Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * xfrm6_state.c: based on xfrm4_state.c
4 *
5 * Authors:
6 * Mitsuru KANDA @USAGI
7 * Kazunori MIYAZAWA @USAGI
8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9 * IPv6 support
10 * YOSHIFUJI Hideaki @USAGI
11 * Split up af-specific portion
12 *
13 */
14
15#include <net/xfrm.h>
16#include <linux/pfkeyv2.h>
17#include <linux/ipsec.h>
18#include <linux/netfilter_ipv6.h>
19#include <linux/export.h>
20#include <net/dsfield.h>
21#include <net/ipv6.h>
22#include <net/addrconf.h>
23
24static void
25__xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
26{
27 const struct flowi6 *fl6 = &fl->u.ip6;
28
29 /* Initialize temporary selector matching only
30 * to current session. */
31 *(struct in6_addr *)&sel->daddr = fl6->daddr;
32 *(struct in6_addr *)&sel->saddr = fl6->saddr;
33 sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
34 sel->dport_mask = htons(0xffff);
35 sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
36 sel->sport_mask = htons(0xffff);
37 sel->family = AF_INET6;
38 sel->prefixlen_d = 128;
39 sel->prefixlen_s = 128;
40 sel->proto = fl6->flowi6_proto;
41 sel->ifindex = fl6->flowi6_oif;
42}
43
44static void
45xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl,
46 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
47{
48 x->id = tmpl->id;
49 if (ipv6_addr_any((struct in6_addr *)&x->id.daddr))
50 memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
51 memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
52 if (ipv6_addr_any((struct in6_addr *)&x->props.saddr))
53 memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
54 x->props.mode = tmpl->mode;
55 x->props.reqid = tmpl->reqid;
56 x->props.family = AF_INET6;
57}
58
59/* distribution counting sort function for xfrm_state and xfrm_tmpl */
60static int
61__xfrm6_sort(void **dst, void **src, int n, int (*cmp)(void *p), int maxclass)
62{
63 int i;
64 int class[XFRM_MAX_DEPTH];
65 int count[maxclass];
66
67 memset(count, 0, sizeof(count));
68
69 for (i = 0; i < n; i++) {
70 int c;
71 class[i] = c = cmp(src[i]);
72 count[c]++;
73 }
74
75 for (i = 2; i < maxclass; i++)
76 count[i] += count[i - 1];
77
78 for (i = 0; i < n; i++) {
79 dst[count[class[i] - 1]++] = src[i];
80 src[i] = NULL;
81 }
82
83 return 0;
84}
85
86/*
87 * Rule for xfrm_state:
88 *
89 * rule 1: select IPsec transport except AH
90 * rule 2: select MIPv6 RO or inbound trigger
91 * rule 3: select IPsec transport AH
92 * rule 4: select IPsec tunnel
93 * rule 5: others
94 */
95static int __xfrm6_state_sort_cmp(void *p)
96{
97 struct xfrm_state *v = p;
98
99 switch (v->props.mode) {
100 case XFRM_MODE_TRANSPORT:
101 if (v->id.proto != IPPROTO_AH)
102 return 1;
103 else
104 return 3;
105#if IS_ENABLED(CONFIG_IPV6_MIP6)
106 case XFRM_MODE_ROUTEOPTIMIZATION:
107 case XFRM_MODE_IN_TRIGGER:
108 return 2;
109#endif
110 case XFRM_MODE_TUNNEL:
111 case XFRM_MODE_BEET:
112 return 4;
113 }
114 return 5;
115}
116
117static int
118__xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
119{
120 return __xfrm6_sort((void **)dst, (void **)src, n,
121 __xfrm6_state_sort_cmp, 6);
122}
123
124/*
125 * Rule for xfrm_tmpl:
126 *
127 * rule 1: select IPsec transport
128 * rule 2: select MIPv6 RO or inbound trigger
129 * rule 3: select IPsec tunnel
130 * rule 4: others
131 */
132static int __xfrm6_tmpl_sort_cmp(void *p)
133{
134 struct xfrm_tmpl *v = p;
135 switch (v->mode) {
136 case XFRM_MODE_TRANSPORT:
137 return 1;
138#if IS_ENABLED(CONFIG_IPV6_MIP6)
139 case XFRM_MODE_ROUTEOPTIMIZATION:
140 case XFRM_MODE_IN_TRIGGER:
141 return 2;
142#endif
143 case XFRM_MODE_TUNNEL:
144 case XFRM_MODE_BEET:
145 return 3;
146 }
147 return 4;
148}
149
150static int
151__xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
152{
153 return __xfrm6_sort((void **)dst, (void **)src, n,
154 __xfrm6_tmpl_sort_cmp, 5);
155}
156
157int xfrm6_extract_header(struct sk_buff *skb)
158{
159 struct ipv6hdr *iph = ipv6_hdr(skb);
160
161 XFRM_MODE_SKB_CB(skb)->ihl = sizeof(*iph);
162 XFRM_MODE_SKB_CB(skb)->id = 0;
163 XFRM_MODE_SKB_CB(skb)->frag_off = htons(IP_DF);
164 XFRM_MODE_SKB_CB(skb)->tos = ipv6_get_dsfield(iph);
165 XFRM_MODE_SKB_CB(skb)->ttl = iph->hop_limit;
166 XFRM_MODE_SKB_CB(skb)->optlen = 0;
167 memcpy(XFRM_MODE_SKB_CB(skb)->flow_lbl, iph->flow_lbl,
168 sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
169
170 return 0;
171}
172
173static struct xfrm_state_afinfo xfrm6_state_afinfo = {
174 .family = AF_INET6,
175 .proto = IPPROTO_IPV6,
176 .eth_proto = htons(ETH_P_IPV6),
177 .owner = THIS_MODULE,
178 .init_tempsel = __xfrm6_init_tempsel,
179 .init_temprop = xfrm6_init_temprop,
180 .tmpl_sort = __xfrm6_tmpl_sort,
181 .state_sort = __xfrm6_state_sort,
182 .output = xfrm6_output,
183 .output_finish = xfrm6_output_finish,
184 .extract_input = xfrm6_extract_input,
185 .extract_output = xfrm6_extract_output,
186 .transport_finish = xfrm6_transport_finish,
187 .local_error = xfrm6_local_error,
188};
189
190int __init xfrm6_state_init(void)
191{
192 return xfrm_state_register_afinfo(&xfrm6_state_afinfo);
193}
194
195void xfrm6_state_fini(void)
196{
197 xfrm_state_unregister_afinfo(&xfrm6_state_afinfo);
198}
1/*
2 * xfrm6_state.c: based on xfrm4_state.c
3 *
4 * Authors:
5 * Mitsuru KANDA @USAGI
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki @USAGI
10 * Split up af-specific portion
11 *
12 */
13
14#include <net/xfrm.h>
15#include <linux/pfkeyv2.h>
16#include <linux/ipsec.h>
17#include <linux/netfilter_ipv6.h>
18#include <net/dsfield.h>
19#include <net/ipv6.h>
20#include <net/addrconf.h>
21
22static void
23__xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
24{
25 const struct flowi6 *fl6 = &fl->u.ip6;
26
27 /* Initialize temporary selector matching only
28 * to current session. */
29 ipv6_addr_copy((struct in6_addr *)&sel->daddr, &fl6->daddr);
30 ipv6_addr_copy((struct in6_addr *)&sel->saddr, &fl6->saddr);
31 sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
32 sel->dport_mask = htons(0xffff);
33 sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
34 sel->sport_mask = htons(0xffff);
35 sel->family = AF_INET6;
36 sel->prefixlen_d = 128;
37 sel->prefixlen_s = 128;
38 sel->proto = fl6->flowi6_proto;
39 sel->ifindex = fl6->flowi6_oif;
40}
41
42static void
43xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl,
44 const xfrm_address_t *daddr, const xfrm_address_t *saddr)
45{
46 x->id = tmpl->id;
47 if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))
48 memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
49 memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
50 if (ipv6_addr_any((struct in6_addr*)&x->props.saddr))
51 memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
52 x->props.mode = tmpl->mode;
53 x->props.reqid = tmpl->reqid;
54 x->props.family = AF_INET6;
55}
56
57/* distribution counting sort function for xfrm_state and xfrm_tmpl */
58static int
59__xfrm6_sort(void **dst, void **src, int n, int (*cmp)(void *p), int maxclass)
60{
61 int i;
62 int class[XFRM_MAX_DEPTH];
63 int count[maxclass];
64
65 memset(count, 0, sizeof(count));
66
67 for (i = 0; i < n; i++) {
68 int c;
69 class[i] = c = cmp(src[i]);
70 count[c]++;
71 }
72
73 for (i = 2; i < maxclass; i++)
74 count[i] += count[i - 1];
75
76 for (i = 0; i < n; i++) {
77 dst[count[class[i] - 1]++] = src[i];
78 src[i] = NULL;
79 }
80
81 return 0;
82}
83
84/*
85 * Rule for xfrm_state:
86 *
87 * rule 1: select IPsec transport except AH
88 * rule 2: select MIPv6 RO or inbound trigger
89 * rule 3: select IPsec transport AH
90 * rule 4: select IPsec tunnel
91 * rule 5: others
92 */
93static int __xfrm6_state_sort_cmp(void *p)
94{
95 struct xfrm_state *v = p;
96
97 switch (v->props.mode) {
98 case XFRM_MODE_TRANSPORT:
99 if (v->id.proto != IPPROTO_AH)
100 return 1;
101 else
102 return 3;
103#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
104 case XFRM_MODE_ROUTEOPTIMIZATION:
105 case XFRM_MODE_IN_TRIGGER:
106 return 2;
107#endif
108 case XFRM_MODE_TUNNEL:
109 case XFRM_MODE_BEET:
110 return 4;
111 }
112 return 5;
113}
114
115static int
116__xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
117{
118 return __xfrm6_sort((void **)dst, (void **)src, n,
119 __xfrm6_state_sort_cmp, 6);
120}
121
122/*
123 * Rule for xfrm_tmpl:
124 *
125 * rule 1: select IPsec transport
126 * rule 2: select MIPv6 RO or inbound trigger
127 * rule 3: select IPsec tunnel
128 * rule 4: others
129 */
130static int __xfrm6_tmpl_sort_cmp(void *p)
131{
132 struct xfrm_tmpl *v = p;
133 switch (v->mode) {
134 case XFRM_MODE_TRANSPORT:
135 return 1;
136#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
137 case XFRM_MODE_ROUTEOPTIMIZATION:
138 case XFRM_MODE_IN_TRIGGER:
139 return 2;
140#endif
141 case XFRM_MODE_TUNNEL:
142 case XFRM_MODE_BEET:
143 return 3;
144 }
145 return 4;
146}
147
148static int
149__xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
150{
151 return __xfrm6_sort((void **)dst, (void **)src, n,
152 __xfrm6_tmpl_sort_cmp, 5);
153}
154
155int xfrm6_extract_header(struct sk_buff *skb)
156{
157 struct ipv6hdr *iph = ipv6_hdr(skb);
158
159 XFRM_MODE_SKB_CB(skb)->ihl = sizeof(*iph);
160 XFRM_MODE_SKB_CB(skb)->id = 0;
161 XFRM_MODE_SKB_CB(skb)->frag_off = htons(IP_DF);
162 XFRM_MODE_SKB_CB(skb)->tos = ipv6_get_dsfield(iph);
163 XFRM_MODE_SKB_CB(skb)->ttl = iph->hop_limit;
164 XFRM_MODE_SKB_CB(skb)->optlen = 0;
165 memcpy(XFRM_MODE_SKB_CB(skb)->flow_lbl, iph->flow_lbl,
166 sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
167
168 return 0;
169}
170
171static struct xfrm_state_afinfo xfrm6_state_afinfo = {
172 .family = AF_INET6,
173 .proto = IPPROTO_IPV6,
174 .eth_proto = htons(ETH_P_IPV6),
175 .owner = THIS_MODULE,
176 .init_tempsel = __xfrm6_init_tempsel,
177 .init_temprop = xfrm6_init_temprop,
178 .tmpl_sort = __xfrm6_tmpl_sort,
179 .state_sort = __xfrm6_state_sort,
180 .output = xfrm6_output,
181 .output_finish = xfrm6_output_finish,
182 .extract_input = xfrm6_extract_input,
183 .extract_output = xfrm6_extract_output,
184 .transport_finish = xfrm6_transport_finish,
185};
186
187int __init xfrm6_state_init(void)
188{
189 return xfrm_state_register_afinfo(&xfrm6_state_afinfo);
190}
191
192void xfrm6_state_fini(void)
193{
194 xfrm_state_unregister_afinfo(&xfrm6_state_afinfo);
195}
196