diff options
Diffstat (limited to 'net/ipv6/sit.c')
-rw-r--r-- | net/ipv6/sit.c | 186 |
1 files changed, 142 insertions, 44 deletions
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c index 1b8196c8d145..4786419ade0e 100644 --- a/net/ipv6/sit.c +++ b/net/ipv6/sit.c | |||
@@ -16,7 +16,7 @@ | |||
16 | * Changes: | 16 | * Changes: |
17 | * Roger Venning <r.venning@telstra.com>: 6to4 support | 17 | * Roger Venning <r.venning@telstra.com>: 6to4 support |
18 | * Nate Thompson <nate@thebog.net>: 6to4 support | 18 | * Nate Thompson <nate@thebog.net>: 6to4 support |
19 | * Fred L. Templin <fltemplin@acm.org>: isatap support | 19 | * Fred Templin <fred.l.templin@boeing.com>: isatap support |
20 | */ | 20 | */ |
21 | 21 | ||
22 | #include <linux/module.h> | 22 | #include <linux/module.h> |
@@ -197,6 +197,119 @@ failed: | |||
197 | return NULL; | 197 | return NULL; |
198 | } | 198 | } |
199 | 199 | ||
200 | static struct ip_tunnel_prl_entry * | ||
201 | ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr) | ||
202 | { | ||
203 | struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL; | ||
204 | |||
205 | for (p = t->prl; p; p = p->next) | ||
206 | if (p->entry.addr == addr) | ||
207 | break; | ||
208 | return p; | ||
209 | |||
210 | } | ||
211 | |||
212 | static int | ||
213 | ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg) | ||
214 | { | ||
215 | struct ip_tunnel_prl_entry *p; | ||
216 | |||
217 | for (p = t->prl; p; p = p->next) { | ||
218 | if (p->entry.addr == a->addr) { | ||
219 | if (chg) { | ||
220 | p->entry = *a; | ||
221 | return 0; | ||
222 | } | ||
223 | return -EEXIST; | ||
224 | } | ||
225 | } | ||
226 | |||
227 | if (chg) | ||
228 | return -ENXIO; | ||
229 | |||
230 | p = kzalloc(sizeof(struct ip_tunnel_prl_entry), GFP_KERNEL); | ||
231 | if (!p) | ||
232 | return -ENOBUFS; | ||
233 | |||
234 | p->entry = *a; | ||
235 | p->next = t->prl; | ||
236 | t->prl = p; | ||
237 | return 0; | ||
238 | } | ||
239 | |||
240 | static int | ||
241 | ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a) | ||
242 | { | ||
243 | struct ip_tunnel_prl_entry *x, **p; | ||
244 | |||
245 | if (a) { | ||
246 | for (p = &t->prl; *p; p = &(*p)->next) { | ||
247 | if ((*p)->entry.addr == a->addr) { | ||
248 | x = *p; | ||
249 | *p = x->next; | ||
250 | kfree(x); | ||
251 | return 0; | ||
252 | } | ||
253 | } | ||
254 | return -ENXIO; | ||
255 | } else { | ||
256 | while (t->prl) { | ||
257 | x = t->prl; | ||
258 | t->prl = t->prl->next; | ||
259 | kfree(x); | ||
260 | } | ||
261 | } | ||
262 | return 0; | ||
263 | } | ||
264 | |||
265 | /* copied directly from anycast.c */ | ||
266 | static int | ||
267 | ipip6_onlink(struct in6_addr *addr, struct net_device *dev) | ||
268 | { | ||
269 | struct inet6_dev *idev; | ||
270 | struct inet6_ifaddr *ifa; | ||
271 | int onlink; | ||
272 | |||
273 | onlink = 0; | ||
274 | rcu_read_lock(); | ||
275 | idev = __in6_dev_get(dev); | ||
276 | if (idev) { | ||
277 | read_lock_bh(&idev->lock); | ||
278 | for (ifa=idev->addr_list; ifa; ifa=ifa->if_next) { | ||
279 | onlink = ipv6_prefix_equal(addr, &ifa->addr, | ||
280 | ifa->prefix_len); | ||
281 | if (onlink) | ||
282 | break; | ||
283 | } | ||
284 | read_unlock_bh(&idev->lock); | ||
285 | } | ||
286 | rcu_read_unlock(); | ||
287 | return onlink; | ||
288 | } | ||
289 | |||
290 | static int | ||
291 | isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t) | ||
292 | { | ||
293 | struct ip_tunnel_prl_entry *p = ipip6_tunnel_locate_prl(t, iph->saddr); | ||
294 | int ok = 1; | ||
295 | |||
296 | if (p) { | ||
297 | if (p->entry.flags & PRL_DEFAULT) | ||
298 | skb->ndisc_nodetype = NDISC_NODETYPE_DEFAULT; | ||
299 | else | ||
300 | skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT; | ||
301 | } else { | ||
302 | struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr; | ||
303 | if (ipv6_addr_is_isatap(addr6) && | ||
304 | (addr6->s6_addr32[3] == iph->saddr) && | ||
305 | ipip6_onlink(addr6, t->dev)) | ||
306 | skb->ndisc_nodetype = NDISC_NODETYPE_HOST; | ||
307 | else | ||
308 | ok = 0; | ||
309 | } | ||
310 | return ok; | ||
311 | } | ||
312 | |||
200 | static void ipip6_tunnel_uninit(struct net_device *dev) | 313 | static void ipip6_tunnel_uninit(struct net_device *dev) |
201 | { | 314 | { |
202 | if (dev == ipip6_fb_tunnel_dev) { | 315 | if (dev == ipip6_fb_tunnel_dev) { |
@@ -206,6 +319,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev) | |||
206 | dev_put(dev); | 319 | dev_put(dev); |
207 | } else { | 320 | } else { |
208 | ipip6_tunnel_unlink(netdev_priv(dev)); | 321 | ipip6_tunnel_unlink(netdev_priv(dev)); |
322 | ipip6_tunnel_del_prl(netdev_priv(dev), 0); | ||
209 | dev_put(dev); | 323 | dev_put(dev); |
210 | } | 324 | } |
211 | } | 325 | } |
@@ -365,48 +479,6 @@ static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb) | |||
365 | IP6_ECN_set_ce(ipv6_hdr(skb)); | 479 | IP6_ECN_set_ce(ipv6_hdr(skb)); |
366 | } | 480 | } |
367 | 481 | ||
368 | /* ISATAP (RFC4214) - check source address */ | ||
369 | static int | ||
370 | isatap_srcok(struct sk_buff *skb, struct iphdr *iph, struct net_device *dev) | ||
371 | { | ||
372 | struct neighbour *neigh; | ||
373 | struct dst_entry *dst; | ||
374 | struct rt6_info *rt; | ||
375 | struct flowi fl; | ||
376 | struct in6_addr *addr6; | ||
377 | struct in6_addr rtr; | ||
378 | struct ipv6hdr *iph6; | ||
379 | int ok = 0; | ||
380 | |||
381 | /* from onlink default router */ | ||
382 | ipv6_addr_set(&rtr, htonl(0xFE800000), 0, 0, 0); | ||
383 | ipv6_isatap_eui64(rtr.s6_addr + 8, iph->saddr); | ||
384 | if ((rt = rt6_get_dflt_router(&rtr, dev))) { | ||
385 | dst_release(&rt->u.dst); | ||
386 | return 1; | ||
387 | } | ||
388 | |||
389 | iph6 = ipv6_hdr(skb); | ||
390 | memset(&fl, 0, sizeof(fl)); | ||
391 | fl.proto = iph6->nexthdr; | ||
392 | ipv6_addr_copy(&fl.fl6_dst, &iph6->saddr); | ||
393 | fl.oif = dev->ifindex; | ||
394 | security_skb_classify_flow(skb, &fl); | ||
395 | |||
396 | dst = ip6_route_output(&init_net, NULL, &fl); | ||
397 | if (!dst->error && (dst->dev == dev) && (neigh = dst->neighbour)) { | ||
398 | |||
399 | addr6 = (struct in6_addr*)&neigh->primary_key; | ||
400 | |||
401 | /* from correct previous hop */ | ||
402 | if (ipv6_addr_is_isatap(addr6) && | ||
403 | (addr6->s6_addr32[3] == iph->saddr)) | ||
404 | ok = 1; | ||
405 | } | ||
406 | dst_release(dst); | ||
407 | return ok; | ||
408 | } | ||
409 | |||
410 | static int ipip6_rcv(struct sk_buff *skb) | 482 | static int ipip6_rcv(struct sk_buff *skb) |
411 | { | 483 | { |
412 | struct iphdr *iph; | 484 | struct iphdr *iph; |
@@ -427,7 +499,7 @@ static int ipip6_rcv(struct sk_buff *skb) | |||
427 | skb->pkt_type = PACKET_HOST; | 499 | skb->pkt_type = PACKET_HOST; |
428 | 500 | ||
429 | if ((tunnel->dev->priv_flags & IFF_ISATAP) && | 501 | if ((tunnel->dev->priv_flags & IFF_ISATAP) && |
430 | !isatap_srcok(skb, iph, tunnel->dev)) { | 502 | !isatap_chksrc(skb, iph, tunnel)) { |
431 | tunnel->stat.rx_errors++; | 503 | tunnel->stat.rx_errors++; |
432 | read_unlock(&ipip6_lock); | 504 | read_unlock(&ipip6_lock); |
433 | kfree_skb(skb); | 505 | kfree_skb(skb); |
@@ -707,6 +779,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) | |||
707 | { | 779 | { |
708 | int err = 0; | 780 | int err = 0; |
709 | struct ip_tunnel_parm p; | 781 | struct ip_tunnel_parm p; |
782 | struct ip_tunnel_prl prl; | ||
710 | struct ip_tunnel *t; | 783 | struct ip_tunnel *t; |
711 | 784 | ||
712 | switch (cmd) { | 785 | switch (cmd) { |
@@ -806,6 +879,31 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd) | |||
806 | err = 0; | 879 | err = 0; |
807 | break; | 880 | break; |
808 | 881 | ||
882 | case SIOCADDPRL: | ||
883 | case SIOCDELPRL: | ||
884 | case SIOCCHGPRL: | ||
885 | err = -EPERM; | ||
886 | if (!capable(CAP_NET_ADMIN)) | ||
887 | goto done; | ||
888 | err = -EINVAL; | ||
889 | if (dev == ipip6_fb_tunnel_dev) | ||
890 | goto done; | ||
891 | err = -EFAULT; | ||
892 | if (copy_from_user(&prl, ifr->ifr_ifru.ifru_data, sizeof(prl))) | ||
893 | goto done; | ||
894 | err = -ENOENT; | ||
895 | if (!(t = netdev_priv(dev))) | ||
896 | goto done; | ||
897 | |||
898 | ipip6_tunnel_unlink(t); | ||
899 | if (cmd == SIOCDELPRL) | ||
900 | err = ipip6_tunnel_del_prl(t, &prl); | ||
901 | else | ||
902 | err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL); | ||
903 | ipip6_tunnel_link(t); | ||
904 | netdev_state_change(dev); | ||
905 | break; | ||
906 | |||
809 | default: | 907 | default: |
810 | err = -EINVAL; | 908 | err = -EINVAL; |
811 | } | 909 | } |