Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm4_output.c - Common IPsec encapsulation code for IPv4. |
| 3 | * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 4 | * |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | * This program is free software; you can redistribute it and/or |
| 6 | * modify it under the terms of the GNU General Public License |
| 7 | * as published by the Free Software Foundation; either version |
| 8 | * 2 of the License, or (at your option) any later version. |
| 9 | */ |
| 10 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 11 | #include <linux/compiler.h> |
Herbert Xu | 09b8f7a | 2006-06-22 03:08:03 -0700 | [diff] [blame] | 12 | #include <linux/if_ether.h> |
| 13 | #include <linux/kernel.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 14 | #include <linux/skbuff.h> |
| 15 | #include <linux/spinlock.h> |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 16 | #include <linux/netfilter_ipv4.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | #include <net/ip.h> |
| 18 | #include <net/xfrm.h> |
| 19 | #include <net/icmp.h> |
| 20 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 21 | static int xfrm4_tunnel_check_size(struct sk_buff *skb) |
| 22 | { |
| 23 | int mtu, ret = 0; |
| 24 | struct dst_entry *dst; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 25 | |
| 26 | if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE) |
| 27 | goto out; |
| 28 | |
| 29 | IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE; |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 30 | |
Arnaldo Carvalho de Melo | eddc9ec | 2007-04-20 22:47:35 -0700 | [diff] [blame] | 31 | if (!(ip_hdr(skb)->frag_off & htons(IP_DF)) || skb->local_df) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 32 | goto out; |
| 33 | |
| 34 | dst = skb->dst; |
| 35 | mtu = dst_mtu(dst); |
| 36 | if (skb->len > mtu) { |
| 37 | icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); |
| 38 | ret = -EMSGSIZE; |
| 39 | } |
| 40 | out: |
| 41 | return ret; |
| 42 | } |
| 43 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 44 | static int xfrm4_output_one(struct sk_buff *skb) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | { |
| 46 | struct dst_entry *dst = skb->dst; |
| 47 | struct xfrm_state *x = dst->xfrm; |
| 48 | int err; |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 49 | |
Patrick McHardy | 84fa793 | 2006-08-29 16:44:56 -0700 | [diff] [blame] | 50 | if (skb->ip_summed == CHECKSUM_PARTIAL) { |
| 51 | err = skb_checksum_help(skb); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 52 | if (err) |
| 53 | goto error_nolock; |
| 54 | } |
| 55 | |
Masahide NAKAMURA | 7e49e6d | 2006-09-22 15:05:15 -0700 | [diff] [blame] | 56 | if (x->props.mode == XFRM_MODE_TUNNEL) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 57 | err = xfrm4_tunnel_check_size(skb); |
| 58 | if (err) |
| 59 | goto error_nolock; |
| 60 | } |
| 61 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 62 | do { |
| 63 | spin_lock_bh(&x->lock); |
| 64 | err = xfrm_state_check(x, skb); |
| 65 | if (err) |
| 66 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 67 | |
Jamal Hadi Salim | eb878e8 | 2006-08-31 17:42:59 -0700 | [diff] [blame] | 68 | err = x->mode->output(x, skb); |
Herbert Xu | b59f45d | 2006-05-27 23:05:54 -0700 | [diff] [blame] | 69 | if (err) |
| 70 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 71 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 72 | err = x->type->output(x, skb); |
| 73 | if (err) |
| 74 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 75 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 76 | x->curlft.bytes += skb->len; |
| 77 | x->curlft.packets++; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 79 | spin_unlock_bh(&x->lock); |
YOSHIFUJI Hideaki | e905a9e | 2007-02-09 23:24:47 +0900 | [diff] [blame] | 80 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 81 | if (!(skb->dst = dst_pop(dst))) { |
| 82 | err = -EHOSTUNREACH; |
| 83 | goto error_nolock; |
| 84 | } |
| 85 | dst = skb->dst; |
| 86 | x = dst->xfrm; |
Masahide NAKAMURA | 7e49e6d | 2006-09-22 15:05:15 -0700 | [diff] [blame] | 87 | } while (x && (x->props.mode != XFRM_MODE_TUNNEL)); |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 88 | |
Patrick McHardy | 3e3850e | 2006-01-06 23:04:54 -0800 | [diff] [blame] | 89 | IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED; |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 90 | err = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 91 | |
| 92 | out_exit: |
| 93 | return err; |
| 94 | error: |
| 95 | spin_unlock_bh(&x->lock); |
| 96 | error_nolock: |
| 97 | kfree_skb(skb); |
| 98 | goto out_exit; |
| 99 | } |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 100 | |
Herbert Xu | 09b8f7a | 2006-06-22 03:08:03 -0700 | [diff] [blame] | 101 | static int xfrm4_output_finish2(struct sk_buff *skb) |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 102 | { |
| 103 | int err; |
| 104 | |
| 105 | while (likely((err = xfrm4_output_one(skb)) == 0)) { |
| 106 | nf_reset(skb); |
| 107 | |
| 108 | err = nf_hook(PF_INET, NF_IP_LOCAL_OUT, &skb, NULL, |
| 109 | skb->dst->dev, dst_output); |
| 110 | if (unlikely(err != 1)) |
| 111 | break; |
| 112 | |
| 113 | if (!skb->dst->xfrm) |
| 114 | return dst_output(skb); |
| 115 | |
| 116 | err = nf_hook(PF_INET, NF_IP_POST_ROUTING, &skb, NULL, |
Herbert Xu | 09b8f7a | 2006-06-22 03:08:03 -0700 | [diff] [blame] | 117 | skb->dst->dev, xfrm4_output_finish2); |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 118 | if (unlikely(err != 1)) |
| 119 | break; |
| 120 | } |
| 121 | |
| 122 | return err; |
| 123 | } |
| 124 | |
Herbert Xu | 09b8f7a | 2006-06-22 03:08:03 -0700 | [diff] [blame] | 125 | static int xfrm4_output_finish(struct sk_buff *skb) |
| 126 | { |
| 127 | struct sk_buff *segs; |
| 128 | |
| 129 | #ifdef CONFIG_NETFILTER |
| 130 | if (!skb->dst->xfrm) { |
| 131 | IPCB(skb)->flags |= IPSKB_REROUTED; |
| 132 | return dst_output(skb); |
| 133 | } |
| 134 | #endif |
| 135 | |
Herbert Xu | 89114af | 2006-07-08 13:34:32 -0700 | [diff] [blame] | 136 | if (!skb_is_gso(skb)) |
Herbert Xu | 09b8f7a | 2006-06-22 03:08:03 -0700 | [diff] [blame] | 137 | return xfrm4_output_finish2(skb); |
| 138 | |
| 139 | skb->protocol = htons(ETH_P_IP); |
| 140 | segs = skb_gso_segment(skb, 0); |
| 141 | kfree_skb(skb); |
| 142 | if (unlikely(IS_ERR(segs))) |
| 143 | return PTR_ERR(segs); |
| 144 | |
| 145 | do { |
| 146 | struct sk_buff *nskb = segs->next; |
| 147 | int err; |
| 148 | |
| 149 | segs->next = NULL; |
| 150 | err = xfrm4_output_finish2(segs); |
| 151 | |
| 152 | if (unlikely(err)) { |
| 153 | while ((segs = nskb)) { |
| 154 | nskb = segs->next; |
| 155 | segs->next = NULL; |
| 156 | kfree_skb(segs); |
| 157 | } |
| 158 | return err; |
| 159 | } |
| 160 | |
| 161 | segs = nskb; |
| 162 | } while (segs); |
| 163 | |
| 164 | return 0; |
| 165 | } |
| 166 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 167 | int xfrm4_output(struct sk_buff *skb) |
| 168 | { |
Patrick McHardy | 48d5cad | 2006-02-15 15:10:22 -0800 | [diff] [blame] | 169 | return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev, |
| 170 | xfrm4_output_finish, |
| 171 | !(IPCB(skb)->flags & IPSKB_REROUTED)); |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 172 | } |