target/linux/generic/patches-3.3/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch

   1 Index: linux-3.3.8/include/net/netns/ipv6.h
   2 ===================================================================
   3 --- linux-3.3.8.orig/include/net/netns/ipv6.h   2013-06-10 20:53:57.637355486 +0200
   4 +++ linux-3.3.8/include/net/netns/ipv6.h        2013-06-10 20:53:57.621355486 +0200
   5 @@ -50,6 +50,7 @@
   6         unsigned long            ip6_rt_last_gc;
   7  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
   8         struct rt6_info         *ip6_prohibit_entry;
   9 +       struct rt6_info         *ip6_failed_policy_entry;
  10         struct rt6_info         *ip6_blk_hole_entry;
  11         struct fib6_table       *fib6_local_tbl;
  12         struct fib_rules_ops    *fib6_rules_ops;
  13 Index: linux-3.3.8/include/linux/fib_rules.h
  14 ===================================================================
  15 --- linux-3.3.8.orig/include/linux/fib_rules.h  2013-06-10 20:53:57.637355486 +0200
  16 +++ linux-3.3.8/include/linux/fib_rules.h       2013-06-10 20:53:57.621355486 +0200
  17 @@ -64,6 +64,10 @@
  18         FR_ACT_BLACKHOLE,       /* Drop without notification */
  19         FR_ACT_UNREACHABLE,     /* Drop with ENETUNREACH */
  20         FR_ACT_PROHIBIT,        /* Drop with EACCES */
  21 +       FR_ACT_RES9,
  22 +       FR_ACT_RES10,
  23 +       FR_ACT_RES11,
  24 +       FR_ACT_FAILED_POLICY,   /* Drop with EPERM */
  25         __FR_ACT_MAX,
  26  };
  27
  28 Index: linux-3.3.8/include/linux/icmpv6.h
  29 ===================================================================
  30 --- linux-3.3.8.orig/include/linux/icmpv6.h     2013-06-10 20:53:57.637355486 +0200
  31 +++ linux-3.3.8/include/linux/icmpv6.h  2013-06-10 20:53:57.621355486 +0200
  32 @@ -123,6 +123,7 @@
  33  #define ICMPV6_NOT_NEIGHBOUR           2
  34  #define ICMPV6_ADDR_UNREACH            3
  35  #define ICMPV6_PORT_UNREACH            4
  36 +#define ICMPV6_FAILED_POLICY           5
  37
  38  /*
  39   *     Codes for Time Exceeded
  40 Index: linux-3.3.8/include/linux/rtnetlink.h
  41 ===================================================================
  42 --- linux-3.3.8.orig/include/linux/rtnetlink.h  2013-06-10 20:53:57.637355486 +0200
  43 +++ linux-3.3.8/include/linux/rtnetlink.h       2013-06-10 20:53:57.621355486 +0200
  44 @@ -191,6 +191,7 @@
  45         RTN_THROW,              /* Not in this table            */
  46         RTN_NAT,                /* Translate this address       */
  47         RTN_XRESOLVE,           /* Use external resolver        */
  48 +       RTN_FAILED_POLICY,      /* Failed ingress/egress policy */
  49         __RTN_MAX
  50  };
  51
  52 Index: linux-3.3.8/net/ipv4/fib_rules.c
  53 ===================================================================
  54 --- linux-3.3.8.orig/net/ipv4/fib_rules.c       2013-06-10 20:53:57.637355486 +0200
  55 +++ linux-3.3.8/net/ipv4/fib_rules.c    2013-06-10 20:53:57.621355486 +0200
  56 @@ -87,6 +87,10 @@
  57                 err = -EACCES;
  58                 goto errout;
  59
  60 +       case FR_ACT_FAILED_POLICY:
  61 +               err = -EPERM;
  62 +               goto errout;
  63 +
  64         case FR_ACT_BLACKHOLE:
  65         default:
  66                 err = -EINVAL;
  67 Index: linux-3.3.8/net/ipv4/fib_semantics.c
  68 ===================================================================
  69 --- linux-3.3.8.orig/net/ipv4/fib_semantics.c   2013-06-10 20:53:57.637355486 +0200
  70 +++ linux-3.3.8/net/ipv4/fib_semantics.c        2013-06-10 20:53:57.621355486 +0200
  71 @@ -139,6 +139,10 @@
  72                 .error  = -EINVAL,
  73                 .scope  = RT_SCOPE_NOWHERE,
  74         },
  75 +       [RTN_FAILED_POLICY] = {
  76 +               .error  = -EPERM,
  77 +               .scope  = RT_SCOPE_UNIVERSE,
  78 +       },
  79  };
  80
  81  /* Release a nexthop info record */
  82 Index: linux-3.3.8/net/ipv4/fib_trie.c
  83 ===================================================================
  84 --- linux-3.3.8.orig/net/ipv4/fib_trie.c        2013-06-10 20:53:57.637355486 +0200
  85 +++ linux-3.3.8/net/ipv4/fib_trie.c     2013-06-10 20:53:57.625355486 +0200
  86 @@ -2349,6 +2349,7 @@
  87         [RTN_THROW] = "THROW",
  88         [RTN_NAT] = "NAT",
  89         [RTN_XRESOLVE] = "XRESOLVE",
  90 +       [RTN_FAILED_POLICY] = "FAILED_POLICY",
  91  };
  92
  93  static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
  94 Index: linux-3.3.8/net/ipv4/ipmr.c
  95 ===================================================================
  96 --- linux-3.3.8.orig/net/ipv4/ipmr.c    2013-06-10 20:53:57.637355486 +0200
  97 +++ linux-3.3.8/net/ipv4/ipmr.c 2013-06-10 20:53:57.625355486 +0200
  98 @@ -176,6 +176,7 @@
  99         case FR_ACT_UNREACHABLE:
 100                 return -ENETUNREACH;
 101         case FR_ACT_PROHIBIT:
 102 +       case FR_ACT_FAILED_POLICY:
 103                 return -EACCES;
 104         case FR_ACT_BLACKHOLE:
 105         default:
 106 Index: linux-3.3.8/net/ipv6/fib6_rules.c
 107 ===================================================================
 108 --- linux-3.3.8.orig/net/ipv6/fib6_rules.c      2013-06-10 20:53:57.637355486 +0200
 109 +++ linux-3.3.8/net/ipv6/fib6_rules.c   2013-06-10 20:53:57.625355486 +0200
 110 @@ -70,6 +70,9 @@
 111         case FR_ACT_PROHIBIT:
 112                 rt = net->ipv6.ip6_prohibit_entry;
 113                 goto discard_pkt;
 114 +       case FR_ACT_FAILED_POLICY:
 115 +               rt = net->ipv6.ip6_failed_policy_entry;
 116 +               goto discard_pkt;
 117         }
 118
 119         table = fib6_get_table(net, rule->table);
 120 Index: linux-3.3.8/net/ipv6/ip6mr.c
 121 ===================================================================
 122 --- linux-3.3.8.orig/net/ipv6/ip6mr.c   2013-06-10 20:53:57.637355486 +0200
 123 +++ linux-3.3.8/net/ipv6/ip6mr.c        2013-06-10 20:53:57.629355486 +0200
 124 @@ -164,6 +164,8 @@
 125                 return -ENETUNREACH;
 126         case FR_ACT_PROHIBIT:
 127                 return -EACCES;
 128 +       case FR_ACT_FAILED_POLICY:
 129 +               return -EPERM;
 130         case FR_ACT_BLACKHOLE:
 131         default:
 132                 return -EINVAL;
 133 Index: linux-3.3.8/net/ipv6/route.c
 134 ===================================================================
 135 --- linux-3.3.8.orig/net/ipv6/route.c   2013-06-10 20:53:57.637355486 +0200
 136 +++ linux-3.3.8/net/ipv6/route.c        2013-06-10 20:53:57.629355486 +0200
 137 @@ -228,6 +228,24 @@
 138         .rt6i_ref       = ATOMIC_INIT(1),
 139  };
 140
 141 +static int ip6_pkt_failed_policy(struct sk_buff *skb);
 142 +static int ip6_pkt_failed_policy_out(struct sk_buff *skb);
 143 +
 144 +static const struct rt6_info ip6_failed_policy_entry_template = {
 145 +       .dst = {
 146 +               .__refcnt       = ATOMIC_INIT(1),
 147 +               .__use          = 1,
 148 +               .obsolete       = -1,
 149 +               .error          = -EPERM,
 150 +               .input          = ip6_pkt_failed_policy,
 151 +               .output         = ip6_pkt_failed_policy_out,
 152 +       },
 153 +       .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
 154 +       .rt6i_protocol  = RTPROT_KERNEL,
 155 +       .rt6i_metric    = ~(u32) 0,
 156 +       .rt6i_ref       = ATOMIC_INIT(1),
 157 +};
 158 +
 159  static struct rt6_info ip6_blk_hole_entry_template = {
 160         .dst = {
 161                 .__refcnt       = ATOMIC_INIT(1),
 162 @@ -1344,6 +1362,9 @@
 163                 case RTN_THROW:
 164                         rt->dst.error = -EAGAIN;
 165                         break;
 166 +               case RTN_FAILED_POLICY:
 167 +                       rt->dst.error = -EPERM;
 168 +                       break;
 169                 default:
 170                         rt->dst.error = -ENETUNREACH;
 171                         break;
 172 @@ -2068,6 +2089,17 @@
 173         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
 174  }
 175
 176 +static int ip6_pkt_failed_policy(struct sk_buff *skb)
 177 +{
 178 +       return ip6_pkt_drop(skb, ICMPV6_FAILED_POLICY, IPSTATS_MIB_INNOROUTES);
 179 +}
 180 +
 181 +static int ip6_pkt_failed_policy_out(struct sk_buff *skb)
 182 +{
 183 +       skb->dev = skb_dst(skb)->dev;
 184 +       return ip6_pkt_drop(skb, ICMPV6_FAILED_POLICY, IPSTATS_MIB_OUTNOROUTES);
 185 +}
 186 +
 187  #endif
 188
 189  /*
 190 @@ -2283,7 +2315,8 @@
 191         if (rtm->rtm_type == RTN_UNREACHABLE ||
 192             rtm->rtm_type == RTN_BLACKHOLE ||
 193             rtm->rtm_type == RTN_PROHIBIT ||
 194 -           rtm->rtm_type == RTN_THROW)
 195 +           rtm->rtm_type == RTN_THROW ||
 196 +           rtm->rtm_type == RTN_FAILED_POLICY)
 197                 cfg->fc_flags |= RTF_REJECT;
 198
 199         if (rtm->rtm_type == RTN_LOCAL)
 200 @@ -2421,6 +2454,9 @@
 201                 case -EACCES:
 202                         rtm->rtm_type = RTN_PROHIBIT;
 203                         break;
 204 +               case -EPERM:
 205 +                       rtm->rtm_type = RTN_FAILED_POLICY;
 206 +                       break;
 207                 case -EAGAIN:
 208                         rtm->rtm_type = RTN_THROW;
 209                         break;
 210 @@ -2665,6 +2701,8 @@
 211  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 212                 net->ipv6.ip6_prohibit_entry->dst.dev = dev;
 213                 net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
 214 +               net->ipv6.ip6_failed_policy_entry->dst.dev = dev;
 215 +               net->ipv6.ip6_failed_policy_entry->rt6i_idev = in6_dev_get(dev);
 216                 net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
 217                 net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
 218  #endif
 219 @@ -2925,6 +2963,17 @@
 220         net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
 221         dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
 222                          ip6_template_metrics, true);
 223 +
 224 +       net->ipv6.ip6_failed_policy_entry =
 225 +               kmemdup(&ip6_failed_policy_entry_template,
 226 +                       sizeof(*net->ipv6.ip6_failed_policy_entry), GFP_KERNEL);
 227 +       if (!net->ipv6.ip6_failed_policy_entry)
 228 +               goto out_ip6_blk_hole_entry;
 229 +       net->ipv6.ip6_failed_policy_entry->dst.path =
 230 +               (struct dst_entry *)net->ipv6.ip6_failed_policy_entry;
 231 +       net->ipv6.ip6_failed_policy_entry->dst.ops = &net->ipv6.ip6_dst_ops;
 232 +       dst_init_metrics(&net->ipv6.ip6_failed_policy_entry->dst,
 233 +                        ip6_template_metrics, true);
 234  #endif
 235
 236         net->ipv6.sysctl.flush_delay = 0;
 237 @@ -2947,6 +2996,8 @@
 238         return ret;
 239
 240  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 241 +out_ip6_blk_hole_entry:
 242 +       kfree(net->ipv6.ip6_blk_hole_entry);
 243  out_ip6_prohibit_entry:
 244         kfree(net->ipv6.ip6_prohibit_entry);
 245  out_ip6_null_entry:
 246 @@ -2968,6 +3019,7 @@
 247  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 248         kfree(net->ipv6.ip6_prohibit_entry);
 249         kfree(net->ipv6.ip6_blk_hole_entry);
 250 +       kfree(net->ipv6.ip6_failed_policy_entry);
 251  #endif
 252         dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 253  }
 254 @@ -3013,6 +3065,9 @@
 255         init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
 256         init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
 257         init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
 258 +       init_net.ipv6.ip6_failed_policy_entry->dst.dev = init_net.loopback_dev;
 259 +       init_net.ipv6.ip6_failed_policy_entry->rt6i_idev =
 260 +               in6_dev_get(init_net.loopback_dev);
 261    #endif
 262         ret = fib6_init();
 263         if (ret)