[IPSEC]: Merge most of the input path

As part of the work on asynchronous cryptographic operations, we need
to be able to resume from the spot where they occur.  As such, it
helps if we isolate them to one spot.

This patch moves most of the remaining family-specific processing into
the common input code.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 14 insertions, 105 deletions

diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index c458d0a2e684..3b9eedf5b24a 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -23,118 +23,26 @@ int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb)
 
 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 {
-        int err;
-        __be32 seq;
-        struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
-        struct xfrm_state *x;
-        int xfrm_nr = 0;
-        int decaps = 0;
-        unsigned int nhoff;
-
-        nhoff = IP6CB(skb)->nhoff;
-
-        seq = 0;
-        if (!spi && (err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) != 0)
-                goto drop;
-
-        do {
-                struct ipv6hdr *iph = ipv6_hdr(skb);
-
-                if (xfrm_nr == XFRM_MAX_DEPTH)
-                        goto drop;
-
-                x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi,
-                                      nexthdr, AF_INET6);
-                if (x == NULL)
-                        goto drop;
-                spin_lock(&x->lock);
-                if (unlikely(x->km.state != XFRM_STATE_VALID))
-                        goto drop_unlock;
-
-                if (x->props.replay_window && xfrm_replay_check(x, seq))
-                        goto drop_unlock;
-
-                if (xfrm_state_check_expire(x))
-                        goto drop_unlock;
-
-                nexthdr = x->type->input(x, skb);
-                if (nexthdr <= 0)
-                        goto drop_unlock;
-
-                skb_network_header(skb)[nhoff] = nexthdr;
-
-                if (x->props.replay_window)
-                        xfrm_replay_advance(x, seq);
-
-                x->curlft.bytes += skb->len;
-                x->curlft.packets++;
-
-                spin_unlock(&x->lock);
-
-                xfrm_vec[xfrm_nr++] = x;
-
-                if (x->inner_mode->input(x, skb))
-                        goto drop;
-
-                if (x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) {
-                        decaps = 1;
-                        break;
-                }
-
-                if ((err = xfrm_parse_spi(skb, nexthdr, &spi, &seq)) < 0)
-                        goto drop;
-        } while (!err);
-
-        /* Allocate new secpath or COW existing one. */
-        if (!skb->sp || atomic_read(&skb->sp->refcnt) != 1) {
-                struct sec_path *sp;
-                sp = secpath_dup(skb->sp);
-                if (!sp)
-                        goto drop;
-                if (skb->sp)
-                        secpath_put(skb->sp);
-                skb->sp = sp;
-        }
-
-        if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
-                goto drop;
-
-        memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
-               xfrm_nr * sizeof(xfrm_vec[0]));
-        skb->sp->len += xfrm_nr;
-
-        nf_reset(skb);
+        XFRM_SPI_SKB_CB(skb)->nhoff = IP6CB(skb)->nhoff;
+        XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
+        return xfrm_input(skb, nexthdr, spi, 0);
+}
+EXPORT_SYMBOL(xfrm6_rcv_spi);
 
-        if (decaps) {
-                dst_release(skb->dst);
-                skb->dst = NULL;
-                netif_rx(skb);
-                return -1;
-        } else {
+int xfrm6_transport_finish(struct sk_buff *skb, int async)
+{
 #ifdef CONFIG_NETFILTER
-                ipv6_hdr(skb)->payload_len = htons(skb->len);
-                __skb_push(skb, skb->data - skb_network_header(skb));
+        ipv6_hdr(skb)->payload_len = htons(skb->len);
+        __skb_push(skb, skb->data - skb_network_header(skb));
 
-                NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
-                        ip6_rcv_finish);
-                return -1;
+        NF_HOOK(PF_INET6, NF_IP6_PRE_ROUTING, skb, skb->dev, NULL,
+                ip6_rcv_finish);
+        return -1;
 #else
-                return 1;
+        return 1;
 #endif
-        }
-
-drop_unlock:
-        spin_unlock(&x->lock);
-        xfrm_state_put(x);
-drop:
-        while (--xfrm_nr >= 0)
-                xfrm_state_put(xfrm_vec[xfrm_nr]);
-        kfree_skb(skb);
-        return -1;
 }
 
-EXPORT_SYMBOL(xfrm6_rcv_spi);
-
 int xfrm6_rcv(struct sk_buff *skb)
 {
         return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index bb09e85a336d..00360b514e99 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -198,6 +198,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
         .output                 = xfrm6_output,
         .extract_input          = xfrm6_extract_input,
         .extract_output         = xfrm6_extract_output,
+        .transport_finish       = xfrm6_transport_finish,
 };
 
 void __init xfrm6_state_init(void)