net/ipv6/ip6_output.c

   1 /*
   2  *      IPv6 output functions
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on linux/net/ipv4/ip_output.c
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  *
  15  *      Changes:
  16  *      A.N.Kuznetsov   :       airthmetics in fragmentation.
  17  *                              extension headers are implemented.
  18  *                              route changes now work.
  19  *                              ip6_forward does not confuse sniffers.
  20  *                              etc.
  21  *
  22  *      H. von Brand    :       Added missing #include <linux/string.h>
  23  *      Imran Patel     :       frag id should be in NBO
  24  *      Kazunori MIYAZAWA @USAGI
  25  *                      :       add ip6_append_data and related functions
  26  *                              for datagram xmit
  27  */
  28
  29 #include <linux/errno.h>
  30 #include <linux/kernel.h>
  31 #include <linux/string.h>
  32 #include <linux/socket.h>
  33 #include <linux/net.h>
  34 #include <linux/netdevice.h>
  35 #include <linux/if_arp.h>
  36 #include <linux/in6.h>
  37 #include <linux/tcp.h>
  38 #include <linux/route.h>
  39 #include <linux/module.h>
  40 #include <linux/slab.h>
  41
  42 #include <linux/netfilter.h>
  43 #include <linux/netfilter_ipv6.h>
  44
  45 #include <net/sock.h>
  46 #include <net/snmp.h>
  47
  48 #include <net/ipv6.h>
  49 #include <net/ndisc.h>
  50 #include <net/protocol.h>
  51 #include <net/ip6_route.h>
  52 #include <net/addrconf.h>
  53 #include <net/rawv6.h>
  54 #include <net/icmp.h>
  55 #include <net/xfrm.h>
  56 #include <net/checksum.h>
  57 #include <linux/mroute6.h>
  58
  59 static int ip6_finish_output2(struct sk_buff *skb)
  60 {
  61         struct dst_entry *dst = skb_dst(skb);
  62         struct net_device *dev = dst->dev;
  63         struct neighbour *neigh;
  64         struct in6_addr *nexthop;
  65         int ret;
  66
  67         skb->protocol = htons(ETH_P_IPV6);
  68         skb->dev = dev;
  69
  70         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
  71                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
  72
  73                 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
  74                     ((mroute6_socket(dev_net(dev), skb) &&
  75                      !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
  76                      ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
  77                                          &ipv6_hdr(skb)->saddr))) {
  78                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
  79
  80                         /* Do not check for IFF_ALLMULTI; multicast routing
  81                            is not supported in any case.
  82                          */
  83                         if (newskb)
  84                                 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
  85                                         newskb, NULL, newskb->dev,
  86                                         dev_loopback_xmit);
  87
  88                         if (ipv6_hdr(skb)->hop_limit == 0) {
  89                                 IP6_INC_STATS(dev_net(dev), idev,
  90                                               IPSTATS_MIB_OUTDISCARDS);
  91                                 kfree_skb(skb);
  92                                 return 0;
  93                         }
  94                 }
  95
  96                 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
  97                                 skb->len);
  98
  99                 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
 100                     IPV6_ADDR_SCOPE_NODELOCAL &&
 101                     !(dev->flags & IFF_LOOPBACK)) {
 102                         kfree_skb(skb);
 103                         return 0;
 104                 }
 105         }
 106
 107         rcu_read_lock_bh();
 108         nexthop = rt6_nexthop((struct rt6_info *)dst);
 109         neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
 110         if (unlikely(!neigh))
 111                 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
 112         if (!IS_ERR(neigh)) {
 113                 ret = dst_neigh_output(dst, neigh, skb);
 114                 rcu_read_unlock_bh();
 115                 return ret;
 116         }
 117         rcu_read_unlock_bh();
 118
 119         IP6_INC_STATS(dev_net(dst->dev),
 120                       ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
 121         kfree_skb(skb);
 122         return -EINVAL;
 123 }
 124
 125 static int ip6_finish_output(struct sk_buff *skb)
 126 {
 127         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
 128             dst_allfrag(skb_dst(skb)) ||
 129             (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
 130                 return ip6_fragment(skb, ip6_finish_output2);
 131         else
 132                 return ip6_finish_output2(skb);
 133 }
 134
 135 int ip6_output(struct sock *sk, struct sk_buff *skb)
 136 {
 137         struct net_device *dev = skb_dst(skb)->dev;
 138         struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 139         if (unlikely(idev->cnf.disable_ipv6)) {
 140                 IP6_INC_STATS(dev_net(dev), idev,
 141                               IPSTATS_MIB_OUTDISCARDS);
 142                 kfree_skb(skb);
 143                 return 0;
 144         }
 145
 146         return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
 147                             ip6_finish_output,
 148                             !(IP6CB(skb)->flags & IP6SKB_REROUTED));
 149 }
 150
 151 /*
 152  *      xmit an sk_buff (used by TCP, SCTP and DCCP)
 153  */
 154
 155 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 156              struct ipv6_txoptions *opt, int tclass)
 157 {
 158         struct net *net = sock_net(sk);
 159         struct ipv6_pinfo *np = inet6_sk(sk);
 160         struct in6_addr *first_hop = &fl6->daddr;
 161         struct dst_entry *dst = skb_dst(skb);
 162         struct ipv6hdr *hdr;
 163         u8  proto = fl6->flowi6_proto;
 164         int seg_len = skb->len;
 165         int hlimit = -1;
 166         u32 mtu;
 167
 168         if (opt) {
 169                 unsigned int head_room;
 170
 171                 /* First: exthdrs may take lots of space (~8K for now)
 172                    MAX_HEADER is not enough.
 173                  */
 174                 head_room = opt->opt_nflen + opt->opt_flen;
 175                 seg_len += head_room;
 176                 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
 177
 178                 if (skb_headroom(skb) < head_room) {
 179                         struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
 180                         if (skb2 == NULL) {
 181                                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 182                                               IPSTATS_MIB_OUTDISCARDS);
 183                                 kfree_skb(skb);
 184                                 return -ENOBUFS;
 185                         }
 186                         consume_skb(skb);
 187                         skb = skb2;
 188                         skb_set_owner_w(skb, sk);
 189                 }
 190                 if (opt->opt_flen)
 191                         ipv6_push_frag_opts(skb, opt, &proto);
 192                 if (opt->opt_nflen)
 193                         ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
 194         }
 195
 196         skb_push(skb, sizeof(struct ipv6hdr));
 197         skb_reset_network_header(skb);
 198         hdr = ipv6_hdr(skb);
 199
 200         /*
 201          *      Fill in the IPv6 header
 202          */
 203         if (np)
 204                 hlimit = np->hop_limit;
 205         if (hlimit < 0)
 206                 hlimit = ip6_dst_hoplimit(dst);
 207
 208         ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel,
 209                                                      np->autoflowlabel));
 210
 211         hdr->payload_len = htons(seg_len);
 212         hdr->nexthdr = proto;
 213         hdr->hop_limit = hlimit;
 214
 215         hdr->saddr = fl6->saddr;
 216         hdr->daddr = *first_hop;
 217
 218         skb->protocol = htons(ETH_P_IPV6);
 219         skb->priority = sk->sk_priority;
 220         skb->mark = sk->sk_mark;
 221
 222         mtu = dst_mtu(dst);
 223         if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
 224                 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
 225                               IPSTATS_MIB_OUT, skb->len);
 226                 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
 227                                dst->dev, dst_output);
 228         }
 229
 230         skb->dev = dst->dev;
 231         ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
 232         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
 233         kfree_skb(skb);
 234         return -EMSGSIZE;
 235 }
 236
 237 EXPORT_SYMBOL(ip6_xmit);
 238
 239 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
 240 {
 241         struct ip6_ra_chain *ra;
 242         struct sock *last = NULL;
 243
 244         read_lock(&ip6_ra_lock);
 245         for (ra = ip6_ra_chain; ra; ra = ra->next) {
 246                 struct sock *sk = ra->sk;
 247                 if (sk && ra->sel == sel &&
 248                     (!sk->sk_bound_dev_if ||
 249                      sk->sk_bound_dev_if == skb->dev->ifindex)) {
 250                         if (last) {
 251                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 252                                 if (skb2)
 253                                         rawv6_rcv(last, skb2);
 254                         }
 255                         last = sk;
 256                 }
 257         }
 258
 259         if (last) {
 260                 rawv6_rcv(last, skb);
 261                 read_unlock(&ip6_ra_lock);
 262                 return 1;
 263         }
 264         read_unlock(&ip6_ra_lock);
 265         return 0;
 266 }
 267
 268 static int ip6_forward_proxy_check(struct sk_buff *skb)
 269 {
 270         struct ipv6hdr *hdr = ipv6_hdr(skb);
 271         u8 nexthdr = hdr->nexthdr;
 272         __be16 frag_off;
 273         int offset;
 274
 275         if (ipv6_ext_hdr(nexthdr)) {
 276                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
 277                 if (offset < 0)
 278                         return 0;
 279         } else
 280                 offset = sizeof(struct ipv6hdr);
 281
 282         if (nexthdr == IPPROTO_ICMPV6) {
 283                 struct icmp6hdr *icmp6;
 284
 285                 if (!pskb_may_pull(skb, (skb_network_header(skb) +
 286                                          offset + 1 - skb->data)))
 287                         return 0;
 288
 289                 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
 290
 291                 switch (icmp6->icmp6_type) {
 292                 case NDISC_ROUTER_SOLICITATION:
 293                 case NDISC_ROUTER_ADVERTISEMENT:
 294                 case NDISC_NEIGHBOUR_SOLICITATION:
 295                 case NDISC_NEIGHBOUR_ADVERTISEMENT:
 296                 case NDISC_REDIRECT:
 297                         /* For reaction involving unicast neighbor discovery
 298                          * message destined to the proxied address, pass it to
 299                          * input function.
 300                          */
 301                         return 1;
 302                 default:
 303                         break;
 304                 }
 305         }
 306
 307         /*
 308          * The proxying router can't forward traffic sent to a link-local
 309          * address, so signal the sender and discard the packet. This
 310          * behavior is clarified by the MIPv6 specification.
 311          */
 312         if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
 313                 dst_link_failure(skb);
 314                 return -1;
 315         }
 316
 317         return 0;
 318 }
 319
 320 static inline int ip6_forward_finish(struct sk_buff *skb)
 321 {
 322         return dst_output(skb);
 323 }
 324
 325 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
 326 {
 327         unsigned int mtu;
 328         struct inet6_dev *idev;
 329
 330         if (dst_metric_locked(dst, RTAX_MTU)) {
 331                 mtu = dst_metric_raw(dst, RTAX_MTU);
 332                 if (mtu)
 333                         return mtu;
 334         }
 335
 336         mtu = IPV6_MIN_MTU;
 337         rcu_read_lock();
 338         idev = __in6_dev_get(dst->dev);
 339         if (idev)
 340                 mtu = idev->cnf.mtu6;
 341         rcu_read_unlock();
 342
 343         return mtu;
 344 }
 345
 346 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
 347 {
 348         if (skb->len <= mtu)
 349                 return false;
 350
 351         /* ipv6 conntrack defrag sets max_frag_size + ignore_df */
 352         if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
 353                 return true;
 354
 355         if (skb->ignore_df)
 356                 return false;
 357
 358         if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
 359                 return false;
 360
 361         return true;
 362 }
 363
 364 int ip6_forward(struct sk_buff *skb)
 365 {
 366         struct dst_entry *dst = skb_dst(skb);
 367         struct ipv6hdr *hdr = ipv6_hdr(skb);
 368         struct inet6_skb_parm *opt = IP6CB(skb);
 369         struct net *net = dev_net(dst->dev);
 370         u32 mtu;
 371
 372         if (net->ipv6.devconf_all->forwarding == 0)
 373                 goto error;
 374
 375         if (skb->pkt_type != PACKET_HOST)
 376                 goto drop;
 377
 378         if (skb_warn_if_lro(skb))
 379                 goto drop;
 380
 381         if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
 382                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 383                                  IPSTATS_MIB_INDISCARDS);
 384                 goto drop;
 385         }
 386
 387         skb_forward_csum(skb);
 388
 389         /*
 390          *      We DO NOT make any processing on
 391          *      RA packets, pushing them to user level AS IS
 392          *      without ane WARRANTY that application will be able
 393          *      to interpret them. The reason is that we
 394          *      cannot make anything clever here.
 395          *
 396          *      We are not end-node, so that if packet contains
 397          *      AH/ESP, we cannot make anything.
 398          *      Defragmentation also would be mistake, RA packets
 399          *      cannot be fragmented, because there is no warranty
 400          *      that different fragments will go along one path. --ANK
 401          */
 402         if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
 403                 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
 404                         return 0;
 405         }
 406
 407         /*
 408          *      check and decrement ttl
 409          */
 410         if (hdr->hop_limit <= 1) {
 411                 /* Force OUTPUT device used as source address */
 412                 skb->dev = dst->dev;
 413                 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
 414                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 415                                  IPSTATS_MIB_INHDRERRORS);
 416
 417                 kfree_skb(skb);
 418                 return -ETIMEDOUT;
 419         }
 420
 421         /* XXX: idev->cnf.proxy_ndp? */
 422         if (net->ipv6.devconf_all->proxy_ndp &&
 423             pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
 424                 int proxied = ip6_forward_proxy_check(skb);
 425                 if (proxied > 0)
 426                         return ip6_input(skb);
 427                 else if (proxied < 0) {
 428                         IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 429                                          IPSTATS_MIB_INDISCARDS);
 430                         goto drop;
 431                 }
 432         }
 433
 434         if (!xfrm6_route_forward(skb)) {
 435                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 436                                  IPSTATS_MIB_INDISCARDS);
 437                 goto drop;
 438         }
 439         dst = skb_dst(skb);
 440
 441         /* IPv6 specs say nothing about it, but it is clear that we cannot
 442            send redirects to source routed frames.
 443            We don't send redirects to frames decapsulated from IPsec.
 444          */
 445         if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
 446                 struct in6_addr *target = NULL;
 447                 struct inet_peer *peer;
 448                 struct rt6_info *rt;
 449
 450                 /*
 451                  *      incoming and outgoing devices are the same
 452                  *      send a redirect.
 453                  */
 454
 455                 rt = (struct rt6_info *) dst;
 456                 if (rt->rt6i_flags & RTF_GATEWAY)
 457                         target = &rt->rt6i_gateway;
 458                 else
 459                         target = &hdr->daddr;
 460
 461                 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
 462
 463                 /* Limit redirects both by destination (here)
 464                    and by source (inside ndisc_send_redirect)
 465                  */
 466                 if (inet_peer_xrlim_allow(peer, 1*HZ))
 467                         ndisc_send_redirect(skb, target);
 468                 if (peer)
 469                         inet_putpeer(peer);
 470         } else {
 471                 int addrtype = ipv6_addr_type(&hdr->saddr);
 472
 473                 /* This check is security critical. */
 474                 if (addrtype == IPV6_ADDR_ANY ||
 475                     addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
 476                         goto error;
 477                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
 478                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
 479                                     ICMPV6_NOT_NEIGHBOUR, 0);
 480                         goto error;
 481                 }
 482         }
 483
 484         mtu = ip6_dst_mtu_forward(dst);
 485         if (mtu < IPV6_MIN_MTU)
 486                 mtu = IPV6_MIN_MTU;
 487
 488         if (ip6_pkt_too_big(skb, mtu)) {
 489                 /* Again, force OUTPUT device used as source address */
 490                 skb->dev = dst->dev;
 491                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 492                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 493                                  IPSTATS_MIB_INTOOBIGERRORS);
 494                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 495                                  IPSTATS_MIB_FRAGFAILS);
 496                 kfree_skb(skb);
 497                 return -EMSGSIZE;
 498         }
 499
 500         if (skb_cow(skb, dst->dev->hard_header_len)) {
 501                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 502                                  IPSTATS_MIB_OUTDISCARDS);
 503                 goto drop;
 504         }
 505
 506         hdr = ipv6_hdr(skb);
 507
 508         /* Mangling hops number delayed to point after skb COW */
 509
 510         hdr->hop_limit--;
 511
 512         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
 513         IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
 514         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
 515                        ip6_forward_finish);
 516
 517 error:
 518         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
 519 drop:
 520         kfree_skb(skb);
 521         return -EINVAL;
 522 }
 523
 524 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
 525 {
 526         to->pkt_type = from->pkt_type;
 527         to->priority = from->priority;
 528         to->protocol = from->protocol;
 529         skb_dst_drop(to);
 530         skb_dst_set(to, dst_clone(skb_dst(from)));
 531         to->dev = from->dev;
 532         to->mark = from->mark;
 533
 534 #ifdef CONFIG_NET_SCHED
 535         to->tc_index = from->tc_index;
 536 #endif
 537         nf_copy(to, from);
 538         skb_copy_secmark(to, from);
 539 }
 540
 541 static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
 542 {
 543         static u32 ip6_idents_hashrnd __read_mostly;
 544         u32 hash, id;
 545
 546         net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
 547
 548         hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
 549         hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
 550
 551         id = ip_idents_reserve(hash, 1);
 552         fhdr->identification = htonl(id);
 553 }
 554
 555 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 556 {
 557         struct sk_buff *frag;
 558         struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
 559         struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
 560         struct ipv6hdr *tmp_hdr;
 561         struct frag_hdr *fh;
 562         unsigned int mtu, hlen, left, len;
 563         int hroom, troom;
 564         __be32 frag_id = 0;
 565         int ptr, offset = 0, err=0;
 566         u8 *prevhdr, nexthdr = 0;
 567         struct net *net = dev_net(skb_dst(skb)->dev);
 568
 569         hlen = ip6_find_1stfragopt(skb, &prevhdr);
 570         nexthdr = *prevhdr;
 571
 572         mtu = ip6_skb_dst_mtu(skb);
 573
 574         /* We must not fragment if the socket is set to force MTU discovery
 575          * or if the skb it not generated by a local socket.
 576          */
 577         if (unlikely(!skb->ignore_df && skb->len > mtu) ||
 578                      (IP6CB(skb)->frag_max_size &&
 579                       IP6CB(skb)->frag_max_size > mtu)) {
 580                 if (skb->sk && dst_allfrag(skb_dst(skb)))
 581                         sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
 582
 583                 skb->dev = skb_dst(skb)->dev;
 584                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 585                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 586                               IPSTATS_MIB_FRAGFAILS);
 587                 kfree_skb(skb);
 588                 return -EMSGSIZE;
 589         }
 590
 591         if (np && np->frag_size < mtu) {
 592                 if (np->frag_size)
 593                         mtu = np->frag_size;
 594         }
 595         mtu -= hlen + sizeof(struct frag_hdr);
 596
 597         if (skb_has_frag_list(skb)) {
 598                 int first_len = skb_pagelen(skb);
 599                 struct sk_buff *frag2;
 600
 601                 if (first_len - hlen > mtu ||
 602                     ((first_len - hlen) & 7) ||
 603                     skb_cloned(skb))
 604                         goto slow_path;
 605
 606                 skb_walk_frags(skb, frag) {
 607                         /* Correct geometry. */
 608                         if (frag->len > mtu ||
 609                             ((frag->len & 7) && frag->next) ||
 610                             skb_headroom(frag) < hlen)
 611                                 goto slow_path_clean;
 612
 613                         /* Partially cloned skb? */
 614                         if (skb_shared(frag))
 615                                 goto slow_path_clean;
 616
 617                         BUG_ON(frag->sk);
 618                         if (skb->sk) {
 619                                 frag->sk = skb->sk;
 620                                 frag->destructor = sock_wfree;
 621                         }
 622                         skb->truesize -= frag->truesize;
 623                 }
 624
 625                 err = 0;
 626                 offset = 0;
 627                 frag = skb_shinfo(skb)->frag_list;
 628                 skb_frag_list_init(skb);
 629                 /* BUILD HEADER */
 630
 631                 *prevhdr = NEXTHDR_FRAGMENT;
 632                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
 633                 if (!tmp_hdr) {
 634                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 635                                       IPSTATS_MIB_FRAGFAILS);
 636                         return -ENOMEM;
 637                 }
 638
 639                 __skb_pull(skb, hlen);
 640                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
 641                 __skb_push(skb, hlen);
 642                 skb_reset_network_header(skb);
 643                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
 644
 645                 ipv6_select_ident(fh, rt);
 646                 fh->nexthdr = nexthdr;
 647                 fh->reserved = 0;
 648                 fh->frag_off = htons(IP6_MF);
 649                 frag_id = fh->identification;
 650
 651                 first_len = skb_pagelen(skb);
 652                 skb->data_len = first_len - skb_headlen(skb);
 653                 skb->len = first_len;
 654                 ipv6_hdr(skb)->payload_len = htons(first_len -
 655                                                    sizeof(struct ipv6hdr));
 656
 657                 dst_hold(&rt->dst);
 658
 659                 for (;;) {
 660                         /* Prepare header of the next frame,
 661                          * before previous one went down. */
 662                         if (frag) {
 663                                 frag->ip_summed = CHECKSUM_NONE;
 664                                 skb_reset_transport_header(frag);
 665                                 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
 666                                 __skb_push(frag, hlen);
 667                                 skb_reset_network_header(frag);
 668                                 memcpy(skb_network_header(frag), tmp_hdr,
 669                                        hlen);
 670                                 offset += skb->len - hlen - sizeof(struct frag_hdr);
 671                                 fh->nexthdr = nexthdr;
 672                                 fh->reserved = 0;
 673                                 fh->frag_off = htons(offset);
 674                                 if (frag->next != NULL)
 675                                         fh->frag_off |= htons(IP6_MF);
 676                                 fh->identification = frag_id;
 677                                 ipv6_hdr(frag)->payload_len =
 678                                                 htons(frag->len -
 679                                                       sizeof(struct ipv6hdr));
 680                                 ip6_copy_metadata(frag, skb);
 681                         }
 682
 683                         err = output(skb);
 684                         if(!err)
 685                                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 686                                               IPSTATS_MIB_FRAGCREATES);
 687
 688                         if (err || !frag)
 689                                 break;
 690
 691                         skb = frag;
 692                         frag = skb->next;
 693                         skb->next = NULL;
 694                 }
 695
 696                 kfree(tmp_hdr);
 697
 698                 if (err == 0) {
 699                         IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 700                                       IPSTATS_MIB_FRAGOKS);
 701                         ip6_rt_put(rt);
 702                         return 0;
 703                 }
 704
 705                 while (frag) {
 706                         skb = frag->next;
 707                         kfree_skb(frag);
 708                         frag = skb;
 709                 }
 710
 711                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 712                               IPSTATS_MIB_FRAGFAILS);
 713                 ip6_rt_put(rt);
 714                 return err;
 715
 716 slow_path_clean:
 717                 skb_walk_frags(skb, frag2) {
 718                         if (frag2 == frag)
 719                                 break;
 720                         frag2->sk = NULL;
 721                         frag2->destructor = NULL;
 722                         skb->truesize += frag2->truesize;
 723                 }
 724         }
 725
 726 slow_path:
 727         if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
 728             skb_checksum_help(skb))
 729                 goto fail;
 730
 731         left = skb->len - hlen;         /* Space per frame */
 732         ptr = hlen;                     /* Where to start from */
 733
 734         /*
 735          *      Fragment the datagram.
 736          */
 737
 738         *prevhdr = NEXTHDR_FRAGMENT;
 739         hroom = LL_RESERVED_SPACE(rt->dst.dev);
 740         troom = rt->dst.dev->needed_tailroom;
 741
 742         /*
 743          *      Keep copying data until we run out.
 744          */
 745         while(left > 0) {
 746                 len = left;
 747                 /* IF: it doesn't fit, use 'mtu' - the data space left */
 748                 if (len > mtu)
 749                         len = mtu;
 750                 /* IF: we are not sending up to and including the packet end
 751                    then align the next start on an eight byte boundary */
 752                 if (len < left) {
 753                         len &= ~7;
 754                 }
 755                 /*
 756                  *      Allocate buffer.
 757                  */
 758
 759                 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
 760                                       hroom + troom, GFP_ATOMIC)) == NULL) {
 761                         NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
 762                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 763                                       IPSTATS_MIB_FRAGFAILS);
 764                         err = -ENOMEM;
 765                         goto fail;
 766                 }
 767
 768                 /*
 769                  *      Set up data on packet
 770                  */
 771
 772                 ip6_copy_metadata(frag, skb);
 773                 skb_reserve(frag, hroom);
 774                 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
 775                 skb_reset_network_header(frag);
 776                 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
 777                 frag->transport_header = (frag->network_header + hlen +
 778                                           sizeof(struct frag_hdr));
 779
 780                 /*
 781                  *      Charge the memory for the fragment to any owner
 782                  *      it might possess
 783                  */
 784                 if (skb->sk)
 785                         skb_set_owner_w(frag, skb->sk);
 786
 787                 /*
 788                  *      Copy the packet header into the new buffer.
 789                  */
 790                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 791
 792                 /*
 793                  *      Build fragment header.
 794                  */
 795                 fh->nexthdr = nexthdr;
 796                 fh->reserved = 0;
 797                 if (!frag_id) {
 798                         ipv6_select_ident(fh, rt);
 799                         frag_id = fh->identification;
 800                 } else
 801                         fh->identification = frag_id;
 802
 803                 /*
 804                  *      Copy a block of the IP datagram.
 805                  */
 806                 BUG_ON(skb_copy_bits(skb, ptr, skb_transport_header(frag),
 807                                      len));
 808                 left -= len;
 809
 810                 fh->frag_off = htons(offset);
 811                 if (left > 0)
 812                         fh->frag_off |= htons(IP6_MF);
 813                 ipv6_hdr(frag)->payload_len = htons(frag->len -
 814                                                     sizeof(struct ipv6hdr));
 815
 816                 ptr += len;
 817                 offset += len;
 818
 819                 /*
 820                  *      Put this fragment into the sending queue.
 821                  */
 822                 err = output(frag);
 823                 if (err)
 824                         goto fail;
 825
 826                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 827                               IPSTATS_MIB_FRAGCREATES);
 828         }
 829         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 830                       IPSTATS_MIB_FRAGOKS);
 831         consume_skb(skb);
 832         return err;
 833
 834 fail:
 835         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 836                       IPSTATS_MIB_FRAGFAILS);
 837         kfree_skb(skb);
 838         return err;
 839 }
 840
 841 static inline int ip6_rt_check(const struct rt6key *rt_key,
 842                                const struct in6_addr *fl_addr,
 843                                const struct in6_addr *addr_cache)
 844 {
 845         return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
 846                 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
 847 }
 848
 849 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
 850                                           struct dst_entry *dst,
 851                                           const struct flowi6 *fl6)
 852 {
 853         struct ipv6_pinfo *np = inet6_sk(sk);
 854         struct rt6_info *rt;
 855
 856         if (!dst)
 857                 goto out;
 858
 859         if (dst->ops->family != AF_INET6) {
 860                 dst_release(dst);
 861                 return NULL;
 862         }
 863
 864         rt = (struct rt6_info *)dst;
 865         /* Yes, checking route validity in not connected
 866          * case is not very simple. Take into account,
 867          * that we do not support routing by source, TOS,
 868          * and MSG_DONTROUTE            --ANK (980726)
 869          *
 870          * 1. ip6_rt_check(): If route was host route,
 871          *    check that cached destination is current.
 872          *    If it is network route, we still may
 873          *    check its validity using saved pointer
 874          *    to the last used address: daddr_cache.
 875          *    We do not want to save whole address now,
 876          *    (because main consumer of this service
 877          *    is tcp, which has not this problem),
 878          *    so that the last trick works only on connected
 879          *    sockets.
 880          * 2. oif also should be the same.
 881          */
 882         if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
 883 #ifdef CONFIG_IPV6_SUBTREES
 884             ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
 885 #endif
 886             (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
 887                 dst_release(dst);
 888                 dst = NULL;
 889         }
 890
 891 out:
 892         return dst;
 893 }
 894
 895 static int ip6_dst_lookup_tail(struct sock *sk,
 896                                struct dst_entry **dst, struct flowi6 *fl6)
 897 {
 898         struct net *net = sock_net(sk);
 899 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 900         struct neighbour *n;
 901         struct rt6_info *rt;
 902 #endif
 903         int err;
 904
 905         if (*dst == NULL)
 906                 *dst = ip6_route_output(net, sk, fl6);
 907
 908         if ((err = (*dst)->error))
 909                 goto out_err_release;
 910
 911         if (ipv6_addr_any(&fl6->saddr)) {
 912                 struct rt6_info *rt = (struct rt6_info *) *dst;
 913                 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
 914                                           sk ? inet6_sk(sk)->srcprefs : 0,
 915                                           &fl6->saddr);
 916                 if (err)
 917                         goto out_err_release;
 918         }
 919
 920 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 921         /*
 922          * Here if the dst entry we've looked up
 923          * has a neighbour entry that is in the INCOMPLETE
 924          * state and the src address from the flow is
 925          * marked as OPTIMISTIC, we release the found
 926          * dst entry and replace it instead with the
 927          * dst entry of the nexthop router
 928          */
 929         rt = (struct rt6_info *) *dst;
 930         rcu_read_lock_bh();
 931         n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
 932         err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
 933         rcu_read_unlock_bh();
 934
 935         if (err) {
 936                 struct inet6_ifaddr *ifp;
 937                 struct flowi6 fl_gw6;
 938                 int redirect;
 939
 940                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
 941                                       (*dst)->dev, 1);
 942
 943                 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
 944                 if (ifp)
 945                         in6_ifa_put(ifp);
 946
 947                 if (redirect) {
 948                         /*
 949                          * We need to get the dst entry for the
 950                          * default router instead
 951                          */
 952                         dst_release(*dst);
 953                         memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
 954                         memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
 955                         *dst = ip6_route_output(net, sk, &fl_gw6);
 956                         if ((err = (*dst)->error))
 957                                 goto out_err_release;
 958                 }
 959         }
 960 #endif
 961
 962         return 0;
 963
 964 out_err_release:
 965         if (err == -ENETUNREACH)
 966                 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
 967         dst_release(*dst);
 968         *dst = NULL;
 969         return err;
 970 }
 971
 972 /**
 973  *      ip6_dst_lookup - perform route lookup on flow
 974  *      @sk: socket which provides route info
 975  *      @dst: pointer to dst_entry * for result
 976  *      @fl6: flow to lookup
 977  *
 978  *      This function performs a route lookup on the given flow.
 979  *
 980  *      It returns zero on success, or a standard errno code on error.
 981  */
 982 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
 983 {
 984         *dst = NULL;
 985         return ip6_dst_lookup_tail(sk, dst, fl6);
 986 }
 987 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 988
 989 /**
 990  *      ip6_dst_lookup_flow - perform route lookup on flow with ipsec
 991  *      @sk: socket which provides route info
 992  *      @fl6: flow to lookup
 993  *      @final_dst: final destination address for ipsec lookup
 994  *
 995  *      This function performs a route lookup on the given flow.
 996  *
 997  *      It returns a valid dst pointer on success, or a pointer encoded
 998  *      error code.
 999  */
1000 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1001                                       const struct in6_addr *final_dst)
1002 {
1003         struct dst_entry *dst = NULL;
1004         int err;
1005
1006         err = ip6_dst_lookup_tail(sk, &dst, fl6);
1007         if (err)
1008                 return ERR_PTR(err);
1009         if (final_dst)
1010                 fl6->daddr = *final_dst;
1011
1012         return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1013 }
1014 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1015
1016 /**
1017  *      ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1018  *      @sk: socket which provides the dst cache and route info
1019  *      @fl6: flow to lookup
1020  *      @final_dst: final destination address for ipsec lookup
1021  *
1022  *      This function performs a route lookup on the given flow with the
1023  *      possibility of using the cached route in the socket if it is valid.
1024  *      It will take the socket dst lock when operating on the dst cache.
1025  *      As a result, this function can only be used in process context.
1026  *
1027  *      It returns a valid dst pointer on success, or a pointer encoded
1028  *      error code.
1029  */
1030 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1031                                          const struct in6_addr *final_dst)
1032 {
1033         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1034         int err;
1035
1036         dst = ip6_sk_dst_check(sk, dst, fl6);
1037
1038         err = ip6_dst_lookup_tail(sk, &dst, fl6);
1039         if (err)
1040                 return ERR_PTR(err);
1041         if (final_dst)
1042                 fl6->daddr = *final_dst;
1043
1044         return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1045 }
1046 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1047
1048 static inline int ip6_ufo_append_data(struct sock *sk,
1049                         int getfrag(void *from, char *to, int offset, int len,
1050                         int odd, struct sk_buff *skb),
1051                         void *from, int length, int hh_len, int fragheaderlen,
1052                         int transhdrlen, int mtu,unsigned int flags,
1053                         struct rt6_info *rt)
1054
1055 {
1056         struct sk_buff *skb;
1057         struct frag_hdr fhdr;
1058         int err;
1059
1060         /* There is support for UDP large send offload by network
1061          * device, so create one single skb packet containing complete
1062          * udp datagram
1063          */
1064         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1065                 skb = sock_alloc_send_skb(sk,
1066                         hh_len + fragheaderlen + transhdrlen + 20,
1067                         (flags & MSG_DONTWAIT), &err);
1068                 if (skb == NULL)
1069                         return err;
1070
1071                 /* reserve space for Hardware header */
1072                 skb_reserve(skb, hh_len);
1073
1074                 /* create space for UDP/IP header */
1075                 skb_put(skb,fragheaderlen + transhdrlen);
1076
1077                 /* initialize network header pointer */
1078                 skb_reset_network_header(skb);
1079
1080                 /* initialize protocol header pointer */
1081                 skb->transport_header = skb->network_header + fragheaderlen;
1082
1083                 skb->protocol = htons(ETH_P_IPV6);
1084                 skb->csum = 0;
1085
1086                 __skb_queue_tail(&sk->sk_write_queue, skb);
1087         } else if (skb_is_gso(skb)) {
1088                 goto append;
1089         }
1090
1091         skb->ip_summed = CHECKSUM_PARTIAL;
1092         /* Specify the length of each IPv6 datagram fragment.
1093          * It has to be a multiple of 8.
1094          */
1095         skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1096                                      sizeof(struct frag_hdr)) & ~7;
1097         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1098         ipv6_select_ident(&fhdr, rt);
1099         skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1100
1101 append:
1102         return skb_append_datato_frags(sk, skb, getfrag, from,
1103                                        (length - transhdrlen));
1104 }
1105
1106 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1107                                                gfp_t gfp)
1108 {
1109         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1110 }
1111
1112 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1113                                                 gfp_t gfp)
1114 {
1115         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1116 }
1117
1118 static void ip6_append_data_mtu(unsigned int *mtu,
1119                                 int *maxfraglen,
1120                                 unsigned int fragheaderlen,
1121                                 struct sk_buff *skb,
1122                                 struct rt6_info *rt,
1123                                 unsigned int orig_mtu)
1124 {
1125         if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1126                 if (skb == NULL) {
1127                         /* first fragment, reserve header_len */
1128                         *mtu = orig_mtu - rt->dst.header_len;
1129
1130                 } else {
1131                         /*
1132                          * this fragment is not first, the headers
1133                          * space is regarded as data space.
1134                          */
1135                         *mtu = orig_mtu;
1136                 }
1137                 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1138                               + fragheaderlen - sizeof(struct frag_hdr);
1139         }
1140 }
1141
1142 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1143         int offset, int len, int odd, struct sk_buff *skb),
1144         void *from, int length, int transhdrlen,
1145         int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1146         struct rt6_info *rt, unsigned int flags, int dontfrag)
1147 {
1148         struct inet_sock *inet = inet_sk(sk);
1149         struct ipv6_pinfo *np = inet6_sk(sk);
1150         struct inet_cork *cork;
1151         struct sk_buff *skb, *skb_prev = NULL;
1152         unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1153         int exthdrlen;
1154         int dst_exthdrlen;
1155         int hh_len;
1156         int copy;
1157         int err;
1158         int offset = 0;
1159         __u8 tx_flags = 0;
1160
1161         if (flags&MSG_PROBE)
1162                 return 0;
1163         cork = &inet->cork.base;
1164         if (skb_queue_empty(&sk->sk_write_queue)) {
1165                 /*
1166                  * setup for corking
1167                  */
1168                 if (opt) {
1169                         if (WARN_ON(np->cork.opt))
1170                                 return -EINVAL;
1171
1172                         np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1173                         if (unlikely(np->cork.opt == NULL))
1174                                 return -ENOBUFS;
1175
1176                         np->cork.opt->tot_len = opt->tot_len;
1177                         np->cork.opt->opt_flen = opt->opt_flen;
1178                         np->cork.opt->opt_nflen = opt->opt_nflen;
1179
1180                         np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1181                                                             sk->sk_allocation);
1182                         if (opt->dst0opt && !np->cork.opt->dst0opt)
1183                                 return -ENOBUFS;
1184
1185                         np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1186                                                             sk->sk_allocation);
1187                         if (opt->dst1opt && !np->cork.opt->dst1opt)
1188                                 return -ENOBUFS;
1189
1190                         np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1191                                                            sk->sk_allocation);
1192                         if (opt->hopopt && !np->cork.opt->hopopt)
1193                                 return -ENOBUFS;
1194
1195                         np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1196                                                             sk->sk_allocation);
1197                         if (opt->srcrt && !np->cork.opt->srcrt)
1198                                 return -ENOBUFS;
1199
1200                         /* need source address above miyazawa*/
1201                 }
1202                 dst_hold(&rt->dst);
1203                 cork->dst = &rt->dst;
1204                 inet->cork.fl.u.ip6 = *fl6;
1205                 np->cork.hop_limit = hlimit;
1206                 np->cork.tclass = tclass;
1207                 if (rt->dst.flags & DST_XFRM_TUNNEL)
1208                         mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1209                               rt->dst.dev->mtu : dst_mtu(&rt->dst);
1210                 else
1211                         mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1212                               rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1213                 if (np->frag_size < mtu) {
1214                         if (np->frag_size)
1215                                 mtu = np->frag_size;
1216                 }
1217                 cork->fragsize = mtu;
1218                 if (dst_allfrag(rt->dst.path))
1219                         cork->flags |= IPCORK_ALLFRAG;
1220                 cork->length = 0;
1221                 exthdrlen = (opt ? opt->opt_flen : 0);
1222                 length += exthdrlen;
1223                 transhdrlen += exthdrlen;
1224                 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1225         } else {
1226                 rt = (struct rt6_info *)cork->dst;
1227                 fl6 = &inet->cork.fl.u.ip6;
1228                 opt = np->cork.opt;
1229                 transhdrlen = 0;
1230                 exthdrlen = 0;
1231                 dst_exthdrlen = 0;
1232                 mtu = cork->fragsize;
1233         }
1234         orig_mtu = mtu;
1235
1236         hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1237
1238         fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1239                         (opt ? opt->opt_nflen : 0);
1240         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1241                      sizeof(struct frag_hdr);
1242
1243         if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1244                 unsigned int maxnonfragsize, headersize;
1245
1246                 headersize = sizeof(struct ipv6hdr) +
1247                              (opt ? opt->opt_flen + opt->opt_nflen : 0) +
1248                              (dst_allfrag(&rt->dst) ?
1249                               sizeof(struct frag_hdr) : 0) +
1250                              rt->rt6i_nfheader_len;
1251
1252                 if (ip6_sk_ignore_df(sk))
1253                         maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1254                 else
1255                         maxnonfragsize = mtu;
1256
1257                 /* dontfrag active */
1258                 if ((cork->length + length > mtu - headersize) && dontfrag &&
1259                     (sk->sk_protocol == IPPROTO_UDP ||
1260                      sk->sk_protocol == IPPROTO_RAW)) {
1261                         ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1262                                                    sizeof(struct ipv6hdr));
1263                         goto emsgsize;
1264                 }
1265
1266                 if (cork->length + length > maxnonfragsize - headersize) {
1267 emsgsize:
1268                         ipv6_local_error(sk, EMSGSIZE, fl6,
1269                                          mtu - headersize +
1270                                          sizeof(struct ipv6hdr));
1271                         return -EMSGSIZE;
1272                 }
1273         }
1274
1275         if (sk->sk_type == SOCK_DGRAM || sk->sk_type == SOCK_RAW)
1276                 sock_tx_timestamp(sk, &tx_flags);
1277
1278         /*
1279          * Let's try using as much space as possible.
1280          * Use MTU if total length of the message fits into the MTU.
1281          * Otherwise, we need to reserve fragment header and
1282          * fragment alignment (= 8-15 octects, in total).
1283          *
1284          * Note that we may need to "move" the data from the tail of
1285          * of the buffer to the new fragment when we split
1286          * the message.
1287          *
1288          * FIXME: It may be fragmented into multiple chunks
1289          *        at once if non-fragmentable extension headers
1290          *        are too large.
1291          * --yoshfuji
1292          */
1293
1294         skb = skb_peek_tail(&sk->sk_write_queue);
1295         cork->length += length;
1296         if (((length > mtu) ||
1297              (skb && skb_is_gso(skb))) &&
1298             (sk->sk_protocol == IPPROTO_UDP) &&
1299             (rt->dst.dev->features & NETIF_F_UFO)) {
1300                 err = ip6_ufo_append_data(sk, getfrag, from, length,
1301                                           hh_len, fragheaderlen,
1302                                           transhdrlen, mtu, flags, rt);
1303                 if (err)
1304                         goto error;
1305                 return 0;
1306         }
1307
1308         if (!skb)
1309                 goto alloc_new_skb;
1310
1311         while (length > 0) {
1312                 /* Check if the remaining data fits into current packet. */
1313                 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1314                 if (copy < length)
1315                         copy = maxfraglen - skb->len;
1316
1317                 if (copy <= 0) {
1318                         char *data;
1319                         unsigned int datalen;
1320                         unsigned int fraglen;
1321                         unsigned int fraggap;
1322                         unsigned int alloclen;
1323 alloc_new_skb:
1324                         /* There's no room in the current skb */
1325                         if (skb)
1326                                 fraggap = skb->len - maxfraglen;
1327                         else
1328                                 fraggap = 0;
1329                         /* update mtu and maxfraglen if necessary */
1330                         if (skb == NULL || skb_prev == NULL)
1331                                 ip6_append_data_mtu(&mtu, &maxfraglen,
1332                                                     fragheaderlen, skb, rt,
1333                                                     orig_mtu);
1334
1335                         skb_prev = skb;
1336
1337                         /*
1338                          * If remaining data exceeds the mtu,
1339                          * we know we need more fragment(s).
1340                          */
1341                         datalen = length + fraggap;
1342
1343                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1344                                 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1345                         if ((flags & MSG_MORE) &&
1346                             !(rt->dst.dev->features&NETIF_F_SG))
1347                                 alloclen = mtu;
1348                         else
1349                                 alloclen = datalen + fragheaderlen;
1350
1351                         alloclen += dst_exthdrlen;
1352
1353                         if (datalen != length + fraggap) {
1354                                 /*
1355                                  * this is not the last fragment, the trailer
1356                                  * space is regarded as data space.
1357                                  */
1358                                 datalen += rt->dst.trailer_len;
1359                         }
1360
1361                         alloclen += rt->dst.trailer_len;
1362                         fraglen = datalen + fragheaderlen;
1363
1364                         /*
1365                          * We just reserve space for fragment header.
1366                          * Note: this may be overallocation if the message
1367                          * (without MSG_MORE) fits into the MTU.
1368                          */
1369                         alloclen += sizeof(struct frag_hdr);
1370
1371                         if (transhdrlen) {
1372                                 skb = sock_alloc_send_skb(sk,
1373                                                 alloclen + hh_len,
1374                                                 (flags & MSG_DONTWAIT), &err);
1375                         } else {
1376                                 skb = NULL;
1377                                 if (atomic_read(&sk->sk_wmem_alloc) <=
1378                                     2 * sk->sk_sndbuf)
1379                                         skb = sock_wmalloc(sk,
1380                                                            alloclen + hh_len, 1,
1381                                                            sk->sk_allocation);
1382                                 if (unlikely(skb == NULL))
1383                                         err = -ENOBUFS;
1384                         }
1385                         if (skb == NULL)
1386                                 goto error;
1387                         /*
1388                          *      Fill in the control structures
1389                          */
1390                         skb->protocol = htons(ETH_P_IPV6);
1391                         skb->ip_summed = CHECKSUM_NONE;
1392                         skb->csum = 0;
1393                         /* reserve for fragmentation and ipsec header */
1394                         skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1395                                     dst_exthdrlen);
1396
1397                         /* Only the initial fragment is time stamped */
1398                         skb_shinfo(skb)->tx_flags = tx_flags;
1399                         tx_flags = 0;
1400
1401                         /*
1402                          *      Find where to start putting bytes
1403                          */
1404                         data = skb_put(skb, fraglen);
1405                         skb_set_network_header(skb, exthdrlen);
1406                         data += fragheaderlen;
1407                         skb->transport_header = (skb->network_header +
1408                                                  fragheaderlen);
1409                         if (fraggap) {
1410                                 skb->csum = skb_copy_and_csum_bits(
1411                                         skb_prev, maxfraglen,
1412                                         data + transhdrlen, fraggap, 0);
1413                                 skb_prev->csum = csum_sub(skb_prev->csum,
1414                                                           skb->csum);
1415                                 data += fraggap;
1416                                 pskb_trim_unique(skb_prev, maxfraglen);
1417                         }
1418                         copy = datalen - transhdrlen - fraggap;
1419
1420                         if (copy < 0) {
1421                                 err = -EINVAL;
1422                                 kfree_skb(skb);
1423                                 goto error;
1424                         } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1425                                 err = -EFAULT;
1426                                 kfree_skb(skb);
1427                                 goto error;
1428                         }
1429
1430                         offset += copy;
1431                         length -= datalen - fraggap;
1432                         transhdrlen = 0;
1433                         exthdrlen = 0;
1434                         dst_exthdrlen = 0;
1435
1436                         /*
1437                          * Put the packet on the pending queue
1438                          */
1439                         __skb_queue_tail(&sk->sk_write_queue, skb);
1440                         continue;
1441                 }
1442
1443                 if (copy > length)
1444                         copy = length;
1445
1446                 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1447                         unsigned int off;
1448
1449                         off = skb->len;
1450                         if (getfrag(from, skb_put(skb, copy),
1451                                                 offset, copy, off, skb) < 0) {
1452                                 __skb_trim(skb, off);
1453                                 err = -EFAULT;
1454                                 goto error;
1455                         }
1456                 } else {
1457                         int i = skb_shinfo(skb)->nr_frags;
1458                         struct page_frag *pfrag = sk_page_frag(sk);
1459
1460                         err = -ENOMEM;
1461                         if (!sk_page_frag_refill(sk, pfrag))
1462                                 goto error;
1463
1464                         if (!skb_can_coalesce(skb, i, pfrag->page,
1465                                               pfrag->offset)) {
1466                                 err = -EMSGSIZE;
1467                                 if (i == MAX_SKB_FRAGS)
1468                                         goto error;
1469
1470                                 __skb_fill_page_desc(skb, i, pfrag->page,
1471                                                      pfrag->offset, 0);
1472                                 skb_shinfo(skb)->nr_frags = ++i;
1473                                 get_page(pfrag->page);
1474                         }
1475                         copy = min_t(int, copy, pfrag->size - pfrag->offset);
1476                         if (getfrag(from,
1477                                     page_address(pfrag->page) + pfrag->offset,
1478                                     offset, copy, skb->len, skb) < 0)
1479                                 goto error_efault;
1480
1481                         pfrag->offset += copy;
1482                         skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1483                         skb->len += copy;
1484                         skb->data_len += copy;
1485                         skb->truesize += copy;
1486                         atomic_add(copy, &sk->sk_wmem_alloc);
1487                 }
1488                 offset += copy;
1489                 length -= copy;
1490         }
1491
1492         return 0;
1493
1494 error_efault:
1495         err = -EFAULT;
1496 error:
1497         cork->length -= length;
1498         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1499         return err;
1500 }
1501 EXPORT_SYMBOL_GPL(ip6_append_data);
1502
1503 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1504 {
1505         if (np->cork.opt) {
1506                 kfree(np->cork.opt->dst0opt);
1507                 kfree(np->cork.opt->dst1opt);
1508                 kfree(np->cork.opt->hopopt);
1509                 kfree(np->cork.opt->srcrt);
1510                 kfree(np->cork.opt);
1511                 np->cork.opt = NULL;
1512         }
1513
1514         if (inet->cork.base.dst) {
1515                 dst_release(inet->cork.base.dst);
1516                 inet->cork.base.dst = NULL;
1517                 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1518         }
1519         memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1520 }
1521
1522 int ip6_push_pending_frames(struct sock *sk)
1523 {
1524         struct sk_buff *skb, *tmp_skb;
1525         struct sk_buff **tail_skb;
1526         struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1527         struct inet_sock *inet = inet_sk(sk);
1528         struct ipv6_pinfo *np = inet6_sk(sk);
1529         struct net *net = sock_net(sk);
1530         struct ipv6hdr *hdr;
1531         struct ipv6_txoptions *opt = np->cork.opt;
1532         struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1533         struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1534         unsigned char proto = fl6->flowi6_proto;
1535         int err = 0;
1536
1537         if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1538                 goto out;
1539         tail_skb = &(skb_shinfo(skb)->frag_list);
1540
1541         /* move skb->data to ip header from ext header */
1542         if (skb->data < skb_network_header(skb))
1543                 __skb_pull(skb, skb_network_offset(skb));
1544         while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1545                 __skb_pull(tmp_skb, skb_network_header_len(skb));
1546                 *tail_skb = tmp_skb;
1547                 tail_skb = &(tmp_skb->next);
1548                 skb->len += tmp_skb->len;
1549                 skb->data_len += tmp_skb->len;
1550                 skb->truesize += tmp_skb->truesize;
1551                 tmp_skb->destructor = NULL;
1552                 tmp_skb->sk = NULL;
1553         }
1554
1555         /* Allow local fragmentation. */
1556         skb->ignore_df = ip6_sk_ignore_df(sk);
1557
1558         *final_dst = fl6->daddr;
1559         __skb_pull(skb, skb_network_header_len(skb));
1560         if (opt && opt->opt_flen)
1561                 ipv6_push_frag_opts(skb, opt, &proto);
1562         if (opt && opt->opt_nflen)
1563                 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1564
1565         skb_push(skb, sizeof(struct ipv6hdr));
1566         skb_reset_network_header(skb);
1567         hdr = ipv6_hdr(skb);
1568
1569         ip6_flow_hdr(hdr, np->cork.tclass,
1570                      ip6_make_flowlabel(net, skb, fl6->flowlabel,
1571                                         np->autoflowlabel));
1572         hdr->hop_limit = np->cork.hop_limit;
1573         hdr->nexthdr = proto;
1574         hdr->saddr = fl6->saddr;
1575         hdr->daddr = *final_dst;
1576
1577         skb->priority = sk->sk_priority;
1578         skb->mark = sk->sk_mark;
1579
1580         skb_dst_set(skb, dst_clone(&rt->dst));
1581         IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1582         if (proto == IPPROTO_ICMPV6) {
1583                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1584
1585                 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
1586                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1587         }
1588
1589         err = ip6_local_out(skb);
1590         if (err) {
1591                 if (err > 0)
1592                         err = net_xmit_errno(err);
1593                 if (err)
1594                         goto error;
1595         }
1596
1597 out:
1598         ip6_cork_release(inet, np);
1599         return err;
1600 error:
1601         IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1602         goto out;
1603 }
1604 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1605
1606 void ip6_flush_pending_frames(struct sock *sk)
1607 {
1608         struct sk_buff *skb;
1609
1610         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1611                 if (skb_dst(skb))
1612                         IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1613                                       IPSTATS_MIB_OUTDISCARDS);
1614                 kfree_skb(skb);
1615         }
1616
1617         ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1618 }
1619 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);