Commit | Line | Data |
---|---|---|
e905a9ed | 1 | /* |
1da177e4 LT |
2 | * xfrm4_policy.c |
3 | * | |
4 | * Changes: | |
5 | * Kazunori MIYAZAWA @USAGI | |
6 | * YOSHIFUJI Hideaki @USAGI | |
7 | * Split up af-specific portion | |
e905a9ed | 8 | * |
1da177e4 LT |
9 | */ |
10 | ||
66cdb3ca HX |
11 | #include <linux/err.h> |
12 | #include <linux/kernel.h> | |
aabc9761 | 13 | #include <linux/inetdevice.h> |
45ff5a3f | 14 | #include <net/dst.h> |
1da177e4 LT |
15 | #include <net/xfrm.h> |
16 | #include <net/ip.h> | |
17 | ||
18 | static struct dst_ops xfrm4_dst_ops; | |
19 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo; | |
20 | ||
c5b3cf46 AD |
21 | static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, |
22 | xfrm_address_t *saddr, | |
66cdb3ca | 23 | xfrm_address_t *daddr) |
1da177e4 | 24 | { |
66cdb3ca | 25 | struct flowi fl = { |
a1e59abf PM |
26 | .nl_u = { |
27 | .ip4_u = { | |
66cdb3ca | 28 | .tos = tos, |
a1e59abf PM |
29 | .daddr = daddr->a4, |
30 | }, | |
31 | }, | |
32 | }; | |
66cdb3ca HX |
33 | struct dst_entry *dst; |
34 | struct rtable *rt; | |
35 | int err; | |
a1e59abf | 36 | |
66cdb3ca HX |
37 | if (saddr) |
38 | fl.fl4_src = saddr->a4; | |
39 | ||
c5b3cf46 | 40 | err = __ip_route_output_key(net, &rt, &fl); |
66cdb3ca HX |
41 | dst = &rt->u.dst; |
42 | if (err) | |
43 | dst = ERR_PTR(err); | |
44 | return dst; | |
45 | } | |
46 | ||
fbda33b2 AD |
47 | static int xfrm4_get_saddr(struct net *net, |
48 | xfrm_address_t *saddr, xfrm_address_t *daddr) | |
66cdb3ca HX |
49 | { |
50 | struct dst_entry *dst; | |
51 | struct rtable *rt; | |
52 | ||
fbda33b2 | 53 | dst = xfrm4_dst_lookup(net, 0, NULL, daddr); |
66cdb3ca HX |
54 | if (IS_ERR(dst)) |
55 | return -EHOSTUNREACH; | |
56 | ||
57 | rt = (struct rtable *)dst; | |
58 | saddr->a4 = rt->rt_src; | |
59 | dst_release(dst); | |
60 | return 0; | |
a1e59abf PM |
61 | } |
62 | ||
1da177e4 LT |
63 | static struct dst_entry * |
64 | __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy) | |
65 | { | |
66 | struct dst_entry *dst; | |
67 | ||
68 | read_lock_bh(&policy->lock); | |
69 | for (dst = policy->bundles; dst; dst = dst->next) { | |
5a5f3a8d | 70 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
1da177e4 LT |
71 | if (xdst->u.rt.fl.oif == fl->oif && /*XXX*/ |
72 | xdst->u.rt.fl.fl4_dst == fl->fl4_dst && | |
e905a9ed YH |
73 | xdst->u.rt.fl.fl4_src == fl->fl4_src && |
74 | xdst->u.rt.fl.fl4_tos == fl->fl4_tos && | |
5b368e61 | 75 | xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) { |
1da177e4 LT |
76 | dst_clone(dst); |
77 | break; | |
78 | } | |
79 | } | |
80 | read_unlock_bh(&policy->lock); | |
81 | return dst; | |
82 | } | |
83 | ||
25ee3286 | 84 | static int xfrm4_get_tos(struct flowi *fl) |
1da177e4 | 85 | { |
25ee3286 HX |
86 | return fl->fl4_tos; |
87 | } | |
1da177e4 | 88 | |
a1b05140 MN |
89 | static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst, |
90 | int nfheader_len) | |
91 | { | |
92 | return 0; | |
93 | } | |
94 | ||
25ee3286 HX |
95 | static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev) |
96 | { | |
97 | struct rtable *rt = (struct rtable *)xdst->route; | |
1da177e4 | 98 | |
25ee3286 | 99 | xdst->u.rt.fl = rt->fl; |
1da177e4 | 100 | |
25ee3286 HX |
101 | xdst->u.dst.dev = dev; |
102 | dev_hold(dev); | |
43372262 | 103 | |
25ee3286 HX |
104 | xdst->u.rt.idev = in_dev_get(dev); |
105 | if (!xdst->u.rt.idev) | |
106 | return -ENODEV; | |
1da177e4 | 107 | |
25ee3286 HX |
108 | xdst->u.rt.peer = rt->peer; |
109 | if (rt->peer) | |
110 | atomic_inc(&rt->peer->refcnt); | |
66cdb3ca | 111 | |
25ee3286 HX |
112 | /* Sheit... I remember I did this right. Apparently, |
113 | * it was magically lost, so this code needs audit */ | |
114 | xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | | |
115 | RTCF_LOCAL); | |
116 | xdst->u.rt.rt_type = rt->rt_type; | |
117 | xdst->u.rt.rt_src = rt->rt_src; | |
118 | xdst->u.rt.rt_dst = rt->rt_dst; | |
119 | xdst->u.rt.rt_gateway = rt->rt_gateway; | |
120 | xdst->u.rt.rt_spec_dst = rt->rt_spec_dst; | |
1da177e4 | 121 | |
1da177e4 | 122 | return 0; |
1da177e4 LT |
123 | } |
124 | ||
125 | static void | |
d5422efe | 126 | _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) |
1da177e4 | 127 | { |
eddc9ec5 | 128 | struct iphdr *iph = ip_hdr(skb); |
d56f90a7 | 129 | u8 *xprth = skb_network_header(skb) + iph->ihl * 4; |
1da177e4 LT |
130 | |
131 | memset(fl, 0, sizeof(struct flowi)); | |
132 | if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) { | |
133 | switch (iph->protocol) { | |
134 | case IPPROTO_UDP: | |
ba4e58ec | 135 | case IPPROTO_UDPLITE: |
1da177e4 LT |
136 | case IPPROTO_TCP: |
137 | case IPPROTO_SCTP: | |
9e999993 | 138 | case IPPROTO_DCCP: |
1da177e4 | 139 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { |
8c689a6e | 140 | __be16 *ports = (__be16 *)xprth; |
1da177e4 | 141 | |
d5422efe HX |
142 | fl->fl_ip_sport = ports[!!reverse]; |
143 | fl->fl_ip_dport = ports[!reverse]; | |
1da177e4 LT |
144 | } |
145 | break; | |
146 | ||
147 | case IPPROTO_ICMP: | |
148 | if (pskb_may_pull(skb, xprth + 2 - skb->data)) { | |
149 | u8 *icmp = xprth; | |
150 | ||
151 | fl->fl_icmp_type = icmp[0]; | |
152 | fl->fl_icmp_code = icmp[1]; | |
153 | } | |
154 | break; | |
155 | ||
156 | case IPPROTO_ESP: | |
157 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
4324a174 | 158 | __be32 *ehdr = (__be32 *)xprth; |
1da177e4 LT |
159 | |
160 | fl->fl_ipsec_spi = ehdr[0]; | |
161 | } | |
162 | break; | |
163 | ||
164 | case IPPROTO_AH: | |
165 | if (pskb_may_pull(skb, xprth + 8 - skb->data)) { | |
4324a174 | 166 | __be32 *ah_hdr = (__be32*)xprth; |
1da177e4 LT |
167 | |
168 | fl->fl_ipsec_spi = ah_hdr[1]; | |
169 | } | |
170 | break; | |
171 | ||
172 | case IPPROTO_COMP: | |
173 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
4324a174 | 174 | __be16 *ipcomp_hdr = (__be16 *)xprth; |
1da177e4 | 175 | |
4195f814 | 176 | fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); |
1da177e4 LT |
177 | } |
178 | break; | |
179 | default: | |
180 | fl->fl_ipsec_spi = 0; | |
181 | break; | |
3ff50b79 | 182 | } |
1da177e4 LT |
183 | } |
184 | fl->proto = iph->protocol; | |
d5422efe HX |
185 | fl->fl4_dst = reverse ? iph->saddr : iph->daddr; |
186 | fl->fl4_src = reverse ? iph->daddr : iph->saddr; | |
4da3089f | 187 | fl->fl4_tos = iph->tos; |
1da177e4 LT |
188 | } |
189 | ||
569d3645 | 190 | static inline int xfrm4_garbage_collect(struct dst_ops *ops) |
1da177e4 | 191 | { |
ddcfd796 | 192 | xfrm4_policy_afinfo.garbage_collect(&init_net); |
1da177e4 LT |
193 | return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2); |
194 | } | |
195 | ||
196 | static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu) | |
197 | { | |
198 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
199 | struct dst_entry *path = xdst->route; | |
200 | ||
201 | path->ops->update_pmtu(path, mtu); | |
202 | } | |
203 | ||
aabc9761 HX |
204 | static void xfrm4_dst_destroy(struct dst_entry *dst) |
205 | { | |
206 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
207 | ||
208 | if (likely(xdst->u.rt.idev)) | |
209 | in_dev_put(xdst->u.rt.idev); | |
ed3e37dd | 210 | if (likely(xdst->u.rt.peer)) |
26db1677 | 211 | inet_putpeer(xdst->u.rt.peer); |
aabc9761 HX |
212 | xfrm_dst_destroy(xdst); |
213 | } | |
214 | ||
215 | static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, | |
216 | int unregister) | |
217 | { | |
218 | struct xfrm_dst *xdst; | |
219 | ||
220 | if (!unregister) | |
221 | return; | |
222 | ||
223 | xdst = (struct xfrm_dst *)dst; | |
224 | if (xdst->u.rt.idev->dev == dev) { | |
5a3e55d6 | 225 | struct in_device *loopback_idev = |
c346dca1 | 226 | in_dev_get(dev_net(dev)->loopback_dev); |
aabc9761 HX |
227 | BUG_ON(!loopback_idev); |
228 | ||
229 | do { | |
230 | in_dev_put(xdst->u.rt.idev); | |
231 | xdst->u.rt.idev = loopback_idev; | |
232 | in_dev_hold(loopback_idev); | |
233 | xdst = (struct xfrm_dst *)xdst->u.dst.child; | |
234 | } while (xdst->u.dst.xfrm); | |
235 | ||
236 | __in_dev_put(loopback_idev); | |
237 | } | |
238 | ||
239 | xfrm_dst_ifdown(dst, dev); | |
240 | } | |
241 | ||
1da177e4 LT |
242 | static struct dst_ops xfrm4_dst_ops = { |
243 | .family = AF_INET, | |
244 | .protocol = __constant_htons(ETH_P_IP), | |
245 | .gc = xfrm4_garbage_collect, | |
246 | .update_pmtu = xfrm4_update_pmtu, | |
aabc9761 HX |
247 | .destroy = xfrm4_dst_destroy, |
248 | .ifdown = xfrm4_dst_ifdown, | |
862b82c6 | 249 | .local_out = __ip_local_out, |
1da177e4 | 250 | .gc_thresh = 1024, |
e2422970 | 251 | .entries = ATOMIC_INIT(0), |
1da177e4 LT |
252 | }; |
253 | ||
254 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { | |
255 | .family = AF_INET, | |
1da177e4 LT |
256 | .dst_ops = &xfrm4_dst_ops, |
257 | .dst_lookup = xfrm4_dst_lookup, | |
a1e59abf | 258 | .get_saddr = xfrm4_get_saddr, |
1da177e4 | 259 | .find_bundle = __xfrm4_find_bundle, |
1da177e4 | 260 | .decode_session = _decode_session4, |
25ee3286 | 261 | .get_tos = xfrm4_get_tos, |
a1b05140 | 262 | .init_path = xfrm4_init_path, |
25ee3286 | 263 | .fill_dst = xfrm4_fill_dst, |
1da177e4 LT |
264 | }; |
265 | ||
266 | static void __init xfrm4_policy_init(void) | |
267 | { | |
268 | xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); | |
269 | } | |
270 | ||
271 | static void __exit xfrm4_policy_fini(void) | |
272 | { | |
273 | xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo); | |
274 | } | |
275 | ||
276 | void __init xfrm4_init(void) | |
277 | { | |
278 | xfrm4_state_init(); | |
279 | xfrm4_policy_init(); | |
280 | } | |
281 |