2 * xfrm_output.c - Common IPsec encapsulation code.
4 * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/errno.h>
13 #include <linux/module.h>
14 #include <linux/netdevice.h>
15 #include <linux/netfilter.h>
16 #include <linux/skbuff.h>
17 #include <linux/slab.h>
18 #include <linux/spinlock.h>
22 static int xfrm_output2(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
);
24 static int xfrm_skb_check_space(struct sk_buff
*skb
)
26 struct dst_entry
*dst
= skb_dst(skb
);
27 int nhead
= dst
->header_len
+ LL_RESERVED_SPACE(dst
->dev
)
29 int ntail
= dst
->dev
->needed_tailroom
- skb_tailroom(skb
);
38 return pskb_expand_head(skb
, nhead
, ntail
, GFP_ATOMIC
);
41 /* Children define the path of the packet through the
42 * Linux networking. Thus, destinations are stackable.
45 static struct dst_entry
*skb_dst_pop(struct sk_buff
*skb
)
47 struct dst_entry
*child
= dst_clone(skb_dst(skb
)->child
);
53 static int xfrm_output_one(struct sk_buff
*skb
, int err
)
55 struct dst_entry
*dst
= skb_dst(skb
);
56 struct xfrm_state
*x
= dst
->xfrm
;
57 struct net
*net
= xs_net(x
);
63 err
= xfrm_skb_check_space(skb
);
65 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTERROR
);
69 if (x
->props
.output_mark
)
70 skb
->mark
= x
->props
.output_mark
;
72 err
= x
->outer_mode
->output(x
, skb
);
74 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTSTATEMODEERROR
);
78 spin_lock_bh(&x
->lock
);
80 if (unlikely(x
->km
.state
!= XFRM_STATE_VALID
)) {
81 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTSTATEINVALID
);
86 err
= xfrm_state_check_expire(x
);
88 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTSTATEEXPIRED
);
92 err
= x
->repl
->overflow(x
, skb
);
94 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTSTATESEQERROR
);
98 x
->curlft
.bytes
+= skb
->len
;
101 spin_unlock_bh(&x
->lock
);
105 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTERROR
);
109 if (xfrm_offload(skb
)) {
110 x
->type_offload
->encap(x
, skb
);
112 /* Inner headers are invalid now. */
113 skb
->encapsulation
= 0;
115 err
= x
->type
->output(x
, skb
);
116 if (err
== -EINPROGRESS
)
122 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTSTATEPROTOERROR
);
126 dst
= skb_dst_pop(skb
);
128 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTERROR
);
132 skb_dst_set(skb
, dst
);
134 } while (x
&& !(x
->outer_mode
->flags
& XFRM_MODE_FLAG_TUNNEL
));
139 spin_unlock_bh(&x
->lock
);
146 int xfrm_output_resume(struct sk_buff
*skb
, int err
)
148 struct net
*net
= xs_net(skb_dst(skb
)->xfrm
);
150 while (likely((err
= xfrm_output_one(skb
, err
)) == 0)) {
153 err
= skb_dst(skb
)->ops
->local_out(net
, skb
->sk
, skb
);
154 if (unlikely(err
!= 1))
157 if (!skb_dst(skb
)->xfrm
)
158 return dst_output(net
, skb
->sk
, skb
);
160 err
= nf_hook(skb_dst(skb
)->ops
->family
,
161 NF_INET_POST_ROUTING
, net
, skb
->sk
, skb
,
162 NULL
, skb_dst(skb
)->dev
, xfrm_output2
);
163 if (unlikely(err
!= 1))
167 if (err
== -EINPROGRESS
)
173 EXPORT_SYMBOL_GPL(xfrm_output_resume
);
175 static int xfrm_output2(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
177 return xfrm_output_resume(skb
, 1);
180 static int xfrm_output_gso(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
182 struct sk_buff
*segs
;
184 BUILD_BUG_ON(sizeof(*IPCB(skb
)) > SKB_SGO_CB_OFFSET
);
185 BUILD_BUG_ON(sizeof(*IP6CB(skb
)) > SKB_SGO_CB_OFFSET
);
186 segs
= skb_gso_segment(skb
, 0);
189 return PTR_ERR(segs
);
194 struct sk_buff
*nskb
= segs
->next
;
198 err
= xfrm_output2(net
, sk
, segs
);
201 kfree_skb_list(nskb
);
211 int xfrm_output(struct sock
*sk
, struct sk_buff
*skb
)
213 struct net
*net
= dev_net(skb_dst(skb
)->dev
);
214 struct xfrm_state
*x
= skb_dst(skb
)->xfrm
;
219 if (xfrm_dev_offload_ok(skb
, x
)) {
222 sp
= secpath_dup(skb
->sp
);
224 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTERROR
);
229 secpath_put(skb
->sp
);
231 skb
->encapsulation
= 1;
234 sp
->xvec
[skb
->sp
->len
++] = x
;
237 if (skb_is_gso(skb
)) {
238 skb_shinfo(skb
)->gso_type
|= SKB_GSO_ESP
;
240 return xfrm_output2(net
, sk
, skb
);
243 if (x
->xso
.dev
&& x
->xso
.dev
->features
& NETIF_F_HW_ESP_TX_CSUM
)
248 return xfrm_output_gso(net
, sk
, skb
);
250 if (skb
->ip_summed
== CHECKSUM_PARTIAL
) {
251 err
= skb_checksum_help(skb
);
253 XFRM_INC_STATS(net
, LINUX_MIB_XFRMOUTERROR
);
260 return xfrm_output2(net
, sk
, skb
);
262 EXPORT_SYMBOL_GPL(xfrm_output
);
264 int xfrm_inner_extract_output(struct xfrm_state
*x
, struct sk_buff
*skb
)
266 struct xfrm_mode
*inner_mode
;
267 if (x
->sel
.family
== AF_UNSPEC
)
268 inner_mode
= xfrm_ip2inner_mode(x
,
269 xfrm_af2proto(skb_dst(skb
)->ops
->family
));
271 inner_mode
= x
->inner_mode
;
273 if (inner_mode
== NULL
)
274 return -EAFNOSUPPORT
;
275 return inner_mode
->afinfo
->extract_output(x
, skb
);
277 EXPORT_SYMBOL_GPL(xfrm_inner_extract_output
);
279 void xfrm_local_error(struct sk_buff
*skb
, int mtu
)
282 struct xfrm_state_afinfo
*afinfo
;
284 if (skb
->protocol
== htons(ETH_P_IP
))
286 else if (skb
->protocol
== htons(ETH_P_IPV6
))
291 afinfo
= xfrm_state_get_afinfo(proto
);
293 afinfo
->local_error(skb
, mtu
);
297 EXPORT_SYMBOL_GPL(xfrm_local_error
);