ip6_output.c 35 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382
  1. /*
  2. * IPv6 output functions
  3. * Linux INET6 implementation
  4. *
  5. * Authors:
  6. * Pedro Roque <roque@di.fc.ul.pt>
  7. *
  8. * $Id: ip6_output.c,v 1.1.1.1 2007/06/12 07:27:14 eyryu Exp $
  9. *
  10. * Based on linux/net/ipv4/ip_output.c
  11. *
  12. * This program is free software; you can redistribute it and/or
  13. * modify it under the terms of the GNU General Public License
  14. * as published by the Free Software Foundation; either version
  15. * 2 of the License, or (at your option) any later version.
  16. *
  17. * Changes:
  18. * A.N.Kuznetsov : airthmetics in fragmentation.
  19. * extension headers are implemented.
  20. * route changes now work.
  21. * ip6_forward does not confuse sniffers.
  22. * etc.
  23. *
  24. * H. von Brand : Added missing #include <linux/string.h>
  25. * Imran Patel : frag id should be in NBO
  26. * Kazunori MIYAZAWA @USAGI
  27. * : add ip6_append_data and related functions
  28. * for datagram xmit
  29. */
  30. #include <linux/errno.h>
  31. #include <linux/types.h>
  32. #include <linux/string.h>
  33. #include <linux/socket.h>
  34. #include <linux/net.h>
  35. #include <linux/netdevice.h>
  36. #include <linux/if_arp.h>
  37. #include <linux/in6.h>
  38. #include <linux/tcp.h>
  39. #include <linux/route.h>
  40. #include <linux/module.h>
  41. #include <linux/netfilter.h>
  42. #include <linux/netfilter_ipv6.h>
  43. #include <net/sock.h>
  44. #include <net/snmp.h>
  45. #include <net/ipv6.h>
  46. #include <net/ndisc.h>
  47. #include <net/protocol.h>
  48. #include <net/ip6_route.h>
  49. #include <net/addrconf.h>
  50. #include <net/rawv6.h>
  51. #include <net/icmp.h>
  52. #include <net/xfrm.h>
  53. #include <net/checksum.h>
  54. static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
  55. static __inline__ void ipv6_select_ident(struct sk_buff *skb, struct frag_hdr *fhdr)
  56. {
  57. static u32 ipv6_fragmentation_id = 1;
  58. static DEFINE_SPINLOCK(ip6_id_lock);
  59. spin_lock_bh(&ip6_id_lock);
  60. fhdr->identification = htonl(ipv6_fragmentation_id);
  61. if (++ipv6_fragmentation_id == 0)
  62. ipv6_fragmentation_id = 1;
  63. spin_unlock_bh(&ip6_id_lock);
  64. }
  65. static inline int ip6_output_finish(struct sk_buff *skb)
  66. {
  67. struct dst_entry *dst = skb->dst;
  68. if (dst->hh)
  69. return neigh_hh_output(dst->hh, skb);
  70. else if (dst->neighbour)
  71. return dst->neighbour->output(skb);
  72. IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
  73. kfree_skb(skb);
  74. return -EINVAL;
  75. }
  76. /* dev_loopback_xmit for use with netfilter. */
  77. static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
  78. {
  79. newskb->mac.raw = newskb->data;
  80. __skb_pull(newskb, newskb->nh.raw - newskb->data);
  81. newskb->pkt_type = PACKET_LOOPBACK;
  82. newskb->ip_summed = CHECKSUM_UNNECESSARY;
  83. BUG_TRAP(newskb->dst);
  84. netif_rx(newskb);
  85. return 0;
  86. }
  87. static int ip6_output2(struct sk_buff *skb)
  88. {
  89. struct dst_entry *dst = skb->dst;
  90. struct net_device *dev = dst->dev;
  91. skb->protocol = htons(ETH_P_IPV6);
  92. skb->dev = dev;
  93. if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr)) {
  94. struct ipv6_pinfo* np = skb->sk ? inet6_sk(skb->sk) : NULL;
  95. struct inet6_dev *idev = ip6_dst_idev(skb->dst);
  96. if (!(dev->flags & IFF_LOOPBACK) && (!np || np->mc_loop) &&
  97. ipv6_chk_mcast_addr(dev, &skb->nh.ipv6h->daddr,
  98. &skb->nh.ipv6h->saddr)) {
  99. struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
  100. /* Do not check for IFF_ALLMULTI; multicast routing
  101. is not supported in any case.
  102. */
  103. if (newskb)
  104. NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, newskb, NULL,
  105. newskb->dev,
  106. ip6_dev_loopback_xmit);
  107. if (skb->nh.ipv6h->hop_limit == 0) {
  108. IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
  109. kfree_skb(skb);
  110. return 0;
  111. }
  112. }
  113. IP6_INC_STATS(idev, IPSTATS_MIB_OUTMCASTPKTS);
  114. }
  115. return NF_HOOK(PF_INET6, NF_IP6_POST_ROUTING, skb,NULL, skb->dev,ip6_output_finish);
  116. }
  117. int ip6_output(struct sk_buff *skb)
  118. {
  119. if ((skb->len > dst_mtu(skb->dst) && !skb_is_gso(skb)) ||
  120. dst_allfrag(skb->dst))
  121. return ip6_fragment(skb, ip6_output2);
  122. else
  123. return ip6_output2(skb);
  124. }
  125. /*
  126. * xmit an sk_buff (used by TCP)
  127. */
  128. int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
  129. struct ipv6_txoptions *opt, int ipfragok)
  130. {
  131. struct ipv6_pinfo *np = inet6_sk(sk);
  132. struct in6_addr *first_hop = &fl->fl6_dst;
  133. struct dst_entry *dst = skb->dst;
  134. struct ipv6hdr *hdr;
  135. u8 proto = fl->proto;
  136. int seg_len = skb->len;
  137. int hlimit, tclass;
  138. u32 mtu;
  139. if (opt) {
  140. int head_room;
  141. /* First: exthdrs may take lots of space (~8K for now)
  142. MAX_HEADER is not enough.
  143. */
  144. head_room = opt->opt_nflen + opt->opt_flen;
  145. seg_len += head_room;
  146. head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
  147. if (skb_headroom(skb) < head_room) {
  148. struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
  149. if (skb2 == NULL) {
  150. IP6_INC_STATS(ip6_dst_idev(skb->dst),
  151. IPSTATS_MIB_OUTDISCARDS);
  152. kfree_skb(skb);
  153. return -ENOBUFS;
  154. }
  155. kfree_skb(skb);
  156. skb = skb2;
  157. if (sk)
  158. skb_set_owner_w(skb, sk);
  159. }
  160. if (opt->opt_flen)
  161. ipv6_push_frag_opts(skb, opt, &proto);
  162. if (opt->opt_nflen)
  163. ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
  164. }
  165. hdr = skb->nh.ipv6h = (struct ipv6hdr*)skb_push(skb, sizeof(struct ipv6hdr));
  166. /*
  167. * Fill in the IPv6 header
  168. */
  169. hlimit = -1;
  170. if (np)
  171. hlimit = np->hop_limit;
  172. if (hlimit < 0)
  173. hlimit = dst_metric(dst, RTAX_HOPLIMIT);
  174. if (hlimit < 0)
  175. hlimit = ipv6_get_hoplimit(dst->dev);
  176. tclass = -1;
  177. if (np)
  178. tclass = np->tclass;
  179. if (tclass < 0)
  180. tclass = 0;
  181. *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
  182. hdr->payload_len = htons(seg_len);
  183. hdr->nexthdr = proto;
  184. hdr->hop_limit = hlimit;
  185. ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
  186. ipv6_addr_copy(&hdr->daddr, first_hop);
  187. skb->priority = sk->sk_priority;
  188. mtu = dst_mtu(dst);
  189. if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
  190. IP6_INC_STATS(ip6_dst_idev(skb->dst),
  191. IPSTATS_MIB_OUTREQUESTS);
  192. return NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, dst->dev,
  193. dst_output);
  194. }
  195. if (net_ratelimit())
  196. printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
  197. skb->dev = dst->dev;
  198. icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
  199. IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
  200. kfree_skb(skb);
  201. return -EMSGSIZE;
  202. }
  203. /*
  204. * To avoid extra problems ND packets are send through this
  205. * routine. It's code duplication but I really want to avoid
  206. * extra checks since ipv6_build_header is used by TCP (which
  207. * is for us performance critical)
  208. */
  209. int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
  210. struct in6_addr *saddr, struct in6_addr *daddr,
  211. int proto, int len)
  212. {
  213. struct ipv6_pinfo *np = inet6_sk(sk);
  214. struct ipv6hdr *hdr;
  215. int totlen;
  216. skb->protocol = htons(ETH_P_IPV6);
  217. skb->dev = dev;
  218. totlen = len + sizeof(struct ipv6hdr);
  219. hdr = (struct ipv6hdr *) skb_put(skb, sizeof(struct ipv6hdr));
  220. skb->nh.ipv6h = hdr;
  221. *(__be32*)hdr = htonl(0x60000000);
  222. hdr->payload_len = htons(len);
  223. hdr->nexthdr = proto;
  224. hdr->hop_limit = np->hop_limit;
  225. ipv6_addr_copy(&hdr->saddr, saddr);
  226. ipv6_addr_copy(&hdr->daddr, daddr);
  227. return 0;
  228. }
  229. static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
  230. {
  231. struct ip6_ra_chain *ra;
  232. struct sock *last = NULL;
  233. read_lock(&ip6_ra_lock);
  234. for (ra = ip6_ra_chain; ra; ra = ra->next) {
  235. struct sock *sk = ra->sk;
  236. if (sk && ra->sel == sel &&
  237. (!sk->sk_bound_dev_if ||
  238. sk->sk_bound_dev_if == skb->dev->ifindex)) {
  239. if (last) {
  240. struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
  241. if (skb2)
  242. rawv6_rcv(last, skb2);
  243. }
  244. last = sk;
  245. }
  246. }
  247. if (last) {
  248. rawv6_rcv(last, skb);
  249. read_unlock(&ip6_ra_lock);
  250. return 1;
  251. }
  252. read_unlock(&ip6_ra_lock);
  253. return 0;
  254. }
  255. static int ip6_forward_proxy_check(struct sk_buff *skb)
  256. {
  257. struct ipv6hdr *hdr = skb->nh.ipv6h;
  258. u8 nexthdr = hdr->nexthdr;
  259. int offset;
  260. if (ipv6_ext_hdr(nexthdr)) {
  261. offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
  262. if (offset < 0)
  263. return 0;
  264. } else
  265. offset = sizeof(struct ipv6hdr);
  266. if (nexthdr == IPPROTO_ICMPV6) {
  267. struct icmp6hdr *icmp6;
  268. if (!pskb_may_pull(skb, skb->nh.raw + offset + 1 - skb->data))
  269. return 0;
  270. icmp6 = (struct icmp6hdr *)(skb->nh.raw + offset);
  271. switch (icmp6->icmp6_type) {
  272. case NDISC_ROUTER_SOLICITATION:
  273. case NDISC_ROUTER_ADVERTISEMENT:
  274. case NDISC_NEIGHBOUR_SOLICITATION:
  275. case NDISC_NEIGHBOUR_ADVERTISEMENT:
  276. case NDISC_REDIRECT:
  277. /* For reaction involving unicast neighbor discovery
  278. * message destined to the proxied address, pass it to
  279. * input function.
  280. */
  281. return 1;
  282. default:
  283. break;
  284. }
  285. }
  286. /*
  287. * The proxying router can't forward traffic sent to a link-local
  288. * address, so signal the sender and discard the packet. This
  289. * behavior is clarified by the MIPv6 specification.
  290. */
  291. if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
  292. dst_link_failure(skb);
  293. return -1;
  294. }
  295. return 0;
  296. }
  297. static inline int ip6_forward_finish(struct sk_buff *skb)
  298. {
  299. return dst_output(skb);
  300. }
  301. int ip6_forward(struct sk_buff *skb)
  302. {
  303. struct dst_entry *dst = skb->dst;
  304. struct ipv6hdr *hdr = skb->nh.ipv6h;
  305. struct inet6_skb_parm *opt = IP6CB(skb);
  306. if (ipv6_devconf.forwarding == 0)
  307. goto error;
  308. if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
  309. IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
  310. goto drop;
  311. }
  312. skb->ip_summed = CHECKSUM_NONE;
  313. /*
  314. * We DO NOT make any processing on
  315. * RA packets, pushing them to user level AS IS
  316. * without ane WARRANTY that application will be able
  317. * to interpret them. The reason is that we
  318. * cannot make anything clever here.
  319. *
  320. * We are not end-node, so that if packet contains
  321. * AH/ESP, we cannot make anything.
  322. * Defragmentation also would be mistake, RA packets
  323. * cannot be fragmented, because there is no warranty
  324. * that different fragments will go along one path. --ANK
  325. */
  326. if (opt->ra) {
  327. u8 *ptr = skb->nh.raw + opt->ra;
  328. if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
  329. return 0;
  330. }
  331. /*
  332. * check and decrement ttl
  333. */
  334. if (hdr->hop_limit <= 1) {
  335. /* Force OUTPUT device used as source address */
  336. skb->dev = dst->dev;
  337. icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
  338. 0, skb->dev);
  339. IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
  340. kfree_skb(skb);
  341. return -ETIMEDOUT;
  342. }
  343. /* XXX: idev->cnf.proxy_ndp? */
  344. if (ipv6_devconf.proxy_ndp &&
  345. pneigh_lookup(&nd_tbl, &hdr->daddr, skb->dev, 0)) {
  346. int proxied = ip6_forward_proxy_check(skb);
  347. if (proxied > 0)
  348. return ip6_input(skb);
  349. else if (proxied < 0) {
  350. IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
  351. goto drop;
  352. }
  353. }
  354. if (!xfrm6_route_forward(skb)) {
  355. IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
  356. goto drop;
  357. }
  358. dst = skb->dst;
  359. /* IPv6 specs say nothing about it, but it is clear that we cannot
  360. send redirects to source routed frames.
  361. */
  362. if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0) {
  363. struct in6_addr *target = NULL;
  364. struct rt6_info *rt;
  365. struct neighbour *n = dst->neighbour;
  366. /*
  367. * incoming and outgoing devices are the same
  368. * send a redirect.
  369. */
  370. rt = (struct rt6_info *) dst;
  371. if ((rt->rt6i_flags & RTF_GATEWAY))
  372. target = (struct in6_addr*)&n->primary_key;
  373. else
  374. target = &hdr->daddr;
  375. /* Limit redirects both by destination (here)
  376. and by source (inside ndisc_send_redirect)
  377. */
  378. if (xrlim_allow(dst, 1*HZ))
  379. ndisc_send_redirect(skb, n, target);
  380. } else {
  381. int addrtype = ipv6_addr_type(&hdr->saddr);
  382. /* This check is security critical. */
  383. if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))
  384. goto error;
  385. if (addrtype & IPV6_ADDR_LINKLOCAL) {
  386. icmpv6_send(skb, ICMPV6_DEST_UNREACH,
  387. ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
  388. goto error;
  389. }
  390. }
  391. if (skb->len > dst_mtu(dst)) {
  392. /* Again, force OUTPUT device used as source address */
  393. skb->dev = dst->dev;
  394. icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, dst_mtu(dst), skb->dev);
  395. IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
  396. IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
  397. kfree_skb(skb);
  398. return -EMSGSIZE;
  399. }
  400. if (skb_cow(skb, dst->dev->hard_header_len)) {
  401. IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
  402. goto drop;
  403. }
  404. hdr = skb->nh.ipv6h;
  405. /* Mangling hops number delayed to point after skb COW */
  406. hdr->hop_limit--;
  407. IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
  408. return NF_HOOK(PF_INET6,NF_IP6_FORWARD, skb, skb->dev, dst->dev, ip6_forward_finish);
  409. error:
  410. IP6_INC_STATS_BH(ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
  411. drop:
  412. kfree_skb(skb);
  413. return -EINVAL;
  414. }
  415. static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
  416. {
  417. to->pkt_type = from->pkt_type;
  418. to->priority = from->priority;
  419. to->protocol = from->protocol;
  420. dst_release(to->dst);
  421. to->dst = dst_clone(from->dst);
  422. to->dev = from->dev;
  423. to->mark = from->mark;
  424. #ifdef CONFIG_NET_SCHED
  425. to->tc_index = from->tc_index;
  426. #endif
  427. #ifdef CONFIG_NETFILTER
  428. /* Connection association is same as pre-frag packet */
  429. nf_conntrack_put(to->nfct);
  430. to->nfct = from->nfct;
  431. nf_conntrack_get(to->nfct);
  432. to->nfctinfo = from->nfctinfo;
  433. #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
  434. nf_conntrack_put_reasm(to->nfct_reasm);
  435. to->nfct_reasm = from->nfct_reasm;
  436. nf_conntrack_get_reasm(to->nfct_reasm);
  437. #endif
  438. #ifdef CONFIG_BRIDGE_NETFILTER
  439. nf_bridge_put(to->nf_bridge);
  440. to->nf_bridge = from->nf_bridge;
  441. nf_bridge_get(to->nf_bridge);
  442. #endif
  443. #endif
  444. skb_copy_secmark(to, from);
  445. }
  446. int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
  447. {
  448. u16 offset = sizeof(struct ipv6hdr);
  449. struct ipv6_opt_hdr *exthdr = (struct ipv6_opt_hdr*)(skb->nh.ipv6h + 1);
  450. unsigned int packet_len = skb->tail - skb->nh.raw;
  451. int found_rhdr = 0;
  452. *nexthdr = &skb->nh.ipv6h->nexthdr;
  453. while (offset + 1 <= packet_len) {
  454. switch (**nexthdr) {
  455. case NEXTHDR_HOP:
  456. break;
  457. case NEXTHDR_ROUTING:
  458. found_rhdr = 1;
  459. break;
  460. case NEXTHDR_DEST:
  461. #ifdef CONFIG_IPV6_MIP6
  462. if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
  463. break;
  464. #endif
  465. if (found_rhdr)
  466. return offset;
  467. break;
  468. default :
  469. return offset;
  470. }
  471. offset += ipv6_optlen(exthdr);
  472. *nexthdr = &exthdr->nexthdr;
  473. exthdr = (struct ipv6_opt_hdr*)(skb->nh.raw + offset);
  474. }
  475. return offset;
  476. }
  477. EXPORT_SYMBOL_GPL(ip6_find_1stfragopt);
  478. static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
  479. {
  480. struct net_device *dev;
  481. struct sk_buff *frag;
  482. struct rt6_info *rt = (struct rt6_info*)skb->dst;
  483. struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
  484. struct ipv6hdr *tmp_hdr;
  485. struct frag_hdr *fh;
  486. unsigned int mtu, hlen, left, len;
  487. __be32 frag_id = 0;
  488. int ptr, offset = 0, err=0;
  489. u8 *prevhdr, nexthdr = 0;
  490. dev = rt->u.dst.dev;
  491. hlen = ip6_find_1stfragopt(skb, &prevhdr);
  492. nexthdr = *prevhdr;
  493. mtu = dst_mtu(&rt->u.dst);
  494. if (np && np->frag_size < mtu) {
  495. if (np->frag_size)
  496. mtu = np->frag_size;
  497. }
  498. mtu -= hlen + sizeof(struct frag_hdr);
  499. if (skb_shinfo(skb)->frag_list) {
  500. int first_len = skb_pagelen(skb);
  501. if (first_len - hlen > mtu ||
  502. ((first_len - hlen) & 7) ||
  503. skb_cloned(skb))
  504. goto slow_path;
  505. for (frag = skb_shinfo(skb)->frag_list; frag; frag = frag->next) {
  506. /* Correct geometry. */
  507. if (frag->len > mtu ||
  508. ((frag->len & 7) && frag->next) ||
  509. skb_headroom(frag) < hlen)
  510. goto slow_path;
  511. /* Partially cloned skb? */
  512. if (skb_shared(frag))
  513. goto slow_path;
  514. BUG_ON(frag->sk);
  515. if (skb->sk) {
  516. sock_hold(skb->sk);
  517. frag->sk = skb->sk;
  518. frag->destructor = sock_wfree;
  519. skb->truesize -= frag->truesize;
  520. }
  521. }
  522. err = 0;
  523. offset = 0;
  524. frag = skb_shinfo(skb)->frag_list;
  525. skb_shinfo(skb)->frag_list = NULL;
  526. /* BUILD HEADER */
  527. *prevhdr = NEXTHDR_FRAGMENT;
  528. tmp_hdr = kmemdup(skb->nh.raw, hlen, GFP_ATOMIC);
  529. if (!tmp_hdr) {
  530. IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGFAILS);
  531. return -ENOMEM;
  532. }
  533. __skb_pull(skb, hlen);
  534. fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
  535. skb->nh.raw = __skb_push(skb, hlen);
  536. memcpy(skb->nh.raw, tmp_hdr, hlen);
  537. ipv6_select_ident(skb, fh);
  538. fh->nexthdr = nexthdr;
  539. fh->reserved = 0;
  540. fh->frag_off = htons(IP6_MF);
  541. frag_id = fh->identification;
  542. first_len = skb_pagelen(skb);
  543. skb->data_len = first_len - skb_headlen(skb);
  544. skb->len = first_len;
  545. skb->nh.ipv6h->payload_len = htons(first_len - sizeof(struct ipv6hdr));
  546. dst_hold(&rt->u.dst);
  547. for (;;) {
  548. /* Prepare header of the next frame,
  549. * before previous one went down. */
  550. if (frag) {
  551. frag->ip_summed = CHECKSUM_NONE;
  552. frag->h.raw = frag->data;
  553. fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
  554. frag->nh.raw = __skb_push(frag, hlen);
  555. memcpy(frag->nh.raw, tmp_hdr, hlen);
  556. offset += skb->len - hlen - sizeof(struct frag_hdr);
  557. fh->nexthdr = nexthdr;
  558. fh->reserved = 0;
  559. fh->frag_off = htons(offset);
  560. if (frag->next != NULL)
  561. fh->frag_off |= htons(IP6_MF);
  562. fh->identification = frag_id;
  563. frag->nh.ipv6h->payload_len = htons(frag->len - sizeof(struct ipv6hdr));
  564. ip6_copy_metadata(frag, skb);
  565. }
  566. err = output(skb);
  567. if(!err)
  568. IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGCREATES);
  569. if (err || !frag)
  570. break;
  571. skb = frag;
  572. frag = skb->next;
  573. skb->next = NULL;
  574. }
  575. kfree(tmp_hdr);
  576. if (err == 0) {
  577. IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGOKS);
  578. dst_release(&rt->u.dst);
  579. return 0;
  580. }
  581. while (frag) {
  582. skb = frag->next;
  583. kfree_skb(frag);
  584. frag = skb;
  585. }
  586. IP6_INC_STATS(ip6_dst_idev(&rt->u.dst), IPSTATS_MIB_FRAGFAILS);
  587. dst_release(&rt->u.dst);
  588. return err;
  589. }
  590. slow_path:
  591. left = skb->len - hlen; /* Space per frame */
  592. ptr = hlen; /* Where to start from */
  593. /*
  594. * Fragment the datagram.
  595. */
  596. *prevhdr = NEXTHDR_FRAGMENT;
  597. /*
  598. * Keep copying data until we run out.
  599. */
  600. while(left > 0) {
  601. len = left;
  602. /* IF: it doesn't fit, use 'mtu' - the data space left */
  603. if (len > mtu)
  604. len = mtu;
  605. /* IF: we are not sending upto and including the packet end
  606. then align the next start on an eight byte boundary */
  607. if (len < left) {
  608. len &= ~7;
  609. }
  610. /*
  611. * Allocate buffer.
  612. */
  613. if ((frag = alloc_skb(len+hlen+sizeof(struct frag_hdr)+LL_RESERVED_SPACE(rt->u.dst.dev), GFP_ATOMIC)) == NULL) {
  614. NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
  615. IP6_INC_STATS(ip6_dst_idev(skb->dst),
  616. IPSTATS_MIB_FRAGFAILS);
  617. err = -ENOMEM;
  618. goto fail;
  619. }
  620. /*
  621. * Set up data on packet
  622. */
  623. ip6_copy_metadata(frag, skb);
  624. skb_reserve(frag, LL_RESERVED_SPACE(rt->u.dst.dev));
  625. skb_put(frag, len + hlen + sizeof(struct frag_hdr));
  626. frag->nh.raw = frag->data;
  627. fh = (struct frag_hdr*)(frag->data + hlen);
  628. frag->h.raw = frag->data + hlen + sizeof(struct frag_hdr);
  629. /*
  630. * Charge the memory for the fragment to any owner
  631. * it might possess
  632. */
  633. if (skb->sk)
  634. skb_set_owner_w(frag, skb->sk);
  635. /*
  636. * Copy the packet header into the new buffer.
  637. */
  638. memcpy(frag->nh.raw, skb->data, hlen);
  639. /*
  640. * Build fragment header.
  641. */
  642. fh->nexthdr = nexthdr;
  643. fh->reserved = 0;
  644. if (!frag_id) {
  645. ipv6_select_ident(skb, fh);
  646. frag_id = fh->identification;
  647. } else
  648. fh->identification = frag_id;
  649. /*
  650. * Copy a block of the IP datagram.
  651. */
  652. if (skb_copy_bits(skb, ptr, frag->h.raw, len))
  653. BUG();
  654. left -= len;
  655. fh->frag_off = htons(offset);
  656. if (left > 0)
  657. fh->frag_off |= htons(IP6_MF);
  658. frag->nh.ipv6h->payload_len = htons(frag->len - sizeof(struct ipv6hdr));
  659. ptr += len;
  660. offset += len;
  661. /*
  662. * Put this fragment into the sending queue.
  663. */
  664. err = output(frag);
  665. if (err)
  666. goto fail;
  667. IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_FRAGCREATES);
  668. }
  669. IP6_INC_STATS(ip6_dst_idev(skb->dst),
  670. IPSTATS_MIB_FRAGOKS);
  671. kfree_skb(skb);
  672. return err;
  673. fail:
  674. IP6_INC_STATS(ip6_dst_idev(skb->dst),
  675. IPSTATS_MIB_FRAGFAILS);
  676. kfree_skb(skb);
  677. return err;
  678. }
  679. static inline int ip6_rt_check(struct rt6key *rt_key,
  680. struct in6_addr *fl_addr,
  681. struct in6_addr *addr_cache)
  682. {
  683. return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
  684. (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
  685. }
  686. static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
  687. struct dst_entry *dst,
  688. struct flowi *fl)
  689. {
  690. struct ipv6_pinfo *np = inet6_sk(sk);
  691. struct rt6_info *rt = (struct rt6_info *)dst;
  692. if (!dst)
  693. goto out;
  694. /* Yes, checking route validity in not connected
  695. * case is not very simple. Take into account,
  696. * that we do not support routing by source, TOS,
  697. * and MSG_DONTROUTE --ANK (980726)
  698. *
  699. * 1. ip6_rt_check(): If route was host route,
  700. * check that cached destination is current.
  701. * If it is network route, we still may
  702. * check its validity using saved pointer
  703. * to the last used address: daddr_cache.
  704. * We do not want to save whole address now,
  705. * (because main consumer of this service
  706. * is tcp, which has not this problem),
  707. * so that the last trick works only on connected
  708. * sockets.
  709. * 2. oif also should be the same.
  710. */
  711. if (ip6_rt_check(&rt->rt6i_dst, &fl->fl6_dst, np->daddr_cache) ||
  712. #ifdef CONFIG_IPV6_SUBTREES
  713. ip6_rt_check(&rt->rt6i_src, &fl->fl6_src, np->saddr_cache) ||
  714. #endif
  715. (fl->oif && fl->oif != dst->dev->ifindex)) {
  716. dst_release(dst);
  717. dst = NULL;
  718. }
  719. out:
  720. return dst;
  721. }
  722. static int ip6_dst_lookup_tail(struct sock *sk,
  723. struct dst_entry **dst, struct flowi *fl)
  724. {
  725. int err;
  726. if (*dst == NULL)
  727. *dst = ip6_route_output(sk, fl);
  728. if ((err = (*dst)->error))
  729. goto out_err_release;
  730. if (ipv6_addr_any(&fl->fl6_src)) {
  731. err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
  732. if (err)
  733. goto out_err_release;
  734. }
  735. return 0;
  736. out_err_release:
  737. dst_release(*dst);
  738. *dst = NULL;
  739. return err;
  740. }
  741. /**
  742. * ip6_dst_lookup - perform route lookup on flow
  743. * @sk: socket which provides route info
  744. * @dst: pointer to dst_entry * for result
  745. * @fl: flow to lookup
  746. *
  747. * This function performs a route lookup on the given flow.
  748. *
  749. * It returns zero on success, or a standard errno code on error.
  750. */
  751. int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
  752. {
  753. *dst = NULL;
  754. return ip6_dst_lookup_tail(sk, dst, fl);
  755. }
  756. EXPORT_SYMBOL_GPL(ip6_dst_lookup);
  757. /**
  758. * ip6_sk_dst_lookup - perform socket cached route lookup on flow
  759. * @sk: socket which provides the dst cache and route info
  760. * @dst: pointer to dst_entry * for result
  761. * @fl: flow to lookup
  762. *
  763. * This function performs a route lookup on the given flow with the
  764. * possibility of using the cached route in the socket if it is valid.
  765. * It will take the socket dst lock when operating on the dst cache.
  766. * As a result, this function can only be used in process context.
  767. *
  768. * It returns zero on success, or a standard errno code on error.
  769. */
  770. int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
  771. {
  772. *dst = NULL;
  773. if (sk) {
  774. *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
  775. *dst = ip6_sk_dst_check(sk, *dst, fl);
  776. }
  777. return ip6_dst_lookup_tail(sk, dst, fl);
  778. }
  779. EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
  780. static inline int ip6_ufo_append_data(struct sock *sk,
  781. int getfrag(void *from, char *to, int offset, int len,
  782. int odd, struct sk_buff *skb),
  783. void *from, int length, int hh_len, int fragheaderlen,
  784. int transhdrlen, int mtu,unsigned int flags)
  785. {
  786. struct sk_buff *skb;
  787. int err;
  788. /* There is support for UDP large send offload by network
  789. * device, so create one single skb packet containing complete
  790. * udp datagram
  791. */
  792. if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
  793. skb = sock_alloc_send_skb(sk,
  794. hh_len + fragheaderlen + transhdrlen + 20,
  795. (flags & MSG_DONTWAIT), &err);
  796. if (skb == NULL)
  797. return -ENOMEM;
  798. /* reserve space for Hardware header */
  799. skb_reserve(skb, hh_len);
  800. /* create space for UDP/IP header */
  801. skb_put(skb,fragheaderlen + transhdrlen);
  802. /* initialize network header pointer */
  803. skb->nh.raw = skb->data;
  804. /* initialize protocol header pointer */
  805. skb->h.raw = skb->data + fragheaderlen;
  806. skb->ip_summed = CHECKSUM_PARTIAL;
  807. skb->csum = 0;
  808. sk->sk_sndmsg_off = 0;
  809. }
  810. err = skb_append_datato_frags(sk,skb, getfrag, from,
  811. (length - transhdrlen));
  812. if (!err) {
  813. struct frag_hdr fhdr;
  814. /* specify the length of each IP datagram fragment*/
  815. skb_shinfo(skb)->gso_size = mtu - fragheaderlen -
  816. sizeof(struct frag_hdr);
  817. skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
  818. ipv6_select_ident(skb, &fhdr);
  819. skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
  820. __skb_queue_tail(&sk->sk_write_queue, skb);
  821. return 0;
  822. }
  823. /* There is not enough support do UPD LSO,
  824. * so follow normal path
  825. */
  826. kfree_skb(skb);
  827. return err;
  828. }
  829. int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
  830. int offset, int len, int odd, struct sk_buff *skb),
  831. void *from, int length, int transhdrlen,
  832. int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
  833. struct rt6_info *rt, unsigned int flags)
  834. {
  835. struct inet_sock *inet = inet_sk(sk);
  836. struct ipv6_pinfo *np = inet6_sk(sk);
  837. struct sk_buff *skb;
  838. unsigned int maxfraglen, fragheaderlen;
  839. int exthdrlen;
  840. int hh_len;
  841. int mtu;
  842. int copy;
  843. int err;
  844. int offset = 0;
  845. int csummode = CHECKSUM_NONE;
  846. if (flags&MSG_PROBE)
  847. return 0;
  848. if (skb_queue_empty(&sk->sk_write_queue)) {
  849. /*
  850. * setup for corking
  851. */
  852. if (opt) {
  853. if (np->cork.opt == NULL) {
  854. np->cork.opt = kmalloc(opt->tot_len,
  855. sk->sk_allocation);
  856. if (unlikely(np->cork.opt == NULL))
  857. return -ENOBUFS;
  858. } else if (np->cork.opt->tot_len < opt->tot_len) {
  859. printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
  860. return -EINVAL;
  861. }
  862. memcpy(np->cork.opt, opt, opt->tot_len);
  863. inet->cork.flags |= IPCORK_OPT;
  864. /* need source address above miyazawa*/
  865. }
  866. dst_hold(&rt->u.dst);
  867. np->cork.rt = rt;
  868. inet->cork.fl = *fl;
  869. np->cork.hop_limit = hlimit;
  870. np->cork.tclass = tclass;
  871. mtu = dst_mtu(rt->u.dst.path);
  872. if (np->frag_size < mtu) {
  873. if (np->frag_size)
  874. mtu = np->frag_size;
  875. }
  876. inet->cork.fragsize = mtu;
  877. if (dst_allfrag(rt->u.dst.path))
  878. inet->cork.flags |= IPCORK_ALLFRAG;
  879. inet->cork.length = 0;
  880. sk->sk_sndmsg_page = NULL;
  881. sk->sk_sndmsg_off = 0;
  882. exthdrlen = rt->u.dst.header_len + (opt ? opt->opt_flen : 0);
  883. length += exthdrlen;
  884. transhdrlen += exthdrlen;
  885. } else {
  886. rt = np->cork.rt;
  887. fl = &inet->cork.fl;
  888. if (inet->cork.flags & IPCORK_OPT)
  889. opt = np->cork.opt;
  890. transhdrlen = 0;
  891. exthdrlen = 0;
  892. mtu = inet->cork.fragsize;
  893. }
  894. hh_len = LL_RESERVED_SPACE(rt->u.dst.dev);
  895. fragheaderlen = sizeof(struct ipv6hdr) + rt->u.dst.nfheader_len + (opt ? opt->opt_nflen : 0);
  896. maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
  897. if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
  898. if (inet->cork.length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
  899. ipv6_local_error(sk, EMSGSIZE, fl, mtu-exthdrlen);
  900. return -EMSGSIZE;
  901. }
  902. }
  903. /*
  904. * Let's try using as much space as possible.
  905. * Use MTU if total length of the message fits into the MTU.
  906. * Otherwise, we need to reserve fragment header and
  907. * fragment alignment (= 8-15 octects, in total).
  908. *
  909. * Note that we may need to "move" the data from the tail of
  910. * of the buffer to the new fragment when we split
  911. * the message.
  912. *
  913. * FIXME: It may be fragmented into multiple chunks
  914. * at once if non-fragmentable extension headers
  915. * are too large.
  916. * --yoshfuji
  917. */
  918. inet->cork.length += length;
  919. if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
  920. (rt->u.dst.dev->features & NETIF_F_UFO)) {
  921. err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
  922. fragheaderlen, transhdrlen, mtu,
  923. flags);
  924. if (err)
  925. goto error;
  926. return 0;
  927. }
  928. if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
  929. goto alloc_new_skb;
  930. while (length > 0) {
  931. /* Check if the remaining data fits into current packet. */
  932. copy = (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
  933. if (copy < length)
  934. copy = maxfraglen - skb->len;
  935. if (copy <= 0) {
  936. char *data;
  937. unsigned int datalen;
  938. unsigned int fraglen;
  939. unsigned int fraggap;
  940. unsigned int alloclen;
  941. struct sk_buff *skb_prev;
  942. alloc_new_skb:
  943. skb_prev = skb;
  944. /* There's no room in the current skb */
  945. if (skb_prev)
  946. fraggap = skb_prev->len - maxfraglen;
  947. else
  948. fraggap = 0;
  949. /*
  950. * If remaining data exceeds the mtu,
  951. * we know we need more fragment(s).
  952. */
  953. datalen = length + fraggap;
  954. if (datalen > (inet->cork.length <= mtu && !(inet->cork.flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
  955. datalen = maxfraglen - fragheaderlen;
  956. fraglen = datalen + fragheaderlen;
  957. if ((flags & MSG_MORE) &&
  958. !(rt->u.dst.dev->features&NETIF_F_SG))
  959. alloclen = mtu;
  960. else
  961. alloclen = datalen + fragheaderlen;
  962. /*
  963. * The last fragment gets additional space at tail.
  964. * Note: we overallocate on fragments with MSG_MODE
  965. * because we have no idea if we're the last one.
  966. */
  967. if (datalen == length + fraggap)
  968. alloclen += rt->u.dst.trailer_len;
  969. /*
  970. * We just reserve space for fragment header.
  971. * Note: this may be overallocation if the message
  972. * (without MSG_MORE) fits into the MTU.
  973. */
  974. alloclen += sizeof(struct frag_hdr);
  975. if (transhdrlen) {
  976. skb = sock_alloc_send_skb(sk,
  977. alloclen + hh_len,
  978. (flags & MSG_DONTWAIT), &err);
  979. } else {
  980. skb = NULL;
  981. if (atomic_read(&sk->sk_wmem_alloc) <=
  982. 2 * sk->sk_sndbuf)
  983. skb = sock_wmalloc(sk,
  984. alloclen + hh_len, 1,
  985. sk->sk_allocation);
  986. if (unlikely(skb == NULL))
  987. err = -ENOBUFS;
  988. }
  989. if (skb == NULL)
  990. goto error;
  991. /*
  992. * Fill in the control structures
  993. */
  994. skb->ip_summed = csummode;
  995. skb->csum = 0;
  996. /* reserve for fragmentation */
  997. skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
  998. /*
  999. * Find where to start putting bytes
  1000. */
  1001. data = skb_put(skb, fraglen);
  1002. skb->nh.raw = data + exthdrlen;
  1003. data += fragheaderlen;
  1004. skb->h.raw = data + exthdrlen;
  1005. if (fraggap) {
  1006. skb->csum = skb_copy_and_csum_bits(
  1007. skb_prev, maxfraglen,
  1008. data + transhdrlen, fraggap, 0);
  1009. skb_prev->csum = csum_sub(skb_prev->csum,
  1010. skb->csum);
  1011. data += fraggap;
  1012. pskb_trim_unique(skb_prev, maxfraglen);
  1013. }
  1014. copy = datalen - transhdrlen - fraggap;
  1015. if (copy < 0) {
  1016. err = -EINVAL;
  1017. kfree_skb(skb);
  1018. goto error;
  1019. } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
  1020. err = -EFAULT;
  1021. kfree_skb(skb);
  1022. goto error;
  1023. }
  1024. offset += copy;
  1025. length -= datalen - fraggap;
  1026. transhdrlen = 0;
  1027. exthdrlen = 0;
  1028. csummode = CHECKSUM_NONE;
  1029. /*
  1030. * Put the packet on the pending queue
  1031. */
  1032. __skb_queue_tail(&sk->sk_write_queue, skb);
  1033. continue;
  1034. }
  1035. if (copy > length)
  1036. copy = length;
  1037. if (!(rt->u.dst.dev->features&NETIF_F_SG)) {
  1038. unsigned int off;
  1039. off = skb->len;
  1040. if (getfrag(from, skb_put(skb, copy),
  1041. offset, copy, off, skb) < 0) {
  1042. __skb_trim(skb, off);
  1043. err = -EFAULT;
  1044. goto error;
  1045. }
  1046. } else {
  1047. int i = skb_shinfo(skb)->nr_frags;
  1048. skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
  1049. struct page *page = sk->sk_sndmsg_page;
  1050. int off = sk->sk_sndmsg_off;
  1051. unsigned int left;
  1052. if (page && (left = PAGE_SIZE - off) > 0) {
  1053. if (copy >= left)
  1054. copy = left;
  1055. if (page != frag->page) {
  1056. if (i == MAX_SKB_FRAGS) {
  1057. err = -EMSGSIZE;
  1058. goto error;
  1059. }
  1060. get_page(page);
  1061. skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
  1062. frag = &skb_shinfo(skb)->frags[i];
  1063. }
  1064. } else if(i < MAX_SKB_FRAGS) {
  1065. if (copy > PAGE_SIZE)
  1066. copy = PAGE_SIZE;
  1067. page = alloc_pages(sk->sk_allocation, 0);
  1068. if (page == NULL) {
  1069. err = -ENOMEM;
  1070. goto error;
  1071. }
  1072. sk->sk_sndmsg_page = page;
  1073. sk->sk_sndmsg_off = 0;
  1074. skb_fill_page_desc(skb, i, page, 0, 0);
  1075. frag = &skb_shinfo(skb)->frags[i];
  1076. skb->truesize += PAGE_SIZE;
  1077. atomic_add(PAGE_SIZE, &sk->sk_wmem_alloc);
  1078. } else {
  1079. err = -EMSGSIZE;
  1080. goto error;
  1081. }
  1082. if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
  1083. err = -EFAULT;
  1084. goto error;
  1085. }
  1086. sk->sk_sndmsg_off += copy;
  1087. frag->size += copy;
  1088. skb->len += copy;
  1089. skb->data_len += copy;
  1090. }
  1091. offset += copy;
  1092. length -= copy;
  1093. }
  1094. return 0;
  1095. error:
  1096. inet->cork.length -= length;
  1097. IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
  1098. return err;
  1099. }
  1100. int ip6_push_pending_frames(struct sock *sk)
  1101. {
  1102. struct sk_buff *skb, *tmp_skb;
  1103. struct sk_buff **tail_skb;
  1104. struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
  1105. struct inet_sock *inet = inet_sk(sk);
  1106. struct ipv6_pinfo *np = inet6_sk(sk);
  1107. struct ipv6hdr *hdr;
  1108. struct ipv6_txoptions *opt = np->cork.opt;
  1109. struct rt6_info *rt = np->cork.rt;
  1110. struct flowi *fl = &inet->cork.fl;
  1111. unsigned char proto = fl->proto;
  1112. int err = 0;
  1113. if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
  1114. goto out;
  1115. tail_skb = &(skb_shinfo(skb)->frag_list);
  1116. /* move skb->data to ip header from ext header */
  1117. if (skb->data < skb->nh.raw)
  1118. __skb_pull(skb, skb->nh.raw - skb->data);
  1119. while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
  1120. __skb_pull(tmp_skb, skb->h.raw - skb->nh.raw);
  1121. *tail_skb = tmp_skb;
  1122. tail_skb = &(tmp_skb->next);
  1123. skb->len += tmp_skb->len;
  1124. skb->data_len += tmp_skb->len;
  1125. skb->truesize += tmp_skb->truesize;
  1126. __sock_put(tmp_skb->sk);
  1127. tmp_skb->destructor = NULL;
  1128. tmp_skb->sk = NULL;
  1129. }
  1130. ipv6_addr_copy(final_dst, &fl->fl6_dst);
  1131. __skb_pull(skb, skb->h.raw - skb->nh.raw);
  1132. if (opt && opt->opt_flen)
  1133. ipv6_push_frag_opts(skb, opt, &proto);
  1134. if (opt && opt->opt_nflen)
  1135. ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
  1136. skb->nh.ipv6h = hdr = (struct ipv6hdr*) skb_push(skb, sizeof(struct ipv6hdr));
  1137. *(__be32*)hdr = fl->fl6_flowlabel |
  1138. htonl(0x60000000 | ((int)np->cork.tclass << 20));
  1139. if (skb->len <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN)
  1140. hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
  1141. else
  1142. hdr->payload_len = 0;
  1143. hdr->hop_limit = np->cork.hop_limit;
  1144. hdr->nexthdr = proto;
  1145. ipv6_addr_copy(&hdr->saddr, &fl->fl6_src);
  1146. ipv6_addr_copy(&hdr->daddr, final_dst);
  1147. skb->priority = sk->sk_priority;
  1148. skb->dst = dst_clone(&rt->u.dst);
  1149. IP6_INC_STATS(rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
  1150. err = NF_HOOK(PF_INET6, NF_IP6_LOCAL_OUT, skb, NULL, skb->dst->dev, dst_output);
  1151. if (err) {
  1152. if (err > 0)
  1153. err = np->recverr ? net_xmit_errno(err) : 0;
  1154. if (err)
  1155. goto error;
  1156. }
  1157. out:
  1158. inet->cork.flags &= ~IPCORK_OPT;
  1159. kfree(np->cork.opt);
  1160. np->cork.opt = NULL;
  1161. if (np->cork.rt) {
  1162. dst_release(&np->cork.rt->u.dst);
  1163. np->cork.rt = NULL;
  1164. inet->cork.flags &= ~IPCORK_ALLFRAG;
  1165. }
  1166. memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
  1167. return err;
  1168. error:
  1169. goto out;
  1170. }
  1171. void ip6_flush_pending_frames(struct sock *sk)
  1172. {
  1173. struct inet_sock *inet = inet_sk(sk);
  1174. struct ipv6_pinfo *np = inet6_sk(sk);
  1175. struct sk_buff *skb;
  1176. while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
  1177. IP6_INC_STATS(ip6_dst_idev(skb->dst),
  1178. IPSTATS_MIB_OUTDISCARDS);
  1179. kfree_skb(skb);
  1180. }
  1181. inet->cork.flags &= ~IPCORK_OPT;
  1182. kfree(np->cork.opt);
  1183. np->cork.opt = NULL;
  1184. if (np->cork.rt) {
  1185. dst_release(&np->cork.rt->u.dst);
  1186. np->cork.rt = NULL;
  1187. inet->cork.flags &= ~IPCORK_ALLFRAG;
  1188. }
  1189. memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
  1190. }