xfrm6_input.c 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
  4. *
  5. * Authors:
  6. * Mitsuru KANDA @USAGI
  7. * Kazunori MIYAZAWA @USAGI
  8. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  9. * YOSHIFUJI Hideaki @USAGI
  10. * IPv6 support
  11. */
  12. #include <linux/module.h>
  13. #include <linux/string.h>
  14. #include <linux/netfilter.h>
  15. #include <linux/netfilter_ipv6.h>
  16. #include <net/ipv6.h>
  17. #include <net/xfrm.h>
  18. int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
  19. struct ip6_tnl *t)
  20. {
  21. XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
  22. XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
  23. XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
  24. return xfrm_input(skb, nexthdr, spi, 0);
  25. }
  26. EXPORT_SYMBOL(xfrm6_rcv_spi);
  27. static int xfrm6_transport_finish2(struct net *net, struct sock *sk,
  28. struct sk_buff *skb)
  29. {
  30. if (xfrm_trans_queue(skb, ip6_rcv_finish)) {
  31. kfree_skb(skb);
  32. return NET_RX_DROP;
  33. }
  34. return 0;
  35. }
  36. int xfrm6_transport_finish(struct sk_buff *skb, int async)
  37. {
  38. struct xfrm_offload *xo = xfrm_offload(skb);
  39. int nhlen = skb->data - skb_network_header(skb);
  40. skb_network_header(skb)[IP6CB(skb)->nhoff] =
  41. XFRM_MODE_SKB_CB(skb)->protocol;
  42. #ifndef CONFIG_NETFILTER
  43. if (!async)
  44. return 1;
  45. #endif
  46. __skb_push(skb, nhlen);
  47. ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
  48. skb_postpush_rcsum(skb, skb_network_header(skb), nhlen);
  49. if (xo && (xo->flags & XFRM_GRO)) {
  50. skb_mac_header_rebuild(skb);
  51. skb_reset_transport_header(skb);
  52. return 0;
  53. }
  54. NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
  55. dev_net(skb->dev), NULL, skb, skb->dev, NULL,
  56. xfrm6_transport_finish2);
  57. return 0;
  58. }
  59. /* If it's a keepalive packet, then just eat it.
  60. * If it's an encapsulated packet, then pass it to the
  61. * IPsec xfrm input.
  62. * Returns 0 if skb passed to xfrm or was dropped.
  63. * Returns >0 if skb should be passed to UDP.
  64. * Returns <0 if skb should be resubmitted (-ret is protocol)
  65. */
  66. int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
  67. {
  68. struct udp_sock *up = udp_sk(sk);
  69. struct udphdr *uh;
  70. struct ipv6hdr *ip6h;
  71. int len;
  72. int ip6hlen = sizeof(struct ipv6hdr);
  73. __u8 *udpdata;
  74. __be32 *udpdata32;
  75. __u16 encap_type = up->encap_type;
  76. /* if this is not encapsulated socket, then just return now */
  77. if (!encap_type)
  78. return 1;
  79. /* If this is a paged skb, make sure we pull up
  80. * whatever data we need to look at. */
  81. len = skb->len - sizeof(struct udphdr);
  82. if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8)))
  83. return 1;
  84. /* Now we can get the pointers */
  85. uh = udp_hdr(skb);
  86. udpdata = (__u8 *)uh + sizeof(struct udphdr);
  87. udpdata32 = (__be32 *)udpdata;
  88. switch (encap_type) {
  89. default:
  90. case UDP_ENCAP_ESPINUDP:
  91. /* Check if this is a keepalive packet. If so, eat it. */
  92. if (len == 1 && udpdata[0] == 0xff) {
  93. goto drop;
  94. } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) {
  95. /* ESP Packet without Non-ESP header */
  96. len = sizeof(struct udphdr);
  97. } else
  98. /* Must be an IKE packet.. pass it through */
  99. return 1;
  100. break;
  101. case UDP_ENCAP_ESPINUDP_NON_IKE:
  102. /* Check if this is a keepalive packet. If so, eat it. */
  103. if (len == 1 && udpdata[0] == 0xff) {
  104. goto drop;
  105. } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) &&
  106. udpdata32[0] == 0 && udpdata32[1] == 0) {
  107. /* ESP Packet with Non-IKE marker */
  108. len = sizeof(struct udphdr) + 2 * sizeof(u32);
  109. } else
  110. /* Must be an IKE packet.. pass it through */
  111. return 1;
  112. break;
  113. }
  114. /* At this point we are sure that this is an ESPinUDP packet,
  115. * so we need to remove 'len' bytes from the packet (the UDP
  116. * header and optional ESP marker bytes) and then modify the
  117. * protocol to ESP, and then call into the transform receiver.
  118. */
  119. if (skb_unclone(skb, GFP_ATOMIC))
  120. goto drop;
  121. /* Now we can update and verify the packet length... */
  122. ip6h = ipv6_hdr(skb);
  123. ip6h->payload_len = htons(ntohs(ip6h->payload_len) - len);
  124. if (skb->len < ip6hlen + len) {
  125. /* packet is too small!?! */
  126. goto drop;
  127. }
  128. /* pull the data buffer up to the ESP header and set the
  129. * transport header to point to ESP. Keep UDP on the stack
  130. * for later.
  131. */
  132. __skb_pull(skb, len);
  133. skb_reset_transport_header(skb);
  134. /* process ESP */
  135. return xfrm6_rcv_encap(skb, IPPROTO_ESP, 0, encap_type);
  136. drop:
  137. kfree_skb(skb);
  138. return 0;
  139. }
  140. int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t)
  141. {
  142. return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
  143. 0, t);
  144. }
  145. EXPORT_SYMBOL(xfrm6_rcv_tnl);
  146. int xfrm6_rcv(struct sk_buff *skb)
  147. {
  148. return xfrm6_rcv_tnl(skb, NULL);
  149. }
  150. EXPORT_SYMBOL(xfrm6_rcv);
  151. int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
  152. xfrm_address_t *saddr, u8 proto)
  153. {
  154. struct net *net = dev_net(skb->dev);
  155. struct xfrm_state *x = NULL;
  156. struct sec_path *sp;
  157. int i = 0;
  158. sp = secpath_set(skb);
  159. if (!sp) {
  160. XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
  161. goto drop;
  162. }
  163. if (1 + sp->len == XFRM_MAX_DEPTH) {
  164. XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
  165. goto drop;
  166. }
  167. for (i = 0; i < 3; i++) {
  168. xfrm_address_t *dst, *src;
  169. switch (i) {
  170. case 0:
  171. dst = daddr;
  172. src = saddr;
  173. break;
  174. case 1:
  175. /* lookup state with wild-card source address */
  176. dst = daddr;
  177. src = (xfrm_address_t *)&in6addr_any;
  178. break;
  179. default:
  180. /* lookup state with wild-card addresses */
  181. dst = (xfrm_address_t *)&in6addr_any;
  182. src = (xfrm_address_t *)&in6addr_any;
  183. break;
  184. }
  185. x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6);
  186. if (!x)
  187. continue;
  188. spin_lock(&x->lock);
  189. if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) &&
  190. likely(x->km.state == XFRM_STATE_VALID) &&
  191. !xfrm_state_check_expire(x)) {
  192. spin_unlock(&x->lock);
  193. if (x->type->input(x, skb) > 0) {
  194. /* found a valid state */
  195. break;
  196. }
  197. } else
  198. spin_unlock(&x->lock);
  199. xfrm_state_put(x);
  200. x = NULL;
  201. }
  202. if (!x) {
  203. XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
  204. xfrm_audit_state_notfound_simple(skb, AF_INET6);
  205. goto drop;
  206. }
  207. sp->xvec[sp->len++] = x;
  208. spin_lock(&x->lock);
  209. x->curlft.bytes += skb->len;
  210. x->curlft.packets++;
  211. spin_unlock(&x->lock);
  212. return 1;
  213. drop:
  214. return -1;
  215. }
  216. EXPORT_SYMBOL(xfrm6_input_addr);