Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm_output.c - Common IPsec encapsulation code. |
| 3 | * |
| 4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | */ |
| 11 | |
| 12 | #include <linux/errno.h> |
| 13 | #include <linux/module.h> |
| 14 | #include <linux/netdevice.h> |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 15 | #include <linux/netfilter.h> |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 16 | #include <linux/skbuff.h> |
| 17 | #include <linux/spinlock.h> |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 18 | #include <net/dst.h> |
| 19 | #include <net/xfrm.h> |
| 20 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 21 | static int xfrm_output2(struct sk_buff *skb); |
| 22 | |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 23 | static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb) |
| 24 | { |
Herbert Xu | 550ade8 | 2007-11-13 21:33:01 -0800 | [diff] [blame] | 25 | struct dst_entry *dst = skb->dst; |
| 26 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) |
Herbert Xu | 83815de | 2007-10-08 17:25:08 -0700 | [diff] [blame] | 27 | - skb_headroom(skb); |
| 28 | |
| 29 | if (nhead > 0) |
| 30 | return pskb_expand_head(skb, nhead, 0, GFP_ATOMIC); |
| 31 | |
| 32 | /* Check tail too... */ |
| 33 | return 0; |
| 34 | } |
| 35 | |
| 36 | static int xfrm_state_check(struct xfrm_state *x, struct sk_buff *skb) |
| 37 | { |
| 38 | int err = xfrm_state_check_expire(x); |
| 39 | if (err < 0) |
| 40 | goto err; |
| 41 | err = xfrm_state_check_space(x, skb); |
| 42 | err: |
| 43 | return err; |
| 44 | } |
| 45 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 46 | static int xfrm_output_one(struct sk_buff *skb, int err) |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 47 | { |
| 48 | struct dst_entry *dst = skb->dst; |
| 49 | struct xfrm_state *x = dst->xfrm; |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 50 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 51 | if (err <= 0) |
| 52 | goto resume; |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 53 | |
| 54 | do { |
Herbert Xu | a2deb6d2 | 2007-11-13 21:39:38 -0800 | [diff] [blame] | 55 | err = x->outer_mode->output(x, skb); |
| 56 | if (err) |
| 57 | goto error; |
| 58 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 59 | spin_lock_bh(&x->lock); |
| 60 | err = xfrm_state_check(x, skb); |
| 61 | if (err) |
| 62 | goto error; |
| 63 | |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 64 | if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { |
| 65 | XFRM_SKB_CB(skb)->seq = ++x->replay.oseq; |
Herbert Xu | cdf7e66 | 2007-10-08 17:26:34 -0700 | [diff] [blame] | 66 | if (xfrm_aevent_is_on()) |
| 67 | xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); |
Herbert Xu | 436a0a4 | 2007-10-08 17:25:53 -0700 | [diff] [blame] | 68 | } |
| 69 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 70 | x->curlft.bytes += skb->len; |
| 71 | x->curlft.packets++; |
| 72 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 73 | spin_unlock_bh(&x->lock); |
| 74 | |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 75 | err = x->type->output(x, skb); |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 76 | |
| 77 | resume: |
Herbert Xu | b7c6538 | 2007-10-09 13:33:35 -0700 | [diff] [blame] | 78 | if (err) |
| 79 | goto error_nolock; |
| 80 | |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 81 | if (!(skb->dst = dst_pop(dst))) { |
| 82 | err = -EHOSTUNREACH; |
| 83 | goto error_nolock; |
| 84 | } |
| 85 | dst = skb->dst; |
| 86 | x = dst->xfrm; |
Herbert Xu | 1399637 | 2007-10-17 21:35:51 -0700 | [diff] [blame] | 87 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 88 | |
| 89 | err = 0; |
| 90 | |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 91 | out_exit: |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 92 | return err; |
| 93 | error: |
| 94 | spin_unlock_bh(&x->lock); |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 95 | error_nolock: |
| 96 | kfree_skb(skb); |
| 97 | goto out_exit; |
| 98 | } |
| 99 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 100 | int xfrm_output_resume(struct sk_buff *skb, int err) |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 101 | { |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 102 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 103 | struct xfrm_state *x; |
| 104 | |
| 105 | nf_reset(skb); |
| 106 | |
| 107 | err = skb->dst->ops->local_out(skb); |
| 108 | if (unlikely(err != 1)) |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 109 | goto out; |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 110 | |
| 111 | x = skb->dst->xfrm; |
| 112 | if (!x) |
| 113 | return dst_output(skb); |
| 114 | |
| 115 | err = nf_hook(x->inner_mode->afinfo->family, |
| 116 | x->inner_mode->afinfo->nf_post_routing, skb, |
| 117 | NULL, skb->dst->dev, xfrm_output2); |
| 118 | if (unlikely(err != 1)) |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 119 | goto out; |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 120 | } |
| 121 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 122 | if (err == -EINPROGRESS) |
| 123 | err = 0; |
| 124 | |
| 125 | out: |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 126 | return err; |
| 127 | } |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 128 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 129 | |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 130 | static int xfrm_output2(struct sk_buff *skb) |
| 131 | { |
| 132 | return xfrm_output_resume(skb, 1); |
| 133 | } |
| 134 | |
| 135 | static int xfrm_output_gso(struct sk_buff *skb) |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 136 | { |
| 137 | struct sk_buff *segs; |
| 138 | |
Herbert Xu | 862b82c | 2007-11-13 21:43:11 -0800 | [diff] [blame] | 139 | segs = skb_gso_segment(skb, 0); |
| 140 | kfree_skb(skb); |
| 141 | if (unlikely(IS_ERR(segs))) |
| 142 | return PTR_ERR(segs); |
| 143 | |
| 144 | do { |
| 145 | struct sk_buff *nskb = segs->next; |
| 146 | int err; |
| 147 | |
| 148 | segs->next = NULL; |
| 149 | err = xfrm_output2(segs); |
| 150 | |
| 151 | if (unlikely(err)) { |
| 152 | while ((segs = nskb)) { |
| 153 | nskb = segs->next; |
| 154 | segs->next = NULL; |
| 155 | kfree_skb(segs); |
| 156 | } |
| 157 | return err; |
| 158 | } |
| 159 | |
| 160 | segs = nskb; |
| 161 | } while (segs); |
| 162 | |
| 163 | return 0; |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 164 | } |
Herbert Xu | c6581a4 | 2007-11-13 21:43:43 -0800 | [diff] [blame] | 165 | |
| 166 | int xfrm_output(struct sk_buff *skb) |
| 167 | { |
| 168 | int err; |
| 169 | |
| 170 | if (skb_is_gso(skb)) |
| 171 | return xfrm_output_gso(skb); |
| 172 | |
| 173 | if (skb->ip_summed == CHECKSUM_PARTIAL) { |
| 174 | err = skb_checksum_help(skb); |
| 175 | if (err) { |
| 176 | kfree_skb(skb); |
| 177 | return err; |
| 178 | } |
| 179 | } |
| 180 | |
| 181 | return xfrm_output2(skb); |
| 182 | } |
Herbert Xu | 406ef77 | 2007-10-08 17:16:30 -0700 | [diff] [blame] | 183 | EXPORT_SYMBOL_GPL(xfrm_output); |