1 // SPDX-License-Identifier: GPL-2.0
3 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
7 * Kazunori MIYAZAWA @USAGI
8 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
9 * YOSHIFUJI Hideaki @USAGI
13 #include <linux/module.h>
14 #include <linux/string.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter_ipv6.h>
20 int xfrm6_extract_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
22 return xfrm6_extract_header(skb
);
25 int xfrm6_rcv_spi(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
28 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip6
= t
;
29 XFRM_SPI_SKB_CB(skb
)->family
= AF_INET6
;
30 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct ipv6hdr
, daddr
);
31 return xfrm_input(skb
, nexthdr
, spi
, 0);
33 EXPORT_SYMBOL(xfrm6_rcv_spi
);
35 int xfrm6_transport_finish(struct sk_buff
*skb
, int async
)
37 struct xfrm_offload
*xo
= xfrm_offload(skb
);
38 int nhlen
= skb
->data
- skb_network_header(skb
);
40 skb_network_header(skb
)[IP6CB(skb
)->nhoff
] =
41 XFRM_MODE_SKB_CB(skb
)->protocol
;
43 #ifndef CONFIG_NETFILTER
48 __skb_push(skb
, nhlen
);
49 ipv6_hdr(skb
)->payload_len
= htons(skb
->len
- sizeof(struct ipv6hdr
));
50 skb_postpush_rcsum(skb
, skb_network_header(skb
), nhlen
);
52 if (xo
&& (xo
->flags
& XFRM_GRO
)) {
53 skb_mac_header_rebuild(skb
);
57 NF_HOOK(NFPROTO_IPV6
, NF_INET_PRE_ROUTING
,
58 dev_net(skb
->dev
), NULL
, skb
, skb
->dev
, NULL
,
63 int xfrm6_rcv_tnl(struct sk_buff
*skb
, struct ip6_tnl
*t
)
65 return xfrm6_rcv_spi(skb
, skb_network_header(skb
)[IP6CB(skb
)->nhoff
],
68 EXPORT_SYMBOL(xfrm6_rcv_tnl
);
70 int xfrm6_rcv(struct sk_buff
*skb
)
72 return xfrm6_rcv_tnl(skb
, NULL
);
74 EXPORT_SYMBOL(xfrm6_rcv
);
75 int xfrm6_input_addr(struct sk_buff
*skb
, xfrm_address_t
*daddr
,
76 xfrm_address_t
*saddr
, u8 proto
)
78 struct net
*net
= dev_net(skb
->dev
);
79 struct xfrm_state
*x
= NULL
;
82 if (secpath_set(skb
)) {
83 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINERROR
);
87 if (1 + skb
->sp
->len
== XFRM_MAX_DEPTH
) {
88 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINBUFFERERROR
);
92 for (i
= 0; i
< 3; i
++) {
93 xfrm_address_t
*dst
, *src
;
101 /* lookup state with wild-card source address */
103 src
= (xfrm_address_t
*)&in6addr_any
;
106 /* lookup state with wild-card addresses */
107 dst
= (xfrm_address_t
*)&in6addr_any
;
108 src
= (xfrm_address_t
*)&in6addr_any
;
112 x
= xfrm_state_lookup_byaddr(net
, skb
->mark
, dst
, src
, proto
, AF_INET6
);
118 if ((!i
|| (x
->props
.flags
& XFRM_STATE_WILDRECV
)) &&
119 likely(x
->km
.state
== XFRM_STATE_VALID
) &&
120 !xfrm_state_check_expire(x
)) {
121 spin_unlock(&x
->lock
);
122 if (x
->type
->input(x
, skb
) > 0) {
123 /* found a valid state */
127 spin_unlock(&x
->lock
);
134 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINNOSTATES
);
135 xfrm_audit_state_notfound_simple(skb
, AF_INET6
);
139 skb
->sp
->xvec
[skb
->sp
->len
++] = x
;
143 x
->curlft
.bytes
+= skb
->len
;
146 spin_unlock(&x
->lock
);
153 EXPORT_SYMBOL(xfrm6_input_addr
);