2 * IPv6 output functions
3 * Linux INET6 implementation
6 * Pedro Roque <roque@di.fc.ul.pt>
8 * Based on linux/net/ipv4/ip_output.c
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv6.h>
49 #include <net/ndisc.h>
50 #include <net/protocol.h>
51 #include <net/ip6_route.h>
52 #include <net/addrconf.h>
53 #include <net/rawv6.h>
56 #include <net/checksum.h>
57 #include <linux/mroute6.h>
59 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
61 int __ip6_local_out(struct sk_buff *skb)
65 len = skb->len - sizeof(struct ipv6hdr);
66 if (len > IPV6_MAXPLEN)
68 ipv6_hdr(skb)->payload_len = htons(len);
70 return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
71 skb_dst(skb)->dev, dst_output);
74 int ip6_local_out(struct sk_buff *skb)
78 err = __ip6_local_out(skb);
80 err = dst_output(skb);
84 EXPORT_SYMBOL_GPL(ip6_local_out);
86 static int ip6_finish_output2(struct sk_buff *skb)
88 struct dst_entry *dst = skb_dst(skb);
89 struct net_device *dev = dst->dev;
90 struct neighbour *neigh;
93 skb->protocol = htons(ETH_P_IPV6);
96 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
97 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
99 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
100 ((mroute6_socket(dev_net(dev), skb) &&
101 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
102 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
103 &ipv6_hdr(skb)->saddr))) {
104 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
106 /* Do not check for IFF_ALLMULTI; multicast routing
107 is not supported in any case.
110 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
111 newskb, NULL, newskb->dev,
114 if (ipv6_hdr(skb)->hop_limit == 0) {
115 IP6_INC_STATS(dev_net(dev), idev,
116 IPSTATS_MIB_OUTDISCARDS);
122 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
127 rt = (struct rt6_info *) dst;
130 int res = dst_neigh_output(dst, neigh, skb);
136 IP6_INC_STATS_BH(dev_net(dst->dev),
137 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
142 static int ip6_finish_output(struct sk_buff *skb)
144 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
145 dst_allfrag(skb_dst(skb)))
146 return ip6_fragment(skb, ip6_finish_output2);
148 return ip6_finish_output2(skb);
151 int ip6_output(struct sk_buff *skb)
153 struct net_device *dev = skb_dst(skb)->dev;
154 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
155 if (unlikely(idev->cnf.disable_ipv6)) {
156 IP6_INC_STATS(dev_net(dev), idev,
157 IPSTATS_MIB_OUTDISCARDS);
162 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
164 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
168 * xmit an sk_buff (used by TCP, SCTP and DCCP)
171 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
172 struct ipv6_txoptions *opt, int tclass)
174 struct net *net = sock_net(sk);
175 struct ipv6_pinfo *np = inet6_sk(sk);
176 struct in6_addr *first_hop = &fl6->daddr;
177 struct dst_entry *dst = skb_dst(skb);
179 u8 proto = fl6->flowi6_proto;
180 int seg_len = skb->len;
185 unsigned int head_room;
187 /* First: exthdrs may take lots of space (~8K for now)
188 MAX_HEADER is not enough.
190 head_room = opt->opt_nflen + opt->opt_flen;
191 seg_len += head_room;
192 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
194 if (skb_headroom(skb) < head_room) {
195 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
197 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
198 IPSTATS_MIB_OUTDISCARDS);
204 skb_set_owner_w(skb, sk);
207 ipv6_push_frag_opts(skb, opt, &proto);
209 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
212 skb_push(skb, sizeof(struct ipv6hdr));
213 skb_reset_network_header(skb);
217 * Fill in the IPv6 header
220 hlimit = np->hop_limit;
222 hlimit = ip6_dst_hoplimit(dst);
224 *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl6->flowlabel;
226 hdr->payload_len = htons(seg_len);
227 hdr->nexthdr = proto;
228 hdr->hop_limit = hlimit;
230 hdr->saddr = fl6->saddr;
231 hdr->daddr = *first_hop;
233 skb->priority = sk->sk_priority;
234 skb->mark = sk->sk_mark;
237 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
238 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
239 IPSTATS_MIB_OUT, skb->len);
240 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
241 dst->dev, dst_output);
244 net_dbg_ratelimited("IPv6: sending pkt_too_big to self\n");
246 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
247 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
252 EXPORT_SYMBOL(ip6_xmit);
255 * To avoid extra problems ND packets are send through this
256 * routine. It's code duplication but I really want to avoid
257 * extra checks since ipv6_build_header is used by TCP (which
258 * is for us performance critical)
261 int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
262 const struct in6_addr *saddr, const struct in6_addr *daddr,
265 struct ipv6_pinfo *np = inet6_sk(sk);
268 skb->protocol = htons(ETH_P_IPV6);
271 skb_reset_network_header(skb);
272 skb_put(skb, sizeof(struct ipv6hdr));
275 *(__be32*)hdr = htonl(0x60000000);
277 hdr->payload_len = htons(len);
278 hdr->nexthdr = proto;
279 hdr->hop_limit = np->hop_limit;
287 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
289 struct ip6_ra_chain *ra;
290 struct sock *last = NULL;
292 read_lock(&ip6_ra_lock);
293 for (ra = ip6_ra_chain; ra; ra = ra->next) {
294 struct sock *sk = ra->sk;
295 if (sk && ra->sel == sel &&
296 (!sk->sk_bound_dev_if ||
297 sk->sk_bound_dev_if == skb->dev->ifindex)) {
299 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
301 rawv6_rcv(last, skb2);
308 rawv6_rcv(last, skb);
309 read_unlock(&ip6_ra_lock);
312 read_unlock(&ip6_ra_lock);
316 static int ip6_forward_proxy_check(struct sk_buff *skb)
318 struct ipv6hdr *hdr = ipv6_hdr(skb);
319 u8 nexthdr = hdr->nexthdr;
323 if (ipv6_ext_hdr(nexthdr)) {
324 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
328 offset = sizeof(struct ipv6hdr);
330 if (nexthdr == IPPROTO_ICMPV6) {
331 struct icmp6hdr *icmp6;
333 if (!pskb_may_pull(skb, (skb_network_header(skb) +
334 offset + 1 - skb->data)))
337 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
339 switch (icmp6->icmp6_type) {
340 case NDISC_ROUTER_SOLICITATION:
341 case NDISC_ROUTER_ADVERTISEMENT:
342 case NDISC_NEIGHBOUR_SOLICITATION:
343 case NDISC_NEIGHBOUR_ADVERTISEMENT:
345 /* For reaction involving unicast neighbor discovery
346 * message destined to the proxied address, pass it to
356 * The proxying router can't forward traffic sent to a link-local
357 * address, so signal the sender and discard the packet. This
358 * behavior is clarified by the MIPv6 specification.
360 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
361 dst_link_failure(skb);
368 static inline int ip6_forward_finish(struct sk_buff *skb)
370 return dst_output(skb);
373 int ip6_forward(struct sk_buff *skb)
375 struct dst_entry *dst = skb_dst(skb);
376 struct ipv6hdr *hdr = ipv6_hdr(skb);
377 struct inet6_skb_parm *opt = IP6CB(skb);
378 struct net *net = dev_net(dst->dev);
381 if (net->ipv6.devconf_all->forwarding == 0)
384 if (skb_warn_if_lro(skb))
387 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
388 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
392 if (skb->pkt_type != PACKET_HOST)
395 skb_forward_csum(skb);
398 * We DO NOT make any processing on
399 * RA packets, pushing them to user level AS IS
400 * without ane WARRANTY that application will be able
401 * to interpret them. The reason is that we
402 * cannot make anything clever here.
404 * We are not end-node, so that if packet contains
405 * AH/ESP, we cannot make anything.
406 * Defragmentation also would be mistake, RA packets
407 * cannot be fragmented, because there is no warranty
408 * that different fragments will go along one path. --ANK
411 u8 *ptr = skb_network_header(skb) + opt->ra;
412 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
417 * check and decrement ttl
419 if (hdr->hop_limit <= 1) {
420 /* Force OUTPUT device used as source address */
422 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
423 IP6_INC_STATS_BH(net,
424 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
430 /* XXX: idev->cnf.proxy_ndp? */
431 if (net->ipv6.devconf_all->proxy_ndp &&
432 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
433 int proxied = ip6_forward_proxy_check(skb);
435 return ip6_input(skb);
436 else if (proxied < 0) {
437 IP6_INC_STATS(net, ip6_dst_idev(dst),
438 IPSTATS_MIB_INDISCARDS);
443 if (!xfrm6_route_forward(skb)) {
444 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
449 /* IPv6 specs say nothing about it, but it is clear that we cannot
450 send redirects to source routed frames.
451 We don't send redirects to frames decapsulated from IPsec.
453 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
454 struct in6_addr *target = NULL;
455 struct inet_peer *peer;
459 * incoming and outgoing devices are the same
463 rt = (struct rt6_info *) dst;
464 if (rt->rt6i_flags & RTF_GATEWAY)
465 target = &rt->rt6i_gateway;
467 target = &hdr->daddr;
469 peer = rt6_get_peer_create(rt);
471 /* Limit redirects both by destination (here)
472 and by source (inside ndisc_send_redirect)
474 if (inet_peer_xrlim_allow(peer, 1*HZ))
475 ndisc_send_redirect(skb, target);
477 int addrtype = ipv6_addr_type(&hdr->saddr);
479 /* This check is security critical. */
480 if (addrtype == IPV6_ADDR_ANY ||
481 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
483 if (addrtype & IPV6_ADDR_LINKLOCAL) {
484 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
485 ICMPV6_NOT_NEIGHBOUR, 0);
491 if (mtu < IPV6_MIN_MTU)
494 if (skb->len > mtu && !skb_is_gso(skb)) {
495 /* Again, force OUTPUT device used as source address */
497 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
498 IP6_INC_STATS_BH(net,
499 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
500 IP6_INC_STATS_BH(net,
501 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
506 if (skb_cow(skb, dst->dev->hard_header_len)) {
507 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
513 /* Mangling hops number delayed to point after skb COW */
517 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
518 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
519 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
523 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
529 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
531 to->pkt_type = from->pkt_type;
532 to->priority = from->priority;
533 to->protocol = from->protocol;
535 skb_dst_set(to, dst_clone(skb_dst(from)));
537 to->mark = from->mark;
539 #ifdef CONFIG_NET_SCHED
540 to->tc_index = from->tc_index;
543 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
544 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
545 to->nf_trace = from->nf_trace;
547 skb_copy_secmark(to, from);
550 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
552 u16 offset = sizeof(struct ipv6hdr);
553 struct ipv6_opt_hdr *exthdr =
554 (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
555 unsigned int packet_len = skb->tail - skb->network_header;
557 *nexthdr = &ipv6_hdr(skb)->nexthdr;
559 while (offset + 1 <= packet_len) {
565 case NEXTHDR_ROUTING:
569 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
570 if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
580 offset += ipv6_optlen(exthdr);
581 *nexthdr = &exthdr->nexthdr;
582 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
589 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
591 static atomic_t ipv6_fragmentation_id;
594 if (rt && !(rt->dst.flags & DST_NOPEER)) {
595 struct inet_peer *peer = rt6_get_peer_create(rt);
598 fhdr->identification = htonl(inet_getid(peer, 0));
603 old = atomic_read(&ipv6_fragmentation_id);
607 } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
608 fhdr->identification = htonl(new);
611 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
613 struct sk_buff *frag;
614 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
615 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
616 struct ipv6hdr *tmp_hdr;
618 unsigned int mtu, hlen, left, len;
621 int ptr, offset = 0, err=0;
622 u8 *prevhdr, nexthdr = 0;
623 struct net *net = dev_net(skb_dst(skb)->dev);
625 hlen = ip6_find_1stfragopt(skb, &prevhdr);
628 mtu = ip6_skb_dst_mtu(skb);
630 /* We must not fragment if the socket is set to force MTU discovery
631 * or if the skb it not generated by a local socket.
633 if (unlikely(!skb->local_df && skb->len > mtu)) {
634 if (skb->sk && dst_allfrag(skb_dst(skb)))
635 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
637 skb->dev = skb_dst(skb)->dev;
638 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
639 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
640 IPSTATS_MIB_FRAGFAILS);
645 if (np && np->frag_size < mtu) {
649 mtu -= hlen + sizeof(struct frag_hdr);
651 if (skb_has_frag_list(skb)) {
652 int first_len = skb_pagelen(skb);
653 struct sk_buff *frag2;
655 if (first_len - hlen > mtu ||
656 ((first_len - hlen) & 7) ||
660 skb_walk_frags(skb, frag) {
661 /* Correct geometry. */
662 if (frag->len > mtu ||
663 ((frag->len & 7) && frag->next) ||
664 skb_headroom(frag) < hlen)
665 goto slow_path_clean;
667 /* Partially cloned skb? */
668 if (skb_shared(frag))
669 goto slow_path_clean;
674 frag->destructor = sock_wfree;
676 skb->truesize -= frag->truesize;
681 frag = skb_shinfo(skb)->frag_list;
682 skb_frag_list_init(skb);
685 *prevhdr = NEXTHDR_FRAGMENT;
686 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
688 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
689 IPSTATS_MIB_FRAGFAILS);
693 __skb_pull(skb, hlen);
694 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
695 __skb_push(skb, hlen);
696 skb_reset_network_header(skb);
697 memcpy(skb_network_header(skb), tmp_hdr, hlen);
699 ipv6_select_ident(fh, rt);
700 fh->nexthdr = nexthdr;
702 fh->frag_off = htons(IP6_MF);
703 frag_id = fh->identification;
705 first_len = skb_pagelen(skb);
706 skb->data_len = first_len - skb_headlen(skb);
707 skb->len = first_len;
708 ipv6_hdr(skb)->payload_len = htons(first_len -
709 sizeof(struct ipv6hdr));
714 /* Prepare header of the next frame,
715 * before previous one went down. */
717 frag->ip_summed = CHECKSUM_NONE;
718 skb_reset_transport_header(frag);
719 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
720 __skb_push(frag, hlen);
721 skb_reset_network_header(frag);
722 memcpy(skb_network_header(frag), tmp_hdr,
724 offset += skb->len - hlen - sizeof(struct frag_hdr);
725 fh->nexthdr = nexthdr;
727 fh->frag_off = htons(offset);
728 if (frag->next != NULL)
729 fh->frag_off |= htons(IP6_MF);
730 fh->identification = frag_id;
731 ipv6_hdr(frag)->payload_len =
733 sizeof(struct ipv6hdr));
734 ip6_copy_metadata(frag, skb);
739 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
740 IPSTATS_MIB_FRAGCREATES);
753 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
754 IPSTATS_MIB_FRAGOKS);
755 dst_release(&rt->dst);
765 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
766 IPSTATS_MIB_FRAGFAILS);
767 dst_release(&rt->dst);
771 skb_walk_frags(skb, frag2) {
775 frag2->destructor = NULL;
776 skb->truesize += frag2->truesize;
781 if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
782 skb_checksum_help(skb))
785 left = skb->len - hlen; /* Space per frame */
786 ptr = hlen; /* Where to start from */
789 * Fragment the datagram.
792 *prevhdr = NEXTHDR_FRAGMENT;
793 hroom = LL_RESERVED_SPACE(rt->dst.dev);
794 troom = rt->dst.dev->needed_tailroom;
797 * Keep copying data until we run out.
801 /* IF: it doesn't fit, use 'mtu' - the data space left */
804 /* IF: we are not sending up to and including the packet end
805 then align the next start on an eight byte boundary */
813 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
814 hroom + troom, GFP_ATOMIC)) == NULL) {
815 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
816 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
817 IPSTATS_MIB_FRAGFAILS);
823 * Set up data on packet
826 ip6_copy_metadata(frag, skb);
827 skb_reserve(frag, hroom);
828 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
829 skb_reset_network_header(frag);
830 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
831 frag->transport_header = (frag->network_header + hlen +
832 sizeof(struct frag_hdr));
835 * Charge the memory for the fragment to any owner
839 skb_set_owner_w(frag, skb->sk);
842 * Copy the packet header into the new buffer.
844 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
847 * Build fragment header.
849 fh->nexthdr = nexthdr;
852 ipv6_select_ident(fh, rt);
853 frag_id = fh->identification;
855 fh->identification = frag_id;
858 * Copy a block of the IP datagram.
860 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
864 fh->frag_off = htons(offset);
866 fh->frag_off |= htons(IP6_MF);
867 ipv6_hdr(frag)->payload_len = htons(frag->len -
868 sizeof(struct ipv6hdr));
874 * Put this fragment into the sending queue.
880 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
881 IPSTATS_MIB_FRAGCREATES);
883 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
884 IPSTATS_MIB_FRAGOKS);
889 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
890 IPSTATS_MIB_FRAGFAILS);
895 static inline int ip6_rt_check(const struct rt6key *rt_key,
896 const struct in6_addr *fl_addr,
897 const struct in6_addr *addr_cache)
899 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
900 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
903 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
904 struct dst_entry *dst,
905 const struct flowi6 *fl6)
907 struct ipv6_pinfo *np = inet6_sk(sk);
908 struct rt6_info *rt = (struct rt6_info *)dst;
913 /* Yes, checking route validity in not connected
914 * case is not very simple. Take into account,
915 * that we do not support routing by source, TOS,
916 * and MSG_DONTROUTE --ANK (980726)
918 * 1. ip6_rt_check(): If route was host route,
919 * check that cached destination is current.
920 * If it is network route, we still may
921 * check its validity using saved pointer
922 * to the last used address: daddr_cache.
923 * We do not want to save whole address now,
924 * (because main consumer of this service
925 * is tcp, which has not this problem),
926 * so that the last trick works only on connected
928 * 2. oif also should be the same.
930 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
931 #ifdef CONFIG_IPV6_SUBTREES
932 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
934 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
943 static int ip6_dst_lookup_tail(struct sock *sk,
944 struct dst_entry **dst, struct flowi6 *fl6)
946 struct net *net = sock_net(sk);
947 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
954 *dst = ip6_route_output(net, sk, fl6);
956 if ((err = (*dst)->error))
957 goto out_err_release;
959 if (ipv6_addr_any(&fl6->saddr)) {
960 struct rt6_info *rt = (struct rt6_info *) *dst;
961 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
962 sk ? inet6_sk(sk)->srcprefs : 0,
965 goto out_err_release;
968 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
970 * Here if the dst entry we've looked up
971 * has a neighbour entry that is in the INCOMPLETE
972 * state and the src address from the flow is
973 * marked as OPTIMISTIC, we release the found
974 * dst entry and replace it instead with the
975 * dst entry of the nexthop router
978 rt = (struct rt6_info *) *dst;
980 if (n && !(n->nud_state & NUD_VALID)) {
981 struct inet6_ifaddr *ifp;
982 struct flowi6 fl_gw6;
986 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
989 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
995 * We need to get the dst entry for the
996 * default router instead
999 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1000 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1001 *dst = ip6_route_output(net, sk, &fl_gw6);
1002 if ((err = (*dst)->error))
1003 goto out_err_release;
1013 if (err == -ENETUNREACH)
1014 IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1021 * ip6_dst_lookup - perform route lookup on flow
1022 * @sk: socket which provides route info
1023 * @dst: pointer to dst_entry * for result
1024 * @fl6: flow to lookup
1026 * This function performs a route lookup on the given flow.
1028 * It returns zero on success, or a standard errno code on error.
1030 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
1033 return ip6_dst_lookup_tail(sk, dst, fl6);
1035 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1038 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1039 * @sk: socket which provides route info
1040 * @fl6: flow to lookup
1041 * @final_dst: final destination address for ipsec lookup
1042 * @can_sleep: we are in a sleepable context
1044 * This function performs a route lookup on the given flow.
1046 * It returns a valid dst pointer on success, or a pointer encoded
1049 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1050 const struct in6_addr *final_dst,
1053 struct dst_entry *dst = NULL;
1056 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1058 return ERR_PTR(err);
1060 fl6->daddr = *final_dst;
1062 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1064 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1066 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1069 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1070 * @sk: socket which provides the dst cache and route info
1071 * @fl6: flow to lookup
1072 * @final_dst: final destination address for ipsec lookup
1073 * @can_sleep: we are in a sleepable context
1075 * This function performs a route lookup on the given flow with the
1076 * possibility of using the cached route in the socket if it is valid.
1077 * It will take the socket dst lock when operating on the dst cache.
1078 * As a result, this function can only be used in process context.
1080 * It returns a valid dst pointer on success, or a pointer encoded
1083 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1084 const struct in6_addr *final_dst,
1087 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1090 dst = ip6_sk_dst_check(sk, dst, fl6);
1092 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1094 return ERR_PTR(err);
1096 fl6->daddr = *final_dst;
1098 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1100 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1102 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1104 static inline int ip6_ufo_append_data(struct sock *sk,
1105 int getfrag(void *from, char *to, int offset, int len,
1106 int odd, struct sk_buff *skb),
1107 void *from, int length, int hh_len, int fragheaderlen,
1108 int transhdrlen, int mtu,unsigned int flags,
1109 struct rt6_info *rt)
1112 struct sk_buff *skb;
1115 /* There is support for UDP large send offload by network
1116 * device, so create one single skb packet containing complete
1119 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1120 skb = sock_alloc_send_skb(sk,
1121 hh_len + fragheaderlen + transhdrlen + 20,
1122 (flags & MSG_DONTWAIT), &err);
1126 /* reserve space for Hardware header */
1127 skb_reserve(skb, hh_len);
1129 /* create space for UDP/IP header */
1130 skb_put(skb,fragheaderlen + transhdrlen);
1132 /* initialize network header pointer */
1133 skb_reset_network_header(skb);
1135 /* initialize protocol header pointer */
1136 skb->transport_header = skb->network_header + fragheaderlen;
1138 skb->ip_summed = CHECKSUM_PARTIAL;
1142 err = skb_append_datato_frags(sk,skb, getfrag, from,
1143 (length - transhdrlen));
1145 struct frag_hdr fhdr;
1147 /* Specify the length of each IPv6 datagram fragment.
1148 * It has to be a multiple of 8.
1150 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1151 sizeof(struct frag_hdr)) & ~7;
1152 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1153 ipv6_select_ident(&fhdr, rt);
1154 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1155 __skb_queue_tail(&sk->sk_write_queue, skb);
1159 /* There is not enough support do UPD LSO,
1160 * so follow normal path
1167 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1170 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1173 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1176 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1179 static void ip6_append_data_mtu(int *mtu,
1181 unsigned int fragheaderlen,
1182 struct sk_buff *skb,
1183 struct rt6_info *rt)
1185 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1187 /* first fragment, reserve header_len */
1188 *mtu = *mtu - rt->dst.header_len;
1192 * this fragment is not first, the headers
1193 * space is regarded as data space.
1195 *mtu = dst_mtu(rt->dst.path);
1197 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1198 + fragheaderlen - sizeof(struct frag_hdr);
1202 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1203 int offset, int len, int odd, struct sk_buff *skb),
1204 void *from, int length, int transhdrlen,
1205 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1206 struct rt6_info *rt, unsigned int flags, int dontfrag)
1208 struct inet_sock *inet = inet_sk(sk);
1209 struct ipv6_pinfo *np = inet6_sk(sk);
1210 struct inet_cork *cork;
1211 struct sk_buff *skb, *skb_prev = NULL;
1212 unsigned int maxfraglen, fragheaderlen;
1222 if (flags&MSG_PROBE)
1224 cork = &inet->cork.base;
1225 if (skb_queue_empty(&sk->sk_write_queue)) {
1230 if (WARN_ON(np->cork.opt))
1233 np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
1234 if (unlikely(np->cork.opt == NULL))
1237 np->cork.opt->tot_len = opt->tot_len;
1238 np->cork.opt->opt_flen = opt->opt_flen;
1239 np->cork.opt->opt_nflen = opt->opt_nflen;
1241 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1243 if (opt->dst0opt && !np->cork.opt->dst0opt)
1246 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1248 if (opt->dst1opt && !np->cork.opt->dst1opt)
1251 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1253 if (opt->hopopt && !np->cork.opt->hopopt)
1256 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1258 if (opt->srcrt && !np->cork.opt->srcrt)
1261 /* need source address above miyazawa*/
1264 cork->dst = &rt->dst;
1265 inet->cork.fl.u.ip6 = *fl6;
1266 np->cork.hop_limit = hlimit;
1267 np->cork.tclass = tclass;
1268 if (rt->dst.flags & DST_XFRM_TUNNEL)
1269 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1270 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1272 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1273 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1274 if (np->frag_size < mtu) {
1276 mtu = np->frag_size;
1278 cork->fragsize = mtu;
1279 if (dst_allfrag(rt->dst.path))
1280 cork->flags |= IPCORK_ALLFRAG;
1282 sk->sk_sndmsg_page = NULL;
1283 sk->sk_sndmsg_off = 0;
1284 exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len;
1285 length += exthdrlen;
1286 transhdrlen += exthdrlen;
1287 dst_exthdrlen = rt->dst.header_len;
1289 rt = (struct rt6_info *)cork->dst;
1290 fl6 = &inet->cork.fl.u.ip6;
1295 mtu = cork->fragsize;
1298 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1300 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1301 (opt ? opt->opt_nflen : 0);
1302 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1304 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1305 if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1306 ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1311 /* For UDP, check if TX timestamp is enabled */
1312 if (sk->sk_type == SOCK_DGRAM) {
1313 err = sock_tx_timestamp(sk, &tx_flags);
1319 * Let's try using as much space as possible.
1320 * Use MTU if total length of the message fits into the MTU.
1321 * Otherwise, we need to reserve fragment header and
1322 * fragment alignment (= 8-15 octects, in total).
1324 * Note that we may need to "move" the data from the tail of
1325 * of the buffer to the new fragment when we split
1328 * FIXME: It may be fragmented into multiple chunks
1329 * at once if non-fragmentable extension headers
1334 cork->length += length;
1336 int proto = sk->sk_protocol;
1337 if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
1338 ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1342 if (proto == IPPROTO_UDP &&
1343 (rt->dst.dev->features & NETIF_F_UFO)) {
1345 err = ip6_ufo_append_data(sk, getfrag, from, length,
1346 hh_len, fragheaderlen,
1347 transhdrlen, mtu, flags, rt);
1354 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
1357 while (length > 0) {
1358 /* Check if the remaining data fits into current packet. */
1359 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1361 copy = maxfraglen - skb->len;
1365 unsigned int datalen;
1366 unsigned int fraglen;
1367 unsigned int fraggap;
1368 unsigned int alloclen;
1370 /* There's no room in the current skb */
1372 fraggap = skb->len - maxfraglen;
1375 /* update mtu and maxfraglen if necessary */
1376 if (skb == NULL || skb_prev == NULL)
1377 ip6_append_data_mtu(&mtu, &maxfraglen,
1378 fragheaderlen, skb, rt);
1383 * If remaining data exceeds the mtu,
1384 * we know we need more fragment(s).
1386 datalen = length + fraggap;
1388 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1389 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1390 if ((flags & MSG_MORE) &&
1391 !(rt->dst.dev->features&NETIF_F_SG))
1394 alloclen = datalen + fragheaderlen;
1396 alloclen += dst_exthdrlen;
1398 if (datalen != length + fraggap) {
1400 * this is not the last fragment, the trailer
1401 * space is regarded as data space.
1403 datalen += rt->dst.trailer_len;
1406 alloclen += rt->dst.trailer_len;
1407 fraglen = datalen + fragheaderlen;
1410 * We just reserve space for fragment header.
1411 * Note: this may be overallocation if the message
1412 * (without MSG_MORE) fits into the MTU.
1414 alloclen += sizeof(struct frag_hdr);
1417 skb = sock_alloc_send_skb(sk,
1419 (flags & MSG_DONTWAIT), &err);
1422 if (atomic_read(&sk->sk_wmem_alloc) <=
1424 skb = sock_wmalloc(sk,
1425 alloclen + hh_len, 1,
1427 if (unlikely(skb == NULL))
1430 /* Only the initial fragment
1439 * Fill in the control structures
1441 skb->ip_summed = CHECKSUM_NONE;
1443 /* reserve for fragmentation and ipsec header */
1444 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1447 if (sk->sk_type == SOCK_DGRAM)
1448 skb_shinfo(skb)->tx_flags = tx_flags;
1451 * Find where to start putting bytes
1453 data = skb_put(skb, fraglen);
1454 skb_set_network_header(skb, exthdrlen);
1455 data += fragheaderlen;
1456 skb->transport_header = (skb->network_header +
1459 skb->csum = skb_copy_and_csum_bits(
1460 skb_prev, maxfraglen,
1461 data + transhdrlen, fraggap, 0);
1462 skb_prev->csum = csum_sub(skb_prev->csum,
1465 pskb_trim_unique(skb_prev, maxfraglen);
1467 copy = datalen - transhdrlen - fraggap;
1473 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1480 length -= datalen - fraggap;
1486 * Put the packet on the pending queue
1488 __skb_queue_tail(&sk->sk_write_queue, skb);
1495 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1499 if (getfrag(from, skb_put(skb, copy),
1500 offset, copy, off, skb) < 0) {
1501 __skb_trim(skb, off);
1506 int i = skb_shinfo(skb)->nr_frags;
1507 skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
1508 struct page *page = sk->sk_sndmsg_page;
1509 int off = sk->sk_sndmsg_off;
1512 if (page && (left = PAGE_SIZE - off) > 0) {
1515 if (page != skb_frag_page(frag)) {
1516 if (i == MAX_SKB_FRAGS) {
1520 skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
1521 skb_frag_ref(skb, i);
1522 frag = &skb_shinfo(skb)->frags[i];
1524 } else if(i < MAX_SKB_FRAGS) {
1525 if (copy > PAGE_SIZE)
1527 page = alloc_pages(sk->sk_allocation, 0);
1532 sk->sk_sndmsg_page = page;
1533 sk->sk_sndmsg_off = 0;
1535 skb_fill_page_desc(skb, i, page, 0, 0);
1536 frag = &skb_shinfo(skb)->frags[i];
1542 skb_frag_address(frag) + skb_frag_size(frag),
1543 offset, copy, skb->len, skb) < 0) {
1547 sk->sk_sndmsg_off += copy;
1548 skb_frag_size_add(frag, copy);
1550 skb->data_len += copy;
1551 skb->truesize += copy;
1552 atomic_add(copy, &sk->sk_wmem_alloc);
1559 cork->length -= length;
1560 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1563 EXPORT_SYMBOL_GPL(ip6_append_data);
1565 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1568 kfree(np->cork.opt->dst0opt);
1569 kfree(np->cork.opt->dst1opt);
1570 kfree(np->cork.opt->hopopt);
1571 kfree(np->cork.opt->srcrt);
1572 kfree(np->cork.opt);
1573 np->cork.opt = NULL;
1576 if (inet->cork.base.dst) {
1577 dst_release(inet->cork.base.dst);
1578 inet->cork.base.dst = NULL;
1579 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1581 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1584 int ip6_push_pending_frames(struct sock *sk)
1586 struct sk_buff *skb, *tmp_skb;
1587 struct sk_buff **tail_skb;
1588 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1589 struct inet_sock *inet = inet_sk(sk);
1590 struct ipv6_pinfo *np = inet6_sk(sk);
1591 struct net *net = sock_net(sk);
1592 struct ipv6hdr *hdr;
1593 struct ipv6_txoptions *opt = np->cork.opt;
1594 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1595 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1596 unsigned char proto = fl6->flowi6_proto;
1599 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1601 tail_skb = &(skb_shinfo(skb)->frag_list);
1603 /* move skb->data to ip header from ext header */
1604 if (skb->data < skb_network_header(skb))
1605 __skb_pull(skb, skb_network_offset(skb));
1606 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1607 __skb_pull(tmp_skb, skb_network_header_len(skb));
1608 *tail_skb = tmp_skb;
1609 tail_skb = &(tmp_skb->next);
1610 skb->len += tmp_skb->len;
1611 skb->data_len += tmp_skb->len;
1612 skb->truesize += tmp_skb->truesize;
1613 tmp_skb->destructor = NULL;
1617 /* Allow local fragmentation. */
1618 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1621 *final_dst = fl6->daddr;
1622 __skb_pull(skb, skb_network_header_len(skb));
1623 if (opt && opt->opt_flen)
1624 ipv6_push_frag_opts(skb, opt, &proto);
1625 if (opt && opt->opt_nflen)
1626 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1628 skb_push(skb, sizeof(struct ipv6hdr));
1629 skb_reset_network_header(skb);
1630 hdr = ipv6_hdr(skb);
1632 *(__be32*)hdr = fl6->flowlabel |
1633 htonl(0x60000000 | ((int)np->cork.tclass << 20));
1635 hdr->hop_limit = np->cork.hop_limit;
1636 hdr->nexthdr = proto;
1637 hdr->saddr = fl6->saddr;
1638 hdr->daddr = *final_dst;
1640 skb->priority = sk->sk_priority;
1641 skb->mark = sk->sk_mark;
1643 skb_dst_set(skb, dst_clone(&rt->dst));
1644 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1645 if (proto == IPPROTO_ICMPV6) {
1646 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1648 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1649 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1652 err = ip6_local_out(skb);
1655 err = net_xmit_errno(err);
1661 ip6_cork_release(inet, np);
1664 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1667 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1669 void ip6_flush_pending_frames(struct sock *sk)
1671 struct sk_buff *skb;
1673 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1675 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1676 IPSTATS_MIB_OUTDISCARDS);
1680 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1682 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);