1 From 1b5aaa4b16f6e6471ab1c07b38068197a1b4c395 Mon Sep 17 00:00:00 2001
2 From: Jonas Gorski <jogo@openwrt.org>
3 Date: Fri, 24 May 2013 14:40:54 +0200
4 Subject: [PATCH 1/2] ipv6: allow rejecting with "source address failed policy"
6 RFC6204 L-14 requires rejecting traffic from invalid addresses with
7 ICMPv6 Destination Unreachable, Code 5 (Source address failed ingress/
8 egress policy) on the LAN side, so add an appropriate rule for that.
10 Signed-off-by: Jonas Gorski <jogo@openwrt.org>
12 include/net/netns/ipv6.h | 1 +
13 include/uapi/linux/fib_rules.h | 4 +++
14 include/uapi/linux/rtnetlink.h | 1 +
15 net/ipv4/fib_semantics.c | 4 +++
16 net/ipv4/fib_trie.c | 1 +
18 net/ipv6/fib6_rules.c | 4 +++
19 net/ipv6/ip6mr.c | 2 ++
20 net/ipv6/route.c | 58 +++++++++++++++++++++++++++++++++++++++++-
21 9 files changed, 75 insertions(+), 1 deletion(-)
23 --- a/include/net/netns/ipv6.h
24 +++ b/include/net/netns/ipv6.h
25 @@ -59,6 +59,7 @@ struct netns_ipv6 {
26 unsigned long ip6_rt_last_gc;
27 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
28 struct rt6_info *ip6_prohibit_entry;
29 + struct rt6_info *ip6_policy_failed_entry;
30 struct rt6_info *ip6_blk_hole_entry;
31 struct fib6_table *fib6_local_tbl;
32 struct fib_rules_ops *fib6_rules_ops;
33 --- a/include/uapi/linux/fib_rules.h
34 +++ b/include/uapi/linux/fib_rules.h
35 @@ -64,6 +64,10 @@ enum {
36 FR_ACT_BLACKHOLE, /* Drop without notification */
37 FR_ACT_UNREACHABLE, /* Drop with ENETUNREACH */
38 FR_ACT_PROHIBIT, /* Drop with EACCES */
42 + FR_ACT_POLICY_FAILED, /* Drop with EACCES */
46 --- a/include/uapi/linux/rtnetlink.h
47 +++ b/include/uapi/linux/rtnetlink.h
48 @@ -203,6 +203,7 @@ enum {
49 RTN_THROW, /* Not in this table */
50 RTN_NAT, /* Translate this address */
51 RTN_XRESOLVE, /* Use external resolver */
52 + RTN_POLICY_FAILED, /* Failed ingress/egress policy */
56 --- a/net/ipv4/fib_semantics.c
57 +++ b/net/ipv4/fib_semantics.c
58 @@ -138,6 +138,10 @@ const struct fib_prop fib_props[RTN_MAX
60 .scope = RT_SCOPE_NOWHERE,
62 + [RTN_POLICY_FAILED] = {
64 + .scope = RT_SCOPE_UNIVERSE,
68 static void rt_fibinfo_free(struct rtable __rcu **rtp)
69 --- a/net/ipv4/fib_trie.c
70 +++ b/net/ipv4/fib_trie.c
71 @@ -2324,6 +2324,7 @@ static const char *const rtn_type_names[
72 [RTN_THROW] = "THROW",
74 [RTN_XRESOLVE] = "XRESOLVE",
75 + [RTN_POLICY_FAILED] = "POLICY_FAILED",
78 static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
81 @@ -184,6 +184,7 @@ static int ipmr_rule_action(struct fib_r
82 case FR_ACT_UNREACHABLE:
85 + case FR_ACT_POLICY_FAILED:
87 case FR_ACT_BLACKHOLE:
89 --- a/net/ipv6/fib6_rules.c
90 +++ b/net/ipv6/fib6_rules.c
91 @@ -73,6 +73,10 @@ static int fib6_rule_action(struct fib_r
93 rt = net->ipv6.ip6_prohibit_entry;
95 + case FR_ACT_POLICY_FAILED:
97 + rt = net->ipv6.ip6_policy_failed_entry;
101 table = fib6_get_table(net, rule->table);
102 --- a/net/ipv6/ip6mr.c
103 +++ b/net/ipv6/ip6mr.c
104 @@ -169,6 +169,8 @@ static int ip6mr_rule_action(struct fib_
106 case FR_ACT_PROHIBIT:
108 + case FR_ACT_POLICY_FAILED:
110 case FR_ACT_BLACKHOLE:
113 --- a/net/ipv6/route.c
114 +++ b/net/ipv6/route.c
115 @@ -283,6 +283,21 @@ static const struct rt6_info ip6_prohibi
116 .rt6i_ref = ATOMIC_INIT(1),
119 +static const struct rt6_info ip6_policy_failed_entry_template = {
121 + .__refcnt = ATOMIC_INIT(1),
123 + .obsolete = DST_OBSOLETE_FORCE_CHK,
125 + .input = ip6_pkt_policy_failed,
126 + .output = ip6_pkt_policy_failed_out,
128 + .rt6i_flags = (RTF_REJECT | RTF_NONEXTHOP),
129 + .rt6i_protocol = RTPROT_KERNEL,
130 + .rt6i_metric = ~(u32) 0,
131 + .rt6i_ref = ATOMIC_INIT(1),
134 static const struct rt6_info ip6_blk_hole_entry_template = {
136 .__refcnt = ATOMIC_INIT(1),
137 @@ -1581,6 +1596,11 @@ int ip6_route_add(struct fib6_config *cf
138 rt->dst.output = ip6_pkt_prohibit_out;
139 rt->dst.input = ip6_pkt_prohibit;
141 + case RTN_POLICY_FAILED:
142 + rt->dst.error = -EACCES;
143 + rt->dst.output = ip6_pkt_policy_failed_out;
144 + rt->dst.input = ip6_pkt_policy_failed;
148 rt->dst.error = (cfg->fc_type == RTN_THROW) ? -EAGAIN
149 @@ -2142,6 +2162,17 @@ static int ip6_pkt_prohibit_out(struct s
150 return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
153 +static int ip6_pkt_policy_failed(struct sk_buff *skb)
155 + return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_INNOROUTES);
158 +static int ip6_pkt_policy_failed_out(struct sk_buff *skb)
160 + skb->dev = skb_dst(skb)->dev;
161 + return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_OUTNOROUTES);
165 * Allocate a dst for local (unicast / anycast) address.
167 @@ -2365,7 +2396,8 @@ static int rtm_to_fib6_config(struct sk_
168 if (rtm->rtm_type == RTN_UNREACHABLE ||
169 rtm->rtm_type == RTN_BLACKHOLE ||
170 rtm->rtm_type == RTN_PROHIBIT ||
171 - rtm->rtm_type == RTN_THROW)
172 + rtm->rtm_type == RTN_THROW ||
173 + rtm->rtm_type == RTN_POLICY_FAILED)
174 cfg->fc_flags |= RTF_REJECT;
176 if (rtm->rtm_type == RTN_LOCAL)
177 @@ -2567,6 +2599,9 @@ static int rt6_fill_node(struct net *net
179 rtm->rtm_type = RTN_PROHIBIT;
182 + rtm->rtm_type = RTN_POLICY_FAILED;
185 rtm->rtm_type = RTN_THROW;
187 @@ -2820,6 +2855,8 @@ static int ip6_route_dev_notify(struct n
188 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
189 net->ipv6.ip6_prohibit_entry->dst.dev = dev;
190 net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
191 + net->ipv6.ip6_policy_failed_entry->dst.dev = dev;
192 + net->ipv6.ip6_policy_failed_entry->rt6i_idev = in6_dev_get(dev);
193 net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
194 net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
196 @@ -3036,6 +3073,17 @@ static int __net_init ip6_route_net_init
197 net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
198 dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
199 ip6_template_metrics, true);
201 + net->ipv6.ip6_policy_failed_entry =
202 + kmemdup(&ip6_policy_failed_entry_template,
203 + sizeof(*net->ipv6.ip6_policy_failed_entry), GFP_KERNEL);
204 + if (!net->ipv6.ip6_policy_failed_entry)
205 + goto out_ip6_blk_hole_entry;
206 + net->ipv6.ip6_policy_failed_entry->dst.path =
207 + (struct dst_entry *)net->ipv6.ip6_policy_failed_entry;
208 + net->ipv6.ip6_policy_failed_entry->dst.ops = &net->ipv6.ip6_dst_ops;
209 + dst_init_metrics(&net->ipv6.ip6_policy_failed_entry->dst,
210 + ip6_template_metrics, true);
213 net->ipv6.sysctl.flush_delay = 0;
214 @@ -3054,6 +3102,8 @@ out:
217 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
218 +out_ip6_blk_hole_entry:
219 + kfree(net->ipv6.ip6_blk_hole_entry);
220 out_ip6_prohibit_entry:
221 kfree(net->ipv6.ip6_prohibit_entry);
223 @@ -3071,6 +3121,7 @@ static void __net_exit ip6_route_net_exi
224 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
225 kfree(net->ipv6.ip6_prohibit_entry);
226 kfree(net->ipv6.ip6_blk_hole_entry);
227 + kfree(net->ipv6.ip6_policy_failed_entry);
229 dst_entries_destroy(&net->ipv6.ip6_dst_ops);
231 @@ -3167,6 +3218,9 @@ int __init ip6_route_init(void)
232 init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
233 init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
234 init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
235 + init_net.ipv6.ip6_policy_failed_entry->dst.dev = init_net.loopback_dev;
236 + init_net.ipv6.ip6_policy_failed_entry->rt6i_idev =
237 + in6_dev_get(init_net.loopback_dev);