blob: d8c70b8efc24231358ab50a32f354b69064f7860 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm6_state.c: based on xfrm4_state.c
3 *
4 * Authors:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific portion
YOSHIFUJI Hideaki1ab14572007-02-09 23:24:49 +090011 *
Linus Torvalds1da177e2005-04-16 15:20:36 -070012 */
13
14#include <net/xfrm.h>
15#include <linux/pfkeyv2.h>
16#include <linux/ipsec.h>
Herbert Xu862b82c2007-11-13 21:43:11 -080017#include <linux/netfilter_ipv6.h>
Paul Gortmakerbc3b2d72011-07-15 11:47:34 -040018#include <linux/export.h>
Herbert Xu36cf9ac2007-11-13 21:40:52 -080019#include <net/dsfield.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020#include <net/ipv6.h>
Patrick McHardyee51b1b2006-01-13 14:34:36 -080021#include <net/addrconf.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070022
Linus Torvalds1da177e2005-04-16 15:20:36 -070023static void
David S. Miller73e5ebb2011-02-22 17:51:44 -080024__xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
Linus Torvalds1da177e2005-04-16 15:20:36 -070025{
David S. Miller7e1dc7b2011-03-12 02:42:11 -050026 const struct flowi6 *fl6 = &fl->u.ip6;
27
Linus Torvalds1da177e2005-04-16 15:20:36 -070028 /* Initialize temporary selector matching only
29 * to current session. */
Alexey Dobriyan4e3fd7a2011-11-21 03:39:03 +000030 *(struct in6_addr *)&sel->daddr = fl6->daddr;
31 *(struct in6_addr *)&sel->saddr = fl6->saddr;
David S. Miller7e1dc7b2011-03-12 02:42:11 -050032 sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
Thomas Egerer8444cf72010-09-20 11:11:38 -070033 sel->dport_mask = htons(0xffff);
David S. Miller7e1dc7b2011-03-12 02:42:11 -050034 sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
Thomas Egerer8444cf72010-09-20 11:11:38 -070035 sel->sport_mask = htons(0xffff);
36 sel->family = AF_INET6;
37 sel->prefixlen_d = 128;
38 sel->prefixlen_s = 128;
David S. Miller7e1dc7b2011-03-12 02:42:11 -050039 sel->proto = fl6->flowi6_proto;
40 sel->ifindex = fl6->flowi6_oif;
Thomas Egerer8444cf72010-09-20 11:11:38 -070041}
42
43static void
David S. Miller19bd6242011-02-24 00:07:20 -050044xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl,
45 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
Thomas Egerer8444cf72010-09-20 11:11:38 -070046{
Linus Torvalds1da177e2005-04-16 15:20:36 -070047 x->id = tmpl->id;
48 if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
49 memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
50 memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
51 if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
52 memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
Linus Torvalds1da177e2005-04-16 15:20:36 -070053 x->props.mode = tmpl->mode;
54 x->props.reqid = tmpl->reqid;
55 x->props.family = AF_INET6;
56}
57
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +090058/* distribution counting sort function for xfrm_state and xfrm_tmpl */
59static int
60__xfrm6_sort(void **dst, void **src, int n, int (*cmp)(void *p), int maxclass)
61{
62 int i;
63 int class[XFRM_MAX_DEPTH];
64 int count[maxclass];
65
66 memset(count, 0, sizeof(count));
67
68 for (i = 0; i < n; i++) {
69 int c;
70 class[i] = c = cmp(src[i]);
71 count[c]++;
72 }
73
74 for (i = 2; i < maxclass; i++)
75 count[i] += count[i - 1];
76
77 for (i = 0; i < n; i++) {
78 dst[count[class[i] - 1]++] = src[i];
Hannes Eder66da8c52009-02-21 23:37:10 -080079 src[i] = NULL;
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +090080 }
81
82 return 0;
83}
84
85/*
86 * Rule for xfrm_state:
87 *
88 * rule 1: select IPsec transport except AH
89 * rule 2: select MIPv6 RO or inbound trigger
90 * rule 3: select IPsec transport AH
91 * rule 4: select IPsec tunnel
92 * rule 5: others
93 */
94static int __xfrm6_state_sort_cmp(void *p)
95{
96 struct xfrm_state *v = p;
97
98 switch (v->props.mode) {
99 case XFRM_MODE_TRANSPORT:
100 if (v->id.proto != IPPROTO_AH)
101 return 1;
102 else
103 return 3;
Amerigo Wang07a93622012-10-29 16:23:10 +0000104#if IS_ENABLED(CONFIG_IPV6_MIP6)
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +0900105 case XFRM_MODE_ROUTEOPTIMIZATION:
106 case XFRM_MODE_IN_TRIGGER:
107 return 2;
108#endif
109 case XFRM_MODE_TUNNEL:
110 case XFRM_MODE_BEET:
111 return 4;
112 }
113 return 5;
114}
115
Masahide NAKAMURA58c949d2006-08-23 22:51:02 -0700116static int
117__xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
118{
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +0900119 return __xfrm6_sort((void **)dst, (void **)src, n,
120 __xfrm6_state_sort_cmp, 6);
121}
Masahide NAKAMURA58c949d2006-08-23 22:51:02 -0700122
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +0900123/*
124 * Rule for xfrm_tmpl:
125 *
126 * rule 1: select IPsec transport
127 * rule 2: select MIPv6 RO or inbound trigger
128 * rule 3: select IPsec tunnel
129 * rule 4: others
130 */
131static int __xfrm6_tmpl_sort_cmp(void *p)
132{
133 struct xfrm_tmpl *v = p;
134 switch (v->mode) {
135 case XFRM_MODE_TRANSPORT:
136 return 1;
Amerigo Wang07a93622012-10-29 16:23:10 +0000137#if IS_ENABLED(CONFIG_IPV6_MIP6)
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +0900138 case XFRM_MODE_ROUTEOPTIMIZATION:
139 case XFRM_MODE_IN_TRIGGER:
140 return 2;
Masahide NAKAMURA64d9fdd2006-08-23 22:54:07 -0700141#endif
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +0900142 case XFRM_MODE_TUNNEL:
143 case XFRM_MODE_BEET:
144 return 3;
Masahide NAKAMURA58c949d2006-08-23 22:51:02 -0700145 }
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +0900146 return 4;
Masahide NAKAMURA58c949d2006-08-23 22:51:02 -0700147}
148
149static int
150__xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
151{
YOSHIFUJI Hideaki3b6cdf92008-02-19 10:15:27 +0900152 return __xfrm6_sort((void **)dst, (void **)src, n,
153 __xfrm6_tmpl_sort_cmp, 5);
Masahide NAKAMURA58c949d2006-08-23 22:51:02 -0700154}
155
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800156int xfrm6_extract_header(struct sk_buff *skb)
157{
158 struct ipv6hdr *iph = ipv6_hdr(skb);
159
Herbert Xu732c8bd2008-03-26 16:51:09 -0700160 XFRM_MODE_SKB_CB(skb)->ihl = sizeof(*iph);
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800161 XFRM_MODE_SKB_CB(skb)->id = 0;
162 XFRM_MODE_SKB_CB(skb)->frag_off = htons(IP_DF);
163 XFRM_MODE_SKB_CB(skb)->tos = ipv6_get_dsfield(iph);
164 XFRM_MODE_SKB_CB(skb)->ttl = iph->hop_limit;
Herbert Xu732c8bd2008-03-26 16:51:09 -0700165 XFRM_MODE_SKB_CB(skb)->optlen = 0;
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800166 memcpy(XFRM_MODE_SKB_CB(skb)->flow_lbl, iph->flow_lbl,
167 sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
168
169 return 0;
170}
171
Linus Torvalds1da177e2005-04-16 15:20:36 -0700172static struct xfrm_state_afinfo xfrm6_state_afinfo = {
173 .family = AF_INET6,
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800174 .proto = IPPROTO_IPV6,
Herbert Xu227620e2007-11-13 21:41:28 -0800175 .eth_proto = htons(ETH_P_IPV6),
Herbert Xu17c2a422007-10-17 21:33:12 -0700176 .owner = THIS_MODULE,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700177 .init_tempsel = __xfrm6_init_tempsel,
Thomas Egerer8444cf72010-09-20 11:11:38 -0700178 .init_temprop = xfrm6_init_temprop,
Masahide NAKAMURA58c949d2006-08-23 22:51:02 -0700179 .tmpl_sort = __xfrm6_tmpl_sort,
180 .state_sort = __xfrm6_state_sort,
Miika Komucdca7262007-02-06 14:24:56 -0800181 .output = xfrm6_output,
Steffen Klassert43a4dea2011-05-09 19:36:38 +0000182 .output_finish = xfrm6_output_finish,
Herbert Xu227620e2007-11-13 21:41:28 -0800183 .extract_input = xfrm6_extract_input,
Herbert Xu36cf9ac2007-11-13 21:40:52 -0800184 .extract_output = xfrm6_extract_output,
Herbert Xu716062f2007-11-13 21:44:23 -0800185 .transport_finish = xfrm6_transport_finish,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700186};
187
Daniel Lezcano0013cab2007-12-07 00:42:11 -0800188int __init xfrm6_state_init(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700189{
Daniel Lezcano0013cab2007-12-07 00:42:11 -0800190 return xfrm_state_register_afinfo(&xfrm6_state_afinfo);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700191}
192
193void xfrm6_state_fini(void)
194{
195 xfrm_state_unregister_afinfo(&xfrm6_state_afinfo);
196}
197