xref: /openbmc/linux/net/ipv6/route.c (revision f7777dcc)
1 /*
2  *	Linux INET6 implementation
3  *	FIB front-end.
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *
8  *	This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  */
13 
14 /*	Changes:
15  *
16  *	YOSHIFUJI Hideaki @USAGI
17  *		reworked default router selection.
18  *		- respect outgoing interface
19  *		- select from (probably) reachable routers (i.e.
20  *		routers in REACHABLE, STALE, DELAY or PROBE states).
21  *		- always select the same router if it is (probably)
22  *		reachable.  otherwise, round-robin the list.
23  *	Ville Nuorvala
24  *		Fixed routing subtrees.
25  */
26 
27 #define pr_fmt(fmt) "IPv6: " fmt
28 
29 #include <linux/capability.h>
30 #include <linux/errno.h>
31 #include <linux/export.h>
32 #include <linux/types.h>
33 #include <linux/times.h>
34 #include <linux/socket.h>
35 #include <linux/sockios.h>
36 #include <linux/net.h>
37 #include <linux/route.h>
38 #include <linux/netdevice.h>
39 #include <linux/in6.h>
40 #include <linux/mroute6.h>
41 #include <linux/init.h>
42 #include <linux/if_arp.h>
43 #include <linux/proc_fs.h>
44 #include <linux/seq_file.h>
45 #include <linux/nsproxy.h>
46 #include <linux/slab.h>
47 #include <net/net_namespace.h>
48 #include <net/snmp.h>
49 #include <net/ipv6.h>
50 #include <net/ip6_fib.h>
51 #include <net/ip6_route.h>
52 #include <net/ndisc.h>
53 #include <net/addrconf.h>
54 #include <net/tcp.h>
55 #include <linux/rtnetlink.h>
56 #include <net/dst.h>
57 #include <net/xfrm.h>
58 #include <net/netevent.h>
59 #include <net/netlink.h>
60 #include <net/nexthop.h>
61 
62 #include <asm/uaccess.h>
63 
64 #ifdef CONFIG_SYSCTL
65 #include <linux/sysctl.h>
66 #endif
67 
68 enum rt6_nud_state {
69 	RT6_NUD_FAIL_HARD = -2,
70 	RT6_NUD_FAIL_SOFT = -1,
71 	RT6_NUD_SUCCEED = 1
72 };
73 
74 static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
75 				    const struct in6_addr *dest);
76 static struct dst_entry	*ip6_dst_check(struct dst_entry *dst, u32 cookie);
77 static unsigned int	 ip6_default_advmss(const struct dst_entry *dst);
78 static unsigned int	 ip6_mtu(const struct dst_entry *dst);
79 static struct dst_entry *ip6_negative_advice(struct dst_entry *);
80 static void		ip6_dst_destroy(struct dst_entry *);
81 static void		ip6_dst_ifdown(struct dst_entry *,
82 				       struct net_device *dev, int how);
83 static int		 ip6_dst_gc(struct dst_ops *ops);
84 
85 static int		ip6_pkt_discard(struct sk_buff *skb);
86 static int		ip6_pkt_discard_out(struct sk_buff *skb);
87 static void		ip6_link_failure(struct sk_buff *skb);
88 static void		ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
89 					   struct sk_buff *skb, u32 mtu);
90 static void		rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
91 					struct sk_buff *skb);
92 static int rt6_score_route(struct rt6_info *rt, int oif, int strict);
93 
94 #ifdef CONFIG_IPV6_ROUTE_INFO
95 static struct rt6_info *rt6_add_route_info(struct net *net,
96 					   const struct in6_addr *prefix, int prefixlen,
97 					   const struct in6_addr *gwaddr, int ifindex,
98 					   unsigned int pref);
99 static struct rt6_info *rt6_get_route_info(struct net *net,
100 					   const struct in6_addr *prefix, int prefixlen,
101 					   const struct in6_addr *gwaddr, int ifindex);
102 #endif
103 
104 static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
105 {
106 	struct rt6_info *rt = (struct rt6_info *) dst;
107 	struct inet_peer *peer;
108 	u32 *p = NULL;
109 
110 	if (!(rt->dst.flags & DST_HOST))
111 		return NULL;
112 
113 	peer = rt6_get_peer_create(rt);
114 	if (peer) {
115 		u32 *old_p = __DST_METRICS_PTR(old);
116 		unsigned long prev, new;
117 
118 		p = peer->metrics;
119 		if (inet_metrics_new(peer))
120 			memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
121 
122 		new = (unsigned long) p;
123 		prev = cmpxchg(&dst->_metrics, old, new);
124 
125 		if (prev != old) {
126 			p = __DST_METRICS_PTR(prev);
127 			if (prev & DST_METRICS_READ_ONLY)
128 				p = NULL;
129 		}
130 	}
131 	return p;
132 }
133 
134 static inline const void *choose_neigh_daddr(struct rt6_info *rt,
135 					     struct sk_buff *skb,
136 					     const void *daddr)
137 {
138 	struct in6_addr *p = &rt->rt6i_gateway;
139 
140 	if (!ipv6_addr_any(p))
141 		return (const void *) p;
142 	else if (skb)
143 		return &ipv6_hdr(skb)->daddr;
144 	return daddr;
145 }
146 
147 static struct neighbour *ip6_neigh_lookup(const struct dst_entry *dst,
148 					  struct sk_buff *skb,
149 					  const void *daddr)
150 {
151 	struct rt6_info *rt = (struct rt6_info *) dst;
152 	struct neighbour *n;
153 
154 	daddr = choose_neigh_daddr(rt, skb, daddr);
155 	n = __ipv6_neigh_lookup(dst->dev, daddr);
156 	if (n)
157 		return n;
158 	return neigh_create(&nd_tbl, daddr, dst->dev);
159 }
160 
161 static struct dst_ops ip6_dst_ops_template = {
162 	.family			=	AF_INET6,
163 	.protocol		=	cpu_to_be16(ETH_P_IPV6),
164 	.gc			=	ip6_dst_gc,
165 	.gc_thresh		=	1024,
166 	.check			=	ip6_dst_check,
167 	.default_advmss		=	ip6_default_advmss,
168 	.mtu			=	ip6_mtu,
169 	.cow_metrics		=	ipv6_cow_metrics,
170 	.destroy		=	ip6_dst_destroy,
171 	.ifdown			=	ip6_dst_ifdown,
172 	.negative_advice	=	ip6_negative_advice,
173 	.link_failure		=	ip6_link_failure,
174 	.update_pmtu		=	ip6_rt_update_pmtu,
175 	.redirect		=	rt6_do_redirect,
176 	.local_out		=	__ip6_local_out,
177 	.neigh_lookup		=	ip6_neigh_lookup,
178 };
179 
180 static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
181 {
182 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
183 
184 	return mtu ? : dst->dev->mtu;
185 }
186 
187 static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
188 					 struct sk_buff *skb, u32 mtu)
189 {
190 }
191 
192 static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
193 				      struct sk_buff *skb)
194 {
195 }
196 
197 static u32 *ip6_rt_blackhole_cow_metrics(struct dst_entry *dst,
198 					 unsigned long old)
199 {
200 	return NULL;
201 }
202 
203 static struct dst_ops ip6_dst_blackhole_ops = {
204 	.family			=	AF_INET6,
205 	.protocol		=	cpu_to_be16(ETH_P_IPV6),
206 	.destroy		=	ip6_dst_destroy,
207 	.check			=	ip6_dst_check,
208 	.mtu			=	ip6_blackhole_mtu,
209 	.default_advmss		=	ip6_default_advmss,
210 	.update_pmtu		=	ip6_rt_blackhole_update_pmtu,
211 	.redirect		=	ip6_rt_blackhole_redirect,
212 	.cow_metrics		=	ip6_rt_blackhole_cow_metrics,
213 	.neigh_lookup		=	ip6_neigh_lookup,
214 };
215 
216 static const u32 ip6_template_metrics[RTAX_MAX] = {
217 	[RTAX_HOPLIMIT - 1] = 0,
218 };
219 
220 static const struct rt6_info ip6_null_entry_template = {
221 	.dst = {
222 		.__refcnt	= ATOMIC_INIT(1),
223 		.__use		= 1,
224 		.obsolete	= DST_OBSOLETE_FORCE_CHK,
225 		.error		= -ENETUNREACH,
226 		.input		= ip6_pkt_discard,
227 		.output		= ip6_pkt_discard_out,
228 	},
229 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
230 	.rt6i_protocol  = RTPROT_KERNEL,
231 	.rt6i_metric	= ~(u32) 0,
232 	.rt6i_ref	= ATOMIC_INIT(1),
233 };
234 
235 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
236 
237 static int ip6_pkt_prohibit(struct sk_buff *skb);
238 static int ip6_pkt_prohibit_out(struct sk_buff *skb);
239 
240 static const struct rt6_info ip6_prohibit_entry_template = {
241 	.dst = {
242 		.__refcnt	= ATOMIC_INIT(1),
243 		.__use		= 1,
244 		.obsolete	= DST_OBSOLETE_FORCE_CHK,
245 		.error		= -EACCES,
246 		.input		= ip6_pkt_prohibit,
247 		.output		= ip6_pkt_prohibit_out,
248 	},
249 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
250 	.rt6i_protocol  = RTPROT_KERNEL,
251 	.rt6i_metric	= ~(u32) 0,
252 	.rt6i_ref	= ATOMIC_INIT(1),
253 };
254 
255 static const struct rt6_info ip6_blk_hole_entry_template = {
256 	.dst = {
257 		.__refcnt	= ATOMIC_INIT(1),
258 		.__use		= 1,
259 		.obsolete	= DST_OBSOLETE_FORCE_CHK,
260 		.error		= -EINVAL,
261 		.input		= dst_discard,
262 		.output		= dst_discard,
263 	},
264 	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
265 	.rt6i_protocol  = RTPROT_KERNEL,
266 	.rt6i_metric	= ~(u32) 0,
267 	.rt6i_ref	= ATOMIC_INIT(1),
268 };
269 
270 #endif
271 
272 /* allocate dst with ip6_dst_ops */
273 static inline struct rt6_info *ip6_dst_alloc(struct net *net,
274 					     struct net_device *dev,
275 					     int flags,
276 					     struct fib6_table *table)
277 {
278 	struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
279 					0, DST_OBSOLETE_FORCE_CHK, flags);
280 
281 	if (rt) {
282 		struct dst_entry *dst = &rt->dst;
283 
284 		memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
285 		rt6_init_peer(rt, table ? &table->tb6_peers : net->ipv6.peers);
286 		rt->rt6i_genid = rt_genid_ipv6(net);
287 		INIT_LIST_HEAD(&rt->rt6i_siblings);
288 	}
289 	return rt;
290 }
291 
292 static void ip6_dst_destroy(struct dst_entry *dst)
293 {
294 	struct rt6_info *rt = (struct rt6_info *)dst;
295 	struct inet6_dev *idev = rt->rt6i_idev;
296 	struct dst_entry *from = dst->from;
297 
298 	if (!(rt->dst.flags & DST_HOST))
299 		dst_destroy_metrics_generic(dst);
300 
301 	if (idev) {
302 		rt->rt6i_idev = NULL;
303 		in6_dev_put(idev);
304 	}
305 
306 	dst->from = NULL;
307 	dst_release(from);
308 
309 	if (rt6_has_peer(rt)) {
310 		struct inet_peer *peer = rt6_peer_ptr(rt);
311 		inet_putpeer(peer);
312 	}
313 }
314 
315 void rt6_bind_peer(struct rt6_info *rt, int create)
316 {
317 	struct inet_peer_base *base;
318 	struct inet_peer *peer;
319 
320 	base = inetpeer_base_ptr(rt->_rt6i_peer);
321 	if (!base)
322 		return;
323 
324 	peer = inet_getpeer_v6(base, &rt->rt6i_dst.addr, create);
325 	if (peer) {
326 		if (!rt6_set_peer(rt, peer))
327 			inet_putpeer(peer);
328 	}
329 }
330 
331 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
332 			   int how)
333 {
334 	struct rt6_info *rt = (struct rt6_info *)dst;
335 	struct inet6_dev *idev = rt->rt6i_idev;
336 	struct net_device *loopback_dev =
337 		dev_net(dev)->loopback_dev;
338 
339 	if (dev != loopback_dev) {
340 		if (idev && idev->dev == dev) {
341 			struct inet6_dev *loopback_idev =
342 				in6_dev_get(loopback_dev);
343 			if (loopback_idev) {
344 				rt->rt6i_idev = loopback_idev;
345 				in6_dev_put(idev);
346 			}
347 		}
348 	}
349 }
350 
351 static bool rt6_check_expired(const struct rt6_info *rt)
352 {
353 	if (rt->rt6i_flags & RTF_EXPIRES) {
354 		if (time_after(jiffies, rt->dst.expires))
355 			return true;
356 	} else if (rt->dst.from) {
357 		return rt6_check_expired((struct rt6_info *) rt->dst.from);
358 	}
359 	return false;
360 }
361 
362 static bool rt6_need_strict(const struct in6_addr *daddr)
363 {
364 	return ipv6_addr_type(daddr) &
365 		(IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
366 }
367 
368 /* Multipath route selection:
369  *   Hash based function using packet header and flowlabel.
370  * Adapted from fib_info_hashfn()
371  */
372 static int rt6_info_hash_nhsfn(unsigned int candidate_count,
373 			       const struct flowi6 *fl6)
374 {
375 	unsigned int val = fl6->flowi6_proto;
376 
377 	val ^= ipv6_addr_hash(&fl6->daddr);
378 	val ^= ipv6_addr_hash(&fl6->saddr);
379 
380 	/* Work only if this not encapsulated */
381 	switch (fl6->flowi6_proto) {
382 	case IPPROTO_UDP:
383 	case IPPROTO_TCP:
384 	case IPPROTO_SCTP:
385 		val ^= (__force u16)fl6->fl6_sport;
386 		val ^= (__force u16)fl6->fl6_dport;
387 		break;
388 
389 	case IPPROTO_ICMPV6:
390 		val ^= (__force u16)fl6->fl6_icmp_type;
391 		val ^= (__force u16)fl6->fl6_icmp_code;
392 		break;
393 	}
394 	/* RFC6438 recommands to use flowlabel */
395 	val ^= (__force u32)fl6->flowlabel;
396 
397 	/* Perhaps, we need to tune, this function? */
398 	val = val ^ (val >> 7) ^ (val >> 12);
399 	return val % candidate_count;
400 }
401 
402 static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
403 					     struct flowi6 *fl6, int oif,
404 					     int strict)
405 {
406 	struct rt6_info *sibling, *next_sibling;
407 	int route_choosen;
408 
409 	route_choosen = rt6_info_hash_nhsfn(match->rt6i_nsiblings + 1, fl6);
410 	/* Don't change the route, if route_choosen == 0
411 	 * (siblings does not include ourself)
412 	 */
413 	if (route_choosen)
414 		list_for_each_entry_safe(sibling, next_sibling,
415 				&match->rt6i_siblings, rt6i_siblings) {
416 			route_choosen--;
417 			if (route_choosen == 0) {
418 				if (rt6_score_route(sibling, oif, strict) < 0)
419 					break;
420 				match = sibling;
421 				break;
422 			}
423 		}
424 	return match;
425 }
426 
427 /*
428  *	Route lookup. Any table->tb6_lock is implied.
429  */
430 
431 static inline struct rt6_info *rt6_device_match(struct net *net,
432 						    struct rt6_info *rt,
433 						    const struct in6_addr *saddr,
434 						    int oif,
435 						    int flags)
436 {
437 	struct rt6_info *local = NULL;
438 	struct rt6_info *sprt;
439 
440 	if (!oif && ipv6_addr_any(saddr))
441 		goto out;
442 
443 	for (sprt = rt; sprt; sprt = sprt->dst.rt6_next) {
444 		struct net_device *dev = sprt->dst.dev;
445 
446 		if (oif) {
447 			if (dev->ifindex == oif)
448 				return sprt;
449 			if (dev->flags & IFF_LOOPBACK) {
450 				if (!sprt->rt6i_idev ||
451 				    sprt->rt6i_idev->dev->ifindex != oif) {
452 					if (flags & RT6_LOOKUP_F_IFACE && oif)
453 						continue;
454 					if (local && (!oif ||
455 						      local->rt6i_idev->dev->ifindex == oif))
456 						continue;
457 				}
458 				local = sprt;
459 			}
460 		} else {
461 			if (ipv6_chk_addr(net, saddr, dev,
462 					  flags & RT6_LOOKUP_F_IFACE))
463 				return sprt;
464 		}
465 	}
466 
467 	if (oif) {
468 		if (local)
469 			return local;
470 
471 		if (flags & RT6_LOOKUP_F_IFACE)
472 			return net->ipv6.ip6_null_entry;
473 	}
474 out:
475 	return rt;
476 }
477 
478 #ifdef CONFIG_IPV6_ROUTER_PREF
479 struct __rt6_probe_work {
480 	struct work_struct work;
481 	struct in6_addr target;
482 	struct net_device *dev;
483 };
484 
485 static void rt6_probe_deferred(struct work_struct *w)
486 {
487 	struct in6_addr mcaddr;
488 	struct __rt6_probe_work *work =
489 		container_of(w, struct __rt6_probe_work, work);
490 
491 	addrconf_addr_solict_mult(&work->target, &mcaddr);
492 	ndisc_send_ns(work->dev, NULL, &work->target, &mcaddr, NULL);
493 	dev_put(work->dev);
494 	kfree(w);
495 }
496 
497 static void rt6_probe(struct rt6_info *rt)
498 {
499 	struct neighbour *neigh;
500 	/*
501 	 * Okay, this does not seem to be appropriate
502 	 * for now, however, we need to check if it
503 	 * is really so; aka Router Reachability Probing.
504 	 *
505 	 * Router Reachability Probe MUST be rate-limited
506 	 * to no more than one per minute.
507 	 */
508 	if (!rt || !(rt->rt6i_flags & RTF_GATEWAY))
509 		return;
510 	rcu_read_lock_bh();
511 	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
512 	if (neigh) {
513 		write_lock(&neigh->lock);
514 		if (neigh->nud_state & NUD_VALID)
515 			goto out;
516 	}
517 
518 	if (!neigh ||
519 	    time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
520 		struct __rt6_probe_work *work;
521 
522 		work = kmalloc(sizeof(*work), GFP_ATOMIC);
523 
524 		if (neigh && work)
525 			neigh->updated = jiffies;
526 
527 		if (neigh)
528 			write_unlock(&neigh->lock);
529 
530 		if (work) {
531 			INIT_WORK(&work->work, rt6_probe_deferred);
532 			work->target = rt->rt6i_gateway;
533 			dev_hold(rt->dst.dev);
534 			work->dev = rt->dst.dev;
535 			schedule_work(&work->work);
536 		}
537 	} else {
538 out:
539 		write_unlock(&neigh->lock);
540 	}
541 	rcu_read_unlock_bh();
542 }
543 #else
544 static inline void rt6_probe(struct rt6_info *rt)
545 {
546 }
547 #endif
548 
549 /*
550  * Default Router Selection (RFC 2461 6.3.6)
551  */
552 static inline int rt6_check_dev(struct rt6_info *rt, int oif)
553 {
554 	struct net_device *dev = rt->dst.dev;
555 	if (!oif || dev->ifindex == oif)
556 		return 2;
557 	if ((dev->flags & IFF_LOOPBACK) &&
558 	    rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
559 		return 1;
560 	return 0;
561 }
562 
563 static inline enum rt6_nud_state rt6_check_neigh(struct rt6_info *rt)
564 {
565 	struct neighbour *neigh;
566 	enum rt6_nud_state ret = RT6_NUD_FAIL_HARD;
567 
568 	if (rt->rt6i_flags & RTF_NONEXTHOP ||
569 	    !(rt->rt6i_flags & RTF_GATEWAY))
570 		return RT6_NUD_SUCCEED;
571 
572 	rcu_read_lock_bh();
573 	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
574 	if (neigh) {
575 		read_lock(&neigh->lock);
576 		if (neigh->nud_state & NUD_VALID)
577 			ret = RT6_NUD_SUCCEED;
578 #ifdef CONFIG_IPV6_ROUTER_PREF
579 		else if (!(neigh->nud_state & NUD_FAILED))
580 			ret = RT6_NUD_SUCCEED;
581 #endif
582 		read_unlock(&neigh->lock);
583 	} else {
584 		ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
585 		      RT6_NUD_SUCCEED : RT6_NUD_FAIL_SOFT;
586 	}
587 	rcu_read_unlock_bh();
588 
589 	return ret;
590 }
591 
592 static int rt6_score_route(struct rt6_info *rt, int oif,
593 			   int strict)
594 {
595 	int m;
596 
597 	m = rt6_check_dev(rt, oif);
598 	if (!m && (strict & RT6_LOOKUP_F_IFACE))
599 		return RT6_NUD_FAIL_HARD;
600 #ifdef CONFIG_IPV6_ROUTER_PREF
601 	m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
602 #endif
603 	if (strict & RT6_LOOKUP_F_REACHABLE) {
604 		int n = rt6_check_neigh(rt);
605 		if (n < 0)
606 			return n;
607 	}
608 	return m;
609 }
610 
611 static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
612 				   int *mpri, struct rt6_info *match,
613 				   bool *do_rr)
614 {
615 	int m;
616 	bool match_do_rr = false;
617 
618 	if (rt6_check_expired(rt))
619 		goto out;
620 
621 	m = rt6_score_route(rt, oif, strict);
622 	if (m == RT6_NUD_FAIL_SOFT && !IS_ENABLED(CONFIG_IPV6_ROUTER_PREF)) {
623 		match_do_rr = true;
624 		m = 0; /* lowest valid score */
625 	} else if (m < 0) {
626 		goto out;
627 	}
628 
629 	if (strict & RT6_LOOKUP_F_REACHABLE)
630 		rt6_probe(rt);
631 
632 	if (m > *mpri) {
633 		*do_rr = match_do_rr;
634 		*mpri = m;
635 		match = rt;
636 	}
637 out:
638 	return match;
639 }
640 
641 static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
642 				     struct rt6_info *rr_head,
643 				     u32 metric, int oif, int strict,
644 				     bool *do_rr)
645 {
646 	struct rt6_info *rt, *match;
647 	int mpri = -1;
648 
649 	match = NULL;
650 	for (rt = rr_head; rt && rt->rt6i_metric == metric;
651 	     rt = rt->dst.rt6_next)
652 		match = find_match(rt, oif, strict, &mpri, match, do_rr);
653 	for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
654 	     rt = rt->dst.rt6_next)
655 		match = find_match(rt, oif, strict, &mpri, match, do_rr);
656 
657 	return match;
658 }
659 
660 static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
661 {
662 	struct rt6_info *match, *rt0;
663 	struct net *net;
664 	bool do_rr = false;
665 
666 	rt0 = fn->rr_ptr;
667 	if (!rt0)
668 		fn->rr_ptr = rt0 = fn->leaf;
669 
670 	match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict,
671 			     &do_rr);
672 
673 	if (do_rr) {
674 		struct rt6_info *next = rt0->dst.rt6_next;
675 
676 		/* no entries matched; do round-robin */
677 		if (!next || next->rt6i_metric != rt0->rt6i_metric)
678 			next = fn->leaf;
679 
680 		if (next != rt0)
681 			fn->rr_ptr = next;
682 	}
683 
684 	net = dev_net(rt0->dst.dev);
685 	return match ? match : net->ipv6.ip6_null_entry;
686 }
687 
688 #ifdef CONFIG_IPV6_ROUTE_INFO
689 int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
690 		  const struct in6_addr *gwaddr)
691 {
692 	struct net *net = dev_net(dev);
693 	struct route_info *rinfo = (struct route_info *) opt;
694 	struct in6_addr prefix_buf, *prefix;
695 	unsigned int pref;
696 	unsigned long lifetime;
697 	struct rt6_info *rt;
698 
699 	if (len < sizeof(struct route_info)) {
700 		return -EINVAL;
701 	}
702 
703 	/* Sanity check for prefix_len and length */
704 	if (rinfo->length > 3) {
705 		return -EINVAL;
706 	} else if (rinfo->prefix_len > 128) {
707 		return -EINVAL;
708 	} else if (rinfo->prefix_len > 64) {
709 		if (rinfo->length < 2) {
710 			return -EINVAL;
711 		}
712 	} else if (rinfo->prefix_len > 0) {
713 		if (rinfo->length < 1) {
714 			return -EINVAL;
715 		}
716 	}
717 
718 	pref = rinfo->route_pref;
719 	if (pref == ICMPV6_ROUTER_PREF_INVALID)
720 		return -EINVAL;
721 
722 	lifetime = addrconf_timeout_fixup(ntohl(rinfo->lifetime), HZ);
723 
724 	if (rinfo->length == 3)
725 		prefix = (struct in6_addr *)rinfo->prefix;
726 	else {
727 		/* this function is safe */
728 		ipv6_addr_prefix(&prefix_buf,
729 				 (struct in6_addr *)rinfo->prefix,
730 				 rinfo->prefix_len);
731 		prefix = &prefix_buf;
732 	}
733 
734 	rt = rt6_get_route_info(net, prefix, rinfo->prefix_len, gwaddr,
735 				dev->ifindex);
736 
737 	if (rt && !lifetime) {
738 		ip6_del_rt(rt);
739 		rt = NULL;
740 	}
741 
742 	if (!rt && lifetime)
743 		rt = rt6_add_route_info(net, prefix, rinfo->prefix_len, gwaddr, dev->ifindex,
744 					pref);
745 	else if (rt)
746 		rt->rt6i_flags = RTF_ROUTEINFO |
747 				 (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
748 
749 	if (rt) {
750 		if (!addrconf_finite_timeout(lifetime))
751 			rt6_clean_expires(rt);
752 		else
753 			rt6_set_expires(rt, jiffies + HZ * lifetime);
754 
755 		ip6_rt_put(rt);
756 	}
757 	return 0;
758 }
759 #endif
760 
761 #define BACKTRACK(__net, saddr)			\
762 do { \
763 	if (rt == __net->ipv6.ip6_null_entry) {	\
764 		struct fib6_node *pn; \
765 		while (1) { \
766 			if (fn->fn_flags & RTN_TL_ROOT) \
767 				goto out; \
768 			pn = fn->parent; \
769 			if (FIB6_SUBTREE(pn) && FIB6_SUBTREE(pn) != fn) \
770 				fn = fib6_lookup(FIB6_SUBTREE(pn), NULL, saddr); \
771 			else \
772 				fn = pn; \
773 			if (fn->fn_flags & RTN_RTINFO) \
774 				goto restart; \
775 		} \
776 	} \
777 } while (0)
778 
779 static struct rt6_info *ip6_pol_route_lookup(struct net *net,
780 					     struct fib6_table *table,
781 					     struct flowi6 *fl6, int flags)
782 {
783 	struct fib6_node *fn;
784 	struct rt6_info *rt;
785 
786 	read_lock_bh(&table->tb6_lock);
787 	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
788 restart:
789 	rt = fn->leaf;
790 	rt = rt6_device_match(net, rt, &fl6->saddr, fl6->flowi6_oif, flags);
791 	if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
792 		rt = rt6_multipath_select(rt, fl6, fl6->flowi6_oif, flags);
793 	BACKTRACK(net, &fl6->saddr);
794 out:
795 	dst_use(&rt->dst, jiffies);
796 	read_unlock_bh(&table->tb6_lock);
797 	return rt;
798 
799 }
800 
801 struct dst_entry * ip6_route_lookup(struct net *net, struct flowi6 *fl6,
802 				    int flags)
803 {
804 	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_lookup);
805 }
806 EXPORT_SYMBOL_GPL(ip6_route_lookup);
807 
808 struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
809 			    const struct in6_addr *saddr, int oif, int strict)
810 {
811 	struct flowi6 fl6 = {
812 		.flowi6_oif = oif,
813 		.daddr = *daddr,
814 	};
815 	struct dst_entry *dst;
816 	int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
817 
818 	if (saddr) {
819 		memcpy(&fl6.saddr, saddr, sizeof(*saddr));
820 		flags |= RT6_LOOKUP_F_HAS_SADDR;
821 	}
822 
823 	dst = fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_lookup);
824 	if (dst->error == 0)
825 		return (struct rt6_info *) dst;
826 
827 	dst_release(dst);
828 
829 	return NULL;
830 }
831 
832 EXPORT_SYMBOL(rt6_lookup);
833 
834 /* ip6_ins_rt is called with FREE table->tb6_lock.
835    It takes new route entry, the addition fails by any reason the
836    route is freed. In any case, if caller does not hold it, it may
837    be destroyed.
838  */
839 
840 static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info)
841 {
842 	int err;
843 	struct fib6_table *table;
844 
845 	table = rt->rt6i_table;
846 	write_lock_bh(&table->tb6_lock);
847 	err = fib6_add(&table->tb6_root, rt, info);
848 	write_unlock_bh(&table->tb6_lock);
849 
850 	return err;
851 }
852 
853 int ip6_ins_rt(struct rt6_info *rt)
854 {
855 	struct nl_info info = {
856 		.nl_net = dev_net(rt->dst.dev),
857 	};
858 	return __ip6_ins_rt(rt, &info);
859 }
860 
861 static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort,
862 				      const struct in6_addr *daddr,
863 				      const struct in6_addr *saddr)
864 {
865 	struct rt6_info *rt;
866 
867 	/*
868 	 *	Clone the route.
869 	 */
870 
871 	rt = ip6_rt_copy(ort, daddr);
872 
873 	if (rt) {
874 		if (!(rt->rt6i_flags & RTF_GATEWAY)) {
875 			if (ort->rt6i_dst.plen != 128 &&
876 			    ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
877 				rt->rt6i_flags |= RTF_ANYCAST;
878 		}
879 
880 		rt->rt6i_flags |= RTF_CACHE;
881 
882 #ifdef CONFIG_IPV6_SUBTREES
883 		if (rt->rt6i_src.plen && saddr) {
884 			rt->rt6i_src.addr = *saddr;
885 			rt->rt6i_src.plen = 128;
886 		}
887 #endif
888 	}
889 
890 	return rt;
891 }
892 
893 static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort,
894 					const struct in6_addr *daddr)
895 {
896 	struct rt6_info *rt = ip6_rt_copy(ort, daddr);
897 
898 	if (rt)
899 		rt->rt6i_flags |= RTF_CACHE;
900 	return rt;
901 }
902 
903 static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, int oif,
904 				      struct flowi6 *fl6, int flags)
905 {
906 	struct fib6_node *fn;
907 	struct rt6_info *rt, *nrt;
908 	int strict = 0;
909 	int attempts = 3;
910 	int err;
911 	int reachable = net->ipv6.devconf_all->forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
912 
913 	strict |= flags & RT6_LOOKUP_F_IFACE;
914 
915 relookup:
916 	read_lock_bh(&table->tb6_lock);
917 
918 restart_2:
919 	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
920 
921 restart:
922 	rt = rt6_select(fn, oif, strict | reachable);
923 	if (rt->rt6i_nsiblings)
924 		rt = rt6_multipath_select(rt, fl6, oif, strict | reachable);
925 	BACKTRACK(net, &fl6->saddr);
926 	if (rt == net->ipv6.ip6_null_entry ||
927 	    rt->rt6i_flags & RTF_CACHE)
928 		goto out;
929 
930 	dst_hold(&rt->dst);
931 	read_unlock_bh(&table->tb6_lock);
932 
933 	if (!(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_GATEWAY)))
934 		nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
935 	else if (!(rt->dst.flags & DST_HOST))
936 		nrt = rt6_alloc_clone(rt, &fl6->daddr);
937 	else
938 		goto out2;
939 
940 	ip6_rt_put(rt);
941 	rt = nrt ? : net->ipv6.ip6_null_entry;
942 
943 	dst_hold(&rt->dst);
944 	if (nrt) {
945 		err = ip6_ins_rt(nrt);
946 		if (!err)
947 			goto out2;
948 	}
949 
950 	if (--attempts <= 0)
951 		goto out2;
952 
953 	/*
954 	 * Race condition! In the gap, when table->tb6_lock was
955 	 * released someone could insert this route.  Relookup.
956 	 */
957 	ip6_rt_put(rt);
958 	goto relookup;
959 
960 out:
961 	if (reachable) {
962 		reachable = 0;
963 		goto restart_2;
964 	}
965 	dst_hold(&rt->dst);
966 	read_unlock_bh(&table->tb6_lock);
967 out2:
968 	rt->dst.lastuse = jiffies;
969 	rt->dst.__use++;
970 
971 	return rt;
972 }
973 
974 static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
975 					    struct flowi6 *fl6, int flags)
976 {
977 	return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
978 }
979 
980 static struct dst_entry *ip6_route_input_lookup(struct net *net,
981 						struct net_device *dev,
982 						struct flowi6 *fl6, int flags)
983 {
984 	if (rt6_need_strict(&fl6->daddr) && dev->type != ARPHRD_PIMREG)
985 		flags |= RT6_LOOKUP_F_IFACE;
986 
987 	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_input);
988 }
989 
990 void ip6_route_input(struct sk_buff *skb)
991 {
992 	const struct ipv6hdr *iph = ipv6_hdr(skb);
993 	struct net *net = dev_net(skb->dev);
994 	int flags = RT6_LOOKUP_F_HAS_SADDR;
995 	struct flowi6 fl6 = {
996 		.flowi6_iif = skb->dev->ifindex,
997 		.daddr = iph->daddr,
998 		.saddr = iph->saddr,
999 		.flowlabel = ip6_flowinfo(iph),
1000 		.flowi6_mark = skb->mark,
1001 		.flowi6_proto = iph->nexthdr,
1002 	};
1003 
1004 	skb_dst_set(skb, ip6_route_input_lookup(net, skb->dev, &fl6, flags));
1005 }
1006 
1007 static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
1008 					     struct flowi6 *fl6, int flags)
1009 {
1010 	return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
1011 }
1012 
1013 struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,
1014 				    struct flowi6 *fl6)
1015 {
1016 	int flags = 0;
1017 
1018 	fl6->flowi6_iif = LOOPBACK_IFINDEX;
1019 
1020 	if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
1021 		flags |= RT6_LOOKUP_F_IFACE;
1022 
1023 	if (!ipv6_addr_any(&fl6->saddr))
1024 		flags |= RT6_LOOKUP_F_HAS_SADDR;
1025 	else if (sk)
1026 		flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
1027 
1028 	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_output);
1029 }
1030 
1031 EXPORT_SYMBOL(ip6_route_output);
1032 
1033 struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
1034 {
1035 	struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
1036 	struct dst_entry *new = NULL;
1037 
1038 	rt = dst_alloc(&ip6_dst_blackhole_ops, ort->dst.dev, 1, DST_OBSOLETE_NONE, 0);
1039 	if (rt) {
1040 		new = &rt->dst;
1041 
1042 		memset(new + 1, 0, sizeof(*rt) - sizeof(*new));
1043 		rt6_init_peer(rt, net->ipv6.peers);
1044 
1045 		new->__use = 1;
1046 		new->input = dst_discard;
1047 		new->output = dst_discard;
1048 
1049 		if (dst_metrics_read_only(&ort->dst))
1050 			new->_metrics = ort->dst._metrics;
1051 		else
1052 			dst_copy_metrics(new, &ort->dst);
1053 		rt->rt6i_idev = ort->rt6i_idev;
1054 		if (rt->rt6i_idev)
1055 			in6_dev_hold(rt->rt6i_idev);
1056 
1057 		rt->rt6i_gateway = ort->rt6i_gateway;
1058 		rt->rt6i_flags = ort->rt6i_flags;
1059 		rt->rt6i_metric = 0;
1060 
1061 		memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
1062 #ifdef CONFIG_IPV6_SUBTREES
1063 		memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
1064 #endif
1065 
1066 		dst_free(new);
1067 	}
1068 
1069 	dst_release(dst_orig);
1070 	return new ? new : ERR_PTR(-ENOMEM);
1071 }
1072 
1073 /*
1074  *	Destination cache support functions
1075  */
1076 
1077 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
1078 {
1079 	struct rt6_info *rt;
1080 
1081 	rt = (struct rt6_info *) dst;
1082 
1083 	/* All IPV6 dsts are created with ->obsolete set to the value
1084 	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
1085 	 * into this function always.
1086 	 */
1087 	if (rt->rt6i_genid != rt_genid_ipv6(dev_net(rt->dst.dev)))
1088 		return NULL;
1089 
1090 	if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
1091 		return dst;
1092 
1093 	return NULL;
1094 }
1095 
1096 static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
1097 {
1098 	struct rt6_info *rt = (struct rt6_info *) dst;
1099 
1100 	if (rt) {
1101 		if (rt->rt6i_flags & RTF_CACHE) {
1102 			if (rt6_check_expired(rt)) {
1103 				ip6_del_rt(rt);
1104 				dst = NULL;
1105 			}
1106 		} else {
1107 			dst_release(dst);
1108 			dst = NULL;
1109 		}
1110 	}
1111 	return dst;
1112 }
1113 
1114 static void ip6_link_failure(struct sk_buff *skb)
1115 {
1116 	struct rt6_info *rt;
1117 
1118 	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
1119 
1120 	rt = (struct rt6_info *) skb_dst(skb);
1121 	if (rt) {
1122 		if (rt->rt6i_flags & RTF_CACHE) {
1123 			dst_hold(&rt->dst);
1124 			if (ip6_del_rt(rt))
1125 				dst_free(&rt->dst);
1126 		} else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
1127 			rt->rt6i_node->fn_sernum = -1;
1128 		}
1129 	}
1130 }
1131 
1132 static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
1133 			       struct sk_buff *skb, u32 mtu)
1134 {
1135 	struct rt6_info *rt6 = (struct rt6_info*)dst;
1136 
1137 	dst_confirm(dst);
1138 	if (mtu < dst_mtu(dst) && rt6->rt6i_dst.plen == 128) {
1139 		struct net *net = dev_net(dst->dev);
1140 
1141 		rt6->rt6i_flags |= RTF_MODIFIED;
1142 		if (mtu < IPV6_MIN_MTU) {
1143 			u32 features = dst_metric(dst, RTAX_FEATURES);
1144 			mtu = IPV6_MIN_MTU;
1145 			features |= RTAX_FEATURE_ALLFRAG;
1146 			dst_metric_set(dst, RTAX_FEATURES, features);
1147 		}
1148 		dst_metric_set(dst, RTAX_MTU, mtu);
1149 		rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
1150 	}
1151 }
1152 
1153 void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
1154 		     int oif, u32 mark)
1155 {
1156 	const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
1157 	struct dst_entry *dst;
1158 	struct flowi6 fl6;
1159 
1160 	memset(&fl6, 0, sizeof(fl6));
1161 	fl6.flowi6_oif = oif;
1162 	fl6.flowi6_mark = mark;
1163 	fl6.flowi6_flags = 0;
1164 	fl6.daddr = iph->daddr;
1165 	fl6.saddr = iph->saddr;
1166 	fl6.flowlabel = ip6_flowinfo(iph);
1167 
1168 	dst = ip6_route_output(net, NULL, &fl6);
1169 	if (!dst->error)
1170 		ip6_rt_update_pmtu(dst, NULL, skb, ntohl(mtu));
1171 	dst_release(dst);
1172 }
1173 EXPORT_SYMBOL_GPL(ip6_update_pmtu);
1174 
1175 void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
1176 {
1177 	ip6_update_pmtu(skb, sock_net(sk), mtu,
1178 			sk->sk_bound_dev_if, sk->sk_mark);
1179 }
1180 EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);
1181 
1182 /* Handle redirects */
1183 struct ip6rd_flowi {
1184 	struct flowi6 fl6;
1185 	struct in6_addr gateway;
1186 };
1187 
1188 static struct rt6_info *__ip6_route_redirect(struct net *net,
1189 					     struct fib6_table *table,
1190 					     struct flowi6 *fl6,
1191 					     int flags)
1192 {
1193 	struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
1194 	struct rt6_info *rt;
1195 	struct fib6_node *fn;
1196 
1197 	/* Get the "current" route for this destination and
1198 	 * check if the redirect has come from approriate router.
1199 	 *
1200 	 * RFC 4861 specifies that redirects should only be
1201 	 * accepted if they come from the nexthop to the target.
1202 	 * Due to the way the routes are chosen, this notion
1203 	 * is a bit fuzzy and one might need to check all possible
1204 	 * routes.
1205 	 */
1206 
1207 	read_lock_bh(&table->tb6_lock);
1208 	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
1209 restart:
1210 	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
1211 		if (rt6_check_expired(rt))
1212 			continue;
1213 		if (rt->dst.error)
1214 			break;
1215 		if (!(rt->rt6i_flags & RTF_GATEWAY))
1216 			continue;
1217 		if (fl6->flowi6_oif != rt->dst.dev->ifindex)
1218 			continue;
1219 		if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway))
1220 			continue;
1221 		break;
1222 	}
1223 
1224 	if (!rt)
1225 		rt = net->ipv6.ip6_null_entry;
1226 	else if (rt->dst.error) {
1227 		rt = net->ipv6.ip6_null_entry;
1228 		goto out;
1229 	}
1230 	BACKTRACK(net, &fl6->saddr);
1231 out:
1232 	dst_hold(&rt->dst);
1233 
1234 	read_unlock_bh(&table->tb6_lock);
1235 
1236 	return rt;
1237 };
1238 
1239 static struct dst_entry *ip6_route_redirect(struct net *net,
1240 					const struct flowi6 *fl6,
1241 					const struct in6_addr *gateway)
1242 {
1243 	int flags = RT6_LOOKUP_F_HAS_SADDR;
1244 	struct ip6rd_flowi rdfl;
1245 
1246 	rdfl.fl6 = *fl6;
1247 	rdfl.gateway = *gateway;
1248 
1249 	return fib6_rule_lookup(net, &rdfl.fl6,
1250 				flags, __ip6_route_redirect);
1251 }
1252 
1253 void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
1254 {
1255 	const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
1256 	struct dst_entry *dst;
1257 	struct flowi6 fl6;
1258 
1259 	memset(&fl6, 0, sizeof(fl6));
1260 	fl6.flowi6_oif = oif;
1261 	fl6.flowi6_mark = mark;
1262 	fl6.flowi6_flags = 0;
1263 	fl6.daddr = iph->daddr;
1264 	fl6.saddr = iph->saddr;
1265 	fl6.flowlabel = ip6_flowinfo(iph);
1266 
1267 	dst = ip6_route_redirect(net, &fl6, &ipv6_hdr(skb)->saddr);
1268 	rt6_do_redirect(dst, NULL, skb);
1269 	dst_release(dst);
1270 }
1271 EXPORT_SYMBOL_GPL(ip6_redirect);
1272 
1273 void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
1274 			    u32 mark)
1275 {
1276 	const struct ipv6hdr *iph = ipv6_hdr(skb);
1277 	const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
1278 	struct dst_entry *dst;
1279 	struct flowi6 fl6;
1280 
1281 	memset(&fl6, 0, sizeof(fl6));
1282 	fl6.flowi6_oif = oif;
1283 	fl6.flowi6_mark = mark;
1284 	fl6.flowi6_flags = 0;
1285 	fl6.daddr = msg->dest;
1286 	fl6.saddr = iph->daddr;
1287 
1288 	dst = ip6_route_redirect(net, &fl6, &iph->saddr);
1289 	rt6_do_redirect(dst, NULL, skb);
1290 	dst_release(dst);
1291 }
1292 
1293 void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
1294 {
1295 	ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark);
1296 }
1297 EXPORT_SYMBOL_GPL(ip6_sk_redirect);
1298 
1299 static unsigned int ip6_default_advmss(const struct dst_entry *dst)
1300 {
1301 	struct net_device *dev = dst->dev;
1302 	unsigned int mtu = dst_mtu(dst);
1303 	struct net *net = dev_net(dev);
1304 
1305 	mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
1306 
1307 	if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
1308 		mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
1309 
1310 	/*
1311 	 * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
1312 	 * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
1313 	 * IPV6_MAXPLEN is also valid and means: "any MSS,
1314 	 * rely only on pmtu discovery"
1315 	 */
1316 	if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
1317 		mtu = IPV6_MAXPLEN;
1318 	return mtu;
1319 }
1320 
1321 static unsigned int ip6_mtu(const struct dst_entry *dst)
1322 {
1323 	struct inet6_dev *idev;
1324 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
1325 
1326 	if (mtu)
1327 		return mtu;
1328 
1329 	mtu = IPV6_MIN_MTU;
1330 
1331 	rcu_read_lock();
1332 	idev = __in6_dev_get(dst->dev);
1333 	if (idev)
1334 		mtu = idev->cnf.mtu6;
1335 	rcu_read_unlock();
1336 
1337 	return mtu;
1338 }
1339 
1340 static struct dst_entry *icmp6_dst_gc_list;
1341 static DEFINE_SPINLOCK(icmp6_dst_lock);
1342 
1343 struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
1344 				  struct flowi6 *fl6)
1345 {
1346 	struct dst_entry *dst;
1347 	struct rt6_info *rt;
1348 	struct inet6_dev *idev = in6_dev_get(dev);
1349 	struct net *net = dev_net(dev);
1350 
1351 	if (unlikely(!idev))
1352 		return ERR_PTR(-ENODEV);
1353 
1354 	rt = ip6_dst_alloc(net, dev, 0, NULL);
1355 	if (unlikely(!rt)) {
1356 		in6_dev_put(idev);
1357 		dst = ERR_PTR(-ENOMEM);
1358 		goto out;
1359 	}
1360 
1361 	rt->dst.flags |= DST_HOST;
1362 	rt->dst.output  = ip6_output;
1363 	atomic_set(&rt->dst.__refcnt, 1);
1364 	rt->rt6i_gateway  = fl6->daddr;
1365 	rt->rt6i_dst.addr = fl6->daddr;
1366 	rt->rt6i_dst.plen = 128;
1367 	rt->rt6i_idev     = idev;
1368 	dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 0);
1369 
1370 	spin_lock_bh(&icmp6_dst_lock);
1371 	rt->dst.next = icmp6_dst_gc_list;
1372 	icmp6_dst_gc_list = &rt->dst;
1373 	spin_unlock_bh(&icmp6_dst_lock);
1374 
1375 	fib6_force_start_gc(net);
1376 
1377 	dst = xfrm_lookup(net, &rt->dst, flowi6_to_flowi(fl6), NULL, 0);
1378 
1379 out:
1380 	return dst;
1381 }
1382 
1383 int icmp6_dst_gc(void)
1384 {
1385 	struct dst_entry *dst, **pprev;
1386 	int more = 0;
1387 
1388 	spin_lock_bh(&icmp6_dst_lock);
1389 	pprev = &icmp6_dst_gc_list;
1390 
1391 	while ((dst = *pprev) != NULL) {
1392 		if (!atomic_read(&dst->__refcnt)) {
1393 			*pprev = dst->next;
1394 			dst_free(dst);
1395 		} else {
1396 			pprev = &dst->next;
1397 			++more;
1398 		}
1399 	}
1400 
1401 	spin_unlock_bh(&icmp6_dst_lock);
1402 
1403 	return more;
1404 }
1405 
1406 static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
1407 			    void *arg)
1408 {
1409 	struct dst_entry *dst, **pprev;
1410 
1411 	spin_lock_bh(&icmp6_dst_lock);
1412 	pprev = &icmp6_dst_gc_list;
1413 	while ((dst = *pprev) != NULL) {
1414 		struct rt6_info *rt = (struct rt6_info *) dst;
1415 		if (func(rt, arg)) {
1416 			*pprev = dst->next;
1417 			dst_free(dst);
1418 		} else {
1419 			pprev = &dst->next;
1420 		}
1421 	}
1422 	spin_unlock_bh(&icmp6_dst_lock);
1423 }
1424 
1425 static int ip6_dst_gc(struct dst_ops *ops)
1426 {
1427 	struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
1428 	int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
1429 	int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
1430 	int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
1431 	int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
1432 	unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
1433 	int entries;
1434 
1435 	entries = dst_entries_get_fast(ops);
1436 	if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
1437 	    entries <= rt_max_size)
1438 		goto out;
1439 
1440 	net->ipv6.ip6_rt_gc_expire++;
1441 	fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
1442 	entries = dst_entries_get_slow(ops);
1443 	if (entries < ops->gc_thresh)
1444 		net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
1445 out:
1446 	net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
1447 	return entries > rt_max_size;
1448 }
1449 
1450 /*
1451  *
1452  */
1453 
1454 int ip6_route_add(struct fib6_config *cfg)
1455 {
1456 	int err;
1457 	struct net *net = cfg->fc_nlinfo.nl_net;
1458 	struct rt6_info *rt = NULL;
1459 	struct net_device *dev = NULL;
1460 	struct inet6_dev *idev = NULL;
1461 	struct fib6_table *table;
1462 	int addr_type;
1463 
1464 	if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
1465 		return -EINVAL;
1466 #ifndef CONFIG_IPV6_SUBTREES
1467 	if (cfg->fc_src_len)
1468 		return -EINVAL;
1469 #endif
1470 	if (cfg->fc_ifindex) {
1471 		err = -ENODEV;
1472 		dev = dev_get_by_index(net, cfg->fc_ifindex);
1473 		if (!dev)
1474 			goto out;
1475 		idev = in6_dev_get(dev);
1476 		if (!idev)
1477 			goto out;
1478 	}
1479 
1480 	if (cfg->fc_metric == 0)
1481 		cfg->fc_metric = IP6_RT_PRIO_USER;
1482 
1483 	err = -ENOBUFS;
1484 	if (cfg->fc_nlinfo.nlh &&
1485 	    !(cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_CREATE)) {
1486 		table = fib6_get_table(net, cfg->fc_table);
1487 		if (!table) {
1488 			pr_warn("NLM_F_CREATE should be specified when creating new route\n");
1489 			table = fib6_new_table(net, cfg->fc_table);
1490 		}
1491 	} else {
1492 		table = fib6_new_table(net, cfg->fc_table);
1493 	}
1494 
1495 	if (!table)
1496 		goto out;
1497 
1498 	rt = ip6_dst_alloc(net, NULL, DST_NOCOUNT, table);
1499 
1500 	if (!rt) {
1501 		err = -ENOMEM;
1502 		goto out;
1503 	}
1504 
1505 	if (cfg->fc_flags & RTF_EXPIRES)
1506 		rt6_set_expires(rt, jiffies +
1507 				clock_t_to_jiffies(cfg->fc_expires));
1508 	else
1509 		rt6_clean_expires(rt);
1510 
1511 	if (cfg->fc_protocol == RTPROT_UNSPEC)
1512 		cfg->fc_protocol = RTPROT_BOOT;
1513 	rt->rt6i_protocol = cfg->fc_protocol;
1514 
1515 	addr_type = ipv6_addr_type(&cfg->fc_dst);
1516 
1517 	if (addr_type & IPV6_ADDR_MULTICAST)
1518 		rt->dst.input = ip6_mc_input;
1519 	else if (cfg->fc_flags & RTF_LOCAL)
1520 		rt->dst.input = ip6_input;
1521 	else
1522 		rt->dst.input = ip6_forward;
1523 
1524 	rt->dst.output = ip6_output;
1525 
1526 	ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
1527 	rt->rt6i_dst.plen = cfg->fc_dst_len;
1528 	if (rt->rt6i_dst.plen == 128)
1529 	       rt->dst.flags |= DST_HOST;
1530 
1531 	if (!(rt->dst.flags & DST_HOST) && cfg->fc_mx) {
1532 		u32 *metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
1533 		if (!metrics) {
1534 			err = -ENOMEM;
1535 			goto out;
1536 		}
1537 		dst_init_metrics(&rt->dst, metrics, 0);
1538 	}
1539 #ifdef CONFIG_IPV6_SUBTREES
1540 	ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
1541 	rt->rt6i_src.plen = cfg->fc_src_len;
1542 #endif
1543 
1544 	rt->rt6i_metric = cfg->fc_metric;
1545 
1546 	/* We cannot add true routes via loopback here,
1547 	   they would result in kernel looping; promote them to reject routes
1548 	 */
1549 	if ((cfg->fc_flags & RTF_REJECT) ||
1550 	    (dev && (dev->flags & IFF_LOOPBACK) &&
1551 	     !(addr_type & IPV6_ADDR_LOOPBACK) &&
1552 	     !(cfg->fc_flags & RTF_LOCAL))) {
1553 		/* hold loopback dev/idev if we haven't done so. */
1554 		if (dev != net->loopback_dev) {
1555 			if (dev) {
1556 				dev_put(dev);
1557 				in6_dev_put(idev);
1558 			}
1559 			dev = net->loopback_dev;
1560 			dev_hold(dev);
1561 			idev = in6_dev_get(dev);
1562 			if (!idev) {
1563 				err = -ENODEV;
1564 				goto out;
1565 			}
1566 		}
1567 		rt->dst.output = ip6_pkt_discard_out;
1568 		rt->dst.input = ip6_pkt_discard;
1569 		rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
1570 		switch (cfg->fc_type) {
1571 		case RTN_BLACKHOLE:
1572 			rt->dst.error = -EINVAL;
1573 			break;
1574 		case RTN_PROHIBIT:
1575 			rt->dst.error = -EACCES;
1576 			break;
1577 		case RTN_THROW:
1578 			rt->dst.error = -EAGAIN;
1579 			break;
1580 		default:
1581 			rt->dst.error = -ENETUNREACH;
1582 			break;
1583 		}
1584 		goto install_route;
1585 	}
1586 
1587 	if (cfg->fc_flags & RTF_GATEWAY) {
1588 		const struct in6_addr *gw_addr;
1589 		int gwa_type;
1590 
1591 		gw_addr = &cfg->fc_gateway;
1592 		rt->rt6i_gateway = *gw_addr;
1593 		gwa_type = ipv6_addr_type(gw_addr);
1594 
1595 		if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
1596 			struct rt6_info *grt;
1597 
1598 			/* IPv6 strictly inhibits using not link-local
1599 			   addresses as nexthop address.
1600 			   Otherwise, router will not able to send redirects.
1601 			   It is very good, but in some (rare!) circumstances
1602 			   (SIT, PtP, NBMA NOARP links) it is handy to allow
1603 			   some exceptions. --ANK
1604 			 */
1605 			err = -EINVAL;
1606 			if (!(gwa_type & IPV6_ADDR_UNICAST))
1607 				goto out;
1608 
1609 			grt = rt6_lookup(net, gw_addr, NULL, cfg->fc_ifindex, 1);
1610 
1611 			err = -EHOSTUNREACH;
1612 			if (!grt)
1613 				goto out;
1614 			if (dev) {
1615 				if (dev != grt->dst.dev) {
1616 					ip6_rt_put(grt);
1617 					goto out;
1618 				}
1619 			} else {
1620 				dev = grt->dst.dev;
1621 				idev = grt->rt6i_idev;
1622 				dev_hold(dev);
1623 				in6_dev_hold(grt->rt6i_idev);
1624 			}
1625 			if (!(grt->rt6i_flags & RTF_GATEWAY))
1626 				err = 0;
1627 			ip6_rt_put(grt);
1628 
1629 			if (err)
1630 				goto out;
1631 		}
1632 		err = -EINVAL;
1633 		if (!dev || (dev->flags & IFF_LOOPBACK))
1634 			goto out;
1635 	}
1636 
1637 	err = -ENODEV;
1638 	if (!dev)
1639 		goto out;
1640 
1641 	if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
1642 		if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
1643 			err = -EINVAL;
1644 			goto out;
1645 		}
1646 		rt->rt6i_prefsrc.addr = cfg->fc_prefsrc;
1647 		rt->rt6i_prefsrc.plen = 128;
1648 	} else
1649 		rt->rt6i_prefsrc.plen = 0;
1650 
1651 	rt->rt6i_flags = cfg->fc_flags;
1652 
1653 install_route:
1654 	if (cfg->fc_mx) {
1655 		struct nlattr *nla;
1656 		int remaining;
1657 
1658 		nla_for_each_attr(nla, cfg->fc_mx, cfg->fc_mx_len, remaining) {
1659 			int type = nla_type(nla);
1660 
1661 			if (type) {
1662 				if (type > RTAX_MAX) {
1663 					err = -EINVAL;
1664 					goto out;
1665 				}
1666 
1667 				dst_metric_set(&rt->dst, type, nla_get_u32(nla));
1668 			}
1669 		}
1670 	}
1671 
1672 	rt->dst.dev = dev;
1673 	rt->rt6i_idev = idev;
1674 	rt->rt6i_table = table;
1675 
1676 	cfg->fc_nlinfo.nl_net = dev_net(dev);
1677 
1678 	return __ip6_ins_rt(rt, &cfg->fc_nlinfo);
1679 
1680 out:
1681 	if (dev)
1682 		dev_put(dev);
1683 	if (idev)
1684 		in6_dev_put(idev);
1685 	if (rt)
1686 		dst_free(&rt->dst);
1687 	return err;
1688 }
1689 
1690 static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
1691 {
1692 	int err;
1693 	struct fib6_table *table;
1694 	struct net *net = dev_net(rt->dst.dev);
1695 
1696 	if (rt == net->ipv6.ip6_null_entry) {
1697 		err = -ENOENT;
1698 		goto out;
1699 	}
1700 
1701 	table = rt->rt6i_table;
1702 	write_lock_bh(&table->tb6_lock);
1703 	err = fib6_del(rt, info);
1704 	write_unlock_bh(&table->tb6_lock);
1705 
1706 out:
1707 	ip6_rt_put(rt);
1708 	return err;
1709 }
1710 
1711 int ip6_del_rt(struct rt6_info *rt)
1712 {
1713 	struct nl_info info = {
1714 		.nl_net = dev_net(rt->dst.dev),
1715 	};
1716 	return __ip6_del_rt(rt, &info);
1717 }
1718 
1719 static int ip6_route_del(struct fib6_config *cfg)
1720 {
1721 	struct fib6_table *table;
1722 	struct fib6_node *fn;
1723 	struct rt6_info *rt;
1724 	int err = -ESRCH;
1725 
1726 	table = fib6_get_table(cfg->fc_nlinfo.nl_net, cfg->fc_table);
1727 	if (!table)
1728 		return err;
1729 
1730 	read_lock_bh(&table->tb6_lock);
1731 
1732 	fn = fib6_locate(&table->tb6_root,
1733 			 &cfg->fc_dst, cfg->fc_dst_len,
1734 			 &cfg->fc_src, cfg->fc_src_len);
1735 
1736 	if (fn) {
1737 		for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
1738 			if (cfg->fc_ifindex &&
1739 			    (!rt->dst.dev ||
1740 			     rt->dst.dev->ifindex != cfg->fc_ifindex))
1741 				continue;
1742 			if (cfg->fc_flags & RTF_GATEWAY &&
1743 			    !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
1744 				continue;
1745 			if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric)
1746 				continue;
1747 			dst_hold(&rt->dst);
1748 			read_unlock_bh(&table->tb6_lock);
1749 
1750 			return __ip6_del_rt(rt, &cfg->fc_nlinfo);
1751 		}
1752 	}
1753 	read_unlock_bh(&table->tb6_lock);
1754 
1755 	return err;
1756 }
1757 
1758 static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
1759 {
1760 	struct net *net = dev_net(skb->dev);
1761 	struct netevent_redirect netevent;
1762 	struct rt6_info *rt, *nrt = NULL;
1763 	struct ndisc_options ndopts;
1764 	struct inet6_dev *in6_dev;
1765 	struct neighbour *neigh;
1766 	struct rd_msg *msg;
1767 	int optlen, on_link;
1768 	u8 *lladdr;
1769 
1770 	optlen = skb_tail_pointer(skb) - skb_transport_header(skb);
1771 	optlen -= sizeof(*msg);
1772 
1773 	if (optlen < 0) {
1774 		net_dbg_ratelimited("rt6_do_redirect: packet too short\n");
1775 		return;
1776 	}
1777 
1778 	msg = (struct rd_msg *)icmp6_hdr(skb);
1779 
1780 	if (ipv6_addr_is_multicast(&msg->dest)) {
1781 		net_dbg_ratelimited("rt6_do_redirect: destination address is multicast\n");
1782 		return;
1783 	}
1784 
1785 	on_link = 0;
1786 	if (ipv6_addr_equal(&msg->dest, &msg->target)) {
1787 		on_link = 1;
1788 	} else if (ipv6_addr_type(&msg->target) !=
1789 		   (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
1790 		net_dbg_ratelimited("rt6_do_redirect: target address is not link-local unicast\n");
1791 		return;
1792 	}
1793 
1794 	in6_dev = __in6_dev_get(skb->dev);
1795 	if (!in6_dev)
1796 		return;
1797 	if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects)
1798 		return;
1799 
1800 	/* RFC2461 8.1:
1801 	 *	The IP source address of the Redirect MUST be the same as the current
1802 	 *	first-hop router for the specified ICMP Destination Address.
1803 	 */
1804 
1805 	if (!ndisc_parse_options(msg->opt, optlen, &ndopts)) {
1806 		net_dbg_ratelimited("rt6_redirect: invalid ND options\n");
1807 		return;
1808 	}
1809 
1810 	lladdr = NULL;
1811 	if (ndopts.nd_opts_tgt_lladdr) {
1812 		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
1813 					     skb->dev);
1814 		if (!lladdr) {
1815 			net_dbg_ratelimited("rt6_redirect: invalid link-layer address length\n");
1816 			return;
1817 		}
1818 	}
1819 
1820 	rt = (struct rt6_info *) dst;
1821 	if (rt == net->ipv6.ip6_null_entry) {
1822 		net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
1823 		return;
1824 	}
1825 
1826 	/* Redirect received -> path was valid.
1827 	 * Look, redirects are sent only in response to data packets,
1828 	 * so that this nexthop apparently is reachable. --ANK
1829 	 */
1830 	dst_confirm(&rt->dst);
1831 
1832 	neigh = __neigh_lookup(&nd_tbl, &msg->target, skb->dev, 1);
1833 	if (!neigh)
1834 		return;
1835 
1836 	/*
1837 	 *	We have finally decided to accept it.
1838 	 */
1839 
1840 	neigh_update(neigh, lladdr, NUD_STALE,
1841 		     NEIGH_UPDATE_F_WEAK_OVERRIDE|
1842 		     NEIGH_UPDATE_F_OVERRIDE|
1843 		     (on_link ? 0 : (NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
1844 				     NEIGH_UPDATE_F_ISROUTER))
1845 		     );
1846 
1847 	nrt = ip6_rt_copy(rt, &msg->dest);
1848 	if (!nrt)
1849 		goto out;
1850 
1851 	nrt->rt6i_flags = RTF_GATEWAY|RTF_UP|RTF_DYNAMIC|RTF_CACHE;
1852 	if (on_link)
1853 		nrt->rt6i_flags &= ~RTF_GATEWAY;
1854 
1855 	nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
1856 
1857 	if (ip6_ins_rt(nrt))
1858 		goto out;
1859 
1860 	netevent.old = &rt->dst;
1861 	netevent.new = &nrt->dst;
1862 	netevent.daddr = &msg->dest;
1863 	netevent.neigh = neigh;
1864 	call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
1865 
1866 	if (rt->rt6i_flags & RTF_CACHE) {
1867 		rt = (struct rt6_info *) dst_clone(&rt->dst);
1868 		ip6_del_rt(rt);
1869 	}
1870 
1871 out:
1872 	neigh_release(neigh);
1873 }
1874 
1875 /*
1876  *	Misc support functions
1877  */
1878 
1879 static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
1880 				    const struct in6_addr *dest)
1881 {
1882 	struct net *net = dev_net(ort->dst.dev);
1883 	struct rt6_info *rt = ip6_dst_alloc(net, ort->dst.dev, 0,
1884 					    ort->rt6i_table);
1885 
1886 	if (rt) {
1887 		rt->dst.input = ort->dst.input;
1888 		rt->dst.output = ort->dst.output;
1889 		rt->dst.flags |= DST_HOST;
1890 
1891 		rt->rt6i_dst.addr = *dest;
1892 		rt->rt6i_dst.plen = 128;
1893 		dst_copy_metrics(&rt->dst, &ort->dst);
1894 		rt->dst.error = ort->dst.error;
1895 		rt->rt6i_idev = ort->rt6i_idev;
1896 		if (rt->rt6i_idev)
1897 			in6_dev_hold(rt->rt6i_idev);
1898 		rt->dst.lastuse = jiffies;
1899 
1900 		if (ort->rt6i_flags & RTF_GATEWAY)
1901 			rt->rt6i_gateway = ort->rt6i_gateway;
1902 		else
1903 			rt->rt6i_gateway = *dest;
1904 		rt->rt6i_flags = ort->rt6i_flags;
1905 		if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
1906 		    (RTF_DEFAULT | RTF_ADDRCONF))
1907 			rt6_set_from(rt, ort);
1908 		rt->rt6i_metric = 0;
1909 
1910 #ifdef CONFIG_IPV6_SUBTREES
1911 		memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
1912 #endif
1913 		memcpy(&rt->rt6i_prefsrc, &ort->rt6i_prefsrc, sizeof(struct rt6key));
1914 		rt->rt6i_table = ort->rt6i_table;
1915 	}
1916 	return rt;
1917 }
1918 
1919 #ifdef CONFIG_IPV6_ROUTE_INFO
1920 static struct rt6_info *rt6_get_route_info(struct net *net,
1921 					   const struct in6_addr *prefix, int prefixlen,
1922 					   const struct in6_addr *gwaddr, int ifindex)
1923 {
1924 	struct fib6_node *fn;
1925 	struct rt6_info *rt = NULL;
1926 	struct fib6_table *table;
1927 
1928 	table = fib6_get_table(net, RT6_TABLE_INFO);
1929 	if (!table)
1930 		return NULL;
1931 
1932 	read_lock_bh(&table->tb6_lock);
1933 	fn = fib6_locate(&table->tb6_root, prefix ,prefixlen, NULL, 0);
1934 	if (!fn)
1935 		goto out;
1936 
1937 	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
1938 		if (rt->dst.dev->ifindex != ifindex)
1939 			continue;
1940 		if ((rt->rt6i_flags & (RTF_ROUTEINFO|RTF_GATEWAY)) != (RTF_ROUTEINFO|RTF_GATEWAY))
1941 			continue;
1942 		if (!ipv6_addr_equal(&rt->rt6i_gateway, gwaddr))
1943 			continue;
1944 		dst_hold(&rt->dst);
1945 		break;
1946 	}
1947 out:
1948 	read_unlock_bh(&table->tb6_lock);
1949 	return rt;
1950 }
1951 
1952 static struct rt6_info *rt6_add_route_info(struct net *net,
1953 					   const struct in6_addr *prefix, int prefixlen,
1954 					   const struct in6_addr *gwaddr, int ifindex,
1955 					   unsigned int pref)
1956 {
1957 	struct fib6_config cfg = {
1958 		.fc_table	= RT6_TABLE_INFO,
1959 		.fc_metric	= IP6_RT_PRIO_USER,
1960 		.fc_ifindex	= ifindex,
1961 		.fc_dst_len	= prefixlen,
1962 		.fc_flags	= RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
1963 				  RTF_UP | RTF_PREF(pref),
1964 		.fc_nlinfo.portid = 0,
1965 		.fc_nlinfo.nlh = NULL,
1966 		.fc_nlinfo.nl_net = net,
1967 	};
1968 
1969 	cfg.fc_dst = *prefix;
1970 	cfg.fc_gateway = *gwaddr;
1971 
1972 	/* We should treat it as a default route if prefix length is 0. */
1973 	if (!prefixlen)
1974 		cfg.fc_flags |= RTF_DEFAULT;
1975 
1976 	ip6_route_add(&cfg);
1977 
1978 	return rt6_get_route_info(net, prefix, prefixlen, gwaddr, ifindex);
1979 }
1980 #endif
1981 
1982 struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_device *dev)
1983 {
1984 	struct rt6_info *rt;
1985 	struct fib6_table *table;
1986 
1987 	table = fib6_get_table(dev_net(dev), RT6_TABLE_DFLT);
1988 	if (!table)
1989 		return NULL;
1990 
1991 	read_lock_bh(&table->tb6_lock);
1992 	for (rt = table->tb6_root.leaf; rt; rt=rt->dst.rt6_next) {
1993 		if (dev == rt->dst.dev &&
1994 		    ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
1995 		    ipv6_addr_equal(&rt->rt6i_gateway, addr))
1996 			break;
1997 	}
1998 	if (rt)
1999 		dst_hold(&rt->dst);
2000 	read_unlock_bh(&table->tb6_lock);
2001 	return rt;
2002 }
2003 
2004 struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
2005 				     struct net_device *dev,
2006 				     unsigned int pref)
2007 {
2008 	struct fib6_config cfg = {
2009 		.fc_table	= RT6_TABLE_DFLT,
2010 		.fc_metric	= IP6_RT_PRIO_USER,
2011 		.fc_ifindex	= dev->ifindex,
2012 		.fc_flags	= RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
2013 				  RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
2014 		.fc_nlinfo.portid = 0,
2015 		.fc_nlinfo.nlh = NULL,
2016 		.fc_nlinfo.nl_net = dev_net(dev),
2017 	};
2018 
2019 	cfg.fc_gateway = *gwaddr;
2020 
2021 	ip6_route_add(&cfg);
2022 
2023 	return rt6_get_dflt_router(gwaddr, dev);
2024 }
2025 
2026 void rt6_purge_dflt_routers(struct net *net)
2027 {
2028 	struct rt6_info *rt;
2029 	struct fib6_table *table;
2030 
2031 	/* NOTE: Keep consistent with rt6_get_dflt_router */
2032 	table = fib6_get_table(net, RT6_TABLE_DFLT);
2033 	if (!table)
2034 		return;
2035 
2036 restart:
2037 	read_lock_bh(&table->tb6_lock);
2038 	for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
2039 		if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
2040 		    (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
2041 			dst_hold(&rt->dst);
2042 			read_unlock_bh(&table->tb6_lock);
2043 			ip6_del_rt(rt);
2044 			goto restart;
2045 		}
2046 	}
2047 	read_unlock_bh(&table->tb6_lock);
2048 }
2049 
2050 static void rtmsg_to_fib6_config(struct net *net,
2051 				 struct in6_rtmsg *rtmsg,
2052 				 struct fib6_config *cfg)
2053 {
2054 	memset(cfg, 0, sizeof(*cfg));
2055 
2056 	cfg->fc_table = RT6_TABLE_MAIN;
2057 	cfg->fc_ifindex = rtmsg->rtmsg_ifindex;
2058 	cfg->fc_metric = rtmsg->rtmsg_metric;
2059 	cfg->fc_expires = rtmsg->rtmsg_info;
2060 	cfg->fc_dst_len = rtmsg->rtmsg_dst_len;
2061 	cfg->fc_src_len = rtmsg->rtmsg_src_len;
2062 	cfg->fc_flags = rtmsg->rtmsg_flags;
2063 
2064 	cfg->fc_nlinfo.nl_net = net;
2065 
2066 	cfg->fc_dst = rtmsg->rtmsg_dst;
2067 	cfg->fc_src = rtmsg->rtmsg_src;
2068 	cfg->fc_gateway = rtmsg->rtmsg_gateway;
2069 }
2070 
2071 int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
2072 {
2073 	struct fib6_config cfg;
2074 	struct in6_rtmsg rtmsg;
2075 	int err;
2076 
2077 	switch(cmd) {
2078 	case SIOCADDRT:		/* Add a route */
2079 	case SIOCDELRT:		/* Delete a route */
2080 		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
2081 			return -EPERM;
2082 		err = copy_from_user(&rtmsg, arg,
2083 				     sizeof(struct in6_rtmsg));
2084 		if (err)
2085 			return -EFAULT;
2086 
2087 		rtmsg_to_fib6_config(net, &rtmsg, &cfg);
2088 
2089 		rtnl_lock();
2090 		switch (cmd) {
2091 		case SIOCADDRT:
2092 			err = ip6_route_add(&cfg);
2093 			break;
2094 		case SIOCDELRT:
2095 			err = ip6_route_del(&cfg);
2096 			break;
2097 		default:
2098 			err = -EINVAL;
2099 		}
2100 		rtnl_unlock();
2101 
2102 		return err;
2103 	}
2104 
2105 	return -EINVAL;
2106 }
2107 
2108 /*
2109  *	Drop the packet on the floor
2110  */
2111 
2112 static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
2113 {
2114 	int type;
2115 	struct dst_entry *dst = skb_dst(skb);
2116 	switch (ipstats_mib_noroutes) {
2117 	case IPSTATS_MIB_INNOROUTES:
2118 		type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
2119 		if (type == IPV6_ADDR_ANY) {
2120 			IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
2121 				      IPSTATS_MIB_INADDRERRORS);
2122 			break;
2123 		}
2124 		/* FALLTHROUGH */
2125 	case IPSTATS_MIB_OUTNOROUTES:
2126 		IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
2127 			      ipstats_mib_noroutes);
2128 		break;
2129 	}
2130 	icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0);
2131 	kfree_skb(skb);
2132 	return 0;
2133 }
2134 
2135 static int ip6_pkt_discard(struct sk_buff *skb)
2136 {
2137 	return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_INNOROUTES);
2138 }
2139 
2140 static int ip6_pkt_discard_out(struct sk_buff *skb)
2141 {
2142 	skb->dev = skb_dst(skb)->dev;
2143 	return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
2144 }
2145 
2146 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
2147 
2148 static int ip6_pkt_prohibit(struct sk_buff *skb)
2149 {
2150 	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
2151 }
2152 
2153 static int ip6_pkt_prohibit_out(struct sk_buff *skb)
2154 {
2155 	skb->dev = skb_dst(skb)->dev;
2156 	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
2157 }
2158 
2159 #endif
2160 
2161 /*
2162  *	Allocate a dst for local (unicast / anycast) address.
2163  */
2164 
2165 struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
2166 				    const struct in6_addr *addr,
2167 				    bool anycast)
2168 {
2169 	struct net *net = dev_net(idev->dev);
2170 	struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev, 0, NULL);
2171 
2172 	if (!rt) {
2173 		net_warn_ratelimited("Maximum number of routes reached, consider increasing route/max_size\n");
2174 		return ERR_PTR(-ENOMEM);
2175 	}
2176 
2177 	in6_dev_hold(idev);
2178 
2179 	rt->dst.flags |= DST_HOST;
2180 	rt->dst.input = ip6_input;
2181 	rt->dst.output = ip6_output;
2182 	rt->rt6i_idev = idev;
2183 
2184 	rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
2185 	if (anycast)
2186 		rt->rt6i_flags |= RTF_ANYCAST;
2187 	else
2188 		rt->rt6i_flags |= RTF_LOCAL;
2189 
2190 	rt->rt6i_gateway  = *addr;
2191 	rt->rt6i_dst.addr = *addr;
2192 	rt->rt6i_dst.plen = 128;
2193 	rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL);
2194 
2195 	atomic_set(&rt->dst.__refcnt, 1);
2196 
2197 	return rt;
2198 }
2199 
2200 int ip6_route_get_saddr(struct net *net,
2201 			struct rt6_info *rt,
2202 			const struct in6_addr *daddr,
2203 			unsigned int prefs,
2204 			struct in6_addr *saddr)
2205 {
2206 	struct inet6_dev *idev = ip6_dst_idev((struct dst_entry*)rt);
2207 	int err = 0;
2208 	if (rt->rt6i_prefsrc.plen)
2209 		*saddr = rt->rt6i_prefsrc.addr;
2210 	else
2211 		err = ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
2212 					 daddr, prefs, saddr);
2213 	return err;
2214 }
2215 
2216 /* remove deleted ip from prefsrc entries */
2217 struct arg_dev_net_ip {
2218 	struct net_device *dev;
2219 	struct net *net;
2220 	struct in6_addr *addr;
2221 };
2222 
2223 static int fib6_remove_prefsrc(struct rt6_info *rt, void *arg)
2224 {
2225 	struct net_device *dev = ((struct arg_dev_net_ip *)arg)->dev;
2226 	struct net *net = ((struct arg_dev_net_ip *)arg)->net;
2227 	struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;
2228 
2229 	if (((void *)rt->dst.dev == dev || !dev) &&
2230 	    rt != net->ipv6.ip6_null_entry &&
2231 	    ipv6_addr_equal(addr, &rt->rt6i_prefsrc.addr)) {
2232 		/* remove prefsrc entry */
2233 		rt->rt6i_prefsrc.plen = 0;
2234 	}
2235 	return 0;
2236 }
2237 
2238 void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
2239 {
2240 	struct net *net = dev_net(ifp->idev->dev);
2241 	struct arg_dev_net_ip adni = {
2242 		.dev = ifp->idev->dev,
2243 		.net = net,
2244 		.addr = &ifp->addr,
2245 	};
2246 	fib6_clean_all(net, fib6_remove_prefsrc, 0, &adni);
2247 }
2248 
2249 struct arg_dev_net {
2250 	struct net_device *dev;
2251 	struct net *net;
2252 };
2253 
2254 static int fib6_ifdown(struct rt6_info *rt, void *arg)
2255 {
2256 	const struct arg_dev_net *adn = arg;
2257 	const struct net_device *dev = adn->dev;
2258 
2259 	if ((rt->dst.dev == dev || !dev) &&
2260 	    rt != adn->net->ipv6.ip6_null_entry)
2261 		return -1;
2262 
2263 	return 0;
2264 }
2265 
2266 void rt6_ifdown(struct net *net, struct net_device *dev)
2267 {
2268 	struct arg_dev_net adn = {
2269 		.dev = dev,
2270 		.net = net,
2271 	};
2272 
2273 	fib6_clean_all(net, fib6_ifdown, 0, &adn);
2274 	icmp6_clean_all(fib6_ifdown, &adn);
2275 }
2276 
2277 struct rt6_mtu_change_arg {
2278 	struct net_device *dev;
2279 	unsigned int mtu;
2280 };
2281 
2282 static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
2283 {
2284 	struct rt6_mtu_change_arg *arg = (struct rt6_mtu_change_arg *) p_arg;
2285 	struct inet6_dev *idev;
2286 
2287 	/* In IPv6 pmtu discovery is not optional,
2288 	   so that RTAX_MTU lock cannot disable it.
2289 	   We still use this lock to block changes
2290 	   caused by addrconf/ndisc.
2291 	*/
2292 
2293 	idev = __in6_dev_get(arg->dev);
2294 	if (!idev)
2295 		return 0;
2296 
2297 	/* For administrative MTU increase, there is no way to discover
2298 	   IPv6 PMTU increase, so PMTU increase should be updated here.
2299 	   Since RFC 1981 doesn't include administrative MTU increase
2300 	   update PMTU increase is a MUST. (i.e. jumbo frame)
2301 	 */
2302 	/*
2303 	   If new MTU is less than route PMTU, this new MTU will be the
2304 	   lowest MTU in the path, update the route PMTU to reflect PMTU
2305 	   decreases; if new MTU is greater than route PMTU, and the
2306 	   old MTU is the lowest MTU in the path, update the route PMTU
2307 	   to reflect the increase. In this case if the other nodes' MTU
2308 	   also have the lowest MTU, TOO BIG MESSAGE will be lead to
2309 	   PMTU discouvery.
2310 	 */
2311 	if (rt->dst.dev == arg->dev &&
2312 	    !dst_metric_locked(&rt->dst, RTAX_MTU) &&
2313 	    (dst_mtu(&rt->dst) >= arg->mtu ||
2314 	     (dst_mtu(&rt->dst) < arg->mtu &&
2315 	      dst_mtu(&rt->dst) == idev->cnf.mtu6))) {
2316 		dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
2317 	}
2318 	return 0;
2319 }
2320 
2321 void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
2322 {
2323 	struct rt6_mtu_change_arg arg = {
2324 		.dev = dev,
2325 		.mtu = mtu,
2326 	};
2327 
2328 	fib6_clean_all(dev_net(dev), rt6_mtu_change_route, 0, &arg);
2329 }
2330 
2331 static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
2332 	[RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
2333 	[RTA_OIF]               = { .type = NLA_U32 },
2334 	[RTA_IIF]		= { .type = NLA_U32 },
2335 	[RTA_PRIORITY]          = { .type = NLA_U32 },
2336 	[RTA_METRICS]           = { .type = NLA_NESTED },
2337 	[RTA_MULTIPATH]		= { .len = sizeof(struct rtnexthop) },
2338 };
2339 
2340 static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
2341 			      struct fib6_config *cfg)
2342 {
2343 	struct rtmsg *rtm;
2344 	struct nlattr *tb[RTA_MAX+1];
2345 	int err;
2346 
2347 	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
2348 	if (err < 0)
2349 		goto errout;
2350 
2351 	err = -EINVAL;
2352 	rtm = nlmsg_data(nlh);
2353 	memset(cfg, 0, sizeof(*cfg));
2354 
2355 	cfg->fc_table = rtm->rtm_table;
2356 	cfg->fc_dst_len = rtm->rtm_dst_len;
2357 	cfg->fc_src_len = rtm->rtm_src_len;
2358 	cfg->fc_flags = RTF_UP;
2359 	cfg->fc_protocol = rtm->rtm_protocol;
2360 	cfg->fc_type = rtm->rtm_type;
2361 
2362 	if (rtm->rtm_type == RTN_UNREACHABLE ||
2363 	    rtm->rtm_type == RTN_BLACKHOLE ||
2364 	    rtm->rtm_type == RTN_PROHIBIT ||
2365 	    rtm->rtm_type == RTN_THROW)
2366 		cfg->fc_flags |= RTF_REJECT;
2367 
2368 	if (rtm->rtm_type == RTN_LOCAL)
2369 		cfg->fc_flags |= RTF_LOCAL;
2370 
2371 	cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid;
2372 	cfg->fc_nlinfo.nlh = nlh;
2373 	cfg->fc_nlinfo.nl_net = sock_net(skb->sk);
2374 
2375 	if (tb[RTA_GATEWAY]) {
2376 		nla_memcpy(&cfg->fc_gateway, tb[RTA_GATEWAY], 16);
2377 		cfg->fc_flags |= RTF_GATEWAY;
2378 	}
2379 
2380 	if (tb[RTA_DST]) {
2381 		int plen = (rtm->rtm_dst_len + 7) >> 3;
2382 
2383 		if (nla_len(tb[RTA_DST]) < plen)
2384 			goto errout;
2385 
2386 		nla_memcpy(&cfg->fc_dst, tb[RTA_DST], plen);
2387 	}
2388 
2389 	if (tb[RTA_SRC]) {
2390 		int plen = (rtm->rtm_src_len + 7) >> 3;
2391 
2392 		if (nla_len(tb[RTA_SRC]) < plen)
2393 			goto errout;
2394 
2395 		nla_memcpy(&cfg->fc_src, tb[RTA_SRC], plen);
2396 	}
2397 
2398 	if (tb[RTA_PREFSRC])
2399 		nla_memcpy(&cfg->fc_prefsrc, tb[RTA_PREFSRC], 16);
2400 
2401 	if (tb[RTA_OIF])
2402 		cfg->fc_ifindex = nla_get_u32(tb[RTA_OIF]);
2403 
2404 	if (tb[RTA_PRIORITY])
2405 		cfg->fc_metric = nla_get_u32(tb[RTA_PRIORITY]);
2406 
2407 	if (tb[RTA_METRICS]) {
2408 		cfg->fc_mx = nla_data(tb[RTA_METRICS]);
2409 		cfg->fc_mx_len = nla_len(tb[RTA_METRICS]);
2410 	}
2411 
2412 	if (tb[RTA_TABLE])
2413 		cfg->fc_table = nla_get_u32(tb[RTA_TABLE]);
2414 
2415 	if (tb[RTA_MULTIPATH]) {
2416 		cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
2417 		cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
2418 	}
2419 
2420 	err = 0;
2421 errout:
2422 	return err;
2423 }
2424 
2425 static int ip6_route_multipath(struct fib6_config *cfg, int add)
2426 {
2427 	struct fib6_config r_cfg;
2428 	struct rtnexthop *rtnh;
2429 	int remaining;
2430 	int attrlen;
2431 	int err = 0, last_err = 0;
2432 
2433 beginning:
2434 	rtnh = (struct rtnexthop *)cfg->fc_mp;
2435 	remaining = cfg->fc_mp_len;
2436 
2437 	/* Parse a Multipath Entry */
2438 	while (rtnh_ok(rtnh, remaining)) {
2439 		memcpy(&r_cfg, cfg, sizeof(*cfg));
2440 		if (rtnh->rtnh_ifindex)
2441 			r_cfg.fc_ifindex = rtnh->rtnh_ifindex;
2442 
2443 		attrlen = rtnh_attrlen(rtnh);
2444 		if (attrlen > 0) {
2445 			struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
2446 
2447 			nla = nla_find(attrs, attrlen, RTA_GATEWAY);
2448 			if (nla) {
2449 				nla_memcpy(&r_cfg.fc_gateway, nla, 16);
2450 				r_cfg.fc_flags |= RTF_GATEWAY;
2451 			}
2452 		}
2453 		err = add ? ip6_route_add(&r_cfg) : ip6_route_del(&r_cfg);
2454 		if (err) {
2455 			last_err = err;
2456 			/* If we are trying to remove a route, do not stop the
2457 			 * loop when ip6_route_del() fails (because next hop is
2458 			 * already gone), we should try to remove all next hops.
2459 			 */
2460 			if (add) {
2461 				/* If add fails, we should try to delete all
2462 				 * next hops that have been already added.
2463 				 */
2464 				add = 0;
2465 				goto beginning;
2466 			}
2467 		}
2468 		/* Because each route is added like a single route we remove
2469 		 * this flag after the first nexthop (if there is a collision,
2470 		 * we have already fail to add the first nexthop:
2471 		 * fib6_add_rt2node() has reject it).
2472 		 */
2473 		cfg->fc_nlinfo.nlh->nlmsg_flags &= ~NLM_F_EXCL;
2474 		rtnh = rtnh_next(rtnh, &remaining);
2475 	}
2476 
2477 	return last_err;
2478 }
2479 
2480 static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr* nlh)
2481 {
2482 	struct fib6_config cfg;
2483 	int err;
2484 
2485 	err = rtm_to_fib6_config(skb, nlh, &cfg);
2486 	if (err < 0)
2487 		return err;
2488 
2489 	if (cfg.fc_mp)
2490 		return ip6_route_multipath(&cfg, 0);
2491 	else
2492 		return ip6_route_del(&cfg);
2493 }
2494 
2495 static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr* nlh)
2496 {
2497 	struct fib6_config cfg;
2498 	int err;
2499 
2500 	err = rtm_to_fib6_config(skb, nlh, &cfg);
2501 	if (err < 0)
2502 		return err;
2503 
2504 	if (cfg.fc_mp)
2505 		return ip6_route_multipath(&cfg, 1);
2506 	else
2507 		return ip6_route_add(&cfg);
2508 }
2509 
2510 static inline size_t rt6_nlmsg_size(void)
2511 {
2512 	return NLMSG_ALIGN(sizeof(struct rtmsg))
2513 	       + nla_total_size(16) /* RTA_SRC */
2514 	       + nla_total_size(16) /* RTA_DST */
2515 	       + nla_total_size(16) /* RTA_GATEWAY */
2516 	       + nla_total_size(16) /* RTA_PREFSRC */
2517 	       + nla_total_size(4) /* RTA_TABLE */
2518 	       + nla_total_size(4) /* RTA_IIF */
2519 	       + nla_total_size(4) /* RTA_OIF */
2520 	       + nla_total_size(4) /* RTA_PRIORITY */
2521 	       + RTAX_MAX * nla_total_size(4) /* RTA_METRICS */
2522 	       + nla_total_size(sizeof(struct rta_cacheinfo));
2523 }
2524 
2525 static int rt6_fill_node(struct net *net,
2526 			 struct sk_buff *skb, struct rt6_info *rt,
2527 			 struct in6_addr *dst, struct in6_addr *src,
2528 			 int iif, int type, u32 portid, u32 seq,
2529 			 int prefix, int nowait, unsigned int flags)
2530 {
2531 	struct rtmsg *rtm;
2532 	struct nlmsghdr *nlh;
2533 	long expires;
2534 	u32 table;
2535 
2536 	if (prefix) {	/* user wants prefix routes only */
2537 		if (!(rt->rt6i_flags & RTF_PREFIX_RT)) {
2538 			/* success since this is not a prefix route */
2539 			return 1;
2540 		}
2541 	}
2542 
2543 	nlh = nlmsg_put(skb, portid, seq, type, sizeof(*rtm), flags);
2544 	if (!nlh)
2545 		return -EMSGSIZE;
2546 
2547 	rtm = nlmsg_data(nlh);
2548 	rtm->rtm_family = AF_INET6;
2549 	rtm->rtm_dst_len = rt->rt6i_dst.plen;
2550 	rtm->rtm_src_len = rt->rt6i_src.plen;
2551 	rtm->rtm_tos = 0;
2552 	if (rt->rt6i_table)
2553 		table = rt->rt6i_table->tb6_id;
2554 	else
2555 		table = RT6_TABLE_UNSPEC;
2556 	rtm->rtm_table = table;
2557 	if (nla_put_u32(skb, RTA_TABLE, table))
2558 		goto nla_put_failure;
2559 	if (rt->rt6i_flags & RTF_REJECT) {
2560 		switch (rt->dst.error) {
2561 		case -EINVAL:
2562 			rtm->rtm_type = RTN_BLACKHOLE;
2563 			break;
2564 		case -EACCES:
2565 			rtm->rtm_type = RTN_PROHIBIT;
2566 			break;
2567 		case -EAGAIN:
2568 			rtm->rtm_type = RTN_THROW;
2569 			break;
2570 		default:
2571 			rtm->rtm_type = RTN_UNREACHABLE;
2572 			break;
2573 		}
2574 	}
2575 	else if (rt->rt6i_flags & RTF_LOCAL)
2576 		rtm->rtm_type = RTN_LOCAL;
2577 	else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
2578 		rtm->rtm_type = RTN_LOCAL;
2579 	else
2580 		rtm->rtm_type = RTN_UNICAST;
2581 	rtm->rtm_flags = 0;
2582 	rtm->rtm_scope = RT_SCOPE_UNIVERSE;
2583 	rtm->rtm_protocol = rt->rt6i_protocol;
2584 	if (rt->rt6i_flags & RTF_DYNAMIC)
2585 		rtm->rtm_protocol = RTPROT_REDIRECT;
2586 	else if (rt->rt6i_flags & RTF_ADDRCONF) {
2587 		if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ROUTEINFO))
2588 			rtm->rtm_protocol = RTPROT_RA;
2589 		else
2590 			rtm->rtm_protocol = RTPROT_KERNEL;
2591 	}
2592 
2593 	if (rt->rt6i_flags & RTF_CACHE)
2594 		rtm->rtm_flags |= RTM_F_CLONED;
2595 
2596 	if (dst) {
2597 		if (nla_put(skb, RTA_DST, 16, dst))
2598 			goto nla_put_failure;
2599 		rtm->rtm_dst_len = 128;
2600 	} else if (rtm->rtm_dst_len)
2601 		if (nla_put(skb, RTA_DST, 16, &rt->rt6i_dst.addr))
2602 			goto nla_put_failure;
2603 #ifdef CONFIG_IPV6_SUBTREES
2604 	if (src) {
2605 		if (nla_put(skb, RTA_SRC, 16, src))
2606 			goto nla_put_failure;
2607 		rtm->rtm_src_len = 128;
2608 	} else if (rtm->rtm_src_len &&
2609 		   nla_put(skb, RTA_SRC, 16, &rt->rt6i_src.addr))
2610 		goto nla_put_failure;
2611 #endif
2612 	if (iif) {
2613 #ifdef CONFIG_IPV6_MROUTE
2614 		if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr)) {
2615 			int err = ip6mr_get_route(net, skb, rtm, nowait);
2616 			if (err <= 0) {
2617 				if (!nowait) {
2618 					if (err == 0)
2619 						return 0;
2620 					goto nla_put_failure;
2621 				} else {
2622 					if (err == -EMSGSIZE)
2623 						goto nla_put_failure;
2624 				}
2625 			}
2626 		} else
2627 #endif
2628 			if (nla_put_u32(skb, RTA_IIF, iif))
2629 				goto nla_put_failure;
2630 	} else if (dst) {
2631 		struct in6_addr saddr_buf;
2632 		if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0 &&
2633 		    nla_put(skb, RTA_PREFSRC, 16, &saddr_buf))
2634 			goto nla_put_failure;
2635 	}
2636 
2637 	if (rt->rt6i_prefsrc.plen) {
2638 		struct in6_addr saddr_buf;
2639 		saddr_buf = rt->rt6i_prefsrc.addr;
2640 		if (nla_put(skb, RTA_PREFSRC, 16, &saddr_buf))
2641 			goto nla_put_failure;
2642 	}
2643 
2644 	if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
2645 		goto nla_put_failure;
2646 
2647 	if (rt->rt6i_flags & RTF_GATEWAY) {
2648 		if (nla_put(skb, RTA_GATEWAY, 16, &rt->rt6i_gateway) < 0)
2649 			goto nla_put_failure;
2650 	}
2651 
2652 	if (rt->dst.dev &&
2653 	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
2654 		goto nla_put_failure;
2655 	if (nla_put_u32(skb, RTA_PRIORITY, rt->rt6i_metric))
2656 		goto nla_put_failure;
2657 
2658 	expires = (rt->rt6i_flags & RTF_EXPIRES) ? rt->dst.expires - jiffies : 0;
2659 
2660 	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, rt->dst.error) < 0)
2661 		goto nla_put_failure;
2662 
2663 	return nlmsg_end(skb, nlh);
2664 
2665 nla_put_failure:
2666 	nlmsg_cancel(skb, nlh);
2667 	return -EMSGSIZE;
2668 }
2669 
2670 int rt6_dump_route(struct rt6_info *rt, void *p_arg)
2671 {
2672 	struct rt6_rtnl_dump_arg *arg = (struct rt6_rtnl_dump_arg *) p_arg;
2673 	int prefix;
2674 
2675 	if (nlmsg_len(arg->cb->nlh) >= sizeof(struct rtmsg)) {
2676 		struct rtmsg *rtm = nlmsg_data(arg->cb->nlh);
2677 		prefix = (rtm->rtm_flags & RTM_F_PREFIX) != 0;
2678 	} else
2679 		prefix = 0;
2680 
2681 	return rt6_fill_node(arg->net,
2682 		     arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
2683 		     NETLINK_CB(arg->cb->skb).portid, arg->cb->nlh->nlmsg_seq,
2684 		     prefix, 0, NLM_F_MULTI);
2685 }
2686 
2687 static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh)
2688 {
2689 	struct net *net = sock_net(in_skb->sk);
2690 	struct nlattr *tb[RTA_MAX+1];
2691 	struct rt6_info *rt;
2692 	struct sk_buff *skb;
2693 	struct rtmsg *rtm;
2694 	struct flowi6 fl6;
2695 	int err, iif = 0, oif = 0;
2696 
2697 	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
2698 	if (err < 0)
2699 		goto errout;
2700 
2701 	err = -EINVAL;
2702 	memset(&fl6, 0, sizeof(fl6));
2703 
2704 	if (tb[RTA_SRC]) {
2705 		if (nla_len(tb[RTA_SRC]) < sizeof(struct in6_addr))
2706 			goto errout;
2707 
2708 		fl6.saddr = *(struct in6_addr *)nla_data(tb[RTA_SRC]);
2709 	}
2710 
2711 	if (tb[RTA_DST]) {
2712 		if (nla_len(tb[RTA_DST]) < sizeof(struct in6_addr))
2713 			goto errout;
2714 
2715 		fl6.daddr = *(struct in6_addr *)nla_data(tb[RTA_DST]);
2716 	}
2717 
2718 	if (tb[RTA_IIF])
2719 		iif = nla_get_u32(tb[RTA_IIF]);
2720 
2721 	if (tb[RTA_OIF])
2722 		oif = nla_get_u32(tb[RTA_OIF]);
2723 
2724 	if (iif) {
2725 		struct net_device *dev;
2726 		int flags = 0;
2727 
2728 		dev = __dev_get_by_index(net, iif);
2729 		if (!dev) {
2730 			err = -ENODEV;
2731 			goto errout;
2732 		}
2733 
2734 		fl6.flowi6_iif = iif;
2735 
2736 		if (!ipv6_addr_any(&fl6.saddr))
2737 			flags |= RT6_LOOKUP_F_HAS_SADDR;
2738 
2739 		rt = (struct rt6_info *)ip6_route_input_lookup(net, dev, &fl6,
2740 							       flags);
2741 	} else {
2742 		fl6.flowi6_oif = oif;
2743 
2744 		rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
2745 	}
2746 
2747 	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2748 	if (!skb) {
2749 		ip6_rt_put(rt);
2750 		err = -ENOBUFS;
2751 		goto errout;
2752 	}
2753 
2754 	/* Reserve room for dummy headers, this skb can pass
2755 	   through good chunk of routing engine.
2756 	 */
2757 	skb_reset_mac_header(skb);
2758 	skb_reserve(skb, MAX_HEADER + sizeof(struct ipv6hdr));
2759 
2760 	skb_dst_set(skb, &rt->dst);
2761 
2762 	err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
2763 			    RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
2764 			    nlh->nlmsg_seq, 0, 0, 0);
2765 	if (err < 0) {
2766 		kfree_skb(skb);
2767 		goto errout;
2768 	}
2769 
2770 	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2771 errout:
2772 	return err;
2773 }
2774 
2775 void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
2776 {
2777 	struct sk_buff *skb;
2778 	struct net *net = info->nl_net;
2779 	u32 seq;
2780 	int err;
2781 
2782 	err = -ENOBUFS;
2783 	seq = info->nlh ? info->nlh->nlmsg_seq : 0;
2784 
2785 	skb = nlmsg_new(rt6_nlmsg_size(), gfp_any());
2786 	if (!skb)
2787 		goto errout;
2788 
2789 	err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
2790 				event, info->portid, seq, 0, 0, 0);
2791 	if (err < 0) {
2792 		/* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
2793 		WARN_ON(err == -EMSGSIZE);
2794 		kfree_skb(skb);
2795 		goto errout;
2796 	}
2797 	rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
2798 		    info->nlh, gfp_any());
2799 	return;
2800 errout:
2801 	if (err < 0)
2802 		rtnl_set_sk_err(net, RTNLGRP_IPV6_ROUTE, err);
2803 }
2804 
2805 static int ip6_route_dev_notify(struct notifier_block *this,
2806 				unsigned long event, void *ptr)
2807 {
2808 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
2809 	struct net *net = dev_net(dev);
2810 
2811 	if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
2812 		net->ipv6.ip6_null_entry->dst.dev = dev;
2813 		net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
2814 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
2815 		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
2816 		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
2817 		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
2818 		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
2819 #endif
2820 	}
2821 
2822 	return NOTIFY_OK;
2823 }
2824 
2825 /*
2826  *	/proc
2827  */
2828 
2829 #ifdef CONFIG_PROC_FS
2830 
2831 struct rt6_proc_arg
2832 {
2833 	char *buffer;
2834 	int offset;
2835 	int length;
2836 	int skip;
2837 	int len;
2838 };
2839 
2840 static int rt6_info_route(struct rt6_info *rt, void *p_arg)
2841 {
2842 	struct seq_file *m = p_arg;
2843 
2844 	seq_printf(m, "%pi6 %02x ", &rt->rt6i_dst.addr, rt->rt6i_dst.plen);
2845 
2846 #ifdef CONFIG_IPV6_SUBTREES
2847 	seq_printf(m, "%pi6 %02x ", &rt->rt6i_src.addr, rt->rt6i_src.plen);
2848 #else
2849 	seq_puts(m, "00000000000000000000000000000000 00 ");
2850 #endif
2851 	if (rt->rt6i_flags & RTF_GATEWAY) {
2852 		seq_printf(m, "%pi6", &rt->rt6i_gateway);
2853 	} else {
2854 		seq_puts(m, "00000000000000000000000000000000");
2855 	}
2856 	seq_printf(m, " %08x %08x %08x %08x %8s\n",
2857 		   rt->rt6i_metric, atomic_read(&rt->dst.__refcnt),
2858 		   rt->dst.__use, rt->rt6i_flags,
2859 		   rt->dst.dev ? rt->dst.dev->name : "");
2860 	return 0;
2861 }
2862 
2863 static int ipv6_route_show(struct seq_file *m, void *v)
2864 {
2865 	struct net *net = (struct net *)m->private;
2866 	fib6_clean_all_ro(net, rt6_info_route, 0, m);
2867 	return 0;
2868 }
2869 
2870 static int ipv6_route_open(struct inode *inode, struct file *file)
2871 {
2872 	return single_open_net(inode, file, ipv6_route_show);
2873 }
2874 
2875 static const struct file_operations ipv6_route_proc_fops = {
2876 	.owner		= THIS_MODULE,
2877 	.open		= ipv6_route_open,
2878 	.read		= seq_read,
2879 	.llseek		= seq_lseek,
2880 	.release	= single_release_net,
2881 };
2882 
2883 static int rt6_stats_seq_show(struct seq_file *seq, void *v)
2884 {
2885 	struct net *net = (struct net *)seq->private;
2886 	seq_printf(seq, "%04x %04x %04x %04x %04x %04x %04x\n",
2887 		   net->ipv6.rt6_stats->fib_nodes,
2888 		   net->ipv6.rt6_stats->fib_route_nodes,
2889 		   net->ipv6.rt6_stats->fib_rt_alloc,
2890 		   net->ipv6.rt6_stats->fib_rt_entries,
2891 		   net->ipv6.rt6_stats->fib_rt_cache,
2892 		   dst_entries_get_slow(&net->ipv6.ip6_dst_ops),
2893 		   net->ipv6.rt6_stats->fib_discarded_routes);
2894 
2895 	return 0;
2896 }
2897 
2898 static int rt6_stats_seq_open(struct inode *inode, struct file *file)
2899 {
2900 	return single_open_net(inode, file, rt6_stats_seq_show);
2901 }
2902 
2903 static const struct file_operations rt6_stats_seq_fops = {
2904 	.owner	 = THIS_MODULE,
2905 	.open	 = rt6_stats_seq_open,
2906 	.read	 = seq_read,
2907 	.llseek	 = seq_lseek,
2908 	.release = single_release_net,
2909 };
2910 #endif	/* CONFIG_PROC_FS */
2911 
2912 #ifdef CONFIG_SYSCTL
2913 
2914 static
2915 int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
2916 			      void __user *buffer, size_t *lenp, loff_t *ppos)
2917 {
2918 	struct net *net;
2919 	int delay;
2920 	if (!write)
2921 		return -EINVAL;
2922 
2923 	net = (struct net *)ctl->extra1;
2924 	delay = net->ipv6.sysctl.flush_delay;
2925 	proc_dointvec(ctl, write, buffer, lenp, ppos);
2926 	fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
2927 	return 0;
2928 }
2929 
2930 struct ctl_table ipv6_route_table_template[] = {
2931 	{
2932 		.procname	=	"flush",
2933 		.data		=	&init_net.ipv6.sysctl.flush_delay,
2934 		.maxlen		=	sizeof(int),
2935 		.mode		=	0200,
2936 		.proc_handler	=	ipv6_sysctl_rtcache_flush
2937 	},
2938 	{
2939 		.procname	=	"gc_thresh",
2940 		.data		=	&ip6_dst_ops_template.gc_thresh,
2941 		.maxlen		=	sizeof(int),
2942 		.mode		=	0644,
2943 		.proc_handler	=	proc_dointvec,
2944 	},
2945 	{
2946 		.procname	=	"max_size",
2947 		.data		=	&init_net.ipv6.sysctl.ip6_rt_max_size,
2948 		.maxlen		=	sizeof(int),
2949 		.mode		=	0644,
2950 		.proc_handler	=	proc_dointvec,
2951 	},
2952 	{
2953 		.procname	=	"gc_min_interval",
2954 		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
2955 		.maxlen		=	sizeof(int),
2956 		.mode		=	0644,
2957 		.proc_handler	=	proc_dointvec_jiffies,
2958 	},
2959 	{
2960 		.procname	=	"gc_timeout",
2961 		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_timeout,
2962 		.maxlen		=	sizeof(int),
2963 		.mode		=	0644,
2964 		.proc_handler	=	proc_dointvec_jiffies,
2965 	},
2966 	{
2967 		.procname	=	"gc_interval",
2968 		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_interval,
2969 		.maxlen		=	sizeof(int),
2970 		.mode		=	0644,
2971 		.proc_handler	=	proc_dointvec_jiffies,
2972 	},
2973 	{
2974 		.procname	=	"gc_elasticity",
2975 		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_elasticity,
2976 		.maxlen		=	sizeof(int),
2977 		.mode		=	0644,
2978 		.proc_handler	=	proc_dointvec,
2979 	},
2980 	{
2981 		.procname	=	"mtu_expires",
2982 		.data		=	&init_net.ipv6.sysctl.ip6_rt_mtu_expires,
2983 		.maxlen		=	sizeof(int),
2984 		.mode		=	0644,
2985 		.proc_handler	=	proc_dointvec_jiffies,
2986 	},
2987 	{
2988 		.procname	=	"min_adv_mss",
2989 		.data		=	&init_net.ipv6.sysctl.ip6_rt_min_advmss,
2990 		.maxlen		=	sizeof(int),
2991 		.mode		=	0644,
2992 		.proc_handler	=	proc_dointvec,
2993 	},
2994 	{
2995 		.procname	=	"gc_min_interval_ms",
2996 		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
2997 		.maxlen		=	sizeof(int),
2998 		.mode		=	0644,
2999 		.proc_handler	=	proc_dointvec_ms_jiffies,
3000 	},
3001 	{ }
3002 };
3003 
3004 struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
3005 {
3006 	struct ctl_table *table;
3007 
3008 	table = kmemdup(ipv6_route_table_template,
3009 			sizeof(ipv6_route_table_template),
3010 			GFP_KERNEL);
3011 
3012 	if (table) {
3013 		table[0].data = &net->ipv6.sysctl.flush_delay;
3014 		table[0].extra1 = net;
3015 		table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
3016 		table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
3017 		table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
3018 		table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;
3019 		table[5].data = &net->ipv6.sysctl.ip6_rt_gc_interval;
3020 		table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
3021 		table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
3022 		table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
3023 		table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
3024 
3025 		/* Don't export sysctls to unprivileged users */
3026 		if (net->user_ns != &init_user_ns)
3027 			table[0].procname = NULL;
3028 	}
3029 
3030 	return table;
3031 }
3032 #endif
3033 
3034 static int __net_init ip6_route_net_init(struct net *net)
3035 {
3036 	int ret = -ENOMEM;
3037 
3038 	memcpy(&net->ipv6.ip6_dst_ops, &ip6_dst_ops_template,
3039 	       sizeof(net->ipv6.ip6_dst_ops));
3040 
3041 	if (dst_entries_init(&net->ipv6.ip6_dst_ops) < 0)
3042 		goto out_ip6_dst_ops;
3043 
3044 	net->ipv6.ip6_null_entry = kmemdup(&ip6_null_entry_template,
3045 					   sizeof(*net->ipv6.ip6_null_entry),
3046 					   GFP_KERNEL);
3047 	if (!net->ipv6.ip6_null_entry)
3048 		goto out_ip6_dst_entries;
3049 	net->ipv6.ip6_null_entry->dst.path =
3050 		(struct dst_entry *)net->ipv6.ip6_null_entry;
3051 	net->ipv6.ip6_null_entry->dst.ops = &net->ipv6.ip6_dst_ops;
3052 	dst_init_metrics(&net->ipv6.ip6_null_entry->dst,
3053 			 ip6_template_metrics, true);
3054 
3055 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
3056 	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
3057 					       sizeof(*net->ipv6.ip6_prohibit_entry),
3058 					       GFP_KERNEL);
3059 	if (!net->ipv6.ip6_prohibit_entry)
3060 		goto out_ip6_null_entry;
3061 	net->ipv6.ip6_prohibit_entry->dst.path =
3062 		(struct dst_entry *)net->ipv6.ip6_prohibit_entry;
3063 	net->ipv6.ip6_prohibit_entry->dst.ops = &net->ipv6.ip6_dst_ops;
3064 	dst_init_metrics(&net->ipv6.ip6_prohibit_entry->dst,
3065 			 ip6_template_metrics, true);
3066 
3067 	net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
3068 					       sizeof(*net->ipv6.ip6_blk_hole_entry),
3069 					       GFP_KERNEL);
3070 	if (!net->ipv6.ip6_blk_hole_entry)
3071 		goto out_ip6_prohibit_entry;
3072 	net->ipv6.ip6_blk_hole_entry->dst.path =
3073 		(struct dst_entry *)net->ipv6.ip6_blk_hole_entry;
3074 	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
3075 	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
3076 			 ip6_template_metrics, true);
3077 #endif
3078 
3079 	net->ipv6.sysctl.flush_delay = 0;
3080 	net->ipv6.sysctl.ip6_rt_max_size = 4096;
3081 	net->ipv6.sysctl.ip6_rt_gc_min_interval = HZ / 2;
3082 	net->ipv6.sysctl.ip6_rt_gc_timeout = 60*HZ;
3083 	net->ipv6.sysctl.ip6_rt_gc_interval = 30*HZ;
3084 	net->ipv6.sysctl.ip6_rt_gc_elasticity = 9;
3085 	net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
3086 	net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
3087 
3088 	net->ipv6.ip6_rt_gc_expire = 30*HZ;
3089 
3090 	ret = 0;
3091 out:
3092 	return ret;
3093 
3094 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
3095 out_ip6_prohibit_entry:
3096 	kfree(net->ipv6.ip6_prohibit_entry);
3097 out_ip6_null_entry:
3098 	kfree(net->ipv6.ip6_null_entry);
3099 #endif
3100 out_ip6_dst_entries:
3101 	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
3102 out_ip6_dst_ops:
3103 	goto out;
3104 }
3105 
3106 static void __net_exit ip6_route_net_exit(struct net *net)
3107 {
3108 	kfree(net->ipv6.ip6_null_entry);
3109 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
3110 	kfree(net->ipv6.ip6_prohibit_entry);
3111 	kfree(net->ipv6.ip6_blk_hole_entry);
3112 #endif
3113 	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
3114 }
3115 
3116 static int __net_init ip6_route_net_init_late(struct net *net)
3117 {
3118 #ifdef CONFIG_PROC_FS
3119 	proc_create("ipv6_route", 0, net->proc_net, &ipv6_route_proc_fops);
3120 	proc_create("rt6_stats", S_IRUGO, net->proc_net, &rt6_stats_seq_fops);
3121 #endif
3122 	return 0;
3123 }
3124 
3125 static void __net_exit ip6_route_net_exit_late(struct net *net)
3126 {
3127 #ifdef CONFIG_PROC_FS
3128 	remove_proc_entry("ipv6_route", net->proc_net);
3129 	remove_proc_entry("rt6_stats", net->proc_net);
3130 #endif
3131 }
3132 
3133 static struct pernet_operations ip6_route_net_ops = {
3134 	.init = ip6_route_net_init,
3135 	.exit = ip6_route_net_exit,
3136 };
3137 
3138 static int __net_init ipv6_inetpeer_init(struct net *net)
3139 {
3140 	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
3141 
3142 	if (!bp)
3143 		return -ENOMEM;
3144 	inet_peer_base_init(bp);
3145 	net->ipv6.peers = bp;
3146 	return 0;
3147 }
3148 
3149 static void __net_exit ipv6_inetpeer_exit(struct net *net)
3150 {
3151 	struct inet_peer_base *bp = net->ipv6.peers;
3152 
3153 	net->ipv6.peers = NULL;
3154 	inetpeer_invalidate_tree(bp);
3155 	kfree(bp);
3156 }
3157 
3158 static struct pernet_operations ipv6_inetpeer_ops = {
3159 	.init	=	ipv6_inetpeer_init,
3160 	.exit	=	ipv6_inetpeer_exit,
3161 };
3162 
3163 static struct pernet_operations ip6_route_net_late_ops = {
3164 	.init = ip6_route_net_init_late,
3165 	.exit = ip6_route_net_exit_late,
3166 };
3167 
3168 static struct notifier_block ip6_route_dev_notifier = {
3169 	.notifier_call = ip6_route_dev_notify,
3170 	.priority = 0,
3171 };
3172 
3173 int __init ip6_route_init(void)
3174 {
3175 	int ret;
3176 
3177 	ret = -ENOMEM;
3178 	ip6_dst_ops_template.kmem_cachep =
3179 		kmem_cache_create("ip6_dst_cache", sizeof(struct rt6_info), 0,
3180 				  SLAB_HWCACHE_ALIGN, NULL);
3181 	if (!ip6_dst_ops_template.kmem_cachep)
3182 		goto out;
3183 
3184 	ret = dst_entries_init(&ip6_dst_blackhole_ops);
3185 	if (ret)
3186 		goto out_kmem_cache;
3187 
3188 	ret = register_pernet_subsys(&ipv6_inetpeer_ops);
3189 	if (ret)
3190 		goto out_dst_entries;
3191 
3192 	ret = register_pernet_subsys(&ip6_route_net_ops);
3193 	if (ret)
3194 		goto out_register_inetpeer;
3195 
3196 	ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
3197 
3198 	/* Registering of the loopback is done before this portion of code,
3199 	 * the loopback reference in rt6_info will not be taken, do it
3200 	 * manually for init_net */
3201 	init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
3202 	init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
3203   #ifdef CONFIG_IPV6_MULTIPLE_TABLES
3204 	init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
3205 	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
3206 	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
3207 	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
3208   #endif
3209 	ret = fib6_init();
3210 	if (ret)
3211 		goto out_register_subsys;
3212 
3213 	ret = xfrm6_init();
3214 	if (ret)
3215 		goto out_fib6_init;
3216 
3217 	ret = fib6_rules_init();
3218 	if (ret)
3219 		goto xfrm6_init;
3220 
3221 	ret = register_pernet_subsys(&ip6_route_net_late_ops);
3222 	if (ret)
3223 		goto fib6_rules_init;
3224 
3225 	ret = -ENOBUFS;
3226 	if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
3227 	    __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
3228 	    __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
3229 		goto out_register_late_subsys;
3230 
3231 	ret = register_netdevice_notifier(&ip6_route_dev_notifier);
3232 	if (ret)
3233 		goto out_register_late_subsys;
3234 
3235 out:
3236 	return ret;
3237 
3238 out_register_late_subsys:
3239 	unregister_pernet_subsys(&ip6_route_net_late_ops);
3240 fib6_rules_init:
3241 	fib6_rules_cleanup();
3242 xfrm6_init:
3243 	xfrm6_fini();
3244 out_fib6_init:
3245 	fib6_gc_cleanup();
3246 out_register_subsys:
3247 	unregister_pernet_subsys(&ip6_route_net_ops);
3248 out_register_inetpeer:
3249 	unregister_pernet_subsys(&ipv6_inetpeer_ops);
3250 out_dst_entries:
3251 	dst_entries_destroy(&ip6_dst_blackhole_ops);
3252 out_kmem_cache:
3253 	kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
3254 	goto out;
3255 }
3256 
3257 void ip6_route_cleanup(void)
3258 {
3259 	unregister_netdevice_notifier(&ip6_route_dev_notifier);
3260 	unregister_pernet_subsys(&ip6_route_net_late_ops);
3261 	fib6_rules_cleanup();
3262 	xfrm6_fini();
3263 	fib6_gc_cleanup();
3264 	unregister_pernet_subsys(&ipv6_inetpeer_ops);
3265 	unregister_pernet_subsys(&ip6_route_net_ops);
3266 	dst_entries_destroy(&ip6_dst_blackhole_ops);
3267 	kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
3268 }
3269