Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm4_policy.c |
| 3 | * |
| 4 | * Changes: |
| 5 | * Kazunori MIYAZAWA @USAGI |
| 6 | * YOSHIFUJI Hideaki @USAGI |
| 7 | * Split up af-specific portion |
| 8 | * |
| 9 | */ |
| 10 | |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 11 | #include <asm/bug.h> |
| 12 | #include <linux/compiler.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 13 | #include <linux/config.h> |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 14 | #include <linux/inetdevice.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 15 | #include <net/xfrm.h> |
| 16 | #include <net/ip.h> |
| 17 | |
| 18 | static struct dst_ops xfrm4_dst_ops; |
| 19 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo; |
| 20 | |
| 21 | static struct xfrm_type_map xfrm4_type_map = { .lock = RW_LOCK_UNLOCKED }; |
| 22 | |
| 23 | static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl) |
| 24 | { |
| 25 | return __ip_route_output_key((struct rtable**)dst, fl); |
| 26 | } |
| 27 | |
| 28 | static struct dst_entry * |
| 29 | __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy) |
| 30 | { |
| 31 | struct dst_entry *dst; |
| 32 | |
| 33 | read_lock_bh(&policy->lock); |
| 34 | for (dst = policy->bundles; dst; dst = dst->next) { |
| 35 | struct xfrm_dst *xdst = (struct xfrm_dst*)dst; |
| 36 | if (xdst->u.rt.fl.oif == fl->oif && /*XXX*/ |
| 37 | xdst->u.rt.fl.fl4_dst == fl->fl4_dst && |
| 38 | xdst->u.rt.fl.fl4_src == fl->fl4_src && |
| 39 | xfrm_bundle_ok(xdst, fl, AF_INET)) { |
| 40 | dst_clone(dst); |
| 41 | break; |
| 42 | } |
| 43 | } |
| 44 | read_unlock_bh(&policy->lock); |
| 45 | return dst; |
| 46 | } |
| 47 | |
| 48 | /* Allocate chain of dst_entry's, attach known xfrm's, calculate |
| 49 | * all the metrics... Shortly, bundle a bundle. |
| 50 | */ |
| 51 | |
| 52 | static int |
| 53 | __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx, |
| 54 | struct flowi *fl, struct dst_entry **dst_p) |
| 55 | { |
| 56 | struct dst_entry *dst, *dst_prev; |
| 57 | struct rtable *rt0 = (struct rtable*)(*dst_p); |
| 58 | struct rtable *rt = rt0; |
| 59 | u32 remote = fl->fl4_dst; |
| 60 | u32 local = fl->fl4_src; |
| 61 | struct flowi fl_tunnel = { |
| 62 | .nl_u = { |
| 63 | .ip4_u = { |
| 64 | .saddr = local, |
| 65 | .daddr = remote |
| 66 | } |
| 67 | } |
| 68 | }; |
| 69 | int i; |
| 70 | int err; |
| 71 | int header_len = 0; |
| 72 | int trailer_len = 0; |
| 73 | |
| 74 | dst = dst_prev = NULL; |
| 75 | dst_hold(&rt->u.dst); |
| 76 | |
| 77 | for (i = 0; i < nx; i++) { |
| 78 | struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops); |
| 79 | struct xfrm_dst *xdst; |
| 80 | int tunnel = 0; |
| 81 | |
| 82 | if (unlikely(dst1 == NULL)) { |
| 83 | err = -ENOBUFS; |
| 84 | dst_release(&rt->u.dst); |
| 85 | goto error; |
| 86 | } |
| 87 | |
| 88 | if (!dst) |
| 89 | dst = dst1; |
| 90 | else { |
| 91 | dst_prev->child = dst1; |
| 92 | dst1->flags |= DST_NOHASH; |
| 93 | dst_clone(dst1); |
| 94 | } |
| 95 | |
| 96 | xdst = (struct xfrm_dst *)dst1; |
| 97 | xdst->route = &rt->u.dst; |
| 98 | |
| 99 | dst1->next = dst_prev; |
| 100 | dst_prev = dst1; |
| 101 | if (xfrm[i]->props.mode) { |
| 102 | remote = xfrm[i]->id.daddr.a4; |
| 103 | local = xfrm[i]->props.saddr.a4; |
| 104 | tunnel = 1; |
| 105 | } |
| 106 | header_len += xfrm[i]->props.header_len; |
| 107 | trailer_len += xfrm[i]->props.trailer_len; |
| 108 | |
| 109 | if (tunnel) { |
| 110 | fl_tunnel.fl4_src = local; |
| 111 | fl_tunnel.fl4_dst = remote; |
| 112 | err = xfrm_dst_lookup((struct xfrm_dst **)&rt, |
| 113 | &fl_tunnel, AF_INET); |
| 114 | if (err) |
| 115 | goto error; |
| 116 | } else |
| 117 | dst_hold(&rt->u.dst); |
| 118 | } |
| 119 | |
| 120 | dst_prev->child = &rt->u.dst; |
| 121 | dst->path = &rt->u.dst; |
| 122 | |
| 123 | *dst_p = dst; |
| 124 | dst = dst_prev; |
| 125 | |
| 126 | dst_prev = *dst_p; |
| 127 | i = 0; |
| 128 | for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) { |
| 129 | struct xfrm_dst *x = (struct xfrm_dst*)dst_prev; |
| 130 | x->u.rt.fl = *fl; |
| 131 | |
| 132 | dst_prev->xfrm = xfrm[i++]; |
| 133 | dst_prev->dev = rt->u.dst.dev; |
| 134 | if (rt->u.dst.dev) |
| 135 | dev_hold(rt->u.dst.dev); |
| 136 | dst_prev->obsolete = -1; |
| 137 | dst_prev->flags |= DST_HOST; |
| 138 | dst_prev->lastuse = jiffies; |
| 139 | dst_prev->header_len = header_len; |
| 140 | dst_prev->trailer_len = trailer_len; |
| 141 | memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics)); |
| 142 | |
| 143 | /* Copy neighbout for reachability confirmation */ |
| 144 | dst_prev->neighbour = neigh_clone(rt->u.dst.neighbour); |
| 145 | dst_prev->input = rt->u.dst.input; |
| 146 | dst_prev->output = xfrm4_output; |
| 147 | if (rt->peer) |
| 148 | atomic_inc(&rt->peer->refcnt); |
| 149 | x->u.rt.peer = rt->peer; |
| 150 | /* Sheit... I remember I did this right. Apparently, |
| 151 | * it was magically lost, so this code needs audit */ |
| 152 | x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL); |
| 153 | x->u.rt.rt_type = rt->rt_type; |
| 154 | x->u.rt.rt_src = rt0->rt_src; |
| 155 | x->u.rt.rt_dst = rt0->rt_dst; |
| 156 | x->u.rt.rt_gateway = rt->rt_gateway; |
| 157 | x->u.rt.rt_spec_dst = rt0->rt_spec_dst; |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 158 | x->u.rt.idev = rt0->idev; |
| 159 | in_dev_hold(rt0->idev); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 160 | header_len -= x->u.dst.xfrm->props.header_len; |
| 161 | trailer_len -= x->u.dst.xfrm->props.trailer_len; |
| 162 | } |
| 163 | |
| 164 | xfrm_init_pmtu(dst); |
| 165 | return 0; |
| 166 | |
| 167 | error: |
| 168 | if (dst) |
| 169 | dst_free(dst); |
| 170 | return err; |
| 171 | } |
| 172 | |
| 173 | static void |
| 174 | _decode_session4(struct sk_buff *skb, struct flowi *fl) |
| 175 | { |
| 176 | struct iphdr *iph = skb->nh.iph; |
| 177 | u8 *xprth = skb->nh.raw + iph->ihl*4; |
| 178 | |
| 179 | memset(fl, 0, sizeof(struct flowi)); |
| 180 | if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) { |
| 181 | switch (iph->protocol) { |
| 182 | case IPPROTO_UDP: |
| 183 | case IPPROTO_TCP: |
| 184 | case IPPROTO_SCTP: |
Patrick McHardy | 9e99999 | 2005-12-19 14:03:46 -0800 | [diff] [blame] | 185 | case IPPROTO_DCCP: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 186 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { |
| 187 | u16 *ports = (u16 *)xprth; |
| 188 | |
| 189 | fl->fl_ip_sport = ports[0]; |
| 190 | fl->fl_ip_dport = ports[1]; |
| 191 | } |
| 192 | break; |
| 193 | |
| 194 | case IPPROTO_ICMP: |
| 195 | if (pskb_may_pull(skb, xprth + 2 - skb->data)) { |
| 196 | u8 *icmp = xprth; |
| 197 | |
| 198 | fl->fl_icmp_type = icmp[0]; |
| 199 | fl->fl_icmp_code = icmp[1]; |
| 200 | } |
| 201 | break; |
| 202 | |
| 203 | case IPPROTO_ESP: |
| 204 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { |
| 205 | u32 *ehdr = (u32 *)xprth; |
| 206 | |
| 207 | fl->fl_ipsec_spi = ehdr[0]; |
| 208 | } |
| 209 | break; |
| 210 | |
| 211 | case IPPROTO_AH: |
| 212 | if (pskb_may_pull(skb, xprth + 8 - skb->data)) { |
| 213 | u32 *ah_hdr = (u32*)xprth; |
| 214 | |
| 215 | fl->fl_ipsec_spi = ah_hdr[1]; |
| 216 | } |
| 217 | break; |
| 218 | |
| 219 | case IPPROTO_COMP: |
| 220 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { |
| 221 | u16 *ipcomp_hdr = (u16 *)xprth; |
| 222 | |
| 223 | fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1])); |
| 224 | } |
| 225 | break; |
| 226 | default: |
| 227 | fl->fl_ipsec_spi = 0; |
| 228 | break; |
| 229 | }; |
| 230 | } |
| 231 | fl->proto = iph->protocol; |
| 232 | fl->fl4_dst = iph->daddr; |
| 233 | fl->fl4_src = iph->saddr; |
| 234 | } |
| 235 | |
| 236 | static inline int xfrm4_garbage_collect(void) |
| 237 | { |
| 238 | read_lock(&xfrm4_policy_afinfo.lock); |
| 239 | xfrm4_policy_afinfo.garbage_collect(); |
| 240 | read_unlock(&xfrm4_policy_afinfo.lock); |
| 241 | return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2); |
| 242 | } |
| 243 | |
| 244 | static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu) |
| 245 | { |
| 246 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
| 247 | struct dst_entry *path = xdst->route; |
| 248 | |
| 249 | path->ops->update_pmtu(path, mtu); |
| 250 | } |
| 251 | |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 252 | static void xfrm4_dst_destroy(struct dst_entry *dst) |
| 253 | { |
| 254 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
| 255 | |
| 256 | if (likely(xdst->u.rt.idev)) |
| 257 | in_dev_put(xdst->u.rt.idev); |
| 258 | xfrm_dst_destroy(xdst); |
| 259 | } |
| 260 | |
| 261 | static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, |
| 262 | int unregister) |
| 263 | { |
| 264 | struct xfrm_dst *xdst; |
| 265 | |
| 266 | if (!unregister) |
| 267 | return; |
| 268 | |
| 269 | xdst = (struct xfrm_dst *)dst; |
| 270 | if (xdst->u.rt.idev->dev == dev) { |
| 271 | struct in_device *loopback_idev = in_dev_get(&loopback_dev); |
| 272 | BUG_ON(!loopback_idev); |
| 273 | |
| 274 | do { |
| 275 | in_dev_put(xdst->u.rt.idev); |
| 276 | xdst->u.rt.idev = loopback_idev; |
| 277 | in_dev_hold(loopback_idev); |
| 278 | xdst = (struct xfrm_dst *)xdst->u.dst.child; |
| 279 | } while (xdst->u.dst.xfrm); |
| 280 | |
| 281 | __in_dev_put(loopback_idev); |
| 282 | } |
| 283 | |
| 284 | xfrm_dst_ifdown(dst, dev); |
| 285 | } |
| 286 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 287 | static struct dst_ops xfrm4_dst_ops = { |
| 288 | .family = AF_INET, |
| 289 | .protocol = __constant_htons(ETH_P_IP), |
| 290 | .gc = xfrm4_garbage_collect, |
| 291 | .update_pmtu = xfrm4_update_pmtu, |
Herbert Xu | aabc976 | 2005-05-03 16:27:10 -0700 | [diff] [blame] | 292 | .destroy = xfrm4_dst_destroy, |
| 293 | .ifdown = xfrm4_dst_ifdown, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 294 | .gc_thresh = 1024, |
| 295 | .entry_size = sizeof(struct xfrm_dst), |
| 296 | }; |
| 297 | |
| 298 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { |
| 299 | .family = AF_INET, |
| 300 | .lock = RW_LOCK_UNLOCKED, |
| 301 | .type_map = &xfrm4_type_map, |
| 302 | .dst_ops = &xfrm4_dst_ops, |
| 303 | .dst_lookup = xfrm4_dst_lookup, |
| 304 | .find_bundle = __xfrm4_find_bundle, |
| 305 | .bundle_create = __xfrm4_bundle_create, |
| 306 | .decode_session = _decode_session4, |
| 307 | }; |
| 308 | |
| 309 | static void __init xfrm4_policy_init(void) |
| 310 | { |
| 311 | xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); |
| 312 | } |
| 313 | |
| 314 | static void __exit xfrm4_policy_fini(void) |
| 315 | { |
| 316 | xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo); |
| 317 | } |
| 318 | |
| 319 | void __init xfrm4_init(void) |
| 320 | { |
| 321 | xfrm4_state_init(); |
| 322 | xfrm4_policy_init(); |
| 323 | } |
| 324 | |