2 * IPv6 output functions
3 * Linux INET6 implementation
6 * Pedro Roque <roque@di.fc.ul.pt>
8 * Based on linux/net/ipv4/ip_output.c
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv6.h>
49 #include <net/ndisc.h>
50 #include <net/protocol.h>
51 #include <net/ip6_route.h>
52 #include <net/addrconf.h>
53 #include <net/rawv6.h>
56 #include <net/checksum.h>
57 #include <linux/mroute6.h>
59 static int ip6_finish_output2(struct sk_buff *skb)
61 struct dst_entry *dst = skb_dst(skb);
62 struct net_device *dev = dst->dev;
63 struct neighbour *neigh;
64 struct in6_addr *nexthop;
67 skb->protocol = htons(ETH_P_IPV6);
70 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
71 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
73 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
74 ((mroute6_socket(dev_net(dev), skb) &&
75 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
76 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
77 &ipv6_hdr(skb)->saddr))) {
78 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
80 /* Do not check for IFF_ALLMULTI; multicast routing
81 is not supported in any case.
84 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
85 newskb, NULL, newskb->dev,
88 if (ipv6_hdr(skb)->hop_limit == 0) {
89 IP6_INC_STATS(dev_net(dev), idev,
90 IPSTATS_MIB_OUTDISCARDS);
96 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
99 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
100 IPV6_ADDR_SCOPE_NODELOCAL &&
101 !(dev->flags & IFF_LOOPBACK)) {
108 nexthop = rt6_nexthop((struct rt6_info *)dst);
109 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
110 if (unlikely(!neigh))
111 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
112 if (!IS_ERR(neigh)) {
113 ret = dst_neigh_output(dst, neigh, skb);
114 rcu_read_unlock_bh();
117 rcu_read_unlock_bh();
119 IP6_INC_STATS(dev_net(dst->dev),
120 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
125 static int ip6_finish_output(struct sk_buff *skb)
127 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
128 dst_allfrag(skb_dst(skb)) ||
129 (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
130 return ip6_fragment(skb, ip6_finish_output2);
132 return ip6_finish_output2(skb);
135 int ip6_output(struct sk_buff *skb)
137 struct net_device *dev = skb_dst(skb)->dev;
138 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
139 if (unlikely(idev->cnf.disable_ipv6)) {
140 IP6_INC_STATS(dev_net(dev), idev,
141 IPSTATS_MIB_OUTDISCARDS);
146 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
148 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
152 * xmit an sk_buff (used by TCP, SCTP and DCCP)
155 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
156 struct ipv6_txoptions *opt, int tclass)
158 struct net *net = sock_net(sk);
159 struct ipv6_pinfo *np = inet6_sk(sk);
160 struct in6_addr *first_hop = &fl6->daddr;
161 struct dst_entry *dst = skb_dst(skb);
163 u8 proto = fl6->flowi6_proto;
164 int seg_len = skb->len;
169 unsigned int head_room;
171 /* First: exthdrs may take lots of space (~8K for now)
172 MAX_HEADER is not enough.
174 head_room = opt->opt_nflen + opt->opt_flen;
175 seg_len += head_room;
176 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
178 if (skb_headroom(skb) < head_room) {
179 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
181 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
182 IPSTATS_MIB_OUTDISCARDS);
188 skb_set_owner_w(skb, sk);
191 ipv6_push_frag_opts(skb, opt, &proto);
193 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
196 skb_push(skb, sizeof(struct ipv6hdr));
197 skb_reset_network_header(skb);
201 * Fill in the IPv6 header
204 hlimit = np->hop_limit;
206 hlimit = ip6_dst_hoplimit(dst);
208 ip6_flow_hdr(hdr, tclass, fl6->flowlabel);
210 hdr->payload_len = htons(seg_len);
211 hdr->nexthdr = proto;
212 hdr->hop_limit = hlimit;
214 hdr->saddr = fl6->saddr;
215 hdr->daddr = *first_hop;
217 skb->protocol = htons(ETH_P_IPV6);
218 skb->priority = sk->sk_priority;
219 skb->mark = sk->sk_mark;
222 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
223 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
224 IPSTATS_MIB_OUT, skb->len);
225 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
226 dst->dev, dst_output);
230 ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
231 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
236 EXPORT_SYMBOL(ip6_xmit);
238 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
240 struct ip6_ra_chain *ra;
241 struct sock *last = NULL;
243 read_lock(&ip6_ra_lock);
244 for (ra = ip6_ra_chain; ra; ra = ra->next) {
245 struct sock *sk = ra->sk;
246 if (sk && ra->sel == sel &&
247 (!sk->sk_bound_dev_if ||
248 sk->sk_bound_dev_if == skb->dev->ifindex)) {
250 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
252 rawv6_rcv(last, skb2);
259 rawv6_rcv(last, skb);
260 read_unlock(&ip6_ra_lock);
263 read_unlock(&ip6_ra_lock);
267 static int ip6_forward_proxy_check(struct sk_buff *skb)
269 struct ipv6hdr *hdr = ipv6_hdr(skb);
270 u8 nexthdr = hdr->nexthdr;
274 if (ipv6_ext_hdr(nexthdr)) {
275 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
279 offset = sizeof(struct ipv6hdr);
281 if (nexthdr == IPPROTO_ICMPV6) {
282 struct icmp6hdr *icmp6;
284 if (!pskb_may_pull(skb, (skb_network_header(skb) +
285 offset + 1 - skb->data)))
288 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
290 switch (icmp6->icmp6_type) {
291 case NDISC_ROUTER_SOLICITATION:
292 case NDISC_ROUTER_ADVERTISEMENT:
293 case NDISC_NEIGHBOUR_SOLICITATION:
294 case NDISC_NEIGHBOUR_ADVERTISEMENT:
296 /* For reaction involving unicast neighbor discovery
297 * message destined to the proxied address, pass it to
307 * The proxying router can't forward traffic sent to a link-local
308 * address, so signal the sender and discard the packet. This
309 * behavior is clarified by the MIPv6 specification.
311 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
312 dst_link_failure(skb);
319 static inline int ip6_forward_finish(struct sk_buff *skb)
321 return dst_output(skb);
324 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
327 struct inet6_dev *idev;
329 if (dst_metric_locked(dst, RTAX_MTU)) {
330 mtu = dst_metric_raw(dst, RTAX_MTU);
337 idev = __in6_dev_get(dst->dev);
339 mtu = idev->cnf.mtu6;
345 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
347 if (skb->len <= mtu || skb->local_df)
350 if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
353 if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
359 int ip6_forward(struct sk_buff *skb)
361 struct dst_entry *dst = skb_dst(skb);
362 struct ipv6hdr *hdr = ipv6_hdr(skb);
363 struct inet6_skb_parm *opt = IP6CB(skb);
364 struct net *net = dev_net(dst->dev);
367 if (net->ipv6.devconf_all->forwarding == 0)
370 if (skb_warn_if_lro(skb))
373 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
374 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
375 IPSTATS_MIB_INDISCARDS);
379 if (skb->pkt_type != PACKET_HOST)
382 skb_forward_csum(skb);
385 * We DO NOT make any processing on
386 * RA packets, pushing them to user level AS IS
387 * without ane WARRANTY that application will be able
388 * to interpret them. The reason is that we
389 * cannot make anything clever here.
391 * We are not end-node, so that if packet contains
392 * AH/ESP, we cannot make anything.
393 * Defragmentation also would be mistake, RA packets
394 * cannot be fragmented, because there is no warranty
395 * that different fragments will go along one path. --ANK
397 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
398 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
403 * check and decrement ttl
405 if (hdr->hop_limit <= 1) {
406 /* Force OUTPUT device used as source address */
408 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
409 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
410 IPSTATS_MIB_INHDRERRORS);
416 /* XXX: idev->cnf.proxy_ndp? */
417 if (net->ipv6.devconf_all->proxy_ndp &&
418 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
419 int proxied = ip6_forward_proxy_check(skb);
421 return ip6_input(skb);
422 else if (proxied < 0) {
423 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
424 IPSTATS_MIB_INDISCARDS);
429 if (!xfrm6_route_forward(skb)) {
430 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
431 IPSTATS_MIB_INDISCARDS);
436 /* IPv6 specs say nothing about it, but it is clear that we cannot
437 send redirects to source routed frames.
438 We don't send redirects to frames decapsulated from IPsec.
440 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
441 struct in6_addr *target = NULL;
442 struct inet_peer *peer;
446 * incoming and outgoing devices are the same
450 rt = (struct rt6_info *) dst;
451 if (rt->rt6i_flags & RTF_GATEWAY)
452 target = &rt->rt6i_gateway;
454 target = &hdr->daddr;
456 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
458 /* Limit redirects both by destination (here)
459 and by source (inside ndisc_send_redirect)
461 if (inet_peer_xrlim_allow(peer, 1*HZ))
462 ndisc_send_redirect(skb, target);
466 int addrtype = ipv6_addr_type(&hdr->saddr);
468 /* This check is security critical. */
469 if (addrtype == IPV6_ADDR_ANY ||
470 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
472 if (addrtype & IPV6_ADDR_LINKLOCAL) {
473 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
474 ICMPV6_NOT_NEIGHBOUR, 0);
479 mtu = ip6_dst_mtu_forward(dst);
480 if (mtu < IPV6_MIN_MTU)
483 if (ip6_pkt_too_big(skb, mtu)) {
484 /* Again, force OUTPUT device used as source address */
486 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
487 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
488 IPSTATS_MIB_INTOOBIGERRORS);
489 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
490 IPSTATS_MIB_FRAGFAILS);
495 if (skb_cow(skb, dst->dev->hard_header_len)) {
496 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
497 IPSTATS_MIB_OUTDISCARDS);
503 /* Mangling hops number delayed to point after skb COW */
507 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
508 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
509 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
513 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
519 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
521 to->pkt_type = from->pkt_type;
522 to->priority = from->priority;
523 to->protocol = from->protocol;
525 skb_dst_set(to, dst_clone(skb_dst(from)));
527 to->mark = from->mark;
529 #ifdef CONFIG_NET_SCHED
530 to->tc_index = from->tc_index;
533 skb_copy_secmark(to, from);
536 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
538 struct sk_buff *frag;
539 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
540 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
541 struct ipv6hdr *tmp_hdr;
543 unsigned int mtu, hlen, left, len;
546 int ptr, offset = 0, err=0;
547 u8 *prevhdr, nexthdr = 0;
548 struct net *net = dev_net(skb_dst(skb)->dev);
550 hlen = ip6_find_1stfragopt(skb, &prevhdr);
553 mtu = ip6_skb_dst_mtu(skb);
555 /* We must not fragment if the socket is set to force MTU discovery
556 * or if the skb it not generated by a local socket.
558 if (unlikely(!skb->local_df && skb->len > mtu) ||
559 (IP6CB(skb)->frag_max_size &&
560 IP6CB(skb)->frag_max_size > mtu)) {
561 if (skb->sk && dst_allfrag(skb_dst(skb)))
562 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
564 skb->dev = skb_dst(skb)->dev;
565 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
566 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
567 IPSTATS_MIB_FRAGFAILS);
572 if (np && np->frag_size < mtu) {
576 mtu -= hlen + sizeof(struct frag_hdr);
578 if (skb_has_frag_list(skb)) {
579 int first_len = skb_pagelen(skb);
580 struct sk_buff *frag2;
582 if (first_len - hlen > mtu ||
583 ((first_len - hlen) & 7) ||
587 skb_walk_frags(skb, frag) {
588 /* Correct geometry. */
589 if (frag->len > mtu ||
590 ((frag->len & 7) && frag->next) ||
591 skb_headroom(frag) < hlen)
592 goto slow_path_clean;
594 /* Partially cloned skb? */
595 if (skb_shared(frag))
596 goto slow_path_clean;
601 frag->destructor = sock_wfree;
603 skb->truesize -= frag->truesize;
608 frag = skb_shinfo(skb)->frag_list;
609 skb_frag_list_init(skb);
612 *prevhdr = NEXTHDR_FRAGMENT;
613 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
615 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
616 IPSTATS_MIB_FRAGFAILS);
620 __skb_pull(skb, hlen);
621 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
622 __skb_push(skb, hlen);
623 skb_reset_network_header(skb);
624 memcpy(skb_network_header(skb), tmp_hdr, hlen);
626 ipv6_select_ident(fh, rt);
627 fh->nexthdr = nexthdr;
629 fh->frag_off = htons(IP6_MF);
630 frag_id = fh->identification;
632 first_len = skb_pagelen(skb);
633 skb->data_len = first_len - skb_headlen(skb);
634 skb->len = first_len;
635 ipv6_hdr(skb)->payload_len = htons(first_len -
636 sizeof(struct ipv6hdr));
641 /* Prepare header of the next frame,
642 * before previous one went down. */
644 frag->ip_summed = CHECKSUM_NONE;
645 skb_reset_transport_header(frag);
646 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
647 __skb_push(frag, hlen);
648 skb_reset_network_header(frag);
649 memcpy(skb_network_header(frag), tmp_hdr,
651 offset += skb->len - hlen - sizeof(struct frag_hdr);
652 fh->nexthdr = nexthdr;
654 fh->frag_off = htons(offset);
655 if (frag->next != NULL)
656 fh->frag_off |= htons(IP6_MF);
657 fh->identification = frag_id;
658 ipv6_hdr(frag)->payload_len =
660 sizeof(struct ipv6hdr));
661 ip6_copy_metadata(frag, skb);
666 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
667 IPSTATS_MIB_FRAGCREATES);
680 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
681 IPSTATS_MIB_FRAGOKS);
692 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
693 IPSTATS_MIB_FRAGFAILS);
698 skb_walk_frags(skb, frag2) {
702 frag2->destructor = NULL;
703 skb->truesize += frag2->truesize;
708 if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
709 skb_checksum_help(skb))
712 left = skb->len - hlen; /* Space per frame */
713 ptr = hlen; /* Where to start from */
716 * Fragment the datagram.
719 *prevhdr = NEXTHDR_FRAGMENT;
720 hroom = LL_RESERVED_SPACE(rt->dst.dev);
721 troom = rt->dst.dev->needed_tailroom;
724 * Keep copying data until we run out.
728 /* IF: it doesn't fit, use 'mtu' - the data space left */
731 /* IF: we are not sending up to and including the packet end
732 then align the next start on an eight byte boundary */
740 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
741 hroom + troom, GFP_ATOMIC)) == NULL) {
742 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
743 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
744 IPSTATS_MIB_FRAGFAILS);
750 * Set up data on packet
753 ip6_copy_metadata(frag, skb);
754 skb_reserve(frag, hroom);
755 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
756 skb_reset_network_header(frag);
757 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
758 frag->transport_header = (frag->network_header + hlen +
759 sizeof(struct frag_hdr));
762 * Charge the memory for the fragment to any owner
766 skb_set_owner_w(frag, skb->sk);
769 * Copy the packet header into the new buffer.
771 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
774 * Build fragment header.
776 fh->nexthdr = nexthdr;
779 ipv6_select_ident(fh, rt);
780 frag_id = fh->identification;
782 fh->identification = frag_id;
785 * Copy a block of the IP datagram.
787 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
791 fh->frag_off = htons(offset);
793 fh->frag_off |= htons(IP6_MF);
794 ipv6_hdr(frag)->payload_len = htons(frag->len -
795 sizeof(struct ipv6hdr));
801 * Put this fragment into the sending queue.
807 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
808 IPSTATS_MIB_FRAGCREATES);
810 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
811 IPSTATS_MIB_FRAGOKS);
816 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
817 IPSTATS_MIB_FRAGFAILS);
822 static inline int ip6_rt_check(const struct rt6key *rt_key,
823 const struct in6_addr *fl_addr,
824 const struct in6_addr *addr_cache)
826 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
827 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
830 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
831 struct dst_entry *dst,
832 const struct flowi6 *fl6)
834 struct ipv6_pinfo *np = inet6_sk(sk);
840 if (dst->ops->family != AF_INET6) {
845 rt = (struct rt6_info *)dst;
846 /* Yes, checking route validity in not connected
847 * case is not very simple. Take into account,
848 * that we do not support routing by source, TOS,
849 * and MSG_DONTROUTE --ANK (980726)
851 * 1. ip6_rt_check(): If route was host route,
852 * check that cached destination is current.
853 * If it is network route, we still may
854 * check its validity using saved pointer
855 * to the last used address: daddr_cache.
856 * We do not want to save whole address now,
857 * (because main consumer of this service
858 * is tcp, which has not this problem),
859 * so that the last trick works only on connected
861 * 2. oif also should be the same.
863 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
864 #ifdef CONFIG_IPV6_SUBTREES
865 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
867 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
876 static int ip6_dst_lookup_tail(struct sock *sk,
877 struct dst_entry **dst, struct flowi6 *fl6)
879 struct net *net = sock_net(sk);
880 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
887 *dst = ip6_route_output(net, sk, fl6);
889 if ((err = (*dst)->error))
890 goto out_err_release;
892 if (ipv6_addr_any(&fl6->saddr)) {
893 struct rt6_info *rt = (struct rt6_info *) *dst;
894 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
895 sk ? inet6_sk(sk)->srcprefs : 0,
898 goto out_err_release;
901 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
903 * Here if the dst entry we've looked up
904 * has a neighbour entry that is in the INCOMPLETE
905 * state and the src address from the flow is
906 * marked as OPTIMISTIC, we release the found
907 * dst entry and replace it instead with the
908 * dst entry of the nexthop router
910 rt = (struct rt6_info *) *dst;
912 n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
913 err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
914 rcu_read_unlock_bh();
917 struct inet6_ifaddr *ifp;
918 struct flowi6 fl_gw6;
921 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
924 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
930 * We need to get the dst entry for the
931 * default router instead
934 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
935 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
936 *dst = ip6_route_output(net, sk, &fl_gw6);
937 if ((err = (*dst)->error))
938 goto out_err_release;
946 if (err == -ENETUNREACH)
947 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
954 * ip6_dst_lookup - perform route lookup on flow
955 * @sk: socket which provides route info
956 * @dst: pointer to dst_entry * for result
957 * @fl6: flow to lookup
959 * This function performs a route lookup on the given flow.
961 * It returns zero on success, or a standard errno code on error.
963 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
966 return ip6_dst_lookup_tail(sk, dst, fl6);
968 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
971 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
972 * @sk: socket which provides route info
973 * @fl6: flow to lookup
974 * @final_dst: final destination address for ipsec lookup
976 * This function performs a route lookup on the given flow.
978 * It returns a valid dst pointer on success, or a pointer encoded
981 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
982 const struct in6_addr *final_dst)
984 struct dst_entry *dst = NULL;
987 err = ip6_dst_lookup_tail(sk, &dst, fl6);
991 fl6->daddr = *final_dst;
993 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
995 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
998 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
999 * @sk: socket which provides the dst cache and route info
1000 * @fl6: flow to lookup
1001 * @final_dst: final destination address for ipsec lookup
1003 * This function performs a route lookup on the given flow with the
1004 * possibility of using the cached route in the socket if it is valid.
1005 * It will take the socket dst lock when operating on the dst cache.
1006 * As a result, this function can only be used in process context.
1008 * It returns a valid dst pointer on success, or a pointer encoded
1011 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1012 const struct in6_addr *final_dst)
1014 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1017 dst = ip6_sk_dst_check(sk, dst, fl6);
1019 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1021 return ERR_PTR(err);
1023 fl6->daddr = *final_dst;
1025 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1027 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1029 static inline int ip6_ufo_append_data(struct sock *sk,
1030 int getfrag(void *from, char *to, int offset, int len,
1031 int odd, struct sk_buff *skb),
1032 void *from, int length, int hh_len, int fragheaderlen,
1033 int transhdrlen, int mtu,unsigned int flags,
1034 struct rt6_info *rt)
1037 struct sk_buff *skb;
1038 struct frag_hdr fhdr;
1041 /* There is support for UDP large send offload by network
1042 * device, so create one single skb packet containing complete
1045 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1046 skb = sock_alloc_send_skb(sk,
1047 hh_len + fragheaderlen + transhdrlen + 20,
1048 (flags & MSG_DONTWAIT), &err);
1052 /* reserve space for Hardware header */
1053 skb_reserve(skb, hh_len);
1055 /* create space for UDP/IP header */
1056 skb_put(skb,fragheaderlen + transhdrlen);
1058 /* initialize network header pointer */
1059 skb_reset_network_header(skb);
1061 /* initialize protocol header pointer */
1062 skb->transport_header = skb->network_header + fragheaderlen;
1064 skb->protocol = htons(ETH_P_IPV6);
1067 __skb_queue_tail(&sk->sk_write_queue, skb);
1068 } else if (skb_is_gso(skb)) {
1072 skb->ip_summed = CHECKSUM_PARTIAL;
1073 /* Specify the length of each IPv6 datagram fragment.
1074 * It has to be a multiple of 8.
1076 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1077 sizeof(struct frag_hdr)) & ~7;
1078 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1079 ipv6_select_ident(&fhdr, rt);
1080 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1083 return skb_append_datato_frags(sk, skb, getfrag, from,
1084 (length - transhdrlen));
1087 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1090 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1093 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1096 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1099 static void ip6_append_data_mtu(unsigned int *mtu,
1101 unsigned int fragheaderlen,
1102 struct sk_buff *skb,
1103 struct rt6_info *rt,
1104 unsigned int orig_mtu)
1106 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1108 /* first fragment, reserve header_len */
1109 *mtu = orig_mtu - rt->dst.header_len;
1113 * this fragment is not first, the headers
1114 * space is regarded as data space.
1118 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1119 + fragheaderlen - sizeof(struct frag_hdr);
1123 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1124 int offset, int len, int odd, struct sk_buff *skb),
1125 void *from, int length, int transhdrlen,
1126 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1127 struct rt6_info *rt, unsigned int flags, int dontfrag)
1129 struct inet_sock *inet = inet_sk(sk);
1130 struct ipv6_pinfo *np = inet6_sk(sk);
1131 struct inet_cork *cork;
1132 struct sk_buff *skb, *skb_prev = NULL;
1133 unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1142 if (flags&MSG_PROBE)
1144 cork = &inet->cork.base;
1145 if (skb_queue_empty(&sk->sk_write_queue)) {
1150 if (WARN_ON(np->cork.opt))
1153 np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1154 if (unlikely(np->cork.opt == NULL))
1157 np->cork.opt->tot_len = opt->tot_len;
1158 np->cork.opt->opt_flen = opt->opt_flen;
1159 np->cork.opt->opt_nflen = opt->opt_nflen;
1161 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1163 if (opt->dst0opt && !np->cork.opt->dst0opt)
1166 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1168 if (opt->dst1opt && !np->cork.opt->dst1opt)
1171 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1173 if (opt->hopopt && !np->cork.opt->hopopt)
1176 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1178 if (opt->srcrt && !np->cork.opt->srcrt)
1181 /* need source address above miyazawa*/
1184 cork->dst = &rt->dst;
1185 inet->cork.fl.u.ip6 = *fl6;
1186 np->cork.hop_limit = hlimit;
1187 np->cork.tclass = tclass;
1188 if (rt->dst.flags & DST_XFRM_TUNNEL)
1189 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1190 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1192 mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1193 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1194 if (np->frag_size < mtu) {
1196 mtu = np->frag_size;
1198 cork->fragsize = mtu;
1199 if (dst_allfrag(rt->dst.path))
1200 cork->flags |= IPCORK_ALLFRAG;
1202 exthdrlen = (opt ? opt->opt_flen : 0);
1203 length += exthdrlen;
1204 transhdrlen += exthdrlen;
1205 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1207 rt = (struct rt6_info *)cork->dst;
1208 fl6 = &inet->cork.fl.u.ip6;
1213 mtu = cork->fragsize;
1217 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1219 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1220 (opt ? opt->opt_nflen : 0);
1221 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1222 sizeof(struct frag_hdr);
1224 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1225 unsigned int maxnonfragsize, headersize;
1227 headersize = sizeof(struct ipv6hdr) +
1228 (opt ? opt->tot_len : 0) +
1229 (dst_allfrag(&rt->dst) ?
1230 sizeof(struct frag_hdr) : 0) +
1231 rt->rt6i_nfheader_len;
1233 maxnonfragsize = (np->pmtudisc >= IPV6_PMTUDISC_DO) ?
1234 mtu : sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1236 /* dontfrag active */
1237 if ((cork->length + length > mtu - headersize) && dontfrag &&
1238 (sk->sk_protocol == IPPROTO_UDP ||
1239 sk->sk_protocol == IPPROTO_RAW)) {
1240 ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1241 sizeof(struct ipv6hdr));
1245 if (cork->length + length > maxnonfragsize - headersize) {
1247 ipv6_local_error(sk, EMSGSIZE, fl6,
1249 sizeof(struct ipv6hdr));
1254 /* For UDP, check if TX timestamp is enabled */
1255 if (sk->sk_type == SOCK_DGRAM)
1256 sock_tx_timestamp(sk, &tx_flags);
1259 * Let's try using as much space as possible.
1260 * Use MTU if total length of the message fits into the MTU.
1261 * Otherwise, we need to reserve fragment header and
1262 * fragment alignment (= 8-15 octects, in total).
1264 * Note that we may need to "move" the data from the tail of
1265 * of the buffer to the new fragment when we split
1268 * FIXME: It may be fragmented into multiple chunks
1269 * at once if non-fragmentable extension headers
1274 skb = skb_peek_tail(&sk->sk_write_queue);
1275 cork->length += length;
1276 if (((length > mtu) ||
1277 (skb && skb_is_gso(skb))) &&
1278 (sk->sk_protocol == IPPROTO_UDP) &&
1279 (rt->dst.dev->features & NETIF_F_UFO)) {
1280 err = ip6_ufo_append_data(sk, getfrag, from, length,
1281 hh_len, fragheaderlen,
1282 transhdrlen, mtu, flags, rt);
1291 while (length > 0) {
1292 /* Check if the remaining data fits into current packet. */
1293 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1295 copy = maxfraglen - skb->len;
1299 unsigned int datalen;
1300 unsigned int fraglen;
1301 unsigned int fraggap;
1302 unsigned int alloclen;
1304 /* There's no room in the current skb */
1306 fraggap = skb->len - maxfraglen;
1309 /* update mtu and maxfraglen if necessary */
1310 if (skb == NULL || skb_prev == NULL)
1311 ip6_append_data_mtu(&mtu, &maxfraglen,
1312 fragheaderlen, skb, rt,
1318 * If remaining data exceeds the mtu,
1319 * we know we need more fragment(s).
1321 datalen = length + fraggap;
1323 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1324 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1325 if ((flags & MSG_MORE) &&
1326 !(rt->dst.dev->features&NETIF_F_SG))
1329 alloclen = datalen + fragheaderlen;
1331 alloclen += dst_exthdrlen;
1333 if (datalen != length + fraggap) {
1335 * this is not the last fragment, the trailer
1336 * space is regarded as data space.
1338 datalen += rt->dst.trailer_len;
1341 alloclen += rt->dst.trailer_len;
1342 fraglen = datalen + fragheaderlen;
1345 * We just reserve space for fragment header.
1346 * Note: this may be overallocation if the message
1347 * (without MSG_MORE) fits into the MTU.
1349 alloclen += sizeof(struct frag_hdr);
1352 skb = sock_alloc_send_skb(sk,
1354 (flags & MSG_DONTWAIT), &err);
1357 if (atomic_read(&sk->sk_wmem_alloc) <=
1359 skb = sock_wmalloc(sk,
1360 alloclen + hh_len, 1,
1362 if (unlikely(skb == NULL))
1365 /* Only the initial fragment
1374 * Fill in the control structures
1376 skb->protocol = htons(ETH_P_IPV6);
1377 skb->ip_summed = CHECKSUM_NONE;
1379 /* reserve for fragmentation and ipsec header */
1380 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1383 if (sk->sk_type == SOCK_DGRAM)
1384 skb_shinfo(skb)->tx_flags = tx_flags;
1387 * Find where to start putting bytes
1389 data = skb_put(skb, fraglen);
1390 skb_set_network_header(skb, exthdrlen);
1391 data += fragheaderlen;
1392 skb->transport_header = (skb->network_header +
1395 skb->csum = skb_copy_and_csum_bits(
1396 skb_prev, maxfraglen,
1397 data + transhdrlen, fraggap, 0);
1398 skb_prev->csum = csum_sub(skb_prev->csum,
1401 pskb_trim_unique(skb_prev, maxfraglen);
1403 copy = datalen - transhdrlen - fraggap;
1409 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1416 length -= datalen - fraggap;
1422 * Put the packet on the pending queue
1424 __skb_queue_tail(&sk->sk_write_queue, skb);
1431 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1435 if (getfrag(from, skb_put(skb, copy),
1436 offset, copy, off, skb) < 0) {
1437 __skb_trim(skb, off);
1442 int i = skb_shinfo(skb)->nr_frags;
1443 struct page_frag *pfrag = sk_page_frag(sk);
1446 if (!sk_page_frag_refill(sk, pfrag))
1449 if (!skb_can_coalesce(skb, i, pfrag->page,
1452 if (i == MAX_SKB_FRAGS)
1455 __skb_fill_page_desc(skb, i, pfrag->page,
1457 skb_shinfo(skb)->nr_frags = ++i;
1458 get_page(pfrag->page);
1460 copy = min_t(int, copy, pfrag->size - pfrag->offset);
1462 page_address(pfrag->page) + pfrag->offset,
1463 offset, copy, skb->len, skb) < 0)
1466 pfrag->offset += copy;
1467 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1469 skb->data_len += copy;
1470 skb->truesize += copy;
1471 atomic_add(copy, &sk->sk_wmem_alloc);
1482 cork->length -= length;
1483 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1486 EXPORT_SYMBOL_GPL(ip6_append_data);
1488 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1491 kfree(np->cork.opt->dst0opt);
1492 kfree(np->cork.opt->dst1opt);
1493 kfree(np->cork.opt->hopopt);
1494 kfree(np->cork.opt->srcrt);
1495 kfree(np->cork.opt);
1496 np->cork.opt = NULL;
1499 if (inet->cork.base.dst) {
1500 dst_release(inet->cork.base.dst);
1501 inet->cork.base.dst = NULL;
1502 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1504 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1507 int ip6_push_pending_frames(struct sock *sk)
1509 struct sk_buff *skb, *tmp_skb;
1510 struct sk_buff **tail_skb;
1511 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1512 struct inet_sock *inet = inet_sk(sk);
1513 struct ipv6_pinfo *np = inet6_sk(sk);
1514 struct net *net = sock_net(sk);
1515 struct ipv6hdr *hdr;
1516 struct ipv6_txoptions *opt = np->cork.opt;
1517 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1518 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1519 unsigned char proto = fl6->flowi6_proto;
1522 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1524 tail_skb = &(skb_shinfo(skb)->frag_list);
1526 /* move skb->data to ip header from ext header */
1527 if (skb->data < skb_network_header(skb))
1528 __skb_pull(skb, skb_network_offset(skb));
1529 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1530 __skb_pull(tmp_skb, skb_network_header_len(skb));
1531 *tail_skb = tmp_skb;
1532 tail_skb = &(tmp_skb->next);
1533 skb->len += tmp_skb->len;
1534 skb->data_len += tmp_skb->len;
1535 skb->truesize += tmp_skb->truesize;
1536 tmp_skb->destructor = NULL;
1540 /* Allow local fragmentation. */
1541 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1544 *final_dst = fl6->daddr;
1545 __skb_pull(skb, skb_network_header_len(skb));
1546 if (opt && opt->opt_flen)
1547 ipv6_push_frag_opts(skb, opt, &proto);
1548 if (opt && opt->opt_nflen)
1549 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1551 skb_push(skb, sizeof(struct ipv6hdr));
1552 skb_reset_network_header(skb);
1553 hdr = ipv6_hdr(skb);
1555 ip6_flow_hdr(hdr, np->cork.tclass, fl6->flowlabel);
1556 hdr->hop_limit = np->cork.hop_limit;
1557 hdr->nexthdr = proto;
1558 hdr->saddr = fl6->saddr;
1559 hdr->daddr = *final_dst;
1561 skb->priority = sk->sk_priority;
1562 skb->mark = sk->sk_mark;
1564 skb_dst_set(skb, dst_clone(&rt->dst));
1565 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1566 if (proto == IPPROTO_ICMPV6) {
1567 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1569 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1570 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1573 err = ip6_local_out(skb);
1576 err = net_xmit_errno(err);
1582 ip6_cork_release(inet, np);
1585 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1588 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1590 void ip6_flush_pending_frames(struct sock *sk)
1592 struct sk_buff *skb;
1594 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1596 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1597 IPSTATS_MIB_OUTDISCARDS);
1601 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1603 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);