]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
e905a9ed | 2 | /* |
1da177e4 LT |
3 | * xfrm4_policy.c |
4 | * | |
5 | * Changes: | |
6 | * Kazunori MIYAZAWA @USAGI | |
7 | * YOSHIFUJI Hideaki @USAGI | |
8 | * Split up af-specific portion | |
e905a9ed | 9 | * |
1da177e4 LT |
10 | */ |
11 | ||
66cdb3ca HX |
12 | #include <linux/err.h> |
13 | #include <linux/kernel.h> | |
aabc9761 | 14 | #include <linux/inetdevice.h> |
cc9ff19d | 15 | #include <linux/if_tunnel.h> |
45ff5a3f | 16 | #include <net/dst.h> |
1da177e4 LT |
17 | #include <net/xfrm.h> |
18 | #include <net/ip.h> | |
385add90 | 19 | #include <net/l3mdev.h> |
1da177e4 | 20 | |
8f01cb08 | 21 | static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4, |
42a7b32b | 22 | int tos, int oif, |
8f01cb08 | 23 | const xfrm_address_t *saddr, |
077fbac4 LC |
24 | const xfrm_address_t *daddr, |
25 | u32 mark) | |
1da177e4 | 26 | { |
66cdb3ca | 27 | struct rtable *rt; |
a1e59abf | 28 | |
8f01cb08 DM |
29 | memset(fl4, 0, sizeof(*fl4)); |
30 | fl4->daddr = daddr->a4; | |
31 | fl4->flowi4_tos = tos; | |
11d7a0bb | 32 | fl4->flowi4_oif = l3mdev_master_ifindex_by_index(net, oif); |
077fbac4 | 33 | fl4->flowi4_mark = mark; |
66cdb3ca | 34 | if (saddr) |
8f01cb08 | 35 | fl4->saddr = saddr->a4; |
66cdb3ca | 36 | |
58189ca7 DA |
37 | fl4->flowi4_flags = FLOWI_FLAG_SKIP_NH_OIF; |
38 | ||
8f01cb08 | 39 | rt = __ip_route_output_key(net, fl4); |
b23dd4fe DM |
40 | if (!IS_ERR(rt)) |
41 | return &rt->dst; | |
42 | ||
43 | return ERR_CAST(rt); | |
66cdb3ca HX |
44 | } |
45 | ||
42a7b32b | 46 | static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos, int oif, |
8f01cb08 | 47 | const xfrm_address_t *saddr, |
077fbac4 LC |
48 | const xfrm_address_t *daddr, |
49 | u32 mark) | |
8f01cb08 DM |
50 | { |
51 | struct flowi4 fl4; | |
52 | ||
077fbac4 | 53 | return __xfrm4_dst_lookup(net, &fl4, tos, oif, saddr, daddr, mark); |
8f01cb08 DM |
54 | } |
55 | ||
42a7b32b | 56 | static int xfrm4_get_saddr(struct net *net, int oif, |
077fbac4 LC |
57 | xfrm_address_t *saddr, xfrm_address_t *daddr, |
58 | u32 mark) | |
66cdb3ca HX |
59 | { |
60 | struct dst_entry *dst; | |
8f01cb08 | 61 | struct flowi4 fl4; |
66cdb3ca | 62 | |
077fbac4 | 63 | dst = __xfrm4_dst_lookup(net, &fl4, 0, oif, NULL, daddr, mark); |
66cdb3ca HX |
64 | if (IS_ERR(dst)) |
65 | return -EHOSTUNREACH; | |
66 | ||
8f01cb08 | 67 | saddr->a4 = fl4.saddr; |
66cdb3ca HX |
68 | dst_release(dst); |
69 | return 0; | |
a1e59abf PM |
70 | } |
71 | ||
05d84025 | 72 | static int xfrm4_get_tos(const struct flowi *fl) |
1da177e4 | 73 | { |
7e1dc7b6 | 74 | return IPTOS_RT_MASK & fl->u.ip4.flowi4_tos; /* Strip ECN bits */ |
25ee3286 | 75 | } |
1da177e4 | 76 | |
a1b05140 MN |
77 | static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst, |
78 | int nfheader_len) | |
79 | { | |
80 | return 0; | |
81 | } | |
82 | ||
87c1e12b | 83 | static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, |
0c7b3eef | 84 | const struct flowi *fl) |
25ee3286 HX |
85 | { |
86 | struct rtable *rt = (struct rtable *)xdst->route; | |
7e1dc7b6 | 87 | const struct flowi4 *fl4 = &fl->u.ip4; |
1da177e4 | 88 | |
b7323396 | 89 | xdst->u.rt.rt_iif = fl4->flowi4_iif; |
1da177e4 | 90 | |
25ee3286 HX |
91 | xdst->u.dst.dev = dev; |
92 | dev_hold(dev); | |
43372262 | 93 | |
25ee3286 HX |
94 | /* Sheit... I remember I did this right. Apparently, |
95 | * it was magically lost, so this code needs audit */ | |
9917e1e8 | 96 | xdst->u.rt.rt_is_input = rt->rt_is_input; |
25ee3286 HX |
97 | xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST | |
98 | RTCF_LOCAL); | |
99 | xdst->u.rt.rt_type = rt->rt_type; | |
25ee3286 | 100 | xdst->u.rt.rt_gateway = rt->rt_gateway; |
155e8336 | 101 | xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway; |
5943634f | 102 | xdst->u.rt.rt_pmtu = rt->rt_pmtu; |
a9f829f7 | 103 | xdst->u.rt.rt_mtu_locked = rt->rt_mtu_locked; |
b7503e0c | 104 | xdst->u.rt.rt_table_id = rt->rt_table_id; |
caacf05e | 105 | INIT_LIST_HEAD(&xdst->u.rt.rt_uncached); |
31a5b09d | 106 | rt_add_uncached_list(&xdst->u.rt); |
1da177e4 | 107 | |
1da177e4 | 108 | return 0; |
1da177e4 LT |
109 | } |
110 | ||
111 | static void | |
d5422efe | 112 | _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse) |
1da177e4 | 113 | { |
b71d1d42 | 114 | const struct iphdr *iph = ip_hdr(skb); |
d56f90a7 | 115 | u8 *xprth = skb_network_header(skb) + iph->ihl * 4; |
7e1dc7b6 | 116 | struct flowi4 *fl4 = &fl->u.ip4; |
84502b5e SK |
117 | int oif = 0; |
118 | ||
385add90 | 119 | if (skb_dst(skb)) |
e0d56fdd | 120 | oif = skb_dst(skb)->dev->ifindex; |
1da177e4 | 121 | |
7e1dc7b6 DM |
122 | memset(fl4, 0, sizeof(struct flowi4)); |
123 | fl4->flowi4_mark = skb->mark; | |
84502b5e | 124 | fl4->flowi4_oif = reverse ? skb->skb_iif : oif; |
44b451f1 | 125 | |
56f8a75c | 126 | if (!ip_is_fragment(iph)) { |
1da177e4 LT |
127 | switch (iph->protocol) { |
128 | case IPPROTO_UDP: | |
ba4e58ec | 129 | case IPPROTO_UDPLITE: |
1da177e4 LT |
130 | case IPPROTO_TCP: |
131 | case IPPROTO_SCTP: | |
9e999993 | 132 | case IPPROTO_DCCP: |
c615c9f3 WY |
133 | if (xprth + 4 < skb->data || |
134 | pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
ea673a4d SK |
135 | __be16 *ports; |
136 | ||
137 | xprth = skb_network_header(skb) + iph->ihl * 4; | |
138 | ports = (__be16 *)xprth; | |
1da177e4 | 139 | |
9cce96df DM |
140 | fl4->fl4_sport = ports[!!reverse]; |
141 | fl4->fl4_dport = ports[!reverse]; | |
1da177e4 LT |
142 | } |
143 | break; | |
144 | ||
145 | case IPPROTO_ICMP: | |
1a14f1e5 SK |
146 | if (xprth + 2 < skb->data || |
147 | pskb_may_pull(skb, xprth + 2 - skb->data)) { | |
ea673a4d SK |
148 | u8 *icmp; |
149 | ||
150 | xprth = skb_network_header(skb) + iph->ihl * 4; | |
151 | icmp = xprth; | |
1da177e4 | 152 | |
9cce96df DM |
153 | fl4->fl4_icmp_type = icmp[0]; |
154 | fl4->fl4_icmp_code = icmp[1]; | |
1da177e4 LT |
155 | } |
156 | break; | |
157 | ||
158 | case IPPROTO_ESP: | |
1a14f1e5 SK |
159 | if (xprth + 4 < skb->data || |
160 | pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
ea673a4d SK |
161 | __be32 *ehdr; |
162 | ||
163 | xprth = skb_network_header(skb) + iph->ihl * 4; | |
164 | ehdr = (__be32 *)xprth; | |
1da177e4 | 165 | |
9cce96df | 166 | fl4->fl4_ipsec_spi = ehdr[0]; |
1da177e4 LT |
167 | } |
168 | break; | |
169 | ||
170 | case IPPROTO_AH: | |
1a14f1e5 SK |
171 | if (xprth + 8 < skb->data || |
172 | pskb_may_pull(skb, xprth + 8 - skb->data)) { | |
ea673a4d SK |
173 | __be32 *ah_hdr; |
174 | ||
175 | xprth = skb_network_header(skb) + iph->ihl * 4; | |
176 | ah_hdr = (__be32 *)xprth; | |
1da177e4 | 177 | |
9cce96df | 178 | fl4->fl4_ipsec_spi = ah_hdr[1]; |
1da177e4 LT |
179 | } |
180 | break; | |
181 | ||
182 | case IPPROTO_COMP: | |
1a14f1e5 SK |
183 | if (xprth + 4 < skb->data || |
184 | pskb_may_pull(skb, xprth + 4 - skb->data)) { | |
ea673a4d SK |
185 | __be16 *ipcomp_hdr; |
186 | ||
187 | xprth = skb_network_header(skb) + iph->ihl * 4; | |
188 | ipcomp_hdr = (__be16 *)xprth; | |
1da177e4 | 189 | |
9cce96df | 190 | fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1])); |
1da177e4 LT |
191 | } |
192 | break; | |
cc9ff19d TT |
193 | |
194 | case IPPROTO_GRE: | |
1a14f1e5 SK |
195 | if (xprth + 12 < skb->data || |
196 | pskb_may_pull(skb, xprth + 12 - skb->data)) { | |
ea673a4d SK |
197 | __be16 *greflags; |
198 | __be32 *gre_hdr; | |
199 | ||
200 | xprth = skb_network_header(skb) + iph->ihl * 4; | |
201 | greflags = (__be16 *)xprth; | |
202 | gre_hdr = (__be32 *)xprth; | |
cc9ff19d TT |
203 | |
204 | if (greflags[0] & GRE_KEY) { | |
205 | if (greflags[0] & GRE_CSUM) | |
206 | gre_hdr++; | |
9cce96df | 207 | fl4->fl4_gre_key = gre_hdr[1]; |
cc9ff19d TT |
208 | } |
209 | } | |
210 | break; | |
211 | ||
1da177e4 | 212 | default: |
9cce96df | 213 | fl4->fl4_ipsec_spi = 0; |
1da177e4 | 214 | break; |
3ff50b79 | 215 | } |
1da177e4 | 216 | } |
7e1dc7b6 DM |
217 | fl4->flowi4_proto = iph->protocol; |
218 | fl4->daddr = reverse ? iph->saddr : iph->daddr; | |
219 | fl4->saddr = reverse ? iph->daddr : iph->saddr; | |
220 | fl4->flowi4_tos = iph->tos; | |
1da177e4 LT |
221 | } |
222 | ||
6700c270 DM |
223 | static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk, |
224 | struct sk_buff *skb, u32 mtu) | |
1da177e4 LT |
225 | { |
226 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
227 | struct dst_entry *path = xdst->route; | |
228 | ||
6700c270 | 229 | path->ops->update_pmtu(path, sk, skb, mtu); |
1da177e4 LT |
230 | } |
231 | ||
6700c270 DM |
232 | static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk, |
233 | struct sk_buff *skb) | |
55be7a9c DM |
234 | { |
235 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
236 | struct dst_entry *path = xdst->route; | |
237 | ||
6700c270 | 238 | path->ops->redirect(path, sk, skb); |
55be7a9c DM |
239 | } |
240 | ||
aabc9761 HX |
241 | static void xfrm4_dst_destroy(struct dst_entry *dst) |
242 | { | |
243 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; | |
244 | ||
62fa8a84 | 245 | dst_destroy_metrics_generic(dst); |
31a5b09d XL |
246 | if (xdst->u.rt.rt_uncached_list) |
247 | rt_del_uncached_list(&xdst->u.rt); | |
aabc9761 HX |
248 | xfrm_dst_destroy(xdst); |
249 | } | |
250 | ||
251 | static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev, | |
252 | int unregister) | |
253 | { | |
aabc9761 HX |
254 | if (!unregister) |
255 | return; | |
256 | ||
aabc9761 HX |
257 | xfrm_dst_ifdown(dst, dev); |
258 | } | |
259 | ||
a8a572a6 | 260 | static struct dst_ops xfrm4_dst_ops_template = { |
1da177e4 | 261 | .family = AF_INET, |
1da177e4 | 262 | .update_pmtu = xfrm4_update_pmtu, |
55be7a9c | 263 | .redirect = xfrm4_redirect, |
62fa8a84 | 264 | .cow_metrics = dst_cow_metrics_generic, |
aabc9761 HX |
265 | .destroy = xfrm4_dst_destroy, |
266 | .ifdown = xfrm4_dst_ifdown, | |
862b82c6 | 267 | .local_out = __ip_local_out, |
3c2a89dd | 268 | .gc_thresh = 32768, |
1da177e4 LT |
269 | }; |
270 | ||
37b10383 | 271 | static const struct xfrm_policy_afinfo xfrm4_policy_afinfo = { |
a8a572a6 | 272 | .dst_ops = &xfrm4_dst_ops_template, |
1da177e4 | 273 | .dst_lookup = xfrm4_dst_lookup, |
a1e59abf | 274 | .get_saddr = xfrm4_get_saddr, |
1da177e4 | 275 | .decode_session = _decode_session4, |
25ee3286 | 276 | .get_tos = xfrm4_get_tos, |
a1b05140 | 277 | .init_path = xfrm4_init_path, |
25ee3286 | 278 | .fill_dst = xfrm4_fill_dst, |
2774c131 | 279 | .blackhole_route = ipv4_blackhole_route, |
1da177e4 LT |
280 | }; |
281 | ||
f816700a | 282 | #ifdef CONFIG_SYSCTL |
a44a4a00 NH |
283 | static struct ctl_table xfrm4_policy_table[] = { |
284 | { | |
a44a4a00 | 285 | .procname = "xfrm4_gc_thresh", |
d7c7544c | 286 | .data = &init_net.xfrm.xfrm4_dst_ops.gc_thresh, |
a44a4a00 NH |
287 | .maxlen = sizeof(int), |
288 | .mode = 0644, | |
289 | .proc_handler = proc_dointvec, | |
290 | }, | |
291 | { } | |
292 | }; | |
293 | ||
318d3cc0 | 294 | static __net_init int xfrm4_net_sysctl_init(struct net *net) |
8d068875 MK |
295 | { |
296 | struct ctl_table *table; | |
297 | struct ctl_table_header *hdr; | |
298 | ||
299 | table = xfrm4_policy_table; | |
300 | if (!net_eq(net, &init_net)) { | |
301 | table = kmemdup(table, sizeof(xfrm4_policy_table), GFP_KERNEL); | |
302 | if (!table) | |
303 | goto err_alloc; | |
304 | ||
305 | table[0].data = &net->xfrm.xfrm4_dst_ops.gc_thresh; | |
306 | } | |
307 | ||
308 | hdr = register_net_sysctl(net, "net/ipv4", table); | |
309 | if (!hdr) | |
310 | goto err_reg; | |
311 | ||
312 | net->ipv4.xfrm4_hdr = hdr; | |
313 | return 0; | |
314 | ||
315 | err_reg: | |
316 | if (!net_eq(net, &init_net)) | |
317 | kfree(table); | |
318 | err_alloc: | |
319 | return -ENOMEM; | |
320 | } | |
321 | ||
318d3cc0 | 322 | static __net_exit void xfrm4_net_sysctl_exit(struct net *net) |
8d068875 MK |
323 | { |
324 | struct ctl_table *table; | |
325 | ||
51456b29 | 326 | if (!net->ipv4.xfrm4_hdr) |
8d068875 MK |
327 | return; |
328 | ||
329 | table = net->ipv4.xfrm4_hdr->ctl_table_arg; | |
330 | unregister_net_sysctl_table(net->ipv4.xfrm4_hdr); | |
331 | if (!net_eq(net, &init_net)) | |
332 | kfree(table); | |
333 | } | |
a8a572a6 | 334 | #else /* CONFIG_SYSCTL */ |
318d3cc0 | 335 | static inline int xfrm4_net_sysctl_init(struct net *net) |
a8a572a6 DS |
336 | { |
337 | return 0; | |
338 | } | |
339 | ||
318d3cc0 | 340 | static inline void xfrm4_net_sysctl_exit(struct net *net) |
a8a572a6 DS |
341 | { |
342 | } | |
343 | #endif | |
344 | ||
345 | static int __net_init xfrm4_net_init(struct net *net) | |
346 | { | |
347 | int ret; | |
348 | ||
349 | memcpy(&net->xfrm.xfrm4_dst_ops, &xfrm4_dst_ops_template, | |
350 | sizeof(xfrm4_dst_ops_template)); | |
351 | ret = dst_entries_init(&net->xfrm.xfrm4_dst_ops); | |
352 | if (ret) | |
353 | return ret; | |
354 | ||
355 | ret = xfrm4_net_sysctl_init(net); | |
356 | if (ret) | |
357 | dst_entries_destroy(&net->xfrm.xfrm4_dst_ops); | |
358 | ||
359 | return ret; | |
360 | } | |
361 | ||
362 | static void __net_exit xfrm4_net_exit(struct net *net) | |
363 | { | |
364 | xfrm4_net_sysctl_exit(net); | |
365 | dst_entries_destroy(&net->xfrm.xfrm4_dst_ops); | |
366 | } | |
8d068875 MK |
367 | |
368 | static struct pernet_operations __net_initdata xfrm4_net_ops = { | |
369 | .init = xfrm4_net_init, | |
370 | .exit = xfrm4_net_exit, | |
371 | }; | |
a44a4a00 | 372 | |
1da177e4 LT |
373 | static void __init xfrm4_policy_init(void) |
374 | { | |
a2817d8b | 375 | xfrm_policy_register_afinfo(&xfrm4_policy_afinfo, AF_INET); |
1da177e4 LT |
376 | } |
377 | ||
703fb94e | 378 | void __init xfrm4_init(void) |
1da177e4 | 379 | { |
d7c7544c AD |
380 | xfrm4_state_init(); |
381 | xfrm4_policy_init(); | |
2f32b51b | 382 | xfrm4_protocol_init(); |
8d068875 | 383 | register_pernet_subsys(&xfrm4_net_ops); |
1da177e4 LT |
384 | } |
385 |