Re: [RFC PATCHv2] ipv6: implementation of reverse path filtering

[Eric Dumazet <eric.dumazet@gmail.com>]

Le lundi 06 juin 2011 à 19:53 +0200, Eric Leblond a écrit :
> This patch provides a basic implementation of reverse path filtering
> for IPv6. Functionnality can be activatedor desactivated through an
> rp_filter entry similar to the IPv4 one.
> 
> The functionnality is disabled by default for backward compatibility
> but should be enable on all IPv6 routers/firewalls for security reason.
> 
> This implementation is heavily based on the patch Denis Semmau proposed
> in 2006.
> 
> Signed-off-by: Eric Leblond <eric@regit.org>
> ---
>  include/linux/ipv6.h   |    2 ++
>  include/linux/sysctl.h |    1 +
>  net/ipv6/addrconf.c    |   10 ++++++++++
>  net/ipv6/ip6_output.c  |   35 +++++++++++++++++++++++++++++++++++
>  4 files changed, 48 insertions(+), 0 deletions(-)
> 
> diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
> index 0c99776..6b61869 100644
> --- a/include/linux/ipv6.h
> +++ b/include/linux/ipv6.h
> @@ -172,6 +172,7 @@ struct ipv6_devconf {
>  	__s32		disable_ipv6;
>  	__s32		accept_dad;
>  	__s32		force_tllao;
> +	__s32		rp_filter;
>  	void		*sysctl;
>  };
>  
> @@ -213,6 +214,7 @@ enum {
>  	DEVCONF_DISABLE_IPV6,
>  	DEVCONF_ACCEPT_DAD,
>  	DEVCONF_FORCE_TLLAO,
> +	DEVCONF_RP_FILTER,
>  	DEVCONF_MAX
>  };
>  
> diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
> index 11684d9..bdcb7f8 100644
> --- a/include/linux/sysctl.h
> +++ b/include/linux/sysctl.h
> @@ -568,6 +568,7 @@ enum {
>  	NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN=22,
>  	NET_IPV6_PROXY_NDP=23,
>  	NET_IPV6_ACCEPT_SOURCE_ROUTE=25,
> +	NET_IPV6_RP_FILTER=26,


not needed ?

>  	__NET_IPV6_MAX
>  };
>  
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index 498b927..ba1c574 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -196,6 +196,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
>  	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
>  	.disable_ipv6		= 0,
>  	.accept_dad		= 1,
> +	.rp_filter		= 0,
>  };
>  
>  static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
> @@ -230,6 +231,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
>  	.accept_source_route	= 0,	/* we do not accept RH0 by default. */
>  	.disable_ipv6		= 0,
>  	.accept_dad		= 1,
> +	.rp_filter		= 0,
>  };
>  
>  /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
> @@ -3805,6 +3807,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
>  	array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
>  	array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
>  	array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
> +	array[DEVCONF_RP_FILTER] = cnf->rp_filter;
>  }
>  
>  static inline size_t inet6_ifla6_size(void)
> @@ -4459,6 +4462,13 @@ static struct addrconf_sysctl_table
>  			.proc_handler   = proc_dointvec
>  		},
>  		{
> +			.procname       = "rp_filter",
> +			.data           = &ipv6_devconf.rp_filter,
> +			.maxlen         = sizeof(int),
> +			.mode           = 0644,
> +			.proc_handler   = proc_dointvec
> +		},
> +		{
>  			/* sentinel */
>  		}
>  	},
> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 9d4b165..ad8f351 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -374,6 +374,22 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
>  	return 0;
>  }
>  
> +static int rt6_validate_source(struct sk_buff *skb, char mode)
> +{
> +	struct rt6_info *rt;
> +	struct ipv6hdr *hdr = ipv6_hdr(skb);
> +	if (mode == 0)
> +		return 0;
> +	rt = rt6_lookup(dev_net(skb->dev), &hdr->saddr, NULL, 0, 0);
> +	if (rt != NULL) {

	route leak ?  you need dst_release(&rt->dst); [ and/or rcu ;) ]

> +		if ((mode >= 2) && rt->rt6i_idev->dev)
> +			return 0;
> +		if ((mode == 1) && (rt->rt6i_idev->dev == skb->dev))
> +			return 0;
> +	}
> +	return -1;
> +}
> +