1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * xfrm6_policy.c: based on xfrm4_policy.c |
4 | * |
5 | * Authors: |
6 | * Mitsuru KANDA @USAGI |
7 | * Kazunori MIYAZAWA @USAGI |
8 | * Kunihiro Ishiguro <kunihiro@ipinfusion.com> |
9 | * IPv6 support |
10 | * YOSHIFUJI Hideaki |
11 | * Split up af-specific portion |
12 | * |
13 | */ |
14 | |
15 | #include <linux/err.h> |
16 | #include <linux/kernel.h> |
17 | #include <linux/netdevice.h> |
18 | #include <net/addrconf.h> |
19 | #include <net/dst.h> |
20 | #include <net/xfrm.h> |
21 | #include <net/ip.h> |
22 | #include <net/ipv6.h> |
23 | #include <net/ip6_route.h> |
24 | #include <net/l3mdev.h> |
25 | |
26 | static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif, |
27 | const xfrm_address_t *saddr, |
28 | const xfrm_address_t *daddr, |
29 | u32 mark) |
30 | { |
31 | struct flowi6 fl6; |
32 | struct dst_entry *dst; |
33 | int err; |
34 | |
35 | memset(&fl6, 0, sizeof(fl6)); |
36 | fl6.flowi6_l3mdev = l3mdev_master_ifindex_by_index(net, ifindex: oif); |
37 | fl6.flowi6_mark = mark; |
38 | memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr)); |
39 | if (saddr) |
40 | memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr)); |
41 | |
42 | dst = ip6_route_output(net, NULL, fl6: &fl6); |
43 | |
44 | err = dst->error; |
45 | if (dst->error) { |
46 | dst_release(dst); |
47 | dst = ERR_PTR(error: err); |
48 | } |
49 | |
50 | return dst; |
51 | } |
52 | |
53 | static int xfrm6_get_saddr(struct net *net, int oif, |
54 | xfrm_address_t *saddr, xfrm_address_t *daddr, |
55 | u32 mark) |
56 | { |
57 | struct dst_entry *dst; |
58 | struct net_device *dev; |
59 | |
60 | dst = xfrm6_dst_lookup(net, tos: 0, oif, NULL, daddr, mark); |
61 | if (IS_ERR(ptr: dst)) |
62 | return -EHOSTUNREACH; |
63 | |
64 | dev = ip6_dst_idev(dst)->dev; |
65 | ipv6_dev_get_saddr(net: dev_net(dev), dev, daddr: &daddr->in6, srcprefs: 0, saddr: &saddr->in6); |
66 | dst_release(dst); |
67 | return 0; |
68 | } |
69 | |
70 | static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, |
71 | const struct flowi *fl) |
72 | { |
73 | struct rt6_info *rt = (struct rt6_info *)xdst->route; |
74 | |
75 | xdst->u.dst.dev = dev; |
76 | netdev_hold(dev, tracker: &xdst->u.dst.dev_tracker, GFP_ATOMIC); |
77 | |
78 | xdst->u.rt6.rt6i_idev = in6_dev_get(dev); |
79 | if (!xdst->u.rt6.rt6i_idev) { |
80 | netdev_put(dev, tracker: &xdst->u.dst.dev_tracker); |
81 | return -ENODEV; |
82 | } |
83 | |
84 | /* Sheit... I remember I did this right. Apparently, |
85 | * it was magically lost, so this code needs audit */ |
86 | xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST | |
87 | RTF_LOCAL); |
88 | xdst->route_cookie = rt6_get_cookie(rt); |
89 | xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway; |
90 | xdst->u.rt6.rt6i_dst = rt->rt6i_dst; |
91 | xdst->u.rt6.rt6i_src = rt->rt6i_src; |
92 | rt6_uncached_list_add(rt: &xdst->u.rt6); |
93 | |
94 | return 0; |
95 | } |
96 | |
97 | static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk, |
98 | struct sk_buff *skb, u32 mtu, |
99 | bool confirm_neigh) |
100 | { |
101 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
102 | struct dst_entry *path = xdst->route; |
103 | |
104 | path->ops->update_pmtu(path, sk, skb, mtu, confirm_neigh); |
105 | } |
106 | |
107 | static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk, |
108 | struct sk_buff *skb) |
109 | { |
110 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
111 | struct dst_entry *path = xdst->route; |
112 | |
113 | path->ops->redirect(path, sk, skb); |
114 | } |
115 | |
116 | static void xfrm6_dst_destroy(struct dst_entry *dst) |
117 | { |
118 | struct xfrm_dst *xdst = (struct xfrm_dst *)dst; |
119 | |
120 | dst_destroy_metrics_generic(dst); |
121 | rt6_uncached_list_del(rt: &xdst->u.rt6); |
122 | if (likely(xdst->u.rt6.rt6i_idev)) |
123 | in6_dev_put(idev: xdst->u.rt6.rt6i_idev); |
124 | xfrm_dst_destroy(xdst); |
125 | } |
126 | |
127 | static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev) |
128 | { |
129 | struct xfrm_dst *xdst; |
130 | |
131 | xdst = (struct xfrm_dst *)dst; |
132 | if (xdst->u.rt6.rt6i_idev->dev == dev) { |
133 | struct inet6_dev *loopback_idev = |
134 | in6_dev_get(dev: dev_net(dev)->loopback_dev); |
135 | |
136 | do { |
137 | in6_dev_put(idev: xdst->u.rt6.rt6i_idev); |
138 | xdst->u.rt6.rt6i_idev = loopback_idev; |
139 | in6_dev_hold(idev: loopback_idev); |
140 | xdst = (struct xfrm_dst *)xfrm_dst_child(dst: &xdst->u.dst); |
141 | } while (xdst->u.dst.xfrm); |
142 | |
143 | __in6_dev_put(idev: loopback_idev); |
144 | } |
145 | |
146 | xfrm_dst_ifdown(dst, dev); |
147 | } |
148 | |
149 | static struct dst_ops xfrm6_dst_ops_template = { |
150 | .family = AF_INET6, |
151 | .update_pmtu = xfrm6_update_pmtu, |
152 | .redirect = xfrm6_redirect, |
153 | .cow_metrics = dst_cow_metrics_generic, |
154 | .destroy = xfrm6_dst_destroy, |
155 | .ifdown = xfrm6_dst_ifdown, |
156 | .local_out = __ip6_local_out, |
157 | .gc_thresh = 32768, |
158 | }; |
159 | |
160 | static const struct xfrm_policy_afinfo xfrm6_policy_afinfo = { |
161 | .dst_ops = &xfrm6_dst_ops_template, |
162 | .dst_lookup = xfrm6_dst_lookup, |
163 | .get_saddr = xfrm6_get_saddr, |
164 | .fill_dst = xfrm6_fill_dst, |
165 | .blackhole_route = ip6_blackhole_route, |
166 | }; |
167 | |
168 | static int __init xfrm6_policy_init(void) |
169 | { |
170 | return xfrm_policy_register_afinfo(afinfo: &xfrm6_policy_afinfo, AF_INET6); |
171 | } |
172 | |
173 | static void xfrm6_policy_fini(void) |
174 | { |
175 | xfrm_policy_unregister_afinfo(afinfo: &xfrm6_policy_afinfo); |
176 | } |
177 | |
178 | #ifdef CONFIG_SYSCTL |
179 | static struct ctl_table xfrm6_policy_table[] = { |
180 | { |
181 | .procname = "xfrm6_gc_thresh" , |
182 | .data = &init_net.xfrm.xfrm6_dst_ops.gc_thresh, |
183 | .maxlen = sizeof(int), |
184 | .mode = 0644, |
185 | .proc_handler = proc_dointvec, |
186 | }, |
187 | { } |
188 | }; |
189 | |
190 | static int __net_init xfrm6_net_sysctl_init(struct net *net) |
191 | { |
192 | struct ctl_table *table; |
193 | struct ctl_table_header *hdr; |
194 | |
195 | table = xfrm6_policy_table; |
196 | if (!net_eq(net1: net, net2: &init_net)) { |
197 | table = kmemdup(p: table, size: sizeof(xfrm6_policy_table), GFP_KERNEL); |
198 | if (!table) |
199 | goto err_alloc; |
200 | |
201 | table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh; |
202 | } |
203 | |
204 | hdr = register_net_sysctl_sz(net, path: "net/ipv6" , table, |
205 | ARRAY_SIZE(xfrm6_policy_table)); |
206 | if (!hdr) |
207 | goto err_reg; |
208 | |
209 | net->ipv6.sysctl.xfrm6_hdr = hdr; |
210 | return 0; |
211 | |
212 | err_reg: |
213 | if (!net_eq(net1: net, net2: &init_net)) |
214 | kfree(objp: table); |
215 | err_alloc: |
216 | return -ENOMEM; |
217 | } |
218 | |
219 | static void __net_exit xfrm6_net_sysctl_exit(struct net *net) |
220 | { |
221 | struct ctl_table *table; |
222 | |
223 | if (!net->ipv6.sysctl.xfrm6_hdr) |
224 | return; |
225 | |
226 | table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg; |
227 | unregister_net_sysctl_table(header: net->ipv6.sysctl.xfrm6_hdr); |
228 | if (!net_eq(net1: net, net2: &init_net)) |
229 | kfree(objp: table); |
230 | } |
231 | #else /* CONFIG_SYSCTL */ |
232 | static inline int xfrm6_net_sysctl_init(struct net *net) |
233 | { |
234 | return 0; |
235 | } |
236 | |
237 | static inline void xfrm6_net_sysctl_exit(struct net *net) |
238 | { |
239 | } |
240 | #endif |
241 | |
242 | static int __net_init xfrm6_net_init(struct net *net) |
243 | { |
244 | int ret; |
245 | |
246 | memcpy(&net->xfrm.xfrm6_dst_ops, &xfrm6_dst_ops_template, |
247 | sizeof(xfrm6_dst_ops_template)); |
248 | ret = dst_entries_init(dst: &net->xfrm.xfrm6_dst_ops); |
249 | if (ret) |
250 | return ret; |
251 | |
252 | ret = xfrm6_net_sysctl_init(net); |
253 | if (ret) |
254 | dst_entries_destroy(dst: &net->xfrm.xfrm6_dst_ops); |
255 | |
256 | return ret; |
257 | } |
258 | |
259 | static void __net_exit xfrm6_net_exit(struct net *net) |
260 | { |
261 | xfrm6_net_sysctl_exit(net); |
262 | dst_entries_destroy(dst: &net->xfrm.xfrm6_dst_ops); |
263 | } |
264 | |
265 | static struct pernet_operations xfrm6_net_ops = { |
266 | .init = xfrm6_net_init, |
267 | .exit = xfrm6_net_exit, |
268 | }; |
269 | |
270 | int __init xfrm6_init(void) |
271 | { |
272 | int ret; |
273 | |
274 | ret = xfrm6_policy_init(); |
275 | if (ret) |
276 | goto out; |
277 | ret = xfrm6_state_init(); |
278 | if (ret) |
279 | goto out_policy; |
280 | |
281 | ret = xfrm6_protocol_init(); |
282 | if (ret) |
283 | goto out_state; |
284 | |
285 | ret = register_pernet_subsys(&xfrm6_net_ops); |
286 | if (ret) |
287 | goto out_protocol; |
288 | out: |
289 | return ret; |
290 | out_protocol: |
291 | xfrm6_protocol_fini(); |
292 | out_state: |
293 | xfrm6_state_fini(); |
294 | out_policy: |
295 | xfrm6_policy_fini(); |
296 | goto out; |
297 | } |
298 | |
299 | void xfrm6_fini(void) |
300 | { |
301 | unregister_pernet_subsys(&xfrm6_net_ops); |
302 | xfrm6_protocol_fini(); |
303 | xfrm6_policy_fini(); |
304 | xfrm6_state_fini(); |
305 | } |
306 | |