xref: /openbmc/linux/net/ipv4/route.c (revision fff74a93)
1 /*
2  * INET		An implementation of the TCP/IP protocol suite for the LINUX
3  *		operating system.  INET is implemented using the  BSD Socket
4  *		interface as the means of communication with the user level.
5  *
6  *		ROUTE - implementation of the IP router.
7  *
8  * Authors:	Ross Biro
9  *		Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
10  *		Alan Cox, <gw4pts@gw4pts.ampr.org>
11  *		Linus Torvalds, <Linus.Torvalds@helsinki.fi>
12  *		Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
13  *
14  * Fixes:
15  *		Alan Cox	:	Verify area fixes.
16  *		Alan Cox	:	cli() protects routing changes
17  *		Rui Oliveira	:	ICMP routing table updates
18  *		(rco@di.uminho.pt)	Routing table insertion and update
19  *		Linus Torvalds	:	Rewrote bits to be sensible
20  *		Alan Cox	:	Added BSD route gw semantics
21  *		Alan Cox	:	Super /proc >4K
22  *		Alan Cox	:	MTU in route table
23  *		Alan Cox	: 	MSS actually. Also added the window
24  *					clamper.
25  *		Sam Lantinga	:	Fixed route matching in rt_del()
26  *		Alan Cox	:	Routing cache support.
27  *		Alan Cox	:	Removed compatibility cruft.
28  *		Alan Cox	:	RTF_REJECT support.
29  *		Alan Cox	:	TCP irtt support.
30  *		Jonathan Naylor	:	Added Metric support.
31  *	Miquel van Smoorenburg	:	BSD API fixes.
32  *	Miquel van Smoorenburg	:	Metrics.
33  *		Alan Cox	:	Use __u32 properly
34  *		Alan Cox	:	Aligned routing errors more closely with BSD
35  *					our system is still very different.
36  *		Alan Cox	:	Faster /proc handling
37  *	Alexey Kuznetsov	:	Massive rework to support tree based routing,
38  *					routing caches and better behaviour.
39  *
40  *		Olaf Erb	:	irtt wasn't being copied right.
41  *		Bjorn Ekwall	:	Kerneld route support.
42  *		Alan Cox	:	Multicast fixed (I hope)
43  * 		Pavel Krauz	:	Limited broadcast fixed
44  *		Mike McLagan	:	Routing by source
45  *	Alexey Kuznetsov	:	End of old history. Split to fib.c and
46  *					route.c and rewritten from scratch.
47  *		Andi Kleen	:	Load-limit warning messages.
48  *	Vitaly E. Lavrov	:	Transparent proxy revived after year coma.
49  *	Vitaly E. Lavrov	:	Race condition in ip_route_input_slow.
50  *	Tobias Ringstrom	:	Uninitialized res.type in ip_route_output_slow.
51  *	Vladimir V. Ivanov	:	IP rule info (flowid) is really useful.
52  *		Marc Boucher	:	routing by fwmark
53  *	Robert Olsson		:	Added rt_cache statistics
54  *	Arnaldo C. Melo		:	Convert proc stuff to seq_file
55  *	Eric Dumazet		:	hashed spinlocks and rt_check_expire() fixes.
56  * 	Ilia Sotnikov		:	Ignore TOS on PMTUD and Redirect
57  * 	Ilia Sotnikov		:	Removed TOS from hash calculations
58  *
59  *		This program is free software; you can redistribute it and/or
60  *		modify it under the terms of the GNU General Public License
61  *		as published by the Free Software Foundation; either version
62  *		2 of the License, or (at your option) any later version.
63  */
64 
65 #define pr_fmt(fmt) "IPv4: " fmt
66 
67 #include <linux/module.h>
68 #include <asm/uaccess.h>
69 #include <linux/bitops.h>
70 #include <linux/types.h>
71 #include <linux/kernel.h>
72 #include <linux/mm.h>
73 #include <linux/string.h>
74 #include <linux/socket.h>
75 #include <linux/sockios.h>
76 #include <linux/errno.h>
77 #include <linux/in.h>
78 #include <linux/inet.h>
79 #include <linux/netdevice.h>
80 #include <linux/proc_fs.h>
81 #include <linux/init.h>
82 #include <linux/skbuff.h>
83 #include <linux/inetdevice.h>
84 #include <linux/igmp.h>
85 #include <linux/pkt_sched.h>
86 #include <linux/mroute.h>
87 #include <linux/netfilter_ipv4.h>
88 #include <linux/random.h>
89 #include <linux/rcupdate.h>
90 #include <linux/times.h>
91 #include <linux/slab.h>
92 #include <linux/jhash.h>
93 #include <net/dst.h>
94 #include <net/net_namespace.h>
95 #include <net/protocol.h>
96 #include <net/ip.h>
97 #include <net/route.h>
98 #include <net/inetpeer.h>
99 #include <net/sock.h>
100 #include <net/ip_fib.h>
101 #include <net/arp.h>
102 #include <net/tcp.h>
103 #include <net/icmp.h>
104 #include <net/xfrm.h>
105 #include <net/netevent.h>
106 #include <net/rtnetlink.h>
107 #ifdef CONFIG_SYSCTL
108 #include <linux/sysctl.h>
109 #include <linux/kmemleak.h>
110 #endif
111 #include <net/secure_seq.h>
112 
113 #define RT_FL_TOS(oldflp4) \
114 	((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
115 
116 #define RT_GC_TIMEOUT (300*HZ)
117 
118 static int ip_rt_max_size;
119 static int ip_rt_redirect_number __read_mostly	= 9;
120 static int ip_rt_redirect_load __read_mostly	= HZ / 50;
121 static int ip_rt_redirect_silence __read_mostly	= ((HZ / 50) << (9 + 1));
122 static int ip_rt_error_cost __read_mostly	= HZ;
123 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
124 static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
125 static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
126 static int ip_rt_min_advmss __read_mostly	= 256;
127 
128 /*
129  *	Interface to generic destination cache.
130  */
131 
132 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
133 static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);
134 static unsigned int	 ipv4_mtu(const struct dst_entry *dst);
135 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
136 static void		 ipv4_link_failure(struct sk_buff *skb);
137 static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
138 					   struct sk_buff *skb, u32 mtu);
139 static void		 ip_do_redirect(struct dst_entry *dst, struct sock *sk,
140 					struct sk_buff *skb);
141 static void		ipv4_dst_destroy(struct dst_entry *dst);
142 
143 static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
144 {
145 	WARN_ON(1);
146 	return NULL;
147 }
148 
149 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
150 					   struct sk_buff *skb,
151 					   const void *daddr);
152 
153 static struct dst_ops ipv4_dst_ops = {
154 	.family =		AF_INET,
155 	.protocol =		cpu_to_be16(ETH_P_IP),
156 	.check =		ipv4_dst_check,
157 	.default_advmss =	ipv4_default_advmss,
158 	.mtu =			ipv4_mtu,
159 	.cow_metrics =		ipv4_cow_metrics,
160 	.destroy =		ipv4_dst_destroy,
161 	.negative_advice =	ipv4_negative_advice,
162 	.link_failure =		ipv4_link_failure,
163 	.update_pmtu =		ip_rt_update_pmtu,
164 	.redirect =		ip_do_redirect,
165 	.local_out =		__ip_local_out,
166 	.neigh_lookup =		ipv4_neigh_lookup,
167 };
168 
169 #define ECN_OR_COST(class)	TC_PRIO_##class
170 
171 const __u8 ip_tos2prio[16] = {
172 	TC_PRIO_BESTEFFORT,
173 	ECN_OR_COST(BESTEFFORT),
174 	TC_PRIO_BESTEFFORT,
175 	ECN_OR_COST(BESTEFFORT),
176 	TC_PRIO_BULK,
177 	ECN_OR_COST(BULK),
178 	TC_PRIO_BULK,
179 	ECN_OR_COST(BULK),
180 	TC_PRIO_INTERACTIVE,
181 	ECN_OR_COST(INTERACTIVE),
182 	TC_PRIO_INTERACTIVE,
183 	ECN_OR_COST(INTERACTIVE),
184 	TC_PRIO_INTERACTIVE_BULK,
185 	ECN_OR_COST(INTERACTIVE_BULK),
186 	TC_PRIO_INTERACTIVE_BULK,
187 	ECN_OR_COST(INTERACTIVE_BULK)
188 };
189 EXPORT_SYMBOL(ip_tos2prio);
190 
191 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
192 #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
193 
194 #ifdef CONFIG_PROC_FS
195 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
196 {
197 	if (*pos)
198 		return NULL;
199 	return SEQ_START_TOKEN;
200 }
201 
202 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
203 {
204 	++*pos;
205 	return NULL;
206 }
207 
208 static void rt_cache_seq_stop(struct seq_file *seq, void *v)
209 {
210 }
211 
212 static int rt_cache_seq_show(struct seq_file *seq, void *v)
213 {
214 	if (v == SEQ_START_TOKEN)
215 		seq_printf(seq, "%-127s\n",
216 			   "Iface\tDestination\tGateway \tFlags\t\tRefCnt\tUse\t"
217 			   "Metric\tSource\t\tMTU\tWindow\tIRTT\tTOS\tHHRef\t"
218 			   "HHUptod\tSpecDst");
219 	return 0;
220 }
221 
222 static const struct seq_operations rt_cache_seq_ops = {
223 	.start  = rt_cache_seq_start,
224 	.next   = rt_cache_seq_next,
225 	.stop   = rt_cache_seq_stop,
226 	.show   = rt_cache_seq_show,
227 };
228 
229 static int rt_cache_seq_open(struct inode *inode, struct file *file)
230 {
231 	return seq_open(file, &rt_cache_seq_ops);
232 }
233 
234 static const struct file_operations rt_cache_seq_fops = {
235 	.owner	 = THIS_MODULE,
236 	.open	 = rt_cache_seq_open,
237 	.read	 = seq_read,
238 	.llseek	 = seq_lseek,
239 	.release = seq_release,
240 };
241 
242 
243 static void *rt_cpu_seq_start(struct seq_file *seq, loff_t *pos)
244 {
245 	int cpu;
246 
247 	if (*pos == 0)
248 		return SEQ_START_TOKEN;
249 
250 	for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
251 		if (!cpu_possible(cpu))
252 			continue;
253 		*pos = cpu+1;
254 		return &per_cpu(rt_cache_stat, cpu);
255 	}
256 	return NULL;
257 }
258 
259 static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
260 {
261 	int cpu;
262 
263 	for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
264 		if (!cpu_possible(cpu))
265 			continue;
266 		*pos = cpu+1;
267 		return &per_cpu(rt_cache_stat, cpu);
268 	}
269 	return NULL;
270 
271 }
272 
273 static void rt_cpu_seq_stop(struct seq_file *seq, void *v)
274 {
275 
276 }
277 
278 static int rt_cpu_seq_show(struct seq_file *seq, void *v)
279 {
280 	struct rt_cache_stat *st = v;
281 
282 	if (v == SEQ_START_TOKEN) {
283 		seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
284 		return 0;
285 	}
286 
287 	seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
288 		   " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
289 		   dst_entries_get_slow(&ipv4_dst_ops),
290 		   0, /* st->in_hit */
291 		   st->in_slow_tot,
292 		   st->in_slow_mc,
293 		   st->in_no_route,
294 		   st->in_brd,
295 		   st->in_martian_dst,
296 		   st->in_martian_src,
297 
298 		   0, /* st->out_hit */
299 		   st->out_slow_tot,
300 		   st->out_slow_mc,
301 
302 		   0, /* st->gc_total */
303 		   0, /* st->gc_ignored */
304 		   0, /* st->gc_goal_miss */
305 		   0, /* st->gc_dst_overflow */
306 		   0, /* st->in_hlist_search */
307 		   0  /* st->out_hlist_search */
308 		);
309 	return 0;
310 }
311 
312 static const struct seq_operations rt_cpu_seq_ops = {
313 	.start  = rt_cpu_seq_start,
314 	.next   = rt_cpu_seq_next,
315 	.stop   = rt_cpu_seq_stop,
316 	.show   = rt_cpu_seq_show,
317 };
318 
319 
320 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
321 {
322 	return seq_open(file, &rt_cpu_seq_ops);
323 }
324 
325 static const struct file_operations rt_cpu_seq_fops = {
326 	.owner	 = THIS_MODULE,
327 	.open	 = rt_cpu_seq_open,
328 	.read	 = seq_read,
329 	.llseek	 = seq_lseek,
330 	.release = seq_release,
331 };
332 
333 #ifdef CONFIG_IP_ROUTE_CLASSID
334 static int rt_acct_proc_show(struct seq_file *m, void *v)
335 {
336 	struct ip_rt_acct *dst, *src;
337 	unsigned int i, j;
338 
339 	dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
340 	if (!dst)
341 		return -ENOMEM;
342 
343 	for_each_possible_cpu(i) {
344 		src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
345 		for (j = 0; j < 256; j++) {
346 			dst[j].o_bytes   += src[j].o_bytes;
347 			dst[j].o_packets += src[j].o_packets;
348 			dst[j].i_bytes   += src[j].i_bytes;
349 			dst[j].i_packets += src[j].i_packets;
350 		}
351 	}
352 
353 	seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
354 	kfree(dst);
355 	return 0;
356 }
357 
358 static int rt_acct_proc_open(struct inode *inode, struct file *file)
359 {
360 	return single_open(file, rt_acct_proc_show, NULL);
361 }
362 
363 static const struct file_operations rt_acct_proc_fops = {
364 	.owner		= THIS_MODULE,
365 	.open		= rt_acct_proc_open,
366 	.read		= seq_read,
367 	.llseek		= seq_lseek,
368 	.release	= single_release,
369 };
370 #endif
371 
372 static int __net_init ip_rt_do_proc_init(struct net *net)
373 {
374 	struct proc_dir_entry *pde;
375 
376 	pde = proc_create("rt_cache", S_IRUGO, net->proc_net,
377 			  &rt_cache_seq_fops);
378 	if (!pde)
379 		goto err1;
380 
381 	pde = proc_create("rt_cache", S_IRUGO,
382 			  net->proc_net_stat, &rt_cpu_seq_fops);
383 	if (!pde)
384 		goto err2;
385 
386 #ifdef CONFIG_IP_ROUTE_CLASSID
387 	pde = proc_create("rt_acct", 0, net->proc_net, &rt_acct_proc_fops);
388 	if (!pde)
389 		goto err3;
390 #endif
391 	return 0;
392 
393 #ifdef CONFIG_IP_ROUTE_CLASSID
394 err3:
395 	remove_proc_entry("rt_cache", net->proc_net_stat);
396 #endif
397 err2:
398 	remove_proc_entry("rt_cache", net->proc_net);
399 err1:
400 	return -ENOMEM;
401 }
402 
403 static void __net_exit ip_rt_do_proc_exit(struct net *net)
404 {
405 	remove_proc_entry("rt_cache", net->proc_net_stat);
406 	remove_proc_entry("rt_cache", net->proc_net);
407 #ifdef CONFIG_IP_ROUTE_CLASSID
408 	remove_proc_entry("rt_acct", net->proc_net);
409 #endif
410 }
411 
412 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
413 	.init = ip_rt_do_proc_init,
414 	.exit = ip_rt_do_proc_exit,
415 };
416 
417 static int __init ip_rt_proc_init(void)
418 {
419 	return register_pernet_subsys(&ip_rt_proc_ops);
420 }
421 
422 #else
423 static inline int ip_rt_proc_init(void)
424 {
425 	return 0;
426 }
427 #endif /* CONFIG_PROC_FS */
428 
429 static inline bool rt_is_expired(const struct rtable *rth)
430 {
431 	return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
432 }
433 
434 void rt_cache_flush(struct net *net)
435 {
436 	rt_genid_bump_ipv4(net);
437 }
438 
439 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
440 					   struct sk_buff *skb,
441 					   const void *daddr)
442 {
443 	struct net_device *dev = dst->dev;
444 	const __be32 *pkey = daddr;
445 	const struct rtable *rt;
446 	struct neighbour *n;
447 
448 	rt = (const struct rtable *) dst;
449 	if (rt->rt_gateway)
450 		pkey = (const __be32 *) &rt->rt_gateway;
451 	else if (skb)
452 		pkey = &ip_hdr(skb)->daddr;
453 
454 	n = __ipv4_neigh_lookup(dev, *(__force u32 *)pkey);
455 	if (n)
456 		return n;
457 	return neigh_create(&arp_tbl, pkey, dev);
458 }
459 
460 #define IP_IDENTS_SZ 2048u
461 struct ip_ident_bucket {
462 	atomic_t	id;
463 	u32		stamp32;
464 };
465 
466 static struct ip_ident_bucket *ip_idents __read_mostly;
467 
468 /* In order to protect privacy, we add a perturbation to identifiers
469  * if one generator is seldom used. This makes hard for an attacker
470  * to infer how many packets were sent between two points in time.
471  */
472 u32 ip_idents_reserve(u32 hash, int segs)
473 {
474 	struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
475 	u32 old = ACCESS_ONCE(bucket->stamp32);
476 	u32 now = (u32)jiffies;
477 	u32 delta = 0;
478 
479 	if (old != now && cmpxchg(&bucket->stamp32, old, now) == old)
480 		delta = prandom_u32_max(now - old);
481 
482 	return atomic_add_return(segs + delta, &bucket->id) - segs;
483 }
484 EXPORT_SYMBOL(ip_idents_reserve);
485 
486 void __ip_select_ident(struct iphdr *iph, int segs)
487 {
488 	static u32 ip_idents_hashrnd __read_mostly;
489 	u32 hash, id;
490 
491 	net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
492 
493 	hash = jhash_3words((__force u32)iph->daddr,
494 			    (__force u32)iph->saddr,
495 			    iph->protocol,
496 			    ip_idents_hashrnd);
497 	id = ip_idents_reserve(hash, segs);
498 	iph->id = htons(id);
499 }
500 EXPORT_SYMBOL(__ip_select_ident);
501 
502 static void __build_flow_key(struct flowi4 *fl4, const struct sock *sk,
503 			     const struct iphdr *iph,
504 			     int oif, u8 tos,
505 			     u8 prot, u32 mark, int flow_flags)
506 {
507 	if (sk) {
508 		const struct inet_sock *inet = inet_sk(sk);
509 
510 		oif = sk->sk_bound_dev_if;
511 		mark = sk->sk_mark;
512 		tos = RT_CONN_FLAGS(sk);
513 		prot = inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol;
514 	}
515 	flowi4_init_output(fl4, oif, mark, tos,
516 			   RT_SCOPE_UNIVERSE, prot,
517 			   flow_flags,
518 			   iph->daddr, iph->saddr, 0, 0);
519 }
520 
521 static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
522 			       const struct sock *sk)
523 {
524 	const struct iphdr *iph = ip_hdr(skb);
525 	int oif = skb->dev->ifindex;
526 	u8 tos = RT_TOS(iph->tos);
527 	u8 prot = iph->protocol;
528 	u32 mark = skb->mark;
529 
530 	__build_flow_key(fl4, sk, iph, oif, tos, prot, mark, 0);
531 }
532 
533 static void build_sk_flow_key(struct flowi4 *fl4, const struct sock *sk)
534 {
535 	const struct inet_sock *inet = inet_sk(sk);
536 	const struct ip_options_rcu *inet_opt;
537 	__be32 daddr = inet->inet_daddr;
538 
539 	rcu_read_lock();
540 	inet_opt = rcu_dereference(inet->inet_opt);
541 	if (inet_opt && inet_opt->opt.srr)
542 		daddr = inet_opt->opt.faddr;
543 	flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
544 			   RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
545 			   inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
546 			   inet_sk_flowi_flags(sk),
547 			   daddr, inet->inet_saddr, 0, 0);
548 	rcu_read_unlock();
549 }
550 
551 static void ip_rt_build_flow_key(struct flowi4 *fl4, const struct sock *sk,
552 				 const struct sk_buff *skb)
553 {
554 	if (skb)
555 		build_skb_flow_key(fl4, skb, sk);
556 	else
557 		build_sk_flow_key(fl4, sk);
558 }
559 
560 static inline void rt_free(struct rtable *rt)
561 {
562 	call_rcu(&rt->dst.rcu_head, dst_rcu_free);
563 }
564 
565 static DEFINE_SPINLOCK(fnhe_lock);
566 
567 static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
568 {
569 	struct rtable *rt;
570 
571 	rt = rcu_dereference(fnhe->fnhe_rth_input);
572 	if (rt) {
573 		RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
574 		rt_free(rt);
575 	}
576 	rt = rcu_dereference(fnhe->fnhe_rth_output);
577 	if (rt) {
578 		RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
579 		rt_free(rt);
580 	}
581 }
582 
583 static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
584 {
585 	struct fib_nh_exception *fnhe, *oldest;
586 
587 	oldest = rcu_dereference(hash->chain);
588 	for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
589 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
590 		if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
591 			oldest = fnhe;
592 	}
593 	fnhe_flush_routes(oldest);
594 	return oldest;
595 }
596 
597 static inline u32 fnhe_hashfun(__be32 daddr)
598 {
599 	u32 hval;
600 
601 	hval = (__force u32) daddr;
602 	hval ^= (hval >> 11) ^ (hval >> 22);
603 
604 	return hval & (FNHE_HASH_SIZE - 1);
605 }
606 
607 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
608 {
609 	rt->rt_pmtu = fnhe->fnhe_pmtu;
610 	rt->dst.expires = fnhe->fnhe_expires;
611 
612 	if (fnhe->fnhe_gw) {
613 		rt->rt_flags |= RTCF_REDIRECTED;
614 		rt->rt_gateway = fnhe->fnhe_gw;
615 		rt->rt_uses_gateway = 1;
616 	}
617 }
618 
619 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
620 				  u32 pmtu, unsigned long expires)
621 {
622 	struct fnhe_hash_bucket *hash;
623 	struct fib_nh_exception *fnhe;
624 	struct rtable *rt;
625 	unsigned int i;
626 	int depth;
627 	u32 hval = fnhe_hashfun(daddr);
628 
629 	spin_lock_bh(&fnhe_lock);
630 
631 	hash = nh->nh_exceptions;
632 	if (!hash) {
633 		hash = kzalloc(FNHE_HASH_SIZE * sizeof(*hash), GFP_ATOMIC);
634 		if (!hash)
635 			goto out_unlock;
636 		nh->nh_exceptions = hash;
637 	}
638 
639 	hash += hval;
640 
641 	depth = 0;
642 	for (fnhe = rcu_dereference(hash->chain); fnhe;
643 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
644 		if (fnhe->fnhe_daddr == daddr)
645 			break;
646 		depth++;
647 	}
648 
649 	if (fnhe) {
650 		if (gw)
651 			fnhe->fnhe_gw = gw;
652 		if (pmtu) {
653 			fnhe->fnhe_pmtu = pmtu;
654 			fnhe->fnhe_expires = max(1UL, expires);
655 		}
656 		/* Update all cached dsts too */
657 		rt = rcu_dereference(fnhe->fnhe_rth_input);
658 		if (rt)
659 			fill_route_from_fnhe(rt, fnhe);
660 		rt = rcu_dereference(fnhe->fnhe_rth_output);
661 		if (rt)
662 			fill_route_from_fnhe(rt, fnhe);
663 	} else {
664 		if (depth > FNHE_RECLAIM_DEPTH)
665 			fnhe = fnhe_oldest(hash);
666 		else {
667 			fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
668 			if (!fnhe)
669 				goto out_unlock;
670 
671 			fnhe->fnhe_next = hash->chain;
672 			rcu_assign_pointer(hash->chain, fnhe);
673 		}
674 		fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
675 		fnhe->fnhe_daddr = daddr;
676 		fnhe->fnhe_gw = gw;
677 		fnhe->fnhe_pmtu = pmtu;
678 		fnhe->fnhe_expires = expires;
679 
680 		/* Exception created; mark the cached routes for the nexthop
681 		 * stale, so anyone caching it rechecks if this exception
682 		 * applies to them.
683 		 */
684 		rt = rcu_dereference(nh->nh_rth_input);
685 		if (rt)
686 			rt->dst.obsolete = DST_OBSOLETE_KILL;
687 
688 		for_each_possible_cpu(i) {
689 			struct rtable __rcu **prt;
690 			prt = per_cpu_ptr(nh->nh_pcpu_rth_output, i);
691 			rt = rcu_dereference(*prt);
692 			if (rt)
693 				rt->dst.obsolete = DST_OBSOLETE_KILL;
694 		}
695 	}
696 
697 	fnhe->fnhe_stamp = jiffies;
698 
699 out_unlock:
700 	spin_unlock_bh(&fnhe_lock);
701 }
702 
703 static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flowi4 *fl4,
704 			     bool kill_route)
705 {
706 	__be32 new_gw = icmp_hdr(skb)->un.gateway;
707 	__be32 old_gw = ip_hdr(skb)->saddr;
708 	struct net_device *dev = skb->dev;
709 	struct in_device *in_dev;
710 	struct fib_result res;
711 	struct neighbour *n;
712 	struct net *net;
713 
714 	switch (icmp_hdr(skb)->code & 7) {
715 	case ICMP_REDIR_NET:
716 	case ICMP_REDIR_NETTOS:
717 	case ICMP_REDIR_HOST:
718 	case ICMP_REDIR_HOSTTOS:
719 		break;
720 
721 	default:
722 		return;
723 	}
724 
725 	if (rt->rt_gateway != old_gw)
726 		return;
727 
728 	in_dev = __in_dev_get_rcu(dev);
729 	if (!in_dev)
730 		return;
731 
732 	net = dev_net(dev);
733 	if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
734 	    ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
735 	    ipv4_is_zeronet(new_gw))
736 		goto reject_redirect;
737 
738 	if (!IN_DEV_SHARED_MEDIA(in_dev)) {
739 		if (!inet_addr_onlink(in_dev, new_gw, old_gw))
740 			goto reject_redirect;
741 		if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
742 			goto reject_redirect;
743 	} else {
744 		if (inet_addr_type(net, new_gw) != RTN_UNICAST)
745 			goto reject_redirect;
746 	}
747 
748 	n = ipv4_neigh_lookup(&rt->dst, NULL, &new_gw);
749 	if (n) {
750 		if (!(n->nud_state & NUD_VALID)) {
751 			neigh_event_send(n, NULL);
752 		} else {
753 			if (fib_lookup(net, fl4, &res) == 0) {
754 				struct fib_nh *nh = &FIB_RES_NH(res);
755 
756 				update_or_create_fnhe(nh, fl4->daddr, new_gw,
757 						      0, 0);
758 			}
759 			if (kill_route)
760 				rt->dst.obsolete = DST_OBSOLETE_KILL;
761 			call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
762 		}
763 		neigh_release(n);
764 	}
765 	return;
766 
767 reject_redirect:
768 #ifdef CONFIG_IP_ROUTE_VERBOSE
769 	if (IN_DEV_LOG_MARTIANS(in_dev)) {
770 		const struct iphdr *iph = (const struct iphdr *) skb->data;
771 		__be32 daddr = iph->daddr;
772 		__be32 saddr = iph->saddr;
773 
774 		net_info_ratelimited("Redirect from %pI4 on %s about %pI4 ignored\n"
775 				     "  Advised path = %pI4 -> %pI4\n",
776 				     &old_gw, dev->name, &new_gw,
777 				     &saddr, &daddr);
778 	}
779 #endif
780 	;
781 }
782 
783 static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
784 {
785 	struct rtable *rt;
786 	struct flowi4 fl4;
787 	const struct iphdr *iph = (const struct iphdr *) skb->data;
788 	int oif = skb->dev->ifindex;
789 	u8 tos = RT_TOS(iph->tos);
790 	u8 prot = iph->protocol;
791 	u32 mark = skb->mark;
792 
793 	rt = (struct rtable *) dst;
794 
795 	__build_flow_key(&fl4, sk, iph, oif, tos, prot, mark, 0);
796 	__ip_do_redirect(rt, skb, &fl4, true);
797 }
798 
799 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
800 {
801 	struct rtable *rt = (struct rtable *)dst;
802 	struct dst_entry *ret = dst;
803 
804 	if (rt) {
805 		if (dst->obsolete > 0) {
806 			ip_rt_put(rt);
807 			ret = NULL;
808 		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
809 			   rt->dst.expires) {
810 			ip_rt_put(rt);
811 			ret = NULL;
812 		}
813 	}
814 	return ret;
815 }
816 
817 /*
818  * Algorithm:
819  *	1. The first ip_rt_redirect_number redirects are sent
820  *	   with exponential backoff, then we stop sending them at all,
821  *	   assuming that the host ignores our redirects.
822  *	2. If we did not see packets requiring redirects
823  *	   during ip_rt_redirect_silence, we assume that the host
824  *	   forgot redirected route and start to send redirects again.
825  *
826  * This algorithm is much cheaper and more intelligent than dumb load limiting
827  * in icmp.c.
828  *
829  * NOTE. Do not forget to inhibit load limiting for redirects (redundant)
830  * and "frag. need" (breaks PMTU discovery) in icmp.c.
831  */
832 
833 void ip_rt_send_redirect(struct sk_buff *skb)
834 {
835 	struct rtable *rt = skb_rtable(skb);
836 	struct in_device *in_dev;
837 	struct inet_peer *peer;
838 	struct net *net;
839 	int log_martians;
840 
841 	rcu_read_lock();
842 	in_dev = __in_dev_get_rcu(rt->dst.dev);
843 	if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
844 		rcu_read_unlock();
845 		return;
846 	}
847 	log_martians = IN_DEV_LOG_MARTIANS(in_dev);
848 	rcu_read_unlock();
849 
850 	net = dev_net(rt->dst.dev);
851 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
852 	if (!peer) {
853 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
854 			  rt_nexthop(rt, ip_hdr(skb)->daddr));
855 		return;
856 	}
857 
858 	/* No redirected packets during ip_rt_redirect_silence;
859 	 * reset the algorithm.
860 	 */
861 	if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
862 		peer->rate_tokens = 0;
863 
864 	/* Too many ignored redirects; do not send anything
865 	 * set dst.rate_last to the last seen redirected packet.
866 	 */
867 	if (peer->rate_tokens >= ip_rt_redirect_number) {
868 		peer->rate_last = jiffies;
869 		goto out_put_peer;
870 	}
871 
872 	/* Check for load limit; set rate_last to the latest sent
873 	 * redirect.
874 	 */
875 	if (peer->rate_tokens == 0 ||
876 	    time_after(jiffies,
877 		       (peer->rate_last +
878 			(ip_rt_redirect_load << peer->rate_tokens)))) {
879 		__be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
880 
881 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
882 		peer->rate_last = jiffies;
883 		++peer->rate_tokens;
884 #ifdef CONFIG_IP_ROUTE_VERBOSE
885 		if (log_martians &&
886 		    peer->rate_tokens == ip_rt_redirect_number)
887 			net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
888 					     &ip_hdr(skb)->saddr, inet_iif(skb),
889 					     &ip_hdr(skb)->daddr, &gw);
890 #endif
891 	}
892 out_put_peer:
893 	inet_putpeer(peer);
894 }
895 
896 static int ip_error(struct sk_buff *skb)
897 {
898 	struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
899 	struct rtable *rt = skb_rtable(skb);
900 	struct inet_peer *peer;
901 	unsigned long now;
902 	struct net *net;
903 	bool send;
904 	int code;
905 
906 	net = dev_net(rt->dst.dev);
907 	if (!IN_DEV_FORWARD(in_dev)) {
908 		switch (rt->dst.error) {
909 		case EHOSTUNREACH:
910 			IP_INC_STATS_BH(net, IPSTATS_MIB_INADDRERRORS);
911 			break;
912 
913 		case ENETUNREACH:
914 			IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
915 			break;
916 		}
917 		goto out;
918 	}
919 
920 	switch (rt->dst.error) {
921 	case EINVAL:
922 	default:
923 		goto out;
924 	case EHOSTUNREACH:
925 		code = ICMP_HOST_UNREACH;
926 		break;
927 	case ENETUNREACH:
928 		code = ICMP_NET_UNREACH;
929 		IP_INC_STATS_BH(net, IPSTATS_MIB_INNOROUTES);
930 		break;
931 	case EACCES:
932 		code = ICMP_PKT_FILTERED;
933 		break;
934 	}
935 
936 	peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, 1);
937 
938 	send = true;
939 	if (peer) {
940 		now = jiffies;
941 		peer->rate_tokens += now - peer->rate_last;
942 		if (peer->rate_tokens > ip_rt_error_burst)
943 			peer->rate_tokens = ip_rt_error_burst;
944 		peer->rate_last = now;
945 		if (peer->rate_tokens >= ip_rt_error_cost)
946 			peer->rate_tokens -= ip_rt_error_cost;
947 		else
948 			send = false;
949 		inet_putpeer(peer);
950 	}
951 	if (send)
952 		icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
953 
954 out:	kfree_skb(skb);
955 	return 0;
956 }
957 
958 static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
959 {
960 	struct dst_entry *dst = &rt->dst;
961 	struct fib_result res;
962 
963 	if (dst_metric_locked(dst, RTAX_MTU))
964 		return;
965 
966 	if (dst->dev->mtu < mtu)
967 		return;
968 
969 	if (mtu < ip_rt_min_pmtu)
970 		mtu = ip_rt_min_pmtu;
971 
972 	if (rt->rt_pmtu == mtu &&
973 	    time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
974 		return;
975 
976 	rcu_read_lock();
977 	if (fib_lookup(dev_net(dst->dev), fl4, &res) == 0) {
978 		struct fib_nh *nh = &FIB_RES_NH(res);
979 
980 		update_or_create_fnhe(nh, fl4->daddr, 0, mtu,
981 				      jiffies + ip_rt_mtu_expires);
982 	}
983 	rcu_read_unlock();
984 }
985 
986 static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
987 			      struct sk_buff *skb, u32 mtu)
988 {
989 	struct rtable *rt = (struct rtable *) dst;
990 	struct flowi4 fl4;
991 
992 	ip_rt_build_flow_key(&fl4, sk, skb);
993 	__ip_rt_update_pmtu(rt, &fl4, mtu);
994 }
995 
996 void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
997 		      int oif, u32 mark, u8 protocol, int flow_flags)
998 {
999 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1000 	struct flowi4 fl4;
1001 	struct rtable *rt;
1002 
1003 	if (!mark)
1004 		mark = IP4_REPLY_MARK(net, skb->mark);
1005 
1006 	__build_flow_key(&fl4, NULL, iph, oif,
1007 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1008 	rt = __ip_route_output_key(net, &fl4);
1009 	if (!IS_ERR(rt)) {
1010 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1011 		ip_rt_put(rt);
1012 	}
1013 }
1014 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
1015 
1016 static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1017 {
1018 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1019 	struct flowi4 fl4;
1020 	struct rtable *rt;
1021 
1022 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1023 
1024 	if (!fl4.flowi4_mark)
1025 		fl4.flowi4_mark = IP4_REPLY_MARK(sock_net(sk), skb->mark);
1026 
1027 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1028 	if (!IS_ERR(rt)) {
1029 		__ip_rt_update_pmtu(rt, &fl4, mtu);
1030 		ip_rt_put(rt);
1031 	}
1032 }
1033 
1034 void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1035 {
1036 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1037 	struct flowi4 fl4;
1038 	struct rtable *rt;
1039 	struct dst_entry *odst = NULL;
1040 	bool new = false;
1041 
1042 	bh_lock_sock(sk);
1043 
1044 	if (!ip_sk_accept_pmtu(sk))
1045 		goto out;
1046 
1047 	odst = sk_dst_get(sk);
1048 
1049 	if (sock_owned_by_user(sk) || !odst) {
1050 		__ipv4_sk_update_pmtu(skb, sk, mtu);
1051 		goto out;
1052 	}
1053 
1054 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1055 
1056 	rt = (struct rtable *)odst;
1057 	if (odst->obsolete && odst->ops->check(odst, 0) == NULL) {
1058 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1059 		if (IS_ERR(rt))
1060 			goto out;
1061 
1062 		new = true;
1063 	}
1064 
1065 	__ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
1066 
1067 	if (!dst_check(&rt->dst, 0)) {
1068 		if (new)
1069 			dst_release(&rt->dst);
1070 
1071 		rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1072 		if (IS_ERR(rt))
1073 			goto out;
1074 
1075 		new = true;
1076 	}
1077 
1078 	if (new)
1079 		sk_dst_set(sk, &rt->dst);
1080 
1081 out:
1082 	bh_unlock_sock(sk);
1083 	dst_release(odst);
1084 }
1085 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
1086 
1087 void ipv4_redirect(struct sk_buff *skb, struct net *net,
1088 		   int oif, u32 mark, u8 protocol, int flow_flags)
1089 {
1090 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1091 	struct flowi4 fl4;
1092 	struct rtable *rt;
1093 
1094 	__build_flow_key(&fl4, NULL, iph, oif,
1095 			 RT_TOS(iph->tos), protocol, mark, flow_flags);
1096 	rt = __ip_route_output_key(net, &fl4);
1097 	if (!IS_ERR(rt)) {
1098 		__ip_do_redirect(rt, skb, &fl4, false);
1099 		ip_rt_put(rt);
1100 	}
1101 }
1102 EXPORT_SYMBOL_GPL(ipv4_redirect);
1103 
1104 void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk)
1105 {
1106 	const struct iphdr *iph = (const struct iphdr *) skb->data;
1107 	struct flowi4 fl4;
1108 	struct rtable *rt;
1109 
1110 	__build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
1111 	rt = __ip_route_output_key(sock_net(sk), &fl4);
1112 	if (!IS_ERR(rt)) {
1113 		__ip_do_redirect(rt, skb, &fl4, false);
1114 		ip_rt_put(rt);
1115 	}
1116 }
1117 EXPORT_SYMBOL_GPL(ipv4_sk_redirect);
1118 
1119 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
1120 {
1121 	struct rtable *rt = (struct rtable *) dst;
1122 
1123 	/* All IPV4 dsts are created with ->obsolete set to the value
1124 	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
1125 	 * into this function always.
1126 	 *
1127 	 * When a PMTU/redirect information update invalidates a route,
1128 	 * this is indicated by setting obsolete to DST_OBSOLETE_KILL or
1129 	 * DST_OBSOLETE_DEAD by dst_free().
1130 	 */
1131 	if (dst->obsolete != DST_OBSOLETE_FORCE_CHK || rt_is_expired(rt))
1132 		return NULL;
1133 	return dst;
1134 }
1135 
1136 static void ipv4_link_failure(struct sk_buff *skb)
1137 {
1138 	struct rtable *rt;
1139 
1140 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
1141 
1142 	rt = skb_rtable(skb);
1143 	if (rt)
1144 		dst_set_expires(&rt->dst, 0);
1145 }
1146 
1147 static int ip_rt_bug(struct sock *sk, struct sk_buff *skb)
1148 {
1149 	pr_debug("%s: %pI4 -> %pI4, %s\n",
1150 		 __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
1151 		 skb->dev ? skb->dev->name : "?");
1152 	kfree_skb(skb);
1153 	WARN_ON(1);
1154 	return 0;
1155 }
1156 
1157 /*
1158    We do not cache source address of outgoing interface,
1159    because it is used only by IP RR, TS and SRR options,
1160    so that it out of fast path.
1161 
1162    BTW remember: "addr" is allowed to be not aligned
1163    in IP options!
1164  */
1165 
1166 void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
1167 {
1168 	__be32 src;
1169 
1170 	if (rt_is_output_route(rt))
1171 		src = ip_hdr(skb)->saddr;
1172 	else {
1173 		struct fib_result res;
1174 		struct flowi4 fl4;
1175 		struct iphdr *iph;
1176 
1177 		iph = ip_hdr(skb);
1178 
1179 		memset(&fl4, 0, sizeof(fl4));
1180 		fl4.daddr = iph->daddr;
1181 		fl4.saddr = iph->saddr;
1182 		fl4.flowi4_tos = RT_TOS(iph->tos);
1183 		fl4.flowi4_oif = rt->dst.dev->ifindex;
1184 		fl4.flowi4_iif = skb->dev->ifindex;
1185 		fl4.flowi4_mark = skb->mark;
1186 
1187 		rcu_read_lock();
1188 		if (fib_lookup(dev_net(rt->dst.dev), &fl4, &res) == 0)
1189 			src = FIB_RES_PREFSRC(dev_net(rt->dst.dev), res);
1190 		else
1191 			src = inet_select_addr(rt->dst.dev,
1192 					       rt_nexthop(rt, iph->daddr),
1193 					       RT_SCOPE_UNIVERSE);
1194 		rcu_read_unlock();
1195 	}
1196 	memcpy(addr, &src, 4);
1197 }
1198 
1199 #ifdef CONFIG_IP_ROUTE_CLASSID
1200 static void set_class_tag(struct rtable *rt, u32 tag)
1201 {
1202 	if (!(rt->dst.tclassid & 0xFFFF))
1203 		rt->dst.tclassid |= tag & 0xFFFF;
1204 	if (!(rt->dst.tclassid & 0xFFFF0000))
1205 		rt->dst.tclassid |= tag & 0xFFFF0000;
1206 }
1207 #endif
1208 
1209 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
1210 {
1211 	unsigned int advmss = dst_metric_raw(dst, RTAX_ADVMSS);
1212 
1213 	if (advmss == 0) {
1214 		advmss = max_t(unsigned int, dst->dev->mtu - 40,
1215 			       ip_rt_min_advmss);
1216 		if (advmss > 65535 - 40)
1217 			advmss = 65535 - 40;
1218 	}
1219 	return advmss;
1220 }
1221 
1222 static unsigned int ipv4_mtu(const struct dst_entry *dst)
1223 {
1224 	const struct rtable *rt = (const struct rtable *) dst;
1225 	unsigned int mtu = rt->rt_pmtu;
1226 
1227 	if (!mtu || time_after_eq(jiffies, rt->dst.expires))
1228 		mtu = dst_metric_raw(dst, RTAX_MTU);
1229 
1230 	if (mtu)
1231 		return mtu;
1232 
1233 	mtu = dst->dev->mtu;
1234 
1235 	if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
1236 		if (rt->rt_uses_gateway && mtu > 576)
1237 			mtu = 576;
1238 	}
1239 
1240 	return min_t(unsigned int, mtu, IP_MAX_MTU);
1241 }
1242 
1243 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
1244 {
1245 	struct fnhe_hash_bucket *hash = nh->nh_exceptions;
1246 	struct fib_nh_exception *fnhe;
1247 	u32 hval;
1248 
1249 	if (!hash)
1250 		return NULL;
1251 
1252 	hval = fnhe_hashfun(daddr);
1253 
1254 	for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
1255 	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
1256 		if (fnhe->fnhe_daddr == daddr)
1257 			return fnhe;
1258 	}
1259 	return NULL;
1260 }
1261 
1262 static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
1263 			      __be32 daddr)
1264 {
1265 	bool ret = false;
1266 
1267 	spin_lock_bh(&fnhe_lock);
1268 
1269 	if (daddr == fnhe->fnhe_daddr) {
1270 		struct rtable __rcu **porig;
1271 		struct rtable *orig;
1272 		int genid = fnhe_genid(dev_net(rt->dst.dev));
1273 
1274 		if (rt_is_input_route(rt))
1275 			porig = &fnhe->fnhe_rth_input;
1276 		else
1277 			porig = &fnhe->fnhe_rth_output;
1278 		orig = rcu_dereference(*porig);
1279 
1280 		if (fnhe->fnhe_genid != genid) {
1281 			fnhe->fnhe_genid = genid;
1282 			fnhe->fnhe_gw = 0;
1283 			fnhe->fnhe_pmtu = 0;
1284 			fnhe->fnhe_expires = 0;
1285 			fnhe_flush_routes(fnhe);
1286 			orig = NULL;
1287 		}
1288 		fill_route_from_fnhe(rt, fnhe);
1289 		if (!rt->rt_gateway)
1290 			rt->rt_gateway = daddr;
1291 
1292 		if (!(rt->dst.flags & DST_NOCACHE)) {
1293 			rcu_assign_pointer(*porig, rt);
1294 			if (orig)
1295 				rt_free(orig);
1296 			ret = true;
1297 		}
1298 
1299 		fnhe->fnhe_stamp = jiffies;
1300 	}
1301 	spin_unlock_bh(&fnhe_lock);
1302 
1303 	return ret;
1304 }
1305 
1306 static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
1307 {
1308 	struct rtable *orig, *prev, **p;
1309 	bool ret = true;
1310 
1311 	if (rt_is_input_route(rt)) {
1312 		p = (struct rtable **)&nh->nh_rth_input;
1313 	} else {
1314 		p = (struct rtable **)__this_cpu_ptr(nh->nh_pcpu_rth_output);
1315 	}
1316 	orig = *p;
1317 
1318 	prev = cmpxchg(p, orig, rt);
1319 	if (prev == orig) {
1320 		if (orig)
1321 			rt_free(orig);
1322 	} else
1323 		ret = false;
1324 
1325 	return ret;
1326 }
1327 
1328 static DEFINE_SPINLOCK(rt_uncached_lock);
1329 static LIST_HEAD(rt_uncached_list);
1330 
1331 static void rt_add_uncached_list(struct rtable *rt)
1332 {
1333 	spin_lock_bh(&rt_uncached_lock);
1334 	list_add_tail(&rt->rt_uncached, &rt_uncached_list);
1335 	spin_unlock_bh(&rt_uncached_lock);
1336 }
1337 
1338 static void ipv4_dst_destroy(struct dst_entry *dst)
1339 {
1340 	struct rtable *rt = (struct rtable *) dst;
1341 
1342 	if (!list_empty(&rt->rt_uncached)) {
1343 		spin_lock_bh(&rt_uncached_lock);
1344 		list_del(&rt->rt_uncached);
1345 		spin_unlock_bh(&rt_uncached_lock);
1346 	}
1347 }
1348 
1349 void rt_flush_dev(struct net_device *dev)
1350 {
1351 	if (!list_empty(&rt_uncached_list)) {
1352 		struct net *net = dev_net(dev);
1353 		struct rtable *rt;
1354 
1355 		spin_lock_bh(&rt_uncached_lock);
1356 		list_for_each_entry(rt, &rt_uncached_list, rt_uncached) {
1357 			if (rt->dst.dev != dev)
1358 				continue;
1359 			rt->dst.dev = net->loopback_dev;
1360 			dev_hold(rt->dst.dev);
1361 			dev_put(dev);
1362 		}
1363 		spin_unlock_bh(&rt_uncached_lock);
1364 	}
1365 }
1366 
1367 static bool rt_cache_valid(const struct rtable *rt)
1368 {
1369 	return	rt &&
1370 		rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1371 		!rt_is_expired(rt);
1372 }
1373 
1374 static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
1375 			   const struct fib_result *res,
1376 			   struct fib_nh_exception *fnhe,
1377 			   struct fib_info *fi, u16 type, u32 itag)
1378 {
1379 	bool cached = false;
1380 
1381 	if (fi) {
1382 		struct fib_nh *nh = &FIB_RES_NH(*res);
1383 
1384 		if (nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) {
1385 			rt->rt_gateway = nh->nh_gw;
1386 			rt->rt_uses_gateway = 1;
1387 		}
1388 		dst_init_metrics(&rt->dst, fi->fib_metrics, true);
1389 #ifdef CONFIG_IP_ROUTE_CLASSID
1390 		rt->dst.tclassid = nh->nh_tclassid;
1391 #endif
1392 		if (unlikely(fnhe))
1393 			cached = rt_bind_exception(rt, fnhe, daddr);
1394 		else if (!(rt->dst.flags & DST_NOCACHE))
1395 			cached = rt_cache_route(nh, rt);
1396 		if (unlikely(!cached)) {
1397 			/* Routes we intend to cache in nexthop exception or
1398 			 * FIB nexthop have the DST_NOCACHE bit clear.
1399 			 * However, if we are unsuccessful at storing this
1400 			 * route into the cache we really need to set it.
1401 			 */
1402 			rt->dst.flags |= DST_NOCACHE;
1403 			if (!rt->rt_gateway)
1404 				rt->rt_gateway = daddr;
1405 			rt_add_uncached_list(rt);
1406 		}
1407 	} else
1408 		rt_add_uncached_list(rt);
1409 
1410 #ifdef CONFIG_IP_ROUTE_CLASSID
1411 #ifdef CONFIG_IP_MULTIPLE_TABLES
1412 	set_class_tag(rt, res->tclassid);
1413 #endif
1414 	set_class_tag(rt, itag);
1415 #endif
1416 }
1417 
1418 static struct rtable *rt_dst_alloc(struct net_device *dev,
1419 				   bool nopolicy, bool noxfrm, bool will_cache)
1420 {
1421 	return dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
1422 			 (will_cache ? 0 : (DST_HOST | DST_NOCACHE)) |
1423 			 (nopolicy ? DST_NOPOLICY : 0) |
1424 			 (noxfrm ? DST_NOXFRM : 0));
1425 }
1426 
1427 /* called in rcu_read_lock() section */
1428 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1429 				u8 tos, struct net_device *dev, int our)
1430 {
1431 	struct rtable *rth;
1432 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1433 	u32 itag = 0;
1434 	int err;
1435 
1436 	/* Primary sanity checks. */
1437 
1438 	if (in_dev == NULL)
1439 		return -EINVAL;
1440 
1441 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1442 	    skb->protocol != htons(ETH_P_IP))
1443 		goto e_inval;
1444 
1445 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1446 		if (ipv4_is_loopback(saddr))
1447 			goto e_inval;
1448 
1449 	if (ipv4_is_zeronet(saddr)) {
1450 		if (!ipv4_is_local_multicast(daddr))
1451 			goto e_inval;
1452 	} else {
1453 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1454 					  in_dev, &itag);
1455 		if (err < 0)
1456 			goto e_err;
1457 	}
1458 	rth = rt_dst_alloc(dev_net(dev)->loopback_dev,
1459 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
1460 	if (!rth)
1461 		goto e_nobufs;
1462 
1463 #ifdef CONFIG_IP_ROUTE_CLASSID
1464 	rth->dst.tclassid = itag;
1465 #endif
1466 	rth->dst.output = ip_rt_bug;
1467 
1468 	rth->rt_genid	= rt_genid_ipv4(dev_net(dev));
1469 	rth->rt_flags	= RTCF_MULTICAST;
1470 	rth->rt_type	= RTN_MULTICAST;
1471 	rth->rt_is_input= 1;
1472 	rth->rt_iif	= 0;
1473 	rth->rt_pmtu	= 0;
1474 	rth->rt_gateway	= 0;
1475 	rth->rt_uses_gateway = 0;
1476 	INIT_LIST_HEAD(&rth->rt_uncached);
1477 	if (our) {
1478 		rth->dst.input= ip_local_deliver;
1479 		rth->rt_flags |= RTCF_LOCAL;
1480 	}
1481 
1482 #ifdef CONFIG_IP_MROUTE
1483 	if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
1484 		rth->dst.input = ip_mr_input;
1485 #endif
1486 	RT_CACHE_STAT_INC(in_slow_mc);
1487 
1488 	skb_dst_set(skb, &rth->dst);
1489 	return 0;
1490 
1491 e_nobufs:
1492 	return -ENOBUFS;
1493 e_inval:
1494 	return -EINVAL;
1495 e_err:
1496 	return err;
1497 }
1498 
1499 
1500 static void ip_handle_martian_source(struct net_device *dev,
1501 				     struct in_device *in_dev,
1502 				     struct sk_buff *skb,
1503 				     __be32 daddr,
1504 				     __be32 saddr)
1505 {
1506 	RT_CACHE_STAT_INC(in_martian_src);
1507 #ifdef CONFIG_IP_ROUTE_VERBOSE
1508 	if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
1509 		/*
1510 		 *	RFC1812 recommendation, if source is martian,
1511 		 *	the only hint is MAC header.
1512 		 */
1513 		pr_warn("martian source %pI4 from %pI4, on dev %s\n",
1514 			&daddr, &saddr, dev->name);
1515 		if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
1516 			print_hex_dump(KERN_WARNING, "ll header: ",
1517 				       DUMP_PREFIX_OFFSET, 16, 1,
1518 				       skb_mac_header(skb),
1519 				       dev->hard_header_len, true);
1520 		}
1521 	}
1522 #endif
1523 }
1524 
1525 /* called in rcu_read_lock() section */
1526 static int __mkroute_input(struct sk_buff *skb,
1527 			   const struct fib_result *res,
1528 			   struct in_device *in_dev,
1529 			   __be32 daddr, __be32 saddr, u32 tos)
1530 {
1531 	struct fib_nh_exception *fnhe;
1532 	struct rtable *rth;
1533 	int err;
1534 	struct in_device *out_dev;
1535 	unsigned int flags = 0;
1536 	bool do_cache;
1537 	u32 itag = 0;
1538 
1539 	/* get a working reference to the output device */
1540 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
1541 	if (out_dev == NULL) {
1542 		net_crit_ratelimited("Bug in ip_route_input_slow(). Please report.\n");
1543 		return -EINVAL;
1544 	}
1545 
1546 	err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
1547 				  in_dev->dev, in_dev, &itag);
1548 	if (err < 0) {
1549 		ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
1550 					 saddr);
1551 
1552 		goto cleanup;
1553 	}
1554 
1555 	do_cache = res->fi && !itag;
1556 	if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
1557 	    (IN_DEV_SHARED_MEDIA(out_dev) ||
1558 	     inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
1559 		flags |= RTCF_DOREDIRECT;
1560 		do_cache = false;
1561 	}
1562 
1563 	if (skb->protocol != htons(ETH_P_IP)) {
1564 		/* Not IP (i.e. ARP). Do not create route, if it is
1565 		 * invalid for proxy arp. DNAT routes are always valid.
1566 		 *
1567 		 * Proxy arp feature have been extended to allow, ARP
1568 		 * replies back to the same interface, to support
1569 		 * Private VLAN switch technologies. See arp.c.
1570 		 */
1571 		if (out_dev == in_dev &&
1572 		    IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
1573 			err = -EINVAL;
1574 			goto cleanup;
1575 		}
1576 	}
1577 
1578 	fnhe = find_exception(&FIB_RES_NH(*res), daddr);
1579 	if (do_cache) {
1580 		if (fnhe != NULL)
1581 			rth = rcu_dereference(fnhe->fnhe_rth_input);
1582 		else
1583 			rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
1584 
1585 		if (rt_cache_valid(rth)) {
1586 			skb_dst_set_noref(skb, &rth->dst);
1587 			goto out;
1588 		}
1589 	}
1590 
1591 	rth = rt_dst_alloc(out_dev->dev,
1592 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1593 			   IN_DEV_CONF_GET(out_dev, NOXFRM), do_cache);
1594 	if (!rth) {
1595 		err = -ENOBUFS;
1596 		goto cleanup;
1597 	}
1598 
1599 	rth->rt_genid = rt_genid_ipv4(dev_net(rth->dst.dev));
1600 	rth->rt_flags = flags;
1601 	rth->rt_type = res->type;
1602 	rth->rt_is_input = 1;
1603 	rth->rt_iif 	= 0;
1604 	rth->rt_pmtu	= 0;
1605 	rth->rt_gateway	= 0;
1606 	rth->rt_uses_gateway = 0;
1607 	INIT_LIST_HEAD(&rth->rt_uncached);
1608 	RT_CACHE_STAT_INC(in_slow_tot);
1609 
1610 	rth->dst.input = ip_forward;
1611 	rth->dst.output = ip_output;
1612 
1613 	rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag);
1614 	skb_dst_set(skb, &rth->dst);
1615 out:
1616 	err = 0;
1617  cleanup:
1618 	return err;
1619 }
1620 
1621 static int ip_mkroute_input(struct sk_buff *skb,
1622 			    struct fib_result *res,
1623 			    const struct flowi4 *fl4,
1624 			    struct in_device *in_dev,
1625 			    __be32 daddr, __be32 saddr, u32 tos)
1626 {
1627 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1628 	if (res->fi && res->fi->fib_nhs > 1)
1629 		fib_select_multipath(res);
1630 #endif
1631 
1632 	/* create a routing cache entry */
1633 	return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
1634 }
1635 
1636 /*
1637  *	NOTE. We drop all the packets that has local source
1638  *	addresses, because every properly looped back packet
1639  *	must have correct destination already attached by output routine.
1640  *
1641  *	Such approach solves two big problems:
1642  *	1. Not simplex devices are handled properly.
1643  *	2. IP spoofing attempts are filtered with 100% of guarantee.
1644  *	called with rcu_read_lock()
1645  */
1646 
1647 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1648 			       u8 tos, struct net_device *dev)
1649 {
1650 	struct fib_result res;
1651 	struct in_device *in_dev = __in_dev_get_rcu(dev);
1652 	struct flowi4	fl4;
1653 	unsigned int	flags = 0;
1654 	u32		itag = 0;
1655 	struct rtable	*rth;
1656 	int		err = -EINVAL;
1657 	struct net    *net = dev_net(dev);
1658 	bool do_cache;
1659 
1660 	/* IP on this device is disabled. */
1661 
1662 	if (!in_dev)
1663 		goto out;
1664 
1665 	/* Check for the most weird martians, which can be not detected
1666 	   by fib_lookup.
1667 	 */
1668 
1669 	if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
1670 		goto martian_source;
1671 
1672 	res.fi = NULL;
1673 	if (ipv4_is_lbcast(daddr) || (saddr == 0 && daddr == 0))
1674 		goto brd_input;
1675 
1676 	/* Accept zero addresses only to limited broadcast;
1677 	 * I even do not know to fix it or not. Waiting for complains :-)
1678 	 */
1679 	if (ipv4_is_zeronet(saddr))
1680 		goto martian_source;
1681 
1682 	if (ipv4_is_zeronet(daddr))
1683 		goto martian_destination;
1684 
1685 	/* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
1686 	 * and call it once if daddr or/and saddr are loopback addresses
1687 	 */
1688 	if (ipv4_is_loopback(daddr)) {
1689 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1690 			goto martian_destination;
1691 	} else if (ipv4_is_loopback(saddr)) {
1692 		if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1693 			goto martian_source;
1694 	}
1695 
1696 	/*
1697 	 *	Now we are ready to route packet.
1698 	 */
1699 	fl4.flowi4_oif = 0;
1700 	fl4.flowi4_iif = dev->ifindex;
1701 	fl4.flowi4_mark = skb->mark;
1702 	fl4.flowi4_tos = tos;
1703 	fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
1704 	fl4.daddr = daddr;
1705 	fl4.saddr = saddr;
1706 	err = fib_lookup(net, &fl4, &res);
1707 	if (err != 0) {
1708 		if (!IN_DEV_FORWARD(in_dev))
1709 			err = -EHOSTUNREACH;
1710 		goto no_route;
1711 	}
1712 
1713 	if (res.type == RTN_BROADCAST)
1714 		goto brd_input;
1715 
1716 	if (res.type == RTN_LOCAL) {
1717 		err = fib_validate_source(skb, saddr, daddr, tos,
1718 					  0, dev, in_dev, &itag);
1719 		if (err < 0)
1720 			goto martian_source_keep_err;
1721 		goto local_input;
1722 	}
1723 
1724 	if (!IN_DEV_FORWARD(in_dev)) {
1725 		err = -EHOSTUNREACH;
1726 		goto no_route;
1727 	}
1728 	if (res.type != RTN_UNICAST)
1729 		goto martian_destination;
1730 
1731 	err = ip_mkroute_input(skb, &res, &fl4, in_dev, daddr, saddr, tos);
1732 out:	return err;
1733 
1734 brd_input:
1735 	if (skb->protocol != htons(ETH_P_IP))
1736 		goto e_inval;
1737 
1738 	if (!ipv4_is_zeronet(saddr)) {
1739 		err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1740 					  in_dev, &itag);
1741 		if (err < 0)
1742 			goto martian_source_keep_err;
1743 	}
1744 	flags |= RTCF_BROADCAST;
1745 	res.type = RTN_BROADCAST;
1746 	RT_CACHE_STAT_INC(in_brd);
1747 
1748 local_input:
1749 	do_cache = false;
1750 	if (res.fi) {
1751 		if (!itag) {
1752 			rth = rcu_dereference(FIB_RES_NH(res).nh_rth_input);
1753 			if (rt_cache_valid(rth)) {
1754 				skb_dst_set_noref(skb, &rth->dst);
1755 				err = 0;
1756 				goto out;
1757 			}
1758 			do_cache = true;
1759 		}
1760 	}
1761 
1762 	rth = rt_dst_alloc(net->loopback_dev,
1763 			   IN_DEV_CONF_GET(in_dev, NOPOLICY), false, do_cache);
1764 	if (!rth)
1765 		goto e_nobufs;
1766 
1767 	rth->dst.input= ip_local_deliver;
1768 	rth->dst.output= ip_rt_bug;
1769 #ifdef CONFIG_IP_ROUTE_CLASSID
1770 	rth->dst.tclassid = itag;
1771 #endif
1772 
1773 	rth->rt_genid = rt_genid_ipv4(net);
1774 	rth->rt_flags 	= flags|RTCF_LOCAL;
1775 	rth->rt_type	= res.type;
1776 	rth->rt_is_input = 1;
1777 	rth->rt_iif	= 0;
1778 	rth->rt_pmtu	= 0;
1779 	rth->rt_gateway	= 0;
1780 	rth->rt_uses_gateway = 0;
1781 	INIT_LIST_HEAD(&rth->rt_uncached);
1782 	RT_CACHE_STAT_INC(in_slow_tot);
1783 	if (res.type == RTN_UNREACHABLE) {
1784 		rth->dst.input= ip_error;
1785 		rth->dst.error= -err;
1786 		rth->rt_flags 	&= ~RTCF_LOCAL;
1787 	}
1788 	if (do_cache) {
1789 		if (unlikely(!rt_cache_route(&FIB_RES_NH(res), rth))) {
1790 			rth->dst.flags |= DST_NOCACHE;
1791 			rt_add_uncached_list(rth);
1792 		}
1793 	}
1794 	skb_dst_set(skb, &rth->dst);
1795 	err = 0;
1796 	goto out;
1797 
1798 no_route:
1799 	RT_CACHE_STAT_INC(in_no_route);
1800 	res.type = RTN_UNREACHABLE;
1801 	goto local_input;
1802 
1803 	/*
1804 	 *	Do not cache martian addresses: they should be logged (RFC1812)
1805 	 */
1806 martian_destination:
1807 	RT_CACHE_STAT_INC(in_martian_dst);
1808 #ifdef CONFIG_IP_ROUTE_VERBOSE
1809 	if (IN_DEV_LOG_MARTIANS(in_dev))
1810 		net_warn_ratelimited("martian destination %pI4 from %pI4, dev %s\n",
1811 				     &daddr, &saddr, dev->name);
1812 #endif
1813 
1814 e_inval:
1815 	err = -EINVAL;
1816 	goto out;
1817 
1818 e_nobufs:
1819 	err = -ENOBUFS;
1820 	goto out;
1821 
1822 martian_source:
1823 	err = -EINVAL;
1824 martian_source_keep_err:
1825 	ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
1826 	goto out;
1827 }
1828 
1829 int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1830 			 u8 tos, struct net_device *dev)
1831 {
1832 	int res;
1833 
1834 	rcu_read_lock();
1835 
1836 	/* Multicast recognition logic is moved from route cache to here.
1837 	   The problem was that too many Ethernet cards have broken/missing
1838 	   hardware multicast filters :-( As result the host on multicasting
1839 	   network acquires a lot of useless route cache entries, sort of
1840 	   SDR messages from all the world. Now we try to get rid of them.
1841 	   Really, provided software IP multicast filter is organized
1842 	   reasonably (at least, hashed), it does not result in a slowdown
1843 	   comparing with route cache reject entries.
1844 	   Note, that multicast routers are not affected, because
1845 	   route cache entry is created eventually.
1846 	 */
1847 	if (ipv4_is_multicast(daddr)) {
1848 		struct in_device *in_dev = __in_dev_get_rcu(dev);
1849 
1850 		if (in_dev) {
1851 			int our = ip_check_mc_rcu(in_dev, daddr, saddr,
1852 						  ip_hdr(skb)->protocol);
1853 			if (our
1854 #ifdef CONFIG_IP_MROUTE
1855 				||
1856 			    (!ipv4_is_local_multicast(daddr) &&
1857 			     IN_DEV_MFORWARD(in_dev))
1858 #endif
1859 			   ) {
1860 				int res = ip_route_input_mc(skb, daddr, saddr,
1861 							    tos, dev, our);
1862 				rcu_read_unlock();
1863 				return res;
1864 			}
1865 		}
1866 		rcu_read_unlock();
1867 		return -EINVAL;
1868 	}
1869 	res = ip_route_input_slow(skb, daddr, saddr, tos, dev);
1870 	rcu_read_unlock();
1871 	return res;
1872 }
1873 EXPORT_SYMBOL(ip_route_input_noref);
1874 
1875 /* called with rcu_read_lock() */
1876 static struct rtable *__mkroute_output(const struct fib_result *res,
1877 				       const struct flowi4 *fl4, int orig_oif,
1878 				       struct net_device *dev_out,
1879 				       unsigned int flags)
1880 {
1881 	struct fib_info *fi = res->fi;
1882 	struct fib_nh_exception *fnhe;
1883 	struct in_device *in_dev;
1884 	u16 type = res->type;
1885 	struct rtable *rth;
1886 	bool do_cache;
1887 
1888 	in_dev = __in_dev_get_rcu(dev_out);
1889 	if (!in_dev)
1890 		return ERR_PTR(-EINVAL);
1891 
1892 	if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
1893 		if (ipv4_is_loopback(fl4->saddr) && !(dev_out->flags & IFF_LOOPBACK))
1894 			return ERR_PTR(-EINVAL);
1895 
1896 	if (ipv4_is_lbcast(fl4->daddr))
1897 		type = RTN_BROADCAST;
1898 	else if (ipv4_is_multicast(fl4->daddr))
1899 		type = RTN_MULTICAST;
1900 	else if (ipv4_is_zeronet(fl4->daddr))
1901 		return ERR_PTR(-EINVAL);
1902 
1903 	if (dev_out->flags & IFF_LOOPBACK)
1904 		flags |= RTCF_LOCAL;
1905 
1906 	do_cache = true;
1907 	if (type == RTN_BROADCAST) {
1908 		flags |= RTCF_BROADCAST | RTCF_LOCAL;
1909 		fi = NULL;
1910 	} else if (type == RTN_MULTICAST) {
1911 		flags |= RTCF_MULTICAST | RTCF_LOCAL;
1912 		if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
1913 				     fl4->flowi4_proto))
1914 			flags &= ~RTCF_LOCAL;
1915 		else
1916 			do_cache = false;
1917 		/* If multicast route do not exist use
1918 		 * default one, but do not gateway in this case.
1919 		 * Yes, it is hack.
1920 		 */
1921 		if (fi && res->prefixlen < 4)
1922 			fi = NULL;
1923 	}
1924 
1925 	fnhe = NULL;
1926 	do_cache &= fi != NULL;
1927 	if (do_cache) {
1928 		struct rtable __rcu **prth;
1929 		struct fib_nh *nh = &FIB_RES_NH(*res);
1930 
1931 		fnhe = find_exception(nh, fl4->daddr);
1932 		if (fnhe)
1933 			prth = &fnhe->fnhe_rth_output;
1934 		else {
1935 			if (unlikely(fl4->flowi4_flags &
1936 				     FLOWI_FLAG_KNOWN_NH &&
1937 				     !(nh->nh_gw &&
1938 				       nh->nh_scope == RT_SCOPE_LINK))) {
1939 				do_cache = false;
1940 				goto add;
1941 			}
1942 			prth = __this_cpu_ptr(nh->nh_pcpu_rth_output);
1943 		}
1944 		rth = rcu_dereference(*prth);
1945 		if (rt_cache_valid(rth)) {
1946 			dst_hold(&rth->dst);
1947 			return rth;
1948 		}
1949 	}
1950 
1951 add:
1952 	rth = rt_dst_alloc(dev_out,
1953 			   IN_DEV_CONF_GET(in_dev, NOPOLICY),
1954 			   IN_DEV_CONF_GET(in_dev, NOXFRM),
1955 			   do_cache);
1956 	if (!rth)
1957 		return ERR_PTR(-ENOBUFS);
1958 
1959 	rth->dst.output = ip_output;
1960 
1961 	rth->rt_genid = rt_genid_ipv4(dev_net(dev_out));
1962 	rth->rt_flags	= flags;
1963 	rth->rt_type	= type;
1964 	rth->rt_is_input = 0;
1965 	rth->rt_iif	= orig_oif ? : 0;
1966 	rth->rt_pmtu	= 0;
1967 	rth->rt_gateway = 0;
1968 	rth->rt_uses_gateway = 0;
1969 	INIT_LIST_HEAD(&rth->rt_uncached);
1970 
1971 	RT_CACHE_STAT_INC(out_slow_tot);
1972 
1973 	if (flags & RTCF_LOCAL)
1974 		rth->dst.input = ip_local_deliver;
1975 	if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
1976 		if (flags & RTCF_LOCAL &&
1977 		    !(dev_out->flags & IFF_LOOPBACK)) {
1978 			rth->dst.output = ip_mc_output;
1979 			RT_CACHE_STAT_INC(out_slow_mc);
1980 		}
1981 #ifdef CONFIG_IP_MROUTE
1982 		if (type == RTN_MULTICAST) {
1983 			if (IN_DEV_MFORWARD(in_dev) &&
1984 			    !ipv4_is_local_multicast(fl4->daddr)) {
1985 				rth->dst.input = ip_mr_input;
1986 				rth->dst.output = ip_mc_output;
1987 			}
1988 		}
1989 #endif
1990 	}
1991 
1992 	rt_set_nexthop(rth, fl4->daddr, res, fnhe, fi, type, 0);
1993 
1994 	return rth;
1995 }
1996 
1997 /*
1998  * Major route resolver routine.
1999  */
2000 
2001 struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4)
2002 {
2003 	struct net_device *dev_out = NULL;
2004 	__u8 tos = RT_FL_TOS(fl4);
2005 	unsigned int flags = 0;
2006 	struct fib_result res;
2007 	struct rtable *rth;
2008 	int orig_oif;
2009 
2010 	res.tclassid	= 0;
2011 	res.fi		= NULL;
2012 	res.table	= NULL;
2013 
2014 	orig_oif = fl4->flowi4_oif;
2015 
2016 	fl4->flowi4_iif = LOOPBACK_IFINDEX;
2017 	fl4->flowi4_tos = tos & IPTOS_RT_MASK;
2018 	fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
2019 			 RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
2020 
2021 	rcu_read_lock();
2022 	if (fl4->saddr) {
2023 		rth = ERR_PTR(-EINVAL);
2024 		if (ipv4_is_multicast(fl4->saddr) ||
2025 		    ipv4_is_lbcast(fl4->saddr) ||
2026 		    ipv4_is_zeronet(fl4->saddr))
2027 			goto out;
2028 
2029 		/* I removed check for oif == dev_out->oif here.
2030 		   It was wrong for two reasons:
2031 		   1. ip_dev_find(net, saddr) can return wrong iface, if saddr
2032 		      is assigned to multiple interfaces.
2033 		   2. Moreover, we are allowed to send packets with saddr
2034 		      of another iface. --ANK
2035 		 */
2036 
2037 		if (fl4->flowi4_oif == 0 &&
2038 		    (ipv4_is_multicast(fl4->daddr) ||
2039 		     ipv4_is_lbcast(fl4->daddr))) {
2040 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2041 			dev_out = __ip_dev_find(net, fl4->saddr, false);
2042 			if (dev_out == NULL)
2043 				goto out;
2044 
2045 			/* Special hack: user can direct multicasts
2046 			   and limited broadcast via necessary interface
2047 			   without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
2048 			   This hack is not just for fun, it allows
2049 			   vic,vat and friends to work.
2050 			   They bind socket to loopback, set ttl to zero
2051 			   and expect that it will work.
2052 			   From the viewpoint of routing cache they are broken,
2053 			   because we are not allowed to build multicast path
2054 			   with loopback source addr (look, routing cache
2055 			   cannot know, that ttl is zero, so that packet
2056 			   will not leave this host and route is valid).
2057 			   Luckily, this hack is good workaround.
2058 			 */
2059 
2060 			fl4->flowi4_oif = dev_out->ifindex;
2061 			goto make_route;
2062 		}
2063 
2064 		if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
2065 			/* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2066 			if (!__ip_dev_find(net, fl4->saddr, false))
2067 				goto out;
2068 		}
2069 	}
2070 
2071 
2072 	if (fl4->flowi4_oif) {
2073 		dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
2074 		rth = ERR_PTR(-ENODEV);
2075 		if (dev_out == NULL)
2076 			goto out;
2077 
2078 		/* RACE: Check return value of inet_select_addr instead. */
2079 		if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
2080 			rth = ERR_PTR(-ENETUNREACH);
2081 			goto out;
2082 		}
2083 		if (ipv4_is_local_multicast(fl4->daddr) ||
2084 		    ipv4_is_lbcast(fl4->daddr)) {
2085 			if (!fl4->saddr)
2086 				fl4->saddr = inet_select_addr(dev_out, 0,
2087 							      RT_SCOPE_LINK);
2088 			goto make_route;
2089 		}
2090 		if (!fl4->saddr) {
2091 			if (ipv4_is_multicast(fl4->daddr))
2092 				fl4->saddr = inet_select_addr(dev_out, 0,
2093 							      fl4->flowi4_scope);
2094 			else if (!fl4->daddr)
2095 				fl4->saddr = inet_select_addr(dev_out, 0,
2096 							      RT_SCOPE_HOST);
2097 		}
2098 	}
2099 
2100 	if (!fl4->daddr) {
2101 		fl4->daddr = fl4->saddr;
2102 		if (!fl4->daddr)
2103 			fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
2104 		dev_out = net->loopback_dev;
2105 		fl4->flowi4_oif = LOOPBACK_IFINDEX;
2106 		res.type = RTN_LOCAL;
2107 		flags |= RTCF_LOCAL;
2108 		goto make_route;
2109 	}
2110 
2111 	if (fib_lookup(net, fl4, &res)) {
2112 		res.fi = NULL;
2113 		res.table = NULL;
2114 		if (fl4->flowi4_oif) {
2115 			/* Apparently, routing tables are wrong. Assume,
2116 			   that the destination is on link.
2117 
2118 			   WHY? DW.
2119 			   Because we are allowed to send to iface
2120 			   even if it has NO routes and NO assigned
2121 			   addresses. When oif is specified, routing
2122 			   tables are looked up with only one purpose:
2123 			   to catch if destination is gatewayed, rather than
2124 			   direct. Moreover, if MSG_DONTROUTE is set,
2125 			   we send packet, ignoring both routing tables
2126 			   and ifaddr state. --ANK
2127 
2128 
2129 			   We could make it even if oif is unknown,
2130 			   likely IPv6, but we do not.
2131 			 */
2132 
2133 			if (fl4->saddr == 0)
2134 				fl4->saddr = inet_select_addr(dev_out, 0,
2135 							      RT_SCOPE_LINK);
2136 			res.type = RTN_UNICAST;
2137 			goto make_route;
2138 		}
2139 		rth = ERR_PTR(-ENETUNREACH);
2140 		goto out;
2141 	}
2142 
2143 	if (res.type == RTN_LOCAL) {
2144 		if (!fl4->saddr) {
2145 			if (res.fi->fib_prefsrc)
2146 				fl4->saddr = res.fi->fib_prefsrc;
2147 			else
2148 				fl4->saddr = fl4->daddr;
2149 		}
2150 		dev_out = net->loopback_dev;
2151 		fl4->flowi4_oif = dev_out->ifindex;
2152 		flags |= RTCF_LOCAL;
2153 		goto make_route;
2154 	}
2155 
2156 #ifdef CONFIG_IP_ROUTE_MULTIPATH
2157 	if (res.fi->fib_nhs > 1 && fl4->flowi4_oif == 0)
2158 		fib_select_multipath(&res);
2159 	else
2160 #endif
2161 	if (!res.prefixlen &&
2162 	    res.table->tb_num_default > 1 &&
2163 	    res.type == RTN_UNICAST && !fl4->flowi4_oif)
2164 		fib_select_default(&res);
2165 
2166 	if (!fl4->saddr)
2167 		fl4->saddr = FIB_RES_PREFSRC(net, res);
2168 
2169 	dev_out = FIB_RES_DEV(res);
2170 	fl4->flowi4_oif = dev_out->ifindex;
2171 
2172 
2173 make_route:
2174 	rth = __mkroute_output(&res, fl4, orig_oif, dev_out, flags);
2175 
2176 out:
2177 	rcu_read_unlock();
2178 	return rth;
2179 }
2180 EXPORT_SYMBOL_GPL(__ip_route_output_key);
2181 
2182 static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
2183 {
2184 	return NULL;
2185 }
2186 
2187 static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
2188 {
2189 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
2190 
2191 	return mtu ? : dst->dev->mtu;
2192 }
2193 
2194 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
2195 					  struct sk_buff *skb, u32 mtu)
2196 {
2197 }
2198 
2199 static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
2200 				       struct sk_buff *skb)
2201 {
2202 }
2203 
2204 static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
2205 					  unsigned long old)
2206 {
2207 	return NULL;
2208 }
2209 
2210 static struct dst_ops ipv4_dst_blackhole_ops = {
2211 	.family			=	AF_INET,
2212 	.protocol		=	cpu_to_be16(ETH_P_IP),
2213 	.check			=	ipv4_blackhole_dst_check,
2214 	.mtu			=	ipv4_blackhole_mtu,
2215 	.default_advmss		=	ipv4_default_advmss,
2216 	.update_pmtu		=	ipv4_rt_blackhole_update_pmtu,
2217 	.redirect		=	ipv4_rt_blackhole_redirect,
2218 	.cow_metrics		=	ipv4_rt_blackhole_cow_metrics,
2219 	.neigh_lookup		=	ipv4_neigh_lookup,
2220 };
2221 
2222 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
2223 {
2224 	struct rtable *ort = (struct rtable *) dst_orig;
2225 	struct rtable *rt;
2226 
2227 	rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, 0);
2228 	if (rt) {
2229 		struct dst_entry *new = &rt->dst;
2230 
2231 		new->__use = 1;
2232 		new->input = dst_discard;
2233 		new->output = dst_discard_sk;
2234 
2235 		new->dev = ort->dst.dev;
2236 		if (new->dev)
2237 			dev_hold(new->dev);
2238 
2239 		rt->rt_is_input = ort->rt_is_input;
2240 		rt->rt_iif = ort->rt_iif;
2241 		rt->rt_pmtu = ort->rt_pmtu;
2242 
2243 		rt->rt_genid = rt_genid_ipv4(net);
2244 		rt->rt_flags = ort->rt_flags;
2245 		rt->rt_type = ort->rt_type;
2246 		rt->rt_gateway = ort->rt_gateway;
2247 		rt->rt_uses_gateway = ort->rt_uses_gateway;
2248 
2249 		INIT_LIST_HEAD(&rt->rt_uncached);
2250 
2251 		dst_free(new);
2252 	}
2253 
2254 	dst_release(dst_orig);
2255 
2256 	return rt ? &rt->dst : ERR_PTR(-ENOMEM);
2257 }
2258 
2259 struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
2260 				    struct sock *sk)
2261 {
2262 	struct rtable *rt = __ip_route_output_key(net, flp4);
2263 
2264 	if (IS_ERR(rt))
2265 		return rt;
2266 
2267 	if (flp4->flowi4_proto)
2268 		rt = (struct rtable *) xfrm_lookup(net, &rt->dst,
2269 						   flowi4_to_flowi(flp4),
2270 						   sk, 0);
2271 
2272 	return rt;
2273 }
2274 EXPORT_SYMBOL_GPL(ip_route_output_flow);
2275 
2276 static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
2277 			struct flowi4 *fl4, struct sk_buff *skb, u32 portid,
2278 			u32 seq, int event, int nowait, unsigned int flags)
2279 {
2280 	struct rtable *rt = skb_rtable(skb);
2281 	struct rtmsg *r;
2282 	struct nlmsghdr *nlh;
2283 	unsigned long expires = 0;
2284 	u32 error;
2285 	u32 metrics[RTAX_MAX];
2286 
2287 	nlh = nlmsg_put(skb, portid, seq, event, sizeof(*r), flags);
2288 	if (nlh == NULL)
2289 		return -EMSGSIZE;
2290 
2291 	r = nlmsg_data(nlh);
2292 	r->rtm_family	 = AF_INET;
2293 	r->rtm_dst_len	= 32;
2294 	r->rtm_src_len	= 0;
2295 	r->rtm_tos	= fl4->flowi4_tos;
2296 	r->rtm_table	= RT_TABLE_MAIN;
2297 	if (nla_put_u32(skb, RTA_TABLE, RT_TABLE_MAIN))
2298 		goto nla_put_failure;
2299 	r->rtm_type	= rt->rt_type;
2300 	r->rtm_scope	= RT_SCOPE_UNIVERSE;
2301 	r->rtm_protocol = RTPROT_UNSPEC;
2302 	r->rtm_flags	= (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
2303 	if (rt->rt_flags & RTCF_NOTIFY)
2304 		r->rtm_flags |= RTM_F_NOTIFY;
2305 
2306 	if (nla_put_be32(skb, RTA_DST, dst))
2307 		goto nla_put_failure;
2308 	if (src) {
2309 		r->rtm_src_len = 32;
2310 		if (nla_put_be32(skb, RTA_SRC, src))
2311 			goto nla_put_failure;
2312 	}
2313 	if (rt->dst.dev &&
2314 	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
2315 		goto nla_put_failure;
2316 #ifdef CONFIG_IP_ROUTE_CLASSID
2317 	if (rt->dst.tclassid &&
2318 	    nla_put_u32(skb, RTA_FLOW, rt->dst.tclassid))
2319 		goto nla_put_failure;
2320 #endif
2321 	if (!rt_is_input_route(rt) &&
2322 	    fl4->saddr != src) {
2323 		if (nla_put_be32(skb, RTA_PREFSRC, fl4->saddr))
2324 			goto nla_put_failure;
2325 	}
2326 	if (rt->rt_uses_gateway &&
2327 	    nla_put_be32(skb, RTA_GATEWAY, rt->rt_gateway))
2328 		goto nla_put_failure;
2329 
2330 	expires = rt->dst.expires;
2331 	if (expires) {
2332 		unsigned long now = jiffies;
2333 
2334 		if (time_before(now, expires))
2335 			expires -= now;
2336 		else
2337 			expires = 0;
2338 	}
2339 
2340 	memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
2341 	if (rt->rt_pmtu && expires)
2342 		metrics[RTAX_MTU - 1] = rt->rt_pmtu;
2343 	if (rtnetlink_put_metrics(skb, metrics) < 0)
2344 		goto nla_put_failure;
2345 
2346 	if (fl4->flowi4_mark &&
2347 	    nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
2348 		goto nla_put_failure;
2349 
2350 	error = rt->dst.error;
2351 
2352 	if (rt_is_input_route(rt)) {
2353 #ifdef CONFIG_IP_MROUTE
2354 		if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
2355 		    IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
2356 			int err = ipmr_get_route(net, skb,
2357 						 fl4->saddr, fl4->daddr,
2358 						 r, nowait);
2359 			if (err <= 0) {
2360 				if (!nowait) {
2361 					if (err == 0)
2362 						return 0;
2363 					goto nla_put_failure;
2364 				} else {
2365 					if (err == -EMSGSIZE)
2366 						goto nla_put_failure;
2367 					error = err;
2368 				}
2369 			}
2370 		} else
2371 #endif
2372 			if (nla_put_u32(skb, RTA_IIF, skb->dev->ifindex))
2373 				goto nla_put_failure;
2374 	}
2375 
2376 	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, error) < 0)
2377 		goto nla_put_failure;
2378 
2379 	return nlmsg_end(skb, nlh);
2380 
2381 nla_put_failure:
2382 	nlmsg_cancel(skb, nlh);
2383 	return -EMSGSIZE;
2384 }
2385 
2386 static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
2387 {
2388 	struct net *net = sock_net(in_skb->sk);
2389 	struct rtmsg *rtm;
2390 	struct nlattr *tb[RTA_MAX+1];
2391 	struct rtable *rt = NULL;
2392 	struct flowi4 fl4;
2393 	__be32 dst = 0;
2394 	__be32 src = 0;
2395 	u32 iif;
2396 	int err;
2397 	int mark;
2398 	struct sk_buff *skb;
2399 
2400 	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv4_policy);
2401 	if (err < 0)
2402 		goto errout;
2403 
2404 	rtm = nlmsg_data(nlh);
2405 
2406 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2407 	if (skb == NULL) {
2408 		err = -ENOBUFS;
2409 		goto errout;
2410 	}
2411 
2412 	/* Reserve room for dummy headers, this skb can pass
2413 	   through good chunk of routing engine.
2414 	 */
2415 	skb_reset_mac_header(skb);
2416 	skb_reset_network_header(skb);
2417 
2418 	/* Bugfix: need to give ip_route_input enough of an IP header to not gag. */
2419 	ip_hdr(skb)->protocol = IPPROTO_ICMP;
2420 	skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr));
2421 
2422 	src = tb[RTA_SRC] ? nla_get_be32(tb[RTA_SRC]) : 0;
2423 	dst = tb[RTA_DST] ? nla_get_be32(tb[RTA_DST]) : 0;
2424 	iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
2425 	mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
2426 
2427 	memset(&fl4, 0, sizeof(fl4));
2428 	fl4.daddr = dst;
2429 	fl4.saddr = src;
2430 	fl4.flowi4_tos = rtm->rtm_tos;
2431 	fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
2432 	fl4.flowi4_mark = mark;
2433 
2434 	if (iif) {
2435 		struct net_device *dev;
2436 
2437 		dev = __dev_get_by_index(net, iif);
2438 		if (dev == NULL) {
2439 			err = -ENODEV;
2440 			goto errout_free;
2441 		}
2442 
2443 		skb->protocol	= htons(ETH_P_IP);
2444 		skb->dev	= dev;
2445 		skb->mark	= mark;
2446 		local_bh_disable();
2447 		err = ip_route_input(skb, dst, src, rtm->rtm_tos, dev);
2448 		local_bh_enable();
2449 
2450 		rt = skb_rtable(skb);
2451 		if (err == 0 && rt->dst.error)
2452 			err = -rt->dst.error;
2453 	} else {
2454 		rt = ip_route_output_key(net, &fl4);
2455 
2456 		err = 0;
2457 		if (IS_ERR(rt))
2458 			err = PTR_ERR(rt);
2459 	}
2460 
2461 	if (err)
2462 		goto errout_free;
2463 
2464 	skb_dst_set(skb, &rt->dst);
2465 	if (rtm->rtm_flags & RTM_F_NOTIFY)
2466 		rt->rt_flags |= RTCF_NOTIFY;
2467 
2468 	err = rt_fill_info(net, dst, src, &fl4, skb,
2469 			   NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
2470 			   RTM_NEWROUTE, 0, 0);
2471 	if (err <= 0)
2472 		goto errout_free;
2473 
2474 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2475 errout:
2476 	return err;
2477 
2478 errout_free:
2479 	kfree_skb(skb);
2480 	goto errout;
2481 }
2482 
2483 void ip_rt_multicast_event(struct in_device *in_dev)
2484 {
2485 	rt_cache_flush(dev_net(in_dev->dev));
2486 }
2487 
2488 #ifdef CONFIG_SYSCTL
2489 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
2490 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
2491 static int ip_rt_gc_min_interval __read_mostly	= HZ / 2;
2492 static int ip_rt_gc_elasticity __read_mostly	= 8;
2493 
2494 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
2495 					void __user *buffer,
2496 					size_t *lenp, loff_t *ppos)
2497 {
2498 	struct net *net = (struct net *)__ctl->extra1;
2499 
2500 	if (write) {
2501 		rt_cache_flush(net);
2502 		fnhe_genid_bump(net);
2503 		return 0;
2504 	}
2505 
2506 	return -EINVAL;
2507 }
2508 
2509 static struct ctl_table ipv4_route_table[] = {
2510 	{
2511 		.procname	= "gc_thresh",
2512 		.data		= &ipv4_dst_ops.gc_thresh,
2513 		.maxlen		= sizeof(int),
2514 		.mode		= 0644,
2515 		.proc_handler	= proc_dointvec,
2516 	},
2517 	{
2518 		.procname	= "max_size",
2519 		.data		= &ip_rt_max_size,
2520 		.maxlen		= sizeof(int),
2521 		.mode		= 0644,
2522 		.proc_handler	= proc_dointvec,
2523 	},
2524 	{
2525 		/*  Deprecated. Use gc_min_interval_ms */
2526 
2527 		.procname	= "gc_min_interval",
2528 		.data		= &ip_rt_gc_min_interval,
2529 		.maxlen		= sizeof(int),
2530 		.mode		= 0644,
2531 		.proc_handler	= proc_dointvec_jiffies,
2532 	},
2533 	{
2534 		.procname	= "gc_min_interval_ms",
2535 		.data		= &ip_rt_gc_min_interval,
2536 		.maxlen		= sizeof(int),
2537 		.mode		= 0644,
2538 		.proc_handler	= proc_dointvec_ms_jiffies,
2539 	},
2540 	{
2541 		.procname	= "gc_timeout",
2542 		.data		= &ip_rt_gc_timeout,
2543 		.maxlen		= sizeof(int),
2544 		.mode		= 0644,
2545 		.proc_handler	= proc_dointvec_jiffies,
2546 	},
2547 	{
2548 		.procname	= "gc_interval",
2549 		.data		= &ip_rt_gc_interval,
2550 		.maxlen		= sizeof(int),
2551 		.mode		= 0644,
2552 		.proc_handler	= proc_dointvec_jiffies,
2553 	},
2554 	{
2555 		.procname	= "redirect_load",
2556 		.data		= &ip_rt_redirect_load,
2557 		.maxlen		= sizeof(int),
2558 		.mode		= 0644,
2559 		.proc_handler	= proc_dointvec,
2560 	},
2561 	{
2562 		.procname	= "redirect_number",
2563 		.data		= &ip_rt_redirect_number,
2564 		.maxlen		= sizeof(int),
2565 		.mode		= 0644,
2566 		.proc_handler	= proc_dointvec,
2567 	},
2568 	{
2569 		.procname	= "redirect_silence",
2570 		.data		= &ip_rt_redirect_silence,
2571 		.maxlen		= sizeof(int),
2572 		.mode		= 0644,
2573 		.proc_handler	= proc_dointvec,
2574 	},
2575 	{
2576 		.procname	= "error_cost",
2577 		.data		= &ip_rt_error_cost,
2578 		.maxlen		= sizeof(int),
2579 		.mode		= 0644,
2580 		.proc_handler	= proc_dointvec,
2581 	},
2582 	{
2583 		.procname	= "error_burst",
2584 		.data		= &ip_rt_error_burst,
2585 		.maxlen		= sizeof(int),
2586 		.mode		= 0644,
2587 		.proc_handler	= proc_dointvec,
2588 	},
2589 	{
2590 		.procname	= "gc_elasticity",
2591 		.data		= &ip_rt_gc_elasticity,
2592 		.maxlen		= sizeof(int),
2593 		.mode		= 0644,
2594 		.proc_handler	= proc_dointvec,
2595 	},
2596 	{
2597 		.procname	= "mtu_expires",
2598 		.data		= &ip_rt_mtu_expires,
2599 		.maxlen		= sizeof(int),
2600 		.mode		= 0644,
2601 		.proc_handler	= proc_dointvec_jiffies,
2602 	},
2603 	{
2604 		.procname	= "min_pmtu",
2605 		.data		= &ip_rt_min_pmtu,
2606 		.maxlen		= sizeof(int),
2607 		.mode		= 0644,
2608 		.proc_handler	= proc_dointvec,
2609 	},
2610 	{
2611 		.procname	= "min_adv_mss",
2612 		.data		= &ip_rt_min_advmss,
2613 		.maxlen		= sizeof(int),
2614 		.mode		= 0644,
2615 		.proc_handler	= proc_dointvec,
2616 	},
2617 	{ }
2618 };
2619 
2620 static struct ctl_table ipv4_route_flush_table[] = {
2621 	{
2622 		.procname	= "flush",
2623 		.maxlen		= sizeof(int),
2624 		.mode		= 0200,
2625 		.proc_handler	= ipv4_sysctl_rtcache_flush,
2626 	},
2627 	{ },
2628 };
2629 
2630 static __net_init int sysctl_route_net_init(struct net *net)
2631 {
2632 	struct ctl_table *tbl;
2633 
2634 	tbl = ipv4_route_flush_table;
2635 	if (!net_eq(net, &init_net)) {
2636 		tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
2637 		if (tbl == NULL)
2638 			goto err_dup;
2639 
2640 		/* Don't export sysctls to unprivileged users */
2641 		if (net->user_ns != &init_user_ns)
2642 			tbl[0].procname = NULL;
2643 	}
2644 	tbl[0].extra1 = net;
2645 
2646 	net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
2647 	if (net->ipv4.route_hdr == NULL)
2648 		goto err_reg;
2649 	return 0;
2650 
2651 err_reg:
2652 	if (tbl != ipv4_route_flush_table)
2653 		kfree(tbl);
2654 err_dup:
2655 	return -ENOMEM;
2656 }
2657 
2658 static __net_exit void sysctl_route_net_exit(struct net *net)
2659 {
2660 	struct ctl_table *tbl;
2661 
2662 	tbl = net->ipv4.route_hdr->ctl_table_arg;
2663 	unregister_net_sysctl_table(net->ipv4.route_hdr);
2664 	BUG_ON(tbl == ipv4_route_flush_table);
2665 	kfree(tbl);
2666 }
2667 
2668 static __net_initdata struct pernet_operations sysctl_route_ops = {
2669 	.init = sysctl_route_net_init,
2670 	.exit = sysctl_route_net_exit,
2671 };
2672 #endif
2673 
2674 static __net_init int rt_genid_init(struct net *net)
2675 {
2676 	atomic_set(&net->ipv4.rt_genid, 0);
2677 	atomic_set(&net->fnhe_genid, 0);
2678 	get_random_bytes(&net->ipv4.dev_addr_genid,
2679 			 sizeof(net->ipv4.dev_addr_genid));
2680 	return 0;
2681 }
2682 
2683 static __net_initdata struct pernet_operations rt_genid_ops = {
2684 	.init = rt_genid_init,
2685 };
2686 
2687 static int __net_init ipv4_inetpeer_init(struct net *net)
2688 {
2689 	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
2690 
2691 	if (!bp)
2692 		return -ENOMEM;
2693 	inet_peer_base_init(bp);
2694 	net->ipv4.peers = bp;
2695 	return 0;
2696 }
2697 
2698 static void __net_exit ipv4_inetpeer_exit(struct net *net)
2699 {
2700 	struct inet_peer_base *bp = net->ipv4.peers;
2701 
2702 	net->ipv4.peers = NULL;
2703 	inetpeer_invalidate_tree(bp);
2704 	kfree(bp);
2705 }
2706 
2707 static __net_initdata struct pernet_operations ipv4_inetpeer_ops = {
2708 	.init	=	ipv4_inetpeer_init,
2709 	.exit	=	ipv4_inetpeer_exit,
2710 };
2711 
2712 #ifdef CONFIG_IP_ROUTE_CLASSID
2713 struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
2714 #endif /* CONFIG_IP_ROUTE_CLASSID */
2715 
2716 int __init ip_rt_init(void)
2717 {
2718 	int rc = 0;
2719 
2720 	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
2721 	if (!ip_idents)
2722 		panic("IP: failed to allocate ip_idents\n");
2723 
2724 	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
2725 
2726 #ifdef CONFIG_IP_ROUTE_CLASSID
2727 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
2728 	if (!ip_rt_acct)
2729 		panic("IP: failed to allocate ip_rt_acct\n");
2730 #endif
2731 
2732 	ipv4_dst_ops.kmem_cachep =
2733 		kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
2734 				  SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
2735 
2736 	ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
2737 
2738 	if (dst_entries_init(&ipv4_dst_ops) < 0)
2739 		panic("IP: failed to allocate ipv4_dst_ops counter\n");
2740 
2741 	if (dst_entries_init(&ipv4_dst_blackhole_ops) < 0)
2742 		panic("IP: failed to allocate ipv4_dst_blackhole_ops counter\n");
2743 
2744 	ipv4_dst_ops.gc_thresh = ~0;
2745 	ip_rt_max_size = INT_MAX;
2746 
2747 	devinet_init();
2748 	ip_fib_init();
2749 
2750 	if (ip_rt_proc_init())
2751 		pr_err("Unable to create route proc files\n");
2752 #ifdef CONFIG_XFRM
2753 	xfrm_init();
2754 	xfrm4_init();
2755 #endif
2756 	rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL, NULL);
2757 
2758 #ifdef CONFIG_SYSCTL
2759 	register_pernet_subsys(&sysctl_route_ops);
2760 #endif
2761 	register_pernet_subsys(&rt_genid_ops);
2762 	register_pernet_subsys(&ipv4_inetpeer_ops);
2763 	return rc;
2764 }
2765 
2766 #ifdef CONFIG_SYSCTL
2767 /*
2768  * We really need to sanitize the damn ipv4 init order, then all
2769  * this nonsense will go away.
2770  */
2771 void __init ip_static_sysctl_init(void)
2772 {
2773 	register_net_sysctl(&init_net, "net/ipv4/route", ipv4_route_table);
2774 }
2775 #endif
2776