xfrm6_state.c 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186
  1. /*
  2. * xfrm6_state.c: based on xfrm4_state.c
  3. *
  4. * Authors:
  5. * Mitsuru KANDA @USAGI
  6. * Kazunori MIYAZAWA @USAGI
  7. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  8. * IPv6 support
  9. * YOSHIFUJI Hideaki @USAGI
  10. * Split up af-specific portion
  11. *
  12. */
  13. #include <net/xfrm.h>
  14. #include <linux/pfkeyv2.h>
  15. #include <linux/ipsec.h>
  16. #include <net/ipv6.h>
  17. #include <net/addrconf.h>
  18. static struct xfrm_state_afinfo xfrm6_state_afinfo;
  19. static void
  20. __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
  21. struct xfrm_tmpl *tmpl,
  22. xfrm_address_t *daddr, xfrm_address_t *saddr)
  23. {
  24. /* Initialize temporary selector matching only
  25. * to current session. */
  26. ipv6_addr_copy((struct in6_addr *)&x->sel.daddr, &fl->fl6_dst);
  27. ipv6_addr_copy((struct in6_addr *)&x->sel.saddr, &fl->fl6_src);
  28. x->sel.dport = xfrm_flowi_dport(fl);
  29. x->sel.dport_mask = htons(0xffff);
  30. x->sel.sport = xfrm_flowi_sport(fl);
  31. x->sel.sport_mask = htons(0xffff);
  32. x->sel.prefixlen_d = 128;
  33. x->sel.prefixlen_s = 128;
  34. x->sel.proto = fl->proto;
  35. x->sel.ifindex = fl->oif;
  36. x->id = tmpl->id;
  37. if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
  38. memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
  39. memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
  40. if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
  41. memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
  42. x->props.mode = tmpl->mode;
  43. x->props.reqid = tmpl->reqid;
  44. x->props.family = AF_INET6;
  45. }
  46. static int
  47. __xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
  48. {
  49. int i;
  50. int j = 0;
  51. /* Rule 1: select IPsec transport except AH */
  52. for (i = 0; i < n; i++) {
  53. if (src[i]->props.mode == XFRM_MODE_TRANSPORT &&
  54. src[i]->id.proto != IPPROTO_AH) {
  55. dst[j++] = src[i];
  56. src[i] = NULL;
  57. }
  58. }
  59. if (j == n)
  60. goto end;
  61. /* Rule 2: select MIPv6 RO or inbound trigger */
  62. #ifdef CONFIG_IPV6_MIP6
  63. for (i = 0; i < n; i++) {
  64. if (src[i] &&
  65. (src[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION ||
  66. src[i]->props.mode == XFRM_MODE_IN_TRIGGER)) {
  67. dst[j++] = src[i];
  68. src[i] = NULL;
  69. }
  70. }
  71. if (j == n)
  72. goto end;
  73. #endif
  74. /* Rule 3: select IPsec transport AH */
  75. for (i = 0; i < n; i++) {
  76. if (src[i] &&
  77. src[i]->props.mode == XFRM_MODE_TRANSPORT &&
  78. src[i]->id.proto == IPPROTO_AH) {
  79. dst[j++] = src[i];
  80. src[i] = NULL;
  81. }
  82. }
  83. if (j == n)
  84. goto end;
  85. /* Rule 4: select IPsec tunnel */
  86. for (i = 0; i < n; i++) {
  87. if (src[i] &&
  88. src[i]->props.mode == XFRM_MODE_TUNNEL) {
  89. dst[j++] = src[i];
  90. src[i] = NULL;
  91. }
  92. }
  93. if (likely(j == n))
  94. goto end;
  95. /* Final rule */
  96. for (i = 0; i < n; i++) {
  97. if (src[i]) {
  98. dst[j++] = src[i];
  99. src[i] = NULL;
  100. }
  101. }
  102. end:
  103. return 0;
  104. }
  105. static int
  106. __xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
  107. {
  108. int i;
  109. int j = 0;
  110. /* Rule 1: select IPsec transport */
  111. for (i = 0; i < n; i++) {
  112. if (src[i]->mode == XFRM_MODE_TRANSPORT) {
  113. dst[j++] = src[i];
  114. src[i] = NULL;
  115. }
  116. }
  117. if (j == n)
  118. goto end;
  119. /* Rule 2: select MIPv6 RO or inbound trigger */
  120. #ifdef CONFIG_IPV6_MIP6
  121. for (i = 0; i < n; i++) {
  122. if (src[i] &&
  123. (src[i]->mode == XFRM_MODE_ROUTEOPTIMIZATION ||
  124. src[i]->mode == XFRM_MODE_IN_TRIGGER)) {
  125. dst[j++] = src[i];
  126. src[i] = NULL;
  127. }
  128. }
  129. if (j == n)
  130. goto end;
  131. #endif
  132. /* Rule 3: select IPsec tunnel */
  133. for (i = 0; i < n; i++) {
  134. if (src[i] &&
  135. src[i]->mode == XFRM_MODE_TUNNEL) {
  136. dst[j++] = src[i];
  137. src[i] = NULL;
  138. }
  139. }
  140. if (likely(j == n))
  141. goto end;
  142. /* Final rule */
  143. for (i = 0; i < n; i++) {
  144. if (src[i]) {
  145. dst[j++] = src[i];
  146. src[i] = NULL;
  147. }
  148. }
  149. end:
  150. return 0;
  151. }
  152. static struct xfrm_state_afinfo xfrm6_state_afinfo = {
  153. .family = AF_INET6,
  154. .init_tempsel = __xfrm6_init_tempsel,
  155. .tmpl_sort = __xfrm6_tmpl_sort,
  156. .state_sort = __xfrm6_state_sort,
  157. .output = xfrm6_output,
  158. };
  159. void __init xfrm6_state_init(void)
  160. {
  161. xfrm_state_register_afinfo(&xfrm6_state_afinfo);
  162. }
  163. void xfrm6_state_fini(void)
  164. {
  165. xfrm_state_unregister_afinfo(&xfrm6_state_afinfo);
  166. }