Commit | Line | Data |
---|---|---|
406ef77c HX |
1 | /* |
2 | * xfrm_output.c - Common IPsec encapsulation code. | |
3 | * | |
4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> | |
5 | * | |
6 | * This program is free software; you can redistribute it and/or | |
7 | * modify it under the terms of the GNU General Public License | |
8 | * as published by the Free Software Foundation; either version | |
9 | * 2 of the License, or (at your option) any later version. | |
10 | */ | |
11 | ||
12 | #include <linux/errno.h> | |
13 | #include <linux/module.h> | |
14 | #include <linux/netdevice.h> | |
862b82c6 | 15 | #include <linux/netfilter.h> |
406ef77c | 16 | #include <linux/skbuff.h> |
5a0e3ad6 | 17 | #include <linux/slab.h> |
406ef77c | 18 | #include <linux/spinlock.h> |
406ef77c HX |
19 | #include <net/dst.h> |
20 | #include <net/xfrm.h> | |
21 | ||
c6581a45 HX |
22 | static int xfrm_output2(struct sk_buff *skb); |
23 | ||
83815dea HX |
24 | static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb) |
25 | { | |
adf30907 | 26 | struct dst_entry *dst = skb_dst(skb); |
550ade84 | 27 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) |
83815dea | 28 | - skb_headroom(skb); |
f5184d26 | 29 | int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); |
83815dea | 30 | |
d01dbeb6 HX |
31 | if (nhead <= 0) { |
32 | if (ntail <= 0) | |
33 | return 0; | |
34 | nhead = 0; | |
35 | } else if (ntail < 0) | |
36 | ntail = 0; | |
37 | ||
38 | return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); | |
83815dea HX |
39 | } |
40 | ||
c6581a45 | 41 | static int xfrm_output_one(struct sk_buff *skb, int err) |
406ef77c | 42 | { |
adf30907 | 43 | struct dst_entry *dst = skb_dst(skb); |
406ef77c | 44 | struct xfrm_state *x = dst->xfrm; |
a6483b79 | 45 | struct net *net = xs_net(x); |
406ef77c | 46 | |
c6581a45 HX |
47 | if (err <= 0) |
48 | goto resume; | |
406ef77c HX |
49 | |
50 | do { | |
910ef70a | 51 | err = xfrm_state_check_space(x, skb); |
b15c4bcd | 52 | if (err) { |
59c9940e | 53 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
910ef70a | 54 | goto error_nolock; |
b15c4bcd | 55 | } |
910ef70a | 56 | |
a2deb6d2 | 57 | err = x->outer_mode->output(x, skb); |
b15c4bcd | 58 | if (err) { |
59c9940e | 59 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR); |
910ef70a | 60 | goto error_nolock; |
b15c4bcd | 61 | } |
a2deb6d2 | 62 | |
406ef77c | 63 | spin_lock_bh(&x->lock); |
910ef70a | 64 | err = xfrm_state_check_expire(x); |
b15c4bcd | 65 | if (err) { |
59c9940e | 66 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); |
406ef77c | 67 | goto error; |
b15c4bcd | 68 | } |
406ef77c | 69 | |
9fdc4883 SK |
70 | err = x->repl->overflow(x, skb); |
71 | if (err) { | |
72 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); | |
73 | goto error; | |
436a0a40 HX |
74 | } |
75 | ||
406ef77c HX |
76 | x->curlft.bytes += skb->len; |
77 | x->curlft.packets++; | |
78 | ||
406ef77c HX |
79 | spin_unlock_bh(&x->lock); |
80 | ||
b7c6538c | 81 | err = x->type->output(x, skb); |
fcb8c156 HX |
82 | if (err == -EINPROGRESS) |
83 | goto out_exit; | |
c6581a45 HX |
84 | |
85 | resume: | |
0aa64774 | 86 | if (err) { |
59c9940e | 87 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR); |
b7c6538c | 88 | goto error_nolock; |
0aa64774 | 89 | } |
b7c6538c | 90 | |
8764ab2c | 91 | dst = skb_dst_pop(skb); |
adf30907 | 92 | if (!dst) { |
59c9940e | 93 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
406ef77c HX |
94 | err = -EHOSTUNREACH; |
95 | goto error_nolock; | |
96 | } | |
e71895a1 | 97 | skb_dst_set(skb, dst_clone(dst)); |
406ef77c | 98 | x = dst->xfrm; |
13996378 | 99 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
406ef77c HX |
100 | |
101 | err = 0; | |
102 | ||
862b82c6 | 103 | out_exit: |
406ef77c HX |
104 | return err; |
105 | error: | |
106 | spin_unlock_bh(&x->lock); | |
862b82c6 HX |
107 | error_nolock: |
108 | kfree_skb(skb); | |
109 | goto out_exit; | |
110 | } | |
111 | ||
c6581a45 | 112 | int xfrm_output_resume(struct sk_buff *skb, int err) |
862b82c6 | 113 | { |
c6581a45 | 114 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
862b82c6 HX |
115 | nf_reset(skb); |
116 | ||
adf30907 | 117 | err = skb_dst(skb)->ops->local_out(skb); |
862b82c6 | 118 | if (unlikely(err != 1)) |
c6581a45 | 119 | goto out; |
862b82c6 | 120 | |
adf30907 | 121 | if (!skb_dst(skb)->xfrm) |
862b82c6 HX |
122 | return dst_output(skb); |
123 | ||
adf30907 | 124 | err = nf_hook(skb_dst(skb)->ops->family, |
294b4baf | 125 | NF_INET_POST_ROUTING, skb, |
adf30907 | 126 | NULL, skb_dst(skb)->dev, xfrm_output2); |
862b82c6 | 127 | if (unlikely(err != 1)) |
c6581a45 | 128 | goto out; |
862b82c6 HX |
129 | } |
130 | ||
c6581a45 HX |
131 | if (err == -EINPROGRESS) |
132 | err = 0; | |
133 | ||
134 | out: | |
862b82c6 HX |
135 | return err; |
136 | } | |
c6581a45 | 137 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
862b82c6 | 138 | |
c6581a45 | 139 | static int xfrm_output2(struct sk_buff *skb) |
862b82c6 | 140 | { |
c6581a45 HX |
141 | return xfrm_output_resume(skb, 1); |
142 | } | |
862b82c6 | 143 | |
c6581a45 HX |
144 | static int xfrm_output_gso(struct sk_buff *skb) |
145 | { | |
146 | struct sk_buff *segs; | |
862b82c6 HX |
147 | |
148 | segs = skb_gso_segment(skb, 0); | |
149 | kfree_skb(skb); | |
801678c5 | 150 | if (IS_ERR(segs)) |
862b82c6 HX |
151 | return PTR_ERR(segs); |
152 | ||
153 | do { | |
154 | struct sk_buff *nskb = segs->next; | |
155 | int err; | |
156 | ||
157 | segs->next = NULL; | |
158 | err = xfrm_output2(segs); | |
159 | ||
160 | if (unlikely(err)) { | |
161 | while ((segs = nskb)) { | |
162 | nskb = segs->next; | |
163 | segs->next = NULL; | |
164 | kfree_skb(segs); | |
165 | } | |
166 | return err; | |
167 | } | |
168 | ||
169 | segs = nskb; | |
170 | } while (segs); | |
171 | ||
172 | return 0; | |
406ef77c | 173 | } |
c6581a45 HX |
174 | |
175 | int xfrm_output(struct sk_buff *skb) | |
176 | { | |
adf30907 | 177 | struct net *net = dev_net(skb_dst(skb)->dev); |
c6581a45 HX |
178 | int err; |
179 | ||
180 | if (skb_is_gso(skb)) | |
181 | return xfrm_output_gso(skb); | |
182 | ||
183 | if (skb->ip_summed == CHECKSUM_PARTIAL) { | |
184 | err = skb_checksum_help(skb); | |
185 | if (err) { | |
59c9940e | 186 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
c6581a45 HX |
187 | kfree_skb(skb); |
188 | return err; | |
189 | } | |
190 | } | |
191 | ||
192 | return xfrm_output2(skb); | |
193 | } | |
df9dcb45 KM |
194 | |
195 | int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) | |
196 | { | |
197 | struct xfrm_mode *inner_mode; | |
198 | if (x->sel.family == AF_UNSPEC) | |
199 | inner_mode = xfrm_ip2inner_mode(x, | |
adf30907 | 200 | xfrm_af2proto(skb_dst(skb)->ops->family)); |
df9dcb45 KM |
201 | else |
202 | inner_mode = x->inner_mode; | |
203 | ||
204 | if (inner_mode == NULL) | |
205 | return -EAFNOSUPPORT; | |
206 | return inner_mode->afinfo->extract_output(x, skb); | |
207 | } | |
208 | ||
406ef77c | 209 | EXPORT_SYMBOL_GPL(xfrm_output); |
df9dcb45 | 210 | EXPORT_SYMBOL_GPL(xfrm_inner_extract_output); |