~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/ip6_output.c

Version: ~ [ linux-5.12-rc1 ] ~ [ linux-5.11.2 ] ~ [ linux-5.10.19 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.101 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.177 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.222 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.258 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.258 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *      IPv6 output functions
  3  *      Linux INET6 implementation
  4  *
  5  *      Authors:
  6  *      Pedro Roque             <roque@di.fc.ul.pt>
  7  *
  8  *      Based on linux/net/ipv4/ip_output.c
  9  *
 10  *      This program is free software; you can redistribute it and/or
 11  *      modify it under the terms of the GNU General Public License
 12  *      as published by the Free Software Foundation; either version
 13  *      2 of the License, or (at your option) any later version.
 14  *
 15  *      Changes:
 16  *      A.N.Kuznetsov   :       airthmetics in fragmentation.
 17  *                              extension headers are implemented.
 18  *                              route changes now work.
 19  *                              ip6_forward does not confuse sniffers.
 20  *                              etc.
 21  *
 22  *      H. von Brand    :       Added missing #include <linux/string.h>
 23  *      Imran Patel     :       frag id should be in NBO
 24  *      Kazunori MIYAZAWA @USAGI
 25  *                      :       add ip6_append_data and related functions
 26  *                              for datagram xmit
 27  */
 28 
 29 #include <linux/errno.h>
 30 #include <linux/kernel.h>
 31 #include <linux/string.h>
 32 #include <linux/socket.h>
 33 #include <linux/net.h>
 34 #include <linux/netdevice.h>
 35 #include <linux/if_arp.h>
 36 #include <linux/in6.h>
 37 #include <linux/tcp.h>
 38 #include <linux/route.h>
 39 #include <linux/module.h>
 40 #include <linux/slab.h>
 41 
 42 #include <linux/netfilter.h>
 43 #include <linux/netfilter_ipv6.h>
 44 
 45 #include <net/sock.h>
 46 #include <net/snmp.h>
 47 
 48 #include <net/ipv6.h>
 49 #include <net/ndisc.h>
 50 #include <net/protocol.h>
 51 #include <net/ip6_route.h>
 52 #include <net/addrconf.h>
 53 #include <net/rawv6.h>
 54 #include <net/icmp.h>
 55 #include <net/xfrm.h>
 56 #include <net/checksum.h>
 57 #include <linux/mroute6.h>
 58 
 59 static int ip6_finish_output2(struct sk_buff *skb)
 60 {
 61         struct dst_entry *dst = skb_dst(skb);
 62         struct net_device *dev = dst->dev;
 63         struct neighbour *neigh;
 64         struct in6_addr *nexthop;
 65         int ret;
 66 
 67         skb->protocol = htons(ETH_P_IPV6);
 68         skb->dev = dev;
 69 
 70         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
 71                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 72 
 73                 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
 74                     ((mroute6_socket(dev_net(dev), skb) &&
 75                      !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
 76                      ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
 77                                          &ipv6_hdr(skb)->saddr))) {
 78                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
 79 
 80                         /* Do not check for IFF_ALLMULTI; multicast routing
 81                            is not supported in any case.
 82                          */
 83                         if (newskb)
 84                                 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
 85                                         newskb, NULL, newskb->dev,
 86                                         dev_loopback_xmit);
 87 
 88                         if (ipv6_hdr(skb)->hop_limit == 0) {
 89                                 IP6_INC_STATS(dev_net(dev), idev,
 90                                               IPSTATS_MIB_OUTDISCARDS);
 91                                 kfree_skb(skb);
 92                                 return 0;
 93                         }
 94                 }
 95 
 96                 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
 97                                 skb->len);
 98 
 99                 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
100                     IPV6_ADDR_SCOPE_NODELOCAL &&
101                     !(dev->flags & IFF_LOOPBACK)) {
102                         kfree_skb(skb);
103                         return 0;
104                 }
105         }
106 
107         rcu_read_lock_bh();
108         nexthop = rt6_nexthop((struct rt6_info *)dst);
109         neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
110         if (unlikely(!neigh))
111                 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
112         if (!IS_ERR(neigh)) {
113                 ret = dst_neigh_output(dst, neigh, skb);
114                 rcu_read_unlock_bh();
115                 return ret;
116         }
117         rcu_read_unlock_bh();
118 
119         IP6_INC_STATS(dev_net(dst->dev),
120                       ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
121         kfree_skb(skb);
122         return -EINVAL;
123 }
124 
125 static int ip6_finish_output(struct sk_buff *skb)
126 {
127         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
128             dst_allfrag(skb_dst(skb)) ||
129             (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
130                 return ip6_fragment(skb, ip6_finish_output2);
131         else
132                 return ip6_finish_output2(skb);
133 }
134 
135 int ip6_output(struct sk_buff *skb)
136 {
137         struct net_device *dev = skb_dst(skb)->dev;
138         struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
139         if (unlikely(idev->cnf.disable_ipv6)) {
140                 IP6_INC_STATS(dev_net(dev), idev,
141                               IPSTATS_MIB_OUTDISCARDS);
142                 kfree_skb(skb);
143                 return 0;
144         }
145 
146         return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
147                             ip6_finish_output,
148                             !(IP6CB(skb)->flags & IP6SKB_REROUTED));
149 }
150 
151 /*
152  *      xmit an sk_buff (used by TCP, SCTP and DCCP)
153  */
154 
155 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
156              struct ipv6_txoptions *opt, int tclass)
157 {
158         struct net *net = sock_net(sk);
159         struct ipv6_pinfo *np = inet6_sk(sk);
160         struct in6_addr *first_hop = &fl6->daddr;
161         struct dst_entry *dst = skb_dst(skb);
162         struct ipv6hdr *hdr;
163         u8  proto = fl6->flowi6_proto;
164         int seg_len = skb->len;
165         int hlimit = -1;
166         u32 mtu;
167 
168         if (opt) {
169                 unsigned int head_room;
170 
171                 /* First: exthdrs may take lots of space (~8K for now)
172                    MAX_HEADER is not enough.
173                  */
174                 head_room = opt->opt_nflen + opt->opt_flen;
175                 seg_len += head_room;
176                 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
177 
178                 if (skb_headroom(skb) < head_room) {
179                         struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
180                         if (skb2 == NULL) {
181                                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
182                                               IPSTATS_MIB_OUTDISCARDS);
183                                 kfree_skb(skb);
184                                 return -ENOBUFS;
185                         }
186                         consume_skb(skb);
187                         skb = skb2;
188                         skb_set_owner_w(skb, sk);
189                 }
190                 if (opt->opt_flen)
191                         ipv6_push_frag_opts(skb, opt, &proto);
192                 if (opt->opt_nflen)
193                         ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
194         }
195 
196         skb_push(skb, sizeof(struct ipv6hdr));
197         skb_reset_network_header(skb);
198         hdr = ipv6_hdr(skb);
199 
200         /*
201          *      Fill in the IPv6 header
202          */
203         if (np)
204                 hlimit = np->hop_limit;
205         if (hlimit < 0)
206                 hlimit = ip6_dst_hoplimit(dst);
207 
208         ip6_flow_hdr(hdr, tclass, fl6->flowlabel);
209 
210         hdr->payload_len = htons(seg_len);
211         hdr->nexthdr = proto;
212         hdr->hop_limit = hlimit;
213 
214         hdr->saddr = fl6->saddr;
215         hdr->daddr = *first_hop;
216 
217         skb->protocol = htons(ETH_P_IPV6);
218         skb->priority = sk->sk_priority;
219         skb->mark = sk->sk_mark;
220 
221         mtu = dst_mtu(dst);
222         if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
223                 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
224                               IPSTATS_MIB_OUT, skb->len);
225                 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
226                                dst->dev, dst_output);
227         }
228 
229         skb->dev = dst->dev;
230         ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
231         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
232         kfree_skb(skb);
233         return -EMSGSIZE;
234 }
235 
236 EXPORT_SYMBOL(ip6_xmit);
237 
238 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
239 {
240         struct ip6_ra_chain *ra;
241         struct sock *last = NULL;
242 
243         read_lock(&ip6_ra_lock);
244         for (ra = ip6_ra_chain; ra; ra = ra->next) {
245                 struct sock *sk = ra->sk;
246                 if (sk && ra->sel == sel &&
247                     (!sk->sk_bound_dev_if ||
248                      sk->sk_bound_dev_if == skb->dev->ifindex)) {
249                         if (last) {
250                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
251                                 if (skb2)
252                                         rawv6_rcv(last, skb2);
253                         }
254                         last = sk;
255                 }
256         }
257 
258         if (last) {
259                 rawv6_rcv(last, skb);
260                 read_unlock(&ip6_ra_lock);
261                 return 1;
262         }
263         read_unlock(&ip6_ra_lock);
264         return 0;
265 }
266 
267 static int ip6_forward_proxy_check(struct sk_buff *skb)
268 {
269         struct ipv6hdr *hdr = ipv6_hdr(skb);
270         u8 nexthdr = hdr->nexthdr;
271         __be16 frag_off;
272         int offset;
273 
274         if (ipv6_ext_hdr(nexthdr)) {
275                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
276                 if (offset < 0)
277                         return 0;
278         } else
279                 offset = sizeof(struct ipv6hdr);
280 
281         if (nexthdr == IPPROTO_ICMPV6) {
282                 struct icmp6hdr *icmp6;
283 
284                 if (!pskb_may_pull(skb, (skb_network_header(skb) +
285                                          offset + 1 - skb->data)))
286                         return 0;
287 
288                 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
289 
290                 switch (icmp6->icmp6_type) {
291                 case NDISC_ROUTER_SOLICITATION:
292                 case NDISC_ROUTER_ADVERTISEMENT:
293                 case NDISC_NEIGHBOUR_SOLICITATION:
294                 case NDISC_NEIGHBOUR_ADVERTISEMENT:
295                 case NDISC_REDIRECT:
296                         /* For reaction involving unicast neighbor discovery
297                          * message destined to the proxied address, pass it to
298                          * input function.
299                          */
300                         return 1;
301                 default:
302                         break;
303                 }
304         }
305 
306         /*
307          * The proxying router can't forward traffic sent to a link-local
308          * address, so signal the sender and discard the packet. This
309          * behavior is clarified by the MIPv6 specification.
310          */
311         if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
312                 dst_link_failure(skb);
313                 return -1;
314         }
315 
316         return 0;
317 }
318 
319 static inline int ip6_forward_finish(struct sk_buff *skb)
320 {
321         return dst_output(skb);
322 }
323 
324 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
325 {
326         unsigned int mtu;
327         struct inet6_dev *idev;
328 
329         if (dst_metric_locked(dst, RTAX_MTU)) {
330                 mtu = dst_metric_raw(dst, RTAX_MTU);
331                 if (mtu)
332                         return mtu;
333         }
334 
335         mtu = IPV6_MIN_MTU;
336         rcu_read_lock();
337         idev = __in6_dev_get(dst->dev);
338         if (idev)
339                 mtu = idev->cnf.mtu6;
340         rcu_read_unlock();
341 
342         return mtu;
343 }
344 
345 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
346 {
347         if (skb->len <= mtu)
348                 return false;
349 
350         /* ipv6 conntrack defrag sets max_frag_size + local_df */
351         if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
352                 return true;
353 
354         if (skb->local_df)
355                 return false;
356 
357         if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
358                 return false;
359 
360         return true;
361 }
362 
363 int ip6_forward(struct sk_buff *skb)
364 {
365         struct dst_entry *dst = skb_dst(skb);
366         struct ipv6hdr *hdr = ipv6_hdr(skb);
367         struct inet6_skb_parm *opt = IP6CB(skb);
368         struct net *net = dev_net(dst->dev);
369         u32 mtu;
370 
371         if (net->ipv6.devconf_all->forwarding == 0)
372                 goto error;
373 
374         if (skb_warn_if_lro(skb))
375                 goto drop;
376 
377         if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
378                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
379                                  IPSTATS_MIB_INDISCARDS);
380                 goto drop;
381         }
382 
383         if (skb->pkt_type != PACKET_HOST)
384                 goto drop;
385 
386         skb_forward_csum(skb);
387 
388         /*
389          *      We DO NOT make any processing on
390          *      RA packets, pushing them to user level AS IS
391          *      without ane WARRANTY that application will be able
392          *      to interpret them. The reason is that we
393          *      cannot make anything clever here.
394          *
395          *      We are not end-node, so that if packet contains
396          *      AH/ESP, we cannot make anything.
397          *      Defragmentation also would be mistake, RA packets
398          *      cannot be fragmented, because there is no warranty
399          *      that different fragments will go along one path. --ANK
400          */
401         if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
402                 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
403                         return 0;
404         }
405 
406         /*
407          *      check and decrement ttl
408          */
409         if (hdr->hop_limit <= 1) {
410                 /* Force OUTPUT device used as source address */
411                 skb->dev = dst->dev;
412                 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
413                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
414                                  IPSTATS_MIB_INHDRERRORS);
415 
416                 kfree_skb(skb);
417                 return -ETIMEDOUT;
418         }
419 
420         /* XXX: idev->cnf.proxy_ndp? */
421         if (net->ipv6.devconf_all->proxy_ndp &&
422             pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
423                 int proxied = ip6_forward_proxy_check(skb);
424                 if (proxied > 0)
425                         return ip6_input(skb);
426                 else if (proxied < 0) {
427                         IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
428                                          IPSTATS_MIB_INDISCARDS);
429                         goto drop;
430                 }
431         }
432 
433         if (!xfrm6_route_forward(skb)) {
434                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
435                                  IPSTATS_MIB_INDISCARDS);
436                 goto drop;
437         }
438         dst = skb_dst(skb);
439 
440         /* IPv6 specs say nothing about it, but it is clear that we cannot
441            send redirects to source routed frames.
442            We don't send redirects to frames decapsulated from IPsec.
443          */
444         if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
445                 struct in6_addr *target = NULL;
446                 struct inet_peer *peer;
447                 struct rt6_info *rt;
448 
449                 /*
450                  *      incoming and outgoing devices are the same
451                  *      send a redirect.
452                  */
453 
454                 rt = (struct rt6_info *) dst;
455                 if (rt->rt6i_flags & RTF_GATEWAY)
456                         target = &rt->rt6i_gateway;
457                 else
458                         target = &hdr->daddr;
459 
460                 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
461 
462                 /* Limit redirects both by destination (here)
463                    and by source (inside ndisc_send_redirect)
464                  */
465                 if (inet_peer_xrlim_allow(peer, 1*HZ))
466                         ndisc_send_redirect(skb, target);
467                 if (peer)
468                         inet_putpeer(peer);
469         } else {
470                 int addrtype = ipv6_addr_type(&hdr->saddr);
471 
472                 /* This check is security critical. */
473                 if (addrtype == IPV6_ADDR_ANY ||
474                     addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
475                         goto error;
476                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
477                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
478                                     ICMPV6_NOT_NEIGHBOUR, 0);
479                         goto error;
480                 }
481         }
482 
483         mtu = ip6_dst_mtu_forward(dst);
484         if (mtu < IPV6_MIN_MTU)
485                 mtu = IPV6_MIN_MTU;
486 
487         if (ip6_pkt_too_big(skb, mtu)) {
488                 /* Again, force OUTPUT device used as source address */
489                 skb->dev = dst->dev;
490                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
491                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
492                                  IPSTATS_MIB_INTOOBIGERRORS);
493                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
494                                  IPSTATS_MIB_FRAGFAILS);
495                 kfree_skb(skb);
496                 return -EMSGSIZE;
497         }
498 
499         if (skb_cow(skb, dst->dev->hard_header_len)) {
500                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
501                                  IPSTATS_MIB_OUTDISCARDS);
502                 goto drop;
503         }
504 
505         hdr = ipv6_hdr(skb);
506 
507         /* Mangling hops number delayed to point after skb COW */
508 
509         hdr->hop_limit--;
510 
511         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
512         IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
513         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
514                        ip6_forward_finish);
515 
516 error:
517         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
518 drop:
519         kfree_skb(skb);
520         return -EINVAL;
521 }
522 
523 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
524 {
525         to->pkt_type = from->pkt_type;
526         to->priority = from->priority;
527         to->protocol = from->protocol;
528         skb_dst_drop(to);
529         skb_dst_set(to, dst_clone(skb_dst(from)));
530         to->dev = from->dev;
531         to->mark = from->mark;
532 
533 #ifdef CONFIG_NET_SCHED
534         to->tc_index = from->tc_index;
535 #endif
536         nf_copy(to, from);
537         skb_copy_secmark(to, from);
538 }
539 
540 static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
541 {
542         static u32 ip6_idents_hashrnd __read_mostly;
543         u32 hash, id;
544 
545         net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
546 
547         hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
548         hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
549 
550         id = ip_idents_reserve(hash, 1);
551         fhdr->identification = htonl(id);
552 }
553 
554 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
555 {
556         struct sk_buff *frag;
557         struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
558         struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
559                                 inet6_sk(skb->sk) : NULL;
560         struct ipv6hdr *tmp_hdr;
561         struct frag_hdr *fh;
562         unsigned int mtu, hlen, left, len;
563         int hroom, troom;
564         __be32 frag_id = 0;
565         int ptr, offset = 0, err=0;
566         u8 *prevhdr, nexthdr = 0;
567         struct net *net = dev_net(skb_dst(skb)->dev);
568 
569         hlen = ip6_find_1stfragopt(skb, &prevhdr);
570         nexthdr = *prevhdr;
571 
572         mtu = ip6_skb_dst_mtu(skb);
573 
574         /* We must not fragment if the socket is set to force MTU discovery
575          * or if the skb it not generated by a local socket.
576          */
577         if (unlikely(!skb->local_df && skb->len > mtu) ||
578                      (IP6CB(skb)->frag_max_size &&
579                       IP6CB(skb)->frag_max_size > mtu)) {
580                 if (skb->sk && dst_allfrag(skb_dst(skb)))
581                         sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
582 
583                 skb->dev = skb_dst(skb)->dev;
584                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
585                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
586                               IPSTATS_MIB_FRAGFAILS);
587                 kfree_skb(skb);
588                 return -EMSGSIZE;
589         }
590 
591         if (np && np->frag_size < mtu) {
592                 if (np->frag_size)
593                         mtu = np->frag_size;
594         }
595         mtu -= hlen + sizeof(struct frag_hdr);
596 
597         if (skb_has_frag_list(skb)) {
598                 int first_len = skb_pagelen(skb);
599                 struct sk_buff *frag2;
600 
601                 if (first_len - hlen > mtu ||
602                     ((first_len - hlen) & 7) ||
603                     skb_cloned(skb))
604                         goto slow_path;
605 
606                 skb_walk_frags(skb, frag) {
607                         /* Correct geometry. */
608                         if (frag->len > mtu ||
609                             ((frag->len & 7) && frag->next) ||
610                             skb_headroom(frag) < hlen)
611                                 goto slow_path_clean;
612 
613                         /* Partially cloned skb? */
614                         if (skb_shared(frag))
615                                 goto slow_path_clean;
616 
617                         BUG_ON(frag->sk);
618                         if (skb->sk) {
619                                 frag->sk = skb->sk;
620                                 frag->destructor = sock_wfree;
621                         }
622                         skb->truesize -= frag->truesize;
623                 }
624 
625                 err = 0;
626                 offset = 0;
627                 frag = skb_shinfo(skb)->frag_list;
628                 skb_frag_list_init(skb);
629                 /* BUILD HEADER */
630 
631                 *prevhdr = NEXTHDR_FRAGMENT;
632                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
633                 if (!tmp_hdr) {
634                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
635                                       IPSTATS_MIB_FRAGFAILS);
636                         return -ENOMEM;
637                 }
638 
639                 __skb_pull(skb, hlen);
640                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
641                 __skb_push(skb, hlen);
642                 skb_reset_network_header(skb);
643                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
644 
645                 ipv6_select_ident(fh, rt);
646                 fh->nexthdr = nexthdr;
647                 fh->reserved = 0;
648                 fh->frag_off = htons(IP6_MF);
649                 frag_id = fh->identification;
650 
651                 first_len = skb_pagelen(skb);
652                 skb->data_len = first_len - skb_headlen(skb);
653                 skb->len = first_len;
654                 ipv6_hdr(skb)->payload_len = htons(first_len -
655                                                    sizeof(struct ipv6hdr));
656 
657                 dst_hold(&rt->dst);
658 
659                 for (;;) {
660                         /* Prepare header of the next frame,
661                          * before previous one went down. */
662                         if (frag) {
663                                 frag->ip_summed = CHECKSUM_NONE;
664                                 skb_reset_transport_header(frag);
665                                 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
666                                 __skb_push(frag, hlen);
667                                 skb_reset_network_header(frag);
668                                 memcpy(skb_network_header(frag), tmp_hdr,
669                                        hlen);
670                                 offset += skb->len - hlen - sizeof(struct frag_hdr);
671                                 fh->nexthdr = nexthdr;
672                                 fh->reserved = 0;
673                                 fh->frag_off = htons(offset);
674                                 if (frag->next != NULL)
675                                         fh->frag_off |= htons(IP6_MF);
676                                 fh->identification = frag_id;
677                                 ipv6_hdr(frag)->payload_len =
678                                                 htons(frag->len -
679                                                       sizeof(struct ipv6hdr));
680                                 ip6_copy_metadata(frag, skb);
681                         }
682 
683                         err = output(skb);
684                         if(!err)
685                                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
686                                               IPSTATS_MIB_FRAGCREATES);
687 
688                         if (err || !frag)
689                                 break;
690 
691                         skb = frag;
692                         frag = skb->next;
693                         skb->next = NULL;
694                 }
695 
696                 kfree(tmp_hdr);
697 
698                 if (err == 0) {
699                         IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
700                                       IPSTATS_MIB_FRAGOKS);
701                         ip6_rt_put(rt);
702                         return 0;
703                 }
704 
705                 while (frag) {
706                         skb = frag->next;
707                         kfree_skb(frag);
708                         frag = skb;
709                 }
710 
711                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
712                               IPSTATS_MIB_FRAGFAILS);
713                 ip6_rt_put(rt);
714                 return err;
715 
716 slow_path_clean:
717                 skb_walk_frags(skb, frag2) {
718                         if (frag2 == frag)
719                                 break;
720                         frag2->sk = NULL;
721                         frag2->destructor = NULL;
722                         skb->truesize += frag2->truesize;
723                 }
724         }
725 
726 slow_path:
727         if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
728             skb_checksum_help(skb))
729                 goto fail;
730 
731         left = skb->len - hlen;         /* Space per frame */
732         ptr = hlen;                     /* Where to start from */
733 
734         /*
735          *      Fragment the datagram.
736          */
737 
738         *prevhdr = NEXTHDR_FRAGMENT;
739         hroom = LL_RESERVED_SPACE(rt->dst.dev);
740         troom = rt->dst.dev->needed_tailroom;
741 
742         /*
743          *      Keep copying data until we run out.
744          */
745         while(left > 0) {
746                 len = left;
747                 /* IF: it doesn't fit, use 'mtu' - the data space left */
748                 if (len > mtu)
749                         len = mtu;
750                 /* IF: we are not sending up to and including the packet end
751                    then align the next start on an eight byte boundary */
752                 if (len < left) {
753                         len &= ~7;
754                 }
755                 /*
756                  *      Allocate buffer.
757                  */
758 
759                 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
760                                       hroom + troom, GFP_ATOMIC)) == NULL) {
761                         NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
762                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
763                                       IPSTATS_MIB_FRAGFAILS);
764                         err = -ENOMEM;
765                         goto fail;
766                 }
767 
768                 /*
769                  *      Set up data on packet
770                  */
771 
772                 ip6_copy_metadata(frag, skb);
773                 skb_reserve(frag, hroom);
774                 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
775                 skb_reset_network_header(frag);
776                 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
777                 frag->transport_header = (frag->network_header + hlen +
778                                           sizeof(struct frag_hdr));
779 
780                 /*
781                  *      Charge the memory for the fragment to any owner
782                  *      it might possess
783                  */
784                 if (skb->sk)
785                         skb_set_owner_w(frag, skb->sk);
786 
787                 /*
788                  *      Copy the packet header into the new buffer.
789                  */
790                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
791 
792                 /*
793                  *      Build fragment header.
794                  */
795                 fh->nexthdr = nexthdr;
796                 fh->reserved = 0;
797                 if (!frag_id) {
798                         ipv6_select_ident(fh, rt);
799                         frag_id = fh->identification;
800                 } else
801                         fh->identification = frag_id;
802 
803                 /*
804                  *      Copy a block of the IP datagram.
805                  */
806                 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
807                         BUG();
808                 left -= len;
809 
810                 fh->frag_off = htons(offset);
811                 if (left > 0)
812                         fh->frag_off |= htons(IP6_MF);
813                 ipv6_hdr(frag)->payload_len = htons(frag->len -
814                                                     sizeof(struct ipv6hdr));
815 
816                 ptr += len;
817                 offset += len;
818 
819                 /*
820                  *      Put this fragment into the sending queue.
821                  */
822                 err = output(frag);
823                 if (err)
824                         goto fail;
825 
826                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
827                               IPSTATS_MIB_FRAGCREATES);
828         }
829         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
830                       IPSTATS_MIB_FRAGOKS);
831         consume_skb(skb);
832         return err;
833 
834 fail:
835         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
836                       IPSTATS_MIB_FRAGFAILS);
837         kfree_skb(skb);
838         return err;
839 }
840 
841 static inline int ip6_rt_check(const struct rt6key *rt_key,
842                                const struct in6_addr *fl_addr,
843                                const struct in6_addr *addr_cache)
844 {
845         return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
846                 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
847 }
848 
849 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
850                                           struct dst_entry *dst,
851                                           const struct flowi6 *fl6)
852 {
853         struct ipv6_pinfo *np = inet6_sk(sk);
854         struct rt6_info *rt;
855 
856         if (!dst)
857                 goto out;
858 
859         if (dst->ops->family != AF_INET6) {
860                 dst_release(dst);
861                 return NULL;
862         }
863 
864         rt = (struct rt6_info *)dst;
865         /* Yes, checking route validity in not connected
866          * case is not very simple. Take into account,
867          * that we do not support routing by source, TOS,
868          * and MSG_DONTROUTE            --ANK (980726)
869          *
870          * 1. ip6_rt_check(): If route was host route,
871          *    check that cached destination is current.
872          *    If it is network route, we still may
873          *    check its validity using saved pointer
874          *    to the last used address: daddr_cache.
875          *    We do not want to save whole address now,
876          *    (because main consumer of this service
877          *    is tcp, which has not this problem),
878          *    so that the last trick works only on connected
879          *    sockets.
880          * 2. oif also should be the same.
881          */
882         if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
883 #ifdef CONFIG_IPV6_SUBTREES
884             ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
885 #endif
886             (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
887                 dst_release(dst);
888                 dst = NULL;
889         }
890 
891 out:
892         return dst;
893 }
894 
895 static int ip6_dst_lookup_tail(struct sock *sk,
896                                struct dst_entry **dst, struct flowi6 *fl6)
897 {
898         struct net *net = sock_net(sk);
899 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
900         struct neighbour *n;
901         struct rt6_info *rt;
902 #endif
903         int err;
904 
905         if (*dst == NULL)
906                 *dst = ip6_route_output(net, sk, fl6);
907 
908         if ((err = (*dst)->error))
909                 goto out_err_release;
910 
911         if (ipv6_addr_any(&fl6->saddr)) {
912                 struct rt6_info *rt = (struct rt6_info *) *dst;
913                 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
914                                           sk ? inet6_sk(sk)->srcprefs : 0,
915                                           &fl6->saddr);
916                 if (err)
917                         goto out_err_release;
918         }
919 
920 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
921         /*
922          * Here if the dst entry we've looked up
923          * has a neighbour entry that is in the INCOMPLETE
924          * state and the src address from the flow is
925          * marked as OPTIMISTIC, we release the found
926          * dst entry and replace it instead with the
927          * dst entry of the nexthop router
928          */
929         rt = (struct rt6_info *) *dst;
930         rcu_read_lock_bh();
931         n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
932         err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
933         rcu_read_unlock_bh();
934 
935         if (err) {
936                 struct inet6_ifaddr *ifp;
937                 struct flowi6 fl_gw6;
938                 int redirect;
939 
940                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
941                                       (*dst)->dev, 1);
942 
943                 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
944                 if (ifp)
945                         in6_ifa_put(ifp);
946 
947                 if (redirect) {
948                         /*
949                          * We need to get the dst entry for the
950                          * default router instead
951                          */
952                         dst_release(*dst);
953                         memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
954                         memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
955                         *dst = ip6_route_output(net, sk, &fl_gw6);
956                         if ((err = (*dst)->error))
957                                 goto out_err_release;
958                 }
959         }
960 #endif
961 
962         return 0;
963 
964 out_err_release:
965         if (err == -ENETUNREACH)
966                 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
967         dst_release(*dst);
968         *dst = NULL;
969         return err;
970 }
971 
972 /**
973  *      ip6_dst_lookup - perform route lookup on flow
974  *      @sk: socket which provides route info
975  *      @dst: pointer to dst_entry * for result
976  *      @fl6: flow to lookup
977  *
978  *      This function performs a route lookup on the given flow.
979  *
980  *      It returns zero on success, or a standard errno code on error.
981  */
982 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
983 {
984         *dst = NULL;
985         return ip6_dst_lookup_tail(sk, dst, fl6);
986 }
987 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
988 
989 /**
990  *      ip6_dst_lookup_flow - perform route lookup on flow with ipsec
991  *      @sk: socket which provides route info
992  *      @fl6: flow to lookup
993  *      @final_dst: final destination address for ipsec lookup
994  *
995  *      This function performs a route lookup on the given flow.
996  *
997  *      It returns a valid dst pointer on success, or a pointer encoded
998  *      error code.
999  */
1000 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1001                                       const struct in6_addr *final_dst)
1002 {
1003         struct dst_entry *dst = NULL;
1004         int err;
1005 
1006         err = ip6_dst_lookup_tail(sk, &dst, fl6);
1007         if (err)
1008                 return ERR_PTR(err);
1009         if (final_dst)
1010                 fl6->daddr = *final_dst;
1011 
1012         return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1013 }
1014 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1015 
1016 /**
1017  *      ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1018  *      @sk: socket which provides the dst cache and route info
1019  *      @fl6: flow to lookup
1020  *      @final_dst: final destination address for ipsec lookup
1021  *
1022  *      This function performs a route lookup on the given flow with the
1023  *      possibility of using the cached route in the socket if it is valid.
1024  *      It will take the socket dst lock when operating on the dst cache.
1025  *      As a result, this function can only be used in process context.
1026  *
1027  *      It returns a valid dst pointer on success, or a pointer encoded
1028  *      error code.
1029  */
1030 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1031                                          const struct in6_addr *final_dst)
1032 {
1033         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1034         int err;
1035 
1036         dst = ip6_sk_dst_check(sk, dst, fl6);
1037 
1038         err = ip6_dst_lookup_tail(sk, &dst, fl6);
1039         if (err)
1040                 return ERR_PTR(err);
1041         if (final_dst)
1042                 fl6->daddr = *final_dst;
1043 
1044         return xfrm_lookup_route(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1045 }
1046 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1047 
1048 static inline int ip6_ufo_append_data(struct sock *sk,
1049                         int getfrag(void *from, char *to, int offset, int len,
1050                         int odd, struct sk_buff *skb),
1051                         void *from, int length, int hh_len, int fragheaderlen,
1052                         int transhdrlen, int mtu,unsigned int flags,
1053                         struct rt6_info *rt)
1054 
1055 {
1056         struct sk_buff *skb;
1057         struct frag_hdr fhdr;
1058         int err;
1059 
1060         /* There is support for UDP large send offload by network
1061          * device, so create one single skb packet containing complete
1062          * udp datagram
1063          */
1064         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1065                 skb = sock_alloc_send_skb(sk,
1066                         hh_len + fragheaderlen + transhdrlen + 20,
1067                         (flags & MSG_DONTWAIT), &err);
1068                 if (skb == NULL)
1069                         return err;
1070 
1071                 /* reserve space for Hardware header */
1072                 skb_reserve(skb, hh_len);
1073 
1074                 /* create space for UDP/IP header */
1075                 skb_put(skb,fragheaderlen + transhdrlen);
1076 
1077                 /* initialize network header pointer */
1078                 skb_reset_network_header(skb);
1079 
1080                 /* initialize protocol header pointer */
1081                 skb->transport_header = skb->network_header + fragheaderlen;
1082 
1083                 skb->protocol = htons(ETH_P_IPV6);
1084                 skb->csum = 0;
1085 
1086                 __skb_queue_tail(&sk->sk_write_queue, skb);
1087         } else if (skb_is_gso(skb)) {
1088                 goto append;
1089         }
1090 
1091         skb->ip_summed = CHECKSUM_PARTIAL;
1092         /* Specify the length of each IPv6 datagram fragment.
1093          * It has to be a multiple of 8.
1094          */
1095         skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1096                                      sizeof(struct frag_hdr)) & ~7;
1097         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1098         ipv6_select_ident(&fhdr, rt);
1099         skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1100 
1101 append:
1102         return skb_append_datato_frags(sk, skb, getfrag, from,
1103                                        (length - transhdrlen));
1104 }
1105 
1106 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1107                                                gfp_t gfp)
1108 {
1109         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1110 }
1111 
1112 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1113                                                 gfp_t gfp)
1114 {
1115         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1116 }
1117 
1118 static void ip6_append_data_mtu(unsigned int *mtu,
1119                                 int *maxfraglen,
1120                                 unsigned int fragheaderlen,
1121                                 struct sk_buff *skb,
1122                                 struct rt6_info *rt,
1123                                 unsigned int orig_mtu)
1124 {
1125         if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1126                 if (skb == NULL) {
1127                         /* first fragment, reserve header_len */
1128                         *mtu = orig_mtu - rt->dst.header_len;
1129 
1130                 } else {
1131                         /*
1132                          * this fragment is not first, the headers
1133                          * space is regarded as data space.
1134                          */
1135                         *mtu = orig_mtu;
1136                 }
1137                 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1138                               + fragheaderlen - sizeof(struct frag_hdr);
1139         }
1140 }
1141 
1142 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1143         int offset, int len, int odd, struct sk_buff *skb),
1144         void *from, int length, int transhdrlen,
1145         int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1146         struct rt6_info *rt, unsigned int flags, int dontfrag)
1147 {
1148         struct inet_sock *inet = inet_sk(sk);
1149         struct ipv6_pinfo *np = inet6_sk(sk);
1150         struct inet_cork *cork;
1151         struct sk_buff *skb, *skb_prev = NULL;
1152         unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1153         int exthdrlen;
1154         int dst_exthdrlen;
1155         int hh_len;
1156         int copy;
1157         int err;
1158         int offset = 0;
1159         __u8 tx_flags = 0;
1160 
1161         if (flags&MSG_PROBE)
1162                 return 0;
1163         cork = &inet->cork.base;
1164         if (skb_queue_empty(&sk->sk_write_queue)) {
1165                 /*
1166                  * setup for corking
1167                  */
1168                 if (opt) {
1169                         if (WARN_ON(np->cork.opt))
1170                                 return -EINVAL;
1171 
1172                         np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1173                         if (unlikely(np->cork.opt == NULL))
1174                                 return -ENOBUFS;
1175 
1176                         np->cork.opt->tot_len = opt->tot_len;
1177                         np->cork.opt->opt_flen = opt->opt_flen;
1178                         np->cork.opt->opt_nflen = opt->opt_nflen;
1179 
1180                         np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1181                                                             sk->sk_allocation);
1182                         if (opt->dst0opt && !np->cork.opt->dst0opt)
1183                                 return -ENOBUFS;
1184 
1185                         np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1186                                                             sk->sk_allocation);
1187                         if (opt->dst1opt && !np->cork.opt->dst1opt)
1188                                 return -ENOBUFS;
1189 
1190                         np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1191                                                            sk->sk_allocation);
1192                         if (opt->hopopt && !np->cork.opt->hopopt)
1193                                 return -ENOBUFS;
1194 
1195                         np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1196                                                             sk->sk_allocation);
1197                         if (opt->srcrt && !np->cork.opt->srcrt)
1198                                 return -ENOBUFS;
1199 
1200                         /* need source address above miyazawa*/
1201                 }
1202                 dst_hold(&rt->dst);
1203                 cork->dst = &rt->dst;
1204                 inet->cork.fl.u.ip6 = *fl6;
1205                 np->cork.hop_limit = hlimit;
1206                 np->cork.tclass = tclass;
1207                 if (rt->dst.flags & DST_XFRM_TUNNEL)
1208                         mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1209                               rt->dst.dev->mtu : dst_mtu(&rt->dst);
1210                 else
1211                         mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1212                               rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1213                 if (np->frag_size < mtu) {
1214                         if (np->frag_size)
1215                                 mtu = np->frag_size;
1216                 }
1217                 cork->fragsize = mtu;
1218                 if (dst_allfrag(rt->dst.path))
1219                         cork->flags |= IPCORK_ALLFRAG;
1220                 cork->length = 0;
1221                 exthdrlen = (opt ? opt->opt_flen : 0);
1222                 length += exthdrlen;
1223                 transhdrlen += exthdrlen;
1224                 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1225         } else {
1226                 rt = (struct rt6_info *)cork->dst;
1227                 fl6 = &inet->cork.fl.u.ip6;
1228                 opt = np->cork.opt;
1229                 transhdrlen = 0;
1230                 exthdrlen = 0;
1231                 dst_exthdrlen = 0;
1232                 mtu = cork->fragsize;
1233         }
1234         orig_mtu = mtu;
1235 
1236         hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1237 
1238         fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1239                         (opt ? opt->opt_nflen : 0);
1240         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1241                      sizeof(struct frag_hdr);
1242 
1243         if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1244                 unsigned int maxnonfragsize, headersize;
1245 
1246                 headersize = sizeof(struct ipv6hdr) +
1247                              (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1248                              (dst_allfrag(&rt->dst) ?
1249                               sizeof(struct frag_hdr) : 0) +
1250                              rt->rt6i_nfheader_len;
1251 
1252                 maxnonfragsize = (np->pmtudisc >= IPV6_PMTUDISC_DO) ?
1253                                  mtu : sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1254 
1255                 /* dontfrag active */
1256                 if ((cork->length + length > mtu - headersize) && dontfrag &&
1257                     (sk->sk_protocol == IPPROTO_UDP ||
1258                      sk->sk_protocol == IPPROTO_RAW)) {
1259                         ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1260                                                    sizeof(struct ipv6hdr));
1261                         goto emsgsize;
1262                 }
1263 
1264                 if (cork->length + length > maxnonfragsize - headersize) {
1265 emsgsize:
1266                         ipv6_local_error(sk, EMSGSIZE, fl6,
1267                                          mtu - headersize +
1268                                          sizeof(struct ipv6hdr));
1269                         return -EMSGSIZE;
1270                 }
1271         }
1272 
1273         /* For UDP, check if TX timestamp is enabled */
1274         if (sk->sk_type == SOCK_DGRAM)
1275                 sock_tx_timestamp(sk, &tx_flags);
1276 
1277         /*
1278          * Let's try using as much space as possible.
1279          * Use MTU if total length of the message fits into the MTU.
1280          * Otherwise, we need to reserve fragment header and
1281          * fragment alignment (= 8-15 octects, in total).
1282          *
1283          * Note that we may need to "move" the data from the tail of
1284          * of the buffer to the new fragment when we split
1285          * the message.
1286          *
1287          * FIXME: It may be fragmented into multiple chunks
1288          *        at once if non-fragmentable extension headers
1289          *        are too large.
1290          * --yoshfuji
1291          */
1292 
1293         skb = skb_peek_tail(&sk->sk_write_queue);
1294         cork->length += length;
1295         if (((length > mtu) ||
1296              (skb && skb_is_gso(skb))) &&
1297             (sk->sk_protocol == IPPROTO_UDP) &&
1298             (rt->dst.dev->features & NETIF_F_UFO) &&
1299             (sk->sk_type == SOCK_DGRAM)) {
1300                 err = ip6_ufo_append_data(sk, getfrag, from, length,
1301                                           hh_len, fragheaderlen,
1302                                           transhdrlen, mtu, flags, rt);
1303                 if (err)
1304                         goto error;
1305                 return 0;
1306         }
1307 
1308         if (!skb)
1309                 goto alloc_new_skb;
1310 
1311         while (length > 0) {
1312                 /* Check if the remaining data fits into current packet. */
1313                 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1314                 if (copy < length)
1315                         copy = maxfraglen - skb->len;
1316 
1317                 if (copy <= 0) {
1318                         char *data;
1319                         unsigned int datalen;
1320                         unsigned int fraglen;
1321                         unsigned int fraggap;
1322                         unsigned int alloclen;
1323 alloc_new_skb:
1324                         /* There's no room in the current skb */
1325                         if (skb)
1326                                 fraggap = skb->len - maxfraglen;
1327                         else
1328                                 fraggap = 0;
1329                         /* update mtu and maxfraglen if necessary */
1330                         if (skb == NULL || skb_prev == NULL)
1331                                 ip6_append_data_mtu(&mtu, &maxfraglen,
1332                                                     fragheaderlen, skb, rt,
1333                                                     orig_mtu);
1334 
1335                         skb_prev = skb;
1336 
1337                         /*
1338                          * If remaining data exceeds the mtu,
1339                          * we know we need more fragment(s).
1340                          */
1341                         datalen = length + fraggap;
1342 
1343                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1344                                 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1345                         if ((flags & MSG_MORE) &&
1346                             !(rt->dst.dev->features&NETIF_F_SG))
1347                                 alloclen = mtu;
1348                         else
1349                                 alloclen = datalen + fragheaderlen;
1350 
1351                         alloclen += dst_exthdrlen;
1352 
1353                         if (datalen != length + fraggap) {
1354                                 /*
1355                                  * this is not the last fragment, the trailer
1356                                  * space is regarded as data space.
1357                                  */
1358                                 datalen += rt->dst.trailer_len;
1359                         }
1360 
1361                         alloclen += rt->dst.trailer_len;
1362                         fraglen = datalen + fragheaderlen;
1363 
1364                         /*
1365                          * We just reserve space for fragment header.
1366                          * Note: this may be overallocation if the message
1367                          * (without MSG_MORE) fits into the MTU.
1368                          */
1369                         alloclen += sizeof(struct frag_hdr);
1370 
1371                         if (transhdrlen) {
1372                                 skb = sock_alloc_send_skb(sk,
1373                                                 alloclen + hh_len,
1374                                                 (flags & MSG_DONTWAIT), &err);
1375                         } else {
1376                                 skb = NULL;
1377                                 if (atomic_read(&sk->sk_wmem_alloc) <=
1378                                     2 * sk->sk_sndbuf)
1379                                         skb = sock_wmalloc(sk,
1380                                                            alloclen + hh_len, 1,
1381                                                            sk->sk_allocation);
1382                                 if (unlikely(skb == NULL))
1383                                         err = -ENOBUFS;
1384                                 else {
1385                                         /* Only the initial fragment
1386                                          * is time stamped.
1387                                          */
1388                                         tx_flags = 0;
1389                                 }
1390                         }
1391                         if (skb == NULL)
1392                                 goto error;
1393                         /*
1394                          *      Fill in the control structures
1395                          */
1396                         skb->protocol = htons(ETH_P_IPV6);
1397                         skb->ip_summed = CHECKSUM_NONE;
1398                         skb->csum = 0;
1399                         /* reserve for fragmentation and ipsec header */
1400                         skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1401                                     dst_exthdrlen);
1402 
1403                         if (sk->sk_type == SOCK_DGRAM)
1404                                 skb_shinfo(skb)->tx_flags = tx_flags;
1405 
1406                         /*
1407                          *      Find where to start putting bytes
1408                          */
1409                         data = skb_put(skb, fraglen);
1410                         skb_set_network_header(skb, exthdrlen);
1411                         data += fragheaderlen;
1412                         skb->transport_header = (skb->network_header +
1413                                                  fragheaderlen);
1414                         if (fraggap) {
1415                                 skb->csum = skb_copy_and_csum_bits(
1416                                         skb_prev, maxfraglen,
1417                                         data + transhdrlen, fraggap, 0);
1418                                 skb_prev->csum = csum_sub(skb_prev->csum,
1419                                                           skb->csum);
1420                                 data += fraggap;
1421                                 pskb_trim_unique(skb_prev, maxfraglen);
1422                         }
1423                         copy = datalen - transhdrlen - fraggap;
1424 
1425                         if (copy < 0) {
1426                                 err = -EINVAL;
1427                                 kfree_skb(skb);
1428                                 goto error;
1429                         } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1430                                 err = -EFAULT;
1431                                 kfree_skb(skb);
1432                                 goto error;
1433                         }
1434 
1435                         offset += copy;
1436                         length -= datalen - fraggap;
1437                         transhdrlen = 0;
1438                         exthdrlen = 0;
1439                         dst_exthdrlen = 0;
1440 
1441                         /*
1442                          * Put the packet on the pending queue
1443                          */
1444                         __skb_queue_tail(&sk->sk_write_queue, skb);
1445                         continue;
1446                 }
1447 
1448                 if (copy > length)
1449                         copy = length;
1450 
1451                 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1452                         unsigned int off;
1453 
1454                         off = skb->len;
1455                         if (getfrag(from, skb_put(skb, copy),
1456                                                 offset, copy, off, skb) < 0) {
1457                                 __skb_trim(skb, off);
1458                                 err = -EFAULT;
1459                                 goto error;
1460                         }
1461                 } else {
1462                         int i = skb_shinfo(skb)->nr_frags;
1463                         struct page_frag *pfrag = sk_page_frag(sk);
1464 
1465                         err = -ENOMEM;
1466                         if (!sk_page_frag_refill(sk, pfrag))
1467                                 goto error;
1468 
1469                         if (!skb_can_coalesce(skb, i, pfrag->page,
1470                                               pfrag->offset)) {
1471                                 err = -EMSGSIZE;
1472                                 if (i == MAX_SKB_FRAGS)
1473                                         goto error;
1474 
1475                                 __skb_fill_page_desc(skb, i, pfrag->page,
1476                                                      pfrag->offset, 0);
1477                                 skb_shinfo(skb)->nr_frags = ++i;
1478                                 get_page(pfrag->page);
1479                         }
1480                         copy = min_t(int, copy, pfrag->size - pfrag->offset);
1481                         if (getfrag(from,
1482                                     page_address(pfrag->page) + pfrag->offset,
1483                                     offset, copy, skb->len, skb) < 0)
1484                                 goto error_efault;
1485 
1486                         pfrag->offset += copy;
1487                         skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1488                         skb->len += copy;
1489                         skb->data_len += copy;
1490                         skb->truesize += copy;
1491                         atomic_add(copy, &sk->sk_wmem_alloc);
1492                 }
1493                 offset += copy;
1494                 length -= copy;
1495         }
1496 
1497         return 0;
1498 
1499 error_efault:
1500         err = -EFAULT;
1501 error:
1502         cork->length -= length;
1503         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1504         return err;
1505 }
1506 EXPORT_SYMBOL_GPL(ip6_append_data);
1507 
1508 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1509 {
1510         if (np->cork.opt) {
1511                 kfree(np->cork.opt->dst0opt);
1512                 kfree(np->cork.opt->dst1opt);
1513                 kfree(np->cork.opt->hopopt);
1514                 kfree(np->cork.opt->srcrt);
1515                 kfree(np->cork.opt);
1516                 np->cork.opt = NULL;
1517         }
1518 
1519         if (inet->cork.base.dst) {
1520                 dst_release(inet->cork.base.dst);
1521                 inet->cork.base.dst = NULL;
1522                 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1523         }
1524         memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1525 }
1526 
1527 int ip6_push_pending_frames(struct sock *sk)
1528 {
1529         struct sk_buff *skb, *tmp_skb;
1530         struct sk_buff **tail_skb;
1531         struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1532         struct inet_sock *inet = inet_sk(sk);
1533         struct ipv6_pinfo *np = inet6_sk(sk);
1534         struct net *net = sock_net(sk);
1535         struct ipv6hdr *hdr;
1536         struct ipv6_txoptions *opt = np->cork.opt;
1537         struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1538         struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1539         unsigned char proto = fl6->flowi6_proto;
1540         int err = 0;
1541 
1542         if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1543                 goto out;
1544         tail_skb = &(skb_shinfo(skb)->frag_list);
1545 
1546         /* move skb->data to ip header from ext header */
1547         if (skb->data < skb_network_header(skb))
1548                 __skb_pull(skb, skb_network_offset(skb));
1549         while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1550                 __skb_pull(tmp_skb, skb_network_header_len(skb));
1551                 *tail_skb = tmp_skb;
1552                 tail_skb = &(tmp_skb->next);
1553                 skb->len += tmp_skb->len;
1554                 skb->data_len += tmp_skb->len;
1555                 skb->truesize += tmp_skb->truesize;
1556                 tmp_skb->destructor = NULL;
1557                 tmp_skb->sk = NULL;
1558         }
1559 
1560         /* Allow local fragmentation. */
1561         if (np->pmtudisc < IPV6_PMTUDISC_DO)
1562                 skb->local_df = 1;
1563 
1564         *final_dst = fl6->daddr;
1565         __skb_pull(skb, skb_network_header_len(skb));
1566         if (opt && opt->opt_flen)
1567                 ipv6_push_frag_opts(skb, opt, &proto);
1568         if (opt && opt->opt_nflen)
1569                 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1570 
1571         skb_push(skb, sizeof(struct ipv6hdr));
1572         skb_reset_network_header(skb);
1573         hdr = ipv6_hdr(skb);
1574 
1575         ip6_flow_hdr(hdr, np->cork.tclass, fl6->flowlabel);
1576         hdr->hop_limit = np->cork.hop_limit;
1577         hdr->nexthdr = proto;
1578         hdr->saddr = fl6->saddr;
1579         hdr->daddr = *final_dst;
1580 
1581         skb->priority = sk->sk_priority;
1582         skb->mark = sk->sk_mark;
1583 
1584         skb_dst_set(skb, dst_clone(&rt->dst));
1585         IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1586         if (proto == IPPROTO_ICMPV6) {
1587                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1588 
1589                 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
1590                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1591         }
1592 
1593         err = ip6_local_out(skb);
1594         if (err) {
1595                 if (err > 0)
1596                         err = net_xmit_errno(err);
1597                 if (err)
1598                         goto error;
1599         }
1600 
1601 out:
1602         ip6_cork_release(inet, np);
1603         return err;
1604 error:
1605         IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1606         goto out;
1607 }
1608 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1609 
1610 void ip6_flush_pending_frames(struct sock *sk)
1611 {
1612         struct sk_buff *skb;
1613 
1614         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1615                 if (skb_dst(skb))
1616                         IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1617                                       IPSTATS_MIB_OUTDISCARDS);
1618                 kfree_skb(skb);
1619         }
1620 
1621         ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1622 }
1623 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);
1624 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp