xref: /openbmc/linux/net/ipv6/exthdrs.c (revision fc28ab18)
1 /*
2  *	Extension Header handling for IPv6
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *	Andi Kleen		<ak@muc.de>
8  *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
9  *
10  *	This program is free software; you can redistribute it and/or
11  *      modify it under the terms of the GNU General Public License
12  *      as published by the Free Software Foundation; either version
13  *      2 of the License, or (at your option) any later version.
14  */
15 
16 /* Changes:
17  *	yoshfuji		: ensure not to overrun while parsing
18  *				  tlv options.
19  *	Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
20  *	YOSHIFUJI Hideaki @USAGI  Register inbound extension header
21  *				  handlers as inet6_protocol{}.
22  */
23 
24 #include <linux/errno.h>
25 #include <linux/types.h>
26 #include <linux/socket.h>
27 #include <linux/sockios.h>
28 #include <linux/net.h>
29 #include <linux/netdevice.h>
30 #include <linux/in6.h>
31 #include <linux/icmpv6.h>
32 #include <linux/slab.h>
33 #include <linux/export.h>
34 
35 #include <net/dst.h>
36 #include <net/sock.h>
37 #include <net/snmp.h>
38 
39 #include <net/ipv6.h>
40 #include <net/protocol.h>
41 #include <net/transp_v6.h>
42 #include <net/rawv6.h>
43 #include <net/ndisc.h>
44 #include <net/ip6_route.h>
45 #include <net/addrconf.h>
46 #include <net/calipso.h>
47 #if IS_ENABLED(CONFIG_IPV6_MIP6)
48 #include <net/xfrm.h>
49 #endif
50 #include <linux/seg6.h>
51 #include <net/seg6.h>
52 #ifdef CONFIG_IPV6_SEG6_HMAC
53 #include <net/seg6_hmac.h>
54 #endif
55 
56 #include <linux/uaccess.h>
57 
58 /*
59  *	Parsing tlv encoded headers.
60  *
61  *	Parsing function "func" returns true, if parsing succeed
62  *	and false, if it failed.
63  *	It MUST NOT touch skb->h.
64  */
65 
66 struct tlvtype_proc {
67 	int	type;
68 	bool	(*func)(struct sk_buff *skb, int offset);
69 };
70 
71 /*********************
72   Generic functions
73  *********************/
74 
75 /* An unknown option is detected, decide what to do */
76 
77 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
78 {
79 	switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
80 	case 0: /* ignore */
81 		return true;
82 
83 	case 1: /* drop packet */
84 		break;
85 
86 	case 3: /* Send ICMP if not a multicast address and drop packet */
87 		/* Actually, it is redundant check. icmp_send
88 		   will recheck in any case.
89 		 */
90 		if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
91 			break;
92 	case 2: /* send ICMP PARM PROB regardless and drop packet */
93 		icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
94 		return false;
95 	}
96 
97 	kfree_skb(skb);
98 	return false;
99 }
100 
101 /* Parse tlv encoded option header (hop-by-hop or destination) */
102 
103 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
104 {
105 	const struct tlvtype_proc *curr;
106 	const unsigned char *nh = skb_network_header(skb);
107 	int off = skb_network_header_len(skb);
108 	int len = (skb_transport_header(skb)[1] + 1) << 3;
109 	int padlen = 0;
110 
111 	if (skb_transport_offset(skb) + len > skb_headlen(skb))
112 		goto bad;
113 
114 	off += 2;
115 	len -= 2;
116 
117 	while (len > 0) {
118 		int optlen = nh[off + 1] + 2;
119 		int i;
120 
121 		switch (nh[off]) {
122 		case IPV6_TLV_PAD1:
123 			optlen = 1;
124 			padlen++;
125 			if (padlen > 7)
126 				goto bad;
127 			break;
128 
129 		case IPV6_TLV_PADN:
130 			/* RFC 2460 states that the purpose of PadN is
131 			 * to align the containing header to multiples
132 			 * of 8. 7 is therefore the highest valid value.
133 			 * See also RFC 4942, Section 2.1.9.5.
134 			 */
135 			padlen += optlen;
136 			if (padlen > 7)
137 				goto bad;
138 			/* RFC 4942 recommends receiving hosts to
139 			 * actively check PadN payload to contain
140 			 * only zeroes.
141 			 */
142 			for (i = 2; i < optlen; i++) {
143 				if (nh[off + i] != 0)
144 					goto bad;
145 			}
146 			break;
147 
148 		default: /* Other TLV code so scan list */
149 			if (optlen > len)
150 				goto bad;
151 			for (curr = procs; curr->type >= 0; curr++) {
152 				if (curr->type == nh[off]) {
153 					/* type specific length/alignment
154 					   checks will be performed in the
155 					   func(). */
156 					if (curr->func(skb, off) == false)
157 						return false;
158 					break;
159 				}
160 			}
161 			if (curr->type < 0) {
162 				if (ip6_tlvopt_unknown(skb, off) == 0)
163 					return false;
164 			}
165 			padlen = 0;
166 			break;
167 		}
168 		off += optlen;
169 		len -= optlen;
170 	}
171 
172 	if (len == 0)
173 		return true;
174 bad:
175 	kfree_skb(skb);
176 	return false;
177 }
178 
179 /*****************************
180   Destination options header.
181  *****************************/
182 
183 #if IS_ENABLED(CONFIG_IPV6_MIP6)
184 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
185 {
186 	struct ipv6_destopt_hao *hao;
187 	struct inet6_skb_parm *opt = IP6CB(skb);
188 	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
189 	struct in6_addr tmp_addr;
190 	int ret;
191 
192 	if (opt->dsthao) {
193 		net_dbg_ratelimited("hao duplicated\n");
194 		goto discard;
195 	}
196 	opt->dsthao = opt->dst1;
197 	opt->dst1 = 0;
198 
199 	hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
200 
201 	if (hao->length != 16) {
202 		net_dbg_ratelimited("hao invalid option length = %d\n",
203 				    hao->length);
204 		goto discard;
205 	}
206 
207 	if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
208 		net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
209 				    &hao->addr);
210 		goto discard;
211 	}
212 
213 	ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
214 			       (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
215 	if (unlikely(ret < 0))
216 		goto discard;
217 
218 	if (skb_cloned(skb)) {
219 		if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
220 			goto discard;
221 
222 		/* update all variable using below by copied skbuff */
223 		hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
224 						  optoff);
225 		ipv6h = ipv6_hdr(skb);
226 	}
227 
228 	if (skb->ip_summed == CHECKSUM_COMPLETE)
229 		skb->ip_summed = CHECKSUM_NONE;
230 
231 	tmp_addr = ipv6h->saddr;
232 	ipv6h->saddr = hao->addr;
233 	hao->addr = tmp_addr;
234 
235 	if (skb->tstamp == 0)
236 		__net_timestamp(skb);
237 
238 	return true;
239 
240  discard:
241 	kfree_skb(skb);
242 	return false;
243 }
244 #endif
245 
246 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
247 #if IS_ENABLED(CONFIG_IPV6_MIP6)
248 	{
249 		.type	= IPV6_TLV_HAO,
250 		.func	= ipv6_dest_hao,
251 	},
252 #endif
253 	{-1,			NULL}
254 };
255 
256 static int ipv6_destopt_rcv(struct sk_buff *skb)
257 {
258 	struct inet6_skb_parm *opt = IP6CB(skb);
259 #if IS_ENABLED(CONFIG_IPV6_MIP6)
260 	__u16 dstbuf;
261 #endif
262 	struct dst_entry *dst = skb_dst(skb);
263 
264 	if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
265 	    !pskb_may_pull(skb, (skb_transport_offset(skb) +
266 				 ((skb_transport_header(skb)[1] + 1) << 3)))) {
267 		__IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
268 				IPSTATS_MIB_INHDRERRORS);
269 		kfree_skb(skb);
270 		return -1;
271 	}
272 
273 	opt->lastopt = opt->dst1 = skb_network_header_len(skb);
274 #if IS_ENABLED(CONFIG_IPV6_MIP6)
275 	dstbuf = opt->dst1;
276 #endif
277 
278 	if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
279 		skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
280 		opt = IP6CB(skb);
281 #if IS_ENABLED(CONFIG_IPV6_MIP6)
282 		opt->nhoff = dstbuf;
283 #else
284 		opt->nhoff = opt->dst1;
285 #endif
286 		return 1;
287 	}
288 
289 	__IP6_INC_STATS(dev_net(dst->dev),
290 			ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
291 	return -1;
292 }
293 
294 static void seg6_update_csum(struct sk_buff *skb)
295 {
296 	struct ipv6_sr_hdr *hdr;
297 	struct in6_addr *addr;
298 	__be32 from, to;
299 
300 	/* srh is at transport offset and seg_left is already decremented
301 	 * but daddr is not yet updated with next segment
302 	 */
303 
304 	hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
305 	addr = hdr->segments + hdr->segments_left;
306 
307 	hdr->segments_left++;
308 	from = *(__be32 *)hdr;
309 
310 	hdr->segments_left--;
311 	to = *(__be32 *)hdr;
312 
313 	/* update skb csum with diff resulting from seg_left decrement */
314 
315 	update_csum_diff4(skb, from, to);
316 
317 	/* compute csum diff between current and next segment and update */
318 
319 	update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
320 			   (__be32 *)addr);
321 }
322 
323 static int ipv6_srh_rcv(struct sk_buff *skb)
324 {
325 	struct inet6_skb_parm *opt = IP6CB(skb);
326 	struct net *net = dev_net(skb->dev);
327 	struct ipv6_sr_hdr *hdr;
328 	struct inet6_dev *idev;
329 	struct in6_addr *addr;
330 	bool cleanup = false;
331 	int accept_seg6;
332 
333 	hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
334 
335 	idev = __in6_dev_get(skb->dev);
336 
337 	accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
338 	if (accept_seg6 > idev->cnf.seg6_enabled)
339 		accept_seg6 = idev->cnf.seg6_enabled;
340 
341 	if (!accept_seg6) {
342 		kfree_skb(skb);
343 		return -1;
344 	}
345 
346 #ifdef CONFIG_IPV6_SEG6_HMAC
347 	if (!seg6_hmac_validate_skb(skb)) {
348 		kfree_skb(skb);
349 		return -1;
350 	}
351 #endif
352 
353 looped_back:
354 	if (hdr->segments_left > 0) {
355 		if (hdr->nexthdr != NEXTHDR_IPV6 && hdr->segments_left == 1 &&
356 		    sr_has_cleanup(hdr))
357 			cleanup = true;
358 	} else {
359 		if (hdr->nexthdr == NEXTHDR_IPV6) {
360 			int offset = (hdr->hdrlen + 1) << 3;
361 
362 			skb_postpull_rcsum(skb, skb_network_header(skb),
363 					   skb_network_header_len(skb));
364 
365 			if (!pskb_pull(skb, offset)) {
366 				kfree_skb(skb);
367 				return -1;
368 			}
369 			skb_postpull_rcsum(skb, skb_transport_header(skb),
370 					   offset);
371 
372 			skb_reset_network_header(skb);
373 			skb_reset_transport_header(skb);
374 			skb->encapsulation = 0;
375 
376 			__skb_tunnel_rx(skb, skb->dev, net);
377 
378 			netif_rx(skb);
379 			return -1;
380 		}
381 
382 		opt->srcrt = skb_network_header_len(skb);
383 		opt->lastopt = opt->srcrt;
384 		skb->transport_header += (hdr->hdrlen + 1) << 3;
385 		opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
386 
387 		return 1;
388 	}
389 
390 	if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
391 		__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
392 				IPSTATS_MIB_INHDRERRORS);
393 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
394 				  ((&hdr->segments_left) -
395 				   skb_network_header(skb)));
396 		kfree_skb(skb);
397 		return -1;
398 	}
399 
400 	if (skb_cloned(skb)) {
401 		if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
402 			__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
403 					IPSTATS_MIB_OUTDISCARDS);
404 			kfree_skb(skb);
405 			return -1;
406 		}
407 	}
408 
409 	hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
410 
411 	hdr->segments_left--;
412 	addr = hdr->segments + hdr->segments_left;
413 
414 	skb_push(skb, sizeof(struct ipv6hdr));
415 
416 	if (skb->ip_summed == CHECKSUM_COMPLETE)
417 		seg6_update_csum(skb);
418 
419 	ipv6_hdr(skb)->daddr = *addr;
420 
421 	if (cleanup) {
422 		int srhlen = (hdr->hdrlen + 1) << 3;
423 		int nh = hdr->nexthdr;
424 
425 		skb_pull_rcsum(skb, sizeof(struct ipv6hdr) + srhlen);
426 		memmove(skb_network_header(skb) + srhlen,
427 			skb_network_header(skb),
428 			(unsigned char *)hdr - skb_network_header(skb));
429 		skb->network_header += srhlen;
430 		ipv6_hdr(skb)->nexthdr = nh;
431 		ipv6_hdr(skb)->payload_len = htons(skb->len -
432 						   sizeof(struct ipv6hdr));
433 		skb_push_rcsum(skb, sizeof(struct ipv6hdr));
434 	}
435 
436 	skb_dst_drop(skb);
437 
438 	ip6_route_input(skb);
439 
440 	if (skb_dst(skb)->error) {
441 		dst_input(skb);
442 		return -1;
443 	}
444 
445 	if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
446 		if (ipv6_hdr(skb)->hop_limit <= 1) {
447 			__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
448 					IPSTATS_MIB_INHDRERRORS);
449 			icmpv6_send(skb, ICMPV6_TIME_EXCEED,
450 				    ICMPV6_EXC_HOPLIMIT, 0);
451 			kfree_skb(skb);
452 			return -1;
453 		}
454 		ipv6_hdr(skb)->hop_limit--;
455 
456 		/* be sure that srh is still present before reinjecting */
457 		if (!cleanup) {
458 			skb_pull(skb, sizeof(struct ipv6hdr));
459 			goto looped_back;
460 		}
461 		skb_set_transport_header(skb, sizeof(struct ipv6hdr));
462 		IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
463 	}
464 
465 	dst_input(skb);
466 
467 	return -1;
468 }
469 
470 /********************************
471   Routing header.
472  ********************************/
473 
474 /* called with rcu_read_lock() */
475 static int ipv6_rthdr_rcv(struct sk_buff *skb)
476 {
477 	struct inet6_skb_parm *opt = IP6CB(skb);
478 	struct in6_addr *addr = NULL;
479 	struct in6_addr daddr;
480 	struct inet6_dev *idev;
481 	int n, i;
482 	struct ipv6_rt_hdr *hdr;
483 	struct rt0_hdr *rthdr;
484 	struct net *net = dev_net(skb->dev);
485 	int accept_source_route = net->ipv6.devconf_all->accept_source_route;
486 
487 	idev = __in6_dev_get(skb->dev);
488 	if (idev && accept_source_route > idev->cnf.accept_source_route)
489 		accept_source_route = idev->cnf.accept_source_route;
490 
491 	if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
492 	    !pskb_may_pull(skb, (skb_transport_offset(skb) +
493 				 ((skb_transport_header(skb)[1] + 1) << 3)))) {
494 		__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
495 				IPSTATS_MIB_INHDRERRORS);
496 		kfree_skb(skb);
497 		return -1;
498 	}
499 
500 	hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
501 
502 	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
503 	    skb->pkt_type != PACKET_HOST) {
504 		__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
505 				IPSTATS_MIB_INADDRERRORS);
506 		kfree_skb(skb);
507 		return -1;
508 	}
509 
510 	/* segment routing */
511 	if (hdr->type == IPV6_SRCRT_TYPE_4)
512 		return ipv6_srh_rcv(skb);
513 
514 looped_back:
515 	if (hdr->segments_left == 0) {
516 		switch (hdr->type) {
517 #if IS_ENABLED(CONFIG_IPV6_MIP6)
518 		case IPV6_SRCRT_TYPE_2:
519 			/* Silently discard type 2 header unless it was
520 			 * processed by own
521 			 */
522 			if (!addr) {
523 				__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
524 						IPSTATS_MIB_INADDRERRORS);
525 				kfree_skb(skb);
526 				return -1;
527 			}
528 			break;
529 #endif
530 		default:
531 			break;
532 		}
533 
534 		opt->lastopt = opt->srcrt = skb_network_header_len(skb);
535 		skb->transport_header += (hdr->hdrlen + 1) << 3;
536 		opt->dst0 = opt->dst1;
537 		opt->dst1 = 0;
538 		opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
539 		return 1;
540 	}
541 
542 	switch (hdr->type) {
543 #if IS_ENABLED(CONFIG_IPV6_MIP6)
544 	case IPV6_SRCRT_TYPE_2:
545 		if (accept_source_route < 0)
546 			goto unknown_rh;
547 		/* Silently discard invalid RTH type 2 */
548 		if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
549 			__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
550 					IPSTATS_MIB_INHDRERRORS);
551 			kfree_skb(skb);
552 			return -1;
553 		}
554 		break;
555 #endif
556 	default:
557 		goto unknown_rh;
558 	}
559 
560 	/*
561 	 *	This is the routing header forwarding algorithm from
562 	 *	RFC 2460, page 16.
563 	 */
564 
565 	n = hdr->hdrlen >> 1;
566 
567 	if (hdr->segments_left > n) {
568 		__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
569 				IPSTATS_MIB_INHDRERRORS);
570 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
571 				  ((&hdr->segments_left) -
572 				   skb_network_header(skb)));
573 		return -1;
574 	}
575 
576 	/* We are about to mangle packet header. Be careful!
577 	   Do not damage packets queued somewhere.
578 	 */
579 	if (skb_cloned(skb)) {
580 		/* the copy is a forwarded packet */
581 		if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
582 			__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
583 					IPSTATS_MIB_OUTDISCARDS);
584 			kfree_skb(skb);
585 			return -1;
586 		}
587 		hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
588 	}
589 
590 	if (skb->ip_summed == CHECKSUM_COMPLETE)
591 		skb->ip_summed = CHECKSUM_NONE;
592 
593 	i = n - --hdr->segments_left;
594 
595 	rthdr = (struct rt0_hdr *) hdr;
596 	addr = rthdr->addr;
597 	addr += i - 1;
598 
599 	switch (hdr->type) {
600 #if IS_ENABLED(CONFIG_IPV6_MIP6)
601 	case IPV6_SRCRT_TYPE_2:
602 		if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
603 				     (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
604 				     IPPROTO_ROUTING) < 0) {
605 			__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
606 					IPSTATS_MIB_INADDRERRORS);
607 			kfree_skb(skb);
608 			return -1;
609 		}
610 		if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
611 			__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
612 					IPSTATS_MIB_INADDRERRORS);
613 			kfree_skb(skb);
614 			return -1;
615 		}
616 		break;
617 #endif
618 	default:
619 		break;
620 	}
621 
622 	if (ipv6_addr_is_multicast(addr)) {
623 		__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
624 				IPSTATS_MIB_INADDRERRORS);
625 		kfree_skb(skb);
626 		return -1;
627 	}
628 
629 	daddr = *addr;
630 	*addr = ipv6_hdr(skb)->daddr;
631 	ipv6_hdr(skb)->daddr = daddr;
632 
633 	skb_dst_drop(skb);
634 	ip6_route_input(skb);
635 	if (skb_dst(skb)->error) {
636 		skb_push(skb, skb->data - skb_network_header(skb));
637 		dst_input(skb);
638 		return -1;
639 	}
640 
641 	if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
642 		if (ipv6_hdr(skb)->hop_limit <= 1) {
643 			__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
644 					IPSTATS_MIB_INHDRERRORS);
645 			icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
646 				    0);
647 			kfree_skb(skb);
648 			return -1;
649 		}
650 		ipv6_hdr(skb)->hop_limit--;
651 		goto looped_back;
652 	}
653 
654 	skb_push(skb, skb->data - skb_network_header(skb));
655 	dst_input(skb);
656 	return -1;
657 
658 unknown_rh:
659 	__IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
660 	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
661 			  (&hdr->type) - skb_network_header(skb));
662 	return -1;
663 }
664 
665 static const struct inet6_protocol rthdr_protocol = {
666 	.handler	=	ipv6_rthdr_rcv,
667 	.flags		=	INET6_PROTO_NOPOLICY,
668 };
669 
670 static const struct inet6_protocol destopt_protocol = {
671 	.handler	=	ipv6_destopt_rcv,
672 	.flags		=	INET6_PROTO_NOPOLICY,
673 };
674 
675 static const struct inet6_protocol nodata_protocol = {
676 	.handler	=	dst_discard,
677 	.flags		=	INET6_PROTO_NOPOLICY,
678 };
679 
680 int __init ipv6_exthdrs_init(void)
681 {
682 	int ret;
683 
684 	ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
685 	if (ret)
686 		goto out;
687 
688 	ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
689 	if (ret)
690 		goto out_rthdr;
691 
692 	ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
693 	if (ret)
694 		goto out_destopt;
695 
696 out:
697 	return ret;
698 out_destopt:
699 	inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
700 out_rthdr:
701 	inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
702 	goto out;
703 };
704 
705 void ipv6_exthdrs_exit(void)
706 {
707 	inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
708 	inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
709 	inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
710 }
711 
712 /**********************************
713   Hop-by-hop options.
714  **********************************/
715 
716 /*
717  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
718  */
719 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
720 {
721 	return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
722 }
723 
724 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
725 {
726 	return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
727 }
728 
729 /* Router Alert as of RFC 2711 */
730 
731 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
732 {
733 	const unsigned char *nh = skb_network_header(skb);
734 
735 	if (nh[optoff + 1] == 2) {
736 		IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
737 		memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
738 		return true;
739 	}
740 	net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
741 			    nh[optoff + 1]);
742 	kfree_skb(skb);
743 	return false;
744 }
745 
746 /* Jumbo payload */
747 
748 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
749 {
750 	const unsigned char *nh = skb_network_header(skb);
751 	struct net *net = ipv6_skb_net(skb);
752 	u32 pkt_len;
753 
754 	if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
755 		net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
756 				    nh[optoff+1]);
757 		__IP6_INC_STATS(net, ipv6_skb_idev(skb),
758 				IPSTATS_MIB_INHDRERRORS);
759 		goto drop;
760 	}
761 
762 	pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
763 	if (pkt_len <= IPV6_MAXPLEN) {
764 		__IP6_INC_STATS(net, ipv6_skb_idev(skb),
765 				IPSTATS_MIB_INHDRERRORS);
766 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
767 		return false;
768 	}
769 	if (ipv6_hdr(skb)->payload_len) {
770 		__IP6_INC_STATS(net, ipv6_skb_idev(skb),
771 				IPSTATS_MIB_INHDRERRORS);
772 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
773 		return false;
774 	}
775 
776 	if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
777 		__IP6_INC_STATS(net, ipv6_skb_idev(skb),
778 				IPSTATS_MIB_INTRUNCATEDPKTS);
779 		goto drop;
780 	}
781 
782 	if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
783 		goto drop;
784 
785 	return true;
786 
787 drop:
788 	kfree_skb(skb);
789 	return false;
790 }
791 
792 /* CALIPSO RFC 5570 */
793 
794 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
795 {
796 	const unsigned char *nh = skb_network_header(skb);
797 
798 	if (nh[optoff + 1] < 8)
799 		goto drop;
800 
801 	if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
802 		goto drop;
803 
804 	if (!calipso_validate(skb, nh + optoff))
805 		goto drop;
806 
807 	return true;
808 
809 drop:
810 	kfree_skb(skb);
811 	return false;
812 }
813 
814 static const struct tlvtype_proc tlvprochopopt_lst[] = {
815 	{
816 		.type	= IPV6_TLV_ROUTERALERT,
817 		.func	= ipv6_hop_ra,
818 	},
819 	{
820 		.type	= IPV6_TLV_JUMBO,
821 		.func	= ipv6_hop_jumbo,
822 	},
823 	{
824 		.type	= IPV6_TLV_CALIPSO,
825 		.func	= ipv6_hop_calipso,
826 	},
827 	{ -1, }
828 };
829 
830 int ipv6_parse_hopopts(struct sk_buff *skb)
831 {
832 	struct inet6_skb_parm *opt = IP6CB(skb);
833 
834 	/*
835 	 * skb_network_header(skb) is equal to skb->data, and
836 	 * skb_network_header_len(skb) is always equal to
837 	 * sizeof(struct ipv6hdr) by definition of
838 	 * hop-by-hop options.
839 	 */
840 	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
841 	    !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
842 				 ((skb_transport_header(skb)[1] + 1) << 3)))) {
843 		kfree_skb(skb);
844 		return -1;
845 	}
846 
847 	opt->flags |= IP6SKB_HOPBYHOP;
848 	if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
849 		skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
850 		opt = IP6CB(skb);
851 		opt->nhoff = sizeof(struct ipv6hdr);
852 		return 1;
853 	}
854 	return -1;
855 }
856 
857 /*
858  *	Creating outbound headers.
859  *
860  *	"build" functions work when skb is filled from head to tail (datagram)
861  *	"push"	functions work when headers are added from tail to head (tcp)
862  *
863  *	In both cases we assume, that caller reserved enough room
864  *	for headers.
865  */
866 
867 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
868 			     struct ipv6_rt_hdr *opt,
869 			     struct in6_addr **addr_p, struct in6_addr *saddr)
870 {
871 	struct rt0_hdr *phdr, *ihdr;
872 	int hops;
873 
874 	ihdr = (struct rt0_hdr *) opt;
875 
876 	phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
877 	memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
878 
879 	hops = ihdr->rt_hdr.hdrlen >> 1;
880 
881 	if (hops > 1)
882 		memcpy(phdr->addr, ihdr->addr + 1,
883 		       (hops - 1) * sizeof(struct in6_addr));
884 
885 	phdr->addr[hops - 1] = **addr_p;
886 	*addr_p = ihdr->addr;
887 
888 	phdr->rt_hdr.nexthdr = *proto;
889 	*proto = NEXTHDR_ROUTING;
890 }
891 
892 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
893 			     struct ipv6_rt_hdr *opt,
894 			     struct in6_addr **addr_p, struct in6_addr *saddr)
895 {
896 	struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
897 	int plen, hops;
898 
899 	sr_ihdr = (struct ipv6_sr_hdr *)opt;
900 	plen = (sr_ihdr->hdrlen + 1) << 3;
901 
902 	sr_phdr = (struct ipv6_sr_hdr *)skb_push(skb, plen);
903 	memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
904 
905 	hops = sr_ihdr->first_segment + 1;
906 	memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
907 	       (hops - 1) * sizeof(struct in6_addr));
908 
909 	sr_phdr->segments[0] = **addr_p;
910 	*addr_p = &sr_ihdr->segments[hops - 1];
911 
912 #ifdef CONFIG_IPV6_SEG6_HMAC
913 	if (sr_has_hmac(sr_phdr)) {
914 		struct net *net = NULL;
915 
916 		if (skb->dev)
917 			net = dev_net(skb->dev);
918 		else if (skb->sk)
919 			net = sock_net(skb->sk);
920 
921 		WARN_ON(!net);
922 
923 		if (net)
924 			seg6_push_hmac(net, saddr, sr_phdr);
925 	}
926 #endif
927 
928 	sr_phdr->nexthdr = *proto;
929 	*proto = NEXTHDR_ROUTING;
930 }
931 
932 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
933 			    struct ipv6_rt_hdr *opt,
934 			    struct in6_addr **addr_p, struct in6_addr *saddr)
935 {
936 	switch (opt->type) {
937 	case IPV6_SRCRT_TYPE_0:
938 		ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
939 		break;
940 	case IPV6_SRCRT_TYPE_4:
941 		ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
942 		break;
943 	default:
944 		break;
945 	}
946 }
947 
948 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
949 {
950 	struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));
951 
952 	memcpy(h, opt, ipv6_optlen(opt));
953 	h->nexthdr = *proto;
954 	*proto = type;
955 }
956 
957 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
958 			  u8 *proto,
959 			  struct in6_addr **daddr, struct in6_addr *saddr)
960 {
961 	if (opt->srcrt) {
962 		ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
963 		/*
964 		 * IPV6_RTHDRDSTOPTS is ignored
965 		 * unless IPV6_RTHDR is set (RFC3542).
966 		 */
967 		if (opt->dst0opt)
968 			ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
969 	}
970 	if (opt->hopopt)
971 		ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
972 }
973 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
974 
975 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
976 {
977 	if (opt->dst1opt)
978 		ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
979 }
980 
981 struct ipv6_txoptions *
982 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
983 {
984 	struct ipv6_txoptions *opt2;
985 
986 	opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
987 	if (opt2) {
988 		long dif = (char *)opt2 - (char *)opt;
989 		memcpy(opt2, opt, opt->tot_len);
990 		if (opt2->hopopt)
991 			*((char **)&opt2->hopopt) += dif;
992 		if (opt2->dst0opt)
993 			*((char **)&opt2->dst0opt) += dif;
994 		if (opt2->dst1opt)
995 			*((char **)&opt2->dst1opt) += dif;
996 		if (opt2->srcrt)
997 			*((char **)&opt2->srcrt) += dif;
998 		atomic_set(&opt2->refcnt, 1);
999 	}
1000 	return opt2;
1001 }
1002 EXPORT_SYMBOL_GPL(ipv6_dup_options);
1003 
1004 static int ipv6_renew_option(void *ohdr,
1005 			     struct ipv6_opt_hdr __user *newopt, int newoptlen,
1006 			     int inherit,
1007 			     struct ipv6_opt_hdr **hdr,
1008 			     char **p)
1009 {
1010 	if (inherit) {
1011 		if (ohdr) {
1012 			memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
1013 			*hdr = (struct ipv6_opt_hdr *)*p;
1014 			*p += CMSG_ALIGN(ipv6_optlen(*hdr));
1015 		}
1016 	} else {
1017 		if (newopt) {
1018 			if (copy_from_user(*p, newopt, newoptlen))
1019 				return -EFAULT;
1020 			*hdr = (struct ipv6_opt_hdr *)*p;
1021 			if (ipv6_optlen(*hdr) > newoptlen)
1022 				return -EINVAL;
1023 			*p += CMSG_ALIGN(newoptlen);
1024 		}
1025 	}
1026 	return 0;
1027 }
1028 
1029 /**
1030  * ipv6_renew_options - replace a specific ext hdr with a new one.
1031  *
1032  * @sk: sock from which to allocate memory
1033  * @opt: original options
1034  * @newtype: option type to replace in @opt
1035  * @newopt: new option of type @newtype to replace (user-mem)
1036  * @newoptlen: length of @newopt
1037  *
1038  * Returns a new set of options which is a copy of @opt with the
1039  * option type @newtype replaced with @newopt.
1040  *
1041  * @opt may be NULL, in which case a new set of options is returned
1042  * containing just @newopt.
1043  *
1044  * @newopt may be NULL, in which case the specified option type is
1045  * not copied into the new set of options.
1046  *
1047  * The new set of options is allocated from the socket option memory
1048  * buffer of @sk.
1049  */
1050 struct ipv6_txoptions *
1051 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1052 		   int newtype,
1053 		   struct ipv6_opt_hdr __user *newopt, int newoptlen)
1054 {
1055 	int tot_len = 0;
1056 	char *p;
1057 	struct ipv6_txoptions *opt2;
1058 	int err;
1059 
1060 	if (opt) {
1061 		if (newtype != IPV6_HOPOPTS && opt->hopopt)
1062 			tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1063 		if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1064 			tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1065 		if (newtype != IPV6_RTHDR && opt->srcrt)
1066 			tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1067 		if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1068 			tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1069 	}
1070 
1071 	if (newopt && newoptlen)
1072 		tot_len += CMSG_ALIGN(newoptlen);
1073 
1074 	if (!tot_len)
1075 		return NULL;
1076 
1077 	tot_len += sizeof(*opt2);
1078 	opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1079 	if (!opt2)
1080 		return ERR_PTR(-ENOBUFS);
1081 
1082 	memset(opt2, 0, tot_len);
1083 	atomic_set(&opt2->refcnt, 1);
1084 	opt2->tot_len = tot_len;
1085 	p = (char *)(opt2 + 1);
1086 
1087 	err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
1088 				newtype != IPV6_HOPOPTS,
1089 				&opt2->hopopt, &p);
1090 	if (err)
1091 		goto out;
1092 
1093 	err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
1094 				newtype != IPV6_RTHDRDSTOPTS,
1095 				&opt2->dst0opt, &p);
1096 	if (err)
1097 		goto out;
1098 
1099 	err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
1100 				newtype != IPV6_RTHDR,
1101 				(struct ipv6_opt_hdr **)&opt2->srcrt, &p);
1102 	if (err)
1103 		goto out;
1104 
1105 	err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
1106 				newtype != IPV6_DSTOPTS,
1107 				&opt2->dst1opt, &p);
1108 	if (err)
1109 		goto out;
1110 
1111 	opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1112 			  (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1113 			  (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1114 	opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1115 
1116 	return opt2;
1117 out:
1118 	sock_kfree_s(sk, opt2, opt2->tot_len);
1119 	return ERR_PTR(err);
1120 }
1121 
1122 /**
1123  * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
1124  *
1125  * @sk: sock from which to allocate memory
1126  * @opt: original options
1127  * @newtype: option type to replace in @opt
1128  * @newopt: new option of type @newtype to replace (kernel-mem)
1129  * @newoptlen: length of @newopt
1130  *
1131  * See ipv6_renew_options().  The difference is that @newopt is
1132  * kernel memory, rather than user memory.
1133  */
1134 struct ipv6_txoptions *
1135 ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
1136 			int newtype, struct ipv6_opt_hdr *newopt,
1137 			int newoptlen)
1138 {
1139 	struct ipv6_txoptions *ret_val;
1140 	const mm_segment_t old_fs = get_fs();
1141 
1142 	set_fs(KERNEL_DS);
1143 	ret_val = ipv6_renew_options(sk, opt, newtype,
1144 				     (struct ipv6_opt_hdr __user *)newopt,
1145 				     newoptlen);
1146 	set_fs(old_fs);
1147 	return ret_val;
1148 }
1149 
1150 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1151 					  struct ipv6_txoptions *opt)
1152 {
1153 	/*
1154 	 * ignore the dest before srcrt unless srcrt is being included.
1155 	 * --yoshfuji
1156 	 */
1157 	if (opt && opt->dst0opt && !opt->srcrt) {
1158 		if (opt_space != opt) {
1159 			memcpy(opt_space, opt, sizeof(*opt_space));
1160 			opt = opt_space;
1161 		}
1162 		opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1163 		opt->dst0opt = NULL;
1164 	}
1165 
1166 	return opt;
1167 }
1168 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1169 
1170 /**
1171  * fl6_update_dst - update flowi destination address with info given
1172  *                  by srcrt option, if any.
1173  *
1174  * @fl6: flowi6 for which daddr is to be updated
1175  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1176  * @orig: copy of original daddr address if modified
1177  *
1178  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1179  * and initial value of fl6->daddr set in orig
1180  */
1181 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1182 				const struct ipv6_txoptions *opt,
1183 				struct in6_addr *orig)
1184 {
1185 	if (!opt || !opt->srcrt)
1186 		return NULL;
1187 
1188 	*orig = fl6->daddr;
1189 
1190 	switch (opt->srcrt->type) {
1191 	case IPV6_SRCRT_TYPE_0:
1192 		fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1193 		break;
1194 	case IPV6_SRCRT_TYPE_4:
1195 	{
1196 		struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1197 
1198 		fl6->daddr = srh->segments[srh->first_segment];
1199 		break;
1200 	}
1201 	default:
1202 		return NULL;
1203 	}
1204 
1205 	return orig;
1206 }
1207 EXPORT_SYMBOL_GPL(fl6_update_dst);
1208