11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * xfrm4_output.c - Common IPsec encapsulation code for IPv4. 31da177e4SLinus Torvalds * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 41da177e4SLinus Torvalds * 51da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or 61da177e4SLinus Torvalds * modify it under the terms of the GNU General Public License 71da177e4SLinus Torvalds * as published by the Free Software Foundation; either version 81da177e4SLinus Torvalds * 2 of the License, or (at your option) any later version. 91da177e4SLinus Torvalds */ 101da177e4SLinus Torvalds 111da177e4SLinus Torvalds #include <linux/skbuff.h> 121da177e4SLinus Torvalds #include <linux/spinlock.h> 131da177e4SLinus Torvalds #include <net/inet_ecn.h> 141da177e4SLinus Torvalds #include <net/ip.h> 151da177e4SLinus Torvalds #include <net/xfrm.h> 161da177e4SLinus Torvalds #include <net/icmp.h> 171da177e4SLinus Torvalds 181da177e4SLinus Torvalds /* Add encapsulation header. 191da177e4SLinus Torvalds * 201da177e4SLinus Torvalds * In transport mode, the IP header will be moved forward to make space 211da177e4SLinus Torvalds * for the encapsulation header. 221da177e4SLinus Torvalds * 231da177e4SLinus Torvalds * In tunnel mode, the top IP header will be constructed per RFC 2401. 241da177e4SLinus Torvalds * The following fields in it shall be filled in by x->type->output: 251da177e4SLinus Torvalds * tot_len 261da177e4SLinus Torvalds * check 271da177e4SLinus Torvalds * 281da177e4SLinus Torvalds * On exit, skb->h will be set to the start of the payload to be processed 291da177e4SLinus Torvalds * by x->type->output and skb->nh will be set to the top IP header. 301da177e4SLinus Torvalds */ 311da177e4SLinus Torvalds static void xfrm4_encap(struct sk_buff *skb) 321da177e4SLinus Torvalds { 331da177e4SLinus Torvalds struct dst_entry *dst = skb->dst; 341da177e4SLinus Torvalds struct xfrm_state *x = dst->xfrm; 351da177e4SLinus Torvalds struct iphdr *iph, *top_iph; 361da177e4SLinus Torvalds 371da177e4SLinus Torvalds iph = skb->nh.iph; 381da177e4SLinus Torvalds skb->h.ipiph = iph; 391da177e4SLinus Torvalds 401da177e4SLinus Torvalds skb->nh.raw = skb_push(skb, x->props.header_len); 411da177e4SLinus Torvalds top_iph = skb->nh.iph; 421da177e4SLinus Torvalds 431da177e4SLinus Torvalds if (!x->props.mode) { 441da177e4SLinus Torvalds skb->h.raw += iph->ihl*4; 451da177e4SLinus Torvalds memmove(top_iph, iph, iph->ihl*4); 461da177e4SLinus Torvalds return; 471da177e4SLinus Torvalds } 481da177e4SLinus Torvalds 491da177e4SLinus Torvalds top_iph->ihl = 5; 501da177e4SLinus Torvalds top_iph->version = 4; 511da177e4SLinus Torvalds 521da177e4SLinus Torvalds /* DS disclosed */ 531da177e4SLinus Torvalds top_iph->tos = INET_ECN_encapsulate(iph->tos, iph->tos); 541da177e4SLinus Torvalds if (x->props.flags & XFRM_STATE_NOECN) 551da177e4SLinus Torvalds IP_ECN_clear(top_iph); 561da177e4SLinus Torvalds 571da177e4SLinus Torvalds top_iph->frag_off = iph->frag_off & htons(IP_DF); 581da177e4SLinus Torvalds if (!top_iph->frag_off) 591da177e4SLinus Torvalds __ip_select_ident(top_iph, dst, 0); 601da177e4SLinus Torvalds 611da177e4SLinus Torvalds top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT); 621da177e4SLinus Torvalds 631da177e4SLinus Torvalds top_iph->saddr = x->props.saddr.a4; 641da177e4SLinus Torvalds top_iph->daddr = x->id.daddr.a4; 651da177e4SLinus Torvalds top_iph->protocol = IPPROTO_IPIP; 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options)); 681da177e4SLinus Torvalds } 691da177e4SLinus Torvalds 701da177e4SLinus Torvalds static int xfrm4_tunnel_check_size(struct sk_buff *skb) 711da177e4SLinus Torvalds { 721da177e4SLinus Torvalds int mtu, ret = 0; 731da177e4SLinus Torvalds struct dst_entry *dst; 741da177e4SLinus Torvalds struct iphdr *iph = skb->nh.iph; 751da177e4SLinus Torvalds 761da177e4SLinus Torvalds if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE) 771da177e4SLinus Torvalds goto out; 781da177e4SLinus Torvalds 791da177e4SLinus Torvalds IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE; 801da177e4SLinus Torvalds 811da177e4SLinus Torvalds if (!(iph->frag_off & htons(IP_DF)) || skb->local_df) 821da177e4SLinus Torvalds goto out; 831da177e4SLinus Torvalds 841da177e4SLinus Torvalds dst = skb->dst; 851da177e4SLinus Torvalds mtu = dst_mtu(dst); 861da177e4SLinus Torvalds if (skb->len > mtu) { 871da177e4SLinus Torvalds icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); 881da177e4SLinus Torvalds ret = -EMSGSIZE; 891da177e4SLinus Torvalds } 901da177e4SLinus Torvalds out: 911da177e4SLinus Torvalds return ret; 921da177e4SLinus Torvalds } 931da177e4SLinus Torvalds 941da177e4SLinus Torvalds int xfrm4_output(struct sk_buff *skb) 951da177e4SLinus Torvalds { 961da177e4SLinus Torvalds struct dst_entry *dst = skb->dst; 971da177e4SLinus Torvalds struct xfrm_state *x = dst->xfrm; 981da177e4SLinus Torvalds int err; 991da177e4SLinus Torvalds 1001da177e4SLinus Torvalds if (skb->ip_summed == CHECKSUM_HW) { 1011da177e4SLinus Torvalds err = skb_checksum_help(skb, 0); 1021da177e4SLinus Torvalds if (err) 1031da177e4SLinus Torvalds goto error_nolock; 1041da177e4SLinus Torvalds } 1051da177e4SLinus Torvalds 1061da177e4SLinus Torvalds if (x->props.mode) { 1071da177e4SLinus Torvalds err = xfrm4_tunnel_check_size(skb); 1081da177e4SLinus Torvalds if (err) 1091da177e4SLinus Torvalds goto error_nolock; 1101da177e4SLinus Torvalds } 1111da177e4SLinus Torvalds 1121da177e4SLinus Torvalds spin_lock_bh(&x->lock); 1131da177e4SLinus Torvalds err = xfrm_state_check(x, skb); 1141da177e4SLinus Torvalds if (err) 1151da177e4SLinus Torvalds goto error; 1161da177e4SLinus Torvalds 1171da177e4SLinus Torvalds xfrm4_encap(skb); 1181da177e4SLinus Torvalds 1191da177e4SLinus Torvalds err = x->type->output(x, skb); 1201da177e4SLinus Torvalds if (err) 1211da177e4SLinus Torvalds goto error; 1221da177e4SLinus Torvalds 1231da177e4SLinus Torvalds x->curlft.bytes += skb->len; 1241da177e4SLinus Torvalds x->curlft.packets++; 1251da177e4SLinus Torvalds 1261da177e4SLinus Torvalds spin_unlock_bh(&x->lock); 1271da177e4SLinus Torvalds 1281da177e4SLinus Torvalds if (!(skb->dst = dst_pop(dst))) { 1291da177e4SLinus Torvalds err = -EHOSTUNREACH; 1301da177e4SLinus Torvalds goto error_nolock; 1311da177e4SLinus Torvalds } 1321da177e4SLinus Torvalds err = NET_XMIT_BYPASS; 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds out_exit: 1351da177e4SLinus Torvalds return err; 1361da177e4SLinus Torvalds error: 1371da177e4SLinus Torvalds spin_unlock_bh(&x->lock); 1381da177e4SLinus Torvalds error_nolock: 1391da177e4SLinus Torvalds kfree_skb(skb); 1401da177e4SLinus Torvalds goto out_exit; 1411da177e4SLinus Torvalds } 142