Root/net/xfrm/xfrm_input.c

1/*
2 * xfrm_input.c
3 *
4 * Changes:
5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
7 *
8 */
9
10#include <linux/slab.h>
11#include <linux/module.h>
12#include <linux/netdevice.h>
13#include <net/dst.h>
14#include <net/ip.h>
15#include <net/xfrm.h>
16
17static struct kmem_cache *secpath_cachep __read_mostly;
18
19void __secpath_destroy(struct sec_path *sp)
20{
21    int i;
22    for (i = 0; i < sp->len; i++)
23        xfrm_state_put(sp->xvec[i]);
24    kmem_cache_free(secpath_cachep, sp);
25}
26EXPORT_SYMBOL(__secpath_destroy);
27
28struct sec_path *secpath_dup(struct sec_path *src)
29{
30    struct sec_path *sp;
31
32    sp = kmem_cache_alloc(secpath_cachep, GFP_ATOMIC);
33    if (!sp)
34        return NULL;
35
36    sp->len = 0;
37    if (src) {
38        int i;
39
40        memcpy(sp, src, sizeof(*sp));
41        for (i = 0; i < sp->len; i++)
42            xfrm_state_hold(sp->xvec[i]);
43    }
44    atomic_set(&sp->refcnt, 1);
45    return sp;
46}
47EXPORT_SYMBOL(secpath_dup);
48
49/* Fetch spi and seq from ipsec header */
50
51int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
52{
53    int offset, offset_seq;
54    int hlen;
55
56    switch (nexthdr) {
57    case IPPROTO_AH:
58        hlen = sizeof(struct ip_auth_hdr);
59        offset = offsetof(struct ip_auth_hdr, spi);
60        offset_seq = offsetof(struct ip_auth_hdr, seq_no);
61        break;
62    case IPPROTO_ESP:
63        hlen = sizeof(struct ip_esp_hdr);
64        offset = offsetof(struct ip_esp_hdr, spi);
65        offset_seq = offsetof(struct ip_esp_hdr, seq_no);
66        break;
67    case IPPROTO_COMP:
68        if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
69            return -EINVAL;
70        *spi = htonl(ntohs(*(__be16*)(skb_transport_header(skb) + 2)));
71        *seq = 0;
72        return 0;
73    default:
74        return 1;
75    }
76
77    if (!pskb_may_pull(skb, hlen))
78        return -EINVAL;
79
80    *spi = *(__be32*)(skb_transport_header(skb) + offset);
81    *seq = *(__be32*)(skb_transport_header(skb) + offset_seq);
82    return 0;
83}
84
85int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
86{
87    struct xfrm_mode *inner_mode = x->inner_mode;
88    int err;
89
90    err = x->outer_mode->afinfo->extract_input(x, skb);
91    if (err)
92        return err;
93
94    if (x->sel.family == AF_UNSPEC) {
95        inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
96        if (inner_mode == NULL)
97            return -EAFNOSUPPORT;
98    }
99
100    skb->protocol = inner_mode->afinfo->eth_proto;
101    return inner_mode->input2(x, skb);
102}
103EXPORT_SYMBOL(xfrm_prepare_input);
104
105int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
106{
107    struct net *net = dev_net(skb->dev);
108    int err;
109    __be32 seq;
110    __be32 seq_hi;
111    struct xfrm_state *x;
112    xfrm_address_t *daddr;
113    struct xfrm_mode *inner_mode;
114    unsigned int family;
115    int decaps = 0;
116    int async = 0;
117
118    /* A negative encap_type indicates async resumption. */
119    if (encap_type < 0) {
120        async = 1;
121        x = xfrm_input_state(skb);
122        seq = XFRM_SKB_CB(skb)->seq.input.low;
123        goto resume;
124    }
125
126    /* Allocate new secpath or COW existing one. */
127    if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
128        struct sec_path *sp;
129
130        sp = secpath_dup(skb->sp);
131        if (!sp) {
132            XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
133            goto drop;
134        }
135        if (skb->sp)
136            secpath_put(skb->sp);
137        skb->sp = sp;
138    }
139
140    daddr = (xfrm_address_t *)(skb_network_header(skb) +
141                   XFRM_SPI_SKB_CB(skb)->daddroff);
142    family = XFRM_SPI_SKB_CB(skb)->family;
143
144    seq = 0;
145    if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) {
146        XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
147        goto drop;
148    }
149
150    do {
151        if (skb->sp->len == XFRM_MAX_DEPTH) {
152            XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
153            goto drop;
154        }
155
156        x = xfrm_state_lookup(net, skb->mark, daddr, spi, nexthdr, family);
157        if (x == NULL) {
158            XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
159            xfrm_audit_state_notfound(skb, family, spi, seq);
160            goto drop;
161        }
162
163        skb->sp->xvec[skb->sp->len++] = x;
164
165        spin_lock(&x->lock);
166        if (unlikely(x->km.state == XFRM_STATE_ACQ)) {
167            XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
168            goto drop_unlock;
169        }
170
171        if (unlikely(x->km.state != XFRM_STATE_VALID)) {
172            XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEINVALID);
173            goto drop_unlock;
174        }
175
176        if ((x->encap ? x->encap->encap_type : 0) != encap_type) {
177            XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH);
178            goto drop_unlock;
179        }
180
181        if (x->repl->check(x, skb, seq)) {
182            XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
183            goto drop_unlock;
184        }
185
186        if (xfrm_state_check_expire(x)) {
187            XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEEXPIRED);
188            goto drop_unlock;
189        }
190
191        spin_unlock(&x->lock);
192
193        seq_hi = htonl(xfrm_replay_seqhi(x, seq));
194
195        XFRM_SKB_CB(skb)->seq.input.low = seq;
196        XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
197
198        skb_dst_force(skb);
199
200        nexthdr = x->type->input(x, skb);
201
202        if (nexthdr == -EINPROGRESS)
203            return 0;
204
205resume:
206        spin_lock(&x->lock);
207        if (nexthdr <= 0) {
208            if (nexthdr == -EBADMSG) {
209                xfrm_audit_state_icvfail(x, skb,
210                             x->type->proto);
211                x->stats.integrity_failed++;
212            }
213            XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEPROTOERROR);
214            goto drop_unlock;
215        }
216
217        /* only the first xfrm gets the encap type */
218        encap_type = 0;
219
220        if (async && x->repl->recheck(x, skb, seq)) {
221            XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
222            goto drop_unlock;
223        }
224
225        x->repl->advance(x, seq);
226
227        x->curlft.bytes += skb->len;
228        x->curlft.packets++;
229
230        spin_unlock(&x->lock);
231
232        XFRM_MODE_SKB_CB(skb)->protocol = nexthdr;
233
234        inner_mode = x->inner_mode;
235
236        if (x->sel.family == AF_UNSPEC) {
237            inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
238            if (inner_mode == NULL)
239                goto drop;
240        }
241
242        if (inner_mode->input(x, skb)) {
243            XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
244            goto drop;
245        }
246
247        if (x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) {
248            decaps = 1;
249            break;
250        }
251
252        /*
253         * We need the inner address. However, we only get here for
254         * transport mode so the outer address is identical.
255         */
256        daddr = &x->id.daddr;
257        family = x->outer_mode->afinfo->family;
258
259        err = xfrm_parse_spi(skb, nexthdr, &spi, &seq);
260        if (err < 0) {
261            XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
262            goto drop;
263        }
264    } while (!err);
265
266    nf_reset(skb);
267
268    if (decaps) {
269        skb_dst_drop(skb);
270        netif_rx(skb);
271        return 0;
272    } else {
273        return x->inner_mode->afinfo->transport_finish(skb, async);
274    }
275
276drop_unlock:
277    spin_unlock(&x->lock);
278drop:
279    kfree_skb(skb);
280    return 0;
281}
282EXPORT_SYMBOL(xfrm_input);
283
284int xfrm_input_resume(struct sk_buff *skb, int nexthdr)
285{
286    return xfrm_input(skb, nexthdr, 0, -1);
287}
288EXPORT_SYMBOL(xfrm_input_resume);
289
290void __init xfrm_input_init(void)
291{
292    secpath_cachep = kmem_cache_create("secpath_cache",
293                       sizeof(struct sec_path),
294                       0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
295                       NULL);
296}
297

Archive Download this file

Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master

Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9



interactive