xref: /openbmc/linux/net/ipv6/ip6_output.c (revision e30b38c298b55e09456d3ccbc1df2f3e2e8dc6e9)
11da177e4SLinus Torvalds /*
21da177e4SLinus Torvalds  *	IPv6 output functions
31da177e4SLinus Torvalds  *	Linux INET6 implementation
41da177e4SLinus Torvalds  *
51da177e4SLinus Torvalds  *	Authors:
61da177e4SLinus Torvalds  *	Pedro Roque		<roque@di.fc.ul.pt>
71da177e4SLinus Torvalds  *
81da177e4SLinus Torvalds  *	Based on linux/net/ipv4/ip_output.c
91da177e4SLinus Torvalds  *
101da177e4SLinus Torvalds  *	This program is free software; you can redistribute it and/or
111da177e4SLinus Torvalds  *      modify it under the terms of the GNU General Public License
121da177e4SLinus Torvalds  *      as published by the Free Software Foundation; either version
131da177e4SLinus Torvalds  *      2 of the License, or (at your option) any later version.
141da177e4SLinus Torvalds  *
151da177e4SLinus Torvalds  *	Changes:
161da177e4SLinus Torvalds  *	A.N.Kuznetsov	:	airthmetics in fragmentation.
171da177e4SLinus Torvalds  *				extension headers are implemented.
181da177e4SLinus Torvalds  *				route changes now work.
191da177e4SLinus Torvalds  *				ip6_forward does not confuse sniffers.
201da177e4SLinus Torvalds  *				etc.
211da177e4SLinus Torvalds  *
221da177e4SLinus Torvalds  *      H. von Brand    :       Added missing #include <linux/string.h>
231da177e4SLinus Torvalds  *	Imran Patel	: 	frag id should be in NBO
241da177e4SLinus Torvalds  *      Kazunori MIYAZAWA @USAGI
251da177e4SLinus Torvalds  *			:       add ip6_append_data and related functions
261da177e4SLinus Torvalds  *				for datagram xmit
271da177e4SLinus Torvalds  */
281da177e4SLinus Torvalds 
291da177e4SLinus Torvalds #include <linux/errno.h>
30ef76bc23SHerbert Xu #include <linux/kernel.h>
311da177e4SLinus Torvalds #include <linux/string.h>
321da177e4SLinus Torvalds #include <linux/socket.h>
331da177e4SLinus Torvalds #include <linux/net.h>
341da177e4SLinus Torvalds #include <linux/netdevice.h>
351da177e4SLinus Torvalds #include <linux/if_arp.h>
361da177e4SLinus Torvalds #include <linux/in6.h>
371da177e4SLinus Torvalds #include <linux/tcp.h>
381da177e4SLinus Torvalds #include <linux/route.h>
39b59f45d0SHerbert Xu #include <linux/module.h>
405a0e3ad6STejun Heo #include <linux/slab.h>
411da177e4SLinus Torvalds 
421da177e4SLinus Torvalds #include <linux/netfilter.h>
431da177e4SLinus Torvalds #include <linux/netfilter_ipv6.h>
441da177e4SLinus Torvalds 
451da177e4SLinus Torvalds #include <net/sock.h>
461da177e4SLinus Torvalds #include <net/snmp.h>
471da177e4SLinus Torvalds 
481da177e4SLinus Torvalds #include <net/ipv6.h>
491da177e4SLinus Torvalds #include <net/ndisc.h>
501da177e4SLinus Torvalds #include <net/protocol.h>
511da177e4SLinus Torvalds #include <net/ip6_route.h>
521da177e4SLinus Torvalds #include <net/addrconf.h>
531da177e4SLinus Torvalds #include <net/rawv6.h>
541da177e4SLinus Torvalds #include <net/icmp.h>
551da177e4SLinus Torvalds #include <net/xfrm.h>
561da177e4SLinus Torvalds #include <net/checksum.h>
577bc570c8SYOSHIFUJI Hideaki #include <linux/mroute6.h>
581da177e4SLinus Torvalds 
591da177e4SLinus Torvalds static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
601da177e4SLinus Torvalds 
61ef76bc23SHerbert Xu int __ip6_local_out(struct sk_buff *skb)
62ef76bc23SHerbert Xu {
63ef76bc23SHerbert Xu 	int len;
64ef76bc23SHerbert Xu 
65ef76bc23SHerbert Xu 	len = skb->len - sizeof(struct ipv6hdr);
66ef76bc23SHerbert Xu 	if (len > IPV6_MAXPLEN)
67ef76bc23SHerbert Xu 		len = 0;
68ef76bc23SHerbert Xu 	ipv6_hdr(skb)->payload_len = htons(len);
69ef76bc23SHerbert Xu 
70adf30907SEric Dumazet 	return nf_hook(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb_dst(skb)->dev,
71ef76bc23SHerbert Xu 		       dst_output);
72ef76bc23SHerbert Xu }
73ef76bc23SHerbert Xu 
74ef76bc23SHerbert Xu int ip6_local_out(struct sk_buff *skb)
75ef76bc23SHerbert Xu {
76ef76bc23SHerbert Xu 	int err;
77ef76bc23SHerbert Xu 
78ef76bc23SHerbert Xu 	err = __ip6_local_out(skb);
79ef76bc23SHerbert Xu 	if (likely(err == 1))
80ef76bc23SHerbert Xu 		err = dst_output(skb);
81ef76bc23SHerbert Xu 
82ef76bc23SHerbert Xu 	return err;
83ef76bc23SHerbert Xu }
84ef76bc23SHerbert Xu EXPORT_SYMBOL_GPL(ip6_local_out);
85ef76bc23SHerbert Xu 
86ad643a79SPatrick McHardy static int ip6_output_finish(struct sk_buff *skb)
871da177e4SLinus Torvalds {
88adf30907SEric Dumazet 	struct dst_entry *dst = skb_dst(skb);
891da177e4SLinus Torvalds 
903644f0ceSStephen Hemminger 	if (dst->hh)
913644f0ceSStephen Hemminger 		return neigh_hh_output(dst->hh, skb);
923644f0ceSStephen Hemminger 	else if (dst->neighbour)
931da177e4SLinus Torvalds 		return dst->neighbour->output(skb);
941da177e4SLinus Torvalds 
95483a47d2SDenis V. Lunev 	IP6_INC_STATS_BH(dev_net(dst->dev),
96483a47d2SDenis V. Lunev 			 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
971da177e4SLinus Torvalds 	kfree_skb(skb);
981da177e4SLinus Torvalds 	return -EINVAL;
991da177e4SLinus Torvalds 
1001da177e4SLinus Torvalds }
1011da177e4SLinus Torvalds 
1021da177e4SLinus Torvalds /* dev_loopback_xmit for use with netfilter. */
1031da177e4SLinus Torvalds static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
1041da177e4SLinus Torvalds {
105459a98edSArnaldo Carvalho de Melo 	skb_reset_mac_header(newskb);
106bbe735e4SArnaldo Carvalho de Melo 	__skb_pull(newskb, skb_network_offset(newskb));
1071da177e4SLinus Torvalds 	newskb->pkt_type = PACKET_LOOPBACK;
1081da177e4SLinus Torvalds 	newskb->ip_summed = CHECKSUM_UNNECESSARY;
109adf30907SEric Dumazet 	WARN_ON(!skb_dst(newskb));
1101da177e4SLinus Torvalds 
111*e30b38c2SEric Dumazet 	netif_rx_ni(newskb);
1121da177e4SLinus Torvalds 	return 0;
1131da177e4SLinus Torvalds }
1141da177e4SLinus Torvalds 
1151da177e4SLinus Torvalds 
1161da177e4SLinus Torvalds static int ip6_output2(struct sk_buff *skb)
1171da177e4SLinus Torvalds {
118adf30907SEric Dumazet 	struct dst_entry *dst = skb_dst(skb);
1191da177e4SLinus Torvalds 	struct net_device *dev = dst->dev;
1201da177e4SLinus Torvalds 
1211da177e4SLinus Torvalds 	skb->protocol = htons(ETH_P_IPV6);
1221da177e4SLinus Torvalds 	skb->dev = dev;
1231da177e4SLinus Torvalds 
1240660e03fSArnaldo Carvalho de Melo 	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
125adf30907SEric Dumazet 		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1261da177e4SLinus Torvalds 
1277ad6848cSOctavian Purdila 		if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
128bd91b8bfSBenjamin Thery 		    ((mroute6_socket(dev_net(dev)) &&
129bd91b8bfSBenjamin Thery 		     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
1300660e03fSArnaldo Carvalho de Melo 		     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
1317bc570c8SYOSHIFUJI Hideaki 					 &ipv6_hdr(skb)->saddr))) {
1321da177e4SLinus Torvalds 			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
1331da177e4SLinus Torvalds 
1341da177e4SLinus Torvalds 			/* Do not check for IFF_ALLMULTI; multicast routing
1351da177e4SLinus Torvalds 			   is not supported in any case.
1361da177e4SLinus Torvalds 			 */
1371da177e4SLinus Torvalds 			if (newskb)
1386e23ae2aSPatrick McHardy 				NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, newskb,
1396e23ae2aSPatrick McHardy 					NULL, newskb->dev,
1401da177e4SLinus Torvalds 					ip6_dev_loopback_xmit);
1411da177e4SLinus Torvalds 
1420660e03fSArnaldo Carvalho de Melo 			if (ipv6_hdr(skb)->hop_limit == 0) {
1433bd653c8SDenis V. Lunev 				IP6_INC_STATS(dev_net(dev), idev,
1443bd653c8SDenis V. Lunev 					      IPSTATS_MIB_OUTDISCARDS);
1451da177e4SLinus Torvalds 				kfree_skb(skb);
1461da177e4SLinus Torvalds 				return 0;
1471da177e4SLinus Torvalds 			}
1481da177e4SLinus Torvalds 		}
1491da177e4SLinus Torvalds 
150edf391ffSNeil Horman 		IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
151edf391ffSNeil Horman 				skb->len);
1521da177e4SLinus Torvalds 	}
1531da177e4SLinus Torvalds 
1546e23ae2aSPatrick McHardy 	return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
1556e23ae2aSPatrick McHardy 		       ip6_output_finish);
1561da177e4SLinus Torvalds }
1571da177e4SLinus Torvalds 
158628a5c56SJohn Heffner static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
159628a5c56SJohn Heffner {
160628a5c56SJohn Heffner 	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
161628a5c56SJohn Heffner 
162628a5c56SJohn Heffner 	return (np && np->pmtudisc == IPV6_PMTUDISC_PROBE) ?
163adf30907SEric Dumazet 	       skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb));
164628a5c56SJohn Heffner }
165628a5c56SJohn Heffner 
1661da177e4SLinus Torvalds int ip6_output(struct sk_buff *skb)
1671da177e4SLinus Torvalds {
168adf30907SEric Dumazet 	struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
169778d80beSYOSHIFUJI Hideaki 	if (unlikely(idev->cnf.disable_ipv6)) {
170adf30907SEric Dumazet 		IP6_INC_STATS(dev_net(skb_dst(skb)->dev), idev,
1713bd653c8SDenis V. Lunev 			      IPSTATS_MIB_OUTDISCARDS);
172778d80beSYOSHIFUJI Hideaki 		kfree_skb(skb);
173778d80beSYOSHIFUJI Hideaki 		return 0;
174778d80beSYOSHIFUJI Hideaki 	}
175778d80beSYOSHIFUJI Hideaki 
176628a5c56SJohn Heffner 	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
177adf30907SEric Dumazet 				dst_allfrag(skb_dst(skb)))
1781da177e4SLinus Torvalds 		return ip6_fragment(skb, ip6_output2);
1791da177e4SLinus Torvalds 	else
1801da177e4SLinus Torvalds 		return ip6_output2(skb);
1811da177e4SLinus Torvalds }
1821da177e4SLinus Torvalds 
1831da177e4SLinus Torvalds /*
1841da177e4SLinus Torvalds  *	xmit an sk_buff (used by TCP)
1851da177e4SLinus Torvalds  */
1861da177e4SLinus Torvalds 
1871da177e4SLinus Torvalds int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
1881da177e4SLinus Torvalds 	     struct ipv6_txoptions *opt, int ipfragok)
1891da177e4SLinus Torvalds {
1903bd653c8SDenis V. Lunev 	struct net *net = sock_net(sk);
191b30bd282SPatrick McHardy 	struct ipv6_pinfo *np = inet6_sk(sk);
1921da177e4SLinus Torvalds 	struct in6_addr *first_hop = &fl->fl6_dst;
193adf30907SEric Dumazet 	struct dst_entry *dst = skb_dst(skb);
1941da177e4SLinus Torvalds 	struct ipv6hdr *hdr;
1951da177e4SLinus Torvalds 	u8  proto = fl->proto;
1961da177e4SLinus Torvalds 	int seg_len = skb->len;
197e651f03aSGerrit Renker 	int hlimit = -1;
198e651f03aSGerrit Renker 	int tclass = 0;
1991da177e4SLinus Torvalds 	u32 mtu;
2001da177e4SLinus Torvalds 
2011da177e4SLinus Torvalds 	if (opt) {
202c2636b4dSChuck Lever 		unsigned int head_room;
2031da177e4SLinus Torvalds 
2041da177e4SLinus Torvalds 		/* First: exthdrs may take lots of space (~8K for now)
2051da177e4SLinus Torvalds 		   MAX_HEADER is not enough.
2061da177e4SLinus Torvalds 		 */
2071da177e4SLinus Torvalds 		head_room = opt->opt_nflen + opt->opt_flen;
2081da177e4SLinus Torvalds 		seg_len += head_room;
2091da177e4SLinus Torvalds 		head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
2101da177e4SLinus Torvalds 
2111da177e4SLinus Torvalds 		if (skb_headroom(skb) < head_room) {
2121da177e4SLinus Torvalds 			struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
213a11d206dSYOSHIFUJI Hideaki 			if (skb2 == NULL) {
214adf30907SEric Dumazet 				IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
215a11d206dSYOSHIFUJI Hideaki 					      IPSTATS_MIB_OUTDISCARDS);
2161da177e4SLinus Torvalds 				kfree_skb(skb);
2171da177e4SLinus Torvalds 				return -ENOBUFS;
2181da177e4SLinus Torvalds 			}
219a11d206dSYOSHIFUJI Hideaki 			kfree_skb(skb);
220a11d206dSYOSHIFUJI Hideaki 			skb = skb2;
2211da177e4SLinus Torvalds 			if (sk)
2221da177e4SLinus Torvalds 				skb_set_owner_w(skb, sk);
2231da177e4SLinus Torvalds 		}
2241da177e4SLinus Torvalds 		if (opt->opt_flen)
2251da177e4SLinus Torvalds 			ipv6_push_frag_opts(skb, opt, &proto);
2261da177e4SLinus Torvalds 		if (opt->opt_nflen)
2271da177e4SLinus Torvalds 			ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
2281da177e4SLinus Torvalds 	}
2291da177e4SLinus Torvalds 
230e2d1bca7SArnaldo Carvalho de Melo 	skb_push(skb, sizeof(struct ipv6hdr));
231e2d1bca7SArnaldo Carvalho de Melo 	skb_reset_network_header(skb);
2320660e03fSArnaldo Carvalho de Melo 	hdr = ipv6_hdr(skb);
2331da177e4SLinus Torvalds 
23477e2f14fSWei Yongjun 	/* Allow local fragmentation. */
23577e2f14fSWei Yongjun 	if (ipfragok)
23677e2f14fSWei Yongjun 		skb->local_df = 1;
23777e2f14fSWei Yongjun 
2381da177e4SLinus Torvalds 	/*
2391da177e4SLinus Torvalds 	 *	Fill in the IPv6 header
2401da177e4SLinus Torvalds 	 */
241e651f03aSGerrit Renker 	if (np) {
242e651f03aSGerrit Renker 		tclass = np->tclass;
2431da177e4SLinus Torvalds 		hlimit = np->hop_limit;
244e651f03aSGerrit Renker 	}
2451da177e4SLinus Torvalds 	if (hlimit < 0)
2466b75d090SYOSHIFUJI Hideaki 		hlimit = ip6_dst_hoplimit(dst);
2471da177e4SLinus Torvalds 
24890bcaf7bSAl Viro 	*(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
24941a1f8eaSYOSHIFUJI Hideaki 
2501da177e4SLinus Torvalds 	hdr->payload_len = htons(seg_len);
2511da177e4SLinus Torvalds 	hdr->nexthdr = proto;
2521da177e4SLinus Torvalds 	hdr->hop_limit = hlimit;
2531da177e4SLinus Torvalds 
2541da177e4SLinus Torvalds 	ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
2551da177e4SLinus Torvalds 	ipv6_addr_copy(&hdr->daddr, first_hop);
2561da177e4SLinus Torvalds 
257a2c2064fSPatrick McHardy 	skb->priority = sk->sk_priority;
2584a19ec58SLaszlo Attila Toth 	skb->mark = sk->sk_mark;
259a2c2064fSPatrick McHardy 
2601da177e4SLinus Torvalds 	mtu = dst_mtu(dst);
261283d07acSWei Yongjun 	if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
262adf30907SEric Dumazet 		IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
263edf391ffSNeil Horman 			      IPSTATS_MIB_OUT, skb->len);
2646e23ae2aSPatrick McHardy 		return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
2656869c4d8SHarald Welte 				dst_output);
2661da177e4SLinus Torvalds 	}
2671da177e4SLinus Torvalds 
2681da177e4SLinus Torvalds 	if (net_ratelimit())
2691da177e4SLinus Torvalds 		printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
2701da177e4SLinus Torvalds 	skb->dev = dst->dev;
2713ffe533cSAlexey Dobriyan 	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
272adf30907SEric Dumazet 	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
2731da177e4SLinus Torvalds 	kfree_skb(skb);
2741da177e4SLinus Torvalds 	return -EMSGSIZE;
2751da177e4SLinus Torvalds }
2761da177e4SLinus Torvalds 
2777159039aSYOSHIFUJI Hideaki EXPORT_SYMBOL(ip6_xmit);
2787159039aSYOSHIFUJI Hideaki 
2791da177e4SLinus Torvalds /*
2801da177e4SLinus Torvalds  *	To avoid extra problems ND packets are send through this
2811da177e4SLinus Torvalds  *	routine. It's code duplication but I really want to avoid
2821da177e4SLinus Torvalds  *	extra checks since ipv6_build_header is used by TCP (which
2831da177e4SLinus Torvalds  *	is for us performance critical)
2841da177e4SLinus Torvalds  */
2851da177e4SLinus Torvalds 
2861da177e4SLinus Torvalds int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
2879acd9f3aSYOSHIFUJI Hideaki 	       const struct in6_addr *saddr, const struct in6_addr *daddr,
2881da177e4SLinus Torvalds 	       int proto, int len)
2891da177e4SLinus Torvalds {
2901da177e4SLinus Torvalds 	struct ipv6_pinfo *np = inet6_sk(sk);
2911da177e4SLinus Torvalds 	struct ipv6hdr *hdr;
2921da177e4SLinus Torvalds 	int totlen;
2931da177e4SLinus Torvalds 
2941da177e4SLinus Torvalds 	skb->protocol = htons(ETH_P_IPV6);
2951da177e4SLinus Torvalds 	skb->dev = dev;
2961da177e4SLinus Torvalds 
2971da177e4SLinus Torvalds 	totlen = len + sizeof(struct ipv6hdr);
2981da177e4SLinus Torvalds 
29955f79cc0SArnaldo Carvalho de Melo 	skb_reset_network_header(skb);
30055f79cc0SArnaldo Carvalho de Melo 	skb_put(skb, sizeof(struct ipv6hdr));
3010660e03fSArnaldo Carvalho de Melo 	hdr = ipv6_hdr(skb);
3021da177e4SLinus Torvalds 
303ae08e1f0SAl Viro 	*(__be32*)hdr = htonl(0x60000000);
3041da177e4SLinus Torvalds 
3051da177e4SLinus Torvalds 	hdr->payload_len = htons(len);
3061da177e4SLinus Torvalds 	hdr->nexthdr = proto;
3071da177e4SLinus Torvalds 	hdr->hop_limit = np->hop_limit;
3081da177e4SLinus Torvalds 
3091da177e4SLinus Torvalds 	ipv6_addr_copy(&hdr->saddr, saddr);
3101da177e4SLinus Torvalds 	ipv6_addr_copy(&hdr->daddr, daddr);
3111da177e4SLinus Torvalds 
3121da177e4SLinus Torvalds 	return 0;
3131da177e4SLinus Torvalds }
3141da177e4SLinus Torvalds 
3151da177e4SLinus Torvalds static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
3161da177e4SLinus Torvalds {
3171da177e4SLinus Torvalds 	struct ip6_ra_chain *ra;
3181da177e4SLinus Torvalds 	struct sock *last = NULL;
3191da177e4SLinus Torvalds 
3201da177e4SLinus Torvalds 	read_lock(&ip6_ra_lock);
3211da177e4SLinus Torvalds 	for (ra = ip6_ra_chain; ra; ra = ra->next) {
3221da177e4SLinus Torvalds 		struct sock *sk = ra->sk;
3230bd1b59bSAndrew McDonald 		if (sk && ra->sel == sel &&
3240bd1b59bSAndrew McDonald 		    (!sk->sk_bound_dev_if ||
3250bd1b59bSAndrew McDonald 		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
3261da177e4SLinus Torvalds 			if (last) {
3271da177e4SLinus Torvalds 				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
3281da177e4SLinus Torvalds 				if (skb2)
3291da177e4SLinus Torvalds 					rawv6_rcv(last, skb2);
3301da177e4SLinus Torvalds 			}
3311da177e4SLinus Torvalds 			last = sk;
3321da177e4SLinus Torvalds 		}
3331da177e4SLinus Torvalds 	}
3341da177e4SLinus Torvalds 
3351da177e4SLinus Torvalds 	if (last) {
3361da177e4SLinus Torvalds 		rawv6_rcv(last, skb);
3371da177e4SLinus Torvalds 		read_unlock(&ip6_ra_lock);
3381da177e4SLinus Torvalds 		return 1;
3391da177e4SLinus Torvalds 	}
3401da177e4SLinus Torvalds 	read_unlock(&ip6_ra_lock);
3411da177e4SLinus Torvalds 	return 0;
3421da177e4SLinus Torvalds }
3431da177e4SLinus Torvalds 
344e21e0b5fSVille Nuorvala static int ip6_forward_proxy_check(struct sk_buff *skb)
345e21e0b5fSVille Nuorvala {
3460660e03fSArnaldo Carvalho de Melo 	struct ipv6hdr *hdr = ipv6_hdr(skb);
347e21e0b5fSVille Nuorvala 	u8 nexthdr = hdr->nexthdr;
348e21e0b5fSVille Nuorvala 	int offset;
349e21e0b5fSVille Nuorvala 
350e21e0b5fSVille Nuorvala 	if (ipv6_ext_hdr(nexthdr)) {
351e21e0b5fSVille Nuorvala 		offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
352e21e0b5fSVille Nuorvala 		if (offset < 0)
353e21e0b5fSVille Nuorvala 			return 0;
354e21e0b5fSVille Nuorvala 	} else
355e21e0b5fSVille Nuorvala 		offset = sizeof(struct ipv6hdr);
356e21e0b5fSVille Nuorvala 
357e21e0b5fSVille Nuorvala 	if (nexthdr == IPPROTO_ICMPV6) {
358e21e0b5fSVille Nuorvala 		struct icmp6hdr *icmp6;
359e21e0b5fSVille Nuorvala 
360d56f90a7SArnaldo Carvalho de Melo 		if (!pskb_may_pull(skb, (skb_network_header(skb) +
361d56f90a7SArnaldo Carvalho de Melo 					 offset + 1 - skb->data)))
362e21e0b5fSVille Nuorvala 			return 0;
363e21e0b5fSVille Nuorvala 
364d56f90a7SArnaldo Carvalho de Melo 		icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
365e21e0b5fSVille Nuorvala 
366e21e0b5fSVille Nuorvala 		switch (icmp6->icmp6_type) {
367e21e0b5fSVille Nuorvala 		case NDISC_ROUTER_SOLICITATION:
368e21e0b5fSVille Nuorvala 		case NDISC_ROUTER_ADVERTISEMENT:
369e21e0b5fSVille Nuorvala 		case NDISC_NEIGHBOUR_SOLICITATION:
370e21e0b5fSVille Nuorvala 		case NDISC_NEIGHBOUR_ADVERTISEMENT:
371e21e0b5fSVille Nuorvala 		case NDISC_REDIRECT:
372e21e0b5fSVille Nuorvala 			/* For reaction involving unicast neighbor discovery
373e21e0b5fSVille Nuorvala 			 * message destined to the proxied address, pass it to
374e21e0b5fSVille Nuorvala 			 * input function.
375e21e0b5fSVille Nuorvala 			 */
376e21e0b5fSVille Nuorvala 			return 1;
377e21e0b5fSVille Nuorvala 		default:
378e21e0b5fSVille Nuorvala 			break;
379e21e0b5fSVille Nuorvala 		}
380e21e0b5fSVille Nuorvala 	}
381e21e0b5fSVille Nuorvala 
38274553b09SVille Nuorvala 	/*
38374553b09SVille Nuorvala 	 * The proxying router can't forward traffic sent to a link-local
38474553b09SVille Nuorvala 	 * address, so signal the sender and discard the packet. This
38574553b09SVille Nuorvala 	 * behavior is clarified by the MIPv6 specification.
38674553b09SVille Nuorvala 	 */
38774553b09SVille Nuorvala 	if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
38874553b09SVille Nuorvala 		dst_link_failure(skb);
38974553b09SVille Nuorvala 		return -1;
39074553b09SVille Nuorvala 	}
39174553b09SVille Nuorvala 
392e21e0b5fSVille Nuorvala 	return 0;
393e21e0b5fSVille Nuorvala }
394e21e0b5fSVille Nuorvala 
3951da177e4SLinus Torvalds static inline int ip6_forward_finish(struct sk_buff *skb)
3961da177e4SLinus Torvalds {
3971da177e4SLinus Torvalds 	return dst_output(skb);
3981da177e4SLinus Torvalds }
3991da177e4SLinus Torvalds 
4001da177e4SLinus Torvalds int ip6_forward(struct sk_buff *skb)
4011da177e4SLinus Torvalds {
402adf30907SEric Dumazet 	struct dst_entry *dst = skb_dst(skb);
4030660e03fSArnaldo Carvalho de Melo 	struct ipv6hdr *hdr = ipv6_hdr(skb);
4041da177e4SLinus Torvalds 	struct inet6_skb_parm *opt = IP6CB(skb);
405c346dca1SYOSHIFUJI Hideaki 	struct net *net = dev_net(dst->dev);
40614f3ad6fSUlrich Weber 	u32 mtu;
4071da177e4SLinus Torvalds 
40853b7997fSYOSHIFUJI Hideaki 	if (net->ipv6.devconf_all->forwarding == 0)
4091da177e4SLinus Torvalds 		goto error;
4101da177e4SLinus Torvalds 
4114497b076SBen Hutchings 	if (skb_warn_if_lro(skb))
4124497b076SBen Hutchings 		goto drop;
4134497b076SBen Hutchings 
4141da177e4SLinus Torvalds 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
4153bd653c8SDenis V. Lunev 		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
4161da177e4SLinus Torvalds 		goto drop;
4171da177e4SLinus Torvalds 	}
4181da177e4SLinus Torvalds 
41935fc92a9SHerbert Xu 	skb_forward_csum(skb);
4201da177e4SLinus Torvalds 
4211da177e4SLinus Torvalds 	/*
4221da177e4SLinus Torvalds 	 *	We DO NOT make any processing on
4231da177e4SLinus Torvalds 	 *	RA packets, pushing them to user level AS IS
4241da177e4SLinus Torvalds 	 *	without ane WARRANTY that application will be able
4251da177e4SLinus Torvalds 	 *	to interpret them. The reason is that we
4261da177e4SLinus Torvalds 	 *	cannot make anything clever here.
4271da177e4SLinus Torvalds 	 *
4281da177e4SLinus Torvalds 	 *	We are not end-node, so that if packet contains
4291da177e4SLinus Torvalds 	 *	AH/ESP, we cannot make anything.
4301da177e4SLinus Torvalds 	 *	Defragmentation also would be mistake, RA packets
4311da177e4SLinus Torvalds 	 *	cannot be fragmented, because there is no warranty
4321da177e4SLinus Torvalds 	 *	that different fragments will go along one path. --ANK
4331da177e4SLinus Torvalds 	 */
4341da177e4SLinus Torvalds 	if (opt->ra) {
435d56f90a7SArnaldo Carvalho de Melo 		u8 *ptr = skb_network_header(skb) + opt->ra;
4361da177e4SLinus Torvalds 		if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
4371da177e4SLinus Torvalds 			return 0;
4381da177e4SLinus Torvalds 	}
4391da177e4SLinus Torvalds 
4401da177e4SLinus Torvalds 	/*
4411da177e4SLinus Torvalds 	 *	check and decrement ttl
4421da177e4SLinus Torvalds 	 */
4431da177e4SLinus Torvalds 	if (hdr->hop_limit <= 1) {
4441da177e4SLinus Torvalds 		/* Force OUTPUT device used as source address */
4451da177e4SLinus Torvalds 		skb->dev = dst->dev;
4463ffe533cSAlexey Dobriyan 		icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
447483a47d2SDenis V. Lunev 		IP6_INC_STATS_BH(net,
448483a47d2SDenis V. Lunev 				 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
4491da177e4SLinus Torvalds 
4501da177e4SLinus Torvalds 		kfree_skb(skb);
4511da177e4SLinus Torvalds 		return -ETIMEDOUT;
4521da177e4SLinus Torvalds 	}
4531da177e4SLinus Torvalds 
454fbea49e1SYOSHIFUJI Hideaki 	/* XXX: idev->cnf.proxy_ndp? */
45553b7997fSYOSHIFUJI Hideaki 	if (net->ipv6.devconf_all->proxy_ndp &&
4568a3edd80SDaniel Lezcano 	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
45774553b09SVille Nuorvala 		int proxied = ip6_forward_proxy_check(skb);
45874553b09SVille Nuorvala 		if (proxied > 0)
459e21e0b5fSVille Nuorvala 			return ip6_input(skb);
46074553b09SVille Nuorvala 		else if (proxied < 0) {
4613bd653c8SDenis V. Lunev 			IP6_INC_STATS(net, ip6_dst_idev(dst),
4623bd653c8SDenis V. Lunev 				      IPSTATS_MIB_INDISCARDS);
46374553b09SVille Nuorvala 			goto drop;
46474553b09SVille Nuorvala 		}
465e21e0b5fSVille Nuorvala 	}
466e21e0b5fSVille Nuorvala 
4671da177e4SLinus Torvalds 	if (!xfrm6_route_forward(skb)) {
4683bd653c8SDenis V. Lunev 		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
4691da177e4SLinus Torvalds 		goto drop;
4701da177e4SLinus Torvalds 	}
471adf30907SEric Dumazet 	dst = skb_dst(skb);
4721da177e4SLinus Torvalds 
4731da177e4SLinus Torvalds 	/* IPv6 specs say nothing about it, but it is clear that we cannot
4741da177e4SLinus Torvalds 	   send redirects to source routed frames.
4751e5dc146SMasahide NAKAMURA 	   We don't send redirects to frames decapsulated from IPsec.
4761da177e4SLinus Torvalds 	 */
4771e5dc146SMasahide NAKAMURA 	if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
478def8b4faSAlexey Dobriyan 	    !skb_sec_path(skb)) {
4791da177e4SLinus Torvalds 		struct in6_addr *target = NULL;
4801da177e4SLinus Torvalds 		struct rt6_info *rt;
4811da177e4SLinus Torvalds 		struct neighbour *n = dst->neighbour;
4821da177e4SLinus Torvalds 
4831da177e4SLinus Torvalds 		/*
4841da177e4SLinus Torvalds 		 *	incoming and outgoing devices are the same
4851da177e4SLinus Torvalds 		 *	send a redirect.
4861da177e4SLinus Torvalds 		 */
4871da177e4SLinus Torvalds 
4881da177e4SLinus Torvalds 		rt = (struct rt6_info *) dst;
4891da177e4SLinus Torvalds 		if ((rt->rt6i_flags & RTF_GATEWAY))
4901da177e4SLinus Torvalds 			target = (struct in6_addr*)&n->primary_key;
4911da177e4SLinus Torvalds 		else
4921da177e4SLinus Torvalds 			target = &hdr->daddr;
4931da177e4SLinus Torvalds 
4941da177e4SLinus Torvalds 		/* Limit redirects both by destination (here)
4951da177e4SLinus Torvalds 		   and by source (inside ndisc_send_redirect)
4961da177e4SLinus Torvalds 		 */
4971da177e4SLinus Torvalds 		if (xrlim_allow(dst, 1*HZ))
4981da177e4SLinus Torvalds 			ndisc_send_redirect(skb, n, target);
4995bb1ab09SDavid L Stevens 	} else {
5005bb1ab09SDavid L Stevens 		int addrtype = ipv6_addr_type(&hdr->saddr);
5015bb1ab09SDavid L Stevens 
5021da177e4SLinus Torvalds 		/* This check is security critical. */
503f81b2e7dSYOSHIFUJI Hideaki 		if (addrtype == IPV6_ADDR_ANY ||
504f81b2e7dSYOSHIFUJI Hideaki 		    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
5051da177e4SLinus Torvalds 			goto error;
5065bb1ab09SDavid L Stevens 		if (addrtype & IPV6_ADDR_LINKLOCAL) {
5075bb1ab09SDavid L Stevens 			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
5083ffe533cSAlexey Dobriyan 				    ICMPV6_NOT_NEIGHBOUR, 0);
5095bb1ab09SDavid L Stevens 			goto error;
5105bb1ab09SDavid L Stevens 		}
5111da177e4SLinus Torvalds 	}
5121da177e4SLinus Torvalds 
51314f3ad6fSUlrich Weber 	mtu = dst_mtu(dst);
51414f3ad6fSUlrich Weber 	if (mtu < IPV6_MIN_MTU)
51514f3ad6fSUlrich Weber 		mtu = IPV6_MIN_MTU;
51614f3ad6fSUlrich Weber 
51714f3ad6fSUlrich Weber 	if (skb->len > mtu) {
5181da177e4SLinus Torvalds 		/* Again, force OUTPUT device used as source address */
5191da177e4SLinus Torvalds 		skb->dev = dst->dev;
52014f3ad6fSUlrich Weber 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
521483a47d2SDenis V. Lunev 		IP6_INC_STATS_BH(net,
522483a47d2SDenis V. Lunev 				 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
523483a47d2SDenis V. Lunev 		IP6_INC_STATS_BH(net,
524483a47d2SDenis V. Lunev 				 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
5251da177e4SLinus Torvalds 		kfree_skb(skb);
5261da177e4SLinus Torvalds 		return -EMSGSIZE;
5271da177e4SLinus Torvalds 	}
5281da177e4SLinus Torvalds 
5291da177e4SLinus Torvalds 	if (skb_cow(skb, dst->dev->hard_header_len)) {
5303bd653c8SDenis V. Lunev 		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
5311da177e4SLinus Torvalds 		goto drop;
5321da177e4SLinus Torvalds 	}
5331da177e4SLinus Torvalds 
5340660e03fSArnaldo Carvalho de Melo 	hdr = ipv6_hdr(skb);
5351da177e4SLinus Torvalds 
5361da177e4SLinus Torvalds 	/* Mangling hops number delayed to point after skb COW */
5371da177e4SLinus Torvalds 
5381da177e4SLinus Torvalds 	hdr->hop_limit--;
5391da177e4SLinus Torvalds 
540483a47d2SDenis V. Lunev 	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
5416e23ae2aSPatrick McHardy 	return NF_HOOK(PF_INET6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
5426e23ae2aSPatrick McHardy 		       ip6_forward_finish);
5431da177e4SLinus Torvalds 
5441da177e4SLinus Torvalds error:
545483a47d2SDenis V. Lunev 	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
5461da177e4SLinus Torvalds drop:
5471da177e4SLinus Torvalds 	kfree_skb(skb);
5481da177e4SLinus Torvalds 	return -EINVAL;
5491da177e4SLinus Torvalds }
5501da177e4SLinus Torvalds 
5511da177e4SLinus Torvalds static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
5521da177e4SLinus Torvalds {
5531da177e4SLinus Torvalds 	to->pkt_type = from->pkt_type;
5541da177e4SLinus Torvalds 	to->priority = from->priority;
5551da177e4SLinus Torvalds 	to->protocol = from->protocol;
556adf30907SEric Dumazet 	skb_dst_drop(to);
557adf30907SEric Dumazet 	skb_dst_set(to, dst_clone(skb_dst(from)));
5581da177e4SLinus Torvalds 	to->dev = from->dev;
55982e91ffeSThomas Graf 	to->mark = from->mark;
5601da177e4SLinus Torvalds 
5611da177e4SLinus Torvalds #ifdef CONFIG_NET_SCHED
5621da177e4SLinus Torvalds 	to->tc_index = from->tc_index;
5631da177e4SLinus Torvalds #endif
564e7ac05f3SYasuyuki Kozakai 	nf_copy(to, from);
565ba9dda3aSJozsef Kadlecsik #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
566ba9dda3aSJozsef Kadlecsik     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
567ba9dda3aSJozsef Kadlecsik 	to->nf_trace = from->nf_trace;
568ba9dda3aSJozsef Kadlecsik #endif
569984bc16cSJames Morris 	skb_copy_secmark(to, from);
5701da177e4SLinus Torvalds }
5711da177e4SLinus Torvalds 
5721da177e4SLinus Torvalds int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
5731da177e4SLinus Torvalds {
5741da177e4SLinus Torvalds 	u16 offset = sizeof(struct ipv6hdr);
5750660e03fSArnaldo Carvalho de Melo 	struct ipv6_opt_hdr *exthdr =
5760660e03fSArnaldo Carvalho de Melo 				(struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
57727a884dcSArnaldo Carvalho de Melo 	unsigned int packet_len = skb->tail - skb->network_header;
5781da177e4SLinus Torvalds 	int found_rhdr = 0;
5790660e03fSArnaldo Carvalho de Melo 	*nexthdr = &ipv6_hdr(skb)->nexthdr;
5801da177e4SLinus Torvalds 
5811da177e4SLinus Torvalds 	while (offset + 1 <= packet_len) {
5821da177e4SLinus Torvalds 
5831da177e4SLinus Torvalds 		switch (**nexthdr) {
5841da177e4SLinus Torvalds 
5851da177e4SLinus Torvalds 		case NEXTHDR_HOP:
58627637df9SMasahide NAKAMURA 			break;
5871da177e4SLinus Torvalds 		case NEXTHDR_ROUTING:
58827637df9SMasahide NAKAMURA 			found_rhdr = 1;
58927637df9SMasahide NAKAMURA 			break;
5901da177e4SLinus Torvalds 		case NEXTHDR_DEST:
59159fbb3a6SMasahide NAKAMURA #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
59227637df9SMasahide NAKAMURA 			if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
59327637df9SMasahide NAKAMURA 				break;
59427637df9SMasahide NAKAMURA #endif
59527637df9SMasahide NAKAMURA 			if (found_rhdr)
59627637df9SMasahide NAKAMURA 				return offset;
5971da177e4SLinus Torvalds 			break;
5981da177e4SLinus Torvalds 		default :
5991da177e4SLinus Torvalds 			return offset;
6001da177e4SLinus Torvalds 		}
60127637df9SMasahide NAKAMURA 
60227637df9SMasahide NAKAMURA 		offset += ipv6_optlen(exthdr);
60327637df9SMasahide NAKAMURA 		*nexthdr = &exthdr->nexthdr;
604d56f90a7SArnaldo Carvalho de Melo 		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
605d56f90a7SArnaldo Carvalho de Melo 						 offset);
6061da177e4SLinus Torvalds 	}
6071da177e4SLinus Torvalds 
6081da177e4SLinus Torvalds 	return offset;
6091da177e4SLinus Torvalds }
6101da177e4SLinus Torvalds 
6111da177e4SLinus Torvalds static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
6121da177e4SLinus Torvalds {
6131da177e4SLinus Torvalds 	struct sk_buff *frag;
614adf30907SEric Dumazet 	struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
615d91675f9SYOSHIFUJI Hideaki 	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
6161da177e4SLinus Torvalds 	struct ipv6hdr *tmp_hdr;
6171da177e4SLinus Torvalds 	struct frag_hdr *fh;
6181da177e4SLinus Torvalds 	unsigned int mtu, hlen, left, len;
619ae08e1f0SAl Viro 	__be32 frag_id = 0;
6201da177e4SLinus Torvalds 	int ptr, offset = 0, err=0;
6211da177e4SLinus Torvalds 	u8 *prevhdr, nexthdr = 0;
622adf30907SEric Dumazet 	struct net *net = dev_net(skb_dst(skb)->dev);
6231da177e4SLinus Torvalds 
6241da177e4SLinus Torvalds 	hlen = ip6_find_1stfragopt(skb, &prevhdr);
6251da177e4SLinus Torvalds 	nexthdr = *prevhdr;
6261da177e4SLinus Torvalds 
627628a5c56SJohn Heffner 	mtu = ip6_skb_dst_mtu(skb);
628b881ef76SJohn Heffner 
629b881ef76SJohn Heffner 	/* We must not fragment if the socket is set to force MTU discovery
63014f3ad6fSUlrich Weber 	 * or if the skb it not generated by a local socket.
631b881ef76SJohn Heffner 	 */
632b5c15fc0SHerbert Xu 	if (!skb->local_df) {
633adf30907SEric Dumazet 		skb->dev = skb_dst(skb)->dev;
6343ffe533cSAlexey Dobriyan 		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
635adf30907SEric Dumazet 		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
6363bd653c8SDenis V. Lunev 			      IPSTATS_MIB_FRAGFAILS);
637b881ef76SJohn Heffner 		kfree_skb(skb);
638b881ef76SJohn Heffner 		return -EMSGSIZE;
639b881ef76SJohn Heffner 	}
640b881ef76SJohn Heffner 
641d91675f9SYOSHIFUJI Hideaki 	if (np && np->frag_size < mtu) {
642d91675f9SYOSHIFUJI Hideaki 		if (np->frag_size)
643d91675f9SYOSHIFUJI Hideaki 			mtu = np->frag_size;
644d91675f9SYOSHIFUJI Hideaki 	}
645d91675f9SYOSHIFUJI Hideaki 	mtu -= hlen + sizeof(struct frag_hdr);
6461da177e4SLinus Torvalds 
6474d9092bbSDavid S. Miller 	if (skb_has_frags(skb)) {
6481da177e4SLinus Torvalds 		int first_len = skb_pagelen(skb);
64929ffe1a5SHerbert Xu 		int truesizes = 0;
6501da177e4SLinus Torvalds 
6511da177e4SLinus Torvalds 		if (first_len - hlen > mtu ||
6521da177e4SLinus Torvalds 		    ((first_len - hlen) & 7) ||
6531da177e4SLinus Torvalds 		    skb_cloned(skb))
6541da177e4SLinus Torvalds 			goto slow_path;
6551da177e4SLinus Torvalds 
6564d9092bbSDavid S. Miller 		skb_walk_frags(skb, frag) {
6571da177e4SLinus Torvalds 			/* Correct geometry. */
6581da177e4SLinus Torvalds 			if (frag->len > mtu ||
6591da177e4SLinus Torvalds 			    ((frag->len & 7) && frag->next) ||
6601da177e4SLinus Torvalds 			    skb_headroom(frag) < hlen)
6611da177e4SLinus Torvalds 			    goto slow_path;
6621da177e4SLinus Torvalds 
6631da177e4SLinus Torvalds 			/* Partially cloned skb? */
6641da177e4SLinus Torvalds 			if (skb_shared(frag))
6651da177e4SLinus Torvalds 				goto slow_path;
6662fdba6b0SHerbert Xu 
6672fdba6b0SHerbert Xu 			BUG_ON(frag->sk);
6682fdba6b0SHerbert Xu 			if (skb->sk) {
6692fdba6b0SHerbert Xu 				frag->sk = skb->sk;
6702fdba6b0SHerbert Xu 				frag->destructor = sock_wfree;
67129ffe1a5SHerbert Xu 				truesizes += frag->truesize;
6722fdba6b0SHerbert Xu 			}
6731da177e4SLinus Torvalds 		}
6741da177e4SLinus Torvalds 
6751da177e4SLinus Torvalds 		err = 0;
6761da177e4SLinus Torvalds 		offset = 0;
6771da177e4SLinus Torvalds 		frag = skb_shinfo(skb)->frag_list;
6784d9092bbSDavid S. Miller 		skb_frag_list_init(skb);
6791da177e4SLinus Torvalds 		/* BUILD HEADER */
6801da177e4SLinus Torvalds 
6819a217a1cSYOSHIFUJI Hideaki 		*prevhdr = NEXTHDR_FRAGMENT;
682d56f90a7SArnaldo Carvalho de Melo 		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
6831da177e4SLinus Torvalds 		if (!tmp_hdr) {
684adf30907SEric Dumazet 			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
6853bd653c8SDenis V. Lunev 				      IPSTATS_MIB_FRAGFAILS);
6861da177e4SLinus Torvalds 			return -ENOMEM;
6871da177e4SLinus Torvalds 		}
6881da177e4SLinus Torvalds 
6891da177e4SLinus Torvalds 		__skb_pull(skb, hlen);
6901da177e4SLinus Torvalds 		fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
691e2d1bca7SArnaldo Carvalho de Melo 		__skb_push(skb, hlen);
692e2d1bca7SArnaldo Carvalho de Melo 		skb_reset_network_header(skb);
693d56f90a7SArnaldo Carvalho de Melo 		memcpy(skb_network_header(skb), tmp_hdr, hlen);
6941da177e4SLinus Torvalds 
6957ea2f2c5SSridhar Samudrala 		ipv6_select_ident(fh);
6961da177e4SLinus Torvalds 		fh->nexthdr = nexthdr;
6971da177e4SLinus Torvalds 		fh->reserved = 0;
6981da177e4SLinus Torvalds 		fh->frag_off = htons(IP6_MF);
6991da177e4SLinus Torvalds 		frag_id = fh->identification;
7001da177e4SLinus Torvalds 
7011da177e4SLinus Torvalds 		first_len = skb_pagelen(skb);
7021da177e4SLinus Torvalds 		skb->data_len = first_len - skb_headlen(skb);
70329ffe1a5SHerbert Xu 		skb->truesize -= truesizes;
7041da177e4SLinus Torvalds 		skb->len = first_len;
7050660e03fSArnaldo Carvalho de Melo 		ipv6_hdr(skb)->payload_len = htons(first_len -
7060660e03fSArnaldo Carvalho de Melo 						   sizeof(struct ipv6hdr));
7071da177e4SLinus Torvalds 
708a11d206dSYOSHIFUJI Hideaki 		dst_hold(&rt->u.dst);
7091da177e4SLinus Torvalds 
7101da177e4SLinus Torvalds 		for (;;) {
7111da177e4SLinus Torvalds 			/* Prepare header of the next frame,
7121da177e4SLinus Torvalds 			 * before previous one went down. */
7131da177e4SLinus Torvalds 			if (frag) {
7141da177e4SLinus Torvalds 				frag->ip_summed = CHECKSUM_NONE;
715badff6d0SArnaldo Carvalho de Melo 				skb_reset_transport_header(frag);
7161da177e4SLinus Torvalds 				fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
717e2d1bca7SArnaldo Carvalho de Melo 				__skb_push(frag, hlen);
718e2d1bca7SArnaldo Carvalho de Melo 				skb_reset_network_header(frag);
719d56f90a7SArnaldo Carvalho de Melo 				memcpy(skb_network_header(frag), tmp_hdr,
720d56f90a7SArnaldo Carvalho de Melo 				       hlen);
7211da177e4SLinus Torvalds 				offset += skb->len - hlen - sizeof(struct frag_hdr);
7221da177e4SLinus Torvalds 				fh->nexthdr = nexthdr;
7231da177e4SLinus Torvalds 				fh->reserved = 0;
7241da177e4SLinus Torvalds 				fh->frag_off = htons(offset);
7251da177e4SLinus Torvalds 				if (frag->next != NULL)
7261da177e4SLinus Torvalds 					fh->frag_off |= htons(IP6_MF);
7271da177e4SLinus Torvalds 				fh->identification = frag_id;
7280660e03fSArnaldo Carvalho de Melo 				ipv6_hdr(frag)->payload_len =
7290660e03fSArnaldo Carvalho de Melo 						htons(frag->len -
7300660e03fSArnaldo Carvalho de Melo 						      sizeof(struct ipv6hdr));
7311da177e4SLinus Torvalds 				ip6_copy_metadata(frag, skb);
7321da177e4SLinus Torvalds 			}
7331da177e4SLinus Torvalds 
7341da177e4SLinus Torvalds 			err = output(skb);
735dafee490SWei Dong 			if(!err)
7363bd653c8SDenis V. Lunev 				IP6_INC_STATS(net, ip6_dst_idev(&rt->u.dst),
7373bd653c8SDenis V. Lunev 					      IPSTATS_MIB_FRAGCREATES);
738dafee490SWei Dong 
7391da177e4SLinus Torvalds 			if (err || !frag)
7401da177e4SLinus Torvalds 				break;
7411da177e4SLinus Torvalds 
7421da177e4SLinus Torvalds 			skb = frag;
7431da177e4SLinus Torvalds 			frag = skb->next;
7441da177e4SLinus Torvalds 			skb->next = NULL;
7451da177e4SLinus Torvalds 		}
7461da177e4SLinus Torvalds 
7471da177e4SLinus Torvalds 		kfree(tmp_hdr);
7481da177e4SLinus Torvalds 
7491da177e4SLinus Torvalds 		if (err == 0) {
7503bd653c8SDenis V. Lunev 			IP6_INC_STATS(net, ip6_dst_idev(&rt->u.dst),
7513bd653c8SDenis V. Lunev 				      IPSTATS_MIB_FRAGOKS);
752a11d206dSYOSHIFUJI Hideaki 			dst_release(&rt->u.dst);
7531da177e4SLinus Torvalds 			return 0;
7541da177e4SLinus Torvalds 		}
7551da177e4SLinus Torvalds 
7561da177e4SLinus Torvalds 		while (frag) {
7571da177e4SLinus Torvalds 			skb = frag->next;
7581da177e4SLinus Torvalds 			kfree_skb(frag);
7591da177e4SLinus Torvalds 			frag = skb;
7601da177e4SLinus Torvalds 		}
7611da177e4SLinus Torvalds 
7623bd653c8SDenis V. Lunev 		IP6_INC_STATS(net, ip6_dst_idev(&rt->u.dst),
7633bd653c8SDenis V. Lunev 			      IPSTATS_MIB_FRAGFAILS);
764a11d206dSYOSHIFUJI Hideaki 		dst_release(&rt->u.dst);
7651da177e4SLinus Torvalds 		return err;
7661da177e4SLinus Torvalds 	}
7671da177e4SLinus Torvalds 
7681da177e4SLinus Torvalds slow_path:
7691da177e4SLinus Torvalds 	left = skb->len - hlen;		/* Space per frame */
7701da177e4SLinus Torvalds 	ptr = hlen;			/* Where to start from */
7711da177e4SLinus Torvalds 
7721da177e4SLinus Torvalds 	/*
7731da177e4SLinus Torvalds 	 *	Fragment the datagram.
7741da177e4SLinus Torvalds 	 */
7751da177e4SLinus Torvalds 
7761da177e4SLinus Torvalds 	*prevhdr = NEXTHDR_FRAGMENT;
7771da177e4SLinus Torvalds 
7781da177e4SLinus Torvalds 	/*
7791da177e4SLinus Torvalds 	 *	Keep copying data until we run out.
7801da177e4SLinus Torvalds 	 */
7811da177e4SLinus Torvalds 	while(left > 0)	{
7821da177e4SLinus Torvalds 		len = left;
7831da177e4SLinus Torvalds 		/* IF: it doesn't fit, use 'mtu' - the data space left */
7841da177e4SLinus Torvalds 		if (len > mtu)
7851da177e4SLinus Torvalds 			len = mtu;
7861da177e4SLinus Torvalds 		/* IF: we are not sending upto and including the packet end
7871da177e4SLinus Torvalds 		   then align the next start on an eight byte boundary */
7881da177e4SLinus Torvalds 		if (len < left)	{
7891da177e4SLinus Torvalds 			len &= ~7;
7901da177e4SLinus Torvalds 		}
7911da177e4SLinus Torvalds 		/*
7921da177e4SLinus Torvalds 		 *	Allocate buffer.
7931da177e4SLinus Torvalds 		 */
7941da177e4SLinus Torvalds 
795f5184d26SJohannes Berg 		if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_ALLOCATED_SPACE(rt->u.dst.dev), GFP_ATOMIC)) == NULL) {
79664ce2073SPatrick McHardy 			NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
797adf30907SEric Dumazet 			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
798a11d206dSYOSHIFUJI Hideaki 				      IPSTATS_MIB_FRAGFAILS);
7991da177e4SLinus Torvalds 			err = -ENOMEM;
8001da177e4SLinus Torvalds 			goto fail;
8011da177e4SLinus Torvalds 		}
8021da177e4SLinus Torvalds 
8031da177e4SLinus Torvalds 		/*
8041da177e4SLinus Torvalds 		 *	Set up data on packet
8051da177e4SLinus Torvalds 		 */
8061da177e4SLinus Torvalds 
8071da177e4SLinus Torvalds 		ip6_copy_metadata(frag, skb);
8081da177e4SLinus Torvalds 		skb_reserve(frag, LL_RESERVED_SPACE(rt->u.dst.dev));
8091da177e4SLinus Torvalds 		skb_put(frag, len + hlen + sizeof(struct frag_hdr));
810c1d2bbe1SArnaldo Carvalho de Melo 		skb_reset_network_header(frag);
811badff6d0SArnaldo Carvalho de Melo 		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
812b0e380b1SArnaldo Carvalho de Melo 		frag->transport_header = (frag->network_header + hlen +
813b0e380b1SArnaldo Carvalho de Melo 					  sizeof(struct frag_hdr));
8141da177e4SLinus Torvalds 
8151da177e4SLinus Torvalds 		/*
8161da177e4SLinus Torvalds 		 *	Charge the memory for the fragment to any owner
8171da177e4SLinus Torvalds 		 *	it might possess
8181da177e4SLinus Torvalds 		 */
8191da177e4SLinus Torvalds 		if (skb->sk)
8201da177e4SLinus Torvalds 			skb_set_owner_w(frag, skb->sk);
8211da177e4SLinus Torvalds 
8221da177e4SLinus Torvalds 		/*
8231da177e4SLinus Torvalds 		 *	Copy the packet header into the new buffer.
8241da177e4SLinus Torvalds 		 */
825d626f62bSArnaldo Carvalho de Melo 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
8261da177e4SLinus Torvalds 
8271da177e4SLinus Torvalds 		/*
8281da177e4SLinus Torvalds 		 *	Build fragment header.
8291da177e4SLinus Torvalds 		 */
8301da177e4SLinus Torvalds 		fh->nexthdr = nexthdr;
8311da177e4SLinus Torvalds 		fh->reserved = 0;
832f36d6ab1SYan Zheng 		if (!frag_id) {
8337ea2f2c5SSridhar Samudrala 			ipv6_select_ident(fh);
8341da177e4SLinus Torvalds 			frag_id = fh->identification;
8351da177e4SLinus Torvalds 		} else
8361da177e4SLinus Torvalds 			fh->identification = frag_id;
8371da177e4SLinus Torvalds 
8381da177e4SLinus Torvalds 		/*
8391da177e4SLinus Torvalds 		 *	Copy a block of the IP datagram.
8401da177e4SLinus Torvalds 		 */
8418984e41dSWei Yongjun 		if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
8421da177e4SLinus Torvalds 			BUG();
8431da177e4SLinus Torvalds 		left -= len;
8441da177e4SLinus Torvalds 
8451da177e4SLinus Torvalds 		fh->frag_off = htons(offset);
8461da177e4SLinus Torvalds 		if (left > 0)
8471da177e4SLinus Torvalds 			fh->frag_off |= htons(IP6_MF);
8480660e03fSArnaldo Carvalho de Melo 		ipv6_hdr(frag)->payload_len = htons(frag->len -
8490660e03fSArnaldo Carvalho de Melo 						    sizeof(struct ipv6hdr));
8501da177e4SLinus Torvalds 
8511da177e4SLinus Torvalds 		ptr += len;
8521da177e4SLinus Torvalds 		offset += len;
8531da177e4SLinus Torvalds 
8541da177e4SLinus Torvalds 		/*
8551da177e4SLinus Torvalds 		 *	Put this fragment into the sending queue.
8561da177e4SLinus Torvalds 		 */
8571da177e4SLinus Torvalds 		err = output(frag);
8581da177e4SLinus Torvalds 		if (err)
8591da177e4SLinus Torvalds 			goto fail;
860dafee490SWei Dong 
861adf30907SEric Dumazet 		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
8623bd653c8SDenis V. Lunev 			      IPSTATS_MIB_FRAGCREATES);
8631da177e4SLinus Torvalds 	}
864adf30907SEric Dumazet 	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
865a11d206dSYOSHIFUJI Hideaki 		      IPSTATS_MIB_FRAGOKS);
8661da177e4SLinus Torvalds 	kfree_skb(skb);
8671da177e4SLinus Torvalds 	return err;
8681da177e4SLinus Torvalds 
8691da177e4SLinus Torvalds fail:
870adf30907SEric Dumazet 	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
871a11d206dSYOSHIFUJI Hideaki 		      IPSTATS_MIB_FRAGFAILS);
8721da177e4SLinus Torvalds 	kfree_skb(skb);
8731da177e4SLinus Torvalds 	return err;
8741da177e4SLinus Torvalds }
8751da177e4SLinus Torvalds 
876cf6b1982SYOSHIFUJI Hideaki static inline int ip6_rt_check(struct rt6key *rt_key,
877cf6b1982SYOSHIFUJI Hideaki 			       struct in6_addr *fl_addr,
878cf6b1982SYOSHIFUJI Hideaki 			       struct in6_addr *addr_cache)
879cf6b1982SYOSHIFUJI Hideaki {
880cf6b1982SYOSHIFUJI Hideaki 	return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
881cf6b1982SYOSHIFUJI Hideaki 		(addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
882cf6b1982SYOSHIFUJI Hideaki }
883cf6b1982SYOSHIFUJI Hideaki 
884497c615aSHerbert Xu static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
885497c615aSHerbert Xu 					  struct dst_entry *dst,
886497c615aSHerbert Xu 					  struct flowi *fl)
8871da177e4SLinus Torvalds {
8881da177e4SLinus Torvalds 	struct ipv6_pinfo *np = inet6_sk(sk);
889497c615aSHerbert Xu 	struct rt6_info *rt = (struct rt6_info *)dst;
8901da177e4SLinus Torvalds 
891497c615aSHerbert Xu 	if (!dst)
892497c615aSHerbert Xu 		goto out;
8931da177e4SLinus Torvalds 
8941da177e4SLinus Torvalds 	/* Yes, checking route validity in not connected
895d76e60a5SDavid S. Miller 	 * case is not very simple. Take into account,
896d76e60a5SDavid S. Miller 	 * that we do not support routing by source, TOS,
897d76e60a5SDavid S. Miller 	 * and MSG_DONTROUTE 		--ANK (980726)
898d76e60a5SDavid S. Miller 	 *
899cf6b1982SYOSHIFUJI Hideaki 	 * 1. ip6_rt_check(): If route was host route,
900cf6b1982SYOSHIFUJI Hideaki 	 *    check that cached destination is current.
901d76e60a5SDavid S. Miller 	 *    If it is network route, we still may
902d76e60a5SDavid S. Miller 	 *    check its validity using saved pointer
903d76e60a5SDavid S. Miller 	 *    to the last used address: daddr_cache.
904d76e60a5SDavid S. Miller 	 *    We do not want to save whole address now,
905d76e60a5SDavid S. Miller 	 *    (because main consumer of this service
906d76e60a5SDavid S. Miller 	 *    is tcp, which has not this problem),
907d76e60a5SDavid S. Miller 	 *    so that the last trick works only on connected
908d76e60a5SDavid S. Miller 	 *    sockets.
909d76e60a5SDavid S. Miller 	 * 2. oif also should be the same.
9101da177e4SLinus Torvalds 	 */
911cf6b1982SYOSHIFUJI Hideaki 	if (ip6_rt_check(&rt->rt6i_dst, &fl->fl6_dst, np->daddr_cache) ||
9128e1ef0a9SYOSHIFUJI Hideaki #ifdef CONFIG_IPV6_SUBTREES
9138e1ef0a9SYOSHIFUJI Hideaki 	    ip6_rt_check(&rt->rt6i_src, &fl->fl6_src, np->saddr_cache) ||
9148e1ef0a9SYOSHIFUJI Hideaki #endif
915cf6b1982SYOSHIFUJI Hideaki 	    (fl->oif && fl->oif != dst->dev->ifindex)) {
916497c615aSHerbert Xu 		dst_release(dst);
917497c615aSHerbert Xu 		dst = NULL;
9181da177e4SLinus Torvalds 	}
919497c615aSHerbert Xu 
920497c615aSHerbert Xu out:
921497c615aSHerbert Xu 	return dst;
9221da177e4SLinus Torvalds }
923497c615aSHerbert Xu 
924497c615aSHerbert Xu static int ip6_dst_lookup_tail(struct sock *sk,
925497c615aSHerbert Xu 			       struct dst_entry **dst, struct flowi *fl)
926497c615aSHerbert Xu {
927497c615aSHerbert Xu 	int err;
9283b1e0a65SYOSHIFUJI Hideaki 	struct net *net = sock_net(sk);
9291da177e4SLinus Torvalds 
9301da177e4SLinus Torvalds 	if (*dst == NULL)
9318a3edd80SDaniel Lezcano 		*dst = ip6_route_output(net, sk, fl);
9321da177e4SLinus Torvalds 
9331da177e4SLinus Torvalds 	if ((err = (*dst)->error))
9341da177e4SLinus Torvalds 		goto out_err_release;
9351da177e4SLinus Torvalds 
9361da177e4SLinus Torvalds 	if (ipv6_addr_any(&fl->fl6_src)) {
937191cd582SBrian Haley 		err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
9387cbca67cSYOSHIFUJI Hideaki 					 &fl->fl6_dst,
9397cbca67cSYOSHIFUJI Hideaki 					 sk ? inet6_sk(sk)->srcprefs : 0,
9407cbca67cSYOSHIFUJI Hideaki 					 &fl->fl6_src);
94144456d37SOlaf Hering 		if (err)
9421da177e4SLinus Torvalds 			goto out_err_release;
9431da177e4SLinus Torvalds 	}
9441da177e4SLinus Torvalds 
94595c385b4SNeil Horman #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
94695c385b4SNeil Horman 	/*
94795c385b4SNeil Horman 	 * Here if the dst entry we've looked up
94895c385b4SNeil Horman 	 * has a neighbour entry that is in the INCOMPLETE
94995c385b4SNeil Horman 	 * state and the src address from the flow is
95095c385b4SNeil Horman 	 * marked as OPTIMISTIC, we release the found
95195c385b4SNeil Horman 	 * dst entry and replace it instead with the
95295c385b4SNeil Horman 	 * dst entry of the nexthop router
95395c385b4SNeil Horman 	 */
954e550dfb0SNeil Horman 	if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
95595c385b4SNeil Horman 		struct inet6_ifaddr *ifp;
95695c385b4SNeil Horman 		struct flowi fl_gw;
95795c385b4SNeil Horman 		int redirect;
95895c385b4SNeil Horman 
9598a3edd80SDaniel Lezcano 		ifp = ipv6_get_ifaddr(net, &fl->fl6_src,
9601cab3da6SDaniel Lezcano 				      (*dst)->dev, 1);
96195c385b4SNeil Horman 
96295c385b4SNeil Horman 		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
96395c385b4SNeil Horman 		if (ifp)
96495c385b4SNeil Horman 			in6_ifa_put(ifp);
96595c385b4SNeil Horman 
96695c385b4SNeil Horman 		if (redirect) {
96795c385b4SNeil Horman 			/*
96895c385b4SNeil Horman 			 * We need to get the dst entry for the
96995c385b4SNeil Horman 			 * default router instead
97095c385b4SNeil Horman 			 */
97195c385b4SNeil Horman 			dst_release(*dst);
97295c385b4SNeil Horman 			memcpy(&fl_gw, fl, sizeof(struct flowi));
97395c385b4SNeil Horman 			memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
9748a3edd80SDaniel Lezcano 			*dst = ip6_route_output(net, sk, &fl_gw);
97595c385b4SNeil Horman 			if ((err = (*dst)->error))
97695c385b4SNeil Horman 				goto out_err_release;
97795c385b4SNeil Horman 		}
97895c385b4SNeil Horman 	}
97995c385b4SNeil Horman #endif
98095c385b4SNeil Horman 
9811da177e4SLinus Torvalds 	return 0;
9821da177e4SLinus Torvalds 
9831da177e4SLinus Torvalds out_err_release:
984ca46f9c8SMitsuru Chinen 	if (err == -ENETUNREACH)
985483a47d2SDenis V. Lunev 		IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
9861da177e4SLinus Torvalds 	dst_release(*dst);
9871da177e4SLinus Torvalds 	*dst = NULL;
9881da177e4SLinus Torvalds 	return err;
9891da177e4SLinus Torvalds }
99034a0b3cdSAdrian Bunk 
991497c615aSHerbert Xu /**
992497c615aSHerbert Xu  *	ip6_dst_lookup - perform route lookup on flow
993497c615aSHerbert Xu  *	@sk: socket which provides route info
994497c615aSHerbert Xu  *	@dst: pointer to dst_entry * for result
995497c615aSHerbert Xu  *	@fl: flow to lookup
996497c615aSHerbert Xu  *
997497c615aSHerbert Xu  *	This function performs a route lookup on the given flow.
998497c615aSHerbert Xu  *
999497c615aSHerbert Xu  *	It returns zero on success, or a standard errno code on error.
1000497c615aSHerbert Xu  */
1001497c615aSHerbert Xu int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
1002497c615aSHerbert Xu {
1003497c615aSHerbert Xu 	*dst = NULL;
1004497c615aSHerbert Xu 	return ip6_dst_lookup_tail(sk, dst, fl);
1005497c615aSHerbert Xu }
10063cf3dc6cSArnaldo Carvalho de Melo EXPORT_SYMBOL_GPL(ip6_dst_lookup);
10073cf3dc6cSArnaldo Carvalho de Melo 
1008497c615aSHerbert Xu /**
1009497c615aSHerbert Xu  *	ip6_sk_dst_lookup - perform socket cached route lookup on flow
1010497c615aSHerbert Xu  *	@sk: socket which provides the dst cache and route info
1011497c615aSHerbert Xu  *	@dst: pointer to dst_entry * for result
1012497c615aSHerbert Xu  *	@fl: flow to lookup
1013497c615aSHerbert Xu  *
1014497c615aSHerbert Xu  *	This function performs a route lookup on the given flow with the
1015497c615aSHerbert Xu  *	possibility of using the cached route in the socket if it is valid.
1016497c615aSHerbert Xu  *	It will take the socket dst lock when operating on the dst cache.
1017497c615aSHerbert Xu  *	As a result, this function can only be used in process context.
1018497c615aSHerbert Xu  *
1019497c615aSHerbert Xu  *	It returns zero on success, or a standard errno code on error.
1020497c615aSHerbert Xu  */
1021497c615aSHerbert Xu int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
1022497c615aSHerbert Xu {
1023497c615aSHerbert Xu 	*dst = NULL;
1024497c615aSHerbert Xu 	if (sk) {
1025497c615aSHerbert Xu 		*dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1026497c615aSHerbert Xu 		*dst = ip6_sk_dst_check(sk, *dst, fl);
1027497c615aSHerbert Xu 	}
1028497c615aSHerbert Xu 
1029497c615aSHerbert Xu 	return ip6_dst_lookup_tail(sk, dst, fl);
1030497c615aSHerbert Xu }
1031497c615aSHerbert Xu EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
1032497c615aSHerbert Xu 
103334a0b3cdSAdrian Bunk static inline int ip6_ufo_append_data(struct sock *sk,
1034e89e9cf5SAnanda Raju 			int getfrag(void *from, char *to, int offset, int len,
1035e89e9cf5SAnanda Raju 			int odd, struct sk_buff *skb),
1036e89e9cf5SAnanda Raju 			void *from, int length, int hh_len, int fragheaderlen,
1037e89e9cf5SAnanda Raju 			int transhdrlen, int mtu,unsigned int flags)
1038e89e9cf5SAnanda Raju 
1039e89e9cf5SAnanda Raju {
1040e89e9cf5SAnanda Raju 	struct sk_buff *skb;
1041e89e9cf5SAnanda Raju 	int err;
1042e89e9cf5SAnanda Raju 
1043e89e9cf5SAnanda Raju 	/* There is support for UDP large send offload by network
1044e89e9cf5SAnanda Raju 	 * device, so create one single skb packet containing complete
1045e89e9cf5SAnanda Raju 	 * udp datagram
1046e89e9cf5SAnanda Raju 	 */
1047e89e9cf5SAnanda Raju 	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1048e89e9cf5SAnanda Raju 		skb = sock_alloc_send_skb(sk,
1049e89e9cf5SAnanda Raju 			hh_len + fragheaderlen + transhdrlen + 20,
1050e89e9cf5SAnanda Raju 			(flags & MSG_DONTWAIT), &err);
1051e89e9cf5SAnanda Raju 		if (skb == NULL)
1052e89e9cf5SAnanda Raju 			return -ENOMEM;
1053e89e9cf5SAnanda Raju 
1054e89e9cf5SAnanda Raju 		/* reserve space for Hardware header */
1055e89e9cf5SAnanda Raju 		skb_reserve(skb, hh_len);
1056e89e9cf5SAnanda Raju 
1057e89e9cf5SAnanda Raju 		/* create space for UDP/IP header */
1058e89e9cf5SAnanda Raju 		skb_put(skb,fragheaderlen + transhdrlen);
1059e89e9cf5SAnanda Raju 
1060e89e9cf5SAnanda Raju 		/* initialize network header pointer */
1061c1d2bbe1SArnaldo Carvalho de Melo 		skb_reset_network_header(skb);
1062e89e9cf5SAnanda Raju 
1063e89e9cf5SAnanda Raju 		/* initialize protocol header pointer */
1064b0e380b1SArnaldo Carvalho de Melo 		skb->transport_header = skb->network_header + fragheaderlen;
1065e89e9cf5SAnanda Raju 
106684fa7933SPatrick McHardy 		skb->ip_summed = CHECKSUM_PARTIAL;
1067e89e9cf5SAnanda Raju 		skb->csum = 0;
1068e89e9cf5SAnanda Raju 		sk->sk_sndmsg_off = 0;
1069e89e9cf5SAnanda Raju 	}
1070e89e9cf5SAnanda Raju 
1071e89e9cf5SAnanda Raju 	err = skb_append_datato_frags(sk,skb, getfrag, from,
1072e89e9cf5SAnanda Raju 				      (length - transhdrlen));
1073e89e9cf5SAnanda Raju 	if (!err) {
1074e89e9cf5SAnanda Raju 		struct frag_hdr fhdr;
1075e89e9cf5SAnanda Raju 
1076c31d5326SSridhar Samudrala 		/* Specify the length of each IPv6 datagram fragment.
1077c31d5326SSridhar Samudrala 		 * It has to be a multiple of 8.
1078c31d5326SSridhar Samudrala 		 */
1079c31d5326SSridhar Samudrala 		skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1080c31d5326SSridhar Samudrala 					     sizeof(struct frag_hdr)) & ~7;
1081f83ef8c0SHerbert Xu 		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
10827ea2f2c5SSridhar Samudrala 		ipv6_select_ident(&fhdr);
1083e89e9cf5SAnanda Raju 		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1084e89e9cf5SAnanda Raju 		__skb_queue_tail(&sk->sk_write_queue, skb);
1085e89e9cf5SAnanda Raju 
1086e89e9cf5SAnanda Raju 		return 0;
1087e89e9cf5SAnanda Raju 	}
1088e89e9cf5SAnanda Raju 	/* There is not enough support do UPD LSO,
1089e89e9cf5SAnanda Raju 	 * so follow normal path
1090e89e9cf5SAnanda Raju 	 */
1091e89e9cf5SAnanda Raju 	kfree_skb(skb);
1092e89e9cf5SAnanda Raju 
1093e89e9cf5SAnanda Raju 	return err;
1094e89e9cf5SAnanda Raju }
10951da177e4SLinus Torvalds 
10960178b695SHerbert Xu static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
10970178b695SHerbert Xu 					       gfp_t gfp)
10980178b695SHerbert Xu {
10990178b695SHerbert Xu 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
11000178b695SHerbert Xu }
11010178b695SHerbert Xu 
11020178b695SHerbert Xu static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
11030178b695SHerbert Xu 						gfp_t gfp)
11040178b695SHerbert Xu {
11050178b695SHerbert Xu 	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
11060178b695SHerbert Xu }
11070178b695SHerbert Xu 
110841a1f8eaSYOSHIFUJI Hideaki int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
110941a1f8eaSYOSHIFUJI Hideaki 	int offset, int len, int odd, struct sk_buff *skb),
11101da177e4SLinus Torvalds 	void *from, int length, int transhdrlen,
111141a1f8eaSYOSHIFUJI Hideaki 	int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
111241a1f8eaSYOSHIFUJI Hideaki 	struct rt6_info *rt, unsigned int flags)
11131da177e4SLinus Torvalds {
11141da177e4SLinus Torvalds 	struct inet_sock *inet = inet_sk(sk);
11151da177e4SLinus Torvalds 	struct ipv6_pinfo *np = inet6_sk(sk);
11161da177e4SLinus Torvalds 	struct sk_buff *skb;
11171da177e4SLinus Torvalds 	unsigned int maxfraglen, fragheaderlen;
11181da177e4SLinus Torvalds 	int exthdrlen;
11191da177e4SLinus Torvalds 	int hh_len;
11201da177e4SLinus Torvalds 	int mtu;
11211da177e4SLinus Torvalds 	int copy;
11221da177e4SLinus Torvalds 	int err;
11231da177e4SLinus Torvalds 	int offset = 0;
11241da177e4SLinus Torvalds 	int csummode = CHECKSUM_NONE;
11251da177e4SLinus Torvalds 
11261da177e4SLinus Torvalds 	if (flags&MSG_PROBE)
11271da177e4SLinus Torvalds 		return 0;
11281da177e4SLinus Torvalds 	if (skb_queue_empty(&sk->sk_write_queue)) {
11291da177e4SLinus Torvalds 		/*
11301da177e4SLinus Torvalds 		 * setup for corking
11311da177e4SLinus Torvalds 		 */
11321da177e4SLinus Torvalds 		if (opt) {
11330178b695SHerbert Xu 			if (WARN_ON(np->cork.opt))
11340178b695SHerbert Xu 				return -EINVAL;
11350178b695SHerbert Xu 
11360178b695SHerbert Xu 			np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
11371da177e4SLinus Torvalds 			if (unlikely(np->cork.opt == NULL))
11381da177e4SLinus Torvalds 				return -ENOBUFS;
11390178b695SHerbert Xu 
11400178b695SHerbert Xu 			np->cork.opt->tot_len = opt->tot_len;
11410178b695SHerbert Xu 			np->cork.opt->opt_flen = opt->opt_flen;
11420178b695SHerbert Xu 			np->cork.opt->opt_nflen = opt->opt_nflen;
11430178b695SHerbert Xu 
11440178b695SHerbert Xu 			np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
11450178b695SHerbert Xu 							    sk->sk_allocation);
11460178b695SHerbert Xu 			if (opt->dst0opt && !np->cork.opt->dst0opt)
11470178b695SHerbert Xu 				return -ENOBUFS;
11480178b695SHerbert Xu 
11490178b695SHerbert Xu 			np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
11500178b695SHerbert Xu 							    sk->sk_allocation);
11510178b695SHerbert Xu 			if (opt->dst1opt && !np->cork.opt->dst1opt)
11520178b695SHerbert Xu 				return -ENOBUFS;
11530178b695SHerbert Xu 
11540178b695SHerbert Xu 			np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
11550178b695SHerbert Xu 							   sk->sk_allocation);
11560178b695SHerbert Xu 			if (opt->hopopt && !np->cork.opt->hopopt)
11570178b695SHerbert Xu 				return -ENOBUFS;
11580178b695SHerbert Xu 
11590178b695SHerbert Xu 			np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
11600178b695SHerbert Xu 							    sk->sk_allocation);
11610178b695SHerbert Xu 			if (opt->srcrt && !np->cork.opt->srcrt)
11620178b695SHerbert Xu 				return -ENOBUFS;
11630178b695SHerbert Xu 
11641da177e4SLinus Torvalds 			/* need source address above miyazawa*/
11651da177e4SLinus Torvalds 		}
11661da177e4SLinus Torvalds 		dst_hold(&rt->u.dst);
1167c8cdaf99SYOSHIFUJI Hideaki 		inet->cork.dst = &rt->u.dst;
11681da177e4SLinus Torvalds 		inet->cork.fl = *fl;
11691da177e4SLinus Torvalds 		np->cork.hop_limit = hlimit;
117041a1f8eaSYOSHIFUJI Hideaki 		np->cork.tclass = tclass;
1171628a5c56SJohn Heffner 		mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1172628a5c56SJohn Heffner 		      rt->u.dst.dev->mtu : dst_mtu(rt->u.dst.path);
1173c7503609SDave Jones 		if (np->frag_size < mtu) {
1174d91675f9SYOSHIFUJI Hideaki 			if (np->frag_size)
1175d91675f9SYOSHIFUJI Hideaki 				mtu = np->frag_size;
1176d91675f9SYOSHIFUJI Hideaki 		}
1177d91675f9SYOSHIFUJI Hideaki 		inet->cork.fragsize = mtu;
11781da177e4SLinus Torvalds 		if (dst_allfrag(rt->u.dst.path))
11791da177e4SLinus Torvalds 			inet->cork.flags |= IPCORK_ALLFRAG;
11801da177e4SLinus Torvalds 		inet->cork.length = 0;
11811da177e4SLinus Torvalds 		sk->sk_sndmsg_page = NULL;
11821da177e4SLinus Torvalds 		sk->sk_sndmsg_off = 0;
118301488942SHerbert Xu 		exthdrlen = rt->u.dst.header_len + (opt ? opt->opt_flen : 0) -
1184a1b05140SMasahide NAKAMURA 			    rt->rt6i_nfheader_len;
11851da177e4SLinus Torvalds 		length += exthdrlen;
11861da177e4SLinus Torvalds 		transhdrlen += exthdrlen;
11871da177e4SLinus Torvalds 	} else {
1188c8cdaf99SYOSHIFUJI Hideaki 		rt = (struct rt6_info *)inet->cork.dst;
11891da177e4SLinus Torvalds 		fl = &inet->cork.fl;
11901da177e4SLinus Torvalds 		opt = np->cork.opt;
11911da177e4SLinus Torvalds 		transhdrlen = 0;
11921da177e4SLinus Torvalds 		exthdrlen = 0;
11931da177e4SLinus Torvalds 		mtu = inet->cork.fragsize;
11941da177e4SLinus Torvalds 	}
11951da177e4SLinus Torvalds 
11961da177e4SLinus Torvalds 	hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
11971da177e4SLinus Torvalds 
1198a1b05140SMasahide NAKAMURA 	fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1199b4ce9277SHerbert Xu 			(opt ? opt->opt_nflen : 0);
12001da177e4SLinus Torvalds 	maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
12011da177e4SLinus Torvalds 
12021da177e4SLinus Torvalds 	if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
12031da177e4SLinus Torvalds 		if (inet->cork.length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
12041da177e4SLinus Torvalds 			ipv6_local_error(sk, EMSGSIZE, fl, mtu-exthdrlen);
12051da177e4SLinus Torvalds 			return -EMSGSIZE;
12061da177e4SLinus Torvalds 		}
12071da177e4SLinus Torvalds 	}
12081da177e4SLinus Torvalds 
12091da177e4SLinus Torvalds 	/*
12101da177e4SLinus Torvalds 	 * Let's try using as much space as possible.
12111da177e4SLinus Torvalds 	 * Use MTU if total length of the message fits into the MTU.
12121da177e4SLinus Torvalds 	 * Otherwise, we need to reserve fragment header and
12131da177e4SLinus Torvalds 	 * fragment alignment (= 8-15 octects, in total).
12141da177e4SLinus Torvalds 	 *
12151da177e4SLinus Torvalds 	 * Note that we may need to "move" the data from the tail of
12161da177e4SLinus Torvalds 	 * of the buffer to the new fragment when we split
12171da177e4SLinus Torvalds 	 * the message.
12181da177e4SLinus Torvalds 	 *
12191da177e4SLinus Torvalds 	 * FIXME: It may be fragmented into multiple chunks
12201da177e4SLinus Torvalds 	 *        at once if non-fragmentable extension headers
12211da177e4SLinus Torvalds 	 *        are too large.
12221da177e4SLinus Torvalds 	 * --yoshfuji
12231da177e4SLinus Torvalds 	 */
12241da177e4SLinus Torvalds 
12251da177e4SLinus Torvalds 	inet->cork.length += length;
1226e89e9cf5SAnanda Raju 	if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
1227e89e9cf5SAnanda Raju 	    (rt->u.dst.dev->features & NETIF_F_UFO)) {
1228e89e9cf5SAnanda Raju 
1229baa829d8SPatrick McHardy 		err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
1230baa829d8SPatrick McHardy 					  fragheaderlen, transhdrlen, mtu,
1231baa829d8SPatrick McHardy 					  flags);
1232baa829d8SPatrick McHardy 		if (err)
1233e89e9cf5SAnanda Raju 			goto error;
1234e89e9cf5SAnanda Raju 		return 0;
1235e89e9cf5SAnanda Raju 	}
12361da177e4SLinus Torvalds 
12371da177e4SLinus Torvalds 	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
12381da177e4SLinus Torvalds 		goto alloc_new_skb;
12391da177e4SLinus Torvalds 
12401da177e4SLinus Torvalds 	while (length > 0) {
12411da177e4SLinus Torvalds 		/* Check if the remaining data fits into current packet. */
12421da177e4SLinus Torvalds 		copy = (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
12431da177e4SLinus Torvalds 		if (copy < length)
12441da177e4SLinus Torvalds 			copy = maxfraglen - skb->len;
12451da177e4SLinus Torvalds 
12461da177e4SLinus Torvalds 		if (copy <= 0) {
12471da177e4SLinus Torvalds 			char *data;
12481da177e4SLinus Torvalds 			unsigned int datalen;
12491da177e4SLinus Torvalds 			unsigned int fraglen;
12501da177e4SLinus Torvalds 			unsigned int fraggap;
12511da177e4SLinus Torvalds 			unsigned int alloclen;
12521da177e4SLinus Torvalds 			struct sk_buff *skb_prev;
12531da177e4SLinus Torvalds alloc_new_skb:
12541da177e4SLinus Torvalds 			skb_prev = skb;
12551da177e4SLinus Torvalds 
12561da177e4SLinus Torvalds 			/* There's no room in the current skb */
12571da177e4SLinus Torvalds 			if (skb_prev)
12581da177e4SLinus Torvalds 				fraggap = skb_prev->len - maxfraglen;
12591da177e4SLinus Torvalds 			else
12601da177e4SLinus Torvalds 				fraggap = 0;
12611da177e4SLinus Torvalds 
12621da177e4SLinus Torvalds 			/*
12631da177e4SLinus Torvalds 			 * If remaining data exceeds the mtu,
12641da177e4SLinus Torvalds 			 * we know we need more fragment(s).
12651da177e4SLinus Torvalds 			 */
12661da177e4SLinus Torvalds 			datalen = length + fraggap;
12671da177e4SLinus Torvalds 			if (datalen > (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
12681da177e4SLinus Torvalds 				datalen = maxfraglen - fragheaderlen;
12691da177e4SLinus Torvalds 
12701da177e4SLinus Torvalds 			fraglen = datalen + fragheaderlen;
12711da177e4SLinus Torvalds 			if ((flags & MSG_MORE) &&
12721da177e4SLinus Torvalds 			    !(rt->u.dst.dev->features&NETIF_F_SG))
12731da177e4SLinus Torvalds 				alloclen = mtu;
12741da177e4SLinus Torvalds 			else
12751da177e4SLinus Torvalds 				alloclen = datalen + fragheaderlen;
12761da177e4SLinus Torvalds 
12771da177e4SLinus Torvalds 			/*
12781da177e4SLinus Torvalds 			 * The last fragment gets additional space at tail.
12791da177e4SLinus Torvalds 			 * Note: we overallocate on fragments with MSG_MODE
12801da177e4SLinus Torvalds 			 * because we have no idea if we're the last one.
12811da177e4SLinus Torvalds 			 */
12821da177e4SLinus Torvalds 			if (datalen == length + fraggap)
12831da177e4SLinus Torvalds 				alloclen += rt->u.dst.trailer_len;
12841da177e4SLinus Torvalds 
12851da177e4SLinus Torvalds 			/*
12861da177e4SLinus Torvalds 			 * We just reserve space for fragment header.
12871da177e4SLinus Torvalds 			 * Note: this may be overallocation if the message
12881da177e4SLinus Torvalds 			 * (without MSG_MORE) fits into the MTU.
12891da177e4SLinus Torvalds 			 */
12901da177e4SLinus Torvalds 			alloclen += sizeof(struct frag_hdr);
12911da177e4SLinus Torvalds 
12921da177e4SLinus Torvalds 			if (transhdrlen) {
12931da177e4SLinus Torvalds 				skb = sock_alloc_send_skb(sk,
12941da177e4SLinus Torvalds 						alloclen + hh_len,
12951da177e4SLinus Torvalds 						(flags & MSG_DONTWAIT), &err);
12961da177e4SLinus Torvalds 			} else {
12971da177e4SLinus Torvalds 				skb = NULL;
12981da177e4SLinus Torvalds 				if (atomic_read(&sk->sk_wmem_alloc) <=
12991da177e4SLinus Torvalds 				    2 * sk->sk_sndbuf)
13001da177e4SLinus Torvalds 					skb = sock_wmalloc(sk,
13011da177e4SLinus Torvalds 							   alloclen + hh_len, 1,
13021da177e4SLinus Torvalds 							   sk->sk_allocation);
13031da177e4SLinus Torvalds 				if (unlikely(skb == NULL))
13041da177e4SLinus Torvalds 					err = -ENOBUFS;
13051da177e4SLinus Torvalds 			}
13061da177e4SLinus Torvalds 			if (skb == NULL)
13071da177e4SLinus Torvalds 				goto error;
13081da177e4SLinus Torvalds 			/*
13091da177e4SLinus Torvalds 			 *	Fill in the control structures
13101da177e4SLinus Torvalds 			 */
13111da177e4SLinus Torvalds 			skb->ip_summed = csummode;
13121da177e4SLinus Torvalds 			skb->csum = 0;
13131da177e4SLinus Torvalds 			/* reserve for fragmentation */
13141da177e4SLinus Torvalds 			skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
13151da177e4SLinus Torvalds 
13161da177e4SLinus Torvalds 			/*
13171da177e4SLinus Torvalds 			 *	Find where to start putting bytes
13181da177e4SLinus Torvalds 			 */
13191da177e4SLinus Torvalds 			data = skb_put(skb, fraglen);
1320c14d2450SArnaldo Carvalho de Melo 			skb_set_network_header(skb, exthdrlen);
13211da177e4SLinus Torvalds 			data += fragheaderlen;
1322b0e380b1SArnaldo Carvalho de Melo 			skb->transport_header = (skb->network_header +
1323b0e380b1SArnaldo Carvalho de Melo 						 fragheaderlen);
13241da177e4SLinus Torvalds 			if (fraggap) {
13251da177e4SLinus Torvalds 				skb->csum = skb_copy_and_csum_bits(
13261da177e4SLinus Torvalds 					skb_prev, maxfraglen,
13271da177e4SLinus Torvalds 					data + transhdrlen, fraggap, 0);
13281da177e4SLinus Torvalds 				skb_prev->csum = csum_sub(skb_prev->csum,
13291da177e4SLinus Torvalds 							  skb->csum);
13301da177e4SLinus Torvalds 				data += fraggap;
1331e9fa4f7bSHerbert Xu 				pskb_trim_unique(skb_prev, maxfraglen);
13321da177e4SLinus Torvalds 			}
13331da177e4SLinus Torvalds 			copy = datalen - transhdrlen - fraggap;
13341da177e4SLinus Torvalds 			if (copy < 0) {
13351da177e4SLinus Torvalds 				err = -EINVAL;
13361da177e4SLinus Torvalds 				kfree_skb(skb);
13371da177e4SLinus Torvalds 				goto error;
13381da177e4SLinus Torvalds 			} else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
13391da177e4SLinus Torvalds 				err = -EFAULT;
13401da177e4SLinus Torvalds 				kfree_skb(skb);
13411da177e4SLinus Torvalds 				goto error;
13421da177e4SLinus Torvalds 			}
13431da177e4SLinus Torvalds 
13441da177e4SLinus Torvalds 			offset += copy;
13451da177e4SLinus Torvalds 			length -= datalen - fraggap;
13461da177e4SLinus Torvalds 			transhdrlen = 0;
13471da177e4SLinus Torvalds 			exthdrlen = 0;
13481da177e4SLinus Torvalds 			csummode = CHECKSUM_NONE;
13491da177e4SLinus Torvalds 
13501da177e4SLinus Torvalds 			/*
13511da177e4SLinus Torvalds 			 * Put the packet on the pending queue
13521da177e4SLinus Torvalds 			 */
13531da177e4SLinus Torvalds 			__skb_queue_tail(&sk->sk_write_queue, skb);
13541da177e4SLinus Torvalds 			continue;
13551da177e4SLinus Torvalds 		}
13561da177e4SLinus Torvalds 
13571da177e4SLinus Torvalds 		if (copy > length)
13581da177e4SLinus Torvalds 			copy = length;
13591da177e4SLinus Torvalds 
13601da177e4SLinus Torvalds 		if (!(rt->u.dst.dev->features&NETIF_F_SG)) {
13611da177e4SLinus Torvalds 			unsigned int off;
13621da177e4SLinus Torvalds 
13631da177e4SLinus Torvalds 			off = skb->len;
13641da177e4SLinus Torvalds 			if (getfrag(from, skb_put(skb, copy),
13651da177e4SLinus Torvalds 						offset, copy, off, skb) < 0) {
13661da177e4SLinus Torvalds 				__skb_trim(skb, off);
13671da177e4SLinus Torvalds 				err = -EFAULT;
13681da177e4SLinus Torvalds 				goto error;
13691da177e4SLinus Torvalds 			}
13701da177e4SLinus Torvalds 		} else {
13711da177e4SLinus Torvalds 			int i = skb_shinfo(skb)->nr_frags;
13721da177e4SLinus Torvalds 			skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
13731da177e4SLinus Torvalds 			struct page *page = sk->sk_sndmsg_page;
13741da177e4SLinus Torvalds 			int off = sk->sk_sndmsg_off;
13751da177e4SLinus Torvalds 			unsigned int left;
13761da177e4SLinus Torvalds 
13771da177e4SLinus Torvalds 			if (page && (left = PAGE_SIZE - off) > 0) {
13781da177e4SLinus Torvalds 				if (copy >= left)
13791da177e4SLinus Torvalds 					copy = left;
13801da177e4SLinus Torvalds 				if (page != frag->page) {
13811da177e4SLinus Torvalds 					if (i == MAX_SKB_FRAGS) {
13821da177e4SLinus Torvalds 						err = -EMSGSIZE;
13831da177e4SLinus Torvalds 						goto error;
13841da177e4SLinus Torvalds 					}
13851da177e4SLinus Torvalds 					get_page(page);
13861da177e4SLinus Torvalds 					skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
13871da177e4SLinus Torvalds 					frag = &skb_shinfo(skb)->frags[i];
13881da177e4SLinus Torvalds 				}
13891da177e4SLinus Torvalds 			} else if(i < MAX_SKB_FRAGS) {
13901da177e4SLinus Torvalds 				if (copy > PAGE_SIZE)
13911da177e4SLinus Torvalds 					copy = PAGE_SIZE;
13921da177e4SLinus Torvalds 				page = alloc_pages(sk->sk_allocation, 0);
13931da177e4SLinus Torvalds 				if (page == NULL) {
13941da177e4SLinus Torvalds 					err = -ENOMEM;
13951da177e4SLinus Torvalds 					goto error;
13961da177e4SLinus Torvalds 				}
13971da177e4SLinus Torvalds 				sk->sk_sndmsg_page = page;
13981da177e4SLinus Torvalds 				sk->sk_sndmsg_off = 0;
13991da177e4SLinus Torvalds 
14001da177e4SLinus Torvalds 				skb_fill_page_desc(skb, i, page, 0, 0);
14011da177e4SLinus Torvalds 				frag = &skb_shinfo(skb)->frags[i];
14021da177e4SLinus Torvalds 			} else {
14031da177e4SLinus Torvalds 				err = -EMSGSIZE;
14041da177e4SLinus Torvalds 				goto error;
14051da177e4SLinus Torvalds 			}
14061da177e4SLinus Torvalds 			if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
14071da177e4SLinus Torvalds 				err = -EFAULT;
14081da177e4SLinus Torvalds 				goto error;
14091da177e4SLinus Torvalds 			}
14101da177e4SLinus Torvalds 			sk->sk_sndmsg_off += copy;
14111da177e4SLinus Torvalds 			frag->size += copy;
14121da177e4SLinus Torvalds 			skb->len += copy;
14131da177e4SLinus Torvalds 			skb->data_len += copy;
1414f945fa7aSHerbert Xu 			skb->truesize += copy;
1415f945fa7aSHerbert Xu 			atomic_add(copy, &sk->sk_wmem_alloc);
14161da177e4SLinus Torvalds 		}
14171da177e4SLinus Torvalds 		offset += copy;
14181da177e4SLinus Torvalds 		length -= copy;
14191da177e4SLinus Torvalds 	}
14201da177e4SLinus Torvalds 	return 0;
14211da177e4SLinus Torvalds error:
14221da177e4SLinus Torvalds 	inet->cork.length -= length;
14233bd653c8SDenis V. Lunev 	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
14241da177e4SLinus Torvalds 	return err;
14251da177e4SLinus Torvalds }
14261da177e4SLinus Torvalds 
1427bf138862SPavel Emelyanov static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1428bf138862SPavel Emelyanov {
14290178b695SHerbert Xu 	if (np->cork.opt) {
14300178b695SHerbert Xu 		kfree(np->cork.opt->dst0opt);
14310178b695SHerbert Xu 		kfree(np->cork.opt->dst1opt);
14320178b695SHerbert Xu 		kfree(np->cork.opt->hopopt);
14330178b695SHerbert Xu 		kfree(np->cork.opt->srcrt);
1434bf138862SPavel Emelyanov 		kfree(np->cork.opt);
1435bf138862SPavel Emelyanov 		np->cork.opt = NULL;
14360178b695SHerbert Xu 	}
14370178b695SHerbert Xu 
1438c8cdaf99SYOSHIFUJI Hideaki 	if (inet->cork.dst) {
1439c8cdaf99SYOSHIFUJI Hideaki 		dst_release(inet->cork.dst);
1440c8cdaf99SYOSHIFUJI Hideaki 		inet->cork.dst = NULL;
1441bf138862SPavel Emelyanov 		inet->cork.flags &= ~IPCORK_ALLFRAG;
1442bf138862SPavel Emelyanov 	}
1443bf138862SPavel Emelyanov 	memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1444bf138862SPavel Emelyanov }
1445bf138862SPavel Emelyanov 
14461da177e4SLinus Torvalds int ip6_push_pending_frames(struct sock *sk)
14471da177e4SLinus Torvalds {
14481da177e4SLinus Torvalds 	struct sk_buff *skb, *tmp_skb;
14491da177e4SLinus Torvalds 	struct sk_buff **tail_skb;
14501da177e4SLinus Torvalds 	struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
14511da177e4SLinus Torvalds 	struct inet_sock *inet = inet_sk(sk);
14521da177e4SLinus Torvalds 	struct ipv6_pinfo *np = inet6_sk(sk);
14533bd653c8SDenis V. Lunev 	struct net *net = sock_net(sk);
14541da177e4SLinus Torvalds 	struct ipv6hdr *hdr;
14551da177e4SLinus Torvalds 	struct ipv6_txoptions *opt = np->cork.opt;
1456c8cdaf99SYOSHIFUJI Hideaki 	struct rt6_info *rt = (struct rt6_info *)inet->cork.dst;
14571da177e4SLinus Torvalds 	struct flowi *fl = &inet->cork.fl;
14581da177e4SLinus Torvalds 	unsigned char proto = fl->proto;
14591da177e4SLinus Torvalds 	int err = 0;
14601da177e4SLinus Torvalds 
14611da177e4SLinus Torvalds 	if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
14621da177e4SLinus Torvalds 		goto out;
14631da177e4SLinus Torvalds 	tail_skb = &(skb_shinfo(skb)->frag_list);
14641da177e4SLinus Torvalds 
14651da177e4SLinus Torvalds 	/* move skb->data to ip header from ext header */
1466d56f90a7SArnaldo Carvalho de Melo 	if (skb->data < skb_network_header(skb))
1467bbe735e4SArnaldo Carvalho de Melo 		__skb_pull(skb, skb_network_offset(skb));
14681da177e4SLinus Torvalds 	while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1469cfe1fc77SArnaldo Carvalho de Melo 		__skb_pull(tmp_skb, skb_network_header_len(skb));
14701da177e4SLinus Torvalds 		*tail_skb = tmp_skb;
14711da177e4SLinus Torvalds 		tail_skb = &(tmp_skb->next);
14721da177e4SLinus Torvalds 		skb->len += tmp_skb->len;
14731da177e4SLinus Torvalds 		skb->data_len += tmp_skb->len;
14741da177e4SLinus Torvalds 		skb->truesize += tmp_skb->truesize;
14751da177e4SLinus Torvalds 		tmp_skb->destructor = NULL;
14761da177e4SLinus Torvalds 		tmp_skb->sk = NULL;
14771da177e4SLinus Torvalds 	}
14781da177e4SLinus Torvalds 
147928a89453SHerbert Xu 	/* Allow local fragmentation. */
1480b5c15fc0SHerbert Xu 	if (np->pmtudisc < IPV6_PMTUDISC_DO)
148128a89453SHerbert Xu 		skb->local_df = 1;
148228a89453SHerbert Xu 
14831da177e4SLinus Torvalds 	ipv6_addr_copy(final_dst, &fl->fl6_dst);
1484cfe1fc77SArnaldo Carvalho de Melo 	__skb_pull(skb, skb_network_header_len(skb));
14851da177e4SLinus Torvalds 	if (opt && opt->opt_flen)
14861da177e4SLinus Torvalds 		ipv6_push_frag_opts(skb, opt, &proto);
14871da177e4SLinus Torvalds 	if (opt && opt->opt_nflen)
14881da177e4SLinus Torvalds 		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
14891da177e4SLinus Torvalds 
1490e2d1bca7SArnaldo Carvalho de Melo 	skb_push(skb, sizeof(struct ipv6hdr));
1491e2d1bca7SArnaldo Carvalho de Melo 	skb_reset_network_header(skb);
14920660e03fSArnaldo Carvalho de Melo 	hdr = ipv6_hdr(skb);
14931da177e4SLinus Torvalds 
149490bcaf7bSAl Viro 	*(__be32*)hdr = fl->fl6_flowlabel |
149541a1f8eaSYOSHIFUJI Hideaki 		     htonl(0x60000000 | ((int)np->cork.tclass << 20));
14961da177e4SLinus Torvalds 
14971da177e4SLinus Torvalds 	hdr->hop_limit = np->cork.hop_limit;
14981da177e4SLinus Torvalds 	hdr->nexthdr = proto;
14991da177e4SLinus Torvalds 	ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
15001da177e4SLinus Torvalds 	ipv6_addr_copy(&hdr->daddr, final_dst);
15011da177e4SLinus Torvalds 
1502a2c2064fSPatrick McHardy 	skb->priority = sk->sk_priority;
15034a19ec58SLaszlo Attila Toth 	skb->mark = sk->sk_mark;
1504a2c2064fSPatrick McHardy 
1505adf30907SEric Dumazet 	skb_dst_set(skb, dst_clone(&rt->u.dst));
1506edf391ffSNeil Horman 	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
150714878f75SDavid L Stevens 	if (proto == IPPROTO_ICMPV6) {
1508adf30907SEric Dumazet 		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
150914878f75SDavid L Stevens 
15105a57d4c7SDenis V. Lunev 		ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1511e41b5368SDenis V. Lunev 		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
151214878f75SDavid L Stevens 	}
151314878f75SDavid L Stevens 
1514ef76bc23SHerbert Xu 	err = ip6_local_out(skb);
15151da177e4SLinus Torvalds 	if (err) {
15161da177e4SLinus Torvalds 		if (err > 0)
15176ce9e7b5SEric Dumazet 			err = net_xmit_errno(err);
15181da177e4SLinus Torvalds 		if (err)
15191da177e4SLinus Torvalds 			goto error;
15201da177e4SLinus Torvalds 	}
15211da177e4SLinus Torvalds 
15221da177e4SLinus Torvalds out:
1523bf138862SPavel Emelyanov 	ip6_cork_release(inet, np);
15241da177e4SLinus Torvalds 	return err;
15251da177e4SLinus Torvalds error:
152606254914SEric Dumazet 	IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
15271da177e4SLinus Torvalds 	goto out;
15281da177e4SLinus Torvalds }
15291da177e4SLinus Torvalds 
15301da177e4SLinus Torvalds void ip6_flush_pending_frames(struct sock *sk)
15311da177e4SLinus Torvalds {
15321da177e4SLinus Torvalds 	struct sk_buff *skb;
15331da177e4SLinus Torvalds 
15341da177e4SLinus Torvalds 	while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1535adf30907SEric Dumazet 		if (skb_dst(skb))
1536adf30907SEric Dumazet 			IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1537a11d206dSYOSHIFUJI Hideaki 				      IPSTATS_MIB_OUTDISCARDS);
15381da177e4SLinus Torvalds 		kfree_skb(skb);
15391da177e4SLinus Torvalds 	}
15401da177e4SLinus Torvalds 
1541bf138862SPavel Emelyanov 	ip6_cork_release(inet_sk(sk), inet6_sk(sk));
15421da177e4SLinus Torvalds }
1543