| Message ID | 9d167c46fbfb38ab8559695524b5a84449855e1b.1612393368.git.andreas.a.roeseler@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | add support for RFC 8335 PROBE | expand |
On Wed, Feb 3, 2021 at 6:29 PM Andreas Roeseler <andreas.a.roeseler@gmail.com> wrote: > > Section 8 of RFC 8335 specifies potential security concerns of > responding to PROBE requests, and states that nodes that support PROBE > functionality MUST be able to enable/disable responses and it is > disabled by default. > > Add sysctl to enable responses to PROBE messages. > > Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com> > --- > Changes since v1: > - Combine patches related to sysctl into one patch > --- > include/net/netns/ipv4.h | 1 + > net/ipv4/sysctl_net_ipv4.c | 7 +++++++ > 2 files changed, 8 insertions(+) > > diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h > index 70a2a085dd1a..362388ab40c8 100644 > --- a/include/net/netns/ipv4.h > +++ b/include/net/netns/ipv4.h > @@ -85,6 +85,7 @@ struct netns_ipv4 { > #endif > > int sysctl_icmp_echo_ignore_all; > + int sysctl_icmp_echo_enable_probe; > int sysctl_icmp_echo_ignore_broadcasts; > int sysctl_icmp_ignore_bogus_error_responses; > int sysctl_icmp_ratelimit; > diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c > index e5798b3b59d2..06b7241bc01d 100644 > --- a/net/ipv4/sysctl_net_ipv4.c > +++ b/net/ipv4/sysctl_net_ipv4.c > @@ -599,6 +599,13 @@ static struct ctl_table ipv4_net_table[] = { > .mode = 0644, > .proc_handler = proc_dointvec > }, > + { > + .procname = "icmp_echo_enable_probe", > + .data = &init_net.ipv4.sysctl_icmp_echo_enable_probe, > + .maxlen = sizeof(int), > + .mode = 0644, > + .proc_handler = proc_dointvec > + }, proc_dointvec_minmax with zero and one.
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h index 70a2a085dd1a..362388ab40c8 100644 --- a/include/net/netns/ipv4.h +++ b/include/net/netns/ipv4.h @@ -85,6 +85,7 @@ struct netns_ipv4 { #endif int sysctl_icmp_echo_ignore_all; + int sysctl_icmp_echo_enable_probe; int sysctl_icmp_echo_ignore_broadcasts; int sysctl_icmp_ignore_bogus_error_responses; int sysctl_icmp_ratelimit; diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c index e5798b3b59d2..06b7241bc01d 100644 --- a/net/ipv4/sysctl_net_ipv4.c +++ b/net/ipv4/sysctl_net_ipv4.c @@ -599,6 +599,13 @@ static struct ctl_table ipv4_net_table[] = { .mode = 0644, .proc_handler = proc_dointvec }, + { + .procname = "icmp_echo_enable_probe", + .data = &init_net.ipv4.sysctl_icmp_echo_enable_probe, + .maxlen = sizeof(int), + .mode = 0644, + .proc_handler = proc_dointvec + }, { .procname = "icmp_echo_ignore_broadcasts", .data = &init_net.ipv4.sysctl_icmp_echo_ignore_broadcasts,
Section 8 of RFC 8335 specifies potential security concerns of responding to PROBE requests, and states that nodes that support PROBE functionality MUST be able to enable/disable responses and it is disabled by default. Add sysctl to enable responses to PROBE messages. Signed-off-by: Andreas Roeseler <andreas.a.roeseler@gmail.com> --- Changes since v1: - Combine patches related to sysctl into one patch --- include/net/netns/ipv4.h | 1 + net/ipv4/sysctl_net_ipv4.c | 7 +++++++ 2 files changed, 8 insertions(+)