| 1 | /* |
| 2 | * xfrm4_input.c |
| 3 | * |
| 4 | * Changes: |
| 5 | * YOSHIFUJI Hideaki @USAGI |
| 6 | * Split up af-specific portion |
| 7 | * Derek Atkins <derek@ihtfp.com> |
| 8 | * Add Encapsulation support |
| 9 | * |
| 10 | */ |
| 11 | |
| 12 | #include <linux/module.h> |
| 13 | #include <linux/string.h> |
| 14 | #include <linux/netfilter.h> |
| 15 | #include <linux/netfilter_ipv4.h> |
| 16 | #include <net/ip.h> |
| 17 | #include <net/xfrm.h> |
| 18 | |
| 19 | int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb) |
| 20 | { |
| 21 | return xfrm4_extract_header(skb); |
| 22 | } |
| 23 | |
| 24 | static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb) |
| 25 | { |
| 26 | if (skb->dst == NULL) { |
| 27 | const struct iphdr *iph = ip_hdr(skb); |
| 28 | |
| 29 | if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, |
| 30 | skb->dev)) |
| 31 | goto drop; |
| 32 | } |
| 33 | return dst_input(skb); |
| 34 | drop: |
| 35 | kfree_skb(skb); |
| 36 | return NET_RX_DROP; |
| 37 | } |
| 38 | |
| 39 | int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, |
| 40 | int encap_type) |
| 41 | { |
| 42 | XFRM_SPI_SKB_CB(skb)->family = AF_INET; |
| 43 | XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); |
| 44 | return xfrm_input(skb, nexthdr, spi, encap_type); |
| 45 | } |
| 46 | EXPORT_SYMBOL(xfrm4_rcv_encap); |
| 47 | |
| 48 | int xfrm4_transport_finish(struct sk_buff *skb, int async) |
| 49 | { |
| 50 | struct iphdr *iph = ip_hdr(skb); |
| 51 | |
| 52 | iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol; |
| 53 | |
| 54 | #ifndef CONFIG_NETFILTER |
| 55 | if (!async) |
| 56 | return -iph->protocol; |
| 57 | #endif |
| 58 | |
| 59 | __skb_push(skb, skb->data - skb_network_header(skb)); |
| 60 | iph->tot_len = htons(skb->len); |
| 61 | ip_send_check(iph); |
| 62 | |
| 63 | NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL, |
| 64 | xfrm4_rcv_encap_finish); |
| 65 | return 0; |
| 66 | } |
| 67 | |
| 68 | /* If it's a keepalive packet, then just eat it. |
| 69 | * If it's an encapsulated packet, then pass it to the |
| 70 | * IPsec xfrm input. |
| 71 | * Returns 0 if skb passed to xfrm or was dropped. |
| 72 | * Returns >0 if skb should be passed to UDP. |
| 73 | * Returns <0 if skb should be resubmitted (-ret is protocol) |
| 74 | */ |
| 75 | int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) |
| 76 | { |
| 77 | struct udp_sock *up = udp_sk(sk); |
| 78 | struct udphdr *uh; |
| 79 | struct iphdr *iph; |
| 80 | int iphlen, len; |
| 81 | int ret; |
| 82 | |
| 83 | __u8 *udpdata; |
| 84 | __be32 *udpdata32; |
| 85 | __u16 encap_type = up->encap_type; |
| 86 | |
| 87 | /* if this is not encapsulated socket, then just return now */ |
| 88 | if (!encap_type) |
| 89 | return 1; |
| 90 | |
| 91 | /* If this is a paged skb, make sure we pull up |
| 92 | * whatever data we need to look at. */ |
| 93 | len = skb->len - sizeof(struct udphdr); |
| 94 | if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) |
| 95 | return 1; |
| 96 | |
| 97 | /* Now we can get the pointers */ |
| 98 | uh = udp_hdr(skb); |
| 99 | udpdata = (__u8 *)uh + sizeof(struct udphdr); |
| 100 | udpdata32 = (__be32 *)udpdata; |
| 101 | |
| 102 | switch (encap_type) { |
| 103 | default: |
| 104 | case UDP_ENCAP_ESPINUDP: |
| 105 | /* Check if this is a keepalive packet. If so, eat it. */ |
| 106 | if (len == 1 && udpdata[0] == 0xff) { |
| 107 | goto drop; |
| 108 | } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) { |
| 109 | /* ESP Packet without Non-ESP header */ |
| 110 | len = sizeof(struct udphdr); |
| 111 | } else |
| 112 | /* Must be an IKE packet.. pass it through */ |
| 113 | return 1; |
| 114 | break; |
| 115 | case UDP_ENCAP_ESPINUDP_NON_IKE: |
| 116 | /* Check if this is a keepalive packet. If so, eat it. */ |
| 117 | if (len == 1 && udpdata[0] == 0xff) { |
| 118 | goto drop; |
| 119 | } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) && |
| 120 | udpdata32[0] == 0 && udpdata32[1] == 0) { |
| 121 | |
| 122 | /* ESP Packet with Non-IKE marker */ |
| 123 | len = sizeof(struct udphdr) + 2 * sizeof(u32); |
| 124 | } else |
| 125 | /* Must be an IKE packet.. pass it through */ |
| 126 | return 1; |
| 127 | break; |
| 128 | } |
| 129 | |
| 130 | /* At this point we are sure that this is an ESPinUDP packet, |
| 131 | * so we need to remove 'len' bytes from the packet (the UDP |
| 132 | * header and optional ESP marker bytes) and then modify the |
| 133 | * protocol to ESP, and then call into the transform receiver. |
| 134 | */ |
| 135 | if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) |
| 136 | goto drop; |
| 137 | |
| 138 | /* Now we can update and verify the packet length... */ |
| 139 | iph = ip_hdr(skb); |
| 140 | iphlen = iph->ihl << 2; |
| 141 | iph->tot_len = htons(ntohs(iph->tot_len) - len); |
| 142 | if (skb->len < iphlen + len) { |
| 143 | /* packet is too small!?! */ |
| 144 | goto drop; |
| 145 | } |
| 146 | |
| 147 | /* pull the data buffer up to the ESP header and set the |
| 148 | * transport header to point to ESP. Keep UDP on the stack |
| 149 | * for later. |
| 150 | */ |
| 151 | __skb_pull(skb, len); |
| 152 | skb_reset_transport_header(skb); |
| 153 | |
| 154 | /* process ESP */ |
| 155 | ret = xfrm4_rcv_encap(skb, IPPROTO_ESP, 0, encap_type); |
| 156 | return ret; |
| 157 | |
| 158 | drop: |
| 159 | kfree_skb(skb); |
| 160 | return 0; |
| 161 | } |
| 162 | |
| 163 | int xfrm4_rcv(struct sk_buff *skb) |
| 164 | { |
| 165 | return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0); |
| 166 | } |
| 167 | |
| 168 | EXPORT_SYMBOL(xfrm4_rcv); |