1 /* 2 * common UDP/RAW code 3 * Linux INET6 implementation 4 * 5 * Authors: 6 * Pedro Roque <roque@di.fc.ul.pt> 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License 10 * as published by the Free Software Foundation; either version 11 * 2 of the License, or (at your option) any later version. 12 */ 13 14 #include <linux/capability.h> 15 #include <linux/errno.h> 16 #include <linux/types.h> 17 #include <linux/kernel.h> 18 #include <linux/interrupt.h> 19 #include <linux/socket.h> 20 #include <linux/sockios.h> 21 #include <linux/in6.h> 22 #include <linux/ipv6.h> 23 #include <linux/route.h> 24 #include <linux/slab.h> 25 26 #include <net/ipv6.h> 27 #include <net/ndisc.h> 28 #include <net/addrconf.h> 29 #include <net/transp_v6.h> 30 #include <net/ip6_route.h> 31 #include <net/tcp_states.h> 32 33 #include <linux/errqueue.h> 34 #include <asm/uaccess.h> 35 36 int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) 37 { 38 struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr; 39 struct inet_sock *inet = inet_sk(sk); 40 struct ipv6_pinfo *np = inet6_sk(sk); 41 struct in6_addr *daddr, *final_p, final; 42 struct dst_entry *dst; 43 struct flowi6 fl6; 44 struct ip6_flowlabel *flowlabel = NULL; 45 struct ipv6_txoptions *opt; 46 int addr_type; 47 int err; 48 49 if (usin->sin6_family == AF_INET) { 50 if (__ipv6_only_sock(sk)) 51 return -EAFNOSUPPORT; 52 err = ip4_datagram_connect(sk, uaddr, addr_len); 53 goto ipv4_connected; 54 } 55 56 if (addr_len < SIN6_LEN_RFC2133) 57 return -EINVAL; 58 59 if (usin->sin6_family != AF_INET6) 60 return -EAFNOSUPPORT; 61 62 memset(&fl6, 0, sizeof(fl6)); 63 if (np->sndflow) { 64 fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK; 65 if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) { 66 flowlabel = fl6_sock_lookup(sk, fl6.flowlabel); 67 if (flowlabel == NULL) 68 return -EINVAL; 69 ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst); 70 } 71 } 72 73 addr_type = ipv6_addr_type(&usin->sin6_addr); 74 75 if (addr_type == IPV6_ADDR_ANY) { 76 /* 77 * connect to self 78 */ 79 usin->sin6_addr.s6_addr[15] = 0x01; 80 } 81 82 daddr = &usin->sin6_addr; 83 84 if (addr_type == IPV6_ADDR_MAPPED) { 85 struct sockaddr_in sin; 86 87 if (__ipv6_only_sock(sk)) { 88 err = -ENETUNREACH; 89 goto out; 90 } 91 sin.sin_family = AF_INET; 92 sin.sin_addr.s_addr = daddr->s6_addr32[3]; 93 sin.sin_port = usin->sin6_port; 94 95 err = ip4_datagram_connect(sk, 96 (struct sockaddr*) &sin, 97 sizeof(sin)); 98 99 ipv4_connected: 100 if (err) 101 goto out; 102 103 ipv6_addr_set_v4mapped(inet->inet_daddr, &np->daddr); 104 105 if (ipv6_addr_any(&np->saddr)) 106 ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr); 107 108 if (ipv6_addr_any(&np->rcv_saddr)) { 109 ipv6_addr_set_v4mapped(inet->inet_rcv_saddr, 110 &np->rcv_saddr); 111 if (sk->sk_prot->rehash) 112 sk->sk_prot->rehash(sk); 113 } 114 115 goto out; 116 } 117 118 if (addr_type&IPV6_ADDR_LINKLOCAL) { 119 if (addr_len >= sizeof(struct sockaddr_in6) && 120 usin->sin6_scope_id) { 121 if (sk->sk_bound_dev_if && 122 sk->sk_bound_dev_if != usin->sin6_scope_id) { 123 err = -EINVAL; 124 goto out; 125 } 126 sk->sk_bound_dev_if = usin->sin6_scope_id; 127 } 128 129 if (!sk->sk_bound_dev_if && (addr_type & IPV6_ADDR_MULTICAST)) 130 sk->sk_bound_dev_if = np->mcast_oif; 131 132 /* Connect to link-local address requires an interface */ 133 if (!sk->sk_bound_dev_if) { 134 err = -EINVAL; 135 goto out; 136 } 137 } 138 139 ipv6_addr_copy(&np->daddr, daddr); 140 np->flow_label = fl6.flowlabel; 141 142 inet->inet_dport = usin->sin6_port; 143 144 /* 145 * Check for a route to destination an obtain the 146 * destination cache for it. 147 */ 148 149 fl6.flowi6_proto = sk->sk_protocol; 150 ipv6_addr_copy(&fl6.daddr, &np->daddr); 151 ipv6_addr_copy(&fl6.saddr, &np->saddr); 152 fl6.flowi6_oif = sk->sk_bound_dev_if; 153 fl6.flowi6_mark = sk->sk_mark; 154 fl6.fl6_dport = inet->inet_dport; 155 fl6.fl6_sport = inet->inet_sport; 156 157 if (!fl6.flowi6_oif && (addr_type&IPV6_ADDR_MULTICAST)) 158 fl6.flowi6_oif = np->mcast_oif; 159 160 security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); 161 162 opt = flowlabel ? flowlabel->opt : np->opt; 163 final_p = fl6_update_dst(&fl6, opt, &final); 164 165 dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true); 166 err = 0; 167 if (IS_ERR(dst)) { 168 err = PTR_ERR(dst); 169 goto out; 170 } 171 172 /* source address lookup done in ip6_dst_lookup */ 173 174 if (ipv6_addr_any(&np->saddr)) 175 ipv6_addr_copy(&np->saddr, &fl6.saddr); 176 177 if (ipv6_addr_any(&np->rcv_saddr)) { 178 ipv6_addr_copy(&np->rcv_saddr, &fl6.saddr); 179 inet->inet_rcv_saddr = LOOPBACK4_IPV6; 180 if (sk->sk_prot->rehash) 181 sk->sk_prot->rehash(sk); 182 } 183 184 ip6_dst_store(sk, dst, 185 ipv6_addr_equal(&fl6.daddr, &np->daddr) ? 186 &np->daddr : NULL, 187 #ifdef CONFIG_IPV6_SUBTREES 188 ipv6_addr_equal(&fl6.saddr, &np->saddr) ? 189 &np->saddr : 190 #endif 191 NULL); 192 193 sk->sk_state = TCP_ESTABLISHED; 194 out: 195 fl6_sock_release(flowlabel); 196 return err; 197 } 198 199 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, 200 __be16 port, u32 info, u8 *payload) 201 { 202 struct ipv6_pinfo *np = inet6_sk(sk); 203 struct icmp6hdr *icmph = icmp6_hdr(skb); 204 struct sock_exterr_skb *serr; 205 206 if (!np->recverr) 207 return; 208 209 skb = skb_clone(skb, GFP_ATOMIC); 210 if (!skb) 211 return; 212 213 skb->protocol = htons(ETH_P_IPV6); 214 215 serr = SKB_EXT_ERR(skb); 216 serr->ee.ee_errno = err; 217 serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6; 218 serr->ee.ee_type = icmph->icmp6_type; 219 serr->ee.ee_code = icmph->icmp6_code; 220 serr->ee.ee_pad = 0; 221 serr->ee.ee_info = info; 222 serr->ee.ee_data = 0; 223 serr->addr_offset = (u8 *)&(((struct ipv6hdr *)(icmph + 1))->daddr) - 224 skb_network_header(skb); 225 serr->port = port; 226 227 __skb_pull(skb, payload - skb->data); 228 skb_reset_transport_header(skb); 229 230 if (sock_queue_err_skb(sk, skb)) 231 kfree_skb(skb); 232 } 233 234 void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info) 235 { 236 struct ipv6_pinfo *np = inet6_sk(sk); 237 struct sock_exterr_skb *serr; 238 struct ipv6hdr *iph; 239 struct sk_buff *skb; 240 241 if (!np->recverr) 242 return; 243 244 skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC); 245 if (!skb) 246 return; 247 248 skb->protocol = htons(ETH_P_IPV6); 249 250 skb_put(skb, sizeof(struct ipv6hdr)); 251 skb_reset_network_header(skb); 252 iph = ipv6_hdr(skb); 253 ipv6_addr_copy(&iph->daddr, &fl6->daddr); 254 255 serr = SKB_EXT_ERR(skb); 256 serr->ee.ee_errno = err; 257 serr->ee.ee_origin = SO_EE_ORIGIN_LOCAL; 258 serr->ee.ee_type = 0; 259 serr->ee.ee_code = 0; 260 serr->ee.ee_pad = 0; 261 serr->ee.ee_info = info; 262 serr->ee.ee_data = 0; 263 serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb); 264 serr->port = fl6->fl6_dport; 265 266 __skb_pull(skb, skb_tail_pointer(skb) - skb->data); 267 skb_reset_transport_header(skb); 268 269 if (sock_queue_err_skb(sk, skb)) 270 kfree_skb(skb); 271 } 272 273 void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu) 274 { 275 struct ipv6_pinfo *np = inet6_sk(sk); 276 struct ipv6hdr *iph; 277 struct sk_buff *skb; 278 struct ip6_mtuinfo *mtu_info; 279 280 if (!np->rxopt.bits.rxpmtu) 281 return; 282 283 skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC); 284 if (!skb) 285 return; 286 287 skb_put(skb, sizeof(struct ipv6hdr)); 288 skb_reset_network_header(skb); 289 iph = ipv6_hdr(skb); 290 ipv6_addr_copy(&iph->daddr, &fl6->daddr); 291 292 mtu_info = IP6CBMTU(skb); 293 if (!mtu_info) { 294 kfree_skb(skb); 295 return; 296 } 297 298 mtu_info->ip6m_mtu = mtu; 299 mtu_info->ip6m_addr.sin6_family = AF_INET6; 300 mtu_info->ip6m_addr.sin6_port = 0; 301 mtu_info->ip6m_addr.sin6_flowinfo = 0; 302 mtu_info->ip6m_addr.sin6_scope_id = fl6->flowi6_oif; 303 ipv6_addr_copy(&mtu_info->ip6m_addr.sin6_addr, &ipv6_hdr(skb)->daddr); 304 305 __skb_pull(skb, skb_tail_pointer(skb) - skb->data); 306 skb_reset_transport_header(skb); 307 308 skb = xchg(&np->rxpmtu, skb); 309 kfree_skb(skb); 310 } 311 312 /* 313 * Handle MSG_ERRQUEUE 314 */ 315 int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len) 316 { 317 struct ipv6_pinfo *np = inet6_sk(sk); 318 struct sock_exterr_skb *serr; 319 struct sk_buff *skb, *skb2; 320 struct sockaddr_in6 *sin; 321 struct { 322 struct sock_extended_err ee; 323 struct sockaddr_in6 offender; 324 } errhdr; 325 int err; 326 int copied; 327 328 err = -EAGAIN; 329 skb = skb_dequeue(&sk->sk_error_queue); 330 if (skb == NULL) 331 goto out; 332 333 copied = skb->len; 334 if (copied > len) { 335 msg->msg_flags |= MSG_TRUNC; 336 copied = len; 337 } 338 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 339 if (err) 340 goto out_free_skb; 341 342 sock_recv_timestamp(msg, sk, skb); 343 344 serr = SKB_EXT_ERR(skb); 345 346 sin = (struct sockaddr_in6 *)msg->msg_name; 347 if (sin) { 348 const unsigned char *nh = skb_network_header(skb); 349 sin->sin6_family = AF_INET6; 350 sin->sin6_flowinfo = 0; 351 sin->sin6_port = serr->port; 352 sin->sin6_scope_id = 0; 353 if (skb->protocol == htons(ETH_P_IPV6)) { 354 ipv6_addr_copy(&sin->sin6_addr, 355 (struct in6_addr *)(nh + serr->addr_offset)); 356 if (np->sndflow) 357 sin->sin6_flowinfo = 358 (*(__be32 *)(nh + serr->addr_offset - 24) & 359 IPV6_FLOWINFO_MASK); 360 if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL) 361 sin->sin6_scope_id = IP6CB(skb)->iif; 362 } else { 363 ipv6_addr_set_v4mapped(*(__be32 *)(nh + serr->addr_offset), 364 &sin->sin6_addr); 365 } 366 } 367 368 memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err)); 369 sin = &errhdr.offender; 370 sin->sin6_family = AF_UNSPEC; 371 if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) { 372 sin->sin6_family = AF_INET6; 373 sin->sin6_flowinfo = 0; 374 sin->sin6_scope_id = 0; 375 if (skb->protocol == htons(ETH_P_IPV6)) { 376 ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr); 377 if (np->rxopt.all) 378 datagram_recv_ctl(sk, msg, skb); 379 if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL) 380 sin->sin6_scope_id = IP6CB(skb)->iif; 381 } else { 382 struct inet_sock *inet = inet_sk(sk); 383 384 ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, 385 &sin->sin6_addr); 386 if (inet->cmsg_flags) 387 ip_cmsg_recv(msg, skb); 388 } 389 } 390 391 put_cmsg(msg, SOL_IPV6, IPV6_RECVERR, sizeof(errhdr), &errhdr); 392 393 /* Now we could try to dump offended packet options */ 394 395 msg->msg_flags |= MSG_ERRQUEUE; 396 err = copied; 397 398 /* Reset and regenerate socket error */ 399 spin_lock_bh(&sk->sk_error_queue.lock); 400 sk->sk_err = 0; 401 if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) { 402 sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno; 403 spin_unlock_bh(&sk->sk_error_queue.lock); 404 sk->sk_error_report(sk); 405 } else { 406 spin_unlock_bh(&sk->sk_error_queue.lock); 407 } 408 409 out_free_skb: 410 kfree_skb(skb); 411 out: 412 return err; 413 } 414 415 /* 416 * Handle IPV6_RECVPATHMTU 417 */ 418 int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len) 419 { 420 struct ipv6_pinfo *np = inet6_sk(sk); 421 struct sk_buff *skb; 422 struct sockaddr_in6 *sin; 423 struct ip6_mtuinfo mtu_info; 424 int err; 425 int copied; 426 427 err = -EAGAIN; 428 skb = xchg(&np->rxpmtu, NULL); 429 if (skb == NULL) 430 goto out; 431 432 copied = skb->len; 433 if (copied > len) { 434 msg->msg_flags |= MSG_TRUNC; 435 copied = len; 436 } 437 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 438 if (err) 439 goto out_free_skb; 440 441 sock_recv_timestamp(msg, sk, skb); 442 443 memcpy(&mtu_info, IP6CBMTU(skb), sizeof(mtu_info)); 444 445 sin = (struct sockaddr_in6 *)msg->msg_name; 446 if (sin) { 447 sin->sin6_family = AF_INET6; 448 sin->sin6_flowinfo = 0; 449 sin->sin6_port = 0; 450 sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id; 451 ipv6_addr_copy(&sin->sin6_addr, &mtu_info.ip6m_addr.sin6_addr); 452 } 453 454 put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info); 455 456 err = copied; 457 458 out_free_skb: 459 kfree_skb(skb); 460 out: 461 return err; 462 } 463 464 465 int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb) 466 { 467 struct ipv6_pinfo *np = inet6_sk(sk); 468 struct inet6_skb_parm *opt = IP6CB(skb); 469 unsigned char *nh = skb_network_header(skb); 470 471 if (np->rxopt.bits.rxinfo) { 472 struct in6_pktinfo src_info; 473 474 src_info.ipi6_ifindex = opt->iif; 475 ipv6_addr_copy(&src_info.ipi6_addr, &ipv6_hdr(skb)->daddr); 476 put_cmsg(msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info); 477 } 478 479 if (np->rxopt.bits.rxhlim) { 480 int hlim = ipv6_hdr(skb)->hop_limit; 481 put_cmsg(msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim); 482 } 483 484 if (np->rxopt.bits.rxtclass) { 485 int tclass = (ntohl(*(__be32 *)ipv6_hdr(skb)) >> 20) & 0xff; 486 put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass); 487 } 488 489 if (np->rxopt.bits.rxflow && (*(__be32 *)nh & IPV6_FLOWINFO_MASK)) { 490 __be32 flowinfo = *(__be32 *)nh & IPV6_FLOWINFO_MASK; 491 put_cmsg(msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo); 492 } 493 494 /* HbH is allowed only once */ 495 if (np->rxopt.bits.hopopts && opt->hop) { 496 u8 *ptr = nh + opt->hop; 497 put_cmsg(msg, SOL_IPV6, IPV6_HOPOPTS, (ptr[1]+1)<<3, ptr); 498 } 499 500 if (opt->lastopt && 501 (np->rxopt.bits.dstopts || np->rxopt.bits.srcrt)) { 502 /* 503 * Silly enough, but we need to reparse in order to 504 * report extension headers (except for HbH) 505 * in order. 506 * 507 * Also note that IPV6_RECVRTHDRDSTOPTS is NOT 508 * (and WILL NOT be) defined because 509 * IPV6_RECVDSTOPTS is more generic. --yoshfuji 510 */ 511 unsigned int off = sizeof(struct ipv6hdr); 512 u8 nexthdr = ipv6_hdr(skb)->nexthdr; 513 514 while (off <= opt->lastopt) { 515 unsigned len; 516 u8 *ptr = nh + off; 517 518 switch(nexthdr) { 519 case IPPROTO_DSTOPTS: 520 nexthdr = ptr[0]; 521 len = (ptr[1] + 1) << 3; 522 if (np->rxopt.bits.dstopts) 523 put_cmsg(msg, SOL_IPV6, IPV6_DSTOPTS, len, ptr); 524 break; 525 case IPPROTO_ROUTING: 526 nexthdr = ptr[0]; 527 len = (ptr[1] + 1) << 3; 528 if (np->rxopt.bits.srcrt) 529 put_cmsg(msg, SOL_IPV6, IPV6_RTHDR, len, ptr); 530 break; 531 case IPPROTO_AH: 532 nexthdr = ptr[0]; 533 len = (ptr[1] + 2) << 2; 534 break; 535 default: 536 nexthdr = ptr[0]; 537 len = (ptr[1] + 1) << 3; 538 break; 539 } 540 541 off += len; 542 } 543 } 544 545 /* socket options in old style */ 546 if (np->rxopt.bits.rxoinfo) { 547 struct in6_pktinfo src_info; 548 549 src_info.ipi6_ifindex = opt->iif; 550 ipv6_addr_copy(&src_info.ipi6_addr, &ipv6_hdr(skb)->daddr); 551 put_cmsg(msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info); 552 } 553 if (np->rxopt.bits.rxohlim) { 554 int hlim = ipv6_hdr(skb)->hop_limit; 555 put_cmsg(msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim); 556 } 557 if (np->rxopt.bits.ohopopts && opt->hop) { 558 u8 *ptr = nh + opt->hop; 559 put_cmsg(msg, SOL_IPV6, IPV6_2292HOPOPTS, (ptr[1]+1)<<3, ptr); 560 } 561 if (np->rxopt.bits.odstopts && opt->dst0) { 562 u8 *ptr = nh + opt->dst0; 563 put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr); 564 } 565 if (np->rxopt.bits.osrcrt && opt->srcrt) { 566 struct ipv6_rt_hdr *rthdr = (struct ipv6_rt_hdr *)(nh + opt->srcrt); 567 put_cmsg(msg, SOL_IPV6, IPV6_2292RTHDR, (rthdr->hdrlen+1) << 3, rthdr); 568 } 569 if (np->rxopt.bits.odstopts && opt->dst1) { 570 u8 *ptr = nh + opt->dst1; 571 put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr); 572 } 573 if (np->rxopt.bits.rxorigdstaddr) { 574 struct sockaddr_in6 sin6; 575 u16 *ports = (u16 *) skb_transport_header(skb); 576 577 if (skb_transport_offset(skb) + 4 <= skb->len) { 578 /* All current transport protocols have the port numbers in the 579 * first four bytes of the transport header and this function is 580 * written with this assumption in mind. 581 */ 582 583 sin6.sin6_family = AF_INET6; 584 ipv6_addr_copy(&sin6.sin6_addr, &ipv6_hdr(skb)->daddr); 585 sin6.sin6_port = ports[1]; 586 sin6.sin6_flowinfo = 0; 587 sin6.sin6_scope_id = 0; 588 589 put_cmsg(msg, SOL_IPV6, IPV6_ORIGDSTADDR, sizeof(sin6), &sin6); 590 } 591 } 592 return 0; 593 } 594 595 int datagram_send_ctl(struct net *net, 596 struct msghdr *msg, struct flowi6 *fl6, 597 struct ipv6_txoptions *opt, 598 int *hlimit, int *tclass, int *dontfrag) 599 { 600 struct in6_pktinfo *src_info; 601 struct cmsghdr *cmsg; 602 struct ipv6_rt_hdr *rthdr; 603 struct ipv6_opt_hdr *hdr; 604 int len; 605 int err = 0; 606 607 for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) { 608 int addr_type; 609 610 if (!CMSG_OK(msg, cmsg)) { 611 err = -EINVAL; 612 goto exit_f; 613 } 614 615 if (cmsg->cmsg_level != SOL_IPV6) 616 continue; 617 618 switch (cmsg->cmsg_type) { 619 case IPV6_PKTINFO: 620 case IPV6_2292PKTINFO: 621 { 622 struct net_device *dev = NULL; 623 624 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) { 625 err = -EINVAL; 626 goto exit_f; 627 } 628 629 src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg); 630 631 if (src_info->ipi6_ifindex) { 632 if (fl6->flowi6_oif && 633 src_info->ipi6_ifindex != fl6->flowi6_oif) 634 return -EINVAL; 635 fl6->flowi6_oif = src_info->ipi6_ifindex; 636 } 637 638 addr_type = __ipv6_addr_type(&src_info->ipi6_addr); 639 640 rcu_read_lock(); 641 if (fl6->flowi6_oif) { 642 dev = dev_get_by_index_rcu(net, fl6->flowi6_oif); 643 if (!dev) { 644 rcu_read_unlock(); 645 return -ENODEV; 646 } 647 } else if (addr_type & IPV6_ADDR_LINKLOCAL) { 648 rcu_read_unlock(); 649 return -EINVAL; 650 } 651 652 if (addr_type != IPV6_ADDR_ANY) { 653 int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL; 654 if (!ipv6_chk_addr(net, &src_info->ipi6_addr, 655 strict ? dev : NULL, 0)) 656 err = -EINVAL; 657 else 658 ipv6_addr_copy(&fl6->saddr, &src_info->ipi6_addr); 659 } 660 661 rcu_read_unlock(); 662 663 if (err) 664 goto exit_f; 665 666 break; 667 } 668 669 case IPV6_FLOWINFO: 670 if (cmsg->cmsg_len < CMSG_LEN(4)) { 671 err = -EINVAL; 672 goto exit_f; 673 } 674 675 if (fl6->flowlabel&IPV6_FLOWINFO_MASK) { 676 if ((fl6->flowlabel^*(__be32 *)CMSG_DATA(cmsg))&~IPV6_FLOWINFO_MASK) { 677 err = -EINVAL; 678 goto exit_f; 679 } 680 } 681 fl6->flowlabel = IPV6_FLOWINFO_MASK & *(__be32 *)CMSG_DATA(cmsg); 682 break; 683 684 case IPV6_2292HOPOPTS: 685 case IPV6_HOPOPTS: 686 if (opt->hopopt || cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) { 687 err = -EINVAL; 688 goto exit_f; 689 } 690 691 hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg); 692 len = ((hdr->hdrlen + 1) << 3); 693 if (cmsg->cmsg_len < CMSG_LEN(len)) { 694 err = -EINVAL; 695 goto exit_f; 696 } 697 if (!capable(CAP_NET_RAW)) { 698 err = -EPERM; 699 goto exit_f; 700 } 701 opt->opt_nflen += len; 702 opt->hopopt = hdr; 703 break; 704 705 case IPV6_2292DSTOPTS: 706 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) { 707 err = -EINVAL; 708 goto exit_f; 709 } 710 711 hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg); 712 len = ((hdr->hdrlen + 1) << 3); 713 if (cmsg->cmsg_len < CMSG_LEN(len)) { 714 err = -EINVAL; 715 goto exit_f; 716 } 717 if (!capable(CAP_NET_RAW)) { 718 err = -EPERM; 719 goto exit_f; 720 } 721 if (opt->dst1opt) { 722 err = -EINVAL; 723 goto exit_f; 724 } 725 opt->opt_flen += len; 726 opt->dst1opt = hdr; 727 break; 728 729 case IPV6_DSTOPTS: 730 case IPV6_RTHDRDSTOPTS: 731 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) { 732 err = -EINVAL; 733 goto exit_f; 734 } 735 736 hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg); 737 len = ((hdr->hdrlen + 1) << 3); 738 if (cmsg->cmsg_len < CMSG_LEN(len)) { 739 err = -EINVAL; 740 goto exit_f; 741 } 742 if (!capable(CAP_NET_RAW)) { 743 err = -EPERM; 744 goto exit_f; 745 } 746 if (cmsg->cmsg_type == IPV6_DSTOPTS) { 747 opt->opt_flen += len; 748 opt->dst1opt = hdr; 749 } else { 750 opt->opt_nflen += len; 751 opt->dst0opt = hdr; 752 } 753 break; 754 755 case IPV6_2292RTHDR: 756 case IPV6_RTHDR: 757 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_rt_hdr))) { 758 err = -EINVAL; 759 goto exit_f; 760 } 761 762 rthdr = (struct ipv6_rt_hdr *)CMSG_DATA(cmsg); 763 764 switch (rthdr->type) { 765 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE) 766 case IPV6_SRCRT_TYPE_2: 767 if (rthdr->hdrlen != 2 || 768 rthdr->segments_left != 1) { 769 err = -EINVAL; 770 goto exit_f; 771 } 772 break; 773 #endif 774 default: 775 err = -EINVAL; 776 goto exit_f; 777 } 778 779 len = ((rthdr->hdrlen + 1) << 3); 780 781 if (cmsg->cmsg_len < CMSG_LEN(len)) { 782 err = -EINVAL; 783 goto exit_f; 784 } 785 786 /* segments left must also match */ 787 if ((rthdr->hdrlen >> 1) != rthdr->segments_left) { 788 err = -EINVAL; 789 goto exit_f; 790 } 791 792 opt->opt_nflen += len; 793 opt->srcrt = rthdr; 794 795 if (cmsg->cmsg_type == IPV6_2292RTHDR && opt->dst1opt) { 796 int dsthdrlen = ((opt->dst1opt->hdrlen+1)<<3); 797 798 opt->opt_nflen += dsthdrlen; 799 opt->dst0opt = opt->dst1opt; 800 opt->dst1opt = NULL; 801 opt->opt_flen -= dsthdrlen; 802 } 803 804 break; 805 806 case IPV6_2292HOPLIMIT: 807 case IPV6_HOPLIMIT: 808 if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) { 809 err = -EINVAL; 810 goto exit_f; 811 } 812 813 *hlimit = *(int *)CMSG_DATA(cmsg); 814 if (*hlimit < -1 || *hlimit > 0xff) { 815 err = -EINVAL; 816 goto exit_f; 817 } 818 819 break; 820 821 case IPV6_TCLASS: 822 { 823 int tc; 824 825 err = -EINVAL; 826 if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) { 827 goto exit_f; 828 } 829 830 tc = *(int *)CMSG_DATA(cmsg); 831 if (tc < -1 || tc > 0xff) 832 goto exit_f; 833 834 err = 0; 835 *tclass = tc; 836 837 break; 838 } 839 840 case IPV6_DONTFRAG: 841 { 842 int df; 843 844 err = -EINVAL; 845 if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) { 846 goto exit_f; 847 } 848 849 df = *(int *)CMSG_DATA(cmsg); 850 if (df < 0 || df > 1) 851 goto exit_f; 852 853 err = 0; 854 *dontfrag = df; 855 856 break; 857 } 858 default: 859 LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n", 860 cmsg->cmsg_type); 861 err = -EINVAL; 862 goto exit_f; 863 } 864 } 865 866 exit_f: 867 return err; 868 } 869