11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * xfrm4_input.c 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Changes: 51da177e4SLinus Torvalds * YOSHIFUJI Hideaki @USAGI 61da177e4SLinus Torvalds * Split up af-specific portion 71da177e4SLinus Torvalds * Derek Atkins <derek@ihtfp.com> 81da177e4SLinus Torvalds * Add Encapsulation support 91da177e4SLinus Torvalds * 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds 121da177e4SLinus Torvalds #include <linux/module.h> 131da177e4SLinus Torvalds #include <linux/string.h> 14b05e1066SPatrick McHardy #include <linux/netfilter.h> 15b05e1066SPatrick McHardy #include <linux/netfilter_ipv4.h> 161da177e4SLinus Torvalds #include <net/ip.h> 171da177e4SLinus Torvalds #include <net/xfrm.h> 181da177e4SLinus Torvalds 19227620e2SHerbert Xu int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb) 20227620e2SHerbert Xu { 21227620e2SHerbert Xu return xfrm4_extract_header(skb); 22227620e2SHerbert Xu } 23227620e2SHerbert Xu 24b05e1066SPatrick McHardy static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb) 25b05e1066SPatrick McHardy { 26b05e1066SPatrick McHardy if (skb->dst == NULL) { 27eddc9ec5SArnaldo Carvalho de Melo const struct iphdr *iph = ip_hdr(skb); 28eddc9ec5SArnaldo Carvalho de Melo 29b05e1066SPatrick McHardy if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, 30b05e1066SPatrick McHardy skb->dev)) 31b05e1066SPatrick McHardy goto drop; 32b05e1066SPatrick McHardy } 33b05e1066SPatrick McHardy return dst_input(skb); 34b05e1066SPatrick McHardy drop: 35b05e1066SPatrick McHardy kfree_skb(skb); 36b05e1066SPatrick McHardy return NET_RX_DROP; 37b05e1066SPatrick McHardy } 38b05e1066SPatrick McHardy 39c4541b41SHerbert Xu int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, 40c4541b41SHerbert Xu int encap_type) 411da177e4SLinus Torvalds { 42716062fdSHerbert Xu XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); 43716062fdSHerbert Xu return xfrm_input(skb, nexthdr, spi, encap_type); 441da177e4SLinus Torvalds } 45716062fdSHerbert Xu EXPORT_SYMBOL(xfrm4_rcv_encap); 461da177e4SLinus Torvalds 47716062fdSHerbert Xu int xfrm4_transport_finish(struct sk_buff *skb, int async) 48716062fdSHerbert Xu { 4960d5fcfbSHerbert Xu struct iphdr *iph = ip_hdr(skb); 5060d5fcfbSHerbert Xu 5160d5fcfbSHerbert Xu iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol; 5260d5fcfbSHerbert Xu 53b05e1066SPatrick McHardy #ifdef CONFIG_NETFILTER 54d56f90a7SArnaldo Carvalho de Melo __skb_push(skb, skb->data - skb_network_header(skb)); 5560d5fcfbSHerbert Xu iph->tot_len = htons(skb->len); 5660d5fcfbSHerbert Xu ip_send_check(iph); 57b05e1066SPatrick McHardy 58b05e1066SPatrick McHardy NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL, 59b05e1066SPatrick McHardy xfrm4_rcv_encap_finish); 60b05e1066SPatrick McHardy return 0; 61b05e1066SPatrick McHardy #else 6260d5fcfbSHerbert Xu return -iph->protocol; 63b05e1066SPatrick McHardy #endif 641da177e4SLinus Torvalds } 651da177e4SLinus Torvalds 66067b207bSJames Chapman /* If it's a keepalive packet, then just eat it. 67067b207bSJames Chapman * If it's an encapsulated packet, then pass it to the 68067b207bSJames Chapman * IPsec xfrm input. 69067b207bSJames Chapman * Returns 0 if skb passed to xfrm or was dropped. 70067b207bSJames Chapman * Returns >0 if skb should be passed to UDP. 71067b207bSJames Chapman * Returns <0 if skb should be resubmitted (-ret is protocol) 72067b207bSJames Chapman */ 73067b207bSJames Chapman int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 74067b207bSJames Chapman { 75067b207bSJames Chapman struct udp_sock *up = udp_sk(sk); 76067b207bSJames Chapman struct udphdr *uh; 77067b207bSJames Chapman struct iphdr *iph; 78067b207bSJames Chapman int iphlen, len; 79067b207bSJames Chapman int ret; 80067b207bSJames Chapman 81067b207bSJames Chapman __u8 *udpdata; 82067b207bSJames Chapman __be32 *udpdata32; 83067b207bSJames Chapman __u16 encap_type = up->encap_type; 84067b207bSJames Chapman 85067b207bSJames Chapman /* if this is not encapsulated socket, then just return now */ 86067b207bSJames Chapman if (!encap_type) 87067b207bSJames Chapman return 1; 88067b207bSJames Chapman 89067b207bSJames Chapman /* If this is a paged skb, make sure we pull up 90067b207bSJames Chapman * whatever data we need to look at. */ 91067b207bSJames Chapman len = skb->len - sizeof(struct udphdr); 92067b207bSJames Chapman if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) 93067b207bSJames Chapman return 1; 94067b207bSJames Chapman 95067b207bSJames Chapman /* Now we can get the pointers */ 96067b207bSJames Chapman uh = udp_hdr(skb); 97067b207bSJames Chapman udpdata = (__u8 *)uh + sizeof(struct udphdr); 98067b207bSJames Chapman udpdata32 = (__be32 *)udpdata; 99067b207bSJames Chapman 100067b207bSJames Chapman switch (encap_type) { 101067b207bSJames Chapman default: 102067b207bSJames Chapman case UDP_ENCAP_ESPINUDP: 103067b207bSJames Chapman /* Check if this is a keepalive packet. If so, eat it. */ 104067b207bSJames Chapman if (len == 1 && udpdata[0] == 0xff) { 105067b207bSJames Chapman goto drop; 106067b207bSJames Chapman } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) { 107067b207bSJames Chapman /* ESP Packet without Non-ESP header */ 108067b207bSJames Chapman len = sizeof(struct udphdr); 109067b207bSJames Chapman } else 110067b207bSJames Chapman /* Must be an IKE packet.. pass it through */ 111067b207bSJames Chapman return 1; 112067b207bSJames Chapman break; 113067b207bSJames Chapman case UDP_ENCAP_ESPINUDP_NON_IKE: 114067b207bSJames Chapman /* Check if this is a keepalive packet. If so, eat it. */ 115067b207bSJames Chapman if (len == 1 && udpdata[0] == 0xff) { 116067b207bSJames Chapman goto drop; 117067b207bSJames Chapman } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) && 118067b207bSJames Chapman udpdata32[0] == 0 && udpdata32[1] == 0) { 119067b207bSJames Chapman 120067b207bSJames Chapman /* ESP Packet with Non-IKE marker */ 121067b207bSJames Chapman len = sizeof(struct udphdr) + 2 * sizeof(u32); 122067b207bSJames Chapman } else 123067b207bSJames Chapman /* Must be an IKE packet.. pass it through */ 124067b207bSJames Chapman return 1; 125067b207bSJames Chapman break; 126067b207bSJames Chapman } 127067b207bSJames Chapman 128067b207bSJames Chapman /* At this point we are sure that this is an ESPinUDP packet, 129067b207bSJames Chapman * so we need to remove 'len' bytes from the packet (the UDP 130067b207bSJames Chapman * header and optional ESP marker bytes) and then modify the 131067b207bSJames Chapman * protocol to ESP, and then call into the transform receiver. 132067b207bSJames Chapman */ 133067b207bSJames Chapman if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) 134067b207bSJames Chapman goto drop; 135067b207bSJames Chapman 136067b207bSJames Chapman /* Now we can update and verify the packet length... */ 137067b207bSJames Chapman iph = ip_hdr(skb); 138067b207bSJames Chapman iphlen = iph->ihl << 2; 139067b207bSJames Chapman iph->tot_len = htons(ntohs(iph->tot_len) - len); 140067b207bSJames Chapman if (skb->len < iphlen + len) { 141067b207bSJames Chapman /* packet is too small!?! */ 142067b207bSJames Chapman goto drop; 143067b207bSJames Chapman } 144067b207bSJames Chapman 145067b207bSJames Chapman /* pull the data buffer up to the ESP header and set the 146067b207bSJames Chapman * transport header to point to ESP. Keep UDP on the stack 147067b207bSJames Chapman * for later. 148067b207bSJames Chapman */ 149067b207bSJames Chapman __skb_pull(skb, len); 150067b207bSJames Chapman skb_reset_transport_header(skb); 151067b207bSJames Chapman 152067b207bSJames Chapman /* process ESP */ 153c4541b41SHerbert Xu ret = xfrm4_rcv_encap(skb, IPPROTO_ESP, 0, encap_type); 154067b207bSJames Chapman return ret; 155067b207bSJames Chapman 156067b207bSJames Chapman drop: 157067b207bSJames Chapman kfree_skb(skb); 158067b207bSJames Chapman return 0; 159067b207bSJames Chapman } 160067b207bSJames Chapman 161067b207bSJames Chapman int xfrm4_rcv(struct sk_buff *skb) 162067b207bSJames Chapman { 163c4541b41SHerbert Xu return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0); 164067b207bSJames Chapman } 165067b207bSJames Chapman 166067b207bSJames Chapman EXPORT_SYMBOL(xfrm4_rcv); 167