]>
git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blob - net/ipv4/xfrm4_input.c
5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
7 * Derek Atkins <derek@ihtfp.com>
8 * Add Encapsulation support
12 #include <linux/module.h>
13 #include <linux/string.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter_ipv4.h>
19 int xfrm4_rcv(struct sk_buff
*skb
)
21 return xfrm4_rcv_encap(skb
, 0);
24 EXPORT_SYMBOL(xfrm4_rcv
);
26 static int xfrm4_parse_spi(struct sk_buff
*skb
, u8 nexthdr
, u32
*spi
, u32
*seq
)
30 *spi
= skb
->nh
.iph
->saddr
;
35 return xfrm_parse_spi(skb
, nexthdr
, spi
, seq
);
38 #ifdef CONFIG_NETFILTER
39 static inline int xfrm4_rcv_encap_finish(struct sk_buff
*skb
)
41 struct iphdr
*iph
= skb
->nh
.iph
;
43 if (skb
->dst
== NULL
) {
44 if (ip_route_input(skb
, iph
->daddr
, iph
->saddr
, iph
->tos
,
48 return dst_input(skb
);
55 int xfrm4_rcv_encap(struct sk_buff
*skb
, __u16 encap_type
)
59 struct xfrm_state
*xfrm_vec
[XFRM_MAX_DEPTH
];
64 if ((err
= xfrm4_parse_spi(skb
, skb
->nh
.iph
->protocol
, &spi
, &seq
)) != 0)
68 struct iphdr
*iph
= skb
->nh
.iph
;
70 if (xfrm_nr
== XFRM_MAX_DEPTH
)
73 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, spi
, iph
->protocol
, AF_INET
);
78 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
))
81 if ((x
->encap
? x
->encap
->encap_type
: 0) != encap_type
)
84 if (x
->props
.replay_window
&& xfrm_replay_check(x
, seq
))
87 if (xfrm_state_check_expire(x
))
90 if (x
->type
->input(x
, skb
))
93 /* only the first xfrm gets the encap type */
96 if (x
->props
.replay_window
)
97 xfrm_replay_advance(x
, seq
);
99 x
->curlft
.bytes
+= skb
->len
;
102 spin_unlock(&x
->lock
);
104 xfrm_vec
[xfrm_nr
++] = x
;
106 if (x
->mode
->input(x
, skb
))
114 if ((err
= xfrm_parse_spi(skb
, skb
->nh
.iph
->protocol
, &spi
, &seq
)) < 0)
118 /* Allocate new secpath or COW existing one. */
120 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
122 sp
= secpath_dup(skb
->sp
);
126 secpath_put(skb
->sp
);
129 if (xfrm_nr
+ skb
->sp
->len
> XFRM_MAX_DEPTH
)
132 memcpy(skb
->sp
->xvec
+ skb
->sp
->len
, xfrm_vec
,
133 xfrm_nr
* sizeof(xfrm_vec
[0]));
134 skb
->sp
->len
+= xfrm_nr
;
139 if (!(skb
->dev
->flags
&IFF_LOOPBACK
)) {
140 dst_release(skb
->dst
);
146 #ifdef CONFIG_NETFILTER
147 __skb_push(skb
, skb
->data
- skb
->nh
.raw
);
148 skb
->nh
.iph
->tot_len
= htons(skb
->len
);
149 ip_send_check(skb
->nh
.iph
);
151 NF_HOOK(PF_INET
, NF_IP_PRE_ROUTING
, skb
, skb
->dev
, NULL
,
152 xfrm4_rcv_encap_finish
);
155 return -skb
->nh
.iph
->protocol
;
160 spin_unlock(&x
->lock
);
163 while (--xfrm_nr
>= 0)
164 xfrm_state_put(xfrm_vec
[xfrm_nr
]);