xref: /openbmc/linux/net/ipv4/route.c (revision 9ac8d3fb)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		ROUTE - implementation of the IP router.
7  *
8  * Authors:	Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
11  *		Linus Torvalds, <Linus.Torvalds@helsinki.fi>
12  *		Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
13  *
14  * Fixes:
15  *		Alan Cox	:	Verify area fixes.
16  *		Alan Cox	:	cli() protects routing changes
17  *		Rui Oliveira	:	ICMP routing table updates
18  *		(rco@di.uminho.pt)	Routing table insertion and update
19  *		Linus Torvalds	:	Rewrote bits to be sensible
20  *		Alan Cox	:	Added BSD route gw semantics
21  *		Alan Cox	:	Super /proc >4K
22  *		Alan Cox	:	MTU in route table
23  *		Alan Cox	: 	MSS actually. Also added the window
24  *					clamper.
25  *		Sam Lantinga	:	Fixed route matching in rt_del()
26  *		Alan Cox	:	Routing cache support.
27  *		Alan Cox	:	Removed compatibility cruft.
28  *		Alan Cox	:	RTF_REJECT support.
29  *		Alan Cox	:	TCP irtt support.
30  *		Jonathan Naylor	:	Added Metric support.
31  *	Miquel van Smoorenburg	:	BSD API fixes.
32  *	Miquel van Smoorenburg	:	Metrics.
33  *		Alan Cox	:	Use __u32 properly
34  *		Alan Cox	:	Aligned routing errors more closely with BSD
35  *					our system is still very different.
36  *		Alan Cox	:	Faster /proc handling
37  *	Alexey Kuznetsov	:	Massive rework to support tree based routing,
38  *					routing caches and better behaviour.
39  *
40  *		Olaf Erb	:	irtt wasn't being copied right.
41  *		Bjorn Ekwall	:	Kerneld route support.
42  *		Alan Cox	:	Multicast fixed (I hope)
43  * 		Pavel Krauz	:	Limited broadcast fixed
44  *		Mike McLagan	:	Routing by source
45  *	Alexey Kuznetsov	:	End of old history. Split to fib.c and
46  *					route.c and rewritten from scratch.
47  *		Andi Kleen	:	Load-limit warning messages.
48  *	Vitaly E. Lavrov	:	Transparent proxy revived after year coma.
49  *	Vitaly E. Lavrov	:	Race condition in ip_route_input_slow.
50  *	Tobias Ringstrom	:	Uninitialized res.type in ip_route_output_slow.
51  *	Vladimir V. Ivanov	:	IP rule info (flowid) is really useful.
52  *		Marc Boucher	:	routing by fwmark
53  *	Robert Olsson		:	Added rt_cache statistics
54  *	Arnaldo C. Melo		:	Convert proc stuff to seq_file
55  *	Eric Dumazet		:	hashed spinlocks and rt_check_expire() fixes.
56  * 	Ilia Sotnikov		:	Ignore TOS on PMTUD and Redirect
57  * 	Ilia Sotnikov		:	Removed TOS from hash calculations
58  *
59  *		This program is free software; you can redistribute it and/or
60  *		modify it under the terms of the GNU General Public License
61  *		as published by the Free Software Foundation; either version
62  *		2 of the License, or (at your option) any later version.
63  */
64 
65 #include <linux/module.h>
66 #include <asm/uaccess.h>
67 #include <asm/system.h>
68 #include <linux/bitops.h>
69 #include <linux/types.h>
70 #include <linux/kernel.h>
71 #include <linux/mm.h>
72 #include <linux/bootmem.h>
73 #include <linux/string.h>
74 #include <linux/socket.h>
75 #include <linux/sockios.h>
76 #include <linux/errno.h>
77 #include <linux/in.h>
78 #include <linux/inet.h>
79 #include <linux/netdevice.h>
80 #include <linux/proc_fs.h>
81 #include <linux/init.h>
82 #include <linux/workqueue.h>
83 #include <linux/skbuff.h>
84 #include <linux/inetdevice.h>
85 #include <linux/igmp.h>
86 #include <linux/pkt_sched.h>
87 #include <linux/mroute.h>
88 #include <linux/netfilter_ipv4.h>
89 #include <linux/random.h>
90 #include <linux/jhash.h>
91 #include <linux/rcupdate.h>
92 #include <linux/times.h>
93 #include <net/dst.h>
94 #include <net/net_namespace.h>
95 #include <net/protocol.h>
96 #include <net/ip.h>
97 #include <net/route.h>
98 #include <net/inetpeer.h>
99 #include <net/sock.h>
100 #include <net/ip_fib.h>
101 #include <net/arp.h>
102 #include <net/tcp.h>
103 #include <net/icmp.h>
104 #include <net/xfrm.h>
105 #include <net/netevent.h>
106 #include <net/rtnetlink.h>
107 #ifdef CONFIG_SYSCTL
108 #include <linux/sysctl.h>
109 #endif
110 
111 #define RT_FL_TOS(oldflp) \
112     ((u32)(oldflp->fl4_tos & (IPTOS_RT_MASK | RTO_ONLINK)))
113 
114 #define IP_MAX_MTU	0xFFF0
115 
116 #define RT_GC_TIMEOUT (300*HZ)
117 
118 static int ip_rt_max_size;
119 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
120 static int ip_rt_gc_interval __read_mostly	= 60 * HZ;
121 static int ip_rt_gc_min_interval __read_mostly	= HZ / 2;
122 static int ip_rt_redirect_number __read_mostly	= 9;
123 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
124 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
125 static int ip_rt_error_cost __read_mostly	= HZ;
126 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
127 static int ip_rt_gc_elasticity __read_mostly	= 8;
128 static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
129 static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
130 static int ip_rt_min_advmss __read_mostly	= 256;
131 static int ip_rt_secret_interval __read_mostly	= 10 * 60 * HZ;
132 
133 static void rt_worker_func(struct work_struct *work);
134 static DECLARE_DELAYED_WORK(expires_work, rt_worker_func);
135 
136 /*
137  *	Interface to generic destination cache.
138  */
139 
140 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
141 static void		 ipv4_dst_destroy(struct dst_entry *dst);
142 static void		 ipv4_dst_ifdown(struct dst_entry *dst,
143 					 struct net_device *dev, int how);
144 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
145 static void		 ipv4_link_failure(struct sk_buff *skb);
146 static void		 ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
147 static int rt_garbage_collect(struct dst_ops *ops);
148 
149 
150 static struct dst_ops ipv4_dst_ops = {
151 	.family =		AF_INET,
152 	.protocol =		__constant_htons(ETH_P_IP),
153 	.gc =			rt_garbage_collect,
154 	.check =		ipv4_dst_check,
155 	.destroy =		ipv4_dst_destroy,
156 	.ifdown =		ipv4_dst_ifdown,
157 	.negative_advice =	ipv4_negative_advice,
158 	.link_failure =		ipv4_link_failure,
159 	.update_pmtu =		ip_rt_update_pmtu,
160 	.local_out =		__ip_local_out,
161 	.entry_size =		sizeof(struct rtable),
162 	.entries =		ATOMIC_INIT(0),
163 };
164 
165 #define ECN_OR_COST(class)	TC_PRIO_##class
166 
167 const __u8 ip_tos2prio[16] = {
168 	TC_PRIO_BESTEFFORT,
169 	ECN_OR_COST(FILLER),
170 	TC_PRIO_BESTEFFORT,
171 	ECN_OR_COST(BESTEFFORT),
172 	TC_PRIO_BULK,
173 	ECN_OR_COST(BULK),
174 	TC_PRIO_BULK,
175 	ECN_OR_COST(BULK),
176 	TC_PRIO_INTERACTIVE,
177 	ECN_OR_COST(INTERACTIVE),
178 	TC_PRIO_INTERACTIVE,
179 	ECN_OR_COST(INTERACTIVE),
180 	TC_PRIO_INTERACTIVE_BULK,
181 	ECN_OR_COST(INTERACTIVE_BULK),
182 	TC_PRIO_INTERACTIVE_BULK,
183 	ECN_OR_COST(INTERACTIVE_BULK)
184 };
185 
186 
187 /*
188  * Route cache.
189  */
190 
191 /* The locking scheme is rather straight forward:
192  *
193  * 1) Read-Copy Update protects the buckets of the central route hash.
194  * 2) Only writers remove entries, and they hold the lock
195  *    as they look at rtable reference counts.
196  * 3) Only readers acquire references to rtable entries,
197  *    they do so with atomic increments and with the
198  *    lock held.
199  */
200 
201 struct rt_hash_bucket {
202 	struct rtable	*chain;
203 };
204 #if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK) || \
205 	defined(CONFIG_PROVE_LOCKING)
206 /*
207  * Instead of using one spinlock for each rt_hash_bucket, we use a table of spinlocks
208  * The size of this table is a power of two and depends on the number of CPUS.
209  * (on lockdep we have a quite big spinlock_t, so keep the size down there)
210  */
211 #ifdef CONFIG_LOCKDEP
212 # define RT_HASH_LOCK_SZ	256
213 #else
214 # if NR_CPUS >= 32
215 #  define RT_HASH_LOCK_SZ	4096
216 # elif NR_CPUS >= 16
217 #  define RT_HASH_LOCK_SZ	2048
218 # elif NR_CPUS >= 8
219 #  define RT_HASH_LOCK_SZ	1024
220 # elif NR_CPUS >= 4
221 #  define RT_HASH_LOCK_SZ	512
222 # else
223 #  define RT_HASH_LOCK_SZ	256
224 # endif
225 #endif
226 
227 static spinlock_t	*rt_hash_locks;
228 # define rt_hash_lock_addr(slot) &rt_hash_locks[(slot) & (RT_HASH_LOCK_SZ - 1)]
229 
230 static __init void rt_hash_lock_init(void)
231 {
232 	int i;
233 
234 	rt_hash_locks = kmalloc(sizeof(spinlock_t) * RT_HASH_LOCK_SZ,
235 			GFP_KERNEL);
236 	if (!rt_hash_locks)
237 		panic("IP: failed to allocate rt_hash_locks\n");
238 
239 	for (i = 0; i < RT_HASH_LOCK_SZ; i++)
240 		spin_lock_init(&rt_hash_locks[i]);
241 }
242 #else
243 # define rt_hash_lock_addr(slot) NULL
244 
245 static inline void rt_hash_lock_init(void)
246 {
247 }
248 #endif
249 
250 static struct rt_hash_bucket 	*rt_hash_table __read_mostly;
251 static unsigned			rt_hash_mask __read_mostly;
252 static unsigned int		rt_hash_log  __read_mostly;
253 
254 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
255 #define RT_CACHE_STAT_INC(field) \
256 	(__raw_get_cpu_var(rt_cache_stat).field++)
257 
258 static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
259 		int genid)
260 {
261 	return jhash_3words((__force u32)(__be32)(daddr),
262 			    (__force u32)(__be32)(saddr),
263 			    idx, genid)
264 		& rt_hash_mask;
265 }
266 
267 static inline int rt_genid(struct net *net)
268 {
269 	return atomic_read(&net->ipv4.rt_genid);
270 }
271 
272 #ifdef CONFIG_PROC_FS
273 struct rt_cache_iter_state {
274 	struct seq_net_private p;
275 	int bucket;
276 	int genid;
277 };
278 
279 static struct rtable *rt_cache_get_first(struct seq_file *seq)
280 {
281 	struct rt_cache_iter_state *st = seq->private;
282 	struct rtable *r = NULL;
283 
284 	for (st->bucket = rt_hash_mask; st->bucket >= 0; --st->bucket) {
285 		if (!rt_hash_table[st->bucket].chain)
286 			continue;
287 		rcu_read_lock_bh();
288 		r = rcu_dereference(rt_hash_table[st->bucket].chain);
289 		while (r) {
290 			if (dev_net(r->u.dst.dev) == seq_file_net(seq) &&
291 			    r->rt_genid == st->genid)
292 				return r;
293 			r = rcu_dereference(r->u.dst.rt_next);
294 		}
295 		rcu_read_unlock_bh();
296 	}
297 	return r;
298 }
299 
300 static struct rtable *__rt_cache_get_next(struct seq_file *seq,
301 					  struct rtable *r)
302 {
303 	struct rt_cache_iter_state *st = seq->private;
304 
305 	r = r->u.dst.rt_next;
306 	while (!r) {
307 		rcu_read_unlock_bh();
308 		do {
309 			if (--st->bucket < 0)
310 				return NULL;
311 		} while (!rt_hash_table[st->bucket].chain);
312 		rcu_read_lock_bh();
313 		r = rt_hash_table[st->bucket].chain;
314 	}
315 	return rcu_dereference(r);
316 }
317 
318 static struct rtable *rt_cache_get_next(struct seq_file *seq,
319 					struct rtable *r)
320 {
321 	struct rt_cache_iter_state *st = seq->private;
322 	while ((r = __rt_cache_get_next(seq, r)) != NULL) {
323 		if (dev_net(r->u.dst.dev) != seq_file_net(seq))
324 			continue;
325 		if (r->rt_genid == st->genid)
326 			break;
327 	}
328 	return r;
329 }
330 
331 static struct rtable *rt_cache_get_idx(struct seq_file *seq, loff_t pos)
332 {
333 	struct rtable *r = rt_cache_get_first(seq);
334 
335 	if (r)
336 		while (pos && (r = rt_cache_get_next(seq, r)))
337 			--pos;
338 	return pos ? NULL : r;
339 }
340 
341 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
342 {
343 	struct rt_cache_iter_state *st = seq->private;
344 	if (*pos)
345 		return rt_cache_get_idx(seq, *pos - 1);
346 	st->genid = rt_genid(seq_file_net(seq));
347 	return SEQ_START_TOKEN;
348 }
349 
350 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
351 {
352 	struct rtable *r;
353 
354 	if (v == SEQ_START_TOKEN)
355 		r = rt_cache_get_first(seq);
356 	else
357 		r = rt_cache_get_next(seq, v);
358 	++*pos;
359 	return r;
360 }
361 
362 static void rt_cache_seq_stop(struct seq_file *seq, void *v)
363 {
364 	if (v && v != SEQ_START_TOKEN)
365 		rcu_read_unlock_bh();
366 }
367 
368 static int rt_cache_seq_show(struct seq_file *seq, void *v)
369 {
370 	if (v == SEQ_START_TOKEN)
371 		seq_printf(seq, "%-127s\n",
372 			   "Iface\tDestination\tGateway \tFlags\t\tRefCnt\tUse\t"
373 			   "Metric\tSource\t\tMTU\tWindow\tIRTT\tTOS\tHHRef\t"
374 			   "HHUptod\tSpecDst");
375 	else {
376 		struct rtable *r = v;
377 		int len;
378 
379 		seq_printf(seq, "%s\t%08lX\t%08lX\t%8X\t%d\t%u\t%d\t"
380 			      "%08lX\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
381 			r->u.dst.dev ? r->u.dst.dev->name : "*",
382 			(unsigned long)r->rt_dst, (unsigned long)r->rt_gateway,
383 			r->rt_flags, atomic_read(&r->u.dst.__refcnt),
384 			r->u.dst.__use, 0, (unsigned long)r->rt_src,
385 			(dst_metric(&r->u.dst, RTAX_ADVMSS) ?
386 			     (int)dst_metric(&r->u.dst, RTAX_ADVMSS) + 40 : 0),
387 			dst_metric(&r->u.dst, RTAX_WINDOW),
388 			(int)((dst_metric(&r->u.dst, RTAX_RTT) >> 3) +
389 			      dst_metric(&r->u.dst, RTAX_RTTVAR)),
390 			r->fl.fl4_tos,
391 			r->u.dst.hh ? atomic_read(&r->u.dst.hh->hh_refcnt) : -1,
392 			r->u.dst.hh ? (r->u.dst.hh->hh_output ==
393 				       dev_queue_xmit) : 0,
394 			r->rt_spec_dst, &len);
395 
396 		seq_printf(seq, "%*s\n", 127 - len, "");
397 	}
398 	return 0;
399 }
400 
401 static const struct seq_operations rt_cache_seq_ops = {
402 	.start  = rt_cache_seq_start,
403 	.next   = rt_cache_seq_next,
404 	.stop   = rt_cache_seq_stop,
405 	.show   = rt_cache_seq_show,
406 };
407 
408 static int rt_cache_seq_open(struct inode *inode, struct file *file)
409 {
410 	return seq_open_net(inode, file, &rt_cache_seq_ops,
411 			sizeof(struct rt_cache_iter_state));
412 }
413 
414 static const struct file_operations rt_cache_seq_fops = {
415 	.owner	 = THIS_MODULE,
416 	.open	 = rt_cache_seq_open,
417 	.read	 = seq_read,
418 	.llseek	 = seq_lseek,
419 	.release = seq_release_net,
420 };
421 
422 
423 static void *rt_cpu_seq_start(struct seq_file *seq, loff_t *pos)
424 {
425 	int cpu;
426 
427 	if (*pos == 0)
428 		return SEQ_START_TOKEN;
429 
430 	for (cpu = *pos-1; cpu < NR_CPUS; ++cpu) {
431 		if (!cpu_possible(cpu))
432 			continue;
433 		*pos = cpu+1;
434 		return &per_cpu(rt_cache_stat, cpu);
435 	}
436 	return NULL;
437 }
438 
439 static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
440 {
441 	int cpu;
442 
443 	for (cpu = *pos; cpu < NR_CPUS; ++cpu) {
444 		if (!cpu_possible(cpu))
445 			continue;
446 		*pos = cpu+1;
447 		return &per_cpu(rt_cache_stat, cpu);
448 	}
449 	return NULL;
450 
451 }
452 
453 static void rt_cpu_seq_stop(struct seq_file *seq, void *v)
454 {
455 
456 }
457 
458 static int rt_cpu_seq_show(struct seq_file *seq, void *v)
459 {
460 	struct rt_cache_stat *st = v;
461 
462 	if (v == SEQ_START_TOKEN) {
463 		seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
464 		return 0;
465 	}
466 
467 	seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
468 		   " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
469 		   atomic_read(&ipv4_dst_ops.entries),
470 		   st->in_hit,
471 		   st->in_slow_tot,
472 		   st->in_slow_mc,
473 		   st->in_no_route,
474 		   st->in_brd,
475 		   st->in_martian_dst,
476 		   st->in_martian_src,
477 
478 		   st->out_hit,
479 		   st->out_slow_tot,
480 		   st->out_slow_mc,
481 
482 		   st->gc_total,
483 		   st->gc_ignored,
484 		   st->gc_goal_miss,
485 		   st->gc_dst_overflow,
486 		   st->in_hlist_search,
487 		   st->out_hlist_search
488 		);
489 	return 0;
490 }
491 
492 static const struct seq_operations rt_cpu_seq_ops = {
493 	.start  = rt_cpu_seq_start,
494 	.next   = rt_cpu_seq_next,
495 	.stop   = rt_cpu_seq_stop,
496 	.show   = rt_cpu_seq_show,
497 };
498 
499 
500 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
501 {
502 	return seq_open(file, &rt_cpu_seq_ops);
503 }
504 
505 static const struct file_operations rt_cpu_seq_fops = {
506 	.owner	 = THIS_MODULE,
507 	.open	 = rt_cpu_seq_open,
508 	.read	 = seq_read,
509 	.llseek	 = seq_lseek,
510 	.release = seq_release,
511 };
512 
513 #ifdef CONFIG_NET_CLS_ROUTE
514 static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
515 			   int length, int *eof, void *data)
516 {
517 	unsigned int i;
518 
519 	if ((offset & 3) || (length & 3))
520 		return -EIO;
521 
522 	if (offset >= sizeof(struct ip_rt_acct) * 256) {
523 		*eof = 1;
524 		return 0;
525 	}
526 
527 	if (offset + length >= sizeof(struct ip_rt_acct) * 256) {
528 		length = sizeof(struct ip_rt_acct) * 256 - offset;
529 		*eof = 1;
530 	}
531 
532 	offset /= sizeof(u32);
533 
534 	if (length > 0) {
535 		u32 *dst = (u32 *) buffer;
536 
537 		*start = buffer;
538 		memset(dst, 0, length);
539 
540 		for_each_possible_cpu(i) {
541 			unsigned int j;
542 			u32 *src;
543 
544 			src = ((u32 *) per_cpu_ptr(ip_rt_acct, i)) + offset;
545 			for (j = 0; j < length/4; j++)
546 				dst[j] += src[j];
547 		}
548 	}
549 	return length;
550 }
551 #endif
552 
553 static int __net_init ip_rt_do_proc_init(struct net *net)
554 {
555 	struct proc_dir_entry *pde;
556 
557 	pde = proc_net_fops_create(net, "rt_cache", S_IRUGO,
558 			&rt_cache_seq_fops);
559 	if (!pde)
560 		goto err1;
561 
562 	pde = proc_create("rt_cache", S_IRUGO,
563 			  net->proc_net_stat, &rt_cpu_seq_fops);
564 	if (!pde)
565 		goto err2;
566 
567 #ifdef CONFIG_NET_CLS_ROUTE
568 	pde = create_proc_read_entry("rt_acct", 0, net->proc_net,
569 			ip_rt_acct_read, NULL);
570 	if (!pde)
571 		goto err3;
572 #endif
573 	return 0;
574 
575 #ifdef CONFIG_NET_CLS_ROUTE
576 err3:
577 	remove_proc_entry("rt_cache", net->proc_net_stat);
578 #endif
579 err2:
580 	remove_proc_entry("rt_cache", net->proc_net);
581 err1:
582 	return -ENOMEM;
583 }
584 
585 static void __net_exit ip_rt_do_proc_exit(struct net *net)
586 {
587 	remove_proc_entry("rt_cache", net->proc_net_stat);
588 	remove_proc_entry("rt_cache", net->proc_net);
589 	remove_proc_entry("rt_acct", net->proc_net);
590 }
591 
592 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
593 	.init = ip_rt_do_proc_init,
594 	.exit = ip_rt_do_proc_exit,
595 };
596 
597 static int __init ip_rt_proc_init(void)
598 {
599 	return register_pernet_subsys(&ip_rt_proc_ops);
600 }
601 
602 #else
603 static inline int ip_rt_proc_init(void)
604 {
605 	return 0;
606 }
607 #endif /* CONFIG_PROC_FS */
608 
609 static inline void rt_free(struct rtable *rt)
610 {
611 	call_rcu_bh(&rt->u.dst.rcu_head, dst_rcu_free);
612 }
613 
614 static inline void rt_drop(struct rtable *rt)
615 {
616 	ip_rt_put(rt);
617 	call_rcu_bh(&rt->u.dst.rcu_head, dst_rcu_free);
618 }
619 
620 static inline int rt_fast_clean(struct rtable *rth)
621 {
622 	/* Kill broadcast/multicast entries very aggresively, if they
623 	   collide in hash table with more useful entries */
624 	return (rth->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) &&
625 		rth->fl.iif && rth->u.dst.rt_next;
626 }
627 
628 static inline int rt_valuable(struct rtable *rth)
629 {
630 	return (rth->rt_flags & (RTCF_REDIRECTED | RTCF_NOTIFY)) ||
631 		rth->u.dst.expires;
632 }
633 
634 static int rt_may_expire(struct rtable *rth, unsigned long tmo1, unsigned long tmo2)
635 {
636 	unsigned long age;
637 	int ret = 0;
638 
639 	if (atomic_read(&rth->u.dst.__refcnt))
640 		goto out;
641 
642 	ret = 1;
643 	if (rth->u.dst.expires &&
644 	    time_after_eq(jiffies, rth->u.dst.expires))
645 		goto out;
646 
647 	age = jiffies - rth->u.dst.lastuse;
648 	ret = 0;
649 	if ((age <= tmo1 && !rt_fast_clean(rth)) ||
650 	    (age <= tmo2 && rt_valuable(rth)))
651 		goto out;
652 	ret = 1;
653 out:	return ret;
654 }
655 
656 /* Bits of score are:
657  * 31: very valuable
658  * 30: not quite useless
659  * 29..0: usage counter
660  */
661 static inline u32 rt_score(struct rtable *rt)
662 {
663 	u32 score = jiffies - rt->u.dst.lastuse;
664 
665 	score = ~score & ~(3<<30);
666 
667 	if (rt_valuable(rt))
668 		score |= (1<<31);
669 
670 	if (!rt->fl.iif ||
671 	    !(rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST|RTCF_LOCAL)))
672 		score |= (1<<30);
673 
674 	return score;
675 }
676 
677 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
678 {
679 	return ((__force u32)((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
680 		(fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr)) |
681 		(fl1->mark ^ fl2->mark) |
682 		(*(u16 *)&fl1->nl_u.ip4_u.tos ^
683 		 *(u16 *)&fl2->nl_u.ip4_u.tos) |
684 		(fl1->oif ^ fl2->oif) |
685 		(fl1->iif ^ fl2->iif)) == 0;
686 }
687 
688 static inline int compare_netns(struct rtable *rt1, struct rtable *rt2)
689 {
690 	return dev_net(rt1->u.dst.dev) == dev_net(rt2->u.dst.dev);
691 }
692 
693 static inline int rt_is_expired(struct rtable *rth)
694 {
695 	return rth->rt_genid != rt_genid(dev_net(rth->u.dst.dev));
696 }
697 
698 /*
699  * Perform a full scan of hash table and free all entries.
700  * Can be called by a softirq or a process.
701  * In the later case, we want to be reschedule if necessary
702  */
703 static void rt_do_flush(int process_context)
704 {
705 	unsigned int i;
706 	struct rtable *rth, *next;
707 	struct rtable * tail;
708 
709 	for (i = 0; i <= rt_hash_mask; i++) {
710 		if (process_context && need_resched())
711 			cond_resched();
712 		rth = rt_hash_table[i].chain;
713 		if (!rth)
714 			continue;
715 
716 		spin_lock_bh(rt_hash_lock_addr(i));
717 #ifdef CONFIG_NET_NS
718 		{
719 		struct rtable ** prev, * p;
720 
721 		rth = rt_hash_table[i].chain;
722 
723 		/* defer releasing the head of the list after spin_unlock */
724 		for (tail = rth; tail; tail = tail->u.dst.rt_next)
725 			if (!rt_is_expired(tail))
726 				break;
727 		if (rth != tail)
728 			rt_hash_table[i].chain = tail;
729 
730 		/* call rt_free on entries after the tail requiring flush */
731 		prev = &rt_hash_table[i].chain;
732 		for (p = *prev; p; p = next) {
733 			next = p->u.dst.rt_next;
734 			if (!rt_is_expired(p)) {
735 				prev = &p->u.dst.rt_next;
736 			} else {
737 				*prev = next;
738 				rt_free(p);
739 			}
740 		}
741 		}
742 #else
743 		rth = rt_hash_table[i].chain;
744 		rt_hash_table[i].chain = NULL;
745 		tail = NULL;
746 #endif
747 		spin_unlock_bh(rt_hash_lock_addr(i));
748 
749 		for (; rth != tail; rth = next) {
750 			next = rth->u.dst.rt_next;
751 			rt_free(rth);
752 		}
753 	}
754 }
755 
756 static void rt_check_expire(void)
757 {
758 	static unsigned int rover;
759 	unsigned int i = rover, goal;
760 	struct rtable *rth, **rthp;
761 	u64 mult;
762 
763 	mult = ((u64)ip_rt_gc_interval) << rt_hash_log;
764 	if (ip_rt_gc_timeout > 1)
765 		do_div(mult, ip_rt_gc_timeout);
766 	goal = (unsigned int)mult;
767 	if (goal > rt_hash_mask)
768 		goal = rt_hash_mask + 1;
769 	for (; goal > 0; goal--) {
770 		unsigned long tmo = ip_rt_gc_timeout;
771 
772 		i = (i + 1) & rt_hash_mask;
773 		rthp = &rt_hash_table[i].chain;
774 
775 		if (need_resched())
776 			cond_resched();
777 
778 		if (*rthp == NULL)
779 			continue;
780 		spin_lock_bh(rt_hash_lock_addr(i));
781 		while ((rth = *rthp) != NULL) {
782 			if (rt_is_expired(rth)) {
783 				*rthp = rth->u.dst.rt_next;
784 				rt_free(rth);
785 				continue;
786 			}
787 			if (rth->u.dst.expires) {
788 				/* Entry is expired even if it is in use */
789 				if (time_before_eq(jiffies, rth->u.dst.expires)) {
790 					tmo >>= 1;
791 					rthp = &rth->u.dst.rt_next;
792 					continue;
793 				}
794 			} else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout)) {
795 				tmo >>= 1;
796 				rthp = &rth->u.dst.rt_next;
797 				continue;
798 			}
799 
800 			/* Cleanup aged off entries. */
801 			*rthp = rth->u.dst.rt_next;
802 			rt_free(rth);
803 		}
804 		spin_unlock_bh(rt_hash_lock_addr(i));
805 	}
806 	rover = i;
807 }
808 
809 /*
810  * rt_worker_func() is run in process context.
811  * we call rt_check_expire() to scan part of the hash table
812  */
813 static void rt_worker_func(struct work_struct *work)
814 {
815 	rt_check_expire();
816 	schedule_delayed_work(&expires_work, ip_rt_gc_interval);
817 }
818 
819 /*
820  * Pertubation of rt_genid by a small quantity [1..256]
821  * Using 8 bits of shuffling ensure we can call rt_cache_invalidate()
822  * many times (2^24) without giving recent rt_genid.
823  * Jenkins hash is strong enough that litle changes of rt_genid are OK.
824  */
825 static void rt_cache_invalidate(struct net *net)
826 {
827 	unsigned char shuffle;
828 
829 	get_random_bytes(&shuffle, sizeof(shuffle));
830 	atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
831 }
832 
833 /*
834  * delay < 0  : invalidate cache (fast : entries will be deleted later)
835  * delay >= 0 : invalidate & flush cache (can be long)
836  */
837 void rt_cache_flush(struct net *net, int delay)
838 {
839 	rt_cache_invalidate(net);
840 	if (delay >= 0)
841 		rt_do_flush(!in_softirq());
842 }
843 
844 /*
845  * We change rt_genid and let gc do the cleanup
846  */
847 static void rt_secret_rebuild(unsigned long __net)
848 {
849 	struct net *net = (struct net *)__net;
850 	rt_cache_invalidate(net);
851 	mod_timer(&net->ipv4.rt_secret_timer, jiffies + ip_rt_secret_interval);
852 }
853 
854 /*
855    Short description of GC goals.
856 
857    We want to build algorithm, which will keep routing cache
858    at some equilibrium point, when number of aged off entries
859    is kept approximately equal to newly generated ones.
860 
861    Current expiration strength is variable "expire".
862    We try to adjust it dynamically, so that if networking
863    is idle expires is large enough to keep enough of warm entries,
864    and when load increases it reduces to limit cache size.
865  */
866 
867 static int rt_garbage_collect(struct dst_ops *ops)
868 {
869 	static unsigned long expire = RT_GC_TIMEOUT;
870 	static unsigned long last_gc;
871 	static int rover;
872 	static int equilibrium;
873 	struct rtable *rth, **rthp;
874 	unsigned long now = jiffies;
875 	int goal;
876 
877 	/*
878 	 * Garbage collection is pretty expensive,
879 	 * do not make it too frequently.
880 	 */
881 
882 	RT_CACHE_STAT_INC(gc_total);
883 
884 	if (now - last_gc < ip_rt_gc_min_interval &&
885 	    atomic_read(&ipv4_dst_ops.entries) < ip_rt_max_size) {
886 		RT_CACHE_STAT_INC(gc_ignored);
887 		goto out;
888 	}
889 
890 	/* Calculate number of entries, which we want to expire now. */
891 	goal = atomic_read(&ipv4_dst_ops.entries) -
892 		(ip_rt_gc_elasticity << rt_hash_log);
893 	if (goal <= 0) {
894 		if (equilibrium < ipv4_dst_ops.gc_thresh)
895 			equilibrium = ipv4_dst_ops.gc_thresh;
896 		goal = atomic_read(&ipv4_dst_ops.entries) - equilibrium;
897 		if (goal > 0) {
898 			equilibrium += min_t(unsigned int, goal >> 1, rt_hash_mask + 1);
899 			goal = atomic_read(&ipv4_dst_ops.entries) - equilibrium;
900 		}
901 	} else {
902 		/* We are in dangerous area. Try to reduce cache really
903 		 * aggressively.
904 		 */
905 		goal = max_t(unsigned int, goal >> 1, rt_hash_mask + 1);
906 		equilibrium = atomic_read(&ipv4_dst_ops.entries) - goal;
907 	}
908 
909 	if (now - last_gc >= ip_rt_gc_min_interval)
910 		last_gc = now;
911 
912 	if (goal <= 0) {
913 		equilibrium += goal;
914 		goto work_done;
915 	}
916 
917 	do {
918 		int i, k;
919 
920 		for (i = rt_hash_mask, k = rover; i >= 0; i--) {
921 			unsigned long tmo = expire;
922 
923 			k = (k + 1) & rt_hash_mask;
924 			rthp = &rt_hash_table[k].chain;
925 			spin_lock_bh(rt_hash_lock_addr(k));
926 			while ((rth = *rthp) != NULL) {
927 				if (!rt_is_expired(rth) &&
928 					!rt_may_expire(rth, tmo, expire)) {
929 					tmo >>= 1;
930 					rthp = &rth->u.dst.rt_next;
931 					continue;
932 				}
933 				*rthp = rth->u.dst.rt_next;
934 				rt_free(rth);
935 				goal--;
936 			}
937 			spin_unlock_bh(rt_hash_lock_addr(k));
938 			if (goal <= 0)
939 				break;
940 		}
941 		rover = k;
942 
943 		if (goal <= 0)
944 			goto work_done;
945 
946 		/* Goal is not achieved. We stop process if:
947 
948 		   - if expire reduced to zero. Otherwise, expire is halfed.
949 		   - if table is not full.
950 		   - if we are called from interrupt.
951 		   - jiffies check is just fallback/debug loop breaker.
952 		     We will not spin here for long time in any case.
953 		 */
954 
955 		RT_CACHE_STAT_INC(gc_goal_miss);
956 
957 		if (expire == 0)
958 			break;
959 
960 		expire >>= 1;
961 #if RT_CACHE_DEBUG >= 2
962 		printk(KERN_DEBUG "expire>> %u %d %d %d\n", expire,
963 				atomic_read(&ipv4_dst_ops.entries), goal, i);
964 #endif
965 
966 		if (atomic_read(&ipv4_dst_ops.entries) < ip_rt_max_size)
967 			goto out;
968 	} while (!in_softirq() && time_before_eq(jiffies, now));
969 
970 	if (atomic_read(&ipv4_dst_ops.entries) < ip_rt_max_size)
971 		goto out;
972 	if (net_ratelimit())
973 		printk(KERN_WARNING "dst cache overflow\n");
974 	RT_CACHE_STAT_INC(gc_dst_overflow);
975 	return 1;
976 
977 work_done:
978 	expire += ip_rt_gc_min_interval;
979 	if (expire > ip_rt_gc_timeout ||
980 	    atomic_read(&ipv4_dst_ops.entries) < ipv4_dst_ops.gc_thresh)
981 		expire = ip_rt_gc_timeout;
982 #if RT_CACHE_DEBUG >= 2
983 	printk(KERN_DEBUG "expire++ %u %d %d %d\n", expire,
984 			atomic_read(&ipv4_dst_ops.entries), goal, rover);
985 #endif
986 out:	return 0;
987 }
988 
989 static int rt_intern_hash(unsigned hash, struct rtable *rt, struct rtable **rp)
990 {
991 	struct rtable	*rth, **rthp;
992 	unsigned long	now;
993 	struct rtable *cand, **candp;
994 	u32 		min_score;
995 	int		chain_length;
996 	int attempts = !in_softirq();
997 
998 restart:
999 	chain_length = 0;
1000 	min_score = ~(u32)0;
1001 	cand = NULL;
1002 	candp = NULL;
1003 	now = jiffies;
1004 
1005 	rthp = &rt_hash_table[hash].chain;
1006 
1007 	spin_lock_bh(rt_hash_lock_addr(hash));
1008 	while ((rth = *rthp) != NULL) {
1009 		if (rt_is_expired(rth)) {
1010 			*rthp = rth->u.dst.rt_next;
1011 			rt_free(rth);
1012 			continue;
1013 		}
1014 		if (compare_keys(&rth->fl, &rt->fl) && compare_netns(rth, rt)) {
1015 			/* Put it first */
1016 			*rthp = rth->u.dst.rt_next;
1017 			/*
1018 			 * Since lookup is lockfree, the deletion
1019 			 * must be visible to another weakly ordered CPU before
1020 			 * the insertion at the start of the hash chain.
1021 			 */
1022 			rcu_assign_pointer(rth->u.dst.rt_next,
1023 					   rt_hash_table[hash].chain);
1024 			/*
1025 			 * Since lookup is lockfree, the update writes
1026 			 * must be ordered for consistency on SMP.
1027 			 */
1028 			rcu_assign_pointer(rt_hash_table[hash].chain, rth);
1029 
1030 			dst_use(&rth->u.dst, now);
1031 			spin_unlock_bh(rt_hash_lock_addr(hash));
1032 
1033 			rt_drop(rt);
1034 			*rp = rth;
1035 			return 0;
1036 		}
1037 
1038 		if (!atomic_read(&rth->u.dst.__refcnt)) {
1039 			u32 score = rt_score(rth);
1040 
1041 			if (score <= min_score) {
1042 				cand = rth;
1043 				candp = rthp;
1044 				min_score = score;
1045 			}
1046 		}
1047 
1048 		chain_length++;
1049 
1050 		rthp = &rth->u.dst.rt_next;
1051 	}
1052 
1053 	if (cand) {
1054 		/* ip_rt_gc_elasticity used to be average length of chain
1055 		 * length, when exceeded gc becomes really aggressive.
1056 		 *
1057 		 * The second limit is less certain. At the moment it allows
1058 		 * only 2 entries per bucket. We will see.
1059 		 */
1060 		if (chain_length > ip_rt_gc_elasticity) {
1061 			*candp = cand->u.dst.rt_next;
1062 			rt_free(cand);
1063 		}
1064 	}
1065 
1066 	/* Try to bind route to arp only if it is output
1067 	   route or unicast forwarding path.
1068 	 */
1069 	if (rt->rt_type == RTN_UNICAST || rt->fl.iif == 0) {
1070 		int err = arp_bind_neighbour(&rt->u.dst);
1071 		if (err) {
1072 			spin_unlock_bh(rt_hash_lock_addr(hash));
1073 
1074 			if (err != -ENOBUFS) {
1075 				rt_drop(rt);
1076 				return err;
1077 			}
1078 
1079 			/* Neighbour tables are full and nothing
1080 			   can be released. Try to shrink route cache,
1081 			   it is most likely it holds some neighbour records.
1082 			 */
1083 			if (attempts-- > 0) {
1084 				int saved_elasticity = ip_rt_gc_elasticity;
1085 				int saved_int = ip_rt_gc_min_interval;
1086 				ip_rt_gc_elasticity	= 1;
1087 				ip_rt_gc_min_interval	= 0;
1088 				rt_garbage_collect(&ipv4_dst_ops);
1089 				ip_rt_gc_min_interval	= saved_int;
1090 				ip_rt_gc_elasticity	= saved_elasticity;
1091 				goto restart;
1092 			}
1093 
1094 			if (net_ratelimit())
1095 				printk(KERN_WARNING "Neighbour table overflow.\n");
1096 			rt_drop(rt);
1097 			return -ENOBUFS;
1098 		}
1099 	}
1100 
1101 	rt->u.dst.rt_next = rt_hash_table[hash].chain;
1102 #if RT_CACHE_DEBUG >= 2
1103 	if (rt->u.dst.rt_next) {
1104 		struct rtable *trt;
1105 		printk(KERN_DEBUG "rt_cache @%02x: " NIPQUAD_FMT, hash,
1106 		       NIPQUAD(rt->rt_dst));
1107 		for (trt = rt->u.dst.rt_next; trt; trt = trt->u.dst.rt_next)
1108 			printk(" . " NIPQUAD_FMT, NIPQUAD(trt->rt_dst));
1109 		printk("\n");
1110 	}
1111 #endif
1112 	/*
1113 	 * Since lookup is lockfree, we must make sure
1114 	 * previous writes to rt are comitted to memory
1115 	 * before making rt visible to other CPUS.
1116 	 */
1117 	rcu_assign_pointer(rt_hash_table[hash].chain, rt);
1118 	spin_unlock_bh(rt_hash_lock_addr(hash));
1119 	*rp = rt;
1120 	return 0;
1121 }
1122 
1123 void rt_bind_peer(struct rtable *rt, int create)
1124 {
1125 	static DEFINE_SPINLOCK(rt_peer_lock);
1126 	struct inet_peer *peer;
1127 
1128 	peer = inet_getpeer(rt->rt_dst, create);
1129 
1130 	spin_lock_bh(&rt_peer_lock);
1131 	if (rt->peer == NULL) {
1132 		rt->peer = peer;
1133 		peer = NULL;
1134 	}
1135 	spin_unlock_bh(&rt_peer_lock);
1136 	if (peer)
1137 		inet_putpeer(peer);
1138 }
1139 
1140 /*
1141  * Peer allocation may fail only in serious out-of-memory conditions.  However
1142  * we still can generate some output.
1143  * Random ID selection looks a bit dangerous because we have no chances to
1144  * select ID being unique in a reasonable period of time.
1145  * But broken packet identifier may be better than no packet at all.
1146  */
1147 static void ip_select_fb_ident(struct iphdr *iph)
1148 {
1149 	static DEFINE_SPINLOCK(ip_fb_id_lock);
1150 	static u32 ip_fallback_id;
1151 	u32 salt;
1152 
1153 	spin_lock_bh(&ip_fb_id_lock);
1154 	salt = secure_ip_id((__force __be32)ip_fallback_id ^ iph->daddr);
1155 	iph->id = htons(salt & 0xFFFF);
1156 	ip_fallback_id = salt;
1157 	spin_unlock_bh(&ip_fb_id_lock);
1158 }
1159 
1160 void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
1161 {
1162 	struct rtable *rt = (struct rtable *) dst;
1163 
1164 	if (rt) {
1165 		if (rt->peer == NULL)
1166 			rt_bind_peer(rt, 1);
1167 
1168 		/* If peer is attached to destination, it is never detached,
1169 		   so that we need not to grab a lock to dereference it.
1170 		 */
1171 		if (rt->peer) {
1172 			iph->id = htons(inet_getid(rt->peer, more));
1173 			return;
1174 		}
1175 	} else
1176 		printk(KERN_DEBUG "rt_bind_peer(0) @%p\n",
1177 		       __builtin_return_address(0));
1178 
1179 	ip_select_fb_ident(iph);
1180 }
1181 
1182 static void rt_del(unsigned hash, struct rtable *rt)
1183 {
1184 	struct rtable **rthp, *aux;
1185 
1186 	rthp = &rt_hash_table[hash].chain;
1187 	spin_lock_bh(rt_hash_lock_addr(hash));
1188 	ip_rt_put(rt);
1189 	while ((aux = *rthp) != NULL) {
1190 		if (aux == rt || rt_is_expired(aux)) {
1191 			*rthp = aux->u.dst.rt_next;
1192 			rt_free(aux);
1193 			continue;
1194 		}
1195 		rthp = &aux->u.dst.rt_next;
1196 	}
1197 	spin_unlock_bh(rt_hash_lock_addr(hash));
1198 }
1199 
1200 void ip_rt_redirect(__be32 old_gw, __be32 daddr, __be32 new_gw,
1201 		    __be32 saddr, struct net_device *dev)
1202 {
1203 	int i, k;
1204 	struct in_device *in_dev = in_dev_get(dev);
1205 	struct rtable *rth, **rthp;
1206 	__be32  skeys[2] = { saddr, 0 };
1207 	int  ikeys[2] = { dev->ifindex, 0 };
1208 	struct netevent_redirect netevent;
1209 	struct net *net;
1210 
1211 	if (!in_dev)
1212 		return;
1213 
1214 	net = dev_net(dev);
1215 	if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev)
1216 	    || ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw)
1217 	    || ipv4_is_zeronet(new_gw))
1218 		goto reject_redirect;
1219 
1220 	if (!IN_DEV_SHARED_MEDIA(in_dev)) {
1221 		if (!inet_addr_onlink(in_dev, new_gw, old_gw))
1222 			goto reject_redirect;
1223 		if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
1224 			goto reject_redirect;
1225 	} else {
1226 		if (inet_addr_type(net, new_gw) != RTN_UNICAST)
1227 			goto reject_redirect;
1228 	}
1229 
1230 	for (i = 0; i < 2; i++) {
1231 		for (k = 0; k < 2; k++) {
1232 			unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
1233 						rt_genid(net));
1234 
1235 			rthp=&rt_hash_table[hash].chain;
1236 
1237 			rcu_read_lock();
1238 			while ((rth = rcu_dereference(*rthp)) != NULL) {
1239 				struct rtable *rt;
1240 
1241 				if (rth->fl.fl4_dst != daddr ||
1242 				    rth->fl.fl4_src != skeys[i] ||
1243 				    rth->fl.oif != ikeys[k] ||
1244 				    rth->fl.iif != 0 ||
1245 				    rt_is_expired(rth) ||
1246 				    !net_eq(dev_net(rth->u.dst.dev), net)) {
1247 					rthp = &rth->u.dst.rt_next;
1248 					continue;
1249 				}
1250 
1251 				if (rth->rt_dst != daddr ||
1252 				    rth->rt_src != saddr ||
1253 				    rth->u.dst.error ||
1254 				    rth->rt_gateway != old_gw ||
1255 				    rth->u.dst.dev != dev)
1256 					break;
1257 
1258 				dst_hold(&rth->u.dst);
1259 				rcu_read_unlock();
1260 
1261 				rt = dst_alloc(&ipv4_dst_ops);
1262 				if (rt == NULL) {
1263 					ip_rt_put(rth);
1264 					in_dev_put(in_dev);
1265 					return;
1266 				}
1267 
1268 				/* Copy all the information. */
1269 				*rt = *rth;
1270 				INIT_RCU_HEAD(&rt->u.dst.rcu_head);
1271 				rt->u.dst.__use		= 1;
1272 				atomic_set(&rt->u.dst.__refcnt, 1);
1273 				rt->u.dst.child		= NULL;
1274 				if (rt->u.dst.dev)
1275 					dev_hold(rt->u.dst.dev);
1276 				if (rt->idev)
1277 					in_dev_hold(rt->idev);
1278 				rt->u.dst.obsolete	= 0;
1279 				rt->u.dst.lastuse	= jiffies;
1280 				rt->u.dst.path		= &rt->u.dst;
1281 				rt->u.dst.neighbour	= NULL;
1282 				rt->u.dst.hh		= NULL;
1283 				rt->u.dst.xfrm		= NULL;
1284 				rt->rt_genid		= rt_genid(net);
1285 				rt->rt_flags		|= RTCF_REDIRECTED;
1286 
1287 				/* Gateway is different ... */
1288 				rt->rt_gateway		= new_gw;
1289 
1290 				/* Redirect received -> path was valid */
1291 				dst_confirm(&rth->u.dst);
1292 
1293 				if (rt->peer)
1294 					atomic_inc(&rt->peer->refcnt);
1295 
1296 				if (arp_bind_neighbour(&rt->u.dst) ||
1297 				    !(rt->u.dst.neighbour->nud_state &
1298 					    NUD_VALID)) {
1299 					if (rt->u.dst.neighbour)
1300 						neigh_event_send(rt->u.dst.neighbour, NULL);
1301 					ip_rt_put(rth);
1302 					rt_drop(rt);
1303 					goto do_next;
1304 				}
1305 
1306 				netevent.old = &rth->u.dst;
1307 				netevent.new = &rt->u.dst;
1308 				call_netevent_notifiers(NETEVENT_REDIRECT,
1309 							&netevent);
1310 
1311 				rt_del(hash, rth);
1312 				if (!rt_intern_hash(hash, rt, &rt))
1313 					ip_rt_put(rt);
1314 				goto do_next;
1315 			}
1316 			rcu_read_unlock();
1317 		do_next:
1318 			;
1319 		}
1320 	}
1321 	in_dev_put(in_dev);
1322 	return;
1323 
1324 reject_redirect:
1325 #ifdef CONFIG_IP_ROUTE_VERBOSE
1326 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit())
1327 		printk(KERN_INFO "Redirect from " NIPQUAD_FMT " on %s about "
1328 			NIPQUAD_FMT " ignored.\n"
1329 			"  Advised path = " NIPQUAD_FMT " -> " NIPQUAD_FMT "\n",
1330 		       NIPQUAD(old_gw), dev->name, NIPQUAD(new_gw),
1331 		       NIPQUAD(saddr), NIPQUAD(daddr));
1332 #endif
1333 	in_dev_put(in_dev);
1334 }
1335 
1336 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
1337 {
1338 	struct rtable *rt = (struct rtable *)dst;
1339 	struct dst_entry *ret = dst;
1340 
1341 	if (rt) {
1342 		if (dst->obsolete) {
1343 			ip_rt_put(rt);
1344 			ret = NULL;
1345 		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
1346 			   rt->u.dst.expires) {
1347 			unsigned hash = rt_hash(rt->fl.fl4_dst, rt->fl.fl4_src,
1348 						rt->fl.oif,
1349 						rt_genid(dev_net(dst->dev)));
1350 #if RT_CACHE_DEBUG >= 1
1351 			printk(KERN_DEBUG "ipv4_negative_advice: redirect to "
1352 					  NIPQUAD_FMT "/%02x dropped\n",
1353 				NIPQUAD(rt->rt_dst), rt->fl.fl4_tos);
1354 #endif
1355 			rt_del(hash, rt);
1356 			ret = NULL;
1357 		}
1358 	}
1359 	return ret;
1360 }
1361 
1362 /*
1363  * Algorithm:
1364  *	1. The first ip_rt_redirect_number redirects are sent
1365  *	   with exponential backoff, then we stop sending them at all,
1366  *	   assuming that the host ignores our redirects.
1367  *	2. If we did not see packets requiring redirects
1368  *	   during ip_rt_redirect_silence, we assume that the host
1369  *	   forgot redirected route and start to send redirects again.
1370  *
1371  * This algorithm is much cheaper and more intelligent than dumb load limiting
1372  * in icmp.c.
1373  *
1374  * NOTE. Do not forget to inhibit load limiting for redirects (redundant)
1375  * and "frag. need" (breaks PMTU discovery) in icmp.c.
1376  */
1377 
1378 void ip_rt_send_redirect(struct sk_buff *skb)
1379 {
1380 	struct rtable *rt = skb->rtable;
1381 	struct in_device *in_dev = in_dev_get(rt->u.dst.dev);
1382 
1383 	if (!in_dev)
1384 		return;
1385 
1386 	if (!IN_DEV_TX_REDIRECTS(in_dev))
1387 		goto out;
1388 
1389 	/* No redirected packets during ip_rt_redirect_silence;
1390 	 * reset the algorithm.
1391 	 */
1392 	if (time_after(jiffies, rt->u.dst.rate_last + ip_rt_redirect_silence))
1393 		rt->u.dst.rate_tokens = 0;
1394 
1395 	/* Too many ignored redirects; do not send anything
1396 	 * set u.dst.rate_last to the last seen redirected packet.
1397 	 */
1398 	if (rt->u.dst.rate_tokens >= ip_rt_redirect_number) {
1399 		rt->u.dst.rate_last = jiffies;
1400 		goto out;
1401 	}
1402 
1403 	/* Check for load limit; set rate_last to the latest sent
1404 	 * redirect.
1405 	 */
1406 	if (rt->u.dst.rate_tokens == 0 ||
1407 	    time_after(jiffies,
1408 		       (rt->u.dst.rate_last +
1409 			(ip_rt_redirect_load << rt->u.dst.rate_tokens)))) {
1410 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, rt->rt_gateway);
1411 		rt->u.dst.rate_last = jiffies;
1412 		++rt->u.dst.rate_tokens;
1413 #ifdef CONFIG_IP_ROUTE_VERBOSE
1414 		if (IN_DEV_LOG_MARTIANS(in_dev) &&
1415 		    rt->u.dst.rate_tokens == ip_rt_redirect_number &&
1416 		    net_ratelimit())
1417 			printk(KERN_WARNING "host " NIPQUAD_FMT "/if%d ignores "
1418 				"redirects for " NIPQUAD_FMT " to " NIPQUAD_FMT ".\n",
1419 				NIPQUAD(rt->rt_src), rt->rt_iif,
1420 				NIPQUAD(rt->rt_dst), NIPQUAD(rt->rt_gateway));
1421 #endif
1422 	}
1423 out:
1424 	in_dev_put(in_dev);
1425 }
1426 
1427 static int ip_error(struct sk_buff *skb)
1428 {
1429 	struct rtable *rt = skb->rtable;
1430 	unsigned long now;
1431 	int code;
1432 
1433 	switch (rt->u.dst.error) {
1434 		case EINVAL:
1435 		default:
1436 			goto out;
1437 		case EHOSTUNREACH:
1438 			code = ICMP_HOST_UNREACH;
1439 			break;
1440 		case ENETUNREACH:
1441 			code = ICMP_NET_UNREACH;
1442 			IP_INC_STATS_BH(dev_net(rt->u.dst.dev),
1443 					IPSTATS_MIB_INNOROUTES);
1444 			break;
1445 		case EACCES:
1446 			code = ICMP_PKT_FILTERED;
1447 			break;
1448 	}
1449 
1450 	now = jiffies;
1451 	rt->u.dst.rate_tokens += now - rt->u.dst.rate_last;
1452 	if (rt->u.dst.rate_tokens > ip_rt_error_burst)
1453 		rt->u.dst.rate_tokens = ip_rt_error_burst;
1454 	rt->u.dst.rate_last = now;
1455 	if (rt->u.dst.rate_tokens >= ip_rt_error_cost) {
1456 		rt->u.dst.rate_tokens -= ip_rt_error_cost;
1457 		icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
1458 	}
1459 
1460 out:	kfree_skb(skb);
1461 	return 0;
1462 }
1463 
1464 /*
1465  *	The last two values are not from the RFC but
1466  *	are needed for AMPRnet AX.25 paths.
1467  */
1468 
1469 static const unsigned short mtu_plateau[] =
1470 {32000, 17914, 8166, 4352, 2002, 1492, 576, 296, 216, 128 };
1471 
1472 static inline unsigned short guess_mtu(unsigned short old_mtu)
1473 {
1474 	int i;
1475 
1476 	for (i = 0; i < ARRAY_SIZE(mtu_plateau); i++)
1477 		if (old_mtu > mtu_plateau[i])
1478 			return mtu_plateau[i];
1479 	return 68;
1480 }
1481 
1482 unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
1483 				 unsigned short new_mtu,
1484 				 struct net_device *dev)
1485 {
1486 	int i, k;
1487 	unsigned short old_mtu = ntohs(iph->tot_len);
1488 	struct rtable *rth;
1489 	int  ikeys[2] = { dev->ifindex, 0 };
1490 	__be32  skeys[2] = { iph->saddr, 0, };
1491 	__be32  daddr = iph->daddr;
1492 	unsigned short est_mtu = 0;
1493 
1494 	if (ipv4_config.no_pmtu_disc)
1495 		return 0;
1496 
1497 	for (k = 0; k < 2; k++) {
1498 		for (i = 0; i < 2; i++) {
1499 			unsigned hash = rt_hash(daddr, skeys[i], ikeys[k],
1500 						rt_genid(net));
1501 
1502 			rcu_read_lock();
1503 			for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
1504 			     rth = rcu_dereference(rth->u.dst.rt_next)) {
1505 				unsigned short mtu = new_mtu;
1506 
1507 				if (rth->fl.fl4_dst != daddr ||
1508 				    rth->fl.fl4_src != skeys[i] ||
1509 				    rth->rt_dst != daddr ||
1510 				    rth->rt_src != iph->saddr ||
1511 				    rth->fl.oif != ikeys[k] ||
1512 				    rth->fl.iif != 0 ||
1513 				    dst_metric_locked(&rth->u.dst, RTAX_MTU) ||
1514 				    !net_eq(dev_net(rth->u.dst.dev), net) ||
1515 				    rt_is_expired(rth))
1516 					continue;
1517 
1518 				if (new_mtu < 68 || new_mtu >= old_mtu) {
1519 
1520 					/* BSD 4.2 compatibility hack :-( */
1521 					if (mtu == 0 &&
1522 					    old_mtu >= dst_mtu(&rth->u.dst) &&
1523 					    old_mtu >= 68 + (iph->ihl << 2))
1524 						old_mtu -= iph->ihl << 2;
1525 
1526 					mtu = guess_mtu(old_mtu);
1527 				}
1528 				if (mtu <= dst_mtu(&rth->u.dst)) {
1529 					if (mtu < dst_mtu(&rth->u.dst)) {
1530 						dst_confirm(&rth->u.dst);
1531 						if (mtu < ip_rt_min_pmtu) {
1532 							mtu = ip_rt_min_pmtu;
1533 							rth->u.dst.metrics[RTAX_LOCK-1] |=
1534 								(1 << RTAX_MTU);
1535 						}
1536 						rth->u.dst.metrics[RTAX_MTU-1] = mtu;
1537 						dst_set_expires(&rth->u.dst,
1538 							ip_rt_mtu_expires);
1539 					}
1540 					est_mtu = mtu;
1541 				}
1542 			}
1543 			rcu_read_unlock();
1544 		}
1545 	}
1546 	return est_mtu ? : new_mtu;
1547 }
1548 
1549 static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
1550 {
1551 	if (dst_mtu(dst) > mtu && mtu >= 68 &&
1552 	    !(dst_metric_locked(dst, RTAX_MTU))) {
1553 		if (mtu < ip_rt_min_pmtu) {
1554 			mtu = ip_rt_min_pmtu;
1555 			dst->metrics[RTAX_LOCK-1] |= (1 << RTAX_MTU);
1556 		}
1557 		dst->metrics[RTAX_MTU-1] = mtu;
1558 		dst_set_expires(dst, ip_rt_mtu_expires);
1559 		call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
1560 	}
1561 }
1562 
1563 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
1564 {
1565 	return NULL;
1566 }
1567 
1568 static void ipv4_dst_destroy(struct dst_entry *dst)
1569 {
1570 	struct rtable *rt = (struct rtable *) dst;
1571 	struct inet_peer *peer = rt->peer;
1572 	struct in_device *idev = rt->idev;
1573 
1574 	if (peer) {
1575 		rt->peer = NULL;
1576 		inet_putpeer(peer);
1577 	}
1578 
1579 	if (idev) {
1580 		rt->idev = NULL;
1581 		in_dev_put(idev);
1582 	}
1583 }
1584 
1585 static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
1586 			    int how)
1587 {
1588 	struct rtable *rt = (struct rtable *) dst;
1589 	struct in_device *idev = rt->idev;
1590 	if (dev != dev_net(dev)->loopback_dev && idev && idev->dev == dev) {
1591 		struct in_device *loopback_idev =
1592 			in_dev_get(dev_net(dev)->loopback_dev);
1593 		if (loopback_idev) {
1594 			rt->idev = loopback_idev;
1595 			in_dev_put(idev);
1596 		}
1597 	}
1598 }
1599 
1600 static void ipv4_link_failure(struct sk_buff *skb)
1601 {
1602 	struct rtable *rt;
1603 
1604 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
1605 
1606 	rt = skb->rtable;
1607 	if (rt)
1608 		dst_set_expires(&rt->u.dst, 0);
1609 }
1610 
1611 static int ip_rt_bug(struct sk_buff *skb)
1612 {
1613 	printk(KERN_DEBUG "ip_rt_bug: " NIPQUAD_FMT " -> " NIPQUAD_FMT ", %s\n",
1614 		NIPQUAD(ip_hdr(skb)->saddr), NIPQUAD(ip_hdr(skb)->daddr),
1615 		skb->dev ? skb->dev->name : "?");
1616 	kfree_skb(skb);
1617 	return 0;
1618 }
1619 
1620 /*
1621    We do not cache source address of outgoing interface,
1622    because it is used only by IP RR, TS and SRR options,
1623    so that it out of fast path.
1624 
1625    BTW remember: "addr" is allowed to be not aligned
1626    in IP options!
1627  */
1628 
1629 void ip_rt_get_source(u8 *addr, struct rtable *rt)
1630 {
1631 	__be32 src;
1632 	struct fib_result res;
1633 
1634 	if (rt->fl.iif == 0)
1635 		src = rt->rt_src;
1636 	else if (fib_lookup(dev_net(rt->u.dst.dev), &rt->fl, &res) == 0) {
1637 		src = FIB_RES_PREFSRC(res);
1638 		fib_res_put(&res);
1639 	} else
1640 		src = inet_select_addr(rt->u.dst.dev, rt->rt_gateway,
1641 					RT_SCOPE_UNIVERSE);
1642 	memcpy(addr, &src, 4);
1643 }
1644 
1645 #ifdef CONFIG_NET_CLS_ROUTE
1646 static void set_class_tag(struct rtable *rt, u32 tag)
1647 {
1648 	if (!(rt->u.dst.tclassid & 0xFFFF))
1649 		rt->u.dst.tclassid |= tag & 0xFFFF;
1650 	if (!(rt->u.dst.tclassid & 0xFFFF0000))
1651 		rt->u.dst.tclassid |= tag & 0xFFFF0000;
1652 }
1653 #endif
1654 
1655 static void rt_set_nexthop(struct rtable *rt, struct fib_result *res, u32 itag)
1656 {
1657 	struct fib_info *fi = res->fi;
1658 
1659 	if (fi) {
1660 		if (FIB_RES_GW(*res) &&
1661 		    FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
1662 			rt->rt_gateway = FIB_RES_GW(*res);
1663 		memcpy(rt->u.dst.metrics, fi->fib_metrics,
1664 		       sizeof(rt->u.dst.metrics));
1665 		if (fi->fib_mtu == 0) {
1666 			rt->u.dst.metrics[RTAX_MTU-1] = rt->u.dst.dev->mtu;
1667 			if (dst_metric_locked(&rt->u.dst, RTAX_MTU) &&
1668 			    rt->rt_gateway != rt->rt_dst &&
1669 			    rt->u.dst.dev->mtu > 576)
1670 				rt->u.dst.metrics[RTAX_MTU-1] = 576;
1671 		}
1672 #ifdef CONFIG_NET_CLS_ROUTE
1673 		rt->u.dst.tclassid = FIB_RES_NH(*res).nh_tclassid;
1674 #endif
1675 	} else
1676 		rt->u.dst.metrics[RTAX_MTU-1]= rt->u.dst.dev->mtu;
1677 
1678 	if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0)
1679 		rt->u.dst.metrics[RTAX_HOPLIMIT-1] = sysctl_ip_default_ttl;
1680 	if (dst_mtu(&rt->u.dst) > IP_MAX_MTU)
1681 		rt->u.dst.metrics[RTAX_MTU-1] = IP_MAX_MTU;
1682 	if (dst_metric(&rt->u.dst, RTAX_ADVMSS) == 0)
1683 		rt->u.dst.metrics[RTAX_ADVMSS-1] = max_t(unsigned int, rt->u.dst.dev->mtu - 40,
1684 				       ip_rt_min_advmss);
1685 	if (dst_metric(&rt->u.dst, RTAX_ADVMSS) > 65535 - 40)
1686 		rt->u.dst.metrics[RTAX_ADVMSS-1] = 65535 - 40;
1687 
1688 #ifdef CONFIG_NET_CLS_ROUTE
1689 #ifdef CONFIG_IP_MULTIPLE_TABLES
1690 	set_class_tag(rt, fib_rules_tclass(res));
1691 #endif
1692 	set_class_tag(rt, itag);
1693 #endif
1694 	rt->rt_type = res->type;
1695 }
1696 
1697 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1698 				u8 tos, struct net_device *dev, int our)
1699 {
1700 	unsigned hash;
1701 	struct rtable *rth;
1702 	__be32 spec_dst;
1703 	struct in_device *in_dev = in_dev_get(dev);
1704 	u32 itag = 0;
1705 
1706 	/* Primary sanity checks. */
1707 
1708 	if (in_dev == NULL)
1709 		return -EINVAL;
1710 
1711 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1712 	    ipv4_is_loopback(saddr) || skb->protocol != htons(ETH_P_IP))
1713 		goto e_inval;
1714 
1715 	if (ipv4_is_zeronet(saddr)) {
1716 		if (!ipv4_is_local_multicast(daddr))
1717 			goto e_inval;
1718 		spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
1719 	} else if (fib_validate_source(saddr, 0, tos, 0,
1720 					dev, &spec_dst, &itag) < 0)
1721 		goto e_inval;
1722 
1723 	rth = dst_alloc(&ipv4_dst_ops);
1724 	if (!rth)
1725 		goto e_nobufs;
1726 
1727 	rth->u.dst.output= ip_rt_bug;
1728 
1729 	atomic_set(&rth->u.dst.__refcnt, 1);
1730 	rth->u.dst.flags= DST_HOST;
1731 	if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
1732 		rth->u.dst.flags |= DST_NOPOLICY;
1733 	rth->fl.fl4_dst	= daddr;
1734 	rth->rt_dst	= daddr;
1735 	rth->fl.fl4_tos	= tos;
1736 	rth->fl.mark    = skb->mark;
1737 	rth->fl.fl4_src	= saddr;
1738 	rth->rt_src	= saddr;
1739 #ifdef CONFIG_NET_CLS_ROUTE
1740 	rth->u.dst.tclassid = itag;
1741 #endif
1742 	rth->rt_iif	=
1743 	rth->fl.iif	= dev->ifindex;
1744 	rth->u.dst.dev	= init_net.loopback_dev;
1745 	dev_hold(rth->u.dst.dev);
1746 	rth->idev	= in_dev_get(rth->u.dst.dev);
1747 	rth->fl.oif	= 0;
1748 	rth->rt_gateway	= daddr;
1749 	rth->rt_spec_dst= spec_dst;
1750 	rth->rt_genid	= rt_genid(dev_net(dev));
1751 	rth->rt_flags	= RTCF_MULTICAST;
1752 	rth->rt_type	= RTN_MULTICAST;
1753 	if (our) {
1754 		rth->u.dst.input= ip_local_deliver;
1755 		rth->rt_flags |= RTCF_LOCAL;
1756 	}
1757 
1758 #ifdef CONFIG_IP_MROUTE
1759 	if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
1760 		rth->u.dst.input = ip_mr_input;
1761 #endif
1762 	RT_CACHE_STAT_INC(in_slow_mc);
1763 
1764 	in_dev_put(in_dev);
1765 	hash = rt_hash(daddr, saddr, dev->ifindex, rt_genid(dev_net(dev)));
1766 	return rt_intern_hash(hash, rth, &skb->rtable);
1767 
1768 e_nobufs:
1769 	in_dev_put(in_dev);
1770 	return -ENOBUFS;
1771 
1772 e_inval:
1773 	in_dev_put(in_dev);
1774 	return -EINVAL;
1775 }
1776 
1777 
1778 static void ip_handle_martian_source(struct net_device *dev,
1779 				     struct in_device *in_dev,
1780 				     struct sk_buff *skb,
1781 				     __be32 daddr,
1782 				     __be32 saddr)
1783 {
1784 	RT_CACHE_STAT_INC(in_martian_src);
1785 #ifdef CONFIG_IP_ROUTE_VERBOSE
1786 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
1787 		/*
1788 		 *	RFC1812 recommendation, if source is martian,
1789 		 *	the only hint is MAC header.
1790 		 */
1791 		printk(KERN_WARNING "martian source " NIPQUAD_FMT " from "
1792 			NIPQUAD_FMT", on dev %s\n",
1793 			NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
1794 		if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
1795 			int i;
1796 			const unsigned char *p = skb_mac_header(skb);
1797 			printk(KERN_WARNING "ll header: ");
1798 			for (i = 0; i < dev->hard_header_len; i++, p++) {
1799 				printk("%02x", *p);
1800 				if (i < (dev->hard_header_len - 1))
1801 					printk(":");
1802 			}
1803 			printk("\n");
1804 		}
1805 	}
1806 #endif
1807 }
1808 
1809 static int __mkroute_input(struct sk_buff *skb,
1810 			   struct fib_result *res,
1811 			   struct in_device *in_dev,
1812 			   __be32 daddr, __be32 saddr, u32 tos,
1813 			   struct rtable **result)
1814 {
1815 
1816 	struct rtable *rth;
1817 	int err;
1818 	struct in_device *out_dev;
1819 	unsigned flags = 0;
1820 	__be32 spec_dst;
1821 	u32 itag;
1822 
1823 	/* get a working reference to the output device */
1824 	out_dev = in_dev_get(FIB_RES_DEV(*res));
1825 	if (out_dev == NULL) {
1826 		if (net_ratelimit())
1827 			printk(KERN_CRIT "Bug in ip_route_input" \
1828 			       "_slow(). Please, report\n");
1829 		return -EINVAL;
1830 	}
1831 
1832 
1833 	err = fib_validate_source(saddr, daddr, tos, FIB_RES_OIF(*res),
1834 				  in_dev->dev, &spec_dst, &itag);
1835 	if (err < 0) {
1836 		ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
1837 					 saddr);
1838 
1839 		err = -EINVAL;
1840 		goto cleanup;
1841 	}
1842 
1843 	if (err)
1844 		flags |= RTCF_DIRECTSRC;
1845 
1846 	if (out_dev == in_dev && err &&
1847 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
1848 	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
1849 		flags |= RTCF_DOREDIRECT;
1850 
1851 	if (skb->protocol != htons(ETH_P_IP)) {
1852 		/* Not IP (i.e. ARP). Do not create route, if it is
1853 		 * invalid for proxy arp. DNAT routes are always valid.
1854 		 */
1855 		if (out_dev == in_dev) {
1856 			err = -EINVAL;
1857 			goto cleanup;
1858 		}
1859 	}
1860 
1861 
1862 	rth = dst_alloc(&ipv4_dst_ops);
1863 	if (!rth) {
1864 		err = -ENOBUFS;
1865 		goto cleanup;
1866 	}
1867 
1868 	atomic_set(&rth->u.dst.__refcnt, 1);
1869 	rth->u.dst.flags= DST_HOST;
1870 	if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
1871 		rth->u.dst.flags |= DST_NOPOLICY;
1872 	if (IN_DEV_CONF_GET(out_dev, NOXFRM))
1873 		rth->u.dst.flags |= DST_NOXFRM;
1874 	rth->fl.fl4_dst	= daddr;
1875 	rth->rt_dst	= daddr;
1876 	rth->fl.fl4_tos	= tos;
1877 	rth->fl.mark    = skb->mark;
1878 	rth->fl.fl4_src	= saddr;
1879 	rth->rt_src	= saddr;
1880 	rth->rt_gateway	= daddr;
1881 	rth->rt_iif 	=
1882 		rth->fl.iif	= in_dev->dev->ifindex;
1883 	rth->u.dst.dev	= (out_dev)->dev;
1884 	dev_hold(rth->u.dst.dev);
1885 	rth->idev	= in_dev_get(rth->u.dst.dev);
1886 	rth->fl.oif 	= 0;
1887 	rth->rt_spec_dst= spec_dst;
1888 
1889 	rth->u.dst.input = ip_forward;
1890 	rth->u.dst.output = ip_output;
1891 	rth->rt_genid = rt_genid(dev_net(rth->u.dst.dev));
1892 
1893 	rt_set_nexthop(rth, res, itag);
1894 
1895 	rth->rt_flags = flags;
1896 
1897 	*result = rth;
1898 	err = 0;
1899  cleanup:
1900 	/* release the working reference to the output device */
1901 	in_dev_put(out_dev);
1902 	return err;
1903 }
1904 
1905 static int ip_mkroute_input(struct sk_buff *skb,
1906 			    struct fib_result *res,
1907 			    const struct flowi *fl,
1908 			    struct in_device *in_dev,
1909 			    __be32 daddr, __be32 saddr, u32 tos)
1910 {
1911 	struct rtable* rth = NULL;
1912 	int err;
1913 	unsigned hash;
1914 
1915 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1916 	if (res->fi && res->fi->fib_nhs > 1 && fl->oif == 0)
1917 		fib_select_multipath(fl, res);
1918 #endif
1919 
1920 	/* create a routing cache entry */
1921 	err = __mkroute_input(skb, res, in_dev, daddr, saddr, tos, &rth);
1922 	if (err)
1923 		return err;
1924 
1925 	/* put it into the cache */
1926 	hash = rt_hash(daddr, saddr, fl->iif,
1927 		       rt_genid(dev_net(rth->u.dst.dev)));
1928 	return rt_intern_hash(hash, rth, &skb->rtable);
1929 }
1930 
1931 /*
1932  *	NOTE. We drop all the packets that has local source
1933  *	addresses, because every properly looped back packet
1934  *	must have correct destination already attached by output routine.
1935  *
1936  *	Such approach solves two big problems:
1937  *	1. Not simplex devices are handled properly.
1938  *	2. IP spoofing attempts are filtered with 100% of guarantee.
1939  */
1940 
1941 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1942 			       u8 tos, struct net_device *dev)
1943 {
1944 	struct fib_result res;
1945 	struct in_device *in_dev = in_dev_get(dev);
1946 	struct flowi fl = { .nl_u = { .ip4_u =
1947 				      { .daddr = daddr,
1948 					.saddr = saddr,
1949 					.tos = tos,
1950 					.scope = RT_SCOPE_UNIVERSE,
1951 				      } },
1952 			    .mark = skb->mark,
1953 			    .iif = dev->ifindex };
1954 	unsigned	flags = 0;
1955 	u32		itag = 0;
1956 	struct rtable * rth;
1957 	unsigned	hash;
1958 	__be32		spec_dst;
1959 	int		err = -EINVAL;
1960 	int		free_res = 0;
1961 	struct net    * net = dev_net(dev);
1962 
1963 	/* IP on this device is disabled. */
1964 
1965 	if (!in_dev)
1966 		goto out;
1967 
1968 	/* Check for the most weird martians, which can be not detected
1969 	   by fib_lookup.
1970 	 */
1971 
1972 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1973 	    ipv4_is_loopback(saddr))
1974 		goto martian_source;
1975 
1976 	if (daddr == htonl(0xFFFFFFFF) || (saddr == 0 && daddr == 0))
1977 		goto brd_input;
1978 
1979 	/* Accept zero addresses only to limited broadcast;
1980 	 * I even do not know to fix it or not. Waiting for complains :-)
1981 	 */
1982 	if (ipv4_is_zeronet(saddr))
1983 		goto martian_source;
1984 
1985 	if (ipv4_is_lbcast(daddr) || ipv4_is_zeronet(daddr) ||
1986 	    ipv4_is_loopback(daddr))
1987 		goto martian_destination;
1988 
1989 	/*
1990 	 *	Now we are ready to route packet.
1991 	 */
1992 	if ((err = fib_lookup(net, &fl, &res)) != 0) {
1993 		if (!IN_DEV_FORWARD(in_dev))
1994 			goto e_hostunreach;
1995 		goto no_route;
1996 	}
1997 	free_res = 1;
1998 
1999 	RT_CACHE_STAT_INC(in_slow_tot);
2000 
2001 	if (res.type == RTN_BROADCAST)
2002 		goto brd_input;
2003 
2004 	if (res.type == RTN_LOCAL) {
2005 		int result;
2006 		result = fib_validate_source(saddr, daddr, tos,
2007 					     net->loopback_dev->ifindex,
2008 					     dev, &spec_dst, &itag);
2009 		if (result < 0)
2010 			goto martian_source;
2011 		if (result)
2012 			flags |= RTCF_DIRECTSRC;
2013 		spec_dst = daddr;
2014 		goto local_input;
2015 	}
2016 
2017 	if (!IN_DEV_FORWARD(in_dev))
2018 		goto e_hostunreach;
2019 	if (res.type != RTN_UNICAST)
2020 		goto martian_destination;
2021 
2022 	err = ip_mkroute_input(skb, &res, &fl, in_dev, daddr, saddr, tos);
2023 done:
2024 	in_dev_put(in_dev);
2025 	if (free_res)
2026 		fib_res_put(&res);
2027 out:	return err;
2028 
2029 brd_input:
2030 	if (skb->protocol != htons(ETH_P_IP))
2031 		goto e_inval;
2032 
2033 	if (ipv4_is_zeronet(saddr))
2034 		spec_dst = inet_select_addr(dev, 0, RT_SCOPE_LINK);
2035 	else {
2036 		err = fib_validate_source(saddr, 0, tos, 0, dev, &spec_dst,
2037 					  &itag);
2038 		if (err < 0)
2039 			goto martian_source;
2040 		if (err)
2041 			flags |= RTCF_DIRECTSRC;
2042 	}
2043 	flags |= RTCF_BROADCAST;
2044 	res.type = RTN_BROADCAST;
2045 	RT_CACHE_STAT_INC(in_brd);
2046 
2047 local_input:
2048 	rth = dst_alloc(&ipv4_dst_ops);
2049 	if (!rth)
2050 		goto e_nobufs;
2051 
2052 	rth->u.dst.output= ip_rt_bug;
2053 	rth->rt_genid = rt_genid(net);
2054 
2055 	atomic_set(&rth->u.dst.__refcnt, 1);
2056 	rth->u.dst.flags= DST_HOST;
2057 	if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
2058 		rth->u.dst.flags |= DST_NOPOLICY;
2059 	rth->fl.fl4_dst	= daddr;
2060 	rth->rt_dst	= daddr;
2061 	rth->fl.fl4_tos	= tos;
2062 	rth->fl.mark    = skb->mark;
2063 	rth->fl.fl4_src	= saddr;
2064 	rth->rt_src	= saddr;
2065 #ifdef CONFIG_NET_CLS_ROUTE
2066 	rth->u.dst.tclassid = itag;
2067 #endif
2068 	rth->rt_iif	=
2069 	rth->fl.iif	= dev->ifindex;
2070 	rth->u.dst.dev	= net->loopback_dev;
2071 	dev_hold(rth->u.dst.dev);
2072 	rth->idev	= in_dev_get(rth->u.dst.dev);
2073 	rth->rt_gateway	= daddr;
2074 	rth->rt_spec_dst= spec_dst;
2075 	rth->u.dst.input= ip_local_deliver;
2076 	rth->rt_flags 	= flags|RTCF_LOCAL;
2077 	if (res.type == RTN_UNREACHABLE) {
2078 		rth->u.dst.input= ip_error;
2079 		rth->u.dst.error= -err;
2080 		rth->rt_flags 	&= ~RTCF_LOCAL;
2081 	}
2082 	rth->rt_type	= res.type;
2083 	hash = rt_hash(daddr, saddr, fl.iif, rt_genid(net));
2084 	err = rt_intern_hash(hash, rth, &skb->rtable);
2085 	goto done;
2086 
2087 no_route:
2088 	RT_CACHE_STAT_INC(in_no_route);
2089 	spec_dst = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
2090 	res.type = RTN_UNREACHABLE;
2091 	if (err == -ESRCH)
2092 		err = -ENETUNREACH;
2093 	goto local_input;
2094 
2095 	/*
2096 	 *	Do not cache martian addresses: they should be logged (RFC1812)
2097 	 */
2098 martian_destination:
2099 	RT_CACHE_STAT_INC(in_martian_dst);
2100 #ifdef CONFIG_IP_ROUTE_VERBOSE
2101 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit())
2102 		printk(KERN_WARNING "martian destination " NIPQUAD_FMT " from "
2103 			NIPQUAD_FMT ", dev %s\n",
2104 			NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
2105 #endif
2106 
2107 e_hostunreach:
2108 	err = -EHOSTUNREACH;
2109 	goto done;
2110 
2111 e_inval:
2112 	err = -EINVAL;
2113 	goto done;
2114 
2115 e_nobufs:
2116 	err = -ENOBUFS;
2117 	goto done;
2118 
2119 martian_source:
2120 	ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
2121 	goto e_inval;
2122 }
2123 
2124 int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
2125 		   u8 tos, struct net_device *dev)
2126 {
2127 	struct rtable * rth;
2128 	unsigned	hash;
2129 	int iif = dev->ifindex;
2130 	struct net *net;
2131 
2132 	net = dev_net(dev);
2133 	tos &= IPTOS_RT_MASK;
2134 	hash = rt_hash(daddr, saddr, iif, rt_genid(net));
2135 
2136 	rcu_read_lock();
2137 	for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
2138 	     rth = rcu_dereference(rth->u.dst.rt_next)) {
2139 		if (((rth->fl.fl4_dst ^ daddr) |
2140 		     (rth->fl.fl4_src ^ saddr) |
2141 		     (rth->fl.iif ^ iif) |
2142 		     rth->fl.oif |
2143 		     (rth->fl.fl4_tos ^ tos)) == 0 &&
2144 		    rth->fl.mark == skb->mark &&
2145 		    net_eq(dev_net(rth->u.dst.dev), net) &&
2146 		    !rt_is_expired(rth)) {
2147 			dst_use(&rth->u.dst, jiffies);
2148 			RT_CACHE_STAT_INC(in_hit);
2149 			rcu_read_unlock();
2150 			skb->rtable = rth;
2151 			return 0;
2152 		}
2153 		RT_CACHE_STAT_INC(in_hlist_search);
2154 	}
2155 	rcu_read_unlock();
2156 
2157 	/* Multicast recognition logic is moved from route cache to here.
2158 	   The problem was that too many Ethernet cards have broken/missing
2159 	   hardware multicast filters :-( As result the host on multicasting
2160 	   network acquires a lot of useless route cache entries, sort of
2161 	   SDR messages from all the world. Now we try to get rid of them.
2162 	   Really, provided software IP multicast filter is organized
2163 	   reasonably (at least, hashed), it does not result in a slowdown
2164 	   comparing with route cache reject entries.
2165 	   Note, that multicast routers are not affected, because
2166 	   route cache entry is created eventually.
2167 	 */
2168 	if (ipv4_is_multicast(daddr)) {
2169 		struct in_device *in_dev;
2170 
2171 		rcu_read_lock();
2172 		if ((in_dev = __in_dev_get_rcu(dev)) != NULL) {
2173 			int our = ip_check_mc(in_dev, daddr, saddr,
2174 				ip_hdr(skb)->protocol);
2175 			if (our
2176 #ifdef CONFIG_IP_MROUTE
2177 			    || (!ipv4_is_local_multicast(daddr) &&
2178 				IN_DEV_MFORWARD(in_dev))
2179 #endif
2180 			    ) {
2181 				rcu_read_unlock();
2182 				return ip_route_input_mc(skb, daddr, saddr,
2183 							 tos, dev, our);
2184 			}
2185 		}
2186 		rcu_read_unlock();
2187 		return -EINVAL;
2188 	}
2189 	return ip_route_input_slow(skb, daddr, saddr, tos, dev);
2190 }
2191 
2192 static int __mkroute_output(struct rtable **result,
2193 			    struct fib_result *res,
2194 			    const struct flowi *fl,
2195 			    const struct flowi *oldflp,
2196 			    struct net_device *dev_out,
2197 			    unsigned flags)
2198 {
2199 	struct rtable *rth;
2200 	struct in_device *in_dev;
2201 	u32 tos = RT_FL_TOS(oldflp);
2202 	int err = 0;
2203 
2204 	if (ipv4_is_loopback(fl->fl4_src) && !(dev_out->flags&IFF_LOOPBACK))
2205 		return -EINVAL;
2206 
2207 	if (fl->fl4_dst == htonl(0xFFFFFFFF))
2208 		res->type = RTN_BROADCAST;
2209 	else if (ipv4_is_multicast(fl->fl4_dst))
2210 		res->type = RTN_MULTICAST;
2211 	else if (ipv4_is_lbcast(fl->fl4_dst) || ipv4_is_zeronet(fl->fl4_dst))
2212 		return -EINVAL;
2213 
2214 	if (dev_out->flags & IFF_LOOPBACK)
2215 		flags |= RTCF_LOCAL;
2216 
2217 	/* get work reference to inet device */
2218 	in_dev = in_dev_get(dev_out);
2219 	if (!in_dev)
2220 		return -EINVAL;
2221 
2222 	if (res->type == RTN_BROADCAST) {
2223 		flags |= RTCF_BROADCAST | RTCF_LOCAL;
2224 		if (res->fi) {
2225 			fib_info_put(res->fi);
2226 			res->fi = NULL;
2227 		}
2228 	} else if (res->type == RTN_MULTICAST) {
2229 		flags |= RTCF_MULTICAST|RTCF_LOCAL;
2230 		if (!ip_check_mc(in_dev, oldflp->fl4_dst, oldflp->fl4_src,
2231 				 oldflp->proto))
2232 			flags &= ~RTCF_LOCAL;
2233 		/* If multicast route do not exist use
2234 		   default one, but do not gateway in this case.
2235 		   Yes, it is hack.
2236 		 */
2237 		if (res->fi && res->prefixlen < 4) {
2238 			fib_info_put(res->fi);
2239 			res->fi = NULL;
2240 		}
2241 	}
2242 
2243 
2244 	rth = dst_alloc(&ipv4_dst_ops);
2245 	if (!rth) {
2246 		err = -ENOBUFS;
2247 		goto cleanup;
2248 	}
2249 
2250 	atomic_set(&rth->u.dst.__refcnt, 1);
2251 	rth->u.dst.flags= DST_HOST;
2252 	if (IN_DEV_CONF_GET(in_dev, NOXFRM))
2253 		rth->u.dst.flags |= DST_NOXFRM;
2254 	if (IN_DEV_CONF_GET(in_dev, NOPOLICY))
2255 		rth->u.dst.flags |= DST_NOPOLICY;
2256 
2257 	rth->fl.fl4_dst	= oldflp->fl4_dst;
2258 	rth->fl.fl4_tos	= tos;
2259 	rth->fl.fl4_src	= oldflp->fl4_src;
2260 	rth->fl.oif	= oldflp->oif;
2261 	rth->fl.mark    = oldflp->mark;
2262 	rth->rt_dst	= fl->fl4_dst;
2263 	rth->rt_src	= fl->fl4_src;
2264 	rth->rt_iif	= oldflp->oif ? : dev_out->ifindex;
2265 	/* get references to the devices that are to be hold by the routing
2266 	   cache entry */
2267 	rth->u.dst.dev	= dev_out;
2268 	dev_hold(dev_out);
2269 	rth->idev	= in_dev_get(dev_out);
2270 	rth->rt_gateway = fl->fl4_dst;
2271 	rth->rt_spec_dst= fl->fl4_src;
2272 
2273 	rth->u.dst.output=ip_output;
2274 	rth->rt_genid = rt_genid(dev_net(dev_out));
2275 
2276 	RT_CACHE_STAT_INC(out_slow_tot);
2277 
2278 	if (flags & RTCF_LOCAL) {
2279 		rth->u.dst.input = ip_local_deliver;
2280 		rth->rt_spec_dst = fl->fl4_dst;
2281 	}
2282 	if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
2283 		rth->rt_spec_dst = fl->fl4_src;
2284 		if (flags & RTCF_LOCAL &&
2285 		    !(dev_out->flags & IFF_LOOPBACK)) {
2286 			rth->u.dst.output = ip_mc_output;
2287 			RT_CACHE_STAT_INC(out_slow_mc);
2288 		}
2289 #ifdef CONFIG_IP_MROUTE
2290 		if (res->type == RTN_MULTICAST) {
2291 			if (IN_DEV_MFORWARD(in_dev) &&
2292 			    !ipv4_is_local_multicast(oldflp->fl4_dst)) {
2293 				rth->u.dst.input = ip_mr_input;
2294 				rth->u.dst.output = ip_mc_output;
2295 			}
2296 		}
2297 #endif
2298 	}
2299 
2300 	rt_set_nexthop(rth, res, 0);
2301 
2302 	rth->rt_flags = flags;
2303 
2304 	*result = rth;
2305  cleanup:
2306 	/* release work reference to inet device */
2307 	in_dev_put(in_dev);
2308 
2309 	return err;
2310 }
2311 
2312 static int ip_mkroute_output(struct rtable **rp,
2313 			     struct fib_result *res,
2314 			     const struct flowi *fl,
2315 			     const struct flowi *oldflp,
2316 			     struct net_device *dev_out,
2317 			     unsigned flags)
2318 {
2319 	struct rtable *rth = NULL;
2320 	int err = __mkroute_output(&rth, res, fl, oldflp, dev_out, flags);
2321 	unsigned hash;
2322 	if (err == 0) {
2323 		hash = rt_hash(oldflp->fl4_dst, oldflp->fl4_src, oldflp->oif,
2324 			       rt_genid(dev_net(dev_out)));
2325 		err = rt_intern_hash(hash, rth, rp);
2326 	}
2327 
2328 	return err;
2329 }
2330 
2331 /*
2332  * Major route resolver routine.
2333  */
2334 
2335 static int ip_route_output_slow(struct net *net, struct rtable **rp,
2336 				const struct flowi *oldflp)
2337 {
2338 	u32 tos	= RT_FL_TOS(oldflp);
2339 	struct flowi fl = { .nl_u = { .ip4_u =
2340 				      { .daddr = oldflp->fl4_dst,
2341 					.saddr = oldflp->fl4_src,
2342 					.tos = tos & IPTOS_RT_MASK,
2343 					.scope = ((tos & RTO_ONLINK) ?
2344 						  RT_SCOPE_LINK :
2345 						  RT_SCOPE_UNIVERSE),
2346 				      } },
2347 			    .mark = oldflp->mark,
2348 			    .iif = net->loopback_dev->ifindex,
2349 			    .oif = oldflp->oif };
2350 	struct fib_result res;
2351 	unsigned flags = 0;
2352 	struct net_device *dev_out = NULL;
2353 	int free_res = 0;
2354 	int err;
2355 
2356 
2357 	res.fi		= NULL;
2358 #ifdef CONFIG_IP_MULTIPLE_TABLES
2359 	res.r		= NULL;
2360 #endif
2361 
2362 	if (oldflp->fl4_src) {
2363 		err = -EINVAL;
2364 		if (ipv4_is_multicast(oldflp->fl4_src) ||
2365 		    ipv4_is_lbcast(oldflp->fl4_src) ||
2366 		    ipv4_is_zeronet(oldflp->fl4_src))
2367 			goto out;
2368 
2369 		/* I removed check for oif == dev_out->oif here.
2370 		   It was wrong for two reasons:
2371 		   1. ip_dev_find(net, saddr) can return wrong iface, if saddr
2372 		      is assigned to multiple interfaces.
2373 		   2. Moreover, we are allowed to send packets with saddr
2374 		      of another iface. --ANK
2375 		 */
2376 
2377 		if (oldflp->oif == 0
2378 		    && (ipv4_is_multicast(oldflp->fl4_dst) ||
2379 			oldflp->fl4_dst == htonl(0xFFFFFFFF))) {
2380 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2381 			dev_out = ip_dev_find(net, oldflp->fl4_src);
2382 			if (dev_out == NULL)
2383 				goto out;
2384 
2385 			/* Special hack: user can direct multicasts
2386 			   and limited broadcast via necessary interface
2387 			   without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
2388 			   This hack is not just for fun, it allows
2389 			   vic,vat and friends to work.
2390 			   They bind socket to loopback, set ttl to zero
2391 			   and expect that it will work.
2392 			   From the viewpoint of routing cache they are broken,
2393 			   because we are not allowed to build multicast path
2394 			   with loopback source addr (look, routing cache
2395 			   cannot know, that ttl is zero, so that packet
2396 			   will not leave this host and route is valid).
2397 			   Luckily, this hack is good workaround.
2398 			 */
2399 
2400 			fl.oif = dev_out->ifindex;
2401 			goto make_route;
2402 		}
2403 
2404 		if (!(oldflp->flags & FLOWI_FLAG_ANYSRC)) {
2405 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2406 			dev_out = ip_dev_find(net, oldflp->fl4_src);
2407 			if (dev_out == NULL)
2408 				goto out;
2409 			dev_put(dev_out);
2410 			dev_out = NULL;
2411 		}
2412 	}
2413 
2414 
2415 	if (oldflp->oif) {
2416 		dev_out = dev_get_by_index(net, oldflp->oif);
2417 		err = -ENODEV;
2418 		if (dev_out == NULL)
2419 			goto out;
2420 
2421 		/* RACE: Check return value of inet_select_addr instead. */
2422 		if (__in_dev_get_rtnl(dev_out) == NULL) {
2423 			dev_put(dev_out);
2424 			goto out;	/* Wrong error code */
2425 		}
2426 
2427 		if (ipv4_is_local_multicast(oldflp->fl4_dst) ||
2428 		    oldflp->fl4_dst == htonl(0xFFFFFFFF)) {
2429 			if (!fl.fl4_src)
2430 				fl.fl4_src = inet_select_addr(dev_out, 0,
2431 							      RT_SCOPE_LINK);
2432 			goto make_route;
2433 		}
2434 		if (!fl.fl4_src) {
2435 			if (ipv4_is_multicast(oldflp->fl4_dst))
2436 				fl.fl4_src = inet_select_addr(dev_out, 0,
2437 							      fl.fl4_scope);
2438 			else if (!oldflp->fl4_dst)
2439 				fl.fl4_src = inet_select_addr(dev_out, 0,
2440 							      RT_SCOPE_HOST);
2441 		}
2442 	}
2443 
2444 	if (!fl.fl4_dst) {
2445 		fl.fl4_dst = fl.fl4_src;
2446 		if (!fl.fl4_dst)
2447 			fl.fl4_dst = fl.fl4_src = htonl(INADDR_LOOPBACK);
2448 		if (dev_out)
2449 			dev_put(dev_out);
2450 		dev_out = net->loopback_dev;
2451 		dev_hold(dev_out);
2452 		fl.oif = net->loopback_dev->ifindex;
2453 		res.type = RTN_LOCAL;
2454 		flags |= RTCF_LOCAL;
2455 		goto make_route;
2456 	}
2457 
2458 	if (fib_lookup(net, &fl, &res)) {
2459 		res.fi = NULL;
2460 		if (oldflp->oif) {
2461 			/* Apparently, routing tables are wrong. Assume,
2462 			   that the destination is on link.
2463 
2464 			   WHY? DW.
2465 			   Because we are allowed to send to iface
2466 			   even if it has NO routes and NO assigned
2467 			   addresses. When oif is specified, routing
2468 			   tables are looked up with only one purpose:
2469 			   to catch if destination is gatewayed, rather than
2470 			   direct. Moreover, if MSG_DONTROUTE is set,
2471 			   we send packet, ignoring both routing tables
2472 			   and ifaddr state. --ANK
2473 
2474 
2475 			   We could make it even if oif is unknown,
2476 			   likely IPv6, but we do not.
2477 			 */
2478 
2479 			if (fl.fl4_src == 0)
2480 				fl.fl4_src = inet_select_addr(dev_out, 0,
2481 							      RT_SCOPE_LINK);
2482 			res.type = RTN_UNICAST;
2483 			goto make_route;
2484 		}
2485 		if (dev_out)
2486 			dev_put(dev_out);
2487 		err = -ENETUNREACH;
2488 		goto out;
2489 	}
2490 	free_res = 1;
2491 
2492 	if (res.type == RTN_LOCAL) {
2493 		if (!fl.fl4_src)
2494 			fl.fl4_src = fl.fl4_dst;
2495 		if (dev_out)
2496 			dev_put(dev_out);
2497 		dev_out = net->loopback_dev;
2498 		dev_hold(dev_out);
2499 		fl.oif = dev_out->ifindex;
2500 		if (res.fi)
2501 			fib_info_put(res.fi);
2502 		res.fi = NULL;
2503 		flags |= RTCF_LOCAL;
2504 		goto make_route;
2505 	}
2506 
2507 #ifdef CONFIG_IP_ROUTE_MULTIPATH
2508 	if (res.fi->fib_nhs > 1 && fl.oif == 0)
2509 		fib_select_multipath(&fl, &res);
2510 	else
2511 #endif
2512 	if (!res.prefixlen && res.type == RTN_UNICAST && !fl.oif)
2513 		fib_select_default(net, &fl, &res);
2514 
2515 	if (!fl.fl4_src)
2516 		fl.fl4_src = FIB_RES_PREFSRC(res);
2517 
2518 	if (dev_out)
2519 		dev_put(dev_out);
2520 	dev_out = FIB_RES_DEV(res);
2521 	dev_hold(dev_out);
2522 	fl.oif = dev_out->ifindex;
2523 
2524 
2525 make_route:
2526 	err = ip_mkroute_output(rp, &res, &fl, oldflp, dev_out, flags);
2527 
2528 
2529 	if (free_res)
2530 		fib_res_put(&res);
2531 	if (dev_out)
2532 		dev_put(dev_out);
2533 out:	return err;
2534 }
2535 
2536 int __ip_route_output_key(struct net *net, struct rtable **rp,
2537 			  const struct flowi *flp)
2538 {
2539 	unsigned hash;
2540 	struct rtable *rth;
2541 
2542 	hash = rt_hash(flp->fl4_dst, flp->fl4_src, flp->oif, rt_genid(net));
2543 
2544 	rcu_read_lock_bh();
2545 	for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
2546 		rth = rcu_dereference(rth->u.dst.rt_next)) {
2547 		if (rth->fl.fl4_dst == flp->fl4_dst &&
2548 		    rth->fl.fl4_src == flp->fl4_src &&
2549 		    rth->fl.iif == 0 &&
2550 		    rth->fl.oif == flp->oif &&
2551 		    rth->fl.mark == flp->mark &&
2552 		    !((rth->fl.fl4_tos ^ flp->fl4_tos) &
2553 			    (IPTOS_RT_MASK | RTO_ONLINK)) &&
2554 		    net_eq(dev_net(rth->u.dst.dev), net) &&
2555 		    !rt_is_expired(rth)) {
2556 			dst_use(&rth->u.dst, jiffies);
2557 			RT_CACHE_STAT_INC(out_hit);
2558 			rcu_read_unlock_bh();
2559 			*rp = rth;
2560 			return 0;
2561 		}
2562 		RT_CACHE_STAT_INC(out_hlist_search);
2563 	}
2564 	rcu_read_unlock_bh();
2565 
2566 	return ip_route_output_slow(net, rp, flp);
2567 }
2568 
2569 EXPORT_SYMBOL_GPL(__ip_route_output_key);
2570 
2571 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, u32 mtu)
2572 {
2573 }
2574 
2575 static struct dst_ops ipv4_dst_blackhole_ops = {
2576 	.family			=	AF_INET,
2577 	.protocol		=	__constant_htons(ETH_P_IP),
2578 	.destroy		=	ipv4_dst_destroy,
2579 	.check			=	ipv4_dst_check,
2580 	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
2581 	.entry_size		=	sizeof(struct rtable),
2582 	.entries		=	ATOMIC_INIT(0),
2583 };
2584 
2585 
2586 static int ipv4_dst_blackhole(struct net *net, struct rtable **rp, struct flowi *flp)
2587 {
2588 	struct rtable *ort = *rp;
2589 	struct rtable *rt = (struct rtable *)
2590 		dst_alloc(&ipv4_dst_blackhole_ops);
2591 
2592 	if (rt) {
2593 		struct dst_entry *new = &rt->u.dst;
2594 
2595 		atomic_set(&new->__refcnt, 1);
2596 		new->__use = 1;
2597 		new->input = dst_discard;
2598 		new->output = dst_discard;
2599 		memcpy(new->metrics, ort->u.dst.metrics, RTAX_MAX*sizeof(u32));
2600 
2601 		new->dev = ort->u.dst.dev;
2602 		if (new->dev)
2603 			dev_hold(new->dev);
2604 
2605 		rt->fl = ort->fl;
2606 
2607 		rt->idev = ort->idev;
2608 		if (rt->idev)
2609 			in_dev_hold(rt->idev);
2610 		rt->rt_genid = rt_genid(net);
2611 		rt->rt_flags = ort->rt_flags;
2612 		rt->rt_type = ort->rt_type;
2613 		rt->rt_dst = ort->rt_dst;
2614 		rt->rt_src = ort->rt_src;
2615 		rt->rt_iif = ort->rt_iif;
2616 		rt->rt_gateway = ort->rt_gateway;
2617 		rt->rt_spec_dst = ort->rt_spec_dst;
2618 		rt->peer = ort->peer;
2619 		if (rt->peer)
2620 			atomic_inc(&rt->peer->refcnt);
2621 
2622 		dst_free(new);
2623 	}
2624 
2625 	dst_release(&(*rp)->u.dst);
2626 	*rp = rt;
2627 	return (rt ? 0 : -ENOMEM);
2628 }
2629 
2630 int ip_route_output_flow(struct net *net, struct rtable **rp, struct flowi *flp,
2631 			 struct sock *sk, int flags)
2632 {
2633 	int err;
2634 
2635 	if ((err = __ip_route_output_key(net, rp, flp)) != 0)
2636 		return err;
2637 
2638 	if (flp->proto) {
2639 		if (!flp->fl4_src)
2640 			flp->fl4_src = (*rp)->rt_src;
2641 		if (!flp->fl4_dst)
2642 			flp->fl4_dst = (*rp)->rt_dst;
2643 		err = __xfrm_lookup((struct dst_entry **)rp, flp, sk,
2644 				    flags ? XFRM_LOOKUP_WAIT : 0);
2645 		if (err == -EREMOTE)
2646 			err = ipv4_dst_blackhole(net, rp, flp);
2647 
2648 		return err;
2649 	}
2650 
2651 	return 0;
2652 }
2653 
2654 EXPORT_SYMBOL_GPL(ip_route_output_flow);
2655 
2656 int ip_route_output_key(struct net *net, struct rtable **rp, struct flowi *flp)
2657 {
2658 	return ip_route_output_flow(net, rp, flp, NULL, 0);
2659 }
2660 
2661 static int rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
2662 			int nowait, unsigned int flags)
2663 {
2664 	struct rtable *rt = skb->rtable;
2665 	struct rtmsg *r;
2666 	struct nlmsghdr *nlh;
2667 	long expires;
2668 	u32 id = 0, ts = 0, tsage = 0, error;
2669 
2670 	nlh = nlmsg_put(skb, pid, seq, event, sizeof(*r), flags);
2671 	if (nlh == NULL)
2672 		return -EMSGSIZE;
2673 
2674 	r = nlmsg_data(nlh);
2675 	r->rtm_family	 = AF_INET;
2676 	r->rtm_dst_len	= 32;
2677 	r->rtm_src_len	= 0;
2678 	r->rtm_tos	= rt->fl.fl4_tos;
2679 	r->rtm_table	= RT_TABLE_MAIN;
2680 	NLA_PUT_U32(skb, RTA_TABLE, RT_TABLE_MAIN);
2681 	r->rtm_type	= rt->rt_type;
2682 	r->rtm_scope	= RT_SCOPE_UNIVERSE;
2683 	r->rtm_protocol = RTPROT_UNSPEC;
2684 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
2685 	if (rt->rt_flags & RTCF_NOTIFY)
2686 		r->rtm_flags |= RTM_F_NOTIFY;
2687 
2688 	NLA_PUT_BE32(skb, RTA_DST, rt->rt_dst);
2689 
2690 	if (rt->fl.fl4_src) {
2691 		r->rtm_src_len = 32;
2692 		NLA_PUT_BE32(skb, RTA_SRC, rt->fl.fl4_src);
2693 	}
2694 	if (rt->u.dst.dev)
2695 		NLA_PUT_U32(skb, RTA_OIF, rt->u.dst.dev->ifindex);
2696 #ifdef CONFIG_NET_CLS_ROUTE
2697 	if (rt->u.dst.tclassid)
2698 		NLA_PUT_U32(skb, RTA_FLOW, rt->u.dst.tclassid);
2699 #endif
2700 	if (rt->fl.iif)
2701 		NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_spec_dst);
2702 	else if (rt->rt_src != rt->fl.fl4_src)
2703 		NLA_PUT_BE32(skb, RTA_PREFSRC, rt->rt_src);
2704 
2705 	if (rt->rt_dst != rt->rt_gateway)
2706 		NLA_PUT_BE32(skb, RTA_GATEWAY, rt->rt_gateway);
2707 
2708 	if (rtnetlink_put_metrics(skb, rt->u.dst.metrics) < 0)
2709 		goto nla_put_failure;
2710 
2711 	error = rt->u.dst.error;
2712 	expires = rt->u.dst.expires ? rt->u.dst.expires - jiffies : 0;
2713 	if (rt->peer) {
2714 		id = rt->peer->ip_id_count;
2715 		if (rt->peer->tcp_ts_stamp) {
2716 			ts = rt->peer->tcp_ts;
2717 			tsage = get_seconds() - rt->peer->tcp_ts_stamp;
2718 		}
2719 	}
2720 
2721 	if (rt->fl.iif) {
2722 #ifdef CONFIG_IP_MROUTE
2723 		__be32 dst = rt->rt_dst;
2724 
2725 		if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
2726 		    IPV4_DEVCONF_ALL(&init_net, MC_FORWARDING)) {
2727 			int err = ipmr_get_route(skb, r, nowait);
2728 			if (err <= 0) {
2729 				if (!nowait) {
2730 					if (err == 0)
2731 						return 0;
2732 					goto nla_put_failure;
2733 				} else {
2734 					if (err == -EMSGSIZE)
2735 						goto nla_put_failure;
2736 					error = err;
2737 				}
2738 			}
2739 		} else
2740 #endif
2741 			NLA_PUT_U32(skb, RTA_IIF, rt->fl.iif);
2742 	}
2743 
2744 	if (rtnl_put_cacheinfo(skb, &rt->u.dst, id, ts, tsage,
2745 			       expires, error) < 0)
2746 		goto nla_put_failure;
2747 
2748 	return nlmsg_end(skb, nlh);
2749 
2750 nla_put_failure:
2751 	nlmsg_cancel(skb, nlh);
2752 	return -EMSGSIZE;
2753 }
2754 
2755 static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void *arg)
2756 {
2757 	struct net *net = sock_net(in_skb->sk);
2758 	struct rtmsg *rtm;
2759 	struct nlattr *tb[RTA_MAX+1];
2760 	struct rtable *rt = NULL;
2761 	__be32 dst = 0;
2762 	__be32 src = 0;
2763 	u32 iif;
2764 	int err;
2765 	struct sk_buff *skb;
2766 
2767 	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
2768 	if (err < 0)
2769 		goto errout;
2770 
2771 	rtm = nlmsg_data(nlh);
2772 
2773 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2774 	if (skb == NULL) {
2775 		err = -ENOBUFS;
2776 		goto errout;
2777 	}
2778 
2779 	/* Reserve room for dummy headers, this skb can pass
2780 	   through good chunk of routing engine.
2781 	 */
2782 	skb_reset_mac_header(skb);
2783 	skb_reset_network_header(skb);
2784 
2785 	/* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
2786 	ip_hdr(skb)->protocol = IPPROTO_ICMP;
2787 	skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
2788 
2789 	src = tb[RTA_SRC] ? nla_get_be32(tb[RTA_SRC]) : 0;
2790 	dst = tb[RTA_DST] ? nla_get_be32(tb[RTA_DST]) : 0;
2791 	iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
2792 
2793 	if (iif) {
2794 		struct net_device *dev;
2795 
2796 		dev = __dev_get_by_index(net, iif);
2797 		if (dev == NULL) {
2798 			err = -ENODEV;
2799 			goto errout_free;
2800 		}
2801 
2802 		skb->protocol	= htons(ETH_P_IP);
2803 		skb->dev	= dev;
2804 		local_bh_disable();
2805 		err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev);
2806 		local_bh_enable();
2807 
2808 		rt = skb->rtable;
2809 		if (err == 0 && rt->u.dst.error)
2810 			err = -rt->u.dst.error;
2811 	} else {
2812 		struct flowi fl = {
2813 			.nl_u = {
2814 				.ip4_u = {
2815 					.daddr = dst,
2816 					.saddr = src,
2817 					.tos = rtm->rtm_tos,
2818 				},
2819 			},
2820 			.oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0,
2821 		};
2822 		err = ip_route_output_key(net, &rt, &fl);
2823 	}
2824 
2825 	if (err)
2826 		goto errout_free;
2827 
2828 	skb->rtable = rt;
2829 	if (rtm->rtm_flags & RTM_F_NOTIFY)
2830 		rt->rt_flags |= RTCF_NOTIFY;
2831 
2832 	err = rt_fill_info(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
2833 			   RTM_NEWROUTE, 0, 0);
2834 	if (err <= 0)
2835 		goto errout_free;
2836 
2837 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
2838 errout:
2839 	return err;
2840 
2841 errout_free:
2842 	kfree_skb(skb);
2843 	goto errout;
2844 }
2845 
2846 int ip_rt_dump(struct sk_buff *skb,  struct netlink_callback *cb)
2847 {
2848 	struct rtable *rt;
2849 	int h, s_h;
2850 	int idx, s_idx;
2851 	struct net *net;
2852 
2853 	net = sock_net(skb->sk);
2854 
2855 	s_h = cb->args[0];
2856 	if (s_h < 0)
2857 		s_h = 0;
2858 	s_idx = idx = cb->args[1];
2859 	for (h = s_h; h <= rt_hash_mask; h++, s_idx = 0) {
2860 		if (!rt_hash_table[h].chain)
2861 			continue;
2862 		rcu_read_lock_bh();
2863 		for (rt = rcu_dereference(rt_hash_table[h].chain), idx = 0; rt;
2864 		     rt = rcu_dereference(rt->u.dst.rt_next), idx++) {
2865 			if (!net_eq(dev_net(rt->u.dst.dev), net) || idx < s_idx)
2866 				continue;
2867 			if (rt_is_expired(rt))
2868 				continue;
2869 			skb->dst = dst_clone(&rt->u.dst);
2870 			if (rt_fill_info(skb, NETLINK_CB(cb->skb).pid,
2871 					 cb->nlh->nlmsg_seq, RTM_NEWROUTE,
2872 					 1, NLM_F_MULTI) <= 0) {
2873 				dst_release(xchg(&skb->dst, NULL));
2874 				rcu_read_unlock_bh();
2875 				goto done;
2876 			}
2877 			dst_release(xchg(&skb->dst, NULL));
2878 		}
2879 		rcu_read_unlock_bh();
2880 	}
2881 
2882 done:
2883 	cb->args[0] = h;
2884 	cb->args[1] = idx;
2885 	return skb->len;
2886 }
2887 
2888 void ip_rt_multicast_event(struct in_device *in_dev)
2889 {
2890 	rt_cache_flush(dev_net(in_dev->dev), 0);
2891 }
2892 
2893 #ifdef CONFIG_SYSCTL
2894 static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
2895 					struct file *filp, void __user *buffer,
2896 					size_t *lenp, loff_t *ppos)
2897 {
2898 	if (write) {
2899 		int flush_delay;
2900 		ctl_table ctl;
2901 		struct net *net;
2902 
2903 		memcpy(&ctl, __ctl, sizeof(ctl));
2904 		ctl.data = &flush_delay;
2905 		proc_dointvec(&ctl, write, filp, buffer, lenp, ppos);
2906 
2907 		net = (struct net *)__ctl->extra1;
2908 		rt_cache_flush(net, flush_delay);
2909 		return 0;
2910 	}
2911 
2912 	return -EINVAL;
2913 }
2914 
2915 static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
2916 						void __user *oldval,
2917 						size_t __user *oldlenp,
2918 						void __user *newval,
2919 						size_t newlen)
2920 {
2921 	int delay;
2922 	struct net *net;
2923 	if (newlen != sizeof(int))
2924 		return -EINVAL;
2925 	if (get_user(delay, (int __user *)newval))
2926 		return -EFAULT;
2927 	net = (struct net *)table->extra1;
2928 	rt_cache_flush(net, delay);
2929 	return 0;
2930 }
2931 
2932 static void rt_secret_reschedule(int old)
2933 {
2934 	struct net *net;
2935 	int new = ip_rt_secret_interval;
2936 	int diff = new - old;
2937 
2938 	if (!diff)
2939 		return;
2940 
2941 	rtnl_lock();
2942 	for_each_net(net) {
2943 		int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
2944 
2945 		if (!new)
2946 			continue;
2947 
2948 		if (deleted) {
2949 			long time = net->ipv4.rt_secret_timer.expires - jiffies;
2950 
2951 			if (time <= 0 || (time += diff) <= 0)
2952 				time = 0;
2953 
2954 			net->ipv4.rt_secret_timer.expires = time;
2955 		} else
2956 			net->ipv4.rt_secret_timer.expires = new;
2957 
2958 		net->ipv4.rt_secret_timer.expires += jiffies;
2959 		add_timer(&net->ipv4.rt_secret_timer);
2960 	}
2961 	rtnl_unlock();
2962 }
2963 
2964 static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
2965 					  struct file *filp,
2966 					  void __user *buffer, size_t *lenp,
2967 					  loff_t *ppos)
2968 {
2969 	int old = ip_rt_secret_interval;
2970 	int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
2971 
2972 	rt_secret_reschedule(old);
2973 
2974 	return ret;
2975 }
2976 
2977 static int ipv4_sysctl_rt_secret_interval_strategy(ctl_table *table,
2978 						   void __user *oldval,
2979 						   size_t __user *oldlenp,
2980 						   void __user *newval,
2981 						   size_t newlen)
2982 {
2983 	int old = ip_rt_secret_interval;
2984 	int ret = sysctl_jiffies(table, oldval, oldlenp, newval, newlen);
2985 
2986 	rt_secret_reschedule(old);
2987 
2988 	return ret;
2989 }
2990 
2991 static ctl_table ipv4_route_table[] = {
2992 	{
2993 		.ctl_name	= NET_IPV4_ROUTE_GC_THRESH,
2994 		.procname	= "gc_thresh",
2995 		.data		= &ipv4_dst_ops.gc_thresh,
2996 		.maxlen		= sizeof(int),
2997 		.mode		= 0644,
2998 		.proc_handler	= &proc_dointvec,
2999 	},
3000 	{
3001 		.ctl_name	= NET_IPV4_ROUTE_MAX_SIZE,
3002 		.procname	= "max_size",
3003 		.data		= &ip_rt_max_size,
3004 		.maxlen		= sizeof(int),
3005 		.mode		= 0644,
3006 		.proc_handler	= &proc_dointvec,
3007 	},
3008 	{
3009 		/*  Deprecated. Use gc_min_interval_ms */
3010 
3011 		.ctl_name	= NET_IPV4_ROUTE_GC_MIN_INTERVAL,
3012 		.procname	= "gc_min_interval",
3013 		.data		= &ip_rt_gc_min_interval,
3014 		.maxlen		= sizeof(int),
3015 		.mode		= 0644,
3016 		.proc_handler	= &proc_dointvec_jiffies,
3017 		.strategy	= &sysctl_jiffies,
3018 	},
3019 	{
3020 		.ctl_name	= NET_IPV4_ROUTE_GC_MIN_INTERVAL_MS,
3021 		.procname	= "gc_min_interval_ms",
3022 		.data		= &ip_rt_gc_min_interval,
3023 		.maxlen		= sizeof(int),
3024 		.mode		= 0644,
3025 		.proc_handler	= &proc_dointvec_ms_jiffies,
3026 		.strategy	= &sysctl_ms_jiffies,
3027 	},
3028 	{
3029 		.ctl_name	= NET_IPV4_ROUTE_GC_TIMEOUT,
3030 		.procname	= "gc_timeout",
3031 		.data		= &ip_rt_gc_timeout,
3032 		.maxlen		= sizeof(int),
3033 		.mode		= 0644,
3034 		.proc_handler	= &proc_dointvec_jiffies,
3035 		.strategy	= &sysctl_jiffies,
3036 	},
3037 	{
3038 		.ctl_name	= NET_IPV4_ROUTE_GC_INTERVAL,
3039 		.procname	= "gc_interval",
3040 		.data		= &ip_rt_gc_interval,
3041 		.maxlen		= sizeof(int),
3042 		.mode		= 0644,
3043 		.proc_handler	= &proc_dointvec_jiffies,
3044 		.strategy	= &sysctl_jiffies,
3045 	},
3046 	{
3047 		.ctl_name	= NET_IPV4_ROUTE_REDIRECT_LOAD,
3048 		.procname	= "redirect_load",
3049 		.data		= &ip_rt_redirect_load,
3050 		.maxlen		= sizeof(int),
3051 		.mode		= 0644,
3052 		.proc_handler	= &proc_dointvec,
3053 	},
3054 	{
3055 		.ctl_name	= NET_IPV4_ROUTE_REDIRECT_NUMBER,
3056 		.procname	= "redirect_number",
3057 		.data		= &ip_rt_redirect_number,
3058 		.maxlen		= sizeof(int),
3059 		.mode		= 0644,
3060 		.proc_handler	= &proc_dointvec,
3061 	},
3062 	{
3063 		.ctl_name	= NET_IPV4_ROUTE_REDIRECT_SILENCE,
3064 		.procname	= "redirect_silence",
3065 		.data		= &ip_rt_redirect_silence,
3066 		.maxlen		= sizeof(int),
3067 		.mode		= 0644,
3068 		.proc_handler	= &proc_dointvec,
3069 	},
3070 	{
3071 		.ctl_name	= NET_IPV4_ROUTE_ERROR_COST,
3072 		.procname	= "error_cost",
3073 		.data		= &ip_rt_error_cost,
3074 		.maxlen		= sizeof(int),
3075 		.mode		= 0644,
3076 		.proc_handler	= &proc_dointvec,
3077 	},
3078 	{
3079 		.ctl_name	= NET_IPV4_ROUTE_ERROR_BURST,
3080 		.procname	= "error_burst",
3081 		.data		= &ip_rt_error_burst,
3082 		.maxlen		= sizeof(int),
3083 		.mode		= 0644,
3084 		.proc_handler	= &proc_dointvec,
3085 	},
3086 	{
3087 		.ctl_name	= NET_IPV4_ROUTE_GC_ELASTICITY,
3088 		.procname	= "gc_elasticity",
3089 		.data		= &ip_rt_gc_elasticity,
3090 		.maxlen		= sizeof(int),
3091 		.mode		= 0644,
3092 		.proc_handler	= &proc_dointvec,
3093 	},
3094 	{
3095 		.ctl_name	= NET_IPV4_ROUTE_MTU_EXPIRES,
3096 		.procname	= "mtu_expires",
3097 		.data		= &ip_rt_mtu_expires,
3098 		.maxlen		= sizeof(int),
3099 		.mode		= 0644,
3100 		.proc_handler	= &proc_dointvec_jiffies,
3101 		.strategy	= &sysctl_jiffies,
3102 	},
3103 	{
3104 		.ctl_name	= NET_IPV4_ROUTE_MIN_PMTU,
3105 		.procname	= "min_pmtu",
3106 		.data		= &ip_rt_min_pmtu,
3107 		.maxlen		= sizeof(int),
3108 		.mode		= 0644,
3109 		.proc_handler	= &proc_dointvec,
3110 	},
3111 	{
3112 		.ctl_name	= NET_IPV4_ROUTE_MIN_ADVMSS,
3113 		.procname	= "min_adv_mss",
3114 		.data		= &ip_rt_min_advmss,
3115 		.maxlen		= sizeof(int),
3116 		.mode		= 0644,
3117 		.proc_handler	= &proc_dointvec,
3118 	},
3119 	{
3120 		.ctl_name	= NET_IPV4_ROUTE_SECRET_INTERVAL,
3121 		.procname	= "secret_interval",
3122 		.data		= &ip_rt_secret_interval,
3123 		.maxlen		= sizeof(int),
3124 		.mode		= 0644,
3125 		.proc_handler	= &ipv4_sysctl_rt_secret_interval,
3126 		.strategy	= &ipv4_sysctl_rt_secret_interval_strategy,
3127 	},
3128 	{ .ctl_name = 0 }
3129 };
3130 
3131 static struct ctl_table empty[1];
3132 
3133 static struct ctl_table ipv4_skeleton[] =
3134 {
3135 	{ .procname = "route", .ctl_name = NET_IPV4_ROUTE,
3136 	  .mode = 0555, .child = ipv4_route_table},
3137 	{ .procname = "neigh", .ctl_name = NET_IPV4_NEIGH,
3138 	  .mode = 0555, .child = empty},
3139 	{ }
3140 };
3141 
3142 static __net_initdata struct ctl_path ipv4_path[] = {
3143 	{ .procname = "net", .ctl_name = CTL_NET, },
3144 	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
3145 	{ },
3146 };
3147 
3148 static struct ctl_table ipv4_route_flush_table[] = {
3149 	{
3150 		.ctl_name 	= NET_IPV4_ROUTE_FLUSH,
3151 		.procname	= "flush",
3152 		.maxlen		= sizeof(int),
3153 		.mode		= 0200,
3154 		.proc_handler	= &ipv4_sysctl_rtcache_flush,
3155 		.strategy	= &ipv4_sysctl_rtcache_flush_strategy,
3156 	},
3157 	{ .ctl_name = 0 },
3158 };
3159 
3160 static __net_initdata struct ctl_path ipv4_route_path[] = {
3161 	{ .procname = "net", .ctl_name = CTL_NET, },
3162 	{ .procname = "ipv4", .ctl_name = NET_IPV4, },
3163 	{ .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
3164 	{ },
3165 };
3166 
3167 static __net_init int sysctl_route_net_init(struct net *net)
3168 {
3169 	struct ctl_table *tbl;
3170 
3171 	tbl = ipv4_route_flush_table;
3172 	if (net != &init_net) {
3173 		tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
3174 		if (tbl == NULL)
3175 			goto err_dup;
3176 	}
3177 	tbl[0].extra1 = net;
3178 
3179 	net->ipv4.route_hdr =
3180 		register_net_sysctl_table(net, ipv4_route_path, tbl);
3181 	if (net->ipv4.route_hdr == NULL)
3182 		goto err_reg;
3183 	return 0;
3184 
3185 err_reg:
3186 	if (tbl != ipv4_route_flush_table)
3187 		kfree(tbl);
3188 err_dup:
3189 	return -ENOMEM;
3190 }
3191 
3192 static __net_exit void sysctl_route_net_exit(struct net *net)
3193 {
3194 	struct ctl_table *tbl;
3195 
3196 	tbl = net->ipv4.route_hdr->ctl_table_arg;
3197 	unregister_net_sysctl_table(net->ipv4.route_hdr);
3198 	BUG_ON(tbl == ipv4_route_flush_table);
3199 	kfree(tbl);
3200 }
3201 
3202 static __net_initdata struct pernet_operations sysctl_route_ops = {
3203 	.init = sysctl_route_net_init,
3204 	.exit = sysctl_route_net_exit,
3205 };
3206 #endif
3207 
3208 
3209 static __net_init int rt_secret_timer_init(struct net *net)
3210 {
3211 	atomic_set(&net->ipv4.rt_genid,
3212 			(int) ((num_physpages ^ (num_physpages>>8)) ^
3213 			(jiffies ^ (jiffies >> 7))));
3214 
3215 	net->ipv4.rt_secret_timer.function = rt_secret_rebuild;
3216 	net->ipv4.rt_secret_timer.data = (unsigned long)net;
3217 	init_timer_deferrable(&net->ipv4.rt_secret_timer);
3218 
3219 	if (ip_rt_secret_interval) {
3220 		net->ipv4.rt_secret_timer.expires =
3221 			jiffies + net_random() % ip_rt_secret_interval +
3222 			ip_rt_secret_interval;
3223 		add_timer(&net->ipv4.rt_secret_timer);
3224 	}
3225 	return 0;
3226 }
3227 
3228 static __net_exit void rt_secret_timer_exit(struct net *net)
3229 {
3230 	del_timer_sync(&net->ipv4.rt_secret_timer);
3231 }
3232 
3233 static __net_initdata struct pernet_operations rt_secret_timer_ops = {
3234 	.init = rt_secret_timer_init,
3235 	.exit = rt_secret_timer_exit,
3236 };
3237 
3238 
3239 #ifdef CONFIG_NET_CLS_ROUTE
3240 struct ip_rt_acct *ip_rt_acct __read_mostly;
3241 #endif /* CONFIG_NET_CLS_ROUTE */
3242 
3243 static __initdata unsigned long rhash_entries;
3244 static int __init set_rhash_entries(char *str)
3245 {
3246 	if (!str)
3247 		return 0;
3248 	rhash_entries = simple_strtoul(str, &str, 0);
3249 	return 1;
3250 }
3251 __setup("rhash_entries=", set_rhash_entries);
3252 
3253 int __init ip_rt_init(void)
3254 {
3255 	int rc = 0;
3256 
3257 #ifdef CONFIG_NET_CLS_ROUTE
3258 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct));
3259 	if (!ip_rt_acct)
3260 		panic("IP: failed to allocate ip_rt_acct\n");
3261 #endif
3262 
3263 	ipv4_dst_ops.kmem_cachep =
3264 		kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
3265 				  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
3266 
3267 	ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
3268 
3269 	rt_hash_table = (struct rt_hash_bucket *)
3270 		alloc_large_system_hash("IP route cache",
3271 					sizeof(struct rt_hash_bucket),
3272 					rhash_entries,
3273 					(num_physpages >= 128 * 1024) ?
3274 					15 : 17,
3275 					0,
3276 					&rt_hash_log,
3277 					&rt_hash_mask,
3278 					0);
3279 	memset(rt_hash_table, 0, (rt_hash_mask + 1) * sizeof(struct rt_hash_bucket));
3280 	rt_hash_lock_init();
3281 
3282 	ipv4_dst_ops.gc_thresh = (rt_hash_mask + 1);
3283 	ip_rt_max_size = (rt_hash_mask + 1) * 16;
3284 
3285 	devinet_init();
3286 	ip_fib_init();
3287 
3288 	/* All the timers, started at system startup tend
3289 	   to synchronize. Perturb it a bit.
3290 	 */
3291 	schedule_delayed_work(&expires_work,
3292 		net_random() % ip_rt_gc_interval + ip_rt_gc_interval);
3293 
3294 	if (register_pernet_subsys(&rt_secret_timer_ops))
3295 		printk(KERN_ERR "Unable to setup rt_secret_timer\n");
3296 
3297 	if (ip_rt_proc_init())
3298 		printk(KERN_ERR "Unable to create route proc files\n");
3299 #ifdef CONFIG_XFRM
3300 	xfrm_init();
3301 	xfrm4_init();
3302 #endif
3303 	rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL);
3304 
3305 #ifdef CONFIG_SYSCTL
3306 	register_pernet_subsys(&sysctl_route_ops);
3307 #endif
3308 	return rc;
3309 }
3310 
3311 #ifdef CONFIG_SYSCTL
3312 /*
3313  * We really need to sanitize the damn ipv4 init order, then all
3314  * this nonsense will go away.
3315  */
3316 void __init ip_static_sysctl_init(void)
3317 {
3318 	register_sysctl_paths(ipv4_path, ipv4_skeleton);
3319 }
3320 #endif
3321 
3322 EXPORT_SYMBOL(__ip_select_ident);
3323 EXPORT_SYMBOL(ip_route_input);
3324 EXPORT_SYMBOL(ip_route_output_key);
3325