Commit | Line | Data |
---|---|---|
e905a9ed | 1 | /* |
1da177e4 LT |
2 | * xfrm4_policy.c |
3 | * | |
4 | * Changes: | |
5 | * Kazunori MIYAZAWA @USAGI | |
6 | * YOSHIFUJI Hideaki @USAGI | |
7 | * Split up af-specific portion | |
e905a9ed | 8 | * |
1da177e4 LT |
9 | */ |
10 | ||
66cdb3ca HX |
11 | #include <linux/err.h> |
12 | #include <linux/kernel.h> | |
aabc9761 | 13 | #include <linux/inetdevice.h> |
cc9ff19d | 14 | #include <linux/if_tunnel.h> |
45ff5a3f | 15 | #include <net/dst.h> |
1da177e4 LT |
16 | #include <net/xfrm.h> |
17 | #include <net/ip.h> | |
4ec3b28c | 18 | #include <net/vrf.h> |
1da177e4 | 19 | |
1da177e4 LT |
20 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo; |
21 | ||
8f01cb08 | 22 | static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4, |
42a7b32b | 23 | int tos, int oif, |
8f01cb08 DM |
24 | const xfrm_address_t *saddr, |
25 | const xfrm_address_t *daddr) | |
1da177e4 | 26 | { |
66cdb3ca | 27 | struct rtable *rt; |
a1e59abf | 28 | |
8f01cb08 DM |
29 | memset(fl4, 0, sizeof(*fl4)); |
30 | fl4->daddr = daddr->a4; | |
31 | fl4->flowi4_tos = tos; | |
42a7b32b | 32 | fl4->flowi4_oif = oif; |
66cdb3ca | 33 | if (saddr) |
8f01cb08 | 34 | fl4->saddr = saddr->a4; |
66cdb3ca | 35 | |
58189ca7 DA |
36 | fl4->flowi4_flags = FLOWI_FLAG_SKIP_NH_OIF; |
37 | ||
8f01cb08 | 38 | rt = __ip_route_output_key(net, fl4); |
b23dd4fe DM |
39 | if (!IS_ERR(rt)) |
40 | return &rt->dst; | |
41 | ||
42 | return ERR_CAST(rt); | |
66cdb3ca HX |
43 | } |
44 | ||
42a7b32b | 45 | static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif, |
8f01cb08 DM |
46 | const xfrm_address_t *saddr, |
47 | const xfrm_address_t *daddr) | |
48 | { | |
49 | struct flowi4 fl4; | |
50 | ||
42a7b32b | 51 | return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr); |
8f01cb08 DM |
52 | } |
53 | ||
42a7b32b | 54 | static int xfrm4_get_saddr(struct net *net, int oif, |
fbda33b2 | 55 | xfrm_address_t *saddr, xfrm_address_t *daddr) |
66cdb3ca HX |
56 | { |
57 | struct dst_entry *dst; | |
8f01cb08 | 58 | struct flowi4 fl4; |
66cdb3ca | 59 | |
42a7b32b | 60 | dst = __xfrm4_dst_lookup(net, &fl4, 0, oif, NULL, daddr); |
66cdb3ca HX |
61 | if (IS_ERR(dst)) |
62 | return -EHOSTUNREACH; | |
63 | ||
8f01cb08 | 64 | saddr->a4 = fl4.saddr; |
66cdb3ca HX |
65 | dst_release(dst); |
66 | return 0; | |
a1e59abf PM |
67 | } |
68 | ||
05d84025 | 69 | static int xfrm4_get_tos(const struct flowi *fl) |
1da177e4 | 70 | { |
7e1dc7b6 | 71 | return IPTOS_RT_MASK & fl->u.ip4.flowi4_tos; /* Strip ECN bits */ |
25ee3286 | 72 | } |
1da177e4 | 73 | |
a1b05140 MN |
74 | static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst, |
75 | int nfheader_len) | |
76 | { | |
77 | return 0; | |
78 | } | |
79 | ||
87c1e12b | 80 | static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, |
0c7b3eef | 81 | const struct flowi *fl) |
25ee3286 HX |
82 | { |
83 | struct rtable *rt = (struct rtable *)xdst->route; | |
7e1dc7b6 | 84 | const struct flowi4 *fl4 = &fl->u.ip4; |
1da177e4 | 85 | |
b7323396 | 86 | xdst->u.rt.rt_iif = fl4->flowi4_iif; |
1da177e4 | 87 | |
25ee3286 HX |
88 | xdst->u.dst.dev = dev; |
89 | dev_hold(dev); | |
43372262 | 90 | |
25ee3286 HX |
91 | /* Sheit... I remember I did this right. Apparently, |
92 | * it was magically lost, so this code needs audit */ | |
9917e1e8 | 93 | xdst->u.rt.rt_is_input = rt->rt_is_input; |
25ee3286 HX |
94 | xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | |
95 | RTCF_LOCAL); | |
96 | xdst->u.rt.rt_type = rt->rt_type; | |
25ee3286 | 97 | xdst->u.rt.rt_gateway = rt->rt_gateway; |
155e8336 | 98 | xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway; |
5943634f | 99 | xdst->u.rt.rt_pmtu = rt->rt_pmtu; |
caacf05e | 100 | INIT_LIST_HEAD(&xdst->u.rt.rt_uncached); |
1da177e4 | 101 | |
1da177e4 | 102 | return 0; |
1da177e4 LT |
103 | } |
104 | ||
105 | static void | |
d5422efe | 106 | _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) |
1da177e4 | 107 | { |
b71d1d42 | 108 | const struct iphdr *iph = ip_hdr(skb); |
d56f90a7 | 109 | u8 *xprth = skb_network_header(skb) + iph->ihl * 4; |
7e1dc7b6 | 110 | struct flowi4 *fl4 = &fl->u.ip4; |
84502b5e SK |
111 | int oif = 0; |
112 | ||
4ec3b28c DA |
113 | if (skb_dst(skb)) { |
114 | oif = vrf_master_ifindex(skb_dst(skb)->dev) ? | |
115 | : skb_dst(skb)->dev->ifindex; | |
116 | } | |
1da177e4 | 117 | |
7e1dc7b6 DM |
118 | memset(fl4, 0, sizeof(struct flowi4)); |
119 | fl4->flowi4_mark = skb->mark; | |
84502b5e | 120 | fl4->flowi4_oif = reverse ? skb->skb_iif : oif; |
44b451f1 | 121 | |
56f8a75c | 122 | if (!ip_is_fragment(iph)) { |
1da177e4 LT |
123 | switch (iph->protocol) { |
124 | case IPPROTO_UDP: | |
ba4e58ec | 125 | case IPPROTO_UDPLITE: |
1da177e4 LT |
126 | case IPPROTO_TCP: |
127 | case IPPROTO_SCTP: | |
9e999993 | 128 | case IPPROTO_DCCP: |
c615c9f3 WY |
129 | if (xprth + 4 < skb->data || |
130 | pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
8c689a6e | 131 | __be16 *ports = (__be16 *)xprth; |
1da177e4 | 132 | |
9cce96df DM |
133 | fl4->fl4_sport = ports[!!reverse]; |
134 | fl4->fl4_dport = ports[!reverse]; | |
1da177e4 LT |
135 | } |
136 | break; | |
137 | ||
138 | case IPPROTO_ICMP: | |
139 | if (pskb_may_pull(skb, xprth + 2 - skb->data)) { | |
140 | u8 *icmp = xprth; | |
141 | ||
9cce96df DM |
142 | fl4->fl4_icmp_type = icmp[0]; |
143 | fl4->fl4_icmp_code = icmp[1]; | |
1da177e4 LT |
144 | } |
145 | break; | |
146 | ||
147 | case IPPROTO_ESP: | |
148 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
4324a174 | 149 | __be32 *ehdr = (__be32 *)xprth; |
1da177e4 | 150 | |
9cce96df | 151 | fl4->fl4_ipsec_spi = ehdr[0]; |
1da177e4 LT |
152 | } |
153 | break; | |
154 | ||
155 | case IPPROTO_AH: | |
156 | if (pskb_may_pull(skb, xprth + 8 - skb->data)) { | |
5e73ea1a | 157 | __be32 *ah_hdr = (__be32 *)xprth; |
1da177e4 | 158 | |
9cce96df | 159 | fl4->fl4_ipsec_spi = ah_hdr[1]; |
1da177e4 LT |
160 | } |
161 | break; | |
162 | ||
163 | case IPPROTO_COMP: | |
164 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
4324a174 | 165 | __be16 *ipcomp_hdr = (__be16 *)xprth; |
1da177e4 | 166 | |
9cce96df | 167 | fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); |
1da177e4 LT |
168 | } |
169 | break; | |
cc9ff19d TT |
170 | |
171 | case IPPROTO_GRE: | |
172 | if (pskb_may_pull(skb, xprth + 12 - skb->data)) { | |
173 | __be16 *greflags = (__be16 *)xprth; | |
174 | __be32 *gre_hdr = (__be32 *)xprth; | |
175 | ||
176 | if (greflags[0] & GRE_KEY) { | |
177 | if (greflags[0] & GRE_CSUM) | |
178 | gre_hdr++; | |
9cce96df | 179 | fl4->fl4_gre_key = gre_hdr[1]; |
cc9ff19d TT |
180 | } |
181 | } | |
182 | break; | |
183 | ||
1da177e4 | 184 | default: |
9cce96df | 185 | fl4->fl4_ipsec_spi = 0; |
1da177e4 | 186 | break; |
3ff50b79 | 187 | } |
1da177e4 | 188 | } |
7e1dc7b6 DM |
189 | fl4->flowi4_proto = iph->protocol; |
190 | fl4->daddr = reverse ? iph->saddr : iph->daddr; | |
191 | fl4->saddr = reverse ? iph->daddr : iph->saddr; | |
192 | fl4->flowi4_tos = iph->tos; | |
1da177e4 LT |
193 | } |
194 | ||
569d3645 | 195 | static inline int xfrm4_garbage_collect(struct dst_ops *ops) |
1da177e4 | 196 | { |
d7c7544c AD |
197 | struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops); |
198 | ||
199 | xfrm4_policy_afinfo.garbage_collect(net); | |
fc66f95c | 200 | return (dst_entries_get_slow(ops) > ops->gc_thresh * 2); |
1da177e4 LT |
201 | } |
202 | ||
6700c270 DM |
203 | static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk, |
204 | struct sk_buff *skb, u32 mtu) | |
1da177e4 LT |
205 | { |
206 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
207 | struct dst_entry *path = xdst->route; | |
208 | ||
6700c270 | 209 | path->ops->update_pmtu(path, sk, skb, mtu); |
1da177e4 LT |
210 | } |
211 | ||
6700c270 DM |
212 | static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk, |
213 | struct sk_buff *skb) | |
55be7a9c DM |
214 | { |
215 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
216 | struct dst_entry *path = xdst->route; | |
217 | ||
6700c270 | 218 | path->ops->redirect(path, sk, skb); |
55be7a9c DM |
219 | } |
220 | ||
aabc9761 HX |
221 | static void xfrm4_dst_destroy(struct dst_entry *dst) |
222 | { | |
223 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
224 | ||
62fa8a84 DM |
225 | dst_destroy_metrics_generic(dst); |
226 | ||
aabc9761 HX |
227 | xfrm_dst_destroy(xdst); |
228 | } | |
229 | ||
230 | static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, | |
231 | int unregister) | |
232 | { | |
aabc9761 HX |
233 | if (!unregister) |
234 | return; | |
235 | ||
aabc9761 HX |
236 | xfrm_dst_ifdown(dst, dev); |
237 | } | |
238 | ||
1da177e4 LT |
239 | static struct dst_ops xfrm4_dst_ops = { |
240 | .family = AF_INET, | |
1da177e4 LT |
241 | .gc = xfrm4_garbage_collect, |
242 | .update_pmtu = xfrm4_update_pmtu, | |
55be7a9c | 243 | .redirect = xfrm4_redirect, |
62fa8a84 | 244 | .cow_metrics = dst_cow_metrics_generic, |
aabc9761 HX |
245 | .destroy = xfrm4_dst_destroy, |
246 | .ifdown = xfrm4_dst_ifdown, | |
862b82c6 | 247 | .local_out = __ip_local_out, |
eeb1b733 | 248 | .gc_thresh = 32768, |
1da177e4 LT |
249 | }; |
250 | ||
251 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { | |
252 | .family = AF_INET, | |
1da177e4 LT |
253 | .dst_ops = &xfrm4_dst_ops, |
254 | .dst_lookup = xfrm4_dst_lookup, | |
a1e59abf | 255 | .get_saddr = xfrm4_get_saddr, |
1da177e4 | 256 | .decode_session = _decode_session4, |
25ee3286 | 257 | .get_tos = xfrm4_get_tos, |
a1b05140 | 258 | .init_path = xfrm4_init_path, |
25ee3286 | 259 | .fill_dst = xfrm4_fill_dst, |
2774c131 | 260 | .blackhole_route = ipv4_blackhole_route, |
1da177e4 LT |
261 | }; |
262 | ||
f816700a | 263 | #ifdef CONFIG_SYSCTL |
a44a4a00 NH |
264 | static struct ctl_table xfrm4_policy_table[] = { |
265 | { | |
a44a4a00 | 266 | .procname = "xfrm4_gc_thresh", |
d7c7544c | 267 | .data = &init_net.xfrm.xfrm4_dst_ops.gc_thresh, |
a44a4a00 NH |
268 | .maxlen = sizeof(int), |
269 | .mode = 0644, | |
270 | .proc_handler = proc_dointvec, | |
271 | }, | |
272 | { } | |
273 | }; | |
274 | ||
8d068875 MK |
275 | static int __net_init xfrm4_net_init(struct net *net) |
276 | { | |
277 | struct ctl_table *table; | |
278 | struct ctl_table_header *hdr; | |
279 | ||
280 | table = xfrm4_policy_table; | |
281 | if (!net_eq(net, &init_net)) { | |
282 | table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL); | |
283 | if (!table) | |
284 | goto err_alloc; | |
285 | ||
286 | table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh; | |
287 | } | |
288 | ||
289 | hdr = register_net_sysctl(net, "net/ipv4", table); | |
290 | if (!hdr) | |
291 | goto err_reg; | |
292 | ||
293 | net->ipv4.xfrm4_hdr = hdr; | |
294 | return 0; | |
295 | ||
296 | err_reg: | |
297 | if (!net_eq(net, &init_net)) | |
298 | kfree(table); | |
299 | err_alloc: | |
300 | return -ENOMEM; | |
301 | } | |
302 | ||
303 | static void __net_exit xfrm4_net_exit(struct net *net) | |
304 | { | |
305 | struct ctl_table *table; | |
306 | ||
51456b29 | 307 | if (!net->ipv4.xfrm4_hdr) |
8d068875 MK |
308 | return; |
309 | ||
310 | table = net->ipv4.xfrm4_hdr->ctl_table_arg; | |
311 | unregister_net_sysctl_table(net->ipv4.xfrm4_hdr); | |
312 | if (!net_eq(net, &init_net)) | |
313 | kfree(table); | |
314 | } | |
315 | ||
316 | static struct pernet_operations __net_initdata xfrm4_net_ops = { | |
317 | .init = xfrm4_net_init, | |
318 | .exit = xfrm4_net_exit, | |
319 | }; | |
f816700a | 320 | #endif |
a44a4a00 | 321 | |
1da177e4 LT |
322 | static void __init xfrm4_policy_init(void) |
323 | { | |
324 | xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); | |
325 | } | |
326 | ||
703fb94e | 327 | void __init xfrm4_init(void) |
1da177e4 | 328 | { |
fc66f95c | 329 | dst_entries_init(&xfrm4_dst_ops); |
d7c7544c AD |
330 | |
331 | xfrm4_state_init(); | |
332 | xfrm4_policy_init(); | |
2f32b51b | 333 | xfrm4_protocol_init(); |
f816700a | 334 | #ifdef CONFIG_SYSCTL |
8d068875 | 335 | register_pernet_subsys(&xfrm4_net_ops); |
f816700a | 336 | #endif |
1da177e4 LT |
337 | } |
338 |