2 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * YOSHIFUJI Hideaki @USAGI
12 #include <linux/module.h>
13 #include <linux/string.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter_ipv6.h>
16 #include <net/dsfield.h>
17 #include <net/inet_ecn.h>
22 static inline void ipip6_ecn_decapsulate(struct sk_buff
*skb
)
24 struct ipv6hdr
*outer_iph
= skb
->nh
.ipv6h
;
25 struct ipv6hdr
*inner_iph
= skb
->h
.ipv6h
;
27 if (INET_ECN_is_ce(ipv6_get_dsfield(outer_iph
)))
28 IP6_ECN_set_ce(inner_iph
);
31 int xfrm6_rcv_spi(struct sk_buff
*skb
, u32 spi
)
35 struct xfrm_state
*xfrm_vec
[XFRM_MAX_DEPTH
];
42 nhoff
= IP6CB(skb
)->nhoff
;
43 nexthdr
= skb
->nh
.raw
[nhoff
];
46 if (!spi
&& (err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) != 0)
50 struct ipv6hdr
*iph
= skb
->nh
.ipv6h
;
52 if (xfrm_nr
== XFRM_MAX_DEPTH
)
55 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, spi
, nexthdr
, AF_INET6
);
59 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
))
62 if (x
->props
.replay_window
&& xfrm_replay_check(x
, seq
))
65 if (xfrm_state_check_expire(x
))
68 nexthdr
= x
->type
->input(x
, skb
);
72 skb
->nh
.raw
[nhoff
] = nexthdr
;
74 if (x
->props
.replay_window
)
75 xfrm_replay_advance(x
, seq
);
77 x
->curlft
.bytes
+= skb
->len
;
80 spin_unlock(&x
->lock
);
82 xfrm_vec
[xfrm_nr
++] = x
;
84 if (x
->props
.mode
) { /* XXX */
85 if (nexthdr
!= IPPROTO_IPV6
)
87 if (!pskb_may_pull(skb
, sizeof(struct ipv6hdr
)))
89 if (skb_cloned(skb
) &&
90 pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
92 if (x
->props
.flags
& XFRM_STATE_DECAP_DSCP
)
93 ipv6_copy_dscp(skb
->nh
.ipv6h
, skb
->h
.ipv6h
);
94 if (!(x
->props
.flags
& XFRM_STATE_NOECN
))
95 ipip6_ecn_decapsulate(skb
);
96 skb
->mac
.raw
= memmove(skb
->data
- skb
->mac_len
,
97 skb
->mac
.raw
, skb
->mac_len
);
98 skb
->nh
.raw
= skb
->data
;
103 if ((err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) < 0)
107 /* Allocate new secpath or COW existing one. */
108 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
110 sp
= secpath_dup(skb
->sp
);
114 secpath_put(skb
->sp
);
118 if (xfrm_nr
+ skb
->sp
->len
> XFRM_MAX_DEPTH
)
121 memcpy(skb
->sp
->xvec
+ skb
->sp
->len
, xfrm_vec
,
122 xfrm_nr
* sizeof(xfrm_vec
[0]));
123 skb
->sp
->len
+= xfrm_nr
;
124 skb
->ip_summed
= CHECKSUM_NONE
;
129 if (!(skb
->dev
->flags
&IFF_LOOPBACK
)) {
130 dst_release(skb
->dst
);
136 #ifdef CONFIG_NETFILTER
137 skb
->nh
.ipv6h
->payload_len
= htons(skb
->len
);
138 __skb_push(skb
, skb
->data
- skb
->nh
.raw
);
140 NF_HOOK(PF_INET6
, NF_IP6_PRE_ROUTING
, skb
, skb
->dev
, NULL
,
149 spin_unlock(&x
->lock
);
152 while (--xfrm_nr
>= 0)
153 xfrm_state_put(xfrm_vec
[xfrm_nr
]);
158 EXPORT_SYMBOL(xfrm6_rcv_spi
);
160 int xfrm6_rcv(struct sk_buff
**pskb
)
162 return xfrm6_rcv_spi(*pskb
, 0);