Commit | Line | Data |
---|---|---|
2874c5fd | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
406ef77c HX |
2 | /* |
3 | * xfrm_output.c - Common IPsec encapsulation code. | |
4 | * | |
5 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> | |
406ef77c HX |
6 | */ |
7 | ||
8 | #include <linux/errno.h> | |
9 | #include <linux/module.h> | |
10 | #include <linux/netdevice.h> | |
862b82c6 | 11 | #include <linux/netfilter.h> |
406ef77c | 12 | #include <linux/skbuff.h> |
5a0e3ad6 | 13 | #include <linux/slab.h> |
406ef77c | 14 | #include <linux/spinlock.h> |
406ef77c | 15 | #include <net/dst.h> |
1de70830 | 16 | #include <net/inet_ecn.h> |
406ef77c HX |
17 | #include <net/xfrm.h> |
18 | ||
1de70830 FW |
19 | #include "xfrm_inout.h" |
20 | ||
0c4b51f0 | 21 | static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb); |
0c620e97 | 22 | static int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); |
c6581a45 | 23 | |
26b2072e | 24 | static int xfrm_skb_check_space(struct sk_buff *skb) |
83815dea | 25 | { |
adf30907 | 26 | struct dst_entry *dst = skb_dst(skb); |
550ade84 | 27 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) |
83815dea | 28 | - skb_headroom(skb); |
f5184d26 | 29 | int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); |
83815dea | 30 | |
d01dbeb6 HX |
31 | if (nhead <= 0) { |
32 | if (ntail <= 0) | |
33 | return 0; | |
34 | nhead = 0; | |
35 | } else if (ntail < 0) | |
36 | ntail = 0; | |
37 | ||
38 | return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); | |
83815dea HX |
39 | } |
40 | ||
9449c3cd YX |
41 | /* Children define the path of the packet through the |
42 | * Linux networking. Thus, destinations are stackable. | |
43 | */ | |
44 | ||
45 | static struct dst_entry *skb_dst_pop(struct sk_buff *skb) | |
46 | { | |
b92cf4aa | 47 | struct dst_entry *child = dst_clone(xfrm_dst_child(skb_dst(skb))); |
9449c3cd YX |
48 | |
49 | skb_dst_drop(skb); | |
50 | return child; | |
51 | } | |
52 | ||
0c620e97 FW |
53 | /* Add encapsulation header. |
54 | * | |
55 | * The IP header will be moved forward to make space for the encapsulation | |
56 | * header. | |
57 | */ | |
58 | static int xfrm4_transport_output(struct xfrm_state *x, struct sk_buff *skb) | |
59 | { | |
0c620e97 FW |
60 | struct iphdr *iph = ip_hdr(skb); |
61 | int ihl = iph->ihl * 4; | |
62 | ||
63 | skb_set_inner_transport_header(skb, skb_transport_offset(skb)); | |
64 | ||
65 | skb_set_network_header(skb, -x->props.header_len); | |
66 | skb->mac_header = skb->network_header + | |
67 | offsetof(struct iphdr, protocol); | |
68 | skb->transport_header = skb->network_header + ihl; | |
69 | __skb_pull(skb, ihl); | |
70 | memmove(skb_network_header(skb), iph, ihl); | |
71 | return 0; | |
0c620e97 FW |
72 | } |
73 | ||
74 | /* Add encapsulation header. | |
75 | * | |
76 | * The IP header and mutable extension headers will be moved forward to make | |
77 | * space for the encapsulation header. | |
78 | */ | |
79 | static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb) | |
80 | { | |
4c145dce | 81 | #if IS_ENABLED(CONFIG_IPV6) |
0c620e97 FW |
82 | struct ipv6hdr *iph; |
83 | u8 *prevhdr; | |
84 | int hdr_len; | |
85 | ||
86 | iph = ipv6_hdr(skb); | |
87 | skb_set_inner_transport_header(skb, skb_transport_offset(skb)); | |
88 | ||
89 | hdr_len = x->type->hdr_offset(x, skb, &prevhdr); | |
90 | if (hdr_len < 0) | |
91 | return hdr_len; | |
92 | skb_set_mac_header(skb, | |
93 | (prevhdr - x->props.header_len) - skb->data); | |
94 | skb_set_network_header(skb, -x->props.header_len); | |
95 | skb->transport_header = skb->network_header + hdr_len; | |
96 | __skb_pull(skb, hdr_len); | |
97 | memmove(ipv6_hdr(skb), iph, hdr_len); | |
98 | return 0; | |
99 | #else | |
100 | WARN_ON_ONCE(1); | |
4c145dce | 101 | return -EAFNOSUPPORT; |
0c620e97 FW |
102 | #endif |
103 | } | |
104 | ||
105 | /* Add route optimization header space. | |
106 | * | |
107 | * The IP header and mutable extension headers will be moved forward to make | |
108 | * space for the route optimization header. | |
109 | */ | |
110 | static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb) | |
111 | { | |
4c145dce | 112 | #if IS_ENABLED(CONFIG_IPV6) |
0c620e97 FW |
113 | struct ipv6hdr *iph; |
114 | u8 *prevhdr; | |
115 | int hdr_len; | |
116 | ||
117 | iph = ipv6_hdr(skb); | |
118 | ||
119 | hdr_len = x->type->hdr_offset(x, skb, &prevhdr); | |
120 | if (hdr_len < 0) | |
121 | return hdr_len; | |
122 | skb_set_mac_header(skb, | |
123 | (prevhdr - x->props.header_len) - skb->data); | |
124 | skb_set_network_header(skb, -x->props.header_len); | |
125 | skb->transport_header = skb->network_header + hdr_len; | |
126 | __skb_pull(skb, hdr_len); | |
127 | memmove(ipv6_hdr(skb), iph, hdr_len); | |
128 | ||
129 | x->lastused = ktime_get_real_seconds(); | |
130 | ||
131 | return 0; | |
132 | #else | |
133 | WARN_ON_ONCE(1); | |
4c145dce | 134 | return -EAFNOSUPPORT; |
0c620e97 FW |
135 | #endif |
136 | } | |
137 | ||
1de70830 FW |
138 | /* Add encapsulation header. |
139 | * | |
140 | * The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt. | |
141 | */ | |
142 | static int xfrm4_beet_encap_add(struct xfrm_state *x, struct sk_buff *skb) | |
143 | { | |
144 | struct ip_beet_phdr *ph; | |
145 | struct iphdr *top_iph; | |
146 | int hdrlen, optlen; | |
147 | ||
148 | hdrlen = 0; | |
149 | optlen = XFRM_MODE_SKB_CB(skb)->optlen; | |
150 | if (unlikely(optlen)) | |
151 | hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4); | |
152 | ||
153 | skb_set_network_header(skb, -x->props.header_len - hdrlen + | |
154 | (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph))); | |
155 | if (x->sel.family != AF_INET6) | |
156 | skb->network_header += IPV4_BEET_PHMAXLEN; | |
157 | skb->mac_header = skb->network_header + | |
158 | offsetof(struct iphdr, protocol); | |
159 | skb->transport_header = skb->network_header + sizeof(*top_iph); | |
160 | ||
161 | xfrm4_beet_make_header(skb); | |
162 | ||
163 | ph = __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl - hdrlen); | |
164 | ||
165 | top_iph = ip_hdr(skb); | |
166 | ||
167 | if (unlikely(optlen)) { | |
168 | if (WARN_ON(optlen < 0)) | |
169 | return -EINVAL; | |
170 | ||
171 | ph->padlen = 4 - (optlen & 4); | |
172 | ph->hdrlen = optlen / 8; | |
173 | ph->nexthdr = top_iph->protocol; | |
174 | if (ph->padlen) | |
175 | memset(ph + 1, IPOPT_NOP, ph->padlen); | |
176 | ||
177 | top_iph->protocol = IPPROTO_BEETPH; | |
178 | top_iph->ihl = sizeof(struct iphdr) / 4; | |
179 | } | |
180 | ||
181 | top_iph->saddr = x->props.saddr.a4; | |
182 | top_iph->daddr = x->id.daddr.a4; | |
183 | ||
184 | return 0; | |
185 | } | |
186 | ||
187 | /* Add encapsulation header. | |
188 | * | |
189 | * The top IP header will be constructed per RFC 2401. | |
190 | */ | |
191 | static int xfrm4_tunnel_encap_add(struct xfrm_state *x, struct sk_buff *skb) | |
192 | { | |
193 | struct dst_entry *dst = skb_dst(skb); | |
194 | struct iphdr *top_iph; | |
195 | int flags; | |
196 | ||
197 | skb_set_inner_network_header(skb, skb_network_offset(skb)); | |
198 | skb_set_inner_transport_header(skb, skb_transport_offset(skb)); | |
199 | ||
200 | skb_set_network_header(skb, -x->props.header_len); | |
201 | skb->mac_header = skb->network_header + | |
202 | offsetof(struct iphdr, protocol); | |
203 | skb->transport_header = skb->network_header + sizeof(*top_iph); | |
204 | top_iph = ip_hdr(skb); | |
205 | ||
206 | top_iph->ihl = 5; | |
207 | top_iph->version = 4; | |
208 | ||
209 | top_iph->protocol = xfrm_af2proto(skb_dst(skb)->ops->family); | |
210 | ||
211 | /* DS disclosing depends on XFRM_SA_XFLAG_DONT_ENCAP_DSCP */ | |
212 | if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP) | |
213 | top_iph->tos = 0; | |
214 | else | |
215 | top_iph->tos = XFRM_MODE_SKB_CB(skb)->tos; | |
216 | top_iph->tos = INET_ECN_encapsulate(top_iph->tos, | |
217 | XFRM_MODE_SKB_CB(skb)->tos); | |
218 | ||
219 | flags = x->props.flags; | |
220 | if (flags & XFRM_STATE_NOECN) | |
221 | IP_ECN_clear(top_iph); | |
222 | ||
223 | top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ? | |
224 | 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF)); | |
225 | ||
226 | top_iph->ttl = ip4_dst_hoplimit(xfrm_dst_child(dst)); | |
227 | ||
228 | top_iph->saddr = x->props.saddr.a4; | |
229 | top_iph->daddr = x->id.daddr.a4; | |
230 | ip_select_ident(dev_net(dst->dev), skb, NULL); | |
231 | ||
232 | return 0; | |
233 | } | |
234 | ||
235 | #if IS_ENABLED(CONFIG_IPV6) | |
236 | static int xfrm6_tunnel_encap_add(struct xfrm_state *x, struct sk_buff *skb) | |
237 | { | |
238 | struct dst_entry *dst = skb_dst(skb); | |
239 | struct ipv6hdr *top_iph; | |
240 | int dsfield; | |
241 | ||
242 | skb_set_inner_network_header(skb, skb_network_offset(skb)); | |
243 | skb_set_inner_transport_header(skb, skb_transport_offset(skb)); | |
244 | ||
245 | skb_set_network_header(skb, -x->props.header_len); | |
246 | skb->mac_header = skb->network_header + | |
247 | offsetof(struct ipv6hdr, nexthdr); | |
248 | skb->transport_header = skb->network_header + sizeof(*top_iph); | |
249 | top_iph = ipv6_hdr(skb); | |
250 | ||
251 | top_iph->version = 6; | |
252 | ||
253 | memcpy(top_iph->flow_lbl, XFRM_MODE_SKB_CB(skb)->flow_lbl, | |
254 | sizeof(top_iph->flow_lbl)); | |
255 | top_iph->nexthdr = xfrm_af2proto(skb_dst(skb)->ops->family); | |
256 | ||
257 | if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP) | |
258 | dsfield = 0; | |
259 | else | |
260 | dsfield = XFRM_MODE_SKB_CB(skb)->tos; | |
261 | dsfield = INET_ECN_encapsulate(dsfield, XFRM_MODE_SKB_CB(skb)->tos); | |
262 | if (x->props.flags & XFRM_STATE_NOECN) | |
263 | dsfield &= ~INET_ECN_MASK; | |
264 | ipv6_change_dsfield(top_iph, 0, dsfield); | |
265 | top_iph->hop_limit = ip6_dst_hoplimit(xfrm_dst_child(dst)); | |
266 | top_iph->saddr = *(struct in6_addr *)&x->props.saddr; | |
267 | top_iph->daddr = *(struct in6_addr *)&x->id.daddr; | |
268 | return 0; | |
269 | } | |
270 | ||
271 | static int xfrm6_beet_encap_add(struct xfrm_state *x, struct sk_buff *skb) | |
272 | { | |
273 | struct ipv6hdr *top_iph; | |
274 | struct ip_beet_phdr *ph; | |
275 | int optlen, hdr_len; | |
276 | ||
277 | hdr_len = 0; | |
278 | optlen = XFRM_MODE_SKB_CB(skb)->optlen; | |
279 | if (unlikely(optlen)) | |
280 | hdr_len += IPV4_BEET_PHMAXLEN - (optlen & 4); | |
281 | ||
282 | skb_set_network_header(skb, -x->props.header_len - hdr_len); | |
283 | if (x->sel.family != AF_INET6) | |
284 | skb->network_header += IPV4_BEET_PHMAXLEN; | |
285 | skb->mac_header = skb->network_header + | |
286 | offsetof(struct ipv6hdr, nexthdr); | |
287 | skb->transport_header = skb->network_header + sizeof(*top_iph); | |
288 | ph = __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl - hdr_len); | |
289 | ||
290 | xfrm6_beet_make_header(skb); | |
291 | ||
292 | top_iph = ipv6_hdr(skb); | |
293 | if (unlikely(optlen)) { | |
294 | if (WARN_ON(optlen < 0)) | |
295 | return -EINVAL; | |
296 | ||
297 | ph->padlen = 4 - (optlen & 4); | |
298 | ph->hdrlen = optlen / 8; | |
299 | ph->nexthdr = top_iph->nexthdr; | |
300 | if (ph->padlen) | |
301 | memset(ph + 1, IPOPT_NOP, ph->padlen); | |
302 | ||
303 | top_iph->nexthdr = IPPROTO_BEETPH; | |
304 | } | |
305 | ||
306 | top_iph->saddr = *(struct in6_addr *)&x->props.saddr; | |
307 | top_iph->daddr = *(struct in6_addr *)&x->id.daddr; | |
308 | return 0; | |
309 | } | |
310 | #endif | |
311 | ||
312 | /* Add encapsulation header. | |
313 | * | |
314 | * On exit, the transport header will be set to the start of the | |
315 | * encapsulation header to be filled in by x->type->output and the mac | |
316 | * header will be set to the nextheader (protocol for IPv4) field of the | |
317 | * extension header directly preceding the encapsulation header, or in | |
318 | * its absence, that of the top IP header. | |
319 | * The value of the network header will always point to the top IP header | |
320 | * while skb->data will point to the payload. | |
321 | */ | |
0c620e97 FW |
322 | static int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb) |
323 | { | |
324 | int err; | |
325 | ||
326 | err = xfrm_inner_extract_output(x, skb); | |
327 | if (err) | |
328 | return err; | |
329 | ||
330 | IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE; | |
331 | skb->protocol = htons(ETH_P_IP); | |
332 | ||
c9500d7b | 333 | switch (x->outer_mode.encap) { |
1de70830 FW |
334 | case XFRM_MODE_BEET: |
335 | return xfrm4_beet_encap_add(x, skb); | |
336 | case XFRM_MODE_TUNNEL: | |
337 | return xfrm4_tunnel_encap_add(x, skb); | |
338 | } | |
339 | ||
340 | WARN_ON_ONCE(1); | |
341 | return -EOPNOTSUPP; | |
0c620e97 FW |
342 | } |
343 | ||
344 | static int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb) | |
345 | { | |
346 | #if IS_ENABLED(CONFIG_IPV6) | |
347 | int err; | |
348 | ||
349 | err = xfrm_inner_extract_output(x, skb); | |
350 | if (err) | |
351 | return err; | |
352 | ||
353 | skb->ignore_df = 1; | |
354 | skb->protocol = htons(ETH_P_IPV6); | |
355 | ||
c9500d7b | 356 | switch (x->outer_mode.encap) { |
1de70830 FW |
357 | case XFRM_MODE_BEET: |
358 | return xfrm6_beet_encap_add(x, skb); | |
359 | case XFRM_MODE_TUNNEL: | |
360 | return xfrm6_tunnel_encap_add(x, skb); | |
361 | default: | |
362 | WARN_ON_ONCE(1); | |
363 | return -EOPNOTSUPP; | |
364 | } | |
0c620e97 | 365 | #endif |
1de70830 FW |
366 | WARN_ON_ONCE(1); |
367 | return -EAFNOSUPPORT; | |
0c620e97 FW |
368 | } |
369 | ||
370 | static int xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb) | |
371 | { | |
c9500d7b | 372 | switch (x->outer_mode.encap) { |
0c620e97 FW |
373 | case XFRM_MODE_BEET: |
374 | case XFRM_MODE_TUNNEL: | |
c9500d7b | 375 | if (x->outer_mode.family == AF_INET) |
0c620e97 | 376 | return xfrm4_prepare_output(x, skb); |
c9500d7b | 377 | if (x->outer_mode.family == AF_INET6) |
0c620e97 FW |
378 | return xfrm6_prepare_output(x, skb); |
379 | break; | |
380 | case XFRM_MODE_TRANSPORT: | |
c9500d7b | 381 | if (x->outer_mode.family == AF_INET) |
0c620e97 | 382 | return xfrm4_transport_output(x, skb); |
c9500d7b | 383 | if (x->outer_mode.family == AF_INET6) |
0c620e97 FW |
384 | return xfrm6_transport_output(x, skb); |
385 | break; | |
386 | case XFRM_MODE_ROUTEOPTIMIZATION: | |
c9500d7b | 387 | if (x->outer_mode.family == AF_INET6) |
0c620e97 FW |
388 | return xfrm6_ro_output(x, skb); |
389 | WARN_ON_ONCE(1); | |
390 | break; | |
391 | default: | |
392 | WARN_ON_ONCE(1); | |
393 | break; | |
394 | } | |
395 | ||
396 | return -EOPNOTSUPP; | |
397 | } | |
398 | ||
399 | #if IS_ENABLED(CONFIG_NET_PKTGEN) | |
400 | int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb) | |
401 | { | |
402 | return xfrm_outer_mode_output(x, skb); | |
403 | } | |
404 | EXPORT_SYMBOL_GPL(pktgen_xfrm_outer_mode_output); | |
405 | #endif | |
406 | ||
c6581a45 | 407 | static int xfrm_output_one(struct sk_buff *skb, int err) |
406ef77c | 408 | { |
adf30907 | 409 | struct dst_entry *dst = skb_dst(skb); |
406ef77c | 410 | struct xfrm_state *x = dst->xfrm; |
a6483b79 | 411 | struct net *net = xs_net(x); |
406ef77c | 412 | |
c6581a45 HX |
413 | if (err <= 0) |
414 | goto resume; | |
406ef77c HX |
415 | |
416 | do { | |
26b2072e | 417 | err = xfrm_skb_check_space(skb); |
b15c4bcd | 418 | if (err) { |
59c9940e | 419 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
910ef70a | 420 | goto error_nolock; |
b15c4bcd | 421 | } |
910ef70a | 422 | |
9b42c1f1 | 423 | skb->mark = xfrm_smark_get(skb->mark, x); |
077fbac4 | 424 | |
0c620e97 | 425 | err = xfrm_outer_mode_output(x, skb); |
b15c4bcd | 426 | if (err) { |
59c9940e | 427 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR); |
910ef70a | 428 | goto error_nolock; |
b15c4bcd | 429 | } |
a2deb6d2 | 430 | |
406ef77c | 431 | spin_lock_bh(&x->lock); |
bb65a9cb LR |
432 | |
433 | if (unlikely(x->km.state != XFRM_STATE_VALID)) { | |
434 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID); | |
497574c7 | 435 | err = -EINVAL; |
fa8599db | 436 | goto error; |
bb65a9cb LR |
437 | } |
438 | ||
910ef70a | 439 | err = xfrm_state_check_expire(x); |
b15c4bcd | 440 | if (err) { |
59c9940e | 441 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); |
406ef77c | 442 | goto error; |
b15c4bcd | 443 | } |
406ef77c | 444 | |
9fdc4883 SK |
445 | err = x->repl->overflow(x, skb); |
446 | if (err) { | |
447 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); | |
448 | goto error; | |
436a0a40 HX |
449 | } |
450 | ||
406ef77c HX |
451 | x->curlft.bytes += skb->len; |
452 | x->curlft.packets++; | |
453 | ||
406ef77c HX |
454 | spin_unlock_bh(&x->lock); |
455 | ||
3bc07321 | 456 | skb_dst_force(skb); |
9e143793 SK |
457 | if (!skb_dst(skb)) { |
458 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); | |
533555e5 | 459 | err = -EHOSTUNREACH; |
9e143793 SK |
460 | goto error_nolock; |
461 | } | |
3bc07321 | 462 | |
d77e38e6 SK |
463 | if (xfrm_offload(skb)) { |
464 | x->type_offload->encap(x, skb); | |
465 | } else { | |
73b9fc49 SK |
466 | /* Inner headers are invalid now. */ |
467 | skb->encapsulation = 0; | |
468 | ||
d77e38e6 SK |
469 | err = x->type->output(x, skb); |
470 | if (err == -EINPROGRESS) | |
471 | goto out; | |
472 | } | |
c6581a45 HX |
473 | |
474 | resume: | |
0aa64774 | 475 | if (err) { |
59c9940e | 476 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR); |
b7c6538c | 477 | goto error_nolock; |
0aa64774 | 478 | } |
b7c6538c | 479 | |
8764ab2c | 480 | dst = skb_dst_pop(skb); |
adf30907 | 481 | if (!dst) { |
59c9940e | 482 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
406ef77c HX |
483 | err = -EHOSTUNREACH; |
484 | goto error_nolock; | |
485 | } | |
e433430a | 486 | skb_dst_set(skb, dst); |
406ef77c | 487 | x = dst->xfrm; |
c9500d7b | 488 | } while (x && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL)); |
406ef77c | 489 | |
ebd4687a | 490 | return 0; |
406ef77c | 491 | |
406ef77c HX |
492 | error: |
493 | spin_unlock_bh(&x->lock); | |
862b82c6 HX |
494 | error_nolock: |
495 | kfree_skb(skb); | |
ebd4687a JS |
496 | out: |
497 | return err; | |
862b82c6 HX |
498 | } |
499 | ||
c6581a45 | 500 | int xfrm_output_resume(struct sk_buff *skb, int err) |
862b82c6 | 501 | { |
29a26a56 | 502 | struct net *net = xs_net(skb_dst(skb)->xfrm); |
be10de0a | 503 | |
c6581a45 | 504 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
862b82c6 HX |
505 | nf_reset(skb); |
506 | ||
cf91a99d | 507 | err = skb_dst(skb)->ops->local_out(net, skb->sk, skb); |
862b82c6 | 508 | if (unlikely(err != 1)) |
c6581a45 | 509 | goto out; |
862b82c6 | 510 | |
adf30907 | 511 | if (!skb_dst(skb)->xfrm) |
13206b6b | 512 | return dst_output(net, skb->sk, skb); |
862b82c6 | 513 | |
adf30907 | 514 | err = nf_hook(skb_dst(skb)->ops->family, |
29a26a56 | 515 | NF_INET_POST_ROUTING, net, skb->sk, skb, |
adf30907 | 516 | NULL, skb_dst(skb)->dev, xfrm_output2); |
862b82c6 | 517 | if (unlikely(err != 1)) |
c6581a45 | 518 | goto out; |
862b82c6 HX |
519 | } |
520 | ||
c6581a45 HX |
521 | if (err == -EINPROGRESS) |
522 | err = 0; | |
523 | ||
524 | out: | |
862b82c6 HX |
525 | return err; |
526 | } | |
c6581a45 | 527 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
862b82c6 | 528 | |
0c4b51f0 | 529 | static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb) |
862b82c6 | 530 | { |
c6581a45 HX |
531 | return xfrm_output_resume(skb, 1); |
532 | } | |
862b82c6 | 533 | |
0c4b51f0 | 534 | static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb) |
c6581a45 HX |
535 | { |
536 | struct sk_buff *segs; | |
862b82c6 | 537 | |
9207f9d4 KK |
538 | BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET); |
539 | BUILD_BUG_ON(sizeof(*IP6CB(skb)) > SKB_SGO_CB_OFFSET); | |
862b82c6 HX |
540 | segs = skb_gso_segment(skb, 0); |
541 | kfree_skb(skb); | |
801678c5 | 542 | if (IS_ERR(segs)) |
862b82c6 | 543 | return PTR_ERR(segs); |
330966e5 FW |
544 | if (segs == NULL) |
545 | return -EINVAL; | |
862b82c6 HX |
546 | |
547 | do { | |
548 | struct sk_buff *nskb = segs->next; | |
549 | int err; | |
550 | ||
a8305bff | 551 | skb_mark_not_on_list(segs); |
0c4b51f0 | 552 | err = xfrm_output2(net, sk, segs); |
862b82c6 HX |
553 | |
554 | if (unlikely(err)) { | |
46cfd725 | 555 | kfree_skb_list(nskb); |
862b82c6 HX |
556 | return err; |
557 | } | |
558 | ||
559 | segs = nskb; | |
560 | } while (segs); | |
561 | ||
562 | return 0; | |
406ef77c | 563 | } |
c6581a45 | 564 | |
7026b1dd | 565 | int xfrm_output(struct sock *sk, struct sk_buff *skb) |
c6581a45 | 566 | { |
adf30907 | 567 | struct net *net = dev_net(skb_dst(skb)->dev); |
d77e38e6 | 568 | struct xfrm_state *x = skb_dst(skb)->xfrm; |
c6581a45 HX |
569 | int err; |
570 | ||
d77e38e6 SK |
571 | secpath_reset(skb); |
572 | ||
573 | if (xfrm_dev_offload_ok(skb, x)) { | |
574 | struct sec_path *sp; | |
575 | ||
a84e3f53 | 576 | sp = secpath_set(skb); |
d77e38e6 SK |
577 | if (!sp) { |
578 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); | |
579 | kfree_skb(skb); | |
580 | return -ENOMEM; | |
581 | } | |
f1bd7d65 | 582 | skb->encapsulation = 1; |
d77e38e6 SK |
583 | |
584 | sp->olen++; | |
a84e3f53 | 585 | sp->xvec[sp->len++] = x; |
d77e38e6 SK |
586 | xfrm_state_hold(x); |
587 | ||
588 | if (skb_is_gso(skb)) { | |
589 | skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; | |
590 | ||
591 | return xfrm_output2(net, sk, skb); | |
592 | } | |
593 | ||
594 | if (x->xso.dev && x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM) | |
595 | goto out; | |
596 | } | |
597 | ||
c6581a45 | 598 | if (skb_is_gso(skb)) |
0c4b51f0 | 599 | return xfrm_output_gso(net, sk, skb); |
c6581a45 HX |
600 | |
601 | if (skb->ip_summed == CHECKSUM_PARTIAL) { | |
602 | err = skb_checksum_help(skb); | |
603 | if (err) { | |
59c9940e | 604 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
c6581a45 HX |
605 | kfree_skb(skb); |
606 | return err; | |
607 | } | |
608 | } | |
609 | ||
d77e38e6 | 610 | out: |
0c4b51f0 | 611 | return xfrm_output2(net, sk, skb); |
c6581a45 | 612 | } |
fc68086c | 613 | EXPORT_SYMBOL_GPL(xfrm_output); |
df9dcb45 | 614 | |
0c620e97 | 615 | static int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) |
df9dcb45 | 616 | { |
733a5fac | 617 | const struct xfrm_state_afinfo *afinfo; |
4c145dce | 618 | const struct xfrm_mode *inner_mode; |
733a5fac FW |
619 | int err = -EAFNOSUPPORT; |
620 | ||
df9dcb45 KM |
621 | if (x->sel.family == AF_UNSPEC) |
622 | inner_mode = xfrm_ip2inner_mode(x, | |
adf30907 | 623 | xfrm_af2proto(skb_dst(skb)->ops->family)); |
df9dcb45 | 624 | else |
c9500d7b | 625 | inner_mode = &x->inner_mode; |
df9dcb45 KM |
626 | |
627 | if (inner_mode == NULL) | |
628 | return -EAFNOSUPPORT; | |
733a5fac FW |
629 | |
630 | rcu_read_lock(); | |
631 | afinfo = xfrm_state_afinfo_get_rcu(inner_mode->family); | |
632 | if (likely(afinfo)) | |
633 | err = afinfo->extract_output(x, skb); | |
634 | rcu_read_unlock(); | |
635 | ||
636 | return err; | |
df9dcb45 KM |
637 | } |
638 | ||
628e341f HFS |
639 | void xfrm_local_error(struct sk_buff *skb, int mtu) |
640 | { | |
844d4874 | 641 | unsigned int proto; |
628e341f HFS |
642 | struct xfrm_state_afinfo *afinfo; |
643 | ||
844d4874 HFS |
644 | if (skb->protocol == htons(ETH_P_IP)) |
645 | proto = AF_INET; | |
646 | else if (skb->protocol == htons(ETH_P_IPV6)) | |
647 | proto = AF_INET6; | |
648 | else | |
649 | return; | |
650 | ||
651 | afinfo = xfrm_state_get_afinfo(proto); | |
46c0ef6e | 652 | if (afinfo) { |
af5d27c4 | 653 | afinfo->local_error(skb, mtu); |
46c0ef6e TY |
654 | rcu_read_unlock(); |
655 | } | |
628e341f | 656 | } |
628e341f | 657 | EXPORT_SYMBOL_GPL(xfrm_local_error); |