leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'net-2.6.26-isatap-20080403' of git://git.linux-ipv6.org/gitroot/yoshfuji/linux-2.6-dev

Browse Source
This commit is contained in:
David S. Miller 2008-04-08 02:33:36 -07:00
commit 8eefca4888
11 changed files with 330 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
include/linux/if_tunnel.h
View File

@ -7,6 +7,10 @@
#define SIOCADDTUNNEL (SIOCDEVPRIVATE + 1)
#define SIOCDELTUNNEL (SIOCDEVPRIVATE + 2)
#define SIOCCHGTUNNEL (SIOCDEVPRIVATE + 3)
#define SIOCGETPRL (SIOCDEVPRIVATE + 4)
#define SIOCADDPRL (SIOCDEVPRIVATE + 5)
#define SIOCDELPRL (SIOCDEVPRIVATE + 6)
#define SIOCCHGPRL (SIOCDEVPRIVATE + 7)
#define GRE_CSUM __constant_htons(0x8000)
#define GRE_ROUTING __constant_htons(0x4000)
@ -17,9 +21,6 @@
#define GRE_FLAGS __constant_htons(0x00F8)
#define GRE_VERSION __constant_htons(0x0007)
/* i_flags values for SIT mode */
#define SIT_ISATAP 0x0001
struct ip_tunnel_parm
{
char name[IFNAMSIZ];
@ -31,4 +32,19 @@ struct ip_tunnel_parm
struct iphdr iph;
};
/* SIT-mode i_flags */
#define SIT_ISATAP 0x0001
struct ip_tunnel_prl {
__be32 addr;
__u16 flags;
__u16 __reserved;
__u32 datalen;
__u32 __reserved2;
void __user *data;
};
/* PRL flags */
#define PRL_DEFAULT 0x0001
#endif /* _IF_TUNNEL_H_ */

5
include/linux/skbuff.h
View File

@ -313,7 +313,10 @@ struct sk_buff {
__u16 tc_verd; /* traffic control verdict */
#endif
#endif
/* 2 byte hole */
#ifdef CONFIG_IPV6_NDISC_NODETYPE
__u8 ndisc_nodetype:2;
#endif
/* 14 bit hole */
#ifdef CONFIG_NET_DMA
dma_cookie_t dma_cookie;

4
include/net/addrconf.h
View File

@ -71,6 +71,10 @@ extern int ipv6_chk_addr(struct net *net,
extern int ipv6_chk_home_addr(struct net *net,
struct in6_addr *addr);
#endif
extern int ipv6_chk_prefix(struct in6_addr *addr,
struct net_device *dev);
extern struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net,
struct in6_addr *addr,
struct net_device *dev,

10
include/net/ipip.h
View File

@ -24,6 +24,16 @@ struct ip_tunnel
int mlink;
struct ip_tunnel_parm parms;
struct ip_tunnel_prl_entry *prl; /* potential router list */
unsigned int prl_count; /* # of entries in PRL */
};
struct ip_tunnel_prl_entry
{
struct ip_tunnel_prl_entry *next;
__be32 addr;
u16 flags;
};
#define IPTUNNEL_XMIT() do { \

9
include/net/ndisc.h
View File

@ -11,6 +11,15 @@
#define NDISC_NEIGHBOUR_ADVERTISEMENT 136
#define NDISC_REDIRECT 137
/*
* Router type: cross-layer information from link-layer to
* IPv6 layer reported by certain link types (e.g., RFC4214).
*/
#define NDISC_NODETYPE_UNSPEC 0 /* unspecified (default) */
#define NDISC_NODETYPE_HOST 1 /* host or unauthorized router */
#define NDISC_NODETYPE_NODEFAULT 2 /* non-default router */
#define NDISC_NODETYPE_DEFAULT 3 /* default router */
/*
* ndisc options
*/

4
net/ipv6/Kconfig
View File

@ -168,6 +168,7 @@ config IPV6_SIT
tristate "IPv6: IPv6-in-IPv4 tunnel (SIT driver)"
depends on IPV6
select INET_TUNNEL
select IPV6_NDISC_NODETYPE
default y
---help---
Tunneling means encapsulating data of one protocol type within
@ -178,6 +179,9 @@ config IPV6_SIT
Saying M here will produce a module called sit.ko. If unsure, say Y.
config IPV6_NDISC_NODETYPE
bool
config IPV6_TUNNEL
tristate "IPv6: IP-in-IPv6 tunnel (RFC2473)"
select INET6_TUNNEL

25
net/ipv6/addrconf.c
View File

@ -1265,6 +1265,31 @@ int ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
return ifp != NULL;
}
int ipv6_chk_prefix(struct in6_addr *addr, struct net_device *dev)
{
struct inet6_dev *idev;
struct inet6_ifaddr *ifa;
int onlink;
onlink = 0;
rcu_read_lock();
idev = __in6_dev_get(dev);
if (idev) {
read_lock_bh(&idev->lock);
for (ifa = idev->addr_list; ifa; ifa = ifa->if_next) {
onlink = ipv6_prefix_equal(addr, &ifa->addr,
ifa->prefix_len);
if (onlink)
break;
}
read_unlock_bh(&idev->lock);
}
rcu_read_unlock();
return onlink;
}
EXPORT_SYMBOL(ipv6_chk_prefix);
struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, struct in6_addr *addr,
struct net_device *dev, int strict)
{

25
net/ipv6/anycast.c
View File

@ -48,29 +48,6 @@ static int ipv6_dev_ac_dec(struct net_device *dev, struct in6_addr *addr);
/* Big ac list lock for all the sockets */
static DEFINE_RWLOCK(ipv6_sk_ac_lock);
static int
ip6_onlink(struct in6_addr *addr, struct net_device *dev)
{
struct inet6_dev *idev;
struct inet6_ifaddr *ifa;
int onlink;
onlink = 0;
rcu_read_lock();
idev = __in6_dev_get(dev);
if (idev) {
read_lock_bh(&idev->lock);
for (ifa=idev->addr_list; ifa; ifa=ifa->if_next) {
onlink = ipv6_prefix_equal(addr, &ifa->addr,
ifa->prefix_len);
if (onlink)
break;
}
read_unlock_bh(&idev->lock);
}
rcu_read_unlock();
return onlink;
}
/*
* socket join an anycast group
@ -142,7 +119,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, struct in6_addr *addr)
* This obviates the need for propagating anycast routes while
* still allowing some non-router anycast participation.
*/
if (!ip6_onlink(addr, dev)) {
if (!ipv6_chk_prefix(addr, dev)) {
if (ishost)
err = -EADDRNOTAVAIL;
if (err)

42
net/ipv6/ndisc.c
View File

@ -1093,6 +1093,14 @@ static void ndisc_router_discovery(struct sk_buff *skb)
return;
}
#ifdef CONFIG_IPV6_NDISC_NODETYPE
if (skb->ndisc_nodetype == NDISC_NODETYPE_HOST) {
ND_PRINTK2(KERN_WARNING
"ICMPv6 RA: from host or unauthorized router\n");
return;
}
#endif
/*
* set the RA_RECV flag in the interface
*/
@ -1116,6 +1124,12 @@ static void ndisc_router_discovery(struct sk_buff *skb)
return;
}
#ifdef CONFIG_IPV6_NDISC_NODETYPE
/* skip link-specific parameters from interior routers */
if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
goto skip_linkparms;
#endif
if (in6_dev->if_flags & IF_RS_SENT) {
/*
* flag that an RA was received after an RS was sent
@ -1230,6 +1244,10 @@ skip_defrtr:
}
}
#ifdef CONFIG_IPV6_NDISC_NODETYPE
skip_linkparms:
#endif
/*
* Process options.
*/
@ -1261,7 +1279,13 @@ skip_defrtr:
for (p = ndopts.nd_opts_ri;
p;
p = ndisc_next_option(p, ndopts.nd_opts_ri_end)) {
if (((struct route_info *)p)->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
struct route_info *ri = (struct route_info *)p;
#ifdef CONFIG_IPV6_NDISC_NODETYPE
if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT &&
ri->prefix_len == 0)
continue;
#endif
if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
continue;
rt6_route_rcv(skb->dev, (u8*)p, (p->nd_opt_len) << 3,
&ipv6_hdr(skb)->saddr);
@ -1269,6 +1293,12 @@ skip_defrtr:
}
#endif
#ifdef CONFIG_IPV6_NDISC_NODETYPE
/* skip link-specific ndopts from interior routers */
if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT)
goto out;
#endif
if (in6_dev->cnf.accept_ra_pinfo && ndopts.nd_opts_pi) {
struct nd_opt_hdr *p;
for (p = ndopts.nd_opts_pi;
@ -1332,6 +1362,16 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
int optlen;
u8 *lladdr = NULL;
#ifdef CONFIG_IPV6_NDISC_NODETYPE
switch (skb->ndisc_nodetype) {
case NDISC_NODETYPE_HOST:
case NDISC_NODETYPE_NODEFAULT:
ND_PRINTK2(KERN_WARNING
"ICMPv6 Redirect: from host or unauthorized router\n");
return;
}
#endif
if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
ND_PRINTK2(KERN_WARNING
"ICMPv6 Redirect: source address is not link-local.\n");

2
net/ipv6/route.c
View File

@ -1700,8 +1700,6 @@ struct rt6_info *rt6_get_dflt_router(struct in6_addr *addr, struct net_device *d
return rt;
}
EXPORT_SYMBOL(rt6_get_dflt_router);
struct rt6_info *rt6_add_dflt_router(struct in6_addr *gwaddr,
struct net_device *dev,
unsigned int pref)

257
net/ipv6/sit.c
View File

@ -16,7 +16,7 @@
* Changes:
* Roger Venning <r.venning@telstra.com>: 6to4 support
* Nate Thompson <nate@thebog.net>: 6to4 support
* Fred L. Templin <fltemplin@acm.org>: isatap support
* Fred Templin <fred.l.templin@boeing.com>: isatap support
*/
#include <linux/module.h>
@ -197,6 +197,179 @@ failed:
return NULL;
}
static struct ip_tunnel_prl_entry *
__ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
{
struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL;
for (p = t->prl; p; p = p->next)
if (p->addr == addr)
break;
return p;
}
static int ipip6_tunnel_get_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
{
struct ip_tunnel_prl *kp;
struct ip_tunnel_prl_entry *prl;
unsigned int cmax, c = 0, ca, len;
int ret = 0;
cmax = a->datalen / sizeof(*a);
if (cmax > 1 && a->addr != htonl(INADDR_ANY))
cmax = 1;
/* For simple GET or for root users,
* we try harder to allocate.
*/
kp = (cmax <= 1 || capable(CAP_NET_ADMIN)) ?
kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
NULL;
read_lock(&ipip6_lock);
ca = t->prl_count < cmax ? t->prl_count : cmax;
if (!kp) {
/* We don't try hard to allocate much memory for
* non-root users.
* For root users, retry allocating enough memory for
* the answer.
*/
kp = kcalloc(ca, sizeof(*kp), GFP_ATOMIC);
if (!kp) {
ret = -ENOMEM;
goto out;
}
}
c = 0;
for (prl = t->prl; prl; prl = prl->next) {
if (c > cmax)
break;
if (a->addr != htonl(INADDR_ANY) && prl->addr != a->addr)
continue;
kp[c].addr = prl->addr;
kp[c].flags = prl->flags;
c++;
if (a->addr != htonl(INADDR_ANY))
break;
}
out:
read_unlock(&ipip6_lock);
len = sizeof(*kp) * c;
ret = len ? copy_to_user(a->data, kp, len) : 0;
kfree(kp);
if (ret)
return -EFAULT;
a->datalen = len;
return 0;
}
static int
ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
{
struct ip_tunnel_prl_entry *p;
int err = 0;
if (a->addr == htonl(INADDR_ANY))
return -EINVAL;
write_lock(&ipip6_lock);
for (p = t->prl; p; p = p->next) {
if (p->addr == a->addr) {
if (chg)
goto update;
err = -EEXIST;
goto out;
}
}
if (chg) {
err = -ENXIO;
goto out;
}
p = kzalloc(sizeof(struct ip_tunnel_prl_entry), GFP_KERNEL);
if (!p) {
err = -ENOBUFS;
goto out;
}
p->next = t->prl;
t->prl = p;
t->prl_count++;
update:
p->addr = a->addr;
p->flags = a->flags;
out:
write_unlock(&ipip6_lock);
return err;
}
static int
ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
{
struct ip_tunnel_prl_entry *x, **p;
int err = 0;
write_lock(&ipip6_lock);
if (a && a->addr != htonl(INADDR_ANY)) {
for (p = &t->prl; *p; p = &(*p)->next) {
if ((*p)->addr == a->addr) {
x = *p;
*p = x->next;
kfree(x);
t->prl_count--;
goto out;
}
}
err = -ENXIO;
} else {
while (t->prl) {
x = t->prl;
t->prl = t->prl->next;
kfree(x);
t->prl_count--;
}
}
out:
write_unlock(&ipip6_lock);
return 0;
}
static int
isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
{
struct ip_tunnel_prl_entry *p;
int ok = 1;
read_lock(&ipip6_lock);
p = __ipip6_tunnel_locate_prl(t, iph->saddr);
if (p) {
if (p->flags & PRL_DEFAULT)
skb->ndisc_nodetype = NDISC_NODETYPE_DEFAULT;
else
skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT;
} else {
struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
if (ipv6_addr_is_isatap(addr6) &&
(addr6->s6_addr32[3] == iph->saddr) &&
ipv6_chk_prefix(addr6, t->dev))
skb->ndisc_nodetype = NDISC_NODETYPE_HOST;
else
ok = 0;
}
read_unlock(&ipip6_lock);
return ok;
}
static void ipip6_tunnel_uninit(struct net_device *dev)
{
if (dev == ipip6_fb_tunnel_dev) {
@ -206,6 +379,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
dev_put(dev);
} else {
ipip6_tunnel_unlink(netdev_priv(dev));
ipip6_tunnel_del_prl(netdev_priv(dev), 0);
dev_put(dev);
}
}
@ -365,48 +539,6 @@ static inline void ipip6_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
IP6_ECN_set_ce(ipv6_hdr(skb));
}
/* ISATAP (RFC4214) - check source address */
static int
isatap_srcok(struct sk_buff *skb, struct iphdr *iph, struct net_device *dev)
{
struct neighbour *neigh;
struct dst_entry *dst;
struct rt6_info *rt;
struct flowi fl;
struct in6_addr *addr6;
struct in6_addr rtr;
struct ipv6hdr *iph6;
int ok = 0;
/* from onlink default router */
ipv6_addr_set(&rtr, htonl(0xFE800000), 0, 0, 0);
ipv6_isatap_eui64(rtr.s6_addr + 8, iph->saddr);
if ((rt = rt6_get_dflt_router(&rtr, dev))) {
dst_release(&rt->u.dst);
return 1;
}
iph6 = ipv6_hdr(skb);
memset(&fl, 0, sizeof(fl));
fl.proto = iph6->nexthdr;
ipv6_addr_copy(&fl.fl6_dst, &iph6->saddr);
fl.oif = dev->ifindex;
security_skb_classify_flow(skb, &fl);
dst = ip6_route_output(&init_net, NULL, &fl);
if (!dst->error && (dst->dev == dev) && (neigh = dst->neighbour)) {
addr6 = (struct in6_addr*)&neigh->primary_key;
/* from correct previous hop */
if (ipv6_addr_is_isatap(addr6) &&
(addr6->s6_addr32[3] == iph->saddr))
ok = 1;
}
dst_release(dst);
return ok;
}
static int ipip6_rcv(struct sk_buff *skb)
{
struct iphdr *iph;
@ -427,7 +559,7 @@ static int ipip6_rcv(struct sk_buff *skb)
skb->pkt_type = PACKET_HOST;
if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
!isatap_srcok(skb, iph, tunnel->dev)) {
!isatap_chksrc(skb, iph, tunnel)) {
tunnel->stat.rx_errors++;
read_unlock(&ipip6_lock);
kfree_skb(skb);
@ -707,6 +839,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
{
int err = 0;
struct ip_tunnel_parm p;
struct ip_tunnel_prl prl;
struct ip_tunnel *t;
switch (cmd) {
@ -806,6 +939,42 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
err = 0;
break;
case SIOCGETPRL:
case SIOCADDPRL:
case SIOCDELPRL:
case SIOCCHGPRL:
err = -EPERM;
if (cmd != SIOCGETPRL && !capable(CAP_NET_ADMIN))
goto done;
err = -EINVAL;
if (dev == ipip6_fb_tunnel_dev)
goto done;
err = -EFAULT;
if (copy_from_user(&prl, ifr->ifr_ifru.ifru_data, sizeof(prl)))
goto done;
err = -ENOENT;
if (!(t = netdev_priv(dev)))
goto done;
switch (cmd) {
case SIOCGETPRL:
err = ipip6_tunnel_get_prl(t, &prl);
if (!err && copy_to_user(ifr->ifr_ifru.ifru_data,
&prl, sizeof(prl)))
err = -EFAULT;
break;
case SIOCDELPRL:
err = ipip6_tunnel_del_prl(t, &prl);
break;
case SIOCADDPRL:
case SIOCCHGPRL:
err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
break;
}
if (cmd != SIOCGETPRL)
netdev_state_change(dev);
break;
default:
err = -EINVAL;
}