Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
xfrm_output.c
Go to the documentation of this file.
1 /*
2  * xfrm_output.c - Common IPsec encapsulation code.
3  *
4  * Copyright (c) 2007 Herbert Xu <[email protected]>
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU General Public License
8  * as published by the Free Software Foundation; either version
9  * 2 of the License, or (at your option) any later version.
10  */
11 
12 #include <linux/errno.h>
13 #include <linux/module.h>
14 #include <linux/netdevice.h>
15 #include <linux/netfilter.h>
16 #include <linux/skbuff.h>
17 #include <linux/slab.h>
18 #include <linux/spinlock.h>
19 #include <net/dst.h>
20 #include <net/xfrm.h>
21 
22 static int xfrm_output2(struct sk_buff *skb);
23 
24 static int xfrm_skb_check_space(struct sk_buff *skb)
25 {
26  struct dst_entry *dst = skb_dst(skb);
27  int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev)
28  - skb_headroom(skb);
29  int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
30 
31  if (nhead <= 0) {
32  if (ntail <= 0)
33  return 0;
34  nhead = 0;
35  } else if (ntail < 0)
36  ntail = 0;
37 
38  return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
39 }
40 
41 static int xfrm_output_one(struct sk_buff *skb, int err)
42 {
43  struct dst_entry *dst = skb_dst(skb);
44  struct xfrm_state *x = dst->xfrm;
45  struct net *net = xs_net(x);
46 
47  if (err <= 0)
48  goto resume;
49 
50  do {
51  err = xfrm_skb_check_space(skb);
52  if (err) {
54  goto error_nolock;
55  }
56 
57  err = x->outer_mode->output(x, skb);
58  if (err) {
60  goto error_nolock;
61  }
62 
63  spin_lock_bh(&x->lock);
64  err = xfrm_state_check_expire(x);
65  if (err) {
67  goto error;
68  }
69 
70  err = x->repl->overflow(x, skb);
71  if (err) {
73  goto error;
74  }
75 
76  x->curlft.bytes += skb->len;
77  x->curlft.packets++;
78 
79  spin_unlock_bh(&x->lock);
80 
81  skb_dst_force(skb);
82 
83  err = x->type->output(x, skb);
84  if (err == -EINPROGRESS)
85  goto out_exit;
86 
87 resume:
88  if (err) {
90  goto error_nolock;
91  }
92 
93  dst = skb_dst_pop(skb);
94  if (!dst) {
96  err = -EHOSTUNREACH;
97  goto error_nolock;
98  }
99  skb_dst_set(skb, dst);
100  x = dst->xfrm;
101  } while (x && !(x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL));
102 
103  err = 0;
104 
105 out_exit:
106  return err;
107 error:
108  spin_unlock_bh(&x->lock);
109 error_nolock:
110  kfree_skb(skb);
111  goto out_exit;
112 }
113 
114 int xfrm_output_resume(struct sk_buff *skb, int err)
115 {
116  while (likely((err = xfrm_output_one(skb, err)) == 0)) {
117  nf_reset(skb);
118 
119  err = skb_dst(skb)->ops->local_out(skb);
120  if (unlikely(err != 1))
121  goto out;
122 
123  if (!skb_dst(skb)->xfrm)
124  return dst_output(skb);
125 
126  err = nf_hook(skb_dst(skb)->ops->family,
128  NULL, skb_dst(skb)->dev, xfrm_output2);
129  if (unlikely(err != 1))
130  goto out;
131  }
132 
133  if (err == -EINPROGRESS)
134  err = 0;
135 
136 out:
137  return err;
138 }
140 
141 static int xfrm_output2(struct sk_buff *skb)
142 {
143  return xfrm_output_resume(skb, 1);
144 }
145 
146 static int xfrm_output_gso(struct sk_buff *skb)
147 {
148  struct sk_buff *segs;
149 
150  segs = skb_gso_segment(skb, 0);
151  kfree_skb(skb);
152  if (IS_ERR(segs))
153  return PTR_ERR(segs);
154 
155  do {
156  struct sk_buff *nskb = segs->next;
157  int err;
158 
159  segs->next = NULL;
160  err = xfrm_output2(segs);
161 
162  if (unlikely(err)) {
163  while ((segs = nskb)) {
164  nskb = segs->next;
165  segs->next = NULL;
166  kfree_skb(segs);
167  }
168  return err;
169  }
170 
171  segs = nskb;
172  } while (segs);
173 
174  return 0;
175 }
176 
177 int xfrm_output(struct sk_buff *skb)
178 {
179  struct net *net = dev_net(skb_dst(skb)->dev);
180  int err;
181 
182  if (skb_is_gso(skb))
183  return xfrm_output_gso(skb);
184 
185  if (skb->ip_summed == CHECKSUM_PARTIAL) {
186  err = skb_checksum_help(skb);
187  if (err) {
189  kfree_skb(skb);
190  return err;
191  }
192  }
193 
194  return xfrm_output2(skb);
195 }
196 
197 int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
198 {
199  struct xfrm_mode *inner_mode;
200  if (x->sel.family == AF_UNSPEC)
201  inner_mode = xfrm_ip2inner_mode(x,
202  xfrm_af2proto(skb_dst(skb)->ops->family));
203  else
204  inner_mode = x->inner_mode;
205 
206  if (inner_mode == NULL)
207  return -EAFNOSUPPORT;
208  return inner_mode->afinfo->extract_output(x, skb);
209 }
210