diff options
| author | Lorenzo Bianconi <lorenzo.bianconi@redhat.com> | 2018-03-29 11:02:24 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-03-30 12:20:52 -0400 |
| commit | 428604fb118facce1309670779a35baf27ad044c (patch) | |
| tree | 221bdc475ea73f115318fe02f852f195b75f055c /net/ipv6 | |
| parent | d162190bded8b3f635d1ba1e27e63d1b4a720ba8 (diff) | |
ipv6: do not set routes if disable_ipv6 has been enabled
Do not allow setting ipv6 routes from userspace if disable_ipv6 has been
enabled. The issue can be triggered using the following reproducer:
- sysctl net.ipv6.conf.all.disable_ipv6=1
- ip -6 route add a:b:c:d::/64 dev em1
- ip -6 route show
a:b:c:d::/64 dev em1 metric 1024 pref medium
Fix it checking disable_ipv6 value in ip6_route_info_create routine
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/route.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index ba8d5df50ebe..e461ef1158b6 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2917,6 +2917,12 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, if (!dev) goto out; + if (idev->cnf.disable_ipv6) { + NL_SET_ERR_MSG(extack, "IPv6 is disabled on nexthop device"); + err = -EACCES; + goto out; + } + if (!(dev->flags & IFF_UP)) { NL_SET_ERR_MSG(extack, "Nexthop device is not up"); err = -ENETDOWN; |