]>
Commit | Line | Data |
---|---|---|
e905a9ed | 1 | /* |
1da177e4 LT |
2 | * xfrm4_policy.c |
3 | * | |
4 | * Changes: | |
5 | * Kazunori MIYAZAWA @USAGI | |
6 | * YOSHIFUJI Hideaki @USAGI | |
7 | * Split up af-specific portion | |
e905a9ed | 8 | * |
1da177e4 LT |
9 | */ |
10 | ||
66cdb3ca HX |
11 | #include <linux/err.h> |
12 | #include <linux/kernel.h> | |
aabc9761 | 13 | #include <linux/inetdevice.h> |
45ff5a3f | 14 | #include <net/dst.h> |
1da177e4 LT |
15 | #include <net/xfrm.h> |
16 | #include <net/ip.h> | |
17 | ||
1da177e4 LT |
18 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo; |
19 | ||
c5b3cf46 AD |
20 | static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, |
21 | xfrm_address_t *saddr, | |
66cdb3ca | 22 | xfrm_address_t *daddr) |
1da177e4 | 23 | { |
66cdb3ca | 24 | struct flowi fl = { |
a1e59abf PM |
25 | .nl_u = { |
26 | .ip4_u = { | |
66cdb3ca | 27 | .tos = tos, |
a1e59abf PM |
28 | .daddr = daddr->a4, |
29 | }, | |
30 | }, | |
31 | }; | |
66cdb3ca HX |
32 | struct dst_entry *dst; |
33 | struct rtable *rt; | |
34 | int err; | |
a1e59abf | 35 | |
66cdb3ca HX |
36 | if (saddr) |
37 | fl.fl4_src = saddr->a4; | |
38 | ||
c5b3cf46 | 39 | err = __ip_route_output_key(net, &rt, &fl); |
d8d1f30b | 40 | dst = &rt->dst; |
66cdb3ca HX |
41 | if (err) |
42 | dst = ERR_PTR(err); | |
43 | return dst; | |
44 | } | |
45 | ||
fbda33b2 AD |
46 | static int xfrm4_get_saddr(struct net *net, |
47 | xfrm_address_t *saddr, xfrm_address_t *daddr) | |
66cdb3ca HX |
48 | { |
49 | struct dst_entry *dst; | |
50 | struct rtable *rt; | |
51 | ||
fbda33b2 | 52 | dst = xfrm4_dst_lookup(net, 0, NULL, daddr); |
66cdb3ca HX |
53 | if (IS_ERR(dst)) |
54 | return -EHOSTUNREACH; | |
55 | ||
56 | rt = (struct rtable *)dst; | |
57 | saddr->a4 = rt->rt_src; | |
58 | dst_release(dst); | |
59 | return 0; | |
a1e59abf PM |
60 | } |
61 | ||
25ee3286 | 62 | static int xfrm4_get_tos(struct flowi *fl) |
1da177e4 | 63 | { |
94e22389 | 64 | return IPTOS_RT_MASK & fl->fl4_tos; /* Strip ECN bits */ |
25ee3286 | 65 | } |
1da177e4 | 66 | |
a1b05140 MN |
67 | static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst, |
68 | int nfheader_len) | |
69 | { | |
70 | return 0; | |
71 | } | |
72 | ||
87c1e12b HX |
73 | static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, |
74 | struct flowi *fl) | |
25ee3286 HX |
75 | { |
76 | struct rtable *rt = (struct rtable *)xdst->route; | |
1da177e4 | 77 | |
87c1e12b | 78 | xdst->u.rt.fl = *fl; |
1da177e4 | 79 | |
25ee3286 HX |
80 | xdst->u.dst.dev = dev; |
81 | dev_hold(dev); | |
43372262 | 82 | |
25ee3286 HX |
83 | xdst->u.rt.peer = rt->peer; |
84 | if (rt->peer) | |
85 | atomic_inc(&rt->peer->refcnt); | |
66cdb3ca | 86 | |
25ee3286 HX |
87 | /* Sheit... I remember I did this right. Apparently, |
88 | * it was magically lost, so this code needs audit */ | |
89 | xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | | |
90 | RTCF_LOCAL); | |
91 | xdst->u.rt.rt_type = rt->rt_type; | |
92 | xdst->u.rt.rt_src = rt->rt_src; | |
93 | xdst->u.rt.rt_dst = rt->rt_dst; | |
94 | xdst->u.rt.rt_gateway = rt->rt_gateway; | |
95 | xdst->u.rt.rt_spec_dst = rt->rt_spec_dst; | |
1da177e4 | 96 | |
1da177e4 | 97 | return 0; |
1da177e4 LT |
98 | } |
99 | ||
100 | static void | |
d5422efe | 101 | _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) |
1da177e4 | 102 | { |
eddc9ec5 | 103 | struct iphdr *iph = ip_hdr(skb); |
d56f90a7 | 104 | u8 *xprth = skb_network_header(skb) + iph->ihl * 4; |
1da177e4 LT |
105 | |
106 | memset(fl, 0, sizeof(struct flowi)); | |
44b451f1 PK |
107 | fl->mark = skb->mark; |
108 | ||
1da177e4 LT |
109 | if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) { |
110 | switch (iph->protocol) { | |
111 | case IPPROTO_UDP: | |
ba4e58ec | 112 | case IPPROTO_UDPLITE: |
1da177e4 LT |
113 | case IPPROTO_TCP: |
114 | case IPPROTO_SCTP: | |
9e999993 | 115 | case IPPROTO_DCCP: |
c615c9f3 WY |
116 | if (xprth + 4 < skb->data || |
117 | pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
8c689a6e | 118 | __be16 *ports = (__be16 *)xprth; |
1da177e4 | 119 | |
d5422efe HX |
120 | fl->fl_ip_sport = ports[!!reverse]; |
121 | fl->fl_ip_dport = ports[!reverse]; | |
1da177e4 LT |
122 | } |
123 | break; | |
124 | ||
125 | case IPPROTO_ICMP: | |
126 | if (pskb_may_pull(skb, xprth + 2 - skb->data)) { | |
127 | u8 *icmp = xprth; | |
128 | ||
129 | fl->fl_icmp_type = icmp[0]; | |
130 | fl->fl_icmp_code = icmp[1]; | |
131 | } | |
132 | break; | |
133 | ||
134 | case IPPROTO_ESP: | |
135 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
4324a174 | 136 | __be32 *ehdr = (__be32 *)xprth; |
1da177e4 LT |
137 | |
138 | fl->fl_ipsec_spi = ehdr[0]; | |
139 | } | |
140 | break; | |
141 | ||
142 | case IPPROTO_AH: | |
143 | if (pskb_may_pull(skb, xprth + 8 - skb->data)) { | |
4324a174 | 144 | __be32 *ah_hdr = (__be32*)xprth; |
1da177e4 LT |
145 | |
146 | fl->fl_ipsec_spi = ah_hdr[1]; | |
147 | } | |
148 | break; | |
149 | ||
150 | case IPPROTO_COMP: | |
151 | if (pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
4324a174 | 152 | __be16 *ipcomp_hdr = (__be16 *)xprth; |
1da177e4 | 153 | |
4195f814 | 154 | fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); |
1da177e4 LT |
155 | } |
156 | break; | |
157 | default: | |
158 | fl->fl_ipsec_spi = 0; | |
159 | break; | |
3ff50b79 | 160 | } |
1da177e4 LT |
161 | } |
162 | fl->proto = iph->protocol; | |
d5422efe HX |
163 | fl->fl4_dst = reverse ? iph->saddr : iph->daddr; |
164 | fl->fl4_src = reverse ? iph->daddr : iph->saddr; | |
4da3089f | 165 | fl->fl4_tos = iph->tos; |
1da177e4 LT |
166 | } |
167 | ||
569d3645 | 168 | static inline int xfrm4_garbage_collect(struct dst_ops *ops) |
1da177e4 | 169 | { |
d7c7544c AD |
170 | struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops); |
171 | ||
172 | xfrm4_policy_afinfo.garbage_collect(net); | |
fc66f95c | 173 | return (dst_entries_get_slow(ops) > ops->gc_thresh * 2); |
1da177e4 LT |
174 | } |
175 | ||
176 | static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu) | |
177 | { | |
178 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
179 | struct dst_entry *path = xdst->route; | |
180 | ||
181 | path->ops->update_pmtu(path, mtu); | |
182 | } | |
183 | ||
aabc9761 HX |
184 | static void xfrm4_dst_destroy(struct dst_entry *dst) |
185 | { | |
186 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
187 | ||
ed3e37dd | 188 | if (likely(xdst->u.rt.peer)) |
26db1677 | 189 | inet_putpeer(xdst->u.rt.peer); |
aabc9761 HX |
190 | xfrm_dst_destroy(xdst); |
191 | } | |
192 | ||
193 | static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, | |
194 | int unregister) | |
195 | { | |
aabc9761 HX |
196 | if (!unregister) |
197 | return; | |
198 | ||
aabc9761 HX |
199 | xfrm_dst_ifdown(dst, dev); |
200 | } | |
201 | ||
1da177e4 LT |
202 | static struct dst_ops xfrm4_dst_ops = { |
203 | .family = AF_INET, | |
09640e63 | 204 | .protocol = cpu_to_be16(ETH_P_IP), |
1da177e4 LT |
205 | .gc = xfrm4_garbage_collect, |
206 | .update_pmtu = xfrm4_update_pmtu, | |
aabc9761 HX |
207 | .destroy = xfrm4_dst_destroy, |
208 | .ifdown = xfrm4_dst_ifdown, | |
862b82c6 | 209 | .local_out = __ip_local_out, |
1da177e4 | 210 | .gc_thresh = 1024, |
1da177e4 LT |
211 | }; |
212 | ||
213 | static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { | |
214 | .family = AF_INET, | |
1da177e4 LT |
215 | .dst_ops = &xfrm4_dst_ops, |
216 | .dst_lookup = xfrm4_dst_lookup, | |
a1e59abf | 217 | .get_saddr = xfrm4_get_saddr, |
1da177e4 | 218 | .decode_session = _decode_session4, |
25ee3286 | 219 | .get_tos = xfrm4_get_tos, |
a1b05140 | 220 | .init_path = xfrm4_init_path, |
25ee3286 | 221 | .fill_dst = xfrm4_fill_dst, |
1da177e4 LT |
222 | }; |
223 | ||
f816700a | 224 | #ifdef CONFIG_SYSCTL |
a44a4a00 NH |
225 | static struct ctl_table xfrm4_policy_table[] = { |
226 | { | |
a44a4a00 | 227 | .procname = "xfrm4_gc_thresh", |
d7c7544c | 228 | .data = &init_net.xfrm.xfrm4_dst_ops.gc_thresh, |
a44a4a00 NH |
229 | .maxlen = sizeof(int), |
230 | .mode = 0644, | |
231 | .proc_handler = proc_dointvec, | |
232 | }, | |
233 | { } | |
234 | }; | |
235 | ||
236 | static struct ctl_table_header *sysctl_hdr; | |
f816700a | 237 | #endif |
a44a4a00 | 238 | |
1da177e4 LT |
239 | static void __init xfrm4_policy_init(void) |
240 | { | |
241 | xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); | |
242 | } | |
243 | ||
244 | static void __exit xfrm4_policy_fini(void) | |
245 | { | |
f816700a | 246 | #ifdef CONFIG_SYSCTL |
a44a4a00 NH |
247 | if (sysctl_hdr) |
248 | unregister_net_sysctl_table(sysctl_hdr); | |
f816700a | 249 | #endif |
1da177e4 LT |
250 | xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo); |
251 | } | |
252 | ||
a33bc5c1 | 253 | void __init xfrm4_init(int rt_max_size) |
1da177e4 | 254 | { |
a33bc5c1 NH |
255 | /* |
256 | * Select a default value for the gc_thresh based on the main route | |
257 | * table hash size. It seems to me the worst case scenario is when | |
258 | * we have ipsec operating in transport mode, in which we create a | |
259 | * dst_entry per socket. The xfrm gc algorithm starts trying to remove | |
260 | * entries at gc_thresh, and prevents new allocations as 2*gc_thresh | |
261 | * so lets set an initial xfrm gc_thresh value at the rt_max_size/2. | |
262 | * That will let us store an ipsec connection per route table entry, | |
263 | * and start cleaning when were 1/2 full | |
264 | */ | |
265 | xfrm4_dst_ops.gc_thresh = rt_max_size/2; | |
fc66f95c | 266 | dst_entries_init(&xfrm4_dst_ops); |
d7c7544c AD |
267 | |
268 | xfrm4_state_init(); | |
269 | xfrm4_policy_init(); | |
f816700a | 270 | #ifdef CONFIG_SYSCTL |
a44a4a00 NH |
271 | sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path, |
272 | xfrm4_policy_table); | |
f816700a | 273 | #endif |
1da177e4 LT |
274 | } |
275 |