net/ipv6/ip6_output.c

   1 /*
   2  *      IPv6 output functions
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on linux/net/ipv4/ip_output.c
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  *
  15  *      Changes:
  16  *      A.N.Kuznetsov   :       airthmetics in fragmentation.
  17  *                              extension headers are implemented.
  18  *                              route changes now work.
  19  *                              ip6_forward does not confuse sniffers.
  20  *                              etc.
  21  *
  22  *      H. von Brand    :       Added missing #include <linux/string.h>
  23  *      Imran Patel     :       frag id should be in NBO
  24  *      Kazunori MIYAZAWA @USAGI
  25  *                      :       add ip6_append_data and related functions
  26  *                              for datagram xmit
  27  */
  28
  29 #include <linux/errno.h>
  30 #include <linux/kernel.h>
  31 #include <linux/string.h>
  32 #include <linux/socket.h>
  33 #include <linux/net.h>
  34 #include <linux/netdevice.h>
  35 #include <linux/if_arp.h>
  36 #include <linux/in6.h>
  37 #include <linux/tcp.h>
  38 #include <linux/route.h>
  39 #include <linux/module.h>
  40 #include <linux/slab.h>
  41
  42 #include <linux/netfilter.h>
  43 #include <linux/netfilter_ipv6.h>
  44
  45 #include <net/sock.h>
  46 #include <net/snmp.h>
  47
  48 #include <net/ipv6.h>
  49 #include <net/ndisc.h>
  50 #include <net/protocol.h>
  51 #include <net/ip6_route.h>
  52 #include <net/addrconf.h>
  53 #include <net/rawv6.h>
  54 #include <net/icmp.h>
  55 #include <net/xfrm.h>
  56 #include <net/checksum.h>
  57 #include <linux/mroute6.h>
  58
  59 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
  60
  61 int __ip6_local_out(struct sk_buff *skb)
  62 {
  63         int len;
  64
  65         len = skb->len - sizeof(struct ipv6hdr);
  66         if (len > IPV6_MAXPLEN)
  67                 len = 0;
  68         ipv6_hdr(skb)->payload_len = htons(len);
  69
  70         return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
  71                        skb_dst(skb)->dev, dst_output);
  72 }
  73
  74 int ip6_local_out(struct sk_buff *skb)
  75 {
  76         int err;
  77
  78         err = __ip6_local_out(skb);
  79         if (likely(err == 1))
  80                 err = dst_output(skb);
  81
  82         return err;
  83 }
  84 EXPORT_SYMBOL_GPL(ip6_local_out);
  85
  86 /* dev_loopback_xmit for use with netfilter. */
  87 static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
  88 {
  89         skb_reset_mac_header(newskb);
  90         __skb_pull(newskb, skb_network_offset(newskb));
  91         newskb->pkt_type = PACKET_LOOPBACK;
  92         newskb->ip_summed = CHECKSUM_UNNECESSARY;
  93         WARN_ON(!skb_dst(newskb));
  94
  95         netif_rx_ni(newskb);
  96         return 0;
  97 }
  98
  99 static int ip6_finish_output2(struct sk_buff *skb)
 100 {
 101         struct dst_entry *dst = skb_dst(skb);
 102         struct net_device *dev = dst->dev;
 103         struct neighbour *neigh;
 104
 105         skb->protocol = htons(ETH_P_IPV6);
 106         skb->dev = dev;
 107
 108         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
 109                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 110
 111                 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
 112                     ((mroute6_socket(dev_net(dev), skb) &&
 113                      !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
 114                      ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
 115                                          &ipv6_hdr(skb)->saddr))) {
 116                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
 117
 118                         /* Do not check for IFF_ALLMULTI; multicast routing
 119                            is not supported in any case.
 120                          */
 121                         if (newskb)
 122                                 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
 123                                         newskb, NULL, newskb->dev,
 124                                         ip6_dev_loopback_xmit);
 125
 126                         if (ipv6_hdr(skb)->hop_limit == 0) {
 127                                 IP6_INC_STATS(dev_net(dev), idev,
 128                                               IPSTATS_MIB_OUTDISCARDS);
 129                                 kfree_skb(skb);
 130                                 return 0;
 131                         }
 132                 }
 133
 134                 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
 135                                 skb->len);
 136         }
 137
 138         rcu_read_lock();
 139         neigh = dst_get_neighbour(dst);
 140         if (neigh) {
 141                 int res = neigh_output(neigh, skb);
 142
 143                 rcu_read_unlock();
 144                 return res;
 145         }
 146         rcu_read_unlock();
 147         IP6_INC_STATS_BH(dev_net(dst->dev),
 148                          ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
 149         kfree_skb(skb);
 150         return -EINVAL;
 151 }
 152
 153 static int ip6_finish_output(struct sk_buff *skb)
 154 {
 155         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
 156             dst_allfrag(skb_dst(skb)))
 157                 return ip6_fragment(skb, ip6_finish_output2);
 158         else
 159                 return ip6_finish_output2(skb);
 160 }
 161
 162 int ip6_output(struct sk_buff *skb)
 163 {
 164         struct net_device *dev = skb_dst(skb)->dev;
 165         struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 166         if (unlikely(idev->cnf.disable_ipv6)) {
 167                 IP6_INC_STATS(dev_net(dev), idev,
 168                               IPSTATS_MIB_OUTDISCARDS);
 169                 kfree_skb(skb);
 170                 return 0;
 171         }
 172
 173         return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
 174                             ip6_finish_output,
 175                             !(IP6CB(skb)->flags & IP6SKB_REROUTED));
 176 }
 177
 178 /*
 179  *      xmit an sk_buff (used by TCP, SCTP and DCCP)
 180  */
 181
 182 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 183              struct ipv6_txoptions *opt, int tclass)
 184 {
 185         struct net *net = sock_net(sk);
 186         struct ipv6_pinfo *np = inet6_sk(sk);
 187         struct in6_addr *first_hop = &fl6->daddr;
 188         struct dst_entry *dst = skb_dst(skb);
 189         struct ipv6hdr *hdr;
 190         u8  proto = fl6->flowi6_proto;
 191         int seg_len = skb->len;
 192         int hlimit = -1;
 193         u32 mtu;
 194
 195         if (opt) {
 196                 unsigned int head_room;
 197
 198                 /* First: exthdrs may take lots of space (~8K for now)
 199                    MAX_HEADER is not enough.
 200                  */
 201                 head_room = opt->opt_nflen + opt->opt_flen;
 202                 seg_len += head_room;
 203                 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
 204
 205                 if (skb_headroom(skb) < head_room) {
 206                         struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
 207                         if (skb2 == NULL) {
 208                                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 209                                               IPSTATS_MIB_OUTDISCARDS);
 210                                 kfree_skb(skb);
 211                                 return -ENOBUFS;
 212                         }
 213                         kfree_skb(skb);
 214                         skb = skb2;
 215                         skb_set_owner_w(skb, sk);
 216                 }
 217                 if (opt->opt_flen)
 218                         ipv6_push_frag_opts(skb, opt, &proto);
 219                 if (opt->opt_nflen)
 220                         ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
 221         }
 222
 223         skb_push(skb, sizeof(struct ipv6hdr));
 224         skb_reset_network_header(skb);
 225         hdr = ipv6_hdr(skb);
 226
 227         /*
 228          *      Fill in the IPv6 header
 229          */
 230         if (np)
 231                 hlimit = np->hop_limit;
 232         if (hlimit < 0)
 233                 hlimit = ip6_dst_hoplimit(dst);
 234
 235         *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl6->flowlabel;
 236
 237         hdr->payload_len = htons(seg_len);
 238         hdr->nexthdr = proto;
 239         hdr->hop_limit = hlimit;
 240
 241         hdr->saddr = fl6->saddr;
 242         hdr->daddr = *first_hop;
 243
 244         skb->priority = sk->sk_priority;
 245         skb->mark = sk->sk_mark;
 246
 247         mtu = dst_mtu(dst);
 248         if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
 249                 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
 250                               IPSTATS_MIB_OUT, skb->len);
 251                 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
 252                                dst->dev, dst_output);
 253         }
 254
 255         if (net_ratelimit())
 256                 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
 257         skb->dev = dst->dev;
 258         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 259         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
 260         kfree_skb(skb);
 261         return -EMSGSIZE;
 262 }
 263
 264 EXPORT_SYMBOL(ip6_xmit);
 265
 266 /*
 267  *      To avoid extra problems ND packets are send through this
 268  *      routine. It's code duplication but I really want to avoid
 269  *      extra checks since ipv6_build_header is used by TCP (which
 270  *      is for us performance critical)
 271  */
 272
 273 int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
 274                const struct in6_addr *saddr, const struct in6_addr *daddr,
 275                int proto, int len)
 276 {
 277         struct ipv6_pinfo *np = inet6_sk(sk);
 278         struct ipv6hdr *hdr;
 279
 280         skb->protocol = htons(ETH_P_IPV6);
 281         skb->dev = dev;
 282
 283         skb_reset_network_header(skb);
 284         skb_put(skb, sizeof(struct ipv6hdr));
 285         hdr = ipv6_hdr(skb);
 286
 287         *(__be32*)hdr = htonl(0x60000000);
 288
 289         hdr->payload_len = htons(len);
 290         hdr->nexthdr = proto;
 291         hdr->hop_limit = np->hop_limit;
 292
 293         hdr->saddr = *saddr;
 294         hdr->daddr = *daddr;
 295
 296         return 0;
 297 }
 298
 299 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
 300 {
 301         struct ip6_ra_chain *ra;
 302         struct sock *last = NULL;
 303
 304         read_lock(&ip6_ra_lock);
 305         for (ra = ip6_ra_chain; ra; ra = ra->next) {
 306                 struct sock *sk = ra->sk;
 307                 if (sk && ra->sel == sel &&
 308                     (!sk->sk_bound_dev_if ||
 309                      sk->sk_bound_dev_if == skb->dev->ifindex)) {
 310                         if (last) {
 311                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 312                                 if (skb2)
 313                                         rawv6_rcv(last, skb2);
 314                         }
 315                         last = sk;
 316                 }
 317         }
 318
 319         if (last) {
 320                 rawv6_rcv(last, skb);
 321                 read_unlock(&ip6_ra_lock);
 322                 return 1;
 323         }
 324         read_unlock(&ip6_ra_lock);
 325         return 0;
 326 }
 327
 328 static int ip6_forward_proxy_check(struct sk_buff *skb)
 329 {
 330         struct ipv6hdr *hdr = ipv6_hdr(skb);
 331         u8 nexthdr = hdr->nexthdr;
 332         int offset;
 333
 334         if (ipv6_ext_hdr(nexthdr)) {
 335                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
 336                 if (offset < 0)
 337                         return 0;
 338         } else
 339                 offset = sizeof(struct ipv6hdr);
 340
 341         if (nexthdr == IPPROTO_ICMPV6) {
 342                 struct icmp6hdr *icmp6;
 343
 344                 if (!pskb_may_pull(skb, (skb_network_header(skb) +
 345                                          offset + 1 - skb->data)))
 346                         return 0;
 347
 348                 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
 349
 350                 switch (icmp6->icmp6_type) {
 351                 case NDISC_ROUTER_SOLICITATION:
 352                 case NDISC_ROUTER_ADVERTISEMENT:
 353                 case NDISC_NEIGHBOUR_SOLICITATION:
 354                 case NDISC_NEIGHBOUR_ADVERTISEMENT:
 355                 case NDISC_REDIRECT:
 356                         /* For reaction involving unicast neighbor discovery
 357                          * message destined to the proxied address, pass it to
 358                          * input function.
 359                          */
 360                         return 1;
 361                 default:
 362                         break;
 363                 }
 364         }
 365
 366         /*
 367          * The proxying router can't forward traffic sent to a link-local
 368          * address, so signal the sender and discard the packet. This
 369          * behavior is clarified by the MIPv6 specification.
 370          */
 371         if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
 372                 dst_link_failure(skb);
 373                 return -1;
 374         }
 375
 376         return 0;
 377 }
 378
 379 static inline int ip6_forward_finish(struct sk_buff *skb)
 380 {
 381         return dst_output(skb);
 382 }
 383
 384 int ip6_forward(struct sk_buff *skb)
 385 {
 386         struct dst_entry *dst = skb_dst(skb);
 387         struct ipv6hdr *hdr = ipv6_hdr(skb);
 388         struct inet6_skb_parm *opt = IP6CB(skb);
 389         struct net *net = dev_net(dst->dev);
 390         struct neighbour *n;
 391         u32 mtu;
 392
 393         if (net->ipv6.devconf_all->forwarding == 0)
 394                 goto error;
 395
 396         if (skb_warn_if_lro(skb))
 397                 goto drop;
 398
 399         if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
 400                 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
 401                 goto drop;
 402         }
 403
 404         if (skb->pkt_type != PACKET_HOST)
 405                 goto drop;
 406
 407         skb_forward_csum(skb);
 408
 409         /*
 410          *      We DO NOT make any processing on
 411          *      RA packets, pushing them to user level AS IS
 412          *      without ane WARRANTY that application will be able
 413          *      to interpret them. The reason is that we
 414          *      cannot make anything clever here.
 415          *
 416          *      We are not end-node, so that if packet contains
 417          *      AH/ESP, we cannot make anything.
 418          *      Defragmentation also would be mistake, RA packets
 419          *      cannot be fragmented, because there is no warranty
 420          *      that different fragments will go along one path. --ANK
 421          */
 422         if (opt->ra) {
 423                 u8 *ptr = skb_network_header(skb) + opt->ra;
 424                 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
 425                         return 0;
 426         }
 427
 428         /*
 429          *      check and decrement ttl
 430          */
 431         if (hdr->hop_limit <= 1) {
 432                 /* Force OUTPUT device used as source address */
 433                 skb->dev = dst->dev;
 434                 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
 435                 IP6_INC_STATS_BH(net,
 436                                  ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 437
 438                 kfree_skb(skb);
 439                 return -ETIMEDOUT;
 440         }
 441
 442         /* XXX: idev->cnf.proxy_ndp? */
 443         if (net->ipv6.devconf_all->proxy_ndp &&
 444             pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
 445                 int proxied = ip6_forward_proxy_check(skb);
 446                 if (proxied > 0)
 447                         return ip6_input(skb);
 448                 else if (proxied < 0) {
 449                         IP6_INC_STATS(net, ip6_dst_idev(dst),
 450                                       IPSTATS_MIB_INDISCARDS);
 451                         goto drop;
 452                 }
 453         }
 454
 455         if (!xfrm6_route_forward(skb)) {
 456                 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
 457                 goto drop;
 458         }
 459         dst = skb_dst(skb);
 460
 461         /* IPv6 specs say nothing about it, but it is clear that we cannot
 462            send redirects to source routed frames.
 463            We don't send redirects to frames decapsulated from IPsec.
 464          */
 465         n = dst_get_neighbour(dst);
 466         if (skb->dev == dst->dev && n && opt->srcrt == 0 && !skb_sec_path(skb)) {
 467                 struct in6_addr *target = NULL;
 468                 struct rt6_info *rt;
 469
 470                 /*
 471                  *      incoming and outgoing devices are the same
 472                  *      send a redirect.
 473                  */
 474
 475                 rt = (struct rt6_info *) dst;
 476                 if ((rt->rt6i_flags & RTF_GATEWAY))
 477                         target = (struct in6_addr*)&n->primary_key;
 478                 else
 479                         target = &hdr->daddr;
 480
 481                 if (!rt->rt6i_peer)
 482                         rt6_bind_peer(rt, 1);
 483
 484                 /* Limit redirects both by destination (here)
 485                    and by source (inside ndisc_send_redirect)
 486                  */
 487                 if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
 488                         ndisc_send_redirect(skb, n, target);
 489         } else {
 490                 int addrtype = ipv6_addr_type(&hdr->saddr);
 491
 492                 /* This check is security critical. */
 493                 if (addrtype == IPV6_ADDR_ANY ||
 494                     addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
 495                         goto error;
 496                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
 497                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
 498                                     ICMPV6_NOT_NEIGHBOUR, 0);
 499                         goto error;
 500                 }
 501         }
 502
 503         mtu = dst_mtu(dst);
 504         if (mtu < IPV6_MIN_MTU)
 505                 mtu = IPV6_MIN_MTU;
 506
 507         if (skb->len > mtu && !skb_is_gso(skb)) {
 508                 /* Again, force OUTPUT device used as source address */
 509                 skb->dev = dst->dev;
 510                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 511                 IP6_INC_STATS_BH(net,
 512                                  ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
 513                 IP6_INC_STATS_BH(net,
 514                                  ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
 515                 kfree_skb(skb);
 516                 return -EMSGSIZE;
 517         }
 518
 519         if (skb_cow(skb, dst->dev->hard_header_len)) {
 520                 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
 521                 goto drop;
 522         }
 523
 524         hdr = ipv6_hdr(skb);
 525
 526         /* Mangling hops number delayed to point after skb COW */
 527
 528         hdr->hop_limit--;
 529
 530         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
 531         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
 532                        ip6_forward_finish);
 533
 534 error:
 535         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
 536 drop:
 537         kfree_skb(skb);
 538         return -EINVAL;
 539 }
 540
 541 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
 542 {
 543         to->pkt_type = from->pkt_type;
 544         to->priority = from->priority;
 545         to->protocol = from->protocol;
 546         skb_dst_drop(to);
 547         skb_dst_set(to, dst_clone(skb_dst(from)));
 548         to->dev = from->dev;
 549         to->mark = from->mark;
 550
 551 #ifdef CONFIG_NET_SCHED
 552         to->tc_index = from->tc_index;
 553 #endif
 554         nf_copy(to, from);
 555 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
 556     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 557         to->nf_trace = from->nf_trace;
 558 #endif
 559         skb_copy_secmark(to, from);
 560 }
 561
 562 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 563 {
 564         u16 offset = sizeof(struct ipv6hdr);
 565         struct ipv6_opt_hdr *exthdr =
 566                                 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
 567         unsigned int packet_len = skb->tail - skb->network_header;
 568         int found_rhdr = 0;
 569         *nexthdr = &ipv6_hdr(skb)->nexthdr;
 570
 571         while (offset + 1 <= packet_len) {
 572
 573                 switch (**nexthdr) {
 574
 575                 case NEXTHDR_HOP:
 576                         break;
 577                 case NEXTHDR_ROUTING:
 578                         found_rhdr = 1;
 579                         break;
 580                 case NEXTHDR_DEST:
 581 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 582                         if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
 583                                 break;
 584 #endif
 585                         if (found_rhdr)
 586                                 return offset;
 587                         break;
 588                 default :
 589                         return offset;
 590                 }
 591
 592                 offset += ipv6_optlen(exthdr);
 593                 *nexthdr = &exthdr->nexthdr;
 594                 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
 595                                                  offset);
 596         }
 597
 598         return offset;
 599 }
 600
 601 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
 602 {
 603         static atomic_t ipv6_fragmentation_id;
 604         int old, new;
 605
 606         if (rt) {
 607                 struct inet_peer *peer;
 608
 609                 if (!rt->rt6i_peer)
 610                         rt6_bind_peer(rt, 1);
 611                 peer = rt->rt6i_peer;
 612                 if (peer) {
 613                         fhdr->identification = htonl(inet_getid(peer, 0));
 614                         return;
 615                 }
 616         }
 617         do {
 618                 old = atomic_read(&ipv6_fragmentation_id);
 619                 new = old + 1;
 620                 if (!new)
 621                         new = 1;
 622         } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
 623         fhdr->identification = htonl(new);
 624 }
 625
 626 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 627 {
 628         struct sk_buff *frag;
 629         struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
 630         struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
 631         struct ipv6hdr *tmp_hdr;
 632         struct frag_hdr *fh;
 633         unsigned int mtu, hlen, left, len;
 634         int hroom, troom;
 635         __be32 frag_id = 0;
 636         int ptr, offset = 0, err=0;
 637         u8 *prevhdr, nexthdr = 0;
 638         struct net *net = dev_net(skb_dst(skb)->dev);
 639
 640         hlen = ip6_find_1stfragopt(skb, &prevhdr);
 641         nexthdr = *prevhdr;
 642
 643         mtu = ip6_skb_dst_mtu(skb);
 644
 645         /* We must not fragment if the socket is set to force MTU discovery
 646          * or if the skb it not generated by a local socket.
 647          */
 648         if (!skb->local_df && skb->len > mtu) {
 649                 skb->dev = skb_dst(skb)->dev;
 650                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 651                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 652                               IPSTATS_MIB_FRAGFAILS);
 653                 kfree_skb(skb);
 654                 return -EMSGSIZE;
 655         }
 656
 657         if (np && np->frag_size < mtu) {
 658                 if (np->frag_size)
 659                         mtu = np->frag_size;
 660         }
 661         mtu -= hlen + sizeof(struct frag_hdr);
 662
 663         if (skb_has_frag_list(skb)) {
 664                 int first_len = skb_pagelen(skb);
 665                 struct sk_buff *frag2;
 666
 667                 if (first_len - hlen > mtu ||
 668                     ((first_len - hlen) & 7) ||
 669                     skb_cloned(skb))
 670                         goto slow_path;
 671
 672                 skb_walk_frags(skb, frag) {
 673                         /* Correct geometry. */
 674                         if (frag->len > mtu ||
 675                             ((frag->len & 7) && frag->next) ||
 676                             skb_headroom(frag) < hlen)
 677                                 goto slow_path_clean;
 678
 679                         /* Partially cloned skb? */
 680                         if (skb_shared(frag))
 681                                 goto slow_path_clean;
 682
 683                         BUG_ON(frag->sk);
 684                         if (skb->sk) {
 685                                 frag->sk = skb->sk;
 686                                 frag->destructor = sock_wfree;
 687                         }
 688                         skb->truesize -= frag->truesize;
 689                 }
 690
 691                 err = 0;
 692                 offset = 0;
 693                 frag = skb_shinfo(skb)->frag_list;
 694                 skb_frag_list_init(skb);
 695                 /* BUILD HEADER */
 696
 697                 *prevhdr = NEXTHDR_FRAGMENT;
 698                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
 699                 if (!tmp_hdr) {
 700                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 701                                       IPSTATS_MIB_FRAGFAILS);
 702                         return -ENOMEM;
 703                 }
 704
 705                 __skb_pull(skb, hlen);
 706                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
 707                 __skb_push(skb, hlen);
 708                 skb_reset_network_header(skb);
 709                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
 710
 711                 ipv6_select_ident(fh, rt);
 712                 fh->nexthdr = nexthdr;
 713                 fh->reserved = 0;
 714                 fh->frag_off = htons(IP6_MF);
 715                 frag_id = fh->identification;
 716
 717                 first_len = skb_pagelen(skb);
 718                 skb->data_len = first_len - skb_headlen(skb);
 719                 skb->len = first_len;
 720                 ipv6_hdr(skb)->payload_len = htons(first_len -
 721                                                    sizeof(struct ipv6hdr));
 722
 723                 dst_hold(&rt->dst);
 724
 725                 for (;;) {
 726                         /* Prepare header of the next frame,
 727                          * before previous one went down. */
 728                         if (frag) {
 729                                 frag->ip_summed = CHECKSUM_NONE;
 730                                 skb_reset_transport_header(frag);
 731                                 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
 732                                 __skb_push(frag, hlen);
 733                                 skb_reset_network_header(frag);
 734                                 memcpy(skb_network_header(frag), tmp_hdr,
 735                                        hlen);
 736                                 offset += skb->len - hlen - sizeof(struct frag_hdr);
 737                                 fh->nexthdr = nexthdr;
 738                                 fh->reserved = 0;
 739                                 fh->frag_off = htons(offset);
 740                                 if (frag->next != NULL)
 741                                         fh->frag_off |= htons(IP6_MF);
 742                                 fh->identification = frag_id;
 743                                 ipv6_hdr(frag)->payload_len =
 744                                                 htons(frag->len -
 745                                                       sizeof(struct ipv6hdr));
 746                                 ip6_copy_metadata(frag, skb);
 747                         }
 748
 749                         err = output(skb);
 750                         if(!err)
 751                                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 752                                               IPSTATS_MIB_FRAGCREATES);
 753
 754                         if (err || !frag)
 755                                 break;
 756
 757                         skb = frag;
 758                         frag = skb->next;
 759                         skb->next = NULL;
 760                 }
 761
 762                 kfree(tmp_hdr);
 763
 764                 if (err == 0) {
 765                         IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 766                                       IPSTATS_MIB_FRAGOKS);
 767                         dst_release(&rt->dst);
 768                         return 0;
 769                 }
 770
 771                 while (frag) {
 772                         skb = frag->next;
 773                         kfree_skb(frag);
 774                         frag = skb;
 775                 }
 776
 777                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 778                               IPSTATS_MIB_FRAGFAILS);
 779                 dst_release(&rt->dst);
 780                 return err;
 781
 782 slow_path_clean:
 783                 skb_walk_frags(skb, frag2) {
 784                         if (frag2 == frag)
 785                                 break;
 786                         frag2->sk = NULL;
 787                         frag2->destructor = NULL;
 788                         skb->truesize += frag2->truesize;
 789                 }
 790         }
 791
 792 slow_path:
 793         left = skb->len - hlen;         /* Space per frame */
 794         ptr = hlen;                     /* Where to start from */
 795
 796         /*
 797          *      Fragment the datagram.
 798          */
 799
 800         *prevhdr = NEXTHDR_FRAGMENT;
 801         hroom = LL_RESERVED_SPACE(rt->dst.dev);
 802         troom = rt->dst.dev->needed_tailroom;
 803
 804         /*
 805          *      Keep copying data until we run out.
 806          */
 807         while(left > 0) {
 808                 len = left;
 809                 /* IF: it doesn't fit, use 'mtu' - the data space left */
 810                 if (len > mtu)
 811                         len = mtu;
 812                 /* IF: we are not sending up to and including the packet end
 813                    then align the next start on an eight byte boundary */
 814                 if (len < left) {
 815                         len &= ~7;
 816                 }
 817                 /*
 818                  *      Allocate buffer.
 819                  */
 820
 821                 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
 822                                       hroom + troom, GFP_ATOMIC)) == NULL) {
 823                         NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
 824                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 825                                       IPSTATS_MIB_FRAGFAILS);
 826                         err = -ENOMEM;
 827                         goto fail;
 828                 }
 829
 830                 /*
 831                  *      Set up data on packet
 832                  */
 833
 834                 ip6_copy_metadata(frag, skb);
 835                 skb_reserve(frag, hroom);
 836                 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
 837                 skb_reset_network_header(frag);
 838                 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
 839                 frag->transport_header = (frag->network_header + hlen +
 840                                           sizeof(struct frag_hdr));
 841
 842                 /*
 843                  *      Charge the memory for the fragment to any owner
 844                  *      it might possess
 845                  */
 846                 if (skb->sk)
 847                         skb_set_owner_w(frag, skb->sk);
 848
 849                 /*
 850                  *      Copy the packet header into the new buffer.
 851                  */
 852                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 853
 854                 /*
 855                  *      Build fragment header.
 856                  */
 857                 fh->nexthdr = nexthdr;
 858                 fh->reserved = 0;
 859                 if (!frag_id) {
 860                         ipv6_select_ident(fh, rt);
 861                         frag_id = fh->identification;
 862                 } else
 863                         fh->identification = frag_id;
 864
 865                 /*
 866                  *      Copy a block of the IP datagram.
 867                  */
 868                 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
 869                         BUG();
 870                 left -= len;
 871
 872                 fh->frag_off = htons(offset);
 873                 if (left > 0)
 874                         fh->frag_off |= htons(IP6_MF);
 875                 ipv6_hdr(frag)->payload_len = htons(frag->len -
 876                                                     sizeof(struct ipv6hdr));
 877
 878                 ptr += len;
 879                 offset += len;
 880
 881                 /*
 882                  *      Put this fragment into the sending queue.
 883                  */
 884                 err = output(frag);
 885                 if (err)
 886                         goto fail;
 887
 888                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 889                               IPSTATS_MIB_FRAGCREATES);
 890         }
 891         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 892                       IPSTATS_MIB_FRAGOKS);
 893         kfree_skb(skb);
 894         return err;
 895
 896 fail:
 897         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 898                       IPSTATS_MIB_FRAGFAILS);
 899         kfree_skb(skb);
 900         return err;
 901 }
 902
 903 static inline int ip6_rt_check(const struct rt6key *rt_key,
 904                                const struct in6_addr *fl_addr,
 905                                const struct in6_addr *addr_cache)
 906 {
 907         return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
 908                 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
 909 }
 910
 911 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
 912                                           struct dst_entry *dst,
 913                                           const struct flowi6 *fl6)
 914 {
 915         struct ipv6_pinfo *np = inet6_sk(sk);
 916         struct rt6_info *rt = (struct rt6_info *)dst;
 917
 918         if (!dst)
 919                 goto out;
 920
 921         /* Yes, checking route validity in not connected
 922          * case is not very simple. Take into account,
 923          * that we do not support routing by source, TOS,
 924          * and MSG_DONTROUTE            --ANK (980726)
 925          *
 926          * 1. ip6_rt_check(): If route was host route,
 927          *    check that cached destination is current.
 928          *    If it is network route, we still may
 929          *    check its validity using saved pointer
 930          *    to the last used address: daddr_cache.
 931          *    We do not want to save whole address now,
 932          *    (because main consumer of this service
 933          *    is tcp, which has not this problem),
 934          *    so that the last trick works only on connected
 935          *    sockets.
 936          * 2. oif also should be the same.
 937          */
 938         if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
 939 #ifdef CONFIG_IPV6_SUBTREES
 940             ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
 941 #endif
 942             (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
 943                 dst_release(dst);
 944                 dst = NULL;
 945         }
 946
 947 out:
 948         return dst;
 949 }
 950
 951 static int ip6_dst_lookup_tail(struct sock *sk,
 952                                struct dst_entry **dst, struct flowi6 *fl6)
 953 {
 954         struct net *net = sock_net(sk);
 955 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 956         struct neighbour *n;
 957 #endif
 958         int err;
 959
 960         if (*dst == NULL)
 961                 *dst = ip6_route_output(net, sk, fl6);
 962
 963         if ((err = (*dst)->error))
 964                 goto out_err_release;
 965
 966         if (ipv6_addr_any(&fl6->saddr)) {
 967                 struct rt6_info *rt = (struct rt6_info *) *dst;
 968                 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
 969                                           sk ? inet6_sk(sk)->srcprefs : 0,
 970                                           &fl6->saddr);
 971                 if (err)
 972                         goto out_err_release;
 973         }
 974
 975 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 976         /*
 977          * Here if the dst entry we've looked up
 978          * has a neighbour entry that is in the INCOMPLETE
 979          * state and the src address from the flow is
 980          * marked as OPTIMISTIC, we release the found
 981          * dst entry and replace it instead with the
 982          * dst entry of the nexthop router
 983          */
 984         rcu_read_lock();
 985         n = dst_get_neighbour(*dst);
 986         if (n && !(n->nud_state & NUD_VALID)) {
 987                 struct inet6_ifaddr *ifp;
 988                 struct flowi6 fl_gw6;
 989                 int redirect;
 990
 991                 rcu_read_unlock();
 992                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
 993                                       (*dst)->dev, 1);
 994
 995                 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
 996                 if (ifp)
 997                         in6_ifa_put(ifp);
 998
 999                 if (redirect) {
1000                         /*
1001                          * We need to get the dst entry for the
1002                          * default router instead
1003                          */
1004                         dst_release(*dst);
1005                         memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1006                         memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1007                         *dst = ip6_route_output(net, sk, &fl_gw6);
1008                         if ((err = (*dst)->error))
1009                                 goto out_err_release;
1010                 }
1011         } else {
1012                 rcu_read_unlock();
1013         }
1014 #endif
1015
1016         return 0;
1017
1018 out_err_release:
1019         if (err == -ENETUNREACH)
1020                 IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1021         dst_release(*dst);
1022         *dst = NULL;
1023         return err;
1024 }
1025
1026 /**
1027  *      ip6_dst_lookup - perform route lookup on flow
1028  *      @sk: socket which provides route info
1029  *      @dst: pointer to dst_entry * for result
1030  *      @fl6: flow to lookup
1031  *
1032  *      This function performs a route lookup on the given flow.
1033  *
1034  *      It returns zero on success, or a standard errno code on error.
1035  */
1036 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
1037 {
1038         *dst = NULL;
1039         return ip6_dst_lookup_tail(sk, dst, fl6);
1040 }
1041 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1042
1043 /**
1044  *      ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1045  *      @sk: socket which provides route info
1046  *      @fl6: flow to lookup
1047  *      @final_dst: final destination address for ipsec lookup
1048  *      @can_sleep: we are in a sleepable context
1049  *
1050  *      This function performs a route lookup on the given flow.
1051  *
1052  *      It returns a valid dst pointer on success, or a pointer encoded
1053  *      error code.
1054  */
1055 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1056                                       const struct in6_addr *final_dst,
1057                                       bool can_sleep)
1058 {
1059         struct dst_entry *dst = NULL;
1060         int err;
1061
1062         err = ip6_dst_lookup_tail(sk, &dst, fl6);
1063         if (err)
1064                 return ERR_PTR(err);
1065         if (final_dst)
1066                 fl6->daddr = *final_dst;
1067         if (can_sleep)
1068                 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1069
1070         return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1071 }
1072 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1073
1074 /**
1075  *      ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1076  *      @sk: socket which provides the dst cache and route info
1077  *      @fl6: flow to lookup
1078  *      @final_dst: final destination address for ipsec lookup
1079  *      @can_sleep: we are in a sleepable context
1080  *
1081  *      This function performs a route lookup on the given flow with the
1082  *      possibility of using the cached route in the socket if it is valid.
1083  *      It will take the socket dst lock when operating on the dst cache.
1084  *      As a result, this function can only be used in process context.
1085  *
1086  *      It returns a valid dst pointer on success, or a pointer encoded
1087  *      error code.
1088  */
1089 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1090                                          const struct in6_addr *final_dst,
1091                                          bool can_sleep)
1092 {
1093         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1094         int err;
1095
1096         dst = ip6_sk_dst_check(sk, dst, fl6);
1097
1098         err = ip6_dst_lookup_tail(sk, &dst, fl6);
1099         if (err)
1100                 return ERR_PTR(err);
1101         if (final_dst)
1102                 fl6->daddr = *final_dst;
1103         if (can_sleep)
1104                 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1105
1106         return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1107 }
1108 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1109
1110 static inline int ip6_ufo_append_data(struct sock *sk,
1111                         int getfrag(void *from, char *to, int offset, int len,
1112                         int odd, struct sk_buff *skb),
1113                         void *from, int length, int hh_len, int fragheaderlen,
1114                         int transhdrlen, int mtu,unsigned int flags,
1115                         struct rt6_info *rt)
1116
1117 {
1118         struct sk_buff *skb;
1119         int err;
1120
1121         /* There is support for UDP large send offload by network
1122          * device, so create one single skb packet containing complete
1123          * udp datagram
1124          */
1125         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1126                 skb = sock_alloc_send_skb(sk,
1127                         hh_len + fragheaderlen + transhdrlen + 20,
1128                         (flags & MSG_DONTWAIT), &err);
1129                 if (skb == NULL)
1130                         return err;
1131
1132                 /* reserve space for Hardware header */
1133                 skb_reserve(skb, hh_len);
1134
1135                 /* create space for UDP/IP header */
1136                 skb_put(skb,fragheaderlen + transhdrlen);
1137
1138                 /* initialize network header pointer */
1139                 skb_reset_network_header(skb);
1140
1141                 /* initialize protocol header pointer */
1142                 skb->transport_header = skb->network_header + fragheaderlen;
1143
1144                 skb->ip_summed = CHECKSUM_PARTIAL;
1145                 skb->csum = 0;
1146         }
1147
1148         err = skb_append_datato_frags(sk,skb, getfrag, from,
1149                                       (length - transhdrlen));
1150         if (!err) {
1151                 struct frag_hdr fhdr;
1152
1153                 /* Specify the length of each IPv6 datagram fragment.
1154                  * It has to be a multiple of 8.
1155                  */
1156                 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1157                                              sizeof(struct frag_hdr)) & ~7;
1158                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1159                 ipv6_select_ident(&fhdr, rt);
1160                 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1161                 __skb_queue_tail(&sk->sk_write_queue, skb);
1162
1163                 return 0;
1164         }
1165         /* There is not enough support do UPD LSO,
1166          * so follow normal path
1167          */
1168         kfree_skb(skb);
1169
1170         return err;
1171 }
1172
1173 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1174                                                gfp_t gfp)
1175 {
1176         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1177 }
1178
1179 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1180                                                 gfp_t gfp)
1181 {
1182         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1183 }
1184
1185 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1186         int offset, int len, int odd, struct sk_buff *skb),
1187         void *from, int length, int transhdrlen,
1188         int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1189         struct rt6_info *rt, unsigned int flags, int dontfrag)
1190 {
1191         struct inet_sock *inet = inet_sk(sk);
1192         struct ipv6_pinfo *np = inet6_sk(sk);
1193         struct inet_cork *cork;
1194         struct sk_buff *skb;
1195         unsigned int maxfraglen, fragheaderlen;
1196         int exthdrlen;
1197         int dst_exthdrlen;
1198         int hh_len;
1199         int mtu;
1200         int copy;
1201         int err;
1202         int offset = 0;
1203         int csummode = CHECKSUM_NONE;
1204         __u8 tx_flags = 0;
1205
1206         if (flags&MSG_PROBE)
1207                 return 0;
1208         cork = &inet->cork.base;
1209         if (skb_queue_empty(&sk->sk_write_queue)) {
1210                 /*
1211                  * setup for corking
1212                  */
1213                 if (opt) {
1214                         if (WARN_ON(np->cork.opt))
1215                                 return -EINVAL;
1216
1217                         np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
1218                         if (unlikely(np->cork.opt == NULL))
1219                                 return -ENOBUFS;
1220
1221                         np->cork.opt->tot_len = opt->tot_len;
1222                         np->cork.opt->opt_flen = opt->opt_flen;
1223                         np->cork.opt->opt_nflen = opt->opt_nflen;
1224
1225                         np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1226                                                             sk->sk_allocation);
1227                         if (opt->dst0opt && !np->cork.opt->dst0opt)
1228                                 return -ENOBUFS;
1229
1230                         np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1231                                                             sk->sk_allocation);
1232                         if (opt->dst1opt && !np->cork.opt->dst1opt)
1233                                 return -ENOBUFS;
1234
1235                         np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1236                                                            sk->sk_allocation);
1237                         if (opt->hopopt && !np->cork.opt->hopopt)
1238                                 return -ENOBUFS;
1239
1240                         np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1241                                                             sk->sk_allocation);
1242                         if (opt->srcrt && !np->cork.opt->srcrt)
1243                                 return -ENOBUFS;
1244
1245                         /* need source address above miyazawa*/
1246                 }
1247                 dst_hold(&rt->dst);
1248                 cork->dst = &rt->dst;
1249                 inet->cork.fl.u.ip6 = *fl6;
1250                 np->cork.hop_limit = hlimit;
1251                 np->cork.tclass = tclass;
1252                 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1253                       rt->dst.dev->mtu : dst_mtu(&rt->dst);
1254                 if (np->frag_size < mtu) {
1255                         if (np->frag_size)
1256                                 mtu = np->frag_size;
1257                 }
1258                 cork->fragsize = mtu;
1259                 if (dst_allfrag(rt->dst.path))
1260                         cork->flags |= IPCORK_ALLFRAG;
1261                 cork->length = 0;
1262                 sk->sk_sndmsg_page = NULL;
1263                 sk->sk_sndmsg_off = 0;
1264                 exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
1265                 length += exthdrlen;
1266                 transhdrlen += exthdrlen;
1267                 dst_exthdrlen = rt->dst.header_len;
1268         } else {
1269                 rt = (struct rt6_info *)cork->dst;
1270                 fl6 = &inet->cork.fl.u.ip6;
1271                 opt = np->cork.opt;
1272                 transhdrlen = 0;
1273                 exthdrlen = 0;
1274                 dst_exthdrlen = 0;
1275                 mtu = cork->fragsize;
1276         }
1277
1278         hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1279
1280         fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1281                         (opt ? opt->opt_nflen : 0);
1282         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1283
1284         if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1285                 if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1286                         ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1287                         return -EMSGSIZE;
1288                 }
1289         }
1290
1291         /* For UDP, check if TX timestamp is enabled */
1292         if (sk->sk_type == SOCK_DGRAM) {
1293                 err = sock_tx_timestamp(sk, &tx_flags);
1294                 if (err)
1295                         goto error;
1296         }
1297
1298         /*
1299          * Let's try using as much space as possible.
1300          * Use MTU if total length of the message fits into the MTU.
1301          * Otherwise, we need to reserve fragment header and
1302          * fragment alignment (= 8-15 octects, in total).
1303          *
1304          * Note that we may need to "move" the data from the tail of
1305          * of the buffer to the new fragment when we split
1306          * the message.
1307          *
1308          * FIXME: It may be fragmented into multiple chunks
1309          *        at once if non-fragmentable extension headers
1310          *        are too large.
1311          * --yoshfuji
1312          */
1313
1314         cork->length += length;
1315         if (length > mtu) {
1316                 int proto = sk->sk_protocol;
1317                 if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
1318                         ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1319                         return -EMSGSIZE;
1320                 }
1321
1322                 if (proto == IPPROTO_UDP &&
1323                     (rt->dst.dev->features & NETIF_F_UFO)) {
1324
1325                         err = ip6_ufo_append_data(sk, getfrag, from, length,
1326                                                   hh_len, fragheaderlen,
1327                                                   transhdrlen, mtu, flags, rt);
1328                         if (err)
1329                                 goto error;
1330                         return 0;
1331                 }
1332         }
1333
1334         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
1335                 goto alloc_new_skb;
1336
1337         while (length > 0) {
1338                 /* Check if the remaining data fits into current packet. */
1339                 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1340                 if (copy < length)
1341                         copy = maxfraglen - skb->len;
1342
1343                 if (copy <= 0) {
1344                         char *data;
1345                         unsigned int datalen;
1346                         unsigned int fraglen;
1347                         unsigned int fraggap;
1348                         unsigned int alloclen;
1349                         struct sk_buff *skb_prev;
1350 alloc_new_skb:
1351                         skb_prev = skb;
1352
1353                         /* There's no room in the current skb */
1354                         if (skb_prev)
1355                                 fraggap = skb_prev->len - maxfraglen;
1356                         else
1357                                 fraggap = 0;
1358
1359                         /*
1360                          * If remaining data exceeds the mtu,
1361                          * we know we need more fragment(s).
1362                          */
1363                         datalen = length + fraggap;
1364                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1365                                 datalen = maxfraglen - fragheaderlen;
1366
1367                         fraglen = datalen + fragheaderlen;
1368                         if ((flags & MSG_MORE) &&
1369                             !(rt->dst.dev->features&NETIF_F_SG))
1370                                 alloclen = mtu;
1371                         else
1372                                 alloclen = datalen + fragheaderlen;
1373
1374                         alloclen += dst_exthdrlen;
1375
1376                         /*
1377                          * The last fragment gets additional space at tail.
1378                          * Note: we overallocate on fragments with MSG_MODE
1379                          * because we have no idea if we're the last one.
1380                          */
1381                         if (datalen == length + fraggap)
1382                                 alloclen += rt->dst.trailer_len;
1383
1384                         /*
1385                          * We just reserve space for fragment header.
1386                          * Note: this may be overallocation if the message
1387                          * (without MSG_MORE) fits into the MTU.
1388                          */
1389                         alloclen += sizeof(struct frag_hdr);
1390
1391                         if (transhdrlen) {
1392                                 skb = sock_alloc_send_skb(sk,
1393                                                 alloclen + hh_len,
1394                                                 (flags & MSG_DONTWAIT), &err);
1395                         } else {
1396                                 skb = NULL;
1397                                 if (atomic_read(&sk->sk_wmem_alloc) <=
1398                                     2 * sk->sk_sndbuf)
1399                                         skb = sock_wmalloc(sk,
1400                                                            alloclen + hh_len, 1,
1401                                                            sk->sk_allocation);
1402                                 if (unlikely(skb == NULL))
1403                                         err = -ENOBUFS;
1404                                 else {
1405                                         /* Only the initial fragment
1406                                          * is time stamped.
1407                                          */
1408                                         tx_flags = 0;
1409                                 }
1410                         }
1411                         if (skb == NULL)
1412                                 goto error;
1413                         /*
1414                          *      Fill in the control structures
1415                          */
1416                         skb->ip_summed = csummode;
1417                         skb->csum = 0;
1418                         /* reserve for fragmentation */
1419                         skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
1420
1421                         if (sk->sk_type == SOCK_DGRAM)
1422                                 skb_shinfo(skb)->tx_flags = tx_flags;
1423
1424                         /*
1425                          *      Find where to start putting bytes
1426                          */
1427                         data = skb_put(skb, fraglen + dst_exthdrlen);
1428                         skb_set_network_header(skb, exthdrlen + dst_exthdrlen);
1429                         data += fragheaderlen + dst_exthdrlen;
1430                         skb->transport_header = (skb->network_header +
1431                                                  fragheaderlen);
1432                         if (fraggap) {
1433                                 skb->csum = skb_copy_and_csum_bits(
1434                                         skb_prev, maxfraglen,
1435                                         data + transhdrlen, fraggap, 0);
1436                                 skb_prev->csum = csum_sub(skb_prev->csum,
1437                                                           skb->csum);
1438                                 data += fraggap;
1439                                 pskb_trim_unique(skb_prev, maxfraglen);
1440                         }
1441                         copy = datalen - transhdrlen - fraggap;
1442
1443                         if (copy < 0) {
1444                                 err = -EINVAL;
1445                                 kfree_skb(skb);
1446                                 goto error;
1447                         } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1448                                 err = -EFAULT;
1449                                 kfree_skb(skb);
1450                                 goto error;
1451                         }
1452
1453                         offset += copy;
1454                         length -= datalen - fraggap;
1455                         transhdrlen = 0;
1456                         exthdrlen = 0;
1457                         dst_exthdrlen = 0;
1458                         csummode = CHECKSUM_NONE;
1459
1460                         /*
1461                          * Put the packet on the pending queue
1462                          */
1463                         __skb_queue_tail(&sk->sk_write_queue, skb);
1464                         continue;
1465                 }
1466
1467                 if (copy > length)
1468                         copy = length;
1469
1470                 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1471                         unsigned int off;
1472
1473                         off = skb->len;
1474                         if (getfrag(from, skb_put(skb, copy),
1475                                                 offset, copy, off, skb) < 0) {
1476                                 __skb_trim(skb, off);
1477                                 err = -EFAULT;
1478                                 goto error;
1479                         }
1480                 } else {
1481                         int i = skb_shinfo(skb)->nr_frags;
1482                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
1483                         struct page *page = sk->sk_sndmsg_page;
1484                         int off = sk->sk_sndmsg_off;
1485                         unsigned int left;
1486
1487                         if (page && (left = PAGE_SIZE - off) > 0) {
1488                                 if (copy >= left)
1489                                         copy = left;
1490                                 if (page != skb_frag_page(frag)) {
1491                                         if (i == MAX_SKB_FRAGS) {
1492                                                 err = -EMSGSIZE;
1493                                                 goto error;
1494                                         }
1495                                         skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
1496                                         skb_frag_ref(skb, i);
1497                                         frag = &skb_shinfo(skb)->frags[i];
1498                                 }
1499                         } else if(i < MAX_SKB_FRAGS) {
1500                                 if (copy > PAGE_SIZE)
1501                                         copy = PAGE_SIZE;
1502                                 page = alloc_pages(sk->sk_allocation, 0);
1503                                 if (page == NULL) {
1504                                         err = -ENOMEM;
1505                                         goto error;
1506                                 }
1507                                 sk->sk_sndmsg_page = page;
1508                                 sk->sk_sndmsg_off = 0;
1509
1510                                 skb_fill_page_desc(skb, i, page, 0, 0);
1511                                 frag = &skb_shinfo(skb)->frags[i];
1512                         } else {
1513                                 err = -EMSGSIZE;
1514                                 goto error;
1515                         }
1516                         if (getfrag(from,
1517                                     skb_frag_address(frag) + skb_frag_size(frag),
1518                                     offset, copy, skb->len, skb) < 0) {
1519                                 err = -EFAULT;
1520                                 goto error;
1521                         }
1522                         sk->sk_sndmsg_off += copy;
1523                         skb_frag_size_add(frag, copy);
1524                         skb->len += copy;
1525                         skb->data_len += copy;
1526                         skb->truesize += copy;
1527                         atomic_add(copy, &sk->sk_wmem_alloc);
1528                 }
1529                 offset += copy;
1530                 length -= copy;
1531         }
1532         return 0;
1533 error:
1534         cork->length -= length;
1535         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1536         return err;
1537 }
1538
1539 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1540 {
1541         if (np->cork.opt) {
1542                 kfree(np->cork.opt->dst0opt);
1543                 kfree(np->cork.opt->dst1opt);
1544                 kfree(np->cork.opt->hopopt);
1545                 kfree(np->cork.opt->srcrt);
1546                 kfree(np->cork.opt);
1547                 np->cork.opt = NULL;
1548         }
1549
1550         if (inet->cork.base.dst) {
1551                 dst_release(inet->cork.base.dst);
1552                 inet->cork.base.dst = NULL;
1553                 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1554         }
1555         memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1556 }
1557
1558 int ip6_push_pending_frames(struct sock *sk)
1559 {
1560         struct sk_buff *skb, *tmp_skb;
1561         struct sk_buff **tail_skb;
1562         struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1563         struct inet_sock *inet = inet_sk(sk);
1564         struct ipv6_pinfo *np = inet6_sk(sk);
1565         struct net *net = sock_net(sk);
1566         struct ipv6hdr *hdr;
1567         struct ipv6_txoptions *opt = np->cork.opt;
1568         struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1569         struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1570         unsigned char proto = fl6->flowi6_proto;
1571         int err = 0;
1572
1573         if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1574                 goto out;
1575         tail_skb = &(skb_shinfo(skb)->frag_list);
1576
1577         /* move skb->data to ip header from ext header */
1578         if (skb->data < skb_network_header(skb))
1579                 __skb_pull(skb, skb_network_offset(skb));
1580         while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1581                 __skb_pull(tmp_skb, skb_network_header_len(skb));
1582                 *tail_skb = tmp_skb;
1583                 tail_skb = &(tmp_skb->next);
1584                 skb->len += tmp_skb->len;
1585                 skb->data_len += tmp_skb->len;
1586                 skb->truesize += tmp_skb->truesize;
1587                 tmp_skb->destructor = NULL;
1588                 tmp_skb->sk = NULL;
1589         }
1590
1591         /* Allow local fragmentation. */
1592         if (np->pmtudisc < IPV6_PMTUDISC_DO)
1593                 skb->local_df = 1;
1594
1595         *final_dst = fl6->daddr;
1596         __skb_pull(skb, skb_network_header_len(skb));
1597         if (opt && opt->opt_flen)
1598                 ipv6_push_frag_opts(skb, opt, &proto);
1599         if (opt && opt->opt_nflen)
1600                 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1601
1602         skb_push(skb, sizeof(struct ipv6hdr));
1603         skb_reset_network_header(skb);
1604         hdr = ipv6_hdr(skb);
1605
1606         *(__be32*)hdr = fl6->flowlabel |
1607                      htonl(0x60000000 | ((int)np->cork.tclass << 20));
1608
1609         hdr->hop_limit = np->cork.hop_limit;
1610         hdr->nexthdr = proto;
1611         hdr->saddr = fl6->saddr;
1612         hdr->daddr = *final_dst;
1613
1614         skb->priority = sk->sk_priority;
1615         skb->mark = sk->sk_mark;
1616
1617         skb_dst_set(skb, dst_clone(&rt->dst));
1618         IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1619         if (proto == IPPROTO_ICMPV6) {
1620                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1621
1622                 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1623                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1624         }
1625
1626         err = ip6_local_out(skb);
1627         if (err) {
1628                 if (err > 0)
1629                         err = net_xmit_errno(err);
1630                 if (err)
1631                         goto error;
1632         }
1633
1634 out:
1635         ip6_cork_release(inet, np);
1636         return err;
1637 error:
1638         IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1639         goto out;
1640 }
1641
1642 void ip6_flush_pending_frames(struct sock *sk)
1643 {
1644         struct sk_buff *skb;
1645
1646         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1647                 if (skb_dst(skb))
1648                         IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1649                                       IPSTATS_MIB_OUTDISCARDS);
1650                 kfree_skb(skb);
1651         }
1652
1653         ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1654 }