net/ipv4/xfrm4_policy.c

   1 /*
   2  * xfrm4_policy.c
   3  *
   4  * Changes:
   5  *      Kazunori MIYAZAWA @USAGI
   6  *      YOSHIFUJI Hideaki @USAGI
   7  *              Split up af-specific portion
   8  *
   9  */
  10
  11 #include <linux/compiler.h>
  12 #include <linux/inetdevice.h>
  13 #include <net/dst.h>
  14 #include <net/xfrm.h>
  15 #include <net/ip.h>
  16
  17 static struct dst_ops xfrm4_dst_ops;
  18 static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
  19
  20 static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
  21 {
  22         return __ip_route_output_key((struct rtable**)dst, fl);
  23 }
  24
  25 static int xfrm4_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
  26 {
  27         struct rtable *rt;
  28         struct flowi fl_tunnel = {
  29                 .nl_u = {
  30                         .ip4_u = {
  31                                 .daddr = daddr->a4,
  32                         },
  33                 },
  34         };
  35
  36         if (!xfrm4_dst_lookup((struct xfrm_dst **)&rt, &fl_tunnel)) {
  37                 saddr->a4 = rt->rt_src;
  38                 dst_release(&rt->u.dst);
  39                 return 0;
  40         }
  41         return -EHOSTUNREACH;
  42 }
  43
  44 static struct dst_entry *
  45 __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
  46 {
  47         struct dst_entry *dst;
  48
  49         read_lock_bh(&policy->lock);
  50         for (dst = policy->bundles; dst; dst = dst->next) {
  51                 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
  52                 if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
  53                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
  54                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
  55                     xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
  56                     xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
  57                         dst_clone(dst);
  58                         break;
  59                 }
  60         }
  61         read_unlock_bh(&policy->lock);
  62         return dst;
  63 }
  64
  65 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
  66  * all the metrics... Shortly, bundle a bundle.
  67  */
  68
  69 static int
  70 __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
  71                       struct flowi *fl, struct dst_entry **dst_p)
  72 {
  73         struct dst_entry *dst, *dst_prev;
  74         struct rtable *rt0 = (struct rtable*)(*dst_p);
  75         struct rtable *rt = rt0;
  76         struct flowi fl_tunnel = {
  77                 .nl_u = {
  78                         .ip4_u = {
  79                                 .saddr = fl->fl4_src,
  80                                 .daddr = fl->fl4_dst,
  81                                 .tos = fl->fl4_tos
  82                         }
  83                 }
  84         };
  85         int i;
  86         int err;
  87         int header_len = 0;
  88         int trailer_len = 0;
  89
  90         dst = dst_prev = NULL;
  91         dst_hold(&rt->u.dst);
  92
  93         for (i = 0; i < nx; i++) {
  94                 struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);
  95                 struct xfrm_dst *xdst;
  96
  97                 if (unlikely(dst1 == NULL)) {
  98                         err = -ENOBUFS;
  99                         dst_release(&rt->u.dst);
 100                         goto error;
 101                 }
 102
 103                 if (!dst)
 104                         dst = dst1;
 105                 else {
 106                         dst_prev->child = dst1;
 107                         dst1->flags |= DST_NOHASH;
 108                         dst_clone(dst1);
 109                 }
 110
 111                 xdst = (struct xfrm_dst *)dst1;
 112                 xdst->route = &rt->u.dst;
 113                 xdst->genid = xfrm[i]->genid;
 114
 115                 dst1->next = dst_prev;
 116                 dst_prev = dst1;
 117
 118                 header_len += xfrm[i]->props.header_len;
 119                 trailer_len += xfrm[i]->props.trailer_len;
 120
 121                 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
 122                         unsigned short encap_family = xfrm[i]->props.family;
 123                         switch (encap_family) {
 124                         case AF_INET:
 125                                 fl_tunnel.fl4_dst = xfrm[i]->id.daddr.a4;
 126                                 fl_tunnel.fl4_src = xfrm[i]->props.saddr.a4;
 127                                 break;
 128 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 129                         case AF_INET6:
 130                                 ipv6_addr_copy(&fl_tunnel.fl6_dst, (struct in6_addr*)&xfrm[i]->id.daddr.a6);
 131                                 ipv6_addr_copy(&fl_tunnel.fl6_src, (struct in6_addr*)&xfrm[i]->props.saddr.a6);
 132                                 break;
 133 #endif
 134                         default:
 135                                 BUG_ON(1);
 136                         }
 137                         err = xfrm_dst_lookup((struct xfrm_dst **)&rt,
 138                                               &fl_tunnel, encap_family);
 139                         if (err)
 140                                 goto error;
 141                 } else
 142                         dst_hold(&rt->u.dst);
 143         }
 144
 145         dst_prev->child = &rt->u.dst;
 146         dst->path = &rt->u.dst;
 147
 148         /* Copy neighbout for reachability confirmation */
 149         dst->neighbour = neigh_clone(rt->u.dst.neighbour);
 150
 151         *dst_p = dst;
 152         dst = dst_prev;
 153
 154         dst_prev = *dst_p;
 155         i = 0;
 156         for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
 157                 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
 158                 x->u.rt.fl = *fl;
 159
 160                 dst_prev->xfrm = xfrm[i++];
 161                 dst_prev->dev = rt->u.dst.dev;
 162                 if (rt->u.dst.dev)
 163                         dev_hold(rt->u.dst.dev);
 164                 dst_prev->obsolete      = -1;
 165                 dst_prev->flags        |= DST_HOST;
 166                 dst_prev->lastuse       = jiffies;
 167                 dst_prev->header_len    = header_len;
 168                 dst_prev->trailer_len   = trailer_len;
 169                 memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
 170
 171                 dst_prev->input = dst_discard;
 172                 dst_prev->output = dst_prev->xfrm->outer_mode->afinfo->output;
 173                 if (rt0->peer)
 174                         atomic_inc(&rt0->peer->refcnt);
 175                 x->u.rt.peer = rt0->peer;
 176                 /* Sheit... I remember I did this right. Apparently,
 177                  * it was magically lost, so this code needs audit */
 178                 x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
 179                 x->u.rt.rt_type = rt0->rt_type;
 180                 x->u.rt.rt_src = rt0->rt_src;
 181                 x->u.rt.rt_dst = rt0->rt_dst;
 182                 x->u.rt.rt_gateway = rt0->rt_gateway;
 183                 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
 184                 x->u.rt.idev = rt0->idev;
 185                 in_dev_hold(rt0->idev);
 186                 header_len -= x->u.dst.xfrm->props.header_len;
 187                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
 188         }
 189
 190         xfrm_init_pmtu(dst);
 191         return 0;
 192
 193 error:
 194         if (dst)
 195                 dst_free(dst);
 196         return err;
 197 }
 198
 199 static void
 200 _decode_session4(struct sk_buff *skb, struct flowi *fl)
 201 {
 202         struct iphdr *iph = ip_hdr(skb);
 203         u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
 204
 205         memset(fl, 0, sizeof(struct flowi));
 206         if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
 207                 switch (iph->protocol) {
 208                 case IPPROTO_UDP:
 209                 case IPPROTO_UDPLITE:
 210                 case IPPROTO_TCP:
 211                 case IPPROTO_SCTP:
 212                 case IPPROTO_DCCP:
 213                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
 214                                 __be16 *ports = (__be16 *)xprth;
 215
 216                                 fl->fl_ip_sport = ports[0];
 217                                 fl->fl_ip_dport = ports[1];
 218                         }
 219                         break;
 220
 221                 case IPPROTO_ICMP:
 222                         if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
 223                                 u8 *icmp = xprth;
 224
 225                                 fl->fl_icmp_type = icmp[0];
 226                                 fl->fl_icmp_code = icmp[1];
 227                         }
 228                         break;
 229
 230                 case IPPROTO_ESP:
 231                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
 232                                 __be32 *ehdr = (__be32 *)xprth;
 233
 234                                 fl->fl_ipsec_spi = ehdr[0];
 235                         }
 236                         break;
 237
 238                 case IPPROTO_AH:
 239                         if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
 240                                 __be32 *ah_hdr = (__be32*)xprth;
 241
 242                                 fl->fl_ipsec_spi = ah_hdr[1];
 243                         }
 244                         break;
 245
 246                 case IPPROTO_COMP:
 247                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
 248                                 __be16 *ipcomp_hdr = (__be16 *)xprth;
 249
 250                                 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
 251                         }
 252                         break;
 253                 default:
 254                         fl->fl_ipsec_spi = 0;
 255                         break;
 256                 }
 257         }
 258         fl->proto = iph->protocol;
 259         fl->fl4_dst = iph->daddr;
 260         fl->fl4_src = iph->saddr;
 261         fl->fl4_tos = iph->tos;
 262 }
 263
 264 static inline int xfrm4_garbage_collect(void)
 265 {
 266         xfrm4_policy_afinfo.garbage_collect();
 267         return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
 268 }
 269
 270 static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
 271 {
 272         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 273         struct dst_entry *path = xdst->route;
 274
 275         path->ops->update_pmtu(path, mtu);
 276 }
 277
 278 static void xfrm4_dst_destroy(struct dst_entry *dst)
 279 {
 280         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
 281
 282         if (likely(xdst->u.rt.idev))
 283                 in_dev_put(xdst->u.rt.idev);
 284         if (likely(xdst->u.rt.peer))
 285                 inet_putpeer(xdst->u.rt.peer);
 286         xfrm_dst_destroy(xdst);
 287 }
 288
 289 static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 290                              int unregister)
 291 {
 292         struct xfrm_dst *xdst;
 293
 294         if (!unregister)
 295                 return;
 296
 297         xdst = (struct xfrm_dst *)dst;
 298         if (xdst->u.rt.idev->dev == dev) {
 299                 struct in_device *loopback_idev = in_dev_get(init_net.loopback_dev);
 300                 BUG_ON(!loopback_idev);
 301
 302                 do {
 303                         in_dev_put(xdst->u.rt.idev);
 304                         xdst->u.rt.idev = loopback_idev;
 305                         in_dev_hold(loopback_idev);
 306                         xdst = (struct xfrm_dst *)xdst->u.dst.child;
 307                 } while (xdst->u.dst.xfrm);
 308
 309                 __in_dev_put(loopback_idev);
 310         }
 311
 312         xfrm_dst_ifdown(dst, dev);
 313 }
 314
 315 static struct dst_ops xfrm4_dst_ops = {
 316         .family =               AF_INET,
 317         .protocol =             __constant_htons(ETH_P_IP),
 318         .gc =                   xfrm4_garbage_collect,
 319         .update_pmtu =          xfrm4_update_pmtu,
 320         .destroy =              xfrm4_dst_destroy,
 321         .ifdown =               xfrm4_dst_ifdown,
 322         .gc_thresh =            1024,
 323         .entry_size =           sizeof(struct xfrm_dst),
 324 };
 325
 326 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
 327         .family =               AF_INET,
 328         .dst_ops =              &xfrm4_dst_ops,
 329         .dst_lookup =           xfrm4_dst_lookup,
 330         .get_saddr =            xfrm4_get_saddr,
 331         .find_bundle =          __xfrm4_find_bundle,
 332         .bundle_create =        __xfrm4_bundle_create,
 333         .decode_session =       _decode_session4,
 334 };
 335
 336 static void __init xfrm4_policy_init(void)
 337 {
 338         xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
 339 }
 340
 341 static void __exit xfrm4_policy_fini(void)
 342 {
 343         xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
 344 }
 345
 346 void __init xfrm4_init(void)
 347 {
 348         xfrm4_state_init();
 349         xfrm4_policy_init();
 350 }
 351