4 * An implementation of the DCCP protocol
5 * Arnaldo Carvalho de Melo <acme@conectiva.com.br>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License
9 * as published by the Free Software Foundation; either version
10 * 2 of the License, or (at your option) any later version.
13 #include <linux/dccp.h>
14 #include <linux/kernel.h>
15 #include <linux/skbuff.h>
16 #include <linux/slab.h>
18 #include <net/inet_sock.h>
25 static inline void dccp_event_ack_sent(struct sock *sk)
27 inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
30 static void dccp_skb_entail(struct sock *sk, struct sk_buff *skb)
32 skb_set_owner_w(skb, sk);
33 WARN_ON(sk->sk_send_head);
34 sk->sk_send_head = skb;
38 * All SKB's seen here are completely headerless. It is our
39 * job to build the DCCP header, and pass the packet down to
40 * IP so it can do the same plus pass the packet off to the
43 static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
45 if (likely(skb != NULL)) {
46 const struct inet_sock *inet = inet_sk(sk);
47 const struct inet_connection_sock *icsk = inet_csk(sk);
48 struct dccp_sock *dp = dccp_sk(sk);
49 struct dccp_skb_cb *dcb = DCCP_SKB_CB(skb);
51 /* XXX For now we're using only 48 bits sequence numbers */
52 const u32 dccp_header_size = sizeof(*dh) +
53 sizeof(struct dccp_hdr_ext) +
54 dccp_packet_hdr_len(dcb->dccpd_type);
56 u64 ackno = dp->dccps_gsr;
58 * Increment GSS here already in case the option code needs it.
59 * Update GSS for real only if option processing below succeeds.
61 dcb->dccpd_seq = ADD48(dp->dccps_gss, 1);
63 switch (dcb->dccpd_type) {
67 case DCCP_PKT_DATAACK:
71 case DCCP_PKT_REQUEST:
73 /* Use ISS on the first (non-retransmitted) Request. */
74 if (icsk->icsk_retransmits == 0)
75 dcb->dccpd_seq = dp->dccps_iss;
79 case DCCP_PKT_SYNCACK:
80 ackno = dcb->dccpd_ack_seq;
84 * Set owner/destructor: some skbs are allocated via
85 * alloc_skb (e.g. when retransmission may happen).
86 * Only Data, DataAck, and Reset packets should come
87 * through here with skb->sk set.
90 skb_set_owner_w(skb, sk);
94 if (dccp_insert_options(sk, skb)) {
100 /* Build DCCP header and checksum it. */
101 dh = dccp_zeroed_hdr(skb, dccp_header_size);
102 dh->dccph_type = dcb->dccpd_type;
103 dh->dccph_sport = inet->inet_sport;
104 dh->dccph_dport = inet->inet_dport;
105 dh->dccph_doff = (dccp_header_size + dcb->dccpd_opt_len) / 4;
106 dh->dccph_ccval = dcb->dccpd_ccval;
107 dh->dccph_cscov = dp->dccps_pcslen;
108 /* XXX For now we're using only 48 bits sequence numbers */
111 dccp_update_gss(sk, dcb->dccpd_seq);
112 dccp_hdr_set_seq(dh, dp->dccps_gss);
114 dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), ackno);
116 switch (dcb->dccpd_type) {
117 case DCCP_PKT_REQUEST:
118 dccp_hdr_request(skb)->dccph_req_service =
121 * Limit Ack window to ISS <= P.ackno <= GSS, so that
122 * only Responses to Requests we sent are considered.
124 dp->dccps_awl = dp->dccps_iss;
127 dccp_hdr_reset(skb)->dccph_reset_code =
128 dcb->dccpd_reset_code;
132 icsk->icsk_af_ops->send_check(sk, skb);
135 dccp_event_ack_sent(sk);
137 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
139 err = icsk->icsk_af_ops->queue_xmit(skb);
140 return net_xmit_eval(err);
146 * dccp_determine_ccmps - Find out about CCID-specfic packet-size limits
147 * We only consider the HC-sender CCID for setting the CCMPS (RFC 4340, 14.),
148 * since the RX CCID is restricted to feedback packets (Acks), which are small
149 * in comparison with the data traffic. A value of 0 means "no current CCMPS".
151 static u32 dccp_determine_ccmps(const struct dccp_sock *dp)
153 const struct ccid *tx_ccid = dp->dccps_hc_tx_ccid;
155 if (tx_ccid == NULL || tx_ccid->ccid_ops == NULL)
157 return tx_ccid->ccid_ops->ccid_ccmps;
160 unsigned int dccp_sync_mss(struct sock *sk, u32 pmtu)
162 struct inet_connection_sock *icsk = inet_csk(sk);
163 struct dccp_sock *dp = dccp_sk(sk);
164 u32 ccmps = dccp_determine_ccmps(dp);
165 u32 cur_mps = ccmps ? min(pmtu, ccmps) : pmtu;
167 /* Account for header lengths and IPv4/v6 option overhead */
168 cur_mps -= (icsk->icsk_af_ops->net_header_len + icsk->icsk_ext_hdr_len +
169 sizeof(struct dccp_hdr) + sizeof(struct dccp_hdr_ext));
172 * Leave enough headroom for common DCCP header options.
173 * This only considers options which may appear on DCCP-Data packets, as
174 * per table 3 in RFC 4340, 5.8. When running out of space for other
175 * options (eg. Ack Vector which can take up to 255 bytes), it is better
176 * to schedule a separate Ack. Thus we leave headroom for the following:
177 * - 1 byte for Slow Receiver (11.6)
178 * - 6 bytes for Timestamp (13.1)
179 * - 10 bytes for Timestamp Echo (13.3)
180 * - 8 bytes for NDP count (7.7, when activated)
181 * - 6 bytes for Data Checksum (9.3)
182 * - %DCCPAV_MIN_OPTLEN bytes for Ack Vector size (11.4, when enabled)
184 cur_mps -= roundup(1 + 6 + 10 + dp->dccps_send_ndp_count * 8 + 6 +
185 (dp->dccps_hc_rx_ackvec ? DCCPAV_MIN_OPTLEN : 0), 4);
187 /* And store cached results */
188 icsk->icsk_pmtu_cookie = pmtu;
189 dp->dccps_mss_cache = cur_mps;
194 EXPORT_SYMBOL_GPL(dccp_sync_mss);
196 void dccp_write_space(struct sock *sk)
198 struct socket_wq *wq;
201 wq = rcu_dereference(sk->sk_wq);
202 if (wq_has_sleeper(wq))
203 wake_up_interruptible(&wq->wait);
204 /* Should agree with poll, otherwise some programs break */
205 if (sock_writeable(sk))
206 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
212 * dccp_wait_for_ccid - Await CCID send permission
213 * @sk: socket to wait for
214 * @delay: timeout in jiffies
215 * This is used by CCIDs which need to delay the send time in process context.
217 static int dccp_wait_for_ccid(struct sock *sk, unsigned long delay)
222 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
223 sk->sk_write_pending++;
226 remaining = schedule_timeout(delay);
229 sk->sk_write_pending--;
230 finish_wait(sk_sleep(sk), &wait);
232 if (signal_pending(current) || sk->sk_err)
238 * dccp_xmit_packet - Send data packet under control of CCID
239 * Transmits next-queued payload and informs CCID to account for the packet.
241 static void dccp_xmit_packet(struct sock *sk)
244 struct dccp_sock *dp = dccp_sk(sk);
245 struct sk_buff *skb = dccp_qpolicy_pop(sk);
247 if (unlikely(skb == NULL))
251 if (sk->sk_state == DCCP_PARTOPEN) {
252 const u32 cur_mps = dp->dccps_mss_cache - DCCP_FEATNEG_OVERHEAD;
254 * See 8.1.5 - Handshake Completion.
256 * For robustness we resend Confirm options until the client has
257 * entered OPEN. During the initial feature negotiation, the MPS
258 * is smaller than usual, reduced by the Change/Confirm options.
260 if (!list_empty(&dp->dccps_featneg) && len > cur_mps) {
261 DCCP_WARN("Payload too large (%d) for featneg.\n", len);
263 dccp_feat_list_purge(&dp->dccps_featneg);
266 inet_csk_schedule_ack(sk);
267 inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
268 inet_csk(sk)->icsk_rto,
270 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_DATAACK;
271 } else if (dccp_ack_pending(sk)) {
272 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_DATAACK;
274 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_DATA;
277 err = dccp_transmit_skb(sk, skb);
279 dccp_pr_debug("transmit_skb() returned err=%d\n", err);
281 * Register this one as sent even if an error occurred. To the remote
282 * end a local packet drop is indistinguishable from network loss, i.e.
283 * any local drop will eventually be reported via receiver feedback.
285 ccid_hc_tx_packet_sent(dp->dccps_hc_tx_ccid, sk, len);
288 * If the CCID needs to transfer additional header options out-of-band
289 * (e.g. Ack Vectors or feature-negotiation options), it activates this
290 * flag to schedule a Sync. The Sync will automatically incorporate all
291 * currently pending header options, thus clearing the backlog.
293 if (dp->dccps_sync_scheduled)
294 dccp_send_sync(sk, dp->dccps_gsr, DCCP_PKT_SYNC);
298 * dccp_flush_write_queue - Drain queue at end of connection
299 * Since dccp_sendmsg queues packets without waiting for them to be sent, it may
300 * happen that the TX queue is not empty at the end of a connection. We give the
301 * HC-sender CCID a grace period of up to @time_budget jiffies. If this function
302 * returns with a non-empty write queue, it will be purged later.
304 void dccp_flush_write_queue(struct sock *sk, long *time_budget)
306 struct dccp_sock *dp = dccp_sk(sk);
310 while (*time_budget > 0 && (skb = skb_peek(&sk->sk_write_queue))) {
311 rc = ccid_hc_tx_send_packet(dp->dccps_hc_tx_ccid, sk, skb);
313 switch (ccid_packet_dequeue_eval(rc)) {
314 case CCID_PACKET_WILL_DEQUEUE_LATER:
316 * If the CCID determines when to send, the next sending
317 * time is unknown or the CCID may not even send again
318 * (e.g. remote host crashes or lost Ack packets).
320 DCCP_WARN("CCID did not manage to send all packets\n");
322 case CCID_PACKET_DELAY:
323 delay = msecs_to_jiffies(rc);
324 if (delay > *time_budget)
326 rc = dccp_wait_for_ccid(sk, delay);
329 *time_budget -= (delay - rc);
330 /* check again if we can send now */
332 case CCID_PACKET_SEND_AT_ONCE:
333 dccp_xmit_packet(sk);
335 case CCID_PACKET_ERR:
336 skb_dequeue(&sk->sk_write_queue);
338 dccp_pr_debug("packet discarded due to err=%ld\n", rc);
343 void dccp_write_xmit(struct sock *sk)
345 struct dccp_sock *dp = dccp_sk(sk);
348 while ((skb = dccp_qpolicy_top(sk))) {
349 int rc = ccid_hc_tx_send_packet(dp->dccps_hc_tx_ccid, sk, skb);
351 switch (ccid_packet_dequeue_eval(rc)) {
352 case CCID_PACKET_WILL_DEQUEUE_LATER:
354 case CCID_PACKET_DELAY:
355 sk_reset_timer(sk, &dp->dccps_xmit_timer,
356 jiffies + msecs_to_jiffies(rc));
358 case CCID_PACKET_SEND_AT_ONCE:
359 dccp_xmit_packet(sk);
361 case CCID_PACKET_ERR:
362 dccp_qpolicy_drop(sk, skb);
363 dccp_pr_debug("packet discarded due to err=%d\n", rc);
369 * dccp_retransmit_skb - Retransmit Request, Close, or CloseReq packets
370 * There are only four retransmittable packet types in DCCP:
371 * - Request in client-REQUEST state (sec. 8.1.1),
372 * - CloseReq in server-CLOSEREQ state (sec. 8.3),
373 * - Close in node-CLOSING state (sec. 8.3),
374 * - Acks in client-PARTOPEN state (sec. 8.1.5, handled by dccp_delack_timer()).
375 * This function expects sk->sk_send_head to contain the original skb.
377 int dccp_retransmit_skb(struct sock *sk)
379 WARN_ON(sk->sk_send_head == NULL);
381 if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk) != 0)
382 return -EHOSTUNREACH; /* Routing failure or similar. */
384 /* this count is used to distinguish original and retransmitted skb */
385 inet_csk(sk)->icsk_retransmits++;
387 return dccp_transmit_skb(sk, skb_clone(sk->sk_send_head, GFP_ATOMIC));
390 struct sk_buff *dccp_make_response(struct sock *sk, struct dst_entry *dst,
391 struct request_sock *req)
394 struct dccp_request_sock *dreq;
395 const u32 dccp_header_size = sizeof(struct dccp_hdr) +
396 sizeof(struct dccp_hdr_ext) +
397 sizeof(struct dccp_hdr_response);
398 struct sk_buff *skb = sock_wmalloc(sk, sk->sk_prot->max_header, 1,
403 /* Reserve space for headers. */
404 skb_reserve(skb, sk->sk_prot->max_header);
406 skb_dst_set(skb, dst_clone(dst));
408 dreq = dccp_rsk(req);
409 if (inet_rsk(req)->acked) /* increase ISS upon retransmission */
410 dccp_inc_seqno(&dreq->dreq_iss);
411 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_RESPONSE;
412 DCCP_SKB_CB(skb)->dccpd_seq = dreq->dreq_iss;
414 /* Resolve feature dependencies resulting from choice of CCID */
415 if (dccp_feat_server_ccid_dependencies(dreq))
416 goto response_failed;
418 if (dccp_insert_options_rsk(dreq, skb))
419 goto response_failed;
421 /* Build and checksum header */
422 dh = dccp_zeroed_hdr(skb, dccp_header_size);
424 dh->dccph_sport = inet_rsk(req)->loc_port;
425 dh->dccph_dport = inet_rsk(req)->rmt_port;
426 dh->dccph_doff = (dccp_header_size +
427 DCCP_SKB_CB(skb)->dccpd_opt_len) / 4;
428 dh->dccph_type = DCCP_PKT_RESPONSE;
430 dccp_hdr_set_seq(dh, dreq->dreq_iss);
431 dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dreq->dreq_isr);
432 dccp_hdr_response(skb)->dccph_resp_service = dreq->dreq_service;
434 dccp_csum_outgoing(skb);
436 /* We use `acked' to remember that a Response was already sent. */
437 inet_rsk(req)->acked = 1;
438 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
445 EXPORT_SYMBOL_GPL(dccp_make_response);
447 /* answer offending packet in @rcv_skb with Reset from control socket @ctl */
448 struct sk_buff *dccp_ctl_make_reset(struct sock *sk, struct sk_buff *rcv_skb)
450 struct dccp_hdr *rxdh = dccp_hdr(rcv_skb), *dh;
451 struct dccp_skb_cb *dcb = DCCP_SKB_CB(rcv_skb);
452 const u32 dccp_hdr_reset_len = sizeof(struct dccp_hdr) +
453 sizeof(struct dccp_hdr_ext) +
454 sizeof(struct dccp_hdr_reset);
455 struct dccp_hdr_reset *dhr;
458 skb = alloc_skb(sk->sk_prot->max_header, GFP_ATOMIC);
462 skb_reserve(skb, sk->sk_prot->max_header);
464 /* Swap the send and the receive. */
465 dh = dccp_zeroed_hdr(skb, dccp_hdr_reset_len);
466 dh->dccph_type = DCCP_PKT_RESET;
467 dh->dccph_sport = rxdh->dccph_dport;
468 dh->dccph_dport = rxdh->dccph_sport;
469 dh->dccph_doff = dccp_hdr_reset_len / 4;
472 dhr = dccp_hdr_reset(skb);
473 dhr->dccph_reset_code = dcb->dccpd_reset_code;
475 switch (dcb->dccpd_reset_code) {
476 case DCCP_RESET_CODE_PACKET_ERROR:
477 dhr->dccph_reset_data[0] = rxdh->dccph_type;
479 case DCCP_RESET_CODE_OPTION_ERROR: /* fall through */
480 case DCCP_RESET_CODE_MANDATORY_ERROR:
481 memcpy(dhr->dccph_reset_data, dcb->dccpd_reset_data, 3);
485 * From RFC 4340, 8.3.1:
486 * If P.ackno exists, set R.seqno := P.ackno + 1.
487 * Else set R.seqno := 0.
489 if (dcb->dccpd_ack_seq != DCCP_PKT_WITHOUT_ACK_SEQ)
490 dccp_hdr_set_seq(dh, ADD48(dcb->dccpd_ack_seq, 1));
491 dccp_hdr_set_ack(dccp_hdr_ack_bits(skb), dcb->dccpd_seq);
493 dccp_csum_outgoing(skb);
497 EXPORT_SYMBOL_GPL(dccp_ctl_make_reset);
499 /* send Reset on established socket, to close or abort the connection */
500 int dccp_send_reset(struct sock *sk, enum dccp_reset_codes code)
504 * FIXME: what if rebuild_header fails?
505 * Should we be doing a rebuild_header here?
507 int err = inet_csk(sk)->icsk_af_ops->rebuild_header(sk);
512 skb = sock_wmalloc(sk, sk->sk_prot->max_header, 1, GFP_ATOMIC);
516 /* Reserve space for headers and prepare control bits. */
517 skb_reserve(skb, sk->sk_prot->max_header);
518 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_RESET;
519 DCCP_SKB_CB(skb)->dccpd_reset_code = code;
521 return dccp_transmit_skb(sk, skb);
525 * Do all connect socket setups that can be done AF independent.
527 int dccp_connect(struct sock *sk)
530 struct dccp_sock *dp = dccp_sk(sk);
531 struct dst_entry *dst = __sk_dst_get(sk);
532 struct inet_connection_sock *icsk = inet_csk(sk);
535 sock_reset_flag(sk, SOCK_DONE);
537 dccp_sync_mss(sk, dst_mtu(dst));
539 /* do not connect if feature negotiation setup fails */
540 if (dccp_feat_finalise_settings(dccp_sk(sk)))
543 /* Initialise GAR as per 8.5; AWL/AWH are set in dccp_transmit_skb() */
544 dp->dccps_gar = dp->dccps_iss;
546 skb = alloc_skb(sk->sk_prot->max_header, sk->sk_allocation);
547 if (unlikely(skb == NULL))
550 /* Reserve space for headers. */
551 skb_reserve(skb, sk->sk_prot->max_header);
553 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_REQUEST;
555 dccp_skb_entail(sk, skb);
556 dccp_transmit_skb(sk, skb_clone(skb, GFP_KERNEL));
557 DCCP_INC_STATS(DCCP_MIB_ACTIVEOPENS);
559 /* Timer for repeating the REQUEST until an answer. */
560 icsk->icsk_retransmits = 0;
561 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
562 icsk->icsk_rto, DCCP_RTO_MAX);
566 EXPORT_SYMBOL_GPL(dccp_connect);
568 void dccp_send_ack(struct sock *sk)
570 /* If we have been reset, we may not send again. */
571 if (sk->sk_state != DCCP_CLOSED) {
572 struct sk_buff *skb = alloc_skb(sk->sk_prot->max_header,
576 inet_csk_schedule_ack(sk);
577 inet_csk(sk)->icsk_ack.ato = TCP_ATO_MIN;
578 inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
584 /* Reserve space for headers */
585 skb_reserve(skb, sk->sk_prot->max_header);
586 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_ACK;
587 dccp_transmit_skb(sk, skb);
591 EXPORT_SYMBOL_GPL(dccp_send_ack);
594 /* FIXME: Is this still necessary (11.3) - currently nowhere used by DCCP. */
595 void dccp_send_delayed_ack(struct sock *sk)
597 struct inet_connection_sock *icsk = inet_csk(sk);
599 * FIXME: tune this timer. elapsed time fixes the skew, so no problem
600 * with using 2s, and active senders also piggyback the ACK into a
601 * DATAACK packet, so this is really for quiescent senders.
603 unsigned long timeout = jiffies + 2 * HZ;
605 /* Use new timeout only if there wasn't a older one earlier. */
606 if (icsk->icsk_ack.pending & ICSK_ACK_TIMER) {
607 /* If delack timer was blocked or is about to expire,
610 * FIXME: check the "about to expire" part
612 if (icsk->icsk_ack.blocked) {
617 if (!time_before(timeout, icsk->icsk_ack.timeout))
618 timeout = icsk->icsk_ack.timeout;
620 icsk->icsk_ack.pending |= ICSK_ACK_SCHED | ICSK_ACK_TIMER;
621 icsk->icsk_ack.timeout = timeout;
622 sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
626 void dccp_send_sync(struct sock *sk, const u64 ackno,
627 const enum dccp_pkt_type pkt_type)
630 * We are not putting this on the write queue, so
631 * dccp_transmit_skb() will set the ownership to this
634 struct sk_buff *skb = alloc_skb(sk->sk_prot->max_header, GFP_ATOMIC);
637 /* FIXME: how to make sure the sync is sent? */
638 DCCP_CRIT("could not send %s", dccp_packet_name(pkt_type));
642 /* Reserve space for headers and prepare control bits. */
643 skb_reserve(skb, sk->sk_prot->max_header);
644 DCCP_SKB_CB(skb)->dccpd_type = pkt_type;
645 DCCP_SKB_CB(skb)->dccpd_ack_seq = ackno;
648 * Clear the flag in case the Sync was scheduled for out-of-band data,
649 * such as carrying a long Ack Vector.
651 dccp_sk(sk)->dccps_sync_scheduled = 0;
653 dccp_transmit_skb(sk, skb);
656 EXPORT_SYMBOL_GPL(dccp_send_sync);
659 * Send a DCCP_PKT_CLOSE/CLOSEREQ. The caller locks the socket for us. This
660 * cannot be allowed to fail queueing a DCCP_PKT_CLOSE/CLOSEREQ frame under
663 void dccp_send_close(struct sock *sk, const int active)
665 struct dccp_sock *dp = dccp_sk(sk);
667 const gfp_t prio = active ? GFP_KERNEL : GFP_ATOMIC;
669 skb = alloc_skb(sk->sk_prot->max_header, prio);
673 /* Reserve space for headers and prepare control bits. */
674 skb_reserve(skb, sk->sk_prot->max_header);
675 if (dp->dccps_role == DCCP_ROLE_SERVER && !dp->dccps_server_timewait)
676 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_CLOSEREQ;
678 DCCP_SKB_CB(skb)->dccpd_type = DCCP_PKT_CLOSE;
681 dccp_skb_entail(sk, skb);
682 dccp_transmit_skb(sk, skb_clone(skb, prio));
684 * Retransmission timer for active-close: RFC 4340, 8.3 requires
685 * to retransmit the Close/CloseReq until the CLOSING/CLOSEREQ
686 * state can be left. The initial timeout is 2 RTTs.
687 * Since RTT measurement is done by the CCIDs, there is no easy
688 * way to get an RTT sample. The fallback RTT from RFC 4340, 3.4
689 * is too low (200ms); we use a high value to avoid unnecessary
690 * retransmissions when the link RTT is > 0.2 seconds.
691 * FIXME: Let main module sample RTTs and use that instead.
693 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
694 DCCP_TIMEOUT_INIT, DCCP_RTO_MAX);
696 dccp_transmit_skb(sk, skb);