net/ipv4/xfrm4_policy.c

   1 /*
   2  * xfrm4_policy.c
   3  *
   4  * Changes:
   5  *      Kazunori MIYAZAWA @USAGI
   6  *      YOSHIFUJI Hideaki @USAGI
   7  *              Split up af-specific portion
   8  *
   9  */
  10
  11 #include <linux/compiler.h>
  12 #include <linux/inetdevice.h>
  13 #include <net/dst.h>
  14 #include <net/xfrm.h>
  15 #include <net/ip.h>
  16
  17 static struct dst_ops xfrm4_dst_ops;
  18 static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
  19
  20 static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
  21 {
  22         return __ip_route_output_key((struct rtable**)dst, fl);
  23 }
  24
  25 static int xfrm4_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
  26 {
  27         struct rtable *rt;
  28         struct flowi fl_tunnel = {
  29                 .nl_u = {
  30                         .ip4_u = {
  31                                 .daddr = daddr->a4,
  32                         },
  33                 },
  34         };
  35
  36         if (!xfrm4_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
  37                 saddr->a4 = rt->rt_src;
  38                 dst_release(&rt->u.dst);
  39                 return 0;
  40         }
  41         return -EHOSTUNREACH;
  42 }
  43
  44 static struct dst_entry *
  45 __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
  46 {
  47         struct dst_entry *dst;
  48
  49         read_lock_bh(&policy->lock);
  50         for (dst = policy->bundles; dst; dst = dst->next) {
  51                 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
  52                 if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
  53                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
  54                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
  55                     xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
  56                     xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
  57                         dst_clone(dst);
  58                         break;
  59                 }
  60         }
  61         read_unlock_bh(&policy->lock);
  62         return dst;
  63 }
  64
  65 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
  66  * all the metrics... Shortly, bundle a bundle.
  67  */
  68
  69 static int
  70 __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
  71                       struct flowi *fl, struct dst_entry **dst_p)
  72 {
  73         struct dst_entry *dst, *dst_prev;
  74         struct rtable *rt0 = (struct rtable*)(*dst_p);
  75         struct rtable *rt = rt0;
  76         struct flowi fl_tunnel = {
  77                 .nl_u = {
  78                         .ip4_u = {
  79                                 .saddr = fl->fl4_src,
  80                                 .daddr = fl->fl4_dst,
  81                                 .tos = fl->fl4_tos
  82                         }
  83                 }
  84         };
  85         int i;
  86         int err;
  87         int header_len = 0;
  88         int trailer_len = 0;
  89
  90         dst = dst_prev = NULL;
  91         dst_hold(&rt->u.dst);
  92
  93         for (i = 0; i < nx; i++) {
  94                 struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);
  95                 struct xfrm_dst *xdst;
  96
  97                 if (unlikely(dst1 == NULL)) {
  98                         err = -ENOBUFS;
  99                         dst_release(&rt->u.dst);
 100                         goto error;
 101                 }
 102
 103                 if (!dst)
 104                         dst = dst1;
 105                 else {
 106                         dst_prev->child = dst1;
 107                         dst1->flags |= DST_NOHASH;
 108                         dst_clone(dst1);
 109                 }
 110
 111                 xdst = (struct xfrm_dst *)dst1;
 112                 xdst->route = &rt->u.dst;
 113                 xdst->genid = xfrm[i]->genid;
 114
 115                 dst1->next = dst_prev;
 116                 dst_prev = dst1;
 117
 118                 header_len += xfrm[i]->props.header_len;
 119                 trailer_len += xfrm[i]->props.trailer_len;
 120
 121                 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
 122                         unsigned short encap_family = xfrm[i]->props.family;
 123                         switch (encap_family) {
 124                         case AF_INET:
 125                                 fl_tunnel.fl4_dst = xfrm[i]->id.daddr.a4;
 126                                 fl_tunnel.fl4_src = xfrm[i]->props.saddr.a4;
 127                                 break;
 128 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 129                         case AF_INET6:
 130                                 ipv6_addr_copy(&fl_tunnel.fl6_dst, (struct in6_addr*)&xfrm[i]->id.daddr.a6);
 131                                 ipv6_addr_copy(&fl_tunnel.fl6_src, (struct in6_addr*)&xfrm[i]->props.saddr.a6);
 132                                 break;
 133 #endif
 134                         default:
 135                                 BUG_ON(1);
 136                         }
 137                         err = xfrm_dst_lookup((struct xfrm_dst **)&rt,
 138                                               &fl_tunnel, encap_family);
 139                         if (err)
 140                                 goto error;
 141                 } else
 142                         dst_hold(&rt->u.dst);
 143         }
 144
 145         dst_prev->child = &rt->u.dst;
 146         dst->path = &rt->u.dst;
 147
 148         /* Copy neighbout for reachability confirmation */
 149         dst->neighbour = neigh_clone(rt->u.dst.neighbour);
 150
 151         *dst_p = dst;
 152         dst = dst_prev;
 153
 154         dst_prev = *dst_p;
 155         i = 0;
 156         err = -ENODEV;
 157         for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
 158                 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
 159                 x->u.rt.fl = *fl;
 160
 161                 dst_prev->xfrm = xfrm[i++];
 162                 dst_prev->dev = rt->u.dst.dev;
 163                 if (!rt->u.dst.dev)
 164                         goto error;
 165                 dev_hold(rt->u.dst.dev);
 166
 167                 x->u.rt.idev = in_dev_get(rt->u.dst.dev);
 168                 if (!x->u.rt.idev)
 169                         goto error;
 170
 171                 dst_prev->obsolete      = -1;
 172                 dst_prev->flags        |= DST_HOST;
 173                 dst_prev->lastuse       = jiffies;
 174                 dst_prev->header_len    = header_len;
 175                 dst_prev->trailer_len   = trailer_len;
 176                 memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
 177
 178                 dst_prev->input = dst_discard;
 179                 dst_prev->output = dst_prev->xfrm->outer_mode->afinfo->output;
 180                 if (rt0->peer)
 181                         atomic_inc(&rt0->peer->refcnt);
 182                 x->u.rt.peer = rt0->peer;
 183                 /* Sheit... I remember I did this right. Apparently,
 184                  * it was magically lost, so this code needs audit */
 185                 x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
 186                 x->u.rt.rt_type = rt0->rt_type;
 187                 x->u.rt.rt_src = rt0->rt_src;
 188                 x->u.rt.rt_dst = rt0->rt_dst;
 189                 x->u.rt.rt_gateway = rt0->rt_gateway;
 190                 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
 191                 header_len -= x->u.dst.xfrm->props.header_len;
 192                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
 193         }
 194
 195         xfrm_init_pmtu(dst);
 196         return 0;
 197
 198 error:
 199         if (dst)
 200                 dst_free(dst);
 201         return err;
 202 }
 203
 204 static void
 205 _decode_session4(struct sk_buff *skb, struct flowi *fl)
 206 {
 207         struct iphdr *iph = ip_hdr(skb);
 208         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
 209
 210         memset(fl, 0, sizeof(struct flowi));
 211         if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
 212                 switch (iph->protocol) {
 213                 case IPPROTO_UDP:
 214                 case IPPROTO_UDPLITE:
 215                 case IPPROTO_TCP:
 216                 case IPPROTO_SCTP:
 217                 case IPPROTO_DCCP:
 218                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
 219                                 __be16 *ports = (__be16 *)xprth;
 220
 221                                 fl->fl_ip_sport = ports[0];
 222                                 fl->fl_ip_dport = ports[1];
 223                         }
 224                         break;
 225
 226                 case IPPROTO_ICMP:
 227                         if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
 228                                 u8 *icmp = xprth;
 229
 230                                 fl->fl_icmp_type = icmp[0];
 231                                 fl->fl_icmp_code = icmp[1];
 232                         }
 233                         break;
 234
 235                 case IPPROTO_ESP:
 236                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
 237                                 __be32 *ehdr = (__be32 *)xprth;
 238
 239                                 fl->fl_ipsec_spi = ehdr[0];
 240                         }
 241                         break;
 242
 243                 case IPPROTO_AH:
 244                         if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
 245                                 __be32 *ah_hdr = (__be32*)xprth;
 246
 247                                 fl->fl_ipsec_spi = ah_hdr[1];
 248                         }
 249                         break;
 250
 251                 case IPPROTO_COMP:
 252                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
 253                                 __be16 *ipcomp_hdr = (__be16 *)xprth;
 254
 255                                 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
 256                         }
 257                         break;
 258                 default:
 259                         fl->fl_ipsec_spi = 0;
 260                         break;
 261                 }
 262         }
 263         fl->proto = iph->protocol;
 264         fl->fl4_dst = iph->daddr;
 265         fl->fl4_src = iph->saddr;
 266         fl->fl4_tos = iph->tos;
 267 }
 268
 269 static inline int xfrm4_garbage_collect(void)
 270 {
 271         xfrm4_policy_afinfo.garbage_collect();
 272         return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
 273 }
 274
 275 static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
 276 {
 277         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 278         struct dst_entry *path = xdst->route;
 279
 280         path->ops->update_pmtu(path, mtu);
 281 }
 282
 283 static void xfrm4_dst_destroy(struct dst_entry *dst)
 284 {
 285         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 286
 287         if (likely(xdst->u.rt.idev))
 288                 in_dev_put(xdst->u.rt.idev);
 289         if (likely(xdst->u.rt.peer))
 290                 inet_putpeer(xdst->u.rt.peer);
 291         xfrm_dst_destroy(xdst);
 292 }
 293
 294 static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 295                              int unregister)
 296 {
 297         struct xfrm_dst *xdst;
 298
 299         if (!unregister)
 300                 return;
 301
 302         xdst = (struct xfrm_dst *)dst;
 303         if (xdst->u.rt.idev->dev == dev) {
 304                 struct in_device *loopback_idev = in_dev_get(init_net.loopback_dev);
 305                 BUG_ON(!loopback_idev);
 306
 307                 do {
 308                         in_dev_put(xdst->u.rt.idev);
 309                         xdst->u.rt.idev = loopback_idev;
 310                         in_dev_hold(loopback_idev);
 311                         xdst = (struct xfrm_dst *)xdst->u.dst.child;
 312                 } while (xdst->u.dst.xfrm);
 313
 314                 __in_dev_put(loopback_idev);
 315         }
 316
 317         xfrm_dst_ifdown(dst, dev);
 318 }
 319
 320 static struct dst_ops xfrm4_dst_ops = {
 321         .family =               AF_INET,
 322         .protocol =             __constant_htons(ETH_P_IP),
 323         .gc =                   xfrm4_garbage_collect,
 324         .update_pmtu =          xfrm4_update_pmtu,
 325         .destroy =              xfrm4_dst_destroy,
 326         .ifdown =               xfrm4_dst_ifdown,
 327         .gc_thresh =            1024,
 328         .entry_size =           sizeof(struct xfrm_dst),
 329 };
 330
 331 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
 332         .family =               AF_INET,
 333         .dst_ops =              &xfrm4_dst_ops,
 334         .dst_lookup =           xfrm4_dst_lookup,
 335         .get_saddr =            xfrm4_get_saddr,
 336         .find_bundle =          __xfrm4_find_bundle,
 337         .bundle_create =        __xfrm4_bundle_create,
 338         .decode_session =       _decode_session4,
 339 };
 340
 341 static void __init xfrm4_policy_init(void)
 342 {
 343         xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
 344 }
 345
 346 static void __exit xfrm4_policy_fini(void)
 347 {
 348         xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
 349 }
 350
 351 void __init xfrm4_init(void)
 352 {
 353         xfrm4_state_init();
 354         xfrm4_policy_init();
 355 }
 356