1 /* 2 * xfrm6_output.c - Common IPsec encapsulation code for IPv6. 3 * Copyright (C) 2002 USAGI/WIDE Project 4 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/compiler.h> 13 #include <linux/skbuff.h> 14 #include <linux/spinlock.h> 15 #include <linux/icmpv6.h> 16 #include <linux/netfilter_ipv6.h> 17 #include <net/ipv6.h> 18 #include <net/xfrm.h> 19 20 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 21 u8 **prevhdr) 22 { 23 return ip6_find_1stfragopt(skb, prevhdr); 24 } 25 26 static int xfrm6_tunnel_check_size(struct sk_buff *skb) 27 { 28 int mtu, ret = 0; 29 struct dst_entry *dst = skb->dst; 30 31 mtu = dst_mtu(dst); 32 if (mtu < IPV6_MIN_MTU) 33 mtu = IPV6_MIN_MTU; 34 35 if (skb->len > mtu) { 36 skb->dev = dst->dev; 37 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); 38 ret = -EMSGSIZE; 39 } 40 41 return ret; 42 } 43 44 static int xfrm6_output_one(struct sk_buff *skb) 45 { 46 struct dst_entry *dst = skb->dst; 47 struct xfrm_state *x = dst->xfrm; 48 int err; 49 50 if (skb->ip_summed == CHECKSUM_PARTIAL) { 51 err = skb_checksum_help(skb); 52 if (err) 53 goto error_nolock; 54 } 55 56 if (x->props.mode == XFRM_MODE_TUNNEL) { 57 err = xfrm6_tunnel_check_size(skb); 58 if (err) 59 goto error_nolock; 60 } 61 62 do { 63 spin_lock_bh(&x->lock); 64 err = xfrm_state_check(x, skb); 65 if (err) 66 goto error; 67 68 err = x->mode->output(x, skb); 69 if (err) 70 goto error; 71 72 err = x->type->output(x, skb); 73 if (err) 74 goto error; 75 76 x->curlft.bytes += skb->len; 77 x->curlft.packets++; 78 if (x->props.mode == XFRM_MODE_ROUTEOPTIMIZATION) 79 x->lastused = (u64)xtime.tv_sec; 80 81 spin_unlock_bh(&x->lock); 82 83 skb->nh.raw = skb->data; 84 85 if (!(skb->dst = dst_pop(dst))) { 86 err = -EHOSTUNREACH; 87 goto error_nolock; 88 } 89 dst = skb->dst; 90 x = dst->xfrm; 91 } while (x && (x->props.mode != XFRM_MODE_TUNNEL)); 92 93 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; 94 err = 0; 95 96 out_exit: 97 return err; 98 error: 99 spin_unlock_bh(&x->lock); 100 error_nolock: 101 kfree_skb(skb); 102 goto out_exit; 103 } 104 105 static int xfrm6_output_finish2(struct sk_buff *skb) 106 { 107 int err; 108 109 while (likely((err = xfrm6_output_one(skb)) == 0)) { 110 nf_reset(skb); 111 112 err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL, 113 skb->dst->dev, dst_output); 114 if (unlikely(err != 1)) 115 break; 116 117 if (!skb->dst->xfrm) 118 return dst_output(skb); 119 120 err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL, 121 skb->dst->dev, xfrm6_output_finish2); 122 if (unlikely(err != 1)) 123 break; 124 } 125 126 return err; 127 } 128 129 static int xfrm6_output_finish(struct sk_buff *skb) 130 { 131 struct sk_buff *segs; 132 133 if (!skb_is_gso(skb)) 134 return xfrm6_output_finish2(skb); 135 136 skb->protocol = htons(ETH_P_IPV6); 137 segs = skb_gso_segment(skb, 0); 138 kfree_skb(skb); 139 if (unlikely(IS_ERR(segs))) 140 return PTR_ERR(segs); 141 142 do { 143 struct sk_buff *nskb = segs->next; 144 int err; 145 146 segs->next = NULL; 147 err = xfrm6_output_finish2(segs); 148 149 if (unlikely(err)) { 150 while ((segs = nskb)) { 151 nskb = segs->next; 152 segs->next = NULL; 153 kfree_skb(segs); 154 } 155 return err; 156 } 157 158 segs = nskb; 159 } while (segs); 160 161 return 0; 162 } 163 164 int xfrm6_output(struct sk_buff *skb) 165 { 166 return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev, 167 xfrm6_output_finish); 168 } 169