From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Ahern Subject: Re: [PATCH net-next 1/2] ipv6: do not set routes if disable_ipv6 has been enabled Date: Wed, 28 Mar 2018 13:12:20 -0600 Message-ID: References: <3635f139e31e1c28803ed6d76743c8d8da2c2d3d.1522166051.git.lorenzo.bianconi@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org To: Lorenzo Bianconi , davem@davemloft.net Return-path: Received: from mail-pf0-f173.google.com ([209.85.192.173]:33764 "EHLO mail-pf0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753644AbeC1TMX (ORCPT ); Wed, 28 Mar 2018 15:12:23 -0400 Received: by mail-pf0-f173.google.com with SMTP id f15so1463334pfn.0 for ; Wed, 28 Mar 2018 12:12:23 -0700 (PDT) In-Reply-To: <3635f139e31e1c28803ed6d76743c8d8da2c2d3d.1522166051.git.lorenzo.bianconi@redhat.com> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 3/27/18 11:11 AM, Lorenzo Bianconi wrote: > Do not allow to set ipv6 routes from userspace if disable_ipv6 has been > enabled. The issue can be triggered using the following reproducer: > > - sysctl net.ipv6.conf.all.disable_ipv6=1 > - ip -6 route add a:b:c:d::/64 dev em1 > - ip -6 route show > a:b:c:d::/64 dev em1 metric 1024 pref medium > > Fix it checking disable_ipv6 value in ip6_route_info_create routine > > Signed-off-by: Lorenzo Bianconi > --- > net/ipv6/route.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/net/ipv6/route.c b/net/ipv6/route.c > index 1d0eaa69874d..672fd7fdb037 100644 > --- a/net/ipv6/route.c > +++ b/net/ipv6/route.c > @@ -2917,6 +2917,11 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, > if (!dev) > goto out; > > + if (idev->cnf.disable_ipv6) { > + err = -EACCES; you need an extack message telling the user that IPv6 is disabled on the nexthop device. > + goto out; > + } > + > if (!(dev->flags & IFF_UP)) { > NL_SET_ERR_MSG(extack, "Nexthop device is not up"); > err = -ENETDOWN; >