xref: /linux/net/ipv6/xfrm6_policy.c (revision e7d759f31ca295d589f7420719c311870bb3166f)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * xfrm6_policy.c: based on xfrm4_policy.c
4  *
5  * Authors:
6  *	Mitsuru KANDA @USAGI
7  *	Kazunori MIYAZAWA @USAGI
8  *	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9  *		IPv6 support
10  *	YOSHIFUJI Hideaki
11  *		Split up af-specific portion
12  *
13  */
14 
15 #include <linux/err.h>
16 #include <linux/kernel.h>
17 #include <linux/netdevice.h>
18 #include <net/addrconf.h>
19 #include <net/dst.h>
20 #include <net/xfrm.h>
21 #include <net/ip.h>
22 #include <net/ipv6.h>
23 #include <net/ip6_route.h>
24 #include <net/l3mdev.h>
25 
26 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
27 					  const xfrm_address_t *saddr,
28 					  const xfrm_address_t *daddr,
29 					  u32 mark)
30 {
31 	struct flowi6 fl6;
32 	struct dst_entry *dst;
33 	int err;
34 
35 	memset(&fl6, 0, sizeof(fl6));
36 	fl6.flowi6_l3mdev = l3mdev_master_ifindex_by_index(net, oif);
37 	fl6.flowi6_mark = mark;
38 	memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
39 	if (saddr)
40 		memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
41 
42 	dst = ip6_route_output(net, NULL, &fl6);
43 
44 	err = dst->error;
45 	if (dst->error) {
46 		dst_release(dst);
47 		dst = ERR_PTR(err);
48 	}
49 
50 	return dst;
51 }
52 
53 static int xfrm6_get_saddr(struct net *net, int oif,
54 			   xfrm_address_t *saddr, xfrm_address_t *daddr,
55 			   u32 mark)
56 {
57 	struct dst_entry *dst;
58 	struct net_device *dev;
59 
60 	dst = xfrm6_dst_lookup(net, 0, oif, NULL, daddr, mark);
61 	if (IS_ERR(dst))
62 		return -EHOSTUNREACH;
63 
64 	dev = ip6_dst_idev(dst)->dev;
65 	ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6, 0, &saddr->in6);
66 	dst_release(dst);
67 	return 0;
68 }
69 
70 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
71 			  const struct flowi *fl)
72 {
73 	struct rt6_info *rt = (struct rt6_info *)xdst->route;
74 
75 	xdst->u.dst.dev = dev;
76 	netdev_hold(dev, &xdst->u.dst.dev_tracker, GFP_ATOMIC);
77 
78 	xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
79 	if (!xdst->u.rt6.rt6i_idev) {
80 		netdev_put(dev, &xdst->u.dst.dev_tracker);
81 		return -ENODEV;
82 	}
83 
84 	/* Sheit... I remember I did this right. Apparently,
85 	 * it was magically lost, so this code needs audit */
86 	xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
87 						   RTF_LOCAL);
88 	xdst->route_cookie = rt6_get_cookie(rt);
89 	xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
90 	xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
91 	xdst->u.rt6.rt6i_src = rt->rt6i_src;
92 	rt6_uncached_list_add(&xdst->u.rt6);
93 
94 	return 0;
95 }
96 
97 static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
98 			      struct sk_buff *skb, u32 mtu,
99 			      bool confirm_neigh)
100 {
101 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
102 	struct dst_entry *path = xdst->route;
103 
104 	path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh);
105 }
106 
107 static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
108 			   struct sk_buff *skb)
109 {
110 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
111 	struct dst_entry *path = xdst->route;
112 
113 	path->ops->redirect(path, sk, skb);
114 }
115 
116 static void xfrm6_dst_destroy(struct dst_entry *dst)
117 {
118 	struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
119 
120 	dst_destroy_metrics_generic(dst);
121 	rt6_uncached_list_del(&xdst->u.rt6);
122 	if (likely(xdst->u.rt6.rt6i_idev))
123 		in6_dev_put(xdst->u.rt6.rt6i_idev);
124 	xfrm_dst_destroy(xdst);
125 }
126 
127 static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev)
128 {
129 	struct xfrm_dst *xdst;
130 
131 	xdst = (struct xfrm_dst *)dst;
132 	if (xdst->u.rt6.rt6i_idev->dev == dev) {
133 		struct inet6_dev *loopback_idev =
134 			in6_dev_get(dev_net(dev)->loopback_dev);
135 
136 		do {
137 			in6_dev_put(xdst->u.rt6.rt6i_idev);
138 			xdst->u.rt6.rt6i_idev = loopback_idev;
139 			in6_dev_hold(loopback_idev);
140 			xdst = (struct xfrm_dst *)xfrm_dst_child(&xdst->u.dst);
141 		} while (xdst->u.dst.xfrm);
142 
143 		__in6_dev_put(loopback_idev);
144 	}
145 
146 	xfrm_dst_ifdown(dst, dev);
147 }
148 
149 static struct dst_ops xfrm6_dst_ops_template = {
150 	.family =		AF_INET6,
151 	.update_pmtu =		xfrm6_update_pmtu,
152 	.redirect =		xfrm6_redirect,
153 	.cow_metrics =		dst_cow_metrics_generic,
154 	.destroy =		xfrm6_dst_destroy,
155 	.ifdown =		xfrm6_dst_ifdown,
156 	.local_out =		__ip6_local_out,
157 	.gc_thresh =		32768,
158 };
159 
160 static const struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
161 	.dst_ops =		&xfrm6_dst_ops_template,
162 	.dst_lookup =		xfrm6_dst_lookup,
163 	.get_saddr =		xfrm6_get_saddr,
164 	.fill_dst =		xfrm6_fill_dst,
165 	.blackhole_route =	ip6_blackhole_route,
166 };
167 
168 static int __init xfrm6_policy_init(void)
169 {
170 	return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo, AF_INET6);
171 }
172 
173 static void xfrm6_policy_fini(void)
174 {
175 	xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
176 }
177 
178 #ifdef CONFIG_SYSCTL
179 static struct ctl_table xfrm6_policy_table[] = {
180 	{
181 		.procname       = "xfrm6_gc_thresh",
182 		.data		= &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
183 		.maxlen		= sizeof(int),
184 		.mode		= 0644,
185 		.proc_handler   = proc_dointvec,
186 	},
187 	{ }
188 };
189 
190 static int __net_init xfrm6_net_sysctl_init(struct net *net)
191 {
192 	struct ctl_table *table;
193 	struct ctl_table_header *hdr;
194 
195 	table = xfrm6_policy_table;
196 	if (!net_eq(net, &init_net)) {
197 		table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
198 		if (!table)
199 			goto err_alloc;
200 
201 		table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
202 	}
203 
204 	hdr = register_net_sysctl_sz(net, "net/ipv6", table,
205 				     ARRAY_SIZE(xfrm6_policy_table));
206 	if (!hdr)
207 		goto err_reg;
208 
209 	net->ipv6.sysctl.xfrm6_hdr = hdr;
210 	return 0;
211 
212 err_reg:
213 	if (!net_eq(net, &init_net))
214 		kfree(table);
215 err_alloc:
216 	return -ENOMEM;
217 }
218 
219 static void __net_exit xfrm6_net_sysctl_exit(struct net *net)
220 {
221 	struct ctl_table *table;
222 
223 	if (!net->ipv6.sysctl.xfrm6_hdr)
224 		return;
225 
226 	table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
227 	unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
228 	if (!net_eq(net, &init_net))
229 		kfree(table);
230 }
231 #else /* CONFIG_SYSCTL */
232 static inline int xfrm6_net_sysctl_init(struct net *net)
233 {
234 	return 0;
235 }
236 
237 static inline void xfrm6_net_sysctl_exit(struct net *net)
238 {
239 }
240 #endif
241 
242 static int __net_init xfrm6_net_init(struct net *net)
243 {
244 	int ret;
245 
246 	memcpy(&net->xfrm.xfrm6_dst_ops, &xfrm6_dst_ops_template,
247 	       sizeof(xfrm6_dst_ops_template));
248 	ret = dst_entries_init(&net->xfrm.xfrm6_dst_ops);
249 	if (ret)
250 		return ret;
251 
252 	ret = xfrm6_net_sysctl_init(net);
253 	if (ret)
254 		dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
255 
256 	return ret;
257 }
258 
259 static void __net_exit xfrm6_net_exit(struct net *net)
260 {
261 	xfrm6_net_sysctl_exit(net);
262 	dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
263 }
264 
265 static struct pernet_operations xfrm6_net_ops = {
266 	.init	= xfrm6_net_init,
267 	.exit	= xfrm6_net_exit,
268 };
269 
270 int __init xfrm6_init(void)
271 {
272 	int ret;
273 
274 	ret = xfrm6_policy_init();
275 	if (ret)
276 		goto out;
277 	ret = xfrm6_state_init();
278 	if (ret)
279 		goto out_policy;
280 
281 	ret = xfrm6_protocol_init();
282 	if (ret)
283 		goto out_state;
284 
285 	ret = register_pernet_subsys(&xfrm6_net_ops);
286 	if (ret)
287 		goto out_protocol;
288 out:
289 	return ret;
290 out_protocol:
291 	xfrm6_protocol_fini();
292 out_state:
293 	xfrm6_state_fini();
294 out_policy:
295 	xfrm6_policy_fini();
296 	goto out;
297 }
298 
299 void xfrm6_fini(void)
300 {
301 	unregister_pernet_subsys(&xfrm6_net_ops);
302 	xfrm6_protocol_fini();
303 	xfrm6_policy_fini();
304 	xfrm6_state_fini();
305 }
306