xfrm4_input.c 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168
  1. /*
  2. * xfrm4_input.c
  3. *
  4. * Changes:
  5. * YOSHIFUJI Hideaki @USAGI
  6. * Split up af-specific portion
  7. * Derek Atkins <derek@ihtfp.com>
  8. * Add Encapsulation support
  9. *
  10. */
  11. #include <linux/module.h>
  12. #include <linux/string.h>
  13. #include <linux/netfilter.h>
  14. #include <linux/netfilter_ipv4.h>
  15. #include <net/ip.h>
  16. #include <net/xfrm.h>
  17. int xfrm4_rcv(struct sk_buff *skb)
  18. {
  19. return xfrm4_rcv_encap(skb, 0);
  20. }
  21. EXPORT_SYMBOL(xfrm4_rcv);
  22. static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
  23. {
  24. switch (nexthdr) {
  25. case IPPROTO_IPIP:
  26. case IPPROTO_IPV6:
  27. *spi = skb->nh.iph->saddr;
  28. *seq = 0;
  29. return 0;
  30. }
  31. return xfrm_parse_spi(skb, nexthdr, spi, seq);
  32. }
  33. #ifdef CONFIG_NETFILTER
  34. static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)
  35. {
  36. struct iphdr *iph = skb->nh.iph;
  37. if (skb->dst == NULL) {
  38. if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
  39. skb->dev))
  40. goto drop;
  41. }
  42. return dst_input(skb);
  43. drop:
  44. kfree_skb(skb);
  45. return NET_RX_DROP;
  46. }
  47. #endif
  48. int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
  49. {
  50. int err;
  51. __be32 spi, seq;
  52. struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
  53. struct xfrm_state *x;
  54. int xfrm_nr = 0;
  55. int decaps = 0;
  56. if ((err = xfrm4_parse_spi(skb, skb->nh.iph->protocol, &spi, &seq)) != 0)
  57. goto drop;
  58. do {
  59. struct iphdr *iph = skb->nh.iph;
  60. if (xfrm_nr == XFRM_MAX_DEPTH)
  61. goto drop;
  62. x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,
  63. iph->protocol != IPPROTO_IPV6 ? iph->protocol : IPPROTO_IPIP, AF_INET);
  64. if (x == NULL)
  65. goto drop;
  66. spin_lock(&x->lock);
  67. if (unlikely(x->km.state != XFRM_STATE_VALID))
  68. goto drop_unlock;
  69. if ((x->encap ? x->encap->encap_type : 0) != encap_type)
  70. goto drop_unlock;
  71. if (x->props.replay_window && xfrm_replay_check(x, seq))
  72. goto drop_unlock;
  73. if (xfrm_state_check_expire(x))
  74. goto drop_unlock;
  75. if (x->type->input(x, skb))
  76. goto drop_unlock;
  77. /* only the first xfrm gets the encap type */
  78. encap_type = 0;
  79. if (x->props.replay_window)
  80. xfrm_replay_advance(x, seq);
  81. x->curlft.bytes += skb->len;
  82. x->curlft.packets++;
  83. spin_unlock(&x->lock);
  84. xfrm_vec[xfrm_nr++] = x;
  85. if (x->mode->input(x, skb))
  86. goto drop;
  87. if (x->props.mode == XFRM_MODE_TUNNEL) {
  88. decaps = 1;
  89. break;
  90. }
  91. if ((err = xfrm_parse_spi(skb, skb->nh.iph->protocol, &spi, &seq)) < 0)
  92. goto drop;
  93. } while (!err);
  94. /* Allocate new secpath or COW existing one. */
  95. if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
  96. struct sec_path *sp;
  97. sp = secpath_dup(skb->sp);
  98. if (!sp)
  99. goto drop;
  100. if (skb->sp)
  101. secpath_put(skb->sp);
  102. skb->sp = sp;
  103. }
  104. if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
  105. goto drop;
  106. memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
  107. xfrm_nr * sizeof(xfrm_vec[0]));
  108. skb->sp->len += xfrm_nr;
  109. nf_reset(skb);
  110. if (decaps) {
  111. dst_release(skb->dst);
  112. skb->dst = NULL;
  113. netif_rx(skb);
  114. return 0;
  115. } else {
  116. #ifdef CONFIG_NETFILTER
  117. __skb_push(skb, skb->data - skb->nh.raw);
  118. skb->nh.iph->tot_len = htons(skb->len);
  119. ip_send_check(skb->nh.iph);
  120. NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
  121. xfrm4_rcv_encap_finish);
  122. return 0;
  123. #else
  124. return -skb->nh.iph->protocol;
  125. #endif
  126. }
  127. drop_unlock:
  128. spin_unlock(&x->lock);
  129. xfrm_state_put(x);
  130. drop:
  131. while (--xfrm_nr >= 0)
  132. xfrm_state_put(xfrm_vec[xfrm_nr]);
  133. kfree_skb(skb);
  134. return 0;
  135. }