1 /* 2 * IPv6 output functions 3 * Linux INET6 implementation 4 * 5 * Authors: 6 * Pedro Roque <roque@di.fc.ul.pt> 7 * 8 * Based on linux/net/ipv4/ip_output.c 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License 12 * as published by the Free Software Foundation; either version 13 * 2 of the License, or (at your option) any later version. 14 * 15 * Changes: 16 * A.N.Kuznetsov : airthmetics in fragmentation. 17 * extension headers are implemented. 18 * route changes now work. 19 * ip6_forward does not confuse sniffers. 20 * etc. 21 * 22 * H. von Brand : Added missing #include <linux/string.h> 23 * Imran Patel : frag id should be in NBO 24 * Kazunori MIYAZAWA @USAGI 25 * : add ip6_append_data and related functions 26 * for datagram xmit 27 */ 28 29 #include <linux/errno.h> 30 #include <linux/kernel.h> 31 #include <linux/string.h> 32 #include <linux/socket.h> 33 #include <linux/net.h> 34 #include <linux/netdevice.h> 35 #include <linux/if_arp.h> 36 #include <linux/in6.h> 37 #include <linux/tcp.h> 38 #include <linux/route.h> 39 #include <linux/module.h> 40 #include <linux/slab.h> 41 42 #include <linux/netfilter.h> 43 #include <linux/netfilter_ipv6.h> 44 45 #include <net/sock.h> 46 #include <net/snmp.h> 47 48 #include <net/ipv6.h> 49 #include <net/ndisc.h> 50 #include <net/protocol.h> 51 #include <net/ip6_route.h> 52 #include <net/addrconf.h> 53 #include <net/rawv6.h> 54 #include <net/icmp.h> 55 #include <net/xfrm.h> 56 #include <net/checksum.h> 57 #include <linux/mroute6.h> 58 59 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)); 60 61 int __ip6_local_out(struct sk_buff *skb) 62 { 63 int len; 64 65 len = skb->len - sizeof(struct ipv6hdr); 66 if (len > IPV6_MAXPLEN) 67 len = 0; 68 ipv6_hdr(skb)->payload_len = htons(len); 69 70 return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, 71 skb_dst(skb)->dev, dst_output); 72 } 73 74 int ip6_local_out(struct sk_buff *skb) 75 { 76 int err; 77 78 err = __ip6_local_out(skb); 79 if (likely(err == 1)) 80 err = dst_output(skb); 81 82 return err; 83 } 84 EXPORT_SYMBOL_GPL(ip6_local_out); 85 86 /* dev_loopback_xmit for use with netfilter. */ 87 static int ip6_dev_loopback_xmit(struct sk_buff *newskb) 88 { 89 skb_reset_mac_header(newskb); 90 __skb_pull(newskb, skb_network_offset(newskb)); 91 newskb->pkt_type = PACKET_LOOPBACK; 92 newskb->ip_summed = CHECKSUM_UNNECESSARY; 93 WARN_ON(!skb_dst(newskb)); 94 95 netif_rx_ni(newskb); 96 return 0; 97 } 98 99 static int ip6_finish_output2(struct sk_buff *skb) 100 { 101 struct dst_entry *dst = skb_dst(skb); 102 struct net_device *dev = dst->dev; 103 104 skb->protocol = htons(ETH_P_IPV6); 105 skb->dev = dev; 106 107 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) { 108 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); 109 110 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) && 111 ((mroute6_socket(dev_net(dev), skb) && 112 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) || 113 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr, 114 &ipv6_hdr(skb)->saddr))) { 115 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC); 116 117 /* Do not check for IFF_ALLMULTI; multicast routing 118 is not supported in any case. 119 */ 120 if (newskb) 121 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, 122 newskb, NULL, newskb->dev, 123 ip6_dev_loopback_xmit); 124 125 if (ipv6_hdr(skb)->hop_limit == 0) { 126 IP6_INC_STATS(dev_net(dev), idev, 127 IPSTATS_MIB_OUTDISCARDS); 128 kfree_skb(skb); 129 return 0; 130 } 131 } 132 133 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST, 134 skb->len); 135 } 136 137 if (dst->hh) 138 return neigh_hh_output(dst->hh, skb); 139 else if (dst->neighbour) 140 return dst->neighbour->output(skb); 141 142 IP6_INC_STATS_BH(dev_net(dst->dev), 143 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); 144 kfree_skb(skb); 145 return -EINVAL; 146 } 147 148 static int ip6_finish_output(struct sk_buff *skb) 149 { 150 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) || 151 dst_allfrag(skb_dst(skb))) 152 return ip6_fragment(skb, ip6_finish_output2); 153 else 154 return ip6_finish_output2(skb); 155 } 156 157 int ip6_output(struct sk_buff *skb) 158 { 159 struct net_device *dev = skb_dst(skb)->dev; 160 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); 161 if (unlikely(idev->cnf.disable_ipv6)) { 162 IP6_INC_STATS(dev_net(dev), idev, 163 IPSTATS_MIB_OUTDISCARDS); 164 kfree_skb(skb); 165 return 0; 166 } 167 168 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev, 169 ip6_finish_output, 170 !(IP6CB(skb)->flags & IP6SKB_REROUTED)); 171 } 172 173 /* 174 * xmit an sk_buff (used by TCP, SCTP and DCCP) 175 */ 176 177 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl, 178 struct ipv6_txoptions *opt) 179 { 180 struct net *net = sock_net(sk); 181 struct ipv6_pinfo *np = inet6_sk(sk); 182 struct in6_addr *first_hop = &fl->fl6_dst; 183 struct dst_entry *dst = skb_dst(skb); 184 struct ipv6hdr *hdr; 185 u8 proto = fl->proto; 186 int seg_len = skb->len; 187 int hlimit = -1; 188 int tclass = 0; 189 u32 mtu; 190 191 if (opt) { 192 unsigned int head_room; 193 194 /* First: exthdrs may take lots of space (~8K for now) 195 MAX_HEADER is not enough. 196 */ 197 head_room = opt->opt_nflen + opt->opt_flen; 198 seg_len += head_room; 199 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev); 200 201 if (skb_headroom(skb) < head_room) { 202 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room); 203 if (skb2 == NULL) { 204 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 205 IPSTATS_MIB_OUTDISCARDS); 206 kfree_skb(skb); 207 return -ENOBUFS; 208 } 209 kfree_skb(skb); 210 skb = skb2; 211 skb_set_owner_w(skb, sk); 212 } 213 if (opt->opt_flen) 214 ipv6_push_frag_opts(skb, opt, &proto); 215 if (opt->opt_nflen) 216 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop); 217 } 218 219 skb_push(skb, sizeof(struct ipv6hdr)); 220 skb_reset_network_header(skb); 221 hdr = ipv6_hdr(skb); 222 223 /* 224 * Fill in the IPv6 header 225 */ 226 if (np) { 227 tclass = np->tclass; 228 hlimit = np->hop_limit; 229 } 230 if (hlimit < 0) 231 hlimit = ip6_dst_hoplimit(dst); 232 233 *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel; 234 235 hdr->payload_len = htons(seg_len); 236 hdr->nexthdr = proto; 237 hdr->hop_limit = hlimit; 238 239 ipv6_addr_copy(&hdr->saddr, &fl->fl6_src); 240 ipv6_addr_copy(&hdr->daddr, first_hop); 241 242 skb->priority = sk->sk_priority; 243 skb->mark = sk->sk_mark; 244 245 mtu = dst_mtu(dst); 246 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) { 247 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)), 248 IPSTATS_MIB_OUT, skb->len); 249 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, 250 dst->dev, dst_output); 251 } 252 253 if (net_ratelimit()) 254 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n"); 255 skb->dev = dst->dev; 256 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 257 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS); 258 kfree_skb(skb); 259 return -EMSGSIZE; 260 } 261 262 EXPORT_SYMBOL(ip6_xmit); 263 264 /* 265 * To avoid extra problems ND packets are send through this 266 * routine. It's code duplication but I really want to avoid 267 * extra checks since ipv6_build_header is used by TCP (which 268 * is for us performance critical) 269 */ 270 271 int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev, 272 const struct in6_addr *saddr, const struct in6_addr *daddr, 273 int proto, int len) 274 { 275 struct ipv6_pinfo *np = inet6_sk(sk); 276 struct ipv6hdr *hdr; 277 int totlen; 278 279 skb->protocol = htons(ETH_P_IPV6); 280 skb->dev = dev; 281 282 totlen = len + sizeof(struct ipv6hdr); 283 284 skb_reset_network_header(skb); 285 skb_put(skb, sizeof(struct ipv6hdr)); 286 hdr = ipv6_hdr(skb); 287 288 *(__be32*)hdr = htonl(0x60000000); 289 290 hdr->payload_len = htons(len); 291 hdr->nexthdr = proto; 292 hdr->hop_limit = np->hop_limit; 293 294 ipv6_addr_copy(&hdr->saddr, saddr); 295 ipv6_addr_copy(&hdr->daddr, daddr); 296 297 return 0; 298 } 299 300 static int ip6_call_ra_chain(struct sk_buff *skb, int sel) 301 { 302 struct ip6_ra_chain *ra; 303 struct sock *last = NULL; 304 305 read_lock(&ip6_ra_lock); 306 for (ra = ip6_ra_chain; ra; ra = ra->next) { 307 struct sock *sk = ra->sk; 308 if (sk && ra->sel == sel && 309 (!sk->sk_bound_dev_if || 310 sk->sk_bound_dev_if == skb->dev->ifindex)) { 311 if (last) { 312 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC); 313 if (skb2) 314 rawv6_rcv(last, skb2); 315 } 316 last = sk; 317 } 318 } 319 320 if (last) { 321 rawv6_rcv(last, skb); 322 read_unlock(&ip6_ra_lock); 323 return 1; 324 } 325 read_unlock(&ip6_ra_lock); 326 return 0; 327 } 328 329 static int ip6_forward_proxy_check(struct sk_buff *skb) 330 { 331 struct ipv6hdr *hdr = ipv6_hdr(skb); 332 u8 nexthdr = hdr->nexthdr; 333 int offset; 334 335 if (ipv6_ext_hdr(nexthdr)) { 336 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr); 337 if (offset < 0) 338 return 0; 339 } else 340 offset = sizeof(struct ipv6hdr); 341 342 if (nexthdr == IPPROTO_ICMPV6) { 343 struct icmp6hdr *icmp6; 344 345 if (!pskb_may_pull(skb, (skb_network_header(skb) + 346 offset + 1 - skb->data))) 347 return 0; 348 349 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset); 350 351 switch (icmp6->icmp6_type) { 352 case NDISC_ROUTER_SOLICITATION: 353 case NDISC_ROUTER_ADVERTISEMENT: 354 case NDISC_NEIGHBOUR_SOLICITATION: 355 case NDISC_NEIGHBOUR_ADVERTISEMENT: 356 case NDISC_REDIRECT: 357 /* For reaction involving unicast neighbor discovery 358 * message destined to the proxied address, pass it to 359 * input function. 360 */ 361 return 1; 362 default: 363 break; 364 } 365 } 366 367 /* 368 * The proxying router can't forward traffic sent to a link-local 369 * address, so signal the sender and discard the packet. This 370 * behavior is clarified by the MIPv6 specification. 371 */ 372 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) { 373 dst_link_failure(skb); 374 return -1; 375 } 376 377 return 0; 378 } 379 380 static inline int ip6_forward_finish(struct sk_buff *skb) 381 { 382 return dst_output(skb); 383 } 384 385 int ip6_forward(struct sk_buff *skb) 386 { 387 struct dst_entry *dst = skb_dst(skb); 388 struct ipv6hdr *hdr = ipv6_hdr(skb); 389 struct inet6_skb_parm *opt = IP6CB(skb); 390 struct net *net = dev_net(dst->dev); 391 u32 mtu; 392 393 if (net->ipv6.devconf_all->forwarding == 0) 394 goto error; 395 396 if (skb_warn_if_lro(skb)) 397 goto drop; 398 399 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) { 400 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS); 401 goto drop; 402 } 403 404 skb_forward_csum(skb); 405 406 /* 407 * We DO NOT make any processing on 408 * RA packets, pushing them to user level AS IS 409 * without ane WARRANTY that application will be able 410 * to interpret them. The reason is that we 411 * cannot make anything clever here. 412 * 413 * We are not end-node, so that if packet contains 414 * AH/ESP, we cannot make anything. 415 * Defragmentation also would be mistake, RA packets 416 * cannot be fragmented, because there is no warranty 417 * that different fragments will go along one path. --ANK 418 */ 419 if (opt->ra) { 420 u8 *ptr = skb_network_header(skb) + opt->ra; 421 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3])) 422 return 0; 423 } 424 425 /* 426 * check and decrement ttl 427 */ 428 if (hdr->hop_limit <= 1) { 429 /* Force OUTPUT device used as source address */ 430 skb->dev = dst->dev; 431 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0); 432 IP6_INC_STATS_BH(net, 433 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS); 434 435 kfree_skb(skb); 436 return -ETIMEDOUT; 437 } 438 439 /* XXX: idev->cnf.proxy_ndp? */ 440 if (net->ipv6.devconf_all->proxy_ndp && 441 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) { 442 int proxied = ip6_forward_proxy_check(skb); 443 if (proxied > 0) 444 return ip6_input(skb); 445 else if (proxied < 0) { 446 IP6_INC_STATS(net, ip6_dst_idev(dst), 447 IPSTATS_MIB_INDISCARDS); 448 goto drop; 449 } 450 } 451 452 if (!xfrm6_route_forward(skb)) { 453 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS); 454 goto drop; 455 } 456 dst = skb_dst(skb); 457 458 /* IPv6 specs say nothing about it, but it is clear that we cannot 459 send redirects to source routed frames. 460 We don't send redirects to frames decapsulated from IPsec. 461 */ 462 if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 && 463 !skb_sec_path(skb)) { 464 struct in6_addr *target = NULL; 465 struct rt6_info *rt; 466 struct neighbour *n = dst->neighbour; 467 468 /* 469 * incoming and outgoing devices are the same 470 * send a redirect. 471 */ 472 473 rt = (struct rt6_info *) dst; 474 if ((rt->rt6i_flags & RTF_GATEWAY)) 475 target = (struct in6_addr*)&n->primary_key; 476 else 477 target = &hdr->daddr; 478 479 /* Limit redirects both by destination (here) 480 and by source (inside ndisc_send_redirect) 481 */ 482 if (xrlim_allow(dst, 1*HZ)) 483 ndisc_send_redirect(skb, n, target); 484 } else { 485 int addrtype = ipv6_addr_type(&hdr->saddr); 486 487 /* This check is security critical. */ 488 if (addrtype == IPV6_ADDR_ANY || 489 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK)) 490 goto error; 491 if (addrtype & IPV6_ADDR_LINKLOCAL) { 492 icmpv6_send(skb, ICMPV6_DEST_UNREACH, 493 ICMPV6_NOT_NEIGHBOUR, 0); 494 goto error; 495 } 496 } 497 498 mtu = dst_mtu(dst); 499 if (mtu < IPV6_MIN_MTU) 500 mtu = IPV6_MIN_MTU; 501 502 if (skb->len > mtu && !skb_is_gso(skb)) { 503 /* Again, force OUTPUT device used as source address */ 504 skb->dev = dst->dev; 505 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 506 IP6_INC_STATS_BH(net, 507 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS); 508 IP6_INC_STATS_BH(net, 509 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS); 510 kfree_skb(skb); 511 return -EMSGSIZE; 512 } 513 514 if (skb_cow(skb, dst->dev->hard_header_len)) { 515 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS); 516 goto drop; 517 } 518 519 hdr = ipv6_hdr(skb); 520 521 /* Mangling hops number delayed to point after skb COW */ 522 523 hdr->hop_limit--; 524 525 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); 526 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev, 527 ip6_forward_finish); 528 529 error: 530 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS); 531 drop: 532 kfree_skb(skb); 533 return -EINVAL; 534 } 535 536 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from) 537 { 538 to->pkt_type = from->pkt_type; 539 to->priority = from->priority; 540 to->protocol = from->protocol; 541 skb_dst_drop(to); 542 skb_dst_set(to, dst_clone(skb_dst(from))); 543 to->dev = from->dev; 544 to->mark = from->mark; 545 546 #ifdef CONFIG_NET_SCHED 547 to->tc_index = from->tc_index; 548 #endif 549 nf_copy(to, from); 550 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \ 551 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE) 552 to->nf_trace = from->nf_trace; 553 #endif 554 skb_copy_secmark(to, from); 555 } 556 557 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) 558 { 559 u16 offset = sizeof(struct ipv6hdr); 560 struct ipv6_opt_hdr *exthdr = 561 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1); 562 unsigned int packet_len = skb->tail - skb->network_header; 563 int found_rhdr = 0; 564 *nexthdr = &ipv6_hdr(skb)->nexthdr; 565 566 while (offset + 1 <= packet_len) { 567 568 switch (**nexthdr) { 569 570 case NEXTHDR_HOP: 571 break; 572 case NEXTHDR_ROUTING: 573 found_rhdr = 1; 574 break; 575 case NEXTHDR_DEST: 576 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 577 if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0) 578 break; 579 #endif 580 if (found_rhdr) 581 return offset; 582 break; 583 default : 584 return offset; 585 } 586 587 offset += ipv6_optlen(exthdr); 588 *nexthdr = &exthdr->nexthdr; 589 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + 590 offset); 591 } 592 593 return offset; 594 } 595 596 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *)) 597 { 598 struct sk_buff *frag; 599 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb); 600 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL; 601 struct ipv6hdr *tmp_hdr; 602 struct frag_hdr *fh; 603 unsigned int mtu, hlen, left, len; 604 __be32 frag_id = 0; 605 int ptr, offset = 0, err=0; 606 u8 *prevhdr, nexthdr = 0; 607 struct net *net = dev_net(skb_dst(skb)->dev); 608 609 hlen = ip6_find_1stfragopt(skb, &prevhdr); 610 nexthdr = *prevhdr; 611 612 mtu = ip6_skb_dst_mtu(skb); 613 614 /* We must not fragment if the socket is set to force MTU discovery 615 * or if the skb it not generated by a local socket. 616 */ 617 if (!skb->local_df && skb->len > mtu) { 618 skb->dev = skb_dst(skb)->dev; 619 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); 620 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 621 IPSTATS_MIB_FRAGFAILS); 622 kfree_skb(skb); 623 return -EMSGSIZE; 624 } 625 626 if (np && np->frag_size < mtu) { 627 if (np->frag_size) 628 mtu = np->frag_size; 629 } 630 mtu -= hlen + sizeof(struct frag_hdr); 631 632 if (skb_has_frag_list(skb)) { 633 int first_len = skb_pagelen(skb); 634 struct sk_buff *frag2; 635 636 if (first_len - hlen > mtu || 637 ((first_len - hlen) & 7) || 638 skb_cloned(skb)) 639 goto slow_path; 640 641 skb_walk_frags(skb, frag) { 642 /* Correct geometry. */ 643 if (frag->len > mtu || 644 ((frag->len & 7) && frag->next) || 645 skb_headroom(frag) < hlen) 646 goto slow_path_clean; 647 648 /* Partially cloned skb? */ 649 if (skb_shared(frag)) 650 goto slow_path_clean; 651 652 BUG_ON(frag->sk); 653 if (skb->sk) { 654 frag->sk = skb->sk; 655 frag->destructor = sock_wfree; 656 } 657 skb->truesize -= frag->truesize; 658 } 659 660 err = 0; 661 offset = 0; 662 frag = skb_shinfo(skb)->frag_list; 663 skb_frag_list_init(skb); 664 /* BUILD HEADER */ 665 666 *prevhdr = NEXTHDR_FRAGMENT; 667 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC); 668 if (!tmp_hdr) { 669 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 670 IPSTATS_MIB_FRAGFAILS); 671 return -ENOMEM; 672 } 673 674 __skb_pull(skb, hlen); 675 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr)); 676 __skb_push(skb, hlen); 677 skb_reset_network_header(skb); 678 memcpy(skb_network_header(skb), tmp_hdr, hlen); 679 680 ipv6_select_ident(fh); 681 fh->nexthdr = nexthdr; 682 fh->reserved = 0; 683 fh->frag_off = htons(IP6_MF); 684 frag_id = fh->identification; 685 686 first_len = skb_pagelen(skb); 687 skb->data_len = first_len - skb_headlen(skb); 688 skb->len = first_len; 689 ipv6_hdr(skb)->payload_len = htons(first_len - 690 sizeof(struct ipv6hdr)); 691 692 dst_hold(&rt->dst); 693 694 for (;;) { 695 /* Prepare header of the next frame, 696 * before previous one went down. */ 697 if (frag) { 698 frag->ip_summed = CHECKSUM_NONE; 699 skb_reset_transport_header(frag); 700 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr)); 701 __skb_push(frag, hlen); 702 skb_reset_network_header(frag); 703 memcpy(skb_network_header(frag), tmp_hdr, 704 hlen); 705 offset += skb->len - hlen - sizeof(struct frag_hdr); 706 fh->nexthdr = nexthdr; 707 fh->reserved = 0; 708 fh->frag_off = htons(offset); 709 if (frag->next != NULL) 710 fh->frag_off |= htons(IP6_MF); 711 fh->identification = frag_id; 712 ipv6_hdr(frag)->payload_len = 713 htons(frag->len - 714 sizeof(struct ipv6hdr)); 715 ip6_copy_metadata(frag, skb); 716 } 717 718 err = output(skb); 719 if(!err) 720 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst), 721 IPSTATS_MIB_FRAGCREATES); 722 723 if (err || !frag) 724 break; 725 726 skb = frag; 727 frag = skb->next; 728 skb->next = NULL; 729 } 730 731 kfree(tmp_hdr); 732 733 if (err == 0) { 734 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst), 735 IPSTATS_MIB_FRAGOKS); 736 dst_release(&rt->dst); 737 return 0; 738 } 739 740 while (frag) { 741 skb = frag->next; 742 kfree_skb(frag); 743 frag = skb; 744 } 745 746 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst), 747 IPSTATS_MIB_FRAGFAILS); 748 dst_release(&rt->dst); 749 return err; 750 751 slow_path_clean: 752 skb_walk_frags(skb, frag2) { 753 if (frag2 == frag) 754 break; 755 frag2->sk = NULL; 756 frag2->destructor = NULL; 757 skb->truesize += frag2->truesize; 758 } 759 } 760 761 slow_path: 762 left = skb->len - hlen; /* Space per frame */ 763 ptr = hlen; /* Where to start from */ 764 765 /* 766 * Fragment the datagram. 767 */ 768 769 *prevhdr = NEXTHDR_FRAGMENT; 770 771 /* 772 * Keep copying data until we run out. 773 */ 774 while(left > 0) { 775 len = left; 776 /* IF: it doesn't fit, use 'mtu' - the data space left */ 777 if (len > mtu) 778 len = mtu; 779 /* IF: we are not sending upto and including the packet end 780 then align the next start on an eight byte boundary */ 781 if (len < left) { 782 len &= ~7; 783 } 784 /* 785 * Allocate buffer. 786 */ 787 788 if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_ALLOCATED_SPACE(rt->dst.dev), GFP_ATOMIC)) == NULL) { 789 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n"); 790 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 791 IPSTATS_MIB_FRAGFAILS); 792 err = -ENOMEM; 793 goto fail; 794 } 795 796 /* 797 * Set up data on packet 798 */ 799 800 ip6_copy_metadata(frag, skb); 801 skb_reserve(frag, LL_RESERVED_SPACE(rt->dst.dev)); 802 skb_put(frag, len + hlen + sizeof(struct frag_hdr)); 803 skb_reset_network_header(frag); 804 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen); 805 frag->transport_header = (frag->network_header + hlen + 806 sizeof(struct frag_hdr)); 807 808 /* 809 * Charge the memory for the fragment to any owner 810 * it might possess 811 */ 812 if (skb->sk) 813 skb_set_owner_w(frag, skb->sk); 814 815 /* 816 * Copy the packet header into the new buffer. 817 */ 818 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen); 819 820 /* 821 * Build fragment header. 822 */ 823 fh->nexthdr = nexthdr; 824 fh->reserved = 0; 825 if (!frag_id) { 826 ipv6_select_ident(fh); 827 frag_id = fh->identification; 828 } else 829 fh->identification = frag_id; 830 831 /* 832 * Copy a block of the IP datagram. 833 */ 834 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len)) 835 BUG(); 836 left -= len; 837 838 fh->frag_off = htons(offset); 839 if (left > 0) 840 fh->frag_off |= htons(IP6_MF); 841 ipv6_hdr(frag)->payload_len = htons(frag->len - 842 sizeof(struct ipv6hdr)); 843 844 ptr += len; 845 offset += len; 846 847 /* 848 * Put this fragment into the sending queue. 849 */ 850 err = output(frag); 851 if (err) 852 goto fail; 853 854 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 855 IPSTATS_MIB_FRAGCREATES); 856 } 857 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 858 IPSTATS_MIB_FRAGOKS); 859 kfree_skb(skb); 860 return err; 861 862 fail: 863 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), 864 IPSTATS_MIB_FRAGFAILS); 865 kfree_skb(skb); 866 return err; 867 } 868 869 static inline int ip6_rt_check(struct rt6key *rt_key, 870 struct in6_addr *fl_addr, 871 struct in6_addr *addr_cache) 872 { 873 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) && 874 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)); 875 } 876 877 static struct dst_entry *ip6_sk_dst_check(struct sock *sk, 878 struct dst_entry *dst, 879 struct flowi *fl) 880 { 881 struct ipv6_pinfo *np = inet6_sk(sk); 882 struct rt6_info *rt = (struct rt6_info *)dst; 883 884 if (!dst) 885 goto out; 886 887 /* Yes, checking route validity in not connected 888 * case is not very simple. Take into account, 889 * that we do not support routing by source, TOS, 890 * and MSG_DONTROUTE --ANK (980726) 891 * 892 * 1. ip6_rt_check(): If route was host route, 893 * check that cached destination is current. 894 * If it is network route, we still may 895 * check its validity using saved pointer 896 * to the last used address: daddr_cache. 897 * We do not want to save whole address now, 898 * (because main consumer of this service 899 * is tcp, which has not this problem), 900 * so that the last trick works only on connected 901 * sockets. 902 * 2. oif also should be the same. 903 */ 904 if (ip6_rt_check(&rt->rt6i_dst, &fl->fl6_dst, np->daddr_cache) || 905 #ifdef CONFIG_IPV6_SUBTREES 906 ip6_rt_check(&rt->rt6i_src, &fl->fl6_src, np->saddr_cache) || 907 #endif 908 (fl->oif && fl->oif != dst->dev->ifindex)) { 909 dst_release(dst); 910 dst = NULL; 911 } 912 913 out: 914 return dst; 915 } 916 917 static int ip6_dst_lookup_tail(struct sock *sk, 918 struct dst_entry **dst, struct flowi *fl) 919 { 920 int err; 921 struct net *net = sock_net(sk); 922 923 if (*dst == NULL) 924 *dst = ip6_route_output(net, sk, fl); 925 926 if ((err = (*dst)->error)) 927 goto out_err_release; 928 929 if (ipv6_addr_any(&fl->fl6_src)) { 930 err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev, 931 &fl->fl6_dst, 932 sk ? inet6_sk(sk)->srcprefs : 0, 933 &fl->fl6_src); 934 if (err) 935 goto out_err_release; 936 } 937 938 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD 939 /* 940 * Here if the dst entry we've looked up 941 * has a neighbour entry that is in the INCOMPLETE 942 * state and the src address from the flow is 943 * marked as OPTIMISTIC, we release the found 944 * dst entry and replace it instead with the 945 * dst entry of the nexthop router 946 */ 947 if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) { 948 struct inet6_ifaddr *ifp; 949 struct flowi fl_gw; 950 int redirect; 951 952 ifp = ipv6_get_ifaddr(net, &fl->fl6_src, 953 (*dst)->dev, 1); 954 955 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC); 956 if (ifp) 957 in6_ifa_put(ifp); 958 959 if (redirect) { 960 /* 961 * We need to get the dst entry for the 962 * default router instead 963 */ 964 dst_release(*dst); 965 memcpy(&fl_gw, fl, sizeof(struct flowi)); 966 memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr)); 967 *dst = ip6_route_output(net, sk, &fl_gw); 968 if ((err = (*dst)->error)) 969 goto out_err_release; 970 } 971 } 972 #endif 973 974 return 0; 975 976 out_err_release: 977 if (err == -ENETUNREACH) 978 IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES); 979 dst_release(*dst); 980 *dst = NULL; 981 return err; 982 } 983 984 /** 985 * ip6_dst_lookup - perform route lookup on flow 986 * @sk: socket which provides route info 987 * @dst: pointer to dst_entry * for result 988 * @fl: flow to lookup 989 * 990 * This function performs a route lookup on the given flow. 991 * 992 * It returns zero on success, or a standard errno code on error. 993 */ 994 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl) 995 { 996 *dst = NULL; 997 return ip6_dst_lookup_tail(sk, dst, fl); 998 } 999 EXPORT_SYMBOL_GPL(ip6_dst_lookup); 1000 1001 /** 1002 * ip6_sk_dst_lookup - perform socket cached route lookup on flow 1003 * @sk: socket which provides the dst cache and route info 1004 * @dst: pointer to dst_entry * for result 1005 * @fl: flow to lookup 1006 * 1007 * This function performs a route lookup on the given flow with the 1008 * possibility of using the cached route in the socket if it is valid. 1009 * It will take the socket dst lock when operating on the dst cache. 1010 * As a result, this function can only be used in process context. 1011 * 1012 * It returns zero on success, or a standard errno code on error. 1013 */ 1014 int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl) 1015 { 1016 *dst = NULL; 1017 if (sk) { 1018 *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie); 1019 *dst = ip6_sk_dst_check(sk, *dst, fl); 1020 } 1021 1022 return ip6_dst_lookup_tail(sk, dst, fl); 1023 } 1024 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup); 1025 1026 static inline int ip6_ufo_append_data(struct sock *sk, 1027 int getfrag(void *from, char *to, int offset, int len, 1028 int odd, struct sk_buff *skb), 1029 void *from, int length, int hh_len, int fragheaderlen, 1030 int transhdrlen, int mtu,unsigned int flags) 1031 1032 { 1033 struct sk_buff *skb; 1034 int err; 1035 1036 /* There is support for UDP large send offload by network 1037 * device, so create one single skb packet containing complete 1038 * udp datagram 1039 */ 1040 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) { 1041 skb = sock_alloc_send_skb(sk, 1042 hh_len + fragheaderlen + transhdrlen + 20, 1043 (flags & MSG_DONTWAIT), &err); 1044 if (skb == NULL) 1045 return -ENOMEM; 1046 1047 /* reserve space for Hardware header */ 1048 skb_reserve(skb, hh_len); 1049 1050 /* create space for UDP/IP header */ 1051 skb_put(skb,fragheaderlen + transhdrlen); 1052 1053 /* initialize network header pointer */ 1054 skb_reset_network_header(skb); 1055 1056 /* initialize protocol header pointer */ 1057 skb->transport_header = skb->network_header + fragheaderlen; 1058 1059 skb->ip_summed = CHECKSUM_PARTIAL; 1060 skb->csum = 0; 1061 sk->sk_sndmsg_off = 0; 1062 } 1063 1064 err = skb_append_datato_frags(sk,skb, getfrag, from, 1065 (length - transhdrlen)); 1066 if (!err) { 1067 struct frag_hdr fhdr; 1068 1069 /* Specify the length of each IPv6 datagram fragment. 1070 * It has to be a multiple of 8. 1071 */ 1072 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen - 1073 sizeof(struct frag_hdr)) & ~7; 1074 skb_shinfo(skb)->gso_type = SKB_GSO_UDP; 1075 ipv6_select_ident(&fhdr); 1076 skb_shinfo(skb)->ip6_frag_id = fhdr.identification; 1077 __skb_queue_tail(&sk->sk_write_queue, skb); 1078 1079 return 0; 1080 } 1081 /* There is not enough support do UPD LSO, 1082 * so follow normal path 1083 */ 1084 kfree_skb(skb); 1085 1086 return err; 1087 } 1088 1089 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src, 1090 gfp_t gfp) 1091 { 1092 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL; 1093 } 1094 1095 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src, 1096 gfp_t gfp) 1097 { 1098 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL; 1099 } 1100 1101 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, 1102 int offset, int len, int odd, struct sk_buff *skb), 1103 void *from, int length, int transhdrlen, 1104 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl, 1105 struct rt6_info *rt, unsigned int flags, int dontfrag) 1106 { 1107 struct inet_sock *inet = inet_sk(sk); 1108 struct ipv6_pinfo *np = inet6_sk(sk); 1109 struct sk_buff *skb; 1110 unsigned int maxfraglen, fragheaderlen; 1111 int exthdrlen; 1112 int hh_len; 1113 int mtu; 1114 int copy; 1115 int err; 1116 int offset = 0; 1117 int csummode = CHECKSUM_NONE; 1118 1119 if (flags&MSG_PROBE) 1120 return 0; 1121 if (skb_queue_empty(&sk->sk_write_queue)) { 1122 /* 1123 * setup for corking 1124 */ 1125 if (opt) { 1126 if (WARN_ON(np->cork.opt)) 1127 return -EINVAL; 1128 1129 np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation); 1130 if (unlikely(np->cork.opt == NULL)) 1131 return -ENOBUFS; 1132 1133 np->cork.opt->tot_len = opt->tot_len; 1134 np->cork.opt->opt_flen = opt->opt_flen; 1135 np->cork.opt->opt_nflen = opt->opt_nflen; 1136 1137 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt, 1138 sk->sk_allocation); 1139 if (opt->dst0opt && !np->cork.opt->dst0opt) 1140 return -ENOBUFS; 1141 1142 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt, 1143 sk->sk_allocation); 1144 if (opt->dst1opt && !np->cork.opt->dst1opt) 1145 return -ENOBUFS; 1146 1147 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt, 1148 sk->sk_allocation); 1149 if (opt->hopopt && !np->cork.opt->hopopt) 1150 return -ENOBUFS; 1151 1152 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt, 1153 sk->sk_allocation); 1154 if (opt->srcrt && !np->cork.opt->srcrt) 1155 return -ENOBUFS; 1156 1157 /* need source address above miyazawa*/ 1158 } 1159 dst_hold(&rt->dst); 1160 inet->cork.dst = &rt->dst; 1161 inet->cork.fl = *fl; 1162 np->cork.hop_limit = hlimit; 1163 np->cork.tclass = tclass; 1164 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ? 1165 rt->dst.dev->mtu : dst_mtu(rt->dst.path); 1166 if (np->frag_size < mtu) { 1167 if (np->frag_size) 1168 mtu = np->frag_size; 1169 } 1170 inet->cork.fragsize = mtu; 1171 if (dst_allfrag(rt->dst.path)) 1172 inet->cork.flags |= IPCORK_ALLFRAG; 1173 inet->cork.length = 0; 1174 sk->sk_sndmsg_page = NULL; 1175 sk->sk_sndmsg_off = 0; 1176 exthdrlen = rt->dst.header_len + (opt ? opt->opt_flen : 0) - 1177 rt->rt6i_nfheader_len; 1178 length += exthdrlen; 1179 transhdrlen += exthdrlen; 1180 } else { 1181 rt = (struct rt6_info *)inet->cork.dst; 1182 fl = &inet->cork.fl; 1183 opt = np->cork.opt; 1184 transhdrlen = 0; 1185 exthdrlen = 0; 1186 mtu = inet->cork.fragsize; 1187 } 1188 1189 hh_len = LL_RESERVED_SPACE(rt->dst.dev); 1190 1191 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len + 1192 (opt ? opt->opt_nflen : 0); 1193 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr); 1194 1195 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) { 1196 if (inet->cork.length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) { 1197 ipv6_local_error(sk, EMSGSIZE, fl, mtu-exthdrlen); 1198 return -EMSGSIZE; 1199 } 1200 } 1201 1202 /* 1203 * Let's try using as much space as possible. 1204 * Use MTU if total length of the message fits into the MTU. 1205 * Otherwise, we need to reserve fragment header and 1206 * fragment alignment (= 8-15 octects, in total). 1207 * 1208 * Note that we may need to "move" the data from the tail of 1209 * of the buffer to the new fragment when we split 1210 * the message. 1211 * 1212 * FIXME: It may be fragmented into multiple chunks 1213 * at once if non-fragmentable extension headers 1214 * are too large. 1215 * --yoshfuji 1216 */ 1217 1218 inet->cork.length += length; 1219 if (length > mtu) { 1220 int proto = sk->sk_protocol; 1221 if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){ 1222 ipv6_local_rxpmtu(sk, fl, mtu-exthdrlen); 1223 return -EMSGSIZE; 1224 } 1225 1226 if (proto == IPPROTO_UDP && 1227 (rt->dst.dev->features & NETIF_F_UFO)) { 1228 1229 err = ip6_ufo_append_data(sk, getfrag, from, length, 1230 hh_len, fragheaderlen, 1231 transhdrlen, mtu, flags); 1232 if (err) 1233 goto error; 1234 return 0; 1235 } 1236 } 1237 1238 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) 1239 goto alloc_new_skb; 1240 1241 while (length > 0) { 1242 /* Check if the remaining data fits into current packet. */ 1243 copy = (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len; 1244 if (copy < length) 1245 copy = maxfraglen - skb->len; 1246 1247 if (copy <= 0) { 1248 char *data; 1249 unsigned int datalen; 1250 unsigned int fraglen; 1251 unsigned int fraggap; 1252 unsigned int alloclen; 1253 struct sk_buff *skb_prev; 1254 alloc_new_skb: 1255 skb_prev = skb; 1256 1257 /* There's no room in the current skb */ 1258 if (skb_prev) 1259 fraggap = skb_prev->len - maxfraglen; 1260 else 1261 fraggap = 0; 1262 1263 /* 1264 * If remaining data exceeds the mtu, 1265 * we know we need more fragment(s). 1266 */ 1267 datalen = length + fraggap; 1268 if (datalen > (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen) 1269 datalen = maxfraglen - fragheaderlen; 1270 1271 fraglen = datalen + fragheaderlen; 1272 if ((flags & MSG_MORE) && 1273 !(rt->dst.dev->features&NETIF_F_SG)) 1274 alloclen = mtu; 1275 else 1276 alloclen = datalen + fragheaderlen; 1277 1278 /* 1279 * The last fragment gets additional space at tail. 1280 * Note: we overallocate on fragments with MSG_MODE 1281 * because we have no idea if we're the last one. 1282 */ 1283 if (datalen == length + fraggap) 1284 alloclen += rt->dst.trailer_len; 1285 1286 /* 1287 * We just reserve space for fragment header. 1288 * Note: this may be overallocation if the message 1289 * (without MSG_MORE) fits into the MTU. 1290 */ 1291 alloclen += sizeof(struct frag_hdr); 1292 1293 if (transhdrlen) { 1294 skb = sock_alloc_send_skb(sk, 1295 alloclen + hh_len, 1296 (flags & MSG_DONTWAIT), &err); 1297 } else { 1298 skb = NULL; 1299 if (atomic_read(&sk->sk_wmem_alloc) <= 1300 2 * sk->sk_sndbuf) 1301 skb = sock_wmalloc(sk, 1302 alloclen + hh_len, 1, 1303 sk->sk_allocation); 1304 if (unlikely(skb == NULL)) 1305 err = -ENOBUFS; 1306 } 1307 if (skb == NULL) 1308 goto error; 1309 /* 1310 * Fill in the control structures 1311 */ 1312 skb->ip_summed = csummode; 1313 skb->csum = 0; 1314 /* reserve for fragmentation */ 1315 skb_reserve(skb, hh_len+sizeof(struct frag_hdr)); 1316 1317 /* 1318 * Find where to start putting bytes 1319 */ 1320 data = skb_put(skb, fraglen); 1321 skb_set_network_header(skb, exthdrlen); 1322 data += fragheaderlen; 1323 skb->transport_header = (skb->network_header + 1324 fragheaderlen); 1325 if (fraggap) { 1326 skb->csum = skb_copy_and_csum_bits( 1327 skb_prev, maxfraglen, 1328 data + transhdrlen, fraggap, 0); 1329 skb_prev->csum = csum_sub(skb_prev->csum, 1330 skb->csum); 1331 data += fraggap; 1332 pskb_trim_unique(skb_prev, maxfraglen); 1333 } 1334 copy = datalen - transhdrlen - fraggap; 1335 if (copy < 0) { 1336 err = -EINVAL; 1337 kfree_skb(skb); 1338 goto error; 1339 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) { 1340 err = -EFAULT; 1341 kfree_skb(skb); 1342 goto error; 1343 } 1344 1345 offset += copy; 1346 length -= datalen - fraggap; 1347 transhdrlen = 0; 1348 exthdrlen = 0; 1349 csummode = CHECKSUM_NONE; 1350 1351 /* 1352 * Put the packet on the pending queue 1353 */ 1354 __skb_queue_tail(&sk->sk_write_queue, skb); 1355 continue; 1356 } 1357 1358 if (copy > length) 1359 copy = length; 1360 1361 if (!(rt->dst.dev->features&NETIF_F_SG)) { 1362 unsigned int off; 1363 1364 off = skb->len; 1365 if (getfrag(from, skb_put(skb, copy), 1366 offset, copy, off, skb) < 0) { 1367 __skb_trim(skb, off); 1368 err = -EFAULT; 1369 goto error; 1370 } 1371 } else { 1372 int i = skb_shinfo(skb)->nr_frags; 1373 skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1]; 1374 struct page *page = sk->sk_sndmsg_page; 1375 int off = sk->sk_sndmsg_off; 1376 unsigned int left; 1377 1378 if (page && (left = PAGE_SIZE - off) > 0) { 1379 if (copy >= left) 1380 copy = left; 1381 if (page != frag->page) { 1382 if (i == MAX_SKB_FRAGS) { 1383 err = -EMSGSIZE; 1384 goto error; 1385 } 1386 get_page(page); 1387 skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0); 1388 frag = &skb_shinfo(skb)->frags[i]; 1389 } 1390 } else if(i < MAX_SKB_FRAGS) { 1391 if (copy > PAGE_SIZE) 1392 copy = PAGE_SIZE; 1393 page = alloc_pages(sk->sk_allocation, 0); 1394 if (page == NULL) { 1395 err = -ENOMEM; 1396 goto error; 1397 } 1398 sk->sk_sndmsg_page = page; 1399 sk->sk_sndmsg_off = 0; 1400 1401 skb_fill_page_desc(skb, i, page, 0, 0); 1402 frag = &skb_shinfo(skb)->frags[i]; 1403 } else { 1404 err = -EMSGSIZE; 1405 goto error; 1406 } 1407 if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) { 1408 err = -EFAULT; 1409 goto error; 1410 } 1411 sk->sk_sndmsg_off += copy; 1412 frag->size += copy; 1413 skb->len += copy; 1414 skb->data_len += copy; 1415 skb->truesize += copy; 1416 atomic_add(copy, &sk->sk_wmem_alloc); 1417 } 1418 offset += copy; 1419 length -= copy; 1420 } 1421 return 0; 1422 error: 1423 inet->cork.length -= length; 1424 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); 1425 return err; 1426 } 1427 1428 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np) 1429 { 1430 if (np->cork.opt) { 1431 kfree(np->cork.opt->dst0opt); 1432 kfree(np->cork.opt->dst1opt); 1433 kfree(np->cork.opt->hopopt); 1434 kfree(np->cork.opt->srcrt); 1435 kfree(np->cork.opt); 1436 np->cork.opt = NULL; 1437 } 1438 1439 if (inet->cork.dst) { 1440 dst_release(inet->cork.dst); 1441 inet->cork.dst = NULL; 1442 inet->cork.flags &= ~IPCORK_ALLFRAG; 1443 } 1444 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl)); 1445 } 1446 1447 int ip6_push_pending_frames(struct sock *sk) 1448 { 1449 struct sk_buff *skb, *tmp_skb; 1450 struct sk_buff **tail_skb; 1451 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf; 1452 struct inet_sock *inet = inet_sk(sk); 1453 struct ipv6_pinfo *np = inet6_sk(sk); 1454 struct net *net = sock_net(sk); 1455 struct ipv6hdr *hdr; 1456 struct ipv6_txoptions *opt = np->cork.opt; 1457 struct rt6_info *rt = (struct rt6_info *)inet->cork.dst; 1458 struct flowi *fl = &inet->cork.fl; 1459 unsigned char proto = fl->proto; 1460 int err = 0; 1461 1462 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL) 1463 goto out; 1464 tail_skb = &(skb_shinfo(skb)->frag_list); 1465 1466 /* move skb->data to ip header from ext header */ 1467 if (skb->data < skb_network_header(skb)) 1468 __skb_pull(skb, skb_network_offset(skb)); 1469 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) { 1470 __skb_pull(tmp_skb, skb_network_header_len(skb)); 1471 *tail_skb = tmp_skb; 1472 tail_skb = &(tmp_skb->next); 1473 skb->len += tmp_skb->len; 1474 skb->data_len += tmp_skb->len; 1475 skb->truesize += tmp_skb->truesize; 1476 tmp_skb->destructor = NULL; 1477 tmp_skb->sk = NULL; 1478 } 1479 1480 /* Allow local fragmentation. */ 1481 if (np->pmtudisc < IPV6_PMTUDISC_DO) 1482 skb->local_df = 1; 1483 1484 ipv6_addr_copy(final_dst, &fl->fl6_dst); 1485 __skb_pull(skb, skb_network_header_len(skb)); 1486 if (opt && opt->opt_flen) 1487 ipv6_push_frag_opts(skb, opt, &proto); 1488 if (opt && opt->opt_nflen) 1489 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst); 1490 1491 skb_push(skb, sizeof(struct ipv6hdr)); 1492 skb_reset_network_header(skb); 1493 hdr = ipv6_hdr(skb); 1494 1495 *(__be32*)hdr = fl->fl6_flowlabel | 1496 htonl(0x60000000 | ((int)np->cork.tclass << 20)); 1497 1498 hdr->hop_limit = np->cork.hop_limit; 1499 hdr->nexthdr = proto; 1500 ipv6_addr_copy(&hdr->saddr, &fl->fl6_src); 1501 ipv6_addr_copy(&hdr->daddr, final_dst); 1502 1503 skb->priority = sk->sk_priority; 1504 skb->mark = sk->sk_mark; 1505 1506 skb_dst_set(skb, dst_clone(&rt->dst)); 1507 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len); 1508 if (proto == IPPROTO_ICMPV6) { 1509 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); 1510 1511 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type); 1512 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS); 1513 } 1514 1515 err = ip6_local_out(skb); 1516 if (err) { 1517 if (err > 0) 1518 err = net_xmit_errno(err); 1519 if (err) 1520 goto error; 1521 } 1522 1523 out: 1524 ip6_cork_release(inet, np); 1525 return err; 1526 error: 1527 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS); 1528 goto out; 1529 } 1530 1531 void ip6_flush_pending_frames(struct sock *sk) 1532 { 1533 struct sk_buff *skb; 1534 1535 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) { 1536 if (skb_dst(skb)) 1537 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)), 1538 IPSTATS_MIB_OUTDISCARDS); 1539 kfree_skb(skb); 1540 } 1541 1542 ip6_cork_release(inet_sk(sk), inet6_sk(sk)); 1543 } 1544