11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * xfrm4_input.c 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Changes: 51da177e4SLinus Torvalds * YOSHIFUJI Hideaki @USAGI 61da177e4SLinus Torvalds * Split up af-specific portion 71da177e4SLinus Torvalds * Derek Atkins <derek@ihtfp.com> 81da177e4SLinus Torvalds * Add Encapsulation support 91da177e4SLinus Torvalds * 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds 125a0e3ad6STejun Heo #include <linux/slab.h> 131da177e4SLinus Torvalds #include <linux/module.h> 141da177e4SLinus Torvalds #include <linux/string.h> 15b05e1066SPatrick McHardy #include <linux/netfilter.h> 16b05e1066SPatrick McHardy #include <linux/netfilter_ipv4.h> 171da177e4SLinus Torvalds #include <net/ip.h> 181da177e4SLinus Torvalds #include <net/xfrm.h> 191da177e4SLinus Torvalds 20227620e2SHerbert Xu int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb) 21227620e2SHerbert Xu { 22227620e2SHerbert Xu return xfrm4_extract_header(skb); 23227620e2SHerbert Xu } 24227620e2SHerbert Xu 25b05e1066SPatrick McHardy static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb) 26b05e1066SPatrick McHardy { 27adf30907SEric Dumazet if (skb_dst(skb) == NULL) { 28eddc9ec5SArnaldo Carvalho de Melo const struct iphdr *iph = ip_hdr(skb); 29eddc9ec5SArnaldo Carvalho de Melo 30c6cffba4SDavid S. Miller if (ip_route_input_noref(skb, iph->daddr, iph->saddr, 31c10237e0SDavid S. Miller iph->tos, skb->dev)) 32b05e1066SPatrick McHardy goto drop; 33b05e1066SPatrick McHardy } 34b05e1066SPatrick McHardy return dst_input(skb); 35b05e1066SPatrick McHardy drop: 36b05e1066SPatrick McHardy kfree_skb(skb); 37b05e1066SPatrick McHardy return NET_RX_DROP; 38b05e1066SPatrick McHardy } 39b05e1066SPatrick McHardy 40c4541b41SHerbert Xu int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 41c4541b41SHerbert Xu int encap_type) 421da177e4SLinus Torvalds { 432fcb45b6SHerbert Xu XFRM_SPI_SKB_CB(skb)->family = AF_INET; 44716062fdSHerbert Xu XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 45716062fdSHerbert Xu return xfrm_input(skb, nexthdr, spi, encap_type); 461da177e4SLinus Torvalds } 47716062fdSHerbert Xu EXPORT_SYMBOL(xfrm4_rcv_encap); 481da177e4SLinus Torvalds 49716062fdSHerbert Xu int xfrm4_transport_finish(struct sk_buff *skb, int async) 50716062fdSHerbert Xu { 5160d5fcfbSHerbert Xu struct iphdr *iph = ip_hdr(skb); 5260d5fcfbSHerbert Xu 5360d5fcfbSHerbert Xu iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol; 5460d5fcfbSHerbert Xu 550883ae0eSHerbert Xu #ifndef CONFIG_NETFILTER 560883ae0eSHerbert Xu if (!async) 570883ae0eSHerbert Xu return -iph->protocol; 580883ae0eSHerbert Xu #endif 590883ae0eSHerbert Xu 60d56f90a7SArnaldo Carvalho de Melo __skb_push(skb, skb->data - skb_network_header(skb)); 6160d5fcfbSHerbert Xu iph->tot_len = htons(skb->len); 6260d5fcfbSHerbert Xu ip_send_check(iph); 63b05e1066SPatrick McHardy 649bbc768aSJan Engelhardt NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, skb->dev, NULL, 65b05e1066SPatrick McHardy xfrm4_rcv_encap_finish); 66b05e1066SPatrick McHardy return 0; 671da177e4SLinus Torvalds } 681da177e4SLinus Torvalds 69067b207bSJames Chapman /* If it's a keepalive packet, then just eat it. 70067b207bSJames Chapman * If it's an encapsulated packet, then pass it to the 71067b207bSJames Chapman * IPsec xfrm input. 72067b207bSJames Chapman * Returns 0 if skb passed to xfrm or was dropped. 73067b207bSJames Chapman * Returns >0 if skb should be passed to UDP. 74067b207bSJames Chapman * Returns <0 if skb should be resubmitted (-ret is protocol) 75067b207bSJames Chapman */ 76067b207bSJames Chapman int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 77067b207bSJames Chapman { 78067b207bSJames Chapman struct udp_sock *up = udp_sk(sk); 79067b207bSJames Chapman struct udphdr *uh; 80067b207bSJames Chapman struct iphdr *iph; 81067b207bSJames Chapman int iphlen, len; 82067b207bSJames Chapman 83067b207bSJames Chapman __u8 *udpdata; 84067b207bSJames Chapman __be32 *udpdata32; 85067b207bSJames Chapman __u16 encap_type = up->encap_type; 86067b207bSJames Chapman 87067b207bSJames Chapman /* if this is not encapsulated socket, then just return now */ 88067b207bSJames Chapman if (!encap_type) 89067b207bSJames Chapman return 1; 90067b207bSJames Chapman 91067b207bSJames Chapman /* If this is a paged skb, make sure we pull up 92067b207bSJames Chapman * whatever data we need to look at. */ 93067b207bSJames Chapman len = skb->len - sizeof(struct udphdr); 94067b207bSJames Chapman if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) 95067b207bSJames Chapman return 1; 96067b207bSJames Chapman 97067b207bSJames Chapman /* Now we can get the pointers */ 98067b207bSJames Chapman uh = udp_hdr(skb); 99067b207bSJames Chapman udpdata = (__u8 *)uh + sizeof(struct udphdr); 100067b207bSJames Chapman udpdata32 = (__be32 *)udpdata; 101067b207bSJames Chapman 102067b207bSJames Chapman switch (encap_type) { 103067b207bSJames Chapman default: 104067b207bSJames Chapman case UDP_ENCAP_ESPINUDP: 105067b207bSJames Chapman /* Check if this is a keepalive packet. If so, eat it. */ 106067b207bSJames Chapman if (len == 1 && udpdata[0] == 0xff) { 107067b207bSJames Chapman goto drop; 108067b207bSJames Chapman } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) { 109067b207bSJames Chapman /* ESP Packet without Non-ESP header */ 110067b207bSJames Chapman len = sizeof(struct udphdr); 111067b207bSJames Chapman } else 112067b207bSJames Chapman /* Must be an IKE packet.. pass it through */ 113067b207bSJames Chapman return 1; 114067b207bSJames Chapman break; 115067b207bSJames Chapman case UDP_ENCAP_ESPINUDP_NON_IKE: 116067b207bSJames Chapman /* Check if this is a keepalive packet. If so, eat it. */ 117067b207bSJames Chapman if (len == 1 && udpdata[0] == 0xff) { 118067b207bSJames Chapman goto drop; 119067b207bSJames Chapman } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) && 120067b207bSJames Chapman udpdata32[0] == 0 && udpdata32[1] == 0) { 121067b207bSJames Chapman 122067b207bSJames Chapman /* ESP Packet with Non-IKE marker */ 123067b207bSJames Chapman len = sizeof(struct udphdr) + 2 * sizeof(u32); 124067b207bSJames Chapman } else 125067b207bSJames Chapman /* Must be an IKE packet.. pass it through */ 126067b207bSJames Chapman return 1; 127067b207bSJames Chapman break; 128067b207bSJames Chapman } 129067b207bSJames Chapman 130067b207bSJames Chapman /* At this point we are sure that this is an ESPinUDP packet, 131067b207bSJames Chapman * so we need to remove 'len' bytes from the packet (the UDP 132067b207bSJames Chapman * header and optional ESP marker bytes) and then modify the 133067b207bSJames Chapman * protocol to ESP, and then call into the transform receiver. 134067b207bSJames Chapman */ 13514bbd6a5SPravin B Shelar if (skb_unclone(skb, GFP_ATOMIC)) 136067b207bSJames Chapman goto drop; 137067b207bSJames Chapman 138067b207bSJames Chapman /* Now we can update and verify the packet length... */ 139067b207bSJames Chapman iph = ip_hdr(skb); 140067b207bSJames Chapman iphlen = iph->ihl << 2; 141067b207bSJames Chapman iph->tot_len = htons(ntohs(iph->tot_len) - len); 142067b207bSJames Chapman if (skb->len < iphlen + len) { 143067b207bSJames Chapman /* packet is too small!?! */ 144067b207bSJames Chapman goto drop; 145067b207bSJames Chapman } 146067b207bSJames Chapman 147067b207bSJames Chapman /* pull the data buffer up to the ESP header and set the 148067b207bSJames Chapman * transport header to point to ESP. Keep UDP on the stack 149067b207bSJames Chapman * for later. 150067b207bSJames Chapman */ 151067b207bSJames Chapman __skb_pull(skb, len); 152067b207bSJames Chapman skb_reset_transport_header(skb); 153067b207bSJames Chapman 154067b207bSJames Chapman /* process ESP */ 155f2712fd0SHerbert Xu return xfrm4_rcv_encap(skb, IPPROTO_ESP, 0, encap_type); 156067b207bSJames Chapman 157067b207bSJames Chapman drop: 158067b207bSJames Chapman kfree_skb(skb); 159067b207bSJames Chapman return 0; 160067b207bSJames Chapman } 161067b207bSJames Chapman 162067b207bSJames Chapman int xfrm4_rcv(struct sk_buff *skb) 163067b207bSJames Chapman { 164c4541b41SHerbert Xu return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0); 165067b207bSJames Chapman } 166067b207bSJames Chapman EXPORT_SYMBOL(xfrm4_rcv); 167