ip6_output.c 44.4 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	IPv6 output functions
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
 *
 *	Based on linux/net/ipv4/ip_output.c
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 *	Changes:
 *	A.N.Kuznetsov	:	airthmetics in fragmentation.
 *				extension headers are implemented.
 *				route changes now work.
 *				ip6_forward does not confuse sniffers.
 *				etc.
 *
 *      H. von Brand    :       Added missing #include <linux/string.h>
23
 *	Imran Patel	:	frag id should be in NBO
L
Linus Torvalds 已提交
24 25 26 27 28 29
 *      Kazunori MIYAZAWA @USAGI
 *			:       add ip6_append_data and related functions
 *				for datagram xmit
 */

#include <linux/errno.h>
H
Herbert Xu 已提交
30
#include <linux/kernel.h>
L
Linus Torvalds 已提交
31 32 33 34 35 36 37 38
#include <linux/string.h>
#include <linux/socket.h>
#include <linux/net.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/in6.h>
#include <linux/tcp.h>
#include <linux/route.h>
39
#include <linux/module.h>
40
#include <linux/slab.h>
L
Linus Torvalds 已提交
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

#include <linux/netfilter.h>
#include <linux/netfilter_ipv6.h>

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
#include <net/ndisc.h>
#include <net/protocol.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/rawv6.h>
#include <net/icmp.h>
#include <net/xfrm.h>
#include <net/checksum.h>
57
#include <linux/mroute6.h>
L
Linus Torvalds 已提交
58

59
static int ip6_finish_output2(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
60
{
E
Eric Dumazet 已提交
61
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
62
	struct net_device *dev = dst->dev;
63
	struct net *net = dev_net(dev);
64
	struct neighbour *neigh;
65 66
	struct in6_addr *nexthop;
	int ret;
L
Linus Torvalds 已提交
67 68 69 70

	skb->protocol = htons(ETH_P_IPV6);
	skb->dev = dev;

71
	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
E
Eric Dumazet 已提交
72
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
L
Linus Torvalds 已提交
73

74
		if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) &&
75
		    ((mroute6_socket(net, skb) &&
76
		     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
77 78
		     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
					 &ipv6_hdr(skb)->saddr))) {
L
Linus Torvalds 已提交
79 80 81 82 83 84
			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);

			/* Do not check for IFF_ALLMULTI; multicast routing
			   is not supported in any case.
			 */
			if (newskb)
85
				NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
86
					sk, newskb, NULL, newskb->dev,
87
					dev_loopback_xmit);
L
Linus Torvalds 已提交
88

89
			if (ipv6_hdr(skb)->hop_limit == 0) {
90
				IP6_INC_STATS(net, idev,
91
					      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
92 93 94 95 96
				kfree_skb(skb);
				return 0;
			}
		}

97
		IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, skb->len);
98 99 100 101 102 103 104

		if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
		    IPV6_ADDR_SCOPE_NODELOCAL &&
		    !(dev->flags & IFF_LOOPBACK)) {
			kfree_skb(skb);
			return 0;
		}
L
Linus Torvalds 已提交
105 106
	}

107
	rcu_read_lock_bh();
108
	nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
109 110 111 112 113 114 115 116 117
	neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
	if (unlikely(!neigh))
		neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
	if (!IS_ERR(neigh)) {
		ret = dst_neigh_output(dst, neigh, skb);
		rcu_read_unlock_bh();
		return ret;
	}
	rcu_read_unlock_bh();
118

119
	IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
120 121
	kfree_skb(skb);
	return -EINVAL;
L
Linus Torvalds 已提交
122 123
}

124
static int ip6_finish_output(struct sock *sk, struct sk_buff *skb)
125 126
{
	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
127 128
	    dst_allfrag(skb_dst(skb)) ||
	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
129
		return ip6_fragment(sk, skb, ip6_finish_output2);
130
	else
131
		return ip6_finish_output2(sk, skb);
132 133
}

134
int ip6_output(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
135
{
136
	struct net_device *dev = skb_dst(skb)->dev;
E
Eric Dumazet 已提交
137
	struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
138
	struct net *net = dev_net(dev);
139
	if (unlikely(idev->cnf.disable_ipv6)) {
140
		IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
141 142 143 144
		kfree_skb(skb);
		return 0;
	}

145 146
	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, sk, skb,
			    NULL, dev,
147 148
			    ip6_finish_output,
			    !(IP6CB(skb)->flags & IP6SKB_REROUTED));
L
Linus Torvalds 已提交
149 150 151
}

/*
S
Shan Wei 已提交
152
 *	xmit an sk_buff (used by TCP, SCTP and DCCP)
L
Linus Torvalds 已提交
153 154
 */

155
int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
156
	     struct ipv6_txoptions *opt, int tclass)
L
Linus Torvalds 已提交
157
{
158
	struct net *net = sock_net(sk);
159
	struct ipv6_pinfo *np = inet6_sk(sk);
160
	struct in6_addr *first_hop = &fl6->daddr;
E
Eric Dumazet 已提交
161
	struct dst_entry *dst = skb_dst(skb);
L
Linus Torvalds 已提交
162
	struct ipv6hdr *hdr;
163
	u8  proto = fl6->flowi6_proto;
L
Linus Torvalds 已提交
164
	int seg_len = skb->len;
G
Gerrit Renker 已提交
165
	int hlimit = -1;
L
Linus Torvalds 已提交
166 167 168
	u32 mtu;

	if (opt) {
169
		unsigned int head_room;
L
Linus Torvalds 已提交
170 171 172 173 174 175 176 177 178 179

		/* First: exthdrs may take lots of space (~8K for now)
		   MAX_HEADER is not enough.
		 */
		head_room = opt->opt_nflen + opt->opt_flen;
		seg_len += head_room;
		head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);

		if (skb_headroom(skb) < head_room) {
			struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
180
			if (!skb2) {
E
Eric Dumazet 已提交
181
				IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
182 183
					      IPSTATS_MIB_OUTDISCARDS);
				kfree_skb(skb);
L
Linus Torvalds 已提交
184 185
				return -ENOBUFS;
			}
186
			consume_skb(skb);
187
			skb = skb2;
188
			skb_set_owner_w(skb, sk);
L
Linus Torvalds 已提交
189 190 191 192 193 194 195
		}
		if (opt->opt_flen)
			ipv6_push_frag_opts(skb, opt, &proto);
		if (opt->opt_nflen)
			ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
	}

196 197
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
198
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
199 200 201 202

	/*
	 *	Fill in the IPv6 header
	 */
203
	if (np)
L
Linus Torvalds 已提交
204 205
		hlimit = np->hop_limit;
	if (hlimit < 0)
206
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
207

208
	ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
209
						     np->autoflowlabel, fl6));
210

L
Linus Torvalds 已提交
211 212 213 214
	hdr->payload_len = htons(seg_len);
	hdr->nexthdr = proto;
	hdr->hop_limit = hlimit;

A
Alexey Dobriyan 已提交
215 216
	hdr->saddr = fl6->saddr;
	hdr->daddr = *first_hop;
L
Linus Torvalds 已提交
217

218
	skb->protocol = htons(ETH_P_IPV6);
219
	skb->priority = sk->sk_priority;
220
	skb->mark = sk->sk_mark;
221

L
Linus Torvalds 已提交
222
	mtu = dst_mtu(dst);
W
WANG Cong 已提交
223
	if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
E
Eric Dumazet 已提交
224
		IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
225
			      IPSTATS_MIB_OUT, skb->len);
226
		return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, sk, skb,
227
			       NULL, dst->dev, dst_output);
L
Linus Torvalds 已提交
228 229 230
	}

	skb->dev = dst->dev;
231
	ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
E
Eric Dumazet 已提交
232
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
233 234 235
	kfree_skb(skb);
	return -EMSGSIZE;
}
236 237
EXPORT_SYMBOL(ip6_xmit);

L
Linus Torvalds 已提交
238 239 240 241 242 243 244 245
static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
{
	struct ip6_ra_chain *ra;
	struct sock *last = NULL;

	read_lock(&ip6_ra_lock);
	for (ra = ip6_ra_chain; ra; ra = ra->next) {
		struct sock *sk = ra->sk;
246 247 248
		if (sk && ra->sel == sel &&
		    (!sk->sk_bound_dev_if ||
		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
L
Linus Torvalds 已提交
249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266
			if (last) {
				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
				if (skb2)
					rawv6_rcv(last, skb2);
			}
			last = sk;
		}
	}

	if (last) {
		rawv6_rcv(last, skb);
		read_unlock(&ip6_ra_lock);
		return 1;
	}
	read_unlock(&ip6_ra_lock);
	return 0;
}

267 268
static int ip6_forward_proxy_check(struct sk_buff *skb)
{
269
	struct ipv6hdr *hdr = ipv6_hdr(skb);
270
	u8 nexthdr = hdr->nexthdr;
271
	__be16 frag_off;
272 273 274
	int offset;

	if (ipv6_ext_hdr(nexthdr)) {
275
		offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
276 277 278 279 280 281 282 283
		if (offset < 0)
			return 0;
	} else
		offset = sizeof(struct ipv6hdr);

	if (nexthdr == IPPROTO_ICMPV6) {
		struct icmp6hdr *icmp6;

284 285
		if (!pskb_may_pull(skb, (skb_network_header(skb) +
					 offset + 1 - skb->data)))
286 287
			return 0;

288
		icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305

		switch (icmp6->icmp6_type) {
		case NDISC_ROUTER_SOLICITATION:
		case NDISC_ROUTER_ADVERTISEMENT:
		case NDISC_NEIGHBOUR_SOLICITATION:
		case NDISC_NEIGHBOUR_ADVERTISEMENT:
		case NDISC_REDIRECT:
			/* For reaction involving unicast neighbor discovery
			 * message destined to the proxied address, pass it to
			 * input function.
			 */
			return 1;
		default:
			break;
		}
	}

306 307 308 309 310 311 312 313 314 315
	/*
	 * The proxying router can't forward traffic sent to a link-local
	 * address, so signal the sender and discard the packet. This
	 * behavior is clarified by the MIPv6 specification.
	 */
	if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
		dst_link_failure(skb);
		return -1;
	}

316 317 318
	return 0;
}

319
static inline int ip6_forward_finish(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
320
{
321
	skb_sender_cpu_clear(skb);
322
	return dst_output(sk, skb);
L
Linus Torvalds 已提交
323 324
}

325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345
static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
{
	unsigned int mtu;
	struct inet6_dev *idev;

	if (dst_metric_locked(dst, RTAX_MTU)) {
		mtu = dst_metric_raw(dst, RTAX_MTU);
		if (mtu)
			return mtu;
	}

	mtu = IPV6_MIN_MTU;
	rcu_read_lock();
	idev = __in6_dev_get(dst->dev);
	if (idev)
		mtu = idev->cnf.mtu6;
	rcu_read_unlock();

	return mtu;
}

346 347
static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
{
348
	if (skb->len <= mtu)
349 350
		return false;

W
WANG Cong 已提交
351
	/* ipv6 conntrack defrag sets max_frag_size + ignore_df */
352 353 354
	if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
		return true;

W
WANG Cong 已提交
355
	if (skb->ignore_df)
356 357
		return false;

358 359 360 361 362 363
	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
		return false;

	return true;
}

L
Linus Torvalds 已提交
364 365
int ip6_forward(struct sk_buff *skb)
{
E
Eric Dumazet 已提交
366
	struct dst_entry *dst = skb_dst(skb);
367
	struct ipv6hdr *hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
368
	struct inet6_skb_parm *opt = IP6CB(skb);
369
	struct net *net = dev_net(dst->dev);
370
	u32 mtu;
371

372
	if (net->ipv6.devconf_all->forwarding == 0)
L
Linus Torvalds 已提交
373 374
		goto error;

375 376 377
	if (skb->pkt_type != PACKET_HOST)
		goto drop;

378 379 380
	if (skb_warn_if_lro(skb))
		goto drop;

L
Linus Torvalds 已提交
381
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
382 383
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
384 385 386
		goto drop;
	}

387
	skb_forward_csum(skb);
L
Linus Torvalds 已提交
388 389 390 391 392 393 394 395 396 397 398 399 400 401

	/*
	 *	We DO NOT make any processing on
	 *	RA packets, pushing them to user level AS IS
	 *	without ane WARRANTY that application will be able
	 *	to interpret them. The reason is that we
	 *	cannot make anything clever here.
	 *
	 *	We are not end-node, so that if packet contains
	 *	AH/ESP, we cannot make anything.
	 *	Defragmentation also would be mistake, RA packets
	 *	cannot be fragmented, because there is no warranty
	 *	that different fragments will go along one path. --ANK
	 */
402 403
	if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
		if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
L
Linus Torvalds 已提交
404 405 406 407 408 409 410 411 412
			return 0;
	}

	/*
	 *	check and decrement ttl
	 */
	if (hdr->hop_limit <= 1) {
		/* Force OUTPUT device used as source address */
		skb->dev = dst->dev;
413
		icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
414 415
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INHDRERRORS);
L
Linus Torvalds 已提交
416 417 418 419 420

		kfree_skb(skb);
		return -ETIMEDOUT;
	}

421
	/* XXX: idev->cnf.proxy_ndp? */
422
	if (net->ipv6.devconf_all->proxy_ndp &&
423
	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
424 425
		int proxied = ip6_forward_proxy_check(skb);
		if (proxied > 0)
426
			return ip6_input(skb);
427
		else if (proxied < 0) {
428 429
			IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
					 IPSTATS_MIB_INDISCARDS);
430 431
			goto drop;
		}
432 433
	}

L
Linus Torvalds 已提交
434
	if (!xfrm6_route_forward(skb)) {
435 436
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INDISCARDS);
L
Linus Torvalds 已提交
437 438
		goto drop;
	}
E
Eric Dumazet 已提交
439
	dst = skb_dst(skb);
L
Linus Torvalds 已提交
440 441 442

	/* IPv6 specs say nothing about it, but it is clear that we cannot
	   send redirects to source routed frames.
443
	   We don't send redirects to frames decapsulated from IPsec.
L
Linus Torvalds 已提交
444
	 */
445
	if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
L
Linus Torvalds 已提交
446
		struct in6_addr *target = NULL;
447
		struct inet_peer *peer;
L
Linus Torvalds 已提交
448 449 450 451 452 453 454 455
		struct rt6_info *rt;

		/*
		 *	incoming and outgoing devices are the same
		 *	send a redirect.
		 */

		rt = (struct rt6_info *) dst;
456 457
		if (rt->rt6i_flags & RTF_GATEWAY)
			target = &rt->rt6i_gateway;
L
Linus Torvalds 已提交
458 459 460
		else
			target = &hdr->daddr;

461
		peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
462

L
Linus Torvalds 已提交
463 464 465
		/* Limit redirects both by destination (here)
		   and by source (inside ndisc_send_redirect)
		 */
466
		if (inet_peer_xrlim_allow(peer, 1*HZ))
467
			ndisc_send_redirect(skb, target);
468 469
		if (peer)
			inet_putpeer(peer);
470 471 472
	} else {
		int addrtype = ipv6_addr_type(&hdr->saddr);

L
Linus Torvalds 已提交
473
		/* This check is security critical. */
474 475
		if (addrtype == IPV6_ADDR_ANY ||
		    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
476 477 478
			goto error;
		if (addrtype & IPV6_ADDR_LINKLOCAL) {
			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
479
				    ICMPV6_NOT_NEIGHBOUR, 0);
480 481
			goto error;
		}
L
Linus Torvalds 已提交
482 483
	}

484
	mtu = ip6_dst_mtu_forward(dst);
485 486 487
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;

488
	if (ip6_pkt_too_big(skb, mtu)) {
L
Linus Torvalds 已提交
489 490
		/* Again, force OUTPUT device used as source address */
		skb->dev = dst->dev;
491
		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
492 493 494 495
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_INTOOBIGERRORS);
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
496 497 498 499 500
		kfree_skb(skb);
		return -EMSGSIZE;
	}

	if (skb_cow(skb, dst->dev->hard_header_len)) {
501 502
		IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
				 IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
503 504 505
		goto drop;
	}

506
	hdr = ipv6_hdr(skb);
L
Linus Torvalds 已提交
507 508

	/* Mangling hops number delayed to point after skb COW */
509

L
Linus Torvalds 已提交
510 511
	hdr->hop_limit--;

512
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
513
	IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
514 515
	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, NULL, skb,
		       skb->dev, dst->dev,
516
		       ip6_forward_finish);
L
Linus Torvalds 已提交
517 518

error:
519
	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
L
Linus Torvalds 已提交
520 521 522 523 524 525 526 527 528 529
drop:
	kfree_skb(skb);
	return -EINVAL;
}

static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
{
	to->pkt_type = from->pkt_type;
	to->priority = from->priority;
	to->protocol = from->protocol;
E
Eric Dumazet 已提交
530 531
	skb_dst_drop(to);
	skb_dst_set(to, dst_clone(skb_dst(from)));
L
Linus Torvalds 已提交
532
	to->dev = from->dev;
T
Thomas Graf 已提交
533
	to->mark = from->mark;
L
Linus Torvalds 已提交
534 535 536 537

#ifdef CONFIG_NET_SCHED
	to->tc_index = from->tc_index;
#endif
538
	nf_copy(to, from);
539
	skb_copy_secmark(to, from);
L
Linus Torvalds 已提交
540 541
}

542 543
int ip6_fragment(struct sock *sk, struct sk_buff *skb,
		 int (*output)(struct sock *, struct sk_buff *))
L
Linus Torvalds 已提交
544 545
{
	struct sk_buff *frag;
546
	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
547 548
	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
				inet6_sk(skb->sk) : NULL;
L
Linus Torvalds 已提交
549 550 551
	struct ipv6hdr *tmp_hdr;
	struct frag_hdr *fh;
	unsigned int mtu, hlen, left, len;
552
	int hroom, troom;
553
	__be32 frag_id;
554
	int ptr, offset = 0, err = 0;
L
Linus Torvalds 已提交
555
	u8 *prevhdr, nexthdr = 0;
E
Eric Dumazet 已提交
556
	struct net *net = dev_net(skb_dst(skb)->dev);
L
Linus Torvalds 已提交
557 558 559 560

	hlen = ip6_find_1stfragopt(skb, &prevhdr);
	nexthdr = *prevhdr;

J
John Heffner 已提交
561
	mtu = ip6_skb_dst_mtu(skb);
562 563

	/* We must not fragment if the socket is set to force MTU discovery
564
	 * or if the skb it not generated by a local socket.
565
	 */
566 567
	if (unlikely(!skb->ignore_df && skb->len > mtu))
		goto fail_toobig;
568

569 570 571 572 573 574 575 576
	if (IP6CB(skb)->frag_max_size) {
		if (IP6CB(skb)->frag_max_size > mtu)
			goto fail_toobig;

		/* don't send fragments larger than what we received */
		mtu = IP6CB(skb)->frag_max_size;
		if (mtu < IPV6_MIN_MTU)
			mtu = IPV6_MIN_MTU;
577 578
	}

579 580 581 582 583
	if (np && np->frag_size < mtu) {
		if (np->frag_size)
			mtu = np->frag_size;
	}
	mtu -= hlen + sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
584

585 586
	frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
				    &ipv6_hdr(skb)->saddr);
587

588
	if (skb_has_frag_list(skb)) {
L
Linus Torvalds 已提交
589
		int first_len = skb_pagelen(skb);
590
		struct sk_buff *frag2;
L
Linus Torvalds 已提交
591 592 593 594 595 596

		if (first_len - hlen > mtu ||
		    ((first_len - hlen) & 7) ||
		    skb_cloned(skb))
			goto slow_path;

597
		skb_walk_frags(skb, frag) {
L
Linus Torvalds 已提交
598 599 600 601
			/* Correct geometry. */
			if (frag->len > mtu ||
			    ((frag->len & 7) && frag->next) ||
			    skb_headroom(frag) < hlen)
602
				goto slow_path_clean;
L
Linus Torvalds 已提交
603 604 605

			/* Partially cloned skb? */
			if (skb_shared(frag))
606
				goto slow_path_clean;
607 608 609 610 611 612

			BUG_ON(frag->sk);
			if (skb->sk) {
				frag->sk = skb->sk;
				frag->destructor = sock_wfree;
			}
613
			skb->truesize -= frag->truesize;
L
Linus Torvalds 已提交
614 615 616 617 618
		}

		err = 0;
		offset = 0;
		frag = skb_shinfo(skb)->frag_list;
619
		skb_frag_list_init(skb);
L
Linus Torvalds 已提交
620 621
		/* BUILD HEADER */

Y
YOSHIFUJI Hideaki 已提交
622
		*prevhdr = NEXTHDR_FRAGMENT;
623
		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
L
Linus Torvalds 已提交
624
		if (!tmp_hdr) {
E
Eric Dumazet 已提交
625
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
626
				      IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
627 628 629 630
			return -ENOMEM;
		}

		__skb_pull(skb, hlen);
631
		fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
632 633
		__skb_push(skb, hlen);
		skb_reset_network_header(skb);
634
		memcpy(skb_network_header(skb), tmp_hdr, hlen);
L
Linus Torvalds 已提交
635 636 637 638

		fh->nexthdr = nexthdr;
		fh->reserved = 0;
		fh->frag_off = htons(IP6_MF);
639
		fh->identification = frag_id;
L
Linus Torvalds 已提交
640 641 642 643

		first_len = skb_pagelen(skb);
		skb->data_len = first_len - skb_headlen(skb);
		skb->len = first_len;
644 645
		ipv6_hdr(skb)->payload_len = htons(first_len -
						   sizeof(struct ipv6hdr));
646

647
		dst_hold(&rt->dst);
L
Linus Torvalds 已提交
648 649 650 651 652 653

		for (;;) {
			/* Prepare header of the next frame,
			 * before previous one went down. */
			if (frag) {
				frag->ip_summed = CHECKSUM_NONE;
654
				skb_reset_transport_header(frag);
655
				fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));
656 657
				__skb_push(frag, hlen);
				skb_reset_network_header(frag);
658 659
				memcpy(skb_network_header(frag), tmp_hdr,
				       hlen);
L
Linus Torvalds 已提交
660 661 662 663
				offset += skb->len - hlen - sizeof(struct frag_hdr);
				fh->nexthdr = nexthdr;
				fh->reserved = 0;
				fh->frag_off = htons(offset);
664
				if (frag->next)
L
Linus Torvalds 已提交
665 666
					fh->frag_off |= htons(IP6_MF);
				fh->identification = frag_id;
667 668 669
				ipv6_hdr(frag)->payload_len =
						htons(frag->len -
						      sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
670 671
				ip6_copy_metadata(frag, skb);
			}
672

673
			err = output(sk, skb);
674
			if (!err)
675
				IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
676
					      IPSTATS_MIB_FRAGCREATES);
677

L
Linus Torvalds 已提交
678 679 680 681 682 683 684 685
			if (err || !frag)
				break;

			skb = frag;
			frag = skb->next;
			skb->next = NULL;
		}

J
Jesper Juhl 已提交
686
		kfree(tmp_hdr);
L
Linus Torvalds 已提交
687 688

		if (err == 0) {
689
			IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
690
				      IPSTATS_MIB_FRAGOKS);
A
Amerigo Wang 已提交
691
			ip6_rt_put(rt);
L
Linus Torvalds 已提交
692 693 694
			return 0;
		}

695
		kfree_skb_list(frag);
L
Linus Torvalds 已提交
696

697
		IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
698
			      IPSTATS_MIB_FRAGFAILS);
A
Amerigo Wang 已提交
699
		ip6_rt_put(rt);
L
Linus Torvalds 已提交
700
		return err;
701 702 703 704 705 706 707 708 709

slow_path_clean:
		skb_walk_frags(skb, frag2) {
			if (frag2 == frag)
				break;
			frag2->sk = NULL;
			frag2->destructor = NULL;
			skb->truesize += frag2->truesize;
		}
L
Linus Torvalds 已提交
710 711 712
	}

slow_path:
713 714 715 716
	if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
	    skb_checksum_help(skb))
		goto fail;

L
Linus Torvalds 已提交
717 718 719 720 721 722 723 724
	left = skb->len - hlen;		/* Space per frame */
	ptr = hlen;			/* Where to start from */

	/*
	 *	Fragment the datagram.
	 */

	*prevhdr = NEXTHDR_FRAGMENT;
725 726
	hroom = LL_RESERVED_SPACE(rt->dst.dev);
	troom = rt->dst.dev->needed_tailroom;
L
Linus Torvalds 已提交
727 728 729 730

	/*
	 *	Keep copying data until we run out.
	 */
731
	while (left > 0)	{
L
Linus Torvalds 已提交
732 733 734 735
		len = left;
		/* IF: it doesn't fit, use 'mtu' - the data space left */
		if (len > mtu)
			len = mtu;
L
Lucas De Marchi 已提交
736
		/* IF: we are not sending up to and including the packet end
L
Linus Torvalds 已提交
737 738 739 740 741
		   then align the next start on an eight byte boundary */
		if (len < left)	{
			len &= ~7;
		}

742 743 744 745
		/* Allocate buffer */
		frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
				 hroom + troom, GFP_ATOMIC);
		if (!frag) {
E
Eric Dumazet 已提交
746
			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
747
				      IPSTATS_MIB_FRAGFAILS);
L
Linus Torvalds 已提交
748 749 750 751 752 753 754 755 756
			err = -ENOMEM;
			goto fail;
		}

		/*
		 *	Set up data on packet
		 */

		ip6_copy_metadata(frag, skb);
757
		skb_reserve(frag, hroom);
L
Linus Torvalds 已提交
758
		skb_put(frag, len + hlen + sizeof(struct frag_hdr));
759
		skb_reset_network_header(frag);
760
		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
761 762
		frag->transport_header = (frag->network_header + hlen +
					  sizeof(struct frag_hdr));
L
Linus Torvalds 已提交
763 764 765 766 767 768 769 770 771 772 773

		/*
		 *	Charge the memory for the fragment to any owner
		 *	it might possess
		 */
		if (skb->sk)
			skb_set_owner_w(frag, skb->sk);

		/*
		 *	Copy the packet header into the new buffer.
		 */
774
		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
L
Linus Torvalds 已提交
775 776 777 778 779 780

		/*
		 *	Build fragment header.
		 */
		fh->nexthdr = nexthdr;
		fh->reserved = 0;
781
		fh->identification = frag_id;
L
Linus Torvalds 已提交
782 783 784 785

		/*
		 *	Copy a block of the IP datagram.
		 */
H
Himangi Saraogi 已提交
786 787
		BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),
				     len));
L
Linus Torvalds 已提交
788 789 790 791 792
		left -= len;

		fh->frag_off = htons(offset);
		if (left > 0)
			fh->frag_off |= htons(IP6_MF);
793 794
		ipv6_hdr(frag)->payload_len = htons(frag->len -
						    sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
795 796 797 798 799 800 801

		ptr += len;
		offset += len;

		/*
		 *	Put this fragment into the sending queue.
		 */
802
		err = output(sk, frag);
L
Linus Torvalds 已提交
803 804
		if (err)
			goto fail;
805

E
Eric Dumazet 已提交
806
		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
807
			      IPSTATS_MIB_FRAGCREATES);
L
Linus Torvalds 已提交
808
	}
E
Eric Dumazet 已提交
809
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
810
		      IPSTATS_MIB_FRAGOKS);
811
	consume_skb(skb);
L
Linus Torvalds 已提交
812 813
	return err;

814 815 816 817 818 819 820 821
fail_toobig:
	if (skb->sk && dst_allfrag(skb_dst(skb)))
		sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);

	skb->dev = skb_dst(skb)->dev;
	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
	err = -EMSGSIZE;

L
Linus Torvalds 已提交
822
fail:
E
Eric Dumazet 已提交
823
	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
824
		      IPSTATS_MIB_FRAGFAILS);
825
	kfree_skb(skb);
L
Linus Torvalds 已提交
826 827 828
	return err;
}

829 830 831
static inline int ip6_rt_check(const struct rt6key *rt_key,
			       const struct in6_addr *fl_addr,
			       const struct in6_addr *addr_cache)
832
{
E
Eric Dumazet 已提交
833
	return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
834
		(!addr_cache || !ipv6_addr_equal(fl_addr, addr_cache));
835 836
}

837 838
static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
					  struct dst_entry *dst,
839
					  const struct flowi6 *fl6)
L
Linus Torvalds 已提交
840
{
841
	struct ipv6_pinfo *np = inet6_sk(sk);
842
	struct rt6_info *rt;
L
Linus Torvalds 已提交
843

844 845 846
	if (!dst)
		goto out;

847 848 849 850 851 852
	if (dst->ops->family != AF_INET6) {
		dst_release(dst);
		return NULL;
	}

	rt = (struct rt6_info *)dst;
853 854 855
	/* Yes, checking route validity in not connected
	 * case is not very simple. Take into account,
	 * that we do not support routing by source, TOS,
856
	 * and MSG_DONTROUTE		--ANK (980726)
857
	 *
858 859
	 * 1. ip6_rt_check(): If route was host route,
	 *    check that cached destination is current.
860 861 862 863 864 865 866 867 868 869
	 *    If it is network route, we still may
	 *    check its validity using saved pointer
	 *    to the last used address: daddr_cache.
	 *    We do not want to save whole address now,
	 *    (because main consumer of this service
	 *    is tcp, which has not this problem),
	 *    so that the last trick works only on connected
	 *    sockets.
	 * 2. oif also should be the same.
	 */
870
	if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
871
#ifdef CONFIG_IPV6_SUBTREES
872
	    ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
873
#endif
874
	    (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
875 876
		dst_release(dst);
		dst = NULL;
L
Linus Torvalds 已提交
877 878
	}

879 880 881 882
out:
	return dst;
}

883
static int ip6_dst_lookup_tail(struct net *net, struct sock *sk,
884
			       struct dst_entry **dst, struct flowi6 *fl6)
885
{
886 887
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
	struct neighbour *n;
888
	struct rt6_info *rt;
889 890
#endif
	int err;
891

892 893 894 895 896 897 898 899 900 901 902 903
	/* The correct way to handle this would be to do
	 * ip6_route_get_saddr, and then ip6_route_output; however,
	 * the route-specific preferred source forces the
	 * ip6_route_output call _before_ ip6_route_get_saddr.
	 *
	 * In source specific routing (no src=any default route),
	 * ip6_route_output will fail given src=any saddr, though, so
	 * that's why we try it again later.
	 */
	if (ipv6_addr_any(&fl6->saddr) && (!*dst || !(*dst)->error)) {
		struct rt6_info *rt;
		bool had_dst = *dst != NULL;
L
Linus Torvalds 已提交
904

905 906 907
		if (!had_dst)
			*dst = ip6_route_output(net, sk, fl6);
		rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
908 909 910
		err = ip6_route_get_saddr(net, rt, &fl6->daddr,
					  sk ? inet6_sk(sk)->srcprefs : 0,
					  &fl6->saddr);
911
		if (err)
L
Linus Torvalds 已提交
912
			goto out_err_release;
913 914 915 916 917 918 919 920 921

		/* If we had an erroneous initial result, pretend it
		 * never existed and let the SA-enabled version take
		 * over.
		 */
		if (!had_dst && (*dst)->error) {
			dst_release(*dst);
			*dst = NULL;
		}
L
Linus Torvalds 已提交
922 923
	}

924 925 926 927 928 929 930
	if (!*dst)
		*dst = ip6_route_output(net, sk, fl6);

	err = (*dst)->error;
	if (err)
		goto out_err_release;

931
#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
932 933 934 935 936 937 938 939
	/*
	 * Here if the dst entry we've looked up
	 * has a neighbour entry that is in the INCOMPLETE
	 * state and the src address from the flow is
	 * marked as OPTIMISTIC, we release the found
	 * dst entry and replace it instead with the
	 * dst entry of the nexthop router
	 */
940
	rt = (struct rt6_info *) *dst;
941
	rcu_read_lock_bh();
942 943
	n = __ipv6_neigh_lookup_noref(rt->dst.dev,
				      rt6_nexthop(rt, &fl6->daddr));
944 945 946 947
	err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
	rcu_read_unlock_bh();

	if (err) {
948
		struct inet6_ifaddr *ifp;
949
		struct flowi6 fl_gw6;
950 951
		int redirect;

952
		ifp = ipv6_get_ifaddr(net, &fl6->saddr,
953 954 955 956 957 958 959 960 961 962 963 964
				      (*dst)->dev, 1);

		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
		if (ifp)
			in6_ifa_put(ifp);

		if (redirect) {
			/*
			 * We need to get the dst entry for the
			 * default router instead
			 */
			dst_release(*dst);
965 966 967
			memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
			memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
			*dst = ip6_route_output(net, sk, &fl_gw6);
968 969
			err = (*dst)->error;
			if (err)
970
				goto out_err_release;
971
		}
972
	}
973 974
#endif

L
Linus Torvalds 已提交
975 976 977
	return 0;

out_err_release:
978
	if (err == -ENETUNREACH)
979
		IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
980 981 982 983
	dst_release(*dst);
	*dst = NULL;
	return err;
}
A
Adrian Bunk 已提交
984

985 986 987 988
/**
 *	ip6_dst_lookup - perform route lookup on flow
 *	@sk: socket which provides route info
 *	@dst: pointer to dst_entry * for result
989
 *	@fl6: flow to lookup
990 991 992 993 994
 *
 *	This function performs a route lookup on the given flow.
 *
 *	It returns zero on success, or a standard errno code on error.
 */
995 996
int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
		   struct flowi6 *fl6)
997 998
{
	*dst = NULL;
999
	return ip6_dst_lookup_tail(net, sk, dst, fl6);
1000
}
1001 1002
EXPORT_SYMBOL_GPL(ip6_dst_lookup);

1003
/**
1004 1005
 *	ip6_dst_lookup_flow - perform route lookup on flow with ipsec
 *	@sk: socket which provides route info
1006
 *	@fl6: flow to lookup
1007 1008 1009 1010 1011 1012 1013
 *	@final_dst: final destination address for ipsec lookup
 *
 *	This function performs a route lookup on the given flow.
 *
 *	It returns a valid dst pointer on success, or a pointer encoded
 *	error code.
 */
1014
struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1015
				      const struct in6_addr *final_dst)
1016 1017 1018 1019
{
	struct dst_entry *dst = NULL;
	int err;

1020
	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1021 1022 1023
	if (err)
		return ERR_PTR(err);
	if (final_dst)
A
Alexey Dobriyan 已提交
1024
		fl6->daddr = *final_dst;
1025 1026
	if (!fl6->flowi6_oif)
		fl6->flowi6_oif = dst->dev->ifindex;
1027

1028
	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1029 1030 1031 1032 1033
}
EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);

/**
 *	ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1034
 *	@sk: socket which provides the dst cache and route info
1035
 *	@fl6: flow to lookup
1036
 *	@final_dst: final destination address for ipsec lookup
1037 1038 1039 1040 1041 1042
 *
 *	This function performs a route lookup on the given flow with the
 *	possibility of using the cached route in the socket if it is valid.
 *	It will take the socket dst lock when operating on the dst cache.
 *	As a result, this function can only be used in process context.
 *
1043 1044
 *	It returns a valid dst pointer on success, or a pointer encoded
 *	error code.
1045
 */
1046
struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1047
					 const struct in6_addr *final_dst)
1048
{
1049 1050
	struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
	int err;
1051

1052
	dst = ip6_sk_dst_check(sk, dst, fl6);
1053

1054
	err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1055 1056 1057
	if (err)
		return ERR_PTR(err);
	if (final_dst)
A
Alexey Dobriyan 已提交
1058
		fl6->daddr = *final_dst;
1059

1060
	return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1061
}
1062
EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1063

A
Adrian Bunk 已提交
1064
static inline int ip6_ufo_append_data(struct sock *sk,
1065
			struct sk_buff_head *queue,
1066 1067 1068
			int getfrag(void *from, char *to, int offset, int len,
			int odd, struct sk_buff *skb),
			void *from, int length, int hh_len, int fragheaderlen,
1069
			int transhdrlen, int mtu, unsigned int flags,
1070
			const struct flowi6 *fl6)
1071 1072 1073 1074 1075 1076 1077 1078 1079

{
	struct sk_buff *skb;
	int err;

	/* There is support for UDP large send offload by network
	 * device, so create one single skb packet containing complete
	 * udp datagram
	 */
1080
	skb = skb_peek_tail(queue);
1081
	if (!skb) {
1082 1083 1084
		skb = sock_alloc_send_skb(sk,
			hh_len + fragheaderlen + transhdrlen + 20,
			(flags & MSG_DONTWAIT), &err);
1085
		if (!skb)
1086
			return err;
1087 1088 1089 1090 1091

		/* reserve space for Hardware header */
		skb_reserve(skb, hh_len);

		/* create space for UDP/IP header */
1092
		skb_put(skb, fragheaderlen + transhdrlen);
1093 1094

		/* initialize network header pointer */
1095
		skb_reset_network_header(skb);
1096 1097

		/* initialize protocol header pointer */
1098
		skb->transport_header = skb->network_header + fragheaderlen;
1099

1100
		skb->protocol = htons(ETH_P_IPV6);
1101 1102
		skb->csum = 0;

1103
		__skb_queue_tail(queue, skb);
1104 1105
	} else if (skb_is_gso(skb)) {
		goto append;
1106 1107
	}

1108 1109 1110 1111 1112 1113 1114
	skb->ip_summed = CHECKSUM_PARTIAL;
	/* Specify the length of each IPv6 datagram fragment.
	 * It has to be a multiple of 8.
	 */
	skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
				     sizeof(struct frag_hdr)) & ~7;
	skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1115 1116 1117
	skb_shinfo(skb)->ip6_frag_id = ipv6_select_ident(sock_net(sk),
							 &fl6->daddr,
							 &fl6->saddr);
1118 1119

append:
1120 1121
	return skb_append_datato_frags(sk, skb, getfrag, from,
				       (length - transhdrlen));
1122
}
L
Linus Torvalds 已提交
1123

1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135
static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
					       gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
						gfp_t gfp)
{
	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
}

1136
static void ip6_append_data_mtu(unsigned int *mtu,
G
Gao feng 已提交
1137 1138 1139
				int *maxfraglen,
				unsigned int fragheaderlen,
				struct sk_buff *skb,
1140
				struct rt6_info *rt,
1141
				unsigned int orig_mtu)
G
Gao feng 已提交
1142 1143
{
	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1144
		if (!skb) {
G
Gao feng 已提交
1145
			/* first fragment, reserve header_len */
1146
			*mtu = orig_mtu - rt->dst.header_len;
G
Gao feng 已提交
1147 1148 1149 1150 1151 1152

		} else {
			/*
			 * this fragment is not first, the headers
			 * space is regarded as data space.
			 */
1153
			*mtu = orig_mtu;
G
Gao feng 已提交
1154 1155 1156 1157 1158 1159
		}
		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
			      + fragheaderlen - sizeof(struct frag_hdr);
	}
}

1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175
static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
			  struct inet6_cork *v6_cork,
			  int hlimit, int tclass, struct ipv6_txoptions *opt,
			  struct rt6_info *rt, struct flowi6 *fl6)
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	unsigned int mtu;

	/*
	 * setup for corking
	 */
	if (opt) {
		if (WARN_ON(v6_cork->opt))
			return -EINVAL;

		v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation);
1176
		if (unlikely(!v6_cork->opt))
1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227
			return -ENOBUFS;

		v6_cork->opt->tot_len = opt->tot_len;
		v6_cork->opt->opt_flen = opt->opt_flen;
		v6_cork->opt->opt_nflen = opt->opt_nflen;

		v6_cork->opt->dst0opt = ip6_opt_dup(opt->dst0opt,
						    sk->sk_allocation);
		if (opt->dst0opt && !v6_cork->opt->dst0opt)
			return -ENOBUFS;

		v6_cork->opt->dst1opt = ip6_opt_dup(opt->dst1opt,
						    sk->sk_allocation);
		if (opt->dst1opt && !v6_cork->opt->dst1opt)
			return -ENOBUFS;

		v6_cork->opt->hopopt = ip6_opt_dup(opt->hopopt,
						   sk->sk_allocation);
		if (opt->hopopt && !v6_cork->opt->hopopt)
			return -ENOBUFS;

		v6_cork->opt->srcrt = ip6_rthdr_dup(opt->srcrt,
						    sk->sk_allocation);
		if (opt->srcrt && !v6_cork->opt->srcrt)
			return -ENOBUFS;

		/* need source address above miyazawa*/
	}
	dst_hold(&rt->dst);
	cork->base.dst = &rt->dst;
	cork->fl.u.ip6 = *fl6;
	v6_cork->hop_limit = hlimit;
	v6_cork->tclass = tclass;
	if (rt->dst.flags & DST_XFRM_TUNNEL)
		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
		      rt->dst.dev->mtu : dst_mtu(&rt->dst);
	else
		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
		      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
	if (np->frag_size < mtu) {
		if (np->frag_size)
			mtu = np->frag_size;
	}
	cork->base.fragsize = mtu;
	if (dst_allfrag(rt->dst.path))
		cork->base.flags |= IPCORK_ALLFRAG;
	cork->base.length = 0;

	return 0;
}

1228 1229 1230 1231 1232 1233 1234 1235 1236 1237
static int __ip6_append_data(struct sock *sk,
			     struct flowi6 *fl6,
			     struct sk_buff_head *queue,
			     struct inet_cork *cork,
			     struct inet6_cork *v6_cork,
			     struct page_frag *pfrag,
			     int getfrag(void *from, char *to, int offset,
					 int len, int odd, struct sk_buff *skb),
			     void *from, int length, int transhdrlen,
			     unsigned int flags, int dontfrag)
L
Linus Torvalds 已提交
1238
{
G
Gao feng 已提交
1239
	struct sk_buff *skb, *skb_prev = NULL;
1240
	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1241 1242
	int exthdrlen = 0;
	int dst_exthdrlen = 0;
L
Linus Torvalds 已提交
1243 1244 1245 1246
	int hh_len;
	int copy;
	int err;
	int offset = 0;
1247
	__u8 tx_flags = 0;
1248
	u32 tskey = 0;
1249 1250
	struct rt6_info *rt = (struct rt6_info *)cork->dst;
	struct ipv6_txoptions *opt = v6_cork->opt;
1251
	int csummode = CHECKSUM_NONE;
L
Linus Torvalds 已提交
1252

1253 1254 1255
	skb = skb_peek_tail(queue);
	if (!skb) {
		exthdrlen = opt ? opt->opt_flen : 0;
1256
		dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
L
Linus Torvalds 已提交
1257
	}
1258

1259
	mtu = cork->fragsize;
1260
	orig_mtu = mtu;
L
Linus Torvalds 已提交
1261

1262
	hh_len = LL_RESERVED_SPACE(rt->dst.dev);
L
Linus Torvalds 已提交
1263

1264
	fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1265
			(opt ? opt->opt_nflen : 0);
1266 1267
	maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
		     sizeof(struct frag_hdr);
L
Linus Torvalds 已提交
1268 1269

	if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1270 1271 1272
		unsigned int maxnonfragsize, headersize;

		headersize = sizeof(struct ipv6hdr) +
1273
			     (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1274 1275 1276 1277
			     (dst_allfrag(&rt->dst) ?
			      sizeof(struct frag_hdr) : 0) +
			     rt->rt6i_nfheader_len;

W
WANG Cong 已提交
1278
		if (ip6_sk_ignore_df(sk))
1279 1280 1281
			maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
		else
			maxnonfragsize = mtu;
1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296

		/* dontfrag active */
		if ((cork->length + length > mtu - headersize) && dontfrag &&
		    (sk->sk_protocol == IPPROTO_UDP ||
		     sk->sk_protocol == IPPROTO_RAW)) {
			ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
						   sizeof(struct ipv6hdr));
			goto emsgsize;
		}

		if (cork->length + length > maxnonfragsize - headersize) {
emsgsize:
			ipv6_local_error(sk, EMSGSIZE, fl6,
					 mtu - headersize +
					 sizeof(struct ipv6hdr));
L
Linus Torvalds 已提交
1297 1298 1299 1300
			return -EMSGSIZE;
		}
	}

1301
	if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_RAW) {
1302
		sock_tx_timestamp(sk, &tx_flags);
1303 1304 1305 1306
		if (tx_flags & SKBTX_ANY_SW_TSTAMP &&
		    sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
			tskey = sk->sk_tskey++;
	}
1307

1308 1309
	/* If this is the first and only packet and device
	 * supports checksum offloading, let's use it.
1310 1311
	 * Use transhdrlen, same as IPv4, because partial
	 * sums only work when transhdrlen is set.
1312
	 */
1313
	if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
1314 1315 1316 1317
	    length + fragheaderlen < mtu &&
	    rt->dst.dev->features & NETIF_F_V6_CSUM &&
	    !exthdrlen)
		csummode = CHECKSUM_PARTIAL;
L
Linus Torvalds 已提交
1318 1319 1320 1321 1322 1323 1324
	/*
	 * Let's try using as much space as possible.
	 * Use MTU if total length of the message fits into the MTU.
	 * Otherwise, we need to reserve fragment header and
	 * fragment alignment (= 8-15 octects, in total).
	 *
	 * Note that we may need to "move" the data from the tail of
1325
	 * of the buffer to the new fragment when we split
L
Linus Torvalds 已提交
1326 1327
	 * the message.
	 *
1328
	 * FIXME: It may be fragmented into multiple chunks
L
Linus Torvalds 已提交
1329 1330
	 *        at once if non-fragmentable extension headers
	 *        are too large.
1331
	 * --yoshfuji
L
Linus Torvalds 已提交
1332 1333
	 */

1334 1335 1336 1337
	cork->length += length;
	if (((length > mtu) ||
	     (skb && skb_is_gso(skb))) &&
	    (sk->sk_protocol == IPPROTO_UDP) &&
1338 1339
	    (rt->dst.dev->features & NETIF_F_UFO) &&
	    (sk->sk_type == SOCK_DGRAM)) {
1340
		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
1341
					  hh_len, fragheaderlen,
1342
					  transhdrlen, mtu, flags, fl6);
1343 1344 1345
		if (err)
			goto error;
		return 0;
1346
	}
L
Linus Torvalds 已提交
1347

1348
	if (!skb)
L
Linus Torvalds 已提交
1349 1350 1351 1352
		goto alloc_new_skb;

	while (length > 0) {
		/* Check if the remaining data fits into current packet. */
1353
		copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
L
Linus Torvalds 已提交
1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364
		if (copy < length)
			copy = maxfraglen - skb->len;

		if (copy <= 0) {
			char *data;
			unsigned int datalen;
			unsigned int fraglen;
			unsigned int fraggap;
			unsigned int alloclen;
alloc_new_skb:
			/* There's no room in the current skb */
G
Gao feng 已提交
1365 1366
			if (skb)
				fraggap = skb->len - maxfraglen;
L
Linus Torvalds 已提交
1367 1368
			else
				fraggap = 0;
G
Gao feng 已提交
1369
			/* update mtu and maxfraglen if necessary */
1370
			if (!skb || !skb_prev)
G
Gao feng 已提交
1371
				ip6_append_data_mtu(&mtu, &maxfraglen,
1372
						    fragheaderlen, skb, rt,
1373
						    orig_mtu);
G
Gao feng 已提交
1374 1375

			skb_prev = skb;
L
Linus Torvalds 已提交
1376 1377 1378 1379 1380 1381 1382

			/*
			 * If remaining data exceeds the mtu,
			 * we know we need more fragment(s).
			 */
			datalen = length + fraggap;

G
Gao feng 已提交
1383 1384
			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
L
Linus Torvalds 已提交
1385
			if ((flags & MSG_MORE) &&
1386
			    !(rt->dst.dev->features&NETIF_F_SG))
L
Linus Torvalds 已提交
1387 1388 1389 1390
				alloclen = mtu;
			else
				alloclen = datalen + fragheaderlen;

1391 1392
			alloclen += dst_exthdrlen;

G
Gao feng 已提交
1393 1394 1395 1396 1397 1398 1399 1400 1401 1402
			if (datalen != length + fraggap) {
				/*
				 * this is not the last fragment, the trailer
				 * space is regarded as data space.
				 */
				datalen += rt->dst.trailer_len;
			}

			alloclen += rt->dst.trailer_len;
			fraglen = datalen + fragheaderlen;
L
Linus Torvalds 已提交
1403 1404 1405

			/*
			 * We just reserve space for fragment header.
1406
			 * Note: this may be overallocation if the message
L
Linus Torvalds 已提交
1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421
			 * (without MSG_MORE) fits into the MTU.
			 */
			alloclen += sizeof(struct frag_hdr);

			if (transhdrlen) {
				skb = sock_alloc_send_skb(sk,
						alloclen + hh_len,
						(flags & MSG_DONTWAIT), &err);
			} else {
				skb = NULL;
				if (atomic_read(&sk->sk_wmem_alloc) <=
				    2 * sk->sk_sndbuf)
					skb = sock_wmalloc(sk,
							   alloclen + hh_len, 1,
							   sk->sk_allocation);
1422
				if (unlikely(!skb))
L
Linus Torvalds 已提交
1423 1424
					err = -ENOBUFS;
			}
1425
			if (!skb)
L
Linus Torvalds 已提交
1426 1427 1428 1429
				goto error;
			/*
			 *	Fill in the control structures
			 */
1430
			skb->protocol = htons(ETH_P_IPV6);
1431
			skb->ip_summed = csummode;
L
Linus Torvalds 已提交
1432
			skb->csum = 0;
1433 1434 1435
			/* reserve for fragmentation and ipsec header */
			skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
				    dst_exthdrlen);
L
Linus Torvalds 已提交
1436

1437 1438 1439
			/* Only the initial fragment is time stamped */
			skb_shinfo(skb)->tx_flags = tx_flags;
			tx_flags = 0;
1440 1441
			skb_shinfo(skb)->tskey = tskey;
			tskey = 0;
1442

L
Linus Torvalds 已提交
1443 1444 1445
			/*
			 *	Find where to start putting bytes
			 */
1446 1447 1448
			data = skb_put(skb, fraglen);
			skb_set_network_header(skb, exthdrlen);
			data += fragheaderlen;
1449 1450
			skb->transport_header = (skb->network_header +
						 fragheaderlen);
L
Linus Torvalds 已提交
1451 1452 1453 1454 1455 1456 1457
			if (fraggap) {
				skb->csum = skb_copy_and_csum_bits(
					skb_prev, maxfraglen,
					data + transhdrlen, fraggap, 0);
				skb_prev->csum = csum_sub(skb_prev->csum,
							  skb->csum);
				data += fraggap;
1458
				pskb_trim_unique(skb_prev, maxfraglen);
L
Linus Torvalds 已提交
1459 1460
			}
			copy = datalen - transhdrlen - fraggap;
1461

L
Linus Torvalds 已提交
1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475
			if (copy < 0) {
				err = -EINVAL;
				kfree_skb(skb);
				goto error;
			} else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
				err = -EFAULT;
				kfree_skb(skb);
				goto error;
			}

			offset += copy;
			length -= datalen - fraggap;
			transhdrlen = 0;
			exthdrlen = 0;
1476
			dst_exthdrlen = 0;
L
Linus Torvalds 已提交
1477 1478 1479 1480

			/*
			 * Put the packet on the pending queue
			 */
1481
			__skb_queue_tail(queue, skb);
L
Linus Torvalds 已提交
1482 1483 1484 1485 1486 1487
			continue;
		}

		if (copy > length)
			copy = length;

1488
		if (!(rt->dst.dev->features&NETIF_F_SG)) {
L
Linus Torvalds 已提交
1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500
			unsigned int off;

			off = skb->len;
			if (getfrag(from, skb_put(skb, copy),
						offset, copy, off, skb) < 0) {
				__skb_trim(skb, off);
				err = -EFAULT;
				goto error;
			}
		} else {
			int i = skb_shinfo(skb)->nr_frags;

1501 1502
			err = -ENOMEM;
			if (!sk_page_frag_refill(sk, pfrag))
L
Linus Torvalds 已提交
1503
				goto error;
1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514

			if (!skb_can_coalesce(skb, i, pfrag->page,
					      pfrag->offset)) {
				err = -EMSGSIZE;
				if (i == MAX_SKB_FRAGS)
					goto error;

				__skb_fill_page_desc(skb, i, pfrag->page,
						     pfrag->offset, 0);
				skb_shinfo(skb)->nr_frags = ++i;
				get_page(pfrag->page);
L
Linus Torvalds 已提交
1515
			}
1516
			copy = min_t(int, copy, pfrag->size - pfrag->offset);
E
Eric Dumazet 已提交
1517
			if (getfrag(from,
1518 1519 1520 1521 1522 1523
				    page_address(pfrag->page) + pfrag->offset,
				    offset, copy, skb->len, skb) < 0)
				goto error_efault;

			pfrag->offset += copy;
			skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
L
Linus Torvalds 已提交
1524 1525
			skb->len += copy;
			skb->data_len += copy;
1526 1527
			skb->truesize += copy;
			atomic_add(copy, &sk->sk_wmem_alloc);
L
Linus Torvalds 已提交
1528 1529 1530 1531
		}
		offset += copy;
		length -= copy;
	}
1532

L
Linus Torvalds 已提交
1533
	return 0;
1534 1535 1536

error_efault:
	err = -EFAULT;
L
Linus Torvalds 已提交
1537
error:
1538
	cork->length -= length;
1539
	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1540 1541
	return err;
}
1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577

int ip6_append_data(struct sock *sk,
		    int getfrag(void *from, char *to, int offset, int len,
				int odd, struct sk_buff *skb),
		    void *from, int length, int transhdrlen, int hlimit,
		    int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
		    struct rt6_info *rt, unsigned int flags, int dontfrag)
{
	struct inet_sock *inet = inet_sk(sk);
	struct ipv6_pinfo *np = inet6_sk(sk);
	int exthdrlen;
	int err;

	if (flags&MSG_PROBE)
		return 0;
	if (skb_queue_empty(&sk->sk_write_queue)) {
		/*
		 * setup for corking
		 */
		err = ip6_setup_cork(sk, &inet->cork, &np->cork, hlimit,
				     tclass, opt, rt, fl6);
		if (err)
			return err;

		exthdrlen = (opt ? opt->opt_flen : 0);
		length += exthdrlen;
		transhdrlen += exthdrlen;
	} else {
		fl6 = &inet->cork.fl.u.ip6;
		transhdrlen = 0;
	}

	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
				 &np->cork, sk_page_frag(sk), getfrag,
				 from, length, transhdrlen, flags, dontfrag);
}
1578
EXPORT_SYMBOL_GPL(ip6_append_data);
L
Linus Torvalds 已提交
1579

1580 1581
static void ip6_cork_release(struct inet_cork_full *cork,
			     struct inet6_cork *v6_cork)
1582
{
1583 1584 1585 1586 1587 1588 1589
	if (v6_cork->opt) {
		kfree(v6_cork->opt->dst0opt);
		kfree(v6_cork->opt->dst1opt);
		kfree(v6_cork->opt->hopopt);
		kfree(v6_cork->opt->srcrt);
		kfree(v6_cork->opt);
		v6_cork->opt = NULL;
1590 1591
	}

1592 1593 1594 1595
	if (cork->base.dst) {
		dst_release(cork->base.dst);
		cork->base.dst = NULL;
		cork->base.flags &= ~IPCORK_ALLFRAG;
1596
	}
1597
	memset(&cork->fl, 0, sizeof(cork->fl));
1598 1599
}

V
Vlad Yasevich 已提交
1600 1601 1602 1603
struct sk_buff *__ip6_make_skb(struct sock *sk,
			       struct sk_buff_head *queue,
			       struct inet_cork_full *cork,
			       struct inet6_cork *v6_cork)
L
Linus Torvalds 已提交
1604 1605 1606 1607 1608
{
	struct sk_buff *skb, *tmp_skb;
	struct sk_buff **tail_skb;
	struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
	struct ipv6_pinfo *np = inet6_sk(sk);
1609
	struct net *net = sock_net(sk);
L
Linus Torvalds 已提交
1610
	struct ipv6hdr *hdr;
V
Vlad Yasevich 已提交
1611 1612 1613
	struct ipv6_txoptions *opt = v6_cork->opt;
	struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
	struct flowi6 *fl6 = &cork->fl.u.ip6;
1614
	unsigned char proto = fl6->flowi6_proto;
L
Linus Torvalds 已提交
1615

V
Vlad Yasevich 已提交
1616
	skb = __skb_dequeue(queue);
1617
	if (!skb)
L
Linus Torvalds 已提交
1618 1619 1620 1621
		goto out;
	tail_skb = &(skb_shinfo(skb)->frag_list);

	/* move skb->data to ip header from ext header */
1622
	if (skb->data < skb_network_header(skb))
1623
		__skb_pull(skb, skb_network_offset(skb));
V
Vlad Yasevich 已提交
1624
	while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
1625
		__skb_pull(tmp_skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1626 1627 1628 1629 1630 1631 1632 1633 1634
		*tail_skb = tmp_skb;
		tail_skb = &(tmp_skb->next);
		skb->len += tmp_skb->len;
		skb->data_len += tmp_skb->len;
		skb->truesize += tmp_skb->truesize;
		tmp_skb->destructor = NULL;
		tmp_skb->sk = NULL;
	}

1635
	/* Allow local fragmentation. */
W
WANG Cong 已提交
1636
	skb->ignore_df = ip6_sk_ignore_df(sk);
1637

A
Alexey Dobriyan 已提交
1638
	*final_dst = fl6->daddr;
1639
	__skb_pull(skb, skb_network_header_len(skb));
L
Linus Torvalds 已提交
1640 1641 1642 1643 1644
	if (opt && opt->opt_flen)
		ipv6_push_frag_opts(skb, opt, &proto);
	if (opt && opt->opt_nflen)
		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);

1645 1646
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
1647
	hdr = ipv6_hdr(skb);
1648

V
Vlad Yasevich 已提交
1649
	ip6_flow_hdr(hdr, v6_cork->tclass,
1650
		     ip6_make_flowlabel(net, skb, fl6->flowlabel,
1651
					np->autoflowlabel, fl6));
V
Vlad Yasevich 已提交
1652
	hdr->hop_limit = v6_cork->hop_limit;
L
Linus Torvalds 已提交
1653
	hdr->nexthdr = proto;
A
Alexey Dobriyan 已提交
1654 1655
	hdr->saddr = fl6->saddr;
	hdr->daddr = *final_dst;
L
Linus Torvalds 已提交
1656

1657
	skb->priority = sk->sk_priority;
1658
	skb->mark = sk->sk_mark;
1659

1660
	skb_dst_set(skb, dst_clone(&rt->dst));
1661
	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1662
	if (proto == IPPROTO_ICMPV6) {
E
Eric Dumazet 已提交
1663
		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1664

1665 1666
		ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1667 1668
	}

V
Vlad Yasevich 已提交
1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679
	ip6_cork_release(cork, v6_cork);
out:
	return skb;
}

int ip6_send_skb(struct sk_buff *skb)
{
	struct net *net = sock_net(skb->sk);
	struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
	int err;

H
Herbert Xu 已提交
1680
	err = ip6_local_out(skb);
L
Linus Torvalds 已提交
1681 1682
	if (err) {
		if (err > 0)
E
Eric Dumazet 已提交
1683
			err = net_xmit_errno(err);
L
Linus Torvalds 已提交
1684
		if (err)
V
Vlad Yasevich 已提交
1685 1686
			IP6_INC_STATS(net, rt->rt6i_idev,
				      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1687 1688 1689
	}

	return err;
V
Vlad Yasevich 已提交
1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700
}

int ip6_push_pending_frames(struct sock *sk)
{
	struct sk_buff *skb;

	skb = ip6_finish_skb(sk);
	if (!skb)
		return 0;

	return ip6_send_skb(skb);
L
Linus Torvalds 已提交
1701
}
1702
EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
L
Linus Torvalds 已提交
1703

1704
static void __ip6_flush_pending_frames(struct sock *sk,
V
Vlad Yasevich 已提交
1705 1706 1707
				       struct sk_buff_head *queue,
				       struct inet_cork_full *cork,
				       struct inet6_cork *v6_cork)
L
Linus Torvalds 已提交
1708 1709 1710
{
	struct sk_buff *skb;

1711
	while ((skb = __skb_dequeue_tail(queue)) != NULL) {
E
Eric Dumazet 已提交
1712 1713
		if (skb_dst(skb))
			IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1714
				      IPSTATS_MIB_OUTDISCARDS);
L
Linus Torvalds 已提交
1715 1716 1717
		kfree_skb(skb);
	}

V
Vlad Yasevich 已提交
1718
	ip6_cork_release(cork, v6_cork);
L
Linus Torvalds 已提交
1719
}
1720 1721 1722

void ip6_flush_pending_frames(struct sock *sk)
{
V
Vlad Yasevich 已提交
1723 1724
	__ip6_flush_pending_frames(sk, &sk->sk_write_queue,
				   &inet_sk(sk)->cork, &inet6_sk(sk)->cork);
1725
}
1726
EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
V
Vlad Yasevich 已提交
1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769

struct sk_buff *ip6_make_skb(struct sock *sk,
			     int getfrag(void *from, char *to, int offset,
					 int len, int odd, struct sk_buff *skb),
			     void *from, int length, int transhdrlen,
			     int hlimit, int tclass,
			     struct ipv6_txoptions *opt, struct flowi6 *fl6,
			     struct rt6_info *rt, unsigned int flags,
			     int dontfrag)
{
	struct inet_cork_full cork;
	struct inet6_cork v6_cork;
	struct sk_buff_head queue;
	int exthdrlen = (opt ? opt->opt_flen : 0);
	int err;

	if (flags & MSG_PROBE)
		return NULL;

	__skb_queue_head_init(&queue);

	cork.base.flags = 0;
	cork.base.addr = 0;
	cork.base.opt = NULL;
	v6_cork.opt = NULL;
	err = ip6_setup_cork(sk, &cork, &v6_cork, hlimit, tclass, opt, rt, fl6);
	if (err)
		return ERR_PTR(err);

	if (dontfrag < 0)
		dontfrag = inet6_sk(sk)->dontfrag;

	err = __ip6_append_data(sk, fl6, &queue, &cork.base, &v6_cork,
				&current->task_frag, getfrag, from,
				length + exthdrlen, transhdrlen + exthdrlen,
				flags, dontfrag);
	if (err) {
		__ip6_flush_pending_frames(sk, &queue, &cork, &v6_cork);
		return ERR_PTR(err);
	}

	return __ip6_make_skb(sk, &queue, &cork, &v6_cork);
}