1406ef77cSHerbert Xu /* 2406ef77cSHerbert Xu * xfrm_output.c - Common IPsec encapsulation code. 3406ef77cSHerbert Xu * 4406ef77cSHerbert Xu * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> 5406ef77cSHerbert Xu * 6406ef77cSHerbert Xu * This program is free software; you can redistribute it and/or 7406ef77cSHerbert Xu * modify it under the terms of the GNU General Public License 8406ef77cSHerbert Xu * as published by the Free Software Foundation; either version 9406ef77cSHerbert Xu * 2 of the License, or (at your option) any later version. 10406ef77cSHerbert Xu */ 11406ef77cSHerbert Xu 12406ef77cSHerbert Xu #include <linux/errno.h> 13406ef77cSHerbert Xu #include <linux/module.h> 14406ef77cSHerbert Xu #include <linux/netdevice.h> 15862b82c6SHerbert Xu #include <linux/netfilter.h> 16406ef77cSHerbert Xu #include <linux/skbuff.h> 175a0e3ad6STejun Heo #include <linux/slab.h> 18406ef77cSHerbert Xu #include <linux/spinlock.h> 19406ef77cSHerbert Xu #include <net/dst.h> 20406ef77cSHerbert Xu #include <net/xfrm.h> 21406ef77cSHerbert Xu 220c4b51f0SEric W. Biederman static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb); 23c6581a45SHerbert Xu 2426b2072eSSteffen Klassert static int xfrm_skb_check_space(struct sk_buff *skb) 2583815deaSHerbert Xu { 26adf30907SEric Dumazet struct dst_entry *dst = skb_dst(skb); 27550ade84SHerbert Xu int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) 2883815deaSHerbert Xu - skb_headroom(skb); 29f5184d26SJohannes Berg int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); 3083815deaSHerbert Xu 31d01dbeb6SHerbert Xu if (nhead <= 0) { 32d01dbeb6SHerbert Xu if (ntail <= 0) 3383815deaSHerbert Xu return 0; 34d01dbeb6SHerbert Xu nhead = 0; 35d01dbeb6SHerbert Xu } else if (ntail < 0) 36d01dbeb6SHerbert Xu ntail = 0; 37d01dbeb6SHerbert Xu 38d01dbeb6SHerbert Xu return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); 3983815deaSHerbert Xu } 4083815deaSHerbert Xu 419449c3cdSYing Xue /* Children define the path of the packet through the 429449c3cdSYing Xue * Linux networking. Thus, destinations are stackable. 439449c3cdSYing Xue */ 449449c3cdSYing Xue 459449c3cdSYing Xue static struct dst_entry *skb_dst_pop(struct sk_buff *skb) 469449c3cdSYing Xue { 479449c3cdSYing Xue struct dst_entry *child = dst_clone(skb_dst(skb)->child); 489449c3cdSYing Xue 499449c3cdSYing Xue skb_dst_drop(skb); 509449c3cdSYing Xue return child; 519449c3cdSYing Xue } 529449c3cdSYing Xue 53c6581a45SHerbert Xu static int xfrm_output_one(struct sk_buff *skb, int err) 54406ef77cSHerbert Xu { 55adf30907SEric Dumazet struct dst_entry *dst = skb_dst(skb); 56406ef77cSHerbert Xu struct xfrm_state *x = dst->xfrm; 57a6483b79SAlexey Dobriyan struct net *net = xs_net(x); 58406ef77cSHerbert Xu 59c6581a45SHerbert Xu if (err <= 0) 60c6581a45SHerbert Xu goto resume; 61406ef77cSHerbert Xu 62406ef77cSHerbert Xu do { 6326b2072eSSteffen Klassert err = xfrm_skb_check_space(skb); 64b15c4bcdSMasahide NAKAMURA if (err) { 6559c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 66910ef70aSHerbert Xu goto error_nolock; 67b15c4bcdSMasahide NAKAMURA } 68910ef70aSHerbert Xu 69077fbac4SLorenzo Colitti if (x->props.output_mark) 70077fbac4SLorenzo Colitti skb->mark = x->props.output_mark; 71077fbac4SLorenzo Colitti 72a2deb6d2SHerbert Xu err = x->outer_mode->output(x, skb); 73b15c4bcdSMasahide NAKAMURA if (err) { 7459c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR); 75910ef70aSHerbert Xu goto error_nolock; 76b15c4bcdSMasahide NAKAMURA } 77a2deb6d2SHerbert Xu 78406ef77cSHerbert Xu spin_lock_bh(&x->lock); 79bb65a9cbSLi RongQing 80bb65a9cbSLi RongQing if (unlikely(x->km.state != XFRM_STATE_VALID)) { 81bb65a9cbSLi RongQing XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); 82497574c7STimo Teräs err = -EINVAL; 83fa8599dbSLi RongQing goto error; 84bb65a9cbSLi RongQing } 85bb65a9cbSLi RongQing 86910ef70aSHerbert Xu err = xfrm_state_check_expire(x); 87b15c4bcdSMasahide NAKAMURA if (err) { 8859c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); 89406ef77cSHerbert Xu goto error; 90b15c4bcdSMasahide NAKAMURA } 91406ef77cSHerbert Xu 929fdc4883SSteffen Klassert err = x->repl->overflow(x, skb); 939fdc4883SSteffen Klassert if (err) { 9459c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); 95e1af9f27SPaul Moore goto error; 96e1af9f27SPaul Moore } 97436a0a40SHerbert Xu 98406ef77cSHerbert Xu x->curlft.bytes += skb->len; 99406ef77cSHerbert Xu x->curlft.packets++; 100406ef77cSHerbert Xu 101406ef77cSHerbert Xu spin_unlock_bh(&x->lock); 102406ef77cSHerbert Xu 1033bc07321SSteffen Klassert skb_dst_force(skb); 1043bc07321SSteffen Klassert 105d77e38e6SSteffen Klassert if (xfrm_offload(skb)) { 106d77e38e6SSteffen Klassert x->type_offload->encap(x, skb); 107d77e38e6SSteffen Klassert } else { 10873b9fc49SSteffen Klassert /* Inner headers are invalid now. */ 10973b9fc49SSteffen Klassert skb->encapsulation = 0; 11073b9fc49SSteffen Klassert 111b7c6538cSHerbert Xu err = x->type->output(x, skb); 112fcb8c156SHerbert Xu if (err == -EINPROGRESS) 113ebd4687aSJean Sacren goto out; 114d77e38e6SSteffen Klassert } 115c6581a45SHerbert Xu 116c6581a45SHerbert Xu resume: 1170aa64774SMasahide NAKAMURA if (err) { 11859c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR); 119b7c6538cSHerbert Xu goto error_nolock; 1200aa64774SMasahide NAKAMURA } 121b7c6538cSHerbert Xu 1228764ab2cSSteffen Klassert dst = skb_dst_pop(skb); 123adf30907SEric Dumazet if (!dst) { 12459c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 125406ef77cSHerbert Xu err = -EHOSTUNREACH; 126406ef77cSHerbert Xu goto error_nolock; 127406ef77cSHerbert Xu } 128e433430aSSteffen Klassert skb_dst_set(skb, dst); 129406ef77cSHerbert Xu x = dst->xfrm; 13013996378SHerbert Xu } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); 131406ef77cSHerbert Xu 132ebd4687aSJean Sacren return 0; 133406ef77cSHerbert Xu 134406ef77cSHerbert Xu error: 135406ef77cSHerbert Xu spin_unlock_bh(&x->lock); 136862b82c6SHerbert Xu error_nolock: 137862b82c6SHerbert Xu kfree_skb(skb); 138ebd4687aSJean Sacren out: 139ebd4687aSJean Sacren return err; 140862b82c6SHerbert Xu } 141862b82c6SHerbert Xu 142c6581a45SHerbert Xu int xfrm_output_resume(struct sk_buff *skb, int err) 143862b82c6SHerbert Xu { 14429a26a56SEric W. Biederman struct net *net = xs_net(skb_dst(skb)->xfrm); 145be10de0aSEric W. Biederman 146c6581a45SHerbert Xu while (likely((err = xfrm_output_one(skb, err)) == 0)) { 147862b82c6SHerbert Xu nf_reset(skb); 148862b82c6SHerbert Xu 149cf91a99dSEric W. Biederman err = skb_dst(skb)->ops->local_out(net, skb->sk, skb); 150862b82c6SHerbert Xu if (unlikely(err != 1)) 151c6581a45SHerbert Xu goto out; 152862b82c6SHerbert Xu 153adf30907SEric Dumazet if (!skb_dst(skb)->xfrm) 15413206b6bSEric W. Biederman return dst_output(net, skb->sk, skb); 155862b82c6SHerbert Xu 156adf30907SEric Dumazet err = nf_hook(skb_dst(skb)->ops->family, 15729a26a56SEric W. Biederman NF_INET_POST_ROUTING, net, skb->sk, skb, 158adf30907SEric Dumazet NULL, skb_dst(skb)->dev, xfrm_output2); 159862b82c6SHerbert Xu if (unlikely(err != 1)) 160c6581a45SHerbert Xu goto out; 161862b82c6SHerbert Xu } 162862b82c6SHerbert Xu 163c6581a45SHerbert Xu if (err == -EINPROGRESS) 164c6581a45SHerbert Xu err = 0; 165c6581a45SHerbert Xu 166c6581a45SHerbert Xu out: 167862b82c6SHerbert Xu return err; 168862b82c6SHerbert Xu } 169c6581a45SHerbert Xu EXPORT_SYMBOL_GPL(xfrm_output_resume); 170862b82c6SHerbert Xu 1710c4b51f0SEric W. Biederman static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb) 172c6581a45SHerbert Xu { 173c6581a45SHerbert Xu return xfrm_output_resume(skb, 1); 174c6581a45SHerbert Xu } 175c6581a45SHerbert Xu 1760c4b51f0SEric W. Biederman static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb) 177862b82c6SHerbert Xu { 178862b82c6SHerbert Xu struct sk_buff *segs; 179862b82c6SHerbert Xu 1809207f9d4SKonstantin Khlebnikov BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET); 1819207f9d4SKonstantin Khlebnikov BUILD_BUG_ON(sizeof(*IP6CB(skb)) > SKB_SGO_CB_OFFSET); 182862b82c6SHerbert Xu segs = skb_gso_segment(skb, 0); 183862b82c6SHerbert Xu kfree_skb(skb); 184801678c5SHirofumi Nakagawa if (IS_ERR(segs)) 185862b82c6SHerbert Xu return PTR_ERR(segs); 186330966e5SFlorian Westphal if (segs == NULL) 187330966e5SFlorian Westphal return -EINVAL; 188862b82c6SHerbert Xu 189862b82c6SHerbert Xu do { 190862b82c6SHerbert Xu struct sk_buff *nskb = segs->next; 191862b82c6SHerbert Xu int err; 192862b82c6SHerbert Xu 193862b82c6SHerbert Xu segs->next = NULL; 1940c4b51f0SEric W. Biederman err = xfrm_output2(net, sk, segs); 195862b82c6SHerbert Xu 196862b82c6SHerbert Xu if (unlikely(err)) { 19746cfd725SFlorian Westphal kfree_skb_list(nskb); 198862b82c6SHerbert Xu return err; 199862b82c6SHerbert Xu } 200862b82c6SHerbert Xu 201862b82c6SHerbert Xu segs = nskb; 202862b82c6SHerbert Xu } while (segs); 203862b82c6SHerbert Xu 204862b82c6SHerbert Xu return 0; 205406ef77cSHerbert Xu } 206c6581a45SHerbert Xu 2077026b1ddSDavid Miller int xfrm_output(struct sock *sk, struct sk_buff *skb) 208c6581a45SHerbert Xu { 209adf30907SEric Dumazet struct net *net = dev_net(skb_dst(skb)->dev); 210d77e38e6SSteffen Klassert struct xfrm_state *x = skb_dst(skb)->xfrm; 211c6581a45SHerbert Xu int err; 212c6581a45SHerbert Xu 213d77e38e6SSteffen Klassert secpath_reset(skb); 214d77e38e6SSteffen Klassert 215d77e38e6SSteffen Klassert if (xfrm_dev_offload_ok(skb, x)) { 216d77e38e6SSteffen Klassert struct sec_path *sp; 217d77e38e6SSteffen Klassert 218d77e38e6SSteffen Klassert sp = secpath_dup(skb->sp); 219d77e38e6SSteffen Klassert if (!sp) { 220d77e38e6SSteffen Klassert XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 221d77e38e6SSteffen Klassert kfree_skb(skb); 222d77e38e6SSteffen Klassert return -ENOMEM; 223d77e38e6SSteffen Klassert } 224d77e38e6SSteffen Klassert if (skb->sp) 225d77e38e6SSteffen Klassert secpath_put(skb->sp); 226d77e38e6SSteffen Klassert skb->sp = sp; 227f1bd7d65SIlan Tayari skb->encapsulation = 1; 228d77e38e6SSteffen Klassert 229d77e38e6SSteffen Klassert sp->olen++; 230d77e38e6SSteffen Klassert sp->xvec[skb->sp->len++] = x; 231d77e38e6SSteffen Klassert xfrm_state_hold(x); 232d77e38e6SSteffen Klassert 233d77e38e6SSteffen Klassert if (skb_is_gso(skb)) { 234d77e38e6SSteffen Klassert skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; 235d77e38e6SSteffen Klassert 236d77e38e6SSteffen Klassert return xfrm_output2(net, sk, skb); 237d77e38e6SSteffen Klassert } 238d77e38e6SSteffen Klassert 239d77e38e6SSteffen Klassert if (x->xso.dev && x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM) 240d77e38e6SSteffen Klassert goto out; 241d77e38e6SSteffen Klassert } 242d77e38e6SSteffen Klassert 243c6581a45SHerbert Xu if (skb_is_gso(skb)) 2440c4b51f0SEric W. Biederman return xfrm_output_gso(net, sk, skb); 245c6581a45SHerbert Xu 246c6581a45SHerbert Xu if (skb->ip_summed == CHECKSUM_PARTIAL) { 247c6581a45SHerbert Xu err = skb_checksum_help(skb); 248c6581a45SHerbert Xu if (err) { 24959c9940eSAlexey Dobriyan XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); 250c6581a45SHerbert Xu kfree_skb(skb); 251c6581a45SHerbert Xu return err; 252c6581a45SHerbert Xu } 253c6581a45SHerbert Xu } 254c6581a45SHerbert Xu 255d77e38e6SSteffen Klassert out: 2560c4b51f0SEric W. Biederman return xfrm_output2(net, sk, skb); 257c6581a45SHerbert Xu } 258fc68086cSFabian Frederick EXPORT_SYMBOL_GPL(xfrm_output); 259df9dcb45SKazunori MIYAZAWA 260df9dcb45SKazunori MIYAZAWA int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) 261df9dcb45SKazunori MIYAZAWA { 262df9dcb45SKazunori MIYAZAWA struct xfrm_mode *inner_mode; 263df9dcb45SKazunori MIYAZAWA if (x->sel.family == AF_UNSPEC) 264df9dcb45SKazunori MIYAZAWA inner_mode = xfrm_ip2inner_mode(x, 265adf30907SEric Dumazet xfrm_af2proto(skb_dst(skb)->ops->family)); 266df9dcb45SKazunori MIYAZAWA else 267df9dcb45SKazunori MIYAZAWA inner_mode = x->inner_mode; 268df9dcb45SKazunori MIYAZAWA 269df9dcb45SKazunori MIYAZAWA if (inner_mode == NULL) 270df9dcb45SKazunori MIYAZAWA return -EAFNOSUPPORT; 271df9dcb45SKazunori MIYAZAWA return inner_mode->afinfo->extract_output(x, skb); 272df9dcb45SKazunori MIYAZAWA } 273fc68086cSFabian Frederick EXPORT_SYMBOL_GPL(xfrm_inner_extract_output); 274df9dcb45SKazunori MIYAZAWA 275628e341fSHannes Frederic Sowa void xfrm_local_error(struct sk_buff *skb, int mtu) 276628e341fSHannes Frederic Sowa { 277844d4874SHannes Frederic Sowa unsigned int proto; 278628e341fSHannes Frederic Sowa struct xfrm_state_afinfo *afinfo; 279628e341fSHannes Frederic Sowa 280844d4874SHannes Frederic Sowa if (skb->protocol == htons(ETH_P_IP)) 281844d4874SHannes Frederic Sowa proto = AF_INET; 282844d4874SHannes Frederic Sowa else if (skb->protocol == htons(ETH_P_IPV6)) 283844d4874SHannes Frederic Sowa proto = AF_INET6; 284844d4874SHannes Frederic Sowa else 285844d4874SHannes Frederic Sowa return; 286844d4874SHannes Frederic Sowa 287844d4874SHannes Frederic Sowa afinfo = xfrm_state_get_afinfo(proto); 288af5d27c4SFlorian Westphal if (afinfo) 289628e341fSHannes Frederic Sowa afinfo->local_error(skb, mtu); 290af5d27c4SFlorian Westphal rcu_read_unlock(); 291628e341fSHannes Frederic Sowa } 292628e341fSHannes Frederic Sowa EXPORT_SYMBOL_GPL(xfrm_local_error); 293