Skip to content
This repository was archived by the owner on Nov 15, 2025. It is now read-only.

Commit 16c89e6

Browse files
Devon Pringleyuwata
Devon Pringle
authored and
yuwata
committed
networkd: add RouteDenyList
Allow configuration for IPv6 discovered routes to be ignored instead of adding them as a route. This can be used to block unwanted routes, for example, you may wish to not receive some set of routes on an interface if they are causing issues.
1 parent af42881 commit 16c89e6

File tree

6 files changed

+43
-14
lines changed

6 files changed

+43
-14
lines changed

‎man/systemd.network.xml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2095,7 +2095,16 @@ IPv6Token=prefixstable:2002:da8:1::</programlisting></para>
20952095
<varlistentry>
20962096
<term><varname>DenyList=</varname></term>
20972097
<listitem>
2098-
<para>A whitespace-separated list of IPv6 prefixes. IPv6 prefixes supplied via router advertisements in the list are ignored.</para>
2098+
<para>A whitespace-separated list of IPv6 prefixes. IPv6 prefixes supplied via router
2099+
advertisements in the list are ignored.</para>
2100+
</listitem>
2101+
</varlistentry>
2102+
2103+
<varlistentry>
2104+
<term><varname>RouteDenyList=</varname></term>
2105+
<listitem>
2106+
<para>A whitespace-separated list of IPv6 route prefixes. IPv6 route prefixes supplied via
2107+
router advertisements in the list are ignored.</para>
20992108
</listitem>
21002109
</varlistentry>
21012110

‎src/network/networkd-ndisc.c‎

Lines changed: 27 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -839,6 +839,16 @@ static int ndisc_router_process_route(Link *link, sd_ndisc_router *rt) {
839839
if (r < 0)
840840
return log_link_error_errno(link, r, "Failed to get gateway address from RA: %m");
841841

842+
if (set_contains(link->network->ndisc_deny_listed_route_prefix, &gateway.in6)) {
843+
if (DEBUG_LOGGING) {
844+
_cleanup_free_ char *buf = NULL;
845+
846+
(void) in_addr_to_string(AF_INET6, &gateway, &buf);
847+
log_link_debug(link, "Route Prefix '%s' is deny-listed, ignoring", strnull(buf));
848+
}
849+
return 0;
850+
}
851+
842852
if (link_has_ipv6_address(link, &gateway.in6) == 0) {
843853
if (DEBUG_LOGGING) {
844854
_cleanup_free_ char *buf = NULL;
@@ -1378,8 +1388,8 @@ int config_parse_ndisc_deny_listed_prefix(
13781388
void *data,
13791389
void *userdata) {
13801390

1381-
Network *network = data;
1382-
const char *p;
1391+
Set **list = data;
1392+
bool is_route;
13831393
int r;
13841394

13851395
assert(filename);
@@ -1388,11 +1398,13 @@ int config_parse_ndisc_deny_listed_prefix(
13881398
assert(data);
13891399

13901400
if (isempty(rvalue)) {
1391-
network->ndisc_deny_listed_prefix = set_free_free(network->ndisc_deny_listed_prefix);
1401+
*list = set_free_free(*list);
13921402
return 0;
13931403
}
13941404

1395-
for (p = rvalue;;) {
1405+
is_route = streq_ptr(lvalue, "RouteDenyList");
1406+
1407+
for (const char *p = rvalue;;) {
13961408
_cleanup_free_ char *n = NULL;
13971409
_cleanup_free_ struct in6_addr *a = NULL;
13981410
union in_addr_union ip;
@@ -1402,8 +1414,8 @@ int config_parse_ndisc_deny_listed_prefix(
14021414
return log_oom();
14031415
if (r < 0) {
14041416
log_syntax(unit, LOG_WARNING, filename, line, r,
1405-
"Failed to parse NDisc deny-listed prefix, ignoring assignment: %s",
1406-
rvalue);
1417+
"Failed to parse NDisc deny-listed %sprefix, ignoring assignment: %s",
1418+
is_route ? "route " : "", rvalue);
14071419
return 0;
14081420
}
14091421
if (r == 0)
@@ -1412,20 +1424,24 @@ int config_parse_ndisc_deny_listed_prefix(
14121424
r = in_addr_from_string(AF_INET6, n, &ip);
14131425
if (r < 0) {
14141426
log_syntax(unit, LOG_WARNING, filename, line, r,
1415-
"NDisc deny-listed prefix is invalid, ignoring assignment: %s", n);
1427+
"NDisc deny-listed %sprefix is invalid, ignoring assignment: %s",
1428+
is_route ? "route " : "", n);
14161429
continue;
14171430
}
14181431

1419-
if (set_contains(network->ndisc_deny_listed_prefix, &ip.in6))
1420-
continue;
1421-
14221432
a = newdup(struct in6_addr, &ip.in6, 1);
14231433
if (!a)
14241434
return log_oom();
14251435

1426-
r = set_ensure_consume(&network->ndisc_deny_listed_prefix, &in6_addr_hash_ops, TAKE_PTR(a));
1436+
r = set_ensure_consume(list, &in6_addr_hash_ops, TAKE_PTR(a));
14271437
if (r < 0)
14281438
return log_oom();
1439+
if (r == 0)
1440+
log_syntax(unit, LOG_WARNING, filename, line, 0,
1441+
"NDisc deny-listed %sprefix entry %s is duplicated, ignoring assignment.",
1442+
is_route ? "route " : "", n);
1443+
if (r > 0)
1444+
TAKE_PTR(a);
14291445
}
14301446
}
14311447

‎src/network/networkd-network-gperf.gperf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -237,8 +237,9 @@ IPv6AcceptRA.UseDNS, config_parse_bool,
237237
IPv6AcceptRA.UseDomains, config_parse_dhcp_use_domains, 0, offsetof(Network, ipv6_accept_ra_use_domains)
238238
IPv6AcceptRA.DHCPv6Client, config_parse_ipv6_accept_ra_start_dhcp6_client, 0, offsetof(Network, ipv6_accept_ra_start_dhcp6_client)
239239
IPv6AcceptRA.RouteTable, config_parse_section_route_table, 0, 0
240-
IPv6AcceptRA.DenyList, config_parse_ndisc_deny_listed_prefix, 0, 0
241-
IPv6AcceptRA.BlackList, config_parse_ndisc_deny_listed_prefix, 0, 0
240+
IPv6AcceptRA.DenyList, config_parse_ndisc_deny_listed_prefix, 0, offsetof(Network, ndisc_deny_listed_prefix)
241+
IPv6AcceptRA.BlackList, config_parse_ndisc_deny_listed_prefix, 0, offsetof(Network, ndisc_deny_listed_prefix)
242+
IPv6AcceptRA.RouteDenyList, config_parse_ndisc_deny_listed_prefix, 0, offsetof(Network, ndisc_deny_listed_route_prefix)
242243
DHCPServer.MaxLeaseTimeSec, config_parse_sec, 0, offsetof(Network, dhcp_server_max_lease_time_usec)
243244
DHCPServer.DefaultLeaseTimeSec, config_parse_sec, 0, offsetof(Network, dhcp_server_default_lease_time_usec)
244245
DHCPServer.EmitDNS, config_parse_bool, 0, offsetof(Network, dhcp_server_emit[SD_DHCP_LEASE_DNS].emit)

‎src/network/networkd-network.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -607,6 +607,7 @@ static Network *network_free(Network *network) {
607607
ordered_set_free(network->router_search_domains);
608608
free(network->router_dns);
609609
set_free_free(network->ndisc_deny_listed_prefix);
610+
set_free_free(network->ndisc_deny_listed_route_prefix);
610611

611612
free(network->bridge_name);
612613
free(network->bond_name);

‎src/network/networkd-network.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,7 @@ struct Network {
257257
IPv6AcceptRAStartDHCP6Client ipv6_accept_ra_start_dhcp6_client;
258258
uint32_t ipv6_accept_ra_route_table;
259259
Set *ndisc_deny_listed_prefix;
260+
Set *ndisc_deny_listed_route_prefix;
260261
OrderedSet *ipv6_tokens;
261262

262263
/* LLDP support */

‎test/fuzz/fuzz-network-parser/directives.network‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -312,6 +312,7 @@ UseAutonomousPrefix=
312312
UseOnLinkPrefix=
313313
DenyList=
314314
BlackList=
315+
RouteDenyList=
315316
[DHCPServer]
316317
EmitNTP=
317318
PoolSize=

0 commit comments

Comments
 (0)