[IPSEC]: Separate inner/outer mode processing on input (227620e2) · Commits · e / devices / android_kernel_fairphone_FP3

include/net/xfrm.h

+27 −0

Original line number	Original line	Diff line number	Diff line
	@@ -258,6 +258,7 @@ extern int __xfrm_state_delete(struct xfrm_state *x);
	struct xfrm_state_afinfo {		struct xfrm_state_afinfo {
	unsigned int family;		unsigned int family;
	unsigned int proto;		unsigned int proto;
			unsigned int eth_proto;
	struct module *owner;		struct module *owner;
	struct xfrm_type *type_map[IPPROTO_MAX];		struct xfrm_type *type_map[IPPROTO_MAX];
	struct xfrm_mode *mode_map[XFRM_MODE_MAX];		struct xfrm_mode *mode_map[XFRM_MODE_MAX];
	@@ -268,6 +269,8 @@ struct xfrm_state_afinfo {
	int (tmpl_sort)(struct xfrm_tmpl dst, struct xfrm_tmpl *src, int n);		int (tmpl_sort)(struct xfrm_tmpl dst, struct xfrm_tmpl *src, int n);
	int (state_sort)(struct xfrm_state dst, struct xfrm_state *src, int n);		int (state_sort)(struct xfrm_state dst, struct xfrm_state *src, int n);
	int (output)(struct sk_buff skb);		int (output)(struct sk_buff skb);
			int (extract_input)(struct xfrm_state x,
			struct sk_buff *skb);
	int (extract_output)(struct xfrm_state x,		int (extract_output)(struct xfrm_state x,
	struct sk_buff *skb);		struct sk_buff *skb);
	};		};
	@@ -302,6 +305,27 @@ extern int xfrm_register_type(struct xfrm_type *type, unsigned short family);
	extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);		extern int xfrm_unregister_type(struct xfrm_type *type, unsigned short family);

	struct xfrm_mode {		struct xfrm_mode {
			/*
			* Remove encapsulation header.
			*
			* The IP header will be moved over the top of the encapsulation
			* header.
			*
			* On entry, the transport header shall point to where the IP header
			* should be and the network header shall be set to where the IP
			* header currently is. skb->data shall point to the start of the
			* payload.
			*/
			int (input2)(struct xfrm_state x, struct sk_buff *skb);

			/*
			* This is the actual input entry point.
			*
			* For transport mode and equivalent this would be identical to
			* input2 (which does not need to be set). While tunnel mode
			* and equivalent would set this to the tunnel encapsulation function
			* xfrm4_prepare_input that would in turn call input2.
			*/
	int (input)(struct xfrm_state x, struct sk_buff *skb);		int (input)(struct xfrm_state x, struct sk_buff *skb);

	/*		/*
	@@ -1093,8 +1117,10 @@ extern void xfrm_replay_advance(struct xfrm_state *x, __be32 seq);
	extern void xfrm_replay_notify(struct xfrm_state *x, int event);		extern void xfrm_replay_notify(struct xfrm_state *x, int event);
	extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);		extern int xfrm_state_mtu(struct xfrm_state *x, int mtu);
	extern int xfrm_init_state(struct xfrm_state *x);		extern int xfrm_init_state(struct xfrm_state *x);
			extern int xfrm_prepare_input(struct xfrm_state x, struct sk_buff skb);
	extern int xfrm_output(struct sk_buff *skb);		extern int xfrm_output(struct sk_buff *skb);
	extern int xfrm4_extract_header(struct sk_buff *skb);		extern int xfrm4_extract_header(struct sk_buff *skb);
			extern int xfrm4_extract_input(struct xfrm_state x, struct sk_buff skb);
	extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,		extern int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
	int encap_type);		int encap_type);
	extern int xfrm4_rcv(struct sk_buff *skb);		extern int xfrm4_rcv(struct sk_buff *skb);
	@@ -1110,6 +1136,7 @@ extern int xfrm4_output(struct sk_buff *skb);
	extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);		extern int xfrm4_tunnel_register(struct xfrm_tunnel *handler, unsigned short family);
	extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);		extern int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
	extern int xfrm6_extract_header(struct sk_buff *skb);		extern int xfrm6_extract_header(struct sk_buff *skb);
			extern int xfrm6_extract_input(struct xfrm_state x, struct sk_buff skb);
	extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);		extern int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
	extern int xfrm6_rcv(struct sk_buff *skb);		extern int xfrm6_rcv(struct sk_buff *skb);
	extern int xfrm6_input_addr(struct sk_buff skb, xfrm_address_t daddr,		extern int xfrm6_input_addr(struct sk_buff skb, xfrm_address_t daddr,

net/ipv4/xfrm4_input.c

+6 −1

Original line number	Original line	Diff line number	Diff line
	@@ -16,6 +16,11 @@
	#include <net/ip.h>		#include <net/ip.h>
	#include <net/xfrm.h>		#include <net/xfrm.h>

			int xfrm4_extract_input(struct xfrm_state x, struct sk_buff skb)
			{
			return xfrm4_extract_header(skb);
			}

	#ifdef CONFIG_NETFILTER		#ifdef CONFIG_NETFILTER
	static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)		static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)
	{		{
	@@ -91,7 +96,7 @@ int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,

	xfrm_vec[xfrm_nr++] = x;		xfrm_vec[xfrm_nr++] = x;

	if (x->outer_mode->input(x, skb))		if (x->inner_mode->input(x, skb))
	goto drop;		goto drop;

	if (x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) {		if (x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) {

net/ipv4/xfrm4_mode_beet.c

+39 −28

Original line number	Original line	Diff line number	Diff line
	@@ -17,6 +17,21 @@
	#include <net/ip.h>		#include <net/ip.h>
	#include <net/xfrm.h>		#include <net/xfrm.h>

			static void xfrm4_beet_make_header(struct sk_buff *skb)
			{
			struct iphdr *iph = ip_hdr(skb);

			iph->ihl = 5;
			iph->version = 4;

			iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol;
			iph->tos = XFRM_MODE_SKB_CB(skb)->tos;

			iph->id = XFRM_MODE_SKB_CB(skb)->id;
			iph->frag_off = XFRM_MODE_SKB_CB(skb)->frag_off;
			iph->ttl = XFRM_MODE_SKB_CB(skb)->ttl;
			}

	/* Add encapsulation header.		/* Add encapsulation header.
	*		*
	* The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt.		* The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt.
	@@ -40,20 +55,12 @@ static int xfrm4_beet_output(struct xfrm_state x, struct sk_buff skb)
	offsetof(struct iphdr, protocol);		offsetof(struct iphdr, protocol);
	skb->transport_header = skb->network_header + sizeof(*iph);		skb->transport_header = skb->network_header + sizeof(*iph);

			xfrm4_beet_make_header(skb);

	ph = (struct ip_beet_phdr )__skb_pull(skb, sizeof(iph) - hdrlen);		ph = (struct ip_beet_phdr )__skb_pull(skb, sizeof(iph) - hdrlen);

	top_iph = ip_hdr(skb);		top_iph = ip_hdr(skb);

	top_iph->ihl = 5;
	top_iph->version = 4;

	top_iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol;
	top_iph->tos = XFRM_MODE_SKB_CB(skb)->tos;

	top_iph->id = XFRM_MODE_SKB_CB(skb)->id;
	top_iph->frag_off = XFRM_MODE_SKB_CB(skb)->frag_off;
	top_iph->ttl = XFRM_MODE_SKB_CB(skb)->ttl;

	if (unlikely(optlen)) {		if (unlikely(optlen)) {
	BUG_ON(optlen < 0);		BUG_ON(optlen < 0);

	@@ -75,43 +82,46 @@ static int xfrm4_beet_output(struct xfrm_state x, struct sk_buff skb)

	static int xfrm4_beet_input(struct xfrm_state x, struct sk_buff skb)		static int xfrm4_beet_input(struct xfrm_state x, struct sk_buff skb)
	{		{
	struct iphdr *iph = ip_hdr(skb);		struct iphdr *iph;
	int phlen = 0;
	int optlen = 0;		int optlen = 0;
	u8 ph_nexthdr = 0;
	int err = -EINVAL;		int err = -EINVAL;

	if (unlikely(iph->protocol == IPPROTO_BEETPH)) {		if (unlikely(XFRM_MODE_SKB_CB(skb)->protocol == IPPROTO_BEETPH)) {
	struct ip_beet_phdr *ph;		struct ip_beet_phdr *ph;
			int phlen;

	if (!pskb_may_pull(skb, sizeof(*ph)))		if (!pskb_may_pull(skb, sizeof(*ph)))
	goto out;		goto out;
	ph = (struct ip_beet_phdr *)(ipip_hdr(skb) + 1);
			ph = (struct ip_beet_phdr *)skb->data;

	phlen = sizeof(*ph) + ph->padlen;		phlen = sizeof(*ph) + ph->padlen;
	optlen = ph->hdrlen * 8 + (IPV4_BEET_PHMAXLEN - phlen);		optlen = ph->hdrlen * 8 + (IPV4_BEET_PHMAXLEN - phlen);
	if (optlen < 0 \|\| optlen & 3 \|\| optlen > 250)		if (optlen < 0 \|\| optlen & 3 \|\| optlen > 250)
	goto out;		goto out;

	if (!pskb_may_pull(skb, phlen + optlen))		XFRM_MODE_SKB_CB(skb)->protocol = ph->nexthdr;
	goto out;
	skb->len -= phlen + optlen;

	ph_nexthdr = ph->nexthdr;		if (!pskb_may_pull(skb, phlen));
			goto out;
			__skb_pull(skb, phlen);
	}		}

	skb_set_network_header(skb, phlen - sizeof(*iph));		skb_push(skb, sizeof(*iph));
	memmove(skb_network_header(skb), iph, sizeof(*iph));		skb_reset_network_header(skb);
	skb_set_transport_header(skb, phlen + optlen);
	skb->data = skb_transport_header(skb);		memmove(skb->data - skb->mac_len, skb_mac_header(skb),
			skb->mac_len);
			skb_set_mac_header(skb, -skb->mac_len);

			xfrm4_beet_make_header(skb);

	iph = ip_hdr(skb);		iph = ip_hdr(skb);
	iph->ihl = (sizeof(*iph) + optlen) / 4;
	iph->tot_len = htons(skb->len + iph->ihl * 4);		iph->ihl += optlen / 4;
			iph->tot_len = htons(skb->len);
	iph->daddr = x->sel.daddr.a4;		iph->daddr = x->sel.daddr.a4;
	iph->saddr = x->sel.saddr.a4;		iph->saddr = x->sel.saddr.a4;
	if (ph_nexthdr)
	iph->protocol = ph_nexthdr;
	iph->check = 0;		iph->check = 0;
	iph->check = ip_fast_csum(skb_network_header(skb), iph->ihl);		iph->check = ip_fast_csum(skb_network_header(skb), iph->ihl);
	err = 0;		err = 0;
	@@ -120,7 +130,8 @@ static int xfrm4_beet_input(struct xfrm_state x, struct sk_buff skb)
	}		}

	static struct xfrm_mode xfrm4_beet_mode = {		static struct xfrm_mode xfrm4_beet_mode = {
	.input = xfrm4_beet_input,		.input2 = xfrm4_beet_input,
			.input = xfrm_prepare_input,
	.output2 = xfrm4_beet_output,		.output2 = xfrm4_beet_output,
	.output = xfrm4_prepare_output,		.output = xfrm4_prepare_output,
	.owner = THIS_MODULE,		.owner = THIS_MODULE,

net/ipv4/xfrm4_mode_tunnel.c

+10 −34

Original line number	Original line	Diff line number	Diff line
	@@ -16,19 +16,12 @@

	static inline void ipip_ecn_decapsulate(struct sk_buff *skb)		static inline void ipip_ecn_decapsulate(struct sk_buff *skb)
	{		{
	struct iphdr *outer_iph = ip_hdr(skb);
	struct iphdr *inner_iph = ipip_hdr(skb);		struct iphdr *inner_iph = ipip_hdr(skb);

	if (INET_ECN_is_ce(outer_iph->tos))		if (INET_ECN_is_ce(XFRM_MODE_SKB_CB(skb)->tos))
	IP_ECN_set_ce(inner_iph);		IP_ECN_set_ce(inner_iph);
	}		}

	static inline void ipip6_ecn_decapsulate(struct iphdr iph, struct sk_buff skb)
	{
	if (INET_ECN_is_ce(iph->tos))
	IP6_ECN_set_ce(ipv6_hdr(skb));
	}

	/* Add encapsulation header.		/* Add encapsulation header.
	*		*
	* The top IP header will be constructed per RFC 2401.		* The top IP header will be constructed per RFC 2401.
	@@ -72,20 +65,11 @@ static int xfrm4_tunnel_output(struct xfrm_state x, struct sk_buff skb)

	static int xfrm4_tunnel_input(struct xfrm_state x, struct sk_buff skb)		static int xfrm4_tunnel_input(struct xfrm_state x, struct sk_buff skb)
	{		{
	struct iphdr *iph = ip_hdr(skb);
	const unsigned char *old_mac;		const unsigned char *old_mac;
	int err = -EINVAL;		int err = -EINVAL;

	switch (iph->protocol){		if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
	case IPPROTO_IPIP:
	break;
	#if defined(CONFIG_IPV6) \|\| defined (CONFIG_IPV6_MODULE)
	case IPPROTO_IPV6:
	break;
	#endif
	default:
	goto out;		goto out;
	}

	if (!pskb_may_pull(skb, sizeof(struct iphdr)))		if (!pskb_may_pull(skb, sizeof(struct iphdr)))
	goto out;		goto out;
	@@ -94,20 +78,11 @@ static int xfrm4_tunnel_input(struct xfrm_state x, struct sk_buff skb)
	(err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))		(err = pskb_expand_head(skb, 0, 0, GFP_ATOMIC)))
	goto out;		goto out;

	iph = ip_hdr(skb);
	if (iph->protocol == IPPROTO_IPIP) {
	if (x->props.flags & XFRM_STATE_DECAP_DSCP)		if (x->props.flags & XFRM_STATE_DECAP_DSCP)
	ipv4_copy_dscp(ipv4_get_dsfield(iph), ipip_hdr(skb));		ipv4_copy_dscp(XFRM_MODE_SKB_CB(skb)->tos, ipip_hdr(skb));
	if (!(x->props.flags & XFRM_STATE_NOECN))		if (!(x->props.flags & XFRM_STATE_NOECN))
	ipip_ecn_decapsulate(skb);		ipip_ecn_decapsulate(skb);
	}
	#if defined(CONFIG_IPV6) \|\| defined (CONFIG_IPV6_MODULE)
	else {
	if (!(x->props.flags & XFRM_STATE_NOECN))
	ipip6_ecn_decapsulate(iph, skb);
	skb->protocol = htons(ETH_P_IPV6);
	}
	#endif
	old_mac = skb_mac_header(skb);		old_mac = skb_mac_header(skb);
	skb_set_mac_header(skb, -skb->mac_len);		skb_set_mac_header(skb, -skb->mac_len);
	memmove(skb_mac_header(skb), old_mac, skb->mac_len);		memmove(skb_mac_header(skb), old_mac, skb->mac_len);
	@@ -119,7 +94,8 @@ static int xfrm4_tunnel_input(struct xfrm_state x, struct sk_buff skb)
	}		}

	static struct xfrm_mode xfrm4_tunnel_mode = {		static struct xfrm_mode xfrm4_tunnel_mode = {
	.input = xfrm4_tunnel_input,		.input2 = xfrm4_tunnel_input,
			.input = xfrm_prepare_input,
	.output2 = xfrm4_tunnel_output,		.output2 = xfrm4_tunnel_output,
	.output = xfrm4_prepare_output,		.output = xfrm4_prepare_output,
	.owner = THIS_MODULE,		.owner = THIS_MODULE,

net/ipv4/xfrm4_state.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -65,10 +65,12 @@ int xfrm4_extract_header(struct sk_buff *skb)
	static struct xfrm_state_afinfo xfrm4_state_afinfo = {		static struct xfrm_state_afinfo xfrm4_state_afinfo = {
	.family = AF_INET,		.family = AF_INET,
	.proto = IPPROTO_IPIP,		.proto = IPPROTO_IPIP,
			.eth_proto = htons(ETH_P_IP),
	.owner = THIS_MODULE,		.owner = THIS_MODULE,
	.init_flags = xfrm4_init_flags,		.init_flags = xfrm4_init_flags,
	.init_tempsel = __xfrm4_init_tempsel,		.init_tempsel = __xfrm4_init_tempsel,
	.output = xfrm4_output,		.output = xfrm4_output,
			.extract_input = xfrm4_extract_input,
	.extract_output = xfrm4_extract_output,		.extract_output = xfrm4_extract_output,
	};		};