Blame view
net/ipv6/xfrm6_output.c
3.36 KB
1da177e4c
|
1 2 3 4 |
/* * xfrm6_output.c - Common IPsec encapsulation code for IPv6. * Copyright (C) 2002 USAGI/WIDE Project * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au> |
1ab1457c4
|
5 |
* |
1da177e4c
|
6 7 8 9 10 |
* This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License * as published by the Free Software Foundation; either version * 2 of the License, or (at your option) any later version. */ |
16a6677fd
|
11 |
#include <linux/compiler.h> |
1da177e4c
|
12 13 14 |
#include <linux/skbuff.h> #include <linux/spinlock.h> #include <linux/icmpv6.h> |
16a6677fd
|
15 |
#include <linux/netfilter_ipv6.h> |
1da177e4c
|
16 17 |
#include <net/ipv6.h> #include <net/xfrm.h> |
aee5adb43
|
18 19 20 21 22 |
int xfrm6_find_1stfragopt(struct xfrm_state *x, struct sk_buff *skb, u8 **prevhdr) { return ip6_find_1stfragopt(skb, prevhdr); } |
7159039a1
|
23 |
EXPORT_SYMBOL(xfrm6_find_1stfragopt); |
1da177e4c
|
24 25 26 27 28 29 30 31 32 33 |
static int xfrm6_tunnel_check_size(struct sk_buff *skb) { int mtu, ret = 0; struct dst_entry *dst = skb->dst; mtu = dst_mtu(dst); if (mtu < IPV6_MIN_MTU) mtu = IPV6_MIN_MTU; if (skb->len > mtu) { |
180e42503
|
34 |
skb->dev = dst->dev; |
1da177e4c
|
35 36 37 38 39 40 |
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev); ret = -EMSGSIZE; } return ret; } |
16a6677fd
|
41 |
static int xfrm6_output_one(struct sk_buff *skb) |
1da177e4c
|
42 43 44 45 |
{ struct dst_entry *dst = skb->dst; struct xfrm_state *x = dst->xfrm; int err; |
1ab1457c4
|
46 |
|
84fa7933a
|
47 48 |
if (skb->ip_summed == CHECKSUM_PARTIAL) { err = skb_checksum_help(skb); |
1da177e4c
|
49 50 51 |
if (err) goto error_nolock; } |
7e49e6de3
|
52 |
if (x->props.mode == XFRM_MODE_TUNNEL) { |
1da177e4c
|
53 54 55 56 |
err = xfrm6_tunnel_check_size(skb); if (err) goto error_nolock; } |
16a6677fd
|
57 58 59 60 61 |
do { spin_lock_bh(&x->lock); err = xfrm_state_check(x, skb); if (err) goto error; |
1da177e4c
|
62 |
|
eb878e845
|
63 |
err = x->mode->output(x, skb); |
b59f45d0b
|
64 65 |
if (err) goto error; |
1da177e4c
|
66 |
|
16a6677fd
|
67 68 69 |
err = x->type->output(x, skb); if (err) goto error; |
1da177e4c
|
70 |
|
16a6677fd
|
71 72 |
x->curlft.bytes += skb->len; x->curlft.packets++; |
9afaca057
|
73 |
if (x->props.mode == XFRM_MODE_ROUTEOPTIMIZATION) |
9d729f72d
|
74 |
x->lastused = get_seconds(); |
1da177e4c
|
75 |
|
16a6677fd
|
76 |
spin_unlock_bh(&x->lock); |
1da177e4c
|
77 |
|
c1d2bbe1c
|
78 |
skb_reset_network_header(skb); |
1ab1457c4
|
79 |
|
16a6677fd
|
80 81 82 83 84 85 |
if (!(skb->dst = dst_pop(dst))) { err = -EHOSTUNREACH; goto error_nolock; } dst = skb->dst; x = dst->xfrm; |
7e49e6de3
|
86 |
} while (x && (x->props.mode != XFRM_MODE_TUNNEL)); |
16a6677fd
|
87 |
|
3e3850e98
|
88 |
IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED; |
16a6677fd
|
89 |
err = 0; |
1da177e4c
|
90 91 92 93 94 95 96 97 98 |
out_exit: return err; error: spin_unlock_bh(&x->lock); error_nolock: kfree_skb(skb); goto out_exit; } |
16a6677fd
|
99 |
|
09b8f7a93
|
100 |
static int xfrm6_output_finish2(struct sk_buff *skb) |
16a6677fd
|
101 102 103 104 105 |
{ int err; while (likely((err = xfrm6_output_one(skb)) == 0)) { nf_reset(skb); |
1ab1457c4
|
106 |
|
16a6677fd
|
107 108 109 110 111 112 113 114 115 |
err = nf_hook(PF_INET6, NF_IP6_LOCAL_OUT, &skb, NULL, skb->dst->dev, dst_output); if (unlikely(err != 1)) break; if (!skb->dst->xfrm) return dst_output(skb); err = nf_hook(PF_INET6, NF_IP6_POST_ROUTING, &skb, NULL, |
09b8f7a93
|
116 |
skb->dst->dev, xfrm6_output_finish2); |
16a6677fd
|
117 118 119 120 121 122 |
if (unlikely(err != 1)) break; } return err; } |
09b8f7a93
|
123 124 125 |
static int xfrm6_output_finish(struct sk_buff *skb) { struct sk_buff *segs; |
89114afd4
|
126 |
if (!skb_is_gso(skb)) |
09b8f7a93
|
127 |
return xfrm6_output_finish2(skb); |
679e898a4
|
128 |
skb->protocol = htons(ETH_P_IPV6); |
09b8f7a93
|
129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 |
segs = skb_gso_segment(skb, 0); kfree_skb(skb); if (unlikely(IS_ERR(segs))) return PTR_ERR(segs); do { struct sk_buff *nskb = segs->next; int err; segs->next = NULL; err = xfrm6_output_finish2(segs); if (unlikely(err)) { while ((segs = nskb)) { nskb = segs->next; segs->next = NULL; kfree_skb(segs); } return err; } segs = nskb; } while (segs); return 0; } |
16a6677fd
|
155 156 157 158 159 |
int xfrm6_output(struct sk_buff *skb) { return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb, NULL, skb->dst->dev, xfrm6_output_finish); } |