~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/esp4_offload.c

Version: ~ [ linux-5.9 ] ~ [ linux-5.8.14 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.70 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.150 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.200 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.238 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.238 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.85 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * IPV4 GSO/GRO offload support
  3  * Linux INET implementation
  4  *
  5  * Copyright (C) 2016 secunet Security Networks AG
  6  * Author: Steffen Klassert <steffen.klassert@secunet.com>
  7  *
  8  * This program is free software; you can redistribute it and/or modify it
  9  * under the terms and conditions of the GNU General Public License,
 10  * version 2, as published by the Free Software Foundation.
 11  *
 12  * ESP GRO support
 13  */
 14 
 15 #include <linux/skbuff.h>
 16 #include <linux/init.h>
 17 #include <net/protocol.h>
 18 #include <crypto/aead.h>
 19 #include <crypto/authenc.h>
 20 #include <linux/err.h>
 21 #include <linux/module.h>
 22 #include <net/ip.h>
 23 #include <net/xfrm.h>
 24 #include <net/esp.h>
 25 #include <linux/scatterlist.h>
 26 #include <linux/kernel.h>
 27 #include <linux/slab.h>
 28 #include <linux/spinlock.h>
 29 #include <net/udp.h>
 30 
 31 static struct sk_buff **esp4_gro_receive(struct sk_buff **head,
 32                                          struct sk_buff *skb)
 33 {
 34         int offset = skb_gro_offset(skb);
 35         struct xfrm_offload *xo;
 36         struct xfrm_state *x;
 37         __be32 seq;
 38         __be32 spi;
 39         int err;
 40 
 41         if (!pskb_pull(skb, offset))
 42                 return NULL;
 43 
 44         if ((err = xfrm_parse_spi(skb, IPPROTO_ESP, &spi, &seq)) != 0)
 45                 goto out;
 46 
 47         xo = xfrm_offload(skb);
 48         if (!xo || !(xo->flags & CRYPTO_DONE)) {
 49                 err = secpath_set(skb);
 50                 if (err)
 51                         goto out;
 52 
 53                 if (skb->sp->len == XFRM_MAX_DEPTH)
 54                         goto out;
 55 
 56                 x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,
 57                                       (xfrm_address_t *)&ip_hdr(skb)->daddr,
 58                                       spi, IPPROTO_ESP, AF_INET);
 59                 if (!x)
 60                         goto out;
 61 
 62                 skb->sp->xvec[skb->sp->len++] = x;
 63                 skb->sp->olen++;
 64 
 65                 xo = xfrm_offload(skb);
 66                 if (!xo) {
 67                         xfrm_state_put(x);
 68                         goto out;
 69                 }
 70         }
 71 
 72         xo->flags |= XFRM_GRO;
 73 
 74         XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
 75         XFRM_SPI_SKB_CB(skb)->family = AF_INET;
 76         XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
 77         XFRM_SPI_SKB_CB(skb)->seq = seq;
 78 
 79         /* We don't need to handle errors from xfrm_input, it does all
 80          * the error handling and frees the resources on error. */
 81         xfrm_input(skb, IPPROTO_ESP, spi, -2);
 82 
 83         return ERR_PTR(-EINPROGRESS);
 84 out:
 85         skb_push(skb, offset);
 86         NAPI_GRO_CB(skb)->same_flow = 0;
 87         NAPI_GRO_CB(skb)->flush = 1;
 88 
 89         return NULL;
 90 }
 91 
 92 static void esp4_gso_encap(struct xfrm_state *x, struct sk_buff *skb)
 93 {
 94         struct ip_esp_hdr *esph;
 95         struct iphdr *iph = ip_hdr(skb);
 96         struct xfrm_offload *xo = xfrm_offload(skb);
 97         int proto = iph->protocol;
 98 
 99         skb_push(skb, -skb_network_offset(skb));
100         esph = ip_esp_hdr(skb);
101         *skb_mac_header(skb) = IPPROTO_ESP;
102 
103         esph->spi = x->id.spi;
104         esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low);
105 
106         xo->proto = proto;
107 }
108 
109 static struct sk_buff *esp4_gso_segment(struct sk_buff *skb,
110                                         netdev_features_t features)
111 {
112         __u32 seq;
113         int err = 0;
114         struct sk_buff *skb2;
115         struct xfrm_state *x;
116         struct ip_esp_hdr *esph;
117         struct crypto_aead *aead;
118         struct sk_buff *segs = ERR_PTR(-EINVAL);
119         netdev_features_t esp_features = features;
120         struct xfrm_offload *xo = xfrm_offload(skb);
121 
122         if (!xo)
123                 goto out;
124 
125         if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))
126                 goto out;
127 
128         seq = xo->seq.low;
129 
130         x = skb->sp->xvec[skb->sp->len - 1];
131         aead = x->data;
132         esph = ip_esp_hdr(skb);
133 
134         if (esph->spi != x->id.spi)
135                 goto out;
136 
137         if (!pskb_may_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead)))
138                 goto out;
139 
140         __skb_pull(skb, sizeof(*esph) + crypto_aead_ivsize(aead));
141 
142         skb->encap_hdr_csum = 1;
143 
144         if (!(features & NETIF_F_HW_ESP))
145                 esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK);
146 
147         segs = x->outer_mode->gso_segment(x, skb, esp_features);
148         if (IS_ERR_OR_NULL(segs))
149                 goto out;
150 
151         __skb_pull(skb, skb->data - skb_mac_header(skb));
152 
153         skb2 = segs;
154         do {
155                 struct sk_buff *nskb = skb2->next;
156 
157                 xo = xfrm_offload(skb2);
158                 xo->flags |= XFRM_GSO_SEGMENT;
159                 xo->seq.low = seq;
160                 xo->seq.hi = xfrm_replay_seqhi(x, seq);
161 
162                 if(!(features & NETIF_F_HW_ESP))
163                         xo->flags |= CRYPTO_FALLBACK;
164 
165                 x->outer_mode->xmit(x, skb2);
166 
167                 err = x->type_offload->xmit(x, skb2, esp_features);
168                 if (err) {
169                         kfree_skb_list(segs);
170                         return ERR_PTR(err);
171                 }
172 
173                 if (!skb_is_gso(skb2))
174                         seq++;
175                 else
176                         seq += skb_shinfo(skb2)->gso_segs;
177 
178                 skb_push(skb2, skb2->mac_len);
179                 skb2 = nskb;
180         } while (skb2);
181 
182 out:
183         return segs;
184 }
185 
186 static int esp_input_tail(struct xfrm_state *x, struct sk_buff *skb)
187 {
188         struct crypto_aead *aead = x->data;
189         struct xfrm_offload *xo = xfrm_offload(skb);
190 
191         if (!pskb_may_pull(skb, sizeof(struct ip_esp_hdr) + crypto_aead_ivsize(aead)))
192                 return -EINVAL;
193 
194         if (!(xo->flags & CRYPTO_DONE))
195                 skb->ip_summed = CHECKSUM_NONE;
196 
197         return esp_input_done2(skb, 0);
198 }
199 
200 static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb,  netdev_features_t features)
201 {
202         int err;
203         int alen;
204         int blksize;
205         struct xfrm_offload *xo;
206         struct ip_esp_hdr *esph;
207         struct crypto_aead *aead;
208         struct esp_info esp;
209         bool hw_offload = true;
210 
211         esp.inplace = true;
212 
213         xo = xfrm_offload(skb);
214 
215         if (!xo)
216                 return -EINVAL;
217 
218         if (!(features & NETIF_F_HW_ESP) || !x->xso.offload_handle ||
219             (x->xso.dev != skb->dev)) {
220                 xo->flags |= CRYPTO_FALLBACK;
221                 hw_offload = false;
222         }
223 
224         esp.proto = xo->proto;
225 
226         /* skb is pure payload to encrypt */
227 
228         aead = x->data;
229         alen = crypto_aead_authsize(aead);
230 
231         esp.tfclen = 0;
232         /* XXX: Add support for tfc padding here. */
233 
234         blksize = ALIGN(crypto_aead_blocksize(aead), 4);
235         esp.clen = ALIGN(skb->len + 2 + esp.tfclen, blksize);
236         esp.plen = esp.clen - skb->len - esp.tfclen;
237         esp.tailen = esp.tfclen + esp.plen + alen;
238 
239         esp.esph = ip_esp_hdr(skb);
240 
241 
242         if (!hw_offload || (hw_offload && !skb_is_gso(skb))) {
243                 esp.nfrags = esp_output_head(x, skb, &esp);
244                 if (esp.nfrags < 0)
245                         return esp.nfrags;
246         }
247 
248         esph = esp.esph;
249         esph->spi = x->id.spi;
250 
251         skb_push(skb, -skb_network_offset(skb));
252 
253         if (xo->flags & XFRM_GSO_SEGMENT) {
254                 esph->seq_no = htonl(xo->seq.low);
255         } else {
256                 ip_hdr(skb)->tot_len = htons(skb->len);
257                 ip_send_check(ip_hdr(skb));
258         }
259 
260         if (hw_offload)
261                 return 0;
262 
263         esp.seqno = cpu_to_be64(xo->seq.low + ((u64)xo->seq.hi << 32));
264 
265         err = esp_output_tail(x, skb, &esp);
266         if (err)
267                 return err;
268 
269         secpath_reset(skb);
270 
271         return 0;
272 }
273 
274 static const struct net_offload esp4_offload = {
275         .callbacks = {
276                 .gro_receive = esp4_gro_receive,
277                 .gso_segment = esp4_gso_segment,
278         },
279 };
280 
281 static const struct xfrm_type_offload esp_type_offload = {
282         .description    = "ESP4 OFFLOAD",
283         .owner          = THIS_MODULE,
284         .proto          = IPPROTO_ESP,
285         .input_tail     = esp_input_tail,
286         .xmit           = esp_xmit,
287         .encap          = esp4_gso_encap,
288 };
289 
290 static int __init esp4_offload_init(void)
291 {
292         if (xfrm_register_type_offload(&esp_type_offload, AF_INET) < 0) {
293                 pr_info("%s: can't add xfrm type offload\n", __func__);
294                 return -EAGAIN;
295         }
296 
297         return inet_add_offload(&esp4_offload, IPPROTO_ESP);
298 }
299 
300 static void __exit esp4_offload_exit(void)
301 {
302         if (xfrm_unregister_type_offload(&esp_type_offload, AF_INET) < 0)
303                 pr_info("%s: can't remove xfrm type offload\n", __func__);
304 
305         inet_del_offload(&esp4_offload, IPPROTO_ESP);
306 }
307 
308 module_init(esp4_offload_init);
309 module_exit(esp4_offload_exit);
310 MODULE_LICENSE("GPL");
311 MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
312 MODULE_ALIAS_XFRM_OFFLOAD_TYPE(AF_INET, XFRM_PROTO_ESP);
313 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp