2 * xfrm6_input.c: based on net/ipv4/xfrm4_input.c
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * YOSHIFUJI Hideaki @USAGI
12 #include <linux/module.h>
13 #include <linux/string.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter_ipv6.h>
19 int xfrm6_rcv_spi(struct sk_buff
*skb
, int nexthdr
, __be32 spi
)
23 struct xfrm_state
*xfrm_vec
[XFRM_MAX_DEPTH
];
29 nhoff
= IP6CB(skb
)->nhoff
;
32 if (!spi
&& (err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) != 0)
36 struct ipv6hdr
*iph
= ipv6_hdr(skb
);
38 if (xfrm_nr
== XFRM_MAX_DEPTH
)
41 x
= xfrm_state_lookup((xfrm_address_t
*)&iph
->daddr
, spi
,
46 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
))
49 if (x
->props
.replay_window
&& xfrm_replay_check(x
, seq
))
52 if (xfrm_state_check_expire(x
))
55 nexthdr
= x
->type
->input(x
, skb
);
59 skb_network_header(skb
)[nhoff
] = nexthdr
;
61 if (x
->props
.replay_window
)
62 xfrm_replay_advance(x
, seq
);
64 x
->curlft
.bytes
+= skb
->len
;
67 spin_unlock(&x
->lock
);
69 xfrm_vec
[xfrm_nr
++] = x
;
71 if (x
->mode
->input(x
, skb
))
74 if (x
->props
.mode
== XFRM_MODE_TUNNEL
) { /* XXX */
79 if ((err
= xfrm_parse_spi(skb
, nexthdr
, &spi
, &seq
)) < 0)
83 /* Allocate new secpath or COW existing one. */
84 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
86 sp
= secpath_dup(skb
->sp
);
94 if (xfrm_nr
+ skb
->sp
->len
> XFRM_MAX_DEPTH
)
97 memcpy(skb
->sp
->xvec
+ skb
->sp
->len
, xfrm_vec
,
98 xfrm_nr
* sizeof(xfrm_vec
[0]));
99 skb
->sp
->len
+= xfrm_nr
;
100 skb
->ip_summed
= CHECKSUM_NONE
;
105 dst_release(skb
->dst
);
110 #ifdef CONFIG_NETFILTER
111 ipv6_hdr(skb
)->payload_len
= htons(skb
->len
);
112 __skb_push(skb
, skb
->data
- skb_network_header(skb
));
114 NF_HOOK(PF_INET6
, NF_IP6_PRE_ROUTING
, skb
, skb
->dev
, NULL
,
123 spin_unlock(&x
->lock
);
126 while (--xfrm_nr
>= 0)
127 xfrm_state_put(xfrm_vec
[xfrm_nr
]);
132 EXPORT_SYMBOL(xfrm6_rcv_spi
);
134 int xfrm6_rcv(struct sk_buff
*skb
)
136 return xfrm6_rcv_spi(skb
, skb_network_header(skb
)[IP6CB(skb
)->nhoff
],
140 EXPORT_SYMBOL(xfrm6_rcv
);
142 int xfrm6_input_addr(struct sk_buff
*skb
, xfrm_address_t
*daddr
,
143 xfrm_address_t
*saddr
, u8 proto
)
145 struct xfrm_state
*x
= NULL
;
147 xfrm_address_t
*xany
;
148 struct xfrm_state
*xfrm_vec_one
= NULL
;
152 xany
= (xfrm_address_t
*)&in6addr_any
;
154 for (i
= 0; i
< 3; i
++) {
155 xfrm_address_t
*dst
, *src
;
162 /* lookup state with wild-card source address */
169 /* lookup state with wild-card addresses */
170 wildcard
= 1; /* XXX */
176 x
= xfrm_state_lookup_byaddr(dst
, src
, proto
, AF_INET6
);
183 if ((x
->props
.flags
& XFRM_STATE_WILDRECV
) == 0) {
184 spin_unlock(&x
->lock
);
191 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
)) {
192 spin_unlock(&x
->lock
);
197 if (xfrm_state_check_expire(x
)) {
198 spin_unlock(&x
->lock
);
204 nh
= x
->type
->input(x
, skb
);
206 spin_unlock(&x
->lock
);
212 x
->curlft
.bytes
+= skb
->len
;
215 spin_unlock(&x
->lock
);
224 /* Allocate new secpath or COW existing one. */
225 if (!skb
->sp
|| atomic_read(&skb
->sp
->refcnt
) != 1) {
227 sp
= secpath_dup(skb
->sp
);
231 secpath_put(skb
->sp
);
235 if (1 + skb
->sp
->len
> XFRM_MAX_DEPTH
)
238 skb
->sp
->xvec
[skb
->sp
->len
] = xfrm_vec_one
;
244 xfrm_state_put(xfrm_vec_one
);
248 EXPORT_SYMBOL(xfrm6_input_addr
);
This page took 0.043391 seconds and 5 git commands to generate.