ip6_output.c 38.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 output functions
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29
 *
 *	Based on linux/net/ipv4/ip_output.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 *	Changes:
 *	A.N.Kuznetsov	:	airthmetics in fragmentation.
 *				extension headers are implemented.
 *				route changes now work.
 *				ip6_forward does not confuse sniffers.
 *				etc.
 *
 *      H. von Brand    :       Added missing #include <linux/string.h>
 *	Imran Patel	: 	frag id should be in NBO
 *      Kazunori MIYAZAWA @USAGI
 *			:       add ip6_append_data and related functions
 *				for datagram xmit
 */

#include <linux/errno.h>
H
Herbert Xu 已提交
30
#include <linux/kernel.h>
L
Linus Torvalds 已提交
31 32 33 34 35 36 37 38
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/net.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/in6.h>
#include <linux/tcp.h>
#include <linux/route.h>
39
#include <linux/module.h>
L
Linus Torvalds 已提交
40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55

#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
#include <net/ndisc.h>
#include <net/protocol.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/rawv6.h>
#include <net/icmp.h>
#include <net/xfrm.h>
#include <net/checksum.h>
56
#include <linux/mroute6.h>
L
Linus Torvalds 已提交
57 58 59

static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));

H
Herbert Xu 已提交
60 61 62 63 64 65 66 67 68
int __ip6_local_out(struct sk_buff *skb)
{
	int len;

	len = skb->len - sizeof(struct ipv6hdr);
	if (len > IPV6_MAXPLEN)
		len = 0;
	ipv6_hdr(skb)->payload_len = htons(len);

E
Eric Dumazet 已提交
69
	return nf_hook(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb_dst(skb)->dev,
H
Herbert Xu 已提交
70 71 72 73 74 75 76 77 78 79 80 81 82 83 84
		       dst_output);
}

int ip6_local_out(struct sk_buff *skb)
{
	int err;

	err = __ip6_local_out(skb);
	if (likely(err == 1))
		err = dst_output(skb);

	return err;
}
EXPORT_SYMBOL_GPL(ip6_local_out);

P
Patrick McHardy 已提交
85
static int ip6_output_finish(struct sk_buff *skb)
L
Linus Torvalds 已提交
86
{
E
Eric Dumazet 已提交
87
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
88

89 90 91
	if (dst->hh)
		return neigh_hh_output(dst->hh, skb);
	else if (dst->neighbour)
L
Linus Torvalds 已提交
92 93
		return dst->neighbour->output(skb);

94 95
	IP6_INC_STATS_BH(dev_net(dst->dev),
			 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
96 97 98 99 100 101 102 103
	kfree_skb(skb);
	return -EINVAL;

}

/* dev_loopback_xmit for use with netfilter. */
static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
{
104
	skb_reset_mac_header(newskb);
105
	__skb_pull(newskb, skb_network_offset(newskb));
L
Linus Torvalds 已提交
106 107
	newskb->pkt_type = PACKET_LOOPBACK;
	newskb->ip_summed = CHECKSUM_UNNECESSARY;
E
Eric Dumazet 已提交
108
	WARN_ON(!skb_dst(newskb));
L
Linus Torvalds 已提交
109 110 111 112 113 114 115 116

	netif_rx(newskb);
	return 0;
}


static int ip6_output2(struct sk_buff *skb)
{
E
Eric Dumazet 已提交
117
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
118 119 120 121 122
	struct net_device *dev = dst->dev;

	skb->protocol = htons(ETH_P_IPV6);
	skb->dev = dev;

123
	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
E
Eric Dumazet 已提交
124
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
L
Linus Torvalds 已提交
125

126
		if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
127 128
		    ((mroute6_socket(dev_net(dev)) &&
		     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
129 130
		     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
					 &ipv6_hdr(skb)->saddr))) {
L
Linus Torvalds 已提交
131 132 133 134 135 136
			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);

			/* Do not check for IFF_ALLMULTI; multicast routing
			   is not supported in any case.
			 */
			if (newskb)
137 138
				NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, newskb,
					NULL, newskb->dev,
L
Linus Torvalds 已提交
139 140
					ip6_dev_loopback_xmit);

141
			if (ipv6_hdr(skb)->hop_limit == 0) {
142 143
				IP6_INC_STATS(dev_net(dev), idev,
					      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
144 145 146 147 148
				kfree_skb(skb);
				return 0;
			}
		}

149 150
		IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
				skb->len);
L
Linus Torvalds 已提交
151 152
	}

153 154
	return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
		       ip6_output_finish);
L
Linus Torvalds 已提交
155 156
}

J
John Heffner 已提交
157 158 159 160 161
static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
{
	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;

	return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
E
Eric Dumazet 已提交
162
	       skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
J
John Heffner 已提交
163 164
}

L
Linus Torvalds 已提交
165 166
int ip6_output(struct sk_buff *skb)
{
E
Eric Dumazet 已提交
167
	struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
168
	if (unlikely(idev->cnf.disable_ipv6)) {
E
Eric Dumazet 已提交
169
		IP6_INC_STATS(dev_net(skb_dst(skb)->dev), idev,
170
			      IPSTATS_MIB_OUTDISCARDS);
171 172 173 174
		kfree_skb(skb);
		return 0;
	}

J
John Heffner 已提交
175
	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
E
Eric Dumazet 已提交
176
				dst_allfrag(skb_dst(skb)))
L
Linus Torvalds 已提交
177 178 179 180 181 182 183 184 185 186 187 188
		return ip6_fragment(skb, ip6_output2);
	else
		return ip6_output2(skb);
}

/*
 *	xmit an sk_buff (used by TCP)
 */

int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
	     struct ipv6_txoptions *opt, int ipfragok)
{
189
	struct net *net = sock_net(sk);
190
	struct ipv6_pinfo *np = inet6_sk(sk);
L
Linus Torvalds 已提交
191
	struct in6_addr *first_hop = &fl->fl6_dst;
E
Eric Dumazet 已提交
192
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
193 194 195
	struct ipv6hdr *hdr;
	u8  proto = fl->proto;
	int seg_len = skb->len;
G
Gerrit Renker 已提交
196 197
	int hlimit = -1;
	int tclass = 0;
L
Linus Torvalds 已提交
198 199 200
	u32 mtu;

	if (opt) {
201
		unsigned int head_room;
L
Linus Torvalds 已提交
202 203 204 205 206 207 208 209 210 211

		/* First: exthdrs may take lots of space (~8K for now)
		   MAX_HEADER is not enough.
		 */
		head_room = opt->opt_nflen + opt->opt_flen;
		seg_len += head_room;
		head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);

		if (skb_headroom(skb) < head_room) {
			struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
212
			if (skb2 == NULL) {
E
Eric Dumazet 已提交
213
				IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
214 215
					      IPSTATS_MIB_OUTDISCARDS);
				kfree_skb(skb);
L
Linus Torvalds 已提交
216 217
				return -ENOBUFS;
			}
218 219
			kfree_skb(skb);
			skb = skb2;
L
Linus Torvalds 已提交
220 221 222 223 224 225 226 227 228
			if (sk)
				skb_set_owner_w(skb, sk);
		}
		if (opt->opt_flen)
			ipv6_push_frag_opts(skb, opt, &proto);
		if (opt->opt_nflen)
			ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
	}

229 230
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
231
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
232

233 234 235 236
	/* Allow local fragmentation. */
	if (ipfragok)
		skb->local_df = 1;

L
Linus Torvalds 已提交
237 238 239
	/*
	 *	Fill in the IPv6 header
	 */
G
Gerrit Renker 已提交
240 241
	if (np) {
		tclass = np->tclass;
L
Linus Torvalds 已提交
242
		hlimit = np->hop_limit;
G
Gerrit Renker 已提交
243
	}
L
Linus Torvalds 已提交
244
	if (hlimit < 0)
245
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
246

A
Al Viro 已提交
247
	*(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
248

L
Linus Torvalds 已提交
249 250 251 252 253 254 255
	hdr->payload_len = htons(seg_len);
	hdr->nexthdr = proto;
	hdr->hop_limit = hlimit;

	ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
	ipv6_addr_copy(&hdr->daddr, first_hop);

256
	skb->priority = sk->sk_priority;
257
	skb->mark = sk->sk_mark;
258

L
Linus Torvalds 已提交
259
	mtu = dst_mtu(dst);
260
	if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
E
Eric Dumazet 已提交
261
		IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
262
			      IPSTATS_MIB_OUT, skb->len);
263
		return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
264
				dst_output);
L
Linus Torvalds 已提交
265 266 267 268 269
	}

	if (net_ratelimit())
		printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
	skb->dev = dst->dev;
270
	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
E
Eric Dumazet 已提交
271
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
272 273 274 275
	kfree_skb(skb);
	return -EMSGSIZE;
}

276 277
EXPORT_SYMBOL(ip6_xmit);

L
Linus Torvalds 已提交
278 279 280 281 282 283 284 285
/*
 *	To avoid extra problems ND packets are send through this
 *	routine. It's code duplication but I really want to avoid
 *	extra checks since ipv6_build_header is used by TCP (which
 *	is for us performance critical)
 */

int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
286
	       const struct in6_addr *saddr, const struct in6_addr *daddr,
L
Linus Torvalds 已提交
287 288 289 290 291 292 293 294 295 296 297
	       int proto, int len)
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct ipv6hdr *hdr;
	int totlen;

	skb->protocol = htons(ETH_P_IPV6);
	skb->dev = dev;

	totlen = len + sizeof(struct ipv6hdr);

298 299
	skb_reset_network_header(skb);
	skb_put(skb, sizeof(struct ipv6hdr));
300
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
301

A
Al Viro 已提交
302
	*(__be32*)hdr = htonl(0x60000000);
L
Linus Torvalds 已提交
303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321

	hdr->payload_len = htons(len);
	hdr->nexthdr = proto;
	hdr->hop_limit = np->hop_limit;

	ipv6_addr_copy(&hdr->saddr, saddr);
	ipv6_addr_copy(&hdr->daddr, daddr);

	return 0;
}

static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
{
	struct ip6_ra_chain *ra;
	struct sock *last = NULL;

	read_lock(&ip6_ra_lock);
	for (ra = ip6_ra_chain; ra; ra = ra->next) {
		struct sock *sk = ra->sk;
322 323 324
		if (sk && ra->sel == sel &&
		    (!sk->sk_bound_dev_if ||
		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
L
Linus Torvalds 已提交
325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342
			if (last) {
				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
				if (skb2)
					rawv6_rcv(last, skb2);
			}
			last = sk;
		}
	}

	if (last) {
		rawv6_rcv(last, skb);
		read_unlock(&ip6_ra_lock);
		return 1;
	}
	read_unlock(&ip6_ra_lock);
	return 0;
}

343 344
static int ip6_forward_proxy_check(struct sk_buff *skb)
{
345
	struct ipv6hdr *hdr = ipv6_hdr(skb);
346 347 348 349 350 351 352 353 354 355 356 357 358
	u8 nexthdr = hdr->nexthdr;
	int offset;

	if (ipv6_ext_hdr(nexthdr)) {
		offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
		if (offset < 0)
			return 0;
	} else
		offset = sizeof(struct ipv6hdr);

	if (nexthdr == IPPROTO_ICMPV6) {
		struct icmp6hdr *icmp6;

359 360
		if (!pskb_may_pull(skb, (skb_network_header(skb) +
					 offset + 1 - skb->data)))
361 362
			return 0;

363
		icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380

		switch (icmp6->icmp6_type) {
		case NDISC_ROUTER_SOLICITATION:
		case NDISC_ROUTER_ADVERTISEMENT:
		case NDISC_NEIGHBOUR_SOLICITATION:
		case NDISC_NEIGHBOUR_ADVERTISEMENT:
		case NDISC_REDIRECT:
			/* For reaction involving unicast neighbor discovery
			 * message destined to the proxied address, pass it to
			 * input function.
			 */
			return 1;
		default:
			break;
		}
	}

381 382 383 384 385 386 387 388 389 390
	/*
	 * The proxying router can't forward traffic sent to a link-local
	 * address, so signal the sender and discard the packet. This
	 * behavior is clarified by the MIPv6 specification.
	 */
	if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
		dst_link_failure(skb);
		return -1;
	}

391 392 393
	return 0;
}

L
Linus Torvalds 已提交
394 395 396 397 398 399 400
static inline int ip6_forward_finish(struct sk_buff *skb)
{
	return dst_output(skb);
}

int ip6_forward(struct sk_buff *skb)
{
E
Eric Dumazet 已提交
401
	struct dst_entry *dst = skb_dst(skb);
402
	struct ipv6hdr *hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
403
	struct inet6_skb_parm *opt = IP6CB(skb);
404
	struct net *net = dev_net(dst->dev);
405
	u32 mtu;
406

407
	if (net->ipv6.devconf_all->forwarding == 0)
L
Linus Torvalds 已提交
408 409
		goto error;

410 411 412
	if (skb_warn_if_lro(skb))
		goto drop;

L
Linus Torvalds 已提交
413
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
414
		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
415 416 417
		goto drop;
	}

418
	skb_forward_csum(skb);
L
Linus Torvalds 已提交
419 420 421 422 423 424 425 426 427 428 429 430 431 432 433

	/*
	 *	We DO NOT make any processing on
	 *	RA packets, pushing them to user level AS IS
	 *	without ane WARRANTY that application will be able
	 *	to interpret them. The reason is that we
	 *	cannot make anything clever here.
	 *
	 *	We are not end-node, so that if packet contains
	 *	AH/ESP, we cannot make anything.
	 *	Defragmentation also would be mistake, RA packets
	 *	cannot be fragmented, because there is no warranty
	 *	that different fragments will go along one path. --ANK
	 */
	if (opt->ra) {
434
		u8 *ptr = skb_network_header(skb) + opt->ra;
L
Linus Torvalds 已提交
435 436 437 438 439 440 441 442 443 444
		if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
			return 0;
	}

	/*
	 *	check and decrement ttl
	 */
	if (hdr->hop_limit <= 1) {
		/* Force OUTPUT device used as source address */
		skb->dev = dst->dev;
445
		icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
446 447
		IP6_INC_STATS_BH(net,
				 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
L
Linus Torvalds 已提交
448 449 450 451 452

		kfree_skb(skb);
		return -ETIMEDOUT;
	}

453
	/* XXX: idev->cnf.proxy_ndp? */
454
	if (net->ipv6.devconf_all->proxy_ndp &&
455
	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
456 457
		int proxied = ip6_forward_proxy_check(skb);
		if (proxied > 0)
458
			return ip6_input(skb);
459
		else if (proxied < 0) {
460 461
			IP6_INC_STATS(net, ip6_dst_idev(dst),
				      IPSTATS_MIB_INDISCARDS);
462 463
			goto drop;
		}
464 465
	}

L
Linus Torvalds 已提交
466
	if (!xfrm6_route_forward(skb)) {
467
		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
468 469
		goto drop;
	}
E
Eric Dumazet 已提交
470
	dst = skb_dst(skb);
L
Linus Torvalds 已提交
471 472 473

	/* IPv6 specs say nothing about it, but it is clear that we cannot
	   send redirects to source routed frames.
474
	   We don't send redirects to frames decapsulated from IPsec.
L
Linus Torvalds 已提交
475
	 */
476
	if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
477
	    !skb_sec_path(skb)) {
L
Linus Torvalds 已提交
478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497
		struct in6_addr *target = NULL;
		struct rt6_info *rt;
		struct neighbour *n = dst->neighbour;

		/*
		 *	incoming and outgoing devices are the same
		 *	send a redirect.
		 */

		rt = (struct rt6_info *) dst;
		if ((rt->rt6i_flags & RTF_GATEWAY))
			target = (struct in6_addr*)&n->primary_key;
		else
			target = &hdr->daddr;

		/* Limit redirects both by destination (here)
		   and by source (inside ndisc_send_redirect)
		 */
		if (xrlim_allow(dst, 1*HZ))
			ndisc_send_redirect(skb, n, target);
498 499 500
	} else {
		int addrtype = ipv6_addr_type(&hdr->saddr);

L
Linus Torvalds 已提交
501
		/* This check is security critical. */
502 503
		if (addrtype == IPV6_ADDR_ANY ||
		    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
504 505 506
			goto error;
		if (addrtype & IPV6_ADDR_LINKLOCAL) {
			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
507
				    ICMPV6_NOT_NEIGHBOUR, 0);
508 509
			goto error;
		}
L
Linus Torvalds 已提交
510 511
	}

512 513 514 515 516
	mtu = dst_mtu(dst);
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;

	if (skb->len > mtu) {
L
Linus Torvalds 已提交
517 518
		/* Again, force OUTPUT device used as source address */
		skb->dev = dst->dev;
519
		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
520 521 522 523
		IP6_INC_STATS_BH(net,
				 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
		IP6_INC_STATS_BH(net,
				 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
524 525 526 527 528
		kfree_skb(skb);
		return -EMSGSIZE;
	}

	if (skb_cow(skb, dst->dev->hard_header_len)) {
529
		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
530 531 532
		goto drop;
	}

533
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
534 535

	/* Mangling hops number delayed to point after skb COW */
536

L
Linus Torvalds 已提交
537 538
	hdr->hop_limit--;

539
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
540 541
	return NF_HOOK(PF_INET6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
		       ip6_forward_finish);
L
Linus Torvalds 已提交
542 543

error:
544
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
L
Linus Torvalds 已提交
545 546 547 548 549 550 551 552 553 554
drop:
	kfree_skb(skb);
	return -EINVAL;
}

static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
{
	to->pkt_type = from->pkt_type;
	to->priority = from->priority;
	to->protocol = from->protocol;
E
Eric Dumazet 已提交
555 556
	skb_dst_drop(to);
	skb_dst_set(to, dst_clone(skb_dst(from)));
L
Linus Torvalds 已提交
557
	to->dev = from->dev;
T
Thomas Graf 已提交
558
	to->mark = from->mark;
L
Linus Torvalds 已提交
559 560 561 562

#ifdef CONFIG_NET_SCHED
	to->tc_index = from->tc_index;
#endif
563
	nf_copy(to, from);
564 565 566 567
#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
	to->nf_trace = from->nf_trace;
#endif
568
	skb_copy_secmark(to, from);
L
Linus Torvalds 已提交
569 570 571 572 573
}

int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
{
	u16 offset = sizeof(struct ipv6hdr);
574 575
	struct ipv6_opt_hdr *exthdr =
				(struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
576
	unsigned int packet_len = skb->tail - skb->network_header;
L
Linus Torvalds 已提交
577
	int found_rhdr = 0;
578
	*nexthdr = &ipv6_hdr(skb)->nexthdr;
L
Linus Torvalds 已提交
579 580 581 582 583 584

	while (offset + 1 <= packet_len) {

		switch (**nexthdr) {

		case NEXTHDR_HOP:
585
			break;
L
Linus Torvalds 已提交
586
		case NEXTHDR_ROUTING:
587 588
			found_rhdr = 1;
			break;
L
Linus Torvalds 已提交
589
		case NEXTHDR_DEST:
590
#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
591 592 593 594 595
			if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
				break;
#endif
			if (found_rhdr)
				return offset;
L
Linus Torvalds 已提交
596 597 598 599
			break;
		default :
			return offset;
		}
600 601 602

		offset += ipv6_optlen(exthdr);
		*nexthdr = &exthdr->nexthdr;
603 604
		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
						 offset);
L
Linus Torvalds 已提交
605 606 607 608 609 610 611 612
	}

	return offset;
}

static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
{
	struct sk_buff *frag;
E
Eric Dumazet 已提交
613
	struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
614
	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
L
Linus Torvalds 已提交
615 616 617
	struct ipv6hdr *tmp_hdr;
	struct frag_hdr *fh;
	unsigned int mtu, hlen, left, len;
A
Al Viro 已提交
618
	__be32 frag_id = 0;
L
Linus Torvalds 已提交
619 620
	int ptr, offset = 0, err=0;
	u8 *prevhdr, nexthdr = 0;
E
Eric Dumazet 已提交
621
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
622 623 624 625

	hlen = ip6_find_1stfragopt(skb, &prevhdr);
	nexthdr = *prevhdr;

J
John Heffner 已提交
626
	mtu = ip6_skb_dst_mtu(skb);
627 628

	/* We must not fragment if the socket is set to force MTU discovery
629
	 * or if the skb it not generated by a local socket.
630
	 */
631
	if (!skb->local_df) {
E
Eric Dumazet 已提交
632
		skb->dev = skb_dst(skb)->dev;
633
		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
E
Eric Dumazet 已提交
634
		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
635
			      IPSTATS_MIB_FRAGFAILS);
636 637 638 639
		kfree_skb(skb);
		return -EMSGSIZE;
	}

640 641 642 643 644
	if (np && np->frag_size < mtu) {
		if (np->frag_size)
			mtu = np->frag_size;
	}
	mtu -= hlen + sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
645

646
	if (skb_has_frags(skb)) {
L
Linus Torvalds 已提交
647
		int first_len = skb_pagelen(skb);
648
		int truesizes = 0;
L
Linus Torvalds 已提交
649 650 651 652 653 654

		if (first_len - hlen > mtu ||
		    ((first_len - hlen) & 7) ||
		    skb_cloned(skb))
			goto slow_path;

655
		skb_walk_frags(skb, frag) {
L
Linus Torvalds 已提交
656 657 658 659 660 661 662 663 664
			/* Correct geometry. */
			if (frag->len > mtu ||
			    ((frag->len & 7) && frag->next) ||
			    skb_headroom(frag) < hlen)
			    goto slow_path;

			/* Partially cloned skb? */
			if (skb_shared(frag))
				goto slow_path;
665 666 667 668 669

			BUG_ON(frag->sk);
			if (skb->sk) {
				frag->sk = skb->sk;
				frag->destructor = sock_wfree;
670
				truesizes += frag->truesize;
671
			}
L
Linus Torvalds 已提交
672 673 674 675 676
		}

		err = 0;
		offset = 0;
		frag = skb_shinfo(skb)->frag_list;
677
		skb_frag_list_init(skb);
L
Linus Torvalds 已提交
678 679
		/* BUILD HEADER */

Y
YOSHIFUJI Hideaki 已提交
680
		*prevhdr = NEXTHDR_FRAGMENT;
681
		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
L
Linus Torvalds 已提交
682
		if (!tmp_hdr) {
E
Eric Dumazet 已提交
683
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
684
				      IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
685 686 687 688 689
			return -ENOMEM;
		}

		__skb_pull(skb, hlen);
		fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
690 691
		__skb_push(skb, hlen);
		skb_reset_network_header(skb);
692
		memcpy(skb_network_header(skb), tmp_hdr, hlen);
L
Linus Torvalds 已提交
693

694
		ipv6_select_ident(fh);
L
Linus Torvalds 已提交
695 696 697 698 699 700 701
		fh->nexthdr = nexthdr;
		fh->reserved = 0;
		fh->frag_off = htons(IP6_MF);
		frag_id = fh->identification;

		first_len = skb_pagelen(skb);
		skb->data_len = first_len - skb_headlen(skb);
702
		skb->truesize -= truesizes;
L
Linus Torvalds 已提交
703
		skb->len = first_len;
704 705
		ipv6_hdr(skb)->payload_len = htons(first_len -
						   sizeof(struct ipv6hdr));
706 707

		dst_hold(&rt->u.dst);
L
Linus Torvalds 已提交
708 709 710 711 712 713

		for (;;) {
			/* Prepare header of the next frame,
			 * before previous one went down. */
			if (frag) {
				frag->ip_summed = CHECKSUM_NONE;
714
				skb_reset_transport_header(frag);
L
Linus Torvalds 已提交
715
				fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
716 717
				__skb_push(frag, hlen);
				skb_reset_network_header(frag);
718 719
				memcpy(skb_network_header(frag), tmp_hdr,
				       hlen);
L
Linus Torvalds 已提交
720 721 722 723 724 725 726
				offset += skb->len - hlen - sizeof(struct frag_hdr);
				fh->nexthdr = nexthdr;
				fh->reserved = 0;
				fh->frag_off = htons(offset);
				if (frag->next != NULL)
					fh->frag_off |= htons(IP6_MF);
				fh->identification = frag_id;
727 728 729
				ipv6_hdr(frag)->payload_len =
						htons(frag->len -
						      sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
730 731
				ip6_copy_metadata(frag, skb);
			}
732

L
Linus Torvalds 已提交
733
			err = output(skb);
734
			if(!err)
735 736
				IP6_INC_STATS(net, ip6_dst_idev(&rt->u.dst),
					      IPSTATS_MIB_FRAGCREATES);
737

L
Linus Torvalds 已提交
738 739 740 741 742 743 744 745
			if (err || !frag)
				break;

			skb = frag;
			frag = skb->next;
			skb->next = NULL;
		}

J
Jesper Juhl 已提交
746
		kfree(tmp_hdr);
L
Linus Torvalds 已提交
747 748

		if (err == 0) {
749 750
			IP6_INC_STATS(net, ip6_dst_idev(&rt->u.dst),
				      IPSTATS_MIB_FRAGOKS);
751
			dst_release(&rt->u.dst);
L
Linus Torvalds 已提交
752 753 754 755 756 757 758 759 760
			return 0;
		}

		while (frag) {
			skb = frag->next;
			kfree_skb(frag);
			frag = skb;
		}

761 762
		IP6_INC_STATS(net, ip6_dst_idev(&rt->u.dst),
			      IPSTATS_MIB_FRAGFAILS);
763
		dst_release(&rt->u.dst);
L
Linus Torvalds 已提交
764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793
		return err;
	}

slow_path:
	left = skb->len - hlen;		/* Space per frame */
	ptr = hlen;			/* Where to start from */

	/*
	 *	Fragment the datagram.
	 */

	*prevhdr = NEXTHDR_FRAGMENT;

	/*
	 *	Keep copying data until we run out.
	 */
	while(left > 0)	{
		len = left;
		/* IF: it doesn't fit, use 'mtu' - the data space left */
		if (len > mtu)
			len = mtu;
		/* IF: we are not sending upto and including the packet end
		   then align the next start on an eight byte boundary */
		if (len < left)	{
			len &= ~7;
		}
		/*
		 *	Allocate buffer.
		 */

794
		if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_ALLOCATED_SPACE(rt->u.dst.dev), GFP_ATOMIC)) == NULL) {
795
			NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
E
Eric Dumazet 已提交
796
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
797
				      IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
798 799 800 801 802 803 804 805 806 807 808
			err = -ENOMEM;
			goto fail;
		}

		/*
		 *	Set up data on packet
		 */

		ip6_copy_metadata(frag, skb);
		skb_reserve(frag, LL_RESERVED_SPACE(rt->u.dst.dev));
		skb_put(frag, len + hlen + sizeof(struct frag_hdr));
809
		skb_reset_network_header(frag);
810
		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
811 812
		frag->transport_header = (frag->network_header + hlen +
					  sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
813 814 815 816 817 818 819 820 821 822 823

		/*
		 *	Charge the memory for the fragment to any owner
		 *	it might possess
		 */
		if (skb->sk)
			skb_set_owner_w(frag, skb->sk);

		/*
		 *	Copy the packet header into the new buffer.
		 */
824
		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
L
Linus Torvalds 已提交
825 826 827 828 829 830

		/*
		 *	Build fragment header.
		 */
		fh->nexthdr = nexthdr;
		fh->reserved = 0;
831
		if (!frag_id) {
832
			ipv6_select_ident(fh);
L
Linus Torvalds 已提交
833 834 835 836 837 838 839
			frag_id = fh->identification;
		} else
			fh->identification = frag_id;

		/*
		 *	Copy a block of the IP datagram.
		 */
840
		if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
L
Linus Torvalds 已提交
841 842 843 844 845 846
			BUG();
		left -= len;

		fh->frag_off = htons(offset);
		if (left > 0)
			fh->frag_off |= htons(IP6_MF);
847 848
		ipv6_hdr(frag)->payload_len = htons(frag->len -
						    sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
849 850 851 852 853 854 855 856 857 858

		ptr += len;
		offset += len;

		/*
		 *	Put this fragment into the sending queue.
		 */
		err = output(frag);
		if (err)
			goto fail;
859

E
Eric Dumazet 已提交
860
		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
861
			      IPSTATS_MIB_FRAGCREATES);
L
Linus Torvalds 已提交
862
	}
E
Eric Dumazet 已提交
863
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
864
		      IPSTATS_MIB_FRAGOKS);
L
Linus Torvalds 已提交
865 866 867 868
	kfree_skb(skb);
	return err;

fail:
E
Eric Dumazet 已提交
869
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
870
		      IPSTATS_MIB_FRAGFAILS);
871
	kfree_skb(skb);
L
Linus Torvalds 已提交
872 873 874
	return err;
}

875 876 877 878 879 880 881 882
static inline int ip6_rt_check(struct rt6key *rt_key,
			       struct in6_addr *fl_addr,
			       struct in6_addr *addr_cache)
{
	return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
		(addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
}

883 884 885
static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
					  struct dst_entry *dst,
					  struct flowi *fl)
L
Linus Torvalds 已提交
886
{
887 888
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct rt6_info *rt = (struct rt6_info *)dst;
L
Linus Torvalds 已提交
889

890 891 892 893 894 895 896 897
	if (!dst)
		goto out;

	/* Yes, checking route validity in not connected
	 * case is not very simple. Take into account,
	 * that we do not support routing by source, TOS,
	 * and MSG_DONTROUTE 		--ANK (980726)
	 *
898 899
	 * 1. ip6_rt_check(): If route was host route,
	 *    check that cached destination is current.
900 901 902 903 904 905 906 907 908 909
	 *    If it is network route, we still may
	 *    check its validity using saved pointer
	 *    to the last used address: daddr_cache.
	 *    We do not want to save whole address now,
	 *    (because main consumer of this service
	 *    is tcp, which has not this problem),
	 *    so that the last trick works only on connected
	 *    sockets.
	 * 2. oif also should be the same.
	 */
910
	if (ip6_rt_check(&rt->rt6i_dst, &fl->fl6_dst, np->daddr_cache) ||
911 912 913
#ifdef CONFIG_IPV6_SUBTREES
	    ip6_rt_check(&rt->rt6i_src, &fl->fl6_src, np->saddr_cache) ||
#endif
914
	    (fl->oif && fl->oif != dst->dev->ifindex)) {
915 916
		dst_release(dst);
		dst = NULL;
L
Linus Torvalds 已提交
917 918
	}

919 920 921 922 923 924 925 926
out:
	return dst;
}

static int ip6_dst_lookup_tail(struct sock *sk,
			       struct dst_entry **dst, struct flowi *fl)
{
	int err;
927
	struct net *net = sock_net(sk);
928

L
Linus Torvalds 已提交
929
	if (*dst == NULL)
930
		*dst = ip6_route_output(net, sk, fl);
L
Linus Torvalds 已提交
931 932 933 934 935

	if ((err = (*dst)->error))
		goto out_err_release;

	if (ipv6_addr_any(&fl->fl6_src)) {
936
		err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
937 938 939
					 &fl->fl6_dst,
					 sk ? inet6_sk(sk)->srcprefs : 0,
					 &fl->fl6_src);
940
		if (err)
L
Linus Torvalds 已提交
941 942 943
			goto out_err_release;
	}

944
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975
	/*
	 * Here if the dst entry we've looked up
	 * has a neighbour entry that is in the INCOMPLETE
	 * state and the src address from the flow is
	 * marked as OPTIMISTIC, we release the found
	 * dst entry and replace it instead with the
	 * dst entry of the nexthop router
	 */
	if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
		struct inet6_ifaddr *ifp;
		struct flowi fl_gw;
		int redirect;

		ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
				      (*dst)->dev, 1);

		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
		if (ifp)
			in6_ifa_put(ifp);

		if (redirect) {
			/*
			 * We need to get the dst entry for the
			 * default router instead
			 */
			dst_release(*dst);
			memcpy(&fl_gw, fl, sizeof(struct flowi));
			memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
			*dst = ip6_route_output(net, sk, &fl_gw);
			if ((err = (*dst)->error))
				goto out_err_release;
976
		}
977
	}
978 979
#endif

L
Linus Torvalds 已提交
980 981 982
	return 0;

out_err_release:
983
	if (err == -ENETUNREACH)
984
		IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
985 986 987 988
	dst_release(*dst);
	*dst = NULL;
	return err;
}
A
Adrian Bunk 已提交
989

990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004
/**
 *	ip6_dst_lookup - perform route lookup on flow
 *	@sk: socket which provides route info
 *	@dst: pointer to dst_entry * for result
 *	@fl: flow to lookup
 *
 *	This function performs a route lookup on the given flow.
 *
 *	It returns zero on success, or a standard errno code on error.
 */
int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
{
	*dst = NULL;
	return ip6_dst_lookup_tail(sk, dst, fl);
}
1005 1006
EXPORT_SYMBOL_GPL(ip6_dst_lookup);

1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031
/**
 *	ip6_sk_dst_lookup - perform socket cached route lookup on flow
 *	@sk: socket which provides the dst cache and route info
 *	@dst: pointer to dst_entry * for result
 *	@fl: flow to lookup
 *
 *	This function performs a route lookup on the given flow with the
 *	possibility of using the cached route in the socket if it is valid.
 *	It will take the socket dst lock when operating on the dst cache.
 *	As a result, this function can only be used in process context.
 *
 *	It returns zero on success, or a standard errno code on error.
 */
int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
{
	*dst = NULL;
	if (sk) {
		*dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
		*dst = ip6_sk_dst_check(sk, *dst, fl);
	}

	return ip6_dst_lookup_tail(sk, dst, fl);
}
EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);

A
Adrian Bunk 已提交
1032
static inline int ip6_ufo_append_data(struct sock *sk,
1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059
			int getfrag(void *from, char *to, int offset, int len,
			int odd, struct sk_buff *skb),
			void *from, int length, int hh_len, int fragheaderlen,
			int transhdrlen, int mtu,unsigned int flags)

{
	struct sk_buff *skb;
	int err;

	/* There is support for UDP large send offload by network
	 * device, so create one single skb packet containing complete
	 * udp datagram
	 */
	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
		skb = sock_alloc_send_skb(sk,
			hh_len + fragheaderlen + transhdrlen + 20,
			(flags & MSG_DONTWAIT), &err);
		if (skb == NULL)
			return -ENOMEM;

		/* reserve space for Hardware header */
		skb_reserve(skb, hh_len);

		/* create space for UDP/IP header */
		skb_put(skb,fragheaderlen + transhdrlen);

		/* initialize network header pointer */
1060
		skb_reset_network_header(skb);
1061 1062

		/* initialize protocol header pointer */
1063
		skb->transport_header = skb->network_header + fragheaderlen;
1064

1065
		skb->ip_summed = CHECKSUM_PARTIAL;
1066 1067 1068 1069 1070 1071 1072 1073 1074
		skb->csum = 0;
		sk->sk_sndmsg_off = 0;
	}

	err = skb_append_datato_frags(sk,skb, getfrag, from,
				      (length - transhdrlen));
	if (!err) {
		struct frag_hdr fhdr;

1075 1076 1077 1078 1079
		/* Specify the length of each IPv6 datagram fragment.
		 * It has to be a multiple of 8.
		 */
		skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
					     sizeof(struct frag_hdr)) & ~7;
H
Herbert Xu 已提交
1080
		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1081
		ipv6_select_ident(&fhdr);
1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093
		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
		__skb_queue_tail(&sk->sk_write_queue, skb);

		return 0;
	}
	/* There is not enough support do UPD LSO,
	 * so follow normal path
	 */
	kfree_skb(skb);

	return err;
}
L
Linus Torvalds 已提交
1094

1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106
static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
					       gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
						gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

1107 1108 1109 1110 1111
int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
	int offset, int len, int odd, struct sk_buff *skb),
	void *from, int length, int transhdrlen,
	int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
	struct rt6_info *rt, unsigned int flags)
L
Linus Torvalds 已提交
1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131
{
	struct inet_sock *inet = inet_sk(sk);
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct sk_buff *skb;
	unsigned int maxfraglen, fragheaderlen;
	int exthdrlen;
	int hh_len;
	int mtu;
	int copy;
	int err;
	int offset = 0;
	int csummode = CHECKSUM_NONE;

	if (flags&MSG_PROBE)
		return 0;
	if (skb_queue_empty(&sk->sk_write_queue)) {
		/*
		 * setup for corking
		 */
		if (opt) {
1132
			if (WARN_ON(np->cork.opt))
L
Linus Torvalds 已提交
1133
				return -EINVAL;
1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162

			np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
			if (unlikely(np->cork.opt == NULL))
				return -ENOBUFS;

			np->cork.opt->tot_len = opt->tot_len;
			np->cork.opt->opt_flen = opt->opt_flen;
			np->cork.opt->opt_nflen = opt->opt_nflen;

			np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
							    sk->sk_allocation);
			if (opt->dst0opt && !np->cork.opt->dst0opt)
				return -ENOBUFS;

			np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
							    sk->sk_allocation);
			if (opt->dst1opt && !np->cork.opt->dst1opt)
				return -ENOBUFS;

			np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
							   sk->sk_allocation);
			if (opt->hopopt && !np->cork.opt->hopopt)
				return -ENOBUFS;

			np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
							    sk->sk_allocation);
			if (opt->srcrt && !np->cork.opt->srcrt)
				return -ENOBUFS;

L
Linus Torvalds 已提交
1163 1164 1165
			/* need source address above miyazawa*/
		}
		dst_hold(&rt->u.dst);
1166
		inet->cork.dst = &rt->u.dst;
L
Linus Torvalds 已提交
1167 1168
		inet->cork.fl = *fl;
		np->cork.hop_limit = hlimit;
1169
		np->cork.tclass = tclass;
J
John Heffner 已提交
1170 1171
		mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
		      rt->u.dst.dev->mtu : dst_mtu(rt->u.dst.path);
1172
		if (np->frag_size < mtu) {
1173 1174 1175 1176
			if (np->frag_size)
				mtu = np->frag_size;
		}
		inet->cork.fragsize = mtu;
L
Linus Torvalds 已提交
1177 1178 1179 1180 1181
		if (dst_allfrag(rt->u.dst.path))
			inet->cork.flags |= IPCORK_ALLFRAG;
		inet->cork.length = 0;
		sk->sk_sndmsg_page = NULL;
		sk->sk_sndmsg_off = 0;
1182
		exthdrlen = rt->u.dst.header_len + (opt ? opt->opt_flen : 0) -
1183
			    rt->rt6i_nfheader_len;
L
Linus Torvalds 已提交
1184 1185 1186
		length += exthdrlen;
		transhdrlen += exthdrlen;
	} else {
1187
		rt = (struct rt6_info *)inet->cork.dst;
L
Linus Torvalds 已提交
1188
		fl = &inet->cork.fl;
1189
		opt = np->cork.opt;
L
Linus Torvalds 已提交
1190 1191 1192 1193 1194 1195 1196
		transhdrlen = 0;
		exthdrlen = 0;
		mtu = inet->cork.fragsize;
	}

	hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);

1197
	fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1198
			(opt ? opt->opt_nflen : 0);
L
Linus Torvalds 已提交
1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214
	maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);

	if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
		if (inet->cork.length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
			ipv6_local_error(sk, EMSGSIZE, fl, mtu-exthdrlen);
			return -EMSGSIZE;
		}
	}

	/*
	 * Let's try using as much space as possible.
	 * Use MTU if total length of the message fits into the MTU.
	 * Otherwise, we need to reserve fragment header and
	 * fragment alignment (= 8-15 octects, in total).
	 *
	 * Note that we may need to "move" the data from the tail of
1215
	 * of the buffer to the new fragment when we split
L
Linus Torvalds 已提交
1216 1217
	 * the message.
	 *
1218
	 * FIXME: It may be fragmented into multiple chunks
L
Linus Torvalds 已提交
1219 1220
	 *        at once if non-fragmentable extension headers
	 *        are too large.
1221
	 * --yoshfuji
L
Linus Torvalds 已提交
1222 1223 1224
	 */

	inet->cork.length += length;
1225 1226 1227
	if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
	    (rt->u.dst.dev->features & NETIF_F_UFO)) {

1228 1229 1230 1231
		err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
					  fragheaderlen, transhdrlen, mtu,
					  flags);
		if (err)
1232 1233 1234
			goto error;
		return 0;
	}
L
Linus Torvalds 已提交
1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285

	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
		goto alloc_new_skb;

	while (length > 0) {
		/* Check if the remaining data fits into current packet. */
		copy = (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
		if (copy < length)
			copy = maxfraglen - skb->len;

		if (copy <= 0) {
			char *data;
			unsigned int datalen;
			unsigned int fraglen;
			unsigned int fraggap;
			unsigned int alloclen;
			struct sk_buff *skb_prev;
alloc_new_skb:
			skb_prev = skb;

			/* There's no room in the current skb */
			if (skb_prev)
				fraggap = skb_prev->len - maxfraglen;
			else
				fraggap = 0;

			/*
			 * If remaining data exceeds the mtu,
			 * we know we need more fragment(s).
			 */
			datalen = length + fraggap;
			if (datalen > (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
				datalen = maxfraglen - fragheaderlen;

			fraglen = datalen + fragheaderlen;
			if ((flags & MSG_MORE) &&
			    !(rt->u.dst.dev->features&NETIF_F_SG))
				alloclen = mtu;
			else
				alloclen = datalen + fragheaderlen;

			/*
			 * The last fragment gets additional space at tail.
			 * Note: we overallocate on fragments with MSG_MODE
			 * because we have no idea if we're the last one.
			 */
			if (datalen == length + fraggap)
				alloclen += rt->u.dst.trailer_len;

			/*
			 * We just reserve space for fragment header.
1286
			 * Note: this may be overallocation if the message
L
Linus Torvalds 已提交
1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318
			 * (without MSG_MORE) fits into the MTU.
			 */
			alloclen += sizeof(struct frag_hdr);

			if (transhdrlen) {
				skb = sock_alloc_send_skb(sk,
						alloclen + hh_len,
						(flags & MSG_DONTWAIT), &err);
			} else {
				skb = NULL;
				if (atomic_read(&sk->sk_wmem_alloc) <=
				    2 * sk->sk_sndbuf)
					skb = sock_wmalloc(sk,
							   alloclen + hh_len, 1,
							   sk->sk_allocation);
				if (unlikely(skb == NULL))
					err = -ENOBUFS;
			}
			if (skb == NULL)
				goto error;
			/*
			 *	Fill in the control structures
			 */
			skb->ip_summed = csummode;
			skb->csum = 0;
			/* reserve for fragmentation */
			skb_reserve(skb, hh_len+sizeof(struct frag_hdr));

			/*
			 *	Find where to start putting bytes
			 */
			data = skb_put(skb, fraglen);
1319
			skb_set_network_header(skb, exthdrlen);
L
Linus Torvalds 已提交
1320
			data += fragheaderlen;
1321 1322
			skb->transport_header = (skb->network_header +
						 fragheaderlen);
L
Linus Torvalds 已提交
1323 1324 1325 1326 1327 1328 1329
			if (fraggap) {
				skb->csum = skb_copy_and_csum_bits(
					skb_prev, maxfraglen,
					data + transhdrlen, fraggap, 0);
				skb_prev->csum = csum_sub(skb_prev->csum,
							  skb->csum);
				data += fraggap;
1330
				pskb_trim_unique(skb_prev, maxfraglen);
L
Linus Torvalds 已提交
1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412
			}
			copy = datalen - transhdrlen - fraggap;
			if (copy < 0) {
				err = -EINVAL;
				kfree_skb(skb);
				goto error;
			} else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
				err = -EFAULT;
				kfree_skb(skb);
				goto error;
			}

			offset += copy;
			length -= datalen - fraggap;
			transhdrlen = 0;
			exthdrlen = 0;
			csummode = CHECKSUM_NONE;

			/*
			 * Put the packet on the pending queue
			 */
			__skb_queue_tail(&sk->sk_write_queue, skb);
			continue;
		}

		if (copy > length)
			copy = length;

		if (!(rt->u.dst.dev->features&NETIF_F_SG)) {
			unsigned int off;

			off = skb->len;
			if (getfrag(from, skb_put(skb, copy),
						offset, copy, off, skb) < 0) {
				__skb_trim(skb, off);
				err = -EFAULT;
				goto error;
			}
		} else {
			int i = skb_shinfo(skb)->nr_frags;
			skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
			struct page *page = sk->sk_sndmsg_page;
			int off = sk->sk_sndmsg_off;
			unsigned int left;

			if (page && (left = PAGE_SIZE - off) > 0) {
				if (copy >= left)
					copy = left;
				if (page != frag->page) {
					if (i == MAX_SKB_FRAGS) {
						err = -EMSGSIZE;
						goto error;
					}
					get_page(page);
					skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
					frag = &skb_shinfo(skb)->frags[i];
				}
			} else if(i < MAX_SKB_FRAGS) {
				if (copy > PAGE_SIZE)
					copy = PAGE_SIZE;
				page = alloc_pages(sk->sk_allocation, 0);
				if (page == NULL) {
					err = -ENOMEM;
					goto error;
				}
				sk->sk_sndmsg_page = page;
				sk->sk_sndmsg_off = 0;

				skb_fill_page_desc(skb, i, page, 0, 0);
				frag = &skb_shinfo(skb)->frags[i];
			} else {
				err = -EMSGSIZE;
				goto error;
			}
			if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
				err = -EFAULT;
				goto error;
			}
			sk->sk_sndmsg_off += copy;
			frag->size += copy;
			skb->len += copy;
			skb->data_len += copy;
1413 1414
			skb->truesize += copy;
			atomic_add(copy, &sk->sk_wmem_alloc);
L
Linus Torvalds 已提交
1415 1416 1417 1418 1419 1420 1421
		}
		offset += copy;
		length -= copy;
	}
	return 0;
error:
	inet->cork.length -= length;
1422
	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1423 1424 1425
	return err;
}

1426 1427
static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
{
1428 1429 1430 1431 1432 1433 1434 1435 1436
	if (np->cork.opt) {
		kfree(np->cork.opt->dst0opt);
		kfree(np->cork.opt->dst1opt);
		kfree(np->cork.opt->hopopt);
		kfree(np->cork.opt->srcrt);
		kfree(np->cork.opt);
		np->cork.opt = NULL;
	}

1437 1438 1439
	if (inet->cork.dst) {
		dst_release(inet->cork.dst);
		inet->cork.dst = NULL;
1440 1441 1442 1443 1444
		inet->cork.flags &= ~IPCORK_ALLFRAG;
	}
	memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
}

L
Linus Torvalds 已提交
1445 1446 1447 1448 1449 1450 1451
int ip6_push_pending_frames(struct sock *sk)
{
	struct sk_buff *skb, *tmp_skb;
	struct sk_buff **tail_skb;
	struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
	struct inet_sock *inet = inet_sk(sk);
	struct ipv6_pinfo *np = inet6_sk(sk);
1452
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
1453 1454
	struct ipv6hdr *hdr;
	struct ipv6_txoptions *opt = np->cork.opt;
1455
	struct rt6_info *rt = (struct rt6_info *)inet->cork.dst;
L
Linus Torvalds 已提交
1456 1457 1458 1459 1460 1461 1462 1463 1464
	struct flowi *fl = &inet->cork.fl;
	unsigned char proto = fl->proto;
	int err = 0;

	if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
		goto out;
	tail_skb = &(skb_shinfo(skb)->frag_list);

	/* move skb->data to ip header from ext header */
1465
	if (skb->data < skb_network_header(skb))
1466
		__skb_pull(skb, skb_network_offset(skb));
L
Linus Torvalds 已提交
1467
	while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1468
		__skb_pull(tmp_skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1469 1470 1471 1472 1473 1474 1475 1476 1477
		*tail_skb = tmp_skb;
		tail_skb = &(tmp_skb->next);
		skb->len += tmp_skb->len;
		skb->data_len += tmp_skb->len;
		skb->truesize += tmp_skb->truesize;
		tmp_skb->destructor = NULL;
		tmp_skb->sk = NULL;
	}

1478
	/* Allow local fragmentation. */
1479
	if (np->pmtudisc < IPV6_PMTUDISC_DO)
1480 1481
		skb->local_df = 1;

L
Linus Torvalds 已提交
1482
	ipv6_addr_copy(final_dst, &fl->fl6_dst);
1483
	__skb_pull(skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1484 1485 1486 1487 1488
	if (opt && opt->opt_flen)
		ipv6_push_frag_opts(skb, opt, &proto);
	if (opt && opt->opt_nflen)
		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);

1489 1490
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
1491
	hdr = ipv6_hdr(skb);
1492

A
Al Viro 已提交
1493
	*(__be32*)hdr = fl->fl6_flowlabel |
1494
		     htonl(0x60000000 | ((int)np->cork.tclass << 20));
L
Linus Torvalds 已提交
1495 1496 1497 1498 1499 1500

	hdr->hop_limit = np->cork.hop_limit;
	hdr->nexthdr = proto;
	ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
	ipv6_addr_copy(&hdr->daddr, final_dst);

1501
	skb->priority = sk->sk_priority;
1502
	skb->mark = sk->sk_mark;
1503

E
Eric Dumazet 已提交
1504
	skb_dst_set(skb, dst_clone(&rt->u.dst));
1505
	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1506
	if (proto == IPPROTO_ICMPV6) {
E
Eric Dumazet 已提交
1507
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1508

1509
		ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1510
		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1511 1512
	}

H
Herbert Xu 已提交
1513
	err = ip6_local_out(skb);
L
Linus Torvalds 已提交
1514 1515
	if (err) {
		if (err > 0)
E
Eric Dumazet 已提交
1516
			err = net_xmit_errno(err);
L
Linus Torvalds 已提交
1517 1518 1519 1520 1521
		if (err)
			goto error;
	}

out:
1522
	ip6_cork_release(inet, np);
L
Linus Torvalds 已提交
1523 1524
	return err;
error:
1525
	IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1526 1527 1528 1529 1530 1531 1532 1533
	goto out;
}

void ip6_flush_pending_frames(struct sock *sk)
{
	struct sk_buff *skb;

	while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
E
Eric Dumazet 已提交
1534 1535
		if (skb_dst(skb))
			IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1536
				      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1537 1538 1539
		kfree_skb(skb);
	}

1540
	ip6_cork_release(inet_sk(sk), inet6_sk(sk));
L
Linus Torvalds 已提交
1541
}