5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
7 * Derek Atkins <derek@ihtfp.com>
8 * Add Encapsulation support
12 #include <linux/module.h>
13 #include <linux/string.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter_ipv4.h>
18 #include <net/xfrmudp.h>
20 static int xfrm4_parse_spi(struct sk_buff
*skb
, u8 nexthdr
, __be32
*spi
, __be32
*seq
)
25 *spi
= ip_hdr(skb
)->saddr
;
30 return xfrm_parse_spi(skb
, nexthdr
, spi
, seq
);
33 #ifdef CONFIG_NETFILTER
34 static inline int xfrm4_rcv_encap_finish(struct sk_buff
*skb
)
36 if (skb
->dst
== NULL
) {
37 const struct iphdr
*iph
= ip_hdr(skb
);
39 if (ip_route_input(skb
, iph
->daddr
, iph
->saddr
, iph
->tos
,
43 return dst_input(skb
);
50 static int xfrm4_rcv_encap(struct sk_buff
*skb
, __u16 encap_type
)
53 struct xfrm_state
*xfrm_vec
[XFRM_MAX_DEPTH
];
57 int err
= xfrm4_parse_spi(skb
, ip_hdr(skb
)->protocol
, &spi
, &seq
);
63 const struct iphdr
*iph
= ip_hdr(skb
);
65 if (xfrm_nr
== XFRM_MAX_DEPTH
)
68 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, spi
,
69 iph
->protocol
!= IPPROTO_IPV6
? iph
->protocol
: IPPROTO_IPIP
, AF_INET
);
74 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
))
77 if ((x
->encap
? x
->encap
->encap_type
: 0) != encap_type
)
80 if (x
->props
.replay_window
&& xfrm_replay_check(x
, seq
))
83 if (xfrm_state_check_expire(x
))
86 if (x
->type
->input(x
, skb
))
89 /* only the first xfrm gets the encap type */
92 if (x
->props
.replay_window
)
93 xfrm_replay_advance(x
, seq
);
95 x
->curlft
.bytes
+= skb
->len
;
98 spin_unlock(&x
->lock
);
100 xfrm_vec
[xfrm_nr
++] = x
;
102 if (x
->mode
->input(x
, skb
))
105 if (x
->props
.mode
== XFRM_MODE_TUNNEL
) {
110 err
= xfrm_parse_spi(skb
, ip_hdr(skb
)->protocol
, &spi
, &seq
);
115 /* Allocate new secpath or COW existing one. */
117 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
119 sp
= secpath_dup(skb
->sp
);
123 secpath_put(skb
->sp
);
126 if (xfrm_nr
+ skb
->sp
->len
> XFRM_MAX_DEPTH
)
129 memcpy(skb
->sp
->xvec
+ skb
->sp
->len
, xfrm_vec
,
130 xfrm_nr
* sizeof(xfrm_vec
[0]));
131 skb
->sp
->len
+= xfrm_nr
;
136 dst_release(skb
->dst
);
141 #ifdef CONFIG_NETFILTER
142 __skb_push(skb
, skb
->data
- skb_network_header(skb
));
143 ip_hdr(skb
)->tot_len
= htons(skb
->len
);
144 ip_send_check(ip_hdr(skb
));
146 NF_HOOK(PF_INET
, NF_IP_PRE_ROUTING
, skb
, skb
->dev
, NULL
,
147 xfrm4_rcv_encap_finish
);
150 return -ip_hdr(skb
)->protocol
;
155 spin_unlock(&x
->lock
);
158 while (--xfrm_nr
>= 0)
159 xfrm_state_put(xfrm_vec
[xfrm_nr
]);
165 #ifdef CONFIG_IPSEC_NAT_TRAVERSAL
166 static xfrm4_rcv_encap_t xfrm4_rcv_encap_func
= NULL
;
168 int udp4_register_esp_rcvencap(xfrm4_rcv_encap_t func
,
169 xfrm4_rcv_encap_t
*oldfunc
)
172 *oldfunc
= xfrm4_rcv_encap_func
;
174 xfrm4_rcv_encap_func
= func
;
178 int udp4_unregister_esp_rcvencap(xfrm4_rcv_encap_t func
)
180 if(xfrm4_rcv_encap_func
!= func
)
183 xfrm4_rcv_encap_func
= NULL
;
186 #endif /* CONFIG_IPSEC_NAT_TRAVERSAL */
188 /* If it's a keepalive packet, then just eat it.
189 * If it's an encapsulated packet, then pass it to the
191 * Returns 0 if skb passed to xfrm or was dropped.
192 * Returns >0 if skb should be passed to UDP.
193 * Returns <0 if skb should be resubmitted (-ret is protocol)
195 int xfrm4_udp_encap_rcv(struct sock
*sk
, struct sk_buff
*skb
)
197 struct udp_sock
*up
= udp_sk(sk
);
205 __u16 encap_type
= up
->encap_type
;
207 /* if this is not encapsulated socket, then just return now */
211 /* If this is a paged skb, make sure we pull up
212 * whatever data we need to look at. */
213 len
= skb
->len
- sizeof(struct udphdr
);
214 if (!pskb_may_pull(skb
, sizeof(struct udphdr
) + min(len
, 8)))
217 /* Now we can get the pointers */
219 udpdata
= (__u8
*)uh
+ sizeof(struct udphdr
);
220 udpdata32
= (__be32
*)udpdata
;
222 switch (encap_type
) {
224 case UDP_ENCAP_ESPINUDP
:
225 /* Check if this is a keepalive packet. If so, eat it. */
226 if (len
== 1 && udpdata
[0] == 0xff) {
228 } else if (len
> sizeof(struct ip_esp_hdr
) && udpdata32
[0] != 0) {
229 /* ESP Packet without Non-ESP header */
230 len
= sizeof(struct udphdr
);
232 /* Must be an IKE packet.. pass it through */
235 case UDP_ENCAP_ESPINUDP_NON_IKE
:
236 /* Check if this is a keepalive packet. If so, eat it. */
237 if (len
== 1 && udpdata
[0] == 0xff) {
239 } else if (len
> 2 * sizeof(u32
) + sizeof(struct ip_esp_hdr
) &&
240 udpdata32
[0] == 0 && udpdata32
[1] == 0) {
242 /* ESP Packet with Non-IKE marker */
243 len
= sizeof(struct udphdr
) + 2 * sizeof(u32
);
245 /* Must be an IKE packet.. pass it through */
250 /* At this point we are sure that this is an ESPinUDP packet,
251 * so we need to remove 'len' bytes from the packet (the UDP
252 * header and optional ESP marker bytes) and then modify the
253 * protocol to ESP, and then call into the transform receiver.
255 if (skb_cloned(skb
) && pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
258 /* Now we can update and verify the packet length... */
260 iphlen
= iph
->ihl
<< 2;
261 iph
->tot_len
= htons(ntohs(iph
->tot_len
) - len
);
262 if (skb
->len
< iphlen
+ len
) {
263 /* packet is too small!?! */
267 /* pull the data buffer up to the ESP header and set the
268 * transport header to point to ESP. Keep UDP on the stack
271 __skb_pull(skb
, len
);
272 skb_reset_transport_header(skb
);
274 /* modify the protocol (it's ESP!) */
275 iph
->protocol
= IPPROTO_ESP
;
278 #ifdef CONFIG_IPSEC_NAT_TRAVERSAL
279 if (xfrm4_rcv_encap_func
!= NULL
)
280 ret
= (*xfrm4_rcv_encap_func
)(skb
, encap_type
);
283 ret
= xfrm4_rcv_encap(skb
, encap_type
);
291 int xfrm4_rcv(struct sk_buff
*skb
)
293 return xfrm4_rcv_encap(skb
, 0);
296 EXPORT_SYMBOL(xfrm4_rcv
);
298 #ifdef CONFIG_IPSEC_NAT_TRAVERSAL
299 EXPORT_SYMBOL(udp4_register_esp_rcvencap
);
300 EXPORT_SYMBOL(udp4_unregister_esp_rcvencap
);