[IPV6]: Add RFC4214 support
This patch includes support for the Intra-Site Automatic Tunnel
Addressing Protocol (ISATAP) per RFC4214. It uses the SIT
module, and is configured using extensions to the "iproute2"
utility. The diffs are specific to the Linux 2.6.24-rc2 kernel
distribution.
This version includes the diff for ./include/linux/if.h which was
missing in the v2.4 submission and is needed to make the
patch compile. The patch has been installed, compiled and
tested in a clean 2.6.24-rc2 kernel build area.
Signed-off-by: Fred L. Templin <fred.l.templin@boeing.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 71433d2..b3b8513 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -16,6 +16,7 @@
* Changes:
* Roger Venning <r.venning@telstra.com>: 6to4 support
* Nate Thompson <nate@thebog.net>: 6to4 support
+ * Fred L. Templin <fltemplin@acm.org>: isatap support
*/
#include <linux/module.h>
@@ -182,6 +183,9 @@
dev->init = ipip6_tunnel_init;
nt->parms = *parms;
+ if (parms->i_flags & SIT_ISATAP)
+ dev->priv_flags |= IFF_ISATAP;
+
if (register_netdevice(dev) < 0) {
free_netdev(dev);
goto failed;
@@ -364,6 +368,48 @@
IP6_ECN_set_ce(ipv6_hdr(skb));
}
+/* ISATAP (RFC4214) - check source address */
+static int
+isatap_srcok(struct sk_buff *skb, struct iphdr *iph, struct net_device *dev)
+{
+ struct neighbour *neigh;
+ struct dst_entry *dst;
+ struct rt6_info *rt;
+ struct flowi fl;
+ struct in6_addr *addr6;
+ struct in6_addr rtr;
+ struct ipv6hdr *iph6;
+ int ok = 0;
+
+ /* from onlink default router */
+ ipv6_addr_set(&rtr, htonl(0xFE800000), 0, 0, 0);
+ ipv6_isatap_eui64(rtr.s6_addr + 8, iph->saddr);
+ if ((rt = rt6_get_dflt_router(&rtr, dev))) {
+ dst_release(&rt->u.dst);
+ return 1;
+ }
+
+ iph6 = ipv6_hdr(skb);
+ memset(&fl, 0, sizeof(fl));
+ fl.proto = iph6->nexthdr;
+ ipv6_addr_copy(&fl.fl6_dst, &iph6->saddr);
+ fl.oif = dev->ifindex;
+ security_skb_classify_flow(skb, &fl);
+
+ dst = ip6_route_output(NULL, &fl);
+ if (!dst->error && (dst->dev == dev) && (neigh = dst->neighbour)) {
+
+ addr6 = (struct in6_addr*)&neigh->primary_key;
+
+ /* from correct previous hop */
+ if (ipv6_addr_is_isatap(addr6) &&
+ (addr6->s6_addr32[3] == iph->saddr))
+ ok = 1;
+ }
+ dst_release(dst);
+ return ok;
+}
+
static int ipip6_rcv(struct sk_buff *skb)
{
struct iphdr *iph;
@@ -382,6 +428,14 @@
IPCB(skb)->flags = 0;
skb->protocol = htons(ETH_P_IPV6);
skb->pkt_type = PACKET_HOST;
+
+ if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
+ !isatap_srcok(skb, iph, tunnel->dev)) {
+ tunnel->stat.rx_errors++;
+ read_unlock(&ipip6_lock);
+ kfree_skb(skb);
+ return 0;
+ }
tunnel->stat.rx_packets++;
tunnel->stat.rx_bytes += skb->len;
skb->dev = tunnel->dev;
@@ -444,6 +498,29 @@
if (skb->protocol != htons(ETH_P_IPV6))
goto tx_error;
+ /* ISATAP (RFC4214) - must come before 6to4 */
+ if (dev->priv_flags & IFF_ISATAP) {
+ struct neighbour *neigh = NULL;
+
+ if (skb->dst)
+ neigh = skb->dst->neighbour;
+
+ if (neigh == NULL) {
+ if (net_ratelimit())
+ printk(KERN_DEBUG "sit: nexthop == NULL\n");
+ goto tx_error;
+ }
+
+ addr6 = (struct in6_addr*)&neigh->primary_key;
+ addr_type = ipv6_addr_type(addr6);
+
+ if ((addr_type & IPV6_ADDR_UNICAST) &&
+ ipv6_addr_is_isatap(addr6))
+ dst = addr6->s6_addr32[3];
+ else
+ goto tx_error;
+ }
+
if (!dst)
dst = try_6to4(&iph6->daddr);