Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 07:00:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ipv6: add option to drop unsolicited neighbor advertisements

Browse Source 
In certain 802.11 wireless deployments, there will be NA proxies
that use knowledge of the network to correctly answer requests.
To prevent unsolicitd advertisements on the shared medium from
being a problem, on such deployments wireless needs to drop them.

Enable this by providing an option called "drop_unsolicited_na".

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Johannes Berg 2016-02-04 13:31:20 +01:00 committed by David S. Miller
parent abbc30436d
commit 7a02bf892d
5 changed files with 26 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Documentation/networking/ip-sysctl.txt
View File

@ -1680,6 +1680,13 @@ drop_unicast_in_l2_multicast - BOOLEAN
By default this is turned off. By default this is turned off.
drop_unsolicited_na - BOOLEAN
Drop all unsolicited neighbor advertisements, for example if there's
a known good NA proxy on the network and such frames need not be used
(or in the case of 802.11, must not be used to prevent attacks.)
By default this is turned off.
icmp/*: icmp/*:
ratelimit - INTEGER ratelimit - INTEGER
Limit the maximal rates for sending ICMPv6 packets. Limit the maximal rates for sending ICMPv6 packets.

1
include/linux/ipv6.h
View File

@ -56,6 +56,7 @@ struct ipv6_devconf {
__s32 ndisc_notify; __s32 ndisc_notify;
__s32 suppress_frag_ndisc; __s32 suppress_frag_ndisc;
__s32 accept_ra_mtu; __s32 accept_ra_mtu;
__s32 drop_unsolicited_na;
struct ipv6_stable_secret { struct ipv6_stable_secret {
bool initialized; bool initialized;
struct in6_addr secret; struct in6_addr secret;

1
include/uapi/linux/ipv6.h
View File

@ -175,6 +175,7 @@ enum {
DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT, DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT,
DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN, DEVCONF_IGNORE_ROUTES_WITH_LINKDOWN,
DEVCONF_DROP_UNICAST_IN_L2_MULTICAST, DEVCONF_DROP_UNICAST_IN_L2_MULTICAST,
DEVCONF_DROP_UNSOLICITED_NA,
DEVCONF_MAX DEVCONF_MAX
}; };

8
net/ipv6/addrconf.c
View File

@ -4712,6 +4712,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
/* we omit DEVCONF_STABLE_SECRET for now */ /* we omit DEVCONF_STABLE_SECRET for now */
array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only; array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
array[DEVCONF_DROP_UNICAST_IN_L2_MULTICAST] = cnf->drop_unicast_in_l2_multicast; array[DEVCONF_DROP_UNICAST_IN_L2_MULTICAST] = cnf->drop_unicast_in_l2_multicast;
array[DEVCONF_DROP_UNSOLICITED_NA] = cnf->drop_unsolicited_na;
} }
static inline size_t inet6_ifla6_size(void) static inline size_t inet6_ifla6_size(void)
@ -5792,6 +5793,13 @@ static struct addrconf_sysctl_table
.mode = 0644, .mode = 0644,
.proc_handler = proc_dointvec, .proc_handler = proc_dointvec,
}, },
{
.procname = "drop_unsolicited_na",
.data = &ipv6_devconf.drop_unsolicited_na,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
},
{ {
/* sentinel */ /* sentinel */
} }

9
net/ipv6/ndisc.c
View File

@ -883,6 +883,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
offsetof(struct nd_msg, opt)); offsetof(struct nd_msg, opt));
struct ndisc_options ndopts; struct ndisc_options ndopts;
struct net_device *dev = skb->dev; struct net_device *dev = skb->dev;
struct inet6_dev *idev = __in6_dev_get(dev);
struct inet6_ifaddr *ifp; struct inet6_ifaddr *ifp;
struct neighbour *neigh; struct neighbour *neigh;
@ -902,6 +903,14 @@ static void ndisc_recv_na(struct sk_buff *skb)
return; return;
} }
/* For some 802.11 wireless deployments (and possibly other networks),
* there will be a NA proxy and unsolicitd packets are attacks
* and thus should not be accepted.
*/
if (!msg->icmph.icmp6_solicited && idev &&
idev->cnf.drop_unsolicited_na)
return;
if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) { if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts)) {
ND_PRINTK(2, warn, "NS: invalid ND option\n"); ND_PRINTK(2, warn, "NS: invalid ND option\n");
return; return;