?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
net: Discard and warn about LRO'd skbs received for forwarding
[linux-2.6/verdex.git] / net / ipv6 / ip6_output.c
blobfd7cd1bfe1510e4e71fcd000b02087a8c4280d97
1 /*
2 * IPv6 output functions
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on linux/net/ipv4/ip_output.c
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 *
15 * Changes:
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
20 * etc.
21 *
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
26 * for datagram xmit
27 */
28
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40
41 #include <linux/netfilter.h>
42 #include <linux/netfilter_ipv6.h>
43
44 #include <net/sock.h>
45 #include <net/snmp.h>
46
47 #include <net/ipv6.h>
48 #include <net/ndisc.h>
49 #include <net/protocol.h>
50 #include <net/ip6_route.h>
51 #include <net/addrconf.h>
52 #include <net/rawv6.h>
53 #include <net/icmp.h>
54 #include <net/xfrm.h>
55 #include <net/checksum.h>
56 #include <linux/mroute6.h>
57
58 static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
59
60 static __inline__ void ipv6_select_ident(struct sk_buff *skb, struct frag_hdr *fhdr)
61 {
62 static u32 ipv6_fragmentation_id = 1;
63 static DEFINE_SPINLOCK(ip6_id_lock);
64
65 spin_lock_bh(&ip6_id_lock);
66 fhdr->identification = htonl(ipv6_fragmentation_id);
67 if (++ipv6_fragmentation_id == 0)
68 ipv6_fragmentation_id = 1;
69 spin_unlock_bh(&ip6_id_lock);
70 }
71
72 int __ip6_local_out(struct sk_buff *skb)
73 {
74 int len;
75
76 len = skb->len - sizeof(struct ipv6hdr);
77 if (len > IPV6_MAXPLEN)
78 len = 0;
79 ipv6_hdr(skb)->payload_len = htons(len);
80
81 return nf_hook(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dst->dev,
82 dst_output);
83 }
84
85 int ip6_local_out(struct sk_buff *skb)
86 {
87 int err;
88
89 err = __ip6_local_out(skb);
90 if (likely(err == 1))
91 err = dst_output(skb);
92
93 return err;
94 }
95 EXPORT_SYMBOL_GPL(ip6_local_out);
96
97 static int ip6_output_finish(struct sk_buff *skb)
98 {
99 struct dst_entry *dst = skb->dst;
100
101 if (dst->hh)
102 return neigh_hh_output(dst->hh, skb);
103 else if (dst->neighbour)
104 return dst->neighbour->output(skb);
105
106 IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
107 kfree_skb(skb);
108 return -EINVAL;
109
110 }
111
112 /* dev_loopback_xmit for use with netfilter. */
113 static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
114 {
115 skb_reset_mac_header(newskb);
116 __skb_pull(newskb, skb_network_offset(newskb));
117 newskb->pkt_type = PACKET_LOOPBACK;
118 newskb->ip_summed = CHECKSUM_UNNECESSARY;
119 BUG_TRAP(newskb->dst);
120
121 netif_rx(newskb);
122 return 0;
123 }
124
125
126 static int ip6_output2(struct sk_buff *skb)
127 {
128 struct dst_entry *dst = skb->dst;
129 struct net_device *dev = dst->dev;
130
131 skb->protocol = htons(ETH_P_IPV6);
132 skb->dev = dev;
133
134 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
135 struct ipv6_pinfo* np = skb->sk ? inet6_sk(skb->sk) : NULL;
136 struct inet6_dev *idev = ip6_dst_idev(skb->dst);
137
138 if (!(dev->flags & IFF_LOOPBACK) && (!np || np->mc_loop) &&
139 ((mroute6_socket && !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
140 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
141 &ipv6_hdr(skb)->saddr))) {
142 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
143
144 /* Do not check for IFF_ALLMULTI; multicast routing
145 is not supported in any case.
146 */
147 if (newskb)
148 NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, newskb,
149 NULL, newskb->dev,
150 ip6_dev_loopback_xmit);
151
152 if (ipv6_hdr(skb)->hop_limit == 0) {
153 IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
154 kfree_skb(skb);
155 return 0;
156 }
157 }
158
159 IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
160 }
161
162 return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
163 ip6_output_finish);
164 }
165
166 static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
167 {
168 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
169
170 return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
171 skb->dst->dev->mtu : dst_mtu(skb->dst);
172 }
173
174 int ip6_output(struct sk_buff *skb)
175 {
176 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
177 dst_allfrag(skb->dst))
178 return ip6_fragment(skb, ip6_output2);
179 else
180 return ip6_output2(skb);
181 }
182
183 /*
184 * xmit an sk_buff (used by TCP)
185 */
186
187 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
188 struct ipv6_txoptions *opt, int ipfragok)
189 {
190 struct ipv6_pinfo *np = inet6_sk(sk);
191 struct in6_addr *first_hop = &fl->fl6_dst;
192 struct dst_entry *dst = skb->dst;
193 struct ipv6hdr *hdr;
194 u8 proto = fl->proto;
195 int seg_len = skb->len;
196 int hlimit, tclass;
197 u32 mtu;
198
199 if (opt) {
200 unsigned int head_room;
201
202 /* First: exthdrs may take lots of space (~8K for now)
203 MAX_HEADER is not enough.
204 */
205 head_room = opt->opt_nflen + opt->opt_flen;
206 seg_len += head_room;
207 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
208
209 if (skb_headroom(skb) < head_room) {
210 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
211 if (skb2 == NULL) {
212 IP6_INC_STATS(ip6_dst_idev(skb->dst),
213 IPSTATS_MIB_OUTDISCARDS);
214 kfree_skb(skb);
215 return -ENOBUFS;
216 }
217 kfree_skb(skb);
218 skb = skb2;
219 if (sk)
220 skb_set_owner_w(skb, sk);
221 }
222 if (opt->opt_flen)
223 ipv6_push_frag_opts(skb, opt, &proto);
224 if (opt->opt_nflen)
225 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
226 }
227
228 skb_push(skb, sizeof(struct ipv6hdr));
229 skb_reset_network_header(skb);
230 hdr = ipv6_hdr(skb);
231
232 /*
233 * Fill in the IPv6 header
234 */
235
236 hlimit = -1;
237 if (np)
238 hlimit = np->hop_limit;
239 if (hlimit < 0)
240 hlimit = ip6_dst_hoplimit(dst);
241
242 tclass = -1;
243 if (np)
244 tclass = np->tclass;
245 if (tclass < 0)
246 tclass = 0;
247
248 *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
249
250 hdr->payload_len = htons(seg_len);
251 hdr->nexthdr = proto;
252 hdr->hop_limit = hlimit;
253
254 ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
255 ipv6_addr_copy(&hdr->daddr, first_hop);
256
257 skb->priority = sk->sk_priority;
258 skb->mark = sk->sk_mark;
259
260 mtu = dst_mtu(dst);
261 if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
262 IP6_INC_STATS(ip6_dst_idev(skb->dst),
263 IPSTATS_MIB_OUTREQUESTS);
264 return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
265 dst_output);
266 }
267
268 if (net_ratelimit())
269 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
270 skb->dev = dst->dev;
271 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
272 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
273 kfree_skb(skb);
274 return -EMSGSIZE;
275 }
276
277 EXPORT_SYMBOL(ip6_xmit);
278
279 /*
280 * To avoid extra problems ND packets are send through this
281 * routine. It's code duplication but I really want to avoid
282 * extra checks since ipv6_build_header is used by TCP (which
283 * is for us performance critical)
284 */
285
286 int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
287 const struct in6_addr *saddr, const struct in6_addr *daddr,
288 int proto, int len)
289 {
290 struct ipv6_pinfo *np = inet6_sk(sk);
291 struct ipv6hdr *hdr;
292 int totlen;
293
294 skb->protocol = htons(ETH_P_IPV6);
295 skb->dev = dev;
296
297 totlen = len + sizeof(struct ipv6hdr);
298
299 skb_reset_network_header(skb);
300 skb_put(skb, sizeof(struct ipv6hdr));
301 hdr = ipv6_hdr(skb);
302
303 *(__be32*)hdr = htonl(0x60000000);
304
305 hdr->payload_len = htons(len);
306 hdr->nexthdr = proto;
307 hdr->hop_limit = np->hop_limit;
308
309 ipv6_addr_copy(&hdr->saddr, saddr);
310 ipv6_addr_copy(&hdr->daddr, daddr);
311
312 return 0;
313 }
314
315 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
316 {
317 struct ip6_ra_chain *ra;
318 struct sock *last = NULL;
319
320 read_lock(&ip6_ra_lock);
321 for (ra = ip6_ra_chain; ra; ra = ra->next) {
322 struct sock *sk = ra->sk;
323 if (sk && ra->sel == sel &&
324 (!sk->sk_bound_dev_if ||
325 sk->sk_bound_dev_if == skb->dev->ifindex)) {
326 if (last) {
327 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
328 if (skb2)
329 rawv6_rcv(last, skb2);
330 }
331 last = sk;
332 }
333 }
334
335 if (last) {
336 rawv6_rcv(last, skb);
337 read_unlock(&ip6_ra_lock);
338 return 1;
339 }
340 read_unlock(&ip6_ra_lock);
341 return 0;
342 }
343
344 static int ip6_forward_proxy_check(struct sk_buff *skb)
345 {
346 struct ipv6hdr *hdr = ipv6_hdr(skb);
347 u8 nexthdr = hdr->nexthdr;
348 int offset;
349
350 if (ipv6_ext_hdr(nexthdr)) {
351 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
352 if (offset < 0)
353 return 0;
354 } else
355 offset = sizeof(struct ipv6hdr);
356
357 if (nexthdr == IPPROTO_ICMPV6) {
358 struct icmp6hdr *icmp6;
359
360 if (!pskb_may_pull(skb, (skb_network_header(skb) +
361 offset + 1 - skb->data)))
362 return 0;
363
364 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
365
366 switch (icmp6->icmp6_type) {
367 case NDISC_ROUTER_SOLICITATION:
368 case NDISC_ROUTER_ADVERTISEMENT:
369 case NDISC_NEIGHBOUR_SOLICITATION:
370 case NDISC_NEIGHBOUR_ADVERTISEMENT:
371 case NDISC_REDIRECT:
372 /* For reaction involving unicast neighbor discovery
373 * message destined to the proxied address, pass it to
374 * input function.
375 */
376 return 1;
377 default:
378 break;
379 }
380 }
381
382 /*
383 * The proxying router can't forward traffic sent to a link-local
384 * address, so signal the sender and discard the packet. This
385 * behavior is clarified by the MIPv6 specification.
386 */
387 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
388 dst_link_failure(skb);
389 return -1;
390 }
391
392 return 0;
393 }
394
395 static inline int ip6_forward_finish(struct sk_buff *skb)
396 {
397 return dst_output(skb);
398 }
399
400 int ip6_forward(struct sk_buff *skb)
401 {
402 struct dst_entry *dst = skb->dst;
403 struct ipv6hdr *hdr = ipv6_hdr(skb);
404 struct inet6_skb_parm *opt = IP6CB(skb);
405 struct net *net = dev_net(dst->dev);
406
407 if (ipv6_devconf.forwarding == 0)
408 goto error;
409
410 if (skb_warn_if_lro(skb))
411 goto drop;
412
413 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
414 IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
415 goto drop;
416 }
417
418 skb_forward_csum(skb);
419
420 /*
421 * We DO NOT make any processing on
422 * RA packets, pushing them to user level AS IS
423 * without ane WARRANTY that application will be able
424 * to interpret them. The reason is that we
425 * cannot make anything clever here.
426 *
427 * We are not end-node, so that if packet contains
428 * AH/ESP, we cannot make anything.
429 * Defragmentation also would be mistake, RA packets
430 * cannot be fragmented, because there is no warranty
431 * that different fragments will go along one path. --ANK
432 */
433 if (opt->ra) {
434 u8 *ptr = skb_network_header(skb) + opt->ra;
435 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
436 return 0;
437 }
438
439 /*
440 * check and decrement ttl
441 */
442 if (hdr->hop_limit <= 1) {
443 /* Force OUTPUT device used as source address */
444 skb->dev = dst->dev;
445 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
446 0, skb->dev);
447 IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
448
449 kfree_skb(skb);
450 return -ETIMEDOUT;
451 }
452
453 /* XXX: idev->cnf.proxy_ndp? */
454 if (ipv6_devconf.proxy_ndp &&
455 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
456 int proxied = ip6_forward_proxy_check(skb);
457 if (proxied > 0)
458 return ip6_input(skb);
459 else if (proxied < 0) {
460 IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
461 goto drop;
462 }
463 }
464
465 if (!xfrm6_route_forward(skb)) {
466 IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
467 goto drop;
468 }
469 dst = skb->dst;
470
471 /* IPv6 specs say nothing about it, but it is clear that we cannot
472 send redirects to source routed frames.
473 We don't send redirects to frames decapsulated from IPsec.
474 */
475 if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
476 !skb->sp) {
477 struct in6_addr *target = NULL;
478 struct rt6_info *rt;
479 struct neighbour *n = dst->neighbour;
480
481 /*
482 * incoming and outgoing devices are the same
483 * send a redirect.
484 */
485
486 rt = (struct rt6_info *) dst;
487 if ((rt->rt6i_flags & RTF_GATEWAY))
488 target = (struct in6_addr*)&n->primary_key;
489 else
490 target = &hdr->daddr;
491
492 /* Limit redirects both by destination (here)
493 and by source (inside ndisc_send_redirect)
494 */
495 if (xrlim_allow(dst, 1*HZ))
496 ndisc_send_redirect(skb, n, target);
497 } else {
498 int addrtype = ipv6_addr_type(&hdr->saddr);
499
500 /* This check is security critical. */
501 if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))
502 goto error;
503 if (addrtype & IPV6_ADDR_LINKLOCAL) {
504 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
505 ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
506 goto error;
507 }
508 }
509
510 if (skb->len > dst_mtu(dst)) {
511 /* Again, force OUTPUT device used as source address */
512 skb->dev = dst->dev;
513 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, dst_mtu(dst), skb->dev);
514 IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
515 IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
516 kfree_skb(skb);
517 return -EMSGSIZE;
518 }
519
520 if (skb_cow(skb, dst->dev->hard_header_len)) {
521 IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
522 goto drop;
523 }
524
525 hdr = ipv6_hdr(skb);
526
527 /* Mangling hops number delayed to point after skb COW */
528
529 hdr->hop_limit--;
530
531 IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
532 return NF_HOOK(PF_INET6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
533 ip6_forward_finish);
534
535 error:
536 IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
537 drop:
538 kfree_skb(skb);
539 return -EINVAL;
540 }
541
542 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
543 {
544 to->pkt_type = from->pkt_type;
545 to->priority = from->priority;
546 to->protocol = from->protocol;
547 dst_release(to->dst);
548 to->dst = dst_clone(from->dst);
549 to->dev = from->dev;
550 to->mark = from->mark;
551
552 #ifdef CONFIG_NET_SCHED
553 to->tc_index = from->tc_index;
554 #endif
555 nf_copy(to, from);
556 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
557 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
558 to->nf_trace = from->nf_trace;
559 #endif
560 skb_copy_secmark(to, from);
561 }
562
563 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
564 {
565 u16 offset = sizeof(struct ipv6hdr);
566 struct ipv6_opt_hdr *exthdr =
567 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
568 unsigned int packet_len = skb->tail - skb->network_header;
569 int found_rhdr = 0;
570 *nexthdr = &ipv6_hdr(skb)->nexthdr;
571
572 while (offset + 1 <= packet_len) {
573
574 switch (**nexthdr) {
575
576 case NEXTHDR_HOP:
577 break;
578 case NEXTHDR_ROUTING:
579 found_rhdr = 1;
580 break;
581 case NEXTHDR_DEST:
582 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
583 if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
584 break;
585 #endif
586 if (found_rhdr)
587 return offset;
588 break;
589 default :
590 return offset;
591 }
592
593 offset += ipv6_optlen(exthdr);
594 *nexthdr = &exthdr->nexthdr;
595 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
596 offset);
597 }
598
599 return offset;
600 }
601
602 static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
603 {
604 struct net_device *dev;
605 struct sk_buff *frag;
606 struct rt6_info *rt = (struct rt6_info*)skb->dst;
607 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
608 struct ipv6hdr *tmp_hdr;
609 struct frag_hdr *fh;
610 unsigned int mtu, hlen, left, len;
611 __be32 frag_id = 0;
612 int ptr, offset = 0, err=0;
613 u8 *prevhdr, nexthdr = 0;
614
615 dev = rt->u.dst.dev;
616 hlen = ip6_find_1stfragopt(skb, &prevhdr);
617 nexthdr = *prevhdr;
618
619 mtu = ip6_skb_dst_mtu(skb);
620
621 /* We must not fragment if the socket is set to force MTU discovery
622 * or if the skb it not generated by a local socket. (This last
623 * check should be redundant, but it's free.)
624 */
625 if (!skb->local_df) {
626 skb->dev = skb->dst->dev;
627 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
628 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
629 kfree_skb(skb);
630 return -EMSGSIZE;
631 }
632
633 if (np && np->frag_size < mtu) {
634 if (np->frag_size)
635 mtu = np->frag_size;
636 }
637 mtu -= hlen + sizeof(struct frag_hdr);
638
639 if (skb_shinfo(skb)->frag_list) {
640 int first_len = skb_pagelen(skb);
641 int truesizes = 0;
642
643 if (first_len - hlen > mtu ||
644 ((first_len - hlen) & 7) ||
645 skb_cloned(skb))
646 goto slow_path;
647
648 for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next) {
649 /* Correct geometry. */
650 if (frag->len > mtu ||
651 ((frag->len & 7) && frag->next) ||
652 skb_headroom(frag) < hlen)
653 goto slow_path;
654
655 /* Partially cloned skb? */
656 if (skb_shared(frag))
657 goto slow_path;
658
659 BUG_ON(frag->sk);
660 if (skb->sk) {
661 sock_hold(skb->sk);
662 frag->sk = skb->sk;
663 frag->destructor = sock_wfree;
664 truesizes += frag->truesize;
665 }
666 }
667
668 err = 0;
669 offset = 0;
670 frag = skb_shinfo(skb)->frag_list;
671 skb_shinfo(skb)->frag_list = NULL;
672 /* BUILD HEADER */
673
674 *prevhdr = NEXTHDR_FRAGMENT;
675 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
676 if (!tmp_hdr) {
677 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
678 return -ENOMEM;
679 }
680
681 __skb_pull(skb, hlen);
682 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
683 __skb_push(skb, hlen);
684 skb_reset_network_header(skb);
685 memcpy(skb_network_header(skb), tmp_hdr, hlen);
686
687 ipv6_select_ident(skb, fh);
688 fh->nexthdr = nexthdr;
689 fh->reserved = 0;
690 fh->frag_off = htons(IP6_MF);
691 frag_id = fh->identification;
692
693 first_len = skb_pagelen(skb);
694 skb->data_len = first_len - skb_headlen(skb);
695 skb->truesize -= truesizes;
696 skb->len = first_len;
697 ipv6_hdr(skb)->payload_len = htons(first_len -
698 sizeof(struct ipv6hdr));
699
700 dst_hold(&rt->u.dst);
701
702 for (;;) {
703 /* Prepare header of the next frame,
704 * before previous one went down. */
705 if (frag) {
706 frag->ip_summed = CHECKSUM_NONE;
707 skb_reset_transport_header(frag);
708 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
709 __skb_push(frag, hlen);
710 skb_reset_network_header(frag);
711 memcpy(skb_network_header(frag), tmp_hdr,
712 hlen);
713 offset += skb->len - hlen - sizeof(struct frag_hdr);
714 fh->nexthdr = nexthdr;
715 fh->reserved = 0;
716 fh->frag_off = htons(offset);
717 if (frag->next != NULL)
718 fh->frag_off |= htons(IP6_MF);
719 fh->identification = frag_id;
720 ipv6_hdr(frag)->payload_len =
721 htons(frag->len -
722 sizeof(struct ipv6hdr));
723 ip6_copy_metadata(frag, skb);
724 }
725
726 err = output(skb);
727 if(!err)
728 IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGCREATES);
729
730 if (err || !frag)
731 break;
732
733 skb = frag;
734 frag = skb->next;
735 skb->next = NULL;
736 }
737
738 kfree(tmp_hdr);
739
740 if (err == 0) {
741 IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGOKS);
742 dst_release(&rt->u.dst);
743 return 0;
744 }
745
746 while (frag) {
747 skb = frag->next;
748 kfree_skb(frag);
749 frag = skb;
750 }
751
752 IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGFAILS);
753 dst_release(&rt->u.dst);
754 return err;
755 }
756
757 slow_path:
758 left = skb->len - hlen; /* Space per frame */
759 ptr = hlen; /* Where to start from */
760
761 /*
762 * Fragment the datagram.
763 */
764
765 *prevhdr = NEXTHDR_FRAGMENT;
766
767 /*
768 * Keep copying data until we run out.
769 */
770 while(left > 0) {
771 len = left;
772 /* IF: it doesn't fit, use 'mtu' - the data space left */
773 if (len > mtu)
774 len = mtu;
775 /* IF: we are not sending upto and including the packet end
776 then align the next start on an eight byte boundary */
777 if (len < left) {
778 len &= ~7;
779 }
780 /*
781 * Allocate buffer.
782 */
783
784 if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_ALLOCATED_SPACE(rt->u.dst.dev), GFP_ATOMIC)) == NULL) {
785 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
786 IP6_INC_STATS(ip6_dst_idev(skb->dst),
787 IPSTATS_MIB_FRAGFAILS);
788 err = -ENOMEM;
789 goto fail;
790 }
791
792 /*
793 * Set up data on packet
794 */
795
796 ip6_copy_metadata(frag, skb);
797 skb_reserve(frag, LL_RESERVED_SPACE(rt->u.dst.dev));
798 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
799 skb_reset_network_header(frag);
800 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
801 frag->transport_header = (frag->network_header + hlen +
802 sizeof(struct frag_hdr));
803
804 /*
805 * Charge the memory for the fragment to any owner
806 * it might possess
807 */
808 if (skb->sk)
809 skb_set_owner_w(frag, skb->sk);
810
811 /*
812 * Copy the packet header into the new buffer.
813 */
814 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
815
816 /*
817 * Build fragment header.
818 */
819 fh->nexthdr = nexthdr;
820 fh->reserved = 0;
821 if (!frag_id) {
822 ipv6_select_ident(skb, fh);
823 frag_id = fh->identification;
824 } else
825 fh->identification = frag_id;
826
827 /*
828 * Copy a block of the IP datagram.
829 */
830 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
831 BUG();
832 left -= len;
833
834 fh->frag_off = htons(offset);
835 if (left > 0)
836 fh->frag_off |= htons(IP6_MF);
837 ipv6_hdr(frag)->payload_len = htons(frag->len -
838 sizeof(struct ipv6hdr));
839
840 ptr += len;
841 offset += len;
842
843 /*
844 * Put this fragment into the sending queue.
845 */
846 err = output(frag);
847 if (err)
848 goto fail;
849
850 IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGCREATES);
851 }
852 IP6_INC_STATS(ip6_dst_idev(skb->dst),
853 IPSTATS_MIB_FRAGOKS);
854 kfree_skb(skb);
855 return err;
856
857 fail:
858 IP6_INC_STATS(ip6_dst_idev(skb->dst),
859 IPSTATS_MIB_FRAGFAILS);
860 kfree_skb(skb);
861 return err;
862 }
863
864 static inline int ip6_rt_check(struct rt6key *rt_key,
865 struct in6_addr *fl_addr,
866 struct in6_addr *addr_cache)
867 {
868 return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
869 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
870 }
871
872 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
873 struct dst_entry *dst,
874 struct flowi *fl)
875 {
876 struct ipv6_pinfo *np = inet6_sk(sk);
877 struct rt6_info *rt = (struct rt6_info *)dst;
878
879 if (!dst)
880 goto out;
881
882 /* Yes, checking route validity in not connected
883 * case is not very simple. Take into account,
884 * that we do not support routing by source, TOS,
885 * and MSG_DONTROUTE --ANK (980726)
886 *
887 * 1. ip6_rt_check(): If route was host route,
888 * check that cached destination is current.
889 * If it is network route, we still may
890 * check its validity using saved pointer
891 * to the last used address: daddr_cache.
892 * We do not want to save whole address now,
893 * (because main consumer of this service
894 * is tcp, which has not this problem),
895 * so that the last trick works only on connected
896 * sockets.
897 * 2. oif also should be the same.
898 */
899 if (ip6_rt_check(&rt->rt6i_dst, &fl->fl6_dst, np->daddr_cache) ||
900 #ifdef CONFIG_IPV6_SUBTREES
901 ip6_rt_check(&rt->rt6i_src, &fl->fl6_src, np->saddr_cache) ||
902 #endif
903 (fl->oif && fl->oif != dst->dev->ifindex)) {
904 dst_release(dst);
905 dst = NULL;
906 }
907
908 out:
909 return dst;
910 }
911
912 static int ip6_dst_lookup_tail(struct sock *sk,
913 struct dst_entry **dst, struct flowi *fl)
914 {
915 int err;
916 struct net *net = sock_net(sk);
917
918 if (*dst == NULL)
919 *dst = ip6_route_output(net, sk, fl);
920
921 if ((err = (*dst)->error))
922 goto out_err_release;
923
924 if (ipv6_addr_any(&fl->fl6_src)) {
925 err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev,
926 &fl->fl6_dst,
927 sk ? inet6_sk(sk)->srcprefs : 0,
928 &fl->fl6_src);
929 if (err)
930 goto out_err_release;
931 }
932
933 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
934 /*
935 * Here if the dst entry we've looked up
936 * has a neighbour entry that is in the INCOMPLETE
937 * state and the src address from the flow is
938 * marked as OPTIMISTIC, we release the found
939 * dst entry and replace it instead with the
940 * dst entry of the nexthop router
941 */
942 if (!((*dst)->neighbour->nud_state & NUD_VALID)) {
943 struct inet6_ifaddr *ifp;
944 struct flowi fl_gw;
945 int redirect;
946
947 ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
948 (*dst)->dev, 1);
949
950 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
951 if (ifp)
952 in6_ifa_put(ifp);
953
954 if (redirect) {
955 /*
956 * We need to get the dst entry for the
957 * default router instead
958 */
959 dst_release(*dst);
960 memcpy(&fl_gw, fl, sizeof(struct flowi));
961 memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
962 *dst = ip6_route_output(net, sk, &fl_gw);
963 if ((err = (*dst)->error))
964 goto out_err_release;
965 }
966 }
967 #endif
968
969 return 0;
970
971 out_err_release:
972 if (err == -ENETUNREACH)
973 IP6_INC_STATS_BH(NULL, IPSTATS_MIB_OUTNOROUTES);
974 dst_release(*dst);
975 *dst = NULL;
976 return err;
977 }
978
979 /**
980 * ip6_dst_lookup - perform route lookup on flow
981 * @sk: socket which provides route info
982 * @dst: pointer to dst_entry * for result
983 * @fl: flow to lookup
984 *
985 * This function performs a route lookup on the given flow.
986 *
987 * It returns zero on success, or a standard errno code on error.
988 */
989 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
990 {
991 *dst = NULL;
992 return ip6_dst_lookup_tail(sk, dst, fl);
993 }
994 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
995
996 /**
997 * ip6_sk_dst_lookup - perform socket cached route lookup on flow
998 * @sk: socket which provides the dst cache and route info
999 * @dst: pointer to dst_entry * for result
1000 * @fl: flow to lookup
1001 *
1002 * This function performs a route lookup on the given flow with the
1003 * possibility of using the cached route in the socket if it is valid.
1004 * It will take the socket dst lock when operating on the dst cache.
1005 * As a result, this function can only be used in process context.
1006 *
1007 * It returns zero on success, or a standard errno code on error.
1008 */
1009 int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
1010 {
1011 *dst = NULL;
1012 if (sk) {
1013 *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1014 *dst = ip6_sk_dst_check(sk, *dst, fl);
1015 }
1016
1017 return ip6_dst_lookup_tail(sk, dst, fl);
1018 }
1019 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
1020
1021 static inline int ip6_ufo_append_data(struct sock *sk,
1022 int getfrag(void *from, char *to, int offset, int len,
1023 int odd, struct sk_buff *skb),
1024 void *from, int length, int hh_len, int fragheaderlen,
1025 int transhdrlen, int mtu,unsigned int flags)
1026
1027 {
1028 struct sk_buff *skb;
1029 int err;
1030
1031 /* There is support for UDP large send offload by network
1032 * device, so create one single skb packet containing complete
1033 * udp datagram
1034 */
1035 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1036 skb = sock_alloc_send_skb(sk,
1037 hh_len + fragheaderlen + transhdrlen + 20,
1038 (flags & MSG_DONTWAIT), &err);
1039 if (skb == NULL)
1040 return -ENOMEM;
1041
1042 /* reserve space for Hardware header */
1043 skb_reserve(skb, hh_len);
1044
1045 /* create space for UDP/IP header */
1046 skb_put(skb,fragheaderlen + transhdrlen);
1047
1048 /* initialize network header pointer */
1049 skb_reset_network_header(skb);
1050
1051 /* initialize protocol header pointer */
1052 skb->transport_header = skb->network_header + fragheaderlen;
1053
1054 skb->ip_summed = CHECKSUM_PARTIAL;
1055 skb->csum = 0;
1056 sk->sk_sndmsg_off = 0;
1057 }
1058
1059 err = skb_append_datato_frags(sk,skb, getfrag, from,
1060 (length - transhdrlen));
1061 if (!err) {
1062 struct frag_hdr fhdr;
1063
1064 /* specify the length of each IP datagram fragment*/
1065 skb_shinfo(skb)->gso_size = mtu - fragheaderlen -
1066 sizeof(struct frag_hdr);
1067 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1068 ipv6_select_ident(skb, &fhdr);
1069 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1070 __skb_queue_tail(&sk->sk_write_queue, skb);
1071
1072 return 0;
1073 }
1074 /* There is not enough support do UPD LSO,
1075 * so follow normal path
1076 */
1077 kfree_skb(skb);
1078
1079 return err;
1080 }
1081
1082 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1083 int offset, int len, int odd, struct sk_buff *skb),
1084 void *from, int length, int transhdrlen,
1085 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
1086 struct rt6_info *rt, unsigned int flags)
1087 {
1088 struct inet_sock *inet = inet_sk(sk);
1089 struct ipv6_pinfo *np = inet6_sk(sk);
1090 struct sk_buff *skb;
1091 unsigned int maxfraglen, fragheaderlen;
1092 int exthdrlen;
1093 int hh_len;
1094 int mtu;
1095 int copy;
1096 int err;
1097 int offset = 0;
1098 int csummode = CHECKSUM_NONE;
1099
1100 if (flags&MSG_PROBE)
1101 return 0;
1102 if (skb_queue_empty(&sk->sk_write_queue)) {
1103 /*
1104 * setup for corking
1105 */
1106 if (opt) {
1107 if (np->cork.opt == NULL) {
1108 np->cork.opt = kmalloc(opt->tot_len,
1109 sk->sk_allocation);
1110 if (unlikely(np->cork.opt == NULL))
1111 return -ENOBUFS;
1112 } else if (np->cork.opt->tot_len < opt->tot_len) {
1113 printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
1114 return -EINVAL;
1115 }
1116 memcpy(np->cork.opt, opt, opt->tot_len);
1117 inet->cork.flags |= IPCORK_OPT;
1118 /* need source address above miyazawa*/
1119 }
1120 dst_hold(&rt->u.dst);
1121 inet->cork.dst = &rt->u.dst;
1122 inet->cork.fl = *fl;
1123 np->cork.hop_limit = hlimit;
1124 np->cork.tclass = tclass;
1125 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1126 rt->u.dst.dev->mtu : dst_mtu(rt->u.dst.path);
1127 if (np->frag_size < mtu) {
1128 if (np->frag_size)
1129 mtu = np->frag_size;
1130 }
1131 inet->cork.fragsize = mtu;
1132 if (dst_allfrag(rt->u.dst.path))
1133 inet->cork.flags |= IPCORK_ALLFRAG;
1134 inet->cork.length = 0;
1135 sk->sk_sndmsg_page = NULL;
1136 sk->sk_sndmsg_off = 0;
1137 exthdrlen = rt->u.dst.header_len + (opt ? opt->opt_flen : 0) -
1138 rt->rt6i_nfheader_len;
1139 length += exthdrlen;
1140 transhdrlen += exthdrlen;
1141 } else {
1142 rt = (struct rt6_info *)inet->cork.dst;
1143 fl = &inet->cork.fl;
1144 if (inet->cork.flags & IPCORK_OPT)
1145 opt = np->cork.opt;
1146 transhdrlen = 0;
1147 exthdrlen = 0;
1148 mtu = inet->cork.fragsize;
1149 }
1150
1151 hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
1152
1153 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1154 (opt ? opt->opt_nflen : 0);
1155 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1156
1157 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1158 if (inet->cork.length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1159 ipv6_local_error(sk, EMSGSIZE, fl, mtu-exthdrlen);
1160 return -EMSGSIZE;
1161 }
1162 }
1163
1164 /*
1165 * Let's try using as much space as possible.
1166 * Use MTU if total length of the message fits into the MTU.
1167 * Otherwise, we need to reserve fragment header and
1168 * fragment alignment (= 8-15 octects, in total).
1169 *
1170 * Note that we may need to "move" the data from the tail of
1171 * of the buffer to the new fragment when we split
1172 * the message.
1173 *
1174 * FIXME: It may be fragmented into multiple chunks
1175 * at once if non-fragmentable extension headers
1176 * are too large.
1177 * --yoshfuji
1178 */
1179
1180 inet->cork.length += length;
1181 if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
1182 (rt->u.dst.dev->features & NETIF_F_UFO)) {
1183
1184 err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
1185 fragheaderlen, transhdrlen, mtu,
1186 flags);
1187 if (err)
1188 goto error;
1189 return 0;
1190 }
1191
1192 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
1193 goto alloc_new_skb;
1194
1195 while (length > 0) {
1196 /* Check if the remaining data fits into current packet. */
1197 copy = (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1198 if (copy < length)
1199 copy = maxfraglen - skb->len;
1200
1201 if (copy <= 0) {
1202 char *data;
1203 unsigned int datalen;
1204 unsigned int fraglen;
1205 unsigned int fraggap;
1206 unsigned int alloclen;
1207 struct sk_buff *skb_prev;
1208 alloc_new_skb:
1209 skb_prev = skb;
1210
1211 /* There's no room in the current skb */
1212 if (skb_prev)
1213 fraggap = skb_prev->len - maxfraglen;
1214 else
1215 fraggap = 0;
1216
1217 /*
1218 * If remaining data exceeds the mtu,
1219 * we know we need more fragment(s).
1220 */
1221 datalen = length + fraggap;
1222 if (datalen > (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1223 datalen = maxfraglen - fragheaderlen;
1224
1225 fraglen = datalen + fragheaderlen;
1226 if ((flags & MSG_MORE) &&
1227 !(rt->u.dst.dev->features&NETIF_F_SG))
1228 alloclen = mtu;
1229 else
1230 alloclen = datalen + fragheaderlen;
1231
1232 /*
1233 * The last fragment gets additional space at tail.
1234 * Note: we overallocate on fragments with MSG_MODE
1235 * because we have no idea if we're the last one.
1236 */
1237 if (datalen == length + fraggap)
1238 alloclen += rt->u.dst.trailer_len;
1239
1240 /*
1241 * We just reserve space for fragment header.
1242 * Note: this may be overallocation if the message
1243 * (without MSG_MORE) fits into the MTU.
1244 */
1245 alloclen += sizeof(struct frag_hdr);
1246
1247 if (transhdrlen) {
1248 skb = sock_alloc_send_skb(sk,
1249 alloclen + hh_len,
1250 (flags & MSG_DONTWAIT), &err);
1251 } else {
1252 skb = NULL;
1253 if (atomic_read(&sk->sk_wmem_alloc) <=
1254 2 * sk->sk_sndbuf)
1255 skb = sock_wmalloc(sk,
1256 alloclen + hh_len, 1,
1257 sk->sk_allocation);
1258 if (unlikely(skb == NULL))
1259 err = -ENOBUFS;
1260 }
1261 if (skb == NULL)
1262 goto error;
1263 /*
1264 * Fill in the control structures
1265 */
1266 skb->ip_summed = csummode;
1267 skb->csum = 0;
1268 /* reserve for fragmentation */
1269 skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
1270
1271 /*
1272 * Find where to start putting bytes
1273 */
1274 data = skb_put(skb, fraglen);
1275 skb_set_network_header(skb, exthdrlen);
1276 data += fragheaderlen;
1277 skb->transport_header = (skb->network_header +
1278 fragheaderlen);
1279 if (fraggap) {
1280 skb->csum = skb_copy_and_csum_bits(
1281 skb_prev, maxfraglen,
1282 data + transhdrlen, fraggap, 0);
1283 skb_prev->csum = csum_sub(skb_prev->csum,
1284 skb->csum);
1285 data += fraggap;
1286 pskb_trim_unique(skb_prev, maxfraglen);
1287 }
1288 copy = datalen - transhdrlen - fraggap;
1289 if (copy < 0) {
1290 err = -EINVAL;
1291 kfree_skb(skb);
1292 goto error;
1293 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1294 err = -EFAULT;
1295 kfree_skb(skb);
1296 goto error;
1297 }
1298
1299 offset += copy;
1300 length -= datalen - fraggap;
1301 transhdrlen = 0;
1302 exthdrlen = 0;
1303 csummode = CHECKSUM_NONE;
1304
1305 /*
1306 * Put the packet on the pending queue
1307 */
1308 __skb_queue_tail(&sk->sk_write_queue, skb);
1309 continue;
1310 }
1311
1312 if (copy > length)
1313 copy = length;
1314
1315 if (!(rt->u.dst.dev->features&NETIF_F_SG)) {
1316 unsigned int off;
1317
1318 off = skb->len;
1319 if (getfrag(from, skb_put(skb, copy),
1320 offset, copy, off, skb) < 0) {
1321 __skb_trim(skb, off);
1322 err = -EFAULT;
1323 goto error;
1324 }
1325 } else {
1326 int i = skb_shinfo(skb)->nr_frags;
1327 skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
1328 struct page *page = sk->sk_sndmsg_page;
1329 int off = sk->sk_sndmsg_off;
1330 unsigned int left;
1331
1332 if (page && (left = PAGE_SIZE - off) > 0) {
1333 if (copy >= left)
1334 copy = left;
1335 if (page != frag->page) {
1336 if (i == MAX_SKB_FRAGS) {
1337 err = -EMSGSIZE;
1338 goto error;
1339 }
1340 get_page(page);
1341 skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
1342 frag = &skb_shinfo(skb)->frags[i];
1343 }
1344 } else if(i < MAX_SKB_FRAGS) {
1345 if (copy > PAGE_SIZE)
1346 copy = PAGE_SIZE;
1347 page = alloc_pages(sk->sk_allocation, 0);
1348 if (page == NULL) {
1349 err = -ENOMEM;
1350 goto error;
1351 }
1352 sk->sk_sndmsg_page = page;
1353 sk->sk_sndmsg_off = 0;
1354
1355 skb_fill_page_desc(skb, i, page, 0, 0);
1356 frag = &skb_shinfo(skb)->frags[i];
1357 } else {
1358 err = -EMSGSIZE;
1359 goto error;
1360 }
1361 if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
1362 err = -EFAULT;
1363 goto error;
1364 }
1365 sk->sk_sndmsg_off += copy;
1366 frag->size += copy;
1367 skb->len += copy;
1368 skb->data_len += copy;
1369 skb->truesize += copy;
1370 atomic_add(copy, &sk->sk_wmem_alloc);
1371 }
1372 offset += copy;
1373 length -= copy;
1374 }
1375 return 0;
1376 error:
1377 inet->cork.length -= length;
1378 IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1379 return err;
1380 }
1381
1382 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1383 {
1384 inet->cork.flags &= ~IPCORK_OPT;
1385 kfree(np->cork.opt);
1386 np->cork.opt = NULL;
1387 if (inet->cork.dst) {
1388 dst_release(inet->cork.dst);
1389 inet->cork.dst = NULL;
1390 inet->cork.flags &= ~IPCORK_ALLFRAG;
1391 }
1392 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1393 }
1394
1395 int ip6_push_pending_frames(struct sock *sk)
1396 {
1397 struct sk_buff *skb, *tmp_skb;
1398 struct sk_buff **tail_skb;
1399 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1400 struct inet_sock *inet = inet_sk(sk);
1401 struct ipv6_pinfo *np = inet6_sk(sk);
1402 struct ipv6hdr *hdr;
1403 struct ipv6_txoptions *opt = np->cork.opt;
1404 struct rt6_info *rt = (struct rt6_info *)inet->cork.dst;
1405 struct flowi *fl = &inet->cork.fl;
1406 unsigned char proto = fl->proto;
1407 int err = 0;
1408
1409 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1410 goto out;
1411 tail_skb = &(skb_shinfo(skb)->frag_list);
1412
1413 /* move skb->data to ip header from ext header */
1414 if (skb->data < skb_network_header(skb))
1415 __skb_pull(skb, skb_network_offset(skb));
1416 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1417 __skb_pull(tmp_skb, skb_network_header_len(skb));
1418 *tail_skb = tmp_skb;
1419 tail_skb = &(tmp_skb->next);
1420 skb->len += tmp_skb->len;
1421 skb->data_len += tmp_skb->len;
1422 skb->truesize += tmp_skb->truesize;
1423 __sock_put(tmp_skb->sk);
1424 tmp_skb->destructor = NULL;
1425 tmp_skb->sk = NULL;
1426 }
1427
1428 /* Allow local fragmentation. */
1429 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1430 skb->local_df = 1;
1431
1432 ipv6_addr_copy(final_dst, &fl->fl6_dst);
1433 __skb_pull(skb, skb_network_header_len(skb));
1434 if (opt && opt->opt_flen)
1435 ipv6_push_frag_opts(skb, opt, &proto);
1436 if (opt && opt->opt_nflen)
1437 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1438
1439 skb_push(skb, sizeof(struct ipv6hdr));
1440 skb_reset_network_header(skb);
1441 hdr = ipv6_hdr(skb);
1442
1443 *(__be32*)hdr = fl->fl6_flowlabel |
1444 htonl(0x60000000 | ((int)np->cork.tclass << 20));
1445
1446 hdr->hop_limit = np->cork.hop_limit;
1447 hdr->nexthdr = proto;
1448 ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
1449 ipv6_addr_copy(&hdr->daddr, final_dst);
1450
1451 skb->priority = sk->sk_priority;
1452 skb->mark = sk->sk_mark;
1453
1454 skb->dst = dst_clone(&rt->u.dst);
1455 IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
1456 if (proto == IPPROTO_ICMPV6) {
1457 struct inet6_dev *idev = ip6_dst_idev(skb->dst);
1458
1459 ICMP6MSGOUT_INC_STATS_BH(idev, icmp6_hdr(skb)->icmp6_type);
1460 ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
1461 }
1462
1463 err = ip6_local_out(skb);
1464 if (err) {
1465 if (err > 0)
1466 err = np->recverr ? net_xmit_errno(err) : 0;
1467 if (err)
1468 goto error;
1469 }
1470
1471 out:
1472 ip6_cork_release(inet, np);
1473 return err;
1474 error:
1475 goto out;
1476 }
1477
1478 void ip6_flush_pending_frames(struct sock *sk)
1479 {
1480 struct sk_buff *skb;
1481
1482 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1483 if (skb->dst)
1484 IP6_INC_STATS(ip6_dst_idev(skb->dst),
1485 IPSTATS_MIB_OUTDISCARDS);
1486 kfree_skb(skb);
1487 }
1488
1489 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1490 }
Verdex Pro support