Commit 60d5fcfb authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[IPSEC]: Remove nhoff from xfrm_input 



The nhoff field isn't actually necessary in xfrm_input.  For tunnel
mode transforms we now throw away the output IP header so it makes no
sense to fill in the nexthdr field.  For transport mode we can now let
the function transport_finish do the setting and it knows where the
nexthdr field is.

The only other thing that needs the nexthdr field to be set is the
header extraction code.  However, we can simply move the protocol
extraction out of the generic header extraction.

We want to minimise the amount of info we have to carry around between
transforms as this simplifies the resumption process for async crypto.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d26f3984

include/net/xfrm.h

+0 −1
Original line number Diff line number Diff line
@@ -534,7 +534,6 @@ struct xfrm_spi_skb_cb { 
		struct inet6_skb_parm h6;

	} header;



	unsigned int nhoff;

	unsigned int daddroff;

};

net/ipv4/xfrm4_input.c

+7 −6
Original line number Diff line number Diff line
@@ -21,7 +21,6 @@ int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb) 
	return xfrm4_extract_header(skb);

}



#ifdef CONFIG_NETFILTER

static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)

{

	if (skb->dst == NULL) {
@@ -36,12 +35,10 @@ drop: 
	kfree_skb(skb);

	return NET_RX_DROP;

}

#endif



int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,

		    int encap_type)

{

	XFRM_SPI_SKB_CB(skb)->nhoff = offsetof(struct iphdr, protocol);

	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);

	return xfrm_input(skb, nexthdr, spi, encap_type);

}
@@ -49,16 +46,20 @@ EXPORT_SYMBOL(xfrm4_rcv_encap); 


int xfrm4_transport_finish(struct sk_buff *skb, int async)

{

	struct iphdr *iph = ip_hdr(skb);



	iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol;



#ifdef CONFIG_NETFILTER

	__skb_push(skb, skb->data - skb_network_header(skb));

	ip_hdr(skb)->tot_len = htons(skb->len);

	ip_send_check(ip_hdr(skb));

	iph->tot_len = htons(skb->len);

	ip_send_check(iph);



	NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, skb->dev, NULL,

		xfrm4_rcv_encap_finish);

	return 0;

#else

	return -ip_hdr(skb)->protocol;

	return -iph->protocol;

#endif

}

net/ipv4/xfrm4_output.c

+2 −0
Original line number Diff line number Diff line
@@ -47,6 +47,8 @@ int xfrm4_extract_output(struct xfrm_state *x, struct sk_buff *skb) 
	if (err)

		return err;



	XFRM_MODE_SKB_CB(skb)->protocol = ip_hdr(skb)->protocol;



	return xfrm4_extract_header(skb);

}

net/ipv4/xfrm4_state.c

+0 −1
Original line number Diff line number Diff line
@@ -56,7 +56,6 @@ int xfrm4_extract_header(struct sk_buff *skb) 
	XFRM_MODE_SKB_CB(skb)->frag_off = iph->frag_off;

	XFRM_MODE_SKB_CB(skb)->tos = iph->tos;

	XFRM_MODE_SKB_CB(skb)->ttl = iph->ttl;

	XFRM_MODE_SKB_CB(skb)->protocol = iph->protocol;

	memset(XFRM_MODE_SKB_CB(skb)->flow_lbl, 0,

	       sizeof(XFRM_MODE_SKB_CB(skb)->flow_lbl));

net/ipv6/xfrm6_input.c

+3 −1
Original line number Diff line number Diff line
@@ -23,7 +23,6 @@ int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb) 


int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)

{

	XFRM_SPI_SKB_CB(skb)->nhoff = IP6CB(skb)->nhoff;

	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);

	return xfrm_input(skb, nexthdr, spi, 0);

}
@@ -31,6 +30,9 @@ EXPORT_SYMBOL(xfrm6_rcv_spi); 


int xfrm6_transport_finish(struct sk_buff *skb, int async)

{

	skb_network_header(skb)[IP6CB(skb)->nhoff] =

		XFRM_MODE_SKB_CB(skb)->protocol;



#ifdef CONFIG_NETFILTER

	ipv6_hdr(skb)->payload_len = htons(skb->len);

	__skb_push(skb, skb->data - skb_network_header(skb));

CRA Git | Maintained and supported by SUSTech CRA and CCSE