ip6_output.c 44.6 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 output functions
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
 *
 *	Based on linux/net/ipv4/ip_output.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 *	Changes:
 *	A.N.Kuznetsov	:	airthmetics in fragmentation.
 *				extension headers are implemented.
 *				route changes now work.
 *				ip6_forward does not confuse sniffers.
 *				etc.
 *
 *      H. von Brand    :       Added missing #include <linux/string.h>
23
 *	Imran Patel	:	frag id should be in NBO
L
Linus Torvalds 已提交
24 25 26 27 28 29
 *      Kazunori MIYAZAWA @USAGI
 *			:       add ip6_append_data and related functions
 *				for datagram xmit
 */

#include <linux/errno.h>
H
Herbert Xu 已提交
30
#include <linux/kernel.h>
L
Linus Torvalds 已提交
31 32 33 34 35 36 37 38
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/net.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/in6.h>
#include <linux/tcp.h>
#include <linux/route.h>
39
#include <linux/module.h>
40
#include <linux/slab.h>
L
Linus Torvalds 已提交
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
#include <net/ndisc.h>
#include <net/protocol.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/rawv6.h>
#include <net/icmp.h>
#include <net/xfrm.h>
#include <net/checksum.h>
57
#include <linux/mroute6.h>
L
Linus Torvalds 已提交
58

59
static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
60
{
E
Eric Dumazet 已提交
61
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
62
	struct net_device *dev = dst->dev;
63
	struct neighbour *neigh;
64 65
	struct in6_addr *nexthop;
	int ret;
L
Linus Torvalds 已提交
66 67 68 69

	skb->protocol = htons(ETH_P_IPV6);
	skb->dev = dev;

70
	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
E
Eric Dumazet 已提交
71
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
L
Linus Torvalds 已提交
72

73
		if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) &&
74
		    ((mroute6_socket(dev_net(dev), skb) &&
75
		     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
76 77
		     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
					 &ipv6_hdr(skb)->saddr))) {
L
Linus Torvalds 已提交
78 79 80 81 82 83
			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);

			/* Do not check for IFF_ALLMULTI; multicast routing
			   is not supported in any case.
			 */
			if (newskb)
84
				NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
85
					sk, newskb, NULL, newskb->dev,
86
					dev_loopback_xmit);
L
Linus Torvalds 已提交
87

88
			if (ipv6_hdr(skb)->hop_limit == 0) {
89 90
				IP6_INC_STATS(dev_net(dev), idev,
					      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
91 92 93 94 95
				kfree_skb(skb);
				return 0;
			}
		}

96 97
		IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
				skb->len);
98 99 100 101 102 103 104

		if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
		    IPV6_ADDR_SCOPE_NODELOCAL &&
		    !(dev->flags & IFF_LOOPBACK)) {
			kfree_skb(skb);
			return 0;
		}
L
Linus Torvalds 已提交
105 106
	}

107
	rcu_read_lock_bh();
108
	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
109 110 111 112 113 114 115 116 117
	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
	if (unlikely(!neigh))
		neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
	if (!IS_ERR(neigh)) {
		ret = dst_neigh_output(dst, neigh, skb);
		rcu_read_unlock_bh();
		return ret;
	}
	rcu_read_unlock_bh();
118

119 120
	IP6_INC_STATS(dev_net(dst->dev),
		      ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
121 122
	kfree_skb(skb);
	return -EINVAL;
L
Linus Torvalds 已提交
123 124
}

125
static int ip6_finish_output(struct sock *sk, struct sk_buff *skb)
126 127
{
	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
128 129
	    dst_allfrag(skb_dst(skb)) ||
	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
130
		return ip6_fragment(sk, skb, ip6_finish_output2);
131
	else
132
		return ip6_finish_output2(sk, skb);
133 134
}

135
int ip6_output(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
136
{
137
	struct net_device *dev = skb_dst(skb)->dev;
E
Eric Dumazet 已提交
138
	struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
139
	if (unlikely(idev->cnf.disable_ipv6)) {
140
		IP6_INC_STATS(dev_net(dev), idev,
141
			      IPSTATS_MIB_OUTDISCARDS);
142 143 144 145
		kfree_skb(skb);
		return 0;
	}

146 147
	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, sk, skb,
			    NULL, dev,
148 149
			    ip6_finish_output,
			    !(IP6CB(skb)->flags & IP6SKB_REROUTED));
L
Linus Torvalds 已提交
150 151 152
}

/*
S
Shan Wei 已提交
153
 *	xmit an sk_buff (used by TCP, SCTP and DCCP)
L
Linus Torvalds 已提交
154 155
 */

156
int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
157
	     struct ipv6_txoptions *opt, int tclass)
L
Linus Torvalds 已提交
158
{
159
	struct net *net = sock_net(sk);
160
	struct ipv6_pinfo *np = inet6_sk(sk);
161
	struct in6_addr *first_hop = &fl6->daddr;
E
Eric Dumazet 已提交
162
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
163
	struct ipv6hdr *hdr;
164
	u8  proto = fl6->flowi6_proto;
L
Linus Torvalds 已提交
165
	int seg_len = skb->len;
G
Gerrit Renker 已提交
166
	int hlimit = -1;
L
Linus Torvalds 已提交
167 168 169
	u32 mtu;

	if (opt) {
170
		unsigned int head_room;
L
Linus Torvalds 已提交
171 172 173 174 175 176 177 178 179 180

		/* First: exthdrs may take lots of space (~8K for now)
		   MAX_HEADER is not enough.
		 */
		head_room = opt->opt_nflen + opt->opt_flen;
		seg_len += head_room;
		head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);

		if (skb_headroom(skb) < head_room) {
			struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
181
			if (!skb2) {
E
Eric Dumazet 已提交
182
				IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
183 184
					      IPSTATS_MIB_OUTDISCARDS);
				kfree_skb(skb);
L
Linus Torvalds 已提交
185 186
				return -ENOBUFS;
			}
187
			consume_skb(skb);
188
			skb = skb2;
189
			skb_set_owner_w(skb, sk);
L
Linus Torvalds 已提交
190 191 192 193 194 195 196
		}
		if (opt->opt_flen)
			ipv6_push_frag_opts(skb, opt, &proto);
		if (opt->opt_nflen)
			ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
	}

197 198
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
199
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
200 201 202 203

	/*
	 *	Fill in the IPv6 header
	 */
204
	if (np)
L
Linus Torvalds 已提交
205 206
		hlimit = np->hop_limit;
	if (hlimit < 0)
207
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
208

209
	ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
210
						     np->autoflowlabel, fl6));
211

L
Linus Torvalds 已提交
212 213 214 215
	hdr->payload_len = htons(seg_len);
	hdr->nexthdr = proto;
	hdr->hop_limit = hlimit;

A
Alexey Dobriyan 已提交
216 217
	hdr->saddr = fl6->saddr;
	hdr->daddr = *first_hop;
L
Linus Torvalds 已提交
218

219
	skb->protocol = htons(ETH_P_IPV6);
220
	skb->priority = sk->sk_priority;
221
	skb->mark = sk->sk_mark;
222

L
Linus Torvalds 已提交
223
	mtu = dst_mtu(dst);
W
WANG Cong 已提交
224
	if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
E
Eric Dumazet 已提交
225
		IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
226
			      IPSTATS_MIB_OUT, skb->len);
227 228
		return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, sk, skb,
			       NULL, dst->dev, dst_output_sk);
L
Linus Torvalds 已提交
229 230 231
	}

	skb->dev = dst->dev;
232
	ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
E
Eric Dumazet 已提交
233
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
234 235 236
	kfree_skb(skb);
	return -EMSGSIZE;
}
237 238
EXPORT_SYMBOL(ip6_xmit);

L
Linus Torvalds 已提交
239 240 241 242 243 244 245 246
static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
{
	struct ip6_ra_chain *ra;
	struct sock *last = NULL;

	read_lock(&ip6_ra_lock);
	for (ra = ip6_ra_chain; ra; ra = ra->next) {
		struct sock *sk = ra->sk;
247 248 249
		if (sk && ra->sel == sel &&
		    (!sk->sk_bound_dev_if ||
		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
L
Linus Torvalds 已提交
250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267
			if (last) {
				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
				if (skb2)
					rawv6_rcv(last, skb2);
			}
			last = sk;
		}
	}

	if (last) {
		rawv6_rcv(last, skb);
		read_unlock(&ip6_ra_lock);
		return 1;
	}
	read_unlock(&ip6_ra_lock);
	return 0;
}

268 269
static int ip6_forward_proxy_check(struct sk_buff *skb)
{
270
	struct ipv6hdr *hdr = ipv6_hdr(skb);
271
	u8 nexthdr = hdr->nexthdr;
272
	__be16 frag_off;
273 274 275
	int offset;

	if (ipv6_ext_hdr(nexthdr)) {
276
		offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
277 278 279 280 281 282 283 284
		if (offset < 0)
			return 0;
	} else
		offset = sizeof(struct ipv6hdr);

	if (nexthdr == IPPROTO_ICMPV6) {
		struct icmp6hdr *icmp6;

285 286
		if (!pskb_may_pull(skb, (skb_network_header(skb) +
					 offset + 1 - skb->data)))
287 288
			return 0;

289
		icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306

		switch (icmp6->icmp6_type) {
		case NDISC_ROUTER_SOLICITATION:
		case NDISC_ROUTER_ADVERTISEMENT:
		case NDISC_NEIGHBOUR_SOLICITATION:
		case NDISC_NEIGHBOUR_ADVERTISEMENT:
		case NDISC_REDIRECT:
			/* For reaction involving unicast neighbor discovery
			 * message destined to the proxied address, pass it to
			 * input function.
			 */
			return 1;
		default:
			break;
		}
	}

307 308 309 310 311 312 313 314 315 316
	/*
	 * The proxying router can't forward traffic sent to a link-local
	 * address, so signal the sender and discard the packet. This
	 * behavior is clarified by the MIPv6 specification.
	 */
	if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
		dst_link_failure(skb);
		return -1;
	}

317 318 319
	return 0;
}

320
static inline int ip6_forward_finish(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
321
{
322
	skb_sender_cpu_clear(skb);
323
	return dst_output_sk(sk, skb);
L
Linus Torvalds 已提交
324 325
}

326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346
static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
{
	unsigned int mtu;
	struct inet6_dev *idev;

	if (dst_metric_locked(dst, RTAX_MTU)) {
		mtu = dst_metric_raw(dst, RTAX_MTU);
		if (mtu)
			return mtu;
	}

	mtu = IPV6_MIN_MTU;
	rcu_read_lock();
	idev = __in6_dev_get(dst->dev);
	if (idev)
		mtu = idev->cnf.mtu6;
	rcu_read_unlock();

	return mtu;
}

347 348
static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
{
349
	if (skb->len <= mtu)
350 351
		return false;

W
WANG Cong 已提交
352
	/* ipv6 conntrack defrag sets max_frag_size + ignore_df */
353 354 355
	if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
		return true;

W
WANG Cong 已提交
356
	if (skb->ignore_df)
357 358
		return false;

359 360 361 362 363 364
	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
		return false;

	return true;
}

L
Linus Torvalds 已提交
365 366
int ip6_forward(struct sk_buff *skb)
{
E
Eric Dumazet 已提交
367
	struct dst_entry *dst = skb_dst(skb);
368
	struct ipv6hdr *hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
369
	struct inet6_skb_parm *opt = IP6CB(skb);
370
	struct net *net = dev_net(dst->dev);
371
	u32 mtu;
372

373
	if (net->ipv6.devconf_all->forwarding == 0)
L
Linus Torvalds 已提交
374 375
		goto error;

376 377 378
	if (skb->pkt_type != PACKET_HOST)
		goto drop;

379 380 381
	if (unlikely(skb->sk))
		goto drop;

382 383 384
	if (skb_warn_if_lro(skb))
		goto drop;

L
Linus Torvalds 已提交
385
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
386 387
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
388 389 390
		goto drop;
	}

391
	skb_forward_csum(skb);
L
Linus Torvalds 已提交
392 393 394 395 396 397 398 399 400 401 402 403 404 405

	/*
	 *	We DO NOT make any processing on
	 *	RA packets, pushing them to user level AS IS
	 *	without ane WARRANTY that application will be able
	 *	to interpret them. The reason is that we
	 *	cannot make anything clever here.
	 *
	 *	We are not end-node, so that if packet contains
	 *	AH/ESP, we cannot make anything.
	 *	Defragmentation also would be mistake, RA packets
	 *	cannot be fragmented, because there is no warranty
	 *	that different fragments will go along one path. --ANK
	 */
406 407
	if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
		if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
L
Linus Torvalds 已提交
408 409 410 411 412 413 414 415 416
			return 0;
	}

	/*
	 *	check and decrement ttl
	 */
	if (hdr->hop_limit <= 1) {
		/* Force OUTPUT device used as source address */
		skb->dev = dst->dev;
417
		icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
418 419
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INHDRERRORS);
L
Linus Torvalds 已提交
420 421 422 423 424

		kfree_skb(skb);
		return -ETIMEDOUT;
	}

425
	/* XXX: idev->cnf.proxy_ndp? */
426
	if (net->ipv6.devconf_all->proxy_ndp &&
427
	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
428 429
		int proxied = ip6_forward_proxy_check(skb);
		if (proxied > 0)
430
			return ip6_input(skb);
431
		else if (proxied < 0) {
432 433
			IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
					 IPSTATS_MIB_INDISCARDS);
434 435
			goto drop;
		}
436 437
	}

L
Linus Torvalds 已提交
438
	if (!xfrm6_route_forward(skb)) {
439 440
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
441 442
		goto drop;
	}
E
Eric Dumazet 已提交
443
	dst = skb_dst(skb);
L
Linus Torvalds 已提交
444 445 446

	/* IPv6 specs say nothing about it, but it is clear that we cannot
	   send redirects to source routed frames.
447
	   We don't send redirects to frames decapsulated from IPsec.
L
Linus Torvalds 已提交
448
	 */
449
	if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
L
Linus Torvalds 已提交
450
		struct in6_addr *target = NULL;
451
		struct inet_peer *peer;
L
Linus Torvalds 已提交
452 453 454 455 456 457 458 459
		struct rt6_info *rt;

		/*
		 *	incoming and outgoing devices are the same
		 *	send a redirect.
		 */

		rt = (struct rt6_info *) dst;
460 461
		if (rt->rt6i_flags & RTF_GATEWAY)
			target = &rt->rt6i_gateway;
L
Linus Torvalds 已提交
462 463 464
		else
			target = &hdr->daddr;

465
		peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
466

L
Linus Torvalds 已提交
467 468 469
		/* Limit redirects both by destination (here)
		   and by source (inside ndisc_send_redirect)
		 */
470
		if (inet_peer_xrlim_allow(peer, 1*HZ))
471
			ndisc_send_redirect(skb, target);
472 473
		if (peer)
			inet_putpeer(peer);
474 475 476
	} else {
		int addrtype = ipv6_addr_type(&hdr->saddr);

L
Linus Torvalds 已提交
477
		/* This check is security critical. */
478 479
		if (addrtype == IPV6_ADDR_ANY ||
		    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
480 481 482
			goto error;
		if (addrtype & IPV6_ADDR_LINKLOCAL) {
			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
483
				    ICMPV6_NOT_NEIGHBOUR, 0);
484 485
			goto error;
		}
L
Linus Torvalds 已提交
486 487
	}

488
	mtu = ip6_dst_mtu_forward(dst);
489 490 491
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;

492
	if (ip6_pkt_too_big(skb, mtu)) {
L
Linus Torvalds 已提交
493 494
		/* Again, force OUTPUT device used as source address */
		skb->dev = dst->dev;
495
		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
496 497 498 499
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INTOOBIGERRORS);
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
500 501 502 503 504
		kfree_skb(skb);
		return -EMSGSIZE;
	}

	if (skb_cow(skb, dst->dev->hard_header_len)) {
505 506
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
507 508 509
		goto drop;
	}

510
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
511 512

	/* Mangling hops number delayed to point after skb COW */
513

L
Linus Torvalds 已提交
514 515
	hdr->hop_limit--;

516
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
517
	IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
518 519
	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, NULL, skb,
		       skb->dev, dst->dev,
520
		       ip6_forward_finish);
L
Linus Torvalds 已提交
521 522

error:
523
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
L
Linus Torvalds 已提交
524 525 526 527 528 529 530 531 532 533
drop:
	kfree_skb(skb);
	return -EINVAL;
}

static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
{
	to->pkt_type = from->pkt_type;
	to->priority = from->priority;
	to->protocol = from->protocol;
E
Eric Dumazet 已提交
534 535
	skb_dst_drop(to);
	skb_dst_set(to, dst_clone(skb_dst(from)));
L
Linus Torvalds 已提交
536
	to->dev = from->dev;
T
Thomas Graf 已提交
537
	to->mark = from->mark;
L
Linus Torvalds 已提交
538 539 540 541

#ifdef CONFIG_NET_SCHED
	to->tc_index = from->tc_index;
#endif
542
	nf_copy(to, from);
543
	skb_copy_secmark(to, from);
L
Linus Torvalds 已提交
544 545
}

546 547
int ip6_fragment(struct sock *sk, struct sk_buff *skb,
		 int (*output)(struct sock *, struct sk_buff *))
L
Linus Torvalds 已提交
548 549
{
	struct sk_buff *frag;
550
	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
551 552
	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
				inet6_sk(skb->sk) : NULL;
L
Linus Torvalds 已提交
553 554 555
	struct ipv6hdr *tmp_hdr;
	struct frag_hdr *fh;
	unsigned int mtu, hlen, left, len;
556
	int hroom, troom;
557
	__be32 frag_id;
558
	int ptr, offset = 0, err = 0;
L
Linus Torvalds 已提交
559
	u8 *prevhdr, nexthdr = 0;
E
Eric Dumazet 已提交
560
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
561 562 563 564

	hlen = ip6_find_1stfragopt(skb, &prevhdr);
	nexthdr = *prevhdr;

J
John Heffner 已提交
565
	mtu = ip6_skb_dst_mtu(skb);
566 567

	/* We must not fragment if the socket is set to force MTU discovery
568
	 * or if the skb it not generated by a local socket.
569
	 */
570 571
	if (unlikely(!skb->ignore_df && skb->len > mtu))
		goto fail_toobig;
572

573 574 575 576 577 578 579 580
	if (IP6CB(skb)->frag_max_size) {
		if (IP6CB(skb)->frag_max_size > mtu)
			goto fail_toobig;

		/* don't send fragments larger than what we received */
		mtu = IP6CB(skb)->frag_max_size;
		if (mtu < IPV6_MIN_MTU)
			mtu = IPV6_MIN_MTU;
581 582
	}

583 584 585 586 587
	if (np && np->frag_size < mtu) {
		if (np->frag_size)
			mtu = np->frag_size;
	}
	mtu -= hlen + sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
588

589 590
	frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
				    &ipv6_hdr(skb)->saddr);
591

592
	hroom = LL_RESERVED_SPACE(rt->dst.dev);
593
	if (skb_has_frag_list(skb)) {
L
Linus Torvalds 已提交
594
		int first_len = skb_pagelen(skb);
595
		struct sk_buff *frag2;
L
Linus Torvalds 已提交
596 597 598

		if (first_len - hlen > mtu ||
		    ((first_len - hlen) & 7) ||
599 600
		    skb_cloned(skb) ||
		    skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
L
Linus Torvalds 已提交
601 602
			goto slow_path;

603
		skb_walk_frags(skb, frag) {
L
Linus Torvalds 已提交
604 605 606
			/* Correct geometry. */
			if (frag->len > mtu ||
			    ((frag->len & 7) && frag->next) ||
607
			    skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))
608
				goto slow_path_clean;
L
Linus Torvalds 已提交
609 610 611

			/* Partially cloned skb? */
			if (skb_shared(frag))
612
				goto slow_path_clean;
613 614 615 616 617 618

			BUG_ON(frag->sk);
			if (skb->sk) {
				frag->sk = skb->sk;
				frag->destructor = sock_wfree;
			}
619
			skb->truesize -= frag->truesize;
L
Linus Torvalds 已提交
620 621 622 623 624 625
		}

		err = 0;
		offset = 0;
		/* BUILD HEADER */

Y
YOSHIFUJI Hideaki 已提交
626
		*prevhdr = NEXTHDR_FRAGMENT;
627
		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
L
Linus Torvalds 已提交
628
		if (!tmp_hdr) {
E
Eric Dumazet 已提交
629
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
630
				      IPSTATS_MIB_FRAGFAILS);
631 632
			err = -ENOMEM;
			goto fail;
L
Linus Torvalds 已提交
633
		}
634 635
		frag = skb_shinfo(skb)->frag_list;
		skb_frag_list_init(skb);
L
Linus Torvalds 已提交
636 637

		__skb_pull(skb, hlen);
638
		fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
639 640
		__skb_push(skb, hlen);
		skb_reset_network_header(skb);
641
		memcpy(skb_network_header(skb), tmp_hdr, hlen);
L
Linus Torvalds 已提交
642 643 644 645

		fh->nexthdr = nexthdr;
		fh->reserved = 0;
		fh->frag_off = htons(IP6_MF);
646
		fh->identification = frag_id;
L
Linus Torvalds 已提交
647 648 649 650

		first_len = skb_pagelen(skb);
		skb->data_len = first_len - skb_headlen(skb);
		skb->len = first_len;
651 652
		ipv6_hdr(skb)->payload_len = htons(first_len -
						   sizeof(struct ipv6hdr));
653

654
		dst_hold(&rt->dst);
L
Linus Torvalds 已提交
655 656 657 658 659 660

		for (;;) {
			/* Prepare header of the next frame,
			 * before previous one went down. */
			if (frag) {
				frag->ip_summed = CHECKSUM_NONE;
661
				skb_reset_transport_header(frag);
662
				fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));
663 664
				__skb_push(frag, hlen);
				skb_reset_network_header(frag);
665 666
				memcpy(skb_network_header(frag), tmp_hdr,
				       hlen);
L
Linus Torvalds 已提交
667 668 669 670
				offset += skb->len - hlen - sizeof(struct frag_hdr);
				fh->nexthdr = nexthdr;
				fh->reserved = 0;
				fh->frag_off = htons(offset);
671
				if (frag->next)
L
Linus Torvalds 已提交
672 673
					fh->frag_off |= htons(IP6_MF);
				fh->identification = frag_id;
674 675 676
				ipv6_hdr(frag)->payload_len =
						htons(frag->len -
						      sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
677 678
				ip6_copy_metadata(frag, skb);
			}
679

680
			err = output(sk, skb);
681
			if (!err)
682
				IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
683
					      IPSTATS_MIB_FRAGCREATES);
684

L
Linus Torvalds 已提交
685 686 687 688 689 690 691 692
			if (err || !frag)
				break;

			skb = frag;
			frag = skb->next;
			skb->next = NULL;
		}

J
Jesper Juhl 已提交
693
		kfree(tmp_hdr);
L
Linus Torvalds 已提交
694 695

		if (err == 0) {
696
			IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
697
				      IPSTATS_MIB_FRAGOKS);
A
Amerigo Wang 已提交
698
			ip6_rt_put(rt);
L
Linus Torvalds 已提交
699 700 701
			return 0;
		}

702
		kfree_skb_list(frag);
L
Linus Torvalds 已提交
703

704
		IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
705
			      IPSTATS_MIB_FRAGFAILS);
A
Amerigo Wang 已提交
706
		ip6_rt_put(rt);
L
Linus Torvalds 已提交
707
		return err;
708 709 710 711 712 713 714 715 716

slow_path_clean:
		skb_walk_frags(skb, frag2) {
			if (frag2 == frag)
				break;
			frag2->sk = NULL;
			frag2->destructor = NULL;
			skb->truesize += frag2->truesize;
		}
L
Linus Torvalds 已提交
717 718 719
	}

slow_path:
720 721 722 723
	if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
	    skb_checksum_help(skb))
		goto fail;

L
Linus Torvalds 已提交
724 725 726 727 728 729 730 731
	left = skb->len - hlen;		/* Space per frame */
	ptr = hlen;			/* Where to start from */

	/*
	 *	Fragment the datagram.
	 */

	*prevhdr = NEXTHDR_FRAGMENT;
732
	troom = rt->dst.dev->needed_tailroom;
L
Linus Torvalds 已提交
733 734 735 736

	/*
	 *	Keep copying data until we run out.
	 */
737
	while (left > 0)	{
L
Linus Torvalds 已提交
738 739 740 741
		len = left;
		/* IF: it doesn't fit, use 'mtu' - the data space left */
		if (len > mtu)
			len = mtu;
L
Lucas De Marchi 已提交
742
		/* IF: we are not sending up to and including the packet end
L
Linus Torvalds 已提交
743 744 745 746 747
		   then align the next start on an eight byte boundary */
		if (len < left)	{
			len &= ~7;
		}

748 749 750 751
		/* Allocate buffer */
		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
				 hroom + troom, GFP_ATOMIC);
		if (!frag) {
E
Eric Dumazet 已提交
752
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
753
				      IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
754 755 756 757 758 759 760 761 762
			err = -ENOMEM;
			goto fail;
		}

		/*
		 *	Set up data on packet
		 */

		ip6_copy_metadata(frag, skb);
763
		skb_reserve(frag, hroom);
L
Linus Torvalds 已提交
764
		skb_put(frag, len + hlen + sizeof(struct frag_hdr));
765
		skb_reset_network_header(frag);
766
		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
767 768
		frag->transport_header = (frag->network_header + hlen +
					  sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
769 770 771 772 773 774 775 776 777 778 779

		/*
		 *	Charge the memory for the fragment to any owner
		 *	it might possess
		 */
		if (skb->sk)
			skb_set_owner_w(frag, skb->sk);

		/*
		 *	Copy the packet header into the new buffer.
		 */
780
		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
L
Linus Torvalds 已提交
781 782 783 784 785 786

		/*
		 *	Build fragment header.
		 */
		fh->nexthdr = nexthdr;
		fh->reserved = 0;
787
		fh->identification = frag_id;
L
Linus Torvalds 已提交
788 789 790 791

		/*
		 *	Copy a block of the IP datagram.
		 */
H
Himangi Saraogi 已提交
792 793
		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),
				     len));
L
Linus Torvalds 已提交
794 795 796 797 798
		left -= len;

		fh->frag_off = htons(offset);
		if (left > 0)
			fh->frag_off |= htons(IP6_MF);
799 800
		ipv6_hdr(frag)->payload_len = htons(frag->len -
						    sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
801 802 803 804 805 806 807

		ptr += len;
		offset += len;

		/*
		 *	Put this fragment into the sending queue.
		 */
808
		err = output(sk, frag);
L
Linus Torvalds 已提交
809 810
		if (err)
			goto fail;
811

E
Eric Dumazet 已提交
812
		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
813
			      IPSTATS_MIB_FRAGCREATES);
L
Linus Torvalds 已提交
814
	}
E
Eric Dumazet 已提交
815
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
816
		      IPSTATS_MIB_FRAGOKS);
817
	consume_skb(skb);
L
Linus Torvalds 已提交
818 819
	return err;

820 821 822 823 824 825 826 827
fail_toobig:
	if (skb->sk && dst_allfrag(skb_dst(skb)))
		sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);

	skb->dev = skb_dst(skb)->dev;
	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
	err = -EMSGSIZE;

L
Linus Torvalds 已提交
828
fail:
E
Eric Dumazet 已提交
829
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
830
		      IPSTATS_MIB_FRAGFAILS);
831
	kfree_skb(skb);
L
Linus Torvalds 已提交
832 833 834
	return err;
}

835 836 837
static inline int ip6_rt_check(const struct rt6key *rt_key,
			       const struct in6_addr *fl_addr,
			       const struct in6_addr *addr_cache)
838
{
E
Eric Dumazet 已提交
839
	return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
840
		(!addr_cache || !ipv6_addr_equal(fl_addr, addr_cache));
841 842
}

843 844
static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
					  struct dst_entry *dst,
845
					  const struct flowi6 *fl6)
L
Linus Torvalds 已提交
846
{
847
	struct ipv6_pinfo *np = inet6_sk(sk);
848
	struct rt6_info *rt;
L
Linus Torvalds 已提交
849

850 851 852
	if (!dst)
		goto out;

853 854 855 856 857 858
	if (dst->ops->family != AF_INET6) {
		dst_release(dst);
		return NULL;
	}

	rt = (struct rt6_info *)dst;
859 860 861
	/* Yes, checking route validity in not connected
	 * case is not very simple. Take into account,
	 * that we do not support routing by source, TOS,
862
	 * and MSG_DONTROUTE		--ANK (980726)
863
	 *
864 865
	 * 1. ip6_rt_check(): If route was host route,
	 *    check that cached destination is current.
866 867 868 869 870 871 872 873 874 875
	 *    If it is network route, we still may
	 *    check its validity using saved pointer
	 *    to the last used address: daddr_cache.
	 *    We do not want to save whole address now,
	 *    (because main consumer of this service
	 *    is tcp, which has not this problem),
	 *    so that the last trick works only on connected
	 *    sockets.
	 * 2. oif also should be the same.
	 */
876
	if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
877
#ifdef CONFIG_IPV6_SUBTREES
878
	    ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
879
#endif
880 881
	   (!(fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF) &&
	      (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex))) {
882 883
		dst_release(dst);
		dst = NULL;
L
Linus Torvalds 已提交
884 885
	}

886 887 888 889
out:
	return dst;
}

890
static int ip6_dst_lookup_tail(struct net *net, struct sock *sk,
891
			       struct dst_entry **dst, struct flowi6 *fl6)
892
{
893 894
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
	struct neighbour *n;
895
	struct rt6_info *rt;
896 897
#endif
	int err;
898

899 900 901 902 903 904 905 906 907 908 909 910
	/* The correct way to handle this would be to do
	 * ip6_route_get_saddr, and then ip6_route_output; however,
	 * the route-specific preferred source forces the
	 * ip6_route_output call _before_ ip6_route_get_saddr.
	 *
	 * In source specific routing (no src=any default route),
	 * ip6_route_output will fail given src=any saddr, though, so
	 * that's why we try it again later.
	 */
	if (ipv6_addr_any(&fl6->saddr) && (!*dst || !(*dst)->error)) {
		struct rt6_info *rt;
		bool had_dst = *dst != NULL;
L
Linus Torvalds 已提交
911

912 913 914
		if (!had_dst)
			*dst = ip6_route_output(net, sk, fl6);
		rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
915 916 917
		err = ip6_route_get_saddr(net, rt, &fl6->daddr,
					  sk ? inet6_sk(sk)->srcprefs : 0,
					  &fl6->saddr);
918
		if (err)
L
Linus Torvalds 已提交
919
			goto out_err_release;
920 921 922 923 924 925 926 927 928

		/* If we had an erroneous initial result, pretend it
		 * never existed and let the SA-enabled version take
		 * over.
		 */
		if (!had_dst && (*dst)->error) {
			dst_release(*dst);
			*dst = NULL;
		}
L
Linus Torvalds 已提交
929 930
	}

931 932 933 934 935 936 937
	if (!*dst)
		*dst = ip6_route_output(net, sk, fl6);

	err = (*dst)->error;
	if (err)
		goto out_err_release;

938
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
939 940 941 942 943 944 945 946
	/*
	 * Here if the dst entry we've looked up
	 * has a neighbour entry that is in the INCOMPLETE
	 * state and the src address from the flow is
	 * marked as OPTIMISTIC, we release the found
	 * dst entry and replace it instead with the
	 * dst entry of the nexthop router
	 */
947
	rt = (struct rt6_info *) *dst;
948
	rcu_read_lock_bh();
949 950
	n = __ipv6_neigh_lookup_noref(rt->dst.dev,
				      rt6_nexthop(rt, &fl6->daddr));
951 952 953 954
	err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
	rcu_read_unlock_bh();

	if (err) {
955
		struct inet6_ifaddr *ifp;
956
		struct flowi6 fl_gw6;
957 958
		int redirect;

959
		ifp = ipv6_get_ifaddr(net, &fl6->saddr,
960 961 962 963 964 965 966 967 968 969 970 971
				      (*dst)->dev, 1);

		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
		if (ifp)
			in6_ifa_put(ifp);

		if (redirect) {
			/*
			 * We need to get the dst entry for the
			 * default router instead
			 */
			dst_release(*dst);
972 973 974
			memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
			memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
			*dst = ip6_route_output(net, sk, &fl_gw6);
975 976
			err = (*dst)->error;
			if (err)
977
				goto out_err_release;
978
		}
979
	}
980 981
#endif

L
Linus Torvalds 已提交
982 983 984
	return 0;

out_err_release:
985
	if (err == -ENETUNREACH)
986
		IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
987 988 989 990
	dst_release(*dst);
	*dst = NULL;
	return err;
}
A
Adrian Bunk 已提交
991

992 993 994 995
/**
 *	ip6_dst_lookup - perform route lookup on flow
 *	@sk: socket which provides route info
 *	@dst: pointer to dst_entry * for result
996
 *	@fl6: flow to lookup
997 998 999 1000 1001
 *
 *	This function performs a route lookup on the given flow.
 *
 *	It returns zero on success, or a standard errno code on error.
 */
1002 1003
int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
		   struct flowi6 *fl6)
1004 1005
{
	*dst = NULL;
1006
	return ip6_dst_lookup_tail(net, sk, dst, fl6);
1007
}
1008 1009
EXPORT_SYMBOL_GPL(ip6_dst_lookup);

1010
/**
1011 1012
 *	ip6_dst_lookup_flow - perform route lookup on flow with ipsec
 *	@sk: socket which provides route info
1013
 *	@fl6: flow to lookup
1014 1015 1016 1017 1018 1019 1020
 *	@final_dst: final destination address for ipsec lookup
 *
 *	This function performs a route lookup on the given flow.
 *
 *	It returns a valid dst pointer on success, or a pointer encoded
 *	error code.
 */
1021
struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1022
				      const struct in6_addr *final_dst)
1023 1024 1025 1026
{
	struct dst_entry *dst = NULL;
	int err;

1027
	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1028 1029 1030
	if (err)
		return ERR_PTR(err);
	if (final_dst)
A
Alexey Dobriyan 已提交
1031
		fl6->daddr = *final_dst;
1032 1033
	if (!fl6->flowi6_oif)
		fl6->flowi6_oif = dst->dev->ifindex;
1034

1035
	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1036 1037 1038 1039 1040
}
EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);

/**
 *	ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1041
 *	@sk: socket which provides the dst cache and route info
1042
 *	@fl6: flow to lookup
1043
 *	@final_dst: final destination address for ipsec lookup
1044 1045 1046 1047 1048 1049
 *
 *	This function performs a route lookup on the given flow with the
 *	possibility of using the cached route in the socket if it is valid.
 *	It will take the socket dst lock when operating on the dst cache.
 *	As a result, this function can only be used in process context.
 *
1050 1051
 *	It returns a valid dst pointer on success, or a pointer encoded
 *	error code.
1052
 */
1053
struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1054
					 const struct in6_addr *final_dst)
1055
{
1056 1057
	struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
	int err;
1058

1059
	dst = ip6_sk_dst_check(sk, dst, fl6);
1060

1061
	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1062 1063 1064
	if (err)
		return ERR_PTR(err);
	if (final_dst)
A
Alexey Dobriyan 已提交
1065
		fl6->daddr = *final_dst;
1066

1067
	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1068
}
1069
EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1070

A
Adrian Bunk 已提交
1071
static inline int ip6_ufo_append_data(struct sock *sk,
1072
			struct sk_buff_head *queue,
1073 1074 1075
			int getfrag(void *from, char *to, int offset, int len,
			int odd, struct sk_buff *skb),
			void *from, int length, int hh_len, int fragheaderlen,
1076
			int transhdrlen, int mtu, unsigned int flags,
1077
			const struct flowi6 *fl6)
1078 1079 1080 1081 1082 1083 1084 1085 1086

{
	struct sk_buff *skb;
	int err;

	/* There is support for UDP large send offload by network
	 * device, so create one single skb packet containing complete
	 * udp datagram
	 */
1087
	skb = skb_peek_tail(queue);
1088
	if (!skb) {
1089 1090 1091
		skb = sock_alloc_send_skb(sk,
			hh_len + fragheaderlen + transhdrlen + 20,
			(flags & MSG_DONTWAIT), &err);
1092
		if (!skb)
1093
			return err;
1094 1095 1096 1097 1098

		/* reserve space for Hardware header */
		skb_reserve(skb, hh_len);

		/* create space for UDP/IP header */
1099
		skb_put(skb, fragheaderlen + transhdrlen);
1100 1101

		/* initialize network header pointer */
1102
		skb_reset_network_header(skb);
1103 1104

		/* initialize protocol header pointer */
1105
		skb->transport_header = skb->network_header + fragheaderlen;
1106

1107
		skb->protocol = htons(ETH_P_IPV6);
1108 1109
		skb->csum = 0;

1110
		__skb_queue_tail(queue, skb);
1111 1112
	} else if (skb_is_gso(skb)) {
		goto append;
1113 1114
	}

1115 1116 1117 1118 1119 1120 1121
	skb->ip_summed = CHECKSUM_PARTIAL;
	/* Specify the length of each IPv6 datagram fragment.
	 * It has to be a multiple of 8.
	 */
	skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
				     sizeof(struct frag_hdr)) & ~7;
	skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1122 1123 1124
	skb_shinfo(skb)->ip6_frag_id = ipv6_select_ident(sock_net(sk),
							 &fl6->daddr,
							 &fl6->saddr);
1125 1126

append:
1127 1128
	return skb_append_datato_frags(sk, skb, getfrag, from,
				       (length - transhdrlen));
1129
}
L
Linus Torvalds 已提交
1130

1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142
static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
					       gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
						gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

1143
static void ip6_append_data_mtu(unsigned int *mtu,
G
Gao feng 已提交
1144 1145 1146
				int *maxfraglen,
				unsigned int fragheaderlen,
				struct sk_buff *skb,
1147
				struct rt6_info *rt,
1148
				unsigned int orig_mtu)
G
Gao feng 已提交
1149 1150
{
	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1151
		if (!skb) {
G
Gao feng 已提交
1152
			/* first fragment, reserve header_len */
1153
			*mtu = orig_mtu - rt->dst.header_len;
G
Gao feng 已提交
1154 1155 1156 1157 1158 1159

		} else {
			/*
			 * this fragment is not first, the headers
			 * space is regarded as data space.
			 */
1160
			*mtu = orig_mtu;
G
Gao feng 已提交
1161 1162 1163 1164 1165 1166
		}
		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
			      + fragheaderlen - sizeof(struct frag_hdr);
	}
}

1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182
static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
			  struct inet6_cork *v6_cork,
			  int hlimit, int tclass, struct ipv6_txoptions *opt,
			  struct rt6_info *rt, struct flowi6 *fl6)
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	unsigned int mtu;

	/*
	 * setup for corking
	 */
	if (opt) {
		if (WARN_ON(v6_cork->opt))
			return -EINVAL;

		v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation);
1183
		if (unlikely(!v6_cork->opt))
1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234
			return -ENOBUFS;

		v6_cork->opt->tot_len = opt->tot_len;
		v6_cork->opt->opt_flen = opt->opt_flen;
		v6_cork->opt->opt_nflen = opt->opt_nflen;

		v6_cork->opt->dst0opt = ip6_opt_dup(opt->dst0opt,
						    sk->sk_allocation);
		if (opt->dst0opt && !v6_cork->opt->dst0opt)
			return -ENOBUFS;

		v6_cork->opt->dst1opt = ip6_opt_dup(opt->dst1opt,
						    sk->sk_allocation);
		if (opt->dst1opt && !v6_cork->opt->dst1opt)
			return -ENOBUFS;

		v6_cork->opt->hopopt = ip6_opt_dup(opt->hopopt,
						   sk->sk_allocation);
		if (opt->hopopt && !v6_cork->opt->hopopt)
			return -ENOBUFS;

		v6_cork->opt->srcrt = ip6_rthdr_dup(opt->srcrt,
						    sk->sk_allocation);
		if (opt->srcrt && !v6_cork->opt->srcrt)
			return -ENOBUFS;

		/* need source address above miyazawa*/
	}
	dst_hold(&rt->dst);
	cork->base.dst = &rt->dst;
	cork->fl.u.ip6 = *fl6;
	v6_cork->hop_limit = hlimit;
	v6_cork->tclass = tclass;
	if (rt->dst.flags & DST_XFRM_TUNNEL)
		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
		      rt->dst.dev->mtu : dst_mtu(&rt->dst);
	else
		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
		      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
	if (np->frag_size < mtu) {
		if (np->frag_size)
			mtu = np->frag_size;
	}
	cork->base.fragsize = mtu;
	if (dst_allfrag(rt->dst.path))
		cork->base.flags |= IPCORK_ALLFRAG;
	cork->base.length = 0;

	return 0;
}

1235 1236 1237 1238 1239 1240 1241 1242 1243 1244
static int __ip6_append_data(struct sock *sk,
			     struct flowi6 *fl6,
			     struct sk_buff_head *queue,
			     struct inet_cork *cork,
			     struct inet6_cork *v6_cork,
			     struct page_frag *pfrag,
			     int getfrag(void *from, char *to, int offset,
					 int len, int odd, struct sk_buff *skb),
			     void *from, int length, int transhdrlen,
			     unsigned int flags, int dontfrag)
L
Linus Torvalds 已提交
1245
{
G
Gao feng 已提交
1246
	struct sk_buff *skb, *skb_prev = NULL;
1247
	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1248 1249
	int exthdrlen = 0;
	int dst_exthdrlen = 0;
L
Linus Torvalds 已提交
1250 1251 1252 1253
	int hh_len;
	int copy;
	int err;
	int offset = 0;
1254
	__u8 tx_flags = 0;
1255
	u32 tskey = 0;
1256 1257
	struct rt6_info *rt = (struct rt6_info *)cork->dst;
	struct ipv6_txoptions *opt = v6_cork->opt;
1258
	int csummode = CHECKSUM_NONE;
L
Linus Torvalds 已提交
1259

1260 1261 1262
	skb = skb_peek_tail(queue);
	if (!skb) {
		exthdrlen = opt ? opt->opt_flen : 0;
1263
		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
L
Linus Torvalds 已提交
1264
	}
1265

1266
	mtu = cork->fragsize;
1267
	orig_mtu = mtu;
L
Linus Torvalds 已提交
1268

1269
	hh_len = LL_RESERVED_SPACE(rt->dst.dev);
L
Linus Torvalds 已提交
1270

1271
	fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1272
			(opt ? opt->opt_nflen : 0);
1273 1274
	maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
		     sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
1275 1276

	if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1277 1278 1279
		unsigned int maxnonfragsize, headersize;

		headersize = sizeof(struct ipv6hdr) +
1280
			     (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1281 1282 1283 1284
			     (dst_allfrag(&rt->dst) ?
			      sizeof(struct frag_hdr) : 0) +
			     rt->rt6i_nfheader_len;

W
WANG Cong 已提交
1285
		if (ip6_sk_ignore_df(sk))
1286 1287 1288
			maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
		else
			maxnonfragsize = mtu;
1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303

		/* dontfrag active */
		if ((cork->length + length > mtu - headersize) && dontfrag &&
		    (sk->sk_protocol == IPPROTO_UDP ||
		     sk->sk_protocol == IPPROTO_RAW)) {
			ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
						   sizeof(struct ipv6hdr));
			goto emsgsize;
		}

		if (cork->length + length > maxnonfragsize - headersize) {
emsgsize:
			ipv6_local_error(sk, EMSGSIZE, fl6,
					 mtu - headersize +
					 sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
1304 1305 1306 1307
			return -EMSGSIZE;
		}
	}

1308
	if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_RAW) {
1309
		sock_tx_timestamp(sk, &tx_flags);
1310 1311 1312 1313
		if (tx_flags & SKBTX_ANY_SW_TSTAMP &&
		    sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
			tskey = sk->sk_tskey++;
	}
1314

1315 1316
	/* If this is the first and only packet and device
	 * supports checksum offloading, let's use it.
1317 1318
	 * Use transhdrlen, same as IPv4, because partial
	 * sums only work when transhdrlen is set.
1319
	 */
1320
	if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
1321 1322 1323 1324
	    length + fragheaderlen < mtu &&
	    rt->dst.dev->features & NETIF_F_V6_CSUM &&
	    !exthdrlen)
		csummode = CHECKSUM_PARTIAL;
L
Linus Torvalds 已提交
1325 1326 1327 1328 1329 1330 1331
	/*
	 * Let's try using as much space as possible.
	 * Use MTU if total length of the message fits into the MTU.
	 * Otherwise, we need to reserve fragment header and
	 * fragment alignment (= 8-15 octects, in total).
	 *
	 * Note that we may need to "move" the data from the tail of
1332
	 * of the buffer to the new fragment when we split
L
Linus Torvalds 已提交
1333 1334
	 * the message.
	 *
1335
	 * FIXME: It may be fragmented into multiple chunks
L
Linus Torvalds 已提交
1336 1337
	 *        at once if non-fragmentable extension headers
	 *        are too large.
1338
	 * --yoshfuji
L
Linus Torvalds 已提交
1339 1340
	 */

1341 1342 1343 1344
	cork->length += length;
	if (((length > mtu) ||
	     (skb && skb_is_gso(skb))) &&
	    (sk->sk_protocol == IPPROTO_UDP) &&
1345 1346
	    (rt->dst.dev->features & NETIF_F_UFO) &&
	    (sk->sk_type == SOCK_DGRAM)) {
1347
		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
1348
					  hh_len, fragheaderlen,
1349
					  transhdrlen, mtu, flags, fl6);
1350 1351 1352
		if (err)
			goto error;
		return 0;
1353
	}
L
Linus Torvalds 已提交
1354

1355
	if (!skb)
L
Linus Torvalds 已提交
1356 1357 1358 1359
		goto alloc_new_skb;

	while (length > 0) {
		/* Check if the remaining data fits into current packet. */
1360
		copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
L
Linus Torvalds 已提交
1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371
		if (copy < length)
			copy = maxfraglen - skb->len;

		if (copy <= 0) {
			char *data;
			unsigned int datalen;
			unsigned int fraglen;
			unsigned int fraggap;
			unsigned int alloclen;
alloc_new_skb:
			/* There's no room in the current skb */
G
Gao feng 已提交
1372 1373
			if (skb)
				fraggap = skb->len - maxfraglen;
L
Linus Torvalds 已提交
1374 1375
			else
				fraggap = 0;
G
Gao feng 已提交
1376
			/* update mtu and maxfraglen if necessary */
1377
			if (!skb || !skb_prev)
G
Gao feng 已提交
1378
				ip6_append_data_mtu(&mtu, &maxfraglen,
1379
						    fragheaderlen, skb, rt,
1380
						    orig_mtu);
G
Gao feng 已提交
1381 1382

			skb_prev = skb;
L
Linus Torvalds 已提交
1383 1384 1385 1386 1387 1388 1389

			/*
			 * If remaining data exceeds the mtu,
			 * we know we need more fragment(s).
			 */
			datalen = length + fraggap;

G
Gao feng 已提交
1390 1391
			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
L
Linus Torvalds 已提交
1392
			if ((flags & MSG_MORE) &&
1393
			    !(rt->dst.dev->features&NETIF_F_SG))
L
Linus Torvalds 已提交
1394 1395 1396 1397
				alloclen = mtu;
			else
				alloclen = datalen + fragheaderlen;

1398 1399
			alloclen += dst_exthdrlen;

G
Gao feng 已提交
1400 1401 1402 1403 1404 1405 1406 1407 1408 1409
			if (datalen != length + fraggap) {
				/*
				 * this is not the last fragment, the trailer
				 * space is regarded as data space.
				 */
				datalen += rt->dst.trailer_len;
			}

			alloclen += rt->dst.trailer_len;
			fraglen = datalen + fragheaderlen;
L
Linus Torvalds 已提交
1410 1411 1412

			/*
			 * We just reserve space for fragment header.
1413
			 * Note: this may be overallocation if the message
L
Linus Torvalds 已提交
1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428
			 * (without MSG_MORE) fits into the MTU.
			 */
			alloclen += sizeof(struct frag_hdr);

			if (transhdrlen) {
				skb = sock_alloc_send_skb(sk,
						alloclen + hh_len,
						(flags & MSG_DONTWAIT), &err);
			} else {
				skb = NULL;
				if (atomic_read(&sk->sk_wmem_alloc) <=
				    2 * sk->sk_sndbuf)
					skb = sock_wmalloc(sk,
							   alloclen + hh_len, 1,
							   sk->sk_allocation);
1429
				if (unlikely(!skb))
L
Linus Torvalds 已提交
1430 1431
					err = -ENOBUFS;
			}
1432
			if (!skb)
L
Linus Torvalds 已提交
1433 1434 1435 1436
				goto error;
			/*
			 *	Fill in the control structures
			 */
1437
			skb->protocol = htons(ETH_P_IPV6);
1438
			skb->ip_summed = csummode;
L
Linus Torvalds 已提交
1439
			skb->csum = 0;
1440 1441 1442
			/* reserve for fragmentation and ipsec header */
			skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
				    dst_exthdrlen);
L
Linus Torvalds 已提交
1443

1444 1445 1446
			/* Only the initial fragment is time stamped */
			skb_shinfo(skb)->tx_flags = tx_flags;
			tx_flags = 0;
1447 1448
			skb_shinfo(skb)->tskey = tskey;
			tskey = 0;
1449

L
Linus Torvalds 已提交
1450 1451 1452
			/*
			 *	Find where to start putting bytes
			 */
1453 1454 1455
			data = skb_put(skb, fraglen);
			skb_set_network_header(skb, exthdrlen);
			data += fragheaderlen;
1456 1457
			skb->transport_header = (skb->network_header +
						 fragheaderlen);
L
Linus Torvalds 已提交
1458 1459 1460 1461 1462 1463 1464
			if (fraggap) {
				skb->csum = skb_copy_and_csum_bits(
					skb_prev, maxfraglen,
					data + transhdrlen, fraggap, 0);
				skb_prev->csum = csum_sub(skb_prev->csum,
							  skb->csum);
				data += fraggap;
1465
				pskb_trim_unique(skb_prev, maxfraglen);
L
Linus Torvalds 已提交
1466 1467
			}
			copy = datalen - transhdrlen - fraggap;
1468

L
Linus Torvalds 已提交
1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482
			if (copy < 0) {
				err = -EINVAL;
				kfree_skb(skb);
				goto error;
			} else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
				err = -EFAULT;
				kfree_skb(skb);
				goto error;
			}

			offset += copy;
			length -= datalen - fraggap;
			transhdrlen = 0;
			exthdrlen = 0;
1483
			dst_exthdrlen = 0;
L
Linus Torvalds 已提交
1484 1485 1486 1487

			/*
			 * Put the packet on the pending queue
			 */
1488
			__skb_queue_tail(queue, skb);
L
Linus Torvalds 已提交
1489 1490 1491 1492 1493 1494
			continue;
		}

		if (copy > length)
			copy = length;

1495
		if (!(rt->dst.dev->features&NETIF_F_SG)) {
L
Linus Torvalds 已提交
1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507
			unsigned int off;

			off = skb->len;
			if (getfrag(from, skb_put(skb, copy),
						offset, copy, off, skb) < 0) {
				__skb_trim(skb, off);
				err = -EFAULT;
				goto error;
			}
		} else {
			int i = skb_shinfo(skb)->nr_frags;

1508 1509
			err = -ENOMEM;
			if (!sk_page_frag_refill(sk, pfrag))
L
Linus Torvalds 已提交
1510
				goto error;
1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521

			if (!skb_can_coalesce(skb, i, pfrag->page,
					      pfrag->offset)) {
				err = -EMSGSIZE;
				if (i == MAX_SKB_FRAGS)
					goto error;

				__skb_fill_page_desc(skb, i, pfrag->page,
						     pfrag->offset, 0);
				skb_shinfo(skb)->nr_frags = ++i;
				get_page(pfrag->page);
L
Linus Torvalds 已提交
1522
			}
1523
			copy = min_t(int, copy, pfrag->size - pfrag->offset);
E
Eric Dumazet 已提交
1524
			if (getfrag(from,
1525 1526 1527 1528 1529 1530
				    page_address(pfrag->page) + pfrag->offset,
				    offset, copy, skb->len, skb) < 0)
				goto error_efault;

			pfrag->offset += copy;
			skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
L
Linus Torvalds 已提交
1531 1532
			skb->len += copy;
			skb->data_len += copy;
1533 1534
			skb->truesize += copy;
			atomic_add(copy, &sk->sk_wmem_alloc);
L
Linus Torvalds 已提交
1535 1536 1537 1538
		}
		offset += copy;
		length -= copy;
	}
1539

L
Linus Torvalds 已提交
1540
	return 0;
1541 1542 1543

error_efault:
	err = -EFAULT;
L
Linus Torvalds 已提交
1544
error:
1545
	cork->length -= length;
1546
	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1547 1548
	return err;
}
1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584

int ip6_append_data(struct sock *sk,
		    int getfrag(void *from, char *to, int offset, int len,
				int odd, struct sk_buff *skb),
		    void *from, int length, int transhdrlen, int hlimit,
		    int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
		    struct rt6_info *rt, unsigned int flags, int dontfrag)
{
	struct inet_sock *inet = inet_sk(sk);
	struct ipv6_pinfo *np = inet6_sk(sk);
	int exthdrlen;
	int err;

	if (flags&MSG_PROBE)
		return 0;
	if (skb_queue_empty(&sk->sk_write_queue)) {
		/*
		 * setup for corking
		 */
		err = ip6_setup_cork(sk, &inet->cork, &np->cork, hlimit,
				     tclass, opt, rt, fl6);
		if (err)
			return err;

		exthdrlen = (opt ? opt->opt_flen : 0);
		length += exthdrlen;
		transhdrlen += exthdrlen;
	} else {
		fl6 = &inet->cork.fl.u.ip6;
		transhdrlen = 0;
	}

	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
				 &np->cork, sk_page_frag(sk), getfrag,
				 from, length, transhdrlen, flags, dontfrag);
}
1585
EXPORT_SYMBOL_GPL(ip6_append_data);
L
Linus Torvalds 已提交
1586

1587 1588
static void ip6_cork_release(struct inet_cork_full *cork,
			     struct inet6_cork *v6_cork)
1589
{
1590 1591 1592 1593 1594 1595 1596
	if (v6_cork->opt) {
		kfree(v6_cork->opt->dst0opt);
		kfree(v6_cork->opt->dst1opt);
		kfree(v6_cork->opt->hopopt);
		kfree(v6_cork->opt->srcrt);
		kfree(v6_cork->opt);
		v6_cork->opt = NULL;
1597 1598
	}

1599 1600 1601 1602
	if (cork->base.dst) {
		dst_release(cork->base.dst);
		cork->base.dst = NULL;
		cork->base.flags &= ~IPCORK_ALLFRAG;
1603
	}
1604
	memset(&cork->fl, 0, sizeof(cork->fl));
1605 1606
}

V
Vlad Yasevich 已提交
1607 1608 1609 1610
struct sk_buff *__ip6_make_skb(struct sock *sk,
			       struct sk_buff_head *queue,
			       struct inet_cork_full *cork,
			       struct inet6_cork *v6_cork)
L
Linus Torvalds 已提交
1611 1612 1613 1614 1615
{
	struct sk_buff *skb, *tmp_skb;
	struct sk_buff **tail_skb;
	struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
	struct ipv6_pinfo *np = inet6_sk(sk);
1616
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
1617
	struct ipv6hdr *hdr;
V
Vlad Yasevich 已提交
1618 1619 1620
	struct ipv6_txoptions *opt = v6_cork->opt;
	struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
	struct flowi6 *fl6 = &cork->fl.u.ip6;
1621
	unsigned char proto = fl6->flowi6_proto;
L
Linus Torvalds 已提交
1622

V
Vlad Yasevich 已提交
1623
	skb = __skb_dequeue(queue);
1624
	if (!skb)
L
Linus Torvalds 已提交
1625 1626 1627 1628
		goto out;
	tail_skb = &(skb_shinfo(skb)->frag_list);

	/* move skb->data to ip header from ext header */
1629
	if (skb->data < skb_network_header(skb))
1630
		__skb_pull(skb, skb_network_offset(skb));
V
Vlad Yasevich 已提交
1631
	while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
1632
		__skb_pull(tmp_skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1633 1634 1635 1636 1637 1638 1639 1640 1641
		*tail_skb = tmp_skb;
		tail_skb = &(tmp_skb->next);
		skb->len += tmp_skb->len;
		skb->data_len += tmp_skb->len;
		skb->truesize += tmp_skb->truesize;
		tmp_skb->destructor = NULL;
		tmp_skb->sk = NULL;
	}

1642
	/* Allow local fragmentation. */
W
WANG Cong 已提交
1643
	skb->ignore_df = ip6_sk_ignore_df(sk);
1644

A
Alexey Dobriyan 已提交
1645
	*final_dst = fl6->daddr;
1646
	__skb_pull(skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1647 1648 1649 1650 1651
	if (opt && opt->opt_flen)
		ipv6_push_frag_opts(skb, opt, &proto);
	if (opt && opt->opt_nflen)
		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);

1652 1653
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
1654
	hdr = ipv6_hdr(skb);
1655

V
Vlad Yasevich 已提交
1656
	ip6_flow_hdr(hdr, v6_cork->tclass,
1657
		     ip6_make_flowlabel(net, skb, fl6->flowlabel,
1658
					np->autoflowlabel, fl6));
V
Vlad Yasevich 已提交
1659
	hdr->hop_limit = v6_cork->hop_limit;
L
Linus Torvalds 已提交
1660
	hdr->nexthdr = proto;
A
Alexey Dobriyan 已提交
1661 1662
	hdr->saddr = fl6->saddr;
	hdr->daddr = *final_dst;
L
Linus Torvalds 已提交
1663

1664
	skb->priority = sk->sk_priority;
1665
	skb->mark = sk->sk_mark;
1666

1667
	skb_dst_set(skb, dst_clone(&rt->dst));
1668
	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1669
	if (proto == IPPROTO_ICMPV6) {
E
Eric Dumazet 已提交
1670
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1671

1672 1673
		ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1674 1675
	}

V
Vlad Yasevich 已提交
1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686
	ip6_cork_release(cork, v6_cork);
out:
	return skb;
}

int ip6_send_skb(struct sk_buff *skb)
{
	struct net *net = sock_net(skb->sk);
	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
	int err;

H
Herbert Xu 已提交
1687
	err = ip6_local_out(skb);
L
Linus Torvalds 已提交
1688 1689
	if (err) {
		if (err > 0)
E
Eric Dumazet 已提交
1690
			err = net_xmit_errno(err);
L
Linus Torvalds 已提交
1691
		if (err)
V
Vlad Yasevich 已提交
1692 1693
			IP6_INC_STATS(net, rt->rt6i_idev,
				      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1694 1695 1696
	}

	return err;
V
Vlad Yasevich 已提交
1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707
}

int ip6_push_pending_frames(struct sock *sk)
{
	struct sk_buff *skb;

	skb = ip6_finish_skb(sk);
	if (!skb)
		return 0;

	return ip6_send_skb(skb);
L
Linus Torvalds 已提交
1708
}
1709
EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
L
Linus Torvalds 已提交
1710

1711
static void __ip6_flush_pending_frames(struct sock *sk,
V
Vlad Yasevich 已提交
1712 1713 1714
				       struct sk_buff_head *queue,
				       struct inet_cork_full *cork,
				       struct inet6_cork *v6_cork)
L
Linus Torvalds 已提交
1715 1716 1717
{
	struct sk_buff *skb;

1718
	while ((skb = __skb_dequeue_tail(queue)) != NULL) {
E
Eric Dumazet 已提交
1719 1720
		if (skb_dst(skb))
			IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1721
				      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1722 1723 1724
		kfree_skb(skb);
	}

V
Vlad Yasevich 已提交
1725
	ip6_cork_release(cork, v6_cork);
L
Linus Torvalds 已提交
1726
}
1727 1728 1729

void ip6_flush_pending_frames(struct sock *sk)
{
V
Vlad Yasevich 已提交
1730 1731
	__ip6_flush_pending_frames(sk, &sk->sk_write_queue,
				   &inet_sk(sk)->cork, &inet6_sk(sk)->cork);
1732
}
1733
EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
V
Vlad Yasevich 已提交
1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776

struct sk_buff *ip6_make_skb(struct sock *sk,
			     int getfrag(void *from, char *to, int offset,
					 int len, int odd, struct sk_buff *skb),
			     void *from, int length, int transhdrlen,
			     int hlimit, int tclass,
			     struct ipv6_txoptions *opt, struct flowi6 *fl6,
			     struct rt6_info *rt, unsigned int flags,
			     int dontfrag)
{
	struct inet_cork_full cork;
	struct inet6_cork v6_cork;
	struct sk_buff_head queue;
	int exthdrlen = (opt ? opt->opt_flen : 0);
	int err;

	if (flags & MSG_PROBE)
		return NULL;

	__skb_queue_head_init(&queue);

	cork.base.flags = 0;
	cork.base.addr = 0;
	cork.base.opt = NULL;
	v6_cork.opt = NULL;
	err = ip6_setup_cork(sk, &cork, &v6_cork, hlimit, tclass, opt, rt, fl6);
	if (err)
		return ERR_PTR(err);

	if (dontfrag < 0)
		dontfrag = inet6_sk(sk)->dontfrag;

	err = __ip6_append_data(sk, fl6, &queue, &cork.base, &v6_cork,
				&current->task_frag, getfrag, from,
				length + exthdrlen, transhdrlen + exthdrlen,
				flags, dontfrag);
	if (err) {
		__ip6_flush_pending_frames(sk, &queue, &cork, &v6_cork);
		return ERR_PTR(err);
	}

	return __ip6_make_skb(sk, &queue, &cork, &v6_cork);
}