5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
10 #include <linux/slab.h>
11 #include <linux/module.h>
12 #include <linux/netdevice.h>
16 #include <net/ip_tunnels.h>
17 #include <net/ip6_tunnel.h>
19 static struct kmem_cache
*secpath_cachep __read_mostly
;
21 static DEFINE_SPINLOCK(xfrm_input_afinfo_lock
);
22 static struct xfrm_input_afinfo __rcu
*xfrm_input_afinfo
[NPROTO
];
24 static struct gro_cells gro_cells
;
25 static struct net_device xfrm_napi_dev
;
27 int xfrm_input_register_afinfo(struct xfrm_input_afinfo
*afinfo
)
31 if (unlikely(afinfo
== NULL
))
33 if (unlikely(afinfo
->family
>= NPROTO
))
35 spin_lock_bh(&xfrm_input_afinfo_lock
);
36 if (unlikely(xfrm_input_afinfo
[afinfo
->family
] != NULL
))
39 rcu_assign_pointer(xfrm_input_afinfo
[afinfo
->family
], afinfo
);
40 spin_unlock_bh(&xfrm_input_afinfo_lock
);
43 EXPORT_SYMBOL(xfrm_input_register_afinfo
);
45 int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo
*afinfo
)
49 if (unlikely(afinfo
== NULL
))
51 if (unlikely(afinfo
->family
>= NPROTO
))
53 spin_lock_bh(&xfrm_input_afinfo_lock
);
54 if (likely(xfrm_input_afinfo
[afinfo
->family
] != NULL
)) {
55 if (unlikely(xfrm_input_afinfo
[afinfo
->family
] != afinfo
))
58 RCU_INIT_POINTER(xfrm_input_afinfo
[afinfo
->family
], NULL
);
60 spin_unlock_bh(&xfrm_input_afinfo_lock
);
64 EXPORT_SYMBOL(xfrm_input_unregister_afinfo
);
66 static struct xfrm_input_afinfo
*xfrm_input_get_afinfo(unsigned int family
)
68 struct xfrm_input_afinfo
*afinfo
;
70 if (unlikely(family
>= NPROTO
))
73 afinfo
= rcu_dereference(xfrm_input_afinfo
[family
]);
74 if (unlikely(!afinfo
))
79 static void xfrm_input_put_afinfo(struct xfrm_input_afinfo
*afinfo
)
84 static int xfrm_rcv_cb(struct sk_buff
*skb
, unsigned int family
, u8 protocol
,
88 struct xfrm_input_afinfo
*afinfo
= xfrm_input_get_afinfo(family
);
93 ret
= afinfo
->callback(skb
, protocol
, err
);
94 xfrm_input_put_afinfo(afinfo
);
99 void __secpath_destroy(struct sec_path
*sp
)
102 for (i
= 0; i
< sp
->len
; i
++)
103 xfrm_state_put(sp
->xvec
[i
]);
104 kmem_cache_free(secpath_cachep
, sp
);
106 EXPORT_SYMBOL(__secpath_destroy
);
108 struct sec_path
*secpath_dup(struct sec_path
*src
)
112 sp
= kmem_cache_alloc(secpath_cachep
, GFP_ATOMIC
);
120 memcpy(sp
, src
, sizeof(*sp
));
121 for (i
= 0; i
< sp
->len
; i
++)
122 xfrm_state_hold(sp
->xvec
[i
]);
124 atomic_set(&sp
->refcnt
, 1);
127 EXPORT_SYMBOL(secpath_dup
);
129 /* Fetch spi and seq from ipsec header */
131 int xfrm_parse_spi(struct sk_buff
*skb
, u8 nexthdr
, __be32
*spi
, __be32
*seq
)
133 int offset
, offset_seq
;
138 hlen
= sizeof(struct ip_auth_hdr
);
139 offset
= offsetof(struct ip_auth_hdr
, spi
);
140 offset_seq
= offsetof(struct ip_auth_hdr
, seq_no
);
143 hlen
= sizeof(struct ip_esp_hdr
);
144 offset
= offsetof(struct ip_esp_hdr
, spi
);
145 offset_seq
= offsetof(struct ip_esp_hdr
, seq_no
);
148 if (!pskb_may_pull(skb
, sizeof(struct ip_comp_hdr
)))
150 *spi
= htonl(ntohs(*(__be16
*)(skb_transport_header(skb
) + 2)));
157 if (!pskb_may_pull(skb
, hlen
))
160 *spi
= *(__be32
*)(skb_transport_header(skb
) + offset
);
161 *seq
= *(__be32
*)(skb_transport_header(skb
) + offset_seq
);
165 int xfrm_prepare_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
167 struct xfrm_mode
*inner_mode
= x
->inner_mode
;
170 err
= x
->outer_mode
->afinfo
->extract_input(x
, skb
);
174 if (x
->sel
.family
== AF_UNSPEC
) {
175 inner_mode
= xfrm_ip2inner_mode(x
, XFRM_MODE_SKB_CB(skb
)->protocol
);
176 if (inner_mode
== NULL
)
177 return -EAFNOSUPPORT
;
180 skb
->protocol
= inner_mode
->afinfo
->eth_proto
;
181 return inner_mode
->input2(x
, skb
);
183 EXPORT_SYMBOL(xfrm_prepare_input
);
185 int xfrm_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
, int encap_type
)
187 struct net
*net
= dev_net(skb
->dev
);
191 struct xfrm_state
*x
= NULL
;
192 xfrm_address_t
*daddr
;
193 struct xfrm_mode
*inner_mode
;
194 u32 mark
= skb
->mark
;
199 /* A negative encap_type indicates async resumption. */
200 if (encap_type
< 0) {
202 x
= xfrm_input_state(skb
);
203 seq
= XFRM_SKB_CB(skb
)->seq
.input
.low
;
204 family
= x
->outer_mode
->afinfo
->family
;
208 daddr
= (xfrm_address_t
*)(skb_network_header(skb
) +
209 XFRM_SPI_SKB_CB(skb
)->daddroff
);
210 family
= XFRM_SPI_SKB_CB(skb
)->family
;
212 /* if tunnel is present override skb->mark value with tunnel i_key */
215 if (XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
)
216 mark
= be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
->parms
.i_key
);
219 if (XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip6
)
220 mark
= be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip6
->parms
.i_key
);
224 /* Allocate new secpath or COW existing one. */
225 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
228 sp
= secpath_dup(skb
->sp
);
230 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINERROR
);
234 secpath_put(skb
->sp
);
239 if (!spi
&& (err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) != 0) {
240 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINHDRERROR
);
245 if (skb
->sp
->len
== XFRM_MAX_DEPTH
) {
246 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINBUFFERERROR
);
250 x
= xfrm_state_lookup(net
, mark
, daddr
, spi
, nexthdr
, family
);
252 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINNOSTATES
);
253 xfrm_audit_state_notfound(skb
, family
, spi
, seq
);
257 skb
->sp
->xvec
[skb
->sp
->len
++] = x
;
261 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
)) {
262 if (x
->km
.state
== XFRM_STATE_ACQ
)
263 XFRM_INC_STATS(net
, LINUX_MIB_XFRMACQUIREERROR
);
266 LINUX_MIB_XFRMINSTATEINVALID
);
270 if ((x
->encap
? x
->encap
->encap_type
: 0) != encap_type
) {
271 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEMISMATCH
);
275 if (x
->repl
->check(x
, skb
, seq
)) {
276 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATESEQERROR
);
280 if (xfrm_state_check_expire(x
)) {
281 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEEXPIRED
);
285 spin_unlock(&x
->lock
);
287 if (xfrm_tunnel_check(skb
, x
, family
)) {
288 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEMODEERROR
);
292 seq_hi
= htonl(xfrm_replay_seqhi(x
, seq
));
294 XFRM_SKB_CB(skb
)->seq
.input
.low
= seq
;
295 XFRM_SKB_CB(skb
)->seq
.input
.hi
= seq_hi
;
300 nexthdr
= x
->type
->input(x
, skb
);
302 if (nexthdr
== -EINPROGRESS
)
309 if (nexthdr
== -EBADMSG
) {
310 xfrm_audit_state_icvfail(x
, skb
,
312 x
->stats
.integrity_failed
++;
314 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEPROTOERROR
);
318 /* only the first xfrm gets the encap type */
321 if (async
&& x
->repl
->recheck(x
, skb
, seq
)) {
322 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATESEQERROR
);
326 x
->repl
->advance(x
, seq
);
328 x
->curlft
.bytes
+= skb
->len
;
331 spin_unlock(&x
->lock
);
333 XFRM_MODE_SKB_CB(skb
)->protocol
= nexthdr
;
335 inner_mode
= x
->inner_mode
;
337 if (x
->sel
.family
== AF_UNSPEC
) {
338 inner_mode
= xfrm_ip2inner_mode(x
, XFRM_MODE_SKB_CB(skb
)->protocol
);
339 if (inner_mode
== NULL
) {
340 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEMODEERROR
);
345 if (inner_mode
->input(x
, skb
)) {
346 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEMODEERROR
);
350 if (x
->outer_mode
->flags
& XFRM_MODE_FLAG_TUNNEL
) {
356 * We need the inner address. However, we only get here for
357 * transport mode so the outer address is identical.
359 daddr
= &x
->id
.daddr
;
360 family
= x
->outer_mode
->afinfo
->family
;
362 err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
);
364 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINHDRERROR
);
369 err
= xfrm_rcv_cb(skb
, family
, x
->type
->proto
, 0);
377 gro_cells_receive(&gro_cells
, skb
);
380 return x
->inner_mode
->afinfo
->transport_finish(skb
, async
);
384 spin_unlock(&x
->lock
);
386 xfrm_rcv_cb(skb
, family
, x
&& x
->type
? x
->type
->proto
: nexthdr
, -1);
390 EXPORT_SYMBOL(xfrm_input
);
392 int xfrm_input_resume(struct sk_buff
*skb
, int nexthdr
)
394 return xfrm_input(skb
, nexthdr
, 0, -1);
396 EXPORT_SYMBOL(xfrm_input_resume
);
398 void __init
xfrm_input_init(void)
402 init_dummy_netdev(&xfrm_napi_dev
);
403 err
= gro_cells_init(&gro_cells
, &xfrm_napi_dev
);
405 gro_cells
.cells
= NULL
;
407 secpath_cachep
= kmem_cache_create("secpath_cache",
408 sizeof(struct sec_path
),
409 0, SLAB_HWCACHE_ALIGN
|SLAB_PANIC
,