1 /* 2 * xfrm6_policy.c: based on xfrm4_policy.c 3 * 4 * Authors: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * YOSHIFUJI Hideaki 10 * Split up af-specific portion 11 * 12 */ 13 14 #include <linux/err.h> 15 #include <linux/kernel.h> 16 #include <linux/netdevice.h> 17 #include <net/addrconf.h> 18 #include <net/dst.h> 19 #include <net/xfrm.h> 20 #include <net/ip.h> 21 #include <net/ipv6.h> 22 #include <net/ip6_route.h> 23 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 24 #include <net/mip6.h> 25 #endif 26 27 static struct dst_ops xfrm6_dst_ops; 28 static struct xfrm_policy_afinfo xfrm6_policy_afinfo; 29 30 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, 31 xfrm_address_t *saddr, 32 xfrm_address_t *daddr) 33 { 34 struct flowi fl = {}; 35 struct dst_entry *dst; 36 int err; 37 38 memcpy(&fl.fl6_dst, daddr, sizeof(fl.fl6_dst)); 39 if (saddr) 40 memcpy(&fl.fl6_src, saddr, sizeof(fl.fl6_src)); 41 42 dst = ip6_route_output(net, NULL, &fl); 43 44 err = dst->error; 45 if (dst->error) { 46 dst_release(dst); 47 dst = ERR_PTR(err); 48 } 49 50 return dst; 51 } 52 53 static int xfrm6_get_saddr(struct net *net, 54 xfrm_address_t *saddr, xfrm_address_t *daddr) 55 { 56 struct dst_entry *dst; 57 struct net_device *dev; 58 59 dst = xfrm6_dst_lookup(net, 0, NULL, daddr); 60 if (IS_ERR(dst)) 61 return -EHOSTUNREACH; 62 63 dev = ip6_dst_idev(dst)->dev; 64 ipv6_dev_get_saddr(dev_net(dev), dev, 65 (struct in6_addr *)&daddr->a6, 0, 66 (struct in6_addr *)&saddr->a6); 67 dst_release(dst); 68 return 0; 69 } 70 71 static struct dst_entry * 72 __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy) 73 { 74 struct dst_entry *dst; 75 76 /* Still not clear if we should set fl->fl6_{src,dst}... */ 77 read_lock_bh(&policy->lock); 78 for (dst = policy->bundles; dst; dst = dst->next) { 79 struct xfrm_dst *xdst = (struct xfrm_dst*)dst; 80 struct in6_addr fl_dst_prefix, fl_src_prefix; 81 82 ipv6_addr_prefix(&fl_dst_prefix, 83 &fl->fl6_dst, 84 xdst->u.rt6.rt6i_dst.plen); 85 ipv6_addr_prefix(&fl_src_prefix, 86 &fl->fl6_src, 87 xdst->u.rt6.rt6i_src.plen); 88 if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) && 89 ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) && 90 xfrm_bundle_ok(policy, xdst, fl, AF_INET6, 91 (xdst->u.rt6.rt6i_dst.plen != 128 || 92 xdst->u.rt6.rt6i_src.plen != 128))) { 93 dst_clone(dst); 94 break; 95 } 96 } 97 read_unlock_bh(&policy->lock); 98 return dst; 99 } 100 101 static int xfrm6_get_tos(struct flowi *fl) 102 { 103 return 0; 104 } 105 106 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst, 107 int nfheader_len) 108 { 109 if (dst->ops->family == AF_INET6) { 110 struct rt6_info *rt = (struct rt6_info*)dst; 111 if (rt->rt6i_node) 112 path->path_cookie = rt->rt6i_node->fn_sernum; 113 } 114 115 path->u.rt6.rt6i_nfheader_len = nfheader_len; 116 117 return 0; 118 } 119 120 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev) 121 { 122 struct rt6_info *rt = (struct rt6_info*)xdst->route; 123 124 xdst->u.dst.dev = dev; 125 dev_hold(dev); 126 127 xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev); 128 if (!xdst->u.rt6.rt6i_idev) 129 return -ENODEV; 130 131 /* Sheit... I remember I did this right. Apparently, 132 * it was magically lost, so this code needs audit */ 133 xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST | 134 RTF_LOCAL); 135 xdst->u.rt6.rt6i_metric = rt->rt6i_metric; 136 xdst->u.rt6.rt6i_node = rt->rt6i_node; 137 if (rt->rt6i_node) 138 xdst->route_cookie = rt->rt6i_node->fn_sernum; 139 xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway; 140 xdst->u.rt6.rt6i_dst = rt->rt6i_dst; 141 xdst->u.rt6.rt6i_src = rt->rt6i_src; 142 143 return 0; 144 } 145 146 static inline void 147 _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) 148 { 149 int onlyproto = 0; 150 u16 offset = skb_network_header_len(skb); 151 struct ipv6hdr *hdr = ipv6_hdr(skb); 152 struct ipv6_opt_hdr *exthdr; 153 const unsigned char *nh = skb_network_header(skb); 154 u8 nexthdr = nh[IP6CB(skb)->nhoff]; 155 156 memset(fl, 0, sizeof(struct flowi)); 157 ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr); 158 ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr); 159 160 while (nh + offset + 1 < skb->data || 161 pskb_may_pull(skb, nh + offset + 1 - skb->data)) { 162 nh = skb_network_header(skb); 163 exthdr = (struct ipv6_opt_hdr *)(nh + offset); 164 165 switch (nexthdr) { 166 case NEXTHDR_FRAGMENT: 167 onlyproto = 1; 168 case NEXTHDR_ROUTING: 169 case NEXTHDR_HOP: 170 case NEXTHDR_DEST: 171 offset += ipv6_optlen(exthdr); 172 nexthdr = exthdr->nexthdr; 173 exthdr = (struct ipv6_opt_hdr *)(nh + offset); 174 break; 175 176 case IPPROTO_UDP: 177 case IPPROTO_UDPLITE: 178 case IPPROTO_TCP: 179 case IPPROTO_SCTP: 180 case IPPROTO_DCCP: 181 if (!onlyproto && (nh + offset + 4 < skb->data || 182 pskb_may_pull(skb, nh + offset + 4 - skb->data))) { 183 __be16 *ports = (__be16 *)exthdr; 184 185 fl->fl_ip_sport = ports[!!reverse]; 186 fl->fl_ip_dport = ports[!reverse]; 187 } 188 fl->proto = nexthdr; 189 return; 190 191 case IPPROTO_ICMPV6: 192 if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) { 193 u8 *icmp = (u8 *)exthdr; 194 195 fl->fl_icmp_type = icmp[0]; 196 fl->fl_icmp_code = icmp[1]; 197 } 198 fl->proto = nexthdr; 199 return; 200 201 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 202 case IPPROTO_MH: 203 if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) { 204 struct ip6_mh *mh; 205 mh = (struct ip6_mh *)exthdr; 206 207 fl->fl_mh_type = mh->ip6mh_type; 208 } 209 fl->proto = nexthdr; 210 return; 211 #endif 212 213 /* XXX Why are there these headers? */ 214 case IPPROTO_AH: 215 case IPPROTO_ESP: 216 case IPPROTO_COMP: 217 default: 218 fl->fl_ipsec_spi = 0; 219 fl->proto = nexthdr; 220 return; 221 } 222 } 223 } 224 225 static inline int xfrm6_garbage_collect(struct dst_ops *ops) 226 { 227 xfrm6_policy_afinfo.garbage_collect(&init_net); 228 return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2); 229 } 230 231 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu) 232 { 233 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 234 struct dst_entry *path = xdst->route; 235 236 path->ops->update_pmtu(path, mtu); 237 } 238 239 static void xfrm6_dst_destroy(struct dst_entry *dst) 240 { 241 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 242 243 if (likely(xdst->u.rt6.rt6i_idev)) 244 in6_dev_put(xdst->u.rt6.rt6i_idev); 245 xfrm_dst_destroy(xdst); 246 } 247 248 static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev, 249 int unregister) 250 { 251 struct xfrm_dst *xdst; 252 253 if (!unregister) 254 return; 255 256 xdst = (struct xfrm_dst *)dst; 257 if (xdst->u.rt6.rt6i_idev->dev == dev) { 258 struct inet6_dev *loopback_idev = 259 in6_dev_get(dev_net(dev)->loopback_dev); 260 BUG_ON(!loopback_idev); 261 262 do { 263 in6_dev_put(xdst->u.rt6.rt6i_idev); 264 xdst->u.rt6.rt6i_idev = loopback_idev; 265 in6_dev_hold(loopback_idev); 266 xdst = (struct xfrm_dst *)xdst->u.dst.child; 267 } while (xdst->u.dst.xfrm); 268 269 __in6_dev_put(loopback_idev); 270 } 271 272 xfrm_dst_ifdown(dst, dev); 273 } 274 275 static struct dst_ops xfrm6_dst_ops = { 276 .family = AF_INET6, 277 .protocol = cpu_to_be16(ETH_P_IPV6), 278 .gc = xfrm6_garbage_collect, 279 .update_pmtu = xfrm6_update_pmtu, 280 .destroy = xfrm6_dst_destroy, 281 .ifdown = xfrm6_dst_ifdown, 282 .local_out = __ip6_local_out, 283 .gc_thresh = 1024, 284 .entries = ATOMIC_INIT(0), 285 }; 286 287 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = { 288 .family = AF_INET6, 289 .dst_ops = &xfrm6_dst_ops, 290 .dst_lookup = xfrm6_dst_lookup, 291 .get_saddr = xfrm6_get_saddr, 292 .find_bundle = __xfrm6_find_bundle, 293 .decode_session = _decode_session6, 294 .get_tos = xfrm6_get_tos, 295 .init_path = xfrm6_init_path, 296 .fill_dst = xfrm6_fill_dst, 297 }; 298 299 static int __init xfrm6_policy_init(void) 300 { 301 return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo); 302 } 303 304 static void xfrm6_policy_fini(void) 305 { 306 xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo); 307 } 308 309 int __init xfrm6_init(void) 310 { 311 int ret; 312 313 ret = xfrm6_policy_init(); 314 if (ret) 315 goto out; 316 317 ret = xfrm6_state_init(); 318 if (ret) 319 goto out_policy; 320 out: 321 return ret; 322 out_policy: 323 xfrm6_policy_fini(); 324 goto out; 325 } 326 327 void xfrm6_fini(void) 328 { 329 //xfrm6_input_fini(); 330 xfrm6_policy_fini(); 331 xfrm6_state_fini(); 332 } 333