1 /* 2 * xfrm4_policy.c 3 * 4 * Changes: 5 * Kazunori MIYAZAWA @USAGI 6 * YOSHIFUJI Hideaki @USAGI 7 * Split up af-specific portion 8 * 9 */ 10 11 #include <linux/err.h> 12 #include <linux/kernel.h> 13 #include <linux/inetdevice.h> 14 #include <linux/if_tunnel.h> 15 #include <net/dst.h> 16 #include <net/xfrm.h> 17 #include <net/ip.h> 18 19 static struct xfrm_policy_afinfo xfrm4_policy_afinfo; 20 21 static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4, 22 int tos, 23 const xfrm_address_t *saddr, 24 const xfrm_address_t *daddr) 25 { 26 struct rtable *rt; 27 28 memset(fl4, 0, sizeof(*fl4)); 29 fl4->daddr = daddr->a4; 30 fl4->flowi4_tos = tos; 31 if (saddr) 32 fl4->saddr = saddr->a4; 33 34 rt = __ip_route_output_key(net, fl4); 35 if (!IS_ERR(rt)) 36 return &rt->dst; 37 38 return ERR_CAST(rt); 39 } 40 41 static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, 42 const xfrm_address_t *saddr, 43 const xfrm_address_t *daddr) 44 { 45 struct flowi4 fl4; 46 47 return __xfrm4_dst_lookup(net, &fl4, tos, saddr, daddr); 48 } 49 50 static int xfrm4_get_saddr(struct net *net, 51 xfrm_address_t *saddr, xfrm_address_t *daddr) 52 { 53 struct dst_entry *dst; 54 struct flowi4 fl4; 55 56 dst = __xfrm4_dst_lookup(net, &fl4, 0, NULL, daddr); 57 if (IS_ERR(dst)) 58 return -EHOSTUNREACH; 59 60 saddr->a4 = fl4.saddr; 61 dst_release(dst); 62 return 0; 63 } 64 65 static int xfrm4_get_tos(const struct flowi *fl) 66 { 67 return IPTOS_RT_MASK & fl->u.ip4.flowi4_tos; /* Strip ECN bits */ 68 } 69 70 static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst, 71 int nfheader_len) 72 { 73 return 0; 74 } 75 76 static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, 77 const struct flowi *fl) 78 { 79 struct rtable *rt = (struct rtable *)xdst->route; 80 const struct flowi4 *fl4 = &fl->u.ip4; 81 82 xdst->u.rt.rt_iif = fl4->flowi4_iif; 83 84 xdst->u.dst.dev = dev; 85 dev_hold(dev); 86 87 /* Sheit... I remember I did this right. Apparently, 88 * it was magically lost, so this code needs audit */ 89 xdst->u.rt.rt_is_input = rt->rt_is_input; 90 xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | 91 RTCF_LOCAL); 92 xdst->u.rt.rt_type = rt->rt_type; 93 xdst->u.rt.rt_gateway = rt->rt_gateway; 94 xdst->u.rt.rt_pmtu = rt->rt_pmtu; 95 INIT_LIST_HEAD(&xdst->u.rt.rt_uncached); 96 97 return 0; 98 } 99 100 static void 101 _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) 102 { 103 const struct iphdr *iph = ip_hdr(skb); 104 u8 *xprth = skb_network_header(skb) + iph->ihl * 4; 105 struct flowi4 *fl4 = &fl->u.ip4; 106 107 memset(fl4, 0, sizeof(struct flowi4)); 108 fl4->flowi4_mark = skb->mark; 109 110 if (!ip_is_fragment(iph)) { 111 switch (iph->protocol) { 112 case IPPROTO_UDP: 113 case IPPROTO_UDPLITE: 114 case IPPROTO_TCP: 115 case IPPROTO_SCTP: 116 case IPPROTO_DCCP: 117 if (xprth + 4 < skb->data || 118 pskb_may_pull(skb, xprth + 4 - skb->data)) { 119 __be16 *ports = (__be16 *)xprth; 120 121 fl4->fl4_sport = ports[!!reverse]; 122 fl4->fl4_dport = ports[!reverse]; 123 } 124 break; 125 126 case IPPROTO_ICMP: 127 if (pskb_may_pull(skb, xprth + 2 - skb->data)) { 128 u8 *icmp = xprth; 129 130 fl4->fl4_icmp_type = icmp[0]; 131 fl4->fl4_icmp_code = icmp[1]; 132 } 133 break; 134 135 case IPPROTO_ESP: 136 if (pskb_may_pull(skb, xprth + 4 - skb->data)) { 137 __be32 *ehdr = (__be32 *)xprth; 138 139 fl4->fl4_ipsec_spi = ehdr[0]; 140 } 141 break; 142 143 case IPPROTO_AH: 144 if (pskb_may_pull(skb, xprth + 8 - skb->data)) { 145 __be32 *ah_hdr = (__be32 *)xprth; 146 147 fl4->fl4_ipsec_spi = ah_hdr[1]; 148 } 149 break; 150 151 case IPPROTO_COMP: 152 if (pskb_may_pull(skb, xprth + 4 - skb->data)) { 153 __be16 *ipcomp_hdr = (__be16 *)xprth; 154 155 fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); 156 } 157 break; 158 159 case IPPROTO_GRE: 160 if (pskb_may_pull(skb, xprth + 12 - skb->data)) { 161 __be16 *greflags = (__be16 *)xprth; 162 __be32 *gre_hdr = (__be32 *)xprth; 163 164 if (greflags[0] & GRE_KEY) { 165 if (greflags[0] & GRE_CSUM) 166 gre_hdr++; 167 fl4->fl4_gre_key = gre_hdr[1]; 168 } 169 } 170 break; 171 172 default: 173 fl4->fl4_ipsec_spi = 0; 174 break; 175 } 176 } 177 fl4->flowi4_proto = iph->protocol; 178 fl4->daddr = reverse ? iph->saddr : iph->daddr; 179 fl4->saddr = reverse ? iph->daddr : iph->saddr; 180 fl4->flowi4_tos = iph->tos; 181 } 182 183 static inline int xfrm4_garbage_collect(struct dst_ops *ops) 184 { 185 struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops); 186 187 xfrm4_policy_afinfo.garbage_collect(net); 188 return (dst_entries_get_slow(ops) > ops->gc_thresh * 2); 189 } 190 191 static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk, 192 struct sk_buff *skb, u32 mtu) 193 { 194 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 195 struct dst_entry *path = xdst->route; 196 197 path->ops->update_pmtu(path, sk, skb, mtu); 198 } 199 200 static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk, 201 struct sk_buff *skb) 202 { 203 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 204 struct dst_entry *path = xdst->route; 205 206 path->ops->redirect(path, sk, skb); 207 } 208 209 static void xfrm4_dst_destroy(struct dst_entry *dst) 210 { 211 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 212 213 dst_destroy_metrics_generic(dst); 214 215 xfrm_dst_destroy(xdst); 216 } 217 218 static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, 219 int unregister) 220 { 221 if (!unregister) 222 return; 223 224 xfrm_dst_ifdown(dst, dev); 225 } 226 227 static struct dst_ops xfrm4_dst_ops = { 228 .family = AF_INET, 229 .protocol = cpu_to_be16(ETH_P_IP), 230 .gc = xfrm4_garbage_collect, 231 .update_pmtu = xfrm4_update_pmtu, 232 .redirect = xfrm4_redirect, 233 .cow_metrics = dst_cow_metrics_generic, 234 .destroy = xfrm4_dst_destroy, 235 .ifdown = xfrm4_dst_ifdown, 236 .local_out = __ip_local_out, 237 .gc_thresh = 1024, 238 }; 239 240 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { 241 .family = AF_INET, 242 .dst_ops = &xfrm4_dst_ops, 243 .dst_lookup = xfrm4_dst_lookup, 244 .get_saddr = xfrm4_get_saddr, 245 .decode_session = _decode_session4, 246 .get_tos = xfrm4_get_tos, 247 .init_path = xfrm4_init_path, 248 .fill_dst = xfrm4_fill_dst, 249 .blackhole_route = ipv4_blackhole_route, 250 }; 251 252 #ifdef CONFIG_SYSCTL 253 static struct ctl_table xfrm4_policy_table[] = { 254 { 255 .procname = "xfrm4_gc_thresh", 256 .data = &init_net.xfrm.xfrm4_dst_ops.gc_thresh, 257 .maxlen = sizeof(int), 258 .mode = 0644, 259 .proc_handler = proc_dointvec, 260 }, 261 { } 262 }; 263 264 static struct ctl_table_header *sysctl_hdr; 265 #endif 266 267 static void __init xfrm4_policy_init(void) 268 { 269 xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); 270 } 271 272 static void __exit xfrm4_policy_fini(void) 273 { 274 #ifdef CONFIG_SYSCTL 275 if (sysctl_hdr) 276 unregister_net_sysctl_table(sysctl_hdr); 277 #endif 278 xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo); 279 } 280 281 void __init xfrm4_init(int rt_max_size) 282 { 283 /* 284 * Select a default value for the gc_thresh based on the main route 285 * table hash size. It seems to me the worst case scenario is when 286 * we have ipsec operating in transport mode, in which we create a 287 * dst_entry per socket. The xfrm gc algorithm starts trying to remove 288 * entries at gc_thresh, and prevents new allocations as 2*gc_thresh 289 * so lets set an initial xfrm gc_thresh value at the rt_max_size/2. 290 * That will let us store an ipsec connection per route table entry, 291 * and start cleaning when were 1/2 full 292 */ 293 xfrm4_dst_ops.gc_thresh = rt_max_size/2; 294 dst_entries_init(&xfrm4_dst_ops); 295 296 xfrm4_state_init(); 297 xfrm4_policy_init(); 298 #ifdef CONFIG_SYSCTL 299 sysctl_hdr = register_net_sysctl(&init_net, "net/ipv4", 300 xfrm4_policy_table); 301 #endif 302 } 303 304