Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm_output.c - Common IPsec encapsulation code. |
| 3 | * |
| 4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | */ |
| 11 | |
| 12 | #include <linux/errno.h> |
| 13 | #include <linux/module.h> |
| 14 | #include <linux/netdevice.h> |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame^] | 15 | #include <linux/netfilter.h> |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 16 | #include <linux/skbuff.h> |
| 17 | #include <linux/spinlock.h> |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 18 | #include <net/dst.h> |
| 19 | #include <net/xfrm.h> |
| 20 | |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 21 | static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb) |
| 22 | { |
Herbert Xu | 550ade8 | 2007-11-13 21:33:01 -0800 | [diff] [blame] | 23 | struct dst_entry *dst = skb->dst; |
| 24 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 25 | - skb_headroom(skb); |
| 26 | |
| 27 | if (nhead > 0) |
| 28 | return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC); |
| 29 | |
| 30 | /* Check tail too... */ |
| 31 | return 0; |
| 32 | } |
| 33 | |
| 34 | static int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb) |
| 35 | { |
| 36 | int err = xfrm_state_check_expire(x); |
| 37 | if (err < 0) |
| 38 | goto err; |
| 39 | err = xfrm_state_check_space(x, skb); |
| 40 | err: |
| 41 | return err; |
| 42 | } |
| 43 | |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame^] | 44 | static int xfrm_output_one(struct sk_buff *skb) |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 45 | { |
| 46 | struct dst_entry *dst = skb->dst; |
| 47 | struct xfrm_state *x = dst->xfrm; |
| 48 | int err; |
| 49 | |
| 50 | if (skb->ip_summed == CHECKSUM_PARTIAL) { |
| 51 | err = skb_checksum_help(skb); |
| 52 | if (err) |
| 53 | goto error_nolock; |
| 54 | } |
| 55 | |
| 56 | do { |
Herbert Xu | a2deb6d | 2007-11-13 21:39:38 -0800 | [diff] [blame] | 57 | err = x->outer_mode->output(x, skb); |
| 58 | if (err) |
| 59 | goto error; |
| 60 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 61 | spin_lock_bh(&x->lock); |
| 62 | err = xfrm_state_check(x, skb); |
| 63 | if (err) |
| 64 | goto error; |
| 65 | |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 66 | if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { |
| 67 | XFRM_SKB_CB(skb)->seq = ++x->replay.oseq; |
Herbert Xu | cdf7e66 | 2007-10-08 17:26:34 -0700 | [diff] [blame] | 68 | if (xfrm_aevent_is_on()) |
| 69 | xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 70 | } |
| 71 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 72 | x->curlft.bytes += skb->len; |
| 73 | x->curlft.packets++; |
| 74 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 75 | spin_unlock_bh(&x->lock); |
| 76 | |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 77 | err = x->type->output(x, skb); |
| 78 | if (err) |
| 79 | goto error_nolock; |
| 80 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 81 | if (!(skb->dst = dst_pop(dst))) { |
| 82 | err = -EHOSTUNREACH; |
| 83 | goto error_nolock; |
| 84 | } |
| 85 | dst = skb->dst; |
| 86 | x = dst->xfrm; |
Herbert Xu | 1399637 | 2007-10-17 21:35:51 -0700 | [diff] [blame] | 87 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 88 | |
| 89 | err = 0; |
| 90 | |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame^] | 91 | out_exit: |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 92 | return err; |
| 93 | error: |
| 94 | spin_unlock_bh(&x->lock); |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame^] | 95 | error_nolock: |
| 96 | kfree_skb(skb); |
| 97 | goto out_exit; |
| 98 | } |
| 99 | |
| 100 | static int xfrm_output2(struct sk_buff *skb) |
| 101 | { |
| 102 | int err; |
| 103 | |
| 104 | while (likely((err = xfrm_output_one(skb)) == 0)) { |
| 105 | struct xfrm_state *x; |
| 106 | |
| 107 | nf_reset(skb); |
| 108 | |
| 109 | err = skb->dst->ops->local_out(skb); |
| 110 | if (unlikely(err != 1)) |
| 111 | break; |
| 112 | |
| 113 | x = skb->dst->xfrm; |
| 114 | if (!x) |
| 115 | return dst_output(skb); |
| 116 | |
| 117 | err = nf_hook(x->inner_mode->afinfo->family, |
| 118 | x->inner_mode->afinfo->nf_post_routing, skb, |
| 119 | NULL, skb->dst->dev, xfrm_output2); |
| 120 | if (unlikely(err != 1)) |
| 121 | break; |
| 122 | } |
| 123 | |
| 124 | return err; |
| 125 | } |
| 126 | |
| 127 | int xfrm_output(struct sk_buff *skb) |
| 128 | { |
| 129 | struct sk_buff *segs; |
| 130 | |
| 131 | if (!skb_is_gso(skb)) |
| 132 | return xfrm_output2(skb); |
| 133 | |
| 134 | segs = skb_gso_segment(skb, 0); |
| 135 | kfree_skb(skb); |
| 136 | if (unlikely(IS_ERR(segs))) |
| 137 | return PTR_ERR(segs); |
| 138 | |
| 139 | do { |
| 140 | struct sk_buff *nskb = segs->next; |
| 141 | int err; |
| 142 | |
| 143 | segs->next = NULL; |
| 144 | err = xfrm_output2(segs); |
| 145 | |
| 146 | if (unlikely(err)) { |
| 147 | while ((segs = nskb)) { |
| 148 | nskb = segs->next; |
| 149 | segs->next = NULL; |
| 150 | kfree_skb(segs); |
| 151 | } |
| 152 | return err; |
| 153 | } |
| 154 | |
| 155 | segs = nskb; |
| 156 | } while (segs); |
| 157 | |
| 158 | return 0; |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 159 | } |
| 160 | EXPORT_SYMBOL_GPL(xfrm_output); |