11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * xfrm4_policy.c 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Changes: 51da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI 61da177e4SLinus Torvalds * YOSHIFUJI Hideaki @USAGI 71da177e4SLinus Torvalds * Split up af-specific portion 81da177e4SLinus Torvalds * 91da177e4SLinus Torvalds */ 101da177e4SLinus Torvalds 1166cdb3caSHerbert Xu #include <linux/err.h> 1266cdb3caSHerbert Xu #include <linux/kernel.h> 13aabc9761SHerbert Xu #include <linux/inetdevice.h> 14cc9ff19dSTimo Teräs #include <linux/if_tunnel.h> 1545ff5a3fSHerbert Xu #include <net/dst.h> 161da177e4SLinus Torvalds #include <net/xfrm.h> 171da177e4SLinus Torvalds #include <net/ip.h> 181da177e4SLinus Torvalds 191da177e4SLinus Torvalds static struct xfrm_policy_afinfo xfrm4_policy_afinfo; 201da177e4SLinus Torvalds 21c5b3cf46SAlexey Dobriyan static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, 22c5b3cf46SAlexey Dobriyan xfrm_address_t *saddr, 2366cdb3caSHerbert Xu xfrm_address_t *daddr) 241da177e4SLinus Torvalds { 2566cdb3caSHerbert Xu struct flowi fl = { 265811662bSChangli Gao .fl4_dst = daddr->a4, 275811662bSChangli Gao .fl4_tos = tos, 28a1e59abfSPatrick McHardy }; 2966cdb3caSHerbert Xu struct dst_entry *dst; 3066cdb3caSHerbert Xu struct rtable *rt; 3166cdb3caSHerbert Xu int err; 32a1e59abfSPatrick McHardy 3366cdb3caSHerbert Xu if (saddr) 3466cdb3caSHerbert Xu fl.fl4_src = saddr->a4; 3566cdb3caSHerbert Xu 36c5b3cf46SAlexey Dobriyan err = __ip_route_output_key(net, &rt, &fl); 37d8d1f30bSChangli Gao dst = &rt->dst; 3866cdb3caSHerbert Xu if (err) 3966cdb3caSHerbert Xu dst = ERR_PTR(err); 4066cdb3caSHerbert Xu return dst; 41a1e59abfSPatrick McHardy } 4266cdb3caSHerbert Xu 43fbda33b2SAlexey Dobriyan static int xfrm4_get_saddr(struct net *net, 44fbda33b2SAlexey Dobriyan xfrm_address_t *saddr, xfrm_address_t *daddr) 4566cdb3caSHerbert Xu { 4666cdb3caSHerbert Xu struct dst_entry *dst; 4766cdb3caSHerbert Xu struct rtable *rt; 4866cdb3caSHerbert Xu 49fbda33b2SAlexey Dobriyan dst = xfrm4_dst_lookup(net, 0, NULL, daddr); 5066cdb3caSHerbert Xu if (IS_ERR(dst)) 51a1e59abfSPatrick McHardy return -EHOSTUNREACH; 5266cdb3caSHerbert Xu 5366cdb3caSHerbert Xu rt = (struct rtable *)dst; 5466cdb3caSHerbert Xu saddr->a4 = rt->rt_src; 5566cdb3caSHerbert Xu dst_release(dst); 5666cdb3caSHerbert Xu return 0; 57a1e59abfSPatrick McHardy } 58a1e59abfSPatrick McHardy 5925ee3286SHerbert Xu static int xfrm4_get_tos(struct flowi *fl) 601da177e4SLinus Torvalds { 6194e22389SUlrich Weber return IPTOS_RT_MASK & fl->fl4_tos; /* Strip ECN bits */ 621da177e4SLinus Torvalds } 631da177e4SLinus Torvalds 64a1b05140SMasahide NAKAMURA static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst, 65a1b05140SMasahide NAKAMURA int nfheader_len) 66a1b05140SMasahide NAKAMURA { 67a1b05140SMasahide NAKAMURA return 0; 68a1b05140SMasahide NAKAMURA } 69a1b05140SMasahide NAKAMURA 7087c1e12bSHerbert Xu static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, 7187c1e12bSHerbert Xu struct flowi *fl) 7225ee3286SHerbert Xu { 7325ee3286SHerbert Xu struct rtable *rt = (struct rtable *)xdst->route; 741da177e4SLinus Torvalds 7587c1e12bSHerbert Xu xdst->u.rt.fl = *fl; 761da177e4SLinus Torvalds 7725ee3286SHerbert Xu xdst->u.dst.dev = dev; 7825ee3286SHerbert Xu dev_hold(dev); 7943372262SMiika Komu 8025ee3286SHerbert Xu xdst->u.rt.peer = rt->peer; 8125ee3286SHerbert Xu if (rt->peer) 8225ee3286SHerbert Xu atomic_inc(&rt->peer->refcnt); 8366cdb3caSHerbert Xu 841da177e4SLinus Torvalds /* Sheit... I remember I did this right. Apparently, 851da177e4SLinus Torvalds * it was magically lost, so this code needs audit */ 8625ee3286SHerbert Xu xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | 8725ee3286SHerbert Xu RTCF_LOCAL); 8825ee3286SHerbert Xu xdst->u.rt.rt_type = rt->rt_type; 8925ee3286SHerbert Xu xdst->u.rt.rt_src = rt->rt_src; 9025ee3286SHerbert Xu xdst->u.rt.rt_dst = rt->rt_dst; 9125ee3286SHerbert Xu xdst->u.rt.rt_gateway = rt->rt_gateway; 9225ee3286SHerbert Xu xdst->u.rt.rt_spec_dst = rt->rt_spec_dst; 931da177e4SLinus Torvalds 941da177e4SLinus Torvalds return 0; 951da177e4SLinus Torvalds } 961da177e4SLinus Torvalds 971da177e4SLinus Torvalds static void 98d5422efeSHerbert Xu _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) 991da177e4SLinus Torvalds { 100eddc9ec5SArnaldo Carvalho de Melo struct iphdr *iph = ip_hdr(skb); 101d56f90a7SArnaldo Carvalho de Melo u8 *xprth = skb_network_header(skb) + iph->ihl * 4; 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds memset(fl, 0, sizeof(struct flowi)); 10444b451f1SPeter Kosyh fl->mark = skb->mark; 10544b451f1SPeter Kosyh 1061da177e4SLinus Torvalds if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) { 1071da177e4SLinus Torvalds switch (iph->protocol) { 1081da177e4SLinus Torvalds case IPPROTO_UDP: 109ba4e58ecSGerrit Renker case IPPROTO_UDPLITE: 1101da177e4SLinus Torvalds case IPPROTO_TCP: 1111da177e4SLinus Torvalds case IPPROTO_SCTP: 1129e999993SPatrick McHardy case IPPROTO_DCCP: 113c615c9f3SWei Yongjun if (xprth + 4 < skb->data || 114c615c9f3SWei Yongjun pskb_may_pull(skb, xprth + 4 - skb->data)) { 1158c689a6eSAl Viro __be16 *ports = (__be16 *)xprth; 1161da177e4SLinus Torvalds 117d5422efeSHerbert Xu fl->fl_ip_sport = ports[!!reverse]; 118d5422efeSHerbert Xu fl->fl_ip_dport = ports[!reverse]; 1191da177e4SLinus Torvalds } 1201da177e4SLinus Torvalds break; 1211da177e4SLinus Torvalds 1221da177e4SLinus Torvalds case IPPROTO_ICMP: 1231da177e4SLinus Torvalds if (pskb_may_pull(skb, xprth + 2 - skb->data)) { 1241da177e4SLinus Torvalds u8 *icmp = xprth; 1251da177e4SLinus Torvalds 1261da177e4SLinus Torvalds fl->fl_icmp_type = icmp[0]; 1271da177e4SLinus Torvalds fl->fl_icmp_code = icmp[1]; 1281da177e4SLinus Torvalds } 1291da177e4SLinus Torvalds break; 1301da177e4SLinus Torvalds 1311da177e4SLinus Torvalds case IPPROTO_ESP: 1321da177e4SLinus Torvalds if (pskb_may_pull(skb, xprth + 4 - skb->data)) { 1334324a174SAl Viro __be32 *ehdr = (__be32 *)xprth; 1341da177e4SLinus Torvalds 1351da177e4SLinus Torvalds fl->fl_ipsec_spi = ehdr[0]; 1361da177e4SLinus Torvalds } 1371da177e4SLinus Torvalds break; 1381da177e4SLinus Torvalds 1391da177e4SLinus Torvalds case IPPROTO_AH: 1401da177e4SLinus Torvalds if (pskb_may_pull(skb, xprth + 8 - skb->data)) { 1414324a174SAl Viro __be32 *ah_hdr = (__be32*)xprth; 1421da177e4SLinus Torvalds 1431da177e4SLinus Torvalds fl->fl_ipsec_spi = ah_hdr[1]; 1441da177e4SLinus Torvalds } 1451da177e4SLinus Torvalds break; 1461da177e4SLinus Torvalds 1471da177e4SLinus Torvalds case IPPROTO_COMP: 1481da177e4SLinus Torvalds if (pskb_may_pull(skb, xprth + 4 - skb->data)) { 1494324a174SAl Viro __be16 *ipcomp_hdr = (__be16 *)xprth; 1501da177e4SLinus Torvalds 1514195f814SAlexey Dobriyan fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); 1521da177e4SLinus Torvalds } 1531da177e4SLinus Torvalds break; 154cc9ff19dSTimo Teräs 155cc9ff19dSTimo Teräs case IPPROTO_GRE: 156cc9ff19dSTimo Teräs if (pskb_may_pull(skb, xprth + 12 - skb->data)) { 157cc9ff19dSTimo Teräs __be16 *greflags = (__be16 *)xprth; 158cc9ff19dSTimo Teräs __be32 *gre_hdr = (__be32 *)xprth; 159cc9ff19dSTimo Teräs 160cc9ff19dSTimo Teräs if (greflags[0] & GRE_KEY) { 161cc9ff19dSTimo Teräs if (greflags[0] & GRE_CSUM) 162cc9ff19dSTimo Teräs gre_hdr++; 163cc9ff19dSTimo Teräs fl->fl_gre_key = gre_hdr[1]; 164cc9ff19dSTimo Teräs } 165cc9ff19dSTimo Teräs } 166cc9ff19dSTimo Teräs break; 167cc9ff19dSTimo Teräs 1681da177e4SLinus Torvalds default: 1691da177e4SLinus Torvalds fl->fl_ipsec_spi = 0; 1701da177e4SLinus Torvalds break; 1713ff50b79SStephen Hemminger } 1721da177e4SLinus Torvalds } 1731da177e4SLinus Torvalds fl->proto = iph->protocol; 174d5422efeSHerbert Xu fl->fl4_dst = reverse ? iph->saddr : iph->daddr; 175d5422efeSHerbert Xu fl->fl4_src = reverse ? iph->daddr : iph->saddr; 1764da3089fSHerbert Xu fl->fl4_tos = iph->tos; 1771da177e4SLinus Torvalds } 1781da177e4SLinus Torvalds 179569d3645SDaniel Lezcano static inline int xfrm4_garbage_collect(struct dst_ops *ops) 1801da177e4SLinus Torvalds { 181d7c7544cSAlexey Dobriyan struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops); 182d7c7544cSAlexey Dobriyan 183d7c7544cSAlexey Dobriyan xfrm4_policy_afinfo.garbage_collect(net); 184fc66f95cSEric Dumazet return (dst_entries_get_slow(ops) > ops->gc_thresh * 2); 1851da177e4SLinus Torvalds } 1861da177e4SLinus Torvalds 1871da177e4SLinus Torvalds static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu) 1881da177e4SLinus Torvalds { 1891da177e4SLinus Torvalds struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 1901da177e4SLinus Torvalds struct dst_entry *path = xdst->route; 1911da177e4SLinus Torvalds 1921da177e4SLinus Torvalds path->ops->update_pmtu(path, mtu); 1931da177e4SLinus Torvalds } 1941da177e4SLinus Torvalds 195aabc9761SHerbert Xu static void xfrm4_dst_destroy(struct dst_entry *dst) 196aabc9761SHerbert Xu { 197aabc9761SHerbert Xu struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 198aabc9761SHerbert Xu 199*62fa8a84SDavid S. Miller dst_destroy_metrics_generic(dst); 200*62fa8a84SDavid S. Miller 201ed3e37ddSHerbert Xu if (likely(xdst->u.rt.peer)) 20226db1677SDavid S. Miller inet_putpeer(xdst->u.rt.peer); 203*62fa8a84SDavid S. Miller 204aabc9761SHerbert Xu xfrm_dst_destroy(xdst); 205aabc9761SHerbert Xu } 206aabc9761SHerbert Xu 207aabc9761SHerbert Xu static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, 208aabc9761SHerbert Xu int unregister) 209aabc9761SHerbert Xu { 210aabc9761SHerbert Xu if (!unregister) 211aabc9761SHerbert Xu return; 212aabc9761SHerbert Xu 213aabc9761SHerbert Xu xfrm_dst_ifdown(dst, dev); 214aabc9761SHerbert Xu } 215aabc9761SHerbert Xu 2161da177e4SLinus Torvalds static struct dst_ops xfrm4_dst_ops = { 2171da177e4SLinus Torvalds .family = AF_INET, 21809640e63SHarvey Harrison .protocol = cpu_to_be16(ETH_P_IP), 2191da177e4SLinus Torvalds .gc = xfrm4_garbage_collect, 2201da177e4SLinus Torvalds .update_pmtu = xfrm4_update_pmtu, 221*62fa8a84SDavid S. Miller .cow_metrics = dst_cow_metrics_generic, 222aabc9761SHerbert Xu .destroy = xfrm4_dst_destroy, 223aabc9761SHerbert Xu .ifdown = xfrm4_dst_ifdown, 224862b82c6SHerbert Xu .local_out = __ip_local_out, 2251da177e4SLinus Torvalds .gc_thresh = 1024, 2261da177e4SLinus Torvalds }; 2271da177e4SLinus Torvalds 2281da177e4SLinus Torvalds static struct xfrm_policy_afinfo xfrm4_policy_afinfo = { 2291da177e4SLinus Torvalds .family = AF_INET, 2301da177e4SLinus Torvalds .dst_ops = &xfrm4_dst_ops, 2311da177e4SLinus Torvalds .dst_lookup = xfrm4_dst_lookup, 232a1e59abfSPatrick McHardy .get_saddr = xfrm4_get_saddr, 2331da177e4SLinus Torvalds .decode_session = _decode_session4, 23425ee3286SHerbert Xu .get_tos = xfrm4_get_tos, 235a1b05140SMasahide NAKAMURA .init_path = xfrm4_init_path, 23625ee3286SHerbert Xu .fill_dst = xfrm4_fill_dst, 2371da177e4SLinus Torvalds }; 2381da177e4SLinus Torvalds 239f816700aSRandy Dunlap #ifdef CONFIG_SYSCTL 240a44a4a00SNeil Horman static struct ctl_table xfrm4_policy_table[] = { 241a44a4a00SNeil Horman { 242a44a4a00SNeil Horman .procname = "xfrm4_gc_thresh", 243d7c7544cSAlexey Dobriyan .data = &init_net.xfrm.xfrm4_dst_ops.gc_thresh, 244a44a4a00SNeil Horman .maxlen = sizeof(int), 245a44a4a00SNeil Horman .mode = 0644, 246a44a4a00SNeil Horman .proc_handler = proc_dointvec, 247a44a4a00SNeil Horman }, 248a44a4a00SNeil Horman { } 249a44a4a00SNeil Horman }; 250a44a4a00SNeil Horman 251a44a4a00SNeil Horman static struct ctl_table_header *sysctl_hdr; 252f816700aSRandy Dunlap #endif 253a44a4a00SNeil Horman 2541da177e4SLinus Torvalds static void __init xfrm4_policy_init(void) 2551da177e4SLinus Torvalds { 2561da177e4SLinus Torvalds xfrm_policy_register_afinfo(&xfrm4_policy_afinfo); 2571da177e4SLinus Torvalds } 2581da177e4SLinus Torvalds 2591da177e4SLinus Torvalds static void __exit xfrm4_policy_fini(void) 2601da177e4SLinus Torvalds { 261f816700aSRandy Dunlap #ifdef CONFIG_SYSCTL 262a44a4a00SNeil Horman if (sysctl_hdr) 263a44a4a00SNeil Horman unregister_net_sysctl_table(sysctl_hdr); 264f816700aSRandy Dunlap #endif 2651da177e4SLinus Torvalds xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo); 2661da177e4SLinus Torvalds } 2671da177e4SLinus Torvalds 268a33bc5c1SNeil Horman void __init xfrm4_init(int rt_max_size) 2691da177e4SLinus Torvalds { 270a33bc5c1SNeil Horman /* 271a33bc5c1SNeil Horman * Select a default value for the gc_thresh based on the main route 272a33bc5c1SNeil Horman * table hash size. It seems to me the worst case scenario is when 273a33bc5c1SNeil Horman * we have ipsec operating in transport mode, in which we create a 274a33bc5c1SNeil Horman * dst_entry per socket. The xfrm gc algorithm starts trying to remove 275a33bc5c1SNeil Horman * entries at gc_thresh, and prevents new allocations as 2*gc_thresh 276a33bc5c1SNeil Horman * so lets set an initial xfrm gc_thresh value at the rt_max_size/2. 277a33bc5c1SNeil Horman * That will let us store an ipsec connection per route table entry, 278a33bc5c1SNeil Horman * and start cleaning when were 1/2 full 279a33bc5c1SNeil Horman */ 280a33bc5c1SNeil Horman xfrm4_dst_ops.gc_thresh = rt_max_size/2; 281fc66f95cSEric Dumazet dst_entries_init(&xfrm4_dst_ops); 282d7c7544cSAlexey Dobriyan 283d7c7544cSAlexey Dobriyan xfrm4_state_init(); 284d7c7544cSAlexey Dobriyan xfrm4_policy_init(); 285f816700aSRandy Dunlap #ifdef CONFIG_SYSCTL 286a44a4a00SNeil Horman sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path, 287a44a4a00SNeil Horman xfrm4_policy_table); 288f816700aSRandy Dunlap #endif 2891da177e4SLinus Torvalds } 2901da177e4SLinus Torvalds 291