1 /* 2 * IPv6 Address Label subsystem 3 * for the IPv6 "Default" Source Address Selection 4 * 5 * Copyright (C)2007 USAGI/WIDE Project 6 */ 7 /* 8 * Author: 9 * YOSHIFUJI Hideaki @ USAGI/WIDE Project <yoshfuji@linux-ipv6.org> 10 */ 11 12 #include <linux/kernel.h> 13 #include <linux/list.h> 14 #include <linux/rcupdate.h> 15 #include <linux/in6.h> 16 #include <net/addrconf.h> 17 #include <linux/if_addrlabel.h> 18 #include <linux/netlink.h> 19 #include <linux/rtnetlink.h> 20 21 #if 0 22 #define ADDRLABEL(x...) printk(x) 23 #else 24 #define ADDRLABEL(x...) do { ; } while(0) 25 #endif 26 27 /* 28 * Policy Table 29 */ 30 struct ip6addrlbl_entry 31 { 32 #ifdef CONFIG_NET_NS 33 struct net *lbl_net; 34 #endif 35 struct in6_addr prefix; 36 int prefixlen; 37 int ifindex; 38 int addrtype; 39 u32 label; 40 struct hlist_node list; 41 atomic_t refcnt; 42 struct rcu_head rcu; 43 }; 44 45 static struct ip6addrlbl_table 46 { 47 struct hlist_head head; 48 spinlock_t lock; 49 u32 seq; 50 } ip6addrlbl_table; 51 52 static inline 53 struct net *ip6addrlbl_net(const struct ip6addrlbl_entry *lbl) 54 { 55 #ifdef CONFIG_NET_NS 56 return lbl->lbl_net; 57 #else 58 return &init_net; 59 #endif 60 } 61 62 /* 63 * Default policy table (RFC3484 + extensions) 64 * 65 * prefix addr_type label 66 * ------------------------------------------------------------------------- 67 * ::1/128 LOOPBACK 0 68 * ::/0 N/A 1 69 * 2002::/16 N/A 2 70 * ::/96 COMPATv4 3 71 * ::ffff:0:0/96 V4MAPPED 4 72 * fc00::/7 N/A 5 ULA (RFC 4193) 73 * 2001::/32 N/A 6 Teredo (RFC 4380) 74 * 2001:10::/28 N/A 7 ORCHID (RFC 4843) 75 * 76 * Note: 0xffffffff is used if we do not have any policies. 77 */ 78 79 #define IPV6_ADDR_LABEL_DEFAULT 0xffffffffUL 80 81 static const __net_initdata struct ip6addrlbl_init_table 82 { 83 const struct in6_addr *prefix; 84 int prefixlen; 85 u32 label; 86 } ip6addrlbl_init_table[] = { 87 { /* ::/0 */ 88 .prefix = &in6addr_any, 89 .label = 1, 90 },{ /* fc00::/7 */ 91 .prefix = &(struct in6_addr){{{ 0xfc }}}, 92 .prefixlen = 7, 93 .label = 5, 94 },{ /* 2002::/16 */ 95 .prefix = &(struct in6_addr){{{ 0x20, 0x02 }}}, 96 .prefixlen = 16, 97 .label = 2, 98 },{ /* 2001::/32 */ 99 .prefix = &(struct in6_addr){{{ 0x20, 0x01 }}}, 100 .prefixlen = 32, 101 .label = 6, 102 },{ /* 2001:10::/28 */ 103 .prefix = &(struct in6_addr){{{ 0x20, 0x01, 0x00, 0x10 }}}, 104 .prefixlen = 28, 105 .label = 7, 106 },{ /* ::ffff:0:0 */ 107 .prefix = &(struct in6_addr){{{ [10] = 0xff, [11] = 0xff }}}, 108 .prefixlen = 96, 109 .label = 4, 110 },{ /* ::/96 */ 111 .prefix = &in6addr_any, 112 .prefixlen = 96, 113 .label = 3, 114 },{ /* ::1/128 */ 115 .prefix = &in6addr_loopback, 116 .prefixlen = 128, 117 .label = 0, 118 } 119 }; 120 121 /* Object management */ 122 static inline void ip6addrlbl_free(struct ip6addrlbl_entry *p) 123 { 124 #ifdef CONFIG_NET_NS 125 release_net(p->lbl_net); 126 #endif 127 kfree(p); 128 } 129 130 static void ip6addrlbl_free_rcu(struct rcu_head *h) 131 { 132 ip6addrlbl_free(container_of(h, struct ip6addrlbl_entry, rcu)); 133 } 134 135 static inline int ip6addrlbl_hold(struct ip6addrlbl_entry *p) 136 { 137 return atomic_inc_not_zero(&p->refcnt); 138 } 139 140 static inline void ip6addrlbl_put(struct ip6addrlbl_entry *p) 141 { 142 if (atomic_dec_and_test(&p->refcnt)) 143 call_rcu(&p->rcu, ip6addrlbl_free_rcu); 144 } 145 146 /* Find label */ 147 static int __ip6addrlbl_match(struct net *net, 148 struct ip6addrlbl_entry *p, 149 const struct in6_addr *addr, 150 int addrtype, int ifindex) 151 { 152 if (!net_eq(ip6addrlbl_net(p), net)) 153 return 0; 154 if (p->ifindex && p->ifindex != ifindex) 155 return 0; 156 if (p->addrtype && p->addrtype != addrtype) 157 return 0; 158 if (!ipv6_prefix_equal(addr, &p->prefix, p->prefixlen)) 159 return 0; 160 return 1; 161 } 162 163 static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net, 164 const struct in6_addr *addr, 165 int type, int ifindex) 166 { 167 struct hlist_node *pos; 168 struct ip6addrlbl_entry *p; 169 hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) { 170 if (__ip6addrlbl_match(net, p, addr, type, ifindex)) 171 return p; 172 } 173 return NULL; 174 } 175 176 u32 ipv6_addr_label(struct net *net, 177 const struct in6_addr *addr, int type, int ifindex) 178 { 179 u32 label; 180 struct ip6addrlbl_entry *p; 181 182 type &= IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK; 183 184 rcu_read_lock(); 185 p = __ipv6_addr_label(net, addr, type, ifindex); 186 label = p ? p->label : IPV6_ADDR_LABEL_DEFAULT; 187 rcu_read_unlock(); 188 189 ADDRLABEL(KERN_DEBUG "%s(addr=" NIP6_FMT ", type=%d, ifindex=%d) => %08x\n", 190 __func__, 191 NIP6(*addr), type, ifindex, 192 label); 193 194 return label; 195 } 196 197 /* allocate one entry */ 198 static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net, 199 const struct in6_addr *prefix, 200 int prefixlen, int ifindex, 201 u32 label) 202 { 203 struct ip6addrlbl_entry *newp; 204 int addrtype; 205 206 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u)\n", 207 __func__, 208 NIP6(*prefix), prefixlen, 209 ifindex, 210 (unsigned int)label); 211 212 addrtype = ipv6_addr_type(prefix) & (IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK); 213 214 switch (addrtype) { 215 case IPV6_ADDR_MAPPED: 216 if (prefixlen > 96) 217 return ERR_PTR(-EINVAL); 218 if (prefixlen < 96) 219 addrtype = 0; 220 break; 221 case IPV6_ADDR_COMPATv4: 222 if (prefixlen != 96) 223 addrtype = 0; 224 break; 225 case IPV6_ADDR_LOOPBACK: 226 if (prefixlen != 128) 227 addrtype = 0; 228 break; 229 } 230 231 newp = kmalloc(sizeof(*newp), GFP_KERNEL); 232 if (!newp) 233 return ERR_PTR(-ENOMEM); 234 235 ipv6_addr_prefix(&newp->prefix, prefix, prefixlen); 236 newp->prefixlen = prefixlen; 237 newp->ifindex = ifindex; 238 newp->addrtype = addrtype; 239 newp->label = label; 240 INIT_HLIST_NODE(&newp->list); 241 #ifdef CONFIG_NET_NS 242 newp->lbl_net = hold_net(net); 243 #endif 244 atomic_set(&newp->refcnt, 1); 245 return newp; 246 } 247 248 /* add a label */ 249 static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace) 250 { 251 int ret = 0; 252 253 ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", 254 __func__, 255 newp, replace); 256 257 if (hlist_empty(&ip6addrlbl_table.head)) { 258 hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head); 259 } else { 260 struct hlist_node *pos, *n; 261 struct ip6addrlbl_entry *p = NULL; 262 hlist_for_each_entry_safe(p, pos, n, 263 &ip6addrlbl_table.head, list) { 264 if (p->prefixlen == newp->prefixlen && 265 net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) && 266 p->ifindex == newp->ifindex && 267 ipv6_addr_equal(&p->prefix, &newp->prefix)) { 268 if (!replace) { 269 ret = -EEXIST; 270 goto out; 271 } 272 hlist_replace_rcu(&p->list, &newp->list); 273 ip6addrlbl_put(p); 274 goto out; 275 } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) || 276 (p->prefixlen < newp->prefixlen)) { 277 hlist_add_before_rcu(&newp->list, &p->list); 278 goto out; 279 } 280 } 281 hlist_add_after_rcu(&p->list, &newp->list); 282 } 283 out: 284 if (!ret) 285 ip6addrlbl_table.seq++; 286 return ret; 287 } 288 289 /* add a label */ 290 static int ip6addrlbl_add(struct net *net, 291 const struct in6_addr *prefix, int prefixlen, 292 int ifindex, u32 label, int replace) 293 { 294 struct ip6addrlbl_entry *newp; 295 int ret = 0; 296 297 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u, replace=%d)\n", 298 __func__, 299 NIP6(*prefix), prefixlen, 300 ifindex, 301 (unsigned int)label, 302 replace); 303 304 newp = ip6addrlbl_alloc(net, prefix, prefixlen, ifindex, label); 305 if (IS_ERR(newp)) 306 return PTR_ERR(newp); 307 spin_lock(&ip6addrlbl_table.lock); 308 ret = __ip6addrlbl_add(newp, replace); 309 spin_unlock(&ip6addrlbl_table.lock); 310 if (ret) 311 ip6addrlbl_free(newp); 312 return ret; 313 } 314 315 /* remove a label */ 316 static int __ip6addrlbl_del(struct net *net, 317 const struct in6_addr *prefix, int prefixlen, 318 int ifindex) 319 { 320 struct ip6addrlbl_entry *p = NULL; 321 struct hlist_node *pos, *n; 322 int ret = -ESRCH; 323 324 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n", 325 __func__, 326 NIP6(*prefix), prefixlen, 327 ifindex); 328 329 hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) { 330 if (p->prefixlen == prefixlen && 331 net_eq(ip6addrlbl_net(p), net) && 332 p->ifindex == ifindex && 333 ipv6_addr_equal(&p->prefix, prefix)) { 334 hlist_del_rcu(&p->list); 335 ip6addrlbl_put(p); 336 ret = 0; 337 break; 338 } 339 } 340 return ret; 341 } 342 343 static int ip6addrlbl_del(struct net *net, 344 const struct in6_addr *prefix, int prefixlen, 345 int ifindex) 346 { 347 struct in6_addr prefix_buf; 348 int ret; 349 350 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n", 351 __func__, 352 NIP6(*prefix), prefixlen, 353 ifindex); 354 355 ipv6_addr_prefix(&prefix_buf, prefix, prefixlen); 356 spin_lock(&ip6addrlbl_table.lock); 357 ret = __ip6addrlbl_del(net, &prefix_buf, prefixlen, ifindex); 358 spin_unlock(&ip6addrlbl_table.lock); 359 return ret; 360 } 361 362 /* add default label */ 363 static int __net_init ip6addrlbl_net_init(struct net *net) 364 { 365 int err = 0; 366 int i; 367 368 ADDRLABEL(KERN_DEBUG "%s()\n", __func__); 369 370 for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) { 371 int ret = ip6addrlbl_add(net, 372 ip6addrlbl_init_table[i].prefix, 373 ip6addrlbl_init_table[i].prefixlen, 374 0, 375 ip6addrlbl_init_table[i].label, 0); 376 /* XXX: should we free all rules when we catch an error? */ 377 if (ret && (!err || err != -ENOMEM)) 378 err = ret; 379 } 380 return err; 381 } 382 383 static void __net_exit ip6addrlbl_net_exit(struct net *net) 384 { 385 struct ip6addrlbl_entry *p = NULL; 386 struct hlist_node *pos, *n; 387 388 /* Remove all labels belonging to the exiting net */ 389 spin_lock(&ip6addrlbl_table.lock); 390 hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) { 391 if (net_eq(ip6addrlbl_net(p), net)) { 392 hlist_del_rcu(&p->list); 393 ip6addrlbl_put(p); 394 } 395 } 396 spin_unlock(&ip6addrlbl_table.lock); 397 } 398 399 static struct pernet_operations ipv6_addr_label_ops = { 400 .init = ip6addrlbl_net_init, 401 .exit = ip6addrlbl_net_exit, 402 }; 403 404 int __init ipv6_addr_label_init(void) 405 { 406 spin_lock_init(&ip6addrlbl_table.lock); 407 408 return register_pernet_subsys(&ipv6_addr_label_ops); 409 } 410 411 static const struct nla_policy ifal_policy[IFAL_MAX+1] = { 412 [IFAL_ADDRESS] = { .len = sizeof(struct in6_addr), }, 413 [IFAL_LABEL] = { .len = sizeof(u32), }, 414 }; 415 416 static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh, 417 void *arg) 418 { 419 struct net *net = sock_net(skb->sk); 420 struct ifaddrlblmsg *ifal; 421 struct nlattr *tb[IFAL_MAX+1]; 422 struct in6_addr *pfx; 423 u32 label; 424 int err = 0; 425 426 err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy); 427 if (err < 0) 428 return err; 429 430 ifal = nlmsg_data(nlh); 431 432 if (ifal->ifal_family != AF_INET6 || 433 ifal->ifal_prefixlen > 128) 434 return -EINVAL; 435 436 if (ifal->ifal_index && 437 !__dev_get_by_index(net, ifal->ifal_index)) 438 return -EINVAL; 439 440 if (!tb[IFAL_ADDRESS]) 441 return -EINVAL; 442 443 pfx = nla_data(tb[IFAL_ADDRESS]); 444 if (!pfx) 445 return -EINVAL; 446 447 if (!tb[IFAL_LABEL]) 448 return -EINVAL; 449 label = nla_get_u32(tb[IFAL_LABEL]); 450 if (label == IPV6_ADDR_LABEL_DEFAULT) 451 return -EINVAL; 452 453 switch(nlh->nlmsg_type) { 454 case RTM_NEWADDRLABEL: 455 err = ip6addrlbl_add(net, pfx, ifal->ifal_prefixlen, 456 ifal->ifal_index, label, 457 nlh->nlmsg_flags & NLM_F_REPLACE); 458 break; 459 case RTM_DELADDRLABEL: 460 err = ip6addrlbl_del(net, pfx, ifal->ifal_prefixlen, 461 ifal->ifal_index); 462 break; 463 default: 464 err = -EOPNOTSUPP; 465 } 466 return err; 467 } 468 469 static inline void ip6addrlbl_putmsg(struct nlmsghdr *nlh, 470 int prefixlen, int ifindex, u32 lseq) 471 { 472 struct ifaddrlblmsg *ifal = nlmsg_data(nlh); 473 ifal->ifal_family = AF_INET6; 474 ifal->ifal_prefixlen = prefixlen; 475 ifal->ifal_flags = 0; 476 ifal->ifal_index = ifindex; 477 ifal->ifal_seq = lseq; 478 }; 479 480 static int ip6addrlbl_fill(struct sk_buff *skb, 481 struct ip6addrlbl_entry *p, 482 u32 lseq, 483 u32 pid, u32 seq, int event, 484 unsigned int flags) 485 { 486 struct nlmsghdr *nlh = nlmsg_put(skb, pid, seq, event, 487 sizeof(struct ifaddrlblmsg), flags); 488 if (!nlh) 489 return -EMSGSIZE; 490 491 ip6addrlbl_putmsg(nlh, p->prefixlen, p->ifindex, lseq); 492 493 if (nla_put(skb, IFAL_ADDRESS, 16, &p->prefix) < 0 || 494 nla_put_u32(skb, IFAL_LABEL, p->label) < 0) { 495 nlmsg_cancel(skb, nlh); 496 return -EMSGSIZE; 497 } 498 499 return nlmsg_end(skb, nlh); 500 } 501 502 static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb) 503 { 504 struct net *net = sock_net(skb->sk); 505 struct ip6addrlbl_entry *p; 506 struct hlist_node *pos; 507 int idx = 0, s_idx = cb->args[0]; 508 int err; 509 510 rcu_read_lock(); 511 hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) { 512 if (idx >= s_idx && 513 net_eq(ip6addrlbl_net(p), net)) { 514 if ((err = ip6addrlbl_fill(skb, p, 515 ip6addrlbl_table.seq, 516 NETLINK_CB(cb->skb).pid, 517 cb->nlh->nlmsg_seq, 518 RTM_NEWADDRLABEL, 519 NLM_F_MULTI)) <= 0) 520 break; 521 } 522 idx++; 523 } 524 rcu_read_unlock(); 525 cb->args[0] = idx; 526 return skb->len; 527 } 528 529 static inline int ip6addrlbl_msgsize(void) 530 { 531 return (NLMSG_ALIGN(sizeof(struct ifaddrlblmsg)) 532 + nla_total_size(16) /* IFAL_ADDRESS */ 533 + nla_total_size(4) /* IFAL_LABEL */ 534 ); 535 } 536 537 static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh, 538 void *arg) 539 { 540 struct net *net = sock_net(in_skb->sk); 541 struct ifaddrlblmsg *ifal; 542 struct nlattr *tb[IFAL_MAX+1]; 543 struct in6_addr *addr; 544 u32 lseq; 545 int err = 0; 546 struct ip6addrlbl_entry *p; 547 struct sk_buff *skb; 548 549 err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy); 550 if (err < 0) 551 return err; 552 553 ifal = nlmsg_data(nlh); 554 555 if (ifal->ifal_family != AF_INET6 || 556 ifal->ifal_prefixlen != 128) 557 return -EINVAL; 558 559 if (ifal->ifal_index && 560 !__dev_get_by_index(net, ifal->ifal_index)) 561 return -EINVAL; 562 563 if (!tb[IFAL_ADDRESS]) 564 return -EINVAL; 565 566 addr = nla_data(tb[IFAL_ADDRESS]); 567 if (!addr) 568 return -EINVAL; 569 570 rcu_read_lock(); 571 p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index); 572 if (p && ip6addrlbl_hold(p)) 573 p = NULL; 574 lseq = ip6addrlbl_table.seq; 575 rcu_read_unlock(); 576 577 if (!p) { 578 err = -ESRCH; 579 goto out; 580 } 581 582 if (!(skb = nlmsg_new(ip6addrlbl_msgsize(), GFP_KERNEL))) { 583 ip6addrlbl_put(p); 584 return -ENOBUFS; 585 } 586 587 err = ip6addrlbl_fill(skb, p, lseq, 588 NETLINK_CB(in_skb).pid, nlh->nlmsg_seq, 589 RTM_NEWADDRLABEL, 0); 590 591 ip6addrlbl_put(p); 592 593 if (err < 0) { 594 WARN_ON(err == -EMSGSIZE); 595 kfree_skb(skb); 596 goto out; 597 } 598 599 err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid); 600 out: 601 return err; 602 } 603 604 void __init ipv6_addr_label_rtnl_register(void) 605 { 606 __rtnl_register(PF_INET6, RTM_NEWADDRLABEL, ip6addrlbl_newdel, NULL); 607 __rtnl_register(PF_INET6, RTM_DELADDRLABEL, ip6addrlbl_newdel, NULL); 608 __rtnl_register(PF_INET6, RTM_GETADDRLABEL, ip6addrlbl_get, ip6addrlbl_dump); 609 } 610 611