2 * xfrm6_policy.c: based on xfrm4_policy.c
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
10 * Split up af-specific portion
14 #include <linux/err.h>
15 #include <linux/kernel.h>
16 #include <linux/netdevice.h>
17 #include <net/addrconf.h>
22 #include <net/ip6_route.h>
23 #if IS_ENABLED(CONFIG_IPV6_MIP6)
27 static struct xfrm_policy_afinfo xfrm6_policy_afinfo
;
29 static struct dst_entry
*xfrm6_dst_lookup(struct net
*net
, int tos
,
30 const xfrm_address_t
*saddr
,
31 const xfrm_address_t
*daddr
)
34 struct dst_entry
*dst
;
37 memset(&fl6
, 0, sizeof(fl6
));
38 memcpy(&fl6
.daddr
, daddr
, sizeof(fl6
.daddr
));
40 memcpy(&fl6
.saddr
, saddr
, sizeof(fl6
.saddr
));
42 dst
= ip6_route_output(net
, NULL
, &fl6
);
53 static int xfrm6_get_saddr(struct net
*net
,
54 xfrm_address_t
*saddr
, xfrm_address_t
*daddr
)
56 struct dst_entry
*dst
;
57 struct net_device
*dev
;
59 dst
= xfrm6_dst_lookup(net
, 0, NULL
, daddr
);
63 dev
= ip6_dst_idev(dst
)->dev
;
64 ipv6_dev_get_saddr(dev_net(dev
), dev
,
65 (struct in6_addr
*)&daddr
->a6
, 0,
66 (struct in6_addr
*)&saddr
->a6
);
71 static int xfrm6_get_tos(const struct flowi
*fl
)
76 static void xfrm6_init_dst(struct net
*net
, struct xfrm_dst
*xdst
)
78 struct rt6_info
*rt
= (struct rt6_info
*)xdst
;
80 rt6_init_peer(rt
, net
->ipv6
.peers
);
83 static int xfrm6_init_path(struct xfrm_dst
*path
, struct dst_entry
*dst
,
86 if (dst
->ops
->family
== AF_INET6
) {
87 struct rt6_info
*rt
= (struct rt6_info
*)dst
;
89 path
->path_cookie
= rt
->rt6i_node
->fn_sernum
;
92 path
->u
.rt6
.rt6i_nfheader_len
= nfheader_len
;
97 static int xfrm6_fill_dst(struct xfrm_dst
*xdst
, struct net_device
*dev
,
98 const struct flowi
*fl
)
100 struct rt6_info
*rt
= (struct rt6_info
*)xdst
->route
;
102 xdst
->u
.dst
.dev
= dev
;
105 xdst
->u
.rt6
.rt6i_idev
= in6_dev_get(dev
);
106 if (!xdst
->u
.rt6
.rt6i_idev
) {
111 rt6_transfer_peer(&xdst
->u
.rt6
, rt
);
113 /* Sheit... I remember I did this right. Apparently,
114 * it was magically lost, so this code needs audit */
115 xdst
->u
.rt6
.rt6i_flags
= rt
->rt6i_flags
& (RTF_ANYCAST
|
117 xdst
->u
.rt6
.rt6i_metric
= rt
->rt6i_metric
;
118 xdst
->u
.rt6
.rt6i_node
= rt
->rt6i_node
;
120 xdst
->route_cookie
= rt
->rt6i_node
->fn_sernum
;
121 xdst
->u
.rt6
.rt6i_gateway
= rt
->rt6i_gateway
;
122 xdst
->u
.rt6
.rt6i_dst
= rt
->rt6i_dst
;
123 xdst
->u
.rt6
.rt6i_src
= rt
->rt6i_src
;
129 _decode_session6(struct sk_buff
*skb
, struct flowi
*fl
, int reverse
)
131 struct flowi6
*fl6
= &fl
->u
.ip6
;
133 const struct ipv6hdr
*hdr
= ipv6_hdr(skb
);
134 u16 offset
= sizeof(*hdr
);
135 struct ipv6_opt_hdr
*exthdr
;
136 const unsigned char *nh
= skb_network_header(skb
);
137 u16 nhoff
= IP6CB(skb
)->nhoff
;
142 nhoff
= offsetof(struct ipv6hdr
, nexthdr
);
147 oif
= skb_dst(skb
)->dev
->ifindex
;
149 memset(fl6
, 0, sizeof(struct flowi6
));
150 fl6
->flowi6_mark
= skb
->mark
;
151 fl6
->flowi6_oif
= reverse
? skb
->skb_iif
: oif
;
153 fl6
->daddr
= reverse
? hdr
->saddr
: hdr
->daddr
;
154 fl6
->saddr
= reverse
? hdr
->daddr
: hdr
->saddr
;
156 while (nh
+ offset
+ 1 < skb
->data
||
157 pskb_may_pull(skb
, nh
+ offset
+ 1 - skb
->data
)) {
158 nh
= skb_network_header(skb
);
159 exthdr
= (struct ipv6_opt_hdr
*)(nh
+ offset
);
162 case NEXTHDR_FRAGMENT
:
164 case NEXTHDR_ROUTING
:
167 offset
+= ipv6_optlen(exthdr
);
168 nexthdr
= exthdr
->nexthdr
;
169 exthdr
= (struct ipv6_opt_hdr
*)(nh
+ offset
);
173 case IPPROTO_UDPLITE
:
177 if (!onlyproto
&& (nh
+ offset
+ 4 < skb
->data
||
178 pskb_may_pull(skb
, nh
+ offset
+ 4 - skb
->data
))) {
181 nh
= skb_network_header(skb
);
182 ports
= (__be16
*)(nh
+ offset
);
183 fl6
->fl6_sport
= ports
[!!reverse
];
184 fl6
->fl6_dport
= ports
[!reverse
];
186 fl6
->flowi6_proto
= nexthdr
;
190 if (!onlyproto
&& pskb_may_pull(skb
, nh
+ offset
+ 2 - skb
->data
)) {
193 nh
= skb_network_header(skb
);
194 icmp
= (u8
*)(nh
+ offset
);
195 fl6
->fl6_icmp_type
= icmp
[0];
196 fl6
->fl6_icmp_code
= icmp
[1];
198 fl6
->flowi6_proto
= nexthdr
;
201 #if IS_ENABLED(CONFIG_IPV6_MIP6)
203 offset
+= ipv6_optlen(exthdr
);
204 if (!onlyproto
&& pskb_may_pull(skb
, nh
+ offset
+ 3 - skb
->data
)) {
207 nh
= skb_network_header(skb
);
208 mh
= (struct ip6_mh
*)(nh
+ offset
);
209 fl6
->fl6_mh_type
= mh
->ip6mh_type
;
211 fl6
->flowi6_proto
= nexthdr
;
215 /* XXX Why are there these headers? */
220 fl6
->fl6_ipsec_spi
= 0;
221 fl6
->flowi6_proto
= nexthdr
;
227 static inline int xfrm6_garbage_collect(struct dst_ops
*ops
)
229 struct net
*net
= container_of(ops
, struct net
, xfrm
.xfrm6_dst_ops
);
231 xfrm6_policy_afinfo
.garbage_collect(net
);
232 return dst_entries_get_fast(ops
) > ops
->gc_thresh
* 2;
235 static void xfrm6_update_pmtu(struct dst_entry
*dst
, struct sock
*sk
,
236 struct sk_buff
*skb
, u32 mtu
)
238 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
239 struct dst_entry
*path
= xdst
->route
;
241 path
->ops
->update_pmtu(path
, sk
, skb
, mtu
);
244 static void xfrm6_redirect(struct dst_entry
*dst
, struct sock
*sk
,
247 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
248 struct dst_entry
*path
= xdst
->route
;
250 path
->ops
->redirect(path
, sk
, skb
);
253 static void xfrm6_dst_destroy(struct dst_entry
*dst
)
255 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
257 if (likely(xdst
->u
.rt6
.rt6i_idev
))
258 in6_dev_put(xdst
->u
.rt6
.rt6i_idev
);
259 dst_destroy_metrics_generic(dst
);
260 if (rt6_has_peer(&xdst
->u
.rt6
)) {
261 struct inet_peer
*peer
= rt6_peer_ptr(&xdst
->u
.rt6
);
264 xfrm_dst_destroy(xdst
);
267 static void xfrm6_dst_ifdown(struct dst_entry
*dst
, struct net_device
*dev
,
270 struct xfrm_dst
*xdst
;
275 xdst
= (struct xfrm_dst
*)dst
;
276 if (xdst
->u
.rt6
.rt6i_idev
->dev
== dev
) {
277 struct inet6_dev
*loopback_idev
=
278 in6_dev_get(dev_net(dev
)->loopback_dev
);
279 BUG_ON(!loopback_idev
);
282 in6_dev_put(xdst
->u
.rt6
.rt6i_idev
);
283 xdst
->u
.rt6
.rt6i_idev
= loopback_idev
;
284 in6_dev_hold(loopback_idev
);
285 xdst
= (struct xfrm_dst
*)xdst
->u
.dst
.child
;
286 } while (xdst
->u
.dst
.xfrm
);
288 __in6_dev_put(loopback_idev
);
291 xfrm_dst_ifdown(dst
, dev
);
294 static struct dst_ops xfrm6_dst_ops
= {
296 .protocol
= cpu_to_be16(ETH_P_IPV6
),
297 .gc
= xfrm6_garbage_collect
,
298 .update_pmtu
= xfrm6_update_pmtu
,
299 .redirect
= xfrm6_redirect
,
300 .cow_metrics
= dst_cow_metrics_generic
,
301 .destroy
= xfrm6_dst_destroy
,
302 .ifdown
= xfrm6_dst_ifdown
,
303 .local_out
= __ip6_local_out
,
307 static struct xfrm_policy_afinfo xfrm6_policy_afinfo
= {
309 .dst_ops
= &xfrm6_dst_ops
,
310 .dst_lookup
= xfrm6_dst_lookup
,
311 .get_saddr
= xfrm6_get_saddr
,
312 .decode_session
= _decode_session6
,
313 .get_tos
= xfrm6_get_tos
,
314 .init_dst
= xfrm6_init_dst
,
315 .init_path
= xfrm6_init_path
,
316 .fill_dst
= xfrm6_fill_dst
,
317 .blackhole_route
= ip6_blackhole_route
,
320 static int __init
xfrm6_policy_init(void)
322 return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo
);
325 static void xfrm6_policy_fini(void)
327 xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo
);
331 static struct ctl_table xfrm6_policy_table
[] = {
333 .procname
= "xfrm6_gc_thresh",
334 .data
= &init_net
.xfrm
.xfrm6_dst_ops
.gc_thresh
,
335 .maxlen
= sizeof(int),
337 .proc_handler
= proc_dointvec
,
342 static int __net_init
xfrm6_net_init(struct net
*net
)
344 struct ctl_table
*table
;
345 struct ctl_table_header
*hdr
;
347 table
= xfrm6_policy_table
;
348 if (!net_eq(net
, &init_net
)) {
349 table
= kmemdup(table
, sizeof(xfrm6_policy_table
), GFP_KERNEL
);
353 table
[0].data
= &net
->xfrm
.xfrm6_dst_ops
.gc_thresh
;
356 hdr
= register_net_sysctl(net
, "net/ipv6", table
);
360 net
->ipv6
.sysctl
.xfrm6_hdr
= hdr
;
364 if (!net_eq(net
, &init_net
))
370 static void __net_exit
xfrm6_net_exit(struct net
*net
)
372 struct ctl_table
*table
;
374 if (net
->ipv6
.sysctl
.xfrm6_hdr
== NULL
)
377 table
= net
->ipv6
.sysctl
.xfrm6_hdr
->ctl_table_arg
;
378 unregister_net_sysctl_table(net
->ipv6
.sysctl
.xfrm6_hdr
);
379 if (!net_eq(net
, &init_net
))
383 static struct pernet_operations xfrm6_net_ops
= {
384 .init
= xfrm6_net_init
,
385 .exit
= xfrm6_net_exit
,
389 int __init
xfrm6_init(void)
393 dst_entries_init(&xfrm6_dst_ops
);
395 ret
= xfrm6_policy_init();
397 dst_entries_destroy(&xfrm6_dst_ops
);
400 ret
= xfrm6_state_init();
404 ret
= xfrm6_protocol_init();
409 register_pernet_subsys(&xfrm6_net_ops
);
420 void xfrm6_fini(void)
423 unregister_pernet_subsys(&xfrm6_net_ops
);
425 xfrm6_protocol_fini();
428 dst_entries_destroy(&xfrm6_dst_ops
);