~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/xfrm/xfrm_output.c

Version: ~ [ linux-5.15-rc5 ] ~ [ linux-5.14.11 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.72 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.152 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.210 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.250 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.286 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.288 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-or-later
  2 /*
  3  * xfrm_output.c - Common IPsec encapsulation code.
  4  *
  5  * Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
  6  */
  7 
  8 #include <linux/errno.h>
  9 #include <linux/module.h>
 10 #include <linux/netdevice.h>
 11 #include <linux/netfilter.h>
 12 #include <linux/skbuff.h>
 13 #include <linux/slab.h>
 14 #include <linux/spinlock.h>
 15 #include <net/dst.h>
 16 #include <net/inet_ecn.h>
 17 #include <net/xfrm.h>
 18 
 19 #include "xfrm_inout.h"
 20 
 21 static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb);
 22 static int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
 23 
 24 static int xfrm_skb_check_space(struct sk_buff *skb)
 25 {
 26         struct dst_entry *dst = skb_dst(skb);
 27         int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev)
 28                 - skb_headroom(skb);
 29         int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
 30 
 31         if (nhead <= 0) {
 32                 if (ntail <= 0)
 33                         return 0;
 34                 nhead = 0;
 35         } else if (ntail < 0)
 36                 ntail = 0;
 37 
 38         return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
 39 }
 40 
 41 /* Children define the path of the packet through the
 42  * Linux networking.  Thus, destinations are stackable.
 43  */
 44 
 45 static struct dst_entry *skb_dst_pop(struct sk_buff *skb)
 46 {
 47         struct dst_entry *child = dst_clone(xfrm_dst_child(skb_dst(skb)));
 48 
 49         skb_dst_drop(skb);
 50         return child;
 51 }
 52 
 53 /* Add encapsulation header.
 54  *
 55  * The IP header will be moved forward to make space for the encapsulation
 56  * header.
 57  */
 58 static int xfrm4_transport_output(struct xfrm_state *x, struct sk_buff *skb)
 59 {
 60         struct iphdr *iph = ip_hdr(skb);
 61         int ihl = iph->ihl * 4;
 62 
 63         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
 64 
 65         skb_set_network_header(skb, -x->props.header_len);
 66         skb->mac_header = skb->network_header +
 67                           offsetof(struct iphdr, protocol);
 68         skb->transport_header = skb->network_header + ihl;
 69         __skb_pull(skb, ihl);
 70         memmove(skb_network_header(skb), iph, ihl);
 71         return 0;
 72 }
 73 
 74 /* Add encapsulation header.
 75  *
 76  * The IP header and mutable extension headers will be moved forward to make
 77  * space for the encapsulation header.
 78  */
 79 static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
 80 {
 81 #if IS_ENABLED(CONFIG_IPV6)
 82         struct ipv6hdr *iph;
 83         u8 *prevhdr;
 84         int hdr_len;
 85 
 86         iph = ipv6_hdr(skb);
 87         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
 88 
 89         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
 90         if (hdr_len < 0)
 91                 return hdr_len;
 92         skb_set_mac_header(skb,
 93                            (prevhdr - x->props.header_len) - skb->data);
 94         skb_set_network_header(skb, -x->props.header_len);
 95         skb->transport_header = skb->network_header + hdr_len;
 96         __skb_pull(skb, hdr_len);
 97         memmove(ipv6_hdr(skb), iph, hdr_len);
 98         return 0;
 99 #else
100         WARN_ON_ONCE(1);
101         return -EAFNOSUPPORT;
102 #endif
103 }
104 
105 /* Add route optimization header space.
106  *
107  * The IP header and mutable extension headers will be moved forward to make
108  * space for the route optimization header.
109  */
110 static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
111 {
112 #if IS_ENABLED(CONFIG_IPV6)
113         struct ipv6hdr *iph;
114         u8 *prevhdr;
115         int hdr_len;
116 
117         iph = ipv6_hdr(skb);
118 
119         hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
120         if (hdr_len < 0)
121                 return hdr_len;
122         skb_set_mac_header(skb,
123                            (prevhdr - x->props.header_len) - skb->data);
124         skb_set_network_header(skb, -x->props.header_len);
125         skb->transport_header = skb->network_header + hdr_len;
126         __skb_pull(skb, hdr_len);
127         memmove(ipv6_hdr(skb), iph, hdr_len);
128 
129         x->lastused = ktime_get_real_seconds();
130 
131         return 0;
132 #else
133         WARN_ON_ONCE(1);
134         return -EAFNOSUPPORT;
135 #endif
136 }
137 
138 /* Add encapsulation header.
139  *
140  * The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt.
141  */
142 static int xfrm4_beet_encap_add(struct xfrm_state *x, struct sk_buff *skb)
143 {
144         struct ip_beet_phdr *ph;
145         struct iphdr *top_iph;
146         int hdrlen, optlen;
147 
148         hdrlen = 0;
149         optlen = XFRM_MODE_SKB_CB(skb)->optlen;
150         if (unlikely(optlen))
151                 hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
152 
153         skb_set_network_header(skb, -x->props.header_len - hdrlen +
154                                (XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
155         if (x->sel.family != AF_INET6)
156                 skb->network_header += IPV4_BEET_PHMAXLEN;
157         skb->mac_header = skb->network_header +
158                           offsetof(struct iphdr, protocol);
159         skb->transport_header = skb->network_header + sizeof(*top_iph);
160 
161         xfrm4_beet_make_header(skb);
162 
163         ph = __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl - hdrlen);
164 
165         top_iph = ip_hdr(skb);
166 
167         if (unlikely(optlen)) {
168                 if (WARN_ON(optlen < 0))
169                         return -EINVAL;
170 
171                 ph->padlen = 4 - (optlen & 4);
172                 ph->hdrlen = optlen / 8;
173                 ph->nexthdr = top_iph->protocol;
174                 if (ph->padlen)
175                         memset(ph + 1, IPOPT_NOP, ph->padlen);
176 
177                 top_iph->protocol = IPPROTO_BEETPH;
178                 top_iph->ihl = sizeof(struct iphdr) / 4;
179         }
180 
181         top_iph->saddr = x->props.saddr.a4;
182         top_iph->daddr = x->id.daddr.a4;
183 
184         return 0;
185 }
186 
187 /* Add encapsulation header.
188  *
189  * The top IP header will be constructed per RFC 2401.
190  */
191 static int xfrm4_tunnel_encap_add(struct xfrm_state *x, struct sk_buff *skb)
192 {
193         struct dst_entry *dst = skb_dst(skb);
194         struct iphdr *top_iph;
195         int flags;
196 
197         skb_set_inner_network_header(skb, skb_network_offset(skb));
198         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
199 
200         skb_set_network_header(skb, -x->props.header_len);
201         skb->mac_header = skb->network_header +
202                           offsetof(struct iphdr, protocol);
203         skb->transport_header = skb->network_header + sizeof(*top_iph);
204         top_iph = ip_hdr(skb);
205 
206         top_iph->ihl = 5;
207         top_iph->version = 4;
208 
209         top_iph->protocol = xfrm_af2proto(skb_dst(skb)->ops->family);
210 
211         /* DS disclosing depends on XFRM_SA_XFLAG_DONT_ENCAP_DSCP */
212         if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP)
213                 top_iph->tos = 0;
214         else
215                 top_iph->tos = XFRM_MODE_SKB_CB(skb)->tos;
216         top_iph->tos = INET_ECN_encapsulate(top_iph->tos,
217                                             XFRM_MODE_SKB_CB(skb)->tos);
218 
219         flags = x->props.flags;
220         if (flags & XFRM_STATE_NOECN)
221                 IP_ECN_clear(top_iph);
222 
223         top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
224                 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
225 
226         top_iph->ttl = ip4_dst_hoplimit(xfrm_dst_child(dst));
227 
228         top_iph->saddr = x->props.saddr.a4;
229         top_iph->daddr = x->id.daddr.a4;
230         ip_select_ident(dev_net(dst->dev), skb, NULL);
231 
232         return 0;
233 }
234 
235 #if IS_ENABLED(CONFIG_IPV6)
236 static int xfrm6_tunnel_encap_add(struct xfrm_state *x, struct sk_buff *skb)
237 {
238         struct dst_entry *dst = skb_dst(skb);
239         struct ipv6hdr *top_iph;
240         int dsfield;
241 
242         skb_set_inner_network_header(skb, skb_network_offset(skb));
243         skb_set_inner_transport_header(skb, skb_transport_offset(skb));
244 
245         skb_set_network_header(skb, -x->props.header_len);
246         skb->mac_header = skb->network_header +
247                           offsetof(struct ipv6hdr, nexthdr);
248         skb->transport_header = skb->network_header + sizeof(*top_iph);
249         top_iph = ipv6_hdr(skb);
250 
251         top_iph->version = 6;
252 
253         memcpy(top_iph->flow_lbl, XFRM_MODE_SKB_CB(skb)->flow_lbl,
254                sizeof(top_iph->flow_lbl));
255         top_iph->nexthdr = xfrm_af2proto(skb_dst(skb)->ops->family);
256 
257         if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP)
258                 dsfield = 0;
259         else
260                 dsfield = XFRM_MODE_SKB_CB(skb)->tos;
261         dsfield = INET_ECN_encapsulate(dsfield, XFRM_MODE_SKB_CB(skb)->tos);
262         if (x->props.flags & XFRM_STATE_NOECN)
263                 dsfield &= ~INET_ECN_MASK;
264         ipv6_change_dsfield(top_iph, 0, dsfield);
265         top_iph->hop_limit = ip6_dst_hoplimit(xfrm_dst_child(dst));
266         top_iph->saddr = *(struct in6_addr *)&x->props.saddr;
267         top_iph->daddr = *(struct in6_addr *)&x->id.daddr;
268         return 0;
269 }
270 
271 static int xfrm6_beet_encap_add(struct xfrm_state *x, struct sk_buff *skb)
272 {
273         struct ipv6hdr *top_iph;
274         struct ip_beet_phdr *ph;
275         int optlen, hdr_len;
276 
277         hdr_len = 0;
278         optlen = XFRM_MODE_SKB_CB(skb)->optlen;
279         if (unlikely(optlen))
280                 hdr_len += IPV4_BEET_PHMAXLEN - (optlen & 4);
281 
282         skb_set_network_header(skb, -x->props.header_len - hdr_len);
283         if (x->sel.family != AF_INET6)
284                 skb->network_header += IPV4_BEET_PHMAXLEN;
285         skb->mac_header = skb->network_header +
286                           offsetof(struct ipv6hdr, nexthdr);
287         skb->transport_header = skb->network_header + sizeof(*top_iph);
288         ph = __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl - hdr_len);
289 
290         xfrm6_beet_make_header(skb);
291 
292         top_iph = ipv6_hdr(skb);
293         if (unlikely(optlen)) {
294                 if (WARN_ON(optlen < 0))
295                         return -EINVAL;
296 
297                 ph->padlen = 4 - (optlen & 4);
298                 ph->hdrlen = optlen / 8;
299                 ph->nexthdr = top_iph->nexthdr;
300                 if (ph->padlen)
301                         memset(ph + 1, IPOPT_NOP, ph->padlen);
302 
303                 top_iph->nexthdr = IPPROTO_BEETPH;
304         }
305 
306         top_iph->saddr = *(struct in6_addr *)&x->props.saddr;
307         top_iph->daddr = *(struct in6_addr *)&x->id.daddr;
308         return 0;
309 }
310 #endif
311 
312 /* Add encapsulation header.
313  *
314  * On exit, the transport header will be set to the start of the
315  * encapsulation header to be filled in by x->type->output and the mac
316  * header will be set to the nextheader (protocol for IPv4) field of the
317  * extension header directly preceding the encapsulation header, or in
318  * its absence, that of the top IP header.
319  * The value of the network header will always point to the top IP header
320  * while skb->data will point to the payload.
321  */
322 static int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
323 {
324         int err;
325 
326         err = xfrm_inner_extract_output(x, skb);
327         if (err)
328                 return err;
329 
330         IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
331         skb->protocol = htons(ETH_P_IP);
332 
333         switch (x->outer_mode.encap) {
334         case XFRM_MODE_BEET:
335                 return xfrm4_beet_encap_add(x, skb);
336         case XFRM_MODE_TUNNEL:
337                 return xfrm4_tunnel_encap_add(x, skb);
338         }
339 
340         WARN_ON_ONCE(1);
341         return -EOPNOTSUPP;
342 }
343 
344 static int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
345 {
346 #if IS_ENABLED(CONFIG_IPV6)
347         int err;
348 
349         err = xfrm_inner_extract_output(x, skb);
350         if (err)
351                 return err;
352 
353         skb->ignore_df = 1;
354         skb->protocol = htons(ETH_P_IPV6);
355 
356         switch (x->outer_mode.encap) {
357         case XFRM_MODE_BEET:
358                 return xfrm6_beet_encap_add(x, skb);
359         case XFRM_MODE_TUNNEL:
360                 return xfrm6_tunnel_encap_add(x, skb);
361         default:
362                 WARN_ON_ONCE(1);
363                 return -EOPNOTSUPP;
364         }
365 #endif
366         WARN_ON_ONCE(1);
367         return -EAFNOSUPPORT;
368 }
369 
370 static int xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb)
371 {
372         switch (x->outer_mode.encap) {
373         case XFRM_MODE_BEET:
374         case XFRM_MODE_TUNNEL:
375                 if (x->outer_mode.family == AF_INET)
376                         return xfrm4_prepare_output(x, skb);
377                 if (x->outer_mode.family == AF_INET6)
378                         return xfrm6_prepare_output(x, skb);
379                 break;
380         case XFRM_MODE_TRANSPORT:
381                 if (x->outer_mode.family == AF_INET)
382                         return xfrm4_transport_output(x, skb);
383                 if (x->outer_mode.family == AF_INET6)
384                         return xfrm6_transport_output(x, skb);
385                 break;
386         case XFRM_MODE_ROUTEOPTIMIZATION:
387                 if (x->outer_mode.family == AF_INET6)
388                         return xfrm6_ro_output(x, skb);
389                 WARN_ON_ONCE(1);
390                 break;
391         default:
392                 WARN_ON_ONCE(1);
393                 break;
394         }
395 
396         return -EOPNOTSUPP;
397 }
398 
399 #if IS_ENABLED(CONFIG_NET_PKTGEN)
400 int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb)
401 {
402         return xfrm_outer_mode_output(x, skb);
403 }
404 EXPORT_SYMBOL_GPL(pktgen_xfrm_outer_mode_output);
405 #endif
406 
407 static int xfrm_output_one(struct sk_buff *skb, int err)
408 {
409         struct dst_entry *dst = skb_dst(skb);
410         struct xfrm_state *x = dst->xfrm;
411         struct net *net = xs_net(x);
412 
413         if (err <= 0)
414                 goto resume;
415 
416         do {
417                 err = xfrm_skb_check_space(skb);
418                 if (err) {
419                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
420                         goto error_nolock;
421                 }
422 
423                 skb->mark = xfrm_smark_get(skb->mark, x);
424 
425                 err = xfrm_outer_mode_output(x, skb);
426                 if (err) {
427                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR);
428                         goto error_nolock;
429                 }
430 
431                 spin_lock_bh(&x->lock);
432 
433                 if (unlikely(x->km.state != XFRM_STATE_VALID)) {
434                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
435                         err = -EINVAL;
436                         goto error;
437                 }
438 
439                 err = xfrm_state_check_expire(x);
440                 if (err) {
441                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED);
442                         goto error;
443                 }
444 
445                 err = x->repl->overflow(x, skb);
446                 if (err) {
447                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR);
448                         goto error;
449                 }
450 
451                 x->curlft.bytes += skb->len;
452                 x->curlft.packets++;
453 
454                 spin_unlock_bh(&x->lock);
455 
456                 skb_dst_force(skb);
457                 if (!skb_dst(skb)) {
458                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
459                         err = -EHOSTUNREACH;
460                         goto error_nolock;
461                 }
462 
463                 if (xfrm_offload(skb)) {
464                         x->type_offload->encap(x, skb);
465                 } else {
466                         /* Inner headers are invalid now. */
467                         skb->encapsulation = 0;
468 
469                         err = x->type->output(x, skb);
470                         if (err == -EINPROGRESS)
471                                 goto out;
472                 }
473 
474 resume:
475                 if (err) {
476                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR);
477                         goto error_nolock;
478                 }
479 
480                 dst = skb_dst_pop(skb);
481                 if (!dst) {
482                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
483                         err = -EHOSTUNREACH;
484                         goto error_nolock;
485                 }
486                 skb_dst_set(skb, dst);
487                 x = dst->xfrm;
488         } while (x && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL));
489 
490         return 0;
491 
492 error:
493         spin_unlock_bh(&x->lock);
494 error_nolock:
495         kfree_skb(skb);
496 out:
497         return err;
498 }
499 
500 int xfrm_output_resume(struct sk_buff *skb, int err)
501 {
502         struct net *net = xs_net(skb_dst(skb)->xfrm);
503 
504         while (likely((err = xfrm_output_one(skb, err)) == 0)) {
505                 nf_reset(skb);
506 
507                 err = skb_dst(skb)->ops->local_out(net, skb->sk, skb);
508                 if (unlikely(err != 1))
509                         goto out;
510 
511                 if (!skb_dst(skb)->xfrm)
512                         return dst_output(net, skb->sk, skb);
513 
514                 err = nf_hook(skb_dst(skb)->ops->family,
515                               NF_INET_POST_ROUTING, net, skb->sk, skb,
516                               NULL, skb_dst(skb)->dev, xfrm_output2);
517                 if (unlikely(err != 1))
518                         goto out;
519         }
520 
521         if (err == -EINPROGRESS)
522                 err = 0;
523 
524 out:
525         return err;
526 }
527 EXPORT_SYMBOL_GPL(xfrm_output_resume);
528 
529 static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
530 {
531         return xfrm_output_resume(skb, 1);
532 }
533 
534 static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb)
535 {
536         struct sk_buff *segs;
537 
538         BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET);
539         BUILD_BUG_ON(sizeof(*IP6CB(skb)) > SKB_SGO_CB_OFFSET);
540         segs = skb_gso_segment(skb, 0);
541         kfree_skb(skb);
542         if (IS_ERR(segs))
543                 return PTR_ERR(segs);
544         if (segs == NULL)
545                 return -EINVAL;
546 
547         do {
548                 struct sk_buff *nskb = segs->next;
549                 int err;
550 
551                 skb_mark_not_on_list(segs);
552                 err = xfrm_output2(net, sk, segs);
553 
554                 if (unlikely(err)) {
555                         kfree_skb_list(nskb);
556                         return err;
557                 }
558 
559                 segs = nskb;
560         } while (segs);
561 
562         return 0;
563 }
564 
565 int xfrm_output(struct sock *sk, struct sk_buff *skb)
566 {
567         struct net *net = dev_net(skb_dst(skb)->dev);
568         struct xfrm_state *x = skb_dst(skb)->xfrm;
569         int err;
570 
571         secpath_reset(skb);
572 
573         if (xfrm_dev_offload_ok(skb, x)) {
574                 struct sec_path *sp;
575 
576                 sp = secpath_set(skb);
577                 if (!sp) {
578                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
579                         kfree_skb(skb);
580                         return -ENOMEM;
581                 }
582                 skb->encapsulation = 1;
583 
584                 sp->olen++;
585                 sp->xvec[sp->len++] = x;
586                 xfrm_state_hold(x);
587 
588                 if (skb_is_gso(skb)) {
589                         skb_shinfo(skb)->gso_type |= SKB_GSO_ESP;
590 
591                         return xfrm_output2(net, sk, skb);
592                 }
593 
594                 if (x->xso.dev && x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM)
595                         goto out;
596         }
597 
598         if (skb_is_gso(skb))
599                 return xfrm_output_gso(net, sk, skb);
600 
601         if (skb->ip_summed == CHECKSUM_PARTIAL) {
602                 err = skb_checksum_help(skb);
603                 if (err) {
604                         XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
605                         kfree_skb(skb);
606                         return err;
607                 }
608         }
609 
610 out:
611         return xfrm_output2(net, sk, skb);
612 }
613 EXPORT_SYMBOL_GPL(xfrm_output);
614 
615 static int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
616 {
617         const struct xfrm_state_afinfo *afinfo;
618         const struct xfrm_mode *inner_mode;
619         int err = -EAFNOSUPPORT;
620 
621         if (x->sel.family == AF_UNSPEC)
622                 inner_mode = xfrm_ip2inner_mode(x,
623                                 xfrm_af2proto(skb_dst(skb)->ops->family));
624         else
625                 inner_mode = &x->inner_mode;
626 
627         if (inner_mode == NULL)
628                 return -EAFNOSUPPORT;
629 
630         rcu_read_lock();
631         afinfo = xfrm_state_afinfo_get_rcu(inner_mode->family);
632         if (likely(afinfo))
633                 err = afinfo->extract_output(x, skb);
634         rcu_read_unlock();
635 
636         return err;
637 }
638 
639 void xfrm_local_error(struct sk_buff *skb, int mtu)
640 {
641         unsigned int proto;
642         struct xfrm_state_afinfo *afinfo;
643 
644         if (skb->protocol == htons(ETH_P_IP))
645                 proto = AF_INET;
646         else if (skb->protocol == htons(ETH_P_IPV6))
647                 proto = AF_INET6;
648         else
649                 return;
650 
651         afinfo = xfrm_state_get_afinfo(proto);
652         if (afinfo) {
653                 afinfo->local_error(skb, mtu);
654                 rcu_read_unlock();
655         }
656 }
657 EXPORT_SYMBOL_GPL(xfrm_local_error);
658 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp