~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/xfrm6_policy.c

Version: ~ [ linux-5.6-rc1 ] ~ [ linux-5.5.2 ] ~ [ linux-5.4.17 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.102 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.170 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.213 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.213 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.81 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * xfrm6_policy.c: based on xfrm4_policy.c
  3  *
  4  * Authors:
  5  *      Mitsuru KANDA @USAGI
  6  *      Kazunori MIYAZAWA @USAGI
  7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  8  *              IPv6 support
  9  *      YOSHIFUJI Hideaki
 10  *              Split up af-specific portion
 11  *
 12  */
 13 
 14 #include <linux/err.h>
 15 #include <linux/kernel.h>
 16 #include <linux/netdevice.h>
 17 #include <net/addrconf.h>
 18 #include <net/dst.h>
 19 #include <net/xfrm.h>
 20 #include <net/ip.h>
 21 #include <net/ipv6.h>
 22 #include <net/ip6_route.h>
 23 #include <net/l3mdev.h>
 24 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 25 #include <net/mip6.h>
 26 #endif
 27 
 28 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 29 
 30 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
 31                                           const xfrm_address_t *saddr,
 32                                           const xfrm_address_t *daddr)
 33 {
 34         struct flowi6 fl6;
 35         struct dst_entry *dst;
 36         int err;
 37 
 38         memset(&fl6, 0, sizeof(fl6));
 39         fl6.flowi6_oif = oif;
 40         fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
 41         memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
 42         if (saddr)
 43                 memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
 44 
 45         dst = ip6_route_output(net, NULL, &fl6);
 46 
 47         err = dst->error;
 48         if (dst->error) {
 49                 dst_release(dst);
 50                 dst = ERR_PTR(err);
 51         }
 52 
 53         return dst;
 54 }
 55 
 56 static int xfrm6_get_saddr(struct net *net, int oif,
 57                            xfrm_address_t *saddr, xfrm_address_t *daddr)
 58 {
 59         struct dst_entry *dst;
 60         struct net_device *dev;
 61 
 62         dst = xfrm6_dst_lookup(net, 0, oif, NULL, daddr);
 63         if (IS_ERR(dst))
 64                 return -EHOSTUNREACH;
 65 
 66         dev = ip6_dst_idev(dst)->dev;
 67         ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6, 0, &saddr->in6);
 68         dst_release(dst);
 69         return 0;
 70 }
 71 
 72 static int xfrm6_get_tos(const struct flowi *fl)
 73 {
 74         return 0;
 75 }
 76 
 77 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
 78                            int nfheader_len)
 79 {
 80         if (dst->ops->family == AF_INET6) {
 81                 struct rt6_info *rt = (struct rt6_info *)dst;
 82                 path->path_cookie = rt6_get_cookie(rt);
 83         }
 84 
 85         path->u.rt6.rt6i_nfheader_len = nfheader_len;
 86 
 87         return 0;
 88 }
 89 
 90 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
 91                           const struct flowi *fl)
 92 {
 93         struct rt6_info *rt = (struct rt6_info *)xdst->route;
 94 
 95         xdst->u.dst.dev = dev;
 96         dev_hold(dev);
 97 
 98         xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
 99         if (!xdst->u.rt6.rt6i_idev) {
100                 dev_put(dev);
101                 return -ENODEV;
102         }
103 
104         /* Sheit... I remember I did this right. Apparently,
105          * it was magically lost, so this code needs audit */
106         xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
107                                                    RTF_LOCAL);
108         xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
109         xdst->u.rt6.rt6i_node = rt->rt6i_node;
110         xdst->route_cookie = rt6_get_cookie(rt);
111         xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
112         xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
113         xdst->u.rt6.rt6i_src = rt->rt6i_src;
114 
115         return 0;
116 }
117 
118 static inline void
119 _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
120 {
121         struct flowi6 *fl6 = &fl->u.ip6;
122         int onlyproto = 0;
123         const struct ipv6hdr *hdr = ipv6_hdr(skb);
124         u16 offset = sizeof(*hdr);
125         struct ipv6_opt_hdr *exthdr;
126         const unsigned char *nh = skb_network_header(skb);
127         u16 nhoff = IP6CB(skb)->nhoff;
128         int oif = 0;
129         u8 nexthdr;
130 
131         if (!nhoff)
132                 nhoff = offsetof(struct ipv6hdr, nexthdr);
133 
134         nexthdr = nh[nhoff];
135 
136         if (skb_dst(skb))
137                 oif = l3mdev_fib_oif(skb_dst(skb)->dev);
138 
139         memset(fl6, 0, sizeof(struct flowi6));
140         fl6->flowi6_mark = skb->mark;
141         fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
142 
143         fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
144         fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
145 
146         while (nh + offset + 1 < skb->data ||
147                pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
148                 nh = skb_network_header(skb);
149                 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
150 
151                 switch (nexthdr) {
152                 case NEXTHDR_FRAGMENT:
153                         onlyproto = 1;
154                 case NEXTHDR_ROUTING:
155                 case NEXTHDR_HOP:
156                 case NEXTHDR_DEST:
157                         offset += ipv6_optlen(exthdr);
158                         nexthdr = exthdr->nexthdr;
159                         exthdr = (struct ipv6_opt_hdr *)(nh + offset);
160                         break;
161 
162                 case IPPROTO_UDP:
163                 case IPPROTO_UDPLITE:
164                 case IPPROTO_TCP:
165                 case IPPROTO_SCTP:
166                 case IPPROTO_DCCP:
167                         if (!onlyproto && (nh + offset + 4 < skb->data ||
168                              pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
169                                 __be16 *ports;
170 
171                                 nh = skb_network_header(skb);
172                                 ports = (__be16 *)(nh + offset);
173                                 fl6->fl6_sport = ports[!!reverse];
174                                 fl6->fl6_dport = ports[!reverse];
175                         }
176                         fl6->flowi6_proto = nexthdr;
177                         return;
178 
179                 case IPPROTO_ICMPV6:
180                         if (!onlyproto && (nh + offset + 2 < skb->data ||
181                             pskb_may_pull(skb, nh + offset + 2 - skb->data))) {
182                                 u8 *icmp;
183 
184                                 nh = skb_network_header(skb);
185                                 icmp = (u8 *)(nh + offset);
186                                 fl6->fl6_icmp_type = icmp[0];
187                                 fl6->fl6_icmp_code = icmp[1];
188                         }
189                         fl6->flowi6_proto = nexthdr;
190                         return;
191 
192 #if IS_ENABLED(CONFIG_IPV6_MIP6)
193                 case IPPROTO_MH:
194                         offset += ipv6_optlen(exthdr);
195                         if (!onlyproto && (nh + offset + 3 < skb->data ||
196                             pskb_may_pull(skb, nh + offset + 3 - skb->data))) {
197                                 struct ip6_mh *mh;
198 
199                                 nh = skb_network_header(skb);
200                                 mh = (struct ip6_mh *)(nh + offset);
201                                 fl6->fl6_mh_type = mh->ip6mh_type;
202                         }
203                         fl6->flowi6_proto = nexthdr;
204                         return;
205 #endif
206 
207                 /* XXX Why are there these headers? */
208                 case IPPROTO_AH:
209                 case IPPROTO_ESP:
210                 case IPPROTO_COMP:
211                 default:
212                         fl6->fl6_ipsec_spi = 0;
213                         fl6->flowi6_proto = nexthdr;
214                         return;
215                 }
216         }
217 }
218 
219 static inline int xfrm6_garbage_collect(struct dst_ops *ops)
220 {
221         struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
222 
223         xfrm6_policy_afinfo.garbage_collect(net);
224         return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
225 }
226 
227 static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
228                               struct sk_buff *skb, u32 mtu)
229 {
230         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
231         struct dst_entry *path = xdst->route;
232 
233         path->ops->update_pmtu(path, sk, skb, mtu);
234 }
235 
236 static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
237                            struct sk_buff *skb)
238 {
239         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
240         struct dst_entry *path = xdst->route;
241 
242         path->ops->redirect(path, sk, skb);
243 }
244 
245 static void xfrm6_dst_destroy(struct dst_entry *dst)
246 {
247         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
248 
249         if (likely(xdst->u.rt6.rt6i_idev))
250                 in6_dev_put(xdst->u.rt6.rt6i_idev);
251         dst_destroy_metrics_generic(dst);
252         xfrm_dst_destroy(xdst);
253 }
254 
255 static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
256                              int unregister)
257 {
258         struct xfrm_dst *xdst;
259 
260         if (!unregister)
261                 return;
262 
263         xdst = (struct xfrm_dst *)dst;
264         if (xdst->u.rt6.rt6i_idev->dev == dev) {
265                 struct inet6_dev *loopback_idev =
266                         in6_dev_get(dev_net(dev)->loopback_dev);
267                 BUG_ON(!loopback_idev);
268 
269                 do {
270                         in6_dev_put(xdst->u.rt6.rt6i_idev);
271                         xdst->u.rt6.rt6i_idev = loopback_idev;
272                         in6_dev_hold(loopback_idev);
273                         xdst = (struct xfrm_dst *)xdst->u.dst.child;
274                 } while (xdst->u.dst.xfrm);
275 
276                 __in6_dev_put(loopback_idev);
277         }
278 
279         xfrm_dst_ifdown(dst, dev);
280 }
281 
282 static struct dst_ops xfrm6_dst_ops_template = {
283         .family =               AF_INET6,
284         .gc =                   xfrm6_garbage_collect,
285         .update_pmtu =          xfrm6_update_pmtu,
286         .redirect =             xfrm6_redirect,
287         .cow_metrics =          dst_cow_metrics_generic,
288         .destroy =              xfrm6_dst_destroy,
289         .ifdown =               xfrm6_dst_ifdown,
290         .local_out =            __ip6_local_out,
291         .gc_thresh =            INT_MAX,
292 };
293 
294 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
295         .family =               AF_INET6,
296         .dst_ops =              &xfrm6_dst_ops_template,
297         .dst_lookup =           xfrm6_dst_lookup,
298         .get_saddr =            xfrm6_get_saddr,
299         .decode_session =       _decode_session6,
300         .get_tos =              xfrm6_get_tos,
301         .init_path =            xfrm6_init_path,
302         .fill_dst =             xfrm6_fill_dst,
303         .blackhole_route =      ip6_blackhole_route,
304 };
305 
306 static int __init xfrm6_policy_init(void)
307 {
308         return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
309 }
310 
311 static void xfrm6_policy_fini(void)
312 {
313         xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
314 }
315 
316 #ifdef CONFIG_SYSCTL
317 static struct ctl_table xfrm6_policy_table[] = {
318         {
319                 .procname       = "xfrm6_gc_thresh",
320                 .data           = &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
321                 .maxlen         = sizeof(int),
322                 .mode           = 0644,
323                 .proc_handler   = proc_dointvec,
324         },
325         { }
326 };
327 
328 static int __net_init xfrm6_net_sysctl_init(struct net *net)
329 {
330         struct ctl_table *table;
331         struct ctl_table_header *hdr;
332 
333         table = xfrm6_policy_table;
334         if (!net_eq(net, &init_net)) {
335                 table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
336                 if (!table)
337                         goto err_alloc;
338 
339                 table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
340         }
341 
342         hdr = register_net_sysctl(net, "net/ipv6", table);
343         if (!hdr)
344                 goto err_reg;
345 
346         net->ipv6.sysctl.xfrm6_hdr = hdr;
347         return 0;
348 
349 err_reg:
350         if (!net_eq(net, &init_net))
351                 kfree(table);
352 err_alloc:
353         return -ENOMEM;
354 }
355 
356 static void __net_exit xfrm6_net_sysctl_exit(struct net *net)
357 {
358         struct ctl_table *table;
359 
360         if (!net->ipv6.sysctl.xfrm6_hdr)
361                 return;
362 
363         table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
364         unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
365         if (!net_eq(net, &init_net))
366                 kfree(table);
367 }
368 #else /* CONFIG_SYSCTL */
369 static int inline xfrm6_net_sysctl_init(struct net *net)
370 {
371         return 0;
372 }
373 
374 static void inline xfrm6_net_sysctl_exit(struct net *net)
375 {
376 }
377 #endif
378 
379 static int __net_init xfrm6_net_init(struct net *net)
380 {
381         int ret;
382 
383         memcpy(&net->xfrm.xfrm6_dst_ops, &xfrm6_dst_ops_template,
384                sizeof(xfrm6_dst_ops_template));
385         ret = dst_entries_init(&net->xfrm.xfrm6_dst_ops);
386         if (ret)
387                 return ret;
388 
389         ret = xfrm6_net_sysctl_init(net);
390         if (ret)
391                 dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
392 
393         return ret;
394 }
395 
396 static void __net_exit xfrm6_net_exit(struct net *net)
397 {
398         xfrm6_net_sysctl_exit(net);
399         dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
400 }
401 
402 static struct pernet_operations xfrm6_net_ops = {
403         .init   = xfrm6_net_init,
404         .exit   = xfrm6_net_exit,
405 };
406 
407 int __init xfrm6_init(void)
408 {
409         int ret;
410 
411         ret = xfrm6_policy_init();
412         if (ret)
413                 goto out;
414         ret = xfrm6_state_init();
415         if (ret)
416                 goto out_policy;
417 
418         ret = xfrm6_protocol_init();
419         if (ret)
420                 goto out_state;
421 
422         register_pernet_subsys(&xfrm6_net_ops);
423 out:
424         return ret;
425 out_state:
426         xfrm6_state_fini();
427 out_policy:
428         xfrm6_policy_fini();
429         goto out;
430 }
431 
432 void xfrm6_fini(void)
433 {
434         unregister_pernet_subsys(&xfrm6_net_ops);
435         xfrm6_protocol_fini();
436         xfrm6_policy_fini();
437         xfrm6_state_fini();
438 }
439 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp