1/*
2 * xfrm6_state.c: based on xfrm4_state.c
3 *
4 * Authors:
5 *	Mitsuru KANDA @USAGI
6 *	Kazunori MIYAZAWA @USAGI
7 *	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 *		IPv6 support
9 *	YOSHIFUJI Hideaki @USAGI
10 *		Split up af-specific portion
11 *
12 */
13
14#include <net/xfrm.h>
15#include <linux/pfkeyv2.h>
16#include <linux/ipsec.h>
17#include <linux/netfilter_ipv6.h>
18#include <linux/export.h>
19#include <net/dsfield.h>
20#include <net/ipv6.h>
21#include <net/addrconf.h>
22
23static void
24__xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
25{
26	const struct flowi6 *fl6 = &fl->u.ip6;
27
28	/* Initialize temporary selector matching only
29	 * to current session. */
30	*(struct in6_addr *)&sel->daddr = fl6->daddr;
31	*(struct in6_addr *)&sel->saddr = fl6->saddr;
32	sel->dport = xfrm_flowi_dport(fl, &fl6->uli);
33	sel->dport_mask = htons(0xffff);
34	sel->sport = xfrm_flowi_sport(fl, &fl6->uli);
35	sel->sport_mask = htons(0xffff);
36	sel->family = AF_INET6;
37	sel->prefixlen_d = 128;
38	sel->prefixlen_s = 128;
39	sel->proto = fl6->flowi6_proto;
40	sel->ifindex = fl6->flowi6_oif;
41}
42
43static void
44xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl,
45		   const xfrm_address_t *daddr, const xfrm_address_t *saddr)
46{
47	x->id = tmpl->id;
48	if (ipv6_addr_any((struct in6_addr *)&x->id.daddr))
49		memcpy(&x->id.daddr, daddr, sizeof(x->sel.daddr));
50	memcpy(&x->props.saddr, &tmpl->saddr, sizeof(x->props.saddr));
51	if (ipv6_addr_any((struct in6_addr *)&x->props.saddr))
52		memcpy(&x->props.saddr, saddr, sizeof(x->props.saddr));
53	x->props.mode = tmpl->mode;
54	x->props.reqid = tmpl->reqid;
55	x->props.family = AF_INET6;
56}
57
58/* distribution counting sort function for xfrm_state and xfrm_tmpl */
59static int
60__xfrm6_sort(void **dst, void **src, int n, int (*cmp)(void *p), int maxclass)
61{
62	int i;
63	int class[XFRM_MAX_DEPTH];
64	int count[maxclass];
65
66	memset(count, 0, sizeof(count));
67
68	for (i = 0; i < n; i++) {
69		int c;
70		class[i] = c = cmp(src[i]);
71		count[c]++;
72	}
73
74	for (i = 2; i < maxclass; i++)
75		count[i] += count[i - 1];
76
77	for (i = 0; i < n; i++) {
78		dst[count[class[i] - 1]++] = src[i];
79		src[i] = NULL;
80	}
81
82	return 0;
83}
84
85/*
86 * Rule for xfrm_state:
87 *
88 * rule 1: select IPsec transport except AH
89 * rule 2: select MIPv6 RO or inbound trigger
90 * rule 3: select IPsec transport AH
91 * rule 4: select IPsec tunnel
92 * rule 5: others
93 */
94static int __xfrm6_state_sort_cmp(void *p)
95{
96	struct xfrm_state *v = p;
97
98	switch (v->props.mode) {
99	case XFRM_MODE_TRANSPORT:
100		if (v->id.proto != IPPROTO_AH)
101			return 1;
102		else
103			return 3;
104#if IS_ENABLED(CONFIG_IPV6_MIP6)
105	case XFRM_MODE_ROUTEOPTIMIZATION:
106	case XFRM_MODE_IN_TRIGGER:
107		return 2;
108#endif
109	case XFRM_MODE_TUNNEL:
110	case XFRM_MODE_BEET:
111		return 4;
112	}
113	return 5;
114}
115
116static int
117__xfrm6_state_sort(struct xfrm_state **dst, struct xfrm_state **src, int n)
118{
119	return __xfrm6_sort((void **)dst, (void **)src, n,
120			    __xfrm6_state_sort_cmp, 6);
121}
122
123/*
124 * Rule for xfrm_tmpl:
125 *
126 * rule 1: select IPsec transport
127 * rule 2: select MIPv6 RO or inbound trigger
128 * rule 3: select IPsec tunnel
129 * rule 4: others
130 */
131static int __xfrm6_tmpl_sort_cmp(void *p)
132{
133	struct xfrm_tmpl *v = p;
134	switch (v->mode) {
135	case XFRM_MODE_TRANSPORT:
136		return 1;
137#if IS_ENABLED(CONFIG_IPV6_MIP6)
138	case XFRM_MODE_ROUTEOPTIMIZATION:
139	case XFRM_MODE_IN_TRIGGER:
140		return 2;
141#endif
142	case XFRM_MODE_TUNNEL:
143	case XFRM_MODE_BEET:
144		return 3;
145	}
146	return 4;
147}
148
149static int
150__xfrm6_tmpl_sort(struct xfrm_tmpl **dst, struct xfrm_tmpl **src, int n)
151{
152	return __xfrm6_sort((void **)dst, (void **)src, n,
153			    __xfrm6_tmpl_sort_cmp, 5);
154}
155
156int xfrm6_extract_header(struct sk_buff *skb)
157{
158	struct ipv6hdr *iph = ipv6_hdr(skb);
159
160	XFRM_MODE_SKB_CB(skb)->ihl = sizeof(*iph);
161	XFRM_MODE_SKB_CB(skb)->id = 0;
162	XFRM_MODE_SKB_CB(skb)->frag_off = htons(IP_DF);
163	XFRM_MODE_SKB_CB(skb)->tos = ipv6_get_dsfield(iph);
164	XFRM_MODE_SKB_CB(skb)->ttl = iph->hop_limit;
165	XFRM_MODE_SKB_CB(skb)->optlen = 0;
166	memcpy(XFRM_MODE_SKB_CB(skb)->flow_lbl, iph->flow_lbl,
167	       sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));
168
169	return 0;
170}
171
172static struct xfrm_state_afinfo xfrm6_state_afinfo = {
173	.family			= AF_INET6,
174	.proto			= IPPROTO_IPV6,
175	.eth_proto		= htons(ETH_P_IPV6),
176	.owner			= THIS_MODULE,
177	.init_tempsel		= __xfrm6_init_tempsel,
178	.init_temprop		= xfrm6_init_temprop,
179	.tmpl_sort		= __xfrm6_tmpl_sort,
180	.state_sort		= __xfrm6_state_sort,
181	.output			= xfrm6_output,
182	.output_finish		= xfrm6_output_finish,
183	.extract_input		= xfrm6_extract_input,
184	.extract_output		= xfrm6_extract_output,
185	.transport_finish	= xfrm6_transport_finish,
186	.local_error		= xfrm6_local_error,
187};
188
189int __init xfrm6_state_init(void)
190{
191	return xfrm_state_register_afinfo(&xfrm6_state_afinfo);
192}
193
194void xfrm6_state_fini(void)
195{
196	xfrm_state_unregister_afinfo(&xfrm6_state_afinfo);
197}
198
199