]>
git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - net/ipv6/xfrm6_input.c
2 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * YOSHIFUJI Hideaki @USAGI
12 #include <linux/module.h>
13 #include <linux/string.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter_ipv6.h>
16 #include <net/dsfield.h>
17 #include <net/inet_ecn.h>
22 static inline void ipip6_ecn_decapsulate(struct sk_buff
*skb
)
24 struct ipv6hdr
*outer_iph
= skb
->nh
.ipv6h
;
25 struct ipv6hdr
*inner_iph
= skb
->h
.ipv6h
;
27 if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph
)))
28 IP6_ECN_set_ce(inner_iph
);
31 int xfrm6_rcv_spi(struct sk_buff
*skb
, u32 spi
)
35 struct sec_decap_state xfrm_vec
[XFRM_MAX_DEPTH
];
42 nhoff
= IP6CB(skb
)->nhoff
;
43 nexthdr
= skb
->nh
.raw
[nhoff
];
46 if (!spi
&& (err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) != 0)
50 struct ipv6hdr
*iph
= skb
->nh
.ipv6h
;
52 if (xfrm_nr
== XFRM_MAX_DEPTH
)
55 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, spi
, nexthdr
, AF_INET6
);
59 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
))
62 if (x
->props
.replay_window
&& xfrm_replay_check(x
, seq
))
65 if (xfrm_state_check_expire(x
))
68 nexthdr
= x
->type
->input(x
, &(xfrm_vec
[xfrm_nr
].decap
), skb
);
72 skb
->nh
.raw
[nhoff
] = nexthdr
;
74 if (x
->props
.replay_window
)
75 xfrm_replay_advance(x
, seq
);
77 x
->curlft
.bytes
+= skb
->len
;
80 spin_unlock(&x
->lock
);
82 xfrm_vec
[xfrm_nr
++].xvec
= x
;
84 if (x
->props
.mode
) { /* XXX */
85 if (nexthdr
!= IPPROTO_IPV6
)
87 if (!pskb_may_pull(skb
, sizeof(struct ipv6hdr
)))
89 if (skb_cloned(skb
) &&
90 pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
92 if (x
->props
.flags
& XFRM_STATE_DECAP_DSCP
)
93 ipv6_copy_dscp(skb
->nh
.ipv6h
, skb
->h
.ipv6h
);
94 if (!(x
->props
.flags
& XFRM_STATE_NOECN
))
95 ipip6_ecn_decapsulate(skb
);
96 skb
->mac
.raw
= memmove(skb
->data
- skb
->mac_len
,
97 skb
->mac
.raw
, skb
->mac_len
);
98 skb
->nh
.raw
= skb
->data
;
103 if ((err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) < 0)
107 /* Allocate new secpath or COW existing one. */
108 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
110 sp
= secpath_dup(skb
->sp
);
114 secpath_put(skb
->sp
);
118 if (xfrm_nr
+ skb
->sp
->len
> XFRM_MAX_DEPTH
)
121 memcpy(skb
->sp
->x
+skb
->sp
->len
, xfrm_vec
, xfrm_nr
*sizeof(struct sec_decap_state
));
122 skb
->sp
->len
+= xfrm_nr
;
123 skb
->ip_summed
= CHECKSUM_NONE
;
128 if (!(skb
->dev
->flags
&IFF_LOOPBACK
)) {
129 dst_release(skb
->dst
);
135 #ifdef CONFIG_NETFILTER
136 skb
->nh
.ipv6h
->payload_len
= htons(skb
->len
);
137 __skb_push(skb
, skb
->data
- skb
->nh
.raw
);
139 NF_HOOK(PF_INET6
, NF_IP6_PRE_ROUTING
, skb
, skb
->dev
, NULL
,
148 spin_unlock(&x
->lock
);
151 while (--xfrm_nr
>= 0)
152 xfrm_state_put(xfrm_vec
[xfrm_nr
].xvec
);
157 EXPORT_SYMBOL(xfrm6_rcv_spi
);
159 int xfrm6_rcv(struct sk_buff
**pskb
)
161 return xfrm6_rcv_spi(*pskb
, 0);