1/*
   2 *	IPv6 output functions
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on linux/net/ipv4/ip_output.c
   9 *
  10 *	This program is free software; you can redistribute it and/or
  11 *      modify it under the terms of the GNU General Public License
  12 *      as published by the Free Software Foundation; either version
  13 *      2 of the License, or (at your option) any later version.
  14 *
  15 *	Changes:
  16 *	A.N.Kuznetsov	:	airthmetics in fragmentation.
  17 *				extension headers are implemented.
  18 *				route changes now work.
  19 *				ip6_forward does not confuse sniffers.
  20 *				etc.
  21 *
  22 *      H. von Brand    :       Added missing #include <linux/string.h>
  23 *	Imran Patel	: 	frag id should be in NBO
  24 *      Kazunori MIYAZAWA @USAGI
  25 *			:       add ip6_append_data and related functions
  26 *				for datagram xmit
  27 */
  28
  29#include <linux/errno.h>
  30#include <linux/kernel.h>
  31#include <linux/string.h>
  32#include <linux/socket.h>
  33#include <linux/net.h>
  34#include <linux/netdevice.h>
  35#include <linux/if_arp.h>
  36#include <linux/in6.h>
  37#include <linux/tcp.h>
  38#include <linux/route.h>
  39#include <linux/module.h>
  40#include <linux/slab.h>
  41
  42#include <linux/netfilter.h>
  43#include <linux/netfilter_ipv6.h>
  44
  45#include <net/sock.h>
  46#include <net/snmp.h>
  47
  48#include <net/ipv6.h>
  49#include <net/ndisc.h>
  50#include <net/protocol.h>
  51#include <net/ip6_route.h>
  52#include <net/addrconf.h>
  53#include <net/rawv6.h>
  54#include <net/icmp.h>
  55#include <net/xfrm.h>
  56#include <net/checksum.h>
  57#include <linux/mroute6.h>
 
  58
  59int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
  60
  61int __ip6_local_out(struct sk_buff *skb)
  62{
  63	int len;
  64
  65	len = skb->len - sizeof(struct ipv6hdr);
  66	if (len > IPV6_MAXPLEN)
  67		len = 0;
  68	ipv6_hdr(skb)->payload_len = htons(len);
  69
  70	return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
  71		       skb_dst(skb)->dev, dst_output);
  72}
  73
  74int ip6_local_out(struct sk_buff *skb)
  75{
  76	int err;
  77
  78	err = __ip6_local_out(skb);
  79	if (likely(err == 1))
  80		err = dst_output(skb);
  81
  82	return err;
  83}
  84EXPORT_SYMBOL_GPL(ip6_local_out);
  85
  86/* dev_loopback_xmit for use with netfilter. */
  87static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
  88{
  89	skb_reset_mac_header(newskb);
  90	__skb_pull(newskb, skb_network_offset(newskb));
  91	newskb->pkt_type = PACKET_LOOPBACK;
  92	newskb->ip_summed = CHECKSUM_UNNECESSARY;
  93	WARN_ON(!skb_dst(newskb));
  94
  95	netif_rx_ni(newskb);
  96	return 0;
  97}
  98
  99static int ip6_finish_output2(struct sk_buff *skb)
 100{
 101	struct dst_entry *dst = skb_dst(skb);
 102	struct net_device *dev = dst->dev;
 103	struct neighbour *neigh;
 
 
 104
 105	skb->protocol = htons(ETH_P_IPV6);
 106	skb->dev = dev;
 107
 108	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
 109		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 110
 111		if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
 112		    ((mroute6_socket(dev_net(dev), skb) &&
 113		     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
 114		     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
 115					 &ipv6_hdr(skb)->saddr))) {
 116			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
 117
 118			/* Do not check for IFF_ALLMULTI; multicast routing
 119			   is not supported in any case.
 120			 */
 121			if (newskb)
 122				NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
 123					newskb, NULL, newskb->dev,
 124					ip6_dev_loopback_xmit);
 125
 126			if (ipv6_hdr(skb)->hop_limit == 0) {
 127				IP6_INC_STATS(dev_net(dev), idev,
 128					      IPSTATS_MIB_OUTDISCARDS);
 129				kfree_skb(skb);
 130				return 0;
 131			}
 132		}
 133
 134		IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
 135				skb->len);
 136	}
 137
 138	rcu_read_lock();
 139	neigh = dst_get_neighbour_noref(dst);
 140	if (neigh) {
 141		int res = neigh_output(neigh, skb);
 
 
 
 142
 143		rcu_read_unlock();
 144		return res;
 
 
 
 
 
 
 
 145	}
 146	rcu_read_unlock();
 147	IP6_INC_STATS_BH(dev_net(dst->dev),
 148			 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
 149	kfree_skb(skb);
 150	return -EINVAL;
 151}
 152
 153static int ip6_finish_output(struct sk_buff *skb)
 154{
 155	if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
 156	    dst_allfrag(skb_dst(skb)))
 157		return ip6_fragment(skb, ip6_finish_output2);
 
 158	else
 159		return ip6_finish_output2(skb);
 160}
 161
 162int ip6_output(struct sk_buff *skb)
 163{
 164	struct net_device *dev = skb_dst(skb)->dev;
 165	struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 
 166	if (unlikely(idev->cnf.disable_ipv6)) {
 167		IP6_INC_STATS(dev_net(dev), idev,
 168			      IPSTATS_MIB_OUTDISCARDS);
 169		kfree_skb(skb);
 170		return 0;
 171	}
 172
 173	return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
 
 174			    ip6_finish_output,
 175			    !(IP6CB(skb)->flags & IP6SKB_REROUTED));
 176}
 177
 178/*
 179 *	xmit an sk_buff (used by TCP, SCTP and DCCP)
 
 
 
 180 */
 181
 182int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 183	     struct ipv6_txoptions *opt, int tclass)
 184{
 185	struct net *net = sock_net(sk);
 186	struct ipv6_pinfo *np = inet6_sk(sk);
 187	struct in6_addr *first_hop = &fl6->daddr;
 188	struct dst_entry *dst = skb_dst(skb);
 189	struct ipv6hdr *hdr;
 190	u8  proto = fl6->flowi6_proto;
 191	int seg_len = skb->len;
 192	int hlimit = -1;
 193	u32 mtu;
 194
 195	if (opt) {
 196		unsigned int head_room;
 197
 198		/* First: exthdrs may take lots of space (~8K for now)
 199		   MAX_HEADER is not enough.
 200		 */
 201		head_room = opt->opt_nflen + opt->opt_flen;
 202		seg_len += head_room;
 203		head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
 204
 205		if (skb_headroom(skb) < head_room) {
 206			struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
 207			if (skb2 == NULL) {
 208				IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 209					      IPSTATS_MIB_OUTDISCARDS);
 210				kfree_skb(skb);
 211				return -ENOBUFS;
 212			}
 213			consume_skb(skb);
 214			skb = skb2;
 215			skb_set_owner_w(skb, sk);
 
 
 
 216		}
 217		if (opt->opt_flen)
 218			ipv6_push_frag_opts(skb, opt, &proto);
 219		if (opt->opt_nflen)
 220			ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
 221	}
 222
 223	skb_push(skb, sizeof(struct ipv6hdr));
 224	skb_reset_network_header(skb);
 225	hdr = ipv6_hdr(skb);
 226
 227	/*
 228	 *	Fill in the IPv6 header
 229	 */
 230	if (np)
 231		hlimit = np->hop_limit;
 232	if (hlimit < 0)
 233		hlimit = ip6_dst_hoplimit(dst);
 234
 235	*(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl6->flowlabel;
 
 236
 237	hdr->payload_len = htons(seg_len);
 238	hdr->nexthdr = proto;
 239	hdr->hop_limit = hlimit;
 240
 241	hdr->saddr = fl6->saddr;
 242	hdr->daddr = *first_hop;
 243
 
 244	skb->priority = sk->sk_priority;
 245	skb->mark = sk->sk_mark;
 246
 247	mtu = dst_mtu(dst);
 248	if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
 249		IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
 250			      IPSTATS_MIB_OUT, skb->len);
 251		return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
 252			       dst->dev, dst_output);
 
 
 
 
 253	}
 254
 255	net_dbg_ratelimited("IPv6: sending pkt_too_big to self\n");
 256	skb->dev = dst->dev;
 257	icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 
 
 
 
 258	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
 259	kfree_skb(skb);
 260	return -EMSGSIZE;
 261}
 262
 263EXPORT_SYMBOL(ip6_xmit);
 264
 265/*
 266 *	To avoid extra problems ND packets are send through this
 267 *	routine. It's code duplication but I really want to avoid
 268 *	extra checks since ipv6_build_header is used by TCP (which
 269 *	is for us performance critical)
 270 */
 271
 272int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
 273	       const struct in6_addr *saddr, const struct in6_addr *daddr,
 274	       int proto, int len)
 275{
 276	struct ipv6_pinfo *np = inet6_sk(sk);
 277	struct ipv6hdr *hdr;
 278
 279	skb->protocol = htons(ETH_P_IPV6);
 280	skb->dev = dev;
 281
 282	skb_reset_network_header(skb);
 283	skb_put(skb, sizeof(struct ipv6hdr));
 284	hdr = ipv6_hdr(skb);
 285
 286	*(__be32*)hdr = htonl(0x60000000);
 287
 288	hdr->payload_len = htons(len);
 289	hdr->nexthdr = proto;
 290	hdr->hop_limit = np->hop_limit;
 291
 292	hdr->saddr = *saddr;
 293	hdr->daddr = *daddr;
 294
 295	return 0;
 296}
 297
 298static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
 299{
 300	struct ip6_ra_chain *ra;
 301	struct sock *last = NULL;
 302
 303	read_lock(&ip6_ra_lock);
 304	for (ra = ip6_ra_chain; ra; ra = ra->next) {
 305		struct sock *sk = ra->sk;
 306		if (sk && ra->sel == sel &&
 307		    (!sk->sk_bound_dev_if ||
 308		     sk->sk_bound_dev_if == skb->dev->ifindex)) {
 309			if (last) {
 310				struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 311				if (skb2)
 312					rawv6_rcv(last, skb2);
 313			}
 314			last = sk;
 315		}
 316	}
 317
 318	if (last) {
 319		rawv6_rcv(last, skb);
 320		read_unlock(&ip6_ra_lock);
 321		return 1;
 322	}
 323	read_unlock(&ip6_ra_lock);
 324	return 0;
 325}
 326
 327static int ip6_forward_proxy_check(struct sk_buff *skb)
 328{
 329	struct ipv6hdr *hdr = ipv6_hdr(skb);
 330	u8 nexthdr = hdr->nexthdr;
 331	__be16 frag_off;
 332	int offset;
 333
 334	if (ipv6_ext_hdr(nexthdr)) {
 335		offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
 336		if (offset < 0)
 337			return 0;
 338	} else
 339		offset = sizeof(struct ipv6hdr);
 340
 341	if (nexthdr == IPPROTO_ICMPV6) {
 342		struct icmp6hdr *icmp6;
 343
 344		if (!pskb_may_pull(skb, (skb_network_header(skb) +
 345					 offset + 1 - skb->data)))
 346			return 0;
 347
 348		icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
 349
 350		switch (icmp6->icmp6_type) {
 351		case NDISC_ROUTER_SOLICITATION:
 352		case NDISC_ROUTER_ADVERTISEMENT:
 353		case NDISC_NEIGHBOUR_SOLICITATION:
 354		case NDISC_NEIGHBOUR_ADVERTISEMENT:
 355		case NDISC_REDIRECT:
 356			/* For reaction involving unicast neighbor discovery
 357			 * message destined to the proxied address, pass it to
 358			 * input function.
 359			 */
 360			return 1;
 361		default:
 362			break;
 363		}
 364	}
 365
 366	/*
 367	 * The proxying router can't forward traffic sent to a link-local
 368	 * address, so signal the sender and discard the packet. This
 369	 * behavior is clarified by the MIPv6 specification.
 370	 */
 371	if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
 372		dst_link_failure(skb);
 373		return -1;
 374	}
 375
 376	return 0;
 377}
 378
 379static inline int ip6_forward_finish(struct sk_buff *skb)
 
 
 
 
 
 
 380{
 381	return dst_output(skb);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 382}
 383
 384int ip6_forward(struct sk_buff *skb)
 385{
 386	struct dst_entry *dst = skb_dst(skb);
 387	struct ipv6hdr *hdr = ipv6_hdr(skb);
 388	struct inet6_skb_parm *opt = IP6CB(skb);
 389	struct net *net = dev_net(dst->dev);
 390	u32 mtu;
 391
 392	if (net->ipv6.devconf_all->forwarding == 0)
 393		goto error;
 394
 
 
 
 
 
 
 395	if (skb_warn_if_lro(skb))
 396		goto drop;
 397
 398	if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
 399		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
 
 400		goto drop;
 401	}
 402
 403	if (skb->pkt_type != PACKET_HOST)
 404		goto drop;
 405
 406	skb_forward_csum(skb);
 407
 408	/*
 409	 *	We DO NOT make any processing on
 410	 *	RA packets, pushing them to user level AS IS
 411	 *	without ane WARRANTY that application will be able
 412	 *	to interpret them. The reason is that we
 413	 *	cannot make anything clever here.
 414	 *
 415	 *	We are not end-node, so that if packet contains
 416	 *	AH/ESP, we cannot make anything.
 417	 *	Defragmentation also would be mistake, RA packets
 418	 *	cannot be fragmented, because there is no warranty
 419	 *	that different fragments will go along one path. --ANK
 420	 */
 421	if (opt->ra) {
 422		u8 *ptr = skb_network_header(skb) + opt->ra;
 423		if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
 424			return 0;
 425	}
 426
 427	/*
 428	 *	check and decrement ttl
 429	 */
 430	if (hdr->hop_limit <= 1) {
 431		/* Force OUTPUT device used as source address */
 432		skb->dev = dst->dev;
 433		icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
 434		IP6_INC_STATS_BH(net,
 435				 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 436
 437		kfree_skb(skb);
 438		return -ETIMEDOUT;
 439	}
 440
 441	/* XXX: idev->cnf.proxy_ndp? */
 442	if (net->ipv6.devconf_all->proxy_ndp &&
 443	    pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
 444		int proxied = ip6_forward_proxy_check(skb);
 445		if (proxied > 0)
 446			return ip6_input(skb);
 447		else if (proxied < 0) {
 448			IP6_INC_STATS(net, ip6_dst_idev(dst),
 449				      IPSTATS_MIB_INDISCARDS);
 450			goto drop;
 451		}
 452	}
 453
 454	if (!xfrm6_route_forward(skb)) {
 455		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
 
 456		goto drop;
 457	}
 458	dst = skb_dst(skb);
 459
 460	/* IPv6 specs say nothing about it, but it is clear that we cannot
 461	   send redirects to source routed frames.
 462	   We don't send redirects to frames decapsulated from IPsec.
 463	 */
 464	if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
 465		struct in6_addr *target = NULL;
 
 466		struct rt6_info *rt;
 467
 468		/*
 469		 *	incoming and outgoing devices are the same
 470		 *	send a redirect.
 471		 */
 472
 473		rt = (struct rt6_info *) dst;
 474		if (rt->rt6i_flags & RTF_GATEWAY)
 475			target = &rt->rt6i_gateway;
 476		else
 477			target = &hdr->daddr;
 478
 479		if (!rt->rt6i_peer)
 480			rt6_bind_peer(rt, 1);
 481
 482		/* Limit redirects both by destination (here)
 483		   and by source (inside ndisc_send_redirect)
 484		 */
 485		if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
 486			ndisc_send_redirect(skb, target);
 
 
 487	} else {
 488		int addrtype = ipv6_addr_type(&hdr->saddr);
 489
 490		/* This check is security critical. */
 491		if (addrtype == IPV6_ADDR_ANY ||
 492		    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
 493			goto error;
 494		if (addrtype & IPV6_ADDR_LINKLOCAL) {
 495			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
 496				    ICMPV6_NOT_NEIGHBOUR, 0);
 497			goto error;
 498		}
 499	}
 500
 501	mtu = dst_mtu(dst);
 502	if (mtu < IPV6_MIN_MTU)
 503		mtu = IPV6_MIN_MTU;
 504
 505	if (skb->len > mtu && !skb_is_gso(skb)) {
 506		/* Again, force OUTPUT device used as source address */
 507		skb->dev = dst->dev;
 508		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 509		IP6_INC_STATS_BH(net,
 510				 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
 511		IP6_INC_STATS_BH(net,
 512				 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
 513		kfree_skb(skb);
 514		return -EMSGSIZE;
 515	}
 516
 517	if (skb_cow(skb, dst->dev->hard_header_len)) {
 518		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
 
 519		goto drop;
 520	}
 521
 522	hdr = ipv6_hdr(skb);
 523
 524	/* Mangling hops number delayed to point after skb COW */
 525
 526	hdr->hop_limit--;
 527
 528	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
 529	IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
 530	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
 
 531		       ip6_forward_finish);
 532
 533error:
 534	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
 535drop:
 536	kfree_skb(skb);
 537	return -EINVAL;
 538}
 539
 540static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
 541{
 542	to->pkt_type = from->pkt_type;
 543	to->priority = from->priority;
 544	to->protocol = from->protocol;
 545	skb_dst_drop(to);
 546	skb_dst_set(to, dst_clone(skb_dst(from)));
 547	to->dev = from->dev;
 548	to->mark = from->mark;
 549
 550#ifdef CONFIG_NET_SCHED
 551	to->tc_index = from->tc_index;
 552#endif
 553	nf_copy(to, from);
 554#if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 555    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 556	to->nf_trace = from->nf_trace;
 557#endif
 558	skb_copy_secmark(to, from);
 559}
 560
 561int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 562{
 563	u16 offset = sizeof(struct ipv6hdr);
 564	struct ipv6_opt_hdr *exthdr =
 565				(struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
 566	unsigned int packet_len = skb->tail - skb->network_header;
 567	int found_rhdr = 0;
 568	*nexthdr = &ipv6_hdr(skb)->nexthdr;
 569
 570	while (offset + 1 <= packet_len) {
 571
 572		switch (**nexthdr) {
 573
 574		case NEXTHDR_HOP:
 575			break;
 576		case NEXTHDR_ROUTING:
 577			found_rhdr = 1;
 578			break;
 579		case NEXTHDR_DEST:
 580#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 581			if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
 582				break;
 583#endif
 584			if (found_rhdr)
 585				return offset;
 586			break;
 587		default :
 588			return offset;
 589		}
 590
 591		offset += ipv6_optlen(exthdr);
 592		*nexthdr = &exthdr->nexthdr;
 593		exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
 594						 offset);
 595	}
 596
 597	return offset;
 598}
 599
 600void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
 601{
 602	static atomic_t ipv6_fragmentation_id;
 603	int old, new;
 604
 605	if (rt && !(rt->dst.flags & DST_NOPEER)) {
 606		struct inet_peer *peer;
 607
 608		if (!rt->rt6i_peer)
 609			rt6_bind_peer(rt, 1);
 610		peer = rt->rt6i_peer;
 611		if (peer) {
 612			fhdr->identification = htonl(inet_getid(peer, 0));
 613			return;
 614		}
 615	}
 616	do {
 617		old = atomic_read(&ipv6_fragmentation_id);
 618		new = old + 1;
 619		if (!new)
 620			new = 1;
 621	} while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
 622	fhdr->identification = htonl(new);
 623}
 624
 625int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 626{
 627	struct sk_buff *frag;
 628	struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
 629	struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
 
 630	struct ipv6hdr *tmp_hdr;
 631	struct frag_hdr *fh;
 632	unsigned int mtu, hlen, left, len;
 633	int hroom, troom;
 634	__be32 frag_id = 0;
 635	int ptr, offset = 0, err=0;
 636	u8 *prevhdr, nexthdr = 0;
 637	struct net *net = dev_net(skb_dst(skb)->dev);
 638
 639	hlen = ip6_find_1stfragopt(skb, &prevhdr);
 640	nexthdr = *prevhdr;
 641
 642	mtu = ip6_skb_dst_mtu(skb);
 643
 644	/* We must not fragment if the socket is set to force MTU discovery
 645	 * or if the skb it not generated by a local socket.
 646	 */
 647	if (unlikely(!skb->local_df && skb->len > mtu)) {
 648		if (skb->sk && dst_allfrag(skb_dst(skb)))
 649			sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
 650
 651		skb->dev = skb_dst(skb)->dev;
 652		icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 653		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 654			      IPSTATS_MIB_FRAGFAILS);
 655		kfree_skb(skb);
 656		return -EMSGSIZE;
 
 
 657	}
 658
 659	if (np && np->frag_size < mtu) {
 660		if (np->frag_size)
 661			mtu = np->frag_size;
 662	}
 
 
 663	mtu -= hlen + sizeof(struct frag_hdr);
 664
 
 
 
 
 
 
 
 
 665	if (skb_has_frag_list(skb)) {
 666		int first_len = skb_pagelen(skb);
 667		struct sk_buff *frag2;
 668
 669		if (first_len - hlen > mtu ||
 670		    ((first_len - hlen) & 7) ||
 671		    skb_cloned(skb))
 
 672			goto slow_path;
 673
 674		skb_walk_frags(skb, frag) {
 675			/* Correct geometry. */
 676			if (frag->len > mtu ||
 677			    ((frag->len & 7) && frag->next) ||
 678			    skb_headroom(frag) < hlen)
 679				goto slow_path_clean;
 680
 681			/* Partially cloned skb? */
 682			if (skb_shared(frag))
 683				goto slow_path_clean;
 684
 685			BUG_ON(frag->sk);
 686			if (skb->sk) {
 687				frag->sk = skb->sk;
 688				frag->destructor = sock_wfree;
 689			}
 690			skb->truesize -= frag->truesize;
 691		}
 692
 693		err = 0;
 694		offset = 0;
 695		frag = skb_shinfo(skb)->frag_list;
 696		skb_frag_list_init(skb);
 697		/* BUILD HEADER */
 698
 699		*prevhdr = NEXTHDR_FRAGMENT;
 700		tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
 701		if (!tmp_hdr) {
 702			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 703				      IPSTATS_MIB_FRAGFAILS);
 704			return -ENOMEM;
 
 705		}
 
 
 706
 707		__skb_pull(skb, hlen);
 708		fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
 709		__skb_push(skb, hlen);
 710		skb_reset_network_header(skb);
 711		memcpy(skb_network_header(skb), tmp_hdr, hlen);
 712
 713		ipv6_select_ident(fh, rt);
 714		fh->nexthdr = nexthdr;
 715		fh->reserved = 0;
 716		fh->frag_off = htons(IP6_MF);
 717		frag_id = fh->identification;
 718
 719		first_len = skb_pagelen(skb);
 720		skb->data_len = first_len - skb_headlen(skb);
 721		skb->len = first_len;
 722		ipv6_hdr(skb)->payload_len = htons(first_len -
 723						   sizeof(struct ipv6hdr));
 724
 725		dst_hold(&rt->dst);
 726
 727		for (;;) {
 728			/* Prepare header of the next frame,
 729			 * before previous one went down. */
 730			if (frag) {
 731				frag->ip_summed = CHECKSUM_NONE;
 732				skb_reset_transport_header(frag);
 733				fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
 734				__skb_push(frag, hlen);
 735				skb_reset_network_header(frag);
 736				memcpy(skb_network_header(frag), tmp_hdr,
 737				       hlen);
 738				offset += skb->len - hlen - sizeof(struct frag_hdr);
 739				fh->nexthdr = nexthdr;
 740				fh->reserved = 0;
 741				fh->frag_off = htons(offset);
 742				if (frag->next != NULL)
 743					fh->frag_off |= htons(IP6_MF);
 744				fh->identification = frag_id;
 745				ipv6_hdr(frag)->payload_len =
 746						htons(frag->len -
 747						      sizeof(struct ipv6hdr));
 748				ip6_copy_metadata(frag, skb);
 749			}
 750
 751			err = output(skb);
 752			if(!err)
 753				IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 754					      IPSTATS_MIB_FRAGCREATES);
 755
 756			if (err || !frag)
 757				break;
 758
 759			skb = frag;
 760			frag = skb->next;
 761			skb->next = NULL;
 762		}
 763
 764		kfree(tmp_hdr);
 765
 766		if (err == 0) {
 767			IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 768				      IPSTATS_MIB_FRAGOKS);
 769			dst_release(&rt->dst);
 770			return 0;
 771		}
 772
 773		while (frag) {
 774			skb = frag->next;
 775			kfree_skb(frag);
 776			frag = skb;
 777		}
 778
 779		IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 780			      IPSTATS_MIB_FRAGFAILS);
 781		dst_release(&rt->dst);
 782		return err;
 783
 784slow_path_clean:
 785		skb_walk_frags(skb, frag2) {
 786			if (frag2 == frag)
 787				break;
 788			frag2->sk = NULL;
 789			frag2->destructor = NULL;
 790			skb->truesize += frag2->truesize;
 791		}
 792	}
 793
 794slow_path:
 795	if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
 796	    skb_checksum_help(skb))
 797		goto fail;
 798
 799	left = skb->len - hlen;		/* Space per frame */
 800	ptr = hlen;			/* Where to start from */
 801
 802	/*
 803	 *	Fragment the datagram.
 804	 */
 805
 806	*prevhdr = NEXTHDR_FRAGMENT;
 807	hroom = LL_RESERVED_SPACE(rt->dst.dev);
 808	troom = rt->dst.dev->needed_tailroom;
 809
 810	/*
 811	 *	Keep copying data until we run out.
 812	 */
 813	while(left > 0)	{
 814		len = left;
 815		/* IF: it doesn't fit, use 'mtu' - the data space left */
 816		if (len > mtu)
 817			len = mtu;
 818		/* IF: we are not sending up to and including the packet end
 819		   then align the next start on an eight byte boundary */
 820		if (len < left)	{
 821			len &= ~7;
 822		}
 823		/*
 824		 *	Allocate buffer.
 825		 */
 826
 827		if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
 828				      hroom + troom, GFP_ATOMIC)) == NULL) {
 829			NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
 
 830			IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 831				      IPSTATS_MIB_FRAGFAILS);
 832			err = -ENOMEM;
 833			goto fail;
 834		}
 835
 836		/*
 837		 *	Set up data on packet
 838		 */
 839
 840		ip6_copy_metadata(frag, skb);
 841		skb_reserve(frag, hroom);
 842		skb_put(frag, len + hlen + sizeof(struct frag_hdr));
 843		skb_reset_network_header(frag);
 844		fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
 845		frag->transport_header = (frag->network_header + hlen +
 846					  sizeof(struct frag_hdr));
 847
 848		/*
 849		 *	Charge the memory for the fragment to any owner
 850		 *	it might possess
 851		 */
 852		if (skb->sk)
 853			skb_set_owner_w(frag, skb->sk);
 854
 855		/*
 856		 *	Copy the packet header into the new buffer.
 857		 */
 858		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 859
 860		/*
 861		 *	Build fragment header.
 862		 */
 863		fh->nexthdr = nexthdr;
 864		fh->reserved = 0;
 865		if (!frag_id) {
 866			ipv6_select_ident(fh, rt);
 867			frag_id = fh->identification;
 868		} else
 869			fh->identification = frag_id;
 870
 871		/*
 872		 *	Copy a block of the IP datagram.
 873		 */
 874		if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
 875			BUG();
 876		left -= len;
 877
 878		fh->frag_off = htons(offset);
 879		if (left > 0)
 880			fh->frag_off |= htons(IP6_MF);
 881		ipv6_hdr(frag)->payload_len = htons(frag->len -
 882						    sizeof(struct ipv6hdr));
 883
 884		ptr += len;
 885		offset += len;
 886
 887		/*
 888		 *	Put this fragment into the sending queue.
 889		 */
 890		err = output(frag);
 891		if (err)
 892			goto fail;
 893
 894		IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 895			      IPSTATS_MIB_FRAGCREATES);
 896	}
 897	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 898		      IPSTATS_MIB_FRAGOKS);
 899	consume_skb(skb);
 900	return err;
 901
 
 
 
 
 
 
 
 
 902fail:
 903	IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 904		      IPSTATS_MIB_FRAGFAILS);
 905	kfree_skb(skb);
 906	return err;
 907}
 908
 909static inline int ip6_rt_check(const struct rt6key *rt_key,
 910			       const struct in6_addr *fl_addr,
 911			       const struct in6_addr *addr_cache)
 912{
 913	return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
 914		(addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
 915}
 916
 917static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
 918					  struct dst_entry *dst,
 919					  const struct flowi6 *fl6)
 920{
 921	struct ipv6_pinfo *np = inet6_sk(sk);
 922	struct rt6_info *rt = (struct rt6_info *)dst;
 923
 924	if (!dst)
 925		goto out;
 926
 
 
 
 
 
 
 927	/* Yes, checking route validity in not connected
 928	 * case is not very simple. Take into account,
 929	 * that we do not support routing by source, TOS,
 930	 * and MSG_DONTROUTE 		--ANK (980726)
 931	 *
 932	 * 1. ip6_rt_check(): If route was host route,
 933	 *    check that cached destination is current.
 934	 *    If it is network route, we still may
 935	 *    check its validity using saved pointer
 936	 *    to the last used address: daddr_cache.
 937	 *    We do not want to save whole address now,
 938	 *    (because main consumer of this service
 939	 *    is tcp, which has not this problem),
 940	 *    so that the last trick works only on connected
 941	 *    sockets.
 942	 * 2. oif also should be the same.
 943	 */
 944	if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
 945#ifdef CONFIG_IPV6_SUBTREES
 946	    ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
 947#endif
 948	    (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
 
 949		dst_release(dst);
 950		dst = NULL;
 951	}
 952
 953out:
 954	return dst;
 955}
 956
 957static int ip6_dst_lookup_tail(struct sock *sk,
 958			       struct dst_entry **dst, struct flowi6 *fl6)
 959{
 960	struct net *net = sock_net(sk);
 961#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 962	struct neighbour *n;
 
 963#endif
 964	int err;
 
 965
 966	if (*dst == NULL)
 967		*dst = ip6_route_output(net, sk, fl6);
 968
 969	if ((err = (*dst)->error))
 970		goto out_err_release;
 
 
 
 
 
 
 
 971
 972	if (ipv6_addr_any(&fl6->saddr)) {
 973		struct rt6_info *rt = (struct rt6_info *) *dst;
 
 974		err = ip6_route_get_saddr(net, rt, &fl6->daddr,
 975					  sk ? inet6_sk(sk)->srcprefs : 0,
 976					  &fl6->saddr);
 977		if (err)
 978			goto out_err_release;
 
 
 
 
 
 
 
 
 
 
 
 
 979	}
 980
 
 
 
 
 
 
 
 981#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 982	/*
 983	 * Here if the dst entry we've looked up
 984	 * has a neighbour entry that is in the INCOMPLETE
 985	 * state and the src address from the flow is
 986	 * marked as OPTIMISTIC, we release the found
 987	 * dst entry and replace it instead with the
 988	 * dst entry of the nexthop router
 989	 */
 990	rcu_read_lock();
 991	n = dst_get_neighbour_noref(*dst);
 992	if (n && !(n->nud_state & NUD_VALID)) {
 
 
 
 
 
 993		struct inet6_ifaddr *ifp;
 994		struct flowi6 fl_gw6;
 995		int redirect;
 996
 997		rcu_read_unlock();
 998		ifp = ipv6_get_ifaddr(net, &fl6->saddr,
 999				      (*dst)->dev, 1);
1000
1001		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
1002		if (ifp)
1003			in6_ifa_put(ifp);
1004
1005		if (redirect) {
1006			/*
1007			 * We need to get the dst entry for the
1008			 * default router instead
1009			 */
1010			dst_release(*dst);
1011			memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1012			memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1013			*dst = ip6_route_output(net, sk, &fl_gw6);
1014			if ((err = (*dst)->error))
 
1015				goto out_err_release;
1016		}
1017	} else {
1018		rcu_read_unlock();
1019	}
1020#endif
1021
1022	return 0;
1023
1024out_err_release:
1025	if (err == -ENETUNREACH)
1026		IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1027	dst_release(*dst);
1028	*dst = NULL;
1029	return err;
1030}
1031
1032/**
1033 *	ip6_dst_lookup - perform route lookup on flow
1034 *	@sk: socket which provides route info
1035 *	@dst: pointer to dst_entry * for result
1036 *	@fl6: flow to lookup
1037 *
1038 *	This function performs a route lookup on the given flow.
1039 *
1040 *	It returns zero on success, or a standard errno code on error.
1041 */
1042int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
 
1043{
1044	*dst = NULL;
1045	return ip6_dst_lookup_tail(sk, dst, fl6);
1046}
1047EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1048
1049/**
1050 *	ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1051 *	@sk: socket which provides route info
1052 *	@fl6: flow to lookup
1053 *	@final_dst: final destination address for ipsec lookup
1054 *	@can_sleep: we are in a sleepable context
1055 *
1056 *	This function performs a route lookup on the given flow.
1057 *
1058 *	It returns a valid dst pointer on success, or a pointer encoded
1059 *	error code.
1060 */
1061struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1062				      const struct in6_addr *final_dst,
1063				      bool can_sleep)
1064{
1065	struct dst_entry *dst = NULL;
1066	int err;
1067
1068	err = ip6_dst_lookup_tail(sk, &dst, fl6);
1069	if (err)
1070		return ERR_PTR(err);
1071	if (final_dst)
1072		fl6->daddr = *final_dst;
1073	if (can_sleep)
1074		fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1075
1076	return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1077}
1078EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1079
1080/**
1081 *	ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1082 *	@sk: socket which provides the dst cache and route info
1083 *	@fl6: flow to lookup
1084 *	@final_dst: final destination address for ipsec lookup
1085 *	@can_sleep: we are in a sleepable context
1086 *
1087 *	This function performs a route lookup on the given flow with the
1088 *	possibility of using the cached route in the socket if it is valid.
1089 *	It will take the socket dst lock when operating on the dst cache.
1090 *	As a result, this function can only be used in process context.
1091 *
1092 *	It returns a valid dst pointer on success, or a pointer encoded
1093 *	error code.
1094 */
1095struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1096					 const struct in6_addr *final_dst,
1097					 bool can_sleep)
1098{
1099	struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1100	int err;
1101
1102	dst = ip6_sk_dst_check(sk, dst, fl6);
1103
1104	err = ip6_dst_lookup_tail(sk, &dst, fl6);
1105	if (err)
1106		return ERR_PTR(err);
1107	if (final_dst)
1108		fl6->daddr = *final_dst;
1109	if (can_sleep)
1110		fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1111
1112	return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1113}
1114EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1115
1116static inline int ip6_ufo_append_data(struct sock *sk,
 
1117			int getfrag(void *from, char *to, int offset, int len,
1118			int odd, struct sk_buff *skb),
1119			void *from, int length, int hh_len, int fragheaderlen,
1120			int transhdrlen, int mtu,unsigned int flags,
1121			struct rt6_info *rt)
1122
1123{
1124	struct sk_buff *skb;
1125	int err;
1126
1127	/* There is support for UDP large send offload by network
1128	 * device, so create one single skb packet containing complete
1129	 * udp datagram
1130	 */
1131	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
 
1132		skb = sock_alloc_send_skb(sk,
1133			hh_len + fragheaderlen + transhdrlen + 20,
1134			(flags & MSG_DONTWAIT), &err);
1135		if (skb == NULL)
1136			return err;
1137
1138		/* reserve space for Hardware header */
1139		skb_reserve(skb, hh_len);
1140
1141		/* create space for UDP/IP header */
1142		skb_put(skb,fragheaderlen + transhdrlen);
1143
1144		/* initialize network header pointer */
1145		skb_reset_network_header(skb);
1146
1147		/* initialize protocol header pointer */
1148		skb->transport_header = skb->network_header + fragheaderlen;
1149
1150		skb->ip_summed = CHECKSUM_PARTIAL;
1151		skb->csum = 0;
1152	}
1153
1154	err = skb_append_datato_frags(sk,skb, getfrag, from,
1155				      (length - transhdrlen));
1156	if (!err) {
1157		struct frag_hdr fhdr;
1158
1159		/* Specify the length of each IPv6 datagram fragment.
1160		 * It has to be a multiple of 8.
1161		 */
1162		skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1163					     sizeof(struct frag_hdr)) & ~7;
1164		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1165		ipv6_select_ident(&fhdr, rt);
1166		skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1167		__skb_queue_tail(&sk->sk_write_queue, skb);
1168
1169		return 0;
 
 
1170	}
1171	/* There is not enough support do UPD LSO,
1172	 * so follow normal path
1173	 */
1174	kfree_skb(skb);
1175
1176	return err;
 
 
 
 
 
 
 
 
 
 
 
 
 
1177}
1178
1179static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1180					       gfp_t gfp)
1181{
1182	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1183}
1184
1185static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1186						gfp_t gfp)
1187{
1188	return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1189}
1190
1191static void ip6_append_data_mtu(int *mtu,
1192				int *maxfraglen,
1193				unsigned int fragheaderlen,
1194				struct sk_buff *skb,
1195				struct rt6_info *rt)
 
1196{
1197	if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1198		if (skb == NULL) {
1199			/* first fragment, reserve header_len */
1200			*mtu = *mtu - rt->dst.header_len;
1201
1202		} else {
1203			/*
1204			 * this fragment is not first, the headers
1205			 * space is regarded as data space.
1206			 */
1207			*mtu = dst_mtu(rt->dst.path);
1208		}
1209		*maxfraglen = ((*mtu - fragheaderlen) & ~7)
1210			      + fragheaderlen - sizeof(struct frag_hdr);
1211	}
1212}
1213
1214int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1215	int offset, int len, int odd, struct sk_buff *skb),
1216	void *from, int length, int transhdrlen,
1217	int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1218	struct rt6_info *rt, unsigned int flags, int dontfrag)
1219{
1220	struct inet_sock *inet = inet_sk(sk);
1221	struct ipv6_pinfo *np = inet6_sk(sk);
1222	struct inet_cork *cork;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1223	struct sk_buff *skb, *skb_prev = NULL;
1224	unsigned int maxfraglen, fragheaderlen;
1225	int exthdrlen;
1226	int dst_exthdrlen;
1227	int hh_len;
1228	int mtu;
1229	int copy;
1230	int err;
1231	int offset = 0;
1232	__u8 tx_flags = 0;
1233
1234	if (flags&MSG_PROBE)
1235		return 0;
1236	cork = &inet->cork.base;
1237	if (skb_queue_empty(&sk->sk_write_queue)) {
1238		/*
1239		 * setup for corking
1240		 */
1241		if (opt) {
1242			if (WARN_ON(np->cork.opt))
1243				return -EINVAL;
1244
1245			np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
1246			if (unlikely(np->cork.opt == NULL))
1247				return -ENOBUFS;
1248
1249			np->cork.opt->tot_len = opt->tot_len;
1250			np->cork.opt->opt_flen = opt->opt_flen;
1251			np->cork.opt->opt_nflen = opt->opt_nflen;
1252
1253			np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1254							    sk->sk_allocation);
1255			if (opt->dst0opt && !np->cork.opt->dst0opt)
1256				return -ENOBUFS;
1257
1258			np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1259							    sk->sk_allocation);
1260			if (opt->dst1opt && !np->cork.opt->dst1opt)
1261				return -ENOBUFS;
1262
1263			np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1264							   sk->sk_allocation);
1265			if (opt->hopopt && !np->cork.opt->hopopt)
1266				return -ENOBUFS;
1267
1268			np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1269							    sk->sk_allocation);
1270			if (opt->srcrt && !np->cork.opt->srcrt)
1271				return -ENOBUFS;
1272
1273			/* need source address above miyazawa*/
1274		}
1275		dst_hold(&rt->dst);
1276		cork->dst = &rt->dst;
1277		inet->cork.fl.u.ip6 = *fl6;
1278		np->cork.hop_limit = hlimit;
1279		np->cork.tclass = tclass;
1280		if (rt->dst.flags & DST_XFRM_TUNNEL)
1281			mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1282			      rt->dst.dev->mtu : dst_mtu(&rt->dst);
1283		else
1284			mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1285			      rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1286		if (np->frag_size < mtu) {
1287			if (np->frag_size)
1288				mtu = np->frag_size;
1289		}
1290		cork->fragsize = mtu;
1291		if (dst_allfrag(rt->dst.path))
1292			cork->flags |= IPCORK_ALLFRAG;
1293		cork->length = 0;
1294		sk->sk_sndmsg_page = NULL;
1295		sk->sk_sndmsg_off = 0;
1296		exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
1297		length += exthdrlen;
1298		transhdrlen += exthdrlen;
1299		dst_exthdrlen = rt->dst.header_len;
1300	} else {
1301		rt = (struct rt6_info *)cork->dst;
1302		fl6 = &inet->cork.fl.u.ip6;
1303		opt = np->cork.opt;
1304		transhdrlen = 0;
1305		exthdrlen = 0;
1306		dst_exthdrlen = 0;
1307		mtu = cork->fragsize;
1308	}
1309
 
 
 
1310	hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1311
1312	fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1313			(opt ? opt->opt_nflen : 0);
1314	maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
 
1315
1316	if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1317		if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1318			ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1319			return -EMSGSIZE;
1320		}
 
 
 
 
 
 
 
1321	}
1322
1323	/* For UDP, check if TX timestamp is enabled */
1324	if (sk->sk_type == SOCK_DGRAM) {
1325		err = sock_tx_timestamp(sk, &tx_flags);
1326		if (err)
1327			goto error;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1328	}
1329
1330	/*
1331	 * Let's try using as much space as possible.
1332	 * Use MTU if total length of the message fits into the MTU.
1333	 * Otherwise, we need to reserve fragment header and
1334	 * fragment alignment (= 8-15 octects, in total).
1335	 *
1336	 * Note that we may need to "move" the data from the tail of
1337	 * of the buffer to the new fragment when we split
1338	 * the message.
1339	 *
1340	 * FIXME: It may be fragmented into multiple chunks
1341	 *        at once if non-fragmentable extension headers
1342	 *        are too large.
1343	 * --yoshfuji
1344	 */
1345
1346	cork->length += length;
1347	if (length > mtu) {
1348		int proto = sk->sk_protocol;
1349		if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
1350			ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1351			return -EMSGSIZE;
1352		}
1353
1354		if (proto == IPPROTO_UDP &&
1355		    (rt->dst.dev->features & NETIF_F_UFO)) {
1356
1357			err = ip6_ufo_append_data(sk, getfrag, from, length,
1358						  hh_len, fragheaderlen,
1359						  transhdrlen, mtu, flags, rt);
1360			if (err)
1361				goto error;
1362			return 0;
1363		}
1364	}
1365
1366	if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
1367		goto alloc_new_skb;
1368
1369	while (length > 0) {
1370		/* Check if the remaining data fits into current packet. */
1371		copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1372		if (copy < length)
1373			copy = maxfraglen - skb->len;
1374
1375		if (copy <= 0) {
1376			char *data;
1377			unsigned int datalen;
1378			unsigned int fraglen;
1379			unsigned int fraggap;
1380			unsigned int alloclen;
1381alloc_new_skb:
1382			/* There's no room in the current skb */
1383			if (skb)
1384				fraggap = skb->len - maxfraglen;
1385			else
1386				fraggap = 0;
1387			/* update mtu and maxfraglen if necessary */
1388			if (skb == NULL || skb_prev == NULL)
1389				ip6_append_data_mtu(&mtu, &maxfraglen,
1390						    fragheaderlen, skb, rt);
 
1391
1392			skb_prev = skb;
1393
1394			/*
1395			 * If remaining data exceeds the mtu,
1396			 * we know we need more fragment(s).
1397			 */
1398			datalen = length + fraggap;
1399
1400			if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1401				datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1402			if ((flags & MSG_MORE) &&
1403			    !(rt->dst.dev->features&NETIF_F_SG))
1404				alloclen = mtu;
1405			else
1406				alloclen = datalen + fragheaderlen;
1407
1408			alloclen += dst_exthdrlen;
1409
1410			if (datalen != length + fraggap) {
1411				/*
1412				 * this is not the last fragment, the trailer
1413				 * space is regarded as data space.
1414				 */
1415				datalen += rt->dst.trailer_len;
1416			}
1417
1418			alloclen += rt->dst.trailer_len;
1419			fraglen = datalen + fragheaderlen;
1420
1421			/*
1422			 * We just reserve space for fragment header.
1423			 * Note: this may be overallocation if the message
1424			 * (without MSG_MORE) fits into the MTU.
1425			 */
1426			alloclen += sizeof(struct frag_hdr);
1427
1428			if (transhdrlen) {
1429				skb = sock_alloc_send_skb(sk,
1430						alloclen + hh_len,
1431						(flags & MSG_DONTWAIT), &err);
1432			} else {
1433				skb = NULL;
1434				if (atomic_read(&sk->sk_wmem_alloc) <=
1435				    2 * sk->sk_sndbuf)
1436					skb = sock_wmalloc(sk,
1437							   alloclen + hh_len, 1,
1438							   sk->sk_allocation);
1439				if (unlikely(skb == NULL))
1440					err = -ENOBUFS;
1441				else {
1442					/* Only the initial fragment
1443					 * is time stamped.
1444					 */
1445					tx_flags = 0;
1446				}
1447			}
1448			if (skb == NULL)
1449				goto error;
1450			/*
1451			 *	Fill in the control structures
1452			 */
1453			skb->ip_summed = CHECKSUM_NONE;
 
1454			skb->csum = 0;
1455			/* reserve for fragmentation and ipsec header */
1456			skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1457				    dst_exthdrlen);
1458
1459			if (sk->sk_type == SOCK_DGRAM)
1460				skb_shinfo(skb)->tx_flags = tx_flags;
 
 
 
1461
1462			/*
1463			 *	Find where to start putting bytes
1464			 */
1465			data = skb_put(skb, fraglen);
1466			skb_set_network_header(skb, exthdrlen);
1467			data += fragheaderlen;
1468			skb->transport_header = (skb->network_header +
1469						 fragheaderlen);
1470			if (fraggap) {
1471				skb->csum = skb_copy_and_csum_bits(
1472					skb_prev, maxfraglen,
1473					data + transhdrlen, fraggap, 0);
1474				skb_prev->csum = csum_sub(skb_prev->csum,
1475							  skb->csum);
1476				data += fraggap;
1477				pskb_trim_unique(skb_prev, maxfraglen);
1478			}
1479			copy = datalen - transhdrlen - fraggap;
1480
1481			if (copy < 0) {
1482				err = -EINVAL;
1483				kfree_skb(skb);
1484				goto error;
1485			} else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1486				err = -EFAULT;
1487				kfree_skb(skb);
1488				goto error;
1489			}
1490
1491			offset += copy;
1492			length -= datalen - fraggap;
1493			transhdrlen = 0;
1494			exthdrlen = 0;
1495			dst_exthdrlen = 0;
1496
1497			/*
1498			 * Put the packet on the pending queue
1499			 */
1500			__skb_queue_tail(&sk->sk_write_queue, skb);
1501			continue;
1502		}
1503
1504		if (copy > length)
1505			copy = length;
1506
1507		if (!(rt->dst.dev->features&NETIF_F_SG)) {
1508			unsigned int off;
1509
1510			off = skb->len;
1511			if (getfrag(from, skb_put(skb, copy),
1512						offset, copy, off, skb) < 0) {
1513				__skb_trim(skb, off);
1514				err = -EFAULT;
1515				goto error;
1516			}
1517		} else {
1518			int i = skb_shinfo(skb)->nr_frags;
1519			skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
1520			struct page *page = sk->sk_sndmsg_page;
1521			int off = sk->sk_sndmsg_off;
1522			unsigned int left;
1523
1524			if (page && (left = PAGE_SIZE - off) > 0) {
1525				if (copy >= left)
1526					copy = left;
1527				if (page != skb_frag_page(frag)) {
1528					if (i == MAX_SKB_FRAGS) {
1529						err = -EMSGSIZE;
1530						goto error;
1531					}
1532					skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
1533					skb_frag_ref(skb, i);
1534					frag = &skb_shinfo(skb)->frags[i];
1535				}
1536			} else if(i < MAX_SKB_FRAGS) {
1537				if (copy > PAGE_SIZE)
1538					copy = PAGE_SIZE;
1539				page = alloc_pages(sk->sk_allocation, 0);
1540				if (page == NULL) {
1541					err = -ENOMEM;
1542					goto error;
1543				}
1544				sk->sk_sndmsg_page = page;
1545				sk->sk_sndmsg_off = 0;
1546
1547				skb_fill_page_desc(skb, i, page, 0, 0);
1548				frag = &skb_shinfo(skb)->frags[i];
1549			} else {
1550				err = -EMSGSIZE;
1551				goto error;
 
 
 
 
 
 
 
 
 
 
 
1552			}
 
1553			if (getfrag(from,
1554				    skb_frag_address(frag) + skb_frag_size(frag),
1555				    offset, copy, skb->len, skb) < 0) {
1556				err = -EFAULT;
1557				goto error;
1558			}
1559			sk->sk_sndmsg_off += copy;
1560			skb_frag_size_add(frag, copy);
1561			skb->len += copy;
1562			skb->data_len += copy;
1563			skb->truesize += copy;
1564			atomic_add(copy, &sk->sk_wmem_alloc);
1565		}
1566		offset += copy;
1567		length -= copy;
1568	}
 
1569	return 0;
 
 
 
1570error:
1571	cork->length -= length;
1572	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1573	return err;
1574}
1575EXPORT_SYMBOL_GPL(ip6_append_data);
1576
1577static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 
 
 
 
 
1578{
1579	if (np->cork.opt) {
1580		kfree(np->cork.opt->dst0opt);
1581		kfree(np->cork.opt->dst1opt);
1582		kfree(np->cork.opt->hopopt);
1583		kfree(np->cork.opt->srcrt);
1584		kfree(np->cork.opt);
1585		np->cork.opt = NULL;
1586	}
1587
1588	if (inet->cork.base.dst) {
1589		dst_release(inet->cork.base.dst);
1590		inet->cork.base.dst = NULL;
1591		inet->cork.base.flags &= ~IPCORK_ALLFRAG;
 
 
 
 
 
 
 
 
 
1592	}
1593	memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
 
 
 
1594}
 
1595
1596int ip6_push_pending_frames(struct sock *sk)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1597{
1598	struct sk_buff *skb, *tmp_skb;
1599	struct sk_buff **tail_skb;
1600	struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1601	struct inet_sock *inet = inet_sk(sk);
1602	struct ipv6_pinfo *np = inet6_sk(sk);
1603	struct net *net = sock_net(sk);
1604	struct ipv6hdr *hdr;
1605	struct ipv6_txoptions *opt = np->cork.opt;
1606	struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1607	struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1608	unsigned char proto = fl6->flowi6_proto;
1609	int err = 0;
1610
1611	if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
 
1612		goto out;
1613	tail_skb = &(skb_shinfo(skb)->frag_list);
1614
1615	/* move skb->data to ip header from ext header */
1616	if (skb->data < skb_network_header(skb))
1617		__skb_pull(skb, skb_network_offset(skb));
1618	while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1619		__skb_pull(tmp_skb, skb_network_header_len(skb));
1620		*tail_skb = tmp_skb;
1621		tail_skb = &(tmp_skb->next);
1622		skb->len += tmp_skb->len;
1623		skb->data_len += tmp_skb->len;
1624		skb->truesize += tmp_skb->truesize;
1625		tmp_skb->destructor = NULL;
1626		tmp_skb->sk = NULL;
1627	}
1628
1629	/* Allow local fragmentation. */
1630	if (np->pmtudisc < IPV6_PMTUDISC_DO)
1631		skb->local_df = 1;
1632
1633	*final_dst = fl6->daddr;
1634	__skb_pull(skb, skb_network_header_len(skb));
1635	if (opt && opt->opt_flen)
1636		ipv6_push_frag_opts(skb, opt, &proto);
1637	if (opt && opt->opt_nflen)
1638		ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1639
1640	skb_push(skb, sizeof(struct ipv6hdr));
1641	skb_reset_network_header(skb);
1642	hdr = ipv6_hdr(skb);
1643
1644	*(__be32*)hdr = fl6->flowlabel |
1645		     htonl(0x60000000 | ((int)np->cork.tclass << 20));
1646
1647	hdr->hop_limit = np->cork.hop_limit;
1648	hdr->nexthdr = proto;
1649	hdr->saddr = fl6->saddr;
1650	hdr->daddr = *final_dst;
1651
1652	skb->priority = sk->sk_priority;
1653	skb->mark = sk->sk_mark;
1654
1655	skb_dst_set(skb, dst_clone(&rt->dst));
1656	IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1657	if (proto == IPPROTO_ICMPV6) {
1658		struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1659
1660		ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1661		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1662	}
1663
1664	err = ip6_local_out(skb);
 
 
 
 
 
 
 
 
 
 
 
1665	if (err) {
1666		if (err > 0)
1667			err = net_xmit_errno(err);
1668		if (err)
1669			goto error;
 
1670	}
1671
1672out:
1673	ip6_cork_release(inet, np);
1674	return err;
1675error:
1676	IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1677	goto out;
 
 
 
 
 
 
 
 
1678}
1679EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1680
1681void ip6_flush_pending_frames(struct sock *sk)
 
 
 
1682{
1683	struct sk_buff *skb;
1684
1685	while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1686		if (skb_dst(skb))
1687			IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1688				      IPSTATS_MIB_OUTDISCARDS);
1689		kfree_skb(skb);
1690	}
1691
1692	ip6_cork_release(inet_sk(sk), inet6_sk(sk));
 
 
 
 
 
 
1693}
1694EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);