11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * xfrm4_output.c - Common IPsec encapsulation code for IPv4. 31da177e4SLinus Torvalds * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 41da177e4SLinus Torvalds * 51da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or 61da177e4SLinus Torvalds * modify it under the terms of the GNU General Public License 71da177e4SLinus Torvalds * as published by the Free Software Foundation; either version 81da177e4SLinus Torvalds * 2 of the License, or (at your option) any later version. 91da177e4SLinus Torvalds */ 101da177e4SLinus Torvalds 111da177e4SLinus Torvalds #include <linux/skbuff.h> 121da177e4SLinus Torvalds #include <linux/spinlock.h> 131da177e4SLinus Torvalds #include <net/inet_ecn.h> 141da177e4SLinus Torvalds #include <net/ip.h> 151da177e4SLinus Torvalds #include <net/xfrm.h> 161da177e4SLinus Torvalds #include <net/icmp.h> 171da177e4SLinus Torvalds 181da177e4SLinus Torvalds /* Add encapsulation header. 191da177e4SLinus Torvalds * 201da177e4SLinus Torvalds * In transport mode, the IP header will be moved forward to make space 211da177e4SLinus Torvalds * for the encapsulation header. 221da177e4SLinus Torvalds * 231da177e4SLinus Torvalds * In tunnel mode, the top IP header will be constructed per RFC 2401. 241da177e4SLinus Torvalds * The following fields in it shall be filled in by x->type->output: 251da177e4SLinus Torvalds * tot_len 261da177e4SLinus Torvalds * check 271da177e4SLinus Torvalds * 281da177e4SLinus Torvalds * On exit, skb->h will be set to the start of the payload to be processed 291da177e4SLinus Torvalds * by x->type->output and skb->nh will be set to the top IP header. 301da177e4SLinus Torvalds */ 311da177e4SLinus Torvalds static void xfrm4_encap(struct sk_buff *skb) 321da177e4SLinus Torvalds { 331da177e4SLinus Torvalds struct dst_entry *dst = skb->dst; 341da177e4SLinus Torvalds struct xfrm_state *x = dst->xfrm; 351da177e4SLinus Torvalds struct iphdr *iph, *top_iph; 36dd87147eSHerbert Xu int flags; 371da177e4SLinus Torvalds 381da177e4SLinus Torvalds iph = skb->nh.iph; 391da177e4SLinus Torvalds skb->h.ipiph = iph; 401da177e4SLinus Torvalds 411da177e4SLinus Torvalds skb->nh.raw = skb_push(skb, x->props.header_len); 421da177e4SLinus Torvalds top_iph = skb->nh.iph; 431da177e4SLinus Torvalds 441da177e4SLinus Torvalds if (!x->props.mode) { 451da177e4SLinus Torvalds skb->h.raw += iph->ihl*4; 461da177e4SLinus Torvalds memmove(top_iph, iph, iph->ihl*4); 471da177e4SLinus Torvalds return; 481da177e4SLinus Torvalds } 491da177e4SLinus Torvalds 501da177e4SLinus Torvalds top_iph->ihl = 5; 511da177e4SLinus Torvalds top_iph->version = 4; 521da177e4SLinus Torvalds 531da177e4SLinus Torvalds /* DS disclosed */ 541da177e4SLinus Torvalds top_iph->tos = INET_ECN_encapsulate(iph->tos, iph->tos); 55dd87147eSHerbert Xu 56dd87147eSHerbert Xu flags = x->props.flags; 57dd87147eSHerbert Xu if (flags & XFRM_STATE_NOECN) 581da177e4SLinus Torvalds IP_ECN_clear(top_iph); 591da177e4SLinus Torvalds 60dd87147eSHerbert Xu top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ? 61dd87147eSHerbert Xu 0 : (iph->frag_off & htons(IP_DF)); 621da177e4SLinus Torvalds if (!top_iph->frag_off) 631da177e4SLinus Torvalds __ip_select_ident(top_iph, dst, 0); 641da177e4SLinus Torvalds 651da177e4SLinus Torvalds top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT); 661da177e4SLinus Torvalds 671da177e4SLinus Torvalds top_iph->saddr = x->props.saddr.a4; 681da177e4SLinus Torvalds top_iph->daddr = x->id.daddr.a4; 691da177e4SLinus Torvalds top_iph->protocol = IPPROTO_IPIP; 701da177e4SLinus Torvalds 711da177e4SLinus Torvalds memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options)); 721da177e4SLinus Torvalds } 731da177e4SLinus Torvalds 741da177e4SLinus Torvalds static int xfrm4_tunnel_check_size(struct sk_buff *skb) 751da177e4SLinus Torvalds { 761da177e4SLinus Torvalds int mtu, ret = 0; 771da177e4SLinus Torvalds struct dst_entry *dst; 781da177e4SLinus Torvalds struct iphdr *iph = skb->nh.iph; 791da177e4SLinus Torvalds 801da177e4SLinus Torvalds if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE) 811da177e4SLinus Torvalds goto out; 821da177e4SLinus Torvalds 831da177e4SLinus Torvalds IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE; 841da177e4SLinus Torvalds 851da177e4SLinus Torvalds if (!(iph->frag_off & htons(IP_DF)) || skb->local_df) 861da177e4SLinus Torvalds goto out; 871da177e4SLinus Torvalds 881da177e4SLinus Torvalds dst = skb->dst; 891da177e4SLinus Torvalds mtu = dst_mtu(dst); 901da177e4SLinus Torvalds if (skb->len > mtu) { 911da177e4SLinus Torvalds icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); 921da177e4SLinus Torvalds ret = -EMSGSIZE; 931da177e4SLinus Torvalds } 941da177e4SLinus Torvalds out: 951da177e4SLinus Torvalds return ret; 961da177e4SLinus Torvalds } 971da177e4SLinus Torvalds 981da177e4SLinus Torvalds int xfrm4_output(struct sk_buff *skb) 991da177e4SLinus Torvalds { 1001da177e4SLinus Torvalds struct dst_entry *dst = skb->dst; 1011da177e4SLinus Torvalds struct xfrm_state *x = dst->xfrm; 1021da177e4SLinus Torvalds int err; 1031da177e4SLinus Torvalds 1041da177e4SLinus Torvalds if (skb->ip_summed == CHECKSUM_HW) { 1051da177e4SLinus Torvalds err = skb_checksum_help(skb, 0); 1061da177e4SLinus Torvalds if (err) 1071da177e4SLinus Torvalds goto error_nolock; 1081da177e4SLinus Torvalds } 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvalds if (x->props.mode) { 1111da177e4SLinus Torvalds err = xfrm4_tunnel_check_size(skb); 1121da177e4SLinus Torvalds if (err) 1131da177e4SLinus Torvalds goto error_nolock; 1141da177e4SLinus Torvalds } 1151da177e4SLinus Torvalds 1161da177e4SLinus Torvalds spin_lock_bh(&x->lock); 1171da177e4SLinus Torvalds err = xfrm_state_check(x, skb); 1181da177e4SLinus Torvalds if (err) 1191da177e4SLinus Torvalds goto error; 1201da177e4SLinus Torvalds 1211da177e4SLinus Torvalds xfrm4_encap(skb); 1221da177e4SLinus Torvalds 1231da177e4SLinus Torvalds err = x->type->output(x, skb); 1241da177e4SLinus Torvalds if (err) 1251da177e4SLinus Torvalds goto error; 1261da177e4SLinus Torvalds 1271da177e4SLinus Torvalds x->curlft.bytes += skb->len; 1281da177e4SLinus Torvalds x->curlft.packets++; 1291da177e4SLinus Torvalds 1301da177e4SLinus Torvalds spin_unlock_bh(&x->lock); 1311da177e4SLinus Torvalds 1321da177e4SLinus Torvalds if (!(skb->dst = dst_pop(dst))) { 1331da177e4SLinus Torvalds err = -EHOSTUNREACH; 1341da177e4SLinus Torvalds goto error_nolock; 1351da177e4SLinus Torvalds } 1361da177e4SLinus Torvalds err = NET_XMIT_BYPASS; 1371da177e4SLinus Torvalds 1381da177e4SLinus Torvalds out_exit: 1391da177e4SLinus Torvalds return err; 1401da177e4SLinus Torvalds error: 1411da177e4SLinus Torvalds spin_unlock_bh(&x->lock); 1421da177e4SLinus Torvalds error_nolock: 1431da177e4SLinus Torvalds kfree_skb(skb); 1441da177e4SLinus Torvalds goto out_exit; 1451da177e4SLinus Torvalds } 146