]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
1da177e4 LT |
2 | /* |
3 | * xfrm6_input.c: based on net/ipv4/xfrm4_input.c | |
4 | * | |
5 | * Authors: | |
6 | * Mitsuru KANDA @USAGI | |
67ba4152 IM |
7 | * Kazunori MIYAZAWA @USAGI |
8 | * Kunihiro Ishiguro <kunihiro@ipinfusion.com> | |
1da177e4 LT |
9 | * YOSHIFUJI Hideaki @USAGI |
10 | * IPv6 support | |
11 | */ | |
12 | ||
13 | #include <linux/module.h> | |
14 | #include <linux/string.h> | |
b05e1066 PM |
15 | #include <linux/netfilter.h> |
16 | #include <linux/netfilter_ipv6.h> | |
1da177e4 LT |
17 | #include <net/ipv6.h> |
18 | #include <net/xfrm.h> | |
221ddb72 SK |
19 | #include <net/protocol.h> |
20 | #include <net/gro.h> | |
1da177e4 | 21 | |
63c43787 ND |
22 | int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, |
23 | struct ip6_tnl *t) | |
1da177e4 | 24 | { |
63c43787 | 25 | XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t; |
2fcb45b6 | 26 | XFRM_SPI_SKB_CB(skb)->family = AF_INET6; |
716062fd HX |
27 | XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr); |
28 | return xfrm_input(skb, nexthdr, spi, 0); | |
29 | } | |
30 | EXPORT_SYMBOL(xfrm6_rcv_spi); | |
b05e1066 | 31 | |
acf568ee HX |
32 | static int xfrm6_transport_finish2(struct net *net, struct sock *sk, |
33 | struct sk_buff *skb) | |
34 | { | |
0146dca7 SD |
35 | if (xfrm_trans_queue(skb, ip6_rcv_finish)) { |
36 | kfree_skb(skb); | |
37 | return NET_RX_DROP; | |
38 | } | |
39 | ||
40 | return 0; | |
acf568ee HX |
41 | } |
42 | ||
716062fd HX |
43 | int xfrm6_transport_finish(struct sk_buff *skb, int async) |
44 | { | |
7785bba2 | 45 | struct xfrm_offload *xo = xfrm_offload(skb); |
80bfab79 | 46 | int nhlen = -skb_network_offset(skb); |
7785bba2 | 47 | |
60d5fcfb HX |
48 | skb_network_header(skb)[IP6CB(skb)->nhoff] = |
49 | XFRM_MODE_SKB_CB(skb)->protocol; | |
50 | ||
0883ae0e HX |
51 | #ifndef CONFIG_NETFILTER |
52 | if (!async) | |
53 | return 1; | |
54 | #endif | |
55 | ||
e9cba694 | 56 | __skb_push(skb, nhlen); |
7c88e21a | 57 | ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); |
e9cba694 | 58 | skb_postpush_rcsum(skb, skb_network_header(skb), nhlen); |
b05e1066 | 59 | |
7785bba2 | 60 | if (xo && (xo->flags & XFRM_GRO)) { |
58fbfeca PD |
61 | /* The full l2 header needs to be preserved so that re-injecting the packet at l2 |
62 | * works correctly in the presence of vlan tags. | |
63 | */ | |
64 | skb_mac_header_rebuild_full(skb, xo->orig_mac_len); | |
65 | skb_reset_network_header(skb); | |
bfc0698b | 66 | skb_reset_transport_header(skb); |
0146dca7 | 67 | return 0; |
7785bba2 SK |
68 | } |
69 | ||
29a26a56 EB |
70 | NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, |
71 | dev_net(skb->dev), NULL, skb, skb->dev, NULL, | |
acf568ee | 72 | xfrm6_transport_finish2); |
0146dca7 SD |
73 | return 0; |
74 | } | |
75 | ||
221ddb72 | 76 | static int __xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb, bool pull) |
0146dca7 SD |
77 | { |
78 | struct udp_sock *up = udp_sk(sk); | |
79 | struct udphdr *uh; | |
80 | struct ipv6hdr *ip6h; | |
81 | int len; | |
82 | int ip6hlen = sizeof(struct ipv6hdr); | |
0146dca7 SD |
83 | __u8 *udpdata; |
84 | __be32 *udpdata32; | |
70a36f57 | 85 | u16 encap_type; |
0146dca7 | 86 | |
70a36f57 | 87 | encap_type = READ_ONCE(up->encap_type); |
0146dca7 SD |
88 | /* if this is not encapsulated socket, then just return now */ |
89 | if (!encap_type) | |
90 | return 1; | |
91 | ||
92 | /* If this is a paged skb, make sure we pull up | |
93 | * whatever data we need to look at. */ | |
94 | len = skb->len - sizeof(struct udphdr); | |
95 | if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8))) | |
96 | return 1; | |
97 | ||
98 | /* Now we can get the pointers */ | |
99 | uh = udp_hdr(skb); | |
100 | udpdata = (__u8 *)uh + sizeof(struct udphdr); | |
101 | udpdata32 = (__be32 *)udpdata; | |
102 | ||
103 | switch (encap_type) { | |
104 | default: | |
105 | case UDP_ENCAP_ESPINUDP: | |
106 | /* Check if this is a keepalive packet. If so, eat it. */ | |
107 | if (len == 1 && udpdata[0] == 0xff) { | |
221ddb72 | 108 | return -EINVAL; |
0146dca7 SD |
109 | } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) { |
110 | /* ESP Packet without Non-ESP header */ | |
111 | len = sizeof(struct udphdr); | |
112 | } else | |
113 | /* Must be an IKE packet.. pass it through */ | |
114 | return 1; | |
115 | break; | |
0146dca7 SD |
116 | } |
117 | ||
118 | /* At this point we are sure that this is an ESPinUDP packet, | |
119 | * so we need to remove 'len' bytes from the packet (the UDP | |
120 | * header and optional ESP marker bytes) and then modify the | |
121 | * protocol to ESP, and then call into the transform receiver. | |
122 | */ | |
123 | if (skb_unclone(skb, GFP_ATOMIC)) | |
221ddb72 | 124 | return -EINVAL; |
0146dca7 SD |
125 | |
126 | /* Now we can update and verify the packet length... */ | |
127 | ip6h = ipv6_hdr(skb); | |
128 | ip6h->payload_len = htons(ntohs(ip6h->payload_len) - len); | |
129 | if (skb->len < ip6hlen + len) { | |
130 | /* packet is too small!?! */ | |
221ddb72 | 131 | return -EINVAL; |
0146dca7 SD |
132 | } |
133 | ||
134 | /* pull the data buffer up to the ESP header and set the | |
135 | * transport header to point to ESP. Keep UDP on the stack | |
136 | * for later. | |
137 | */ | |
221ddb72 SK |
138 | if (pull) { |
139 | __skb_pull(skb, len); | |
140 | skb_reset_transport_header(skb); | |
141 | } else { | |
142 | skb_set_transport_header(skb, len); | |
143 | } | |
0146dca7 SD |
144 | |
145 | /* process ESP */ | |
0146dca7 | 146 | return 0; |
1da177e4 LT |
147 | } |
148 | ||
221ddb72 SK |
149 | /* If it's a keepalive packet, then just eat it. |
150 | * If it's an encapsulated packet, then pass it to the | |
151 | * IPsec xfrm input. | |
152 | * Returns 0 if skb passed to xfrm or was dropped. | |
153 | * Returns >0 if skb should be passed to UDP. | |
154 | * Returns <0 if skb should be resubmitted (-ret is protocol) | |
155 | */ | |
156 | int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) | |
157 | { | |
158 | int ret; | |
159 | ||
53a5b4f2 SK |
160 | if (skb->protocol == htons(ETH_P_IP)) |
161 | return xfrm4_udp_encap_rcv(sk, skb); | |
162 | ||
221ddb72 SK |
163 | ret = __xfrm6_udp_encap_rcv(sk, skb, true); |
164 | if (!ret) | |
165 | return xfrm6_rcv_encap(skb, IPPROTO_ESP, 0, | |
166 | udp_sk(sk)->encap_type); | |
167 | ||
168 | if (ret < 0) { | |
169 | kfree_skb(skb); | |
170 | return 0; | |
171 | } | |
172 | ||
173 | return ret; | |
174 | } | |
175 | ||
176 | struct sk_buff *xfrm6_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, | |
177 | struct sk_buff *skb) | |
178 | { | |
179 | int offset = skb_gro_offset(skb); | |
180 | const struct net_offload *ops; | |
181 | struct sk_buff *pp = NULL; | |
182 | int ret; | |
183 | ||
53a5b4f2 SK |
184 | if (skb->protocol == htons(ETH_P_IP)) |
185 | return xfrm4_gro_udp_encap_rcv(sk, head, skb); | |
186 | ||
221ddb72 SK |
187 | offset = offset - sizeof(struct udphdr); |
188 | ||
189 | if (!pskb_pull(skb, offset)) | |
190 | return NULL; | |
191 | ||
192 | rcu_read_lock(); | |
193 | ops = rcu_dereference(inet6_offloads[IPPROTO_ESP]); | |
194 | if (!ops || !ops->callbacks.gro_receive) | |
195 | goto out; | |
196 | ||
197 | ret = __xfrm6_udp_encap_rcv(sk, skb, false); | |
198 | if (ret) | |
199 | goto out; | |
200 | ||
201 | skb_push(skb, offset); | |
202 | NAPI_GRO_CB(skb)->proto = IPPROTO_UDP; | |
203 | ||
204 | pp = call_gro_receive(ops->callbacks.gro_receive, head, skb); | |
205 | rcu_read_unlock(); | |
206 | ||
207 | return pp; | |
208 | ||
209 | out: | |
210 | rcu_read_unlock(); | |
211 | skb_push(skb, offset); | |
212 | NAPI_GRO_CB(skb)->same_flow = 0; | |
213 | NAPI_GRO_CB(skb)->flush = 1; | |
214 | ||
215 | return NULL; | |
216 | } | |
217 | ||
63c43787 | 218 | int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t) |
1da177e4 | 219 | { |
33b5ecb8 | 220 | return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff], |
63c43787 | 221 | 0, t); |
1da177e4 | 222 | } |
63c43787 | 223 | EXPORT_SYMBOL(xfrm6_rcv_tnl); |
7159039a | 224 | |
63c43787 ND |
225 | int xfrm6_rcv(struct sk_buff *skb) |
226 | { | |
227 | return xfrm6_rcv_tnl(skb, NULL); | |
228 | } | |
229 | EXPORT_SYMBOL(xfrm6_rcv); | |
fbd9a5b4 MN |
230 | int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr, |
231 | xfrm_address_t *saddr, u8 proto) | |
232 | { | |
59c9940e | 233 | struct net *net = dev_net(skb->dev); |
1ab1457c | 234 | struct xfrm_state *x = NULL; |
0ca64da1 | 235 | struct sec_path *sp; |
fbd9a5b4 MN |
236 | int i = 0; |
237 | ||
0ca64da1 FW |
238 | sp = secpath_set(skb); |
239 | if (!sp) { | |
b0fcee82 SK |
240 | XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR); |
241 | goto drop; | |
9473e1f6 MN |
242 | } |
243 | ||
0ca64da1 | 244 | if (1 + sp->len == XFRM_MAX_DEPTH) { |
59c9940e | 245 | XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR); |
9473e1f6 MN |
246 | goto drop; |
247 | } | |
248 | ||
fbd9a5b4 MN |
249 | for (i = 0; i < 3; i++) { |
250 | xfrm_address_t *dst, *src; | |
a002c6fd | 251 | |
fbd9a5b4 MN |
252 | switch (i) { |
253 | case 0: | |
254 | dst = daddr; | |
255 | src = saddr; | |
256 | break; | |
257 | case 1: | |
258 | /* lookup state with wild-card source address */ | |
fbd9a5b4 | 259 | dst = daddr; |
a002c6fd | 260 | src = (xfrm_address_t *)&in6addr_any; |
fbd9a5b4 | 261 | break; |
fbd9a5b4 | 262 | default: |
1ab1457c | 263 | /* lookup state with wild-card addresses */ |
a002c6fd YH |
264 | dst = (xfrm_address_t *)&in6addr_any; |
265 | src = (xfrm_address_t *)&in6addr_any; | |
fbd9a5b4 | 266 | break; |
1ab1457c | 267 | } |
fbd9a5b4 | 268 | |
bd55775c | 269 | x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6); |
fbd9a5b4 MN |
270 | if (!x) |
271 | continue; | |
272 | ||
304b44f0 AA |
273 | if (unlikely(x->dir && x->dir != XFRM_SA_DIR_IN)) { |
274 | XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEDIRERROR); | |
275 | xfrm_state_put(x); | |
276 | x = NULL; | |
277 | continue; | |
278 | } | |
279 | ||
fbd9a5b4 MN |
280 | spin_lock(&x->lock); |
281 | ||
a002c6fd YH |
282 | if ((!i || (x->props.flags & XFRM_STATE_WILDRECV)) && |
283 | likely(x->km.state == XFRM_STATE_VALID) && | |
284 | !xfrm_state_check_expire(x)) { | |
fbd9a5b4 | 285 | spin_unlock(&x->lock); |
a002c6fd YH |
286 | if (x->type->input(x, skb) > 0) { |
287 | /* found a valid state */ | |
288 | break; | |
289 | } | |
290 | } else | |
fbd9a5b4 | 291 | spin_unlock(&x->lock); |
fbd9a5b4 | 292 | |
a002c6fd YH |
293 | xfrm_state_put(x); |
294 | x = NULL; | |
fbd9a5b4 MN |
295 | } |
296 | ||
9473e1f6 | 297 | if (!x) { |
59c9940e | 298 | XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES); |
afeb14b4 | 299 | xfrm_audit_state_notfound_simple(skb, AF_INET6); |
fbd9a5b4 | 300 | goto drop; |
fbd9a5b4 MN |
301 | } |
302 | ||
2294be0f | 303 | sp->xvec[sp->len++] = x; |
9473e1f6 MN |
304 | |
305 | spin_lock(&x->lock); | |
fbd9a5b4 | 306 | |
9473e1f6 MN |
307 | x->curlft.bytes += skb->len; |
308 | x->curlft.packets++; | |
309 | ||
310 | spin_unlock(&x->lock); | |
fbd9a5b4 MN |
311 | |
312 | return 1; | |
9473e1f6 | 313 | |
fbd9a5b4 | 314 | drop: |
fbd9a5b4 MN |
315 | return -1; |
316 | } | |
7159039a | 317 | EXPORT_SYMBOL(xfrm6_input_addr); |