Re: [PATCH net-next] Revert "net/ipv6: add sysctl option accept_ra_min_hop_limit"

YOSHIFUJI Hideaki [off-list ref] wrote:

Sabrina Dubroca wrote:

quoted

2015-09-10, 14:52:45 +0900, YOSHIFUJI Hideaki wrote:

quoted

Sabrina Dubroca wrote:

quoted

Would you agree with a default of 64, as Florian suggested?

1 was chosen to restore our behavior before introduction of current
hoplimit check.  I am not in favor of changing that value.

But our old behavior had a security issue, which is why the >= current
check was introduced.

We have the knob to "protect" ourselves now but it has drawbacks no to
accept lower values than specified.  We can never have ultimate default
for everybody.  The knob might "mitigate" the issue but once we have
any rouge routers on our L2, we lose anyway.  So, I do want to keep it
as-is not to change our traditional behavior.

If that argument is brough forward (and it's a good point!), then the
entire case for rejecting 'low' hoplimit values in first place becomes moot.

If this is an important security issue, then either the sysctl has to be
removed or the default raised to some 'safe' value (32, for example).

If its not a security issue -- and it isn't if we think "1" is a good
default choice -- then we should seriously consider reverting both
the added sysctl and the 'original' commit (6fd99094de2b; "ipv6: Don't
reduce hop limit for an interface").

Cheers,
Florian