xfrm4_output.c 3.39 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3 4 5 6 7 8 9 10
/*
 * xfrm4_output.c - Common IPsec encapsulation code for IPv4.
 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
 * 
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

11
#include <linux/compiler.h>
Herbert Xu's avatar
Herbert Xu committed
12 13
#include <linux/if_ether.h>
#include <linux/kernel.h>
Linus Torvalds's avatar
Linus Torvalds committed
14 15
#include <linux/skbuff.h>
#include <linux/spinlock.h>
16
#include <linux/netfilter_ipv4.h>
Linus Torvalds's avatar
Linus Torvalds committed
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44
#include <net/ip.h>
#include <net/xfrm.h>
#include <net/icmp.h>

static int xfrm4_tunnel_check_size(struct sk_buff *skb)
{
	int mtu, ret = 0;
	struct dst_entry *dst;
	struct iphdr *iph = skb->nh.iph;

	if (IPCB(skb)->flags & IPSKB_XFRM_TUNNEL_SIZE)
		goto out;

	IPCB(skb)->flags |= IPSKB_XFRM_TUNNEL_SIZE;
	
	if (!(iph->frag_off & htons(IP_DF)) || skb->local_df)
		goto out;

	dst = skb->dst;
	mtu = dst_mtu(dst);
	if (skb->len > mtu) {
		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
		ret = -EMSGSIZE;
	}
out:
	return ret;
}

45
static int xfrm4_output_one(struct sk_buff *skb)
Linus Torvalds's avatar
Linus Torvalds committed
46 47 48 49 50
{
	struct dst_entry *dst = skb->dst;
	struct xfrm_state *x = dst->xfrm;
	int err;
	
51 52
	if (skb->ip_summed == CHECKSUM_PARTIAL) {
		err = skb_checksum_help(skb);
Linus Torvalds's avatar
Linus Torvalds committed
53 54 55 56
		if (err)
			goto error_nolock;
	}

57
	if (x->props.mode == XFRM_MODE_TUNNEL) {
Linus Torvalds's avatar
Linus Torvalds committed
58 59 60 61 62
		err = xfrm4_tunnel_check_size(skb);
		if (err)
			goto error_nolock;
	}

63 64 65 66 67
	do {
		spin_lock_bh(&x->lock);
		err = xfrm_state_check(x, skb);
		if (err)
			goto error;
Linus Torvalds's avatar
Linus Torvalds committed
68

69 70 71
		err = x->mode->output(skb);
		if (err)
			goto error;
Linus Torvalds's avatar
Linus Torvalds committed
72

73 74 75
		err = x->type->output(x, skb);
		if (err)
			goto error;
Linus Torvalds's avatar
Linus Torvalds committed
76

77 78
		x->curlft.bytes += skb->len;
		x->curlft.packets++;
Linus Torvalds's avatar
Linus Torvalds committed
79

80
		spin_unlock_bh(&x->lock);
Linus Torvalds's avatar
Linus Torvalds committed
81
	
82 83 84 85 86 87
		if (!(skb->dst = dst_pop(dst))) {
			err = -EHOSTUNREACH;
			goto error_nolock;
		}
		dst = skb->dst;
		x = dst->xfrm;
88
	} while (x && (x->props.mode != XFRM_MODE_TUNNEL));
89

90
	IPCB(skb)->flags |= IPSKB_XFRM_TRANSFORMED;
91
	err = 0;
Linus Torvalds's avatar
Linus Torvalds committed
92 93 94 95 96 97 98 99 100

out_exit:
	return err;
error:
	spin_unlock_bh(&x->lock);
error_nolock:
	kfree_skb(skb);
	goto out_exit;
}
101

Herbert Xu's avatar
Herbert Xu committed
102
static int xfrm4_output_finish2(struct sk_buff *skb)
103 104 105 106 107 108 109 110 111 112 113 114 115 116 117
{
	int err;

	while (likely((err = xfrm4_output_one(skb)) == 0)) {
		nf_reset(skb);

		err = nf_hook(PF_INET, NF_IP_LOCAL_OUT, &skb, NULL,
			      skb->dst->dev, dst_output);
		if (unlikely(err != 1))
			break;

		if (!skb->dst->xfrm)
			return dst_output(skb);

		err = nf_hook(PF_INET, NF_IP_POST_ROUTING, &skb, NULL,
Herbert Xu's avatar
Herbert Xu committed
118
			      skb->dst->dev, xfrm4_output_finish2);
119 120 121 122 123 124 125
		if (unlikely(err != 1))
			break;
	}

	return err;
}

Herbert Xu's avatar
Herbert Xu committed
126 127 128 129 130 131 132 133 134 135 136
static int xfrm4_output_finish(struct sk_buff *skb)
{
	struct sk_buff *segs;

#ifdef CONFIG_NETFILTER
	if (!skb->dst->xfrm) {
		IPCB(skb)->flags |= IPSKB_REROUTED;
		return dst_output(skb);
	}
#endif

Herbert Xu's avatar
Herbert Xu committed
137
	if (!skb_is_gso(skb))
Herbert Xu's avatar
Herbert Xu committed
138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167
		return xfrm4_output_finish2(skb);

	skb->protocol = htons(ETH_P_IP);
	segs = skb_gso_segment(skb, 0);
	kfree_skb(skb);
	if (unlikely(IS_ERR(segs)))
		return PTR_ERR(segs);

	do {
		struct sk_buff *nskb = segs->next;
		int err;

		segs->next = NULL;
		err = xfrm4_output_finish2(segs);

		if (unlikely(err)) {
			while ((segs = nskb)) {
				nskb = segs->next;
				segs->next = NULL;
				kfree_skb(segs);
			}
			return err;
		}

		segs = nskb;
	} while (segs);

	return 0;
}

168 169
int xfrm4_output(struct sk_buff *skb)
{
170 171 172
	return NF_HOOK_COND(PF_INET, NF_IP_POST_ROUTING, skb, NULL, skb->dst->dev,
			    xfrm4_output_finish,
			    !(IPCB(skb)->flags & IPSKB_REROUTED));
173
}