xfrm6_policy.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433
  1. /*
  2. * xfrm6_policy.c: based on xfrm4_policy.c
  3. *
  4. * Authors:
  5. * Mitsuru KANDA @USAGI
  6. * Kazunori MIYAZAWA @USAGI
  7. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  8. * IPv6 support
  9. * YOSHIFUJI Hideaki
  10. * Split up af-specific portion
  11. *
  12. */
  13. #include <linux/compiler.h>
  14. #include <linux/netdevice.h>
  15. #include <net/addrconf.h>
  16. #include <net/xfrm.h>
  17. #include <net/ip.h>
  18. #include <net/ipv6.h>
  19. #include <net/ip6_route.h>
  20. #ifdef CONFIG_IPV6_MIP6
  21. #include <net/mip6.h>
  22. #endif
  23. static struct dst_ops xfrm6_dst_ops;
  24. static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
  25. static int xfrm6_dst_lookup(struct xfrm_dst **xdst, struct flowi *fl)
  26. {
  27. struct dst_entry *dst = ip6_route_output(NULL, fl);
  28. int err = dst->error;
  29. if (!err)
  30. *xdst = (struct xfrm_dst *) dst;
  31. else
  32. dst_release(dst);
  33. return err;
  34. }
  35. static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
  36. {
  37. struct rt6_info *rt;
  38. struct flowi fl_tunnel = {
  39. .nl_u = {
  40. .ip6_u = {
  41. .daddr = *(struct in6_addr *)&daddr->a6,
  42. },
  43. },
  44. };
  45. if (!xfrm6_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
  46. ipv6_get_saddr(&rt->u.dst, (struct in6_addr *)&daddr->a6,
  47. (struct in6_addr *)&saddr->a6);
  48. dst_release(&rt->u.dst);
  49. return 0;
  50. }
  51. return -EHOSTUNREACH;
  52. }
  53. static struct dst_entry *
  54. __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
  55. {
  56. struct dst_entry *dst;
  57. /* Still not clear if we should set fl->fl6_{src,dst}... */
  58. read_lock_bh(&policy->lock);
  59. for (dst = policy->bundles; dst; dst = dst->next) {
  60. struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
  61. struct in6_addr fl_dst_prefix, fl_src_prefix;
  62. ipv6_addr_prefix(&fl_dst_prefix,
  63. &fl->fl6_dst,
  64. xdst->u.rt6.rt6i_dst.plen);
  65. ipv6_addr_prefix(&fl_src_prefix,
  66. &fl->fl6_src,
  67. xdst->u.rt6.rt6i_src.plen);
  68. if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&
  69. ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) &&
  70. xfrm_bundle_ok(policy, xdst, fl, AF_INET6,
  71. (xdst->u.rt6.rt6i_dst.plen != 128 ||
  72. xdst->u.rt6.rt6i_src.plen != 128))) {
  73. dst_clone(dst);
  74. break;
  75. }
  76. }
  77. read_unlock_bh(&policy->lock);
  78. return dst;
  79. }
  80. static inline struct in6_addr*
  81. __xfrm6_bundle_addr_remote(struct xfrm_state *x, struct in6_addr *addr)
  82. {
  83. return (x->type->remote_addr) ?
  84. (struct in6_addr*)x->type->remote_addr(x, (xfrm_address_t *)addr) :
  85. (struct in6_addr*)&x->id.daddr;
  86. }
  87. static inline struct in6_addr*
  88. __xfrm6_bundle_addr_local(struct xfrm_state *x, struct in6_addr *addr)
  89. {
  90. return (x->type->local_addr) ?
  91. (struct in6_addr*)x->type->local_addr(x, (xfrm_address_t *)addr) :
  92. (struct in6_addr*)&x->props.saddr;
  93. }
  94. static inline void
  95. __xfrm6_bundle_len_inc(int *len, int *nflen, struct xfrm_state *x)
  96. {
  97. if (x->type->flags & XFRM_TYPE_NON_FRAGMENT)
  98. *nflen += x->props.header_len;
  99. else
  100. *len += x->props.header_len;
  101. }
  102. static inline void
  103. __xfrm6_bundle_len_dec(int *len, int *nflen, struct xfrm_state *x)
  104. {
  105. if (x->type->flags & XFRM_TYPE_NON_FRAGMENT)
  106. *nflen -= x->props.header_len;
  107. else
  108. *len -= x->props.header_len;
  109. }
  110. /* Allocate chain of dst_entry's, attach known xfrm's, calculate
  111. * all the metrics... Shortly, bundle a bundle.
  112. */
  113. static int
  114. __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
  115. struct flowi *fl, struct dst_entry **dst_p)
  116. {
  117. struct dst_entry *dst, *dst_prev;
  118. struct rt6_info *rt0 = (struct rt6_info*)(*dst_p);
  119. struct rt6_info *rt = rt0;
  120. struct flowi fl_tunnel = {
  121. .nl_u = {
  122. .ip6_u = {
  123. .saddr = fl->fl6_src,
  124. .daddr = fl->fl6_dst,
  125. }
  126. }
  127. };
  128. int i;
  129. int err = 0;
  130. int header_len = 0;
  131. int nfheader_len = 0;
  132. int trailer_len = 0;
  133. dst = dst_prev = NULL;
  134. dst_hold(&rt->u.dst);
  135. for (i = 0; i < nx; i++) {
  136. struct dst_entry *dst1 = dst_alloc(&xfrm6_dst_ops);
  137. struct xfrm_dst *xdst;
  138. if (unlikely(dst1 == NULL)) {
  139. err = -ENOBUFS;
  140. dst_release(&rt->u.dst);
  141. goto error;
  142. }
  143. if (!dst)
  144. dst = dst1;
  145. else {
  146. dst_prev->child = dst1;
  147. dst1->flags |= DST_NOHASH;
  148. dst_clone(dst1);
  149. }
  150. xdst = (struct xfrm_dst *)dst1;
  151. xdst->route = &rt->u.dst;
  152. xdst->genid = xfrm[i]->genid;
  153. if (rt->rt6i_node)
  154. xdst->route_cookie = rt->rt6i_node->fn_sernum;
  155. dst1->next = dst_prev;
  156. dst_prev = dst1;
  157. __xfrm6_bundle_len_inc(&header_len, &nfheader_len, xfrm[i]);
  158. trailer_len += xfrm[i]->props.trailer_len;
  159. if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL ||
  160. xfrm[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION) {
  161. unsigned short encap_family = xfrm[i]->props.family;
  162. switch(encap_family) {
  163. case AF_INET:
  164. fl_tunnel.fl4_dst = xfrm[i]->id.daddr.a4;
  165. fl_tunnel.fl4_src = xfrm[i]->props.saddr.a4;
  166. break;
  167. case AF_INET6:
  168. ipv6_addr_copy(&fl_tunnel.fl6_dst, __xfrm6_bundle_addr_remote(xfrm[i], &fl->fl6_dst));
  169. ipv6_addr_copy(&fl_tunnel.fl6_src, __xfrm6_bundle_addr_local(xfrm[i], &fl->fl6_src));
  170. break;
  171. default:
  172. BUG_ON(1);
  173. }
  174. err = xfrm_dst_lookup((struct xfrm_dst **) &rt,
  175. &fl_tunnel, encap_family);
  176. if (err)
  177. goto error;
  178. } else
  179. dst_hold(&rt->u.dst);
  180. }
  181. dst_prev->child = &rt->u.dst;
  182. dst->path = &rt->u.dst;
  183. if (rt->rt6i_node)
  184. ((struct xfrm_dst *)dst)->path_cookie = rt->rt6i_node->fn_sernum;
  185. *dst_p = dst;
  186. dst = dst_prev;
  187. dst_prev = *dst_p;
  188. i = 0;
  189. for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
  190. struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
  191. struct xfrm_state_afinfo *afinfo;
  192. dst_prev->xfrm = xfrm[i++];
  193. dst_prev->dev = rt->u.dst.dev;
  194. if (rt->u.dst.dev)
  195. dev_hold(rt->u.dst.dev);
  196. dst_prev->obsolete = -1;
  197. dst_prev->flags |= DST_HOST;
  198. dst_prev->lastuse = jiffies;
  199. dst_prev->header_len = header_len;
  200. dst_prev->nfheader_len = nfheader_len;
  201. dst_prev->trailer_len = trailer_len;
  202. memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
  203. /* Copy neighbour for reachability confirmation */
  204. dst_prev->neighbour = neigh_clone(rt->u.dst.neighbour);
  205. dst_prev->input = rt->u.dst.input;
  206. /* XXX: When IPv4 is implemented as module and can be unloaded,
  207. * we should manage reference to xfrm4_output in afinfo->output.
  208. * Miyazawa
  209. */
  210. afinfo = xfrm_state_get_afinfo(dst_prev->xfrm->props.family);
  211. if (!afinfo) {
  212. dst = *dst_p;
  213. goto error;
  214. };
  215. dst_prev->output = afinfo->output;
  216. xfrm_state_put_afinfo(afinfo);
  217. /* Sheit... I remember I did this right. Apparently,
  218. * it was magically lost, so this code needs audit */
  219. x->u.rt6.rt6i_flags = rt0->rt6i_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
  220. x->u.rt6.rt6i_metric = rt0->rt6i_metric;
  221. x->u.rt6.rt6i_node = rt0->rt6i_node;
  222. x->u.rt6.rt6i_gateway = rt0->rt6i_gateway;
  223. memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway));
  224. x->u.rt6.rt6i_dst = rt0->rt6i_dst;
  225. x->u.rt6.rt6i_src = rt0->rt6i_src;
  226. x->u.rt6.rt6i_idev = rt0->rt6i_idev;
  227. in6_dev_hold(rt0->rt6i_idev);
  228. __xfrm6_bundle_len_dec(&header_len, &nfheader_len, x->u.dst.xfrm);
  229. trailer_len -= x->u.dst.xfrm->props.trailer_len;
  230. }
  231. xfrm_init_pmtu(dst);
  232. return 0;
  233. error:
  234. if (dst)
  235. dst_free(dst);
  236. return err;
  237. }
  238. static inline void
  239. _decode_session6(struct sk_buff *skb, struct flowi *fl)
  240. {
  241. u16 offset = skb->h.raw - skb->nh.raw;
  242. struct ipv6hdr *hdr = skb->nh.ipv6h;
  243. struct ipv6_opt_hdr *exthdr;
  244. u8 nexthdr = skb->nh.raw[IP6CB(skb)->nhoff];
  245. memset(fl, 0, sizeof(struct flowi));
  246. ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
  247. ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
  248. while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
  249. exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
  250. switch (nexthdr) {
  251. case NEXTHDR_ROUTING:
  252. case NEXTHDR_HOP:
  253. case NEXTHDR_DEST:
  254. offset += ipv6_optlen(exthdr);
  255. nexthdr = exthdr->nexthdr;
  256. exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
  257. break;
  258. case IPPROTO_UDP:
  259. case IPPROTO_UDPLITE:
  260. case IPPROTO_TCP:
  261. case IPPROTO_SCTP:
  262. case IPPROTO_DCCP:
  263. if (pskb_may_pull(skb, skb->nh.raw + offset + 4 - skb->data)) {
  264. __be16 *ports = (__be16 *)exthdr;
  265. fl->fl_ip_sport = ports[0];
  266. fl->fl_ip_dport = ports[1];
  267. }
  268. fl->proto = nexthdr;
  269. return;
  270. case IPPROTO_ICMPV6:
  271. if (pskb_may_pull(skb, skb->nh.raw + offset + 2 - skb->data)) {
  272. u8 *icmp = (u8 *)exthdr;
  273. fl->fl_icmp_type = icmp[0];
  274. fl->fl_icmp_code = icmp[1];
  275. }
  276. fl->proto = nexthdr;
  277. return;
  278. #ifdef CONFIG_IPV6_MIP6
  279. case IPPROTO_MH:
  280. if (pskb_may_pull(skb, skb->nh.raw + offset + 3 - skb->data)) {
  281. struct ip6_mh *mh;
  282. mh = (struct ip6_mh *)exthdr;
  283. fl->fl_mh_type = mh->ip6mh_type;
  284. }
  285. fl->proto = nexthdr;
  286. return;
  287. #endif
  288. /* XXX Why are there these headers? */
  289. case IPPROTO_AH:
  290. case IPPROTO_ESP:
  291. case IPPROTO_COMP:
  292. default:
  293. fl->fl_ipsec_spi = 0;
  294. fl->proto = nexthdr;
  295. return;
  296. };
  297. }
  298. }
  299. static inline int xfrm6_garbage_collect(void)
  300. {
  301. xfrm6_policy_afinfo.garbage_collect();
  302. return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2);
  303. }
  304. static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
  305. {
  306. struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
  307. struct dst_entry *path = xdst->route;
  308. path->ops->update_pmtu(path, mtu);
  309. }
  310. static void xfrm6_dst_destroy(struct dst_entry *dst)
  311. {
  312. struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
  313. if (likely(xdst->u.rt6.rt6i_idev))
  314. in6_dev_put(xdst->u.rt6.rt6i_idev);
  315. xfrm_dst_destroy(xdst);
  316. }
  317. static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
  318. int unregister)
  319. {
  320. struct xfrm_dst *xdst;
  321. if (!unregister)
  322. return;
  323. xdst = (struct xfrm_dst *)dst;
  324. if (xdst->u.rt6.rt6i_idev->dev == dev) {
  325. struct inet6_dev *loopback_idev = in6_dev_get(&loopback_dev);
  326. BUG_ON(!loopback_idev);
  327. do {
  328. in6_dev_put(xdst->u.rt6.rt6i_idev);
  329. xdst->u.rt6.rt6i_idev = loopback_idev;
  330. in6_dev_hold(loopback_idev);
  331. xdst = (struct xfrm_dst *)xdst->u.dst.child;
  332. } while (xdst->u.dst.xfrm);
  333. __in6_dev_put(loopback_idev);
  334. }
  335. xfrm_dst_ifdown(dst, dev);
  336. }
  337. static struct dst_ops xfrm6_dst_ops = {
  338. .family = AF_INET6,
  339. .protocol = __constant_htons(ETH_P_IPV6),
  340. .gc = xfrm6_garbage_collect,
  341. .update_pmtu = xfrm6_update_pmtu,
  342. .destroy = xfrm6_dst_destroy,
  343. .ifdown = xfrm6_dst_ifdown,
  344. .gc_thresh = 1024,
  345. .entry_size = sizeof(struct xfrm_dst),
  346. };
  347. static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
  348. .family = AF_INET6,
  349. .dst_ops = &xfrm6_dst_ops,
  350. .dst_lookup = xfrm6_dst_lookup,
  351. .get_saddr = xfrm6_get_saddr,
  352. .find_bundle = __xfrm6_find_bundle,
  353. .bundle_create = __xfrm6_bundle_create,
  354. .decode_session = _decode_session6,
  355. };
  356. static void __init xfrm6_policy_init(void)
  357. {
  358. xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
  359. }
  360. static void xfrm6_policy_fini(void)
  361. {
  362. xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
  363. }
  364. void __init xfrm6_init(void)
  365. {
  366. xfrm6_policy_init();
  367. xfrm6_state_init();
  368. }
  369. void xfrm6_fini(void)
  370. {
  371. //xfrm6_input_fini();
  372. xfrm6_policy_fini();
  373. xfrm6_state_fini();
  374. }