Root/
1 | /* |
2 | * xfrm_output.c - Common IPsec encapsulation code. |
3 | * |
4 | * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au> |
5 | * |
6 | * This program is free software; you can redistribute it and/or |
7 | * modify it under the terms of the GNU General Public License |
8 | * as published by the Free Software Foundation; either version |
9 | * 2 of the License, or (at your option) any later version. |
10 | */ |
11 | |
12 | #include <linux/errno.h> |
13 | #include <linux/module.h> |
14 | #include <linux/netdevice.h> |
15 | #include <linux/netfilter.h> |
16 | #include <linux/skbuff.h> |
17 | #include <linux/slab.h> |
18 | #include <linux/spinlock.h> |
19 | #include <net/dst.h> |
20 | #include <net/xfrm.h> |
21 | |
22 | static int xfrm_output2(struct sk_buff *skb); |
23 | |
24 | static int xfrm_state_check_space(struct xfrm_state *x, struct sk_buff *skb) |
25 | { |
26 | struct dst_entry *dst = skb_dst(skb); |
27 | int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev) |
28 | - skb_headroom(skb); |
29 | int ntail = dst->dev->needed_tailroom - skb_tailroom(skb); |
30 | |
31 | if (nhead <= 0) { |
32 | if (ntail <= 0) |
33 | return 0; |
34 | nhead = 0; |
35 | } else if (ntail < 0) |
36 | ntail = 0; |
37 | |
38 | return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC); |
39 | } |
40 | |
41 | static int xfrm_output_one(struct sk_buff *skb, int err) |
42 | { |
43 | struct dst_entry *dst = skb_dst(skb); |
44 | struct xfrm_state *x = dst->xfrm; |
45 | struct net *net = xs_net(x); |
46 | |
47 | if (err <= 0) |
48 | goto resume; |
49 | |
50 | do { |
51 | err = xfrm_state_check_space(x, skb); |
52 | if (err) { |
53 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
54 | goto error_nolock; |
55 | } |
56 | |
57 | err = x->outer_mode->output(x, skb); |
58 | if (err) { |
59 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR); |
60 | goto error_nolock; |
61 | } |
62 | |
63 | spin_lock_bh(&x->lock); |
64 | err = xfrm_state_check_expire(x); |
65 | if (err) { |
66 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED); |
67 | goto error; |
68 | } |
69 | |
70 | if (x->type->flags & XFRM_TYPE_REPLAY_PROT) { |
71 | XFRM_SKB_CB(skb)->seq.output = ++x->replay.oseq; |
72 | if (unlikely(x->replay.oseq == 0)) { |
73 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR); |
74 | x->replay.oseq--; |
75 | xfrm_audit_state_replay_overflow(x, skb); |
76 | err = -EOVERFLOW; |
77 | goto error; |
78 | } |
79 | if (xfrm_aevent_is_on(net)) |
80 | xfrm_replay_notify(x, XFRM_REPLAY_UPDATE); |
81 | } |
82 | |
83 | x->curlft.bytes += skb->len; |
84 | x->curlft.packets++; |
85 | |
86 | spin_unlock_bh(&x->lock); |
87 | |
88 | err = x->type->output(x, skb); |
89 | if (err == -EINPROGRESS) |
90 | goto out_exit; |
91 | |
92 | resume: |
93 | if (err) { |
94 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR); |
95 | goto error_nolock; |
96 | } |
97 | |
98 | dst = dst_pop(dst); |
99 | if (!dst) { |
100 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
101 | err = -EHOSTUNREACH; |
102 | goto error_nolock; |
103 | } |
104 | skb_dst_set(skb, dst); |
105 | x = dst->xfrm; |
106 | } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL)); |
107 | |
108 | err = 0; |
109 | |
110 | out_exit: |
111 | return err; |
112 | error: |
113 | spin_unlock_bh(&x->lock); |
114 | error_nolock: |
115 | kfree_skb(skb); |
116 | goto out_exit; |
117 | } |
118 | |
119 | int xfrm_output_resume(struct sk_buff *skb, int err) |
120 | { |
121 | while (likely((err = xfrm_output_one(skb, err)) == 0)) { |
122 | nf_reset(skb); |
123 | |
124 | err = skb_dst(skb)->ops->local_out(skb); |
125 | if (unlikely(err != 1)) |
126 | goto out; |
127 | |
128 | if (!skb_dst(skb)->xfrm) |
129 | return dst_output(skb); |
130 | |
131 | err = nf_hook(skb_dst(skb)->ops->family, |
132 | NF_INET_POST_ROUTING, skb, |
133 | NULL, skb_dst(skb)->dev, xfrm_output2); |
134 | if (unlikely(err != 1)) |
135 | goto out; |
136 | } |
137 | |
138 | if (err == -EINPROGRESS) |
139 | err = 0; |
140 | |
141 | out: |
142 | return err; |
143 | } |
144 | EXPORT_SYMBOL_GPL(xfrm_output_resume); |
145 | |
146 | static int xfrm_output2(struct sk_buff *skb) |
147 | { |
148 | return xfrm_output_resume(skb, 1); |
149 | } |
150 | |
151 | static int xfrm_output_gso(struct sk_buff *skb) |
152 | { |
153 | struct sk_buff *segs; |
154 | |
155 | segs = skb_gso_segment(skb, 0); |
156 | kfree_skb(skb); |
157 | if (IS_ERR(segs)) |
158 | return PTR_ERR(segs); |
159 | |
160 | do { |
161 | struct sk_buff *nskb = segs->next; |
162 | int err; |
163 | |
164 | segs->next = NULL; |
165 | err = xfrm_output2(segs); |
166 | |
167 | if (unlikely(err)) { |
168 | while ((segs = nskb)) { |
169 | nskb = segs->next; |
170 | segs->next = NULL; |
171 | kfree_skb(segs); |
172 | } |
173 | return err; |
174 | } |
175 | |
176 | segs = nskb; |
177 | } while (segs); |
178 | |
179 | return 0; |
180 | } |
181 | |
182 | int xfrm_output(struct sk_buff *skb) |
183 | { |
184 | struct net *net = dev_net(skb_dst(skb)->dev); |
185 | int err; |
186 | |
187 | if (skb_is_gso(skb)) |
188 | return xfrm_output_gso(skb); |
189 | |
190 | if (skb->ip_summed == CHECKSUM_PARTIAL) { |
191 | err = skb_checksum_help(skb); |
192 | if (err) { |
193 | XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR); |
194 | kfree_skb(skb); |
195 | return err; |
196 | } |
197 | } |
198 | |
199 | return xfrm_output2(skb); |
200 | } |
201 | |
202 | int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) |
203 | { |
204 | struct xfrm_mode *inner_mode; |
205 | if (x->sel.family == AF_UNSPEC) |
206 | inner_mode = xfrm_ip2inner_mode(x, |
207 | xfrm_af2proto(skb_dst(skb)->ops->family)); |
208 | else |
209 | inner_mode = x->inner_mode; |
210 | |
211 | if (inner_mode == NULL) |
212 | return -EAFNOSUPPORT; |
213 | return inner_mode->afinfo->extract_output(x, skb); |
214 | } |
215 | |
216 | EXPORT_SYMBOL_GPL(xfrm_output); |
217 | EXPORT_SYMBOL_GPL(xfrm_inner_extract_output); |
218 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9