50fba2aa7c
This patch moves the sending of ICMP messages when there are no IPv4/IPv6 tunnels present to tunnel4/tunnel6 respectively. Please note that for now if xfrm4_tunnel/xfrm6_tunnel is loaded then no ICMP messages will ever be sent. This is similar to how we handle AH/ESP/IPCOMP. This move fixes the bug where we always send an ICMP message when there is no ip6_tunnel device present for a given packet even if it is later handled by IPsec. It also causes ICMP messages to be sent when no IPIP tunnel is present. I've decided to use the "port unreachable" ICMP message over the current value of "address unreachable" (and "protocol unreachable" by GRE) because it is not ambiguous unlike the other ones which can be triggered by other conditions. There seems to be no standard specifying what value must be used so this change should be OK. In fact we should change GRE to use this value as well. Incidentally, this patch also fixes a fairly serious bug in xfrm6_tunnel where we don't check whether the embedded IPv6 header is present before dereferencing it for the inside source address. This patch is inspired by a previous patch by Hugo Santos <hsantos@av.it.pt>. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
140 lines
3.3 KiB
C
140 lines
3.3 KiB
C
/*
|
|
* Copyright (C)2003,2004 USAGI/WIDE Project
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*
|
|
* Authors Mitsuru KANDA <mk@linux-ipv6.org>
|
|
* YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
|
|
*/
|
|
|
|
#include <linux/icmpv6.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/mutex.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/skbuff.h>
|
|
#include <net/ipv6.h>
|
|
#include <net/protocol.h>
|
|
#include <net/xfrm.h>
|
|
|
|
static struct xfrm6_tunnel *tunnel6_handlers;
|
|
static DEFINE_MUTEX(tunnel6_mutex);
|
|
|
|
int xfrm6_tunnel_register(struct xfrm6_tunnel *handler)
|
|
{
|
|
struct xfrm6_tunnel **pprev;
|
|
int ret = -EEXIST;
|
|
int priority = handler->priority;
|
|
|
|
mutex_lock(&tunnel6_mutex);
|
|
|
|
for (pprev = &tunnel6_handlers; *pprev; pprev = &(*pprev)->next) {
|
|
if ((*pprev)->priority > priority)
|
|
break;
|
|
if ((*pprev)->priority == priority)
|
|
goto err;
|
|
}
|
|
|
|
handler->next = *pprev;
|
|
*pprev = handler;
|
|
|
|
ret = 0;
|
|
|
|
err:
|
|
mutex_unlock(&tunnel6_mutex);
|
|
|
|
return ret;
|
|
}
|
|
|
|
EXPORT_SYMBOL(xfrm6_tunnel_register);
|
|
|
|
int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler)
|
|
{
|
|
struct xfrm6_tunnel **pprev;
|
|
int ret = -ENOENT;
|
|
|
|
mutex_lock(&tunnel6_mutex);
|
|
|
|
for (pprev = &tunnel6_handlers; *pprev; pprev = &(*pprev)->next) {
|
|
if (*pprev == handler) {
|
|
*pprev = handler->next;
|
|
ret = 0;
|
|
break;
|
|
}
|
|
}
|
|
|
|
mutex_unlock(&tunnel6_mutex);
|
|
|
|
synchronize_net();
|
|
|
|
return ret;
|
|
}
|
|
|
|
EXPORT_SYMBOL(xfrm6_tunnel_deregister);
|
|
|
|
static int tunnel6_rcv(struct sk_buff **pskb)
|
|
{
|
|
struct sk_buff *skb = *pskb;
|
|
struct xfrm6_tunnel *handler;
|
|
|
|
if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
|
|
goto drop;
|
|
|
|
for (handler = tunnel6_handlers; handler; handler = handler->next)
|
|
if (!handler->handler(skb))
|
|
return 0;
|
|
|
|
icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
|
|
|
|
drop:
|
|
kfree_skb(skb);
|
|
return 0;
|
|
}
|
|
|
|
static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
|
|
int type, int code, int offset, __u32 info)
|
|
{
|
|
struct xfrm6_tunnel *handler;
|
|
|
|
for (handler = tunnel6_handlers; handler; handler = handler->next)
|
|
if (!handler->err_handler(skb, opt, type, code, offset, info))
|
|
break;
|
|
}
|
|
|
|
static struct inet6_protocol tunnel6_protocol = {
|
|
.handler = tunnel6_rcv,
|
|
.err_handler = tunnel6_err,
|
|
.flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
|
|
};
|
|
|
|
static int __init tunnel6_init(void)
|
|
{
|
|
if (inet6_add_protocol(&tunnel6_protocol, IPPROTO_IPV6)) {
|
|
printk(KERN_ERR "tunnel6 init(): can't add protocol\n");
|
|
return -EAGAIN;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static void __exit tunnel6_fini(void)
|
|
{
|
|
if (inet6_del_protocol(&tunnel6_protocol, IPPROTO_IPV6))
|
|
printk(KERN_ERR "tunnel6 close: can't remove protocol\n");
|
|
}
|
|
|
|
module_init(tunnel6_init);
|
|
module_exit(tunnel6_fini);
|
|
MODULE_LICENSE("GPL");
|