1 /* 2 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c 3 * 4 * Authors: 5 * Mitsuru KANDA @USAGI 6 * Kazunori MIYAZAWA @USAGI 7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com> 8 * YOSHIFUJI Hideaki @USAGI 9 * IPv6 support 10 */ 11 12 #include <linux/module.h> 13 #include <linux/string.h> 14 #include <linux/netfilter.h> 15 #include <linux/netfilter_ipv6.h> 16 #include <net/ipv6.h> 17 #include <net/xfrm.h> 18 19 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb) 20 { 21 return xfrm6_extract_header(skb); 22 } 23 24 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, 25 struct ip6_tnl *t) 26 { 27 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t; 28 XFRM_SPI_SKB_CB(skb)->family = AF_INET6; 29 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); 30 return xfrm_input(skb, nexthdr, spi, 0); 31 } 32 EXPORT_SYMBOL(xfrm6_rcv_spi); 33 34 int xfrm6_transport_finish(struct sk_buff *skb, int async) 35 { 36 struct xfrm_offload *xo = xfrm_offload(skb); 37 int nhlen = skb->data - skb_network_header(skb); 38 39 skb_network_header(skb)[IP6CB(skb)->nhoff] = 40 XFRM_MODE_SKB_CB(skb)->protocol; 41 42 #ifndef CONFIG_NETFILTER 43 if (!async) 44 return 1; 45 #endif 46 47 __skb_push(skb, nhlen); 48 ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); 49 skb_postpush_rcsum(skb, skb_network_header(skb), nhlen); 50 51 if (xo && (xo->flags & XFRM_GRO)) { 52 skb_mac_header_rebuild(skb); 53 return -1; 54 } 55 56 NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, 57 dev_net(skb->dev), NULL, skb, skb->dev, NULL, 58 ip6_rcv_finish); 59 return -1; 60 } 61 62 int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t) 63 { 64 return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], 65 0, t); 66 } 67 EXPORT_SYMBOL(xfrm6_rcv_tnl); 68 69 int xfrm6_rcv(struct sk_buff *skb) 70 { 71 return xfrm6_rcv_tnl(skb, NULL); 72 } 73 EXPORT_SYMBOL(xfrm6_rcv); 74 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, 75 xfrm_address_t *saddr, u8 proto) 76 { 77 struct net *net = dev_net(skb->dev); 78 struct xfrm_state *x = NULL; 79 int i = 0; 80 81 if (secpath_set(skb)) { 82 XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR); 83 goto drop; 84 } 85 86 if (1 + skb->sp->len == XFRM_MAX_DEPTH) { 87 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); 88 goto drop; 89 } 90 91 for (i = 0; i < 3; i++) { 92 xfrm_address_t *dst, *src; 93 94 switch (i) { 95 case 0: 96 dst = daddr; 97 src = saddr; 98 break; 99 case 1: 100 /* lookup state with wild-card source address */ 101 dst = daddr; 102 src = (xfrm_address_t *)&in6addr_any; 103 break; 104 default: 105 /* lookup state with wild-card addresses */ 106 dst = (xfrm_address_t *)&in6addr_any; 107 src = (xfrm_address_t *)&in6addr_any; 108 break; 109 } 110 111 x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6); 112 if (!x) 113 continue; 114 115 spin_lock(&x->lock); 116 117 if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) && 118 likely(x->km.state == XFRM_STATE_VALID) && 119 !xfrm_state_check_expire(x)) { 120 spin_unlock(&x->lock); 121 if (x->type->input(x, skb) > 0) { 122 /* found a valid state */ 123 break; 124 } 125 } else 126 spin_unlock(&x->lock); 127 128 xfrm_state_put(x); 129 x = NULL; 130 } 131 132 if (!x) { 133 XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); 134 xfrm_audit_state_notfound_simple(skb, AF_INET6); 135 goto drop; 136 } 137 138 skb->sp->xvec[skb->sp->len++] = x; 139 140 spin_lock(&x->lock); 141 142 x->curlft.bytes += skb->len; 143 x->curlft.packets++; 144 145 spin_unlock(&x->lock); 146 147 return 1; 148 149 drop: 150 return -1; 151 } 152 EXPORT_SYMBOL(xfrm6_input_addr); 153