xfrm6_mode_tunnel.c 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189
  1. /*
  2. * xfrm6_mode_tunnel.c - Tunnel mode encapsulation for IPv6.
  3. *
  4. * Copyright (C) 2002 USAGI/WIDE Project
  5. * Copyright (c) 2004-2006 Herbert Xu <herbert@gondor.apana.org.au>
  6. */
  7. #include <linux/gfp.h>
  8. #include <linux/init.h>
  9. #include <linux/kernel.h>
  10. #include <linux/module.h>
  11. #include <linux/skbuff.h>
  12. #include <linux/stringify.h>
  13. #include <net/dsfield.h>
  14. #include <net/dst.h>
  15. #include <net/inet_ecn.h>
  16. #include <net/ip6_route.h>
  17. #include <net/ipv6.h>
  18. #include <net/xfrm.h>
  19. /* Informational hook. The decap is still done here. */
  20. static struct xfrm_tunnel_notifier __rcu *rcv_notify_handlers __read_mostly;
  21. static DEFINE_MUTEX(xfrm6_mode_tunnel_input_mutex);
  22. int xfrm6_mode_tunnel_input_register(struct xfrm_tunnel_notifier *handler)
  23. {
  24. struct xfrm_tunnel_notifier __rcu **pprev;
  25. struct xfrm_tunnel_notifier *t;
  26. int ret = -EEXIST;
  27. int priority = handler->priority;
  28. mutex_lock(&xfrm6_mode_tunnel_input_mutex);
  29. for (pprev = &rcv_notify_handlers;
  30. (t = rcu_dereference_protected(*pprev,
  31. lockdep_is_held(&xfrm6_mode_tunnel_input_mutex))) != NULL;
  32. pprev = &t->next) {
  33. if (t->priority > priority)
  34. break;
  35. if (t->priority == priority)
  36. goto err;
  37. }
  38. handler->next = *pprev;
  39. rcu_assign_pointer(*pprev, handler);
  40. ret = 0;
  41. err:
  42. mutex_unlock(&xfrm6_mode_tunnel_input_mutex);
  43. return ret;
  44. }
  45. EXPORT_SYMBOL_GPL(xfrm6_mode_tunnel_input_register);
  46. int xfrm6_mode_tunnel_input_deregister(struct xfrm_tunnel_notifier *handler)
  47. {
  48. struct xfrm_tunnel_notifier __rcu **pprev;
  49. struct xfrm_tunnel_notifier *t;
  50. int ret = -ENOENT;
  51. mutex_lock(&xfrm6_mode_tunnel_input_mutex);
  52. for (pprev = &rcv_notify_handlers;
  53. (t = rcu_dereference_protected(*pprev,
  54. lockdep_is_held(&xfrm6_mode_tunnel_input_mutex))) != NULL;
  55. pprev = &t->next) {
  56. if (t == handler) {
  57. *pprev = handler->next;
  58. ret = 0;
  59. break;
  60. }
  61. }
  62. mutex_unlock(&xfrm6_mode_tunnel_input_mutex);
  63. synchronize_net();
  64. return ret;
  65. }
  66. EXPORT_SYMBOL_GPL(xfrm6_mode_tunnel_input_deregister);
  67. static inline void ipip6_ecn_decapsulate(struct sk_buff *skb)
  68. {
  69. const struct ipv6hdr *outer_iph = ipv6_hdr(skb);
  70. struct ipv6hdr *inner_iph = ipipv6_hdr(skb);
  71. if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph)))
  72. IP6_ECN_set_ce(inner_iph);
  73. }
  74. /* Add encapsulation header.
  75. *
  76. * The top IP header will be constructed per RFC 2401.
  77. */
  78. static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
  79. {
  80. struct dst_entry *dst = skb_dst(skb);
  81. struct ipv6hdr *top_iph;
  82. int dsfield;
  83. skb_set_network_header(skb, -x->props.header_len);
  84. skb->mac_header = skb->network_header +
  85. offsetof(struct ipv6hdr, nexthdr);
  86. skb->transport_header = skb->network_header + sizeof(*top_iph);
  87. top_iph = ipv6_hdr(skb);
  88. top_iph->version = 6;
  89. memcpy(top_iph->flow_lbl, XFRM_MODE_SKB_CB(skb)->flow_lbl,
  90. sizeof(top_iph->flow_lbl));
  91. top_iph->nexthdr = xfrm_af2proto(skb_dst(skb)->ops->family);
  92. if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP)
  93. dsfield = 0;
  94. else
  95. dsfield = XFRM_MODE_SKB_CB(skb)->tos;
  96. dsfield = INET_ECN_encapsulate(dsfield, XFRM_MODE_SKB_CB(skb)->tos);
  97. if (x->props.flags & XFRM_STATE_NOECN)
  98. dsfield &= ~INET_ECN_MASK;
  99. ipv6_change_dsfield(top_iph, 0, dsfield);
  100. top_iph->hop_limit = ip6_dst_hoplimit(dst->child);
  101. top_iph->saddr = *(struct in6_addr *)&x->props.saddr;
  102. top_iph->daddr = *(struct in6_addr *)&x->id.daddr;
  103. return 0;
  104. }
  105. #define for_each_input_rcu(head, handler) \
  106. for (handler = rcu_dereference(head); \
  107. handler != NULL; \
  108. handler = rcu_dereference(handler->next))
  109. static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
  110. {
  111. struct xfrm_tunnel_notifier *handler;
  112. int err = -EINVAL;
  113. if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
  114. goto out;
  115. if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
  116. goto out;
  117. for_each_input_rcu(rcv_notify_handlers, handler)
  118. handler->handler(skb);
  119. err = skb_unclone(skb, GFP_ATOMIC);
  120. if (err)
  121. goto out;
  122. if (x->props.flags & XFRM_STATE_DECAP_DSCP)
  123. ipv6_copy_dscp(ipv6_get_dsfield(ipv6_hdr(skb)),
  124. ipipv6_hdr(skb));
  125. if (!(x->props.flags & XFRM_STATE_NOECN))
  126. ipip6_ecn_decapsulate(skb);
  127. skb_reset_network_header(skb);
  128. skb_mac_header_rebuild(skb);
  129. err = 0;
  130. out:
  131. return err;
  132. }
  133. static struct xfrm_mode xfrm6_tunnel_mode = {
  134. .input2 = xfrm6_mode_tunnel_input,
  135. .input = xfrm_prepare_input,
  136. .output2 = xfrm6_mode_tunnel_output,
  137. .output = xfrm6_prepare_output,
  138. .owner = THIS_MODULE,
  139. .encap = XFRM_MODE_TUNNEL,
  140. .flags = XFRM_MODE_FLAG_TUNNEL,
  141. };
  142. static int __init xfrm6_mode_tunnel_init(void)
  143. {
  144. return xfrm_register_mode(&xfrm6_tunnel_mode, AF_INET6);
  145. }
  146. static void __exit xfrm6_mode_tunnel_exit(void)
  147. {
  148. int err;
  149. err = xfrm_unregister_mode(&xfrm6_tunnel_mode, AF_INET6);
  150. BUG_ON(err);
  151. }
  152. module_init(xfrm6_mode_tunnel_init);
  153. module_exit(xfrm6_mode_tunnel_exit);
  154. MODULE_LICENSE("GPL");
  155. MODULE_ALIAS_XFRM_MODE(AF_INET6, XFRM_MODE_TUNNEL);