udp.c 37.4 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	UDP over IPv6
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34
 *
 *	Based on linux/ipv4/udp.c
 *
 *	Fixes:
 *	Hideaki YOSHIFUJI	:	sin6_scope_id support
 *	YOSHIFUJI Hideaki @USAGI and:	Support IPV6_V6ONLY socket option, which
 *	Alexey Kuznetsov		allow both IPv4 and IPv6 sockets to bind
 *					a single port at the same time.
 *      Kazunori MIYAZAWA @USAGI:       change process style to use ip6_append_data
 *      YOSHIFUJI Hideaki @USAGI:	convert /proc/net/udp6 to seq_file.
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/ipv6.h>
#include <linux/icmpv6.h>
#include <linux/init.h>
35
#include <linux/module.h>
36
#include <linux/skbuff.h>
37
#include <linux/slab.h>
L
Linus Torvalds 已提交
38 39
#include <asm/uaccess.h>

40
#include <net/addrconf.h>
L
Linus Torvalds 已提交
41 42 43 44 45
#include <net/ndisc.h>
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/ip6_route.h>
#include <net/raw.h>
46
#include <net/tcp_states.h>
L
Linus Torvalds 已提交
47 48
#include <net/ip6_checksum.h>
#include <net/xfrm.h>
49
#include <net/inet6_hashtables.h>
50
#include <net/busy_poll.h>
51
#include <net/sock_reuseport.h>
L
Linus Torvalds 已提交
52 53 54

#include <linux/proc_fs.h>
#include <linux/seq_file.h>
55
#include <trace/events/skb.h>
56
#include "udp_impl.h"
L
Linus Torvalds 已提交
57

58 59 60 61 62
static u32 udp6_ehashfn(const struct net *net,
			const struct in6_addr *laddr,
			const u16 lport,
			const struct in6_addr *faddr,
			const __be16 fport)
63
{
64 65 66 67 68 69 70 71 72 73 74 75 76
	static u32 udp6_ehash_secret __read_mostly;
	static u32 udp_ipv6_hash_secret __read_mostly;

	u32 lhash, fhash;

	net_get_random_once(&udp6_ehash_secret,
			    sizeof(udp6_ehash_secret));
	net_get_random_once(&udp_ipv6_hash_secret,
			    sizeof(udp_ipv6_hash_secret));

	lhash = (__force u32)laddr->s6_addr32[3];
	fhash = __ipv6_addr_jhash(faddr, udp_ipv6_hash_secret);

77
	return __inet6_ehashfn(lhash, lport, fhash, fport,
78
			       udp_ipv6_hash_secret + net_hash_mix(net));
79 80
}

81 82 83
static u32 udp6_portaddr_hash(const struct net *net,
			      const struct in6_addr *addr6,
			      unsigned int port)
84 85 86 87 88
{
	unsigned int hash, mix = net_hash_mix(net);

	if (ipv6_addr_any(addr6))
		hash = jhash_1word(0, mix);
B
Brian Haley 已提交
89
	else if (ipv6_addr_v4mapped(addr6))
90
		hash = jhash_1word((__force u32)addr6->s6_addr32[3], mix);
91
	else
92
		hash = jhash2((__force u32 *)addr6->s6_addr32, 4, mix);
93 94 95 96

	return hash ^ port;
}

97
int udp_v6_get_port(struct sock *sk, unsigned short snum)
L
Linus Torvalds 已提交
98
{
E
Eric Dumazet 已提交
99 100
	unsigned int hash2_nulladdr =
		udp6_portaddr_hash(sock_net(sk), &in6addr_any, snum);
101
	unsigned int hash2_partial =
102
		udp6_portaddr_hash(sock_net(sk), &sk->sk_v6_rcv_saddr, 0);
E
Eric Dumazet 已提交
103

104
	/* precompute partial secondary hash */
E
Eric Dumazet 已提交
105 106
	udp_sk(sk)->udp_portaddr_hash = hash2_partial;
	return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal, hash2_nulladdr);
L
Linus Torvalds 已提交
107 108
}

E
Eric Dumazet 已提交
109 110 111
static void udp_v6_rehash(struct sock *sk)
{
	u16 new_hash = udp6_portaddr_hash(sock_net(sk),
112
					  &sk->sk_v6_rcv_saddr,
E
Eric Dumazet 已提交
113 114 115 116 117
					  inet_sk(sk)->inet_num);

	udp_lib_rehash(sk, new_hash);
}

118 119 120 121
static int compute_score(struct sock *sk, struct net *net,
			 const struct in6_addr *saddr, __be16 sport,
			 const struct in6_addr *daddr, unsigned short hnum,
			 int dif)
122
{
123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155
	int score;
	struct inet_sock *inet;

	if (!net_eq(sock_net(sk), net) ||
	    udp_sk(sk)->udp_port_hash != hnum ||
	    sk->sk_family != PF_INET6)
		return -1;

	score = 0;
	inet = inet_sk(sk);

	if (inet->inet_dport) {
		if (inet->inet_dport != sport)
			return -1;
		score++;
	}

	if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
		if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, daddr))
			return -1;
		score++;
	}

	if (!ipv6_addr_any(&sk->sk_v6_daddr)) {
		if (!ipv6_addr_equal(&sk->sk_v6_daddr, saddr))
			return -1;
		score++;
	}

	if (sk->sk_bound_dev_if) {
		if (sk->sk_bound_dev_if != dif)
			return -1;
		score++;
156
	}
157

158 159 160
	if (sk->sk_incoming_cpu == raw_smp_processor_id())
		score++;

161 162 163
	return score;
}

164
/* called with rcu_read_lock() */
E
Eric Dumazet 已提交
165 166 167
static struct sock *udp6_lib_lookup2(struct net *net,
		const struct in6_addr *saddr, __be16 sport,
		const struct in6_addr *daddr, unsigned int hnum, int dif,
168
		struct udp_hslot *hslot2,
169
		struct sk_buff *skb)
E
Eric Dumazet 已提交
170 171
{
	struct sock *sk, *result;
172 173
	int score, badness, matches = 0, reuseport = 0;
	u32 hash = 0;
E
Eric Dumazet 已提交
174 175 176

	result = NULL;
	badness = -1;
177
	udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
178
		score = compute_score(sk, net, saddr, sport,
E
Eric Dumazet 已提交
179 180
				      daddr, hnum, dif);
		if (score > badness) {
181 182
			reuseport = sk->sk_reuseport;
			if (reuseport) {
183 184
				hash = udp6_ehashfn(net, daddr, hnum,
						    saddr, sport);
185

186
				result = reuseport_select_sock(sk, hash, skb,
187
							sizeof(struct udphdr));
188 189
				if (result)
					return result;
190
				matches = 1;
191
			}
192 193
			result = sk;
			badness = score;
194 195
		} else if (score == badness && reuseport) {
			matches++;
196
			if (reciprocal_scale(hash, matches) == 0)
197 198
				result = sk;
			hash = next_pseudo_random32(hash);
E
Eric Dumazet 已提交
199 200 201 202 203
		}
	}
	return result;
}

204
/* rcu_read_lock() must be held */
205
struct sock *__udp6_lib_lookup(struct net *net,
206 207
				      const struct in6_addr *saddr, __be16 sport,
				      const struct in6_addr *daddr, __be16 dport,
208 209
				      int dif, struct udp_table *udptable,
				      struct sk_buff *skb)
L
Linus Torvalds 已提交
210
{
211
	struct sock *sk, *result;
L
Linus Torvalds 已提交
212
	unsigned short hnum = ntohs(dport);
E
Eric Dumazet 已提交
213 214
	unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
	struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
215 216
	int score, badness, matches = 0, reuseport = 0;
	u32 hash = 0;
217

E
Eric Dumazet 已提交
218 219 220 221 222 223 224 225 226
	if (hslot->count > 10) {
		hash2 = udp6_portaddr_hash(net, daddr, hnum);
		slot2 = hash2 & udptable->mask;
		hslot2 = &udptable->hash2[slot2];
		if (hslot->count < hslot2->count)
			goto begin;

		result = udp6_lib_lookup2(net, saddr, sport,
					  daddr, hnum, dif,
227
					  hslot2, skb);
E
Eric Dumazet 已提交
228
		if (!result) {
229
			unsigned int old_slot2 = slot2;
E
Eric Dumazet 已提交
230 231
			hash2 = udp6_portaddr_hash(net, &in6addr_any, hnum);
			slot2 = hash2 & udptable->mask;
232 233 234 235
			/* avoid searching the same slot again. */
			if (unlikely(slot2 == old_slot2))
				return result;

E
Eric Dumazet 已提交
236 237 238 239
			hslot2 = &udptable->hash2[slot2];
			if (hslot->count < hslot2->count)
				goto begin;

240
			result = udp6_lib_lookup2(net, saddr, sport,
241 242
						  daddr, hnum, dif,
						  hslot2, skb);
E
Eric Dumazet 已提交
243 244 245
		}
		return result;
	}
246 247 248
begin:
	result = NULL;
	badness = -1;
249
	sk_for_each_rcu(sk, &hslot->head) {
250
		score = compute_score(sk, net, saddr, sport, daddr, hnum, dif);
251
		if (score > badness) {
252 253
			reuseport = sk->sk_reuseport;
			if (reuseport) {
254 255
				hash = udp6_ehashfn(net, daddr, hnum,
						    saddr, sport);
256
				result = reuseport_select_sock(sk, hash, skb,
257
							sizeof(struct udphdr));
258 259
				if (result)
					return result;
260 261
				matches = 1;
			}
262 263
			result = sk;
			badness = score;
264 265
		} else if (score == badness && reuseport) {
			matches++;
266
			if (reciprocal_scale(hash, matches) == 0)
267 268
				result = sk;
			hash = next_pseudo_random32(hash);
L
Linus Torvalds 已提交
269 270 271 272
		}
	}
	return result;
}
273
EXPORT_SYMBOL_GPL(__udp6_lib_lookup);
L
Linus Torvalds 已提交
274

275 276
static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
					  __be16 sport, __be16 dport,
277
					  struct udp_table *udptable)
278
{
279
	const struct ipv6hdr *iph = ipv6_hdr(skb);
280
	struct sock *sk;
281

282 283
	sk = skb_steal_sock(skb);
	if (unlikely(sk))
284
		return sk;
285
	return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
E
Eric Dumazet 已提交
286
				 &iph->daddr, dport, inet6_iif(skb),
287
				 udptable, skb);
288 289
}

290 291 292 293 294
struct sock *udp6_lib_lookup_skb(struct sk_buff *skb,
				 __be16 sport, __be16 dport)
{
	const struct ipv6hdr *iph = ipv6_hdr(skb);

295
	return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
296 297 298 299 300
				 &iph->daddr, dport, inet6_iif(skb),
				 &udp_table, skb);
}
EXPORT_SYMBOL_GPL(udp6_lib_lookup_skb);

301 302 303 304 305
/* Must be called under rcu_read_lock().
 * Does increment socket refcount.
 */
#if IS_ENABLED(CONFIG_NETFILTER_XT_MATCH_SOCKET) || \
    IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TPROXY)
306 307 308
struct sock *udp6_lib_lookup(struct net *net, const struct in6_addr *saddr, __be16 sport,
			     const struct in6_addr *daddr, __be16 dport, int dif)
{
309 310 311 312 313 314 315
	struct sock *sk;

	sk =  __udp6_lib_lookup(net, saddr, sport, daddr, dport,
				dif, &udp_table, NULL);
	if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
		sk = NULL;
	return sk;
316 317
}
EXPORT_SYMBOL_GPL(udp6_lib_lookup);
318
#endif
319

L
Linus Torvalds 已提交
320
/*
321 322
 *	This should be easy, if there is something there we
 *	return it, otherwise we block.
L
Linus Torvalds 已提交
323 324
 */

325
int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
L
Linus Torvalds 已提交
326 327 328 329
		  int noblock, int flags, int *addr_len)
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct inet_sock *inet = inet_sk(sk);
330
	struct sk_buff *skb;
331
	unsigned int ulen, copied;
332
	int peeked, peeking, off;
333 334
	int err;
	int is_udplite = IS_UDPLITE(sk);
335
	bool checksum_valid = false;
336
	int is_udp4;
337
	bool slow;
L
Linus Torvalds 已提交
338 339

	if (flags & MSG_ERRQUEUE)
340
		return ipv6_recv_error(sk, msg, len, addr_len);
L
Linus Torvalds 已提交
341

342
	if (np->rxpmtu && np->rxopt.bits.rxpmtu)
343
		return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
344

L
Linus Torvalds 已提交
345
try_again:
346
	peeking = off = sk_peek_offset(sk, flags);
347
	skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
348
				  &peeked, &off, &err);
L
Linus Torvalds 已提交
349
	if (!skb)
350
		return err;
L
Linus Torvalds 已提交
351

352
	ulen = skb->len;
353
	copied = len;
354 355
	if (copied > ulen - off)
		copied = ulen - off;
356
	else if (copied < ulen)
357
		msg->msg_flags |= MSG_TRUNC;
L
Linus Torvalds 已提交
358

359 360
	is_udp4 = (skb->protocol == htons(ETH_P_IP));

361
	/*
362 363 364
	 * If checksum is needed at all, try to do it while copying the
	 * data.  If the data is truncated, or if we only want a partial
	 * coverage checksum (UDP-Lite), do it before the copy.
365 366
	 */

367
	if (copied < ulen || UDP_SKB_CB(skb)->partial_cov || peeking) {
368 369
		checksum_valid = !udp_lib_checksum_complete(skb);
		if (!checksum_valid)
L
Linus Torvalds 已提交
370
			goto csum_copy_err;
371 372
	}

373
	if (checksum_valid || skb_csum_unnecessary(skb))
374
		err = skb_copy_datagram_msg(skb, off, msg, copied);
375
	else {
376
		err = skb_copy_and_csum_datagram_msg(skb, off, msg);
L
Linus Torvalds 已提交
377 378 379
		if (err == -EINVAL)
			goto csum_copy_err;
	}
380 381
	if (unlikely(err)) {
		trace_kfree_skb(skb, udpv6_recvmsg);
382 383 384
		if (!peeked) {
			atomic_inc(&sk->sk_drops);
			if (is_udp4)
385 386
				UDP_INC_STATS(sock_net(sk), UDP_MIB_INERRORS,
					      is_udplite);
387
			else
388 389
				UDP6_INC_STATS(sock_net(sk), UDP_MIB_INERRORS,
					       is_udplite);
390
		}
391 392
		skb_free_datagram_locked(sk, skb);
		return err;
393
	}
394 395
	if (!peeked) {
		if (is_udp4)
396 397
			UDP_INC_STATS(sock_net(sk), UDP_MIB_INDATAGRAMS,
				      is_udplite);
398
		else
399 400
			UDP6_INC_STATS(sock_net(sk), UDP_MIB_INDATAGRAMS,
				       is_udplite);
401
	}
402

403
	sock_recv_ts_and_drops(msg, sk, skb);
L
Linus Torvalds 已提交
404 405 406

	/* Copy the address. */
	if (msg->msg_name) {
407
		DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name);
L
Linus Torvalds 已提交
408
		sin6->sin6_family = AF_INET6;
409
		sin6->sin6_port = udp_hdr(skb)->source;
L
Linus Torvalds 已提交
410 411
		sin6->sin6_flowinfo = 0;

412
		if (is_udp4) {
B
Brian Haley 已提交
413 414
			ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
					       &sin6->sin6_addr);
415 416
			sin6->sin6_scope_id = 0;
		} else {
A
Alexey Dobriyan 已提交
417
			sin6->sin6_addr = ipv6_hdr(skb)->saddr;
418 419
			sin6->sin6_scope_id =
				ipv6_iface_scope_id(&sin6->sin6_addr,
420
						    inet6_iif(skb));
L
Linus Torvalds 已提交
421
		}
422
		*addr_len = sizeof(*sin6);
L
Linus Torvalds 已提交
423
	}
424 425 426 427

	if (np->rxopt.all)
		ip6_datagram_recv_common_ctl(sk, msg, skb);

428
	if (is_udp4) {
L
Linus Torvalds 已提交
429 430 431 432
		if (inet->cmsg_flags)
			ip_cmsg_recv(msg, skb);
	} else {
		if (np->rxopt.all)
433
			ip6_datagram_recv_specific_ctl(sk, msg, skb);
434
	}
L
Linus Torvalds 已提交
435

436
	err = copied;
L
Linus Torvalds 已提交
437
	if (flags & MSG_TRUNC)
438
		err = ulen;
L
Linus Torvalds 已提交
439

440
	__skb_free_datagram_locked(sk, skb, peeking ? -err : err);
L
Linus Torvalds 已提交
441 442 443
	return err;

csum_copy_err:
444
	slow = lock_sock_fast(sk);
445
	if (!skb_kill_datagram(sk, skb, flags)) {
446
		if (is_udp4) {
447 448 449 450
			UDP_INC_STATS(sock_net(sk),
				      UDP_MIB_CSUMERRORS, is_udplite);
			UDP_INC_STATS(sock_net(sk),
				      UDP_MIB_INERRORS, is_udplite);
451
		} else {
452 453 454 455
			UDP6_INC_STATS(sock_net(sk),
				       UDP_MIB_CSUMERRORS, is_udplite);
			UDP6_INC_STATS(sock_net(sk),
				       UDP_MIB_INERRORS, is_udplite);
456
		}
457
	}
458
	unlock_sock_fast(sk, slow);
L
Linus Torvalds 已提交
459

460 461
	/* starting over for a new packet, but check if we need to yield */
	cond_resched();
462
	msg->msg_flags &= ~MSG_TRUNC;
L
Linus Torvalds 已提交
463 464 465
	goto try_again;
}

466
void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
467
		    u8 type, u8 code, int offset, __be32 info,
468
		    struct udp_table *udptable)
L
Linus Torvalds 已提交
469 470
{
	struct ipv6_pinfo *np;
471 472 473
	const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
	const struct in6_addr *saddr = &hdr->saddr;
	const struct in6_addr *daddr = &hdr->daddr;
474
	struct udphdr *uh = (struct udphdr *)(skb->data+offset);
L
Linus Torvalds 已提交
475
	struct sock *sk;
476
	int harderr;
L
Linus Torvalds 已提交
477
	int err;
478
	struct net *net = dev_net(skb->dev);
L
Linus Torvalds 已提交
479

480
	sk = __udp6_lib_lookup(net, daddr, uh->dest, saddr, uh->source,
481
			       inet6_iif(skb), udptable, skb);
482
	if (!sk) {
E
Eric Dumazet 已提交
483 484
		__ICMP6_INC_STATS(net, __in6_dev_get(skb->dev),
				  ICMP6_MIB_INERRORS);
L
Linus Torvalds 已提交
485
		return;
486
	}
L
Linus Torvalds 已提交
487

488 489 490
	harderr = icmpv6_err_convert(type, code, &err);
	np = inet6_sk(sk);

491 492 493
	if (type == ICMPV6_PKT_TOOBIG) {
		if (!ip6_sk_accept_pmtu(sk))
			goto out;
494
		ip6_sk_update_pmtu(skb, sk, info);
495 496
		if (np->pmtudisc != IPV6_PMTUDISC_DONT)
			harderr = 1;
497
	}
498
	if (type == NDISC_REDIRECT) {
499
		ip6_sk_redirect(skb, sk);
500 501
		goto out;
	}
502

503 504 505 506
	if (!np->recverr) {
		if (!harderr || sk->sk_state != TCP_ESTABLISHED)
			goto out;
	} else {
L
Linus Torvalds 已提交
507
		ipv6_icmp_error(sk, skb, err, uh->dest, ntohl(info), (u8 *)(uh+1));
508
	}
509

L
Linus Torvalds 已提交
510 511 512
	sk->sk_err = err;
	sk->sk_error_report(sk);
out:
513
	return;
L
Linus Torvalds 已提交
514 515
}

516 517 518 519
static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
{
	int rc;

520
	if (!ipv6_addr_any(&sk->sk_v6_daddr)) {
521
		sock_rps_save_rxhash(sk, skb);
522
		sk_mark_napi_id(sk, skb);
E
Eric Dumazet 已提交
523
		sk_incoming_cpu_update(sk);
524
	}
525

526
	rc = __sock_queue_rcv_skb(sk, skb);
527 528 529 530 531
	if (rc < 0) {
		int is_udplite = IS_UDPLITE(sk);

		/* Note that an ENOMEM error is charged twice */
		if (rc == -ENOMEM)
532
			UDP6_INC_STATS(sock_net(sk),
533
					 UDP_MIB_RCVBUFERRORS, is_udplite);
534
		UDP6_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
535 536 537 538 539 540
		kfree_skb(skb);
		return -1;
	}
	return 0;
}

541
static __inline__ void udpv6_err(struct sk_buff *skb,
542
				 struct inet6_skb_parm *opt, u8 type,
543
				 u8 code, int offset, __be32 info)
544
{
545
	__udp6_lib_err(skb, opt, type, code, offset, info, &udp_table);
546 547
}

548 549 550 551 552 553 554 555
static struct static_key udpv6_encap_needed __read_mostly;
void udpv6_encap_enable(void)
{
	if (!static_key_enabled(&udpv6_encap_needed))
		static_key_slow_inc(&udpv6_encap_needed);
}
EXPORT_SYMBOL(udpv6_encap_enable);

556
int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
557
{
558
	struct udp_sock *up = udp_sk(sk);
559
	int rc;
W
Wang Chen 已提交
560
	int is_udplite = IS_UDPLITE(sk);
561

562 563
	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
		goto drop;
L
Linus Torvalds 已提交
564

565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580
	if (static_key_false(&udpv6_encap_needed) && up->encap_type) {
		int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);

		/*
		 * This is an encapsulation socket so pass the skb to
		 * the socket's udp_encap_rcv() hook. Otherwise, just
		 * fall through and pass this up the UDP socket.
		 * up->encap_rcv() returns the following value:
		 * =0 if skb was successfully passed to the encap
		 *    handler or was discarded by it.
		 * >0 if skb should be passed on to UDP.
		 * <0 if skb should be resubmitted as proto -N
		 */

		/* if we're overly short, let UDP handle it */
		encap_rcv = ACCESS_ONCE(up->encap_rcv);
581
		if (encap_rcv) {
582 583
			int ret;

584 585 586 587
			/* Verify checksum before giving to encap */
			if (udp_lib_checksum_complete(skb))
				goto csum_error;

588 589
			ret = encap_rcv(sk, skb);
			if (ret <= 0) {
590 591 592
				__UDP_INC_STATS(sock_net(sk),
						UDP_MIB_INDATAGRAMS,
						is_udplite);
593 594 595 596 597 598 599
				return -ret;
			}
		}

		/* FALLTHROUGH -- it's a UDP Packet */
	}

600 601 602
	/*
	 * UDP-Lite specific tests, ignored on UDP sockets (see net/ipv4/udp.c).
	 */
W
Wang Chen 已提交
603
	if ((is_udplite & UDPLITE_RECV_CC)  &&  UDP_SKB_CB(skb)->partial_cov) {
604 605

		if (up->pcrlen == 0) {          /* full coverage was set  */
606 607
			net_dbg_ratelimited("UDPLITE6: partial coverage %d while full coverage %d requested\n",
					    UDP_SKB_CB(skb)->cscov, skb->len);
608 609 610
			goto drop;
		}
		if (UDP_SKB_CB(skb)->cscov  <  up->pcrlen) {
611 612
			net_dbg_ratelimited("UDPLITE6: coverage %d too small, need min %d\n",
					    UDP_SKB_CB(skb)->cscov, up->pcrlen);
613 614
			goto drop;
		}
L
Linus Torvalds 已提交
615 616
	}

617 618 619 620 621 622
	if (rcu_access_pointer(sk->sk_filter) &&
	    udp_lib_checksum_complete(skb))
		goto csum_error;

	if (sk_filter(sk, skb))
		goto drop;
623 624
	if (unlikely(skb->len < sizeof(struct udphdr)))
		goto drop;
625

626
	udp_csum_pull_header(skb);
627
	if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
628 629
		__UDP6_INC_STATS(sock_net(sk),
				 UDP_MIB_RCVBUFERRORS, is_udplite);
630
		goto drop;
631
	}
632

633
	skb_dst_drop(skb);
634

635 636 637 638 639 640 641 642 643
	bh_lock_sock(sk);
	rc = 0;
	if (!sock_owned_by_user(sk))
		rc = __udpv6_queue_rcv_skb(sk, skb);
	else if (sk_add_backlog(sk, skb, sk->sk_rcvbuf)) {
		bh_unlock_sock(sk);
		goto drop;
	}
	bh_unlock_sock(sk);
644 645

	return rc;
646

647
csum_error:
648
	__UDP6_INC_STATS(sock_net(sk), UDP_MIB_CSUMERRORS, is_udplite);
649
drop:
650
	__UDP6_INC_STATS(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
651
	atomic_inc(&sk->sk_drops);
652 653
	kfree_skb(skb);
	return -1;
L
Linus Torvalds 已提交
654 655
}

656 657 658 659
static bool __udp_v6_is_mcast_sock(struct net *net, struct sock *sk,
				   __be16 loc_port, const struct in6_addr *loc_addr,
				   __be16 rmt_port, const struct in6_addr *rmt_addr,
				   int dif, unsigned short hnum)
L
Linus Torvalds 已提交
660
{
661
	struct inet_sock *inet = inet_sk(sk);
L
Linus Torvalds 已提交
662

663 664 665 666 667 668 669 670
	if (!net_eq(sock_net(sk), net))
		return false;

	if (udp_sk(sk)->udp_port_hash != hnum ||
	    sk->sk_family != PF_INET6 ||
	    (inet->inet_dport && inet->inet_dport != rmt_port) ||
	    (!ipv6_addr_any(&sk->sk_v6_daddr) &&
		    !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) ||
671 672 673
	    (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif) ||
	    (!ipv6_addr_any(&sk->sk_v6_rcv_saddr) &&
		    !ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr)))
674 675 676 677
		return false;
	if (!inet6_mc_check(sk, loc_addr, rmt_addr))
		return false;
	return true;
L
Linus Torvalds 已提交
678 679
}

680 681 682 683 684
static void udp6_csum_zero_error(struct sk_buff *skb)
{
	/* RFC 2460 section 8.1 says that we SHOULD log
	 * this error. Well, it is reasonable.
	 */
685 686 687
	net_dbg_ratelimited("IPv6: udp checksum is 0 for [%pI6c]:%u->[%pI6c]:%u\n",
			    &ipv6_hdr(skb)->saddr, ntohs(udp_hdr(skb)->source),
			    &ipv6_hdr(skb)->daddr, ntohs(udp_hdr(skb)->dest));
688 689
}

L
Linus Torvalds 已提交
690 691 692 693
/*
 * Note: called only from the BH handler context,
 * so we don't need to lock the hashes.
 */
694
static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
695
		const struct in6_addr *saddr, const struct in6_addr *daddr,
696
		struct udp_table *udptable, int proto)
L
Linus Torvalds 已提交
697
{
698
	struct sock *sk, *first = NULL;
699
	const struct udphdr *uh = udp_hdr(skb);
700 701
	unsigned short hnum = ntohs(uh->dest);
	struct udp_hslot *hslot = udp_hashslot(udptable, net, hnum);
702
	unsigned int offset = offsetof(typeof(*sk), sk_node);
703
	unsigned int hash2 = 0, hash2_any = 0, use_hash2 = (hslot->count > 10);
704 705 706
	int dif = inet6_iif(skb);
	struct hlist_node *node;
	struct sk_buff *nskb;
707 708 709 710 711 712 713 714 715

	if (use_hash2) {
		hash2_any = udp6_portaddr_hash(net, &in6addr_any, hnum) &
			    udp_table.mask;
		hash2 = udp6_portaddr_hash(net, daddr, hnum) & udp_table.mask;
start_lookup:
		hslot = &udp_table.hash2[hash2];
		offset = offsetof(typeof(*sk), __sk_common.skc_portaddr_node);
	}
L
Linus Torvalds 已提交
716

717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732
	sk_for_each_entry_offset_rcu(sk, node, &hslot->head, offset) {
		if (!__udp_v6_is_mcast_sock(net, sk, uh->dest, daddr,
					    uh->source, saddr, dif, hnum))
			continue;
		/* If zero checksum and no_check is not on for
		 * the socket then skip it.
		 */
		if (!uh->check && !udp_sk(sk)->no_check6_rx)
			continue;
		if (!first) {
			first = sk;
			continue;
		}
		nskb = skb_clone(skb, GFP_ATOMIC);
		if (unlikely(!nskb)) {
			atomic_inc(&sk->sk_drops);
733 734 735 736
			__UDP6_INC_STATS(net, UDP_MIB_RCVBUFERRORS,
					 IS_UDPLITE(sk));
			__UDP6_INC_STATS(net, UDP_MIB_INERRORS,
					 IS_UDPLITE(sk));
737
			continue;
H
Hideo Aoki 已提交
738
		}
739

740 741 742
		if (udpv6_queue_rcv_skb(sk, nskb) > 0)
			consume_skb(nskb);
	}
743

744 745 746 747 748 749
	/* Also lookup *:port if we are using hash2 and haven't done so yet. */
	if (use_hash2 && hash2 != hash2_any) {
		hash2 = hash2_any;
		goto start_lookup;
	}

750 751 752
	if (first) {
		if (udpv6_queue_rcv_skb(first, skb) > 0)
			consume_skb(skb);
753
	} else {
754
		kfree_skb(skb);
755 756
		__UDP6_INC_STATS(net, UDP_MIB_IGNOREDMULTI,
				 proto == IPPROTO_UDPLITE);
757
	}
758
	return 0;
L
Linus Torvalds 已提交
759 760
}

761
int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
762
		   int proto)
L
Linus Torvalds 已提交
763
{
764
	const struct in6_addr *saddr, *daddr;
765
	struct net *net = dev_net(skb->dev);
766
	struct udphdr *uh;
767
	struct sock *sk;
L
Linus Torvalds 已提交
768 769 770
	u32 ulen = 0;

	if (!pskb_may_pull(skb, sizeof(struct udphdr)))
771
		goto discard;
L
Linus Torvalds 已提交
772

773 774
	saddr = &ipv6_hdr(skb)->saddr;
	daddr = &ipv6_hdr(skb)->daddr;
775
	uh = udp_hdr(skb);
L
Linus Torvalds 已提交
776 777

	ulen = ntohs(uh->len);
778 779
	if (ulen > skb->len)
		goto short_packet;
L
Linus Torvalds 已提交
780

781 782
	if (proto == IPPROTO_UDP) {
		/* UDP validates ulen. */
L
Linus Torvalds 已提交
783

784 785 786
		/* Check for jumbo payload */
		if (ulen == 0)
			ulen = skb->len;
L
Linus Torvalds 已提交
787

788 789
		if (ulen < sizeof(*uh))
			goto short_packet;
L
Linus Torvalds 已提交
790

791 792 793
		if (ulen < skb->len) {
			if (pskb_trim_rcsum(skb, ulen))
				goto short_packet;
794 795
			saddr = &ipv6_hdr(skb)->saddr;
			daddr = &ipv6_hdr(skb)->daddr;
796
			uh = udp_hdr(skb);
797 798
		}
	}
L
Linus Torvalds 已提交
799

800
	if (udp6_csum_init(skb, uh, proto))
801
		goto csum_error;
802

803 804
	/*
	 *	Multicast receive code
L
Linus Torvalds 已提交
805
	 */
806
	if (ipv6_addr_is_multicast(daddr))
807
		return __udp6_lib_mcast_deliver(net, skb,
808
				saddr, daddr, udptable, proto);
L
Linus Torvalds 已提交
809 810 811

	/* Unicast */

812
	/*
L
Linus Torvalds 已提交
813 814 815
	 * check socket cache ... must talk to Alan about his plans
	 * for sock caches... i'll skip this for now.
	 */
816
	sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
817
	if (sk) {
818 819
		int ret;

820
		if (!uh->check && !udp_sk(sk)->no_check6_rx) {
821 822 823 824
			udp6_csum_zero_error(skb);
			goto csum_error;
		}

825
		if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
826 827 828
			skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
						 ip6_compute_pseudo);

829
		ret = udpv6_queue_rcv_skb(sk, skb);
L
Linus Torvalds 已提交
830

831
		/* a return value > 0 means to resubmit the input */
832
		if (ret > 0)
833
			return ret;
L
Linus Torvalds 已提交
834

S
Stephen Hemminger 已提交
835
		return 0;
L
Linus Torvalds 已提交
836
	}
837

838 839 840 841 842
	if (!uh->check) {
		udp6_csum_zero_error(skb);
		goto csum_error;
	}

843
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
844
		goto discard;
845 846

	if (udp_lib_checksum_complete(skb))
847
		goto csum_error;
848

849
	__UDP6_INC_STATS(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
850 851 852
	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);

	kfree_skb(skb);
S
Stephen Hemminger 已提交
853
	return 0;
L
Linus Torvalds 已提交
854

855
short_packet:
856 857 858 859 860
	net_dbg_ratelimited("UDP%sv6: short packet: From [%pI6c]:%u %d/%d to [%pI6c]:%u\n",
			    proto == IPPROTO_UDPLITE ? "-Lite" : "",
			    saddr, ntohs(uh->source),
			    ulen, skb->len,
			    daddr, ntohs(uh->dest));
861 862
	goto discard;
csum_error:
863
	__UDP6_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE);
L
Linus Torvalds 已提交
864
discard:
865
	__UDP6_INC_STATS(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
L
Linus Torvalds 已提交
866
	kfree_skb(skb);
S
Stephen Hemminger 已提交
867
	return 0;
L
Linus Torvalds 已提交
868
}
869

870
static __inline__ int udpv6_rcv(struct sk_buff *skb)
871
{
872
	return __udp6_lib_rcv(skb, &udp_table, IPPROTO_UDP);
873 874
}

L
Linus Torvalds 已提交
875 876 877 878 879 880 881
/*
 * Throw away all pending data and cancel the corking. Socket is locked.
 */
static void udp_v6_flush_pending_frames(struct sock *sk)
{
	struct udp_sock *up = udp_sk(sk);

882 883 884
	if (up->pending == AF_INET)
		udp_flush_pending_frames(sk);
	else if (up->pending) {
L
Linus Torvalds 已提交
885 886 887
		up->len = 0;
		up->pending = 0;
		ip6_flush_pending_frames(sk);
888
	}
L
Linus Torvalds 已提交
889 890
}

891
/**
892 893 894 895
 *	udp6_hwcsum_outgoing  -  handle outgoing HW checksumming
 *	@sk:	socket we are sending on
 *	@skb:	sk_buff containing the filled-in UDP header
 *		(checksum field must be zeroed out)
896 897 898 899 900 901 902
 */
static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb,
				 const struct in6_addr *saddr,
				 const struct in6_addr *daddr, int len)
{
	unsigned int offset;
	struct udphdr *uh = udp_hdr(skb);
V
Vlad Yasevich 已提交
903
	struct sk_buff *frags = skb_shinfo(skb)->frag_list;
904 905
	__wsum csum = 0;

V
Vlad Yasevich 已提交
906
	if (!frags) {
907 908 909 910 911 912 913 914 915 916 917 918 919 920 921
		/* Only one fragment on the socket.  */
		skb->csum_start = skb_transport_header(skb) - skb->head;
		skb->csum_offset = offsetof(struct udphdr, check);
		uh->check = ~csum_ipv6_magic(saddr, daddr, len, IPPROTO_UDP, 0);
	} else {
		/*
		 * HW-checksum won't work as there are two or more
		 * fragments on the socket so that all csums of sk_buffs
		 * should be together
		 */
		offset = skb_transport_offset(skb);
		skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);

		skb->ip_summed = CHECKSUM_NONE;

V
Vlad Yasevich 已提交
922 923 924
		do {
			csum = csum_add(csum, frags->csum);
		} while ((frags = frags->next));
925 926 927 928 929 930 931 932

		uh->check = csum_ipv6_magic(saddr, daddr, len, IPPROTO_UDP,
					    csum);
		if (uh->check == 0)
			uh->check = CSUM_MANGLED_0;
	}
}

L
Linus Torvalds 已提交
933 934 935 936
/*
 *	Sending
 */

V
Vlad Yasevich 已提交
937
static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6)
L
Linus Torvalds 已提交
938
{
V
Vlad Yasevich 已提交
939
	struct sock *sk = skb->sk;
L
Linus Torvalds 已提交
940 941
	struct udphdr *uh;
	int err = 0;
W
Wang Chen 已提交
942
	int is_udplite = IS_UDPLITE(sk);
943
	__wsum csum = 0;
V
Vlad Yasevich 已提交
944 945
	int offset = skb_transport_offset(skb);
	int len = skb->len - offset;
L
Linus Torvalds 已提交
946 947 948 949

	/*
	 * Create a UDP header
	 */
950
	uh = udp_hdr(skb);
951 952
	uh->source = fl6->fl6_sport;
	uh->dest = fl6->fl6_dport;
V
Vlad Yasevich 已提交
953
	uh->len = htons(len);
L
Linus Torvalds 已提交
954 955
	uh->check = 0;

W
Wang Chen 已提交
956
	if (is_udplite)
V
Vlad Yasevich 已提交
957 958
		csum = udplite_csum(skb);
	else if (udp_sk(sk)->no_check6_tx) {   /* UDP csum disabled */
959 960 961
		skb->ip_summed = CHECKSUM_NONE;
		goto send;
	} else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
V
Vlad Yasevich 已提交
962
		udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr, len);
963 964
		goto send;
	} else
V
Vlad Yasevich 已提交
965
		csum = udp_csum(skb);
L
Linus Torvalds 已提交
966

967
	/* add protocol-dependent pseudo-header */
968
	uh->check = csum_ipv6_magic(&fl6->saddr, &fl6->daddr,
V
Vlad Yasevich 已提交
969
				    len, fl6->flowi6_proto, csum);
L
Linus Torvalds 已提交
970
	if (uh->check == 0)
971
		uh->check = CSUM_MANGLED_0;
L
Linus Torvalds 已提交
972

973
send:
V
Vlad Yasevich 已提交
974
	err = ip6_send_skb(skb);
E
Eric Dumazet 已提交
975 976
	if (err) {
		if (err == -ENOBUFS && !inet6_sk(sk)->recverr) {
977 978
			UDP6_INC_STATS(sock_net(sk),
				       UDP_MIB_SNDBUFERRORS, is_udplite);
E
Eric Dumazet 已提交
979 980
			err = 0;
		}
981 982 983 984
	} else {
		UDP6_INC_STATS(sock_net(sk),
			       UDP_MIB_OUTDATAGRAMS, is_udplite);
	}
V
Vlad Yasevich 已提交
985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008
	return err;
}

static int udp_v6_push_pending_frames(struct sock *sk)
{
	struct sk_buff *skb;
	struct udp_sock  *up = udp_sk(sk);
	struct flowi6 fl6;
	int err = 0;

	if (up->pending == AF_INET)
		return udp_push_pending_frames(sk);

	/* ip6_finish_skb will release the cork, so make a copy of
	 * fl6 here.
	 */
	fl6 = inet_sk(sk)->cork.fl.u.ip6;

	skb = ip6_finish_skb(sk);
	if (!skb)
		goto out;

	err = udp_v6_send_skb(skb, &fl6);

L
Linus Torvalds 已提交
1009 1010 1011 1012 1013 1014
out:
	up->len = 0;
	up->pending = 0;
	return err;
}

1015
int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
L
Linus Torvalds 已提交
1016 1017 1018 1019 1020
{
	struct ipv6_txoptions opt_space;
	struct udp_sock *up = udp_sk(sk);
	struct inet_sock *inet = inet_sk(sk);
	struct ipv6_pinfo *np = inet6_sk(sk);
1021
	DECLARE_SOCKADDR(struct sockaddr_in6 *, sin6, msg->msg_name);
1022
	struct in6_addr *daddr, *final_p, final;
L
Linus Torvalds 已提交
1023
	struct ipv6_txoptions *opt = NULL;
1024
	struct ipv6_txoptions *opt_to_free = NULL;
L
Linus Torvalds 已提交
1025
	struct ip6_flowlabel *flowlabel = NULL;
1026
	struct flowi6 fl6;
L
Linus Torvalds 已提交
1027
	struct dst_entry *dst;
W
Wei Wang 已提交
1028
	struct ipcm6_cookie ipc6;
L
Linus Torvalds 已提交
1029 1030 1031 1032
	int addr_len = msg->msg_namelen;
	int ulen = len;
	int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
	int err;
1033
	int connected = 0;
W
Wang Chen 已提交
1034
	int is_udplite = IS_UDPLITE(sk);
1035
	int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
1036
	struct sockcm_cookie sockc;
L
Linus Torvalds 已提交
1037

W
Wei Wang 已提交
1038 1039 1040 1041
	ipc6.hlimit = -1;
	ipc6.tclass = -1;
	ipc6.dontfrag = -1;

L
Linus Torvalds 已提交
1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065
	/* destination address check */
	if (sin6) {
		if (addr_len < offsetof(struct sockaddr, sa_data))
			return -EINVAL;

		switch (sin6->sin6_family) {
		case AF_INET6:
			if (addr_len < SIN6_LEN_RFC2133)
				return -EINVAL;
			daddr = &sin6->sin6_addr;
			break;
		case AF_INET:
			goto do_udp_sendmsg;
		case AF_UNSPEC:
			msg->msg_name = sin6 = NULL;
			msg->msg_namelen = addr_len = 0;
			daddr = NULL;
			break;
		default:
			return -EINVAL;
		}
	} else if (!up->pending) {
		if (sk->sk_state != TCP_ESTABLISHED)
			return -EDESTADDRREQ;
1066
		daddr = &sk->sk_v6_daddr;
1067
	} else
L
Linus Torvalds 已提交
1068 1069 1070
		daddr = NULL;

	if (daddr) {
B
Brian Haley 已提交
1071
		if (ipv6_addr_v4mapped(daddr)) {
L
Linus Torvalds 已提交
1072 1073
			struct sockaddr_in sin;
			sin.sin_family = AF_INET;
E
Eric Dumazet 已提交
1074
			sin.sin_port = sin6 ? sin6->sin6_port : inet->inet_dport;
L
Linus Torvalds 已提交
1075 1076 1077 1078 1079 1080
			sin.sin_addr.s_addr = daddr->s6_addr32[3];
			msg->msg_name = &sin;
			msg->msg_namelen = sizeof(sin);
do_udp_sendmsg:
			if (__ipv6_only_sock(sk))
				return -ENETUNREACH;
1081
			return udp_sendmsg(sk, msg, len);
L
Linus Torvalds 已提交
1082 1083 1084 1085
		}
	}

	if (up->pending == AF_INET)
1086
		return udp_sendmsg(sk, msg, len);
L
Linus Torvalds 已提交
1087 1088

	/* Rough check on arithmetic overflow,
1089
	   better check is made in ip6_append_data().
L
Linus Torvalds 已提交
1090 1091 1092
	   */
	if (len > INT_MAX - sizeof(struct udphdr))
		return -EMSGSIZE;
1093

1094
	getfrag  =  is_udplite ?  udplite_getfrag : ip_generic_getfrag;
L
Linus Torvalds 已提交
1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112
	if (up->pending) {
		/*
		 * There are pending frames.
		 * The socket lock must be held while it's corked.
		 */
		lock_sock(sk);
		if (likely(up->pending)) {
			if (unlikely(up->pending != AF_INET6)) {
				release_sock(sk);
				return -EAFNOSUPPORT;
			}
			dst = NULL;
			goto do_append_data;
		}
		release_sock(sk);
	}
	ulen += sizeof(struct udphdr);

1113
	memset(&fl6, 0, sizeof(fl6));
L
Linus Torvalds 已提交
1114 1115 1116 1117 1118

	if (sin6) {
		if (sin6->sin6_port == 0)
			return -EINVAL;

1119
		fl6.fl6_dport = sin6->sin6_port;
L
Linus Torvalds 已提交
1120 1121 1122
		daddr = &sin6->sin6_addr;

		if (np->sndflow) {
1123 1124 1125
			fl6.flowlabel = sin6->sin6_flowinfo&IPV6_FLOWINFO_MASK;
			if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
				flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
1126
				if (!flowlabel)
L
Linus Torvalds 已提交
1127 1128 1129 1130 1131 1132 1133 1134 1135
					return -EINVAL;
			}
		}

		/*
		 * Otherwise it will be difficult to maintain
		 * sk->sk_dst_cache.
		 */
		if (sk->sk_state == TCP_ESTABLISHED &&
1136 1137
		    ipv6_addr_equal(daddr, &sk->sk_v6_daddr))
			daddr = &sk->sk_v6_daddr;
L
Linus Torvalds 已提交
1138 1139 1140

		if (addr_len >= sizeof(struct sockaddr_in6) &&
		    sin6->sin6_scope_id &&
1141
		    __ipv6_addr_needs_scope_id(__ipv6_addr_type(daddr)))
1142
			fl6.flowi6_oif = sin6->sin6_scope_id;
L
Linus Torvalds 已提交
1143 1144 1145 1146
	} else {
		if (sk->sk_state != TCP_ESTABLISHED)
			return -EDESTADDRREQ;

1147
		fl6.fl6_dport = inet->inet_dport;
1148
		daddr = &sk->sk_v6_daddr;
1149
		fl6.flowlabel = np->flow_label;
1150
		connected = 1;
L
Linus Torvalds 已提交
1151 1152
	}

1153 1154
	if (!fl6.flowi6_oif)
		fl6.flowi6_oif = sk->sk_bound_dev_if;
L
Linus Torvalds 已提交
1155

1156 1157
	if (!fl6.flowi6_oif)
		fl6.flowi6_oif = np->sticky_pktinfo.ipi6_ifindex;
1158

1159
	fl6.flowi6_mark = sk->sk_mark;
1160
	sockc.tsflags = sk->sk_tsflags;
B
Brian Haley 已提交
1161

L
Linus Torvalds 已提交
1162 1163 1164 1165
	if (msg->msg_controllen) {
		opt = &opt_space;
		memset(opt, 0, sizeof(struct ipv6_txoptions));
		opt->tot_len = sizeof(*opt);
W
Wei Wang 已提交
1166
		ipc6.opt = opt;
L
Linus Torvalds 已提交
1167

W
Wei Wang 已提交
1168
		err = ip6_datagram_send_ctl(sock_net(sk), sk, msg, &fl6, &ipc6, &sockc);
L
Linus Torvalds 已提交
1169 1170 1171 1172
		if (err < 0) {
			fl6_sock_release(flowlabel);
			return err;
		}
1173 1174
		if ((fl6.flowlabel&IPV6_FLOWLABEL_MASK) && !flowlabel) {
			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
1175
			if (!flowlabel)
L
Linus Torvalds 已提交
1176 1177 1178 1179
				return -EINVAL;
		}
		if (!(opt->opt_nflen|opt->opt_flen))
			opt = NULL;
1180
		connected = 0;
L
Linus Torvalds 已提交
1181
	}
1182 1183 1184 1185
	if (!opt) {
		opt = txopt_get(np);
		opt_to_free = opt;
	}
1186 1187 1188
	if (flowlabel)
		opt = fl6_merge_options(&opt_space, flowlabel, opt);
	opt = ipv6_fixup_options(&opt_space, opt);
W
Wei Wang 已提交
1189
	ipc6.opt = opt;
L
Linus Torvalds 已提交
1190

1191
	fl6.flowi6_proto = sk->sk_protocol;
1192
	if (!ipv6_addr_any(daddr))
A
Alexey Dobriyan 已提交
1193
		fl6.daddr = *daddr;
1194
	else
1195 1196
		fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
	if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
A
Alexey Dobriyan 已提交
1197
		fl6.saddr = np->saddr;
1198
	fl6.fl6_sport = inet->inet_sport;
1199

1200
	final_p = fl6_update_dst(&fl6, opt, &final);
1201
	if (final_p)
1202
		connected = 0;
L
Linus Torvalds 已提交
1203

1204 1205
	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) {
		fl6.flowi6_oif = np->mcast_oif;
1206
		connected = 0;
1207 1208
	} else if (!fl6.flowi6_oif)
		fl6.flowi6_oif = np->ucast_oif;
L
Linus Torvalds 已提交
1209

1210
	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
V
Venkat Yekkirala 已提交
1211

1212 1213 1214 1215 1216
	if (ipc6.tclass < 0)
		ipc6.tclass = np->tclass;

	fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);

1217
	dst = ip6_sk_dst_lookup_flow(sk, &fl6, final_p);
1218 1219 1220
	if (IS_ERR(dst)) {
		err = PTR_ERR(dst);
		dst = NULL;
L
Linus Torvalds 已提交
1221
		goto out;
1222
	}
L
Linus Torvalds 已提交
1223

W
Wei Wang 已提交
1224 1225
	if (ipc6.hlimit < 0)
		ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
L
Linus Torvalds 已提交
1226 1227 1228 1229 1230

	if (msg->msg_flags&MSG_CONFIRM)
		goto do_confirm;
back_from_confirm:

1231 1232 1233 1234 1235
	/* Lockless fast path for the non-corking case */
	if (!corkreq) {
		struct sk_buff *skb;

		skb = ip6_make_skb(sk, getfrag, msg, ulen,
W
Wei Wang 已提交
1236
				   sizeof(struct udphdr), &ipc6,
1237
				   &fl6, (struct rt6_info *)dst,
W
Wei Wang 已提交
1238
				   msg->msg_flags, &sockc);
1239 1240 1241 1242 1243 1244
		err = PTR_ERR(skb);
		if (!IS_ERR_OR_NULL(skb))
			err = udp_v6_send_skb(skb, &fl6);
		goto release_dst;
	}

L
Linus Torvalds 已提交
1245 1246 1247 1248 1249 1250
	lock_sock(sk);
	if (unlikely(up->pending)) {
		/* The socket is already corked while preparing it. */
		/* ... which is an evident application bug. --ANK */
		release_sock(sk);

1251
		net_dbg_ratelimited("udp cork app bug 2\n");
L
Linus Torvalds 已提交
1252 1253 1254 1255 1256 1257 1258
		err = -EINVAL;
		goto out;
	}

	up->pending = AF_INET6;

do_append_data:
W
Wei Wang 已提交
1259 1260
	if (ipc6.dontfrag < 0)
		ipc6.dontfrag = np->dontfrag;
L
Linus Torvalds 已提交
1261
	up->len += ulen;
W
Wei Wang 已提交
1262 1263 1264
	err = ip6_append_data(sk, getfrag, msg, ulen, sizeof(struct udphdr),
			      &ipc6, &fl6, (struct rt6_info *)dst,
			      corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags, &sockc);
L
Linus Torvalds 已提交
1265 1266 1267
	if (err)
		udp_v6_flush_pending_frames(sk);
	else if (!corkreq)
1268
		err = udp_v6_push_pending_frames(sk);
H
Herbert Xu 已提交
1269 1270
	else if (unlikely(skb_queue_empty(&sk->sk_write_queue)))
		up->pending = 0;
L
Linus Torvalds 已提交
1271

1272 1273 1274 1275 1276
	if (err > 0)
		err = np->recverr ? net_xmit_errno(err) : 0;
	release_sock(sk);

release_dst:
1277 1278 1279
	if (dst) {
		if (connected) {
			ip6_dst_store(sk, dst,
1280 1281
				      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
				      &sk->sk_v6_daddr : NULL,
1282
#ifdef CONFIG_IPV6_SUBTREES
1283
				      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
1284 1285 1286
				      &np->saddr :
#endif
				      NULL);
1287 1288 1289
		} else {
			dst_release(dst);
		}
1290
		dst = NULL;
1291 1292
	}

L
Linus Torvalds 已提交
1293
out:
1294
	dst_release(dst);
L
Linus Torvalds 已提交
1295
	fl6_sock_release(flowlabel);
1296
	txopt_put(opt_to_free);
1297
	if (!err)
L
Linus Torvalds 已提交
1298
		return len;
1299 1300 1301 1302 1303 1304 1305 1306
	/*
	 * ENOBUFS = no kernel mem, SOCK_NOSPACE = no sndbuf space.  Reporting
	 * ENOBUFS might not be good (it's not tunable per se), but otherwise
	 * we don't have a good statistic (IpOutDiscards but it can be too many
	 * things).  We could add another new stat but at least for now that
	 * seems like overkill.
	 */
	if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
1307 1308
		UDP6_INC_STATS(sock_net(sk),
			       UDP_MIB_SNDBUFERRORS, is_udplite);
1309
	}
L
Linus Torvalds 已提交
1310 1311 1312 1313 1314 1315 1316 1317 1318 1319
	return err;

do_confirm:
	dst_confirm(dst);
	if (!(msg->msg_flags&MSG_PROBE) || len)
		goto back_from_confirm;
	err = 0;
	goto out;
}

1320
void udpv6_destroy_sock(struct sock *sk)
L
Linus Torvalds 已提交
1321
{
T
Tom Parkin 已提交
1322
	struct udp_sock *up = udp_sk(sk);
L
Linus Torvalds 已提交
1323 1324 1325 1326
	lock_sock(sk);
	udp_v6_flush_pending_frames(sk);
	release_sock(sk);

T
Tom Parkin 已提交
1327 1328 1329 1330 1331 1332 1333
	if (static_key_false(&udpv6_encap_needed) && up->encap_type) {
		void (*encap_destroy)(struct sock *sk);
		encap_destroy = ACCESS_ONCE(up->encap_destroy);
		if (encap_destroy)
			encap_destroy(sk);
	}

L
Linus Torvalds 已提交
1334 1335 1336 1337 1338 1339
	inet6_destroy_sock(sk);
}

/*
 *	Socket option code for UDP
 */
1340
int udpv6_setsockopt(struct sock *sk, int level, int optname,
1341
		     char __user *optval, unsigned int optlen)
1342
{
1343
	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1344 1345
		return udp_lib_setsockopt(sk, level, optname, optval, optlen,
					  udp_v6_push_pending_frames);
1346
	return ipv6_setsockopt(sk, level, optname, optval, optlen);
1347 1348 1349
}

#ifdef CONFIG_COMPAT
1350
int compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
1351
			    char __user *optval, unsigned int optlen)
1352
{
1353
	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1354 1355
		return udp_lib_setsockopt(sk, level, optname, optval, optlen,
					  udp_v6_push_pending_frames);
1356
	return compat_ipv6_setsockopt(sk, level, optname, optval, optlen);
1357 1358 1359
}
#endif

1360 1361
int udpv6_getsockopt(struct sock *sk, int level, int optname,
		     char __user *optval, int __user *optlen)
1362
{
1363
	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1364
		return udp_lib_getsockopt(sk, level, optname, optval, optlen);
1365
	return ipv6_getsockopt(sk, level, optname, optval, optlen);
1366 1367 1368
}

#ifdef CONFIG_COMPAT
1369 1370
int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
			    char __user *optval, int __user *optlen)
1371
{
1372
	if (level == SOL_UDP  ||  level == SOL_UDPLITE)
1373
		return udp_lib_getsockopt(sk, level, optname, optval, optlen);
1374
	return compat_ipv6_getsockopt(sk, level, optname, optval, optlen);
1375 1376 1377
}
#endif

1378
static const struct inet6_protocol udpv6_protocol = {
L
Linus Torvalds 已提交
1379 1380 1381 1382 1383 1384 1385
	.handler	=	udpv6_rcv,
	.err_handler	=	udpv6_err,
	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
};

/* ------------------------------------------------------------------------ */
#ifdef CONFIG_PROC_FS
1386
int udp6_seq_show(struct seq_file *seq, void *v)
L
Linus Torvalds 已提交
1387
{
1388 1389 1390 1391 1392 1393 1394 1395 1396
	if (v == SEQ_START_TOKEN) {
		seq_puts(seq, IPV6_SEQ_DGRAM_HEADER);
	} else {
		int bucket = ((struct udp_iter_state *)seq->private)->bucket;
		struct inet_sock *inet = inet_sk(v);
		__u16 srcp = ntohs(inet->inet_sport);
		__u16 destp = ntohs(inet->inet_dport);
		ip6_dgram_sock_seq_show(seq, v, srcp, destp, bucket);
	}
L
Linus Torvalds 已提交
1397 1398 1399
	return 0;
}

1400 1401 1402 1403 1404 1405 1406 1407
static const struct file_operations udp6_afinfo_seq_fops = {
	.owner    = THIS_MODULE,
	.open     = udp_seq_open,
	.read     = seq_read,
	.llseek   = seq_lseek,
	.release  = seq_release_net
};

L
Linus Torvalds 已提交
1408 1409 1410
static struct udp_seq_afinfo udp6_seq_afinfo = {
	.name		= "udp6",
	.family		= AF_INET6,
1411
	.udp_table	= &udp_table,
1412
	.seq_fops	= &udp6_afinfo_seq_fops,
1413 1414 1415
	.seq_ops	= {
		.show		= udp6_seq_show,
	},
L
Linus Torvalds 已提交
1416 1417
};

1418
int __net_init udp6_proc_init(struct net *net)
L
Linus Torvalds 已提交
1419
{
1420
	return udp_proc_register(net, &udp6_seq_afinfo);
L
Linus Torvalds 已提交
1421 1422
}

I
Ian Morris 已提交
1423 1424
void udp6_proc_exit(struct net *net)
{
1425
	udp_proc_unregister(net, &udp6_seq_afinfo);
L
Linus Torvalds 已提交
1426 1427 1428
}
#endif /* CONFIG_PROC_FS */

E
Eric Dumazet 已提交
1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439
void udp_v6_clear_sk(struct sock *sk, int size)
{
	struct inet_sock *inet = inet_sk(sk);

	/* we do not want to clear pinet6 field, because of RCU lookups */
	sk_prot_clear_portaddr_nulls(sk, offsetof(struct inet_sock, pinet6));

	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
	memset(&inet->pinet6 + 1, 0, size);
}

L
Linus Torvalds 已提交
1440 1441 1442
/* ------------------------------------------------------------------------ */

struct proto udpv6_prot = {
1443 1444
	.name		   = "UDPv6",
	.owner		   = THIS_MODULE,
1445
	.close		   = udp_lib_close,
1446 1447 1448 1449 1450 1451 1452 1453
	.connect	   = ip6_datagram_connect,
	.disconnect	   = udp_disconnect,
	.ioctl		   = udp_ioctl,
	.destroy	   = udpv6_destroy_sock,
	.setsockopt	   = udpv6_setsockopt,
	.getsockopt	   = udpv6_getsockopt,
	.sendmsg	   = udpv6_sendmsg,
	.recvmsg	   = udpv6_recvmsg,
1454
	.backlog_rcv	   = __udpv6_queue_rcv_skb,
1455
	.release_cb	   = ip6_datagram_release_cb,
1456 1457
	.hash		   = udp_lib_hash,
	.unhash		   = udp_lib_unhash,
E
Eric Dumazet 已提交
1458
	.rehash		   = udp_v6_rehash,
1459
	.get_port	   = udp_v6_get_port,
H
Hideo Aoki 已提交
1460 1461 1462 1463
	.memory_allocated  = &udp_memory_allocated,
	.sysctl_mem	   = sysctl_udp_mem,
	.sysctl_wmem	   = &sysctl_udp_wmem_min,
	.sysctl_rmem	   = &sysctl_udp_rmem_min,
1464
	.obj_size	   = sizeof(struct udp6_sock),
1465
	.slab_flags	   = SLAB_DESTROY_BY_RCU,
1466
	.h.udp_table	   = &udp_table,
1467
#ifdef CONFIG_COMPAT
1468 1469
	.compat_setsockopt = compat_udpv6_setsockopt,
	.compat_getsockopt = compat_udpv6_getsockopt,
1470
#endif
E
Eric Dumazet 已提交
1471
	.clear_sk	   = udp_v6_clear_sk,
L
Linus Torvalds 已提交
1472 1473 1474 1475 1476 1477 1478 1479 1480 1481
};

static struct inet_protosw udpv6_protosw = {
	.type =      SOCK_DGRAM,
	.protocol =  IPPROTO_UDP,
	.prot =      &udpv6_prot,
	.ops =       &inet6_dgram_ops,
	.flags =     INET_PROTOSW_PERMANENT,
};

1482
int __init udpv6_init(void)
L
Linus Torvalds 已提交
1483
{
1484 1485
	int ret;

1486 1487
	ret = inet6_add_protocol(&udpv6_protocol, IPPROTO_UDP);
	if (ret)
1488
		goto out;
1489

1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500
	ret = inet6_register_protosw(&udpv6_protosw);
	if (ret)
		goto out_udpv6_protocol;
out:
	return ret;

out_udpv6_protocol:
	inet6_del_protocol(&udpv6_protocol, IPPROTO_UDP);
	goto out;
}

1501
void udpv6_exit(void)
1502 1503 1504
{
	inet6_unregister_protosw(&udpv6_protosw);
	inet6_del_protocol(&udpv6_protocol, IPPROTO_UDP);
L
Linus Torvalds 已提交
1505
}