]>
git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blob - net/ipv4/xfrm4_output.c
2 * xfrm4_output.c - Common IPsec encapsulation code for IPv4.
3 * Copyright (c) 2004 Herbert Xu <herbert@gondor.apana.org.au>
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version
8 * 2 of the License, or (at your option) any later version.
11 #include <linux/compiler.h>
12 #include <linux/skbuff.h>
13 #include <linux/spinlock.h>
14 #include <linux/netfilter_ipv4.h>
19 static int xfrm4_tunnel_check_size(struct sk_buff
*skb
)
22 struct dst_entry
*dst
;
23 struct iphdr
*iph
= skb
->nh
.iph
;
25 if (IPCB(skb
)->flags
& IPSKB_XFRM_TUNNEL_SIZE
)
28 IPCB(skb
)->flags
|= IPSKB_XFRM_TUNNEL_SIZE
;
30 if (!(iph
->frag_off
& htons(IP_DF
)) || skb
->local_df
)
36 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_FRAG_NEEDED
, htonl(mtu
));
43 static int xfrm4_output_one(struct sk_buff
*skb
)
45 struct dst_entry
*dst
= skb
->dst
;
46 struct xfrm_state
*x
= dst
->xfrm
;
49 if (skb
->ip_summed
== CHECKSUM_HW
) {
50 err
= skb_checksum_help(skb
, 0);
56 err
= xfrm4_tunnel_check_size(skb
);
62 spin_lock_bh(&x
->lock
);
63 err
= xfrm_state_check(x
, skb
);
67 err
= x
->mode
->output(skb
);
71 err
= x
->type
->output(x
, skb
);
75 x
->curlft
.bytes
+= skb
->len
;
78 spin_unlock_bh(&x
->lock
);
80 if (!(skb
->dst
= dst_pop(dst
))) {
86 } while (x
&& !x
->props
.mode
);
88 IPCB(skb
)->flags
|= IPSKB_XFRM_TRANSFORMED
;
94 spin_unlock_bh(&x
->lock
);
100 static int xfrm4_output_finish(struct sk_buff
*skb
)
104 #ifdef CONFIG_NETFILTER
105 if (!skb
->dst
->xfrm
) {
106 IPCB(skb
)->flags
|= IPSKB_REROUTED
;
107 return dst_output(skb
);
110 while (likely((err
= xfrm4_output_one(skb
)) == 0)) {
113 err
= nf_hook(PF_INET
, NF_IP_LOCAL_OUT
, &skb
, NULL
,
114 skb
->dst
->dev
, dst_output
);
115 if (unlikely(err
!= 1))
119 return dst_output(skb
);
121 err
= nf_hook(PF_INET
, NF_IP_POST_ROUTING
, &skb
, NULL
,
122 skb
->dst
->dev
, xfrm4_output_finish
);
123 if (unlikely(err
!= 1))
130 int xfrm4_output(struct sk_buff
*skb
)
132 return NF_HOOK_COND(PF_INET
, NF_IP_POST_ROUTING
, skb
, NULL
, skb
->dst
->dev
,
134 !(IPCB(skb
)->flags
& IPSKB_REROUTED
));