xref: /openbmc/linux/net/ipv4/route.c (revision 62e7ca52)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		ROUTE - implementation of the IP router.
7  *
8  * Authors:	Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
11  *		Linus Torvalds, <Linus.Torvalds@helsinki.fi>
12  *		Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
13  *
14  * Fixes:
15  *		Alan Cox	:	Verify area fixes.
16  *		Alan Cox	:	cli() protects routing changes
17  *		Rui Oliveira	:	ICMP routing table updates
18  *		(rco@di.uminho.pt)	Routing table insertion and update
19  *		Linus Torvalds	:	Rewrote bits to be sensible
20  *		Alan Cox	:	Added BSD route gw semantics
21  *		Alan Cox	:	Super /proc >4K
22  *		Alan Cox	:	MTU in route table
23  *		Alan Cox	: 	MSS actually. Also added the window
24  *					clamper.
25  *		Sam Lantinga	:	Fixed route matching in rt_del()
26  *		Alan Cox	:	Routing cache support.
27  *		Alan Cox	:	Removed compatibility cruft.
28  *		Alan Cox	:	RTF_REJECT support.
29  *		Alan Cox	:	TCP irtt support.
30  *		Jonathan Naylor	:	Added Metric support.
31  *	Miquel van Smoorenburg	:	BSD API fixes.
32  *	Miquel van Smoorenburg	:	Metrics.
33  *		Alan Cox	:	Use __u32 properly
34  *		Alan Cox	:	Aligned routing errors more closely with BSD
35  *					our system is still very different.
36  *		Alan Cox	:	Faster /proc handling
37  *	Alexey Kuznetsov	:	Massive rework to support tree based routing,
38  *					routing caches and better behaviour.
39  *
40  *		Olaf Erb	:	irtt wasn't being copied right.
41  *		Bjorn Ekwall	:	Kerneld route support.
42  *		Alan Cox	:	Multicast fixed (I hope)
43  * 		Pavel Krauz	:	Limited broadcast fixed
44  *		Mike McLagan	:	Routing by source
45  *	Alexey Kuznetsov	:	End of old history. Split to fib.c and
46  *					route.c and rewritten from scratch.
47  *		Andi Kleen	:	Load-limit warning messages.
48  *	Vitaly E. Lavrov	:	Transparent proxy revived after year coma.
49  *	Vitaly E. Lavrov	:	Race condition in ip_route_input_slow.
50  *	Tobias Ringstrom	:	Uninitialized res.type in ip_route_output_slow.
51  *	Vladimir V. Ivanov	:	IP rule info (flowid) is really useful.
52  *		Marc Boucher	:	routing by fwmark
53  *	Robert Olsson		:	Added rt_cache statistics
54  *	Arnaldo C. Melo		:	Convert proc stuff to seq_file
55  *	Eric Dumazet		:	hashed spinlocks and rt_check_expire() fixes.
56  * 	Ilia Sotnikov		:	Ignore TOS on PMTUD and Redirect
57  * 	Ilia Sotnikov		:	Removed TOS from hash calculations
58  *
59  *		This program is free software; you can redistribute it and/or
60  *		modify it under the terms of the GNU General Public License
61  *		as published by the Free Software Foundation; either version
62  *		2 of the License, or (at your option) any later version.
63  */
64 
65 #define pr_fmt(fmt) "IPv4: " fmt
66 
67 #include <linux/module.h>
68 #include <asm/uaccess.h>
69 #include <linux/bitops.h>
70 #include <linux/types.h>
71 #include <linux/kernel.h>
72 #include <linux/mm.h>
73 #include <linux/string.h>
74 #include <linux/socket.h>
75 #include <linux/sockios.h>
76 #include <linux/errno.h>
77 #include <linux/in.h>
78 #include <linux/inet.h>
79 #include <linux/netdevice.h>
80 #include <linux/proc_fs.h>
81 #include <linux/init.h>
82 #include <linux/skbuff.h>
83 #include <linux/inetdevice.h>
84 #include <linux/igmp.h>
85 #include <linux/pkt_sched.h>
86 #include <linux/mroute.h>
87 #include <linux/netfilter_ipv4.h>
88 #include <linux/random.h>
89 #include <linux/rcupdate.h>
90 #include <linux/times.h>
91 #include <linux/slab.h>
92 #include <linux/jhash.h>
93 #include <net/dst.h>
94 #include <net/net_namespace.h>
95 #include <net/protocol.h>
96 #include <net/ip.h>
97 #include <net/route.h>
98 #include <net/inetpeer.h>
99 #include <net/sock.h>
100 #include <net/ip_fib.h>
101 #include <net/arp.h>
102 #include <net/tcp.h>
103 #include <net/icmp.h>
104 #include <net/xfrm.h>
105 #include <net/netevent.h>
106 #include <net/rtnetlink.h>
107 #ifdef CONFIG_SYSCTL
108 #include <linux/sysctl.h>
109 #include <linux/kmemleak.h>
110 #endif
111 #include <net/secure_seq.h>
112 
113 #define RT_FL_TOS(oldflp4) \
114 	((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
115 
116 #define RT_GC_TIMEOUT (300*HZ)
117 
118 static int ip_rt_max_size;
119 static int ip_rt_redirect_number __read_mostly	= 9;
120 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
121 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
122 static int ip_rt_error_cost __read_mostly	= HZ;
123 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
124 static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
125 static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
126 static int ip_rt_min_advmss __read_mostly	= 256;
127 
128 /*
129  *	Interface to generic destination cache.
130  */
131 
132 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
133 static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);
134 static unsigned int	 ipv4_mtu(const struct dst_entry *dst);
135 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
136 static void		 ipv4_link_failure(struct sk_buff *skb);
137 static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
138 					   struct sk_buff *skb, u32 mtu);
139 static void		 ip_do_redirect(struct dst_entry *dst, struct sock *sk,
140 					struct sk_buff *skb);
141 static void		ipv4_dst_destroy(struct dst_entry *dst);
142 
143 static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
144 {
145 	WARN_ON(1);
146 	return NULL;
147 }
148 
149 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
150 					   struct sk_buff *skb,
151 					   const void *daddr);
152 
153 static struct dst_ops ipv4_dst_ops = {
154 	.family =		AF_INET,
155 	.protocol =		cpu_to_be16(ETH_P_IP),
156 	.check =		ipv4_dst_check,
157 	.default_advmss =	ipv4_default_advmss,
158 	.mtu =			ipv4_mtu,
159 	.cow_metrics =		ipv4_cow_metrics,
160 	.destroy =		ipv4_dst_destroy,
161 	.negative_advice =	ipv4_negative_advice,
162 	.link_failure =		ipv4_link_failure,
163 	.update_pmtu =		ip_rt_update_pmtu,
164 	.redirect =		ip_do_redirect,
165 	.local_out =		__ip_local_out,
166 	.neigh_lookup =		ipv4_neigh_lookup,
167 };
168 
169 #define ECN_OR_COST(class)	TC_PRIO_##class
170 
171 const __u8 ip_tos2prio[16] = {
172 	TC_PRIO_BESTEFFORT,
173 	ECN_OR_COST(BESTEFFORT),
174 	TC_PRIO_BESTEFFORT,
175 	ECN_OR_COST(BESTEFFORT),
176 	TC_PRIO_BULK,
177 	ECN_OR_COST(BULK),
178 	TC_PRIO_BULK,
179 	ECN_OR_COST(BULK),
180 	TC_PRIO_INTERACTIVE,
181 	ECN_OR_COST(INTERACTIVE),
182 	TC_PRIO_INTERACTIVE,
183 	ECN_OR_COST(INTERACTIVE),
184 	TC_PRIO_INTERACTIVE_BULK,
185 	ECN_OR_COST(INTERACTIVE_BULK),
186 	TC_PRIO_INTERACTIVE_BULK,
187 	ECN_OR_COST(INTERACTIVE_BULK)
188 };
189 EXPORT_SYMBOL(ip_tos2prio);
190 
191 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
192 #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
193 
194 #ifdef CONFIG_PROC_FS
195 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
196 {
197 	if (*pos)
198 		return NULL;
199 	return SEQ_START_TOKEN;
200 }
201 
202 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
203 {
204 	++*pos;
205 	return NULL;
206 }
207 
208 static void rt_cache_seq_stop(struct seq_file *seq, void *v)
209 {
210 }
211 
212 static int rt_cache_seq_show(struct seq_file *seq, void *v)
213 {
214 	if (v == SEQ_START_TOKEN)
215 		seq_printf(seq, "%-127s\n",
216 			   "Iface\tDestination\tGateway \tFlags\t\tRefCnt\tUse\t"
217 			   "Metric\tSource\t\tMTU\tWindow\tIRTT\tTOS\tHHRef\t"
218 			   "HHUptod\tSpecDst");
219 	return 0;
220 }
221 
222 static const struct seq_operations rt_cache_seq_ops = {
223 	.start  = rt_cache_seq_start,
224 	.next   = rt_cache_seq_next,
225 	.stop   = rt_cache_seq_stop,
226 	.show   = rt_cache_seq_show,
227 };
228 
229 static int rt_cache_seq_open(struct inode *inode, struct file *file)
230 {
231 	return seq_open(file, &rt_cache_seq_ops);
232 }
233 
234 static const struct file_operations rt_cache_seq_fops = {
235 	.owner	 = THIS_MODULE,
236 	.open	 = rt_cache_seq_open,
237 	.read	 = seq_read,
238 	.llseek	 = seq_lseek,
239 	.release = seq_release,
240 };
241 
242 
243 static void *rt_cpu_seq_start(struct seq_file *seq, loff_t *pos)
244 {
245 	int cpu;
246 
247 	if (*pos == 0)
248 		return SEQ_START_TOKEN;
249 
250 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
251 		if (!cpu_possible(cpu))
252 			continue;
253 		*pos = cpu+1;
254 		return &per_cpu(rt_cache_stat, cpu);
255 	}
256 	return NULL;
257 }
258 
259 static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
260 {
261 	int cpu;
262 
263 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
264 		if (!cpu_possible(cpu))
265 			continue;
266 		*pos = cpu+1;
267 		return &per_cpu(rt_cache_stat, cpu);
268 	}
269 	return NULL;
270 
271 }
272 
273 static void rt_cpu_seq_stop(struct seq_file *seq, void *v)
274 {
275 
276 }
277 
278 static int rt_cpu_seq_show(struct seq_file *seq, void *v)
279 {
280 	struct rt_cache_stat *st = v;
281 
282 	if (v == SEQ_START_TOKEN) {
283 		seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
284 		return 0;
285 	}
286 
287 	seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
288 		   " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
289 		   dst_entries_get_slow(&ipv4_dst_ops),
290 		   0, /* st->in_hit */
291 		   st->in_slow_tot,
292 		   st->in_slow_mc,
293 		   st->in_no_route,
294 		   st->in_brd,
295 		   st->in_martian_dst,
296 		   st->in_martian_src,
297 
298 		   0, /* st->out_hit */
299 		   st->out_slow_tot,
300 		   st->out_slow_mc,
301 
302 		   0, /* st->gc_total */
303 		   0, /* st->gc_ignored */
304 		   0, /* st->gc_goal_miss */
305 		   0, /* st->gc_dst_overflow */
306 		   0, /* st->in_hlist_search */
307 		   0  /* st->out_hlist_search */
308 		);
309 	return 0;
310 }
311 
312 static const struct seq_operations rt_cpu_seq_ops = {
313 	.start  = rt_cpu_seq_start,
314 	.next   = rt_cpu_seq_next,
315 	.stop   = rt_cpu_seq_stop,
316 	.show   = rt_cpu_seq_show,
317 };
318 
319 
320 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
321 {
322 	return seq_open(file, &rt_cpu_seq_ops);
323 }
324 
325 static const struct file_operations rt_cpu_seq_fops = {
326 	.owner	 = THIS_MODULE,
327 	.open	 = rt_cpu_seq_open,
328 	.read	 = seq_read,
329 	.llseek	 = seq_lseek,
330 	.release = seq_release,
331 };
332 
333 #ifdef CONFIG_IP_ROUTE_CLASSID
334 static int rt_acct_proc_show(struct seq_file *m, void *v)
335 {
336 	struct ip_rt_acct *dst, *src;
337 	unsigned int i, j;
338 
339 	dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
340 	if (!dst)
341 		return -ENOMEM;
342 
343 	for_each_possible_cpu(i) {
344 		src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
345 		for (j = 0; j < 256; j++) {
346 			dst[j].o_bytes   += src[j].o_bytes;
347 			dst[j].o_packets += src[j].o_packets;
348 			dst[j].i_bytes   += src[j].i_bytes;
349 			dst[j].i_packets += src[j].i_packets;
350 		}
351 	}
352 
353 	seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
354 	kfree(dst);
355 	return 0;
356 }
357 
358 static int rt_acct_proc_open(struct inode *inode, struct file *file)
359 {
360 	return single_open(file, rt_acct_proc_show, NULL);
361 }
362 
363 static const struct file_operations rt_acct_proc_fops = {
364 	.owner		= THIS_MODULE,
365 	.open		= rt_acct_proc_open,
366 	.read		= seq_read,
367 	.llseek		= seq_lseek,
368 	.release	= single_release,
369 };
370 #endif
371 
372 static int __net_init ip_rt_do_proc_init(struct net *net)
373 {
374 	struct proc_dir_entry *pde;
375 
376 	pde = proc_create("rt_cache", S_IRUGO, net->proc_net,
377 			  &rt_cache_seq_fops);
378 	if (!pde)
379 		goto err1;
380 
381 	pde = proc_create("rt_cache", S_IRUGO,
382 			  net->proc_net_stat, &rt_cpu_seq_fops);
383 	if (!pde)
384 		goto err2;
385 
386 #ifdef CONFIG_IP_ROUTE_CLASSID
387 	pde = proc_create("rt_acct", 0, net->proc_net, &rt_acct_proc_fops);
388 	if (!pde)
389 		goto err3;
390 #endif
391 	return 0;
392 
393 #ifdef CONFIG_IP_ROUTE_CLASSID
394 err3:
395 	remove_proc_entry("rt_cache", net->proc_net_stat);
396 #endif
397 err2:
398 	remove_proc_entry("rt_cache", net->proc_net);
399 err1:
400 	return -ENOMEM;
401 }
402 
403 static void __net_exit ip_rt_do_proc_exit(struct net *net)
404 {
405 	remove_proc_entry("rt_cache", net->proc_net_stat);
406 	remove_proc_entry("rt_cache", net->proc_net);
407 #ifdef CONFIG_IP_ROUTE_CLASSID
408 	remove_proc_entry("rt_acct", net->proc_net);
409 #endif
410 }
411 
412 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
413 	.init = ip_rt_do_proc_init,
414 	.exit = ip_rt_do_proc_exit,
415 };
416 
417 static int __init ip_rt_proc_init(void)
418 {
419 	return register_pernet_subsys(&ip_rt_proc_ops);
420 }
421 
422 #else
423 static inline int ip_rt_proc_init(void)
424 {
425 	return 0;
426 }
427 #endif /* CONFIG_PROC_FS */
428 
429 static inline bool rt_is_expired(const struct rtable *rth)
430 {
431 	return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
432 }
433 
434 void rt_cache_flush(struct net *net)
435 {
436 	rt_genid_bump_ipv4(net);
437 }
438 
439 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
440 					   struct sk_buff *skb,
441 					   const void *daddr)
442 {
443 	struct net_device *dev = dst->dev;
444 	const __be32 *pkey = daddr;
445 	const struct rtable *rt;
446 	struct neighbour *n;
447 
448 	rt = (const struct rtable *) dst;
449 	if (rt->rt_gateway)
450 		pkey = (const __be32 *) &rt->rt_gateway;
451 	else if (skb)
452 		pkey = &ip_hdr(skb)->daddr;
453 
454 	n = __ipv4_neigh_lookup(dev, *(__force u32 *)pkey);
455 	if (n)
456 		return n;
457 	return neigh_create(&arp_tbl, pkey, dev);
458 }
459 
460 #define IP_IDENTS_SZ 2048u
461 struct ip_ident_bucket {
462 	atomic_t	id;
463 	u32		stamp32;
464 };
465 
466 static struct ip_ident_bucket *ip_idents __read_mostly;
467 
468 /* In order to protect privacy, we add a perturbation to identifiers
469  * if one generator is seldom used. This makes hard for an attacker
470  * to infer how many packets were sent between two points in time.
471  */
472 u32 ip_idents_reserve(u32 hash, int segs)
473 {
474 	struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
475 	u32 old = ACCESS_ONCE(bucket->stamp32);
476 	u32 now = (u32)jiffies;
477 	u32 delta = 0;
478 
479 	if (old != now && cmpxchg(&bucket->stamp32, old, now) == old)
480 		delta = prandom_u32_max(now - old);
481 
482 	return atomic_add_return(segs + delta, &bucket->id) - segs;
483 }
484 EXPORT_SYMBOL(ip_idents_reserve);
485 
486 void __ip_select_ident(struct iphdr *iph, int segs)
487 {
488 	static u32 ip_idents_hashrnd __read_mostly;
489 	u32 hash, id;
490 
491 	net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
492 
493 	hash = jhash_3words((__force u32)iph->daddr,
494 			    (__force u32)iph->saddr,
495 			    iph->protocol,
496 			    ip_idents_hashrnd);
497 	id = ip_idents_reserve(hash, segs);
498 	iph->id = htons(id);
499 }
500 EXPORT_SYMBOL(__ip_select_ident);
501 
502 static void __build_flow_key(struct flowi4 *fl4, const struct sock *sk,
503 			     const struct iphdr *iph,
504 			     int oif, u8 tos,
505 			     u8 prot, u32 mark, int flow_flags)
506 {
507 	if (sk) {
508 		const struct inet_sock *inet = inet_sk(sk);
509 
510 		oif = sk->sk_bound_dev_if;
511 		mark = sk->sk_mark;
512 		tos = RT_CONN_FLAGS(sk);
513 		prot = inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol;
514 	}
515 	flowi4_init_output(fl4, oif, mark, tos,
516 			   RT_SCOPE_UNIVERSE, prot,
517 			   flow_flags,
518 			   iph->daddr, iph->saddr, 0, 0);
519 }
520 
521 static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
522 			       const struct sock *sk)
523 {
524 	const struct iphdr *iph = ip_hdr(skb);
525 	int oif = skb->dev->ifindex;
526 	u8 tos = RT_TOS(iph->tos);
527 	u8 prot = iph->protocol;
528 	u32 mark = skb->mark;
529 
530 	__build_flow_key(fl4, sk, iph, oif, tos, prot, mark, 0);
531 }
532 
533 static void build_sk_flow_key(struct flowi4 *fl4, const struct sock *sk)
534 {
535 	const struct inet_sock *inet = inet_sk(sk);
536 	const struct ip_options_rcu *inet_opt;
537 	__be32 daddr = inet->inet_daddr;
538 
539 	rcu_read_lock();
540 	inet_opt = rcu_dereference(inet->inet_opt);
541 	if (inet_opt && inet_opt->opt.srr)
542 		daddr = inet_opt->opt.faddr;
543 	flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
544 			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
545 			   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
546 			   inet_sk_flowi_flags(sk),
547 			   daddr, inet->inet_saddr, 0, 0);
548 	rcu_read_unlock();
549 }
550 
551 static void ip_rt_build_flow_key(struct flowi4 *fl4, const struct sock *sk,
552 				 const struct sk_buff *skb)
553 {
554 	if (skb)
555 		build_skb_flow_key(fl4, skb, sk);
556 	else
557 		build_sk_flow_key(fl4, sk);
558 }
559 
560 static inline void rt_free(struct rtable *rt)
561 {
562 	call_rcu(&rt->dst.rcu_head, dst_rcu_free);
563 }
564 
565 static DEFINE_SPINLOCK(fnhe_lock);
566 
567 static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
568 {
569 	struct rtable *rt;
570 
571 	rt = rcu_dereference(fnhe->fnhe_rth_input);
572 	if (rt) {
573 		RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
574 		rt_free(rt);
575 	}
576 	rt = rcu_dereference(fnhe->fnhe_rth_output);
577 	if (rt) {
578 		RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
579 		rt_free(rt);
580 	}
581 }
582 
583 static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
584 {
585 	struct fib_nh_exception *fnhe, *oldest;
586 
587 	oldest = rcu_dereference(hash->chain);
588 	for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
589 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
590 		if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
591 			oldest = fnhe;
592 	}
593 	fnhe_flush_routes(oldest);
594 	return oldest;
595 }
596 
597 static inline u32 fnhe_hashfun(__be32 daddr)
598 {
599 	u32 hval;
600 
601 	hval = (__force u32) daddr;
602 	hval ^= (hval >> 11) ^ (hval >> 22);
603 
604 	return hval & (FNHE_HASH_SIZE - 1);
605 }
606 
607 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
608 {
609 	rt->rt_pmtu = fnhe->fnhe_pmtu;
610 	rt->dst.expires = fnhe->fnhe_expires;
611 
612 	if (fnhe->fnhe_gw) {
613 		rt->rt_flags |= RTCF_REDIRECTED;
614 		rt->rt_gateway = fnhe->fnhe_gw;
615 		rt->rt_uses_gateway = 1;
616 	}
617 }
618 
619 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
620 				  u32 pmtu, unsigned long expires)
621 {
622 	struct fnhe_hash_bucket *hash;
623 	struct fib_nh_exception *fnhe;
624 	struct rtable *rt;
625 	unsigned int i;
626 	int depth;
627 	u32 hval = fnhe_hashfun(daddr);
628 
629 	spin_lock_bh(&fnhe_lock);
630 
631 	hash = nh->nh_exceptions;
632 	if (!hash) {
633 		hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);
634 		if (!hash)
635 			goto out_unlock;
636 		nh->nh_exceptions = hash;
637 	}
638 
639 	hash += hval;
640 
641 	depth = 0;
642 	for (fnhe = rcu_dereference(hash->chain); fnhe;
643 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
644 		if (fnhe->fnhe_daddr == daddr)
645 			break;
646 		depth++;
647 	}
648 
649 	if (fnhe) {
650 		if (gw)
651 			fnhe->fnhe_gw = gw;
652 		if (pmtu) {
653 			fnhe->fnhe_pmtu = pmtu;
654 			fnhe->fnhe_expires = max(1UL, expires);
655 		}
656 		/* Update all cached dsts too */
657 		rt = rcu_dereference(fnhe->fnhe_rth_input);
658 		if (rt)
659 			fill_route_from_fnhe(rt, fnhe);
660 		rt = rcu_dereference(fnhe->fnhe_rth_output);
661 		if (rt)
662 			fill_route_from_fnhe(rt, fnhe);
663 	} else {
664 		if (depth > FNHE_RECLAIM_DEPTH)
665 			fnhe = fnhe_oldest(hash);
666 		else {
667 			fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
668 			if (!fnhe)
669 				goto out_unlock;
670 
671 			fnhe->fnhe_next = hash->chain;
672 			rcu_assign_pointer(hash->chain, fnhe);
673 		}
674 		fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
675 		fnhe->fnhe_daddr = daddr;
676 		fnhe->fnhe_gw = gw;
677 		fnhe->fnhe_pmtu = pmtu;
678 		fnhe->fnhe_expires = expires;
679 
680 		/* Exception created; mark the cached routes for the nexthop
681 		 * stale, so anyone caching it rechecks if this exception
682 		 * applies to them.
683 		 */
684 		rt = rcu_dereference(nh->nh_rth_input);
685 		if (rt)
686 			rt->dst.obsolete = DST_OBSOLETE_KILL;
687 
688 		for_each_possible_cpu(i) {
689 			struct rtable __rcu **prt;
690 			prt = per_cpu_ptr(nh->nh_pcpu_rth_output, i);
691 			rt = rcu_dereference(*prt);
692 			if (rt)
693 				rt->dst.obsolete = DST_OBSOLETE_KILL;
694 		}
695 	}
696 
697 	fnhe->fnhe_stamp = jiffies;
698 
699 out_unlock:
700 	spin_unlock_bh(&fnhe_lock);
701 }
702 
703 static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flowi4 *fl4,
704 			     bool kill_route)
705 {
706 	__be32 new_gw = icmp_hdr(skb)->un.gateway;
707 	__be32 old_gw = ip_hdr(skb)->saddr;
708 	struct net_device *dev = skb->dev;
709 	struct in_device *in_dev;
710 	struct fib_result res;
711 	struct neighbour *n;
712 	struct net *net;
713 
714 	switch (icmp_hdr(skb)->code & 7) {
715 	case ICMP_REDIR_NET:
716 	case ICMP_REDIR_NETTOS:
717 	case ICMP_REDIR_HOST:
718 	case ICMP_REDIR_HOSTTOS:
719 		break;
720 
721 	default:
722 		return;
723 	}
724 
725 	if (rt->rt_gateway != old_gw)
726 		return;
727 
728 	in_dev = __in_dev_get_rcu(dev);
729 	if (!in_dev)
730 		return;
731 
732 	net = dev_net(dev);
733 	if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
734 	    ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
735 	    ipv4_is_zeronet(new_gw))
736 		goto reject_redirect;
737 
738 	if (!IN_DEV_SHARED_MEDIA(in_dev)) {
739 		if (!inet_addr_onlink(in_dev, new_gw, old_gw))
740 			goto reject_redirect;
741 		if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
742 			goto reject_redirect;
743 	} else {
744 		if (inet_addr_type(net, new_gw) != RTN_UNICAST)
745 			goto reject_redirect;
746 	}
747 
748 	n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
749 	if (n) {
750 		if (!(n->nud_state & NUD_VALID)) {
751 			neigh_event_send(n, NULL);
752 		} else {
753 			if (fib_lookup(net, fl4, &res) == 0) {
754 				struct fib_nh *nh = &FIB_RES_NH(res);
755 
756 				update_or_create_fnhe(nh, fl4->daddr, new_gw,
757 						      0, 0);
758 			}
759 			if (kill_route)
760 				rt->dst.obsolete = DST_OBSOLETE_KILL;
761 			call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
762 		}
763 		neigh_release(n);
764 	}
765 	return;
766 
767 reject_redirect:
768 #ifdef CONFIG_IP_ROUTE_VERBOSE
769 	if (IN_DEV_LOG_MARTIANS(in_dev)) {
770 		const struct iphdr *iph = (const struct iphdr *) skb->data;
771 		__be32 daddr = iph->daddr;
772 		__be32 saddr = iph->saddr;
773 
774 		net_info_ratelimited("Redirect from %pI4 on %s about %pI4 ignored\n"
775 				     "  Advised path = %pI4 -> %pI4\n",
776 				     &old_gw, dev->name, &new_gw,
777 				     &saddr, &daddr);
778 	}
779 #endif
780 	;
781 }
782 
783 static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
784 {
785 	struct rtable *rt;
786 	struct flowi4 fl4;
787 	const struct iphdr *iph = (const struct iphdr *) skb->data;
788 	int oif = skb->dev->ifindex;
789 	u8 tos = RT_TOS(iph->tos);
790 	u8 prot = iph->protocol;
791 	u32 mark = skb->mark;
792 
793 	rt = (struct rtable *) dst;
794 
795 	__build_flow_key(&fl4, sk, iph, oif, tos, prot, mark, 0);
796 	__ip_do_redirect(rt, skb, &fl4, true);
797 }
798 
799 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
800 {
801 	struct rtable *rt = (struct rtable *)dst;
802 	struct dst_entry *ret = dst;
803 
804 	if (rt) {
805 		if (dst->obsolete > 0) {
806 			ip_rt_put(rt);
807 			ret = NULL;
808 		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
809 			   rt->dst.expires) {
810 			ip_rt_put(rt);
811 			ret = NULL;
812 		}
813 	}
814 	return ret;
815 }
816 
817 /*
818  * Algorithm:
819  *	1. The first ip_rt_redirect_number redirects are sent
820  *	   with exponential backoff, then we stop sending them at all,
821  *	   assuming that the host ignores our redirects.
822  *	2. If we did not see packets requiring redirects
823  *	   during ip_rt_redirect_silence, we assume that the host
824  *	   forgot redirected route and start to send redirects again.
825  *
826  * This algorithm is much cheaper and more intelligent than dumb load limiting
827  * in icmp.c.
828  *
829  * NOTE. Do not forget to inhibit load limiting for redirects (redundant)
830  * and "frag. need" (breaks PMTU discovery) in icmp.c.
831  */
832 
833 void ip_rt_send_redirect(struct sk_buff *skb)
834 {
835 	struct rtable *rt = skb_rtable(skb);
836 	struct in_device *in_dev;
837 	struct inet_peer *peer;
838 	struct net *net;
839 	int log_martians;
840 
841 	rcu_read_lock();
842 	in_dev = __in_dev_get_rcu(rt->dst.dev);
843 	if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
844 		rcu_read_unlock();
845 		return;
846 	}
847 	log_martians = IN_DEV_LOG_MARTIANS(in_dev);
848 	rcu_read_unlock();
849 
850 	net = dev_net(rt->dst.dev);
851 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
852 	if (!peer) {
853 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
854 			  rt_nexthop(rt, ip_hdr(skb)->daddr));
855 		return;
856 	}
857 
858 	/* No redirected packets during ip_rt_redirect_silence;
859 	 * reset the algorithm.
860 	 */
861 	if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
862 		peer->rate_tokens = 0;
863 
864 	/* Too many ignored redirects; do not send anything
865 	 * set dst.rate_last to the last seen redirected packet.
866 	 */
867 	if (peer->rate_tokens >= ip_rt_redirect_number) {
868 		peer->rate_last = jiffies;
869 		goto out_put_peer;
870 	}
871 
872 	/* Check for load limit; set rate_last to the latest sent
873 	 * redirect.
874 	 */
875 	if (peer->rate_tokens == 0 ||
876 	    time_after(jiffies,
877 		       (peer->rate_last +
878 			(ip_rt_redirect_load << peer->rate_tokens)))) {
879 		__be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
880 
881 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
882 		peer->rate_last = jiffies;
883 		++peer->rate_tokens;
884 #ifdef CONFIG_IP_ROUTE_VERBOSE
885 		if (log_martians &&
886 		    peer->rate_tokens == ip_rt_redirect_number)
887 			net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
888 					     &ip_hdr(skb)->saddr, inet_iif(skb),
889 					     &ip_hdr(skb)->daddr, &gw);
890 #endif
891 	}
892 out_put_peer:
893 	inet_putpeer(peer);
894 }
895 
896 static int ip_error(struct sk_buff *skb)
897 {
898 	struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
899 	struct rtable *rt = skb_rtable(skb);
900 	struct inet_peer *peer;
901 	unsigned long now;
902 	struct net *net;
903 	bool send;
904 	int code;
905 
906 	net = dev_net(rt->dst.dev);
907 	if (!IN_DEV_FORWARD(in_dev)) {
908 		switch (rt->dst.error) {
909 		case EHOSTUNREACH:
910 			IP_INC_STATS_BH(net, IPSTATS_MIB_INADDRERRORS);
911 			break;
912 
913 		case ENETUNREACH:
914 			IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
915 			break;
916 		}
917 		goto out;
918 	}
919 
920 	switch (rt->dst.error) {
921 	case EINVAL:
922 	default:
923 		goto out;
924 	case EHOSTUNREACH:
925 		code = ICMP_HOST_UNREACH;
926 		break;
927 	case ENETUNREACH:
928 		code = ICMP_NET_UNREACH;
929 		IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
930 		break;
931 	case EACCES:
932 		code = ICMP_PKT_FILTERED;
933 		break;
934 	}
935 
936 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
937 
938 	send = true;
939 	if (peer) {
940 		now = jiffies;
941 		peer->rate_tokens += now - peer->rate_last;
942 		if (peer->rate_tokens > ip_rt_error_burst)
943 			peer->rate_tokens = ip_rt_error_burst;
944 		peer->rate_last = now;
945 		if (peer->rate_tokens >= ip_rt_error_cost)
946 			peer->rate_tokens -= ip_rt_error_cost;
947 		else
948 			send = false;
949 		inet_putpeer(peer);
950 	}
951 	if (send)
952 		icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
953 
954 out:	kfree_skb(skb);
955 	return 0;
956 }
957 
958 static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
959 {
960 	struct dst_entry *dst = &rt->dst;
961 	struct fib_result res;
962 
963 	if (dst_metric_locked(dst, RTAX_MTU))
964 		return;
965 
966 	if (dst->dev->mtu < mtu)
967 		return;
968 
969 	if (mtu < ip_rt_min_pmtu)
970 		mtu = ip_rt_min_pmtu;
971 
972 	if (rt->rt_pmtu == mtu &&
973 	    time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
974 		return;
975 
976 	rcu_read_lock();
977 	if (fib_lookup(dev_net(dst->dev), fl4, &res) == 0) {
978 		struct fib_nh *nh = &FIB_RES_NH(res);
979 
980 		update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
981 				      jiffies + ip_rt_mtu_expires);
982 	}
983 	rcu_read_unlock();
984 }
985 
986 static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
987 			      struct sk_buff *skb, u32 mtu)
988 {
989 	struct rtable *rt = (struct rtable *) dst;
990 	struct flowi4 fl4;
991 
992 	ip_rt_build_flow_key(&fl4, sk, skb);
993 	__ip_rt_update_pmtu(rt, &fl4, mtu);
994 }
995 
996 void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
997 		      int oif, u32 mark, u8 protocol, int flow_flags)
998 {
999 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1000 	struct flowi4 fl4;
1001 	struct rtable *rt;
1002 
1003 	if (!mark)
1004 		mark = IP4_REPLY_MARK(net, skb->mark);
1005 
1006 	__build_flow_key(&fl4, NULL, iph, oif,
1007 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1008 	rt = __ip_route_output_key(net, &fl4);
1009 	if (!IS_ERR(rt)) {
1010 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1011 		ip_rt_put(rt);
1012 	}
1013 }
1014 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
1015 
1016 static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1017 {
1018 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1019 	struct flowi4 fl4;
1020 	struct rtable *rt;
1021 
1022 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1023 
1024 	if (!fl4.flowi4_mark)
1025 		fl4.flowi4_mark = IP4_REPLY_MARK(sock_net(sk), skb->mark);
1026 
1027 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1028 	if (!IS_ERR(rt)) {
1029 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1030 		ip_rt_put(rt);
1031 	}
1032 }
1033 
1034 void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1035 {
1036 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1037 	struct flowi4 fl4;
1038 	struct rtable *rt;
1039 	struct dst_entry *odst = NULL;
1040 	bool new = false;
1041 
1042 	bh_lock_sock(sk);
1043 
1044 	if (!ip_sk_accept_pmtu(sk))
1045 		goto out;
1046 
1047 	odst = sk_dst_get(sk);
1048 
1049 	if (sock_owned_by_user(sk) || !odst) {
1050 		__ipv4_sk_update_pmtu(skb, sk, mtu);
1051 		goto out;
1052 	}
1053 
1054 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1055 
1056 	rt = (struct rtable *)odst;
1057 	if (odst->obsolete && odst->ops->check(odst, 0) == NULL) {
1058 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1059 		if (IS_ERR(rt))
1060 			goto out;
1061 
1062 		new = true;
1063 	}
1064 
1065 	__ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
1066 
1067 	if (!dst_check(&rt->dst, 0)) {
1068 		if (new)
1069 			dst_release(&rt->dst);
1070 
1071 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1072 		if (IS_ERR(rt))
1073 			goto out;
1074 
1075 		new = true;
1076 	}
1077 
1078 	if (new)
1079 		sk_dst_set(sk, &rt->dst);
1080 
1081 out:
1082 	bh_unlock_sock(sk);
1083 	dst_release(odst);
1084 }
1085 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
1086 
1087 void ipv4_redirect(struct sk_buff *skb, struct net *net,
1088 		   int oif, u32 mark, u8 protocol, int flow_flags)
1089 {
1090 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1091 	struct flowi4 fl4;
1092 	struct rtable *rt;
1093 
1094 	__build_flow_key(&fl4, NULL, iph, oif,
1095 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1096 	rt = __ip_route_output_key(net, &fl4);
1097 	if (!IS_ERR(rt)) {
1098 		__ip_do_redirect(rt, skb, &fl4, false);
1099 		ip_rt_put(rt);
1100 	}
1101 }
1102 EXPORT_SYMBOL_GPL(ipv4_redirect);
1103 
1104 void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk)
1105 {
1106 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1107 	struct flowi4 fl4;
1108 	struct rtable *rt;
1109 
1110 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1111 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1112 	if (!IS_ERR(rt)) {
1113 		__ip_do_redirect(rt, skb, &fl4, false);
1114 		ip_rt_put(rt);
1115 	}
1116 }
1117 EXPORT_SYMBOL_GPL(ipv4_sk_redirect);
1118 
1119 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
1120 {
1121 	struct rtable *rt = (struct rtable *) dst;
1122 
1123 	/* All IPV4 dsts are created with ->obsolete set to the value
1124 	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
1125 	 * into this function always.
1126 	 *
1127 	 * When a PMTU/redirect information update invalidates a route,
1128 	 * this is indicated by setting obsolete to DST_OBSOLETE_KILL or
1129 	 * DST_OBSOLETE_DEAD by dst_free().
1130 	 */
1131 	if (dst->obsolete != DST_OBSOLETE_FORCE_CHK || rt_is_expired(rt))
1132 		return NULL;
1133 	return dst;
1134 }
1135 
1136 static void ipv4_link_failure(struct sk_buff *skb)
1137 {
1138 	struct rtable *rt;
1139 
1140 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
1141 
1142 	rt = skb_rtable(skb);
1143 	if (rt)
1144 		dst_set_expires(&rt->dst, 0);
1145 }
1146 
1147 static int ip_rt_bug(struct sock *sk, struct sk_buff *skb)
1148 {
1149 	pr_debug("%s: %pI4 -> %pI4, %s\n",
1150 		 __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
1151 		 skb->dev ? skb->dev->name : "?");
1152 	kfree_skb(skb);
1153 	WARN_ON(1);
1154 	return 0;
1155 }
1156 
1157 /*
1158    We do not cache source address of outgoing interface,
1159    because it is used only by IP RR, TS and SRR options,
1160    so that it out of fast path.
1161 
1162    BTW remember: "addr" is allowed to be not aligned
1163    in IP options!
1164  */
1165 
1166 void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
1167 {
1168 	__be32 src;
1169 
1170 	if (rt_is_output_route(rt))
1171 		src = ip_hdr(skb)->saddr;
1172 	else {
1173 		struct fib_result res;
1174 		struct flowi4 fl4;
1175 		struct iphdr *iph;
1176 
1177 		iph = ip_hdr(skb);
1178 
1179 		memset(&fl4, 0, sizeof(fl4));
1180 		fl4.daddr = iph->daddr;
1181 		fl4.saddr = iph->saddr;
1182 		fl4.flowi4_tos = RT_TOS(iph->tos);
1183 		fl4.flowi4_oif = rt->dst.dev->ifindex;
1184 		fl4.flowi4_iif = skb->dev->ifindex;
1185 		fl4.flowi4_mark = skb->mark;
1186 
1187 		rcu_read_lock();
1188 		if (fib_lookup(dev_net(rt->dst.dev), &fl4, &res) == 0)
1189 			src = FIB_RES_PREFSRC(dev_net(rt->dst.dev), res);
1190 		else
1191 			src = inet_select_addr(rt->dst.dev,
1192 					       rt_nexthop(rt, iph->daddr),
1193 					       RT_SCOPE_UNIVERSE);
1194 		rcu_read_unlock();
1195 	}
1196 	memcpy(addr, &src, 4);
1197 }
1198 
1199 #ifdef CONFIG_IP_ROUTE_CLASSID
1200 static void set_class_tag(struct rtable *rt, u32 tag)
1201 {
1202 	if (!(rt->dst.tclassid & 0xFFFF))
1203 		rt->dst.tclassid |= tag & 0xFFFF;
1204 	if (!(rt->dst.tclassid & 0xFFFF0000))
1205 		rt->dst.tclassid |= tag & 0xFFFF0000;
1206 }
1207 #endif
1208 
1209 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
1210 {
1211 	unsigned int advmss = dst_metric_raw(dst, RTAX_ADVMSS);
1212 
1213 	if (advmss == 0) {
1214 		advmss = max_t(unsigned int, dst->dev->mtu - 40,
1215 			       ip_rt_min_advmss);
1216 		if (advmss > 65535 - 40)
1217 			advmss = 65535 - 40;
1218 	}
1219 	return advmss;
1220 }
1221 
1222 static unsigned int ipv4_mtu(const struct dst_entry *dst)
1223 {
1224 	const struct rtable *rt = (const struct rtable *) dst;
1225 	unsigned int mtu = rt->rt_pmtu;
1226 
1227 	if (!mtu || time_after_eq(jiffies, rt->dst.expires))
1228 		mtu = dst_metric_raw(dst, RTAX_MTU);
1229 
1230 	if (mtu)
1231 		return mtu;
1232 
1233 	mtu = dst->dev->mtu;
1234 
1235 	if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
1236 		if (rt->rt_uses_gateway && mtu > 576)
1237 			mtu = 576;
1238 	}
1239 
1240 	return min_t(unsigned int, mtu, IP_MAX_MTU);
1241 }
1242 
1243 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
1244 {
1245 	struct fnhe_hash_bucket *hash = nh->nh_exceptions;
1246 	struct fib_nh_exception *fnhe;
1247 	u32 hval;
1248 
1249 	if (!hash)
1250 		return NULL;
1251 
1252 	hval = fnhe_hashfun(daddr);
1253 
1254 	for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
1255 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
1256 		if (fnhe->fnhe_daddr == daddr)
1257 			return fnhe;
1258 	}
1259 	return NULL;
1260 }
1261 
1262 static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
1263 			      __be32 daddr)
1264 {
1265 	bool ret = false;
1266 
1267 	spin_lock_bh(&fnhe_lock);
1268 
1269 	if (daddr == fnhe->fnhe_daddr) {
1270 		struct rtable __rcu **porig;
1271 		struct rtable *orig;
1272 		int genid = fnhe_genid(dev_net(rt->dst.dev));
1273 
1274 		if (rt_is_input_route(rt))
1275 			porig = &fnhe->fnhe_rth_input;
1276 		else
1277 			porig = &fnhe->fnhe_rth_output;
1278 		orig = rcu_dereference(*porig);
1279 
1280 		if (fnhe->fnhe_genid != genid) {
1281 			fnhe->fnhe_genid = genid;
1282 			fnhe->fnhe_gw = 0;
1283 			fnhe->fnhe_pmtu = 0;
1284 			fnhe->fnhe_expires = 0;
1285 			fnhe_flush_routes(fnhe);
1286 			orig = NULL;
1287 		}
1288 		fill_route_from_fnhe(rt, fnhe);
1289 		if (!rt->rt_gateway)
1290 			rt->rt_gateway = daddr;
1291 
1292 		if (!(rt->dst.flags & DST_NOCACHE)) {
1293 			rcu_assign_pointer(*porig, rt);
1294 			if (orig)
1295 				rt_free(orig);
1296 			ret = true;
1297 		}
1298 
1299 		fnhe->fnhe_stamp = jiffies;
1300 	}
1301 	spin_unlock_bh(&fnhe_lock);
1302 
1303 	return ret;
1304 }
1305 
1306 static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
1307 {
1308 	struct rtable *orig, *prev, **p;
1309 	bool ret = true;
1310 
1311 	if (rt_is_input_route(rt)) {
1312 		p = (struct rtable **)&nh->nh_rth_input;
1313 	} else {
1314 		p = (struct rtable **)__this_cpu_ptr(nh->nh_pcpu_rth_output);
1315 	}
1316 	orig = *p;
1317 
1318 	prev = cmpxchg(p, orig, rt);
1319 	if (prev == orig) {
1320 		if (orig)
1321 			rt_free(orig);
1322 	} else
1323 		ret = false;
1324 
1325 	return ret;
1326 }
1327 
1328 static DEFINE_SPINLOCK(rt_uncached_lock);
1329 static LIST_HEAD(rt_uncached_list);
1330 
1331 static void rt_add_uncached_list(struct rtable *rt)
1332 {
1333 	spin_lock_bh(&rt_uncached_lock);
1334 	list_add_tail(&rt->rt_uncached, &rt_uncached_list);
1335 	spin_unlock_bh(&rt_uncached_lock);
1336 }
1337 
1338 static void ipv4_dst_destroy(struct dst_entry *dst)
1339 {
1340 	struct rtable *rt = (struct rtable *) dst;
1341 
1342 	if (!list_empty(&rt->rt_uncached)) {
1343 		spin_lock_bh(&rt_uncached_lock);
1344 		list_del(&rt->rt_uncached);
1345 		spin_unlock_bh(&rt_uncached_lock);
1346 	}
1347 }
1348 
1349 void rt_flush_dev(struct net_device *dev)
1350 {
1351 	if (!list_empty(&rt_uncached_list)) {
1352 		struct net *net = dev_net(dev);
1353 		struct rtable *rt;
1354 
1355 		spin_lock_bh(&rt_uncached_lock);
1356 		list_for_each_entry(rt, &rt_uncached_list, rt_uncached) {
1357 			if (rt->dst.dev != dev)
1358 				continue;
1359 			rt->dst.dev = net->loopback_dev;
1360 			dev_hold(rt->dst.dev);
1361 			dev_put(dev);
1362 		}
1363 		spin_unlock_bh(&rt_uncached_lock);
1364 	}
1365 }
1366 
1367 static bool rt_cache_valid(const struct rtable *rt)
1368 {
1369 	return	rt &&
1370 		rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1371 		!rt_is_expired(rt);
1372 }
1373 
1374 static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
1375 			   const struct fib_result *res,
1376 			   struct fib_nh_exception *fnhe,
1377 			   struct fib_info *fi, u16 type, u32 itag)
1378 {
1379 	bool cached = false;
1380 
1381 	if (fi) {
1382 		struct fib_nh *nh = &FIB_RES_NH(*res);
1383 
1384 		if (nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) {
1385 			rt->rt_gateway = nh->nh_gw;
1386 			rt->rt_uses_gateway = 1;
1387 		}
1388 		dst_init_metrics(&rt->dst, fi->fib_metrics, true);
1389 #ifdef CONFIG_IP_ROUTE_CLASSID
1390 		rt->dst.tclassid = nh->nh_tclassid;
1391 #endif
1392 		if (unlikely(fnhe))
1393 			cached = rt_bind_exception(rt, fnhe, daddr);
1394 		else if (!(rt->dst.flags & DST_NOCACHE))
1395 			cached = rt_cache_route(nh, rt);
1396 		if (unlikely(!cached)) {
1397 			/* Routes we intend to cache in nexthop exception or
1398 			 * FIB nexthop have the DST_NOCACHE bit clear.
1399 			 * However, if we are unsuccessful at storing this
1400 			 * route into the cache we really need to set it.
1401 			 */
1402 			rt->dst.flags |= DST_NOCACHE;
1403 			if (!rt->rt_gateway)
1404 				rt->rt_gateway = daddr;
1405 			rt_add_uncached_list(rt);
1406 		}
1407 	} else
1408 		rt_add_uncached_list(rt);
1409 
1410 #ifdef CONFIG_IP_ROUTE_CLASSID
1411 #ifdef CONFIG_IP_MULTIPLE_TABLES
1412 	set_class_tag(rt, res->tclassid);
1413 #endif
1414 	set_class_tag(rt, itag);
1415 #endif
1416 }
1417 
1418 static struct rtable *rt_dst_alloc(struct net_device *dev,
1419 				   bool nopolicy, bool noxfrm, bool will_cache)
1420 {
1421 	return dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
1422 			 (will_cache ? 0 : (DST_HOST | DST_NOCACHE)) |
1423 			 (nopolicy ? DST_NOPOLICY : 0) |
1424 			 (noxfrm ? DST_NOXFRM : 0));
1425 }
1426 
1427 /* called in rcu_read_lock() section */
1428 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1429 				u8 tos, struct net_device *dev, int our)
1430 {
1431 	struct rtable *rth;
1432 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1433 	u32 itag = 0;
1434 	int err;
1435 
1436 	/* Primary sanity checks. */
1437 
1438 	if (in_dev == NULL)
1439 		return -EINVAL;
1440 
1441 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1442 	    skb->protocol != htons(ETH_P_IP))
1443 		goto e_inval;
1444 
1445 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1446 		if (ipv4_is_loopback(saddr))
1447 			goto e_inval;
1448 
1449 	if (ipv4_is_zeronet(saddr)) {
1450 		if (!ipv4_is_local_multicast(daddr))
1451 			goto e_inval;
1452 	} else {
1453 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1454 					  in_dev, &itag);
1455 		if (err < 0)
1456 			goto e_err;
1457 	}
1458 	rth = rt_dst_alloc(dev_net(dev)->loopback_dev,
1459 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
1460 	if (!rth)
1461 		goto e_nobufs;
1462 
1463 #ifdef CONFIG_IP_ROUTE_CLASSID
1464 	rth->dst.tclassid = itag;
1465 #endif
1466 	rth->dst.output = ip_rt_bug;
1467 
1468 	rth->rt_genid	= rt_genid_ipv4(dev_net(dev));
1469 	rth->rt_flags	= RTCF_MULTICAST;
1470 	rth->rt_type	= RTN_MULTICAST;
1471 	rth->rt_is_input= 1;
1472 	rth->rt_iif	= 0;
1473 	rth->rt_pmtu	= 0;
1474 	rth->rt_gateway	= 0;
1475 	rth->rt_uses_gateway = 0;
1476 	INIT_LIST_HEAD(&rth->rt_uncached);
1477 	if (our) {
1478 		rth->dst.input= ip_local_deliver;
1479 		rth->rt_flags |= RTCF_LOCAL;
1480 	}
1481 
1482 #ifdef CONFIG_IP_MROUTE
1483 	if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
1484 		rth->dst.input = ip_mr_input;
1485 #endif
1486 	RT_CACHE_STAT_INC(in_slow_mc);
1487 
1488 	skb_dst_set(skb, &rth->dst);
1489 	return 0;
1490 
1491 e_nobufs:
1492 	return -ENOBUFS;
1493 e_inval:
1494 	return -EINVAL;
1495 e_err:
1496 	return err;
1497 }
1498 
1499 
1500 static void ip_handle_martian_source(struct net_device *dev,
1501 				     struct in_device *in_dev,
1502 				     struct sk_buff *skb,
1503 				     __be32 daddr,
1504 				     __be32 saddr)
1505 {
1506 	RT_CACHE_STAT_INC(in_martian_src);
1507 #ifdef CONFIG_IP_ROUTE_VERBOSE
1508 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
1509 		/*
1510 		 *	RFC1812 recommendation, if source is martian,
1511 		 *	the only hint is MAC header.
1512 		 */
1513 		pr_warn("martian source %pI4 from %pI4, on dev %s\n",
1514 			&daddr, &saddr, dev->name);
1515 		if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
1516 			print_hex_dump(KERN_WARNING, "ll header: ",
1517 				       DUMP_PREFIX_OFFSET, 16, 1,
1518 				       skb_mac_header(skb),
1519 				       dev->hard_header_len, true);
1520 		}
1521 	}
1522 #endif
1523 }
1524 
1525 /* called in rcu_read_lock() section */
1526 static int __mkroute_input(struct sk_buff *skb,
1527 			   const struct fib_result *res,
1528 			   struct in_device *in_dev,
1529 			   __be32 daddr, __be32 saddr, u32 tos)
1530 {
1531 	struct fib_nh_exception *fnhe;
1532 	struct rtable *rth;
1533 	int err;
1534 	struct in_device *out_dev;
1535 	unsigned int flags = 0;
1536 	bool do_cache;
1537 	u32 itag = 0;
1538 
1539 	/* get a working reference to the output device */
1540 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
1541 	if (out_dev == NULL) {
1542 		net_crit_ratelimited("Bug in ip_route_input_slow(). Please report.\n");
1543 		return -EINVAL;
1544 	}
1545 
1546 	err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
1547 				  in_dev->dev, in_dev, &itag);
1548 	if (err < 0) {
1549 		ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
1550 					 saddr);
1551 
1552 		goto cleanup;
1553 	}
1554 
1555 	do_cache = res->fi && !itag;
1556 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
1557 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
1558 	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
1559 		flags |= RTCF_DOREDIRECT;
1560 		do_cache = false;
1561 	}
1562 
1563 	if (skb->protocol != htons(ETH_P_IP)) {
1564 		/* Not IP (i.e. ARP). Do not create route, if it is
1565 		 * invalid for proxy arp. DNAT routes are always valid.
1566 		 *
1567 		 * Proxy arp feature have been extended to allow, ARP
1568 		 * replies back to the same interface, to support
1569 		 * Private VLAN switch technologies. See arp.c.
1570 		 */
1571 		if (out_dev == in_dev &&
1572 		    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
1573 			err = -EINVAL;
1574 			goto cleanup;
1575 		}
1576 	}
1577 
1578 	fnhe = find_exception(&FIB_RES_NH(*res), daddr);
1579 	if (do_cache) {
1580 		if (fnhe != NULL)
1581 			rth = rcu_dereference(fnhe->fnhe_rth_input);
1582 		else
1583 			rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
1584 
1585 		if (rt_cache_valid(rth)) {
1586 			skb_dst_set_noref(skb, &rth->dst);
1587 			goto out;
1588 		}
1589 	}
1590 
1591 	rth = rt_dst_alloc(out_dev->dev,
1592 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1593 			   IN_DEV_CONF_GET(out_dev, NOXFRM), do_cache);
1594 	if (!rth) {
1595 		err = -ENOBUFS;
1596 		goto cleanup;
1597 	}
1598 
1599 	rth->rt_genid = rt_genid_ipv4(dev_net(rth->dst.dev));
1600 	rth->rt_flags = flags;
1601 	rth->rt_type = res->type;
1602 	rth->rt_is_input = 1;
1603 	rth->rt_iif 	= 0;
1604 	rth->rt_pmtu	= 0;
1605 	rth->rt_gateway	= 0;
1606 	rth->rt_uses_gateway = 0;
1607 	INIT_LIST_HEAD(&rth->rt_uncached);
1608 	RT_CACHE_STAT_INC(in_slow_tot);
1609 
1610 	rth->dst.input = ip_forward;
1611 	rth->dst.output = ip_output;
1612 
1613 	rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag);
1614 	skb_dst_set(skb, &rth->dst);
1615 out:
1616 	err = 0;
1617  cleanup:
1618 	return err;
1619 }
1620 
1621 static int ip_mkroute_input(struct sk_buff *skb,
1622 			    struct fib_result *res,
1623 			    const struct flowi4 *fl4,
1624 			    struct in_device *in_dev,
1625 			    __be32 daddr, __be32 saddr, u32 tos)
1626 {
1627 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1628 	if (res->fi && res->fi->fib_nhs > 1)
1629 		fib_select_multipath(res);
1630 #endif
1631 
1632 	/* create a routing cache entry */
1633 	return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
1634 }
1635 
1636 /*
1637  *	NOTE. We drop all the packets that has local source
1638  *	addresses, because every properly looped back packet
1639  *	must have correct destination already attached by output routine.
1640  *
1641  *	Such approach solves two big problems:
1642  *	1. Not simplex devices are handled properly.
1643  *	2. IP spoofing attempts are filtered with 100% of guarantee.
1644  *	called with rcu_read_lock()
1645  */
1646 
1647 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1648 			       u8 tos, struct net_device *dev)
1649 {
1650 	struct fib_result res;
1651 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1652 	struct flowi4	fl4;
1653 	unsigned int	flags = 0;
1654 	u32		itag = 0;
1655 	struct rtable	*rth;
1656 	int		err = -EINVAL;
1657 	struct net    *net = dev_net(dev);
1658 	bool do_cache;
1659 
1660 	/* IP on this device is disabled. */
1661 
1662 	if (!in_dev)
1663 		goto out;
1664 
1665 	/* Check for the most weird martians, which can be not detected
1666 	   by fib_lookup.
1667 	 */
1668 
1669 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
1670 		goto martian_source;
1671 
1672 	res.fi = NULL;
1673 	if (ipv4_is_lbcast(daddr) || (saddr == 0 && daddr == 0))
1674 		goto brd_input;
1675 
1676 	/* Accept zero addresses only to limited broadcast;
1677 	 * I even do not know to fix it or not. Waiting for complains :-)
1678 	 */
1679 	if (ipv4_is_zeronet(saddr))
1680 		goto martian_source;
1681 
1682 	if (ipv4_is_zeronet(daddr))
1683 		goto martian_destination;
1684 
1685 	/* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
1686 	 * and call it once if daddr or/and saddr are loopback addresses
1687 	 */
1688 	if (ipv4_is_loopback(daddr)) {
1689 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1690 			goto martian_destination;
1691 	} else if (ipv4_is_loopback(saddr)) {
1692 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1693 			goto martian_source;
1694 	}
1695 
1696 	/*
1697 	 *	Now we are ready to route packet.
1698 	 */
1699 	fl4.flowi4_oif = 0;
1700 	fl4.flowi4_iif = dev->ifindex;
1701 	fl4.flowi4_mark = skb->mark;
1702 	fl4.flowi4_tos = tos;
1703 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
1704 	fl4.daddr = daddr;
1705 	fl4.saddr = saddr;
1706 	err = fib_lookup(net, &fl4, &res);
1707 	if (err != 0) {
1708 		if (!IN_DEV_FORWARD(in_dev))
1709 			err = -EHOSTUNREACH;
1710 		goto no_route;
1711 	}
1712 
1713 	if (res.type == RTN_BROADCAST)
1714 		goto brd_input;
1715 
1716 	if (res.type == RTN_LOCAL) {
1717 		err = fib_validate_source(skb, saddr, daddr, tos,
1718 					  0, dev, in_dev, &itag);
1719 		if (err < 0)
1720 			goto martian_source_keep_err;
1721 		goto local_input;
1722 	}
1723 
1724 	if (!IN_DEV_FORWARD(in_dev)) {
1725 		err = -EHOSTUNREACH;
1726 		goto no_route;
1727 	}
1728 	if (res.type != RTN_UNICAST)
1729 		goto martian_destination;
1730 
1731 	err = ip_mkroute_input(skb, &res, &fl4, in_dev, daddr, saddr, tos);
1732 out:	return err;
1733 
1734 brd_input:
1735 	if (skb->protocol != htons(ETH_P_IP))
1736 		goto e_inval;
1737 
1738 	if (!ipv4_is_zeronet(saddr)) {
1739 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1740 					  in_dev, &itag);
1741 		if (err < 0)
1742 			goto martian_source_keep_err;
1743 	}
1744 	flags |= RTCF_BROADCAST;
1745 	res.type = RTN_BROADCAST;
1746 	RT_CACHE_STAT_INC(in_brd);
1747 
1748 local_input:
1749 	do_cache = false;
1750 	if (res.fi) {
1751 		if (!itag) {
1752 			rth = rcu_dereference(FIB_RES_NH(res).nh_rth_input);
1753 			if (rt_cache_valid(rth)) {
1754 				skb_dst_set_noref(skb, &rth->dst);
1755 				err = 0;
1756 				goto out;
1757 			}
1758 			do_cache = true;
1759 		}
1760 	}
1761 
1762 	rth = rt_dst_alloc(net->loopback_dev,
1763 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, do_cache);
1764 	if (!rth)
1765 		goto e_nobufs;
1766 
1767 	rth->dst.input= ip_local_deliver;
1768 	rth->dst.output= ip_rt_bug;
1769 #ifdef CONFIG_IP_ROUTE_CLASSID
1770 	rth->dst.tclassid = itag;
1771 #endif
1772 
1773 	rth->rt_genid = rt_genid_ipv4(net);
1774 	rth->rt_flags 	= flags|RTCF_LOCAL;
1775 	rth->rt_type	= res.type;
1776 	rth->rt_is_input = 1;
1777 	rth->rt_iif	= 0;
1778 	rth->rt_pmtu	= 0;
1779 	rth->rt_gateway	= 0;
1780 	rth->rt_uses_gateway = 0;
1781 	INIT_LIST_HEAD(&rth->rt_uncached);
1782 	RT_CACHE_STAT_INC(in_slow_tot);
1783 	if (res.type == RTN_UNREACHABLE) {
1784 		rth->dst.input= ip_error;
1785 		rth->dst.error= -err;
1786 		rth->rt_flags 	&= ~RTCF_LOCAL;
1787 	}
1788 	if (do_cache) {
1789 		if (unlikely(!rt_cache_route(&FIB_RES_NH(res), rth))) {
1790 			rth->dst.flags |= DST_NOCACHE;
1791 			rt_add_uncached_list(rth);
1792 		}
1793 	}
1794 	skb_dst_set(skb, &rth->dst);
1795 	err = 0;
1796 	goto out;
1797 
1798 no_route:
1799 	RT_CACHE_STAT_INC(in_no_route);
1800 	res.type = RTN_UNREACHABLE;
1801 	if (err == -ESRCH)
1802 		err = -ENETUNREACH;
1803 	goto local_input;
1804 
1805 	/*
1806 	 *	Do not cache martian addresses: they should be logged (RFC1812)
1807 	 */
1808 martian_destination:
1809 	RT_CACHE_STAT_INC(in_martian_dst);
1810 #ifdef CONFIG_IP_ROUTE_VERBOSE
1811 	if (IN_DEV_LOG_MARTIANS(in_dev))
1812 		net_warn_ratelimited("martian destination %pI4 from %pI4, dev %s\n",
1813 				     &daddr, &saddr, dev->name);
1814 #endif
1815 
1816 e_inval:
1817 	err = -EINVAL;
1818 	goto out;
1819 
1820 e_nobufs:
1821 	err = -ENOBUFS;
1822 	goto out;
1823 
1824 martian_source:
1825 	err = -EINVAL;
1826 martian_source_keep_err:
1827 	ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
1828 	goto out;
1829 }
1830 
1831 int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1832 			 u8 tos, struct net_device *dev)
1833 {
1834 	int res;
1835 
1836 	rcu_read_lock();
1837 
1838 	/* Multicast recognition logic is moved from route cache to here.
1839 	   The problem was that too many Ethernet cards have broken/missing
1840 	   hardware multicast filters :-( As result the host on multicasting
1841 	   network acquires a lot of useless route cache entries, sort of
1842 	   SDR messages from all the world. Now we try to get rid of them.
1843 	   Really, provided software IP multicast filter is organized
1844 	   reasonably (at least, hashed), it does not result in a slowdown
1845 	   comparing with route cache reject entries.
1846 	   Note, that multicast routers are not affected, because
1847 	   route cache entry is created eventually.
1848 	 */
1849 	if (ipv4_is_multicast(daddr)) {
1850 		struct in_device *in_dev = __in_dev_get_rcu(dev);
1851 
1852 		if (in_dev) {
1853 			int our = ip_check_mc_rcu(in_dev, daddr, saddr,
1854 						  ip_hdr(skb)->protocol);
1855 			if (our
1856 #ifdef CONFIG_IP_MROUTE
1857 				||
1858 			    (!ipv4_is_local_multicast(daddr) &&
1859 			     IN_DEV_MFORWARD(in_dev))
1860 #endif
1861 			   ) {
1862 				int res = ip_route_input_mc(skb, daddr, saddr,
1863 							    tos, dev, our);
1864 				rcu_read_unlock();
1865 				return res;
1866 			}
1867 		}
1868 		rcu_read_unlock();
1869 		return -EINVAL;
1870 	}
1871 	res = ip_route_input_slow(skb, daddr, saddr, tos, dev);
1872 	rcu_read_unlock();
1873 	return res;
1874 }
1875 EXPORT_SYMBOL(ip_route_input_noref);
1876 
1877 /* called with rcu_read_lock() */
1878 static struct rtable *__mkroute_output(const struct fib_result *res,
1879 				       const struct flowi4 *fl4, int orig_oif,
1880 				       struct net_device *dev_out,
1881 				       unsigned int flags)
1882 {
1883 	struct fib_info *fi = res->fi;
1884 	struct fib_nh_exception *fnhe;
1885 	struct in_device *in_dev;
1886 	u16 type = res->type;
1887 	struct rtable *rth;
1888 	bool do_cache;
1889 
1890 	in_dev = __in_dev_get_rcu(dev_out);
1891 	if (!in_dev)
1892 		return ERR_PTR(-EINVAL);
1893 
1894 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1895 		if (ipv4_is_loopback(fl4->saddr) && !(dev_out->flags & IFF_LOOPBACK))
1896 			return ERR_PTR(-EINVAL);
1897 
1898 	if (ipv4_is_lbcast(fl4->daddr))
1899 		type = RTN_BROADCAST;
1900 	else if (ipv4_is_multicast(fl4->daddr))
1901 		type = RTN_MULTICAST;
1902 	else if (ipv4_is_zeronet(fl4->daddr))
1903 		return ERR_PTR(-EINVAL);
1904 
1905 	if (dev_out->flags & IFF_LOOPBACK)
1906 		flags |= RTCF_LOCAL;
1907 
1908 	do_cache = true;
1909 	if (type == RTN_BROADCAST) {
1910 		flags |= RTCF_BROADCAST | RTCF_LOCAL;
1911 		fi = NULL;
1912 	} else if (type == RTN_MULTICAST) {
1913 		flags |= RTCF_MULTICAST | RTCF_LOCAL;
1914 		if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
1915 				     fl4->flowi4_proto))
1916 			flags &= ~RTCF_LOCAL;
1917 		else
1918 			do_cache = false;
1919 		/* If multicast route do not exist use
1920 		 * default one, but do not gateway in this case.
1921 		 * Yes, it is hack.
1922 		 */
1923 		if (fi && res->prefixlen < 4)
1924 			fi = NULL;
1925 	}
1926 
1927 	fnhe = NULL;
1928 	do_cache &= fi != NULL;
1929 	if (do_cache) {
1930 		struct rtable __rcu **prth;
1931 		struct fib_nh *nh = &FIB_RES_NH(*res);
1932 
1933 		fnhe = find_exception(nh, fl4->daddr);
1934 		if (fnhe)
1935 			prth = &fnhe->fnhe_rth_output;
1936 		else {
1937 			if (unlikely(fl4->flowi4_flags &
1938 				     FLOWI_FLAG_KNOWN_NH &&
1939 				     !(nh->nh_gw &&
1940 				       nh->nh_scope == RT_SCOPE_LINK))) {
1941 				do_cache = false;
1942 				goto add;
1943 			}
1944 			prth = __this_cpu_ptr(nh->nh_pcpu_rth_output);
1945 		}
1946 		rth = rcu_dereference(*prth);
1947 		if (rt_cache_valid(rth)) {
1948 			dst_hold(&rth->dst);
1949 			return rth;
1950 		}
1951 	}
1952 
1953 add:
1954 	rth = rt_dst_alloc(dev_out,
1955 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1956 			   IN_DEV_CONF_GET(in_dev, NOXFRM),
1957 			   do_cache);
1958 	if (!rth)
1959 		return ERR_PTR(-ENOBUFS);
1960 
1961 	rth->dst.output = ip_output;
1962 
1963 	rth->rt_genid = rt_genid_ipv4(dev_net(dev_out));
1964 	rth->rt_flags	= flags;
1965 	rth->rt_type	= type;
1966 	rth->rt_is_input = 0;
1967 	rth->rt_iif	= orig_oif ? : 0;
1968 	rth->rt_pmtu	= 0;
1969 	rth->rt_gateway = 0;
1970 	rth->rt_uses_gateway = 0;
1971 	INIT_LIST_HEAD(&rth->rt_uncached);
1972 
1973 	RT_CACHE_STAT_INC(out_slow_tot);
1974 
1975 	if (flags & RTCF_LOCAL)
1976 		rth->dst.input = ip_local_deliver;
1977 	if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
1978 		if (flags & RTCF_LOCAL &&
1979 		    !(dev_out->flags & IFF_LOOPBACK)) {
1980 			rth->dst.output = ip_mc_output;
1981 			RT_CACHE_STAT_INC(out_slow_mc);
1982 		}
1983 #ifdef CONFIG_IP_MROUTE
1984 		if (type == RTN_MULTICAST) {
1985 			if (IN_DEV_MFORWARD(in_dev) &&
1986 			    !ipv4_is_local_multicast(fl4->daddr)) {
1987 				rth->dst.input = ip_mr_input;
1988 				rth->dst.output = ip_mc_output;
1989 			}
1990 		}
1991 #endif
1992 	}
1993 
1994 	rt_set_nexthop(rth, fl4->daddr, res, fnhe, fi, type, 0);
1995 
1996 	return rth;
1997 }
1998 
1999 /*
2000  * Major route resolver routine.
2001  */
2002 
2003 struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
2004 {
2005 	struct net_device *dev_out = NULL;
2006 	__u8 tos = RT_FL_TOS(fl4);
2007 	unsigned int flags = 0;
2008 	struct fib_result res;
2009 	struct rtable *rth;
2010 	int orig_oif;
2011 
2012 	res.tclassid	= 0;
2013 	res.fi		= NULL;
2014 	res.table	= NULL;
2015 
2016 	orig_oif = fl4->flowi4_oif;
2017 
2018 	fl4->flowi4_iif = LOOPBACK_IFINDEX;
2019 	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
2020 	fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
2021 			 RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
2022 
2023 	rcu_read_lock();
2024 	if (fl4->saddr) {
2025 		rth = ERR_PTR(-EINVAL);
2026 		if (ipv4_is_multicast(fl4->saddr) ||
2027 		    ipv4_is_lbcast(fl4->saddr) ||
2028 		    ipv4_is_zeronet(fl4->saddr))
2029 			goto out;
2030 
2031 		/* I removed check for oif == dev_out->oif here.
2032 		   It was wrong for two reasons:
2033 		   1. ip_dev_find(net, saddr) can return wrong iface, if saddr
2034 		      is assigned to multiple interfaces.
2035 		   2. Moreover, we are allowed to send packets with saddr
2036 		      of another iface. --ANK
2037 		 */
2038 
2039 		if (fl4->flowi4_oif == 0 &&
2040 		    (ipv4_is_multicast(fl4->daddr) ||
2041 		     ipv4_is_lbcast(fl4->daddr))) {
2042 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2043 			dev_out = __ip_dev_find(net, fl4->saddr, false);
2044 			if (dev_out == NULL)
2045 				goto out;
2046 
2047 			/* Special hack: user can direct multicasts
2048 			   and limited broadcast via necessary interface
2049 			   without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
2050 			   This hack is not just for fun, it allows
2051 			   vic,vat and friends to work.
2052 			   They bind socket to loopback, set ttl to zero
2053 			   and expect that it will work.
2054 			   From the viewpoint of routing cache they are broken,
2055 			   because we are not allowed to build multicast path
2056 			   with loopback source addr (look, routing cache
2057 			   cannot know, that ttl is zero, so that packet
2058 			   will not leave this host and route is valid).
2059 			   Luckily, this hack is good workaround.
2060 			 */
2061 
2062 			fl4->flowi4_oif = dev_out->ifindex;
2063 			goto make_route;
2064 		}
2065 
2066 		if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
2067 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2068 			if (!__ip_dev_find(net, fl4->saddr, false))
2069 				goto out;
2070 		}
2071 	}
2072 
2073 
2074 	if (fl4->flowi4_oif) {
2075 		dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
2076 		rth = ERR_PTR(-ENODEV);
2077 		if (dev_out == NULL)
2078 			goto out;
2079 
2080 		/* RACE: Check return value of inet_select_addr instead. */
2081 		if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
2082 			rth = ERR_PTR(-ENETUNREACH);
2083 			goto out;
2084 		}
2085 		if (ipv4_is_local_multicast(fl4->daddr) ||
2086 		    ipv4_is_lbcast(fl4->daddr)) {
2087 			if (!fl4->saddr)
2088 				fl4->saddr = inet_select_addr(dev_out, 0,
2089 							      RT_SCOPE_LINK);
2090 			goto make_route;
2091 		}
2092 		if (!fl4->saddr) {
2093 			if (ipv4_is_multicast(fl4->daddr))
2094 				fl4->saddr = inet_select_addr(dev_out, 0,
2095 							      fl4->flowi4_scope);
2096 			else if (!fl4->daddr)
2097 				fl4->saddr = inet_select_addr(dev_out, 0,
2098 							      RT_SCOPE_HOST);
2099 		}
2100 	}
2101 
2102 	if (!fl4->daddr) {
2103 		fl4->daddr = fl4->saddr;
2104 		if (!fl4->daddr)
2105 			fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
2106 		dev_out = net->loopback_dev;
2107 		fl4->flowi4_oif = LOOPBACK_IFINDEX;
2108 		res.type = RTN_LOCAL;
2109 		flags |= RTCF_LOCAL;
2110 		goto make_route;
2111 	}
2112 
2113 	if (fib_lookup(net, fl4, &res)) {
2114 		res.fi = NULL;
2115 		res.table = NULL;
2116 		if (fl4->flowi4_oif) {
2117 			/* Apparently, routing tables are wrong. Assume,
2118 			   that the destination is on link.
2119 
2120 			   WHY? DW.
2121 			   Because we are allowed to send to iface
2122 			   even if it has NO routes and NO assigned
2123 			   addresses. When oif is specified, routing
2124 			   tables are looked up with only one purpose:
2125 			   to catch if destination is gatewayed, rather than
2126 			   direct. Moreover, if MSG_DONTROUTE is set,
2127 			   we send packet, ignoring both routing tables
2128 			   and ifaddr state. --ANK
2129 
2130 
2131 			   We could make it even if oif is unknown,
2132 			   likely IPv6, but we do not.
2133 			 */
2134 
2135 			if (fl4->saddr == 0)
2136 				fl4->saddr = inet_select_addr(dev_out, 0,
2137 							      RT_SCOPE_LINK);
2138 			res.type = RTN_UNICAST;
2139 			goto make_route;
2140 		}
2141 		rth = ERR_PTR(-ENETUNREACH);
2142 		goto out;
2143 	}
2144 
2145 	if (res.type == RTN_LOCAL) {
2146 		if (!fl4->saddr) {
2147 			if (res.fi->fib_prefsrc)
2148 				fl4->saddr = res.fi->fib_prefsrc;
2149 			else
2150 				fl4->saddr = fl4->daddr;
2151 		}
2152 		dev_out = net->loopback_dev;
2153 		fl4->flowi4_oif = dev_out->ifindex;
2154 		flags |= RTCF_LOCAL;
2155 		goto make_route;
2156 	}
2157 
2158 #ifdef CONFIG_IP_ROUTE_MULTIPATH
2159 	if (res.fi->fib_nhs > 1 && fl4->flowi4_oif == 0)
2160 		fib_select_multipath(&res);
2161 	else
2162 #endif
2163 	if (!res.prefixlen &&
2164 	    res.table->tb_num_default > 1 &&
2165 	    res.type == RTN_UNICAST && !fl4->flowi4_oif)
2166 		fib_select_default(&res);
2167 
2168 	if (!fl4->saddr)
2169 		fl4->saddr = FIB_RES_PREFSRC(net, res);
2170 
2171 	dev_out = FIB_RES_DEV(res);
2172 	fl4->flowi4_oif = dev_out->ifindex;
2173 
2174 
2175 make_route:
2176 	rth = __mkroute_output(&res, fl4, orig_oif, dev_out, flags);
2177 
2178 out:
2179 	rcu_read_unlock();
2180 	return rth;
2181 }
2182 EXPORT_SYMBOL_GPL(__ip_route_output_key);
2183 
2184 static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
2185 {
2186 	return NULL;
2187 }
2188 
2189 static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
2190 {
2191 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
2192 
2193 	return mtu ? : dst->dev->mtu;
2194 }
2195 
2196 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
2197 					  struct sk_buff *skb, u32 mtu)
2198 {
2199 }
2200 
2201 static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
2202 				       struct sk_buff *skb)
2203 {
2204 }
2205 
2206 static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
2207 					  unsigned long old)
2208 {
2209 	return NULL;
2210 }
2211 
2212 static struct dst_ops ipv4_dst_blackhole_ops = {
2213 	.family			=	AF_INET,
2214 	.protocol		=	cpu_to_be16(ETH_P_IP),
2215 	.check			=	ipv4_blackhole_dst_check,
2216 	.mtu			=	ipv4_blackhole_mtu,
2217 	.default_advmss		=	ipv4_default_advmss,
2218 	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
2219 	.redirect		=	ipv4_rt_blackhole_redirect,
2220 	.cow_metrics		=	ipv4_rt_blackhole_cow_metrics,
2221 	.neigh_lookup		=	ipv4_neigh_lookup,
2222 };
2223 
2224 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
2225 {
2226 	struct rtable *ort = (struct rtable *) dst_orig;
2227 	struct rtable *rt;
2228 
2229 	rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, 0);
2230 	if (rt) {
2231 		struct dst_entry *new = &rt->dst;
2232 
2233 		new->__use = 1;
2234 		new->input = dst_discard;
2235 		new->output = dst_discard_sk;
2236 
2237 		new->dev = ort->dst.dev;
2238 		if (new->dev)
2239 			dev_hold(new->dev);
2240 
2241 		rt->rt_is_input = ort->rt_is_input;
2242 		rt->rt_iif = ort->rt_iif;
2243 		rt->rt_pmtu = ort->rt_pmtu;
2244 
2245 		rt->rt_genid = rt_genid_ipv4(net);
2246 		rt->rt_flags = ort->rt_flags;
2247 		rt->rt_type = ort->rt_type;
2248 		rt->rt_gateway = ort->rt_gateway;
2249 		rt->rt_uses_gateway = ort->rt_uses_gateway;
2250 
2251 		INIT_LIST_HEAD(&rt->rt_uncached);
2252 
2253 		dst_free(new);
2254 	}
2255 
2256 	dst_release(dst_orig);
2257 
2258 	return rt ? &rt->dst : ERR_PTR(-ENOMEM);
2259 }
2260 
2261 struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
2262 				    struct sock *sk)
2263 {
2264 	struct rtable *rt = __ip_route_output_key(net, flp4);
2265 
2266 	if (IS_ERR(rt))
2267 		return rt;
2268 
2269 	if (flp4->flowi4_proto)
2270 		rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
2271 						   flowi4_to_flowi(flp4),
2272 						   sk, 0);
2273 
2274 	return rt;
2275 }
2276 EXPORT_SYMBOL_GPL(ip_route_output_flow);
2277 
2278 static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
2279 			struct flowi4 *fl4, struct sk_buff *skb, u32 portid,
2280 			u32 seq, int event, int nowait, unsigned int flags)
2281 {
2282 	struct rtable *rt = skb_rtable(skb);
2283 	struct rtmsg *r;
2284 	struct nlmsghdr *nlh;
2285 	unsigned long expires = 0;
2286 	u32 error;
2287 	u32 metrics[RTAX_MAX];
2288 
2289 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*r), flags);
2290 	if (nlh == NULL)
2291 		return -EMSGSIZE;
2292 
2293 	r = nlmsg_data(nlh);
2294 	r->rtm_family	 = AF_INET;
2295 	r->rtm_dst_len	= 32;
2296 	r->rtm_src_len	= 0;
2297 	r->rtm_tos	= fl4->flowi4_tos;
2298 	r->rtm_table	= RT_TABLE_MAIN;
2299 	if (nla_put_u32(skb, RTA_TABLE, RT_TABLE_MAIN))
2300 		goto nla_put_failure;
2301 	r->rtm_type	= rt->rt_type;
2302 	r->rtm_scope	= RT_SCOPE_UNIVERSE;
2303 	r->rtm_protocol = RTPROT_UNSPEC;
2304 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
2305 	if (rt->rt_flags & RTCF_NOTIFY)
2306 		r->rtm_flags |= RTM_F_NOTIFY;
2307 
2308 	if (nla_put_be32(skb, RTA_DST, dst))
2309 		goto nla_put_failure;
2310 	if (src) {
2311 		r->rtm_src_len = 32;
2312 		if (nla_put_be32(skb, RTA_SRC, src))
2313 			goto nla_put_failure;
2314 	}
2315 	if (rt->dst.dev &&
2316 	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
2317 		goto nla_put_failure;
2318 #ifdef CONFIG_IP_ROUTE_CLASSID
2319 	if (rt->dst.tclassid &&
2320 	    nla_put_u32(skb, RTA_FLOW, rt->dst.tclassid))
2321 		goto nla_put_failure;
2322 #endif
2323 	if (!rt_is_input_route(rt) &&
2324 	    fl4->saddr != src) {
2325 		if (nla_put_be32(skb, RTA_PREFSRC, fl4->saddr))
2326 			goto nla_put_failure;
2327 	}
2328 	if (rt->rt_uses_gateway &&
2329 	    nla_put_be32(skb, RTA_GATEWAY, rt->rt_gateway))
2330 		goto nla_put_failure;
2331 
2332 	expires = rt->dst.expires;
2333 	if (expires) {
2334 		unsigned long now = jiffies;
2335 
2336 		if (time_before(now, expires))
2337 			expires -= now;
2338 		else
2339 			expires = 0;
2340 	}
2341 
2342 	memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
2343 	if (rt->rt_pmtu && expires)
2344 		metrics[RTAX_MTU - 1] = rt->rt_pmtu;
2345 	if (rtnetlink_put_metrics(skb, metrics) < 0)
2346 		goto nla_put_failure;
2347 
2348 	if (fl4->flowi4_mark &&
2349 	    nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
2350 		goto nla_put_failure;
2351 
2352 	error = rt->dst.error;
2353 
2354 	if (rt_is_input_route(rt)) {
2355 #ifdef CONFIG_IP_MROUTE
2356 		if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
2357 		    IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
2358 			int err = ipmr_get_route(net, skb,
2359 						 fl4->saddr, fl4->daddr,
2360 						 r, nowait);
2361 			if (err <= 0) {
2362 				if (!nowait) {
2363 					if (err == 0)
2364 						return 0;
2365 					goto nla_put_failure;
2366 				} else {
2367 					if (err == -EMSGSIZE)
2368 						goto nla_put_failure;
2369 					error = err;
2370 				}
2371 			}
2372 		} else
2373 #endif
2374 			if (nla_put_u32(skb, RTA_IIF, skb->dev->ifindex))
2375 				goto nla_put_failure;
2376 	}
2377 
2378 	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, error) < 0)
2379 		goto nla_put_failure;
2380 
2381 	return nlmsg_end(skb, nlh);
2382 
2383 nla_put_failure:
2384 	nlmsg_cancel(skb, nlh);
2385 	return -EMSGSIZE;
2386 }
2387 
2388 static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
2389 {
2390 	struct net *net = sock_net(in_skb->sk);
2391 	struct rtmsg *rtm;
2392 	struct nlattr *tb[RTA_MAX+1];
2393 	struct rtable *rt = NULL;
2394 	struct flowi4 fl4;
2395 	__be32 dst = 0;
2396 	__be32 src = 0;
2397 	u32 iif;
2398 	int err;
2399 	int mark;
2400 	struct sk_buff *skb;
2401 
2402 	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
2403 	if (err < 0)
2404 		goto errout;
2405 
2406 	rtm = nlmsg_data(nlh);
2407 
2408 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2409 	if (skb == NULL) {
2410 		err = -ENOBUFS;
2411 		goto errout;
2412 	}
2413 
2414 	/* Reserve room for dummy headers, this skb can pass
2415 	   through good chunk of routing engine.
2416 	 */
2417 	skb_reset_mac_header(skb);
2418 	skb_reset_network_header(skb);
2419 
2420 	/* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
2421 	ip_hdr(skb)->protocol = IPPROTO_ICMP;
2422 	skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
2423 
2424 	src = tb[RTA_SRC] ? nla_get_be32(tb[RTA_SRC]) : 0;
2425 	dst = tb[RTA_DST] ? nla_get_be32(tb[RTA_DST]) : 0;
2426 	iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
2427 	mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
2428 
2429 	memset(&fl4, 0, sizeof(fl4));
2430 	fl4.daddr = dst;
2431 	fl4.saddr = src;
2432 	fl4.flowi4_tos = rtm->rtm_tos;
2433 	fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
2434 	fl4.flowi4_mark = mark;
2435 
2436 	if (iif) {
2437 		struct net_device *dev;
2438 
2439 		dev = __dev_get_by_index(net, iif);
2440 		if (dev == NULL) {
2441 			err = -ENODEV;
2442 			goto errout_free;
2443 		}
2444 
2445 		skb->protocol	= htons(ETH_P_IP);
2446 		skb->dev	= dev;
2447 		skb->mark	= mark;
2448 		local_bh_disable();
2449 		err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev);
2450 		local_bh_enable();
2451 
2452 		rt = skb_rtable(skb);
2453 		if (err == 0 && rt->dst.error)
2454 			err = -rt->dst.error;
2455 	} else {
2456 		rt = ip_route_output_key(net, &fl4);
2457 
2458 		err = 0;
2459 		if (IS_ERR(rt))
2460 			err = PTR_ERR(rt);
2461 	}
2462 
2463 	if (err)
2464 		goto errout_free;
2465 
2466 	skb_dst_set(skb, &rt->dst);
2467 	if (rtm->rtm_flags & RTM_F_NOTIFY)
2468 		rt->rt_flags |= RTCF_NOTIFY;
2469 
2470 	err = rt_fill_info(net, dst, src, &fl4, skb,
2471 			   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2472 			   RTM_NEWROUTE, 0, 0);
2473 	if (err <= 0)
2474 		goto errout_free;
2475 
2476 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2477 errout:
2478 	return err;
2479 
2480 errout_free:
2481 	kfree_skb(skb);
2482 	goto errout;
2483 }
2484 
2485 void ip_rt_multicast_event(struct in_device *in_dev)
2486 {
2487 	rt_cache_flush(dev_net(in_dev->dev));
2488 }
2489 
2490 #ifdef CONFIG_SYSCTL
2491 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
2492 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
2493 static int ip_rt_gc_min_interval __read_mostly	= HZ / 2;
2494 static int ip_rt_gc_elasticity __read_mostly	= 8;
2495 
2496 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
2497 					void __user *buffer,
2498 					size_t *lenp, loff_t *ppos)
2499 {
2500 	struct net *net = (struct net *)__ctl->extra1;
2501 
2502 	if (write) {
2503 		rt_cache_flush(net);
2504 		fnhe_genid_bump(net);
2505 		return 0;
2506 	}
2507 
2508 	return -EINVAL;
2509 }
2510 
2511 static struct ctl_table ipv4_route_table[] = {
2512 	{
2513 		.procname	= "gc_thresh",
2514 		.data		= &ipv4_dst_ops.gc_thresh,
2515 		.maxlen		= sizeof(int),
2516 		.mode		= 0644,
2517 		.proc_handler	= proc_dointvec,
2518 	},
2519 	{
2520 		.procname	= "max_size",
2521 		.data		= &ip_rt_max_size,
2522 		.maxlen		= sizeof(int),
2523 		.mode		= 0644,
2524 		.proc_handler	= proc_dointvec,
2525 	},
2526 	{
2527 		/*  Deprecated. Use gc_min_interval_ms */
2528 
2529 		.procname	= "gc_min_interval",
2530 		.data		= &ip_rt_gc_min_interval,
2531 		.maxlen		= sizeof(int),
2532 		.mode		= 0644,
2533 		.proc_handler	= proc_dointvec_jiffies,
2534 	},
2535 	{
2536 		.procname	= "gc_min_interval_ms",
2537 		.data		= &ip_rt_gc_min_interval,
2538 		.maxlen		= sizeof(int),
2539 		.mode		= 0644,
2540 		.proc_handler	= proc_dointvec_ms_jiffies,
2541 	},
2542 	{
2543 		.procname	= "gc_timeout",
2544 		.data		= &ip_rt_gc_timeout,
2545 		.maxlen		= sizeof(int),
2546 		.mode		= 0644,
2547 		.proc_handler	= proc_dointvec_jiffies,
2548 	},
2549 	{
2550 		.procname	= "gc_interval",
2551 		.data		= &ip_rt_gc_interval,
2552 		.maxlen		= sizeof(int),
2553 		.mode		= 0644,
2554 		.proc_handler	= proc_dointvec_jiffies,
2555 	},
2556 	{
2557 		.procname	= "redirect_load",
2558 		.data		= &ip_rt_redirect_load,
2559 		.maxlen		= sizeof(int),
2560 		.mode		= 0644,
2561 		.proc_handler	= proc_dointvec,
2562 	},
2563 	{
2564 		.procname	= "redirect_number",
2565 		.data		= &ip_rt_redirect_number,
2566 		.maxlen		= sizeof(int),
2567 		.mode		= 0644,
2568 		.proc_handler	= proc_dointvec,
2569 	},
2570 	{
2571 		.procname	= "redirect_silence",
2572 		.data		= &ip_rt_redirect_silence,
2573 		.maxlen		= sizeof(int),
2574 		.mode		= 0644,
2575 		.proc_handler	= proc_dointvec,
2576 	},
2577 	{
2578 		.procname	= "error_cost",
2579 		.data		= &ip_rt_error_cost,
2580 		.maxlen		= sizeof(int),
2581 		.mode		= 0644,
2582 		.proc_handler	= proc_dointvec,
2583 	},
2584 	{
2585 		.procname	= "error_burst",
2586 		.data		= &ip_rt_error_burst,
2587 		.maxlen		= sizeof(int),
2588 		.mode		= 0644,
2589 		.proc_handler	= proc_dointvec,
2590 	},
2591 	{
2592 		.procname	= "gc_elasticity",
2593 		.data		= &ip_rt_gc_elasticity,
2594 		.maxlen		= sizeof(int),
2595 		.mode		= 0644,
2596 		.proc_handler	= proc_dointvec,
2597 	},
2598 	{
2599 		.procname	= "mtu_expires",
2600 		.data		= &ip_rt_mtu_expires,
2601 		.maxlen		= sizeof(int),
2602 		.mode		= 0644,
2603 		.proc_handler	= proc_dointvec_jiffies,
2604 	},
2605 	{
2606 		.procname	= "min_pmtu",
2607 		.data		= &ip_rt_min_pmtu,
2608 		.maxlen		= sizeof(int),
2609 		.mode		= 0644,
2610 		.proc_handler	= proc_dointvec,
2611 	},
2612 	{
2613 		.procname	= "min_adv_mss",
2614 		.data		= &ip_rt_min_advmss,
2615 		.maxlen		= sizeof(int),
2616 		.mode		= 0644,
2617 		.proc_handler	= proc_dointvec,
2618 	},
2619 	{ }
2620 };
2621 
2622 static struct ctl_table ipv4_route_flush_table[] = {
2623 	{
2624 		.procname	= "flush",
2625 		.maxlen		= sizeof(int),
2626 		.mode		= 0200,
2627 		.proc_handler	= ipv4_sysctl_rtcache_flush,
2628 	},
2629 	{ },
2630 };
2631 
2632 static __net_init int sysctl_route_net_init(struct net *net)
2633 {
2634 	struct ctl_table *tbl;
2635 
2636 	tbl = ipv4_route_flush_table;
2637 	if (!net_eq(net, &init_net)) {
2638 		tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
2639 		if (tbl == NULL)
2640 			goto err_dup;
2641 
2642 		/* Don't export sysctls to unprivileged users */
2643 		if (net->user_ns != &init_user_ns)
2644 			tbl[0].procname = NULL;
2645 	}
2646 	tbl[0].extra1 = net;
2647 
2648 	net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
2649 	if (net->ipv4.route_hdr == NULL)
2650 		goto err_reg;
2651 	return 0;
2652 
2653 err_reg:
2654 	if (tbl != ipv4_route_flush_table)
2655 		kfree(tbl);
2656 err_dup:
2657 	return -ENOMEM;
2658 }
2659 
2660 static __net_exit void sysctl_route_net_exit(struct net *net)
2661 {
2662 	struct ctl_table *tbl;
2663 
2664 	tbl = net->ipv4.route_hdr->ctl_table_arg;
2665 	unregister_net_sysctl_table(net->ipv4.route_hdr);
2666 	BUG_ON(tbl == ipv4_route_flush_table);
2667 	kfree(tbl);
2668 }
2669 
2670 static __net_initdata struct pernet_operations sysctl_route_ops = {
2671 	.init = sysctl_route_net_init,
2672 	.exit = sysctl_route_net_exit,
2673 };
2674 #endif
2675 
2676 static __net_init int rt_genid_init(struct net *net)
2677 {
2678 	atomic_set(&net->ipv4.rt_genid, 0);
2679 	atomic_set(&net->fnhe_genid, 0);
2680 	get_random_bytes(&net->ipv4.dev_addr_genid,
2681 			 sizeof(net->ipv4.dev_addr_genid));
2682 	return 0;
2683 }
2684 
2685 static __net_initdata struct pernet_operations rt_genid_ops = {
2686 	.init = rt_genid_init,
2687 };
2688 
2689 static int __net_init ipv4_inetpeer_init(struct net *net)
2690 {
2691 	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
2692 
2693 	if (!bp)
2694 		return -ENOMEM;
2695 	inet_peer_base_init(bp);
2696 	net->ipv4.peers = bp;
2697 	return 0;
2698 }
2699 
2700 static void __net_exit ipv4_inetpeer_exit(struct net *net)
2701 {
2702 	struct inet_peer_base *bp = net->ipv4.peers;
2703 
2704 	net->ipv4.peers = NULL;
2705 	inetpeer_invalidate_tree(bp);
2706 	kfree(bp);
2707 }
2708 
2709 static __net_initdata struct pernet_operations ipv4_inetpeer_ops = {
2710 	.init	=	ipv4_inetpeer_init,
2711 	.exit	=	ipv4_inetpeer_exit,
2712 };
2713 
2714 #ifdef CONFIG_IP_ROUTE_CLASSID
2715 struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
2716 #endif /* CONFIG_IP_ROUTE_CLASSID */
2717 
2718 int __init ip_rt_init(void)
2719 {
2720 	int rc = 0;
2721 
2722 	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
2723 	if (!ip_idents)
2724 		panic("IP: failed to allocate ip_idents\n");
2725 
2726 	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
2727 
2728 #ifdef CONFIG_IP_ROUTE_CLASSID
2729 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
2730 	if (!ip_rt_acct)
2731 		panic("IP: failed to allocate ip_rt_acct\n");
2732 #endif
2733 
2734 	ipv4_dst_ops.kmem_cachep =
2735 		kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
2736 				  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
2737 
2738 	ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
2739 
2740 	if (dst_entries_init(&ipv4_dst_ops) < 0)
2741 		panic("IP: failed to allocate ipv4_dst_ops counter\n");
2742 
2743 	if (dst_entries_init(&ipv4_dst_blackhole_ops) < 0)
2744 		panic("IP: failed to allocate ipv4_dst_blackhole_ops counter\n");
2745 
2746 	ipv4_dst_ops.gc_thresh = ~0;
2747 	ip_rt_max_size = INT_MAX;
2748 
2749 	devinet_init();
2750 	ip_fib_init();
2751 
2752 	if (ip_rt_proc_init())
2753 		pr_err("Unable to create route proc files\n");
2754 #ifdef CONFIG_XFRM
2755 	xfrm_init();
2756 	xfrm4_init();
2757 #endif
2758 	rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL, NULL);
2759 
2760 #ifdef CONFIG_SYSCTL
2761 	register_pernet_subsys(&sysctl_route_ops);
2762 #endif
2763 	register_pernet_subsys(&rt_genid_ops);
2764 	register_pernet_subsys(&ipv4_inetpeer_ops);
2765 	return rc;
2766 }
2767 
2768 #ifdef CONFIG_SYSCTL
2769 /*
2770  * We really need to sanitize the damn ipv4 init order, then all
2771  * this nonsense will go away.
2772  */
2773 void __init ip_static_sysctl_init(void)
2774 {
2775 	register_net_sysctl(&init_net, "net/ipv4/route", ipv4_route_table);
2776 }
2777 #endif
2778