xfrm6_output.c 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * xfrm6_output.c - Common IPsec encapsulation code for IPv6.
  4. * Copyright (C) 2002 USAGI/WIDE Project
  5. * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
  6. */
  7. #include <linux/if_ether.h>
  8. #include <linux/kernel.h>
  9. #include <linux/module.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/icmpv6.h>
  12. #include <linux/netfilter_ipv6.h>
  13. #include <net/dst.h>
  14. #include <net/ipv6.h>
  15. #include <net/ip6_route.h>
  16. #include <net/xfrm.h>
  17. int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
  18. u8 **prevhdr)
  19. {
  20. return ip6_find_1stfragopt(skb, prevhdr);
  21. }
  22. EXPORT_SYMBOL(xfrm6_find_1stfragopt);
  23. void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu)
  24. {
  25. struct flowi6 fl6;
  26. struct sock *sk = skb->sk;
  27. fl6.flowi6_oif = sk->sk_bound_dev_if;
  28. fl6.daddr = ipv6_hdr(skb)->daddr;
  29. ipv6_local_rxpmtu(sk, &fl6, mtu);
  30. }
  31. void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
  32. {
  33. struct flowi6 fl6;
  34. const struct ipv6hdr *hdr;
  35. struct sock *sk = skb->sk;
  36. hdr = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
  37. fl6.fl6_dport = inet_sk(sk)->inet_dport;
  38. fl6.daddr = hdr->daddr;
  39. ipv6_local_error(sk, EMSGSIZE, &fl6, mtu);
  40. }
  41. static int __xfrm6_output_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  42. {
  43. return xfrm_output(sk, skb);
  44. }
  45. static int xfrm6_noneed_fragment(struct sk_buff *skb)
  46. {
  47. struct frag_hdr *fh;
  48. u8 prevhdr = ipv6_hdr(skb)->nexthdr;
  49. if (prevhdr != NEXTHDR_FRAGMENT)
  50. return 0;
  51. fh = (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr));
  52. if (fh->nexthdr == NEXTHDR_ESP || fh->nexthdr == NEXTHDR_AUTH)
  53. return 1;
  54. return 0;
  55. }
  56. static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
  57. {
  58. struct dst_entry *dst = skb_dst(skb);
  59. struct xfrm_state *x = dst->xfrm;
  60. unsigned int mtu;
  61. bool toobig;
  62. #ifdef CONFIG_NETFILTER
  63. if (!x) {
  64. IP6CB(skb)->flags |= IP6SKB_REROUTED;
  65. return dst_output(net, sk, skb);
  66. }
  67. #endif
  68. if (x->props.mode != XFRM_MODE_TUNNEL)
  69. goto skip_frag;
  70. if (skb->protocol == htons(ETH_P_IPV6))
  71. mtu = ip6_skb_dst_mtu(skb);
  72. else
  73. mtu = dst_mtu(skb_dst(skb));
  74. toobig = skb->len > mtu && !skb_is_gso(skb);
  75. if (toobig && xfrm6_local_dontfrag(skb->sk)) {
  76. xfrm6_local_rxpmtu(skb, mtu);
  77. kfree_skb(skb);
  78. return -EMSGSIZE;
  79. } else if (toobig && xfrm6_noneed_fragment(skb)) {
  80. skb->ignore_df = 1;
  81. goto skip_frag;
  82. } else if (!skb->ignore_df && toobig && skb->sk) {
  83. xfrm_local_error(skb, mtu);
  84. kfree_skb(skb);
  85. return -EMSGSIZE;
  86. }
  87. if (toobig || dst_allfrag(skb_dst(skb)))
  88. return ip6_fragment(net, sk, skb,
  89. __xfrm6_output_finish);
  90. skip_frag:
  91. return xfrm_output(sk, skb);
  92. }
  93. int xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
  94. {
  95. return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
  96. net, sk, skb, skb->dev, skb_dst(skb)->dev,
  97. __xfrm6_output,
  98. !(IP6CB(skb)->flags & IP6SKB_REROUTED));
  99. }