?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
serial/8250: Limit the omap workarounds to omap1
[linux-2.6.git] / net / ipv6 / ip6_output.c
blob5b2d63ed793e1ffe7a568e9c581ccf7bab9057a5
1 /*
2 * IPv6 output functions
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on linux/net/ipv4/ip_output.c
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 *
15 * Changes:
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
20 * etc.
21 *
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
26 * for datagram xmit
27 */
28
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
41
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv6.h>
44
45 #include <net/sock.h>
46 #include <net/snmp.h>
47
48 #include <net/ipv6.h>
49 #include <net/ndisc.h>
50 #include <net/protocol.h>
51 #include <net/ip6_route.h>
52 #include <net/addrconf.h>
53 #include <net/rawv6.h>
54 #include <net/icmp.h>
55 #include <net/xfrm.h>
56 #include <net/checksum.h>
57 #include <linux/mroute6.h>
58
59 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
60
61 int __ip6_local_out(struct sk_buff *skb)
62 {
63 int len;
64
65 len = skb->len - sizeof(struct ipv6hdr);
66 if (len > IPV6_MAXPLEN)
67 len = 0;
68 ipv6_hdr(skb)->payload_len = htons(len);
69
70 return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
71 skb_dst(skb)->dev, dst_output);
72 }
73
74 int ip6_local_out(struct sk_buff *skb)
75 {
76 int err;
77
78 err = __ip6_local_out(skb);
79 if (likely(err == 1))
80 err = dst_output(skb);
81
82 return err;
83 }
84 EXPORT_SYMBOL_GPL(ip6_local_out);
85
86 static int ip6_finish_output2(struct sk_buff *skb)
87 {
88 struct dst_entry *dst = skb_dst(skb);
89 struct net_device *dev = dst->dev;
90 struct neighbour *neigh;
91 struct rt6_info *rt;
92
93 skb->protocol = htons(ETH_P_IPV6);
94 skb->dev = dev;
95
96 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
97 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
98
99 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
100 ((mroute6_socket(dev_net(dev), skb) &&
101 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
102 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
103 &ipv6_hdr(skb)->saddr))) {
104 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
105
106 /* Do not check for IFF_ALLMULTI; multicast routing
107 is not supported in any case.
108 */
109 if (newskb)
110 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
111 newskb, NULL, newskb->dev,
112 dev_loopback_xmit);
113
114 if (ipv6_hdr(skb)->hop_limit == 0) {
115 IP6_INC_STATS(dev_net(dev), idev,
116 IPSTATS_MIB_OUTDISCARDS);
117 kfree_skb(skb);
118 return 0;
119 }
120 }
121
122 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
123 skb->len);
124 }
125
126 rcu_read_lock();
127 rt = (struct rt6_info *) dst;
128 neigh = rt->n;
129 if (neigh) {
130 int res = dst_neigh_output(dst, neigh, skb);
131
132 rcu_read_unlock();
133 return res;
134 }
135 rcu_read_unlock();
136 IP6_INC_STATS_BH(dev_net(dst->dev),
137 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
138 kfree_skb(skb);
139 return -EINVAL;
140 }
141
142 static int ip6_finish_output(struct sk_buff *skb)
143 {
144 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
145 dst_allfrag(skb_dst(skb)))
146 return ip6_fragment(skb, ip6_finish_output2);
147 else
148 return ip6_finish_output2(skb);
149 }
150
151 int ip6_output(struct sk_buff *skb)
152 {
153 struct net_device *dev = skb_dst(skb)->dev;
154 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
155 if (unlikely(idev->cnf.disable_ipv6)) {
156 IP6_INC_STATS(dev_net(dev), idev,
157 IPSTATS_MIB_OUTDISCARDS);
158 kfree_skb(skb);
159 return 0;
160 }
161
162 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
163 ip6_finish_output,
164 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
165 }
166
167 /*
168 * xmit an sk_buff (used by TCP, SCTP and DCCP)
169 */
170
171 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
172 struct ipv6_txoptions *opt, int tclass)
173 {
174 struct net *net = sock_net(sk);
175 struct ipv6_pinfo *np = inet6_sk(sk);
176 struct in6_addr *first_hop = &fl6->daddr;
177 struct dst_entry *dst = skb_dst(skb);
178 struct ipv6hdr *hdr;
179 u8 proto = fl6->flowi6_proto;
180 int seg_len = skb->len;
181 int hlimit = -1;
182 u32 mtu;
183
184 if (opt) {
185 unsigned int head_room;
186
187 /* First: exthdrs may take lots of space (~8K for now)
188 MAX_HEADER is not enough.
189 */
190 head_room = opt->opt_nflen + opt->opt_flen;
191 seg_len += head_room;
192 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
193
194 if (skb_headroom(skb) < head_room) {
195 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
196 if (skb2 == NULL) {
197 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
198 IPSTATS_MIB_OUTDISCARDS);
199 kfree_skb(skb);
200 return -ENOBUFS;
201 }
202 consume_skb(skb);
203 skb = skb2;
204 skb_set_owner_w(skb, sk);
205 }
206 if (opt->opt_flen)
207 ipv6_push_frag_opts(skb, opt, &proto);
208 if (opt->opt_nflen)
209 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
210 }
211
212 skb_push(skb, sizeof(struct ipv6hdr));
213 skb_reset_network_header(skb);
214 hdr = ipv6_hdr(skb);
215
216 /*
217 * Fill in the IPv6 header
218 */
219 if (np)
220 hlimit = np->hop_limit;
221 if (hlimit < 0)
222 hlimit = ip6_dst_hoplimit(dst);
223
224 *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl6->flowlabel;
225
226 hdr->payload_len = htons(seg_len);
227 hdr->nexthdr = proto;
228 hdr->hop_limit = hlimit;
229
230 hdr->saddr = fl6->saddr;
231 hdr->daddr = *first_hop;
232
233 skb->priority = sk->sk_priority;
234 skb->mark = sk->sk_mark;
235
236 mtu = dst_mtu(dst);
237 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
238 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
239 IPSTATS_MIB_OUT, skb->len);
240 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
241 dst->dev, dst_output);
242 }
243
244 net_dbg_ratelimited("IPv6: sending pkt_too_big to self\n");
245 skb->dev = dst->dev;
246 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
247 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
248 kfree_skb(skb);
249 return -EMSGSIZE;
250 }
251
252 EXPORT_SYMBOL(ip6_xmit);
253
254 /*
255 * To avoid extra problems ND packets are send through this
256 * routine. It's code duplication but I really want to avoid
257 * extra checks since ipv6_build_header is used by TCP (which
258 * is for us performance critical)
259 */
260
261 int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
262 const struct in6_addr *saddr, const struct in6_addr *daddr,
263 int proto, int len)
264 {
265 struct ipv6_pinfo *np = inet6_sk(sk);
266 struct ipv6hdr *hdr;
267
268 skb->protocol = htons(ETH_P_IPV6);
269 skb->dev = dev;
270
271 skb_reset_network_header(skb);
272 skb_put(skb, sizeof(struct ipv6hdr));
273 hdr = ipv6_hdr(skb);
274
275 *(__be32*)hdr = htonl(0x60000000);
276
277 hdr->payload_len = htons(len);
278 hdr->nexthdr = proto;
279 hdr->hop_limit = np->hop_limit;
280
281 hdr->saddr = *saddr;
282 hdr->daddr = *daddr;
283
284 return 0;
285 }
286
287 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
288 {
289 struct ip6_ra_chain *ra;
290 struct sock *last = NULL;
291
292 read_lock(&ip6_ra_lock);
293 for (ra = ip6_ra_chain; ra; ra = ra->next) {
294 struct sock *sk = ra->sk;
295 if (sk && ra->sel == sel &&
296 (!sk->sk_bound_dev_if ||
297 sk->sk_bound_dev_if == skb->dev->ifindex)) {
298 if (last) {
299 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
300 if (skb2)
301 rawv6_rcv(last, skb2);
302 }
303 last = sk;
304 }
305 }
306
307 if (last) {
308 rawv6_rcv(last, skb);
309 read_unlock(&ip6_ra_lock);
310 return 1;
311 }
312 read_unlock(&ip6_ra_lock);
313 return 0;
314 }
315
316 static int ip6_forward_proxy_check(struct sk_buff *skb)
317 {
318 struct ipv6hdr *hdr = ipv6_hdr(skb);
319 u8 nexthdr = hdr->nexthdr;
320 __be16 frag_off;
321 int offset;
322
323 if (ipv6_ext_hdr(nexthdr)) {
324 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
325 if (offset < 0)
326 return 0;
327 } else
328 offset = sizeof(struct ipv6hdr);
329
330 if (nexthdr == IPPROTO_ICMPV6) {
331 struct icmp6hdr *icmp6;
332
333 if (!pskb_may_pull(skb, (skb_network_header(skb) +
334 offset + 1 - skb->data)))
335 return 0;
336
337 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
338
339 switch (icmp6->icmp6_type) {
340 case NDISC_ROUTER_SOLICITATION:
341 case NDISC_ROUTER_ADVERTISEMENT:
342 case NDISC_NEIGHBOUR_SOLICITATION:
343 case NDISC_NEIGHBOUR_ADVERTISEMENT:
344 case NDISC_REDIRECT:
345 /* For reaction involving unicast neighbor discovery
346 * message destined to the proxied address, pass it to
347 * input function.
348 */
349 return 1;
350 default:
351 break;
352 }
353 }
354
355 /*
356 * The proxying router can't forward traffic sent to a link-local
357 * address, so signal the sender and discard the packet. This
358 * behavior is clarified by the MIPv6 specification.
359 */
360 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
361 dst_link_failure(skb);
362 return -1;
363 }
364
365 return 0;
366 }
367
368 static inline int ip6_forward_finish(struct sk_buff *skb)
369 {
370 return dst_output(skb);
371 }
372
373 int ip6_forward(struct sk_buff *skb)
374 {
375 struct dst_entry *dst = skb_dst(skb);
376 struct ipv6hdr *hdr = ipv6_hdr(skb);
377 struct inet6_skb_parm *opt = IP6CB(skb);
378 struct net *net = dev_net(dst->dev);
379 u32 mtu;
380
381 if (net->ipv6.devconf_all->forwarding == 0)
382 goto error;
383
384 if (skb_warn_if_lro(skb))
385 goto drop;
386
387 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
388 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
389 goto drop;
390 }
391
392 if (skb->pkt_type != PACKET_HOST)
393 goto drop;
394
395 skb_forward_csum(skb);
396
397 /*
398 * We DO NOT make any processing on
399 * RA packets, pushing them to user level AS IS
400 * without ane WARRANTY that application will be able
401 * to interpret them. The reason is that we
402 * cannot make anything clever here.
403 *
404 * We are not end-node, so that if packet contains
405 * AH/ESP, we cannot make anything.
406 * Defragmentation also would be mistake, RA packets
407 * cannot be fragmented, because there is no warranty
408 * that different fragments will go along one path. --ANK
409 */
410 if (opt->ra) {
411 u8 *ptr = skb_network_header(skb) + opt->ra;
412 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
413 return 0;
414 }
415
416 /*
417 * check and decrement ttl
418 */
419 if (hdr->hop_limit <= 1) {
420 /* Force OUTPUT device used as source address */
421 skb->dev = dst->dev;
422 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
423 IP6_INC_STATS_BH(net,
424 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
425
426 kfree_skb(skb);
427 return -ETIMEDOUT;
428 }
429
430 /* XXX: idev->cnf.proxy_ndp? */
431 if (net->ipv6.devconf_all->proxy_ndp &&
432 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
433 int proxied = ip6_forward_proxy_check(skb);
434 if (proxied > 0)
435 return ip6_input(skb);
436 else if (proxied < 0) {
437 IP6_INC_STATS(net, ip6_dst_idev(dst),
438 IPSTATS_MIB_INDISCARDS);
439 goto drop;
440 }
441 }
442
443 if (!xfrm6_route_forward(skb)) {
444 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
445 goto drop;
446 }
447 dst = skb_dst(skb);
448
449 /* IPv6 specs say nothing about it, but it is clear that we cannot
450 send redirects to source routed frames.
451 We don't send redirects to frames decapsulated from IPsec.
452 */
453 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
454 struct in6_addr *target = NULL;
455 struct inet_peer *peer;
456 struct rt6_info *rt;
457
458 /*
459 * incoming and outgoing devices are the same
460 * send a redirect.
461 */
462
463 rt = (struct rt6_info *) dst;
464 if (rt->rt6i_flags & RTF_GATEWAY)
465 target = &rt->rt6i_gateway;
466 else
467 target = &hdr->daddr;
468
469 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
470
471 /* Limit redirects both by destination (here)
472 and by source (inside ndisc_send_redirect)
473 */
474 if (inet_peer_xrlim_allow(peer, 1*HZ))
475 ndisc_send_redirect(skb, target);
476 if (peer)
477 inet_putpeer(peer);
478 } else {
479 int addrtype = ipv6_addr_type(&hdr->saddr);
480
481 /* This check is security critical. */
482 if (addrtype == IPV6_ADDR_ANY ||
483 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
484 goto error;
485 if (addrtype & IPV6_ADDR_LINKLOCAL) {
486 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
487 ICMPV6_NOT_NEIGHBOUR, 0);
488 goto error;
489 }
490 }
491
492 mtu = dst_mtu(dst);
493 if (mtu < IPV6_MIN_MTU)
494 mtu = IPV6_MIN_MTU;
495
496 if (skb->len > mtu && !skb_is_gso(skb)) {
497 /* Again, force OUTPUT device used as source address */
498 skb->dev = dst->dev;
499 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
500 IP6_INC_STATS_BH(net,
501 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
502 IP6_INC_STATS_BH(net,
503 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
504 kfree_skb(skb);
505 return -EMSGSIZE;
506 }
507
508 if (skb_cow(skb, dst->dev->hard_header_len)) {
509 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
510 goto drop;
511 }
512
513 hdr = ipv6_hdr(skb);
514
515 /* Mangling hops number delayed to point after skb COW */
516
517 hdr->hop_limit--;
518
519 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
520 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
521 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
522 ip6_forward_finish);
523
524 error:
525 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
526 drop:
527 kfree_skb(skb);
528 return -EINVAL;
529 }
530
531 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
532 {
533 to->pkt_type = from->pkt_type;
534 to->priority = from->priority;
535 to->protocol = from->protocol;
536 skb_dst_drop(to);
537 skb_dst_set(to, dst_clone(skb_dst(from)));
538 to->dev = from->dev;
539 to->mark = from->mark;
540
541 #ifdef CONFIG_NET_SCHED
542 to->tc_index = from->tc_index;
543 #endif
544 nf_copy(to, from);
545 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
546 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
547 to->nf_trace = from->nf_trace;
548 #endif
549 skb_copy_secmark(to, from);
550 }
551
552 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
553 {
554 u16 offset = sizeof(struct ipv6hdr);
555 struct ipv6_opt_hdr *exthdr =
556 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
557 unsigned int packet_len = skb->tail - skb->network_header;
558 int found_rhdr = 0;
559 *nexthdr = &ipv6_hdr(skb)->nexthdr;
560
561 while (offset + 1 <= packet_len) {
562
563 switch (**nexthdr) {
564
565 case NEXTHDR_HOP:
566 break;
567 case NEXTHDR_ROUTING:
568 found_rhdr = 1;
569 break;
570 case NEXTHDR_DEST:
571 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
572 if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
573 break;
574 #endif
575 if (found_rhdr)
576 return offset;
577 break;
578 default :
579 return offset;
580 }
581
582 offset += ipv6_optlen(exthdr);
583 *nexthdr = &exthdr->nexthdr;
584 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
585 offset);
586 }
587
588 return offset;
589 }
590
591 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
592 {
593 static atomic_t ipv6_fragmentation_id;
594 int old, new;
595
596 if (rt && !(rt->dst.flags & DST_NOPEER)) {
597 struct inet_peer *peer;
598 struct net *net;
599
600 net = dev_net(rt->dst.dev);
601 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
602 if (peer) {
603 fhdr->identification = htonl(inet_getid(peer, 0));
604 inet_putpeer(peer);
605 return;
606 }
607 }
608 do {
609 old = atomic_read(&ipv6_fragmentation_id);
610 new = old + 1;
611 if (!new)
612 new = 1;
613 } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
614 fhdr->identification = htonl(new);
615 }
616
617 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
618 {
619 struct sk_buff *frag;
620 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
621 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
622 struct ipv6hdr *tmp_hdr;
623 struct frag_hdr *fh;
624 unsigned int mtu, hlen, left, len;
625 int hroom, troom;
626 __be32 frag_id = 0;
627 int ptr, offset = 0, err=0;
628 u8 *prevhdr, nexthdr = 0;
629 struct net *net = dev_net(skb_dst(skb)->dev);
630
631 hlen = ip6_find_1stfragopt(skb, &prevhdr);
632 nexthdr = *prevhdr;
633
634 mtu = ip6_skb_dst_mtu(skb);
635
636 /* We must not fragment if the socket is set to force MTU discovery
637 * or if the skb it not generated by a local socket.
638 */
639 if (unlikely(!skb->local_df && skb->len > mtu)) {
640 if (skb->sk && dst_allfrag(skb_dst(skb)))
641 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
642
643 skb->dev = skb_dst(skb)->dev;
644 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
645 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
646 IPSTATS_MIB_FRAGFAILS);
647 kfree_skb(skb);
648 return -EMSGSIZE;
649 }
650
651 if (np && np->frag_size < mtu) {
652 if (np->frag_size)
653 mtu = np->frag_size;
654 }
655 mtu -= hlen + sizeof(struct frag_hdr);
656
657 if (skb_has_frag_list(skb)) {
658 int first_len = skb_pagelen(skb);
659 struct sk_buff *frag2;
660
661 if (first_len - hlen > mtu ||
662 ((first_len - hlen) & 7) ||
663 skb_cloned(skb))
664 goto slow_path;
665
666 skb_walk_frags(skb, frag) {
667 /* Correct geometry. */
668 if (frag->len > mtu ||
669 ((frag->len & 7) && frag->next) ||
670 skb_headroom(frag) < hlen)
671 goto slow_path_clean;
672
673 /* Partially cloned skb? */
674 if (skb_shared(frag))
675 goto slow_path_clean;
676
677 BUG_ON(frag->sk);
678 if (skb->sk) {
679 frag->sk = skb->sk;
680 frag->destructor = sock_wfree;
681 }
682 skb->truesize -= frag->truesize;
683 }
684
685 err = 0;
686 offset = 0;
687 frag = skb_shinfo(skb)->frag_list;
688 skb_frag_list_init(skb);
689 /* BUILD HEADER */
690
691 *prevhdr = NEXTHDR_FRAGMENT;
692 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
693 if (!tmp_hdr) {
694 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
695 IPSTATS_MIB_FRAGFAILS);
696 return -ENOMEM;
697 }
698
699 __skb_pull(skb, hlen);
700 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
701 __skb_push(skb, hlen);
702 skb_reset_network_header(skb);
703 memcpy(skb_network_header(skb), tmp_hdr, hlen);
704
705 ipv6_select_ident(fh, rt);
706 fh->nexthdr = nexthdr;
707 fh->reserved = 0;
708 fh->frag_off = htons(IP6_MF);
709 frag_id = fh->identification;
710
711 first_len = skb_pagelen(skb);
712 skb->data_len = first_len - skb_headlen(skb);
713 skb->len = first_len;
714 ipv6_hdr(skb)->payload_len = htons(first_len -
715 sizeof(struct ipv6hdr));
716
717 dst_hold(&rt->dst);
718
719 for (;;) {
720 /* Prepare header of the next frame,
721 * before previous one went down. */
722 if (frag) {
723 frag->ip_summed = CHECKSUM_NONE;
724 skb_reset_transport_header(frag);
725 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
726 __skb_push(frag, hlen);
727 skb_reset_network_header(frag);
728 memcpy(skb_network_header(frag), tmp_hdr,
729 hlen);
730 offset += skb->len - hlen - sizeof(struct frag_hdr);
731 fh->nexthdr = nexthdr;
732 fh->reserved = 0;
733 fh->frag_off = htons(offset);
734 if (frag->next != NULL)
735 fh->frag_off |= htons(IP6_MF);
736 fh->identification = frag_id;
737 ipv6_hdr(frag)->payload_len =
738 htons(frag->len -
739 sizeof(struct ipv6hdr));
740 ip6_copy_metadata(frag, skb);
741 }
742
743 err = output(skb);
744 if(!err)
745 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
746 IPSTATS_MIB_FRAGCREATES);
747
748 if (err || !frag)
749 break;
750
751 skb = frag;
752 frag = skb->next;
753 skb->next = NULL;
754 }
755
756 kfree(tmp_hdr);
757
758 if (err == 0) {
759 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
760 IPSTATS_MIB_FRAGOKS);
761 dst_release(&rt->dst);
762 return 0;
763 }
764
765 while (frag) {
766 skb = frag->next;
767 kfree_skb(frag);
768 frag = skb;
769 }
770
771 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
772 IPSTATS_MIB_FRAGFAILS);
773 dst_release(&rt->dst);
774 return err;
775
776 slow_path_clean:
777 skb_walk_frags(skb, frag2) {
778 if (frag2 == frag)
779 break;
780 frag2->sk = NULL;
781 frag2->destructor = NULL;
782 skb->truesize += frag2->truesize;
783 }
784 }
785
786 slow_path:
787 if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
788 skb_checksum_help(skb))
789 goto fail;
790
791 left = skb->len - hlen; /* Space per frame */
792 ptr = hlen; /* Where to start from */
793
794 /*
795 * Fragment the datagram.
796 */
797
798 *prevhdr = NEXTHDR_FRAGMENT;
799 hroom = LL_RESERVED_SPACE(rt->dst.dev);
800 troom = rt->dst.dev->needed_tailroom;
801
802 /*
803 * Keep copying data until we run out.
804 */
805 while(left > 0) {
806 len = left;
807 /* IF: it doesn't fit, use 'mtu' - the data space left */
808 if (len > mtu)
809 len = mtu;
810 /* IF: we are not sending up to and including the packet end
811 then align the next start on an eight byte boundary */
812 if (len < left) {
813 len &= ~7;
814 }
815 /*
816 * Allocate buffer.
817 */
818
819 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
820 hroom + troom, GFP_ATOMIC)) == NULL) {
821 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
822 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
823 IPSTATS_MIB_FRAGFAILS);
824 err = -ENOMEM;
825 goto fail;
826 }
827
828 /*
829 * Set up data on packet
830 */
831
832 ip6_copy_metadata(frag, skb);
833 skb_reserve(frag, hroom);
834 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
835 skb_reset_network_header(frag);
836 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
837 frag->transport_header = (frag->network_header + hlen +
838 sizeof(struct frag_hdr));
839
840 /*
841 * Charge the memory for the fragment to any owner
842 * it might possess
843 */
844 if (skb->sk)
845 skb_set_owner_w(frag, skb->sk);
846
847 /*
848 * Copy the packet header into the new buffer.
849 */
850 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
851
852 /*
853 * Build fragment header.
854 */
855 fh->nexthdr = nexthdr;
856 fh->reserved = 0;
857 if (!frag_id) {
858 ipv6_select_ident(fh, rt);
859 frag_id = fh->identification;
860 } else
861 fh->identification = frag_id;
862
863 /*
864 * Copy a block of the IP datagram.
865 */
866 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
867 BUG();
868 left -= len;
869
870 fh->frag_off = htons(offset);
871 if (left > 0)
872 fh->frag_off |= htons(IP6_MF);
873 ipv6_hdr(frag)->payload_len = htons(frag->len -
874 sizeof(struct ipv6hdr));
875
876 ptr += len;
877 offset += len;
878
879 /*
880 * Put this fragment into the sending queue.
881 */
882 err = output(frag);
883 if (err)
884 goto fail;
885
886 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
887 IPSTATS_MIB_FRAGCREATES);
888 }
889 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
890 IPSTATS_MIB_FRAGOKS);
891 consume_skb(skb);
892 return err;
893
894 fail:
895 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
896 IPSTATS_MIB_FRAGFAILS);
897 kfree_skb(skb);
898 return err;
899 }
900
901 static inline int ip6_rt_check(const struct rt6key *rt_key,
902 const struct in6_addr *fl_addr,
903 const struct in6_addr *addr_cache)
904 {
905 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
906 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
907 }
908
909 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
910 struct dst_entry *dst,
911 const struct flowi6 *fl6)
912 {
913 struct ipv6_pinfo *np = inet6_sk(sk);
914 struct rt6_info *rt = (struct rt6_info *)dst;
915
916 if (!dst)
917 goto out;
918
919 /* Yes, checking route validity in not connected
920 * case is not very simple. Take into account,
921 * that we do not support routing by source, TOS,
922 * and MSG_DONTROUTE --ANK (980726)
923 *
924 * 1. ip6_rt_check(): If route was host route,
925 * check that cached destination is current.
926 * If it is network route, we still may
927 * check its validity using saved pointer
928 * to the last used address: daddr_cache.
929 * We do not want to save whole address now,
930 * (because main consumer of this service
931 * is tcp, which has not this problem),
932 * so that the last trick works only on connected
933 * sockets.
934 * 2. oif also should be the same.
935 */
936 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
937 #ifdef CONFIG_IPV6_SUBTREES
938 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
939 #endif
940 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
941 dst_release(dst);
942 dst = NULL;
943 }
944
945 out:
946 return dst;
947 }
948
949 static int ip6_dst_lookup_tail(struct sock *sk,
950 struct dst_entry **dst, struct flowi6 *fl6)
951 {
952 struct net *net = sock_net(sk);
953 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
954 struct neighbour *n;
955 struct rt6_info *rt;
956 #endif
957 int err;
958
959 if (*dst == NULL)
960 *dst = ip6_route_output(net, sk, fl6);
961
962 if ((err = (*dst)->error))
963 goto out_err_release;
964
965 if (ipv6_addr_any(&fl6->saddr)) {
966 struct rt6_info *rt = (struct rt6_info *) *dst;
967 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
968 sk ? inet6_sk(sk)->srcprefs : 0,
969 &fl6->saddr);
970 if (err)
971 goto out_err_release;
972 }
973
974 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
975 /*
976 * Here if the dst entry we've looked up
977 * has a neighbour entry that is in the INCOMPLETE
978 * state and the src address from the flow is
979 * marked as OPTIMISTIC, we release the found
980 * dst entry and replace it instead with the
981 * dst entry of the nexthop router
982 */
983 rcu_read_lock();
984 rt = (struct rt6_info *) *dst;
985 n = rt->n;
986 if (n && !(n->nud_state & NUD_VALID)) {
987 struct inet6_ifaddr *ifp;
988 struct flowi6 fl_gw6;
989 int redirect;
990
991 rcu_read_unlock();
992 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
993 (*dst)->dev, 1);
994
995 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
996 if (ifp)
997 in6_ifa_put(ifp);
998
999 if (redirect) {
1000 /*
1001 * We need to get the dst entry for the
1002 * default router instead
1003 */
1004 dst_release(*dst);
1005 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1006 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1007 *dst = ip6_route_output(net, sk, &fl_gw6);
1008 if ((err = (*dst)->error))
1009 goto out_err_release;
1010 }
1011 } else {
1012 rcu_read_unlock();
1013 }
1014 #endif
1015
1016 return 0;
1017
1018 out_err_release:
1019 if (err == -ENETUNREACH)
1020 IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1021 dst_release(*dst);
1022 *dst = NULL;
1023 return err;
1024 }
1025
1026 /**
1027 * ip6_dst_lookup - perform route lookup on flow
1028 * @sk: socket which provides route info
1029 * @dst: pointer to dst_entry * for result
1030 * @fl6: flow to lookup
1031 *
1032 * This function performs a route lookup on the given flow.
1033 *
1034 * It returns zero on success, or a standard errno code on error.
1035 */
1036 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
1037 {
1038 *dst = NULL;
1039 return ip6_dst_lookup_tail(sk, dst, fl6);
1040 }
1041 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1042
1043 /**
1044 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1045 * @sk: socket which provides route info
1046 * @fl6: flow to lookup
1047 * @final_dst: final destination address for ipsec lookup
1048 * @can_sleep: we are in a sleepable context
1049 *
1050 * This function performs a route lookup on the given flow.
1051 *
1052 * It returns a valid dst pointer on success, or a pointer encoded
1053 * error code.
1054 */
1055 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1056 const struct in6_addr *final_dst,
1057 bool can_sleep)
1058 {
1059 struct dst_entry *dst = NULL;
1060 int err;
1061
1062 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1063 if (err)
1064 return ERR_PTR(err);
1065 if (final_dst)
1066 fl6->daddr = *final_dst;
1067 if (can_sleep)
1068 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1069
1070 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1071 }
1072 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1073
1074 /**
1075 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1076 * @sk: socket which provides the dst cache and route info
1077 * @fl6: flow to lookup
1078 * @final_dst: final destination address for ipsec lookup
1079 * @can_sleep: we are in a sleepable context
1080 *
1081 * This function performs a route lookup on the given flow with the
1082 * possibility of using the cached route in the socket if it is valid.
1083 * It will take the socket dst lock when operating on the dst cache.
1084 * As a result, this function can only be used in process context.
1085 *
1086 * It returns a valid dst pointer on success, or a pointer encoded
1087 * error code.
1088 */
1089 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1090 const struct in6_addr *final_dst,
1091 bool can_sleep)
1092 {
1093 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1094 int err;
1095
1096 dst = ip6_sk_dst_check(sk, dst, fl6);
1097
1098 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1099 if (err)
1100 return ERR_PTR(err);
1101 if (final_dst)
1102 fl6->daddr = *final_dst;
1103 if (can_sleep)
1104 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1105
1106 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1107 }
1108 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1109
1110 static inline int ip6_ufo_append_data(struct sock *sk,
1111 int getfrag(void *from, char *to, int offset, int len,
1112 int odd, struct sk_buff *skb),
1113 void *from, int length, int hh_len, int fragheaderlen,
1114 int transhdrlen, int mtu,unsigned int flags,
1115 struct rt6_info *rt)
1116
1117 {
1118 struct sk_buff *skb;
1119 int err;
1120
1121 /* There is support for UDP large send offload by network
1122 * device, so create one single skb packet containing complete
1123 * udp datagram
1124 */
1125 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1126 skb = sock_alloc_send_skb(sk,
1127 hh_len + fragheaderlen + transhdrlen + 20,
1128 (flags & MSG_DONTWAIT), &err);
1129 if (skb == NULL)
1130 return err;
1131
1132 /* reserve space for Hardware header */
1133 skb_reserve(skb, hh_len);
1134
1135 /* create space for UDP/IP header */
1136 skb_put(skb,fragheaderlen + transhdrlen);
1137
1138 /* initialize network header pointer */
1139 skb_reset_network_header(skb);
1140
1141 /* initialize protocol header pointer */
1142 skb->transport_header = skb->network_header + fragheaderlen;
1143
1144 skb->ip_summed = CHECKSUM_PARTIAL;
1145 skb->csum = 0;
1146 }
1147
1148 err = skb_append_datato_frags(sk,skb, getfrag, from,
1149 (length - transhdrlen));
1150 if (!err) {
1151 struct frag_hdr fhdr;
1152
1153 /* Specify the length of each IPv6 datagram fragment.
1154 * It has to be a multiple of 8.
1155 */
1156 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1157 sizeof(struct frag_hdr)) & ~7;
1158 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1159 ipv6_select_ident(&fhdr, rt);
1160 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1161 __skb_queue_tail(&sk->sk_write_queue, skb);
1162
1163 return 0;
1164 }
1165 /* There is not enough support do UPD LSO,
1166 * so follow normal path
1167 */
1168 kfree_skb(skb);
1169
1170 return err;
1171 }
1172
1173 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1174 gfp_t gfp)
1175 {
1176 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1177 }
1178
1179 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1180 gfp_t gfp)
1181 {
1182 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1183 }
1184
1185 static void ip6_append_data_mtu(int *mtu,
1186 int *maxfraglen,
1187 unsigned int fragheaderlen,
1188 struct sk_buff *skb,
1189 struct rt6_info *rt)
1190 {
1191 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1192 if (skb == NULL) {
1193 /* first fragment, reserve header_len */
1194 *mtu = *mtu - rt->dst.header_len;
1195
1196 } else {
1197 /*
1198 * this fragment is not first, the headers
1199 * space is regarded as data space.
1200 */
1201 *mtu = dst_mtu(rt->dst.path);
1202 }
1203 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1204 + fragheaderlen - sizeof(struct frag_hdr);
1205 }
1206 }
1207
1208 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1209 int offset, int len, int odd, struct sk_buff *skb),
1210 void *from, int length, int transhdrlen,
1211 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1212 struct rt6_info *rt, unsigned int flags, int dontfrag)
1213 {
1214 struct inet_sock *inet = inet_sk(sk);
1215 struct ipv6_pinfo *np = inet6_sk(sk);
1216 struct inet_cork *cork;
1217 struct sk_buff *skb, *skb_prev = NULL;
1218 unsigned int maxfraglen, fragheaderlen;
1219 int exthdrlen;
1220 int dst_exthdrlen;
1221 int hh_len;
1222 int mtu;
1223 int copy;
1224 int err;
1225 int offset = 0;
1226 __u8 tx_flags = 0;
1227
1228 if (flags&MSG_PROBE)
1229 return 0;
1230 cork = &inet->cork.base;
1231 if (skb_queue_empty(&sk->sk_write_queue)) {
1232 /*
1233 * setup for corking
1234 */
1235 if (opt) {
1236 if (WARN_ON(np->cork.opt))
1237 return -EINVAL;
1238
1239 np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
1240 if (unlikely(np->cork.opt == NULL))
1241 return -ENOBUFS;
1242
1243 np->cork.opt->tot_len = opt->tot_len;
1244 np->cork.opt->opt_flen = opt->opt_flen;
1245 np->cork.opt->opt_nflen = opt->opt_nflen;
1246
1247 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1248 sk->sk_allocation);
1249 if (opt->dst0opt && !np->cork.opt->dst0opt)
1250 return -ENOBUFS;
1251
1252 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1253 sk->sk_allocation);
1254 if (opt->dst1opt && !np->cork.opt->dst1opt)
1255 return -ENOBUFS;
1256
1257 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1258 sk->sk_allocation);
1259 if (opt->hopopt && !np->cork.opt->hopopt)
1260 return -ENOBUFS;
1261
1262 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1263 sk->sk_allocation);
1264 if (opt->srcrt && !np->cork.opt->srcrt)
1265 return -ENOBUFS;
1266
1267 /* need source address above miyazawa*/
1268 }
1269 dst_hold(&rt->dst);
1270 cork->dst = &rt->dst;
1271 inet->cork.fl.u.ip6 = *fl6;
1272 np->cork.hop_limit = hlimit;
1273 np->cork.tclass = tclass;
1274 if (rt->dst.flags & DST_XFRM_TUNNEL)
1275 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1276 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1277 else
1278 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1279 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1280 if (np->frag_size < mtu) {
1281 if (np->frag_size)
1282 mtu = np->frag_size;
1283 }
1284 cork->fragsize = mtu;
1285 if (dst_allfrag(rt->dst.path))
1286 cork->flags |= IPCORK_ALLFRAG;
1287 cork->length = 0;
1288 sk->sk_sndmsg_page = NULL;
1289 sk->sk_sndmsg_off = 0;
1290 exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
1291 length += exthdrlen;
1292 transhdrlen += exthdrlen;
1293 dst_exthdrlen = rt->dst.header_len;
1294 } else {
1295 rt = (struct rt6_info *)cork->dst;
1296 fl6 = &inet->cork.fl.u.ip6;
1297 opt = np->cork.opt;
1298 transhdrlen = 0;
1299 exthdrlen = 0;
1300 dst_exthdrlen = 0;
1301 mtu = cork->fragsize;
1302 }
1303
1304 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1305
1306 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1307 (opt ? opt->opt_nflen : 0);
1308 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1309
1310 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1311 if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1312 ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1313 return -EMSGSIZE;
1314 }
1315 }
1316
1317 /* For UDP, check if TX timestamp is enabled */
1318 if (sk->sk_type == SOCK_DGRAM) {
1319 err = sock_tx_timestamp(sk, &tx_flags);
1320 if (err)
1321 goto error;
1322 }
1323
1324 /*
1325 * Let's try using as much space as possible.
1326 * Use MTU if total length of the message fits into the MTU.
1327 * Otherwise, we need to reserve fragment header and
1328 * fragment alignment (= 8-15 octects, in total).
1329 *
1330 * Note that we may need to "move" the data from the tail of
1331 * of the buffer to the new fragment when we split
1332 * the message.
1333 *
1334 * FIXME: It may be fragmented into multiple chunks
1335 * at once if non-fragmentable extension headers
1336 * are too large.
1337 * --yoshfuji
1338 */
1339
1340 cork->length += length;
1341 if (length > mtu) {
1342 int proto = sk->sk_protocol;
1343 if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
1344 ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1345 return -EMSGSIZE;
1346 }
1347
1348 if (proto == IPPROTO_UDP &&
1349 (rt->dst.dev->features & NETIF_F_UFO)) {
1350
1351 err = ip6_ufo_append_data(sk, getfrag, from, length,
1352 hh_len, fragheaderlen,
1353 transhdrlen, mtu, flags, rt);
1354 if (err)
1355 goto error;
1356 return 0;
1357 }
1358 }
1359
1360 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
1361 goto alloc_new_skb;
1362
1363 while (length > 0) {
1364 /* Check if the remaining data fits into current packet. */
1365 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1366 if (copy < length)
1367 copy = maxfraglen - skb->len;
1368
1369 if (copy <= 0) {
1370 char *data;
1371 unsigned int datalen;
1372 unsigned int fraglen;
1373 unsigned int fraggap;
1374 unsigned int alloclen;
1375 alloc_new_skb:
1376 /* There's no room in the current skb */
1377 if (skb)
1378 fraggap = skb->len - maxfraglen;
1379 else
1380 fraggap = 0;
1381 /* update mtu and maxfraglen if necessary */
1382 if (skb == NULL || skb_prev == NULL)
1383 ip6_append_data_mtu(&mtu, &maxfraglen,
1384 fragheaderlen, skb, rt);
1385
1386 skb_prev = skb;
1387
1388 /*
1389 * If remaining data exceeds the mtu,
1390 * we know we need more fragment(s).
1391 */
1392 datalen = length + fraggap;
1393
1394 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1395 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1396 if ((flags & MSG_MORE) &&
1397 !(rt->dst.dev->features&NETIF_F_SG))
1398 alloclen = mtu;
1399 else
1400 alloclen = datalen + fragheaderlen;
1401
1402 alloclen += dst_exthdrlen;
1403
1404 if (datalen != length + fraggap) {
1405 /*
1406 * this is not the last fragment, the trailer
1407 * space is regarded as data space.
1408 */
1409 datalen += rt->dst.trailer_len;
1410 }
1411
1412 alloclen += rt->dst.trailer_len;
1413 fraglen = datalen + fragheaderlen;
1414
1415 /*
1416 * We just reserve space for fragment header.
1417 * Note: this may be overallocation if the message
1418 * (without MSG_MORE) fits into the MTU.
1419 */
1420 alloclen += sizeof(struct frag_hdr);
1421
1422 if (transhdrlen) {
1423 skb = sock_alloc_send_skb(sk,
1424 alloclen + hh_len,
1425 (flags & MSG_DONTWAIT), &err);
1426 } else {
1427 skb = NULL;
1428 if (atomic_read(&sk->sk_wmem_alloc) <=
1429 2 * sk->sk_sndbuf)
1430 skb = sock_wmalloc(sk,
1431 alloclen + hh_len, 1,
1432 sk->sk_allocation);
1433 if (unlikely(skb == NULL))
1434 err = -ENOBUFS;
1435 else {
1436 /* Only the initial fragment
1437 * is time stamped.
1438 */
1439 tx_flags = 0;
1440 }
1441 }
1442 if (skb == NULL)
1443 goto error;
1444 /*
1445 * Fill in the control structures
1446 */
1447 skb->ip_summed = CHECKSUM_NONE;
1448 skb->csum = 0;
1449 /* reserve for fragmentation and ipsec header */
1450 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1451 dst_exthdrlen);
1452
1453 if (sk->sk_type == SOCK_DGRAM)
1454 skb_shinfo(skb)->tx_flags = tx_flags;
1455
1456 /*
1457 * Find where to start putting bytes
1458 */
1459 data = skb_put(skb, fraglen);
1460 skb_set_network_header(skb, exthdrlen);
1461 data += fragheaderlen;
1462 skb->transport_header = (skb->network_header +
1463 fragheaderlen);
1464 if (fraggap) {
1465 skb->csum = skb_copy_and_csum_bits(
1466 skb_prev, maxfraglen,
1467 data + transhdrlen, fraggap, 0);
1468 skb_prev->csum = csum_sub(skb_prev->csum,
1469 skb->csum);
1470 data += fraggap;
1471 pskb_trim_unique(skb_prev, maxfraglen);
1472 }
1473 copy = datalen - transhdrlen - fraggap;
1474
1475 if (copy < 0) {
1476 err = -EINVAL;
1477 kfree_skb(skb);
1478 goto error;
1479 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1480 err = -EFAULT;
1481 kfree_skb(skb);
1482 goto error;
1483 }
1484
1485 offset += copy;
1486 length -= datalen - fraggap;
1487 transhdrlen = 0;
1488 exthdrlen = 0;
1489 dst_exthdrlen = 0;
1490
1491 /*
1492 * Put the packet on the pending queue
1493 */
1494 __skb_queue_tail(&sk->sk_write_queue, skb);
1495 continue;
1496 }
1497
1498 if (copy > length)
1499 copy = length;
1500
1501 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1502 unsigned int off;
1503
1504 off = skb->len;
1505 if (getfrag(from, skb_put(skb, copy),
1506 offset, copy, off, skb) < 0) {
1507 __skb_trim(skb, off);
1508 err = -EFAULT;
1509 goto error;
1510 }
1511 } else {
1512 int i = skb_shinfo(skb)->nr_frags;
1513 skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
1514 struct page *page = sk->sk_sndmsg_page;
1515 int off = sk->sk_sndmsg_off;
1516 unsigned int left;
1517
1518 if (page && (left = PAGE_SIZE - off) > 0) {
1519 if (copy >= left)
1520 copy = left;
1521 if (page != skb_frag_page(frag)) {
1522 if (i == MAX_SKB_FRAGS) {
1523 err = -EMSGSIZE;
1524 goto error;
1525 }
1526 skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
1527 skb_frag_ref(skb, i);
1528 frag = &skb_shinfo(skb)->frags[i];
1529 }
1530 } else if(i < MAX_SKB_FRAGS) {
1531 if (copy > PAGE_SIZE)
1532 copy = PAGE_SIZE;
1533 page = alloc_pages(sk->sk_allocation, 0);
1534 if (page == NULL) {
1535 err = -ENOMEM;
1536 goto error;
1537 }
1538 sk->sk_sndmsg_page = page;
1539 sk->sk_sndmsg_off = 0;
1540
1541 skb_fill_page_desc(skb, i, page, 0, 0);
1542 frag = &skb_shinfo(skb)->frags[i];
1543 } else {
1544 err = -EMSGSIZE;
1545 goto error;
1546 }
1547 if (getfrag(from,
1548 skb_frag_address(frag) + skb_frag_size(frag),
1549 offset, copy, skb->len, skb) < 0) {
1550 err = -EFAULT;
1551 goto error;
1552 }
1553 sk->sk_sndmsg_off += copy;
1554 skb_frag_size_add(frag, copy);
1555 skb->len += copy;
1556 skb->data_len += copy;
1557 skb->truesize += copy;
1558 atomic_add(copy, &sk->sk_wmem_alloc);
1559 }
1560 offset += copy;
1561 length -= copy;
1562 }
1563 return 0;
1564 error:
1565 cork->length -= length;
1566 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1567 return err;
1568 }
1569 EXPORT_SYMBOL_GPL(ip6_append_data);
1570
1571 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1572 {
1573 if (np->cork.opt) {
1574 kfree(np->cork.opt->dst0opt);
1575 kfree(np->cork.opt->dst1opt);
1576 kfree(np->cork.opt->hopopt);
1577 kfree(np->cork.opt->srcrt);
1578 kfree(np->cork.opt);
1579 np->cork.opt = NULL;
1580 }
1581
1582 if (inet->cork.base.dst) {
1583 dst_release(inet->cork.base.dst);
1584 inet->cork.base.dst = NULL;
1585 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1586 }
1587 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1588 }
1589
1590 int ip6_push_pending_frames(struct sock *sk)
1591 {
1592 struct sk_buff *skb, *tmp_skb;
1593 struct sk_buff **tail_skb;
1594 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1595 struct inet_sock *inet = inet_sk(sk);
1596 struct ipv6_pinfo *np = inet6_sk(sk);
1597 struct net *net = sock_net(sk);
1598 struct ipv6hdr *hdr;
1599 struct ipv6_txoptions *opt = np->cork.opt;
1600 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1601 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1602 unsigned char proto = fl6->flowi6_proto;
1603 int err = 0;
1604
1605 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1606 goto out;
1607 tail_skb = &(skb_shinfo(skb)->frag_list);
1608
1609 /* move skb->data to ip header from ext header */
1610 if (skb->data < skb_network_header(skb))
1611 __skb_pull(skb, skb_network_offset(skb));
1612 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1613 __skb_pull(tmp_skb, skb_network_header_len(skb));
1614 *tail_skb = tmp_skb;
1615 tail_skb = &(tmp_skb->next);
1616 skb->len += tmp_skb->len;
1617 skb->data_len += tmp_skb->len;
1618 skb->truesize += tmp_skb->truesize;
1619 tmp_skb->destructor = NULL;
1620 tmp_skb->sk = NULL;
1621 }
1622
1623 /* Allow local fragmentation. */
1624 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1625 skb->local_df = 1;
1626
1627 *final_dst = fl6->daddr;
1628 __skb_pull(skb, skb_network_header_len(skb));
1629 if (opt && opt->opt_flen)
1630 ipv6_push_frag_opts(skb, opt, &proto);
1631 if (opt && opt->opt_nflen)
1632 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1633
1634 skb_push(skb, sizeof(struct ipv6hdr));
1635 skb_reset_network_header(skb);
1636 hdr = ipv6_hdr(skb);
1637
1638 *(__be32*)hdr = fl6->flowlabel |
1639 htonl(0x60000000 | ((int)np->cork.tclass << 20));
1640
1641 hdr->hop_limit = np->cork.hop_limit;
1642 hdr->nexthdr = proto;
1643 hdr->saddr = fl6->saddr;
1644 hdr->daddr = *final_dst;
1645
1646 skb->priority = sk->sk_priority;
1647 skb->mark = sk->sk_mark;
1648
1649 skb_dst_set(skb, dst_clone(&rt->dst));
1650 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1651 if (proto == IPPROTO_ICMPV6) {
1652 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1653
1654 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1655 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1656 }
1657
1658 err = ip6_local_out(skb);
1659 if (err) {
1660 if (err > 0)
1661 err = net_xmit_errno(err);
1662 if (err)
1663 goto error;
1664 }
1665
1666 out:
1667 ip6_cork_release(inet, np);
1668 return err;
1669 error:
1670 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1671 goto out;
1672 }
1673 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1674
1675 void ip6_flush_pending_frames(struct sock *sk)
1676 {
1677 struct sk_buff *skb;
1678
1679 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1680 if (skb_dst(skb))
1681 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1682 IPSTATS_MIB_OUTDISCARDS);
1683 kfree_skb(skb);
1684 }
1685
1686 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1687 }
1688 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
Linus' kernel tree