1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c 4 * 5 * Authors: 6 * Mitsuru KANDA @USAGI 7 * Kazunori MIYAZAWA @USAGI 8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 9 * YOSHIFUJI Hideaki @USAGI 10 * IPv6 support 11 */ 12 13 #include <linux/module.h> 14 #include <linux/string.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter_ipv6.h> 17 #include <net/ipv6.h> 18 #include <net/xfrm.h> 19 20 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 21 struct ip6_tnl *t) 22 { 23 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t; 24 XFRM_SPI_SKB_CB(skb)->family = AF_INET6; 25 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); 26 return xfrm_input(skb, nexthdr, spi, 0); 27 } 28 EXPORT_SYMBOL(xfrm6_rcv_spi); 29 30 static int xfrm6_transport_finish2(struct net *net, struct sock *sk, 31 struct sk_buff *skb) 32 { 33 if (xfrm_trans_queue(skb, ip6_rcv_finish)) { 34 kfree_skb(skb); 35 return NET_RX_DROP; 36 } 37 38 return 0; 39 } 40 41 int xfrm6_transport_finish(struct sk_buff *skb, int async) 42 { 43 struct xfrm_offload *xo = xfrm_offload(skb); 44 int nhlen = skb->data - skb_network_header(skb); 45 46 skb_network_header(skb)[IP6CB(skb)->nhoff] = 47 XFRM_MODE_SKB_CB(skb)->protocol; 48 49 #ifndef CONFIG_NETFILTER 50 if (!async) 51 return 1; 52 #endif 53 54 __skb_push(skb, nhlen); 55 ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); 56 skb_postpush_rcsum(skb, skb_network_header(skb), nhlen); 57 58 if (xo && (xo->flags & XFRM_GRO)) { 59 skb_mac_header_rebuild(skb); 60 skb_reset_transport_header(skb); 61 return 0; 62 } 63 64 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, 65 dev_net(skb->dev), NULL, skb, skb->dev, NULL, 66 xfrm6_transport_finish2); 67 return 0; 68 } 69 70 /* If it's a keepalive packet, then just eat it. 71 * If it's an encapsulated packet, then pass it to the 72 * IPsec xfrm input. 73 * Returns 0 if skb passed to xfrm or was dropped. 74 * Returns >0 if skb should be passed to UDP. 75 * Returns <0 if skb should be resubmitted (-ret is protocol) 76 */ 77 int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) 78 { 79 struct udp_sock *up = udp_sk(sk); 80 struct udphdr *uh; 81 struct ipv6hdr *ip6h; 82 int len; 83 int ip6hlen = sizeof(struct ipv6hdr); 84 __u8 *udpdata; 85 __be32 *udpdata32; 86 u16 encap_type; 87 88 if (skb->protocol == htons(ETH_P_IP)) 89 return xfrm4_udp_encap_rcv(sk, skb); 90 91 encap_type = READ_ONCE(up->encap_type); 92 /* if this is not encapsulated socket, then just return now */ 93 if (!encap_type) 94 return 1; 95 96 /* If this is a paged skb, make sure we pull up 97 * whatever data we need to look at. */ 98 len = skb->len - sizeof(struct udphdr); 99 if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) 100 return 1; 101 102 /* Now we can get the pointers */ 103 uh = udp_hdr(skb); 104 udpdata = (__u8 *)uh + sizeof(struct udphdr); 105 udpdata32 = (__be32 *)udpdata; 106 107 switch (encap_type) { 108 default: 109 case UDP_ENCAP_ESPINUDP: 110 /* Check if this is a keepalive packet. If so, eat it. */ 111 if (len == 1 && udpdata[0] == 0xff) { 112 goto drop; 113 } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) { 114 /* ESP Packet without Non-ESP header */ 115 len = sizeof(struct udphdr); 116 } else 117 /* Must be an IKE packet.. pass it through */ 118 return 1; 119 break; 120 case UDP_ENCAP_ESPINUDP_NON_IKE: 121 /* Check if this is a keepalive packet. If so, eat it. */ 122 if (len == 1 && udpdata[0] == 0xff) { 123 goto drop; 124 } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) && 125 udpdata32[0] == 0 && udpdata32[1] == 0) { 126 127 /* ESP Packet with Non-IKE marker */ 128 len = sizeof(struct udphdr) + 2 * sizeof(u32); 129 } else 130 /* Must be an IKE packet.. pass it through */ 131 return 1; 132 break; 133 } 134 135 /* At this point we are sure that this is an ESPinUDP packet, 136 * so we need to remove 'len' bytes from the packet (the UDP 137 * header and optional ESP marker bytes) and then modify the 138 * protocol to ESP, and then call into the transform receiver. 139 */ 140 if (skb_unclone(skb, GFP_ATOMIC)) 141 goto drop; 142 143 /* Now we can update and verify the packet length... */ 144 ip6h = ipv6_hdr(skb); 145 ip6h->payload_len = htons(ntohs(ip6h->payload_len) - len); 146 if (skb->len < ip6hlen + len) { 147 /* packet is too small!?! */ 148 goto drop; 149 } 150 151 /* pull the data buffer up to the ESP header and set the 152 * transport header to point to ESP. Keep UDP on the stack 153 * for later. 154 */ 155 __skb_pull(skb, len); 156 skb_reset_transport_header(skb); 157 158 /* process ESP */ 159 return xfrm6_rcv_encap(skb, IPPROTO_ESP, 0, encap_type); 160 161 drop: 162 kfree_skb(skb); 163 return 0; 164 } 165 166 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t) 167 { 168 return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], 169 0, t); 170 } 171 EXPORT_SYMBOL(xfrm6_rcv_tnl); 172 173 int xfrm6_rcv(struct sk_buff *skb) 174 { 175 return xfrm6_rcv_tnl(skb, NULL); 176 } 177 EXPORT_SYMBOL(xfrm6_rcv); 178 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 179 xfrm_address_t *saddr, u8 proto) 180 { 181 struct net *net = dev_net(skb->dev); 182 struct xfrm_state *x = NULL; 183 struct sec_path *sp; 184 int i = 0; 185 186 sp = secpath_set(skb); 187 if (!sp) { 188 XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR); 189 goto drop; 190 } 191 192 if (1 + sp->len == XFRM_MAX_DEPTH) { 193 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 194 goto drop; 195 } 196 197 for (i = 0; i < 3; i++) { 198 xfrm_address_t *dst, *src; 199 200 switch (i) { 201 case 0: 202 dst = daddr; 203 src = saddr; 204 break; 205 case 1: 206 /* lookup state with wild-card source address */ 207 dst = daddr; 208 src = (xfrm_address_t *)&in6addr_any; 209 break; 210 default: 211 /* lookup state with wild-card addresses */ 212 dst = (xfrm_address_t *)&in6addr_any; 213 src = (xfrm_address_t *)&in6addr_any; 214 break; 215 } 216 217 x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6); 218 if (!x) 219 continue; 220 221 spin_lock(&x->lock); 222 223 if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) && 224 likely(x->km.state == XFRM_STATE_VALID) && 225 !xfrm_state_check_expire(x)) { 226 spin_unlock(&x->lock); 227 if (x->type->input(x, skb) > 0) { 228 /* found a valid state */ 229 break; 230 } 231 } else 232 spin_unlock(&x->lock); 233 234 xfrm_state_put(x); 235 x = NULL; 236 } 237 238 if (!x) { 239 XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); 240 xfrm_audit_state_notfound_simple(skb, AF_INET6); 241 goto drop; 242 } 243 244 sp->xvec[sp->len++] = x; 245 246 spin_lock(&x->lock); 247 248 x->curlft.bytes += skb->len; 249 x->curlft.packets++; 250 251 spin_unlock(&x->lock); 252 253 return 1; 254 255 drop: 256 return -1; 257 } 258 EXPORT_SYMBOL(xfrm6_input_addr); 259