ipv6: add flowlabel_consistency sysctl

With the introduction of IPV6_FL_F_REFLECT, there is no guarantee of
flow label unicity. This patch introduces a new sysctl to protect the old
behaviour, enable by default.

Changelog of V3:
 * rename ip6_flowlabel_consistency to flowlabel_consistency
 * use net_info_ratelimited()
 * checkpatch cleanups

Signed-off-by: Florent Fourcot <florent.fourcot@enst-bretagne.fr>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

5 files changed, 25 insertions, 0 deletions

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index c97932c88ea3..5de03740cdd5 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1118,6 +1118,14 @@ bindv6only - BOOLEAN
 
         Default: FALSE (as specified in RFC3493)
 
+flowlabel_consistency - BOOLEAN
+        Protect the consistency (and unicity) of flow label.
+        You have to disable it to use IPV6_FL_F_REFLECT flag on the
+        flow label manager.
+        TRUE: enabled
+        FALSE: disabled
+        Default: TRUE
+
 anycast_src_echo_reply - BOOLEAN
         Controls the use of anycast addresses as source addresses for ICMPv6
         echo reply
diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index 592fecd2e59e..21edaf1f7916 100644
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -27,6 +27,7 @@ struct netns_sysctl_ipv6 {
         int ip6_rt_gc_elasticity;
         int ip6_rt_mtu_expires;
         int ip6_rt_min_advmss;
+        int flowlabel_consistency;
         int icmpv6_time;
         int anycast_src_echo_reply;
 };
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index c921d5d38831..d935889f1008 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -775,6 +775,7 @@ static int __net_init inet6_net_init(struct net *net)
 
         net->ipv6.sysctl.bindv6only = 0;
         net->ipv6.sysctl.icmpv6_time = 1*HZ;
+        net->ipv6.sysctl.flowlabel_consistency = 1;
         atomic_set(&net->ipv6.rt_genid, 0);
 
         err = ipv6_init_mibs(net);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 01bf2524c72a..dfa41bb4e0dc 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -588,8 +588,15 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
 
         case IPV6_FL_A_GET:
                 if (freq.flr_flags & IPV6_FL_F_REFLECT) {
+                        struct net *net = sock_net(sk);
+                        if (net->ipv6.sysctl.flowlabel_consistency) {
+                                net_info_ratelimited("Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable\n");
+                                return -EPERM;
+                        }
+
                         if (sk->sk_protocol != IPPROTO_TCP)
                                 return -ENOPROTOOPT;
+
                         np->repflow = 1;
                         return 0;
                 }
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index b51b2688102c..7f405a168822 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -31,6 +31,13 @@ static struct ctl_table ipv6_table_template[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+        {
+                .procname       = "flowlabel_consistency",
+                .data           = &init_net.ipv6.sysctl.flowlabel_consistency,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
         { }
 };
 
@@ -59,6 +66,7 @@ static int __net_init ipv6_sysctl_net_init(struct net *net)
                 goto out;
         ipv6_table[0].data = &net->ipv6.sysctl.bindv6only;
         ipv6_table[1].data = &net->ipv6.sysctl.anycast_src_echo_reply;
+        ipv6_table[2].data = &net->ipv6.sysctl.flowlabel_consistency;
 
         ipv6_route_table = ipv6_route_sysctl_init(net);
         if (!ipv6_route_table)