[net-next-2.6.git] / net / ipv6 / xfrm6_state.c

/*
 * xfrm6_state.c: based on xfrm4_state.c
 *
 * Authors:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 * 		IPv6 support
 * 	YOSHIFUJI Hideaki @USAGI
 * 		Split up af-specific portion
 *
 */

#include <net/xfrm.h>
#include <linux/pfkeyv2.h>
#include <linux/ipsec.h>
#include <linux/netfilter_ipv6.h>
#include <net/dsfield.h>
#include <net/ipv6.h>
#include <net/addrconf.h>

static struct xfrm_state_afinfo xfrm6_state_afinfo;

static void
__xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
		     struct xfrm_tmpl *tmpl,
		     xfrm_address_t *daddr, xfrm_address_t *saddr)
{
	/* Initialize temporary selector matching only
	 * to current session. */
	ipv6_addr_copy((struct in6_addr *)&x->sel.daddr, &fl->fl6_dst);
	ipv6_addr_copy((struct in6_addr *)&x->sel.saddr, &fl->fl6_src);
	x->sel.dport = xfrm_flowi_dport(fl);
	x->sel.dport_mask = htons(0xffff);
	x->sel.sport = xfrm_flowi_sport(fl);
	x->sel.sport_mask = htons(0xffff);
	x->sel.prefixlen_d = 128;
	x->sel.prefixlen_s = 128;
	x->sel.proto = fl->proto;
	x->sel.ifindex = fl->oif;
	x->id = tmpl->id;
	if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
		memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
	memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
	if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
		memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
	x->props.mode = tmpl->mode;
	x->props.reqid = tmpl->reqid;
	x->props.family = AF_INET6;
}

static int
__xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
{
	int i;
	int j = 0;

	/* Rule 1: select IPsec transport except AH */
	for (i = 0; i < n; i++) {
		if (src[i]->props.mode == XFRM_MODE_TRANSPORT &&
		    src[i]->id.proto != IPPROTO_AH) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}
	if (j == n)
		goto end;

	/* Rule 2: select MIPv6 RO or inbound trigger */
#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
	for (i = 0; i < n; i++) {
		if (src[i] &&
		    (src[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION ||
		     src[i]->props.mode == XFRM_MODE_IN_TRIGGER)) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}
	if (j == n)
		goto end;
#endif

	/* Rule 3: select IPsec transport AH */
	for (i = 0; i < n; i++) {
		if (src[i] &&
		    src[i]->props.mode == XFRM_MODE_TRANSPORT &&
		    src[i]->id.proto == IPPROTO_AH) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}
	if (j == n)
		goto end;

	/* Rule 4: select IPsec tunnel */
	for (i = 0; i < n; i++) {
		if (src[i] &&
		    (src[i]->props.mode == XFRM_MODE_TUNNEL ||
		     src[i]->props.mode == XFRM_MODE_BEET)) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}
	if (likely(j == n))
		goto end;

	/* Final rule */
	for (i = 0; i < n; i++) {
		if (src[i]) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}

 end:
	return 0;
}

static int
__xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
{
	int i;
	int j = 0;

	/* Rule 1: select IPsec transport */
	for (i = 0; i < n; i++) {
		if (src[i]->mode == XFRM_MODE_TRANSPORT) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}
	if (j == n)
		goto end;

	/* Rule 2: select MIPv6 RO or inbound trigger */
#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
	for (i = 0; i < n; i++) {
		if (src[i] &&
		    (src[i]->mode == XFRM_MODE_ROUTEOPTIMIZATION ||
		     src[i]->mode == XFRM_MODE_IN_TRIGGER)) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}
	if (j == n)
		goto end;
#endif

	/* Rule 3: select IPsec tunnel */
	for (i = 0; i < n; i++) {
		if (src[i] &&
		    (src[i]->mode == XFRM_MODE_TUNNEL ||
		     src[i]->mode == XFRM_MODE_BEET)) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}
	if (likely(j == n))
		goto end;

	/* Final rule */
	for (i = 0; i < n; i++) {
		if (src[i]) {
			dst[j++] = src[i];
			src[i] = NULL;
		}
	}

 end:
	return 0;
}

int xfrm6_extract_header(struct sk_buff *skb)
{
	struct ipv6hdr *iph = ipv6_hdr(skb);

	XFRM_MODE_SKB_CB(skb)->id = 0;
	XFRM_MODE_SKB_CB(skb)->frag_off = htons(IP_DF);
	XFRM_MODE_SKB_CB(skb)->tos = ipv6_get_dsfield(iph);
	XFRM_MODE_SKB_CB(skb)->ttl = iph->hop_limit;
	memcpy(XFRM_MODE_SKB_CB(skb)->flow_lbl, iph->flow_lbl,
	       sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));

	return 0;
}

static struct xfrm_state_afinfo xfrm6_state_afinfo = {
	.family			= AF_INET6,
	.proto			= IPPROTO_IPV6,
	.eth_proto		= htons(ETH_P_IPV6),
	.nf_post_routing	= NF_INET_POST_ROUTING,
	.owner			= THIS_MODULE,
	.init_tempsel		= __xfrm6_init_tempsel,
	.tmpl_sort		= __xfrm6_tmpl_sort,
	.state_sort		= __xfrm6_state_sort,
	.output			= xfrm6_output,
	.extract_input		= xfrm6_extract_input,
	.extract_output		= xfrm6_extract_output,
	.transport_finish	= xfrm6_transport_finish,
};

void __init xfrm6_state_init(void)
{
	xfrm_state_register_afinfo(&xfrm6_state_afinfo);
}

void xfrm6_state_fini(void)
{
	xfrm_state_unregister_afinfo(&xfrm6_state_afinfo);
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	* xfrm6_state.c: based on xfrm4_state.c
	3	*
	4	* Authors:
	5	* Mitsuru KANDA @USAGI
	6	* Kazunori MIYAZAWA @USAGI
	7	* Kunihiro Ishiguro <kunihiro@ipinfusion.com>
	8	* IPv6 support
	9	* YOSHIFUJI Hideaki @USAGI
	10	* Split up af-specific portion
1ab1457c	11	*
1da177e4 LT	12	*/
	13
	14	#include <net/xfrm.h>
	15	#include <linux/pfkeyv2.h>
	16	#include <linux/ipsec.h>
862b82c6	17	#include <linux/netfilter_ipv6.h>
36cf9acf	18	#include <net/dsfield.h>
1da177e4	19	#include <net/ipv6.h>
ee51b1b6	20	#include <net/addrconf.h>
1da177e4 LT	21
	22	static struct xfrm_state_afinfo xfrm6_state_afinfo;
	23
	24	static void
	25	__xfrm6_init_tempsel(struct xfrm_state x, struct flowi fl,
	26	struct xfrm_tmpl *tmpl,
	27	xfrm_address_t daddr, xfrm_address_t saddr)
	28	{
	29	/* Initialize temporary selector matching only
	30	* to current session. */
	31	ipv6_addr_copy((struct in6_addr *)&x->sel.daddr, &fl->fl6_dst);
	32	ipv6_addr_copy((struct in6_addr *)&x->sel.saddr, &fl->fl6_src);
	33	x->sel.dport = xfrm_flowi_dport(fl);
8f83f23e	34	x->sel.dport_mask = htons(0xffff);
1da177e4	35	x->sel.sport = xfrm_flowi_sport(fl);
8f83f23e	36	x->sel.sport_mask = htons(0xffff);
1da177e4 LT	37	x->sel.prefixlen_d = 128;
	38	x->sel.prefixlen_s = 128;
	39	x->sel.proto = fl->proto;
	40	x->sel.ifindex = fl->oif;
	41	x->id = tmpl->id;
	42	if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
	43	memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
	44	memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
	45	if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
	46	memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
	47	x->props.mode = tmpl->mode;
	48	x->props.reqid = tmpl->reqid;
	49	x->props.family = AF_INET6;
	50	}
	51
58c949d1 MN	52	static int
	53	__xfrm6_state_sort(struct xfrm_state dst, struct xfrm_state src, int n)
	54	{
	55	int i;
	56	int j = 0;
	57
	58	/* Rule 1: select IPsec transport except AH */
	59	for (i = 0; i < n; i++) {
	60	if (src[i]->props.mode == XFRM_MODE_TRANSPORT &&
	61	src[i]->id.proto != IPPROTO_AH) {
	62	dst[j++] = src[i];
	63	src[i] = NULL;
	64	}
	65	}
	66	if (j == n)
	67	goto end;
	68
64d9fdda	69	/* Rule 2: select MIPv6 RO or inbound trigger */
59fbb3a6	70	#if defined(CONFIG_IPV6_MIP6) \|\| defined(CONFIG_IPV6_MIP6_MODULE)
64d9fdda MN	71	for (i = 0; i < n; i++) {
	72	if (src[i] &&
	73	(src[i]->props.mode == XFRM_MODE_ROUTEOPTIMIZATION \|\|
	74	src[i]->props.mode == XFRM_MODE_IN_TRIGGER)) {
	75	dst[j++] = src[i];
	76	src[i] = NULL;
	77	}
	78	}
	79	if (j == n)
	80	goto end;
	81	#endif
58c949d1 MN	82
	83	/* Rule 3: select IPsec transport AH */
	84	for (i = 0; i < n; i++) {
	85	if (src[i] &&
	86	src[i]->props.mode == XFRM_MODE_TRANSPORT &&
	87	src[i]->id.proto == IPPROTO_AH) {
	88	dst[j++] = src[i];
	89	src[i] = NULL;
	90	}
	91	}
	92	if (j == n)
	93	goto end;
	94
	95	/* Rule 4: select IPsec tunnel */
	96	for (i = 0; i < n; i++) {
	97	if (src[i] &&
1bfcb10f HX	98	(src[i]->props.mode == XFRM_MODE_TUNNEL \|\|
1bfcb10f HX	99	src[i]->props.mode == XFRM_MODE_BEET)) {
58c949d1 MN	100	dst[j++] = src[i];
	101	src[i] = NULL;
	102	}
	103	}
	104	if (likely(j == n))
	105	goto end;
	106
	107	/* Final rule */
	108	for (i = 0; i < n; i++) {
	109	if (src[i]) {
	110	dst[j++] = src[i];
	111	src[i] = NULL;
	112	}
	113	}
	114
	115	end:
	116	return 0;
	117	}
	118
	119	static int
	120	__xfrm6_tmpl_sort(struct xfrm_tmpl dst, struct xfrm_tmpl src, int n)
	121	{
	122	int i;
	123	int j = 0;
	124
	125	/* Rule 1: select IPsec transport */
	126	for (i = 0; i < n; i++) {
	127	if (src[i]->mode == XFRM_MODE_TRANSPORT) {
	128	dst[j++] = src[i];
	129	src[i] = NULL;
	130	}
	131	}
	132	if (j == n)
	133	goto end;
	134
64d9fdda	135	/* Rule 2: select MIPv6 RO or inbound trigger */
59fbb3a6	136	#if defined(CONFIG_IPV6_MIP6) \|\| defined(CONFIG_IPV6_MIP6_MODULE)
64d9fdda MN	137	for (i = 0; i < n; i++) {
	138	if (src[i] &&
	139	(src[i]->mode == XFRM_MODE_ROUTEOPTIMIZATION \|\|
	140	src[i]->mode == XFRM_MODE_IN_TRIGGER)) {
	141	dst[j++] = src[i];
	142	src[i] = NULL;
	143	}
	144	}
	145	if (j == n)
	146	goto end;
	147	#endif
58c949d1 MN	148
	149	/* Rule 3: select IPsec tunnel */
	150	for (i = 0; i < n; i++) {
	151	if (src[i] &&
1bfcb10f HX	152	(src[i]->mode == XFRM_MODE_TUNNEL \|\|
1bfcb10f HX	153	src[i]->mode == XFRM_MODE_BEET)) {
58c949d1 MN	154	dst[j++] = src[i];
	155	src[i] = NULL;
	156	}
	157	}
	158	if (likely(j == n))
	159	goto end;
	160
	161	/* Final rule */
	162	for (i = 0; i < n; i++) {
	163	if (src[i]) {
	164	dst[j++] = src[i];
	165	src[i] = NULL;
	166	}
	167	}
	168
	169	end:
	170	return 0;
	171	}
	172
36cf9acf HX	173	int xfrm6_extract_header(struct sk_buff *skb)
	174	{
	175	struct ipv6hdr *iph = ipv6_hdr(skb);
	176
	177	XFRM_MODE_SKB_CB(skb)->id = 0;
	178	XFRM_MODE_SKB_CB(skb)->frag_off = htons(IP_DF);
	179	XFRM_MODE_SKB_CB(skb)->tos = ipv6_get_dsfield(iph);
	180	XFRM_MODE_SKB_CB(skb)->ttl = iph->hop_limit;
36cf9acf HX	181	memcpy(XFRM_MODE_SKB_CB(skb)->flow_lbl, iph->flow_lbl,
	182	sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
	183
	184	return 0;
	185	}
	186
1da177e4 LT	187	static struct xfrm_state_afinfo xfrm6_state_afinfo = {
1da177e4 LT	188	.family = AF_INET6,
36cf9acf	189	.proto = IPPROTO_IPV6,
227620e2	190	.eth_proto = htons(ETH_P_IPV6),
6e23ae2a	191	.nf_post_routing = NF_INET_POST_ROUTING,
17c2a42a	192	.owner = THIS_MODULE,
1da177e4	193	.init_tempsel = __xfrm6_init_tempsel,
58c949d1 MN	194	.tmpl_sort = __xfrm6_tmpl_sort,
58c949d1 MN	195	.state_sort = __xfrm6_state_sort,
cdca7265	196	.output = xfrm6_output,
227620e2	197	.extract_input = xfrm6_extract_input,
36cf9acf	198	.extract_output = xfrm6_extract_output,
716062fd	199	.transport_finish = xfrm6_transport_finish,
1da177e4 LT	200	};
	201
	202	void __init xfrm6_state_init(void)
	203	{
	204	xfrm_state_register_afinfo(&xfrm6_state_afinfo);
	205	}
	206
	207	void xfrm6_state_fini(void)
	208	{
	209	xfrm_state_unregister_afinfo(&xfrm6_state_afinfo);
	210	}
	211