netdev - Re: [PATCH net-next v3] net: add sysctl to disable rfc4862 5.5.3e lifetime handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 20 Sep 2023 08:37:27 -0600
From: David Ahern <dsahern@...nel.org>
To: Patrick Rohr <prohr@...gle.com>, "David S. Miller" <davem@...emloft.net>
Cc: Linux Network Development Mailing List <netdev@...r.kernel.org>,
 Maciej Żenczykowski <maze@...gle.com>,
 Lorenzo Colitti <lorenzo@...gle.com>, Jen Linkova <furry@...gle.com>,
 Jiri Pirko <jiri@...nulli.us>
Subject: Re: [PATCH net-next v3] net: add sysctl to disable rfc4862 5.5.3e
 lifetime handling

On 9/19/23 12:04 PM, Patrick Rohr wrote:
> This change adds a sysctl to opt-out of RFC4862 section 5.5.3e's valid
> lifetime derivation mechanism.
> 
> RFC4862 section 5.5.3e prescribes that the valid lifetime in a Router
> Advertisement PIO shall be ignored if it less than 2 hours and to reset
> the lifetime of the corresponding address to 2 hours. An in-progress
> 6man draft (see draft-ietf-6man-slaac-renum-07 section 4.2) is currently
> looking to remove this mechanism. While this draft has not been moving
> particularly quickly for other reasons, there is widespread consensus on
> section 4.2 which updates RFC4862 section 5.5.3e.
> 
> Cc: Maciej Żenczykowski <maze@...gle.com>
> Cc: Lorenzo Colitti <lorenzo@...gle.com>
> Cc: Jen Linkova <furry@...gle.com>
> Cc: Jiri Pirko <jiri@...nulli.us>
> Signed-off-by: Patrick Rohr <prohr@...gle.com>
> ---
>  Documentation/networking/ip-sysctl.rst | 11 ++++++++
>  include/linux/ipv6.h                   |  1 +
>  net/ipv6/addrconf.c                    | 38 +++++++++++++++++---------
>  3 files changed, 37 insertions(+), 13 deletions(-)
> 
> diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
> index a66054d0763a..45d700e04dba 100644
> --- a/Documentation/networking/ip-sysctl.rst
> +++ b/Documentation/networking/ip-sysctl.rst
> @@ -2304,6 +2304,17 @@ accept_ra_pinfo - BOOLEAN
>  		- enabled if accept_ra is enabled.
>  		- disabled if accept_ra is disabled.
>  
> +ra_honor_pio_life - BOOLEAN
> +	Whether to use RFC4862 Section 5.5.3e to determine the valid
> +	lifetime of an address matching a prefix sent in a Router
> +	Advertisement Prefix Information Option.
> +
> +	- If enabled, the PIO valid lifetime will always be honored.
> +	- If disabled, RFC4862 section 5.5.3e is used to determine
> +	  the valid lifetime of the address.
> +
> +	Default: 0 (disabled)
> +
>  accept_ra_rt_info_min_plen - INTEGER
>  	Minimum prefix length of Route Information in RA.
>  
> diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
> index 5883551b1ee8..59fcc4fee7b7 100644
> --- a/include/linux/ipv6.h
> +++ b/include/linux/ipv6.h
> @@ -35,6 +35,7 @@ struct ipv6_devconf {
>  	__s32		accept_ra_min_hop_limit;
>  	__s32		accept_ra_min_lft;
>  	__s32		accept_ra_pinfo;
> +	__s32		ra_honor_pio_life;

Any reason for this to be 4B entry for a boolean? all of these __s32
entries for what are really booleans is pushing devconf size over 256B
which means allocations are 512B. Unnecessary waste of memory.