1 /* 2 * xfrm6_output.c - Common IPsec encapsulation code for IPv6. 3 * Copyright (C) 2002 USAGI/WIDE Project 4 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/if_ether.h> 13 #include <linux/kernel.h> 14 #include <linux/module.h> 15 #include <linux/skbuff.h> 16 #include <linux/icmpv6.h> 17 #include <linux/netfilter_ipv6.h> 18 #include <net/dst.h> 19 #include <net/ipv6.h> 20 #include <net/ip6_route.h> 21 #include <net/xfrm.h> 22 23 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 24 u8 **prevhdr) 25 { 26 return ip6_find_1stfragopt(skb, prevhdr); 27 } 28 29 EXPORT_SYMBOL(xfrm6_find_1stfragopt); 30 31 static int xfrm6_local_dontfrag(struct sk_buff *skb) 32 { 33 int proto; 34 struct sock *sk = skb->sk; 35 36 if (sk) { 37 if (sk->sk_family != AF_INET6) 38 return 0; 39 40 proto = sk->sk_protocol; 41 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW) 42 return inet6_sk(sk)->dontfrag; 43 } 44 45 return 0; 46 } 47 48 static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu) 49 { 50 struct flowi6 fl6; 51 struct sock *sk = skb->sk; 52 53 fl6.flowi6_oif = sk->sk_bound_dev_if; 54 fl6.daddr = ipv6_hdr(skb)->daddr; 55 56 ipv6_local_rxpmtu(sk, &fl6, mtu); 57 } 58 59 void xfrm6_local_error(struct sk_buff *skb, u32 mtu) 60 { 61 struct flowi6 fl6; 62 const struct ipv6hdr *hdr; 63 struct sock *sk = skb->sk; 64 65 hdr = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb); 66 fl6.fl6_dport = inet_sk(sk)->inet_dport; 67 fl6.daddr = hdr->daddr; 68 69 ipv6_local_error(sk, EMSGSIZE, &fl6, mtu); 70 } 71 72 static int xfrm6_tunnel_check_size(struct sk_buff *skb) 73 { 74 int mtu, ret = 0; 75 struct dst_entry *dst = skb_dst(skb); 76 77 mtu = dst_mtu(dst); 78 if (mtu < IPV6_MIN_MTU) 79 mtu = IPV6_MIN_MTU; 80 81 if (!skb->ignore_df && skb->len > mtu) { 82 skb->dev = dst->dev; 83 84 if (xfrm6_local_dontfrag(skb)) 85 xfrm6_local_rxpmtu(skb, mtu); 86 else if (skb->sk) 87 xfrm_local_error(skb, mtu); 88 else 89 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 90 ret = -EMSGSIZE; 91 } 92 93 return ret; 94 } 95 96 int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb) 97 { 98 int err; 99 100 err = xfrm6_tunnel_check_size(skb); 101 if (err) 102 return err; 103 104 XFRM_MODE_SKB_CB(skb)->protocol = ipv6_hdr(skb)->nexthdr; 105 106 return xfrm6_extract_header(skb); 107 } 108 109 int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb) 110 { 111 int err; 112 113 err = xfrm_inner_extract_output(x, skb); 114 if (err) 115 return err; 116 117 skb->ignore_df = 1; 118 119 return x->outer_mode->output2(x, skb); 120 } 121 EXPORT_SYMBOL(xfrm6_prepare_output); 122 123 int xfrm6_output_finish(struct sk_buff *skb) 124 { 125 memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); 126 skb->protocol = htons(ETH_P_IPV6); 127 128 #ifdef CONFIG_NETFILTER 129 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; 130 #endif 131 132 return xfrm_output(skb); 133 } 134 135 static int __xfrm6_output(struct sk_buff *skb) 136 { 137 struct dst_entry *dst = skb_dst(skb); 138 struct xfrm_state *x = dst->xfrm; 139 int mtu; 140 141 #ifdef CONFIG_NETFILTER 142 if (!x) { 143 IP6CB(skb)->flags |= IP6SKB_REROUTED; 144 return dst_output(skb); 145 } 146 #endif 147 148 if (skb->protocol == htons(ETH_P_IPV6)) 149 mtu = ip6_skb_dst_mtu(skb); 150 else 151 mtu = dst_mtu(skb_dst(skb)); 152 153 if (skb->len > mtu && xfrm6_local_dontfrag(skb)) { 154 xfrm6_local_rxpmtu(skb, mtu); 155 return -EMSGSIZE; 156 } else if (!skb->ignore_df && skb->len > mtu && skb->sk) { 157 xfrm_local_error(skb, mtu); 158 return -EMSGSIZE; 159 } 160 161 if (x->props.mode == XFRM_MODE_TUNNEL && 162 ((skb->len > mtu && !skb_is_gso(skb)) || 163 dst_allfrag(skb_dst(skb)))) { 164 return ip6_fragment(skb, x->outer_mode->afinfo->output_finish); 165 } 166 return x->outer_mode->afinfo->output_finish(skb); 167 } 168 169 int xfrm6_output(struct sock *sk, struct sk_buff *skb) 170 { 171 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, 172 NULL, skb_dst(skb)->dev, __xfrm6_output, 173 !(IP6CB(skb)->flags & IP6SKB_REROUTED)); 174 } 175