xref: /openbmc/linux/net/ipv6/xfrm6_policy.c (revision 93df8a1e)
1 /*
2  * xfrm6_policy.c: based on xfrm4_policy.c
3  *
4  * Authors:
5  *	Mitsuru KANDA @USAGI
6  *	Kazunori MIYAZAWA @USAGI
7  *	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8  *		IPv6 support
9  *	YOSHIFUJI Hideaki
10  *		Split up af-specific portion
11  *
12  */
13 
14 #include <linux/err.h>
15 #include <linux/kernel.h>
16 #include <linux/netdevice.h>
17 #include <net/addrconf.h>
18 #include <net/dst.h>
19 #include <net/xfrm.h>
20 #include <net/ip.h>
21 #include <net/ipv6.h>
22 #include <net/ip6_route.h>
23 #if IS_ENABLED(CONFIG_IPV6_MIP6)
24 #include <net/mip6.h>
25 #endif
26 
27 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
28 
29 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
30 					  const xfrm_address_t *saddr,
31 					  const xfrm_address_t *daddr)
32 {
33 	struct flowi6 fl6;
34 	struct dst_entry *dst;
35 	int err;
36 
37 	memset(&fl6, 0, sizeof(fl6));
38 	memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
39 	if (saddr)
40 		memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
41 
42 	dst = ip6_route_output(net, NULL, &fl6);
43 
44 	err = dst->error;
45 	if (dst->error) {
46 		dst_release(dst);
47 		dst = ERR_PTR(err);
48 	}
49 
50 	return dst;
51 }
52 
53 static int xfrm6_get_saddr(struct net *net,
54 			   xfrm_address_t *saddr, xfrm_address_t *daddr)
55 {
56 	struct dst_entry *dst;
57 	struct net_device *dev;
58 
59 	dst = xfrm6_dst_lookup(net, 0, NULL, daddr);
60 	if (IS_ERR(dst))
61 		return -EHOSTUNREACH;
62 
63 	dev = ip6_dst_idev(dst)->dev;
64 	ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6, 0, &saddr->in6);
65 	dst_release(dst);
66 	return 0;
67 }
68 
69 static int xfrm6_get_tos(const struct flowi *fl)
70 {
71 	return 0;
72 }
73 
74 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
75 			   int nfheader_len)
76 {
77 	if (dst->ops->family == AF_INET6) {
78 		struct rt6_info *rt = (struct rt6_info *)dst;
79 		path->path_cookie = rt6_get_cookie(rt);
80 	}
81 
82 	path->u.rt6.rt6i_nfheader_len = nfheader_len;
83 
84 	return 0;
85 }
86 
87 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
88 			  const struct flowi *fl)
89 {
90 	struct rt6_info *rt = (struct rt6_info *)xdst->route;
91 
92 	xdst->u.dst.dev = dev;
93 	dev_hold(dev);
94 
95 	xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
96 	if (!xdst->u.rt6.rt6i_idev) {
97 		dev_put(dev);
98 		return -ENODEV;
99 	}
100 
101 	/* Sheit... I remember I did this right. Apparently,
102 	 * it was magically lost, so this code needs audit */
103 	xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
104 						   RTF_LOCAL);
105 	xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
106 	xdst->u.rt6.rt6i_node = rt->rt6i_node;
107 	xdst->route_cookie = rt6_get_cookie(rt);
108 	xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
109 	xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
110 	xdst->u.rt6.rt6i_src = rt->rt6i_src;
111 
112 	return 0;
113 }
114 
115 static inline void
116 _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
117 {
118 	struct flowi6 *fl6 = &fl->u.ip6;
119 	int onlyproto = 0;
120 	const struct ipv6hdr *hdr = ipv6_hdr(skb);
121 	u16 offset = sizeof(*hdr);
122 	struct ipv6_opt_hdr *exthdr;
123 	const unsigned char *nh = skb_network_header(skb);
124 	u16 nhoff = IP6CB(skb)->nhoff;
125 	int oif = 0;
126 	u8 nexthdr;
127 
128 	if (!nhoff)
129 		nhoff = offsetof(struct ipv6hdr, nexthdr);
130 
131 	nexthdr = nh[nhoff];
132 
133 	if (skb_dst(skb))
134 		oif = skb_dst(skb)->dev->ifindex;
135 
136 	memset(fl6, 0, sizeof(struct flowi6));
137 	fl6->flowi6_mark = skb->mark;
138 	fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
139 
140 	fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
141 	fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
142 
143 	while (nh + offset + 1 < skb->data ||
144 	       pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
145 		nh = skb_network_header(skb);
146 		exthdr = (struct ipv6_opt_hdr *)(nh + offset);
147 
148 		switch (nexthdr) {
149 		case NEXTHDR_FRAGMENT:
150 			onlyproto = 1;
151 		case NEXTHDR_ROUTING:
152 		case NEXTHDR_HOP:
153 		case NEXTHDR_DEST:
154 			offset += ipv6_optlen(exthdr);
155 			nexthdr = exthdr->nexthdr;
156 			exthdr = (struct ipv6_opt_hdr *)(nh + offset);
157 			break;
158 
159 		case IPPROTO_UDP:
160 		case IPPROTO_UDPLITE:
161 		case IPPROTO_TCP:
162 		case IPPROTO_SCTP:
163 		case IPPROTO_DCCP:
164 			if (!onlyproto && (nh + offset + 4 < skb->data ||
165 			     pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
166 				__be16 *ports;
167 
168 				nh = skb_network_header(skb);
169 				ports = (__be16 *)(nh + offset);
170 				fl6->fl6_sport = ports[!!reverse];
171 				fl6->fl6_dport = ports[!reverse];
172 			}
173 			fl6->flowi6_proto = nexthdr;
174 			return;
175 
176 		case IPPROTO_ICMPV6:
177 			if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
178 				u8 *icmp;
179 
180 				nh = skb_network_header(skb);
181 				icmp = (u8 *)(nh + offset);
182 				fl6->fl6_icmp_type = icmp[0];
183 				fl6->fl6_icmp_code = icmp[1];
184 			}
185 			fl6->flowi6_proto = nexthdr;
186 			return;
187 
188 #if IS_ENABLED(CONFIG_IPV6_MIP6)
189 		case IPPROTO_MH:
190 			offset += ipv6_optlen(exthdr);
191 			if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
192 				struct ip6_mh *mh;
193 
194 				nh = skb_network_header(skb);
195 				mh = (struct ip6_mh *)(nh + offset);
196 				fl6->fl6_mh_type = mh->ip6mh_type;
197 			}
198 			fl6->flowi6_proto = nexthdr;
199 			return;
200 #endif
201 
202 		/* XXX Why are there these headers? */
203 		case IPPROTO_AH:
204 		case IPPROTO_ESP:
205 		case IPPROTO_COMP:
206 		default:
207 			fl6->fl6_ipsec_spi = 0;
208 			fl6->flowi6_proto = nexthdr;
209 			return;
210 		}
211 	}
212 }
213 
214 static inline int xfrm6_garbage_collect(struct dst_ops *ops)
215 {
216 	struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
217 
218 	xfrm6_policy_afinfo.garbage_collect(net);
219 	return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
220 }
221 
222 static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
223 			      struct sk_buff *skb, u32 mtu)
224 {
225 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
226 	struct dst_entry *path = xdst->route;
227 
228 	path->ops->update_pmtu(path, sk, skb, mtu);
229 }
230 
231 static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
232 			   struct sk_buff *skb)
233 {
234 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
235 	struct dst_entry *path = xdst->route;
236 
237 	path->ops->redirect(path, sk, skb);
238 }
239 
240 static void xfrm6_dst_destroy(struct dst_entry *dst)
241 {
242 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
243 
244 	if (likely(xdst->u.rt6.rt6i_idev))
245 		in6_dev_put(xdst->u.rt6.rt6i_idev);
246 	dst_destroy_metrics_generic(dst);
247 	xfrm_dst_destroy(xdst);
248 }
249 
250 static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
251 			     int unregister)
252 {
253 	struct xfrm_dst *xdst;
254 
255 	if (!unregister)
256 		return;
257 
258 	xdst = (struct xfrm_dst *)dst;
259 	if (xdst->u.rt6.rt6i_idev->dev == dev) {
260 		struct inet6_dev *loopback_idev =
261 			in6_dev_get(dev_net(dev)->loopback_dev);
262 		BUG_ON(!loopback_idev);
263 
264 		do {
265 			in6_dev_put(xdst->u.rt6.rt6i_idev);
266 			xdst->u.rt6.rt6i_idev = loopback_idev;
267 			in6_dev_hold(loopback_idev);
268 			xdst = (struct xfrm_dst *)xdst->u.dst.child;
269 		} while (xdst->u.dst.xfrm);
270 
271 		__in6_dev_put(loopback_idev);
272 	}
273 
274 	xfrm_dst_ifdown(dst, dev);
275 }
276 
277 static struct dst_ops xfrm6_dst_ops = {
278 	.family =		AF_INET6,
279 	.gc =			xfrm6_garbage_collect,
280 	.update_pmtu =		xfrm6_update_pmtu,
281 	.redirect =		xfrm6_redirect,
282 	.cow_metrics =		dst_cow_metrics_generic,
283 	.destroy =		xfrm6_dst_destroy,
284 	.ifdown =		xfrm6_dst_ifdown,
285 	.local_out =		__ip6_local_out,
286 	.gc_thresh =		32768,
287 };
288 
289 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
290 	.family =		AF_INET6,
291 	.dst_ops =		&xfrm6_dst_ops,
292 	.dst_lookup =		xfrm6_dst_lookup,
293 	.get_saddr =		xfrm6_get_saddr,
294 	.decode_session =	_decode_session6,
295 	.get_tos =		xfrm6_get_tos,
296 	.init_path =		xfrm6_init_path,
297 	.fill_dst =		xfrm6_fill_dst,
298 	.blackhole_route =	ip6_blackhole_route,
299 };
300 
301 static int __init xfrm6_policy_init(void)
302 {
303 	return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
304 }
305 
306 static void xfrm6_policy_fini(void)
307 {
308 	xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
309 }
310 
311 #ifdef CONFIG_SYSCTL
312 static struct ctl_table xfrm6_policy_table[] = {
313 	{
314 		.procname       = "xfrm6_gc_thresh",
315 		.data		= &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
316 		.maxlen		= sizeof(int),
317 		.mode		= 0644,
318 		.proc_handler   = proc_dointvec,
319 	},
320 	{ }
321 };
322 
323 static int __net_init xfrm6_net_init(struct net *net)
324 {
325 	struct ctl_table *table;
326 	struct ctl_table_header *hdr;
327 
328 	table = xfrm6_policy_table;
329 	if (!net_eq(net, &init_net)) {
330 		table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
331 		if (!table)
332 			goto err_alloc;
333 
334 		table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
335 	}
336 
337 	hdr = register_net_sysctl(net, "net/ipv6", table);
338 	if (!hdr)
339 		goto err_reg;
340 
341 	net->ipv6.sysctl.xfrm6_hdr = hdr;
342 	return 0;
343 
344 err_reg:
345 	if (!net_eq(net, &init_net))
346 		kfree(table);
347 err_alloc:
348 	return -ENOMEM;
349 }
350 
351 static void __net_exit xfrm6_net_exit(struct net *net)
352 {
353 	struct ctl_table *table;
354 
355 	if (!net->ipv6.sysctl.xfrm6_hdr)
356 		return;
357 
358 	table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
359 	unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
360 	if (!net_eq(net, &init_net))
361 		kfree(table);
362 }
363 
364 static struct pernet_operations xfrm6_net_ops = {
365 	.init	= xfrm6_net_init,
366 	.exit	= xfrm6_net_exit,
367 };
368 #endif
369 
370 int __init xfrm6_init(void)
371 {
372 	int ret;
373 
374 	dst_entries_init(&xfrm6_dst_ops);
375 
376 	ret = xfrm6_policy_init();
377 	if (ret) {
378 		dst_entries_destroy(&xfrm6_dst_ops);
379 		goto out;
380 	}
381 	ret = xfrm6_state_init();
382 	if (ret)
383 		goto out_policy;
384 
385 	ret = xfrm6_protocol_init();
386 	if (ret)
387 		goto out_state;
388 
389 #ifdef CONFIG_SYSCTL
390 	register_pernet_subsys(&xfrm6_net_ops);
391 #endif
392 out:
393 	return ret;
394 out_state:
395 	xfrm6_state_fini();
396 out_policy:
397 	xfrm6_policy_fini();
398 	goto out;
399 }
400 
401 void xfrm6_fini(void)
402 {
403 #ifdef CONFIG_SYSCTL
404 	unregister_pernet_subsys(&xfrm6_net_ops);
405 #endif
406 	xfrm6_protocol_fini();
407 	xfrm6_policy_fini();
408 	xfrm6_state_fini();
409 	dst_entries_destroy(&xfrm6_dst_ops);
410 }
411