[XFRM]: Add XFRM_MODE_xxx for future use.
[linux-2.6.git] / net / ipv4 / xfrm4_policy.c
1 /* 
2  * xfrm4_policy.c
3  *
4  * Changes:
5  *      Kazunori MIYAZAWA @USAGI
6  *      YOSHIFUJI Hideaki @USAGI
7  *              Split up af-specific portion
8  *      
9  */
10
11 #include <linux/compiler.h>
12 #include <linux/inetdevice.h>
13 #include <net/xfrm.h>
14 #include <net/ip.h>
15
16 static struct dst_ops xfrm4_dst_ops;
17 static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
18
19 static int xfrm4_dst_lookup(struct xfrm_dst **dst, struct flowi *fl)
20 {
21         return __ip_route_output_key((struct rtable**)dst, fl);
22 }
23
24 static struct dst_entry *
25 __xfrm4_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
26 {
27         struct dst_entry *dst;
28
29         read_lock_bh(&policy->lock);
30         for (dst = policy->bundles; dst; dst = dst->next) {
31                 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
32                 if (xdst->u.rt.fl.oif == fl->oif &&     /*XXX*/
33                     xdst->u.rt.fl.fl4_dst == fl->fl4_dst &&
34                     xdst->u.rt.fl.fl4_src == fl->fl4_src &&
35                     xdst->u.rt.fl.fl4_tos == fl->fl4_tos &&
36                     xfrm_bundle_ok(xdst, fl, AF_INET)) {
37                         dst_clone(dst);
38                         break;
39                 }
40         }
41         read_unlock_bh(&policy->lock);
42         return dst;
43 }
44
45 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
46  * all the metrics... Shortly, bundle a bundle.
47  */
48
49 static int
50 __xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
51                       struct flowi *fl, struct dst_entry **dst_p)
52 {
53         struct dst_entry *dst, *dst_prev;
54         struct rtable *rt0 = (struct rtable*)(*dst_p);
55         struct rtable *rt = rt0;
56         u32 remote = fl->fl4_dst;
57         u32 local  = fl->fl4_src;
58         struct flowi fl_tunnel = {
59                 .nl_u = {
60                         .ip4_u = {
61                                 .saddr = local,
62                                 .daddr = remote,
63                                 .tos = fl->fl4_tos
64                         }
65                 }
66         };
67         int i;
68         int err;
69         int header_len = 0;
70         int trailer_len = 0;
71
72         dst = dst_prev = NULL;
73         dst_hold(&rt->u.dst);
74
75         for (i = 0; i < nx; i++) {
76                 struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);
77                 struct xfrm_dst *xdst;
78                 int tunnel = 0;
79
80                 if (unlikely(dst1 == NULL)) {
81                         err = -ENOBUFS;
82                         dst_release(&rt->u.dst);
83                         goto error;
84                 }
85
86                 if (!dst)
87                         dst = dst1;
88                 else {
89                         dst_prev->child = dst1;
90                         dst1->flags |= DST_NOHASH;
91                         dst_clone(dst1);
92                 }
93
94                 xdst = (struct xfrm_dst *)dst1;
95                 xdst->route = &rt->u.dst;
96
97                 dst1->next = dst_prev;
98                 dst_prev = dst1;
99                 if (xfrm[i]->props.mode != XFRM_MODE_TRANSPORT) {
100                         remote = xfrm[i]->id.daddr.a4;
101                         local  = xfrm[i]->props.saddr.a4;
102                         tunnel = 1;
103                 }
104                 header_len += xfrm[i]->props.header_len;
105                 trailer_len += xfrm[i]->props.trailer_len;
106
107                 if (tunnel) {
108                         fl_tunnel.fl4_src = local;
109                         fl_tunnel.fl4_dst = remote;
110                         err = xfrm_dst_lookup((struct xfrm_dst **)&rt,
111                                               &fl_tunnel, AF_INET);
112                         if (err)
113                                 goto error;
114                 } else
115                         dst_hold(&rt->u.dst);
116         }
117
118         dst_prev->child = &rt->u.dst;
119         dst->path = &rt->u.dst;
120
121         *dst_p = dst;
122         dst = dst_prev;
123
124         dst_prev = *dst_p;
125         i = 0;
126         for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {
127                 struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;
128                 x->u.rt.fl = *fl;
129
130                 dst_prev->xfrm = xfrm[i++];
131                 dst_prev->dev = rt->u.dst.dev;
132                 if (rt->u.dst.dev)
133                         dev_hold(rt->u.dst.dev);
134                 dst_prev->obsolete      = -1;
135                 dst_prev->flags        |= DST_HOST;
136                 dst_prev->lastuse       = jiffies;
137                 dst_prev->header_len    = header_len;
138                 dst_prev->trailer_len   = trailer_len;
139                 memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
140
141                 /* Copy neighbout for reachability confirmation */
142                 dst_prev->neighbour     = neigh_clone(rt->u.dst.neighbour);
143                 dst_prev->input         = rt->u.dst.input;
144                 dst_prev->output        = xfrm4_output;
145                 if (rt->peer)
146                         atomic_inc(&rt->peer->refcnt);
147                 x->u.rt.peer = rt->peer;
148                 /* Sheit... I remember I did this right. Apparently,
149                  * it was magically lost, so this code needs audit */
150                 x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);
151                 x->u.rt.rt_type = rt->rt_type;
152                 x->u.rt.rt_src = rt0->rt_src;
153                 x->u.rt.rt_dst = rt0->rt_dst;
154                 x->u.rt.rt_gateway = rt->rt_gateway;
155                 x->u.rt.rt_spec_dst = rt0->rt_spec_dst;
156                 x->u.rt.idev = rt0->idev;
157                 in_dev_hold(rt0->idev);
158                 header_len -= x->u.dst.xfrm->props.header_len;
159                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
160         }
161
162         xfrm_init_pmtu(dst);
163         return 0;
164
165 error:
166         if (dst)
167                 dst_free(dst);
168         return err;
169 }
170
171 static void
172 _decode_session4(struct sk_buff *skb, struct flowi *fl)
173 {
174         struct iphdr *iph = skb->nh.iph;
175         u8 *xprth = skb->nh.raw + iph->ihl*4;
176
177         memset(fl, 0, sizeof(struct flowi));
178         if (!(iph->frag_off & htons(IP_MF | IP_OFFSET))) {
179                 switch (iph->protocol) {
180                 case IPPROTO_UDP:
181                 case IPPROTO_TCP:
182                 case IPPROTO_SCTP:
183                 case IPPROTO_DCCP:
184                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
185                                 u16 *ports = (u16 *)xprth;
186
187                                 fl->fl_ip_sport = ports[0];
188                                 fl->fl_ip_dport = ports[1];
189                         }
190                         break;
191
192                 case IPPROTO_ICMP:
193                         if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
194                                 u8 *icmp = xprth;
195
196                                 fl->fl_icmp_type = icmp[0];
197                                 fl->fl_icmp_code = icmp[1];
198                         }
199                         break;
200
201                 case IPPROTO_ESP:
202                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
203                                 u32 *ehdr = (u32 *)xprth;
204
205                                 fl->fl_ipsec_spi = ehdr[0];
206                         }
207                         break;
208
209                 case IPPROTO_AH:
210                         if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
211                                 u32 *ah_hdr = (u32*)xprth;
212
213                                 fl->fl_ipsec_spi = ah_hdr[1];
214                         }
215                         break;
216
217                 case IPPROTO_COMP:
218                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
219                                 u16 *ipcomp_hdr = (u16 *)xprth;
220
221                                 fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
222                         }
223                         break;
224                 default:
225                         fl->fl_ipsec_spi = 0;
226                         break;
227                 };
228         }
229         fl->proto = iph->protocol;
230         fl->fl4_dst = iph->daddr;
231         fl->fl4_src = iph->saddr;
232         fl->fl4_tos = iph->tos;
233 }
234
235 static inline int xfrm4_garbage_collect(void)
236 {
237         xfrm4_policy_afinfo.garbage_collect();
238         return (atomic_read(&xfrm4_dst_ops.entries) > xfrm4_dst_ops.gc_thresh*2);
239 }
240
241 static void xfrm4_update_pmtu(struct dst_entry *dst, u32 mtu)
242 {
243         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
244         struct dst_entry *path = xdst->route;
245
246         path->ops->update_pmtu(path, mtu);
247 }
248
249 static void xfrm4_dst_destroy(struct dst_entry *dst)
250 {
251         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
252
253         if (likely(xdst->u.rt.idev))
254                 in_dev_put(xdst->u.rt.idev);
255         xfrm_dst_destroy(xdst);
256 }
257
258 static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
259                              int unregister)
260 {
261         struct xfrm_dst *xdst;
262
263         if (!unregister)
264                 return;
265
266         xdst = (struct xfrm_dst *)dst;
267         if (xdst->u.rt.idev->dev == dev) {
268                 struct in_device *loopback_idev = in_dev_get(&loopback_dev);
269                 BUG_ON(!loopback_idev);
270
271                 do {
272                         in_dev_put(xdst->u.rt.idev);
273                         xdst->u.rt.idev = loopback_idev;
274                         in_dev_hold(loopback_idev);
275                         xdst = (struct xfrm_dst *)xdst->u.dst.child;
276                 } while (xdst->u.dst.xfrm);
277
278                 __in_dev_put(loopback_idev);
279         }
280
281         xfrm_dst_ifdown(dst, dev);
282 }
283
284 static struct dst_ops xfrm4_dst_ops = {
285         .family =               AF_INET,
286         .protocol =             __constant_htons(ETH_P_IP),
287         .gc =                   xfrm4_garbage_collect,
288         .update_pmtu =          xfrm4_update_pmtu,
289         .destroy =              xfrm4_dst_destroy,
290         .ifdown =               xfrm4_dst_ifdown,
291         .gc_thresh =            1024,
292         .entry_size =           sizeof(struct xfrm_dst),
293 };
294
295 static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
296         .family =               AF_INET,
297         .dst_ops =              &xfrm4_dst_ops,
298         .dst_lookup =           xfrm4_dst_lookup,
299         .find_bundle =          __xfrm4_find_bundle,
300         .bundle_create =        __xfrm4_bundle_create,
301         .decode_session =       _decode_session4,
302 };
303
304 static void __init xfrm4_policy_init(void)
305 {
306         xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
307 }
308
309 static void __exit xfrm4_policy_fini(void)
310 {
311         xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
312 }
313
314 void __init xfrm4_init(void)
315 {
316         xfrm4_state_init();
317         xfrm4_policy_init();
318 }
319