net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.

This commit adds a new sysctl accept_ra_rt_info_min_plen that
defines the minimum acceptable prefix length of Route Information
Options. The new sysctl is intended to be used together with
accept_ra_rt_info_max_plen to configure a range of acceptable
prefix lengths. It is useful to prevent misconfigurations from
unintentionally blackholing too much of the IPv6 address space
(e.g., home routers announcing RIOs for fc00::/7, which is
incorrect).

Signed-off-by: Joel Scherpelz <jscherpelz@google.com>
Acked-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 12 insertions, 0 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8c69768a5c46..dff5beb26a01 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -224,6 +224,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .accept_ra_rtr_pref     = 1,
         .rtr_probe_interval     = 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+        .accept_ra_rt_info_min_plen = 0,
         .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -277,6 +278,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
         .accept_ra_rtr_pref     = 1,
         .rtr_probe_interval     = 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+        .accept_ra_rt_info_min_plen = 0,
         .accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -4979,6 +4981,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_RTR_PROBE_INTERVAL] =
                 jiffies_to_msecs(cnf->rtr_probe_interval);
 #ifdef CONFIG_IPV6_ROUTE_INFO
+        array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;
         array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
 #endif
 #endif
@@ -6122,6 +6125,13 @@ static const struct ctl_table addrconf_sysctl[] = {
         },
 #ifdef CONFIG_IPV6_ROUTE_INFO
         {
+                .procname       = "accept_ra_rt_info_min_plen",
+                .data           = &ipv6_devconf.accept_ra_rt_info_min_plen,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
+        {
                 .procname       = "accept_ra_rt_info_max_plen",
                 .data           = &ipv6_devconf.accept_ra_rt_info_max_plen,
                 .maxlen         = sizeof(int),
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 112ccbc0a8ac..b5812b3f7539 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1418,6 +1418,8 @@ skip_linkparms:
                         if (ri->prefix_len == 0 &&
                             !in6_dev->cnf.accept_ra_defrtr)
                                 continue;
+                        if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
+                                continue;
                         if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
                                 continue;
                         rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,