2019-05-27 06:55:01 +00:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
2007-10-09 00:16:30 +00:00
|
|
|
/*
|
|
|
|
|
* xfrm_output.c - Common IPsec encapsulation code.
|
|
|
|
|
*
|
|
|
|
|
* Copyright (c) 2007 Herbert Xu <herbert@gondor.apana.org.au>
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <linux/errno.h>
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
|
#include <linux/netdevice.h>
|
2007-11-14 05:43:11 +00:00
|
|
|
#include <linux/netfilter.h>
|
2007-10-09 00:16:30 +00:00
|
|
|
#include <linux/skbuff.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 08:04:11 +00:00
|
|
|
#include <linux/slab.h>
|
2007-10-09 00:16:30 +00:00
|
|
|
#include <linux/spinlock.h>
|
|
|
|
|
#include <net/dst.h>
|
2019-03-29 20:16:29 +00:00
|
|
|
#include <net/inet_ecn.h>
|
2007-10-09 00:16:30 +00:00
|
|
|
#include <net/xfrm.h>
|
|
|
|
|
|
2019-03-29 20:16:29 +00:00
|
|
|
#include "xfrm_inout.h"
|
|
|
|
|
|
2015-09-16 01:04:18 +00:00
|
|
|
static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb);
|
2019-03-29 20:16:25 +00:00
|
|
|
static int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb);
|
2007-11-14 05:43:43 +00:00
|
|
|
|
2012-03-21 23:32:39 +00:00
|
|
|
static int xfrm_skb_check_space(struct sk_buff *skb)
|
2007-10-09 00:25:08 +00:00
|
|
|
{
|
2009-06-02 05:19:30 +00:00
|
|
|
struct dst_entry *dst = skb_dst(skb);
|
2007-11-14 05:33:01 +00:00
|
|
|
int nhead = dst->header_len + LL_RESERVED_SPACE(dst->dev)
|
2007-10-09 00:25:08 +00:00
|
|
|
- skb_headroom(skb);
|
2008-05-13 03:48:31 +00:00
|
|
|
int ntail = dst->dev->needed_tailroom - skb_tailroom(skb);
|
2007-10-09 00:25:08 +00:00
|
|
|
|
2008-09-30 09:03:19 +00:00
|
|
|
if (nhead <= 0) {
|
|
|
|
|
if (ntail <= 0)
|
|
|
|
|
return 0;
|
|
|
|
|
nhead = 0;
|
|
|
|
|
} else if (ntail < 0)
|
|
|
|
|
ntail = 0;
|
|
|
|
|
|
|
|
|
|
return pskb_expand_head(skb, nhead, ntail, GFP_ATOMIC);
|
2007-10-09 00:25:08 +00:00
|
|
|
}
|
|
|
|
|
|
2015-05-12 10:29:44 +00:00
|
|
|
/* Children define the path of the packet through the
|
|
|
|
|
* Linux networking. Thus, destinations are stackable.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
static struct dst_entry *skb_dst_pop(struct sk_buff *skb)
|
|
|
|
|
{
|
2017-11-28 20:40:22 +00:00
|
|
|
struct dst_entry *child = dst_clone(xfrm_dst_child(skb_dst(skb)));
|
2015-05-12 10:29:44 +00:00
|
|
|
|
|
|
|
|
skb_dst_drop(skb);
|
|
|
|
|
return child;
|
|
|
|
|
}
|
|
|
|
|
|
2019-03-29 20:16:25 +00:00
|
|
|
/* Add encapsulation header.
|
|
|
|
|
*
|
|
|
|
|
* The IP header will be moved forward to make space for the encapsulation
|
|
|
|
|
* header.
|
|
|
|
|
*/
|
|
|
|
|
static int xfrm4_transport_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct iphdr *iph = ip_hdr(skb);
|
|
|
|
|
int ihl = iph->ihl * 4;
|
|
|
|
|
|
|
|
|
|
skb_set_inner_transport_header(skb, skb_transport_offset(skb));
|
|
|
|
|
|
|
|
|
|
skb_set_network_header(skb, -x->props.header_len);
|
|
|
|
|
skb->mac_header = skb->network_header +
|
|
|
|
|
offsetof(struct iphdr, protocol);
|
|
|
|
|
skb->transport_header = skb->network_header + ihl;
|
|
|
|
|
__skb_pull(skb, ihl);
|
|
|
|
|
memmove(skb_network_header(skb), iph, ihl);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Add encapsulation header.
|
|
|
|
|
*
|
|
|
|
|
* The IP header and mutable extension headers will be moved forward to make
|
|
|
|
|
* space for the encapsulation header.
|
|
|
|
|
*/
|
|
|
|
|
static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
2019-03-29 20:16:31 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2019-03-29 20:16:25 +00:00
|
|
|
struct ipv6hdr *iph;
|
|
|
|
|
u8 *prevhdr;
|
|
|
|
|
int hdr_len;
|
|
|
|
|
|
|
|
|
|
iph = ipv6_hdr(skb);
|
|
|
|
|
skb_set_inner_transport_header(skb, skb_transport_offset(skb));
|
|
|
|
|
|
|
|
|
|
hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
|
|
|
|
|
if (hdr_len < 0)
|
|
|
|
|
return hdr_len;
|
|
|
|
|
skb_set_mac_header(skb,
|
|
|
|
|
(prevhdr - x->props.header_len) - skb->data);
|
|
|
|
|
skb_set_network_header(skb, -x->props.header_len);
|
|
|
|
|
skb->transport_header = skb->network_header + hdr_len;
|
|
|
|
|
__skb_pull(skb, hdr_len);
|
|
|
|
|
memmove(ipv6_hdr(skb), iph, hdr_len);
|
|
|
|
|
return 0;
|
|
|
|
|
#else
|
|
|
|
|
WARN_ON_ONCE(1);
|
2019-03-29 20:16:31 +00:00
|
|
|
return -EAFNOSUPPORT;
|
2019-03-29 20:16:25 +00:00
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Add route optimization header space.
|
|
|
|
|
*
|
|
|
|
|
* The IP header and mutable extension headers will be moved forward to make
|
|
|
|
|
* space for the route optimization header.
|
|
|
|
|
*/
|
|
|
|
|
static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
2019-03-29 20:16:31 +00:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2019-03-29 20:16:25 +00:00
|
|
|
struct ipv6hdr *iph;
|
|
|
|
|
u8 *prevhdr;
|
|
|
|
|
int hdr_len;
|
|
|
|
|
|
|
|
|
|
iph = ipv6_hdr(skb);
|
|
|
|
|
|
|
|
|
|
hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
|
|
|
|
|
if (hdr_len < 0)
|
|
|
|
|
return hdr_len;
|
|
|
|
|
skb_set_mac_header(skb,
|
|
|
|
|
(prevhdr - x->props.header_len) - skb->data);
|
|
|
|
|
skb_set_network_header(skb, -x->props.header_len);
|
|
|
|
|
skb->transport_header = skb->network_header + hdr_len;
|
|
|
|
|
__skb_pull(skb, hdr_len);
|
|
|
|
|
memmove(ipv6_hdr(skb), iph, hdr_len);
|
|
|
|
|
|
|
|
|
|
x->lastused = ktime_get_real_seconds();
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
#else
|
|
|
|
|
WARN_ON_ONCE(1);
|
2019-03-29 20:16:31 +00:00
|
|
|
return -EAFNOSUPPORT;
|
2019-03-29 20:16:25 +00:00
|
|
|
#endif
|
|
|
|
|
}
|
|
|
|
|
|
2019-03-29 20:16:29 +00:00
|
|
|
/* Add encapsulation header.
|
|
|
|
|
*
|
|
|
|
|
* The top IP header will be constructed per draft-nikander-esp-beet-mode-06.txt.
|
|
|
|
|
*/
|
|
|
|
|
static int xfrm4_beet_encap_add(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct ip_beet_phdr *ph;
|
|
|
|
|
struct iphdr *top_iph;
|
|
|
|
|
int hdrlen, optlen;
|
|
|
|
|
|
|
|
|
|
hdrlen = 0;
|
|
|
|
|
optlen = XFRM_MODE_SKB_CB(skb)->optlen;
|
|
|
|
|
if (unlikely(optlen))
|
|
|
|
|
hdrlen += IPV4_BEET_PHMAXLEN - (optlen & 4);
|
|
|
|
|
|
|
|
|
|
skb_set_network_header(skb, -x->props.header_len - hdrlen +
|
|
|
|
|
(XFRM_MODE_SKB_CB(skb)->ihl - sizeof(*top_iph)));
|
|
|
|
|
if (x->sel.family != AF_INET6)
|
|
|
|
|
skb->network_header += IPV4_BEET_PHMAXLEN;
|
|
|
|
|
skb->mac_header = skb->network_header +
|
|
|
|
|
offsetof(struct iphdr, protocol);
|
|
|
|
|
skb->transport_header = skb->network_header + sizeof(*top_iph);
|
|
|
|
|
|
|
|
|
|
xfrm4_beet_make_header(skb);
|
|
|
|
|
|
|
|
|
|
ph = __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl - hdrlen);
|
|
|
|
|
|
|
|
|
|
top_iph = ip_hdr(skb);
|
|
|
|
|
|
|
|
|
|
if (unlikely(optlen)) {
|
|
|
|
|
if (WARN_ON(optlen < 0))
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
ph->padlen = 4 - (optlen & 4);
|
|
|
|
|
ph->hdrlen = optlen / 8;
|
|
|
|
|
ph->nexthdr = top_iph->protocol;
|
|
|
|
|
if (ph->padlen)
|
|
|
|
|
memset(ph + 1, IPOPT_NOP, ph->padlen);
|
|
|
|
|
|
|
|
|
|
top_iph->protocol = IPPROTO_BEETPH;
|
|
|
|
|
top_iph->ihl = sizeof(struct iphdr) / 4;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
top_iph->saddr = x->props.saddr.a4;
|
|
|
|
|
top_iph->daddr = x->id.daddr.a4;
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Add encapsulation header.
|
|
|
|
|
*
|
|
|
|
|
* The top IP header will be constructed per RFC 2401.
|
|
|
|
|
*/
|
|
|
|
|
static int xfrm4_tunnel_encap_add(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct dst_entry *dst = skb_dst(skb);
|
|
|
|
|
struct iphdr *top_iph;
|
|
|
|
|
int flags;
|
|
|
|
|
|
|
|
|
|
skb_set_inner_network_header(skb, skb_network_offset(skb));
|
|
|
|
|
skb_set_inner_transport_header(skb, skb_transport_offset(skb));
|
|
|
|
|
|
|
|
|
|
skb_set_network_header(skb, -x->props.header_len);
|
|
|
|
|
skb->mac_header = skb->network_header +
|
|
|
|
|
offsetof(struct iphdr, protocol);
|
|
|
|
|
skb->transport_header = skb->network_header + sizeof(*top_iph);
|
|
|
|
|
top_iph = ip_hdr(skb);
|
|
|
|
|
|
|
|
|
|
top_iph->ihl = 5;
|
|
|
|
|
top_iph->version = 4;
|
|
|
|
|
|
|
|
|
|
top_iph->protocol = xfrm_af2proto(skb_dst(skb)->ops->family);
|
|
|
|
|
|
|
|
|
|
/* DS disclosing depends on XFRM_SA_XFLAG_DONT_ENCAP_DSCP */
|
|
|
|
|
if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP)
|
|
|
|
|
top_iph->tos = 0;
|
|
|
|
|
else
|
|
|
|
|
top_iph->tos = XFRM_MODE_SKB_CB(skb)->tos;
|
|
|
|
|
top_iph->tos = INET_ECN_encapsulate(top_iph->tos,
|
|
|
|
|
XFRM_MODE_SKB_CB(skb)->tos);
|
|
|
|
|
|
|
|
|
|
flags = x->props.flags;
|
|
|
|
|
if (flags & XFRM_STATE_NOECN)
|
|
|
|
|
IP_ECN_clear(top_iph);
|
|
|
|
|
|
|
|
|
|
top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
|
|
|
|
|
0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
|
|
|
|
|
|
|
|
|
|
top_iph->ttl = ip4_dst_hoplimit(xfrm_dst_child(dst));
|
|
|
|
|
|
|
|
|
|
top_iph->saddr = x->props.saddr.a4;
|
|
|
|
|
top_iph->daddr = x->id.daddr.a4;
|
|
|
|
|
ip_select_ident(dev_net(dst->dev), skb, NULL);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
|
|
|
static int xfrm6_tunnel_encap_add(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct dst_entry *dst = skb_dst(skb);
|
|
|
|
|
struct ipv6hdr *top_iph;
|
|
|
|
|
int dsfield;
|
|
|
|
|
|
|
|
|
|
skb_set_inner_network_header(skb, skb_network_offset(skb));
|
|
|
|
|
skb_set_inner_transport_header(skb, skb_transport_offset(skb));
|
|
|
|
|
|
|
|
|
|
skb_set_network_header(skb, -x->props.header_len);
|
|
|
|
|
skb->mac_header = skb->network_header +
|
|
|
|
|
offsetof(struct ipv6hdr, nexthdr);
|
|
|
|
|
skb->transport_header = skb->network_header + sizeof(*top_iph);
|
|
|
|
|
top_iph = ipv6_hdr(skb);
|
|
|
|
|
|
|
|
|
|
top_iph->version = 6;
|
|
|
|
|
|
|
|
|
|
memcpy(top_iph->flow_lbl, XFRM_MODE_SKB_CB(skb)->flow_lbl,
|
|
|
|
|
sizeof(top_iph->flow_lbl));
|
|
|
|
|
top_iph->nexthdr = xfrm_af2proto(skb_dst(skb)->ops->family);
|
|
|
|
|
|
|
|
|
|
if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP)
|
|
|
|
|
dsfield = 0;
|
|
|
|
|
else
|
|
|
|
|
dsfield = XFRM_MODE_SKB_CB(skb)->tos;
|
|
|
|
|
dsfield = INET_ECN_encapsulate(dsfield, XFRM_MODE_SKB_CB(skb)->tos);
|
|
|
|
|
if (x->props.flags & XFRM_STATE_NOECN)
|
|
|
|
|
dsfield &= ~INET_ECN_MASK;
|
|
|
|
|
ipv6_change_dsfield(top_iph, 0, dsfield);
|
|
|
|
|
top_iph->hop_limit = ip6_dst_hoplimit(xfrm_dst_child(dst));
|
|
|
|
|
top_iph->saddr = *(struct in6_addr *)&x->props.saddr;
|
|
|
|
|
top_iph->daddr = *(struct in6_addr *)&x->id.daddr;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int xfrm6_beet_encap_add(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct ipv6hdr *top_iph;
|
|
|
|
|
struct ip_beet_phdr *ph;
|
|
|
|
|
int optlen, hdr_len;
|
|
|
|
|
|
|
|
|
|
hdr_len = 0;
|
|
|
|
|
optlen = XFRM_MODE_SKB_CB(skb)->optlen;
|
|
|
|
|
if (unlikely(optlen))
|
|
|
|
|
hdr_len += IPV4_BEET_PHMAXLEN - (optlen & 4);
|
|
|
|
|
|
|
|
|
|
skb_set_network_header(skb, -x->props.header_len - hdr_len);
|
|
|
|
|
if (x->sel.family != AF_INET6)
|
|
|
|
|
skb->network_header += IPV4_BEET_PHMAXLEN;
|
|
|
|
|
skb->mac_header = skb->network_header +
|
|
|
|
|
offsetof(struct ipv6hdr, nexthdr);
|
|
|
|
|
skb->transport_header = skb->network_header + sizeof(*top_iph);
|
|
|
|
|
ph = __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl - hdr_len);
|
|
|
|
|
|
|
|
|
|
xfrm6_beet_make_header(skb);
|
|
|
|
|
|
|
|
|
|
top_iph = ipv6_hdr(skb);
|
|
|
|
|
if (unlikely(optlen)) {
|
|
|
|
|
if (WARN_ON(optlen < 0))
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
ph->padlen = 4 - (optlen & 4);
|
|
|
|
|
ph->hdrlen = optlen / 8;
|
|
|
|
|
ph->nexthdr = top_iph->nexthdr;
|
|
|
|
|
if (ph->padlen)
|
|
|
|
|
memset(ph + 1, IPOPT_NOP, ph->padlen);
|
|
|
|
|
|
|
|
|
|
top_iph->nexthdr = IPPROTO_BEETPH;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
top_iph->saddr = *(struct in6_addr *)&x->props.saddr;
|
|
|
|
|
top_iph->daddr = *(struct in6_addr *)&x->id.daddr;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
/* Add encapsulation header.
|
|
|
|
|
*
|
|
|
|
|
* On exit, the transport header will be set to the start of the
|
|
|
|
|
* encapsulation header to be filled in by x->type->output and the mac
|
|
|
|
|
* header will be set to the nextheader (protocol for IPv4) field of the
|
|
|
|
|
* extension header directly preceding the encapsulation header, or in
|
|
|
|
|
* its absence, that of the top IP header.
|
|
|
|
|
* The value of the network header will always point to the top IP header
|
|
|
|
|
* while skb->data will point to the payload.
|
|
|
|
|
*/
|
2019-03-29 20:16:25 +00:00
|
|
|
static int xfrm4_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
err = xfrm_inner_extract_output(x, skb);
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
|
|
|
|
|
skb->protocol = htons(ETH_P_IP);
|
|
|
|
|
|
2019-03-29 20:16:32 +00:00
|
|
|
switch (x->outer_mode.encap) {
|
2019-03-29 20:16:29 +00:00
|
|
|
case XFRM_MODE_BEET:
|
|
|
|
|
return xfrm4_beet_encap_add(x, skb);
|
|
|
|
|
case XFRM_MODE_TUNNEL:
|
|
|
|
|
return xfrm4_tunnel_encap_add(x, skb);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
WARN_ON_ONCE(1);
|
|
|
|
|
return -EOPNOTSUPP;
|
2019-03-29 20:16:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
err = xfrm_inner_extract_output(x, skb);
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
skb->ignore_df = 1;
|
|
|
|
|
skb->protocol = htons(ETH_P_IPV6);
|
|
|
|
|
|
2019-03-29 20:16:32 +00:00
|
|
|
switch (x->outer_mode.encap) {
|
2019-03-29 20:16:29 +00:00
|
|
|
case XFRM_MODE_BEET:
|
|
|
|
|
return xfrm6_beet_encap_add(x, skb);
|
|
|
|
|
case XFRM_MODE_TUNNEL:
|
|
|
|
|
return xfrm6_tunnel_encap_add(x, skb);
|
|
|
|
|
default:
|
|
|
|
|
WARN_ON_ONCE(1);
|
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
}
|
2019-03-29 20:16:25 +00:00
|
|
|
#endif
|
2019-03-29 20:16:29 +00:00
|
|
|
WARN_ON_ONCE(1);
|
|
|
|
|
return -EAFNOSUPPORT;
|
2019-03-29 20:16:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
2019-03-29 20:16:32 +00:00
|
|
|
switch (x->outer_mode.encap) {
|
2019-03-29 20:16:25 +00:00
|
|
|
case XFRM_MODE_BEET:
|
|
|
|
|
case XFRM_MODE_TUNNEL:
|
2019-03-29 20:16:32 +00:00
|
|
|
if (x->outer_mode.family == AF_INET)
|
2019-03-29 20:16:25 +00:00
|
|
|
return xfrm4_prepare_output(x, skb);
|
2019-03-29 20:16:32 +00:00
|
|
|
if (x->outer_mode.family == AF_INET6)
|
2019-03-29 20:16:25 +00:00
|
|
|
return xfrm6_prepare_output(x, skb);
|
|
|
|
|
break;
|
|
|
|
|
case XFRM_MODE_TRANSPORT:
|
2019-03-29 20:16:32 +00:00
|
|
|
if (x->outer_mode.family == AF_INET)
|
2019-03-29 20:16:25 +00:00
|
|
|
return xfrm4_transport_output(x, skb);
|
2019-03-29 20:16:32 +00:00
|
|
|
if (x->outer_mode.family == AF_INET6)
|
2019-03-29 20:16:25 +00:00
|
|
|
return xfrm6_transport_output(x, skb);
|
|
|
|
|
break;
|
|
|
|
|
case XFRM_MODE_ROUTEOPTIMIZATION:
|
2019-03-29 20:16:32 +00:00
|
|
|
if (x->outer_mode.family == AF_INET6)
|
2019-03-29 20:16:25 +00:00
|
|
|
return xfrm6_ro_output(x, skb);
|
|
|
|
|
WARN_ON_ONCE(1);
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
WARN_ON_ONCE(1);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#if IS_ENABLED(CONFIG_NET_PKTGEN)
|
|
|
|
|
int pktgen_xfrm_outer_mode_output(struct xfrm_state *x, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
return xfrm_outer_mode_output(x, skb);
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(pktgen_xfrm_outer_mode_output);
|
|
|
|
|
#endif
|
|
|
|
|
|
2007-11-14 05:43:43 +00:00
|
|
|
static int xfrm_output_one(struct sk_buff *skb, int err)
|
2007-10-09 00:16:30 +00:00
|
|
|
{
|
2009-06-02 05:19:30 +00:00
|
|
|
struct dst_entry *dst = skb_dst(skb);
|
2007-10-09 00:16:30 +00:00
|
|
|
struct xfrm_state *x = dst->xfrm;
|
2008-11-26 01:38:20 +00:00
|
|
|
struct net *net = xs_net(x);
|
2007-10-09 00:16:30 +00:00
|
|
|
|
2007-11-14 05:43:43 +00:00
|
|
|
if (err <= 0)
|
|
|
|
|
goto resume;
|
2007-10-09 00:16:30 +00:00
|
|
|
|
|
|
|
|
do {
|
2012-03-21 23:32:39 +00:00
|
|
|
err = xfrm_skb_check_space(skb);
|
2007-12-25 00:00:09 +00:00
|
|
|
if (err) {
|
2008-11-26 01:59:52 +00:00
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
|
2007-12-19 06:14:25 +00:00
|
|
|
goto error_nolock;
|
2007-12-25 00:00:09 +00:00
|
|
|
}
|
2007-12-19 06:14:25 +00:00
|
|
|
|
2018-06-12 10:44:26 +00:00
|
|
|
skb->mark = xfrm_smark_get(skb->mark, x);
|
net: xfrm: support setting an output mark.
On systems that use mark-based routing it may be necessary for
routing lookups to use marks in order for packets to be routed
correctly. An example of such a system is Android, which uses
socket marks to route packets via different networks.
Currently, routing lookups in tunnel mode always use a mark of
zero, making routing incorrect on such systems.
This patch adds a new output_mark element to the xfrm state and
a corresponding XFRMA_OUTPUT_MARK netlink attribute. The output
mark differs from the existing xfrm mark in two ways:
1. The xfrm mark is used to match xfrm policies and states, while
the xfrm output mark is used to set the mark (and influence
the routing) of the packets emitted by those states.
2. The existing mark is constrained to be a subset of the bits of
the originating socket or transformed packet, but the output
mark is arbitrary and depends only on the state.
The use of a separate mark provides additional flexibility. For
example:
- A packet subject to two transforms (e.g., transport mode inside
tunnel mode) can have two different output marks applied to it,
one for the transport mode SA and one for the tunnel mode SA.
- On a system where socket marks determine routing, the packets
emitted by an IPsec tunnel can be routed based on a mark that
is determined by the tunnel, not by the marks of the
unencrypted packets.
- Support for setting the output marks can be introduced without
breaking any existing setups that employ both mark-based
routing and xfrm tunnel mode. Simply changing the code to use
the xfrm mark for routing output packets could xfrm mark could
change behaviour in a way that breaks these setups.
If the output mark is unspecified or set to zero, the mark is not
set or changed.
Tested: make allyesconfig; make -j64
Tested: https://android-review.googlesource.com/452776
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2017-08-10 17:11:33 +00:00
|
|
|
|
2019-03-29 20:16:25 +00:00
|
|
|
err = xfrm_outer_mode_output(x, skb);
|
2007-12-25 00:00:09 +00:00
|
|
|
if (err) {
|
2008-11-26 01:59:52 +00:00
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEMODEERROR);
|
2007-12-19 06:14:25 +00:00
|
|
|
goto error_nolock;
|
2007-12-25 00:00:09 +00:00
|
|
|
}
|
2007-11-14 05:39:38 +00:00
|
|
|
|
2007-10-09 00:16:30 +00:00
|
|
|
spin_lock_bh(&x->lock);
|
2012-12-28 08:06:28 +00:00
|
|
|
|
|
|
|
|
if (unlikely(x->km.state != XFRM_STATE_VALID)) {
|
|
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEINVALID);
|
2013-05-22 01:40:47 +00:00
|
|
|
err = -EINVAL;
|
2013-02-01 05:17:16 +00:00
|
|
|
goto error;
|
2012-12-28 08:06:28 +00:00
|
|
|
}
|
|
|
|
|
|
2007-12-19 06:14:25 +00:00
|
|
|
err = xfrm_state_check_expire(x);
|
2007-12-25 00:00:09 +00:00
|
|
|
if (err) {
|
2008-11-26 01:59:52 +00:00
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEEXPIRED);
|
2007-10-09 00:16:30 +00:00
|
|
|
goto error;
|
2007-12-25 00:00:09 +00:00
|
|
|
}
|
2007-10-09 00:16:30 +00:00
|
|
|
|
2011-03-08 00:08:32 +00:00
|
|
|
err = x->repl->overflow(x, skb);
|
|
|
|
|
if (err) {
|
|
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATESEQERROR);
|
|
|
|
|
goto error;
|
2007-10-09 00:25:53 +00:00
|
|
|
}
|
|
|
|
|
|
2007-10-09 00:16:30 +00:00
|
|
|
x->curlft.bytes += skb->len;
|
|
|
|
|
x->curlft.packets++;
|
|
|
|
|
|
|
|
|
|
spin_unlock_bh(&x->lock);
|
|
|
|
|
|
2011-03-15 21:08:28 +00:00
|
|
|
skb_dst_force(skb);
|
2018-09-11 08:31:15 +00:00
|
|
|
if (!skb_dst(skb)) {
|
|
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
|
2018-10-27 06:12:06 +00:00
|
|
|
err = -EHOSTUNREACH;
|
2018-09-11 08:31:15 +00:00
|
|
|
goto error_nolock;
|
|
|
|
|
}
|
2011-03-15 21:08:28 +00:00
|
|
|
|
2017-04-14 08:06:10 +00:00
|
|
|
if (xfrm_offload(skb)) {
|
|
|
|
|
x->type_offload->encap(x, skb);
|
|
|
|
|
} else {
|
2017-10-30 09:04:04 +00:00
|
|
|
/* Inner headers are invalid now. */
|
|
|
|
|
skb->encapsulation = 0;
|
|
|
|
|
|
2017-04-14 08:06:10 +00:00
|
|
|
err = x->type->output(x, skb);
|
|
|
|
|
if (err == -EINPROGRESS)
|
|
|
|
|
goto out;
|
|
|
|
|
}
|
2007-11-14 05:43:43 +00:00
|
|
|
|
|
|
|
|
resume:
|
2007-12-21 04:43:36 +00:00
|
|
|
if (err) {
|
2008-11-26 01:59:52 +00:00
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTSTATEPROTOERROR);
|
2007-10-09 20:33:35 +00:00
|
|
|
goto error_nolock;
|
2007-12-21 04:43:36 +00:00
|
|
|
}
|
2007-10-09 20:33:35 +00:00
|
|
|
|
2010-06-04 01:57:38 +00:00
|
|
|
dst = skb_dst_pop(skb);
|
2009-06-02 05:19:30 +00:00
|
|
|
if (!dst) {
|
2008-11-26 01:59:52 +00:00
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
|
2007-10-09 00:16:30 +00:00
|
|
|
err = -EHOSTUNREACH;
|
|
|
|
|
goto error_nolock;
|
|
|
|
|
}
|
2011-03-15 21:09:32 +00:00
|
|
|
skb_dst_set(skb, dst);
|
2007-10-09 00:16:30 +00:00
|
|
|
x = dst->xfrm;
|
2019-03-29 20:16:32 +00:00
|
|
|
} while (x && !(x->outer_mode.flags & XFRM_MODE_FLAG_TUNNEL));
|
2007-10-09 00:16:30 +00:00
|
|
|
|
2013-06-01 16:23:15 +00:00
|
|
|
return 0;
|
2007-10-09 00:16:30 +00:00
|
|
|
|
|
|
|
|
error:
|
|
|
|
|
spin_unlock_bh(&x->lock);
|
2007-11-14 05:43:11 +00:00
|
|
|
error_nolock:
|
|
|
|
|
kfree_skb(skb);
|
2013-06-01 16:23:15 +00:00
|
|
|
out:
|
|
|
|
|
return err;
|
2007-11-14 05:43:11 +00:00
|
|
|
}
|
|
|
|
|
|
2007-11-14 05:43:43 +00:00
|
|
|
int xfrm_output_resume(struct sk_buff *skb, int err)
|
2007-11-14 05:43:11 +00:00
|
|
|
{
|
2015-09-16 01:04:16 +00:00
|
|
|
struct net *net = xs_net(skb_dst(skb)->xfrm);
|
2015-09-17 22:21:31 +00:00
|
|
|
|
2007-11-14 05:43:43 +00:00
|
|
|
while (likely((err = xfrm_output_one(skb, err)) == 0)) {
|
2019-09-29 18:54:03 +00:00
|
|
|
nf_reset_ct(skb);
|
2007-11-14 05:43:11 +00:00
|
|
|
|
2015-10-07 21:48:45 +00:00
|
|
|
err = skb_dst(skb)->ops->local_out(net, skb->sk, skb);
|
2007-11-14 05:43:11 +00:00
|
|
|
if (unlikely(err != 1))
|
2007-11-14 05:43:43 +00:00
|
|
|
goto out;
|
2007-11-14 05:43:11 +00:00
|
|
|
|
2009-06-02 05:19:30 +00:00
|
|
|
if (!skb_dst(skb)->xfrm)
|
2015-10-07 21:48:35 +00:00
|
|
|
return dst_output(net, skb->sk, skb);
|
2007-11-14 05:43:11 +00:00
|
|
|
|
2009-06-02 05:19:30 +00:00
|
|
|
err = nf_hook(skb_dst(skb)->ops->family,
|
2015-09-16 01:04:16 +00:00
|
|
|
NF_INET_POST_ROUTING, net, skb->sk, skb,
|
2009-06-02 05:19:30 +00:00
|
|
|
NULL, skb_dst(skb)->dev, xfrm_output2);
|
2007-11-14 05:43:11 +00:00
|
|
|
if (unlikely(err != 1))
|
2007-11-14 05:43:43 +00:00
|
|
|
goto out;
|
2007-11-14 05:43:11 +00:00
|
|
|
}
|
|
|
|
|
|
2007-11-14 05:43:43 +00:00
|
|
|
if (err == -EINPROGRESS)
|
|
|
|
|
err = 0;
|
|
|
|
|
|
|
|
|
|
out:
|
2007-11-14 05:43:11 +00:00
|
|
|
return err;
|
|
|
|
|
}
|
2007-11-14 05:43:43 +00:00
|
|
|
EXPORT_SYMBOL_GPL(xfrm_output_resume);
|
2007-11-14 05:43:11 +00:00
|
|
|
|
2015-09-16 01:04:18 +00:00
|
|
|
static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
|
2007-11-14 05:43:11 +00:00
|
|
|
{
|
2007-11-14 05:43:43 +00:00
|
|
|
return xfrm_output_resume(skb, 1);
|
|
|
|
|
}
|
2007-11-14 05:43:11 +00:00
|
|
|
|
2015-09-16 01:04:18 +00:00
|
|
|
static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb)
|
2007-11-14 05:43:43 +00:00
|
|
|
{
|
|
|
|
|
struct sk_buff *segs;
|
2007-11-14 05:43:11 +00:00
|
|
|
|
2016-01-08 12:21:46 +00:00
|
|
|
BUILD_BUG_ON(sizeof(*IPCB(skb)) > SKB_SGO_CB_OFFSET);
|
|
|
|
|
BUILD_BUG_ON(sizeof(*IP6CB(skb)) > SKB_SGO_CB_OFFSET);
|
2007-11-14 05:43:11 +00:00
|
|
|
segs = skb_gso_segment(skb, 0);
|
|
|
|
|
kfree_skb(skb);
|
2008-04-29 08:03:09 +00:00
|
|
|
if (IS_ERR(segs))
|
2007-11-14 05:43:11 +00:00
|
|
|
return PTR_ERR(segs);
|
2014-10-20 11:49:17 +00:00
|
|
|
if (segs == NULL)
|
|
|
|
|
return -EINVAL;
|
2007-11-14 05:43:11 +00:00
|
|
|
|
|
|
|
|
do {
|
|
|
|
|
struct sk_buff *nskb = segs->next;
|
|
|
|
|
int err;
|
|
|
|
|
|
2018-07-30 03:42:53 +00:00
|
|
|
skb_mark_not_on_list(segs);
|
2015-09-16 01:04:18 +00:00
|
|
|
err = xfrm_output2(net, sk, segs);
|
2007-11-14 05:43:11 +00:00
|
|
|
|
|
|
|
|
if (unlikely(err)) {
|
2014-09-09 23:08:46 +00:00
|
|
|
kfree_skb_list(nskb);
|
2007-11-14 05:43:11 +00:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
segs = nskb;
|
|
|
|
|
} while (segs);
|
|
|
|
|
|
|
|
|
|
return 0;
|
2007-10-09 00:16:30 +00:00
|
|
|
}
|
2007-11-14 05:43:43 +00:00
|
|
|
|
2015-04-06 02:19:04 +00:00
|
|
|
int xfrm_output(struct sock *sk, struct sk_buff *skb)
|
2007-11-14 05:43:43 +00:00
|
|
|
{
|
2009-06-02 05:19:30 +00:00
|
|
|
struct net *net = dev_net(skb_dst(skb)->dev);
|
2017-04-14 08:06:10 +00:00
|
|
|
struct xfrm_state *x = skb_dst(skb)->xfrm;
|
2007-11-14 05:43:43 +00:00
|
|
|
int err;
|
|
|
|
|
|
2017-04-14 08:06:10 +00:00
|
|
|
secpath_reset(skb);
|
|
|
|
|
|
|
|
|
|
if (xfrm_dev_offload_ok(skb, x)) {
|
|
|
|
|
struct sec_path *sp;
|
|
|
|
|
|
2018-12-18 16:15:26 +00:00
|
|
|
sp = secpath_set(skb);
|
2017-04-14 08:06:10 +00:00
|
|
|
if (!sp) {
|
|
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
}
|
2017-04-14 08:07:39 +00:00
|
|
|
skb->encapsulation = 1;
|
2017-04-14 08:06:10 +00:00
|
|
|
|
|
|
|
|
sp->olen++;
|
2018-12-18 16:15:26 +00:00
|
|
|
sp->xvec[sp->len++] = x;
|
2017-04-14 08:06:10 +00:00
|
|
|
xfrm_state_hold(x);
|
|
|
|
|
|
|
|
|
|
if (skb_is_gso(skb)) {
|
|
|
|
|
skb_shinfo(skb)->gso_type |= SKB_GSO_ESP;
|
|
|
|
|
|
|
|
|
|
return xfrm_output2(net, sk, skb);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (x->xso.dev && x->xso.dev->features & NETIF_F_HW_ESP_TX_CSUM)
|
|
|
|
|
goto out;
|
|
|
|
|
}
|
|
|
|
|
|
2007-11-14 05:43:43 +00:00
|
|
|
if (skb_is_gso(skb))
|
2015-09-16 01:04:18 +00:00
|
|
|
return xfrm_output_gso(net, sk, skb);
|
2007-11-14 05:43:43 +00:00
|
|
|
|
|
|
|
|
if (skb->ip_summed == CHECKSUM_PARTIAL) {
|
|
|
|
|
err = skb_checksum_help(skb);
|
|
|
|
|
if (err) {
|
2008-11-26 01:59:52 +00:00
|
|
|
XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTERROR);
|
2007-11-14 05:43:43 +00:00
|
|
|
kfree_skb(skb);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2017-04-14 08:06:10 +00:00
|
|
|
out:
|
2015-09-16 01:04:18 +00:00
|
|
|
return xfrm_output2(net, sk, skb);
|
2007-11-14 05:43:43 +00:00
|
|
|
}
|
2014-05-12 17:54:34 +00:00
|
|
|
EXPORT_SYMBOL_GPL(xfrm_output);
|
2008-03-24 21:51:51 +00:00
|
|
|
|
2019-03-29 20:16:25 +00:00
|
|
|
static int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
|
2008-03-24 21:51:51 +00:00
|
|
|
{
|
2019-03-29 20:16:30 +00:00
|
|
|
const struct xfrm_state_afinfo *afinfo;
|
2019-03-29 20:16:31 +00:00
|
|
|
const struct xfrm_mode *inner_mode;
|
2019-03-29 20:16:30 +00:00
|
|
|
int err = -EAFNOSUPPORT;
|
|
|
|
|
|
2008-03-24 21:51:51 +00:00
|
|
|
if (x->sel.family == AF_UNSPEC)
|
|
|
|
|
inner_mode = xfrm_ip2inner_mode(x,
|
2009-06-02 05:19:30 +00:00
|
|
|
xfrm_af2proto(skb_dst(skb)->ops->family));
|
2008-03-24 21:51:51 +00:00
|
|
|
else
|
2019-03-29 20:16:32 +00:00
|
|
|
inner_mode = &x->inner_mode;
|
2008-03-24 21:51:51 +00:00
|
|
|
|
|
|
|
|
if (inner_mode == NULL)
|
|
|
|
|
return -EAFNOSUPPORT;
|
2019-03-29 20:16:30 +00:00
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
afinfo = xfrm_state_afinfo_get_rcu(inner_mode->family);
|
|
|
|
|
if (likely(afinfo))
|
|
|
|
|
err = afinfo->extract_output(x, skb);
|
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
|
|
|
|
|
return err;
|
2008-03-24 21:51:51 +00:00
|
|
|
}
|
|
|
|
|
|
2013-08-14 11:05:23 +00:00
|
|
|
void xfrm_local_error(struct sk_buff *skb, int mtu)
|
|
|
|
|
{
|
2013-08-18 11:47:01 +00:00
|
|
|
unsigned int proto;
|
2013-08-14 11:05:23 +00:00
|
|
|
struct xfrm_state_afinfo *afinfo;
|
|
|
|
|
|
2013-08-18 11:47:01 +00:00
|
|
|
if (skb->protocol == htons(ETH_P_IP))
|
|
|
|
|
proto = AF_INET;
|
|
|
|
|
else if (skb->protocol == htons(ETH_P_IPV6))
|
|
|
|
|
proto = AF_INET6;
|
|
|
|
|
else
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
afinfo = xfrm_state_get_afinfo(proto);
|
2018-03-16 02:35:51 +00:00
|
|
|
if (afinfo) {
|
2017-01-09 13:20:47 +00:00
|
|
|
afinfo->local_error(skb, mtu);
|
2018-03-16 02:35:51 +00:00
|
|
|
rcu_read_unlock();
|
|
|
|
|
}
|
2013-08-14 11:05:23 +00:00
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(xfrm_local_error);
|
