exthdrs.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Extension Header handling for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Andi Kleen              <ak@muc.de>
   9  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  10  */
  11
  12 /* Changes:
  13  *      yoshfuji                : ensure not to overrun while parsing
  14  *                                tlv options.
  15  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  16  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  17  *                                handlers as inet6_protocol{}.
  18  */
  19
  20 #include <linux/errno.h>
  21 #include <linux/types.h>
  22 #include <linux/socket.h>
  23 #include <linux/sockios.h>
  24 #include <linux/net.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/in6.h>
  27 #include <linux/icmpv6.h>
  28 #include <linux/slab.h>
  29 #include <linux/export.h>
  30
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/snmp.h>
  34
  35 #include <net/ipv6.h>
  36 #include <net/protocol.h>
  37 #include <net/transp_v6.h>
  38 #include <net/rawv6.h>
  39 #include <net/ndisc.h>
  40 #include <net/ip6_route.h>
  41 #include <net/addrconf.h>
  42 #include <net/calipso.h>
  43 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  44 #include <net/xfrm.h>
  45 #endif
  46 #include <linux/seg6.h>
  47 #include <net/seg6.h>
  48 #ifdef CONFIG_IPV6_SEG6_HMAC
  49 #include <net/seg6_hmac.h>
  50 #endif
  51
  52 #include <linux/uaccess.h>
  53
  54 /*
  55  *      Parsing tlv encoded headers.
  56  *
  57  *      Parsing function "func" returns true, if parsing succeed
  58  *      and false, if it failed.
  59  *      It MUST NOT touch skb->h.
  60  */
  61
  62 struct tlvtype_proc {
  63         int     type;
  64         bool    (*func)(struct sk_buff *skb, int offset);
  65 };
  66
  67 /*********************
  68   Generic functions
  69  *********************/
  70
  71 /* An unknown option is detected, decide what to do */
  72
  73 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff,
  74                                bool disallow_unknowns)
  75 {
  76         if (disallow_unknowns) {
  77                 /* If unknown TLVs are disallowed by configuration
  78                  * then always silently drop packet. Note this also
  79                  * means no ICMP parameter problem is sent which
  80                  * could be a good property to mitigate a reflection DOS
  81                  * attack.
  82                  */
  83
  84                 goto drop;
  85         }
  86
  87         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  88         case 0: /* ignore */
  89                 return true;
  90
  91         case 1: /* drop packet */
  92                 break;
  93
  94         case 3: /* Send ICMP if not a multicast address and drop packet */
  95                 /* Actually, it is redundant check. icmp_send
  96                    will recheck in any case.
  97                  */
  98                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
  99                         break;
 100                 /* fall through */
 101         case 2: /* send ICMP PARM PROB regardless and drop packet */
 102                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
 103                 return false;
 104         }
 105
 106 drop:
 107         kfree_skb(skb);
 108         return false;
 109 }
 110
 111 /* Parse tlv encoded option header (hop-by-hop or destination) */
 112
 113 static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
 114                           struct sk_buff *skb,
 115                           int max_count)
 116 {
 117         int len = (skb_transport_header(skb)[1] + 1) << 3;
 118         const unsigned char *nh = skb_network_header(skb);
 119         int off = skb_network_header_len(skb);
 120         const struct tlvtype_proc *curr;
 121         bool disallow_unknowns = false;
 122         int tlv_count = 0;
 123         int padlen = 0;
 124
 125         if (unlikely(max_count < 0)) {
 126                 disallow_unknowns = true;
 127                 max_count = -max_count;
 128         }
 129
 130         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 131                 goto bad;
 132
 133         off += 2;
 134         len -= 2;
 135
 136         while (len > 0) {
 137                 int optlen, i;
 138
 139                 if (nh[off] == IPV6_TLV_PAD1) {
 140                         padlen++;
 141                         if (padlen > 7)
 142                                 goto bad;
 143                         off++;
 144                         len--;
 145                         continue;
 146                 }
 147                 if (len < 2)
 148                         goto bad;
 149                 optlen = nh[off + 1] + 2;
 150                 if (optlen > len)
 151                         goto bad;
 152
 153                 if (nh[off] == IPV6_TLV_PADN) {
 154                         /* RFC 2460 states that the purpose of PadN is
 155                          * to align the containing header to multiples
 156                          * of 8. 7 is therefore the highest valid value.
 157                          * See also RFC 4942, Section 2.1.9.5.
 158                          */
 159                         padlen += optlen;
 160                         if (padlen > 7)
 161                                 goto bad;
 162                         /* RFC 4942 recommends receiving hosts to
 163                          * actively check PadN payload to contain
 164                          * only zeroes.
 165                          */
 166                         for (i = 2; i < optlen; i++) {
 167                                 if (nh[off + i] != 0)
 168                                         goto bad;
 169                         }
 170                 } else {
 171                         tlv_count++;
 172                         if (tlv_count > max_count)
 173                                 goto bad;
 174
 175                         for (curr = procs; curr->type >= 0; curr++) {
 176                                 if (curr->type == nh[off]) {
 177                                         /* type specific length/alignment
 178                                            checks will be performed in the
 179                                            func(). */
 180                                         if (curr->func(skb, off) == false)
 181                                                 return false;
 182                                         break;
 183                                 }
 184                         }
 185                         if (curr->type < 0 &&
 186                             !ip6_tlvopt_unknown(skb, off, disallow_unknowns))
 187                                 return false;
 188
 189                         padlen = 0;
 190                 }
 191                 off += optlen;
 192                 len -= optlen;
 193         }
 194
 195         if (len == 0)
 196                 return true;
 197 bad:
 198         kfree_skb(skb);
 199         return false;
 200 }
 201
 202 /*****************************
 203   Destination options header.
 204  *****************************/
 205
 206 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 207 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 208 {
 209         struct ipv6_destopt_hao *hao;
 210         struct inet6_skb_parm *opt = IP6CB(skb);
 211         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 212         int ret;
 213
 214         if (opt->dsthao) {
 215                 net_dbg_ratelimited("hao duplicated\n");
 216                 goto discard;
 217         }
 218         opt->dsthao = opt->dst1;
 219         opt->dst1 = 0;
 220
 221         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 222
 223         if (hao->length != 16) {
 224                 net_dbg_ratelimited("hao invalid option length = %d\n",
 225                                     hao->length);
 226                 goto discard;
 227         }
 228
 229         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 230                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 231                                     &hao->addr);
 232                 goto discard;
 233         }
 234
 235         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 236                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 237         if (unlikely(ret < 0))
 238                 goto discard;
 239
 240         if (skb_cloned(skb)) {
 241                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 242                         goto discard;
 243
 244                 /* update all variable using below by copied skbuff */
 245                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 246                                                   optoff);
 247                 ipv6h = ipv6_hdr(skb);
 248         }
 249
 250         if (skb->ip_summed == CHECKSUM_COMPLETE)
 251                 skb->ip_summed = CHECKSUM_NONE;
 252
 253         swap(ipv6h->saddr, hao->addr);
 254
 255         if (skb->tstamp == 0)
 256                 __net_timestamp(skb);
 257
 258         return true;
 259
 260  discard:
 261         kfree_skb(skb);
 262         return false;
 263 }
 264 #endif
 265
 266 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 267 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 268         {
 269                 .type   = IPV6_TLV_HAO,
 270                 .func   = ipv6_dest_hao,
 271         },
 272 #endif
 273         {-1,                    NULL}
 274 };
 275
 276 static int ipv6_destopt_rcv(struct sk_buff *skb)
 277 {
 278         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 279         struct inet6_skb_parm *opt = IP6CB(skb);
 280 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 281         __u16 dstbuf;
 282 #endif
 283         struct dst_entry *dst = skb_dst(skb);
 284         struct net *net = dev_net(skb->dev);
 285         int extlen;
 286
 287         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 288             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 289                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 290                 __IP6_INC_STATS(dev_net(dst->dev), idev,
 291                                 IPSTATS_MIB_INHDRERRORS);
 292 fail_and_free:
 293                 kfree_skb(skb);
 294                 return -1;
 295         }
 296
 297         extlen = (skb_transport_header(skb)[1] + 1) << 3;
 298         if (extlen > net->ipv6.sysctl.max_dst_opts_len)
 299                 goto fail_and_free;
 300
 301         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 302 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 303         dstbuf = opt->dst1;
 304 #endif
 305
 306         if (ip6_parse_tlv(tlvprocdestopt_lst, skb,
 307                           net->ipv6.sysctl.max_dst_opts_cnt)) {
 308                 skb->transport_header += extlen;
 309                 opt = IP6CB(skb);
 310 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 311                 opt->nhoff = dstbuf;
 312 #else
 313                 opt->nhoff = opt->dst1;
 314 #endif
 315                 return 1;
 316         }
 317
 318         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 319         return -1;
 320 }
 321
 322 static void seg6_update_csum(struct sk_buff *skb)
 323 {
 324         struct ipv6_sr_hdr *hdr;
 325         struct in6_addr *addr;
 326         __be32 from, to;
 327
 328         /* srh is at transport offset and seg_left is already decremented
 329          * but daddr is not yet updated with next segment
 330          */
 331
 332         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 333         addr = hdr->segments + hdr->segments_left;
 334
 335         hdr->segments_left++;
 336         from = *(__be32 *)hdr;
 337
 338         hdr->segments_left--;
 339         to = *(__be32 *)hdr;
 340
 341         /* update skb csum with diff resulting from seg_left decrement */
 342
 343         update_csum_diff4(skb, from, to);
 344
 345         /* compute csum diff between current and next segment and update */
 346
 347         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 348                            (__be32 *)addr);
 349 }
 350
 351 static int ipv6_srh_rcv(struct sk_buff *skb)
 352 {
 353         struct inet6_skb_parm *opt = IP6CB(skb);
 354         struct net *net = dev_net(skb->dev);
 355         struct ipv6_sr_hdr *hdr;
 356         struct inet6_dev *idev;
 357         struct in6_addr *addr;
 358         int accept_seg6;
 359
 360         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 361
 362         idev = __in6_dev_get(skb->dev);
 363
 364         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 365         if (accept_seg6 > idev->cnf.seg6_enabled)
 366                 accept_seg6 = idev->cnf.seg6_enabled;
 367
 368         if (!accept_seg6) {
 369                 kfree_skb(skb);
 370                 return -1;
 371         }
 372
 373 #ifdef CONFIG_IPV6_SEG6_HMAC
 374         if (!seg6_hmac_validate_skb(skb)) {
 375                 kfree_skb(skb);
 376                 return -1;
 377         }
 378 #endif
 379
 380 looped_back:
 381         if (hdr->segments_left == 0) {
 382                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 383                         int offset = (hdr->hdrlen + 1) << 3;
 384
 385                         skb_postpull_rcsum(skb, skb_network_header(skb),
 386                                            skb_network_header_len(skb));
 387
 388                         if (!pskb_pull(skb, offset)) {
 389                                 kfree_skb(skb);
 390                                 return -1;
 391                         }
 392                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 393                                            offset);
 394
 395                         skb_reset_network_header(skb);
 396                         skb_reset_transport_header(skb);
 397                         skb->encapsulation = 0;
 398
 399                         __skb_tunnel_rx(skb, skb->dev, net);
 400
 401                         netif_rx(skb);
 402                         return -1;
 403                 }
 404
 405                 opt->srcrt = skb_network_header_len(skb);
 406                 opt->lastopt = opt->srcrt;
 407                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 408                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 409
 410                 return 1;
 411         }
 412
 413         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 414                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 415                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 416                                   ((&hdr->segments_left) -
 417                                    skb_network_header(skb)));
 418                 return -1;
 419         }
 420
 421         if (skb_cloned(skb)) {
 422                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 423                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 424                                         IPSTATS_MIB_OUTDISCARDS);
 425                         kfree_skb(skb);
 426                         return -1;
 427                 }
 428         }
 429
 430         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 431
 432         hdr->segments_left--;
 433         addr = hdr->segments + hdr->segments_left;
 434
 435         skb_push(skb, sizeof(struct ipv6hdr));
 436
 437         if (skb->ip_summed == CHECKSUM_COMPLETE)
 438                 seg6_update_csum(skb);
 439
 440         ipv6_hdr(skb)->daddr = *addr;
 441
 442         skb_dst_drop(skb);
 443
 444         ip6_route_input(skb);
 445
 446         if (skb_dst(skb)->error) {
 447                 dst_input(skb);
 448                 return -1;
 449         }
 450
 451         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 452                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 453                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 454                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 455                                     ICMPV6_EXC_HOPLIMIT, 0);
 456                         kfree_skb(skb);
 457                         return -1;
 458                 }
 459                 ipv6_hdr(skb)->hop_limit--;
 460
 461                 skb_pull(skb, sizeof(struct ipv6hdr));
 462                 goto looped_back;
 463         }
 464
 465         dst_input(skb);
 466
 467         return -1;
 468 }
 469
 470 /********************************
 471   Routing header.
 472  ********************************/
 473
 474 /* called with rcu_read_lock() */
 475 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 476 {
 477         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 478         struct inet6_skb_parm *opt = IP6CB(skb);
 479         struct in6_addr *addr = NULL;
 480         struct in6_addr daddr;
 481         int n, i;
 482         struct ipv6_rt_hdr *hdr;
 483         struct rt0_hdr *rthdr;
 484         struct net *net = dev_net(skb->dev);
 485         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 486
 487         idev = __in6_dev_get(skb->dev);
 488         if (idev && accept_source_route > idev->cnf.accept_source_route)
 489                 accept_source_route = idev->cnf.accept_source_route;
 490
 491         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 492             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 493                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 494                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 495                 kfree_skb(skb);
 496                 return -1;
 497         }
 498
 499         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 500
 501         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 502             skb->pkt_type != PACKET_HOST) {
 503                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 504                 kfree_skb(skb);
 505                 return -1;
 506         }
 507
 508         /* segment routing */
 509         if (hdr->type == IPV6_SRCRT_TYPE_4)
 510                 return ipv6_srh_rcv(skb);
 511
 512 looped_back:
 513         if (hdr->segments_left == 0) {
 514                 switch (hdr->type) {
 515 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 516                 case IPV6_SRCRT_TYPE_2:
 517                         /* Silently discard type 2 header unless it was
 518                          * processed by own
 519                          */
 520                         if (!addr) {
 521                                 __IP6_INC_STATS(net, idev,
 522                                                 IPSTATS_MIB_INADDRERRORS);
 523                                 kfree_skb(skb);
 524                                 return -1;
 525                         }
 526                         break;
 527 #endif
 528                 default:
 529                         break;
 530                 }
 531
 532                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 533                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 534                 opt->dst0 = opt->dst1;
 535                 opt->dst1 = 0;
 536                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 537                 return 1;
 538         }
 539
 540         switch (hdr->type) {
 541 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 542         case IPV6_SRCRT_TYPE_2:
 543                 if (accept_source_route < 0)
 544                         goto unknown_rh;
 545                 /* Silently discard invalid RTH type 2 */
 546                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 547                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 548                         kfree_skb(skb);
 549                         return -1;
 550                 }
 551                 break;
 552 #endif
 553         default:
 554                 goto unknown_rh;
 555         }
 556
 557         /*
 558          *      This is the routing header forwarding algorithm from
 559          *      RFC 2460, page 16.
 560          */
 561
 562         n = hdr->hdrlen >> 1;
 563
 564         if (hdr->segments_left > n) {
 565                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 566                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 567                                   ((&hdr->segments_left) -
 568                                    skb_network_header(skb)));
 569                 return -1;
 570         }
 571
 572         /* We are about to mangle packet header. Be careful!
 573            Do not damage packets queued somewhere.
 574          */
 575         if (skb_cloned(skb)) {
 576                 /* the copy is a forwarded packet */
 577                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 578                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 579                                         IPSTATS_MIB_OUTDISCARDS);
 580                         kfree_skb(skb);
 581                         return -1;
 582                 }
 583                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 584         }
 585
 586         if (skb->ip_summed == CHECKSUM_COMPLETE)
 587                 skb->ip_summed = CHECKSUM_NONE;
 588
 589         i = n - --hdr->segments_left;
 590
 591         rthdr = (struct rt0_hdr *) hdr;
 592         addr = rthdr->addr;
 593         addr += i - 1;
 594
 595         switch (hdr->type) {
 596 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 597         case IPV6_SRCRT_TYPE_2:
 598                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 599                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 600                                      IPPROTO_ROUTING) < 0) {
 601                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 602                         kfree_skb(skb);
 603                         return -1;
 604                 }
 605                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 606                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 607                         kfree_skb(skb);
 608                         return -1;
 609                 }
 610                 break;
 611 #endif
 612         default:
 613                 break;
 614         }
 615
 616         if (ipv6_addr_is_multicast(addr)) {
 617                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 618                 kfree_skb(skb);
 619                 return -1;
 620         }
 621
 622         daddr = *addr;
 623         *addr = ipv6_hdr(skb)->daddr;
 624         ipv6_hdr(skb)->daddr = daddr;
 625
 626         skb_dst_drop(skb);
 627         ip6_route_input(skb);
 628         if (skb_dst(skb)->error) {
 629                 skb_push(skb, skb->data - skb_network_header(skb));
 630                 dst_input(skb);
 631                 return -1;
 632         }
 633
 634         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 635                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 636                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 637                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 638                                     0);
 639                         kfree_skb(skb);
 640                         return -1;
 641                 }
 642                 ipv6_hdr(skb)->hop_limit--;
 643                 goto looped_back;
 644         }
 645
 646         skb_push(skb, skb->data - skb_network_header(skb));
 647         dst_input(skb);
 648         return -1;
 649
 650 unknown_rh:
 651         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 652         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 653                           (&hdr->type) - skb_network_header(skb));
 654         return -1;
 655 }
 656
 657 static const struct inet6_protocol rthdr_protocol = {
 658         .handler        =       ipv6_rthdr_rcv,
 659         .flags          =       INET6_PROTO_NOPOLICY,
 660 };
 661
 662 static const struct inet6_protocol destopt_protocol = {
 663         .handler        =       ipv6_destopt_rcv,
 664         .flags          =       INET6_PROTO_NOPOLICY,
 665 };
 666
 667 static const struct inet6_protocol nodata_protocol = {
 668         .handler        =       dst_discard,
 669         .flags          =       INET6_PROTO_NOPOLICY,
 670 };
 671
 672 int __init ipv6_exthdrs_init(void)
 673 {
 674         int ret;
 675
 676         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 677         if (ret)
 678                 goto out;
 679
 680         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 681         if (ret)
 682                 goto out_rthdr;
 683
 684         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 685         if (ret)
 686                 goto out_destopt;
 687
 688 out:
 689         return ret;
 690 out_destopt:
 691         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 692 out_rthdr:
 693         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 694         goto out;
 695 };
 696
 697 void ipv6_exthdrs_exit(void)
 698 {
 699         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 700         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 701         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 702 }
 703
 704 /**********************************
 705   Hop-by-hop options.
 706  **********************************/
 707
 708 /*
 709  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 710  */
 711 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 712 {
 713         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 714 }
 715
 716 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 717 {
 718         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 719 }
 720
 721 /* Router Alert as of RFC 2711 */
 722
 723 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 724 {
 725         const unsigned char *nh = skb_network_header(skb);
 726
 727         if (nh[optoff + 1] == 2) {
 728                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 729                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 730                 return true;
 731         }
 732         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 733                             nh[optoff + 1]);
 734         kfree_skb(skb);
 735         return false;
 736 }
 737
 738 /* Jumbo payload */
 739
 740 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 741 {
 742         const unsigned char *nh = skb_network_header(skb);
 743         struct inet6_dev *idev = __in6_dev_get_safely(skb->dev);
 744         struct net *net = ipv6_skb_net(skb);
 745         u32 pkt_len;
 746
 747         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 748                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 749                                     nh[optoff+1]);
 750                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 751                 goto drop;
 752         }
 753
 754         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 755         if (pkt_len <= IPV6_MAXPLEN) {
 756                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 757                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 758                 return false;
 759         }
 760         if (ipv6_hdr(skb)->payload_len) {
 761                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 762                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 763                 return false;
 764         }
 765
 766         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 767                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 768                 goto drop;
 769         }
 770
 771         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 772                 goto drop;
 773
 774         IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
 775         return true;
 776
 777 drop:
 778         kfree_skb(skb);
 779         return false;
 780 }
 781
 782 /* CALIPSO RFC 5570 */
 783
 784 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 785 {
 786         const unsigned char *nh = skb_network_header(skb);
 787
 788         if (nh[optoff + 1] < 8)
 789                 goto drop;
 790
 791         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 792                 goto drop;
 793
 794         if (!calipso_validate(skb, nh + optoff))
 795                 goto drop;
 796
 797         return true;
 798
 799 drop:
 800         kfree_skb(skb);
 801         return false;
 802 }
 803
 804 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 805         {
 806                 .type   = IPV6_TLV_ROUTERALERT,
 807                 .func   = ipv6_hop_ra,
 808         },
 809         {
 810                 .type   = IPV6_TLV_JUMBO,
 811                 .func   = ipv6_hop_jumbo,
 812         },
 813         {
 814                 .type   = IPV6_TLV_CALIPSO,
 815                 .func   = ipv6_hop_calipso,
 816         },
 817         { -1, }
 818 };
 819
 820 int ipv6_parse_hopopts(struct sk_buff *skb)
 821 {
 822         struct inet6_skb_parm *opt = IP6CB(skb);
 823         struct net *net = dev_net(skb->dev);
 824         int extlen;
 825
 826         /*
 827          * skb_network_header(skb) is equal to skb->data, and
 828          * skb_network_header_len(skb) is always equal to
 829          * sizeof(struct ipv6hdr) by definition of
 830          * hop-by-hop options.
 831          */
 832         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 833             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 834                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 835 fail_and_free:
 836                 kfree_skb(skb);
 837                 return -1;
 838         }
 839
 840         extlen = (skb_transport_header(skb)[1] + 1) << 3;
 841         if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
 842                 goto fail_and_free;
 843
 844         opt->flags |= IP6SKB_HOPBYHOP;
 845         if (ip6_parse_tlv(tlvprochopopt_lst, skb,
 846                           net->ipv6.sysctl.max_hbh_opts_cnt)) {
 847                 skb->transport_header += extlen;
 848                 opt = IP6CB(skb);
 849                 opt->nhoff = sizeof(struct ipv6hdr);
 850                 return 1;
 851         }
 852         return -1;
 853 }
 854
 855 /*
 856  *      Creating outbound headers.
 857  *
 858  *      "build" functions work when skb is filled from head to tail (datagram)
 859  *      "push"  functions work when headers are added from tail to head (tcp)
 860  *
 861  *      In both cases we assume, that caller reserved enough room
 862  *      for headers.
 863  */
 864
 865 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
 866                              struct ipv6_rt_hdr *opt,
 867                              struct in6_addr **addr_p, struct in6_addr *saddr)
 868 {
 869         struct rt0_hdr *phdr, *ihdr;
 870         int hops;
 871
 872         ihdr = (struct rt0_hdr *) opt;
 873
 874         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 875         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 876
 877         hops = ihdr->rt_hdr.hdrlen >> 1;
 878
 879         if (hops > 1)
 880                 memcpy(phdr->addr, ihdr->addr + 1,
 881                        (hops - 1) * sizeof(struct in6_addr));
 882
 883         phdr->addr[hops - 1] = **addr_p;
 884         *addr_p = ihdr->addr;
 885
 886         phdr->rt_hdr.nexthdr = *proto;
 887         *proto = NEXTHDR_ROUTING;
 888 }
 889
 890 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
 891                              struct ipv6_rt_hdr *opt,
 892                              struct in6_addr **addr_p, struct in6_addr *saddr)
 893 {
 894         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
 895         int plen, hops;
 896
 897         sr_ihdr = (struct ipv6_sr_hdr *)opt;
 898         plen = (sr_ihdr->hdrlen + 1) << 3;
 899
 900         sr_phdr = skb_push(skb, plen);
 901         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
 902
 903         hops = sr_ihdr->first_segment + 1;
 904         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
 905                (hops - 1) * sizeof(struct in6_addr));
 906
 907         sr_phdr->segments[0] = **addr_p;
 908         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
 909
 910         if (sr_ihdr->hdrlen > hops * 2) {
 911                 int tlvs_offset, tlvs_length;
 912
 913                 tlvs_offset = (1 + hops * 2) << 3;
 914                 tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
 915                 memcpy((char *)sr_phdr + tlvs_offset,
 916                        (char *)sr_ihdr + tlvs_offset, tlvs_length);
 917         }
 918
 919 #ifdef CONFIG_IPV6_SEG6_HMAC
 920         if (sr_has_hmac(sr_phdr)) {
 921                 struct net *net = NULL;
 922
 923                 if (skb->dev)
 924                         net = dev_net(skb->dev);
 925                 else if (skb->sk)
 926                         net = sock_net(skb->sk);
 927
 928                 WARN_ON(!net);
 929
 930                 if (net)
 931                         seg6_push_hmac(net, saddr, sr_phdr);
 932         }
 933 #endif
 934
 935         sr_phdr->nexthdr = *proto;
 936         *proto = NEXTHDR_ROUTING;
 937 }
 938
 939 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 940                             struct ipv6_rt_hdr *opt,
 941                             struct in6_addr **addr_p, struct in6_addr *saddr)
 942 {
 943         switch (opt->type) {
 944         case IPV6_SRCRT_TYPE_0:
 945         case IPV6_SRCRT_STRICT:
 946         case IPV6_SRCRT_TYPE_2:
 947                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
 948                 break;
 949         case IPV6_SRCRT_TYPE_4:
 950                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
 951                 break;
 952         default:
 953                 break;
 954         }
 955 }
 956
 957 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 958 {
 959         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
 960
 961         memcpy(h, opt, ipv6_optlen(opt));
 962         h->nexthdr = *proto;
 963         *proto = type;
 964 }
 965
 966 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 967                           u8 *proto,
 968                           struct in6_addr **daddr, struct in6_addr *saddr)
 969 {
 970         if (opt->srcrt) {
 971                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
 972                 /*
 973                  * IPV6_RTHDRDSTOPTS is ignored
 974                  * unless IPV6_RTHDR is set (RFC3542).
 975                  */
 976                 if (opt->dst0opt)
 977                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 978         }
 979         if (opt->hopopt)
 980                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 981 }
 982
 983 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 984 {
 985         if (opt->dst1opt)
 986                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 987 }
 988 EXPORT_SYMBOL(ipv6_push_frag_opts);
 989
 990 struct ipv6_txoptions *
 991 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 992 {
 993         struct ipv6_txoptions *opt2;
 994
 995         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 996         if (opt2) {
 997                 long dif = (char *)opt2 - (char *)opt;
 998                 memcpy(opt2, opt, opt->tot_len);
 999                 if (opt2->hopopt)
1000                         *((char **)&opt2->hopopt) += dif;
1001                 if (opt2->dst0opt)
1002                         *((char **)&opt2->dst0opt) += dif;
1003                 if (opt2->dst1opt)
1004                         *((char **)&opt2->dst1opt) += dif;
1005                 if (opt2->srcrt)
1006                         *((char **)&opt2->srcrt) += dif;
1007                 refcount_set(&opt2->refcnt, 1);
1008         }
1009         return opt2;
1010 }
1011 EXPORT_SYMBOL_GPL(ipv6_dup_options);
1012
1013 static void ipv6_renew_option(int renewtype,
1014                               struct ipv6_opt_hdr **dest,
1015                               struct ipv6_opt_hdr *old,
1016                               struct ipv6_opt_hdr *new,
1017                               int newtype, char **p)
1018 {
1019         struct ipv6_opt_hdr *src;
1020
1021         src = (renewtype == newtype ? new : old);
1022         if (!src)
1023                 return;
1024
1025         memcpy(*p, src, ipv6_optlen(src));
1026         *dest = (struct ipv6_opt_hdr *)*p;
1027         *p += CMSG_ALIGN(ipv6_optlen(*dest));
1028 }
1029
1030 /**
1031  * ipv6_renew_options - replace a specific ext hdr with a new one.
1032  *
1033  * @sk: sock from which to allocate memory
1034  * @opt: original options
1035  * @newtype: option type to replace in @opt
1036  * @newopt: new option of type @newtype to replace (user-mem)
1037  * @newoptlen: length of @newopt
1038  *
1039  * Returns a new set of options which is a copy of @opt with the
1040  * option type @newtype replaced with @newopt.
1041  *
1042  * @opt may be NULL, in which case a new set of options is returned
1043  * containing just @newopt.
1044  *
1045  * @newopt may be NULL, in which case the specified option type is
1046  * not copied into the new set of options.
1047  *
1048  * The new set of options is allocated from the socket option memory
1049  * buffer of @sk.
1050  */
1051 struct ipv6_txoptions *
1052 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1053                    int newtype, struct ipv6_opt_hdr *newopt)
1054 {
1055         int tot_len = 0;
1056         char *p;
1057         struct ipv6_txoptions *opt2;
1058
1059         if (opt) {
1060                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1061                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1062                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1063                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1064                 if (newtype != IPV6_RTHDR && opt->srcrt)
1065                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1066                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1067                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1068         }
1069
1070         if (newopt)
1071                 tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
1072
1073         if (!tot_len)
1074                 return NULL;
1075
1076         tot_len += sizeof(*opt2);
1077         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1078         if (!opt2)
1079                 return ERR_PTR(-ENOBUFS);
1080
1081         memset(opt2, 0, tot_len);
1082         refcount_set(&opt2->refcnt, 1);
1083         opt2->tot_len = tot_len;
1084         p = (char *)(opt2 + 1);
1085
1086         ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
1087                           (opt ? opt->hopopt : NULL),
1088                           newopt, newtype, &p);
1089         ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
1090                           (opt ? opt->dst0opt : NULL),
1091                           newopt, newtype, &p);
1092         ipv6_renew_option(IPV6_RTHDR,
1093                           (struct ipv6_opt_hdr **)&opt2->srcrt,
1094                           (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
1095                           newopt, newtype, &p);
1096         ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
1097                           (opt ? opt->dst1opt : NULL),
1098                           newopt, newtype, &p);
1099
1100         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1101                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1102                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1103         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1104
1105         return opt2;
1106 }
1107
1108 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1109                                           struct ipv6_txoptions *opt)
1110 {
1111         /*
1112          * ignore the dest before srcrt unless srcrt is being included.
1113          * --yoshfuji
1114          */
1115         if (opt && opt->dst0opt && !opt->srcrt) {
1116                 if (opt_space != opt) {
1117                         memcpy(opt_space, opt, sizeof(*opt_space));
1118                         opt = opt_space;
1119                 }
1120                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1121                 opt->dst0opt = NULL;
1122         }
1123
1124         return opt;
1125 }
1126 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1127
1128 /**
1129  * fl6_update_dst - update flowi destination address with info given
1130  *                  by srcrt option, if any.
1131  *
1132  * @fl6: flowi6 for which daddr is to be updated
1133  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1134  * @orig: copy of original daddr address if modified
1135  *
1136  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1137  * and initial value of fl6->daddr set in orig
1138  */
1139 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1140                                 const struct ipv6_txoptions *opt,
1141                                 struct in6_addr *orig)
1142 {
1143         if (!opt || !opt->srcrt)
1144                 return NULL;
1145
1146         *orig = fl6->daddr;
1147
1148         switch (opt->srcrt->type) {
1149         case IPV6_SRCRT_TYPE_0:
1150         case IPV6_SRCRT_STRICT:
1151         case IPV6_SRCRT_TYPE_2:
1152                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1153                 break;
1154         case IPV6_SRCRT_TYPE_4:
1155         {
1156                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1157
1158                 fl6->daddr = srh->segments[srh->segments_left];
1159                 break;
1160         }
1161         default:
1162                 return NULL;
1163         }
1164
1165         return orig;
1166 }
1167 EXPORT_SYMBOL_GPL(fl6_update_dst);