blob: 7fe2afd2e66954237f4d23a8bc35ea42392c34bf [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm4_policy.c
3 *
4 * Changes:
5 * Kazunori MIYAZAWA @USAGI
6 * YOSHIFUJI Hideaki @USAGI
7 * Split up af-specific portion
8 *
9 */
10
11#include <linux/config.h>
12#include <net/xfrm.h>
13#include <net/ip.h>
14
15static struct dst_ops xfrm4_dst_ops;
16static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
17
18static struct xfrm_type_map xfrm4_type_map = { .lock = RW_LOCK_UNLOCKED };
19
20static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
21{
22 return __ip_route_output_key((struct rtable**)dst, fl);
23}
24
25static struct dst_entry *
26__xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
27{
28 struct dst_entry *dst;
29
30 read_lock_bh(&policy->lock);
31 for (dst = policy->bundles; dst; dst = dst->next) {
32 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
33 if (xdst->u.rt.fl.oif == fl->oif && /*XXX*/
34 xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
35 xdst->u.rt.fl.fl4_src == fl->fl4_src &&
36 xfrm_bundle_ok(xdst, fl, AF_INET)) {
37 dst_clone(dst);
38 break;
39 }
40 }
41 read_unlock_bh(&policy->lock);
42 return dst;
43}
44
45/* Allocate chain of dst_entry's, attach known xfrm's, calculate
46 * all the metrics... Shortly, bundle a bundle.
47 */
48
49static int
50__xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
51 struct flowi *fl, struct dst_entry **dst_p)
52{
53 struct dst_entry *dst, *dst_prev;
54 struct rtable *rt0 = (struct rtable*)(*dst_p);
55 struct rtable *rt = rt0;
56 u32 remote = fl->fl4_dst;
57 u32 local = fl->fl4_src;
58 struct flowi fl_tunnel = {
59 .nl_u = {
60 .ip4_u = {
61 .saddr = local,
62 .daddr = remote
63 }
64 }
65 };
66 int i;
67 int err;
68 int header_len = 0;
69 int trailer_len = 0;
70
71 dst = dst_prev = NULL;
72 dst_hold(&rt->u.dst);
73
74 for (i = 0; i < nx; i++) {
75 struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);
76 struct xfrm_dst *xdst;
77 int tunnel = 0;
78
79 if (unlikely(dst1 == NULL)) {
80 err = -ENOBUFS;
81 dst_release(&rt->u.dst);
82 goto error;
83 }
84
85 if (!dst)
86 dst = dst1;
87 else {
88 dst_prev->child = dst1;
89 dst1->flags |= DST_NOHASH;
90 dst_clone(dst1);
91 }
92
93 xdst = (struct xfrm_dst *)dst1;
94 xdst->route = &rt->u.dst;
95
96 dst1->next = dst_prev;
97 dst_prev = dst1;
98 if (xfrm[i]->props.mode) {
99 remote = xfrm[i]->id.daddr.a4;
100 local = xfrm[i]->props.saddr.a4;
101 tunnel = 1;
102 }
103 header_len += xfrm[i]->props.header_len;
104 trailer_len += xfrm[i]->props.trailer_len;
105
106 if (tunnel) {
107 fl_tunnel.fl4_src = local;
108 fl_tunnel.fl4_dst = remote;
109 err = xfrm_dst_lookup((struct xfrm_dst **)&rt,
110 &fl_tunnel, AF_INET);
111 if (err)
112 goto error;
113 } else
114 dst_hold(&rt->u.dst);
115 }
116
117 dst_prev->child = &rt->u.dst;
118 dst->path = &rt->u.dst;
119
120 *dst_p = dst;
121 dst = dst_prev;
122
123 dst_prev = *dst_p;
124 i = 0;
125 for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
126 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
127 x->u.rt.fl = *fl;
128
129 dst_prev->xfrm = xfrm[i++];
130 dst_prev->dev = rt->u.dst.dev;
131 if (rt->u.dst.dev)
132 dev_hold(rt->u.dst.dev);
133 dst_prev->obsolete = -1;
134 dst_prev->flags |= DST_HOST;
135 dst_prev->lastuse = jiffies;
136 dst_prev->header_len = header_len;
137 dst_prev->trailer_len = trailer_len;
138 memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
139
140 /* Copy neighbout for reachability confirmation */
141 dst_prev->neighbour = neigh_clone(rt->u.dst.neighbour);
142 dst_prev->input = rt->u.dst.input;
143 dst_prev->output = xfrm4_output;
144 if (rt->peer)
145 atomic_inc(&rt->peer->refcnt);
146 x->u.rt.peer = rt->peer;
147 /* Sheit... I remember I did this right. Apparently,
148 * it was magically lost, so this code needs audit */
149 x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
150 x->u.rt.rt_type = rt->rt_type;
151 x->u.rt.rt_src = rt0->rt_src;
152 x->u.rt.rt_dst = rt0->rt_dst;
153 x->u.rt.rt_gateway = rt->rt_gateway;
154 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
155 header_len -= x->u.dst.xfrm->props.header_len;
156 trailer_len -= x->u.dst.xfrm->props.trailer_len;
157 }
158
159 xfrm_init_pmtu(dst);
160 return 0;
161
162error:
163 if (dst)
164 dst_free(dst);
165 return err;
166}
167
168static void
169_decode_session4(struct sk_buff *skb, struct flowi *fl)
170{
171 struct iphdr *iph = skb->nh.iph;
172 u8 *xprth = skb->nh.raw + iph->ihl*4;
173
174 memset(fl, 0, sizeof(struct flowi));
175 if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
176 switch (iph->protocol) {
177 case IPPROTO_UDP:
178 case IPPROTO_TCP:
179 case IPPROTO_SCTP:
180 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
181 u16 *ports = (u16 *)xprth;
182
183 fl->fl_ip_sport = ports[0];
184 fl->fl_ip_dport = ports[1];
185 }
186 break;
187
188 case IPPROTO_ICMP:
189 if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
190 u8 *icmp = xprth;
191
192 fl->fl_icmp_type = icmp[0];
193 fl->fl_icmp_code = icmp[1];
194 }
195 break;
196
197 case IPPROTO_ESP:
198 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
199 u32 *ehdr = (u32 *)xprth;
200
201 fl->fl_ipsec_spi = ehdr[0];
202 }
203 break;
204
205 case IPPROTO_AH:
206 if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
207 u32 *ah_hdr = (u32*)xprth;
208
209 fl->fl_ipsec_spi = ah_hdr[1];
210 }
211 break;
212
213 case IPPROTO_COMP:
214 if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
215 u16 *ipcomp_hdr = (u16 *)xprth;
216
217 fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1]));
218 }
219 break;
220 default:
221 fl->fl_ipsec_spi = 0;
222 break;
223 };
224 }
225 fl->proto = iph->protocol;
226 fl->fl4_dst = iph->daddr;
227 fl->fl4_src = iph->saddr;
228}
229
230static inline int xfrm4_garbage_collect(void)
231{
232 read_lock(&xfrm4_policy_afinfo.lock);
233 xfrm4_policy_afinfo.garbage_collect();
234 read_unlock(&xfrm4_policy_afinfo.lock);
235 return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
236}
237
238static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
239{
240 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
241 struct dst_entry *path = xdst->route;
242
243 path->ops->update_pmtu(path, mtu);
244}
245
246static struct dst_ops xfrm4_dst_ops = {
247 .family = AF_INET,
248 .protocol = __constant_htons(ETH_P_IP),
249 .gc = xfrm4_garbage_collect,
250 .update_pmtu = xfrm4_update_pmtu,
251 .gc_thresh = 1024,
252 .entry_size = sizeof(struct xfrm_dst),
253};
254
255static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
256 .family = AF_INET,
257 .lock = RW_LOCK_UNLOCKED,
258 .type_map = &xfrm4_type_map,
259 .dst_ops = &xfrm4_dst_ops,
260 .dst_lookup = xfrm4_dst_lookup,
261 .find_bundle = __xfrm4_find_bundle,
262 .bundle_create = __xfrm4_bundle_create,
263 .decode_session = _decode_session4,
264};
265
266static void __init xfrm4_policy_init(void)
267{
268 xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
269}
270
271static void __exit xfrm4_policy_fini(void)
272{
273 xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
274}
275
276void __init xfrm4_init(void)
277{
278 xfrm4_state_init();
279 xfrm4_policy_init();
280}
281