?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ARM: multi_v7_defconfig: add SDHCI for i.MX
[linux-2.6.git] / net / ipv6 / ip6_output.c
blob3a692d5291636571266c6e26293bc7054228f4e3
1 /*
2 * IPv6 output functions
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on linux/net/ipv4/ip_output.c
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 *
15 * Changes:
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
20 * etc.
21 *
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
26 * for datagram xmit
27 */
28
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
41
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv6.h>
44
45 #include <net/sock.h>
46 #include <net/snmp.h>
47
48 #include <net/ipv6.h>
49 #include <net/ndisc.h>
50 #include <net/protocol.h>
51 #include <net/ip6_route.h>
52 #include <net/addrconf.h>
53 #include <net/rawv6.h>
54 #include <net/icmp.h>
55 #include <net/xfrm.h>
56 #include <net/checksum.h>
57 #include <linux/mroute6.h>
58
59 static int ip6_finish_output2(struct sk_buff *skb)
60 {
61 struct dst_entry *dst = skb_dst(skb);
62 struct net_device *dev = dst->dev;
63 struct neighbour *neigh;
64 struct in6_addr *nexthop;
65 int ret;
66
67 skb->protocol = htons(ETH_P_IPV6);
68 skb->dev = dev;
69
70 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
71 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
72
73 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
74 ((mroute6_socket(dev_net(dev), skb) &&
75 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
76 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
77 &ipv6_hdr(skb)->saddr))) {
78 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
79
80 /* Do not check for IFF_ALLMULTI; multicast routing
81 is not supported in any case.
82 */
83 if (newskb)
84 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
85 newskb, NULL, newskb->dev,
86 dev_loopback_xmit);
87
88 if (ipv6_hdr(skb)->hop_limit == 0) {
89 IP6_INC_STATS(dev_net(dev), idev,
90 IPSTATS_MIB_OUTDISCARDS);
91 kfree_skb(skb);
92 return 0;
93 }
94 }
95
96 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
97 skb->len);
98
99 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
100 IPV6_ADDR_SCOPE_NODELOCAL &&
101 !(dev->flags & IFF_LOOPBACK)) {
102 kfree_skb(skb);
103 return 0;
104 }
105 }
106
107 rcu_read_lock_bh();
108 nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
109 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
110 if (unlikely(!neigh))
111 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
112 if (!IS_ERR(neigh)) {
113 ret = dst_neigh_output(dst, neigh, skb);
114 rcu_read_unlock_bh();
115 return ret;
116 }
117 rcu_read_unlock_bh();
118
119 IP6_INC_STATS_BH(dev_net(dst->dev),
120 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
121 kfree_skb(skb);
122 return -EINVAL;
123 }
124
125 static int ip6_finish_output(struct sk_buff *skb)
126 {
127 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
128 dst_allfrag(skb_dst(skb)))
129 return ip6_fragment(skb, ip6_finish_output2);
130 else
131 return ip6_finish_output2(skb);
132 }
133
134 int ip6_output(struct sk_buff *skb)
135 {
136 struct net_device *dev = skb_dst(skb)->dev;
137 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
138 if (unlikely(idev->cnf.disable_ipv6)) {
139 IP6_INC_STATS(dev_net(dev), idev,
140 IPSTATS_MIB_OUTDISCARDS);
141 kfree_skb(skb);
142 return 0;
143 }
144
145 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
146 ip6_finish_output,
147 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
148 }
149
150 /*
151 * xmit an sk_buff (used by TCP, SCTP and DCCP)
152 */
153
154 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
155 struct ipv6_txoptions *opt, int tclass)
156 {
157 struct net *net = sock_net(sk);
158 struct ipv6_pinfo *np = inet6_sk(sk);
159 struct in6_addr *first_hop = &fl6->daddr;
160 struct dst_entry *dst = skb_dst(skb);
161 struct ipv6hdr *hdr;
162 u8 proto = fl6->flowi6_proto;
163 int seg_len = skb->len;
164 int hlimit = -1;
165 u32 mtu;
166
167 if (opt) {
168 unsigned int head_room;
169
170 /* First: exthdrs may take lots of space (~8K for now)
171 MAX_HEADER is not enough.
172 */
173 head_room = opt->opt_nflen + opt->opt_flen;
174 seg_len += head_room;
175 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
176
177 if (skb_headroom(skb) < head_room) {
178 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
179 if (skb2 == NULL) {
180 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
181 IPSTATS_MIB_OUTDISCARDS);
182 kfree_skb(skb);
183 return -ENOBUFS;
184 }
185 consume_skb(skb);
186 skb = skb2;
187 skb_set_owner_w(skb, sk);
188 }
189 if (opt->opt_flen)
190 ipv6_push_frag_opts(skb, opt, &proto);
191 if (opt->opt_nflen)
192 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
193 }
194
195 skb_push(skb, sizeof(struct ipv6hdr));
196 skb_reset_network_header(skb);
197 hdr = ipv6_hdr(skb);
198
199 /*
200 * Fill in the IPv6 header
201 */
202 if (np)
203 hlimit = np->hop_limit;
204 if (hlimit < 0)
205 hlimit = ip6_dst_hoplimit(dst);
206
207 ip6_flow_hdr(hdr, tclass, fl6->flowlabel);
208
209 hdr->payload_len = htons(seg_len);
210 hdr->nexthdr = proto;
211 hdr->hop_limit = hlimit;
212
213 hdr->saddr = fl6->saddr;
214 hdr->daddr = *first_hop;
215
216 skb->protocol = htons(ETH_P_IPV6);
217 skb->priority = sk->sk_priority;
218 skb->mark = sk->sk_mark;
219
220 mtu = dst_mtu(dst);
221 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
222 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
223 IPSTATS_MIB_OUT, skb->len);
224 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
225 dst->dev, dst_output);
226 }
227
228 skb->dev = dst->dev;
229 ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
230 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
231 kfree_skb(skb);
232 return -EMSGSIZE;
233 }
234
235 EXPORT_SYMBOL(ip6_xmit);
236
237 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
238 {
239 struct ip6_ra_chain *ra;
240 struct sock *last = NULL;
241
242 read_lock(&ip6_ra_lock);
243 for (ra = ip6_ra_chain; ra; ra = ra->next) {
244 struct sock *sk = ra->sk;
245 if (sk && ra->sel == sel &&
246 (!sk->sk_bound_dev_if ||
247 sk->sk_bound_dev_if == skb->dev->ifindex)) {
248 if (last) {
249 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
250 if (skb2)
251 rawv6_rcv(last, skb2);
252 }
253 last = sk;
254 }
255 }
256
257 if (last) {
258 rawv6_rcv(last, skb);
259 read_unlock(&ip6_ra_lock);
260 return 1;
261 }
262 read_unlock(&ip6_ra_lock);
263 return 0;
264 }
265
266 static int ip6_forward_proxy_check(struct sk_buff *skb)
267 {
268 struct ipv6hdr *hdr = ipv6_hdr(skb);
269 u8 nexthdr = hdr->nexthdr;
270 __be16 frag_off;
271 int offset;
272
273 if (ipv6_ext_hdr(nexthdr)) {
274 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
275 if (offset < 0)
276 return 0;
277 } else
278 offset = sizeof(struct ipv6hdr);
279
280 if (nexthdr == IPPROTO_ICMPV6) {
281 struct icmp6hdr *icmp6;
282
283 if (!pskb_may_pull(skb, (skb_network_header(skb) +
284 offset + 1 - skb->data)))
285 return 0;
286
287 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
288
289 switch (icmp6->icmp6_type) {
290 case NDISC_ROUTER_SOLICITATION:
291 case NDISC_ROUTER_ADVERTISEMENT:
292 case NDISC_NEIGHBOUR_SOLICITATION:
293 case NDISC_NEIGHBOUR_ADVERTISEMENT:
294 case NDISC_REDIRECT:
295 /* For reaction involving unicast neighbor discovery
296 * message destined to the proxied address, pass it to
297 * input function.
298 */
299 return 1;
300 default:
301 break;
302 }
303 }
304
305 /*
306 * The proxying router can't forward traffic sent to a link-local
307 * address, so signal the sender and discard the packet. This
308 * behavior is clarified by the MIPv6 specification.
309 */
310 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
311 dst_link_failure(skb);
312 return -1;
313 }
314
315 return 0;
316 }
317
318 static inline int ip6_forward_finish(struct sk_buff *skb)
319 {
320 return dst_output(skb);
321 }
322
323 int ip6_forward(struct sk_buff *skb)
324 {
325 struct dst_entry *dst = skb_dst(skb);
326 struct ipv6hdr *hdr = ipv6_hdr(skb);
327 struct inet6_skb_parm *opt = IP6CB(skb);
328 struct net *net = dev_net(dst->dev);
329 u32 mtu;
330
331 if (net->ipv6.devconf_all->forwarding == 0)
332 goto error;
333
334 if (skb_warn_if_lro(skb))
335 goto drop;
336
337 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
338 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
339 goto drop;
340 }
341
342 if (skb->pkt_type != PACKET_HOST)
343 goto drop;
344
345 skb_forward_csum(skb);
346
347 /*
348 * We DO NOT make any processing on
349 * RA packets, pushing them to user level AS IS
350 * without ane WARRANTY that application will be able
351 * to interpret them. The reason is that we
352 * cannot make anything clever here.
353 *
354 * We are not end-node, so that if packet contains
355 * AH/ESP, we cannot make anything.
356 * Defragmentation also would be mistake, RA packets
357 * cannot be fragmented, because there is no warranty
358 * that different fragments will go along one path. --ANK
359 */
360 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
361 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
362 return 0;
363 }
364
365 /*
366 * check and decrement ttl
367 */
368 if (hdr->hop_limit <= 1) {
369 /* Force OUTPUT device used as source address */
370 skb->dev = dst->dev;
371 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
372 IP6_INC_STATS_BH(net,
373 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
374
375 kfree_skb(skb);
376 return -ETIMEDOUT;
377 }
378
379 /* XXX: idev->cnf.proxy_ndp? */
380 if (net->ipv6.devconf_all->proxy_ndp &&
381 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
382 int proxied = ip6_forward_proxy_check(skb);
383 if (proxied > 0)
384 return ip6_input(skb);
385 else if (proxied < 0) {
386 IP6_INC_STATS(net, ip6_dst_idev(dst),
387 IPSTATS_MIB_INDISCARDS);
388 goto drop;
389 }
390 }
391
392 if (!xfrm6_route_forward(skb)) {
393 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
394 goto drop;
395 }
396 dst = skb_dst(skb);
397
398 /* IPv6 specs say nothing about it, but it is clear that we cannot
399 send redirects to source routed frames.
400 We don't send redirects to frames decapsulated from IPsec.
401 */
402 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
403 struct in6_addr *target = NULL;
404 struct inet_peer *peer;
405 struct rt6_info *rt;
406
407 /*
408 * incoming and outgoing devices are the same
409 * send a redirect.
410 */
411
412 rt = (struct rt6_info *) dst;
413 if (rt->rt6i_flags & RTF_GATEWAY)
414 target = &rt->rt6i_gateway;
415 else
416 target = &hdr->daddr;
417
418 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
419
420 /* Limit redirects both by destination (here)
421 and by source (inside ndisc_send_redirect)
422 */
423 if (inet_peer_xrlim_allow(peer, 1*HZ))
424 ndisc_send_redirect(skb, target);
425 if (peer)
426 inet_putpeer(peer);
427 } else {
428 int addrtype = ipv6_addr_type(&hdr->saddr);
429
430 /* This check is security critical. */
431 if (addrtype == IPV6_ADDR_ANY ||
432 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
433 goto error;
434 if (addrtype & IPV6_ADDR_LINKLOCAL) {
435 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
436 ICMPV6_NOT_NEIGHBOUR, 0);
437 goto error;
438 }
439 }
440
441 mtu = dst_mtu(dst);
442 if (mtu < IPV6_MIN_MTU)
443 mtu = IPV6_MIN_MTU;
444
445 if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
446 (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
447 /* Again, force OUTPUT device used as source address */
448 skb->dev = dst->dev;
449 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
450 IP6_INC_STATS_BH(net,
451 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
452 IP6_INC_STATS_BH(net,
453 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
454 kfree_skb(skb);
455 return -EMSGSIZE;
456 }
457
458 if (skb_cow(skb, dst->dev->hard_header_len)) {
459 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
460 goto drop;
461 }
462
463 hdr = ipv6_hdr(skb);
464
465 /* Mangling hops number delayed to point after skb COW */
466
467 hdr->hop_limit--;
468
469 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
470 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
471 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
472 ip6_forward_finish);
473
474 error:
475 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
476 drop:
477 kfree_skb(skb);
478 return -EINVAL;
479 }
480
481 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
482 {
483 to->pkt_type = from->pkt_type;
484 to->priority = from->priority;
485 to->protocol = from->protocol;
486 skb_dst_drop(to);
487 skb_dst_set(to, dst_clone(skb_dst(from)));
488 to->dev = from->dev;
489 to->mark = from->mark;
490
491 #ifdef CONFIG_NET_SCHED
492 to->tc_index = from->tc_index;
493 #endif
494 nf_copy(to, from);
495 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
496 to->nf_trace = from->nf_trace;
497 #endif
498 skb_copy_secmark(to, from);
499 }
500
501 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
502 {
503 struct sk_buff *frag;
504 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
505 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
506 struct ipv6hdr *tmp_hdr;
507 struct frag_hdr *fh;
508 unsigned int mtu, hlen, left, len;
509 int hroom, troom;
510 __be32 frag_id = 0;
511 int ptr, offset = 0, err=0;
512 u8 *prevhdr, nexthdr = 0;
513 struct net *net = dev_net(skb_dst(skb)->dev);
514
515 hlen = ip6_find_1stfragopt(skb, &prevhdr);
516 nexthdr = *prevhdr;
517
518 mtu = ip6_skb_dst_mtu(skb);
519
520 /* We must not fragment if the socket is set to force MTU discovery
521 * or if the skb it not generated by a local socket.
522 */
523 if (unlikely(!skb->local_df && skb->len > mtu) ||
524 (IP6CB(skb)->frag_max_size &&
525 IP6CB(skb)->frag_max_size > mtu)) {
526 if (skb->sk && dst_allfrag(skb_dst(skb)))
527 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
528
529 skb->dev = skb_dst(skb)->dev;
530 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
531 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
532 IPSTATS_MIB_FRAGFAILS);
533 kfree_skb(skb);
534 return -EMSGSIZE;
535 }
536
537 if (np && np->frag_size < mtu) {
538 if (np->frag_size)
539 mtu = np->frag_size;
540 }
541 mtu -= hlen + sizeof(struct frag_hdr);
542
543 if (skb_has_frag_list(skb)) {
544 int first_len = skb_pagelen(skb);
545 struct sk_buff *frag2;
546
547 if (first_len - hlen > mtu ||
548 ((first_len - hlen) & 7) ||
549 skb_cloned(skb))
550 goto slow_path;
551
552 skb_walk_frags(skb, frag) {
553 /* Correct geometry. */
554 if (frag->len > mtu ||
555 ((frag->len & 7) && frag->next) ||
556 skb_headroom(frag) < hlen)
557 goto slow_path_clean;
558
559 /* Partially cloned skb? */
560 if (skb_shared(frag))
561 goto slow_path_clean;
562
563 BUG_ON(frag->sk);
564 if (skb->sk) {
565 frag->sk = skb->sk;
566 frag->destructor = sock_wfree;
567 }
568 skb->truesize -= frag->truesize;
569 }
570
571 err = 0;
572 offset = 0;
573 frag = skb_shinfo(skb)->frag_list;
574 skb_frag_list_init(skb);
575 /* BUILD HEADER */
576
577 *prevhdr = NEXTHDR_FRAGMENT;
578 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
579 if (!tmp_hdr) {
580 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
581 IPSTATS_MIB_FRAGFAILS);
582 return -ENOMEM;
583 }
584
585 __skb_pull(skb, hlen);
586 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
587 __skb_push(skb, hlen);
588 skb_reset_network_header(skb);
589 memcpy(skb_network_header(skb), tmp_hdr, hlen);
590
591 ipv6_select_ident(fh, rt);
592 fh->nexthdr = nexthdr;
593 fh->reserved = 0;
594 fh->frag_off = htons(IP6_MF);
595 frag_id = fh->identification;
596
597 first_len = skb_pagelen(skb);
598 skb->data_len = first_len - skb_headlen(skb);
599 skb->len = first_len;
600 ipv6_hdr(skb)->payload_len = htons(first_len -
601 sizeof(struct ipv6hdr));
602
603 dst_hold(&rt->dst);
604
605 for (;;) {
606 /* Prepare header of the next frame,
607 * before previous one went down. */
608 if (frag) {
609 frag->ip_summed = CHECKSUM_NONE;
610 skb_reset_transport_header(frag);
611 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
612 __skb_push(frag, hlen);
613 skb_reset_network_header(frag);
614 memcpy(skb_network_header(frag), tmp_hdr,
615 hlen);
616 offset += skb->len - hlen - sizeof(struct frag_hdr);
617 fh->nexthdr = nexthdr;
618 fh->reserved = 0;
619 fh->frag_off = htons(offset);
620 if (frag->next != NULL)
621 fh->frag_off |= htons(IP6_MF);
622 fh->identification = frag_id;
623 ipv6_hdr(frag)->payload_len =
624 htons(frag->len -
625 sizeof(struct ipv6hdr));
626 ip6_copy_metadata(frag, skb);
627 }
628
629 err = output(skb);
630 if(!err)
631 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
632 IPSTATS_MIB_FRAGCREATES);
633
634 if (err || !frag)
635 break;
636
637 skb = frag;
638 frag = skb->next;
639 skb->next = NULL;
640 }
641
642 kfree(tmp_hdr);
643
644 if (err == 0) {
645 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
646 IPSTATS_MIB_FRAGOKS);
647 ip6_rt_put(rt);
648 return 0;
649 }
650
651 while (frag) {
652 skb = frag->next;
653 kfree_skb(frag);
654 frag = skb;
655 }
656
657 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
658 IPSTATS_MIB_FRAGFAILS);
659 ip6_rt_put(rt);
660 return err;
661
662 slow_path_clean:
663 skb_walk_frags(skb, frag2) {
664 if (frag2 == frag)
665 break;
666 frag2->sk = NULL;
667 frag2->destructor = NULL;
668 skb->truesize += frag2->truesize;
669 }
670 }
671
672 slow_path:
673 if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
674 skb_checksum_help(skb))
675 goto fail;
676
677 left = skb->len - hlen; /* Space per frame */
678 ptr = hlen; /* Where to start from */
679
680 /*
681 * Fragment the datagram.
682 */
683
684 *prevhdr = NEXTHDR_FRAGMENT;
685 hroom = LL_RESERVED_SPACE(rt->dst.dev);
686 troom = rt->dst.dev->needed_tailroom;
687
688 /*
689 * Keep copying data until we run out.
690 */
691 while(left > 0) {
692 len = left;
693 /* IF: it doesn't fit, use 'mtu' - the data space left */
694 if (len > mtu)
695 len = mtu;
696 /* IF: we are not sending up to and including the packet end
697 then align the next start on an eight byte boundary */
698 if (len < left) {
699 len &= ~7;
700 }
701 /*
702 * Allocate buffer.
703 */
704
705 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
706 hroom + troom, GFP_ATOMIC)) == NULL) {
707 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
708 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
709 IPSTATS_MIB_FRAGFAILS);
710 err = -ENOMEM;
711 goto fail;
712 }
713
714 /*
715 * Set up data on packet
716 */
717
718 ip6_copy_metadata(frag, skb);
719 skb_reserve(frag, hroom);
720 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
721 skb_reset_network_header(frag);
722 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
723 frag->transport_header = (frag->network_header + hlen +
724 sizeof(struct frag_hdr));
725
726 /*
727 * Charge the memory for the fragment to any owner
728 * it might possess
729 */
730 if (skb->sk)
731 skb_set_owner_w(frag, skb->sk);
732
733 /*
734 * Copy the packet header into the new buffer.
735 */
736 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
737
738 /*
739 * Build fragment header.
740 */
741 fh->nexthdr = nexthdr;
742 fh->reserved = 0;
743 if (!frag_id) {
744 ipv6_select_ident(fh, rt);
745 frag_id = fh->identification;
746 } else
747 fh->identification = frag_id;
748
749 /*
750 * Copy a block of the IP datagram.
751 */
752 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
753 BUG();
754 left -= len;
755
756 fh->frag_off = htons(offset);
757 if (left > 0)
758 fh->frag_off |= htons(IP6_MF);
759 ipv6_hdr(frag)->payload_len = htons(frag->len -
760 sizeof(struct ipv6hdr));
761
762 ptr += len;
763 offset += len;
764
765 /*
766 * Put this fragment into the sending queue.
767 */
768 err = output(frag);
769 if (err)
770 goto fail;
771
772 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
773 IPSTATS_MIB_FRAGCREATES);
774 }
775 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
776 IPSTATS_MIB_FRAGOKS);
777 consume_skb(skb);
778 return err;
779
780 fail:
781 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
782 IPSTATS_MIB_FRAGFAILS);
783 kfree_skb(skb);
784 return err;
785 }
786
787 static inline int ip6_rt_check(const struct rt6key *rt_key,
788 const struct in6_addr *fl_addr,
789 const struct in6_addr *addr_cache)
790 {
791 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
792 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
793 }
794
795 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
796 struct dst_entry *dst,
797 const struct flowi6 *fl6)
798 {
799 struct ipv6_pinfo *np = inet6_sk(sk);
800 struct rt6_info *rt;
801
802 if (!dst)
803 goto out;
804
805 if (dst->ops->family != AF_INET6) {
806 dst_release(dst);
807 return NULL;
808 }
809
810 rt = (struct rt6_info *)dst;
811 /* Yes, checking route validity in not connected
812 * case is not very simple. Take into account,
813 * that we do not support routing by source, TOS,
814 * and MSG_DONTROUTE --ANK (980726)
815 *
816 * 1. ip6_rt_check(): If route was host route,
817 * check that cached destination is current.
818 * If it is network route, we still may
819 * check its validity using saved pointer
820 * to the last used address: daddr_cache.
821 * We do not want to save whole address now,
822 * (because main consumer of this service
823 * is tcp, which has not this problem),
824 * so that the last trick works only on connected
825 * sockets.
826 * 2. oif also should be the same.
827 */
828 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
829 #ifdef CONFIG_IPV6_SUBTREES
830 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
831 #endif
832 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
833 dst_release(dst);
834 dst = NULL;
835 }
836
837 out:
838 return dst;
839 }
840
841 static int ip6_dst_lookup_tail(struct sock *sk,
842 struct dst_entry **dst, struct flowi6 *fl6)
843 {
844 struct net *net = sock_net(sk);
845 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
846 struct neighbour *n;
847 struct rt6_info *rt;
848 #endif
849 int err;
850
851 if (*dst == NULL)
852 *dst = ip6_route_output(net, sk, fl6);
853
854 if ((err = (*dst)->error))
855 goto out_err_release;
856
857 if (ipv6_addr_any(&fl6->saddr)) {
858 struct rt6_info *rt = (struct rt6_info *) *dst;
859 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
860 sk ? inet6_sk(sk)->srcprefs : 0,
861 &fl6->saddr);
862 if (err)
863 goto out_err_release;
864 }
865
866 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
867 /*
868 * Here if the dst entry we've looked up
869 * has a neighbour entry that is in the INCOMPLETE
870 * state and the src address from the flow is
871 * marked as OPTIMISTIC, we release the found
872 * dst entry and replace it instead with the
873 * dst entry of the nexthop router
874 */
875 rt = (struct rt6_info *) *dst;
876 rcu_read_lock_bh();
877 n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt, &fl6->daddr));
878 err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
879 rcu_read_unlock_bh();
880
881 if (err) {
882 struct inet6_ifaddr *ifp;
883 struct flowi6 fl_gw6;
884 int redirect;
885
886 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
887 (*dst)->dev, 1);
888
889 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
890 if (ifp)
891 in6_ifa_put(ifp);
892
893 if (redirect) {
894 /*
895 * We need to get the dst entry for the
896 * default router instead
897 */
898 dst_release(*dst);
899 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
900 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
901 *dst = ip6_route_output(net, sk, &fl_gw6);
902 if ((err = (*dst)->error))
903 goto out_err_release;
904 }
905 }
906 #endif
907
908 return 0;
909
910 out_err_release:
911 if (err == -ENETUNREACH)
912 IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
913 dst_release(*dst);
914 *dst = NULL;
915 return err;
916 }
917
918 /**
919 * ip6_dst_lookup - perform route lookup on flow
920 * @sk: socket which provides route info
921 * @dst: pointer to dst_entry * for result
922 * @fl6: flow to lookup
923 *
924 * This function performs a route lookup on the given flow.
925 *
926 * It returns zero on success, or a standard errno code on error.
927 */
928 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
929 {
930 *dst = NULL;
931 return ip6_dst_lookup_tail(sk, dst, fl6);
932 }
933 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
934
935 /**
936 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
937 * @sk: socket which provides route info
938 * @fl6: flow to lookup
939 * @final_dst: final destination address for ipsec lookup
940 * @can_sleep: we are in a sleepable context
941 *
942 * This function performs a route lookup on the given flow.
943 *
944 * It returns a valid dst pointer on success, or a pointer encoded
945 * error code.
946 */
947 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
948 const struct in6_addr *final_dst,
949 bool can_sleep)
950 {
951 struct dst_entry *dst = NULL;
952 int err;
953
954 err = ip6_dst_lookup_tail(sk, &dst, fl6);
955 if (err)
956 return ERR_PTR(err);
957 if (final_dst)
958 fl6->daddr = *final_dst;
959 if (can_sleep)
960 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
961
962 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
963 }
964 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
965
966 /**
967 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
968 * @sk: socket which provides the dst cache and route info
969 * @fl6: flow to lookup
970 * @final_dst: final destination address for ipsec lookup
971 * @can_sleep: we are in a sleepable context
972 *
973 * This function performs a route lookup on the given flow with the
974 * possibility of using the cached route in the socket if it is valid.
975 * It will take the socket dst lock when operating on the dst cache.
976 * As a result, this function can only be used in process context.
977 *
978 * It returns a valid dst pointer on success, or a pointer encoded
979 * error code.
980 */
981 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
982 const struct in6_addr *final_dst,
983 bool can_sleep)
984 {
985 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
986 int err;
987
988 dst = ip6_sk_dst_check(sk, dst, fl6);
989
990 err = ip6_dst_lookup_tail(sk, &dst, fl6);
991 if (err)
992 return ERR_PTR(err);
993 if (final_dst)
994 fl6->daddr = *final_dst;
995 if (can_sleep)
996 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
997
998 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
999 }
1000 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1001
1002 static inline int ip6_ufo_append_data(struct sock *sk,
1003 int getfrag(void *from, char *to, int offset, int len,
1004 int odd, struct sk_buff *skb),
1005 void *from, int length, int hh_len, int fragheaderlen,
1006 int transhdrlen, int mtu,unsigned int flags,
1007 struct rt6_info *rt)
1008
1009 {
1010 struct sk_buff *skb;
1011 int err;
1012
1013 /* There is support for UDP large send offload by network
1014 * device, so create one single skb packet containing complete
1015 * udp datagram
1016 */
1017 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1018 skb = sock_alloc_send_skb(sk,
1019 hh_len + fragheaderlen + transhdrlen + 20,
1020 (flags & MSG_DONTWAIT), &err);
1021 if (skb == NULL)
1022 return err;
1023
1024 /* reserve space for Hardware header */
1025 skb_reserve(skb, hh_len);
1026
1027 /* create space for UDP/IP header */
1028 skb_put(skb,fragheaderlen + transhdrlen);
1029
1030 /* initialize network header pointer */
1031 skb_reset_network_header(skb);
1032
1033 /* initialize protocol header pointer */
1034 skb->transport_header = skb->network_header + fragheaderlen;
1035
1036 skb->protocol = htons(ETH_P_IPV6);
1037 skb->ip_summed = CHECKSUM_PARTIAL;
1038 skb->csum = 0;
1039 }
1040
1041 err = skb_append_datato_frags(sk,skb, getfrag, from,
1042 (length - transhdrlen));
1043 if (!err) {
1044 struct frag_hdr fhdr;
1045
1046 /* Specify the length of each IPv6 datagram fragment.
1047 * It has to be a multiple of 8.
1048 */
1049 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1050 sizeof(struct frag_hdr)) & ~7;
1051 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1052 ipv6_select_ident(&fhdr, rt);
1053 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1054 __skb_queue_tail(&sk->sk_write_queue, skb);
1055
1056 return 0;
1057 }
1058 /* There is not enough support do UPD LSO,
1059 * so follow normal path
1060 */
1061 kfree_skb(skb);
1062
1063 return err;
1064 }
1065
1066 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1067 gfp_t gfp)
1068 {
1069 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1070 }
1071
1072 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1073 gfp_t gfp)
1074 {
1075 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1076 }
1077
1078 static void ip6_append_data_mtu(unsigned int *mtu,
1079 int *maxfraglen,
1080 unsigned int fragheaderlen,
1081 struct sk_buff *skb,
1082 struct rt6_info *rt,
1083 bool pmtuprobe)
1084 {
1085 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1086 if (skb == NULL) {
1087 /* first fragment, reserve header_len */
1088 *mtu = *mtu - rt->dst.header_len;
1089
1090 } else {
1091 /*
1092 * this fragment is not first, the headers
1093 * space is regarded as data space.
1094 */
1095 *mtu = min(*mtu, pmtuprobe ?
1096 rt->dst.dev->mtu :
1097 dst_mtu(rt->dst.path));
1098 }
1099 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1100 + fragheaderlen - sizeof(struct frag_hdr);
1101 }
1102 }
1103
1104 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1105 int offset, int len, int odd, struct sk_buff *skb),
1106 void *from, int length, int transhdrlen,
1107 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1108 struct rt6_info *rt, unsigned int flags, int dontfrag)
1109 {
1110 struct inet_sock *inet = inet_sk(sk);
1111 struct ipv6_pinfo *np = inet6_sk(sk);
1112 struct inet_cork *cork;
1113 struct sk_buff *skb, *skb_prev = NULL;
1114 unsigned int maxfraglen, fragheaderlen, mtu;
1115 int exthdrlen;
1116 int dst_exthdrlen;
1117 int hh_len;
1118 int copy;
1119 int err;
1120 int offset = 0;
1121 __u8 tx_flags = 0;
1122
1123 if (flags&MSG_PROBE)
1124 return 0;
1125 cork = &inet->cork.base;
1126 if (skb_queue_empty(&sk->sk_write_queue)) {
1127 /*
1128 * setup for corking
1129 */
1130 if (opt) {
1131 if (WARN_ON(np->cork.opt))
1132 return -EINVAL;
1133
1134 np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1135 if (unlikely(np->cork.opt == NULL))
1136 return -ENOBUFS;
1137
1138 np->cork.opt->tot_len = opt->tot_len;
1139 np->cork.opt->opt_flen = opt->opt_flen;
1140 np->cork.opt->opt_nflen = opt->opt_nflen;
1141
1142 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1143 sk->sk_allocation);
1144 if (opt->dst0opt && !np->cork.opt->dst0opt)
1145 return -ENOBUFS;
1146
1147 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1148 sk->sk_allocation);
1149 if (opt->dst1opt && !np->cork.opt->dst1opt)
1150 return -ENOBUFS;
1151
1152 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1153 sk->sk_allocation);
1154 if (opt->hopopt && !np->cork.opt->hopopt)
1155 return -ENOBUFS;
1156
1157 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1158 sk->sk_allocation);
1159 if (opt->srcrt && !np->cork.opt->srcrt)
1160 return -ENOBUFS;
1161
1162 /* need source address above miyazawa*/
1163 }
1164 dst_hold(&rt->dst);
1165 cork->dst = &rt->dst;
1166 inet->cork.fl.u.ip6 = *fl6;
1167 np->cork.hop_limit = hlimit;
1168 np->cork.tclass = tclass;
1169 if (rt->dst.flags & DST_XFRM_TUNNEL)
1170 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1171 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1172 else
1173 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1174 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1175 if (np->frag_size < mtu) {
1176 if (np->frag_size)
1177 mtu = np->frag_size;
1178 }
1179 cork->fragsize = mtu;
1180 if (dst_allfrag(rt->dst.path))
1181 cork->flags |= IPCORK_ALLFRAG;
1182 cork->length = 0;
1183 exthdrlen = (opt ? opt->opt_flen : 0);
1184 length += exthdrlen;
1185 transhdrlen += exthdrlen;
1186 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1187 } else {
1188 rt = (struct rt6_info *)cork->dst;
1189 fl6 = &inet->cork.fl.u.ip6;
1190 opt = np->cork.opt;
1191 transhdrlen = 0;
1192 exthdrlen = 0;
1193 dst_exthdrlen = 0;
1194 mtu = cork->fragsize;
1195 }
1196
1197 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1198
1199 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1200 (opt ? opt->opt_nflen : 0);
1201 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1202
1203 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1204 if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1205 ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1206 return -EMSGSIZE;
1207 }
1208 }
1209
1210 /* For UDP, check if TX timestamp is enabled */
1211 if (sk->sk_type == SOCK_DGRAM)
1212 sock_tx_timestamp(sk, &tx_flags);
1213
1214 /*
1215 * Let's try using as much space as possible.
1216 * Use MTU if total length of the message fits into the MTU.
1217 * Otherwise, we need to reserve fragment header and
1218 * fragment alignment (= 8-15 octects, in total).
1219 *
1220 * Note that we may need to "move" the data from the tail of
1221 * of the buffer to the new fragment when we split
1222 * the message.
1223 *
1224 * FIXME: It may be fragmented into multiple chunks
1225 * at once if non-fragmentable extension headers
1226 * are too large.
1227 * --yoshfuji
1228 */
1229
1230 cork->length += length;
1231 if (length > mtu) {
1232 int proto = sk->sk_protocol;
1233 if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
1234 ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1235 return -EMSGSIZE;
1236 }
1237
1238 if (proto == IPPROTO_UDP &&
1239 (rt->dst.dev->features & NETIF_F_UFO)) {
1240
1241 err = ip6_ufo_append_data(sk, getfrag, from, length,
1242 hh_len, fragheaderlen,
1243 transhdrlen, mtu, flags, rt);
1244 if (err)
1245 goto error;
1246 return 0;
1247 }
1248 }
1249
1250 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
1251 goto alloc_new_skb;
1252
1253 while (length > 0) {
1254 /* Check if the remaining data fits into current packet. */
1255 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1256 if (copy < length)
1257 copy = maxfraglen - skb->len;
1258
1259 if (copy <= 0) {
1260 char *data;
1261 unsigned int datalen;
1262 unsigned int fraglen;
1263 unsigned int fraggap;
1264 unsigned int alloclen;
1265 alloc_new_skb:
1266 /* There's no room in the current skb */
1267 if (skb)
1268 fraggap = skb->len - maxfraglen;
1269 else
1270 fraggap = 0;
1271 /* update mtu and maxfraglen if necessary */
1272 if (skb == NULL || skb_prev == NULL)
1273 ip6_append_data_mtu(&mtu, &maxfraglen,
1274 fragheaderlen, skb, rt,
1275 np->pmtudisc ==
1276 IPV6_PMTUDISC_PROBE);
1277
1278 skb_prev = skb;
1279
1280 /*
1281 * If remaining data exceeds the mtu,
1282 * we know we need more fragment(s).
1283 */
1284 datalen = length + fraggap;
1285
1286 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1287 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1288 if ((flags & MSG_MORE) &&
1289 !(rt->dst.dev->features&NETIF_F_SG))
1290 alloclen = mtu;
1291 else
1292 alloclen = datalen + fragheaderlen;
1293
1294 alloclen += dst_exthdrlen;
1295
1296 if (datalen != length + fraggap) {
1297 /*
1298 * this is not the last fragment, the trailer
1299 * space is regarded as data space.
1300 */
1301 datalen += rt->dst.trailer_len;
1302 }
1303
1304 alloclen += rt->dst.trailer_len;
1305 fraglen = datalen + fragheaderlen;
1306
1307 /*
1308 * We just reserve space for fragment header.
1309 * Note: this may be overallocation if the message
1310 * (without MSG_MORE) fits into the MTU.
1311 */
1312 alloclen += sizeof(struct frag_hdr);
1313
1314 if (transhdrlen) {
1315 skb = sock_alloc_send_skb(sk,
1316 alloclen + hh_len,
1317 (flags & MSG_DONTWAIT), &err);
1318 } else {
1319 skb = NULL;
1320 if (atomic_read(&sk->sk_wmem_alloc) <=
1321 2 * sk->sk_sndbuf)
1322 skb = sock_wmalloc(sk,
1323 alloclen + hh_len, 1,
1324 sk->sk_allocation);
1325 if (unlikely(skb == NULL))
1326 err = -ENOBUFS;
1327 else {
1328 /* Only the initial fragment
1329 * is time stamped.
1330 */
1331 tx_flags = 0;
1332 }
1333 }
1334 if (skb == NULL)
1335 goto error;
1336 /*
1337 * Fill in the control structures
1338 */
1339 skb->protocol = htons(ETH_P_IPV6);
1340 skb->ip_summed = CHECKSUM_NONE;
1341 skb->csum = 0;
1342 /* reserve for fragmentation and ipsec header */
1343 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1344 dst_exthdrlen);
1345
1346 if (sk->sk_type == SOCK_DGRAM)
1347 skb_shinfo(skb)->tx_flags = tx_flags;
1348
1349 /*
1350 * Find where to start putting bytes
1351 */
1352 data = skb_put(skb, fraglen);
1353 skb_set_network_header(skb, exthdrlen);
1354 data += fragheaderlen;
1355 skb->transport_header = (skb->network_header +
1356 fragheaderlen);
1357 if (fraggap) {
1358 skb->csum = skb_copy_and_csum_bits(
1359 skb_prev, maxfraglen,
1360 data + transhdrlen, fraggap, 0);
1361 skb_prev->csum = csum_sub(skb_prev->csum,
1362 skb->csum);
1363 data += fraggap;
1364 pskb_trim_unique(skb_prev, maxfraglen);
1365 }
1366 copy = datalen - transhdrlen - fraggap;
1367
1368 if (copy < 0) {
1369 err = -EINVAL;
1370 kfree_skb(skb);
1371 goto error;
1372 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1373 err = -EFAULT;
1374 kfree_skb(skb);
1375 goto error;
1376 }
1377
1378 offset += copy;
1379 length -= datalen - fraggap;
1380 transhdrlen = 0;
1381 exthdrlen = 0;
1382 dst_exthdrlen = 0;
1383
1384 /*
1385 * Put the packet on the pending queue
1386 */
1387 __skb_queue_tail(&sk->sk_write_queue, skb);
1388 continue;
1389 }
1390
1391 if (copy > length)
1392 copy = length;
1393
1394 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1395 unsigned int off;
1396
1397 off = skb->len;
1398 if (getfrag(from, skb_put(skb, copy),
1399 offset, copy, off, skb) < 0) {
1400 __skb_trim(skb, off);
1401 err = -EFAULT;
1402 goto error;
1403 }
1404 } else {
1405 int i = skb_shinfo(skb)->nr_frags;
1406 struct page_frag *pfrag = sk_page_frag(sk);
1407
1408 err = -ENOMEM;
1409 if (!sk_page_frag_refill(sk, pfrag))
1410 goto error;
1411
1412 if (!skb_can_coalesce(skb, i, pfrag->page,
1413 pfrag->offset)) {
1414 err = -EMSGSIZE;
1415 if (i == MAX_SKB_FRAGS)
1416 goto error;
1417
1418 __skb_fill_page_desc(skb, i, pfrag->page,
1419 pfrag->offset, 0);
1420 skb_shinfo(skb)->nr_frags = ++i;
1421 get_page(pfrag->page);
1422 }
1423 copy = min_t(int, copy, pfrag->size - pfrag->offset);
1424 if (getfrag(from,
1425 page_address(pfrag->page) + pfrag->offset,
1426 offset, copy, skb->len, skb) < 0)
1427 goto error_efault;
1428
1429 pfrag->offset += copy;
1430 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1431 skb->len += copy;
1432 skb->data_len += copy;
1433 skb->truesize += copy;
1434 atomic_add(copy, &sk->sk_wmem_alloc);
1435 }
1436 offset += copy;
1437 length -= copy;
1438 }
1439
1440 return 0;
1441
1442 error_efault:
1443 err = -EFAULT;
1444 error:
1445 cork->length -= length;
1446 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1447 return err;
1448 }
1449 EXPORT_SYMBOL_GPL(ip6_append_data);
1450
1451 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1452 {
1453 if (np->cork.opt) {
1454 kfree(np->cork.opt->dst0opt);
1455 kfree(np->cork.opt->dst1opt);
1456 kfree(np->cork.opt->hopopt);
1457 kfree(np->cork.opt->srcrt);
1458 kfree(np->cork.opt);
1459 np->cork.opt = NULL;
1460 }
1461
1462 if (inet->cork.base.dst) {
1463 dst_release(inet->cork.base.dst);
1464 inet->cork.base.dst = NULL;
1465 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1466 }
1467 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1468 }
1469
1470 int ip6_push_pending_frames(struct sock *sk)
1471 {
1472 struct sk_buff *skb, *tmp_skb;
1473 struct sk_buff **tail_skb;
1474 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1475 struct inet_sock *inet = inet_sk(sk);
1476 struct ipv6_pinfo *np = inet6_sk(sk);
1477 struct net *net = sock_net(sk);
1478 struct ipv6hdr *hdr;
1479 struct ipv6_txoptions *opt = np->cork.opt;
1480 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1481 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1482 unsigned char proto = fl6->flowi6_proto;
1483 int err = 0;
1484
1485 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1486 goto out;
1487 tail_skb = &(skb_shinfo(skb)->frag_list);
1488
1489 /* move skb->data to ip header from ext header */
1490 if (skb->data < skb_network_header(skb))
1491 __skb_pull(skb, skb_network_offset(skb));
1492 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1493 __skb_pull(tmp_skb, skb_network_header_len(skb));
1494 *tail_skb = tmp_skb;
1495 tail_skb = &(tmp_skb->next);
1496 skb->len += tmp_skb->len;
1497 skb->data_len += tmp_skb->len;
1498 skb->truesize += tmp_skb->truesize;
1499 tmp_skb->destructor = NULL;
1500 tmp_skb->sk = NULL;
1501 }
1502
1503 /* Allow local fragmentation. */
1504 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1505 skb->local_df = 1;
1506
1507 *final_dst = fl6->daddr;
1508 __skb_pull(skb, skb_network_header_len(skb));
1509 if (opt && opt->opt_flen)
1510 ipv6_push_frag_opts(skb, opt, &proto);
1511 if (opt && opt->opt_nflen)
1512 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1513
1514 skb_push(skb, sizeof(struct ipv6hdr));
1515 skb_reset_network_header(skb);
1516 hdr = ipv6_hdr(skb);
1517
1518 ip6_flow_hdr(hdr, np->cork.tclass, fl6->flowlabel);
1519 hdr->hop_limit = np->cork.hop_limit;
1520 hdr->nexthdr = proto;
1521 hdr->saddr = fl6->saddr;
1522 hdr->daddr = *final_dst;
1523
1524 skb->priority = sk->sk_priority;
1525 skb->mark = sk->sk_mark;
1526
1527 skb_dst_set(skb, dst_clone(&rt->dst));
1528 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1529 if (proto == IPPROTO_ICMPV6) {
1530 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1531
1532 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1533 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1534 }
1535
1536 err = ip6_local_out(skb);
1537 if (err) {
1538 if (err > 0)
1539 err = net_xmit_errno(err);
1540 if (err)
1541 goto error;
1542 }
1543
1544 out:
1545 ip6_cork_release(inet, np);
1546 return err;
1547 error:
1548 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1549 goto out;
1550 }
1551 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1552
1553 void ip6_flush_pending_frames(struct sock *sk)
1554 {
1555 struct sk_buff *skb;
1556
1557 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1558 if (skb_dst(skb))
1559 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1560 IPSTATS_MIB_OUTDISCARDS);
1561 kfree_skb(skb);
1562 }
1563
1564 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1565 }
1566 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
Linus' kernel tree