5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
7 * Derek Atkins <derek@ihtfp.com>
8 * Add Encapsulation support
12 #include <linux/module.h>
13 #include <linux/string.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter_ipv4.h>
19 #ifdef CONFIG_NETFILTER
20 static inline int xfrm4_rcv_encap_finish(struct sk_buff
*skb
)
22 if (skb
->dst
== NULL
) {
23 const struct iphdr
*iph
= ip_hdr(skb
);
25 if (ip_route_input(skb
, iph
->daddr
, iph
->saddr
, iph
->tos
,
29 return dst_input(skb
);
36 int xfrm4_rcv_encap(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
41 struct xfrm_state
*xfrm_vec
[XFRM_MAX_DEPTH
];
45 unsigned int nhoff
= offsetof(struct iphdr
, protocol
);
48 if (!spi
&& (err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) != 0)
52 const struct iphdr
*iph
= ip_hdr(skb
);
54 if (xfrm_nr
== XFRM_MAX_DEPTH
)
57 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, spi
,
63 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
))
66 if ((x
->encap
? x
->encap
->encap_type
: 0) != encap_type
)
69 if (x
->props
.replay_window
&& xfrm_replay_check(x
, seq
))
72 if (xfrm_state_check_expire(x
))
75 nexthdr
= x
->type
->input(x
, skb
);
79 skb_network_header(skb
)[nhoff
] = nexthdr
;
81 /* only the first xfrm gets the encap type */
84 if (x
->props
.replay_window
)
85 xfrm_replay_advance(x
, seq
);
87 x
->curlft
.bytes
+= skb
->len
;
90 spin_unlock(&x
->lock
);
92 xfrm_vec
[xfrm_nr
++] = x
;
94 if (x
->outer_mode
->input(x
, skb
))
97 if (x
->outer_mode
->flags
& XFRM_MODE_FLAG_TUNNEL
) {
102 err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
);
107 /* Allocate new secpath or COW existing one. */
109 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
111 sp
= secpath_dup(skb
->sp
);
115 secpath_put(skb
->sp
);
118 if (xfrm_nr
+ skb
->sp
->len
> XFRM_MAX_DEPTH
)
121 memcpy(skb
->sp
->xvec
+ skb
->sp
->len
, xfrm_vec
,
122 xfrm_nr
* sizeof(xfrm_vec
[0]));
123 skb
->sp
->len
+= xfrm_nr
;
128 dst_release(skb
->dst
);
133 #ifdef CONFIG_NETFILTER
134 __skb_push(skb
, skb
->data
- skb_network_header(skb
));
135 ip_hdr(skb
)->tot_len
= htons(skb
->len
);
136 ip_send_check(ip_hdr(skb
));
138 NF_HOOK(PF_INET
, NF_IP_PRE_ROUTING
, skb
, skb
->dev
, NULL
,
139 xfrm4_rcv_encap_finish
);
142 return -ip_hdr(skb
)->protocol
;
147 spin_unlock(&x
->lock
);
150 while (--xfrm_nr
>= 0)
151 xfrm_state_put(xfrm_vec
[xfrm_nr
]);
156 EXPORT_SYMBOL(xfrm4_rcv_encap
);
158 /* If it's a keepalive packet, then just eat it.
159 * If it's an encapsulated packet, then pass it to the
161 * Returns 0 if skb passed to xfrm or was dropped.
162 * Returns >0 if skb should be passed to UDP.
163 * Returns <0 if skb should be resubmitted (-ret is protocol)
165 int xfrm4_udp_encap_rcv(struct sock
*sk
, struct sk_buff
*skb
)
167 struct udp_sock
*up
= udp_sk(sk
);
175 __u16 encap_type
= up
->encap_type
;
177 /* if this is not encapsulated socket, then just return now */
181 /* If this is a paged skb, make sure we pull up
182 * whatever data we need to look at. */
183 len
= skb
->len
- sizeof(struct udphdr
);
184 if (!pskb_may_pull(skb
, sizeof(struct udphdr
) + min(len
, 8)))
187 /* Now we can get the pointers */
189 udpdata
= (__u8
*)uh
+ sizeof(struct udphdr
);
190 udpdata32
= (__be32
*)udpdata
;
192 switch (encap_type
) {
194 case UDP_ENCAP_ESPINUDP
:
195 /* Check if this is a keepalive packet. If so, eat it. */
196 if (len
== 1 && udpdata
[0] == 0xff) {
198 } else if (len
> sizeof(struct ip_esp_hdr
) && udpdata32
[0] != 0) {
199 /* ESP Packet without Non-ESP header */
200 len
= sizeof(struct udphdr
);
202 /* Must be an IKE packet.. pass it through */
205 case UDP_ENCAP_ESPINUDP_NON_IKE
:
206 /* Check if this is a keepalive packet. If so, eat it. */
207 if (len
== 1 && udpdata
[0] == 0xff) {
209 } else if (len
> 2 * sizeof(u32
) + sizeof(struct ip_esp_hdr
) &&
210 udpdata32
[0] == 0 && udpdata32
[1] == 0) {
212 /* ESP Packet with Non-IKE marker */
213 len
= sizeof(struct udphdr
) + 2 * sizeof(u32
);
215 /* Must be an IKE packet.. pass it through */
220 /* At this point we are sure that this is an ESPinUDP packet,
221 * so we need to remove 'len' bytes from the packet (the UDP
222 * header and optional ESP marker bytes) and then modify the
223 * protocol to ESP, and then call into the transform receiver.
225 if (skb_cloned(skb
) && pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
228 /* Now we can update and verify the packet length... */
230 iphlen
= iph
->ihl
<< 2;
231 iph
->tot_len
= htons(ntohs(iph
->tot_len
) - len
);
232 if (skb
->len
< iphlen
+ len
) {
233 /* packet is too small!?! */
237 /* pull the data buffer up to the ESP header and set the
238 * transport header to point to ESP. Keep UDP on the stack
241 __skb_pull(skb
, len
);
242 skb_reset_transport_header(skb
);
245 ret
= xfrm4_rcv_encap(skb
, IPPROTO_ESP
, 0, encap_type
);
253 int xfrm4_rcv(struct sk_buff
*skb
)
255 return xfrm4_rcv_spi(skb
, ip_hdr(skb
)->protocol
, 0);
258 EXPORT_SYMBOL(xfrm4_rcv
);