netdev - Re: PROBLEM: IPv6 autoconf/accept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 24 Mar 2009 21:49:31 -0400
From:	Brian Haley <brian.haley@...com>
To:	Kolbjørn Barmen <linux@...la.no>
CC:	David Miller <davem@...emloft.net>, yoshfuji@...paulia.net,
	netdev@...r.kernel.org, yoshfuji@...ux-ipv6.org
Subject: Re: PROBLEM: IPv6 autoconf/accept_ra default values

Kolbjørn Barmen wrote:
>> Are the two parameters he described for this going to be good enough for
>> you?  I was thinking of also adding a "default" keyword to control
>> net.ipv6.conf.default.*, for example:
>>
>> 	disable_ipv6=all,default,eth0,eth1
>> 	autoconf=all,default,eth2,eth3
>>
>> This is because "default" is what's inherited by all the ethX values,
>> "all" is the big hammer.
> 
> This is still unclear for me. I've been assuming that by changing
> "default" all future devices will inherit the value, but leaving existing
> devices as is. "all" I've assumed takes all existing interfaces, but
> leaving default as is. Is this what you are saying?

"default" is what's inherited by future devices, "all" is supposed to be the
over-ride for all devices, but doesn't change any device-specific values.

>> Of course I could be over-thinking this and the simple solution could work just
>> fine:
>>
>> 	disable_ipv6=1
>> 	autoconf=0
>>
>> Then just let you put things in sysctl.conf to enable what you want.  I'll play
>> with that first to see if it's enough.
> 
> I think this would be enough yes. Probably best to think about how one
> would be able to set boot paramets so that a machine gets static address
> and no autoconf, for example for NFS-root etc. This falls under same
> "mission"?

My patch wouldn't address getting a static address via a module parameter, that
can still be done in, for example, /etc/network/interfaces.  So no, this isn't
part of my "mission", just getting the basic functionality in place.

>>> How about the behaviour that I described:
>>>
>>>     root:~# sysctl net.ipv6.conf.all.accept_ra 
>>>     net.ipv6.conf.all.accept_ra = 1 
>>>     root:~# sysctl -w net.ipv6.conf.all.accept_ra=0 
>>>     net.ipv6.conf.all.accept_ra = 0 
>>>     root:~# sysctl net.ipv6.conf.eth0.accept_ra 
>>>     net.ipv6.conf.all.accept_ra = 1  
>>>
>>> Is this intended behaviour or not? Bug or (mis)feature?
>> I *think* that's intended, at least it's one of the ways IPv6 differs from IPv4
>> - setting "all" doesn't reset to individual nic settings.  But the code in
>> ndisc_router_discovery() should probably check the "all" flag and drop the RA.
>> The other "all" sysctl's should behave the same, so someone needs to take a
>> deeper look.
> 
> OK, I have this weird feeling that this "worked" some years ago, but I
> dont have any old systems to try out that theory on. I fail to see wht
> purpose "all" has, if it isn't setting the value of all interfaces.

I fixed the autoconf one, but this would still need to be addressed in a future
patch, trying to sneak-in before the deadline.  Might be too late...

I sent the actual patch to netdev a few minutes ago for review.

-Brian
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html