1 --- a/include/net/netns/ipv6.h
2 +++ b/include/net/netns/ipv6.h
3 @@ -55,6 +55,7 @@ struct netns_ipv6 {
4 unsigned long ip6_rt_last_gc;
5 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
6 struct rt6_info *ip6_prohibit_entry;
7 + struct rt6_info *ip6_failed_policy_entry;
8 struct rt6_info *ip6_blk_hole_entry;
9 struct fib6_table *fib6_local_tbl;
10 struct fib_rules_ops *fib6_rules_ops;
11 --- a/include/uapi/linux/fib_rules.h
12 +++ b/include/uapi/linux/fib_rules.h
13 @@ -64,6 +64,10 @@ enum {
14 FR_ACT_BLACKHOLE, /* Drop without notification */
15 FR_ACT_UNREACHABLE, /* Drop with ENETUNREACH */
16 FR_ACT_PROHIBIT, /* Drop with EACCES */
20 + FR_ACT_FAILED_POLICY, /* Drop with EPERM */
24 --- a/include/uapi/linux/rtnetlink.h
25 +++ b/include/uapi/linux/rtnetlink.h
26 @@ -203,6 +203,7 @@ enum {
27 RTN_THROW, /* Not in this table */
28 RTN_NAT, /* Translate this address */
29 RTN_XRESOLVE, /* Use external resolver */
30 + RTN_FAILED_POLICY, /* Failed ingress/egress policy */
34 --- a/net/ipv4/fib_rules.c
35 +++ b/net/ipv4/fib_rules.c
36 @@ -84,6 +84,10 @@ static int fib4_rule_action(struct fib_r
40 + case FR_ACT_FAILED_POLICY:
44 case FR_ACT_BLACKHOLE:
47 --- a/net/ipv4/fib_semantics.c
48 +++ b/net/ipv4/fib_semantics.c
49 @@ -138,6 +138,10 @@ const struct fib_prop fib_props[RTN_MAX
51 .scope = RT_SCOPE_NOWHERE,
53 + [RTN_FAILED_POLICY] = {
55 + .scope = RT_SCOPE_UNIVERSE,
59 static void rt_fibinfo_free(struct rtable __rcu **rtp)
60 --- a/net/ipv4/fib_trie.c
61 +++ b/net/ipv4/fib_trie.c
62 @@ -2331,6 +2331,7 @@ static const char *const rtn_type_names[
63 [RTN_THROW] = "THROW",
65 [RTN_XRESOLVE] = "XRESOLVE",
66 + [RTN_FAILED_POLICY] = "FAILED_POLICY",
69 static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
72 @@ -181,6 +181,7 @@ static int ipmr_rule_action(struct fib_r
73 case FR_ACT_UNREACHABLE:
76 + case FR_ACT_FAILED_POLICY:
78 case FR_ACT_BLACKHOLE:
80 --- a/net/ipv6/fib6_rules.c
81 +++ b/net/ipv6/fib6_rules.c
82 @@ -69,6 +69,9 @@ static int fib6_rule_action(struct fib_r
84 rt = net->ipv6.ip6_prohibit_entry;
86 + case FR_ACT_FAILED_POLICY:
87 + rt = net->ipv6.ip6_failed_policy_entry;
91 table = fib6_get_table(net, rule->table);
92 --- a/net/ipv6/ip6mr.c
93 +++ b/net/ipv6/ip6mr.c
94 @@ -166,6 +166,8 @@ static int ip6mr_rule_action(struct fib_
98 + case FR_ACT_FAILED_POLICY:
100 case FR_ACT_BLACKHOLE:
103 --- a/net/ipv6/route.c
104 +++ b/net/ipv6/route.c
105 @@ -251,6 +251,24 @@ static const struct rt6_info ip6_prohibi
106 .rt6i_ref = ATOMIC_INIT(1),
109 +static int ip6_pkt_failed_policy(struct sk_buff *skb);
110 +static int ip6_pkt_failed_policy_out(struct sk_buff *skb);
112 +static const struct rt6_info ip6_failed_policy_entry_template = {
114 + .__refcnt = ATOMIC_INIT(1),
116 + .obsolete = DST_OBSOLETE_FORCE_CHK,
118 + .input = ip6_pkt_failed_policy,
119 + .output = ip6_pkt_failed_policy_out,
121 + .rt6i_flags = (RTF_REJECT | RTF_NONEXTHOP),
122 + .rt6i_protocol = RTPROT_KERNEL,
123 + .rt6i_metric = ~(u32) 0,
124 + .rt6i_ref = ATOMIC_INIT(1),
127 static const struct rt6_info ip6_blk_hole_entry_template = {
129 .__refcnt = ATOMIC_INIT(1),
130 @@ -1505,6 +1523,9 @@ int ip6_route_add(struct fib6_config *cf
132 rt->dst.error = -EAGAIN;
134 + case RTN_FAILED_POLICY:
135 + rt->dst.error = -EPERM;
138 rt->dst.error = -ENETUNREACH;
140 @@ -2084,6 +2105,17 @@ static int ip6_pkt_prohibit_out(struct s
141 return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
144 +static int ip6_pkt_failed_policy(struct sk_buff *skb)
146 + return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_INNOROUTES);
149 +static int ip6_pkt_failed_policy_out(struct sk_buff *skb)
151 + skb->dev = skb_dst(skb)->dev;
152 + return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_OUTNOROUTES);
158 @@ -2290,7 +2322,8 @@ static int rtm_to_fib6_config(struct sk_
159 if (rtm->rtm_type == RTN_UNREACHABLE ||
160 rtm->rtm_type == RTN_BLACKHOLE ||
161 rtm->rtm_type == RTN_PROHIBIT ||
162 - rtm->rtm_type == RTN_THROW)
163 + rtm->rtm_type == RTN_THROW ||
164 + rtm->rtm_type == RTN_FAILED_POLICY)
165 cfg->fc_flags |= RTF_REJECT;
167 if (rtm->rtm_type == RTN_LOCAL)
168 @@ -2492,6 +2525,9 @@ static int rt6_fill_node(struct net *net
170 rtm->rtm_type = RTN_PROHIBIT;
173 + rtm->rtm_type = RTN_FAILED_POLICY;
176 rtm->rtm_type = RTN_THROW;
178 @@ -2742,6 +2778,8 @@ static int ip6_route_dev_notify(struct n
179 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
180 net->ipv6.ip6_prohibit_entry->dst.dev = dev;
181 net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
182 + net->ipv6.ip6_failed_policy_entry->dst.dev = dev;
183 + net->ipv6.ip6_failed_policy_entry->rt6i_idev = in6_dev_get(dev);
184 net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
185 net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
187 @@ -3002,6 +3040,17 @@ static int __net_init ip6_route_net_init
188 net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
189 dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
190 ip6_template_metrics, true);
192 + net->ipv6.ip6_failed_policy_entry =
193 + kmemdup(&ip6_failed_policy_entry_template,
194 + sizeof(*net->ipv6.ip6_failed_policy_entry), GFP_KERNEL);
195 + if (!net->ipv6.ip6_failed_policy_entry)
196 + goto out_ip6_blk_hole_entry;
197 + net->ipv6.ip6_failed_policy_entry->dst.path =
198 + (struct dst_entry *)net->ipv6.ip6_failed_policy_entry;
199 + net->ipv6.ip6_failed_policy_entry->dst.ops = &net->ipv6.ip6_dst_ops;
200 + dst_init_metrics(&net->ipv6.ip6_failed_policy_entry->dst,
201 + ip6_template_metrics, true);
204 net->ipv6.sysctl.flush_delay = 0;
205 @@ -3020,6 +3069,8 @@ out:
208 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
209 +out_ip6_blk_hole_entry:
210 + kfree(net->ipv6.ip6_blk_hole_entry);
211 out_ip6_prohibit_entry:
212 kfree(net->ipv6.ip6_prohibit_entry);
214 @@ -3037,6 +3088,7 @@ static void __net_exit ip6_route_net_exi
215 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
216 kfree(net->ipv6.ip6_prohibit_entry);
217 kfree(net->ipv6.ip6_blk_hole_entry);
218 + kfree(net->ipv6.ip6_failed_policy_entry);
220 dst_entries_destroy(&net->ipv6.ip6_dst_ops);
222 @@ -3133,6 +3185,9 @@ int __init ip6_route_init(void)
223 init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
224 init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
225 init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
226 + init_net.ipv6.ip6_failed_policy_entry->dst.dev = init_net.loopback_dev;
227 + init_net.ipv6.ip6_failed_policy_entry->rt6i_idev =
228 + in6_dev_get(init_net.loopback_dev);