[linux-2.6-block.git] / net / ipv4 / xfrm4_input.c

/*
 * xfrm4_input.c
 *
 * Changes:
 *	YOSHIFUJI Hideaki @USAGI
 *		Split up af-specific portion
 *	Derek Atkins <derek@ihtfp.com>
 *		Add Encapsulation support
 *
 */

#include <linux/module.h>
#include <linux/string.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <net/ip.h>
#include <net/xfrm.h>

int xfrm4_rcv(struct sk_buff *skb)
{
	return xfrm4_rcv_encap(skb, 0);
}

EXPORT_SYMBOL(xfrm4_rcv);

static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
{
	switch (nexthdr) {
	case IPPROTO_IPIP:
	case IPPROTO_IPV6:
		*spi = skb->nh.iph->saddr;
		*seq = 0;
		return 0;
	}

	return xfrm_parse_spi(skb, nexthdr, spi, seq);
}

#ifdef CONFIG_NETFILTER
static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)
{
	struct iphdr *iph = skb->nh.iph;

	if (skb->dst == NULL) {
		if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
				   skb->dev))
			goto drop;
	}
	return dst_input(skb);
drop:
	kfree_skb(skb);
	return NET_RX_DROP;
}
#endif

int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
{
	int err;
	__be32 spi, seq;
	struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
	struct xfrm_state *x;
	int xfrm_nr = 0;
	int decaps = 0;

	if ((err = xfrm4_parse_spi(skb, skb->nh.iph->protocol, &spi, &seq)) != 0)
		goto drop;

	do {
		struct iphdr *iph = skb->nh.iph;

		if (xfrm_nr == XFRM_MAX_DEPTH)
			goto drop;

		x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,
				iph->protocol != IPPROTO_IPV6 ? iph->protocol : IPPROTO_IPIP, AF_INET);
		if (x == NULL)
			goto drop;

		spin_lock(&x->lock);
		if (unlikely(x->km.state != XFRM_STATE_VALID))
			goto drop_unlock;

		if ((x->encap ? x->encap->encap_type : 0) != encap_type)
			goto drop_unlock;

		if (x->props.replay_window && xfrm_replay_check(x, seq))
			goto drop_unlock;

		if (xfrm_state_check_expire(x))
			goto drop_unlock;

		if (x->type->input(x, skb))
			goto drop_unlock;

		/* only the first xfrm gets the encap type */
		encap_type = 0;

		if (x->props.replay_window)
			xfrm_replay_advance(x, seq);

		x->curlft.bytes += skb->len;
		x->curlft.packets++;

		spin_unlock(&x->lock);

		xfrm_vec[xfrm_nr++] = x;

		if (x->mode->input(x, skb))
			goto drop;

		if (x->props.mode == XFRM_MODE_TUNNEL) {
			decaps = 1;
			break;
		}

		if ((err = xfrm_parse_spi(skb, skb->nh.iph->protocol, &spi, &seq)) < 0)
			goto drop;
	} while (!err);

	/* Allocate new secpath or COW existing one. */

	if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
		struct sec_path *sp;
		sp = secpath_dup(skb->sp);
		if (!sp)
			goto drop;
		if (skb->sp)
			secpath_put(skb->sp);
		skb->sp = sp;
	}
	if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
		goto drop;

	memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
	       xfrm_nr * sizeof(xfrm_vec[0]));
	skb->sp->len += xfrm_nr;

	nf_reset(skb);

	if (decaps) {
		if (!(skb->dev->flags&IFF_LOOPBACK)) {
			dst_release(skb->dst);
			skb->dst = NULL;
		}
		netif_rx(skb);
		return 0;
	} else {
#ifdef CONFIG_NETFILTER
		__skb_push(skb, skb->data - skb->nh.raw);
		skb->nh.iph->tot_len = htons(skb->len);
		ip_send_check(skb->nh.iph);

		NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
			xfrm4_rcv_encap_finish);
		return 0;
#else
		return -skb->nh.iph->protocol;
#endif
	}

drop_unlock:
	spin_unlock(&x->lock);
	xfrm_state_put(x);
drop:
	while (--xfrm_nr >= 0)
		xfrm_state_put(xfrm_vec[xfrm_nr]);

	kfree_skb(skb);
	return 0;
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	* xfrm4_input.c
	3	*
	4	* Changes:
	5	* YOSHIFUJI Hideaki @USAGI
	6	* Split up af-specific portion
	7	* Derek Atkins <derek@ihtfp.com>
	8	* Add Encapsulation support
e905a9ed	9	*
1da177e4 LT	10	*/
	11
	12	#include <linux/module.h>
	13	#include <linux/string.h>
b05e1066 PM	14	#include <linux/netfilter.h>
b05e1066 PM	15	#include <linux/netfilter_ipv4.h>
1da177e4 LT	16	#include <net/ip.h>
	17	#include <net/xfrm.h>
	18
	19	int xfrm4_rcv(struct sk_buff *skb)
	20	{
	21	return xfrm4_rcv_encap(skb, 0);
	22	}
	23
	24	EXPORT_SYMBOL(xfrm4_rcv);
	25
6067b2ba	26	static int xfrm4_parse_spi(struct sk_buff skb, u8 nexthdr, __be32 spi, __be32 *seq)
1da177e4 LT	27	{
	28	switch (nexthdr) {
	29	case IPPROTO_IPIP:
c0d56408	30	case IPPROTO_IPV6:
1da177e4 LT	31	*spi = skb->nh.iph->saddr;
	32	*seq = 0;
	33	return 0;
	34	}
	35
	36	return xfrm_parse_spi(skb, nexthdr, spi, seq);
	37	}
	38
b05e1066 PM	39	#ifdef CONFIG_NETFILTER
	40	static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)
	41	{
	42	struct iphdr *iph = skb->nh.iph;
	43
	44	if (skb->dst == NULL) {
	45	if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
e905a9ed	46	skb->dev))
b05e1066 PM	47	goto drop;
	48	}
	49	return dst_input(skb);
	50	drop:
	51	kfree_skb(skb);
	52	return NET_RX_DROP;
	53	}
	54	#endif
	55
1da177e4 LT	56	int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
	57	{
	58	int err;
6067b2ba	59	__be32 spi, seq;
dbe5b4aa	60	struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
1da177e4 LT	61	struct xfrm_state *x;
	62	int xfrm_nr = 0;
	63	int decaps = 0;
	64
	65	if ((err = xfrm4_parse_spi(skb, skb->nh.iph->protocol, &spi, &seq)) != 0)
	66	goto drop;
	67
	68	do {
	69	struct iphdr *iph = skb->nh.iph;
	70
	71	if (xfrm_nr == XFRM_MAX_DEPTH)
	72	goto drop;
	73
c0d56408 KM	74	x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,
c0d56408 KM	75	iph->protocol != IPPROTO_IPV6 ? iph->protocol : IPPROTO_IPIP, AF_INET);
1da177e4 LT	76	if (x == NULL)
	77	goto drop;
	78
	79	spin_lock(&x->lock);
	80	if (unlikely(x->km.state != XFRM_STATE_VALID))
	81	goto drop_unlock;
	82
8bf4b8a1	83	if ((x->encap ? x->encap->encap_type : 0) != encap_type)
e695633e HX	84	goto drop_unlock;
e695633e HX	85
1da177e4 LT	86	if (x->props.replay_window && xfrm_replay_check(x, seq))
	87	goto drop_unlock;
	88
	89	if (xfrm_state_check_expire(x))
	90	goto drop_unlock;
	91
e695633e	92	if (x->type->input(x, skb))
1da177e4 LT	93	goto drop_unlock;
	94
	95	/* only the first xfrm gets the encap type */
	96	encap_type = 0;
	97
	98	if (x->props.replay_window)
	99	xfrm_replay_advance(x, seq);
	100
	101	x->curlft.bytes += skb->len;
	102	x->curlft.packets++;
	103
	104	spin_unlock(&x->lock);
	105
dbe5b4aa	106	xfrm_vec[xfrm_nr++] = x;
1da177e4	107
b59f45d0 HX	108	if (x->mode->input(x, skb))
b59f45d0 HX	109	goto drop;
1da177e4	110
7e49e6de	111	if (x->props.mode == XFRM_MODE_TUNNEL) {
1da177e4 LT	112	decaps = 1;
	113	break;
	114	}
	115
	116	if ((err = xfrm_parse_spi(skb, skb->nh.iph->protocol, &spi, &seq)) < 0)
	117	goto drop;
	118	} while (!err);
	119
	120	/* Allocate new secpath or COW existing one. */
	121
	122	if (!skb->sp \|\| atomic_read(&skb->sp->refcnt) != 1) {
	123	struct sec_path *sp;
	124	sp = secpath_dup(skb->sp);
	125	if (!sp)
	126	goto drop;
	127	if (skb->sp)
	128	secpath_put(skb->sp);
	129	skb->sp = sp;
	130	}
	131	if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
	132	goto drop;
	133
dbe5b4aa HX	134	memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
dbe5b4aa HX	135	xfrm_nr * sizeof(xfrm_vec[0]));
1da177e4 LT	136	skb->sp->len += xfrm_nr;
1da177e4 LT	137
b05e1066 PM	138	nf_reset(skb);
b05e1066 PM	139
1da177e4 LT	140	if (decaps) {
	141	if (!(skb->dev->flags&IFF_LOOPBACK)) {
	142	dst_release(skb->dst);
	143	skb->dst = NULL;
	144	}
	145	netif_rx(skb);
	146	return 0;
	147	} else {
b05e1066 PM	148	#ifdef CONFIG_NETFILTER
	149	__skb_push(skb, skb->data - skb->nh.raw);
	150	skb->nh.iph->tot_len = htons(skb->len);
	151	ip_send_check(skb->nh.iph);
	152
	153	NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,
e905a9ed	154	xfrm4_rcv_encap_finish);
b05e1066 PM	155	return 0;
b05e1066 PM	156	#else
1da177e4	157	return -skb->nh.iph->protocol;
b05e1066	158	#endif
1da177e4 LT	159	}
	160
	161	drop_unlock:
	162	spin_unlock(&x->lock);
	163	xfrm_state_put(x);
	164	drop:
	165	while (--xfrm_nr >= 0)
dbe5b4aa	166	xfrm_state_put(xfrm_vec[xfrm_nr]);
1da177e4 LT	167
	168	kfree_skb(skb);
	169	return 0;
	170	}