~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/xfrm4_input.c

Version: ~ [ linux-5.16-rc3 ] ~ [ linux-5.15.5 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.82 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.162 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.218 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.256 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.291 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.293 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * xfrm4_input.c
  3  *
  4  * Changes:
  5  *      YOSHIFUJI Hideaki @USAGI
  6  *              Split up af-specific portion
  7  *      Derek Atkins <derek@ihtfp.com>
  8  *              Add Encapsulation support
  9  *
 10  */
 11 
 12 #include <linux/slab.h>
 13 #include <linux/module.h>
 14 #include <linux/string.h>
 15 #include <linux/netfilter.h>
 16 #include <linux/netfilter_ipv4.h>
 17 #include <net/ip.h>
 18 #include <net/xfrm.h>
 19 
 20 int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb)
 21 {
 22         return xfrm4_extract_header(skb);
 23 }
 24 
 25 static inline int xfrm4_rcv_encap_finish(struct sock *sk, struct sk_buff *skb)
 26 {
 27         if (!skb_dst(skb)) {
 28                 const struct iphdr *iph = ip_hdr(skb);
 29 
 30                 if (ip_route_input_noref(skb, iph->daddr, iph->saddr,
 31                                          iph->tos, skb->dev))
 32                         goto drop;
 33         }
 34         return dst_input(skb);
 35 drop:
 36         kfree_skb(skb);
 37         return NET_RX_DROP;
 38 }
 39 
 40 int xfrm4_transport_finish(struct sk_buff *skb, int async)
 41 {
 42         struct iphdr *iph = ip_hdr(skb);
 43 
 44         iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol;
 45 
 46 #ifndef CONFIG_NETFILTER
 47         if (!async)
 48                 return -iph->protocol;
 49 #endif
 50 
 51         __skb_push(skb, skb->data - skb_network_header(skb));
 52         iph->tot_len = htons(skb->len);
 53         ip_send_check(iph);
 54 
 55         NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, NULL, skb,
 56                 skb->dev, NULL,
 57                 xfrm4_rcv_encap_finish);
 58         return 0;
 59 }
 60 
 61 /* If it's a keepalive packet, then just eat it.
 62  * If it's an encapsulated packet, then pass it to the
 63  * IPsec xfrm input.
 64  * Returns 0 if skb passed to xfrm or was dropped.
 65  * Returns >0 if skb should be passed to UDP.
 66  * Returns <0 if skb should be resubmitted (-ret is protocol)
 67  */
 68 int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)
 69 {
 70         struct udp_sock *up = udp_sk(sk);
 71         struct udphdr *uh;
 72         struct iphdr *iph;
 73         int iphlen, len;
 74 
 75         __u8 *udpdata;
 76         __be32 *udpdata32;
 77         __u16 encap_type = up->encap_type;
 78 
 79         /* if this is not encapsulated socket, then just return now */
 80         if (!encap_type)
 81                 return 1;
 82 
 83         /* If this is a paged skb, make sure we pull up
 84          * whatever data we need to look at. */
 85         len = skb->len - sizeof(struct udphdr);
 86         if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8)))
 87                 return 1;
 88 
 89         /* Now we can get the pointers */
 90         uh = udp_hdr(skb);
 91         udpdata = (__u8 *)uh + sizeof(struct udphdr);
 92         udpdata32 = (__be32 *)udpdata;
 93 
 94         switch (encap_type) {
 95         default:
 96         case UDP_ENCAP_ESPINUDP:
 97                 /* Check if this is a keepalive packet.  If so, eat it. */
 98                 if (len == 1 && udpdata[0] == 0xff) {
 99                         goto drop;
100                 } else if (len > sizeof(struct ip_esp_hdr) && udpdata32[0] != 0) {
101                         /* ESP Packet without Non-ESP header */
102                         len = sizeof(struct udphdr);
103                 } else
104                         /* Must be an IKE packet.. pass it through */
105                         return 1;
106                 break;
107         case UDP_ENCAP_ESPINUDP_NON_IKE:
108                 /* Check if this is a keepalive packet.  If so, eat it. */
109                 if (len == 1 && udpdata[0] == 0xff) {
110                         goto drop;
111                 } else if (len > 2 * sizeof(u32) + sizeof(struct ip_esp_hdr) &&
112                            udpdata32[0] == 0 && udpdata32[1] == 0) {
113 
114                         /* ESP Packet with Non-IKE marker */
115                         len = sizeof(struct udphdr) + 2 * sizeof(u32);
116                 } else
117                         /* Must be an IKE packet.. pass it through */
118                         return 1;
119                 break;
120         }
121 
122         /* At this point we are sure that this is an ESPinUDP packet,
123          * so we need to remove 'len' bytes from the packet (the UDP
124          * header and optional ESP marker bytes) and then modify the
125          * protocol to ESP, and then call into the transform receiver.
126          */
127         if (skb_unclone(skb, GFP_ATOMIC))
128                 goto drop;
129 
130         /* Now we can update and verify the packet length... */
131         iph = ip_hdr(skb);
132         iphlen = iph->ihl << 2;
133         iph->tot_len = htons(ntohs(iph->tot_len) - len);
134         if (skb->len < iphlen + len) {
135                 /* packet is too small!?! */
136                 goto drop;
137         }
138 
139         /* pull the data buffer up to the ESP header and set the
140          * transport header to point to ESP.  Keep UDP on the stack
141          * for later.
142          */
143         __skb_pull(skb, len);
144         skb_reset_transport_header(skb);
145 
146         /* process ESP */
147         return xfrm4_rcv_encap(skb, IPPROTO_ESP, 0, encap_type);
148 
149 drop:
150         kfree_skb(skb);
151         return 0;
152 }
153 
154 int xfrm4_rcv(struct sk_buff *skb)
155 {
156         return xfrm4_rcv_spi(skb, ip_hdr(skb)->protocol, 0);
157 }
158 EXPORT_SYMBOL(xfrm4_rcv);
159 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp