2 * xfrm6_policy.c: based on xfrm4_policy.c
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
10 * Split up af-specific portion
14 #include <linux/compiler.h>
15 #include <linux/netdevice.h>
16 #include <net/addrconf.h>
21 #include <net/ip6_route.h>
22 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
26 static struct dst_ops xfrm6_dst_ops
;
27 static struct xfrm_policy_afinfo xfrm6_policy_afinfo
;
29 static int xfrm6_dst_lookup(struct xfrm_dst
**xdst
, struct flowi
*fl
)
31 struct dst_entry
*dst
= ip6_route_output(NULL
, fl
);
34 *xdst
= (struct xfrm_dst
*) dst
;
40 static int xfrm6_get_saddr(xfrm_address_t
*saddr
, xfrm_address_t
*daddr
)
43 struct flowi fl_tunnel
= {
46 .daddr
= *(struct in6_addr
*)&daddr
->a6
,
51 if (!xfrm6_dst_lookup((struct xfrm_dst
**)&rt
, &fl_tunnel
)) {
52 ipv6_get_saddr(&rt
->u
.dst
, (struct in6_addr
*)&daddr
->a6
,
53 (struct in6_addr
*)&saddr
->a6
);
54 dst_release(&rt
->u
.dst
);
60 static struct dst_entry
*
61 __xfrm6_find_bundle(struct flowi
*fl
, struct xfrm_policy
*policy
)
63 struct dst_entry
*dst
;
65 /* Still not clear if we should set fl->fl6_{src,dst}... */
66 read_lock_bh(&policy
->lock
);
67 for (dst
= policy
->bundles
; dst
; dst
= dst
->next
) {
68 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
69 struct in6_addr fl_dst_prefix
, fl_src_prefix
;
71 ipv6_addr_prefix(&fl_dst_prefix
,
73 xdst
->u
.rt6
.rt6i_dst
.plen
);
74 ipv6_addr_prefix(&fl_src_prefix
,
76 xdst
->u
.rt6
.rt6i_src
.plen
);
77 if (ipv6_addr_equal(&xdst
->u
.rt6
.rt6i_dst
.addr
, &fl_dst_prefix
) &&
78 ipv6_addr_equal(&xdst
->u
.rt6
.rt6i_src
.addr
, &fl_src_prefix
) &&
79 xfrm_bundle_ok(policy
, xdst
, fl
, AF_INET6
,
80 (xdst
->u
.rt6
.rt6i_dst
.plen
!= 128 ||
81 xdst
->u
.rt6
.rt6i_src
.plen
!= 128))) {
86 read_unlock_bh(&policy
->lock
);
90 static inline struct in6_addr
*
91 __xfrm6_bundle_addr_remote(struct xfrm_state
*x
, struct in6_addr
*addr
)
93 return (x
->type
->remote_addr
) ?
94 (struct in6_addr
*)x
->type
->remote_addr(x
, (xfrm_address_t
*)addr
) :
95 (struct in6_addr
*)&x
->id
.daddr
;
98 static inline struct in6_addr
*
99 __xfrm6_bundle_addr_local(struct xfrm_state
*x
, struct in6_addr
*addr
)
101 return (x
->type
->local_addr
) ?
102 (struct in6_addr
*)x
->type
->local_addr(x
, (xfrm_address_t
*)addr
) :
103 (struct in6_addr
*)&x
->props
.saddr
;
106 /* Allocate chain of dst_entry's, attach known xfrm's, calculate
107 * all the metrics... Shortly, bundle a bundle.
111 __xfrm6_bundle_create(struct xfrm_policy
*policy
, struct xfrm_state
**xfrm
, int nx
,
112 struct flowi
*fl
, struct dst_entry
**dst_p
)
114 struct dst_entry
*dst
, *dst_prev
;
115 struct rt6_info
*rt0
= (struct rt6_info
*)(*dst_p
);
116 struct rt6_info
*rt
= rt0
;
117 struct flowi fl_tunnel
= {
120 .saddr
= fl
->fl6_src
,
121 .daddr
= fl
->fl6_dst
,
130 dst
= dst_prev
= NULL
;
131 dst_hold(&rt
->u
.dst
);
133 for (i
= 0; i
< nx
; i
++) {
134 struct dst_entry
*dst1
= dst_alloc(&xfrm6_dst_ops
);
135 struct xfrm_dst
*xdst
;
137 if (unlikely(dst1
== NULL
)) {
139 dst_release(&rt
->u
.dst
);
146 dst_prev
->child
= dst1
;
147 dst1
->flags
|= DST_NOHASH
;
151 xdst
= (struct xfrm_dst
*)dst1
;
152 xdst
->route
= &rt
->u
.dst
;
153 xdst
->genid
= xfrm
[i
]->genid
;
155 xdst
->route_cookie
= rt
->rt6i_node
->fn_sernum
;
157 dst1
->next
= dst_prev
;
160 if (xfrm
[i
]->type
->flags
& XFRM_TYPE_NON_FRAGMENT
)
161 ((struct rt6_info
*)dst
)->nfheader_len
+=
162 xfrm
[i
]->props
.header_len
;
163 header_len
+= xfrm
[i
]->props
.header_len
;
164 trailer_len
+= xfrm
[i
]->props
.trailer_len
;
166 if (xfrm
[i
]->props
.mode
!= XFRM_MODE_TRANSPORT
) {
167 unsigned short encap_family
= xfrm
[i
]->props
.family
;
168 switch(encap_family
) {
170 fl_tunnel
.fl4_dst
= xfrm
[i
]->id
.daddr
.a4
;
171 fl_tunnel
.fl4_src
= xfrm
[i
]->props
.saddr
.a4
;
174 ipv6_addr_copy(&fl_tunnel
.fl6_dst
, __xfrm6_bundle_addr_remote(xfrm
[i
], &fl
->fl6_dst
));
176 ipv6_addr_copy(&fl_tunnel
.fl6_src
, __xfrm6_bundle_addr_local(xfrm
[i
], &fl
->fl6_src
));
182 err
= xfrm_dst_lookup((struct xfrm_dst
**) &rt
,
183 &fl_tunnel
, encap_family
);
187 dst_hold(&rt
->u
.dst
);
190 dst_prev
->child
= &rt
->u
.dst
;
191 dst
->path
= &rt
->u
.dst
;
193 /* Copy neighbour for reachability confirmation */
194 dst
->neighbour
= neigh_clone(rt
->u
.dst
.neighbour
);
197 ((struct xfrm_dst
*)dst
)->path_cookie
= rt
->rt6i_node
->fn_sernum
;
205 for (; dst_prev
!= &rt
->u
.dst
; dst_prev
= dst_prev
->child
) {
206 struct xfrm_dst
*x
= (struct xfrm_dst
*)dst_prev
;
208 dst_prev
->xfrm
= xfrm
[i
++];
209 dst_prev
->dev
= rt
->u
.dst
.dev
;
212 dev_hold(rt
->u
.dst
.dev
);
214 x
->u
.rt6
.rt6i_idev
= in6_dev_get(rt
->u
.dst
.dev
);
215 if (!x
->u
.rt6
.rt6i_idev
)
218 dst_prev
->obsolete
= -1;
219 dst_prev
->flags
|= DST_HOST
;
220 dst_prev
->lastuse
= jiffies
;
221 dst_prev
->header_len
= header_len
;
222 dst_prev
->trailer_len
= trailer_len
;
223 memcpy(&dst_prev
->metrics
, &x
->route
->metrics
, sizeof(dst_prev
->metrics
));
225 dst_prev
->input
= dst_discard
;
226 dst_prev
->output
= dst_prev
->xfrm
->outer_mode
->afinfo
->output
;
227 /* Sheit... I remember I did this right. Apparently,
228 * it was magically lost, so this code needs audit */
229 x
->u
.rt6
.rt6i_flags
= rt0
->rt6i_flags
&(RTF_ANYCAST
|RTF_LOCAL
);
230 x
->u
.rt6
.rt6i_metric
= rt0
->rt6i_metric
;
231 x
->u
.rt6
.rt6i_node
= rt0
->rt6i_node
;
232 x
->u
.rt6
.rt6i_gateway
= rt0
->rt6i_gateway
;
233 memcpy(&x
->u
.rt6
.rt6i_gateway
, &rt0
->rt6i_gateway
, sizeof(x
->u
.rt6
.rt6i_gateway
));
234 x
->u
.rt6
.rt6i_dst
= rt0
->rt6i_dst
;
235 x
->u
.rt6
.rt6i_src
= rt0
->rt6i_src
;
236 header_len
-= x
->u
.dst
.xfrm
->props
.header_len
;
237 trailer_len
-= x
->u
.dst
.xfrm
->props
.trailer_len
;
250 _decode_session6(struct sk_buff
*skb
, struct flowi
*fl
)
252 u16 offset
= skb_network_header_len(skb
);
253 struct ipv6hdr
*hdr
= ipv6_hdr(skb
);
254 struct ipv6_opt_hdr
*exthdr
;
255 const unsigned char *nh
= skb_network_header(skb
);
256 u8 nexthdr
= nh
[IP6CB(skb
)->nhoff
];
258 memset(fl
, 0, sizeof(struct flowi
));
259 ipv6_addr_copy(&fl
->fl6_dst
, &hdr
->daddr
);
260 ipv6_addr_copy(&fl
->fl6_src
, &hdr
->saddr
);
262 while (pskb_may_pull(skb
, nh
+ offset
+ 1 - skb
->data
)) {
263 nh
= skb_network_header(skb
);
264 exthdr
= (struct ipv6_opt_hdr
*)(nh
+ offset
);
267 case NEXTHDR_ROUTING
:
270 offset
+= ipv6_optlen(exthdr
);
271 nexthdr
= exthdr
->nexthdr
;
272 exthdr
= (struct ipv6_opt_hdr
*)(nh
+ offset
);
276 case IPPROTO_UDPLITE
:
280 if (pskb_may_pull(skb
, nh
+ offset
+ 4 - skb
->data
)) {
281 __be16
*ports
= (__be16
*)exthdr
;
283 fl
->fl_ip_sport
= ports
[0];
284 fl
->fl_ip_dport
= ports
[1];
290 if (pskb_may_pull(skb
, nh
+ offset
+ 2 - skb
->data
)) {
291 u8
*icmp
= (u8
*)exthdr
;
293 fl
->fl_icmp_type
= icmp
[0];
294 fl
->fl_icmp_code
= icmp
[1];
299 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
301 if (pskb_may_pull(skb
, nh
+ offset
+ 3 - skb
->data
)) {
303 mh
= (struct ip6_mh
*)exthdr
;
305 fl
->fl_mh_type
= mh
->ip6mh_type
;
311 /* XXX Why are there these headers? */
316 fl
->fl_ipsec_spi
= 0;
323 static inline int xfrm6_garbage_collect(void)
325 xfrm6_policy_afinfo
.garbage_collect();
326 return (atomic_read(&xfrm6_dst_ops
.entries
) > xfrm6_dst_ops
.gc_thresh
*2);
329 static void xfrm6_update_pmtu(struct dst_entry
*dst
, u32 mtu
)
331 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
332 struct dst_entry
*path
= xdst
->route
;
334 path
->ops
->update_pmtu(path
, mtu
);
337 static void xfrm6_dst_destroy(struct dst_entry
*dst
)
339 struct xfrm_dst
*xdst
= (struct xfrm_dst
*)dst
;
341 if (likely(xdst
->u
.rt6
.rt6i_idev
))
342 in6_dev_put(xdst
->u
.rt6
.rt6i_idev
);
343 xfrm_dst_destroy(xdst
);
346 static void xfrm6_dst_ifdown(struct dst_entry
*dst
, struct net_device
*dev
,
349 struct xfrm_dst
*xdst
;
354 xdst
= (struct xfrm_dst
*)dst
;
355 if (xdst
->u
.rt6
.rt6i_idev
->dev
== dev
) {
356 struct inet6_dev
*loopback_idev
= in6_dev_get(init_net
.loopback_dev
);
357 BUG_ON(!loopback_idev
);
360 in6_dev_put(xdst
->u
.rt6
.rt6i_idev
);
361 xdst
->u
.rt6
.rt6i_idev
= loopback_idev
;
362 in6_dev_hold(loopback_idev
);
363 xdst
= (struct xfrm_dst
*)xdst
->u
.dst
.child
;
364 } while (xdst
->u
.dst
.xfrm
);
366 __in6_dev_put(loopback_idev
);
369 xfrm_dst_ifdown(dst
, dev
);
372 static struct dst_ops xfrm6_dst_ops
= {
374 .protocol
= __constant_htons(ETH_P_IPV6
),
375 .gc
= xfrm6_garbage_collect
,
376 .update_pmtu
= xfrm6_update_pmtu
,
377 .destroy
= xfrm6_dst_destroy
,
378 .ifdown
= xfrm6_dst_ifdown
,
380 .entry_size
= sizeof(struct xfrm_dst
),
383 static struct xfrm_policy_afinfo xfrm6_policy_afinfo
= {
385 .dst_ops
= &xfrm6_dst_ops
,
386 .dst_lookup
= xfrm6_dst_lookup
,
387 .get_saddr
= xfrm6_get_saddr
,
388 .find_bundle
= __xfrm6_find_bundle
,
389 .bundle_create
= __xfrm6_bundle_create
,
390 .decode_session
= _decode_session6
,
393 static void __init
xfrm6_policy_init(void)
395 xfrm_policy_register_afinfo(&xfrm6_policy_afinfo
);
398 static void xfrm6_policy_fini(void)
400 xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo
);
403 void __init
xfrm6_init(void)
409 void xfrm6_fini(void)
411 //xfrm6_input_fini();