xref: /openbmc/linux/net/ipv4/route.c (revision e63c7a0979f28bb13e06b981765dd514c01c075b)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		ROUTE - implementation of the IP router.
7  *
8  * Authors:	Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
11  *		Linus Torvalds, <Linus.Torvalds@helsinki.fi>
12  *		Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
13  *
14  * Fixes:
15  *		Alan Cox	:	Verify area fixes.
16  *		Alan Cox	:	cli() protects routing changes
17  *		Rui Oliveira	:	ICMP routing table updates
18  *		(rco@di.uminho.pt)	Routing table insertion and update
19  *		Linus Torvalds	:	Rewrote bits to be sensible
20  *		Alan Cox	:	Added BSD route gw semantics
21  *		Alan Cox	:	Super /proc >4K
22  *		Alan Cox	:	MTU in route table
23  *		Alan Cox	: 	MSS actually. Also added the window
24  *					clamper.
25  *		Sam Lantinga	:	Fixed route matching in rt_del()
26  *		Alan Cox	:	Routing cache support.
27  *		Alan Cox	:	Removed compatibility cruft.
28  *		Alan Cox	:	RTF_REJECT support.
29  *		Alan Cox	:	TCP irtt support.
30  *		Jonathan Naylor	:	Added Metric support.
31  *	Miquel van Smoorenburg	:	BSD API fixes.
32  *	Miquel van Smoorenburg	:	Metrics.
33  *		Alan Cox	:	Use __u32 properly
34  *		Alan Cox	:	Aligned routing errors more closely with BSD
35  *					our system is still very different.
36  *		Alan Cox	:	Faster /proc handling
37  *	Alexey Kuznetsov	:	Massive rework to support tree based routing,
38  *					routing caches and better behaviour.
39  *
40  *		Olaf Erb	:	irtt wasn't being copied right.
41  *		Bjorn Ekwall	:	Kerneld route support.
42  *		Alan Cox	:	Multicast fixed (I hope)
43  * 		Pavel Krauz	:	Limited broadcast fixed
44  *		Mike McLagan	:	Routing by source
45  *	Alexey Kuznetsov	:	End of old history. Split to fib.c and
46  *					route.c and rewritten from scratch.
47  *		Andi Kleen	:	Load-limit warning messages.
48  *	Vitaly E. Lavrov	:	Transparent proxy revived after year coma.
49  *	Vitaly E. Lavrov	:	Race condition in ip_route_input_slow.
50  *	Tobias Ringstrom	:	Uninitialized res.type in ip_route_output_slow.
51  *	Vladimir V. Ivanov	:	IP rule info (flowid) is really useful.
52  *		Marc Boucher	:	routing by fwmark
53  *	Robert Olsson		:	Added rt_cache statistics
54  *	Arnaldo C. Melo		:	Convert proc stuff to seq_file
55  *	Eric Dumazet		:	hashed spinlocks and rt_check_expire() fixes.
56  * 	Ilia Sotnikov		:	Ignore TOS on PMTUD and Redirect
57  * 	Ilia Sotnikov		:	Removed TOS from hash calculations
58  *
59  *		This program is free software; you can redistribute it and/or
60  *		modify it under the terms of the GNU General Public License
61  *		as published by the Free Software Foundation; either version
62  *		2 of the License, or (at your option) any later version.
63  */
64 
65 #define pr_fmt(fmt) "IPv4: " fmt
66 
67 #include <linux/module.h>
68 #include <asm/uaccess.h>
69 #include <linux/bitops.h>
70 #include <linux/types.h>
71 #include <linux/kernel.h>
72 #include <linux/mm.h>
73 #include <linux/string.h>
74 #include <linux/socket.h>
75 #include <linux/sockios.h>
76 #include <linux/errno.h>
77 #include <linux/in.h>
78 #include <linux/inet.h>
79 #include <linux/netdevice.h>
80 #include <linux/proc_fs.h>
81 #include <linux/init.h>
82 #include <linux/skbuff.h>
83 #include <linux/inetdevice.h>
84 #include <linux/igmp.h>
85 #include <linux/pkt_sched.h>
86 #include <linux/mroute.h>
87 #include <linux/netfilter_ipv4.h>
88 #include <linux/random.h>
89 #include <linux/rcupdate.h>
90 #include <linux/times.h>
91 #include <linux/slab.h>
92 #include <linux/jhash.h>
93 #include <net/dst.h>
94 #include <net/dst_metadata.h>
95 #include <net/net_namespace.h>
96 #include <net/protocol.h>
97 #include <net/ip.h>
98 #include <net/route.h>
99 #include <net/inetpeer.h>
100 #include <net/sock.h>
101 #include <net/ip_fib.h>
102 #include <net/arp.h>
103 #include <net/tcp.h>
104 #include <net/icmp.h>
105 #include <net/xfrm.h>
106 #include <net/lwtunnel.h>
107 #include <net/netevent.h>
108 #include <net/rtnetlink.h>
109 #ifdef CONFIG_SYSCTL
110 #include <linux/sysctl.h>
111 #include <linux/kmemleak.h>
112 #endif
113 #include <net/secure_seq.h>
114 #include <net/ip_tunnels.h>
115 #include <net/vrf.h>
116 
117 #define RT_FL_TOS(oldflp4) \
118 	((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
119 
120 #define RT_GC_TIMEOUT (300*HZ)
121 
122 static int ip_rt_max_size;
123 static int ip_rt_redirect_number __read_mostly	= 9;
124 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
125 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
126 static int ip_rt_error_cost __read_mostly	= HZ;
127 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
128 static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
129 static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
130 static int ip_rt_min_advmss __read_mostly	= 256;
131 
132 /*
133  *	Interface to generic destination cache.
134  */
135 
136 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
137 static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);
138 static unsigned int	 ipv4_mtu(const struct dst_entry *dst);
139 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
140 static void		 ipv4_link_failure(struct sk_buff *skb);
141 static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
142 					   struct sk_buff *skb, u32 mtu);
143 static void		 ip_do_redirect(struct dst_entry *dst, struct sock *sk,
144 					struct sk_buff *skb);
145 static void		ipv4_dst_destroy(struct dst_entry *dst);
146 
147 static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
148 {
149 	WARN_ON(1);
150 	return NULL;
151 }
152 
153 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
154 					   struct sk_buff *skb,
155 					   const void *daddr);
156 
157 static struct dst_ops ipv4_dst_ops = {
158 	.family =		AF_INET,
159 	.check =		ipv4_dst_check,
160 	.default_advmss =	ipv4_default_advmss,
161 	.mtu =			ipv4_mtu,
162 	.cow_metrics =		ipv4_cow_metrics,
163 	.destroy =		ipv4_dst_destroy,
164 	.negative_advice =	ipv4_negative_advice,
165 	.link_failure =		ipv4_link_failure,
166 	.update_pmtu =		ip_rt_update_pmtu,
167 	.redirect =		ip_do_redirect,
168 	.local_out =		__ip_local_out,
169 	.neigh_lookup =		ipv4_neigh_lookup,
170 };
171 
172 #define ECN_OR_COST(class)	TC_PRIO_##class
173 
174 const __u8 ip_tos2prio[16] = {
175 	TC_PRIO_BESTEFFORT,
176 	ECN_OR_COST(BESTEFFORT),
177 	TC_PRIO_BESTEFFORT,
178 	ECN_OR_COST(BESTEFFORT),
179 	TC_PRIO_BULK,
180 	ECN_OR_COST(BULK),
181 	TC_PRIO_BULK,
182 	ECN_OR_COST(BULK),
183 	TC_PRIO_INTERACTIVE,
184 	ECN_OR_COST(INTERACTIVE),
185 	TC_PRIO_INTERACTIVE,
186 	ECN_OR_COST(INTERACTIVE),
187 	TC_PRIO_INTERACTIVE_BULK,
188 	ECN_OR_COST(INTERACTIVE_BULK),
189 	TC_PRIO_INTERACTIVE_BULK,
190 	ECN_OR_COST(INTERACTIVE_BULK)
191 };
192 EXPORT_SYMBOL(ip_tos2prio);
193 
194 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
195 #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
196 
197 #ifdef CONFIG_PROC_FS
198 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
199 {
200 	if (*pos)
201 		return NULL;
202 	return SEQ_START_TOKEN;
203 }
204 
205 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
206 {
207 	++*pos;
208 	return NULL;
209 }
210 
211 static void rt_cache_seq_stop(struct seq_file *seq, void *v)
212 {
213 }
214 
215 static int rt_cache_seq_show(struct seq_file *seq, void *v)
216 {
217 	if (v == SEQ_START_TOKEN)
218 		seq_printf(seq, "%-127s\n",
219 			   "Iface\tDestination\tGateway \tFlags\t\tRefCnt\tUse\t"
220 			   "Metric\tSource\t\tMTU\tWindow\tIRTT\tTOS\tHHRef\t"
221 			   "HHUptod\tSpecDst");
222 	return 0;
223 }
224 
225 static const struct seq_operations rt_cache_seq_ops = {
226 	.start  = rt_cache_seq_start,
227 	.next   = rt_cache_seq_next,
228 	.stop   = rt_cache_seq_stop,
229 	.show   = rt_cache_seq_show,
230 };
231 
232 static int rt_cache_seq_open(struct inode *inode, struct file *file)
233 {
234 	return seq_open(file, &rt_cache_seq_ops);
235 }
236 
237 static const struct file_operations rt_cache_seq_fops = {
238 	.owner	 = THIS_MODULE,
239 	.open	 = rt_cache_seq_open,
240 	.read	 = seq_read,
241 	.llseek	 = seq_lseek,
242 	.release = seq_release,
243 };
244 
245 
246 static void *rt_cpu_seq_start(struct seq_file *seq, loff_t *pos)
247 {
248 	int cpu;
249 
250 	if (*pos == 0)
251 		return SEQ_START_TOKEN;
252 
253 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
254 		if (!cpu_possible(cpu))
255 			continue;
256 		*pos = cpu+1;
257 		return &per_cpu(rt_cache_stat, cpu);
258 	}
259 	return NULL;
260 }
261 
262 static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
263 {
264 	int cpu;
265 
266 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
267 		if (!cpu_possible(cpu))
268 			continue;
269 		*pos = cpu+1;
270 		return &per_cpu(rt_cache_stat, cpu);
271 	}
272 	return NULL;
273 
274 }
275 
276 static void rt_cpu_seq_stop(struct seq_file *seq, void *v)
277 {
278 
279 }
280 
281 static int rt_cpu_seq_show(struct seq_file *seq, void *v)
282 {
283 	struct rt_cache_stat *st = v;
284 
285 	if (v == SEQ_START_TOKEN) {
286 		seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
287 		return 0;
288 	}
289 
290 	seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
291 		   " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
292 		   dst_entries_get_slow(&ipv4_dst_ops),
293 		   0, /* st->in_hit */
294 		   st->in_slow_tot,
295 		   st->in_slow_mc,
296 		   st->in_no_route,
297 		   st->in_brd,
298 		   st->in_martian_dst,
299 		   st->in_martian_src,
300 
301 		   0, /* st->out_hit */
302 		   st->out_slow_tot,
303 		   st->out_slow_mc,
304 
305 		   0, /* st->gc_total */
306 		   0, /* st->gc_ignored */
307 		   0, /* st->gc_goal_miss */
308 		   0, /* st->gc_dst_overflow */
309 		   0, /* st->in_hlist_search */
310 		   0  /* st->out_hlist_search */
311 		);
312 	return 0;
313 }
314 
315 static const struct seq_operations rt_cpu_seq_ops = {
316 	.start  = rt_cpu_seq_start,
317 	.next   = rt_cpu_seq_next,
318 	.stop   = rt_cpu_seq_stop,
319 	.show   = rt_cpu_seq_show,
320 };
321 
322 
323 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
324 {
325 	return seq_open(file, &rt_cpu_seq_ops);
326 }
327 
328 static const struct file_operations rt_cpu_seq_fops = {
329 	.owner	 = THIS_MODULE,
330 	.open	 = rt_cpu_seq_open,
331 	.read	 = seq_read,
332 	.llseek	 = seq_lseek,
333 	.release = seq_release,
334 };
335 
336 #ifdef CONFIG_IP_ROUTE_CLASSID
337 static int rt_acct_proc_show(struct seq_file *m, void *v)
338 {
339 	struct ip_rt_acct *dst, *src;
340 	unsigned int i, j;
341 
342 	dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
343 	if (!dst)
344 		return -ENOMEM;
345 
346 	for_each_possible_cpu(i) {
347 		src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
348 		for (j = 0; j < 256; j++) {
349 			dst[j].o_bytes   += src[j].o_bytes;
350 			dst[j].o_packets += src[j].o_packets;
351 			dst[j].i_bytes   += src[j].i_bytes;
352 			dst[j].i_packets += src[j].i_packets;
353 		}
354 	}
355 
356 	seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
357 	kfree(dst);
358 	return 0;
359 }
360 
361 static int rt_acct_proc_open(struct inode *inode, struct file *file)
362 {
363 	return single_open(file, rt_acct_proc_show, NULL);
364 }
365 
366 static const struct file_operations rt_acct_proc_fops = {
367 	.owner		= THIS_MODULE,
368 	.open		= rt_acct_proc_open,
369 	.read		= seq_read,
370 	.llseek		= seq_lseek,
371 	.release	= single_release,
372 };
373 #endif
374 
375 static int __net_init ip_rt_do_proc_init(struct net *net)
376 {
377 	struct proc_dir_entry *pde;
378 
379 	pde = proc_create("rt_cache", S_IRUGO, net->proc_net,
380 			  &rt_cache_seq_fops);
381 	if (!pde)
382 		goto err1;
383 
384 	pde = proc_create("rt_cache", S_IRUGO,
385 			  net->proc_net_stat, &rt_cpu_seq_fops);
386 	if (!pde)
387 		goto err2;
388 
389 #ifdef CONFIG_IP_ROUTE_CLASSID
390 	pde = proc_create("rt_acct", 0, net->proc_net, &rt_acct_proc_fops);
391 	if (!pde)
392 		goto err3;
393 #endif
394 	return 0;
395 
396 #ifdef CONFIG_IP_ROUTE_CLASSID
397 err3:
398 	remove_proc_entry("rt_cache", net->proc_net_stat);
399 #endif
400 err2:
401 	remove_proc_entry("rt_cache", net->proc_net);
402 err1:
403 	return -ENOMEM;
404 }
405 
406 static void __net_exit ip_rt_do_proc_exit(struct net *net)
407 {
408 	remove_proc_entry("rt_cache", net->proc_net_stat);
409 	remove_proc_entry("rt_cache", net->proc_net);
410 #ifdef CONFIG_IP_ROUTE_CLASSID
411 	remove_proc_entry("rt_acct", net->proc_net);
412 #endif
413 }
414 
415 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
416 	.init = ip_rt_do_proc_init,
417 	.exit = ip_rt_do_proc_exit,
418 };
419 
420 static int __init ip_rt_proc_init(void)
421 {
422 	return register_pernet_subsys(&ip_rt_proc_ops);
423 }
424 
425 #else
426 static inline int ip_rt_proc_init(void)
427 {
428 	return 0;
429 }
430 #endif /* CONFIG_PROC_FS */
431 
432 static inline bool rt_is_expired(const struct rtable *rth)
433 {
434 	return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
435 }
436 
437 void rt_cache_flush(struct net *net)
438 {
439 	rt_genid_bump_ipv4(net);
440 }
441 
442 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
443 					   struct sk_buff *skb,
444 					   const void *daddr)
445 {
446 	struct net_device *dev = dst->dev;
447 	const __be32 *pkey = daddr;
448 	const struct rtable *rt;
449 	struct neighbour *n;
450 
451 	rt = (const struct rtable *) dst;
452 	if (rt->rt_gateway)
453 		pkey = (const __be32 *) &rt->rt_gateway;
454 	else if (skb)
455 		pkey = &ip_hdr(skb)->daddr;
456 
457 	n = __ipv4_neigh_lookup(dev, *(__force u32 *)pkey);
458 	if (n)
459 		return n;
460 	return neigh_create(&arp_tbl, pkey, dev);
461 }
462 
463 #define IP_IDENTS_SZ 2048u
464 
465 static atomic_t *ip_idents __read_mostly;
466 static u32 *ip_tstamps __read_mostly;
467 
468 /* In order to protect privacy, we add a perturbation to identifiers
469  * if one generator is seldom used. This makes hard for an attacker
470  * to infer how many packets were sent between two points in time.
471  */
472 u32 ip_idents_reserve(u32 hash, int segs)
473 {
474 	u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
475 	atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
476 	u32 old = ACCESS_ONCE(*p_tstamp);
477 	u32 now = (u32)jiffies;
478 	u32 delta = 0;
479 
480 	if (old != now && cmpxchg(p_tstamp, old, now) == old)
481 		delta = prandom_u32_max(now - old);
482 
483 	return atomic_add_return(segs + delta, p_id) - segs;
484 }
485 EXPORT_SYMBOL(ip_idents_reserve);
486 
487 void __ip_select_ident(struct net *net, struct iphdr *iph, int segs)
488 {
489 	static u32 ip_idents_hashrnd __read_mostly;
490 	u32 hash, id;
491 
492 	net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
493 
494 	hash = jhash_3words((__force u32)iph->daddr,
495 			    (__force u32)iph->saddr,
496 			    iph->protocol ^ net_hash_mix(net),
497 			    ip_idents_hashrnd);
498 	id = ip_idents_reserve(hash, segs);
499 	iph->id = htons(id);
500 }
501 EXPORT_SYMBOL(__ip_select_ident);
502 
503 static void __build_flow_key(struct flowi4 *fl4, const struct sock *sk,
504 			     const struct iphdr *iph,
505 			     int oif, u8 tos,
506 			     u8 prot, u32 mark, int flow_flags)
507 {
508 	if (sk) {
509 		const struct inet_sock *inet = inet_sk(sk);
510 
511 		oif = sk->sk_bound_dev_if;
512 		mark = sk->sk_mark;
513 		tos = RT_CONN_FLAGS(sk);
514 		prot = inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol;
515 	}
516 	flowi4_init_output(fl4, oif, mark, tos,
517 			   RT_SCOPE_UNIVERSE, prot,
518 			   flow_flags,
519 			   iph->daddr, iph->saddr, 0, 0);
520 }
521 
522 static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
523 			       const struct sock *sk)
524 {
525 	const struct iphdr *iph = ip_hdr(skb);
526 	int oif = skb->dev->ifindex;
527 	u8 tos = RT_TOS(iph->tos);
528 	u8 prot = iph->protocol;
529 	u32 mark = skb->mark;
530 
531 	__build_flow_key(fl4, sk, iph, oif, tos, prot, mark, 0);
532 }
533 
534 static void build_sk_flow_key(struct flowi4 *fl4, const struct sock *sk)
535 {
536 	const struct inet_sock *inet = inet_sk(sk);
537 	const struct ip_options_rcu *inet_opt;
538 	__be32 daddr = inet->inet_daddr;
539 
540 	rcu_read_lock();
541 	inet_opt = rcu_dereference(inet->inet_opt);
542 	if (inet_opt && inet_opt->opt.srr)
543 		daddr = inet_opt->opt.faddr;
544 	flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
545 			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
546 			   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
547 			   inet_sk_flowi_flags(sk),
548 			   daddr, inet->inet_saddr, 0, 0);
549 	rcu_read_unlock();
550 }
551 
552 static void ip_rt_build_flow_key(struct flowi4 *fl4, const struct sock *sk,
553 				 const struct sk_buff *skb)
554 {
555 	if (skb)
556 		build_skb_flow_key(fl4, skb, sk);
557 	else
558 		build_sk_flow_key(fl4, sk);
559 }
560 
561 static inline void rt_free(struct rtable *rt)
562 {
563 	call_rcu(&rt->dst.rcu_head, dst_rcu_free);
564 }
565 
566 static DEFINE_SPINLOCK(fnhe_lock);
567 
568 static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
569 {
570 	struct rtable *rt;
571 
572 	rt = rcu_dereference(fnhe->fnhe_rth_input);
573 	if (rt) {
574 		RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
575 		rt_free(rt);
576 	}
577 	rt = rcu_dereference(fnhe->fnhe_rth_output);
578 	if (rt) {
579 		RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
580 		rt_free(rt);
581 	}
582 }
583 
584 static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
585 {
586 	struct fib_nh_exception *fnhe, *oldest;
587 
588 	oldest = rcu_dereference(hash->chain);
589 	for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
590 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
591 		if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
592 			oldest = fnhe;
593 	}
594 	fnhe_flush_routes(oldest);
595 	return oldest;
596 }
597 
598 static inline u32 fnhe_hashfun(__be32 daddr)
599 {
600 	static u32 fnhe_hashrnd __read_mostly;
601 	u32 hval;
602 
603 	net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
604 	hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
605 	return hash_32(hval, FNHE_HASH_SHIFT);
606 }
607 
608 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
609 {
610 	rt->rt_pmtu = fnhe->fnhe_pmtu;
611 	rt->dst.expires = fnhe->fnhe_expires;
612 
613 	if (fnhe->fnhe_gw) {
614 		rt->rt_flags |= RTCF_REDIRECTED;
615 		rt->rt_gateway = fnhe->fnhe_gw;
616 		rt->rt_uses_gateway = 1;
617 	}
618 }
619 
620 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
621 				  u32 pmtu, unsigned long expires)
622 {
623 	struct fnhe_hash_bucket *hash;
624 	struct fib_nh_exception *fnhe;
625 	struct rtable *rt;
626 	unsigned int i;
627 	int depth;
628 	u32 hval = fnhe_hashfun(daddr);
629 
630 	spin_lock_bh(&fnhe_lock);
631 
632 	hash = rcu_dereference(nh->nh_exceptions);
633 	if (!hash) {
634 		hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);
635 		if (!hash)
636 			goto out_unlock;
637 		rcu_assign_pointer(nh->nh_exceptions, hash);
638 	}
639 
640 	hash += hval;
641 
642 	depth = 0;
643 	for (fnhe = rcu_dereference(hash->chain); fnhe;
644 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
645 		if (fnhe->fnhe_daddr == daddr)
646 			break;
647 		depth++;
648 	}
649 
650 	if (fnhe) {
651 		if (gw)
652 			fnhe->fnhe_gw = gw;
653 		if (pmtu) {
654 			fnhe->fnhe_pmtu = pmtu;
655 			fnhe->fnhe_expires = max(1UL, expires);
656 		}
657 		/* Update all cached dsts too */
658 		rt = rcu_dereference(fnhe->fnhe_rth_input);
659 		if (rt)
660 			fill_route_from_fnhe(rt, fnhe);
661 		rt = rcu_dereference(fnhe->fnhe_rth_output);
662 		if (rt)
663 			fill_route_from_fnhe(rt, fnhe);
664 	} else {
665 		if (depth > FNHE_RECLAIM_DEPTH)
666 			fnhe = fnhe_oldest(hash);
667 		else {
668 			fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
669 			if (!fnhe)
670 				goto out_unlock;
671 
672 			fnhe->fnhe_next = hash->chain;
673 			rcu_assign_pointer(hash->chain, fnhe);
674 		}
675 		fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
676 		fnhe->fnhe_daddr = daddr;
677 		fnhe->fnhe_gw = gw;
678 		fnhe->fnhe_pmtu = pmtu;
679 		fnhe->fnhe_expires = expires;
680 
681 		/* Exception created; mark the cached routes for the nexthop
682 		 * stale, so anyone caching it rechecks if this exception
683 		 * applies to them.
684 		 */
685 		rt = rcu_dereference(nh->nh_rth_input);
686 		if (rt)
687 			rt->dst.obsolete = DST_OBSOLETE_KILL;
688 
689 		for_each_possible_cpu(i) {
690 			struct rtable __rcu **prt;
691 			prt = per_cpu_ptr(nh->nh_pcpu_rth_output, i);
692 			rt = rcu_dereference(*prt);
693 			if (rt)
694 				rt->dst.obsolete = DST_OBSOLETE_KILL;
695 		}
696 	}
697 
698 	fnhe->fnhe_stamp = jiffies;
699 
700 out_unlock:
701 	spin_unlock_bh(&fnhe_lock);
702 }
703 
704 static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flowi4 *fl4,
705 			     bool kill_route)
706 {
707 	__be32 new_gw = icmp_hdr(skb)->un.gateway;
708 	__be32 old_gw = ip_hdr(skb)->saddr;
709 	struct net_device *dev = skb->dev;
710 	struct in_device *in_dev;
711 	struct fib_result res;
712 	struct neighbour *n;
713 	struct net *net;
714 
715 	switch (icmp_hdr(skb)->code & 7) {
716 	case ICMP_REDIR_NET:
717 	case ICMP_REDIR_NETTOS:
718 	case ICMP_REDIR_HOST:
719 	case ICMP_REDIR_HOSTTOS:
720 		break;
721 
722 	default:
723 		return;
724 	}
725 
726 	if (rt->rt_gateway != old_gw)
727 		return;
728 
729 	in_dev = __in_dev_get_rcu(dev);
730 	if (!in_dev)
731 		return;
732 
733 	net = dev_net(dev);
734 	if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
735 	    ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
736 	    ipv4_is_zeronet(new_gw))
737 		goto reject_redirect;
738 
739 	if (!IN_DEV_SHARED_MEDIA(in_dev)) {
740 		if (!inet_addr_onlink(in_dev, new_gw, old_gw))
741 			goto reject_redirect;
742 		if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
743 			goto reject_redirect;
744 	} else {
745 		if (inet_addr_type(net, new_gw) != RTN_UNICAST)
746 			goto reject_redirect;
747 	}
748 
749 	n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
750 	if (!IS_ERR(n)) {
751 		if (!(n->nud_state & NUD_VALID)) {
752 			neigh_event_send(n, NULL);
753 		} else {
754 			if (fib_lookup(net, fl4, &res, 0) == 0) {
755 				struct fib_nh *nh = &FIB_RES_NH(res);
756 
757 				update_or_create_fnhe(nh, fl4->daddr, new_gw,
758 						      0, 0);
759 			}
760 			if (kill_route)
761 				rt->dst.obsolete = DST_OBSOLETE_KILL;
762 			call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
763 		}
764 		neigh_release(n);
765 	}
766 	return;
767 
768 reject_redirect:
769 #ifdef CONFIG_IP_ROUTE_VERBOSE
770 	if (IN_DEV_LOG_MARTIANS(in_dev)) {
771 		const struct iphdr *iph = (const struct iphdr *) skb->data;
772 		__be32 daddr = iph->daddr;
773 		__be32 saddr = iph->saddr;
774 
775 		net_info_ratelimited("Redirect from %pI4 on %s about %pI4 ignored\n"
776 				     "  Advised path = %pI4 -> %pI4\n",
777 				     &old_gw, dev->name, &new_gw,
778 				     &saddr, &daddr);
779 	}
780 #endif
781 	;
782 }
783 
784 static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
785 {
786 	struct rtable *rt;
787 	struct flowi4 fl4;
788 	const struct iphdr *iph = (const struct iphdr *) skb->data;
789 	int oif = skb->dev->ifindex;
790 	u8 tos = RT_TOS(iph->tos);
791 	u8 prot = iph->protocol;
792 	u32 mark = skb->mark;
793 
794 	rt = (struct rtable *) dst;
795 
796 	__build_flow_key(&fl4, sk, iph, oif, tos, prot, mark, 0);
797 	__ip_do_redirect(rt, skb, &fl4, true);
798 }
799 
800 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
801 {
802 	struct rtable *rt = (struct rtable *)dst;
803 	struct dst_entry *ret = dst;
804 
805 	if (rt) {
806 		if (dst->obsolete > 0) {
807 			ip_rt_put(rt);
808 			ret = NULL;
809 		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
810 			   rt->dst.expires) {
811 			ip_rt_put(rt);
812 			ret = NULL;
813 		}
814 	}
815 	return ret;
816 }
817 
818 /*
819  * Algorithm:
820  *	1. The first ip_rt_redirect_number redirects are sent
821  *	   with exponential backoff, then we stop sending them at all,
822  *	   assuming that the host ignores our redirects.
823  *	2. If we did not see packets requiring redirects
824  *	   during ip_rt_redirect_silence, we assume that the host
825  *	   forgot redirected route and start to send redirects again.
826  *
827  * This algorithm is much cheaper and more intelligent than dumb load limiting
828  * in icmp.c.
829  *
830  * NOTE. Do not forget to inhibit load limiting for redirects (redundant)
831  * and "frag. need" (breaks PMTU discovery) in icmp.c.
832  */
833 
834 void ip_rt_send_redirect(struct sk_buff *skb)
835 {
836 	struct rtable *rt = skb_rtable(skb);
837 	struct in_device *in_dev;
838 	struct inet_peer *peer;
839 	struct net *net;
840 	int log_martians;
841 	int vif;
842 
843 	rcu_read_lock();
844 	in_dev = __in_dev_get_rcu(rt->dst.dev);
845 	if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
846 		rcu_read_unlock();
847 		return;
848 	}
849 	log_martians = IN_DEV_LOG_MARTIANS(in_dev);
850 	vif = vrf_master_ifindex_rcu(rt->dst.dev);
851 	rcu_read_unlock();
852 
853 	net = dev_net(rt->dst.dev);
854 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif, 1);
855 	if (!peer) {
856 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
857 			  rt_nexthop(rt, ip_hdr(skb)->daddr));
858 		return;
859 	}
860 
861 	/* No redirected packets during ip_rt_redirect_silence;
862 	 * reset the algorithm.
863 	 */
864 	if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
865 		peer->rate_tokens = 0;
866 
867 	/* Too many ignored redirects; do not send anything
868 	 * set dst.rate_last to the last seen redirected packet.
869 	 */
870 	if (peer->rate_tokens >= ip_rt_redirect_number) {
871 		peer->rate_last = jiffies;
872 		goto out_put_peer;
873 	}
874 
875 	/* Check for load limit; set rate_last to the latest sent
876 	 * redirect.
877 	 */
878 	if (peer->rate_tokens == 0 ||
879 	    time_after(jiffies,
880 		       (peer->rate_last +
881 			(ip_rt_redirect_load << peer->rate_tokens)))) {
882 		__be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
883 
884 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
885 		peer->rate_last = jiffies;
886 		++peer->rate_tokens;
887 #ifdef CONFIG_IP_ROUTE_VERBOSE
888 		if (log_martians &&
889 		    peer->rate_tokens == ip_rt_redirect_number)
890 			net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
891 					     &ip_hdr(skb)->saddr, inet_iif(skb),
892 					     &ip_hdr(skb)->daddr, &gw);
893 #endif
894 	}
895 out_put_peer:
896 	inet_putpeer(peer);
897 }
898 
899 static int ip_error(struct sk_buff *skb)
900 {
901 	struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
902 	struct rtable *rt = skb_rtable(skb);
903 	struct inet_peer *peer;
904 	unsigned long now;
905 	struct net *net;
906 	bool send;
907 	int code;
908 
909 	/* IP on this device is disabled. */
910 	if (!in_dev)
911 		goto out;
912 
913 	net = dev_net(rt->dst.dev);
914 	if (!IN_DEV_FORWARD(in_dev)) {
915 		switch (rt->dst.error) {
916 		case EHOSTUNREACH:
917 			IP_INC_STATS_BH(net, IPSTATS_MIB_INADDRERRORS);
918 			break;
919 
920 		case ENETUNREACH:
921 			IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
922 			break;
923 		}
924 		goto out;
925 	}
926 
927 	switch (rt->dst.error) {
928 	case EINVAL:
929 	default:
930 		goto out;
931 	case EHOSTUNREACH:
932 		code = ICMP_HOST_UNREACH;
933 		break;
934 	case ENETUNREACH:
935 		code = ICMP_NET_UNREACH;
936 		IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
937 		break;
938 	case EACCES:
939 		code = ICMP_PKT_FILTERED;
940 		break;
941 	}
942 
943 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr,
944 			       vrf_master_ifindex(skb->dev), 1);
945 
946 	send = true;
947 	if (peer) {
948 		now = jiffies;
949 		peer->rate_tokens += now - peer->rate_last;
950 		if (peer->rate_tokens > ip_rt_error_burst)
951 			peer->rate_tokens = ip_rt_error_burst;
952 		peer->rate_last = now;
953 		if (peer->rate_tokens >= ip_rt_error_cost)
954 			peer->rate_tokens -= ip_rt_error_cost;
955 		else
956 			send = false;
957 		inet_putpeer(peer);
958 	}
959 	if (send)
960 		icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
961 
962 out:	kfree_skb(skb);
963 	return 0;
964 }
965 
966 static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
967 {
968 	struct dst_entry *dst = &rt->dst;
969 	struct fib_result res;
970 
971 	if (dst_metric_locked(dst, RTAX_MTU))
972 		return;
973 
974 	if (ipv4_mtu(dst) < mtu)
975 		return;
976 
977 	if (mtu < ip_rt_min_pmtu)
978 		mtu = ip_rt_min_pmtu;
979 
980 	if (rt->rt_pmtu == mtu &&
981 	    time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
982 		return;
983 
984 	rcu_read_lock();
985 	if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
986 		struct fib_nh *nh = &FIB_RES_NH(res);
987 
988 		update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
989 				      jiffies + ip_rt_mtu_expires);
990 	}
991 	rcu_read_unlock();
992 }
993 
994 static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
995 			      struct sk_buff *skb, u32 mtu)
996 {
997 	struct rtable *rt = (struct rtable *) dst;
998 	struct flowi4 fl4;
999 
1000 	ip_rt_build_flow_key(&fl4, sk, skb);
1001 	__ip_rt_update_pmtu(rt, &fl4, mtu);
1002 }
1003 
1004 void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
1005 		      int oif, u32 mark, u8 protocol, int flow_flags)
1006 {
1007 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1008 	struct flowi4 fl4;
1009 	struct rtable *rt;
1010 
1011 	if (!mark)
1012 		mark = IP4_REPLY_MARK(net, skb->mark);
1013 
1014 	__build_flow_key(&fl4, NULL, iph, oif,
1015 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1016 	rt = __ip_route_output_key(net, &fl4);
1017 	if (!IS_ERR(rt)) {
1018 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1019 		ip_rt_put(rt);
1020 	}
1021 }
1022 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
1023 
1024 static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1025 {
1026 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1027 	struct flowi4 fl4;
1028 	struct rtable *rt;
1029 
1030 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1031 
1032 	if (!fl4.flowi4_mark)
1033 		fl4.flowi4_mark = IP4_REPLY_MARK(sock_net(sk), skb->mark);
1034 
1035 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1036 	if (!IS_ERR(rt)) {
1037 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1038 		ip_rt_put(rt);
1039 	}
1040 }
1041 
1042 void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1043 {
1044 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1045 	struct flowi4 fl4;
1046 	struct rtable *rt;
1047 	struct dst_entry *odst = NULL;
1048 	bool new = false;
1049 
1050 	bh_lock_sock(sk);
1051 
1052 	if (!ip_sk_accept_pmtu(sk))
1053 		goto out;
1054 
1055 	odst = sk_dst_get(sk);
1056 
1057 	if (sock_owned_by_user(sk) || !odst) {
1058 		__ipv4_sk_update_pmtu(skb, sk, mtu);
1059 		goto out;
1060 	}
1061 
1062 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1063 
1064 	rt = (struct rtable *)odst;
1065 	if (odst->obsolete && !odst->ops->check(odst, 0)) {
1066 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1067 		if (IS_ERR(rt))
1068 			goto out;
1069 
1070 		new = true;
1071 	}
1072 
1073 	__ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
1074 
1075 	if (!dst_check(&rt->dst, 0)) {
1076 		if (new)
1077 			dst_release(&rt->dst);
1078 
1079 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1080 		if (IS_ERR(rt))
1081 			goto out;
1082 
1083 		new = true;
1084 	}
1085 
1086 	if (new)
1087 		sk_dst_set(sk, &rt->dst);
1088 
1089 out:
1090 	bh_unlock_sock(sk);
1091 	dst_release(odst);
1092 }
1093 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
1094 
1095 void ipv4_redirect(struct sk_buff *skb, struct net *net,
1096 		   int oif, u32 mark, u8 protocol, int flow_flags)
1097 {
1098 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1099 	struct flowi4 fl4;
1100 	struct rtable *rt;
1101 
1102 	__build_flow_key(&fl4, NULL, iph, oif,
1103 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1104 	rt = __ip_route_output_key(net, &fl4);
1105 	if (!IS_ERR(rt)) {
1106 		__ip_do_redirect(rt, skb, &fl4, false);
1107 		ip_rt_put(rt);
1108 	}
1109 }
1110 EXPORT_SYMBOL_GPL(ipv4_redirect);
1111 
1112 void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk)
1113 {
1114 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1115 	struct flowi4 fl4;
1116 	struct rtable *rt;
1117 
1118 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1119 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1120 	if (!IS_ERR(rt)) {
1121 		__ip_do_redirect(rt, skb, &fl4, false);
1122 		ip_rt_put(rt);
1123 	}
1124 }
1125 EXPORT_SYMBOL_GPL(ipv4_sk_redirect);
1126 
1127 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
1128 {
1129 	struct rtable *rt = (struct rtable *) dst;
1130 
1131 	/* All IPV4 dsts are created with ->obsolete set to the value
1132 	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
1133 	 * into this function always.
1134 	 *
1135 	 * When a PMTU/redirect information update invalidates a route,
1136 	 * this is indicated by setting obsolete to DST_OBSOLETE_KILL or
1137 	 * DST_OBSOLETE_DEAD by dst_free().
1138 	 */
1139 	if (dst->obsolete != DST_OBSOLETE_FORCE_CHK || rt_is_expired(rt))
1140 		return NULL;
1141 	return dst;
1142 }
1143 
1144 static void ipv4_link_failure(struct sk_buff *skb)
1145 {
1146 	struct rtable *rt;
1147 
1148 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
1149 
1150 	rt = skb_rtable(skb);
1151 	if (rt)
1152 		dst_set_expires(&rt->dst, 0);
1153 }
1154 
1155 static int ip_rt_bug(struct sock *sk, struct sk_buff *skb)
1156 {
1157 	pr_debug("%s: %pI4 -> %pI4, %s\n",
1158 		 __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
1159 		 skb->dev ? skb->dev->name : "?");
1160 	kfree_skb(skb);
1161 	WARN_ON(1);
1162 	return 0;
1163 }
1164 
1165 /*
1166    We do not cache source address of outgoing interface,
1167    because it is used only by IP RR, TS and SRR options,
1168    so that it out of fast path.
1169 
1170    BTW remember: "addr" is allowed to be not aligned
1171    in IP options!
1172  */
1173 
1174 void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
1175 {
1176 	__be32 src;
1177 
1178 	if (rt_is_output_route(rt))
1179 		src = ip_hdr(skb)->saddr;
1180 	else {
1181 		struct fib_result res;
1182 		struct flowi4 fl4;
1183 		struct iphdr *iph;
1184 
1185 		iph = ip_hdr(skb);
1186 
1187 		memset(&fl4, 0, sizeof(fl4));
1188 		fl4.daddr = iph->daddr;
1189 		fl4.saddr = iph->saddr;
1190 		fl4.flowi4_tos = RT_TOS(iph->tos);
1191 		fl4.flowi4_oif = rt->dst.dev->ifindex;
1192 		fl4.flowi4_iif = skb->dev->ifindex;
1193 		fl4.flowi4_mark = skb->mark;
1194 
1195 		rcu_read_lock();
1196 		if (fib_lookup(dev_net(rt->dst.dev), &fl4, &res, 0) == 0)
1197 			src = FIB_RES_PREFSRC(dev_net(rt->dst.dev), res);
1198 		else
1199 			src = inet_select_addr(rt->dst.dev,
1200 					       rt_nexthop(rt, iph->daddr),
1201 					       RT_SCOPE_UNIVERSE);
1202 		rcu_read_unlock();
1203 	}
1204 	memcpy(addr, &src, 4);
1205 }
1206 
1207 #ifdef CONFIG_IP_ROUTE_CLASSID
1208 static void set_class_tag(struct rtable *rt, u32 tag)
1209 {
1210 	if (!(rt->dst.tclassid & 0xFFFF))
1211 		rt->dst.tclassid |= tag & 0xFFFF;
1212 	if (!(rt->dst.tclassid & 0xFFFF0000))
1213 		rt->dst.tclassid |= tag & 0xFFFF0000;
1214 }
1215 #endif
1216 
1217 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
1218 {
1219 	unsigned int advmss = dst_metric_raw(dst, RTAX_ADVMSS);
1220 
1221 	if (advmss == 0) {
1222 		advmss = max_t(unsigned int, dst->dev->mtu - 40,
1223 			       ip_rt_min_advmss);
1224 		if (advmss > 65535 - 40)
1225 			advmss = 65535 - 40;
1226 	}
1227 	return advmss;
1228 }
1229 
1230 static unsigned int ipv4_mtu(const struct dst_entry *dst)
1231 {
1232 	const struct rtable *rt = (const struct rtable *) dst;
1233 	unsigned int mtu = rt->rt_pmtu;
1234 
1235 	if (!mtu || time_after_eq(jiffies, rt->dst.expires))
1236 		mtu = dst_metric_raw(dst, RTAX_MTU);
1237 
1238 	if (mtu)
1239 		return mtu;
1240 
1241 	mtu = dst->dev->mtu;
1242 
1243 	if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
1244 		if (rt->rt_uses_gateway && mtu > 576)
1245 			mtu = 576;
1246 	}
1247 
1248 	return min_t(unsigned int, mtu, IP_MAX_MTU);
1249 }
1250 
1251 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
1252 {
1253 	struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);
1254 	struct fib_nh_exception *fnhe;
1255 	u32 hval;
1256 
1257 	if (!hash)
1258 		return NULL;
1259 
1260 	hval = fnhe_hashfun(daddr);
1261 
1262 	for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
1263 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
1264 		if (fnhe->fnhe_daddr == daddr)
1265 			return fnhe;
1266 	}
1267 	return NULL;
1268 }
1269 
1270 static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
1271 			      __be32 daddr)
1272 {
1273 	bool ret = false;
1274 
1275 	spin_lock_bh(&fnhe_lock);
1276 
1277 	if (daddr == fnhe->fnhe_daddr) {
1278 		struct rtable __rcu **porig;
1279 		struct rtable *orig;
1280 		int genid = fnhe_genid(dev_net(rt->dst.dev));
1281 
1282 		if (rt_is_input_route(rt))
1283 			porig = &fnhe->fnhe_rth_input;
1284 		else
1285 			porig = &fnhe->fnhe_rth_output;
1286 		orig = rcu_dereference(*porig);
1287 
1288 		if (fnhe->fnhe_genid != genid) {
1289 			fnhe->fnhe_genid = genid;
1290 			fnhe->fnhe_gw = 0;
1291 			fnhe->fnhe_pmtu = 0;
1292 			fnhe->fnhe_expires = 0;
1293 			fnhe_flush_routes(fnhe);
1294 			orig = NULL;
1295 		}
1296 		fill_route_from_fnhe(rt, fnhe);
1297 		if (!rt->rt_gateway)
1298 			rt->rt_gateway = daddr;
1299 
1300 		if (!(rt->dst.flags & DST_NOCACHE)) {
1301 			rcu_assign_pointer(*porig, rt);
1302 			if (orig)
1303 				rt_free(orig);
1304 			ret = true;
1305 		}
1306 
1307 		fnhe->fnhe_stamp = jiffies;
1308 	}
1309 	spin_unlock_bh(&fnhe_lock);
1310 
1311 	return ret;
1312 }
1313 
1314 static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
1315 {
1316 	struct rtable *orig, *prev, **p;
1317 	bool ret = true;
1318 
1319 	if (rt_is_input_route(rt)) {
1320 		p = (struct rtable **)&nh->nh_rth_input;
1321 	} else {
1322 		p = (struct rtable **)raw_cpu_ptr(nh->nh_pcpu_rth_output);
1323 	}
1324 	orig = *p;
1325 
1326 	prev = cmpxchg(p, orig, rt);
1327 	if (prev == orig) {
1328 		if (orig)
1329 			rt_free(orig);
1330 	} else
1331 		ret = false;
1332 
1333 	return ret;
1334 }
1335 
1336 struct uncached_list {
1337 	spinlock_t		lock;
1338 	struct list_head	head;
1339 };
1340 
1341 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt_uncached_list);
1342 
1343 static void rt_add_uncached_list(struct rtable *rt)
1344 {
1345 	struct uncached_list *ul = raw_cpu_ptr(&rt_uncached_list);
1346 
1347 	rt->rt_uncached_list = ul;
1348 
1349 	spin_lock_bh(&ul->lock);
1350 	list_add_tail(&rt->rt_uncached, &ul->head);
1351 	spin_unlock_bh(&ul->lock);
1352 }
1353 
1354 static void ipv4_dst_destroy(struct dst_entry *dst)
1355 {
1356 	struct rtable *rt = (struct rtable *) dst;
1357 
1358 	if (!list_empty(&rt->rt_uncached)) {
1359 		struct uncached_list *ul = rt->rt_uncached_list;
1360 
1361 		spin_lock_bh(&ul->lock);
1362 		list_del(&rt->rt_uncached);
1363 		spin_unlock_bh(&ul->lock);
1364 	}
1365 }
1366 
1367 void rt_flush_dev(struct net_device *dev)
1368 {
1369 	struct net *net = dev_net(dev);
1370 	struct rtable *rt;
1371 	int cpu;
1372 
1373 	for_each_possible_cpu(cpu) {
1374 		struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
1375 
1376 		spin_lock_bh(&ul->lock);
1377 		list_for_each_entry(rt, &ul->head, rt_uncached) {
1378 			if (rt->dst.dev != dev)
1379 				continue;
1380 			rt->dst.dev = net->loopback_dev;
1381 			dev_hold(rt->dst.dev);
1382 			dev_put(dev);
1383 		}
1384 		spin_unlock_bh(&ul->lock);
1385 	}
1386 }
1387 
1388 static bool rt_cache_valid(const struct rtable *rt)
1389 {
1390 	return	rt &&
1391 		rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1392 		!rt_is_expired(rt);
1393 }
1394 
1395 static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
1396 			   const struct fib_result *res,
1397 			   struct fib_nh_exception *fnhe,
1398 			   struct fib_info *fi, u16 type, u32 itag)
1399 {
1400 	bool cached = false;
1401 
1402 	if (fi) {
1403 		struct fib_nh *nh = &FIB_RES_NH(*res);
1404 
1405 		if (nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) {
1406 			rt->rt_gateway = nh->nh_gw;
1407 			rt->rt_uses_gateway = 1;
1408 		}
1409 		dst_init_metrics(&rt->dst, fi->fib_metrics, true);
1410 #ifdef CONFIG_IP_ROUTE_CLASSID
1411 		rt->dst.tclassid = nh->nh_tclassid;
1412 #endif
1413 		rt->dst.lwtstate = lwtstate_get(nh->nh_lwtstate);
1414 		if (unlikely(fnhe))
1415 			cached = rt_bind_exception(rt, fnhe, daddr);
1416 		else if (!(rt->dst.flags & DST_NOCACHE))
1417 			cached = rt_cache_route(nh, rt);
1418 		if (unlikely(!cached)) {
1419 			/* Routes we intend to cache in nexthop exception or
1420 			 * FIB nexthop have the DST_NOCACHE bit clear.
1421 			 * However, if we are unsuccessful at storing this
1422 			 * route into the cache we really need to set it.
1423 			 */
1424 			rt->dst.flags |= DST_NOCACHE;
1425 			if (!rt->rt_gateway)
1426 				rt->rt_gateway = daddr;
1427 			rt_add_uncached_list(rt);
1428 		}
1429 	} else
1430 		rt_add_uncached_list(rt);
1431 
1432 #ifdef CONFIG_IP_ROUTE_CLASSID
1433 #ifdef CONFIG_IP_MULTIPLE_TABLES
1434 	set_class_tag(rt, res->tclassid);
1435 #endif
1436 	set_class_tag(rt, itag);
1437 #endif
1438 }
1439 
1440 static struct rtable *rt_dst_alloc(struct net_device *dev,
1441 				   unsigned int flags, u16 type,
1442 				   bool nopolicy, bool noxfrm, bool will_cache)
1443 {
1444 	struct rtable *rt;
1445 
1446 	rt = dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
1447 		       (will_cache ? 0 : (DST_HOST | DST_NOCACHE)) |
1448 		       (nopolicy ? DST_NOPOLICY : 0) |
1449 		       (noxfrm ? DST_NOXFRM : 0));
1450 
1451 	if (rt) {
1452 		rt->rt_genid = rt_genid_ipv4(dev_net(dev));
1453 		rt->rt_flags = flags;
1454 		rt->rt_type = type;
1455 		rt->rt_is_input = 0;
1456 		rt->rt_iif = 0;
1457 		rt->rt_pmtu = 0;
1458 		rt->rt_gateway = 0;
1459 		rt->rt_uses_gateway = 0;
1460 		rt->rt_table_id = 0;
1461 		INIT_LIST_HEAD(&rt->rt_uncached);
1462 
1463 		rt->dst.output = ip_output;
1464 		if (flags & RTCF_LOCAL)
1465 			rt->dst.input = ip_local_deliver;
1466 	}
1467 
1468 	return rt;
1469 }
1470 
1471 /* called in rcu_read_lock() section */
1472 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1473 				u8 tos, struct net_device *dev, int our)
1474 {
1475 	struct rtable *rth;
1476 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1477 	unsigned int flags = RTCF_MULTICAST;
1478 	u32 itag = 0;
1479 	int err;
1480 
1481 	/* Primary sanity checks. */
1482 
1483 	if (!in_dev)
1484 		return -EINVAL;
1485 
1486 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1487 	    skb->protocol != htons(ETH_P_IP))
1488 		goto e_inval;
1489 
1490 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1491 		if (ipv4_is_loopback(saddr))
1492 			goto e_inval;
1493 
1494 	if (ipv4_is_zeronet(saddr)) {
1495 		if (!ipv4_is_local_multicast(daddr))
1496 			goto e_inval;
1497 	} else {
1498 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1499 					  in_dev, &itag);
1500 		if (err < 0)
1501 			goto e_err;
1502 	}
1503 	if (our)
1504 		flags |= RTCF_LOCAL;
1505 
1506 	rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST,
1507 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
1508 	if (!rth)
1509 		goto e_nobufs;
1510 
1511 #ifdef CONFIG_IP_ROUTE_CLASSID
1512 	rth->dst.tclassid = itag;
1513 #endif
1514 	rth->dst.output = ip_rt_bug;
1515 	rth->rt_is_input= 1;
1516 
1517 #ifdef CONFIG_IP_MROUTE
1518 	if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
1519 		rth->dst.input = ip_mr_input;
1520 #endif
1521 	RT_CACHE_STAT_INC(in_slow_mc);
1522 
1523 	skb_dst_set(skb, &rth->dst);
1524 	return 0;
1525 
1526 e_nobufs:
1527 	return -ENOBUFS;
1528 e_inval:
1529 	return -EINVAL;
1530 e_err:
1531 	return err;
1532 }
1533 
1534 
1535 static void ip_handle_martian_source(struct net_device *dev,
1536 				     struct in_device *in_dev,
1537 				     struct sk_buff *skb,
1538 				     __be32 daddr,
1539 				     __be32 saddr)
1540 {
1541 	RT_CACHE_STAT_INC(in_martian_src);
1542 #ifdef CONFIG_IP_ROUTE_VERBOSE
1543 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
1544 		/*
1545 		 *	RFC1812 recommendation, if source is martian,
1546 		 *	the only hint is MAC header.
1547 		 */
1548 		pr_warn("martian source %pI4 from %pI4, on dev %s\n",
1549 			&daddr, &saddr, dev->name);
1550 		if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
1551 			print_hex_dump(KERN_WARNING, "ll header: ",
1552 				       DUMP_PREFIX_OFFSET, 16, 1,
1553 				       skb_mac_header(skb),
1554 				       dev->hard_header_len, true);
1555 		}
1556 	}
1557 #endif
1558 }
1559 
1560 /* called in rcu_read_lock() section */
1561 static int __mkroute_input(struct sk_buff *skb,
1562 			   const struct fib_result *res,
1563 			   struct in_device *in_dev,
1564 			   __be32 daddr, __be32 saddr, u32 tos)
1565 {
1566 	struct fib_nh_exception *fnhe;
1567 	struct rtable *rth;
1568 	int err;
1569 	struct in_device *out_dev;
1570 	bool do_cache;
1571 	u32 itag = 0;
1572 
1573 	/* get a working reference to the output device */
1574 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
1575 	if (!out_dev) {
1576 		net_crit_ratelimited("Bug in ip_route_input_slow(). Please report.\n");
1577 		return -EINVAL;
1578 	}
1579 
1580 	err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
1581 				  in_dev->dev, in_dev, &itag);
1582 	if (err < 0) {
1583 		ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
1584 					 saddr);
1585 
1586 		goto cleanup;
1587 	}
1588 
1589 	do_cache = res->fi && !itag;
1590 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
1591 	    skb->protocol == htons(ETH_P_IP) &&
1592 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
1593 	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
1594 		IPCB(skb)->flags |= IPSKB_DOREDIRECT;
1595 
1596 	if (skb->protocol != htons(ETH_P_IP)) {
1597 		/* Not IP (i.e. ARP). Do not create route, if it is
1598 		 * invalid for proxy arp. DNAT routes are always valid.
1599 		 *
1600 		 * Proxy arp feature have been extended to allow, ARP
1601 		 * replies back to the same interface, to support
1602 		 * Private VLAN switch technologies. See arp.c.
1603 		 */
1604 		if (out_dev == in_dev &&
1605 		    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
1606 			err = -EINVAL;
1607 			goto cleanup;
1608 		}
1609 	}
1610 
1611 	fnhe = find_exception(&FIB_RES_NH(*res), daddr);
1612 	if (do_cache) {
1613 		if (fnhe)
1614 			rth = rcu_dereference(fnhe->fnhe_rth_input);
1615 		else
1616 			rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
1617 
1618 		if (rt_cache_valid(rth)) {
1619 			skb_dst_set_noref(skb, &rth->dst);
1620 			goto out;
1621 		}
1622 	}
1623 
1624 	rth = rt_dst_alloc(out_dev->dev, 0, res->type,
1625 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1626 			   IN_DEV_CONF_GET(out_dev, NOXFRM), do_cache);
1627 	if (!rth) {
1628 		err = -ENOBUFS;
1629 		goto cleanup;
1630 	}
1631 
1632 	rth->rt_is_input = 1;
1633 	if (res->table)
1634 		rth->rt_table_id = res->table->tb_id;
1635 	RT_CACHE_STAT_INC(in_slow_tot);
1636 
1637 	rth->dst.input = ip_forward;
1638 
1639 	rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag);
1640 	if (lwtunnel_output_redirect(rth->dst.lwtstate)) {
1641 		rth->dst.lwtstate->orig_output = rth->dst.output;
1642 		rth->dst.output = lwtunnel_output;
1643 	}
1644 	if (lwtunnel_input_redirect(rth->dst.lwtstate)) {
1645 		rth->dst.lwtstate->orig_input = rth->dst.input;
1646 		rth->dst.input = lwtunnel_input;
1647 	}
1648 	skb_dst_set(skb, &rth->dst);
1649 out:
1650 	err = 0;
1651  cleanup:
1652 	return err;
1653 }
1654 
1655 static int ip_mkroute_input(struct sk_buff *skb,
1656 			    struct fib_result *res,
1657 			    const struct flowi4 *fl4,
1658 			    struct in_device *in_dev,
1659 			    __be32 daddr, __be32 saddr, u32 tos)
1660 {
1661 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1662 	if (res->fi && res->fi->fib_nhs > 1)
1663 		fib_select_multipath(res);
1664 #endif
1665 
1666 	/* create a routing cache entry */
1667 	return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
1668 }
1669 
1670 /*
1671  *	NOTE. We drop all the packets that has local source
1672  *	addresses, because every properly looped back packet
1673  *	must have correct destination already attached by output routine.
1674  *
1675  *	Such approach solves two big problems:
1676  *	1. Not simplex devices are handled properly.
1677  *	2. IP spoofing attempts are filtered with 100% of guarantee.
1678  *	called with rcu_read_lock()
1679  */
1680 
1681 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1682 			       u8 tos, struct net_device *dev)
1683 {
1684 	struct fib_result res;
1685 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1686 	struct ip_tunnel_info *tun_info;
1687 	struct flowi4	fl4;
1688 	unsigned int	flags = 0;
1689 	u32		itag = 0;
1690 	struct rtable	*rth;
1691 	int		err = -EINVAL;
1692 	struct net    *net = dev_net(dev);
1693 	bool do_cache;
1694 
1695 	/* IP on this device is disabled. */
1696 
1697 	if (!in_dev)
1698 		goto out;
1699 
1700 	/* Check for the most weird martians, which can be not detected
1701 	   by fib_lookup.
1702 	 */
1703 
1704 	tun_info = skb_tunnel_info(skb);
1705 	if (tun_info && !(tun_info->mode & IP_TUNNEL_INFO_TX))
1706 		fl4.flowi4_tun_key.tun_id = tun_info->key.tun_id;
1707 	else
1708 		fl4.flowi4_tun_key.tun_id = 0;
1709 	skb_dst_drop(skb);
1710 
1711 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
1712 		goto martian_source;
1713 
1714 	res.fi = NULL;
1715 	if (ipv4_is_lbcast(daddr) || (saddr == 0 && daddr == 0))
1716 		goto brd_input;
1717 
1718 	/* Accept zero addresses only to limited broadcast;
1719 	 * I even do not know to fix it or not. Waiting for complains :-)
1720 	 */
1721 	if (ipv4_is_zeronet(saddr))
1722 		goto martian_source;
1723 
1724 	if (ipv4_is_zeronet(daddr))
1725 		goto martian_destination;
1726 
1727 	/* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
1728 	 * and call it once if daddr or/and saddr are loopback addresses
1729 	 */
1730 	if (ipv4_is_loopback(daddr)) {
1731 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1732 			goto martian_destination;
1733 	} else if (ipv4_is_loopback(saddr)) {
1734 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1735 			goto martian_source;
1736 	}
1737 
1738 	/*
1739 	 *	Now we are ready to route packet.
1740 	 */
1741 	fl4.flowi4_oif = 0;
1742 	fl4.flowi4_iif = vrf_master_ifindex_rcu(dev) ? : dev->ifindex;
1743 	fl4.flowi4_mark = skb->mark;
1744 	fl4.flowi4_tos = tos;
1745 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
1746 	fl4.daddr = daddr;
1747 	fl4.saddr = saddr;
1748 	err = fib_lookup(net, &fl4, &res, 0);
1749 	if (err != 0) {
1750 		if (!IN_DEV_FORWARD(in_dev))
1751 			err = -EHOSTUNREACH;
1752 		goto no_route;
1753 	}
1754 
1755 	if (res.type == RTN_BROADCAST)
1756 		goto brd_input;
1757 
1758 	if (res.type == RTN_LOCAL) {
1759 		err = fib_validate_source(skb, saddr, daddr, tos,
1760 					  0, dev, in_dev, &itag);
1761 		if (err < 0)
1762 			goto martian_source_keep_err;
1763 		goto local_input;
1764 	}
1765 
1766 	if (!IN_DEV_FORWARD(in_dev)) {
1767 		err = -EHOSTUNREACH;
1768 		goto no_route;
1769 	}
1770 	if (res.type != RTN_UNICAST)
1771 		goto martian_destination;
1772 
1773 	err = ip_mkroute_input(skb, &res, &fl4, in_dev, daddr, saddr, tos);
1774 out:	return err;
1775 
1776 brd_input:
1777 	if (skb->protocol != htons(ETH_P_IP))
1778 		goto e_inval;
1779 
1780 	if (!ipv4_is_zeronet(saddr)) {
1781 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1782 					  in_dev, &itag);
1783 		if (err < 0)
1784 			goto martian_source_keep_err;
1785 	}
1786 	flags |= RTCF_BROADCAST;
1787 	res.type = RTN_BROADCAST;
1788 	RT_CACHE_STAT_INC(in_brd);
1789 
1790 local_input:
1791 	do_cache = false;
1792 	if (res.fi) {
1793 		if (!itag) {
1794 			rth = rcu_dereference(FIB_RES_NH(res).nh_rth_input);
1795 			if (rt_cache_valid(rth)) {
1796 				skb_dst_set_noref(skb, &rth->dst);
1797 				err = 0;
1798 				goto out;
1799 			}
1800 			do_cache = true;
1801 		}
1802 	}
1803 
1804 	rth = rt_dst_alloc(net->loopback_dev, flags | RTCF_LOCAL, res.type,
1805 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, do_cache);
1806 	if (!rth)
1807 		goto e_nobufs;
1808 
1809 	rth->dst.output= ip_rt_bug;
1810 #ifdef CONFIG_IP_ROUTE_CLASSID
1811 	rth->dst.tclassid = itag;
1812 #endif
1813 	rth->rt_is_input = 1;
1814 	if (res.table)
1815 		rth->rt_table_id = res.table->tb_id;
1816 
1817 	RT_CACHE_STAT_INC(in_slow_tot);
1818 	if (res.type == RTN_UNREACHABLE) {
1819 		rth->dst.input= ip_error;
1820 		rth->dst.error= -err;
1821 		rth->rt_flags 	&= ~RTCF_LOCAL;
1822 	}
1823 	if (do_cache) {
1824 		if (unlikely(!rt_cache_route(&FIB_RES_NH(res), rth))) {
1825 			rth->dst.flags |= DST_NOCACHE;
1826 			rt_add_uncached_list(rth);
1827 		}
1828 	}
1829 	skb_dst_set(skb, &rth->dst);
1830 	err = 0;
1831 	goto out;
1832 
1833 no_route:
1834 	RT_CACHE_STAT_INC(in_no_route);
1835 	res.type = RTN_UNREACHABLE;
1836 	res.fi = NULL;
1837 	goto local_input;
1838 
1839 	/*
1840 	 *	Do not cache martian addresses: they should be logged (RFC1812)
1841 	 */
1842 martian_destination:
1843 	RT_CACHE_STAT_INC(in_martian_dst);
1844 #ifdef CONFIG_IP_ROUTE_VERBOSE
1845 	if (IN_DEV_LOG_MARTIANS(in_dev))
1846 		net_warn_ratelimited("martian destination %pI4 from %pI4, dev %s\n",
1847 				     &daddr, &saddr, dev->name);
1848 #endif
1849 
1850 e_inval:
1851 	err = -EINVAL;
1852 	goto out;
1853 
1854 e_nobufs:
1855 	err = -ENOBUFS;
1856 	goto out;
1857 
1858 martian_source:
1859 	err = -EINVAL;
1860 martian_source_keep_err:
1861 	ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
1862 	goto out;
1863 }
1864 
1865 int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1866 			 u8 tos, struct net_device *dev)
1867 {
1868 	int res;
1869 
1870 	rcu_read_lock();
1871 
1872 	/* Multicast recognition logic is moved from route cache to here.
1873 	   The problem was that too many Ethernet cards have broken/missing
1874 	   hardware multicast filters :-( As result the host on multicasting
1875 	   network acquires a lot of useless route cache entries, sort of
1876 	   SDR messages from all the world. Now we try to get rid of them.
1877 	   Really, provided software IP multicast filter is organized
1878 	   reasonably (at least, hashed), it does not result in a slowdown
1879 	   comparing with route cache reject entries.
1880 	   Note, that multicast routers are not affected, because
1881 	   route cache entry is created eventually.
1882 	 */
1883 	if (ipv4_is_multicast(daddr)) {
1884 		struct in_device *in_dev = __in_dev_get_rcu(dev);
1885 
1886 		if (in_dev) {
1887 			int our = ip_check_mc_rcu(in_dev, daddr, saddr,
1888 						  ip_hdr(skb)->protocol);
1889 			if (our
1890 #ifdef CONFIG_IP_MROUTE
1891 				||
1892 			    (!ipv4_is_local_multicast(daddr) &&
1893 			     IN_DEV_MFORWARD(in_dev))
1894 #endif
1895 			   ) {
1896 				int res = ip_route_input_mc(skb, daddr, saddr,
1897 							    tos, dev, our);
1898 				rcu_read_unlock();
1899 				return res;
1900 			}
1901 		}
1902 		rcu_read_unlock();
1903 		return -EINVAL;
1904 	}
1905 	res = ip_route_input_slow(skb, daddr, saddr, tos, dev);
1906 	rcu_read_unlock();
1907 	return res;
1908 }
1909 EXPORT_SYMBOL(ip_route_input_noref);
1910 
1911 /* called with rcu_read_lock() */
1912 static struct rtable *__mkroute_output(const struct fib_result *res,
1913 				       const struct flowi4 *fl4, int orig_oif,
1914 				       struct net_device *dev_out,
1915 				       unsigned int flags)
1916 {
1917 	struct fib_info *fi = res->fi;
1918 	struct fib_nh_exception *fnhe;
1919 	struct in_device *in_dev;
1920 	u16 type = res->type;
1921 	struct rtable *rth;
1922 	bool do_cache;
1923 
1924 	in_dev = __in_dev_get_rcu(dev_out);
1925 	if (!in_dev)
1926 		return ERR_PTR(-EINVAL);
1927 
1928 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1929 		if (ipv4_is_loopback(fl4->saddr) && !(dev_out->flags & IFF_LOOPBACK))
1930 			return ERR_PTR(-EINVAL);
1931 
1932 	if (ipv4_is_lbcast(fl4->daddr))
1933 		type = RTN_BROADCAST;
1934 	else if (ipv4_is_multicast(fl4->daddr))
1935 		type = RTN_MULTICAST;
1936 	else if (ipv4_is_zeronet(fl4->daddr))
1937 		return ERR_PTR(-EINVAL);
1938 
1939 	if (dev_out->flags & IFF_LOOPBACK)
1940 		flags |= RTCF_LOCAL;
1941 
1942 	do_cache = true;
1943 	if (type == RTN_BROADCAST) {
1944 		flags |= RTCF_BROADCAST | RTCF_LOCAL;
1945 		fi = NULL;
1946 	} else if (type == RTN_MULTICAST) {
1947 		flags |= RTCF_MULTICAST | RTCF_LOCAL;
1948 		if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
1949 				     fl4->flowi4_proto))
1950 			flags &= ~RTCF_LOCAL;
1951 		else
1952 			do_cache = false;
1953 		/* If multicast route do not exist use
1954 		 * default one, but do not gateway in this case.
1955 		 * Yes, it is hack.
1956 		 */
1957 		if (fi && res->prefixlen < 4)
1958 			fi = NULL;
1959 	}
1960 
1961 	fnhe = NULL;
1962 	do_cache &= fi != NULL;
1963 	if (do_cache) {
1964 		struct rtable __rcu **prth;
1965 		struct fib_nh *nh = &FIB_RES_NH(*res);
1966 
1967 		fnhe = find_exception(nh, fl4->daddr);
1968 		if (fnhe)
1969 			prth = &fnhe->fnhe_rth_output;
1970 		else {
1971 			if (unlikely(fl4->flowi4_flags &
1972 				     FLOWI_FLAG_KNOWN_NH &&
1973 				     !(nh->nh_gw &&
1974 				       nh->nh_scope == RT_SCOPE_LINK))) {
1975 				do_cache = false;
1976 				goto add;
1977 			}
1978 			prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
1979 		}
1980 		rth = rcu_dereference(*prth);
1981 		if (rt_cache_valid(rth)) {
1982 			dst_hold(&rth->dst);
1983 			return rth;
1984 		}
1985 	}
1986 
1987 add:
1988 	rth = rt_dst_alloc(dev_out, flags, type,
1989 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1990 			   IN_DEV_CONF_GET(in_dev, NOXFRM),
1991 			   do_cache);
1992 	if (!rth)
1993 		return ERR_PTR(-ENOBUFS);
1994 
1995 	rth->rt_iif	= orig_oif ? : 0;
1996 	if (res->table)
1997 		rth->rt_table_id = res->table->tb_id;
1998 
1999 	RT_CACHE_STAT_INC(out_slow_tot);
2000 
2001 	if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
2002 		if (flags & RTCF_LOCAL &&
2003 		    !(dev_out->flags & IFF_LOOPBACK)) {
2004 			rth->dst.output = ip_mc_output;
2005 			RT_CACHE_STAT_INC(out_slow_mc);
2006 		}
2007 #ifdef CONFIG_IP_MROUTE
2008 		if (type == RTN_MULTICAST) {
2009 			if (IN_DEV_MFORWARD(in_dev) &&
2010 			    !ipv4_is_local_multicast(fl4->daddr)) {
2011 				rth->dst.input = ip_mr_input;
2012 				rth->dst.output = ip_mc_output;
2013 			}
2014 		}
2015 #endif
2016 	}
2017 
2018 	rt_set_nexthop(rth, fl4->daddr, res, fnhe, fi, type, 0);
2019 	if (lwtunnel_output_redirect(rth->dst.lwtstate))
2020 		rth->dst.output = lwtunnel_output;
2021 
2022 	return rth;
2023 }
2024 
2025 /*
2026  * Major route resolver routine.
2027  */
2028 
2029 struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
2030 {
2031 	struct net_device *dev_out = NULL;
2032 	__u8 tos = RT_FL_TOS(fl4);
2033 	unsigned int flags = 0;
2034 	struct fib_result res;
2035 	struct rtable *rth;
2036 	int orig_oif;
2037 
2038 	res.tclassid	= 0;
2039 	res.fi		= NULL;
2040 	res.table	= NULL;
2041 
2042 	orig_oif = fl4->flowi4_oif;
2043 
2044 	fl4->flowi4_iif = LOOPBACK_IFINDEX;
2045 	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
2046 	fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
2047 			 RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
2048 
2049 	rcu_read_lock();
2050 	if (fl4->saddr) {
2051 		rth = ERR_PTR(-EINVAL);
2052 		if (ipv4_is_multicast(fl4->saddr) ||
2053 		    ipv4_is_lbcast(fl4->saddr) ||
2054 		    ipv4_is_zeronet(fl4->saddr))
2055 			goto out;
2056 
2057 		/* I removed check for oif == dev_out->oif here.
2058 		   It was wrong for two reasons:
2059 		   1. ip_dev_find(net, saddr) can return wrong iface, if saddr
2060 		      is assigned to multiple interfaces.
2061 		   2. Moreover, we are allowed to send packets with saddr
2062 		      of another iface. --ANK
2063 		 */
2064 
2065 		if (fl4->flowi4_oif == 0 &&
2066 		    (ipv4_is_multicast(fl4->daddr) ||
2067 		     ipv4_is_lbcast(fl4->daddr))) {
2068 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2069 			dev_out = __ip_dev_find(net, fl4->saddr, false);
2070 			if (!dev_out)
2071 				goto out;
2072 
2073 			/* Special hack: user can direct multicasts
2074 			   and limited broadcast via necessary interface
2075 			   without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
2076 			   This hack is not just for fun, it allows
2077 			   vic,vat and friends to work.
2078 			   They bind socket to loopback, set ttl to zero
2079 			   and expect that it will work.
2080 			   From the viewpoint of routing cache they are broken,
2081 			   because we are not allowed to build multicast path
2082 			   with loopback source addr (look, routing cache
2083 			   cannot know, that ttl is zero, so that packet
2084 			   will not leave this host and route is valid).
2085 			   Luckily, this hack is good workaround.
2086 			 */
2087 
2088 			fl4->flowi4_oif = dev_out->ifindex;
2089 			goto make_route;
2090 		}
2091 
2092 		if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
2093 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2094 			if (!__ip_dev_find(net, fl4->saddr, false))
2095 				goto out;
2096 		}
2097 	}
2098 
2099 
2100 	if (fl4->flowi4_oif) {
2101 		dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
2102 		rth = ERR_PTR(-ENODEV);
2103 		if (!dev_out)
2104 			goto out;
2105 
2106 		/* RACE: Check return value of inet_select_addr instead. */
2107 		if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
2108 			rth = ERR_PTR(-ENETUNREACH);
2109 			goto out;
2110 		}
2111 		if (ipv4_is_local_multicast(fl4->daddr) ||
2112 		    ipv4_is_lbcast(fl4->daddr) ||
2113 		    fl4->flowi4_proto == IPPROTO_IGMP) {
2114 			if (!fl4->saddr)
2115 				fl4->saddr = inet_select_addr(dev_out, 0,
2116 							      RT_SCOPE_LINK);
2117 			goto make_route;
2118 		}
2119 		if (!fl4->saddr) {
2120 			if (ipv4_is_multicast(fl4->daddr))
2121 				fl4->saddr = inet_select_addr(dev_out, 0,
2122 							      fl4->flowi4_scope);
2123 			else if (!fl4->daddr)
2124 				fl4->saddr = inet_select_addr(dev_out, 0,
2125 							      RT_SCOPE_HOST);
2126 		}
2127 		if (netif_is_vrf(dev_out) &&
2128 		    !(fl4->flowi4_flags & FLOWI_FLAG_VRFSRC)) {
2129 			rth = vrf_dev_get_rth(dev_out);
2130 			goto out;
2131 		}
2132 	}
2133 
2134 	if (!fl4->daddr) {
2135 		fl4->daddr = fl4->saddr;
2136 		if (!fl4->daddr)
2137 			fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
2138 		dev_out = net->loopback_dev;
2139 		fl4->flowi4_oif = LOOPBACK_IFINDEX;
2140 		res.type = RTN_LOCAL;
2141 		flags |= RTCF_LOCAL;
2142 		goto make_route;
2143 	}
2144 
2145 	if (fib_lookup(net, fl4, &res, 0)) {
2146 		res.fi = NULL;
2147 		res.table = NULL;
2148 		if (fl4->flowi4_oif) {
2149 			/* Apparently, routing tables are wrong. Assume,
2150 			   that the destination is on link.
2151 
2152 			   WHY? DW.
2153 			   Because we are allowed to send to iface
2154 			   even if it has NO routes and NO assigned
2155 			   addresses. When oif is specified, routing
2156 			   tables are looked up with only one purpose:
2157 			   to catch if destination is gatewayed, rather than
2158 			   direct. Moreover, if MSG_DONTROUTE is set,
2159 			   we send packet, ignoring both routing tables
2160 			   and ifaddr state. --ANK
2161 
2162 
2163 			   We could make it even if oif is unknown,
2164 			   likely IPv6, but we do not.
2165 			 */
2166 
2167 			if (fl4->saddr == 0)
2168 				fl4->saddr = inet_select_addr(dev_out, 0,
2169 							      RT_SCOPE_LINK);
2170 			res.type = RTN_UNICAST;
2171 			goto make_route;
2172 		}
2173 		rth = ERR_PTR(-ENETUNREACH);
2174 		goto out;
2175 	}
2176 
2177 	if (res.type == RTN_LOCAL) {
2178 		if (!fl4->saddr) {
2179 			if (res.fi->fib_prefsrc)
2180 				fl4->saddr = res.fi->fib_prefsrc;
2181 			else
2182 				fl4->saddr = fl4->daddr;
2183 		}
2184 		dev_out = net->loopback_dev;
2185 		fl4->flowi4_oif = dev_out->ifindex;
2186 		flags |= RTCF_LOCAL;
2187 		goto make_route;
2188 	}
2189 
2190 #ifdef CONFIG_IP_ROUTE_MULTIPATH
2191 	if (res.fi->fib_nhs > 1 && fl4->flowi4_oif == 0)
2192 		fib_select_multipath(&res);
2193 	else
2194 #endif
2195 	if (!res.prefixlen &&
2196 	    res.table->tb_num_default > 1 &&
2197 	    res.type == RTN_UNICAST && !fl4->flowi4_oif)
2198 		fib_select_default(fl4, &res);
2199 
2200 	if (!fl4->saddr)
2201 		fl4->saddr = FIB_RES_PREFSRC(net, res);
2202 
2203 	dev_out = FIB_RES_DEV(res);
2204 	fl4->flowi4_oif = dev_out->ifindex;
2205 
2206 
2207 make_route:
2208 	rth = __mkroute_output(&res, fl4, orig_oif, dev_out, flags);
2209 
2210 out:
2211 	rcu_read_unlock();
2212 	return rth;
2213 }
2214 EXPORT_SYMBOL_GPL(__ip_route_output_key);
2215 
2216 static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
2217 {
2218 	return NULL;
2219 }
2220 
2221 static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
2222 {
2223 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
2224 
2225 	return mtu ? : dst->dev->mtu;
2226 }
2227 
2228 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
2229 					  struct sk_buff *skb, u32 mtu)
2230 {
2231 }
2232 
2233 static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
2234 				       struct sk_buff *skb)
2235 {
2236 }
2237 
2238 static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
2239 					  unsigned long old)
2240 {
2241 	return NULL;
2242 }
2243 
2244 static struct dst_ops ipv4_dst_blackhole_ops = {
2245 	.family			=	AF_INET,
2246 	.check			=	ipv4_blackhole_dst_check,
2247 	.mtu			=	ipv4_blackhole_mtu,
2248 	.default_advmss		=	ipv4_default_advmss,
2249 	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
2250 	.redirect		=	ipv4_rt_blackhole_redirect,
2251 	.cow_metrics		=	ipv4_rt_blackhole_cow_metrics,
2252 	.neigh_lookup		=	ipv4_neigh_lookup,
2253 };
2254 
2255 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
2256 {
2257 	struct rtable *ort = (struct rtable *) dst_orig;
2258 	struct rtable *rt;
2259 
2260 	rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, 0);
2261 	if (rt) {
2262 		struct dst_entry *new = &rt->dst;
2263 
2264 		new->__use = 1;
2265 		new->input = dst_discard;
2266 		new->output = dst_discard_sk;
2267 
2268 		new->dev = ort->dst.dev;
2269 		if (new->dev)
2270 			dev_hold(new->dev);
2271 
2272 		rt->rt_is_input = ort->rt_is_input;
2273 		rt->rt_iif = ort->rt_iif;
2274 		rt->rt_pmtu = ort->rt_pmtu;
2275 
2276 		rt->rt_genid = rt_genid_ipv4(net);
2277 		rt->rt_flags = ort->rt_flags;
2278 		rt->rt_type = ort->rt_type;
2279 		rt->rt_gateway = ort->rt_gateway;
2280 		rt->rt_uses_gateway = ort->rt_uses_gateway;
2281 
2282 		INIT_LIST_HEAD(&rt->rt_uncached);
2283 		dst_free(new);
2284 	}
2285 
2286 	dst_release(dst_orig);
2287 
2288 	return rt ? &rt->dst : ERR_PTR(-ENOMEM);
2289 }
2290 
2291 struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
2292 				    struct sock *sk)
2293 {
2294 	struct rtable *rt = __ip_route_output_key(net, flp4);
2295 
2296 	if (IS_ERR(rt))
2297 		return rt;
2298 
2299 	if (flp4->flowi4_proto)
2300 		rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
2301 							flowi4_to_flowi(flp4),
2302 							sk, 0);
2303 
2304 	return rt;
2305 }
2306 EXPORT_SYMBOL_GPL(ip_route_output_flow);
2307 
2308 static int rt_fill_info(struct net *net,  __be32 dst, __be32 src, u32 table_id,
2309 			struct flowi4 *fl4, struct sk_buff *skb, u32 portid,
2310 			u32 seq, int event, int nowait, unsigned int flags)
2311 {
2312 	struct rtable *rt = skb_rtable(skb);
2313 	struct rtmsg *r;
2314 	struct nlmsghdr *nlh;
2315 	unsigned long expires = 0;
2316 	u32 error;
2317 	u32 metrics[RTAX_MAX];
2318 
2319 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*r), flags);
2320 	if (!nlh)
2321 		return -EMSGSIZE;
2322 
2323 	r = nlmsg_data(nlh);
2324 	r->rtm_family	 = AF_INET;
2325 	r->rtm_dst_len	= 32;
2326 	r->rtm_src_len	= 0;
2327 	r->rtm_tos	= fl4->flowi4_tos;
2328 	r->rtm_table	= table_id;
2329 	if (nla_put_u32(skb, RTA_TABLE, table_id))
2330 		goto nla_put_failure;
2331 	r->rtm_type	= rt->rt_type;
2332 	r->rtm_scope	= RT_SCOPE_UNIVERSE;
2333 	r->rtm_protocol = RTPROT_UNSPEC;
2334 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
2335 	if (rt->rt_flags & RTCF_NOTIFY)
2336 		r->rtm_flags |= RTM_F_NOTIFY;
2337 	if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
2338 		r->rtm_flags |= RTCF_DOREDIRECT;
2339 
2340 	if (nla_put_in_addr(skb, RTA_DST, dst))
2341 		goto nla_put_failure;
2342 	if (src) {
2343 		r->rtm_src_len = 32;
2344 		if (nla_put_in_addr(skb, RTA_SRC, src))
2345 			goto nla_put_failure;
2346 	}
2347 	if (rt->dst.dev &&
2348 	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
2349 		goto nla_put_failure;
2350 #ifdef CONFIG_IP_ROUTE_CLASSID
2351 	if (rt->dst.tclassid &&
2352 	    nla_put_u32(skb, RTA_FLOW, rt->dst.tclassid))
2353 		goto nla_put_failure;
2354 #endif
2355 	if (!rt_is_input_route(rt) &&
2356 	    fl4->saddr != src) {
2357 		if (nla_put_in_addr(skb, RTA_PREFSRC, fl4->saddr))
2358 			goto nla_put_failure;
2359 	}
2360 	if (rt->rt_uses_gateway &&
2361 	    nla_put_in_addr(skb, RTA_GATEWAY, rt->rt_gateway))
2362 		goto nla_put_failure;
2363 
2364 	expires = rt->dst.expires;
2365 	if (expires) {
2366 		unsigned long now = jiffies;
2367 
2368 		if (time_before(now, expires))
2369 			expires -= now;
2370 		else
2371 			expires = 0;
2372 	}
2373 
2374 	memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
2375 	if (rt->rt_pmtu && expires)
2376 		metrics[RTAX_MTU - 1] = rt->rt_pmtu;
2377 	if (rtnetlink_put_metrics(skb, metrics) < 0)
2378 		goto nla_put_failure;
2379 
2380 	if (fl4->flowi4_mark &&
2381 	    nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
2382 		goto nla_put_failure;
2383 
2384 	error = rt->dst.error;
2385 
2386 	if (rt_is_input_route(rt)) {
2387 #ifdef CONFIG_IP_MROUTE
2388 		if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
2389 		    IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
2390 			int err = ipmr_get_route(net, skb,
2391 						 fl4->saddr, fl4->daddr,
2392 						 r, nowait);
2393 			if (err <= 0) {
2394 				if (!nowait) {
2395 					if (err == 0)
2396 						return 0;
2397 					goto nla_put_failure;
2398 				} else {
2399 					if (err == -EMSGSIZE)
2400 						goto nla_put_failure;
2401 					error = err;
2402 				}
2403 			}
2404 		} else
2405 #endif
2406 			if (nla_put_u32(skb, RTA_IIF, skb->dev->ifindex))
2407 				goto nla_put_failure;
2408 	}
2409 
2410 	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, error) < 0)
2411 		goto nla_put_failure;
2412 
2413 	nlmsg_end(skb, nlh);
2414 	return 0;
2415 
2416 nla_put_failure:
2417 	nlmsg_cancel(skb, nlh);
2418 	return -EMSGSIZE;
2419 }
2420 
2421 static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
2422 {
2423 	struct net *net = sock_net(in_skb->sk);
2424 	struct rtmsg *rtm;
2425 	struct nlattr *tb[RTA_MAX+1];
2426 	struct rtable *rt = NULL;
2427 	struct flowi4 fl4;
2428 	__be32 dst = 0;
2429 	__be32 src = 0;
2430 	u32 iif;
2431 	int err;
2432 	int mark;
2433 	struct sk_buff *skb;
2434 	u32 table_id = RT_TABLE_MAIN;
2435 
2436 	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
2437 	if (err < 0)
2438 		goto errout;
2439 
2440 	rtm = nlmsg_data(nlh);
2441 
2442 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2443 	if (!skb) {
2444 		err = -ENOBUFS;
2445 		goto errout;
2446 	}
2447 
2448 	/* Reserve room for dummy headers, this skb can pass
2449 	   through good chunk of routing engine.
2450 	 */
2451 	skb_reset_mac_header(skb);
2452 	skb_reset_network_header(skb);
2453 
2454 	/* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
2455 	ip_hdr(skb)->protocol = IPPROTO_ICMP;
2456 	skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
2457 
2458 	src = tb[RTA_SRC] ? nla_get_in_addr(tb[RTA_SRC]) : 0;
2459 	dst = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0;
2460 	iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
2461 	mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
2462 
2463 	memset(&fl4, 0, sizeof(fl4));
2464 	fl4.daddr = dst;
2465 	fl4.saddr = src;
2466 	fl4.flowi4_tos = rtm->rtm_tos;
2467 	fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
2468 	fl4.flowi4_mark = mark;
2469 
2470 	if (iif) {
2471 		struct net_device *dev;
2472 
2473 		dev = __dev_get_by_index(net, iif);
2474 		if (!dev) {
2475 			err = -ENODEV;
2476 			goto errout_free;
2477 		}
2478 
2479 		skb->protocol	= htons(ETH_P_IP);
2480 		skb->dev	= dev;
2481 		skb->mark	= mark;
2482 		local_bh_disable();
2483 		err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev);
2484 		local_bh_enable();
2485 
2486 		rt = skb_rtable(skb);
2487 		if (err == 0 && rt->dst.error)
2488 			err = -rt->dst.error;
2489 	} else {
2490 		rt = ip_route_output_key(net, &fl4);
2491 
2492 		err = 0;
2493 		if (IS_ERR(rt))
2494 			err = PTR_ERR(rt);
2495 	}
2496 
2497 	if (err)
2498 		goto errout_free;
2499 
2500 	skb_dst_set(skb, &rt->dst);
2501 	if (rtm->rtm_flags & RTM_F_NOTIFY)
2502 		rt->rt_flags |= RTCF_NOTIFY;
2503 
2504 	if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
2505 		table_id = rt->rt_table_id;
2506 
2507 	err = rt_fill_info(net, dst, src, table_id, &fl4, skb,
2508 			   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2509 			   RTM_NEWROUTE, 0, 0);
2510 	if (err < 0)
2511 		goto errout_free;
2512 
2513 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2514 errout:
2515 	return err;
2516 
2517 errout_free:
2518 	kfree_skb(skb);
2519 	goto errout;
2520 }
2521 
2522 void ip_rt_multicast_event(struct in_device *in_dev)
2523 {
2524 	rt_cache_flush(dev_net(in_dev->dev));
2525 }
2526 
2527 #ifdef CONFIG_SYSCTL
2528 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
2529 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
2530 static int ip_rt_gc_min_interval __read_mostly	= HZ / 2;
2531 static int ip_rt_gc_elasticity __read_mostly	= 8;
2532 
2533 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
2534 					void __user *buffer,
2535 					size_t *lenp, loff_t *ppos)
2536 {
2537 	struct net *net = (struct net *)__ctl->extra1;
2538 
2539 	if (write) {
2540 		rt_cache_flush(net);
2541 		fnhe_genid_bump(net);
2542 		return 0;
2543 	}
2544 
2545 	return -EINVAL;
2546 }
2547 
2548 static struct ctl_table ipv4_route_table[] = {
2549 	{
2550 		.procname	= "gc_thresh",
2551 		.data		= &ipv4_dst_ops.gc_thresh,
2552 		.maxlen		= sizeof(int),
2553 		.mode		= 0644,
2554 		.proc_handler	= proc_dointvec,
2555 	},
2556 	{
2557 		.procname	= "max_size",
2558 		.data		= &ip_rt_max_size,
2559 		.maxlen		= sizeof(int),
2560 		.mode		= 0644,
2561 		.proc_handler	= proc_dointvec,
2562 	},
2563 	{
2564 		/*  Deprecated. Use gc_min_interval_ms */
2565 
2566 		.procname	= "gc_min_interval",
2567 		.data		= &ip_rt_gc_min_interval,
2568 		.maxlen		= sizeof(int),
2569 		.mode		= 0644,
2570 		.proc_handler	= proc_dointvec_jiffies,
2571 	},
2572 	{
2573 		.procname	= "gc_min_interval_ms",
2574 		.data		= &ip_rt_gc_min_interval,
2575 		.maxlen		= sizeof(int),
2576 		.mode		= 0644,
2577 		.proc_handler	= proc_dointvec_ms_jiffies,
2578 	},
2579 	{
2580 		.procname	= "gc_timeout",
2581 		.data		= &ip_rt_gc_timeout,
2582 		.maxlen		= sizeof(int),
2583 		.mode		= 0644,
2584 		.proc_handler	= proc_dointvec_jiffies,
2585 	},
2586 	{
2587 		.procname	= "gc_interval",
2588 		.data		= &ip_rt_gc_interval,
2589 		.maxlen		= sizeof(int),
2590 		.mode		= 0644,
2591 		.proc_handler	= proc_dointvec_jiffies,
2592 	},
2593 	{
2594 		.procname	= "redirect_load",
2595 		.data		= &ip_rt_redirect_load,
2596 		.maxlen		= sizeof(int),
2597 		.mode		= 0644,
2598 		.proc_handler	= proc_dointvec,
2599 	},
2600 	{
2601 		.procname	= "redirect_number",
2602 		.data		= &ip_rt_redirect_number,
2603 		.maxlen		= sizeof(int),
2604 		.mode		= 0644,
2605 		.proc_handler	= proc_dointvec,
2606 	},
2607 	{
2608 		.procname	= "redirect_silence",
2609 		.data		= &ip_rt_redirect_silence,
2610 		.maxlen		= sizeof(int),
2611 		.mode		= 0644,
2612 		.proc_handler	= proc_dointvec,
2613 	},
2614 	{
2615 		.procname	= "error_cost",
2616 		.data		= &ip_rt_error_cost,
2617 		.maxlen		= sizeof(int),
2618 		.mode		= 0644,
2619 		.proc_handler	= proc_dointvec,
2620 	},
2621 	{
2622 		.procname	= "error_burst",
2623 		.data		= &ip_rt_error_burst,
2624 		.maxlen		= sizeof(int),
2625 		.mode		= 0644,
2626 		.proc_handler	= proc_dointvec,
2627 	},
2628 	{
2629 		.procname	= "gc_elasticity",
2630 		.data		= &ip_rt_gc_elasticity,
2631 		.maxlen		= sizeof(int),
2632 		.mode		= 0644,
2633 		.proc_handler	= proc_dointvec,
2634 	},
2635 	{
2636 		.procname	= "mtu_expires",
2637 		.data		= &ip_rt_mtu_expires,
2638 		.maxlen		= sizeof(int),
2639 		.mode		= 0644,
2640 		.proc_handler	= proc_dointvec_jiffies,
2641 	},
2642 	{
2643 		.procname	= "min_pmtu",
2644 		.data		= &ip_rt_min_pmtu,
2645 		.maxlen		= sizeof(int),
2646 		.mode		= 0644,
2647 		.proc_handler	= proc_dointvec,
2648 	},
2649 	{
2650 		.procname	= "min_adv_mss",
2651 		.data		= &ip_rt_min_advmss,
2652 		.maxlen		= sizeof(int),
2653 		.mode		= 0644,
2654 		.proc_handler	= proc_dointvec,
2655 	},
2656 	{ }
2657 };
2658 
2659 static struct ctl_table ipv4_route_flush_table[] = {
2660 	{
2661 		.procname	= "flush",
2662 		.maxlen		= sizeof(int),
2663 		.mode		= 0200,
2664 		.proc_handler	= ipv4_sysctl_rtcache_flush,
2665 	},
2666 	{ },
2667 };
2668 
2669 static __net_init int sysctl_route_net_init(struct net *net)
2670 {
2671 	struct ctl_table *tbl;
2672 
2673 	tbl = ipv4_route_flush_table;
2674 	if (!net_eq(net, &init_net)) {
2675 		tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
2676 		if (!tbl)
2677 			goto err_dup;
2678 
2679 		/* Don't export sysctls to unprivileged users */
2680 		if (net->user_ns != &init_user_ns)
2681 			tbl[0].procname = NULL;
2682 	}
2683 	tbl[0].extra1 = net;
2684 
2685 	net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
2686 	if (!net->ipv4.route_hdr)
2687 		goto err_reg;
2688 	return 0;
2689 
2690 err_reg:
2691 	if (tbl != ipv4_route_flush_table)
2692 		kfree(tbl);
2693 err_dup:
2694 	return -ENOMEM;
2695 }
2696 
2697 static __net_exit void sysctl_route_net_exit(struct net *net)
2698 {
2699 	struct ctl_table *tbl;
2700 
2701 	tbl = net->ipv4.route_hdr->ctl_table_arg;
2702 	unregister_net_sysctl_table(net->ipv4.route_hdr);
2703 	BUG_ON(tbl == ipv4_route_flush_table);
2704 	kfree(tbl);
2705 }
2706 
2707 static __net_initdata struct pernet_operations sysctl_route_ops = {
2708 	.init = sysctl_route_net_init,
2709 	.exit = sysctl_route_net_exit,
2710 };
2711 #endif
2712 
2713 static __net_init int rt_genid_init(struct net *net)
2714 {
2715 	atomic_set(&net->ipv4.rt_genid, 0);
2716 	atomic_set(&net->fnhe_genid, 0);
2717 	get_random_bytes(&net->ipv4.dev_addr_genid,
2718 			 sizeof(net->ipv4.dev_addr_genid));
2719 	return 0;
2720 }
2721 
2722 static __net_initdata struct pernet_operations rt_genid_ops = {
2723 	.init = rt_genid_init,
2724 };
2725 
2726 static int __net_init ipv4_inetpeer_init(struct net *net)
2727 {
2728 	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
2729 
2730 	if (!bp)
2731 		return -ENOMEM;
2732 	inet_peer_base_init(bp);
2733 	net->ipv4.peers = bp;
2734 	return 0;
2735 }
2736 
2737 static void __net_exit ipv4_inetpeer_exit(struct net *net)
2738 {
2739 	struct inet_peer_base *bp = net->ipv4.peers;
2740 
2741 	net->ipv4.peers = NULL;
2742 	inetpeer_invalidate_tree(bp);
2743 	kfree(bp);
2744 }
2745 
2746 static __net_initdata struct pernet_operations ipv4_inetpeer_ops = {
2747 	.init	=	ipv4_inetpeer_init,
2748 	.exit	=	ipv4_inetpeer_exit,
2749 };
2750 
2751 #ifdef CONFIG_IP_ROUTE_CLASSID
2752 struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
2753 #endif /* CONFIG_IP_ROUTE_CLASSID */
2754 
2755 int __init ip_rt_init(void)
2756 {
2757 	int rc = 0;
2758 	int cpu;
2759 
2760 	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
2761 	if (!ip_idents)
2762 		panic("IP: failed to allocate ip_idents\n");
2763 
2764 	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
2765 
2766 	ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
2767 	if (!ip_tstamps)
2768 		panic("IP: failed to allocate ip_tstamps\n");
2769 
2770 	for_each_possible_cpu(cpu) {
2771 		struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
2772 
2773 		INIT_LIST_HEAD(&ul->head);
2774 		spin_lock_init(&ul->lock);
2775 	}
2776 #ifdef CONFIG_IP_ROUTE_CLASSID
2777 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
2778 	if (!ip_rt_acct)
2779 		panic("IP: failed to allocate ip_rt_acct\n");
2780 #endif
2781 
2782 	ipv4_dst_ops.kmem_cachep =
2783 		kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
2784 				  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
2785 
2786 	ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
2787 
2788 	if (dst_entries_init(&ipv4_dst_ops) < 0)
2789 		panic("IP: failed to allocate ipv4_dst_ops counter\n");
2790 
2791 	if (dst_entries_init(&ipv4_dst_blackhole_ops) < 0)
2792 		panic("IP: failed to allocate ipv4_dst_blackhole_ops counter\n");
2793 
2794 	ipv4_dst_ops.gc_thresh = ~0;
2795 	ip_rt_max_size = INT_MAX;
2796 
2797 	devinet_init();
2798 	ip_fib_init();
2799 
2800 	if (ip_rt_proc_init())
2801 		pr_err("Unable to create route proc files\n");
2802 #ifdef CONFIG_XFRM
2803 	xfrm_init();
2804 	xfrm4_init();
2805 #endif
2806 	rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL, NULL);
2807 
2808 #ifdef CONFIG_SYSCTL
2809 	register_pernet_subsys(&sysctl_route_ops);
2810 #endif
2811 	register_pernet_subsys(&rt_genid_ops);
2812 	register_pernet_subsys(&ipv4_inetpeer_ops);
2813 	return rc;
2814 }
2815 
2816 #ifdef CONFIG_SYSCTL
2817 /*
2818  * We really need to sanitize the damn ipv4 init order, then all
2819  * this nonsense will go away.
2820  */
2821 void __init ip_static_sysctl_init(void)
2822 {
2823 	register_net_sysctl(&init_net, "net/ipv4/route", ipv4_route_table);
2824 }
2825 #endif
2826