1 files changed, 140 insertions, 93 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 21c2c818df3b..53e3a9d756b0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -195,6 +195,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .max_addresses          = IPV6_MAX_ADDRESSES,
         .accept_ra_defrtr       = 1,
         .accept_ra_from_local   = 0,
+        .accept_ra_min_hop_limit= 1,
         .accept_ra_pinfo        = 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
         .accept_ra_rtr_pref     = 1,
@@ -211,7 +212,8 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .accept_ra_mtu          = 1,
         .stable_secret          = {
                 .initialized = false,
-        }
+        },
+        .use_oif_addrs_only     = 0,
 };
 
 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -236,6 +238,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
         .max_addresses          = IPV6_MAX_ADDRESSES,
         .accept_ra_defrtr       = 1,
         .accept_ra_from_local   = 0,
+        .accept_ra_min_hop_limit= 1,
         .accept_ra_pinfo        = 1,
 #ifdef CONFIG_IPV6_ROUTER_PREF
         .accept_ra_rtr_pref     = 1,
@@ -253,6 +256,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
         .stable_secret          = {
                 .initialized = false,
         },
+        .use_oif_addrs_only     = 0,
 };
 
 /* Check if a valid qdisc is available */
@@ -1358,15 +1362,96 @@ out:
         return ret;
 }
 
+static int __ipv6_dev_get_saddr(struct net *net,
+                                struct ipv6_saddr_dst *dst,
+                                struct inet6_dev *idev,
+                                struct ipv6_saddr_score *scores,
+                                int hiscore_idx)
+{
+        struct ipv6_saddr_score *score = &scores[1 - hiscore_idx], *hiscore = &scores[hiscore_idx];
+
+        read_lock_bh(&idev->lock);
+        list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
+                int i;
+
+                /*
+                 * - Tentative Address (RFC2462 section 5.4)
+                 *  - A tentative address is not considered
+                 *    "assigned to an interface" in the traditional
+                 *    sense, unless it is also flagged as optimistic.
+                 * - Candidate Source Address (section 4)
+                 *  - In any case, anycast addresses, multicast
+                 *    addresses, and the unspecified address MUST
+                 *    NOT be included in a candidate set.
+                 */
+                if ((score->ifa->flags & IFA_F_TENTATIVE) &&
+                    (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
+                        continue;
+
+                score->addr_type = __ipv6_addr_type(&score->ifa->addr);
+
+                if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
+                             score->addr_type & IPV6_ADDR_MULTICAST)) {
+                        net_dbg_ratelimited("ADDRCONF: unspecified / multicast address assigned as unicast address on %s",
+                                            idev->dev->name);
+                        continue;
+                }
+
+                score->rule = -1;
+                bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
+
+                for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
+                        int minihiscore, miniscore;
+
+                        minihiscore = ipv6_get_saddr_eval(net, hiscore, dst, i);
+                        miniscore = ipv6_get_saddr_eval(net, score, dst, i);
+
+                        if (minihiscore > miniscore) {
+                                if (i == IPV6_SADDR_RULE_SCOPE &&
+                                    score->scopedist > 0) {
+                                        /*
+                                         * special case:
+                                         * each remaining entry
+                                         * has too small (not enough)
+                                         * scope, because ifa entries
+                                         * are sorted by their scope
+                                         * values.
+                                         */
+                                        goto out;
+                                }
+                                break;
+                        } else if (minihiscore < miniscore) {
+                                if (hiscore->ifa)
+                                        in6_ifa_put(hiscore->ifa);
+
+                                in6_ifa_hold(score->ifa);
+
+                                swap(hiscore, score);
+                                hiscore_idx = 1 - hiscore_idx;
+
+                                /* restore our iterator */
+                                score->ifa = hiscore->ifa;
+
+                                break;
+                        }
+                }
+        }
+out:
+        read_unlock_bh(&idev->lock);
+        return hiscore_idx;
+}
+
 int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
                        const struct in6_addr *daddr, unsigned int prefs,
                        struct in6_addr *saddr)
 {
-        struct ipv6_saddr_score scores[2],
-                                *score = &scores[0], *hiscore = &scores[1];
+        struct ipv6_saddr_score scores[2], *hiscore;
         struct ipv6_saddr_dst dst;
+        struct inet6_dev *idev;
         struct net_device *dev;
         int dst_type;
+        bool use_oif_addr = false;
+        int hiscore_idx = 0;
 
         dst_type = __ipv6_addr_type(daddr);
         dst.addr = daddr;
@@ -1375,105 +1460,50 @@ int ipv6_dev_get_saddr(struct net *net, const struct net_device *dst_dev,
         dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
         dst.prefs = prefs;
 
-        hiscore->rule = -1;
-        hiscore->ifa = NULL;
+        scores[hiscore_idx].rule = -1;
+        scores[hiscore_idx].ifa = NULL;
 
         rcu_read_lock();
 
-        for_each_netdev_rcu(net, dev) {
-                struct inet6_dev *idev;
-
-                /* Candidate Source Address (section 4)
-                 *  - multicast and link-local destination address,
-                 *    the set of candidate source address MUST only
-                 *    include addresses assigned to interfaces
-                 *    belonging to the same link as the outgoing
-                 *    interface.
-                 * (- For site-local destination addresses, the
-                 *    set of candidate source addresses MUST only
-                 *    include addresses assigned to interfaces
-                 *    belonging to the same site as the outgoing
-                 *    interface.)
-                 */
-                if (((dst_type & IPV6_ADDR_MULTICAST) ||
-                     dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
-                    dst.ifindex && dev->ifindex != dst.ifindex)
-                        continue;
-
-                idev = __in6_dev_get(dev);
-                if (!idev)
-                        continue;
-
-                read_lock_bh(&idev->lock);
-                list_for_each_entry(score->ifa, &idev->addr_list, if_list) {
-                        int i;
-
-                        /*
-                         * - Tentative Address (RFC2462 section 5.4)
-                         *  - A tentative address is not considered
-                         *    "assigned to an interface" in the traditional
-                         *    sense, unless it is also flagged as optimistic.
-                         * - Candidate Source Address (section 4)
-                         *  - In any case, anycast addresses, multicast
-                         *    addresses, and the unspecified address MUST
-                         *    NOT be included in a candidate set.
-                         */
-                        if ((score->ifa->flags & IFA_F_TENTATIVE) &&
-                            (!(score->ifa->flags & IFA_F_OPTIMISTIC)))
-                                continue;
-
-                        score->addr_type = __ipv6_addr_type(&score->ifa->addr);
+        /* Candidate Source Address (section 4)
+         *  - multicast and link-local destination address,
+         *    the set of candidate source address MUST only
+         *    include addresses assigned to interfaces
+         *    belonging to the same link as the outgoing
+         *    interface.
+         * (- For site-local destination addresses, the
+         *    set of candidate source addresses MUST only
+         *    include addresses assigned to interfaces
+         *    belonging to the same site as the outgoing
+         *    interface.)
+         *  - "It is RECOMMENDED that the candidate source addresses
+         *    be the set of unicast addresses assigned to the
+         *    interface that will be used to send to the destination
+         *    (the 'outgoing' interface)." (RFC 6724)
+         */
+        if (dst_dev) {
+                idev = __in6_dev_get(dst_dev);
+                if ((dst_type & IPV6_ADDR_MULTICAST) ||
+                    dst.scope <= IPV6_ADDR_SCOPE_LINKLOCAL ||
+                    (idev && idev->cnf.use_oif_addrs_only)) {
+                        use_oif_addr = true;
+                }
+        }
 
-                        if (unlikely(score->addr_type == IPV6_ADDR_ANY ||
-                                     score->addr_type & IPV6_ADDR_MULTICAST)) {
-                                net_dbg_ratelimited("ADDRCONF: unspecified / multicast address assigned as unicast address on %s",
-                                                    dev->name);
+        if (use_oif_addr) {
+                if (idev)
+                        hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
+        } else {
+                for_each_netdev_rcu(net, dev) {
+                        idev = __in6_dev_get(dev);
+                        if (!idev)
                                 continue;
-                        }
-
-                        score->rule = -1;
-                        bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
-
-                        for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
-                                int minihiscore, miniscore;
-
-                                minihiscore = ipv6_get_saddr_eval(net, hiscore, &dst, i);
-                                miniscore = ipv6_get_saddr_eval(net, score, &dst, i);
-
-                                if (minihiscore > miniscore) {
-                                        if (i == IPV6_SADDR_RULE_SCOPE &&
-                                            score->scopedist > 0) {
-                                                /*
-                                                 * special case:
-                                                 * each remaining entry
-                                                 * has too small (not enough)
-                                                 * scope, because ifa entries
-                                                 * are sorted by their scope
-                                                 * values.
-                                                 */
-                                                goto try_nextdev;
-                                        }
-                                        break;
-                                } else if (minihiscore < miniscore) {
-                                        if (hiscore->ifa)
-                                                in6_ifa_put(hiscore->ifa);
-
-                                        in6_ifa_hold(score->ifa);
-
-                                        swap(hiscore, score);
-
-                                        /* restore our iterator */
-                                        score->ifa = hiscore->ifa;
-
-                                        break;
-                                }
-                        }
+                        hiscore_idx = __ipv6_dev_get_saddr(net, &dst, idev, scores, hiscore_idx);
                 }
-try_nextdev:
-                read_unlock_bh(&idev->lock);
         }
         rcu_read_unlock();
 
+        hiscore = &scores[hiscore_idx];
         if (!hiscore->ifa)
                 return -EADDRNOTAVAIL;
 
@@ -4560,6 +4590,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_MAX_DESYNC_FACTOR] = cnf->max_desync_factor;
         array[DEVCONF_MAX_ADDRESSES] = cnf->max_addresses;
         array[DEVCONF_ACCEPT_RA_DEFRTR] = cnf->accept_ra_defrtr;
+        array[DEVCONF_ACCEPT_RA_MIN_HOP_LIMIT] = cnf->accept_ra_min_hop_limit;
         array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
 #ifdef CONFIG_IPV6_ROUTER_PREF
         array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
@@ -4586,6 +4617,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
         array[DEVCONF_ACCEPT_RA_FROM_LOCAL] = cnf->accept_ra_from_local;
         array[DEVCONF_ACCEPT_RA_MTU] = cnf->accept_ra_mtu;
         /* we omit DEVCONF_STABLE_SECRET for now */
+        array[DEVCONF_USE_OIF_ADDRS_ONLY] = cnf->use_oif_addrs_only;
 }
 
 static inline size_t inet6_ifla6_size(void)
@@ -5456,6 +5488,13 @@ static struct addrconf_sysctl_table
                         .proc_handler   = proc_dointvec,
                 },
                 {
+                        .procname       = "accept_ra_min_hop_limit",
+                        .data           = &ipv6_devconf.accept_ra_min_hop_limit,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec,
+                },
+                {
                         .procname       = "accept_ra_pinfo",
                         .data           = &ipv6_devconf.accept_ra_pinfo,
                         .maxlen         = sizeof(int),
@@ -5585,6 +5624,14 @@ static struct addrconf_sysctl_table
                         .proc_handler   = addrconf_sysctl_stable_secret,
                 },
                 {
+                        .procname       = "use_oif_addrs_only",
+                        .data           = &ipv6_devconf.use_oif_addrs_only,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec,
+
+                },
+                {
                         /* sentinel */
                 }
         },