11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * xfrm6_input.c: based on net/ipv4/xfrm4_input.c 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Authors: 51da177e4SLinus Torvalds * Mitsuru KANDA @USAGI 61da177e4SLinus Torvalds * Kazunori MIYAZAWA @USAGI 71da177e4SLinus Torvalds * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 81da177e4SLinus Torvalds * YOSHIFUJI Hideaki @USAGI 91da177e4SLinus Torvalds * IPv6 support 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds 121da177e4SLinus Torvalds #include <linux/module.h> 131da177e4SLinus Torvalds #include <linux/string.h> 14b05e1066SPatrick McHardy #include <linux/netfilter.h> 15b05e1066SPatrick McHardy #include <linux/netfilter_ipv6.h> 161da177e4SLinus Torvalds #include <net/ipv6.h> 171da177e4SLinus Torvalds #include <net/xfrm.h> 181da177e4SLinus Torvalds 19a252cc23SAl Viro int xfrm6_rcv_spi(struct sk_buff *skb, __be32 spi) 201da177e4SLinus Torvalds { 211da177e4SLinus Torvalds int err; 226067b2baSAl Viro __be32 seq; 23dbe5b4aaSHerbert Xu struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH]; 241da177e4SLinus Torvalds struct xfrm_state *x; 251da177e4SLinus Torvalds int xfrm_nr = 0; 261da177e4SLinus Torvalds int decaps = 0; 271da177e4SLinus Torvalds int nexthdr; 281da177e4SLinus Torvalds unsigned int nhoff; 291da177e4SLinus Torvalds 30951dbc8aSPatrick McHardy nhoff = IP6CB(skb)->nhoff; 311da177e4SLinus Torvalds nexthdr = skb->nh.raw[nhoff]; 321da177e4SLinus Torvalds 331da177e4SLinus Torvalds seq = 0; 341da177e4SLinus Torvalds if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) 351da177e4SLinus Torvalds goto drop; 361da177e4SLinus Torvalds 371da177e4SLinus Torvalds do { 381da177e4SLinus Torvalds struct ipv6hdr *iph = skb->nh.ipv6h; 391da177e4SLinus Torvalds 401da177e4SLinus Torvalds if (xfrm_nr == XFRM_MAX_DEPTH) 411da177e4SLinus Torvalds goto drop; 421da177e4SLinus Torvalds 4373d605d1SKazunori MIYAZAWA x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, 4473d605d1SKazunori MIYAZAWA nexthdr != IPPROTO_IPIP ? nexthdr : IPPROTO_IPV6, AF_INET6); 451da177e4SLinus Torvalds if (x == NULL) 461da177e4SLinus Torvalds goto drop; 471da177e4SLinus Torvalds spin_lock(&x->lock); 481da177e4SLinus Torvalds if (unlikely(x->km.state != XFRM_STATE_VALID)) 491da177e4SLinus Torvalds goto drop_unlock; 501da177e4SLinus Torvalds 511da177e4SLinus Torvalds if (x->props.replay_window && xfrm_replay_check(x, seq)) 521da177e4SLinus Torvalds goto drop_unlock; 531da177e4SLinus Torvalds 541da177e4SLinus Torvalds if (xfrm_state_check_expire(x)) 551da177e4SLinus Torvalds goto drop_unlock; 561da177e4SLinus Torvalds 57e695633eSHerbert Xu nexthdr = x->type->input(x, skb); 581da177e4SLinus Torvalds if (nexthdr <= 0) 591da177e4SLinus Torvalds goto drop_unlock; 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds skb->nh.raw[nhoff] = nexthdr; 621da177e4SLinus Torvalds 631da177e4SLinus Torvalds if (x->props.replay_window) 641da177e4SLinus Torvalds xfrm_replay_advance(x, seq); 651da177e4SLinus Torvalds 661da177e4SLinus Torvalds x->curlft.bytes += skb->len; 671da177e4SLinus Torvalds x->curlft.packets++; 681da177e4SLinus Torvalds 691da177e4SLinus Torvalds spin_unlock(&x->lock); 701da177e4SLinus Torvalds 71dbe5b4aaSHerbert Xu xfrm_vec[xfrm_nr++] = x; 721da177e4SLinus Torvalds 73b59f45d0SHerbert Xu if (x->mode->input(x, skb)) 74b59f45d0SHerbert Xu goto drop; 75b59f45d0SHerbert Xu 767e49e6deSMasahide NAKAMURA if (x->props.mode == XFRM_MODE_TUNNEL) { /* XXX */ 771da177e4SLinus Torvalds decaps = 1; 781da177e4SLinus Torvalds break; 791da177e4SLinus Torvalds } 801da177e4SLinus Torvalds 811da177e4SLinus Torvalds if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0) 821da177e4SLinus Torvalds goto drop; 831da177e4SLinus Torvalds } while (!err); 841da177e4SLinus Torvalds 851da177e4SLinus Torvalds /* Allocate new secpath or COW existing one. */ 861da177e4SLinus Torvalds if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { 871da177e4SLinus Torvalds struct sec_path *sp; 881da177e4SLinus Torvalds sp = secpath_dup(skb->sp); 891da177e4SLinus Torvalds if (!sp) 901da177e4SLinus Torvalds goto drop; 911da177e4SLinus Torvalds if (skb->sp) 921da177e4SLinus Torvalds secpath_put(skb->sp); 931da177e4SLinus Torvalds skb->sp = sp; 941da177e4SLinus Torvalds } 951da177e4SLinus Torvalds 961da177e4SLinus Torvalds if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH) 971da177e4SLinus Torvalds goto drop; 981da177e4SLinus Torvalds 99dbe5b4aaSHerbert Xu memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec, 100dbe5b4aaSHerbert Xu xfrm_nr * sizeof(xfrm_vec[0])); 1011da177e4SLinus Torvalds skb->sp->len += xfrm_nr; 1021da177e4SLinus Torvalds skb->ip_summed = CHECKSUM_NONE; 1031da177e4SLinus Torvalds 104b05e1066SPatrick McHardy nf_reset(skb); 105b05e1066SPatrick McHardy 1061da177e4SLinus Torvalds if (decaps) { 1071da177e4SLinus Torvalds if (!(skb->dev->flags&IFF_LOOPBACK)) { 1081da177e4SLinus Torvalds dst_release(skb->dst); 1091da177e4SLinus Torvalds skb->dst = NULL; 1101da177e4SLinus Torvalds } 1111da177e4SLinus Torvalds netif_rx(skb); 1121da177e4SLinus Torvalds return -1; 1131da177e4SLinus Torvalds } else { 114b05e1066SPatrick McHardy #ifdef CONFIG_NETFILTER 115b05e1066SPatrick McHardy skb->nh.ipv6h->payload_len = htons(skb->len); 116b05e1066SPatrick McHardy __skb_push(skb, skb->data - skb->nh.raw); 117b05e1066SPatrick McHardy 118b05e1066SPatrick McHardy NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL, 119b05e1066SPatrick McHardy ip6_rcv_finish); 120b05e1066SPatrick McHardy return -1; 121b05e1066SPatrick McHardy #else 1221da177e4SLinus Torvalds return 1; 123b05e1066SPatrick McHardy #endif 1241da177e4SLinus Torvalds } 1251da177e4SLinus Torvalds 1261da177e4SLinus Torvalds drop_unlock: 1271da177e4SLinus Torvalds spin_unlock(&x->lock); 1281da177e4SLinus Torvalds xfrm_state_put(x); 1291da177e4SLinus Torvalds drop: 1301da177e4SLinus Torvalds while (--xfrm_nr >= 0) 131dbe5b4aaSHerbert Xu xfrm_state_put(xfrm_vec[xfrm_nr]); 1321da177e4SLinus Torvalds kfree_skb(skb); 1331da177e4SLinus Torvalds return -1; 1341da177e4SLinus Torvalds } 1351da177e4SLinus Torvalds 1361da177e4SLinus Torvalds EXPORT_SYMBOL(xfrm6_rcv_spi); 1371da177e4SLinus Torvalds 138951dbc8aSPatrick McHardy int xfrm6_rcv(struct sk_buff **pskb) 1391da177e4SLinus Torvalds { 140d2acc347SHerbert Xu return xfrm6_rcv_spi(*pskb, 0); 1411da177e4SLinus Torvalds } 142fbd9a5b4SMasahide NAKAMURA 143fbd9a5b4SMasahide NAKAMURA int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 144fbd9a5b4SMasahide NAKAMURA xfrm_address_t *saddr, u8 proto) 145fbd9a5b4SMasahide NAKAMURA { 146fbd9a5b4SMasahide NAKAMURA struct xfrm_state *x = NULL; 147fbd9a5b4SMasahide NAKAMURA int wildcard = 0; 148fbd9a5b4SMasahide NAKAMURA struct in6_addr any; 149fbd9a5b4SMasahide NAKAMURA xfrm_address_t *xany; 150fbd9a5b4SMasahide NAKAMURA struct xfrm_state *xfrm_vec_one = NULL; 151fbd9a5b4SMasahide NAKAMURA int nh = 0; 152fbd9a5b4SMasahide NAKAMURA int i = 0; 153fbd9a5b4SMasahide NAKAMURA 154fbd9a5b4SMasahide NAKAMURA ipv6_addr_set(&any, 0, 0, 0, 0); 155fbd9a5b4SMasahide NAKAMURA xany = (xfrm_address_t *)&any; 156fbd9a5b4SMasahide NAKAMURA 157fbd9a5b4SMasahide NAKAMURA for (i = 0; i < 3; i++) { 158fbd9a5b4SMasahide NAKAMURA xfrm_address_t *dst, *src; 159fbd9a5b4SMasahide NAKAMURA switch (i) { 160fbd9a5b4SMasahide NAKAMURA case 0: 161fbd9a5b4SMasahide NAKAMURA dst = daddr; 162fbd9a5b4SMasahide NAKAMURA src = saddr; 163fbd9a5b4SMasahide NAKAMURA break; 164fbd9a5b4SMasahide NAKAMURA case 1: 165fbd9a5b4SMasahide NAKAMURA /* lookup state with wild-card source address */ 166fbd9a5b4SMasahide NAKAMURA wildcard = 1; 167fbd9a5b4SMasahide NAKAMURA dst = daddr; 168fbd9a5b4SMasahide NAKAMURA src = xany; 169fbd9a5b4SMasahide NAKAMURA break; 170fbd9a5b4SMasahide NAKAMURA case 2: 171fbd9a5b4SMasahide NAKAMURA default: 172fbd9a5b4SMasahide NAKAMURA /* lookup state with wild-card addresses */ 173fbd9a5b4SMasahide NAKAMURA wildcard = 1; /* XXX */ 174fbd9a5b4SMasahide NAKAMURA dst = xany; 175fbd9a5b4SMasahide NAKAMURA src = xany; 176fbd9a5b4SMasahide NAKAMURA break; 177fbd9a5b4SMasahide NAKAMURA } 178fbd9a5b4SMasahide NAKAMURA 179fbd9a5b4SMasahide NAKAMURA x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6); 180fbd9a5b4SMasahide NAKAMURA if (!x) 181fbd9a5b4SMasahide NAKAMURA continue; 182fbd9a5b4SMasahide NAKAMURA 183fbd9a5b4SMasahide NAKAMURA spin_lock(&x->lock); 184fbd9a5b4SMasahide NAKAMURA 185fbd9a5b4SMasahide NAKAMURA if (wildcard) { 186fbd9a5b4SMasahide NAKAMURA if ((x->props.flags & XFRM_STATE_WILDRECV) == 0) { 187fbd9a5b4SMasahide NAKAMURA spin_unlock(&x->lock); 188fbd9a5b4SMasahide NAKAMURA xfrm_state_put(x); 189fbd9a5b4SMasahide NAKAMURA x = NULL; 190fbd9a5b4SMasahide NAKAMURA continue; 191fbd9a5b4SMasahide NAKAMURA } 192fbd9a5b4SMasahide NAKAMURA } 193fbd9a5b4SMasahide NAKAMURA 194fbd9a5b4SMasahide NAKAMURA if (unlikely(x->km.state != XFRM_STATE_VALID)) { 195fbd9a5b4SMasahide NAKAMURA spin_unlock(&x->lock); 196fbd9a5b4SMasahide NAKAMURA xfrm_state_put(x); 197fbd9a5b4SMasahide NAKAMURA x = NULL; 198fbd9a5b4SMasahide NAKAMURA continue; 199fbd9a5b4SMasahide NAKAMURA } 200fbd9a5b4SMasahide NAKAMURA if (xfrm_state_check_expire(x)) { 201fbd9a5b4SMasahide NAKAMURA spin_unlock(&x->lock); 202fbd9a5b4SMasahide NAKAMURA xfrm_state_put(x); 203fbd9a5b4SMasahide NAKAMURA x = NULL; 204fbd9a5b4SMasahide NAKAMURA continue; 205fbd9a5b4SMasahide NAKAMURA } 206fbd9a5b4SMasahide NAKAMURA 207fbd9a5b4SMasahide NAKAMURA nh = x->type->input(x, skb); 208fbd9a5b4SMasahide NAKAMURA if (nh <= 0) { 209fbd9a5b4SMasahide NAKAMURA spin_unlock(&x->lock); 210fbd9a5b4SMasahide NAKAMURA xfrm_state_put(x); 211fbd9a5b4SMasahide NAKAMURA x = NULL; 212fbd9a5b4SMasahide NAKAMURA continue; 213fbd9a5b4SMasahide NAKAMURA } 214fbd9a5b4SMasahide NAKAMURA 215fbd9a5b4SMasahide NAKAMURA x->curlft.bytes += skb->len; 216fbd9a5b4SMasahide NAKAMURA x->curlft.packets++; 217fbd9a5b4SMasahide NAKAMURA 218fbd9a5b4SMasahide NAKAMURA spin_unlock(&x->lock); 219fbd9a5b4SMasahide NAKAMURA 220fbd9a5b4SMasahide NAKAMURA xfrm_vec_one = x; 221fbd9a5b4SMasahide NAKAMURA break; 222fbd9a5b4SMasahide NAKAMURA } 223fbd9a5b4SMasahide NAKAMURA 224fbd9a5b4SMasahide NAKAMURA if (!xfrm_vec_one) 225fbd9a5b4SMasahide NAKAMURA goto drop; 226fbd9a5b4SMasahide NAKAMURA 227fbd9a5b4SMasahide NAKAMURA /* Allocate new secpath or COW existing one. */ 228fbd9a5b4SMasahide NAKAMURA if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { 229fbd9a5b4SMasahide NAKAMURA struct sec_path *sp; 230fbd9a5b4SMasahide NAKAMURA sp = secpath_dup(skb->sp); 231fbd9a5b4SMasahide NAKAMURA if (!sp) 232fbd9a5b4SMasahide NAKAMURA goto drop; 233fbd9a5b4SMasahide NAKAMURA if (skb->sp) 234fbd9a5b4SMasahide NAKAMURA secpath_put(skb->sp); 235fbd9a5b4SMasahide NAKAMURA skb->sp = sp; 236fbd9a5b4SMasahide NAKAMURA } 237fbd9a5b4SMasahide NAKAMURA 238fbd9a5b4SMasahide NAKAMURA if (1 + skb->sp->len > XFRM_MAX_DEPTH) 239fbd9a5b4SMasahide NAKAMURA goto drop; 240fbd9a5b4SMasahide NAKAMURA 241fbd9a5b4SMasahide NAKAMURA skb->sp->xvec[skb->sp->len] = xfrm_vec_one; 242fbd9a5b4SMasahide NAKAMURA skb->sp->len ++; 243fbd9a5b4SMasahide NAKAMURA 244fbd9a5b4SMasahide NAKAMURA return 1; 245fbd9a5b4SMasahide NAKAMURA drop: 246fbd9a5b4SMasahide NAKAMURA if (xfrm_vec_one) 247fbd9a5b4SMasahide NAKAMURA xfrm_state_put(xfrm_vec_one); 248fbd9a5b4SMasahide NAKAMURA return -1; 249fbd9a5b4SMasahide NAKAMURA } 250