1/* 2 * xfrm4_mode_tunnel.c - Tunnel mode encapsulation for IPv4. 3 * 4 * Copyright (c) 2004-2006 Herbert Xu <herbert@gondor.apana.org.au> 5 */ 6 7#include <linux/gfp.h> 8#include <linux/init.h> 9#include <linux/kernel.h> 10#include <linux/module.h> 11#include <linux/skbuff.h> 12#include <linux/stringify.h> 13#include <net/dst.h> 14#include <net/inet_ecn.h> 15#include <net/ip.h> 16#include <net/xfrm.h> 17 18static inline void ipip_ecn_decapsulate(struct sk_buff *skb) 19{ 20 struct iphdr *inner_iph = ipip_hdr(skb); 21 22 if (INET_ECN_is_ce(XFRM_MODE_SKB_CB(skb)->tos)) 23 IP_ECN_set_ce(inner_iph); 24} 25 26/* Add encapsulation header. 27 * 28 * The top IP header will be constructed per RFC 2401. 29 */ 30static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb) 31{ 32 struct dst_entry *dst = skb_dst(skb); 33 struct iphdr *top_iph; 34 int flags; 35 36 skb_set_network_header(skb, -x->props.header_len); 37 skb->mac_header = skb->network_header + 38 offsetof(struct iphdr, protocol); 39 skb->transport_header = skb->network_header + sizeof(*top_iph); 40 top_iph = ip_hdr(skb); 41 42 top_iph->ihl = 5; 43 top_iph->version = 4; 44 45 top_iph->protocol = xfrm_af2proto(skb_dst(skb)->ops->family); 46 47 /* DS disclosing depends on XFRM_SA_XFLAG_DONT_ENCAP_DSCP */ 48 if (x->props.extra_flags & XFRM_SA_XFLAG_DONT_ENCAP_DSCP) 49 top_iph->tos = 0; 50 else 51 top_iph->tos = XFRM_MODE_SKB_CB(skb)->tos; 52 top_iph->tos = INET_ECN_encapsulate(top_iph->tos, 53 XFRM_MODE_SKB_CB(skb)->tos); 54 55 flags = x->props.flags; 56 if (flags & XFRM_STATE_NOECN) 57 IP_ECN_clear(top_iph); 58 59 top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ? 60 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF)); 61 62 top_iph->ttl = ip4_dst_hoplimit(dst->child); 63 64 top_iph->saddr = x->props.saddr.a4; 65 top_iph->daddr = x->id.daddr.a4; 66 ip_select_ident(dev_net(dst->dev), skb, NULL); 67 68 return 0; 69} 70 71static int xfrm4_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb) 72{ 73 int err = -EINVAL; 74 75 if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPIP) 76 goto out; 77 78 if (!pskb_may_pull(skb, sizeof(struct iphdr))) 79 goto out; 80 81 err = skb_unclone(skb, GFP_ATOMIC); 82 if (err) 83 goto out; 84 85 if (x->props.flags & XFRM_STATE_DECAP_DSCP) 86 ipv4_copy_dscp(XFRM_MODE_SKB_CB(skb)->tos, ipip_hdr(skb)); 87 if (!(x->props.flags & XFRM_STATE_NOECN)) 88 ipip_ecn_decapsulate(skb); 89 90 skb_reset_network_header(skb); 91 skb_mac_header_rebuild(skb); 92 93 err = 0; 94 95out: 96 return err; 97} 98 99static struct xfrm_mode xfrm4_tunnel_mode = { 100 .input2 = xfrm4_mode_tunnel_input, 101 .input = xfrm_prepare_input, 102 .output2 = xfrm4_mode_tunnel_output, 103 .output = xfrm4_prepare_output, 104 .owner = THIS_MODULE, 105 .encap = XFRM_MODE_TUNNEL, 106 .flags = XFRM_MODE_FLAG_TUNNEL, 107}; 108 109static int __init xfrm4_mode_tunnel_init(void) 110{ 111 return xfrm_register_mode(&xfrm4_tunnel_mode, AF_INET); 112} 113 114static void __exit xfrm4_mode_tunnel_exit(void) 115{ 116 int err; 117 118 err = xfrm_unregister_mode(&xfrm4_tunnel_mode, AF_INET); 119 BUG_ON(err); 120} 121 122module_init(xfrm4_mode_tunnel_init); 123module_exit(xfrm4_mode_tunnel_exit); 124MODULE_LICENSE("GPL"); 125MODULE_ALIAS_XFRM_MODE(AF_INET, XFRM_MODE_TUNNEL); 126