1 /* 2 * xfrm6_output.c - Common IPsec encapsulation code for IPv6. 3 * Copyright (C) 2002 USAGI/WIDE Project 4 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/if_ether.h> 13 #include <linux/kernel.h> 14 #include <linux/module.h> 15 #include <linux/skbuff.h> 16 #include <linux/icmpv6.h> 17 #include <linux/netfilter_ipv6.h> 18 #include <net/dst.h> 19 #include <net/ipv6.h> 20 #include <net/ip6_route.h> 21 #include <net/xfrm.h> 22 23 int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, 24 u8 **prevhdr) 25 { 26 return ip6_find_1stfragopt(skb, prevhdr); 27 } 28 29 EXPORT_SYMBOL(xfrm6_find_1stfragopt); 30 31 static int xfrm6_local_dontfrag(struct sk_buff *skb) 32 { 33 int proto; 34 struct sock *sk = skb->sk; 35 36 if (sk) { 37 proto = sk->sk_protocol; 38 39 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW) 40 return inet6_sk(sk)->dontfrag; 41 } 42 43 return 0; 44 } 45 46 static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu) 47 { 48 struct flowi6 fl6; 49 struct sock *sk = skb->sk; 50 51 fl6.flowi6_oif = sk->sk_bound_dev_if; 52 fl6.daddr = ipv6_hdr(skb)->daddr; 53 54 ipv6_local_rxpmtu(sk, &fl6, mtu); 55 } 56 57 static void xfrm6_local_error(struct sk_buff *skb, u32 mtu) 58 { 59 struct flowi6 fl6; 60 struct sock *sk = skb->sk; 61 62 fl6.fl6_dport = inet_sk(sk)->inet_dport; 63 fl6.daddr = ipv6_hdr(skb)->daddr; 64 65 ipv6_local_error(sk, EMSGSIZE, &fl6, mtu); 66 } 67 68 static int xfrm6_tunnel_check_size(struct sk_buff *skb) 69 { 70 int mtu, ret = 0; 71 struct dst_entry *dst = skb_dst(skb); 72 73 mtu = dst_mtu(dst); 74 if (mtu < IPV6_MIN_MTU) 75 mtu = IPV6_MIN_MTU; 76 77 if (!skb->local_df && skb->len > mtu) { 78 skb->dev = dst->dev; 79 80 if (xfrm6_local_dontfrag(skb)) 81 xfrm6_local_rxpmtu(skb, mtu); 82 else if (skb->sk) 83 xfrm6_local_error(skb, mtu); 84 else 85 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 86 ret = -EMSGSIZE; 87 } 88 89 return ret; 90 } 91 92 int xfrm6_extract_output(struct xfrm_state *x, struct sk_buff *skb) 93 { 94 int err; 95 96 err = xfrm6_tunnel_check_size(skb); 97 if (err) 98 return err; 99 100 XFRM_MODE_SKB_CB(skb)->protocol = ipv6_hdr(skb)->nexthdr; 101 102 return xfrm6_extract_header(skb); 103 } 104 105 int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb) 106 { 107 int err; 108 109 err = xfrm_inner_extract_output(x, skb); 110 if (err) 111 return err; 112 113 memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); 114 #ifdef CONFIG_NETFILTER 115 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; 116 #endif 117 118 skb->protocol = htons(ETH_P_IPV6); 119 skb->local_df = 1; 120 121 return x->outer_mode->output2(x, skb); 122 } 123 EXPORT_SYMBOL(xfrm6_prepare_output); 124 125 int xfrm6_output_finish(struct sk_buff *skb) 126 { 127 #ifdef CONFIG_NETFILTER 128 IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; 129 #endif 130 131 skb->protocol = htons(ETH_P_IPV6); 132 return xfrm_output(skb); 133 } 134 135 static int __xfrm6_output(struct sk_buff *skb) 136 { 137 struct dst_entry *dst = skb_dst(skb); 138 struct xfrm_state *x = dst->xfrm; 139 int mtu = ip6_skb_dst_mtu(skb); 140 141 if (skb->len > mtu && xfrm6_local_dontfrag(skb)) { 142 xfrm6_local_rxpmtu(skb, mtu); 143 return -EMSGSIZE; 144 } else if (!skb->local_df && skb->len > mtu && skb->sk) { 145 xfrm6_local_error(skb, mtu); 146 return -EMSGSIZE; 147 } 148 149 if (x->props.mode == XFRM_MODE_TUNNEL && 150 ((skb->len > mtu && !skb_is_gso(skb)) || 151 dst_allfrag(skb_dst(skb)))) { 152 return ip6_fragment(skb, x->outer_mode->afinfo->output_finish); 153 } 154 return x->outer_mode->afinfo->output_finish(skb); 155 } 156 157 int xfrm6_output(struct sk_buff *skb) 158 { 159 return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, 160 skb_dst(skb)->dev, __xfrm6_output); 161 } 162