Commit | Line | Data |
---|---|---|
406ef77c HX |
1 | /* |
2 | * xfrm_output.c - Common IPsec encapsulation code. | |
3 | * | |
4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public License | |
8 | * as published by the Free Software Foundation; either version | |
9 | * 2 of the License, or (at your option) any later version. | |
10 | */ | |
11 | ||
12 | #include <linux/errno.h> | |
13 | #include <linux/module.h> | |
14 | #include <linux/netdevice.h> | |
862b82c6 | 15 | #include <linux/netfilter.h> |
406ef77c HX |
16 | #include <linux/skbuff.h> |
17 | #include <linux/spinlock.h> | |
406ef77c HX |
18 | #include <net/dst.h> |
19 | #include <net/xfrm.h> | |
20 | ||
c6581a45 HX |
21 | static int xfrm_output2(struct sk_buff *skb); |
22 | ||
83815dea HX |
23 | static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb) |
24 | { | |
550ade84 HX |
25 | struct dst_entry *dst = skb->dst; |
26 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) | |
83815dea HX |
27 | - skb_headroom(skb); |
28 | ||
29 | if (nhead > 0) | |
30 | return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC); | |
31 | ||
32 | /* Check tail too... */ | |
33 | return 0; | |
34 | } | |
35 | ||
c6581a45 | 36 | static int xfrm_output_one(struct sk_buff *skb, int err) |
406ef77c HX |
37 | { |
38 | struct dst_entry *dst = skb->dst; | |
39 | struct xfrm_state *x = dst->xfrm; | |
406ef77c | 40 | |
c6581a45 HX |
41 | if (err <= 0) |
42 | goto resume; | |
406ef77c HX |
43 | |
44 | do { | |
910ef70a HX |
45 | err = xfrm_state_check_space(x, skb); |
46 | if (err) | |
47 | goto error_nolock; | |
48 | ||
a2deb6d2 HX |
49 | err = x->outer_mode->output(x, skb); |
50 | if (err) | |
910ef70a | 51 | goto error_nolock; |
a2deb6d2 | 52 | |
406ef77c | 53 | spin_lock_bh(&x->lock); |
910ef70a | 54 | err = xfrm_state_check_expire(x); |
406ef77c HX |
55 | if (err) |
56 | goto error; | |
57 | ||
436a0a40 HX |
58 | if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { |
59 | XFRM_SKB_CB(skb)->seq = ++x->replay.oseq; | |
cdf7e668 HX |
60 | if (xfrm_aevent_is_on()) |
61 | xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); | |
436a0a40 HX |
62 | } |
63 | ||
406ef77c HX |
64 | x->curlft.bytes += skb->len; |
65 | x->curlft.packets++; | |
66 | ||
406ef77c HX |
67 | spin_unlock_bh(&x->lock); |
68 | ||
b7c6538c | 69 | err = x->type->output(x, skb); |
c6581a45 HX |
70 | |
71 | resume: | |
0aa64774 MN |
72 | if (err) { |
73 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEPROTOERROR); | |
b7c6538c | 74 | goto error_nolock; |
0aa64774 | 75 | } |
b7c6538c | 76 | |
406ef77c | 77 | if (!(skb->dst = dst_pop(dst))) { |
0aa64774 | 78 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); |
406ef77c HX |
79 | err = -EHOSTUNREACH; |
80 | goto error_nolock; | |
81 | } | |
82 | dst = skb->dst; | |
83 | x = dst->xfrm; | |
13996378 | 84 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
406ef77c HX |
85 | |
86 | err = 0; | |
87 | ||
862b82c6 | 88 | out_exit: |
406ef77c HX |
89 | return err; |
90 | error: | |
91 | spin_unlock_bh(&x->lock); | |
862b82c6 HX |
92 | error_nolock: |
93 | kfree_skb(skb); | |
94 | goto out_exit; | |
95 | } | |
96 | ||
c6581a45 | 97 | int xfrm_output_resume(struct sk_buff *skb, int err) |
862b82c6 | 98 | { |
c6581a45 | 99 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
862b82c6 HX |
100 | struct xfrm_state *x; |
101 | ||
102 | nf_reset(skb); | |
103 | ||
104 | err = skb->dst->ops->local_out(skb); | |
105 | if (unlikely(err != 1)) | |
c6581a45 | 106 | goto out; |
862b82c6 HX |
107 | |
108 | x = skb->dst->xfrm; | |
109 | if (!x) | |
110 | return dst_output(skb); | |
111 | ||
112 | err = nf_hook(x->inner_mode->afinfo->family, | |
294b4baf | 113 | NF_INET_POST_ROUTING, skb, |
862b82c6 HX |
114 | NULL, skb->dst->dev, xfrm_output2); |
115 | if (unlikely(err != 1)) | |
c6581a45 | 116 | goto out; |
862b82c6 HX |
117 | } |
118 | ||
c6581a45 HX |
119 | if (err == -EINPROGRESS) |
120 | err = 0; | |
121 | ||
122 | out: | |
862b82c6 HX |
123 | return err; |
124 | } | |
c6581a45 | 125 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
862b82c6 | 126 | |
c6581a45 | 127 | static int xfrm_output2(struct sk_buff *skb) |
862b82c6 | 128 | { |
c6581a45 HX |
129 | return xfrm_output_resume(skb, 1); |
130 | } | |
862b82c6 | 131 | |
c6581a45 HX |
132 | static int xfrm_output_gso(struct sk_buff *skb) |
133 | { | |
134 | struct sk_buff *segs; | |
862b82c6 HX |
135 | |
136 | segs = skb_gso_segment(skb, 0); | |
137 | kfree_skb(skb); | |
138 | if (unlikely(IS_ERR(segs))) | |
139 | return PTR_ERR(segs); | |
140 | ||
141 | do { | |
142 | struct sk_buff *nskb = segs->next; | |
143 | int err; | |
144 | ||
145 | segs->next = NULL; | |
146 | err = xfrm_output2(segs); | |
147 | ||
148 | if (unlikely(err)) { | |
149 | while ((segs = nskb)) { | |
150 | nskb = segs->next; | |
151 | segs->next = NULL; | |
152 | kfree_skb(segs); | |
153 | } | |
154 | return err; | |
155 | } | |
156 | ||
157 | segs = nskb; | |
158 | } while (segs); | |
159 | ||
160 | return 0; | |
406ef77c | 161 | } |
c6581a45 HX |
162 | |
163 | int xfrm_output(struct sk_buff *skb) | |
164 | { | |
165 | int err; | |
166 | ||
167 | if (skb_is_gso(skb)) | |
168 | return xfrm_output_gso(skb); | |
169 | ||
170 | if (skb->ip_summed == CHECKSUM_PARTIAL) { | |
171 | err = skb_checksum_help(skb); | |
172 | if (err) { | |
0aa64774 | 173 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); |
c6581a45 HX |
174 | kfree_skb(skb); |
175 | return err; | |
176 | } | |
177 | } | |
178 | ||
179 | return xfrm_output2(skb); | |
180 | } | |
406ef77c | 181 | EXPORT_SYMBOL_GPL(xfrm_output); |