xfrm6_input.c 4.65 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8 9 10 11 12 13
/*
 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
 *
 * Authors:
 *	Mitsuru KANDA @USAGI
 * 	Kazunori MIYAZAWA @USAGI
 * 	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 *	YOSHIFUJI Hideaki @USAGI
 *		IPv6 support
 */

#include <linux/module.h>
#include <linux/string.h>
14 15
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
Linus Torvalds's avatar
Linus Torvalds committed
16 17 18
#include <net/ipv6.h>
#include <net/xfrm.h>

19
int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
Linus Torvalds's avatar
Linus Torvalds committed
20 21
{
	int err;
22
	__be32 seq;
23
	struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
Linus Torvalds's avatar
Linus Torvalds committed
24 25 26 27 28
	struct xfrm_state *x;
	int xfrm_nr = 0;
	int decaps = 0;
	unsigned int nhoff;

29
	nhoff = IP6CB(skb)->nhoff;
Linus Torvalds's avatar
Linus Torvalds committed
30 31 32 33

	seq = 0;
	if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0)
		goto drop;
34

Linus Torvalds's avatar
Linus Torvalds committed
35
	do {
36
		struct ipv6hdr *iph = ipv6_hdr(skb);
Linus Torvalds's avatar
Linus Torvalds committed
37 38 39 40

		if (xfrm_nr == XFRM_MAX_DEPTH)
			goto drop;

41
		x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,
42
				      nexthdr, AF_INET6);
Linus Torvalds's avatar
Linus Torvalds committed
43 44 45 46 47 48 49 50 51 52 53 54
		if (x == NULL)
			goto drop;
		spin_lock(&x->lock);
		if (unlikely(x->km.state != XFRM_STATE_VALID))
			goto drop_unlock;

		if (x->props.replay_window && xfrm_replay_check(x, seq))
			goto drop_unlock;

		if (xfrm_state_check_expire(x))
			goto drop_unlock;

55
		nexthdr = x->type->input(x, skb);
Linus Torvalds's avatar
Linus Torvalds committed
56 57 58
		if (nexthdr <= 0)
			goto drop_unlock;

59
		skb_network_header(skb)[nhoff] = nexthdr;
Linus Torvalds's avatar
Linus Torvalds committed
60 61 62 63 64 65 66 67 68

		if (x->props.replay_window)
			xfrm_replay_advance(x, seq);

		x->curlft.bytes += skb->len;
		x->curlft.packets++;

		spin_unlock(&x->lock);

69
		xfrm_vec[xfrm_nr++] = x;
Linus Torvalds's avatar
Linus Torvalds committed
70

71 72 73
		if (x->mode->input(x, skb))
			goto drop;

74
		if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */
Linus Torvalds's avatar
Linus Torvalds committed
75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96
			decaps = 1;
			break;
		}

		if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0)
			goto drop;
	} while (!err);

	/* Allocate new secpath or COW existing one. */
	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
		struct sec_path *sp;
		sp = secpath_dup(skb->sp);
		if (!sp)
			goto drop;
		if (skb->sp)
			secpath_put(skb->sp);
		skb->sp = sp;
	}

	if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
		goto drop;

97 98
	memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
	       xfrm_nr * sizeof(xfrm_vec[0]));
Linus Torvalds's avatar
Linus Torvalds committed
99 100 101
	skb->sp->len += xfrm_nr;
	skb->ip_summed = CHECKSUM_NONE;

102 103
	nf_reset(skb);

Linus Torvalds's avatar
Linus Torvalds committed
104
	if (decaps) {
105 106
		dst_release(skb->dst);
		skb->dst = NULL;
Linus Torvalds's avatar
Linus Torvalds committed
107 108 109
		netif_rx(skb);
		return -1;
	} else {
110
#ifdef CONFIG_NETFILTER
111
		ipv6_hdr(skb)->payload_len = htons(skb->len);
112
		__skb_push(skb, skb->data - skb_network_header(skb));
113 114

		NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
115
			ip6_rcv_finish);
116 117
		return -1;
#else
Linus Torvalds's avatar
Linus Torvalds committed
118
		return 1;
119
#endif
Linus Torvalds's avatar
Linus Torvalds committed
120 121 122 123 124 125 126
	}

drop_unlock:
	spin_unlock(&x->lock);
	xfrm_state_put(x);
drop:
	while (--xfrm_nr >= 0)
127
		xfrm_state_put(xfrm_vec[xfrm_nr]);
Linus Torvalds's avatar
Linus Torvalds committed
128 129 130 131 132 133
	kfree_skb(skb);
	return -1;
}

EXPORT_SYMBOL(xfrm6_rcv_spi);

134
int xfrm6_rcv(struct sk_buff *skb)
Linus Torvalds's avatar
Linus Torvalds committed
135
{
136 137
	return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
			     0);
Linus Torvalds's avatar
Linus Torvalds committed
138
}
139

140 141
EXPORT_SYMBOL(xfrm6_rcv);

142 143 144
int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
		     xfrm_address_t *saddr, u8 proto)
{
145 146
	struct xfrm_state *x = NULL;
	int wildcard = 0;
147 148
	xfrm_address_t *xany;
	struct xfrm_state *xfrm_vec_one = NULL;
149
	int nh = 0;
150 151
	int i = 0;

152
	xany = (xfrm_address_t *)&in6addr_any;
153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168

	for (i = 0; i < 3; i++) {
		xfrm_address_t *dst, *src;
		switch (i) {
		case 0:
			dst = daddr;
			src = saddr;
			break;
		case 1:
			/* lookup state with wild-card source address */
			wildcard = 1;
			dst = daddr;
			src = xany;
			break;
		case 2:
		default:
169
			/* lookup state with wild-card addresses */
170 171 172 173
			wildcard = 1; /* XXX */
			dst = xany;
			src = xany;
			break;
174
		}
175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193

		x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6);
		if (!x)
			continue;

		spin_lock(&x->lock);

		if (wildcard) {
			if ((x->props.flags & XFRM_STATE_WILDRECV) == 0) {
				spin_unlock(&x->lock);
				xfrm_state_put(x);
				x = NULL;
				continue;
			}
		}

		if (unlikely(x->km.state != XFRM_STATE_VALID)) {
			spin_unlock(&x->lock);
			xfrm_state_put(x);
194 195
			x = NULL;
			continue;
196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246
		}
		if (xfrm_state_check_expire(x)) {
			spin_unlock(&x->lock);
			xfrm_state_put(x);
			x = NULL;
			continue;
		}

		nh = x->type->input(x, skb);
		if (nh <= 0) {
			spin_unlock(&x->lock);
			xfrm_state_put(x);
			x = NULL;
			continue;
		}

		x->curlft.bytes += skb->len;
		x->curlft.packets++;

		spin_unlock(&x->lock);

		xfrm_vec_one = x;
		break;
	}

	if (!xfrm_vec_one)
		goto drop;

	/* Allocate new secpath or COW existing one. */
	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
		struct sec_path *sp;
		sp = secpath_dup(skb->sp);
		if (!sp)
			goto drop;
		if (skb->sp)
			secpath_put(skb->sp);
		skb->sp = sp;
	}

	if (1 + skb->sp->len > XFRM_MAX_DEPTH)
		goto drop;

	skb->sp->xvec[skb->sp->len] = xfrm_vec_one;
	skb->sp->len ++;

	return 1;
drop:
	if (xfrm_vec_one)
		xfrm_state_put(xfrm_vec_one);
	return -1;
}
247 248

EXPORT_SYMBOL(xfrm6_input_addr);