1 /* 2 * xfrm6_output.c - Common IPsec encapsulation code for IPv6. 3 * Copyright (C) 2002 USAGI/WIDE Project 4 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/if_ether.h> 13 #include <linux/compiler.h> 14 #include <linux/skbuff.h> 15 #include <linux/icmpv6.h> 16 #include <linux/netfilter_ipv6.h> 17 #include <net/ipv6.h> 18 #include <net/xfrm.h> 19 20 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 21 u8 **prevhdr) 22 { 23 return ip6_find_1stfragopt(skb, prevhdr); 24 } 25 26 EXPORT_SYMBOL(xfrm6_find_1stfragopt); 27 28 static int xfrm6_tunnel_check_size(struct sk_buff *skb) 29 { 30 int mtu, ret = 0; 31 struct dst_entry *dst = skb->dst; 32 33 mtu = dst_mtu(dst); 34 if (mtu < IPV6_MIN_MTU) 35 mtu = IPV6_MIN_MTU; 36 37 if (skb->len > mtu) { 38 skb->dev = dst->dev; 39 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); 40 ret = -EMSGSIZE; 41 } 42 43 return ret; 44 } 45 46 static inline int xfrm6_output_one(struct sk_buff *skb) 47 { 48 struct dst_entry *dst = skb->dst; 49 struct xfrm_state *x = dst->xfrm; 50 int err; 51 52 if (x->props.mode == XFRM_MODE_TUNNEL) { 53 err = xfrm6_tunnel_check_size(skb); 54 if (err) 55 goto error_nolock; 56 } 57 58 err = xfrm_output(skb); 59 if (err) 60 goto error_nolock; 61 62 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; 63 err = 0; 64 65 out_exit: 66 return err; 67 error_nolock: 68 kfree_skb(skb); 69 goto out_exit; 70 } 71 72 static int xfrm6_output_finish2(struct sk_buff *skb) 73 { 74 int err; 75 76 while (likely((err = xfrm6_output_one(skb)) == 0)) { 77 nf_reset(skb); 78 79 err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL, 80 skb->dst->dev, dst_output); 81 if (unlikely(err != 1)) 82 break; 83 84 if (!skb->dst->xfrm) 85 return dst_output(skb); 86 87 err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL, 88 skb->dst->dev, xfrm6_output_finish2); 89 if (unlikely(err != 1)) 90 break; 91 } 92 93 return err; 94 } 95 96 static int xfrm6_output_finish(struct sk_buff *skb) 97 { 98 struct sk_buff *segs; 99 100 if (!skb_is_gso(skb)) 101 return xfrm6_output_finish2(skb); 102 103 skb->protocol = htons(ETH_P_IPV6); 104 segs = skb_gso_segment(skb, 0); 105 kfree_skb(skb); 106 if (unlikely(IS_ERR(segs))) 107 return PTR_ERR(segs); 108 109 do { 110 struct sk_buff *nskb = segs->next; 111 int err; 112 113 segs->next = NULL; 114 err = xfrm6_output_finish2(segs); 115 116 if (unlikely(err)) { 117 while ((segs = nskb)) { 118 nskb = segs->next; 119 segs->next = NULL; 120 kfree_skb(segs); 121 } 122 return err; 123 } 124 125 segs = nskb; 126 } while (segs); 127 128 return 0; 129 } 130 131 int xfrm6_output(struct sk_buff *skb) 132 { 133 return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev, 134 xfrm6_output_finish); 135 } 136