net/ipv6/xfrm6_policy.c

   1 /*
   2  * xfrm6_policy.c: based on xfrm4_policy.c
   3  *
   4  * Authors:
   5  *      Mitsuru KANDA @USAGI
   6  *      Kazunori MIYAZAWA @USAGI
   7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
   8  *              IPv6 support
   9  *      YOSHIFUJI Hideaki
  10  *              Split up af-specific portion
  11  *
  12  */
  13
  14 #include <linux/config.h>
  15 #include <net/xfrm.h>
  16 #include <net/ip.h>
  17 #include <net/ipv6.h>
  18 #include <net/ip6_route.h>
  19
  20 extern struct dst_ops xfrm6_dst_ops;
  21 extern struct xfrm_policy_afinfo xfrm6_policy_afinfo;
  22
  23 static struct xfrm_type_map xfrm6_type_map = { .lock = RW_LOCK_UNLOCKED };
  24
  25 int xfrm6_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
  26 {
  27         int err = 0;
  28         err = ip6_dst_lookup(NULL, (struct dst_entry **)dst, fl);
  29         if (err)
  30                 err = -ENETUNREACH;
  31         return err;
  32 }
  33
  34 /* Check that the bundle accepts the flow and its components are
  35  * still valid.
  36  */
  37
  38 static int __xfrm6_bundle_ok(struct xfrm_dst *xdst, struct flowi *fl)
  39 {
  40         do {
  41                 if (xdst->u.dst.ops != &xfrm6_dst_ops)
  42                         return 1;
  43
  44                 if (!xfrm_selector_match(&xdst->u.dst.xfrm->sel, fl, AF_INET6))
  45                         return 0;
  46                 if (xdst->u.dst.xfrm->km.state != XFRM_STATE_VALID ||
  47                     xdst->u.dst.path->obsolete > 0)
  48                         return 0;
  49                 xdst = (struct xfrm_dst*)xdst->u.dst.child;
  50         } while (xdst);
  51         return 0;
  52 }
  53
  54 static struct dst_entry *
  55 __xfrm6_find_bundle(struct flowi *fl, struct rtable *rt, struct xfrm_policy *policy)
  56 {
  57         struct dst_entry *dst;
  58         u32 ndisc_bit = 0;
  59
  60         if (fl->proto == IPPROTO_ICMPV6 &&
  61             (fl->fl_icmp_type == NDISC_NEIGHBOUR_ADVERTISEMENT ||
  62              fl->fl_icmp_type == NDISC_NEIGHBOUR_SOLICITATION  ||
  63              fl->fl_icmp_type == NDISC_ROUTER_SOLICITATION))
  64                 ndisc_bit = RTF_NDISC;
  65
  66         /* Still not clear if we should set fl->fl6_{src,dst}... */
  67         read_lock_bh(&policy->lock);
  68         for (dst = policy->bundles; dst; dst = dst->next) {
  69                 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
  70                 struct in6_addr fl_dst_prefix, fl_src_prefix;
  71
  72                 if ((xdst->u.rt6.rt6i_flags & RTF_NDISC) != ndisc_bit)
  73                         continue;
  74
  75                 ipv6_addr_prefix(&fl_dst_prefix,
  76                                  &fl->fl6_dst,
  77                                  xdst->u.rt6.rt6i_dst.plen);
  78                 ipv6_addr_prefix(&fl_src_prefix,
  79                                  &fl->fl6_src,
  80                                  xdst->u.rt6.rt6i_src.plen);
  81                 if (!ipv6_addr_cmp(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&
  82                     !ipv6_addr_cmp(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) &&
  83                     __xfrm6_bundle_ok(xdst, fl)) {
  84                         dst_clone(dst);
  85                         break;
  86                 }
  87         }
  88         read_unlock_bh(&policy->lock);
  89         return dst;
  90 }
  91
  92 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
  93  * all the metrics... Shortly, bundle a bundle.
  94  */
  95
  96 static int
  97 __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
  98                       struct flowi *fl, struct dst_entry **dst_p)
  99 {
 100         struct dst_entry *dst, *dst_prev;
 101         struct rt6_info *rt0 = (struct rt6_info*)(*dst_p);
 102         struct rt6_info *rt  = rt0;
 103         struct in6_addr *remote = &fl->fl6_dst;
 104         struct in6_addr *local  = &fl->fl6_src;
 105         int i;
 106         int err = 0;
 107         int header_len = 0;
 108         int trailer_len = 0;
 109
 110         dst = dst_prev = NULL;
 111
 112         for (i = 0; i < nx; i++) {
 113                 struct dst_entry *dst1 = dst_alloc(&xfrm6_dst_ops);
 114
 115                 if (unlikely(dst1 == NULL)) {
 116                         err = -ENOBUFS;
 117                         goto error;
 118                 }
 119
 120                 dst1->xfrm = xfrm[i];
 121                 if (!dst)
 122                         dst = dst1;
 123                 else {
 124                         dst_prev->child = dst1;
 125                         dst1->flags |= DST_NOHASH;
 126                         dst_clone(dst1);
 127                 }
 128                 dst_prev = dst1;
 129                 if (xfrm[i]->props.mode) {
 130                         remote = (struct in6_addr*)&xfrm[i]->id.daddr;
 131                         local  = (struct in6_addr*)&xfrm[i]->props.saddr;
 132                 }
 133                 header_len += xfrm[i]->props.header_len;
 134                 trailer_len += xfrm[i]->props.trailer_len;
 135         }
 136
 137         if (ipv6_addr_cmp(remote, &fl->fl6_dst)) {
 138                 struct flowi fl_tunnel;
 139
 140                 memset(&fl_tunnel, 0, sizeof(fl_tunnel));
 141                 ipv6_addr_copy(&fl_tunnel.fl6_dst, remote);
 142                 ipv6_addr_copy(&fl_tunnel.fl6_src, local);
 143
 144                 err = xfrm_dst_lookup((struct xfrm_dst **) &rt,
 145                                       &fl_tunnel, AF_INET6);
 146                 if (err)
 147                         goto error;
 148         } else {
 149                 dst_hold(&rt->u.dst);
 150         }
 151         dst_prev->child = &rt->u.dst;
 152         for (dst_prev = dst; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
 153                 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
 154
 155                 dst_prev->dev = rt->u.dst.dev;
 156                 if (rt->u.dst.dev)
 157                         dev_hold(rt->u.dst.dev);
 158                 dst_prev->obsolete      = -1;
 159                 dst_prev->flags        |= DST_HOST;
 160                 dst_prev->lastuse       = jiffies;
 161                 dst_prev->header_len    = header_len;
 162                 dst_prev->trailer_len   = trailer_len;
 163                 memcpy(&dst_prev->metrics, &rt->u.dst.metrics, sizeof(dst_prev->metrics));
 164                 dst_prev->path          = &rt->u.dst;
 165
 166                 /* Copy neighbour for reachability confirmation */
 167                 dst_prev->neighbour     = neigh_clone(rt->u.dst.neighbour);
 168                 dst_prev->input         = rt->u.dst.input;
 169                 dst_prev->output        = dst_prev->xfrm->type->output;
 170                 /* Sheit... I remember I did this right. Apparently,
 171                  * it was magically lost, so this code needs audit */
 172                 x->u.rt6.rt6i_flags    = rt0->rt6i_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL|RTF_NDISC);
 173                 x->u.rt6.rt6i_metric   = rt0->rt6i_metric;
 174                 x->u.rt6.rt6i_node     = rt0->rt6i_node;
 175                 x->u.rt6.rt6i_gateway  = rt0->rt6i_gateway;
 176                 memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway));
 177                 x->u.rt6.rt6i_dst      = rt0->rt6i_dst;
 178                 x->u.rt6.rt6i_src      = rt0->rt6i_src;
 179                 header_len -= x->u.dst.xfrm->props.header_len;
 180                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
 181         }
 182         *dst_p = dst;
 183         return 0;
 184
 185 error:
 186         if (dst)
 187                 dst_free(dst);
 188         return err;
 189 }
 190
 191 static inline void
 192 _decode_session6(struct sk_buff *skb, struct flowi *fl)
 193 {
 194         u16 offset = sizeof(struct ipv6hdr);
 195         struct ipv6hdr *hdr = skb->nh.ipv6h;
 196         struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
 197         u8 nexthdr = skb->nh.ipv6h->nexthdr;
 198
 199         memset(fl, 0, sizeof(struct flowi));
 200         ipv6_addr_copy(&fl->fl6_dst, &hdr->daddr);
 201         ipv6_addr_copy(&fl->fl6_src, &hdr->saddr);
 202
 203         while (pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data)) {
 204                 switch (nexthdr) {
 205                 case NEXTHDR_ROUTING:
 206                 case NEXTHDR_HOP:
 207                 case NEXTHDR_DEST:
 208                         offset += ipv6_optlen(exthdr);
 209                         nexthdr = exthdr->nexthdr;
 210                         exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
 211                         break;
 212
 213                 case IPPROTO_UDP:
 214                 case IPPROTO_TCP:
 215                 case IPPROTO_SCTP:
 216                         if (pskb_may_pull(skb, skb->nh.raw + offset + 4 - skb->data)) {
 217                                 u16 *ports = (u16 *)exthdr;
 218
 219                                 fl->fl_ip_sport = ports[0];
 220                                 fl->fl_ip_dport = ports[1];
 221                         }
 222                         fl->proto = nexthdr;
 223                         return;
 224
 225                 /* XXX Why are there these headers? */
 226                 case IPPROTO_AH:
 227                 case IPPROTO_ESP:
 228                 case IPPROTO_COMP:
 229                 default:
 230                         fl->fl_ipsec_spi = 0;
 231                         fl->proto = nexthdr;
 232                         return;
 233                 };
 234         }
 235 }
 236
 237 static inline int xfrm6_garbage_collect(void)
 238 {
 239         read_lock(&xfrm6_policy_afinfo.lock);
 240         xfrm6_policy_afinfo.garbage_collect();
 241         read_unlock(&xfrm6_policy_afinfo.lock);
 242         return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2);
 243 }
 244
 245 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
 246 {
 247         struct dst_entry *path = dst->path;
 248
 249         if (mtu >= 1280 && mtu < dst_pmtu(dst))
 250                 return;
 251
 252         path->ops->update_pmtu(path, mtu);
 253 }
 254
 255 struct dst_ops xfrm6_dst_ops = {
 256         .family =               AF_INET6,
 257         .protocol =             __constant_htons(ETH_P_IPV6),
 258         .gc =                   xfrm6_garbage_collect,
 259         .update_pmtu =          xfrm6_update_pmtu,
 260         .gc_thresh =            1024,
 261         .entry_size =           sizeof(struct xfrm_dst),
 262 };
 263
 264 struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
 265         .family =               AF_INET6,
 266         .lock =                 RW_LOCK_UNLOCKED,
 267         .type_map =             &xfrm6_type_map,
 268         .dst_ops =              &xfrm6_dst_ops,
 269         .dst_lookup =           xfrm6_dst_lookup,
 270         .find_bundle =          __xfrm6_find_bundle,
 271         .bundle_create =        __xfrm6_bundle_create,
 272         .decode_session =       _decode_session6,
 273 };
 274
 275 void __init xfrm6_policy_init(void)
 276 {
 277         xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
 278 }
 279
 280 void __exit xfrm6_policy_fini(void)
 281 {
 282         xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
 283 }
 284
 285 /* XXX: xfrm6_tunnel.c */
 286 extern int ip6ip6_init(void);
 287 extern void ip6ip6_fini(void);
 288
 289 void __init xfrm6_init(void)
 290 {
 291         xfrm6_policy_init();
 292         xfrm6_state_init();
 293         ip6ip6_init(); /* XXX: xfrm6_tunnel.c */
 294 }
 295
 296 void __exit xfrm6_fini(void)
 297 {
 298         ip6ip6_fini(); /* XXX: xfrm6_tunnel.c */
 299         //xfrm6_input_fini();
 300         xfrm6_policy_fini();
 301         xfrm6_state_fini();
 302 }