xfrm4_output.c 3.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173
  1. /*
  2. * xfrm4_output.c - Common IPsec encapsulation code for IPv4.
  3. * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
  4. *
  5. * This program is free software; you can redistribute it and/or
  6. * modify it under the terms of the GNU General Public License
  7. * as published by the Free Software Foundation; either version
  8. * 2 of the License, or (at your option) any later version.
  9. */
  10. #include <linux/compiler.h>
  11. #include <linux/if_ether.h>
  12. #include <linux/kernel.h>
  13. #include <linux/skbuff.h>
  14. #include <linux/spinlock.h>
  15. #include <linux/netfilter_ipv4.h>
  16. #include <net/ip.h>
  17. #include <net/xfrm.h>
  18. #include <net/icmp.h>
  19. static int xfrm4_tunnel_check_size(struct sk_buff *skb)
  20. {
  21. int mtu, ret = 0;
  22. struct dst_entry *dst;
  23. struct iphdr *iph = skb->nh.iph;
  24. if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE)
  25. goto out;
  26. IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
  27. if (!(iph->frag_off & htons(IP_DF)) || skb->local_df)
  28. goto out;
  29. dst = skb->dst;
  30. mtu = dst_mtu(dst);
  31. if (skb->len > mtu) {
  32. icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
  33. ret = -EMSGSIZE;
  34. }
  35. out:
  36. return ret;
  37. }
  38. static int xfrm4_output_one(struct sk_buff *skb)
  39. {
  40. struct dst_entry *dst = skb->dst;
  41. struct xfrm_state *x = dst->xfrm;
  42. int err;
  43. if (skb->ip_summed == CHECKSUM_PARTIAL) {
  44. err = skb_checksum_help(skb);
  45. if (err)
  46. goto error_nolock;
  47. }
  48. if (x->props.mode == XFRM_MODE_TUNNEL) {
  49. err = xfrm4_tunnel_check_size(skb);
  50. if (err)
  51. goto error_nolock;
  52. }
  53. do {
  54. spin_lock_bh(&x->lock);
  55. err = xfrm_state_check(x, skb);
  56. if (err)
  57. goto error;
  58. err = x->mode->output(x, skb);
  59. if (err)
  60. goto error;
  61. err = x->type->output(x, skb);
  62. if (err)
  63. goto error;
  64. x->curlft.bytes += skb->len;
  65. x->curlft.packets++;
  66. spin_unlock_bh(&x->lock);
  67. if (!(skb->dst = dst_pop(dst))) {
  68. err = -EHOSTUNREACH;
  69. goto error_nolock;
  70. }
  71. dst = skb->dst;
  72. x = dst->xfrm;
  73. } while (x && (x->props.mode != XFRM_MODE_TUNNEL));
  74. IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
  75. err = 0;
  76. out_exit:
  77. return err;
  78. error:
  79. spin_unlock_bh(&x->lock);
  80. error_nolock:
  81. kfree_skb(skb);
  82. goto out_exit;
  83. }
  84. static int xfrm4_output_finish2(struct sk_buff *skb)
  85. {
  86. int err;
  87. while (likely((err = xfrm4_output_one(skb)) == 0)) {
  88. nf_reset(skb);
  89. err = nf_hook(PF_INET, NF_IP_LOCAL_OUT, &skb, NULL,
  90. skb->dst->dev, dst_output);
  91. if (unlikely(err != 1))
  92. break;
  93. if (!skb->dst->xfrm)
  94. return dst_output(skb);
  95. err = nf_hook(PF_INET, NF_IP_POST_ROUTING, &skb, NULL,
  96. skb->dst->dev, xfrm4_output_finish2);
  97. if (unlikely(err != 1))
  98. break;
  99. }
  100. return err;
  101. }
  102. static int xfrm4_output_finish(struct sk_buff *skb)
  103. {
  104. struct sk_buff *segs;
  105. #ifdef CONFIG_NETFILTER
  106. if (!skb->dst->xfrm) {
  107. IPCB(skb)->flags |= IPSKB_REROUTED;
  108. return dst_output(skb);
  109. }
  110. #endif
  111. if (!skb_is_gso(skb))
  112. return xfrm4_output_finish2(skb);
  113. skb->protocol = htons(ETH_P_IP);
  114. segs = skb_gso_segment(skb, 0);
  115. kfree_skb(skb);
  116. if (unlikely(IS_ERR(segs)))
  117. return PTR_ERR(segs);
  118. do {
  119. struct sk_buff *nskb = segs->next;
  120. int err;
  121. segs->next = NULL;
  122. err = xfrm4_output_finish2(segs);
  123. if (unlikely(err)) {
  124. while ((segs = nskb)) {
  125. nskb = segs->next;
  126. segs->next = NULL;
  127. kfree_skb(segs);
  128. }
  129. return err;
  130. }
  131. segs = nskb;
  132. } while (segs);
  133. return 0;
  134. }
  135. int xfrm4_output(struct sk_buff *skb)
  136. {
  137. return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
  138. xfrm4_output_finish,
  139. !(IPCB(skb)->flags & IPSKB_REROUTED));
  140. }