addrlabel.c revision 3de232554a91adc74e80dc15c304be806bd7e1f9
1/* 2 * IPv6 Address Label subsystem 3 * for the IPv6 "Default" Source Address Selection 4 * 5 * Copyright (C)2007 USAGI/WIDE Project 6 */ 7/* 8 * Author: 9 * YOSHIFUJI Hideaki @ USAGI/WIDE Project <yoshfuji@linux-ipv6.org> 10 */ 11 12#include <linux/kernel.h> 13#include <linux/list.h> 14#include <linux/rcupdate.h> 15#include <linux/in6.h> 16#include <net/addrconf.h> 17#include <linux/if_addrlabel.h> 18#include <linux/netlink.h> 19#include <linux/rtnetlink.h> 20 21#if 0 22#define ADDRLABEL(x...) printk(x) 23#else 24#define ADDRLABEL(x...) do { ; } while(0) 25#endif 26 27/* 28 * Policy Table 29 */ 30struct ip6addrlbl_entry 31{ 32#ifdef CONFIG_NET_NS 33 struct net *lbl_net; 34#endif 35 struct in6_addr prefix; 36 int prefixlen; 37 int ifindex; 38 int addrtype; 39 u32 label; 40 struct hlist_node list; 41 atomic_t refcnt; 42 struct rcu_head rcu; 43}; 44 45static struct ip6addrlbl_table 46{ 47 struct hlist_head head; 48 spinlock_t lock; 49 u32 seq; 50} ip6addrlbl_table; 51 52static inline 53struct net *ip6addrlbl_net(const struct ip6addrlbl_entry *lbl) 54{ 55#ifdef CONFIG_NET_NS 56 return lbl->lbl_net; 57#else 58 return &init_net; 59#endif 60} 61 62/* 63 * Default policy table (RFC3484 + extensions) 64 * 65 * prefix addr_type label 66 * ------------------------------------------------------------------------- 67 * ::1/128 LOOPBACK 0 68 * ::/0 N/A 1 69 * 2002::/16 N/A 2 70 * ::/96 COMPATv4 3 71 * ::ffff:0:0/96 V4MAPPED 4 72 * fc00::/7 N/A 5 ULA (RFC 4193) 73 * 2001::/32 N/A 6 Teredo (RFC 4380) 74 * 2001:10::/28 N/A 7 ORCHID (RFC 4843) 75 * 76 * Note: 0xffffffff is used if we do not have any policies. 77 */ 78 79#define IPV6_ADDR_LABEL_DEFAULT 0xffffffffUL 80 81static const __net_initdata struct ip6addrlbl_init_table 82{ 83 const struct in6_addr *prefix; 84 int prefixlen; 85 u32 label; 86} ip6addrlbl_init_table[] = { 87 { /* ::/0 */ 88 .prefix = &in6addr_any, 89 .label = 1, 90 },{ /* fc00::/7 */ 91 .prefix = &(struct in6_addr){{{ 0xfc }}}, 92 .prefixlen = 7, 93 .label = 5, 94 },{ /* 2002::/16 */ 95 .prefix = &(struct in6_addr){{{ 0x20, 0x02 }}}, 96 .prefixlen = 16, 97 .label = 2, 98 },{ /* 2001::/32 */ 99 .prefix = &(struct in6_addr){{{ 0x20, 0x01 }}}, 100 .prefixlen = 32, 101 .label = 6, 102 },{ /* 2001:10::/28 */ 103 .prefix = &(struct in6_addr){{{ 0x20, 0x01, 0x00, 0x10 }}}, 104 .prefixlen = 28, 105 .label = 7, 106 },{ /* ::ffff:0:0 */ 107 .prefix = &(struct in6_addr){{{ [10] = 0xff, [11] = 0xff }}}, 108 .prefixlen = 96, 109 .label = 4, 110 },{ /* ::/96 */ 111 .prefix = &in6addr_any, 112 .prefixlen = 96, 113 .label = 3, 114 },{ /* ::1/128 */ 115 .prefix = &in6addr_loopback, 116 .prefixlen = 128, 117 .label = 0, 118 } 119}; 120 121/* Object management */ 122static inline void ip6addrlbl_free(struct ip6addrlbl_entry *p) 123{ 124#ifdef CONFIG_NET_NS 125 release_net(p->lbl_net); 126#endif 127 kfree(p); 128} 129 130static void ip6addrlbl_free_rcu(struct rcu_head *h) 131{ 132 ip6addrlbl_free(container_of(h, struct ip6addrlbl_entry, rcu)); 133} 134 135static inline int ip6addrlbl_hold(struct ip6addrlbl_entry *p) 136{ 137 return atomic_inc_not_zero(&p->refcnt); 138} 139 140static inline void ip6addrlbl_put(struct ip6addrlbl_entry *p) 141{ 142 if (atomic_dec_and_test(&p->refcnt)) 143 call_rcu(&p->rcu, ip6addrlbl_free_rcu); 144} 145 146/* Find label */ 147static int __ip6addrlbl_match(struct net *net, 148 struct ip6addrlbl_entry *p, 149 const struct in6_addr *addr, 150 int addrtype, int ifindex) 151{ 152 if (!net_eq(ip6addrlbl_net(p), net)) 153 return 0; 154 if (p->ifindex && p->ifindex != ifindex) 155 return 0; 156 if (p->addrtype && p->addrtype != addrtype) 157 return 0; 158 if (!ipv6_prefix_equal(addr, &p->prefix, p->prefixlen)) 159 return 0; 160 return 1; 161} 162 163static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net, 164 const struct in6_addr *addr, 165 int type, int ifindex) 166{ 167 struct hlist_node *pos; 168 struct ip6addrlbl_entry *p; 169 hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) { 170 if (__ip6addrlbl_match(net, p, addr, type, ifindex)) 171 return p; 172 } 173 return NULL; 174} 175 176u32 ipv6_addr_label(struct net *net, 177 const struct in6_addr *addr, int type, int ifindex) 178{ 179 u32 label; 180 struct ip6addrlbl_entry *p; 181 182 type &= IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK; 183 184 rcu_read_lock(); 185 p = __ipv6_addr_label(net, addr, type, ifindex); 186 label = p ? p->label : IPV6_ADDR_LABEL_DEFAULT; 187 rcu_read_unlock(); 188 189 ADDRLABEL(KERN_DEBUG "%s(addr=" NIP6_FMT ", type=%d, ifindex=%d) => %08x\n", 190 __func__, 191 NIP6(*addr), type, ifindex, 192 label); 193 194 return label; 195} 196 197/* allocate one entry */ 198static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net, 199 const struct in6_addr *prefix, 200 int prefixlen, int ifindex, 201 u32 label) 202{ 203 struct ip6addrlbl_entry *newp; 204 int addrtype; 205 206 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u)\n", 207 __func__, 208 NIP6(*prefix), prefixlen, 209 ifindex, 210 (unsigned int)label); 211 212 addrtype = ipv6_addr_type(prefix) & (IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK); 213 214 switch (addrtype) { 215 case IPV6_ADDR_MAPPED: 216 if (prefixlen > 96) 217 return ERR_PTR(-EINVAL); 218 if (prefixlen < 96) 219 addrtype = 0; 220 break; 221 case IPV6_ADDR_COMPATv4: 222 if (prefixlen != 96) 223 addrtype = 0; 224 break; 225 case IPV6_ADDR_LOOPBACK: 226 if (prefixlen != 128) 227 addrtype = 0; 228 break; 229 } 230 231 newp = kmalloc(sizeof(*newp), GFP_KERNEL); 232 if (!newp) 233 return ERR_PTR(-ENOMEM); 234 235 ipv6_addr_prefix(&newp->prefix, prefix, prefixlen); 236 newp->prefixlen = prefixlen; 237 newp->ifindex = ifindex; 238 newp->addrtype = addrtype; 239 newp->label = label; 240 INIT_HLIST_NODE(&newp->list); 241#ifdef CONFIG_NET_NS 242 newp->lbl_net = hold_net(net); 243#endif 244 atomic_set(&newp->refcnt, 1); 245 return newp; 246} 247 248/* add a label */ 249static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace) 250{ 251 int ret = 0; 252 253 ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", 254 __func__, 255 newp, replace); 256 257 if (hlist_empty(&ip6addrlbl_table.head)) { 258 hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head); 259 } else { 260 struct hlist_node *pos, *n; 261 struct ip6addrlbl_entry *p = NULL; 262 hlist_for_each_entry_safe(p, pos, n, 263 &ip6addrlbl_table.head, list) { 264 if (p->prefixlen == newp->prefixlen && 265 net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) && 266 p->ifindex == newp->ifindex && 267 ipv6_addr_equal(&p->prefix, &newp->prefix)) { 268 if (!replace) { 269 ret = -EEXIST; 270 goto out; 271 } 272 hlist_replace_rcu(&p->list, &newp->list); 273 ip6addrlbl_put(p); 274 goto out; 275 } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) || 276 (p->prefixlen < newp->prefixlen)) { 277 hlist_add_before_rcu(&newp->list, &p->list); 278 goto out; 279 } 280 } 281 hlist_add_after_rcu(&p->list, &newp->list); 282 } 283out: 284 if (!ret) 285 ip6addrlbl_table.seq++; 286 return ret; 287} 288 289/* add a label */ 290static int ip6addrlbl_add(struct net *net, 291 const struct in6_addr *prefix, int prefixlen, 292 int ifindex, u32 label, int replace) 293{ 294 struct ip6addrlbl_entry *newp; 295 int ret = 0; 296 297 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u, replace=%d)\n", 298 __func__, 299 NIP6(*prefix), prefixlen, 300 ifindex, 301 (unsigned int)label, 302 replace); 303 304 newp = ip6addrlbl_alloc(net, prefix, prefixlen, ifindex, label); 305 if (IS_ERR(newp)) 306 return PTR_ERR(newp); 307 spin_lock(&ip6addrlbl_table.lock); 308 ret = __ip6addrlbl_add(newp, replace); 309 spin_unlock(&ip6addrlbl_table.lock); 310 if (ret) 311 ip6addrlbl_free(newp); 312 return ret; 313} 314 315/* remove a label */ 316static int __ip6addrlbl_del(struct net *net, 317 const struct in6_addr *prefix, int prefixlen, 318 int ifindex) 319{ 320 struct ip6addrlbl_entry *p = NULL; 321 struct hlist_node *pos, *n; 322 int ret = -ESRCH; 323 324 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n", 325 __func__, 326 NIP6(*prefix), prefixlen, 327 ifindex); 328 329 hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) { 330 if (p->prefixlen == prefixlen && 331 net_eq(ip6addrlbl_net(p), net) && 332 p->ifindex == ifindex && 333 ipv6_addr_equal(&p->prefix, prefix)) { 334 hlist_del_rcu(&p->list); 335 ip6addrlbl_put(p); 336 ret = 0; 337 break; 338 } 339 } 340 return ret; 341} 342 343static int ip6addrlbl_del(struct net *net, 344 const struct in6_addr *prefix, int prefixlen, 345 int ifindex) 346{ 347 struct in6_addr prefix_buf; 348 int ret; 349 350 ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n", 351 __func__, 352 NIP6(*prefix), prefixlen, 353 ifindex); 354 355 ipv6_addr_prefix(&prefix_buf, prefix, prefixlen); 356 spin_lock(&ip6addrlbl_table.lock); 357 ret = __ip6addrlbl_del(net, &prefix_buf, prefixlen, ifindex); 358 spin_unlock(&ip6addrlbl_table.lock); 359 return ret; 360} 361 362/* add default label */ 363static int __net_init ip6addrlbl_net_init(struct net *net) 364{ 365 int err = 0; 366 int i; 367 368 ADDRLABEL(KERN_DEBUG "%s()\n", __func__); 369 370 for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) { 371 int ret = ip6addrlbl_add(net, 372 ip6addrlbl_init_table[i].prefix, 373 ip6addrlbl_init_table[i].prefixlen, 374 0, 375 ip6addrlbl_init_table[i].label, 0); 376 /* XXX: should we free all rules when we catch an error? */ 377 if (ret && (!err || err != -ENOMEM)) 378 err = ret; 379 } 380 return err; 381} 382 383static void __net_exit ip6addrlbl_net_exit(struct net *net) 384{ 385 struct ip6addrlbl_entry *p = NULL; 386 struct hlist_node *pos, *n; 387 388 /* Remove all labels belonging to the exiting net */ 389 spin_lock(&ip6addrlbl_table.lock); 390 hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) { 391 if (net_eq(ip6addrlbl_net(p), net)) { 392 hlist_del_rcu(&p->list); 393 ip6addrlbl_put(p); 394 } 395 } 396 spin_unlock(&ip6addrlbl_table.lock); 397} 398 399static struct pernet_operations ipv6_addr_label_ops = { 400 .init = ip6addrlbl_net_init, 401 .exit = ip6addrlbl_net_exit, 402}; 403 404int __init ipv6_addr_label_init(void) 405{ 406 spin_lock_init(&ip6addrlbl_table.lock); 407 408 return register_pernet_subsys(&ipv6_addr_label_ops); 409} 410 411static const struct nla_policy ifal_policy[IFAL_MAX+1] = { 412 [IFAL_ADDRESS] = { .len = sizeof(struct in6_addr), }, 413 [IFAL_LABEL] = { .len = sizeof(u32), }, 414}; 415 416static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh, 417 void *arg) 418{ 419 struct net *net = sock_net(skb->sk); 420 struct ifaddrlblmsg *ifal; 421 struct nlattr *tb[IFAL_MAX+1]; 422 struct in6_addr *pfx; 423 u32 label; 424 int err = 0; 425 426 err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy); 427 if (err < 0) 428 return err; 429 430 ifal = nlmsg_data(nlh); 431 432 if (ifal->ifal_family != AF_INET6 || 433 ifal->ifal_prefixlen > 128) 434 return -EINVAL; 435 436 if (ifal->ifal_index && 437 !__dev_get_by_index(net, ifal->ifal_index)) 438 return -EINVAL; 439 440 if (!tb[IFAL_ADDRESS]) 441 return -EINVAL; 442 443 pfx = nla_data(tb[IFAL_ADDRESS]); 444 if (!pfx) 445 return -EINVAL; 446 447 if (!tb[IFAL_LABEL]) 448 return -EINVAL; 449 label = nla_get_u32(tb[IFAL_LABEL]); 450 if (label == IPV6_ADDR_LABEL_DEFAULT) 451 return -EINVAL; 452 453 switch(nlh->nlmsg_type) { 454 case RTM_NEWADDRLABEL: 455 err = ip6addrlbl_add(net, pfx, ifal->ifal_prefixlen, 456 ifal->ifal_index, label, 457 nlh->nlmsg_flags & NLM_F_REPLACE); 458 break; 459 case RTM_DELADDRLABEL: 460 err = ip6addrlbl_del(net, pfx, ifal->ifal_prefixlen, 461 ifal->ifal_index); 462 break; 463 default: 464 err = -EOPNOTSUPP; 465 } 466 return err; 467} 468 469static inline void ip6addrlbl_putmsg(struct nlmsghdr *nlh, 470 int prefixlen, int ifindex, u32 lseq) 471{ 472 struct ifaddrlblmsg *ifal = nlmsg_data(nlh); 473 ifal->ifal_family = AF_INET6; 474 ifal->ifal_prefixlen = prefixlen; 475 ifal->ifal_flags = 0; 476 ifal->ifal_index = ifindex; 477 ifal->ifal_seq = lseq; 478}; 479 480static int ip6addrlbl_fill(struct sk_buff *skb, 481 struct ip6addrlbl_entry *p, 482 u32 lseq, 483 u32 pid, u32 seq, int event, 484 unsigned int flags) 485{ 486 struct nlmsghdr *nlh = nlmsg_put(skb, pid, seq, event, 487 sizeof(struct ifaddrlblmsg), flags); 488 if (!nlh) 489 return -EMSGSIZE; 490 491 ip6addrlbl_putmsg(nlh, p->prefixlen, p->ifindex, lseq); 492 493 if (nla_put(skb, IFAL_ADDRESS, 16, &p->prefix) < 0 || 494 nla_put_u32(skb, IFAL_LABEL, p->label) < 0) { 495 nlmsg_cancel(skb, nlh); 496 return -EMSGSIZE; 497 } 498 499 return nlmsg_end(skb, nlh); 500} 501 502static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb) 503{ 504 struct net *net = sock_net(skb->sk); 505 struct ip6addrlbl_entry *p; 506 struct hlist_node *pos; 507 int idx = 0, s_idx = cb->args[0]; 508 int err; 509 510 rcu_read_lock(); 511 hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) { 512 if (idx >= s_idx && 513 net_eq(ip6addrlbl_net(p), net)) { 514 if ((err = ip6addrlbl_fill(skb, p, 515 ip6addrlbl_table.seq, 516 NETLINK_CB(cb->skb).pid, 517 cb->nlh->nlmsg_seq, 518 RTM_NEWADDRLABEL, 519 NLM_F_MULTI)) <= 0) 520 break; 521 } 522 idx++; 523 } 524 rcu_read_unlock(); 525 cb->args[0] = idx; 526 return skb->len; 527} 528 529static inline int ip6addrlbl_msgsize(void) 530{ 531 return (NLMSG_ALIGN(sizeof(struct ifaddrlblmsg)) 532 + nla_total_size(16) /* IFAL_ADDRESS */ 533 + nla_total_size(4) /* IFAL_LABEL */ 534 ); 535} 536 537static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh, 538 void *arg) 539{ 540 struct net *net = sock_net(in_skb->sk); 541 struct ifaddrlblmsg *ifal; 542 struct nlattr *tb[IFAL_MAX+1]; 543 struct in6_addr *addr; 544 u32 lseq; 545 int err = 0; 546 struct ip6addrlbl_entry *p; 547 struct sk_buff *skb; 548 549 err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy); 550 if (err < 0) 551 return err; 552 553 ifal = nlmsg_data(nlh); 554 555 if (ifal->ifal_family != AF_INET6 || 556 ifal->ifal_prefixlen != 128) 557 return -EINVAL; 558 559 if (ifal->ifal_index && 560 !__dev_get_by_index(net, ifal->ifal_index)) 561 return -EINVAL; 562 563 if (!tb[IFAL_ADDRESS]) 564 return -EINVAL; 565 566 addr = nla_data(tb[IFAL_ADDRESS]); 567 if (!addr) 568 return -EINVAL; 569 570 rcu_read_lock(); 571 p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index); 572 if (p && ip6addrlbl_hold(p)) 573 p = NULL; 574 lseq = ip6addrlbl_table.seq; 575 rcu_read_unlock(); 576 577 if (!p) { 578 err = -ESRCH; 579 goto out; 580 } 581 582 if (!(skb = nlmsg_new(ip6addrlbl_msgsize(), GFP_KERNEL))) { 583 ip6addrlbl_put(p); 584 return -ENOBUFS; 585 } 586 587 err = ip6addrlbl_fill(skb, p, lseq, 588 NETLINK_CB(in_skb).pid, nlh->nlmsg_seq, 589 RTM_NEWADDRLABEL, 0); 590 591 ip6addrlbl_put(p); 592 593 if (err < 0) { 594 WARN_ON(err == -EMSGSIZE); 595 kfree_skb(skb); 596 goto out; 597 } 598 599 err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid); 600out: 601 return err; 602} 603 604void __init ipv6_addr_label_rtnl_register(void) 605{ 606 __rtnl_register(PF_INET6, RTM_NEWADDRLABEL, ip6addrlbl_newdel, NULL); 607 __rtnl_register(PF_INET6, RTM_DELADDRLABEL, ip6addrlbl_newdel, NULL); 608 __rtnl_register(PF_INET6, RTM_GETADDRLABEL, ip6addrlbl_get, ip6addrlbl_dump); 609} 610 611