[mirror_ubuntu-bionic-kernel.git] / net / ipv6 / xfrm6_input.c

/*
 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
 *
 * Authors:
 *	Mitsuru KANDA @USAGI
 *	Kazunori MIYAZAWA @USAGI
 *	Kunihiro Ishiguro <kunihiro@ipinfusion.com>
 *	YOSHIFUJI Hideaki @USAGI
 *		IPv6 support
 */

#include <linux/module.h>
#include <linux/string.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>
#include <net/ipv6.h>
#include <net/xfrm.h>

int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
{
	return xfrm6_extract_header(skb);
}

int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
		  struct ip6_tnl *t)
{
	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
	XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
	return xfrm_input(skb, nexthdr, spi, 0);
}
EXPORT_SYMBOL(xfrm6_rcv_spi);

int xfrm6_transport_finish(struct sk_buff *skb, int async)
{
	struct xfrm_offload *xo = xfrm_offload(skb);

	skb_network_header(skb)[IP6CB(skb)->nhoff] =
		XFRM_MODE_SKB_CB(skb)->protocol;

#ifndef CONFIG_NETFILTER
	if (!async)
		return 1;
#endif

	ipv6_hdr(skb)->payload_len = htons(skb->len);
	__skb_push(skb, skb->data - skb_network_header(skb));

	if (xo && (xo->flags & XFRM_GRO)) {
		skb_mac_header_rebuild(skb);
		return -1;
	}

	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
		dev_net(skb->dev), NULL, skb, skb->dev, NULL,
		ip6_rcv_finish);
	return -1;
}

int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t)
{
	return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
			     0, t);
}
EXPORT_SYMBOL(xfrm6_rcv_tnl);

int xfrm6_rcv(struct sk_buff *skb)
{
	return xfrm6_rcv_tnl(skb, NULL);
}
EXPORT_SYMBOL(xfrm6_rcv);
int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
		     xfrm_address_t *saddr, u8 proto)
{
	struct net *net = dev_net(skb->dev);
	struct xfrm_state *x = NULL;
	int i = 0;

	if (secpath_set(skb)) {
		XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
		goto drop;
	}

	if (1 + skb->sp->len == XFRM_MAX_DEPTH) {
		XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
		goto drop;
	}

	for (i = 0; i < 3; i++) {
		xfrm_address_t *dst, *src;

		switch (i) {
		case 0:
			dst = daddr;
			src = saddr;
			break;
		case 1:
			/* lookup state with wild-card source address */
			dst = daddr;
			src = (xfrm_address_t *)&in6addr_any;
			break;
		default:
			/* lookup state with wild-card addresses */
			dst = (xfrm_address_t *)&in6addr_any;
			src = (xfrm_address_t *)&in6addr_any;
			break;
		}

		x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6);
		if (!x)
			continue;

		spin_lock(&x->lock);

		if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) &&
		    likely(x->km.state == XFRM_STATE_VALID) &&
		    !xfrm_state_check_expire(x)) {
			spin_unlock(&x->lock);
			if (x->type->input(x, skb) > 0) {
				/* found a valid state */
				break;
			}
		} else
			spin_unlock(&x->lock);

		xfrm_state_put(x);
		x = NULL;
	}

	if (!x) {
		XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
		xfrm_audit_state_notfound_simple(skb, AF_INET6);
		goto drop;
	}

	skb->sp->xvec[skb->sp->len++] = x;

	spin_lock(&x->lock);

	x->curlft.bytes += skb->len;
	x->curlft.packets++;

	spin_unlock(&x->lock);

	return 1;

drop:
	return -1;
}
EXPORT_SYMBOL(xfrm6_input_addr);
Commit	Line	Data
1da177e4 LT	1	/*
	2	* xfrm6_input.c: based on net/ipv4/xfrm4_input.c
	3	*
	4	* Authors:
	5	* Mitsuru KANDA @USAGI
67ba4152 IM	6	* Kazunori MIYAZAWA @USAGI
67ba4152 IM	7	* Kunihiro Ishiguro <kunihiro@ipinfusion.com>
1da177e4 LT	8	* YOSHIFUJI Hideaki @USAGI
	9	* IPv6 support
	10	*/
	11
	12	#include <linux/module.h>
	13	#include <linux/string.h>
b05e1066 PM	14	#include <linux/netfilter.h>
b05e1066 PM	15	#include <linux/netfilter_ipv6.h>
1da177e4 LT	16	#include <net/ipv6.h>
	17	#include <net/xfrm.h>
	18
227620e2 HX	19	int xfrm6_extract_input(struct xfrm_state x, struct sk_buff skb)
	20	{
	21	return xfrm6_extract_header(skb);
	22	}
	23
63c43787 ND	24	int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
63c43787 ND	25	struct ip6_tnl *t)
1da177e4	26	{
63c43787	27	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
2fcb45b6	28	XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
716062fd HX	29	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
	30	return xfrm_input(skb, nexthdr, spi, 0);
	31	}
	32	EXPORT_SYMBOL(xfrm6_rcv_spi);
b05e1066	33
716062fd HX	34	int xfrm6_transport_finish(struct sk_buff *skb, int async)
716062fd HX	35	{
7785bba2 SK	36	struct xfrm_offload *xo = xfrm_offload(skb);
7785bba2 SK	37
60d5fcfb HX	38	skb_network_header(skb)[IP6CB(skb)->nhoff] =
	39	XFRM_MODE_SKB_CB(skb)->protocol;
	40
0883ae0e HX	41	#ifndef CONFIG_NETFILTER
	42	if (!async)
	43	return 1;
	44	#endif
	45
716062fd HX	46	ipv6_hdr(skb)->payload_len = htons(skb->len);
716062fd HX	47	__skb_push(skb, skb->data - skb_network_header(skb));
b05e1066	48
7785bba2 SK	49	if (xo && (xo->flags & XFRM_GRO)) {
	50	skb_mac_header_rebuild(skb);
	51	return -1;
	52	}
	53
29a26a56 EB	54	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
29a26a56 EB	55	dev_net(skb->dev), NULL, skb, skb->dev, NULL,
716062fd HX	56	ip6_rcv_finish);
716062fd HX	57	return -1;
1da177e4 LT	58	}
1da177e4 LT	59
63c43787	60	int xfrm6_rcv_tnl(struct sk_buff skb, struct ip6_tnl t)
1da177e4	61	{
33b5ecb8	62	return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
63c43787	63	0, t);
1da177e4	64	}
63c43787	65	EXPORT_SYMBOL(xfrm6_rcv_tnl);
7159039a	66
63c43787 ND	67	int xfrm6_rcv(struct sk_buff *skb)
	68	{
	69	return xfrm6_rcv_tnl(skb, NULL);
	70	}
	71	EXPORT_SYMBOL(xfrm6_rcv);
fbd9a5b4 MN	72	int xfrm6_input_addr(struct sk_buff skb, xfrm_address_t daddr,
	73	xfrm_address_t *saddr, u8 proto)
	74	{
59c9940e	75	struct net *net = dev_net(skb->dev);
1ab1457c	76	struct xfrm_state *x = NULL;
fbd9a5b4 MN	77	int i = 0;
fbd9a5b4 MN	78
b0fcee82 SK	79	if (secpath_set(skb)) {
	80	XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
	81	goto drop;
9473e1f6 MN	82	}
	83
	84	if (1 + skb->sp->len == XFRM_MAX_DEPTH) {
59c9940e	85	XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
9473e1f6 MN	86	goto drop;
	87	}
	88
fbd9a5b4 MN	89	for (i = 0; i < 3; i++) {
fbd9a5b4 MN	90	xfrm_address_t dst, src;
a002c6fd	91
fbd9a5b4 MN	92	switch (i) {
	93	case 0:
	94	dst = daddr;
	95	src = saddr;
	96	break;
	97	case 1:
	98	/* lookup state with wild-card source address */
fbd9a5b4	99	dst = daddr;
a002c6fd	100	src = (xfrm_address_t *)&in6addr_any;
fbd9a5b4	101	break;
fbd9a5b4	102	default:
1ab1457c	103	/* lookup state with wild-card addresses */
a002c6fd YH	104	dst = (xfrm_address_t *)&in6addr_any;
a002c6fd YH	105	src = (xfrm_address_t *)&in6addr_any;
fbd9a5b4	106	break;
1ab1457c	107	}
fbd9a5b4	108
bd55775c	109	x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6);
fbd9a5b4 MN	110	if (!x)
	111	continue;
	112
	113	spin_lock(&x->lock);
	114
a002c6fd YH	115	if ((!i \|\| (x->props.flags & XFRM_STATE_WILDRECV)) &&
	116	likely(x->km.state == XFRM_STATE_VALID) &&
	117	!xfrm_state_check_expire(x)) {
fbd9a5b4	118	spin_unlock(&x->lock);
a002c6fd YH	119	if (x->type->input(x, skb) > 0) {
	120	/* found a valid state */
	121	break;
	122	}
	123	} else
fbd9a5b4	124	spin_unlock(&x->lock);
fbd9a5b4	125
a002c6fd YH	126	xfrm_state_put(x);
a002c6fd YH	127	x = NULL;
fbd9a5b4 MN	128	}
fbd9a5b4 MN	129
9473e1f6	130	if (!x) {
59c9940e	131	XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
afeb14b4	132	xfrm_audit_state_notfound_simple(skb, AF_INET6);
fbd9a5b4	133	goto drop;
fbd9a5b4 MN	134	}
fbd9a5b4 MN	135
9473e1f6 MN	136	skb->sp->xvec[skb->sp->len++] = x;
	137
	138	spin_lock(&x->lock);
fbd9a5b4	139
9473e1f6 MN	140	x->curlft.bytes += skb->len;
	141	x->curlft.packets++;
	142
	143	spin_unlock(&x->lock);
fbd9a5b4 MN	144
fbd9a5b4 MN	145	return 1;
9473e1f6	146
fbd9a5b4	147	drop:
fbd9a5b4 MN	148	return -1;
fbd9a5b4 MN	149	}
7159039a	150	EXPORT_SYMBOL(xfrm6_input_addr);