target/linux/generic/patches-3.10/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch

   1 diff --git a/include/net/netns/ipv6.h b/include/net/netns/ipv6.h
   2 index 005e2c2..a6a1df4 100644
   3 --- a/include/net/netns/ipv6.h
   4 +++ b/include/net/netns/ipv6.h
   5 @@ -55,6 +55,7 @@ struct netns_ipv6 {
   6         unsigned long            ip6_rt_last_gc;
   7  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
   8         struct rt6_info         *ip6_prohibit_entry;
   9 +       struct rt6_info         *ip6_failed_policy_entry;
  10         struct rt6_info         *ip6_blk_hole_entry;
  11         struct fib6_table       *fib6_local_tbl;
  12         struct fib_rules_ops    *fib6_rules_ops;
  13 diff --git a/include/uapi/linux/fib_rules.h b/include/uapi/linux/fib_rules.h
  14 index 51da65b..1429852 100644
  15 --- a/include/uapi/linux/fib_rules.h
  16 +++ b/include/uapi/linux/fib_rules.h
  17 @@ -64,6 +64,10 @@ enum {
  18         FR_ACT_BLACKHOLE,       /* Drop without notification */
  19         FR_ACT_UNREACHABLE,     /* Drop with ENETUNREACH */
  20         FR_ACT_PROHIBIT,        /* Drop with EACCES */
  21 +       FR_ACT_RES9,
  22 +       FR_ACT_RES10,
  23 +       FR_ACT_RES11,
  24 +       FR_ACT_FAILED_POLICY,   /* Drop with EPERM */
  25         __FR_ACT_MAX,
  26  };
  27
  28 diff --git a/include/uapi/linux/icmpv6.h b/include/uapi/linux/icmpv6.h
  29 index e0133c7..dabfa1a 100644
  30 --- a/include/uapi/linux/icmpv6.h
  31 +++ b/include/uapi/linux/icmpv6.h
  32 @@ -115,6 +115,7 @@ struct icmp6hdr {
  33  #define ICMPV6_NOT_NEIGHBOUR           2
  34  #define ICMPV6_ADDR_UNREACH            3
  35  #define ICMPV6_PORT_UNREACH            4
  36 +#define ICMPV6_FAILED_POLICY           5
  37
  38  /*
  39   *     Codes for Time Exceeded
  40 diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
  41 index 7a2144e..8f643f1 100644
  42 --- a/include/uapi/linux/rtnetlink.h
  43 +++ b/include/uapi/linux/rtnetlink.h
  44 @@ -203,6 +203,7 @@ enum {
  45         RTN_THROW,              /* Not in this table            */
  46         RTN_NAT,                /* Translate this address       */
  47         RTN_XRESOLVE,           /* Use external resolver        */
  48 +       RTN_FAILED_POLICY,      /* Failed ingress/egress policy */
  49         __RTN_MAX
  50  };
  51
  52 diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
  53 index 26aa65d..2f66341 100644
  54 --- a/net/ipv4/fib_rules.c
  55 +++ b/net/ipv4/fib_rules.c
  56 @@ -84,6 +84,10 @@ static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
  57                 err = -EACCES;
  58                 goto errout;
  59
  60 +       case FR_ACT_FAILED_POLICY:
  61 +               err = -EPERM;
  62 +               goto errout;
  63 +
  64         case FR_ACT_BLACKHOLE:
  65         default:
  66                 err = -EINVAL;
  67 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
  68 index 8f6cb7a..dbae75d 100644
  69 --- a/net/ipv4/fib_semantics.c
  70 +++ b/net/ipv4/fib_semantics.c
  71 @@ -138,6 +138,10 @@ const struct fib_prop fib_props[RTN_MAX + 1] = {
  72                 .error  = -EINVAL,
  73                 .scope  = RT_SCOPE_NOWHERE,
  74         },
  75 +       [RTN_FAILED_POLICY] = {
  76 +               .error  = -EPERM,
  77 +               .scope  = RT_SCOPE_UNIVERSE,
  78 +       },
  79  };
  80
  81  static void rt_fibinfo_free(struct rtable __rcu **rtp)
  82 diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
  83 index 49616fe..e2845bd 100644
  84 --- a/net/ipv4/fib_trie.c
  85 +++ b/net/ipv4/fib_trie.c
  86 @@ -2334,6 +2334,7 @@ static const char *const rtn_type_names[__RTN_MAX] = {
  87         [RTN_THROW] = "THROW",
  88         [RTN_NAT] = "NAT",
  89         [RTN_XRESOLVE] = "XRESOLVE",
  90 +       [RTN_FAILED_POLICY] = "FAILED_POLICY",
  91  };
  92
  93  static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
  94 diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
  95 index df97f0a..2bd33cc 100644
  96 --- a/net/ipv4/ipmr.c
  97 +++ b/net/ipv4/ipmr.c
  98 @@ -181,6 +181,7 @@ static int ipmr_rule_action(struct fib_rule *rule, struct flowi *flp,
  99         case FR_ACT_UNREACHABLE:
 100                 return -ENETUNREACH;
 101         case FR_ACT_PROHIBIT:
 102 +       case FR_ACT_FAILED_POLICY:
 103                 return -EACCES;
 104         case FR_ACT_BLACKHOLE:
 105         default:
 106 diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
 107 index 2e1a432..c4413b2 100644
 108 --- a/net/ipv6/fib6_rules.c
 109 +++ b/net/ipv6/fib6_rules.c
 110 @@ -69,6 +69,9 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
 111         case FR_ACT_PROHIBIT:
 112                 rt = net->ipv6.ip6_prohibit_entry;
 113                 goto discard_pkt;
 114 +       case FR_ACT_FAILED_POLICY:
 115 +               rt = net->ipv6.ip6_failed_policy_entry;
 116 +               goto discard_pkt;
 117         }
 118
 119         table = fib6_get_table(net, rule->table);
 120 diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
 121 index 583e8d4..1e524da 100644
 122 --- a/net/ipv6/ip6mr.c
 123 +++ b/net/ipv6/ip6mr.c
 124 @@ -166,6 +166,8 @@ static int ip6mr_rule_action(struct fib_rule *rule, struct flowi *flp,
 125                 return -ENETUNREACH;
 126         case FR_ACT_PROHIBIT:
 127                 return -EACCES;
 128 +       case FR_ACT_FAILED_POLICY:
 129 +               return -EPERM;
 130         case FR_ACT_BLACKHOLE:
 131         default:
 132                 return -EINVAL;
 133 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
 134 index 2b87418..864f5fe 100644
 135 --- a/net/ipv6/route.c
 136 +++ b/net/ipv6/route.c
 137 @@ -245,6 +245,24 @@ static const struct rt6_info ip6_prohibit_entry_template = {
 138         .rt6i_ref       = ATOMIC_INIT(1),
 139  };
 140
 141 +static int ip6_pkt_failed_policy(struct sk_buff *skb);
 142 +static int ip6_pkt_failed_policy_out(struct sk_buff *skb);
 143 +
 144 +static const struct rt6_info ip6_failed_policy_entry_template = {
 145 +       .dst = {
 146 +               .__refcnt       = ATOMIC_INIT(1),
 147 +               .__use          = 1,
 148 +               .obsolete       = DST_OBSOLETE_FORCE_CHK,
 149 +               .error          = -EPERM,
 150 +               .input          = ip6_pkt_failed_policy,
 151 +               .output         = ip6_pkt_failed_policy_out,
 152 +       },
 153 +       .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
 154 +       .rt6i_protocol  = RTPROT_KERNEL,
 155 +       .rt6i_metric    = ~(u32) 0,
 156 +       .rt6i_ref       = ATOMIC_INIT(1),
 157 +};
 158 +
 159  static const struct rt6_info ip6_blk_hole_entry_template = {
 160         .dst = {
 161                 .__refcnt       = ATOMIC_INIT(1),
 162 @@ -1459,6 +1477,9 @@ int ip6_route_add(struct fib6_config *cfg)
 163                 case RTN_THROW:
 164                         rt->dst.error = -EAGAIN;
 165                         break;
 166 +               case RTN_FAILED_POLICY:
 167 +                       rt->dst.error = -EPERM;
 168 +                       break;
 169                 default:
 170                         rt->dst.error = -ENETUNREACH;
 171                         break;
 172 @@ -2035,6 +2056,17 @@ static int ip6_pkt_prohibit_out(struct sk_buff *skb)
 173         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
 174  }
 175
 176 +static int ip6_pkt_failed_policy(struct sk_buff *skb)
 177 +{
 178 +       return ip6_pkt_drop(skb, ICMPV6_FAILED_POLICY, IPSTATS_MIB_INNOROUTES);
 179 +}
 180 +
 181 +static int ip6_pkt_failed_policy_out(struct sk_buff *skb)
 182 +{
 183 +       skb->dev = skb_dst(skb)->dev;
 184 +       return ip6_pkt_drop(skb, ICMPV6_FAILED_POLICY, IPSTATS_MIB_OUTNOROUTES);
 185 +}
 186 +
 187  #endif
 188
 189  /*
 190 @@ -2240,7 +2272,8 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
 191         if (rtm->rtm_type == RTN_UNREACHABLE ||
 192             rtm->rtm_type == RTN_BLACKHOLE ||
 193             rtm->rtm_type == RTN_PROHIBIT ||
 194 -           rtm->rtm_type == RTN_THROW)
 195 +           rtm->rtm_type == RTN_THROW ||
 196 +           rtm->rtm_type == RTN_FAILED_POLICY)
 197                 cfg->fc_flags |= RTF_REJECT;
 198
 199         if (rtm->rtm_type == RTN_LOCAL)
 200 @@ -2442,6 +2475,9 @@ static int rt6_fill_node(struct net *net,
 201                 case -EACCES:
 202                         rtm->rtm_type = RTN_PROHIBIT;
 203                         break;
 204 +               case -EPERM:
 205 +                       rtm->rtm_type = RTN_FAILED_POLICY;
 206 +                       break;
 207                 case -EAGAIN:
 208                         rtm->rtm_type = RTN_THROW;
 209                         break;
 210 @@ -2692,6 +2728,8 @@ static int ip6_route_dev_notify(struct notifier_block *this,
 211  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 212                 net->ipv6.ip6_prohibit_entry->dst.dev = dev;
 213                 net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
 214 +               net->ipv6.ip6_failed_policy_entry->dst.dev = dev;
 215 +               net->ipv6.ip6_failed_policy_entry->rt6i_idev = in6_dev_get(dev);
 216                 net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
 217                 net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
 218  #endif
 219 @@ -2952,6 +2990,17 @@ static int __net_init ip6_route_net_init(struct net *net)
 220         net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
 221         dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
 222                          ip6_template_metrics, true);
 223 +
 224 +       net->ipv6.ip6_failed_policy_entry =
 225 +               kmemdup(&ip6_failed_policy_entry_template,
 226 +                       sizeof(*net->ipv6.ip6_failed_policy_entry), GFP_KERNEL);
 227 +       if (!net->ipv6.ip6_failed_policy_entry)
 228 +               goto out_ip6_blk_hole_entry;
 229 +       net->ipv6.ip6_failed_policy_entry->dst.path =
 230 +               (struct dst_entry *)net->ipv6.ip6_failed_policy_entry;
 231 +       net->ipv6.ip6_failed_policy_entry->dst.ops = &net->ipv6.ip6_dst_ops;
 232 +       dst_init_metrics(&net->ipv6.ip6_failed_policy_entry->dst,
 233 +                        ip6_template_metrics, true);
 234  #endif
 235
 236         net->ipv6.sysctl.flush_delay = 0;
 237 @@ -2970,6 +3019,8 @@ out:
 238         return ret;
 239
 240  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 241 +out_ip6_blk_hole_entry:
 242 +       kfree(net->ipv6.ip6_blk_hole_entry);
 243  out_ip6_prohibit_entry:
 244         kfree(net->ipv6.ip6_prohibit_entry);
 245  out_ip6_null_entry:
 246 @@ -2987,6 +3038,7 @@ static void __net_exit ip6_route_net_exit(struct net *net)
 247  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 248         kfree(net->ipv6.ip6_prohibit_entry);
 249         kfree(net->ipv6.ip6_blk_hole_entry);
 250 +       kfree(net->ipv6.ip6_failed_policy_entry);
 251  #endif
 252         dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 253  }
 254 @@ -3083,6 +3135,9 @@ int __init ip6_route_init(void)
 255         init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
 256         init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
 257         init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
 258 +       init_net.ipv6.ip6_failed_policy_entry->dst.dev = init_net.loopback_dev;
 259 +       init_net.ipv6.ip6_failed_policy_entry->rt6i_idev =
 260 +               in6_dev_get(init_net.loopback_dev);
 261    #endif
 262         ret = fib6_init();
 263         if (ret)