Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm4_policy.c |
| 3 | * |
| 4 | * Changes: |
| 5 | * Kazunori MIYAZAWA @USAGI |
| 6 | * YOSHIFUJI Hideaki @USAGI |
| 7 | * Split up af-specific portion |
| 8 | * |
| 9 | */ |
| 10 | |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 11 | #include <linux/compiler.h> |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 12 | #include <linux/inetdevice.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 13 | #include <net/xfrm.h> |
| 14 | #include <net/ip.h> |
| 15 | |
| 16 | static struct dst_ops xfrm4_dst_ops; |
| 17 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo; |
| 18 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 19 | static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl) |
| 20 | { |
| 21 | return __ip_route_output_key((struct rtable**)dst, fl); |
| 22 | } |
| 23 | |
Patrick McHardy | a1e59ab | 2006-09-19 12:57:34 -0700 | [diff] [blame] | 24 | static int xfrm4_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr) |
| 25 | { |
| 26 | struct rtable *rt; |
| 27 | struct flowi fl_tunnel = { |
| 28 | .nl_u = { |
| 29 | .ip4_u = { |
| 30 | .daddr = daddr->a4, |
| 31 | }, |
| 32 | }, |
| 33 | }; |
| 34 | |
| 35 | if (!xfrm4_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) { |
| 36 | saddr->a4 = rt->rt_src; |
| 37 | dst_release(&rt->u.dst); |
| 38 | return 0; |
| 39 | } |
| 40 | return -EHOSTUNREACH; |
| 41 | } |
| 42 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 43 | static struct dst_entry * |
| 44 | __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy) |
| 45 | { |
| 46 | struct dst_entry *dst; |
| 47 | |
| 48 | read_lock_bh(&policy->lock); |
| 49 | for (dst = policy->bundles; dst; dst = dst->next) { |
| 50 | struct xfrm_dst *xdst = (struct xfrm_dst*)dst; |
| 51 | if (xdst->u.rt.fl.oif == fl->oif && /*XXX*/ |
| 52 | xdst->u.rt.fl.fl4_dst == fl->fl4_dst && |
| 53 | xdst->u.rt.fl.fl4_src == fl->fl4_src && |
Herbert Xu | 4da3089 | 2006-02-23 16:19:26 -0800 | [diff] [blame] | 54 | xdst->u.rt.fl.fl4_tos == fl->fl4_tos && |
Masahide NAKAMURA | e53820d | 2006-08-23 19:12:01 -0700 | [diff] [blame] | 55 | xfrm_bundle_ok(xdst, fl, AF_INET, 0)) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 56 | dst_clone(dst); |
| 57 | break; |
| 58 | } |
| 59 | } |
| 60 | read_unlock_bh(&policy->lock); |
| 61 | return dst; |
| 62 | } |
| 63 | |
| 64 | /* Allocate chain of dst_entry's, attach known xfrm's, calculate |
| 65 | * all the metrics... Shortly, bundle a bundle. |
| 66 | */ |
| 67 | |
| 68 | static int |
| 69 | __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx, |
| 70 | struct flowi *fl, struct dst_entry **dst_p) |
| 71 | { |
| 72 | struct dst_entry *dst, *dst_prev; |
| 73 | struct rtable *rt0 = (struct rtable*)(*dst_p); |
| 74 | struct rtable *rt = rt0; |
| 75 | u32 remote = fl->fl4_dst; |
| 76 | u32 local = fl->fl4_src; |
| 77 | struct flowi fl_tunnel = { |
| 78 | .nl_u = { |
| 79 | .ip4_u = { |
| 80 | .saddr = local, |
Herbert Xu | 4da3089 | 2006-02-23 16:19:26 -0800 | [diff] [blame] | 81 | .daddr = remote, |
| 82 | .tos = fl->fl4_tos |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 83 | } |
| 84 | } |
| 85 | }; |
| 86 | int i; |
| 87 | int err; |
| 88 | int header_len = 0; |
| 89 | int trailer_len = 0; |
| 90 | |
| 91 | dst = dst_prev = NULL; |
| 92 | dst_hold(&rt->u.dst); |
| 93 | |
| 94 | for (i = 0; i < nx; i++) { |
| 95 | struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops); |
| 96 | struct xfrm_dst *xdst; |
| 97 | int tunnel = 0; |
| 98 | |
| 99 | if (unlikely(dst1 == NULL)) { |
| 100 | err = -ENOBUFS; |
| 101 | dst_release(&rt->u.dst); |
| 102 | goto error; |
| 103 | } |
| 104 | |
| 105 | if (!dst) |
| 106 | dst = dst1; |
| 107 | else { |
| 108 | dst_prev->child = dst1; |
| 109 | dst1->flags |= DST_NOHASH; |
| 110 | dst_clone(dst1); |
| 111 | } |
| 112 | |
| 113 | xdst = (struct xfrm_dst *)dst1; |
| 114 | xdst->route = &rt->u.dst; |
David S. Miller | 9d4a706 | 2006-08-24 03:18:09 -0700 | [diff] [blame] | 115 | xdst->genid = xfrm[i]->genid; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 116 | |
| 117 | dst1->next = dst_prev; |
| 118 | dst_prev = dst1; |
Masahide NAKAMURA | 7e49e6d | 2006-09-22 15:05:15 -0700 | [diff] [blame] | 119 | if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 120 | remote = xfrm[i]->id.daddr.a4; |
| 121 | local = xfrm[i]->props.saddr.a4; |
| 122 | tunnel = 1; |
| 123 | } |
| 124 | header_len += xfrm[i]->props.header_len; |
| 125 | trailer_len += xfrm[i]->props.trailer_len; |
| 126 | |
| 127 | if (tunnel) { |
| 128 | fl_tunnel.fl4_src = local; |
| 129 | fl_tunnel.fl4_dst = remote; |
| 130 | err = xfrm_dst_lookup((struct xfrm_dst **)&rt, |
| 131 | &fl_tunnel, AF_INET); |
| 132 | if (err) |
| 133 | goto error; |
| 134 | } else |
| 135 | dst_hold(&rt->u.dst); |
| 136 | } |
| 137 | |
| 138 | dst_prev->child = &rt->u.dst; |
| 139 | dst->path = &rt->u.dst; |
| 140 | |
| 141 | *dst_p = dst; |
| 142 | dst = dst_prev; |
| 143 | |
| 144 | dst_prev = *dst_p; |
| 145 | i = 0; |
| 146 | for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) { |
| 147 | struct xfrm_dst *x = (struct xfrm_dst*)dst_prev; |
| 148 | x->u.rt.fl = *fl; |
| 149 | |
| 150 | dst_prev->xfrm = xfrm[i++]; |
| 151 | dst_prev->dev = rt->u.dst.dev; |
| 152 | if (rt->u.dst.dev) |
| 153 | dev_hold(rt->u.dst.dev); |
| 154 | dst_prev->obsolete = -1; |
| 155 | dst_prev->flags |= DST_HOST; |
| 156 | dst_prev->lastuse = jiffies; |
| 157 | dst_prev->header_len = header_len; |
Masahide NAKAMURA | 1b5c229 | 2006-08-23 18:11:50 -0700 | [diff] [blame] | 158 | dst_prev->nfheader_len = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 159 | dst_prev->trailer_len = trailer_len; |
| 160 | memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics)); |
| 161 | |
| 162 | /* Copy neighbout for reachability confirmation */ |
| 163 | dst_prev->neighbour = neigh_clone(rt->u.dst.neighbour); |
| 164 | dst_prev->input = rt->u.dst.input; |
| 165 | dst_prev->output = xfrm4_output; |
| 166 | if (rt->peer) |
| 167 | atomic_inc(&rt->peer->refcnt); |
| 168 | x->u.rt.peer = rt->peer; |
| 169 | /* Sheit... I remember I did this right. Apparently, |
| 170 | * it was magically lost, so this code needs audit */ |
| 171 | x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL); |
| 172 | x->u.rt.rt_type = rt->rt_type; |
| 173 | x->u.rt.rt_src = rt0->rt_src; |
| 174 | x->u.rt.rt_dst = rt0->rt_dst; |
| 175 | x->u.rt.rt_gateway = rt->rt_gateway; |
| 176 | x->u.rt.rt_spec_dst = rt0->rt_spec_dst; |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 177 | x->u.rt.idev = rt0->idev; |
| 178 | in_dev_hold(rt0->idev); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 179 | header_len -= x->u.dst.xfrm->props.header_len; |
| 180 | trailer_len -= x->u.dst.xfrm->props.trailer_len; |
| 181 | } |
| 182 | |
| 183 | xfrm_init_pmtu(dst); |
| 184 | return 0; |
| 185 | |
| 186 | error: |
| 187 | if (dst) |
| 188 | dst_free(dst); |
| 189 | return err; |
| 190 | } |
| 191 | |
| 192 | static void |
| 193 | _decode_session4(struct sk_buff *skb, struct flowi *fl) |
| 194 | { |
| 195 | struct iphdr *iph = skb->nh.iph; |
| 196 | u8 *xprth = skb->nh.raw + iph->ihl*4; |
| 197 | |
| 198 | memset(fl, 0, sizeof(struct flowi)); |
| 199 | if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) { |
| 200 | switch (iph->protocol) { |
| 201 | case IPPROTO_UDP: |
| 202 | case IPPROTO_TCP: |
| 203 | case IPPROTO_SCTP: |
Patrick McHardy | 9e99999 | 2005-12-19 14:03:46 -0800 | [diff] [blame] | 204 | case IPPROTO_DCCP: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 205 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { |
| 206 | u16 *ports = (u16 *)xprth; |
| 207 | |
| 208 | fl->fl_ip_sport = ports[0]; |
| 209 | fl->fl_ip_dport = ports[1]; |
| 210 | } |
| 211 | break; |
| 212 | |
| 213 | case IPPROTO_ICMP: |
| 214 | if (pskb_may_pull(skb, xprth + 2 - skb->data)) { |
| 215 | u8 *icmp = xprth; |
| 216 | |
| 217 | fl->fl_icmp_type = icmp[0]; |
| 218 | fl->fl_icmp_code = icmp[1]; |
| 219 | } |
| 220 | break; |
| 221 | |
| 222 | case IPPROTO_ESP: |
| 223 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { |
| 224 | u32 *ehdr = (u32 *)xprth; |
| 225 | |
| 226 | fl->fl_ipsec_spi = ehdr[0]; |
| 227 | } |
| 228 | break; |
| 229 | |
| 230 | case IPPROTO_AH: |
| 231 | if (pskb_may_pull(skb, xprth + 8 - skb->data)) { |
| 232 | u32 *ah_hdr = (u32*)xprth; |
| 233 | |
| 234 | fl->fl_ipsec_spi = ah_hdr[1]; |
| 235 | } |
| 236 | break; |
| 237 | |
| 238 | case IPPROTO_COMP: |
| 239 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { |
| 240 | u16 *ipcomp_hdr = (u16 *)xprth; |
| 241 | |
Alexey Dobriyan | 4195f81 | 2006-05-22 16:53:22 -0700 | [diff] [blame] | 242 | fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 243 | } |
| 244 | break; |
| 245 | default: |
| 246 | fl->fl_ipsec_spi = 0; |
| 247 | break; |
| 248 | }; |
| 249 | } |
| 250 | fl->proto = iph->protocol; |
| 251 | fl->fl4_dst = iph->daddr; |
| 252 | fl->fl4_src = iph->saddr; |
Herbert Xu | 4da3089 | 2006-02-23 16:19:26 -0800 | [diff] [blame] | 253 | fl->fl4_tos = iph->tos; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 254 | } |
| 255 | |
| 256 | static inline int xfrm4_garbage_collect(void) |
| 257 | { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 258 | xfrm4_policy_afinfo.garbage_collect(); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 259 | return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2); |
| 260 | } |
| 261 | |
| 262 | static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu) |
| 263 | { |
| 264 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
| 265 | struct dst_entry *path = xdst->route; |
| 266 | |
| 267 | path->ops->update_pmtu(path, mtu); |
| 268 | } |
| 269 | |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 270 | static void xfrm4_dst_destroy(struct dst_entry *dst) |
| 271 | { |
| 272 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
| 273 | |
| 274 | if (likely(xdst->u.rt.idev)) |
| 275 | in_dev_put(xdst->u.rt.idev); |
| 276 | xfrm_dst_destroy(xdst); |
| 277 | } |
| 278 | |
| 279 | static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, |
| 280 | int unregister) |
| 281 | { |
| 282 | struct xfrm_dst *xdst; |
| 283 | |
| 284 | if (!unregister) |
| 285 | return; |
| 286 | |
| 287 | xdst = (struct xfrm_dst *)dst; |
| 288 | if (xdst->u.rt.idev->dev == dev) { |
| 289 | struct in_device *loopback_idev = in_dev_get(&loopback_dev); |
| 290 | BUG_ON(!loopback_idev); |
| 291 | |
| 292 | do { |
| 293 | in_dev_put(xdst->u.rt.idev); |
| 294 | xdst->u.rt.idev = loopback_idev; |
| 295 | in_dev_hold(loopback_idev); |
| 296 | xdst = (struct xfrm_dst *)xdst->u.dst.child; |
| 297 | } while (xdst->u.dst.xfrm); |
| 298 | |
| 299 | __in_dev_put(loopback_idev); |
| 300 | } |
| 301 | |
| 302 | xfrm_dst_ifdown(dst, dev); |
| 303 | } |
| 304 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 305 | static struct dst_ops xfrm4_dst_ops = { |
| 306 | .family = AF_INET, |
| 307 | .protocol = __constant_htons(ETH_P_IP), |
| 308 | .gc = xfrm4_garbage_collect, |
| 309 | .update_pmtu = xfrm4_update_pmtu, |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 310 | .destroy = xfrm4_dst_destroy, |
| 311 | .ifdown = xfrm4_dst_ifdown, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 312 | .gc_thresh = 1024, |
| 313 | .entry_size = sizeof(struct xfrm_dst), |
| 314 | }; |
| 315 | |
| 316 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { |
| 317 | .family = AF_INET, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 318 | .dst_ops = &xfrm4_dst_ops, |
| 319 | .dst_lookup = xfrm4_dst_lookup, |
Patrick McHardy | a1e59ab | 2006-09-19 12:57:34 -0700 | [diff] [blame] | 320 | .get_saddr = xfrm4_get_saddr, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 321 | .find_bundle = __xfrm4_find_bundle, |
| 322 | .bundle_create = __xfrm4_bundle_create, |
| 323 | .decode_session = _decode_session4, |
| 324 | }; |
| 325 | |
| 326 | static void __init xfrm4_policy_init(void) |
| 327 | { |
| 328 | xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); |
| 329 | } |
| 330 | |
| 331 | static void __exit xfrm4_policy_fini(void) |
| 332 | { |
| 333 | xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo); |
| 334 | } |
| 335 | |
| 336 | void __init xfrm4_init(void) |
| 337 | { |
| 338 | xfrm4_state_init(); |
| 339 | xfrm4_policy_init(); |
| 340 | } |
| 341 | |