Commit | Line | Data |
---|---|---|
406ef77c HX |
1 | /* |
2 | * xfrm_output.c - Common IPsec encapsulation code. | |
3 | * | |
4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public License | |
8 | * as published by the Free Software Foundation; either version | |
9 | * 2 of the License, or (at your option) any later version. | |
10 | */ | |
11 | ||
12 | #include <linux/errno.h> | |
13 | #include <linux/module.h> | |
14 | #include <linux/netdevice.h> | |
862b82c6 | 15 | #include <linux/netfilter.h> |
406ef77c HX |
16 | #include <linux/skbuff.h> |
17 | #include <linux/spinlock.h> | |
406ef77c HX |
18 | #include <net/dst.h> |
19 | #include <net/xfrm.h> | |
20 | ||
c6581a45 HX |
21 | static int xfrm_output2(struct sk_buff *skb); |
22 | ||
83815dea HX |
23 | static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb) |
24 | { | |
550ade84 HX |
25 | struct dst_entry *dst = skb->dst; |
26 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) | |
83815dea | 27 | - skb_headroom(skb); |
f5184d26 | 28 | int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); |
83815dea | 29 | |
d01dbeb6 HX |
30 | if (nhead <= 0) { |
31 | if (ntail <= 0) | |
32 | return 0; | |
33 | nhead = 0; | |
34 | } else if (ntail < 0) | |
35 | ntail = 0; | |
36 | ||
37 | return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); | |
83815dea HX |
38 | } |
39 | ||
c6581a45 | 40 | static int xfrm_output_one(struct sk_buff *skb, int err) |
406ef77c HX |
41 | { |
42 | struct dst_entry *dst = skb->dst; | |
43 | struct xfrm_state *x = dst->xfrm; | |
406ef77c | 44 | |
c6581a45 HX |
45 | if (err <= 0) |
46 | goto resume; | |
406ef77c HX |
47 | |
48 | do { | |
910ef70a | 49 | err = xfrm_state_check_space(x, skb); |
b15c4bcd MN |
50 | if (err) { |
51 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); | |
910ef70a | 52 | goto error_nolock; |
b15c4bcd | 53 | } |
910ef70a | 54 | |
a2deb6d2 | 55 | err = x->outer_mode->output(x, skb); |
b15c4bcd MN |
56 | if (err) { |
57 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEMODEERROR); | |
910ef70a | 58 | goto error_nolock; |
b15c4bcd | 59 | } |
a2deb6d2 | 60 | |
406ef77c | 61 | spin_lock_bh(&x->lock); |
910ef70a | 62 | err = xfrm_state_check_expire(x); |
b15c4bcd MN |
63 | if (err) { |
64 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEEXPIRED); | |
406ef77c | 65 | goto error; |
b15c4bcd | 66 | } |
406ef77c | 67 | |
436a0a40 | 68 | if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { |
b318e0e4 | 69 | XFRM_SKB_CB(skb)->seq.output = ++x->replay.oseq; |
e1af9f27 | 70 | if (unlikely(x->replay.oseq == 0)) { |
9472c9ef | 71 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATESEQERROR); |
e1af9f27 | 72 | x->replay.oseq--; |
afeb14b4 | 73 | xfrm_audit_state_replay_overflow(x, skb); |
dbb1db8b | 74 | err = -EOVERFLOW; |
e1af9f27 PM |
75 | goto error; |
76 | } | |
cdf7e668 HX |
77 | if (xfrm_aevent_is_on()) |
78 | xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); | |
436a0a40 HX |
79 | } |
80 | ||
406ef77c HX |
81 | x->curlft.bytes += skb->len; |
82 | x->curlft.packets++; | |
83 | ||
406ef77c HX |
84 | spin_unlock_bh(&x->lock); |
85 | ||
b7c6538c | 86 | err = x->type->output(x, skb); |
fcb8c156 HX |
87 | if (err == -EINPROGRESS) |
88 | goto out_exit; | |
c6581a45 HX |
89 | |
90 | resume: | |
0aa64774 MN |
91 | if (err) { |
92 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEPROTOERROR); | |
b7c6538c | 93 | goto error_nolock; |
0aa64774 | 94 | } |
b7c6538c | 95 | |
406ef77c | 96 | if (!(skb->dst = dst_pop(dst))) { |
0aa64774 | 97 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); |
406ef77c HX |
98 | err = -EHOSTUNREACH; |
99 | goto error_nolock; | |
100 | } | |
101 | dst = skb->dst; | |
102 | x = dst->xfrm; | |
13996378 | 103 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
406ef77c HX |
104 | |
105 | err = 0; | |
106 | ||
862b82c6 | 107 | out_exit: |
406ef77c HX |
108 | return err; |
109 | error: | |
110 | spin_unlock_bh(&x->lock); | |
862b82c6 HX |
111 | error_nolock: |
112 | kfree_skb(skb); | |
113 | goto out_exit; | |
114 | } | |
115 | ||
c6581a45 | 116 | int xfrm_output_resume(struct sk_buff *skb, int err) |
862b82c6 | 117 | { |
c6581a45 | 118 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
862b82c6 HX |
119 | nf_reset(skb); |
120 | ||
121 | err = skb->dst->ops->local_out(skb); | |
122 | if (unlikely(err != 1)) | |
c6581a45 | 123 | goto out; |
862b82c6 | 124 | |
c1e24df2 | 125 | if (!skb->dst->xfrm) |
862b82c6 HX |
126 | return dst_output(skb); |
127 | ||
df9dcb45 | 128 | err = nf_hook(skb->dst->ops->family, |
294b4baf | 129 | NF_INET_POST_ROUTING, skb, |
862b82c6 HX |
130 | NULL, skb->dst->dev, xfrm_output2); |
131 | if (unlikely(err != 1)) | |
c6581a45 | 132 | goto out; |
862b82c6 HX |
133 | } |
134 | ||
c6581a45 HX |
135 | if (err == -EINPROGRESS) |
136 | err = 0; | |
137 | ||
138 | out: | |
862b82c6 HX |
139 | return err; |
140 | } | |
c6581a45 | 141 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
862b82c6 | 142 | |
c6581a45 | 143 | static int xfrm_output2(struct sk_buff *skb) |
862b82c6 | 144 | { |
c6581a45 HX |
145 | return xfrm_output_resume(skb, 1); |
146 | } | |
862b82c6 | 147 | |
c6581a45 HX |
148 | static int xfrm_output_gso(struct sk_buff *skb) |
149 | { | |
150 | struct sk_buff *segs; | |
862b82c6 HX |
151 | |
152 | segs = skb_gso_segment(skb, 0); | |
153 | kfree_skb(skb); | |
801678c5 | 154 | if (IS_ERR(segs)) |
862b82c6 HX |
155 | return PTR_ERR(segs); |
156 | ||
157 | do { | |
158 | struct sk_buff *nskb = segs->next; | |
159 | int err; | |
160 | ||
161 | segs->next = NULL; | |
162 | err = xfrm_output2(segs); | |
163 | ||
164 | if (unlikely(err)) { | |
165 | while ((segs = nskb)) { | |
166 | nskb = segs->next; | |
167 | segs->next = NULL; | |
168 | kfree_skb(segs); | |
169 | } | |
170 | return err; | |
171 | } | |
172 | ||
173 | segs = nskb; | |
174 | } while (segs); | |
175 | ||
176 | return 0; | |
406ef77c | 177 | } |
c6581a45 HX |
178 | |
179 | int xfrm_output(struct sk_buff *skb) | |
180 | { | |
181 | int err; | |
182 | ||
183 | if (skb_is_gso(skb)) | |
184 | return xfrm_output_gso(skb); | |
185 | ||
186 | if (skb->ip_summed == CHECKSUM_PARTIAL) { | |
187 | err = skb_checksum_help(skb); | |
188 | if (err) { | |
0aa64774 | 189 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); |
c6581a45 HX |
190 | kfree_skb(skb); |
191 | return err; | |
192 | } | |
193 | } | |
194 | ||
195 | return xfrm_output2(skb); | |
196 | } | |
df9dcb45 KM |
197 | |
198 | int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) | |
199 | { | |
200 | struct xfrm_mode *inner_mode; | |
201 | if (x->sel.family == AF_UNSPEC) | |
202 | inner_mode = xfrm_ip2inner_mode(x, | |
203 | xfrm_af2proto(skb->dst->ops->family)); | |
204 | else | |
205 | inner_mode = x->inner_mode; | |
206 | ||
207 | if (inner_mode == NULL) | |
208 | return -EAFNOSUPPORT; | |
209 | return inner_mode->afinfo->extract_output(x, skb); | |
210 | } | |
211 | ||
406ef77c | 212 | EXPORT_SYMBOL_GPL(xfrm_output); |
df9dcb45 | 213 | EXPORT_SYMBOL_GPL(xfrm_inner_extract_output); |