1 files changed, 213 insertions, 44 deletions

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1b8196c8d145..cc16fe07bbff 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -16,7 +16,7 @@
  *      Changes:
  * Roger Venning <r.venning@telstra.com>:       6to4 support
  * Nate Thompson <nate@thebog.net>:             6to4 support
- * Fred L. Templin <fltemplin@acm.org>:         isatap support
+ * Fred Templin <fred.l.templin@boeing.com>:    isatap support
  */
 
 #include <linux/module.h>
@@ -197,6 +197,179 @@ failed:
         return NULL;
 }
 
+static struct ip_tunnel_prl_entry *
+__ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
+{
+        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL;
+
+        for (p = t->prl; p; p = p->next)
+                if (p->addr == addr)
+                        break;
+        return p;
+
+}
+
+static int ipip6_tunnel_get_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
+{
+        struct ip_tunnel_prl *kp;
+        struct ip_tunnel_prl_entry *prl;
+        unsigned int cmax, c = 0, ca, len;
+        int ret = 0;
+
+        cmax = a->datalen / sizeof(*a);
+        if (cmax > 1 && a->addr != htonl(INADDR_ANY))
+                cmax = 1;
+
+        /* For simple GET or for root users,
+         * we try harder to allocate.
+         */
+        kp = (cmax <= 1 || capable(CAP_NET_ADMIN)) ?
+                kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
+                NULL;
+
+        read_lock(&ipip6_lock);
+
+        ca = t->prl_count < cmax ? t->prl_count : cmax;
+
+        if (!kp) {
+                /* We don't try hard to allocate much memory for
+                 * non-root users.
+                 * For root users, retry allocating enough memory for
+                 * the answer.
+                 */
+                kp = kcalloc(ca, sizeof(*kp), GFP_ATOMIC);
+                if (!kp) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+        }
+
+        c = 0;
+        for (prl = t->prl; prl; prl = prl->next) {
+                if (c > cmax)
+                        break;
+                if (a->addr != htonl(INADDR_ANY) && prl->addr != a->addr)
+                        continue;
+                kp[c].addr = prl->addr;
+                kp[c].flags = prl->flags;
+                c++;
+                if (a->addr != htonl(INADDR_ANY))
+                        break;
+        }
+out:
+        read_unlock(&ipip6_lock);
+
+        len = sizeof(*kp) * c;
+        ret = len ? copy_to_user(a->data, kp, len) : 0;
+
+        kfree(kp);
+        if (ret)
+                return -EFAULT;
+
+        a->datalen = len;
+        return 0;
+}
+
+static int
+ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
+{
+        struct ip_tunnel_prl_entry *p;
+        int err = 0;
+
+        if (a->addr == htonl(INADDR_ANY))
+                return -EINVAL;
+
+        write_lock(&ipip6_lock);
+
+        for (p = t->prl; p; p = p->next) {
+                if (p->addr == a->addr) {
+                        if (chg)
+                                goto update;
+                        err = -EEXIST;
+                        goto out;
+                }
+        }
+
+        if (chg) {
+                err = -ENXIO;
+                goto out;
+        }
+
+        p = kzalloc(sizeof(struct ip_tunnel_prl_entry), GFP_KERNEL);
+        if (!p) {
+                err = -ENOBUFS;
+                goto out;
+        }
+
+        p->next = t->prl;
+        t->prl = p;
+        t->prl_count++;
+update:
+        p->addr = a->addr;
+        p->flags = a->flags;
+out:
+        write_unlock(&ipip6_lock);
+        return err;
+}
+
+static int
+ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
+{
+        struct ip_tunnel_prl_entry *x, **p;
+        int err = 0;
+
+        write_lock(&ipip6_lock);
+
+        if (a && a->addr != htonl(INADDR_ANY)) {
+                for (p = &t->prl; *p; p = &(*p)->next) {
+                        if ((*p)->addr == a->addr) {
+                                x = *p;
+                                *p = x->next;
+                                kfree(x);
+                                t->prl_count--;
+                                goto out;
+                        }
+                }
+                err = -ENXIO;
+        } else {
+                while (t->prl) {
+                        x = t->prl;
+                        t->prl = t->prl->next;
+                        kfree(x);
+                        t->prl_count--;
+                }
+        }
+out:
+        write_unlock(&ipip6_lock);
+        return 0;
+}
+
+static int
+isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
+{
+        struct ip_tunnel_prl_entry *p;
+        int ok = 1;
+
+        read_lock(&ipip6_lock);
+        p = __ipip6_tunnel_locate_prl(t, iph->saddr);
+        if (p) {
+                if (p->flags & PRL_DEFAULT)
+                        skb->ndisc_nodetype = NDISC_NODETYPE_DEFAULT;
+                else
+                        skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT;
+        } else {
+                struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
+                if (ipv6_addr_is_isatap(addr6) &&
+                    (addr6->s6_addr32[3] == iph->saddr) &&
+                    ipv6_chk_prefix(addr6, t->dev))
+                        skb->ndisc_nodetype = NDISC_NODETYPE_HOST;
+                else
+                        ok = 0;
+        }
+        read_unlock(&ipip6_lock);
+        return ok;
+}
+
 static void ipip6_tunnel_uninit(struct net_device *dev)
 {
         if (dev == ipip6_fb_tunnel_dev) {
@@ -206,6 +379,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
                 dev_put(dev);
         } else {
                 ipip6_tunnel_unlink(netdev_priv(dev));
+                ipip6_tunnel_del_prl(netdev_priv(dev), 0);
                 dev_put(dev);
         }
 }
@@ -365,48 +539,6 @@ static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
                 IP6_ECN_set_ce(ipv6_hdr(skb));
 }
 
-/* ISATAP (RFC4214) - check source address */
-static int
-isatap_srcok(struct sk_buff *skb, struct iphdr *iph, struct net_device *dev)
-{
-        struct neighbour *neigh;
-        struct dst_entry *dst;
-        struct rt6_info *rt;
-        struct flowi fl;
-        struct in6_addr *addr6;
-        struct in6_addr rtr;
-        struct ipv6hdr *iph6;
-        int ok = 0;
-
-        /* from onlink default router */
-        ipv6_addr_set(&rtr,  htonl(0xFE800000), 0, 0, 0);
-        ipv6_isatap_eui64(rtr.s6_addr + 8, iph->saddr);
-        if ((rt = rt6_get_dflt_router(&rtr, dev))) {
-                dst_release(&rt->u.dst);
-                return 1;
-        }
-
-        iph6 = ipv6_hdr(skb);
-        memset(&fl, 0, sizeof(fl));
-        fl.proto = iph6->nexthdr;
-        ipv6_addr_copy(&fl.fl6_dst, &iph6->saddr);
-        fl.oif = dev->ifindex;
-        security_skb_classify_flow(skb, &fl);
-
-        dst = ip6_route_output(&init_net, NULL, &fl);
-        if (!dst->error && (dst->dev == dev) && (neigh = dst->neighbour)) {
-
-                addr6 = (struct in6_addr*)&neigh->primary_key;
-
-                /* from correct previous hop */
-                if (ipv6_addr_is_isatap(addr6) &&
-                    (addr6->s6_addr32[3] == iph->saddr))
-                        ok = 1;
-        }
-        dst_release(dst);
-        return ok;
-}
-
 static int ipip6_rcv(struct sk_buff *skb)
 {
         struct iphdr *iph;
@@ -427,7 +559,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                 skb->pkt_type = PACKET_HOST;
 
                 if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
-                    !isatap_srcok(skb, iph, tunnel->dev)) {
+                    !isatap_chksrc(skb, iph, tunnel)) {
                         tunnel->stat.rx_errors++;
                         read_unlock(&ipip6_lock);
                         kfree_skb(skb);
@@ -707,6 +839,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
 {
         int err = 0;
         struct ip_tunnel_parm p;
+        struct ip_tunnel_prl prl;
         struct ip_tunnel *t;
 
         switch (cmd) {
@@ -806,6 +939,42 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 err = 0;
                 break;
 
+        case SIOCGETPRL:
+        case SIOCADDPRL:
+        case SIOCDELPRL:
+        case SIOCCHGPRL:
+                err = -EPERM;
+                if (cmd != SIOCGETPRL && !capable(CAP_NET_ADMIN))
+                        goto done;
+                err = -EINVAL;
+                if (dev == ipip6_fb_tunnel_dev)
+                        goto done;
+                err = -EFAULT;
+                if (copy_from_user(&prl, ifr->ifr_ifru.ifru_data, sizeof(prl)))
+                        goto done;
+                err = -ENOENT;
+                if (!(t = netdev_priv(dev)))
+                        goto done;
+
+                switch (cmd) {
+                case SIOCGETPRL:
+                        err = ipip6_tunnel_get_prl(t, &prl);
+                        if (!err && copy_to_user(ifr->ifr_ifru.ifru_data,
+                                                 &prl, sizeof(prl)))
+                                err = -EFAULT;
+                        break;
+                case SIOCDELPRL:
+                        err = ipip6_tunnel_del_prl(t, &prl);
+                        break;
+                case SIOCADDPRL:
+                case SIOCCHGPRL:
+                        err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
+                        break;
+                }
+                if (cmd != SIOCGETPRL)
+                        netdev_state_change(dev);
+                break;
+
         default:
                 err = -EINVAL;
         }