2005-04-16 22:20:36 +00:00
|
|
|
/*
|
|
|
|
* xfrm6_policy.c: based on xfrm4_policy.c
|
|
|
|
*
|
|
|
|
* Authors:
|
|
|
|
* Mitsuru KANDA @USAGI
|
2014-08-24 20:53:10 +00:00
|
|
|
* Kazunori MIYAZAWA @USAGI
|
|
|
|
* Kunihiro Ishiguro <kunihiro@ipinfusion.com>
|
|
|
|
* IPv6 support
|
|
|
|
* YOSHIFUJI Hideaki
|
|
|
|
* Split up af-specific portion
|
2007-02-09 14:24:49 +00:00
|
|
|
*
|
2005-04-16 22:20:36 +00:00
|
|
|
*/
|
|
|
|
|
2007-11-14 05:37:28 +00:00
|
|
|
#include <linux/err.h>
|
|
|
|
#include <linux/kernel.h>
|
2005-05-03 23:27:10 +00:00
|
|
|
#include <linux/netdevice.h>
|
|
|
|
#include <net/addrconf.h>
|
2007-11-14 05:35:32 +00:00
|
|
|
#include <net/dst.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
#include <net/xfrm.h>
|
|
|
|
#include <net/ip.h>
|
|
|
|
#include <net/ipv6.h>
|
|
|
|
#include <net/ip6_route.h>
|
2015-09-30 03:07:13 +00:00
|
|
|
#include <net/l3mdev.h>
|
2012-10-29 16:23:10 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6_MIP6)
|
2006-08-24 03:39:03 +00:00
|
|
|
#include <net/mip6.h>
|
|
|
|
#endif
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2015-08-10 22:58:11 +00:00
|
|
|
static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos, int oif,
|
2011-02-24 05:14:45 +00:00
|
|
|
const xfrm_address_t *saddr,
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-10 17:11:33 +00:00
|
|
|
const xfrm_address_t *daddr,
|
|
|
|
u32 mark)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2011-03-12 07:42:11 +00:00
|
|
|
struct flowi6 fl6;
|
2007-11-14 05:37:28 +00:00
|
|
|
struct dst_entry *dst;
|
|
|
|
int err;
|
|
|
|
|
2011-03-12 07:42:11 +00:00
|
|
|
memset(&fl6, 0, sizeof(fl6));
|
2016-08-15 02:52:56 +00:00
|
|
|
fl6.flowi6_oif = l3mdev_master_ifindex_by_index(net, oif);
|
2015-10-05 14:32:51 +00:00
|
|
|
fl6.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF;
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-10 17:11:33 +00:00
|
|
|
fl6.flowi6_mark = mark;
|
2011-03-12 07:42:11 +00:00
|
|
|
memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
|
2007-11-14 05:37:28 +00:00
|
|
|
if (saddr)
|
2011-03-12 07:42:11 +00:00
|
|
|
memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
|
2007-11-14 05:37:28 +00:00
|
|
|
|
2011-03-12 21:22:43 +00:00
|
|
|
dst = ip6_route_output(net, NULL, &fl6);
|
2007-11-14 05:37:28 +00:00
|
|
|
|
|
|
|
err = dst->error;
|
|
|
|
if (dst->error) {
|
2006-10-17 05:10:05 +00:00
|
|
|
dst_release(dst);
|
2007-11-14 05:37:28 +00:00
|
|
|
dst = ERR_PTR(err);
|
|
|
|
}
|
|
|
|
|
|
|
|
return dst;
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
2015-08-10 22:58:11 +00:00
|
|
|
static int xfrm6_get_saddr(struct net *net, int oif,
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-10 17:11:33 +00:00
|
|
|
xfrm_address_t *saddr, xfrm_address_t *daddr,
|
|
|
|
u32 mark)
|
2006-09-19 19:57:34 +00:00
|
|
|
{
|
2007-11-14 05:37:28 +00:00
|
|
|
struct dst_entry *dst;
|
2008-08-14 22:33:21 +00:00
|
|
|
struct net_device *dev;
|
2007-11-14 05:37:28 +00:00
|
|
|
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-10 17:11:33 +00:00
|
|
|
dst = xfrm6_dst_lookup(net, 0, oif, NULL, daddr, mark);
|
2007-11-14 05:37:28 +00:00
|
|
|
if (IS_ERR(dst))
|
|
|
|
return -EHOSTUNREACH;
|
|
|
|
|
2008-08-14 22:33:21 +00:00
|
|
|
dev = ip6_dst_idev(dst)->dev;
|
2015-03-29 14:59:24 +00:00
|
|
|
ipv6_dev_get_saddr(dev_net(dev), dev, &daddr->in6, 0, &saddr->in6);
|
2007-11-14 05:37:28 +00:00
|
|
|
dst_release(dst);
|
|
|
|
return 0;
|
2006-09-19 19:57:34 +00:00
|
|
|
}
|
|
|
|
|
2011-02-23 01:47:10 +00:00
|
|
|
static int xfrm6_get_tos(const struct flowi *fl)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2007-12-11 17:32:34 +00:00
|
|
|
return 0;
|
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2007-12-21 04:41:12 +00:00
|
|
|
static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
|
|
|
|
int nfheader_len)
|
|
|
|
{
|
|
|
|
if (dst->ops->family == AF_INET6) {
|
2014-08-24 20:53:10 +00:00
|
|
|
struct rt6_info *rt = (struct rt6_info *)dst;
|
2015-05-23 03:56:01 +00:00
|
|
|
path->path_cookie = rt6_get_cookie(rt);
|
2007-12-21 04:41:12 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
path->u.rt6.rt6i_nfheader_len = nfheader_len;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2010-03-02 02:51:56 +00:00
|
|
|
static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
|
2011-02-23 01:48:57 +00:00
|
|
|
const struct flowi *fl)
|
2007-12-11 17:32:34 +00:00
|
|
|
{
|
2014-08-24 20:53:10 +00:00
|
|
|
struct rt6_info *rt = (struct rt6_info *)xdst->route;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2007-12-11 17:32:34 +00:00
|
|
|
xdst->u.dst.dev = dev;
|
|
|
|
dev_hold(dev);
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2010-04-21 23:25:30 +00:00
|
|
|
xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
|
2013-05-09 22:40:00 +00:00
|
|
|
if (!xdst->u.rt6.rt6i_idev) {
|
|
|
|
dev_put(dev);
|
2007-12-11 17:32:34 +00:00
|
|
|
return -ENODEV;
|
2013-05-09 22:40:00 +00:00
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2007-12-11 17:32:34 +00:00
|
|
|
/* Sheit... I remember I did this right. Apparently,
|
|
|
|
* it was magically lost, so this code needs audit */
|
|
|
|
xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
|
|
|
|
RTF_LOCAL);
|
|
|
|
xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
|
|
|
|
xdst->u.rt6.rt6i_node = rt->rt6i_node;
|
2015-05-23 03:56:01 +00:00
|
|
|
xdst->route_cookie = rt6_get_cookie(rt);
|
2007-12-11 17:32:34 +00:00
|
|
|
xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
|
|
|
|
xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
|
|
|
|
xdst->u.rt6.rt6i_src = rt->rt6i_src;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void
|
2007-12-12 18:44:16 +00:00
|
|
|
_decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2011-03-12 07:42:11 +00:00
|
|
|
struct flowi6 *fl6 = &fl->u.ip6;
|
2008-11-02 04:12:07 +00:00
|
|
|
int onlyproto = 0;
|
2011-04-22 04:53:02 +00:00
|
|
|
const struct ipv6hdr *hdr = ipv6_hdr(skb);
|
2014-12-04 08:46:20 +00:00
|
|
|
u16 offset = sizeof(*hdr);
|
2006-04-18 21:46:52 +00:00
|
|
|
struct ipv6_opt_hdr *exthdr;
|
2007-04-11 03:50:43 +00:00
|
|
|
const unsigned char *nh = skb_network_header(skb);
|
2014-12-08 06:56:18 +00:00
|
|
|
u16 nhoff = IP6CB(skb)->nhoff;
|
2013-10-30 10:16:28 +00:00
|
|
|
int oif = 0;
|
2014-12-08 06:56:18 +00:00
|
|
|
u8 nexthdr;
|
|
|
|
|
|
|
|
if (!nhoff)
|
|
|
|
nhoff = offsetof(struct ipv6hdr, nexthdr);
|
|
|
|
|
|
|
|
nexthdr = nh[nhoff];
|
2013-10-30 10:16:28 +00:00
|
|
|
|
2015-09-30 03:07:13 +00:00
|
|
|
if (skb_dst(skb))
|
2016-09-10 19:09:57 +00:00
|
|
|
oif = skb_dst(skb)->dev->ifindex;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2011-03-12 07:42:11 +00:00
|
|
|
memset(fl6, 0, sizeof(struct flowi6));
|
|
|
|
fl6->flowi6_mark = skb->mark;
|
2013-10-30 10:16:28 +00:00
|
|
|
fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
|
2010-07-02 07:47:55 +00:00
|
|
|
|
2011-11-21 03:39:03 +00:00
|
|
|
fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
|
|
|
|
fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2009-07-02 16:59:49 +00:00
|
|
|
while (nh + offset + 1 < skb->data ||
|
|
|
|
pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
|
2007-04-11 03:50:43 +00:00
|
|
|
nh = skb_network_header(skb);
|
|
|
|
exthdr = (struct ipv6_opt_hdr *)(nh + offset);
|
2006-04-18 21:46:52 +00:00
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
switch (nexthdr) {
|
2008-11-02 04:12:07 +00:00
|
|
|
case NEXTHDR_FRAGMENT:
|
|
|
|
onlyproto = 1;
|
2017-10-16 21:36:52 +00:00
|
|
|
/* fall through */
|
2005-04-16 22:20:36 +00:00
|
|
|
case NEXTHDR_ROUTING:
|
|
|
|
case NEXTHDR_HOP:
|
|
|
|
case NEXTHDR_DEST:
|
|
|
|
offset += ipv6_optlen(exthdr);
|
|
|
|
nexthdr = exthdr->nexthdr;
|
2007-04-11 03:50:43 +00:00
|
|
|
exthdr = (struct ipv6_opt_hdr *)(nh + offset);
|
2005-04-16 22:20:36 +00:00
|
|
|
break;
|
|
|
|
|
|
|
|
case IPPROTO_UDP:
|
2006-11-27 19:10:57 +00:00
|
|
|
case IPPROTO_UDPLITE:
|
2005-04-16 22:20:36 +00:00
|
|
|
case IPPROTO_TCP:
|
|
|
|
case IPPROTO_SCTP:
|
2005-12-19 22:03:46 +00:00
|
|
|
case IPPROTO_DCCP:
|
2009-07-02 16:59:49 +00:00
|
|
|
if (!onlyproto && (nh + offset + 4 < skb->data ||
|
|
|
|
pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
|
2014-10-22 09:09:53 +00:00
|
|
|
__be16 *ports;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2014-10-22 09:09:53 +00:00
|
|
|
nh = skb_network_header(skb);
|
|
|
|
ports = (__be16 *)(nh + offset);
|
2011-03-12 21:36:19 +00:00
|
|
|
fl6->fl6_sport = ports[!!reverse];
|
|
|
|
fl6->fl6_dport = ports[!reverse];
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
2011-03-12 07:42:11 +00:00
|
|
|
fl6->flowi6_proto = nexthdr;
|
2005-04-16 22:20:36 +00:00
|
|
|
return;
|
|
|
|
|
|
|
|
case IPPROTO_ICMPV6:
|
2015-09-11 07:57:20 +00:00
|
|
|
if (!onlyproto && (nh + offset + 2 < skb->data ||
|
|
|
|
pskb_may_pull(skb, nh + offset + 2 - skb->data))) {
|
2014-10-22 09:09:53 +00:00
|
|
|
u8 *icmp;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2014-10-22 09:09:53 +00:00
|
|
|
nh = skb_network_header(skb);
|
|
|
|
icmp = (u8 *)(nh + offset);
|
2011-03-12 21:36:19 +00:00
|
|
|
fl6->fl6_icmp_type = icmp[0];
|
|
|
|
fl6->fl6_icmp_code = icmp[1];
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
2011-03-12 07:42:11 +00:00
|
|
|
fl6->flowi6_proto = nexthdr;
|
2005-04-16 22:20:36 +00:00
|
|
|
return;
|
|
|
|
|
2012-10-29 16:23:10 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6_MIP6)
|
2006-08-24 03:39:03 +00:00
|
|
|
case IPPROTO_MH:
|
2015-02-04 14:31:10 +00:00
|
|
|
offset += ipv6_optlen(exthdr);
|
2015-09-11 07:57:20 +00:00
|
|
|
if (!onlyproto && (nh + offset + 3 < skb->data ||
|
|
|
|
pskb_may_pull(skb, nh + offset + 3 - skb->data))) {
|
2006-08-24 03:39:03 +00:00
|
|
|
struct ip6_mh *mh;
|
|
|
|
|
2014-10-22 09:09:53 +00:00
|
|
|
nh = skb_network_header(skb);
|
|
|
|
mh = (struct ip6_mh *)(nh + offset);
|
2011-03-12 21:36:19 +00:00
|
|
|
fl6->fl6_mh_type = mh->ip6mh_type;
|
2006-08-24 03:39:03 +00:00
|
|
|
}
|
2011-03-12 07:42:11 +00:00
|
|
|
fl6->flowi6_proto = nexthdr;
|
2006-08-24 03:39:03 +00:00
|
|
|
return;
|
|
|
|
#endif
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
/* XXX Why are there these headers? */
|
|
|
|
case IPPROTO_AH:
|
|
|
|
case IPPROTO_ESP:
|
|
|
|
case IPPROTO_COMP:
|
|
|
|
default:
|
2011-03-12 21:36:19 +00:00
|
|
|
fl6->fl6_ipsec_spi = 0;
|
2011-03-12 07:42:11 +00:00
|
|
|
fl6->flowi6_proto = nexthdr;
|
2005-04-16 22:20:36 +00:00
|
|
|
return;
|
2007-04-21 00:09:22 +00:00
|
|
|
}
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-07-17 10:29:28 +00:00
|
|
|
static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
|
|
|
|
struct sk_buff *skb, u32 mtu)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
struct dst_entry *path = xdst->route;
|
|
|
|
|
2012-07-17 10:29:28 +00:00
|
|
|
path->ops->update_pmtu(path, sk, skb, mtu);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
2012-07-17 10:29:28 +00:00
|
|
|
static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
|
|
|
|
struct sk_buff *skb)
|
2012-07-12 07:25:15 +00:00
|
|
|
{
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
struct dst_entry *path = xdst->route;
|
|
|
|
|
2012-07-17 10:29:28 +00:00
|
|
|
path->ops->redirect(path, sk, skb);
|
2012-07-12 07:25:15 +00:00
|
|
|
}
|
|
|
|
|
2005-05-03 23:27:10 +00:00
|
|
|
static void xfrm6_dst_destroy(struct dst_entry *dst)
|
|
|
|
{
|
|
|
|
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
|
|
|
|
|
|
|
|
if (likely(xdst->u.rt6.rt6i_idev))
|
|
|
|
in6_dev_put(xdst->u.rt6.rt6i_idev);
|
net: Implement read-only protection and COW'ing of metrics.
Routing metrics are now copy-on-write.
Initially a route entry points it's metrics at a read-only location.
If a routing table entry exists, it will point there. Else it will
point at the all zero metric place-holder called 'dst_default_metrics'.
The writeability state of the metrics is stored in the low bits of the
metrics pointer, we have two bits left to spare if we want to store
more states.
For the initial implementation, COW is implemented simply via kmalloc.
However future enhancements will change this to place the writable
metrics somewhere else, in order to increase sharing. Very likely
this "somewhere else" will be the inetpeer cache.
Note also that this means that metrics updates may transiently fail
if we cannot COW the metrics successfully.
But even by itself, this patch should decrease memory usage and
increase cache locality especially for routing workloads. In those
cases the read-only metric copies stay in place and never get written
to.
TCP workloads where metrics get updated, and those rare cases where
PMTU triggers occur, will take a very slight performance hit. But
that hit will be alleviated when the long-term writable metrics
move to a more sharable location.
Since the metrics storage went from a u32 array of RTAX_MAX entries to
what is essentially a pointer, some retooling of the dst_entry layout
was necessary.
Most importantly, we need to preserve the alignment of the reference
count so that it doesn't share cache lines with the read-mostly state,
as per Eric Dumazet's alignment assertion checks.
The only non-trivial bit here is the move of the 'flags' member into
the writeable cacheline. This is OK since we are always accessing the
flags around the same moment when we made a modification to the
reference count.
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-01-27 04:51:05 +00:00
|
|
|
dst_destroy_metrics_generic(dst);
|
2005-05-03 23:27:10 +00:00
|
|
|
xfrm_dst_destroy(xdst);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
|
|
|
|
int unregister)
|
|
|
|
{
|
|
|
|
struct xfrm_dst *xdst;
|
|
|
|
|
|
|
|
if (!unregister)
|
|
|
|
return;
|
|
|
|
|
|
|
|
xdst = (struct xfrm_dst *)dst;
|
|
|
|
if (xdst->u.rt6.rt6i_idev->dev == dev) {
|
2007-12-07 08:38:10 +00:00
|
|
|
struct inet6_dev *loopback_idev =
|
2008-03-25 12:47:49 +00:00
|
|
|
in6_dev_get(dev_net(dev)->loopback_dev);
|
2005-05-03 23:27:10 +00:00
|
|
|
BUG_ON(!loopback_idev);
|
|
|
|
|
|
|
|
do {
|
|
|
|
in6_dev_put(xdst->u.rt6.rt6i_idev);
|
|
|
|
xdst->u.rt6.rt6i_idev = loopback_idev;
|
|
|
|
in6_dev_hold(loopback_idev);
|
|
|
|
xdst = (struct xfrm_dst *)xdst->u.dst.child;
|
|
|
|
} while (xdst->u.dst.xfrm);
|
|
|
|
|
|
|
|
__in6_dev_put(loopback_idev);
|
|
|
|
}
|
|
|
|
|
|
|
|
xfrm_dst_ifdown(dst, dev);
|
|
|
|
}
|
|
|
|
|
2015-10-29 13:51:16 +00:00
|
|
|
static struct dst_ops xfrm6_dst_ops_template = {
|
2005-04-16 22:20:36 +00:00
|
|
|
.family = AF_INET6,
|
|
|
|
.update_pmtu = xfrm6_update_pmtu,
|
2012-07-12 07:25:15 +00:00
|
|
|
.redirect = xfrm6_redirect,
|
net: Implement read-only protection and COW'ing of metrics.
Routing metrics are now copy-on-write.
Initially a route entry points it's metrics at a read-only location.
If a routing table entry exists, it will point there. Else it will
point at the all zero metric place-holder called 'dst_default_metrics'.
The writeability state of the metrics is stored in the low bits of the
metrics pointer, we have two bits left to spare if we want to store
more states.
For the initial implementation, COW is implemented simply via kmalloc.
However future enhancements will change this to place the writable
metrics somewhere else, in order to increase sharing. Very likely
this "somewhere else" will be the inetpeer cache.
Note also that this means that metrics updates may transiently fail
if we cannot COW the metrics successfully.
But even by itself, this patch should decrease memory usage and
increase cache locality especially for routing workloads. In those
cases the read-only metric copies stay in place and never get written
to.
TCP workloads where metrics get updated, and those rare cases where
PMTU triggers occur, will take a very slight performance hit. But
that hit will be alleviated when the long-term writable metrics
move to a more sharable location.
Since the metrics storage went from a u32 array of RTAX_MAX entries to
what is essentially a pointer, some retooling of the dst_entry layout
was necessary.
Most importantly, we need to preserve the alignment of the reference
count so that it doesn't share cache lines with the read-mostly state,
as per Eric Dumazet's alignment assertion checks.
The only non-trivial bit here is the move of the 'flags' member into
the writeable cacheline. This is OK since we are always accessing the
flags around the same moment when we made a modification to the
reference count.
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-01-27 04:51:05 +00:00
|
|
|
.cow_metrics = dst_cow_metrics_generic,
|
2005-05-03 23:27:10 +00:00
|
|
|
.destroy = xfrm6_dst_destroy,
|
|
|
|
.ifdown = xfrm6_dst_ifdown,
|
2007-11-14 05:43:11 +00:00
|
|
|
.local_out = __ip6_local_out,
|
2017-07-17 11:57:20 +00:00
|
|
|
.gc_thresh = 32768,
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
2017-02-07 14:00:19 +00:00
|
|
|
static const struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
|
2015-10-29 13:51:16 +00:00
|
|
|
.dst_ops = &xfrm6_dst_ops_template,
|
2005-04-16 22:20:36 +00:00
|
|
|
.dst_lookup = xfrm6_dst_lookup,
|
2014-08-24 20:53:10 +00:00
|
|
|
.get_saddr = xfrm6_get_saddr,
|
2005-04-16 22:20:36 +00:00
|
|
|
.decode_session = _decode_session6,
|
2007-12-11 17:32:34 +00:00
|
|
|
.get_tos = xfrm6_get_tos,
|
2007-12-21 04:41:12 +00:00
|
|
|
.init_path = xfrm6_init_path,
|
2007-12-11 17:32:34 +00:00
|
|
|
.fill_dst = xfrm6_fill_dst,
|
2011-03-01 22:59:04 +00:00
|
|
|
.blackhole_route = ip6_blackhole_route,
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
2007-12-07 08:42:11 +00:00
|
|
|
static int __init xfrm6_policy_init(void)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2017-02-07 14:00:17 +00:00
|
|
|
return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo, AF_INET6);
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static void xfrm6_policy_fini(void)
|
|
|
|
{
|
|
|
|
xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
|
|
|
|
}
|
|
|
|
|
2009-08-05 03:32:16 +00:00
|
|
|
#ifdef CONFIG_SYSCTL
|
2009-07-27 08:22:46 +00:00
|
|
|
static struct ctl_table xfrm6_policy_table[] = {
|
|
|
|
{
|
|
|
|
.procname = "xfrm6_gc_thresh",
|
2014-08-24 20:53:10 +00:00
|
|
|
.data = &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
|
|
|
|
.maxlen = sizeof(int),
|
|
|
|
.mode = 0644,
|
2009-07-27 08:22:46 +00:00
|
|
|
.proc_handler = proc_dointvec,
|
|
|
|
},
|
|
|
|
{ }
|
|
|
|
};
|
|
|
|
|
2015-10-29 13:51:16 +00:00
|
|
|
static int __net_init xfrm6_net_sysctl_init(struct net *net)
|
2013-02-06 09:46:33 +00:00
|
|
|
{
|
|
|
|
struct ctl_table *table;
|
|
|
|
struct ctl_table_header *hdr;
|
|
|
|
|
|
|
|
table = xfrm6_policy_table;
|
|
|
|
if (!net_eq(net, &init_net)) {
|
|
|
|
table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
|
|
|
|
if (!table)
|
|
|
|
goto err_alloc;
|
|
|
|
|
|
|
|
table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
|
|
|
|
}
|
|
|
|
|
|
|
|
hdr = register_net_sysctl(net, "net/ipv6", table);
|
|
|
|
if (!hdr)
|
|
|
|
goto err_reg;
|
|
|
|
|
|
|
|
net->ipv6.sysctl.xfrm6_hdr = hdr;
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
err_reg:
|
|
|
|
if (!net_eq(net, &init_net))
|
|
|
|
kfree(table);
|
|
|
|
err_alloc:
|
|
|
|
return -ENOMEM;
|
|
|
|
}
|
|
|
|
|
2015-10-29 13:51:16 +00:00
|
|
|
static void __net_exit xfrm6_net_sysctl_exit(struct net *net)
|
2013-02-06 09:46:33 +00:00
|
|
|
{
|
|
|
|
struct ctl_table *table;
|
|
|
|
|
2015-03-29 13:00:04 +00:00
|
|
|
if (!net->ipv6.sysctl.xfrm6_hdr)
|
2013-02-06 09:46:33 +00:00
|
|
|
return;
|
|
|
|
|
|
|
|
table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
|
|
|
|
unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
|
|
|
|
if (!net_eq(net, &init_net))
|
|
|
|
kfree(table);
|
|
|
|
}
|
2015-10-29 13:51:16 +00:00
|
|
|
#else /* CONFIG_SYSCTL */
|
2016-06-16 13:59:25 +00:00
|
|
|
static inline int xfrm6_net_sysctl_init(struct net *net)
|
2015-10-29 13:51:16 +00:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-06-16 13:59:25 +00:00
|
|
|
static inline void xfrm6_net_sysctl_exit(struct net *net)
|
2015-10-29 13:51:16 +00:00
|
|
|
{
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
|
|
|
static int __net_init xfrm6_net_init(struct net *net)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
memcpy(&net->xfrm.xfrm6_dst_ops, &xfrm6_dst_ops_template,
|
|
|
|
sizeof(xfrm6_dst_ops_template));
|
|
|
|
ret = dst_entries_init(&net->xfrm.xfrm6_dst_ops);
|
|
|
|
if (ret)
|
|
|
|
return ret;
|
|
|
|
|
|
|
|
ret = xfrm6_net_sysctl_init(net);
|
|
|
|
if (ret)
|
|
|
|
dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
static void __net_exit xfrm6_net_exit(struct net *net)
|
|
|
|
{
|
|
|
|
xfrm6_net_sysctl_exit(net);
|
|
|
|
dst_entries_destroy(&net->xfrm.xfrm6_dst_ops);
|
|
|
|
}
|
2013-02-06 09:46:33 +00:00
|
|
|
|
|
|
|
static struct pernet_operations xfrm6_net_ops = {
|
|
|
|
.init = xfrm6_net_init,
|
|
|
|
.exit = xfrm6_net_exit,
|
|
|
|
};
|
2009-07-27 08:22:46 +00:00
|
|
|
|
2007-12-07 08:42:11 +00:00
|
|
|
int __init xfrm6_init(void)
|
2005-04-16 22:20:36 +00:00
|
|
|
{
|
2007-12-07 08:42:11 +00:00
|
|
|
int ret;
|
2012-11-15 08:00:18 +00:00
|
|
|
|
2010-01-25 06:47:53 +00:00
|
|
|
ret = xfrm6_policy_init();
|
2015-10-29 13:51:16 +00:00
|
|
|
if (ret)
|
2010-01-25 06:47:53 +00:00
|
|
|
goto out;
|
|
|
|
ret = xfrm6_state_init();
|
|
|
|
if (ret)
|
|
|
|
goto out_policy;
|
|
|
|
|
2014-03-14 06:28:07 +00:00
|
|
|
ret = xfrm6_protocol_init();
|
|
|
|
if (ret)
|
|
|
|
goto out_state;
|
|
|
|
|
2013-02-06 09:46:33 +00:00
|
|
|
register_pernet_subsys(&xfrm6_net_ops);
|
2007-12-07 08:42:11 +00:00
|
|
|
out:
|
|
|
|
return ret;
|
2014-03-14 06:28:07 +00:00
|
|
|
out_state:
|
|
|
|
xfrm6_state_fini();
|
2007-12-07 08:42:11 +00:00
|
|
|
out_policy:
|
|
|
|
xfrm6_policy_fini();
|
|
|
|
goto out;
|
2005-04-16 22:20:36 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
void xfrm6_fini(void)
|
|
|
|
{
|
2013-02-06 09:46:33 +00:00
|
|
|
unregister_pernet_subsys(&xfrm6_net_ops);
|
2014-03-14 06:28:07 +00:00
|
|
|
xfrm6_protocol_fini();
|
2005-04-16 22:20:36 +00:00
|
|
|
xfrm6_policy_fini();
|
|
|
|
xfrm6_state_fini();
|
|
|
|
}
|