Am 22.02.2013 16:21, schrieb Alexander Holler:
Hello,
I'm searching for a way to either enforce IPV6_V6ONLY or to block
IPv4-mapped addresses on ipv6-sockets (e.g. by using iptables) system-wide.
E.g. net.ipv6.bindv6only doesn't help if something calls
int v6on = 0;
setsockopt(sd, IPPROTO_IPV6, IPV6_V6ONLY, (char *)&v6on, sizeof(v6on))
In such a case I still want to disable or block IPv4-mapped addresses on
that socket, even if the program thinks it nows it better.
Until now I haven't found a solution.
I've now done it by the following hack:
-----------
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index d1e2e8e..9eefd3e 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -235,7 +235,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int
level, int optname,
if (optlen < sizeof(int) ||
inet_sk(sk)->inet_num)
goto e_inval;
- np->ipv6only = valbool;
+ np->ipv6only = valbool || net->ipv6.sysctl.bindv6only;
retv = 0;
break;
-----------
A proper solution would be to either return false if net.ipv6.bindv6only
is true and optval is false (which would break downward compatibility
because it wouldn't just be a default and setsockopt might return an
error) or to introduce a new sysctl variable like
net.ipv6.bindv6only_enforced_silently. ("silently" because setsockopt()
wouldn't return an error if net.ipv6.bindv6only is true and optval
(v6only in the example above) is false.)
I would volunteer to write a patch which introduces something like
net.ipv6.bindv6only_enforced_silently if some maintainer would give me
his ok.
If so, the question remains if
systemctl net.ipv6.bindv6only_enforced_silently = 1
should set systemctl.net.ipv6.bindv6only too or if an error should be
returned if net.ipv6.bindv6only is false.
Regards,
Alexander
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
