Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm4_input.c |
| 3 | * |
| 4 | * Changes: |
| 5 | * YOSHIFUJI Hideaki @USAGI |
| 6 | * Split up af-specific portion |
| 7 | * Derek Atkins <derek@ihtfp.com> |
| 8 | * Add Encapsulation support |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 9 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 10 | */ |
| 11 | |
| 12 | #include <linux/module.h> |
| 13 | #include <linux/string.h> |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 14 | #include <linux/netfilter.h> |
| 15 | #include <linux/netfilter_ipv4.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 16 | #include <net/ip.h> |
| 17 | #include <net/xfrm.h> |
| 18 | |
Herbert Xu | 227620e | 2007-11-13 21:41:28 -0800 | [diff] [blame] | 19 | int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb) |
| 20 | { |
| 21 | return xfrm4_extract_header(skb); |
| 22 | } |
| 23 | |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 24 | static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb) |
| 25 | { |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 26 | if (skb->dst == NULL) { |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 27 | const struct iphdr *iph = ip_hdr(skb); |
| 28 | |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 29 | if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 30 | skb->dev)) |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 31 | goto drop; |
| 32 | } |
| 33 | return dst_input(skb); |
| 34 | drop: |
| 35 | kfree_skb(skb); |
| 36 | return NET_RX_DROP; |
| 37 | } |
Patrick McHardy | b05e106 | 2006-01-06 23:03:34 -0800 | [diff] [blame] | 38 | |
Herbert Xu | c4541b4 | 2007-10-17 21:28:53 -0700 | [diff] [blame] | 39 | int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi, |
| 40 | int encap_type) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 41 | { |
Herbert Xu | 2fcb45b | 2007-12-03 22:54:12 -0800 | [diff] [blame^] | 42 | XFRM_SPI_SKB_CB(skb)->family = AF_INET; |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 43 | XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr); |
| 44 | return xfrm_input(skb, nexthdr, spi, encap_type); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | } |
Herbert Xu | c4541b4 | 2007-10-17 21:28:53 -0700 | [diff] [blame] | 46 | EXPORT_SYMBOL(xfrm4_rcv_encap); |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 47 | |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 48 | int xfrm4_transport_finish(struct sk_buff *skb, int async) |
| 49 | { |
Herbert Xu | 60d5fcf | 2007-11-19 18:47:58 -0800 | [diff] [blame] | 50 | struct iphdr *iph = ip_hdr(skb); |
| 51 | |
| 52 | iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol; |
| 53 | |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 54 | #ifdef CONFIG_NETFILTER |
| 55 | __skb_push(skb, skb->data - skb_network_header(skb)); |
Herbert Xu | 60d5fcf | 2007-11-19 18:47:58 -0800 | [diff] [blame] | 56 | iph->tot_len = htons(skb->len); |
| 57 | ip_send_check(iph); |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 58 | |
Patrick McHardy | 6e23ae2 | 2007-11-19 18:53:30 -0800 | [diff] [blame] | 59 | NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL, |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 60 | xfrm4_rcv_encap_finish); |
| 61 | return 0; |
| 62 | #else |
Herbert Xu | 1bf06cd | 2007-11-19 18:50:17 -0800 | [diff] [blame] | 63 | if (async) |
| 64 | return xfrm4_rcv_encap_finish(skb); |
| 65 | |
Herbert Xu | 60d5fcf | 2007-11-19 18:47:58 -0800 | [diff] [blame] | 66 | return -iph->protocol; |
Herbert Xu | 716062f | 2007-11-13 21:44:23 -0800 | [diff] [blame] | 67 | #endif |
| 68 | } |
| 69 | |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 70 | /* If it's a keepalive packet, then just eat it. |
| 71 | * If it's an encapsulated packet, then pass it to the |
| 72 | * IPsec xfrm input. |
| 73 | * Returns 0 if skb passed to xfrm or was dropped. |
| 74 | * Returns >0 if skb should be passed to UDP. |
| 75 | * Returns <0 if skb should be resubmitted (-ret is protocol) |
| 76 | */ |
| 77 | int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) |
| 78 | { |
| 79 | struct udp_sock *up = udp_sk(sk); |
| 80 | struct udphdr *uh; |
| 81 | struct iphdr *iph; |
| 82 | int iphlen, len; |
| 83 | int ret; |
| 84 | |
| 85 | __u8 *udpdata; |
| 86 | __be32 *udpdata32; |
| 87 | __u16 encap_type = up->encap_type; |
| 88 | |
| 89 | /* if this is not encapsulated socket, then just return now */ |
| 90 | if (!encap_type) |
| 91 | return 1; |
| 92 | |
| 93 | /* If this is a paged skb, make sure we pull up |
| 94 | * whatever data we need to look at. */ |
| 95 | len = skb->len - sizeof(struct udphdr); |
| 96 | if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) |
| 97 | return 1; |
| 98 | |
| 99 | /* Now we can get the pointers */ |
| 100 | uh = udp_hdr(skb); |
| 101 | udpdata = (__u8 *)uh + sizeof(struct udphdr); |
| 102 | udpdata32 = (__be32 *)udpdata; |
| 103 | |
| 104 | switch (encap_type) { |
| 105 | default: |
| 106 | case UDP_ENCAP_ESPINUDP: |
| 107 | /* Check if this is a keepalive packet. If so, eat it. */ |
| 108 | if (len == 1 && udpdata[0] == 0xff) { |
| 109 | goto drop; |
| 110 | } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) { |
| 111 | /* ESP Packet without Non-ESP header */ |
| 112 | len = sizeof(struct udphdr); |
| 113 | } else |
| 114 | /* Must be an IKE packet.. pass it through */ |
| 115 | return 1; |
| 116 | break; |
| 117 | case UDP_ENCAP_ESPINUDP_NON_IKE: |
| 118 | /* Check if this is a keepalive packet. If so, eat it. */ |
| 119 | if (len == 1 && udpdata[0] == 0xff) { |
| 120 | goto drop; |
| 121 | } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) && |
| 122 | udpdata32[0] == 0 && udpdata32[1] == 0) { |
| 123 | |
| 124 | /* ESP Packet with Non-IKE marker */ |
| 125 | len = sizeof(struct udphdr) + 2 * sizeof(u32); |
| 126 | } else |
| 127 | /* Must be an IKE packet.. pass it through */ |
| 128 | return 1; |
| 129 | break; |
| 130 | } |
| 131 | |
| 132 | /* At this point we are sure that this is an ESPinUDP packet, |
| 133 | * so we need to remove 'len' bytes from the packet (the UDP |
| 134 | * header and optional ESP marker bytes) and then modify the |
| 135 | * protocol to ESP, and then call into the transform receiver. |
| 136 | */ |
| 137 | if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) |
| 138 | goto drop; |
| 139 | |
| 140 | /* Now we can update and verify the packet length... */ |
| 141 | iph = ip_hdr(skb); |
| 142 | iphlen = iph->ihl << 2; |
| 143 | iph->tot_len = htons(ntohs(iph->tot_len) - len); |
| 144 | if (skb->len < iphlen + len) { |
| 145 | /* packet is too small!?! */ |
| 146 | goto drop; |
| 147 | } |
| 148 | |
| 149 | /* pull the data buffer up to the ESP header and set the |
| 150 | * transport header to point to ESP. Keep UDP on the stack |
| 151 | * for later. |
| 152 | */ |
| 153 | __skb_pull(skb, len); |
| 154 | skb_reset_transport_header(skb); |
| 155 | |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 156 | /* process ESP */ |
Herbert Xu | c4541b4 | 2007-10-17 21:28:53 -0700 | [diff] [blame] | 157 | ret = xfrm4_rcv_encap(skb, IPPROTO_ESP, 0, encap_type); |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 158 | return ret; |
| 159 | |
| 160 | drop: |
| 161 | kfree_skb(skb); |
| 162 | return 0; |
| 163 | } |
| 164 | |
| 165 | int xfrm4_rcv(struct sk_buff *skb) |
| 166 | { |
Herbert Xu | c4541b4 | 2007-10-17 21:28:53 -0700 | [diff] [blame] | 167 | return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0); |
James Chapman | 067b207 | 2007-07-05 17:08:05 -0700 | [diff] [blame] | 168 | } |
| 169 | |
| 170 | EXPORT_SYMBOL(xfrm4_rcv); |