]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - net/ipv6/ip6_output.c
projects / mirror_ubuntu-jammy-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'drm-intel-fixes-2014-03-17' of git://anongit.freedesktop.org/drm-intel...
[mirror_ubuntu-jammy-kernel.git] / net / ipv6 / ip6_output.c
1 /*
2 * IPv6 output functions
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on linux/net/ipv4/ip_output.c
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 *
15 * Changes:
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
20 * etc.
21 *
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
26 * for datagram xmit
27 */
28
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
41
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv6.h>
44
45 #include <net/sock.h>
46 #include <net/snmp.h>
47
48 #include <net/ipv6.h>
49 #include <net/ndisc.h>
50 #include <net/protocol.h>
51 #include <net/ip6_route.h>
52 #include <net/addrconf.h>
53 #include <net/rawv6.h>
54 #include <net/icmp.h>
55 #include <net/xfrm.h>
56 #include <net/checksum.h>
57 #include <linux/mroute6.h>
58
59 static int ip6_finish_output2(struct sk_buff *skb)
60 {
61 struct dst_entry *dst = skb_dst(skb);
62 struct net_device *dev = dst->dev;
63 struct neighbour *neigh;
64 struct in6_addr *nexthop;
65 int ret;
66
67 skb->protocol = htons(ETH_P_IPV6);
68 skb->dev = dev;
69
70 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
71 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
72
73 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
74 ((mroute6_socket(dev_net(dev), skb) &&
75 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
76 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
77 &ipv6_hdr(skb)->saddr))) {
78 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
79
80 /* Do not check for IFF_ALLMULTI; multicast routing
81 is not supported in any case.
82 */
83 if (newskb)
84 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
85 newskb, NULL, newskb->dev,
86 dev_loopback_xmit);
87
88 if (ipv6_hdr(skb)->hop_limit == 0) {
89 IP6_INC_STATS(dev_net(dev), idev,
90 IPSTATS_MIB_OUTDISCARDS);
91 kfree_skb(skb);
92 return 0;
93 }
94 }
95
96 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
97 skb->len);
98
99 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
100 IPV6_ADDR_SCOPE_NODELOCAL &&
101 !(dev->flags & IFF_LOOPBACK)) {
102 kfree_skb(skb);
103 return 0;
104 }
105 }
106
107 rcu_read_lock_bh();
108 nexthop = rt6_nexthop((struct rt6_info *)dst);
109 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
110 if (unlikely(!neigh))
111 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
112 if (!IS_ERR(neigh)) {
113 ret = dst_neigh_output(dst, neigh, skb);
114 rcu_read_unlock_bh();
115 return ret;
116 }
117 rcu_read_unlock_bh();
118
119 IP6_INC_STATS(dev_net(dst->dev),
120 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
121 kfree_skb(skb);
122 return -EINVAL;
123 }
124
125 static int ip6_finish_output(struct sk_buff *skb)
126 {
127 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
128 dst_allfrag(skb_dst(skb)) ||
129 (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
130 return ip6_fragment(skb, ip6_finish_output2);
131 else
132 return ip6_finish_output2(skb);
133 }
134
135 int ip6_output(struct sk_buff *skb)
136 {
137 struct net_device *dev = skb_dst(skb)->dev;
138 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
139 if (unlikely(idev->cnf.disable_ipv6)) {
140 IP6_INC_STATS(dev_net(dev), idev,
141 IPSTATS_MIB_OUTDISCARDS);
142 kfree_skb(skb);
143 return 0;
144 }
145
146 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
147 ip6_finish_output,
148 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
149 }
150
151 /*
152 * xmit an sk_buff (used by TCP, SCTP and DCCP)
153 */
154
155 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
156 struct ipv6_txoptions *opt, int tclass)
157 {
158 struct net *net = sock_net(sk);
159 struct ipv6_pinfo *np = inet6_sk(sk);
160 struct in6_addr *first_hop = &fl6->daddr;
161 struct dst_entry *dst = skb_dst(skb);
162 struct ipv6hdr *hdr;
163 u8 proto = fl6->flowi6_proto;
164 int seg_len = skb->len;
165 int hlimit = -1;
166 u32 mtu;
167
168 if (opt) {
169 unsigned int head_room;
170
171 /* First: exthdrs may take lots of space (~8K for now)
172 MAX_HEADER is not enough.
173 */
174 head_room = opt->opt_nflen + opt->opt_flen;
175 seg_len += head_room;
176 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
177
178 if (skb_headroom(skb) < head_room) {
179 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
180 if (skb2 == NULL) {
181 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
182 IPSTATS_MIB_OUTDISCARDS);
183 kfree_skb(skb);
184 return -ENOBUFS;
185 }
186 consume_skb(skb);
187 skb = skb2;
188 skb_set_owner_w(skb, sk);
189 }
190 if (opt->opt_flen)
191 ipv6_push_frag_opts(skb, opt, &proto);
192 if (opt->opt_nflen)
193 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
194 }
195
196 skb_push(skb, sizeof(struct ipv6hdr));
197 skb_reset_network_header(skb);
198 hdr = ipv6_hdr(skb);
199
200 /*
201 * Fill in the IPv6 header
202 */
203 if (np)
204 hlimit = np->hop_limit;
205 if (hlimit < 0)
206 hlimit = ip6_dst_hoplimit(dst);
207
208 ip6_flow_hdr(hdr, tclass, fl6->flowlabel);
209
210 hdr->payload_len = htons(seg_len);
211 hdr->nexthdr = proto;
212 hdr->hop_limit = hlimit;
213
214 hdr->saddr = fl6->saddr;
215 hdr->daddr = *first_hop;
216
217 skb->protocol = htons(ETH_P_IPV6);
218 skb->priority = sk->sk_priority;
219 skb->mark = sk->sk_mark;
220
221 mtu = dst_mtu(dst);
222 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
223 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
224 IPSTATS_MIB_OUT, skb->len);
225 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
226 dst->dev, dst_output);
227 }
228
229 skb->dev = dst->dev;
230 ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
231 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
232 kfree_skb(skb);
233 return -EMSGSIZE;
234 }
235
236 EXPORT_SYMBOL(ip6_xmit);
237
238 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
239 {
240 struct ip6_ra_chain *ra;
241 struct sock *last = NULL;
242
243 read_lock(&ip6_ra_lock);
244 for (ra = ip6_ra_chain; ra; ra = ra->next) {
245 struct sock *sk = ra->sk;
246 if (sk && ra->sel == sel &&
247 (!sk->sk_bound_dev_if ||
248 sk->sk_bound_dev_if == skb->dev->ifindex)) {
249 if (last) {
250 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
251 if (skb2)
252 rawv6_rcv(last, skb2);
253 }
254 last = sk;
255 }
256 }
257
258 if (last) {
259 rawv6_rcv(last, skb);
260 read_unlock(&ip6_ra_lock);
261 return 1;
262 }
263 read_unlock(&ip6_ra_lock);
264 return 0;
265 }
266
267 static int ip6_forward_proxy_check(struct sk_buff *skb)
268 {
269 struct ipv6hdr *hdr = ipv6_hdr(skb);
270 u8 nexthdr = hdr->nexthdr;
271 __be16 frag_off;
272 int offset;
273
274 if (ipv6_ext_hdr(nexthdr)) {
275 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
276 if (offset < 0)
277 return 0;
278 } else
279 offset = sizeof(struct ipv6hdr);
280
281 if (nexthdr == IPPROTO_ICMPV6) {
282 struct icmp6hdr *icmp6;
283
284 if (!pskb_may_pull(skb, (skb_network_header(skb) +
285 offset + 1 - skb->data)))
286 return 0;
287
288 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
289
290 switch (icmp6->icmp6_type) {
291 case NDISC_ROUTER_SOLICITATION:
292 case NDISC_ROUTER_ADVERTISEMENT:
293 case NDISC_NEIGHBOUR_SOLICITATION:
294 case NDISC_NEIGHBOUR_ADVERTISEMENT:
295 case NDISC_REDIRECT:
296 /* For reaction involving unicast neighbor discovery
297 * message destined to the proxied address, pass it to
298 * input function.
299 */
300 return 1;
301 default:
302 break;
303 }
304 }
305
306 /*
307 * The proxying router can't forward traffic sent to a link-local
308 * address, so signal the sender and discard the packet. This
309 * behavior is clarified by the MIPv6 specification.
310 */
311 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
312 dst_link_failure(skb);
313 return -1;
314 }
315
316 return 0;
317 }
318
319 static inline int ip6_forward_finish(struct sk_buff *skb)
320 {
321 return dst_output(skb);
322 }
323
324 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
325 {
326 unsigned int mtu;
327 struct inet6_dev *idev;
328
329 if (dst_metric_locked(dst, RTAX_MTU)) {
330 mtu = dst_metric_raw(dst, RTAX_MTU);
331 if (mtu)
332 return mtu;
333 }
334
335 mtu = IPV6_MIN_MTU;
336 rcu_read_lock();
337 idev = __in6_dev_get(dst->dev);
338 if (idev)
339 mtu = idev->cnf.mtu6;
340 rcu_read_unlock();
341
342 return mtu;
343 }
344
345 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
346 {
347 if (skb->len <= mtu || skb->local_df)
348 return false;
349
350 if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
351 return true;
352
353 if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
354 return false;
355
356 return true;
357 }
358
359 int ip6_forward(struct sk_buff *skb)
360 {
361 struct dst_entry *dst = skb_dst(skb);
362 struct ipv6hdr *hdr = ipv6_hdr(skb);
363 struct inet6_skb_parm *opt = IP6CB(skb);
364 struct net *net = dev_net(dst->dev);
365 u32 mtu;
366
367 if (net->ipv6.devconf_all->forwarding == 0)
368 goto error;
369
370 if (skb_warn_if_lro(skb))
371 goto drop;
372
373 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
374 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
375 IPSTATS_MIB_INDISCARDS);
376 goto drop;
377 }
378
379 if (skb->pkt_type != PACKET_HOST)
380 goto drop;
381
382 skb_forward_csum(skb);
383
384 /*
385 * We DO NOT make any processing on
386 * RA packets, pushing them to user level AS IS
387 * without ane WARRANTY that application will be able
388 * to interpret them. The reason is that we
389 * cannot make anything clever here.
390 *
391 * We are not end-node, so that if packet contains
392 * AH/ESP, we cannot make anything.
393 * Defragmentation also would be mistake, RA packets
394 * cannot be fragmented, because there is no warranty
395 * that different fragments will go along one path. --ANK
396 */
397 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
398 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
399 return 0;
400 }
401
402 /*
403 * check and decrement ttl
404 */
405 if (hdr->hop_limit <= 1) {
406 /* Force OUTPUT device used as source address */
407 skb->dev = dst->dev;
408 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
409 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
410 IPSTATS_MIB_INHDRERRORS);
411
412 kfree_skb(skb);
413 return -ETIMEDOUT;
414 }
415
416 /* XXX: idev->cnf.proxy_ndp? */
417 if (net->ipv6.devconf_all->proxy_ndp &&
418 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
419 int proxied = ip6_forward_proxy_check(skb);
420 if (proxied > 0)
421 return ip6_input(skb);
422 else if (proxied < 0) {
423 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
424 IPSTATS_MIB_INDISCARDS);
425 goto drop;
426 }
427 }
428
429 if (!xfrm6_route_forward(skb)) {
430 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
431 IPSTATS_MIB_INDISCARDS);
432 goto drop;
433 }
434 dst = skb_dst(skb);
435
436 /* IPv6 specs say nothing about it, but it is clear that we cannot
437 send redirects to source routed frames.
438 We don't send redirects to frames decapsulated from IPsec.
439 */
440 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
441 struct in6_addr *target = NULL;
442 struct inet_peer *peer;
443 struct rt6_info *rt;
444
445 /*
446 * incoming and outgoing devices are the same
447 * send a redirect.
448 */
449
450 rt = (struct rt6_info *) dst;
451 if (rt->rt6i_flags & RTF_GATEWAY)
452 target = &rt->rt6i_gateway;
453 else
454 target = &hdr->daddr;
455
456 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
457
458 /* Limit redirects both by destination (here)
459 and by source (inside ndisc_send_redirect)
460 */
461 if (inet_peer_xrlim_allow(peer, 1*HZ))
462 ndisc_send_redirect(skb, target);
463 if (peer)
464 inet_putpeer(peer);
465 } else {
466 int addrtype = ipv6_addr_type(&hdr->saddr);
467
468 /* This check is security critical. */
469 if (addrtype == IPV6_ADDR_ANY ||
470 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
471 goto error;
472 if (addrtype & IPV6_ADDR_LINKLOCAL) {
473 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
474 ICMPV6_NOT_NEIGHBOUR, 0);
475 goto error;
476 }
477 }
478
479 mtu = ip6_dst_mtu_forward(dst);
480 if (mtu < IPV6_MIN_MTU)
481 mtu = IPV6_MIN_MTU;
482
483 if (ip6_pkt_too_big(skb, mtu)) {
484 /* Again, force OUTPUT device used as source address */
485 skb->dev = dst->dev;
486 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
487 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
488 IPSTATS_MIB_INTOOBIGERRORS);
489 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
490 IPSTATS_MIB_FRAGFAILS);
491 kfree_skb(skb);
492 return -EMSGSIZE;
493 }
494
495 if (skb_cow(skb, dst->dev->hard_header_len)) {
496 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
497 IPSTATS_MIB_OUTDISCARDS);
498 goto drop;
499 }
500
501 hdr = ipv6_hdr(skb);
502
503 /* Mangling hops number delayed to point after skb COW */
504
505 hdr->hop_limit--;
506
507 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
508 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
509 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
510 ip6_forward_finish);
511
512 error:
513 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
514 drop:
515 kfree_skb(skb);
516 return -EINVAL;
517 }
518
519 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
520 {
521 to->pkt_type = from->pkt_type;
522 to->priority = from->priority;
523 to->protocol = from->protocol;
524 skb_dst_drop(to);
525 skb_dst_set(to, dst_clone(skb_dst(from)));
526 to->dev = from->dev;
527 to->mark = from->mark;
528
529 #ifdef CONFIG_NET_SCHED
530 to->tc_index = from->tc_index;
531 #endif
532 nf_copy(to, from);
533 skb_copy_secmark(to, from);
534 }
535
536 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
537 {
538 struct sk_buff *frag;
539 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
540 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
541 struct ipv6hdr *tmp_hdr;
542 struct frag_hdr *fh;
543 unsigned int mtu, hlen, left, len;
544 int hroom, troom;
545 __be32 frag_id = 0;
546 int ptr, offset = 0, err=0;
547 u8 *prevhdr, nexthdr = 0;
548 struct net *net = dev_net(skb_dst(skb)->dev);
549
550 hlen = ip6_find_1stfragopt(skb, &prevhdr);
551 nexthdr = *prevhdr;
552
553 mtu = ip6_skb_dst_mtu(skb);
554
555 /* We must not fragment if the socket is set to force MTU discovery
556 * or if the skb it not generated by a local socket.
557 */
558 if (unlikely(!skb->local_df && skb->len > mtu) ||
559 (IP6CB(skb)->frag_max_size &&
560 IP6CB(skb)->frag_max_size > mtu)) {
561 if (skb->sk && dst_allfrag(skb_dst(skb)))
562 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
563
564 skb->dev = skb_dst(skb)->dev;
565 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
566 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
567 IPSTATS_MIB_FRAGFAILS);
568 kfree_skb(skb);
569 return -EMSGSIZE;
570 }
571
572 if (np && np->frag_size < mtu) {
573 if (np->frag_size)
574 mtu = np->frag_size;
575 }
576 mtu -= hlen + sizeof(struct frag_hdr);
577
578 if (skb_has_frag_list(skb)) {
579 int first_len = skb_pagelen(skb);
580 struct sk_buff *frag2;
581
582 if (first_len - hlen > mtu ||
583 ((first_len - hlen) & 7) ||
584 skb_cloned(skb))
585 goto slow_path;
586
587 skb_walk_frags(skb, frag) {
588 /* Correct geometry. */
589 if (frag->len > mtu ||
590 ((frag->len & 7) && frag->next) ||
591 skb_headroom(frag) < hlen)
592 goto slow_path_clean;
593
594 /* Partially cloned skb? */
595 if (skb_shared(frag))
596 goto slow_path_clean;
597
598 BUG_ON(frag->sk);
599 if (skb->sk) {
600 frag->sk = skb->sk;
601 frag->destructor = sock_wfree;
602 }
603 skb->truesize -= frag->truesize;
604 }
605
606 err = 0;
607 offset = 0;
608 frag = skb_shinfo(skb)->frag_list;
609 skb_frag_list_init(skb);
610 /* BUILD HEADER */
611
612 *prevhdr = NEXTHDR_FRAGMENT;
613 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
614 if (!tmp_hdr) {
615 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
616 IPSTATS_MIB_FRAGFAILS);
617 return -ENOMEM;
618 }
619
620 __skb_pull(skb, hlen);
621 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
622 __skb_push(skb, hlen);
623 skb_reset_network_header(skb);
624 memcpy(skb_network_header(skb), tmp_hdr, hlen);
625
626 ipv6_select_ident(fh, rt);
627 fh->nexthdr = nexthdr;
628 fh->reserved = 0;
629 fh->frag_off = htons(IP6_MF);
630 frag_id = fh->identification;
631
632 first_len = skb_pagelen(skb);
633 skb->data_len = first_len - skb_headlen(skb);
634 skb->len = first_len;
635 ipv6_hdr(skb)->payload_len = htons(first_len -
636 sizeof(struct ipv6hdr));
637
638 dst_hold(&rt->dst);
639
640 for (;;) {
641 /* Prepare header of the next frame,
642 * before previous one went down. */
643 if (frag) {
644 frag->ip_summed = CHECKSUM_NONE;
645 skb_reset_transport_header(frag);
646 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
647 __skb_push(frag, hlen);
648 skb_reset_network_header(frag);
649 memcpy(skb_network_header(frag), tmp_hdr,
650 hlen);
651 offset += skb->len - hlen - sizeof(struct frag_hdr);
652 fh->nexthdr = nexthdr;
653 fh->reserved = 0;
654 fh->frag_off = htons(offset);
655 if (frag->next != NULL)
656 fh->frag_off |= htons(IP6_MF);
657 fh->identification = frag_id;
658 ipv6_hdr(frag)->payload_len =
659 htons(frag->len -
660 sizeof(struct ipv6hdr));
661 ip6_copy_metadata(frag, skb);
662 }
663
664 err = output(skb);
665 if(!err)
666 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
667 IPSTATS_MIB_FRAGCREATES);
668
669 if (err || !frag)
670 break;
671
672 skb = frag;
673 frag = skb->next;
674 skb->next = NULL;
675 }
676
677 kfree(tmp_hdr);
678
679 if (err == 0) {
680 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
681 IPSTATS_MIB_FRAGOKS);
682 ip6_rt_put(rt);
683 return 0;
684 }
685
686 while (frag) {
687 skb = frag->next;
688 kfree_skb(frag);
689 frag = skb;
690 }
691
692 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
693 IPSTATS_MIB_FRAGFAILS);
694 ip6_rt_put(rt);
695 return err;
696
697 slow_path_clean:
698 skb_walk_frags(skb, frag2) {
699 if (frag2 == frag)
700 break;
701 frag2->sk = NULL;
702 frag2->destructor = NULL;
703 skb->truesize += frag2->truesize;
704 }
705 }
706
707 slow_path:
708 if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
709 skb_checksum_help(skb))
710 goto fail;
711
712 left = skb->len - hlen; /* Space per frame */
713 ptr = hlen; /* Where to start from */
714
715 /*
716 * Fragment the datagram.
717 */
718
719 *prevhdr = NEXTHDR_FRAGMENT;
720 hroom = LL_RESERVED_SPACE(rt->dst.dev);
721 troom = rt->dst.dev->needed_tailroom;
722
723 /*
724 * Keep copying data until we run out.
725 */
726 while(left > 0) {
727 len = left;
728 /* IF: it doesn't fit, use 'mtu' - the data space left */
729 if (len > mtu)
730 len = mtu;
731 /* IF: we are not sending up to and including the packet end
732 then align the next start on an eight byte boundary */
733 if (len < left) {
734 len &= ~7;
735 }
736 /*
737 * Allocate buffer.
738 */
739
740 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
741 hroom + troom, GFP_ATOMIC)) == NULL) {
742 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
743 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
744 IPSTATS_MIB_FRAGFAILS);
745 err = -ENOMEM;
746 goto fail;
747 }
748
749 /*
750 * Set up data on packet
751 */
752
753 ip6_copy_metadata(frag, skb);
754 skb_reserve(frag, hroom);
755 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
756 skb_reset_network_header(frag);
757 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
758 frag->transport_header = (frag->network_header + hlen +
759 sizeof(struct frag_hdr));
760
761 /*
762 * Charge the memory for the fragment to any owner
763 * it might possess
764 */
765 if (skb->sk)
766 skb_set_owner_w(frag, skb->sk);
767
768 /*
769 * Copy the packet header into the new buffer.
770 */
771 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
772
773 /*
774 * Build fragment header.
775 */
776 fh->nexthdr = nexthdr;
777 fh->reserved = 0;
778 if (!frag_id) {
779 ipv6_select_ident(fh, rt);
780 frag_id = fh->identification;
781 } else
782 fh->identification = frag_id;
783
784 /*
785 * Copy a block of the IP datagram.
786 */
787 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
788 BUG();
789 left -= len;
790
791 fh->frag_off = htons(offset);
792 if (left > 0)
793 fh->frag_off |= htons(IP6_MF);
794 ipv6_hdr(frag)->payload_len = htons(frag->len -
795 sizeof(struct ipv6hdr));
796
797 ptr += len;
798 offset += len;
799
800 /*
801 * Put this fragment into the sending queue.
802 */
803 err = output(frag);
804 if (err)
805 goto fail;
806
807 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
808 IPSTATS_MIB_FRAGCREATES);
809 }
810 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
811 IPSTATS_MIB_FRAGOKS);
812 consume_skb(skb);
813 return err;
814
815 fail:
816 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
817 IPSTATS_MIB_FRAGFAILS);
818 kfree_skb(skb);
819 return err;
820 }
821
822 static inline int ip6_rt_check(const struct rt6key *rt_key,
823 const struct in6_addr *fl_addr,
824 const struct in6_addr *addr_cache)
825 {
826 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
827 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
828 }
829
830 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
831 struct dst_entry *dst,
832 const struct flowi6 *fl6)
833 {
834 struct ipv6_pinfo *np = inet6_sk(sk);
835 struct rt6_info *rt;
836
837 if (!dst)
838 goto out;
839
840 if (dst->ops->family != AF_INET6) {
841 dst_release(dst);
842 return NULL;
843 }
844
845 rt = (struct rt6_info *)dst;
846 /* Yes, checking route validity in not connected
847 * case is not very simple. Take into account,
848 * that we do not support routing by source, TOS,
849 * and MSG_DONTROUTE --ANK (980726)
850 *
851 * 1. ip6_rt_check(): If route was host route,
852 * check that cached destination is current.
853 * If it is network route, we still may
854 * check its validity using saved pointer
855 * to the last used address: daddr_cache.
856 * We do not want to save whole address now,
857 * (because main consumer of this service
858 * is tcp, which has not this problem),
859 * so that the last trick works only on connected
860 * sockets.
861 * 2. oif also should be the same.
862 */
863 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
864 #ifdef CONFIG_IPV6_SUBTREES
865 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
866 #endif
867 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
868 dst_release(dst);
869 dst = NULL;
870 }
871
872 out:
873 return dst;
874 }
875
876 static int ip6_dst_lookup_tail(struct sock *sk,
877 struct dst_entry **dst, struct flowi6 *fl6)
878 {
879 struct net *net = sock_net(sk);
880 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
881 struct neighbour *n;
882 struct rt6_info *rt;
883 #endif
884 int err;
885
886 if (*dst == NULL)
887 *dst = ip6_route_output(net, sk, fl6);
888
889 if ((err = (*dst)->error))
890 goto out_err_release;
891
892 if (ipv6_addr_any(&fl6->saddr)) {
893 struct rt6_info *rt = (struct rt6_info *) *dst;
894 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
895 sk ? inet6_sk(sk)->srcprefs : 0,
896 &fl6->saddr);
897 if (err)
898 goto out_err_release;
899 }
900
901 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
902 /*
903 * Here if the dst entry we've looked up
904 * has a neighbour entry that is in the INCOMPLETE
905 * state and the src address from the flow is
906 * marked as OPTIMISTIC, we release the found
907 * dst entry and replace it instead with the
908 * dst entry of the nexthop router
909 */
910 rt = (struct rt6_info *) *dst;
911 rcu_read_lock_bh();
912 n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
913 err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
914 rcu_read_unlock_bh();
915
916 if (err) {
917 struct inet6_ifaddr *ifp;
918 struct flowi6 fl_gw6;
919 int redirect;
920
921 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
922 (*dst)->dev, 1);
923
924 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
925 if (ifp)
926 in6_ifa_put(ifp);
927
928 if (redirect) {
929 /*
930 * We need to get the dst entry for the
931 * default router instead
932 */
933 dst_release(*dst);
934 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
935 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
936 *dst = ip6_route_output(net, sk, &fl_gw6);
937 if ((err = (*dst)->error))
938 goto out_err_release;
939 }
940 }
941 #endif
942
943 return 0;
944
945 out_err_release:
946 if (err == -ENETUNREACH)
947 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
948 dst_release(*dst);
949 *dst = NULL;
950 return err;
951 }
952
953 /**
954 * ip6_dst_lookup - perform route lookup on flow
955 * @sk: socket which provides route info
956 * @dst: pointer to dst_entry * for result
957 * @fl6: flow to lookup
958 *
959 * This function performs a route lookup on the given flow.
960 *
961 * It returns zero on success, or a standard errno code on error.
962 */
963 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
964 {
965 *dst = NULL;
966 return ip6_dst_lookup_tail(sk, dst, fl6);
967 }
968 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
969
970 /**
971 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
972 * @sk: socket which provides route info
973 * @fl6: flow to lookup
974 * @final_dst: final destination address for ipsec lookup
975 *
976 * This function performs a route lookup on the given flow.
977 *
978 * It returns a valid dst pointer on success, or a pointer encoded
979 * error code.
980 */
981 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
982 const struct in6_addr *final_dst)
983 {
984 struct dst_entry *dst = NULL;
985 int err;
986
987 err = ip6_dst_lookup_tail(sk, &dst, fl6);
988 if (err)
989 return ERR_PTR(err);
990 if (final_dst)
991 fl6->daddr = *final_dst;
992
993 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
994 }
995 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
996
997 /**
998 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
999 * @sk: socket which provides the dst cache and route info
1000 * @fl6: flow to lookup
1001 * @final_dst: final destination address for ipsec lookup
1002 *
1003 * This function performs a route lookup on the given flow with the
1004 * possibility of using the cached route in the socket if it is valid.
1005 * It will take the socket dst lock when operating on the dst cache.
1006 * As a result, this function can only be used in process context.
1007 *
1008 * It returns a valid dst pointer on success, or a pointer encoded
1009 * error code.
1010 */
1011 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1012 const struct in6_addr *final_dst)
1013 {
1014 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1015 int err;
1016
1017 dst = ip6_sk_dst_check(sk, dst, fl6);
1018
1019 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1020 if (err)
1021 return ERR_PTR(err);
1022 if (final_dst)
1023 fl6->daddr = *final_dst;
1024
1025 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1026 }
1027 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1028
1029 static inline int ip6_ufo_append_data(struct sock *sk,
1030 int getfrag(void *from, char *to, int offset, int len,
1031 int odd, struct sk_buff *skb),
1032 void *from, int length, int hh_len, int fragheaderlen,
1033 int transhdrlen, int mtu,unsigned int flags,
1034 struct rt6_info *rt)
1035
1036 {
1037 struct sk_buff *skb;
1038 struct frag_hdr fhdr;
1039 int err;
1040
1041 /* There is support for UDP large send offload by network
1042 * device, so create one single skb packet containing complete
1043 * udp datagram
1044 */
1045 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1046 skb = sock_alloc_send_skb(sk,
1047 hh_len + fragheaderlen + transhdrlen + 20,
1048 (flags & MSG_DONTWAIT), &err);
1049 if (skb == NULL)
1050 return err;
1051
1052 /* reserve space for Hardware header */
1053 skb_reserve(skb, hh_len);
1054
1055 /* create space for UDP/IP header */
1056 skb_put(skb,fragheaderlen + transhdrlen);
1057
1058 /* initialize network header pointer */
1059 skb_reset_network_header(skb);
1060
1061 /* initialize protocol header pointer */
1062 skb->transport_header = skb->network_header + fragheaderlen;
1063
1064 skb->protocol = htons(ETH_P_IPV6);
1065 skb->csum = 0;
1066
1067 __skb_queue_tail(&sk->sk_write_queue, skb);
1068 } else if (skb_is_gso(skb)) {
1069 goto append;
1070 }
1071
1072 skb->ip_summed = CHECKSUM_PARTIAL;
1073 /* Specify the length of each IPv6 datagram fragment.
1074 * It has to be a multiple of 8.
1075 */
1076 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1077 sizeof(struct frag_hdr)) & ~7;
1078 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1079 ipv6_select_ident(&fhdr, rt);
1080 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1081
1082 append:
1083 return skb_append_datato_frags(sk, skb, getfrag, from,
1084 (length - transhdrlen));
1085 }
1086
1087 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1088 gfp_t gfp)
1089 {
1090 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1091 }
1092
1093 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1094 gfp_t gfp)
1095 {
1096 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1097 }
1098
1099 static void ip6_append_data_mtu(unsigned int *mtu,
1100 int *maxfraglen,
1101 unsigned int fragheaderlen,
1102 struct sk_buff *skb,
1103 struct rt6_info *rt,
1104 bool pmtuprobe)
1105 {
1106 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1107 if (skb == NULL) {
1108 /* first fragment, reserve header_len */
1109 *mtu = *mtu - rt->dst.header_len;
1110
1111 } else {
1112 /*
1113 * this fragment is not first, the headers
1114 * space is regarded as data space.
1115 */
1116 *mtu = min(*mtu, pmtuprobe ?
1117 rt->dst.dev->mtu :
1118 dst_mtu(rt->dst.path));
1119 }
1120 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1121 + fragheaderlen - sizeof(struct frag_hdr);
1122 }
1123 }
1124
1125 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1126 int offset, int len, int odd, struct sk_buff *skb),
1127 void *from, int length, int transhdrlen,
1128 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1129 struct rt6_info *rt, unsigned int flags, int dontfrag)
1130 {
1131 struct inet_sock *inet = inet_sk(sk);
1132 struct ipv6_pinfo *np = inet6_sk(sk);
1133 struct inet_cork *cork;
1134 struct sk_buff *skb, *skb_prev = NULL;
1135 unsigned int maxfraglen, fragheaderlen, mtu;
1136 int exthdrlen;
1137 int dst_exthdrlen;
1138 int hh_len;
1139 int copy;
1140 int err;
1141 int offset = 0;
1142 __u8 tx_flags = 0;
1143
1144 if (flags&MSG_PROBE)
1145 return 0;
1146 cork = &inet->cork.base;
1147 if (skb_queue_empty(&sk->sk_write_queue)) {
1148 /*
1149 * setup for corking
1150 */
1151 if (opt) {
1152 if (WARN_ON(np->cork.opt))
1153 return -EINVAL;
1154
1155 np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1156 if (unlikely(np->cork.opt == NULL))
1157 return -ENOBUFS;
1158
1159 np->cork.opt->tot_len = opt->tot_len;
1160 np->cork.opt->opt_flen = opt->opt_flen;
1161 np->cork.opt->opt_nflen = opt->opt_nflen;
1162
1163 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1164 sk->sk_allocation);
1165 if (opt->dst0opt && !np->cork.opt->dst0opt)
1166 return -ENOBUFS;
1167
1168 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1169 sk->sk_allocation);
1170 if (opt->dst1opt && !np->cork.opt->dst1opt)
1171 return -ENOBUFS;
1172
1173 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1174 sk->sk_allocation);
1175 if (opt->hopopt && !np->cork.opt->hopopt)
1176 return -ENOBUFS;
1177
1178 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1179 sk->sk_allocation);
1180 if (opt->srcrt && !np->cork.opt->srcrt)
1181 return -ENOBUFS;
1182
1183 /* need source address above miyazawa*/
1184 }
1185 dst_hold(&rt->dst);
1186 cork->dst = &rt->dst;
1187 inet->cork.fl.u.ip6 = *fl6;
1188 np->cork.hop_limit = hlimit;
1189 np->cork.tclass = tclass;
1190 if (rt->dst.flags & DST_XFRM_TUNNEL)
1191 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1192 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1193 else
1194 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1195 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1196 if (np->frag_size < mtu) {
1197 if (np->frag_size)
1198 mtu = np->frag_size;
1199 }
1200 cork->fragsize = mtu;
1201 if (dst_allfrag(rt->dst.path))
1202 cork->flags |= IPCORK_ALLFRAG;
1203 cork->length = 0;
1204 exthdrlen = (opt ? opt->opt_flen : 0);
1205 length += exthdrlen;
1206 transhdrlen += exthdrlen;
1207 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1208 } else {
1209 rt = (struct rt6_info *)cork->dst;
1210 fl6 = &inet->cork.fl.u.ip6;
1211 opt = np->cork.opt;
1212 transhdrlen = 0;
1213 exthdrlen = 0;
1214 dst_exthdrlen = 0;
1215 mtu = cork->fragsize;
1216 }
1217
1218 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1219
1220 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1221 (opt ? opt->opt_nflen : 0);
1222 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1223 sizeof(struct frag_hdr);
1224
1225 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1226 unsigned int maxnonfragsize, headersize;
1227
1228 headersize = sizeof(struct ipv6hdr) +
1229 (opt ? opt->tot_len : 0) +
1230 (dst_allfrag(&rt->dst) ?
1231 sizeof(struct frag_hdr) : 0) +
1232 rt->rt6i_nfheader_len;
1233
1234 maxnonfragsize = (np->pmtudisc >= IPV6_PMTUDISC_DO) ?
1235 mtu : sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1236
1237 /* dontfrag active */
1238 if ((cork->length + length > mtu - headersize) && dontfrag &&
1239 (sk->sk_protocol == IPPROTO_UDP ||
1240 sk->sk_protocol == IPPROTO_RAW)) {
1241 ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1242 sizeof(struct ipv6hdr));
1243 goto emsgsize;
1244 }
1245
1246 if (cork->length + length > maxnonfragsize - headersize) {
1247 emsgsize:
1248 ipv6_local_error(sk, EMSGSIZE, fl6,
1249 mtu - headersize +
1250 sizeof(struct ipv6hdr));
1251 return -EMSGSIZE;
1252 }
1253 }
1254
1255 /* For UDP, check if TX timestamp is enabled */
1256 if (sk->sk_type == SOCK_DGRAM)
1257 sock_tx_timestamp(sk, &tx_flags);
1258
1259 /*
1260 * Let's try using as much space as possible.
1261 * Use MTU if total length of the message fits into the MTU.
1262 * Otherwise, we need to reserve fragment header and
1263 * fragment alignment (= 8-15 octects, in total).
1264 *
1265 * Note that we may need to "move" the data from the tail of
1266 * of the buffer to the new fragment when we split
1267 * the message.
1268 *
1269 * FIXME: It may be fragmented into multiple chunks
1270 * at once if non-fragmentable extension headers
1271 * are too large.
1272 * --yoshfuji
1273 */
1274
1275 skb = skb_peek_tail(&sk->sk_write_queue);
1276 cork->length += length;
1277 if (((length > mtu) ||
1278 (skb && skb_is_gso(skb))) &&
1279 (sk->sk_protocol == IPPROTO_UDP) &&
1280 (rt->dst.dev->features & NETIF_F_UFO)) {
1281 err = ip6_ufo_append_data(sk, getfrag, from, length,
1282 hh_len, fragheaderlen,
1283 transhdrlen, mtu, flags, rt);
1284 if (err)
1285 goto error;
1286 return 0;
1287 }
1288
1289 if (!skb)
1290 goto alloc_new_skb;
1291
1292 while (length > 0) {
1293 /* Check if the remaining data fits into current packet. */
1294 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1295 if (copy < length)
1296 copy = maxfraglen - skb->len;
1297
1298 if (copy <= 0) {
1299 char *data;
1300 unsigned int datalen;
1301 unsigned int fraglen;
1302 unsigned int fraggap;
1303 unsigned int alloclen;
1304 alloc_new_skb:
1305 /* There's no room in the current skb */
1306 if (skb)
1307 fraggap = skb->len - maxfraglen;
1308 else
1309 fraggap = 0;
1310 /* update mtu and maxfraglen if necessary */
1311 if (skb == NULL || skb_prev == NULL)
1312 ip6_append_data_mtu(&mtu, &maxfraglen,
1313 fragheaderlen, skb, rt,
1314 np->pmtudisc >=
1315 IPV6_PMTUDISC_PROBE);
1316
1317 skb_prev = skb;
1318
1319 /*
1320 * If remaining data exceeds the mtu,
1321 * we know we need more fragment(s).
1322 */
1323 datalen = length + fraggap;
1324
1325 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1326 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1327 if ((flags & MSG_MORE) &&
1328 !(rt->dst.dev->features&NETIF_F_SG))
1329 alloclen = mtu;
1330 else
1331 alloclen = datalen + fragheaderlen;
1332
1333 alloclen += dst_exthdrlen;
1334
1335 if (datalen != length + fraggap) {
1336 /*
1337 * this is not the last fragment, the trailer
1338 * space is regarded as data space.
1339 */
1340 datalen += rt->dst.trailer_len;
1341 }
1342
1343 alloclen += rt->dst.trailer_len;
1344 fraglen = datalen + fragheaderlen;
1345
1346 /*
1347 * We just reserve space for fragment header.
1348 * Note: this may be overallocation if the message
1349 * (without MSG_MORE) fits into the MTU.
1350 */
1351 alloclen += sizeof(struct frag_hdr);
1352
1353 if (transhdrlen) {
1354 skb = sock_alloc_send_skb(sk,
1355 alloclen + hh_len,
1356 (flags & MSG_DONTWAIT), &err);
1357 } else {
1358 skb = NULL;
1359 if (atomic_read(&sk->sk_wmem_alloc) <=
1360 2 * sk->sk_sndbuf)
1361 skb = sock_wmalloc(sk,
1362 alloclen + hh_len, 1,
1363 sk->sk_allocation);
1364 if (unlikely(skb == NULL))
1365 err = -ENOBUFS;
1366 else {
1367 /* Only the initial fragment
1368 * is time stamped.
1369 */
1370 tx_flags = 0;
1371 }
1372 }
1373 if (skb == NULL)
1374 goto error;
1375 /*
1376 * Fill in the control structures
1377 */
1378 skb->protocol = htons(ETH_P_IPV6);
1379 skb->ip_summed = CHECKSUM_NONE;
1380 skb->csum = 0;
1381 /* reserve for fragmentation and ipsec header */
1382 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1383 dst_exthdrlen);
1384
1385 if (sk->sk_type == SOCK_DGRAM)
1386 skb_shinfo(skb)->tx_flags = tx_flags;
1387
1388 /*
1389 * Find where to start putting bytes
1390 */
1391 data = skb_put(skb, fraglen);
1392 skb_set_network_header(skb, exthdrlen);
1393 data += fragheaderlen;
1394 skb->transport_header = (skb->network_header +
1395 fragheaderlen);
1396 if (fraggap) {
1397 skb->csum = skb_copy_and_csum_bits(
1398 skb_prev, maxfraglen,
1399 data + transhdrlen, fraggap, 0);
1400 skb_prev->csum = csum_sub(skb_prev->csum,
1401 skb->csum);
1402 data += fraggap;
1403 pskb_trim_unique(skb_prev, maxfraglen);
1404 }
1405 copy = datalen - transhdrlen - fraggap;
1406
1407 if (copy < 0) {
1408 err = -EINVAL;
1409 kfree_skb(skb);
1410 goto error;
1411 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1412 err = -EFAULT;
1413 kfree_skb(skb);
1414 goto error;
1415 }
1416
1417 offset += copy;
1418 length -= datalen - fraggap;
1419 transhdrlen = 0;
1420 exthdrlen = 0;
1421 dst_exthdrlen = 0;
1422
1423 /*
1424 * Put the packet on the pending queue
1425 */
1426 __skb_queue_tail(&sk->sk_write_queue, skb);
1427 continue;
1428 }
1429
1430 if (copy > length)
1431 copy = length;
1432
1433 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1434 unsigned int off;
1435
1436 off = skb->len;
1437 if (getfrag(from, skb_put(skb, copy),
1438 offset, copy, off, skb) < 0) {
1439 __skb_trim(skb, off);
1440 err = -EFAULT;
1441 goto error;
1442 }
1443 } else {
1444 int i = skb_shinfo(skb)->nr_frags;
1445 struct page_frag *pfrag = sk_page_frag(sk);
1446
1447 err = -ENOMEM;
1448 if (!sk_page_frag_refill(sk, pfrag))
1449 goto error;
1450
1451 if (!skb_can_coalesce(skb, i, pfrag->page,
1452 pfrag->offset)) {
1453 err = -EMSGSIZE;
1454 if (i == MAX_SKB_FRAGS)
1455 goto error;
1456
1457 __skb_fill_page_desc(skb, i, pfrag->page,
1458 pfrag->offset, 0);
1459 skb_shinfo(skb)->nr_frags = ++i;
1460 get_page(pfrag->page);
1461 }
1462 copy = min_t(int, copy, pfrag->size - pfrag->offset);
1463 if (getfrag(from,
1464 page_address(pfrag->page) + pfrag->offset,
1465 offset, copy, skb->len, skb) < 0)
1466 goto error_efault;
1467
1468 pfrag->offset += copy;
1469 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1470 skb->len += copy;
1471 skb->data_len += copy;
1472 skb->truesize += copy;
1473 atomic_add(copy, &sk->sk_wmem_alloc);
1474 }
1475 offset += copy;
1476 length -= copy;
1477 }
1478
1479 return 0;
1480
1481 error_efault:
1482 err = -EFAULT;
1483 error:
1484 cork->length -= length;
1485 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1486 return err;
1487 }
1488 EXPORT_SYMBOL_GPL(ip6_append_data);
1489
1490 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1491 {
1492 if (np->cork.opt) {
1493 kfree(np->cork.opt->dst0opt);
1494 kfree(np->cork.opt->dst1opt);
1495 kfree(np->cork.opt->hopopt);
1496 kfree(np->cork.opt->srcrt);
1497 kfree(np->cork.opt);
1498 np->cork.opt = NULL;
1499 }
1500
1501 if (inet->cork.base.dst) {
1502 dst_release(inet->cork.base.dst);
1503 inet->cork.base.dst = NULL;
1504 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1505 }
1506 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1507 }
1508
1509 int ip6_push_pending_frames(struct sock *sk)
1510 {
1511 struct sk_buff *skb, *tmp_skb;
1512 struct sk_buff **tail_skb;
1513 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1514 struct inet_sock *inet = inet_sk(sk);
1515 struct ipv6_pinfo *np = inet6_sk(sk);
1516 struct net *net = sock_net(sk);
1517 struct ipv6hdr *hdr;
1518 struct ipv6_txoptions *opt = np->cork.opt;
1519 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1520 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1521 unsigned char proto = fl6->flowi6_proto;
1522 int err = 0;
1523
1524 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1525 goto out;
1526 tail_skb = &(skb_shinfo(skb)->frag_list);
1527
1528 /* move skb->data to ip header from ext header */
1529 if (skb->data < skb_network_header(skb))
1530 __skb_pull(skb, skb_network_offset(skb));
1531 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1532 __skb_pull(tmp_skb, skb_network_header_len(skb));
1533 *tail_skb = tmp_skb;
1534 tail_skb = &(tmp_skb->next);
1535 skb->len += tmp_skb->len;
1536 skb->data_len += tmp_skb->len;
1537 skb->truesize += tmp_skb->truesize;
1538 tmp_skb->destructor = NULL;
1539 tmp_skb->sk = NULL;
1540 }
1541
1542 /* Allow local fragmentation. */
1543 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1544 skb->local_df = 1;
1545
1546 *final_dst = fl6->daddr;
1547 __skb_pull(skb, skb_network_header_len(skb));
1548 if (opt && opt->opt_flen)
1549 ipv6_push_frag_opts(skb, opt, &proto);
1550 if (opt && opt->opt_nflen)
1551 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1552
1553 skb_push(skb, sizeof(struct ipv6hdr));
1554 skb_reset_network_header(skb);
1555 hdr = ipv6_hdr(skb);
1556
1557 ip6_flow_hdr(hdr, np->cork.tclass, fl6->flowlabel);
1558 hdr->hop_limit = np->cork.hop_limit;
1559 hdr->nexthdr = proto;
1560 hdr->saddr = fl6->saddr;
1561 hdr->daddr = *final_dst;
1562
1563 skb->priority = sk->sk_priority;
1564 skb->mark = sk->sk_mark;
1565
1566 skb_dst_set(skb, dst_clone(&rt->dst));
1567 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1568 if (proto == IPPROTO_ICMPV6) {
1569 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1570
1571 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1572 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1573 }
1574
1575 err = ip6_local_out(skb);
1576 if (err) {
1577 if (err > 0)
1578 err = net_xmit_errno(err);
1579 if (err)
1580 goto error;
1581 }
1582
1583 out:
1584 ip6_cork_release(inet, np);
1585 return err;
1586 error:
1587 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1588 goto out;
1589 }
1590 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1591
1592 void ip6_flush_pending_frames(struct sock *sk)
1593 {
1594 struct sk_buff *skb;
1595
1596 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1597 if (skb_dst(skb))
1598 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1599 IPSTATS_MIB_OUTDISCARDS);
1600 kfree_skb(skb);
1601 }
1602
1603 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1604 }
1605 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
Ubuntu Jammy Linux kernel mirror