1 /* 2 * xfrm6_output.c - Common IPsec encapsulation code for IPv6. 3 * Copyright (C) 2002 USAGI/WIDE Project 4 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/compiler.h> 13 #include <linux/skbuff.h> 14 #include <linux/spinlock.h> 15 #include <linux/icmpv6.h> 16 #include <linux/netfilter_ipv6.h> 17 #include <net/ipv6.h> 18 #include <net/xfrm.h> 19 20 static int xfrm6_tunnel_check_size(struct sk_buff *skb) 21 { 22 int mtu, ret = 0; 23 struct dst_entry *dst = skb->dst; 24 25 mtu = dst_mtu(dst); 26 if (mtu < IPV6_MIN_MTU) 27 mtu = IPV6_MIN_MTU; 28 29 if (skb->len > mtu) { 30 skb->dev = dst->dev; 31 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); 32 ret = -EMSGSIZE; 33 } 34 35 return ret; 36 } 37 38 static int xfrm6_output_one(struct sk_buff *skb) 39 { 40 struct dst_entry *dst = skb->dst; 41 struct xfrm_state *x = dst->xfrm; 42 int err; 43 44 if (skb->ip_summed == CHECKSUM_HW) { 45 err = skb_checksum_help(skb, 0); 46 if (err) 47 goto error_nolock; 48 } 49 50 if (x->props.mode) { 51 err = xfrm6_tunnel_check_size(skb); 52 if (err) 53 goto error_nolock; 54 } 55 56 do { 57 spin_lock_bh(&x->lock); 58 err = xfrm_state_check(x, skb); 59 if (err) 60 goto error; 61 62 err = x->mode->output(skb); 63 if (err) 64 goto error; 65 66 err = x->type->output(x, skb); 67 if (err) 68 goto error; 69 70 x->curlft.bytes += skb->len; 71 x->curlft.packets++; 72 73 spin_unlock_bh(&x->lock); 74 75 skb->nh.raw = skb->data; 76 77 if (!(skb->dst = dst_pop(dst))) { 78 err = -EHOSTUNREACH; 79 goto error_nolock; 80 } 81 dst = skb->dst; 82 x = dst->xfrm; 83 } while (x && !x->props.mode); 84 85 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; 86 err = 0; 87 88 out_exit: 89 return err; 90 error: 91 spin_unlock_bh(&x->lock); 92 error_nolock: 93 kfree_skb(skb); 94 goto out_exit; 95 } 96 97 static int xfrm6_output_finish2(struct sk_buff *skb) 98 { 99 int err; 100 101 while (likely((err = xfrm6_output_one(skb)) == 0)) { 102 nf_reset(skb); 103 104 err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL, 105 skb->dst->dev, dst_output); 106 if (unlikely(err != 1)) 107 break; 108 109 if (!skb->dst->xfrm) 110 return dst_output(skb); 111 112 err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL, 113 skb->dst->dev, xfrm6_output_finish2); 114 if (unlikely(err != 1)) 115 break; 116 } 117 118 return err; 119 } 120 121 static int xfrm6_output_finish(struct sk_buff *skb) 122 { 123 struct sk_buff *segs; 124 125 if (!skb_is_gso(skb)) 126 return xfrm6_output_finish2(skb); 127 128 skb->protocol = htons(ETH_P_IP); 129 segs = skb_gso_segment(skb, 0); 130 kfree_skb(skb); 131 if (unlikely(IS_ERR(segs))) 132 return PTR_ERR(segs); 133 134 do { 135 struct sk_buff *nskb = segs->next; 136 int err; 137 138 segs->next = NULL; 139 err = xfrm6_output_finish2(segs); 140 141 if (unlikely(err)) { 142 while ((segs = nskb)) { 143 nskb = segs->next; 144 segs->next = NULL; 145 kfree_skb(segs); 146 } 147 return err; 148 } 149 150 segs = nskb; 151 } while (segs); 152 153 return 0; 154 } 155 156 int xfrm6_output(struct sk_buff *skb) 157 { 158 return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev, 159 xfrm6_output_finish); 160 } 161