IPv6: behavior of the all/per device forwarding controls in /proc/sys/net/ipv6

[Peter Bieringer <pb@xxxxxxxxxxxx>]

Hi,

I have a question regarding the use of the forwarding switches in the IPv6 
part of /proc

Scenario:
Internal host --- native IPv6 --- (eth0)local tunnel server(sit0) --- 
tunneled IPv6 --- 6bone

On my "local tunnel server" (2.2.19pre16) are currently following switches 
available:
# find /proc/sys/net/ipv6 -name 'forward*'
/proc/sys/net/ipv6/conf/sit1/forwarding
/proc/sys/net/ipv6/conf/sit0/forwarding
/proc/sys/net/ipv6/conf/eth1/forwarding
/proc/sys/net/ipv6/conf/eth0/forwarding
/proc/sys/net/ipv6/conf/lo/forwarding
/proc/sys/net/ipv6/conf/default/forwarding
/proc/sys/net/ipv6/conf/all/forwarding


IPv6 routing from "internal host" to 6bone only works if following 
forwarding switches are set like
/proc/sys/net/ipv6/conf/eth0/forwarding = 1
/proc/sys/net/ipv6/conf/sit0/forwarding = 1
/proc/sys/net/ipv6/conf/all/forwarding  = 1

But if I set "/proc/sys/net/ipv6/conf/all/forwarding" to "1", all dedicated 
device switches are also set to "1". This is the same behavior like in 
IPv4, but unlike in IPv4, if "/proc/sys/net/ipv6/conf/all/forwarding" = 0, 
IPv6 routing is generally disabled.

Therefore
/proc/sys/net/ipv6/conf/eth0/forwarding = 1
/proc/sys/net/ipv6/conf/sit0/forwarding = 1
/proc/sys/net/ipv6/conf/all/forwarding  = 0
doesn't route anything.

That's bad for security issues, because if someone will only enable 
dedicated devices for IPv6 routing, he must first globally enable IPv6 
routing with
/proc/sys/net/ipv6/conf/all/forwarding  = 1

and then afterwards for each *do not IPv6 routing device* disable 
forwarding like
/proc/sys/net/ipv6/conf/eth1/forwarding = 0


Therefore 2 questions:
a) is this a bug or a feature
b) why is it different to IPv4 where routing still works, if
/proc/sys/net/ipv4/ip_forward = /proc/sys/net/ipv4/conf/all/forwarding = 0
/proc/sys/net/ipv4/conf/eth0/forwarding = 1
/proc/sys/net/ipv4/conf/ppp0/forwarding = 1
(Tested with masquerading, which take also use of such switches)


My opinion is that IPv6 routing should only depends on the "per device" 
switches and "all" only toggles all "per device" switches in one direction, 
but do not switch routing capabilities - this is better for security issues.

TIA,
        Peter