net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #include <net/calipso.h>
  47 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  48 #include <net/xfrm.h>
  49 #endif
  50 #include <linux/seg6.h>
  51 #include <net/seg6.h>
  52 #ifdef CONFIG_IPV6_SEG6_HMAC
  53 #include <net/seg6_hmac.h>
  54 #endif
  55
  56 #include <linux/uaccess.h>
  57
  58 /*
  59  *      Parsing tlv encoded headers.
  60  *
  61  *      Parsing function "func" returns true, if parsing succeed
  62  *      and false, if it failed.
  63  *      It MUST NOT touch skb->h.
  64  */
  65
  66 struct tlvtype_proc {
  67         int     type;
  68         bool    (*func)(struct sk_buff *skb, int offset);
  69 };
  70
  71 /*********************
  72   Generic functions
  73  *********************/
  74
  75 /* An unknown option is detected, decide what to do */
  76
  77 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
  78 {
  79         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  80         case 0: /* ignore */
  81                 return true;
  82
  83         case 1: /* drop packet */
  84                 break;
  85
  86         case 3: /* Send ICMP if not a multicast address and drop packet */
  87                 /* Actually, it is redundant check. icmp_send
  88                    will recheck in any case.
  89                  */
  90                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
  91                         break;
  92         case 2: /* send ICMP PARM PROB regardless and drop packet */
  93                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
  94                 return false;
  95         }
  96
  97         kfree_skb(skb);
  98         return false;
  99 }
 100
 101 /* Parse tlv encoded option header (hop-by-hop or destination) */
 102
 103 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
 104 {
 105         const struct tlvtype_proc *curr;
 106         const unsigned char *nh = skb_network_header(skb);
 107         int off = skb_network_header_len(skb);
 108         int len = (skb_transport_header(skb)[1] + 1) << 3;
 109         int padlen = 0;
 110
 111         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 112                 goto bad;
 113
 114         off += 2;
 115         len -= 2;
 116
 117         while (len > 0) {
 118                 int optlen = nh[off + 1] + 2;
 119                 int i;
 120
 121                 switch (nh[off]) {
 122                 case IPV6_TLV_PAD1:
 123                         optlen = 1;
 124                         padlen++;
 125                         if (padlen > 7)
 126                                 goto bad;
 127                         break;
 128
 129                 case IPV6_TLV_PADN:
 130                         /* RFC 2460 states that the purpose of PadN is
 131                          * to align the containing header to multiples
 132                          * of 8. 7 is therefore the highest valid value.
 133                          * See also RFC 4942, Section 2.1.9.5.
 134                          */
 135                         padlen += optlen;
 136                         if (padlen > 7)
 137                                 goto bad;
 138                         /* RFC 4942 recommends receiving hosts to
 139                          * actively check PadN payload to contain
 140                          * only zeroes.
 141                          */
 142                         for (i = 2; i < optlen; i++) {
 143                                 if (nh[off + i] != 0)
 144                                         goto bad;
 145                         }
 146                         break;
 147
 148                 default: /* Other TLV code so scan list */
 149                         if (optlen > len)
 150                                 goto bad;
 151                         for (curr = procs; curr->type >= 0; curr++) {
 152                                 if (curr->type == nh[off]) {
 153                                         /* type specific length/alignment
 154                                            checks will be performed in the
 155                                            func(). */
 156                                         if (curr->func(skb, off) == false)
 157                                                 return false;
 158                                         break;
 159                                 }
 160                         }
 161                         if (curr->type < 0) {
 162                                 if (ip6_tlvopt_unknown(skb, off) == 0)
 163                                         return false;
 164                         }
 165                         padlen = 0;
 166                         break;
 167                 }
 168                 off += optlen;
 169                 len -= optlen;
 170         }
 171
 172         if (len == 0)
 173                 return true;
 174 bad:
 175         kfree_skb(skb);
 176         return false;
 177 }
 178
 179 /*****************************
 180   Destination options header.
 181  *****************************/
 182
 183 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 184 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 185 {
 186         struct ipv6_destopt_hao *hao;
 187         struct inet6_skb_parm *opt = IP6CB(skb);
 188         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 189         struct in6_addr tmp_addr;
 190         int ret;
 191
 192         if (opt->dsthao) {
 193                 net_dbg_ratelimited("hao duplicated\n");
 194                 goto discard;
 195         }
 196         opt->dsthao = opt->dst1;
 197         opt->dst1 = 0;
 198
 199         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 200
 201         if (hao->length != 16) {
 202                 net_dbg_ratelimited("hao invalid option length = %d\n",
 203                                     hao->length);
 204                 goto discard;
 205         }
 206
 207         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 208                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 209                                     &hao->addr);
 210                 goto discard;
 211         }
 212
 213         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 214                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 215         if (unlikely(ret < 0))
 216                 goto discard;
 217
 218         if (skb_cloned(skb)) {
 219                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 220                         goto discard;
 221
 222                 /* update all variable using below by copied skbuff */
 223                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 224                                                   optoff);
 225                 ipv6h = ipv6_hdr(skb);
 226         }
 227
 228         if (skb->ip_summed == CHECKSUM_COMPLETE)
 229                 skb->ip_summed = CHECKSUM_NONE;
 230
 231         tmp_addr = ipv6h->saddr;
 232         ipv6h->saddr = hao->addr;
 233         hao->addr = tmp_addr;
 234
 235         if (skb->tstamp == 0)
 236                 __net_timestamp(skb);
 237
 238         return true;
 239
 240  discard:
 241         kfree_skb(skb);
 242         return false;
 243 }
 244 #endif
 245
 246 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 247 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 248         {
 249                 .type   = IPV6_TLV_HAO,
 250                 .func   = ipv6_dest_hao,
 251         },
 252 #endif
 253         {-1,                    NULL}
 254 };
 255
 256 static int ipv6_destopt_rcv(struct sk_buff *skb)
 257 {
 258         struct inet6_skb_parm *opt = IP6CB(skb);
 259 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 260         __u16 dstbuf;
 261 #endif
 262         struct dst_entry *dst = skb_dst(skb);
 263
 264         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 265             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 266                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 267                 __IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
 268                                 IPSTATS_MIB_INHDRERRORS);
 269                 kfree_skb(skb);
 270                 return -1;
 271         }
 272
 273         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 274 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 275         dstbuf = opt->dst1;
 276 #endif
 277
 278         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
 279                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 280                 opt = IP6CB(skb);
 281 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 282                 opt->nhoff = dstbuf;
 283 #else
 284                 opt->nhoff = opt->dst1;
 285 #endif
 286                 return 1;
 287         }
 288
 289         __IP6_INC_STATS(dev_net(dst->dev),
 290                         ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 291         return -1;
 292 }
 293
 294 static void seg6_update_csum(struct sk_buff *skb)
 295 {
 296         struct ipv6_sr_hdr *hdr;
 297         struct in6_addr *addr;
 298         __be32 from, to;
 299
 300         /* srh is at transport offset and seg_left is already decremented
 301          * but daddr is not yet updated with next segment
 302          */
 303
 304         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 305         addr = hdr->segments + hdr->segments_left;
 306
 307         hdr->segments_left++;
 308         from = *(__be32 *)hdr;
 309
 310         hdr->segments_left--;
 311         to = *(__be32 *)hdr;
 312
 313         /* update skb csum with diff resulting from seg_left decrement */
 314
 315         update_csum_diff4(skb, from, to);
 316
 317         /* compute csum diff between current and next segment and update */
 318
 319         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 320                            (__be32 *)addr);
 321 }
 322
 323 static int ipv6_srh_rcv(struct sk_buff *skb)
 324 {
 325         struct inet6_skb_parm *opt = IP6CB(skb);
 326         struct net *net = dev_net(skb->dev);
 327         struct ipv6_sr_hdr *hdr;
 328         struct inet6_dev *idev;
 329         struct in6_addr *addr;
 330         int accept_seg6;
 331
 332         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 333
 334         idev = __in6_dev_get(skb->dev);
 335
 336         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 337         if (accept_seg6 > idev->cnf.seg6_enabled)
 338                 accept_seg6 = idev->cnf.seg6_enabled;
 339
 340         if (!accept_seg6) {
 341                 kfree_skb(skb);
 342                 return -1;
 343         }
 344
 345 #ifdef CONFIG_IPV6_SEG6_HMAC
 346         if (!seg6_hmac_validate_skb(skb)) {
 347                 kfree_skb(skb);
 348                 return -1;
 349         }
 350 #endif
 351
 352 looped_back:
 353         if (hdr->segments_left == 0) {
 354                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 355                         int offset = (hdr->hdrlen + 1) << 3;
 356
 357                         skb_postpull_rcsum(skb, skb_network_header(skb),
 358                                            skb_network_header_len(skb));
 359
 360                         if (!pskb_pull(skb, offset)) {
 361                                 kfree_skb(skb);
 362                                 return -1;
 363                         }
 364                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 365                                            offset);
 366
 367                         skb_reset_network_header(skb);
 368                         skb_reset_transport_header(skb);
 369                         skb->encapsulation = 0;
 370
 371                         __skb_tunnel_rx(skb, skb->dev, net);
 372
 373                         netif_rx(skb);
 374                         return -1;
 375                 }
 376
 377                 opt->srcrt = skb_network_header_len(skb);
 378                 opt->lastopt = opt->srcrt;
 379                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 380                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 381
 382                 return 1;
 383         }
 384
 385         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 386                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 387                                 IPSTATS_MIB_INHDRERRORS);
 388                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 389                                   ((&hdr->segments_left) -
 390                                    skb_network_header(skb)));
 391                 return -1;
 392         }
 393
 394         if (skb_cloned(skb)) {
 395                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 396                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 397                                         IPSTATS_MIB_OUTDISCARDS);
 398                         kfree_skb(skb);
 399                         return -1;
 400                 }
 401         }
 402
 403         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 404
 405         hdr->segments_left--;
 406         addr = hdr->segments + hdr->segments_left;
 407
 408         skb_push(skb, sizeof(struct ipv6hdr));
 409
 410         if (skb->ip_summed == CHECKSUM_COMPLETE)
 411                 seg6_update_csum(skb);
 412
 413         ipv6_hdr(skb)->daddr = *addr;
 414
 415         skb_dst_drop(skb);
 416
 417         ip6_route_input(skb);
 418
 419         if (skb_dst(skb)->error) {
 420                 dst_input(skb);
 421                 return -1;
 422         }
 423
 424         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 425                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 426                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 427                                         IPSTATS_MIB_INHDRERRORS);
 428                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 429                                     ICMPV6_EXC_HOPLIMIT, 0);
 430                         kfree_skb(skb);
 431                         return -1;
 432                 }
 433                 ipv6_hdr(skb)->hop_limit--;
 434
 435                 skb_pull(skb, sizeof(struct ipv6hdr));
 436                 goto looped_back;
 437         }
 438
 439         dst_input(skb);
 440
 441         return -1;
 442 }
 443
 444 /********************************
 445   Routing header.
 446  ********************************/
 447
 448 /* called with rcu_read_lock() */
 449 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 450 {
 451         struct inet6_skb_parm *opt = IP6CB(skb);
 452         struct in6_addr *addr = NULL;
 453         struct in6_addr daddr;
 454         struct inet6_dev *idev;
 455         int n, i;
 456         struct ipv6_rt_hdr *hdr;
 457         struct rt0_hdr *rthdr;
 458         struct net *net = dev_net(skb->dev);
 459         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 460
 461         idev = __in6_dev_get(skb->dev);
 462         if (idev && accept_source_route > idev->cnf.accept_source_route)
 463                 accept_source_route = idev->cnf.accept_source_route;
 464
 465         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 466             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 467                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 468                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 469                                 IPSTATS_MIB_INHDRERRORS);
 470                 kfree_skb(skb);
 471                 return -1;
 472         }
 473
 474         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 475
 476         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 477             skb->pkt_type != PACKET_HOST) {
 478                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 479                                 IPSTATS_MIB_INADDRERRORS);
 480                 kfree_skb(skb);
 481                 return -1;
 482         }
 483
 484         /* segment routing */
 485         if (hdr->type == IPV6_SRCRT_TYPE_4)
 486                 return ipv6_srh_rcv(skb);
 487
 488 looped_back:
 489         if (hdr->segments_left == 0) {
 490                 switch (hdr->type) {
 491 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 492                 case IPV6_SRCRT_TYPE_2:
 493                         /* Silently discard type 2 header unless it was
 494                          * processed by own
 495                          */
 496                         if (!addr) {
 497                                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 498                                                 IPSTATS_MIB_INADDRERRORS);
 499                                 kfree_skb(skb);
 500                                 return -1;
 501                         }
 502                         break;
 503 #endif
 504                 default:
 505                         break;
 506                 }
 507
 508                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 509                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 510                 opt->dst0 = opt->dst1;
 511                 opt->dst1 = 0;
 512                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 513                 return 1;
 514         }
 515
 516         switch (hdr->type) {
 517 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 518         case IPV6_SRCRT_TYPE_2:
 519                 if (accept_source_route < 0)
 520                         goto unknown_rh;
 521                 /* Silently discard invalid RTH type 2 */
 522                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 523                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 524                                         IPSTATS_MIB_INHDRERRORS);
 525                         kfree_skb(skb);
 526                         return -1;
 527                 }
 528                 break;
 529 #endif
 530         default:
 531                 goto unknown_rh;
 532         }
 533
 534         /*
 535          *      This is the routing header forwarding algorithm from
 536          *      RFC 2460, page 16.
 537          */
 538
 539         n = hdr->hdrlen >> 1;
 540
 541         if (hdr->segments_left > n) {
 542                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 543                                 IPSTATS_MIB_INHDRERRORS);
 544                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 545                                   ((&hdr->segments_left) -
 546                                    skb_network_header(skb)));
 547                 return -1;
 548         }
 549
 550         /* We are about to mangle packet header. Be careful!
 551            Do not damage packets queued somewhere.
 552          */
 553         if (skb_cloned(skb)) {
 554                 /* the copy is a forwarded packet */
 555                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 556                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 557                                         IPSTATS_MIB_OUTDISCARDS);
 558                         kfree_skb(skb);
 559                         return -1;
 560                 }
 561                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 562         }
 563
 564         if (skb->ip_summed == CHECKSUM_COMPLETE)
 565                 skb->ip_summed = CHECKSUM_NONE;
 566
 567         i = n - --hdr->segments_left;
 568
 569         rthdr = (struct rt0_hdr *) hdr;
 570         addr = rthdr->addr;
 571         addr += i - 1;
 572
 573         switch (hdr->type) {
 574 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 575         case IPV6_SRCRT_TYPE_2:
 576                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 577                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 578                                      IPPROTO_ROUTING) < 0) {
 579                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 580                                         IPSTATS_MIB_INADDRERRORS);
 581                         kfree_skb(skb);
 582                         return -1;
 583                 }
 584                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 585                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 586                                         IPSTATS_MIB_INADDRERRORS);
 587                         kfree_skb(skb);
 588                         return -1;
 589                 }
 590                 break;
 591 #endif
 592         default:
 593                 break;
 594         }
 595
 596         if (ipv6_addr_is_multicast(addr)) {
 597                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 598                                 IPSTATS_MIB_INADDRERRORS);
 599                 kfree_skb(skb);
 600                 return -1;
 601         }
 602
 603         daddr = *addr;
 604         *addr = ipv6_hdr(skb)->daddr;
 605         ipv6_hdr(skb)->daddr = daddr;
 606
 607         skb_dst_drop(skb);
 608         ip6_route_input(skb);
 609         if (skb_dst(skb)->error) {
 610                 skb_push(skb, skb->data - skb_network_header(skb));
 611                 dst_input(skb);
 612                 return -1;
 613         }
 614
 615         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 616                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 617                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 618                                         IPSTATS_MIB_INHDRERRORS);
 619                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 620                                     0);
 621                         kfree_skb(skb);
 622                         return -1;
 623                 }
 624                 ipv6_hdr(skb)->hop_limit--;
 625                 goto looped_back;
 626         }
 627
 628         skb_push(skb, skb->data - skb_network_header(skb));
 629         dst_input(skb);
 630         return -1;
 631
 632 unknown_rh:
 633         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
 634         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 635                           (&hdr->type) - skb_network_header(skb));
 636         return -1;
 637 }
 638
 639 static const struct inet6_protocol rthdr_protocol = {
 640         .handler        =       ipv6_rthdr_rcv,
 641         .flags          =       INET6_PROTO_NOPOLICY,
 642 };
 643
 644 static const struct inet6_protocol destopt_protocol = {
 645         .handler        =       ipv6_destopt_rcv,
 646         .flags          =       INET6_PROTO_NOPOLICY,
 647 };
 648
 649 static const struct inet6_protocol nodata_protocol = {
 650         .handler        =       dst_discard,
 651         .flags          =       INET6_PROTO_NOPOLICY,
 652 };
 653
 654 int __init ipv6_exthdrs_init(void)
 655 {
 656         int ret;
 657
 658         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 659         if (ret)
 660                 goto out;
 661
 662         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 663         if (ret)
 664                 goto out_rthdr;
 665
 666         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 667         if (ret)
 668                 goto out_destopt;
 669
 670 out:
 671         return ret;
 672 out_destopt:
 673         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 674 out_rthdr:
 675         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 676         goto out;
 677 };
 678
 679 void ipv6_exthdrs_exit(void)
 680 {
 681         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 682         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 683         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 684 }
 685
 686 /**********************************
 687   Hop-by-hop options.
 688  **********************************/
 689
 690 /*
 691  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 692  */
 693 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 694 {
 695         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 696 }
 697
 698 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 699 {
 700         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 701 }
 702
 703 /* Router Alert as of RFC 2711 */
 704
 705 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 706 {
 707         const unsigned char *nh = skb_network_header(skb);
 708
 709         if (nh[optoff + 1] == 2) {
 710                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 711                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 712                 return true;
 713         }
 714         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 715                             nh[optoff + 1]);
 716         kfree_skb(skb);
 717         return false;
 718 }
 719
 720 /* Jumbo payload */
 721
 722 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 723 {
 724         const unsigned char *nh = skb_network_header(skb);
 725         struct net *net = ipv6_skb_net(skb);
 726         u32 pkt_len;
 727
 728         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 729                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 730                                     nh[optoff+1]);
 731                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 732                                 IPSTATS_MIB_INHDRERRORS);
 733                 goto drop;
 734         }
 735
 736         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 737         if (pkt_len <= IPV6_MAXPLEN) {
 738                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 739                                 IPSTATS_MIB_INHDRERRORS);
 740                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 741                 return false;
 742         }
 743         if (ipv6_hdr(skb)->payload_len) {
 744                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 745                                 IPSTATS_MIB_INHDRERRORS);
 746                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 747                 return false;
 748         }
 749
 750         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 751                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 752                                 IPSTATS_MIB_INTRUNCATEDPKTS);
 753                 goto drop;
 754         }
 755
 756         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 757                 goto drop;
 758
 759         return true;
 760
 761 drop:
 762         kfree_skb(skb);
 763         return false;
 764 }
 765
 766 /* CALIPSO RFC 5570 */
 767
 768 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 769 {
 770         const unsigned char *nh = skb_network_header(skb);
 771
 772         if (nh[optoff + 1] < 8)
 773                 goto drop;
 774
 775         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 776                 goto drop;
 777
 778         if (!calipso_validate(skb, nh + optoff))
 779                 goto drop;
 780
 781         return true;
 782
 783 drop:
 784         kfree_skb(skb);
 785         return false;
 786 }
 787
 788 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 789         {
 790                 .type   = IPV6_TLV_ROUTERALERT,
 791                 .func   = ipv6_hop_ra,
 792         },
 793         {
 794                 .type   = IPV6_TLV_JUMBO,
 795                 .func   = ipv6_hop_jumbo,
 796         },
 797         {
 798                 .type   = IPV6_TLV_CALIPSO,
 799                 .func   = ipv6_hop_calipso,
 800         },
 801         { -1, }
 802 };
 803
 804 int ipv6_parse_hopopts(struct sk_buff *skb)
 805 {
 806         struct inet6_skb_parm *opt = IP6CB(skb);
 807
 808         /*
 809          * skb_network_header(skb) is equal to skb->data, and
 810          * skb_network_header_len(skb) is always equal to
 811          * sizeof(struct ipv6hdr) by definition of
 812          * hop-by-hop options.
 813          */
 814         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 815             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 816                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 817                 kfree_skb(skb);
 818                 return -1;
 819         }
 820
 821         opt->flags |= IP6SKB_HOPBYHOP;
 822         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
 823                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 824                 opt = IP6CB(skb);
 825                 opt->nhoff = sizeof(struct ipv6hdr);
 826                 return 1;
 827         }
 828         return -1;
 829 }
 830
 831 /*
 832  *      Creating outbound headers.
 833  *
 834  *      "build" functions work when skb is filled from head to tail (datagram)
 835  *      "push"  functions work when headers are added from tail to head (tcp)
 836  *
 837  *      In both cases we assume, that caller reserved enough room
 838  *      for headers.
 839  */
 840
 841 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
 842                              struct ipv6_rt_hdr *opt,
 843                              struct in6_addr **addr_p, struct in6_addr *saddr)
 844 {
 845         struct rt0_hdr *phdr, *ihdr;
 846         int hops;
 847
 848         ihdr = (struct rt0_hdr *) opt;
 849
 850         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 851         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 852
 853         hops = ihdr->rt_hdr.hdrlen >> 1;
 854
 855         if (hops > 1)
 856                 memcpy(phdr->addr, ihdr->addr + 1,
 857                        (hops - 1) * sizeof(struct in6_addr));
 858
 859         phdr->addr[hops - 1] = **addr_p;
 860         *addr_p = ihdr->addr;
 861
 862         phdr->rt_hdr.nexthdr = *proto;
 863         *proto = NEXTHDR_ROUTING;
 864 }
 865
 866 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
 867                              struct ipv6_rt_hdr *opt,
 868                              struct in6_addr **addr_p, struct in6_addr *saddr)
 869 {
 870         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
 871         int plen, hops;
 872
 873         sr_ihdr = (struct ipv6_sr_hdr *)opt;
 874         plen = (sr_ihdr->hdrlen + 1) << 3;
 875
 876         sr_phdr = skb_push(skb, plen);
 877         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
 878
 879         hops = sr_ihdr->first_segment + 1;
 880         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
 881                (hops - 1) * sizeof(struct in6_addr));
 882
 883         sr_phdr->segments[0] = **addr_p;
 884         *addr_p = &sr_ihdr->segments[hops - 1];
 885
 886 #ifdef CONFIG_IPV6_SEG6_HMAC
 887         if (sr_has_hmac(sr_phdr)) {
 888                 struct net *net = NULL;
 889
 890                 if (skb->dev)
 891                         net = dev_net(skb->dev);
 892                 else if (skb->sk)
 893                         net = sock_net(skb->sk);
 894
 895                 WARN_ON(!net);
 896
 897                 if (net)
 898                         seg6_push_hmac(net, saddr, sr_phdr);
 899         }
 900 #endif
 901
 902         sr_phdr->nexthdr = *proto;
 903         *proto = NEXTHDR_ROUTING;
 904 }
 905
 906 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 907                             struct ipv6_rt_hdr *opt,
 908                             struct in6_addr **addr_p, struct in6_addr *saddr)
 909 {
 910         switch (opt->type) {
 911         case IPV6_SRCRT_TYPE_0:
 912         case IPV6_SRCRT_STRICT:
 913         case IPV6_SRCRT_TYPE_2:
 914                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
 915                 break;
 916         case IPV6_SRCRT_TYPE_4:
 917                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
 918                 break;
 919         default:
 920                 break;
 921         }
 922 }
 923
 924 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 925 {
 926         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
 927
 928         memcpy(h, opt, ipv6_optlen(opt));
 929         h->nexthdr = *proto;
 930         *proto = type;
 931 }
 932
 933 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 934                           u8 *proto,
 935                           struct in6_addr **daddr, struct in6_addr *saddr)
 936 {
 937         if (opt->srcrt) {
 938                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
 939                 /*
 940                  * IPV6_RTHDRDSTOPTS is ignored
 941                  * unless IPV6_RTHDR is set (RFC3542).
 942                  */
 943                 if (opt->dst0opt)
 944                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 945         }
 946         if (opt->hopopt)
 947                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 948 }
 949
 950 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 951 {
 952         if (opt->dst1opt)
 953                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 954 }
 955 EXPORT_SYMBOL(ipv6_push_frag_opts);
 956
 957 struct ipv6_txoptions *
 958 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 959 {
 960         struct ipv6_txoptions *opt2;
 961
 962         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 963         if (opt2) {
 964                 long dif = (char *)opt2 - (char *)opt;
 965                 memcpy(opt2, opt, opt->tot_len);
 966                 if (opt2->hopopt)
 967                         *((char **)&opt2->hopopt) += dif;
 968                 if (opt2->dst0opt)
 969                         *((char **)&opt2->dst0opt) += dif;
 970                 if (opt2->dst1opt)
 971                         *((char **)&opt2->dst1opt) += dif;
 972                 if (opt2->srcrt)
 973                         *((char **)&opt2->srcrt) += dif;
 974                 refcount_set(&opt2->refcnt, 1);
 975         }
 976         return opt2;
 977 }
 978 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 979
 980 static int ipv6_renew_option(void *ohdr,
 981                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
 982                              int inherit,
 983                              struct ipv6_opt_hdr **hdr,
 984                              char **p)
 985 {
 986         if (inherit) {
 987                 if (ohdr) {
 988                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
 989                         *hdr = (struct ipv6_opt_hdr *)*p;
 990                         *p += CMSG_ALIGN(ipv6_optlen(*hdr));
 991                 }
 992         } else {
 993                 if (newopt) {
 994                         if (copy_from_user(*p, newopt, newoptlen))
 995                                 return -EFAULT;
 996                         *hdr = (struct ipv6_opt_hdr *)*p;
 997                         if (ipv6_optlen(*hdr) > newoptlen)
 998                                 return -EINVAL;
 999                         *p += CMSG_ALIGN(newoptlen);
1000                 }
1001         }
1002         return 0;
1003 }
1004
1005 /**
1006  * ipv6_renew_options - replace a specific ext hdr with a new one.
1007  *
1008  * @sk: sock from which to allocate memory
1009  * @opt: original options
1010  * @newtype: option type to replace in @opt
1011  * @newopt: new option of type @newtype to replace (user-mem)
1012  * @newoptlen: length of @newopt
1013  *
1014  * Returns a new set of options which is a copy of @opt with the
1015  * option type @newtype replaced with @newopt.
1016  *
1017  * @opt may be NULL, in which case a new set of options is returned
1018  * containing just @newopt.
1019  *
1020  * @newopt may be NULL, in which case the specified option type is
1021  * not copied into the new set of options.
1022  *
1023  * The new set of options is allocated from the socket option memory
1024  * buffer of @sk.
1025  */
1026 struct ipv6_txoptions *
1027 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1028                    int newtype,
1029                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
1030 {
1031         int tot_len = 0;
1032         char *p;
1033         struct ipv6_txoptions *opt2;
1034         int err;
1035
1036         if (opt) {
1037                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1038                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1039                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1040                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1041                 if (newtype != IPV6_RTHDR && opt->srcrt)
1042                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1043                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1044                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1045         }
1046
1047         if (newopt && newoptlen)
1048                 tot_len += CMSG_ALIGN(newoptlen);
1049
1050         if (!tot_len)
1051                 return NULL;
1052
1053         tot_len += sizeof(*opt2);
1054         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1055         if (!opt2)
1056                 return ERR_PTR(-ENOBUFS);
1057
1058         memset(opt2, 0, tot_len);
1059         refcount_set(&opt2->refcnt, 1);
1060         opt2->tot_len = tot_len;
1061         p = (char *)(opt2 + 1);
1062
1063         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
1064                                 newtype != IPV6_HOPOPTS,
1065                                 &opt2->hopopt, &p);
1066         if (err)
1067                 goto out;
1068
1069         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
1070                                 newtype != IPV6_RTHDRDSTOPTS,
1071                                 &opt2->dst0opt, &p);
1072         if (err)
1073                 goto out;
1074
1075         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
1076                                 newtype != IPV6_RTHDR,
1077                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
1078         if (err)
1079                 goto out;
1080
1081         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
1082                                 newtype != IPV6_DSTOPTS,
1083                                 &opt2->dst1opt, &p);
1084         if (err)
1085                 goto out;
1086
1087         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1088                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1089                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1090         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1091
1092         return opt2;
1093 out:
1094         sock_kfree_s(sk, opt2, opt2->tot_len);
1095         return ERR_PTR(err);
1096 }
1097
1098 /**
1099  * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
1100  *
1101  * @sk: sock from which to allocate memory
1102  * @opt: original options
1103  * @newtype: option type to replace in @opt
1104  * @newopt: new option of type @newtype to replace (kernel-mem)
1105  * @newoptlen: length of @newopt
1106  *
1107  * See ipv6_renew_options().  The difference is that @newopt is
1108  * kernel memory, rather than user memory.
1109  */
1110 struct ipv6_txoptions *
1111 ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
1112                         int newtype, struct ipv6_opt_hdr *newopt,
1113                         int newoptlen)
1114 {
1115         struct ipv6_txoptions *ret_val;
1116         const mm_segment_t old_fs = get_fs();
1117
1118         set_fs(KERNEL_DS);
1119         ret_val = ipv6_renew_options(sk, opt, newtype,
1120                                      (struct ipv6_opt_hdr __user *)newopt,
1121                                      newoptlen);
1122         set_fs(old_fs);
1123         return ret_val;
1124 }
1125
1126 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1127                                           struct ipv6_txoptions *opt)
1128 {
1129         /*
1130          * ignore the dest before srcrt unless srcrt is being included.
1131          * --yoshfuji
1132          */
1133         if (opt && opt->dst0opt && !opt->srcrt) {
1134                 if (opt_space != opt) {
1135                         memcpy(opt_space, opt, sizeof(*opt_space));
1136                         opt = opt_space;
1137                 }
1138                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1139                 opt->dst0opt = NULL;
1140         }
1141
1142         return opt;
1143 }
1144 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1145
1146 /**
1147  * fl6_update_dst - update flowi destination address with info given
1148  *                  by srcrt option, if any.
1149  *
1150  * @fl6: flowi6 for which daddr is to be updated
1151  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1152  * @orig: copy of original daddr address if modified
1153  *
1154  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1155  * and initial value of fl6->daddr set in orig
1156  */
1157 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1158                                 const struct ipv6_txoptions *opt,
1159                                 struct in6_addr *orig)
1160 {
1161         if (!opt || !opt->srcrt)
1162                 return NULL;
1163
1164         *orig = fl6->daddr;
1165
1166         switch (opt->srcrt->type) {
1167         case IPV6_SRCRT_TYPE_0:
1168         case IPV6_SRCRT_STRICT:
1169         case IPV6_SRCRT_TYPE_2:
1170                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1171                 break;
1172         case IPV6_SRCRT_TYPE_4:
1173         {
1174                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1175
1176                 fl6->daddr = srh->segments[srh->first_segment];
1177                 break;
1178         }
1179         default:
1180                 return NULL;
1181         }
1182
1183         return orig;
1184 }
1185 EXPORT_SYMBOL_GPL(fl6_update_dst);