addrlabel.c 14 KB
Newer Older
1 2 3 4 5 6 7 8
/*
 * IPv6 Address Label subsystem
 * for the IPv6 "Default" Source Address Selection
 *
 * Copyright (C)2007 USAGI/WIDE Project
 */
/*
 * Author:
9
 *	YOSHIFUJI Hideaki @ USAGI/WIDE Project <yoshfuji@linux-ipv6.org>
10 11 12 13 14 15
 */

#include <linux/kernel.h>
#include <linux/list.h>
#include <linux/rcupdate.h>
#include <linux/in6.h>
16
#include <linux/slab.h>
17 18 19 20 21 22 23 24
#include <net/addrconf.h>
#include <linux/if_addrlabel.h>
#include <linux/netlink.h>
#include <linux/rtnetlink.h>

#if 0
#define ADDRLABEL(x...) printk(x)
#else
25
#define ADDRLABEL(x...) do { ; } while (0)
26 27 28 29 30
#endif

/*
 * Policy Table
 */
31
struct ip6addrlbl_entry {
32 33 34
#ifdef CONFIG_NET_NS
	struct net *lbl_net;
#endif
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
	struct in6_addr prefix;
	int prefixlen;
	int ifindex;
	int addrtype;
	u32 label;
	struct hlist_node list;
	atomic_t refcnt;
	struct rcu_head rcu;
};

static struct ip6addrlbl_table
{
	struct hlist_head head;
	spinlock_t lock;
	u32 seq;
} ip6addrlbl_table;

52 53 54
static inline
struct net *ip6addrlbl_net(const struct ip6addrlbl_entry *lbl)
{
Eric Dumazet's avatar
Eric Dumazet committed
55
	return read_pnet(&lbl->lbl_net);
56 57
}

58
/*
59
 * Default policy table (RFC6724 + extensions)
60 61 62 63 64 65 66 67 68 69
 *
 * prefix		addr_type	label
 * -------------------------------------------------------------------------
 * ::1/128		LOOPBACK	0
 * ::/0			N/A		1
 * 2002::/16		N/A		2
 * ::/96		COMPATv4	3
 * ::ffff:0:0/96	V4MAPPED	4
 * fc00::/7		N/A		5		ULA (RFC 4193)
 * 2001::/32		N/A		6		Teredo (RFC 4380)
70
 * 2001:10::/28		N/A		7		ORCHID (RFC 4843)
71 72 73
 * fec0::/10		N/A		11		Site-local
 *							(deprecated by RFC3879)
 * 3ffe::/16		N/A		12		6bone
74 75
 *
 * Note: 0xffffffff is used if we do not have any policies.
76
 * Note: Labels for ULA and 6to4 are different from labels listed in RFC6724.
77 78 79 80
 */

#define IPV6_ADDR_LABEL_DEFAULT	0xffffffffUL

81
static const __net_initconst struct ip6addrlbl_init_table
82 83 84 85 86 87 88 89
{
	const struct in6_addr *prefix;
	int prefixlen;
	u32 label;
} ip6addrlbl_init_table[] = {
	{	/* ::/0 */
		.prefix = &in6addr_any,
		.label = 1,
90 91
	}, {	/* fc00::/7 */
		.prefix = &(struct in6_addr){ { { 0xfc } } } ,
92 93
		.prefixlen = 7,
		.label = 5,
94 95
	}, {	/* fec0::/10 */
		.prefix = &(struct in6_addr){ { { 0xfe, 0xc0 } } },
96 97
		.prefixlen = 10,
		.label = 11,
98 99
	}, {	/* 2002::/16 */
		.prefix = &(struct in6_addr){ { { 0x20, 0x02 } } },
100 101
		.prefixlen = 16,
		.label = 2,
102 103
	}, {	/* 3ffe::/16 */
		.prefix = &(struct in6_addr){ { { 0x3f, 0xfe } } },
104 105
		.prefixlen = 16,
		.label = 12,
106 107
	}, {	/* 2001::/32 */
		.prefix = &(struct in6_addr){ { { 0x20, 0x01 } } },
108 109
		.prefixlen = 32,
		.label = 6,
110 111
	}, {	/* 2001:10::/28 */
		.prefix = &(struct in6_addr){ { { 0x20, 0x01, 0x00, 0x10 } } },
112 113
		.prefixlen = 28,
		.label = 7,
114 115
	}, {	/* ::ffff:0:0 */
		.prefix = &(struct in6_addr){ { { [10] = 0xff, [11] = 0xff } } },
116 117
		.prefixlen = 96,
		.label = 4,
118
	}, {	/* ::/96 */
119 120 121
		.prefix = &in6addr_any,
		.prefixlen = 96,
		.label = 3,
122
	}, {	/* ::1/128 */
123 124 125 126 127 128 129 130 131 132 133 134
		.prefix = &in6addr_loopback,
		.prefixlen = 128,
		.label = 0,
	}
};

/* Object management */
static inline void ip6addrlbl_free(struct ip6addrlbl_entry *p)
{
	kfree(p);
}

135 136 137 138 139
static void ip6addrlbl_free_rcu(struct rcu_head *h)
{
	ip6addrlbl_free(container_of(h, struct ip6addrlbl_entry, rcu));
}

140
static bool ip6addrlbl_hold(struct ip6addrlbl_entry *p)
141 142 143 144 145 146 147
{
	return atomic_inc_not_zero(&p->refcnt);
}

static inline void ip6addrlbl_put(struct ip6addrlbl_entry *p)
{
	if (atomic_dec_and_test(&p->refcnt))
148
		call_rcu(&p->rcu, ip6addrlbl_free_rcu);
149 150 151
}

/* Find label */
152 153 154 155
static bool __ip6addrlbl_match(struct net *net,
			       const struct ip6addrlbl_entry *p,
			       const struct in6_addr *addr,
			       int addrtype, int ifindex)
156
{
157
	if (!net_eq(ip6addrlbl_net(p), net))
158
		return false;
159
	if (p->ifindex && p->ifindex != ifindex)
160
		return false;
161
	if (p->addrtype && p->addrtype != addrtype)
162
		return false;
163
	if (!ipv6_prefix_equal(addr, &p->prefix, p->prefixlen))
164 165
		return false;
	return true;
166 167
}

168 169
static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net,
						  const struct in6_addr *addr,
170 171 172
						  int type, int ifindex)
{
	struct ip6addrlbl_entry *p;
173
	hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
174
		if (__ip6addrlbl_match(net, p, addr, type, ifindex))
175 176 177 178 179
			return p;
	}
	return NULL;
}

180 181
u32 ipv6_addr_label(struct net *net,
		    const struct in6_addr *addr, int type, int ifindex)
182 183 184 185 186 187 188
{
	u32 label;
	struct ip6addrlbl_entry *p;

	type &= IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK;

	rcu_read_lock();
189
	p = __ipv6_addr_label(net, addr, type, ifindex);
190 191 192
	label = p ? p->label : IPV6_ADDR_LABEL_DEFAULT;
	rcu_read_unlock();

Harvey Harrison's avatar
Harvey Harrison committed
193
	ADDRLABEL(KERN_DEBUG "%s(addr=%pI6, type=%d, ifindex=%d) => %08x\n",
194
		  __func__, addr, type, ifindex, label);
195 196 197 198 199

	return label;
}

/* allocate one entry */
200 201
static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
						 const struct in6_addr *prefix,
202 203
						 int prefixlen, int ifindex,
						 u32 label)
204 205 206 207
{
	struct ip6addrlbl_entry *newp;
	int addrtype;

Harvey Harrison's avatar
Harvey Harrison committed
208
	ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d, label=%u)\n",
209
		  __func__, prefix, prefixlen, ifindex, (unsigned int)label);
210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239

	addrtype = ipv6_addr_type(prefix) & (IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK);

	switch (addrtype) {
	case IPV6_ADDR_MAPPED:
		if (prefixlen > 96)
			return ERR_PTR(-EINVAL);
		if (prefixlen < 96)
			addrtype = 0;
		break;
	case IPV6_ADDR_COMPATv4:
		if (prefixlen != 96)
			addrtype = 0;
		break;
	case IPV6_ADDR_LOOPBACK:
		if (prefixlen != 128)
			addrtype = 0;
		break;
	}

	newp = kmalloc(sizeof(*newp), GFP_KERNEL);
	if (!newp)
		return ERR_PTR(-ENOMEM);

	ipv6_addr_prefix(&newp->prefix, prefix, prefixlen);
	newp->prefixlen = prefixlen;
	newp->ifindex = ifindex;
	newp->addrtype = addrtype;
	newp->label = label;
	INIT_HLIST_NODE(&newp->list);
240
#ifdef CONFIG_NET_NS
241
	newp->lbl_net = net;
242
#endif
243 244 245 246 247
	atomic_set(&newp->refcnt, 1);
	return newp;
}

/* add a label */
248
static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
249
{
250 251
	struct hlist_node *n;
	struct ip6addrlbl_entry *last = NULL, *p = NULL;
252 253
	int ret = 0;

254 255
	ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", __func__, newp,
		  replace);
256

257 258 259 260 261 262 263
	hlist_for_each_entry_safe(p, n,	&ip6addrlbl_table.head, list) {
		if (p->prefixlen == newp->prefixlen &&
		    net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
		    p->ifindex == newp->ifindex &&
		    ipv6_addr_equal(&p->prefix, &newp->prefix)) {
			if (!replace) {
				ret = -EEXIST;
264 265
				goto out;
			}
266 267 268 269 270 271 272
			hlist_replace_rcu(&p->list, &newp->list);
			ip6addrlbl_put(p);
			goto out;
		} else if ((p->prefixlen == newp->prefixlen && !p->ifindex) ||
			   (p->prefixlen < newp->prefixlen)) {
			hlist_add_before_rcu(&newp->list, &p->list);
			goto out;
273
		}
274
		last = p;
275
	}
276
	if (last)
277
		hlist_add_behind_rcu(&newp->list, &last->list);
278 279
	else
		hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
280 281 282 283 284 285 286
out:
	if (!ret)
		ip6addrlbl_table.seq++;
	return ret;
}

/* add a label */
287 288
static int ip6addrlbl_add(struct net *net,
			  const struct in6_addr *prefix, int prefixlen,
289
			  int ifindex, u32 label, int replace)
290 291 292 293
{
	struct ip6addrlbl_entry *newp;
	int ret = 0;

Harvey Harrison's avatar
Harvey Harrison committed
294
	ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d, label=%u, replace=%d)\n",
295 296
		  __func__, prefix, prefixlen, ifindex, (unsigned int)label,
		  replace);
297

298
	newp = ip6addrlbl_alloc(net, prefix, prefixlen, ifindex, label);
299 300 301 302 303 304 305 306 307 308 309
	if (IS_ERR(newp))
		return PTR_ERR(newp);
	spin_lock(&ip6addrlbl_table.lock);
	ret = __ip6addrlbl_add(newp, replace);
	spin_unlock(&ip6addrlbl_table.lock);
	if (ret)
		ip6addrlbl_free(newp);
	return ret;
}

/* remove a label */
310 311
static int __ip6addrlbl_del(struct net *net,
			    const struct in6_addr *prefix, int prefixlen,
312
			    int ifindex)
313 314
{
	struct ip6addrlbl_entry *p = NULL;
315
	struct hlist_node *n;
316 317
	int ret = -ESRCH;

Harvey Harrison's avatar
Harvey Harrison committed
318
	ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
319
		  __func__, prefix, prefixlen, ifindex);
320

321
	hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
322
		if (p->prefixlen == prefixlen &&
323
		    net_eq(ip6addrlbl_net(p), net) &&
324 325 326 327 328 329 330 331 332 333 334
		    p->ifindex == ifindex &&
		    ipv6_addr_equal(&p->prefix, prefix)) {
			hlist_del_rcu(&p->list);
			ip6addrlbl_put(p);
			ret = 0;
			break;
		}
	}
	return ret;
}

335 336
static int ip6addrlbl_del(struct net *net,
			  const struct in6_addr *prefix, int prefixlen,
337
			  int ifindex)
338 339 340 341
{
	struct in6_addr prefix_buf;
	int ret;

Harvey Harrison's avatar
Harvey Harrison committed
342
	ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
343
		  __func__, prefix, prefixlen, ifindex);
344 345 346

	ipv6_addr_prefix(&prefix_buf, prefix, prefixlen);
	spin_lock(&ip6addrlbl_table.lock);
347
	ret = __ip6addrlbl_del(net, &prefix_buf, prefixlen, ifindex);
348 349 350 351 352
	spin_unlock(&ip6addrlbl_table.lock);
	return ret;
}

/* add default label */
353
static int __net_init ip6addrlbl_net_init(struct net *net)
354 355 356 357
{
	int err = 0;
	int i;

358
	ADDRLABEL(KERN_DEBUG "%s\n", __func__);
359 360

	for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) {
361 362
		int ret = ip6addrlbl_add(net,
					 ip6addrlbl_init_table[i].prefix,
363 364 365 366 367 368 369 370 371 372
					 ip6addrlbl_init_table[i].prefixlen,
					 0,
					 ip6addrlbl_init_table[i].label, 0);
		/* XXX: should we free all rules when we catch an error? */
		if (ret && (!err || err != -ENOMEM))
			err = ret;
	}
	return err;
}

373 374 375
static void __net_exit ip6addrlbl_net_exit(struct net *net)
{
	struct ip6addrlbl_entry *p = NULL;
376
	struct hlist_node *n;
377 378 379

	/* Remove all labels belonging to the exiting net */
	spin_lock(&ip6addrlbl_table.lock);
380
	hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
381 382 383 384 385 386 387 388 389 390 391 392 393
		if (net_eq(ip6addrlbl_net(p), net)) {
			hlist_del_rcu(&p->list);
			ip6addrlbl_put(p);
		}
	}
	spin_unlock(&ip6addrlbl_table.lock);
}

static struct pernet_operations ipv6_addr_label_ops = {
	.init = ip6addrlbl_net_init,
	.exit = ip6addrlbl_net_exit,
};

394 395 396 397
int __init ipv6_addr_label_init(void)
{
	spin_lock_init(&ip6addrlbl_table.lock);

398
	return register_pernet_subsys(&ipv6_addr_label_ops);
399 400
}

401 402 403 404 405
void ipv6_addr_label_cleanup(void)
{
	unregister_pernet_subsys(&ipv6_addr_label_ops);
}

406 407 408 409 410
static const struct nla_policy ifal_policy[IFAL_MAX+1] = {
	[IFAL_ADDRESS]		= { .len = sizeof(struct in6_addr), },
	[IFAL_LABEL]		= { .len = sizeof(u32), },
};

411
static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh)
412
{
413
	struct net *net = sock_net(skb->sk);
414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439
	struct ifaddrlblmsg *ifal;
	struct nlattr *tb[IFAL_MAX+1];
	struct in6_addr *pfx;
	u32 label;
	int err = 0;

	err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy);
	if (err < 0)
		return err;

	ifal = nlmsg_data(nlh);

	if (ifal->ifal_family != AF_INET6 ||
	    ifal->ifal_prefixlen > 128)
		return -EINVAL;

	if (!tb[IFAL_ADDRESS])
		return -EINVAL;
	pfx = nla_data(tb[IFAL_ADDRESS]);

	if (!tb[IFAL_LABEL])
		return -EINVAL;
	label = nla_get_u32(tb[IFAL_LABEL]);
	if (label == IPV6_ADDR_LABEL_DEFAULT)
		return -EINVAL;

440
	switch (nlh->nlmsg_type) {
441
	case RTM_NEWADDRLABEL:
442 443 444 445
		if (ifal->ifal_index &&
		    !__dev_get_by_index(net, ifal->ifal_index))
			return -EINVAL;

446
		err = ip6addrlbl_add(net, pfx, ifal->ifal_prefixlen,
447 448 449 450
				     ifal->ifal_index, label,
				     nlh->nlmsg_flags & NLM_F_REPLACE);
		break;
	case RTM_DELADDRLABEL:
451
		err = ip6addrlbl_del(net, pfx, ifal->ifal_prefixlen,
452 453 454 455 456 457 458 459
				     ifal->ifal_index);
		break;
	default:
		err = -EOPNOTSUPP;
	}
	return err;
}

460 461
static void ip6addrlbl_putmsg(struct nlmsghdr *nlh,
			      int prefixlen, int ifindex, u32 lseq)
462 463 464 465 466 467 468 469 470 471 472 473
{
	struct ifaddrlblmsg *ifal = nlmsg_data(nlh);
	ifal->ifal_family = AF_INET6;
	ifal->ifal_prefixlen = prefixlen;
	ifal->ifal_flags = 0;
	ifal->ifal_index = ifindex;
	ifal->ifal_seq = lseq;
};

static int ip6addrlbl_fill(struct sk_buff *skb,
			   struct ip6addrlbl_entry *p,
			   u32 lseq,
474
			   u32 portid, u32 seq, int event,
475 476
			   unsigned int flags)
{
477
	struct nlmsghdr *nlh = nlmsg_put(skb, portid, seq, event,
478 479 480 481 482 483 484 485 486 487 488 489
					 sizeof(struct ifaddrlblmsg), flags);
	if (!nlh)
		return -EMSGSIZE;

	ip6addrlbl_putmsg(nlh, p->prefixlen, p->ifindex, lseq);

	if (nla_put(skb, IFAL_ADDRESS, 16, &p->prefix) < 0 ||
	    nla_put_u32(skb, IFAL_LABEL, p->label) < 0) {
		nlmsg_cancel(skb, nlh);
		return -EMSGSIZE;
	}

490 491
	nlmsg_end(skb, nlh);
	return 0;
492 493 494 495
}

static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
{
496
	struct net *net = sock_net(skb->sk);
497 498 499 500 501
	struct ip6addrlbl_entry *p;
	int idx = 0, s_idx = cb->args[0];
	int err;

	rcu_read_lock();
502
	hlist_for_each_entry_rcu(p, &ip6addrlbl_table.head, list) {
503 504
		if (idx >= s_idx &&
		    net_eq(ip6addrlbl_net(p), net)) {
505 506 507 508 509 510
			err = ip6addrlbl_fill(skb, p,
					      ip6addrlbl_table.seq,
					      NETLINK_CB(cb->skb).portid,
					      cb->nlh->nlmsg_seq,
					      RTM_NEWADDRLABEL,
					      NLM_F_MULTI);
511
			if (err < 0)
512 513 514 515 516 517 518 519 520 521 522
				break;
		}
		idx++;
	}
	rcu_read_unlock();
	cb->args[0] = idx;
	return skb->len;
}

static inline int ip6addrlbl_msgsize(void)
{
Eric Dumazet's avatar
Eric Dumazet committed
523
	return NLMSG_ALIGN(sizeof(struct ifaddrlblmsg))
524
		+ nla_total_size(16)	/* IFAL_ADDRESS */
Eric Dumazet's avatar
Eric Dumazet committed
525
		+ nla_total_size(4);	/* IFAL_LABEL */
526 527
}

528
static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr *nlh)
529
{
530
	struct net *net = sock_net(in_skb->sk);
531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549
	struct ifaddrlblmsg *ifal;
	struct nlattr *tb[IFAL_MAX+1];
	struct in6_addr *addr;
	u32 lseq;
	int err = 0;
	struct ip6addrlbl_entry *p;
	struct sk_buff *skb;

	err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy);
	if (err < 0)
		return err;

	ifal = nlmsg_data(nlh);

	if (ifal->ifal_family != AF_INET6 ||
	    ifal->ifal_prefixlen != 128)
		return -EINVAL;

	if (ifal->ifal_index &&
550
	    !__dev_get_by_index(net, ifal->ifal_index))
551 552 553 554 555 556 557
		return -EINVAL;

	if (!tb[IFAL_ADDRESS])
		return -EINVAL;
	addr = nla_data(tb[IFAL_ADDRESS]);

	rcu_read_lock();
558
	p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
559 560 561 562 563 564 565 566 567 568
	if (p && ip6addrlbl_hold(p))
		p = NULL;
	lseq = ip6addrlbl_table.seq;
	rcu_read_unlock();

	if (!p) {
		err = -ESRCH;
		goto out;
	}

569 570
	skb = nlmsg_new(ip6addrlbl_msgsize(), GFP_KERNEL);
	if (!skb) {
571 572 573 574 575
		ip6addrlbl_put(p);
		return -ENOBUFS;
	}

	err = ip6addrlbl_fill(skb, p, lseq,
576
			      NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
577 578 579 580 581 582 583 584 585 586
			      RTM_NEWADDRLABEL, 0);

	ip6addrlbl_put(p);

	if (err < 0) {
		WARN_ON(err == -EMSGSIZE);
		kfree_skb(skb);
		goto out;
	}

587
	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
588 589 590 591 592 593
out:
	return err;
}

void __init ipv6_addr_label_rtnl_register(void)
{
594 595 596 597 598 599
	__rtnl_register(PF_INET6, RTM_NEWADDRLABEL, ip6addrlbl_newdel,
			NULL, NULL);
	__rtnl_register(PF_INET6, RTM_DELADDRLABEL, ip6addrlbl_newdel,
			NULL, NULL);
	__rtnl_register(PF_INET6, RTM_GETADDRLABEL, ip6addrlbl_get,
			ip6addrlbl_dump, NULL);
600 601
}