xref: /linux/net/ipv4/xfrm4_policy.c (revision d7c7544c3d5f59033d1bf3236bc7b289f5f26b75)
11da177e4SLinus Torvalds /*
21da177e4SLinus Torvalds  * xfrm4_policy.c
31da177e4SLinus Torvalds  *
41da177e4SLinus Torvalds  * Changes:
51da177e4SLinus Torvalds  *	Kazunori MIYAZAWA @USAGI
61da177e4SLinus Torvalds  * 	YOSHIFUJI Hideaki @USAGI
71da177e4SLinus Torvalds  *		Split up af-specific portion
81da177e4SLinus Torvalds  *
91da177e4SLinus Torvalds  */
101da177e4SLinus Torvalds 
1166cdb3caSHerbert Xu #include <linux/err.h>
1266cdb3caSHerbert Xu #include <linux/kernel.h>
13aabc9761SHerbert Xu #include <linux/inetdevice.h>
1445ff5a3fSHerbert Xu #include <net/dst.h>
151da177e4SLinus Torvalds #include <net/xfrm.h>
161da177e4SLinus Torvalds #include <net/ip.h>
171da177e4SLinus Torvalds 
181da177e4SLinus Torvalds static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
191da177e4SLinus Torvalds 
20c5b3cf46SAlexey Dobriyan static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
21c5b3cf46SAlexey Dobriyan 					  xfrm_address_t *saddr,
2266cdb3caSHerbert Xu 					  xfrm_address_t *daddr)
231da177e4SLinus Torvalds {
2466cdb3caSHerbert Xu 	struct flowi fl = {
25a1e59abfSPatrick McHardy 		.nl_u = {
26a1e59abfSPatrick McHardy 			.ip4_u = {
2766cdb3caSHerbert Xu 				.tos = tos,
28a1e59abfSPatrick McHardy 				.daddr = daddr->a4,
29a1e59abfSPatrick McHardy 			},
30a1e59abfSPatrick McHardy 		},
31a1e59abfSPatrick McHardy 	};
3266cdb3caSHerbert Xu 	struct dst_entry *dst;
3366cdb3caSHerbert Xu 	struct rtable *rt;
3466cdb3caSHerbert Xu 	int err;
35a1e59abfSPatrick McHardy 
3666cdb3caSHerbert Xu 	if (saddr)
3766cdb3caSHerbert Xu 		fl.fl4_src = saddr->a4;
3866cdb3caSHerbert Xu 
39c5b3cf46SAlexey Dobriyan 	err = __ip_route_output_key(net, &rt, &fl);
4066cdb3caSHerbert Xu 	dst = &rt->u.dst;
4166cdb3caSHerbert Xu 	if (err)
4266cdb3caSHerbert Xu 		dst = ERR_PTR(err);
4366cdb3caSHerbert Xu 	return dst;
44a1e59abfSPatrick McHardy }
4566cdb3caSHerbert Xu 
46fbda33b2SAlexey Dobriyan static int xfrm4_get_saddr(struct net *net,
47fbda33b2SAlexey Dobriyan 			   xfrm_address_t *saddr, xfrm_address_t *daddr)
4866cdb3caSHerbert Xu {
4966cdb3caSHerbert Xu 	struct dst_entry *dst;
5066cdb3caSHerbert Xu 	struct rtable *rt;
5166cdb3caSHerbert Xu 
52fbda33b2SAlexey Dobriyan 	dst = xfrm4_dst_lookup(net, 0, NULL, daddr);
5366cdb3caSHerbert Xu 	if (IS_ERR(dst))
54a1e59abfSPatrick McHardy 		return -EHOSTUNREACH;
5566cdb3caSHerbert Xu 
5666cdb3caSHerbert Xu 	rt = (struct rtable *)dst;
5766cdb3caSHerbert Xu 	saddr->a4 = rt->rt_src;
5866cdb3caSHerbert Xu 	dst_release(dst);
5966cdb3caSHerbert Xu 	return 0;
60a1e59abfSPatrick McHardy }
61a1e59abfSPatrick McHardy 
621da177e4SLinus Torvalds static struct dst_entry *
631da177e4SLinus Torvalds __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
641da177e4SLinus Torvalds {
651da177e4SLinus Torvalds 	struct dst_entry *dst;
661da177e4SLinus Torvalds 
671da177e4SLinus Torvalds 	read_lock_bh(&policy->lock);
681da177e4SLinus Torvalds 	for (dst = policy->bundles; dst; dst = dst->next) {
691da177e4SLinus Torvalds 		struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
701da177e4SLinus Torvalds 		if (xdst->u.rt.fl.oif == fl->oif &&	/*XXX*/
711da177e4SLinus Torvalds 		    xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
721da177e4SLinus Torvalds 		    xdst->u.rt.fl.fl4_src == fl->fl4_src &&
734da3089fSHerbert Xu 		    xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
745b368e61SVenkat Yekkirala 		    xfrm_bundle_ok(policy, xdst, fl, AF_INET, 0)) {
751da177e4SLinus Torvalds 			dst_clone(dst);
761da177e4SLinus Torvalds 			break;
771da177e4SLinus Torvalds 		}
781da177e4SLinus Torvalds 	}
791da177e4SLinus Torvalds 	read_unlock_bh(&policy->lock);
801da177e4SLinus Torvalds 	return dst;
811da177e4SLinus Torvalds }
821da177e4SLinus Torvalds 
8325ee3286SHerbert Xu static int xfrm4_get_tos(struct flowi *fl)
841da177e4SLinus Torvalds {
8525ee3286SHerbert Xu 	return fl->fl4_tos;
861da177e4SLinus Torvalds }
871da177e4SLinus Torvalds 
88a1b05140SMasahide NAKAMURA static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
89a1b05140SMasahide NAKAMURA 			   int nfheader_len)
90a1b05140SMasahide NAKAMURA {
91a1b05140SMasahide NAKAMURA 	return 0;
92a1b05140SMasahide NAKAMURA }
93a1b05140SMasahide NAKAMURA 
9425ee3286SHerbert Xu static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
9525ee3286SHerbert Xu {
9625ee3286SHerbert Xu 	struct rtable *rt = (struct rtable *)xdst->route;
971da177e4SLinus Torvalds 
9825ee3286SHerbert Xu 	xdst->u.rt.fl = rt->fl;
991da177e4SLinus Torvalds 
10025ee3286SHerbert Xu 	xdst->u.dst.dev = dev;
10125ee3286SHerbert Xu 	dev_hold(dev);
10243372262SMiika Komu 
10325ee3286SHerbert Xu 	xdst->u.rt.idev = in_dev_get(dev);
10425ee3286SHerbert Xu 	if (!xdst->u.rt.idev)
10525ee3286SHerbert Xu 		return -ENODEV;
1061da177e4SLinus Torvalds 
10725ee3286SHerbert Xu 	xdst->u.rt.peer = rt->peer;
10825ee3286SHerbert Xu 	if (rt->peer)
10925ee3286SHerbert Xu 		atomic_inc(&rt->peer->refcnt);
11066cdb3caSHerbert Xu 
1111da177e4SLinus Torvalds 	/* Sheit... I remember I did this right. Apparently,
1121da177e4SLinus Torvalds 	 * it was magically lost, so this code needs audit */
11325ee3286SHerbert Xu 	xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST |
11425ee3286SHerbert Xu 					      RTCF_LOCAL);
11525ee3286SHerbert Xu 	xdst->u.rt.rt_type = rt->rt_type;
11625ee3286SHerbert Xu 	xdst->u.rt.rt_src = rt->rt_src;
11725ee3286SHerbert Xu 	xdst->u.rt.rt_dst = rt->rt_dst;
11825ee3286SHerbert Xu 	xdst->u.rt.rt_gateway = rt->rt_gateway;
11925ee3286SHerbert Xu 	xdst->u.rt.rt_spec_dst = rt->rt_spec_dst;
1201da177e4SLinus Torvalds 
1211da177e4SLinus Torvalds 	return 0;
1221da177e4SLinus Torvalds }
1231da177e4SLinus Torvalds 
1241da177e4SLinus Torvalds static void
125d5422efeSHerbert Xu _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
1261da177e4SLinus Torvalds {
127eddc9ec5SArnaldo Carvalho de Melo 	struct iphdr *iph = ip_hdr(skb);
128d56f90a7SArnaldo Carvalho de Melo 	u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
1291da177e4SLinus Torvalds 
1301da177e4SLinus Torvalds 	memset(fl, 0, sizeof(struct flowi));
1311da177e4SLinus Torvalds 	if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
1321da177e4SLinus Torvalds 		switch (iph->protocol) {
1331da177e4SLinus Torvalds 		case IPPROTO_UDP:
134ba4e58ecSGerrit Renker 		case IPPROTO_UDPLITE:
1351da177e4SLinus Torvalds 		case IPPROTO_TCP:
1361da177e4SLinus Torvalds 		case IPPROTO_SCTP:
1379e999993SPatrick McHardy 		case IPPROTO_DCCP:
138c615c9f3SWei Yongjun 			if (xprth + 4 < skb->data ||
139c615c9f3SWei Yongjun 			    pskb_may_pull(skb, xprth + 4 - skb->data)) {
1408c689a6eSAl Viro 				__be16 *ports = (__be16 *)xprth;
1411da177e4SLinus Torvalds 
142d5422efeSHerbert Xu 				fl->fl_ip_sport = ports[!!reverse];
143d5422efeSHerbert Xu 				fl->fl_ip_dport = ports[!reverse];
1441da177e4SLinus Torvalds 			}
1451da177e4SLinus Torvalds 			break;
1461da177e4SLinus Torvalds 
1471da177e4SLinus Torvalds 		case IPPROTO_ICMP:
1481da177e4SLinus Torvalds 			if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
1491da177e4SLinus Torvalds 				u8 *icmp = xprth;
1501da177e4SLinus Torvalds 
1511da177e4SLinus Torvalds 				fl->fl_icmp_type = icmp[0];
1521da177e4SLinus Torvalds 				fl->fl_icmp_code = icmp[1];
1531da177e4SLinus Torvalds 			}
1541da177e4SLinus Torvalds 			break;
1551da177e4SLinus Torvalds 
1561da177e4SLinus Torvalds 		case IPPROTO_ESP:
1571da177e4SLinus Torvalds 			if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
1584324a174SAl Viro 				__be32 *ehdr = (__be32 *)xprth;
1591da177e4SLinus Torvalds 
1601da177e4SLinus Torvalds 				fl->fl_ipsec_spi = ehdr[0];
1611da177e4SLinus Torvalds 			}
1621da177e4SLinus Torvalds 			break;
1631da177e4SLinus Torvalds 
1641da177e4SLinus Torvalds 		case IPPROTO_AH:
1651da177e4SLinus Torvalds 			if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
1664324a174SAl Viro 				__be32 *ah_hdr = (__be32*)xprth;
1671da177e4SLinus Torvalds 
1681da177e4SLinus Torvalds 				fl->fl_ipsec_spi = ah_hdr[1];
1691da177e4SLinus Torvalds 			}
1701da177e4SLinus Torvalds 			break;
1711da177e4SLinus Torvalds 
1721da177e4SLinus Torvalds 		case IPPROTO_COMP:
1731da177e4SLinus Torvalds 			if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
1744324a174SAl Viro 				__be16 *ipcomp_hdr = (__be16 *)xprth;
1751da177e4SLinus Torvalds 
1764195f814SAlexey Dobriyan 				fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
1771da177e4SLinus Torvalds 			}
1781da177e4SLinus Torvalds 			break;
1791da177e4SLinus Torvalds 		default:
1801da177e4SLinus Torvalds 			fl->fl_ipsec_spi = 0;
1811da177e4SLinus Torvalds 			break;
1823ff50b79SStephen Hemminger 		}
1831da177e4SLinus Torvalds 	}
1841da177e4SLinus Torvalds 	fl->proto = iph->protocol;
185d5422efeSHerbert Xu 	fl->fl4_dst = reverse ? iph->saddr : iph->daddr;
186d5422efeSHerbert Xu 	fl->fl4_src = reverse ? iph->daddr : iph->saddr;
1874da3089fSHerbert Xu 	fl->fl4_tos = iph->tos;
1881da177e4SLinus Torvalds }
1891da177e4SLinus Torvalds 
190569d3645SDaniel Lezcano static inline int xfrm4_garbage_collect(struct dst_ops *ops)
1911da177e4SLinus Torvalds {
192*d7c7544cSAlexey Dobriyan 	struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops);
193*d7c7544cSAlexey Dobriyan 
194*d7c7544cSAlexey Dobriyan 	xfrm4_policy_afinfo.garbage_collect(net);
195*d7c7544cSAlexey Dobriyan 	return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
1961da177e4SLinus Torvalds }
1971da177e4SLinus Torvalds 
1981da177e4SLinus Torvalds static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
1991da177e4SLinus Torvalds {
2001da177e4SLinus Torvalds 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
2011da177e4SLinus Torvalds 	struct dst_entry *path = xdst->route;
2021da177e4SLinus Torvalds 
2031da177e4SLinus Torvalds 	path->ops->update_pmtu(path, mtu);
2041da177e4SLinus Torvalds }
2051da177e4SLinus Torvalds 
206aabc9761SHerbert Xu static void xfrm4_dst_destroy(struct dst_entry *dst)
207aabc9761SHerbert Xu {
208aabc9761SHerbert Xu 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
209aabc9761SHerbert Xu 
210aabc9761SHerbert Xu 	if (likely(xdst->u.rt.idev))
211aabc9761SHerbert Xu 		in_dev_put(xdst->u.rt.idev);
212ed3e37ddSHerbert Xu 	if (likely(xdst->u.rt.peer))
21326db1677SDavid S. Miller 		inet_putpeer(xdst->u.rt.peer);
214aabc9761SHerbert Xu 	xfrm_dst_destroy(xdst);
215aabc9761SHerbert Xu }
216aabc9761SHerbert Xu 
217aabc9761SHerbert Xu static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
218aabc9761SHerbert Xu 			     int unregister)
219aabc9761SHerbert Xu {
220aabc9761SHerbert Xu 	struct xfrm_dst *xdst;
221aabc9761SHerbert Xu 
222aabc9761SHerbert Xu 	if (!unregister)
223aabc9761SHerbert Xu 		return;
224aabc9761SHerbert Xu 
225aabc9761SHerbert Xu 	xdst = (struct xfrm_dst *)dst;
226aabc9761SHerbert Xu 	if (xdst->u.rt.idev->dev == dev) {
2275a3e55d6SDenis V. Lunev 		struct in_device *loopback_idev =
228c346dca1SYOSHIFUJI Hideaki 			in_dev_get(dev_net(dev)->loopback_dev);
229aabc9761SHerbert Xu 		BUG_ON(!loopback_idev);
230aabc9761SHerbert Xu 
231aabc9761SHerbert Xu 		do {
232aabc9761SHerbert Xu 			in_dev_put(xdst->u.rt.idev);
233aabc9761SHerbert Xu 			xdst->u.rt.idev = loopback_idev;
234aabc9761SHerbert Xu 			in_dev_hold(loopback_idev);
235aabc9761SHerbert Xu 			xdst = (struct xfrm_dst *)xdst->u.dst.child;
236aabc9761SHerbert Xu 		} while (xdst->u.dst.xfrm);
237aabc9761SHerbert Xu 
238aabc9761SHerbert Xu 		__in_dev_put(loopback_idev);
239aabc9761SHerbert Xu 	}
240aabc9761SHerbert Xu 
241aabc9761SHerbert Xu 	xfrm_dst_ifdown(dst, dev);
242aabc9761SHerbert Xu }
243aabc9761SHerbert Xu 
2441da177e4SLinus Torvalds static struct dst_ops xfrm4_dst_ops = {
2451da177e4SLinus Torvalds 	.family =		AF_INET,
24609640e63SHarvey Harrison 	.protocol =		cpu_to_be16(ETH_P_IP),
2471da177e4SLinus Torvalds 	.gc =			xfrm4_garbage_collect,
2481da177e4SLinus Torvalds 	.update_pmtu =		xfrm4_update_pmtu,
249aabc9761SHerbert Xu 	.destroy =		xfrm4_dst_destroy,
250aabc9761SHerbert Xu 	.ifdown =		xfrm4_dst_ifdown,
251862b82c6SHerbert Xu 	.local_out =		__ip_local_out,
2521da177e4SLinus Torvalds 	.gc_thresh =		1024,
253e2422970SEric Dumazet 	.entries =		ATOMIC_INIT(0),
2541da177e4SLinus Torvalds };
2551da177e4SLinus Torvalds 
2561da177e4SLinus Torvalds static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
2571da177e4SLinus Torvalds 	.family = 		AF_INET,
2581da177e4SLinus Torvalds 	.dst_ops =		&xfrm4_dst_ops,
2591da177e4SLinus Torvalds 	.dst_lookup =		xfrm4_dst_lookup,
260a1e59abfSPatrick McHardy 	.get_saddr =		xfrm4_get_saddr,
2611da177e4SLinus Torvalds 	.find_bundle = 		__xfrm4_find_bundle,
2621da177e4SLinus Torvalds 	.decode_session =	_decode_session4,
26325ee3286SHerbert Xu 	.get_tos =		xfrm4_get_tos,
264a1b05140SMasahide NAKAMURA 	.init_path =		xfrm4_init_path,
26525ee3286SHerbert Xu 	.fill_dst =		xfrm4_fill_dst,
2661da177e4SLinus Torvalds };
2671da177e4SLinus Torvalds 
268f816700aSRandy Dunlap #ifdef CONFIG_SYSCTL
269a44a4a00SNeil Horman static struct ctl_table xfrm4_policy_table[] = {
270a44a4a00SNeil Horman 	{
271a44a4a00SNeil Horman 		.procname       = "xfrm4_gc_thresh",
272*d7c7544cSAlexey Dobriyan 		.data           = &init_net.xfrm.xfrm4_dst_ops.gc_thresh,
273a44a4a00SNeil Horman 		.maxlen         = sizeof(int),
274a44a4a00SNeil Horman 		.mode           = 0644,
275a44a4a00SNeil Horman 		.proc_handler   = proc_dointvec,
276a44a4a00SNeil Horman 	},
277a44a4a00SNeil Horman 	{ }
278a44a4a00SNeil Horman };
279a44a4a00SNeil Horman 
280a44a4a00SNeil Horman static struct ctl_table_header *sysctl_hdr;
281f816700aSRandy Dunlap #endif
282a44a4a00SNeil Horman 
2831da177e4SLinus Torvalds static void __init xfrm4_policy_init(void)
2841da177e4SLinus Torvalds {
2851da177e4SLinus Torvalds 	xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
2861da177e4SLinus Torvalds }
2871da177e4SLinus Torvalds 
2881da177e4SLinus Torvalds static void __exit xfrm4_policy_fini(void)
2891da177e4SLinus Torvalds {
290f816700aSRandy Dunlap #ifdef CONFIG_SYSCTL
291a44a4a00SNeil Horman 	if (sysctl_hdr)
292a44a4a00SNeil Horman 		unregister_net_sysctl_table(sysctl_hdr);
293f816700aSRandy Dunlap #endif
2941da177e4SLinus Torvalds 	xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
2951da177e4SLinus Torvalds }
2961da177e4SLinus Torvalds 
297a33bc5c1SNeil Horman void __init xfrm4_init(int rt_max_size)
2981da177e4SLinus Torvalds {
299a33bc5c1SNeil Horman 	/*
300a33bc5c1SNeil Horman 	 * Select a default value for the gc_thresh based on the main route
301a33bc5c1SNeil Horman 	 * table hash size.  It seems to me the worst case scenario is when
302a33bc5c1SNeil Horman 	 * we have ipsec operating in transport mode, in which we create a
303a33bc5c1SNeil Horman 	 * dst_entry per socket.  The xfrm gc algorithm starts trying to remove
304a33bc5c1SNeil Horman 	 * entries at gc_thresh, and prevents new allocations as 2*gc_thresh
305a33bc5c1SNeil Horman 	 * so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
306a33bc5c1SNeil Horman 	 * That will let us store an ipsec connection per route table entry,
307a33bc5c1SNeil Horman 	 * and start cleaning when were 1/2 full
308a33bc5c1SNeil Horman 	 */
309a33bc5c1SNeil Horman 	xfrm4_dst_ops.gc_thresh = rt_max_size/2;
310*d7c7544cSAlexey Dobriyan 
311*d7c7544cSAlexey Dobriyan 	xfrm4_state_init();
312*d7c7544cSAlexey Dobriyan 	xfrm4_policy_init();
313f816700aSRandy Dunlap #ifdef CONFIG_SYSCTL
314a44a4a00SNeil Horman 	sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv4_ctl_path,
315a44a4a00SNeil Horman 						xfrm4_policy_table);
316f816700aSRandy Dunlap #endif
3171da177e4SLinus Torvalds }
3181da177e4SLinus Torvalds 
319