]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - net/ipv6/xfrm6_policy.c
xfrm: Increase the garbage collector threshold
[mirror_ubuntu-artful-kernel.git] / net / ipv6 / xfrm6_policy.c
CommitLineData
1da177e4
LT
1/*
2 * xfrm6_policy.c: based on xfrm4_policy.c
3 *
4 * Authors:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki
10 * Split up af-specific portion
1ab1457c 11 *
1da177e4
LT
12 */
13
66cdb3ca
HX
14#include <linux/err.h>
15#include <linux/kernel.h>
aabc9761
HX
16#include <linux/netdevice.h>
17#include <net/addrconf.h>
45ff5a3f 18#include <net/dst.h>
1da177e4
LT
19#include <net/xfrm.h>
20#include <net/ip.h>
21#include <net/ipv6.h>
22#include <net/ip6_route.h>
07a93626 23#if IS_ENABLED(CONFIG_IPV6_MIP6)
2ce4272a
MN
24#include <net/mip6.h>
25#endif
1da177e4 26
1da177e4
LT
27static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
28
c5b3cf46 29static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
5e6b930f
DM
30 const xfrm_address_t *saddr,
31 const xfrm_address_t *daddr)
1da177e4 32{
7e1dc7b6 33 struct flowi6 fl6;
66cdb3ca
HX
34 struct dst_entry *dst;
35 int err;
36
7e1dc7b6
DM
37 memset(&fl6, 0, sizeof(fl6));
38 memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
66cdb3ca 39 if (saddr)
7e1dc7b6 40 memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
66cdb3ca 41
4c9483b2 42 dst = ip6_route_output(net, NULL, &fl6);
66cdb3ca
HX
43
44 err = dst->error;
45 if (dst->error) {
4251320f 46 dst_release(dst);
66cdb3ca
HX
47 dst = ERR_PTR(err);
48 }
49
50 return dst;
1da177e4
LT
51}
52
fbda33b2
AD
53static int xfrm6_get_saddr(struct net *net,
54 xfrm_address_t *saddr, xfrm_address_t *daddr)
a1e59abf 55{
66cdb3ca 56 struct dst_entry *dst;
191cd582 57 struct net_device *dev;
66cdb3ca 58
fbda33b2 59 dst = xfrm6_dst_lookup(net, 0, NULL, daddr);
66cdb3ca
HX
60 if (IS_ERR(dst))
61 return -EHOSTUNREACH;
62
191cd582
BH
63 dev = ip6_dst_idev(dst)->dev;
64 ipv6_dev_get_saddr(dev_net(dev), dev,
7cbca67c 65 (struct in6_addr *)&daddr->a6, 0,
5e5f3f0f 66 (struct in6_addr *)&saddr->a6);
66cdb3ca
HX
67 dst_release(dst);
68 return 0;
a1e59abf
PM
69}
70
05d84025 71static int xfrm6_get_tos(const struct flowi *fl)
1da177e4 72{
25ee3286
HX
73 return 0;
74}
1da177e4 75
9d7b0fc1
PM
76static void xfrm6_init_dst(struct net *net, struct xfrm_dst *xdst)
77{
78 struct rt6_info *rt = (struct rt6_info *)xdst;
79
80 rt6_init_peer(rt, net->ipv6.peers);
81}
82
a1b05140
MN
83static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
84 int nfheader_len)
85{
86 if (dst->ops->family == AF_INET6) {
87 struct rt6_info *rt = (struct rt6_info*)dst;
88 if (rt->rt6i_node)
89 path->path_cookie = rt->rt6i_node->fn_sernum;
90 }
91
92 path->u.rt6.rt6i_nfheader_len = nfheader_len;
93
94 return 0;
95}
96
87c1e12b 97static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
0c7b3eef 98 const struct flowi *fl)
25ee3286
HX
99{
100 struct rt6_info *rt = (struct rt6_info*)xdst->route;
1da177e4 101
25ee3286
HX
102 xdst->u.dst.dev = dev;
103 dev_hold(dev);
1da177e4 104
bc8e4b95 105 xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
84c4a9df
CW
106 if (!xdst->u.rt6.rt6i_idev) {
107 dev_put(dev);
25ee3286 108 return -ENODEV;
84c4a9df 109 }
1da177e4 110
97bab73f 111 rt6_transfer_peer(&xdst->u.rt6, rt);
7cc2edb8 112
25ee3286
HX
113 /* Sheit... I remember I did this right. Apparently,
114 * it was magically lost, so this code needs audit */
115 xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
116 RTF_LOCAL);
117 xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
118 xdst->u.rt6.rt6i_node = rt->rt6i_node;
a1b05140
MN
119 if (rt->rt6i_node)
120 xdst->route_cookie = rt->rt6i_node->fn_sernum;
25ee3286
HX
121 xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
122 xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
123 xdst->u.rt6.rt6i_src = rt->rt6i_src;
1da177e4 124
1da177e4 125 return 0;
1da177e4
LT
126}
127
128static inline void
d5422efe 129_decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
1da177e4 130{
7e1dc7b6 131 struct flowi6 *fl6 = &fl->u.ip6;
7e3a42a1 132 int onlyproto = 0;
cfe1fc77 133 u16 offset = skb_network_header_len(skb);
b71d1d42 134 const struct ipv6hdr *hdr = ipv6_hdr(skb);
e3cae904 135 struct ipv6_opt_hdr *exthdr;
d56f90a7
ACM
136 const unsigned char *nh = skb_network_header(skb);
137 u8 nexthdr = nh[IP6CB(skb)->nhoff];
1da177e4 138
7e1dc7b6
DM
139 memset(fl6, 0, sizeof(struct flowi6));
140 fl6->flowi6_mark = skb->mark;
bafd4bd4 141 fl6->flowi6_oif = skb_dst(skb)->dev->ifindex;
44b451f1 142
4e3fd7a0
AD
143 fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
144 fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
1da177e4 145
59cae009
WY
146 while (nh + offset + 1 < skb->data ||
147 pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
d56f90a7
ACM
148 nh = skb_network_header(skb);
149 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
e3cae904 150
1da177e4 151 switch (nexthdr) {
7e3a42a1
ND
152 case NEXTHDR_FRAGMENT:
153 onlyproto = 1;
1da177e4
LT
154 case NEXTHDR_ROUTING:
155 case NEXTHDR_HOP:
156 case NEXTHDR_DEST:
157 offset += ipv6_optlen(exthdr);
158 nexthdr = exthdr->nexthdr;
d56f90a7 159 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
1da177e4
LT
160 break;
161
162 case IPPROTO_UDP:
ba4e58ec 163 case IPPROTO_UDPLITE:
1da177e4
LT
164 case IPPROTO_TCP:
165 case IPPROTO_SCTP:
9e999993 166 case IPPROTO_DCCP:
59cae009
WY
167 if (!onlyproto && (nh + offset + 4 < skb->data ||
168 pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
8c689a6e 169 __be16 *ports = (__be16 *)exthdr;
1da177e4 170
1958b856
DM
171 fl6->fl6_sport = ports[!!reverse];
172 fl6->fl6_dport = ports[!reverse];
1da177e4 173 }
7e1dc7b6 174 fl6->flowi6_proto = nexthdr;
1da177e4
LT
175 return;
176
177 case IPPROTO_ICMPV6:
7e3a42a1 178 if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
1da177e4
LT
179 u8 *icmp = (u8 *)exthdr;
180
1958b856
DM
181 fl6->fl6_icmp_type = icmp[0];
182 fl6->fl6_icmp_code = icmp[1];
1da177e4 183 }
7e1dc7b6 184 fl6->flowi6_proto = nexthdr;
1da177e4
LT
185 return;
186
07a93626 187#if IS_ENABLED(CONFIG_IPV6_MIP6)
2ce4272a 188 case IPPROTO_MH:
7e3a42a1 189 if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
2ce4272a
MN
190 struct ip6_mh *mh;
191 mh = (struct ip6_mh *)exthdr;
192
1958b856 193 fl6->fl6_mh_type = mh->ip6mh_type;
2ce4272a 194 }
7e1dc7b6 195 fl6->flowi6_proto = nexthdr;
2ce4272a
MN
196 return;
197#endif
198
1da177e4
LT
199 /* XXX Why are there these headers? */
200 case IPPROTO_AH:
201 case IPPROTO_ESP:
202 case IPPROTO_COMP:
203 default:
1958b856 204 fl6->fl6_ipsec_spi = 0;
7e1dc7b6 205 fl6->flowi6_proto = nexthdr;
1da177e4 206 return;
3ff50b79 207 }
1da177e4
LT
208 }
209}
210
569d3645 211static inline int xfrm6_garbage_collect(struct dst_ops *ops)
1da177e4 212{
d7c7544c
AD
213 struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
214
215 xfrm6_policy_afinfo.garbage_collect(net);
fc66f95c 216 return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
1da177e4
LT
217}
218
6700c270
DM
219static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
220 struct sk_buff *skb, u32 mtu)
1da177e4
LT
221{
222 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
223 struct dst_entry *path = xdst->route;
224
6700c270 225 path->ops->update_pmtu(path, sk, skb, mtu);
1da177e4
LT
226}
227
6700c270
DM
228static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
229 struct sk_buff *skb)
ec18d9a2
DM
230{
231 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
232 struct dst_entry *path = xdst->route;
233
6700c270 234 path->ops->redirect(path, sk, skb);
ec18d9a2
DM
235}
236
aabc9761
HX
237static void xfrm6_dst_destroy(struct dst_entry *dst)
238{
239 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
240
241 if (likely(xdst->u.rt6.rt6i_idev))
242 in6_dev_put(xdst->u.rt6.rt6i_idev);
62fa8a84 243 dst_destroy_metrics_generic(dst);
97bab73f
DM
244 if (rt6_has_peer(&xdst->u.rt6)) {
245 struct inet_peer *peer = rt6_peer_ptr(&xdst->u.rt6);
246 inet_putpeer(peer);
247 }
aabc9761
HX
248 xfrm_dst_destroy(xdst);
249}
250
251static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
252 int unregister)
253{
254 struct xfrm_dst *xdst;
255
256 if (!unregister)
257 return;
258
259 xdst = (struct xfrm_dst *)dst;
260 if (xdst->u.rt6.rt6i_idev->dev == dev) {
5a3e55d6 261 struct inet6_dev *loopback_idev =
c346dca1 262 in6_dev_get(dev_net(dev)->loopback_dev);
aabc9761
HX
263 BUG_ON(!loopback_idev);
264
265 do {
266 in6_dev_put(xdst->u.rt6.rt6i_idev);
267 xdst->u.rt6.rt6i_idev = loopback_idev;
268 in6_dev_hold(loopback_idev);
269 xdst = (struct xfrm_dst *)xdst->u.dst.child;
270 } while (xdst->u.dst.xfrm);
271
272 __in6_dev_put(loopback_idev);
273 }
274
275 xfrm_dst_ifdown(dst, dev);
276}
277
1da177e4
LT
278static struct dst_ops xfrm6_dst_ops = {
279 .family = AF_INET6,
09640e63 280 .protocol = cpu_to_be16(ETH_P_IPV6),
1da177e4
LT
281 .gc = xfrm6_garbage_collect,
282 .update_pmtu = xfrm6_update_pmtu,
ec18d9a2 283 .redirect = xfrm6_redirect,
62fa8a84 284 .cow_metrics = dst_cow_metrics_generic,
aabc9761
HX
285 .destroy = xfrm6_dst_destroy,
286 .ifdown = xfrm6_dst_ifdown,
862b82c6 287 .local_out = __ip6_local_out,
eeb1b733 288 .gc_thresh = 32768,
1da177e4
LT
289};
290
291static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
292 .family = AF_INET6,
1da177e4
LT
293 .dst_ops = &xfrm6_dst_ops,
294 .dst_lookup = xfrm6_dst_lookup,
a1e59abf 295 .get_saddr = xfrm6_get_saddr,
1da177e4 296 .decode_session = _decode_session6,
25ee3286 297 .get_tos = xfrm6_get_tos,
9d7b0fc1 298 .init_dst = xfrm6_init_dst,
a1b05140 299 .init_path = xfrm6_init_path,
25ee3286 300 .fill_dst = xfrm6_fill_dst,
2774c131 301 .blackhole_route = ip6_blackhole_route,
1da177e4
LT
302};
303
0013caba 304static int __init xfrm6_policy_init(void)
1da177e4 305{
0013caba 306 return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
1da177e4
LT
307}
308
309static void xfrm6_policy_fini(void)
310{
311 xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
312}
313
db71789c 314#ifdef CONFIG_SYSCTL
a44a4a00
NH
315static struct ctl_table xfrm6_policy_table[] = {
316 {
a44a4a00 317 .procname = "xfrm6_gc_thresh",
d7c7544c 318 .data = &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
a44a4a00
NH
319 .maxlen = sizeof(int),
320 .mode = 0644,
321 .proc_handler = proc_dointvec,
322 },
323 { }
324};
325
8d068875
MK
326static int __net_init xfrm6_net_init(struct net *net)
327{
328 struct ctl_table *table;
329 struct ctl_table_header *hdr;
330
331 table = xfrm6_policy_table;
332 if (!net_eq(net, &init_net)) {
333 table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
334 if (!table)
335 goto err_alloc;
336
337 table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
338 }
339
340 hdr = register_net_sysctl(net, "net/ipv6", table);
341 if (!hdr)
342 goto err_reg;
343
344 net->ipv6.sysctl.xfrm6_hdr = hdr;
345 return 0;
346
347err_reg:
348 if (!net_eq(net, &init_net))
349 kfree(table);
350err_alloc:
351 return -ENOMEM;
352}
353
354static void __net_exit xfrm6_net_exit(struct net *net)
355{
356 struct ctl_table *table;
357
358 if (net->ipv6.sysctl.xfrm6_hdr == NULL)
359 return;
360
361 table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
362 unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
363 if (!net_eq(net, &init_net))
364 kfree(table);
365}
366
367static struct pernet_operations xfrm6_net_ops = {
368 .init = xfrm6_net_init,
369 .exit = xfrm6_net_exit,
370};
db71789c 371#endif
a44a4a00 372
0013caba 373int __init xfrm6_init(void)
1da177e4 374{
0013caba 375 int ret;
c3813286 376
fc66f95c 377 dst_entries_init(&xfrm6_dst_ops);
d7c7544c
AD
378
379 ret = xfrm6_policy_init();
fc66f95c
ED
380 if (ret) {
381 dst_entries_destroy(&xfrm6_dst_ops);
d7c7544c 382 goto out;
fc66f95c 383 }
d7c7544c
AD
384 ret = xfrm6_state_init();
385 if (ret)
386 goto out_policy;
387
db71789c 388#ifdef CONFIG_SYSCTL
8d068875 389 register_pernet_subsys(&xfrm6_net_ops);
db71789c 390#endif
0013caba
DL
391out:
392 return ret;
393out_policy:
394 xfrm6_policy_fini();
395 goto out;
1da177e4
LT
396}
397
398void xfrm6_fini(void)
399{
db71789c 400#ifdef CONFIG_SYSCTL
8d068875 401 unregister_pernet_subsys(&xfrm6_net_ops);
db71789c 402#endif
1da177e4
LT
403 xfrm6_policy_fini();
404 xfrm6_state_fini();
fc66f95c 405 dst_entries_destroy(&xfrm6_dst_ops);
1da177e4 406}