xfrm6_input.c 4.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247
  1. /*
  2. * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
  3. *
  4. * Authors:
  5. * Mitsuru KANDA @USAGI
  6. * Kazunori MIYAZAWA @USAGI
  7. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  8. * YOSHIFUJI Hideaki @USAGI
  9. * IPv6 support
  10. */
  11. #include <linux/module.h>
  12. #include <linux/string.h>
  13. #include <linux/netfilter.h>
  14. #include <linux/netfilter_ipv6.h>
  15. #include <net/ipv6.h>
  16. #include <net/xfrm.h>
  17. int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi)
  18. {
  19. int err;
  20. __be32 seq;
  21. struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
  22. struct xfrm_state *x;
  23. int xfrm_nr = 0;
  24. int decaps = 0;
  25. int nexthdr;
  26. unsigned int nhoff;
  27. nhoff = IP6CB(skb)->nhoff;
  28. nexthdr = skb->nh.raw[nhoff];
  29. seq = 0;
  30. if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0)
  31. goto drop;
  32. do {
  33. struct ipv6hdr *iph = skb->nh.ipv6h;
  34. if (xfrm_nr == XFRM_MAX_DEPTH)
  35. goto drop;
  36. x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,
  37. nexthdr != IPPROTO_IPIP ? nexthdr : IPPROTO_IPV6, AF_INET6);
  38. if (x == NULL)
  39. goto drop;
  40. spin_lock(&x->lock);
  41. if (unlikely(x->km.state != XFRM_STATE_VALID))
  42. goto drop_unlock;
  43. if (x->props.replay_window && xfrm_replay_check(x, seq))
  44. goto drop_unlock;
  45. if (xfrm_state_check_expire(x))
  46. goto drop_unlock;
  47. nexthdr = x->type->input(x, skb);
  48. if (nexthdr <= 0)
  49. goto drop_unlock;
  50. skb->nh.raw[nhoff] = nexthdr;
  51. if (x->props.replay_window)
  52. xfrm_replay_advance(x, seq);
  53. x->curlft.bytes += skb->len;
  54. x->curlft.packets++;
  55. spin_unlock(&x->lock);
  56. xfrm_vec[xfrm_nr++] = x;
  57. if (x->mode->input(x, skb))
  58. goto drop;
  59. if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */
  60. decaps = 1;
  61. break;
  62. }
  63. if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0)
  64. goto drop;
  65. } while (!err);
  66. /* Allocate new secpath or COW existing one. */
  67. if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
  68. struct sec_path *sp;
  69. sp = secpath_dup(skb->sp);
  70. if (!sp)
  71. goto drop;
  72. if (skb->sp)
  73. secpath_put(skb->sp);
  74. skb->sp = sp;
  75. }
  76. if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
  77. goto drop;
  78. memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
  79. xfrm_nr * sizeof(xfrm_vec[0]));
  80. skb->sp->len += xfrm_nr;
  81. skb->ip_summed = CHECKSUM_NONE;
  82. nf_reset(skb);
  83. if (decaps) {
  84. dst_release(skb->dst);
  85. skb->dst = NULL;
  86. netif_rx(skb);
  87. return -1;
  88. } else {
  89. #ifdef CONFIG_NETFILTER
  90. skb->nh.ipv6h->payload_len = htons(skb->len);
  91. __skb_push(skb, skb->data - skb->nh.raw);
  92. NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
  93. ip6_rcv_finish);
  94. return -1;
  95. #else
  96. return 1;
  97. #endif
  98. }
  99. drop_unlock:
  100. spin_unlock(&x->lock);
  101. xfrm_state_put(x);
  102. drop:
  103. while (--xfrm_nr >= 0)
  104. xfrm_state_put(xfrm_vec[xfrm_nr]);
  105. kfree_skb(skb);
  106. return -1;
  107. }
  108. EXPORT_SYMBOL(xfrm6_rcv_spi);
  109. int xfrm6_rcv(struct sk_buff **pskb)
  110. {
  111. return xfrm6_rcv_spi(*pskb, 0);
  112. }
  113. int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
  114. xfrm_address_t *saddr, u8 proto)
  115. {
  116. struct xfrm_state *x = NULL;
  117. int wildcard = 0;
  118. struct in6_addr any;
  119. xfrm_address_t *xany;
  120. struct xfrm_state *xfrm_vec_one = NULL;
  121. int nh = 0;
  122. int i = 0;
  123. ipv6_addr_set(&any, 0, 0, 0, 0);
  124. xany = (xfrm_address_t *)&any;
  125. for (i = 0; i < 3; i++) {
  126. xfrm_address_t *dst, *src;
  127. switch (i) {
  128. case 0:
  129. dst = daddr;
  130. src = saddr;
  131. break;
  132. case 1:
  133. /* lookup state with wild-card source address */
  134. wildcard = 1;
  135. dst = daddr;
  136. src = xany;
  137. break;
  138. case 2:
  139. default:
  140. /* lookup state with wild-card addresses */
  141. wildcard = 1; /* XXX */
  142. dst = xany;
  143. src = xany;
  144. break;
  145. }
  146. x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6);
  147. if (!x)
  148. continue;
  149. spin_lock(&x->lock);
  150. if (wildcard) {
  151. if ((x->props.flags & XFRM_STATE_WILDRECV) == 0) {
  152. spin_unlock(&x->lock);
  153. xfrm_state_put(x);
  154. x = NULL;
  155. continue;
  156. }
  157. }
  158. if (unlikely(x->km.state != XFRM_STATE_VALID)) {
  159. spin_unlock(&x->lock);
  160. xfrm_state_put(x);
  161. x = NULL;
  162. continue;
  163. }
  164. if (xfrm_state_check_expire(x)) {
  165. spin_unlock(&x->lock);
  166. xfrm_state_put(x);
  167. x = NULL;
  168. continue;
  169. }
  170. nh = x->type->input(x, skb);
  171. if (nh <= 0) {
  172. spin_unlock(&x->lock);
  173. xfrm_state_put(x);
  174. x = NULL;
  175. continue;
  176. }
  177. x->curlft.bytes += skb->len;
  178. x->curlft.packets++;
  179. spin_unlock(&x->lock);
  180. xfrm_vec_one = x;
  181. break;
  182. }
  183. if (!xfrm_vec_one)
  184. goto drop;
  185. /* Allocate new secpath or COW existing one. */
  186. if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
  187. struct sec_path *sp;
  188. sp = secpath_dup(skb->sp);
  189. if (!sp)
  190. goto drop;
  191. if (skb->sp)
  192. secpath_put(skb->sp);
  193. skb->sp = sp;
  194. }
  195. if (1 + skb->sp->len > XFRM_MAX_DEPTH)
  196. goto drop;
  197. skb->sp->xvec[skb->sp->len] = xfrm_vec_one;
  198. skb->sp->len ++;
  199. return 1;
  200. drop:
  201. if (xfrm_vec_one)
  202. xfrm_state_put(xfrm_vec_one);
  203. return -1;
  204. }