xfrm_interface.c 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * XFRM virtual interface
  4. *
  5. * Copyright (C) 2018 secunet Security Networks AG
  6. *
  7. * Author:
  8. * Steffen Klassert <steffen.klassert@secunet.com>
  9. */
  10. #include <linux/module.h>
  11. #include <linux/capability.h>
  12. #include <linux/errno.h>
  13. #include <linux/types.h>
  14. #include <linux/sockios.h>
  15. #include <linux/icmp.h>
  16. #include <linux/if.h>
  17. #include <linux/in.h>
  18. #include <linux/ip.h>
  19. #include <linux/net.h>
  20. #include <linux/in6.h>
  21. #include <linux/netdevice.h>
  22. #include <linux/if_link.h>
  23. #include <linux/if_arp.h>
  24. #include <linux/icmpv6.h>
  25. #include <linux/init.h>
  26. #include <linux/route.h>
  27. #include <linux/rtnetlink.h>
  28. #include <linux/netfilter_ipv6.h>
  29. #include <linux/slab.h>
  30. #include <linux/hash.h>
  31. #include <linux/uaccess.h>
  32. #include <linux/atomic.h>
  33. #include <net/icmp.h>
  34. #include <net/ip.h>
  35. #include <net/ipv6.h>
  36. #include <net/ip6_route.h>
  37. #include <net/ip_tunnels.h>
  38. #include <net/addrconf.h>
  39. #include <net/xfrm.h>
  40. #include <net/net_namespace.h>
  41. #include <net/netns/generic.h>
  42. #include <linux/etherdevice.h>
  43. static int xfrmi_dev_init(struct net_device *dev);
  44. static void xfrmi_dev_setup(struct net_device *dev);
  45. static struct rtnl_link_ops xfrmi_link_ops __read_mostly;
  46. static unsigned int xfrmi_net_id __read_mostly;
  47. static const struct net_device_ops xfrmi_netdev_ops;
  48. #define XFRMI_HASH_BITS 8
  49. #define XFRMI_HASH_SIZE BIT(XFRMI_HASH_BITS)
  50. struct xfrmi_net {
  51. /* lists for storing interfaces in use */
  52. struct xfrm_if __rcu *xfrmi[XFRMI_HASH_SIZE];
  53. };
  54. #define for_each_xfrmi_rcu(start, xi) \
  55. for (xi = rcu_dereference(start); xi; xi = rcu_dereference(xi->next))
  56. static u32 xfrmi_hash(u32 if_id)
  57. {
  58. return hash_32(if_id, XFRMI_HASH_BITS);
  59. }
  60. static struct xfrm_if *xfrmi_lookup(struct net *net, struct xfrm_state *x)
  61. {
  62. struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
  63. struct xfrm_if *xi;
  64. for_each_xfrmi_rcu(xfrmn->xfrmi[xfrmi_hash(x->if_id)], xi) {
  65. if (x->if_id == xi->p.if_id &&
  66. (xi->dev->flags & IFF_UP))
  67. return xi;
  68. }
  69. return NULL;
  70. }
  71. static struct xfrm_if *xfrmi_decode_session(struct sk_buff *skb,
  72. unsigned short family)
  73. {
  74. struct net_device *dev;
  75. int ifindex = 0;
  76. if (!secpath_exists(skb) || !skb->dev)
  77. return NULL;
  78. switch (family) {
  79. case AF_INET6:
  80. ifindex = inet6_sdif(skb);
  81. break;
  82. case AF_INET:
  83. ifindex = inet_sdif(skb);
  84. break;
  85. }
  86. if (ifindex) {
  87. struct net *net = xs_net(xfrm_input_state(skb));
  88. dev = dev_get_by_index_rcu(net, ifindex);
  89. } else {
  90. dev = skb->dev;
  91. }
  92. if (!dev || !(dev->flags & IFF_UP))
  93. return NULL;
  94. if (dev->netdev_ops != &xfrmi_netdev_ops)
  95. return NULL;
  96. return netdev_priv(dev);
  97. }
  98. static void xfrmi_link(struct xfrmi_net *xfrmn, struct xfrm_if *xi)
  99. {
  100. struct xfrm_if __rcu **xip = &xfrmn->xfrmi[xfrmi_hash(xi->p.if_id)];
  101. rcu_assign_pointer(xi->next , rtnl_dereference(*xip));
  102. rcu_assign_pointer(*xip, xi);
  103. }
  104. static void xfrmi_unlink(struct xfrmi_net *xfrmn, struct xfrm_if *xi)
  105. {
  106. struct xfrm_if __rcu **xip;
  107. struct xfrm_if *iter;
  108. for (xip = &xfrmn->xfrmi[xfrmi_hash(xi->p.if_id)];
  109. (iter = rtnl_dereference(*xip)) != NULL;
  110. xip = &iter->next) {
  111. if (xi == iter) {
  112. rcu_assign_pointer(*xip, xi->next);
  113. break;
  114. }
  115. }
  116. }
  117. static void xfrmi_dev_free(struct net_device *dev)
  118. {
  119. struct xfrm_if *xi = netdev_priv(dev);
  120. gro_cells_destroy(&xi->gro_cells);
  121. free_percpu(dev->tstats);
  122. }
  123. static int xfrmi_create(struct net_device *dev)
  124. {
  125. struct xfrm_if *xi = netdev_priv(dev);
  126. struct net *net = dev_net(dev);
  127. struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
  128. int err;
  129. dev->rtnl_link_ops = &xfrmi_link_ops;
  130. err = register_netdevice(dev);
  131. if (err < 0)
  132. goto out;
  133. xfrmi_link(xfrmn, xi);
  134. return 0;
  135. out:
  136. return err;
  137. }
  138. static struct xfrm_if *xfrmi_locate(struct net *net, struct xfrm_if_parms *p)
  139. {
  140. struct xfrm_if __rcu **xip;
  141. struct xfrm_if *xi;
  142. struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
  143. for (xip = &xfrmn->xfrmi[xfrmi_hash(p->if_id)];
  144. (xi = rtnl_dereference(*xip)) != NULL;
  145. xip = &xi->next)
  146. if (xi->p.if_id == p->if_id)
  147. return xi;
  148. return NULL;
  149. }
  150. static void xfrmi_dev_uninit(struct net_device *dev)
  151. {
  152. struct xfrm_if *xi = netdev_priv(dev);
  153. struct xfrmi_net *xfrmn = net_generic(xi->net, xfrmi_net_id);
  154. xfrmi_unlink(xfrmn, xi);
  155. }
  156. static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet)
  157. {
  158. skb->tstamp = 0;
  159. skb->pkt_type = PACKET_HOST;
  160. skb->skb_iif = 0;
  161. skb->ignore_df = 0;
  162. skb_dst_drop(skb);
  163. nf_reset_ct(skb);
  164. nf_reset_trace(skb);
  165. if (!xnet)
  166. return;
  167. ipvs_reset(skb);
  168. secpath_reset(skb);
  169. skb_orphan(skb);
  170. skb->mark = 0;
  171. }
  172. static int xfrmi_rcv_cb(struct sk_buff *skb, int err)
  173. {
  174. const struct xfrm_mode *inner_mode;
  175. struct net_device *dev;
  176. struct xfrm_state *x;
  177. struct xfrm_if *xi;
  178. bool xnet;
  179. if (err && !secpath_exists(skb))
  180. return 0;
  181. x = xfrm_input_state(skb);
  182. xi = xfrmi_lookup(xs_net(x), x);
  183. if (!xi)
  184. return 1;
  185. dev = xi->dev;
  186. skb->dev = dev;
  187. if (err) {
  188. dev->stats.rx_errors++;
  189. dev->stats.rx_dropped++;
  190. return 0;
  191. }
  192. xnet = !net_eq(xi->net, dev_net(skb->dev));
  193. if (xnet) {
  194. inner_mode = &x->inner_mode;
  195. if (x->sel.family == AF_UNSPEC) {
  196. inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
  197. if (inner_mode == NULL) {
  198. XFRM_INC_STATS(dev_net(skb->dev),
  199. LINUX_MIB_XFRMINSTATEMODEERROR);
  200. return -EINVAL;
  201. }
  202. }
  203. if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb,
  204. inner_mode->family))
  205. return -EPERM;
  206. }
  207. xfrmi_scrub_packet(skb, xnet);
  208. dev_sw_netstats_rx_add(dev, skb->len);
  209. return 0;
  210. }
  211. static int
  212. xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
  213. {
  214. struct xfrm_if *xi = netdev_priv(dev);
  215. struct net_device_stats *stats = &xi->dev->stats;
  216. struct dst_entry *dst = skb_dst(skb);
  217. unsigned int length = skb->len;
  218. struct net_device *tdev;
  219. struct xfrm_state *x;
  220. int err = -1;
  221. int mtu;
  222. dst_hold(dst);
  223. dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
  224. if (IS_ERR(dst)) {
  225. err = PTR_ERR(dst);
  226. dst = NULL;
  227. goto tx_err_link_failure;
  228. }
  229. x = dst->xfrm;
  230. if (!x)
  231. goto tx_err_link_failure;
  232. if (x->if_id != xi->p.if_id)
  233. goto tx_err_link_failure;
  234. tdev = dst->dev;
  235. if (tdev == dev) {
  236. stats->collisions++;
  237. net_warn_ratelimited("%s: Local routing loop detected!\n",
  238. dev->name);
  239. goto tx_err_dst_release;
  240. }
  241. mtu = dst_mtu(dst);
  242. if (skb->len > mtu) {
  243. skb_dst_update_pmtu_no_confirm(skb, mtu);
  244. if (skb->protocol == htons(ETH_P_IPV6)) {
  245. if (mtu < IPV6_MIN_MTU)
  246. mtu = IPV6_MIN_MTU;
  247. if (skb->len > 1280)
  248. icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
  249. else
  250. goto xmit;
  251. } else {
  252. if (!(ip_hdr(skb)->frag_off & htons(IP_DF)))
  253. goto xmit;
  254. icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
  255. htonl(mtu));
  256. }
  257. dst_release(dst);
  258. return -EMSGSIZE;
  259. }
  260. xmit:
  261. xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev)));
  262. skb_dst_set(skb, dst);
  263. skb->dev = tdev;
  264. err = dst_output(xi->net, skb->sk, skb);
  265. if (net_xmit_eval(err) == 0) {
  266. struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
  267. u64_stats_update_begin(&tstats->syncp);
  268. tstats->tx_bytes += length;
  269. tstats->tx_packets++;
  270. u64_stats_update_end(&tstats->syncp);
  271. } else {
  272. stats->tx_errors++;
  273. stats->tx_aborted_errors++;
  274. }
  275. return 0;
  276. tx_err_link_failure:
  277. stats->tx_carrier_errors++;
  278. dst_link_failure(skb);
  279. tx_err_dst_release:
  280. dst_release(dst);
  281. return err;
  282. }
  283. static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
  284. {
  285. struct xfrm_if *xi = netdev_priv(dev);
  286. struct net_device_stats *stats = &xi->dev->stats;
  287. struct dst_entry *dst = skb_dst(skb);
  288. struct flowi fl;
  289. int ret;
  290. memset(&fl, 0, sizeof(fl));
  291. switch (skb->protocol) {
  292. case htons(ETH_P_IPV6):
  293. xfrm_decode_session(skb, &fl, AF_INET6);
  294. memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
  295. if (!dst) {
  296. fl.u.ip6.flowi6_oif = dev->ifindex;
  297. fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
  298. dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
  299. if (dst->error) {
  300. dst_release(dst);
  301. stats->tx_carrier_errors++;
  302. goto tx_err;
  303. }
  304. skb_dst_set(skb, dst);
  305. }
  306. break;
  307. case htons(ETH_P_IP):
  308. xfrm_decode_session(skb, &fl, AF_INET);
  309. memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
  310. if (!dst) {
  311. struct rtable *rt;
  312. fl.u.ip4.flowi4_oif = dev->ifindex;
  313. fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
  314. rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
  315. if (IS_ERR(rt)) {
  316. stats->tx_carrier_errors++;
  317. goto tx_err;
  318. }
  319. skb_dst_set(skb, &rt->dst);
  320. }
  321. break;
  322. default:
  323. goto tx_err;
  324. }
  325. fl.flowi_oif = xi->p.link;
  326. ret = xfrmi_xmit2(skb, dev, &fl);
  327. if (ret < 0)
  328. goto tx_err;
  329. return NETDEV_TX_OK;
  330. tx_err:
  331. stats->tx_errors++;
  332. stats->tx_dropped++;
  333. kfree_skb(skb);
  334. return NETDEV_TX_OK;
  335. }
  336. static int xfrmi4_err(struct sk_buff *skb, u32 info)
  337. {
  338. const struct iphdr *iph = (const struct iphdr *)skb->data;
  339. struct net *net = dev_net(skb->dev);
  340. int protocol = iph->protocol;
  341. struct ip_comp_hdr *ipch;
  342. struct ip_esp_hdr *esph;
  343. struct ip_auth_hdr *ah ;
  344. struct xfrm_state *x;
  345. struct xfrm_if *xi;
  346. __be32 spi;
  347. switch (protocol) {
  348. case IPPROTO_ESP:
  349. esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
  350. spi = esph->spi;
  351. break;
  352. case IPPROTO_AH:
  353. ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
  354. spi = ah->spi;
  355. break;
  356. case IPPROTO_COMP:
  357. ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
  358. spi = htonl(ntohs(ipch->cpi));
  359. break;
  360. default:
  361. return 0;
  362. }
  363. switch (icmp_hdr(skb)->type) {
  364. case ICMP_DEST_UNREACH:
  365. if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
  366. return 0;
  367. case ICMP_REDIRECT:
  368. break;
  369. default:
  370. return 0;
  371. }
  372. x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
  373. spi, protocol, AF_INET);
  374. if (!x)
  375. return 0;
  376. xi = xfrmi_lookup(net, x);
  377. if (!xi) {
  378. xfrm_state_put(x);
  379. return -1;
  380. }
  381. if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
  382. ipv4_update_pmtu(skb, net, info, 0, protocol);
  383. else
  384. ipv4_redirect(skb, net, 0, protocol);
  385. xfrm_state_put(x);
  386. return 0;
  387. }
  388. static int xfrmi6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  389. u8 type, u8 code, int offset, __be32 info)
  390. {
  391. const struct ipv6hdr *iph = (const struct ipv6hdr *)skb->data;
  392. struct net *net = dev_net(skb->dev);
  393. int protocol = iph->nexthdr;
  394. struct ip_comp_hdr *ipch;
  395. struct ip_esp_hdr *esph;
  396. struct ip_auth_hdr *ah;
  397. struct xfrm_state *x;
  398. struct xfrm_if *xi;
  399. __be32 spi;
  400. switch (protocol) {
  401. case IPPROTO_ESP:
  402. esph = (struct ip_esp_hdr *)(skb->data + offset);
  403. spi = esph->spi;
  404. break;
  405. case IPPROTO_AH:
  406. ah = (struct ip_auth_hdr *)(skb->data + offset);
  407. spi = ah->spi;
  408. break;
  409. case IPPROTO_COMP:
  410. ipch = (struct ip_comp_hdr *)(skb->data + offset);
  411. spi = htonl(ntohs(ipch->cpi));
  412. break;
  413. default:
  414. return 0;
  415. }
  416. if (type != ICMPV6_PKT_TOOBIG &&
  417. type != NDISC_REDIRECT)
  418. return 0;
  419. x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
  420. spi, protocol, AF_INET6);
  421. if (!x)
  422. return 0;
  423. xi = xfrmi_lookup(net, x);
  424. if (!xi) {
  425. xfrm_state_put(x);
  426. return -1;
  427. }
  428. if (type == NDISC_REDIRECT)
  429. ip6_redirect(skb, net, skb->dev->ifindex, 0,
  430. sock_net_uid(net, NULL));
  431. else
  432. ip6_update_pmtu(skb, net, info, 0, 0, sock_net_uid(net, NULL));
  433. xfrm_state_put(x);
  434. return 0;
  435. }
  436. static int xfrmi_change(struct xfrm_if *xi, const struct xfrm_if_parms *p)
  437. {
  438. if (xi->p.link != p->link)
  439. return -EINVAL;
  440. xi->p.if_id = p->if_id;
  441. return 0;
  442. }
  443. static int xfrmi_update(struct xfrm_if *xi, struct xfrm_if_parms *p)
  444. {
  445. struct net *net = xi->net;
  446. struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
  447. int err;
  448. xfrmi_unlink(xfrmn, xi);
  449. synchronize_net();
  450. err = xfrmi_change(xi, p);
  451. xfrmi_link(xfrmn, xi);
  452. netdev_state_change(xi->dev);
  453. return err;
  454. }
  455. static void xfrmi_get_stats64(struct net_device *dev,
  456. struct rtnl_link_stats64 *s)
  457. {
  458. dev_fetch_sw_netstats(s, dev->tstats);
  459. s->rx_dropped = dev->stats.rx_dropped;
  460. s->tx_dropped = dev->stats.tx_dropped;
  461. }
  462. static int xfrmi_get_iflink(const struct net_device *dev)
  463. {
  464. struct xfrm_if *xi = netdev_priv(dev);
  465. return xi->p.link;
  466. }
  467. static const struct net_device_ops xfrmi_netdev_ops = {
  468. .ndo_init = xfrmi_dev_init,
  469. .ndo_uninit = xfrmi_dev_uninit,
  470. .ndo_start_xmit = xfrmi_xmit,
  471. .ndo_get_stats64 = xfrmi_get_stats64,
  472. .ndo_get_iflink = xfrmi_get_iflink,
  473. };
  474. static void xfrmi_dev_setup(struct net_device *dev)
  475. {
  476. dev->netdev_ops = &xfrmi_netdev_ops;
  477. dev->header_ops = &ip_tunnel_header_ops;
  478. dev->type = ARPHRD_NONE;
  479. dev->mtu = ETH_DATA_LEN;
  480. dev->min_mtu = ETH_MIN_MTU;
  481. dev->max_mtu = IP_MAX_MTU;
  482. dev->flags = IFF_NOARP;
  483. dev->needs_free_netdev = true;
  484. dev->priv_destructor = xfrmi_dev_free;
  485. netif_keep_dst(dev);
  486. eth_broadcast_addr(dev->broadcast);
  487. }
  488. static int xfrmi_dev_init(struct net_device *dev)
  489. {
  490. struct xfrm_if *xi = netdev_priv(dev);
  491. struct net_device *phydev = __dev_get_by_index(xi->net, xi->p.link);
  492. int err;
  493. dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
  494. if (!dev->tstats)
  495. return -ENOMEM;
  496. err = gro_cells_init(&xi->gro_cells, dev);
  497. if (err) {
  498. free_percpu(dev->tstats);
  499. return err;
  500. }
  501. dev->features |= NETIF_F_LLTX;
  502. if (phydev) {
  503. dev->needed_headroom = phydev->needed_headroom;
  504. dev->needed_tailroom = phydev->needed_tailroom;
  505. if (is_zero_ether_addr(dev->dev_addr))
  506. eth_hw_addr_inherit(dev, phydev);
  507. if (is_zero_ether_addr(dev->broadcast))
  508. memcpy(dev->broadcast, phydev->broadcast,
  509. dev->addr_len);
  510. } else {
  511. eth_hw_addr_random(dev);
  512. eth_broadcast_addr(dev->broadcast);
  513. }
  514. return 0;
  515. }
  516. static int xfrmi_validate(struct nlattr *tb[], struct nlattr *data[],
  517. struct netlink_ext_ack *extack)
  518. {
  519. return 0;
  520. }
  521. static void xfrmi_netlink_parms(struct nlattr *data[],
  522. struct xfrm_if_parms *parms)
  523. {
  524. memset(parms, 0, sizeof(*parms));
  525. if (!data)
  526. return;
  527. if (data[IFLA_XFRM_LINK])
  528. parms->link = nla_get_u32(data[IFLA_XFRM_LINK]);
  529. if (data[IFLA_XFRM_IF_ID])
  530. parms->if_id = nla_get_u32(data[IFLA_XFRM_IF_ID]);
  531. }
  532. static int xfrmi_newlink(struct net *src_net, struct net_device *dev,
  533. struct nlattr *tb[], struct nlattr *data[],
  534. struct netlink_ext_ack *extack)
  535. {
  536. struct net *net = dev_net(dev);
  537. struct xfrm_if_parms p = {};
  538. struct xfrm_if *xi;
  539. int err;
  540. xfrmi_netlink_parms(data, &p);
  541. if (!p.if_id) {
  542. NL_SET_ERR_MSG(extack, "if_id must be non zero");
  543. return -EINVAL;
  544. }
  545. xi = xfrmi_locate(net, &p);
  546. if (xi)
  547. return -EEXIST;
  548. xi = netdev_priv(dev);
  549. xi->p = p;
  550. xi->net = net;
  551. xi->dev = dev;
  552. err = xfrmi_create(dev);
  553. return err;
  554. }
  555. static void xfrmi_dellink(struct net_device *dev, struct list_head *head)
  556. {
  557. unregister_netdevice_queue(dev, head);
  558. }
  559. static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[],
  560. struct nlattr *data[],
  561. struct netlink_ext_ack *extack)
  562. {
  563. struct xfrm_if *xi = netdev_priv(dev);
  564. struct net *net = xi->net;
  565. struct xfrm_if_parms p = {};
  566. xfrmi_netlink_parms(data, &p);
  567. if (!p.if_id) {
  568. NL_SET_ERR_MSG(extack, "if_id must be non zero");
  569. return -EINVAL;
  570. }
  571. xi = xfrmi_locate(net, &p);
  572. if (!xi) {
  573. xi = netdev_priv(dev);
  574. } else {
  575. if (xi->dev != dev)
  576. return -EEXIST;
  577. }
  578. return xfrmi_update(xi, &p);
  579. }
  580. static size_t xfrmi_get_size(const struct net_device *dev)
  581. {
  582. return
  583. /* IFLA_XFRM_LINK */
  584. nla_total_size(4) +
  585. /* IFLA_XFRM_IF_ID */
  586. nla_total_size(4) +
  587. 0;
  588. }
  589. static int xfrmi_fill_info(struct sk_buff *skb, const struct net_device *dev)
  590. {
  591. struct xfrm_if *xi = netdev_priv(dev);
  592. struct xfrm_if_parms *parm = &xi->p;
  593. if (nla_put_u32(skb, IFLA_XFRM_LINK, parm->link) ||
  594. nla_put_u32(skb, IFLA_XFRM_IF_ID, parm->if_id))
  595. goto nla_put_failure;
  596. return 0;
  597. nla_put_failure:
  598. return -EMSGSIZE;
  599. }
  600. static struct net *xfrmi_get_link_net(const struct net_device *dev)
  601. {
  602. struct xfrm_if *xi = netdev_priv(dev);
  603. return xi->net;
  604. }
  605. static const struct nla_policy xfrmi_policy[IFLA_XFRM_MAX + 1] = {
  606. [IFLA_XFRM_LINK] = { .type = NLA_U32 },
  607. [IFLA_XFRM_IF_ID] = { .type = NLA_U32 },
  608. };
  609. static struct rtnl_link_ops xfrmi_link_ops __read_mostly = {
  610. .kind = "xfrm",
  611. .maxtype = IFLA_XFRM_MAX,
  612. .policy = xfrmi_policy,
  613. .priv_size = sizeof(struct xfrm_if),
  614. .setup = xfrmi_dev_setup,
  615. .validate = xfrmi_validate,
  616. .newlink = xfrmi_newlink,
  617. .dellink = xfrmi_dellink,
  618. .changelink = xfrmi_changelink,
  619. .get_size = xfrmi_get_size,
  620. .fill_info = xfrmi_fill_info,
  621. .get_link_net = xfrmi_get_link_net,
  622. };
  623. static void __net_exit xfrmi_exit_batch_net(struct list_head *net_exit_list)
  624. {
  625. struct net *net;
  626. LIST_HEAD(list);
  627. rtnl_lock();
  628. list_for_each_entry(net, net_exit_list, exit_list) {
  629. struct xfrmi_net *xfrmn = net_generic(net, xfrmi_net_id);
  630. struct xfrm_if __rcu **xip;
  631. struct xfrm_if *xi;
  632. int i;
  633. for (i = 0; i < XFRMI_HASH_SIZE; i++) {
  634. for (xip = &xfrmn->xfrmi[i];
  635. (xi = rtnl_dereference(*xip)) != NULL;
  636. xip = &xi->next)
  637. unregister_netdevice_queue(xi->dev, &list);
  638. }
  639. }
  640. unregister_netdevice_many(&list);
  641. rtnl_unlock();
  642. }
  643. static struct pernet_operations xfrmi_net_ops = {
  644. .exit_batch = xfrmi_exit_batch_net,
  645. .id = &xfrmi_net_id,
  646. .size = sizeof(struct xfrmi_net),
  647. };
  648. static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly = {
  649. .handler = xfrm6_rcv,
  650. .input_handler = xfrm_input,
  651. .cb_handler = xfrmi_rcv_cb,
  652. .err_handler = xfrmi6_err,
  653. .priority = 10,
  654. };
  655. static struct xfrm6_protocol xfrmi_ah6_protocol __read_mostly = {
  656. .handler = xfrm6_rcv,
  657. .input_handler = xfrm_input,
  658. .cb_handler = xfrmi_rcv_cb,
  659. .err_handler = xfrmi6_err,
  660. .priority = 10,
  661. };
  662. static struct xfrm6_protocol xfrmi_ipcomp6_protocol __read_mostly = {
  663. .handler = xfrm6_rcv,
  664. .input_handler = xfrm_input,
  665. .cb_handler = xfrmi_rcv_cb,
  666. .err_handler = xfrmi6_err,
  667. .priority = 10,
  668. };
  669. #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
  670. static int xfrmi6_rcv_tunnel(struct sk_buff *skb)
  671. {
  672. const xfrm_address_t *saddr;
  673. __be32 spi;
  674. saddr = (const xfrm_address_t *)&ipv6_hdr(skb)->saddr;
  675. spi = xfrm6_tunnel_spi_lookup(dev_net(skb->dev), saddr);
  676. return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi, NULL);
  677. }
  678. static struct xfrm6_tunnel xfrmi_ipv6_handler __read_mostly = {
  679. .handler = xfrmi6_rcv_tunnel,
  680. .cb_handler = xfrmi_rcv_cb,
  681. .err_handler = xfrmi6_err,
  682. .priority = 2,
  683. };
  684. static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = {
  685. .handler = xfrmi6_rcv_tunnel,
  686. .cb_handler = xfrmi_rcv_cb,
  687. .err_handler = xfrmi6_err,
  688. .priority = 2,
  689. };
  690. #endif
  691. static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly = {
  692. .handler = xfrm4_rcv,
  693. .input_handler = xfrm_input,
  694. .cb_handler = xfrmi_rcv_cb,
  695. .err_handler = xfrmi4_err,
  696. .priority = 10,
  697. };
  698. static struct xfrm4_protocol xfrmi_ah4_protocol __read_mostly = {
  699. .handler = xfrm4_rcv,
  700. .input_handler = xfrm_input,
  701. .cb_handler = xfrmi_rcv_cb,
  702. .err_handler = xfrmi4_err,
  703. .priority = 10,
  704. };
  705. static struct xfrm4_protocol xfrmi_ipcomp4_protocol __read_mostly = {
  706. .handler = xfrm4_rcv,
  707. .input_handler = xfrm_input,
  708. .cb_handler = xfrmi_rcv_cb,
  709. .err_handler = xfrmi4_err,
  710. .priority = 10,
  711. };
  712. #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
  713. static int xfrmi4_rcv_tunnel(struct sk_buff *skb)
  714. {
  715. return xfrm4_rcv_spi(skb, IPPROTO_IPIP, ip_hdr(skb)->saddr);
  716. }
  717. static struct xfrm_tunnel xfrmi_ipip_handler __read_mostly = {
  718. .handler = xfrmi4_rcv_tunnel,
  719. .cb_handler = xfrmi_rcv_cb,
  720. .err_handler = xfrmi4_err,
  721. .priority = 3,
  722. };
  723. static struct xfrm_tunnel xfrmi_ipip6_handler __read_mostly = {
  724. .handler = xfrmi4_rcv_tunnel,
  725. .cb_handler = xfrmi_rcv_cb,
  726. .err_handler = xfrmi4_err,
  727. .priority = 2,
  728. };
  729. #endif
  730. static int __init xfrmi4_init(void)
  731. {
  732. int err;
  733. err = xfrm4_protocol_register(&xfrmi_esp4_protocol, IPPROTO_ESP);
  734. if (err < 0)
  735. goto xfrm_proto_esp_failed;
  736. err = xfrm4_protocol_register(&xfrmi_ah4_protocol, IPPROTO_AH);
  737. if (err < 0)
  738. goto xfrm_proto_ah_failed;
  739. err = xfrm4_protocol_register(&xfrmi_ipcomp4_protocol, IPPROTO_COMP);
  740. if (err < 0)
  741. goto xfrm_proto_comp_failed;
  742. #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
  743. err = xfrm4_tunnel_register(&xfrmi_ipip_handler, AF_INET);
  744. if (err < 0)
  745. goto xfrm_tunnel_ipip_failed;
  746. err = xfrm4_tunnel_register(&xfrmi_ipip6_handler, AF_INET6);
  747. if (err < 0)
  748. goto xfrm_tunnel_ipip6_failed;
  749. #endif
  750. return 0;
  751. #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
  752. xfrm_tunnel_ipip6_failed:
  753. xfrm4_tunnel_deregister(&xfrmi_ipip_handler, AF_INET);
  754. xfrm_tunnel_ipip_failed:
  755. xfrm4_protocol_deregister(&xfrmi_ipcomp4_protocol, IPPROTO_COMP);
  756. #endif
  757. xfrm_proto_comp_failed:
  758. xfrm4_protocol_deregister(&xfrmi_ah4_protocol, IPPROTO_AH);
  759. xfrm_proto_ah_failed:
  760. xfrm4_protocol_deregister(&xfrmi_esp4_protocol, IPPROTO_ESP);
  761. xfrm_proto_esp_failed:
  762. return err;
  763. }
  764. static void xfrmi4_fini(void)
  765. {
  766. #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
  767. xfrm4_tunnel_deregister(&xfrmi_ipip6_handler, AF_INET6);
  768. xfrm4_tunnel_deregister(&xfrmi_ipip_handler, AF_INET);
  769. #endif
  770. xfrm4_protocol_deregister(&xfrmi_ipcomp4_protocol, IPPROTO_COMP);
  771. xfrm4_protocol_deregister(&xfrmi_ah4_protocol, IPPROTO_AH);
  772. xfrm4_protocol_deregister(&xfrmi_esp4_protocol, IPPROTO_ESP);
  773. }
  774. static int __init xfrmi6_init(void)
  775. {
  776. int err;
  777. err = xfrm6_protocol_register(&xfrmi_esp6_protocol, IPPROTO_ESP);
  778. if (err < 0)
  779. goto xfrm_proto_esp_failed;
  780. err = xfrm6_protocol_register(&xfrmi_ah6_protocol, IPPROTO_AH);
  781. if (err < 0)
  782. goto xfrm_proto_ah_failed;
  783. err = xfrm6_protocol_register(&xfrmi_ipcomp6_protocol, IPPROTO_COMP);
  784. if (err < 0)
  785. goto xfrm_proto_comp_failed;
  786. #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
  787. err = xfrm6_tunnel_register(&xfrmi_ipv6_handler, AF_INET6);
  788. if (err < 0)
  789. goto xfrm_tunnel_ipv6_failed;
  790. err = xfrm6_tunnel_register(&xfrmi_ip6ip_handler, AF_INET);
  791. if (err < 0)
  792. goto xfrm_tunnel_ip6ip_failed;
  793. #endif
  794. return 0;
  795. #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
  796. xfrm_tunnel_ip6ip_failed:
  797. xfrm6_tunnel_deregister(&xfrmi_ipv6_handler, AF_INET6);
  798. xfrm_tunnel_ipv6_failed:
  799. xfrm6_protocol_deregister(&xfrmi_ipcomp6_protocol, IPPROTO_COMP);
  800. #endif
  801. xfrm_proto_comp_failed:
  802. xfrm6_protocol_deregister(&xfrmi_ah6_protocol, IPPROTO_AH);
  803. xfrm_proto_ah_failed:
  804. xfrm6_protocol_deregister(&xfrmi_esp6_protocol, IPPROTO_ESP);
  805. xfrm_proto_esp_failed:
  806. return err;
  807. }
  808. static void xfrmi6_fini(void)
  809. {
  810. #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
  811. xfrm6_tunnel_deregister(&xfrmi_ip6ip_handler, AF_INET);
  812. xfrm6_tunnel_deregister(&xfrmi_ipv6_handler, AF_INET6);
  813. #endif
  814. xfrm6_protocol_deregister(&xfrmi_ipcomp6_protocol, IPPROTO_COMP);
  815. xfrm6_protocol_deregister(&xfrmi_ah6_protocol, IPPROTO_AH);
  816. xfrm6_protocol_deregister(&xfrmi_esp6_protocol, IPPROTO_ESP);
  817. }
  818. static const struct xfrm_if_cb xfrm_if_cb = {
  819. .decode_session = xfrmi_decode_session,
  820. };
  821. static int __init xfrmi_init(void)
  822. {
  823. const char *msg;
  824. int err;
  825. pr_info("IPsec XFRM device driver\n");
  826. msg = "tunnel device";
  827. err = register_pernet_device(&xfrmi_net_ops);
  828. if (err < 0)
  829. goto pernet_dev_failed;
  830. msg = "xfrm4 protocols";
  831. err = xfrmi4_init();
  832. if (err < 0)
  833. goto xfrmi4_failed;
  834. msg = "xfrm6 protocols";
  835. err = xfrmi6_init();
  836. if (err < 0)
  837. goto xfrmi6_failed;
  838. msg = "netlink interface";
  839. err = rtnl_link_register(&xfrmi_link_ops);
  840. if (err < 0)
  841. goto rtnl_link_failed;
  842. xfrm_if_register_cb(&xfrm_if_cb);
  843. return err;
  844. rtnl_link_failed:
  845. xfrmi6_fini();
  846. xfrmi6_failed:
  847. xfrmi4_fini();
  848. xfrmi4_failed:
  849. unregister_pernet_device(&xfrmi_net_ops);
  850. pernet_dev_failed:
  851. pr_err("xfrmi init: failed to register %s\n", msg);
  852. return err;
  853. }
  854. static void __exit xfrmi_fini(void)
  855. {
  856. xfrm_if_unregister_cb();
  857. rtnl_link_unregister(&xfrmi_link_ops);
  858. xfrmi4_fini();
  859. xfrmi6_fini();
  860. unregister_pernet_device(&xfrmi_net_ops);
  861. }
  862. module_init(xfrmi_init);
  863. module_exit(xfrmi_fini);
  864. MODULE_LICENSE("GPL");
  865. MODULE_ALIAS_RTNL_LINK("xfrm");
  866. MODULE_ALIAS_NETDEV("xfrm0");
  867. MODULE_AUTHOR("Steffen Klassert");
  868. MODULE_DESCRIPTION("XFRM virtual interface");