On Wed, Feb 3, 2021 at 6:29 PM Andreas Roeseler
<andreas.a.roese...@gmail.com> wrote:
>
> Section 8 of RFC 8335 specifies potential security concerns of
> responding to PROBE requests, and states that nodes that support PROBE
> functionality MUST be able to enable/disable responses and it is
> disabled by default.
>
> Add sysctl to enable responses to PROBE messages.
>
> Signed-off-by: Andreas Roeseler <andreas.a.roese...@gmail.com>
> ---
> Changes since v1:
> - Combine patches related to sysctl into one patch
> ---
> include/net/netns/ipv4.h | 1 +
> net/ipv4/sysctl_net_ipv4.c | 7 +++++++
> 2 files changed, 8 insertions(+)
>
> diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
> index 70a2a085dd1a..362388ab40c8 100644
> --- a/include/net/netns/ipv4.h
> +++ b/include/net/netns/ipv4.h
> @@ -85,6 +85,7 @@ struct netns_ipv4 {
> #endif
>
> int sysctl_icmp_echo_ignore_all;
> + int sysctl_icmp_echo_enable_probe;
> int sysctl_icmp_echo_ignore_broadcasts;
> int sysctl_icmp_ignore_bogus_error_responses;
> int sysctl_icmp_ratelimit;
> diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
> index e5798b3b59d2..06b7241bc01d 100644
> --- a/net/ipv4/sysctl_net_ipv4.c
> +++ b/net/ipv4/sysctl_net_ipv4.c
> @@ -599,6 +599,13 @@ static struct ctl_table ipv4_net_table[] = {
> .mode = 0644,
> .proc_handler = proc_dointvec
> },
> + {
> + .procname = "icmp_echo_enable_probe",
> + .data =
> &init_net.ipv4.sysctl_icmp_echo_enable_probe,
> + .maxlen = sizeof(int),
> + .mode = 0644,
> + .proc_handler = proc_dointvec
> + },
proc_dointvec_minmax with zero and one.
