2 * IPv6 output functions
3 * Linux INET6 implementation
6 * Pedro Roque <roque@di.fc.ul.pt>
8 * Based on linux/net/ipv4/ip_output.c
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv6.h>
49 #include <net/ndisc.h>
50 #include <net/protocol.h>
51 #include <net/ip6_route.h>
52 #include <net/addrconf.h>
53 #include <net/rawv6.h>
56 #include <net/checksum.h>
57 #include <linux/mroute6.h>
59 static int ip6_finish_output2(struct sk_buff *skb)
61 struct dst_entry *dst = skb_dst(skb);
62 struct net_device *dev = dst->dev;
63 struct neighbour *neigh;
64 struct in6_addr *nexthop;
67 skb->protocol = htons(ETH_P_IPV6);
70 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
71 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
73 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
74 ((mroute6_socket(dev_net(dev), skb) &&
75 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
76 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
77 &ipv6_hdr(skb)->saddr))) {
78 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
80 /* Do not check for IFF_ALLMULTI; multicast routing
81 is not supported in any case.
84 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
85 newskb, NULL, newskb->dev,
88 if (ipv6_hdr(skb)->hop_limit == 0) {
89 IP6_INC_STATS(dev_net(dev), idev,
90 IPSTATS_MIB_OUTDISCARDS);
96 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
99 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
100 IPV6_ADDR_SCOPE_NODELOCAL &&
101 !(dev->flags & IFF_LOOPBACK)) {
108 nexthop = rt6_nexthop((struct rt6_info *)dst);
109 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
110 if (unlikely(!neigh))
111 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
112 if (!IS_ERR(neigh)) {
113 ret = dst_neigh_output(dst, neigh, skb);
114 rcu_read_unlock_bh();
117 rcu_read_unlock_bh();
119 IP6_INC_STATS(dev_net(dst->dev),
120 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
125 static int ip6_finish_output(struct sk_buff *skb)
127 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
128 dst_allfrag(skb_dst(skb)) ||
129 (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
130 return ip6_fragment(skb, ip6_finish_output2);
132 return ip6_finish_output2(skb);
135 int ip6_output(struct sk_buff *skb)
137 struct net_device *dev = skb_dst(skb)->dev;
138 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
139 if (unlikely(idev->cnf.disable_ipv6)) {
140 IP6_INC_STATS(dev_net(dev), idev,
141 IPSTATS_MIB_OUTDISCARDS);
146 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
148 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
152 * xmit an sk_buff (used by TCP, SCTP and DCCP)
155 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
156 struct ipv6_txoptions *opt, int tclass)
158 struct net *net = sock_net(sk);
159 struct ipv6_pinfo *np = inet6_sk(sk);
160 struct in6_addr *first_hop = &fl6->daddr;
161 struct dst_entry *dst = skb_dst(skb);
163 u8 proto = fl6->flowi6_proto;
164 int seg_len = skb->len;
169 unsigned int head_room;
171 /* First: exthdrs may take lots of space (~8K for now)
172 MAX_HEADER is not enough.
174 head_room = opt->opt_nflen + opt->opt_flen;
175 seg_len += head_room;
176 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
178 if (skb_headroom(skb) < head_room) {
179 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
181 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
182 IPSTATS_MIB_OUTDISCARDS);
188 skb_set_owner_w(skb, sk);
191 ipv6_push_frag_opts(skb, opt, &proto);
193 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
196 skb_push(skb, sizeof(struct ipv6hdr));
197 skb_reset_network_header(skb);
201 * Fill in the IPv6 header
204 hlimit = np->hop_limit;
206 hlimit = ip6_dst_hoplimit(dst);
208 ip6_flow_hdr(hdr, tclass, fl6->flowlabel);
210 hdr->payload_len = htons(seg_len);
211 hdr->nexthdr = proto;
212 hdr->hop_limit = hlimit;
214 hdr->saddr = fl6->saddr;
215 hdr->daddr = *first_hop;
217 skb->protocol = htons(ETH_P_IPV6);
218 skb->priority = sk->sk_priority;
219 skb->mark = sk->sk_mark;
222 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
223 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
224 IPSTATS_MIB_OUT, skb->len);
225 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
226 dst->dev, dst_output);
230 ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
231 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
236 EXPORT_SYMBOL(ip6_xmit);
238 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
240 struct ip6_ra_chain *ra;
241 struct sock *last = NULL;
243 read_lock(&ip6_ra_lock);
244 for (ra = ip6_ra_chain; ra; ra = ra->next) {
245 struct sock *sk = ra->sk;
246 if (sk && ra->sel == sel &&
247 (!sk->sk_bound_dev_if ||
248 sk->sk_bound_dev_if == skb->dev->ifindex)) {
250 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
252 rawv6_rcv(last, skb2);
259 rawv6_rcv(last, skb);
260 read_unlock(&ip6_ra_lock);
263 read_unlock(&ip6_ra_lock);
267 static int ip6_forward_proxy_check(struct sk_buff *skb)
269 struct ipv6hdr *hdr = ipv6_hdr(skb);
270 u8 nexthdr = hdr->nexthdr;
274 if (ipv6_ext_hdr(nexthdr)) {
275 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
279 offset = sizeof(struct ipv6hdr);
281 if (nexthdr == IPPROTO_ICMPV6) {
282 struct icmp6hdr *icmp6;
284 if (!pskb_may_pull(skb, (skb_network_header(skb) +
285 offset + 1 - skb->data)))
288 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
290 switch (icmp6->icmp6_type) {
291 case NDISC_ROUTER_SOLICITATION:
292 case NDISC_ROUTER_ADVERTISEMENT:
293 case NDISC_NEIGHBOUR_SOLICITATION:
294 case NDISC_NEIGHBOUR_ADVERTISEMENT:
296 /* For reaction involving unicast neighbor discovery
297 * message destined to the proxied address, pass it to
307 * The proxying router can't forward traffic sent to a link-local
308 * address, so signal the sender and discard the packet. This
309 * behavior is clarified by the MIPv6 specification.
311 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
312 dst_link_failure(skb);
319 static inline int ip6_forward_finish(struct sk_buff *skb)
321 return dst_output(skb);
324 int ip6_forward(struct sk_buff *skb)
326 struct dst_entry *dst = skb_dst(skb);
327 struct ipv6hdr *hdr = ipv6_hdr(skb);
328 struct inet6_skb_parm *opt = IP6CB(skb);
329 struct net *net = dev_net(dst->dev);
332 if (net->ipv6.devconf_all->forwarding == 0)
335 if (skb_warn_if_lro(skb))
338 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
339 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
343 if (skb->pkt_type != PACKET_HOST)
346 skb_forward_csum(skb);
349 * We DO NOT make any processing on
350 * RA packets, pushing them to user level AS IS
351 * without ane WARRANTY that application will be able
352 * to interpret them. The reason is that we
353 * cannot make anything clever here.
355 * We are not end-node, so that if packet contains
356 * AH/ESP, we cannot make anything.
357 * Defragmentation also would be mistake, RA packets
358 * cannot be fragmented, because there is no warranty
359 * that different fragments will go along one path. --ANK
361 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
362 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
367 * check and decrement ttl
369 if (hdr->hop_limit <= 1) {
370 /* Force OUTPUT device used as source address */
372 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
373 IP6_INC_STATS_BH(net,
374 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
380 /* XXX: idev->cnf.proxy_ndp? */
381 if (net->ipv6.devconf_all->proxy_ndp &&
382 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
383 int proxied = ip6_forward_proxy_check(skb);
385 return ip6_input(skb);
386 else if (proxied < 0) {
387 IP6_INC_STATS(net, ip6_dst_idev(dst),
388 IPSTATS_MIB_INDISCARDS);
393 if (!xfrm6_route_forward(skb)) {
394 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
399 /* IPv6 specs say nothing about it, but it is clear that we cannot
400 send redirects to source routed frames.
401 We don't send redirects to frames decapsulated from IPsec.
403 if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
404 struct in6_addr *target = NULL;
405 struct inet_peer *peer;
409 * incoming and outgoing devices are the same
413 rt = (struct rt6_info *) dst;
414 if (rt->rt6i_flags & RTF_GATEWAY)
415 target = &rt->rt6i_gateway;
417 target = &hdr->daddr;
419 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
421 /* Limit redirects both by destination (here)
422 and by source (inside ndisc_send_redirect)
424 if (inet_peer_xrlim_allow(peer, 1*HZ))
425 ndisc_send_redirect(skb, target);
429 int addrtype = ipv6_addr_type(&hdr->saddr);
431 /* This check is security critical. */
432 if (addrtype == IPV6_ADDR_ANY ||
433 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
435 if (addrtype & IPV6_ADDR_LINKLOCAL) {
436 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
437 ICMPV6_NOT_NEIGHBOUR, 0);
443 if (mtu < IPV6_MIN_MTU)
446 if ((!skb->local_df && skb->len > mtu && !skb_is_gso(skb)) ||
447 (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)) {
448 /* Again, force OUTPUT device used as source address */
450 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
451 IP6_INC_STATS_BH(net,
452 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
453 IP6_INC_STATS_BH(net,
454 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
459 if (skb_cow(skb, dst->dev->hard_header_len)) {
460 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
466 /* Mangling hops number delayed to point after skb COW */
470 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
471 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
472 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
476 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
482 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
484 to->pkt_type = from->pkt_type;
485 to->priority = from->priority;
486 to->protocol = from->protocol;
488 skb_dst_set(to, dst_clone(skb_dst(from)));
490 to->mark = from->mark;
492 #ifdef CONFIG_NET_SCHED
493 to->tc_index = from->tc_index;
496 #if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
497 to->nf_trace = from->nf_trace;
499 skb_copy_secmark(to, from);
502 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
504 struct sk_buff *frag;
505 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
506 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
507 struct ipv6hdr *tmp_hdr;
509 unsigned int mtu, hlen, left, len;
512 int ptr, offset = 0, err=0;
513 u8 *prevhdr, nexthdr = 0;
514 struct net *net = dev_net(skb_dst(skb)->dev);
516 hlen = ip6_find_1stfragopt(skb, &prevhdr);
519 mtu = ip6_skb_dst_mtu(skb);
521 /* We must not fragment if the socket is set to force MTU discovery
522 * or if the skb it not generated by a local socket.
524 if (unlikely(!skb->local_df && skb->len > mtu) ||
525 (IP6CB(skb)->frag_max_size &&
526 IP6CB(skb)->frag_max_size > mtu)) {
527 if (skb->sk && dst_allfrag(skb_dst(skb)))
528 sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
530 skb->dev = skb_dst(skb)->dev;
531 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
532 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
533 IPSTATS_MIB_FRAGFAILS);
538 if (np && np->frag_size < mtu) {
542 mtu -= hlen + sizeof(struct frag_hdr);
544 if (skb_has_frag_list(skb)) {
545 int first_len = skb_pagelen(skb);
546 struct sk_buff *frag2;
548 if (first_len - hlen > mtu ||
549 ((first_len - hlen) & 7) ||
553 skb_walk_frags(skb, frag) {
554 /* Correct geometry. */
555 if (frag->len > mtu ||
556 ((frag->len & 7) && frag->next) ||
557 skb_headroom(frag) < hlen)
558 goto slow_path_clean;
560 /* Partially cloned skb? */
561 if (skb_shared(frag))
562 goto slow_path_clean;
567 frag->destructor = sock_wfree;
569 skb->truesize -= frag->truesize;
574 frag = skb_shinfo(skb)->frag_list;
575 skb_frag_list_init(skb);
578 *prevhdr = NEXTHDR_FRAGMENT;
579 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
581 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
582 IPSTATS_MIB_FRAGFAILS);
586 __skb_pull(skb, hlen);
587 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
588 __skb_push(skb, hlen);
589 skb_reset_network_header(skb);
590 memcpy(skb_network_header(skb), tmp_hdr, hlen);
592 ipv6_select_ident(fh, rt);
593 fh->nexthdr = nexthdr;
595 fh->frag_off = htons(IP6_MF);
596 frag_id = fh->identification;
598 first_len = skb_pagelen(skb);
599 skb->data_len = first_len - skb_headlen(skb);
600 skb->len = first_len;
601 ipv6_hdr(skb)->payload_len = htons(first_len -
602 sizeof(struct ipv6hdr));
607 /* Prepare header of the next frame,
608 * before previous one went down. */
610 frag->ip_summed = CHECKSUM_NONE;
611 skb_reset_transport_header(frag);
612 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
613 __skb_push(frag, hlen);
614 skb_reset_network_header(frag);
615 memcpy(skb_network_header(frag), tmp_hdr,
617 offset += skb->len - hlen - sizeof(struct frag_hdr);
618 fh->nexthdr = nexthdr;
620 fh->frag_off = htons(offset);
621 if (frag->next != NULL)
622 fh->frag_off |= htons(IP6_MF);
623 fh->identification = frag_id;
624 ipv6_hdr(frag)->payload_len =
626 sizeof(struct ipv6hdr));
627 ip6_copy_metadata(frag, skb);
632 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
633 IPSTATS_MIB_FRAGCREATES);
646 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
647 IPSTATS_MIB_FRAGOKS);
658 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
659 IPSTATS_MIB_FRAGFAILS);
664 skb_walk_frags(skb, frag2) {
668 frag2->destructor = NULL;
669 skb->truesize += frag2->truesize;
674 if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
675 skb_checksum_help(skb))
678 left = skb->len - hlen; /* Space per frame */
679 ptr = hlen; /* Where to start from */
682 * Fragment the datagram.
685 *prevhdr = NEXTHDR_FRAGMENT;
686 hroom = LL_RESERVED_SPACE(rt->dst.dev);
687 troom = rt->dst.dev->needed_tailroom;
690 * Keep copying data until we run out.
694 /* IF: it doesn't fit, use 'mtu' - the data space left */
697 /* IF: we are not sending up to and including the packet end
698 then align the next start on an eight byte boundary */
706 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
707 hroom + troom, GFP_ATOMIC)) == NULL) {
708 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
709 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
710 IPSTATS_MIB_FRAGFAILS);
716 * Set up data on packet
719 ip6_copy_metadata(frag, skb);
720 skb_reserve(frag, hroom);
721 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
722 skb_reset_network_header(frag);
723 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
724 frag->transport_header = (frag->network_header + hlen +
725 sizeof(struct frag_hdr));
728 * Charge the memory for the fragment to any owner
732 skb_set_owner_w(frag, skb->sk);
735 * Copy the packet header into the new buffer.
737 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
740 * Build fragment header.
742 fh->nexthdr = nexthdr;
745 ipv6_select_ident(fh, rt);
746 frag_id = fh->identification;
748 fh->identification = frag_id;
751 * Copy a block of the IP datagram.
753 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
757 fh->frag_off = htons(offset);
759 fh->frag_off |= htons(IP6_MF);
760 ipv6_hdr(frag)->payload_len = htons(frag->len -
761 sizeof(struct ipv6hdr));
767 * Put this fragment into the sending queue.
773 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
774 IPSTATS_MIB_FRAGCREATES);
776 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
777 IPSTATS_MIB_FRAGOKS);
782 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
783 IPSTATS_MIB_FRAGFAILS);
788 static inline int ip6_rt_check(const struct rt6key *rt_key,
789 const struct in6_addr *fl_addr,
790 const struct in6_addr *addr_cache)
792 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
793 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
796 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
797 struct dst_entry *dst,
798 const struct flowi6 *fl6)
800 struct ipv6_pinfo *np = inet6_sk(sk);
806 if (dst->ops->family != AF_INET6) {
811 rt = (struct rt6_info *)dst;
812 /* Yes, checking route validity in not connected
813 * case is not very simple. Take into account,
814 * that we do not support routing by source, TOS,
815 * and MSG_DONTROUTE --ANK (980726)
817 * 1. ip6_rt_check(): If route was host route,
818 * check that cached destination is current.
819 * If it is network route, we still may
820 * check its validity using saved pointer
821 * to the last used address: daddr_cache.
822 * We do not want to save whole address now,
823 * (because main consumer of this service
824 * is tcp, which has not this problem),
825 * so that the last trick works only on connected
827 * 2. oif also should be the same.
829 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
830 #ifdef CONFIG_IPV6_SUBTREES
831 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
833 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
842 static int ip6_dst_lookup_tail(struct sock *sk,
843 struct dst_entry **dst, struct flowi6 *fl6)
845 struct net *net = sock_net(sk);
846 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
853 *dst = ip6_route_output(net, sk, fl6);
855 if ((err = (*dst)->error))
856 goto out_err_release;
858 if (ipv6_addr_any(&fl6->saddr)) {
859 struct rt6_info *rt = (struct rt6_info *) *dst;
860 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
861 sk ? inet6_sk(sk)->srcprefs : 0,
864 goto out_err_release;
867 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
869 * Here if the dst entry we've looked up
870 * has a neighbour entry that is in the INCOMPLETE
871 * state and the src address from the flow is
872 * marked as OPTIMISTIC, we release the found
873 * dst entry and replace it instead with the
874 * dst entry of the nexthop router
876 rt = (struct rt6_info *) *dst;
878 n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
879 err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
880 rcu_read_unlock_bh();
883 struct inet6_ifaddr *ifp;
884 struct flowi6 fl_gw6;
887 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
890 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
896 * We need to get the dst entry for the
897 * default router instead
900 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
901 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
902 *dst = ip6_route_output(net, sk, &fl_gw6);
903 if ((err = (*dst)->error))
904 goto out_err_release;
912 if (err == -ENETUNREACH)
913 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
920 * ip6_dst_lookup - perform route lookup on flow
921 * @sk: socket which provides route info
922 * @dst: pointer to dst_entry * for result
923 * @fl6: flow to lookup
925 * This function performs a route lookup on the given flow.
927 * It returns zero on success, or a standard errno code on error.
929 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
932 return ip6_dst_lookup_tail(sk, dst, fl6);
934 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
937 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
938 * @sk: socket which provides route info
939 * @fl6: flow to lookup
940 * @final_dst: final destination address for ipsec lookup
941 * @can_sleep: we are in a sleepable context
943 * This function performs a route lookup on the given flow.
945 * It returns a valid dst pointer on success, or a pointer encoded
948 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
949 const struct in6_addr *final_dst,
952 struct dst_entry *dst = NULL;
955 err = ip6_dst_lookup_tail(sk, &dst, fl6);
959 fl6->daddr = *final_dst;
961 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
963 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
965 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
968 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
969 * @sk: socket which provides the dst cache and route info
970 * @fl6: flow to lookup
971 * @final_dst: final destination address for ipsec lookup
972 * @can_sleep: we are in a sleepable context
974 * This function performs a route lookup on the given flow with the
975 * possibility of using the cached route in the socket if it is valid.
976 * It will take the socket dst lock when operating on the dst cache.
977 * As a result, this function can only be used in process context.
979 * It returns a valid dst pointer on success, or a pointer encoded
982 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
983 const struct in6_addr *final_dst,
986 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
989 dst = ip6_sk_dst_check(sk, dst, fl6);
991 err = ip6_dst_lookup_tail(sk, &dst, fl6);
995 fl6->daddr = *final_dst;
997 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
999 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1001 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1003 static inline int ip6_ufo_append_data(struct sock *sk,
1004 int getfrag(void *from, char *to, int offset, int len,
1005 int odd, struct sk_buff *skb),
1006 void *from, int length, int hh_len, int fragheaderlen,
1007 int transhdrlen, int mtu,unsigned int flags,
1008 struct rt6_info *rt)
1011 struct sk_buff *skb;
1012 struct frag_hdr fhdr;
1015 /* There is support for UDP large send offload by network
1016 * device, so create one single skb packet containing complete
1019 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1020 skb = sock_alloc_send_skb(sk,
1021 hh_len + fragheaderlen + transhdrlen + 20,
1022 (flags & MSG_DONTWAIT), &err);
1026 /* reserve space for Hardware header */
1027 skb_reserve(skb, hh_len);
1029 /* create space for UDP/IP header */
1030 skb_put(skb,fragheaderlen + transhdrlen);
1032 /* initialize network header pointer */
1033 skb_reset_network_header(skb);
1035 /* initialize protocol header pointer */
1036 skb->transport_header = skb->network_header + fragheaderlen;
1038 skb->protocol = htons(ETH_P_IPV6);
1041 __skb_queue_tail(&sk->sk_write_queue, skb);
1042 } else if (skb_is_gso(skb)) {
1046 skb->ip_summed = CHECKSUM_PARTIAL;
1047 /* Specify the length of each IPv6 datagram fragment.
1048 * It has to be a multiple of 8.
1050 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1051 sizeof(struct frag_hdr)) & ~7;
1052 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1053 ipv6_select_ident(&fhdr, rt);
1054 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1057 return skb_append_datato_frags(sk, skb, getfrag, from,
1058 (length - transhdrlen));
1061 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1064 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1067 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1070 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1073 static void ip6_append_data_mtu(unsigned int *mtu,
1075 unsigned int fragheaderlen,
1076 struct sk_buff *skb,
1077 struct rt6_info *rt,
1080 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1082 /* first fragment, reserve header_len */
1083 *mtu = *mtu - rt->dst.header_len;
1087 * this fragment is not first, the headers
1088 * space is regarded as data space.
1090 *mtu = min(*mtu, pmtuprobe ?
1092 dst_mtu(rt->dst.path));
1094 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1095 + fragheaderlen - sizeof(struct frag_hdr);
1099 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1100 int offset, int len, int odd, struct sk_buff *skb),
1101 void *from, int length, int transhdrlen,
1102 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1103 struct rt6_info *rt, unsigned int flags, int dontfrag)
1105 struct inet_sock *inet = inet_sk(sk);
1106 struct ipv6_pinfo *np = inet6_sk(sk);
1107 struct inet_cork *cork;
1108 struct sk_buff *skb, *skb_prev = NULL;
1109 unsigned int maxfraglen, fragheaderlen, mtu;
1118 if (flags&MSG_PROBE)
1120 cork = &inet->cork.base;
1121 if (skb_queue_empty(&sk->sk_write_queue)) {
1126 if (WARN_ON(np->cork.opt))
1129 np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1130 if (unlikely(np->cork.opt == NULL))
1133 np->cork.opt->tot_len = opt->tot_len;
1134 np->cork.opt->opt_flen = opt->opt_flen;
1135 np->cork.opt->opt_nflen = opt->opt_nflen;
1137 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1139 if (opt->dst0opt && !np->cork.opt->dst0opt)
1142 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1144 if (opt->dst1opt && !np->cork.opt->dst1opt)
1147 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1149 if (opt->hopopt && !np->cork.opt->hopopt)
1152 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1154 if (opt->srcrt && !np->cork.opt->srcrt)
1157 /* need source address above miyazawa*/
1160 cork->dst = &rt->dst;
1161 inet->cork.fl.u.ip6 = *fl6;
1162 np->cork.hop_limit = hlimit;
1163 np->cork.tclass = tclass;
1164 if (rt->dst.flags & DST_XFRM_TUNNEL)
1165 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1166 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1168 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1169 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1170 if (np->frag_size < mtu) {
1172 mtu = np->frag_size;
1174 cork->fragsize = mtu;
1175 if (dst_allfrag(rt->dst.path))
1176 cork->flags |= IPCORK_ALLFRAG;
1178 exthdrlen = (opt ? opt->opt_flen : 0);
1179 length += exthdrlen;
1180 transhdrlen += exthdrlen;
1181 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1183 rt = (struct rt6_info *)cork->dst;
1184 fl6 = &inet->cork.fl.u.ip6;
1189 mtu = cork->fragsize;
1192 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1194 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1195 (opt ? opt->opt_nflen : 0);
1196 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1198 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1199 if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1200 ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1205 /* For UDP, check if TX timestamp is enabled */
1206 if (sk->sk_type == SOCK_DGRAM)
1207 sock_tx_timestamp(sk, &tx_flags);
1210 * Let's try using as much space as possible.
1211 * Use MTU if total length of the message fits into the MTU.
1212 * Otherwise, we need to reserve fragment header and
1213 * fragment alignment (= 8-15 octects, in total).
1215 * Note that we may need to "move" the data from the tail of
1216 * of the buffer to the new fragment when we split
1219 * FIXME: It may be fragmented into multiple chunks
1220 * at once if non-fragmentable extension headers
1225 if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
1226 sk->sk_protocol == IPPROTO_RAW)) {
1227 ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1231 skb = skb_peek_tail(&sk->sk_write_queue);
1232 cork->length += length;
1233 if (((length > mtu) ||
1234 (skb && skb_is_gso(skb))) &&
1235 (sk->sk_protocol == IPPROTO_UDP) &&
1236 (rt->dst.dev->features & NETIF_F_UFO)) {
1237 err = ip6_ufo_append_data(sk, getfrag, from, length,
1238 hh_len, fragheaderlen,
1239 transhdrlen, mtu, flags, rt);
1248 while (length > 0) {
1249 /* Check if the remaining data fits into current packet. */
1250 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1252 copy = maxfraglen - skb->len;
1256 unsigned int datalen;
1257 unsigned int fraglen;
1258 unsigned int fraggap;
1259 unsigned int alloclen;
1261 /* There's no room in the current skb */
1263 fraggap = skb->len - maxfraglen;
1266 /* update mtu and maxfraglen if necessary */
1267 if (skb == NULL || skb_prev == NULL)
1268 ip6_append_data_mtu(&mtu, &maxfraglen,
1269 fragheaderlen, skb, rt,
1271 IPV6_PMTUDISC_PROBE);
1276 * If remaining data exceeds the mtu,
1277 * we know we need more fragment(s).
1279 datalen = length + fraggap;
1281 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1282 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1283 if ((flags & MSG_MORE) &&
1284 !(rt->dst.dev->features&NETIF_F_SG))
1287 alloclen = datalen + fragheaderlen;
1289 alloclen += dst_exthdrlen;
1291 if (datalen != length + fraggap) {
1293 * this is not the last fragment, the trailer
1294 * space is regarded as data space.
1296 datalen += rt->dst.trailer_len;
1299 alloclen += rt->dst.trailer_len;
1300 fraglen = datalen + fragheaderlen;
1303 * We just reserve space for fragment header.
1304 * Note: this may be overallocation if the message
1305 * (without MSG_MORE) fits into the MTU.
1307 alloclen += sizeof(struct frag_hdr);
1310 skb = sock_alloc_send_skb(sk,
1312 (flags & MSG_DONTWAIT), &err);
1315 if (atomic_read(&sk->sk_wmem_alloc) <=
1317 skb = sock_wmalloc(sk,
1318 alloclen + hh_len, 1,
1320 if (unlikely(skb == NULL))
1323 /* Only the initial fragment
1332 * Fill in the control structures
1334 skb->protocol = htons(ETH_P_IPV6);
1335 skb->ip_summed = CHECKSUM_NONE;
1337 /* reserve for fragmentation and ipsec header */
1338 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1341 if (sk->sk_type == SOCK_DGRAM)
1342 skb_shinfo(skb)->tx_flags = tx_flags;
1345 * Find where to start putting bytes
1347 data = skb_put(skb, fraglen);
1348 skb_set_network_header(skb, exthdrlen);
1349 data += fragheaderlen;
1350 skb->transport_header = (skb->network_header +
1353 skb->csum = skb_copy_and_csum_bits(
1354 skb_prev, maxfraglen,
1355 data + transhdrlen, fraggap, 0);
1356 skb_prev->csum = csum_sub(skb_prev->csum,
1359 pskb_trim_unique(skb_prev, maxfraglen);
1361 copy = datalen - transhdrlen - fraggap;
1367 } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1374 length -= datalen - fraggap;
1380 * Put the packet on the pending queue
1382 __skb_queue_tail(&sk->sk_write_queue, skb);
1389 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1393 if (getfrag(from, skb_put(skb, copy),
1394 offset, copy, off, skb) < 0) {
1395 __skb_trim(skb, off);
1400 int i = skb_shinfo(skb)->nr_frags;
1401 struct page_frag *pfrag = sk_page_frag(sk);
1404 if (!sk_page_frag_refill(sk, pfrag))
1407 if (!skb_can_coalesce(skb, i, pfrag->page,
1410 if (i == MAX_SKB_FRAGS)
1413 __skb_fill_page_desc(skb, i, pfrag->page,
1415 skb_shinfo(skb)->nr_frags = ++i;
1416 get_page(pfrag->page);
1418 copy = min_t(int, copy, pfrag->size - pfrag->offset);
1420 page_address(pfrag->page) + pfrag->offset,
1421 offset, copy, skb->len, skb) < 0)
1424 pfrag->offset += copy;
1425 skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1427 skb->data_len += copy;
1428 skb->truesize += copy;
1429 atomic_add(copy, &sk->sk_wmem_alloc);
1440 cork->length -= length;
1441 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1444 EXPORT_SYMBOL_GPL(ip6_append_data);
1446 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1449 kfree(np->cork.opt->dst0opt);
1450 kfree(np->cork.opt->dst1opt);
1451 kfree(np->cork.opt->hopopt);
1452 kfree(np->cork.opt->srcrt);
1453 kfree(np->cork.opt);
1454 np->cork.opt = NULL;
1457 if (inet->cork.base.dst) {
1458 dst_release(inet->cork.base.dst);
1459 inet->cork.base.dst = NULL;
1460 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1462 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1465 int ip6_push_pending_frames(struct sock *sk)
1467 struct sk_buff *skb, *tmp_skb;
1468 struct sk_buff **tail_skb;
1469 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1470 struct inet_sock *inet = inet_sk(sk);
1471 struct ipv6_pinfo *np = inet6_sk(sk);
1472 struct net *net = sock_net(sk);
1473 struct ipv6hdr *hdr;
1474 struct ipv6_txoptions *opt = np->cork.opt;
1475 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1476 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1477 unsigned char proto = fl6->flowi6_proto;
1480 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1482 tail_skb = &(skb_shinfo(skb)->frag_list);
1484 /* move skb->data to ip header from ext header */
1485 if (skb->data < skb_network_header(skb))
1486 __skb_pull(skb, skb_network_offset(skb));
1487 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1488 __skb_pull(tmp_skb, skb_network_header_len(skb));
1489 *tail_skb = tmp_skb;
1490 tail_skb = &(tmp_skb->next);
1491 skb->len += tmp_skb->len;
1492 skb->data_len += tmp_skb->len;
1493 skb->truesize += tmp_skb->truesize;
1494 tmp_skb->destructor = NULL;
1498 /* Allow local fragmentation. */
1499 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1502 *final_dst = fl6->daddr;
1503 __skb_pull(skb, skb_network_header_len(skb));
1504 if (opt && opt->opt_flen)
1505 ipv6_push_frag_opts(skb, opt, &proto);
1506 if (opt && opt->opt_nflen)
1507 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1509 skb_push(skb, sizeof(struct ipv6hdr));
1510 skb_reset_network_header(skb);
1511 hdr = ipv6_hdr(skb);
1513 ip6_flow_hdr(hdr, np->cork.tclass, fl6->flowlabel);
1514 hdr->hop_limit = np->cork.hop_limit;
1515 hdr->nexthdr = proto;
1516 hdr->saddr = fl6->saddr;
1517 hdr->daddr = *final_dst;
1519 skb->priority = sk->sk_priority;
1520 skb->mark = sk->sk_mark;
1522 skb_dst_set(skb, dst_clone(&rt->dst));
1523 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1524 if (proto == IPPROTO_ICMPV6) {
1525 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1527 ICMP6MSGOUT_INC_STATS_BH(net, idev, icmp6_hdr(skb)->icmp6_type);
1528 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
1531 err = ip6_local_out(skb);
1534 err = net_xmit_errno(err);
1540 ip6_cork_release(inet, np);
1543 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1546 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1548 void ip6_flush_pending_frames(struct sock *sk)
1550 struct sk_buff *skb;
1552 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1554 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1555 IPSTATS_MIB_OUTDISCARDS);
1559 ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1561 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);