1 /* 2 * xfrm6_policy.c: based on xfrm4_policy.c 3 * 4 * Authors: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * IPv6 support 9 * YOSHIFUJI Hideaki 10 * Split up af-specific portion 11 * 12 */ 13 14 #include <linux/err.h> 15 #include <linux/kernel.h> 16 #include <linux/netdevice.h> 17 #include <net/addrconf.h> 18 #include <net/dst.h> 19 #include <net/xfrm.h> 20 #include <net/ip.h> 21 #include <net/ipv6.h> 22 #include <net/ip6_route.h> 23 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 24 #include <net/mip6.h> 25 #endif 26 27 static struct dst_ops xfrm6_dst_ops; 28 static struct xfrm_policy_afinfo xfrm6_policy_afinfo; 29 30 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, 31 xfrm_address_t *saddr, 32 xfrm_address_t *daddr) 33 { 34 struct flowi fl = {}; 35 struct dst_entry *dst; 36 int err; 37 38 memcpy(&fl.fl6_dst, daddr, sizeof(fl.fl6_dst)); 39 if (saddr) 40 memcpy(&fl.fl6_src, saddr, sizeof(fl.fl6_src)); 41 42 dst = ip6_route_output(net, NULL, &fl); 43 44 err = dst->error; 45 if (dst->error) { 46 dst_release(dst); 47 dst = ERR_PTR(err); 48 } 49 50 return dst; 51 } 52 53 static int xfrm6_get_saddr(struct net *net, 54 xfrm_address_t *saddr, xfrm_address_t *daddr) 55 { 56 struct dst_entry *dst; 57 struct net_device *dev; 58 59 dst = xfrm6_dst_lookup(net, 0, NULL, daddr); 60 if (IS_ERR(dst)) 61 return -EHOSTUNREACH; 62 63 dev = ip6_dst_idev(dst)->dev; 64 ipv6_dev_get_saddr(dev_net(dev), dev, 65 (struct in6_addr *)&daddr->a6, 0, 66 (struct in6_addr *)&saddr->a6); 67 dst_release(dst); 68 return 0; 69 } 70 71 static struct dst_entry * 72 __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy) 73 { 74 struct dst_entry *dst; 75 76 /* Still not clear if we should set fl->fl6_{src,dst}... */ 77 read_lock_bh(&policy->lock); 78 for (dst = policy->bundles; dst; dst = dst->next) { 79 struct xfrm_dst *xdst = (struct xfrm_dst*)dst; 80 struct in6_addr fl_dst_prefix, fl_src_prefix; 81 82 ipv6_addr_prefix(&fl_dst_prefix, 83 &fl->fl6_dst, 84 xdst->u.rt6.rt6i_dst.plen); 85 ipv6_addr_prefix(&fl_src_prefix, 86 &fl->fl6_src, 87 xdst->u.rt6.rt6i_src.plen); 88 if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) && 89 ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) && 90 xfrm_bundle_ok(policy, xdst, fl, AF_INET6, 91 (xdst->u.rt6.rt6i_dst.plen != 128 || 92 xdst->u.rt6.rt6i_src.plen != 128))) { 93 dst_clone(dst); 94 break; 95 } 96 } 97 read_unlock_bh(&policy->lock); 98 return dst; 99 } 100 101 static int xfrm6_get_tos(struct flowi *fl) 102 { 103 return 0; 104 } 105 106 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst, 107 int nfheader_len) 108 { 109 if (dst->ops->family == AF_INET6) { 110 struct rt6_info *rt = (struct rt6_info*)dst; 111 if (rt->rt6i_node) 112 path->path_cookie = rt->rt6i_node->fn_sernum; 113 } 114 115 path->u.rt6.rt6i_nfheader_len = nfheader_len; 116 117 return 0; 118 } 119 120 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev) 121 { 122 struct rt6_info *rt = (struct rt6_info*)xdst->route; 123 124 xdst->u.dst.dev = dev; 125 dev_hold(dev); 126 127 xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev); 128 if (!xdst->u.rt6.rt6i_idev) 129 return -ENODEV; 130 131 /* Sheit... I remember I did this right. Apparently, 132 * it was magically lost, so this code needs audit */ 133 xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST | 134 RTF_LOCAL); 135 xdst->u.rt6.rt6i_metric = rt->rt6i_metric; 136 xdst->u.rt6.rt6i_node = rt->rt6i_node; 137 if (rt->rt6i_node) 138 xdst->route_cookie = rt->rt6i_node->fn_sernum; 139 xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway; 140 xdst->u.rt6.rt6i_dst = rt->rt6i_dst; 141 xdst->u.rt6.rt6i_src = rt->rt6i_src; 142 143 return 0; 144 } 145 146 static inline void 147 _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) 148 { 149 int onlyproto = 0; 150 u16 offset = skb_network_header_len(skb); 151 struct ipv6hdr *hdr = ipv6_hdr(skb); 152 struct ipv6_opt_hdr *exthdr; 153 const unsigned char *nh = skb_network_header(skb); 154 u8 nexthdr = nh[IP6CB(skb)->nhoff]; 155 156 memset(fl, 0, sizeof(struct flowi)); 157 ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr); 158 ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr); 159 160 while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) { 161 nh = skb_network_header(skb); 162 exthdr = (struct ipv6_opt_hdr *)(nh + offset); 163 164 switch (nexthdr) { 165 case NEXTHDR_FRAGMENT: 166 onlyproto = 1; 167 case NEXTHDR_ROUTING: 168 case NEXTHDR_HOP: 169 case NEXTHDR_DEST: 170 offset += ipv6_optlen(exthdr); 171 nexthdr = exthdr->nexthdr; 172 exthdr = (struct ipv6_opt_hdr *)(nh + offset); 173 break; 174 175 case IPPROTO_UDP: 176 case IPPROTO_UDPLITE: 177 case IPPROTO_TCP: 178 case IPPROTO_SCTP: 179 case IPPROTO_DCCP: 180 if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) { 181 __be16 *ports = (__be16 *)exthdr; 182 183 fl->fl_ip_sport = ports[!!reverse]; 184 fl->fl_ip_dport = ports[!reverse]; 185 } 186 fl->proto = nexthdr; 187 return; 188 189 case IPPROTO_ICMPV6: 190 if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) { 191 u8 *icmp = (u8 *)exthdr; 192 193 fl->fl_icmp_type = icmp[0]; 194 fl->fl_icmp_code = icmp[1]; 195 } 196 fl->proto = nexthdr; 197 return; 198 199 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 200 case IPPROTO_MH: 201 if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) { 202 struct ip6_mh *mh; 203 mh = (struct ip6_mh *)exthdr; 204 205 fl->fl_mh_type = mh->ip6mh_type; 206 } 207 fl->proto = nexthdr; 208 return; 209 #endif 210 211 /* XXX Why are there these headers? */ 212 case IPPROTO_AH: 213 case IPPROTO_ESP: 214 case IPPROTO_COMP: 215 default: 216 fl->fl_ipsec_spi = 0; 217 fl->proto = nexthdr; 218 return; 219 } 220 } 221 } 222 223 static inline int xfrm6_garbage_collect(struct dst_ops *ops) 224 { 225 xfrm6_policy_afinfo.garbage_collect(&init_net); 226 return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2); 227 } 228 229 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu) 230 { 231 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 232 struct dst_entry *path = xdst->route; 233 234 path->ops->update_pmtu(path, mtu); 235 } 236 237 static void xfrm6_dst_destroy(struct dst_entry *dst) 238 { 239 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 240 241 if (likely(xdst->u.rt6.rt6i_idev)) 242 in6_dev_put(xdst->u.rt6.rt6i_idev); 243 xfrm_dst_destroy(xdst); 244 } 245 246 static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev, 247 int unregister) 248 { 249 struct xfrm_dst *xdst; 250 251 if (!unregister) 252 return; 253 254 xdst = (struct xfrm_dst *)dst; 255 if (xdst->u.rt6.rt6i_idev->dev == dev) { 256 struct inet6_dev *loopback_idev = 257 in6_dev_get(dev_net(dev)->loopback_dev); 258 BUG_ON(!loopback_idev); 259 260 do { 261 in6_dev_put(xdst->u.rt6.rt6i_idev); 262 xdst->u.rt6.rt6i_idev = loopback_idev; 263 in6_dev_hold(loopback_idev); 264 xdst = (struct xfrm_dst *)xdst->u.dst.child; 265 } while (xdst->u.dst.xfrm); 266 267 __in6_dev_put(loopback_idev); 268 } 269 270 xfrm_dst_ifdown(dst, dev); 271 } 272 273 static struct dst_ops xfrm6_dst_ops = { 274 .family = AF_INET6, 275 .protocol = cpu_to_be16(ETH_P_IPV6), 276 .gc = xfrm6_garbage_collect, 277 .update_pmtu = xfrm6_update_pmtu, 278 .destroy = xfrm6_dst_destroy, 279 .ifdown = xfrm6_dst_ifdown, 280 .local_out = __ip6_local_out, 281 .gc_thresh = 1024, 282 .entries = ATOMIC_INIT(0), 283 }; 284 285 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = { 286 .family = AF_INET6, 287 .dst_ops = &xfrm6_dst_ops, 288 .dst_lookup = xfrm6_dst_lookup, 289 .get_saddr = xfrm6_get_saddr, 290 .find_bundle = __xfrm6_find_bundle, 291 .decode_session = _decode_session6, 292 .get_tos = xfrm6_get_tos, 293 .init_path = xfrm6_init_path, 294 .fill_dst = xfrm6_fill_dst, 295 }; 296 297 static int __init xfrm6_policy_init(void) 298 { 299 return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo); 300 } 301 302 static void xfrm6_policy_fini(void) 303 { 304 xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo); 305 } 306 307 int __init xfrm6_init(void) 308 { 309 int ret; 310 311 ret = xfrm6_policy_init(); 312 if (ret) 313 goto out; 314 315 ret = xfrm6_state_init(); 316 if (ret) 317 goto out_policy; 318 out: 319 return ret; 320 out_policy: 321 xfrm6_policy_fini(); 322 goto out; 323 } 324 325 void xfrm6_fini(void) 326 { 327 //xfrm6_input_fini(); 328 xfrm6_policy_fini(); 329 xfrm6_state_fini(); 330 } 331