1406ef77cSHerbert Xu /* 2406ef77cSHerbert Xu * xfrm_output.c - Common IPsec encapsulation code. 3406ef77cSHerbert Xu * 4406ef77cSHerbert Xu * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> 5406ef77cSHerbert Xu * 6406ef77cSHerbert Xu * This program is free software; you can redistribute it and/or 7406ef77cSHerbert Xu * modify it under the terms of the GNU General Public License 8406ef77cSHerbert Xu * as published by the Free Software Foundation; either version 9406ef77cSHerbert Xu * 2 of the License, or (at your option) any later version. 10406ef77cSHerbert Xu */ 11406ef77cSHerbert Xu 12406ef77cSHerbert Xu #include <linux/errno.h> 13406ef77cSHerbert Xu #include <linux/module.h> 14406ef77cSHerbert Xu #include <linux/netdevice.h> 15862b82c6SHerbert Xu #include <linux/netfilter.h> 16406ef77cSHerbert Xu #include <linux/skbuff.h> 175a0e3ad6STejun Heo #include <linux/slab.h> 18406ef77cSHerbert Xu #include <linux/spinlock.h> 19406ef77cSHerbert Xu #include <net/dst.h> 20406ef77cSHerbert Xu #include <net/xfrm.h> 21406ef77cSHerbert Xu 220c4b51f0SEric W. Biederman static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb); 23c6581a45SHerbert Xu 2426b2072eSSteffen Klassert static int xfrm_skb_check_space(struct sk_buff *skb) 2583815deaSHerbert Xu { 26adf30907SEric Dumazet struct dst_entry *dst = skb_dst(skb); 27550ade84SHerbert Xu int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) 2883815deaSHerbert Xu - skb_headroom(skb); 29f5184d26SJohannes Berg int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); 3083815deaSHerbert Xu 31d01dbeb6SHerbert Xu if (nhead <= 0) { 32d01dbeb6SHerbert Xu if (ntail <= 0) 3383815deaSHerbert Xu return 0; 34d01dbeb6SHerbert Xu nhead = 0; 35d01dbeb6SHerbert Xu } else if (ntail < 0) 36d01dbeb6SHerbert Xu ntail = 0; 37d01dbeb6SHerbert Xu 38d01dbeb6SHerbert Xu return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); 3983815deaSHerbert Xu } 4083815deaSHerbert Xu 419449c3cdSYing Xue /* Children define the path of the packet through the 429449c3cdSYing Xue * Linux networking. Thus, destinations are stackable. 439449c3cdSYing Xue */ 449449c3cdSYing Xue 459449c3cdSYing Xue static struct dst_entry *skb_dst_pop(struct sk_buff *skb) 469449c3cdSYing Xue { 47b92cf4aaSDavid Miller struct dst_entry *child = dst_clone(xfrm_dst_child(skb_dst(skb))); 489449c3cdSYing Xue 499449c3cdSYing Xue skb_dst_drop(skb); 509449c3cdSYing Xue return child; 519449c3cdSYing Xue } 529449c3cdSYing Xue 53c6581a45SHerbert Xu static int xfrm_output_one(struct sk_buff *skb, int err) 54406ef77cSHerbert Xu { 55adf30907SEric Dumazet struct dst_entry *dst = skb_dst(skb); 56406ef77cSHerbert Xu struct xfrm_state *x = dst->xfrm; 57a6483b79SAlexey Dobriyan struct net *net = xs_net(x); 58406ef77cSHerbert Xu 59c6581a45SHerbert Xu if (err <= 0) 60c6581a45SHerbert Xu goto resume; 61406ef77cSHerbert Xu 62406ef77cSHerbert Xu do { 6326b2072eSSteffen Klassert err = xfrm_skb_check_space(skb); 64b15c4bcdSMasahide NAKAMURA if (err) { 6559c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 66910ef70aSHerbert Xu goto error_nolock; 67b15c4bcdSMasahide NAKAMURA } 68910ef70aSHerbert Xu 699b42c1f1SSteffen Klassert skb->mark = xfrm_smark_get(skb->mark, x); 70077fbac4SLorenzo Colitti 71a2deb6d2SHerbert Xu err = x->outer_mode->output(x, skb); 72b15c4bcdSMasahide NAKAMURA if (err) { 7359c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR); 74910ef70aSHerbert Xu goto error_nolock; 75b15c4bcdSMasahide NAKAMURA } 76a2deb6d2SHerbert Xu 77406ef77cSHerbert Xu spin_lock_bh(&x->lock); 78bb65a9cbSLi RongQing 79bb65a9cbSLi RongQing if (unlikely(x->km.state != XFRM_STATE_VALID)) { 80bb65a9cbSLi RongQing XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); 81497574c7STimo Teräs err = -EINVAL; 82fa8599dbSLi RongQing goto error; 83bb65a9cbSLi RongQing } 84bb65a9cbSLi RongQing 85910ef70aSHerbert Xu err = xfrm_state_check_expire(x); 86b15c4bcdSMasahide NAKAMURA if (err) { 8759c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); 88406ef77cSHerbert Xu goto error; 89b15c4bcdSMasahide NAKAMURA } 90406ef77cSHerbert Xu 919fdc4883SSteffen Klassert err = x->repl->overflow(x, skb); 929fdc4883SSteffen Klassert if (err) { 9359c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); 94e1af9f27SPaul Moore goto error; 95e1af9f27SPaul Moore } 96436a0a40SHerbert Xu 97406ef77cSHerbert Xu x->curlft.bytes += skb->len; 98406ef77cSHerbert Xu x->curlft.packets++; 99406ef77cSHerbert Xu 100406ef77cSHerbert Xu spin_unlock_bh(&x->lock); 101406ef77cSHerbert Xu 1023bc07321SSteffen Klassert skb_dst_force(skb); 1039e143793SSteffen Klassert if (!skb_dst(skb)) { 1049e143793SSteffen Klassert XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 105533555e5SWei Yongjun err = -EHOSTUNREACH; 1069e143793SSteffen Klassert goto error_nolock; 1079e143793SSteffen Klassert } 1083bc07321SSteffen Klassert 109d77e38e6SSteffen Klassert if (xfrm_offload(skb)) { 110d77e38e6SSteffen Klassert x->type_offload->encap(x, skb); 111d77e38e6SSteffen Klassert } else { 11273b9fc49SSteffen Klassert /* Inner headers are invalid now. */ 11373b9fc49SSteffen Klassert skb->encapsulation = 0; 11473b9fc49SSteffen Klassert 115b7c6538cSHerbert Xu err = x->type->output(x, skb); 116fcb8c156SHerbert Xu if (err == -EINPROGRESS) 117ebd4687aSJean Sacren goto out; 118d77e38e6SSteffen Klassert } 119c6581a45SHerbert Xu 120c6581a45SHerbert Xu resume: 1210aa64774SMasahide NAKAMURA if (err) { 12259c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR); 123b7c6538cSHerbert Xu goto error_nolock; 1240aa64774SMasahide NAKAMURA } 125b7c6538cSHerbert Xu 1268764ab2cSSteffen Klassert dst = skb_dst_pop(skb); 127adf30907SEric Dumazet if (!dst) { 12859c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 129406ef77cSHerbert Xu err = -EHOSTUNREACH; 130406ef77cSHerbert Xu goto error_nolock; 131406ef77cSHerbert Xu } 132e433430aSSteffen Klassert skb_dst_set(skb, dst); 133406ef77cSHerbert Xu x = dst->xfrm; 13413996378SHerbert Xu } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); 135406ef77cSHerbert Xu 136ebd4687aSJean Sacren return 0; 137406ef77cSHerbert Xu 138406ef77cSHerbert Xu error: 139406ef77cSHerbert Xu spin_unlock_bh(&x->lock); 140862b82c6SHerbert Xu error_nolock: 141862b82c6SHerbert Xu kfree_skb(skb); 142ebd4687aSJean Sacren out: 143ebd4687aSJean Sacren return err; 144862b82c6SHerbert Xu } 145862b82c6SHerbert Xu 146c6581a45SHerbert Xu int xfrm_output_resume(struct sk_buff *skb, int err) 147862b82c6SHerbert Xu { 14829a26a56SEric W. Biederman struct net *net = xs_net(skb_dst(skb)->xfrm); 149be10de0aSEric W. Biederman 150c6581a45SHerbert Xu while (likely((err = xfrm_output_one(skb, err)) == 0)) { 151862b82c6SHerbert Xu nf_reset(skb); 152862b82c6SHerbert Xu 153cf91a99dSEric W. Biederman err = skb_dst(skb)->ops->local_out(net, skb->sk, skb); 154862b82c6SHerbert Xu if (unlikely(err != 1)) 155c6581a45SHerbert Xu goto out; 156862b82c6SHerbert Xu 157adf30907SEric Dumazet if (!skb_dst(skb)->xfrm) 15813206b6bSEric W. Biederman return dst_output(net, skb->sk, skb); 159862b82c6SHerbert Xu 160adf30907SEric Dumazet err = nf_hook(skb_dst(skb)->ops->family, 16129a26a56SEric W. Biederman NF_INET_POST_ROUTING, net, skb->sk, skb, 162adf30907SEric Dumazet NULL, skb_dst(skb)->dev, xfrm_output2); 163862b82c6SHerbert Xu if (unlikely(err != 1)) 164c6581a45SHerbert Xu goto out; 165862b82c6SHerbert Xu } 166862b82c6SHerbert Xu 167c6581a45SHerbert Xu if (err == -EINPROGRESS) 168c6581a45SHerbert Xu err = 0; 169c6581a45SHerbert Xu 170c6581a45SHerbert Xu out: 171862b82c6SHerbert Xu return err; 172862b82c6SHerbert Xu } 173c6581a45SHerbert Xu EXPORT_SYMBOL_GPL(xfrm_output_resume); 174862b82c6SHerbert Xu 1750c4b51f0SEric W. Biederman static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb) 176c6581a45SHerbert Xu { 177c6581a45SHerbert Xu return xfrm_output_resume(skb, 1); 178c6581a45SHerbert Xu } 179c6581a45SHerbert Xu 1800c4b51f0SEric W. Biederman static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb) 181862b82c6SHerbert Xu { 182862b82c6SHerbert Xu struct sk_buff *segs; 183862b82c6SHerbert Xu 1849207f9d4SKonstantin Khlebnikov BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET); 1859207f9d4SKonstantin Khlebnikov BUILD_BUG_ON(sizeof(*IP6CB(skb)) > SKB_SGO_CB_OFFSET); 186862b82c6SHerbert Xu segs = skb_gso_segment(skb, 0); 187862b82c6SHerbert Xu kfree_skb(skb); 188801678c5SHirofumi Nakagawa if (IS_ERR(segs)) 189862b82c6SHerbert Xu return PTR_ERR(segs); 190330966e5SFlorian Westphal if (segs == NULL) 191330966e5SFlorian Westphal return -EINVAL; 192862b82c6SHerbert Xu 193862b82c6SHerbert Xu do { 194862b82c6SHerbert Xu struct sk_buff *nskb = segs->next; 195862b82c6SHerbert Xu int err; 196862b82c6SHerbert Xu 197a8305bffSDavid S. Miller skb_mark_not_on_list(segs); 1980c4b51f0SEric W. Biederman err = xfrm_output2(net, sk, segs); 199862b82c6SHerbert Xu 200862b82c6SHerbert Xu if (unlikely(err)) { 20146cfd725SFlorian Westphal kfree_skb_list(nskb); 202862b82c6SHerbert Xu return err; 203862b82c6SHerbert Xu } 204862b82c6SHerbert Xu 205862b82c6SHerbert Xu segs = nskb; 206862b82c6SHerbert Xu } while (segs); 207862b82c6SHerbert Xu 208862b82c6SHerbert Xu return 0; 209406ef77cSHerbert Xu } 210c6581a45SHerbert Xu 2117026b1ddSDavid Miller int xfrm_output(struct sock *sk, struct sk_buff *skb) 212c6581a45SHerbert Xu { 213adf30907SEric Dumazet struct net *net = dev_net(skb_dst(skb)->dev); 214d77e38e6SSteffen Klassert struct xfrm_state *x = skb_dst(skb)->xfrm; 215c6581a45SHerbert Xu int err; 216c6581a45SHerbert Xu 217d77e38e6SSteffen Klassert secpath_reset(skb); 218d77e38e6SSteffen Klassert 219d77e38e6SSteffen Klassert if (xfrm_dev_offload_ok(skb, x)) { 220d77e38e6SSteffen Klassert struct sec_path *sp; 221d77e38e6SSteffen Klassert 222d77e38e6SSteffen Klassert sp = secpath_dup(skb->sp); 223d77e38e6SSteffen Klassert if (!sp) { 224d77e38e6SSteffen Klassert XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 225d77e38e6SSteffen Klassert kfree_skb(skb); 226d77e38e6SSteffen Klassert return -ENOMEM; 227d77e38e6SSteffen Klassert } 228d77e38e6SSteffen Klassert if (skb->sp) 229d77e38e6SSteffen Klassert secpath_put(skb->sp); 230d77e38e6SSteffen Klassert skb->sp = sp; 231f1bd7d65SIlan Tayari skb->encapsulation = 1; 232d77e38e6SSteffen Klassert 233d77e38e6SSteffen Klassert sp->olen++; 234d77e38e6SSteffen Klassert sp->xvec[skb->sp->len++] = x; 235d77e38e6SSteffen Klassert xfrm_state_hold(x); 236d77e38e6SSteffen Klassert 237d77e38e6SSteffen Klassert if (skb_is_gso(skb)) { 238d77e38e6SSteffen Klassert skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; 239d77e38e6SSteffen Klassert 240d77e38e6SSteffen Klassert return xfrm_output2(net, sk, skb); 241d77e38e6SSteffen Klassert } 242d77e38e6SSteffen Klassert 243d77e38e6SSteffen Klassert if (x->xso.dev && x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM) 244d77e38e6SSteffen Klassert goto out; 245d77e38e6SSteffen Klassert } 246d77e38e6SSteffen Klassert 247c6581a45SHerbert Xu if (skb_is_gso(skb)) 2480c4b51f0SEric W. Biederman return xfrm_output_gso(net, sk, skb); 249c6581a45SHerbert Xu 250c6581a45SHerbert Xu if (skb->ip_summed == CHECKSUM_PARTIAL) { 251c6581a45SHerbert Xu err = skb_checksum_help(skb); 252c6581a45SHerbert Xu if (err) { 25359c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 254c6581a45SHerbert Xu kfree_skb(skb); 255c6581a45SHerbert Xu return err; 256c6581a45SHerbert Xu } 257c6581a45SHerbert Xu } 258c6581a45SHerbert Xu 259d77e38e6SSteffen Klassert out: 2600c4b51f0SEric W. Biederman return xfrm_output2(net, sk, skb); 261c6581a45SHerbert Xu } 262fc68086cSFabian Frederick EXPORT_SYMBOL_GPL(xfrm_output); 263df9dcb45SKazunori MIYAZAWA 264df9dcb45SKazunori MIYAZAWA int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) 265df9dcb45SKazunori MIYAZAWA { 266df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode; 267df9dcb45SKazunori MIYAZAWA if (x->sel.family == AF_UNSPEC) 268df9dcb45SKazunori MIYAZAWA inner_mode = xfrm_ip2inner_mode(x, 269adf30907SEric Dumazet xfrm_af2proto(skb_dst(skb)->ops->family)); 270df9dcb45SKazunori MIYAZAWA else 271df9dcb45SKazunori MIYAZAWA inner_mode = x->inner_mode; 272df9dcb45SKazunori MIYAZAWA 273df9dcb45SKazunori MIYAZAWA if (inner_mode == NULL) 274df9dcb45SKazunori MIYAZAWA return -EAFNOSUPPORT; 275df9dcb45SKazunori MIYAZAWA return inner_mode->afinfo->extract_output(x, skb); 276df9dcb45SKazunori MIYAZAWA } 277fc68086cSFabian Frederick EXPORT_SYMBOL_GPL(xfrm_inner_extract_output); 278df9dcb45SKazunori MIYAZAWA 279628e341fSHannes Frederic Sowa void xfrm_local_error(struct sk_buff *skb, int mtu) 280628e341fSHannes Frederic Sowa { 281844d4874SHannes Frederic Sowa unsigned int proto; 282628e341fSHannes Frederic Sowa struct xfrm_state_afinfo *afinfo; 283628e341fSHannes Frederic Sowa 284844d4874SHannes Frederic Sowa if (skb->protocol == htons(ETH_P_IP)) 285844d4874SHannes Frederic Sowa proto = AF_INET; 286844d4874SHannes Frederic Sowa else if (skb->protocol == htons(ETH_P_IPV6)) 287844d4874SHannes Frederic Sowa proto = AF_INET6; 288844d4874SHannes Frederic Sowa else 289844d4874SHannes Frederic Sowa return; 290844d4874SHannes Frederic Sowa 291844d4874SHannes Frederic Sowa afinfo = xfrm_state_get_afinfo(proto); 29246c0ef6eSTaehee Yoo if (afinfo) { 293628e341fSHannes Frederic Sowa afinfo->local_error(skb, mtu); 294af5d27c4SFlorian Westphal rcu_read_unlock(); 295628e341fSHannes Frederic Sowa } 29646c0ef6eSTaehee Yoo } 297628e341fSHannes Frederic Sowa EXPORT_SYMBOL_GPL(xfrm_local_error); 298