From patchwork Tue Mar 13 15:29:36 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Ahern X-Patchwork-Id: 885308 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="MKhpzMEd"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 4011KY2JvWz9sSf for ; Wed, 14 Mar 2018 03:59:13 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933123AbeCMP3z (ORCPT ); Tue, 13 Mar 2018 11:29:55 -0400 Received: from mail-pf0-f193.google.com ([209.85.192.193]:34235 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933102AbeCMP3w (ORCPT ); Tue, 13 Mar 2018 11:29:52 -0400 Received: by mail-pf0-f193.google.com with SMTP id j20so7155pfi.1 for ; Tue, 13 Mar 2018 08:29:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=4MIBq1/vDUoem4NxttuGHOd6bW838R+R1aZTxQRxd/0=; b=MKhpzMEdZgI+nefH7PZdan+7zX8YjG9iQYc5aOqB4NN6MqJv+4ra222H+nJC9mWvN8 e4NJcKIWTAfNuBVH82QlV1qrTArZF4MPVBxlFVPhOl7zJ6e1rk7JoHaZQMyXLCOS/LV1 WD24iGyWEEw6wgJVtdFZim7pzILdWEJl67VtXJ7GxQB2Rx2TUza2tGg9uCdcJxncWAnk TiarUB2B33eq2Jq+uuCpUN6JZuDOKx1XLZItUFuA5vkTw8l281HKBO4j8oS3Tpnup/sV I+N6NvRRBy3LWh43S0bn+yN1l3/aCgTQHUFxzeUWt0g9x70XYZ1HfbHKAF4PsmJhypXw nuHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=4MIBq1/vDUoem4NxttuGHOd6bW838R+R1aZTxQRxd/0=; b=WPvL6zTuMtgma5fSVjBAZlsz/hPfR1FvUrBCERvUk3c1qNesLCQ5ibnqdwcKB26kFq i222iyga5twntDACqdyyCEa7zTGDs3PD310pfWNB7VvHn1AqA/ZOURKtbx0ZCQWbC4uw JPkAAWgSe4W4KL8h49aPJlyX4MKxDerDsKOJ16J/ZuyPCbXfbKnGe5NIDjvjdtB3Sy1p ZgsyL+ajIY/3pcAJnAve8lowoiyTb4JWerSvH0ORBGO6n00wcikih5rTXj8Vs74eKGXB t/EHPw1WtcWnKmn6a3im2nzcTe2xrM6pLjQ8F/mcpKs9wD2u32rRFjgcVsCdgh/R0HnJ a0HA== X-Gm-Message-State: AElRT7GV9P01k0OEeJukwzc0P7PYmagDAstb0Ttt4wvYoeiWSI/9GjML SpGYdjlJLWN7iQYz8L6ZF5N0mw== X-Google-Smtp-Source: AG47ELu5N8A7Oh/tPjO1mBp/+M+SXnr8z6dlGJnbE5AAhuLLUG1IOKwvRenplWDgxJD9Cuw66hv8VA== X-Received: by 10.99.105.202 with SMTP id e193mr818048pgc.84.1520954991510; Tue, 13 Mar 2018 08:29:51 -0700 (PDT) Received: from kenny.it.cumulusnetworks.com. (fw.cumulusnetworks.com. [216.129.126.126]) by smtp.googlemail.com with ESMTPSA id k73sm1231187pfk.54.2018.03.13.08.29.49 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 13 Mar 2018 08:29:49 -0700 (PDT) From: David Ahern To: netdev@vger.kernel.org Cc: idosch@idosch.org, David Ahern Subject: [PATCH v4 net-next 1/6] net/ipv6: Refactor gateway validation on route add Date: Tue, 13 Mar 2018 08:29:36 -0700 Message-Id: <20180313152941.31218-2-dsahern@gmail.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180313152941.31218-1-dsahern@gmail.com> References: <20180313152941.31218-1-dsahern@gmail.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Move gateway validation code from ip6_route_info_create into ip6_validate_gw. Code move plus adjustments to handle the potential reset of dev and idev and to make checkpatch happy. Signed-off-by: David Ahern Reviewed-by: Ido Schimmel --- net/ipv6/route.c | 120 ++++++++++++++++++++++++++++++------------------------- 1 file changed, 66 insertions(+), 54 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 81711e3e2604..23ced851fdb1 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2550,7 +2550,7 @@ static struct rt6_info *ip6_nh_lookup_table(struct net *net, static int ip6_route_check_nh_onlink(struct net *net, struct fib6_config *cfg, - struct net_device *dev, + const struct net_device *dev, struct netlink_ext_ack *extack) { u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN; @@ -2626,6 +2626,68 @@ static int ip6_route_check_nh(struct net *net, return err; } +static int ip6_validate_gw(struct net *net, struct fib6_config *cfg, + struct net_device **_dev, struct inet6_dev **idev, + struct netlink_ext_ack *extack) +{ + const struct in6_addr *gw_addr = &cfg->fc_gateway; + int gwa_type = ipv6_addr_type(gw_addr); + const struct net_device *dev = *_dev; + int err = -EINVAL; + + /* if gw_addr is local we will fail to detect this in case + * address is still TENTATIVE (DAD in progress). rt6_lookup() + * will return already-added prefix route via interface that + * prefix route was assigned to, which might be non-loopback. + */ + if (ipv6_chk_addr_and_flags(net, gw_addr, + gwa_type & IPV6_ADDR_LINKLOCAL ? + dev : NULL, 0, 0)) { + NL_SET_ERR_MSG(extack, "Invalid gateway address"); + goto out; + } + + if (gwa_type != (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_UNICAST)) { + /* IPv6 strictly inhibits using not link-local + * addresses as nexthop address. + * Otherwise, router will not able to send redirects. + * It is very good, but in some (rare!) circumstances + * (SIT, PtP, NBMA NOARP links) it is handy to allow + * some exceptions. --ANK + * We allow IPv4-mapped nexthops to support RFC4798-type + * addressing + */ + if (!(gwa_type & (IPV6_ADDR_UNICAST | IPV6_ADDR_MAPPED))) { + NL_SET_ERR_MSG(extack, "Invalid gateway address"); + goto out; + } + + if (cfg->fc_flags & RTNH_F_ONLINK) + err = ip6_route_check_nh_onlink(net, cfg, dev, extack); + else + err = ip6_route_check_nh(net, cfg, _dev, idev); + + if (err) + goto out; + } + + /* reload in case device was changed */ + dev = *_dev; + + err = -EINVAL; + if (!dev) { + NL_SET_ERR_MSG(extack, "Egress device not specified"); + goto out; + } else if (dev->flags & IFF_LOOPBACK) { + NL_SET_ERR_MSG(extack, + "Egress device can not be loopback device for this route"); + goto out; + } + err = 0; +out: + return err; +} + static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, struct netlink_ext_ack *extack) { @@ -2808,61 +2870,11 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg, } if (cfg->fc_flags & RTF_GATEWAY) { - const struct in6_addr *gw_addr; - int gwa_type; - - gw_addr = &cfg->fc_gateway; - gwa_type = ipv6_addr_type(gw_addr); - - /* if gw_addr is local we will fail to detect this in case - * address is still TENTATIVE (DAD in progress). rt6_lookup() - * will return already-added prefix route via interface that - * prefix route was assigned to, which might be non-loopback. - */ - err = -EINVAL; - if (ipv6_chk_addr_and_flags(net, gw_addr, - gwa_type & IPV6_ADDR_LINKLOCAL ? - dev : NULL, 0, 0)) { - NL_SET_ERR_MSG(extack, "Invalid gateway address"); + err = ip6_validate_gw(net, cfg, &dev, &idev, extack); + if (err) goto out; - } - rt->rt6i_gateway = *gw_addr; - - if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) { - /* IPv6 strictly inhibits using not link-local - addresses as nexthop address. - Otherwise, router will not able to send redirects. - It is very good, but in some (rare!) circumstances - (SIT, PtP, NBMA NOARP links) it is handy to allow - some exceptions. --ANK - We allow IPv4-mapped nexthops to support RFC4798-type - addressing - */ - if (!(gwa_type & (IPV6_ADDR_UNICAST | - IPV6_ADDR_MAPPED))) { - NL_SET_ERR_MSG(extack, - "Invalid gateway address"); - goto out; - } - if (cfg->fc_flags & RTNH_F_ONLINK) { - err = ip6_route_check_nh_onlink(net, cfg, dev, - extack); - } else { - err = ip6_route_check_nh(net, cfg, &dev, &idev); - } - if (err) - goto out; - } - err = -EINVAL; - if (!dev) { - NL_SET_ERR_MSG(extack, "Egress device not specified"); - goto out; - } else if (dev->flags & IFF_LOOPBACK) { - NL_SET_ERR_MSG(extack, - "Egress device can not be loopback device for this route"); - goto out; - } + rt->rt6i_gateway = cfg->fc_gateway; } err = -ENODEV;