1 /* 2 * IPv6 output functions 3 * Linux INET6 implementation 4 * 5 * Authors: 6 * Pedro Roque <roque@di.fc.ul.pt> 7 * 8 * Based on linux/net/ipv4/ip_output.c 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License 12 * as published by the Free Software Foundation; either version 13 * 2 of the License, or (at your option) any later version. 14 * 15 * Changes: 16 * A.N.Kuznetsov : airthmetics in fragmentation. 17 * extension headers are implemented. 18 * route changes now work. 19 * ip6_forward does not confuse sniffers. 20 * etc. 21 * 22 * H. von Brand : Added missing #include <linux/string.h> 23 * Imran Patel : frag id should be in NBO 24 * Kazunori MIYAZAWA @USAGI 25 * : add ip6_append_data and related functions 26 * for datagram xmit 27 */ 28 29 #include <linux/errno.h> 30 #include <linux/kernel.h> 31 #include <linux/string.h> 32 #include <linux/socket.h> 33 #include <linux/net.h> 34 #include <linux/netdevice.h> 35 #include <linux/if_arp.h> 36 #include <linux/in6.h> 37 #include <linux/tcp.h> 38 #include <linux/route.h> 39 #include <linux/module.h> 40 #include <linux/slab.h> 41 42 #include <linux/netfilter.h> 43 #include <linux/netfilter_ipv6.h> 44 45 #include <net/sock.h> 46 #include <net/snmp.h> 47 48 #include <net/ipv6.h> 49 #include <net/ndisc.h> 50 #include <net/protocol.h> 51 #include <net/ip6_route.h> 52 #include <net/addrconf.h> 53 #include <net/rawv6.h> 54 #include <net/icmp.h> 55 #include <net/xfrm.h> 56 #include <net/checksum.h> 57 #include <linux/mroute6.h> 58 59 static int ip6_finish_output2(struct sk_buff *skb) 60 { 61 struct dst_entry *dst = skb_dst(skb); 62 struct net_device *dev = dst->dev; 63 struct neighbour *neigh; 64 struct in6_addr *nexthop; 65 int ret; 66 67 skb->protocol = htons(ETH_P_IPV6); 68 skb->dev = dev; 69 70 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { 71 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); 72 73 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) && 74 ((mroute6_socket(dev_net(dev), skb) && 75 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) || 76 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr, 77 &ipv6_hdr(skb)->saddr))) { 78 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC); 79 80 /* Do not check for IFF_ALLMULTI; multicast routing 81 is not supported in any case. 82 */ 83 if (newskb) 84 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, 85 newskb, NULL, newskb->dev, 86 dev_loopback_xmit); 87 88 if (ipv6_hdr(skb)->hop_limit == 0) { 89 IP6_INC_STATS(dev_net(dev), idev, 90 IPSTATS_MIB_OUTDISCARDS); 91 kfree_skb(skb); 92 return 0; 93 } 94 } 95 96 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST, 97 skb->len); 98 99 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <= 100 IPV6_ADDR_SCOPE_NODELOCAL && 101 !(dev->flags & IFF_LOOPBACK)) { 102 kfree_skb(skb); 103 return 0; 104 } 105 } 106 107 rcu_read_lock_bh(); 108 nexthop = rt6_nexthop((struct rt6_info *)dst); 109 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop); 110 if (unlikely(!neigh)) 111 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false); 112 if (!IS_ERR(neigh)) { 113 ret = dst_neigh_output(dst, neigh, skb); 114 rcu_read_unlock_bh(); 115 return ret; 116 } 117 rcu_read_unlock_bh(); 118 119 IP6_INC_STATS(dev_net(dst->dev), 120 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); 121 kfree_skb(skb); 122 return -EINVAL; 123 } 124 125 static int ip6_finish_output(struct sk_buff *skb) 126 { 127 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) || 128 dst_allfrag(skb_dst(skb)) || 129 (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size)) 130 return ip6_fragment(skb, ip6_finish_output2); 131 else 132 return ip6_finish_output2(skb); 133 } 134 135 int ip6_output(struct sock *sk, struct sk_buff *skb) 136 { 137 struct net_device *dev = skb_dst(skb)->dev; 138 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); 139 if (unlikely(idev->cnf.disable_ipv6)) { 140 IP6_INC_STATS(dev_net(dev), idev, 141 IPSTATS_MIB_OUTDISCARDS); 142 kfree_skb(skb); 143 return 0; 144 } 145 146 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev, 147 ip6_finish_output, 148 !(IP6CB(skb)->flags & IP6SKB_REROUTED)); 149 } 150 151 /* 152 * xmit an sk_buff (used by TCP, SCTP and DCCP) 153 */ 154 155 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, 156 struct ipv6_txoptions *opt, int tclass) 157 { 158 struct net *net = sock_net(sk); 159 struct ipv6_pinfo *np = inet6_sk(sk); 160 struct in6_addr *first_hop = &fl6->daddr; 161 struct dst_entry *dst = skb_dst(skb); 162 struct ipv6hdr *hdr; 163 u8 proto = fl6->flowi6_proto; 164 int seg_len = skb->len; 165 int hlimit = -1; 166 u32 mtu; 167 168 if (opt) { 169 unsigned int head_room; 170 171 /* First: exthdrs may take lots of space (~8K for now) 172 MAX_HEADER is not enough. 173 */ 174 head_room = opt->opt_nflen + opt->opt_flen; 175 seg_len += head_room; 176 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev); 177 178 if (skb_headroom(skb) < head_room) { 179 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room); 180 if (skb2 == NULL) { 181 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 182 IPSTATS_MIB_OUTDISCARDS); 183 kfree_skb(skb); 184 return -ENOBUFS; 185 } 186 consume_skb(skb); 187 skb = skb2; 188 skb_set_owner_w(skb, sk); 189 } 190 if (opt->opt_flen) 191 ipv6_push_frag_opts(skb, opt, &proto); 192 if (opt->opt_nflen) 193 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop); 194 } 195 196 skb_push(skb, sizeof(struct ipv6hdr)); 197 skb_reset_network_header(skb); 198 hdr = ipv6_hdr(skb); 199 200 /* 201 * Fill in the IPv6 header 202 */ 203 if (np) 204 hlimit = np->hop_limit; 205 if (hlimit < 0) 206 hlimit = ip6_dst_hoplimit(dst); 207 208 ip6_flow_hdr(hdr, tclass, fl6->flowlabel); 209 210 hdr->payload_len = htons(seg_len); 211 hdr->nexthdr = proto; 212 hdr->hop_limit = hlimit; 213 214 hdr->saddr = fl6->saddr; 215 hdr->daddr = *first_hop; 216 217 skb->protocol = htons(ETH_P_IPV6); 218 skb->priority = sk->sk_priority; 219 skb->mark = sk->sk_mark; 220 221 mtu = dst_mtu(dst); 222 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) { 223 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)), 224 IPSTATS_MIB_OUT, skb->len); 225 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, 226 dst->dev, dst_output); 227 } 228 229 skb->dev = dst->dev; 230 ipv6_local_error(sk, EMSGSIZE, fl6, mtu); 231 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS); 232 kfree_skb(skb); 233 return -EMSGSIZE; 234 } 235 236 EXPORT_SYMBOL(ip6_xmit); 237 238 static int ip6_call_ra_chain(struct sk_buff *skb, int sel) 239 { 240 struct ip6_ra_chain *ra; 241 struct sock *last = NULL; 242 243 read_lock(&ip6_ra_lock); 244 for (ra = ip6_ra_chain; ra; ra = ra->next) { 245 struct sock *sk = ra->sk; 246 if (sk && ra->sel == sel && 247 (!sk->sk_bound_dev_if || 248 sk->sk_bound_dev_if == skb->dev->ifindex)) { 249 if (last) { 250 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC); 251 if (skb2) 252 rawv6_rcv(last, skb2); 253 } 254 last = sk; 255 } 256 } 257 258 if (last) { 259 rawv6_rcv(last, skb); 260 read_unlock(&ip6_ra_lock); 261 return 1; 262 } 263 read_unlock(&ip6_ra_lock); 264 return 0; 265 } 266 267 static int ip6_forward_proxy_check(struct sk_buff *skb) 268 { 269 struct ipv6hdr *hdr = ipv6_hdr(skb); 270 u8 nexthdr = hdr->nexthdr; 271 __be16 frag_off; 272 int offset; 273 274 if (ipv6_ext_hdr(nexthdr)) { 275 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off); 276 if (offset < 0) 277 return 0; 278 } else 279 offset = sizeof(struct ipv6hdr); 280 281 if (nexthdr == IPPROTO_ICMPV6) { 282 struct icmp6hdr *icmp6; 283 284 if (!pskb_may_pull(skb, (skb_network_header(skb) + 285 offset + 1 - skb->data))) 286 return 0; 287 288 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset); 289 290 switch (icmp6->icmp6_type) { 291 case NDISC_ROUTER_SOLICITATION: 292 case NDISC_ROUTER_ADVERTISEMENT: 293 case NDISC_NEIGHBOUR_SOLICITATION: 294 case NDISC_NEIGHBOUR_ADVERTISEMENT: 295 case NDISC_REDIRECT: 296 /* For reaction involving unicast neighbor discovery 297 * message destined to the proxied address, pass it to 298 * input function. 299 */ 300 return 1; 301 default: 302 break; 303 } 304 } 305 306 /* 307 * The proxying router can't forward traffic sent to a link-local 308 * address, so signal the sender and discard the packet. This 309 * behavior is clarified by the MIPv6 specification. 310 */ 311 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) { 312 dst_link_failure(skb); 313 return -1; 314 } 315 316 return 0; 317 } 318 319 static inline int ip6_forward_finish(struct sk_buff *skb) 320 { 321 return dst_output(skb); 322 } 323 324 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) 325 { 326 unsigned int mtu; 327 struct inet6_dev *idev; 328 329 if (dst_metric_locked(dst, RTAX_MTU)) { 330 mtu = dst_metric_raw(dst, RTAX_MTU); 331 if (mtu) 332 return mtu; 333 } 334 335 mtu = IPV6_MIN_MTU; 336 rcu_read_lock(); 337 idev = __in6_dev_get(dst->dev); 338 if (idev) 339 mtu = idev->cnf.mtu6; 340 rcu_read_unlock(); 341 342 return mtu; 343 } 344 345 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu) 346 { 347 if (skb->len <= mtu || skb->local_df) 348 return false; 349 350 if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu) 351 return true; 352 353 if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu) 354 return false; 355 356 return true; 357 } 358 359 int ip6_forward(struct sk_buff *skb) 360 { 361 struct dst_entry *dst = skb_dst(skb); 362 struct ipv6hdr *hdr = ipv6_hdr(skb); 363 struct inet6_skb_parm *opt = IP6CB(skb); 364 struct net *net = dev_net(dst->dev); 365 u32 mtu; 366 367 if (net->ipv6.devconf_all->forwarding == 0) 368 goto error; 369 370 if (skb->pkt_type != PACKET_HOST) 371 goto drop; 372 373 if (skb_warn_if_lro(skb)) 374 goto drop; 375 376 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) { 377 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), 378 IPSTATS_MIB_INDISCARDS); 379 goto drop; 380 } 381 382 skb_forward_csum(skb); 383 384 /* 385 * We DO NOT make any processing on 386 * RA packets, pushing them to user level AS IS 387 * without ane WARRANTY that application will be able 388 * to interpret them. The reason is that we 389 * cannot make anything clever here. 390 * 391 * We are not end-node, so that if packet contains 392 * AH/ESP, we cannot make anything. 393 * Defragmentation also would be mistake, RA packets 394 * cannot be fragmented, because there is no warranty 395 * that different fragments will go along one path. --ANK 396 */ 397 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) { 398 if (ip6_call_ra_chain(skb, ntohs(opt->ra))) 399 return 0; 400 } 401 402 /* 403 * check and decrement ttl 404 */ 405 if (hdr->hop_limit <= 1) { 406 /* Force OUTPUT device used as source address */ 407 skb->dev = dst->dev; 408 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0); 409 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), 410 IPSTATS_MIB_INHDRERRORS); 411 412 kfree_skb(skb); 413 return -ETIMEDOUT; 414 } 415 416 /* XXX: idev->cnf.proxy_ndp? */ 417 if (net->ipv6.devconf_all->proxy_ndp && 418 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) { 419 int proxied = ip6_forward_proxy_check(skb); 420 if (proxied > 0) 421 return ip6_input(skb); 422 else if (proxied < 0) { 423 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), 424 IPSTATS_MIB_INDISCARDS); 425 goto drop; 426 } 427 } 428 429 if (!xfrm6_route_forward(skb)) { 430 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), 431 IPSTATS_MIB_INDISCARDS); 432 goto drop; 433 } 434 dst = skb_dst(skb); 435 436 /* IPv6 specs say nothing about it, but it is clear that we cannot 437 send redirects to source routed frames. 438 We don't send redirects to frames decapsulated from IPsec. 439 */ 440 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) { 441 struct in6_addr *target = NULL; 442 struct inet_peer *peer; 443 struct rt6_info *rt; 444 445 /* 446 * incoming and outgoing devices are the same 447 * send a redirect. 448 */ 449 450 rt = (struct rt6_info *) dst; 451 if (rt->rt6i_flags & RTF_GATEWAY) 452 target = &rt->rt6i_gateway; 453 else 454 target = &hdr->daddr; 455 456 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1); 457 458 /* Limit redirects both by destination (here) 459 and by source (inside ndisc_send_redirect) 460 */ 461 if (inet_peer_xrlim_allow(peer, 1*HZ)) 462 ndisc_send_redirect(skb, target); 463 if (peer) 464 inet_putpeer(peer); 465 } else { 466 int addrtype = ipv6_addr_type(&hdr->saddr); 467 468 /* This check is security critical. */ 469 if (addrtype == IPV6_ADDR_ANY || 470 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK)) 471 goto error; 472 if (addrtype & IPV6_ADDR_LINKLOCAL) { 473 icmpv6_send(skb, ICMPV6_DEST_UNREACH, 474 ICMPV6_NOT_NEIGHBOUR, 0); 475 goto error; 476 } 477 } 478 479 mtu = ip6_dst_mtu_forward(dst); 480 if (mtu < IPV6_MIN_MTU) 481 mtu = IPV6_MIN_MTU; 482 483 if (ip6_pkt_too_big(skb, mtu)) { 484 /* Again, force OUTPUT device used as source address */ 485 skb->dev = dst->dev; 486 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 487 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), 488 IPSTATS_MIB_INTOOBIGERRORS); 489 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), 490 IPSTATS_MIB_FRAGFAILS); 491 kfree_skb(skb); 492 return -EMSGSIZE; 493 } 494 495 if (skb_cow(skb, dst->dev->hard_header_len)) { 496 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), 497 IPSTATS_MIB_OUTDISCARDS); 498 goto drop; 499 } 500 501 hdr = ipv6_hdr(skb); 502 503 /* Mangling hops number delayed to point after skb COW */ 504 505 hdr->hop_limit--; 506 507 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); 508 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len); 509 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev, 510 ip6_forward_finish); 511 512 error: 513 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS); 514 drop: 515 kfree_skb(skb); 516 return -EINVAL; 517 } 518 519 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from) 520 { 521 to->pkt_type = from->pkt_type; 522 to->priority = from->priority; 523 to->protocol = from->protocol; 524 skb_dst_drop(to); 525 skb_dst_set(to, dst_clone(skb_dst(from))); 526 to->dev = from->dev; 527 to->mark = from->mark; 528 529 #ifdef CONFIG_NET_SCHED 530 to->tc_index = from->tc_index; 531 #endif 532 nf_copy(to, from); 533 skb_copy_secmark(to, from); 534 } 535 536 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 537 { 538 struct sk_buff *frag; 539 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb); 540 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL; 541 struct ipv6hdr *tmp_hdr; 542 struct frag_hdr *fh; 543 unsigned int mtu, hlen, left, len; 544 int hroom, troom; 545 __be32 frag_id = 0; 546 int ptr, offset = 0, err=0; 547 u8 *prevhdr, nexthdr = 0; 548 struct net *net = dev_net(skb_dst(skb)->dev); 549 550 hlen = ip6_find_1stfragopt(skb, &prevhdr); 551 nexthdr = *prevhdr; 552 553 mtu = ip6_skb_dst_mtu(skb); 554 555 /* We must not fragment if the socket is set to force MTU discovery 556 * or if the skb it not generated by a local socket. 557 */ 558 if (unlikely(!skb->local_df && skb->len > mtu) || 559 (IP6CB(skb)->frag_max_size && 560 IP6CB(skb)->frag_max_size > mtu)) { 561 if (skb->sk && dst_allfrag(skb_dst(skb))) 562 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK); 563 564 skb->dev = skb_dst(skb)->dev; 565 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 566 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 567 IPSTATS_MIB_FRAGFAILS); 568 kfree_skb(skb); 569 return -EMSGSIZE; 570 } 571 572 if (np && np->frag_size < mtu) { 573 if (np->frag_size) 574 mtu = np->frag_size; 575 } 576 mtu -= hlen + sizeof(struct frag_hdr); 577 578 if (skb_has_frag_list(skb)) { 579 int first_len = skb_pagelen(skb); 580 struct sk_buff *frag2; 581 582 if (first_len - hlen > mtu || 583 ((first_len - hlen) & 7) || 584 skb_cloned(skb)) 585 goto slow_path; 586 587 skb_walk_frags(skb, frag) { 588 /* Correct geometry. */ 589 if (frag->len > mtu || 590 ((frag->len & 7) && frag->next) || 591 skb_headroom(frag) < hlen) 592 goto slow_path_clean; 593 594 /* Partially cloned skb? */ 595 if (skb_shared(frag)) 596 goto slow_path_clean; 597 598 BUG_ON(frag->sk); 599 if (skb->sk) { 600 frag->sk = skb->sk; 601 frag->destructor = sock_wfree; 602 } 603 skb->truesize -= frag->truesize; 604 } 605 606 err = 0; 607 offset = 0; 608 frag = skb_shinfo(skb)->frag_list; 609 skb_frag_list_init(skb); 610 /* BUILD HEADER */ 611 612 *prevhdr = NEXTHDR_FRAGMENT; 613 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC); 614 if (!tmp_hdr) { 615 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 616 IPSTATS_MIB_FRAGFAILS); 617 return -ENOMEM; 618 } 619 620 __skb_pull(skb, hlen); 621 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr)); 622 __skb_push(skb, hlen); 623 skb_reset_network_header(skb); 624 memcpy(skb_network_header(skb), tmp_hdr, hlen); 625 626 ipv6_select_ident(fh, rt); 627 fh->nexthdr = nexthdr; 628 fh->reserved = 0; 629 fh->frag_off = htons(IP6_MF); 630 frag_id = fh->identification; 631 632 first_len = skb_pagelen(skb); 633 skb->data_len = first_len - skb_headlen(skb); 634 skb->len = first_len; 635 ipv6_hdr(skb)->payload_len = htons(first_len - 636 sizeof(struct ipv6hdr)); 637 638 dst_hold(&rt->dst); 639 640 for (;;) { 641 /* Prepare header of the next frame, 642 * before previous one went down. */ 643 if (frag) { 644 frag->ip_summed = CHECKSUM_NONE; 645 skb_reset_transport_header(frag); 646 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr)); 647 __skb_push(frag, hlen); 648 skb_reset_network_header(frag); 649 memcpy(skb_network_header(frag), tmp_hdr, 650 hlen); 651 offset += skb->len - hlen - sizeof(struct frag_hdr); 652 fh->nexthdr = nexthdr; 653 fh->reserved = 0; 654 fh->frag_off = htons(offset); 655 if (frag->next != NULL) 656 fh->frag_off |= htons(IP6_MF); 657 fh->identification = frag_id; 658 ipv6_hdr(frag)->payload_len = 659 htons(frag->len - 660 sizeof(struct ipv6hdr)); 661 ip6_copy_metadata(frag, skb); 662 } 663 664 err = output(skb); 665 if(!err) 666 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst), 667 IPSTATS_MIB_FRAGCREATES); 668 669 if (err || !frag) 670 break; 671 672 skb = frag; 673 frag = skb->next; 674 skb->next = NULL; 675 } 676 677 kfree(tmp_hdr); 678 679 if (err == 0) { 680 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst), 681 IPSTATS_MIB_FRAGOKS); 682 ip6_rt_put(rt); 683 return 0; 684 } 685 686 while (frag) { 687 skb = frag->next; 688 kfree_skb(frag); 689 frag = skb; 690 } 691 692 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst), 693 IPSTATS_MIB_FRAGFAILS); 694 ip6_rt_put(rt); 695 return err; 696 697 slow_path_clean: 698 skb_walk_frags(skb, frag2) { 699 if (frag2 == frag) 700 break; 701 frag2->sk = NULL; 702 frag2->destructor = NULL; 703 skb->truesize += frag2->truesize; 704 } 705 } 706 707 slow_path: 708 if ((skb->ip_summed == CHECKSUM_PARTIAL) && 709 skb_checksum_help(skb)) 710 goto fail; 711 712 left = skb->len - hlen; /* Space per frame */ 713 ptr = hlen; /* Where to start from */ 714 715 /* 716 * Fragment the datagram. 717 */ 718 719 *prevhdr = NEXTHDR_FRAGMENT; 720 hroom = LL_RESERVED_SPACE(rt->dst.dev); 721 troom = rt->dst.dev->needed_tailroom; 722 723 /* 724 * Keep copying data until we run out. 725 */ 726 while(left > 0) { 727 len = left; 728 /* IF: it doesn't fit, use 'mtu' - the data space left */ 729 if (len > mtu) 730 len = mtu; 731 /* IF: we are not sending up to and including the packet end 732 then align the next start on an eight byte boundary */ 733 if (len < left) { 734 len &= ~7; 735 } 736 /* 737 * Allocate buffer. 738 */ 739 740 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) + 741 hroom + troom, GFP_ATOMIC)) == NULL) { 742 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n"); 743 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 744 IPSTATS_MIB_FRAGFAILS); 745 err = -ENOMEM; 746 goto fail; 747 } 748 749 /* 750 * Set up data on packet 751 */ 752 753 ip6_copy_metadata(frag, skb); 754 skb_reserve(frag, hroom); 755 skb_put(frag, len + hlen + sizeof(struct frag_hdr)); 756 skb_reset_network_header(frag); 757 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen); 758 frag->transport_header = (frag->network_header + hlen + 759 sizeof(struct frag_hdr)); 760 761 /* 762 * Charge the memory for the fragment to any owner 763 * it might possess 764 */ 765 if (skb->sk) 766 skb_set_owner_w(frag, skb->sk); 767 768 /* 769 * Copy the packet header into the new buffer. 770 */ 771 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen); 772 773 /* 774 * Build fragment header. 775 */ 776 fh->nexthdr = nexthdr; 777 fh->reserved = 0; 778 if (!frag_id) { 779 ipv6_select_ident(fh, rt); 780 frag_id = fh->identification; 781 } else 782 fh->identification = frag_id; 783 784 /* 785 * Copy a block of the IP datagram. 786 */ 787 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len)) 788 BUG(); 789 left -= len; 790 791 fh->frag_off = htons(offset); 792 if (left > 0) 793 fh->frag_off |= htons(IP6_MF); 794 ipv6_hdr(frag)->payload_len = htons(frag->len - 795 sizeof(struct ipv6hdr)); 796 797 ptr += len; 798 offset += len; 799 800 /* 801 * Put this fragment into the sending queue. 802 */ 803 err = output(frag); 804 if (err) 805 goto fail; 806 807 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 808 IPSTATS_MIB_FRAGCREATES); 809 } 810 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 811 IPSTATS_MIB_FRAGOKS); 812 consume_skb(skb); 813 return err; 814 815 fail: 816 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 817 IPSTATS_MIB_FRAGFAILS); 818 kfree_skb(skb); 819 return err; 820 } 821 822 static inline int ip6_rt_check(const struct rt6key *rt_key, 823 const struct in6_addr *fl_addr, 824 const struct in6_addr *addr_cache) 825 { 826 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) && 827 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)); 828 } 829 830 static struct dst_entry *ip6_sk_dst_check(struct sock *sk, 831 struct dst_entry *dst, 832 const struct flowi6 *fl6) 833 { 834 struct ipv6_pinfo *np = inet6_sk(sk); 835 struct rt6_info *rt; 836 837 if (!dst) 838 goto out; 839 840 if (dst->ops->family != AF_INET6) { 841 dst_release(dst); 842 return NULL; 843 } 844 845 rt = (struct rt6_info *)dst; 846 /* Yes, checking route validity in not connected 847 * case is not very simple. Take into account, 848 * that we do not support routing by source, TOS, 849 * and MSG_DONTROUTE --ANK (980726) 850 * 851 * 1. ip6_rt_check(): If route was host route, 852 * check that cached destination is current. 853 * If it is network route, we still may 854 * check its validity using saved pointer 855 * to the last used address: daddr_cache. 856 * We do not want to save whole address now, 857 * (because main consumer of this service 858 * is tcp, which has not this problem), 859 * so that the last trick works only on connected 860 * sockets. 861 * 2. oif also should be the same. 862 */ 863 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) || 864 #ifdef CONFIG_IPV6_SUBTREES 865 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) || 866 #endif 867 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) { 868 dst_release(dst); 869 dst = NULL; 870 } 871 872 out: 873 return dst; 874 } 875 876 static int ip6_dst_lookup_tail(struct sock *sk, 877 struct dst_entry **dst, struct flowi6 *fl6) 878 { 879 struct net *net = sock_net(sk); 880 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD 881 struct neighbour *n; 882 struct rt6_info *rt; 883 #endif 884 int err; 885 886 if (*dst == NULL) 887 *dst = ip6_route_output(net, sk, fl6); 888 889 if ((err = (*dst)->error)) 890 goto out_err_release; 891 892 if (ipv6_addr_any(&fl6->saddr)) { 893 struct rt6_info *rt = (struct rt6_info *) *dst; 894 err = ip6_route_get_saddr(net, rt, &fl6->daddr, 895 sk ? inet6_sk(sk)->srcprefs : 0, 896 &fl6->saddr); 897 if (err) 898 goto out_err_release; 899 } 900 901 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD 902 /* 903 * Here if the dst entry we've looked up 904 * has a neighbour entry that is in the INCOMPLETE 905 * state and the src address from the flow is 906 * marked as OPTIMISTIC, we release the found 907 * dst entry and replace it instead with the 908 * dst entry of the nexthop router 909 */ 910 rt = (struct rt6_info *) *dst; 911 rcu_read_lock_bh(); 912 n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt)); 913 err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0; 914 rcu_read_unlock_bh(); 915 916 if (err) { 917 struct inet6_ifaddr *ifp; 918 struct flowi6 fl_gw6; 919 int redirect; 920 921 ifp = ipv6_get_ifaddr(net, &fl6->saddr, 922 (*dst)->dev, 1); 923 924 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC); 925 if (ifp) 926 in6_ifa_put(ifp); 927 928 if (redirect) { 929 /* 930 * We need to get the dst entry for the 931 * default router instead 932 */ 933 dst_release(*dst); 934 memcpy(&fl_gw6, fl6, sizeof(struct flowi6)); 935 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr)); 936 *dst = ip6_route_output(net, sk, &fl_gw6); 937 if ((err = (*dst)->error)) 938 goto out_err_release; 939 } 940 } 941 #endif 942 943 return 0; 944 945 out_err_release: 946 if (err == -ENETUNREACH) 947 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES); 948 dst_release(*dst); 949 *dst = NULL; 950 return err; 951 } 952 953 /** 954 * ip6_dst_lookup - perform route lookup on flow 955 * @sk: socket which provides route info 956 * @dst: pointer to dst_entry * for result 957 * @fl6: flow to lookup 958 * 959 * This function performs a route lookup on the given flow. 960 * 961 * It returns zero on success, or a standard errno code on error. 962 */ 963 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6) 964 { 965 *dst = NULL; 966 return ip6_dst_lookup_tail(sk, dst, fl6); 967 } 968 EXPORT_SYMBOL_GPL(ip6_dst_lookup); 969 970 /** 971 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec 972 * @sk: socket which provides route info 973 * @fl6: flow to lookup 974 * @final_dst: final destination address for ipsec lookup 975 * 976 * This function performs a route lookup on the given flow. 977 * 978 * It returns a valid dst pointer on success, or a pointer encoded 979 * error code. 980 */ 981 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6, 982 const struct in6_addr *final_dst) 983 { 984 struct dst_entry *dst = NULL; 985 int err; 986 987 err = ip6_dst_lookup_tail(sk, &dst, fl6); 988 if (err) 989 return ERR_PTR(err); 990 if (final_dst) 991 fl6->daddr = *final_dst; 992 993 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0); 994 } 995 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow); 996 997 /** 998 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow 999 * @sk: socket which provides the dst cache and route info 1000 * @fl6: flow to lookup 1001 * @final_dst: final destination address for ipsec lookup 1002 * 1003 * This function performs a route lookup on the given flow with the 1004 * possibility of using the cached route in the socket if it is valid. 1005 * It will take the socket dst lock when operating on the dst cache. 1006 * As a result, this function can only be used in process context. 1007 * 1008 * It returns a valid dst pointer on success, or a pointer encoded 1009 * error code. 1010 */ 1011 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6, 1012 const struct in6_addr *final_dst) 1013 { 1014 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie); 1015 int err; 1016 1017 dst = ip6_sk_dst_check(sk, dst, fl6); 1018 1019 err = ip6_dst_lookup_tail(sk, &dst, fl6); 1020 if (err) 1021 return ERR_PTR(err); 1022 if (final_dst) 1023 fl6->daddr = *final_dst; 1024 1025 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0); 1026 } 1027 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow); 1028 1029 static inline int ip6_ufo_append_data(struct sock *sk, 1030 int getfrag(void *from, char *to, int offset, int len, 1031 int odd, struct sk_buff *skb), 1032 void *from, int length, int hh_len, int fragheaderlen, 1033 int transhdrlen, int mtu,unsigned int flags, 1034 struct rt6_info *rt) 1035 1036 { 1037 struct sk_buff *skb; 1038 struct frag_hdr fhdr; 1039 int err; 1040 1041 /* There is support for UDP large send offload by network 1042 * device, so create one single skb packet containing complete 1043 * udp datagram 1044 */ 1045 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) { 1046 skb = sock_alloc_send_skb(sk, 1047 hh_len + fragheaderlen + transhdrlen + 20, 1048 (flags & MSG_DONTWAIT), &err); 1049 if (skb == NULL) 1050 return err; 1051 1052 /* reserve space for Hardware header */ 1053 skb_reserve(skb, hh_len); 1054 1055 /* create space for UDP/IP header */ 1056 skb_put(skb,fragheaderlen + transhdrlen); 1057 1058 /* initialize network header pointer */ 1059 skb_reset_network_header(skb); 1060 1061 /* initialize protocol header pointer */ 1062 skb->transport_header = skb->network_header + fragheaderlen; 1063 1064 skb->protocol = htons(ETH_P_IPV6); 1065 skb->csum = 0; 1066 1067 __skb_queue_tail(&sk->sk_write_queue, skb); 1068 } else if (skb_is_gso(skb)) { 1069 goto append; 1070 } 1071 1072 skb->ip_summed = CHECKSUM_PARTIAL; 1073 /* Specify the length of each IPv6 datagram fragment. 1074 * It has to be a multiple of 8. 1075 */ 1076 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen - 1077 sizeof(struct frag_hdr)) & ~7; 1078 skb_shinfo(skb)->gso_type = SKB_GSO_UDP; 1079 ipv6_select_ident(&fhdr, rt); 1080 skb_shinfo(skb)->ip6_frag_id = fhdr.identification; 1081 1082 append: 1083 return skb_append_datato_frags(sk, skb, getfrag, from, 1084 (length - transhdrlen)); 1085 } 1086 1087 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src, 1088 gfp_t gfp) 1089 { 1090 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL; 1091 } 1092 1093 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src, 1094 gfp_t gfp) 1095 { 1096 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL; 1097 } 1098 1099 static void ip6_append_data_mtu(unsigned int *mtu, 1100 int *maxfraglen, 1101 unsigned int fragheaderlen, 1102 struct sk_buff *skb, 1103 struct rt6_info *rt, 1104 unsigned int orig_mtu) 1105 { 1106 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) { 1107 if (skb == NULL) { 1108 /* first fragment, reserve header_len */ 1109 *mtu = orig_mtu - rt->dst.header_len; 1110 1111 } else { 1112 /* 1113 * this fragment is not first, the headers 1114 * space is regarded as data space. 1115 */ 1116 *mtu = orig_mtu; 1117 } 1118 *maxfraglen = ((*mtu - fragheaderlen) & ~7) 1119 + fragheaderlen - sizeof(struct frag_hdr); 1120 } 1121 } 1122 1123 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, 1124 int offset, int len, int odd, struct sk_buff *skb), 1125 void *from, int length, int transhdrlen, 1126 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6, 1127 struct rt6_info *rt, unsigned int flags, int dontfrag) 1128 { 1129 struct inet_sock *inet = inet_sk(sk); 1130 struct ipv6_pinfo *np = inet6_sk(sk); 1131 struct inet_cork *cork; 1132 struct sk_buff *skb, *skb_prev = NULL; 1133 unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu; 1134 int exthdrlen; 1135 int dst_exthdrlen; 1136 int hh_len; 1137 int copy; 1138 int err; 1139 int offset = 0; 1140 __u8 tx_flags = 0; 1141 1142 if (flags&MSG_PROBE) 1143 return 0; 1144 cork = &inet->cork.base; 1145 if (skb_queue_empty(&sk->sk_write_queue)) { 1146 /* 1147 * setup for corking 1148 */ 1149 if (opt) { 1150 if (WARN_ON(np->cork.opt)) 1151 return -EINVAL; 1152 1153 np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation); 1154 if (unlikely(np->cork.opt == NULL)) 1155 return -ENOBUFS; 1156 1157 np->cork.opt->tot_len = opt->tot_len; 1158 np->cork.opt->opt_flen = opt->opt_flen; 1159 np->cork.opt->opt_nflen = opt->opt_nflen; 1160 1161 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt, 1162 sk->sk_allocation); 1163 if (opt->dst0opt && !np->cork.opt->dst0opt) 1164 return -ENOBUFS; 1165 1166 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt, 1167 sk->sk_allocation); 1168 if (opt->dst1opt && !np->cork.opt->dst1opt) 1169 return -ENOBUFS; 1170 1171 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt, 1172 sk->sk_allocation); 1173 if (opt->hopopt && !np->cork.opt->hopopt) 1174 return -ENOBUFS; 1175 1176 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt, 1177 sk->sk_allocation); 1178 if (opt->srcrt && !np->cork.opt->srcrt) 1179 return -ENOBUFS; 1180 1181 /* need source address above miyazawa*/ 1182 } 1183 dst_hold(&rt->dst); 1184 cork->dst = &rt->dst; 1185 inet->cork.fl.u.ip6 = *fl6; 1186 np->cork.hop_limit = hlimit; 1187 np->cork.tclass = tclass; 1188 if (rt->dst.flags & DST_XFRM_TUNNEL) 1189 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ? 1190 rt->dst.dev->mtu : dst_mtu(&rt->dst); 1191 else 1192 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ? 1193 rt->dst.dev->mtu : dst_mtu(rt->dst.path); 1194 if (np->frag_size < mtu) { 1195 if (np->frag_size) 1196 mtu = np->frag_size; 1197 } 1198 cork->fragsize = mtu; 1199 if (dst_allfrag(rt->dst.path)) 1200 cork->flags |= IPCORK_ALLFRAG; 1201 cork->length = 0; 1202 exthdrlen = (opt ? opt->opt_flen : 0); 1203 length += exthdrlen; 1204 transhdrlen += exthdrlen; 1205 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len; 1206 } else { 1207 rt = (struct rt6_info *)cork->dst; 1208 fl6 = &inet->cork.fl.u.ip6; 1209 opt = np->cork.opt; 1210 transhdrlen = 0; 1211 exthdrlen = 0; 1212 dst_exthdrlen = 0; 1213 mtu = cork->fragsize; 1214 } 1215 orig_mtu = mtu; 1216 1217 hh_len = LL_RESERVED_SPACE(rt->dst.dev); 1218 1219 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len + 1220 (opt ? opt->opt_nflen : 0); 1221 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - 1222 sizeof(struct frag_hdr); 1223 1224 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) { 1225 unsigned int maxnonfragsize, headersize; 1226 1227 headersize = sizeof(struct ipv6hdr) + 1228 (opt ? opt->tot_len : 0) + 1229 (dst_allfrag(&rt->dst) ? 1230 sizeof(struct frag_hdr) : 0) + 1231 rt->rt6i_nfheader_len; 1232 1233 if (ip6_sk_local_df(sk)) 1234 maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN; 1235 else 1236 maxnonfragsize = mtu; 1237 1238 /* dontfrag active */ 1239 if ((cork->length + length > mtu - headersize) && dontfrag && 1240 (sk->sk_protocol == IPPROTO_UDP || 1241 sk->sk_protocol == IPPROTO_RAW)) { 1242 ipv6_local_rxpmtu(sk, fl6, mtu - headersize + 1243 sizeof(struct ipv6hdr)); 1244 goto emsgsize; 1245 } 1246 1247 if (cork->length + length > maxnonfragsize - headersize) { 1248 emsgsize: 1249 ipv6_local_error(sk, EMSGSIZE, fl6, 1250 mtu - headersize + 1251 sizeof(struct ipv6hdr)); 1252 return -EMSGSIZE; 1253 } 1254 } 1255 1256 /* For UDP, check if TX timestamp is enabled */ 1257 if (sk->sk_type == SOCK_DGRAM) 1258 sock_tx_timestamp(sk, &tx_flags); 1259 1260 /* 1261 * Let's try using as much space as possible. 1262 * Use MTU if total length of the message fits into the MTU. 1263 * Otherwise, we need to reserve fragment header and 1264 * fragment alignment (= 8-15 octects, in total). 1265 * 1266 * Note that we may need to "move" the data from the tail of 1267 * of the buffer to the new fragment when we split 1268 * the message. 1269 * 1270 * FIXME: It may be fragmented into multiple chunks 1271 * at once if non-fragmentable extension headers 1272 * are too large. 1273 * --yoshfuji 1274 */ 1275 1276 skb = skb_peek_tail(&sk->sk_write_queue); 1277 cork->length += length; 1278 if (((length > mtu) || 1279 (skb && skb_is_gso(skb))) && 1280 (sk->sk_protocol == IPPROTO_UDP) && 1281 (rt->dst.dev->features & NETIF_F_UFO)) { 1282 err = ip6_ufo_append_data(sk, getfrag, from, length, 1283 hh_len, fragheaderlen, 1284 transhdrlen, mtu, flags, rt); 1285 if (err) 1286 goto error; 1287 return 0; 1288 } 1289 1290 if (!skb) 1291 goto alloc_new_skb; 1292 1293 while (length > 0) { 1294 /* Check if the remaining data fits into current packet. */ 1295 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len; 1296 if (copy < length) 1297 copy = maxfraglen - skb->len; 1298 1299 if (copy <= 0) { 1300 char *data; 1301 unsigned int datalen; 1302 unsigned int fraglen; 1303 unsigned int fraggap; 1304 unsigned int alloclen; 1305 alloc_new_skb: 1306 /* There's no room in the current skb */ 1307 if (skb) 1308 fraggap = skb->len - maxfraglen; 1309 else 1310 fraggap = 0; 1311 /* update mtu and maxfraglen if necessary */ 1312 if (skb == NULL || skb_prev == NULL) 1313 ip6_append_data_mtu(&mtu, &maxfraglen, 1314 fragheaderlen, skb, rt, 1315 orig_mtu); 1316 1317 skb_prev = skb; 1318 1319 /* 1320 * If remaining data exceeds the mtu, 1321 * we know we need more fragment(s). 1322 */ 1323 datalen = length + fraggap; 1324 1325 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen) 1326 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len; 1327 if ((flags & MSG_MORE) && 1328 !(rt->dst.dev->features&NETIF_F_SG)) 1329 alloclen = mtu; 1330 else 1331 alloclen = datalen + fragheaderlen; 1332 1333 alloclen += dst_exthdrlen; 1334 1335 if (datalen != length + fraggap) { 1336 /* 1337 * this is not the last fragment, the trailer 1338 * space is regarded as data space. 1339 */ 1340 datalen += rt->dst.trailer_len; 1341 } 1342 1343 alloclen += rt->dst.trailer_len; 1344 fraglen = datalen + fragheaderlen; 1345 1346 /* 1347 * We just reserve space for fragment header. 1348 * Note: this may be overallocation if the message 1349 * (without MSG_MORE) fits into the MTU. 1350 */ 1351 alloclen += sizeof(struct frag_hdr); 1352 1353 if (transhdrlen) { 1354 skb = sock_alloc_send_skb(sk, 1355 alloclen + hh_len, 1356 (flags & MSG_DONTWAIT), &err); 1357 } else { 1358 skb = NULL; 1359 if (atomic_read(&sk->sk_wmem_alloc) <= 1360 2 * sk->sk_sndbuf) 1361 skb = sock_wmalloc(sk, 1362 alloclen + hh_len, 1, 1363 sk->sk_allocation); 1364 if (unlikely(skb == NULL)) 1365 err = -ENOBUFS; 1366 else { 1367 /* Only the initial fragment 1368 * is time stamped. 1369 */ 1370 tx_flags = 0; 1371 } 1372 } 1373 if (skb == NULL) 1374 goto error; 1375 /* 1376 * Fill in the control structures 1377 */ 1378 skb->protocol = htons(ETH_P_IPV6); 1379 skb->ip_summed = CHECKSUM_NONE; 1380 skb->csum = 0; 1381 /* reserve for fragmentation and ipsec header */ 1382 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) + 1383 dst_exthdrlen); 1384 1385 if (sk->sk_type == SOCK_DGRAM) 1386 skb_shinfo(skb)->tx_flags = tx_flags; 1387 1388 /* 1389 * Find where to start putting bytes 1390 */ 1391 data = skb_put(skb, fraglen); 1392 skb_set_network_header(skb, exthdrlen); 1393 data += fragheaderlen; 1394 skb->transport_header = (skb->network_header + 1395 fragheaderlen); 1396 if (fraggap) { 1397 skb->csum = skb_copy_and_csum_bits( 1398 skb_prev, maxfraglen, 1399 data + transhdrlen, fraggap, 0); 1400 skb_prev->csum = csum_sub(skb_prev->csum, 1401 skb->csum); 1402 data += fraggap; 1403 pskb_trim_unique(skb_prev, maxfraglen); 1404 } 1405 copy = datalen - transhdrlen - fraggap; 1406 1407 if (copy < 0) { 1408 err = -EINVAL; 1409 kfree_skb(skb); 1410 goto error; 1411 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) { 1412 err = -EFAULT; 1413 kfree_skb(skb); 1414 goto error; 1415 } 1416 1417 offset += copy; 1418 length -= datalen - fraggap; 1419 transhdrlen = 0; 1420 exthdrlen = 0; 1421 dst_exthdrlen = 0; 1422 1423 /* 1424 * Put the packet on the pending queue 1425 */ 1426 __skb_queue_tail(&sk->sk_write_queue, skb); 1427 continue; 1428 } 1429 1430 if (copy > length) 1431 copy = length; 1432 1433 if (!(rt->dst.dev->features&NETIF_F_SG)) { 1434 unsigned int off; 1435 1436 off = skb->len; 1437 if (getfrag(from, skb_put(skb, copy), 1438 offset, copy, off, skb) < 0) { 1439 __skb_trim(skb, off); 1440 err = -EFAULT; 1441 goto error; 1442 } 1443 } else { 1444 int i = skb_shinfo(skb)->nr_frags; 1445 struct page_frag *pfrag = sk_page_frag(sk); 1446 1447 err = -ENOMEM; 1448 if (!sk_page_frag_refill(sk, pfrag)) 1449 goto error; 1450 1451 if (!skb_can_coalesce(skb, i, pfrag->page, 1452 pfrag->offset)) { 1453 err = -EMSGSIZE; 1454 if (i == MAX_SKB_FRAGS) 1455 goto error; 1456 1457 __skb_fill_page_desc(skb, i, pfrag->page, 1458 pfrag->offset, 0); 1459 skb_shinfo(skb)->nr_frags = ++i; 1460 get_page(pfrag->page); 1461 } 1462 copy = min_t(int, copy, pfrag->size - pfrag->offset); 1463 if (getfrag(from, 1464 page_address(pfrag->page) + pfrag->offset, 1465 offset, copy, skb->len, skb) < 0) 1466 goto error_efault; 1467 1468 pfrag->offset += copy; 1469 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy); 1470 skb->len += copy; 1471 skb->data_len += copy; 1472 skb->truesize += copy; 1473 atomic_add(copy, &sk->sk_wmem_alloc); 1474 } 1475 offset += copy; 1476 length -= copy; 1477 } 1478 1479 return 0; 1480 1481 error_efault: 1482 err = -EFAULT; 1483 error: 1484 cork->length -= length; 1485 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); 1486 return err; 1487 } 1488 EXPORT_SYMBOL_GPL(ip6_append_data); 1489 1490 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np) 1491 { 1492 if (np->cork.opt) { 1493 kfree(np->cork.opt->dst0opt); 1494 kfree(np->cork.opt->dst1opt); 1495 kfree(np->cork.opt->hopopt); 1496 kfree(np->cork.opt->srcrt); 1497 kfree(np->cork.opt); 1498 np->cork.opt = NULL; 1499 } 1500 1501 if (inet->cork.base.dst) { 1502 dst_release(inet->cork.base.dst); 1503 inet->cork.base.dst = NULL; 1504 inet->cork.base.flags &= ~IPCORK_ALLFRAG; 1505 } 1506 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl)); 1507 } 1508 1509 int ip6_push_pending_frames(struct sock *sk) 1510 { 1511 struct sk_buff *skb, *tmp_skb; 1512 struct sk_buff **tail_skb; 1513 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf; 1514 struct inet_sock *inet = inet_sk(sk); 1515 struct ipv6_pinfo *np = inet6_sk(sk); 1516 struct net *net = sock_net(sk); 1517 struct ipv6hdr *hdr; 1518 struct ipv6_txoptions *opt = np->cork.opt; 1519 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst; 1520 struct flowi6 *fl6 = &inet->cork.fl.u.ip6; 1521 unsigned char proto = fl6->flowi6_proto; 1522 int err = 0; 1523 1524 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL) 1525 goto out; 1526 tail_skb = &(skb_shinfo(skb)->frag_list); 1527 1528 /* move skb->data to ip header from ext header */ 1529 if (skb->data < skb_network_header(skb)) 1530 __skb_pull(skb, skb_network_offset(skb)); 1531 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) { 1532 __skb_pull(tmp_skb, skb_network_header_len(skb)); 1533 *tail_skb = tmp_skb; 1534 tail_skb = &(tmp_skb->next); 1535 skb->len += tmp_skb->len; 1536 skb->data_len += tmp_skb->len; 1537 skb->truesize += tmp_skb->truesize; 1538 tmp_skb->destructor = NULL; 1539 tmp_skb->sk = NULL; 1540 } 1541 1542 /* Allow local fragmentation. */ 1543 skb->local_df = ip6_sk_local_df(sk); 1544 1545 *final_dst = fl6->daddr; 1546 __skb_pull(skb, skb_network_header_len(skb)); 1547 if (opt && opt->opt_flen) 1548 ipv6_push_frag_opts(skb, opt, &proto); 1549 if (opt && opt->opt_nflen) 1550 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst); 1551 1552 skb_push(skb, sizeof(struct ipv6hdr)); 1553 skb_reset_network_header(skb); 1554 hdr = ipv6_hdr(skb); 1555 1556 ip6_flow_hdr(hdr, np->cork.tclass, fl6->flowlabel); 1557 hdr->hop_limit = np->cork.hop_limit; 1558 hdr->nexthdr = proto; 1559 hdr->saddr = fl6->saddr; 1560 hdr->daddr = *final_dst; 1561 1562 skb->priority = sk->sk_priority; 1563 skb->mark = sk->sk_mark; 1564 1565 skb_dst_set(skb, dst_clone(&rt->dst)); 1566 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len); 1567 if (proto == IPPROTO_ICMPV6) { 1568 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); 1569 1570 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type); 1571 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); 1572 } 1573 1574 err = ip6_local_out(skb); 1575 if (err) { 1576 if (err > 0) 1577 err = net_xmit_errno(err); 1578 if (err) 1579 goto error; 1580 } 1581 1582 out: 1583 ip6_cork_release(inet, np); 1584 return err; 1585 error: 1586 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); 1587 goto out; 1588 } 1589 EXPORT_SYMBOL_GPL(ip6_push_pending_frames); 1590 1591 void ip6_flush_pending_frames(struct sock *sk) 1592 { 1593 struct sk_buff *skb; 1594 1595 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) { 1596 if (skb_dst(skb)) 1597 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)), 1598 IPSTATS_MIB_OUTDISCARDS); 1599 kfree_skb(skb); 1600 } 1601 1602 ip6_cork_release(inet_sk(sk), inet6_sk(sk)); 1603 } 1604 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames); 1605