ipv6: Add icmp_echo_ignore_multicast support for ICMPv6

IPv4 has icmp_echo_ignore_broadcast to prevent responding to broadcast pings.
IPv6 needs a similar mechanism.

v1->v2:
- Remove NET_IPV6_ICMP_ECHO_IGNORE_MULTICAST.

Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index acdfb5d2bcaa44a8a0ecdcfcae14202d1ed75bc3..55ea7def46be522e057e911e0eda43ff0e0ec753 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1918,6 +1918,11 @@ echo_ignore_all - BOOLEAN
        requests sent to it over the IPv6 protocol.
        Default: 0
 
+echo_ignore_multicast - BOOLEAN
+       If set non-zero, then the kernel will ignore all ICMP ECHO
+       requests sent to it over the IPv6 protocol via multicast.
+       Default: 0
+
 xfrm6_gc_thresh - INTEGER
        The threshold at which we will start garbage collecting for IPv6
        destination cache entries.  At twice this value the system will

diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
index b028a1dc150ddde3e3535351748cef72af56c1ce..e29aff15acc9176873825e2c813c2e50d62212f8 100644 (file)
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -33,6 +33,7 @@ struct netns_sysctl_ipv6 {
        int auto_flowlabels;
        int icmpv6_time;
        int icmpv6_echo_ignore_all;
+       int icmpv6_echo_ignore_multicast;
        int anycast_src_echo_reply;
        int ip_nonlocal_bind;
        int fwmark_reflect;

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 2f45d2a3e3a33e7e43a3384d1a8fe7a683580919..fdc117de849cb4fb6700fecafbd661e8c4e5cadd 100644 (file)
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -847,6 +847,7 @@ static int __net_init inet6_net_init(struct net *net)
        net->ipv6.sysctl.bindv6only = 0;
        net->ipv6.sysctl.icmpv6_time = 1*HZ;
        net->ipv6.sysctl.icmpv6_echo_ignore_all = 0;
+       net->ipv6.sysctl.icmpv6_echo_ignore_multicast = 0;
        net->ipv6.sysctl.flowlabel_consistency = 1;
        net->ipv6.sysctl.auto_flowlabels = IP6_DEFAULT_AUTO_FLOW_LABELS;
        net->ipv6.sysctl.idgen_retries = 3;

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 802faa2fcc0ed10435d08db62b6f3ca3922ac1b2..0907bcede5e5ef603623043d38a41c25a67610ad 100644 (file)
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -684,6 +684,10 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        struct ipcm6_cookie ipc6;
        u32 mark = IP6_REPLY_MARK(net, skb->mark);
 
+       if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) &&
+           net->ipv6.sysctl.icmpv6_echo_ignore_multicast)
+               return;
+
        saddr = &ipv6_hdr(skb)->daddr;
 
        if (!ipv6_unicast_destination(skb) &&
@@ -1115,6 +1119,13 @@ static struct ctl_table ipv6_icmp_table_template[] = {
                .mode           = 0644,
                .proc_handler = proc_dointvec,
        },
+       {
+               .procname       = "echo_ignore_multicast",
+               .data           = &init_net.ipv6.sysctl.icmpv6_echo_ignore_multicast,
+               .maxlen         = sizeof(int),
+               .mode           = 0644,
+               .proc_handler = proc_dointvec,
+       },
        { },
 };
 
@@ -1129,6 +1140,7 @@ struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
        if (table) {
                table[0].data = &net->ipv6.sysctl.icmpv6_time;
                table[1].data = &net->ipv6.sysctl.icmpv6_echo_ignore_all;
+               table[2].data = &net->ipv6.sysctl.icmpv6_echo_ignore_multicast;
        }
        return table;
 }