7 files changed, 39 insertions, 8 deletions

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index ab42c95f9985..10e216c6e05e 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1210,6 +1210,18 @@ accept_ra_defrtr - BOOLEAN
         Functional default: enabled if accept_ra is enabled.
                             disabled if accept_ra is disabled.
 
+accept_ra_from_local - BOOLEAN
+        Accept RA with source-address that is found on local machine
+        if the RA is otherwise proper and able to be accepted.
+        Default is to NOT accept these as it may be an un-intended
+        network loop.
+
+        Functional default:
+           enabled if accept_ra_from_local is enabled
+               on a specific interface.
+           disabled if accept_ra_from_local is disabled
+               on a specific interface.
+
 accept_ra_pinfo - BOOLEAN
         Learn Prefix Information in Router Advertisement.
 
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index c811300b0b0c..b0f2452f1d58 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -39,6 +39,7 @@ struct ipv6_devconf {
 #endif
         __s32           proxy_ndp;
         __s32           accept_source_route;
+        __s32           accept_ra_from_local;
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
         __s32           optimistic_dad;
 #endif
diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
index 593b0e32d956..efa2666f4b8a 100644
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -163,6 +163,7 @@ enum {
         DEVCONF_MLDV1_UNSOLICITED_REPORT_INTERVAL,
         DEVCONF_MLDV2_UNSOLICITED_REPORT_INTERVAL,
         DEVCONF_SUPPRESS_FRAG_NDISC,
+        DEVCONF_ACCEPT_RA_FROM_LOCAL,
         DEVCONF_MAX
 };
 
diff --git a/include/uapi/linux/sysctl.h b/include/uapi/linux/sysctl.h
index 6d6721341f49..43aaba1cc037 100644
--- a/include/uapi/linux/sysctl.h
+++ b/include/uapi/linux/sysctl.h
@@ -568,6 +568,7 @@ enum {
         NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
         NET_IPV6_PROXY_NDP=23,
         NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
+        NET_IPV6_ACCEPT_RA_FROM_LOCAL=26,
         __NET_IPV6_MAX
 };
 
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 653cbbd9e7ad..e4ba9a5a5ccb 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -522,6 +522,7 @@ static const struct bin_table bin_net_ipv6_conf_var_table[] = {
         { CTL_INT,      NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN,    "accept_ra_rt_info_max_plen" },
         { CTL_INT,      NET_IPV6_PROXY_NDP,                     "proxy_ndp" },
         { CTL_INT,      NET_IPV6_ACCEPT_SOURCE_ROUTE,           "accept_source_route" },
+        { CTL_INT,      NET_IPV6_ACCEPT_RA_FROM_LOCAL,          "accept_ra_from_local" },
         {}
 };
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5667b3003af9..358edd2272ac 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -186,6 +186,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .max_desync_factor      = MAX_DESYNC_FACTOR,
         .max_addresses          = IPV6_MAX_ADDRESSES,
         .accept_ra_defrtr       = 1,
+        .accept_ra_from_local   = 0,
         .accept_ra_pinfo        = 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
         .accept_ra_rtr_pref     = 1,
@@ -222,6 +223,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
         .max_desync_factor      = MAX_DESYNC_FACTOR,
         .max_addresses          = IPV6_MAX_ADDRESSES,
         .accept_ra_defrtr       = 1,
+        .accept_ra_from_local   = 0,
         .accept_ra_pinfo        = 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
         .accept_ra_rtr_pref     = 1,
@@ -4321,6 +4323,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
         array[DEVCONF_NDISC_NOTIFY] = cnf->ndisc_notify;
         array[DEVCONF_SUPPRESS_FRAG_NDISC] = cnf->suppress_frag_ndisc;
+        array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -5168,6 +5171,13 @@ static struct addrconf_sysctl_table
                         .proc_handler   = proc_dointvec
                 },
                 {
+                        .procname       = "accept_ra_from_local",
+                        .data           = &ipv6_devconf.accept_ra_from_local,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec,
+                },
+                {
                         /* sentinel */
                 }
         },
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 736c11c6d266..a845e3d2057e 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1148,11 +1148,15 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                 goto skip_defrtr;
         }
 
-        if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
-                          NULL, 0)) {
+        /* Do not accept RA with source-addr found on local machine unless
+         * accept_ra_from_local is set to true.
+         */
+        if (!(in6_dev->cnf.accept_ra_from_local ||
+              ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
+                            NULL, 0))) {
                 ND_PRINTK(2, info,
-                          "RA: %s, chk_addr failed for dev: %s\n",
-                          __func__, skb->dev->name);
+                          "RA from local address detected on dev: %s: default router ignored\n",
+                          skb->dev->name);
                 goto skip_defrtr;
         }
 
@@ -1290,11 +1294,12 @@ skip_linkparms:
         }
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
-        if (ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
-                          NULL, 0)) {
+        if (!(in6_dev->cnf.accept_ra_from_local ||
+              ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
+                            NULL, 0))) {
                 ND_PRINTK(2, info,
-                          "RA: %s, chk-addr (route info) is false for dev: %s\n",
-                          __func__, skb->dev->name);
+                          "RA from local address detected on dev: %s: router info ignored.\n",
+                          skb->dev->name);
                 goto skip_routeinfo;
         }