diff options
| author | David Ahern <dsahern@gmail.com> | 2019-04-16 17:31:43 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-17 23:19:07 -0700 |
| commit | b8fb1ab46169ac016a8552a6455bb0bfc401f8e2 (patch) | |
| tree | a7d8430a9044e9e3203915f401e68abfd6e30c31 /include/net/neighbour.h | |
| parent | cea29a70727e7885b3fdf0d266a57818652a89c1 (diff) | |
net ipv6: Prevent neighbor add if protocol is disabled on device
Disabling IPv6 on an interface removes existing entries but nothing prevents
new entries from being manually added. To that end, add a new neigh_table
operation, allow_add, that is called on RTM_NEWNEIGH to see if neighbor
entries are allowed on a given device. If IPv6 is disabled on the device,
allow_add returns false and passes a message back to the user via extack.
$ echo 1 > /proc/sys/net/ipv6/conf/eth1/disable_ipv6
$ ip -6 neigh add fe80::4c88:bff:fe21:2704 dev eth1 lladdr de:ad:be:ef:01:01
Error: IPv6 is disabled on this device.
Signed-off-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net/neighbour.h')
| -rw-r--r-- | include/net/neighbour.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/include/net/neighbour.h b/include/net/neighbour.h index 3e5438bd0101..50a67bd6a434 100644 --- a/include/net/neighbour.h +++ b/include/net/neighbour.h @@ -205,6 +205,8 @@ struct neigh_table { int (*pconstructor)(struct pneigh_entry *); void (*pdestructor)(struct pneigh_entry *); void (*proxy_redo)(struct sk_buff *skb); + bool (*allow_add)(const struct net_device *dev, + struct netlink_ext_ack *extack); char *id; struct neigh_parms parms; struct list_head parms_list; |