In sysctl, the /proc/sys/net/ipv[46]/conf/ keys have the following subkeys: all, default, and a key for each network interface. For example, on a machine with a single network interface eth0, it will look like this:

iserv ~ # ll /proc/sys/net/ipv[46]/conf/
insgesamt 0
dr-xr-xr-x 0 root root 0 12. Sep 23:30 all/
dr-xr-xr-x 0 root root 0 12. Sep 23:30 default/
dr-xr-xr-x 0 root root 0 12. Sep 23:30 eth0/
dr-xr-xr-x 0 root root 0 12. Sep 23:30 lo/

insgesamt 0
dr-xr-xr-x 0 root root 0 12. Sep 23:30 all/
dr-xr-xr-x 0 root root 0 12. Sep 23:30 default/
dr-xr-xr-x 0 root root 0 12. Sep 23:30 eth0/
dr-xr-xr-x 0 root root 0 12. Sep 23:30 lo/

All the respective settings exist in each key separately. For example, if I want to disable IPv6 Router Advertisements with the accept_ra value, this value exists four times:

iserv ~ # sysctl -a 2>/dev/null | grep "accept_ra "
net.ipv6.conf.all.accept_ra = 1
net.ipv6.conf.default.accept_ra = 1
net.ipv6.conf.lo.accept_ra = 1
net.ipv6.conf.eth0.accept_ra = 1

My question now is: which of these values do I need to change? I figured all (to change all existing interfaces) and default (to change all new interfaces that may appear later), but changing these still leaves the value at 1 for lo and eth0:

iserv ~ # sysctl -w net.ipv6.conf.all.accept_ra=0
net.ipv6.conf.all.accept_ra = 0
iserv ~ # sysctl -w net.ipv6.conf.default.accept_ra=0
net.ipv6.conf.default.accept_ra = 0
iserv ~ # sysctl -a 2>/dev/null | grep "accept_ra "  
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
net.ipv6.conf.lo.accept_ra = 1
net.ipv6.conf.eth0.accept_ra = 1

Will the machine now accept Router Advertisements on eth0, or will it not?


I've found the answer while still writing the question. I've decided to post it anyway because others may find this insightful, and then answer it myself; I hope this is not frowned upon :)

The user Philipp Matthias Hahn on the linux-kernel mailing list has figured it out at least partially:

As far as I researched for IPv4 some time ago, the "default" value gets
copied to newly created interfaces only once.
"all" on the other hand allways gets applied in addition to the current
setting, but it depends on the exact setting, if its ORed, ANDed, or
    log_martians         OR
    accept_redirects     AND
    forwarding           ?
    mc_forwarding        AND
    proxy_arp            OR
    shared_media         OR
    secure_redirects     OR
    send_redirects       OR
    bootp_relay          AND
    accept_source_route  AND
    rp_filter            AND
    arp_filter           OR
    arp_announce         MAX
    arp_ignore           MAX
(see include/linux/inetdevice.h:83 for IN_DEV_{AND,OR,MAX}CONF)

Putting a new value in "all" doesn't change the value you read from
"$interface", but it only gets computed and used internally.

He doesn't cover accept_ra but at least it's clear now how all and default work, or rather, how they do not work as I would have expected.

| improve this answer | |

The handler for accept_ra in net/ipv6/addrconf.c is proc_dointvec. So generic interface code has previously generated an array of all and interface-specific entries, and writing into these with sysctl or procfs just puts the value you specify in the array.

We are concerned with how those values are then used

You'll see from callers of ipv6_accept_ra() function in include/net/ipv6.h that every caller uses a specific interface to call that function.

So there is nowhere in the kernel that net.ipv6.conf.all.accept_ra is ever used except to store a procfs entry, as far as I can see.

If you want to change accept_ra of every interface with one command, you can do this:

for TUNABLE in $(sysctl -aN --pattern "accept_ra$")
    sysctl -w "$TUNABLE=0"

I'm about 4 years late but this is the correct answer :P

| improve this answer | |
  • sysctl (procps version 3.2.8): error: Unknown parameter "-aN" – qin Jul 19 '19 at 2:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.