From patchwork Fri Sep 24 19:22:45 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arnaud Ebalard X-Patchwork-Id: 65680 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 2D580B710E for ; Sat, 25 Sep 2010 05:23:30 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757720Ab0IXTWQ (ORCPT ); Fri, 24 Sep 2010 15:22:16 -0400 Received: from copper.chdir.org ([88.191.97.87]:55462 "EHLO copper.chdir.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757804Ab0IXTWO (ORCPT ); Fri, 24 Sep 2010 15:22:14 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=natisbad.org; s=mail; h=From:To:Cc:Subject:References:Date: Message-ID:MIME-Version:Content-Type; bh=qF/o7R7+KB8xcpEWvy0ckfm AnFLw50JQ9cKXfVUkv88=; b=SsXlGTLcCkhsVn8RjRgt+meEb1kaUcMAt7b+R5s hvL1EGIIXiZzsGpYjR+7XO23VnaCf6aVsjMZ2WGqSAv6S0mOxW0Jp2xBKaRG0LTM zld3IjrXCaKaTUQ7vnVl+DYkWbEWGUpBpzFoBDo/ACJ6mPWA3kpEu4nvDUUq+9xu bol8= Received: from [2001:7a8:78df:2:20d:93ff:fe55:8f79] (helo=small.ssi.corp) by copper.chdir.org with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.69) (envelope-from ) id 1OzDqW-0008PZ-Lg; Fri, 24 Sep 2010 21:22:13 +0200 X-Hashcash: 1:20:100924:davem@davemloft.net::RGz+L46ozAPuKV6B:0000000000000000000000000000000000000000002PUQ X-Hashcash: 1:20:100924:eric.dumazet@gmail.com::esBZOGlzPk+y8axY:0000000000000000000000000000000000000001xx8 X-Hashcash: 1:20:100924:herbert@gondor.apana.org.au::wZ1OKIAmpWWXcLqE:00000000000000000000000000000000000Bp6 X-Hashcash: 1:20:100924:yoshfuji@linux-ipv6.org::kHWE+KmBWsyD4yrH:000000000000000000000000000000000000003khw X-Hashcash: 1:20:100924:netdev@vger.kernel.org::2cmoDzDzzXkV1NvW:0000000000000000000000000000000000000001A+m From: arno@natisbad.org (Arnaud Ebalard) To: "David S. Miller" , Eric Dumazet , Herbert Xu , Hideaki YOSHIFUJI Cc: netdev@vger.kernel.org Subject: [PATCH net-next-2.6 2/5] XFRM, IPv6: Introduce receive sockopts to access IRO remapped src/dst addresses References: <87bp7nrlvy.fsf@small.ssi.corp> X-PGP-Key-URL: http://natisbad.org/arno@natisbad.org.asc X-Fingerprint: D3A5 B68A 839B 38A5 815A 781B B77C 0748 A7AE 341B Date: Fri, 24 Sep 2010 21:22:45 +0200 Message-ID: <87zkv7q73u.fsf@small.ssi.corp> User-Agent: Gnus/5.110009 (No Gnus v0.9) Emacs/23.1.50 (gnu/linux) MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This patch introduces IRO recv sockopts, in order for userland processes (e.g. UMIP) to access on-wire source or destination addresses found in incoming (IPsec-protected) packets as they were before remapping by IRO. The socket options are respectively IPV6_RECVIROSRC and IPV6_RECVIRODST. Basically, the two recv socket options are similar in their purpose to their generic RH2/HAO counterparts defined in RFC 3542 (IPV6_RECVIROSRC <-> IPV6_RECVDSTOPTS, IPV6_RECVIRODST <-> IPV6_RECVRTHDR). They differ on the following aspects: - IRO reporting sockopts only work on incoming IPsec-protected packets Userspace will never get IRO remapped address report for common (non protected) packets. - The receiver gets the original source/desination address (IRO remapping) from its IPsec stack. - as IRO sockopts only deal with addresses, no specific structure is defined, i.e. struct in6_addr is used to pass info. As we only interact with IPsec protected packets, struct sec_path is used to carry information (addresses) for incoming packets that have undergone remapping process. Signed-off-by: Arnaud Ebalard --- include/linux/in6.h | 7 +++++++ include/linux/ipv6.h | 4 +++- include/net/xfrm.h | 5 +++++ net/ipv6/datagram.c | 18 ++++++++++++++++++ net/ipv6/ipv6_sockglue.c | 26 ++++++++++++++++++++++++++ 5 files changed, 59 insertions(+), 1 deletions(-) diff --git a/include/linux/in6.h b/include/linux/in6.h index c4bf46f..52a98ab 100644 --- a/include/linux/in6.h +++ b/include/linux/in6.h @@ -283,4 +283,11 @@ struct in6_flowlabel_req { * MRT6_PIM 208 * (reserved) 209 */ + +/* IRO (IPsec Route Optimization) sockopts */ +#define IPV6_RECVIROSRC 74 +#define IPV6_IROSRC 75 +#define IPV6_RECVIRODST 76 +#define IPV6_IRODST 77 + #endif diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h index e62683b..55289ee 100644 --- a/include/linux/ipv6.h +++ b/include/linux/ipv6.h @@ -341,7 +341,9 @@ struct ipv6_pinfo { odstopts:1, rxflow:1, rxtclass:1, - rxpmtu:1; + rxpmtu:1, + irosrc:1, + irodst:1; } bits; __u16 all; } rxopt; diff --git a/include/net/xfrm.h b/include/net/xfrm.h index fc8f36d..f35bade 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -909,6 +909,11 @@ struct sec_path { atomic_t refcnt; int len; struct xfrm_state *xvec[XFRM_MAX_DEPTH]; + +#ifdef CONFIG_XFRM_SUB_POLICY + struct in6_addr irosrc; + struct in6_addr irodst; +#endif }; static inline struct sec_path * diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index ef371aa..2952c9e 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include @@ -504,6 +505,23 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb) put_cmsg(msg, SOL_IPV6, IPV6_HOPOPTS, (ptr[1]+1)<<3, ptr); } +#ifdef CONFIG_XFRM_SUB_POLICY + /* If access to IRO-remapped source or destination address has been + * requested and it has indeed been remapped, provide the on-wire + * address to userland */ + if (skb_sec_path(skb)) { + struct sec_path *sp = skb_sec_path(skb); + + if (np->rxopt.bits.irosrc && !ipv6_addr_any(&sp->irosrc)) + put_cmsg(msg, SOL_IPV6, IPV6_IROSRC, + sizeof(sp->irosrc), &sp->irosrc); + + if (np->rxopt.bits.irodst && !ipv6_addr_any(&sp->irodst)) + put_cmsg(msg, SOL_IPV6, IPV6_IRODST, + sizeof(sp->irodst), &sp->irodst); + } +#endif + if (opt->lastopt && (np->rxopt.bits.dstopts || np->rxopt.bits.srcrt)) { /* diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index a7f66bc..722a49f 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -302,6 +302,22 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, retv = 0; break; +#ifdef CONFIG_XFRM_SUB_POLICY + case IPV6_RECVIROSRC: + if (optlen < sizeof(int)) + goto e_inval; + np->rxopt.bits.irosrc = valbool; + retv = 0; + break; + + case IPV6_RECVIRODST: + if (optlen < sizeof(int)) + goto e_inval; + np->rxopt.bits.irodst = valbool; + retv = 0; + break; +#endif + case IPV6_2292DSTOPTS: if (optlen < sizeof(int)) goto e_inval; @@ -1056,6 +1072,16 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, val = np->rxopt.bits.dstopts; break; +#ifdef CONFIG_XFRM_SUB_POLICY + case IPV6_RECVIROSRC: + val = np->rxopt.bits.irosrc; + break; + + case IPV6_RECVIRODST: + val = np->rxopt.bits.irodst; + break; +#endif + case IPV6_2292DSTOPTS: val = np->rxopt.bits.odstopts; break;