[IPSEC]: Kill post_input hook and do NAT-T in esp_input directly

The only reason post_input exists at all is that it gives us the potential to adjust the checksums incrementally in future which we ought to do. However, after thinking about it for a bit we can adjust the checksums without using this post_input stuff at all. The crucial point is that only the inner-most NAT-T SA needs to be considered when adjusting checksums. What's more, the checksum adjustment comes down to a single u32 due to the linearity of IP checksums. We just happen to have a spare u32 lying around in our skb structure :) When ip_summed is set to CHECKSUM_NONE on input, the value of skb->csum is currently unused. All we have to do is to make that the checksum adjustment and voila, there goes all the post_input and decap structures! I've left in the decap data structures for now since it's intricately woven into the sec_path stuff. We can kill them later too. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>

[IPSEC]: Kill post_input hook and do NAT-T in esp_input directly
The only reason post_input exists at all is that it gives us the potential to adjust the checksums incrementally in future which we ought to do. However, after thinking about it for a bit we can adjust the checksums without using this post_input stuff at all. The crucial point is that only the inner-most NAT-T SA needs to be considered when adjusting checksums. What's more, the checksum adjustment comes down to a single u32 due to the linearity of IP checksums. We just happen to have a spare u32 lying around in our skb structure :) When ip_summed is set to CHECKSUM_NONE on input, the value of skb->csum is currently unused. All we have to do is to make that the checksum adjustment and voila, there goes all the post_input and decap structures! I've left in the decap data structures for now since it's intricately woven into the sec_path stuff. We can kill them later too. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net>
Herbert Xu · David S. Miller
1 parent 4bf05eceec
Showing 3 changed files with 38 additions and 98 deletions Side-by-side Diff
include/net/xfrm.h
net/ipv4/esp4.c
net/xfrm/xfrm_policy.c
@@ -233,7 +233,6 @@
 	int			(*init_state)(struct xfrm_state *x);
 	void			(*destructor)(struct xfrm_state *);
 	int			(*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
-	int			(*post_input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
 	int			(*output)(struct xfrm_state *, struct sk_buff *pskb);
 	/* Estimate maximal size of result of transformation of a dgram */
 	u32			(*get_max_size)(struct xfrm_state *, int size);
@@ -12,13 +12,6 @@
 #include <net/protocol.h>
 #include <net/udp.h>
  
-/* decapsulation data for use when post-processing */
-struct esp_decap_data {
-	xfrm_address_t	saddr;
-	__u16		sport;
-	__u8		proto;
-};
-
 static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
 {
 	int err;
  
  
  
  
@@ -210,25 +203,47 @@
  
 	/* ... check padding bits here. Silly. :-) */ 
  
-	if (x->encap && decap && decap->decap_type) {
-		struct esp_decap_data *encap_data;
-		struct udphdr *uh = (struct udphdr *) (iph+1);
+	if (x->encap) {
+		struct xfrm_encap_tmpl *encap = x->encap;
+		struct udphdr *uh;
  
-		encap_data = (struct esp_decap_data *) (decap->decap_data);
-		encap_data->proto = 0;
+		if (encap->encap_type != decap->decap_type)
+			goto out;
  
-		switch (decap->decap_type) {
-		case UDP_ENCAP_ESPINUDP:
-		case UDP_ENCAP_ESPINUDP_NON_IKE:
-			encap_data->proto = AF_INET;
-			encap_data->saddr.a4 = iph->saddr;
-			encap_data->sport = uh->source;
-			encap_len = (void*)esph - (void*)uh;
-			break;
+		uh = (struct udphdr *)(iph + 1);
+		encap_len = (void*)esph - (void*)uh;
  
-		default:
-			goto out;
+		/*
+		 * 1) if the NAT-T peer's IP or port changed then
+		 *    advertize the change to the keying daemon.
+		 *    This is an inbound SA, so just compare
+		 *    SRC ports.
+		 */
+		if (iph->saddr != x->props.saddr.a4 ||
+		    uh->source != encap->encap_sport) {
+			xfrm_address_t ipaddr;
+
+			ipaddr.a4 = iph->saddr;
+			km_new_mapping(x, &ipaddr, uh->source);
+				
+			/* XXX: perhaps add an extra
+			 * policy check here, to see
+			 * if we should allow or
+			 * reject a packet from a
+			 * different source
+			 * address/port.
+			 */
 		}
+	
+		/*
+		 * 2) ignore UDP/TCP checksums in case
+		 *    of NAT-T in Transport Mode, or
+		 *    perform other post-processing fixes
+		 *    as per draft-ietf-ipsec-udp-encaps-06,
+		 *    section 3.1.2
+		 */
+		if (!x->props.mode)
+			skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}
  
 	iph->protocol = nexthdr[1];
@@ -245,63 +260,6 @@
 	return -EINVAL;
 }
  
-static int esp_post_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
-{
-  
-	if (x->encap) {
-		struct xfrm_encap_tmpl *encap;
-		struct esp_decap_data *decap_data;
-
-		encap = x->encap;
-		decap_data = (struct esp_decap_data *)(decap->decap_data);
-
-		/* first, make sure that the decap type == the encap type */
-		if (encap->encap_type != decap->decap_type)
-			return -EINVAL;
-
-		switch (encap->encap_type) {
-		default:
-		case UDP_ENCAP_ESPINUDP:
-		case UDP_ENCAP_ESPINUDP_NON_IKE:
-			/*
-			 * 1) if the NAT-T peer's IP or port changed then
-			 *    advertize the change to the keying daemon.
-			 *    This is an inbound SA, so just compare
-			 *    SRC ports.
-			 */
-			if (decap_data->proto == AF_INET &&
-			    (decap_data->saddr.a4 != x->props.saddr.a4 ||
-			     decap_data->sport != encap->encap_sport)) {
-				xfrm_address_t ipaddr;
-
-				ipaddr.a4 = decap_data->saddr.a4;
-				km_new_mapping(x, &ipaddr, decap_data->sport);
-					
-				/* XXX: perhaps add an extra
-				 * policy check here, to see
-				 * if we should allow or
-				 * reject a packet from a
-				 * different source
-				 * address/port.
-				 */
-			}
-		
-			/*
-			 * 2) ignore UDP/TCP checksums in case
-			 *    of NAT-T in Transport Mode, or
-			 *    perform other post-processing fixes
-			 *    as per * draft-ietf-ipsec-udp-encaps-06,
-			 *    section 3.1.2
-			 */
-			if (!x->props.mode)
-				skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-			break;
-		}
-	}
-	return 0;
-}
-
 static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
 {
 	struct esp_data *esp = x->data;
@@ -457,7 +415,6 @@
 	.destructor	= esp_destroy,
 	.get_max_size	= esp4_get_max_size,
 	.input		= esp_input,
-	.post_input	= esp_post_input,
 	.output		= esp_output
 };
  
@@ -469,15 +426,6 @@
  
 static int __init esp4_init(void)
 {
-	struct xfrm_decap_state decap;
-
-	if (sizeof(struct esp_decap_data)  >
-	    sizeof(decap.decap_data)) {
-		extern void decap_data_too_small(void);
-
-		decap_data_too_small();
-	}
-
 	if (xfrm_register_type(&esp_type, AF_INET) < 0) {
 		printk(KERN_INFO "ip esp init: can't add xfrm type\n");
 		return -EAGAIN;
@@ -996,13 +996,6 @@
 			struct sec_decap_state *xvec = &(skb->sp->x[i]);
 			if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
 				return 0;
-
-			/* If there is a post_input processor, try running it */
-			if (xvec->xvec->type->post_input &&
-			    (xvec->xvec->type->post_input)(xvec->xvec,
-							   &(xvec->decap),
-							   skb) != 0)
-				return 0;
 		}
 	}
...	...	@@ -233,7 +233,6 @@
233	233	int (init_state)(struct xfrm_state x);
234	234	void (destructor)(struct xfrm_state );
235	235	int (input)(struct xfrm_state , struct xfrm_decap_state , struct sk_buff skb);
236		- int (post_input)(struct xfrm_state , struct xfrm_decap_state , struct sk_buff skb);
237	236	int (output)(struct xfrm_state , struct sk_buff *pskb);
238	237	/* Estimate maximal size of result of transformation of a dgram */
239	238	u32 (get_max_size)(struct xfrm_state , int size);
...	...	@@ -12,13 +12,6 @@
12	12	#include <net/protocol.h>
13	13	#include <net/udp.h>
14	14
15		-/* decapsulation data for use when post-processing */
16		-struct esp_decap_data {
17		- xfrm_address_t saddr;
18		- __u16 sport;
19		- __u8 proto;
20		-};
21		-
22	15	static int esp_output(struct xfrm_state x, struct sk_buff skb)
23	16	{
24	17	int err;
25	18
26	19
27	20
28	21
...	...	@@ -210,25 +203,47 @@
210	203
211	204	/* ... check padding bits here. Silly. :-) */
212	205
213		- if (x->encap && decap && decap->decap_type) {
214		- struct esp_decap_data *encap_data;
215		- struct udphdr uh = (struct udphdr ) (iph+1);
	206	+ if (x->encap) {
	207	+ struct xfrm_encap_tmpl *encap = x->encap;
	208	+ struct udphdr *uh;
216	209
217		- encap_data = (struct esp_decap_data *) (decap->decap_data);
218		- encap_data->proto = 0;
	210	+ if (encap->encap_type != decap->decap_type)
	211	+ goto out;
219	212
220		- switch (decap->decap_type) {
221		- case UDP_ENCAP_ESPINUDP:
222		- case UDP_ENCAP_ESPINUDP_NON_IKE:
223		- encap_data->proto = AF_INET;
224		- encap_data->saddr.a4 = iph->saddr;
225		- encap_data->sport = uh->source;
226		- encap_len = (void)esph - (void)uh;
227		- break;
	213	+ uh = (struct udphdr *)(iph + 1);
	214	+ encap_len = (void)esph - (void)uh;
228	215
229		- default:
230		- goto out;
	216	+ /*
	217	+ * 1) if the NAT-T peer's IP or port changed then
	218	+ * advertize the change to the keying daemon.
	219	+ * This is an inbound SA, so just compare
	220	+ * SRC ports.
	221	+ */
	222	+ if (iph->saddr != x->props.saddr.a4 \|\|
	223	+ uh->source != encap->encap_sport) {
	224	+ xfrm_address_t ipaddr;
	225	+
	226	+ ipaddr.a4 = iph->saddr;
	227	+ km_new_mapping(x, &ipaddr, uh->source);
	228	+
	229	+ /* XXX: perhaps add an extra
	230	+ * policy check here, to see
	231	+ * if we should allow or
	232	+ * reject a packet from a
	233	+ * different source
	234	+ * address/port.
	235	+ */
231	236	}
	237	+
	238	+ /*
	239	+ * 2) ignore UDP/TCP checksums in case
	240	+ * of NAT-T in Transport Mode, or
	241	+ * perform other post-processing fixes
	242	+ * as per draft-ietf-ipsec-udp-encaps-06,
	243	+ * section 3.1.2
	244	+ */
	245	+ if (!x->props.mode)
	246	+ skb->ip_summed = CHECKSUM_UNNECESSARY;
232	247	}
233	248
234	249	iph->protocol = nexthdr[1];
...	...	@@ -245,63 +260,6 @@
245	260	return -EINVAL;
246	261	}
247	262
248		-static int esp_post_input(struct xfrm_state x, struct xfrm_decap_state decap, struct sk_buff *skb)
249		-{
250		-
251		- if (x->encap) {
252		- struct xfrm_encap_tmpl *encap;
253		- struct esp_decap_data *decap_data;
254		-
255		- encap = x->encap;
256		- decap_data = (struct esp_decap_data *)(decap->decap_data);
257		-
258		- /* first, make sure that the decap type == the encap type */
259		- if (encap->encap_type != decap->decap_type)
260		- return -EINVAL;
261		-
262		- switch (encap->encap_type) {
263		- default:
264		- case UDP_ENCAP_ESPINUDP:
265		- case UDP_ENCAP_ESPINUDP_NON_IKE:
266		- /*
267		- * 1) if the NAT-T peer's IP or port changed then
268		- * advertize the change to the keying daemon.
269		- * This is an inbound SA, so just compare
270		- * SRC ports.
271		- */
272		- if (decap_data->proto == AF_INET &&
273		- (decap_data->saddr.a4 != x->props.saddr.a4 \|\|
274		- decap_data->sport != encap->encap_sport)) {
275		- xfrm_address_t ipaddr;
276		-
277		- ipaddr.a4 = decap_data->saddr.a4;
278		- km_new_mapping(x, &ipaddr, decap_data->sport);
279		-
280		- /* XXX: perhaps add an extra
281		- * policy check here, to see
282		- * if we should allow or
283		- * reject a packet from a
284		- * different source
285		- * address/port.
286		- */
287		- }
288		-
289		- /*
290		- * 2) ignore UDP/TCP checksums in case
291		- * of NAT-T in Transport Mode, or
292		- * perform other post-processing fixes
293		- * as per * draft-ietf-ipsec-udp-encaps-06,
294		- * section 3.1.2
295		- */
296		- if (!x->props.mode)
297		- skb->ip_summed = CHECKSUM_UNNECESSARY;
298		-
299		- break;
300		- }
301		- }
302		- return 0;
303		-}
304		-
305	263	static u32 esp4_get_max_size(struct xfrm_state *x, int mtu)
306	264	{
307	265	struct esp_data *esp = x->data;
...	...	@@ -457,7 +415,6 @@
457	415	.destructor = esp_destroy,
458	416	.get_max_size = esp4_get_max_size,
459	417	.input = esp_input,
460		- .post_input = esp_post_input,
461	418	.output = esp_output
462	419	};
463	420
...	...	@@ -469,15 +426,6 @@
469	426
470	427	static int __init esp4_init(void)
471	428	{
472		- struct xfrm_decap_state decap;
473		-
474		- if (sizeof(struct esp_decap_data) >
475		- sizeof(decap.decap_data)) {
476		- extern void decap_data_too_small(void);
477		-
478		- decap_data_too_small();
479		- }
480		-
481	429	if (xfrm_register_type(&esp_type, AF_INET) < 0) {
482	430	printk(KERN_INFO "ip esp init: can't add xfrm type\n");
483	431	return -EAGAIN;
...	...	@@ -996,13 +996,6 @@
996	996	struct sec_decap_state *xvec = &(skb->sp->x[i]);
997	997	if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
998	998	return 0;
999		-
1000		- /* If there is a post_input processor, try running it */
1001		- if (xvec->xvec->type->post_input &&
1002		- (xvec->xvec->type->post_input)(xvec->xvec,
1003		- &(xvec->decap),
1004		- skb) != 0)
1005		- return 0;
1006	999	}
1007	1000	}
1008	1001