2007-02-09 07:24:47 -07:00
|
|
|
/*
|
2005-04-16 15:20:36 -07:00
|
|
|
* xfrm4_policy.c
|
|
|
|
*
|
|
|
|
* Changes:
|
|
|
|
* Kazunori MIYAZAWA @USAGI
|
|
|
|
* YOSHIFUJI Hideaki @USAGI
|
|
|
|
* Split up af-specific portion
|
2007-02-09 07:24:47 -07:00
|
|
|
*
|
2005-04-16 15:20:36 -07:00
|
|
|
*/
|
|
|
|
|
2007-11-13 22:37:28 -07:00
|
|
|
#include <linux/err.h>
|
|
|
|
#include <linux/kernel.h>
|
2005-05-03 16:27:10 -07:00
|
|
|
#include <linux/inetdevice.h>
|
2010-11-02 21:41:38 -07:00
|
|
|
#include <linux/if_tunnel.h>
|
2007-11-13 22:35:32 -07:00
|
|
|
#include <net/dst.h>
|
2005-04-16 15:20:36 -07:00
|
|
|
#include <net/xfrm.h>
|
|
|
|
#include <net/ip.h>
|
|
|
|
|
|
|
|
static struct xfrm_policy_afinfo xfrm4_policy_afinfo;
|
|
|
|
|
2011-05-09 15:13:28 -07:00
|
|
|
static struct dst_entry *__xfrm4_dst_lookup(struct net *net, struct flowi4 *fl4,
|
|
|
|
int tos,
|
|
|
|
const xfrm_address_t *saddr,
|
|
|
|
const xfrm_address_t *daddr)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2007-11-13 22:37:28 -07:00
|
|
|
struct rtable *rt;
|
2006-09-19 12:57:34 -07:00
|
|
|
|
2011-05-09 15:13:28 -07:00
|
|
|
memset(fl4, 0, sizeof(*fl4));
|
|
|
|
fl4->daddr = daddr->a4;
|
|
|
|
fl4->flowi4_tos = tos;
|
2007-11-13 22:37:28 -07:00
|
|
|
if (saddr)
|
2011-05-09 15:13:28 -07:00
|
|
|
fl4->saddr = saddr->a4;
|
2007-11-13 22:37:28 -07:00
|
|
|
|
2011-05-09 15:13:28 -07:00
|
|
|
rt = __ip_route_output_key(net, fl4);
|
2011-03-02 15:31:35 -07:00
|
|
|
if (!IS_ERR(rt))
|
|
|
|
return &rt->dst;
|
|
|
|
|
|
|
|
return ERR_CAST(rt);
|
2007-11-13 22:37:28 -07:00
|
|
|
}
|
|
|
|
|
2011-05-09 15:13:28 -07:00
|
|
|
static struct dst_entry *xfrm4_dst_lookup(struct net *net, int tos,
|
|
|
|
const xfrm_address_t *saddr,
|
|
|
|
const xfrm_address_t *daddr)
|
|
|
|
{
|
|
|
|
struct flowi4 fl4;
|
|
|
|
|
|
|
|
return __xfrm4_dst_lookup(net, &fl4, tos, saddr, daddr);
|
|
|
|
}
|
|
|
|
|
2008-11-25 18:56:49 -07:00
|
|
|
static int xfrm4_get_saddr(struct net *net,
|
|
|
|
xfrm_address_t *saddr, xfrm_address_t *daddr)
|
2007-11-13 22:37:28 -07:00
|
|
|
{
|
|
|
|
struct dst_entry *dst;
|
2011-05-09 15:13:28 -07:00
|
|
|
struct flowi4 fl4;
|
2007-11-13 22:37:28 -07:00
|
|
|
|
2011-05-09 15:13:28 -07:00
|
|
|
dst = __xfrm4_dst_lookup(net, &fl4, 0, NULL, daddr);
|
2007-11-13 22:37:28 -07:00
|
|
|
if (IS_ERR(dst))
|
|
|
|
return -EHOSTUNREACH;
|
|
|
|
|
2011-05-09 15:13:28 -07:00
|
|
|
saddr->a4 = fl4.saddr;
|
2007-11-13 22:37:28 -07:00
|
|
|
dst_release(dst);
|
|
|
|
return 0;
|
2006-09-19 12:57:34 -07:00
|
|
|
}
|
|
|
|
|
2011-02-22 18:47:10 -07:00
|
|
|
static int xfrm4_get_tos(const struct flowi *fl)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2011-03-12 00:42:11 -07:00
|
|
|
return IPTOS_RT_MASK & fl->u.ip4.flowi4_tos; /* Strip ECN bits */
|
2007-12-11 10:32:34 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-12-20 21:41:12 -07:00
|
|
|
static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
|
|
|
|
int nfheader_len)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2010-03-01 19:51:56 -07:00
|
|
|
static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
|
2011-02-22 18:48:57 -07:00
|
|
|
const struct flowi *fl)
|
2007-12-11 10:32:34 -07:00
|
|
|
{
|
|
|
|
struct rtable *rt = (struct rtable *)xdst->route;
|
2011-03-12 00:42:11 -07:00
|
|
|
const struct flowi4 *fl4 = &fl->u.ip4;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2011-10-22 14:58:20 -07:00
|
|
|
xdst->u.rt.rt_iif = fl4->flowi4_iif;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2007-12-11 10:32:34 -07:00
|
|
|
xdst->u.dst.dev = dev;
|
|
|
|
dev_hold(dev);
|
2007-02-06 15:27:32 -07:00
|
|
|
|
2007-12-11 10:32:34 -07:00
|
|
|
/* Sheit... I remember I did this right. Apparently,
|
|
|
|
* it was magically lost, so this code needs audit */
|
2012-07-17 14:44:26 -07:00
|
|
|
xdst->u.rt.rt_is_input = rt->rt_is_input;
|
2007-12-11 10:32:34 -07:00
|
|
|
xdst->u.rt.rt_flags = rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST |
|
|
|
|
RTCF_LOCAL);
|
|
|
|
xdst->u.rt.rt_type = rt->rt_type;
|
|
|
|
xdst->u.rt.rt_gateway = rt->rt_gateway;
|
2012-07-10 06:58:42 -07:00
|
|
|
xdst->u.rt.rt_pmtu = rt->rt_pmtu;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void
|
2007-12-12 11:44:16 -07:00
|
|
|
_decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2011-04-21 21:53:02 -07:00
|
|
|
const struct iphdr *iph = ip_hdr(skb);
|
2007-04-10 20:50:43 -07:00
|
|
|
u8 *xprth = skb_network_header(skb) + iph->ihl * 4;
|
2011-03-12 00:42:11 -07:00
|
|
|
struct flowi4 *fl4 = &fl->u.ip4;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2011-03-12 00:42:11 -07:00
|
|
|
memset(fl4, 0, sizeof(struct flowi4));
|
|
|
|
fl4->flowi4_mark = skb->mark;
|
2010-07-02 00:47:55 -07:00
|
|
|
|
2011-06-21 20:33:34 -07:00
|
|
|
if (!ip_is_fragment(iph)) {
|
2005-04-16 15:20:36 -07:00
|
|
|
switch (iph->protocol) {
|
|
|
|
case IPPROTO_UDP:
|
2006-11-27 12:10:57 -07:00
|
|
|
case IPPROTO_UDPLITE:
|
2005-04-16 15:20:36 -07:00
|
|
|
case IPPROTO_TCP:
|
|
|
|
case IPPROTO_SCTP:
|
2005-12-19 15:03:46 -07:00
|
|
|
case IPPROTO_DCCP:
|
2009-07-02 09:57:23 -07:00
|
|
|
if (xprth + 4 < skb->data ||
|
|
|
|
pskb_may_pull(skb, xprth + 4 - skb->data)) {
|
2006-11-08 01:20:21 -07:00
|
|
|
__be16 *ports = (__be16 *)xprth;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2011-03-12 01:00:33 -07:00
|
|
|
fl4->fl4_sport = ports[!!reverse];
|
|
|
|
fl4->fl4_dport = ports[!reverse];
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_ICMP:
|
|
|
|
if (pskb_may_pull(skb, xprth + 2 - skb->data)) {
|
|
|
|
u8 *icmp = xprth;
|
|
|
|
|
2011-03-12 01:00:33 -07:00
|
|
|
fl4->fl4_icmp_type = icmp[0];
|
|
|
|
fl4->fl4_icmp_code = icmp[1];
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_ESP:
|
|
|
|
if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
|
2006-09-27 18:49:07 -07:00
|
|
|
__be32 *ehdr = (__be32 *)xprth;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2011-03-12 01:00:33 -07:00
|
|
|
fl4->fl4_ipsec_spi = ehdr[0];
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_AH:
|
|
|
|
if (pskb_may_pull(skb, xprth + 8 - skb->data)) {
|
2012-04-14 18:34:41 -07:00
|
|
|
__be32 *ah_hdr = (__be32 *)xprth;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2011-03-12 01:00:33 -07:00
|
|
|
fl4->fl4_ipsec_spi = ah_hdr[1];
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_COMP:
|
|
|
|
if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
|
2006-09-27 18:49:07 -07:00
|
|
|
__be16 *ipcomp_hdr = (__be16 *)xprth;
|
2005-04-16 15:20:36 -07:00
|
|
|
|
2011-03-12 01:00:33 -07:00
|
|
|
fl4->fl4_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
break;
|
2010-11-02 21:41:38 -07:00
|
|
|
|
|
|
|
case IPPROTO_GRE:
|
|
|
|
if (pskb_may_pull(skb, xprth + 12 - skb->data)) {
|
|
|
|
__be16 *greflags = (__be16 *)xprth;
|
|
|
|
__be32 *gre_hdr = (__be32 *)xprth;
|
|
|
|
|
|
|
|
if (greflags[0] & GRE_KEY) {
|
|
|
|
if (greflags[0] & GRE_CSUM)
|
|
|
|
gre_hdr++;
|
2011-03-12 01:00:33 -07:00
|
|
|
fl4->fl4_gre_key = gre_hdr[1];
|
2010-11-02 21:41:38 -07:00
|
|
|
}
|
|
|
|
}
|
|
|
|
break;
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
default:
|
2011-03-12 01:00:33 -07:00
|
|
|
fl4->fl4_ipsec_spi = 0;
|
2005-04-16 15:20:36 -07:00
|
|
|
break;
|
2007-04-20 17:09:22 -07:00
|
|
|
}
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
2011-03-12 00:42:11 -07:00
|
|
|
fl4->flowi4_proto = iph->protocol;
|
|
|
|
fl4->daddr = reverse ? iph->saddr : iph->daddr;
|
|
|
|
fl4->saddr = reverse ? iph->daddr : iph->saddr;
|
|
|
|
fl4->flowi4_tos = iph->tos;
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2008-01-18 04:56:57 -07:00
|
|
|
static inline int xfrm4_garbage_collect(struct dst_ops *ops)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2010-01-24 23:47:53 -07:00
|
|
|
struct net *net = container_of(ops, struct net, xfrm.xfrm4_dst_ops);
|
|
|
|
|
|
|
|
xfrm4_policy_afinfo.garbage_collect(net);
|
2010-10-07 23:37:34 -07:00
|
|
|
return (dst_entries_get_slow(ops) > ops->gc_thresh * 2);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2012-07-17 03:29:28 -07:00
|
|
|
static void xfrm4_update_pmtu(struct dst_entry *dst, struct sock *sk,
|
|
|
|
struct sk_buff *skb, u32 mtu)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
struct dst_entry *path = xdst->route;
|
|
|
|
|
2012-07-17 03:29:28 -07:00
|
|
|
path->ops->update_pmtu(path, sk, skb, mtu);
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|
2012-07-17 03:29:28 -07:00
|
|
|
static void xfrm4_redirect(struct dst_entry *dst, struct sock *sk,
|
|
|
|
struct sk_buff *skb)
|
2012-07-11 21:27:49 -07:00
|
|
|
{
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
struct dst_entry *path = xdst->route;
|
|
|
|
|
2012-07-17 03:29:28 -07:00
|
|
|
path->ops->redirect(path, sk, skb);
|
2012-07-11 21:27:49 -07:00
|
|
|
}
|
|
|
|
|
2005-05-03 16:27:10 -07:00
|
|
|
static void xfrm4_dst_destroy(struct dst_entry *dst)
|
|
|
|
{
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
|
net: Implement read-only protection and COW'ing of metrics.
Routing metrics are now copy-on-write.
Initially a route entry points it's metrics at a read-only location.
If a routing table entry exists, it will point there. Else it will
point at the all zero metric place-holder called 'dst_default_metrics'.
The writeability state of the metrics is stored in the low bits of the
metrics pointer, we have two bits left to spare if we want to store
more states.
For the initial implementation, COW is implemented simply via kmalloc.
However future enhancements will change this to place the writable
metrics somewhere else, in order to increase sharing. Very likely
this "somewhere else" will be the inetpeer cache.
Note also that this means that metrics updates may transiently fail
if we cannot COW the metrics successfully.
But even by itself, this patch should decrease memory usage and
increase cache locality especially for routing workloads. In those
cases the read-only metric copies stay in place and never get written
to.
TCP workloads where metrics get updated, and those rare cases where
PMTU triggers occur, will take a very slight performance hit. But
that hit will be alleviated when the long-term writable metrics
move to a more sharable location.
Since the metrics storage went from a u32 array of RTAX_MAX entries to
what is essentially a pointer, some retooling of the dst_entry layout
was necessary.
Most importantly, we need to preserve the alignment of the reference
count so that it doesn't share cache lines with the read-mostly state,
as per Eric Dumazet's alignment assertion checks.
The only non-trivial bit here is the move of the 'flags' member into
the writeable cacheline. This is OK since we are always accessing the
flags around the same moment when we made a modification to the
reference count.
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-01-26 21:51:05 -07:00
|
|
|
dst_destroy_metrics_generic(dst);
|
|
|
|
|
2005-05-03 16:27:10 -07:00
|
|
|
xfrm_dst_destroy(xdst);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void xfrm4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
|
|
|
|
int unregister)
|
|
|
|
{
|
|
|
|
if (!unregister)
|
|
|
|
return;
|
|
|
|
|
|
|
|
xfrm_dst_ifdown(dst, dev);
|
|
|
|
}
|
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static struct dst_ops xfrm4_dst_ops = {
|
|
|
|
.family = AF_INET,
|
2009-02-01 01:45:17 -07:00
|
|
|
.protocol = cpu_to_be16(ETH_P_IP),
|
2005-04-16 15:20:36 -07:00
|
|
|
.gc = xfrm4_garbage_collect,
|
|
|
|
.update_pmtu = xfrm4_update_pmtu,
|
2012-07-11 21:27:49 -07:00
|
|
|
.redirect = xfrm4_redirect,
|
net: Implement read-only protection and COW'ing of metrics.
Routing metrics are now copy-on-write.
Initially a route entry points it's metrics at a read-only location.
If a routing table entry exists, it will point there. Else it will
point at the all zero metric place-holder called 'dst_default_metrics'.
The writeability state of the metrics is stored in the low bits of the
metrics pointer, we have two bits left to spare if we want to store
more states.
For the initial implementation, COW is implemented simply via kmalloc.
However future enhancements will change this to place the writable
metrics somewhere else, in order to increase sharing. Very likely
this "somewhere else" will be the inetpeer cache.
Note also that this means that metrics updates may transiently fail
if we cannot COW the metrics successfully.
But even by itself, this patch should decrease memory usage and
increase cache locality especially for routing workloads. In those
cases the read-only metric copies stay in place and never get written
to.
TCP workloads where metrics get updated, and those rare cases where
PMTU triggers occur, will take a very slight performance hit. But
that hit will be alleviated when the long-term writable metrics
move to a more sharable location.
Since the metrics storage went from a u32 array of RTAX_MAX entries to
what is essentially a pointer, some retooling of the dst_entry layout
was necessary.
Most importantly, we need to preserve the alignment of the reference
count so that it doesn't share cache lines with the read-mostly state,
as per Eric Dumazet's alignment assertion checks.
The only non-trivial bit here is the move of the 'flags' member into
the writeable cacheline. This is OK since we are always accessing the
flags around the same moment when we made a modification to the
reference count.
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-01-26 21:51:05 -07:00
|
|
|
.cow_metrics = dst_cow_metrics_generic,
|
2005-05-03 16:27:10 -07:00
|
|
|
.destroy = xfrm4_dst_destroy,
|
|
|
|
.ifdown = xfrm4_dst_ifdown,
|
2007-11-13 22:43:11 -07:00
|
|
|
.local_out = __ip_local_out,
|
2005-04-16 15:20:36 -07:00
|
|
|
.gc_thresh = 1024,
|
|
|
|
};
|
|
|
|
|
|
|
|
static struct xfrm_policy_afinfo xfrm4_policy_afinfo = {
|
|
|
|
.family = AF_INET,
|
|
|
|
.dst_ops = &xfrm4_dst_ops,
|
|
|
|
.dst_lookup = xfrm4_dst_lookup,
|
2006-09-19 12:57:34 -07:00
|
|
|
.get_saddr = xfrm4_get_saddr,
|
2005-04-16 15:20:36 -07:00
|
|
|
.decode_session = _decode_session4,
|
2007-12-11 10:32:34 -07:00
|
|
|
.get_tos = xfrm4_get_tos,
|
2007-12-20 21:41:12 -07:00
|
|
|
.init_path = xfrm4_init_path,
|
2007-12-11 10:32:34 -07:00
|
|
|
.fill_dst = xfrm4_fill_dst,
|
2011-03-01 15:59:04 -07:00
|
|
|
.blackhole_route = ipv4_blackhole_route,
|
2005-04-16 15:20:36 -07:00
|
|
|
};
|
|
|
|
|
2009-08-04 20:18:33 -07:00
|
|
|
#ifdef CONFIG_SYSCTL
|
2009-07-27 01:22:46 -07:00
|
|
|
static struct ctl_table xfrm4_policy_table[] = {
|
|
|
|
{
|
|
|
|
.procname = "xfrm4_gc_thresh",
|
2010-01-24 23:47:53 -07:00
|
|
|
.data = &init_net.xfrm.xfrm4_dst_ops.gc_thresh,
|
2009-07-27 01:22:46 -07:00
|
|
|
.maxlen = sizeof(int),
|
|
|
|
.mode = 0644,
|
|
|
|
.proc_handler = proc_dointvec,
|
|
|
|
},
|
|
|
|
{ }
|
|
|
|
};
|
|
|
|
|
|
|
|
static struct ctl_table_header *sysctl_hdr;
|
2009-08-04 20:18:33 -07:00
|
|
|
#endif
|
2009-07-27 01:22:46 -07:00
|
|
|
|
2005-04-16 15:20:36 -07:00
|
|
|
static void __init xfrm4_policy_init(void)
|
|
|
|
{
|
|
|
|
xfrm_policy_register_afinfo(&xfrm4_policy_afinfo);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __exit xfrm4_policy_fini(void)
|
|
|
|
{
|
2009-08-04 20:18:33 -07:00
|
|
|
#ifdef CONFIG_SYSCTL
|
2009-07-27 01:22:46 -07:00
|
|
|
if (sysctl_hdr)
|
|
|
|
unregister_net_sysctl_table(sysctl_hdr);
|
2009-08-04 20:18:33 -07:00
|
|
|
#endif
|
2005-04-16 15:20:36 -07:00
|
|
|
xfrm_policy_unregister_afinfo(&xfrm4_policy_afinfo);
|
|
|
|
}
|
|
|
|
|
2009-07-30 18:52:15 -07:00
|
|
|
void __init xfrm4_init(int rt_max_size)
|
2005-04-16 15:20:36 -07:00
|
|
|
{
|
2009-07-30 18:52:15 -07:00
|
|
|
/*
|
|
|
|
* Select a default value for the gc_thresh based on the main route
|
|
|
|
* table hash size. It seems to me the worst case scenario is when
|
|
|
|
* we have ipsec operating in transport mode, in which we create a
|
|
|
|
* dst_entry per socket. The xfrm gc algorithm starts trying to remove
|
|
|
|
* entries at gc_thresh, and prevents new allocations as 2*gc_thresh
|
|
|
|
* so lets set an initial xfrm gc_thresh value at the rt_max_size/2.
|
|
|
|
* That will let us store an ipsec connection per route table entry,
|
|
|
|
* and start cleaning when were 1/2 full
|
|
|
|
*/
|
|
|
|
xfrm4_dst_ops.gc_thresh = rt_max_size/2;
|
2010-10-07 23:37:34 -07:00
|
|
|
dst_entries_init(&xfrm4_dst_ops);
|
2010-01-24 23:47:53 -07:00
|
|
|
|
|
|
|
xfrm4_state_init();
|
|
|
|
xfrm4_policy_init();
|
2009-08-04 20:18:33 -07:00
|
|
|
#ifdef CONFIG_SYSCTL
|
2012-04-19 06:44:49 -07:00
|
|
|
sysctl_hdr = register_net_sysctl(&init_net, "net/ipv4",
|
|
|
|
xfrm4_policy_table);
|
2009-08-04 20:18:33 -07:00
|
|
|
#endif
|
2005-04-16 15:20:36 -07:00
|
|
|
}
|
|
|
|
|