Loading...
1/*
2 * IPv6 output functions
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on linux/net/ipv4/ip_output.c
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 *
15 * Changes:
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
20 * etc.
21 *
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
26 * for datagram xmit
27 */
28
29#include <linux/errno.h>
30#include <linux/kernel.h>
31#include <linux/string.h>
32#include <linux/socket.h>
33#include <linux/net.h>
34#include <linux/netdevice.h>
35#include <linux/if_arp.h>
36#include <linux/in6.h>
37#include <linux/tcp.h>
38#include <linux/route.h>
39#include <linux/module.h>
40#include <linux/slab.h>
41
42#include <linux/netfilter.h>
43#include <linux/netfilter_ipv6.h>
44
45#include <net/sock.h>
46#include <net/snmp.h>
47
48#include <net/ipv6.h>
49#include <net/ndisc.h>
50#include <net/protocol.h>
51#include <net/ip6_route.h>
52#include <net/addrconf.h>
53#include <net/rawv6.h>
54#include <net/icmp.h>
55#include <net/xfrm.h>
56#include <net/checksum.h>
57#include <linux/mroute6.h>
58
59int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
60
61int __ip6_local_out(struct sk_buff *skb)
62{
63 int len;
64
65 len = skb->len - sizeof(struct ipv6hdr);
66 if (len > IPV6_MAXPLEN)
67 len = 0;
68 ipv6_hdr(skb)->payload_len = htons(len);
69
70 return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
71 skb_dst(skb)->dev, dst_output);
72}
73
74int ip6_local_out(struct sk_buff *skb)
75{
76 int err;
77
78 err = __ip6_local_out(skb);
79 if (likely(err == 1))
80 err = dst_output(skb);
81
82 return err;
83}
84EXPORT_SYMBOL_GPL(ip6_local_out);
85
86/* dev_loopback_xmit for use with netfilter. */
87static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
88{
89 skb_reset_mac_header(newskb);
90 __skb_pull(newskb, skb_network_offset(newskb));
91 newskb->pkt_type = PACKET_LOOPBACK;
92 newskb->ip_summed = CHECKSUM_UNNECESSARY;
93 WARN_ON(!skb_dst(newskb));
94
95 netif_rx_ni(newskb);
96 return 0;
97}
98
99static int ip6_finish_output2(struct sk_buff *skb)
100{
101 struct dst_entry *dst = skb_dst(skb);
102 struct net_device *dev = dst->dev;
103 struct neighbour *neigh;
104
105 skb->protocol = htons(ETH_P_IPV6);
106 skb->dev = dev;
107
108 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
109 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
110
111 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
112 ((mroute6_socket(dev_net(dev), skb) &&
113 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
114 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
115 &ipv6_hdr(skb)->saddr))) {
116 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
117
118 /* Do not check for IFF_ALLMULTI; multicast routing
119 is not supported in any case.
120 */
121 if (newskb)
122 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
123 newskb, NULL, newskb->dev,
124 ip6_dev_loopback_xmit);
125
126 if (ipv6_hdr(skb)->hop_limit == 0) {
127 IP6_INC_STATS(dev_net(dev), idev,
128 IPSTATS_MIB_OUTDISCARDS);
129 kfree_skb(skb);
130 return 0;
131 }
132 }
133
134 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
135 skb->len);
136 }
137
138 rcu_read_lock();
139 neigh = dst_get_neighbour(dst);
140 if (neigh) {
141 int res = neigh_output(neigh, skb);
142
143 rcu_read_unlock();
144 return res;
145 }
146 rcu_read_unlock();
147 IP6_INC_STATS_BH(dev_net(dst->dev),
148 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
149 kfree_skb(skb);
150 return -EINVAL;
151}
152
153static int ip6_finish_output(struct sk_buff *skb)
154{
155 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
156 dst_allfrag(skb_dst(skb)))
157 return ip6_fragment(skb, ip6_finish_output2);
158 else
159 return ip6_finish_output2(skb);
160}
161
162int ip6_output(struct sk_buff *skb)
163{
164 struct net_device *dev = skb_dst(skb)->dev;
165 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
166 if (unlikely(idev->cnf.disable_ipv6)) {
167 IP6_INC_STATS(dev_net(dev), idev,
168 IPSTATS_MIB_OUTDISCARDS);
169 kfree_skb(skb);
170 return 0;
171 }
172
173 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
174 ip6_finish_output,
175 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
176}
177
178/*
179 * xmit an sk_buff (used by TCP, SCTP and DCCP)
180 */
181
182int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
183 struct ipv6_txoptions *opt)
184{
185 struct net *net = sock_net(sk);
186 struct ipv6_pinfo *np = inet6_sk(sk);
187 struct in6_addr *first_hop = &fl6->daddr;
188 struct dst_entry *dst = skb_dst(skb);
189 struct ipv6hdr *hdr;
190 u8 proto = fl6->flowi6_proto;
191 int seg_len = skb->len;
192 int hlimit = -1;
193 int tclass = 0;
194 u32 mtu;
195
196 if (opt) {
197 unsigned int head_room;
198
199 /* First: exthdrs may take lots of space (~8K for now)
200 MAX_HEADER is not enough.
201 */
202 head_room = opt->opt_nflen + opt->opt_flen;
203 seg_len += head_room;
204 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
205
206 if (skb_headroom(skb) < head_room) {
207 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
208 if (skb2 == NULL) {
209 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
210 IPSTATS_MIB_OUTDISCARDS);
211 kfree_skb(skb);
212 return -ENOBUFS;
213 }
214 kfree_skb(skb);
215 skb = skb2;
216 skb_set_owner_w(skb, sk);
217 }
218 if (opt->opt_flen)
219 ipv6_push_frag_opts(skb, opt, &proto);
220 if (opt->opt_nflen)
221 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
222 }
223
224 skb_push(skb, sizeof(struct ipv6hdr));
225 skb_reset_network_header(skb);
226 hdr = ipv6_hdr(skb);
227
228 /*
229 * Fill in the IPv6 header
230 */
231 if (np) {
232 tclass = np->tclass;
233 hlimit = np->hop_limit;
234 }
235 if (hlimit < 0)
236 hlimit = ip6_dst_hoplimit(dst);
237
238 *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl6->flowlabel;
239
240 hdr->payload_len = htons(seg_len);
241 hdr->nexthdr = proto;
242 hdr->hop_limit = hlimit;
243
244 ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
245 ipv6_addr_copy(&hdr->daddr, first_hop);
246
247 skb->priority = sk->sk_priority;
248 skb->mark = sk->sk_mark;
249
250 mtu = dst_mtu(dst);
251 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
252 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
253 IPSTATS_MIB_OUT, skb->len);
254 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
255 dst->dev, dst_output);
256 }
257
258 if (net_ratelimit())
259 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
260 skb->dev = dst->dev;
261 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
262 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
263 kfree_skb(skb);
264 return -EMSGSIZE;
265}
266
267EXPORT_SYMBOL(ip6_xmit);
268
269/*
270 * To avoid extra problems ND packets are send through this
271 * routine. It's code duplication but I really want to avoid
272 * extra checks since ipv6_build_header is used by TCP (which
273 * is for us performance critical)
274 */
275
276int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
277 const struct in6_addr *saddr, const struct in6_addr *daddr,
278 int proto, int len)
279{
280 struct ipv6_pinfo *np = inet6_sk(sk);
281 struct ipv6hdr *hdr;
282
283 skb->protocol = htons(ETH_P_IPV6);
284 skb->dev = dev;
285
286 skb_reset_network_header(skb);
287 skb_put(skb, sizeof(struct ipv6hdr));
288 hdr = ipv6_hdr(skb);
289
290 *(__be32*)hdr = htonl(0x60000000);
291
292 hdr->payload_len = htons(len);
293 hdr->nexthdr = proto;
294 hdr->hop_limit = np->hop_limit;
295
296 ipv6_addr_copy(&hdr->saddr, saddr);
297 ipv6_addr_copy(&hdr->daddr, daddr);
298
299 return 0;
300}
301
302static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
303{
304 struct ip6_ra_chain *ra;
305 struct sock *last = NULL;
306
307 read_lock(&ip6_ra_lock);
308 for (ra = ip6_ra_chain; ra; ra = ra->next) {
309 struct sock *sk = ra->sk;
310 if (sk && ra->sel == sel &&
311 (!sk->sk_bound_dev_if ||
312 sk->sk_bound_dev_if == skb->dev->ifindex)) {
313 if (last) {
314 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
315 if (skb2)
316 rawv6_rcv(last, skb2);
317 }
318 last = sk;
319 }
320 }
321
322 if (last) {
323 rawv6_rcv(last, skb);
324 read_unlock(&ip6_ra_lock);
325 return 1;
326 }
327 read_unlock(&ip6_ra_lock);
328 return 0;
329}
330
331static int ip6_forward_proxy_check(struct sk_buff *skb)
332{
333 struct ipv6hdr *hdr = ipv6_hdr(skb);
334 u8 nexthdr = hdr->nexthdr;
335 int offset;
336
337 if (ipv6_ext_hdr(nexthdr)) {
338 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
339 if (offset < 0)
340 return 0;
341 } else
342 offset = sizeof(struct ipv6hdr);
343
344 if (nexthdr == IPPROTO_ICMPV6) {
345 struct icmp6hdr *icmp6;
346
347 if (!pskb_may_pull(skb, (skb_network_header(skb) +
348 offset + 1 - skb->data)))
349 return 0;
350
351 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
352
353 switch (icmp6->icmp6_type) {
354 case NDISC_ROUTER_SOLICITATION:
355 case NDISC_ROUTER_ADVERTISEMENT:
356 case NDISC_NEIGHBOUR_SOLICITATION:
357 case NDISC_NEIGHBOUR_ADVERTISEMENT:
358 case NDISC_REDIRECT:
359 /* For reaction involving unicast neighbor discovery
360 * message destined to the proxied address, pass it to
361 * input function.
362 */
363 return 1;
364 default:
365 break;
366 }
367 }
368
369 /*
370 * The proxying router can't forward traffic sent to a link-local
371 * address, so signal the sender and discard the packet. This
372 * behavior is clarified by the MIPv6 specification.
373 */
374 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
375 dst_link_failure(skb);
376 return -1;
377 }
378
379 return 0;
380}
381
382static inline int ip6_forward_finish(struct sk_buff *skb)
383{
384 return dst_output(skb);
385}
386
387int ip6_forward(struct sk_buff *skb)
388{
389 struct dst_entry *dst = skb_dst(skb);
390 struct ipv6hdr *hdr = ipv6_hdr(skb);
391 struct inet6_skb_parm *opt = IP6CB(skb);
392 struct net *net = dev_net(dst->dev);
393 struct neighbour *n;
394 u32 mtu;
395
396 if (net->ipv6.devconf_all->forwarding == 0)
397 goto error;
398
399 if (skb_warn_if_lro(skb))
400 goto drop;
401
402 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
403 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
404 goto drop;
405 }
406
407 if (skb->pkt_type != PACKET_HOST)
408 goto drop;
409
410 skb_forward_csum(skb);
411
412 /*
413 * We DO NOT make any processing on
414 * RA packets, pushing them to user level AS IS
415 * without ane WARRANTY that application will be able
416 * to interpret them. The reason is that we
417 * cannot make anything clever here.
418 *
419 * We are not end-node, so that if packet contains
420 * AH/ESP, we cannot make anything.
421 * Defragmentation also would be mistake, RA packets
422 * cannot be fragmented, because there is no warranty
423 * that different fragments will go along one path. --ANK
424 */
425 if (opt->ra) {
426 u8 *ptr = skb_network_header(skb) + opt->ra;
427 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
428 return 0;
429 }
430
431 /*
432 * check and decrement ttl
433 */
434 if (hdr->hop_limit <= 1) {
435 /* Force OUTPUT device used as source address */
436 skb->dev = dst->dev;
437 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
438 IP6_INC_STATS_BH(net,
439 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
440
441 kfree_skb(skb);
442 return -ETIMEDOUT;
443 }
444
445 /* XXX: idev->cnf.proxy_ndp? */
446 if (net->ipv6.devconf_all->proxy_ndp &&
447 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
448 int proxied = ip6_forward_proxy_check(skb);
449 if (proxied > 0)
450 return ip6_input(skb);
451 else if (proxied < 0) {
452 IP6_INC_STATS(net, ip6_dst_idev(dst),
453 IPSTATS_MIB_INDISCARDS);
454 goto drop;
455 }
456 }
457
458 if (!xfrm6_route_forward(skb)) {
459 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
460 goto drop;
461 }
462 dst = skb_dst(skb);
463
464 /* IPv6 specs say nothing about it, but it is clear that we cannot
465 send redirects to source routed frames.
466 We don't send redirects to frames decapsulated from IPsec.
467 */
468 n = dst_get_neighbour(dst);
469 if (skb->dev == dst->dev && n && opt->srcrt == 0 && !skb_sec_path(skb)) {
470 struct in6_addr *target = NULL;
471 struct rt6_info *rt;
472
473 /*
474 * incoming and outgoing devices are the same
475 * send a redirect.
476 */
477
478 rt = (struct rt6_info *) dst;
479 if ((rt->rt6i_flags & RTF_GATEWAY))
480 target = (struct in6_addr*)&n->primary_key;
481 else
482 target = &hdr->daddr;
483
484 if (!rt->rt6i_peer)
485 rt6_bind_peer(rt, 1);
486
487 /* Limit redirects both by destination (here)
488 and by source (inside ndisc_send_redirect)
489 */
490 if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
491 ndisc_send_redirect(skb, n, target);
492 } else {
493 int addrtype = ipv6_addr_type(&hdr->saddr);
494
495 /* This check is security critical. */
496 if (addrtype == IPV6_ADDR_ANY ||
497 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
498 goto error;
499 if (addrtype & IPV6_ADDR_LINKLOCAL) {
500 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
501 ICMPV6_NOT_NEIGHBOUR, 0);
502 goto error;
503 }
504 }
505
506 mtu = dst_mtu(dst);
507 if (mtu < IPV6_MIN_MTU)
508 mtu = IPV6_MIN_MTU;
509
510 if (skb->len > mtu && !skb_is_gso(skb)) {
511 /* Again, force OUTPUT device used as source address */
512 skb->dev = dst->dev;
513 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
514 IP6_INC_STATS_BH(net,
515 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
516 IP6_INC_STATS_BH(net,
517 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
518 kfree_skb(skb);
519 return -EMSGSIZE;
520 }
521
522 if (skb_cow(skb, dst->dev->hard_header_len)) {
523 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
524 goto drop;
525 }
526
527 hdr = ipv6_hdr(skb);
528
529 /* Mangling hops number delayed to point after skb COW */
530
531 hdr->hop_limit--;
532
533 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
534 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
535 ip6_forward_finish);
536
537error:
538 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
539drop:
540 kfree_skb(skb);
541 return -EINVAL;
542}
543
544static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
545{
546 to->pkt_type = from->pkt_type;
547 to->priority = from->priority;
548 to->protocol = from->protocol;
549 skb_dst_drop(to);
550 skb_dst_set(to, dst_clone(skb_dst(from)));
551 to->dev = from->dev;
552 to->mark = from->mark;
553
554#ifdef CONFIG_NET_SCHED
555 to->tc_index = from->tc_index;
556#endif
557 nf_copy(to, from);
558#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
559 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
560 to->nf_trace = from->nf_trace;
561#endif
562 skb_copy_secmark(to, from);
563}
564
565int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
566{
567 u16 offset = sizeof(struct ipv6hdr);
568 struct ipv6_opt_hdr *exthdr =
569 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
570 unsigned int packet_len = skb->tail - skb->network_header;
571 int found_rhdr = 0;
572 *nexthdr = &ipv6_hdr(skb)->nexthdr;
573
574 while (offset + 1 <= packet_len) {
575
576 switch (**nexthdr) {
577
578 case NEXTHDR_HOP:
579 break;
580 case NEXTHDR_ROUTING:
581 found_rhdr = 1;
582 break;
583 case NEXTHDR_DEST:
584#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
585 if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
586 break;
587#endif
588 if (found_rhdr)
589 return offset;
590 break;
591 default :
592 return offset;
593 }
594
595 offset += ipv6_optlen(exthdr);
596 *nexthdr = &exthdr->nexthdr;
597 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
598 offset);
599 }
600
601 return offset;
602}
603
604void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
605{
606 static atomic_t ipv6_fragmentation_id;
607 int old, new;
608
609 if (rt) {
610 struct inet_peer *peer;
611
612 if (!rt->rt6i_peer)
613 rt6_bind_peer(rt, 1);
614 peer = rt->rt6i_peer;
615 if (peer) {
616 fhdr->identification = htonl(inet_getid(peer, 0));
617 return;
618 }
619 }
620 do {
621 old = atomic_read(&ipv6_fragmentation_id);
622 new = old + 1;
623 if (!new)
624 new = 1;
625 } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
626 fhdr->identification = htonl(new);
627}
628
629int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
630{
631 struct sk_buff *frag;
632 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
633 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
634 struct ipv6hdr *tmp_hdr;
635 struct frag_hdr *fh;
636 unsigned int mtu, hlen, left, len;
637 __be32 frag_id = 0;
638 int ptr, offset = 0, err=0;
639 u8 *prevhdr, nexthdr = 0;
640 struct net *net = dev_net(skb_dst(skb)->dev);
641
642 hlen = ip6_find_1stfragopt(skb, &prevhdr);
643 nexthdr = *prevhdr;
644
645 mtu = ip6_skb_dst_mtu(skb);
646
647 /* We must not fragment if the socket is set to force MTU discovery
648 * or if the skb it not generated by a local socket.
649 */
650 if (!skb->local_df && skb->len > mtu) {
651 skb->dev = skb_dst(skb)->dev;
652 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
653 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
654 IPSTATS_MIB_FRAGFAILS);
655 kfree_skb(skb);
656 return -EMSGSIZE;
657 }
658
659 if (np && np->frag_size < mtu) {
660 if (np->frag_size)
661 mtu = np->frag_size;
662 }
663 mtu -= hlen + sizeof(struct frag_hdr);
664
665 if (skb_has_frag_list(skb)) {
666 int first_len = skb_pagelen(skb);
667 struct sk_buff *frag2;
668
669 if (first_len - hlen > mtu ||
670 ((first_len - hlen) & 7) ||
671 skb_cloned(skb))
672 goto slow_path;
673
674 skb_walk_frags(skb, frag) {
675 /* Correct geometry. */
676 if (frag->len > mtu ||
677 ((frag->len & 7) && frag->next) ||
678 skb_headroom(frag) < hlen)
679 goto slow_path_clean;
680
681 /* Partially cloned skb? */
682 if (skb_shared(frag))
683 goto slow_path_clean;
684
685 BUG_ON(frag->sk);
686 if (skb->sk) {
687 frag->sk = skb->sk;
688 frag->destructor = sock_wfree;
689 }
690 skb->truesize -= frag->truesize;
691 }
692
693 err = 0;
694 offset = 0;
695 frag = skb_shinfo(skb)->frag_list;
696 skb_frag_list_init(skb);
697 /* BUILD HEADER */
698
699 *prevhdr = NEXTHDR_FRAGMENT;
700 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
701 if (!tmp_hdr) {
702 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
703 IPSTATS_MIB_FRAGFAILS);
704 return -ENOMEM;
705 }
706
707 __skb_pull(skb, hlen);
708 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
709 __skb_push(skb, hlen);
710 skb_reset_network_header(skb);
711 memcpy(skb_network_header(skb), tmp_hdr, hlen);
712
713 ipv6_select_ident(fh, rt);
714 fh->nexthdr = nexthdr;
715 fh->reserved = 0;
716 fh->frag_off = htons(IP6_MF);
717 frag_id = fh->identification;
718
719 first_len = skb_pagelen(skb);
720 skb->data_len = first_len - skb_headlen(skb);
721 skb->len = first_len;
722 ipv6_hdr(skb)->payload_len = htons(first_len -
723 sizeof(struct ipv6hdr));
724
725 dst_hold(&rt->dst);
726
727 for (;;) {
728 /* Prepare header of the next frame,
729 * before previous one went down. */
730 if (frag) {
731 frag->ip_summed = CHECKSUM_NONE;
732 skb_reset_transport_header(frag);
733 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
734 __skb_push(frag, hlen);
735 skb_reset_network_header(frag);
736 memcpy(skb_network_header(frag), tmp_hdr,
737 hlen);
738 offset += skb->len - hlen - sizeof(struct frag_hdr);
739 fh->nexthdr = nexthdr;
740 fh->reserved = 0;
741 fh->frag_off = htons(offset);
742 if (frag->next != NULL)
743 fh->frag_off |= htons(IP6_MF);
744 fh->identification = frag_id;
745 ipv6_hdr(frag)->payload_len =
746 htons(frag->len -
747 sizeof(struct ipv6hdr));
748 ip6_copy_metadata(frag, skb);
749 }
750
751 err = output(skb);
752 if(!err)
753 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
754 IPSTATS_MIB_FRAGCREATES);
755
756 if (err || !frag)
757 break;
758
759 skb = frag;
760 frag = skb->next;
761 skb->next = NULL;
762 }
763
764 kfree(tmp_hdr);
765
766 if (err == 0) {
767 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
768 IPSTATS_MIB_FRAGOKS);
769 dst_release(&rt->dst);
770 return 0;
771 }
772
773 while (frag) {
774 skb = frag->next;
775 kfree_skb(frag);
776 frag = skb;
777 }
778
779 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
780 IPSTATS_MIB_FRAGFAILS);
781 dst_release(&rt->dst);
782 return err;
783
784slow_path_clean:
785 skb_walk_frags(skb, frag2) {
786 if (frag2 == frag)
787 break;
788 frag2->sk = NULL;
789 frag2->destructor = NULL;
790 skb->truesize += frag2->truesize;
791 }
792 }
793
794slow_path:
795 left = skb->len - hlen; /* Space per frame */
796 ptr = hlen; /* Where to start from */
797
798 /*
799 * Fragment the datagram.
800 */
801
802 *prevhdr = NEXTHDR_FRAGMENT;
803
804 /*
805 * Keep copying data until we run out.
806 */
807 while(left > 0) {
808 len = left;
809 /* IF: it doesn't fit, use 'mtu' - the data space left */
810 if (len > mtu)
811 len = mtu;
812 /* IF: we are not sending up to and including the packet end
813 then align the next start on an eight byte boundary */
814 if (len < left) {
815 len &= ~7;
816 }
817 /*
818 * Allocate buffer.
819 */
820
821 if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_ALLOCATED_SPACE(rt->dst.dev), GFP_ATOMIC)) == NULL) {
822 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
823 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
824 IPSTATS_MIB_FRAGFAILS);
825 err = -ENOMEM;
826 goto fail;
827 }
828
829 /*
830 * Set up data on packet
831 */
832
833 ip6_copy_metadata(frag, skb);
834 skb_reserve(frag, LL_RESERVED_SPACE(rt->dst.dev));
835 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
836 skb_reset_network_header(frag);
837 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
838 frag->transport_header = (frag->network_header + hlen +
839 sizeof(struct frag_hdr));
840
841 /*
842 * Charge the memory for the fragment to any owner
843 * it might possess
844 */
845 if (skb->sk)
846 skb_set_owner_w(frag, skb->sk);
847
848 /*
849 * Copy the packet header into the new buffer.
850 */
851 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
852
853 /*
854 * Build fragment header.
855 */
856 fh->nexthdr = nexthdr;
857 fh->reserved = 0;
858 if (!frag_id) {
859 ipv6_select_ident(fh, rt);
860 frag_id = fh->identification;
861 } else
862 fh->identification = frag_id;
863
864 /*
865 * Copy a block of the IP datagram.
866 */
867 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
868 BUG();
869 left -= len;
870
871 fh->frag_off = htons(offset);
872 if (left > 0)
873 fh->frag_off |= htons(IP6_MF);
874 ipv6_hdr(frag)->payload_len = htons(frag->len -
875 sizeof(struct ipv6hdr));
876
877 ptr += len;
878 offset += len;
879
880 /*
881 * Put this fragment into the sending queue.
882 */
883 err = output(frag);
884 if (err)
885 goto fail;
886
887 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
888 IPSTATS_MIB_FRAGCREATES);
889 }
890 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
891 IPSTATS_MIB_FRAGOKS);
892 kfree_skb(skb);
893 return err;
894
895fail:
896 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
897 IPSTATS_MIB_FRAGFAILS);
898 kfree_skb(skb);
899 return err;
900}
901
902static inline int ip6_rt_check(const struct rt6key *rt_key,
903 const struct in6_addr *fl_addr,
904 const struct in6_addr *addr_cache)
905{
906 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
907 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
908}
909
910static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
911 struct dst_entry *dst,
912 const struct flowi6 *fl6)
913{
914 struct ipv6_pinfo *np = inet6_sk(sk);
915 struct rt6_info *rt = (struct rt6_info *)dst;
916
917 if (!dst)
918 goto out;
919
920 /* Yes, checking route validity in not connected
921 * case is not very simple. Take into account,
922 * that we do not support routing by source, TOS,
923 * and MSG_DONTROUTE --ANK (980726)
924 *
925 * 1. ip6_rt_check(): If route was host route,
926 * check that cached destination is current.
927 * If it is network route, we still may
928 * check its validity using saved pointer
929 * to the last used address: daddr_cache.
930 * We do not want to save whole address now,
931 * (because main consumer of this service
932 * is tcp, which has not this problem),
933 * so that the last trick works only on connected
934 * sockets.
935 * 2. oif also should be the same.
936 */
937 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
938#ifdef CONFIG_IPV6_SUBTREES
939 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
940#endif
941 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
942 dst_release(dst);
943 dst = NULL;
944 }
945
946out:
947 return dst;
948}
949
950static int ip6_dst_lookup_tail(struct sock *sk,
951 struct dst_entry **dst, struct flowi6 *fl6)
952{
953 struct net *net = sock_net(sk);
954#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
955 struct neighbour *n;
956#endif
957 int err;
958
959 if (*dst == NULL)
960 *dst = ip6_route_output(net, sk, fl6);
961
962 if ((err = (*dst)->error))
963 goto out_err_release;
964
965 if (ipv6_addr_any(&fl6->saddr)) {
966 struct rt6_info *rt = (struct rt6_info *) *dst;
967 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
968 sk ? inet6_sk(sk)->srcprefs : 0,
969 &fl6->saddr);
970 if (err)
971 goto out_err_release;
972 }
973
974#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
975 /*
976 * Here if the dst entry we've looked up
977 * has a neighbour entry that is in the INCOMPLETE
978 * state and the src address from the flow is
979 * marked as OPTIMISTIC, we release the found
980 * dst entry and replace it instead with the
981 * dst entry of the nexthop router
982 */
983 rcu_read_lock();
984 n = dst_get_neighbour(*dst);
985 if (n && !(n->nud_state & NUD_VALID)) {
986 struct inet6_ifaddr *ifp;
987 struct flowi6 fl_gw6;
988 int redirect;
989
990 rcu_read_unlock();
991 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
992 (*dst)->dev, 1);
993
994 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
995 if (ifp)
996 in6_ifa_put(ifp);
997
998 if (redirect) {
999 /*
1000 * We need to get the dst entry for the
1001 * default router instead
1002 */
1003 dst_release(*dst);
1004 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1005 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1006 *dst = ip6_route_output(net, sk, &fl_gw6);
1007 if ((err = (*dst)->error))
1008 goto out_err_release;
1009 }
1010 } else {
1011 rcu_read_unlock();
1012 }
1013#endif
1014
1015 return 0;
1016
1017out_err_release:
1018 if (err == -ENETUNREACH)
1019 IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1020 dst_release(*dst);
1021 *dst = NULL;
1022 return err;
1023}
1024
1025/**
1026 * ip6_dst_lookup - perform route lookup on flow
1027 * @sk: socket which provides route info
1028 * @dst: pointer to dst_entry * for result
1029 * @fl6: flow to lookup
1030 *
1031 * This function performs a route lookup on the given flow.
1032 *
1033 * It returns zero on success, or a standard errno code on error.
1034 */
1035int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
1036{
1037 *dst = NULL;
1038 return ip6_dst_lookup_tail(sk, dst, fl6);
1039}
1040EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1041
1042/**
1043 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1044 * @sk: socket which provides route info
1045 * @fl6: flow to lookup
1046 * @final_dst: final destination address for ipsec lookup
1047 * @can_sleep: we are in a sleepable context
1048 *
1049 * This function performs a route lookup on the given flow.
1050 *
1051 * It returns a valid dst pointer on success, or a pointer encoded
1052 * error code.
1053 */
1054struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1055 const struct in6_addr *final_dst,
1056 bool can_sleep)
1057{
1058 struct dst_entry *dst = NULL;
1059 int err;
1060
1061 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1062 if (err)
1063 return ERR_PTR(err);
1064 if (final_dst)
1065 ipv6_addr_copy(&fl6->daddr, final_dst);
1066 if (can_sleep)
1067 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1068
1069 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1070}
1071EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1072
1073/**
1074 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1075 * @sk: socket which provides the dst cache and route info
1076 * @fl6: flow to lookup
1077 * @final_dst: final destination address for ipsec lookup
1078 * @can_sleep: we are in a sleepable context
1079 *
1080 * This function performs a route lookup on the given flow with the
1081 * possibility of using the cached route in the socket if it is valid.
1082 * It will take the socket dst lock when operating on the dst cache.
1083 * As a result, this function can only be used in process context.
1084 *
1085 * It returns a valid dst pointer on success, or a pointer encoded
1086 * error code.
1087 */
1088struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1089 const struct in6_addr *final_dst,
1090 bool can_sleep)
1091{
1092 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1093 int err;
1094
1095 dst = ip6_sk_dst_check(sk, dst, fl6);
1096
1097 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1098 if (err)
1099 return ERR_PTR(err);
1100 if (final_dst)
1101 ipv6_addr_copy(&fl6->daddr, final_dst);
1102 if (can_sleep)
1103 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1104
1105 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1106}
1107EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1108
1109static inline int ip6_ufo_append_data(struct sock *sk,
1110 int getfrag(void *from, char *to, int offset, int len,
1111 int odd, struct sk_buff *skb),
1112 void *from, int length, int hh_len, int fragheaderlen,
1113 int transhdrlen, int mtu,unsigned int flags,
1114 struct rt6_info *rt)
1115
1116{
1117 struct sk_buff *skb;
1118 int err;
1119
1120 /* There is support for UDP large send offload by network
1121 * device, so create one single skb packet containing complete
1122 * udp datagram
1123 */
1124 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1125 skb = sock_alloc_send_skb(sk,
1126 hh_len + fragheaderlen + transhdrlen + 20,
1127 (flags & MSG_DONTWAIT), &err);
1128 if (skb == NULL)
1129 return -ENOMEM;
1130
1131 /* reserve space for Hardware header */
1132 skb_reserve(skb, hh_len);
1133
1134 /* create space for UDP/IP header */
1135 skb_put(skb,fragheaderlen + transhdrlen);
1136
1137 /* initialize network header pointer */
1138 skb_reset_network_header(skb);
1139
1140 /* initialize protocol header pointer */
1141 skb->transport_header = skb->network_header + fragheaderlen;
1142
1143 skb->ip_summed = CHECKSUM_PARTIAL;
1144 skb->csum = 0;
1145 }
1146
1147 err = skb_append_datato_frags(sk,skb, getfrag, from,
1148 (length - transhdrlen));
1149 if (!err) {
1150 struct frag_hdr fhdr;
1151
1152 /* Specify the length of each IPv6 datagram fragment.
1153 * It has to be a multiple of 8.
1154 */
1155 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1156 sizeof(struct frag_hdr)) & ~7;
1157 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1158 ipv6_select_ident(&fhdr, rt);
1159 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1160 __skb_queue_tail(&sk->sk_write_queue, skb);
1161
1162 return 0;
1163 }
1164 /* There is not enough support do UPD LSO,
1165 * so follow normal path
1166 */
1167 kfree_skb(skb);
1168
1169 return err;
1170}
1171
1172static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1173 gfp_t gfp)
1174{
1175 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1176}
1177
1178static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1179 gfp_t gfp)
1180{
1181 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1182}
1183
1184int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1185 int offset, int len, int odd, struct sk_buff *skb),
1186 void *from, int length, int transhdrlen,
1187 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1188 struct rt6_info *rt, unsigned int flags, int dontfrag)
1189{
1190 struct inet_sock *inet = inet_sk(sk);
1191 struct ipv6_pinfo *np = inet6_sk(sk);
1192 struct inet_cork *cork;
1193 struct sk_buff *skb;
1194 unsigned int maxfraglen, fragheaderlen;
1195 int exthdrlen;
1196 int hh_len;
1197 int mtu;
1198 int copy;
1199 int err;
1200 int offset = 0;
1201 int csummode = CHECKSUM_NONE;
1202 __u8 tx_flags = 0;
1203
1204 if (flags&MSG_PROBE)
1205 return 0;
1206 cork = &inet->cork.base;
1207 if (skb_queue_empty(&sk->sk_write_queue)) {
1208 /*
1209 * setup for corking
1210 */
1211 if (opt) {
1212 if (WARN_ON(np->cork.opt))
1213 return -EINVAL;
1214
1215 np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
1216 if (unlikely(np->cork.opt == NULL))
1217 return -ENOBUFS;
1218
1219 np->cork.opt->tot_len = opt->tot_len;
1220 np->cork.opt->opt_flen = opt->opt_flen;
1221 np->cork.opt->opt_nflen = opt->opt_nflen;
1222
1223 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1224 sk->sk_allocation);
1225 if (opt->dst0opt && !np->cork.opt->dst0opt)
1226 return -ENOBUFS;
1227
1228 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1229 sk->sk_allocation);
1230 if (opt->dst1opt && !np->cork.opt->dst1opt)
1231 return -ENOBUFS;
1232
1233 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1234 sk->sk_allocation);
1235 if (opt->hopopt && !np->cork.opt->hopopt)
1236 return -ENOBUFS;
1237
1238 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1239 sk->sk_allocation);
1240 if (opt->srcrt && !np->cork.opt->srcrt)
1241 return -ENOBUFS;
1242
1243 /* need source address above miyazawa*/
1244 }
1245 dst_hold(&rt->dst);
1246 cork->dst = &rt->dst;
1247 inet->cork.fl.u.ip6 = *fl6;
1248 np->cork.hop_limit = hlimit;
1249 np->cork.tclass = tclass;
1250 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1251 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1252 if (np->frag_size < mtu) {
1253 if (np->frag_size)
1254 mtu = np->frag_size;
1255 }
1256 cork->fragsize = mtu;
1257 if (dst_allfrag(rt->dst.path))
1258 cork->flags |= IPCORK_ALLFRAG;
1259 cork->length = 0;
1260 sk->sk_sndmsg_page = NULL;
1261 sk->sk_sndmsg_off = 0;
1262 exthdrlen = rt->dst.header_len + (opt ? opt->opt_flen : 0) -
1263 rt->rt6i_nfheader_len;
1264 length += exthdrlen;
1265 transhdrlen += exthdrlen;
1266 } else {
1267 rt = (struct rt6_info *)cork->dst;
1268 fl6 = &inet->cork.fl.u.ip6;
1269 opt = np->cork.opt;
1270 transhdrlen = 0;
1271 exthdrlen = 0;
1272 mtu = cork->fragsize;
1273 }
1274
1275 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1276
1277 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1278 (opt ? opt->opt_nflen : 0);
1279 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1280
1281 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1282 if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1283 ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1284 return -EMSGSIZE;
1285 }
1286 }
1287
1288 /* For UDP, check if TX timestamp is enabled */
1289 if (sk->sk_type == SOCK_DGRAM) {
1290 err = sock_tx_timestamp(sk, &tx_flags);
1291 if (err)
1292 goto error;
1293 }
1294
1295 /*
1296 * Let's try using as much space as possible.
1297 * Use MTU if total length of the message fits into the MTU.
1298 * Otherwise, we need to reserve fragment header and
1299 * fragment alignment (= 8-15 octects, in total).
1300 *
1301 * Note that we may need to "move" the data from the tail of
1302 * of the buffer to the new fragment when we split
1303 * the message.
1304 *
1305 * FIXME: It may be fragmented into multiple chunks
1306 * at once if non-fragmentable extension headers
1307 * are too large.
1308 * --yoshfuji
1309 */
1310
1311 cork->length += length;
1312 if (length > mtu) {
1313 int proto = sk->sk_protocol;
1314 if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
1315 ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1316 return -EMSGSIZE;
1317 }
1318
1319 if (proto == IPPROTO_UDP &&
1320 (rt->dst.dev->features & NETIF_F_UFO)) {
1321
1322 err = ip6_ufo_append_data(sk, getfrag, from, length,
1323 hh_len, fragheaderlen,
1324 transhdrlen, mtu, flags, rt);
1325 if (err)
1326 goto error;
1327 return 0;
1328 }
1329 }
1330
1331 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
1332 goto alloc_new_skb;
1333
1334 while (length > 0) {
1335 /* Check if the remaining data fits into current packet. */
1336 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1337 if (copy < length)
1338 copy = maxfraglen - skb->len;
1339
1340 if (copy <= 0) {
1341 char *data;
1342 unsigned int datalen;
1343 unsigned int fraglen;
1344 unsigned int fraggap;
1345 unsigned int alloclen;
1346 struct sk_buff *skb_prev;
1347alloc_new_skb:
1348 skb_prev = skb;
1349
1350 /* There's no room in the current skb */
1351 if (skb_prev)
1352 fraggap = skb_prev->len - maxfraglen;
1353 else
1354 fraggap = 0;
1355
1356 /*
1357 * If remaining data exceeds the mtu,
1358 * we know we need more fragment(s).
1359 */
1360 datalen = length + fraggap;
1361 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1362 datalen = maxfraglen - fragheaderlen;
1363
1364 fraglen = datalen + fragheaderlen;
1365 if ((flags & MSG_MORE) &&
1366 !(rt->dst.dev->features&NETIF_F_SG))
1367 alloclen = mtu;
1368 else
1369 alloclen = datalen + fragheaderlen;
1370
1371 /*
1372 * The last fragment gets additional space at tail.
1373 * Note: we overallocate on fragments with MSG_MODE
1374 * because we have no idea if we're the last one.
1375 */
1376 if (datalen == length + fraggap)
1377 alloclen += rt->dst.trailer_len;
1378
1379 /*
1380 * We just reserve space for fragment header.
1381 * Note: this may be overallocation if the message
1382 * (without MSG_MORE) fits into the MTU.
1383 */
1384 alloclen += sizeof(struct frag_hdr);
1385
1386 if (transhdrlen) {
1387 skb = sock_alloc_send_skb(sk,
1388 alloclen + hh_len,
1389 (flags & MSG_DONTWAIT), &err);
1390 } else {
1391 skb = NULL;
1392 if (atomic_read(&sk->sk_wmem_alloc) <=
1393 2 * sk->sk_sndbuf)
1394 skb = sock_wmalloc(sk,
1395 alloclen + hh_len, 1,
1396 sk->sk_allocation);
1397 if (unlikely(skb == NULL))
1398 err = -ENOBUFS;
1399 else {
1400 /* Only the initial fragment
1401 * is time stamped.
1402 */
1403 tx_flags = 0;
1404 }
1405 }
1406 if (skb == NULL)
1407 goto error;
1408 /*
1409 * Fill in the control structures
1410 */
1411 skb->ip_summed = csummode;
1412 skb->csum = 0;
1413 /* reserve for fragmentation */
1414 skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
1415
1416 if (sk->sk_type == SOCK_DGRAM)
1417 skb_shinfo(skb)->tx_flags = tx_flags;
1418
1419 /*
1420 * Find where to start putting bytes
1421 */
1422 data = skb_put(skb, fraglen);
1423 skb_set_network_header(skb, exthdrlen);
1424 data += fragheaderlen;
1425 skb->transport_header = (skb->network_header +
1426 fragheaderlen);
1427 if (fraggap) {
1428 skb->csum = skb_copy_and_csum_bits(
1429 skb_prev, maxfraglen,
1430 data + transhdrlen, fraggap, 0);
1431 skb_prev->csum = csum_sub(skb_prev->csum,
1432 skb->csum);
1433 data += fraggap;
1434 pskb_trim_unique(skb_prev, maxfraglen);
1435 }
1436 copy = datalen - transhdrlen - fraggap;
1437 if (copy < 0) {
1438 err = -EINVAL;
1439 kfree_skb(skb);
1440 goto error;
1441 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1442 err = -EFAULT;
1443 kfree_skb(skb);
1444 goto error;
1445 }
1446
1447 offset += copy;
1448 length -= datalen - fraggap;
1449 transhdrlen = 0;
1450 exthdrlen = 0;
1451 csummode = CHECKSUM_NONE;
1452
1453 /*
1454 * Put the packet on the pending queue
1455 */
1456 __skb_queue_tail(&sk->sk_write_queue, skb);
1457 continue;
1458 }
1459
1460 if (copy > length)
1461 copy = length;
1462
1463 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1464 unsigned int off;
1465
1466 off = skb->len;
1467 if (getfrag(from, skb_put(skb, copy),
1468 offset, copy, off, skb) < 0) {
1469 __skb_trim(skb, off);
1470 err = -EFAULT;
1471 goto error;
1472 }
1473 } else {
1474 int i = skb_shinfo(skb)->nr_frags;
1475 skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
1476 struct page *page = sk->sk_sndmsg_page;
1477 int off = sk->sk_sndmsg_off;
1478 unsigned int left;
1479
1480 if (page && (left = PAGE_SIZE - off) > 0) {
1481 if (copy >= left)
1482 copy = left;
1483 if (page != frag->page) {
1484 if (i == MAX_SKB_FRAGS) {
1485 err = -EMSGSIZE;
1486 goto error;
1487 }
1488 get_page(page);
1489 skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
1490 frag = &skb_shinfo(skb)->frags[i];
1491 }
1492 } else if(i < MAX_SKB_FRAGS) {
1493 if (copy > PAGE_SIZE)
1494 copy = PAGE_SIZE;
1495 page = alloc_pages(sk->sk_allocation, 0);
1496 if (page == NULL) {
1497 err = -ENOMEM;
1498 goto error;
1499 }
1500 sk->sk_sndmsg_page = page;
1501 sk->sk_sndmsg_off = 0;
1502
1503 skb_fill_page_desc(skb, i, page, 0, 0);
1504 frag = &skb_shinfo(skb)->frags[i];
1505 } else {
1506 err = -EMSGSIZE;
1507 goto error;
1508 }
1509 if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
1510 err = -EFAULT;
1511 goto error;
1512 }
1513 sk->sk_sndmsg_off += copy;
1514 frag->size += copy;
1515 skb->len += copy;
1516 skb->data_len += copy;
1517 skb->truesize += copy;
1518 atomic_add(copy, &sk->sk_wmem_alloc);
1519 }
1520 offset += copy;
1521 length -= copy;
1522 }
1523 return 0;
1524error:
1525 cork->length -= length;
1526 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1527 return err;
1528}
1529
1530static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1531{
1532 if (np->cork.opt) {
1533 kfree(np->cork.opt->dst0opt);
1534 kfree(np->cork.opt->dst1opt);
1535 kfree(np->cork.opt->hopopt);
1536 kfree(np->cork.opt->srcrt);
1537 kfree(np->cork.opt);
1538 np->cork.opt = NULL;
1539 }
1540
1541 if (inet->cork.base.dst) {
1542 dst_release(inet->cork.base.dst);
1543 inet->cork.base.dst = NULL;
1544 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1545 }
1546 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1547}
1548
1549int ip6_push_pending_frames(struct sock *sk)
1550{
1551 struct sk_buff *skb, *tmp_skb;
1552 struct sk_buff **tail_skb;
1553 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1554 struct inet_sock *inet = inet_sk(sk);
1555 struct ipv6_pinfo *np = inet6_sk(sk);
1556 struct net *net = sock_net(sk);
1557 struct ipv6hdr *hdr;
1558 struct ipv6_txoptions *opt = np->cork.opt;
1559 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1560 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1561 unsigned char proto = fl6->flowi6_proto;
1562 int err = 0;
1563
1564 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1565 goto out;
1566 tail_skb = &(skb_shinfo(skb)->frag_list);
1567
1568 /* move skb->data to ip header from ext header */
1569 if (skb->data < skb_network_header(skb))
1570 __skb_pull(skb, skb_network_offset(skb));
1571 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1572 __skb_pull(tmp_skb, skb_network_header_len(skb));
1573 *tail_skb = tmp_skb;
1574 tail_skb = &(tmp_skb->next);
1575 skb->len += tmp_skb->len;
1576 skb->data_len += tmp_skb->len;
1577 skb->truesize += tmp_skb->truesize;
1578 tmp_skb->destructor = NULL;
1579 tmp_skb->sk = NULL;
1580 }
1581
1582 /* Allow local fragmentation. */
1583 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1584 skb->local_df = 1;
1585
1586 ipv6_addr_copy(final_dst, &fl6->daddr);
1587 __skb_pull(skb, skb_network_header_len(skb));
1588 if (opt && opt->opt_flen)
1589 ipv6_push_frag_opts(skb, opt, &proto);
1590 if (opt && opt->opt_nflen)
1591 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1592
1593 skb_push(skb, sizeof(struct ipv6hdr));
1594 skb_reset_network_header(skb);
1595 hdr = ipv6_hdr(skb);
1596
1597 *(__be32*)hdr = fl6->flowlabel |
1598 htonl(0x60000000 | ((int)np->cork.tclass << 20));
1599
1600 hdr->hop_limit = np->cork.hop_limit;
1601 hdr->nexthdr = proto;
1602 ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
1603 ipv6_addr_copy(&hdr->daddr, final_dst);
1604
1605 skb->priority = sk->sk_priority;
1606 skb->mark = sk->sk_mark;
1607
1608 skb_dst_set(skb, dst_clone(&rt->dst));
1609 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1610 if (proto == IPPROTO_ICMPV6) {
1611 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1612
1613 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1614 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1615 }
1616
1617 err = ip6_local_out(skb);
1618 if (err) {
1619 if (err > 0)
1620 err = net_xmit_errno(err);
1621 if (err)
1622 goto error;
1623 }
1624
1625out:
1626 ip6_cork_release(inet, np);
1627 return err;
1628error:
1629 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1630 goto out;
1631}
1632
1633void ip6_flush_pending_frames(struct sock *sk)
1634{
1635 struct sk_buff *skb;
1636
1637 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1638 if (skb_dst(skb))
1639 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1640 IPSTATS_MIB_OUTDISCARDS);
1641 kfree_skb(skb);
1642 }
1643
1644 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1645}
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * IPv6 output functions
4 * Linux INET6 implementation
5 *
6 * Authors:
7 * Pedro Roque <roque@di.fc.ul.pt>
8 *
9 * Based on linux/net/ipv4/ip_output.c
10 *
11 * Changes:
12 * A.N.Kuznetsov : airthmetics in fragmentation.
13 * extension headers are implemented.
14 * route changes now work.
15 * ip6_forward does not confuse sniffers.
16 * etc.
17 *
18 * H. von Brand : Added missing #include <linux/string.h>
19 * Imran Patel : frag id should be in NBO
20 * Kazunori MIYAZAWA @USAGI
21 * : add ip6_append_data and related functions
22 * for datagram xmit
23 */
24
25#include <linux/errno.h>
26#include <linux/kernel.h>
27#include <linux/string.h>
28#include <linux/socket.h>
29#include <linux/net.h>
30#include <linux/netdevice.h>
31#include <linux/if_arp.h>
32#include <linux/in6.h>
33#include <linux/tcp.h>
34#include <linux/route.h>
35#include <linux/module.h>
36#include <linux/slab.h>
37
38#include <linux/bpf-cgroup.h>
39#include <linux/netfilter.h>
40#include <linux/netfilter_ipv6.h>
41
42#include <net/sock.h>
43#include <net/snmp.h>
44
45#include <net/ipv6.h>
46#include <net/ndisc.h>
47#include <net/protocol.h>
48#include <net/ip6_route.h>
49#include <net/addrconf.h>
50#include <net/rawv6.h>
51#include <net/icmp.h>
52#include <net/xfrm.h>
53#include <net/checksum.h>
54#include <linux/mroute6.h>
55#include <net/l3mdev.h>
56#include <net/lwtunnel.h>
57#include <net/ip_tunnels.h>
58
59static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
60{
61 struct dst_entry *dst = skb_dst(skb);
62 struct net_device *dev = dst->dev;
63 struct inet6_dev *idev = ip6_dst_idev(dst);
64 unsigned int hh_len = LL_RESERVED_SPACE(dev);
65 const struct in6_addr *daddr, *nexthop;
66 struct ipv6hdr *hdr;
67 struct neighbour *neigh;
68 int ret;
69
70 /* Be paranoid, rather than too clever. */
71 if (unlikely(hh_len > skb_headroom(skb)) && dev->header_ops) {
72 skb = skb_expand_head(skb, hh_len);
73 if (!skb) {
74 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
75 return -ENOMEM;
76 }
77 }
78
79 hdr = ipv6_hdr(skb);
80 daddr = &hdr->daddr;
81 if (ipv6_addr_is_multicast(daddr)) {
82 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) &&
83 ((mroute6_is_socket(net, skb) &&
84 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
85 ipv6_chk_mcast_addr(dev, daddr, &hdr->saddr))) {
86 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
87
88 /* Do not check for IFF_ALLMULTI; multicast routing
89 is not supported in any case.
90 */
91 if (newskb)
92 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
93 net, sk, newskb, NULL, newskb->dev,
94 dev_loopback_xmit);
95
96 if (hdr->hop_limit == 0) {
97 IP6_INC_STATS(net, idev,
98 IPSTATS_MIB_OUTDISCARDS);
99 kfree_skb(skb);
100 return 0;
101 }
102 }
103
104 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, skb->len);
105 if (IPV6_ADDR_MC_SCOPE(daddr) <= IPV6_ADDR_SCOPE_NODELOCAL &&
106 !(dev->flags & IFF_LOOPBACK)) {
107 kfree_skb(skb);
108 return 0;
109 }
110 }
111
112 if (lwtunnel_xmit_redirect(dst->lwtstate)) {
113 int res = lwtunnel_xmit(skb);
114
115 if (res < 0 || res == LWTUNNEL_XMIT_DONE)
116 return res;
117 }
118
119 rcu_read_lock_bh();
120 nexthop = rt6_nexthop((struct rt6_info *)dst, daddr);
121 neigh = __ipv6_neigh_lookup_noref(dev, nexthop);
122
123 if (unlikely(IS_ERR_OR_NULL(neigh))) {
124 if (unlikely(!neigh))
125 neigh = __neigh_create(&nd_tbl, nexthop, dev, false);
126 if (IS_ERR(neigh)) {
127 rcu_read_unlock_bh();
128 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTNOROUTES);
129 kfree_skb_reason(skb, SKB_DROP_REASON_NEIGH_CREATEFAIL);
130 return -EINVAL;
131 }
132 }
133 sock_confirm_neigh(skb, neigh);
134 ret = neigh_output(neigh, skb, false);
135 rcu_read_unlock_bh();
136 return ret;
137}
138
139static int
140ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
141 struct sk_buff *skb, unsigned int mtu)
142{
143 struct sk_buff *segs, *nskb;
144 netdev_features_t features;
145 int ret = 0;
146
147 /* Please see corresponding comment in ip_finish_output_gso
148 * describing the cases where GSO segment length exceeds the
149 * egress MTU.
150 */
151 features = netif_skb_features(skb);
152 segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
153 if (IS_ERR_OR_NULL(segs)) {
154 kfree_skb(skb);
155 return -ENOMEM;
156 }
157
158 consume_skb(skb);
159
160 skb_list_walk_safe(segs, segs, nskb) {
161 int err;
162
163 skb_mark_not_on_list(segs);
164 err = ip6_fragment(net, sk, segs, ip6_finish_output2);
165 if (err && ret == 0)
166 ret = err;
167 }
168
169 return ret;
170}
171
172static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
173{
174 unsigned int mtu;
175
176#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
177 /* Policy lookup after SNAT yielded a new policy */
178 if (skb_dst(skb)->xfrm) {
179 IP6CB(skb)->flags |= IP6SKB_REROUTED;
180 return dst_output(net, sk, skb);
181 }
182#endif
183
184 mtu = ip6_skb_dst_mtu(skb);
185 if (skb_is_gso(skb) &&
186 !(IP6CB(skb)->flags & IP6SKB_FAKEJUMBO) &&
187 !skb_gso_validate_network_len(skb, mtu))
188 return ip6_finish_output_gso_slowpath_drop(net, sk, skb, mtu);
189
190 if ((skb->len > mtu && !skb_is_gso(skb)) ||
191 dst_allfrag(skb_dst(skb)) ||
192 (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
193 return ip6_fragment(net, sk, skb, ip6_finish_output2);
194 else
195 return ip6_finish_output2(net, sk, skb);
196}
197
198static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
199{
200 int ret;
201
202 ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
203 switch (ret) {
204 case NET_XMIT_SUCCESS:
205 case NET_XMIT_CN:
206 return __ip6_finish_output(net, sk, skb) ? : ret;
207 default:
208 kfree_skb_reason(skb, SKB_DROP_REASON_BPF_CGROUP_EGRESS);
209 return ret;
210 }
211}
212
213int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
214{
215 struct net_device *dev = skb_dst(skb)->dev, *indev = skb->dev;
216 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
217
218 skb->protocol = htons(ETH_P_IPV6);
219 skb->dev = dev;
220
221 if (unlikely(idev->cnf.disable_ipv6)) {
222 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
223 kfree_skb_reason(skb, SKB_DROP_REASON_IPV6DISABLED);
224 return 0;
225 }
226
227 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
228 net, sk, skb, indev, dev,
229 ip6_finish_output,
230 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
231}
232EXPORT_SYMBOL(ip6_output);
233
234bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np)
235{
236 if (!np->autoflowlabel_set)
237 return ip6_default_np_autolabel(net);
238 else
239 return np->autoflowlabel;
240}
241
242/*
243 * xmit an sk_buff (used by TCP, SCTP and DCCP)
244 * Note : socket lock is not held for SYNACK packets, but might be modified
245 * by calls to skb_set_owner_w() and ipv6_local_error(),
246 * which are using proper atomic operations or spinlocks.
247 */
248int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
249 __u32 mark, struct ipv6_txoptions *opt, int tclass, u32 priority)
250{
251 struct net *net = sock_net(sk);
252 const struct ipv6_pinfo *np = inet6_sk(sk);
253 struct in6_addr *first_hop = &fl6->daddr;
254 struct dst_entry *dst = skb_dst(skb);
255 struct net_device *dev = dst->dev;
256 struct inet6_dev *idev = ip6_dst_idev(dst);
257 struct hop_jumbo_hdr *hop_jumbo;
258 int hoplen = sizeof(*hop_jumbo);
259 unsigned int head_room;
260 struct ipv6hdr *hdr;
261 u8 proto = fl6->flowi6_proto;
262 int seg_len = skb->len;
263 int hlimit = -1;
264 u32 mtu;
265
266 head_room = sizeof(struct ipv6hdr) + hoplen + LL_RESERVED_SPACE(dev);
267 if (opt)
268 head_room += opt->opt_nflen + opt->opt_flen;
269
270 if (unlikely(head_room > skb_headroom(skb))) {
271 skb = skb_expand_head(skb, head_room);
272 if (!skb) {
273 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
274 return -ENOBUFS;
275 }
276 }
277
278 if (opt) {
279 seg_len += opt->opt_nflen + opt->opt_flen;
280
281 if (opt->opt_flen)
282 ipv6_push_frag_opts(skb, opt, &proto);
283
284 if (opt->opt_nflen)
285 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop,
286 &fl6->saddr);
287 }
288
289 if (unlikely(seg_len > IPV6_MAXPLEN)) {
290 hop_jumbo = skb_push(skb, hoplen);
291
292 hop_jumbo->nexthdr = proto;
293 hop_jumbo->hdrlen = 0;
294 hop_jumbo->tlv_type = IPV6_TLV_JUMBO;
295 hop_jumbo->tlv_len = 4;
296 hop_jumbo->jumbo_payload_len = htonl(seg_len + hoplen);
297
298 proto = IPPROTO_HOPOPTS;
299 seg_len = 0;
300 IP6CB(skb)->flags |= IP6SKB_FAKEJUMBO;
301 }
302
303 skb_push(skb, sizeof(struct ipv6hdr));
304 skb_reset_network_header(skb);
305 hdr = ipv6_hdr(skb);
306
307 /*
308 * Fill in the IPv6 header
309 */
310 if (np)
311 hlimit = np->hop_limit;
312 if (hlimit < 0)
313 hlimit = ip6_dst_hoplimit(dst);
314
315 ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
316 ip6_autoflowlabel(net, np), fl6));
317
318 hdr->payload_len = htons(seg_len);
319 hdr->nexthdr = proto;
320 hdr->hop_limit = hlimit;
321
322 hdr->saddr = fl6->saddr;
323 hdr->daddr = *first_hop;
324
325 skb->protocol = htons(ETH_P_IPV6);
326 skb->priority = priority;
327 skb->mark = mark;
328
329 mtu = dst_mtu(dst);
330 if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
331 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
332
333 /* if egress device is enslaved to an L3 master device pass the
334 * skb to its handler for processing
335 */
336 skb = l3mdev_ip6_out((struct sock *)sk, skb);
337 if (unlikely(!skb))
338 return 0;
339
340 /* hooks should never assume socket lock is held.
341 * we promote our socket to non const
342 */
343 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
344 net, (struct sock *)sk, skb, NULL, dev,
345 dst_output);
346 }
347
348 skb->dev = dev;
349 /* ipv6_local_error() does not require socket lock,
350 * we promote our socket to non const
351 */
352 ipv6_local_error((struct sock *)sk, EMSGSIZE, fl6, mtu);
353
354 IP6_INC_STATS(net, idev, IPSTATS_MIB_FRAGFAILS);
355 kfree_skb(skb);
356 return -EMSGSIZE;
357}
358EXPORT_SYMBOL(ip6_xmit);
359
360static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
361{
362 struct ip6_ra_chain *ra;
363 struct sock *last = NULL;
364
365 read_lock(&ip6_ra_lock);
366 for (ra = ip6_ra_chain; ra; ra = ra->next) {
367 struct sock *sk = ra->sk;
368 if (sk && ra->sel == sel &&
369 (!sk->sk_bound_dev_if ||
370 sk->sk_bound_dev_if == skb->dev->ifindex)) {
371 struct ipv6_pinfo *np = inet6_sk(sk);
372
373 if (np && np->rtalert_isolate &&
374 !net_eq(sock_net(sk), dev_net(skb->dev))) {
375 continue;
376 }
377 if (last) {
378 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
379 if (skb2)
380 rawv6_rcv(last, skb2);
381 }
382 last = sk;
383 }
384 }
385
386 if (last) {
387 rawv6_rcv(last, skb);
388 read_unlock(&ip6_ra_lock);
389 return 1;
390 }
391 read_unlock(&ip6_ra_lock);
392 return 0;
393}
394
395static int ip6_forward_proxy_check(struct sk_buff *skb)
396{
397 struct ipv6hdr *hdr = ipv6_hdr(skb);
398 u8 nexthdr = hdr->nexthdr;
399 __be16 frag_off;
400 int offset;
401
402 if (ipv6_ext_hdr(nexthdr)) {
403 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
404 if (offset < 0)
405 return 0;
406 } else
407 offset = sizeof(struct ipv6hdr);
408
409 if (nexthdr == IPPROTO_ICMPV6) {
410 struct icmp6hdr *icmp6;
411
412 if (!pskb_may_pull(skb, (skb_network_header(skb) +
413 offset + 1 - skb->data)))
414 return 0;
415
416 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
417
418 switch (icmp6->icmp6_type) {
419 case NDISC_ROUTER_SOLICITATION:
420 case NDISC_ROUTER_ADVERTISEMENT:
421 case NDISC_NEIGHBOUR_SOLICITATION:
422 case NDISC_NEIGHBOUR_ADVERTISEMENT:
423 case NDISC_REDIRECT:
424 /* For reaction involving unicast neighbor discovery
425 * message destined to the proxied address, pass it to
426 * input function.
427 */
428 return 1;
429 default:
430 break;
431 }
432 }
433
434 /*
435 * The proxying router can't forward traffic sent to a link-local
436 * address, so signal the sender and discard the packet. This
437 * behavior is clarified by the MIPv6 specification.
438 */
439 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
440 dst_link_failure(skb);
441 return -1;
442 }
443
444 return 0;
445}
446
447static inline int ip6_forward_finish(struct net *net, struct sock *sk,
448 struct sk_buff *skb)
449{
450 struct dst_entry *dst = skb_dst(skb);
451
452 __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
453 __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
454
455#ifdef CONFIG_NET_SWITCHDEV
456 if (skb->offload_l3_fwd_mark) {
457 consume_skb(skb);
458 return 0;
459 }
460#endif
461
462 skb_clear_tstamp(skb);
463 return dst_output(net, sk, skb);
464}
465
466static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
467{
468 if (skb->len <= mtu)
469 return false;
470
471 /* ipv6 conntrack defrag sets max_frag_size + ignore_df */
472 if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
473 return true;
474
475 if (skb->ignore_df)
476 return false;
477
478 if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
479 return false;
480
481 return true;
482}
483
484int ip6_forward(struct sk_buff *skb)
485{
486 struct dst_entry *dst = skb_dst(skb);
487 struct ipv6hdr *hdr = ipv6_hdr(skb);
488 struct inet6_skb_parm *opt = IP6CB(skb);
489 struct net *net = dev_net(dst->dev);
490 struct inet6_dev *idev;
491 SKB_DR(reason);
492 u32 mtu;
493
494 idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
495 if (net->ipv6.devconf_all->forwarding == 0)
496 goto error;
497
498 if (skb->pkt_type != PACKET_HOST)
499 goto drop;
500
501 if (unlikely(skb->sk))
502 goto drop;
503
504 if (skb_warn_if_lro(skb))
505 goto drop;
506
507 if (!net->ipv6.devconf_all->disable_policy &&
508 (!idev || !idev->cnf.disable_policy) &&
509 !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
510 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
511 goto drop;
512 }
513
514 skb_forward_csum(skb);
515
516 /*
517 * We DO NOT make any processing on
518 * RA packets, pushing them to user level AS IS
519 * without ane WARRANTY that application will be able
520 * to interpret them. The reason is that we
521 * cannot make anything clever here.
522 *
523 * We are not end-node, so that if packet contains
524 * AH/ESP, we cannot make anything.
525 * Defragmentation also would be mistake, RA packets
526 * cannot be fragmented, because there is no warranty
527 * that different fragments will go along one path. --ANK
528 */
529 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
530 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
531 return 0;
532 }
533
534 /*
535 * check and decrement ttl
536 */
537 if (hdr->hop_limit <= 1) {
538 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
539 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
540
541 kfree_skb_reason(skb, SKB_DROP_REASON_IP_INHDR);
542 return -ETIMEDOUT;
543 }
544
545 /* XXX: idev->cnf.proxy_ndp? */
546 if (net->ipv6.devconf_all->proxy_ndp &&
547 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
548 int proxied = ip6_forward_proxy_check(skb);
549 if (proxied > 0) {
550 /* It's tempting to decrease the hop limit
551 * here by 1, as we do at the end of the
552 * function too.
553 *
554 * But that would be incorrect, as proxying is
555 * not forwarding. The ip6_input function
556 * will handle this packet locally, and it
557 * depends on the hop limit being unchanged.
558 *
559 * One example is the NDP hop limit, that
560 * always has to stay 255, but other would be
561 * similar checks around RA packets, where the
562 * user can even change the desired limit.
563 */
564 return ip6_input(skb);
565 } else if (proxied < 0) {
566 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
567 goto drop;
568 }
569 }
570
571 if (!xfrm6_route_forward(skb)) {
572 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
573 SKB_DR_SET(reason, XFRM_POLICY);
574 goto drop;
575 }
576 dst = skb_dst(skb);
577
578 /* IPv6 specs say nothing about it, but it is clear that we cannot
579 send redirects to source routed frames.
580 We don't send redirects to frames decapsulated from IPsec.
581 */
582 if (IP6CB(skb)->iif == dst->dev->ifindex &&
583 opt->srcrt == 0 && !skb_sec_path(skb)) {
584 struct in6_addr *target = NULL;
585 struct inet_peer *peer;
586 struct rt6_info *rt;
587
588 /*
589 * incoming and outgoing devices are the same
590 * send a redirect.
591 */
592
593 rt = (struct rt6_info *) dst;
594 if (rt->rt6i_flags & RTF_GATEWAY)
595 target = &rt->rt6i_gateway;
596 else
597 target = &hdr->daddr;
598
599 peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
600
601 /* Limit redirects both by destination (here)
602 and by source (inside ndisc_send_redirect)
603 */
604 if (inet_peer_xrlim_allow(peer, 1*HZ))
605 ndisc_send_redirect(skb, target);
606 if (peer)
607 inet_putpeer(peer);
608 } else {
609 int addrtype = ipv6_addr_type(&hdr->saddr);
610
611 /* This check is security critical. */
612 if (addrtype == IPV6_ADDR_ANY ||
613 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
614 goto error;
615 if (addrtype & IPV6_ADDR_LINKLOCAL) {
616 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
617 ICMPV6_NOT_NEIGHBOUR, 0);
618 goto error;
619 }
620 }
621
622 mtu = ip6_dst_mtu_maybe_forward(dst, true);
623 if (mtu < IPV6_MIN_MTU)
624 mtu = IPV6_MIN_MTU;
625
626 if (ip6_pkt_too_big(skb, mtu)) {
627 /* Again, force OUTPUT device used as source address */
628 skb->dev = dst->dev;
629 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
630 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INTOOBIGERRORS);
631 __IP6_INC_STATS(net, ip6_dst_idev(dst),
632 IPSTATS_MIB_FRAGFAILS);
633 kfree_skb_reason(skb, SKB_DROP_REASON_PKT_TOO_BIG);
634 return -EMSGSIZE;
635 }
636
637 if (skb_cow(skb, dst->dev->hard_header_len)) {
638 __IP6_INC_STATS(net, ip6_dst_idev(dst),
639 IPSTATS_MIB_OUTDISCARDS);
640 goto drop;
641 }
642
643 hdr = ipv6_hdr(skb);
644
645 /* Mangling hops number delayed to point after skb COW */
646
647 hdr->hop_limit--;
648
649 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
650 net, NULL, skb, skb->dev, dst->dev,
651 ip6_forward_finish);
652
653error:
654 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
655 SKB_DR_SET(reason, IP_INADDRERRORS);
656drop:
657 kfree_skb_reason(skb, reason);
658 return -EINVAL;
659}
660
661static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
662{
663 to->pkt_type = from->pkt_type;
664 to->priority = from->priority;
665 to->protocol = from->protocol;
666 skb_dst_drop(to);
667 skb_dst_set(to, dst_clone(skb_dst(from)));
668 to->dev = from->dev;
669 to->mark = from->mark;
670
671 skb_copy_hash(to, from);
672
673#ifdef CONFIG_NET_SCHED
674 to->tc_index = from->tc_index;
675#endif
676 nf_copy(to, from);
677 skb_ext_copy(to, from);
678 skb_copy_secmark(to, from);
679}
680
681int ip6_fraglist_init(struct sk_buff *skb, unsigned int hlen, u8 *prevhdr,
682 u8 nexthdr, __be32 frag_id,
683 struct ip6_fraglist_iter *iter)
684{
685 unsigned int first_len;
686 struct frag_hdr *fh;
687
688 /* BUILD HEADER */
689 *prevhdr = NEXTHDR_FRAGMENT;
690 iter->tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
691 if (!iter->tmp_hdr)
692 return -ENOMEM;
693
694 iter->frag = skb_shinfo(skb)->frag_list;
695 skb_frag_list_init(skb);
696
697 iter->offset = 0;
698 iter->hlen = hlen;
699 iter->frag_id = frag_id;
700 iter->nexthdr = nexthdr;
701
702 __skb_pull(skb, hlen);
703 fh = __skb_push(skb, sizeof(struct frag_hdr));
704 __skb_push(skb, hlen);
705 skb_reset_network_header(skb);
706 memcpy(skb_network_header(skb), iter->tmp_hdr, hlen);
707
708 fh->nexthdr = nexthdr;
709 fh->reserved = 0;
710 fh->frag_off = htons(IP6_MF);
711 fh->identification = frag_id;
712
713 first_len = skb_pagelen(skb);
714 skb->data_len = first_len - skb_headlen(skb);
715 skb->len = first_len;
716 ipv6_hdr(skb)->payload_len = htons(first_len - sizeof(struct ipv6hdr));
717
718 return 0;
719}
720EXPORT_SYMBOL(ip6_fraglist_init);
721
722void ip6_fraglist_prepare(struct sk_buff *skb,
723 struct ip6_fraglist_iter *iter)
724{
725 struct sk_buff *frag = iter->frag;
726 unsigned int hlen = iter->hlen;
727 struct frag_hdr *fh;
728
729 frag->ip_summed = CHECKSUM_NONE;
730 skb_reset_transport_header(frag);
731 fh = __skb_push(frag, sizeof(struct frag_hdr));
732 __skb_push(frag, hlen);
733 skb_reset_network_header(frag);
734 memcpy(skb_network_header(frag), iter->tmp_hdr, hlen);
735 iter->offset += skb->len - hlen - sizeof(struct frag_hdr);
736 fh->nexthdr = iter->nexthdr;
737 fh->reserved = 0;
738 fh->frag_off = htons(iter->offset);
739 if (frag->next)
740 fh->frag_off |= htons(IP6_MF);
741 fh->identification = iter->frag_id;
742 ipv6_hdr(frag)->payload_len = htons(frag->len - sizeof(struct ipv6hdr));
743 ip6_copy_metadata(frag, skb);
744}
745EXPORT_SYMBOL(ip6_fraglist_prepare);
746
747void ip6_frag_init(struct sk_buff *skb, unsigned int hlen, unsigned int mtu,
748 unsigned short needed_tailroom, int hdr_room, u8 *prevhdr,
749 u8 nexthdr, __be32 frag_id, struct ip6_frag_state *state)
750{
751 state->prevhdr = prevhdr;
752 state->nexthdr = nexthdr;
753 state->frag_id = frag_id;
754
755 state->hlen = hlen;
756 state->mtu = mtu;
757
758 state->left = skb->len - hlen; /* Space per frame */
759 state->ptr = hlen; /* Where to start from */
760
761 state->hroom = hdr_room;
762 state->troom = needed_tailroom;
763
764 state->offset = 0;
765}
766EXPORT_SYMBOL(ip6_frag_init);
767
768struct sk_buff *ip6_frag_next(struct sk_buff *skb, struct ip6_frag_state *state)
769{
770 u8 *prevhdr = state->prevhdr, *fragnexthdr_offset;
771 struct sk_buff *frag;
772 struct frag_hdr *fh;
773 unsigned int len;
774
775 len = state->left;
776 /* IF: it doesn't fit, use 'mtu' - the data space left */
777 if (len > state->mtu)
778 len = state->mtu;
779 /* IF: we are not sending up to and including the packet end
780 then align the next start on an eight byte boundary */
781 if (len < state->left)
782 len &= ~7;
783
784 /* Allocate buffer */
785 frag = alloc_skb(len + state->hlen + sizeof(struct frag_hdr) +
786 state->hroom + state->troom, GFP_ATOMIC);
787 if (!frag)
788 return ERR_PTR(-ENOMEM);
789
790 /*
791 * Set up data on packet
792 */
793
794 ip6_copy_metadata(frag, skb);
795 skb_reserve(frag, state->hroom);
796 skb_put(frag, len + state->hlen + sizeof(struct frag_hdr));
797 skb_reset_network_header(frag);
798 fh = (struct frag_hdr *)(skb_network_header(frag) + state->hlen);
799 frag->transport_header = (frag->network_header + state->hlen +
800 sizeof(struct frag_hdr));
801
802 /*
803 * Charge the memory for the fragment to any owner
804 * it might possess
805 */
806 if (skb->sk)
807 skb_set_owner_w(frag, skb->sk);
808
809 /*
810 * Copy the packet header into the new buffer.
811 */
812 skb_copy_from_linear_data(skb, skb_network_header(frag), state->hlen);
813
814 fragnexthdr_offset = skb_network_header(frag);
815 fragnexthdr_offset += prevhdr - skb_network_header(skb);
816 *fragnexthdr_offset = NEXTHDR_FRAGMENT;
817
818 /*
819 * Build fragment header.
820 */
821 fh->nexthdr = state->nexthdr;
822 fh->reserved = 0;
823 fh->identification = state->frag_id;
824
825 /*
826 * Copy a block of the IP datagram.
827 */
828 BUG_ON(skb_copy_bits(skb, state->ptr, skb_transport_header(frag),
829 len));
830 state->left -= len;
831
832 fh->frag_off = htons(state->offset);
833 if (state->left > 0)
834 fh->frag_off |= htons(IP6_MF);
835 ipv6_hdr(frag)->payload_len = htons(frag->len - sizeof(struct ipv6hdr));
836
837 state->ptr += len;
838 state->offset += len;
839
840 return frag;
841}
842EXPORT_SYMBOL(ip6_frag_next);
843
844int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
845 int (*output)(struct net *, struct sock *, struct sk_buff *))
846{
847 struct sk_buff *frag;
848 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
849 struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
850 inet6_sk(skb->sk) : NULL;
851 bool mono_delivery_time = skb->mono_delivery_time;
852 struct ip6_frag_state state;
853 unsigned int mtu, hlen, nexthdr_offset;
854 ktime_t tstamp = skb->tstamp;
855 int hroom, err = 0;
856 __be32 frag_id;
857 u8 *prevhdr, nexthdr = 0;
858
859 err = ip6_find_1stfragopt(skb, &prevhdr);
860 if (err < 0)
861 goto fail;
862 hlen = err;
863 nexthdr = *prevhdr;
864 nexthdr_offset = prevhdr - skb_network_header(skb);
865
866 mtu = ip6_skb_dst_mtu(skb);
867
868 /* We must not fragment if the socket is set to force MTU discovery
869 * or if the skb it not generated by a local socket.
870 */
871 if (unlikely(!skb->ignore_df && skb->len > mtu))
872 goto fail_toobig;
873
874 if (IP6CB(skb)->frag_max_size) {
875 if (IP6CB(skb)->frag_max_size > mtu)
876 goto fail_toobig;
877
878 /* don't send fragments larger than what we received */
879 mtu = IP6CB(skb)->frag_max_size;
880 if (mtu < IPV6_MIN_MTU)
881 mtu = IPV6_MIN_MTU;
882 }
883
884 if (np && np->frag_size < mtu) {
885 if (np->frag_size)
886 mtu = np->frag_size;
887 }
888 if (mtu < hlen + sizeof(struct frag_hdr) + 8)
889 goto fail_toobig;
890 mtu -= hlen + sizeof(struct frag_hdr);
891
892 frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
893 &ipv6_hdr(skb)->saddr);
894
895 if (skb->ip_summed == CHECKSUM_PARTIAL &&
896 (err = skb_checksum_help(skb)))
897 goto fail;
898
899 prevhdr = skb_network_header(skb) + nexthdr_offset;
900 hroom = LL_RESERVED_SPACE(rt->dst.dev);
901 if (skb_has_frag_list(skb)) {
902 unsigned int first_len = skb_pagelen(skb);
903 struct ip6_fraglist_iter iter;
904 struct sk_buff *frag2;
905
906 if (first_len - hlen > mtu ||
907 ((first_len - hlen) & 7) ||
908 skb_cloned(skb) ||
909 skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
910 goto slow_path;
911
912 skb_walk_frags(skb, frag) {
913 /* Correct geometry. */
914 if (frag->len > mtu ||
915 ((frag->len & 7) && frag->next) ||
916 skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))
917 goto slow_path_clean;
918
919 /* Partially cloned skb? */
920 if (skb_shared(frag))
921 goto slow_path_clean;
922
923 BUG_ON(frag->sk);
924 if (skb->sk) {
925 frag->sk = skb->sk;
926 frag->destructor = sock_wfree;
927 }
928 skb->truesize -= frag->truesize;
929 }
930
931 err = ip6_fraglist_init(skb, hlen, prevhdr, nexthdr, frag_id,
932 &iter);
933 if (err < 0)
934 goto fail;
935
936 /* We prevent @rt from being freed. */
937 rcu_read_lock();
938
939 for (;;) {
940 /* Prepare header of the next frame,
941 * before previous one went down. */
942 if (iter.frag)
943 ip6_fraglist_prepare(skb, &iter);
944
945 skb_set_delivery_time(skb, tstamp, mono_delivery_time);
946 err = output(net, sk, skb);
947 if (!err)
948 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
949 IPSTATS_MIB_FRAGCREATES);
950
951 if (err || !iter.frag)
952 break;
953
954 skb = ip6_fraglist_next(&iter);
955 }
956
957 kfree(iter.tmp_hdr);
958
959 if (err == 0) {
960 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
961 IPSTATS_MIB_FRAGOKS);
962 rcu_read_unlock();
963 return 0;
964 }
965
966 kfree_skb_list(iter.frag);
967
968 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
969 IPSTATS_MIB_FRAGFAILS);
970 rcu_read_unlock();
971 return err;
972
973slow_path_clean:
974 skb_walk_frags(skb, frag2) {
975 if (frag2 == frag)
976 break;
977 frag2->sk = NULL;
978 frag2->destructor = NULL;
979 skb->truesize += frag2->truesize;
980 }
981 }
982
983slow_path:
984 /*
985 * Fragment the datagram.
986 */
987
988 ip6_frag_init(skb, hlen, mtu, rt->dst.dev->needed_tailroom,
989 LL_RESERVED_SPACE(rt->dst.dev), prevhdr, nexthdr, frag_id,
990 &state);
991
992 /*
993 * Keep copying data until we run out.
994 */
995
996 while (state.left > 0) {
997 frag = ip6_frag_next(skb, &state);
998 if (IS_ERR(frag)) {
999 err = PTR_ERR(frag);
1000 goto fail;
1001 }
1002
1003 /*
1004 * Put this fragment into the sending queue.
1005 */
1006 skb_set_delivery_time(frag, tstamp, mono_delivery_time);
1007 err = output(net, sk, frag);
1008 if (err)
1009 goto fail;
1010
1011 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
1012 IPSTATS_MIB_FRAGCREATES);
1013 }
1014 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
1015 IPSTATS_MIB_FRAGOKS);
1016 consume_skb(skb);
1017 return err;
1018
1019fail_toobig:
1020 if (skb->sk && dst_allfrag(skb_dst(skb)))
1021 sk_gso_disable(skb->sk);
1022
1023 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1024 err = -EMSGSIZE;
1025
1026fail:
1027 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
1028 IPSTATS_MIB_FRAGFAILS);
1029 kfree_skb(skb);
1030 return err;
1031}
1032
1033static inline int ip6_rt_check(const struct rt6key *rt_key,
1034 const struct in6_addr *fl_addr,
1035 const struct in6_addr *addr_cache)
1036{
1037 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
1038 (!addr_cache || !ipv6_addr_equal(fl_addr, addr_cache));
1039}
1040
1041static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
1042 struct dst_entry *dst,
1043 const struct flowi6 *fl6)
1044{
1045 struct ipv6_pinfo *np = inet6_sk(sk);
1046 struct rt6_info *rt;
1047
1048 if (!dst)
1049 goto out;
1050
1051 if (dst->ops->family != AF_INET6) {
1052 dst_release(dst);
1053 return NULL;
1054 }
1055
1056 rt = (struct rt6_info *)dst;
1057 /* Yes, checking route validity in not connected
1058 * case is not very simple. Take into account,
1059 * that we do not support routing by source, TOS,
1060 * and MSG_DONTROUTE --ANK (980726)
1061 *
1062 * 1. ip6_rt_check(): If route was host route,
1063 * check that cached destination is current.
1064 * If it is network route, we still may
1065 * check its validity using saved pointer
1066 * to the last used address: daddr_cache.
1067 * We do not want to save whole address now,
1068 * (because main consumer of this service
1069 * is tcp, which has not this problem),
1070 * so that the last trick works only on connected
1071 * sockets.
1072 * 2. oif also should be the same.
1073 */
1074 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
1075#ifdef CONFIG_IPV6_SUBTREES
1076 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
1077#endif
1078 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
1079 dst_release(dst);
1080 dst = NULL;
1081 }
1082
1083out:
1084 return dst;
1085}
1086
1087static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
1088 struct dst_entry **dst, struct flowi6 *fl6)
1089{
1090#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1091 struct neighbour *n;
1092 struct rt6_info *rt;
1093#endif
1094 int err;
1095 int flags = 0;
1096
1097 /* The correct way to handle this would be to do
1098 * ip6_route_get_saddr, and then ip6_route_output; however,
1099 * the route-specific preferred source forces the
1100 * ip6_route_output call _before_ ip6_route_get_saddr.
1101 *
1102 * In source specific routing (no src=any default route),
1103 * ip6_route_output will fail given src=any saddr, though, so
1104 * that's why we try it again later.
1105 */
1106 if (ipv6_addr_any(&fl6->saddr)) {
1107 struct fib6_info *from;
1108 struct rt6_info *rt;
1109
1110 *dst = ip6_route_output(net, sk, fl6);
1111 rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
1112
1113 rcu_read_lock();
1114 from = rt ? rcu_dereference(rt->from) : NULL;
1115 err = ip6_route_get_saddr(net, from, &fl6->daddr,
1116 sk ? inet6_sk(sk)->srcprefs : 0,
1117 &fl6->saddr);
1118 rcu_read_unlock();
1119
1120 if (err)
1121 goto out_err_release;
1122
1123 /* If we had an erroneous initial result, pretend it
1124 * never existed and let the SA-enabled version take
1125 * over.
1126 */
1127 if ((*dst)->error) {
1128 dst_release(*dst);
1129 *dst = NULL;
1130 }
1131
1132 if (fl6->flowi6_oif)
1133 flags |= RT6_LOOKUP_F_IFACE;
1134 }
1135
1136 if (!*dst)
1137 *dst = ip6_route_output_flags(net, sk, fl6, flags);
1138
1139 err = (*dst)->error;
1140 if (err)
1141 goto out_err_release;
1142
1143#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
1144 /*
1145 * Here if the dst entry we've looked up
1146 * has a neighbour entry that is in the INCOMPLETE
1147 * state and the src address from the flow is
1148 * marked as OPTIMISTIC, we release the found
1149 * dst entry and replace it instead with the
1150 * dst entry of the nexthop router
1151 */
1152 rt = (struct rt6_info *) *dst;
1153 rcu_read_lock_bh();
1154 n = __ipv6_neigh_lookup_noref(rt->dst.dev,
1155 rt6_nexthop(rt, &fl6->daddr));
1156 err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
1157 rcu_read_unlock_bh();
1158
1159 if (err) {
1160 struct inet6_ifaddr *ifp;
1161 struct flowi6 fl_gw6;
1162 int redirect;
1163
1164 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
1165 (*dst)->dev, 1);
1166
1167 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
1168 if (ifp)
1169 in6_ifa_put(ifp);
1170
1171 if (redirect) {
1172 /*
1173 * We need to get the dst entry for the
1174 * default router instead
1175 */
1176 dst_release(*dst);
1177 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1178 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1179 *dst = ip6_route_output(net, sk, &fl_gw6);
1180 err = (*dst)->error;
1181 if (err)
1182 goto out_err_release;
1183 }
1184 }
1185#endif
1186 if (ipv6_addr_v4mapped(&fl6->saddr) &&
1187 !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
1188 err = -EAFNOSUPPORT;
1189 goto out_err_release;
1190 }
1191
1192 return 0;
1193
1194out_err_release:
1195 dst_release(*dst);
1196 *dst = NULL;
1197
1198 if (err == -ENETUNREACH)
1199 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1200 return err;
1201}
1202
1203/**
1204 * ip6_dst_lookup - perform route lookup on flow
1205 * @net: Network namespace to perform lookup in
1206 * @sk: socket which provides route info
1207 * @dst: pointer to dst_entry * for result
1208 * @fl6: flow to lookup
1209 *
1210 * This function performs a route lookup on the given flow.
1211 *
1212 * It returns zero on success, or a standard errno code on error.
1213 */
1214int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
1215 struct flowi6 *fl6)
1216{
1217 *dst = NULL;
1218 return ip6_dst_lookup_tail(net, sk, dst, fl6);
1219}
1220EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1221
1222/**
1223 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1224 * @net: Network namespace to perform lookup in
1225 * @sk: socket which provides route info
1226 * @fl6: flow to lookup
1227 * @final_dst: final destination address for ipsec lookup
1228 *
1229 * This function performs a route lookup on the given flow.
1230 *
1231 * It returns a valid dst pointer on success, or a pointer encoded
1232 * error code.
1233 */
1234struct dst_entry *ip6_dst_lookup_flow(struct net *net, const struct sock *sk, struct flowi6 *fl6,
1235 const struct in6_addr *final_dst)
1236{
1237 struct dst_entry *dst = NULL;
1238 int err;
1239
1240 err = ip6_dst_lookup_tail(net, sk, &dst, fl6);
1241 if (err)
1242 return ERR_PTR(err);
1243 if (final_dst)
1244 fl6->daddr = *final_dst;
1245
1246 return xfrm_lookup_route(net, dst, flowi6_to_flowi(fl6), sk, 0);
1247}
1248EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1249
1250/**
1251 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1252 * @sk: socket which provides the dst cache and route info
1253 * @fl6: flow to lookup
1254 * @final_dst: final destination address for ipsec lookup
1255 * @connected: whether @sk is connected or not
1256 *
1257 * This function performs a route lookup on the given flow with the
1258 * possibility of using the cached route in the socket if it is valid.
1259 * It will take the socket dst lock when operating on the dst cache.
1260 * As a result, this function can only be used in process context.
1261 *
1262 * In addition, for a connected socket, cache the dst in the socket
1263 * if the current cache is not valid.
1264 *
1265 * It returns a valid dst pointer on success, or a pointer encoded
1266 * error code.
1267 */
1268struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1269 const struct in6_addr *final_dst,
1270 bool connected)
1271{
1272 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1273
1274 dst = ip6_sk_dst_check(sk, dst, fl6);
1275 if (dst)
1276 return dst;
1277
1278 dst = ip6_dst_lookup_flow(sock_net(sk), sk, fl6, final_dst);
1279 if (connected && !IS_ERR(dst))
1280 ip6_sk_dst_store_flow(sk, dst_clone(dst), fl6);
1281
1282 return dst;
1283}
1284EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1285
1286/**
1287 * ip6_dst_lookup_tunnel - perform route lookup on tunnel
1288 * @skb: Packet for which lookup is done
1289 * @dev: Tunnel device
1290 * @net: Network namespace of tunnel device
1291 * @sock: Socket which provides route info
1292 * @saddr: Memory to store the src ip address
1293 * @info: Tunnel information
1294 * @protocol: IP protocol
1295 * @use_cache: Flag to enable cache usage
1296 * This function performs a route lookup on a tunnel
1297 *
1298 * It returns a valid dst pointer and stores src address to be used in
1299 * tunnel in param saddr on success, else a pointer encoded error code.
1300 */
1301
1302struct dst_entry *ip6_dst_lookup_tunnel(struct sk_buff *skb,
1303 struct net_device *dev,
1304 struct net *net,
1305 struct socket *sock,
1306 struct in6_addr *saddr,
1307 const struct ip_tunnel_info *info,
1308 u8 protocol,
1309 bool use_cache)
1310{
1311 struct dst_entry *dst = NULL;
1312#ifdef CONFIG_DST_CACHE
1313 struct dst_cache *dst_cache;
1314#endif
1315 struct flowi6 fl6;
1316 __u8 prio;
1317
1318#ifdef CONFIG_DST_CACHE
1319 dst_cache = (struct dst_cache *)&info->dst_cache;
1320 if (use_cache) {
1321 dst = dst_cache_get_ip6(dst_cache, saddr);
1322 if (dst)
1323 return dst;
1324 }
1325#endif
1326 memset(&fl6, 0, sizeof(fl6));
1327 fl6.flowi6_mark = skb->mark;
1328 fl6.flowi6_proto = protocol;
1329 fl6.daddr = info->key.u.ipv6.dst;
1330 fl6.saddr = info->key.u.ipv6.src;
1331 prio = info->key.tos;
1332 fl6.flowlabel = ip6_make_flowinfo(prio, info->key.label);
1333
1334 dst = ipv6_stub->ipv6_dst_lookup_flow(net, sock->sk, &fl6,
1335 NULL);
1336 if (IS_ERR(dst)) {
1337 netdev_dbg(dev, "no route to %pI6\n", &fl6.daddr);
1338 return ERR_PTR(-ENETUNREACH);
1339 }
1340 if (dst->dev == dev) { /* is this necessary? */
1341 netdev_dbg(dev, "circular route to %pI6\n", &fl6.daddr);
1342 dst_release(dst);
1343 return ERR_PTR(-ELOOP);
1344 }
1345#ifdef CONFIG_DST_CACHE
1346 if (use_cache)
1347 dst_cache_set_ip6(dst_cache, dst, &fl6.saddr);
1348#endif
1349 *saddr = fl6.saddr;
1350 return dst;
1351}
1352EXPORT_SYMBOL_GPL(ip6_dst_lookup_tunnel);
1353
1354static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1355 gfp_t gfp)
1356{
1357 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1358}
1359
1360static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1361 gfp_t gfp)
1362{
1363 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1364}
1365
1366static void ip6_append_data_mtu(unsigned int *mtu,
1367 int *maxfraglen,
1368 unsigned int fragheaderlen,
1369 struct sk_buff *skb,
1370 struct rt6_info *rt,
1371 unsigned int orig_mtu)
1372{
1373 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1374 if (!skb) {
1375 /* first fragment, reserve header_len */
1376 *mtu = orig_mtu - rt->dst.header_len;
1377
1378 } else {
1379 /*
1380 * this fragment is not first, the headers
1381 * space is regarded as data space.
1382 */
1383 *mtu = orig_mtu;
1384 }
1385 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1386 + fragheaderlen - sizeof(struct frag_hdr);
1387 }
1388}
1389
1390static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
1391 struct inet6_cork *v6_cork, struct ipcm6_cookie *ipc6,
1392 struct rt6_info *rt)
1393{
1394 struct ipv6_pinfo *np = inet6_sk(sk);
1395 unsigned int mtu;
1396 struct ipv6_txoptions *nopt, *opt = ipc6->opt;
1397
1398 /* callers pass dst together with a reference, set it first so
1399 * ip6_cork_release() can put it down even in case of an error.
1400 */
1401 cork->base.dst = &rt->dst;
1402
1403 /*
1404 * setup for corking
1405 */
1406 if (opt) {
1407 if (WARN_ON(v6_cork->opt))
1408 return -EINVAL;
1409
1410 nopt = v6_cork->opt = kzalloc(sizeof(*opt), sk->sk_allocation);
1411 if (unlikely(!nopt))
1412 return -ENOBUFS;
1413
1414 nopt->tot_len = sizeof(*opt);
1415 nopt->opt_flen = opt->opt_flen;
1416 nopt->opt_nflen = opt->opt_nflen;
1417
1418 nopt->dst0opt = ip6_opt_dup(opt->dst0opt, sk->sk_allocation);
1419 if (opt->dst0opt && !nopt->dst0opt)
1420 return -ENOBUFS;
1421
1422 nopt->dst1opt = ip6_opt_dup(opt->dst1opt, sk->sk_allocation);
1423 if (opt->dst1opt && !nopt->dst1opt)
1424 return -ENOBUFS;
1425
1426 nopt->hopopt = ip6_opt_dup(opt->hopopt, sk->sk_allocation);
1427 if (opt->hopopt && !nopt->hopopt)
1428 return -ENOBUFS;
1429
1430 nopt->srcrt = ip6_rthdr_dup(opt->srcrt, sk->sk_allocation);
1431 if (opt->srcrt && !nopt->srcrt)
1432 return -ENOBUFS;
1433
1434 /* need source address above miyazawa*/
1435 }
1436 v6_cork->hop_limit = ipc6->hlimit;
1437 v6_cork->tclass = ipc6->tclass;
1438 if (rt->dst.flags & DST_XFRM_TUNNEL)
1439 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1440 READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
1441 else
1442 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1443 READ_ONCE(rt->dst.dev->mtu) : dst_mtu(xfrm_dst_path(&rt->dst));
1444 if (np->frag_size < mtu) {
1445 if (np->frag_size)
1446 mtu = np->frag_size;
1447 }
1448 cork->base.fragsize = mtu;
1449 cork->base.gso_size = ipc6->gso_size;
1450 cork->base.tx_flags = 0;
1451 cork->base.mark = ipc6->sockc.mark;
1452 sock_tx_timestamp(sk, ipc6->sockc.tsflags, &cork->base.tx_flags);
1453
1454 if (dst_allfrag(xfrm_dst_path(&rt->dst)))
1455 cork->base.flags |= IPCORK_ALLFRAG;
1456 cork->base.length = 0;
1457
1458 cork->base.transmit_time = ipc6->sockc.transmit_time;
1459
1460 return 0;
1461}
1462
1463static int __ip6_append_data(struct sock *sk,
1464 struct sk_buff_head *queue,
1465 struct inet_cork_full *cork_full,
1466 struct inet6_cork *v6_cork,
1467 struct page_frag *pfrag,
1468 int getfrag(void *from, char *to, int offset,
1469 int len, int odd, struct sk_buff *skb),
1470 void *from, size_t length, int transhdrlen,
1471 unsigned int flags, struct ipcm6_cookie *ipc6)
1472{
1473 struct sk_buff *skb, *skb_prev = NULL;
1474 struct inet_cork *cork = &cork_full->base;
1475 struct flowi6 *fl6 = &cork_full->fl.u.ip6;
1476 unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
1477 struct ubuf_info *uarg = NULL;
1478 int exthdrlen = 0;
1479 int dst_exthdrlen = 0;
1480 int hh_len;
1481 int copy;
1482 int err;
1483 int offset = 0;
1484 bool zc = false;
1485 u32 tskey = 0;
1486 struct rt6_info *rt = (struct rt6_info *)cork->dst;
1487 struct ipv6_txoptions *opt = v6_cork->opt;
1488 int csummode = CHECKSUM_NONE;
1489 unsigned int maxnonfragsize, headersize;
1490 unsigned int wmem_alloc_delta = 0;
1491 bool paged, extra_uref = false;
1492
1493 skb = skb_peek_tail(queue);
1494 if (!skb) {
1495 exthdrlen = opt ? opt->opt_flen : 0;
1496 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1497 }
1498
1499 paged = !!cork->gso_size;
1500 mtu = cork->gso_size ? IP6_MAX_MTU : cork->fragsize;
1501 orig_mtu = mtu;
1502
1503 if (cork->tx_flags & SKBTX_ANY_SW_TSTAMP &&
1504 sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
1505 tskey = atomic_inc_return(&sk->sk_tskey) - 1;
1506
1507 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1508
1509 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1510 (opt ? opt->opt_nflen : 0);
1511
1512 headersize = sizeof(struct ipv6hdr) +
1513 (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1514 (dst_allfrag(&rt->dst) ?
1515 sizeof(struct frag_hdr) : 0) +
1516 rt->rt6i_nfheader_len;
1517
1518 if (mtu <= fragheaderlen ||
1519 ((mtu - fragheaderlen) & ~7) + fragheaderlen <= sizeof(struct frag_hdr))
1520 goto emsgsize;
1521
1522 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1523 sizeof(struct frag_hdr);
1524
1525 /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit
1526 * the first fragment
1527 */
1528 if (headersize + transhdrlen > mtu)
1529 goto emsgsize;
1530
1531 if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
1532 (sk->sk_protocol == IPPROTO_UDP ||
1533 sk->sk_protocol == IPPROTO_ICMPV6 ||
1534 sk->sk_protocol == IPPROTO_RAW)) {
1535 ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1536 sizeof(struct ipv6hdr));
1537 goto emsgsize;
1538 }
1539
1540 if (ip6_sk_ignore_df(sk))
1541 maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1542 else
1543 maxnonfragsize = mtu;
1544
1545 if (cork->length + length > maxnonfragsize - headersize) {
1546emsgsize:
1547 pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0);
1548 ipv6_local_error(sk, EMSGSIZE, fl6, pmtu);
1549 return -EMSGSIZE;
1550 }
1551
1552 /* CHECKSUM_PARTIAL only with no extension headers and when
1553 * we are not going to fragment
1554 */
1555 if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
1556 headersize == sizeof(struct ipv6hdr) &&
1557 length <= mtu - headersize &&
1558 (!(flags & MSG_MORE) || cork->gso_size) &&
1559 rt->dst.dev->features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM))
1560 csummode = CHECKSUM_PARTIAL;
1561
1562 if ((flags & MSG_ZEROCOPY) && length) {
1563 struct msghdr *msg = from;
1564
1565 if (getfrag == ip_generic_getfrag && msg->msg_ubuf) {
1566 if (skb_zcopy(skb) && msg->msg_ubuf != skb_zcopy(skb))
1567 return -EINVAL;
1568
1569 /* Leave uarg NULL if can't zerocopy, callers should
1570 * be able to handle it.
1571 */
1572 if ((rt->dst.dev->features & NETIF_F_SG) &&
1573 csummode == CHECKSUM_PARTIAL) {
1574 paged = true;
1575 zc = true;
1576 uarg = msg->msg_ubuf;
1577 }
1578 } else if (sock_flag(sk, SOCK_ZEROCOPY)) {
1579 uarg = msg_zerocopy_realloc(sk, length, skb_zcopy(skb));
1580 if (!uarg)
1581 return -ENOBUFS;
1582 extra_uref = !skb_zcopy(skb); /* only ref on new uarg */
1583 if (rt->dst.dev->features & NETIF_F_SG &&
1584 csummode == CHECKSUM_PARTIAL) {
1585 paged = true;
1586 zc = true;
1587 } else {
1588 uarg_to_msgzc(uarg)->zerocopy = 0;
1589 skb_zcopy_set(skb, uarg, &extra_uref);
1590 }
1591 }
1592 }
1593
1594 /*
1595 * Let's try using as much space as possible.
1596 * Use MTU if total length of the message fits into the MTU.
1597 * Otherwise, we need to reserve fragment header and
1598 * fragment alignment (= 8-15 octects, in total).
1599 *
1600 * Note that we may need to "move" the data from the tail
1601 * of the buffer to the new fragment when we split
1602 * the message.
1603 *
1604 * FIXME: It may be fragmented into multiple chunks
1605 * at once if non-fragmentable extension headers
1606 * are too large.
1607 * --yoshfuji
1608 */
1609
1610 cork->length += length;
1611 if (!skb)
1612 goto alloc_new_skb;
1613
1614 while (length > 0) {
1615 /* Check if the remaining data fits into current packet. */
1616 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1617 if (copy < length)
1618 copy = maxfraglen - skb->len;
1619
1620 if (copy <= 0) {
1621 char *data;
1622 unsigned int datalen;
1623 unsigned int fraglen;
1624 unsigned int fraggap;
1625 unsigned int alloclen, alloc_extra;
1626 unsigned int pagedlen;
1627alloc_new_skb:
1628 /* There's no room in the current skb */
1629 if (skb)
1630 fraggap = skb->len - maxfraglen;
1631 else
1632 fraggap = 0;
1633 /* update mtu and maxfraglen if necessary */
1634 if (!skb || !skb_prev)
1635 ip6_append_data_mtu(&mtu, &maxfraglen,
1636 fragheaderlen, skb, rt,
1637 orig_mtu);
1638
1639 skb_prev = skb;
1640
1641 /*
1642 * If remaining data exceeds the mtu,
1643 * we know we need more fragment(s).
1644 */
1645 datalen = length + fraggap;
1646
1647 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1648 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1649 fraglen = datalen + fragheaderlen;
1650 pagedlen = 0;
1651
1652 alloc_extra = hh_len;
1653 alloc_extra += dst_exthdrlen;
1654 alloc_extra += rt->dst.trailer_len;
1655
1656 /* We just reserve space for fragment header.
1657 * Note: this may be overallocation if the message
1658 * (without MSG_MORE) fits into the MTU.
1659 */
1660 alloc_extra += sizeof(struct frag_hdr);
1661
1662 if ((flags & MSG_MORE) &&
1663 !(rt->dst.dev->features&NETIF_F_SG))
1664 alloclen = mtu;
1665 else if (!paged &&
1666 (fraglen + alloc_extra < SKB_MAX_ALLOC ||
1667 !(rt->dst.dev->features & NETIF_F_SG)))
1668 alloclen = fraglen;
1669 else {
1670 alloclen = fragheaderlen + transhdrlen;
1671 pagedlen = datalen - transhdrlen;
1672 }
1673 alloclen += alloc_extra;
1674
1675 if (datalen != length + fraggap) {
1676 /*
1677 * this is not the last fragment, the trailer
1678 * space is regarded as data space.
1679 */
1680 datalen += rt->dst.trailer_len;
1681 }
1682
1683 fraglen = datalen + fragheaderlen;
1684
1685 copy = datalen - transhdrlen - fraggap - pagedlen;
1686 if (copy < 0) {
1687 err = -EINVAL;
1688 goto error;
1689 }
1690 if (transhdrlen) {
1691 skb = sock_alloc_send_skb(sk, alloclen,
1692 (flags & MSG_DONTWAIT), &err);
1693 } else {
1694 skb = NULL;
1695 if (refcount_read(&sk->sk_wmem_alloc) + wmem_alloc_delta <=
1696 2 * sk->sk_sndbuf)
1697 skb = alloc_skb(alloclen,
1698 sk->sk_allocation);
1699 if (unlikely(!skb))
1700 err = -ENOBUFS;
1701 }
1702 if (!skb)
1703 goto error;
1704 /*
1705 * Fill in the control structures
1706 */
1707 skb->protocol = htons(ETH_P_IPV6);
1708 skb->ip_summed = csummode;
1709 skb->csum = 0;
1710 /* reserve for fragmentation and ipsec header */
1711 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1712 dst_exthdrlen);
1713
1714 /*
1715 * Find where to start putting bytes
1716 */
1717 data = skb_put(skb, fraglen - pagedlen);
1718 skb_set_network_header(skb, exthdrlen);
1719 data += fragheaderlen;
1720 skb->transport_header = (skb->network_header +
1721 fragheaderlen);
1722 if (fraggap) {
1723 skb->csum = skb_copy_and_csum_bits(
1724 skb_prev, maxfraglen,
1725 data + transhdrlen, fraggap);
1726 skb_prev->csum = csum_sub(skb_prev->csum,
1727 skb->csum);
1728 data += fraggap;
1729 pskb_trim_unique(skb_prev, maxfraglen);
1730 }
1731 if (copy > 0 &&
1732 getfrag(from, data + transhdrlen, offset,
1733 copy, fraggap, skb) < 0) {
1734 err = -EFAULT;
1735 kfree_skb(skb);
1736 goto error;
1737 }
1738
1739 offset += copy;
1740 length -= copy + transhdrlen;
1741 transhdrlen = 0;
1742 exthdrlen = 0;
1743 dst_exthdrlen = 0;
1744
1745 /* Only the initial fragment is time stamped */
1746 skb_shinfo(skb)->tx_flags = cork->tx_flags;
1747 cork->tx_flags = 0;
1748 skb_shinfo(skb)->tskey = tskey;
1749 tskey = 0;
1750 skb_zcopy_set(skb, uarg, &extra_uref);
1751
1752 if ((flags & MSG_CONFIRM) && !skb_prev)
1753 skb_set_dst_pending_confirm(skb, 1);
1754
1755 /*
1756 * Put the packet on the pending queue
1757 */
1758 if (!skb->destructor) {
1759 skb->destructor = sock_wfree;
1760 skb->sk = sk;
1761 wmem_alloc_delta += skb->truesize;
1762 }
1763 __skb_queue_tail(queue, skb);
1764 continue;
1765 }
1766
1767 if (copy > length)
1768 copy = length;
1769
1770 if (!(rt->dst.dev->features&NETIF_F_SG) &&
1771 skb_tailroom(skb) >= copy) {
1772 unsigned int off;
1773
1774 off = skb->len;
1775 if (getfrag(from, skb_put(skb, copy),
1776 offset, copy, off, skb) < 0) {
1777 __skb_trim(skb, off);
1778 err = -EFAULT;
1779 goto error;
1780 }
1781 } else if (!zc) {
1782 int i = skb_shinfo(skb)->nr_frags;
1783
1784 err = -ENOMEM;
1785 if (!sk_page_frag_refill(sk, pfrag))
1786 goto error;
1787
1788 skb_zcopy_downgrade_managed(skb);
1789 if (!skb_can_coalesce(skb, i, pfrag->page,
1790 pfrag->offset)) {
1791 err = -EMSGSIZE;
1792 if (i == MAX_SKB_FRAGS)
1793 goto error;
1794
1795 __skb_fill_page_desc(skb, i, pfrag->page,
1796 pfrag->offset, 0);
1797 skb_shinfo(skb)->nr_frags = ++i;
1798 get_page(pfrag->page);
1799 }
1800 copy = min_t(int, copy, pfrag->size - pfrag->offset);
1801 if (getfrag(from,
1802 page_address(pfrag->page) + pfrag->offset,
1803 offset, copy, skb->len, skb) < 0)
1804 goto error_efault;
1805
1806 pfrag->offset += copy;
1807 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1808 skb->len += copy;
1809 skb->data_len += copy;
1810 skb->truesize += copy;
1811 wmem_alloc_delta += copy;
1812 } else {
1813 err = skb_zerocopy_iter_dgram(skb, from, copy);
1814 if (err < 0)
1815 goto error;
1816 }
1817 offset += copy;
1818 length -= copy;
1819 }
1820
1821 if (wmem_alloc_delta)
1822 refcount_add(wmem_alloc_delta, &sk->sk_wmem_alloc);
1823 return 0;
1824
1825error_efault:
1826 err = -EFAULT;
1827error:
1828 net_zcopy_put_abort(uarg, extra_uref);
1829 cork->length -= length;
1830 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1831 refcount_add(wmem_alloc_delta, &sk->sk_wmem_alloc);
1832 return err;
1833}
1834
1835int ip6_append_data(struct sock *sk,
1836 int getfrag(void *from, char *to, int offset, int len,
1837 int odd, struct sk_buff *skb),
1838 void *from, size_t length, int transhdrlen,
1839 struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
1840 struct rt6_info *rt, unsigned int flags)
1841{
1842 struct inet_sock *inet = inet_sk(sk);
1843 struct ipv6_pinfo *np = inet6_sk(sk);
1844 int exthdrlen;
1845 int err;
1846
1847 if (flags&MSG_PROBE)
1848 return 0;
1849 if (skb_queue_empty(&sk->sk_write_queue)) {
1850 /*
1851 * setup for corking
1852 */
1853 dst_hold(&rt->dst);
1854 err = ip6_setup_cork(sk, &inet->cork, &np->cork,
1855 ipc6, rt);
1856 if (err)
1857 return err;
1858
1859 inet->cork.fl.u.ip6 = *fl6;
1860 exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
1861 length += exthdrlen;
1862 transhdrlen += exthdrlen;
1863 } else {
1864 transhdrlen = 0;
1865 }
1866
1867 return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork,
1868 &np->cork, sk_page_frag(sk), getfrag,
1869 from, length, transhdrlen, flags, ipc6);
1870}
1871EXPORT_SYMBOL_GPL(ip6_append_data);
1872
1873static void ip6_cork_steal_dst(struct sk_buff *skb, struct inet_cork_full *cork)
1874{
1875 struct dst_entry *dst = cork->base.dst;
1876
1877 cork->base.dst = NULL;
1878 cork->base.flags &= ~IPCORK_ALLFRAG;
1879 skb_dst_set(skb, dst);
1880}
1881
1882static void ip6_cork_release(struct inet_cork_full *cork,
1883 struct inet6_cork *v6_cork)
1884{
1885 if (v6_cork->opt) {
1886 struct ipv6_txoptions *opt = v6_cork->opt;
1887
1888 kfree(opt->dst0opt);
1889 kfree(opt->dst1opt);
1890 kfree(opt->hopopt);
1891 kfree(opt->srcrt);
1892 kfree(opt);
1893 v6_cork->opt = NULL;
1894 }
1895
1896 if (cork->base.dst) {
1897 dst_release(cork->base.dst);
1898 cork->base.dst = NULL;
1899 cork->base.flags &= ~IPCORK_ALLFRAG;
1900 }
1901}
1902
1903struct sk_buff *__ip6_make_skb(struct sock *sk,
1904 struct sk_buff_head *queue,
1905 struct inet_cork_full *cork,
1906 struct inet6_cork *v6_cork)
1907{
1908 struct sk_buff *skb, *tmp_skb;
1909 struct sk_buff **tail_skb;
1910 struct in6_addr *final_dst;
1911 struct ipv6_pinfo *np = inet6_sk(sk);
1912 struct net *net = sock_net(sk);
1913 struct ipv6hdr *hdr;
1914 struct ipv6_txoptions *opt = v6_cork->opt;
1915 struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
1916 struct flowi6 *fl6 = &cork->fl.u.ip6;
1917 unsigned char proto = fl6->flowi6_proto;
1918
1919 skb = __skb_dequeue(queue);
1920 if (!skb)
1921 goto out;
1922 tail_skb = &(skb_shinfo(skb)->frag_list);
1923
1924 /* move skb->data to ip header from ext header */
1925 if (skb->data < skb_network_header(skb))
1926 __skb_pull(skb, skb_network_offset(skb));
1927 while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
1928 __skb_pull(tmp_skb, skb_network_header_len(skb));
1929 *tail_skb = tmp_skb;
1930 tail_skb = &(tmp_skb->next);
1931 skb->len += tmp_skb->len;
1932 skb->data_len += tmp_skb->len;
1933 skb->truesize += tmp_skb->truesize;
1934 tmp_skb->destructor = NULL;
1935 tmp_skb->sk = NULL;
1936 }
1937
1938 /* Allow local fragmentation. */
1939 skb->ignore_df = ip6_sk_ignore_df(sk);
1940 __skb_pull(skb, skb_network_header_len(skb));
1941
1942 final_dst = &fl6->daddr;
1943 if (opt && opt->opt_flen)
1944 ipv6_push_frag_opts(skb, opt, &proto);
1945 if (opt && opt->opt_nflen)
1946 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst, &fl6->saddr);
1947
1948 skb_push(skb, sizeof(struct ipv6hdr));
1949 skb_reset_network_header(skb);
1950 hdr = ipv6_hdr(skb);
1951
1952 ip6_flow_hdr(hdr, v6_cork->tclass,
1953 ip6_make_flowlabel(net, skb, fl6->flowlabel,
1954 ip6_autoflowlabel(net, np), fl6));
1955 hdr->hop_limit = v6_cork->hop_limit;
1956 hdr->nexthdr = proto;
1957 hdr->saddr = fl6->saddr;
1958 hdr->daddr = *final_dst;
1959
1960 skb->priority = sk->sk_priority;
1961 skb->mark = cork->base.mark;
1962 skb->tstamp = cork->base.transmit_time;
1963
1964 ip6_cork_steal_dst(skb, cork);
1965 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1966 if (proto == IPPROTO_ICMPV6) {
1967 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1968
1969 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
1970 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1971 }
1972
1973 ip6_cork_release(cork, v6_cork);
1974out:
1975 return skb;
1976}
1977
1978int ip6_send_skb(struct sk_buff *skb)
1979{
1980 struct net *net = sock_net(skb->sk);
1981 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
1982 int err;
1983
1984 err = ip6_local_out(net, skb->sk, skb);
1985 if (err) {
1986 if (err > 0)
1987 err = net_xmit_errno(err);
1988 if (err)
1989 IP6_INC_STATS(net, rt->rt6i_idev,
1990 IPSTATS_MIB_OUTDISCARDS);
1991 }
1992
1993 return err;
1994}
1995
1996int ip6_push_pending_frames(struct sock *sk)
1997{
1998 struct sk_buff *skb;
1999
2000 skb = ip6_finish_skb(sk);
2001 if (!skb)
2002 return 0;
2003
2004 return ip6_send_skb(skb);
2005}
2006EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
2007
2008static void __ip6_flush_pending_frames(struct sock *sk,
2009 struct sk_buff_head *queue,
2010 struct inet_cork_full *cork,
2011 struct inet6_cork *v6_cork)
2012{
2013 struct sk_buff *skb;
2014
2015 while ((skb = __skb_dequeue_tail(queue)) != NULL) {
2016 if (skb_dst(skb))
2017 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
2018 IPSTATS_MIB_OUTDISCARDS);
2019 kfree_skb(skb);
2020 }
2021
2022 ip6_cork_release(cork, v6_cork);
2023}
2024
2025void ip6_flush_pending_frames(struct sock *sk)
2026{
2027 __ip6_flush_pending_frames(sk, &sk->sk_write_queue,
2028 &inet_sk(sk)->cork, &inet6_sk(sk)->cork);
2029}
2030EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
2031
2032struct sk_buff *ip6_make_skb(struct sock *sk,
2033 int getfrag(void *from, char *to, int offset,
2034 int len, int odd, struct sk_buff *skb),
2035 void *from, size_t length, int transhdrlen,
2036 struct ipcm6_cookie *ipc6, struct rt6_info *rt,
2037 unsigned int flags, struct inet_cork_full *cork)
2038{
2039 struct inet6_cork v6_cork;
2040 struct sk_buff_head queue;
2041 int exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
2042 int err;
2043
2044 if (flags & MSG_PROBE) {
2045 dst_release(&rt->dst);
2046 return NULL;
2047 }
2048
2049 __skb_queue_head_init(&queue);
2050
2051 cork->base.flags = 0;
2052 cork->base.addr = 0;
2053 cork->base.opt = NULL;
2054 v6_cork.opt = NULL;
2055 err = ip6_setup_cork(sk, cork, &v6_cork, ipc6, rt);
2056 if (err) {
2057 ip6_cork_release(cork, &v6_cork);
2058 return ERR_PTR(err);
2059 }
2060 if (ipc6->dontfrag < 0)
2061 ipc6->dontfrag = inet6_sk(sk)->dontfrag;
2062
2063 err = __ip6_append_data(sk, &queue, cork, &v6_cork,
2064 ¤t->task_frag, getfrag, from,
2065 length + exthdrlen, transhdrlen + exthdrlen,
2066 flags, ipc6);
2067 if (err) {
2068 __ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
2069 return ERR_PTR(err);
2070 }
2071
2072 return __ip6_make_skb(sk, &queue, cork, &v6_cork);
2073}