xfrm6_policy.c revision 7e1dc7b6f709dfc1a9ab4b320dbe723f45992693 
1/*
2 * xfrm6_policy.c: based on xfrm4_policy.c
3 *
4 * Authors:
5 *	Mitsuru KANDA @USAGI
6 * 	Kazunori MIYAZAWA @USAGI
7 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * 		IPv6 support
9 * 	YOSHIFUJI Hideaki
10 * 		Split up af-specific portion
11 *
12 */
13
14#include <linux/err.h>
15#include <linux/kernel.h>
16#include <linux/netdevice.h>
17#include <net/addrconf.h>
18#include <net/dst.h>
19#include <net/xfrm.h>
20#include <net/ip.h>
21#include <net/ipv6.h>
22#include <net/ip6_route.h>
23#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
24#include <net/mip6.h>
25#endif
26
27static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
28
29static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
30					  const xfrm_address_t *saddr,
31					  const xfrm_address_t *daddr)
32{
33	struct flowi6 fl6;
34	struct dst_entry *dst;
35	int err;
36
37	memset(&fl6, 0, sizeof(fl6));
38	memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
39	if (saddr)
40		memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
41
42	dst = ip6_route_output(net, NULL,
43			       flowi6_to_flowi(&fl6));
44
45	err = dst->error;
46	if (dst->error) {
47		dst_release(dst);
48		dst = ERR_PTR(err);
49	}
50
51	return dst;
52}
53
54static int xfrm6_get_saddr(struct net *net,
55			   xfrm_address_t *saddr, xfrm_address_t *daddr)
56{
57	struct dst_entry *dst;
58	struct net_device *dev;
59
60	dst = xfrm6_dst_lookup(net, 0, NULL, daddr);
61	if (IS_ERR(dst))
62		return -EHOSTUNREACH;
63
64	dev = ip6_dst_idev(dst)->dev;
65	ipv6_dev_get_saddr(dev_net(dev), dev,
66			   (struct in6_addr *)&daddr->a6, 0,
67			   (struct in6_addr *)&saddr->a6);
68	dst_release(dst);
69	return 0;
70}
71
72static int xfrm6_get_tos(const struct flowi *fl)
73{
74	return 0;
75}
76
77static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
78			   int nfheader_len)
79{
80	if (dst->ops->family == AF_INET6) {
81		struct rt6_info *rt = (struct rt6_info*)dst;
82		if (rt->rt6i_node)
83			path->path_cookie = rt->rt6i_node->fn_sernum;
84	}
85
86	path->u.rt6.rt6i_nfheader_len = nfheader_len;
87
88	return 0;
89}
90
91static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
92			  const struct flowi *fl)
93{
94	struct rt6_info *rt = (struct rt6_info*)xdst->route;
95
96	xdst->u.dst.dev = dev;
97	dev_hold(dev);
98
99	xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
100	if (!xdst->u.rt6.rt6i_idev)
101		return -ENODEV;
102
103	xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
104	if (rt->rt6i_peer)
105		atomic_inc(&rt->rt6i_peer->refcnt);
106
107	/* Sheit... I remember I did this right. Apparently,
108	 * it was magically lost, so this code needs audit */
109	xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
110						   RTF_LOCAL);
111	xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
112	xdst->u.rt6.rt6i_node = rt->rt6i_node;
113	if (rt->rt6i_node)
114		xdst->route_cookie = rt->rt6i_node->fn_sernum;
115	xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
116	xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
117	xdst->u.rt6.rt6i_src = rt->rt6i_src;
118
119	return 0;
120}
121
122static inline void
123_decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
124{
125	struct flowi6 *fl6 = &fl->u.ip6;
126	int onlyproto = 0;
127	u16 offset = skb_network_header_len(skb);
128	struct ipv6hdr *hdr = ipv6_hdr(skb);
129	struct ipv6_opt_hdr *exthdr;
130	const unsigned char *nh = skb_network_header(skb);
131	u8 nexthdr = nh[IP6CB(skb)->nhoff];
132
133	memset(fl6, 0, sizeof(struct flowi6));
134	fl6->flowi6_mark = skb->mark;
135
136	ipv6_addr_copy(&fl6->daddr, reverse ? &hdr->saddr : &hdr->daddr);
137	ipv6_addr_copy(&fl6->saddr, reverse ? &hdr->daddr : &hdr->saddr);
138
139	while (nh + offset + 1 < skb->data ||
140	       pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
141		nh = skb_network_header(skb);
142		exthdr = (struct ipv6_opt_hdr *)(nh + offset);
143
144		switch (nexthdr) {
145		case NEXTHDR_FRAGMENT:
146			onlyproto = 1;
147		case NEXTHDR_ROUTING:
148		case NEXTHDR_HOP:
149		case NEXTHDR_DEST:
150			offset += ipv6_optlen(exthdr);
151			nexthdr = exthdr->nexthdr;
152			exthdr = (struct ipv6_opt_hdr *)(nh + offset);
153			break;
154
155		case IPPROTO_UDP:
156		case IPPROTO_UDPLITE:
157		case IPPROTO_TCP:
158		case IPPROTO_SCTP:
159		case IPPROTO_DCCP:
160			if (!onlyproto && (nh + offset + 4 < skb->data ||
161			     pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
162				__be16 *ports = (__be16 *)exthdr;
163
164				fl6->uli.ports.sport = ports[!!reverse];
165				fl6->uli.ports.dport = ports[!reverse];
166			}
167			fl6->flowi6_proto = nexthdr;
168			return;
169
170		case IPPROTO_ICMPV6:
171			if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
172				u8 *icmp = (u8 *)exthdr;
173
174				fl6->uli.icmpt.type = icmp[0];
175				fl6->uli.icmpt.code = icmp[1];
176			}
177			fl6->flowi6_proto = nexthdr;
178			return;
179
180#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
181		case IPPROTO_MH:
182			if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
183				struct ip6_mh *mh;
184				mh = (struct ip6_mh *)exthdr;
185
186				fl6->uli.mht.type = mh->ip6mh_type;
187			}
188			fl6->flowi6_proto = nexthdr;
189			return;
190#endif
191
192		/* XXX Why are there these headers? */
193		case IPPROTO_AH:
194		case IPPROTO_ESP:
195		case IPPROTO_COMP:
196		default:
197			fl6->uli.spi = 0;
198			fl6->flowi6_proto = nexthdr;
199			return;
200		}
201	}
202}
203
204static inline int xfrm6_garbage_collect(struct dst_ops *ops)
205{
206	struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
207
208	xfrm6_policy_afinfo.garbage_collect(net);
209	return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
210}
211
212static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
213{
214	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
215	struct dst_entry *path = xdst->route;
216
217	path->ops->update_pmtu(path, mtu);
218}
219
220static void xfrm6_dst_destroy(struct dst_entry *dst)
221{
222	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
223
224	if (likely(xdst->u.rt6.rt6i_idev))
225		in6_dev_put(xdst->u.rt6.rt6i_idev);
226	dst_destroy_metrics_generic(dst);
227	if (likely(xdst->u.rt6.rt6i_peer))
228		inet_putpeer(xdst->u.rt6.rt6i_peer);
229	xfrm_dst_destroy(xdst);
230}
231
232static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
233			     int unregister)
234{
235	struct xfrm_dst *xdst;
236
237	if (!unregister)
238		return;
239
240	xdst = (struct xfrm_dst *)dst;
241	if (xdst->u.rt6.rt6i_idev->dev == dev) {
242		struct inet6_dev *loopback_idev =
243			in6_dev_get(dev_net(dev)->loopback_dev);
244		BUG_ON(!loopback_idev);
245
246		do {
247			in6_dev_put(xdst->u.rt6.rt6i_idev);
248			xdst->u.rt6.rt6i_idev = loopback_idev;
249			in6_dev_hold(loopback_idev);
250			xdst = (struct xfrm_dst *)xdst->u.dst.child;
251		} while (xdst->u.dst.xfrm);
252
253		__in6_dev_put(loopback_idev);
254	}
255
256	xfrm_dst_ifdown(dst, dev);
257}
258
259static struct dst_ops xfrm6_dst_ops = {
260	.family =		AF_INET6,
261	.protocol =		cpu_to_be16(ETH_P_IPV6),
262	.gc =			xfrm6_garbage_collect,
263	.update_pmtu =		xfrm6_update_pmtu,
264	.cow_metrics =		dst_cow_metrics_generic,
265	.destroy =		xfrm6_dst_destroy,
266	.ifdown =		xfrm6_dst_ifdown,
267	.local_out =		__ip6_local_out,
268	.gc_thresh =		1024,
269};
270
271static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
272	.family =		AF_INET6,
273	.dst_ops =		&xfrm6_dst_ops,
274	.dst_lookup =		xfrm6_dst_lookup,
275	.get_saddr = 		xfrm6_get_saddr,
276	.decode_session =	_decode_session6,
277	.get_tos =		xfrm6_get_tos,
278	.init_path =		xfrm6_init_path,
279	.fill_dst =		xfrm6_fill_dst,
280	.blackhole_route =	ip6_blackhole_route,
281};
282
283static int __init xfrm6_policy_init(void)
284{
285	return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
286}
287
288static void xfrm6_policy_fini(void)
289{
290	xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
291}
292
293#ifdef CONFIG_SYSCTL
294static struct ctl_table xfrm6_policy_table[] = {
295	{
296		.procname       = "xfrm6_gc_thresh",
297		.data	   	= &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
298		.maxlen	 	= sizeof(int),
299		.mode	   	= 0644,
300		.proc_handler   = proc_dointvec,
301	},
302	{ }
303};
304
305static struct ctl_table_header *sysctl_hdr;
306#endif
307
308int __init xfrm6_init(void)
309{
310	int ret;
311	unsigned int gc_thresh;
312
313	/*
314	 * We need a good default value for the xfrm6 gc threshold.
315	 * In ipv4 we set it to the route hash table size * 8, which
316	 * is half the size of the maximaum route cache for ipv4.  It
317	 * would be good to do the same thing for v6, except the table is
318	 * constructed differently here.  Here each table for a net namespace
319	 * can have FIB_TABLE_HASHSZ entries, so lets go with the same
320	 * computation that we used for ipv4 here.  Also, lets keep the initial
321	 * gc_thresh to a minimum of 1024, since, the ipv6 route cache defaults
322	 * to that as a minimum as well
323	 */
324	gc_thresh = FIB6_TABLE_HASHSZ * 8;
325	xfrm6_dst_ops.gc_thresh = (gc_thresh < 1024) ? 1024 : gc_thresh;
326	dst_entries_init(&xfrm6_dst_ops);
327
328	ret = xfrm6_policy_init();
329	if (ret) {
330		dst_entries_destroy(&xfrm6_dst_ops);
331		goto out;
332	}
333	ret = xfrm6_state_init();
334	if (ret)
335		goto out_policy;
336
337#ifdef CONFIG_SYSCTL
338	sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv6_ctl_path,
339						xfrm6_policy_table);
340#endif
341out:
342	return ret;
343out_policy:
344	xfrm6_policy_fini();
345	goto out;
346}
347
348void xfrm6_fini(void)
349{
350#ifdef CONFIG_SYSCTL
351	if (sysctl_hdr)
352		unregister_net_sysctl_table(sysctl_hdr);
353#endif
354	//xfrm6_input_fini();
355	xfrm6_policy_fini();
356	xfrm6_state_fini();
357	dst_entries_destroy(&xfrm6_dst_ops);
358}
359