xref: /openbmc/linux/net/ipv4/route.c (revision ae213c44)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		ROUTE - implementation of the IP router.
7  *
8  * Authors:	Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
11  *		Linus Torvalds, <Linus.Torvalds@helsinki.fi>
12  *		Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
13  *
14  * Fixes:
15  *		Alan Cox	:	Verify area fixes.
16  *		Alan Cox	:	cli() protects routing changes
17  *		Rui Oliveira	:	ICMP routing table updates
18  *		(rco@di.uminho.pt)	Routing table insertion and update
19  *		Linus Torvalds	:	Rewrote bits to be sensible
20  *		Alan Cox	:	Added BSD route gw semantics
21  *		Alan Cox	:	Super /proc >4K
22  *		Alan Cox	:	MTU in route table
23  *		Alan Cox	: 	MSS actually. Also added the window
24  *					clamper.
25  *		Sam Lantinga	:	Fixed route matching in rt_del()
26  *		Alan Cox	:	Routing cache support.
27  *		Alan Cox	:	Removed compatibility cruft.
28  *		Alan Cox	:	RTF_REJECT support.
29  *		Alan Cox	:	TCP irtt support.
30  *		Jonathan Naylor	:	Added Metric support.
31  *	Miquel van Smoorenburg	:	BSD API fixes.
32  *	Miquel van Smoorenburg	:	Metrics.
33  *		Alan Cox	:	Use __u32 properly
34  *		Alan Cox	:	Aligned routing errors more closely with BSD
35  *					our system is still very different.
36  *		Alan Cox	:	Faster /proc handling
37  *	Alexey Kuznetsov	:	Massive rework to support tree based routing,
38  *					routing caches and better behaviour.
39  *
40  *		Olaf Erb	:	irtt wasn't being copied right.
41  *		Bjorn Ekwall	:	Kerneld route support.
42  *		Alan Cox	:	Multicast fixed (I hope)
43  * 		Pavel Krauz	:	Limited broadcast fixed
44  *		Mike McLagan	:	Routing by source
45  *	Alexey Kuznetsov	:	End of old history. Split to fib.c and
46  *					route.c and rewritten from scratch.
47  *		Andi Kleen	:	Load-limit warning messages.
48  *	Vitaly E. Lavrov	:	Transparent proxy revived after year coma.
49  *	Vitaly E. Lavrov	:	Race condition in ip_route_input_slow.
50  *	Tobias Ringstrom	:	Uninitialized res.type in ip_route_output_slow.
51  *	Vladimir V. Ivanov	:	IP rule info (flowid) is really useful.
52  *		Marc Boucher	:	routing by fwmark
53  *	Robert Olsson		:	Added rt_cache statistics
54  *	Arnaldo C. Melo		:	Convert proc stuff to seq_file
55  *	Eric Dumazet		:	hashed spinlocks and rt_check_expire() fixes.
56  * 	Ilia Sotnikov		:	Ignore TOS on PMTUD and Redirect
57  * 	Ilia Sotnikov		:	Removed TOS from hash calculations
58  *
59  *		This program is free software; you can redistribute it and/or
60  *		modify it under the terms of the GNU General Public License
61  *		as published by the Free Software Foundation; either version
62  *		2 of the License, or (at your option) any later version.
63  */
64 
65 #define pr_fmt(fmt) "IPv4: " fmt
66 
67 #include <linux/module.h>
68 #include <linux/uaccess.h>
69 #include <linux/bitops.h>
70 #include <linux/types.h>
71 #include <linux/kernel.h>
72 #include <linux/mm.h>
73 #include <linux/string.h>
74 #include <linux/socket.h>
75 #include <linux/sockios.h>
76 #include <linux/errno.h>
77 #include <linux/in.h>
78 #include <linux/inet.h>
79 #include <linux/netdevice.h>
80 #include <linux/proc_fs.h>
81 #include <linux/init.h>
82 #include <linux/skbuff.h>
83 #include <linux/inetdevice.h>
84 #include <linux/igmp.h>
85 #include <linux/pkt_sched.h>
86 #include <linux/mroute.h>
87 #include <linux/netfilter_ipv4.h>
88 #include <linux/random.h>
89 #include <linux/rcupdate.h>
90 #include <linux/times.h>
91 #include <linux/slab.h>
92 #include <linux/jhash.h>
93 #include <net/dst.h>
94 #include <net/dst_metadata.h>
95 #include <net/net_namespace.h>
96 #include <net/protocol.h>
97 #include <net/ip.h>
98 #include <net/route.h>
99 #include <net/inetpeer.h>
100 #include <net/sock.h>
101 #include <net/ip_fib.h>
102 #include <net/arp.h>
103 #include <net/tcp.h>
104 #include <net/icmp.h>
105 #include <net/xfrm.h>
106 #include <net/lwtunnel.h>
107 #include <net/netevent.h>
108 #include <net/rtnetlink.h>
109 #ifdef CONFIG_SYSCTL
110 #include <linux/sysctl.h>
111 #endif
112 #include <net/secure_seq.h>
113 #include <net/ip_tunnels.h>
114 #include <net/l3mdev.h>
115 
116 #include "fib_lookup.h"
117 
118 #define RT_FL_TOS(oldflp4) \
119 	((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
120 
121 #define RT_GC_TIMEOUT (300*HZ)
122 
123 static int ip_rt_max_size;
124 static int ip_rt_redirect_number __read_mostly	= 9;
125 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
126 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
127 static int ip_rt_error_cost __read_mostly	= HZ;
128 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
129 static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
130 static u32 ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
131 static int ip_rt_min_advmss __read_mostly	= 256;
132 
133 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
134 
135 /*
136  *	Interface to generic destination cache.
137  */
138 
139 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
140 static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);
141 static unsigned int	 ipv4_mtu(const struct dst_entry *dst);
142 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
143 static void		 ipv4_link_failure(struct sk_buff *skb);
144 static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
145 					   struct sk_buff *skb, u32 mtu);
146 static void		 ip_do_redirect(struct dst_entry *dst, struct sock *sk,
147 					struct sk_buff *skb);
148 static void		ipv4_dst_destroy(struct dst_entry *dst);
149 
150 static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
151 {
152 	WARN_ON(1);
153 	return NULL;
154 }
155 
156 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
157 					   struct sk_buff *skb,
158 					   const void *daddr);
159 static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr);
160 
161 static struct dst_ops ipv4_dst_ops = {
162 	.family =		AF_INET,
163 	.check =		ipv4_dst_check,
164 	.default_advmss =	ipv4_default_advmss,
165 	.mtu =			ipv4_mtu,
166 	.cow_metrics =		ipv4_cow_metrics,
167 	.destroy =		ipv4_dst_destroy,
168 	.negative_advice =	ipv4_negative_advice,
169 	.link_failure =		ipv4_link_failure,
170 	.update_pmtu =		ip_rt_update_pmtu,
171 	.redirect =		ip_do_redirect,
172 	.local_out =		__ip_local_out,
173 	.neigh_lookup =		ipv4_neigh_lookup,
174 	.confirm_neigh =	ipv4_confirm_neigh,
175 };
176 
177 #define ECN_OR_COST(class)	TC_PRIO_##class
178 
179 const __u8 ip_tos2prio[16] = {
180 	TC_PRIO_BESTEFFORT,
181 	ECN_OR_COST(BESTEFFORT),
182 	TC_PRIO_BESTEFFORT,
183 	ECN_OR_COST(BESTEFFORT),
184 	TC_PRIO_BULK,
185 	ECN_OR_COST(BULK),
186 	TC_PRIO_BULK,
187 	ECN_OR_COST(BULK),
188 	TC_PRIO_INTERACTIVE,
189 	ECN_OR_COST(INTERACTIVE),
190 	TC_PRIO_INTERACTIVE,
191 	ECN_OR_COST(INTERACTIVE),
192 	TC_PRIO_INTERACTIVE_BULK,
193 	ECN_OR_COST(INTERACTIVE_BULK),
194 	TC_PRIO_INTERACTIVE_BULK,
195 	ECN_OR_COST(INTERACTIVE_BULK)
196 };
197 EXPORT_SYMBOL(ip_tos2prio);
198 
199 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
200 #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
201 
202 #ifdef CONFIG_PROC_FS
203 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
204 {
205 	if (*pos)
206 		return NULL;
207 	return SEQ_START_TOKEN;
208 }
209 
210 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
211 {
212 	++*pos;
213 	return NULL;
214 }
215 
216 static void rt_cache_seq_stop(struct seq_file *seq, void *v)
217 {
218 }
219 
220 static int rt_cache_seq_show(struct seq_file *seq, void *v)
221 {
222 	if (v == SEQ_START_TOKEN)
223 		seq_printf(seq, "%-127s\n",
224 			   "Iface\tDestination\tGateway \tFlags\t\tRefCnt\tUse\t"
225 			   "Metric\tSource\t\tMTU\tWindow\tIRTT\tTOS\tHHRef\t"
226 			   "HHUptod\tSpecDst");
227 	return 0;
228 }
229 
230 static const struct seq_operations rt_cache_seq_ops = {
231 	.start  = rt_cache_seq_start,
232 	.next   = rt_cache_seq_next,
233 	.stop   = rt_cache_seq_stop,
234 	.show   = rt_cache_seq_show,
235 };
236 
237 static int rt_cache_seq_open(struct inode *inode, struct file *file)
238 {
239 	return seq_open(file, &rt_cache_seq_ops);
240 }
241 
242 static const struct file_operations rt_cache_seq_fops = {
243 	.open	 = rt_cache_seq_open,
244 	.read	 = seq_read,
245 	.llseek	 = seq_lseek,
246 	.release = seq_release,
247 };
248 
249 
250 static void *rt_cpu_seq_start(struct seq_file *seq, loff_t *pos)
251 {
252 	int cpu;
253 
254 	if (*pos == 0)
255 		return SEQ_START_TOKEN;
256 
257 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
258 		if (!cpu_possible(cpu))
259 			continue;
260 		*pos = cpu+1;
261 		return &per_cpu(rt_cache_stat, cpu);
262 	}
263 	return NULL;
264 }
265 
266 static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
267 {
268 	int cpu;
269 
270 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
271 		if (!cpu_possible(cpu))
272 			continue;
273 		*pos = cpu+1;
274 		return &per_cpu(rt_cache_stat, cpu);
275 	}
276 	return NULL;
277 
278 }
279 
280 static void rt_cpu_seq_stop(struct seq_file *seq, void *v)
281 {
282 
283 }
284 
285 static int rt_cpu_seq_show(struct seq_file *seq, void *v)
286 {
287 	struct rt_cache_stat *st = v;
288 
289 	if (v == SEQ_START_TOKEN) {
290 		seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
291 		return 0;
292 	}
293 
294 	seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
295 		   " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
296 		   dst_entries_get_slow(&ipv4_dst_ops),
297 		   0, /* st->in_hit */
298 		   st->in_slow_tot,
299 		   st->in_slow_mc,
300 		   st->in_no_route,
301 		   st->in_brd,
302 		   st->in_martian_dst,
303 		   st->in_martian_src,
304 
305 		   0, /* st->out_hit */
306 		   st->out_slow_tot,
307 		   st->out_slow_mc,
308 
309 		   0, /* st->gc_total */
310 		   0, /* st->gc_ignored */
311 		   0, /* st->gc_goal_miss */
312 		   0, /* st->gc_dst_overflow */
313 		   0, /* st->in_hlist_search */
314 		   0  /* st->out_hlist_search */
315 		);
316 	return 0;
317 }
318 
319 static const struct seq_operations rt_cpu_seq_ops = {
320 	.start  = rt_cpu_seq_start,
321 	.next   = rt_cpu_seq_next,
322 	.stop   = rt_cpu_seq_stop,
323 	.show   = rt_cpu_seq_show,
324 };
325 
326 
327 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
328 {
329 	return seq_open(file, &rt_cpu_seq_ops);
330 }
331 
332 static const struct file_operations rt_cpu_seq_fops = {
333 	.open	 = rt_cpu_seq_open,
334 	.read	 = seq_read,
335 	.llseek	 = seq_lseek,
336 	.release = seq_release,
337 };
338 
339 #ifdef CONFIG_IP_ROUTE_CLASSID
340 static int rt_acct_proc_show(struct seq_file *m, void *v)
341 {
342 	struct ip_rt_acct *dst, *src;
343 	unsigned int i, j;
344 
345 	dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
346 	if (!dst)
347 		return -ENOMEM;
348 
349 	for_each_possible_cpu(i) {
350 		src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
351 		for (j = 0; j < 256; j++) {
352 			dst[j].o_bytes   += src[j].o_bytes;
353 			dst[j].o_packets += src[j].o_packets;
354 			dst[j].i_bytes   += src[j].i_bytes;
355 			dst[j].i_packets += src[j].i_packets;
356 		}
357 	}
358 
359 	seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
360 	kfree(dst);
361 	return 0;
362 }
363 #endif
364 
365 static int __net_init ip_rt_do_proc_init(struct net *net)
366 {
367 	struct proc_dir_entry *pde;
368 
369 	pde = proc_create("rt_cache", 0444, net->proc_net,
370 			  &rt_cache_seq_fops);
371 	if (!pde)
372 		goto err1;
373 
374 	pde = proc_create("rt_cache", 0444,
375 			  net->proc_net_stat, &rt_cpu_seq_fops);
376 	if (!pde)
377 		goto err2;
378 
379 #ifdef CONFIG_IP_ROUTE_CLASSID
380 	pde = proc_create_single("rt_acct", 0, net->proc_net,
381 			rt_acct_proc_show);
382 	if (!pde)
383 		goto err3;
384 #endif
385 	return 0;
386 
387 #ifdef CONFIG_IP_ROUTE_CLASSID
388 err3:
389 	remove_proc_entry("rt_cache", net->proc_net_stat);
390 #endif
391 err2:
392 	remove_proc_entry("rt_cache", net->proc_net);
393 err1:
394 	return -ENOMEM;
395 }
396 
397 static void __net_exit ip_rt_do_proc_exit(struct net *net)
398 {
399 	remove_proc_entry("rt_cache", net->proc_net_stat);
400 	remove_proc_entry("rt_cache", net->proc_net);
401 #ifdef CONFIG_IP_ROUTE_CLASSID
402 	remove_proc_entry("rt_acct", net->proc_net);
403 #endif
404 }
405 
406 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
407 	.init = ip_rt_do_proc_init,
408 	.exit = ip_rt_do_proc_exit,
409 };
410 
411 static int __init ip_rt_proc_init(void)
412 {
413 	return register_pernet_subsys(&ip_rt_proc_ops);
414 }
415 
416 #else
417 static inline int ip_rt_proc_init(void)
418 {
419 	return 0;
420 }
421 #endif /* CONFIG_PROC_FS */
422 
423 static inline bool rt_is_expired(const struct rtable *rth)
424 {
425 	return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
426 }
427 
428 void rt_cache_flush(struct net *net)
429 {
430 	rt_genid_bump_ipv4(net);
431 }
432 
433 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
434 					   struct sk_buff *skb,
435 					   const void *daddr)
436 {
437 	const struct rtable *rt = container_of(dst, struct rtable, dst);
438 	struct net_device *dev = dst->dev;
439 	struct neighbour *n;
440 
441 	rcu_read_lock_bh();
442 
443 	if (likely(rt->rt_gw_family == AF_INET)) {
444 		n = ip_neigh_gw4(dev, rt->rt_gw4);
445 	} else if (rt->rt_gw_family == AF_INET6) {
446 		n = ip_neigh_gw6(dev, &rt->rt_gw6);
447         } else {
448 		__be32 pkey;
449 
450 		pkey = skb ? ip_hdr(skb)->daddr : *((__be32 *) daddr);
451 		n = ip_neigh_gw4(dev, pkey);
452 	}
453 
454 	if (n && !refcount_inc_not_zero(&n->refcnt))
455 		n = NULL;
456 
457 	rcu_read_unlock_bh();
458 
459 	return n;
460 }
461 
462 static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr)
463 {
464 	const struct rtable *rt = container_of(dst, struct rtable, dst);
465 	struct net_device *dev = dst->dev;
466 	const __be32 *pkey = daddr;
467 
468 	if (rt->rt_gw_family == AF_INET) {
469 		pkey = (const __be32 *)&rt->rt_gw4;
470 	} else if (rt->rt_gw_family == AF_INET6) {
471 		return __ipv6_confirm_neigh_stub(dev, &rt->rt_gw6);
472 	} else if (!daddr ||
473 		 (rt->rt_flags &
474 		  (RTCF_MULTICAST | RTCF_BROADCAST | RTCF_LOCAL))) {
475 		return;
476 	}
477 	__ipv4_confirm_neigh(dev, *(__force u32 *)pkey);
478 }
479 
480 #define IP_IDENTS_SZ 2048u
481 
482 static atomic_t *ip_idents __read_mostly;
483 static u32 *ip_tstamps __read_mostly;
484 
485 /* In order to protect privacy, we add a perturbation to identifiers
486  * if one generator is seldom used. This makes hard for an attacker
487  * to infer how many packets were sent between two points in time.
488  */
489 u32 ip_idents_reserve(u32 hash, int segs)
490 {
491 	u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
492 	atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
493 	u32 old = READ_ONCE(*p_tstamp);
494 	u32 now = (u32)jiffies;
495 	u32 new, delta = 0;
496 
497 	if (old != now && cmpxchg(p_tstamp, old, now) == old)
498 		delta = prandom_u32_max(now - old);
499 
500 	/* Do not use atomic_add_return() as it makes UBSAN unhappy */
501 	do {
502 		old = (u32)atomic_read(p_id);
503 		new = old + delta + segs;
504 	} while (atomic_cmpxchg(p_id, old, new) != old);
505 
506 	return new - segs;
507 }
508 EXPORT_SYMBOL(ip_idents_reserve);
509 
510 void __ip_select_ident(struct net *net, struct iphdr *iph, int segs)
511 {
512 	u32 hash, id;
513 
514 	/* Note the following code is not safe, but this is okay. */
515 	if (unlikely(siphash_key_is_zero(&net->ipv4.ip_id_key)))
516 		get_random_bytes(&net->ipv4.ip_id_key,
517 				 sizeof(net->ipv4.ip_id_key));
518 
519 	hash = siphash_3u32((__force u32)iph->daddr,
520 			    (__force u32)iph->saddr,
521 			    iph->protocol,
522 			    &net->ipv4.ip_id_key);
523 	id = ip_idents_reserve(hash, segs);
524 	iph->id = htons(id);
525 }
526 EXPORT_SYMBOL(__ip_select_ident);
527 
528 static void __build_flow_key(const struct net *net, struct flowi4 *fl4,
529 			     const struct sock *sk,
530 			     const struct iphdr *iph,
531 			     int oif, u8 tos,
532 			     u8 prot, u32 mark, int flow_flags)
533 {
534 	if (sk) {
535 		const struct inet_sock *inet = inet_sk(sk);
536 
537 		oif = sk->sk_bound_dev_if;
538 		mark = sk->sk_mark;
539 		tos = RT_CONN_FLAGS(sk);
540 		prot = inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol;
541 	}
542 	flowi4_init_output(fl4, oif, mark, tos,
543 			   RT_SCOPE_UNIVERSE, prot,
544 			   flow_flags,
545 			   iph->daddr, iph->saddr, 0, 0,
546 			   sock_net_uid(net, sk));
547 }
548 
549 static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
550 			       const struct sock *sk)
551 {
552 	const struct net *net = dev_net(skb->dev);
553 	const struct iphdr *iph = ip_hdr(skb);
554 	int oif = skb->dev->ifindex;
555 	u8 tos = RT_TOS(iph->tos);
556 	u8 prot = iph->protocol;
557 	u32 mark = skb->mark;
558 
559 	__build_flow_key(net, fl4, sk, iph, oif, tos, prot, mark, 0);
560 }
561 
562 static void build_sk_flow_key(struct flowi4 *fl4, const struct sock *sk)
563 {
564 	const struct inet_sock *inet = inet_sk(sk);
565 	const struct ip_options_rcu *inet_opt;
566 	__be32 daddr = inet->inet_daddr;
567 
568 	rcu_read_lock();
569 	inet_opt = rcu_dereference(inet->inet_opt);
570 	if (inet_opt && inet_opt->opt.srr)
571 		daddr = inet_opt->opt.faddr;
572 	flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
573 			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
574 			   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
575 			   inet_sk_flowi_flags(sk),
576 			   daddr, inet->inet_saddr, 0, 0, sk->sk_uid);
577 	rcu_read_unlock();
578 }
579 
580 static void ip_rt_build_flow_key(struct flowi4 *fl4, const struct sock *sk,
581 				 const struct sk_buff *skb)
582 {
583 	if (skb)
584 		build_skb_flow_key(fl4, skb, sk);
585 	else
586 		build_sk_flow_key(fl4, sk);
587 }
588 
589 static DEFINE_SPINLOCK(fnhe_lock);
590 
591 static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
592 {
593 	struct rtable *rt;
594 
595 	rt = rcu_dereference(fnhe->fnhe_rth_input);
596 	if (rt) {
597 		RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
598 		dst_dev_put(&rt->dst);
599 		dst_release(&rt->dst);
600 	}
601 	rt = rcu_dereference(fnhe->fnhe_rth_output);
602 	if (rt) {
603 		RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
604 		dst_dev_put(&rt->dst);
605 		dst_release(&rt->dst);
606 	}
607 }
608 
609 static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
610 {
611 	struct fib_nh_exception *fnhe, *oldest;
612 
613 	oldest = rcu_dereference(hash->chain);
614 	for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
615 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
616 		if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
617 			oldest = fnhe;
618 	}
619 	fnhe_flush_routes(oldest);
620 	return oldest;
621 }
622 
623 static inline u32 fnhe_hashfun(__be32 daddr)
624 {
625 	static u32 fnhe_hashrnd __read_mostly;
626 	u32 hval;
627 
628 	net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
629 	hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
630 	return hash_32(hval, FNHE_HASH_SHIFT);
631 }
632 
633 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
634 {
635 	rt->rt_pmtu = fnhe->fnhe_pmtu;
636 	rt->rt_mtu_locked = fnhe->fnhe_mtu_locked;
637 	rt->dst.expires = fnhe->fnhe_expires;
638 
639 	if (fnhe->fnhe_gw) {
640 		rt->rt_flags |= RTCF_REDIRECTED;
641 		rt->rt_gw_family = AF_INET;
642 		rt->rt_gw4 = fnhe->fnhe_gw;
643 	}
644 }
645 
646 static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr,
647 				  __be32 gw, u32 pmtu, bool lock,
648 				  unsigned long expires)
649 {
650 	struct fnhe_hash_bucket *hash;
651 	struct fib_nh_exception *fnhe;
652 	struct rtable *rt;
653 	u32 genid, hval;
654 	unsigned int i;
655 	int depth;
656 
657 	genid = fnhe_genid(dev_net(nhc->nhc_dev));
658 	hval = fnhe_hashfun(daddr);
659 
660 	spin_lock_bh(&fnhe_lock);
661 
662 	hash = rcu_dereference(nhc->nhc_exceptions);
663 	if (!hash) {
664 		hash = kcalloc(FNHE_HASH_SIZE, sizeof(*hash), GFP_ATOMIC);
665 		if (!hash)
666 			goto out_unlock;
667 		rcu_assign_pointer(nhc->nhc_exceptions, hash);
668 	}
669 
670 	hash += hval;
671 
672 	depth = 0;
673 	for (fnhe = rcu_dereference(hash->chain); fnhe;
674 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
675 		if (fnhe->fnhe_daddr == daddr)
676 			break;
677 		depth++;
678 	}
679 
680 	if (fnhe) {
681 		if (fnhe->fnhe_genid != genid)
682 			fnhe->fnhe_genid = genid;
683 		if (gw)
684 			fnhe->fnhe_gw = gw;
685 		if (pmtu) {
686 			fnhe->fnhe_pmtu = pmtu;
687 			fnhe->fnhe_mtu_locked = lock;
688 		}
689 		fnhe->fnhe_expires = max(1UL, expires);
690 		/* Update all cached dsts too */
691 		rt = rcu_dereference(fnhe->fnhe_rth_input);
692 		if (rt)
693 			fill_route_from_fnhe(rt, fnhe);
694 		rt = rcu_dereference(fnhe->fnhe_rth_output);
695 		if (rt)
696 			fill_route_from_fnhe(rt, fnhe);
697 	} else {
698 		if (depth > FNHE_RECLAIM_DEPTH)
699 			fnhe = fnhe_oldest(hash);
700 		else {
701 			fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
702 			if (!fnhe)
703 				goto out_unlock;
704 
705 			fnhe->fnhe_next = hash->chain;
706 			rcu_assign_pointer(hash->chain, fnhe);
707 		}
708 		fnhe->fnhe_genid = genid;
709 		fnhe->fnhe_daddr = daddr;
710 		fnhe->fnhe_gw = gw;
711 		fnhe->fnhe_pmtu = pmtu;
712 		fnhe->fnhe_mtu_locked = lock;
713 		fnhe->fnhe_expires = max(1UL, expires);
714 
715 		/* Exception created; mark the cached routes for the nexthop
716 		 * stale, so anyone caching it rechecks if this exception
717 		 * applies to them.
718 		 */
719 		rt = rcu_dereference(nhc->nhc_rth_input);
720 		if (rt)
721 			rt->dst.obsolete = DST_OBSOLETE_KILL;
722 
723 		for_each_possible_cpu(i) {
724 			struct rtable __rcu **prt;
725 			prt = per_cpu_ptr(nhc->nhc_pcpu_rth_output, i);
726 			rt = rcu_dereference(*prt);
727 			if (rt)
728 				rt->dst.obsolete = DST_OBSOLETE_KILL;
729 		}
730 	}
731 
732 	fnhe->fnhe_stamp = jiffies;
733 
734 out_unlock:
735 	spin_unlock_bh(&fnhe_lock);
736 }
737 
738 static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flowi4 *fl4,
739 			     bool kill_route)
740 {
741 	__be32 new_gw = icmp_hdr(skb)->un.gateway;
742 	__be32 old_gw = ip_hdr(skb)->saddr;
743 	struct net_device *dev = skb->dev;
744 	struct in_device *in_dev;
745 	struct fib_result res;
746 	struct neighbour *n;
747 	struct net *net;
748 
749 	switch (icmp_hdr(skb)->code & 7) {
750 	case ICMP_REDIR_NET:
751 	case ICMP_REDIR_NETTOS:
752 	case ICMP_REDIR_HOST:
753 	case ICMP_REDIR_HOSTTOS:
754 		break;
755 
756 	default:
757 		return;
758 	}
759 
760 	if (rt->rt_gw_family != AF_INET || rt->rt_gw4 != old_gw)
761 		return;
762 
763 	in_dev = __in_dev_get_rcu(dev);
764 	if (!in_dev)
765 		return;
766 
767 	net = dev_net(dev);
768 	if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
769 	    ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
770 	    ipv4_is_zeronet(new_gw))
771 		goto reject_redirect;
772 
773 	if (!IN_DEV_SHARED_MEDIA(in_dev)) {
774 		if (!inet_addr_onlink(in_dev, new_gw, old_gw))
775 			goto reject_redirect;
776 		if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
777 			goto reject_redirect;
778 	} else {
779 		if (inet_addr_type(net, new_gw) != RTN_UNICAST)
780 			goto reject_redirect;
781 	}
782 
783 	n = __ipv4_neigh_lookup(rt->dst.dev, new_gw);
784 	if (!n)
785 		n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev);
786 	if (!IS_ERR(n)) {
787 		if (!(n->nud_state & NUD_VALID)) {
788 			neigh_event_send(n, NULL);
789 		} else {
790 			if (fib_lookup(net, fl4, &res, 0) == 0) {
791 				struct fib_nh_common *nhc = FIB_RES_NHC(res);
792 
793 				update_or_create_fnhe(nhc, fl4->daddr, new_gw,
794 						0, false,
795 						jiffies + ip_rt_gc_timeout);
796 			}
797 			if (kill_route)
798 				rt->dst.obsolete = DST_OBSOLETE_KILL;
799 			call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
800 		}
801 		neigh_release(n);
802 	}
803 	return;
804 
805 reject_redirect:
806 #ifdef CONFIG_IP_ROUTE_VERBOSE
807 	if (IN_DEV_LOG_MARTIANS(in_dev)) {
808 		const struct iphdr *iph = (const struct iphdr *) skb->data;
809 		__be32 daddr = iph->daddr;
810 		__be32 saddr = iph->saddr;
811 
812 		net_info_ratelimited("Redirect from %pI4 on %s about %pI4 ignored\n"
813 				     "  Advised path = %pI4 -> %pI4\n",
814 				     &old_gw, dev->name, &new_gw,
815 				     &saddr, &daddr);
816 	}
817 #endif
818 	;
819 }
820 
821 static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
822 {
823 	struct rtable *rt;
824 	struct flowi4 fl4;
825 	const struct iphdr *iph = (const struct iphdr *) skb->data;
826 	struct net *net = dev_net(skb->dev);
827 	int oif = skb->dev->ifindex;
828 	u8 tos = RT_TOS(iph->tos);
829 	u8 prot = iph->protocol;
830 	u32 mark = skb->mark;
831 
832 	rt = (struct rtable *) dst;
833 
834 	__build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0);
835 	__ip_do_redirect(rt, skb, &fl4, true);
836 }
837 
838 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
839 {
840 	struct rtable *rt = (struct rtable *)dst;
841 	struct dst_entry *ret = dst;
842 
843 	if (rt) {
844 		if (dst->obsolete > 0) {
845 			ip_rt_put(rt);
846 			ret = NULL;
847 		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
848 			   rt->dst.expires) {
849 			ip_rt_put(rt);
850 			ret = NULL;
851 		}
852 	}
853 	return ret;
854 }
855 
856 /*
857  * Algorithm:
858  *	1. The first ip_rt_redirect_number redirects are sent
859  *	   with exponential backoff, then we stop sending them at all,
860  *	   assuming that the host ignores our redirects.
861  *	2. If we did not see packets requiring redirects
862  *	   during ip_rt_redirect_silence, we assume that the host
863  *	   forgot redirected route and start to send redirects again.
864  *
865  * This algorithm is much cheaper and more intelligent than dumb load limiting
866  * in icmp.c.
867  *
868  * NOTE. Do not forget to inhibit load limiting for redirects (redundant)
869  * and "frag. need" (breaks PMTU discovery) in icmp.c.
870  */
871 
872 void ip_rt_send_redirect(struct sk_buff *skb)
873 {
874 	struct rtable *rt = skb_rtable(skb);
875 	struct in_device *in_dev;
876 	struct inet_peer *peer;
877 	struct net *net;
878 	int log_martians;
879 	int vif;
880 
881 	rcu_read_lock();
882 	in_dev = __in_dev_get_rcu(rt->dst.dev);
883 	if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
884 		rcu_read_unlock();
885 		return;
886 	}
887 	log_martians = IN_DEV_LOG_MARTIANS(in_dev);
888 	vif = l3mdev_master_ifindex_rcu(rt->dst.dev);
889 	rcu_read_unlock();
890 
891 	net = dev_net(rt->dst.dev);
892 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif, 1);
893 	if (!peer) {
894 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
895 			  rt_nexthop(rt, ip_hdr(skb)->daddr));
896 		return;
897 	}
898 
899 	/* No redirected packets during ip_rt_redirect_silence;
900 	 * reset the algorithm.
901 	 */
902 	if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
903 		peer->rate_tokens = 0;
904 		peer->n_redirects = 0;
905 	}
906 
907 	/* Too many ignored redirects; do not send anything
908 	 * set dst.rate_last to the last seen redirected packet.
909 	 */
910 	if (peer->n_redirects >= ip_rt_redirect_number) {
911 		peer->rate_last = jiffies;
912 		goto out_put_peer;
913 	}
914 
915 	/* Check for load limit; set rate_last to the latest sent
916 	 * redirect.
917 	 */
918 	if (peer->rate_tokens == 0 ||
919 	    time_after(jiffies,
920 		       (peer->rate_last +
921 			(ip_rt_redirect_load << peer->rate_tokens)))) {
922 		__be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
923 
924 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
925 		peer->rate_last = jiffies;
926 		++peer->rate_tokens;
927 		++peer->n_redirects;
928 #ifdef CONFIG_IP_ROUTE_VERBOSE
929 		if (log_martians &&
930 		    peer->rate_tokens == ip_rt_redirect_number)
931 			net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
932 					     &ip_hdr(skb)->saddr, inet_iif(skb),
933 					     &ip_hdr(skb)->daddr, &gw);
934 #endif
935 	}
936 out_put_peer:
937 	inet_putpeer(peer);
938 }
939 
940 static int ip_error(struct sk_buff *skb)
941 {
942 	struct rtable *rt = skb_rtable(skb);
943 	struct net_device *dev = skb->dev;
944 	struct in_device *in_dev;
945 	struct inet_peer *peer;
946 	unsigned long now;
947 	struct net *net;
948 	bool send;
949 	int code;
950 
951 	if (netif_is_l3_master(skb->dev)) {
952 		dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
953 		if (!dev)
954 			goto out;
955 	}
956 
957 	in_dev = __in_dev_get_rcu(dev);
958 
959 	/* IP on this device is disabled. */
960 	if (!in_dev)
961 		goto out;
962 
963 	net = dev_net(rt->dst.dev);
964 	if (!IN_DEV_FORWARD(in_dev)) {
965 		switch (rt->dst.error) {
966 		case EHOSTUNREACH:
967 			__IP_INC_STATS(net, IPSTATS_MIB_INADDRERRORS);
968 			break;
969 
970 		case ENETUNREACH:
971 			__IP_INC_STATS(net, IPSTATS_MIB_INNOROUTES);
972 			break;
973 		}
974 		goto out;
975 	}
976 
977 	switch (rt->dst.error) {
978 	case EINVAL:
979 	default:
980 		goto out;
981 	case EHOSTUNREACH:
982 		code = ICMP_HOST_UNREACH;
983 		break;
984 	case ENETUNREACH:
985 		code = ICMP_NET_UNREACH;
986 		__IP_INC_STATS(net, IPSTATS_MIB_INNOROUTES);
987 		break;
988 	case EACCES:
989 		code = ICMP_PKT_FILTERED;
990 		break;
991 	}
992 
993 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr,
994 			       l3mdev_master_ifindex(skb->dev), 1);
995 
996 	send = true;
997 	if (peer) {
998 		now = jiffies;
999 		peer->rate_tokens += now - peer->rate_last;
1000 		if (peer->rate_tokens > ip_rt_error_burst)
1001 			peer->rate_tokens = ip_rt_error_burst;
1002 		peer->rate_last = now;
1003 		if (peer->rate_tokens >= ip_rt_error_cost)
1004 			peer->rate_tokens -= ip_rt_error_cost;
1005 		else
1006 			send = false;
1007 		inet_putpeer(peer);
1008 	}
1009 	if (send)
1010 		icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
1011 
1012 out:	kfree_skb(skb);
1013 	return 0;
1014 }
1015 
1016 static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
1017 {
1018 	struct dst_entry *dst = &rt->dst;
1019 	u32 old_mtu = ipv4_mtu(dst);
1020 	struct fib_result res;
1021 	bool lock = false;
1022 
1023 	if (ip_mtu_locked(dst))
1024 		return;
1025 
1026 	if (old_mtu < mtu)
1027 		return;
1028 
1029 	if (mtu < ip_rt_min_pmtu) {
1030 		lock = true;
1031 		mtu = min(old_mtu, ip_rt_min_pmtu);
1032 	}
1033 
1034 	if (rt->rt_pmtu == mtu && !lock &&
1035 	    time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
1036 		return;
1037 
1038 	rcu_read_lock();
1039 	if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
1040 		struct fib_nh_common *nhc = FIB_RES_NHC(res);
1041 
1042 		update_or_create_fnhe(nhc, fl4->daddr, 0, mtu, lock,
1043 				      jiffies + ip_rt_mtu_expires);
1044 	}
1045 	rcu_read_unlock();
1046 }
1047 
1048 static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
1049 			      struct sk_buff *skb, u32 mtu)
1050 {
1051 	struct rtable *rt = (struct rtable *) dst;
1052 	struct flowi4 fl4;
1053 
1054 	ip_rt_build_flow_key(&fl4, sk, skb);
1055 	__ip_rt_update_pmtu(rt, &fl4, mtu);
1056 }
1057 
1058 void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
1059 		      int oif, u8 protocol)
1060 {
1061 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1062 	struct flowi4 fl4;
1063 	struct rtable *rt;
1064 	u32 mark = IP4_REPLY_MARK(net, skb->mark);
1065 
1066 	__build_flow_key(net, &fl4, NULL, iph, oif,
1067 			 RT_TOS(iph->tos), protocol, mark, 0);
1068 	rt = __ip_route_output_key(net, &fl4);
1069 	if (!IS_ERR(rt)) {
1070 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1071 		ip_rt_put(rt);
1072 	}
1073 }
1074 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
1075 
1076 static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1077 {
1078 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1079 	struct flowi4 fl4;
1080 	struct rtable *rt;
1081 
1082 	__build_flow_key(sock_net(sk), &fl4, sk, iph, 0, 0, 0, 0, 0);
1083 
1084 	if (!fl4.flowi4_mark)
1085 		fl4.flowi4_mark = IP4_REPLY_MARK(sock_net(sk), skb->mark);
1086 
1087 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1088 	if (!IS_ERR(rt)) {
1089 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1090 		ip_rt_put(rt);
1091 	}
1092 }
1093 
1094 void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1095 {
1096 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1097 	struct flowi4 fl4;
1098 	struct rtable *rt;
1099 	struct dst_entry *odst = NULL;
1100 	bool new = false;
1101 	struct net *net = sock_net(sk);
1102 
1103 	bh_lock_sock(sk);
1104 
1105 	if (!ip_sk_accept_pmtu(sk))
1106 		goto out;
1107 
1108 	odst = sk_dst_get(sk);
1109 
1110 	if (sock_owned_by_user(sk) || !odst) {
1111 		__ipv4_sk_update_pmtu(skb, sk, mtu);
1112 		goto out;
1113 	}
1114 
1115 	__build_flow_key(net, &fl4, sk, iph, 0, 0, 0, 0, 0);
1116 
1117 	rt = (struct rtable *)odst;
1118 	if (odst->obsolete && !odst->ops->check(odst, 0)) {
1119 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1120 		if (IS_ERR(rt))
1121 			goto out;
1122 
1123 		new = true;
1124 	}
1125 
1126 	__ip_rt_update_pmtu((struct rtable *) xfrm_dst_path(&rt->dst), &fl4, mtu);
1127 
1128 	if (!dst_check(&rt->dst, 0)) {
1129 		if (new)
1130 			dst_release(&rt->dst);
1131 
1132 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1133 		if (IS_ERR(rt))
1134 			goto out;
1135 
1136 		new = true;
1137 	}
1138 
1139 	if (new)
1140 		sk_dst_set(sk, &rt->dst);
1141 
1142 out:
1143 	bh_unlock_sock(sk);
1144 	dst_release(odst);
1145 }
1146 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
1147 
1148 void ipv4_redirect(struct sk_buff *skb, struct net *net,
1149 		   int oif, u8 protocol)
1150 {
1151 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1152 	struct flowi4 fl4;
1153 	struct rtable *rt;
1154 
1155 	__build_flow_key(net, &fl4, NULL, iph, oif,
1156 			 RT_TOS(iph->tos), protocol, 0, 0);
1157 	rt = __ip_route_output_key(net, &fl4);
1158 	if (!IS_ERR(rt)) {
1159 		__ip_do_redirect(rt, skb, &fl4, false);
1160 		ip_rt_put(rt);
1161 	}
1162 }
1163 EXPORT_SYMBOL_GPL(ipv4_redirect);
1164 
1165 void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk)
1166 {
1167 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1168 	struct flowi4 fl4;
1169 	struct rtable *rt;
1170 	struct net *net = sock_net(sk);
1171 
1172 	__build_flow_key(net, &fl4, sk, iph, 0, 0, 0, 0, 0);
1173 	rt = __ip_route_output_key(net, &fl4);
1174 	if (!IS_ERR(rt)) {
1175 		__ip_do_redirect(rt, skb, &fl4, false);
1176 		ip_rt_put(rt);
1177 	}
1178 }
1179 EXPORT_SYMBOL_GPL(ipv4_sk_redirect);
1180 
1181 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
1182 {
1183 	struct rtable *rt = (struct rtable *) dst;
1184 
1185 	/* All IPV4 dsts are created with ->obsolete set to the value
1186 	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
1187 	 * into this function always.
1188 	 *
1189 	 * When a PMTU/redirect information update invalidates a route,
1190 	 * this is indicated by setting obsolete to DST_OBSOLETE_KILL or
1191 	 * DST_OBSOLETE_DEAD.
1192 	 */
1193 	if (dst->obsolete != DST_OBSOLETE_FORCE_CHK || rt_is_expired(rt))
1194 		return NULL;
1195 	return dst;
1196 }
1197 
1198 static void ipv4_send_dest_unreach(struct sk_buff *skb)
1199 {
1200 	struct ip_options opt;
1201 	int res;
1202 
1203 	/* Recompile ip options since IPCB may not be valid anymore.
1204 	 * Also check we have a reasonable ipv4 header.
1205 	 */
1206 	if (!pskb_network_may_pull(skb, sizeof(struct iphdr)) ||
1207 	    ip_hdr(skb)->version != 4 || ip_hdr(skb)->ihl < 5)
1208 		return;
1209 
1210 	memset(&opt, 0, sizeof(opt));
1211 	if (ip_hdr(skb)->ihl > 5) {
1212 		if (!pskb_network_may_pull(skb, ip_hdr(skb)->ihl * 4))
1213 			return;
1214 		opt.optlen = ip_hdr(skb)->ihl * 4 - sizeof(struct iphdr);
1215 
1216 		rcu_read_lock();
1217 		res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
1218 		rcu_read_unlock();
1219 
1220 		if (res)
1221 			return;
1222 	}
1223 	__icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
1224 }
1225 
1226 static void ipv4_link_failure(struct sk_buff *skb)
1227 {
1228 	struct rtable *rt;
1229 
1230 	ipv4_send_dest_unreach(skb);
1231 
1232 	rt = skb_rtable(skb);
1233 	if (rt)
1234 		dst_set_expires(&rt->dst, 0);
1235 }
1236 
1237 static int ip_rt_bug(struct net *net, struct sock *sk, struct sk_buff *skb)
1238 {
1239 	pr_debug("%s: %pI4 -> %pI4, %s\n",
1240 		 __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
1241 		 skb->dev ? skb->dev->name : "?");
1242 	kfree_skb(skb);
1243 	WARN_ON(1);
1244 	return 0;
1245 }
1246 
1247 /*
1248    We do not cache source address of outgoing interface,
1249    because it is used only by IP RR, TS and SRR options,
1250    so that it out of fast path.
1251 
1252    BTW remember: "addr" is allowed to be not aligned
1253    in IP options!
1254  */
1255 
1256 void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
1257 {
1258 	__be32 src;
1259 
1260 	if (rt_is_output_route(rt))
1261 		src = ip_hdr(skb)->saddr;
1262 	else {
1263 		struct fib_result res;
1264 		struct iphdr *iph = ip_hdr(skb);
1265 		struct flowi4 fl4 = {
1266 			.daddr = iph->daddr,
1267 			.saddr = iph->saddr,
1268 			.flowi4_tos = RT_TOS(iph->tos),
1269 			.flowi4_oif = rt->dst.dev->ifindex,
1270 			.flowi4_iif = skb->dev->ifindex,
1271 			.flowi4_mark = skb->mark,
1272 		};
1273 
1274 		rcu_read_lock();
1275 		if (fib_lookup(dev_net(rt->dst.dev), &fl4, &res, 0) == 0)
1276 			src = fib_result_prefsrc(dev_net(rt->dst.dev), &res);
1277 		else
1278 			src = inet_select_addr(rt->dst.dev,
1279 					       rt_nexthop(rt, iph->daddr),
1280 					       RT_SCOPE_UNIVERSE);
1281 		rcu_read_unlock();
1282 	}
1283 	memcpy(addr, &src, 4);
1284 }
1285 
1286 #ifdef CONFIG_IP_ROUTE_CLASSID
1287 static void set_class_tag(struct rtable *rt, u32 tag)
1288 {
1289 	if (!(rt->dst.tclassid & 0xFFFF))
1290 		rt->dst.tclassid |= tag & 0xFFFF;
1291 	if (!(rt->dst.tclassid & 0xFFFF0000))
1292 		rt->dst.tclassid |= tag & 0xFFFF0000;
1293 }
1294 #endif
1295 
1296 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
1297 {
1298 	unsigned int header_size = sizeof(struct tcphdr) + sizeof(struct iphdr);
1299 	unsigned int advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
1300 				    ip_rt_min_advmss);
1301 
1302 	return min(advmss, IPV4_MAX_PMTU - header_size);
1303 }
1304 
1305 static unsigned int ipv4_mtu(const struct dst_entry *dst)
1306 {
1307 	const struct rtable *rt = (const struct rtable *) dst;
1308 	unsigned int mtu = rt->rt_pmtu;
1309 
1310 	if (!mtu || time_after_eq(jiffies, rt->dst.expires))
1311 		mtu = dst_metric_raw(dst, RTAX_MTU);
1312 
1313 	if (mtu)
1314 		return mtu;
1315 
1316 	mtu = READ_ONCE(dst->dev->mtu);
1317 
1318 	if (unlikely(ip_mtu_locked(dst))) {
1319 		if (rt->rt_gw_family && mtu > 576)
1320 			mtu = 576;
1321 	}
1322 
1323 	mtu = min_t(unsigned int, mtu, IP_MAX_MTU);
1324 
1325 	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
1326 }
1327 
1328 static void ip_del_fnhe(struct fib_nh_common *nhc, __be32 daddr)
1329 {
1330 	struct fnhe_hash_bucket *hash;
1331 	struct fib_nh_exception *fnhe, __rcu **fnhe_p;
1332 	u32 hval = fnhe_hashfun(daddr);
1333 
1334 	spin_lock_bh(&fnhe_lock);
1335 
1336 	hash = rcu_dereference_protected(nhc->nhc_exceptions,
1337 					 lockdep_is_held(&fnhe_lock));
1338 	hash += hval;
1339 
1340 	fnhe_p = &hash->chain;
1341 	fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
1342 	while (fnhe) {
1343 		if (fnhe->fnhe_daddr == daddr) {
1344 			rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
1345 				fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
1346 			/* set fnhe_daddr to 0 to ensure it won't bind with
1347 			 * new dsts in rt_bind_exception().
1348 			 */
1349 			fnhe->fnhe_daddr = 0;
1350 			fnhe_flush_routes(fnhe);
1351 			kfree_rcu(fnhe, rcu);
1352 			break;
1353 		}
1354 		fnhe_p = &fnhe->fnhe_next;
1355 		fnhe = rcu_dereference_protected(fnhe->fnhe_next,
1356 						 lockdep_is_held(&fnhe_lock));
1357 	}
1358 
1359 	spin_unlock_bh(&fnhe_lock);
1360 }
1361 
1362 static struct fib_nh_exception *find_exception(struct fib_nh_common *nhc,
1363 					       __be32 daddr)
1364 {
1365 	struct fnhe_hash_bucket *hash = rcu_dereference(nhc->nhc_exceptions);
1366 	struct fib_nh_exception *fnhe;
1367 	u32 hval;
1368 
1369 	if (!hash)
1370 		return NULL;
1371 
1372 	hval = fnhe_hashfun(daddr);
1373 
1374 	for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
1375 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
1376 		if (fnhe->fnhe_daddr == daddr) {
1377 			if (fnhe->fnhe_expires &&
1378 			    time_after(jiffies, fnhe->fnhe_expires)) {
1379 				ip_del_fnhe(nhc, daddr);
1380 				break;
1381 			}
1382 			return fnhe;
1383 		}
1384 	}
1385 	return NULL;
1386 }
1387 
1388 /* MTU selection:
1389  * 1. mtu on route is locked - use it
1390  * 2. mtu from nexthop exception
1391  * 3. mtu from egress device
1392  */
1393 
1394 u32 ip_mtu_from_fib_result(struct fib_result *res, __be32 daddr)
1395 {
1396 	struct fib_nh_common *nhc = res->nhc;
1397 	struct net_device *dev = nhc->nhc_dev;
1398 	struct fib_info *fi = res->fi;
1399 	u32 mtu = 0;
1400 
1401 	if (dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu ||
1402 	    fi->fib_metrics->metrics[RTAX_LOCK - 1] & (1 << RTAX_MTU))
1403 		mtu = fi->fib_mtu;
1404 
1405 	if (likely(!mtu)) {
1406 		struct fib_nh_exception *fnhe;
1407 
1408 		fnhe = find_exception(nhc, daddr);
1409 		if (fnhe && !time_after_eq(jiffies, fnhe->fnhe_expires))
1410 			mtu = fnhe->fnhe_pmtu;
1411 	}
1412 
1413 	if (likely(!mtu))
1414 		mtu = min(READ_ONCE(dev->mtu), IP_MAX_MTU);
1415 
1416 	return mtu - lwtunnel_headroom(nhc->nhc_lwtstate, mtu);
1417 }
1418 
1419 static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
1420 			      __be32 daddr, const bool do_cache)
1421 {
1422 	bool ret = false;
1423 
1424 	spin_lock_bh(&fnhe_lock);
1425 
1426 	if (daddr == fnhe->fnhe_daddr) {
1427 		struct rtable __rcu **porig;
1428 		struct rtable *orig;
1429 		int genid = fnhe_genid(dev_net(rt->dst.dev));
1430 
1431 		if (rt_is_input_route(rt))
1432 			porig = &fnhe->fnhe_rth_input;
1433 		else
1434 			porig = &fnhe->fnhe_rth_output;
1435 		orig = rcu_dereference(*porig);
1436 
1437 		if (fnhe->fnhe_genid != genid) {
1438 			fnhe->fnhe_genid = genid;
1439 			fnhe->fnhe_gw = 0;
1440 			fnhe->fnhe_pmtu = 0;
1441 			fnhe->fnhe_expires = 0;
1442 			fnhe->fnhe_mtu_locked = false;
1443 			fnhe_flush_routes(fnhe);
1444 			orig = NULL;
1445 		}
1446 		fill_route_from_fnhe(rt, fnhe);
1447 		if (!rt->rt_gw4) {
1448 			rt->rt_gw4 = daddr;
1449 			rt->rt_gw_family = AF_INET;
1450 		}
1451 
1452 		if (do_cache) {
1453 			dst_hold(&rt->dst);
1454 			rcu_assign_pointer(*porig, rt);
1455 			if (orig) {
1456 				dst_dev_put(&orig->dst);
1457 				dst_release(&orig->dst);
1458 			}
1459 			ret = true;
1460 		}
1461 
1462 		fnhe->fnhe_stamp = jiffies;
1463 	}
1464 	spin_unlock_bh(&fnhe_lock);
1465 
1466 	return ret;
1467 }
1468 
1469 static bool rt_cache_route(struct fib_nh_common *nhc, struct rtable *rt)
1470 {
1471 	struct rtable *orig, *prev, **p;
1472 	bool ret = true;
1473 
1474 	if (rt_is_input_route(rt)) {
1475 		p = (struct rtable **)&nhc->nhc_rth_input;
1476 	} else {
1477 		p = (struct rtable **)raw_cpu_ptr(nhc->nhc_pcpu_rth_output);
1478 	}
1479 	orig = *p;
1480 
1481 	/* hold dst before doing cmpxchg() to avoid race condition
1482 	 * on this dst
1483 	 */
1484 	dst_hold(&rt->dst);
1485 	prev = cmpxchg(p, orig, rt);
1486 	if (prev == orig) {
1487 		if (orig) {
1488 			dst_dev_put(&orig->dst);
1489 			dst_release(&orig->dst);
1490 		}
1491 	} else {
1492 		dst_release(&rt->dst);
1493 		ret = false;
1494 	}
1495 
1496 	return ret;
1497 }
1498 
1499 struct uncached_list {
1500 	spinlock_t		lock;
1501 	struct list_head	head;
1502 };
1503 
1504 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt_uncached_list);
1505 
1506 void rt_add_uncached_list(struct rtable *rt)
1507 {
1508 	struct uncached_list *ul = raw_cpu_ptr(&rt_uncached_list);
1509 
1510 	rt->rt_uncached_list = ul;
1511 
1512 	spin_lock_bh(&ul->lock);
1513 	list_add_tail(&rt->rt_uncached, &ul->head);
1514 	spin_unlock_bh(&ul->lock);
1515 }
1516 
1517 void rt_del_uncached_list(struct rtable *rt)
1518 {
1519 	if (!list_empty(&rt->rt_uncached)) {
1520 		struct uncached_list *ul = rt->rt_uncached_list;
1521 
1522 		spin_lock_bh(&ul->lock);
1523 		list_del(&rt->rt_uncached);
1524 		spin_unlock_bh(&ul->lock);
1525 	}
1526 }
1527 
1528 static void ipv4_dst_destroy(struct dst_entry *dst)
1529 {
1530 	struct rtable *rt = (struct rtable *)dst;
1531 
1532 	ip_dst_metrics_put(dst);
1533 	rt_del_uncached_list(rt);
1534 }
1535 
1536 void rt_flush_dev(struct net_device *dev)
1537 {
1538 	struct net *net = dev_net(dev);
1539 	struct rtable *rt;
1540 	int cpu;
1541 
1542 	for_each_possible_cpu(cpu) {
1543 		struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
1544 
1545 		spin_lock_bh(&ul->lock);
1546 		list_for_each_entry(rt, &ul->head, rt_uncached) {
1547 			if (rt->dst.dev != dev)
1548 				continue;
1549 			rt->dst.dev = net->loopback_dev;
1550 			dev_hold(rt->dst.dev);
1551 			dev_put(dev);
1552 		}
1553 		spin_unlock_bh(&ul->lock);
1554 	}
1555 }
1556 
1557 static bool rt_cache_valid(const struct rtable *rt)
1558 {
1559 	return	rt &&
1560 		rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1561 		!rt_is_expired(rt);
1562 }
1563 
1564 static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
1565 			   const struct fib_result *res,
1566 			   struct fib_nh_exception *fnhe,
1567 			   struct fib_info *fi, u16 type, u32 itag,
1568 			   const bool do_cache)
1569 {
1570 	bool cached = false;
1571 
1572 	if (fi) {
1573 		struct fib_nh_common *nhc = FIB_RES_NHC(*res);
1574 
1575 		if (nhc->nhc_gw_family && nhc->nhc_scope == RT_SCOPE_LINK) {
1576 			rt->rt_gw_family = nhc->nhc_gw_family;
1577 			/* only INET and INET6 are supported */
1578 			if (likely(nhc->nhc_gw_family == AF_INET))
1579 				rt->rt_gw4 = nhc->nhc_gw.ipv4;
1580 			else
1581 				rt->rt_gw6 = nhc->nhc_gw.ipv6;
1582 		}
1583 
1584 		ip_dst_init_metrics(&rt->dst, fi->fib_metrics);
1585 
1586 #ifdef CONFIG_IP_ROUTE_CLASSID
1587 		{
1588 			struct fib_nh *nh;
1589 
1590 			nh = container_of(nhc, struct fib_nh, nh_common);
1591 			rt->dst.tclassid = nh->nh_tclassid;
1592 		}
1593 #endif
1594 		rt->dst.lwtstate = lwtstate_get(nhc->nhc_lwtstate);
1595 		if (unlikely(fnhe))
1596 			cached = rt_bind_exception(rt, fnhe, daddr, do_cache);
1597 		else if (do_cache)
1598 			cached = rt_cache_route(nhc, rt);
1599 		if (unlikely(!cached)) {
1600 			/* Routes we intend to cache in nexthop exception or
1601 			 * FIB nexthop have the DST_NOCACHE bit clear.
1602 			 * However, if we are unsuccessful at storing this
1603 			 * route into the cache we really need to set it.
1604 			 */
1605 			if (!rt->rt_gw4) {
1606 				rt->rt_gw_family = AF_INET;
1607 				rt->rt_gw4 = daddr;
1608 			}
1609 			rt_add_uncached_list(rt);
1610 		}
1611 	} else
1612 		rt_add_uncached_list(rt);
1613 
1614 #ifdef CONFIG_IP_ROUTE_CLASSID
1615 #ifdef CONFIG_IP_MULTIPLE_TABLES
1616 	set_class_tag(rt, res->tclassid);
1617 #endif
1618 	set_class_tag(rt, itag);
1619 #endif
1620 }
1621 
1622 struct rtable *rt_dst_alloc(struct net_device *dev,
1623 			    unsigned int flags, u16 type,
1624 			    bool nopolicy, bool noxfrm, bool will_cache)
1625 {
1626 	struct rtable *rt;
1627 
1628 	rt = dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
1629 		       (will_cache ? 0 : DST_HOST) |
1630 		       (nopolicy ? DST_NOPOLICY : 0) |
1631 		       (noxfrm ? DST_NOXFRM : 0));
1632 
1633 	if (rt) {
1634 		rt->rt_genid = rt_genid_ipv4(dev_net(dev));
1635 		rt->rt_flags = flags;
1636 		rt->rt_type = type;
1637 		rt->rt_is_input = 0;
1638 		rt->rt_iif = 0;
1639 		rt->rt_pmtu = 0;
1640 		rt->rt_mtu_locked = 0;
1641 		rt->rt_gw_family = 0;
1642 		rt->rt_gw4 = 0;
1643 		INIT_LIST_HEAD(&rt->rt_uncached);
1644 
1645 		rt->dst.output = ip_output;
1646 		if (flags & RTCF_LOCAL)
1647 			rt->dst.input = ip_local_deliver;
1648 	}
1649 
1650 	return rt;
1651 }
1652 EXPORT_SYMBOL(rt_dst_alloc);
1653 
1654 /* called in rcu_read_lock() section */
1655 int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1656 			  u8 tos, struct net_device *dev,
1657 			  struct in_device *in_dev, u32 *itag)
1658 {
1659 	int err;
1660 
1661 	/* Primary sanity checks. */
1662 	if (!in_dev)
1663 		return -EINVAL;
1664 
1665 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1666 	    skb->protocol != htons(ETH_P_IP))
1667 		return -EINVAL;
1668 
1669 	if (ipv4_is_loopback(saddr) && !IN_DEV_ROUTE_LOCALNET(in_dev))
1670 		return -EINVAL;
1671 
1672 	if (ipv4_is_zeronet(saddr)) {
1673 		if (!ipv4_is_local_multicast(daddr) &&
1674 		    ip_hdr(skb)->protocol != IPPROTO_IGMP)
1675 			return -EINVAL;
1676 	} else {
1677 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1678 					  in_dev, itag);
1679 		if (err < 0)
1680 			return err;
1681 	}
1682 	return 0;
1683 }
1684 
1685 /* called in rcu_read_lock() section */
1686 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1687 			     u8 tos, struct net_device *dev, int our)
1688 {
1689 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1690 	unsigned int flags = RTCF_MULTICAST;
1691 	struct rtable *rth;
1692 	u32 itag = 0;
1693 	int err;
1694 
1695 	err = ip_mc_validate_source(skb, daddr, saddr, tos, dev, in_dev, &itag);
1696 	if (err)
1697 		return err;
1698 
1699 	if (our)
1700 		flags |= RTCF_LOCAL;
1701 
1702 	rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST,
1703 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
1704 	if (!rth)
1705 		return -ENOBUFS;
1706 
1707 #ifdef CONFIG_IP_ROUTE_CLASSID
1708 	rth->dst.tclassid = itag;
1709 #endif
1710 	rth->dst.output = ip_rt_bug;
1711 	rth->rt_is_input= 1;
1712 
1713 #ifdef CONFIG_IP_MROUTE
1714 	if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
1715 		rth->dst.input = ip_mr_input;
1716 #endif
1717 	RT_CACHE_STAT_INC(in_slow_mc);
1718 
1719 	skb_dst_set(skb, &rth->dst);
1720 	return 0;
1721 }
1722 
1723 
1724 static void ip_handle_martian_source(struct net_device *dev,
1725 				     struct in_device *in_dev,
1726 				     struct sk_buff *skb,
1727 				     __be32 daddr,
1728 				     __be32 saddr)
1729 {
1730 	RT_CACHE_STAT_INC(in_martian_src);
1731 #ifdef CONFIG_IP_ROUTE_VERBOSE
1732 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
1733 		/*
1734 		 *	RFC1812 recommendation, if source is martian,
1735 		 *	the only hint is MAC header.
1736 		 */
1737 		pr_warn("martian source %pI4 from %pI4, on dev %s\n",
1738 			&daddr, &saddr, dev->name);
1739 		if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
1740 			print_hex_dump(KERN_WARNING, "ll header: ",
1741 				       DUMP_PREFIX_OFFSET, 16, 1,
1742 				       skb_mac_header(skb),
1743 				       dev->hard_header_len, false);
1744 		}
1745 	}
1746 #endif
1747 }
1748 
1749 /* called in rcu_read_lock() section */
1750 static int __mkroute_input(struct sk_buff *skb,
1751 			   const struct fib_result *res,
1752 			   struct in_device *in_dev,
1753 			   __be32 daddr, __be32 saddr, u32 tos)
1754 {
1755 	struct fib_nh_common *nhc = FIB_RES_NHC(*res);
1756 	struct net_device *dev = nhc->nhc_dev;
1757 	struct fib_nh_exception *fnhe;
1758 	struct rtable *rth;
1759 	int err;
1760 	struct in_device *out_dev;
1761 	bool do_cache;
1762 	u32 itag = 0;
1763 
1764 	/* get a working reference to the output device */
1765 	out_dev = __in_dev_get_rcu(dev);
1766 	if (!out_dev) {
1767 		net_crit_ratelimited("Bug in ip_route_input_slow(). Please report.\n");
1768 		return -EINVAL;
1769 	}
1770 
1771 	err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
1772 				  in_dev->dev, in_dev, &itag);
1773 	if (err < 0) {
1774 		ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
1775 					 saddr);
1776 
1777 		goto cleanup;
1778 	}
1779 
1780 	do_cache = res->fi && !itag;
1781 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
1782 	    skb->protocol == htons(ETH_P_IP)) {
1783 		__be32 gw;
1784 
1785 		gw = nhc->nhc_gw_family == AF_INET ? nhc->nhc_gw.ipv4 : 0;
1786 		if (IN_DEV_SHARED_MEDIA(out_dev) ||
1787 		    inet_addr_onlink(out_dev, saddr, gw))
1788 			IPCB(skb)->flags |= IPSKB_DOREDIRECT;
1789 	}
1790 
1791 	if (skb->protocol != htons(ETH_P_IP)) {
1792 		/* Not IP (i.e. ARP). Do not create route, if it is
1793 		 * invalid for proxy arp. DNAT routes are always valid.
1794 		 *
1795 		 * Proxy arp feature have been extended to allow, ARP
1796 		 * replies back to the same interface, to support
1797 		 * Private VLAN switch technologies. See arp.c.
1798 		 */
1799 		if (out_dev == in_dev &&
1800 		    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
1801 			err = -EINVAL;
1802 			goto cleanup;
1803 		}
1804 	}
1805 
1806 	fnhe = find_exception(nhc, daddr);
1807 	if (do_cache) {
1808 		if (fnhe)
1809 			rth = rcu_dereference(fnhe->fnhe_rth_input);
1810 		else
1811 			rth = rcu_dereference(nhc->nhc_rth_input);
1812 		if (rt_cache_valid(rth)) {
1813 			skb_dst_set_noref(skb, &rth->dst);
1814 			goto out;
1815 		}
1816 	}
1817 
1818 	rth = rt_dst_alloc(out_dev->dev, 0, res->type,
1819 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1820 			   IN_DEV_CONF_GET(out_dev, NOXFRM), do_cache);
1821 	if (!rth) {
1822 		err = -ENOBUFS;
1823 		goto cleanup;
1824 	}
1825 
1826 	rth->rt_is_input = 1;
1827 	RT_CACHE_STAT_INC(in_slow_tot);
1828 
1829 	rth->dst.input = ip_forward;
1830 
1831 	rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag,
1832 		       do_cache);
1833 	lwtunnel_set_redirect(&rth->dst);
1834 	skb_dst_set(skb, &rth->dst);
1835 out:
1836 	err = 0;
1837  cleanup:
1838 	return err;
1839 }
1840 
1841 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1842 /* To make ICMP packets follow the right flow, the multipath hash is
1843  * calculated from the inner IP addresses.
1844  */
1845 static void ip_multipath_l3_keys(const struct sk_buff *skb,
1846 				 struct flow_keys *hash_keys)
1847 {
1848 	const struct iphdr *outer_iph = ip_hdr(skb);
1849 	const struct iphdr *key_iph = outer_iph;
1850 	const struct iphdr *inner_iph;
1851 	const struct icmphdr *icmph;
1852 	struct iphdr _inner_iph;
1853 	struct icmphdr _icmph;
1854 
1855 	if (likely(outer_iph->protocol != IPPROTO_ICMP))
1856 		goto out;
1857 
1858 	if (unlikely((outer_iph->frag_off & htons(IP_OFFSET)) != 0))
1859 		goto out;
1860 
1861 	icmph = skb_header_pointer(skb, outer_iph->ihl * 4, sizeof(_icmph),
1862 				   &_icmph);
1863 	if (!icmph)
1864 		goto out;
1865 
1866 	if (icmph->type != ICMP_DEST_UNREACH &&
1867 	    icmph->type != ICMP_REDIRECT &&
1868 	    icmph->type != ICMP_TIME_EXCEEDED &&
1869 	    icmph->type != ICMP_PARAMETERPROB)
1870 		goto out;
1871 
1872 	inner_iph = skb_header_pointer(skb,
1873 				       outer_iph->ihl * 4 + sizeof(_icmph),
1874 				       sizeof(_inner_iph), &_inner_iph);
1875 	if (!inner_iph)
1876 		goto out;
1877 
1878 	key_iph = inner_iph;
1879 out:
1880 	hash_keys->addrs.v4addrs.src = key_iph->saddr;
1881 	hash_keys->addrs.v4addrs.dst = key_iph->daddr;
1882 }
1883 
1884 /* if skb is set it will be used and fl4 can be NULL */
1885 int fib_multipath_hash(const struct net *net, const struct flowi4 *fl4,
1886 		       const struct sk_buff *skb, struct flow_keys *flkeys)
1887 {
1888 	u32 multipath_hash = fl4 ? fl4->flowi4_multipath_hash : 0;
1889 	struct flow_keys hash_keys;
1890 	u32 mhash;
1891 
1892 	switch (net->ipv4.sysctl_fib_multipath_hash_policy) {
1893 	case 0:
1894 		memset(&hash_keys, 0, sizeof(hash_keys));
1895 		hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
1896 		if (skb) {
1897 			ip_multipath_l3_keys(skb, &hash_keys);
1898 		} else {
1899 			hash_keys.addrs.v4addrs.src = fl4->saddr;
1900 			hash_keys.addrs.v4addrs.dst = fl4->daddr;
1901 		}
1902 		break;
1903 	case 1:
1904 		/* skb is currently provided only when forwarding */
1905 		if (skb) {
1906 			unsigned int flag = FLOW_DISSECTOR_F_STOP_AT_ENCAP;
1907 			struct flow_keys keys;
1908 
1909 			/* short-circuit if we already have L4 hash present */
1910 			if (skb->l4_hash)
1911 				return skb_get_hash_raw(skb) >> 1;
1912 
1913 			memset(&hash_keys, 0, sizeof(hash_keys));
1914 
1915 			if (!flkeys) {
1916 				skb_flow_dissect_flow_keys(skb, &keys, flag);
1917 				flkeys = &keys;
1918 			}
1919 
1920 			hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
1921 			hash_keys.addrs.v4addrs.src = flkeys->addrs.v4addrs.src;
1922 			hash_keys.addrs.v4addrs.dst = flkeys->addrs.v4addrs.dst;
1923 			hash_keys.ports.src = flkeys->ports.src;
1924 			hash_keys.ports.dst = flkeys->ports.dst;
1925 			hash_keys.basic.ip_proto = flkeys->basic.ip_proto;
1926 		} else {
1927 			memset(&hash_keys, 0, sizeof(hash_keys));
1928 			hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
1929 			hash_keys.addrs.v4addrs.src = fl4->saddr;
1930 			hash_keys.addrs.v4addrs.dst = fl4->daddr;
1931 			hash_keys.ports.src = fl4->fl4_sport;
1932 			hash_keys.ports.dst = fl4->fl4_dport;
1933 			hash_keys.basic.ip_proto = fl4->flowi4_proto;
1934 		}
1935 		break;
1936 	}
1937 	mhash = flow_hash_from_keys(&hash_keys);
1938 
1939 	if (multipath_hash)
1940 		mhash = jhash_2words(mhash, multipath_hash, 0);
1941 
1942 	return mhash >> 1;
1943 }
1944 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
1945 
1946 static int ip_mkroute_input(struct sk_buff *skb,
1947 			    struct fib_result *res,
1948 			    struct in_device *in_dev,
1949 			    __be32 daddr, __be32 saddr, u32 tos,
1950 			    struct flow_keys *hkeys)
1951 {
1952 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1953 	if (res->fi && res->fi->fib_nhs > 1) {
1954 		int h = fib_multipath_hash(res->fi->fib_net, NULL, skb, hkeys);
1955 
1956 		fib_select_multipath(res, h);
1957 	}
1958 #endif
1959 
1960 	/* create a routing cache entry */
1961 	return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
1962 }
1963 
1964 /*
1965  *	NOTE. We drop all the packets that has local source
1966  *	addresses, because every properly looped back packet
1967  *	must have correct destination already attached by output routine.
1968  *
1969  *	Such approach solves two big problems:
1970  *	1. Not simplex devices are handled properly.
1971  *	2. IP spoofing attempts are filtered with 100% of guarantee.
1972  *	called with rcu_read_lock()
1973  */
1974 
1975 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1976 			       u8 tos, struct net_device *dev,
1977 			       struct fib_result *res)
1978 {
1979 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1980 	struct flow_keys *flkeys = NULL, _flkeys;
1981 	struct net    *net = dev_net(dev);
1982 	struct ip_tunnel_info *tun_info;
1983 	int		err = -EINVAL;
1984 	unsigned int	flags = 0;
1985 	u32		itag = 0;
1986 	struct rtable	*rth;
1987 	struct flowi4	fl4;
1988 	bool do_cache;
1989 
1990 	/* IP on this device is disabled. */
1991 
1992 	if (!in_dev)
1993 		goto out;
1994 
1995 	/* Check for the most weird martians, which can be not detected
1996 	   by fib_lookup.
1997 	 */
1998 
1999 	tun_info = skb_tunnel_info(skb);
2000 	if (tun_info && !(tun_info->mode & IP_TUNNEL_INFO_TX))
2001 		fl4.flowi4_tun_key.tun_id = tun_info->key.tun_id;
2002 	else
2003 		fl4.flowi4_tun_key.tun_id = 0;
2004 	skb_dst_drop(skb);
2005 
2006 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
2007 		goto martian_source;
2008 
2009 	res->fi = NULL;
2010 	res->table = NULL;
2011 	if (ipv4_is_lbcast(daddr) || (saddr == 0 && daddr == 0))
2012 		goto brd_input;
2013 
2014 	/* Accept zero addresses only to limited broadcast;
2015 	 * I even do not know to fix it or not. Waiting for complains :-)
2016 	 */
2017 	if (ipv4_is_zeronet(saddr))
2018 		goto martian_source;
2019 
2020 	if (ipv4_is_zeronet(daddr))
2021 		goto martian_destination;
2022 
2023 	/* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
2024 	 * and call it once if daddr or/and saddr are loopback addresses
2025 	 */
2026 	if (ipv4_is_loopback(daddr)) {
2027 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
2028 			goto martian_destination;
2029 	} else if (ipv4_is_loopback(saddr)) {
2030 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
2031 			goto martian_source;
2032 	}
2033 
2034 	/*
2035 	 *	Now we are ready to route packet.
2036 	 */
2037 	fl4.flowi4_oif = 0;
2038 	fl4.flowi4_iif = dev->ifindex;
2039 	fl4.flowi4_mark = skb->mark;
2040 	fl4.flowi4_tos = tos;
2041 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
2042 	fl4.flowi4_flags = 0;
2043 	fl4.daddr = daddr;
2044 	fl4.saddr = saddr;
2045 	fl4.flowi4_uid = sock_net_uid(net, NULL);
2046 
2047 	if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys)) {
2048 		flkeys = &_flkeys;
2049 	} else {
2050 		fl4.flowi4_proto = 0;
2051 		fl4.fl4_sport = 0;
2052 		fl4.fl4_dport = 0;
2053 	}
2054 
2055 	err = fib_lookup(net, &fl4, res, 0);
2056 	if (err != 0) {
2057 		if (!IN_DEV_FORWARD(in_dev))
2058 			err = -EHOSTUNREACH;
2059 		goto no_route;
2060 	}
2061 
2062 	if (res->type == RTN_BROADCAST) {
2063 		if (IN_DEV_BFORWARD(in_dev))
2064 			goto make_route;
2065 		goto brd_input;
2066 	}
2067 
2068 	if (res->type == RTN_LOCAL) {
2069 		err = fib_validate_source(skb, saddr, daddr, tos,
2070 					  0, dev, in_dev, &itag);
2071 		if (err < 0)
2072 			goto martian_source;
2073 		goto local_input;
2074 	}
2075 
2076 	if (!IN_DEV_FORWARD(in_dev)) {
2077 		err = -EHOSTUNREACH;
2078 		goto no_route;
2079 	}
2080 	if (res->type != RTN_UNICAST)
2081 		goto martian_destination;
2082 
2083 make_route:
2084 	err = ip_mkroute_input(skb, res, in_dev, daddr, saddr, tos, flkeys);
2085 out:	return err;
2086 
2087 brd_input:
2088 	if (skb->protocol != htons(ETH_P_IP))
2089 		goto e_inval;
2090 
2091 	if (!ipv4_is_zeronet(saddr)) {
2092 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
2093 					  in_dev, &itag);
2094 		if (err < 0)
2095 			goto martian_source;
2096 	}
2097 	flags |= RTCF_BROADCAST;
2098 	res->type = RTN_BROADCAST;
2099 	RT_CACHE_STAT_INC(in_brd);
2100 
2101 local_input:
2102 	do_cache = false;
2103 	if (res->fi) {
2104 		if (!itag) {
2105 			struct fib_nh_common *nhc = FIB_RES_NHC(*res);
2106 
2107 			rth = rcu_dereference(nhc->nhc_rth_input);
2108 			if (rt_cache_valid(rth)) {
2109 				skb_dst_set_noref(skb, &rth->dst);
2110 				err = 0;
2111 				goto out;
2112 			}
2113 			do_cache = true;
2114 		}
2115 	}
2116 
2117 	rth = rt_dst_alloc(l3mdev_master_dev_rcu(dev) ? : net->loopback_dev,
2118 			   flags | RTCF_LOCAL, res->type,
2119 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, do_cache);
2120 	if (!rth)
2121 		goto e_nobufs;
2122 
2123 	rth->dst.output= ip_rt_bug;
2124 #ifdef CONFIG_IP_ROUTE_CLASSID
2125 	rth->dst.tclassid = itag;
2126 #endif
2127 	rth->rt_is_input = 1;
2128 
2129 	RT_CACHE_STAT_INC(in_slow_tot);
2130 	if (res->type == RTN_UNREACHABLE) {
2131 		rth->dst.input= ip_error;
2132 		rth->dst.error= -err;
2133 		rth->rt_flags 	&= ~RTCF_LOCAL;
2134 	}
2135 
2136 	if (do_cache) {
2137 		struct fib_nh_common *nhc = FIB_RES_NHC(*res);
2138 
2139 		rth->dst.lwtstate = lwtstate_get(nhc->nhc_lwtstate);
2140 		if (lwtunnel_input_redirect(rth->dst.lwtstate)) {
2141 			WARN_ON(rth->dst.input == lwtunnel_input);
2142 			rth->dst.lwtstate->orig_input = rth->dst.input;
2143 			rth->dst.input = lwtunnel_input;
2144 		}
2145 
2146 		if (unlikely(!rt_cache_route(nhc, rth)))
2147 			rt_add_uncached_list(rth);
2148 	}
2149 	skb_dst_set(skb, &rth->dst);
2150 	err = 0;
2151 	goto out;
2152 
2153 no_route:
2154 	RT_CACHE_STAT_INC(in_no_route);
2155 	res->type = RTN_UNREACHABLE;
2156 	res->fi = NULL;
2157 	res->table = NULL;
2158 	goto local_input;
2159 
2160 	/*
2161 	 *	Do not cache martian addresses: they should be logged (RFC1812)
2162 	 */
2163 martian_destination:
2164 	RT_CACHE_STAT_INC(in_martian_dst);
2165 #ifdef CONFIG_IP_ROUTE_VERBOSE
2166 	if (IN_DEV_LOG_MARTIANS(in_dev))
2167 		net_warn_ratelimited("martian destination %pI4 from %pI4, dev %s\n",
2168 				     &daddr, &saddr, dev->name);
2169 #endif
2170 
2171 e_inval:
2172 	err = -EINVAL;
2173 	goto out;
2174 
2175 e_nobufs:
2176 	err = -ENOBUFS;
2177 	goto out;
2178 
2179 martian_source:
2180 	ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
2181 	goto out;
2182 }
2183 
2184 int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
2185 			 u8 tos, struct net_device *dev)
2186 {
2187 	struct fib_result res;
2188 	int err;
2189 
2190 	tos &= IPTOS_RT_MASK;
2191 	rcu_read_lock();
2192 	err = ip_route_input_rcu(skb, daddr, saddr, tos, dev, &res);
2193 	rcu_read_unlock();
2194 
2195 	return err;
2196 }
2197 EXPORT_SYMBOL(ip_route_input_noref);
2198 
2199 /* called with rcu_read_lock held */
2200 int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
2201 		       u8 tos, struct net_device *dev, struct fib_result *res)
2202 {
2203 	/* Multicast recognition logic is moved from route cache to here.
2204 	   The problem was that too many Ethernet cards have broken/missing
2205 	   hardware multicast filters :-( As result the host on multicasting
2206 	   network acquires a lot of useless route cache entries, sort of
2207 	   SDR messages from all the world. Now we try to get rid of them.
2208 	   Really, provided software IP multicast filter is organized
2209 	   reasonably (at least, hashed), it does not result in a slowdown
2210 	   comparing with route cache reject entries.
2211 	   Note, that multicast routers are not affected, because
2212 	   route cache entry is created eventually.
2213 	 */
2214 	if (ipv4_is_multicast(daddr)) {
2215 		struct in_device *in_dev = __in_dev_get_rcu(dev);
2216 		int our = 0;
2217 		int err = -EINVAL;
2218 
2219 		if (!in_dev)
2220 			return err;
2221 		our = ip_check_mc_rcu(in_dev, daddr, saddr,
2222 				      ip_hdr(skb)->protocol);
2223 
2224 		/* check l3 master if no match yet */
2225 		if (!our && netif_is_l3_slave(dev)) {
2226 			struct in_device *l3_in_dev;
2227 
2228 			l3_in_dev = __in_dev_get_rcu(skb->dev);
2229 			if (l3_in_dev)
2230 				our = ip_check_mc_rcu(l3_in_dev, daddr, saddr,
2231 						      ip_hdr(skb)->protocol);
2232 		}
2233 
2234 		if (our
2235 #ifdef CONFIG_IP_MROUTE
2236 			||
2237 		    (!ipv4_is_local_multicast(daddr) &&
2238 		     IN_DEV_MFORWARD(in_dev))
2239 #endif
2240 		   ) {
2241 			err = ip_route_input_mc(skb, daddr, saddr,
2242 						tos, dev, our);
2243 		}
2244 		return err;
2245 	}
2246 
2247 	return ip_route_input_slow(skb, daddr, saddr, tos, dev, res);
2248 }
2249 
2250 /* called with rcu_read_lock() */
2251 static struct rtable *__mkroute_output(const struct fib_result *res,
2252 				       const struct flowi4 *fl4, int orig_oif,
2253 				       struct net_device *dev_out,
2254 				       unsigned int flags)
2255 {
2256 	struct fib_info *fi = res->fi;
2257 	struct fib_nh_exception *fnhe;
2258 	struct in_device *in_dev;
2259 	u16 type = res->type;
2260 	struct rtable *rth;
2261 	bool do_cache;
2262 
2263 	in_dev = __in_dev_get_rcu(dev_out);
2264 	if (!in_dev)
2265 		return ERR_PTR(-EINVAL);
2266 
2267 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
2268 		if (ipv4_is_loopback(fl4->saddr) &&
2269 		    !(dev_out->flags & IFF_LOOPBACK) &&
2270 		    !netif_is_l3_master(dev_out))
2271 			return ERR_PTR(-EINVAL);
2272 
2273 	if (ipv4_is_lbcast(fl4->daddr))
2274 		type = RTN_BROADCAST;
2275 	else if (ipv4_is_multicast(fl4->daddr))
2276 		type = RTN_MULTICAST;
2277 	else if (ipv4_is_zeronet(fl4->daddr))
2278 		return ERR_PTR(-EINVAL);
2279 
2280 	if (dev_out->flags & IFF_LOOPBACK)
2281 		flags |= RTCF_LOCAL;
2282 
2283 	do_cache = true;
2284 	if (type == RTN_BROADCAST) {
2285 		flags |= RTCF_BROADCAST | RTCF_LOCAL;
2286 		fi = NULL;
2287 	} else if (type == RTN_MULTICAST) {
2288 		flags |= RTCF_MULTICAST | RTCF_LOCAL;
2289 		if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
2290 				     fl4->flowi4_proto))
2291 			flags &= ~RTCF_LOCAL;
2292 		else
2293 			do_cache = false;
2294 		/* If multicast route do not exist use
2295 		 * default one, but do not gateway in this case.
2296 		 * Yes, it is hack.
2297 		 */
2298 		if (fi && res->prefixlen < 4)
2299 			fi = NULL;
2300 	} else if ((type == RTN_LOCAL) && (orig_oif != 0) &&
2301 		   (orig_oif != dev_out->ifindex)) {
2302 		/* For local routes that require a particular output interface
2303 		 * we do not want to cache the result.  Caching the result
2304 		 * causes incorrect behaviour when there are multiple source
2305 		 * addresses on the interface, the end result being that if the
2306 		 * intended recipient is waiting on that interface for the
2307 		 * packet he won't receive it because it will be delivered on
2308 		 * the loopback interface and the IP_PKTINFO ipi_ifindex will
2309 		 * be set to the loopback interface as well.
2310 		 */
2311 		do_cache = false;
2312 	}
2313 
2314 	fnhe = NULL;
2315 	do_cache &= fi != NULL;
2316 	if (fi) {
2317 		struct fib_nh_common *nhc = FIB_RES_NHC(*res);
2318 		struct rtable __rcu **prth;
2319 
2320 		fnhe = find_exception(nhc, fl4->daddr);
2321 		if (!do_cache)
2322 			goto add;
2323 		if (fnhe) {
2324 			prth = &fnhe->fnhe_rth_output;
2325 		} else {
2326 			if (unlikely(fl4->flowi4_flags &
2327 				     FLOWI_FLAG_KNOWN_NH &&
2328 				     !(nhc->nhc_gw_family &&
2329 				       nhc->nhc_scope == RT_SCOPE_LINK))) {
2330 				do_cache = false;
2331 				goto add;
2332 			}
2333 			prth = raw_cpu_ptr(nhc->nhc_pcpu_rth_output);
2334 		}
2335 		rth = rcu_dereference(*prth);
2336 		if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst))
2337 			return rth;
2338 	}
2339 
2340 add:
2341 	rth = rt_dst_alloc(dev_out, flags, type,
2342 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
2343 			   IN_DEV_CONF_GET(in_dev, NOXFRM),
2344 			   do_cache);
2345 	if (!rth)
2346 		return ERR_PTR(-ENOBUFS);
2347 
2348 	rth->rt_iif = orig_oif;
2349 
2350 	RT_CACHE_STAT_INC(out_slow_tot);
2351 
2352 	if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
2353 		if (flags & RTCF_LOCAL &&
2354 		    !(dev_out->flags & IFF_LOOPBACK)) {
2355 			rth->dst.output = ip_mc_output;
2356 			RT_CACHE_STAT_INC(out_slow_mc);
2357 		}
2358 #ifdef CONFIG_IP_MROUTE
2359 		if (type == RTN_MULTICAST) {
2360 			if (IN_DEV_MFORWARD(in_dev) &&
2361 			    !ipv4_is_local_multicast(fl4->daddr)) {
2362 				rth->dst.input = ip_mr_input;
2363 				rth->dst.output = ip_mc_output;
2364 			}
2365 		}
2366 #endif
2367 	}
2368 
2369 	rt_set_nexthop(rth, fl4->daddr, res, fnhe, fi, type, 0, do_cache);
2370 	lwtunnel_set_redirect(&rth->dst);
2371 
2372 	return rth;
2373 }
2374 
2375 /*
2376  * Major route resolver routine.
2377  */
2378 
2379 struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
2380 					const struct sk_buff *skb)
2381 {
2382 	__u8 tos = RT_FL_TOS(fl4);
2383 	struct fib_result res = {
2384 		.type		= RTN_UNSPEC,
2385 		.fi		= NULL,
2386 		.table		= NULL,
2387 		.tclassid	= 0,
2388 	};
2389 	struct rtable *rth;
2390 
2391 	fl4->flowi4_iif = LOOPBACK_IFINDEX;
2392 	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
2393 	fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
2394 			 RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
2395 
2396 	rcu_read_lock();
2397 	rth = ip_route_output_key_hash_rcu(net, fl4, &res, skb);
2398 	rcu_read_unlock();
2399 
2400 	return rth;
2401 }
2402 EXPORT_SYMBOL_GPL(ip_route_output_key_hash);
2403 
2404 struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
2405 					    struct fib_result *res,
2406 					    const struct sk_buff *skb)
2407 {
2408 	struct net_device *dev_out = NULL;
2409 	int orig_oif = fl4->flowi4_oif;
2410 	unsigned int flags = 0;
2411 	struct rtable *rth;
2412 	int err = -ENETUNREACH;
2413 
2414 	if (fl4->saddr) {
2415 		rth = ERR_PTR(-EINVAL);
2416 		if (ipv4_is_multicast(fl4->saddr) ||
2417 		    ipv4_is_lbcast(fl4->saddr) ||
2418 		    ipv4_is_zeronet(fl4->saddr))
2419 			goto out;
2420 
2421 		/* I removed check for oif == dev_out->oif here.
2422 		   It was wrong for two reasons:
2423 		   1. ip_dev_find(net, saddr) can return wrong iface, if saddr
2424 		      is assigned to multiple interfaces.
2425 		   2. Moreover, we are allowed to send packets with saddr
2426 		      of another iface. --ANK
2427 		 */
2428 
2429 		if (fl4->flowi4_oif == 0 &&
2430 		    (ipv4_is_multicast(fl4->daddr) ||
2431 		     ipv4_is_lbcast(fl4->daddr))) {
2432 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2433 			dev_out = __ip_dev_find(net, fl4->saddr, false);
2434 			if (!dev_out)
2435 				goto out;
2436 
2437 			/* Special hack: user can direct multicasts
2438 			   and limited broadcast via necessary interface
2439 			   without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
2440 			   This hack is not just for fun, it allows
2441 			   vic,vat and friends to work.
2442 			   They bind socket to loopback, set ttl to zero
2443 			   and expect that it will work.
2444 			   From the viewpoint of routing cache they are broken,
2445 			   because we are not allowed to build multicast path
2446 			   with loopback source addr (look, routing cache
2447 			   cannot know, that ttl is zero, so that packet
2448 			   will not leave this host and route is valid).
2449 			   Luckily, this hack is good workaround.
2450 			 */
2451 
2452 			fl4->flowi4_oif = dev_out->ifindex;
2453 			goto make_route;
2454 		}
2455 
2456 		if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
2457 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2458 			if (!__ip_dev_find(net, fl4->saddr, false))
2459 				goto out;
2460 		}
2461 	}
2462 
2463 
2464 	if (fl4->flowi4_oif) {
2465 		dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
2466 		rth = ERR_PTR(-ENODEV);
2467 		if (!dev_out)
2468 			goto out;
2469 
2470 		/* RACE: Check return value of inet_select_addr instead. */
2471 		if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
2472 			rth = ERR_PTR(-ENETUNREACH);
2473 			goto out;
2474 		}
2475 		if (ipv4_is_local_multicast(fl4->daddr) ||
2476 		    ipv4_is_lbcast(fl4->daddr) ||
2477 		    fl4->flowi4_proto == IPPROTO_IGMP) {
2478 			if (!fl4->saddr)
2479 				fl4->saddr = inet_select_addr(dev_out, 0,
2480 							      RT_SCOPE_LINK);
2481 			goto make_route;
2482 		}
2483 		if (!fl4->saddr) {
2484 			if (ipv4_is_multicast(fl4->daddr))
2485 				fl4->saddr = inet_select_addr(dev_out, 0,
2486 							      fl4->flowi4_scope);
2487 			else if (!fl4->daddr)
2488 				fl4->saddr = inet_select_addr(dev_out, 0,
2489 							      RT_SCOPE_HOST);
2490 		}
2491 	}
2492 
2493 	if (!fl4->daddr) {
2494 		fl4->daddr = fl4->saddr;
2495 		if (!fl4->daddr)
2496 			fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
2497 		dev_out = net->loopback_dev;
2498 		fl4->flowi4_oif = LOOPBACK_IFINDEX;
2499 		res->type = RTN_LOCAL;
2500 		flags |= RTCF_LOCAL;
2501 		goto make_route;
2502 	}
2503 
2504 	err = fib_lookup(net, fl4, res, 0);
2505 	if (err) {
2506 		res->fi = NULL;
2507 		res->table = NULL;
2508 		if (fl4->flowi4_oif &&
2509 		    (ipv4_is_multicast(fl4->daddr) ||
2510 		    !netif_index_is_l3_master(net, fl4->flowi4_oif))) {
2511 			/* Apparently, routing tables are wrong. Assume,
2512 			   that the destination is on link.
2513 
2514 			   WHY? DW.
2515 			   Because we are allowed to send to iface
2516 			   even if it has NO routes and NO assigned
2517 			   addresses. When oif is specified, routing
2518 			   tables are looked up with only one purpose:
2519 			   to catch if destination is gatewayed, rather than
2520 			   direct. Moreover, if MSG_DONTROUTE is set,
2521 			   we send packet, ignoring both routing tables
2522 			   and ifaddr state. --ANK
2523 
2524 
2525 			   We could make it even if oif is unknown,
2526 			   likely IPv6, but we do not.
2527 			 */
2528 
2529 			if (fl4->saddr == 0)
2530 				fl4->saddr = inet_select_addr(dev_out, 0,
2531 							      RT_SCOPE_LINK);
2532 			res->type = RTN_UNICAST;
2533 			goto make_route;
2534 		}
2535 		rth = ERR_PTR(err);
2536 		goto out;
2537 	}
2538 
2539 	if (res->type == RTN_LOCAL) {
2540 		if (!fl4->saddr) {
2541 			if (res->fi->fib_prefsrc)
2542 				fl4->saddr = res->fi->fib_prefsrc;
2543 			else
2544 				fl4->saddr = fl4->daddr;
2545 		}
2546 
2547 		/* L3 master device is the loopback for that domain */
2548 		dev_out = l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) ? :
2549 			net->loopback_dev;
2550 
2551 		/* make sure orig_oif points to fib result device even
2552 		 * though packet rx/tx happens over loopback or l3mdev
2553 		 */
2554 		orig_oif = FIB_RES_OIF(*res);
2555 
2556 		fl4->flowi4_oif = dev_out->ifindex;
2557 		flags |= RTCF_LOCAL;
2558 		goto make_route;
2559 	}
2560 
2561 	fib_select_path(net, res, fl4, skb);
2562 
2563 	dev_out = FIB_RES_DEV(*res);
2564 	fl4->flowi4_oif = dev_out->ifindex;
2565 
2566 
2567 make_route:
2568 	rth = __mkroute_output(res, fl4, orig_oif, dev_out, flags);
2569 
2570 out:
2571 	return rth;
2572 }
2573 
2574 static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
2575 {
2576 	return NULL;
2577 }
2578 
2579 static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
2580 {
2581 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
2582 
2583 	return mtu ? : dst->dev->mtu;
2584 }
2585 
2586 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
2587 					  struct sk_buff *skb, u32 mtu)
2588 {
2589 }
2590 
2591 static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
2592 				       struct sk_buff *skb)
2593 {
2594 }
2595 
2596 static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
2597 					  unsigned long old)
2598 {
2599 	return NULL;
2600 }
2601 
2602 static struct dst_ops ipv4_dst_blackhole_ops = {
2603 	.family			=	AF_INET,
2604 	.check			=	ipv4_blackhole_dst_check,
2605 	.mtu			=	ipv4_blackhole_mtu,
2606 	.default_advmss		=	ipv4_default_advmss,
2607 	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
2608 	.redirect		=	ipv4_rt_blackhole_redirect,
2609 	.cow_metrics		=	ipv4_rt_blackhole_cow_metrics,
2610 	.neigh_lookup		=	ipv4_neigh_lookup,
2611 };
2612 
2613 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
2614 {
2615 	struct rtable *ort = (struct rtable *) dst_orig;
2616 	struct rtable *rt;
2617 
2618 	rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_DEAD, 0);
2619 	if (rt) {
2620 		struct dst_entry *new = &rt->dst;
2621 
2622 		new->__use = 1;
2623 		new->input = dst_discard;
2624 		new->output = dst_discard_out;
2625 
2626 		new->dev = net->loopback_dev;
2627 		if (new->dev)
2628 			dev_hold(new->dev);
2629 
2630 		rt->rt_is_input = ort->rt_is_input;
2631 		rt->rt_iif = ort->rt_iif;
2632 		rt->rt_pmtu = ort->rt_pmtu;
2633 		rt->rt_mtu_locked = ort->rt_mtu_locked;
2634 
2635 		rt->rt_genid = rt_genid_ipv4(net);
2636 		rt->rt_flags = ort->rt_flags;
2637 		rt->rt_type = ort->rt_type;
2638 		rt->rt_gw_family = ort->rt_gw_family;
2639 		if (rt->rt_gw_family == AF_INET)
2640 			rt->rt_gw4 = ort->rt_gw4;
2641 		else if (rt->rt_gw_family == AF_INET6)
2642 			rt->rt_gw6 = ort->rt_gw6;
2643 
2644 		INIT_LIST_HEAD(&rt->rt_uncached);
2645 	}
2646 
2647 	dst_release(dst_orig);
2648 
2649 	return rt ? &rt->dst : ERR_PTR(-ENOMEM);
2650 }
2651 
2652 struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
2653 				    const struct sock *sk)
2654 {
2655 	struct rtable *rt = __ip_route_output_key(net, flp4);
2656 
2657 	if (IS_ERR(rt))
2658 		return rt;
2659 
2660 	if (flp4->flowi4_proto)
2661 		rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
2662 							flowi4_to_flowi(flp4),
2663 							sk, 0);
2664 
2665 	return rt;
2666 }
2667 EXPORT_SYMBOL_GPL(ip_route_output_flow);
2668 
2669 /* called with rcu_read_lock held */
2670 static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
2671 			struct rtable *rt, u32 table_id, struct flowi4 *fl4,
2672 			struct sk_buff *skb, u32 portid, u32 seq)
2673 {
2674 	struct rtmsg *r;
2675 	struct nlmsghdr *nlh;
2676 	unsigned long expires = 0;
2677 	u32 error;
2678 	u32 metrics[RTAX_MAX];
2679 
2680 	nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), 0);
2681 	if (!nlh)
2682 		return -EMSGSIZE;
2683 
2684 	r = nlmsg_data(nlh);
2685 	r->rtm_family	 = AF_INET;
2686 	r->rtm_dst_len	= 32;
2687 	r->rtm_src_len	= 0;
2688 	r->rtm_tos	= fl4->flowi4_tos;
2689 	r->rtm_table	= table_id < 256 ? table_id : RT_TABLE_COMPAT;
2690 	if (nla_put_u32(skb, RTA_TABLE, table_id))
2691 		goto nla_put_failure;
2692 	r->rtm_type	= rt->rt_type;
2693 	r->rtm_scope	= RT_SCOPE_UNIVERSE;
2694 	r->rtm_protocol = RTPROT_UNSPEC;
2695 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
2696 	if (rt->rt_flags & RTCF_NOTIFY)
2697 		r->rtm_flags |= RTM_F_NOTIFY;
2698 	if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
2699 		r->rtm_flags |= RTCF_DOREDIRECT;
2700 
2701 	if (nla_put_in_addr(skb, RTA_DST, dst))
2702 		goto nla_put_failure;
2703 	if (src) {
2704 		r->rtm_src_len = 32;
2705 		if (nla_put_in_addr(skb, RTA_SRC, src))
2706 			goto nla_put_failure;
2707 	}
2708 	if (rt->dst.dev &&
2709 	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
2710 		goto nla_put_failure;
2711 #ifdef CONFIG_IP_ROUTE_CLASSID
2712 	if (rt->dst.tclassid &&
2713 	    nla_put_u32(skb, RTA_FLOW, rt->dst.tclassid))
2714 		goto nla_put_failure;
2715 #endif
2716 	if (!rt_is_input_route(rt) &&
2717 	    fl4->saddr != src) {
2718 		if (nla_put_in_addr(skb, RTA_PREFSRC, fl4->saddr))
2719 			goto nla_put_failure;
2720 	}
2721 	if (rt->rt_gw_family == AF_INET &&
2722 	    nla_put_in_addr(skb, RTA_GATEWAY, rt->rt_gw4)) {
2723 		goto nla_put_failure;
2724 	} else if (rt->rt_gw_family == AF_INET6) {
2725 		int alen = sizeof(struct in6_addr);
2726 		struct nlattr *nla;
2727 		struct rtvia *via;
2728 
2729 		nla = nla_reserve(skb, RTA_VIA, alen + 2);
2730 		if (!nla)
2731 			goto nla_put_failure;
2732 
2733 		via = nla_data(nla);
2734 		via->rtvia_family = AF_INET6;
2735 		memcpy(via->rtvia_addr, &rt->rt_gw6, alen);
2736 	}
2737 
2738 	expires = rt->dst.expires;
2739 	if (expires) {
2740 		unsigned long now = jiffies;
2741 
2742 		if (time_before(now, expires))
2743 			expires -= now;
2744 		else
2745 			expires = 0;
2746 	}
2747 
2748 	memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
2749 	if (rt->rt_pmtu && expires)
2750 		metrics[RTAX_MTU - 1] = rt->rt_pmtu;
2751 	if (rt->rt_mtu_locked && expires)
2752 		metrics[RTAX_LOCK - 1] |= BIT(RTAX_MTU);
2753 	if (rtnetlink_put_metrics(skb, metrics) < 0)
2754 		goto nla_put_failure;
2755 
2756 	if (fl4->flowi4_mark &&
2757 	    nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
2758 		goto nla_put_failure;
2759 
2760 	if (!uid_eq(fl4->flowi4_uid, INVALID_UID) &&
2761 	    nla_put_u32(skb, RTA_UID,
2762 			from_kuid_munged(current_user_ns(), fl4->flowi4_uid)))
2763 		goto nla_put_failure;
2764 
2765 	error = rt->dst.error;
2766 
2767 	if (rt_is_input_route(rt)) {
2768 #ifdef CONFIG_IP_MROUTE
2769 		if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
2770 		    IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
2771 			int err = ipmr_get_route(net, skb,
2772 						 fl4->saddr, fl4->daddr,
2773 						 r, portid);
2774 
2775 			if (err <= 0) {
2776 				if (err == 0)
2777 					return 0;
2778 				goto nla_put_failure;
2779 			}
2780 		} else
2781 #endif
2782 			if (nla_put_u32(skb, RTA_IIF, fl4->flowi4_iif))
2783 				goto nla_put_failure;
2784 	}
2785 
2786 	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, error) < 0)
2787 		goto nla_put_failure;
2788 
2789 	nlmsg_end(skb, nlh);
2790 	return 0;
2791 
2792 nla_put_failure:
2793 	nlmsg_cancel(skb, nlh);
2794 	return -EMSGSIZE;
2795 }
2796 
2797 static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst,
2798 						   u8 ip_proto, __be16 sport,
2799 						   __be16 dport)
2800 {
2801 	struct sk_buff *skb;
2802 	struct iphdr *iph;
2803 
2804 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2805 	if (!skb)
2806 		return NULL;
2807 
2808 	/* Reserve room for dummy headers, this skb can pass
2809 	 * through good chunk of routing engine.
2810 	 */
2811 	skb_reset_mac_header(skb);
2812 	skb_reset_network_header(skb);
2813 	skb->protocol = htons(ETH_P_IP);
2814 	iph = skb_put(skb, sizeof(struct iphdr));
2815 	iph->protocol = ip_proto;
2816 	iph->saddr = src;
2817 	iph->daddr = dst;
2818 	iph->version = 0x4;
2819 	iph->frag_off = 0;
2820 	iph->ihl = 0x5;
2821 	skb_set_transport_header(skb, skb->len);
2822 
2823 	switch (iph->protocol) {
2824 	case IPPROTO_UDP: {
2825 		struct udphdr *udph;
2826 
2827 		udph = skb_put_zero(skb, sizeof(struct udphdr));
2828 		udph->source = sport;
2829 		udph->dest = dport;
2830 		udph->len = sizeof(struct udphdr);
2831 		udph->check = 0;
2832 		break;
2833 	}
2834 	case IPPROTO_TCP: {
2835 		struct tcphdr *tcph;
2836 
2837 		tcph = skb_put_zero(skb, sizeof(struct tcphdr));
2838 		tcph->source	= sport;
2839 		tcph->dest	= dport;
2840 		tcph->doff	= sizeof(struct tcphdr) / 4;
2841 		tcph->rst = 1;
2842 		tcph->check = ~tcp_v4_check(sizeof(struct tcphdr),
2843 					    src, dst, 0);
2844 		break;
2845 	}
2846 	case IPPROTO_ICMP: {
2847 		struct icmphdr *icmph;
2848 
2849 		icmph = skb_put_zero(skb, sizeof(struct icmphdr));
2850 		icmph->type = ICMP_ECHO;
2851 		icmph->code = 0;
2852 	}
2853 	}
2854 
2855 	return skb;
2856 }
2857 
2858 static int inet_rtm_valid_getroute_req(struct sk_buff *skb,
2859 				       const struct nlmsghdr *nlh,
2860 				       struct nlattr **tb,
2861 				       struct netlink_ext_ack *extack)
2862 {
2863 	struct rtmsg *rtm;
2864 	int i, err;
2865 
2866 	if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*rtm))) {
2867 		NL_SET_ERR_MSG(extack,
2868 			       "ipv4: Invalid header for route get request");
2869 		return -EINVAL;
2870 	}
2871 
2872 	if (!netlink_strict_get_check(skb))
2873 		return nlmsg_parse_deprecated(nlh, sizeof(*rtm), tb, RTA_MAX,
2874 					      rtm_ipv4_policy, extack);
2875 
2876 	rtm = nlmsg_data(nlh);
2877 	if ((rtm->rtm_src_len && rtm->rtm_src_len != 32) ||
2878 	    (rtm->rtm_dst_len && rtm->rtm_dst_len != 32) ||
2879 	    rtm->rtm_table || rtm->rtm_protocol ||
2880 	    rtm->rtm_scope || rtm->rtm_type) {
2881 		NL_SET_ERR_MSG(extack, "ipv4: Invalid values in header for route get request");
2882 		return -EINVAL;
2883 	}
2884 
2885 	if (rtm->rtm_flags & ~(RTM_F_NOTIFY |
2886 			       RTM_F_LOOKUP_TABLE |
2887 			       RTM_F_FIB_MATCH)) {
2888 		NL_SET_ERR_MSG(extack, "ipv4: Unsupported rtm_flags for route get request");
2889 		return -EINVAL;
2890 	}
2891 
2892 	err = nlmsg_parse_deprecated_strict(nlh, sizeof(*rtm), tb, RTA_MAX,
2893 					    rtm_ipv4_policy, extack);
2894 	if (err)
2895 		return err;
2896 
2897 	if ((tb[RTA_SRC] && !rtm->rtm_src_len) ||
2898 	    (tb[RTA_DST] && !rtm->rtm_dst_len)) {
2899 		NL_SET_ERR_MSG(extack, "ipv4: rtm_src_len and rtm_dst_len must be 32 for IPv4");
2900 		return -EINVAL;
2901 	}
2902 
2903 	for (i = 0; i <= RTA_MAX; i++) {
2904 		if (!tb[i])
2905 			continue;
2906 
2907 		switch (i) {
2908 		case RTA_IIF:
2909 		case RTA_OIF:
2910 		case RTA_SRC:
2911 		case RTA_DST:
2912 		case RTA_IP_PROTO:
2913 		case RTA_SPORT:
2914 		case RTA_DPORT:
2915 		case RTA_MARK:
2916 		case RTA_UID:
2917 			break;
2918 		default:
2919 			NL_SET_ERR_MSG(extack, "ipv4: Unsupported attribute in route get request");
2920 			return -EINVAL;
2921 		}
2922 	}
2923 
2924 	return 0;
2925 }
2926 
2927 static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2928 			     struct netlink_ext_ack *extack)
2929 {
2930 	struct net *net = sock_net(in_skb->sk);
2931 	struct nlattr *tb[RTA_MAX+1];
2932 	u32 table_id = RT_TABLE_MAIN;
2933 	__be16 sport = 0, dport = 0;
2934 	struct fib_result res = {};
2935 	u8 ip_proto = IPPROTO_UDP;
2936 	struct rtable *rt = NULL;
2937 	struct sk_buff *skb;
2938 	struct rtmsg *rtm;
2939 	struct flowi4 fl4 = {};
2940 	__be32 dst = 0;
2941 	__be32 src = 0;
2942 	kuid_t uid;
2943 	u32 iif;
2944 	int err;
2945 	int mark;
2946 
2947 	err = inet_rtm_valid_getroute_req(in_skb, nlh, tb, extack);
2948 	if (err < 0)
2949 		return err;
2950 
2951 	rtm = nlmsg_data(nlh);
2952 	src = tb[RTA_SRC] ? nla_get_in_addr(tb[RTA_SRC]) : 0;
2953 	dst = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0;
2954 	iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
2955 	mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
2956 	if (tb[RTA_UID])
2957 		uid = make_kuid(current_user_ns(), nla_get_u32(tb[RTA_UID]));
2958 	else
2959 		uid = (iif ? INVALID_UID : current_uid());
2960 
2961 	if (tb[RTA_IP_PROTO]) {
2962 		err = rtm_getroute_parse_ip_proto(tb[RTA_IP_PROTO],
2963 						  &ip_proto, AF_INET, extack);
2964 		if (err)
2965 			return err;
2966 	}
2967 
2968 	if (tb[RTA_SPORT])
2969 		sport = nla_get_be16(tb[RTA_SPORT]);
2970 
2971 	if (tb[RTA_DPORT])
2972 		dport = nla_get_be16(tb[RTA_DPORT]);
2973 
2974 	skb = inet_rtm_getroute_build_skb(src, dst, ip_proto, sport, dport);
2975 	if (!skb)
2976 		return -ENOBUFS;
2977 
2978 	fl4.daddr = dst;
2979 	fl4.saddr = src;
2980 	fl4.flowi4_tos = rtm->rtm_tos;
2981 	fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
2982 	fl4.flowi4_mark = mark;
2983 	fl4.flowi4_uid = uid;
2984 	if (sport)
2985 		fl4.fl4_sport = sport;
2986 	if (dport)
2987 		fl4.fl4_dport = dport;
2988 	fl4.flowi4_proto = ip_proto;
2989 
2990 	rcu_read_lock();
2991 
2992 	if (iif) {
2993 		struct net_device *dev;
2994 
2995 		dev = dev_get_by_index_rcu(net, iif);
2996 		if (!dev) {
2997 			err = -ENODEV;
2998 			goto errout_rcu;
2999 		}
3000 
3001 		fl4.flowi4_iif = iif; /* for rt_fill_info */
3002 		skb->dev	= dev;
3003 		skb->mark	= mark;
3004 		err = ip_route_input_rcu(skb, dst, src, rtm->rtm_tos,
3005 					 dev, &res);
3006 
3007 		rt = skb_rtable(skb);
3008 		if (err == 0 && rt->dst.error)
3009 			err = -rt->dst.error;
3010 	} else {
3011 		fl4.flowi4_iif = LOOPBACK_IFINDEX;
3012 		skb->dev = net->loopback_dev;
3013 		rt = ip_route_output_key_hash_rcu(net, &fl4, &res, skb);
3014 		err = 0;
3015 		if (IS_ERR(rt))
3016 			err = PTR_ERR(rt);
3017 		else
3018 			skb_dst_set(skb, &rt->dst);
3019 	}
3020 
3021 	if (err)
3022 		goto errout_rcu;
3023 
3024 	if (rtm->rtm_flags & RTM_F_NOTIFY)
3025 		rt->rt_flags |= RTCF_NOTIFY;
3026 
3027 	if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
3028 		table_id = res.table ? res.table->tb_id : 0;
3029 
3030 	/* reset skb for netlink reply msg */
3031 	skb_trim(skb, 0);
3032 	skb_reset_network_header(skb);
3033 	skb_reset_transport_header(skb);
3034 	skb_reset_mac_header(skb);
3035 
3036 	if (rtm->rtm_flags & RTM_F_FIB_MATCH) {
3037 		if (!res.fi) {
3038 			err = fib_props[res.type].error;
3039 			if (!err)
3040 				err = -EHOSTUNREACH;
3041 			goto errout_rcu;
3042 		}
3043 		err = fib_dump_info(skb, NETLINK_CB(in_skb).portid,
3044 				    nlh->nlmsg_seq, RTM_NEWROUTE, table_id,
3045 				    rt->rt_type, res.prefix, res.prefixlen,
3046 				    fl4.flowi4_tos, res.fi, 0);
3047 	} else {
3048 		err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb,
3049 				   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
3050 	}
3051 	if (err < 0)
3052 		goto errout_rcu;
3053 
3054 	rcu_read_unlock();
3055 
3056 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
3057 
3058 errout_free:
3059 	return err;
3060 errout_rcu:
3061 	rcu_read_unlock();
3062 	kfree_skb(skb);
3063 	goto errout_free;
3064 }
3065 
3066 void ip_rt_multicast_event(struct in_device *in_dev)
3067 {
3068 	rt_cache_flush(dev_net(in_dev->dev));
3069 }
3070 
3071 #ifdef CONFIG_SYSCTL
3072 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
3073 static int ip_rt_gc_min_interval __read_mostly	= HZ / 2;
3074 static int ip_rt_gc_elasticity __read_mostly	= 8;
3075 static int ip_min_valid_pmtu __read_mostly	= IPV4_MIN_MTU;
3076 
3077 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
3078 					void __user *buffer,
3079 					size_t *lenp, loff_t *ppos)
3080 {
3081 	struct net *net = (struct net *)__ctl->extra1;
3082 
3083 	if (write) {
3084 		rt_cache_flush(net);
3085 		fnhe_genid_bump(net);
3086 		return 0;
3087 	}
3088 
3089 	return -EINVAL;
3090 }
3091 
3092 static struct ctl_table ipv4_route_table[] = {
3093 	{
3094 		.procname	= "gc_thresh",
3095 		.data		= &ipv4_dst_ops.gc_thresh,
3096 		.maxlen		= sizeof(int),
3097 		.mode		= 0644,
3098 		.proc_handler	= proc_dointvec,
3099 	},
3100 	{
3101 		.procname	= "max_size",
3102 		.data		= &ip_rt_max_size,
3103 		.maxlen		= sizeof(int),
3104 		.mode		= 0644,
3105 		.proc_handler	= proc_dointvec,
3106 	},
3107 	{
3108 		/*  Deprecated. Use gc_min_interval_ms */
3109 
3110 		.procname	= "gc_min_interval",
3111 		.data		= &ip_rt_gc_min_interval,
3112 		.maxlen		= sizeof(int),
3113 		.mode		= 0644,
3114 		.proc_handler	= proc_dointvec_jiffies,
3115 	},
3116 	{
3117 		.procname	= "gc_min_interval_ms",
3118 		.data		= &ip_rt_gc_min_interval,
3119 		.maxlen		= sizeof(int),
3120 		.mode		= 0644,
3121 		.proc_handler	= proc_dointvec_ms_jiffies,
3122 	},
3123 	{
3124 		.procname	= "gc_timeout",
3125 		.data		= &ip_rt_gc_timeout,
3126 		.maxlen		= sizeof(int),
3127 		.mode		= 0644,
3128 		.proc_handler	= proc_dointvec_jiffies,
3129 	},
3130 	{
3131 		.procname	= "gc_interval",
3132 		.data		= &ip_rt_gc_interval,
3133 		.maxlen		= sizeof(int),
3134 		.mode		= 0644,
3135 		.proc_handler	= proc_dointvec_jiffies,
3136 	},
3137 	{
3138 		.procname	= "redirect_load",
3139 		.data		= &ip_rt_redirect_load,
3140 		.maxlen		= sizeof(int),
3141 		.mode		= 0644,
3142 		.proc_handler	= proc_dointvec,
3143 	},
3144 	{
3145 		.procname	= "redirect_number",
3146 		.data		= &ip_rt_redirect_number,
3147 		.maxlen		= sizeof(int),
3148 		.mode		= 0644,
3149 		.proc_handler	= proc_dointvec,
3150 	},
3151 	{
3152 		.procname	= "redirect_silence",
3153 		.data		= &ip_rt_redirect_silence,
3154 		.maxlen		= sizeof(int),
3155 		.mode		= 0644,
3156 		.proc_handler	= proc_dointvec,
3157 	},
3158 	{
3159 		.procname	= "error_cost",
3160 		.data		= &ip_rt_error_cost,
3161 		.maxlen		= sizeof(int),
3162 		.mode		= 0644,
3163 		.proc_handler	= proc_dointvec,
3164 	},
3165 	{
3166 		.procname	= "error_burst",
3167 		.data		= &ip_rt_error_burst,
3168 		.maxlen		= sizeof(int),
3169 		.mode		= 0644,
3170 		.proc_handler	= proc_dointvec,
3171 	},
3172 	{
3173 		.procname	= "gc_elasticity",
3174 		.data		= &ip_rt_gc_elasticity,
3175 		.maxlen		= sizeof(int),
3176 		.mode		= 0644,
3177 		.proc_handler	= proc_dointvec,
3178 	},
3179 	{
3180 		.procname	= "mtu_expires",
3181 		.data		= &ip_rt_mtu_expires,
3182 		.maxlen		= sizeof(int),
3183 		.mode		= 0644,
3184 		.proc_handler	= proc_dointvec_jiffies,
3185 	},
3186 	{
3187 		.procname	= "min_pmtu",
3188 		.data		= &ip_rt_min_pmtu,
3189 		.maxlen		= sizeof(int),
3190 		.mode		= 0644,
3191 		.proc_handler	= proc_dointvec_minmax,
3192 		.extra1		= &ip_min_valid_pmtu,
3193 	},
3194 	{
3195 		.procname	= "min_adv_mss",
3196 		.data		= &ip_rt_min_advmss,
3197 		.maxlen		= sizeof(int),
3198 		.mode		= 0644,
3199 		.proc_handler	= proc_dointvec,
3200 	},
3201 	{ }
3202 };
3203 
3204 static struct ctl_table ipv4_route_flush_table[] = {
3205 	{
3206 		.procname	= "flush",
3207 		.maxlen		= sizeof(int),
3208 		.mode		= 0200,
3209 		.proc_handler	= ipv4_sysctl_rtcache_flush,
3210 	},
3211 	{ },
3212 };
3213 
3214 static __net_init int sysctl_route_net_init(struct net *net)
3215 {
3216 	struct ctl_table *tbl;
3217 
3218 	tbl = ipv4_route_flush_table;
3219 	if (!net_eq(net, &init_net)) {
3220 		tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
3221 		if (!tbl)
3222 			goto err_dup;
3223 
3224 		/* Don't export sysctls to unprivileged users */
3225 		if (net->user_ns != &init_user_ns)
3226 			tbl[0].procname = NULL;
3227 	}
3228 	tbl[0].extra1 = net;
3229 
3230 	net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
3231 	if (!net->ipv4.route_hdr)
3232 		goto err_reg;
3233 	return 0;
3234 
3235 err_reg:
3236 	if (tbl != ipv4_route_flush_table)
3237 		kfree(tbl);
3238 err_dup:
3239 	return -ENOMEM;
3240 }
3241 
3242 static __net_exit void sysctl_route_net_exit(struct net *net)
3243 {
3244 	struct ctl_table *tbl;
3245 
3246 	tbl = net->ipv4.route_hdr->ctl_table_arg;
3247 	unregister_net_sysctl_table(net->ipv4.route_hdr);
3248 	BUG_ON(tbl == ipv4_route_flush_table);
3249 	kfree(tbl);
3250 }
3251 
3252 static __net_initdata struct pernet_operations sysctl_route_ops = {
3253 	.init = sysctl_route_net_init,
3254 	.exit = sysctl_route_net_exit,
3255 };
3256 #endif
3257 
3258 static __net_init int rt_genid_init(struct net *net)
3259 {
3260 	atomic_set(&net->ipv4.rt_genid, 0);
3261 	atomic_set(&net->fnhe_genid, 0);
3262 	atomic_set(&net->ipv4.dev_addr_genid, get_random_int());
3263 	return 0;
3264 }
3265 
3266 static __net_initdata struct pernet_operations rt_genid_ops = {
3267 	.init = rt_genid_init,
3268 };
3269 
3270 static int __net_init ipv4_inetpeer_init(struct net *net)
3271 {
3272 	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
3273 
3274 	if (!bp)
3275 		return -ENOMEM;
3276 	inet_peer_base_init(bp);
3277 	net->ipv4.peers = bp;
3278 	return 0;
3279 }
3280 
3281 static void __net_exit ipv4_inetpeer_exit(struct net *net)
3282 {
3283 	struct inet_peer_base *bp = net->ipv4.peers;
3284 
3285 	net->ipv4.peers = NULL;
3286 	inetpeer_invalidate_tree(bp);
3287 	kfree(bp);
3288 }
3289 
3290 static __net_initdata struct pernet_operations ipv4_inetpeer_ops = {
3291 	.init	=	ipv4_inetpeer_init,
3292 	.exit	=	ipv4_inetpeer_exit,
3293 };
3294 
3295 #ifdef CONFIG_IP_ROUTE_CLASSID
3296 struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
3297 #endif /* CONFIG_IP_ROUTE_CLASSID */
3298 
3299 int __init ip_rt_init(void)
3300 {
3301 	int cpu;
3302 
3303 	ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
3304 				  GFP_KERNEL);
3305 	if (!ip_idents)
3306 		panic("IP: failed to allocate ip_idents\n");
3307 
3308 	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
3309 
3310 	ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
3311 	if (!ip_tstamps)
3312 		panic("IP: failed to allocate ip_tstamps\n");
3313 
3314 	for_each_possible_cpu(cpu) {
3315 		struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
3316 
3317 		INIT_LIST_HEAD(&ul->head);
3318 		spin_lock_init(&ul->lock);
3319 	}
3320 #ifdef CONFIG_IP_ROUTE_CLASSID
3321 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
3322 	if (!ip_rt_acct)
3323 		panic("IP: failed to allocate ip_rt_acct\n");
3324 #endif
3325 
3326 	ipv4_dst_ops.kmem_cachep =
3327 		kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
3328 				  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
3329 
3330 	ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
3331 
3332 	if (dst_entries_init(&ipv4_dst_ops) < 0)
3333 		panic("IP: failed to allocate ipv4_dst_ops counter\n");
3334 
3335 	if (dst_entries_init(&ipv4_dst_blackhole_ops) < 0)
3336 		panic("IP: failed to allocate ipv4_dst_blackhole_ops counter\n");
3337 
3338 	ipv4_dst_ops.gc_thresh = ~0;
3339 	ip_rt_max_size = INT_MAX;
3340 
3341 	devinet_init();
3342 	ip_fib_init();
3343 
3344 	if (ip_rt_proc_init())
3345 		pr_err("Unable to create route proc files\n");
3346 #ifdef CONFIG_XFRM
3347 	xfrm_init();
3348 	xfrm4_init();
3349 #endif
3350 	rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL,
3351 		      RTNL_FLAG_DOIT_UNLOCKED);
3352 
3353 #ifdef CONFIG_SYSCTL
3354 	register_pernet_subsys(&sysctl_route_ops);
3355 #endif
3356 	register_pernet_subsys(&rt_genid_ops);
3357 	register_pernet_subsys(&ipv4_inetpeer_ops);
3358 	return 0;
3359 }
3360 
3361 #ifdef CONFIG_SYSCTL
3362 /*
3363  * We really need to sanitize the damn ipv4 init order, then all
3364  * this nonsense will go away.
3365  */
3366 void __init ip_static_sysctl_init(void)
3367 {
3368 	register_net_sysctl(&init_net, "net/ipv4/route", ipv4_route_table);
3369 }
3370 #endif
3371