1 /* 2 * xfrm6_output.c - Common IPsec encapsulation code for IPv6. 3 * Copyright (C) 2002 USAGI/WIDE Project 4 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/if_ether.h> 13 #include <linux/compiler.h> 14 #include <linux/skbuff.h> 15 #include <linux/icmpv6.h> 16 #include <linux/netfilter_ipv6.h> 17 #include <net/ipv6.h> 18 #include <net/xfrm.h> 19 20 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 21 u8 **prevhdr) 22 { 23 return ip6_find_1stfragopt(skb, prevhdr); 24 } 25 26 EXPORT_SYMBOL(xfrm6_find_1stfragopt); 27 28 static int xfrm6_tunnel_check_size(struct sk_buff *skb) 29 { 30 int mtu, ret = 0; 31 struct dst_entry *dst = skb->dst; 32 33 mtu = dst_mtu(dst); 34 if (mtu < IPV6_MIN_MTU) 35 mtu = IPV6_MIN_MTU; 36 37 if (skb->len > mtu) { 38 skb->dev = dst->dev; 39 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); 40 ret = -EMSGSIZE; 41 } 42 43 return ret; 44 } 45 46 static inline int xfrm6_output_one(struct sk_buff *skb) 47 { 48 struct dst_entry *dst = skb->dst; 49 struct xfrm_state *x = dst->xfrm; 50 struct ipv6hdr *iph; 51 int err; 52 53 if (x->outer_mode->flags & XFRM_MODE_FLAG_TUNNEL) { 54 err = xfrm6_tunnel_check_size(skb); 55 if (err) 56 goto error_nolock; 57 } 58 59 err = xfrm_output(skb); 60 if (err) 61 goto error_nolock; 62 63 iph = ipv6_hdr(skb); 64 iph->payload_len = htons(skb->len - sizeof(*iph)); 65 66 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; 67 err = 0; 68 69 out_exit: 70 return err; 71 error_nolock: 72 kfree_skb(skb); 73 goto out_exit; 74 } 75 76 static int xfrm6_output_finish2(struct sk_buff *skb) 77 { 78 int err; 79 80 while (likely((err = xfrm6_output_one(skb)) == 0)) { 81 nf_reset(skb); 82 83 err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, 84 skb->dst->dev, dst_output); 85 if (unlikely(err != 1)) 86 break; 87 88 if (!skb->dst->xfrm) 89 return dst_output(skb); 90 91 err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, 92 skb->dst->dev, xfrm6_output_finish2); 93 if (unlikely(err != 1)) 94 break; 95 } 96 97 return err; 98 } 99 100 static int xfrm6_output_finish(struct sk_buff *skb) 101 { 102 struct sk_buff *segs; 103 104 if (!skb_is_gso(skb)) 105 return xfrm6_output_finish2(skb); 106 107 skb->protocol = htons(ETH_P_IPV6); 108 segs = skb_gso_segment(skb, 0); 109 kfree_skb(skb); 110 if (unlikely(IS_ERR(segs))) 111 return PTR_ERR(segs); 112 113 do { 114 struct sk_buff *nskb = segs->next; 115 int err; 116 117 segs->next = NULL; 118 err = xfrm6_output_finish2(segs); 119 120 if (unlikely(err)) { 121 while ((segs = nskb)) { 122 nskb = segs->next; 123 segs->next = NULL; 124 kfree_skb(segs); 125 } 126 return err; 127 } 128 129 segs = nskb; 130 } while (segs); 131 132 return 0; 133 } 134 135 int xfrm6_output(struct sk_buff *skb) 136 { 137 return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev, 138 xfrm6_output_finish); 139 } 140