9e8bc10fd67f8d7ad74ba8096a65231fed99c492
[oweals/openwrt.git] / target / linux / generic / pending-4.19 / 670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
1 From: Jonas Gorski <jogo@openwrt.org>
2 Subject: ipv6: allow rejecting with "source address failed policy"
3
4 RFC6204 L-14 requires rejecting traffic from invalid addresses with
5 ICMPv6 Destination Unreachable, Code 5 (Source address failed ingress/
6 egress policy) on the LAN side, so add an appropriate rule for that.
7
8 Signed-off-by: Jonas Gorski <jogo@openwrt.org>
9 ---
10  include/net/netns/ipv6.h       |  1 +
11  include/uapi/linux/fib_rules.h |  4 +++
12  include/uapi/linux/rtnetlink.h |  1 +
13  net/ipv4/fib_semantics.c       |  4 +++
14  net/ipv4/fib_trie.c            |  1 +
15  net/ipv4/ipmr.c                |  1 +
16  net/ipv6/fib6_rules.c          |  4 +++
17  net/ipv6/ip6mr.c               |  2 ++
18  net/ipv6/route.c               | 58 +++++++++++++++++++++++++++++++++++++++++-
19  9 files changed, 75 insertions(+), 1 deletion(-)
20
21 --- a/include/net/netns/ipv6.h
22 +++ b/include/net/netns/ipv6.h
23 @@ -78,6 +78,7 @@ struct netns_ipv6 {
24         unsigned int            fib6_rules_require_fldissect;
25         bool                    fib6_has_custom_rules;
26         struct rt6_info         *ip6_prohibit_entry;
27 +       struct rt6_info         *ip6_policy_failed_entry;
28         struct rt6_info         *ip6_blk_hole_entry;
29         struct fib6_table       *fib6_local_tbl;
30         struct fib_rules_ops    *fib6_rules_ops;
31 --- a/include/uapi/linux/fib_rules.h
32 +++ b/include/uapi/linux/fib_rules.h
33 @@ -82,6 +82,10 @@ enum {
34         FR_ACT_BLACKHOLE,       /* Drop without notification */
35         FR_ACT_UNREACHABLE,     /* Drop with ENETUNREACH */
36         FR_ACT_PROHIBIT,        /* Drop with EACCES */
37 +       FR_ACT_RES9,
38 +       FR_ACT_RES10,
39 +       FR_ACT_RES11,
40 +       FR_ACT_POLICY_FAILED,   /* Drop with EACCES */
41         __FR_ACT_MAX,
42  };
43  
44 --- a/include/uapi/linux/rtnetlink.h
45 +++ b/include/uapi/linux/rtnetlink.h
46 @@ -228,6 +228,7 @@ enum {
47         RTN_THROW,              /* Not in this table            */
48         RTN_NAT,                /* Translate this address       */
49         RTN_XRESOLVE,           /* Use external resolver        */
50 +       RTN_POLICY_FAILED,      /* Failed ingress/egress policy */
51         __RTN_MAX
52  };
53  
54 --- a/net/ipv4/fib_semantics.c
55 +++ b/net/ipv4/fib_semantics.c
56 @@ -139,6 +139,10 @@ const struct fib_prop fib_props[RTN_MAX
57                 .error  = -EINVAL,
58                 .scope  = RT_SCOPE_NOWHERE,
59         },
60 +       [RTN_POLICY_FAILED] = {
61 +               .error  = -EACCES,
62 +               .scope  = RT_SCOPE_UNIVERSE,
63 +       },
64  };
65  
66  static void rt_fibinfo_free(struct rtable __rcu **rtp)
67 --- a/net/ipv4/fib_trie.c
68 +++ b/net/ipv4/fib_trie.c
69 @@ -2474,6 +2474,7 @@ static const char *const rtn_type_names[
70         [RTN_THROW] = "THROW",
71         [RTN_NAT] = "NAT",
72         [RTN_XRESOLVE] = "XRESOLVE",
73 +       [RTN_POLICY_FAILED] = "POLICY_FAILED",
74  };
75  
76  static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
77 --- a/net/ipv4/ipmr.c
78 +++ b/net/ipv4/ipmr.c
79 @@ -179,6 +179,7 @@ static int ipmr_rule_action(struct fib_r
80         case FR_ACT_UNREACHABLE:
81                 return -ENETUNREACH;
82         case FR_ACT_PROHIBIT:
83 +       case FR_ACT_POLICY_FAILED:
84                 return -EACCES;
85         case FR_ACT_BLACKHOLE:
86         default:
87 --- a/net/ipv6/fib6_rules.c
88 +++ b/net/ipv6/fib6_rules.c
89 @@ -221,6 +221,10 @@ static int __fib6_rule_action(struct fib
90                 err = -EACCES;
91                 rt = net->ipv6.ip6_prohibit_entry;
92                 goto discard_pkt;
93 +       case FR_ACT_POLICY_FAILED:
94 +               err = -EACCES;
95 +               rt = net->ipv6.ip6_policy_failed_entry;
96 +               goto discard_pkt;
97         }
98  
99         tb_id = fib_rule_get_table(rule, arg);
100 --- a/net/ipv6/ip6mr.c
101 +++ b/net/ipv6/ip6mr.c
102 @@ -162,6 +162,8 @@ static int ip6mr_rule_action(struct fib_
103                 return -ENETUNREACH;
104         case FR_ACT_PROHIBIT:
105                 return -EACCES;
106 +       case FR_ACT_POLICY_FAILED:
107 +               return -EACCES;
108         case FR_ACT_BLACKHOLE:
109         default:
110                 return -EINVAL;
111 --- a/net/ipv6/route.c
112 +++ b/net/ipv6/route.c
113 @@ -97,6 +97,8 @@ static int            ip6_pkt_discard(struct sk_bu
114  static int             ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
115  static int             ip6_pkt_prohibit(struct sk_buff *skb);
116  static int             ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
117 +static int             ip6_pkt_policy_failed(struct sk_buff *skb);
118 +static int             ip6_pkt_policy_failed_out(struct net *net, struct sock *sk, struct sk_buff *skb);
119  static void            ip6_link_failure(struct sk_buff *skb);
120  static void            ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
121                                            struct sk_buff *skb, u32 mtu);
122 @@ -326,6 +328,18 @@ static const struct rt6_info ip6_prohibi
123         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
124  };
125  
126 +static const struct rt6_info ip6_policy_failed_entry_template = {
127 +       .dst = {
128 +               .__refcnt       = ATOMIC_INIT(1),
129 +               .__use          = 1,
130 +               .obsolete       = DST_OBSOLETE_FORCE_CHK,
131 +               .error          = -EACCES,
132 +               .input          = ip6_pkt_policy_failed,
133 +               .output         = ip6_pkt_policy_failed_out,
134 +       },
135 +       .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
136 +};
137 +
138  static const struct rt6_info ip6_blk_hole_entry_template = {
139         .dst = {
140                 .__refcnt       = ATOMIC_INIT(1),
141 @@ -900,6 +914,7 @@ static const int fib6_prop[RTN_MAX + 1]
142         [RTN_BLACKHOLE] = -EINVAL,
143         [RTN_UNREACHABLE] = -EHOSTUNREACH,
144         [RTN_PROHIBIT]  = -EACCES,
145 +       [RTN_POLICY_FAILED] = -EACCES,
146         [RTN_THROW]     = -EAGAIN,
147         [RTN_NAT]       = -EINVAL,
148         [RTN_XRESOLVE]  = -EINVAL,
149 @@ -937,6 +952,10 @@ static void ip6_rt_init_dst_reject(struc
150                 rt->dst.output = ip6_pkt_prohibit_out;
151                 rt->dst.input = ip6_pkt_prohibit;
152                 break;
153 +       case RTN_POLICY_FAILED:
154 +               rt->dst.output = ip6_pkt_policy_failed_out;
155 +               rt->dst.input = ip6_pkt_policy_failed;
156 +               break;
157         case RTN_THROW:
158         case RTN_UNREACHABLE:
159         default:
160 @@ -3774,6 +3793,17 @@ static int ip6_pkt_prohibit_out(struct n
161         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
162  }
163  
164 +static int ip6_pkt_policy_failed(struct sk_buff *skb)
165 +{
166 +       return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_INNOROUTES);
167 +}
168 +
169 +static int ip6_pkt_policy_failed_out(struct net *net, struct sock *sk, struct sk_buff *skb)
170 +{
171 +       skb->dev = skb_dst(skb)->dev;
172 +       return ip6_pkt_drop(skb, ICMPV6_POLICY_FAIL, IPSTATS_MIB_OUTNOROUTES);
173 +}
174 +
175  /*
176   *     Allocate a dst for local (unicast / anycast) address.
177   */
178 @@ -4221,7 +4251,8 @@ static int rtm_to_fib6_config(struct sk_
179         if (rtm->rtm_type == RTN_UNREACHABLE ||
180             rtm->rtm_type == RTN_BLACKHOLE ||
181             rtm->rtm_type == RTN_PROHIBIT ||
182 -           rtm->rtm_type == RTN_THROW)
183 +           rtm->rtm_type == RTN_THROW ||
184 +           rtm->rtm_type == RTN_POLICY_FAILED)
185                 cfg->fc_flags |= RTF_REJECT;
186  
187         if (rtm->rtm_type == RTN_LOCAL)
188 @@ -5069,6 +5100,8 @@ static int ip6_route_dev_notify(struct n
189  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
190                 net->ipv6.ip6_prohibit_entry->dst.dev = dev;
191                 net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
192 +               net->ipv6.ip6_policy_failed_entry->dst.dev = dev;
193 +               net->ipv6.ip6_policy_failed_entry->rt6i_idev = in6_dev_get(dev);
194                 net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
195                 net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
196  #endif
197 @@ -5080,6 +5113,7 @@ static int ip6_route_dev_notify(struct n
198                 in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
199  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
200                 in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
201 +               in6_dev_put_clear(&net->ipv6.ip6_policy_failed_entry->rt6i_idev);
202                 in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
203  #endif
204         }
205 @@ -5274,6 +5308,15 @@ static int __net_init ip6_route_net_init
206         net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
207         dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
208                          ip6_template_metrics, true);
209 +
210 +       net->ipv6.ip6_policy_failed_entry =
211 +               kmemdup(&ip6_policy_failed_entry_template,
212 +                       sizeof(*net->ipv6.ip6_policy_failed_entry), GFP_KERNEL);
213 +       if (!net->ipv6.ip6_policy_failed_entry)
214 +               goto out_ip6_blk_hole_entry;
215 +       net->ipv6.ip6_policy_failed_entry->dst.ops = &net->ipv6.ip6_dst_ops;
216 +       dst_init_metrics(&net->ipv6.ip6_policy_failed_entry->dst,
217 +                        ip6_template_metrics, true);
218  #endif
219  
220         net->ipv6.sysctl.flush_delay = 0;
221 @@ -5292,6 +5335,8 @@ out:
222         return ret;
223  
224  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
225 +out_ip6_blk_hole_entry:
226 +       kfree(net->ipv6.ip6_blk_hole_entry);
227  out_ip6_prohibit_entry:
228         kfree(net->ipv6.ip6_prohibit_entry);
229  out_ip6_null_entry:
230 @@ -5312,6 +5357,7 @@ static void __net_exit ip6_route_net_exi
231  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
232         kfree(net->ipv6.ip6_prohibit_entry);
233         kfree(net->ipv6.ip6_blk_hole_entry);
234 +       kfree(net->ipv6.ip6_policy_failed_entry);
235  #endif
236         dst_entries_destroy(&net->ipv6.ip6_dst_ops);
237  }
238 @@ -5388,6 +5434,9 @@ void __init ip6_route_init_special_entri
239         init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
240         init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
241         init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
242 +       init_net.ipv6.ip6_policy_failed_entry->dst.dev = init_net.loopback_dev;
243 +       init_net.ipv6.ip6_policy_failed_entry->rt6i_idev =
244 +               in6_dev_get(init_net.loopback_dev);
245    #endif
246  }
247