Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm4_input.c |
| 3 | * |
| 4 | * Changes: |
| 5 | * YOSHIFUJI Hideaki @USAGI |
| 6 | * Split up af-specific portion |
| 7 | * Derek Atkins <derek@ihtfp.com> |
| 8 | * Add Encapsulation support |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 9 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 10 | */ |
| 11 | |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 12 | #include <linux/slab.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 13 | #include <linux/module.h> |
| 14 | #include <linux/string.h> |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 15 | #include <linux/netfilter.h> |
| 16 | #include <linux/netfilter_ipv4.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | #include <net/ip.h> |
| 18 | #include <net/xfrm.h> |
| 19 | |
Herbert Xu | 227620e | 2007-11-13 21:41:28 -0800 | [diff] [blame] | 20 | int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb) |
| 21 | { |
| 22 | return xfrm4_extract_header(skb); |
| 23 | } |
| 24 | |
Eric W. Biederman | 0c4b51f | 2015-09-15 20:04:18 -0500 | [diff] [blame] | 25 | static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk, |
| 26 | struct sk_buff *skb) |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 27 | { |
Ian Morris | 51456b2 | 2015-04-03 09:17:26 +0100 | [diff] [blame] | 28 | if (!skb_dst(skb)) { |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 29 | const struct iphdr *iph = ip_hdr(skb); |
| 30 | |
David S. Miller | c6cffba | 2012-07-26 11:14:38 +0000 | [diff] [blame] | 31 | if (ip_route_input_noref(skb, iph->daddr, iph->saddr, |
| 32 | iph->tos, skb->dev)) |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 33 | goto drop; |
| 34 | } |
| 35 | return dst_input(skb); |
| 36 | drop: |
| 37 | kfree_skb(skb); |
| 38 | return NET_RX_DROP; |
| 39 | } |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 40 | |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 41 | int xfrm4_transport_finish(struct sk_buff *skb, int async) |
| 42 | { |
Steffen Klassert | 7785bba | 2017-02-15 09:40:00 +0100 | [diff] [blame] | 43 | struct xfrm_offload *xo = xfrm_offload(skb); |
Herbert Xu | 60d5fcf | 2007-11-19 18:47:58 -0800 | [diff] [blame] | 44 | struct iphdr *iph = ip_hdr(skb); |
| 45 | |
| 46 | iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol; |
| 47 | |
Herbert Xu | 0883ae0 | 2007-12-30 21:10:14 -0800 | [diff] [blame] | 48 | #ifndef CONFIG_NETFILTER |
| 49 | if (!async) |
| 50 | return -iph->protocol; |
| 51 | #endif |
| 52 | |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 53 | __skb_push(skb, skb->data - skb_network_header(skb)); |
Herbert Xu | 60d5fcf | 2007-11-19 18:47:58 -0800 | [diff] [blame] | 54 | iph->tot_len = htons(skb->len); |
| 55 | ip_send_check(iph); |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 56 | |
Steffen Klassert | 7785bba | 2017-02-15 09:40:00 +0100 | [diff] [blame] | 57 | if (xo && (xo->flags & XFRM_GRO)) { |
| 58 | skb_mac_header_rebuild(skb); |
| 59 | return 0; |
| 60 | } |
| 61 | |
Eric W. Biederman | 29a26a5 | 2015-09-15 20:04:16 -0500 | [diff] [blame] | 62 | NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, |
| 63 | dev_net(skb->dev), NULL, skb, skb->dev, NULL, |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 64 | xfrm4_rcv_encap_finish); |
| 65 | return 0; |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 66 | } |
| 67 | |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 68 | /* If it's a keepalive packet, then just eat it. |
| 69 | * If it's an encapsulated packet, then pass it to the |
| 70 | * IPsec xfrm input. |
| 71 | * Returns 0 if skb passed to xfrm or was dropped. |
| 72 | * Returns >0 if skb should be passed to UDP. |
| 73 | * Returns <0 if skb should be resubmitted (-ret is protocol) |
| 74 | */ |
| 75 | int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) |
| 76 | { |
| 77 | struct udp_sock *up = udp_sk(sk); |
| 78 | struct udphdr *uh; |
| 79 | struct iphdr *iph; |
| 80 | int iphlen, len; |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 81 | |
| 82 | __u8 *udpdata; |
| 83 | __be32 *udpdata32; |
| 84 | __u16 encap_type = up->encap_type; |
| 85 | |
| 86 | /* if this is not encapsulated socket, then just return now */ |
| 87 | if (!encap_type) |
| 88 | return 1; |
| 89 | |
| 90 | /* If this is a paged skb, make sure we pull up |
| 91 | * whatever data we need to look at. */ |
| 92 | len = skb->len - sizeof(struct udphdr); |
| 93 | if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) |
| 94 | return 1; |
| 95 | |
| 96 | /* Now we can get the pointers */ |
| 97 | uh = udp_hdr(skb); |
| 98 | udpdata = (__u8 *)uh + sizeof(struct udphdr); |
| 99 | udpdata32 = (__be32 *)udpdata; |
| 100 | |
| 101 | switch (encap_type) { |
| 102 | default: |
| 103 | case UDP_ENCAP_ESPINUDP: |
| 104 | /* Check if this is a keepalive packet. If so, eat it. */ |
| 105 | if (len == 1 && udpdata[0] == 0xff) { |
| 106 | goto drop; |
| 107 | } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) { |
| 108 | /* ESP Packet without Non-ESP header */ |
| 109 | len = sizeof(struct udphdr); |
| 110 | } else |
| 111 | /* Must be an IKE packet.. pass it through */ |
| 112 | return 1; |
| 113 | break; |
| 114 | case UDP_ENCAP_ESPINUDP_NON_IKE: |
| 115 | /* Check if this is a keepalive packet. If so, eat it. */ |
| 116 | if (len == 1 && udpdata[0] == 0xff) { |
| 117 | goto drop; |
| 118 | } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) && |
| 119 | udpdata32[0] == 0 && udpdata32[1] == 0) { |
| 120 | |
| 121 | /* ESP Packet with Non-IKE marker */ |
| 122 | len = sizeof(struct udphdr) + 2 * sizeof(u32); |
| 123 | } else |
| 124 | /* Must be an IKE packet.. pass it through */ |
| 125 | return 1; |
| 126 | break; |
| 127 | } |
| 128 | |
| 129 | /* At this point we are sure that this is an ESPinUDP packet, |
| 130 | * so we need to remove 'len' bytes from the packet (the UDP |
| 131 | * header and optional ESP marker bytes) and then modify the |
| 132 | * protocol to ESP, and then call into the transform receiver. |
| 133 | */ |
Pravin B Shelar | 14bbd6a | 2013-02-14 09:44:49 +0000 | [diff] [blame] | 134 | if (skb_unclone(skb, GFP_ATOMIC)) |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 135 | goto drop; |
| 136 | |
| 137 | /* Now we can update and verify the packet length... */ |
| 138 | iph = ip_hdr(skb); |
| 139 | iphlen = iph->ihl << 2; |
| 140 | iph->tot_len = htons(ntohs(iph->tot_len) - len); |
| 141 | if (skb->len < iphlen + len) { |
| 142 | /* packet is too small!?! */ |
| 143 | goto drop; |
| 144 | } |
| 145 | |
| 146 | /* pull the data buffer up to the ESP header and set the |
| 147 | * transport header to point to ESP. Keep UDP on the stack |
| 148 | * for later. |
| 149 | */ |
| 150 | __skb_pull(skb, len); |
| 151 | skb_reset_transport_header(skb); |
| 152 | |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 153 | /* process ESP */ |
Herbert Xu | f2712fd | 2008-12-26 01:31:18 -0800 | [diff] [blame] | 154 | return xfrm4_rcv_encap(skb, IPPROTO_ESP, 0, encap_type); |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 155 | |
| 156 | drop: |
| 157 | kfree_skb(skb); |
| 158 | return 0; |
| 159 | } |
| 160 | |
| 161 | int xfrm4_rcv(struct sk_buff *skb) |
| 162 | { |
Herbert Xu | c4541b4 | 2007-10-17 21:28:53 -0700 | [diff] [blame] | 163 | return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0); |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 164 | } |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 165 | EXPORT_SYMBOL(xfrm4_rcv); |