?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
cfg80211: Fix array-bounds warning in fragment copy
[linux/fpc-iii.git] / net / ipv6 / ip6_output.c
blob528b3c1f3fdee4314e1c23007ae76333b4af7505
1 /*
2 * IPv6 output functions
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 *
8 * Based on linux/net/ipv4/ip_output.c
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 *
15 * Changes:
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
20 * etc.
21 *
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
26 * for datagram xmit
27 */
28
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
41
42 #include <linux/bpf-cgroup.h>
43 #include <linux/netfilter.h>
44 #include <linux/netfilter_ipv6.h>
45
46 #include <net/sock.h>
47 #include <net/snmp.h>
48
49 #include <net/ipv6.h>
50 #include <net/ndisc.h>
51 #include <net/protocol.h>
52 #include <net/ip6_route.h>
53 #include <net/addrconf.h>
54 #include <net/rawv6.h>
55 #include <net/icmp.h>
56 #include <net/xfrm.h>
57 #include <net/checksum.h>
58 #include <linux/mroute6.h>
59 #include <net/l3mdev.h>
60 #include <net/lwtunnel.h>
61
62 static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *skb)
63 {
64 struct dst_entry *dst = skb_dst(skb);
65 struct net_device *dev = dst->dev;
66 struct neighbour *neigh;
67 struct in6_addr *nexthop;
68 int ret;
69
70 skb->protocol = htons(ETH_P_IPV6);
71 skb->dev = dev;
72
73 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
74 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
75
76 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(sk) &&
77 ((mroute6_socket(net, skb) &&
78 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
79 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
80 &ipv6_hdr(skb)->saddr))) {
81 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
82
83 /* Do not check for IFF_ALLMULTI; multicast routing
84 is not supported in any case.
85 */
86 if (newskb)
87 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
88 net, sk, newskb, NULL, newskb->dev,
89 dev_loopback_xmit);
90
91 if (ipv6_hdr(skb)->hop_limit == 0) {
92 IP6_INC_STATS(net, idev,
93 IPSTATS_MIB_OUTDISCARDS);
94 kfree_skb(skb);
95 return 0;
96 }
97 }
98
99 IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUTMCAST, skb->len);
100
101 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
102 IPV6_ADDR_SCOPE_NODELOCAL &&
103 !(dev->flags & IFF_LOOPBACK)) {
104 kfree_skb(skb);
105 return 0;
106 }
107 }
108
109 if (lwtunnel_xmit_redirect(dst->lwtstate)) {
110 int res = lwtunnel_xmit(skb);
111
112 if (res < 0 || res == LWTUNNEL_XMIT_DONE)
113 return res;
114 }
115
116 rcu_read_lock_bh();
117 nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
118 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
119 if (unlikely(!neigh))
120 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
121 if (!IS_ERR(neigh)) {
122 sock_confirm_neigh(skb, neigh);
123 ret = neigh_output(neigh, skb);
124 rcu_read_unlock_bh();
125 return ret;
126 }
127 rcu_read_unlock_bh();
128
129 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
130 kfree_skb(skb);
131 return -EINVAL;
132 }
133
134 static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
135 {
136 int ret;
137
138 ret = BPF_CGROUP_RUN_PROG_INET_EGRESS(sk, skb);
139 if (ret) {
140 kfree_skb(skb);
141 return ret;
142 }
143
144 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
145 dst_allfrag(skb_dst(skb)) ||
146 (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
147 return ip6_fragment(net, sk, skb, ip6_finish_output2);
148 else
149 return ip6_finish_output2(net, sk, skb);
150 }
151
152 int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
153 {
154 struct net_device *dev = skb_dst(skb)->dev;
155 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
156
157 if (unlikely(idev->cnf.disable_ipv6)) {
158 IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);
159 kfree_skb(skb);
160 return 0;
161 }
162
163 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
164 net, sk, skb, NULL, dev,
165 ip6_finish_output,
166 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
167 }
168
169 /*
170 * xmit an sk_buff (used by TCP, SCTP and DCCP)
171 * Note : socket lock is not held for SYNACK packets, but might be modified
172 * by calls to skb_set_owner_w() and ipv6_local_error(),
173 * which are using proper atomic operations or spinlocks.
174 */
175 int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
176 __u32 mark, struct ipv6_txoptions *opt, int tclass)
177 {
178 struct net *net = sock_net(sk);
179 const struct ipv6_pinfo *np = inet6_sk(sk);
180 struct in6_addr *first_hop = &fl6->daddr;
181 struct dst_entry *dst = skb_dst(skb);
182 struct ipv6hdr *hdr;
183 u8 proto = fl6->flowi6_proto;
184 int seg_len = skb->len;
185 int hlimit = -1;
186 u32 mtu;
187
188 if (opt) {
189 unsigned int head_room;
190
191 /* First: exthdrs may take lots of space (~8K for now)
192 MAX_HEADER is not enough.
193 */
194 head_room = opt->opt_nflen + opt->opt_flen;
195 seg_len += head_room;
196 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
197
198 if (skb_headroom(skb) < head_room) {
199 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
200 if (!skb2) {
201 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
202 IPSTATS_MIB_OUTDISCARDS);
203 kfree_skb(skb);
204 return -ENOBUFS;
205 }
206 consume_skb(skb);
207 skb = skb2;
208 /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
209 * it is safe to call in our context (socket lock not held)
210 */
211 skb_set_owner_w(skb, (struct sock *)sk);
212 }
213 if (opt->opt_flen)
214 ipv6_push_frag_opts(skb, opt, &proto);
215 if (opt->opt_nflen)
216 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop,
217 &fl6->saddr);
218 }
219
220 skb_push(skb, sizeof(struct ipv6hdr));
221 skb_reset_network_header(skb);
222 hdr = ipv6_hdr(skb);
223
224 /*
225 * Fill in the IPv6 header
226 */
227 if (np)
228 hlimit = np->hop_limit;
229 if (hlimit < 0)
230 hlimit = ip6_dst_hoplimit(dst);
231
232 ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
233 np->autoflowlabel, fl6));
234
235 hdr->payload_len = htons(seg_len);
236 hdr->nexthdr = proto;
237 hdr->hop_limit = hlimit;
238
239 hdr->saddr = fl6->saddr;
240 hdr->daddr = *first_hop;
241
242 skb->protocol = htons(ETH_P_IPV6);
243 skb->priority = sk->sk_priority;
244 skb->mark = mark;
245
246 mtu = dst_mtu(dst);
247 if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
248 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
249 IPSTATS_MIB_OUT, skb->len);
250
251 /* if egress device is enslaved to an L3 master device pass the
252 * skb to its handler for processing
253 */
254 skb = l3mdev_ip6_out((struct sock *)sk, skb);
255 if (unlikely(!skb))
256 return 0;
257
258 /* hooks should never assume socket lock is held.
259 * we promote our socket to non const
260 */
261 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT,
262 net, (struct sock *)sk, skb, NULL, dst->dev,
263 dst_output);
264 }
265
266 skb->dev = dst->dev;
267 /* ipv6_local_error() does not require socket lock,
268 * we promote our socket to non const
269 */
270 ipv6_local_error((struct sock *)sk, EMSGSIZE, fl6, mtu);
271
272 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
273 kfree_skb(skb);
274 return -EMSGSIZE;
275 }
276 EXPORT_SYMBOL(ip6_xmit);
277
278 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
279 {
280 struct ip6_ra_chain *ra;
281 struct sock *last = NULL;
282
283 read_lock(&ip6_ra_lock);
284 for (ra = ip6_ra_chain; ra; ra = ra->next) {
285 struct sock *sk = ra->sk;
286 if (sk && ra->sel == sel &&
287 (!sk->sk_bound_dev_if ||
288 sk->sk_bound_dev_if == skb->dev->ifindex)) {
289 if (last) {
290 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
291 if (skb2)
292 rawv6_rcv(last, skb2);
293 }
294 last = sk;
295 }
296 }
297
298 if (last) {
299 rawv6_rcv(last, skb);
300 read_unlock(&ip6_ra_lock);
301 return 1;
302 }
303 read_unlock(&ip6_ra_lock);
304 return 0;
305 }
306
307 static int ip6_forward_proxy_check(struct sk_buff *skb)
308 {
309 struct ipv6hdr *hdr = ipv6_hdr(skb);
310 u8 nexthdr = hdr->nexthdr;
311 __be16 frag_off;
312 int offset;
313
314 if (ipv6_ext_hdr(nexthdr)) {
315 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
316 if (offset < 0)
317 return 0;
318 } else
319 offset = sizeof(struct ipv6hdr);
320
321 if (nexthdr == IPPROTO_ICMPV6) {
322 struct icmp6hdr *icmp6;
323
324 if (!pskb_may_pull(skb, (skb_network_header(skb) +
325 offset + 1 - skb->data)))
326 return 0;
327
328 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
329
330 switch (icmp6->icmp6_type) {
331 case NDISC_ROUTER_SOLICITATION:
332 case NDISC_ROUTER_ADVERTISEMENT:
333 case NDISC_NEIGHBOUR_SOLICITATION:
334 case NDISC_NEIGHBOUR_ADVERTISEMENT:
335 case NDISC_REDIRECT:
336 /* For reaction involving unicast neighbor discovery
337 * message destined to the proxied address, pass it to
338 * input function.
339 */
340 return 1;
341 default:
342 break;
343 }
344 }
345
346 /*
347 * The proxying router can't forward traffic sent to a link-local
348 * address, so signal the sender and discard the packet. This
349 * behavior is clarified by the MIPv6 specification.
350 */
351 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
352 dst_link_failure(skb);
353 return -1;
354 }
355
356 return 0;
357 }
358
359 static inline int ip6_forward_finish(struct net *net, struct sock *sk,
360 struct sk_buff *skb)
361 {
362 return dst_output(net, sk, skb);
363 }
364
365 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
366 {
367 unsigned int mtu;
368 struct inet6_dev *idev;
369
370 if (dst_metric_locked(dst, RTAX_MTU)) {
371 mtu = dst_metric_raw(dst, RTAX_MTU);
372 if (mtu)
373 return mtu;
374 }
375
376 mtu = IPV6_MIN_MTU;
377 rcu_read_lock();
378 idev = __in6_dev_get(dst->dev);
379 if (idev)
380 mtu = idev->cnf.mtu6;
381 rcu_read_unlock();
382
383 return mtu;
384 }
385
386 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
387 {
388 if (skb->len <= mtu)
389 return false;
390
391 /* ipv6 conntrack defrag sets max_frag_size + ignore_df */
392 if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
393 return true;
394
395 if (skb->ignore_df)
396 return false;
397
398 if (skb_is_gso(skb) && skb_gso_validate_mtu(skb, mtu))
399 return false;
400
401 return true;
402 }
403
404 int ip6_forward(struct sk_buff *skb)
405 {
406 struct dst_entry *dst = skb_dst(skb);
407 struct ipv6hdr *hdr = ipv6_hdr(skb);
408 struct inet6_skb_parm *opt = IP6CB(skb);
409 struct net *net = dev_net(dst->dev);
410 u32 mtu;
411
412 if (net->ipv6.devconf_all->forwarding == 0)
413 goto error;
414
415 if (skb->pkt_type != PACKET_HOST)
416 goto drop;
417
418 if (unlikely(skb->sk))
419 goto drop;
420
421 if (skb_warn_if_lro(skb))
422 goto drop;
423
424 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
425 __IP6_INC_STATS(net, ip6_dst_idev(dst),
426 IPSTATS_MIB_INDISCARDS);
427 goto drop;
428 }
429
430 skb_forward_csum(skb);
431
432 /*
433 * We DO NOT make any processing on
434 * RA packets, pushing them to user level AS IS
435 * without ane WARRANTY that application will be able
436 * to interpret them. The reason is that we
437 * cannot make anything clever here.
438 *
439 * We are not end-node, so that if packet contains
440 * AH/ESP, we cannot make anything.
441 * Defragmentation also would be mistake, RA packets
442 * cannot be fragmented, because there is no warranty
443 * that different fragments will go along one path. --ANK
444 */
445 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
446 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
447 return 0;
448 }
449
450 /*
451 * check and decrement ttl
452 */
453 if (hdr->hop_limit <= 1) {
454 /* Force OUTPUT device used as source address */
455 skb->dev = dst->dev;
456 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
457 __IP6_INC_STATS(net, ip6_dst_idev(dst),
458 IPSTATS_MIB_INHDRERRORS);
459
460 kfree_skb(skb);
461 return -ETIMEDOUT;
462 }
463
464 /* XXX: idev->cnf.proxy_ndp? */
465 if (net->ipv6.devconf_all->proxy_ndp &&
466 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
467 int proxied = ip6_forward_proxy_check(skb);
468 if (proxied > 0)
469 return ip6_input(skb);
470 else if (proxied < 0) {
471 __IP6_INC_STATS(net, ip6_dst_idev(dst),
472 IPSTATS_MIB_INDISCARDS);
473 goto drop;
474 }
475 }
476
477 if (!xfrm6_route_forward(skb)) {
478 __IP6_INC_STATS(net, ip6_dst_idev(dst),
479 IPSTATS_MIB_INDISCARDS);
480 goto drop;
481 }
482 dst = skb_dst(skb);
483
484 /* IPv6 specs say nothing about it, but it is clear that we cannot
485 send redirects to source routed frames.
486 We don't send redirects to frames decapsulated from IPsec.
487 */
488 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
489 struct in6_addr *target = NULL;
490 struct inet_peer *peer;
491 struct rt6_info *rt;
492
493 /*
494 * incoming and outgoing devices are the same
495 * send a redirect.
496 */
497
498 rt = (struct rt6_info *) dst;
499 if (rt->rt6i_flags & RTF_GATEWAY)
500 target = &rt->rt6i_gateway;
501 else
502 target = &hdr->daddr;
503
504 peer = inet_getpeer_v6(net->ipv6.peers, &hdr->daddr, 1);
505
506 /* Limit redirects both by destination (here)
507 and by source (inside ndisc_send_redirect)
508 */
509 if (inet_peer_xrlim_allow(peer, 1*HZ))
510 ndisc_send_redirect(skb, target);
511 if (peer)
512 inet_putpeer(peer);
513 } else {
514 int addrtype = ipv6_addr_type(&hdr->saddr);
515
516 /* This check is security critical. */
517 if (addrtype == IPV6_ADDR_ANY ||
518 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
519 goto error;
520 if (addrtype & IPV6_ADDR_LINKLOCAL) {
521 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
522 ICMPV6_NOT_NEIGHBOUR, 0);
523 goto error;
524 }
525 }
526
527 mtu = ip6_dst_mtu_forward(dst);
528 if (mtu < IPV6_MIN_MTU)
529 mtu = IPV6_MIN_MTU;
530
531 if (ip6_pkt_too_big(skb, mtu)) {
532 /* Again, force OUTPUT device used as source address */
533 skb->dev = dst->dev;
534 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
535 __IP6_INC_STATS(net, ip6_dst_idev(dst),
536 IPSTATS_MIB_INTOOBIGERRORS);
537 __IP6_INC_STATS(net, ip6_dst_idev(dst),
538 IPSTATS_MIB_FRAGFAILS);
539 kfree_skb(skb);
540 return -EMSGSIZE;
541 }
542
543 if (skb_cow(skb, dst->dev->hard_header_len)) {
544 __IP6_INC_STATS(net, ip6_dst_idev(dst),
545 IPSTATS_MIB_OUTDISCARDS);
546 goto drop;
547 }
548
549 hdr = ipv6_hdr(skb);
550
551 /* Mangling hops number delayed to point after skb COW */
552
553 hdr->hop_limit--;
554
555 __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
556 __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
557 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
558 net, NULL, skb, skb->dev, dst->dev,
559 ip6_forward_finish);
560
561 error:
562 __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
563 drop:
564 kfree_skb(skb);
565 return -EINVAL;
566 }
567
568 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
569 {
570 to->pkt_type = from->pkt_type;
571 to->priority = from->priority;
572 to->protocol = from->protocol;
573 skb_dst_drop(to);
574 skb_dst_set(to, dst_clone(skb_dst(from)));
575 to->dev = from->dev;
576 to->mark = from->mark;
577
578 #ifdef CONFIG_NET_SCHED
579 to->tc_index = from->tc_index;
580 #endif
581 nf_copy(to, from);
582 skb_copy_secmark(to, from);
583 }
584
585 int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
586 int (*output)(struct net *, struct sock *, struct sk_buff *))
587 {
588 struct sk_buff *frag;
589 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
590 struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
591 inet6_sk(skb->sk) : NULL;
592 struct ipv6hdr *tmp_hdr;
593 struct frag_hdr *fh;
594 unsigned int mtu, hlen, left, len;
595 int hroom, troom;
596 __be32 frag_id;
597 int ptr, offset = 0, err = 0;
598 u8 *prevhdr, nexthdr = 0;
599
600 hlen = ip6_find_1stfragopt(skb, &prevhdr);
601 nexthdr = *prevhdr;
602
603 mtu = ip6_skb_dst_mtu(skb);
604
605 /* We must not fragment if the socket is set to force MTU discovery
606 * or if the skb it not generated by a local socket.
607 */
608 if (unlikely(!skb->ignore_df && skb->len > mtu))
609 goto fail_toobig;
610
611 if (IP6CB(skb)->frag_max_size) {
612 if (IP6CB(skb)->frag_max_size > mtu)
613 goto fail_toobig;
614
615 /* don't send fragments larger than what we received */
616 mtu = IP6CB(skb)->frag_max_size;
617 if (mtu < IPV6_MIN_MTU)
618 mtu = IPV6_MIN_MTU;
619 }
620
621 if (np && np->frag_size < mtu) {
622 if (np->frag_size)
623 mtu = np->frag_size;
624 }
625 if (mtu < hlen + sizeof(struct frag_hdr) + 8)
626 goto fail_toobig;
627 mtu -= hlen + sizeof(struct frag_hdr);
628
629 frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
630 &ipv6_hdr(skb)->saddr);
631
632 if (skb->ip_summed == CHECKSUM_PARTIAL &&
633 (err = skb_checksum_help(skb)))
634 goto fail;
635
636 hroom = LL_RESERVED_SPACE(rt->dst.dev);
637 if (skb_has_frag_list(skb)) {
638 unsigned int first_len = skb_pagelen(skb);
639 struct sk_buff *frag2;
640
641 if (first_len - hlen > mtu ||
642 ((first_len - hlen) & 7) ||
643 skb_cloned(skb) ||
644 skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
645 goto slow_path;
646
647 skb_walk_frags(skb, frag) {
648 /* Correct geometry. */
649 if (frag->len > mtu ||
650 ((frag->len & 7) && frag->next) ||
651 skb_headroom(frag) < (hlen + hroom + sizeof(struct frag_hdr)))
652 goto slow_path_clean;
653
654 /* Partially cloned skb? */
655 if (skb_shared(frag))
656 goto slow_path_clean;
657
658 BUG_ON(frag->sk);
659 if (skb->sk) {
660 frag->sk = skb->sk;
661 frag->destructor = sock_wfree;
662 }
663 skb->truesize -= frag->truesize;
664 }
665
666 err = 0;
667 offset = 0;
668 /* BUILD HEADER */
669
670 *prevhdr = NEXTHDR_FRAGMENT;
671 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
672 if (!tmp_hdr) {
673 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
674 IPSTATS_MIB_FRAGFAILS);
675 err = -ENOMEM;
676 goto fail;
677 }
678 frag = skb_shinfo(skb)->frag_list;
679 skb_frag_list_init(skb);
680
681 __skb_pull(skb, hlen);
682 fh = (struct frag_hdr *)__skb_push(skb, sizeof(struct frag_hdr));
683 __skb_push(skb, hlen);
684 skb_reset_network_header(skb);
685 memcpy(skb_network_header(skb), tmp_hdr, hlen);
686
687 fh->nexthdr = nexthdr;
688 fh->reserved = 0;
689 fh->frag_off = htons(IP6_MF);
690 fh->identification = frag_id;
691
692 first_len = skb_pagelen(skb);
693 skb->data_len = first_len - skb_headlen(skb);
694 skb->len = first_len;
695 ipv6_hdr(skb)->payload_len = htons(first_len -
696 sizeof(struct ipv6hdr));
697
698 dst_hold(&rt->dst);
699
700 for (;;) {
701 /* Prepare header of the next frame,
702 * before previous one went down. */
703 if (frag) {
704 frag->ip_summed = CHECKSUM_NONE;
705 skb_reset_transport_header(frag);
706 fh = (struct frag_hdr *)__skb_push(frag, sizeof(struct frag_hdr));
707 __skb_push(frag, hlen);
708 skb_reset_network_header(frag);
709 memcpy(skb_network_header(frag), tmp_hdr,
710 hlen);
711 offset += skb->len - hlen - sizeof(struct frag_hdr);
712 fh->nexthdr = nexthdr;
713 fh->reserved = 0;
714 fh->frag_off = htons(offset);
715 if (frag->next)
716 fh->frag_off |= htons(IP6_MF);
717 fh->identification = frag_id;
718 ipv6_hdr(frag)->payload_len =
719 htons(frag->len -
720 sizeof(struct ipv6hdr));
721 ip6_copy_metadata(frag, skb);
722 }
723
724 err = output(net, sk, skb);
725 if (!err)
726 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
727 IPSTATS_MIB_FRAGCREATES);
728
729 if (err || !frag)
730 break;
731
732 skb = frag;
733 frag = skb->next;
734 skb->next = NULL;
735 }
736
737 kfree(tmp_hdr);
738
739 if (err == 0) {
740 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
741 IPSTATS_MIB_FRAGOKS);
742 ip6_rt_put(rt);
743 return 0;
744 }
745
746 kfree_skb_list(frag);
747
748 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
749 IPSTATS_MIB_FRAGFAILS);
750 ip6_rt_put(rt);
751 return err;
752
753 slow_path_clean:
754 skb_walk_frags(skb, frag2) {
755 if (frag2 == frag)
756 break;
757 frag2->sk = NULL;
758 frag2->destructor = NULL;
759 skb->truesize += frag2->truesize;
760 }
761 }
762
763 slow_path:
764 left = skb->len - hlen; /* Space per frame */
765 ptr = hlen; /* Where to start from */
766
767 /*
768 * Fragment the datagram.
769 */
770
771 *prevhdr = NEXTHDR_FRAGMENT;
772 troom = rt->dst.dev->needed_tailroom;
773
774 /*
775 * Keep copying data until we run out.
776 */
777 while (left > 0) {
778 len = left;
779 /* IF: it doesn't fit, use 'mtu' - the data space left */
780 if (len > mtu)
781 len = mtu;
782 /* IF: we are not sending up to and including the packet end
783 then align the next start on an eight byte boundary */
784 if (len < left) {
785 len &= ~7;
786 }
787
788 /* Allocate buffer */
789 frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
790 hroom + troom, GFP_ATOMIC);
791 if (!frag) {
792 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
793 IPSTATS_MIB_FRAGFAILS);
794 err = -ENOMEM;
795 goto fail;
796 }
797
798 /*
799 * Set up data on packet
800 */
801
802 ip6_copy_metadata(frag, skb);
803 skb_reserve(frag, hroom);
804 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
805 skb_reset_network_header(frag);
806 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
807 frag->transport_header = (frag->network_header + hlen +
808 sizeof(struct frag_hdr));
809
810 /*
811 * Charge the memory for the fragment to any owner
812 * it might possess
813 */
814 if (skb->sk)
815 skb_set_owner_w(frag, skb->sk);
816
817 /*
818 * Copy the packet header into the new buffer.
819 */
820 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
821
822 /*
823 * Build fragment header.
824 */
825 fh->nexthdr = nexthdr;
826 fh->reserved = 0;
827 fh->identification = frag_id;
828
829 /*
830 * Copy a block of the IP datagram.
831 */
832 BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),
833 len));
834 left -= len;
835
836 fh->frag_off = htons(offset);
837 if (left > 0)
838 fh->frag_off |= htons(IP6_MF);
839 ipv6_hdr(frag)->payload_len = htons(frag->len -
840 sizeof(struct ipv6hdr));
841
842 ptr += len;
843 offset += len;
844
845 /*
846 * Put this fragment into the sending queue.
847 */
848 err = output(net, sk, frag);
849 if (err)
850 goto fail;
851
852 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
853 IPSTATS_MIB_FRAGCREATES);
854 }
855 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
856 IPSTATS_MIB_FRAGOKS);
857 consume_skb(skb);
858 return err;
859
860 fail_toobig:
861 if (skb->sk && dst_allfrag(skb_dst(skb)))
862 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
863
864 skb->dev = skb_dst(skb)->dev;
865 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
866 err = -EMSGSIZE;
867
868 fail:
869 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
870 IPSTATS_MIB_FRAGFAILS);
871 kfree_skb(skb);
872 return err;
873 }
874
875 static inline int ip6_rt_check(const struct rt6key *rt_key,
876 const struct in6_addr *fl_addr,
877 const struct in6_addr *addr_cache)
878 {
879 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
880 (!addr_cache || !ipv6_addr_equal(fl_addr, addr_cache));
881 }
882
883 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
884 struct dst_entry *dst,
885 const struct flowi6 *fl6)
886 {
887 struct ipv6_pinfo *np = inet6_sk(sk);
888 struct rt6_info *rt;
889
890 if (!dst)
891 goto out;
892
893 if (dst->ops->family != AF_INET6) {
894 dst_release(dst);
895 return NULL;
896 }
897
898 rt = (struct rt6_info *)dst;
899 /* Yes, checking route validity in not connected
900 * case is not very simple. Take into account,
901 * that we do not support routing by source, TOS,
902 * and MSG_DONTROUTE --ANK (980726)
903 *
904 * 1. ip6_rt_check(): If route was host route,
905 * check that cached destination is current.
906 * If it is network route, we still may
907 * check its validity using saved pointer
908 * to the last used address: daddr_cache.
909 * We do not want to save whole address now,
910 * (because main consumer of this service
911 * is tcp, which has not this problem),
912 * so that the last trick works only on connected
913 * sockets.
914 * 2. oif also should be the same.
915 */
916 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
917 #ifdef CONFIG_IPV6_SUBTREES
918 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
919 #endif
920 (!(fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF) &&
921 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex))) {
922 dst_release(dst);
923 dst = NULL;
924 }
925
926 out:
927 return dst;
928 }
929
930 static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk,
931 struct dst_entry **dst, struct flowi6 *fl6)
932 {
933 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
934 struct neighbour *n;
935 struct rt6_info *rt;
936 #endif
937 int err;
938 int flags = 0;
939
940 /* The correct way to handle this would be to do
941 * ip6_route_get_saddr, and then ip6_route_output; however,
942 * the route-specific preferred source forces the
943 * ip6_route_output call _before_ ip6_route_get_saddr.
944 *
945 * In source specific routing (no src=any default route),
946 * ip6_route_output will fail given src=any saddr, though, so
947 * that's why we try it again later.
948 */
949 if (ipv6_addr_any(&fl6->saddr) && (!*dst || !(*dst)->error)) {
950 struct rt6_info *rt;
951 bool had_dst = *dst != NULL;
952
953 if (!had_dst)
954 *dst = ip6_route_output(net, sk, fl6);
955 rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
956 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
957 sk ? inet6_sk(sk)->srcprefs : 0,
958 &fl6->saddr);
959 if (err)
960 goto out_err_release;
961
962 /* If we had an erroneous initial result, pretend it
963 * never existed and let the SA-enabled version take
964 * over.
965 */
966 if (!had_dst && (*dst)->error) {
967 dst_release(*dst);
968 *dst = NULL;
969 }
970
971 if (fl6->flowi6_oif)
972 flags |= RT6_LOOKUP_F_IFACE;
973 }
974
975 if (!*dst)
976 *dst = ip6_route_output_flags(net, sk, fl6, flags);
977
978 err = (*dst)->error;
979 if (err)
980 goto out_err_release;
981
982 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
983 /*
984 * Here if the dst entry we've looked up
985 * has a neighbour entry that is in the INCOMPLETE
986 * state and the src address from the flow is
987 * marked as OPTIMISTIC, we release the found
988 * dst entry and replace it instead with the
989 * dst entry of the nexthop router
990 */
991 rt = (struct rt6_info *) *dst;
992 rcu_read_lock_bh();
993 n = __ipv6_neigh_lookup_noref(rt->dst.dev,
994 rt6_nexthop(rt, &fl6->daddr));
995 err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
996 rcu_read_unlock_bh();
997
998 if (err) {
999 struct inet6_ifaddr *ifp;
1000 struct flowi6 fl_gw6;
1001 int redirect;
1002
1003 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
1004 (*dst)->dev, 1);
1005
1006 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
1007 if (ifp)
1008 in6_ifa_put(ifp);
1009
1010 if (redirect) {
1011 /*
1012 * We need to get the dst entry for the
1013 * default router instead
1014 */
1015 dst_release(*dst);
1016 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1017 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1018 *dst = ip6_route_output(net, sk, &fl_gw6);
1019 err = (*dst)->error;
1020 if (err)
1021 goto out_err_release;
1022 }
1023 }
1024 #endif
1025 if (ipv6_addr_v4mapped(&fl6->saddr) &&
1026 !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) {
1027 err = -EAFNOSUPPORT;
1028 goto out_err_release;
1029 }
1030
1031 return 0;
1032
1033 out_err_release:
1034 dst_release(*dst);
1035 *dst = NULL;
1036
1037 if (err == -ENETUNREACH)
1038 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1039 return err;
1040 }
1041
1042 /**
1043 * ip6_dst_lookup - perform route lookup on flow
1044 * @sk: socket which provides route info
1045 * @dst: pointer to dst_entry * for result
1046 * @fl6: flow to lookup
1047 *
1048 * This function performs a route lookup on the given flow.
1049 *
1050 * It returns zero on success, or a standard errno code on error.
1051 */
1052 int ip6_dst_lookup(struct net *net, struct sock *sk, struct dst_entry **dst,
1053 struct flowi6 *fl6)
1054 {
1055 *dst = NULL;
1056 return ip6_dst_lookup_tail(net, sk, dst, fl6);
1057 }
1058 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1059
1060 /**
1061 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1062 * @sk: socket which provides route info
1063 * @fl6: flow to lookup
1064 * @final_dst: final destination address for ipsec lookup
1065 *
1066 * This function performs a route lookup on the given flow.
1067 *
1068 * It returns a valid dst pointer on success, or a pointer encoded
1069 * error code.
1070 */
1071 struct dst_entry *ip6_dst_lookup_flow(const struct sock *sk, struct flowi6 *fl6,
1072 const struct in6_addr *final_dst)
1073 {
1074 struct dst_entry *dst = NULL;
1075 int err;
1076
1077 err = ip6_dst_lookup_tail(sock_net(sk), sk, &dst, fl6);
1078 if (err)
1079 return ERR_PTR(err);
1080 if (final_dst)
1081 fl6->daddr = *final_dst;
1082
1083 return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1084 }
1085 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1086
1087 /**
1088 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1089 * @sk: socket which provides the dst cache and route info
1090 * @fl6: flow to lookup
1091 * @final_dst: final destination address for ipsec lookup
1092 *
1093 * This function performs a route lookup on the given flow with the
1094 * possibility of using the cached route in the socket if it is valid.
1095 * It will take the socket dst lock when operating on the dst cache.
1096 * As a result, this function can only be used in process context.
1097 *
1098 * It returns a valid dst pointer on success, or a pointer encoded
1099 * error code.
1100 */
1101 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1102 const struct in6_addr *final_dst)
1103 {
1104 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1105
1106 dst = ip6_sk_dst_check(sk, dst, fl6);
1107 if (!dst)
1108 dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
1109
1110 return dst;
1111 }
1112 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1113
1114 static inline int ip6_ufo_append_data(struct sock *sk,
1115 struct sk_buff_head *queue,
1116 int getfrag(void *from, char *to, int offset, int len,
1117 int odd, struct sk_buff *skb),
1118 void *from, int length, int hh_len, int fragheaderlen,
1119 int exthdrlen, int transhdrlen, int mtu,
1120 unsigned int flags, const struct flowi6 *fl6)
1121
1122 {
1123 struct sk_buff *skb;
1124 int err;
1125
1126 /* There is support for UDP large send offload by network
1127 * device, so create one single skb packet containing complete
1128 * udp datagram
1129 */
1130 skb = skb_peek_tail(queue);
1131 if (!skb) {
1132 skb = sock_alloc_send_skb(sk,
1133 hh_len + fragheaderlen + transhdrlen + 20,
1134 (flags & MSG_DONTWAIT), &err);
1135 if (!skb)
1136 return err;
1137
1138 /* reserve space for Hardware header */
1139 skb_reserve(skb, hh_len);
1140
1141 /* create space for UDP/IP header */
1142 skb_put(skb, fragheaderlen + transhdrlen);
1143
1144 /* initialize network header pointer */
1145 skb_set_network_header(skb, exthdrlen);
1146
1147 /* initialize protocol header pointer */
1148 skb->transport_header = skb->network_header + fragheaderlen;
1149
1150 skb->protocol = htons(ETH_P_IPV6);
1151 skb->csum = 0;
1152
1153 if (flags & MSG_CONFIRM)
1154 skb_set_dst_pending_confirm(skb, 1);
1155
1156 __skb_queue_tail(queue, skb);
1157 } else if (skb_is_gso(skb)) {
1158 goto append;
1159 }
1160
1161 skb->ip_summed = CHECKSUM_PARTIAL;
1162 /* Specify the length of each IPv6 datagram fragment.
1163 * It has to be a multiple of 8.
1164 */
1165 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1166 sizeof(struct frag_hdr)) & ~7;
1167 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1168 skb_shinfo(skb)->ip6_frag_id = ipv6_select_ident(sock_net(sk),
1169 &fl6->daddr,
1170 &fl6->saddr);
1171
1172 append:
1173 return skb_append_datato_frags(sk, skb, getfrag, from,
1174 (length - transhdrlen));
1175 }
1176
1177 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1178 gfp_t gfp)
1179 {
1180 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1181 }
1182
1183 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1184 gfp_t gfp)
1185 {
1186 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1187 }
1188
1189 static void ip6_append_data_mtu(unsigned int *mtu,
1190 int *maxfraglen,
1191 unsigned int fragheaderlen,
1192 struct sk_buff *skb,
1193 struct rt6_info *rt,
1194 unsigned int orig_mtu)
1195 {
1196 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1197 if (!skb) {
1198 /* first fragment, reserve header_len */
1199 *mtu = orig_mtu - rt->dst.header_len;
1200
1201 } else {
1202 /*
1203 * this fragment is not first, the headers
1204 * space is regarded as data space.
1205 */
1206 *mtu = orig_mtu;
1207 }
1208 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1209 + fragheaderlen - sizeof(struct frag_hdr);
1210 }
1211 }
1212
1213 static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
1214 struct inet6_cork *v6_cork, struct ipcm6_cookie *ipc6,
1215 struct rt6_info *rt, struct flowi6 *fl6)
1216 {
1217 struct ipv6_pinfo *np = inet6_sk(sk);
1218 unsigned int mtu;
1219 struct ipv6_txoptions *opt = ipc6->opt;
1220
1221 /*
1222 * setup for corking
1223 */
1224 if (opt) {
1225 if (WARN_ON(v6_cork->opt))
1226 return -EINVAL;
1227
1228 v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation);
1229 if (unlikely(!v6_cork->opt))
1230 return -ENOBUFS;
1231
1232 v6_cork->opt->tot_len = opt->tot_len;
1233 v6_cork->opt->opt_flen = opt->opt_flen;
1234 v6_cork->opt->opt_nflen = opt->opt_nflen;
1235
1236 v6_cork->opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1237 sk->sk_allocation);
1238 if (opt->dst0opt && !v6_cork->opt->dst0opt)
1239 return -ENOBUFS;
1240
1241 v6_cork->opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1242 sk->sk_allocation);
1243 if (opt->dst1opt && !v6_cork->opt->dst1opt)
1244 return -ENOBUFS;
1245
1246 v6_cork->opt->hopopt = ip6_opt_dup(opt->hopopt,
1247 sk->sk_allocation);
1248 if (opt->hopopt && !v6_cork->opt->hopopt)
1249 return -ENOBUFS;
1250
1251 v6_cork->opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1252 sk->sk_allocation);
1253 if (opt->srcrt && !v6_cork->opt->srcrt)
1254 return -ENOBUFS;
1255
1256 /* need source address above miyazawa*/
1257 }
1258 dst_hold(&rt->dst);
1259 cork->base.dst = &rt->dst;
1260 cork->fl.u.ip6 = *fl6;
1261 v6_cork->hop_limit = ipc6->hlimit;
1262 v6_cork->tclass = ipc6->tclass;
1263 if (rt->dst.flags & DST_XFRM_TUNNEL)
1264 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1265 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1266 else
1267 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1268 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1269 if (np->frag_size < mtu) {
1270 if (np->frag_size)
1271 mtu = np->frag_size;
1272 }
1273 cork->base.fragsize = mtu;
1274 if (dst_allfrag(rt->dst.path))
1275 cork->base.flags |= IPCORK_ALLFRAG;
1276 cork->base.length = 0;
1277
1278 return 0;
1279 }
1280
1281 static int __ip6_append_data(struct sock *sk,
1282 struct flowi6 *fl6,
1283 struct sk_buff_head *queue,
1284 struct inet_cork *cork,
1285 struct inet6_cork *v6_cork,
1286 struct page_frag *pfrag,
1287 int getfrag(void *from, char *to, int offset,
1288 int len, int odd, struct sk_buff *skb),
1289 void *from, int length, int transhdrlen,
1290 unsigned int flags, struct ipcm6_cookie *ipc6,
1291 const struct sockcm_cookie *sockc)
1292 {
1293 struct sk_buff *skb, *skb_prev = NULL;
1294 unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1295 int exthdrlen = 0;
1296 int dst_exthdrlen = 0;
1297 int hh_len;
1298 int copy;
1299 int err;
1300 int offset = 0;
1301 __u8 tx_flags = 0;
1302 u32 tskey = 0;
1303 struct rt6_info *rt = (struct rt6_info *)cork->dst;
1304 struct ipv6_txoptions *opt = v6_cork->opt;
1305 int csummode = CHECKSUM_NONE;
1306 unsigned int maxnonfragsize, headersize;
1307
1308 skb = skb_peek_tail(queue);
1309 if (!skb) {
1310 exthdrlen = opt ? opt->opt_flen : 0;
1311 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1312 }
1313
1314 mtu = cork->fragsize;
1315 orig_mtu = mtu;
1316
1317 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1318
1319 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1320 (opt ? opt->opt_nflen : 0);
1321 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1322 sizeof(struct frag_hdr);
1323
1324 headersize = sizeof(struct ipv6hdr) +
1325 (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1326 (dst_allfrag(&rt->dst) ?
1327 sizeof(struct frag_hdr) : 0) +
1328 rt->rt6i_nfheader_len;
1329
1330 if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
1331 (sk->sk_protocol == IPPROTO_UDP ||
1332 sk->sk_protocol == IPPROTO_RAW)) {
1333 ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1334 sizeof(struct ipv6hdr));
1335 goto emsgsize;
1336 }
1337
1338 if (ip6_sk_ignore_df(sk))
1339 maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1340 else
1341 maxnonfragsize = mtu;
1342
1343 if (cork->length + length > maxnonfragsize - headersize) {
1344 emsgsize:
1345 ipv6_local_error(sk, EMSGSIZE, fl6,
1346 mtu - headersize +
1347 sizeof(struct ipv6hdr));
1348 return -EMSGSIZE;
1349 }
1350
1351 /* CHECKSUM_PARTIAL only with no extension headers and when
1352 * we are not going to fragment
1353 */
1354 if (transhdrlen && sk->sk_protocol == IPPROTO_UDP &&
1355 headersize == sizeof(struct ipv6hdr) &&
1356 length <= mtu - headersize &&
1357 !(flags & MSG_MORE) &&
1358 rt->dst.dev->features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM))
1359 csummode = CHECKSUM_PARTIAL;
1360
1361 if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_RAW) {
1362 sock_tx_timestamp(sk, sockc->tsflags, &tx_flags);
1363 if (tx_flags & SKBTX_ANY_SW_TSTAMP &&
1364 sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)
1365 tskey = sk->sk_tskey++;
1366 }
1367
1368 /*
1369 * Let's try using as much space as possible.
1370 * Use MTU if total length of the message fits into the MTU.
1371 * Otherwise, we need to reserve fragment header and
1372 * fragment alignment (= 8-15 octects, in total).
1373 *
1374 * Note that we may need to "move" the data from the tail of
1375 * of the buffer to the new fragment when we split
1376 * the message.
1377 *
1378 * FIXME: It may be fragmented into multiple chunks
1379 * at once if non-fragmentable extension headers
1380 * are too large.
1381 * --yoshfuji
1382 */
1383
1384 cork->length += length;
1385 if ((((length + fragheaderlen) > mtu) ||
1386 (skb && skb_is_gso(skb))) &&
1387 (sk->sk_protocol == IPPROTO_UDP) &&
1388 (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
1389 (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
1390 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
1391 hh_len, fragheaderlen, exthdrlen,
1392 transhdrlen, mtu, flags, fl6);
1393 if (err)
1394 goto error;
1395 return 0;
1396 }
1397
1398 if (!skb)
1399 goto alloc_new_skb;
1400
1401 while (length > 0) {
1402 /* Check if the remaining data fits into current packet. */
1403 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1404 if (copy < length)
1405 copy = maxfraglen - skb->len;
1406
1407 if (copy <= 0) {
1408 char *data;
1409 unsigned int datalen;
1410 unsigned int fraglen;
1411 unsigned int fraggap;
1412 unsigned int alloclen;
1413 alloc_new_skb:
1414 /* There's no room in the current skb */
1415 if (skb)
1416 fraggap = skb->len - maxfraglen;
1417 else
1418 fraggap = 0;
1419 /* update mtu and maxfraglen if necessary */
1420 if (!skb || !skb_prev)
1421 ip6_append_data_mtu(&mtu, &maxfraglen,
1422 fragheaderlen, skb, rt,
1423 orig_mtu);
1424
1425 skb_prev = skb;
1426
1427 /*
1428 * If remaining data exceeds the mtu,
1429 * we know we need more fragment(s).
1430 */
1431 datalen = length + fraggap;
1432
1433 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1434 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1435 if ((flags & MSG_MORE) &&
1436 !(rt->dst.dev->features&NETIF_F_SG))
1437 alloclen = mtu;
1438 else
1439 alloclen = datalen + fragheaderlen;
1440
1441 alloclen += dst_exthdrlen;
1442
1443 if (datalen != length + fraggap) {
1444 /*
1445 * this is not the last fragment, the trailer
1446 * space is regarded as data space.
1447 */
1448 datalen += rt->dst.trailer_len;
1449 }
1450
1451 alloclen += rt->dst.trailer_len;
1452 fraglen = datalen + fragheaderlen;
1453
1454 /*
1455 * We just reserve space for fragment header.
1456 * Note: this may be overallocation if the message
1457 * (without MSG_MORE) fits into the MTU.
1458 */
1459 alloclen += sizeof(struct frag_hdr);
1460
1461 if (transhdrlen) {
1462 skb = sock_alloc_send_skb(sk,
1463 alloclen + hh_len,
1464 (flags & MSG_DONTWAIT), &err);
1465 } else {
1466 skb = NULL;
1467 if (atomic_read(&sk->sk_wmem_alloc) <=
1468 2 * sk->sk_sndbuf)
1469 skb = sock_wmalloc(sk,
1470 alloclen + hh_len, 1,
1471 sk->sk_allocation);
1472 if (unlikely(!skb))
1473 err = -ENOBUFS;
1474 }
1475 if (!skb)
1476 goto error;
1477 /*
1478 * Fill in the control structures
1479 */
1480 skb->protocol = htons(ETH_P_IPV6);
1481 skb->ip_summed = csummode;
1482 skb->csum = 0;
1483 /* reserve for fragmentation and ipsec header */
1484 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1485 dst_exthdrlen);
1486
1487 /* Only the initial fragment is time stamped */
1488 skb_shinfo(skb)->tx_flags = tx_flags;
1489 tx_flags = 0;
1490 skb_shinfo(skb)->tskey = tskey;
1491 tskey = 0;
1492
1493 /*
1494 * Find where to start putting bytes
1495 */
1496 data = skb_put(skb, fraglen);
1497 skb_set_network_header(skb, exthdrlen);
1498 data += fragheaderlen;
1499 skb->transport_header = (skb->network_header +
1500 fragheaderlen);
1501 if (fraggap) {
1502 skb->csum = skb_copy_and_csum_bits(
1503 skb_prev, maxfraglen,
1504 data + transhdrlen, fraggap, 0);
1505 skb_prev->csum = csum_sub(skb_prev->csum,
1506 skb->csum);
1507 data += fraggap;
1508 pskb_trim_unique(skb_prev, maxfraglen);
1509 }
1510 copy = datalen - transhdrlen - fraggap;
1511
1512 if (copy < 0) {
1513 err = -EINVAL;
1514 kfree_skb(skb);
1515 goto error;
1516 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1517 err = -EFAULT;
1518 kfree_skb(skb);
1519 goto error;
1520 }
1521
1522 offset += copy;
1523 length -= datalen - fraggap;
1524 transhdrlen = 0;
1525 exthdrlen = 0;
1526 dst_exthdrlen = 0;
1527
1528 if ((flags & MSG_CONFIRM) && !skb_prev)
1529 skb_set_dst_pending_confirm(skb, 1);
1530
1531 /*
1532 * Put the packet on the pending queue
1533 */
1534 __skb_queue_tail(queue, skb);
1535 continue;
1536 }
1537
1538 if (copy > length)
1539 copy = length;
1540
1541 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1542 unsigned int off;
1543
1544 off = skb->len;
1545 if (getfrag(from, skb_put(skb, copy),
1546 offset, copy, off, skb) < 0) {
1547 __skb_trim(skb, off);
1548 err = -EFAULT;
1549 goto error;
1550 }
1551 } else {
1552 int i = skb_shinfo(skb)->nr_frags;
1553
1554 err = -ENOMEM;
1555 if (!sk_page_frag_refill(sk, pfrag))
1556 goto error;
1557
1558 if (!skb_can_coalesce(skb, i, pfrag->page,
1559 pfrag->offset)) {
1560 err = -EMSGSIZE;
1561 if (i == MAX_SKB_FRAGS)
1562 goto error;
1563
1564 __skb_fill_page_desc(skb, i, pfrag->page,
1565 pfrag->offset, 0);
1566 skb_shinfo(skb)->nr_frags = ++i;
1567 get_page(pfrag->page);
1568 }
1569 copy = min_t(int, copy, pfrag->size - pfrag->offset);
1570 if (getfrag(from,
1571 page_address(pfrag->page) + pfrag->offset,
1572 offset, copy, skb->len, skb) < 0)
1573 goto error_efault;
1574
1575 pfrag->offset += copy;
1576 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1577 skb->len += copy;
1578 skb->data_len += copy;
1579 skb->truesize += copy;
1580 atomic_add(copy, &sk->sk_wmem_alloc);
1581 }
1582 offset += copy;
1583 length -= copy;
1584 }
1585
1586 return 0;
1587
1588 error_efault:
1589 err = -EFAULT;
1590 error:
1591 cork->length -= length;
1592 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1593 return err;
1594 }
1595
1596 int ip6_append_data(struct sock *sk,
1597 int getfrag(void *from, char *to, int offset, int len,
1598 int odd, struct sk_buff *skb),
1599 void *from, int length, int transhdrlen,
1600 struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
1601 struct rt6_info *rt, unsigned int flags,
1602 const struct sockcm_cookie *sockc)
1603 {
1604 struct inet_sock *inet = inet_sk(sk);
1605 struct ipv6_pinfo *np = inet6_sk(sk);
1606 int exthdrlen;
1607 int err;
1608
1609 if (flags&MSG_PROBE)
1610 return 0;
1611 if (skb_queue_empty(&sk->sk_write_queue)) {
1612 /*
1613 * setup for corking
1614 */
1615 err = ip6_setup_cork(sk, &inet->cork, &np->cork,
1616 ipc6, rt, fl6);
1617 if (err)
1618 return err;
1619
1620 exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
1621 length += exthdrlen;
1622 transhdrlen += exthdrlen;
1623 } else {
1624 fl6 = &inet->cork.fl.u.ip6;
1625 transhdrlen = 0;
1626 }
1627
1628 return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
1629 &np->cork, sk_page_frag(sk), getfrag,
1630 from, length, transhdrlen, flags, ipc6, sockc);
1631 }
1632 EXPORT_SYMBOL_GPL(ip6_append_data);
1633
1634 static void ip6_cork_release(struct inet_cork_full *cork,
1635 struct inet6_cork *v6_cork)
1636 {
1637 if (v6_cork->opt) {
1638 kfree(v6_cork->opt->dst0opt);
1639 kfree(v6_cork->opt->dst1opt);
1640 kfree(v6_cork->opt->hopopt);
1641 kfree(v6_cork->opt->srcrt);
1642 kfree(v6_cork->opt);
1643 v6_cork->opt = NULL;
1644 }
1645
1646 if (cork->base.dst) {
1647 dst_release(cork->base.dst);
1648 cork->base.dst = NULL;
1649 cork->base.flags &= ~IPCORK_ALLFRAG;
1650 }
1651 memset(&cork->fl, 0, sizeof(cork->fl));
1652 }
1653
1654 struct sk_buff *__ip6_make_skb(struct sock *sk,
1655 struct sk_buff_head *queue,
1656 struct inet_cork_full *cork,
1657 struct inet6_cork *v6_cork)
1658 {
1659 struct sk_buff *skb, *tmp_skb;
1660 struct sk_buff **tail_skb;
1661 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1662 struct ipv6_pinfo *np = inet6_sk(sk);
1663 struct net *net = sock_net(sk);
1664 struct ipv6hdr *hdr;
1665 struct ipv6_txoptions *opt = v6_cork->opt;
1666 struct rt6_info *rt = (struct rt6_info *)cork->base.dst;
1667 struct flowi6 *fl6 = &cork->fl.u.ip6;
1668 unsigned char proto = fl6->flowi6_proto;
1669
1670 skb = __skb_dequeue(queue);
1671 if (!skb)
1672 goto out;
1673 tail_skb = &(skb_shinfo(skb)->frag_list);
1674
1675 /* move skb->data to ip header from ext header */
1676 if (skb->data < skb_network_header(skb))
1677 __skb_pull(skb, skb_network_offset(skb));
1678 while ((tmp_skb = __skb_dequeue(queue)) != NULL) {
1679 __skb_pull(tmp_skb, skb_network_header_len(skb));
1680 *tail_skb = tmp_skb;
1681 tail_skb = &(tmp_skb->next);
1682 skb->len += tmp_skb->len;
1683 skb->data_len += tmp_skb->len;
1684 skb->truesize += tmp_skb->truesize;
1685 tmp_skb->destructor = NULL;
1686 tmp_skb->sk = NULL;
1687 }
1688
1689 /* Allow local fragmentation. */
1690 skb->ignore_df = ip6_sk_ignore_df(sk);
1691
1692 *final_dst = fl6->daddr;
1693 __skb_pull(skb, skb_network_header_len(skb));
1694 if (opt && opt->opt_flen)
1695 ipv6_push_frag_opts(skb, opt, &proto);
1696 if (opt && opt->opt_nflen)
1697 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst, &fl6->saddr);
1698
1699 skb_push(skb, sizeof(struct ipv6hdr));
1700 skb_reset_network_header(skb);
1701 hdr = ipv6_hdr(skb);
1702
1703 ip6_flow_hdr(hdr, v6_cork->tclass,
1704 ip6_make_flowlabel(net, skb, fl6->flowlabel,
1705 np->autoflowlabel, fl6));
1706 hdr->hop_limit = v6_cork->hop_limit;
1707 hdr->nexthdr = proto;
1708 hdr->saddr = fl6->saddr;
1709 hdr->daddr = *final_dst;
1710
1711 skb->priority = sk->sk_priority;
1712 skb->mark = sk->sk_mark;
1713
1714 skb_dst_set(skb, dst_clone(&rt->dst));
1715 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1716 if (proto == IPPROTO_ICMPV6) {
1717 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1718
1719 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
1720 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1721 }
1722
1723 ip6_cork_release(cork, v6_cork);
1724 out:
1725 return skb;
1726 }
1727
1728 int ip6_send_skb(struct sk_buff *skb)
1729 {
1730 struct net *net = sock_net(skb->sk);
1731 struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
1732 int err;
1733
1734 err = ip6_local_out(net, skb->sk, skb);
1735 if (err) {
1736 if (err > 0)
1737 err = net_xmit_errno(err);
1738 if (err)
1739 IP6_INC_STATS(net, rt->rt6i_idev,
1740 IPSTATS_MIB_OUTDISCARDS);
1741 }
1742
1743 return err;
1744 }
1745
1746 int ip6_push_pending_frames(struct sock *sk)
1747 {
1748 struct sk_buff *skb;
1749
1750 skb = ip6_finish_skb(sk);
1751 if (!skb)
1752 return 0;
1753
1754 return ip6_send_skb(skb);
1755 }
1756 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1757
1758 static void __ip6_flush_pending_frames(struct sock *sk,
1759 struct sk_buff_head *queue,
1760 struct inet_cork_full *cork,
1761 struct inet6_cork *v6_cork)
1762 {
1763 struct sk_buff *skb;
1764
1765 while ((skb = __skb_dequeue_tail(queue)) != NULL) {
1766 if (skb_dst(skb))
1767 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1768 IPSTATS_MIB_OUTDISCARDS);
1769 kfree_skb(skb);
1770 }
1771
1772 ip6_cork_release(cork, v6_cork);
1773 }
1774
1775 void ip6_flush_pending_frames(struct sock *sk)
1776 {
1777 __ip6_flush_pending_frames(sk, &sk->sk_write_queue,
1778 &inet_sk(sk)->cork, &inet6_sk(sk)->cork);
1779 }
1780 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
1781
1782 struct sk_buff *ip6_make_skb(struct sock *sk,
1783 int getfrag(void *from, char *to, int offset,
1784 int len, int odd, struct sk_buff *skb),
1785 void *from, int length, int transhdrlen,
1786 struct ipcm6_cookie *ipc6, struct flowi6 *fl6,
1787 struct rt6_info *rt, unsigned int flags,
1788 const struct sockcm_cookie *sockc)
1789 {
1790 struct inet_cork_full cork;
1791 struct inet6_cork v6_cork;
1792 struct sk_buff_head queue;
1793 int exthdrlen = (ipc6->opt ? ipc6->opt->opt_flen : 0);
1794 int err;
1795
1796 if (flags & MSG_PROBE)
1797 return NULL;
1798
1799 __skb_queue_head_init(&queue);
1800
1801 cork.base.flags = 0;
1802 cork.base.addr = 0;
1803 cork.base.opt = NULL;
1804 v6_cork.opt = NULL;
1805 err = ip6_setup_cork(sk, &cork, &v6_cork, ipc6, rt, fl6);
1806 if (err)
1807 return ERR_PTR(err);
1808
1809 if (ipc6->dontfrag < 0)
1810 ipc6->dontfrag = inet6_sk(sk)->dontfrag;
1811
1812 err = __ip6_append_data(sk, fl6, &queue, &cork.base, &v6_cork,
1813 &current->task_frag, getfrag, from,
1814 length + exthdrlen, transhdrlen + exthdrlen,
1815 flags, ipc6, sockc);
1816 if (err) {
1817 __ip6_flush_pending_frames(sk, &queue, &cork, &v6_cork);
1818 return ERR_PTR(err);
1819 }
1820
1821 return __ip6_make_skb(sk, &queue, &cork, &v6_cork);
1822 }
Linux with added FPC-III support