blob: e517981ceadd4f5a2fe170e7761668c1cb68cb12 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm4_policy.c
3 *
4 * Changes:
5 * Kazunori MIYAZAWA @USAGI
6 * YOSHIFUJI Hideaki @USAGI
7 * Split up af-specific portion
8 *
9 */
10
Herbert Xuaabc9762005-05-03 16:27:10 -070011#include <linux/compiler.h>
Herbert Xuaabc9762005-05-03 16:27:10 -070012#include <linux/inetdevice.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070013#include <net/xfrm.h>
14#include <net/ip.h>
15
16static struct dst_ops xfrm4_dst_ops;
17static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
18
Linus Torvalds1da177e2005-04-16 15:20:36 -070019static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
20{
21 return __ip_route_output_key((struct rtable**)dst, fl);
22}
23
24static struct dst_entry *
25__xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
26{
27 struct dst_entry *dst;
28
29 read_lock_bh(&policy->lock);
30 for (dst = policy->bundles; dst; dst = dst->next) {
31 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
32 if (xdst->u.rt.fl.oif == fl->oif && /*XXX*/
33 xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
34 xdst->u.rt.fl.fl4_src == fl->fl4_src &&
Herbert Xu4da30892006-02-23 16:19:26 -080035 xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
Linus Torvalds1da177e2005-04-16 15:20:36 -070036 xfrm_bundle_ok(xdst, fl, AF_INET)) {
37 dst_clone(dst);
38 break;
39 }
40 }
41 read_unlock_bh(&policy->lock);
42 return dst;
43}
44
45/* Allocate chain of dst_entry's, attach known xfrm's, calculate
46 * all the metrics... Shortly, bundle a bundle.
47 */
48
49static int
50__xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
51 struct flowi *fl, struct dst_entry **dst_p)
52{
53 struct dst_entry *dst, *dst_prev;
54 struct rtable *rt0 = (struct rtable*)(*dst_p);
55 struct rtable *rt = rt0;
56 u32 remote = fl->fl4_dst;
57 u32 local = fl->fl4_src;
58 struct flowi fl_tunnel = {
59 .nl_u = {
60 .ip4_u = {
61 .saddr = local,
Herbert Xu4da30892006-02-23 16:19:26 -080062 .daddr = remote,
63 .tos = fl->fl4_tos
Linus Torvalds1da177e2005-04-16 15:20:36 -070064 }
65 }
66 };
67 int i;
68 int err;
69 int header_len = 0;
70 int trailer_len = 0;
71
72 dst = dst_prev = NULL;
73 dst_hold(&rt->u.dst);
74
75 for (i = 0; i < nx; i++) {
76 struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);
77 struct xfrm_dst *xdst;
78 int tunnel = 0;
79
80 if (unlikely(dst1 == NULL)) {
81 err = -ENOBUFS;
82 dst_release(&rt->u.dst);
83 goto error;
84 }
85
86 if (!dst)
87 dst = dst1;
88 else {
89 dst_prev->child = dst1;
90 dst1->flags |= DST_NOHASH;
91 dst_clone(dst1);
92 }
93
94 xdst = (struct xfrm_dst *)dst1;
95 xdst->route = &rt->u.dst;
96
97 dst1->next = dst_prev;
98 dst_prev = dst1;
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -070099 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700100 remote = xfrm[i]->id.daddr.a4;
101 local = xfrm[i]->props.saddr.a4;
102 tunnel = 1;
103 }
104 header_len += xfrm[i]->props.header_len;
105 trailer_len += xfrm[i]->props.trailer_len;
106
107 if (tunnel) {
108 fl_tunnel.fl4_src = local;
109 fl_tunnel.fl4_dst = remote;
110 err = xfrm_dst_lookup((struct xfrm_dst **)&rt,
111 &fl_tunnel, AF_INET);
112 if (err)
113 goto error;
114 } else
115 dst_hold(&rt->u.dst);
116 }
117
118 dst_prev->child = &rt->u.dst;
119 dst->path = &rt->u.dst;
120
121 *dst_p = dst;
122 dst = dst_prev;
123
124 dst_prev = *dst_p;
125 i = 0;
126 for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
127 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
128 x->u.rt.fl = *fl;
129
130 dst_prev->xfrm = xfrm[i++];
131 dst_prev->dev = rt->u.dst.dev;
132 if (rt->u.dst.dev)
133 dev_hold(rt->u.dst.dev);
134 dst_prev->obsolete = -1;
135 dst_prev->flags |= DST_HOST;
136 dst_prev->lastuse = jiffies;
137 dst_prev->header_len = header_len;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700138 dst_prev->nfheader_len = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700139 dst_prev->trailer_len = trailer_len;
140 memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
141
142 /* Copy neighbout for reachability confirmation */
143 dst_prev->neighbour = neigh_clone(rt->u.dst.neighbour);
144 dst_prev->input = rt->u.dst.input;
145 dst_prev->output = xfrm4_output;
146 if (rt->peer)
147 atomic_inc(&rt->peer->refcnt);
148 x->u.rt.peer = rt->peer;
149 /* Sheit... I remember I did this right. Apparently,
150 * it was magically lost, so this code needs audit */
151 x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
152 x->u.rt.rt_type = rt->rt_type;
153 x->u.rt.rt_src = rt0->rt_src;
154 x->u.rt.rt_dst = rt0->rt_dst;
155 x->u.rt.rt_gateway = rt->rt_gateway;
156 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
Herbert Xuaabc9762005-05-03 16:27:10 -0700157 x->u.rt.idev = rt0->idev;
158 in_dev_hold(rt0->idev);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700159 header_len -= x->u.dst.xfrm->props.header_len;
160 trailer_len -= x->u.dst.xfrm->props.trailer_len;
161 }
162
163 xfrm_init_pmtu(dst);
164 return 0;
165
166error:
167 if (dst)
168 dst_free(dst);
169 return err;
170}
171
172static void
173_decode_session4(struct sk_buff *skb, struct flowi *fl)
174{
175 struct iphdr *iph = skb->nh.iph;
176 u8 *xprth = skb->nh.raw + iph->ihl*4;
177
178 memset(fl, 0, sizeof(struct flowi));
179 if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
180 switch (iph->protocol) {
181 case IPPROTO_UDP:
182 case IPPROTO_TCP:
183 case IPPROTO_SCTP:
Patrick McHardy9e999992005-12-19 14:03:46 -0800184 case IPPROTO_DCCP:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700185 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
186 u16 *ports = (u16 *)xprth;
187
188 fl->fl_ip_sport = ports[0];
189 fl->fl_ip_dport = ports[1];
190 }
191 break;
192
193 case IPPROTO_ICMP:
194 if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
195 u8 *icmp = xprth;
196
197 fl->fl_icmp_type = icmp[0];
198 fl->fl_icmp_code = icmp[1];
199 }
200 break;
201
202 case IPPROTO_ESP:
203 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
204 u32 *ehdr = (u32 *)xprth;
205
206 fl->fl_ipsec_spi = ehdr[0];
207 }
208 break;
209
210 case IPPROTO_AH:
211 if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
212 u32 *ah_hdr = (u32*)xprth;
213
214 fl->fl_ipsec_spi = ah_hdr[1];
215 }
216 break;
217
218 case IPPROTO_COMP:
219 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
220 u16 *ipcomp_hdr = (u16 *)xprth;
221
Alexey Dobriyan4195f812006-05-22 16:53:22 -0700222 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700223 }
224 break;
225 default:
226 fl->fl_ipsec_spi = 0;
227 break;
228 };
229 }
230 fl->proto = iph->protocol;
231 fl->fl4_dst = iph->daddr;
232 fl->fl4_src = iph->saddr;
Herbert Xu4da30892006-02-23 16:19:26 -0800233 fl->fl4_tos = iph->tos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234}
235
236static inline int xfrm4_garbage_collect(void)
237{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700238 xfrm4_policy_afinfo.garbage_collect();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700239 return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
240}
241
242static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
243{
244 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
245 struct dst_entry *path = xdst->route;
246
247 path->ops->update_pmtu(path, mtu);
248}
249
Herbert Xuaabc9762005-05-03 16:27:10 -0700250static void xfrm4_dst_destroy(struct dst_entry *dst)
251{
252 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
253
254 if (likely(xdst->u.rt.idev))
255 in_dev_put(xdst->u.rt.idev);
256 xfrm_dst_destroy(xdst);
257}
258
259static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
260 int unregister)
261{
262 struct xfrm_dst *xdst;
263
264 if (!unregister)
265 return;
266
267 xdst = (struct xfrm_dst *)dst;
268 if (xdst->u.rt.idev->dev == dev) {
269 struct in_device *loopback_idev = in_dev_get(&loopback_dev);
270 BUG_ON(!loopback_idev);
271
272 do {
273 in_dev_put(xdst->u.rt.idev);
274 xdst->u.rt.idev = loopback_idev;
275 in_dev_hold(loopback_idev);
276 xdst = (struct xfrm_dst *)xdst->u.dst.child;
277 } while (xdst->u.dst.xfrm);
278
279 __in_dev_put(loopback_idev);
280 }
281
282 xfrm_dst_ifdown(dst, dev);
283}
284
Linus Torvalds1da177e2005-04-16 15:20:36 -0700285static struct dst_ops xfrm4_dst_ops = {
286 .family = AF_INET,
287 .protocol = __constant_htons(ETH_P_IP),
288 .gc = xfrm4_garbage_collect,
289 .update_pmtu = xfrm4_update_pmtu,
Herbert Xuaabc9762005-05-03 16:27:10 -0700290 .destroy = xfrm4_dst_destroy,
291 .ifdown = xfrm4_dst_ifdown,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700292 .gc_thresh = 1024,
293 .entry_size = sizeof(struct xfrm_dst),
294};
295
296static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
297 .family = AF_INET,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700298 .dst_ops = &xfrm4_dst_ops,
299 .dst_lookup = xfrm4_dst_lookup,
300 .find_bundle = __xfrm4_find_bundle,
301 .bundle_create = __xfrm4_bundle_create,
302 .decode_session = _decode_session4,
303};
304
305static void __init xfrm4_policy_init(void)
306{
307 xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
308}
309
310static void __exit xfrm4_policy_fini(void)
311{
312 xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
313}
314
315void __init xfrm4_init(void)
316{
317 xfrm4_state_init();
318 xfrm4_policy_init();
319}
320