net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #include <net/calipso.h>
  47 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  48 #include <net/xfrm.h>
  49 #endif
  50 #include <linux/seg6.h>
  51 #include <net/seg6.h>
  52 #ifdef CONFIG_IPV6_SEG6_HMAC
  53 #include <net/seg6_hmac.h>
  54 #endif
  55
  56 #include <linux/uaccess.h>
  57
  58 /*
  59  *      Parsing tlv encoded headers.
  60  *
  61  *      Parsing function "func" returns true, if parsing succeed
  62  *      and false, if it failed.
  63  *      It MUST NOT touch skb->h.
  64  */
  65
  66 struct tlvtype_proc {
  67         int     type;
  68         bool    (*func)(struct sk_buff *skb, int offset);
  69 };
  70
  71 /*********************
  72   Generic functions
  73  *********************/
  74
  75 /* An unknown option is detected, decide what to do */
  76
  77 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
  78 {
  79         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  80         case 0: /* ignore */
  81                 return true;
  82
  83         case 1: /* drop packet */
  84                 break;
  85
  86         case 3: /* Send ICMP if not a multicast address and drop packet */
  87                 /* Actually, it is redundant check. icmp_send
  88                    will recheck in any case.
  89                  */
  90                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
  91                         break;
  92         case 2: /* send ICMP PARM PROB regardless and drop packet */
  93                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
  94                 return false;
  95         }
  96
  97         kfree_skb(skb);
  98         return false;
  99 }
 100
 101 /* Parse tlv encoded option header (hop-by-hop or destination) */
 102
 103 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
 104 {
 105         const struct tlvtype_proc *curr;
 106         const unsigned char *nh = skb_network_header(skb);
 107         int off = skb_network_header_len(skb);
 108         int len = (skb_transport_header(skb)[1] + 1) << 3;
 109         int padlen = 0;
 110
 111         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 112                 goto bad;
 113
 114         off += 2;
 115         len -= 2;
 116
 117         while (len > 0) {
 118                 int optlen = nh[off + 1] + 2;
 119                 int i;
 120
 121                 switch (nh[off]) {
 122                 case IPV6_TLV_PAD1:
 123                         optlen = 1;
 124                         padlen++;
 125                         if (padlen > 7)
 126                                 goto bad;
 127                         break;
 128
 129                 case IPV6_TLV_PADN:
 130                         /* RFC 2460 states that the purpose of PadN is
 131                          * to align the containing header to multiples
 132                          * of 8. 7 is therefore the highest valid value.
 133                          * See also RFC 4942, Section 2.1.9.5.
 134                          */
 135                         padlen += optlen;
 136                         if (padlen > 7)
 137                                 goto bad;
 138                         /* RFC 4942 recommends receiving hosts to
 139                          * actively check PadN payload to contain
 140                          * only zeroes.
 141                          */
 142                         for (i = 2; i < optlen; i++) {
 143                                 if (nh[off + i] != 0)
 144                                         goto bad;
 145                         }
 146                         break;
 147
 148                 default: /* Other TLV code so scan list */
 149                         if (optlen > len)
 150                                 goto bad;
 151                         for (curr = procs; curr->type >= 0; curr++) {
 152                                 if (curr->type == nh[off]) {
 153                                         /* type specific length/alignment
 154                                            checks will be performed in the
 155                                            func(). */
 156                                         if (curr->func(skb, off) == false)
 157                                                 return false;
 158                                         break;
 159                                 }
 160                         }
 161                         if (curr->type < 0) {
 162                                 if (ip6_tlvopt_unknown(skb, off) == 0)
 163                                         return false;
 164                         }
 165                         padlen = 0;
 166                         break;
 167                 }
 168                 off += optlen;
 169                 len -= optlen;
 170         }
 171
 172         if (len == 0)
 173                 return true;
 174 bad:
 175         kfree_skb(skb);
 176         return false;
 177 }
 178
 179 /*****************************
 180   Destination options header.
 181  *****************************/
 182
 183 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 184 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 185 {
 186         struct ipv6_destopt_hao *hao;
 187         struct inet6_skb_parm *opt = IP6CB(skb);
 188         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 189         struct in6_addr tmp_addr;
 190         int ret;
 191
 192         if (opt->dsthao) {
 193                 net_dbg_ratelimited("hao duplicated\n");
 194                 goto discard;
 195         }
 196         opt->dsthao = opt->dst1;
 197         opt->dst1 = 0;
 198
 199         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 200
 201         if (hao->length != 16) {
 202                 net_dbg_ratelimited("hao invalid option length = %d\n",
 203                                     hao->length);
 204                 goto discard;
 205         }
 206
 207         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 208                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 209                                     &hao->addr);
 210                 goto discard;
 211         }
 212
 213         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 214                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 215         if (unlikely(ret < 0))
 216                 goto discard;
 217
 218         if (skb_cloned(skb)) {
 219                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 220                         goto discard;
 221
 222                 /* update all variable using below by copied skbuff */
 223                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 224                                                   optoff);
 225                 ipv6h = ipv6_hdr(skb);
 226         }
 227
 228         if (skb->ip_summed == CHECKSUM_COMPLETE)
 229                 skb->ip_summed = CHECKSUM_NONE;
 230
 231         tmp_addr = ipv6h->saddr;
 232         ipv6h->saddr = hao->addr;
 233         hao->addr = tmp_addr;
 234
 235         if (skb->tstamp == 0)
 236                 __net_timestamp(skb);
 237
 238         return true;
 239
 240  discard:
 241         kfree_skb(skb);
 242         return false;
 243 }
 244 #endif
 245
 246 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 247 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 248         {
 249                 .type   = IPV6_TLV_HAO,
 250                 .func   = ipv6_dest_hao,
 251         },
 252 #endif
 253         {-1,                    NULL}
 254 };
 255
 256 static int ipv6_destopt_rcv(struct sk_buff *skb)
 257 {
 258         struct inet6_skb_parm *opt = IP6CB(skb);
 259 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 260         __u16 dstbuf;
 261 #endif
 262         struct dst_entry *dst = skb_dst(skb);
 263
 264         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 265             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 266                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 267                 __IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
 268                                 IPSTATS_MIB_INHDRERRORS);
 269                 kfree_skb(skb);
 270                 return -1;
 271         }
 272
 273         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 274 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 275         dstbuf = opt->dst1;
 276 #endif
 277
 278         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
 279                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 280                 opt = IP6CB(skb);
 281 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 282                 opt->nhoff = dstbuf;
 283 #else
 284                 opt->nhoff = opt->dst1;
 285 #endif
 286                 return 1;
 287         }
 288
 289         __IP6_INC_STATS(dev_net(dst->dev),
 290                         ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 291         return -1;
 292 }
 293
 294 static void seg6_update_csum(struct sk_buff *skb)
 295 {
 296         struct ipv6_sr_hdr *hdr;
 297         struct in6_addr *addr;
 298         __be32 from, to;
 299
 300         /* srh is at transport offset and seg_left is already decremented
 301          * but daddr is not yet updated with next segment
 302          */
 303
 304         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 305         addr = hdr->segments + hdr->segments_left;
 306
 307         hdr->segments_left++;
 308         from = *(__be32 *)hdr;
 309
 310         hdr->segments_left--;
 311         to = *(__be32 *)hdr;
 312
 313         /* update skb csum with diff resulting from seg_left decrement */
 314
 315         update_csum_diff4(skb, from, to);
 316
 317         /* compute csum diff between current and next segment and update */
 318
 319         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 320                            (__be32 *)addr);
 321 }
 322
 323 static int ipv6_srh_rcv(struct sk_buff *skb)
 324 {
 325         struct inet6_skb_parm *opt = IP6CB(skb);
 326         struct net *net = dev_net(skb->dev);
 327         struct ipv6_sr_hdr *hdr;
 328         struct inet6_dev *idev;
 329         struct in6_addr *addr;
 330         bool cleanup = false;
 331         int accept_seg6;
 332
 333         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 334
 335         idev = __in6_dev_get(skb->dev);
 336
 337         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 338         if (accept_seg6 > idev->cnf.seg6_enabled)
 339                 accept_seg6 = idev->cnf.seg6_enabled;
 340
 341         if (!accept_seg6) {
 342                 kfree_skb(skb);
 343                 return -1;
 344         }
 345
 346 #ifdef CONFIG_IPV6_SEG6_HMAC
 347         if (!seg6_hmac_validate_skb(skb)) {
 348                 kfree_skb(skb);
 349                 return -1;
 350         }
 351 #endif
 352
 353 looped_back:
 354         if (hdr->segments_left > 0) {
 355                 if (hdr->nexthdr != NEXTHDR_IPV6 && hdr->segments_left == 1 &&
 356                     sr_has_cleanup(hdr))
 357                         cleanup = true;
 358         } else {
 359                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 360                         int offset = (hdr->hdrlen + 1) << 3;
 361
 362                         skb_postpull_rcsum(skb, skb_network_header(skb),
 363                                            skb_network_header_len(skb));
 364
 365                         if (!pskb_pull(skb, offset)) {
 366                                 kfree_skb(skb);
 367                                 return -1;
 368                         }
 369                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 370                                            offset);
 371
 372                         skb_reset_network_header(skb);
 373                         skb_reset_transport_header(skb);
 374                         skb->encapsulation = 0;
 375
 376                         __skb_tunnel_rx(skb, skb->dev, net);
 377
 378                         netif_rx(skb);
 379                         return -1;
 380                 }
 381
 382                 opt->srcrt = skb_network_header_len(skb);
 383                 opt->lastopt = opt->srcrt;
 384                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 385                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 386
 387                 return 1;
 388         }
 389
 390         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 391                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 392                                 IPSTATS_MIB_INHDRERRORS);
 393                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 394                                   ((&hdr->segments_left) -
 395                                    skb_network_header(skb)));
 396                 kfree_skb(skb);
 397                 return -1;
 398         }
 399
 400         if (skb_cloned(skb)) {
 401                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 402                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 403                                         IPSTATS_MIB_OUTDISCARDS);
 404                         kfree_skb(skb);
 405                         return -1;
 406                 }
 407         }
 408
 409         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 410
 411         hdr->segments_left--;
 412         addr = hdr->segments + hdr->segments_left;
 413
 414         skb_push(skb, sizeof(struct ipv6hdr));
 415
 416         if (skb->ip_summed == CHECKSUM_COMPLETE)
 417                 seg6_update_csum(skb);
 418
 419         ipv6_hdr(skb)->daddr = *addr;
 420
 421         if (cleanup) {
 422                 int srhlen = (hdr->hdrlen + 1) << 3;
 423                 int nh = hdr->nexthdr;
 424
 425                 skb_pull_rcsum(skb, sizeof(struct ipv6hdr) + srhlen);
 426                 memmove(skb_network_header(skb) + srhlen,
 427                         skb_network_header(skb),
 428                         (unsigned char *)hdr - skb_network_header(skb));
 429                 skb->network_header += srhlen;
 430                 ipv6_hdr(skb)->nexthdr = nh;
 431                 ipv6_hdr(skb)->payload_len = htons(skb->len -
 432                                                    sizeof(struct ipv6hdr));
 433                 skb_push_rcsum(skb, sizeof(struct ipv6hdr));
 434         }
 435
 436         skb_dst_drop(skb);
 437
 438         ip6_route_input(skb);
 439
 440         if (skb_dst(skb)->error) {
 441                 dst_input(skb);
 442                 return -1;
 443         }
 444
 445         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 446                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 447                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 448                                         IPSTATS_MIB_INHDRERRORS);
 449                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 450                                     ICMPV6_EXC_HOPLIMIT, 0);
 451                         kfree_skb(skb);
 452                         return -1;
 453                 }
 454                 ipv6_hdr(skb)->hop_limit--;
 455
 456                 /* be sure that srh is still present before reinjecting */
 457                 if (!cleanup) {
 458                         skb_pull(skb, sizeof(struct ipv6hdr));
 459                         goto looped_back;
 460                 }
 461                 skb_set_transport_header(skb, sizeof(struct ipv6hdr));
 462                 IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 463         }
 464
 465         dst_input(skb);
 466
 467         return -1;
 468 }
 469
 470 /********************************
 471   Routing header.
 472  ********************************/
 473
 474 /* called with rcu_read_lock() */
 475 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 476 {
 477         struct inet6_skb_parm *opt = IP6CB(skb);
 478         struct in6_addr *addr = NULL;
 479         struct in6_addr daddr;
 480         struct inet6_dev *idev;
 481         int n, i;
 482         struct ipv6_rt_hdr *hdr;
 483         struct rt0_hdr *rthdr;
 484         struct net *net = dev_net(skb->dev);
 485         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 486
 487         idev = __in6_dev_get(skb->dev);
 488         if (idev && accept_source_route > idev->cnf.accept_source_route)
 489                 accept_source_route = idev->cnf.accept_source_route;
 490
 491         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 492             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 493                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 494                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 495                                 IPSTATS_MIB_INHDRERRORS);
 496                 kfree_skb(skb);
 497                 return -1;
 498         }
 499
 500         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 501
 502         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 503             skb->pkt_type != PACKET_HOST) {
 504                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 505                                 IPSTATS_MIB_INADDRERRORS);
 506                 kfree_skb(skb);
 507                 return -1;
 508         }
 509
 510         /* segment routing */
 511         if (hdr->type == IPV6_SRCRT_TYPE_4)
 512                 return ipv6_srh_rcv(skb);
 513
 514 looped_back:
 515         if (hdr->segments_left == 0) {
 516                 switch (hdr->type) {
 517 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 518                 case IPV6_SRCRT_TYPE_2:
 519                         /* Silently discard type 2 header unless it was
 520                          * processed by own
 521                          */
 522                         if (!addr) {
 523                                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 524                                                 IPSTATS_MIB_INADDRERRORS);
 525                                 kfree_skb(skb);
 526                                 return -1;
 527                         }
 528                         break;
 529 #endif
 530                 default:
 531                         break;
 532                 }
 533
 534                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 535                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 536                 opt->dst0 = opt->dst1;
 537                 opt->dst1 = 0;
 538                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 539                 return 1;
 540         }
 541
 542         switch (hdr->type) {
 543 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 544         case IPV6_SRCRT_TYPE_2:
 545                 if (accept_source_route < 0)
 546                         goto unknown_rh;
 547                 /* Silently discard invalid RTH type 2 */
 548                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 549                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 550                                         IPSTATS_MIB_INHDRERRORS);
 551                         kfree_skb(skb);
 552                         return -1;
 553                 }
 554                 break;
 555 #endif
 556         default:
 557                 goto unknown_rh;
 558         }
 559
 560         /*
 561          *      This is the routing header forwarding algorithm from
 562          *      RFC 2460, page 16.
 563          */
 564
 565         n = hdr->hdrlen >> 1;
 566
 567         if (hdr->segments_left > n) {
 568                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 569                                 IPSTATS_MIB_INHDRERRORS);
 570                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 571                                   ((&hdr->segments_left) -
 572                                    skb_network_header(skb)));
 573                 return -1;
 574         }
 575
 576         /* We are about to mangle packet header. Be careful!
 577            Do not damage packets queued somewhere.
 578          */
 579         if (skb_cloned(skb)) {
 580                 /* the copy is a forwarded packet */
 581                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 582                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 583                                         IPSTATS_MIB_OUTDISCARDS);
 584                         kfree_skb(skb);
 585                         return -1;
 586                 }
 587                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 588         }
 589
 590         if (skb->ip_summed == CHECKSUM_COMPLETE)
 591                 skb->ip_summed = CHECKSUM_NONE;
 592
 593         i = n - --hdr->segments_left;
 594
 595         rthdr = (struct rt0_hdr *) hdr;
 596         addr = rthdr->addr;
 597         addr += i - 1;
 598
 599         switch (hdr->type) {
 600 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 601         case IPV6_SRCRT_TYPE_2:
 602                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 603                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 604                                      IPPROTO_ROUTING) < 0) {
 605                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 606                                         IPSTATS_MIB_INADDRERRORS);
 607                         kfree_skb(skb);
 608                         return -1;
 609                 }
 610                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 611                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 612                                         IPSTATS_MIB_INADDRERRORS);
 613                         kfree_skb(skb);
 614                         return -1;
 615                 }
 616                 break;
 617 #endif
 618         default:
 619                 break;
 620         }
 621
 622         if (ipv6_addr_is_multicast(addr)) {
 623                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 624                                 IPSTATS_MIB_INADDRERRORS);
 625                 kfree_skb(skb);
 626                 return -1;
 627         }
 628
 629         daddr = *addr;
 630         *addr = ipv6_hdr(skb)->daddr;
 631         ipv6_hdr(skb)->daddr = daddr;
 632
 633         skb_dst_drop(skb);
 634         ip6_route_input(skb);
 635         if (skb_dst(skb)->error) {
 636                 skb_push(skb, skb->data - skb_network_header(skb));
 637                 dst_input(skb);
 638                 return -1;
 639         }
 640
 641         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 642                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 643                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 644                                         IPSTATS_MIB_INHDRERRORS);
 645                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 646                                     0);
 647                         kfree_skb(skb);
 648                         return -1;
 649                 }
 650                 ipv6_hdr(skb)->hop_limit--;
 651                 goto looped_back;
 652         }
 653
 654         skb_push(skb, skb->data - skb_network_header(skb));
 655         dst_input(skb);
 656         return -1;
 657
 658 unknown_rh:
 659         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
 660         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 661                           (&hdr->type) - skb_network_header(skb));
 662         return -1;
 663 }
 664
 665 static const struct inet6_protocol rthdr_protocol = {
 666         .handler        =       ipv6_rthdr_rcv,
 667         .flags          =       INET6_PROTO_NOPOLICY,
 668 };
 669
 670 static const struct inet6_protocol destopt_protocol = {
 671         .handler        =       ipv6_destopt_rcv,
 672         .flags          =       INET6_PROTO_NOPOLICY,
 673 };
 674
 675 static const struct inet6_protocol nodata_protocol = {
 676         .handler        =       dst_discard,
 677         .flags          =       INET6_PROTO_NOPOLICY,
 678 };
 679
 680 int __init ipv6_exthdrs_init(void)
 681 {
 682         int ret;
 683
 684         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 685         if (ret)
 686                 goto out;
 687
 688         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 689         if (ret)
 690                 goto out_rthdr;
 691
 692         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 693         if (ret)
 694                 goto out_destopt;
 695
 696 out:
 697         return ret;
 698 out_destopt:
 699         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 700 out_rthdr:
 701         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 702         goto out;
 703 };
 704
 705 void ipv6_exthdrs_exit(void)
 706 {
 707         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 708         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 709         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 710 }
 711
 712 /**********************************
 713   Hop-by-hop options.
 714  **********************************/
 715
 716 /*
 717  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 718  */
 719 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 720 {
 721         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 722 }
 723
 724 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 725 {
 726         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 727 }
 728
 729 /* Router Alert as of RFC 2711 */
 730
 731 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 732 {
 733         const unsigned char *nh = skb_network_header(skb);
 734
 735         if (nh[optoff + 1] == 2) {
 736                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 737                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 738                 return true;
 739         }
 740         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 741                             nh[optoff + 1]);
 742         kfree_skb(skb);
 743         return false;
 744 }
 745
 746 /* Jumbo payload */
 747
 748 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 749 {
 750         const unsigned char *nh = skb_network_header(skb);
 751         struct net *net = ipv6_skb_net(skb);
 752         u32 pkt_len;
 753
 754         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 755                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 756                                     nh[optoff+1]);
 757                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 758                                 IPSTATS_MIB_INHDRERRORS);
 759                 goto drop;
 760         }
 761
 762         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 763         if (pkt_len <= IPV6_MAXPLEN) {
 764                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 765                                 IPSTATS_MIB_INHDRERRORS);
 766                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 767                 return false;
 768         }
 769         if (ipv6_hdr(skb)->payload_len) {
 770                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 771                                 IPSTATS_MIB_INHDRERRORS);
 772                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 773                 return false;
 774         }
 775
 776         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 777                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 778                                 IPSTATS_MIB_INTRUNCATEDPKTS);
 779                 goto drop;
 780         }
 781
 782         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 783                 goto drop;
 784
 785         return true;
 786
 787 drop:
 788         kfree_skb(skb);
 789         return false;
 790 }
 791
 792 /* CALIPSO RFC 5570 */
 793
 794 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 795 {
 796         const unsigned char *nh = skb_network_header(skb);
 797
 798         if (nh[optoff + 1] < 8)
 799                 goto drop;
 800
 801         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 802                 goto drop;
 803
 804         if (!calipso_validate(skb, nh + optoff))
 805                 goto drop;
 806
 807         return true;
 808
 809 drop:
 810         kfree_skb(skb);
 811         return false;
 812 }
 813
 814 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 815         {
 816                 .type   = IPV6_TLV_ROUTERALERT,
 817                 .func   = ipv6_hop_ra,
 818         },
 819         {
 820                 .type   = IPV6_TLV_JUMBO,
 821                 .func   = ipv6_hop_jumbo,
 822         },
 823         {
 824                 .type   = IPV6_TLV_CALIPSO,
 825                 .func   = ipv6_hop_calipso,
 826         },
 827         { -1, }
 828 };
 829
 830 int ipv6_parse_hopopts(struct sk_buff *skb)
 831 {
 832         struct inet6_skb_parm *opt = IP6CB(skb);
 833
 834         /*
 835          * skb_network_header(skb) is equal to skb->data, and
 836          * skb_network_header_len(skb) is always equal to
 837          * sizeof(struct ipv6hdr) by definition of
 838          * hop-by-hop options.
 839          */
 840         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 841             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 842                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 843                 kfree_skb(skb);
 844                 return -1;
 845         }
 846
 847         opt->flags |= IP6SKB_HOPBYHOP;
 848         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
 849                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 850                 opt = IP6CB(skb);
 851                 opt->nhoff = sizeof(struct ipv6hdr);
 852                 return 1;
 853         }
 854         return -1;
 855 }
 856
 857 /*
 858  *      Creating outbound headers.
 859  *
 860  *      "build" functions work when skb is filled from head to tail (datagram)
 861  *      "push"  functions work when headers are added from tail to head (tcp)
 862  *
 863  *      In both cases we assume, that caller reserved enough room
 864  *      for headers.
 865  */
 866
 867 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
 868                              struct ipv6_rt_hdr *opt,
 869                              struct in6_addr **addr_p, struct in6_addr *saddr)
 870 {
 871         struct rt0_hdr *phdr, *ihdr;
 872         int hops;
 873
 874         ihdr = (struct rt0_hdr *) opt;
 875
 876         phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 877         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 878
 879         hops = ihdr->rt_hdr.hdrlen >> 1;
 880
 881         if (hops > 1)
 882                 memcpy(phdr->addr, ihdr->addr + 1,
 883                        (hops - 1) * sizeof(struct in6_addr));
 884
 885         phdr->addr[hops - 1] = **addr_p;
 886         *addr_p = ihdr->addr;
 887
 888         phdr->rt_hdr.nexthdr = *proto;
 889         *proto = NEXTHDR_ROUTING;
 890 }
 891
 892 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
 893                              struct ipv6_rt_hdr *opt,
 894                              struct in6_addr **addr_p, struct in6_addr *saddr)
 895 {
 896         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
 897         int plen, hops;
 898
 899         sr_ihdr = (struct ipv6_sr_hdr *)opt;
 900         plen = (sr_ihdr->hdrlen + 1) << 3;
 901
 902         sr_phdr = (struct ipv6_sr_hdr *)skb_push(skb, plen);
 903         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
 904
 905         hops = sr_ihdr->first_segment + 1;
 906         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
 907                (hops - 1) * sizeof(struct in6_addr));
 908
 909         sr_phdr->segments[0] = **addr_p;
 910         *addr_p = &sr_ihdr->segments[hops - 1];
 911
 912 #ifdef CONFIG_IPV6_SEG6_HMAC
 913         if (sr_has_hmac(sr_phdr)) {
 914                 struct net *net = NULL;
 915
 916                 if (skb->dev)
 917                         net = dev_net(skb->dev);
 918                 else if (skb->sk)
 919                         net = sock_net(skb->sk);
 920
 921                 WARN_ON(!net);
 922
 923                 if (net)
 924                         seg6_push_hmac(net, saddr, sr_phdr);
 925         }
 926 #endif
 927
 928         sr_phdr->nexthdr = *proto;
 929         *proto = NEXTHDR_ROUTING;
 930 }
 931
 932 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 933                             struct ipv6_rt_hdr *opt,
 934                             struct in6_addr **addr_p, struct in6_addr *saddr)
 935 {
 936         switch (opt->type) {
 937         case IPV6_SRCRT_TYPE_0:
 938                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
 939                 break;
 940         case IPV6_SRCRT_TYPE_4:
 941                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
 942                 break;
 943         default:
 944                 break;
 945         }
 946 }
 947
 948 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 949 {
 950         struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));
 951
 952         memcpy(h, opt, ipv6_optlen(opt));
 953         h->nexthdr = *proto;
 954         *proto = type;
 955 }
 956
 957 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 958                           u8 *proto,
 959                           struct in6_addr **daddr, struct in6_addr *saddr)
 960 {
 961         if (opt->srcrt) {
 962                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
 963                 /*
 964                  * IPV6_RTHDRDSTOPTS is ignored
 965                  * unless IPV6_RTHDR is set (RFC3542).
 966                  */
 967                 if (opt->dst0opt)
 968                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 969         }
 970         if (opt->hopopt)
 971                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 972 }
 973 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 974
 975 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 976 {
 977         if (opt->dst1opt)
 978                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 979 }
 980
 981 struct ipv6_txoptions *
 982 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 983 {
 984         struct ipv6_txoptions *opt2;
 985
 986         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 987         if (opt2) {
 988                 long dif = (char *)opt2 - (char *)opt;
 989                 memcpy(opt2, opt, opt->tot_len);
 990                 if (opt2->hopopt)
 991                         *((char **)&opt2->hopopt) += dif;
 992                 if (opt2->dst0opt)
 993                         *((char **)&opt2->dst0opt) += dif;
 994                 if (opt2->dst1opt)
 995                         *((char **)&opt2->dst1opt) += dif;
 996                 if (opt2->srcrt)
 997                         *((char **)&opt2->srcrt) += dif;
 998                 atomic_set(&opt2->refcnt, 1);
 999         }
1000         return opt2;
1001 }
1002 EXPORT_SYMBOL_GPL(ipv6_dup_options);
1003
1004 static int ipv6_renew_option(void *ohdr,
1005                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
1006                              int inherit,
1007                              struct ipv6_opt_hdr **hdr,
1008                              char **p)
1009 {
1010         if (inherit) {
1011                 if (ohdr) {
1012                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
1013                         *hdr = (struct ipv6_opt_hdr *)*p;
1014                         *p += CMSG_ALIGN(ipv6_optlen(*hdr));
1015                 }
1016         } else {
1017                 if (newopt) {
1018                         if (copy_from_user(*p, newopt, newoptlen))
1019                                 return -EFAULT;
1020                         *hdr = (struct ipv6_opt_hdr *)*p;
1021                         if (ipv6_optlen(*hdr) > newoptlen)
1022                                 return -EINVAL;
1023                         *p += CMSG_ALIGN(newoptlen);
1024                 }
1025         }
1026         return 0;
1027 }
1028
1029 /**
1030  * ipv6_renew_options - replace a specific ext hdr with a new one.
1031  *
1032  * @sk: sock from which to allocate memory
1033  * @opt: original options
1034  * @newtype: option type to replace in @opt
1035  * @newopt: new option of type @newtype to replace (user-mem)
1036  * @newoptlen: length of @newopt
1037  *
1038  * Returns a new set of options which is a copy of @opt with the
1039  * option type @newtype replaced with @newopt.
1040  *
1041  * @opt may be NULL, in which case a new set of options is returned
1042  * containing just @newopt.
1043  *
1044  * @newopt may be NULL, in which case the specified option type is
1045  * not copied into the new set of options.
1046  *
1047  * The new set of options is allocated from the socket option memory
1048  * buffer of @sk.
1049  */
1050 struct ipv6_txoptions *
1051 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1052                    int newtype,
1053                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
1054 {
1055         int tot_len = 0;
1056         char *p;
1057         struct ipv6_txoptions *opt2;
1058         int err;
1059
1060         if (opt) {
1061                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1062                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1063                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1064                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1065                 if (newtype != IPV6_RTHDR && opt->srcrt)
1066                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1067                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1068                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1069         }
1070
1071         if (newopt && newoptlen)
1072                 tot_len += CMSG_ALIGN(newoptlen);
1073
1074         if (!tot_len)
1075                 return NULL;
1076
1077         tot_len += sizeof(*opt2);
1078         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1079         if (!opt2)
1080                 return ERR_PTR(-ENOBUFS);
1081
1082         memset(opt2, 0, tot_len);
1083         atomic_set(&opt2->refcnt, 1);
1084         opt2->tot_len = tot_len;
1085         p = (char *)(opt2 + 1);
1086
1087         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
1088                                 newtype != IPV6_HOPOPTS,
1089                                 &opt2->hopopt, &p);
1090         if (err)
1091                 goto out;
1092
1093         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
1094                                 newtype != IPV6_RTHDRDSTOPTS,
1095                                 &opt2->dst0opt, &p);
1096         if (err)
1097                 goto out;
1098
1099         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
1100                                 newtype != IPV6_RTHDR,
1101                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
1102         if (err)
1103                 goto out;
1104
1105         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
1106                                 newtype != IPV6_DSTOPTS,
1107                                 &opt2->dst1opt, &p);
1108         if (err)
1109                 goto out;
1110
1111         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1112                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1113                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1114         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1115
1116         return opt2;
1117 out:
1118         sock_kfree_s(sk, opt2, opt2->tot_len);
1119         return ERR_PTR(err);
1120 }
1121
1122 /**
1123  * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
1124  *
1125  * @sk: sock from which to allocate memory
1126  * @opt: original options
1127  * @newtype: option type to replace in @opt
1128  * @newopt: new option of type @newtype to replace (kernel-mem)
1129  * @newoptlen: length of @newopt
1130  *
1131  * See ipv6_renew_options().  The difference is that @newopt is
1132  * kernel memory, rather than user memory.
1133  */
1134 struct ipv6_txoptions *
1135 ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
1136                         int newtype, struct ipv6_opt_hdr *newopt,
1137                         int newoptlen)
1138 {
1139         struct ipv6_txoptions *ret_val;
1140         const mm_segment_t old_fs = get_fs();
1141
1142         set_fs(KERNEL_DS);
1143         ret_val = ipv6_renew_options(sk, opt, newtype,
1144                                      (struct ipv6_opt_hdr __user *)newopt,
1145                                      newoptlen);
1146         set_fs(old_fs);
1147         return ret_val;
1148 }
1149
1150 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1151                                           struct ipv6_txoptions *opt)
1152 {
1153         /*
1154          * ignore the dest before srcrt unless srcrt is being included.
1155          * --yoshfuji
1156          */
1157         if (opt && opt->dst0opt && !opt->srcrt) {
1158                 if (opt_space != opt) {
1159                         memcpy(opt_space, opt, sizeof(*opt_space));
1160                         opt = opt_space;
1161                 }
1162                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1163                 opt->dst0opt = NULL;
1164         }
1165
1166         return opt;
1167 }
1168 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1169
1170 /**
1171  * fl6_update_dst - update flowi destination address with info given
1172  *                  by srcrt option, if any.
1173  *
1174  * @fl6: flowi6 for which daddr is to be updated
1175  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1176  * @orig: copy of original daddr address if modified
1177  *
1178  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1179  * and initial value of fl6->daddr set in orig
1180  */
1181 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1182                                 const struct ipv6_txoptions *opt,
1183                                 struct in6_addr *orig)
1184 {
1185         if (!opt || !opt->srcrt)
1186                 return NULL;
1187
1188         *orig = fl6->daddr;
1189
1190         switch (opt->srcrt->type) {
1191         case IPV6_SRCRT_TYPE_0:
1192                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1193                 break;
1194         case IPV6_SRCRT_TYPE_4:
1195         {
1196                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1197
1198                 fl6->daddr = srh->segments[srh->first_segment];
1199                 break;
1200         }
1201         default:
1202                 return NULL;
1203         }
1204
1205         return orig;
1206 }
1207 EXPORT_SYMBOL_GPL(fl6_update_dst);