5 * YOSHIFUJI Hideaki @USAGI
6 * Split up af-specific portion
10 #include <linux/slab.h>
11 #include <linux/module.h>
12 #include <linux/netdevice.h>
17 static struct kmem_cache
*secpath_cachep __read_mostly
;
19 void __secpath_destroy(struct sec_path
*sp
)
22 for (i
= 0; i
< sp
->len
; i
++)
23 xfrm_state_put(sp
->xvec
[i
]);
24 kmem_cache_free(secpath_cachep
, sp
);
26 EXPORT_SYMBOL(__secpath_destroy
);
28 struct sec_path
*secpath_dup(struct sec_path
*src
)
32 sp
= kmem_cache_alloc(secpath_cachep
, GFP_ATOMIC
);
40 memcpy(sp
, src
, sizeof(*sp
));
41 for (i
= 0; i
< sp
->len
; i
++)
42 xfrm_state_hold(sp
->xvec
[i
]);
44 atomic_set(&sp
->refcnt
, 1);
47 EXPORT_SYMBOL(secpath_dup
);
49 /* Fetch spi and seq from ipsec header */
51 int xfrm_parse_spi(struct sk_buff
*skb
, u8 nexthdr
, __be32
*spi
, __be32
*seq
)
53 int offset
, offset_seq
;
58 hlen
= sizeof(struct ip_auth_hdr
);
59 offset
= offsetof(struct ip_auth_hdr
, spi
);
60 offset_seq
= offsetof(struct ip_auth_hdr
, seq_no
);
63 hlen
= sizeof(struct ip_esp_hdr
);
64 offset
= offsetof(struct ip_esp_hdr
, spi
);
65 offset_seq
= offsetof(struct ip_esp_hdr
, seq_no
);
68 if (!pskb_may_pull(skb
, sizeof(struct ip_comp_hdr
)))
70 *spi
= htonl(ntohs(*(__be16
*)(skb_transport_header(skb
) + 2)));
77 if (!pskb_may_pull(skb
, hlen
))
80 *spi
= *(__be32
*)(skb_transport_header(skb
) + offset
);
81 *seq
= *(__be32
*)(skb_transport_header(skb
) + offset_seq
);
84 EXPORT_SYMBOL(xfrm_parse_spi
);
86 int xfrm_prepare_input(struct xfrm_state
*x
, struct sk_buff
*skb
)
90 err
= x
->outer_mode
->afinfo
->extract_input(x
, skb
);
94 skb
->protocol
= x
->inner_mode
->afinfo
->eth_proto
;
95 return x
->inner_mode
->input2(x
, skb
);
97 EXPORT_SYMBOL(xfrm_prepare_input
);
99 int xfrm_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
, int encap_type
)
103 struct xfrm_state
*x
;
104 xfrm_address_t
*daddr
;
109 /* A negative encap_type indicates async resumption. */
110 if (encap_type
< 0) {
112 x
= xfrm_input_state(skb
);
113 seq
= XFRM_SKB_CB(skb
)->seq
;
117 /* Allocate new secpath or COW existing one. */
118 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
121 sp
= secpath_dup(skb
->sp
);
123 XFRM_INC_STATS(LINUX_MIB_XFRMINERROR
);
127 secpath_put(skb
->sp
);
131 daddr
= (xfrm_address_t
*)(skb_network_header(skb
) +
132 XFRM_SPI_SKB_CB(skb
)->daddroff
);
133 family
= XFRM_SPI_SKB_CB(skb
)->family
;
136 if (!spi
&& (err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) != 0) {
137 XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR
);
142 if (skb
->sp
->len
== XFRM_MAX_DEPTH
) {
143 XFRM_INC_STATS(LINUX_MIB_XFRMINBUFFERERROR
);
147 x
= xfrm_state_lookup(daddr
, spi
, nexthdr
, family
);
149 XFRM_INC_STATS(LINUX_MIB_XFRMINNOSTATES
);
150 xfrm_audit_state_notfound(skb
, family
, spi
, seq
);
154 skb
->sp
->xvec
[skb
->sp
->len
++] = x
;
157 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
)) {
158 XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEINVALID
);
162 if ((x
->encap
? x
->encap
->encap_type
: 0) != encap_type
) {
163 XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEINVALID
);
167 if (x
->props
.replay_window
&& xfrm_replay_check(x
, skb
, seq
)) {
168 XFRM_INC_STATS(LINUX_MIB_XFRMINSEQOUTOFWINDOW
);
172 if (xfrm_state_check_expire(x
)) {
173 XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEEXPIRED
);
177 spin_unlock(&x
->lock
);
179 XFRM_SKB_CB(skb
)->seq
= seq
;
181 nexthdr
= x
->type
->input(x
, skb
);
183 if (nexthdr
== -EINPROGRESS
)
189 if (nexthdr
== -EBADMSG
)
190 x
->stats
.integrity_failed
++;
191 XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEPROTOERROR
);
195 /* only the first xfrm gets the encap type */
198 if (x
->props
.replay_window
)
199 xfrm_replay_advance(x
, seq
);
201 x
->curlft
.bytes
+= skb
->len
;
204 spin_unlock(&x
->lock
);
206 XFRM_MODE_SKB_CB(skb
)->protocol
= nexthdr
;
208 if (x
->inner_mode
->input(x
, skb
)) {
209 XFRM_INC_STATS(LINUX_MIB_XFRMINSTATEMODEERROR
);
213 if (x
->outer_mode
->flags
& XFRM_MODE_FLAG_TUNNEL
) {
219 * We need the inner address. However, we only get here for
220 * transport mode so the outer address is identical.
222 daddr
= &x
->id
.daddr
;
223 family
= x
->outer_mode
->afinfo
->family
;
225 err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
);
227 XFRM_INC_STATS(LINUX_MIB_XFRMINHDRERROR
);
235 dst_release(skb
->dst
);
240 return x
->inner_mode
->afinfo
->transport_finish(skb
, async
);
244 spin_unlock(&x
->lock
);
249 EXPORT_SYMBOL(xfrm_input
);
251 int xfrm_input_resume(struct sk_buff
*skb
, int nexthdr
)
253 return xfrm_input(skb
, nexthdr
, 0, -1);
255 EXPORT_SYMBOL(xfrm_input_resume
);
257 void __init
xfrm_input_init(void)
259 secpath_cachep
= kmem_cache_create("secpath_cache",
260 sizeof(struct sec_path
),
261 0, SLAB_HWCACHE_ALIGN
|SLAB_PANIC
,