1 /* 2 * xfrm_device.c - IPsec device offloading code. 3 * 4 * Copyright (c) 2015 secunet Security Networks AG 5 * 6 * Author: 7 * Steffen Klassert <steffen.klassert@secunet.com> 8 * 9 * This program is free software; you can redistribute it and/or 10 * modify it under the terms of the GNU General Public License 11 * as published by the Free Software Foundation; either version 12 * 2 of the License, or (at your option) any later version. 13 */ 14 15 #include <linux/errno.h> 16 #include <linux/module.h> 17 #include <linux/netdevice.h> 18 #include <linux/skbuff.h> 19 #include <linux/slab.h> 20 #include <linux/spinlock.h> 21 #include <net/dst.h> 22 #include <net/xfrm.h> 23 #include <linux/notifier.h> 24 25 #ifdef CONFIG_XFRM_OFFLOAD 26 int validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t features) 27 { 28 int err; 29 struct xfrm_state *x; 30 struct xfrm_offload *xo = xfrm_offload(skb); 31 32 if (skb_is_gso(skb)) 33 return 0; 34 35 if (xo) { 36 x = skb->sp->xvec[skb->sp->len - 1]; 37 if (xo->flags & XFRM_GRO || x->xso.flags & XFRM_OFFLOAD_INBOUND) 38 return 0; 39 40 x->outer_mode->xmit(x, skb); 41 42 err = x->type_offload->xmit(x, skb, features); 43 if (err) { 44 XFRM_INC_STATS(xs_net(x), LINUX_MIB_XFRMOUTSTATEPROTOERROR); 45 return err; 46 } 47 48 skb_push(skb, skb->data - skb_mac_header(skb)); 49 } 50 51 return 0; 52 } 53 EXPORT_SYMBOL_GPL(validate_xmit_xfrm); 54 55 int xfrm_dev_state_add(struct net *net, struct xfrm_state *x, 56 struct xfrm_user_offload *xuo) 57 { 58 int err; 59 struct dst_entry *dst; 60 struct net_device *dev; 61 struct xfrm_state_offload *xso = &x->xso; 62 xfrm_address_t *saddr; 63 xfrm_address_t *daddr; 64 65 if (!x->type_offload) 66 return -EINVAL; 67 68 /* We don't yet support UDP encapsulation, TFC padding and ESN. */ 69 if (x->encap || x->tfcpad || (x->props.flags & XFRM_STATE_ESN)) 70 return 0; 71 72 dev = dev_get_by_index(net, xuo->ifindex); 73 if (!dev) { 74 if (!(xuo->flags & XFRM_OFFLOAD_INBOUND)) { 75 saddr = &x->props.saddr; 76 daddr = &x->id.daddr; 77 } else { 78 saddr = &x->id.daddr; 79 daddr = &x->props.saddr; 80 } 81 82 dst = __xfrm_dst_lookup(net, 0, 0, saddr, daddr, 83 x->props.family, x->props.output_mark); 84 if (IS_ERR(dst)) 85 return 0; 86 87 dev = dst->dev; 88 89 dev_hold(dev); 90 dst_release(dst); 91 } 92 93 if (!dev->xfrmdev_ops || !dev->xfrmdev_ops->xdo_dev_state_add) { 94 xso->dev = NULL; 95 dev_put(dev); 96 return 0; 97 } 98 99 xso->dev = dev; 100 xso->num_exthdrs = 1; 101 xso->flags = xuo->flags; 102 103 err = dev->xfrmdev_ops->xdo_dev_state_add(x); 104 if (err) { 105 xso->dev = NULL; 106 dev_put(dev); 107 return err; 108 } 109 110 return 0; 111 } 112 EXPORT_SYMBOL_GPL(xfrm_dev_state_add); 113 114 bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x) 115 { 116 int mtu; 117 struct dst_entry *dst = skb_dst(skb); 118 struct xfrm_dst *xdst = (struct xfrm_dst *)dst; 119 struct net_device *dev = x->xso.dev; 120 121 if (!x->type_offload || x->encap) 122 return false; 123 124 if ((x->xso.offload_handle && (dev == dst->path->dev)) && 125 !dst->child->xfrm && x->type->get_mtu) { 126 mtu = x->type->get_mtu(x, xdst->child_mtu_cached); 127 128 if (skb->len <= mtu) 129 goto ok; 130 131 if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu)) 132 goto ok; 133 } 134 135 return false; 136 137 ok: 138 if (dev && dev->xfrmdev_ops && dev->xfrmdev_ops->xdo_dev_offload_ok) 139 return x->xso.dev->xfrmdev_ops->xdo_dev_offload_ok(skb, x); 140 141 return true; 142 } 143 EXPORT_SYMBOL_GPL(xfrm_dev_offload_ok); 144 #endif 145 146 static int xfrm_dev_register(struct net_device *dev) 147 { 148 if ((dev->features & NETIF_F_HW_ESP) && !dev->xfrmdev_ops) 149 return NOTIFY_BAD; 150 if ((dev->features & NETIF_F_HW_ESP_TX_CSUM) && 151 !(dev->features & NETIF_F_HW_ESP)) 152 return NOTIFY_BAD; 153 154 return NOTIFY_DONE; 155 } 156 157 static int xfrm_dev_unregister(struct net_device *dev) 158 { 159 xfrm_policy_cache_flush(); 160 return NOTIFY_DONE; 161 } 162 163 static int xfrm_dev_feat_change(struct net_device *dev) 164 { 165 if ((dev->features & NETIF_F_HW_ESP) && !dev->xfrmdev_ops) 166 return NOTIFY_BAD; 167 else if (!(dev->features & NETIF_F_HW_ESP)) 168 dev->xfrmdev_ops = NULL; 169 170 if ((dev->features & NETIF_F_HW_ESP_TX_CSUM) && 171 !(dev->features & NETIF_F_HW_ESP)) 172 return NOTIFY_BAD; 173 174 return NOTIFY_DONE; 175 } 176 177 static int xfrm_dev_down(struct net_device *dev) 178 { 179 if (dev->features & NETIF_F_HW_ESP) 180 xfrm_dev_state_flush(dev_net(dev), dev, true); 181 182 xfrm_policy_cache_flush(); 183 return NOTIFY_DONE; 184 } 185 186 static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr) 187 { 188 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 189 190 switch (event) { 191 case NETDEV_REGISTER: 192 return xfrm_dev_register(dev); 193 194 case NETDEV_UNREGISTER: 195 return xfrm_dev_unregister(dev); 196 197 case NETDEV_FEAT_CHANGE: 198 return xfrm_dev_feat_change(dev); 199 200 case NETDEV_DOWN: 201 return xfrm_dev_down(dev); 202 } 203 return NOTIFY_DONE; 204 } 205 206 static struct notifier_block xfrm_dev_notifier = { 207 .notifier_call = xfrm_dev_event, 208 }; 209 210 void __net_init xfrm_dev_init(void) 211 { 212 register_netdevice_notifier(&xfrm_dev_notifier); 213 } 214