blob: 60ce7014e1b094ef0013f27330ab8c0bec24e284 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm_input.c
3 *
4 * Changes:
5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
YOSHIFUJI Hideakia716c112007-02-09 23:25:29 +09007 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07008 */
9
10#include <linux/slab.h>
11#include <linux/module.h>
Herbert Xu716062f2007-11-13 21:44:23 -080012#include <linux/netdevice.h>
13#include <net/dst.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014#include <net/ip.h>
15#include <net/xfrm.h>
Alexander Duyck049f8e22015-05-27 07:16:49 -070016#include <net/ip_tunnels.h>
17#include <net/ip6_tunnel.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070018
Christoph Lametere18b8902006-12-06 20:33:20 -080019static struct kmem_cache *secpath_cachep __read_mostly;
Linus Torvalds1da177e2005-04-16 15:20:36 -070020
Steffen Klassert2f32b512014-03-14 07:28:07 +010021static DEFINE_SPINLOCK(xfrm_input_afinfo_lock);
22static struct xfrm_input_afinfo __rcu *xfrm_input_afinfo[NPROTO];
23
24int xfrm_input_register_afinfo(struct xfrm_input_afinfo *afinfo)
25{
26 int err = 0;
27
28 if (unlikely(afinfo == NULL))
29 return -EINVAL;
30 if (unlikely(afinfo->family >= NPROTO))
31 return -EAFNOSUPPORT;
32 spin_lock_bh(&xfrm_input_afinfo_lock);
33 if (unlikely(xfrm_input_afinfo[afinfo->family] != NULL))
Li RongQingf31e8d4f2015-04-23 11:06:53 +080034 err = -EEXIST;
Steffen Klassert2f32b512014-03-14 07:28:07 +010035 else
36 rcu_assign_pointer(xfrm_input_afinfo[afinfo->family], afinfo);
37 spin_unlock_bh(&xfrm_input_afinfo_lock);
38 return err;
39}
40EXPORT_SYMBOL(xfrm_input_register_afinfo);
41
42int xfrm_input_unregister_afinfo(struct xfrm_input_afinfo *afinfo)
43{
44 int err = 0;
45
46 if (unlikely(afinfo == NULL))
47 return -EINVAL;
48 if (unlikely(afinfo->family >= NPROTO))
49 return -EAFNOSUPPORT;
50 spin_lock_bh(&xfrm_input_afinfo_lock);
51 if (likely(xfrm_input_afinfo[afinfo->family] != NULL)) {
52 if (unlikely(xfrm_input_afinfo[afinfo->family] != afinfo))
53 err = -EINVAL;
54 else
55 RCU_INIT_POINTER(xfrm_input_afinfo[afinfo->family], NULL);
56 }
57 spin_unlock_bh(&xfrm_input_afinfo_lock);
58 synchronize_rcu();
59 return err;
60}
61EXPORT_SYMBOL(xfrm_input_unregister_afinfo);
62
63static struct xfrm_input_afinfo *xfrm_input_get_afinfo(unsigned int family)
64{
65 struct xfrm_input_afinfo *afinfo;
66
67 if (unlikely(family >= NPROTO))
68 return NULL;
69 rcu_read_lock();
70 afinfo = rcu_dereference(xfrm_input_afinfo[family]);
71 if (unlikely(!afinfo))
72 rcu_read_unlock();
73 return afinfo;
74}
75
76static void xfrm_input_put_afinfo(struct xfrm_input_afinfo *afinfo)
77{
78 rcu_read_unlock();
79}
80
81static int xfrm_rcv_cb(struct sk_buff *skb, unsigned int family, u8 protocol,
82 int err)
83{
84 int ret;
85 struct xfrm_input_afinfo *afinfo = xfrm_input_get_afinfo(family);
86
87 if (!afinfo)
88 return -EAFNOSUPPORT;
89
90 ret = afinfo->callback(skb, protocol, err);
91 xfrm_input_put_afinfo(afinfo);
92
93 return ret;
94}
95
Linus Torvalds1da177e2005-04-16 15:20:36 -070096void __secpath_destroy(struct sec_path *sp)
97{
98 int i;
99 for (i = 0; i < sp->len; i++)
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800100 xfrm_state_put(sp->xvec[i]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700101 kmem_cache_free(secpath_cachep, sp);
102}
103EXPORT_SYMBOL(__secpath_destroy);
104
105struct sec_path *secpath_dup(struct sec_path *src)
106{
107 struct sec_path *sp;
108
Christoph Lameter54e6ecb2006-12-06 20:33:16 -0800109 sp = kmem_cache_alloc(secpath_cachep, GFP_ATOMIC);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110 if (!sp)
111 return NULL;
112
113 sp->len = 0;
114 if (src) {
115 int i;
116
117 memcpy(sp, src, sizeof(*sp));
118 for (i = 0; i < sp->len; i++)
Herbert Xudbe5b4a2006-04-01 00:54:16 -0800119 xfrm_state_hold(sp->xvec[i]);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700120 }
121 atomic_set(&sp->refcnt, 1);
122 return sp;
123}
124EXPORT_SYMBOL(secpath_dup);
125
126/* Fetch spi and seq from ipsec header */
127
Al Viro6067b2b2006-09-27 18:47:59 -0700128int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, __be32 *spi, __be32 *seq)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700129{
130 int offset, offset_seq;
Herbert Xu44072502007-10-17 21:30:34 -0700131 int hlen;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132
133 switch (nexthdr) {
134 case IPPROTO_AH:
Herbert Xu44072502007-10-17 21:30:34 -0700135 hlen = sizeof(struct ip_auth_hdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136 offset = offsetof(struct ip_auth_hdr, spi);
137 offset_seq = offsetof(struct ip_auth_hdr, seq_no);
138 break;
139 case IPPROTO_ESP:
Herbert Xu44072502007-10-17 21:30:34 -0700140 hlen = sizeof(struct ip_esp_hdr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700141 offset = offsetof(struct ip_esp_hdr, spi);
142 offset_seq = offsetof(struct ip_esp_hdr, seq_no);
143 break;
144 case IPPROTO_COMP:
145 if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
146 return -EINVAL;
Weilong Chen3e94c2d2013-12-24 09:43:47 +0800147 *spi = htonl(ntohs(*(__be16 *)(skb_transport_header(skb) + 2)));
Linus Torvalds1da177e2005-04-16 15:20:36 -0700148 *seq = 0;
149 return 0;
150 default:
151 return 1;
152 }
153
Herbert Xu44072502007-10-17 21:30:34 -0700154 if (!pskb_may_pull(skb, hlen))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700155 return -EINVAL;
156
Weilong Chen3e94c2d2013-12-24 09:43:47 +0800157 *spi = *(__be32 *)(skb_transport_header(skb) + offset);
158 *seq = *(__be32 *)(skb_transport_header(skb) + offset_seq);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700159 return 0;
160}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700161
Herbert Xu227620e2007-11-13 21:41:28 -0800162int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
163{
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700164 struct xfrm_mode *inner_mode = x->inner_mode;
Herbert Xu227620e2007-11-13 21:41:28 -0800165 int err;
166
167 err = x->outer_mode->afinfo->extract_input(x, skb);
168 if (err)
169 return err;
170
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700171 if (x->sel.family == AF_UNSPEC) {
172 inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
173 if (inner_mode == NULL)
174 return -EAFNOSUPPORT;
175 }
176
177 skb->protocol = inner_mode->afinfo->eth_proto;
178 return inner_mode->input2(x, skb);
Herbert Xu227620e2007-11-13 21:41:28 -0800179}
180EXPORT_SYMBOL(xfrm_prepare_input);
181
Herbert Xu716062f2007-11-13 21:44:23 -0800182int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
183{
Alexey Dobriyanbd235e32008-11-25 17:37:56 -0800184 struct net *net = dev_net(skb->dev);
Herbert Xu716062f2007-11-13 21:44:23 -0800185 int err;
186 __be32 seq;
Steffen Klassert2cd08462011-03-08 00:09:51 +0000187 __be32 seq_hi;
Steffen Klassert33287152014-02-21 08:41:08 +0100188 struct xfrm_state *x = NULL;
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800189 xfrm_address_t *daddr;
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700190 struct xfrm_mode *inner_mode;
Alexander Duyck049f8e22015-05-27 07:16:49 -0700191 u32 mark = skb->mark;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800192 unsigned int family;
Herbert Xu716062f2007-11-13 21:44:23 -0800193 int decaps = 0;
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800194 int async = 0;
195
196 /* A negative encap_type indicates async resumption. */
197 if (encap_type < 0) {
198 async = 1;
Herbert Xu00501122007-12-11 01:53:43 -0800199 x = xfrm_input_state(skb);
Steffen Klassert1ce36442011-03-08 00:06:31 +0000200 seq = XFRM_SKB_CB(skb)->seq.input.low;
Steffen Klassert33287152014-02-21 08:41:08 +0100201 family = x->outer_mode->afinfo->family;
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800202 goto resume;
203 }
Herbert Xu716062f2007-11-13 21:44:23 -0800204
Steffen Klassert33287152014-02-21 08:41:08 +0100205 daddr = (xfrm_address_t *)(skb_network_header(skb) +
206 XFRM_SPI_SKB_CB(skb)->daddroff);
207 family = XFRM_SPI_SKB_CB(skb)->family;
208
Alexander Duyck049f8e22015-05-27 07:16:49 -0700209 /* if tunnel is present override skb->mark value with tunnel i_key */
210 if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
211 switch (family) {
212 case AF_INET:
213 mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
214 break;
215 case AF_INET6:
216 mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
217 break;
218 }
219 }
220
Herbert Xub2aa5e92007-11-13 21:44:55 -0800221 /* Allocate new secpath or COW existing one. */
222 if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
223 struct sec_path *sp;
224
225 sp = secpath_dup(skb->sp);
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800226 if (!sp) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800227 XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
Herbert Xub2aa5e92007-11-13 21:44:55 -0800228 goto drop;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800229 }
Herbert Xub2aa5e92007-11-13 21:44:55 -0800230 if (skb->sp)
231 secpath_put(skb->sp);
232 skb->sp = sp;
233 }
234
Herbert Xu716062f2007-11-13 21:44:23 -0800235 seq = 0;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800236 if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800237 XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
Herbert Xu716062f2007-11-13 21:44:23 -0800238 goto drop;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800239 }
Herbert Xu716062f2007-11-13 21:44:23 -0800240
241 do {
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800242 if (skb->sp->len == XFRM_MAX_DEPTH) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800243 XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
Herbert Xu716062f2007-11-13 21:44:23 -0800244 goto drop;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800245 }
Herbert Xu716062f2007-11-13 21:44:23 -0800246
Alexander Duyck049f8e22015-05-27 07:16:49 -0700247 x = xfrm_state_lookup(net, mark, daddr, spi, nexthdr, family);
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800248 if (x == NULL) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800249 XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
Paul Mooreafeb14b2007-12-21 14:58:11 -0800250 xfrm_audit_state_notfound(skb, family, spi, seq);
Herbert Xu716062f2007-11-13 21:44:23 -0800251 goto drop;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800252 }
Herbert Xu716062f2007-11-13 21:44:23 -0800253
Herbert Xub2aa5e92007-11-13 21:44:55 -0800254 skb->sp->xvec[skb->sp->len++] = x;
255
Herbert Xu716062f2007-11-13 21:44:23 -0800256 spin_lock(&x->lock);
Fan Du4c4d41f2013-06-06 10:15:54 +0800257
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800258 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
Li RongQingdc0565c2015-04-24 16:49:31 +0800259 if (x->km.state == XFRM_STATE_ACQ)
260 XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
261 else
262 XFRM_INC_STATS(net,
263 LINUX_MIB_XFRMINSTATEINVALID);
Herbert Xu716062f2007-11-13 21:44:23 -0800264 goto drop_unlock;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800265 }
Herbert Xu716062f2007-11-13 21:44:23 -0800266
David S. Miller3de77cf2008-12-18 19:23:56 -0800267 if ((x->encap ? x->encap->encap_type : 0) != encap_type) {
268 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMISMATCH);
269 goto drop_unlock;
270 }
271
Steffen Klassert36ae0142011-03-28 19:45:52 +0000272 if (x->repl->check(x, skb, seq)) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800273 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
Herbert Xu716062f2007-11-13 21:44:23 -0800274 goto drop_unlock;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800275 }
Herbert Xu716062f2007-11-13 21:44:23 -0800276
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800277 if (xfrm_state_check_expire(x)) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800278 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEEXPIRED);
Herbert Xu716062f2007-11-13 21:44:23 -0800279 goto drop_unlock;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800280 }
Herbert Xu716062f2007-11-13 21:44:23 -0800281
Herbert Xu0ebea8e2007-11-13 21:45:58 -0800282 spin_unlock(&x->lock);
283
Alexey Dobriyan68c11e92015-04-02 10:58:24 +0300284 if (xfrm_tunnel_check(skb, x, family)) {
285 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
286 goto drop;
287 }
288
Steffen Klassert2cd08462011-03-08 00:09:51 +0000289 seq_hi = htonl(xfrm_replay_seqhi(x, seq));
290
Steffen Klassert1ce36442011-03-08 00:06:31 +0000291 XFRM_SKB_CB(skb)->seq.input.low = seq;
Steffen Klassert2cd08462011-03-08 00:09:51 +0000292 XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800293
Steffen Klassert3bc07322011-03-15 21:08:28 +0000294 skb_dst_force(skb);
295
Herbert Xu716062f2007-11-13 21:44:23 -0800296 nexthdr = x->type->input(x, skb);
Herbert Xu0ebea8e2007-11-13 21:45:58 -0800297
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800298 if (nexthdr == -EINPROGRESS)
299 return 0;
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800300resume:
Herbert Xu0ebea8e2007-11-13 21:45:58 -0800301 spin_lock(&x->lock);
Herbert Xu668dc8a2007-12-16 15:55:02 -0800302 if (nexthdr <= 0) {
Herbert Xu9dd32452007-12-30 21:10:30 -0800303 if (nexthdr == -EBADMSG) {
304 xfrm_audit_state_icvfail(x, skb,
305 x->type->proto);
Herbert Xu668dc8a2007-12-16 15:55:02 -0800306 x->stats.integrity_failed++;
Herbert Xu9dd32452007-12-30 21:10:30 -0800307 }
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800308 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEPROTOERROR);
Herbert Xu716062f2007-11-13 21:44:23 -0800309 goto drop_unlock;
Herbert Xu668dc8a2007-12-16 15:55:02 -0800310 }
Herbert Xu716062f2007-11-13 21:44:23 -0800311
Herbert Xu716062f2007-11-13 21:44:23 -0800312 /* only the first xfrm gets the encap type */
313 encap_type = 0;
314
Steffen Klassert3b59df42012-09-04 00:03:29 +0000315 if (async && x->repl->recheck(x, skb, seq)) {
Steffen Klassertbcf66bf2011-09-20 23:38:58 +0000316 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATESEQERROR);
317 goto drop_unlock;
318 }
319
Steffen Klassert9fdc4882011-03-08 00:08:32 +0000320 x->repl->advance(x, seq);
Herbert Xu716062f2007-11-13 21:44:23 -0800321
322 x->curlft.bytes += skb->len;
323 x->curlft.packets++;
324
325 spin_unlock(&x->lock);
326
Herbert Xu60d5fcf2007-11-19 18:47:58 -0800327 XFRM_MODE_SKB_CB(skb)->protocol = nexthdr;
328
Kazunori MIYAZAWAdf9dcb42008-03-24 14:51:51 -0700329 inner_mode = x->inner_mode;
330
331 if (x->sel.family == AF_UNSPEC) {
332 inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
333 if (inner_mode == NULL)
334 goto drop;
335 }
336
337 if (inner_mode->input(x, skb)) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800338 XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
Herbert Xu716062f2007-11-13 21:44:23 -0800339 goto drop;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800340 }
Herbert Xu716062f2007-11-13 21:44:23 -0800341
342 if (x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) {
343 decaps = 1;
344 break;
345 }
346
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800347 /*
348 * We need the inner address. However, we only get here for
349 * transport mode so the outer address is identical.
350 */
351 daddr = &x->id.daddr;
Herbert Xu2fcb45b2007-12-03 22:54:12 -0800352 family = x->outer_mode->afinfo->family;
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800353
Herbert Xu716062f2007-11-13 21:44:23 -0800354 err = xfrm_parse_spi(skb, nexthdr, &spi, &seq);
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800355 if (err < 0) {
Alexey Dobriyan59c99402008-11-25 17:59:52 -0800356 XFRM_INC_STATS(net, LINUX_MIB_XFRMINHDRERROR);
Herbert Xu716062f2007-11-13 21:44:23 -0800357 goto drop;
Masahide NAKAMURA0aa64772007-12-20 20:43:36 -0800358 }
Herbert Xu716062f2007-11-13 21:44:23 -0800359 } while (!err);
360
Steffen Klassert33287152014-02-21 08:41:08 +0100361 err = xfrm_rcv_cb(skb, family, x->type->proto, 0);
362 if (err)
363 goto drop;
364
Herbert Xu716062f2007-11-13 21:44:23 -0800365 nf_reset(skb);
366
367 if (decaps) {
Eric Dumazetadf30902009-06-02 05:19:30 +0000368 skb_dst_drop(skb);
Herbert Xu716062f2007-11-13 21:44:23 -0800369 netif_rx(skb);
370 return 0;
371 } else {
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800372 return x->inner_mode->afinfo->transport_finish(skb, async);
Herbert Xu716062f2007-11-13 21:44:23 -0800373 }
374
375drop_unlock:
376 spin_unlock(&x->lock);
Herbert Xu716062f2007-11-13 21:44:23 -0800377drop:
Steffen Klassert33287152014-02-21 08:41:08 +0100378 xfrm_rcv_cb(skb, family, x && x->type ? x->type->proto : nexthdr, -1);
Herbert Xu716062f2007-11-13 21:44:23 -0800379 kfree_skb(skb);
380 return 0;
381}
382EXPORT_SYMBOL(xfrm_input);
383
Herbert Xu1bf06cd2007-11-19 18:50:17 -0800384int xfrm_input_resume(struct sk_buff *skb, int nexthdr)
385{
386 return xfrm_input(skb, nexthdr, 0, -1);
387}
388EXPORT_SYMBOL(xfrm_input_resume);
389
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390void __init xfrm_input_init(void)
391{
392 secpath_cachep = kmem_cache_create("secpath_cache",
393 sizeof(struct sec_path),
Alexey Dobriyane5d679f332006-08-26 19:25:52 -0700394 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC,
Paul Mundt20c2df82007-07-20 10:11:58 +0900395 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700396}