Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* |
2 | * xfrm6_input.c: based on net/ipv4/xfrm4_input.c | |
3 | * | |
4 | * Authors: | |
5 | * Mitsuru KANDA @USAGI | |
6 | * Kazunori MIYAZAWA @USAGI | |
7 | * Kunihiro Ishiguro <kunihiro@ipinfusion.com> | |
8 | * YOSHIFUJI Hideaki @USAGI | |
9 | * IPv6 support | |
10 | */ | |
11 | ||
12 | #include <linux/module.h> | |
13 | #include <linux/string.h> | |
b05e1066 PM |
14 | #include <linux/netfilter.h> |
15 | #include <linux/netfilter_ipv6.h> | |
1da177e4 LT |
16 | #include <net/ipv6.h> |
17 | #include <net/xfrm.h> | |
18 | ||
227620e2 HX |
19 | int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb) |
20 | { | |
21 | return xfrm6_extract_header(skb); | |
22 | } | |
23 | ||
33b5ecb8 | 24 | int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi) |
1da177e4 | 25 | { |
716062fd HX |
26 | XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); |
27 | return xfrm_input(skb, nexthdr, spi, 0); | |
28 | } | |
29 | EXPORT_SYMBOL(xfrm6_rcv_spi); | |
b05e1066 | 30 | |
716062fd HX |
31 | int xfrm6_transport_finish(struct sk_buff *skb, int async) |
32 | { | |
60d5fcfb HX |
33 | skb_network_header(skb)[IP6CB(skb)->nhoff] = |
34 | XFRM_MODE_SKB_CB(skb)->protocol; | |
35 | ||
b05e1066 | 36 | #ifdef CONFIG_NETFILTER |
716062fd HX |
37 | ipv6_hdr(skb)->payload_len = htons(skb->len); |
38 | __skb_push(skb, skb->data - skb_network_header(skb)); | |
b05e1066 | 39 | |
716062fd HX |
40 | NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL, |
41 | ip6_rcv_finish); | |
42 | return -1; | |
b05e1066 | 43 | #else |
716062fd | 44 | return 1; |
b05e1066 | 45 | #endif |
1da177e4 LT |
46 | } |
47 | ||
e5bbef20 | 48 | int xfrm6_rcv(struct sk_buff *skb) |
1da177e4 | 49 | { |
33b5ecb8 HX |
50 | return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], |
51 | 0); | |
1da177e4 | 52 | } |
fbd9a5b4 | 53 | |
7159039a YH |
54 | EXPORT_SYMBOL(xfrm6_rcv); |
55 | ||
fbd9a5b4 MN |
56 | int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, |
57 | xfrm_address_t *saddr, u8 proto) | |
58 | { | |
1ab1457c YH |
59 | struct xfrm_state *x = NULL; |
60 | int wildcard = 0; | |
fbd9a5b4 MN |
61 | xfrm_address_t *xany; |
62 | struct xfrm_state *xfrm_vec_one = NULL; | |
1ab1457c | 63 | int nh = 0; |
fbd9a5b4 MN |
64 | int i = 0; |
65 | ||
c53b3590 | 66 | xany = (xfrm_address_t *)&in6addr_any; |
fbd9a5b4 MN |
67 | |
68 | for (i = 0; i < 3; i++) { | |
69 | xfrm_address_t *dst, *src; | |
70 | switch (i) { | |
71 | case 0: | |
72 | dst = daddr; | |
73 | src = saddr; | |
74 | break; | |
75 | case 1: | |
76 | /* lookup state with wild-card source address */ | |
77 | wildcard = 1; | |
78 | dst = daddr; | |
79 | src = xany; | |
80 | break; | |
81 | case 2: | |
82 | default: | |
1ab1457c | 83 | /* lookup state with wild-card addresses */ |
fbd9a5b4 MN |
84 | wildcard = 1; /* XXX */ |
85 | dst = xany; | |
86 | src = xany; | |
87 | break; | |
1ab1457c | 88 | } |
fbd9a5b4 MN |
89 | |
90 | x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6); | |
91 | if (!x) | |
92 | continue; | |
93 | ||
94 | spin_lock(&x->lock); | |
95 | ||
96 | if (wildcard) { | |
97 | if ((x->props.flags & XFRM_STATE_WILDRECV) == 0) { | |
98 | spin_unlock(&x->lock); | |
99 | xfrm_state_put(x); | |
100 | x = NULL; | |
101 | continue; | |
102 | } | |
103 | } | |
104 | ||
105 | if (unlikely(x->km.state != XFRM_STATE_VALID)) { | |
106 | spin_unlock(&x->lock); | |
107 | xfrm_state_put(x); | |
1ab1457c YH |
108 | x = NULL; |
109 | continue; | |
fbd9a5b4 MN |
110 | } |
111 | if (xfrm_state_check_expire(x)) { | |
112 | spin_unlock(&x->lock); | |
113 | xfrm_state_put(x); | |
114 | x = NULL; | |
115 | continue; | |
116 | } | |
117 | ||
118 | nh = x->type->input(x, skb); | |
119 | if (nh <= 0) { | |
120 | spin_unlock(&x->lock); | |
121 | xfrm_state_put(x); | |
122 | x = NULL; | |
123 | continue; | |
124 | } | |
125 | ||
126 | x->curlft.bytes += skb->len; | |
127 | x->curlft.packets++; | |
128 | ||
129 | spin_unlock(&x->lock); | |
130 | ||
131 | xfrm_vec_one = x; | |
132 | break; | |
133 | } | |
134 | ||
135 | if (!xfrm_vec_one) | |
136 | goto drop; | |
137 | ||
138 | /* Allocate new secpath or COW existing one. */ | |
139 | if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) { | |
140 | struct sec_path *sp; | |
141 | sp = secpath_dup(skb->sp); | |
142 | if (!sp) | |
143 | goto drop; | |
144 | if (skb->sp) | |
145 | secpath_put(skb->sp); | |
146 | skb->sp = sp; | |
147 | } | |
148 | ||
149 | if (1 + skb->sp->len > XFRM_MAX_DEPTH) | |
150 | goto drop; | |
151 | ||
152 | skb->sp->xvec[skb->sp->len] = xfrm_vec_one; | |
153 | skb->sp->len ++; | |
154 | ||
155 | return 1; | |
156 | drop: | |
157 | if (xfrm_vec_one) | |
158 | xfrm_state_put(xfrm_vec_one); | |
159 | return -1; | |
160 | } | |
7159039a YH |
161 | |
162 | EXPORT_SYMBOL(xfrm6_input_addr); |