[RFC net-next v2 03/18] ipv6: allow output fragmentation to reuse a Fragment Header

[Ralf Lici <ralf@mandelbit.com>]

IPv4-to-IPv6 translation constructs an IPv6 Fragment Header before the
target route is selected. If that route has a smaller MTU, IPv6 output
must split the translated fragment again. Adding another Fragment Header
would create a new fragment domain instead of subfragmenting the
original datagram representation.

Allow ip6_fragment to reuse a locally constructed Fragment Header,
preserving its identification, datagram-relative offset and More
Fragments state. This mirrors IPv4 refragmentation, whose fragment state
carries the original offset and whether more fragments follow the input
fragment.

Signed-off-by: Ralf Lici <ralf@mandelbit.com>
---
New patch in RFC v2 replacing ipxlat's v1 IPv4 pre-fragmentation
machinery.

 include/linux/ipv6.h  |  2 ++
 include/net/ipv6.h    |  1 +
 net/ipv6/ip6_output.c | 53 +++++++++++++++++++++++++++++++++++++++----
 3 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index a7421382a916..558260074842 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -177,6 +177,8 @@ struct inet6_skb_parm {
 #define IP6SKB_L3SLAVE         64
 #define IP6SKB_JUMBOGRAM      128
 #define IP6SKB_SEG6	      256
+/* the local stack owns fragmentation of this IPv6 representation */
+#define IP6SKB_FRAG_SOURCE    512
 #define IP6SKB_MULTIPATH      1024
 #define IP6SKB_MCROUTE        2048
 };
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index e3f245d640ac..a1cca04fd17a 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -189,6 +189,7 @@ struct ip6_frag_state {
 	int		hroom;
 	int		troom;
 	__be32		frag_id;
+	bool		not_last_frag;
 	u8		nexthdr;
 };
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 25fe0ba98b1a..73633483f1ab 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -204,7 +204,8 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff
 		return ip6_finish_output_gso(net, sk, skb, mtu);
 
 	if (unlikely(skb->len > mtu ||
-	    (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size)))
+		     (IP6CB(skb)->frag_max_size &&
+		      skb->len > IP6CB(skb)->frag_max_size)))
 		return ip6_fragment(net, sk, skb, ip6_finish_output2);
 
 	return ip6_finish_output2(net, sk, skb);
@@ -805,6 +806,7 @@ void ip6_frag_init(struct sk_buff *skb, unsigned int hlen, unsigned int mtu,
 	state->troom = needed_tailroom;
 
 	state->offset = 0;
+	state->not_last_frag = false;
 }
 EXPORT_SYMBOL(ip6_frag_init);
 
@@ -873,7 +875,7 @@ struct sk_buff *ip6_frag_next(struct sk_buff *skb, struct ip6_frag_state *state)
 	state->left -= len;
 
 	fh->frag_off = htons(state->offset);
-	if (state->left > 0)
+	if (state->left > 0 || state->not_last_frag)
 		fh->frag_off |= htons(IP6_MF);
 	ipv6_hdr(frag)->payload_len = htons(frag->len - sizeof(struct ipv6hdr));
 
@@ -891,10 +893,13 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 	struct rt6_info *rt = dst_rt6_info(skb_dst(skb));
 	struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
 				inet6_sk(skb->sk) : NULL;
+	struct frag_hdr old_fh;
 	u8 tstamp_type = skb->tstamp_type;
 	struct ip6_frag_state state;
 	unsigned int mtu, hlen, nexthdr_offset;
+	unsigned int old_data_len, old_offset, unfrag_len;
 	ktime_t tstamp = skb->tstamp;
+	bool frag_source, refrag;
 	int hroom, err = 0;
 	__be32 frag_id;
 	u8 *prevhdr, nexthdr = 0;
@@ -910,6 +915,31 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 	hlen = err;
 	nexthdr = *prevhdr;
 	nexthdr_offset = prevhdr - skb_network_header(skb);
+	frag_source = IP6CB(skb)->flags & IP6SKB_FRAG_SOURCE;
+	refrag = frag_source && nexthdr == NEXTHDR_FRAGMENT;
+	if (unlikely(refrag)) {
+		/* The current fragment header describes this locally built
+		 * IPv6 representation. We need to replace it with smaller
+		 * fragments rather than nesting another frag hdr around it.
+		 */
+		if (unlikely(skb->len < hlen + sizeof(old_fh) ||
+			     skb_copy_bits(skb, skb_network_offset(skb) + hlen,
+					   &old_fh, sizeof(old_fh)))) {
+			err = -EINVAL;
+			goto fail;
+		}
+
+		old_data_len = skb->len - hlen - sizeof(old_fh);
+		old_offset = ntohs(old_fh.frag_off) & IP6_OFFSET;
+		unfrag_len = hlen - sizeof(struct ipv6hdr);
+		if (unlikely(old_offset + unfrag_len > IPV6_MAXPLEN ||
+			     old_data_len >
+				     IPV6_MAXPLEN - old_offset - unfrag_len)) {
+			err = -EINVAL;
+			goto fail;
+		}
+		nexthdr = old_fh.nexthdr;
+	}
 
 	mtu = ip6_skb_dst_mtu(skb);
 
@@ -939,8 +969,11 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 		goto fail_toobig;
 	mtu -= hlen + sizeof(struct frag_hdr);
 
-	frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
-				    &ipv6_hdr(skb)->saddr);
+	if (refrag)
+		frag_id = old_fh.identification;
+	else
+		frag_id = ipv6_select_ident(net, &ipv6_hdr(skb)->daddr,
+					    &ipv6_hdr(skb)->saddr);
 
 	if (skb->ip_summed == CHECKSUM_PARTIAL &&
 	    (err = skb_checksum_help(skb)))
@@ -953,7 +986,8 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 		struct ip6_fraglist_iter iter;
 		struct sk_buff *frag2;
 
-		if (first_len - hlen > mtu ||
+		if (refrag ||
+		    first_len - hlen > mtu ||
 		    ((first_len - hlen) & 7) ||
 		    skb_cloned(skb) ||
 		    skb_headroom(skb) < (hroom + sizeof(struct frag_hdr)))
@@ -1038,6 +1072,15 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 	ip6_frag_init(skb, hlen, mtu, rt->dst.dev->needed_tailroom,
 		      LL_RESERVED_SPACE(rt->dst.dev), prevhdr, nexthdr, frag_id,
 		      &state);
+	if (refrag) {
+		/* Mirror IPv4 refragmentation: start at the old datagram
+		 * offset and retain its MF value on the final new fragment.
+		 */
+		state.left -= sizeof(old_fh);
+		state.ptr += sizeof(old_fh);
+		state.offset = old_offset;
+		state.not_last_frag = old_fh.frag_off & htons(IP6_MF);
+	}
 
 	/*
 	 *	Keep copying data until we run out.
-- 
2.55.0