Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * xfrm6_output.c - Common IPsec encapsulation code for IPv6. |
| 3 | * Copyright (C) 2002 USAGI/WIDE Project |
| 4 | * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> |
| 5 | * |
| 6 | * This program is free software; you can redistribute it and/or |
| 7 | * modify it under the terms of the GNU General Public License |
| 8 | * as published by the Free Software Foundation; either version |
| 9 | * 2 of the License, or (at your option) any later version. |
| 10 | */ |
| 11 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 12 | #include <linux/compiler.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 13 | #include <linux/skbuff.h> |
| 14 | #include <linux/spinlock.h> |
| 15 | #include <linux/icmpv6.h> |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 16 | #include <linux/netfilter_ipv6.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | #include <net/ipv6.h> |
| 18 | #include <net/xfrm.h> |
| 19 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 20 | static int xfrm6_tunnel_check_size(struct sk_buff *skb) |
| 21 | { |
| 22 | int mtu, ret = 0; |
| 23 | struct dst_entry *dst = skb->dst; |
| 24 | |
| 25 | mtu = dst_mtu(dst); |
| 26 | if (mtu < IPV6_MIN_MTU) |
| 27 | mtu = IPV6_MIN_MTU; |
| 28 | |
| 29 | if (skb->len > mtu) { |
Herbert Xu | 180e425 | 2005-05-23 13:11:07 -0700 | [diff] [blame] | 30 | skb->dev = dst->dev; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 31 | icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); |
| 32 | ret = -EMSGSIZE; |
| 33 | } |
| 34 | |
| 35 | return ret; |
| 36 | } |
| 37 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 38 | static int xfrm6_output_one(struct sk_buff *skb) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 39 | { |
| 40 | struct dst_entry *dst = skb->dst; |
| 41 | struct xfrm_state *x = dst->xfrm; |
| 42 | int err; |
| 43 | |
| 44 | if (skb->ip_summed == CHECKSUM_HW) { |
| 45 | err = skb_checksum_help(skb, 0); |
| 46 | if (err) |
| 47 | goto error_nolock; |
| 48 | } |
| 49 | |
| 50 | if (x->props.mode) { |
| 51 | err = xfrm6_tunnel_check_size(skb); |
| 52 | if (err) |
| 53 | goto error_nolock; |
| 54 | } |
| 55 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 56 | do { |
| 57 | spin_lock_bh(&x->lock); |
| 58 | err = xfrm_state_check(x, skb); |
| 59 | if (err) |
| 60 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 61 | |
Herbert Xu | b59f45d | 2006-05-27 23:05:54 -0700 | [diff] [blame^] | 62 | err = x->mode->output(skb); |
| 63 | if (err) |
| 64 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 65 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 66 | err = x->type->output(x, skb); |
| 67 | if (err) |
| 68 | goto error; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 69 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 70 | x->curlft.bytes += skb->len; |
| 71 | x->curlft.packets++; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 72 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 73 | spin_unlock_bh(&x->lock); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 74 | |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 75 | skb->nh.raw = skb->data; |
| 76 | |
| 77 | if (!(skb->dst = dst_pop(dst))) { |
| 78 | err = -EHOSTUNREACH; |
| 79 | goto error_nolock; |
| 80 | } |
| 81 | dst = skb->dst; |
| 82 | x = dst->xfrm; |
| 83 | } while (x && !x->props.mode); |
| 84 | |
Patrick McHardy | 3e3850e | 2006-01-06 23:04:54 -0800 | [diff] [blame] | 85 | IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 86 | err = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 87 | |
| 88 | out_exit: |
| 89 | return err; |
| 90 | error: |
| 91 | spin_unlock_bh(&x->lock); |
| 92 | error_nolock: |
| 93 | kfree_skb(skb); |
| 94 | goto out_exit; |
| 95 | } |
Patrick McHardy | 16a6677 | 2006-01-06 23:01:48 -0800 | [diff] [blame] | 96 | |
| 97 | static int xfrm6_output_finish(struct sk_buff *skb) |
| 98 | { |
| 99 | int err; |
| 100 | |
| 101 | while (likely((err = xfrm6_output_one(skb)) == 0)) { |
| 102 | nf_reset(skb); |
| 103 | |
| 104 | err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL, |
| 105 | skb->dst->dev, dst_output); |
| 106 | if (unlikely(err != 1)) |
| 107 | break; |
| 108 | |
| 109 | if (!skb->dst->xfrm) |
| 110 | return dst_output(skb); |
| 111 | |
| 112 | err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL, |
| 113 | skb->dst->dev, xfrm6_output_finish); |
| 114 | if (unlikely(err != 1)) |
| 115 | break; |
| 116 | } |
| 117 | |
| 118 | return err; |
| 119 | } |
| 120 | |
| 121 | int xfrm6_output(struct sk_buff *skb) |
| 122 | { |
| 123 | return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev, |
| 124 | xfrm6_output_finish); |
| 125 | } |