Skip to content

Commit

Permalink
xfrm: Remove inner/outer modes from input path
Browse files Browse the repository at this point in the history 
The inner/outer modes were added to abstract out common code that
were once duplicated between IPv4 and IPv6.  As time went on the
abstractions have been removed and we are now left with empty
shells that only contain duplicate information.  These can be
removed one-by-one as the same information is already present
elsewhere in the xfrm_state object.

Removing them from the input path actually allows certain valid
combinations that are currently disallowed.  In particular, when
a transport mode SA sits beneath a tunnel mode SA that changes
address families, at present the transport mode SA cannot have
AF_UNSPEC as its selector because it will be erroneously be treated
as inter-family itself even though it simply sits beneath one.

This is a serious problem because you can't set the selector to
non-AF_UNSPEC either as that will cause the selector match to
fail as we always match selectors to the inner-most traffic.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
  • Loading branch information
Herbert Xu authored and Steffen Klassert committed Mar 13, 2023
1 parent 95b7445 commit 5f24f41
Showing 1 changed file with 23 additions and 43 deletions.
66 changes: 23 additions & 43 deletions net/xfrm/xfrm_input.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -231,9 +231,6 @@ static int xfrm4_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb)
{
int err = -EINVAL;

if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP)
goto out;

if (!pskb_may_pull(skb, sizeof(struct iphdr)))
goto out;

Expand Down Expand Up @@ -269,8 +266,6 @@ static int xfrm6_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb)
{
int err = -EINVAL;

if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
goto out;
if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
goto out;

Expand Down Expand Up @@ -331,22 +326,26 @@ static int xfrm6_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb)
*/
static int
xfrm_inner_mode_encap_remove(struct xfrm_state *x,
const struct xfrm_mode *inner_mode,
struct sk_buff *skb)
{
switch (inner_mode->encap) {
switch (x->props.mode) {
case XFRM_MODE_BEET:
if (inner_mode->family == AF_INET)
switch (XFRM_MODE_SKB_CB(skb)->protocol) {
case IPPROTO_IPIP:
case IPPROTO_BEETPH:
return xfrm4_remove_beet_encap(x, skb);
if (inner_mode->family == AF_INET6)
case IPPROTO_IPV6:
return xfrm6_remove_beet_encap(x, skb);
}
break;
case XFRM_MODE_TUNNEL:
if (inner_mode->family == AF_INET)
switch (XFRM_MODE_SKB_CB(skb)->protocol) {
case IPPROTO_IPIP:
return xfrm4_remove_tunnel_encap(x, skb);
if (inner_mode->family == AF_INET6)
case IPPROTO_IPV6:
return xfrm6_remove_tunnel_encap(x, skb);
break;
}
}

WARN_ON_ONCE(1);
Expand All @@ -355,9 +354,7 @@ xfrm_inner_mode_encap_remove(struct xfrm_state *x,

static int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
{
const struct xfrm_mode *inner_mode = &x->inner_mode;

switch (x->outer_mode.family) {
switch (x->props.family) {
case AF_INET:
xfrm4_extract_header(skb);
break;
Expand All @@ -369,25 +366,20 @@ static int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)
return -EAFNOSUPPORT;
}

if (x->sel.family == AF_UNSPEC) {
inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
if (!inner_mode)
return -EAFNOSUPPORT;
}

switch (inner_mode->family) {
case AF_INET:
switch (XFRM_MODE_SKB_CB(skb)->protocol) {
case IPPROTO_IPIP:
case IPPROTO_BEETPH:
skb->protocol = htons(ETH_P_IP);
break;
case AF_INET6:
case IPPROTO_IPV6:
skb->protocol = htons(ETH_P_IPV6);
break;
default:
WARN_ON_ONCE(1);
break;
}

return xfrm_inner_mode_encap_remove(x, inner_mode, skb);
return xfrm_inner_mode_encap_remove(x, skb);
}

/* Remove encapsulation header.
Expand Down Expand Up @@ -433,17 +425,16 @@ static int xfrm6_transport_input(struct xfrm_state *x, struct sk_buff *skb)
}

static int xfrm_inner_mode_input(struct xfrm_state *x,
const struct xfrm_mode *inner_mode,
struct sk_buff *skb)
{
switch (inner_mode->encap) {
switch (x->props.mode) {
case XFRM_MODE_BEET:
case XFRM_MODE_TUNNEL:
return xfrm_prepare_input(x, skb);
case XFRM_MODE_TRANSPORT:
if (inner_mode->family == AF_INET)
if (x->props.family == AF_INET)
return xfrm4_transport_input(x, skb);
if (inner_mode->family == AF_INET6)
if (x->props.family == AF_INET6)
return xfrm6_transport_input(x, skb);
break;
case XFRM_MODE_ROUTEOPTIMIZATION:
Expand All @@ -461,7 +452,6 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
{
const struct xfrm_state_afinfo *afinfo;
struct net *net = dev_net(skb->dev);
const struct xfrm_mode *inner_mode;
int err;
__be32 seq;
__be32 seq_hi;
Expand Down Expand Up @@ -491,7 +481,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
goto drop;
}

family = x->outer_mode.family;
family = x->props.family;

/* An encap_type of -1 indicates async resumption. */
if (encap_type == -1) {
Expand Down Expand Up @@ -676,17 +666,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)

XFRM_MODE_SKB_CB(skb)->protocol = nexthdr;

inner_mode = &x->inner_mode;

if (x->sel.family == AF_UNSPEC) {
inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
if (inner_mode == NULL) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
goto drop;
}
}

if (xfrm_inner_mode_input(x, inner_mode, skb)) {
if (xfrm_inner_mode_input(x, skb)) {
XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
goto drop;
}
Expand All @@ -701,7 +681,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
* transport mode so the outer address is identical.
*/
daddr = &x->id.daddr;
family = x->outer_mode.family;
family = x->props.family;

err = xfrm_parse_spi(skb, nexthdr, &spi, &seq);
if (err < 0) {
Expand Down Expand Up @@ -732,7 +712,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)

err = -EAFNOSUPPORT;
rcu_read_lock();
afinfo = xfrm_state_afinfo_get_rcu(x->inner_mode.family);
afinfo = xfrm_state_afinfo_get_rcu(x->props.family);
if (likely(afinfo))
err = afinfo->transport_finish(skb, xfrm_gro || async);
rcu_read_unlock();
Expand Down

0 comments on commit 5f24f41

Please sign in to comment.