/net/ipv6/xfrm6_input.c

http://github.com/mirrors/linux · C · 164 lines · 123 code · 27 blank · 14 comment · 15 complexity · 075f17735dec4e8734f389651c39993b MD5 · raw file

  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
  4. *
  5. * Authors:
  6. * Mitsuru KANDA @USAGI
  7. * Kazunori MIYAZAWA @USAGI
  8. * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  9. * YOSHIFUJI Hideaki @USAGI
  10. * IPv6 support
  11. */
  12. #include <linux/module.h>
  13. #include <linux/string.h>
  14. #include <linux/netfilter.h>
  15. #include <linux/netfilter_ipv6.h>
  16. #include <net/ipv6.h>
  17. #include <net/xfrm.h>
  18. int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
  19. {
  20. return xfrm6_extract_header(skb);
  21. }
  22. int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
  23. struct ip6_tnl *t)
  24. {
  25. XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
  26. XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
  27. XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
  28. return xfrm_input(skb, nexthdr, spi, 0);
  29. }
  30. EXPORT_SYMBOL(xfrm6_rcv_spi);
  31. static int xfrm6_transport_finish2(struct net *net, struct sock *sk,
  32. struct sk_buff *skb)
  33. {
  34. if (xfrm_trans_queue(skb, ip6_rcv_finish))
  35. __kfree_skb(skb);
  36. return -1;
  37. }
  38. int xfrm6_transport_finish(struct sk_buff *skb, int async)
  39. {
  40. struct xfrm_offload *xo = xfrm_offload(skb);
  41. int nhlen = skb->data - skb_network_header(skb);
  42. skb_network_header(skb)[IP6CB(skb)->nhoff] =
  43. XFRM_MODE_SKB_CB(skb)->protocol;
  44. #ifndef CONFIG_NETFILTER
  45. if (!async)
  46. return 1;
  47. #endif
  48. __skb_push(skb, nhlen);
  49. ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
  50. skb_postpush_rcsum(skb, skb_network_header(skb), nhlen);
  51. if (xo && (xo->flags & XFRM_GRO)) {
  52. skb_mac_header_rebuild(skb);
  53. skb_reset_transport_header(skb);
  54. return -1;
  55. }
  56. NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
  57. dev_net(skb->dev), NULL, skb, skb->dev, NULL,
  58. xfrm6_transport_finish2);
  59. return -1;
  60. }
  61. int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t)
  62. {
  63. return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
  64. 0, t);
  65. }
  66. EXPORT_SYMBOL(xfrm6_rcv_tnl);
  67. int xfrm6_rcv(struct sk_buff *skb)
  68. {
  69. return xfrm6_rcv_tnl(skb, NULL);
  70. }
  71. EXPORT_SYMBOL(xfrm6_rcv);
  72. int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
  73. xfrm_address_t *saddr, u8 proto)
  74. {
  75. struct net *net = dev_net(skb->dev);
  76. struct xfrm_state *x = NULL;
  77. struct sec_path *sp;
  78. int i = 0;
  79. sp = secpath_set(skb);
  80. if (!sp) {
  81. XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
  82. goto drop;
  83. }
  84. if (1 + sp->len == XFRM_MAX_DEPTH) {
  85. XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
  86. goto drop;
  87. }
  88. for (i = 0; i < 3; i++) {
  89. xfrm_address_t *dst, *src;
  90. switch (i) {
  91. case 0:
  92. dst = daddr;
  93. src = saddr;
  94. break;
  95. case 1:
  96. /* lookup state with wild-card source address */
  97. dst = daddr;
  98. src = (xfrm_address_t *)&in6addr_any;
  99. break;
  100. default:
  101. /* lookup state with wild-card addresses */
  102. dst = (xfrm_address_t *)&in6addr_any;
  103. src = (xfrm_address_t *)&in6addr_any;
  104. break;
  105. }
  106. x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6);
  107. if (!x)
  108. continue;
  109. spin_lock(&x->lock);
  110. if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) &&
  111. likely(x->km.state == XFRM_STATE_VALID) &&
  112. !xfrm_state_check_expire(x)) {
  113. spin_unlock(&x->lock);
  114. if (x->type->input(x, skb) > 0) {
  115. /* found a valid state */
  116. break;
  117. }
  118. } else
  119. spin_unlock(&x->lock);
  120. xfrm_state_put(x);
  121. x = NULL;
  122. }
  123. if (!x) {
  124. XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
  125. xfrm_audit_state_notfound_simple(skb, AF_INET6);
  126. goto drop;
  127. }
  128. sp->xvec[sp->len++] = x;
  129. spin_lock(&x->lock);
  130. x->curlft.bytes += skb->len;
  131. x->curlft.packets++;
  132. spin_unlock(&x->lock);
  133. return 1;
  134. drop:
  135. return -1;
  136. }
  137. EXPORT_SYMBOL(xfrm6_input_addr);