Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm_output.c - Common IPsec encapsulation code. |
| 3 | * |
| 4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | */ |
| 11 | |
| 12 | #include <linux/errno.h> |
| 13 | #include <linux/module.h> |
| 14 | #include <linux/netdevice.h> |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 15 | #include <linux/netfilter.h> |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 16 | #include <linux/skbuff.h> |
| 17 | #include <linux/spinlock.h> |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 18 | #include <net/dst.h> |
| 19 | #include <net/xfrm.h> |
| 20 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 21 | static int xfrm_output2(struct sk_buff *skb); |
| 22 | |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 23 | static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb) |
| 24 | { |
Herbert Xu | 550ade8 | 2007-11-13 21:33:01 -0800 | [diff] [blame] | 25 | struct dst_entry *dst = skb->dst; |
| 26 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 27 | - skb_headroom(skb); |
Johannes Berg | f5184d2 | 2008-05-12 20:48:31 -0700 | [diff] [blame] | 28 | int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 29 | |
Johannes Berg | f5184d2 | 2008-05-12 20:48:31 -0700 | [diff] [blame] | 30 | if (nhead > 0 || ntail > 0) |
| 31 | return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 32 | |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 33 | return 0; |
| 34 | } |
| 35 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 36 | static int xfrm_output_one(struct sk_buff *skb, int err) |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 37 | { |
| 38 | struct dst_entry *dst = skb->dst; |
| 39 | struct xfrm_state *x = dst->xfrm; |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 40 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 41 | if (err <= 0) |
| 42 | goto resume; |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 43 | |
| 44 | do { |
Herbert Xu | 910ef70 | 2007-12-18 22:14:25 -0800 | [diff] [blame] | 45 | err = xfrm_state_check_space(x, skb); |
Masahide NAKAMURA | b15c4bc | 2007-12-24 16:00:09 -0800 | [diff] [blame] | 46 | if (err) { |
| 47 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); |
Herbert Xu | 910ef70 | 2007-12-18 22:14:25 -0800 | [diff] [blame] | 48 | goto error_nolock; |
Masahide NAKAMURA | b15c4bc | 2007-12-24 16:00:09 -0800 | [diff] [blame] | 49 | } |
Herbert Xu | 910ef70 | 2007-12-18 22:14:25 -0800 | [diff] [blame] | 50 | |
Herbert Xu | a2deb6d | 2007-11-13 21:39:38 -0800 | [diff] [blame] | 51 | err = x->outer_mode->output(x, skb); |
Masahide NAKAMURA | b15c4bc | 2007-12-24 16:00:09 -0800 | [diff] [blame] | 52 | if (err) { |
| 53 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEMODEERROR); |
Herbert Xu | 910ef70 | 2007-12-18 22:14:25 -0800 | [diff] [blame] | 54 | goto error_nolock; |
Masahide NAKAMURA | b15c4bc | 2007-12-24 16:00:09 -0800 | [diff] [blame] | 55 | } |
Herbert Xu | a2deb6d | 2007-11-13 21:39:38 -0800 | [diff] [blame] | 56 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 57 | spin_lock_bh(&x->lock); |
Herbert Xu | 910ef70 | 2007-12-18 22:14:25 -0800 | [diff] [blame] | 58 | err = xfrm_state_check_expire(x); |
Masahide NAKAMURA | b15c4bc | 2007-12-24 16:00:09 -0800 | [diff] [blame] | 59 | if (err) { |
| 60 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEEXPIRED); |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 61 | goto error; |
Masahide NAKAMURA | b15c4bc | 2007-12-24 16:00:09 -0800 | [diff] [blame] | 62 | } |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 63 | |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 64 | if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { |
Herbert Xu | b318e0e | 2008-02-12 22:50:35 -0800 | [diff] [blame] | 65 | XFRM_SKB_CB(skb)->seq.output = ++x->replay.oseq; |
Paul Moore | e1af9f2 | 2007-12-21 14:59:08 -0800 | [diff] [blame] | 66 | if (unlikely(x->replay.oseq == 0)) { |
Masahide NAKAMURA | 9472c9e | 2008-01-31 17:14:58 -0800 | [diff] [blame] | 67 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATESEQERROR); |
Paul Moore | e1af9f2 | 2007-12-21 14:59:08 -0800 | [diff] [blame] | 68 | x->replay.oseq--; |
Paul Moore | afeb14b | 2007-12-21 14:58:11 -0800 | [diff] [blame] | 69 | xfrm_audit_state_replay_overflow(x, skb); |
Herbert Xu | dbb1db8 | 2008-01-01 23:52:59 -0800 | [diff] [blame] | 70 | err = -EOVERFLOW; |
Paul Moore | e1af9f2 | 2007-12-21 14:59:08 -0800 | [diff] [blame] | 71 | goto error; |
| 72 | } |
Herbert Xu | cdf7e66 | 2007-10-08 17:26:34 -0700 | [diff] [blame] | 73 | if (xfrm_aevent_is_on()) |
| 74 | xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 75 | } |
| 76 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 77 | x->curlft.bytes += skb->len; |
| 78 | x->curlft.packets++; |
| 79 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 80 | spin_unlock_bh(&x->lock); |
| 81 | |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 82 | err = x->type->output(x, skb); |
Herbert Xu | fcb8c15 | 2007-12-30 21:09:38 -0800 | [diff] [blame] | 83 | if (err == -EINPROGRESS) |
| 84 | goto out_exit; |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 85 | |
| 86 | resume: |
Masahide NAKAMURA | 0aa6477 | 2007-12-20 20:43:36 -0800 | [diff] [blame] | 87 | if (err) { |
| 88 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTSTATEPROTOERROR); |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 89 | goto error_nolock; |
Masahide NAKAMURA | 0aa6477 | 2007-12-20 20:43:36 -0800 | [diff] [blame] | 90 | } |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 91 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 92 | if (!(skb->dst = dst_pop(dst))) { |
Masahide NAKAMURA | 0aa6477 | 2007-12-20 20:43:36 -0800 | [diff] [blame] | 93 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 94 | err = -EHOSTUNREACH; |
| 95 | goto error_nolock; |
| 96 | } |
| 97 | dst = skb->dst; |
| 98 | x = dst->xfrm; |
Herbert Xu | 1399637 | 2007-10-17 21:35:51 -0700 | [diff] [blame] | 99 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 100 | |
| 101 | err = 0; |
| 102 | |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 103 | out_exit: |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 104 | return err; |
| 105 | error: |
| 106 | spin_unlock_bh(&x->lock); |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 107 | error_nolock: |
| 108 | kfree_skb(skb); |
| 109 | goto out_exit; |
| 110 | } |
| 111 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 112 | int xfrm_output_resume(struct sk_buff *skb, int err) |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 113 | { |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 114 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 115 | struct xfrm_state *x; |
| 116 | |
| 117 | nf_reset(skb); |
| 118 | |
| 119 | err = skb->dst->ops->local_out(skb); |
| 120 | if (unlikely(err != 1)) |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 121 | goto out; |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 122 | |
| 123 | x = skb->dst->xfrm; |
| 124 | if (!x) |
| 125 | return dst_output(skb); |
| 126 | |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 127 | err = nf_hook(skb->dst->ops->family, |
David S. Miller | 294b4ba | 2007-11-14 01:57:47 -0800 | [diff] [blame] | 128 | NF_INET_POST_ROUTING, skb, |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 129 | NULL, skb->dst->dev, xfrm_output2); |
| 130 | if (unlikely(err != 1)) |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 131 | goto out; |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 132 | } |
| 133 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 134 | if (err == -EINPROGRESS) |
| 135 | err = 0; |
| 136 | |
| 137 | out: |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 138 | return err; |
| 139 | } |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 140 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 141 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 142 | static int xfrm_output2(struct sk_buff *skb) |
| 143 | { |
| 144 | return xfrm_output_resume(skb, 1); |
| 145 | } |
| 146 | |
| 147 | static int xfrm_output_gso(struct sk_buff *skb) |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 148 | { |
| 149 | struct sk_buff *segs; |
| 150 | |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 151 | segs = skb_gso_segment(skb, 0); |
| 152 | kfree_skb(skb); |
Hirofumi Nakagawa | 801678c | 2008-04-29 01:03:09 -0700 | [diff] [blame] | 153 | if (IS_ERR(segs)) |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 154 | return PTR_ERR(segs); |
| 155 | |
| 156 | do { |
| 157 | struct sk_buff *nskb = segs->next; |
| 158 | int err; |
| 159 | |
| 160 | segs->next = NULL; |
| 161 | err = xfrm_output2(segs); |
| 162 | |
| 163 | if (unlikely(err)) { |
| 164 | while ((segs = nskb)) { |
| 165 | nskb = segs->next; |
| 166 | segs->next = NULL; |
| 167 | kfree_skb(segs); |
| 168 | } |
| 169 | return err; |
| 170 | } |
| 171 | |
| 172 | segs = nskb; |
| 173 | } while (segs); |
| 174 | |
| 175 | return 0; |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 176 | } |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 177 | |
| 178 | int xfrm_output(struct sk_buff *skb) |
| 179 | { |
| 180 | int err; |
| 181 | |
| 182 | if (skb_is_gso(skb)) |
| 183 | return xfrm_output_gso(skb); |
| 184 | |
| 185 | if (skb->ip_summed == CHECKSUM_PARTIAL) { |
| 186 | err = skb_checksum_help(skb); |
| 187 | if (err) { |
Masahide NAKAMURA | 0aa6477 | 2007-12-20 20:43:36 -0800 | [diff] [blame] | 188 | XFRM_INC_STATS(LINUX_MIB_XFRMOUTERROR); |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 189 | kfree_skb(skb); |
| 190 | return err; |
| 191 | } |
| 192 | } |
| 193 | |
| 194 | return xfrm_output2(skb); |
| 195 | } |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 196 | |
| 197 | int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) |
| 198 | { |
| 199 | struct xfrm_mode *inner_mode; |
| 200 | if (x->sel.family == AF_UNSPEC) |
| 201 | inner_mode = xfrm_ip2inner_mode(x, |
| 202 | xfrm_af2proto(skb->dst->ops->family)); |
| 203 | else |
| 204 | inner_mode = x->inner_mode; |
| 205 | |
| 206 | if (inner_mode == NULL) |
| 207 | return -EAFNOSUPPORT; |
| 208 | return inner_mode->afinfo->extract_output(x, skb); |
| 209 | } |
| 210 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 211 | EXPORT_SYMBOL_GPL(xfrm_output); |
Kazunori MIYAZAWA | df9dcb4 | 2008-03-24 14:51:51 -0700 | [diff] [blame] | 212 | EXPORT_SYMBOL_GPL(xfrm_inner_extract_output); |