xref: /openbmc/linux/net/ipv4/route.c (revision ca460cc2)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		ROUTE - implementation of the IP router.
7  *
8  * Authors:	Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
11  *		Linus Torvalds, <Linus.Torvalds@helsinki.fi>
12  *		Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
13  *
14  * Fixes:
15  *		Alan Cox	:	Verify area fixes.
16  *		Alan Cox	:	cli() protects routing changes
17  *		Rui Oliveira	:	ICMP routing table updates
18  *		(rco@di.uminho.pt)	Routing table insertion and update
19  *		Linus Torvalds	:	Rewrote bits to be sensible
20  *		Alan Cox	:	Added BSD route gw semantics
21  *		Alan Cox	:	Super /proc >4K
22  *		Alan Cox	:	MTU in route table
23  *		Alan Cox	: 	MSS actually. Also added the window
24  *					clamper.
25  *		Sam Lantinga	:	Fixed route matching in rt_del()
26  *		Alan Cox	:	Routing cache support.
27  *		Alan Cox	:	Removed compatibility cruft.
28  *		Alan Cox	:	RTF_REJECT support.
29  *		Alan Cox	:	TCP irtt support.
30  *		Jonathan Naylor	:	Added Metric support.
31  *	Miquel van Smoorenburg	:	BSD API fixes.
32  *	Miquel van Smoorenburg	:	Metrics.
33  *		Alan Cox	:	Use __u32 properly
34  *		Alan Cox	:	Aligned routing errors more closely with BSD
35  *					our system is still very different.
36  *		Alan Cox	:	Faster /proc handling
37  *	Alexey Kuznetsov	:	Massive rework to support tree based routing,
38  *					routing caches and better behaviour.
39  *
40  *		Olaf Erb	:	irtt wasn't being copied right.
41  *		Bjorn Ekwall	:	Kerneld route support.
42  *		Alan Cox	:	Multicast fixed (I hope)
43  * 		Pavel Krauz	:	Limited broadcast fixed
44  *		Mike McLagan	:	Routing by source
45  *	Alexey Kuznetsov	:	End of old history. Split to fib.c and
46  *					route.c and rewritten from scratch.
47  *		Andi Kleen	:	Load-limit warning messages.
48  *	Vitaly E. Lavrov	:	Transparent proxy revived after year coma.
49  *	Vitaly E. Lavrov	:	Race condition in ip_route_input_slow.
50  *	Tobias Ringstrom	:	Uninitialized res.type in ip_route_output_slow.
51  *	Vladimir V. Ivanov	:	IP rule info (flowid) is really useful.
52  *		Marc Boucher	:	routing by fwmark
53  *	Robert Olsson		:	Added rt_cache statistics
54  *	Arnaldo C. Melo		:	Convert proc stuff to seq_file
55  *	Eric Dumazet		:	hashed spinlocks and rt_check_expire() fixes.
56  * 	Ilia Sotnikov		:	Ignore TOS on PMTUD and Redirect
57  * 	Ilia Sotnikov		:	Removed TOS from hash calculations
58  *
59  *		This program is free software; you can redistribute it and/or
60  *		modify it under the terms of the GNU General Public License
61  *		as published by the Free Software Foundation; either version
62  *		2 of the License, or (at your option) any later version.
63  */
64 
65 #define pr_fmt(fmt) "IPv4: " fmt
66 
67 #include <linux/module.h>
68 #include <asm/uaccess.h>
69 #include <linux/bitops.h>
70 #include <linux/types.h>
71 #include <linux/kernel.h>
72 #include <linux/mm.h>
73 #include <linux/string.h>
74 #include <linux/socket.h>
75 #include <linux/sockios.h>
76 #include <linux/errno.h>
77 #include <linux/in.h>
78 #include <linux/inet.h>
79 #include <linux/netdevice.h>
80 #include <linux/proc_fs.h>
81 #include <linux/init.h>
82 #include <linux/skbuff.h>
83 #include <linux/inetdevice.h>
84 #include <linux/igmp.h>
85 #include <linux/pkt_sched.h>
86 #include <linux/mroute.h>
87 #include <linux/netfilter_ipv4.h>
88 #include <linux/random.h>
89 #include <linux/rcupdate.h>
90 #include <linux/times.h>
91 #include <linux/slab.h>
92 #include <linux/jhash.h>
93 #include <net/dst.h>
94 #include <net/net_namespace.h>
95 #include <net/protocol.h>
96 #include <net/ip.h>
97 #include <net/route.h>
98 #include <net/inetpeer.h>
99 #include <net/sock.h>
100 #include <net/ip_fib.h>
101 #include <net/arp.h>
102 #include <net/tcp.h>
103 #include <net/icmp.h>
104 #include <net/xfrm.h>
105 #include <net/netevent.h>
106 #include <net/rtnetlink.h>
107 #ifdef CONFIG_SYSCTL
108 #include <linux/sysctl.h>
109 #include <linux/kmemleak.h>
110 #endif
111 #include <net/secure_seq.h>
112 
113 #define RT_FL_TOS(oldflp4) \
114 	((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
115 
116 #define RT_GC_TIMEOUT (300*HZ)
117 
118 static int ip_rt_max_size;
119 static int ip_rt_redirect_number __read_mostly	= 9;
120 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
121 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
122 static int ip_rt_error_cost __read_mostly	= HZ;
123 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
124 static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
125 static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
126 static int ip_rt_min_advmss __read_mostly	= 256;
127 
128 /*
129  *	Interface to generic destination cache.
130  */
131 
132 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
133 static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);
134 static unsigned int	 ipv4_mtu(const struct dst_entry *dst);
135 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
136 static void		 ipv4_link_failure(struct sk_buff *skb);
137 static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
138 					   struct sk_buff *skb, u32 mtu);
139 static void		 ip_do_redirect(struct dst_entry *dst, struct sock *sk,
140 					struct sk_buff *skb);
141 static void		ipv4_dst_destroy(struct dst_entry *dst);
142 
143 static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
144 {
145 	WARN_ON(1);
146 	return NULL;
147 }
148 
149 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
150 					   struct sk_buff *skb,
151 					   const void *daddr);
152 
153 static struct dst_ops ipv4_dst_ops = {
154 	.family =		AF_INET,
155 	.protocol =		cpu_to_be16(ETH_P_IP),
156 	.check =		ipv4_dst_check,
157 	.default_advmss =	ipv4_default_advmss,
158 	.mtu =			ipv4_mtu,
159 	.cow_metrics =		ipv4_cow_metrics,
160 	.destroy =		ipv4_dst_destroy,
161 	.negative_advice =	ipv4_negative_advice,
162 	.link_failure =		ipv4_link_failure,
163 	.update_pmtu =		ip_rt_update_pmtu,
164 	.redirect =		ip_do_redirect,
165 	.local_out =		__ip_local_out,
166 	.neigh_lookup =		ipv4_neigh_lookup,
167 };
168 
169 #define ECN_OR_COST(class)	TC_PRIO_##class
170 
171 const __u8 ip_tos2prio[16] = {
172 	TC_PRIO_BESTEFFORT,
173 	ECN_OR_COST(BESTEFFORT),
174 	TC_PRIO_BESTEFFORT,
175 	ECN_OR_COST(BESTEFFORT),
176 	TC_PRIO_BULK,
177 	ECN_OR_COST(BULK),
178 	TC_PRIO_BULK,
179 	ECN_OR_COST(BULK),
180 	TC_PRIO_INTERACTIVE,
181 	ECN_OR_COST(INTERACTIVE),
182 	TC_PRIO_INTERACTIVE,
183 	ECN_OR_COST(INTERACTIVE),
184 	TC_PRIO_INTERACTIVE_BULK,
185 	ECN_OR_COST(INTERACTIVE_BULK),
186 	TC_PRIO_INTERACTIVE_BULK,
187 	ECN_OR_COST(INTERACTIVE_BULK)
188 };
189 EXPORT_SYMBOL(ip_tos2prio);
190 
191 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
192 #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
193 
194 #ifdef CONFIG_PROC_FS
195 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
196 {
197 	if (*pos)
198 		return NULL;
199 	return SEQ_START_TOKEN;
200 }
201 
202 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
203 {
204 	++*pos;
205 	return NULL;
206 }
207 
208 static void rt_cache_seq_stop(struct seq_file *seq, void *v)
209 {
210 }
211 
212 static int rt_cache_seq_show(struct seq_file *seq, void *v)
213 {
214 	if (v == SEQ_START_TOKEN)
215 		seq_printf(seq, "%-127s\n",
216 			   "Iface\tDestination\tGateway \tFlags\t\tRefCnt\tUse\t"
217 			   "Metric\tSource\t\tMTU\tWindow\tIRTT\tTOS\tHHRef\t"
218 			   "HHUptod\tSpecDst");
219 	return 0;
220 }
221 
222 static const struct seq_operations rt_cache_seq_ops = {
223 	.start  = rt_cache_seq_start,
224 	.next   = rt_cache_seq_next,
225 	.stop   = rt_cache_seq_stop,
226 	.show   = rt_cache_seq_show,
227 };
228 
229 static int rt_cache_seq_open(struct inode *inode, struct file *file)
230 {
231 	return seq_open(file, &rt_cache_seq_ops);
232 }
233 
234 static const struct file_operations rt_cache_seq_fops = {
235 	.owner	 = THIS_MODULE,
236 	.open	 = rt_cache_seq_open,
237 	.read	 = seq_read,
238 	.llseek	 = seq_lseek,
239 	.release = seq_release,
240 };
241 
242 
243 static void *rt_cpu_seq_start(struct seq_file *seq, loff_t *pos)
244 {
245 	int cpu;
246 
247 	if (*pos == 0)
248 		return SEQ_START_TOKEN;
249 
250 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
251 		if (!cpu_possible(cpu))
252 			continue;
253 		*pos = cpu+1;
254 		return &per_cpu(rt_cache_stat, cpu);
255 	}
256 	return NULL;
257 }
258 
259 static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
260 {
261 	int cpu;
262 
263 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
264 		if (!cpu_possible(cpu))
265 			continue;
266 		*pos = cpu+1;
267 		return &per_cpu(rt_cache_stat, cpu);
268 	}
269 	return NULL;
270 
271 }
272 
273 static void rt_cpu_seq_stop(struct seq_file *seq, void *v)
274 {
275 
276 }
277 
278 static int rt_cpu_seq_show(struct seq_file *seq, void *v)
279 {
280 	struct rt_cache_stat *st = v;
281 
282 	if (v == SEQ_START_TOKEN) {
283 		seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
284 		return 0;
285 	}
286 
287 	seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
288 		   " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
289 		   dst_entries_get_slow(&ipv4_dst_ops),
290 		   0, /* st->in_hit */
291 		   st->in_slow_tot,
292 		   st->in_slow_mc,
293 		   st->in_no_route,
294 		   st->in_brd,
295 		   st->in_martian_dst,
296 		   st->in_martian_src,
297 
298 		   0, /* st->out_hit */
299 		   st->out_slow_tot,
300 		   st->out_slow_mc,
301 
302 		   0, /* st->gc_total */
303 		   0, /* st->gc_ignored */
304 		   0, /* st->gc_goal_miss */
305 		   0, /* st->gc_dst_overflow */
306 		   0, /* st->in_hlist_search */
307 		   0  /* st->out_hlist_search */
308 		);
309 	return 0;
310 }
311 
312 static const struct seq_operations rt_cpu_seq_ops = {
313 	.start  = rt_cpu_seq_start,
314 	.next   = rt_cpu_seq_next,
315 	.stop   = rt_cpu_seq_stop,
316 	.show   = rt_cpu_seq_show,
317 };
318 
319 
320 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
321 {
322 	return seq_open(file, &rt_cpu_seq_ops);
323 }
324 
325 static const struct file_operations rt_cpu_seq_fops = {
326 	.owner	 = THIS_MODULE,
327 	.open	 = rt_cpu_seq_open,
328 	.read	 = seq_read,
329 	.llseek	 = seq_lseek,
330 	.release = seq_release,
331 };
332 
333 #ifdef CONFIG_IP_ROUTE_CLASSID
334 static int rt_acct_proc_show(struct seq_file *m, void *v)
335 {
336 	struct ip_rt_acct *dst, *src;
337 	unsigned int i, j;
338 
339 	dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
340 	if (!dst)
341 		return -ENOMEM;
342 
343 	for_each_possible_cpu(i) {
344 		src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
345 		for (j = 0; j < 256; j++) {
346 			dst[j].o_bytes   += src[j].o_bytes;
347 			dst[j].o_packets += src[j].o_packets;
348 			dst[j].i_bytes   += src[j].i_bytes;
349 			dst[j].i_packets += src[j].i_packets;
350 		}
351 	}
352 
353 	seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
354 	kfree(dst);
355 	return 0;
356 }
357 
358 static int rt_acct_proc_open(struct inode *inode, struct file *file)
359 {
360 	return single_open(file, rt_acct_proc_show, NULL);
361 }
362 
363 static const struct file_operations rt_acct_proc_fops = {
364 	.owner		= THIS_MODULE,
365 	.open		= rt_acct_proc_open,
366 	.read		= seq_read,
367 	.llseek		= seq_lseek,
368 	.release	= single_release,
369 };
370 #endif
371 
372 static int __net_init ip_rt_do_proc_init(struct net *net)
373 {
374 	struct proc_dir_entry *pde;
375 
376 	pde = proc_create("rt_cache", S_IRUGO, net->proc_net,
377 			  &rt_cache_seq_fops);
378 	if (!pde)
379 		goto err1;
380 
381 	pde = proc_create("rt_cache", S_IRUGO,
382 			  net->proc_net_stat, &rt_cpu_seq_fops);
383 	if (!pde)
384 		goto err2;
385 
386 #ifdef CONFIG_IP_ROUTE_CLASSID
387 	pde = proc_create("rt_acct", 0, net->proc_net, &rt_acct_proc_fops);
388 	if (!pde)
389 		goto err3;
390 #endif
391 	return 0;
392 
393 #ifdef CONFIG_IP_ROUTE_CLASSID
394 err3:
395 	remove_proc_entry("rt_cache", net->proc_net_stat);
396 #endif
397 err2:
398 	remove_proc_entry("rt_cache", net->proc_net);
399 err1:
400 	return -ENOMEM;
401 }
402 
403 static void __net_exit ip_rt_do_proc_exit(struct net *net)
404 {
405 	remove_proc_entry("rt_cache", net->proc_net_stat);
406 	remove_proc_entry("rt_cache", net->proc_net);
407 #ifdef CONFIG_IP_ROUTE_CLASSID
408 	remove_proc_entry("rt_acct", net->proc_net);
409 #endif
410 }
411 
412 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
413 	.init = ip_rt_do_proc_init,
414 	.exit = ip_rt_do_proc_exit,
415 };
416 
417 static int __init ip_rt_proc_init(void)
418 {
419 	return register_pernet_subsys(&ip_rt_proc_ops);
420 }
421 
422 #else
423 static inline int ip_rt_proc_init(void)
424 {
425 	return 0;
426 }
427 #endif /* CONFIG_PROC_FS */
428 
429 static inline bool rt_is_expired(const struct rtable *rth)
430 {
431 	return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
432 }
433 
434 void rt_cache_flush(struct net *net)
435 {
436 	rt_genid_bump_ipv4(net);
437 }
438 
439 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
440 					   struct sk_buff *skb,
441 					   const void *daddr)
442 {
443 	struct net_device *dev = dst->dev;
444 	const __be32 *pkey = daddr;
445 	const struct rtable *rt;
446 	struct neighbour *n;
447 
448 	rt = (const struct rtable *) dst;
449 	if (rt->rt_gateway)
450 		pkey = (const __be32 *) &rt->rt_gateway;
451 	else if (skb)
452 		pkey = &ip_hdr(skb)->daddr;
453 
454 	n = __ipv4_neigh_lookup(dev, *(__force u32 *)pkey);
455 	if (n)
456 		return n;
457 	return neigh_create(&arp_tbl, pkey, dev);
458 }
459 
460 #define IP_IDENTS_SZ 2048u
461 struct ip_ident_bucket {
462 	atomic_t	id;
463 	u32		stamp32;
464 };
465 
466 static struct ip_ident_bucket *ip_idents __read_mostly;
467 
468 /* In order to protect privacy, we add a perturbation to identifiers
469  * if one generator is seldom used. This makes hard for an attacker
470  * to infer how many packets were sent between two points in time.
471  */
472 u32 ip_idents_reserve(u32 hash, int segs)
473 {
474 	struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
475 	u32 old = ACCESS_ONCE(bucket->stamp32);
476 	u32 now = (u32)jiffies;
477 	u32 delta = 0;
478 
479 	if (old != now && cmpxchg(&bucket->stamp32, old, now) == old)
480 		delta = prandom_u32_max(now - old);
481 
482 	return atomic_add_return(segs + delta, &bucket->id) - segs;
483 }
484 EXPORT_SYMBOL(ip_idents_reserve);
485 
486 void __ip_select_ident(struct iphdr *iph, int segs)
487 {
488 	static u32 ip_idents_hashrnd __read_mostly;
489 	u32 hash, id;
490 
491 	net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
492 
493 	hash = jhash_3words((__force u32)iph->daddr,
494 			    (__force u32)iph->saddr,
495 			    iph->protocol,
496 			    ip_idents_hashrnd);
497 	id = ip_idents_reserve(hash, segs);
498 	iph->id = htons(id);
499 }
500 EXPORT_SYMBOL(__ip_select_ident);
501 
502 static void __build_flow_key(struct flowi4 *fl4, const struct sock *sk,
503 			     const struct iphdr *iph,
504 			     int oif, u8 tos,
505 			     u8 prot, u32 mark, int flow_flags)
506 {
507 	if (sk) {
508 		const struct inet_sock *inet = inet_sk(sk);
509 
510 		oif = sk->sk_bound_dev_if;
511 		mark = sk->sk_mark;
512 		tos = RT_CONN_FLAGS(sk);
513 		prot = inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol;
514 	}
515 	flowi4_init_output(fl4, oif, mark, tos,
516 			   RT_SCOPE_UNIVERSE, prot,
517 			   flow_flags,
518 			   iph->daddr, iph->saddr, 0, 0);
519 }
520 
521 static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
522 			       const struct sock *sk)
523 {
524 	const struct iphdr *iph = ip_hdr(skb);
525 	int oif = skb->dev->ifindex;
526 	u8 tos = RT_TOS(iph->tos);
527 	u8 prot = iph->protocol;
528 	u32 mark = skb->mark;
529 
530 	__build_flow_key(fl4, sk, iph, oif, tos, prot, mark, 0);
531 }
532 
533 static void build_sk_flow_key(struct flowi4 *fl4, const struct sock *sk)
534 {
535 	const struct inet_sock *inet = inet_sk(sk);
536 	const struct ip_options_rcu *inet_opt;
537 	__be32 daddr = inet->inet_daddr;
538 
539 	rcu_read_lock();
540 	inet_opt = rcu_dereference(inet->inet_opt);
541 	if (inet_opt && inet_opt->opt.srr)
542 		daddr = inet_opt->opt.faddr;
543 	flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
544 			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
545 			   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
546 			   inet_sk_flowi_flags(sk),
547 			   daddr, inet->inet_saddr, 0, 0);
548 	rcu_read_unlock();
549 }
550 
551 static void ip_rt_build_flow_key(struct flowi4 *fl4, const struct sock *sk,
552 				 const struct sk_buff *skb)
553 {
554 	if (skb)
555 		build_skb_flow_key(fl4, skb, sk);
556 	else
557 		build_sk_flow_key(fl4, sk);
558 }
559 
560 static inline void rt_free(struct rtable *rt)
561 {
562 	call_rcu(&rt->dst.rcu_head, dst_rcu_free);
563 }
564 
565 static DEFINE_SPINLOCK(fnhe_lock);
566 
567 static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
568 {
569 	struct rtable *rt;
570 
571 	rt = rcu_dereference(fnhe->fnhe_rth_input);
572 	if (rt) {
573 		RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
574 		rt_free(rt);
575 	}
576 	rt = rcu_dereference(fnhe->fnhe_rth_output);
577 	if (rt) {
578 		RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
579 		rt_free(rt);
580 	}
581 }
582 
583 static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
584 {
585 	struct fib_nh_exception *fnhe, *oldest;
586 
587 	oldest = rcu_dereference(hash->chain);
588 	for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
589 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
590 		if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
591 			oldest = fnhe;
592 	}
593 	fnhe_flush_routes(oldest);
594 	return oldest;
595 }
596 
597 static inline u32 fnhe_hashfun(__be32 daddr)
598 {
599 	static u32 fnhe_hashrnd __read_mostly;
600 	u32 hval;
601 
602 	net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
603 	hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
604 	return hash_32(hval, FNHE_HASH_SHIFT);
605 }
606 
607 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
608 {
609 	rt->rt_pmtu = fnhe->fnhe_pmtu;
610 	rt->dst.expires = fnhe->fnhe_expires;
611 
612 	if (fnhe->fnhe_gw) {
613 		rt->rt_flags |= RTCF_REDIRECTED;
614 		rt->rt_gateway = fnhe->fnhe_gw;
615 		rt->rt_uses_gateway = 1;
616 	}
617 }
618 
619 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
620 				  u32 pmtu, unsigned long expires)
621 {
622 	struct fnhe_hash_bucket *hash;
623 	struct fib_nh_exception *fnhe;
624 	struct rtable *rt;
625 	unsigned int i;
626 	int depth;
627 	u32 hval = fnhe_hashfun(daddr);
628 
629 	spin_lock_bh(&fnhe_lock);
630 
631 	hash = rcu_dereference(nh->nh_exceptions);
632 	if (!hash) {
633 		hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);
634 		if (!hash)
635 			goto out_unlock;
636 		rcu_assign_pointer(nh->nh_exceptions, hash);
637 	}
638 
639 	hash += hval;
640 
641 	depth = 0;
642 	for (fnhe = rcu_dereference(hash->chain); fnhe;
643 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
644 		if (fnhe->fnhe_daddr == daddr)
645 			break;
646 		depth++;
647 	}
648 
649 	if (fnhe) {
650 		if (gw)
651 			fnhe->fnhe_gw = gw;
652 		if (pmtu) {
653 			fnhe->fnhe_pmtu = pmtu;
654 			fnhe->fnhe_expires = max(1UL, expires);
655 		}
656 		/* Update all cached dsts too */
657 		rt = rcu_dereference(fnhe->fnhe_rth_input);
658 		if (rt)
659 			fill_route_from_fnhe(rt, fnhe);
660 		rt = rcu_dereference(fnhe->fnhe_rth_output);
661 		if (rt)
662 			fill_route_from_fnhe(rt, fnhe);
663 	} else {
664 		if (depth > FNHE_RECLAIM_DEPTH)
665 			fnhe = fnhe_oldest(hash);
666 		else {
667 			fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
668 			if (!fnhe)
669 				goto out_unlock;
670 
671 			fnhe->fnhe_next = hash->chain;
672 			rcu_assign_pointer(hash->chain, fnhe);
673 		}
674 		fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
675 		fnhe->fnhe_daddr = daddr;
676 		fnhe->fnhe_gw = gw;
677 		fnhe->fnhe_pmtu = pmtu;
678 		fnhe->fnhe_expires = expires;
679 
680 		/* Exception created; mark the cached routes for the nexthop
681 		 * stale, so anyone caching it rechecks if this exception
682 		 * applies to them.
683 		 */
684 		rt = rcu_dereference(nh->nh_rth_input);
685 		if (rt)
686 			rt->dst.obsolete = DST_OBSOLETE_KILL;
687 
688 		for_each_possible_cpu(i) {
689 			struct rtable __rcu **prt;
690 			prt = per_cpu_ptr(nh->nh_pcpu_rth_output, i);
691 			rt = rcu_dereference(*prt);
692 			if (rt)
693 				rt->dst.obsolete = DST_OBSOLETE_KILL;
694 		}
695 	}
696 
697 	fnhe->fnhe_stamp = jiffies;
698 
699 out_unlock:
700 	spin_unlock_bh(&fnhe_lock);
701 }
702 
703 static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flowi4 *fl4,
704 			     bool kill_route)
705 {
706 	__be32 new_gw = icmp_hdr(skb)->un.gateway;
707 	__be32 old_gw = ip_hdr(skb)->saddr;
708 	struct net_device *dev = skb->dev;
709 	struct in_device *in_dev;
710 	struct fib_result res;
711 	struct neighbour *n;
712 	struct net *net;
713 
714 	switch (icmp_hdr(skb)->code & 7) {
715 	case ICMP_REDIR_NET:
716 	case ICMP_REDIR_NETTOS:
717 	case ICMP_REDIR_HOST:
718 	case ICMP_REDIR_HOSTTOS:
719 		break;
720 
721 	default:
722 		return;
723 	}
724 
725 	if (rt->rt_gateway != old_gw)
726 		return;
727 
728 	in_dev = __in_dev_get_rcu(dev);
729 	if (!in_dev)
730 		return;
731 
732 	net = dev_net(dev);
733 	if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
734 	    ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
735 	    ipv4_is_zeronet(new_gw))
736 		goto reject_redirect;
737 
738 	if (!IN_DEV_SHARED_MEDIA(in_dev)) {
739 		if (!inet_addr_onlink(in_dev, new_gw, old_gw))
740 			goto reject_redirect;
741 		if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
742 			goto reject_redirect;
743 	} else {
744 		if (inet_addr_type(net, new_gw) != RTN_UNICAST)
745 			goto reject_redirect;
746 	}
747 
748 	n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
749 	if (!IS_ERR(n)) {
750 		if (!(n->nud_state & NUD_VALID)) {
751 			neigh_event_send(n, NULL);
752 		} else {
753 			if (fib_lookup(net, fl4, &res) == 0) {
754 				struct fib_nh *nh = &FIB_RES_NH(res);
755 
756 				update_or_create_fnhe(nh, fl4->daddr, new_gw,
757 						      0, 0);
758 			}
759 			if (kill_route)
760 				rt->dst.obsolete = DST_OBSOLETE_KILL;
761 			call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
762 		}
763 		neigh_release(n);
764 	}
765 	return;
766 
767 reject_redirect:
768 #ifdef CONFIG_IP_ROUTE_VERBOSE
769 	if (IN_DEV_LOG_MARTIANS(in_dev)) {
770 		const struct iphdr *iph = (const struct iphdr *) skb->data;
771 		__be32 daddr = iph->daddr;
772 		__be32 saddr = iph->saddr;
773 
774 		net_info_ratelimited("Redirect from %pI4 on %s about %pI4 ignored\n"
775 				     "  Advised path = %pI4 -> %pI4\n",
776 				     &old_gw, dev->name, &new_gw,
777 				     &saddr, &daddr);
778 	}
779 #endif
780 	;
781 }
782 
783 static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
784 {
785 	struct rtable *rt;
786 	struct flowi4 fl4;
787 	const struct iphdr *iph = (const struct iphdr *) skb->data;
788 	int oif = skb->dev->ifindex;
789 	u8 tos = RT_TOS(iph->tos);
790 	u8 prot = iph->protocol;
791 	u32 mark = skb->mark;
792 
793 	rt = (struct rtable *) dst;
794 
795 	__build_flow_key(&fl4, sk, iph, oif, tos, prot, mark, 0);
796 	__ip_do_redirect(rt, skb, &fl4, true);
797 }
798 
799 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
800 {
801 	struct rtable *rt = (struct rtable *)dst;
802 	struct dst_entry *ret = dst;
803 
804 	if (rt) {
805 		if (dst->obsolete > 0) {
806 			ip_rt_put(rt);
807 			ret = NULL;
808 		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
809 			   rt->dst.expires) {
810 			ip_rt_put(rt);
811 			ret = NULL;
812 		}
813 	}
814 	return ret;
815 }
816 
817 /*
818  * Algorithm:
819  *	1. The first ip_rt_redirect_number redirects are sent
820  *	   with exponential backoff, then we stop sending them at all,
821  *	   assuming that the host ignores our redirects.
822  *	2. If we did not see packets requiring redirects
823  *	   during ip_rt_redirect_silence, we assume that the host
824  *	   forgot redirected route and start to send redirects again.
825  *
826  * This algorithm is much cheaper and more intelligent than dumb load limiting
827  * in icmp.c.
828  *
829  * NOTE. Do not forget to inhibit load limiting for redirects (redundant)
830  * and "frag. need" (breaks PMTU discovery) in icmp.c.
831  */
832 
833 void ip_rt_send_redirect(struct sk_buff *skb)
834 {
835 	struct rtable *rt = skb_rtable(skb);
836 	struct in_device *in_dev;
837 	struct inet_peer *peer;
838 	struct net *net;
839 	int log_martians;
840 
841 	rcu_read_lock();
842 	in_dev = __in_dev_get_rcu(rt->dst.dev);
843 	if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
844 		rcu_read_unlock();
845 		return;
846 	}
847 	log_martians = IN_DEV_LOG_MARTIANS(in_dev);
848 	rcu_read_unlock();
849 
850 	net = dev_net(rt->dst.dev);
851 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
852 	if (!peer) {
853 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
854 			  rt_nexthop(rt, ip_hdr(skb)->daddr));
855 		return;
856 	}
857 
858 	/* No redirected packets during ip_rt_redirect_silence;
859 	 * reset the algorithm.
860 	 */
861 	if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
862 		peer->rate_tokens = 0;
863 
864 	/* Too many ignored redirects; do not send anything
865 	 * set dst.rate_last to the last seen redirected packet.
866 	 */
867 	if (peer->rate_tokens >= ip_rt_redirect_number) {
868 		peer->rate_last = jiffies;
869 		goto out_put_peer;
870 	}
871 
872 	/* Check for load limit; set rate_last to the latest sent
873 	 * redirect.
874 	 */
875 	if (peer->rate_tokens == 0 ||
876 	    time_after(jiffies,
877 		       (peer->rate_last +
878 			(ip_rt_redirect_load << peer->rate_tokens)))) {
879 		__be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
880 
881 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
882 		peer->rate_last = jiffies;
883 		++peer->rate_tokens;
884 #ifdef CONFIG_IP_ROUTE_VERBOSE
885 		if (log_martians &&
886 		    peer->rate_tokens == ip_rt_redirect_number)
887 			net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
888 					     &ip_hdr(skb)->saddr, inet_iif(skb),
889 					     &ip_hdr(skb)->daddr, &gw);
890 #endif
891 	}
892 out_put_peer:
893 	inet_putpeer(peer);
894 }
895 
896 static int ip_error(struct sk_buff *skb)
897 {
898 	struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
899 	struct rtable *rt = skb_rtable(skb);
900 	struct inet_peer *peer;
901 	unsigned long now;
902 	struct net *net;
903 	bool send;
904 	int code;
905 
906 	net = dev_net(rt->dst.dev);
907 	if (!IN_DEV_FORWARD(in_dev)) {
908 		switch (rt->dst.error) {
909 		case EHOSTUNREACH:
910 			IP_INC_STATS_BH(net, IPSTATS_MIB_INADDRERRORS);
911 			break;
912 
913 		case ENETUNREACH:
914 			IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
915 			break;
916 		}
917 		goto out;
918 	}
919 
920 	switch (rt->dst.error) {
921 	case EINVAL:
922 	default:
923 		goto out;
924 	case EHOSTUNREACH:
925 		code = ICMP_HOST_UNREACH;
926 		break;
927 	case ENETUNREACH:
928 		code = ICMP_NET_UNREACH;
929 		IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
930 		break;
931 	case EACCES:
932 		code = ICMP_PKT_FILTERED;
933 		break;
934 	}
935 
936 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
937 
938 	send = true;
939 	if (peer) {
940 		now = jiffies;
941 		peer->rate_tokens += now - peer->rate_last;
942 		if (peer->rate_tokens > ip_rt_error_burst)
943 			peer->rate_tokens = ip_rt_error_burst;
944 		peer->rate_last = now;
945 		if (peer->rate_tokens >= ip_rt_error_cost)
946 			peer->rate_tokens -= ip_rt_error_cost;
947 		else
948 			send = false;
949 		inet_putpeer(peer);
950 	}
951 	if (send)
952 		icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
953 
954 out:	kfree_skb(skb);
955 	return 0;
956 }
957 
958 static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
959 {
960 	struct dst_entry *dst = &rt->dst;
961 	struct fib_result res;
962 
963 	if (dst_metric_locked(dst, RTAX_MTU))
964 		return;
965 
966 	if (dst->dev->mtu < mtu)
967 		return;
968 
969 	if (mtu < ip_rt_min_pmtu)
970 		mtu = ip_rt_min_pmtu;
971 
972 	if (rt->rt_pmtu == mtu &&
973 	    time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
974 		return;
975 
976 	rcu_read_lock();
977 	if (fib_lookup(dev_net(dst->dev), fl4, &res) == 0) {
978 		struct fib_nh *nh = &FIB_RES_NH(res);
979 
980 		update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
981 				      jiffies + ip_rt_mtu_expires);
982 	}
983 	rcu_read_unlock();
984 }
985 
986 static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
987 			      struct sk_buff *skb, u32 mtu)
988 {
989 	struct rtable *rt = (struct rtable *) dst;
990 	struct flowi4 fl4;
991 
992 	ip_rt_build_flow_key(&fl4, sk, skb);
993 	__ip_rt_update_pmtu(rt, &fl4, mtu);
994 }
995 
996 void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
997 		      int oif, u32 mark, u8 protocol, int flow_flags)
998 {
999 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1000 	struct flowi4 fl4;
1001 	struct rtable *rt;
1002 
1003 	if (!mark)
1004 		mark = IP4_REPLY_MARK(net, skb->mark);
1005 
1006 	__build_flow_key(&fl4, NULL, iph, oif,
1007 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1008 	rt = __ip_route_output_key(net, &fl4);
1009 	if (!IS_ERR(rt)) {
1010 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1011 		ip_rt_put(rt);
1012 	}
1013 }
1014 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
1015 
1016 static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1017 {
1018 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1019 	struct flowi4 fl4;
1020 	struct rtable *rt;
1021 
1022 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1023 
1024 	if (!fl4.flowi4_mark)
1025 		fl4.flowi4_mark = IP4_REPLY_MARK(sock_net(sk), skb->mark);
1026 
1027 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1028 	if (!IS_ERR(rt)) {
1029 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1030 		ip_rt_put(rt);
1031 	}
1032 }
1033 
1034 void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1035 {
1036 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1037 	struct flowi4 fl4;
1038 	struct rtable *rt;
1039 	struct dst_entry *odst = NULL;
1040 	bool new = false;
1041 
1042 	bh_lock_sock(sk);
1043 
1044 	if (!ip_sk_accept_pmtu(sk))
1045 		goto out;
1046 
1047 	odst = sk_dst_get(sk);
1048 
1049 	if (sock_owned_by_user(sk) || !odst) {
1050 		__ipv4_sk_update_pmtu(skb, sk, mtu);
1051 		goto out;
1052 	}
1053 
1054 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1055 
1056 	rt = (struct rtable *)odst;
1057 	if (odst->obsolete && odst->ops->check(odst, 0) == NULL) {
1058 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1059 		if (IS_ERR(rt))
1060 			goto out;
1061 
1062 		new = true;
1063 	}
1064 
1065 	__ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
1066 
1067 	if (!dst_check(&rt->dst, 0)) {
1068 		if (new)
1069 			dst_release(&rt->dst);
1070 
1071 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1072 		if (IS_ERR(rt))
1073 			goto out;
1074 
1075 		new = true;
1076 	}
1077 
1078 	if (new)
1079 		sk_dst_set(sk, &rt->dst);
1080 
1081 out:
1082 	bh_unlock_sock(sk);
1083 	dst_release(odst);
1084 }
1085 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
1086 
1087 void ipv4_redirect(struct sk_buff *skb, struct net *net,
1088 		   int oif, u32 mark, u8 protocol, int flow_flags)
1089 {
1090 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1091 	struct flowi4 fl4;
1092 	struct rtable *rt;
1093 
1094 	__build_flow_key(&fl4, NULL, iph, oif,
1095 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1096 	rt = __ip_route_output_key(net, &fl4);
1097 	if (!IS_ERR(rt)) {
1098 		__ip_do_redirect(rt, skb, &fl4, false);
1099 		ip_rt_put(rt);
1100 	}
1101 }
1102 EXPORT_SYMBOL_GPL(ipv4_redirect);
1103 
1104 void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk)
1105 {
1106 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1107 	struct flowi4 fl4;
1108 	struct rtable *rt;
1109 
1110 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1111 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1112 	if (!IS_ERR(rt)) {
1113 		__ip_do_redirect(rt, skb, &fl4, false);
1114 		ip_rt_put(rt);
1115 	}
1116 }
1117 EXPORT_SYMBOL_GPL(ipv4_sk_redirect);
1118 
1119 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
1120 {
1121 	struct rtable *rt = (struct rtable *) dst;
1122 
1123 	/* All IPV4 dsts are created with ->obsolete set to the value
1124 	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
1125 	 * into this function always.
1126 	 *
1127 	 * When a PMTU/redirect information update invalidates a route,
1128 	 * this is indicated by setting obsolete to DST_OBSOLETE_KILL or
1129 	 * DST_OBSOLETE_DEAD by dst_free().
1130 	 */
1131 	if (dst->obsolete != DST_OBSOLETE_FORCE_CHK || rt_is_expired(rt))
1132 		return NULL;
1133 	return dst;
1134 }
1135 
1136 static void ipv4_link_failure(struct sk_buff *skb)
1137 {
1138 	struct rtable *rt;
1139 
1140 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
1141 
1142 	rt = skb_rtable(skb);
1143 	if (rt)
1144 		dst_set_expires(&rt->dst, 0);
1145 }
1146 
1147 static int ip_rt_bug(struct sock *sk, struct sk_buff *skb)
1148 {
1149 	pr_debug("%s: %pI4 -> %pI4, %s\n",
1150 		 __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
1151 		 skb->dev ? skb->dev->name : "?");
1152 	kfree_skb(skb);
1153 	WARN_ON(1);
1154 	return 0;
1155 }
1156 
1157 /*
1158    We do not cache source address of outgoing interface,
1159    because it is used only by IP RR, TS and SRR options,
1160    so that it out of fast path.
1161 
1162    BTW remember: "addr" is allowed to be not aligned
1163    in IP options!
1164  */
1165 
1166 void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
1167 {
1168 	__be32 src;
1169 
1170 	if (rt_is_output_route(rt))
1171 		src = ip_hdr(skb)->saddr;
1172 	else {
1173 		struct fib_result res;
1174 		struct flowi4 fl4;
1175 		struct iphdr *iph;
1176 
1177 		iph = ip_hdr(skb);
1178 
1179 		memset(&fl4, 0, sizeof(fl4));
1180 		fl4.daddr = iph->daddr;
1181 		fl4.saddr = iph->saddr;
1182 		fl4.flowi4_tos = RT_TOS(iph->tos);
1183 		fl4.flowi4_oif = rt->dst.dev->ifindex;
1184 		fl4.flowi4_iif = skb->dev->ifindex;
1185 		fl4.flowi4_mark = skb->mark;
1186 
1187 		rcu_read_lock();
1188 		if (fib_lookup(dev_net(rt->dst.dev), &fl4, &res) == 0)
1189 			src = FIB_RES_PREFSRC(dev_net(rt->dst.dev), res);
1190 		else
1191 			src = inet_select_addr(rt->dst.dev,
1192 					       rt_nexthop(rt, iph->daddr),
1193 					       RT_SCOPE_UNIVERSE);
1194 		rcu_read_unlock();
1195 	}
1196 	memcpy(addr, &src, 4);
1197 }
1198 
1199 #ifdef CONFIG_IP_ROUTE_CLASSID
1200 static void set_class_tag(struct rtable *rt, u32 tag)
1201 {
1202 	if (!(rt->dst.tclassid & 0xFFFF))
1203 		rt->dst.tclassid |= tag & 0xFFFF;
1204 	if (!(rt->dst.tclassid & 0xFFFF0000))
1205 		rt->dst.tclassid |= tag & 0xFFFF0000;
1206 }
1207 #endif
1208 
1209 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
1210 {
1211 	unsigned int advmss = dst_metric_raw(dst, RTAX_ADVMSS);
1212 
1213 	if (advmss == 0) {
1214 		advmss = max_t(unsigned int, dst->dev->mtu - 40,
1215 			       ip_rt_min_advmss);
1216 		if (advmss > 65535 - 40)
1217 			advmss = 65535 - 40;
1218 	}
1219 	return advmss;
1220 }
1221 
1222 static unsigned int ipv4_mtu(const struct dst_entry *dst)
1223 {
1224 	const struct rtable *rt = (const struct rtable *) dst;
1225 	unsigned int mtu = rt->rt_pmtu;
1226 
1227 	if (!mtu || time_after_eq(jiffies, rt->dst.expires))
1228 		mtu = dst_metric_raw(dst, RTAX_MTU);
1229 
1230 	if (mtu)
1231 		return mtu;
1232 
1233 	mtu = dst->dev->mtu;
1234 
1235 	if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
1236 		if (rt->rt_uses_gateway && mtu > 576)
1237 			mtu = 576;
1238 	}
1239 
1240 	return min_t(unsigned int, mtu, IP_MAX_MTU);
1241 }
1242 
1243 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
1244 {
1245 	struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);
1246 	struct fib_nh_exception *fnhe;
1247 	u32 hval;
1248 
1249 	if (!hash)
1250 		return NULL;
1251 
1252 	hval = fnhe_hashfun(daddr);
1253 
1254 	for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
1255 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
1256 		if (fnhe->fnhe_daddr == daddr)
1257 			return fnhe;
1258 	}
1259 	return NULL;
1260 }
1261 
1262 static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
1263 			      __be32 daddr)
1264 {
1265 	bool ret = false;
1266 
1267 	spin_lock_bh(&fnhe_lock);
1268 
1269 	if (daddr == fnhe->fnhe_daddr) {
1270 		struct rtable __rcu **porig;
1271 		struct rtable *orig;
1272 		int genid = fnhe_genid(dev_net(rt->dst.dev));
1273 
1274 		if (rt_is_input_route(rt))
1275 			porig = &fnhe->fnhe_rth_input;
1276 		else
1277 			porig = &fnhe->fnhe_rth_output;
1278 		orig = rcu_dereference(*porig);
1279 
1280 		if (fnhe->fnhe_genid != genid) {
1281 			fnhe->fnhe_genid = genid;
1282 			fnhe->fnhe_gw = 0;
1283 			fnhe->fnhe_pmtu = 0;
1284 			fnhe->fnhe_expires = 0;
1285 			fnhe_flush_routes(fnhe);
1286 			orig = NULL;
1287 		}
1288 		fill_route_from_fnhe(rt, fnhe);
1289 		if (!rt->rt_gateway)
1290 			rt->rt_gateway = daddr;
1291 
1292 		if (!(rt->dst.flags & DST_NOCACHE)) {
1293 			rcu_assign_pointer(*porig, rt);
1294 			if (orig)
1295 				rt_free(orig);
1296 			ret = true;
1297 		}
1298 
1299 		fnhe->fnhe_stamp = jiffies;
1300 	}
1301 	spin_unlock_bh(&fnhe_lock);
1302 
1303 	return ret;
1304 }
1305 
1306 static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
1307 {
1308 	struct rtable *orig, *prev, **p;
1309 	bool ret = true;
1310 
1311 	if (rt_is_input_route(rt)) {
1312 		p = (struct rtable **)&nh->nh_rth_input;
1313 	} else {
1314 		p = (struct rtable **)raw_cpu_ptr(nh->nh_pcpu_rth_output);
1315 	}
1316 	orig = *p;
1317 
1318 	prev = cmpxchg(p, orig, rt);
1319 	if (prev == orig) {
1320 		if (orig)
1321 			rt_free(orig);
1322 	} else
1323 		ret = false;
1324 
1325 	return ret;
1326 }
1327 
1328 static DEFINE_SPINLOCK(rt_uncached_lock);
1329 static LIST_HEAD(rt_uncached_list);
1330 
1331 static void rt_add_uncached_list(struct rtable *rt)
1332 {
1333 	spin_lock_bh(&rt_uncached_lock);
1334 	list_add_tail(&rt->rt_uncached, &rt_uncached_list);
1335 	spin_unlock_bh(&rt_uncached_lock);
1336 }
1337 
1338 static void ipv4_dst_destroy(struct dst_entry *dst)
1339 {
1340 	struct rtable *rt = (struct rtable *) dst;
1341 
1342 	if (!list_empty(&rt->rt_uncached)) {
1343 		spin_lock_bh(&rt_uncached_lock);
1344 		list_del(&rt->rt_uncached);
1345 		spin_unlock_bh(&rt_uncached_lock);
1346 	}
1347 }
1348 
1349 void rt_flush_dev(struct net_device *dev)
1350 {
1351 	if (!list_empty(&rt_uncached_list)) {
1352 		struct net *net = dev_net(dev);
1353 		struct rtable *rt;
1354 
1355 		spin_lock_bh(&rt_uncached_lock);
1356 		list_for_each_entry(rt, &rt_uncached_list, rt_uncached) {
1357 			if (rt->dst.dev != dev)
1358 				continue;
1359 			rt->dst.dev = net->loopback_dev;
1360 			dev_hold(rt->dst.dev);
1361 			dev_put(dev);
1362 		}
1363 		spin_unlock_bh(&rt_uncached_lock);
1364 	}
1365 }
1366 
1367 static bool rt_cache_valid(const struct rtable *rt)
1368 {
1369 	return	rt &&
1370 		rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1371 		!rt_is_expired(rt);
1372 }
1373 
1374 static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
1375 			   const struct fib_result *res,
1376 			   struct fib_nh_exception *fnhe,
1377 			   struct fib_info *fi, u16 type, u32 itag)
1378 {
1379 	bool cached = false;
1380 
1381 	if (fi) {
1382 		struct fib_nh *nh = &FIB_RES_NH(*res);
1383 
1384 		if (nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) {
1385 			rt->rt_gateway = nh->nh_gw;
1386 			rt->rt_uses_gateway = 1;
1387 		}
1388 		dst_init_metrics(&rt->dst, fi->fib_metrics, true);
1389 #ifdef CONFIG_IP_ROUTE_CLASSID
1390 		rt->dst.tclassid = nh->nh_tclassid;
1391 #endif
1392 		if (unlikely(fnhe))
1393 			cached = rt_bind_exception(rt, fnhe, daddr);
1394 		else if (!(rt->dst.flags & DST_NOCACHE))
1395 			cached = rt_cache_route(nh, rt);
1396 		if (unlikely(!cached)) {
1397 			/* Routes we intend to cache in nexthop exception or
1398 			 * FIB nexthop have the DST_NOCACHE bit clear.
1399 			 * However, if we are unsuccessful at storing this
1400 			 * route into the cache we really need to set it.
1401 			 */
1402 			rt->dst.flags |= DST_NOCACHE;
1403 			if (!rt->rt_gateway)
1404 				rt->rt_gateway = daddr;
1405 			rt_add_uncached_list(rt);
1406 		}
1407 	} else
1408 		rt_add_uncached_list(rt);
1409 
1410 #ifdef CONFIG_IP_ROUTE_CLASSID
1411 #ifdef CONFIG_IP_MULTIPLE_TABLES
1412 	set_class_tag(rt, res->tclassid);
1413 #endif
1414 	set_class_tag(rt, itag);
1415 #endif
1416 }
1417 
1418 static struct rtable *rt_dst_alloc(struct net_device *dev,
1419 				   bool nopolicy, bool noxfrm, bool will_cache)
1420 {
1421 	return dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
1422 			 (will_cache ? 0 : (DST_HOST | DST_NOCACHE)) |
1423 			 (nopolicy ? DST_NOPOLICY : 0) |
1424 			 (noxfrm ? DST_NOXFRM : 0));
1425 }
1426 
1427 /* called in rcu_read_lock() section */
1428 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1429 				u8 tos, struct net_device *dev, int our)
1430 {
1431 	struct rtable *rth;
1432 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1433 	u32 itag = 0;
1434 	int err;
1435 
1436 	/* Primary sanity checks. */
1437 
1438 	if (in_dev == NULL)
1439 		return -EINVAL;
1440 
1441 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1442 	    skb->protocol != htons(ETH_P_IP))
1443 		goto e_inval;
1444 
1445 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1446 		if (ipv4_is_loopback(saddr))
1447 			goto e_inval;
1448 
1449 	if (ipv4_is_zeronet(saddr)) {
1450 		if (!ipv4_is_local_multicast(daddr))
1451 			goto e_inval;
1452 	} else {
1453 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1454 					  in_dev, &itag);
1455 		if (err < 0)
1456 			goto e_err;
1457 	}
1458 	rth = rt_dst_alloc(dev_net(dev)->loopback_dev,
1459 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
1460 	if (!rth)
1461 		goto e_nobufs;
1462 
1463 #ifdef CONFIG_IP_ROUTE_CLASSID
1464 	rth->dst.tclassid = itag;
1465 #endif
1466 	rth->dst.output = ip_rt_bug;
1467 
1468 	rth->rt_genid	= rt_genid_ipv4(dev_net(dev));
1469 	rth->rt_flags	= RTCF_MULTICAST;
1470 	rth->rt_type	= RTN_MULTICAST;
1471 	rth->rt_is_input= 1;
1472 	rth->rt_iif	= 0;
1473 	rth->rt_pmtu	= 0;
1474 	rth->rt_gateway	= 0;
1475 	rth->rt_uses_gateway = 0;
1476 	INIT_LIST_HEAD(&rth->rt_uncached);
1477 	if (our) {
1478 		rth->dst.input= ip_local_deliver;
1479 		rth->rt_flags |= RTCF_LOCAL;
1480 	}
1481 
1482 #ifdef CONFIG_IP_MROUTE
1483 	if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
1484 		rth->dst.input = ip_mr_input;
1485 #endif
1486 	RT_CACHE_STAT_INC(in_slow_mc);
1487 
1488 	skb_dst_set(skb, &rth->dst);
1489 	return 0;
1490 
1491 e_nobufs:
1492 	return -ENOBUFS;
1493 e_inval:
1494 	return -EINVAL;
1495 e_err:
1496 	return err;
1497 }
1498 
1499 
1500 static void ip_handle_martian_source(struct net_device *dev,
1501 				     struct in_device *in_dev,
1502 				     struct sk_buff *skb,
1503 				     __be32 daddr,
1504 				     __be32 saddr)
1505 {
1506 	RT_CACHE_STAT_INC(in_martian_src);
1507 #ifdef CONFIG_IP_ROUTE_VERBOSE
1508 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
1509 		/*
1510 		 *	RFC1812 recommendation, if source is martian,
1511 		 *	the only hint is MAC header.
1512 		 */
1513 		pr_warn("martian source %pI4 from %pI4, on dev %s\n",
1514 			&daddr, &saddr, dev->name);
1515 		if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
1516 			print_hex_dump(KERN_WARNING, "ll header: ",
1517 				       DUMP_PREFIX_OFFSET, 16, 1,
1518 				       skb_mac_header(skb),
1519 				       dev->hard_header_len, true);
1520 		}
1521 	}
1522 #endif
1523 }
1524 
1525 /* called in rcu_read_lock() section */
1526 static int __mkroute_input(struct sk_buff *skb,
1527 			   const struct fib_result *res,
1528 			   struct in_device *in_dev,
1529 			   __be32 daddr, __be32 saddr, u32 tos)
1530 {
1531 	struct fib_nh_exception *fnhe;
1532 	struct rtable *rth;
1533 	int err;
1534 	struct in_device *out_dev;
1535 	unsigned int flags = 0;
1536 	bool do_cache;
1537 	u32 itag = 0;
1538 
1539 	/* get a working reference to the output device */
1540 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
1541 	if (out_dev == NULL) {
1542 		net_crit_ratelimited("Bug in ip_route_input_slow(). Please report.\n");
1543 		return -EINVAL;
1544 	}
1545 
1546 	err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
1547 				  in_dev->dev, in_dev, &itag);
1548 	if (err < 0) {
1549 		ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
1550 					 saddr);
1551 
1552 		goto cleanup;
1553 	}
1554 
1555 	do_cache = res->fi && !itag;
1556 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
1557 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
1558 	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
1559 		flags |= RTCF_DOREDIRECT;
1560 		do_cache = false;
1561 	}
1562 
1563 	if (skb->protocol != htons(ETH_P_IP)) {
1564 		/* Not IP (i.e. ARP). Do not create route, if it is
1565 		 * invalid for proxy arp. DNAT routes are always valid.
1566 		 *
1567 		 * Proxy arp feature have been extended to allow, ARP
1568 		 * replies back to the same interface, to support
1569 		 * Private VLAN switch technologies. See arp.c.
1570 		 */
1571 		if (out_dev == in_dev &&
1572 		    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
1573 			err = -EINVAL;
1574 			goto cleanup;
1575 		}
1576 	}
1577 
1578 	fnhe = find_exception(&FIB_RES_NH(*res), daddr);
1579 	if (do_cache) {
1580 		if (fnhe != NULL)
1581 			rth = rcu_dereference(fnhe->fnhe_rth_input);
1582 		else
1583 			rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
1584 
1585 		if (rt_cache_valid(rth)) {
1586 			skb_dst_set_noref(skb, &rth->dst);
1587 			goto out;
1588 		}
1589 	}
1590 
1591 	rth = rt_dst_alloc(out_dev->dev,
1592 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1593 			   IN_DEV_CONF_GET(out_dev, NOXFRM), do_cache);
1594 	if (!rth) {
1595 		err = -ENOBUFS;
1596 		goto cleanup;
1597 	}
1598 
1599 	rth->rt_genid = rt_genid_ipv4(dev_net(rth->dst.dev));
1600 	rth->rt_flags = flags;
1601 	rth->rt_type = res->type;
1602 	rth->rt_is_input = 1;
1603 	rth->rt_iif 	= 0;
1604 	rth->rt_pmtu	= 0;
1605 	rth->rt_gateway	= 0;
1606 	rth->rt_uses_gateway = 0;
1607 	INIT_LIST_HEAD(&rth->rt_uncached);
1608 	RT_CACHE_STAT_INC(in_slow_tot);
1609 
1610 	rth->dst.input = ip_forward;
1611 	rth->dst.output = ip_output;
1612 
1613 	rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag);
1614 	skb_dst_set(skb, &rth->dst);
1615 out:
1616 	err = 0;
1617  cleanup:
1618 	return err;
1619 }
1620 
1621 static int ip_mkroute_input(struct sk_buff *skb,
1622 			    struct fib_result *res,
1623 			    const struct flowi4 *fl4,
1624 			    struct in_device *in_dev,
1625 			    __be32 daddr, __be32 saddr, u32 tos)
1626 {
1627 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1628 	if (res->fi && res->fi->fib_nhs > 1)
1629 		fib_select_multipath(res);
1630 #endif
1631 
1632 	/* create a routing cache entry */
1633 	return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
1634 }
1635 
1636 /*
1637  *	NOTE. We drop all the packets that has local source
1638  *	addresses, because every properly looped back packet
1639  *	must have correct destination already attached by output routine.
1640  *
1641  *	Such approach solves two big problems:
1642  *	1. Not simplex devices are handled properly.
1643  *	2. IP spoofing attempts are filtered with 100% of guarantee.
1644  *	called with rcu_read_lock()
1645  */
1646 
1647 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1648 			       u8 tos, struct net_device *dev)
1649 {
1650 	struct fib_result res;
1651 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1652 	struct flowi4	fl4;
1653 	unsigned int	flags = 0;
1654 	u32		itag = 0;
1655 	struct rtable	*rth;
1656 	int		err = -EINVAL;
1657 	struct net    *net = dev_net(dev);
1658 	bool do_cache;
1659 
1660 	/* IP on this device is disabled. */
1661 
1662 	if (!in_dev)
1663 		goto out;
1664 
1665 	/* Check for the most weird martians, which can be not detected
1666 	   by fib_lookup.
1667 	 */
1668 
1669 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
1670 		goto martian_source;
1671 
1672 	res.fi = NULL;
1673 	if (ipv4_is_lbcast(daddr) || (saddr == 0 && daddr == 0))
1674 		goto brd_input;
1675 
1676 	/* Accept zero addresses only to limited broadcast;
1677 	 * I even do not know to fix it or not. Waiting for complains :-)
1678 	 */
1679 	if (ipv4_is_zeronet(saddr))
1680 		goto martian_source;
1681 
1682 	if (ipv4_is_zeronet(daddr))
1683 		goto martian_destination;
1684 
1685 	/* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
1686 	 * and call it once if daddr or/and saddr are loopback addresses
1687 	 */
1688 	if (ipv4_is_loopback(daddr)) {
1689 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1690 			goto martian_destination;
1691 	} else if (ipv4_is_loopback(saddr)) {
1692 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1693 			goto martian_source;
1694 	}
1695 
1696 	/*
1697 	 *	Now we are ready to route packet.
1698 	 */
1699 	fl4.flowi4_oif = 0;
1700 	fl4.flowi4_iif = dev->ifindex;
1701 	fl4.flowi4_mark = skb->mark;
1702 	fl4.flowi4_tos = tos;
1703 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
1704 	fl4.daddr = daddr;
1705 	fl4.saddr = saddr;
1706 	err = fib_lookup(net, &fl4, &res);
1707 	if (err != 0) {
1708 		if (!IN_DEV_FORWARD(in_dev))
1709 			err = -EHOSTUNREACH;
1710 		goto no_route;
1711 	}
1712 
1713 	if (res.type == RTN_BROADCAST)
1714 		goto brd_input;
1715 
1716 	if (res.type == RTN_LOCAL) {
1717 		err = fib_validate_source(skb, saddr, daddr, tos,
1718 					  0, dev, in_dev, &itag);
1719 		if (err < 0)
1720 			goto martian_source_keep_err;
1721 		goto local_input;
1722 	}
1723 
1724 	if (!IN_DEV_FORWARD(in_dev)) {
1725 		err = -EHOSTUNREACH;
1726 		goto no_route;
1727 	}
1728 	if (res.type != RTN_UNICAST)
1729 		goto martian_destination;
1730 
1731 	err = ip_mkroute_input(skb, &res, &fl4, in_dev, daddr, saddr, tos);
1732 out:	return err;
1733 
1734 brd_input:
1735 	if (skb->protocol != htons(ETH_P_IP))
1736 		goto e_inval;
1737 
1738 	if (!ipv4_is_zeronet(saddr)) {
1739 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1740 					  in_dev, &itag);
1741 		if (err < 0)
1742 			goto martian_source_keep_err;
1743 	}
1744 	flags |= RTCF_BROADCAST;
1745 	res.type = RTN_BROADCAST;
1746 	RT_CACHE_STAT_INC(in_brd);
1747 
1748 local_input:
1749 	do_cache = false;
1750 	if (res.fi) {
1751 		if (!itag) {
1752 			rth = rcu_dereference(FIB_RES_NH(res).nh_rth_input);
1753 			if (rt_cache_valid(rth)) {
1754 				skb_dst_set_noref(skb, &rth->dst);
1755 				err = 0;
1756 				goto out;
1757 			}
1758 			do_cache = true;
1759 		}
1760 	}
1761 
1762 	rth = rt_dst_alloc(net->loopback_dev,
1763 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, do_cache);
1764 	if (!rth)
1765 		goto e_nobufs;
1766 
1767 	rth->dst.input= ip_local_deliver;
1768 	rth->dst.output= ip_rt_bug;
1769 #ifdef CONFIG_IP_ROUTE_CLASSID
1770 	rth->dst.tclassid = itag;
1771 #endif
1772 
1773 	rth->rt_genid = rt_genid_ipv4(net);
1774 	rth->rt_flags 	= flags|RTCF_LOCAL;
1775 	rth->rt_type	= res.type;
1776 	rth->rt_is_input = 1;
1777 	rth->rt_iif	= 0;
1778 	rth->rt_pmtu	= 0;
1779 	rth->rt_gateway	= 0;
1780 	rth->rt_uses_gateway = 0;
1781 	INIT_LIST_HEAD(&rth->rt_uncached);
1782 	RT_CACHE_STAT_INC(in_slow_tot);
1783 	if (res.type == RTN_UNREACHABLE) {
1784 		rth->dst.input= ip_error;
1785 		rth->dst.error= -err;
1786 		rth->rt_flags 	&= ~RTCF_LOCAL;
1787 	}
1788 	if (do_cache) {
1789 		if (unlikely(!rt_cache_route(&FIB_RES_NH(res), rth))) {
1790 			rth->dst.flags |= DST_NOCACHE;
1791 			rt_add_uncached_list(rth);
1792 		}
1793 	}
1794 	skb_dst_set(skb, &rth->dst);
1795 	err = 0;
1796 	goto out;
1797 
1798 no_route:
1799 	RT_CACHE_STAT_INC(in_no_route);
1800 	res.type = RTN_UNREACHABLE;
1801 	res.fi = NULL;
1802 	goto local_input;
1803 
1804 	/*
1805 	 *	Do not cache martian addresses: they should be logged (RFC1812)
1806 	 */
1807 martian_destination:
1808 	RT_CACHE_STAT_INC(in_martian_dst);
1809 #ifdef CONFIG_IP_ROUTE_VERBOSE
1810 	if (IN_DEV_LOG_MARTIANS(in_dev))
1811 		net_warn_ratelimited("martian destination %pI4 from %pI4, dev %s\n",
1812 				     &daddr, &saddr, dev->name);
1813 #endif
1814 
1815 e_inval:
1816 	err = -EINVAL;
1817 	goto out;
1818 
1819 e_nobufs:
1820 	err = -ENOBUFS;
1821 	goto out;
1822 
1823 martian_source:
1824 	err = -EINVAL;
1825 martian_source_keep_err:
1826 	ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
1827 	goto out;
1828 }
1829 
1830 int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1831 			 u8 tos, struct net_device *dev)
1832 {
1833 	int res;
1834 
1835 	rcu_read_lock();
1836 
1837 	/* Multicast recognition logic is moved from route cache to here.
1838 	   The problem was that too many Ethernet cards have broken/missing
1839 	   hardware multicast filters :-( As result the host on multicasting
1840 	   network acquires a lot of useless route cache entries, sort of
1841 	   SDR messages from all the world. Now we try to get rid of them.
1842 	   Really, provided software IP multicast filter is organized
1843 	   reasonably (at least, hashed), it does not result in a slowdown
1844 	   comparing with route cache reject entries.
1845 	   Note, that multicast routers are not affected, because
1846 	   route cache entry is created eventually.
1847 	 */
1848 	if (ipv4_is_multicast(daddr)) {
1849 		struct in_device *in_dev = __in_dev_get_rcu(dev);
1850 
1851 		if (in_dev) {
1852 			int our = ip_check_mc_rcu(in_dev, daddr, saddr,
1853 						  ip_hdr(skb)->protocol);
1854 			if (our
1855 #ifdef CONFIG_IP_MROUTE
1856 				||
1857 			    (!ipv4_is_local_multicast(daddr) &&
1858 			     IN_DEV_MFORWARD(in_dev))
1859 #endif
1860 			   ) {
1861 				int res = ip_route_input_mc(skb, daddr, saddr,
1862 							    tos, dev, our);
1863 				rcu_read_unlock();
1864 				return res;
1865 			}
1866 		}
1867 		rcu_read_unlock();
1868 		return -EINVAL;
1869 	}
1870 	res = ip_route_input_slow(skb, daddr, saddr, tos, dev);
1871 	rcu_read_unlock();
1872 	return res;
1873 }
1874 EXPORT_SYMBOL(ip_route_input_noref);
1875 
1876 /* called with rcu_read_lock() */
1877 static struct rtable *__mkroute_output(const struct fib_result *res,
1878 				       const struct flowi4 *fl4, int orig_oif,
1879 				       struct net_device *dev_out,
1880 				       unsigned int flags)
1881 {
1882 	struct fib_info *fi = res->fi;
1883 	struct fib_nh_exception *fnhe;
1884 	struct in_device *in_dev;
1885 	u16 type = res->type;
1886 	struct rtable *rth;
1887 	bool do_cache;
1888 
1889 	in_dev = __in_dev_get_rcu(dev_out);
1890 	if (!in_dev)
1891 		return ERR_PTR(-EINVAL);
1892 
1893 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1894 		if (ipv4_is_loopback(fl4->saddr) && !(dev_out->flags & IFF_LOOPBACK))
1895 			return ERR_PTR(-EINVAL);
1896 
1897 	if (ipv4_is_lbcast(fl4->daddr))
1898 		type = RTN_BROADCAST;
1899 	else if (ipv4_is_multicast(fl4->daddr))
1900 		type = RTN_MULTICAST;
1901 	else if (ipv4_is_zeronet(fl4->daddr))
1902 		return ERR_PTR(-EINVAL);
1903 
1904 	if (dev_out->flags & IFF_LOOPBACK)
1905 		flags |= RTCF_LOCAL;
1906 
1907 	do_cache = true;
1908 	if (type == RTN_BROADCAST) {
1909 		flags |= RTCF_BROADCAST | RTCF_LOCAL;
1910 		fi = NULL;
1911 	} else if (type == RTN_MULTICAST) {
1912 		flags |= RTCF_MULTICAST | RTCF_LOCAL;
1913 		if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
1914 				     fl4->flowi4_proto))
1915 			flags &= ~RTCF_LOCAL;
1916 		else
1917 			do_cache = false;
1918 		/* If multicast route do not exist use
1919 		 * default one, but do not gateway in this case.
1920 		 * Yes, it is hack.
1921 		 */
1922 		if (fi && res->prefixlen < 4)
1923 			fi = NULL;
1924 	}
1925 
1926 	fnhe = NULL;
1927 	do_cache &= fi != NULL;
1928 	if (do_cache) {
1929 		struct rtable __rcu **prth;
1930 		struct fib_nh *nh = &FIB_RES_NH(*res);
1931 
1932 		fnhe = find_exception(nh, fl4->daddr);
1933 		if (fnhe)
1934 			prth = &fnhe->fnhe_rth_output;
1935 		else {
1936 			if (unlikely(fl4->flowi4_flags &
1937 				     FLOWI_FLAG_KNOWN_NH &&
1938 				     !(nh->nh_gw &&
1939 				       nh->nh_scope == RT_SCOPE_LINK))) {
1940 				do_cache = false;
1941 				goto add;
1942 			}
1943 			prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
1944 		}
1945 		rth = rcu_dereference(*prth);
1946 		if (rt_cache_valid(rth)) {
1947 			dst_hold(&rth->dst);
1948 			return rth;
1949 		}
1950 	}
1951 
1952 add:
1953 	rth = rt_dst_alloc(dev_out,
1954 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1955 			   IN_DEV_CONF_GET(in_dev, NOXFRM),
1956 			   do_cache);
1957 	if (!rth)
1958 		return ERR_PTR(-ENOBUFS);
1959 
1960 	rth->dst.output = ip_output;
1961 
1962 	rth->rt_genid = rt_genid_ipv4(dev_net(dev_out));
1963 	rth->rt_flags	= flags;
1964 	rth->rt_type	= type;
1965 	rth->rt_is_input = 0;
1966 	rth->rt_iif	= orig_oif ? : 0;
1967 	rth->rt_pmtu	= 0;
1968 	rth->rt_gateway = 0;
1969 	rth->rt_uses_gateway = 0;
1970 	INIT_LIST_HEAD(&rth->rt_uncached);
1971 
1972 	RT_CACHE_STAT_INC(out_slow_tot);
1973 
1974 	if (flags & RTCF_LOCAL)
1975 		rth->dst.input = ip_local_deliver;
1976 	if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
1977 		if (flags & RTCF_LOCAL &&
1978 		    !(dev_out->flags & IFF_LOOPBACK)) {
1979 			rth->dst.output = ip_mc_output;
1980 			RT_CACHE_STAT_INC(out_slow_mc);
1981 		}
1982 #ifdef CONFIG_IP_MROUTE
1983 		if (type == RTN_MULTICAST) {
1984 			if (IN_DEV_MFORWARD(in_dev) &&
1985 			    !ipv4_is_local_multicast(fl4->daddr)) {
1986 				rth->dst.input = ip_mr_input;
1987 				rth->dst.output = ip_mc_output;
1988 			}
1989 		}
1990 #endif
1991 	}
1992 
1993 	rt_set_nexthop(rth, fl4->daddr, res, fnhe, fi, type, 0);
1994 
1995 	return rth;
1996 }
1997 
1998 /*
1999  * Major route resolver routine.
2000  */
2001 
2002 struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
2003 {
2004 	struct net_device *dev_out = NULL;
2005 	__u8 tos = RT_FL_TOS(fl4);
2006 	unsigned int flags = 0;
2007 	struct fib_result res;
2008 	struct rtable *rth;
2009 	int orig_oif;
2010 
2011 	res.tclassid	= 0;
2012 	res.fi		= NULL;
2013 	res.table	= NULL;
2014 
2015 	orig_oif = fl4->flowi4_oif;
2016 
2017 	fl4->flowi4_iif = LOOPBACK_IFINDEX;
2018 	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
2019 	fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
2020 			 RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
2021 
2022 	rcu_read_lock();
2023 	if (fl4->saddr) {
2024 		rth = ERR_PTR(-EINVAL);
2025 		if (ipv4_is_multicast(fl4->saddr) ||
2026 		    ipv4_is_lbcast(fl4->saddr) ||
2027 		    ipv4_is_zeronet(fl4->saddr))
2028 			goto out;
2029 
2030 		/* I removed check for oif == dev_out->oif here.
2031 		   It was wrong for two reasons:
2032 		   1. ip_dev_find(net, saddr) can return wrong iface, if saddr
2033 		      is assigned to multiple interfaces.
2034 		   2. Moreover, we are allowed to send packets with saddr
2035 		      of another iface. --ANK
2036 		 */
2037 
2038 		if (fl4->flowi4_oif == 0 &&
2039 		    (ipv4_is_multicast(fl4->daddr) ||
2040 		     ipv4_is_lbcast(fl4->daddr))) {
2041 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2042 			dev_out = __ip_dev_find(net, fl4->saddr, false);
2043 			if (dev_out == NULL)
2044 				goto out;
2045 
2046 			/* Special hack: user can direct multicasts
2047 			   and limited broadcast via necessary interface
2048 			   without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
2049 			   This hack is not just for fun, it allows
2050 			   vic,vat and friends to work.
2051 			   They bind socket to loopback, set ttl to zero
2052 			   and expect that it will work.
2053 			   From the viewpoint of routing cache they are broken,
2054 			   because we are not allowed to build multicast path
2055 			   with loopback source addr (look, routing cache
2056 			   cannot know, that ttl is zero, so that packet
2057 			   will not leave this host and route is valid).
2058 			   Luckily, this hack is good workaround.
2059 			 */
2060 
2061 			fl4->flowi4_oif = dev_out->ifindex;
2062 			goto make_route;
2063 		}
2064 
2065 		if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
2066 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2067 			if (!__ip_dev_find(net, fl4->saddr, false))
2068 				goto out;
2069 		}
2070 	}
2071 
2072 
2073 	if (fl4->flowi4_oif) {
2074 		dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
2075 		rth = ERR_PTR(-ENODEV);
2076 		if (dev_out == NULL)
2077 			goto out;
2078 
2079 		/* RACE: Check return value of inet_select_addr instead. */
2080 		if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
2081 			rth = ERR_PTR(-ENETUNREACH);
2082 			goto out;
2083 		}
2084 		if (ipv4_is_local_multicast(fl4->daddr) ||
2085 		    ipv4_is_lbcast(fl4->daddr)) {
2086 			if (!fl4->saddr)
2087 				fl4->saddr = inet_select_addr(dev_out, 0,
2088 							      RT_SCOPE_LINK);
2089 			goto make_route;
2090 		}
2091 		if (!fl4->saddr) {
2092 			if (ipv4_is_multicast(fl4->daddr))
2093 				fl4->saddr = inet_select_addr(dev_out, 0,
2094 							      fl4->flowi4_scope);
2095 			else if (!fl4->daddr)
2096 				fl4->saddr = inet_select_addr(dev_out, 0,
2097 							      RT_SCOPE_HOST);
2098 		}
2099 	}
2100 
2101 	if (!fl4->daddr) {
2102 		fl4->daddr = fl4->saddr;
2103 		if (!fl4->daddr)
2104 			fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
2105 		dev_out = net->loopback_dev;
2106 		fl4->flowi4_oif = LOOPBACK_IFINDEX;
2107 		res.type = RTN_LOCAL;
2108 		flags |= RTCF_LOCAL;
2109 		goto make_route;
2110 	}
2111 
2112 	if (fib_lookup(net, fl4, &res)) {
2113 		res.fi = NULL;
2114 		res.table = NULL;
2115 		if (fl4->flowi4_oif) {
2116 			/* Apparently, routing tables are wrong. Assume,
2117 			   that the destination is on link.
2118 
2119 			   WHY? DW.
2120 			   Because we are allowed to send to iface
2121 			   even if it has NO routes and NO assigned
2122 			   addresses. When oif is specified, routing
2123 			   tables are looked up with only one purpose:
2124 			   to catch if destination is gatewayed, rather than
2125 			   direct. Moreover, if MSG_DONTROUTE is set,
2126 			   we send packet, ignoring both routing tables
2127 			   and ifaddr state. --ANK
2128 
2129 
2130 			   We could make it even if oif is unknown,
2131 			   likely IPv6, but we do not.
2132 			 */
2133 
2134 			if (fl4->saddr == 0)
2135 				fl4->saddr = inet_select_addr(dev_out, 0,
2136 							      RT_SCOPE_LINK);
2137 			res.type = RTN_UNICAST;
2138 			goto make_route;
2139 		}
2140 		rth = ERR_PTR(-ENETUNREACH);
2141 		goto out;
2142 	}
2143 
2144 	if (res.type == RTN_LOCAL) {
2145 		if (!fl4->saddr) {
2146 			if (res.fi->fib_prefsrc)
2147 				fl4->saddr = res.fi->fib_prefsrc;
2148 			else
2149 				fl4->saddr = fl4->daddr;
2150 		}
2151 		dev_out = net->loopback_dev;
2152 		fl4->flowi4_oif = dev_out->ifindex;
2153 		flags |= RTCF_LOCAL;
2154 		goto make_route;
2155 	}
2156 
2157 #ifdef CONFIG_IP_ROUTE_MULTIPATH
2158 	if (res.fi->fib_nhs > 1 && fl4->flowi4_oif == 0)
2159 		fib_select_multipath(&res);
2160 	else
2161 #endif
2162 	if (!res.prefixlen &&
2163 	    res.table->tb_num_default > 1 &&
2164 	    res.type == RTN_UNICAST && !fl4->flowi4_oif)
2165 		fib_select_default(&res);
2166 
2167 	if (!fl4->saddr)
2168 		fl4->saddr = FIB_RES_PREFSRC(net, res);
2169 
2170 	dev_out = FIB_RES_DEV(res);
2171 	fl4->flowi4_oif = dev_out->ifindex;
2172 
2173 
2174 make_route:
2175 	rth = __mkroute_output(&res, fl4, orig_oif, dev_out, flags);
2176 
2177 out:
2178 	rcu_read_unlock();
2179 	return rth;
2180 }
2181 EXPORT_SYMBOL_GPL(__ip_route_output_key);
2182 
2183 static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
2184 {
2185 	return NULL;
2186 }
2187 
2188 static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
2189 {
2190 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
2191 
2192 	return mtu ? : dst->dev->mtu;
2193 }
2194 
2195 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
2196 					  struct sk_buff *skb, u32 mtu)
2197 {
2198 }
2199 
2200 static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
2201 				       struct sk_buff *skb)
2202 {
2203 }
2204 
2205 static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
2206 					  unsigned long old)
2207 {
2208 	return NULL;
2209 }
2210 
2211 static struct dst_ops ipv4_dst_blackhole_ops = {
2212 	.family			=	AF_INET,
2213 	.protocol		=	cpu_to_be16(ETH_P_IP),
2214 	.check			=	ipv4_blackhole_dst_check,
2215 	.mtu			=	ipv4_blackhole_mtu,
2216 	.default_advmss		=	ipv4_default_advmss,
2217 	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
2218 	.redirect		=	ipv4_rt_blackhole_redirect,
2219 	.cow_metrics		=	ipv4_rt_blackhole_cow_metrics,
2220 	.neigh_lookup		=	ipv4_neigh_lookup,
2221 };
2222 
2223 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
2224 {
2225 	struct rtable *ort = (struct rtable *) dst_orig;
2226 	struct rtable *rt;
2227 
2228 	rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, 0);
2229 	if (rt) {
2230 		struct dst_entry *new = &rt->dst;
2231 
2232 		new->__use = 1;
2233 		new->input = dst_discard;
2234 		new->output = dst_discard_sk;
2235 
2236 		new->dev = ort->dst.dev;
2237 		if (new->dev)
2238 			dev_hold(new->dev);
2239 
2240 		rt->rt_is_input = ort->rt_is_input;
2241 		rt->rt_iif = ort->rt_iif;
2242 		rt->rt_pmtu = ort->rt_pmtu;
2243 
2244 		rt->rt_genid = rt_genid_ipv4(net);
2245 		rt->rt_flags = ort->rt_flags;
2246 		rt->rt_type = ort->rt_type;
2247 		rt->rt_gateway = ort->rt_gateway;
2248 		rt->rt_uses_gateway = ort->rt_uses_gateway;
2249 
2250 		INIT_LIST_HEAD(&rt->rt_uncached);
2251 
2252 		dst_free(new);
2253 	}
2254 
2255 	dst_release(dst_orig);
2256 
2257 	return rt ? &rt->dst : ERR_PTR(-ENOMEM);
2258 }
2259 
2260 struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
2261 				    struct sock *sk)
2262 {
2263 	struct rtable *rt = __ip_route_output_key(net, flp4);
2264 
2265 	if (IS_ERR(rt))
2266 		return rt;
2267 
2268 	if (flp4->flowi4_proto)
2269 		rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
2270 							flowi4_to_flowi(flp4),
2271 							sk, 0);
2272 
2273 	return rt;
2274 }
2275 EXPORT_SYMBOL_GPL(ip_route_output_flow);
2276 
2277 static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
2278 			struct flowi4 *fl4, struct sk_buff *skb, u32 portid,
2279 			u32 seq, int event, int nowait, unsigned int flags)
2280 {
2281 	struct rtable *rt = skb_rtable(skb);
2282 	struct rtmsg *r;
2283 	struct nlmsghdr *nlh;
2284 	unsigned long expires = 0;
2285 	u32 error;
2286 	u32 metrics[RTAX_MAX];
2287 
2288 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*r), flags);
2289 	if (nlh == NULL)
2290 		return -EMSGSIZE;
2291 
2292 	r = nlmsg_data(nlh);
2293 	r->rtm_family	 = AF_INET;
2294 	r->rtm_dst_len	= 32;
2295 	r->rtm_src_len	= 0;
2296 	r->rtm_tos	= fl4->flowi4_tos;
2297 	r->rtm_table	= RT_TABLE_MAIN;
2298 	if (nla_put_u32(skb, RTA_TABLE, RT_TABLE_MAIN))
2299 		goto nla_put_failure;
2300 	r->rtm_type	= rt->rt_type;
2301 	r->rtm_scope	= RT_SCOPE_UNIVERSE;
2302 	r->rtm_protocol = RTPROT_UNSPEC;
2303 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
2304 	if (rt->rt_flags & RTCF_NOTIFY)
2305 		r->rtm_flags |= RTM_F_NOTIFY;
2306 
2307 	if (nla_put_be32(skb, RTA_DST, dst))
2308 		goto nla_put_failure;
2309 	if (src) {
2310 		r->rtm_src_len = 32;
2311 		if (nla_put_be32(skb, RTA_SRC, src))
2312 			goto nla_put_failure;
2313 	}
2314 	if (rt->dst.dev &&
2315 	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
2316 		goto nla_put_failure;
2317 #ifdef CONFIG_IP_ROUTE_CLASSID
2318 	if (rt->dst.tclassid &&
2319 	    nla_put_u32(skb, RTA_FLOW, rt->dst.tclassid))
2320 		goto nla_put_failure;
2321 #endif
2322 	if (!rt_is_input_route(rt) &&
2323 	    fl4->saddr != src) {
2324 		if (nla_put_be32(skb, RTA_PREFSRC, fl4->saddr))
2325 			goto nla_put_failure;
2326 	}
2327 	if (rt->rt_uses_gateway &&
2328 	    nla_put_be32(skb, RTA_GATEWAY, rt->rt_gateway))
2329 		goto nla_put_failure;
2330 
2331 	expires = rt->dst.expires;
2332 	if (expires) {
2333 		unsigned long now = jiffies;
2334 
2335 		if (time_before(now, expires))
2336 			expires -= now;
2337 		else
2338 			expires = 0;
2339 	}
2340 
2341 	memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
2342 	if (rt->rt_pmtu && expires)
2343 		metrics[RTAX_MTU - 1] = rt->rt_pmtu;
2344 	if (rtnetlink_put_metrics(skb, metrics) < 0)
2345 		goto nla_put_failure;
2346 
2347 	if (fl4->flowi4_mark &&
2348 	    nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
2349 		goto nla_put_failure;
2350 
2351 	error = rt->dst.error;
2352 
2353 	if (rt_is_input_route(rt)) {
2354 #ifdef CONFIG_IP_MROUTE
2355 		if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
2356 		    IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
2357 			int err = ipmr_get_route(net, skb,
2358 						 fl4->saddr, fl4->daddr,
2359 						 r, nowait);
2360 			if (err <= 0) {
2361 				if (!nowait) {
2362 					if (err == 0)
2363 						return 0;
2364 					goto nla_put_failure;
2365 				} else {
2366 					if (err == -EMSGSIZE)
2367 						goto nla_put_failure;
2368 					error = err;
2369 				}
2370 			}
2371 		} else
2372 #endif
2373 			if (nla_put_u32(skb, RTA_IIF, skb->dev->ifindex))
2374 				goto nla_put_failure;
2375 	}
2376 
2377 	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, error) < 0)
2378 		goto nla_put_failure;
2379 
2380 	return nlmsg_end(skb, nlh);
2381 
2382 nla_put_failure:
2383 	nlmsg_cancel(skb, nlh);
2384 	return -EMSGSIZE;
2385 }
2386 
2387 static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
2388 {
2389 	struct net *net = sock_net(in_skb->sk);
2390 	struct rtmsg *rtm;
2391 	struct nlattr *tb[RTA_MAX+1];
2392 	struct rtable *rt = NULL;
2393 	struct flowi4 fl4;
2394 	__be32 dst = 0;
2395 	__be32 src = 0;
2396 	u32 iif;
2397 	int err;
2398 	int mark;
2399 	struct sk_buff *skb;
2400 
2401 	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
2402 	if (err < 0)
2403 		goto errout;
2404 
2405 	rtm = nlmsg_data(nlh);
2406 
2407 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2408 	if (skb == NULL) {
2409 		err = -ENOBUFS;
2410 		goto errout;
2411 	}
2412 
2413 	/* Reserve room for dummy headers, this skb can pass
2414 	   through good chunk of routing engine.
2415 	 */
2416 	skb_reset_mac_header(skb);
2417 	skb_reset_network_header(skb);
2418 
2419 	/* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
2420 	ip_hdr(skb)->protocol = IPPROTO_ICMP;
2421 	skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
2422 
2423 	src = tb[RTA_SRC] ? nla_get_be32(tb[RTA_SRC]) : 0;
2424 	dst = tb[RTA_DST] ? nla_get_be32(tb[RTA_DST]) : 0;
2425 	iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
2426 	mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
2427 
2428 	memset(&fl4, 0, sizeof(fl4));
2429 	fl4.daddr = dst;
2430 	fl4.saddr = src;
2431 	fl4.flowi4_tos = rtm->rtm_tos;
2432 	fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
2433 	fl4.flowi4_mark = mark;
2434 
2435 	if (iif) {
2436 		struct net_device *dev;
2437 
2438 		dev = __dev_get_by_index(net, iif);
2439 		if (dev == NULL) {
2440 			err = -ENODEV;
2441 			goto errout_free;
2442 		}
2443 
2444 		skb->protocol	= htons(ETH_P_IP);
2445 		skb->dev	= dev;
2446 		skb->mark	= mark;
2447 		local_bh_disable();
2448 		err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev);
2449 		local_bh_enable();
2450 
2451 		rt = skb_rtable(skb);
2452 		if (err == 0 && rt->dst.error)
2453 			err = -rt->dst.error;
2454 	} else {
2455 		rt = ip_route_output_key(net, &fl4);
2456 
2457 		err = 0;
2458 		if (IS_ERR(rt))
2459 			err = PTR_ERR(rt);
2460 	}
2461 
2462 	if (err)
2463 		goto errout_free;
2464 
2465 	skb_dst_set(skb, &rt->dst);
2466 	if (rtm->rtm_flags & RTM_F_NOTIFY)
2467 		rt->rt_flags |= RTCF_NOTIFY;
2468 
2469 	err = rt_fill_info(net, dst, src, &fl4, skb,
2470 			   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2471 			   RTM_NEWROUTE, 0, 0);
2472 	if (err <= 0)
2473 		goto errout_free;
2474 
2475 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2476 errout:
2477 	return err;
2478 
2479 errout_free:
2480 	kfree_skb(skb);
2481 	goto errout;
2482 }
2483 
2484 void ip_rt_multicast_event(struct in_device *in_dev)
2485 {
2486 	rt_cache_flush(dev_net(in_dev->dev));
2487 }
2488 
2489 #ifdef CONFIG_SYSCTL
2490 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
2491 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
2492 static int ip_rt_gc_min_interval __read_mostly	= HZ / 2;
2493 static int ip_rt_gc_elasticity __read_mostly	= 8;
2494 
2495 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
2496 					void __user *buffer,
2497 					size_t *lenp, loff_t *ppos)
2498 {
2499 	struct net *net = (struct net *)__ctl->extra1;
2500 
2501 	if (write) {
2502 		rt_cache_flush(net);
2503 		fnhe_genid_bump(net);
2504 		return 0;
2505 	}
2506 
2507 	return -EINVAL;
2508 }
2509 
2510 static struct ctl_table ipv4_route_table[] = {
2511 	{
2512 		.procname	= "gc_thresh",
2513 		.data		= &ipv4_dst_ops.gc_thresh,
2514 		.maxlen		= sizeof(int),
2515 		.mode		= 0644,
2516 		.proc_handler	= proc_dointvec,
2517 	},
2518 	{
2519 		.procname	= "max_size",
2520 		.data		= &ip_rt_max_size,
2521 		.maxlen		= sizeof(int),
2522 		.mode		= 0644,
2523 		.proc_handler	= proc_dointvec,
2524 	},
2525 	{
2526 		/*  Deprecated. Use gc_min_interval_ms */
2527 
2528 		.procname	= "gc_min_interval",
2529 		.data		= &ip_rt_gc_min_interval,
2530 		.maxlen		= sizeof(int),
2531 		.mode		= 0644,
2532 		.proc_handler	= proc_dointvec_jiffies,
2533 	},
2534 	{
2535 		.procname	= "gc_min_interval_ms",
2536 		.data		= &ip_rt_gc_min_interval,
2537 		.maxlen		= sizeof(int),
2538 		.mode		= 0644,
2539 		.proc_handler	= proc_dointvec_ms_jiffies,
2540 	},
2541 	{
2542 		.procname	= "gc_timeout",
2543 		.data		= &ip_rt_gc_timeout,
2544 		.maxlen		= sizeof(int),
2545 		.mode		= 0644,
2546 		.proc_handler	= proc_dointvec_jiffies,
2547 	},
2548 	{
2549 		.procname	= "gc_interval",
2550 		.data		= &ip_rt_gc_interval,
2551 		.maxlen		= sizeof(int),
2552 		.mode		= 0644,
2553 		.proc_handler	= proc_dointvec_jiffies,
2554 	},
2555 	{
2556 		.procname	= "redirect_load",
2557 		.data		= &ip_rt_redirect_load,
2558 		.maxlen		= sizeof(int),
2559 		.mode		= 0644,
2560 		.proc_handler	= proc_dointvec,
2561 	},
2562 	{
2563 		.procname	= "redirect_number",
2564 		.data		= &ip_rt_redirect_number,
2565 		.maxlen		= sizeof(int),
2566 		.mode		= 0644,
2567 		.proc_handler	= proc_dointvec,
2568 	},
2569 	{
2570 		.procname	= "redirect_silence",
2571 		.data		= &ip_rt_redirect_silence,
2572 		.maxlen		= sizeof(int),
2573 		.mode		= 0644,
2574 		.proc_handler	= proc_dointvec,
2575 	},
2576 	{
2577 		.procname	= "error_cost",
2578 		.data		= &ip_rt_error_cost,
2579 		.maxlen		= sizeof(int),
2580 		.mode		= 0644,
2581 		.proc_handler	= proc_dointvec,
2582 	},
2583 	{
2584 		.procname	= "error_burst",
2585 		.data		= &ip_rt_error_burst,
2586 		.maxlen		= sizeof(int),
2587 		.mode		= 0644,
2588 		.proc_handler	= proc_dointvec,
2589 	},
2590 	{
2591 		.procname	= "gc_elasticity",
2592 		.data		= &ip_rt_gc_elasticity,
2593 		.maxlen		= sizeof(int),
2594 		.mode		= 0644,
2595 		.proc_handler	= proc_dointvec,
2596 	},
2597 	{
2598 		.procname	= "mtu_expires",
2599 		.data		= &ip_rt_mtu_expires,
2600 		.maxlen		= sizeof(int),
2601 		.mode		= 0644,
2602 		.proc_handler	= proc_dointvec_jiffies,
2603 	},
2604 	{
2605 		.procname	= "min_pmtu",
2606 		.data		= &ip_rt_min_pmtu,
2607 		.maxlen		= sizeof(int),
2608 		.mode		= 0644,
2609 		.proc_handler	= proc_dointvec,
2610 	},
2611 	{
2612 		.procname	= "min_adv_mss",
2613 		.data		= &ip_rt_min_advmss,
2614 		.maxlen		= sizeof(int),
2615 		.mode		= 0644,
2616 		.proc_handler	= proc_dointvec,
2617 	},
2618 	{ }
2619 };
2620 
2621 static struct ctl_table ipv4_route_flush_table[] = {
2622 	{
2623 		.procname	= "flush",
2624 		.maxlen		= sizeof(int),
2625 		.mode		= 0200,
2626 		.proc_handler	= ipv4_sysctl_rtcache_flush,
2627 	},
2628 	{ },
2629 };
2630 
2631 static __net_init int sysctl_route_net_init(struct net *net)
2632 {
2633 	struct ctl_table *tbl;
2634 
2635 	tbl = ipv4_route_flush_table;
2636 	if (!net_eq(net, &init_net)) {
2637 		tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
2638 		if (tbl == NULL)
2639 			goto err_dup;
2640 
2641 		/* Don't export sysctls to unprivileged users */
2642 		if (net->user_ns != &init_user_ns)
2643 			tbl[0].procname = NULL;
2644 	}
2645 	tbl[0].extra1 = net;
2646 
2647 	net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
2648 	if (net->ipv4.route_hdr == NULL)
2649 		goto err_reg;
2650 	return 0;
2651 
2652 err_reg:
2653 	if (tbl != ipv4_route_flush_table)
2654 		kfree(tbl);
2655 err_dup:
2656 	return -ENOMEM;
2657 }
2658 
2659 static __net_exit void sysctl_route_net_exit(struct net *net)
2660 {
2661 	struct ctl_table *tbl;
2662 
2663 	tbl = net->ipv4.route_hdr->ctl_table_arg;
2664 	unregister_net_sysctl_table(net->ipv4.route_hdr);
2665 	BUG_ON(tbl == ipv4_route_flush_table);
2666 	kfree(tbl);
2667 }
2668 
2669 static __net_initdata struct pernet_operations sysctl_route_ops = {
2670 	.init = sysctl_route_net_init,
2671 	.exit = sysctl_route_net_exit,
2672 };
2673 #endif
2674 
2675 static __net_init int rt_genid_init(struct net *net)
2676 {
2677 	atomic_set(&net->ipv4.rt_genid, 0);
2678 	atomic_set(&net->fnhe_genid, 0);
2679 	get_random_bytes(&net->ipv4.dev_addr_genid,
2680 			 sizeof(net->ipv4.dev_addr_genid));
2681 	return 0;
2682 }
2683 
2684 static __net_initdata struct pernet_operations rt_genid_ops = {
2685 	.init = rt_genid_init,
2686 };
2687 
2688 static int __net_init ipv4_inetpeer_init(struct net *net)
2689 {
2690 	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
2691 
2692 	if (!bp)
2693 		return -ENOMEM;
2694 	inet_peer_base_init(bp);
2695 	net->ipv4.peers = bp;
2696 	return 0;
2697 }
2698 
2699 static void __net_exit ipv4_inetpeer_exit(struct net *net)
2700 {
2701 	struct inet_peer_base *bp = net->ipv4.peers;
2702 
2703 	net->ipv4.peers = NULL;
2704 	inetpeer_invalidate_tree(bp);
2705 	kfree(bp);
2706 }
2707 
2708 static __net_initdata struct pernet_operations ipv4_inetpeer_ops = {
2709 	.init	=	ipv4_inetpeer_init,
2710 	.exit	=	ipv4_inetpeer_exit,
2711 };
2712 
2713 #ifdef CONFIG_IP_ROUTE_CLASSID
2714 struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
2715 #endif /* CONFIG_IP_ROUTE_CLASSID */
2716 
2717 int __init ip_rt_init(void)
2718 {
2719 	int rc = 0;
2720 
2721 	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
2722 	if (!ip_idents)
2723 		panic("IP: failed to allocate ip_idents\n");
2724 
2725 	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
2726 
2727 #ifdef CONFIG_IP_ROUTE_CLASSID
2728 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
2729 	if (!ip_rt_acct)
2730 		panic("IP: failed to allocate ip_rt_acct\n");
2731 #endif
2732 
2733 	ipv4_dst_ops.kmem_cachep =
2734 		kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
2735 				  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
2736 
2737 	ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
2738 
2739 	if (dst_entries_init(&ipv4_dst_ops) < 0)
2740 		panic("IP: failed to allocate ipv4_dst_ops counter\n");
2741 
2742 	if (dst_entries_init(&ipv4_dst_blackhole_ops) < 0)
2743 		panic("IP: failed to allocate ipv4_dst_blackhole_ops counter\n");
2744 
2745 	ipv4_dst_ops.gc_thresh = ~0;
2746 	ip_rt_max_size = INT_MAX;
2747 
2748 	devinet_init();
2749 	ip_fib_init();
2750 
2751 	if (ip_rt_proc_init())
2752 		pr_err("Unable to create route proc files\n");
2753 #ifdef CONFIG_XFRM
2754 	xfrm_init();
2755 	xfrm4_init();
2756 #endif
2757 	rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL, NULL);
2758 
2759 #ifdef CONFIG_SYSCTL
2760 	register_pernet_subsys(&sysctl_route_ops);
2761 #endif
2762 	register_pernet_subsys(&rt_genid_ops);
2763 	register_pernet_subsys(&ipv4_inetpeer_ops);
2764 	return rc;
2765 }
2766 
2767 #ifdef CONFIG_SYSCTL
2768 /*
2769  * We really need to sanitize the damn ipv4 init order, then all
2770  * this nonsense will go away.
2771  */
2772 void __init ip_static_sysctl_init(void)
2773 {
2774 	register_net_sysctl(&init_net, "net/ipv4/route", ipv4_route_table);
2775 }
2776 #endif
2777