5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
10 #include <linux/slab.h>
11 #include <linux/module.h>
12 #include <linux/netdevice.h>
16 #include <net/ip_tunnels.h>
17 #include <net/ip6_tunnel.h>
19 static struct kmem_cache
*secpath_cachep __read_mostly
;
21 static DEFINE_SPINLOCK(xfrm_input_afinfo_lock
);
22 static struct xfrm_input_afinfo __rcu
*xfrm_input_afinfo
[NPROTO
];
24 int xfrm_input_register_afinfo(struct xfrm_input_afinfo
*afinfo
)
28 if (unlikely(afinfo
== NULL
))
30 if (unlikely(afinfo
->family
>= NPROTO
))
32 spin_lock_bh(&xfrm_input_afinfo_lock
);
33 if (unlikely(xfrm_input_afinfo
[afinfo
->family
] != NULL
))
36 rcu_assign_pointer(xfrm_input_afinfo
[afinfo
->family
], afinfo
);
37 spin_unlock_bh(&xfrm_input_afinfo_lock
);
40 EXPORT_SYMBOL(xfrm_input_register_afinfo
);
42 int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo
*afinfo
)
46 if (unlikely(afinfo
== NULL
))
48 if (unlikely(afinfo
->family
>= NPROTO
))
50 spin_lock_bh(&xfrm_input_afinfo_lock
);
51 if (likely(xfrm_input_afinfo
[afinfo
->family
] != NULL
)) {
52 if (unlikely(xfrm_input_afinfo
[afinfo
->family
] != afinfo
))
55 RCU_INIT_POINTER(xfrm_input_afinfo
[afinfo
->family
], NULL
);
57 spin_unlock_bh(&xfrm_input_afinfo_lock
);
61 EXPORT_SYMBOL(xfrm_input_unregister_afinfo
);
63 static struct xfrm_input_afinfo
*xfrm_input_get_afinfo(unsigned int family
)
65 struct xfrm_input_afinfo
*afinfo
;
67 if (unlikely(family
>= NPROTO
))
70 afinfo
= rcu_dereference(xfrm_input_afinfo
[family
]);
71 if (unlikely(!afinfo
))
76 static void xfrm_input_put_afinfo(struct xfrm_input_afinfo
*afinfo
)
81 static int xfrm_rcv_cb(struct sk_buff
*skb
, unsigned int family
, u8 protocol
,
85 struct xfrm_input_afinfo
*afinfo
= xfrm_input_get_afinfo(family
);
90 ret
= afinfo
->callback(skb
, protocol
, err
);
91 xfrm_input_put_afinfo(afinfo
);
96 void __secpath_destroy(struct sec_path
*sp
)
99 for (i
= 0; i
< sp
->len
; i
++)
100 xfrm_state_put(sp
->xvec
[i
]);
101 kmem_cache_free(secpath_cachep
, sp
);
103 EXPORT_SYMBOL(__secpath_destroy
);
105 struct sec_path
*secpath_dup(struct sec_path
*src
)
109 sp
= kmem_cache_alloc(secpath_cachep
, GFP_ATOMIC
);
117 memcpy(sp
, src
, sizeof(*sp
));
118 for (i
= 0; i
< sp
->len
; i
++)
119 xfrm_state_hold(sp
->xvec
[i
]);
121 atomic_set(&sp
->refcnt
, 1);
124 EXPORT_SYMBOL(secpath_dup
);
126 /* Fetch spi and seq from ipsec header */
128 int xfrm_parse_spi(struct sk_buff
*skb
, u8 nexthdr
, __be32
*spi
, __be32
*seq
)
130 int offset
, offset_seq
;
135 hlen
= sizeof(struct ip_auth_hdr
);
136 offset
= offsetof(struct ip_auth_hdr
, spi
);
137 offset_seq
= offsetof(struct ip_auth_hdr
, seq_no
);
140 hlen
= sizeof(struct ip_esp_hdr
);
141 offset
= offsetof(struct ip_esp_hdr
, spi
);
142 offset_seq
= offsetof(struct ip_esp_hdr
, seq_no
);
145 if (!pskb_may_pull(skb
, sizeof(struct ip_comp_hdr
)))
147 *spi
= htonl(ntohs(*(__be16
*)(skb_transport_header(skb
) + 2)));
154 if (!pskb_may_pull(skb
, hlen
))
157 *spi
= *(__be32
*)(skb_transport_header(skb
) + offset
);
158 *seq
= *(__be32
*)(skb_transport_header(skb
) + offset_seq
);
162 int xfrm_prepare_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
164 struct xfrm_mode
*inner_mode
= x
->inner_mode
;
167 err
= x
->outer_mode
->afinfo
->extract_input(x
, skb
);
171 if (x
->sel
.family
== AF_UNSPEC
) {
172 inner_mode
= xfrm_ip2inner_mode(x
, XFRM_MODE_SKB_CB(skb
)->protocol
);
173 if (inner_mode
== NULL
)
174 return -EAFNOSUPPORT
;
177 skb
->protocol
= inner_mode
->afinfo
->eth_proto
;
178 return inner_mode
->input2(x
, skb
);
180 EXPORT_SYMBOL(xfrm_prepare_input
);
182 int xfrm_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
, int encap_type
)
184 struct net
*net
= dev_net(skb
->dev
);
188 struct xfrm_state
*x
= NULL
;
189 xfrm_address_t
*daddr
;
190 struct xfrm_mode
*inner_mode
;
191 u32 mark
= skb
->mark
;
196 /* A negative encap_type indicates async resumption. */
197 if (encap_type
< 0) {
199 x
= xfrm_input_state(skb
);
200 seq
= XFRM_SKB_CB(skb
)->seq
.input
.low
;
201 family
= x
->outer_mode
->afinfo
->family
;
205 daddr
= (xfrm_address_t
*)(skb_network_header(skb
) +
206 XFRM_SPI_SKB_CB(skb
)->daddroff
);
207 family
= XFRM_SPI_SKB_CB(skb
)->family
;
209 /* if tunnel is present override skb->mark value with tunnel i_key */
210 if (XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
) {
213 mark
= be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
->parms
.i_key
);
216 mark
= be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip6
->parms
.i_key
);
221 /* Allocate new secpath or COW existing one. */
222 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
225 sp
= secpath_dup(skb
->sp
);
227 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINERROR
);
231 secpath_put(skb
->sp
);
236 if (!spi
&& (err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) != 0) {
237 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINHDRERROR
);
242 if (skb
->sp
->len
== XFRM_MAX_DEPTH
) {
243 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINBUFFERERROR
);
247 x
= xfrm_state_lookup(net
, mark
, daddr
, spi
, nexthdr
, family
);
249 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINNOSTATES
);
250 xfrm_audit_state_notfound(skb
, family
, spi
, seq
);
254 skb
->sp
->xvec
[skb
->sp
->len
++] = x
;
257 if (unlikely(x
->km
.state
== XFRM_STATE_ACQ
)) {
258 XFRM_INC_STATS(net
, LINUX_MIB_XFRMACQUIREERROR
);
262 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
)) {
263 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEINVALID
);
267 if ((x
->encap
? x
->encap
->encap_type
: 0) != encap_type
) {
268 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEMISMATCH
);
272 if (x
->repl
->check(x
, skb
, seq
)) {
273 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATESEQERROR
);
277 if (xfrm_state_check_expire(x
)) {
278 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEEXPIRED
);
282 spin_unlock(&x
->lock
);
284 if (xfrm_tunnel_check(skb
, x
, family
)) {
285 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEMODEERROR
);
289 seq_hi
= htonl(xfrm_replay_seqhi(x
, seq
));
291 XFRM_SKB_CB(skb
)->seq
.input
.low
= seq
;
292 XFRM_SKB_CB(skb
)->seq
.input
.hi
= seq_hi
;
296 nexthdr
= x
->type
->input(x
, skb
);
298 if (nexthdr
== -EINPROGRESS
)
303 if (nexthdr
== -EBADMSG
) {
304 xfrm_audit_state_icvfail(x
, skb
,
306 x
->stats
.integrity_failed
++;
308 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEPROTOERROR
);
312 /* only the first xfrm gets the encap type */
315 if (async
&& x
->repl
->recheck(x
, skb
, seq
)) {
316 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATESEQERROR
);
320 x
->repl
->advance(x
, seq
);
322 x
->curlft
.bytes
+= skb
->len
;
325 spin_unlock(&x
->lock
);
327 XFRM_MODE_SKB_CB(skb
)->protocol
= nexthdr
;
329 inner_mode
= x
->inner_mode
;
331 if (x
->sel
.family
== AF_UNSPEC
) {
332 inner_mode
= xfrm_ip2inner_mode(x
, XFRM_MODE_SKB_CB(skb
)->protocol
);
333 if (inner_mode
== NULL
)
337 if (inner_mode
->input(x
, skb
)) {
338 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINSTATEMODEERROR
);
342 if (x
->outer_mode
->flags
& XFRM_MODE_FLAG_TUNNEL
) {
348 * We need the inner address. However, we only get here for
349 * transport mode so the outer address is identical.
351 daddr
= &x
->id
.daddr
;
352 family
= x
->outer_mode
->afinfo
->family
;
354 err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
);
356 XFRM_INC_STATS(net
, LINUX_MIB_XFRMINHDRERROR
);
361 err
= xfrm_rcv_cb(skb
, family
, x
->type
->proto
, 0);
372 return x
->inner_mode
->afinfo
->transport_finish(skb
, async
);
376 spin_unlock(&x
->lock
);
378 xfrm_rcv_cb(skb
, family
, x
&& x
->type
? x
->type
->proto
: nexthdr
, -1);
382 EXPORT_SYMBOL(xfrm_input
);
384 int xfrm_input_resume(struct sk_buff
*skb
, int nexthdr
)
386 return xfrm_input(skb
, nexthdr
, 0, -1);
388 EXPORT_SYMBOL(xfrm_input_resume
);
390 void __init
xfrm_input_init(void)
392 secpath_cachep
= kmem_cache_create("secpath_cache",
393 sizeof(struct sec_path
),
394 0, SLAB_HWCACHE_ALIGN
|SLAB_PANIC
,