blob: fb9f69c616f5c3dbf43af6db14a8178aba46419b [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm4_policy.c
3 *
4 * Changes:
5 * Kazunori MIYAZAWA @USAGI
6 * YOSHIFUJI Hideaki @USAGI
7 * Split up af-specific portion
8 *
9 */
10
Herbert Xuaabc9762005-05-03 16:27:10 -070011#include <linux/compiler.h>
Herbert Xuaabc9762005-05-03 16:27:10 -070012#include <linux/inetdevice.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070013#include <net/xfrm.h>
14#include <net/ip.h>
15
16static struct dst_ops xfrm4_dst_ops;
17static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
18
Linus Torvalds1da177e2005-04-16 15:20:36 -070019static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
20{
21 return __ip_route_output_key((struct rtable**)dst, fl);
22}
23
Patrick McHardya1e59ab2006-09-19 12:57:34 -070024static int xfrm4_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
25{
26 struct rtable *rt;
27 struct flowi fl_tunnel = {
28 .nl_u = {
29 .ip4_u = {
30 .daddr = daddr->a4,
31 },
32 },
33 };
34
35 if (!xfrm4_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
36 saddr->a4 = rt->rt_src;
37 dst_release(&rt->u.dst);
38 return 0;
39 }
40 return -EHOSTUNREACH;
41}
42
Linus Torvalds1da177e2005-04-16 15:20:36 -070043static struct dst_entry *
44__xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
45{
46 struct dst_entry *dst;
47
48 read_lock_bh(&policy->lock);
49 for (dst = policy->bundles; dst; dst = dst->next) {
50 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
51 if (xdst->u.rt.fl.oif == fl->oif && /*XXX*/
52 xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
53 xdst->u.rt.fl.fl4_src == fl->fl4_src &&
Herbert Xu4da30892006-02-23 16:19:26 -080054 xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
Venkat Yekkirala5b368e62006-10-05 15:42:18 -050055 xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -070056 dst_clone(dst);
57 break;
58 }
59 }
60 read_unlock_bh(&policy->lock);
61 return dst;
62}
63
64/* Allocate chain of dst_entry's, attach known xfrm's, calculate
65 * all the metrics... Shortly, bundle a bundle.
66 */
67
68static int
69__xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
70 struct flowi *fl, struct dst_entry **dst_p)
71{
72 struct dst_entry *dst, *dst_prev;
73 struct rtable *rt0 = (struct rtable*)(*dst_p);
74 struct rtable *rt = rt0;
Al Viro8c689a62006-11-08 00:20:21 -080075 __be32 remote = fl->fl4_dst;
76 __be32 local = fl->fl4_src;
Linus Torvalds1da177e2005-04-16 15:20:36 -070077 struct flowi fl_tunnel = {
78 .nl_u = {
79 .ip4_u = {
80 .saddr = local,
Herbert Xu4da30892006-02-23 16:19:26 -080081 .daddr = remote,
82 .tos = fl->fl4_tos
Linus Torvalds1da177e2005-04-16 15:20:36 -070083 }
84 }
85 };
86 int i;
87 int err;
88 int header_len = 0;
89 int trailer_len = 0;
90
91 dst = dst_prev = NULL;
92 dst_hold(&rt->u.dst);
93
94 for (i = 0; i < nx; i++) {
95 struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);
96 struct xfrm_dst *xdst;
97 int tunnel = 0;
98
99 if (unlikely(dst1 == NULL)) {
100 err = -ENOBUFS;
101 dst_release(&rt->u.dst);
102 goto error;
103 }
104
105 if (!dst)
106 dst = dst1;
107 else {
108 dst_prev->child = dst1;
109 dst1->flags |= DST_NOHASH;
110 dst_clone(dst1);
111 }
112
113 xdst = (struct xfrm_dst *)dst1;
114 xdst->route = &rt->u.dst;
David S. Miller9d4a7062006-08-24 03:18:09 -0700115 xdst->genid = xfrm[i]->genid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116
117 dst1->next = dst_prev;
118 dst_prev = dst1;
Masahide NAKAMURA7e49e6d2006-09-22 15:05:15 -0700119 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700120 remote = xfrm[i]->id.daddr.a4;
121 local = xfrm[i]->props.saddr.a4;
122 tunnel = 1;
123 }
124 header_len += xfrm[i]->props.header_len;
125 trailer_len += xfrm[i]->props.trailer_len;
126
127 if (tunnel) {
128 fl_tunnel.fl4_src = local;
129 fl_tunnel.fl4_dst = remote;
130 err = xfrm_dst_lookup((struct xfrm_dst **)&rt,
131 &fl_tunnel, AF_INET);
132 if (err)
133 goto error;
134 } else
135 dst_hold(&rt->u.dst);
136 }
137
138 dst_prev->child = &rt->u.dst;
139 dst->path = &rt->u.dst;
140
141 *dst_p = dst;
142 dst = dst_prev;
143
144 dst_prev = *dst_p;
145 i = 0;
146 for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
147 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
148 x->u.rt.fl = *fl;
149
150 dst_prev->xfrm = xfrm[i++];
151 dst_prev->dev = rt->u.dst.dev;
152 if (rt->u.dst.dev)
153 dev_hold(rt->u.dst.dev);
154 dst_prev->obsolete = -1;
155 dst_prev->flags |= DST_HOST;
156 dst_prev->lastuse = jiffies;
157 dst_prev->header_len = header_len;
Masahide NAKAMURA1b5c2292006-08-23 18:11:50 -0700158 dst_prev->nfheader_len = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700159 dst_prev->trailer_len = trailer_len;
160 memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
161
162 /* Copy neighbout for reachability confirmation */
163 dst_prev->neighbour = neigh_clone(rt->u.dst.neighbour);
164 dst_prev->input = rt->u.dst.input;
165 dst_prev->output = xfrm4_output;
166 if (rt->peer)
167 atomic_inc(&rt->peer->refcnt);
168 x->u.rt.peer = rt->peer;
169 /* Sheit... I remember I did this right. Apparently,
170 * it was magically lost, so this code needs audit */
171 x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
172 x->u.rt.rt_type = rt->rt_type;
173 x->u.rt.rt_src = rt0->rt_src;
174 x->u.rt.rt_dst = rt0->rt_dst;
175 x->u.rt.rt_gateway = rt->rt_gateway;
176 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
Herbert Xuaabc9762005-05-03 16:27:10 -0700177 x->u.rt.idev = rt0->idev;
178 in_dev_hold(rt0->idev);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179 header_len -= x->u.dst.xfrm->props.header_len;
180 trailer_len -= x->u.dst.xfrm->props.trailer_len;
181 }
182
183 xfrm_init_pmtu(dst);
184 return 0;
185
186error:
187 if (dst)
188 dst_free(dst);
189 return err;
190}
191
192static void
193_decode_session4(struct sk_buff *skb, struct flowi *fl)
194{
195 struct iphdr *iph = skb->nh.iph;
196 u8 *xprth = skb->nh.raw + iph->ihl*4;
197
198 memset(fl, 0, sizeof(struct flowi));
199 if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
200 switch (iph->protocol) {
201 case IPPROTO_UDP:
Gerrit Renkerba4e58e2006-11-27 11:10:57 -0800202 case IPPROTO_UDPLITE:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700203 case IPPROTO_TCP:
204 case IPPROTO_SCTP:
Patrick McHardy9e999992005-12-19 14:03:46 -0800205 case IPPROTO_DCCP:
Linus Torvalds1da177e2005-04-16 15:20:36 -0700206 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
Al Viro8c689a62006-11-08 00:20:21 -0800207 __be16 *ports = (__be16 *)xprth;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208
209 fl->fl_ip_sport = ports[0];
210 fl->fl_ip_dport = ports[1];
211 }
212 break;
213
214 case IPPROTO_ICMP:
215 if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
216 u8 *icmp = xprth;
217
218 fl->fl_icmp_type = icmp[0];
219 fl->fl_icmp_code = icmp[1];
220 }
221 break;
222
223 case IPPROTO_ESP:
224 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
Al Viro4324a172006-09-27 18:49:07 -0700225 __be32 *ehdr = (__be32 *)xprth;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700226
227 fl->fl_ipsec_spi = ehdr[0];
228 }
229 break;
230
231 case IPPROTO_AH:
232 if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
Al Viro4324a172006-09-27 18:49:07 -0700233 __be32 *ah_hdr = (__be32*)xprth;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700234
235 fl->fl_ipsec_spi = ah_hdr[1];
236 }
237 break;
238
239 case IPPROTO_COMP:
240 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
Al Viro4324a172006-09-27 18:49:07 -0700241 __be16 *ipcomp_hdr = (__be16 *)xprth;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242
Alexey Dobriyan4195f812006-05-22 16:53:22 -0700243 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700244 }
245 break;
246 default:
247 fl->fl_ipsec_spi = 0;
248 break;
249 };
250 }
251 fl->proto = iph->protocol;
252 fl->fl4_dst = iph->daddr;
253 fl->fl4_src = iph->saddr;
Herbert Xu4da30892006-02-23 16:19:26 -0800254 fl->fl4_tos = iph->tos;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700255}
256
257static inline int xfrm4_garbage_collect(void)
258{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700259 xfrm4_policy_afinfo.garbage_collect();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
261}
262
263static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
264{
265 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
266 struct dst_entry *path = xdst->route;
267
268 path->ops->update_pmtu(path, mtu);
269}
270
Herbert Xuaabc9762005-05-03 16:27:10 -0700271static void xfrm4_dst_destroy(struct dst_entry *dst)
272{
273 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
274
275 if (likely(xdst->u.rt.idev))
276 in_dev_put(xdst->u.rt.idev);
David S. Miller26db1672006-12-06 23:45:15 -0800277 if (likely(xdst->u.rt.peer))
278 inet_putpeer(xdst->u.rt.peer);
Herbert Xuaabc9762005-05-03 16:27:10 -0700279 xfrm_dst_destroy(xdst);
280}
281
282static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
283 int unregister)
284{
285 struct xfrm_dst *xdst;
286
287 if (!unregister)
288 return;
289
290 xdst = (struct xfrm_dst *)dst;
291 if (xdst->u.rt.idev->dev == dev) {
292 struct in_device *loopback_idev = in_dev_get(&loopback_dev);
293 BUG_ON(!loopback_idev);
294
295 do {
296 in_dev_put(xdst->u.rt.idev);
297 xdst->u.rt.idev = loopback_idev;
298 in_dev_hold(loopback_idev);
299 xdst = (struct xfrm_dst *)xdst->u.dst.child;
300 } while (xdst->u.dst.xfrm);
301
302 __in_dev_put(loopback_idev);
303 }
304
305 xfrm_dst_ifdown(dst, dev);
306}
307
Linus Torvalds1da177e2005-04-16 15:20:36 -0700308static struct dst_ops xfrm4_dst_ops = {
309 .family = AF_INET,
310 .protocol = __constant_htons(ETH_P_IP),
311 .gc = xfrm4_garbage_collect,
312 .update_pmtu = xfrm4_update_pmtu,
Herbert Xuaabc9762005-05-03 16:27:10 -0700313 .destroy = xfrm4_dst_destroy,
314 .ifdown = xfrm4_dst_ifdown,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700315 .gc_thresh = 1024,
316 .entry_size = sizeof(struct xfrm_dst),
317};
318
319static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
320 .family = AF_INET,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700321 .dst_ops = &xfrm4_dst_ops,
322 .dst_lookup = xfrm4_dst_lookup,
Patrick McHardya1e59ab2006-09-19 12:57:34 -0700323 .get_saddr = xfrm4_get_saddr,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700324 .find_bundle = __xfrm4_find_bundle,
325 .bundle_create = __xfrm4_bundle_create,
326 .decode_session = _decode_session4,
327};
328
329static void __init xfrm4_policy_init(void)
330{
331 xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
332}
333
334static void __exit xfrm4_policy_fini(void)
335{
336 xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
337}
338
339void __init xfrm4_init(void)
340{
341 xfrm4_state_init();
342 xfrm4_policy_init();
343}
344