2 * IPv6 output functions
3 * Linux INET6 implementation
6 * Pedro Roque <roque@di.fc.ul.pt>
8 * Based on linux/net/ipv4/ip_output.c
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
16 * A.N.Kuznetsov : airthmetics in fragmentation.
17 * extension headers are implemented.
18 * route changes now work.
19 * ip6_forward does not confuse sniffers.
22 * H. von Brand : Added missing #include <linux/string.h>
23 * Imran Patel : frag id should be in NBO
24 * Kazunori MIYAZAWA @USAGI
25 * : add ip6_append_data and related functions
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/string.h>
32 #include <linux/socket.h>
33 #include <linux/net.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/in6.h>
37 #include <linux/tcp.h>
38 #include <linux/route.h>
39 #include <linux/module.h>
40 #include <linux/slab.h>
42 #include <linux/netfilter.h>
43 #include <linux/netfilter_ipv6.h>
49 #include <net/ndisc.h>
50 #include <net/protocol.h>
51 #include <net/ip6_route.h>
52 #include <net/addrconf.h>
53 #include <net/rawv6.h>
56 #include <net/checksum.h>
57 #include <linux/mroute6.h>
59 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
61 int __ip6_local_out(struct sk_buff *skb)
65 len = skb->len - sizeof(struct ipv6hdr);
66 if (len > IPV6_MAXPLEN)
68 ipv6_hdr(skb)->payload_len = htons(len);
70 return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
71 skb_dst(skb)->dev, dst_output);
74 int ip6_local_out(struct sk_buff *skb)
78 err = __ip6_local_out(skb);
80 err = dst_output(skb);
84 EXPORT_SYMBOL_GPL(ip6_local_out);
86 /* dev_loopback_xmit for use with netfilter. */
87 static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
89 skb_reset_mac_header(newskb);
90 __skb_pull(newskb, skb_network_offset(newskb));
91 newskb->pkt_type = PACKET_LOOPBACK;
92 newskb->ip_summed = CHECKSUM_UNNECESSARY;
93 WARN_ON(!skb_dst(newskb));
99 static int ip6_finish_output2(struct sk_buff *skb)
101 struct dst_entry *dst = skb_dst(skb);
102 struct net_device *dev = dst->dev;
103 struct neighbour *neigh;
105 skb->protocol = htons(ETH_P_IPV6);
108 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
109 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
111 if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
112 ((mroute6_socket(dev_net(dev), skb) &&
113 !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
114 ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
115 &ipv6_hdr(skb)->saddr))) {
116 struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
118 /* Do not check for IFF_ALLMULTI; multicast routing
119 is not supported in any case.
122 NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
123 newskb, NULL, newskb->dev,
124 ip6_dev_loopback_xmit);
126 if (ipv6_hdr(skb)->hop_limit == 0) {
127 IP6_INC_STATS(dev_net(dev), idev,
128 IPSTATS_MIB_OUTDISCARDS);
134 IP6_UPD_PO_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCAST,
139 neigh = dst_get_neighbour(dst);
141 int res = neigh_output(neigh, skb);
147 IP6_INC_STATS(dev_net(dst->dev),
148 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
153 static int ip6_finish_output(struct sk_buff *skb)
155 if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
156 dst_allfrag(skb_dst(skb)))
157 return ip6_fragment(skb, ip6_finish_output2);
159 return ip6_finish_output2(skb);
162 int ip6_output(struct sk_buff *skb)
164 struct net_device *dev = skb_dst(skb)->dev;
165 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
166 if (unlikely(idev->cnf.disable_ipv6)) {
167 IP6_INC_STATS(dev_net(dev), idev,
168 IPSTATS_MIB_OUTDISCARDS);
173 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, dev,
175 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
179 * xmit an sk_buff (used by TCP, SCTP and DCCP)
182 int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
183 struct ipv6_txoptions *opt, int tclass)
185 struct net *net = sock_net(sk);
186 struct ipv6_pinfo *np = inet6_sk(sk);
187 struct in6_addr *first_hop = &fl6->daddr;
188 struct dst_entry *dst = skb_dst(skb);
190 u8 proto = fl6->flowi6_proto;
191 int seg_len = skb->len;
196 unsigned int head_room;
198 /* First: exthdrs may take lots of space (~8K for now)
199 MAX_HEADER is not enough.
201 head_room = opt->opt_nflen + opt->opt_flen;
202 seg_len += head_room;
203 head_room += sizeof(struct ipv6hdr) + LL_RESERVED_SPACE(dst->dev);
205 if (skb_headroom(skb) < head_room) {
206 struct sk_buff *skb2 = skb_realloc_headroom(skb, head_room);
208 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
209 IPSTATS_MIB_OUTDISCARDS);
215 skb_set_owner_w(skb, sk);
218 ipv6_push_frag_opts(skb, opt, &proto);
220 ipv6_push_nfrag_opts(skb, opt, &proto, &first_hop);
223 skb_push(skb, sizeof(struct ipv6hdr));
224 skb_reset_network_header(skb);
228 * Fill in the IPv6 header
231 hlimit = np->hop_limit;
233 hlimit = ip6_dst_hoplimit(dst);
235 *(__be32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl6->flowlabel;
237 hdr->payload_len = htons(seg_len);
238 hdr->nexthdr = proto;
239 hdr->hop_limit = hlimit;
241 ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
242 ipv6_addr_copy(&hdr->daddr, first_hop);
244 skb->priority = sk->sk_priority;
245 skb->mark = sk->sk_mark;
248 if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
249 IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
250 IPSTATS_MIB_OUT, skb->len);
251 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
252 dst->dev, dst_output);
256 printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
258 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
259 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
264 EXPORT_SYMBOL(ip6_xmit);
267 * To avoid extra problems ND packets are send through this
268 * routine. It's code duplication but I really want to avoid
269 * extra checks since ipv6_build_header is used by TCP (which
270 * is for us performance critical)
273 int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
274 const struct in6_addr *saddr, const struct in6_addr *daddr,
277 struct ipv6_pinfo *np = inet6_sk(sk);
280 skb->protocol = htons(ETH_P_IPV6);
283 skb_reset_network_header(skb);
284 skb_put(skb, sizeof(struct ipv6hdr));
287 *(__be32*)hdr = htonl(0x60000000);
289 hdr->payload_len = htons(len);
290 hdr->nexthdr = proto;
291 hdr->hop_limit = np->hop_limit;
293 ipv6_addr_copy(&hdr->saddr, saddr);
294 ipv6_addr_copy(&hdr->daddr, daddr);
299 static int ip6_call_ra_chain(struct sk_buff *skb, int sel)
301 struct ip6_ra_chain *ra;
302 struct sock *last = NULL;
304 read_lock(&ip6_ra_lock);
305 for (ra = ip6_ra_chain; ra; ra = ra->next) {
306 struct sock *sk = ra->sk;
307 if (sk && ra->sel == sel &&
308 (!sk->sk_bound_dev_if ||
309 sk->sk_bound_dev_if == skb->dev->ifindex)) {
311 struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
313 rawv6_rcv(last, skb2);
320 rawv6_rcv(last, skb);
321 read_unlock(&ip6_ra_lock);
324 read_unlock(&ip6_ra_lock);
328 static int ip6_forward_proxy_check(struct sk_buff *skb)
330 struct ipv6hdr *hdr = ipv6_hdr(skb);
331 u8 nexthdr = hdr->nexthdr;
334 if (ipv6_ext_hdr(nexthdr)) {
335 offset = ipv6_skip_exthdr(skb, sizeof(*hdr), &nexthdr);
339 offset = sizeof(struct ipv6hdr);
341 if (nexthdr == IPPROTO_ICMPV6) {
342 struct icmp6hdr *icmp6;
344 if (!pskb_may_pull(skb, (skb_network_header(skb) +
345 offset + 1 - skb->data)))
348 icmp6 = (struct icmp6hdr *)(skb_network_header(skb) + offset);
350 switch (icmp6->icmp6_type) {
351 case NDISC_ROUTER_SOLICITATION:
352 case NDISC_ROUTER_ADVERTISEMENT:
353 case NDISC_NEIGHBOUR_SOLICITATION:
354 case NDISC_NEIGHBOUR_ADVERTISEMENT:
356 /* For reaction involving unicast neighbor discovery
357 * message destined to the proxied address, pass it to
367 * The proxying router can't forward traffic sent to a link-local
368 * address, so signal the sender and discard the packet. This
369 * behavior is clarified by the MIPv6 specification.
371 if (ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) {
372 dst_link_failure(skb);
379 static inline int ip6_forward_finish(struct sk_buff *skb)
381 return dst_output(skb);
384 int ip6_forward(struct sk_buff *skb)
386 struct dst_entry *dst = skb_dst(skb);
387 struct ipv6hdr *hdr = ipv6_hdr(skb);
388 struct inet6_skb_parm *opt = IP6CB(skb);
389 struct net *net = dev_net(dst->dev);
393 if (net->ipv6.devconf_all->forwarding == 0)
396 if (skb_warn_if_lro(skb))
399 if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
400 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
404 if (skb->pkt_type != PACKET_HOST)
407 skb_forward_csum(skb);
410 * We DO NOT make any processing on
411 * RA packets, pushing them to user level AS IS
412 * without ane WARRANTY that application will be able
413 * to interpret them. The reason is that we
414 * cannot make anything clever here.
416 * We are not end-node, so that if packet contains
417 * AH/ESP, we cannot make anything.
418 * Defragmentation also would be mistake, RA packets
419 * cannot be fragmented, because there is no warranty
420 * that different fragments will go along one path. --ANK
423 u8 *ptr = skb_network_header(skb) + opt->ra;
424 if (ip6_call_ra_chain(skb, (ptr[2]<<8) + ptr[3]))
429 * check and decrement ttl
431 if (hdr->hop_limit <= 1) {
432 /* Force OUTPUT device used as source address */
434 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
435 IP6_INC_STATS_BH(net,
436 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
442 /* XXX: idev->cnf.proxy_ndp? */
443 if (net->ipv6.devconf_all->proxy_ndp &&
444 pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
445 int proxied = ip6_forward_proxy_check(skb);
447 return ip6_input(skb);
448 else if (proxied < 0) {
449 IP6_INC_STATS(net, ip6_dst_idev(dst),
450 IPSTATS_MIB_INDISCARDS);
455 if (!xfrm6_route_forward(skb)) {
456 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
461 /* IPv6 specs say nothing about it, but it is clear that we cannot
462 send redirects to source routed frames.
463 We don't send redirects to frames decapsulated from IPsec.
465 n = dst_get_neighbour(dst);
466 if (skb->dev == dst->dev && n && opt->srcrt == 0 && !skb_sec_path(skb)) {
467 struct in6_addr *target = NULL;
471 * incoming and outgoing devices are the same
475 rt = (struct rt6_info *) dst;
476 if ((rt->rt6i_flags & RTF_GATEWAY))
477 target = (struct in6_addr*)&n->primary_key;
479 target = &hdr->daddr;
482 rt6_bind_peer(rt, 1);
484 /* Limit redirects both by destination (here)
485 and by source (inside ndisc_send_redirect)
487 if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
488 ndisc_send_redirect(skb, n, target);
490 int addrtype = ipv6_addr_type(&hdr->saddr);
492 /* This check is security critical. */
493 if (addrtype == IPV6_ADDR_ANY ||
494 addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
496 if (addrtype & IPV6_ADDR_LINKLOCAL) {
497 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
498 ICMPV6_NOT_NEIGHBOUR, 0);
504 if (mtu < IPV6_MIN_MTU)
507 if (skb->len > mtu && !skb_is_gso(skb)) {
508 /* Again, force OUTPUT device used as source address */
510 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
511 IP6_INC_STATS_BH(net,
512 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
513 IP6_INC_STATS_BH(net,
514 ip6_dst_idev(dst), IPSTATS_MIB_FRAGFAILS);
519 if (skb_cow(skb, dst->dev->hard_header_len)) {
520 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);
526 /* Mangling hops number delayed to point after skb COW */
530 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
531 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
535 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_INADDRERRORS);
541 static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
543 to->pkt_type = from->pkt_type;
544 to->priority = from->priority;
545 to->protocol = from->protocol;
547 skb_dst_set(to, dst_clone(skb_dst(from)));
549 to->mark = from->mark;
551 #ifdef CONFIG_NET_SCHED
552 to->tc_index = from->tc_index;
555 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
556 defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
557 to->nf_trace = from->nf_trace;
559 skb_copy_secmark(to, from);
562 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
564 unsigned int offset = sizeof(struct ipv6hdr);
565 unsigned int packet_len = skb->tail - skb->network_header;
567 *nexthdr = &ipv6_hdr(skb)->nexthdr;
569 while (offset <= packet_len) {
570 struct ipv6_opt_hdr *exthdr;
577 case NEXTHDR_ROUTING:
581 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
582 if (ipv6_find_tlv(skb, offset, IPV6_TLV_HAO) >= 0)
592 if (offset + sizeof(struct ipv6_opt_hdr) > packet_len)
595 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
597 len = ipv6_optlen(exthdr);
598 if (len + offset >= IPV6_MAXPLEN)
601 *nexthdr = &exthdr->nexthdr;
607 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
609 static u32 ip6_idents_hashrnd __read_mostly;
610 static bool hashrnd_initialized = false;
613 if (unlikely(!hashrnd_initialized)) {
614 hashrnd_initialized = true;
615 get_random_bytes(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
617 hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
618 hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
620 id = ip_idents_reserve(hash, 1);
621 fhdr->identification = htonl(id);
624 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
626 struct sk_buff *frag;
627 struct rt6_info *rt = (struct rt6_info*)skb_dst(skb);
628 struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
629 struct ipv6hdr *tmp_hdr;
631 unsigned int mtu, hlen, left, len;
634 int ptr, offset = 0, err=0;
635 u8 *prevhdr, nexthdr = 0;
636 struct net *net = dev_net(skb_dst(skb)->dev);
638 err = ip6_find_1stfragopt(skb, &prevhdr);
644 mtu = ip6_skb_dst_mtu(skb);
646 /* We must not fragment if the socket is set to force MTU discovery
647 * or if the skb it not generated by a local socket.
649 if (!skb->local_df && skb->len > mtu) {
650 skb->dev = skb_dst(skb)->dev;
651 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
652 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
653 IPSTATS_MIB_FRAGFAILS);
658 if (np && np->frag_size < mtu) {
662 mtu -= hlen + sizeof(struct frag_hdr);
664 if (skb_has_frag_list(skb)) {
665 int first_len = skb_pagelen(skb);
666 struct sk_buff *frag2;
668 if (first_len - hlen > mtu ||
669 ((first_len - hlen) & 7) ||
673 skb_walk_frags(skb, frag) {
674 /* Correct geometry. */
675 if (frag->len > mtu ||
676 ((frag->len & 7) && frag->next) ||
677 skb_headroom(frag) < hlen)
678 goto slow_path_clean;
680 /* Partially cloned skb? */
681 if (skb_shared(frag))
682 goto slow_path_clean;
687 frag->destructor = sock_wfree;
689 skb->truesize -= frag->truesize;
694 frag = skb_shinfo(skb)->frag_list;
695 skb_frag_list_init(skb);
698 *prevhdr = NEXTHDR_FRAGMENT;
699 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
701 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
702 IPSTATS_MIB_FRAGFAILS);
706 __skb_pull(skb, hlen);
707 fh = (struct frag_hdr*)__skb_push(skb, sizeof(struct frag_hdr));
708 __skb_push(skb, hlen);
709 skb_reset_network_header(skb);
710 memcpy(skb_network_header(skb), tmp_hdr, hlen);
712 ipv6_select_ident(fh, rt);
713 fh->nexthdr = nexthdr;
715 fh->frag_off = htons(IP6_MF);
716 frag_id = fh->identification;
718 first_len = skb_pagelen(skb);
719 skb->data_len = first_len - skb_headlen(skb);
720 skb->len = first_len;
721 ipv6_hdr(skb)->payload_len = htons(first_len -
722 sizeof(struct ipv6hdr));
727 /* Prepare header of the next frame,
728 * before previous one went down. */
730 frag->ip_summed = CHECKSUM_NONE;
731 skb_reset_transport_header(frag);
732 fh = (struct frag_hdr*)__skb_push(frag, sizeof(struct frag_hdr));
733 __skb_push(frag, hlen);
734 skb_reset_network_header(frag);
735 memcpy(skb_network_header(frag), tmp_hdr,
737 offset += skb->len - hlen - sizeof(struct frag_hdr);
738 fh->nexthdr = nexthdr;
740 fh->frag_off = htons(offset);
741 if (frag->next != NULL)
742 fh->frag_off |= htons(IP6_MF);
743 fh->identification = frag_id;
744 ipv6_hdr(frag)->payload_len =
746 sizeof(struct ipv6hdr));
747 ip6_copy_metadata(frag, skb);
752 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
753 IPSTATS_MIB_FRAGCREATES);
766 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
767 IPSTATS_MIB_FRAGOKS);
768 dst_release(&rt->dst);
778 IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
779 IPSTATS_MIB_FRAGFAILS);
780 dst_release(&rt->dst);
784 skb_walk_frags(skb, frag2) {
788 frag2->destructor = NULL;
789 skb->truesize += frag2->truesize;
794 left = skb->len - hlen; /* Space per frame */
795 ptr = hlen; /* Where to start from */
798 * Fragment the datagram.
801 *prevhdr = NEXTHDR_FRAGMENT;
802 hroom = LL_RESERVED_SPACE(rt->dst.dev);
803 troom = rt->dst.dev->needed_tailroom;
806 * Keep copying data until we run out.
810 /* IF: it doesn't fit, use 'mtu' - the data space left */
813 /* IF: we are not sending up to and including the packet end
814 then align the next start on an eight byte boundary */
822 if ((frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
823 hroom + troom, GFP_ATOMIC)) == NULL) {
824 NETDEBUG(KERN_INFO "IPv6: frag: no memory for new fragment!\n");
825 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
826 IPSTATS_MIB_FRAGFAILS);
832 * Set up data on packet
835 ip6_copy_metadata(frag, skb);
836 skb_reserve(frag, hroom);
837 skb_put(frag, len + hlen + sizeof(struct frag_hdr));
838 skb_reset_network_header(frag);
839 fh = (struct frag_hdr *)(skb_network_header(frag) + hlen);
840 frag->transport_header = (frag->network_header + hlen +
841 sizeof(struct frag_hdr));
844 * Charge the memory for the fragment to any owner
848 skb_set_owner_w(frag, skb->sk);
851 * Copy the packet header into the new buffer.
853 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
856 * Build fragment header.
858 fh->nexthdr = nexthdr;
861 ipv6_select_ident(fh, rt);
862 frag_id = fh->identification;
864 fh->identification = frag_id;
867 * Copy a block of the IP datagram.
869 if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
873 fh->frag_off = htons(offset);
875 fh->frag_off |= htons(IP6_MF);
876 ipv6_hdr(frag)->payload_len = htons(frag->len -
877 sizeof(struct ipv6hdr));
883 * Put this fragment into the sending queue.
889 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
890 IPSTATS_MIB_FRAGCREATES);
892 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
893 IPSTATS_MIB_FRAGOKS);
898 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
899 IPSTATS_MIB_FRAGFAILS);
904 static inline int ip6_rt_check(const struct rt6key *rt_key,
905 const struct in6_addr *fl_addr,
906 const struct in6_addr *addr_cache)
908 return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
909 (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
912 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
913 struct dst_entry *dst,
914 const struct flowi6 *fl6)
916 struct ipv6_pinfo *np = inet6_sk(sk);
922 if (dst->ops->family != AF_INET6) {
927 rt = (struct rt6_info *)dst;
928 /* Yes, checking route validity in not connected
929 * case is not very simple. Take into account,
930 * that we do not support routing by source, TOS,
931 * and MSG_DONTROUTE --ANK (980726)
933 * 1. ip6_rt_check(): If route was host route,
934 * check that cached destination is current.
935 * If it is network route, we still may
936 * check its validity using saved pointer
937 * to the last used address: daddr_cache.
938 * We do not want to save whole address now,
939 * (because main consumer of this service
940 * is tcp, which has not this problem),
941 * so that the last trick works only on connected
943 * 2. oif also should be the same.
945 if (ip6_rt_check(&rt->rt6i_dst, &fl6->daddr, np->daddr_cache) ||
946 #ifdef CONFIG_IPV6_SUBTREES
947 ip6_rt_check(&rt->rt6i_src, &fl6->saddr, np->saddr_cache) ||
949 (fl6->flowi6_oif && fl6->flowi6_oif != dst->dev->ifindex)) {
958 static int ip6_dst_lookup_tail(struct sock *sk,
959 struct dst_entry **dst, struct flowi6 *fl6)
961 struct net *net = sock_net(sk);
962 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
968 *dst = ip6_route_output(net, sk, fl6);
970 if ((err = (*dst)->error))
971 goto out_err_release;
973 if (ipv6_addr_any(&fl6->saddr)) {
974 struct rt6_info *rt = (struct rt6_info *) *dst;
975 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
976 sk ? inet6_sk(sk)->srcprefs : 0,
979 goto out_err_release;
982 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
984 * Here if the dst entry we've looked up
985 * has a neighbour entry that is in the INCOMPLETE
986 * state and the src address from the flow is
987 * marked as OPTIMISTIC, we release the found
988 * dst entry and replace it instead with the
989 * dst entry of the nexthop router
992 n = dst_get_neighbour(*dst);
993 if (n && !(n->nud_state & NUD_VALID)) {
994 struct inet6_ifaddr *ifp;
995 struct flowi6 fl_gw6;
999 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
1002 redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
1008 * We need to get the dst entry for the
1009 * default router instead
1012 memcpy(&fl_gw6, fl6, sizeof(struct flowi6));
1013 memset(&fl_gw6.daddr, 0, sizeof(struct in6_addr));
1014 *dst = ip6_route_output(net, sk, &fl_gw6);
1015 if ((err = (*dst)->error))
1016 goto out_err_release;
1026 if (err == -ENETUNREACH)
1027 IP6_INC_STATS_BH(net, NULL, IPSTATS_MIB_OUTNOROUTES);
1034 * ip6_dst_lookup - perform route lookup on flow
1035 * @sk: socket which provides route info
1036 * @dst: pointer to dst_entry * for result
1037 * @fl6: flow to lookup
1039 * This function performs a route lookup on the given flow.
1041 * It returns zero on success, or a standard errno code on error.
1043 int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi6 *fl6)
1046 return ip6_dst_lookup_tail(sk, dst, fl6);
1048 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
1051 * ip6_dst_lookup_flow - perform route lookup on flow with ipsec
1052 * @sk: socket which provides route info
1053 * @fl6: flow to lookup
1054 * @final_dst: final destination address for ipsec lookup
1055 * @can_sleep: we are in a sleepable context
1057 * This function performs a route lookup on the given flow.
1059 * It returns a valid dst pointer on success, or a pointer encoded
1062 struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1063 const struct in6_addr *final_dst,
1066 struct dst_entry *dst = NULL;
1069 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1071 return ERR_PTR(err);
1073 ipv6_addr_copy(&fl6->daddr, final_dst);
1075 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1077 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1079 EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
1082 * ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
1083 * @sk: socket which provides the dst cache and route info
1084 * @fl6: flow to lookup
1085 * @final_dst: final destination address for ipsec lookup
1086 * @can_sleep: we are in a sleepable context
1088 * This function performs a route lookup on the given flow with the
1089 * possibility of using the cached route in the socket if it is valid.
1090 * It will take the socket dst lock when operating on the dst cache.
1091 * As a result, this function can only be used in process context.
1093 * It returns a valid dst pointer on success, or a pointer encoded
1096 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
1097 const struct in6_addr *final_dst,
1100 struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
1103 dst = ip6_sk_dst_check(sk, dst, fl6);
1105 err = ip6_dst_lookup_tail(sk, &dst, fl6);
1107 return ERR_PTR(err);
1109 ipv6_addr_copy(&fl6->daddr, final_dst);
1111 fl6->flowi6_flags |= FLOWI_FLAG_CAN_SLEEP;
1113 return xfrm_lookup(sock_net(sk), dst, flowi6_to_flowi(fl6), sk, 0);
1115 EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
1117 static inline int ip6_ufo_append_data(struct sock *sk,
1118 int getfrag(void *from, char *to, int offset, int len,
1119 int odd, struct sk_buff *skb),
1120 void *from, int length, int hh_len, int fragheaderlen,
1121 int exthdrlen, int transhdrlen, int mtu,
1122 unsigned int flags, struct rt6_info *rt)
1124 struct sk_buff *skb;
1127 /* There is support for UDP large send offload by network
1128 * device, so create one single skb packet containing complete
1131 if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL) {
1132 struct frag_hdr fhdr;
1134 skb = sock_alloc_send_skb(sk,
1135 hh_len + fragheaderlen + transhdrlen + 20,
1136 (flags & MSG_DONTWAIT), &err);
1140 /* reserve space for Hardware header */
1141 skb_reserve(skb, hh_len);
1143 /* create space for UDP/IP header */
1144 skb_put(skb,fragheaderlen + transhdrlen);
1146 /* initialize network header pointer */
1147 skb_set_network_header(skb, exthdrlen);
1149 /* initialize protocol header pointer */
1150 skb->transport_header = skb->network_header + fragheaderlen;
1152 skb->ip_summed = CHECKSUM_PARTIAL;
1155 /* Specify the length of each IPv6 datagram fragment.
1156 * It has to be a multiple of 8.
1158 skb_shinfo(skb)->gso_size = (mtu - fragheaderlen -
1159 sizeof(struct frag_hdr)) & ~7;
1160 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1161 ipv6_select_ident(&fhdr, rt);
1162 skb_shinfo(skb)->ip6_frag_id = fhdr.identification;
1163 __skb_queue_tail(&sk->sk_write_queue, skb);
1166 return skb_append_datato_frags(sk, skb, getfrag, from,
1167 (length - transhdrlen));
1170 static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1173 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1176 static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1179 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1182 static void ip6_append_data_mtu(unsigned int *mtu,
1184 unsigned int fragheaderlen,
1185 struct sk_buff *skb,
1186 struct rt6_info *rt,
1187 unsigned int orig_mtu)
1189 if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
1191 /* first fragment, reserve header_len */
1192 *mtu = orig_mtu - rt->dst.header_len;
1196 * this fragment is not first, the headers
1197 * space is regarded as data space.
1201 *maxfraglen = ((*mtu - fragheaderlen) & ~7)
1202 + fragheaderlen - sizeof(struct frag_hdr);
1206 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1207 int offset, int len, int odd, struct sk_buff *skb),
1208 void *from, int length, int transhdrlen,
1209 int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi6 *fl6,
1210 struct rt6_info *rt, unsigned int flags, int dontfrag)
1212 struct inet_sock *inet = inet_sk(sk);
1213 struct ipv6_pinfo *np = inet6_sk(sk);
1214 struct inet_cork *cork;
1215 struct sk_buff *skb, *skb_prev = NULL;
1216 unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
1223 int csummode = CHECKSUM_NONE;
1226 if (flags&MSG_PROBE)
1228 cork = &inet->cork.base;
1229 if (skb_queue_empty(&sk->sk_write_queue)) {
1234 if (WARN_ON(np->cork.opt))
1237 np->cork.opt = kzalloc(opt->tot_len, sk->sk_allocation);
1238 if (unlikely(np->cork.opt == NULL))
1241 np->cork.opt->tot_len = opt->tot_len;
1242 np->cork.opt->opt_flen = opt->opt_flen;
1243 np->cork.opt->opt_nflen = opt->opt_nflen;
1245 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1247 if (opt->dst0opt && !np->cork.opt->dst0opt)
1250 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1252 if (opt->dst1opt && !np->cork.opt->dst1opt)
1255 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1257 if (opt->hopopt && !np->cork.opt->hopopt)
1260 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1262 if (opt->srcrt && !np->cork.opt->srcrt)
1265 /* need source address above miyazawa*/
1268 cork->dst = &rt->dst;
1269 inet->cork.fl.u.ip6 = *fl6;
1270 np->cork.hop_limit = hlimit;
1271 np->cork.tclass = tclass;
1272 if (rt->dst.flags & DST_XFRM_TUNNEL)
1273 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1274 rt->dst.dev->mtu : dst_mtu(&rt->dst);
1276 mtu = np->pmtudisc == IPV6_PMTUDISC_PROBE ?
1277 rt->dst.dev->mtu : dst_mtu(rt->dst.path);
1278 if (np->frag_size < mtu) {
1280 mtu = np->frag_size;
1282 cork->fragsize = mtu;
1283 if (dst_allfrag(rt->dst.path))
1284 cork->flags |= IPCORK_ALLFRAG;
1286 sk->sk_sndmsg_page = NULL;
1287 sk->sk_sndmsg_off = 0;
1288 exthdrlen = (opt ? opt->opt_flen : 0);
1289 length += exthdrlen;
1290 transhdrlen += exthdrlen;
1291 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1293 rt = (struct rt6_info *)cork->dst;
1294 fl6 = &inet->cork.fl.u.ip6;
1299 mtu = cork->fragsize;
1303 hh_len = LL_RESERVED_SPACE(rt->dst.dev);
1305 fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
1306 (opt ? opt->opt_nflen : 0);
1307 maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
1309 if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
1310 if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
1311 ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
1316 /* For UDP, check if TX timestamp is enabled */
1317 if (sk->sk_type == SOCK_DGRAM) {
1318 err = sock_tx_timestamp(sk, &tx_flags);
1324 * Let's try using as much space as possible.
1325 * Use MTU if total length of the message fits into the MTU.
1326 * Otherwise, we need to reserve fragment header and
1327 * fragment alignment (= 8-15 octects, in total).
1329 * Note that we may need to "move" the data from the tail of
1330 * of the buffer to the new fragment when we split
1333 * FIXME: It may be fragmented into multiple chunks
1334 * at once if non-fragmentable extension headers
1339 if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
1340 sk->sk_protocol == IPPROTO_RAW)) {
1341 ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
1345 skb = skb_peek_tail(&sk->sk_write_queue);
1346 cork->length += length;
1347 if (((length > mtu) ||
1348 (skb && skb_has_frags(skb))) &&
1349 (sk->sk_protocol == IPPROTO_UDP) &&
1350 (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
1351 (sk->sk_type == SOCK_DGRAM)) {
1352 err = ip6_ufo_append_data(sk, getfrag, from, length,
1353 hh_len, fragheaderlen, exthdrlen,
1354 transhdrlen, mtu, flags, rt);
1363 while (length > 0) {
1364 /* Check if the remaining data fits into current packet. */
1365 copy = (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - skb->len;
1367 copy = maxfraglen - skb->len;
1371 unsigned int datalen;
1372 unsigned int fraglen;
1373 unsigned int fraggap;
1374 unsigned int alloclen;
1376 /* There's no room in the current skb */
1378 fraggap = skb->len - maxfraglen;
1381 /* update mtu and maxfraglen if necessary */
1382 if (skb == NULL || skb_prev == NULL)
1383 ip6_append_data_mtu(&mtu, &maxfraglen,
1384 fragheaderlen, skb, rt,
1390 * If remaining data exceeds the mtu,
1391 * we know we need more fragment(s).
1393 datalen = length + fraggap;
1395 if (datalen > (cork->length <= mtu && !(cork->flags & IPCORK_ALLFRAG) ? mtu : maxfraglen) - fragheaderlen)
1396 datalen = maxfraglen - fragheaderlen - rt->dst.trailer_len;
1397 if ((flags & MSG_MORE) &&
1398 !(rt->dst.dev->features&NETIF_F_SG))
1401 alloclen = datalen + fragheaderlen;
1403 alloclen += dst_exthdrlen;
1405 if (datalen != length + fraggap) {
1407 * this is not the last fragment, the trailer
1408 * space is regarded as data space.
1410 datalen += rt->dst.trailer_len;
1413 alloclen += rt->dst.trailer_len;
1414 fraglen = datalen + fragheaderlen;
1417 * We just reserve space for fragment header.
1418 * Note: this may be overallocation if the message
1419 * (without MSG_MORE) fits into the MTU.
1421 alloclen += sizeof(struct frag_hdr);
1423 copy = datalen - transhdrlen - fraggap;
1429 skb = sock_alloc_send_skb(sk,
1431 (flags & MSG_DONTWAIT), &err);
1434 if (atomic_read(&sk->sk_wmem_alloc) <=
1436 skb = sock_wmalloc(sk,
1437 alloclen + hh_len, 1,
1439 if (unlikely(skb == NULL))
1442 /* Only the initial fragment
1451 * Fill in the control structures
1453 skb->ip_summed = csummode;
1455 /* reserve for fragmentation and ipsec header */
1456 skb_reserve(skb, hh_len + sizeof(struct frag_hdr) +
1459 if (sk->sk_type == SOCK_DGRAM)
1460 skb_shinfo(skb)->tx_flags = tx_flags;
1463 * Find where to start putting bytes
1465 data = skb_put(skb, fraglen);
1466 skb_set_network_header(skb, exthdrlen);
1467 data += fragheaderlen;
1468 skb->transport_header = (skb->network_header +
1471 skb->csum = skb_copy_and_csum_bits(
1472 skb_prev, maxfraglen,
1473 data + transhdrlen, fraggap, 0);
1474 skb_prev->csum = csum_sub(skb_prev->csum,
1477 pskb_trim_unique(skb_prev, maxfraglen);
1480 getfrag(from, data + transhdrlen, offset,
1481 copy, fraggap, skb) < 0) {
1488 length -= datalen - fraggap;
1492 csummode = CHECKSUM_NONE;
1495 * Put the packet on the pending queue
1497 __skb_queue_tail(&sk->sk_write_queue, skb);
1504 if (!(rt->dst.dev->features&NETIF_F_SG)) {
1508 if (getfrag(from, skb_put(skb, copy),
1509 offset, copy, off, skb) < 0) {
1510 __skb_trim(skb, off);
1515 int i = skb_shinfo(skb)->nr_frags;
1516 skb_frag_t *frag = &skb_shinfo(skb)->frags[i-1];
1517 struct page *page = sk->sk_sndmsg_page;
1518 int off = sk->sk_sndmsg_off;
1521 if (page && (left = PAGE_SIZE - off) > 0) {
1524 if (page != skb_frag_page(frag)) {
1525 if (i == MAX_SKB_FRAGS) {
1529 skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
1530 skb_frag_ref(skb, i);
1531 frag = &skb_shinfo(skb)->frags[i];
1533 } else if(i < MAX_SKB_FRAGS) {
1534 if (copy > PAGE_SIZE)
1536 page = alloc_pages(sk->sk_allocation, 0);
1541 sk->sk_sndmsg_page = page;
1542 sk->sk_sndmsg_off = 0;
1544 skb_fill_page_desc(skb, i, page, 0, 0);
1545 frag = &skb_shinfo(skb)->frags[i];
1551 skb_frag_address(frag) + skb_frag_size(frag),
1552 offset, copy, skb->len, skb) < 0) {
1556 sk->sk_sndmsg_off += copy;
1557 skb_frag_size_add(frag, copy);
1559 skb->data_len += copy;
1560 skb->truesize += copy;
1561 atomic_add(copy, &sk->sk_wmem_alloc);
1568 cork->length -= length;
1569 IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1573 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1576 kfree(np->cork.opt->dst0opt);
1577 kfree(np->cork.opt->dst1opt);
1578 kfree(np->cork.opt->hopopt);
1579 kfree(np->cork.opt->srcrt);
1580 kfree(np->cork.opt);
1581 np->cork.opt = NULL;
1584 if (inet->cork.base.dst) {
1585 dst_release(inet->cork.base.dst);
1586 inet->cork.base.dst = NULL;
1587 inet->cork.base.flags &= ~IPCORK_ALLFRAG;
1589 memset(&inet->cork.fl, 0, sizeof(inet->cork.fl));
1592 int ip6_push_pending_frames(struct sock *sk)
1594 struct sk_buff *skb, *tmp_skb;
1595 struct sk_buff **tail_skb;
1596 struct in6_addr final_dst_buf, *final_dst = &final_dst_buf;
1597 struct inet_sock *inet = inet_sk(sk);
1598 struct ipv6_pinfo *np = inet6_sk(sk);
1599 struct net *net = sock_net(sk);
1600 struct ipv6hdr *hdr;
1601 struct ipv6_txoptions *opt = np->cork.opt;
1602 struct rt6_info *rt = (struct rt6_info *)inet->cork.base.dst;
1603 struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
1604 unsigned char proto = fl6->flowi6_proto;
1607 if ((skb = __skb_dequeue(&sk->sk_write_queue)) == NULL)
1609 tail_skb = &(skb_shinfo(skb)->frag_list);
1611 /* move skb->data to ip header from ext header */
1612 if (skb->data < skb_network_header(skb))
1613 __skb_pull(skb, skb_network_offset(skb));
1614 while ((tmp_skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) {
1615 __skb_pull(tmp_skb, skb_network_header_len(skb));
1616 *tail_skb = tmp_skb;
1617 tail_skb = &(tmp_skb->next);
1618 skb->len += tmp_skb->len;
1619 skb->data_len += tmp_skb->len;
1620 skb->truesize += tmp_skb->truesize;
1621 tmp_skb->destructor = NULL;
1625 /* Allow local fragmentation. */
1626 if (np->pmtudisc < IPV6_PMTUDISC_DO)
1629 ipv6_addr_copy(final_dst, &fl6->daddr);
1630 __skb_pull(skb, skb_network_header_len(skb));
1631 if (opt && opt->opt_flen)
1632 ipv6_push_frag_opts(skb, opt, &proto);
1633 if (opt && opt->opt_nflen)
1634 ipv6_push_nfrag_opts(skb, opt, &proto, &final_dst);
1636 skb_push(skb, sizeof(struct ipv6hdr));
1637 skb_reset_network_header(skb);
1638 hdr = ipv6_hdr(skb);
1640 *(__be32*)hdr = fl6->flowlabel |
1641 htonl(0x60000000 | ((int)np->cork.tclass << 20));
1643 hdr->hop_limit = np->cork.hop_limit;
1644 hdr->nexthdr = proto;
1645 ipv6_addr_copy(&hdr->saddr, &fl6->saddr);
1646 ipv6_addr_copy(&hdr->daddr, final_dst);
1648 skb->priority = sk->sk_priority;
1649 skb->mark = sk->sk_mark;
1651 skb_dst_set(skb, dst_clone(&rt->dst));
1652 IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
1653 if (proto == IPPROTO_ICMPV6) {
1654 struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
1656 ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
1657 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
1660 err = ip6_local_out(skb);
1663 err = net_xmit_errno(err);
1669 ip6_cork_release(inet, np);
1672 IP6_INC_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUTDISCARDS);
1676 void ip6_flush_pending_frames(struct sock *sk)
1678 struct sk_buff *skb;
1680 while ((skb = __skb_dequeue_tail(&sk->sk_write_queue)) != NULL) {
1682 IP6_INC_STATS(sock_net(sk), ip6_dst_idev(skb_dst(skb)),
1683 IPSTATS_MIB_OUTDISCARDS);
1687 ip6_cork_release(inet_sk(sk), inet6_sk(sk));