5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
7 * Derek Atkins <derek@ihtfp.com>
8 * Add Encapsulation support
12 #include <linux/module.h>
13 #include <linux/string.h>
14 #include <net/inet_ecn.h>
18 int xfrm4_rcv(struct sk_buff
*skb
)
20 return xfrm4_rcv_encap(skb
, 0);
23 EXPORT_SYMBOL(xfrm4_rcv
);
25 static inline void ipip_ecn_decapsulate(struct sk_buff
*skb
)
27 struct iphdr
*outer_iph
= skb
->nh
.iph
;
28 struct iphdr
*inner_iph
= skb
->h
.ipiph
;
30 if (INET_ECN_is_ce(outer_iph
->tos
))
31 IP_ECN_set_ce(inner_iph
);
34 static int xfrm4_parse_spi(struct sk_buff
*skb
, u8 nexthdr
, u32
*spi
, u32
*seq
)
38 if (!pskb_may_pull(skb
, sizeof(struct iphdr
)))
40 *spi
= skb
->nh
.iph
->saddr
;
45 return xfrm_parse_spi(skb
, nexthdr
, spi
, seq
);
48 int xfrm4_rcv_encap(struct sk_buff
*skb
, __u16 encap_type
)
52 struct sec_decap_state xfrm_vec
[XFRM_MAX_DEPTH
];
57 if ((err
= xfrm4_parse_spi(skb
, skb
->nh
.iph
->protocol
, &spi
, &seq
)) != 0)
61 struct iphdr
*iph
= skb
->nh
.iph
;
63 if (xfrm_nr
== XFRM_MAX_DEPTH
)
66 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, spi
, iph
->protocol
, AF_INET
);
71 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
))
74 if (x
->props
.replay_window
&& xfrm_replay_check(x
, seq
))
77 if (xfrm_state_check_expire(x
))
80 xfrm_vec
[xfrm_nr
].decap
.decap_type
= encap_type
;
81 if (x
->type
->input(x
, &(xfrm_vec
[xfrm_nr
].decap
), skb
))
84 /* only the first xfrm gets the encap type */
87 if (x
->props
.replay_window
)
88 xfrm_replay_advance(x
, seq
);
90 x
->curlft
.bytes
+= skb
->len
;
93 spin_unlock(&x
->lock
);
95 xfrm_vec
[xfrm_nr
++].xvec
= x
;
100 if (iph
->protocol
!= IPPROTO_IPIP
)
102 if (!pskb_may_pull(skb
, sizeof(struct iphdr
)))
104 if (skb_cloned(skb
) &&
105 pskb_expand_head(skb
, 0, 0, GFP_ATOMIC
))
107 if (x
->props
.flags
& XFRM_STATE_DECAP_DSCP
)
108 ipv4_copy_dscp(iph
, skb
->h
.ipiph
);
109 if (!(x
->props
.flags
& XFRM_STATE_NOECN
))
110 ipip_ecn_decapsulate(skb
);
111 skb
->mac
.raw
= memmove(skb
->data
- skb
->mac_len
,
112 skb
->mac
.raw
, skb
->mac_len
);
113 skb
->nh
.raw
= skb
->data
;
114 memset(&(IPCB(skb
)->opt
), 0, sizeof(struct ip_options
));
119 if ((err
= xfrm_parse_spi(skb
, skb
->nh
.iph
->protocol
, &spi
, &seq
)) < 0)
123 /* Allocate new secpath or COW existing one. */
125 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
127 sp
= secpath_dup(skb
->sp
);
131 secpath_put(skb
->sp
);
134 if (xfrm_nr
+ skb
->sp
->len
> XFRM_MAX_DEPTH
)
137 memcpy(skb
->sp
->x
+skb
->sp
->len
, xfrm_vec
, xfrm_nr
*sizeof(struct sec_decap_state
));
138 skb
->sp
->len
+= xfrm_nr
;
141 if (!(skb
->dev
->flags
&IFF_LOOPBACK
)) {
142 dst_release(skb
->dst
);
148 return -skb
->nh
.iph
->protocol
;
152 spin_unlock(&x
->lock
);
155 while (--xfrm_nr
>= 0)
156 xfrm_state_put(xfrm_vec
[xfrm_nr
].xvec
);