ipsec outbound

对于输出的报文，主要做如下操作：

1. 调用ip_route_output_flow路由查找

2. 在ip_route_output_flow里面会调用xfrm_lookup进行ipsec policy查找

3.
如果policy的action为XFRM_POLICY_ALLOW，则调用xfrm_find_bundle或者xfrm_bundle_create创建dst链表

4. 应用链表中的dst->output函数进行ipsec加密或发包

例如需要分别对报文进行IP COMP, ESP, AH变换的链表如图所示

下面主要分析bundle的创建过程，skb->dst在__xfrm4_bundle_create前后变化如下:

传输模式：

隧道模式：

图片中黄色的为原始报文的路由缓存,蓝色的为隧道外层的路由缓存

/* Allocate chain of dst_entry‘s, attach known xfrm‘s, calculate

 * all the metrics... Shortly, bundle a bundle.

 */

static int

__xfrm4_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,

              struct flowi *fl, struct dst_entry **dst_p)

{

    struct dst_entry *dst, *dst_prev;

    struct rtable *rt0 = (struct rtable*)(*dst_p);

    struct rtable *rt = rt0;

    struct flowi fl_tunnel = {

        .nl_u = {

            .ip4_u = {

                .saddr = fl->fl4_src,

                .daddr = fl->fl4_dst,

                .tos = fl->fl4_tos

            }

        }

    };

    int i;

    int err;

    int header_len = 0;

    int trailer_len = 0;
dst = dst_prev = NULL;

    dst_hold(&rt->u.dst);
/* 每个xfrm生成一个dst_entry,child指向下一次变换或最外层报文的实际路由

     * 一个报文最多只能有一次隧道变换,因此rt最多只有两个,一个是隧道内报文的路由,一个是隧道报文的路由

     */

    for (i = 0; i < nx; i++) {

        struct dst_entry *dst1 = dst_alloc(&xfrm4_dst_ops);

        struct xfrm_dst *xdst;
if (unlikely(dst1 == NULL)) {

            err = -ENOBUFS;

            dst_release(&rt->u.dst);

            goto error;

        }
if (!dst)

            dst = dst1;

        else {

            dst_prev->child = dst1;

            dst1->flags |= DST_NOHASH;

            dst_clone(dst1);

        }
xdst = (struct xfrm_dst *)dst1;

        xdst->route = &rt->u.dst;

        xdst->genid = xfrm[i]->genid;
dst1->next = dst_prev;

        dst_prev = dst1;
header_len += xfrm[i]->props.header_len;

        trailer_len += xfrm[i]->props.trailer_len;
/* 隧道模式则查找外层ip包的路由 */

        if (xfrm[i]->props.mode == XFRM_MODE_TUNNEL) {

            unsigned short encap_family = xfrm[i]->props.family;

            switch(encap_family) {

            case AF_INET:

                fl_tunnel.fl4_dst = xfrm[i]->id.daddr.a4;

                fl_tunnel.fl4_src = xfrm[i]->props.saddr.a4;

                break;

#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)

            case AF_INET6:

                ipv6_addr_copy(&fl_tunnel.fl6_dst, (struct in6_addr*)&xfrm[i]->id.daddr.a6);

                ipv6_addr_copy(&fl_tunnel.fl6_src, (struct in6_addr*)&xfrm[i]->props.saddr.a6);

                break;

#endif

            default:

                BUG_ON(1);

            }

            err = xfrm_dst_lookup((struct xfrm_dst **)&rt,

                          &fl_tunnel, encap_family);

            if (err)

                goto error;

        } else

            dst_hold(&rt->u.dst);

    }
/* 最后一个child指向最外层报文的路由 */

    dst_prev->child = &rt->u.dst;

    dst->path = &rt->u.dst;
*dst_p = dst;

    dst = dst_prev;
dst_prev = *dst_p;

    i = 0;

    for (; dst_prev != &rt->u.dst; dst_prev = dst_prev->child) {

        struct xfrm_dst *x = (struct xfrm_dst*)dst_prev;

        struct xfrm_state_afinfo *afinfo;

        x->u.rt.fl = *fl;
dst_prev->xfrm = xfrm[i++];

        dst_prev->dev = rt->u.dst.dev;

        if (rt->u.dst.dev)

            dev_hold(rt->u.dst.dev);

        dst_prev->obsolete    = -1;

        dst_prev->flags           |= DST_HOST;

        dst_prev->lastuse    = jiffies;

        dst_prev->header_len    = header_len;

        dst_prev->nfheader_len    = 0;

        dst_prev->trailer_len    = trailer_len;

        memcpy(&dst_prev->metrics, &x->route->metrics, sizeof(dst_prev->metrics));
/* Copy neighbout for reachability confirmation */

        dst_prev->neighbour    = neigh_clone(rt->u.dst.neighbour);

        dst_prev->input        = rt->u.dst.input;

        /* XXX: When IPv6 module can be unloaded, we should manage reference

         * to xfrm6_output in afinfo->output. Miyazawa

         * */

        afinfo = xfrm_state_get_afinfo(dst_prev->xfrm->props.family);

        if (!afinfo) {

            dst = *dst_p;

            err = -EAFNOSUPPORT;

            goto error;

        }

        /* xfrm的dst_entry->output函数初始化为xfrm4_output */

        dst_prev->output = afinfo->output;

        xfrm_state_put_afinfo(afinfo);

        if (dst_prev->xfrm->props.family == AF_INET && rt->peer)

            atomic_inc(&rt->peer->refcnt);

        x->u.rt.peer = rt->peer;

        /* Sheit... I remember I did this right. Apparently,

         * it was magically lost, so this code needs audit */

        x->u.rt.rt_flags = rt0->rt_flags&(RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL);

        x->u.rt.rt_type = rt->rt_type;

        x->u.rt.rt_src = rt0->rt_src;

        x->u.rt.rt_dst = rt0->rt_dst;

        x->u.rt.rt_gateway = rt->rt_gateway;

        x->u.rt.rt_spec_dst = rt0->rt_spec_dst;

        x->u.rt.idev = rt0->idev;

        in_dev_hold(rt0->idev);

        header_len -= x->u.dst.xfrm->props.header_len;

        trailer_len -= x->u.dst.xfrm->props.trailer_len;

    }
xfrm_init_pmtu(dst);

    return 0;
error:

    if (dst)

        dst_free(dst);

    return err;

}

最后的xfrm4_output_finish2中沿着dst_entry->child每次调用xfrm4_output_one执行一次xfrm，直到最后一个真正的路由dst_entry，这时候调用dst_output进行路由输出；