xref: /openbmc/linux/net/ipv4/xfrm4_policy.c (revision b6dcefde)
1 /*
2  * xfrm4_policy.c
3  *
4  * Changes:
5  *	Kazunori MIYAZAWA @USAGI
6  * 	YOSHIFUJI Hideaki @USAGI
7  *		Split up af-specific portion
8  *
9  */
10 
11 #include <linux/err.h>
12 #include <linux/kernel.h>
13 #include <linux/inetdevice.h>
14 #include <net/dst.h>
15 #include <net/xfrm.h>
16 #include <net/ip.h>
17 
18 static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
19 
20 static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
21 					  xfrm_address_t *saddr,
22 					  xfrm_address_t *daddr)
23 {
24 	struct flowi fl = {
25 		.nl_u = {
26 			.ip4_u = {
27 				.tos = tos,
28 				.daddr = daddr->a4,
29 			},
30 		},
31 	};
32 	struct dst_entry *dst;
33 	struct rtable *rt;
34 	int err;
35 
36 	if (saddr)
37 		fl.fl4_src = saddr->a4;
38 
39 	err = __ip_route_output_key(net, &rt, &fl);
40 	dst = &rt->u.dst;
41 	if (err)
42 		dst = ERR_PTR(err);
43 	return dst;
44 }
45 
46 static int xfrm4_get_saddr(struct net *net,
47 			   xfrm_address_t *saddr, xfrm_address_t *daddr)
48 {
49 	struct dst_entry *dst;
50 	struct rtable *rt;
51 
52 	dst = xfrm4_dst_lookup(net, 0, NULL, daddr);
53 	if (IS_ERR(dst))
54 		return -EHOSTUNREACH;
55 
56 	rt = (struct rtable *)dst;
57 	saddr->a4 = rt->rt_src;
58 	dst_release(dst);
59 	return 0;
60 }
61 
62 static struct dst_entry *
63 __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
64 {
65 	struct dst_entry *dst;
66 
67 	read_lock_bh(&policy->lock);
68 	for (dst = policy->bundles; dst; dst = dst->next) {
69 		struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
70 		if (xdst->u.rt.fl.oif == fl->oif &&	/*XXX*/
71 		    xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
72 		    xdst->u.rt.fl.fl4_src == fl->fl4_src &&
73 		    xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
74 		    xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
75 			dst_clone(dst);
76 			break;
77 		}
78 	}
79 	read_unlock_bh(&policy->lock);
80 	return dst;
81 }
82 
83 static int xfrm4_get_tos(struct flowi *fl)
84 {
85 	return fl->fl4_tos;
86 }
87 
88 static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
89 			   int nfheader_len)
90 {
91 	return 0;
92 }
93 
94 static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
95 {
96 	struct rtable *rt = (struct rtable *)xdst->route;
97 
98 	xdst->u.rt.fl = rt->fl;
99 
100 	xdst->u.dst.dev = dev;
101 	dev_hold(dev);
102 
103 	xdst->u.rt.idev = in_dev_get(dev);
104 	if (!xdst->u.rt.idev)
105 		return -ENODEV;
106 
107 	xdst->u.rt.peer = rt->peer;
108 	if (rt->peer)
109 		atomic_inc(&rt->peer->refcnt);
110 
111 	/* Sheit... I remember I did this right. Apparently,
112 	 * it was magically lost, so this code needs audit */
113 	xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST |
114 					      RTCF_LOCAL);
115 	xdst->u.rt.rt_type = rt->rt_type;
116 	xdst->u.rt.rt_src = rt->rt_src;
117 	xdst->u.rt.rt_dst = rt->rt_dst;
118 	xdst->u.rt.rt_gateway = rt->rt_gateway;
119 	xdst->u.rt.rt_spec_dst = rt->rt_spec_dst;
120 
121 	return 0;
122 }
123 
124 static void
125 _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
126 {
127 	struct iphdr *iph = ip_hdr(skb);
128 	u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
129 
130 	memset(fl, 0, sizeof(struct flowi));
131 	if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
132 		switch (iph->protocol) {
133 		case IPPROTO_UDP:
134 		case IPPROTO_UDPLITE:
135 		case IPPROTO_TCP:
136 		case IPPROTO_SCTP:
137 		case IPPROTO_DCCP:
138 			if (xprth + 4 < skb->data ||
139 			    pskb_may_pull(skb, xprth + 4 - skb->data)) {
140 				__be16 *ports = (__be16 *)xprth;
141 
142 				fl->fl_ip_sport = ports[!!reverse];
143 				fl->fl_ip_dport = ports[!reverse];
144 			}
145 			break;
146 
147 		case IPPROTO_ICMP:
148 			if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
149 				u8 *icmp = xprth;
150 
151 				fl->fl_icmp_type = icmp[0];
152 				fl->fl_icmp_code = icmp[1];
153 			}
154 			break;
155 
156 		case IPPROTO_ESP:
157 			if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
158 				__be32 *ehdr = (__be32 *)xprth;
159 
160 				fl->fl_ipsec_spi = ehdr[0];
161 			}
162 			break;
163 
164 		case IPPROTO_AH:
165 			if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
166 				__be32 *ah_hdr = (__be32*)xprth;
167 
168 				fl->fl_ipsec_spi = ah_hdr[1];
169 			}
170 			break;
171 
172 		case IPPROTO_COMP:
173 			if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
174 				__be16 *ipcomp_hdr = (__be16 *)xprth;
175 
176 				fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
177 			}
178 			break;
179 		default:
180 			fl->fl_ipsec_spi = 0;
181 			break;
182 		}
183 	}
184 	fl->proto = iph->protocol;
185 	fl->fl4_dst = reverse ? iph->saddr : iph->daddr;
186 	fl->fl4_src = reverse ? iph->daddr : iph->saddr;
187 	fl->fl4_tos = iph->tos;
188 }
189 
190 static inline int xfrm4_garbage_collect(struct dst_ops *ops)
191 {
192 	struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops);
193 
194 	xfrm4_policy_afinfo.garbage_collect(net);
195 	return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
196 }
197 
198 static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
199 {
200 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
201 	struct dst_entry *path = xdst->route;
202 
203 	path->ops->update_pmtu(path, mtu);
204 }
205 
206 static void xfrm4_dst_destroy(struct dst_entry *dst)
207 {
208 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
209 
210 	if (likely(xdst->u.rt.idev))
211 		in_dev_put(xdst->u.rt.idev);
212 	if (likely(xdst->u.rt.peer))
213 		inet_putpeer(xdst->u.rt.peer);
214 	xfrm_dst_destroy(xdst);
215 }
216 
217 static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
218 			     int unregister)
219 {
220 	struct xfrm_dst *xdst;
221 
222 	if (!unregister)
223 		return;
224 
225 	xdst = (struct xfrm_dst *)dst;
226 	if (xdst->u.rt.idev->dev == dev) {
227 		struct in_device *loopback_idev =
228 			in_dev_get(dev_net(dev)->loopback_dev);
229 		BUG_ON(!loopback_idev);
230 
231 		do {
232 			in_dev_put(xdst->u.rt.idev);
233 			xdst->u.rt.idev = loopback_idev;
234 			in_dev_hold(loopback_idev);
235 			xdst = (struct xfrm_dst *)xdst->u.dst.child;
236 		} while (xdst->u.dst.xfrm);
237 
238 		__in_dev_put(loopback_idev);
239 	}
240 
241 	xfrm_dst_ifdown(dst, dev);
242 }
243 
244 static struct dst_ops xfrm4_dst_ops = {
245 	.family =		AF_INET,
246 	.protocol =		cpu_to_be16(ETH_P_IP),
247 	.gc =			xfrm4_garbage_collect,
248 	.update_pmtu =		xfrm4_update_pmtu,
249 	.destroy =		xfrm4_dst_destroy,
250 	.ifdown =		xfrm4_dst_ifdown,
251 	.local_out =		__ip_local_out,
252 	.gc_thresh =		1024,
253 	.entries =		ATOMIC_INIT(0),
254 };
255 
256 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
257 	.family = 		AF_INET,
258 	.dst_ops =		&xfrm4_dst_ops,
259 	.dst_lookup =		xfrm4_dst_lookup,
260 	.get_saddr =		xfrm4_get_saddr,
261 	.find_bundle = 		__xfrm4_find_bundle,
262 	.decode_session =	_decode_session4,
263 	.get_tos =		xfrm4_get_tos,
264 	.init_path =		xfrm4_init_path,
265 	.fill_dst =		xfrm4_fill_dst,
266 };
267 
268 #ifdef CONFIG_SYSCTL
269 static struct ctl_table xfrm4_policy_table[] = {
270 	{
271 		.procname       = "xfrm4_gc_thresh",
272 		.data           = &init_net.xfrm.xfrm4_dst_ops.gc_thresh,
273 		.maxlen         = sizeof(int),
274 		.mode           = 0644,
275 		.proc_handler   = proc_dointvec,
276 	},
277 	{ }
278 };
279 
280 static struct ctl_table_header *sysctl_hdr;
281 #endif
282 
283 static void __init xfrm4_policy_init(void)
284 {
285 	xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
286 }
287 
288 static void __exit xfrm4_policy_fini(void)
289 {
290 #ifdef CONFIG_SYSCTL
291 	if (sysctl_hdr)
292 		unregister_net_sysctl_table(sysctl_hdr);
293 #endif
294 	xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
295 }
296 
297 void __init xfrm4_init(int rt_max_size)
298 {
299 	/*
300 	 * Select a default value for the gc_thresh based on the main route
301 	 * table hash size.  It seems to me the worst case scenario is when
302 	 * we have ipsec operating in transport mode, in which we create a
303 	 * dst_entry per socket.  The xfrm gc algorithm starts trying to remove
304 	 * entries at gc_thresh, and prevents new allocations as 2*gc_thresh
305 	 * so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
306 	 * That will let us store an ipsec connection per route table entry,
307 	 * and start cleaning when were 1/2 full
308 	 */
309 	xfrm4_dst_ops.gc_thresh = rt_max_size/2;
310 
311 	xfrm4_state_init();
312 	xfrm4_policy_init();
313 #ifdef CONFIG_SYSCTL
314 	sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path,
315 						xfrm4_policy_table);
316 #endif
317 }
318 
319