xfrm6_output.c 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168
  1. /*
  2. * xfrm6_output.c - Common IPsec encapsulation code for IPv6.
  3. * Copyright (C) 2002 USAGI/WIDE Project
  4. * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version
  9. * 2 of the License, or (at your option) any later version.
  10. */
  11. #include <linux/compiler.h>
  12. #include <linux/skbuff.h>
  13. #include <linux/spinlock.h>
  14. #include <linux/icmpv6.h>
  15. #include <linux/netfilter_ipv6.h>
  16. #include <net/ipv6.h>
  17. #include <net/xfrm.h>
  18. int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
  19. u8 **prevhdr)
  20. {
  21. return ip6_find_1stfragopt(skb, prevhdr);
  22. }
  23. static int xfrm6_tunnel_check_size(struct sk_buff *skb)
  24. {
  25. int mtu, ret = 0;
  26. struct dst_entry *dst = skb->dst;
  27. mtu = dst_mtu(dst);
  28. if (mtu < IPV6_MIN_MTU)
  29. mtu = IPV6_MIN_MTU;
  30. if (skb->len > mtu) {
  31. skb->dev = dst->dev;
  32. icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
  33. ret = -EMSGSIZE;
  34. }
  35. return ret;
  36. }
  37. static int xfrm6_output_one(struct sk_buff *skb)
  38. {
  39. struct dst_entry *dst = skb->dst;
  40. struct xfrm_state *x = dst->xfrm;
  41. int err;
  42. if (skb->ip_summed == CHECKSUM_PARTIAL) {
  43. err = skb_checksum_help(skb);
  44. if (err)
  45. goto error_nolock;
  46. }
  47. if (x->props.mode == XFRM_MODE_TUNNEL) {
  48. err = xfrm6_tunnel_check_size(skb);
  49. if (err)
  50. goto error_nolock;
  51. }
  52. do {
  53. spin_lock_bh(&x->lock);
  54. err = xfrm_state_check(x, skb);
  55. if (err)
  56. goto error;
  57. err = x->mode->output(x, skb);
  58. if (err)
  59. goto error;
  60. err = x->type->output(x, skb);
  61. if (err)
  62. goto error;
  63. x->curlft.bytes += skb->len;
  64. x->curlft.packets++;
  65. if (x->props.mode == XFRM_MODE_ROUTEOPTIMIZATION)
  66. x->lastused = (u64)xtime.tv_sec;
  67. spin_unlock_bh(&x->lock);
  68. skb->nh.raw = skb->data;
  69. if (!(skb->dst = dst_pop(dst))) {
  70. err = -EHOSTUNREACH;
  71. goto error_nolock;
  72. }
  73. dst = skb->dst;
  74. x = dst->xfrm;
  75. } while (x && (x->props.mode != XFRM_MODE_TUNNEL));
  76. IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
  77. err = 0;
  78. out_exit:
  79. return err;
  80. error:
  81. spin_unlock_bh(&x->lock);
  82. error_nolock:
  83. kfree_skb(skb);
  84. goto out_exit;
  85. }
  86. static int xfrm6_output_finish2(struct sk_buff *skb)
  87. {
  88. int err;
  89. while (likely((err = xfrm6_output_one(skb)) == 0)) {
  90. nf_reset(skb);
  91. err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL,
  92. skb->dst->dev, dst_output);
  93. if (unlikely(err != 1))
  94. break;
  95. if (!skb->dst->xfrm)
  96. return dst_output(skb);
  97. err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL,
  98. skb->dst->dev, xfrm6_output_finish2);
  99. if (unlikely(err != 1))
  100. break;
  101. }
  102. return err;
  103. }
  104. static int xfrm6_output_finish(struct sk_buff *skb)
  105. {
  106. struct sk_buff *segs;
  107. if (!skb_is_gso(skb))
  108. return xfrm6_output_finish2(skb);
  109. skb->protocol = htons(ETH_P_IPV6);
  110. segs = skb_gso_segment(skb, 0);
  111. kfree_skb(skb);
  112. if (unlikely(IS_ERR(segs)))
  113. return PTR_ERR(segs);
  114. do {
  115. struct sk_buff *nskb = segs->next;
  116. int err;
  117. segs->next = NULL;
  118. err = xfrm6_output_finish2(segs);
  119. if (unlikely(err)) {
  120. while ((segs = nskb)) {
  121. nskb = segs->next;
  122. segs->next = NULL;
  123. kfree_skb(segs);
  124. }
  125. return err;
  126. }
  127. segs = nskb;
  128. } while (segs);
  129. return 0;
  130. }
  131. int xfrm6_output(struct sk_buff *skb)
  132. {
  133. return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev,
  134. xfrm6_output_finish);
  135. }