blob: 656976760ad47175afa8bc6ac7d2152d5e7f95b4 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * xfrm6_output.c - Common IPsec encapsulation code for IPv6.
3 * Copyright (C) 2002 USAGI/WIDE Project
4 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
YOSHIFUJI Hideaki1ab14572007-02-09 23:24:49 +09005 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07006 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 */
11
Herbert Xu406ef772007-10-08 17:16:30 -070012#include <linux/if_ether.h>
Patrick McHardy16a66772006-01-06 23:01:48 -080013#include <linux/compiler.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014#include <linux/skbuff.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070015#include <linux/icmpv6.h>
Patrick McHardy16a66772006-01-06 23:01:48 -080016#include <linux/netfilter_ipv6.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017#include <net/ipv6.h>
18#include <net/xfrm.h>
19
Masahide NAKAMURAaee5adb2006-08-23 17:57:28 -070020int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb,
21 u8 **prevhdr)
22{
23 return ip6_find_1stfragopt(skb, prevhdr);
24}
25
YOSHIFUJI Hideaki71590392007-02-22 22:05:40 +090026EXPORT_SYMBOL(xfrm6_find_1stfragopt);
27
Linus Torvalds1da177e2005-04-16 15:20:36 -070028static int xfrm6_tunnel_check_size(struct sk_buff *skb)
29{
30 int mtu, ret = 0;
31 struct dst_entry *dst = skb->dst;
32
33 mtu = dst_mtu(dst);
34 if (mtu < IPV6_MIN_MTU)
35 mtu = IPV6_MIN_MTU;
36
37 if (skb->len > mtu) {
Herbert Xu180e4252005-05-23 13:11:07 -070038 skb->dev = dst->dev;
Linus Torvalds1da177e2005-04-16 15:20:36 -070039 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
40 ret = -EMSGSIZE;
41 }
42
43 return ret;
44}
45
Herbert Xu406ef772007-10-08 17:16:30 -070046static inline int xfrm6_output_one(struct sk_buff *skb)
Linus Torvalds1da177e2005-04-16 15:20:36 -070047{
48 struct dst_entry *dst = skb->dst;
49 struct xfrm_state *x = dst->xfrm;
Herbert Xuceb1eec82007-10-10 15:45:52 -070050 struct ipv6hdr *iph;
Linus Torvalds1da177e2005-04-16 15:20:36 -070051 int err;
YOSHIFUJI Hideaki1ab14572007-02-09 23:24:49 +090052
Herbert Xu13996372007-10-17 21:35:51 -070053 if (x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) {
Linus Torvalds1da177e2005-04-16 15:20:36 -070054 err = xfrm6_tunnel_check_size(skb);
55 if (err)
56 goto error_nolock;
57 }
58
Herbert Xu406ef772007-10-08 17:16:30 -070059 err = xfrm_output(skb);
60 if (err)
61 goto error_nolock;
Patrick McHardy16a66772006-01-06 23:01:48 -080062
Herbert Xuceb1eec82007-10-10 15:45:52 -070063 iph = ipv6_hdr(skb);
64 iph->payload_len = htons(skb->len - sizeof(*iph));
65
Patrick McHardy3e3850e2006-01-06 23:04:54 -080066 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
Patrick McHardy16a66772006-01-06 23:01:48 -080067 err = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -070068
69out_exit:
70 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -070071error_nolock:
72 kfree_skb(skb);
73 goto out_exit;
74}
Patrick McHardy16a66772006-01-06 23:01:48 -080075
Herbert Xu09b8f7a2006-06-22 03:08:03 -070076static int xfrm6_output_finish2(struct sk_buff *skb)
Patrick McHardy16a66772006-01-06 23:01:48 -080077{
78 int err;
79
80 while (likely((err = xfrm6_output_one(skb)) == 0)) {
81 nf_reset(skb);
YOSHIFUJI Hideaki1ab14572007-02-09 23:24:49 +090082
Herbert Xu3db05fe2007-10-15 00:53:15 -070083 err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL,
Patrick McHardy16a66772006-01-06 23:01:48 -080084 skb->dst->dev, dst_output);
85 if (unlikely(err != 1))
86 break;
87
88 if (!skb->dst->xfrm)
89 return dst_output(skb);
90
Herbert Xu3db05fe2007-10-15 00:53:15 -070091 err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL,
Herbert Xu09b8f7a2006-06-22 03:08:03 -070092 skb->dst->dev, xfrm6_output_finish2);
Patrick McHardy16a66772006-01-06 23:01:48 -080093 if (unlikely(err != 1))
94 break;
95 }
96
97 return err;
98}
99
Herbert Xu09b8f7a2006-06-22 03:08:03 -0700100static int xfrm6_output_finish(struct sk_buff *skb)
101{
102 struct sk_buff *segs;
103
Herbert Xu89114af2006-07-08 13:34:32 -0700104 if (!skb_is_gso(skb))
Herbert Xu09b8f7a2006-06-22 03:08:03 -0700105 return xfrm6_output_finish2(skb);
106
Patrick McHardy679e8982006-07-30 20:19:11 -0700107 skb->protocol = htons(ETH_P_IPV6);
Herbert Xu09b8f7a2006-06-22 03:08:03 -0700108 segs = skb_gso_segment(skb, 0);
109 kfree_skb(skb);
110 if (unlikely(IS_ERR(segs)))
111 return PTR_ERR(segs);
112
113 do {
114 struct sk_buff *nskb = segs->next;
115 int err;
116
117 segs->next = NULL;
118 err = xfrm6_output_finish2(segs);
119
120 if (unlikely(err)) {
121 while ((segs = nskb)) {
122 nskb = segs->next;
123 segs->next = NULL;
124 kfree_skb(segs);
125 }
126 return err;
127 }
128
129 segs = nskb;
130 } while (segs);
131
132 return 0;
133}
134
Patrick McHardy16a66772006-01-06 23:01:48 -0800135int xfrm6_output(struct sk_buff *skb)
136{
137 return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev,
138 xfrm6_output_finish);
139}