net/ipv6/ip6_output.c

   1 /*
   2  *      IPv6 output functions
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on linux/net/ipv4/ip_output.c
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  *
  15  *      Changes:
  16  *      A.N.Kuznetsov   :       airthmetics in fragmentation.
  17  *                              extension headers are implemented.
  18  *                              route changes now work.
  19  *                              ip6_forward does not confuse sniffers.
  20  *                              etc.
  21  *
  22  *      H. von Brand    :       Added missing #include <linux/string.h>
  23  *      Imran Patel     :       frag id should be in NBO
  24  *      Kazunori MIYAZAWA @USAGI
  25  *                      :       add ip6_append_data and related functions
  26  *                              for datagram xmit
  27  */
  28
  29 #include <linux/errno.h>
  30 #include <linux/kernel.h>
  31 #include <linux/string.h>
  32 #include <linux/socket.h>
  33 #include <linux/net.h>
  34 #include <linux/netdevice.h>
  35 #include <linux/if_arp.h>
  36 #include <linux/in6.h>
  37 #include <linux/tcp.h>
  38 #include <linux/route.h>
  39 #include <linux/module.h>
  40 #include <linux/slab.h>
  41
  42 #include <linux/netfilter.h>
  43 #include <linux/netfilter_ipv6.h>
  44
  45 #include <net/sock.h>
  46 #include <net/snmp.h>
  47
  48 #include <net/ipv6.h>
  49 #include <net/ndisc.h>
  50 #include <net/protocol.h>
  51 #include <net/ip6_route.h>
  52 #include <net/addrconf.h>
  53 #include <net/rawv6.h>
  54 #include <net/icmp.h>
  55 #include <net/xfrm.h>
  56 #include <net/checksum.h>
  57 #include <linux/mroute6.h>
  58
  59 static int ip6_finish_output2(struct sk_buff *skb)
  60 {
  61         struct dst_entry *dst = skb_dst(skb);
  62         struct net_device *dev = dst->dev;
  63         struct neighbour *neigh;
  64         struct in6_addr *nexthop;
  65         int ret;
  66
  67         skb->protocol = htons(ETH_P_IPV6);
  68         skb->dev = dev;
  69
  70         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
  71                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
  72
  73                 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
  74                     ((mroute6_socket(dev_net(dev), skb) &&
  75                      !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
  76                      ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
  77                                          &ipv6_hdr(skb)->saddr))) {
  78                         struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
  79
  80                         /* Do not check for IFF_ALLMULTI; multicast routing
  81                            is not supported in any case.
  82                          */
  83                         if (newskb)
  84                                 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
  85                                         newskb, NULL, newskb->dev,
  86                                         dev_loopback_xmit);
  87
  88                         if (ipv6_hdr(skb)->hop_limit == 0) {
  89                                 IP6_INC_STATS(dev_net(dev), idev,
  90                                               IPSTATS_MIB_OUTDISCARDS);
  91                                 kfree_skb(skb);
  92                                 return 0;
  93                         }
  94                 }
  95
  96                 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
  97                                 skb->len);
  98
  99                 if (IPV6_ADDR_MC_SCOPE(&ipv6_hdr(skb)->daddr) <=
 100                     IPV6_ADDR_SCOPE_NODELOCAL &&
 101                     !(dev->flags & IFF_LOOPBACK)) {
 102                         kfree_skb(skb);
 103                         return 0;
 104                 }
 105         }
 106
 107         rcu_read_lock_bh();
 108         nexthop = rt6_nexthop((struct rt6_info *)dst);
 109         neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
 110         if (unlikely(!neigh))
 111                 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
 112         if (!IS_ERR(neigh)) {
 113                 ret = dst_neigh_output(dst, neigh, skb);
 114                 rcu_read_unlock_bh();
 115                 return ret;
 116         }
 117         rcu_read_unlock_bh();
 118
 119         IP6_INC_STATS(dev_net(dst->dev),
 120                       ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
 121         kfree_skb(skb);
 122         return -EINVAL;
 123 }
 124
 125 static int ip6_finish_output(struct sk_buff *skb)
 126 {
 127         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
 128             dst_allfrag(skb_dst(skb)) ||
 129             (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
 130                 return ip6_fragment(skb, ip6_finish_output2);
 131         else
 132                 return ip6_finish_output2(skb);
 133 }
 134
 135 int ip6_output(struct sock *sk, struct sk_buff *skb)
 136 {
 137         struct net_device *dev = skb_dst(skb)->dev;
 138         struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
 139         if (unlikely(idev->cnf.disable_ipv6)) {
 140                 IP6_INC_STATS(dev_net(dev), idev,
 141                               IPSTATS_MIB_OUTDISCARDS);
 142                 kfree_skb(skb);
 143                 return 0;
 144         }
 145
 146         return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
 147                             ip6_finish_output,
 148                             !(IP6CB(skb)->flags & IP6SKB_REROUTED));
 149 }
 150
 151 /*
 152  *      xmit an sk_buff (used by TCP, SCTP and DCCP)
 153  */
 154
 155 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 156              struct ipv6_txoptions *opt, int tclass)
 157 {
 158         struct net *net = sock_net(sk);
 159         struct ipv6_pinfo *np = inet6_sk(sk);
 160         struct in6_addr *first_hop = &fl6->daddr;
 161         struct dst_entry *dst = skb_dst(skb);
 162         struct ipv6hdr *hdr;
 163         u8  proto = fl6->flowi6_proto;
 164         int seg_len = skb->len;
 165         int hlimit = -1;
 166         u32 mtu;
 167
 168         if (opt) {
 169                 unsigned int head_room;
 170
 171                 /* First: exthdrs may take lots of space (~8K for now)
 172                    MAX_HEADER is not enough.
 173                  */
 174                 head_room = opt->opt_nflen + opt->opt_flen;
 175                 seg_len += head_room;
 176                 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
 177
 178                 if (skb_headroom(skb) < head_room) {
 179                         struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
 180                         if (skb2 == NULL) {
 181                                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 182                                               IPSTATS_MIB_OUTDISCARDS);
 183                                 kfree_skb(skb);
 184                                 return -ENOBUFS;
 185                         }
 186                         consume_skb(skb);
 187                         skb = skb2;
 188                         skb_set_owner_w(skb, sk);
 189                 }
 190                 if (opt->opt_flen)
 191                         ipv6_push_frag_opts(skb, opt, &proto);
 192                 if (opt->opt_nflen)
 193                         ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
 194         }
 195
 196         skb_push(skb, sizeof(struct ipv6hdr));
 197         skb_reset_network_header(skb);
 198         hdr = ipv6_hdr(skb);
 199
 200         /*
 201          *      Fill in the IPv6 header
 202          */
 203         if (np)
 204                 hlimit = np->hop_limit;
 205         if (hlimit < 0)
 206                 hlimit = ip6_dst_hoplimit(dst);
 207
 208         ip6_flow_hdr(hdr, tclass, fl6->flowlabel);
 209
 210         hdr->payload_len = htons(seg_len);
 211         hdr->nexthdr = proto;
 212         hdr->hop_limit = hlimit;
 213
 214         hdr->saddr = fl6->saddr;
 215         hdr->daddr = *first_hop;
 216
 217         skb->protocol = htons(ETH_P_IPV6);
 218         skb->priority = sk->sk_priority;
 219         skb->mark = sk->sk_mark;
 220
 221         mtu = dst_mtu(dst);
 222         if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
 223                 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
 224                               IPSTATS_MIB_OUT, skb->len);
 225                 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
 226                                dst->dev, dst_output);
 227         }
 228
 229         skb->dev = dst->dev;
 230         ipv6_local_error(sk, EMSGSIZE, fl6, mtu);
 231         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
 232         kfree_skb(skb);
 233         return -EMSGSIZE;
 234 }
 235
 236 EXPORT_SYMBOL(ip6_xmit);
 237
 238 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
 239 {
 240         struct ip6_ra_chain *ra;
 241         struct sock *last = NULL;
 242
 243         read_lock(&ip6_ra_lock);
 244         for (ra = ip6_ra_chain; ra; ra = ra->next) {
 245                 struct sock *sk = ra->sk;
 246                 if (sk && ra->sel == sel &&
 247                     (!sk->sk_bound_dev_if ||
 248                      sk->sk_bound_dev_if == skb->dev->ifindex)) {
 249                         if (last) {
 250                                 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 251                                 if (skb2)
 252                                         rawv6_rcv(last, skb2);
 253                         }
 254                         last = sk;
 255                 }
 256         }
 257
 258         if (last) {
 259                 rawv6_rcv(last, skb);
 260                 read_unlock(&ip6_ra_lock);
 261                 return 1;
 262         }
 263         read_unlock(&ip6_ra_lock);
 264         return 0;
 265 }
 266
 267 static int ip6_forward_proxy_check(struct sk_buff *skb)
 268 {
 269         struct ipv6hdr *hdr = ipv6_hdr(skb);
 270         u8 nexthdr = hdr->nexthdr;
 271         __be16 frag_off;
 272         int offset;
 273
 274         if (ipv6_ext_hdr(nexthdr)) {
 275                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr, &frag_off);
 276                 if (offset < 0)
 277                         return 0;
 278         } else
 279                 offset = sizeof(struct ipv6hdr);
 280
 281         if (nexthdr == IPPROTO_ICMPV6) {
 282                 struct icmp6hdr *icmp6;
 283
 284                 if (!pskb_may_pull(skb, (skb_network_header(skb) +
 285                                          offset + 1 - skb->data)))
 286                         return 0;
 287
 288                 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
 289
 290                 switch (icmp6->icmp6_type) {
 291                 case NDISC_ROUTER_SOLICITATION:
 292                 case NDISC_ROUTER_ADVERTISEMENT:
 293                 case NDISC_NEIGHBOUR_SOLICITATION:
 294                 case NDISC_NEIGHBOUR_ADVERTISEMENT:
 295                 case NDISC_REDIRECT:
 296                         /* For reaction involving unicast neighbor discovery
 297                          * message destined to the proxied address, pass it to
 298                          * input function.
 299                          */
 300                         return 1;
 301                 default:
 302                         break;
 303                 }
 304         }
 305
 306         /*
 307          * The proxying router can't forward traffic sent to a link-local
 308          * address, so signal the sender and discard the packet. This
 309          * behavior is clarified by the MIPv6 specification.
 310          */
 311         if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
 312                 dst_link_failure(skb);
 313                 return -1;
 314         }
 315
 316         return 0;
 317 }
 318
 319 static inline int ip6_forward_finish(struct sk_buff *skb)
 320 {
 321         return dst_output(skb);
 322 }
 323
 324 static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
 325 {
 326         unsigned int mtu;
 327         struct inet6_dev *idev;
 328
 329         if (dst_metric_locked(dst, RTAX_MTU)) {
 330                 mtu = dst_metric_raw(dst, RTAX_MTU);
 331                 if (mtu)
 332                         return mtu;
 333         }
 334
 335         mtu = IPV6_MIN_MTU;
 336         rcu_read_lock();
 337         idev = __in6_dev_get(dst->dev);
 338         if (idev)
 339                 mtu = idev->cnf.mtu6;
 340         rcu_read_unlock();
 341
 342         return mtu;
 343 }
 344
 345 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
 346 {
 347         if (skb->len <= mtu || skb->local_df)
 348                 return false;
 349
 350         if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
 351                 return true;
 352
 353         if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
 354                 return false;
 355
 356         return true;
 357 }
 358
 359 int ip6_forward(struct sk_buff *skb)
 360 {
 361         struct dst_entry *dst = skb_dst(skb);
 362         struct ipv6hdr *hdr = ipv6_hdr(skb);
 363         struct inet6_skb_parm *opt = IP6CB(skb);
 364         struct net *net = dev_net(dst->dev);
 365         u32 mtu;
 366
 367         if (net->ipv6.devconf_all->forwarding == 0)
 368                 goto error;
 369
 370         if (skb->pkt_type != PACKET_HOST)
 371                 goto drop;
 372
 373         if (skb_warn_if_lro(skb))
 374                 goto drop;
 375
 376         if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
 377                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 378                                  IPSTATS_MIB_INDISCARDS);
 379                 goto drop;
 380         }
 381
 382         skb_forward_csum(skb);
 383
 384         /*
 385          *      We DO NOT make any processing on
 386          *      RA packets, pushing them to user level AS IS
 387          *      without ane WARRANTY that application will be able
 388          *      to interpret them. The reason is that we
 389          *      cannot make anything clever here.
 390          *
 391          *      We are not end-node, so that if packet contains
 392          *      AH/ESP, we cannot make anything.
 393          *      Defragmentation also would be mistake, RA packets
 394          *      cannot be fragmented, because there is no warranty
 395          *      that different fragments will go along one path. --ANK
 396          */
 397         if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
 398                 if (ip6_call_ra_chain(skb, ntohs(opt->ra)))
 399                         return 0;
 400         }
 401
 402         /*
 403          *      check and decrement ttl
 404          */
 405         if (hdr->hop_limit <= 1) {
 406                 /* Force OUTPUT device used as source address */
 407                 skb->dev = dst->dev;
 408                 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
 409                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 410                                  IPSTATS_MIB_INHDRERRORS);
 411
 412                 kfree_skb(skb);
 413                 return -ETIMEDOUT;
 414         }
 415
 416         /* XXX: idev->cnf.proxy_ndp? */
 417         if (net->ipv6.devconf_all->proxy_ndp &&
 418             pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
 419                 int proxied = ip6_forward_proxy_check(skb);
 420                 if (proxied > 0)
 421                         return ip6_input(skb);
 422                 else if (proxied < 0) {
 423                         IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 424                                          IPSTATS_MIB_INDISCARDS);
 425                         goto drop;
 426                 }
 427         }
 428
 429         if (!xfrm6_route_forward(skb)) {
 430                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 431                                  IPSTATS_MIB_INDISCARDS);
 432                 goto drop;
 433         }
 434         dst = skb_dst(skb);
 435
 436         /* IPv6 specs say nothing about it, but it is clear that we cannot
 437            send redirects to source routed frames.
 438            We don't send redirects to frames decapsulated from IPsec.
 439          */
 440         if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
 441                 struct in6_addr *target = NULL;
 442                 struct inet_peer *peer;
 443                 struct rt6_info *rt;
 444
 445                 /*
 446                  *      incoming and outgoing devices are the same
 447                  *      send a redirect.
 448                  */
 449
 450                 rt = (struct rt6_info *) dst;
 451                 if (rt->rt6i_flags & RTF_GATEWAY)
 452                         target = &rt->rt6i_gateway;
 453                 else
 454                         target = &hdr->daddr;
 455
 456                 peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
 457
 458                 /* Limit redirects both by destination (here)
 459                    and by source (inside ndisc_send_redirect)
 460                  */
 461                 if (inet_peer_xrlim_allow(peer, 1*HZ))
 462                         ndisc_send_redirect(skb, target);
 463                 if (peer)
 464                         inet_putpeer(peer);
 465         } else {
 466                 int addrtype = ipv6_addr_type(&hdr->saddr);
 467
 468                 /* This check is security critical. */
 469                 if (addrtype == IPV6_ADDR_ANY ||
 470                     addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
 471                         goto error;
 472                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
 473                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
 474                                     ICMPV6_NOT_NEIGHBOUR, 0);
 475                         goto error;
 476                 }
 477         }
 478
 479         mtu = ip6_dst_mtu_forward(dst);
 480         if (mtu < IPV6_MIN_MTU)
 481                 mtu = IPV6_MIN_MTU;
 482
 483         if (ip6_pkt_too_big(skb, mtu)) {
 484                 /* Again, force OUTPUT device used as source address */
 485                 skb->dev = dst->dev;
 486                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 487                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 488                                  IPSTATS_MIB_INTOOBIGERRORS);
 489                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 490                                  IPSTATS_MIB_FRAGFAILS);
 491                 kfree_skb(skb);
 492                 return -EMSGSIZE;
 493         }
 494
 495         if (skb_cow(skb, dst->dev->hard_header_len)) {
 496                 IP6_INC_STATS_BH(net, ip6_dst_idev(dst),
 497                                  IPSTATS_MIB_OUTDISCARDS);
 498                 goto drop;
 499         }
 500
 501         hdr = ipv6_hdr(skb);
 502
 503         /* Mangling hops number delayed to point after skb COW */
 504
 505         hdr->hop_limit--;
 506
 507         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
 508         IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
 509         return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
 510                        ip6_forward_finish);
 511
 512 error:
 513         IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
 514 drop:
 515         kfree_skb(skb);
 516         return -EINVAL;
 517 }
 518
 519 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
 520 {
 521         to->pkt_type = from->pkt_type;
 522         to->priority = from->priority;
 523         to->protocol = from->protocol;
 524         skb_dst_drop(to);
 525         skb_dst_set(to, dst_clone(skb_dst(from)));
 526         to->dev = from->dev;
 527         to->mark = from->mark;
 528
 529 #ifdef CONFIG_NET_SCHED
 530         to->tc_index = from->tc_index;
 531 #endif
 532         nf_copy(to, from);
 533         skb_copy_secmark(to, from);
 534 }
 535
 536 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 537 {
 538         struct sk_buff *frag;
 539         struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
 540         struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
 541         struct ipv6hdr *tmp_hdr;
 542         struct frag_hdr *fh;
 543         unsigned int mtu, hlen, left, len;
 544         int hroom, troom;
 545         __be32 frag_id = 0;
 546         int ptr, offset = 0, err=0;
 547         u8 *prevhdr, nexthdr = 0;
 548         struct net *net = dev_net(skb_dst(skb)->dev);
 549
 550         hlen = ip6_find_1stfragopt(skb, &prevhdr);
 551         nexthdr = *prevhdr;
 552
 553         mtu = ip6_skb_dst_mtu(skb);
 554
 555         /* We must not fragment if the socket is set to force MTU discovery
 556          * or if the skb it not generated by a local socket.
 557          */
 558         if (unlikely(!skb->local_df && skb->len > mtu) ||
 559                      (IP6CB(skb)->frag_max_size &&
 560                       IP6CB(skb)->frag_max_size > mtu)) {
 561                 if (skb->sk && dst_allfrag(skb_dst(skb)))
 562                         sk_nocaps_add(skb->sk, NETIF_F_GSO_MASK);
 563
 564                 skb->dev = skb_dst(skb)->dev;
 565                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 566                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 567                               IPSTATS_MIB_FRAGFAILS);
 568                 kfree_skb(skb);
 569                 return -EMSGSIZE;
 570         }
 571
 572         if (np && np->frag_size < mtu) {
 573                 if (np->frag_size)
 574                         mtu = np->frag_size;
 575         }
 576         mtu -= hlen + sizeof(struct frag_hdr);
 577
 578         if (skb_has_frag_list(skb)) {
 579                 int first_len = skb_pagelen(skb);
 580                 struct sk_buff *frag2;
 581
 582                 if (first_len - hlen > mtu ||
 583                     ((first_len - hlen) & 7) ||
 584                     skb_cloned(skb))
 585                         goto slow_path;
 586
 587                 skb_walk_frags(skb, frag) {
 588                         /* Correct geometry. */
 589                         if (frag->len > mtu ||
 590                             ((frag->len & 7) && frag->next) ||
 591                             skb_headroom(frag) < hlen)
 592                                 goto slow_path_clean;
 593
 594                         /* Partially cloned skb? */
 595                         if (skb_shared(frag))
 596                                 goto slow_path_clean;
 597
 598                         BUG_ON(frag->sk);
 599                         if (skb->sk) {
 600                                 frag->sk = skb->sk;
 601                                 frag->destructor = sock_wfree;
 602                         }
 603                         skb->truesize -= frag->truesize;
 604                 }
 605
 606                 err = 0;
 607                 offset = 0;
 608                 frag = skb_shinfo(skb)->frag_list;
 609                 skb_frag_list_init(skb);
 610                 /* BUILD HEADER */
 611
 612                 *prevhdr = NEXTHDR_FRAGMENT;
 613                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
 614                 if (!tmp_hdr) {
 615                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 616                                       IPSTATS_MIB_FRAGFAILS);
 617                         return -ENOMEM;
 618                 }
 619
 620                 __skb_pull(skb, hlen);
 621                 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
 622                 __skb_push(skb, hlen);
 623                 skb_reset_network_header(skb);
 624                 memcpy(skb_network_header(skb), tmp_hdr, hlen);
 625
 626                 ipv6_select_ident(fh, rt);
 627                 fh->nexthdr = nexthdr;
 628                 fh->reserved = 0;
 629                 fh->frag_off = htons(IP6_MF);
 630                 frag_id = fh->identification;
 631
 632                 first_len = skb_pagelen(skb);
 633                 skb->data_len = first_len - skb_headlen(skb);
 634                 skb->len = first_len;
 635                 ipv6_hdr(skb)->payload_len = htons(first_len -
 636                                                    sizeof(struct ipv6hdr));
 637
 638                 dst_hold(&rt->dst);
 639
 640                 for (;;) {
 641                         /* Prepare header of the next frame,
 642                          * before previous one went down. */
 643                         if (frag) {
 644                                 frag->ip_summed = CHECKSUM_NONE;
 645                                 skb_reset_transport_header(frag);
 646                                 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
 647                                 __skb_push(frag, hlen);
 648                                 skb_reset_network_header(frag);
 649                                 memcpy(skb_network_header(frag), tmp_hdr,
 650                                        hlen);
 651                                 offset += skb->len - hlen - sizeof(struct frag_hdr);
 652                                 fh->nexthdr = nexthdr;
 653                                 fh->reserved = 0;
 654                                 fh->frag_off = htons(offset);
 655                                 if (frag->next != NULL)
 656                                         fh->frag_off |= htons(IP6_MF);
 657                                 fh->identification = frag_id;
 658                                 ipv6_hdr(frag)->payload_len =
 659                                                 htons(frag->len -
 660                                                       sizeof(struct ipv6hdr));
 661                                 ip6_copy_metadata(frag, skb);
 662                         }
 663
 664                         err = output(skb);
 665                         if(!err)
 666                                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 667                                               IPSTATS_MIB_FRAGCREATES);
 668
 669                         if (err || !frag)
 670                                 break;
 671
 672                         skb = frag;
 673                         frag = skb->next;
 674                         skb->next = NULL;
 675                 }
 676
 677                 kfree(tmp_hdr);
 678
 679                 if (err == 0) {
 680                         IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 681                                       IPSTATS_MIB_FRAGOKS);
 682                         ip6_rt_put(rt);
 683                         return 0;
 684                 }
 685
 686                 while (frag) {
 687                         skb = frag->next;
 688                         kfree_skb(frag);
 689                         frag = skb;
 690                 }
 691
 692                 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
 693                               IPSTATS_MIB_FRAGFAILS);
 694                 ip6_rt_put(rt);
 695                 return err;
 696
 697 slow_path_clean:
 698                 skb_walk_frags(skb, frag2) {
 699                         if (frag2 == frag)
 700                                 break;
 701                         frag2->sk = NULL;
 702                         frag2->destructor = NULL;
 703                         skb->truesize += frag2->truesize;
 704                 }
 705         }
 706
 707 slow_path:
 708         if ((skb->ip_summed == CHECKSUM_PARTIAL) &&
 709             skb_checksum_help(skb))
 710                 goto fail;
 711
 712         left = skb->len - hlen;         /* Space per frame */
 713         ptr = hlen;                     /* Where to start from */
 714
 715         /*
 716          *      Fragment the datagram.
 717          */
 718
 719         *prevhdr = NEXTHDR_FRAGMENT;
 720         hroom = LL_RESERVED_SPACE(rt->dst.dev);
 721         troom = rt->dst.dev->needed_tailroom;
 722
 723         /*
 724          *      Keep copying data until we run out.
 725          */
 726         while(left > 0) {
 727                 len = left;
 728                 /* IF: it doesn't fit, use 'mtu' - the data space left */
 729                 if (len > mtu)
 730                         len = mtu;
 731                 /* IF: we are not sending up to and including the packet end
 732                    then align the next start on an eight byte boundary */
 733                 if (len < left) {
 734                         len &= ~7;
 735                 }
 736                 /*
 737                  *      Allocate buffer.
 738                  */
 739
 740                 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
 741                                       hroom + troom, GFP_ATOMIC)) == NULL) {
 742                         NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
 743                         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 744                                       IPSTATS_MIB_FRAGFAILS);
 745                         err = -ENOMEM;
 746                         goto fail;
 747                 }
 748
 749                 /*
 750                  *      Set up data on packet
 751                  */
 752
 753                 ip6_copy_metadata(frag, skb);
 754                 skb_reserve(frag, hroom);
 755                 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
 756                 skb_reset_network_header(frag);
 757                 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
 758                 frag->transport_header = (frag->network_header + hlen +
 759                                           sizeof(struct frag_hdr));
 760
 761                 /*
 762                  *      Charge the memory for the fragment to any owner
 763                  *      it might possess
 764                  */
 765                 if (skb->sk)
 766                         skb_set_owner_w(frag, skb->sk);
 767
 768                 /*
 769                  *      Copy the packet header into the new buffer.
 770                  */
 771                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 772
 773                 /*
 774                  *      Build fragment header.
 775                  */
 776                 fh->nexthdr = nexthdr;
 777                 fh->reserved = 0;
 778                 if (!frag_id) {
 779                         ipv6_select_ident(fh, rt);
 780                         frag_id = fh->identification;
 781                 } else
 782                         fh->identification = frag_id;
 783
 784                 /*
 785                  *      Copy a block of the IP datagram.
 786                  */
 787                 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
 788                         BUG();
 789                 left -= len;
 790
 791                 fh->frag_off = htons(offset);
 792                 if (left > 0)
 793                         fh->frag_off |= htons(IP6_MF);
 794                 ipv6_hdr(frag)->payload_len = htons(frag->len -
 795                                                     sizeof(struct ipv6hdr));
 796
 797                 ptr += len;
 798                 offset += len;
 799
 800                 /*
 801                  *      Put this fragment into the sending queue.
 802                  */
 803                 err = output(frag);
 804                 if (err)
 805                         goto fail;
 806
 807                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 808                               IPSTATS_MIB_FRAGCREATES);
 809         }
 810         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 811                       IPSTATS_MIB_FRAGOKS);
 812         consume_skb(skb);
 813         return err;
 814
 815 fail:
 816         IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 817                       IPSTATS_MIB_FRAGFAILS);
 818         kfree_skb(skb);
 819         return err;
 820 }
 821
 822 static inline int ip6_rt_check(const struct rt6key *rt_key,
 823                                const struct in6_addr *fl_addr,
 824                                const struct in6_addr *addr_cache)
 825 {
 826         return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
 827                 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
 828 }
 829
 830 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
 831                                           struct dst_entry *dst,
 832                                           const struct flowi6 *fl6)
 833 {
 834         struct ipv6_pinfo *np = inet6_sk(sk);
 835         struct rt6_info *rt;
 836
 837         if (!dst)
 838                 goto out;
 839
 840         if (dst->ops->family != AF_INET6) {
 841                 dst_release(dst);
 842                 return NULL;
 843         }
 844
 845         rt = (struct rt6_info *)dst;
 846         /* Yes, checking route validity in not connected
 847          * case is not very simple. Take into account,
 848          * that we do not support routing by source, TOS,
 849          * and MSG_DONTROUTE            --ANK (980726)
 850          *
 851          * 1. ip6_rt_check(): If route was host route,
 852          *    check that cached destination is current.
 853          *    If it is network route, we still may
 854          *    check its validity using saved pointer
 855          *    to the last used address: daddr_cache.
 856          *    We do not want to save whole address now,
 857          *    (because main consumer of this service
 858          *    is tcp, which has not this problem),
 859          *    so that the last trick works only on connected
 860          *    sockets.
 861          * 2. oif also should be the same.
 862          */
 863         if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
 864 #ifdef CONFIG_IPV6_SUBTREES
 865             ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
 866 #endif
 867             (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
 868                 dst_release(dst);
 869                 dst = NULL;
 870         }
 871
 872 out:
 873         return dst;
 874 }
 875
 876 static int ip6_dst_lookup_tail(struct sock *sk,
 877                                struct dst_entry **dst, struct flowi6 *fl6)
 878 {
 879         struct net *net = sock_net(sk);
 880 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 881         struct neighbour *n;
 882         struct rt6_info *rt;
 883 #endif
 884         int err;
 885
 886         if (*dst == NULL)
 887                 *dst = ip6_route_output(net, sk, fl6);
 888
 889         if ((err = (*dst)->error))
 890                 goto out_err_release;
 891
 892         if (ipv6_addr_any(&fl6->saddr)) {
 893                 struct rt6_info *rt = (struct rt6_info *) *dst;
 894                 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
 895                                           sk ? inet6_sk(sk)->srcprefs : 0,
 896                                           &fl6->saddr);
 897                 if (err)
 898                         goto out_err_release;
 899         }
 900
 901 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
 902         /*
 903          * Here if the dst entry we've looked up
 904          * has a neighbour entry that is in the INCOMPLETE
 905          * state and the src address from the flow is
 906          * marked as OPTIMISTIC, we release the found
 907          * dst entry and replace it instead with the
 908          * dst entry of the nexthop router
 909          */
 910         rt = (struct rt6_info *) *dst;
 911         rcu_read_lock_bh();
 912         n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt));
 913         err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
 914         rcu_read_unlock_bh();
 915
 916         if (err) {
 917                 struct inet6_ifaddr *ifp;
 918                 struct flowi6 fl_gw6;
 919                 int redirect;
 920
 921                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
 922                                       (*dst)->dev, 1);
 923
 924                 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
 925                 if (ifp)
 926                         in6_ifa_put(ifp);
 927
 928                 if (redirect) {
 929                         /*
 930                          * We need to get the dst entry for the
 931                          * default router instead
 932                          */
 933                         dst_release(*dst);
 934                         memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
 935                         memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
 936                         *dst = ip6_route_output(net, sk, &fl_gw6);
 937                         if ((err = (*dst)->error))
 938                                 goto out_err_release;
 939                 }
 940         }
 941 #endif
 942
 943         return 0;
 944
 945 out_err_release:
 946         if (err == -ENETUNREACH)
 947                 IP6_INC_STATS(net, NULL, IPSTATS_MIB_OUTNOROUTES);
 948         dst_release(*dst);
 949         *dst = NULL;
 950         return err;
 951 }
 952
 953 /**
 954  *      ip6_dst_lookup - perform route lookup on flow
 955  *      @sk: socket which provides route info
 956  *      @dst: pointer to dst_entry * for result
 957  *      @fl6: flow to lookup
 958  *
 959  *      This function performs a route lookup on the given flow.
 960  *
 961  *      It returns zero on success, or a standard errno code on error.
 962  */
 963 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
 964 {
 965         *dst = NULL;
 966         return ip6_dst_lookup_tail(sk, dst, fl6);
 967 }
 968 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 969
 970 /**
 971  *      ip6_dst_lookup_flow - perform route lookup on flow with ipsec
 972  *      @sk: socket which provides route info
 973  *      @fl6: flow to lookup
 974  *      @final_dst: final destination address for ipsec lookup
 975  *
 976  *      This function performs a route lookup on the given flow.
 977  *
 978  *      It returns a valid dst pointer on success, or a pointer encoded
 979  *      error code.
 980  */
 981 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
 982                                       const struct in6_addr *final_dst)
 983 {
 984         struct dst_entry *dst = NULL;
 985         int err;
 986
 987         err = ip6_dst_lookup_tail(sk, &dst, fl6);
 988         if (err)
 989                 return ERR_PTR(err);
 990         if (final_dst)
 991                 fl6->daddr = *final_dst;
 992
 993         return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
 994 }
 995 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
 996
 997 /**
 998  *      ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
 999  *      @sk: socket which provides the dst cache and route info
1000  *      @fl6: flow to lookup
1001  *      @final_dst: final destination address for ipsec lookup
1002  *
1003  *      This function performs a route lookup on the given flow with the
1004  *      possibility of using the cached route in the socket if it is valid.
1005  *      It will take the socket dst lock when operating on the dst cache.
1006  *      As a result, this function can only be used in process context.
1007  *
1008  *      It returns a valid dst pointer on success, or a pointer encoded
1009  *      error code.
1010  */
1011 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1012                                          const struct in6_addr *final_dst)
1013 {
1014         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1015         int err;
1016
1017         dst = ip6_sk_dst_check(sk, dst, fl6);
1018
1019         err = ip6_dst_lookup_tail(sk, &dst, fl6);
1020         if (err)
1021                 return ERR_PTR(err);
1022         if (final_dst)
1023                 fl6->daddr = *final_dst;
1024
1025         return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1026 }
1027 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1028
1029 static inline int ip6_ufo_append_data(struct sock *sk,
1030                         int getfrag(void *from, char *to, int offset, int len,
1031                         int odd, struct sk_buff *skb),
1032                         void *from, int length, int hh_len, int fragheaderlen,
1033                         int transhdrlen, int mtu,unsigned int flags,
1034                         struct rt6_info *rt)
1035
1036 {
1037         struct sk_buff *skb;
1038         struct frag_hdr fhdr;
1039         int err;
1040
1041         /* There is support for UDP large send offload by network
1042          * device, so create one single skb packet containing complete
1043          * udp datagram
1044          */
1045         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1046                 skb = sock_alloc_send_skb(sk,
1047                         hh_len + fragheaderlen + transhdrlen + 20,
1048                         (flags & MSG_DONTWAIT), &err);
1049                 if (skb == NULL)
1050                         return err;
1051
1052                 /* reserve space for Hardware header */
1053                 skb_reserve(skb, hh_len);
1054
1055                 /* create space for UDP/IP header */
1056                 skb_put(skb,fragheaderlen + transhdrlen);
1057
1058                 /* initialize network header pointer */
1059                 skb_reset_network_header(skb);
1060
1061                 /* initialize protocol header pointer */
1062                 skb->transport_header = skb->network_header + fragheaderlen;
1063
1064                 skb->protocol = htons(ETH_P_IPV6);
1065                 skb->csum = 0;
1066
1067                 __skb_queue_tail(&sk->sk_write_queue, skb);
1068         } else if (skb_is_gso(skb)) {
1069                 goto append;
1070         }
1071
1072         skb->ip_summed = CHECKSUM_PARTIAL;
1073         /* Specify the length of each IPv6 datagram fragment.
1074          * It has to be a multiple of 8.
1075          */
1076         skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1077                                      sizeof(struct frag_hdr)) & ~7;
1078         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1079         ipv6_select_ident(&fhdr, rt);
1080         skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1081
1082 append:
1083         return skb_append_datato_frags(sk, skb, getfrag, from,
1084                                        (length - transhdrlen));
1085 }
1086
1087 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1088                                                gfp_t gfp)
1089 {
1090         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1091 }
1092
1093 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1094                                                 gfp_t gfp)
1095 {
1096         return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1097 }
1098
1099 static void ip6_append_data_mtu(unsigned int *mtu,
1100                                 int *maxfraglen,
1101                                 unsigned int fragheaderlen,
1102                                 struct sk_buff *skb,
1103                                 struct rt6_info *rt,
1104                                 unsigned int orig_mtu)
1105 {
1106         if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1107                 if (skb == NULL) {
1108                         /* first fragment, reserve header_len */
1109                         *mtu = orig_mtu - rt->dst.header_len;
1110
1111                 } else {
1112                         /*
1113                          * this fragment is not first, the headers
1114                          * space is regarded as data space.
1115                          */
1116                         *mtu = orig_mtu;
1117                 }
1118                 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1119                               + fragheaderlen - sizeof(struct frag_hdr);
1120         }
1121 }
1122
1123 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1124         int offset, int len, int odd, struct sk_buff *skb),
1125         void *from, int length, int transhdrlen,
1126         int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1127         struct rt6_info *rt, unsigned int flags, int dontfrag)
1128 {
1129         struct inet_sock *inet = inet_sk(sk);
1130         struct ipv6_pinfo *np = inet6_sk(sk);
1131         struct inet_cork *cork;
1132         struct sk_buff *skb, *skb_prev = NULL;
1133         unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1134         int exthdrlen;
1135         int dst_exthdrlen;
1136         int hh_len;
1137         int copy;
1138         int err;
1139         int offset = 0;
1140         __u8 tx_flags = 0;
1141
1142         if (flags&MSG_PROBE)
1143                 return 0;
1144         cork = &inet->cork.base;
1145         if (skb_queue_empty(&sk->sk_write_queue)) {
1146                 /*
1147                  * setup for corking
1148                  */
1149                 if (opt) {
1150                         if (WARN_ON(np->cork.opt))
1151                                 return -EINVAL;
1152
1153                         np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1154                         if (unlikely(np->cork.opt == NULL))
1155                                 return -ENOBUFS;
1156
1157                         np->cork.opt->tot_len = opt->tot_len;
1158                         np->cork.opt->opt_flen = opt->opt_flen;
1159                         np->cork.opt->opt_nflen = opt->opt_nflen;
1160
1161                         np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1162                                                             sk->sk_allocation);
1163                         if (opt->dst0opt && !np->cork.opt->dst0opt)
1164                                 return -ENOBUFS;
1165
1166                         np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1167                                                             sk->sk_allocation);
1168                         if (opt->dst1opt && !np->cork.opt->dst1opt)
1169                                 return -ENOBUFS;
1170
1171                         np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1172                                                            sk->sk_allocation);
1173                         if (opt->hopopt && !np->cork.opt->hopopt)
1174                                 return -ENOBUFS;
1175
1176                         np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1177                                                             sk->sk_allocation);
1178                         if (opt->srcrt && !np->cork.opt->srcrt)
1179                                 return -ENOBUFS;
1180
1181                         /* need source address above miyazawa*/
1182                 }
1183                 dst_hold(&rt->dst);
1184                 cork->dst = &rt->dst;
1185                 inet->cork.fl.u.ip6 = *fl6;
1186                 np->cork.hop_limit = hlimit;
1187                 np->cork.tclass = tclass;
1188                 if (rt->dst.flags & DST_XFRM_TUNNEL)
1189                         mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1190                               rt->dst.dev->mtu : dst_mtu(&rt->dst);
1191                 else
1192                         mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
1193                               rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1194                 if (np->frag_size < mtu) {
1195                         if (np->frag_size)
1196                                 mtu = np->frag_size;
1197                 }
1198                 cork->fragsize = mtu;
1199                 if (dst_allfrag(rt->dst.path))
1200                         cork->flags |= IPCORK_ALLFRAG;
1201                 cork->length = 0;
1202                 exthdrlen = (opt ? opt->opt_flen : 0);
1203                 length += exthdrlen;
1204                 transhdrlen += exthdrlen;
1205                 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1206         } else {
1207                 rt = (struct rt6_info *)cork->dst;
1208                 fl6 = &inet->cork.fl.u.ip6;
1209                 opt = np->cork.opt;
1210                 transhdrlen = 0;
1211                 exthdrlen = 0;
1212                 dst_exthdrlen = 0;
1213                 mtu = cork->fragsize;
1214         }
1215         orig_mtu = mtu;
1216
1217         hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1218
1219         fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1220                         (opt ? opt->opt_nflen : 0);
1221         maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
1222                      sizeof(struct frag_hdr);
1223
1224         if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1225                 unsigned int maxnonfragsize, headersize;
1226
1227                 headersize = sizeof(struct ipv6hdr) +
1228                              (opt ? opt->tot_len : 0) +
1229                              (dst_allfrag(&rt->dst) ?
1230                               sizeof(struct frag_hdr) : 0) +
1231                              rt->rt6i_nfheader_len;
1232
1233                 if (ip6_sk_local_df(sk))
1234                         maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
1235                 else
1236                         maxnonfragsize = mtu;
1237
1238                 /* dontfrag active */
1239                 if ((cork->length + length > mtu - headersize) && dontfrag &&
1240                     (sk->sk_protocol == IPPROTO_UDP ||
1241                      sk->sk_protocol == IPPROTO_RAW)) {
1242                         ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
1243                                                    sizeof(struct ipv6hdr));
1244                         goto emsgsize;
1245                 }
1246
1247                 if (cork->length + length > maxnonfragsize - headersize) {
1248 emsgsize:
1249                         ipv6_local_error(sk, EMSGSIZE, fl6,
1250                                          mtu - headersize +
1251                                          sizeof(struct ipv6hdr));
1252                         return -EMSGSIZE;
1253                 }
1254         }
1255
1256         /* For UDP, check if TX timestamp is enabled */
1257         if (sk->sk_type == SOCK_DGRAM)
1258                 sock_tx_timestamp(sk, &tx_flags);
1259
1260         /*
1261          * Let's try using as much space as possible.
1262          * Use MTU if total length of the message fits into the MTU.
1263          * Otherwise, we need to reserve fragment header and
1264          * fragment alignment (= 8-15 octects, in total).
1265          *
1266          * Note that we may need to "move" the data from the tail of
1267          * of the buffer to the new fragment when we split
1268          * the message.
1269          *
1270          * FIXME: It may be fragmented into multiple chunks
1271          *        at once if non-fragmentable extension headers
1272          *        are too large.
1273          * --yoshfuji
1274          */
1275
1276         skb = skb_peek_tail(&sk->sk_write_queue);
1277         cork->length += length;
1278         if (((length > mtu) ||
1279              (skb && skb_is_gso(skb))) &&
1280             (sk->sk_protocol == IPPROTO_UDP) &&
1281             (rt->dst.dev->features & NETIF_F_UFO)) {
1282                 err = ip6_ufo_append_data(sk, getfrag, from, length,
1283                                           hh_len, fragheaderlen,
1284                                           transhdrlen, mtu, flags, rt);
1285                 if (err)
1286                         goto error;
1287                 return 0;
1288         }
1289
1290         if (!skb)
1291                 goto alloc_new_skb;
1292
1293         while (length > 0) {
1294                 /* Check if the remaining data fits into current packet. */
1295                 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1296                 if (copy < length)
1297                         copy = maxfraglen - skb->len;
1298
1299                 if (copy <= 0) {
1300                         char *data;
1301                         unsigned int datalen;
1302                         unsigned int fraglen;
1303                         unsigned int fraggap;
1304                         unsigned int alloclen;
1305 alloc_new_skb:
1306                         /* There's no room in the current skb */
1307                         if (skb)
1308                                 fraggap = skb->len - maxfraglen;
1309                         else
1310                                 fraggap = 0;
1311                         /* update mtu and maxfraglen if necessary */
1312                         if (skb == NULL || skb_prev == NULL)
1313                                 ip6_append_data_mtu(&mtu, &maxfraglen,
1314                                                     fragheaderlen, skb, rt,
1315                                                     orig_mtu);
1316
1317                         skb_prev = skb;
1318
1319                         /*
1320                          * If remaining data exceeds the mtu,
1321                          * we know we need more fragment(s).
1322                          */
1323                         datalen = length + fraggap;
1324
1325                         if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1326                                 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1327                         if ((flags & MSG_MORE) &&
1328                             !(rt->dst.dev->features&NETIF_F_SG))
1329                                 alloclen = mtu;
1330                         else
1331                                 alloclen = datalen + fragheaderlen;
1332
1333                         alloclen += dst_exthdrlen;
1334
1335                         if (datalen != length + fraggap) {
1336                                 /*
1337                                  * this is not the last fragment, the trailer
1338                                  * space is regarded as data space.
1339                                  */
1340                                 datalen += rt->dst.trailer_len;
1341                         }
1342
1343                         alloclen += rt->dst.trailer_len;
1344                         fraglen = datalen + fragheaderlen;
1345
1346                         /*
1347                          * We just reserve space for fragment header.
1348                          * Note: this may be overallocation if the message
1349                          * (without MSG_MORE) fits into the MTU.
1350                          */
1351                         alloclen += sizeof(struct frag_hdr);
1352
1353                         if (transhdrlen) {
1354                                 skb = sock_alloc_send_skb(sk,
1355                                                 alloclen + hh_len,
1356                                                 (flags & MSG_DONTWAIT), &err);
1357                         } else {
1358                                 skb = NULL;
1359                                 if (atomic_read(&sk->sk_wmem_alloc) <=
1360                                     2 * sk->sk_sndbuf)
1361                                         skb = sock_wmalloc(sk,
1362                                                            alloclen + hh_len, 1,
1363                                                            sk->sk_allocation);
1364                                 if (unlikely(skb == NULL))
1365                                         err = -ENOBUFS;
1366                                 else {
1367                                         /* Only the initial fragment
1368                                          * is time stamped.
1369                                          */
1370                                         tx_flags = 0;
1371                                 }
1372                         }
1373                         if (skb == NULL)
1374                                 goto error;
1375                         /*
1376                          *      Fill in the control structures
1377                          */
1378                         skb->protocol = htons(ETH_P_IPV6);
1379                         skb->ip_summed = CHECKSUM_NONE;
1380                         skb->csum = 0;
1381                         /* reserve for fragmentation and ipsec header */
1382                         skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1383                                     dst_exthdrlen);
1384
1385                         if (sk->sk_type == SOCK_DGRAM)
1386                                 skb_shinfo(skb)->tx_flags = tx_flags;
1387
1388                         /*
1389                          *      Find where to start putting bytes
1390                          */
1391                         data = skb_put(skb, fraglen);
1392                         skb_set_network_header(skb, exthdrlen);
1393                         data += fragheaderlen;
1394                         skb->transport_header = (skb->network_header +
1395                                                  fragheaderlen);
1396                         if (fraggap) {
1397                                 skb->csum = skb_copy_and_csum_bits(
1398                                         skb_prev, maxfraglen,
1399                                         data + transhdrlen, fraggap, 0);
1400                                 skb_prev->csum = csum_sub(skb_prev->csum,
1401                                                           skb->csum);
1402                                 data += fraggap;
1403                                 pskb_trim_unique(skb_prev, maxfraglen);
1404                         }
1405                         copy = datalen - transhdrlen - fraggap;
1406
1407                         if (copy < 0) {
1408                                 err = -EINVAL;
1409                                 kfree_skb(skb);
1410                                 goto error;
1411                         } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) {
1412                                 err = -EFAULT;
1413                                 kfree_skb(skb);
1414                                 goto error;
1415                         }
1416
1417                         offset += copy;
1418                         length -= datalen - fraggap;
1419                         transhdrlen = 0;
1420                         exthdrlen = 0;
1421                         dst_exthdrlen = 0;
1422
1423                         /*
1424                          * Put the packet on the pending queue
1425                          */
1426                         __skb_queue_tail(&sk->sk_write_queue, skb);
1427                         continue;
1428                 }
1429
1430                 if (copy > length)
1431                         copy = length;
1432
1433                 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1434                         unsigned int off;
1435
1436                         off = skb->len;
1437                         if (getfrag(from, skb_put(skb, copy),
1438                                                 offset, copy, off, skb) < 0) {
1439                                 __skb_trim(skb, off);
1440                                 err = -EFAULT;
1441                                 goto error;
1442                         }
1443                 } else {
1444                         int i = skb_shinfo(skb)->nr_frags;
1445                         struct page_frag *pfrag = sk_page_frag(sk);
1446
1447                         err = -ENOMEM;
1448                         if (!sk_page_frag_refill(sk, pfrag))
1449                                 goto error;
1450
1451                         if (!skb_can_coalesce(skb, i, pfrag->page,
1452                                               pfrag->offset)) {
1453                                 err = -EMSGSIZE;
1454                                 if (i == MAX_SKB_FRAGS)
1455                                         goto error;
1456
1457                                 __skb_fill_page_desc(skb, i, pfrag->page,
1458                                                      pfrag->offset, 0);
1459                                 skb_shinfo(skb)->nr_frags = ++i;
1460                                 get_page(pfrag->page);
1461                         }
1462                         copy = min_t(int, copy, pfrag->size - pfrag->offset);
1463                         if (getfrag(from,
1464                                     page_address(pfrag->page) + pfrag->offset,
1465                                     offset, copy, skb->len, skb) < 0)
1466                                 goto error_efault;
1467
1468                         pfrag->offset += copy;
1469                         skb_frag_size_add(&skb_shinfo(skb)->frags[i - 1], copy);
1470                         skb->len += copy;
1471                         skb->data_len += copy;
1472                         skb->truesize += copy;
1473                         atomic_add(copy, &sk->sk_wmem_alloc);
1474                 }
1475                 offset += copy;
1476                 length -= copy;
1477         }
1478
1479         return 0;
1480
1481 error_efault:
1482         err = -EFAULT;
1483 error:
1484         cork->length -= length;
1485         IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1486         return err;
1487 }
1488 EXPORT_SYMBOL_GPL(ip6_append_data);
1489
1490 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1491 {
1492         if (np->cork.opt) {
1493                 kfree(np->cork.opt->dst0opt);
1494                 kfree(np->cork.opt->dst1opt);
1495                 kfree(np->cork.opt->hopopt);
1496                 kfree(np->cork.opt->srcrt);
1497                 kfree(np->cork.opt);
1498                 np->cork.opt = NULL;
1499         }
1500
1501         if (inet->cork.base.dst) {
1502                 dst_release(inet->cork.base.dst);
1503                 inet->cork.base.dst = NULL;
1504                 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1505         }
1506         memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1507 }
1508
1509 int ip6_push_pending_frames(struct sock *sk)
1510 {
1511         struct sk_buff *skb, *tmp_skb;
1512         struct sk_buff **tail_skb;
1513         struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1514         struct inet_sock *inet = inet_sk(sk);
1515         struct ipv6_pinfo *np = inet6_sk(sk);
1516         struct net *net = sock_net(sk);
1517         struct ipv6hdr *hdr;
1518         struct ipv6_txoptions *opt = np->cork.opt;
1519         struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1520         struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1521         unsigned char proto = fl6->flowi6_proto;
1522         int err = 0;
1523
1524         if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1525                 goto out;
1526         tail_skb = &(skb_shinfo(skb)->frag_list);
1527
1528         /* move skb->data to ip header from ext header */
1529         if (skb->data < skb_network_header(skb))
1530                 __skb_pull(skb, skb_network_offset(skb));
1531         while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1532                 __skb_pull(tmp_skb, skb_network_header_len(skb));
1533                 *tail_skb = tmp_skb;
1534                 tail_skb = &(tmp_skb->next);
1535                 skb->len += tmp_skb->len;
1536                 skb->data_len += tmp_skb->len;
1537                 skb->truesize += tmp_skb->truesize;
1538                 tmp_skb->destructor = NULL;
1539                 tmp_skb->sk = NULL;
1540         }
1541
1542         /* Allow local fragmentation. */
1543         skb->local_df = ip6_sk_local_df(sk);
1544
1545         *final_dst = fl6->daddr;
1546         __skb_pull(skb, skb_network_header_len(skb));
1547         if (opt && opt->opt_flen)
1548                 ipv6_push_frag_opts(skb, opt, &proto);
1549         if (opt && opt->opt_nflen)
1550                 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1551
1552         skb_push(skb, sizeof(struct ipv6hdr));
1553         skb_reset_network_header(skb);
1554         hdr = ipv6_hdr(skb);
1555
1556         ip6_flow_hdr(hdr, np->cork.tclass, fl6->flowlabel);
1557         hdr->hop_limit = np->cork.hop_limit;
1558         hdr->nexthdr = proto;
1559         hdr->saddr = fl6->saddr;
1560         hdr->daddr = *final_dst;
1561
1562         skb->priority = sk->sk_priority;
1563         skb->mark = sk->sk_mark;
1564
1565         skb_dst_set(skb, dst_clone(&rt->dst));
1566         IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1567         if (proto == IPPROTO_ICMPV6) {
1568                 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1569
1570                 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
1571                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1572         }
1573
1574         err = ip6_local_out(skb);
1575         if (err) {
1576                 if (err > 0)
1577                         err = net_xmit_errno(err);
1578                 if (err)
1579                         goto error;
1580         }
1581
1582 out:
1583         ip6_cork_release(inet, np);
1584         return err;
1585 error:
1586         IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1587         goto out;
1588 }
1589 EXPORT_SYMBOL_GPL(ip6_push_pending_frames);
1590
1591 void ip6_flush_pending_frames(struct sock *sk)
1592 {
1593         struct sk_buff *skb;
1594
1595         while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1596                 if (skb_dst(skb))
1597                         IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1598                                       IPSTATS_MIB_OUTDISCARDS);
1599                 kfree_skb(skb);
1600         }
1601
1602         ip6_cork_release(inet_sk(sk), inet6_sk(sk));
1603 }
1604 EXPORT_SYMBOL_GPL(ip6_flush_pending_frames);