5 * Kazunori MIYAZAWA @USAGI
6 * YOSHIFUJI Hideaki @USAGI
7 * Split up af-specific portion
11 #include <linux/err.h>
12 #include <linux/kernel.h>
13 #include <linux/inetdevice.h>
14 #include <linux/if_tunnel.h>
19 static struct xfrm_policy_afinfo xfrm4_policy_afinfo
;
21 static struct dst_entry
*xfrm4_dst_lookup(struct net
*net
, int tos
,
22 const xfrm_address_t
*saddr
,
23 const xfrm_address_t
*daddr
)
32 fl
.fl4_src
= saddr
->a4
;
34 rt
= __ip_route_output_key(net
, &fl
);
41 static int xfrm4_get_saddr(struct net
*net
,
42 xfrm_address_t
*saddr
, xfrm_address_t
*daddr
)
44 struct dst_entry
*dst
;
47 dst
= xfrm4_dst_lookup(net
, 0, NULL
, daddr
);
51 rt
= (struct rtable
*)dst
;
52 saddr
->a4
= rt
->rt_src
;
57 static int xfrm4_get_tos(const struct flowi
*fl
)
59 return IPTOS_RT_MASK
& fl
->fl4_tos
; /* Strip ECN bits */
62 static int xfrm4_init_path(struct xfrm_dst
*path
, struct dst_entry
*dst
,
68 static int xfrm4_fill_dst(struct xfrm_dst
*xdst
, struct net_device
*dev
,
69 const struct flowi
*fl
)
71 struct rtable
*rt
= (struct rtable
*)xdst
->route
;
73 rt
->rt_key_dst
= fl
->fl4_dst
;
74 rt
->rt_key_src
= fl
->fl4_src
;
75 rt
->rt_tos
= fl
->fl4_tos
;
76 rt
->rt_iif
= fl
->flowi_iif
;
77 rt
->rt_oif
= fl
->flowi_oif
;
78 rt
->rt_mark
= fl
->flowi_mark
;
80 xdst
->u
.dst
.dev
= dev
;
83 xdst
->u
.rt
.peer
= rt
->peer
;
85 atomic_inc(&rt
->peer
->refcnt
);
87 /* Sheit... I remember I did this right. Apparently,
88 * it was magically lost, so this code needs audit */
89 xdst
->u
.rt
.rt_flags
= rt
->rt_flags
& (RTCF_BROADCAST
| RTCF_MULTICAST
|
91 xdst
->u
.rt
.rt_type
= rt
->rt_type
;
92 xdst
->u
.rt
.rt_src
= rt
->rt_src
;
93 xdst
->u
.rt
.rt_dst
= rt
->rt_dst
;
94 xdst
->u
.rt
.rt_gateway
= rt
->rt_gateway
;
95 xdst
->u
.rt
.rt_spec_dst
= rt
->rt_spec_dst
;
101 _decode_session4(struct sk_buff
*skb
, struct flowi
*fl
, int reverse
)
103 struct iphdr
*iph
= ip_hdr(skb
);
104 u8
*xprth
= skb_network_header(skb
) + iph
->ihl
* 4;
106 memset(fl
, 0, sizeof(struct flowi
));
107 fl
->flowi_mark
= skb
->mark
;
109 if (!(iph
->frag_off
& htons(IP_MF
| IP_OFFSET
))) {
110 switch (iph
->protocol
) {
112 case IPPROTO_UDPLITE
:
116 if (xprth
+ 4 < skb
->data
||
117 pskb_may_pull(skb
, xprth
+ 4 - skb
->data
)) {
118 __be16
*ports
= (__be16
*)xprth
;
120 fl
->fl_ip_sport
= ports
[!!reverse
];
121 fl
->fl_ip_dport
= ports
[!reverse
];
126 if (pskb_may_pull(skb
, xprth
+ 2 - skb
->data
)) {
129 fl
->fl_icmp_type
= icmp
[0];
130 fl
->fl_icmp_code
= icmp
[1];
135 if (pskb_may_pull(skb
, xprth
+ 4 - skb
->data
)) {
136 __be32
*ehdr
= (__be32
*)xprth
;
138 fl
->fl_ipsec_spi
= ehdr
[0];
143 if (pskb_may_pull(skb
, xprth
+ 8 - skb
->data
)) {
144 __be32
*ah_hdr
= (__be32
*)xprth
;
146 fl
->fl_ipsec_spi
= ah_hdr
[1];
151 if (pskb_may_pull(skb
, xprth
+ 4 - skb
->data
)) {
152 __be16
*ipcomp_hdr
= (__be16
*)xprth
;
154 fl
->fl_ipsec_spi
= htonl(ntohs(ipcomp_hdr
[1]));
159 if (pskb_may_pull(skb
, xprth
+ 12 - skb
->data
)) {
160 __be16
*greflags
= (__be16
*)xprth
;
161 __be32
*gre_hdr
= (__be32
*)xprth
;
163 if (greflags
[0] & GRE_KEY
) {
164 if (greflags
[0] & GRE_CSUM
)
166 fl
->fl_gre_key
= gre_hdr
[1];
172 fl
->fl_ipsec_spi
= 0;
176 fl
->flowi_proto
= iph
->protocol
;
177 fl
->fl4_dst
= reverse
? iph
->saddr
: iph
->daddr
;
178 fl
->fl4_src
= reverse
? iph
->daddr
: iph
->saddr
;
179 fl
->fl4_tos
= iph
->tos
;
182 static inline int xfrm4_garbage_collect(struct dst_ops
*ops
)
184 struct net
*net
= container_of(ops
, struct net
, xfrm
.xfrm4_dst_ops
);
186 xfrm4_policy_afinfo
.garbage_collect(net
);
187 return (dst_entries_get_slow(ops
) > ops
->gc_thresh
* 2);
190 static void xfrm4_update_pmtu(struct dst_entry
*dst
, u32 mtu
)
192 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
193 struct dst_entry
*path
= xdst
->route
;
195 path
->ops
->update_pmtu(path
, mtu
);
198 static void xfrm4_dst_destroy(struct dst_entry
*dst
)
200 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
202 dst_destroy_metrics_generic(dst
);
204 if (likely(xdst
->u
.rt
.peer
))
205 inet_putpeer(xdst
->u
.rt
.peer
);
207 xfrm_dst_destroy(xdst
);
210 static void xfrm4_dst_ifdown(struct dst_entry
*dst
, struct net_device
*dev
,
216 xfrm_dst_ifdown(dst
, dev
);
219 static struct dst_ops xfrm4_dst_ops
= {
221 .protocol
= cpu_to_be16(ETH_P_IP
),
222 .gc
= xfrm4_garbage_collect
,
223 .update_pmtu
= xfrm4_update_pmtu
,
224 .cow_metrics
= dst_cow_metrics_generic
,
225 .destroy
= xfrm4_dst_destroy
,
226 .ifdown
= xfrm4_dst_ifdown
,
227 .local_out
= __ip_local_out
,
231 static struct xfrm_policy_afinfo xfrm4_policy_afinfo
= {
233 .dst_ops
= &xfrm4_dst_ops
,
234 .dst_lookup
= xfrm4_dst_lookup
,
235 .get_saddr
= xfrm4_get_saddr
,
236 .decode_session
= _decode_session4
,
237 .get_tos
= xfrm4_get_tos
,
238 .init_path
= xfrm4_init_path
,
239 .fill_dst
= xfrm4_fill_dst
,
240 .blackhole_route
= ipv4_blackhole_route
,
244 static struct ctl_table xfrm4_policy_table
[] = {
246 .procname
= "xfrm4_gc_thresh",
247 .data
= &init_net
.xfrm
.xfrm4_dst_ops
.gc_thresh
,
248 .maxlen
= sizeof(int),
250 .proc_handler
= proc_dointvec
,
255 static struct ctl_table_header
*sysctl_hdr
;
258 static void __init
xfrm4_policy_init(void)
260 xfrm_policy_register_afinfo(&xfrm4_policy_afinfo
);
263 static void __exit
xfrm4_policy_fini(void)
267 unregister_net_sysctl_table(sysctl_hdr
);
269 xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo
);
272 void __init
xfrm4_init(int rt_max_size
)
275 * Select a default value for the gc_thresh based on the main route
276 * table hash size. It seems to me the worst case scenario is when
277 * we have ipsec operating in transport mode, in which we create a
278 * dst_entry per socket. The xfrm gc algorithm starts trying to remove
279 * entries at gc_thresh, and prevents new allocations as 2*gc_thresh
280 * so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
281 * That will let us store an ipsec connection per route table entry,
282 * and start cleaning when were 1/2 full
284 xfrm4_dst_ops
.gc_thresh
= rt_max_size
/2;
285 dst_entries_init(&xfrm4_dst_ops
);
290 sysctl_hdr
= register_net_sysctl_table(&init_net
, net_ipv4_ctl_path
,