net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #include <net/calipso.h>
  47 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  48 #include <net/xfrm.h>
  49 #endif
  50 #include <linux/seg6.h>
  51 #include <net/seg6.h>
  52 #ifdef CONFIG_IPV6_SEG6_HMAC
  53 #include <net/seg6_hmac.h>
  54 #endif
  55
  56 #include <linux/uaccess.h>
  57
  58 /*
  59  *      Parsing tlv encoded headers.
  60  *
  61  *      Parsing function "func" returns true, if parsing succeed
  62  *      and false, if it failed.
  63  *      It MUST NOT touch skb->h.
  64  */
  65
  66 struct tlvtype_proc {
  67         int     type;
  68         bool    (*func)(struct sk_buff *skb, int offset);
  69 };
  70
  71 /*********************
  72   Generic functions
  73  *********************/
  74
  75 /* An unknown option is detected, decide what to do */
  76
  77 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
  78 {
  79         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  80         case 0: /* ignore */
  81                 return true;
  82
  83         case 1: /* drop packet */
  84                 break;
  85
  86         case 3: /* Send ICMP if not a multicast address and drop packet */
  87                 /* Actually, it is redundant check. icmp_send
  88                    will recheck in any case.
  89                  */
  90                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
  91                         break;
  92         case 2: /* send ICMP PARM PROB regardless and drop packet */
  93                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
  94                 return false;
  95         }
  96
  97         kfree_skb(skb);
  98         return false;
  99 }
 100
 101 /* Parse tlv encoded option header (hop-by-hop or destination) */
 102
 103 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
 104 {
 105         const struct tlvtype_proc *curr;
 106         const unsigned char *nh = skb_network_header(skb);
 107         int off = skb_network_header_len(skb);
 108         int len = (skb_transport_header(skb)[1] + 1) << 3;
 109         int padlen = 0;
 110
 111         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 112                 goto bad;
 113
 114         off += 2;
 115         len -= 2;
 116
 117         while (len > 0) {
 118                 int optlen = nh[off + 1] + 2;
 119                 int i;
 120
 121                 switch (nh[off]) {
 122                 case IPV6_TLV_PAD1:
 123                         optlen = 1;
 124                         padlen++;
 125                         if (padlen > 7)
 126                                 goto bad;
 127                         break;
 128
 129                 case IPV6_TLV_PADN:
 130                         /* RFC 2460 states that the purpose of PadN is
 131                          * to align the containing header to multiples
 132                          * of 8. 7 is therefore the highest valid value.
 133                          * See also RFC 4942, Section 2.1.9.5.
 134                          */
 135                         padlen += optlen;
 136                         if (padlen > 7)
 137                                 goto bad;
 138                         /* RFC 4942 recommends receiving hosts to
 139                          * actively check PadN payload to contain
 140                          * only zeroes.
 141                          */
 142                         for (i = 2; i < optlen; i++) {
 143                                 if (nh[off + i] != 0)
 144                                         goto bad;
 145                         }
 146                         break;
 147
 148                 default: /* Other TLV code so scan list */
 149                         if (optlen > len)
 150                                 goto bad;
 151                         for (curr = procs; curr->type >= 0; curr++) {
 152                                 if (curr->type == nh[off]) {
 153                                         /* type specific length/alignment
 154                                            checks will be performed in the
 155                                            func(). */
 156                                         if (curr->func(skb, off) == false)
 157                                                 return false;
 158                                         break;
 159                                 }
 160                         }
 161                         if (curr->type < 0) {
 162                                 if (ip6_tlvopt_unknown(skb, off) == 0)
 163                                         return false;
 164                         }
 165                         padlen = 0;
 166                         break;
 167                 }
 168                 off += optlen;
 169                 len -= optlen;
 170         }
 171
 172         if (len == 0)
 173                 return true;
 174 bad:
 175         kfree_skb(skb);
 176         return false;
 177 }
 178
 179 /*****************************
 180   Destination options header.
 181  *****************************/
 182
 183 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 184 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 185 {
 186         struct ipv6_destopt_hao *hao;
 187         struct inet6_skb_parm *opt = IP6CB(skb);
 188         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 189         struct in6_addr tmp_addr;
 190         int ret;
 191
 192         if (opt->dsthao) {
 193                 net_dbg_ratelimited("hao duplicated\n");
 194                 goto discard;
 195         }
 196         opt->dsthao = opt->dst1;
 197         opt->dst1 = 0;
 198
 199         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 200
 201         if (hao->length != 16) {
 202                 net_dbg_ratelimited("hao invalid option length = %d\n",
 203                                     hao->length);
 204                 goto discard;
 205         }
 206
 207         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 208                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 209                                     &hao->addr);
 210                 goto discard;
 211         }
 212
 213         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 214                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 215         if (unlikely(ret < 0))
 216                 goto discard;
 217
 218         if (skb_cloned(skb)) {
 219                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 220                         goto discard;
 221
 222                 /* update all variable using below by copied skbuff */
 223                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 224                                                   optoff);
 225                 ipv6h = ipv6_hdr(skb);
 226         }
 227
 228         if (skb->ip_summed == CHECKSUM_COMPLETE)
 229                 skb->ip_summed = CHECKSUM_NONE;
 230
 231         tmp_addr = ipv6h->saddr;
 232         ipv6h->saddr = hao->addr;
 233         hao->addr = tmp_addr;
 234
 235         if (skb->tstamp == 0)
 236                 __net_timestamp(skb);
 237
 238         return true;
 239
 240  discard:
 241         kfree_skb(skb);
 242         return false;
 243 }
 244 #endif
 245
 246 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 247 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 248         {
 249                 .type   = IPV6_TLV_HAO,
 250                 .func   = ipv6_dest_hao,
 251         },
 252 #endif
 253         {-1,                    NULL}
 254 };
 255
 256 static int ipv6_destopt_rcv(struct sk_buff *skb)
 257 {
 258         struct inet6_skb_parm *opt = IP6CB(skb);
 259 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 260         __u16 dstbuf;
 261 #endif
 262         struct dst_entry *dst = skb_dst(skb);
 263
 264         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 265             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 266                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 267                 __IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
 268                                 IPSTATS_MIB_INHDRERRORS);
 269                 kfree_skb(skb);
 270                 return -1;
 271         }
 272
 273         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 274 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 275         dstbuf = opt->dst1;
 276 #endif
 277
 278         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
 279                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 280                 opt = IP6CB(skb);
 281 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 282                 opt->nhoff = dstbuf;
 283 #else
 284                 opt->nhoff = opt->dst1;
 285 #endif
 286                 return 1;
 287         }
 288
 289         __IP6_INC_STATS(dev_net(dst->dev),
 290                         ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 291         return -1;
 292 }
 293
 294 static void seg6_update_csum(struct sk_buff *skb)
 295 {
 296         struct ipv6_sr_hdr *hdr;
 297         struct in6_addr *addr;
 298         __be32 from, to;
 299
 300         /* srh is at transport offset and seg_left is already decremented
 301          * but daddr is not yet updated with next segment
 302          */
 303
 304         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 305         addr = hdr->segments + hdr->segments_left;
 306
 307         hdr->segments_left++;
 308         from = *(__be32 *)hdr;
 309
 310         hdr->segments_left--;
 311         to = *(__be32 *)hdr;
 312
 313         /* update skb csum with diff resulting from seg_left decrement */
 314
 315         update_csum_diff4(skb, from, to);
 316
 317         /* compute csum diff between current and next segment and update */
 318
 319         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 320                            (__be32 *)addr);
 321 }
 322
 323 static int ipv6_srh_rcv(struct sk_buff *skb)
 324 {
 325         struct inet6_skb_parm *opt = IP6CB(skb);
 326         struct net *net = dev_net(skb->dev);
 327         struct ipv6_sr_hdr *hdr;
 328         struct inet6_dev *idev;
 329         struct in6_addr *addr;
 330         int accept_seg6;
 331
 332         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 333
 334         idev = __in6_dev_get(skb->dev);
 335
 336         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 337         if (accept_seg6 > idev->cnf.seg6_enabled)
 338                 accept_seg6 = idev->cnf.seg6_enabled;
 339
 340         if (!accept_seg6) {
 341                 kfree_skb(skb);
 342                 return -1;
 343         }
 344
 345 #ifdef CONFIG_IPV6_SEG6_HMAC
 346         if (!seg6_hmac_validate_skb(skb)) {
 347                 kfree_skb(skb);
 348                 return -1;
 349         }
 350 #endif
 351
 352 looped_back:
 353         if (hdr->segments_left == 0) {
 354                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 355                         int offset = (hdr->hdrlen + 1) << 3;
 356
 357                         skb_postpull_rcsum(skb, skb_network_header(skb),
 358                                            skb_network_header_len(skb));
 359
 360                         if (!pskb_pull(skb, offset)) {
 361                                 kfree_skb(skb);
 362                                 return -1;
 363                         }
 364                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 365                                            offset);
 366
 367                         skb_reset_network_header(skb);
 368                         skb_reset_transport_header(skb);
 369                         skb->encapsulation = 0;
 370
 371                         __skb_tunnel_rx(skb, skb->dev, net);
 372
 373                         netif_rx(skb);
 374                         return -1;
 375                 }
 376
 377                 opt->srcrt = skb_network_header_len(skb);
 378                 opt->lastopt = opt->srcrt;
 379                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 380                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 381
 382                 return 1;
 383         }
 384
 385         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 386                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 387                                 IPSTATS_MIB_INHDRERRORS);
 388                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 389                                   ((&hdr->segments_left) -
 390                                    skb_network_header(skb)));
 391                 return -1;
 392         }
 393
 394         if (skb_cloned(skb)) {
 395                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 396                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 397                                         IPSTATS_MIB_OUTDISCARDS);
 398                         kfree_skb(skb);
 399                         return -1;
 400                 }
 401         }
 402
 403         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 404
 405         hdr->segments_left--;
 406         addr = hdr->segments + hdr->segments_left;
 407
 408         skb_push(skb, sizeof(struct ipv6hdr));
 409
 410         if (skb->ip_summed == CHECKSUM_COMPLETE)
 411                 seg6_update_csum(skb);
 412
 413         ipv6_hdr(skb)->daddr = *addr;
 414
 415         skb_dst_drop(skb);
 416
 417         ip6_route_input(skb);
 418
 419         if (skb_dst(skb)->error) {
 420                 dst_input(skb);
 421                 return -1;
 422         }
 423
 424         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 425                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 426                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 427                                         IPSTATS_MIB_INHDRERRORS);
 428                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 429                                     ICMPV6_EXC_HOPLIMIT, 0);
 430                         kfree_skb(skb);
 431                         return -1;
 432                 }
 433                 ipv6_hdr(skb)->hop_limit--;
 434
 435                 skb_pull(skb, sizeof(struct ipv6hdr));
 436                 goto looped_back;
 437         }
 438
 439         dst_input(skb);
 440
 441         return -1;
 442 }
 443
 444 /********************************
 445   Routing header.
 446  ********************************/
 447
 448 /* called with rcu_read_lock() */
 449 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 450 {
 451         struct inet6_skb_parm *opt = IP6CB(skb);
 452         struct in6_addr *addr = NULL;
 453         struct in6_addr daddr;
 454         struct inet6_dev *idev;
 455         int n, i;
 456         struct ipv6_rt_hdr *hdr;
 457         struct rt0_hdr *rthdr;
 458         struct net *net = dev_net(skb->dev);
 459         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 460
 461         idev = __in6_dev_get(skb->dev);
 462         if (idev && accept_source_route > idev->cnf.accept_source_route)
 463                 accept_source_route = idev->cnf.accept_source_route;
 464
 465         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 466             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 467                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 468                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 469                                 IPSTATS_MIB_INHDRERRORS);
 470                 kfree_skb(skb);
 471                 return -1;
 472         }
 473
 474         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 475
 476         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 477             skb->pkt_type != PACKET_HOST) {
 478                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 479                                 IPSTATS_MIB_INADDRERRORS);
 480                 kfree_skb(skb);
 481                 return -1;
 482         }
 483
 484         /* segment routing */
 485         if (hdr->type == IPV6_SRCRT_TYPE_4)
 486                 return ipv6_srh_rcv(skb);
 487
 488 looped_back:
 489         if (hdr->segments_left == 0) {
 490                 switch (hdr->type) {
 491 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 492                 case IPV6_SRCRT_TYPE_2:
 493                         /* Silently discard type 2 header unless it was
 494                          * processed by own
 495                          */
 496                         if (!addr) {
 497                                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 498                                                 IPSTATS_MIB_INADDRERRORS);
 499                                 kfree_skb(skb);
 500                                 return -1;
 501                         }
 502                         break;
 503 #endif
 504                 default:
 505                         break;
 506                 }
 507
 508                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 509                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 510                 opt->dst0 = opt->dst1;
 511                 opt->dst1 = 0;
 512                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 513                 return 1;
 514         }
 515
 516         switch (hdr->type) {
 517 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 518         case IPV6_SRCRT_TYPE_2:
 519                 if (accept_source_route < 0)
 520                         goto unknown_rh;
 521                 /* Silently discard invalid RTH type 2 */
 522                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 523                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 524                                         IPSTATS_MIB_INHDRERRORS);
 525                         kfree_skb(skb);
 526                         return -1;
 527                 }
 528                 break;
 529 #endif
 530         default:
 531                 goto unknown_rh;
 532         }
 533
 534         /*
 535          *      This is the routing header forwarding algorithm from
 536          *      RFC 2460, page 16.
 537          */
 538
 539         n = hdr->hdrlen >> 1;
 540
 541         if (hdr->segments_left > n) {
 542                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 543                                 IPSTATS_MIB_INHDRERRORS);
 544                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 545                                   ((&hdr->segments_left) -
 546                                    skb_network_header(skb)));
 547                 return -1;
 548         }
 549
 550         /* We are about to mangle packet header. Be careful!
 551            Do not damage packets queued somewhere.
 552          */
 553         if (skb_cloned(skb)) {
 554                 /* the copy is a forwarded packet */
 555                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 556                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 557                                         IPSTATS_MIB_OUTDISCARDS);
 558                         kfree_skb(skb);
 559                         return -1;
 560                 }
 561                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 562         }
 563
 564         if (skb->ip_summed == CHECKSUM_COMPLETE)
 565                 skb->ip_summed = CHECKSUM_NONE;
 566
 567         i = n - --hdr->segments_left;
 568
 569         rthdr = (struct rt0_hdr *) hdr;
 570         addr = rthdr->addr;
 571         addr += i - 1;
 572
 573         switch (hdr->type) {
 574 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 575         case IPV6_SRCRT_TYPE_2:
 576                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 577                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 578                                      IPPROTO_ROUTING) < 0) {
 579                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 580                                         IPSTATS_MIB_INADDRERRORS);
 581                         kfree_skb(skb);
 582                         return -1;
 583                 }
 584                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 585                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 586                                         IPSTATS_MIB_INADDRERRORS);
 587                         kfree_skb(skb);
 588                         return -1;
 589                 }
 590                 break;
 591 #endif
 592         default:
 593                 break;
 594         }
 595
 596         if (ipv6_addr_is_multicast(addr)) {
 597                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 598                                 IPSTATS_MIB_INADDRERRORS);
 599                 kfree_skb(skb);
 600                 return -1;
 601         }
 602
 603         daddr = *addr;
 604         *addr = ipv6_hdr(skb)->daddr;
 605         ipv6_hdr(skb)->daddr = daddr;
 606
 607         skb_dst_drop(skb);
 608         ip6_route_input(skb);
 609         if (skb_dst(skb)->error) {
 610                 skb_push(skb, skb->data - skb_network_header(skb));
 611                 dst_input(skb);
 612                 return -1;
 613         }
 614
 615         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 616                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 617                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 618                                         IPSTATS_MIB_INHDRERRORS);
 619                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 620                                     0);
 621                         kfree_skb(skb);
 622                         return -1;
 623                 }
 624                 ipv6_hdr(skb)->hop_limit--;
 625                 goto looped_back;
 626         }
 627
 628         skb_push(skb, skb->data - skb_network_header(skb));
 629         dst_input(skb);
 630         return -1;
 631
 632 unknown_rh:
 633         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
 634         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 635                           (&hdr->type) - skb_network_header(skb));
 636         return -1;
 637 }
 638
 639 static const struct inet6_protocol rthdr_protocol = {
 640         .handler        =       ipv6_rthdr_rcv,
 641         .flags          =       INET6_PROTO_NOPOLICY,
 642 };
 643
 644 static const struct inet6_protocol destopt_protocol = {
 645         .handler        =       ipv6_destopt_rcv,
 646         .flags          =       INET6_PROTO_NOPOLICY,
 647 };
 648
 649 static const struct inet6_protocol nodata_protocol = {
 650         .handler        =       dst_discard,
 651         .flags          =       INET6_PROTO_NOPOLICY,
 652 };
 653
 654 int __init ipv6_exthdrs_init(void)
 655 {
 656         int ret;
 657
 658         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 659         if (ret)
 660                 goto out;
 661
 662         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 663         if (ret)
 664                 goto out_rthdr;
 665
 666         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 667         if (ret)
 668                 goto out_destopt;
 669
 670 out:
 671         return ret;
 672 out_destopt:
 673         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 674 out_rthdr:
 675         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 676         goto out;
 677 };
 678
 679 void ipv6_exthdrs_exit(void)
 680 {
 681         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 682         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 683         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 684 }
 685
 686 /**********************************
 687   Hop-by-hop options.
 688  **********************************/
 689
 690 /*
 691  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 692  */
 693 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 694 {
 695         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 696 }
 697
 698 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 699 {
 700         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 701 }
 702
 703 /* Router Alert as of RFC 2711 */
 704
 705 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 706 {
 707         const unsigned char *nh = skb_network_header(skb);
 708
 709         if (nh[optoff + 1] == 2) {
 710                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 711                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 712                 return true;
 713         }
 714         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 715                             nh[optoff + 1]);
 716         kfree_skb(skb);
 717         return false;
 718 }
 719
 720 /* Jumbo payload */
 721
 722 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 723 {
 724         const unsigned char *nh = skb_network_header(skb);
 725         struct net *net = ipv6_skb_net(skb);
 726         u32 pkt_len;
 727
 728         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 729                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 730                                     nh[optoff+1]);
 731                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 732                                 IPSTATS_MIB_INHDRERRORS);
 733                 goto drop;
 734         }
 735
 736         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 737         if (pkt_len <= IPV6_MAXPLEN) {
 738                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 739                                 IPSTATS_MIB_INHDRERRORS);
 740                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 741                 return false;
 742         }
 743         if (ipv6_hdr(skb)->payload_len) {
 744                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 745                                 IPSTATS_MIB_INHDRERRORS);
 746                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 747                 return false;
 748         }
 749
 750         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 751                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 752                                 IPSTATS_MIB_INTRUNCATEDPKTS);
 753                 goto drop;
 754         }
 755
 756         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 757                 goto drop;
 758
 759         IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
 760         return true;
 761
 762 drop:
 763         kfree_skb(skb);
 764         return false;
 765 }
 766
 767 /* CALIPSO RFC 5570 */
 768
 769 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 770 {
 771         const unsigned char *nh = skb_network_header(skb);
 772
 773         if (nh[optoff + 1] < 8)
 774                 goto drop;
 775
 776         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 777                 goto drop;
 778
 779         if (!calipso_validate(skb, nh + optoff))
 780                 goto drop;
 781
 782         return true;
 783
 784 drop:
 785         kfree_skb(skb);
 786         return false;
 787 }
 788
 789 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 790         {
 791                 .type   = IPV6_TLV_ROUTERALERT,
 792                 .func   = ipv6_hop_ra,
 793         },
 794         {
 795                 .type   = IPV6_TLV_JUMBO,
 796                 .func   = ipv6_hop_jumbo,
 797         },
 798         {
 799                 .type   = IPV6_TLV_CALIPSO,
 800                 .func   = ipv6_hop_calipso,
 801         },
 802         { -1, }
 803 };
 804
 805 int ipv6_parse_hopopts(struct sk_buff *skb)
 806 {
 807         struct inet6_skb_parm *opt = IP6CB(skb);
 808
 809         /*
 810          * skb_network_header(skb) is equal to skb->data, and
 811          * skb_network_header_len(skb) is always equal to
 812          * sizeof(struct ipv6hdr) by definition of
 813          * hop-by-hop options.
 814          */
 815         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 816             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 817                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 818                 kfree_skb(skb);
 819                 return -1;
 820         }
 821
 822         opt->flags |= IP6SKB_HOPBYHOP;
 823         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
 824                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 825                 opt = IP6CB(skb);
 826                 opt->nhoff = sizeof(struct ipv6hdr);
 827                 return 1;
 828         }
 829         return -1;
 830 }
 831
 832 /*
 833  *      Creating outbound headers.
 834  *
 835  *      "build" functions work when skb is filled from head to tail (datagram)
 836  *      "push"  functions work when headers are added from tail to head (tcp)
 837  *
 838  *      In both cases we assume, that caller reserved enough room
 839  *      for headers.
 840  */
 841
 842 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
 843                              struct ipv6_rt_hdr *opt,
 844                              struct in6_addr **addr_p, struct in6_addr *saddr)
 845 {
 846         struct rt0_hdr *phdr, *ihdr;
 847         int hops;
 848
 849         ihdr = (struct rt0_hdr *) opt;
 850
 851         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 852         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 853
 854         hops = ihdr->rt_hdr.hdrlen >> 1;
 855
 856         if (hops > 1)
 857                 memcpy(phdr->addr, ihdr->addr + 1,
 858                        (hops - 1) * sizeof(struct in6_addr));
 859
 860         phdr->addr[hops - 1] = **addr_p;
 861         *addr_p = ihdr->addr;
 862
 863         phdr->rt_hdr.nexthdr = *proto;
 864         *proto = NEXTHDR_ROUTING;
 865 }
 866
 867 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
 868                              struct ipv6_rt_hdr *opt,
 869                              struct in6_addr **addr_p, struct in6_addr *saddr)
 870 {
 871         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
 872         int plen, hops;
 873
 874         sr_ihdr = (struct ipv6_sr_hdr *)opt;
 875         plen = (sr_ihdr->hdrlen + 1) << 3;
 876
 877         sr_phdr = skb_push(skb, plen);
 878         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
 879
 880         hops = sr_ihdr->first_segment + 1;
 881         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
 882                (hops - 1) * sizeof(struct in6_addr));
 883
 884         sr_phdr->segments[0] = **addr_p;
 885         *addr_p = &sr_ihdr->segments[hops - 1];
 886
 887 #ifdef CONFIG_IPV6_SEG6_HMAC
 888         if (sr_has_hmac(sr_phdr)) {
 889                 struct net *net = NULL;
 890
 891                 if (skb->dev)
 892                         net = dev_net(skb->dev);
 893                 else if (skb->sk)
 894                         net = sock_net(skb->sk);
 895
 896                 WARN_ON(!net);
 897
 898                 if (net)
 899                         seg6_push_hmac(net, saddr, sr_phdr);
 900         }
 901 #endif
 902
 903         sr_phdr->nexthdr = *proto;
 904         *proto = NEXTHDR_ROUTING;
 905 }
 906
 907 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 908                             struct ipv6_rt_hdr *opt,
 909                             struct in6_addr **addr_p, struct in6_addr *saddr)
 910 {
 911         switch (opt->type) {
 912         case IPV6_SRCRT_TYPE_0:
 913         case IPV6_SRCRT_STRICT:
 914         case IPV6_SRCRT_TYPE_2:
 915                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
 916                 break;
 917         case IPV6_SRCRT_TYPE_4:
 918                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
 919                 break;
 920         default:
 921                 break;
 922         }
 923 }
 924
 925 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 926 {
 927         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
 928
 929         memcpy(h, opt, ipv6_optlen(opt));
 930         h->nexthdr = *proto;
 931         *proto = type;
 932 }
 933
 934 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 935                           u8 *proto,
 936                           struct in6_addr **daddr, struct in6_addr *saddr)
 937 {
 938         if (opt->srcrt) {
 939                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
 940                 /*
 941                  * IPV6_RTHDRDSTOPTS is ignored
 942                  * unless IPV6_RTHDR is set (RFC3542).
 943                  */
 944                 if (opt->dst0opt)
 945                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 946         }
 947         if (opt->hopopt)
 948                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 949 }
 950
 951 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 952 {
 953         if (opt->dst1opt)
 954                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 955 }
 956 EXPORT_SYMBOL(ipv6_push_frag_opts);
 957
 958 struct ipv6_txoptions *
 959 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 960 {
 961         struct ipv6_txoptions *opt2;
 962
 963         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 964         if (opt2) {
 965                 long dif = (char *)opt2 - (char *)opt;
 966                 memcpy(opt2, opt, opt->tot_len);
 967                 if (opt2->hopopt)
 968                         *((char **)&opt2->hopopt) += dif;
 969                 if (opt2->dst0opt)
 970                         *((char **)&opt2->dst0opt) += dif;
 971                 if (opt2->dst1opt)
 972                         *((char **)&opt2->dst1opt) += dif;
 973                 if (opt2->srcrt)
 974                         *((char **)&opt2->srcrt) += dif;
 975                 refcount_set(&opt2->refcnt, 1);
 976         }
 977         return opt2;
 978 }
 979 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 980
 981 static int ipv6_renew_option(void *ohdr,
 982                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
 983                              int inherit,
 984                              struct ipv6_opt_hdr **hdr,
 985                              char **p)
 986 {
 987         if (inherit) {
 988                 if (ohdr) {
 989                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
 990                         *hdr = (struct ipv6_opt_hdr *)*p;
 991                         *p += CMSG_ALIGN(ipv6_optlen(*hdr));
 992                 }
 993         } else {
 994                 if (newopt) {
 995                         if (copy_from_user(*p, newopt, newoptlen))
 996                                 return -EFAULT;
 997                         *hdr = (struct ipv6_opt_hdr *)*p;
 998                         if (ipv6_optlen(*hdr) > newoptlen)
 999                                 return -EINVAL;
1000                         *p += CMSG_ALIGN(newoptlen);
1001                 }
1002         }
1003         return 0;
1004 }
1005
1006 /**
1007  * ipv6_renew_options - replace a specific ext hdr with a new one.
1008  *
1009  * @sk: sock from which to allocate memory
1010  * @opt: original options
1011  * @newtype: option type to replace in @opt
1012  * @newopt: new option of type @newtype to replace (user-mem)
1013  * @newoptlen: length of @newopt
1014  *
1015  * Returns a new set of options which is a copy of @opt with the
1016  * option type @newtype replaced with @newopt.
1017  *
1018  * @opt may be NULL, in which case a new set of options is returned
1019  * containing just @newopt.
1020  *
1021  * @newopt may be NULL, in which case the specified option type is
1022  * not copied into the new set of options.
1023  *
1024  * The new set of options is allocated from the socket option memory
1025  * buffer of @sk.
1026  */
1027 struct ipv6_txoptions *
1028 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1029                    int newtype,
1030                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
1031 {
1032         int tot_len = 0;
1033         char *p;
1034         struct ipv6_txoptions *opt2;
1035         int err;
1036
1037         if (opt) {
1038                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1039                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1040                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1041                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1042                 if (newtype != IPV6_RTHDR && opt->srcrt)
1043                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1044                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1045                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1046         }
1047
1048         if (newopt && newoptlen)
1049                 tot_len += CMSG_ALIGN(newoptlen);
1050
1051         if (!tot_len)
1052                 return NULL;
1053
1054         tot_len += sizeof(*opt2);
1055         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1056         if (!opt2)
1057                 return ERR_PTR(-ENOBUFS);
1058
1059         memset(opt2, 0, tot_len);
1060         refcount_set(&opt2->refcnt, 1);
1061         opt2->tot_len = tot_len;
1062         p = (char *)(opt2 + 1);
1063
1064         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
1065                                 newtype != IPV6_HOPOPTS,
1066                                 &opt2->hopopt, &p);
1067         if (err)
1068                 goto out;
1069
1070         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
1071                                 newtype != IPV6_RTHDRDSTOPTS,
1072                                 &opt2->dst0opt, &p);
1073         if (err)
1074                 goto out;
1075
1076         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
1077                                 newtype != IPV6_RTHDR,
1078                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
1079         if (err)
1080                 goto out;
1081
1082         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
1083                                 newtype != IPV6_DSTOPTS,
1084                                 &opt2->dst1opt, &p);
1085         if (err)
1086                 goto out;
1087
1088         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1089                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1090                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1091         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1092
1093         return opt2;
1094 out:
1095         sock_kfree_s(sk, opt2, opt2->tot_len);
1096         return ERR_PTR(err);
1097 }
1098
1099 /**
1100  * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
1101  *
1102  * @sk: sock from which to allocate memory
1103  * @opt: original options
1104  * @newtype: option type to replace in @opt
1105  * @newopt: new option of type @newtype to replace (kernel-mem)
1106  * @newoptlen: length of @newopt
1107  *
1108  * See ipv6_renew_options().  The difference is that @newopt is
1109  * kernel memory, rather than user memory.
1110  */
1111 struct ipv6_txoptions *
1112 ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
1113                         int newtype, struct ipv6_opt_hdr *newopt,
1114                         int newoptlen)
1115 {
1116         struct ipv6_txoptions *ret_val;
1117         const mm_segment_t old_fs = get_fs();
1118
1119         set_fs(KERNEL_DS);
1120         ret_val = ipv6_renew_options(sk, opt, newtype,
1121                                      (struct ipv6_opt_hdr __user *)newopt,
1122                                      newoptlen);
1123         set_fs(old_fs);
1124         return ret_val;
1125 }
1126
1127 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1128                                           struct ipv6_txoptions *opt)
1129 {
1130         /*
1131          * ignore the dest before srcrt unless srcrt is being included.
1132          * --yoshfuji
1133          */
1134         if (opt && opt->dst0opt && !opt->srcrt) {
1135                 if (opt_space != opt) {
1136                         memcpy(opt_space, opt, sizeof(*opt_space));
1137                         opt = opt_space;
1138                 }
1139                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1140                 opt->dst0opt = NULL;
1141         }
1142
1143         return opt;
1144 }
1145 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1146
1147 /**
1148  * fl6_update_dst - update flowi destination address with info given
1149  *                  by srcrt option, if any.
1150  *
1151  * @fl6: flowi6 for which daddr is to be updated
1152  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1153  * @orig: copy of original daddr address if modified
1154  *
1155  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1156  * and initial value of fl6->daddr set in orig
1157  */
1158 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1159                                 const struct ipv6_txoptions *opt,
1160                                 struct in6_addr *orig)
1161 {
1162         if (!opt || !opt->srcrt)
1163                 return NULL;
1164
1165         *orig = fl6->daddr;
1166
1167         switch (opt->srcrt->type) {
1168         case IPV6_SRCRT_TYPE_0:
1169         case IPV6_SRCRT_STRICT:
1170         case IPV6_SRCRT_TYPE_2:
1171                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1172                 break;
1173         case IPV6_SRCRT_TYPE_4:
1174         {
1175                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1176
1177                 fl6->daddr = srh->segments[srh->first_segment];
1178                 break;
1179         }
1180         default:
1181                 return NULL;
1182         }
1183
1184         return orig;
1185 }
1186 EXPORT_SYMBOL_GPL(fl6_update_dst);