Merge branch 'topic/kmemtrace' of git://git.kernel.org/pub/scm/linux/kernel/git/penbe...
[linux-2.6] / net / ipv6 / xfrm6_policy.c
1 /*
2  * xfrm6_policy.c: based on xfrm4_policy.c
3  *
4  * Authors:
5  *      Mitsuru KANDA @USAGI
6  *      Kazunori MIYAZAWA @USAGI
7  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8  *              IPv6 support
9  *      YOSHIFUJI Hideaki
10  *              Split up af-specific portion
11  *
12  */
13
14 #include <linux/err.h>
15 #include <linux/kernel.h>
16 #include <linux/netdevice.h>
17 #include <net/addrconf.h>
18 #include <net/dst.h>
19 #include <net/xfrm.h>
20 #include <net/ip.h>
21 #include <net/ipv6.h>
22 #include <net/ip6_route.h>
23 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
24 #include <net/mip6.h>
25 #endif
26
27 static struct dst_ops xfrm6_dst_ops;
28 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
29
30 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
31                                           xfrm_address_t *saddr,
32                                           xfrm_address_t *daddr)
33 {
34         struct flowi fl = {};
35         struct dst_entry *dst;
36         int err;
37
38         memcpy(&fl.fl6_dst, daddr, sizeof(fl.fl6_dst));
39         if (saddr)
40                 memcpy(&fl.fl6_src, saddr, sizeof(fl.fl6_src));
41
42         dst = ip6_route_output(net, NULL, &fl);
43
44         err = dst->error;
45         if (dst->error) {
46                 dst_release(dst);
47                 dst = ERR_PTR(err);
48         }
49
50         return dst;
51 }
52
53 static int xfrm6_get_saddr(struct net *net,
54                            xfrm_address_t *saddr, xfrm_address_t *daddr)
55 {
56         struct dst_entry *dst;
57         struct net_device *dev;
58
59         dst = xfrm6_dst_lookup(net, 0, NULL, daddr);
60         if (IS_ERR(dst))
61                 return -EHOSTUNREACH;
62
63         dev = ip6_dst_idev(dst)->dev;
64         ipv6_dev_get_saddr(dev_net(dev), dev,
65                            (struct in6_addr *)&daddr->a6, 0,
66                            (struct in6_addr *)&saddr->a6);
67         dst_release(dst);
68         return 0;
69 }
70
71 static struct dst_entry *
72 __xfrm6_find_bundle(struct flowi *fl, struct xfrm_policy *policy)
73 {
74         struct dst_entry *dst;
75
76         /* Still not clear if we should set fl->fl6_{src,dst}... */
77         read_lock_bh(&policy->lock);
78         for (dst = policy->bundles; dst; dst = dst->next) {
79                 struct xfrm_dst *xdst = (struct xfrm_dst*)dst;
80                 struct in6_addr fl_dst_prefix, fl_src_prefix;
81
82                 ipv6_addr_prefix(&fl_dst_prefix,
83                                  &fl->fl6_dst,
84                                  xdst->u.rt6.rt6i_dst.plen);
85                 ipv6_addr_prefix(&fl_src_prefix,
86                                  &fl->fl6_src,
87                                  xdst->u.rt6.rt6i_src.plen);
88                 if (ipv6_addr_equal(&xdst->u.rt6.rt6i_dst.addr, &fl_dst_prefix) &&
89                     ipv6_addr_equal(&xdst->u.rt6.rt6i_src.addr, &fl_src_prefix) &&
90                     xfrm_bundle_ok(policy, xdst, fl, AF_INET6,
91                                    (xdst->u.rt6.rt6i_dst.plen != 128 ||
92                                     xdst->u.rt6.rt6i_src.plen != 128))) {
93                         dst_clone(dst);
94                         break;
95                 }
96         }
97         read_unlock_bh(&policy->lock);
98         return dst;
99 }
100
101 static int xfrm6_get_tos(struct flowi *fl)
102 {
103         return 0;
104 }
105
106 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
107                            int nfheader_len)
108 {
109         if (dst->ops->family == AF_INET6) {
110                 struct rt6_info *rt = (struct rt6_info*)dst;
111                 if (rt->rt6i_node)
112                         path->path_cookie = rt->rt6i_node->fn_sernum;
113         }
114
115         path->u.rt6.rt6i_nfheader_len = nfheader_len;
116
117         return 0;
118 }
119
120 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
121 {
122         struct rt6_info *rt = (struct rt6_info*)xdst->route;
123
124         xdst->u.dst.dev = dev;
125         dev_hold(dev);
126
127         xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
128         if (!xdst->u.rt6.rt6i_idev)
129                 return -ENODEV;
130
131         /* Sheit... I remember I did this right. Apparently,
132          * it was magically lost, so this code needs audit */
133         xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
134                                                    RTF_LOCAL);
135         xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
136         xdst->u.rt6.rt6i_node = rt->rt6i_node;
137         if (rt->rt6i_node)
138                 xdst->route_cookie = rt->rt6i_node->fn_sernum;
139         xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
140         xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
141         xdst->u.rt6.rt6i_src = rt->rt6i_src;
142
143         return 0;
144 }
145
146 static inline void
147 _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
148 {
149         int onlyproto = 0;
150         u16 offset = skb_network_header_len(skb);
151         struct ipv6hdr *hdr = ipv6_hdr(skb);
152         struct ipv6_opt_hdr *exthdr;
153         const unsigned char *nh = skb_network_header(skb);
154         u8 nexthdr = nh[IP6CB(skb)->nhoff];
155
156         memset(fl, 0, sizeof(struct flowi));
157         ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
158         ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
159
160         while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
161                 nh = skb_network_header(skb);
162                 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
163
164                 switch (nexthdr) {
165                 case NEXTHDR_FRAGMENT:
166                         onlyproto = 1;
167                 case NEXTHDR_ROUTING:
168                 case NEXTHDR_HOP:
169                 case NEXTHDR_DEST:
170                         offset += ipv6_optlen(exthdr);
171                         nexthdr = exthdr->nexthdr;
172                         exthdr = (struct ipv6_opt_hdr *)(nh + offset);
173                         break;
174
175                 case IPPROTO_UDP:
176                 case IPPROTO_UDPLITE:
177                 case IPPROTO_TCP:
178                 case IPPROTO_SCTP:
179                 case IPPROTO_DCCP:
180                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
181                                 __be16 *ports = (__be16 *)exthdr;
182
183                                 fl->fl_ip_sport = ports[!!reverse];
184                                 fl->fl_ip_dport = ports[!reverse];
185                         }
186                         fl->proto = nexthdr;
187                         return;
188
189                 case IPPROTO_ICMPV6:
190                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
191                                 u8 *icmp = (u8 *)exthdr;
192
193                                 fl->fl_icmp_type = icmp[0];
194                                 fl->fl_icmp_code = icmp[1];
195                         }
196                         fl->proto = nexthdr;
197                         return;
198
199 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
200                 case IPPROTO_MH:
201                         if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
202                                 struct ip6_mh *mh;
203                                 mh = (struct ip6_mh *)exthdr;
204
205                                 fl->fl_mh_type = mh->ip6mh_type;
206                         }
207                         fl->proto = nexthdr;
208                         return;
209 #endif
210
211                 /* XXX Why are there these headers? */
212                 case IPPROTO_AH:
213                 case IPPROTO_ESP:
214                 case IPPROTO_COMP:
215                 default:
216                         fl->fl_ipsec_spi = 0;
217                         fl->proto = nexthdr;
218                         return;
219                 }
220         }
221 }
222
223 static inline int xfrm6_garbage_collect(struct dst_ops *ops)
224 {
225         xfrm6_policy_afinfo.garbage_collect(&init_net);
226         return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2);
227 }
228
229 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
230 {
231         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
232         struct dst_entry *path = xdst->route;
233
234         path->ops->update_pmtu(path, mtu);
235 }
236
237 static void xfrm6_dst_destroy(struct dst_entry *dst)
238 {
239         struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
240
241         if (likely(xdst->u.rt6.rt6i_idev))
242                 in6_dev_put(xdst->u.rt6.rt6i_idev);
243         xfrm_dst_destroy(xdst);
244 }
245
246 static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
247                              int unregister)
248 {
249         struct xfrm_dst *xdst;
250
251         if (!unregister)
252                 return;
253
254         xdst = (struct xfrm_dst *)dst;
255         if (xdst->u.rt6.rt6i_idev->dev == dev) {
256                 struct inet6_dev *loopback_idev =
257                         in6_dev_get(dev_net(dev)->loopback_dev);
258                 BUG_ON(!loopback_idev);
259
260                 do {
261                         in6_dev_put(xdst->u.rt6.rt6i_idev);
262                         xdst->u.rt6.rt6i_idev = loopback_idev;
263                         in6_dev_hold(loopback_idev);
264                         xdst = (struct xfrm_dst *)xdst->u.dst.child;
265                 } while (xdst->u.dst.xfrm);
266
267                 __in6_dev_put(loopback_idev);
268         }
269
270         xfrm_dst_ifdown(dst, dev);
271 }
272
273 static struct dst_ops xfrm6_dst_ops = {
274         .family =               AF_INET6,
275         .protocol =             __constant_htons(ETH_P_IPV6),
276         .gc =                   xfrm6_garbage_collect,
277         .update_pmtu =          xfrm6_update_pmtu,
278         .destroy =              xfrm6_dst_destroy,
279         .ifdown =               xfrm6_dst_ifdown,
280         .local_out =            __ip6_local_out,
281         .gc_thresh =            1024,
282         .entries =              ATOMIC_INIT(0),
283 };
284
285 static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
286         .family =               AF_INET6,
287         .dst_ops =              &xfrm6_dst_ops,
288         .dst_lookup =           xfrm6_dst_lookup,
289         .get_saddr =            xfrm6_get_saddr,
290         .find_bundle =          __xfrm6_find_bundle,
291         .decode_session =       _decode_session6,
292         .get_tos =              xfrm6_get_tos,
293         .init_path =            xfrm6_init_path,
294         .fill_dst =             xfrm6_fill_dst,
295 };
296
297 static int __init xfrm6_policy_init(void)
298 {
299         return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
300 }
301
302 static void xfrm6_policy_fini(void)
303 {
304         xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
305 }
306
307 int __init xfrm6_init(void)
308 {
309         int ret;
310
311         ret = xfrm6_policy_init();
312         if (ret)
313                 goto out;
314
315         ret = xfrm6_state_init();
316         if (ret)
317                 goto out_policy;
318 out:
319         return ret;
320 out_policy:
321         xfrm6_policy_fini();
322         goto out;
323 }
324
325 void xfrm6_fini(void)
326 {
327         //xfrm6_input_fini();
328         xfrm6_policy_fini();
329         xfrm6_state_fini();
330 }