]>
Commit | Line | Data |
---|---|---|
406ef77c HX |
1 | /* |
2 | * xfrm_output.c - Common IPsec encapsulation code. | |
3 | * | |
4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public License | |
8 | * as published by the Free Software Foundation; either version | |
9 | * 2 of the License, or (at your option) any later version. | |
10 | */ | |
11 | ||
12 | #include <linux/errno.h> | |
13 | #include <linux/module.h> | |
14 | #include <linux/netdevice.h> | |
862b82c6 | 15 | #include <linux/netfilter.h> |
406ef77c | 16 | #include <linux/skbuff.h> |
5a0e3ad6 | 17 | #include <linux/slab.h> |
406ef77c | 18 | #include <linux/spinlock.h> |
406ef77c HX |
19 | #include <net/dst.h> |
20 | #include <net/xfrm.h> | |
21 | ||
0c4b51f0 | 22 | static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb); |
c6581a45 | 23 | |
26b2072e | 24 | static int xfrm_skb_check_space(struct sk_buff *skb) |
83815dea | 25 | { |
adf30907 | 26 | struct dst_entry *dst = skb_dst(skb); |
550ade84 | 27 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) |
83815dea | 28 | - skb_headroom(skb); |
f5184d26 | 29 | int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); |
83815dea | 30 | |
d01dbeb6 HX |
31 | if (nhead <= 0) { |
32 | if (ntail <= 0) | |
33 | return 0; | |
34 | nhead = 0; | |
35 | } else if (ntail < 0) | |
36 | ntail = 0; | |
37 | ||
38 | return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); | |
83815dea HX |
39 | } |
40 | ||
9449c3cd YX |
41 | /* Children define the path of the packet through the |
42 | * Linux networking. Thus, destinations are stackable. | |
43 | */ | |
44 | ||
45 | static struct dst_entry *skb_dst_pop(struct sk_buff *skb) | |
46 | { | |
47 | struct dst_entry *child = dst_clone(skb_dst(skb)->child); | |
48 | ||
49 | skb_dst_drop(skb); | |
50 | return child; | |
51 | } | |
52 | ||
c6581a45 | 53 | static int xfrm_output_one(struct sk_buff *skb, int err) |
406ef77c | 54 | { |
adf30907 | 55 | struct dst_entry *dst = skb_dst(skb); |
406ef77c | 56 | struct xfrm_state *x = dst->xfrm; |
a6483b79 | 57 | struct net *net = xs_net(x); |
406ef77c | 58 | |
c6581a45 HX |
59 | if (err <= 0) |
60 | goto resume; | |
406ef77c HX |
61 | |
62 | do { | |
26b2072e | 63 | err = xfrm_skb_check_space(skb); |
b15c4bcd | 64 | if (err) { |
59c9940e | 65 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
910ef70a | 66 | goto error_nolock; |
b15c4bcd | 67 | } |
910ef70a | 68 | |
077fbac4 LC |
69 | if (x->props.output_mark) |
70 | skb->mark = x->props.output_mark; | |
71 | ||
a2deb6d2 | 72 | err = x->outer_mode->output(x, skb); |
b15c4bcd | 73 | if (err) { |
59c9940e | 74 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR); |
910ef70a | 75 | goto error_nolock; |
b15c4bcd | 76 | } |
a2deb6d2 | 77 | |
406ef77c | 78 | spin_lock_bh(&x->lock); |
bb65a9cb LR |
79 | |
80 | if (unlikely(x->km.state != XFRM_STATE_VALID)) { | |
81 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); | |
497574c7 | 82 | err = -EINVAL; |
fa8599db | 83 | goto error; |
bb65a9cb LR |
84 | } |
85 | ||
910ef70a | 86 | err = xfrm_state_check_expire(x); |
b15c4bcd | 87 | if (err) { |
59c9940e | 88 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); |
406ef77c | 89 | goto error; |
b15c4bcd | 90 | } |
406ef77c | 91 | |
9fdc4883 SK |
92 | err = x->repl->overflow(x, skb); |
93 | if (err) { | |
94 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); | |
95 | goto error; | |
436a0a40 HX |
96 | } |
97 | ||
406ef77c HX |
98 | x->curlft.bytes += skb->len; |
99 | x->curlft.packets++; | |
100 | ||
406ef77c HX |
101 | spin_unlock_bh(&x->lock); |
102 | ||
3bc07321 | 103 | skb_dst_force(skb); |
0d4169ed SK |
104 | if (!skb_dst(skb)) { |
105 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); | |
9d076a27 | 106 | err = -EHOSTUNREACH; |
0d4169ed SK |
107 | goto error_nolock; |
108 | } | |
3bc07321 | 109 | |
d77e38e6 SK |
110 | if (xfrm_offload(skb)) { |
111 | x->type_offload->encap(x, skb); | |
112 | } else { | |
73b9fc49 SK |
113 | /* Inner headers are invalid now. */ |
114 | skb->encapsulation = 0; | |
115 | ||
d77e38e6 SK |
116 | err = x->type->output(x, skb); |
117 | if (err == -EINPROGRESS) | |
118 | goto out; | |
119 | } | |
c6581a45 HX |
120 | |
121 | resume: | |
0aa64774 | 122 | if (err) { |
59c9940e | 123 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR); |
b7c6538c | 124 | goto error_nolock; |
0aa64774 | 125 | } |
b7c6538c | 126 | |
8764ab2c | 127 | dst = skb_dst_pop(skb); |
adf30907 | 128 | if (!dst) { |
59c9940e | 129 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
406ef77c HX |
130 | err = -EHOSTUNREACH; |
131 | goto error_nolock; | |
132 | } | |
e433430a | 133 | skb_dst_set(skb, dst); |
406ef77c | 134 | x = dst->xfrm; |
13996378 | 135 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
406ef77c | 136 | |
ebd4687a | 137 | return 0; |
406ef77c | 138 | |
406ef77c HX |
139 | error: |
140 | spin_unlock_bh(&x->lock); | |
862b82c6 HX |
141 | error_nolock: |
142 | kfree_skb(skb); | |
ebd4687a JS |
143 | out: |
144 | return err; | |
862b82c6 HX |
145 | } |
146 | ||
c6581a45 | 147 | int xfrm_output_resume(struct sk_buff *skb, int err) |
862b82c6 | 148 | { |
29a26a56 | 149 | struct net *net = xs_net(skb_dst(skb)->xfrm); |
be10de0a | 150 | |
c6581a45 | 151 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
862b82c6 HX |
152 | nf_reset(skb); |
153 | ||
cf91a99d | 154 | err = skb_dst(skb)->ops->local_out(net, skb->sk, skb); |
862b82c6 | 155 | if (unlikely(err != 1)) |
c6581a45 | 156 | goto out; |
862b82c6 | 157 | |
adf30907 | 158 | if (!skb_dst(skb)->xfrm) |
13206b6b | 159 | return dst_output(net, skb->sk, skb); |
862b82c6 | 160 | |
adf30907 | 161 | err = nf_hook(skb_dst(skb)->ops->family, |
29a26a56 | 162 | NF_INET_POST_ROUTING, net, skb->sk, skb, |
adf30907 | 163 | NULL, skb_dst(skb)->dev, xfrm_output2); |
862b82c6 | 164 | if (unlikely(err != 1)) |
c6581a45 | 165 | goto out; |
862b82c6 HX |
166 | } |
167 | ||
c6581a45 HX |
168 | if (err == -EINPROGRESS) |
169 | err = 0; | |
170 | ||
171 | out: | |
862b82c6 HX |
172 | return err; |
173 | } | |
c6581a45 | 174 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
862b82c6 | 175 | |
0c4b51f0 | 176 | static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb) |
862b82c6 | 177 | { |
c6581a45 HX |
178 | return xfrm_output_resume(skb, 1); |
179 | } | |
862b82c6 | 180 | |
0c4b51f0 | 181 | static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb) |
c6581a45 HX |
182 | { |
183 | struct sk_buff *segs; | |
862b82c6 | 184 | |
9207f9d4 KK |
185 | BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET); |
186 | BUILD_BUG_ON(sizeof(*IP6CB(skb)) > SKB_SGO_CB_OFFSET); | |
862b82c6 HX |
187 | segs = skb_gso_segment(skb, 0); |
188 | kfree_skb(skb); | |
801678c5 | 189 | if (IS_ERR(segs)) |
862b82c6 | 190 | return PTR_ERR(segs); |
330966e5 FW |
191 | if (segs == NULL) |
192 | return -EINVAL; | |
862b82c6 HX |
193 | |
194 | do { | |
195 | struct sk_buff *nskb = segs->next; | |
196 | int err; | |
197 | ||
198 | segs->next = NULL; | |
0c4b51f0 | 199 | err = xfrm_output2(net, sk, segs); |
862b82c6 HX |
200 | |
201 | if (unlikely(err)) { | |
46cfd725 | 202 | kfree_skb_list(nskb); |
862b82c6 HX |
203 | return err; |
204 | } | |
205 | ||
206 | segs = nskb; | |
207 | } while (segs); | |
208 | ||
209 | return 0; | |
406ef77c | 210 | } |
c6581a45 | 211 | |
7026b1dd | 212 | int xfrm_output(struct sock *sk, struct sk_buff *skb) |
c6581a45 | 213 | { |
adf30907 | 214 | struct net *net = dev_net(skb_dst(skb)->dev); |
d77e38e6 | 215 | struct xfrm_state *x = skb_dst(skb)->xfrm; |
c6581a45 HX |
216 | int err; |
217 | ||
d77e38e6 SK |
218 | secpath_reset(skb); |
219 | ||
220 | if (xfrm_dev_offload_ok(skb, x)) { | |
221 | struct sec_path *sp; | |
222 | ||
223 | sp = secpath_dup(skb->sp); | |
224 | if (!sp) { | |
225 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); | |
226 | kfree_skb(skb); | |
227 | return -ENOMEM; | |
228 | } | |
229 | if (skb->sp) | |
230 | secpath_put(skb->sp); | |
231 | skb->sp = sp; | |
f1bd7d65 | 232 | skb->encapsulation = 1; |
d77e38e6 SK |
233 | |
234 | sp->olen++; | |
235 | sp->xvec[skb->sp->len++] = x; | |
236 | xfrm_state_hold(x); | |
237 | ||
238 | if (skb_is_gso(skb)) { | |
239 | skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; | |
240 | ||
241 | return xfrm_output2(net, sk, skb); | |
242 | } | |
243 | ||
244 | if (x->xso.dev && x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM) | |
245 | goto out; | |
246 | } | |
247 | ||
c6581a45 | 248 | if (skb_is_gso(skb)) |
0c4b51f0 | 249 | return xfrm_output_gso(net, sk, skb); |
c6581a45 HX |
250 | |
251 | if (skb->ip_summed == CHECKSUM_PARTIAL) { | |
252 | err = skb_checksum_help(skb); | |
253 | if (err) { | |
59c9940e | 254 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
c6581a45 HX |
255 | kfree_skb(skb); |
256 | return err; | |
257 | } | |
258 | } | |
259 | ||
d77e38e6 | 260 | out: |
0c4b51f0 | 261 | return xfrm_output2(net, sk, skb); |
c6581a45 | 262 | } |
fc68086c | 263 | EXPORT_SYMBOL_GPL(xfrm_output); |
df9dcb45 KM |
264 | |
265 | int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) | |
266 | { | |
267 | struct xfrm_mode *inner_mode; | |
268 | if (x->sel.family == AF_UNSPEC) | |
269 | inner_mode = xfrm_ip2inner_mode(x, | |
adf30907 | 270 | xfrm_af2proto(skb_dst(skb)->ops->family)); |
df9dcb45 KM |
271 | else |
272 | inner_mode = x->inner_mode; | |
273 | ||
274 | if (inner_mode == NULL) | |
275 | return -EAFNOSUPPORT; | |
276 | return inner_mode->afinfo->extract_output(x, skb); | |
277 | } | |
fc68086c | 278 | EXPORT_SYMBOL_GPL(xfrm_inner_extract_output); |
df9dcb45 | 279 | |
628e341f HFS |
280 | void xfrm_local_error(struct sk_buff *skb, int mtu) |
281 | { | |
844d4874 | 282 | unsigned int proto; |
628e341f HFS |
283 | struct xfrm_state_afinfo *afinfo; |
284 | ||
844d4874 HFS |
285 | if (skb->protocol == htons(ETH_P_IP)) |
286 | proto = AF_INET; | |
287 | else if (skb->protocol == htons(ETH_P_IPV6)) | |
288 | proto = AF_INET6; | |
289 | else | |
290 | return; | |
291 | ||
292 | afinfo = xfrm_state_get_afinfo(proto); | |
36dbb90a | 293 | if (afinfo) { |
af5d27c4 | 294 | afinfo->local_error(skb, mtu); |
36dbb90a TY |
295 | rcu_read_unlock(); |
296 | } | |
628e341f | 297 | } |
628e341f | 298 | EXPORT_SYMBOL_GPL(xfrm_local_error); |