xfrm4_policy.c 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361
  1. /*
  2. * xfrm4_policy.c
  3. *
  4. * Changes:
  5. * Kazunori MIYAZAWA @USAGI
  6. * YOSHIFUJI Hideaki @USAGI
  7. * Split up af-specific portion
  8. *
  9. */
  10. #include <linux/compiler.h>
  11. #include <linux/inetdevice.h>
  12. #include <net/xfrm.h>
  13. #include <net/ip.h>
  14. static struct dst_ops xfrm4_dst_ops;
  15. static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
  16. static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
  17. {
  18. return __ip_route_output_key((struct rtable**)dst, fl);
  19. }
  20. static int xfrm4_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
  21. {
  22. struct rtable *rt;
  23. struct flowi fl_tunnel = {
  24. .nl_u = {
  25. .ip4_u = {
  26. .daddr = daddr->a4,
  27. },
  28. },
  29. };
  30. if (!xfrm4_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
  31. saddr->a4 = rt->rt_src;
  32. dst_release(&rt->u.dst);
  33. return 0;
  34. }
  35. return -EHOSTUNREACH;
  36. }
  37. static struct dst_entry *
  38. __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
  39. {
  40. struct dst_entry *dst;
  41. read_lock_bh(&policy->lock);
  42. for (dst = policy->bundles; dst; dst = dst->next) {
  43. struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
  44. if (xdst->u.rt.fl.oif == fl->oif && /*XXX*/
  45. xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
  46. xdst->u.rt.fl.fl4_src == fl->fl4_src &&
  47. xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
  48. xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
  49. dst_clone(dst);
  50. break;
  51. }
  52. }
  53. read_unlock_bh(&policy->lock);
  54. return dst;
  55. }
  56. /* Allocate chain of dst_entry's, attach known xfrm's, calculate
  57. * all the metrics... Shortly, bundle a bundle.
  58. */
  59. static int
  60. __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
  61. struct flowi *fl, struct dst_entry **dst_p)
  62. {
  63. struct dst_entry *dst, *dst_prev;
  64. struct rtable *rt0 = (struct rtable*)(*dst_p);
  65. struct rtable *rt = rt0;
  66. struct flowi fl_tunnel = {
  67. .nl_u = {
  68. .ip4_u = {
  69. .saddr = fl->fl4_src,
  70. .daddr = fl->fl4_dst,
  71. .tos = fl->fl4_tos
  72. }
  73. }
  74. };
  75. int i;
  76. int err;
  77. int header_len = 0;
  78. int trailer_len = 0;
  79. dst = dst_prev = NULL;
  80. dst_hold(&rt->u.dst);
  81. for (i = 0; i < nx; i++) {
  82. struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);
  83. struct xfrm_dst *xdst;
  84. if (unlikely(dst1 == NULL)) {
  85. err = -ENOBUFS;
  86. dst_release(&rt->u.dst);
  87. goto error;
  88. }
  89. if (!dst)
  90. dst = dst1;
  91. else {
  92. dst_prev->child = dst1;
  93. dst1->flags |= DST_NOHASH;
  94. dst_clone(dst1);
  95. }
  96. xdst = (struct xfrm_dst *)dst1;
  97. xdst->route = &rt->u.dst;
  98. xdst->genid = xfrm[i]->genid;
  99. dst1->next = dst_prev;
  100. dst_prev = dst1;
  101. header_len += xfrm[i]->props.header_len;
  102. trailer_len += xfrm[i]->props.trailer_len;
  103. if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL) {
  104. unsigned short encap_family = xfrm[i]->props.family;
  105. switch(encap_family) {
  106. case AF_INET:
  107. fl_tunnel.fl4_dst = xfrm[i]->id.daddr.a4;
  108. fl_tunnel.fl4_src = xfrm[i]->props.saddr.a4;
  109. break;
  110. #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
  111. case AF_INET6:
  112. ipv6_addr_copy(&fl_tunnel.fl6_dst, (struct in6_addr*)&xfrm[i]->id.daddr.a6);
  113. ipv6_addr_copy(&fl_tunnel.fl6_src, (struct in6_addr*)&xfrm[i]->props.saddr.a6);
  114. break;
  115. #endif
  116. default:
  117. BUG_ON(1);
  118. }
  119. err = xfrm_dst_lookup((struct xfrm_dst **)&rt,
  120. &fl_tunnel, encap_family);
  121. if (err)
  122. goto error;
  123. } else
  124. dst_hold(&rt->u.dst);
  125. }
  126. dst_prev->child = &rt->u.dst;
  127. dst->path = &rt->u.dst;
  128. *dst_p = dst;
  129. dst = dst_prev;
  130. dst_prev = *dst_p;
  131. i = 0;
  132. for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
  133. struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
  134. struct xfrm_state_afinfo *afinfo;
  135. x->u.rt.fl = *fl;
  136. dst_prev->xfrm = xfrm[i++];
  137. dst_prev->dev = rt->u.dst.dev;
  138. if (rt->u.dst.dev)
  139. dev_hold(rt->u.dst.dev);
  140. dst_prev->obsolete = -1;
  141. dst_prev->flags |= DST_HOST;
  142. dst_prev->lastuse = jiffies;
  143. dst_prev->header_len = header_len;
  144. dst_prev->nfheader_len = 0;
  145. dst_prev->trailer_len = trailer_len;
  146. memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
  147. /* Copy neighbout for reachability confirmation */
  148. dst_prev->neighbour = neigh_clone(rt->u.dst.neighbour);
  149. dst_prev->input = rt->u.dst.input;
  150. /* XXX: When IPv6 module can be unloaded, we should manage reference
  151. * to xfrm6_output in afinfo->output. Miyazawa
  152. * */
  153. afinfo = xfrm_state_get_afinfo(dst_prev->xfrm->props.family);
  154. if (!afinfo) {
  155. dst = *dst_p;
  156. err = -EAFNOSUPPORT;
  157. goto error;
  158. }
  159. dst_prev->output = afinfo->output;
  160. xfrm_state_put_afinfo(afinfo);
  161. if (dst_prev->xfrm->props.family == AF_INET && rt->peer)
  162. atomic_inc(&rt->peer->refcnt);
  163. x->u.rt.peer = rt->peer;
  164. /* Sheit... I remember I did this right. Apparently,
  165. * it was magically lost, so this code needs audit */
  166. x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
  167. x->u.rt.rt_type = rt->rt_type;
  168. x->u.rt.rt_src = rt0->rt_src;
  169. x->u.rt.rt_dst = rt0->rt_dst;
  170. x->u.rt.rt_gateway = rt->rt_gateway;
  171. x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
  172. x->u.rt.idev = rt0->idev;
  173. in_dev_hold(rt0->idev);
  174. header_len -= x->u.dst.xfrm->props.header_len;
  175. trailer_len -= x->u.dst.xfrm->props.trailer_len;
  176. }
  177. xfrm_init_pmtu(dst);
  178. return 0;
  179. error:
  180. if (dst)
  181. dst_free(dst);
  182. return err;
  183. }
  184. static void
  185. _decode_session4(struct sk_buff *skb, struct flowi *fl)
  186. {
  187. struct iphdr *iph = skb->nh.iph;
  188. u8 *xprth = skb->nh.raw + iph->ihl*4;
  189. memset(fl, 0, sizeof(struct flowi));
  190. if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
  191. switch (iph->protocol) {
  192. case IPPROTO_UDP:
  193. case IPPROTO_UDPLITE:
  194. case IPPROTO_TCP:
  195. case IPPROTO_SCTP:
  196. case IPPROTO_DCCP:
  197. if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
  198. __be16 *ports = (__be16 *)xprth;
  199. fl->fl_ip_sport = ports[0];
  200. fl->fl_ip_dport = ports[1];
  201. }
  202. break;
  203. case IPPROTO_ICMP:
  204. if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
  205. u8 *icmp = xprth;
  206. fl->fl_icmp_type = icmp[0];
  207. fl->fl_icmp_code = icmp[1];
  208. }
  209. break;
  210. case IPPROTO_ESP:
  211. if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
  212. __be32 *ehdr = (__be32 *)xprth;
  213. fl->fl_ipsec_spi = ehdr[0];
  214. }
  215. break;
  216. case IPPROTO_AH:
  217. if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
  218. __be32 *ah_hdr = (__be32*)xprth;
  219. fl->fl_ipsec_spi = ah_hdr[1];
  220. }
  221. break;
  222. case IPPROTO_COMP:
  223. if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
  224. __be16 *ipcomp_hdr = (__be16 *)xprth;
  225. fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
  226. }
  227. break;
  228. default:
  229. fl->fl_ipsec_spi = 0;
  230. break;
  231. };
  232. }
  233. fl->proto = iph->protocol;
  234. fl->fl4_dst = iph->daddr;
  235. fl->fl4_src = iph->saddr;
  236. fl->fl4_tos = iph->tos;
  237. }
  238. static inline int xfrm4_garbage_collect(void)
  239. {
  240. xfrm4_policy_afinfo.garbage_collect();
  241. return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
  242. }
  243. static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
  244. {
  245. struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
  246. struct dst_entry *path = xdst->route;
  247. path->ops->update_pmtu(path, mtu);
  248. }
  249. static void xfrm4_dst_destroy(struct dst_entry *dst)
  250. {
  251. struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
  252. if (likely(xdst->u.rt.idev))
  253. in_dev_put(xdst->u.rt.idev);
  254. if (dst->xfrm && dst->xfrm->props.family == AF_INET && likely(xdst->u.rt.peer))
  255. inet_putpeer(xdst->u.rt.peer);
  256. xfrm_dst_destroy(xdst);
  257. }
  258. static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
  259. int unregister)
  260. {
  261. struct xfrm_dst *xdst;
  262. if (!unregister)
  263. return;
  264. xdst = (struct xfrm_dst *)dst;
  265. if (xdst->u.rt.idev->dev == dev) {
  266. struct in_device *loopback_idev = in_dev_get(&loopback_dev);
  267. BUG_ON(!loopback_idev);
  268. do {
  269. in_dev_put(xdst->u.rt.idev);
  270. xdst->u.rt.idev = loopback_idev;
  271. in_dev_hold(loopback_idev);
  272. xdst = (struct xfrm_dst *)xdst->u.dst.child;
  273. } while (xdst->u.dst.xfrm);
  274. __in_dev_put(loopback_idev);
  275. }
  276. xfrm_dst_ifdown(dst, dev);
  277. }
  278. static struct dst_ops xfrm4_dst_ops = {
  279. .family = AF_INET,
  280. .protocol = __constant_htons(ETH_P_IP),
  281. .gc = xfrm4_garbage_collect,
  282. .update_pmtu = xfrm4_update_pmtu,
  283. .destroy = xfrm4_dst_destroy,
  284. .ifdown = xfrm4_dst_ifdown,
  285. .gc_thresh = 1024,
  286. .entry_size = sizeof(struct xfrm_dst),
  287. };
  288. static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
  289. .family = AF_INET,
  290. .dst_ops = &xfrm4_dst_ops,
  291. .dst_lookup = xfrm4_dst_lookup,
  292. .get_saddr = xfrm4_get_saddr,
  293. .find_bundle = __xfrm4_find_bundle,
  294. .bundle_create = __xfrm4_bundle_create,
  295. .decode_session = _decode_session4,
  296. };
  297. static void __init xfrm4_policy_init(void)
  298. {
  299. xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
  300. }
  301. static void __exit xfrm4_policy_fini(void)
  302. {
  303. xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
  304. }
  305. void __init xfrm4_init(void)
  306. {
  307. xfrm4_state_init();
  308. xfrm4_policy_init();
  309. }