From mboxrd@z Thu Jan 1 00:00:00 1970 From: Lorenzo Bianconi Subject: Re: [PATCH net-next 1/2] ipv6: do not set routes if disable_ipv6 has been enabled Date: Thu, 29 Mar 2018 10:19:30 +0200 Message-ID: <20180329081929.GA3186@localhost.localdomain> References: <3635f139e31e1c28803ed6d76743c8d8da2c2d3d.1522166051.git.lorenzo.bianconi@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: davem@davemloft.net, netdev@vger.kernel.org To: David Ahern Return-path: Received: from mail-wm0-f45.google.com ([74.125.82.45]:37795 "EHLO mail-wm0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750716AbeC2ITe (ORCPT ); Thu, 29 Mar 2018 04:19:34 -0400 Received: by mail-wm0-f45.google.com with SMTP id r131so9867746wmb.2 for ; Thu, 29 Mar 2018 01:19:33 -0700 (PDT) Content-Disposition: inline In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: > On 3/27/18 11:11 AM, Lorenzo Bianconi wrote: > > Do not allow to set ipv6 routes from userspace if disable_ipv6 has been > > enabled. The issue can be triggered using the following reproducer: > > > > - sysctl net.ipv6.conf.all.disable_ipv6=1 > > - ip -6 route add a:b:c:d::/64 dev em1 > > - ip -6 route show > > a:b:c:d::/64 dev em1 metric 1024 pref medium > > > > Fix it checking disable_ipv6 value in ip6_route_info_create routine > > > > Signed-off-by: Lorenzo Bianconi > > --- > > net/ipv6/route.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > > index 1d0eaa69874d..672fd7fdb037 100644 > > --- a/net/ipv6/route.c > > +++ b/net/ipv6/route.c > > @@ -2917,6 +2917,11 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, > > if (!dev) > > goto out; > > > > + if (idev->cnf.disable_ipv6) { > > + err = -EACCES; > > you need an extack message telling the user that IPv6 is disabled on the > nexthop device. > Ack, will do in v2. Regards, Lorenzo > > + goto out; > > + } > > + > > if (!(dev->flags & IFF_UP)) { > > NL_SET_ERR_MSG(extack, "Nexthop device is not up"); > > err = -ENETDOWN; > > >