1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c 4 * 5 * Authors: 6 * Mitsuru KANDA @USAGI 7 * Kazunori MIYAZAWA @USAGI 8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 9 * YOSHIFUJI Hideaki @USAGI 10 * IPv6 support 11 */ 12 13 #include <linux/module.h> 14 #include <linux/string.h> 15 #include <linux/netfilter.h> 16 #include <linux/netfilter_ipv6.h> 17 #include <net/ipv6.h> 18 #include <net/xfrm.h> 19 20 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb) 21 { 22 return xfrm6_extract_header(skb); 23 } 24 25 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 26 struct ip6_tnl *t) 27 { 28 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t; 29 XFRM_SPI_SKB_CB(skb)->family = AF_INET6; 30 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); 31 return xfrm_input(skb, nexthdr, spi, 0); 32 } 33 EXPORT_SYMBOL(xfrm6_rcv_spi); 34 35 int xfrm6_transport_finish(struct sk_buff *skb, int async) 36 { 37 struct xfrm_offload *xo = xfrm_offload(skb); 38 int nhlen = skb->data - skb_network_header(skb); 39 40 skb_network_header(skb)[IP6CB(skb)->nhoff] = 41 XFRM_MODE_SKB_CB(skb)->protocol; 42 43 #ifndef CONFIG_NETFILTER 44 if (!async) 45 return 1; 46 #endif 47 48 __skb_push(skb, nhlen); 49 ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); 50 skb_postpush_rcsum(skb, skb_network_header(skb), nhlen); 51 52 if (xo && (xo->flags & XFRM_GRO)) { 53 skb_mac_header_rebuild(skb); 54 return -1; 55 } 56 57 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, 58 dev_net(skb->dev), NULL, skb, skb->dev, NULL, 59 ip6_rcv_finish); 60 return -1; 61 } 62 63 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t) 64 { 65 return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], 66 0, t); 67 } 68 EXPORT_SYMBOL(xfrm6_rcv_tnl); 69 70 int xfrm6_rcv(struct sk_buff *skb) 71 { 72 return xfrm6_rcv_tnl(skb, NULL); 73 } 74 EXPORT_SYMBOL(xfrm6_rcv); 75 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 76 xfrm_address_t *saddr, u8 proto) 77 { 78 struct net *net = dev_net(skb->dev); 79 struct xfrm_state *x = NULL; 80 int i = 0; 81 82 if (secpath_set(skb)) { 83 XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR); 84 goto drop; 85 } 86 87 if (1 + skb->sp->len == XFRM_MAX_DEPTH) { 88 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 89 goto drop; 90 } 91 92 for (i = 0; i < 3; i++) { 93 xfrm_address_t *dst, *src; 94 95 switch (i) { 96 case 0: 97 dst = daddr; 98 src = saddr; 99 break; 100 case 1: 101 /* lookup state with wild-card source address */ 102 dst = daddr; 103 src = (xfrm_address_t *)&in6addr_any; 104 break; 105 default: 106 /* lookup state with wild-card addresses */ 107 dst = (xfrm_address_t *)&in6addr_any; 108 src = (xfrm_address_t *)&in6addr_any; 109 break; 110 } 111 112 x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6); 113 if (!x) 114 continue; 115 116 spin_lock(&x->lock); 117 118 if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) && 119 likely(x->km.state == XFRM_STATE_VALID) && 120 !xfrm_state_check_expire(x)) { 121 spin_unlock(&x->lock); 122 if (x->type->input(x, skb) > 0) { 123 /* found a valid state */ 124 break; 125 } 126 } else 127 spin_unlock(&x->lock); 128 129 xfrm_state_put(x); 130 x = NULL; 131 } 132 133 if (!x) { 134 XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); 135 xfrm_audit_state_notfound_simple(skb, AF_INET6); 136 goto drop; 137 } 138 139 skb->sp->xvec[skb->sp->len++] = x; 140 141 spin_lock(&x->lock); 142 143 x->curlft.bytes += skb->len; 144 x->curlft.packets++; 145 146 spin_unlock(&x->lock); 147 148 return 1; 149 150 drop: 151 return -1; 152 } 153 EXPORT_SYMBOL(xfrm6_input_addr); 154