ip6_output.c 44.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 output functions
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
 *
 *	Based on linux/net/ipv4/ip_output.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 *	Changes:
 *	A.N.Kuznetsov	:	airthmetics in fragmentation.
 *				extension headers are implemented.
 *				route changes now work.
 *				ip6_forward does not confuse sniffers.
 *				etc.
 *
 *      H. von Brand    :       Added missing #include <linux/string.h>
23
 *	Imran Patel	:	frag id should be in NBO
L
Linus Torvalds 已提交
24 25 26 27 28 29
 *      Kazunori MIYAZAWA @USAGI
 *			:       add ip6_append_data and related functions
 *				for datagram xmit
 */

#include <linux/errno.h>
H
Herbert Xu 已提交
30
#include <linux/kernel.h>
L
Linus Torvalds 已提交
31 32 33 34 35 36 37 38
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/net.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/in6.h>
#include <linux/tcp.h>
#include <linux/route.h>
39
#include <linux/module.h>
40
#include <linux/slab.h>
L
Linus Torvalds 已提交
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
#include <net/ndisc.h>
#include <net/protocol.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/rawv6.h>
#include <net/icmp.h>
#include <net/xfrm.h>
#include <net/checksum.h>
57
#include <linux/mroute6.h>
L
Linus Torvalds 已提交
58

59
static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
60
{
E
Eric Dumazet 已提交
61
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
62
	struct net_device *dev = dst->dev;
63
	struct net *net = dev_net(dev);
64
	struct neighbour *neigh;
65 66
	struct in6_addr *nexthop;
	int ret;
L
Linus Torvalds 已提交
67 68 69 70

	skb->protocol = htons(ETH_P_IPV6);
	skb->dev = dev;

71
	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
E
Eric Dumazet 已提交
72
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
L
Linus Torvalds 已提交
73

74
		if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) &&
75
		    ((mroute6_socket(net, skb) &&
76
		     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
77 78
		     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
					 &ipv6_hdr(skb)->saddr))) {
L
Linus Torvalds 已提交
79 80 81 82 83 84
			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);

			/* Do not check for IFF_ALLMULTI; multicast routing
			   is not supported in any case.
			 */
			if (newskb)
85
				NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
86
					net, sk, newskb, NULL, newskb->dev,
87
					dev_loopback_xmit);
L
Linus Torvalds 已提交
88

89
			if (ipv6_hdr(skb)->hop_limit == 0) {
90
				IP6_INC_STATS(net, idev,
91
					      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
92 93 94 95 96
				kfree_skb(skb);
				return 0;
			}
		}

97
		IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, skb->len);
98 99 100 101 102 103 104

		if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
		    IPV6_ADDR_SCOPE_NODELOCAL &&
		    !(dev->flags & IFF_LOOPBACK)) {
			kfree_skb(skb);
			return 0;
		}
L
Linus Torvalds 已提交
105 106
	}

107
	rcu_read_lock_bh();
108
	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
109 110 111 112 113 114 115 116 117
	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
	if (unlikely(!neigh))
		neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
	if (!IS_ERR(neigh)) {
		ret = dst_neigh_output(dst, neigh, skb);
		rcu_read_unlock_bh();
		return ret;
	}
	rcu_read_unlock_bh();
118

119
	IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
120 121
	kfree_skb(skb);
	return -EINVAL;
L
Linus Torvalds 已提交
122 123
}

124
static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
125 126
{
	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
127 128
	    dst_allfrag(skb_dst(skb)) ||
	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
129
		return ip6_fragment(sk, skb, ip6_finish_output2);
130
	else
131
		return ip6_finish_output2(sk, skb);
132 133
}

134
int ip6_output(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
135
{
136
	struct net_device *dev = skb_dst(skb)->dev;
E
Eric Dumazet 已提交
137
	struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
138
	struct net *net = dev_net(dev);
139
	if (unlikely(idev->cnf.disable_ipv6)) {
140
		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
141 142 143 144
		kfree_skb(skb);
		return 0;
	}

145 146
	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
			    net, sk, skb, NULL, dev,
147 148
			    ip6_finish_output,
			    !(IP6CB(skb)->flags & IP6SKB_REROUTED));
L
Linus Torvalds 已提交
149 150 151
}

/*
S
Shan Wei 已提交
152
 *	xmit an sk_buff (used by TCP, SCTP and DCCP)
L
Linus Torvalds 已提交
153 154
 */

155
int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
156
	     struct ipv6_txoptions *opt, int tclass)
L
Linus Torvalds 已提交
157
{
158
	struct net *net = sock_net(sk);
159
	struct ipv6_pinfo *np = inet6_sk(sk);
160
	struct in6_addr *first_hop = &fl6->daddr;
E
Eric Dumazet 已提交
161
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
162
	struct ipv6hdr *hdr;
163
	u8  proto = fl6->flowi6_proto;
L
Linus Torvalds 已提交
164
	int seg_len = skb->len;
G
Gerrit Renker 已提交
165
	int hlimit = -1;
L
Linus Torvalds 已提交
166 167 168
	u32 mtu;

	if (opt) {
169
		unsigned int head_room;
L
Linus Torvalds 已提交
170 171 172 173 174 175 176 177 178 179

		/* First: exthdrs may take lots of space (~8K for now)
		   MAX_HEADER is not enough.
		 */
		head_room = opt->opt_nflen + opt->opt_flen;
		seg_len += head_room;
		head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);

		if (skb_headroom(skb) < head_room) {
			struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
180
			if (!skb2) {
E
Eric Dumazet 已提交
181
				IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
182 183
					      IPSTATS_MIB_OUTDISCARDS);
				kfree_skb(skb);
L
Linus Torvalds 已提交
184 185
				return -ENOBUFS;
			}
186
			consume_skb(skb);
187
			skb = skb2;
188
			skb_set_owner_w(skb, sk);
L
Linus Torvalds 已提交
189 190 191 192 193 194 195
		}
		if (opt->opt_flen)
			ipv6_push_frag_opts(skb, opt, &proto);
		if (opt->opt_nflen)
			ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
	}

196 197
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
198
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
199 200 201 202

	/*
	 *	Fill in the IPv6 header
	 */
203
	if (np)
L
Linus Torvalds 已提交
204 205
		hlimit = np->hop_limit;
	if (hlimit < 0)
206
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
207

208
	ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
209
						     np->autoflowlabel, fl6));
210

L
Linus Torvalds 已提交
211 212 213 214
	hdr->payload_len = htons(seg_len);
	hdr->nexthdr = proto;
	hdr->hop_limit = hlimit;

A
Alexey Dobriyan 已提交
215 216
	hdr->saddr = fl6->saddr;
	hdr->daddr = *first_hop;
L
Linus Torvalds 已提交
217

218
	skb->protocol = htons(ETH_P_IPV6);
219
	skb->priority = sk->sk_priority;
220
	skb->mark = sk->sk_mark;
221

L
Linus Torvalds 已提交
222
	mtu = dst_mtu(dst);
W
WANG Cong 已提交
223
	if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
E
Eric Dumazet 已提交
224
		IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
225
			      IPSTATS_MIB_OUT, skb->len);
226 227
		return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
			       net, sk, skb, NULL, dst->dev,
228
			       dst_output_okfn);
L
Linus Torvalds 已提交
229 230 231
	}

	skb->dev = dst->dev;
232
	ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
E
Eric Dumazet 已提交
233
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
234 235 236
	kfree_skb(skb);
	return -EMSGSIZE;
}
237 238
EXPORT_SYMBOL(ip6_xmit);

L
Linus Torvalds 已提交
239 240 241 242 243 244 245 246
static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
{
	struct ip6_ra_chain *ra;
	struct sock *last = NULL;

	read_lock(&ip6_ra_lock);
	for (ra = ip6_ra_chain; ra; ra = ra->next) {
		struct sock *sk = ra->sk;
247 248 249
		if (sk && ra->sel == sel &&
		    (!sk->sk_bound_dev_if ||
		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
L
Linus Torvalds 已提交
250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267
			if (last) {
				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
				if (skb2)
					rawv6_rcv(last, skb2);
			}
			last = sk;
		}
	}

	if (last) {
		rawv6_rcv(last, skb);
		read_unlock(&ip6_ra_lock);
		return 1;
	}
	read_unlock(&ip6_ra_lock);
	return 0;
}

268 269
static int ip6_forward_proxy_check(struct sk_buff *skb)
{
270
	struct ipv6hdr *hdr = ipv6_hdr(skb);
271
	u8 nexthdr = hdr->nexthdr;
272
	__be16 frag_off;
273 274 275
	int offset;

	if (ipv6_ext_hdr(nexthdr)) {
276
		offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
277 278 279 280 281 282 283 284
		if (offset < 0)
			return 0;
	} else
		offset = sizeof(struct ipv6hdr);

	if (nexthdr == IPPROTO_ICMPV6) {
		struct icmp6hdr *icmp6;

285 286
		if (!pskb_may_pull(skb, (skb_network_header(skb) +
					 offset + 1 - skb->data)))
287 288
			return 0;

289
		icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306

		switch (icmp6->icmp6_type) {
		case NDISC_ROUTER_SOLICITATION:
		case NDISC_ROUTER_ADVERTISEMENT:
		case NDISC_NEIGHBOUR_SOLICITATION:
		case NDISC_NEIGHBOUR_ADVERTISEMENT:
		case NDISC_REDIRECT:
			/* For reaction involving unicast neighbor discovery
			 * message destined to the proxied address, pass it to
			 * input function.
			 */
			return 1;
		default:
			break;
		}
	}

307 308 309 310 311 312 313 314 315 316
	/*
	 * The proxying router can't forward traffic sent to a link-local
	 * address, so signal the sender and discard the packet. This
	 * behavior is clarified by the MIPv6 specification.
	 */
	if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
		dst_link_failure(skb);
		return -1;
	}

317 318 319
	return 0;
}

320 321
static inline int ip6_forward_finish(struct net *net, struct sock *sk,
				     struct sk_buff *skb)
L
Linus Torvalds 已提交
322
{
323
	skb_sender_cpu_clear(skb);
324
	return dst_output(sk, skb);
L
Linus Torvalds 已提交
325 326
}

327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347
static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
{
	unsigned int mtu;
	struct inet6_dev *idev;

	if (dst_metric_locked(dst, RTAX_MTU)) {
		mtu = dst_metric_raw(dst, RTAX_MTU);
		if (mtu)
			return mtu;
	}

	mtu = IPV6_MIN_MTU;
	rcu_read_lock();
	idev = __in6_dev_get(dst->dev);
	if (idev)
		mtu = idev->cnf.mtu6;
	rcu_read_unlock();

	return mtu;
}

348 349
static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
{
350
	if (skb->len <= mtu)
351 352
		return false;

W
WANG Cong 已提交
353
	/* ipv6 conntrack defrag sets max_frag_size + ignore_df */
354 355 356
	if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
		return true;

W
WANG Cong 已提交
357
	if (skb->ignore_df)
358 359
		return false;

360 361 362 363 364 365
	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
		return false;

	return true;
}

L
Linus Torvalds 已提交
366 367
int ip6_forward(struct sk_buff *skb)
{
E
Eric Dumazet 已提交
368
	struct dst_entry *dst = skb_dst(skb);
369
	struct ipv6hdr *hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
370
	struct inet6_skb_parm *opt = IP6CB(skb);
371
	struct net *net = dev_net(dst->dev);
372
	u32 mtu;
373

374
	if (net->ipv6.devconf_all->forwarding == 0)
L
Linus Torvalds 已提交
375 376
		goto error;

377 378 379
	if (skb->pkt_type != PACKET_HOST)
		goto drop;

380 381 382
	if (skb_warn_if_lro(skb))
		goto drop;

L
Linus Torvalds 已提交
383
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
384 385
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
386 387 388
		goto drop;
	}

389
	skb_forward_csum(skb);
L
Linus Torvalds 已提交
390 391 392 393 394 395 396 397 398 399 400 401 402 403

	/*
	 *	We DO NOT make any processing on
	 *	RA packets, pushing them to user level AS IS
	 *	without ane WARRANTY that application will be able
	 *	to interpret them. The reason is that we
	 *	cannot make anything clever here.
	 *
	 *	We are not end-node, so that if packet contains
	 *	AH/ESP, we cannot make anything.
	 *	Defragmentation also would be mistake, RA packets
	 *	cannot be fragmented, because there is no warranty
	 *	that different fragments will go along one path. --ANK
	 */
404 405
	if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
		if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
L
Linus Torvalds 已提交
406 407 408 409 410 411 412 413 414
			return 0;
	}

	/*
	 *	check and decrement ttl
	 */
	if (hdr->hop_limit <= 1) {
		/* Force OUTPUT device used as source address */
		skb->dev = dst->dev;
415
		icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
416 417
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INHDRERRORS);
L
Linus Torvalds 已提交
418 419 420 421 422

		kfree_skb(skb);
		return -ETIMEDOUT;
	}

423
	/* XXX: idev->cnf.proxy_ndp? */
424
	if (net->ipv6.devconf_all->proxy_ndp &&
425
	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
426 427
		int proxied = ip6_forward_proxy_check(skb);
		if (proxied > 0)
428
			return ip6_input(skb);
429
		else if (proxied < 0) {
430 431
			IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
					 IPSTATS_MIB_INDISCARDS);
432 433
			goto drop;
		}
434 435
	}

L
Linus Torvalds 已提交
436
	if (!xfrm6_route_forward(skb)) {
437 438
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
439 440
		goto drop;
	}
E
Eric Dumazet 已提交
441
	dst = skb_dst(skb);
L
Linus Torvalds 已提交
442 443 444

	/* IPv6 specs say nothing about it, but it is clear that we cannot
	   send redirects to source routed frames.
445
	   We don't send redirects to frames decapsulated from IPsec.
L
Linus Torvalds 已提交
446
	 */
447
	if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
L
Linus Torvalds 已提交
448
		struct in6_addr *target = NULL;
449
		struct inet_peer *peer;
L
Linus Torvalds 已提交
450 451 452 453 454 455 456 457
		struct rt6_info *rt;

		/*
		 *	incoming and outgoing devices are the same
		 *	send a redirect.
		 */

		rt = (struct rt6_info *) dst;
458 459
		if (rt->rt6i_flags & RTF_GATEWAY)
			target = &rt->rt6i_gateway;
L
Linus Torvalds 已提交
460 461 462
		else
			target = &hdr->daddr;

463
		peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
464

L
Linus Torvalds 已提交
465 466 467
		/* Limit redirects both by destination (here)
		   and by source (inside ndisc_send_redirect)
		 */
468
		if (inet_peer_xrlim_allow(peer, 1*HZ))
469
			ndisc_send_redirect(skb, target);
470 471
		if (peer)
			inet_putpeer(peer);
472 473 474
	} else {
		int addrtype = ipv6_addr_type(&hdr->saddr);

L
Linus Torvalds 已提交
475
		/* This check is security critical. */
476 477
		if (addrtype == IPV6_ADDR_ANY ||
		    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
478 479 480
			goto error;
		if (addrtype & IPV6_ADDR_LINKLOCAL) {
			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
481
				    ICMPV6_NOT_NEIGHBOUR, 0);
482 483
			goto error;
		}
L
Linus Torvalds 已提交
484 485
	}

486
	mtu = ip6_dst_mtu_forward(dst);
487 488 489
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;

490
	if (ip6_pkt_too_big(skb, mtu)) {
L
Linus Torvalds 已提交
491 492
		/* Again, force OUTPUT device used as source address */
		skb->dev = dst->dev;
493
		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
494 495 496 497
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INTOOBIGERRORS);
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
498 499 500 501 502
		kfree_skb(skb);
		return -EMSGSIZE;
	}

	if (skb_cow(skb, dst->dev->hard_header_len)) {
503 504
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
505 506 507
		goto drop;
	}

508
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
509 510

	/* Mangling hops number delayed to point after skb COW */
511

L
Linus Torvalds 已提交
512 513
	hdr->hop_limit--;

514
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
515
	IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
516 517
	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
		       net, NULL, skb, skb->dev, dst->dev,
518
		       ip6_forward_finish);
L
Linus Torvalds 已提交
519 520

error:
521
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
L
Linus Torvalds 已提交
522 523 524 525 526 527 528 529 530 531
drop:
	kfree_skb(skb);
	return -EINVAL;
}

static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
{
	to->pkt_type = from->pkt_type;
	to->priority = from->priority;
	to->protocol = from->protocol;
E
Eric Dumazet 已提交
532 533
	skb_dst_drop(to);
	skb_dst_set(to, dst_clone(skb_dst(from)));
L
Linus Torvalds 已提交
534
	to->dev = from->dev;
T
Thomas Graf 已提交
535
	to->mark = from->mark;
L
Linus Torvalds 已提交
536 537 538 539

#ifdef CONFIG_NET_SCHED
	to->tc_index = from->tc_index;
#endif
540
	nf_copy(to, from);
541
	skb_copy_secmark(to, from);
L
Linus Torvalds 已提交
542 543
}

544 545
int ip6_fragment(struct sock *sk, struct sk_buff *skb,
		 int (*output)(struct sock *, struct sk_buff *))
L
Linus Torvalds 已提交
546 547
{
	struct sk_buff *frag;
548
	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
549 550
	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
				inet6_sk(skb->sk) : NULL;
L
Linus Torvalds 已提交
551 552 553
	struct ipv6hdr *tmp_hdr;
	struct frag_hdr *fh;
	unsigned int mtu, hlen, left, len;
554
	int hroom, troom;
555
	__be32 frag_id;
556
	int ptr, offset = 0, err = 0;
L
Linus Torvalds 已提交
557
	u8 *prevhdr, nexthdr = 0;
E
Eric Dumazet 已提交
558
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
559 560 561 562

	hlen = ip6_find_1stfragopt(skb, &prevhdr);
	nexthdr = *prevhdr;

J
John Heffner 已提交
563
	mtu = ip6_skb_dst_mtu(skb);
564 565

	/* We must not fragment if the socket is set to force MTU discovery
566
	 * or if the skb it not generated by a local socket.
567
	 */
568 569
	if (unlikely(!skb->ignore_df && skb->len > mtu))
		goto fail_toobig;
570

571 572 573 574 575 576 577 578
	if (IP6CB(skb)->frag_max_size) {
		if (IP6CB(skb)->frag_max_size > mtu)
			goto fail_toobig;

		/* don't send fragments larger than what we received */
		mtu = IP6CB(skb)->frag_max_size;
		if (mtu < IPV6_MIN_MTU)
			mtu = IPV6_MIN_MTU;
579 580
	}

581 582 583 584 585
	if (np && np->frag_size < mtu) {
		if (np->frag_size)
			mtu = np->frag_size;
	}
	mtu -= hlen + sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
586

587 588
	frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
				    &ipv6_hdr(skb)->saddr);
589

590
	if (skb_has_frag_list(skb)) {
L
Linus Torvalds 已提交
591
		int first_len = skb_pagelen(skb);
592
		struct sk_buff *frag2;
L
Linus Torvalds 已提交
593 594 595 596 597 598

		if (first_len - hlen > mtu ||
		    ((first_len - hlen) & 7) ||
		    skb_cloned(skb))
			goto slow_path;

599
		skb_walk_frags(skb, frag) {
L
Linus Torvalds 已提交
600 601 602 603
			/* Correct geometry. */
			if (frag->len > mtu ||
			    ((frag->len & 7) && frag->next) ||
			    skb_headroom(frag) < hlen)
604
				goto slow_path_clean;
L
Linus Torvalds 已提交
605 606 607

			/* Partially cloned skb? */
			if (skb_shared(frag))
608
				goto slow_path_clean;
609 610 611 612 613 614

			BUG_ON(frag->sk);
			if (skb->sk) {
				frag->sk = skb->sk;
				frag->destructor = sock_wfree;
			}
615
			skb->truesize -= frag->truesize;
L
Linus Torvalds 已提交
616 617 618 619 620
		}

		err = 0;
		offset = 0;
		frag = skb_shinfo(skb)->frag_list;
621
		skb_frag_list_init(skb);
L
Linus Torvalds 已提交
622 623
		/* BUILD HEADER */

Y
YOSHIFUJI Hideaki 已提交
624
		*prevhdr = NEXTHDR_FRAGMENT;
625
		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
L
Linus Torvalds 已提交
626
		if (!tmp_hdr) {
E
Eric Dumazet 已提交
627
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
628
				      IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
629 630 631 632
			return -ENOMEM;
		}

		__skb_pull(skb, hlen);
633
		fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
634 635
		__skb_push(skb, hlen);
		skb_reset_network_header(skb);
636
		memcpy(skb_network_header(skb), tmp_hdr, hlen);
L
Linus Torvalds 已提交
637 638 639 640

		fh->nexthdr = nexthdr;
		fh->reserved = 0;
		fh->frag_off = htons(IP6_MF);
641
		fh->identification = frag_id;
L
Linus Torvalds 已提交
642 643 644 645

		first_len = skb_pagelen(skb);
		skb->data_len = first_len - skb_headlen(skb);
		skb->len = first_len;
646 647
		ipv6_hdr(skb)->payload_len = htons(first_len -
						   sizeof(struct ipv6hdr));
648

649
		dst_hold(&rt->dst);
L
Linus Torvalds 已提交
650 651 652 653 654 655

		for (;;) {
			/* Prepare header of the next frame,
			 * before previous one went down. */
			if (frag) {
				frag->ip_summed = CHECKSUM_NONE;
656
				skb_reset_transport_header(frag);
657
				fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));
658 659
				__skb_push(frag, hlen);
				skb_reset_network_header(frag);
660 661
				memcpy(skb_network_header(frag), tmp_hdr,
				       hlen);
L
Linus Torvalds 已提交
662 663 664 665
				offset += skb->len - hlen - sizeof(struct frag_hdr);
				fh->nexthdr = nexthdr;
				fh->reserved = 0;
				fh->frag_off = htons(offset);
666
				if (frag->next)
L
Linus Torvalds 已提交
667 668
					fh->frag_off |= htons(IP6_MF);
				fh->identification = frag_id;
669 670 671
				ipv6_hdr(frag)->payload_len =
						htons(frag->len -
						      sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
672 673
				ip6_copy_metadata(frag, skb);
			}
674

675
			err = output(sk, skb);
676
			if (!err)
677
				IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
678
					      IPSTATS_MIB_FRAGCREATES);
679

L
Linus Torvalds 已提交
680 681 682 683 684 685 686 687
			if (err || !frag)
				break;

			skb = frag;
			frag = skb->next;
			skb->next = NULL;
		}

J
Jesper Juhl 已提交
688
		kfree(tmp_hdr);
L
Linus Torvalds 已提交
689 690

		if (err == 0) {
691
			IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
692
				      IPSTATS_MIB_FRAGOKS);
A
Amerigo Wang 已提交
693
			ip6_rt_put(rt);
L
Linus Torvalds 已提交
694 695 696
			return 0;
		}

697
		kfree_skb_list(frag);
L
Linus Torvalds 已提交
698

699
		IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
700
			      IPSTATS_MIB_FRAGFAILS);
A
Amerigo Wang 已提交
701
		ip6_rt_put(rt);
L
Linus Torvalds 已提交
702
		return err;
703 704 705 706 707 708 709 710 711

slow_path_clean:
		skb_walk_frags(skb, frag2) {
			if (frag2 == frag)
				break;
			frag2->sk = NULL;
			frag2->destructor = NULL;
			skb->truesize += frag2->truesize;
		}
L
Linus Torvalds 已提交
712 713 714
	}

slow_path:
715 716 717 718
	if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
	    skb_checksum_help(skb))
		goto fail;

L
Linus Torvalds 已提交
719 720 721 722 723 724 725 726
	left = skb->len - hlen;		/* Space per frame */
	ptr = hlen;			/* Where to start from */

	/*
	 *	Fragment the datagram.
	 */

	*prevhdr = NEXTHDR_FRAGMENT;
727 728
	hroom = LL_RESERVED_SPACE(rt->dst.dev);
	troom = rt->dst.dev->needed_tailroom;
L
Linus Torvalds 已提交
729 730 731 732

	/*
	 *	Keep copying data until we run out.
	 */
733
	while (left > 0)	{
L
Linus Torvalds 已提交
734 735 736 737
		len = left;
		/* IF: it doesn't fit, use 'mtu' - the data space left */
		if (len > mtu)
			len = mtu;
L
Lucas De Marchi 已提交
738
		/* IF: we are not sending up to and including the packet end
L
Linus Torvalds 已提交
739 740 741 742 743
		   then align the next start on an eight byte boundary */
		if (len < left)	{
			len &= ~7;
		}

744 745 746 747
		/* Allocate buffer */
		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
				 hroom + troom, GFP_ATOMIC);
		if (!frag) {
E
Eric Dumazet 已提交
748
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
749
				      IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
750 751 752 753 754 755 756 757 758
			err = -ENOMEM;
			goto fail;
		}

		/*
		 *	Set up data on packet
		 */

		ip6_copy_metadata(frag, skb);
759
		skb_reserve(frag, hroom);
L
Linus Torvalds 已提交
760
		skb_put(frag, len + hlen + sizeof(struct frag_hdr));
761
		skb_reset_network_header(frag);
762
		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
763 764
		frag->transport_header = (frag->network_header + hlen +
					  sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
765 766 767 768 769 770 771 772 773 774 775

		/*
		 *	Charge the memory for the fragment to any owner
		 *	it might possess
		 */
		if (skb->sk)
			skb_set_owner_w(frag, skb->sk);

		/*
		 *	Copy the packet header into the new buffer.
		 */
776
		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
L
Linus Torvalds 已提交
777 778 779 780 781 782

		/*
		 *	Build fragment header.
		 */
		fh->nexthdr = nexthdr;
		fh->reserved = 0;
783
		fh->identification = frag_id;
L
Linus Torvalds 已提交
784 785 786 787

		/*
		 *	Copy a block of the IP datagram.
		 */
H
Himangi Saraogi 已提交
788 789
		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),
				     len));
L
Linus Torvalds 已提交
790 791 792 793 794
		left -= len;

		fh->frag_off = htons(offset);
		if (left > 0)
			fh->frag_off |= htons(IP6_MF);
795 796
		ipv6_hdr(frag)->payload_len = htons(frag->len -
						    sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
797 798 799 800 801 802 803

		ptr += len;
		offset += len;

		/*
		 *	Put this fragment into the sending queue.
		 */
804
		err = output(sk, frag);
L
Linus Torvalds 已提交
805 806
		if (err)
			goto fail;
807

E
Eric Dumazet 已提交
808
		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
809
			      IPSTATS_MIB_FRAGCREATES);
L
Linus Torvalds 已提交
810
	}
E
Eric Dumazet 已提交
811
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
812
		      IPSTATS_MIB_FRAGOKS);
813
	consume_skb(skb);
L
Linus Torvalds 已提交
814 815
	return err;

816 817 818 819 820 821 822 823
fail_toobig:
	if (skb->sk && dst_allfrag(skb_dst(skb)))
		sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);

	skb->dev = skb_dst(skb)->dev;
	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
	err = -EMSGSIZE;

L
Linus Torvalds 已提交
824
fail:
E
Eric Dumazet 已提交
825
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
826
		      IPSTATS_MIB_FRAGFAILS);
827
	kfree_skb(skb);
L
Linus Torvalds 已提交
828 829 830
	return err;
}

831 832 833
static inline int ip6_rt_check(const struct rt6key *rt_key,
			       const struct in6_addr *fl_addr,
			       const struct in6_addr *addr_cache)
834
{
E
Eric Dumazet 已提交
835
	return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
836
		(!addr_cache || !ipv6_addr_equal(fl_addr, addr_cache));
837 838
}

839 840
static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
					  struct dst_entry *dst,
841
					  const struct flowi6 *fl6)
L
Linus Torvalds 已提交
842
{
843
	struct ipv6_pinfo *np = inet6_sk(sk);
844
	struct rt6_info *rt;
L
Linus Torvalds 已提交
845

846 847 848
	if (!dst)
		goto out;

849 850 851 852 853 854
	if (dst->ops->family != AF_INET6) {
		dst_release(dst);
		return NULL;
	}

	rt = (struct rt6_info *)dst;
855 856 857
	/* Yes, checking route validity in not connected
	 * case is not very simple. Take into account,
	 * that we do not support routing by source, TOS,
858
	 * and MSG_DONTROUTE		--ANK (980726)
859
	 *
860 861
	 * 1. ip6_rt_check(): If route was host route,
	 *    check that cached destination is current.
862 863 864 865 866 867 868 869 870 871
	 *    If it is network route, we still may
	 *    check its validity using saved pointer
	 *    to the last used address: daddr_cache.
	 *    We do not want to save whole address now,
	 *    (because main consumer of this service
	 *    is tcp, which has not this problem),
	 *    so that the last trick works only on connected
	 *    sockets.
	 * 2. oif also should be the same.
	 */
872
	if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
873
#ifdef CONFIG_IPV6_SUBTREES
874
	    ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
875
#endif
876
	    (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
877 878
		dst_release(dst);
		dst = NULL;
L
Linus Torvalds 已提交
879 880
	}

881 882 883 884
out:
	return dst;
}

885
static int ip6_dst_lookup_tail(struct net *net, struct sock *sk,
886
			       struct dst_entry **dst, struct flowi6 *fl6)
887
{
888 889
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
	struct neighbour *n;
890
	struct rt6_info *rt;
891 892
#endif
	int err;
893

894 895 896 897 898 899 900 901 902 903 904 905
	/* The correct way to handle this would be to do
	 * ip6_route_get_saddr, and then ip6_route_output; however,
	 * the route-specific preferred source forces the
	 * ip6_route_output call _before_ ip6_route_get_saddr.
	 *
	 * In source specific routing (no src=any default route),
	 * ip6_route_output will fail given src=any saddr, though, so
	 * that's why we try it again later.
	 */
	if (ipv6_addr_any(&fl6->saddr) && (!*dst || !(*dst)->error)) {
		struct rt6_info *rt;
		bool had_dst = *dst != NULL;
L
Linus Torvalds 已提交
906

907 908 909
		if (!had_dst)
			*dst = ip6_route_output(net, sk, fl6);
		rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
910 911 912
		err = ip6_route_get_saddr(net, rt, &fl6->daddr,
					  sk ? inet6_sk(sk)->srcprefs : 0,
					  &fl6->saddr);
913
		if (err)
L
Linus Torvalds 已提交
914
			goto out_err_release;
915 916 917 918 919 920 921 922 923

		/* If we had an erroneous initial result, pretend it
		 * never existed and let the SA-enabled version take
		 * over.
		 */
		if (!had_dst && (*dst)->error) {
			dst_release(*dst);
			*dst = NULL;
		}
L
Linus Torvalds 已提交
924 925
	}

926 927 928 929 930 931 932
	if (!*dst)
		*dst = ip6_route_output(net, sk, fl6);

	err = (*dst)->error;
	if (err)
		goto out_err_release;

933
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
934 935 936 937 938 939 940 941
	/*
	 * Here if the dst entry we've looked up
	 * has a neighbour entry that is in the INCOMPLETE
	 * state and the src address from the flow is
	 * marked as OPTIMISTIC, we release the found
	 * dst entry and replace it instead with the
	 * dst entry of the nexthop router
	 */
942
	rt = (struct rt6_info *) *dst;
943
	rcu_read_lock_bh();
944 945
	n = __ipv6_neigh_lookup_noref(rt->dst.dev,
				      rt6_nexthop(rt, &fl6->daddr));
946 947 948 949
	err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
	rcu_read_unlock_bh();

	if (err) {
950
		struct inet6_ifaddr *ifp;
951
		struct flowi6 fl_gw6;
952 953
		int redirect;

954
		ifp = ipv6_get_ifaddr(net, &fl6->saddr,
955 956 957 958 959 960 961 962 963 964 965 966
				      (*dst)->dev, 1);

		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
		if (ifp)
			in6_ifa_put(ifp);

		if (redirect) {
			/*
			 * We need to get the dst entry for the
			 * default router instead
			 */
			dst_release(*dst);
967 968 969
			memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
			memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
			*dst = ip6_route_output(net, sk, &fl_gw6);
970 971
			err = (*dst)->error;
			if (err)
972
				goto out_err_release;
973
		}
974
	}
975 976
#endif

L
Linus Torvalds 已提交
977 978 979
	return 0;

out_err_release:
980
	if (err == -ENETUNREACH)
981
		IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
982 983 984 985
	dst_release(*dst);
	*dst = NULL;
	return err;
}
A
Adrian Bunk 已提交
986

987 988 989 990
/**
 *	ip6_dst_lookup - perform route lookup on flow
 *	@sk: socket which provides route info
 *	@dst: pointer to dst_entry * for result
991
 *	@fl6: flow to lookup
992 993 994 995 996
 *
 *	This function performs a route lookup on the given flow.
 *
 *	It returns zero on success, or a standard errno code on error.
 */
997 998
int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
		   struct flowi6 *fl6)
999 1000
{
	*dst = NULL;
1001
	return ip6_dst_lookup_tail(net, sk, dst, fl6);
1002
}
1003 1004
EXPORT_SYMBOL_GPL(ip6_dst_lookup);

1005
/**
1006 1007
 *	ip6_dst_lookup_flow - perform route lookup on flow with ipsec
 *	@sk: socket which provides route info
1008
 *	@fl6: flow to lookup
1009 1010 1011 1012 1013 1014 1015
 *	@final_dst: final destination address for ipsec lookup
 *
 *	This function performs a route lookup on the given flow.
 *
 *	It returns a valid dst pointer on success, or a pointer encoded
 *	error code.
 */
1016
struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1017
				      const struct in6_addr *final_dst)
1018 1019 1020 1021
{
	struct dst_entry *dst = NULL;
	int err;

1022
	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1023 1024 1025
	if (err)
		return ERR_PTR(err);
	if (final_dst)
A
Alexey Dobriyan 已提交
1026
		fl6->daddr = *final_dst;
1027 1028
	if (!fl6->flowi6_oif)
		fl6->flowi6_oif = dst->dev->ifindex;
1029

1030
	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1031 1032 1033 1034 1035
}
EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);

/**
 *	ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1036
 *	@sk: socket which provides the dst cache and route info
1037
 *	@fl6: flow to lookup
1038
 *	@final_dst: final destination address for ipsec lookup
1039 1040 1041 1042 1043 1044
 *
 *	This function performs a route lookup on the given flow with the
 *	possibility of using the cached route in the socket if it is valid.
 *	It will take the socket dst lock when operating on the dst cache.
 *	As a result, this function can only be used in process context.
 *
1045 1046
 *	It returns a valid dst pointer on success, or a pointer encoded
 *	error code.
1047
 */
1048
struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1049
					 const struct in6_addr *final_dst)
1050
{
1051 1052
	struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
	int err;
1053

1054
	dst = ip6_sk_dst_check(sk, dst, fl6);
1055

1056
	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1057 1058 1059
	if (err)
		return ERR_PTR(err);
	if (final_dst)
A
Alexey Dobriyan 已提交
1060
		fl6->daddr = *final_dst;
1061

1062
	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1063
}
1064
EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1065

A
Adrian Bunk 已提交
1066
static inline int ip6_ufo_append_data(struct sock *sk,
1067
			struct sk_buff_head *queue,
1068 1069 1070
			int getfrag(void *from, char *to, int offset, int len,
			int odd, struct sk_buff *skb),
			void *from, int length, int hh_len, int fragheaderlen,
1071
			int transhdrlen, int mtu, unsigned int flags,
1072
			const struct flowi6 *fl6)
1073 1074 1075 1076 1077 1078 1079 1080 1081

{
	struct sk_buff *skb;
	int err;

	/* There is support for UDP large send offload by network
	 * device, so create one single skb packet containing complete
	 * udp datagram
	 */
1082
	skb = skb_peek_tail(queue);
1083
	if (!skb) {
1084 1085 1086
		skb = sock_alloc_send_skb(sk,
			hh_len + fragheaderlen + transhdrlen + 20,
			(flags & MSG_DONTWAIT), &err);
1087
		if (!skb)
1088
			return err;
1089 1090 1091 1092 1093

		/* reserve space for Hardware header */
		skb_reserve(skb, hh_len);

		/* create space for UDP/IP header */
1094
		skb_put(skb, fragheaderlen + transhdrlen);
1095 1096

		/* initialize network header pointer */
1097
		skb_reset_network_header(skb);
1098 1099

		/* initialize protocol header pointer */
1100
		skb->transport_header = skb->network_header + fragheaderlen;
1101

1102
		skb->protocol = htons(ETH_P_IPV6);
1103 1104
		skb->csum = 0;

1105
		__skb_queue_tail(queue, skb);
1106 1107
	} else if (skb_is_gso(skb)) {
		goto append;
1108 1109
	}

1110 1111 1112 1113 1114 1115 1116
	skb->ip_summed = CHECKSUM_PARTIAL;
	/* Specify the length of each IPv6 datagram fragment.
	 * It has to be a multiple of 8.
	 */
	skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
				     sizeof(struct frag_hdr)) & ~7;
	skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1117 1118 1119
	skb_shinfo(skb)->ip6_frag_id = ipv6_select_ident(sock_net(sk),
							 &fl6->daddr,
							 &fl6->saddr);
1120 1121

append:
1122 1123
	return skb_append_datato_frags(sk, skb, getfrag, from,
				       (length - transhdrlen));
1124
}
L
Linus Torvalds 已提交
1125

1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137
static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
					       gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
						gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

1138
static void ip6_append_data_mtu(unsigned int *mtu,
G
Gao feng 已提交
1139 1140 1141
				int *maxfraglen,
				unsigned int fragheaderlen,
				struct sk_buff *skb,
1142
				struct rt6_info *rt,
1143
				unsigned int orig_mtu)
G
Gao feng 已提交
1144 1145
{
	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1146
		if (!skb) {
G
Gao feng 已提交
1147
			/* first fragment, reserve header_len */
1148
			*mtu = orig_mtu - rt->dst.header_len;
G
Gao feng 已提交
1149 1150 1151 1152 1153 1154

		} else {
			/*
			 * this fragment is not first, the headers
			 * space is regarded as data space.
			 */
1155
			*mtu = orig_mtu;
G
Gao feng 已提交
1156 1157 1158 1159 1160 1161
		}
		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
			      + fragheaderlen - sizeof(struct frag_hdr);
	}
}

1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177
static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
			  struct inet6_cork *v6_cork,
			  int hlimit, int tclass, struct ipv6_txoptions *opt,
			  struct rt6_info *rt, struct flowi6 *fl6)
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	unsigned int mtu;

	/*
	 * setup for corking
	 */
	if (opt) {
		if (WARN_ON(v6_cork->opt))
			return -EINVAL;

		v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation);
1178
		if (unlikely(!v6_cork->opt))
1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229
			return -ENOBUFS;

		v6_cork->opt->tot_len = opt->tot_len;
		v6_cork->opt->opt_flen = opt->opt_flen;
		v6_cork->opt->opt_nflen = opt->opt_nflen;

		v6_cork->opt->dst0opt = ip6_opt_dup(opt->dst0opt,
						    sk->sk_allocation);
		if (opt->dst0opt && !v6_cork->opt->dst0opt)
			return -ENOBUFS;

		v6_cork->opt->dst1opt = ip6_opt_dup(opt->dst1opt,
						    sk->sk_allocation);
		if (opt->dst1opt && !v6_cork->opt->dst1opt)
			return -ENOBUFS;

		v6_cork->opt->hopopt = ip6_opt_dup(opt->hopopt,
						   sk->sk_allocation);
		if (opt->hopopt && !v6_cork->opt->hopopt)
			return -ENOBUFS;

		v6_cork->opt->srcrt = ip6_rthdr_dup(opt->srcrt,
						    sk->sk_allocation);
		if (opt->srcrt && !v6_cork->opt->srcrt)
			return -ENOBUFS;

		/* need source address above miyazawa*/
	}
	dst_hold(&rt->dst);
	cork->base.dst = &rt->dst;
	cork->fl.u.ip6 = *fl6;
	v6_cork->hop_limit = hlimit;
	v6_cork->tclass = tclass;
	if (rt->dst.flags & DST_XFRM_TUNNEL)
		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
		      rt->dst.dev->mtu : dst_mtu(&rt->dst);
	else
		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
		      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
	if (np->frag_size < mtu) {
		if (np->frag_size)
			mtu = np->frag_size;
	}
	cork->base.fragsize = mtu;
	if (dst_allfrag(rt->dst.path))
		cork->base.flags |= IPCORK_ALLFRAG;
	cork->base.length = 0;

	return 0;
}

1230 1231 1232 1233 1234 1235 1236 1237 1238 1239
static int __ip6_append_data(struct sock *sk,
			     struct flowi6 *fl6,
			     struct sk_buff_head *queue,
			     struct inet_cork *cork,
			     struct inet6_cork *v6_cork,
			     struct page_frag *pfrag,
			     int getfrag(void *from, char *to, int offset,
					 int len, int odd, struct sk_buff *skb),
			     void *from, int length, int transhdrlen,
			     unsigned int flags, int dontfrag)
L
Linus Torvalds 已提交
1240
{
G
Gao feng 已提交
1241
	struct sk_buff *skb, *skb_prev = NULL;
1242
	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1243 1244
	int exthdrlen = 0;
	int dst_exthdrlen = 0;
L
Linus Torvalds 已提交
1245 1246 1247 1248
	int hh_len;
	int copy;
	int err;
	int offset = 0;
1249
	__u8 tx_flags = 0;
1250
	u32 tskey = 0;
1251 1252
	struct rt6_info *rt = (struct rt6_info *)cork->dst;
	struct ipv6_txoptions *opt = v6_cork->opt;
1253
	int csummode = CHECKSUM_NONE;
L
Linus Torvalds 已提交
1254

1255 1256 1257
	skb = skb_peek_tail(queue);
	if (!skb) {
		exthdrlen = opt ? opt->opt_flen : 0;
1258
		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
L
Linus Torvalds 已提交
1259
	}
1260

1261
	mtu = cork->fragsize;
1262
	orig_mtu = mtu;
L
Linus Torvalds 已提交
1263

1264
	hh_len = LL_RESERVED_SPACE(rt->dst.dev);
L
Linus Torvalds 已提交
1265

1266
	fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1267
			(opt ? opt->opt_nflen : 0);
1268 1269
	maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
		     sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
1270 1271

	if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1272 1273 1274
		unsigned int maxnonfragsize, headersize;

		headersize = sizeof(struct ipv6hdr) +
1275
			     (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1276 1277 1278 1279
			     (dst_allfrag(&rt->dst) ?
			      sizeof(struct frag_hdr) : 0) +
			     rt->rt6i_nfheader_len;

W
WANG Cong 已提交
1280
		if (ip6_sk_ignore_df(sk))
1281 1282 1283
			maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
		else
			maxnonfragsize = mtu;
1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298

		/* dontfrag active */
		if ((cork->length + length > mtu - headersize) && dontfrag &&
		    (sk->sk_protocol == IPPROTO_UDP ||
		     sk->sk_protocol == IPPROTO_RAW)) {
			ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
						   sizeof(struct ipv6hdr));
			goto emsgsize;
		}

		if (cork->length + length > maxnonfragsize - headersize) {
emsgsize:
			ipv6_local_error(sk, EMSGSIZE, fl6,
					 mtu - headersize +
					 sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
1299 1300 1301 1302
			return -EMSGSIZE;
		}
	}

1303
	if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_RAW) {
1304
		sock_tx_timestamp(sk, &tx_flags);
1305 1306 1307 1308
		if (tx_flags & SKBTX_ANY_SW_TSTAMP &&
		    sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
			tskey = sk->sk_tskey++;
	}
1309

1310 1311
	/* If this is the first and only packet and device
	 * supports checksum offloading, let's use it.
1312 1313
	 * Use transhdrlen, same as IPv4, because partial
	 * sums only work when transhdrlen is set.
1314
	 */
1315
	if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
1316 1317 1318 1319
	    length + fragheaderlen < mtu &&
	    rt->dst.dev->features & NETIF_F_V6_CSUM &&
	    !exthdrlen)
		csummode = CHECKSUM_PARTIAL;
L
Linus Torvalds 已提交
1320 1321 1322 1323 1324 1325 1326
	/*
	 * Let's try using as much space as possible.
	 * Use MTU if total length of the message fits into the MTU.
	 * Otherwise, we need to reserve fragment header and
	 * fragment alignment (= 8-15 octects, in total).
	 *
	 * Note that we may need to "move" the data from the tail of
1327
	 * of the buffer to the new fragment when we split
L
Linus Torvalds 已提交
1328 1329
	 * the message.
	 *
1330
	 * FIXME: It may be fragmented into multiple chunks
L
Linus Torvalds 已提交
1331 1332
	 *        at once if non-fragmentable extension headers
	 *        are too large.
1333
	 * --yoshfuji
L
Linus Torvalds 已提交
1334 1335
	 */

1336 1337 1338 1339
	cork->length += length;
	if (((length > mtu) ||
	     (skb && skb_is_gso(skb))) &&
	    (sk->sk_protocol == IPPROTO_UDP) &&
1340 1341
	    (rt->dst.dev->features & NETIF_F_UFO) &&
	    (sk->sk_type == SOCK_DGRAM)) {
1342
		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
1343
					  hh_len, fragheaderlen,
1344
					  transhdrlen, mtu, flags, fl6);
1345 1346 1347
		if (err)
			goto error;
		return 0;
1348
	}
L
Linus Torvalds 已提交
1349

1350
	if (!skb)
L
Linus Torvalds 已提交
1351 1352 1353 1354
		goto alloc_new_skb;

	while (length > 0) {
		/* Check if the remaining data fits into current packet. */
1355
		copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
L
Linus Torvalds 已提交
1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366
		if (copy < length)
			copy = maxfraglen - skb->len;

		if (copy <= 0) {
			char *data;
			unsigned int datalen;
			unsigned int fraglen;
			unsigned int fraggap;
			unsigned int alloclen;
alloc_new_skb:
			/* There's no room in the current skb */
G
Gao feng 已提交
1367 1368
			if (skb)
				fraggap = skb->len - maxfraglen;
L
Linus Torvalds 已提交
1369 1370
			else
				fraggap = 0;
G
Gao feng 已提交
1371
			/* update mtu and maxfraglen if necessary */
1372
			if (!skb || !skb_prev)
G
Gao feng 已提交
1373
				ip6_append_data_mtu(&mtu, &maxfraglen,
1374
						    fragheaderlen, skb, rt,
1375
						    orig_mtu);
G
Gao feng 已提交
1376 1377

			skb_prev = skb;
L
Linus Torvalds 已提交
1378 1379 1380 1381 1382 1383 1384

			/*
			 * If remaining data exceeds the mtu,
			 * we know we need more fragment(s).
			 */
			datalen = length + fraggap;

G
Gao feng 已提交
1385 1386
			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
L
Linus Torvalds 已提交
1387
			if ((flags & MSG_MORE) &&
1388
			    !(rt->dst.dev->features&NETIF_F_SG))
L
Linus Torvalds 已提交
1389 1390 1391 1392
				alloclen = mtu;
			else
				alloclen = datalen + fragheaderlen;

1393 1394
			alloclen += dst_exthdrlen;

G
Gao feng 已提交
1395 1396 1397 1398 1399 1400 1401 1402 1403 1404
			if (datalen != length + fraggap) {
				/*
				 * this is not the last fragment, the trailer
				 * space is regarded as data space.
				 */
				datalen += rt->dst.trailer_len;
			}

			alloclen += rt->dst.trailer_len;
			fraglen = datalen + fragheaderlen;
L
Linus Torvalds 已提交
1405 1406 1407

			/*
			 * We just reserve space for fragment header.
1408
			 * Note: this may be overallocation if the message
L
Linus Torvalds 已提交
1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423
			 * (without MSG_MORE) fits into the MTU.
			 */
			alloclen += sizeof(struct frag_hdr);

			if (transhdrlen) {
				skb = sock_alloc_send_skb(sk,
						alloclen + hh_len,
						(flags & MSG_DONTWAIT), &err);
			} else {
				skb = NULL;
				if (atomic_read(&sk->sk_wmem_alloc) <=
				    2 * sk->sk_sndbuf)
					skb = sock_wmalloc(sk,
							   alloclen + hh_len, 1,
							   sk->sk_allocation);
1424
				if (unlikely(!skb))
L
Linus Torvalds 已提交
1425 1426
					err = -ENOBUFS;
			}
1427
			if (!skb)
L
Linus Torvalds 已提交
1428 1429 1430 1431
				goto error;
			/*
			 *	Fill in the control structures
			 */
1432
			skb->protocol = htons(ETH_P_IPV6);
1433
			skb->ip_summed = csummode;
L
Linus Torvalds 已提交
1434
			skb->csum = 0;
1435 1436 1437
			/* reserve for fragmentation and ipsec header */
			skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
				    dst_exthdrlen);
L
Linus Torvalds 已提交
1438

1439 1440 1441
			/* Only the initial fragment is time stamped */
			skb_shinfo(skb)->tx_flags = tx_flags;
			tx_flags = 0;
1442 1443
			skb_shinfo(skb)->tskey = tskey;
			tskey = 0;
1444

L
Linus Torvalds 已提交
1445 1446 1447
			/*
			 *	Find where to start putting bytes
			 */
1448 1449 1450
			data = skb_put(skb, fraglen);
			skb_set_network_header(skb, exthdrlen);
			data += fragheaderlen;
1451 1452
			skb->transport_header = (skb->network_header +
						 fragheaderlen);
L
Linus Torvalds 已提交
1453 1454 1455 1456 1457 1458 1459
			if (fraggap) {
				skb->csum = skb_copy_and_csum_bits(
					skb_prev, maxfraglen,
					data + transhdrlen, fraggap, 0);
				skb_prev->csum = csum_sub(skb_prev->csum,
							  skb->csum);
				data += fraggap;
1460
				pskb_trim_unique(skb_prev, maxfraglen);
L
Linus Torvalds 已提交
1461 1462
			}
			copy = datalen - transhdrlen - fraggap;
1463

L
Linus Torvalds 已提交
1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477
			if (copy < 0) {
				err = -EINVAL;
				kfree_skb(skb);
				goto error;
			} else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
				err = -EFAULT;
				kfree_skb(skb);
				goto error;
			}

			offset += copy;
			length -= datalen - fraggap;
			transhdrlen = 0;
			exthdrlen = 0;
1478
			dst_exthdrlen = 0;
L
Linus Torvalds 已提交
1479 1480 1481 1482

			/*
			 * Put the packet on the pending queue
			 */
1483
			__skb_queue_tail(queue, skb);
L
Linus Torvalds 已提交
1484 1485 1486 1487 1488 1489
			continue;
		}

		if (copy > length)
			copy = length;

1490
		if (!(rt->dst.dev->features&NETIF_F_SG)) {
L
Linus Torvalds 已提交
1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502
			unsigned int off;

			off = skb->len;
			if (getfrag(from, skb_put(skb, copy),
						offset, copy, off, skb) < 0) {
				__skb_trim(skb, off);
				err = -EFAULT;
				goto error;
			}
		} else {
			int i = skb_shinfo(skb)->nr_frags;

1503 1504
			err = -ENOMEM;
			if (!sk_page_frag_refill(sk, pfrag))
L
Linus Torvalds 已提交
1505
				goto error;
1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516

			if (!skb_can_coalesce(skb, i, pfrag->page,
					      pfrag->offset)) {
				err = -EMSGSIZE;
				if (i == MAX_SKB_FRAGS)
					goto error;

				__skb_fill_page_desc(skb, i, pfrag->page,
						     pfrag->offset, 0);
				skb_shinfo(skb)->nr_frags = ++i;
				get_page(pfrag->page);
L
Linus Torvalds 已提交
1517
			}
1518
			copy = min_t(int, copy, pfrag->size - pfrag->offset);
E
Eric Dumazet 已提交
1519
			if (getfrag(from,
1520 1521 1522 1523 1524 1525
				    page_address(pfrag->page) + pfrag->offset,
				    offset, copy, skb->len, skb) < 0)
				goto error_efault;

			pfrag->offset += copy;
			skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
L
Linus Torvalds 已提交
1526 1527
			skb->len += copy;
			skb->data_len += copy;
1528 1529
			skb->truesize += copy;
			atomic_add(copy, &sk->sk_wmem_alloc);
L
Linus Torvalds 已提交
1530 1531 1532 1533
		}
		offset += copy;
		length -= copy;
	}
1534

L
Linus Torvalds 已提交
1535
	return 0;
1536 1537 1538

error_efault:
	err = -EFAULT;
L
Linus Torvalds 已提交
1539
error:
1540
	cork->length -= length;
1541
	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1542 1543
	return err;
}
1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579

int ip6_append_data(struct sock *sk,
		    int getfrag(void *from, char *to, int offset, int len,
				int odd, struct sk_buff *skb),
		    void *from, int length, int transhdrlen, int hlimit,
		    int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
		    struct rt6_info *rt, unsigned int flags, int dontfrag)
{
	struct inet_sock *inet = inet_sk(sk);
	struct ipv6_pinfo *np = inet6_sk(sk);
	int exthdrlen;
	int err;

	if (flags&MSG_PROBE)
		return 0;
	if (skb_queue_empty(&sk->sk_write_queue)) {
		/*
		 * setup for corking
		 */
		err = ip6_setup_cork(sk, &inet->cork, &np->cork, hlimit,
				     tclass, opt, rt, fl6);
		if (err)
			return err;

		exthdrlen = (opt ? opt->opt_flen : 0);
		length += exthdrlen;
		transhdrlen += exthdrlen;
	} else {
		fl6 = &inet->cork.fl.u.ip6;
		transhdrlen = 0;
	}

	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
				 &np->cork, sk_page_frag(sk), getfrag,
				 from, length, transhdrlen, flags, dontfrag);
}
1580
EXPORT_SYMBOL_GPL(ip6_append_data);
L
Linus Torvalds 已提交
1581

1582 1583
static void ip6_cork_release(struct inet_cork_full *cork,
			     struct inet6_cork *v6_cork)
1584
{
1585 1586 1587 1588 1589 1590 1591
	if (v6_cork->opt) {
		kfree(v6_cork->opt->dst0opt);
		kfree(v6_cork->opt->dst1opt);
		kfree(v6_cork->opt->hopopt);
		kfree(v6_cork->opt->srcrt);
		kfree(v6_cork->opt);
		v6_cork->opt = NULL;
1592 1593
	}

1594 1595 1596 1597
	if (cork->base.dst) {
		dst_release(cork->base.dst);
		cork->base.dst = NULL;
		cork->base.flags &= ~IPCORK_ALLFRAG;
1598
	}
1599
	memset(&cork->fl, 0, sizeof(cork->fl));
1600 1601
}

V
Vlad Yasevich 已提交
1602 1603 1604 1605
struct sk_buff *__ip6_make_skb(struct sock *sk,
			       struct sk_buff_head *queue,
			       struct inet_cork_full *cork,
			       struct inet6_cork *v6_cork)
L
Linus Torvalds 已提交
1606 1607 1608 1609 1610
{
	struct sk_buff *skb, *tmp_skb;
	struct sk_buff **tail_skb;
	struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
	struct ipv6_pinfo *np = inet6_sk(sk);
1611
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
1612
	struct ipv6hdr *hdr;
V
Vlad Yasevich 已提交
1613 1614 1615
	struct ipv6_txoptions *opt = v6_cork->opt;
	struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
	struct flowi6 *fl6 = &cork->fl.u.ip6;
1616
	unsigned char proto = fl6->flowi6_proto;
L
Linus Torvalds 已提交
1617

V
Vlad Yasevich 已提交
1618
	skb = __skb_dequeue(queue);
1619
	if (!skb)
L
Linus Torvalds 已提交
1620 1621 1622 1623
		goto out;
	tail_skb = &(skb_shinfo(skb)->frag_list);

	/* move skb->data to ip header from ext header */
1624
	if (skb->data < skb_network_header(skb))
1625
		__skb_pull(skb, skb_network_offset(skb));
V
Vlad Yasevich 已提交
1626
	while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
1627
		__skb_pull(tmp_skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1628 1629 1630 1631 1632 1633 1634 1635 1636
		*tail_skb = tmp_skb;
		tail_skb = &(tmp_skb->next);
		skb->len += tmp_skb->len;
		skb->data_len += tmp_skb->len;
		skb->truesize += tmp_skb->truesize;
		tmp_skb->destructor = NULL;
		tmp_skb->sk = NULL;
	}

1637
	/* Allow local fragmentation. */
W
WANG Cong 已提交
1638
	skb->ignore_df = ip6_sk_ignore_df(sk);
1639

A
Alexey Dobriyan 已提交
1640
	*final_dst = fl6->daddr;
1641
	__skb_pull(skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1642 1643 1644 1645 1646
	if (opt && opt->opt_flen)
		ipv6_push_frag_opts(skb, opt, &proto);
	if (opt && opt->opt_nflen)
		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);

1647 1648
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
1649
	hdr = ipv6_hdr(skb);
1650

V
Vlad Yasevich 已提交
1651
	ip6_flow_hdr(hdr, v6_cork->tclass,
1652
		     ip6_make_flowlabel(net, skb, fl6->flowlabel,
1653
					np->autoflowlabel, fl6));
V
Vlad Yasevich 已提交
1654
	hdr->hop_limit = v6_cork->hop_limit;
L
Linus Torvalds 已提交
1655
	hdr->nexthdr = proto;
A
Alexey Dobriyan 已提交
1656 1657
	hdr->saddr = fl6->saddr;
	hdr->daddr = *final_dst;
L
Linus Torvalds 已提交
1658

1659
	skb->priority = sk->sk_priority;
1660
	skb->mark = sk->sk_mark;
1661

1662
	skb_dst_set(skb, dst_clone(&rt->dst));
1663
	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1664
	if (proto == IPPROTO_ICMPV6) {
E
Eric Dumazet 已提交
1665
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1666

1667 1668
		ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1669 1670
	}

V
Vlad Yasevich 已提交
1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681
	ip6_cork_release(cork, v6_cork);
out:
	return skb;
}

int ip6_send_skb(struct sk_buff *skb)
{
	struct net *net = sock_net(skb->sk);
	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
	int err;

H
Herbert Xu 已提交
1682
	err = ip6_local_out(skb);
L
Linus Torvalds 已提交
1683 1684
	if (err) {
		if (err > 0)
E
Eric Dumazet 已提交
1685
			err = net_xmit_errno(err);
L
Linus Torvalds 已提交
1686
		if (err)
V
Vlad Yasevich 已提交
1687 1688
			IP6_INC_STATS(net, rt->rt6i_idev,
				      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1689 1690 1691
	}

	return err;
V
Vlad Yasevich 已提交
1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702
}

int ip6_push_pending_frames(struct sock *sk)
{
	struct sk_buff *skb;

	skb = ip6_finish_skb(sk);
	if (!skb)
		return 0;

	return ip6_send_skb(skb);
L
Linus Torvalds 已提交
1703
}
1704
EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
L
Linus Torvalds 已提交
1705

1706
static void __ip6_flush_pending_frames(struct sock *sk,
V
Vlad Yasevich 已提交
1707 1708 1709
				       struct sk_buff_head *queue,
				       struct inet_cork_full *cork,
				       struct inet6_cork *v6_cork)
L
Linus Torvalds 已提交
1710 1711 1712
{
	struct sk_buff *skb;

1713
	while ((skb = __skb_dequeue_tail(queue)) != NULL) {
E
Eric Dumazet 已提交
1714 1715
		if (skb_dst(skb))
			IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1716
				      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1717 1718 1719
		kfree_skb(skb);
	}

V
Vlad Yasevich 已提交
1720
	ip6_cork_release(cork, v6_cork);
L
Linus Torvalds 已提交
1721
}
1722 1723 1724

void ip6_flush_pending_frames(struct sock *sk)
{
V
Vlad Yasevich 已提交
1725 1726
	__ip6_flush_pending_frames(sk, &sk->sk_write_queue,
				   &inet_sk(sk)->cork, &inet6_sk(sk)->cork);
1727
}
1728
EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
V
Vlad Yasevich 已提交
1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771

struct sk_buff *ip6_make_skb(struct sock *sk,
			     int getfrag(void *from, char *to, int offset,
					 int len, int odd, struct sk_buff *skb),
			     void *from, int length, int transhdrlen,
			     int hlimit, int tclass,
			     struct ipv6_txoptions *opt, struct flowi6 *fl6,
			     struct rt6_info *rt, unsigned int flags,
			     int dontfrag)
{
	struct inet_cork_full cork;
	struct inet6_cork v6_cork;
	struct sk_buff_head queue;
	int exthdrlen = (opt ? opt->opt_flen : 0);
	int err;

	if (flags & MSG_PROBE)
		return NULL;

	__skb_queue_head_init(&queue);

	cork.base.flags = 0;
	cork.base.addr = 0;
	cork.base.opt = NULL;
	v6_cork.opt = NULL;
	err = ip6_setup_cork(sk, &cork, &v6_cork, hlimit, tclass, opt, rt, fl6);
	if (err)
		return ERR_PTR(err);

	if (dontfrag < 0)
		dontfrag = inet6_sk(sk)->dontfrag;

	err = __ip6_append_data(sk, fl6, &queue, &cork.base, &v6_cork,
				&current->task_frag, getfrag, from,
				length + exthdrlen, transhdrlen + exthdrlen,
				flags, dontfrag);
	if (err) {
		__ip6_flush_pending_frames(sk, &queue, &cork, &v6_cork);
		return ERR_PTR(err);
	}

	return __ip6_make_skb(sk, &queue, &cork, &v6_cork);
}