net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #include <net/calipso.h>
  47 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  48 #include <net/xfrm.h>
  49 #endif
  50 #include <linux/seg6.h>
  51 #include <net/seg6.h>
  52 #ifdef CONFIG_IPV6_SEG6_HMAC
  53 #include <net/seg6_hmac.h>
  54 #endif
  55
  56 #include <linux/uaccess.h>
  57
  58 /*
  59  *      Parsing tlv encoded headers.
  60  *
  61  *      Parsing function "func" returns true, if parsing succeed
  62  *      and false, if it failed.
  63  *      It MUST NOT touch skb->h.
  64  */
  65
  66 struct tlvtype_proc {
  67         int     type;
  68         bool    (*func)(struct sk_buff *skb, int offset);
  69 };
  70
  71 /*********************
  72   Generic functions
  73  *********************/
  74
  75 /* An unknown option is detected, decide what to do */
  76
  77 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff,
  78                                bool disallow_unknowns)
  79 {
  80         if (disallow_unknowns) {
  81                 /* If unknown TLVs are disallowed by configuration
  82                  * then always silently drop packet. Note this also
  83                  * means no ICMP parameter problem is sent which
  84                  * could be a good property to mitigate a reflection DOS
  85                  * attack.
  86                  */
  87
  88                 goto drop;
  89         }
  90
  91         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  92         case 0: /* ignore */
  93                 return true;
  94
  95         case 1: /* drop packet */
  96                 break;
  97
  98         case 3: /* Send ICMP if not a multicast address and drop packet */
  99                 /* Actually, it is redundant check. icmp_send
 100                    will recheck in any case.
 101                  */
 102                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
 103                         break;
 104                 /* fall through */
 105         case 2: /* send ICMP PARM PROB regardless and drop packet */
 106                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
 107                 return false;
 108         }
 109
 110 drop:
 111         kfree_skb(skb);
 112         return false;
 113 }
 114
 115 /* Parse tlv encoded option header (hop-by-hop or destination) */
 116
 117 static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
 118                           struct sk_buff *skb,
 119                           int max_count)
 120 {
 121         int len = (skb_transport_header(skb)[1] + 1) << 3;
 122         const unsigned char *nh = skb_network_header(skb);
 123         int off = skb_network_header_len(skb);
 124         const struct tlvtype_proc *curr;
 125         bool disallow_unknowns = false;
 126         int tlv_count = 0;
 127         int padlen = 0;
 128
 129         if (unlikely(max_count < 0)) {
 130                 disallow_unknowns = true;
 131                 max_count = -max_count;
 132         }
 133
 134         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 135                 goto bad;
 136
 137         off += 2;
 138         len -= 2;
 139
 140         while (len > 0) {
 141                 int optlen, i;
 142
 143                 if (nh[off] == IPV6_TLV_PAD1) {
 144                         padlen++;
 145                         if (padlen > 7)
 146                                 goto bad;
 147                         off++;
 148                         len--;
 149                         continue;
 150                 }
 151                 if (len < 2)
 152                         goto bad;
 153                 optlen = nh[off + 1] + 2;
 154                 if (optlen > len)
 155                         goto bad;
 156
 157                 if (nh[off] == IPV6_TLV_PADN) {
 158                         /* RFC 2460 states that the purpose of PadN is
 159                          * to align the containing header to multiples
 160                          * of 8. 7 is therefore the highest valid value.
 161                          * See also RFC 4942, Section 2.1.9.5.
 162                          */
 163                         padlen += optlen;
 164                         if (padlen > 7)
 165                                 goto bad;
 166                         /* RFC 4942 recommends receiving hosts to
 167                          * actively check PadN payload to contain
 168                          * only zeroes.
 169                          */
 170                         for (i = 2; i < optlen; i++) {
 171                                 if (nh[off + i] != 0)
 172                                         goto bad;
 173                         }
 174                 } else {
 175                         tlv_count++;
 176                         if (tlv_count > max_count)
 177                                 goto bad;
 178
 179                         for (curr = procs; curr->type >= 0; curr++) {
 180                                 if (curr->type == nh[off]) {
 181                                         /* type specific length/alignment
 182                                            checks will be performed in the
 183                                            func(). */
 184                                         if (curr->func(skb, off) == false)
 185                                                 return false;
 186                                         break;
 187                                 }
 188                         }
 189                         if (curr->type < 0 &&
 190                             !ip6_tlvopt_unknown(skb, off, disallow_unknowns))
 191                                 return false;
 192
 193                         padlen = 0;
 194                 }
 195                 off += optlen;
 196                 len -= optlen;
 197         }
 198
 199         if (len == 0)
 200                 return true;
 201 bad:
 202         kfree_skb(skb);
 203         return false;
 204 }
 205
 206 /*****************************
 207   Destination options header.
 208  *****************************/
 209
 210 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 211 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 212 {
 213         struct ipv6_destopt_hao *hao;
 214         struct inet6_skb_parm *opt = IP6CB(skb);
 215         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 216         int ret;
 217
 218         if (opt->dsthao) {
 219                 net_dbg_ratelimited("hao duplicated\n");
 220                 goto discard;
 221         }
 222         opt->dsthao = opt->dst1;
 223         opt->dst1 = 0;
 224
 225         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 226
 227         if (hao->length != 16) {
 228                 net_dbg_ratelimited("hao invalid option length = %d\n",
 229                                     hao->length);
 230                 goto discard;
 231         }
 232
 233         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 234                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 235                                     &hao->addr);
 236                 goto discard;
 237         }
 238
 239         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 240                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 241         if (unlikely(ret < 0))
 242                 goto discard;
 243
 244         if (skb_cloned(skb)) {
 245                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 246                         goto discard;
 247
 248                 /* update all variable using below by copied skbuff */
 249                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 250                                                   optoff);
 251                 ipv6h = ipv6_hdr(skb);
 252         }
 253
 254         if (skb->ip_summed == CHECKSUM_COMPLETE)
 255                 skb->ip_summed = CHECKSUM_NONE;
 256
 257         swap(ipv6h->saddr, hao->addr);
 258
 259         if (skb->tstamp == 0)
 260                 __net_timestamp(skb);
 261
 262         return true;
 263
 264  discard:
 265         kfree_skb(skb);
 266         return false;
 267 }
 268 #endif
 269
 270 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 271 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 272         {
 273                 .type   = IPV6_TLV_HAO,
 274                 .func   = ipv6_dest_hao,
 275         },
 276 #endif
 277         {-1,                    NULL}
 278 };
 279
 280 static int ipv6_destopt_rcv(struct sk_buff *skb)
 281 {
 282         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 283         struct inet6_skb_parm *opt = IP6CB(skb);
 284 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 285         __u16 dstbuf;
 286 #endif
 287         struct dst_entry *dst = skb_dst(skb);
 288         struct net *net = dev_net(skb->dev);
 289         int extlen;
 290
 291         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 292             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 293                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 294                 __IP6_INC_STATS(dev_net(dst->dev), idev,
 295                                 IPSTATS_MIB_INHDRERRORS);
 296 fail_and_free:
 297                 kfree_skb(skb);
 298                 return -1;
 299         }
 300
 301         extlen = (skb_transport_header(skb)[1] + 1) << 3;
 302         if (extlen > net->ipv6.sysctl.max_dst_opts_len)
 303                 goto fail_and_free;
 304
 305         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 306 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 307         dstbuf = opt->dst1;
 308 #endif
 309
 310         if (ip6_parse_tlv(tlvprocdestopt_lst, skb,
 311                           net->ipv6.sysctl.max_dst_opts_cnt)) {
 312                 skb->transport_header += extlen;
 313                 opt = IP6CB(skb);
 314 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 315                 opt->nhoff = dstbuf;
 316 #else
 317                 opt->nhoff = opt->dst1;
 318 #endif
 319                 return 1;
 320         }
 321
 322         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 323         return -1;
 324 }
 325
 326 static void seg6_update_csum(struct sk_buff *skb)
 327 {
 328         struct ipv6_sr_hdr *hdr;
 329         struct in6_addr *addr;
 330         __be32 from, to;
 331
 332         /* srh is at transport offset and seg_left is already decremented
 333          * but daddr is not yet updated with next segment
 334          */
 335
 336         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 337         addr = hdr->segments + hdr->segments_left;
 338
 339         hdr->segments_left++;
 340         from = *(__be32 *)hdr;
 341
 342         hdr->segments_left--;
 343         to = *(__be32 *)hdr;
 344
 345         /* update skb csum with diff resulting from seg_left decrement */
 346
 347         update_csum_diff4(skb, from, to);
 348
 349         /* compute csum diff between current and next segment and update */
 350
 351         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 352                            (__be32 *)addr);
 353 }
 354
 355 static int ipv6_srh_rcv(struct sk_buff *skb)
 356 {
 357         struct inet6_skb_parm *opt = IP6CB(skb);
 358         struct net *net = dev_net(skb->dev);
 359         struct ipv6_sr_hdr *hdr;
 360         struct inet6_dev *idev;
 361         struct in6_addr *addr;
 362         int accept_seg6;
 363
 364         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 365
 366         idev = __in6_dev_get(skb->dev);
 367
 368         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 369         if (accept_seg6 > idev->cnf.seg6_enabled)
 370                 accept_seg6 = idev->cnf.seg6_enabled;
 371
 372         if (!accept_seg6) {
 373                 kfree_skb(skb);
 374                 return -1;
 375         }
 376
 377 #ifdef CONFIG_IPV6_SEG6_HMAC
 378         if (!seg6_hmac_validate_skb(skb)) {
 379                 kfree_skb(skb);
 380                 return -1;
 381         }
 382 #endif
 383
 384 looped_back:
 385         if (hdr->segments_left == 0) {
 386                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 387                         int offset = (hdr->hdrlen + 1) << 3;
 388
 389                         skb_postpull_rcsum(skb, skb_network_header(skb),
 390                                            skb_network_header_len(skb));
 391
 392                         if (!pskb_pull(skb, offset)) {
 393                                 kfree_skb(skb);
 394                                 return -1;
 395                         }
 396                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 397                                            offset);
 398
 399                         skb_reset_network_header(skb);
 400                         skb_reset_transport_header(skb);
 401                         skb->encapsulation = 0;
 402
 403                         __skb_tunnel_rx(skb, skb->dev, net);
 404
 405                         netif_rx(skb);
 406                         return -1;
 407                 }
 408
 409                 opt->srcrt = skb_network_header_len(skb);
 410                 opt->lastopt = opt->srcrt;
 411                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 412                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 413
 414                 return 1;
 415         }
 416
 417         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 418                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 419                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 420                                   ((&hdr->segments_left) -
 421                                    skb_network_header(skb)));
 422                 return -1;
 423         }
 424
 425         if (skb_cloned(skb)) {
 426                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 427                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 428                                         IPSTATS_MIB_OUTDISCARDS);
 429                         kfree_skb(skb);
 430                         return -1;
 431                 }
 432         }
 433
 434         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 435
 436         hdr->segments_left--;
 437         addr = hdr->segments + hdr->segments_left;
 438
 439         skb_push(skb, sizeof(struct ipv6hdr));
 440
 441         if (skb->ip_summed == CHECKSUM_COMPLETE)
 442                 seg6_update_csum(skb);
 443
 444         ipv6_hdr(skb)->daddr = *addr;
 445
 446         skb_dst_drop(skb);
 447
 448         ip6_route_input(skb);
 449
 450         if (skb_dst(skb)->error) {
 451                 dst_input(skb);
 452                 return -1;
 453         }
 454
 455         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 456                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 457                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 458                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 459                                     ICMPV6_EXC_HOPLIMIT, 0);
 460                         kfree_skb(skb);
 461                         return -1;
 462                 }
 463                 ipv6_hdr(skb)->hop_limit--;
 464
 465                 skb_pull(skb, sizeof(struct ipv6hdr));
 466                 goto looped_back;
 467         }
 468
 469         dst_input(skb);
 470
 471         return -1;
 472 }
 473
 474 /********************************
 475   Routing header.
 476  ********************************/
 477
 478 /* called with rcu_read_lock() */
 479 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 480 {
 481         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 482         struct inet6_skb_parm *opt = IP6CB(skb);
 483         struct in6_addr *addr = NULL;
 484         struct in6_addr daddr;
 485         int n, i;
 486         struct ipv6_rt_hdr *hdr;
 487         struct rt0_hdr *rthdr;
 488         struct net *net = dev_net(skb->dev);
 489         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 490
 491         idev = __in6_dev_get(skb->dev);
 492         if (idev && accept_source_route > idev->cnf.accept_source_route)
 493                 accept_source_route = idev->cnf.accept_source_route;
 494
 495         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 496             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 497                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 498                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 499                 kfree_skb(skb);
 500                 return -1;
 501         }
 502
 503         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 504
 505         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 506             skb->pkt_type != PACKET_HOST) {
 507                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 508                 kfree_skb(skb);
 509                 return -1;
 510         }
 511
 512         /* segment routing */
 513         if (hdr->type == IPV6_SRCRT_TYPE_4)
 514                 return ipv6_srh_rcv(skb);
 515
 516 looped_back:
 517         if (hdr->segments_left == 0) {
 518                 switch (hdr->type) {
 519 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 520                 case IPV6_SRCRT_TYPE_2:
 521                         /* Silently discard type 2 header unless it was
 522                          * processed by own
 523                          */
 524                         if (!addr) {
 525                                 __IP6_INC_STATS(net, idev,
 526                                                 IPSTATS_MIB_INADDRERRORS);
 527                                 kfree_skb(skb);
 528                                 return -1;
 529                         }
 530                         break;
 531 #endif
 532                 default:
 533                         break;
 534                 }
 535
 536                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 537                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 538                 opt->dst0 = opt->dst1;
 539                 opt->dst1 = 0;
 540                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 541                 return 1;
 542         }
 543
 544         switch (hdr->type) {
 545 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 546         case IPV6_SRCRT_TYPE_2:
 547                 if (accept_source_route < 0)
 548                         goto unknown_rh;
 549                 /* Silently discard invalid RTH type 2 */
 550                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 551                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 552                         kfree_skb(skb);
 553                         return -1;
 554                 }
 555                 break;
 556 #endif
 557         default:
 558                 goto unknown_rh;
 559         }
 560
 561         /*
 562          *      This is the routing header forwarding algorithm from
 563          *      RFC 2460, page 16.
 564          */
 565
 566         n = hdr->hdrlen >> 1;
 567
 568         if (hdr->segments_left > n) {
 569                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 570                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 571                                   ((&hdr->segments_left) -
 572                                    skb_network_header(skb)));
 573                 return -1;
 574         }
 575
 576         /* We are about to mangle packet header. Be careful!
 577            Do not damage packets queued somewhere.
 578          */
 579         if (skb_cloned(skb)) {
 580                 /* the copy is a forwarded packet */
 581                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 582                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 583                                         IPSTATS_MIB_OUTDISCARDS);
 584                         kfree_skb(skb);
 585                         return -1;
 586                 }
 587                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 588         }
 589
 590         if (skb->ip_summed == CHECKSUM_COMPLETE)
 591                 skb->ip_summed = CHECKSUM_NONE;
 592
 593         i = n - --hdr->segments_left;
 594
 595         rthdr = (struct rt0_hdr *) hdr;
 596         addr = rthdr->addr;
 597         addr += i - 1;
 598
 599         switch (hdr->type) {
 600 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 601         case IPV6_SRCRT_TYPE_2:
 602                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 603                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 604                                      IPPROTO_ROUTING) < 0) {
 605                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 606                         kfree_skb(skb);
 607                         return -1;
 608                 }
 609                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 610                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 611                         kfree_skb(skb);
 612                         return -1;
 613                 }
 614                 break;
 615 #endif
 616         default:
 617                 break;
 618         }
 619
 620         if (ipv6_addr_is_multicast(addr)) {
 621                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 622                 kfree_skb(skb);
 623                 return -1;
 624         }
 625
 626         daddr = *addr;
 627         *addr = ipv6_hdr(skb)->daddr;
 628         ipv6_hdr(skb)->daddr = daddr;
 629
 630         skb_dst_drop(skb);
 631         ip6_route_input(skb);
 632         if (skb_dst(skb)->error) {
 633                 skb_push(skb, skb->data - skb_network_header(skb));
 634                 dst_input(skb);
 635                 return -1;
 636         }
 637
 638         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 639                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 640                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 641                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 642                                     0);
 643                         kfree_skb(skb);
 644                         return -1;
 645                 }
 646                 ipv6_hdr(skb)->hop_limit--;
 647                 goto looped_back;
 648         }
 649
 650         skb_push(skb, skb->data - skb_network_header(skb));
 651         dst_input(skb);
 652         return -1;
 653
 654 unknown_rh:
 655         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 656         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 657                           (&hdr->type) - skb_network_header(skb));
 658         return -1;
 659 }
 660
 661 static const struct inet6_protocol rthdr_protocol = {
 662         .handler        =       ipv6_rthdr_rcv,
 663         .flags          =       INET6_PROTO_NOPOLICY,
 664 };
 665
 666 static const struct inet6_protocol destopt_protocol = {
 667         .handler        =       ipv6_destopt_rcv,
 668         .flags          =       INET6_PROTO_NOPOLICY,
 669 };
 670
 671 static const struct inet6_protocol nodata_protocol = {
 672         .handler        =       dst_discard,
 673         .flags          =       INET6_PROTO_NOPOLICY,
 674 };
 675
 676 int __init ipv6_exthdrs_init(void)
 677 {
 678         int ret;
 679
 680         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 681         if (ret)
 682                 goto out;
 683
 684         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 685         if (ret)
 686                 goto out_rthdr;
 687
 688         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 689         if (ret)
 690                 goto out_destopt;
 691
 692 out:
 693         return ret;
 694 out_destopt:
 695         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 696 out_rthdr:
 697         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 698         goto out;
 699 };
 700
 701 void ipv6_exthdrs_exit(void)
 702 {
 703         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 704         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 705         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 706 }
 707
 708 /**********************************
 709   Hop-by-hop options.
 710  **********************************/
 711
 712 /*
 713  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 714  */
 715 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 716 {
 717         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 718 }
 719
 720 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 721 {
 722         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 723 }
 724
 725 /* Router Alert as of RFC 2711 */
 726
 727 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 728 {
 729         const unsigned char *nh = skb_network_header(skb);
 730
 731         if (nh[optoff + 1] == 2) {
 732                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 733                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 734                 return true;
 735         }
 736         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 737                             nh[optoff + 1]);
 738         kfree_skb(skb);
 739         return false;
 740 }
 741
 742 /* Jumbo payload */
 743
 744 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 745 {
 746         const unsigned char *nh = skb_network_header(skb);
 747         struct inet6_dev *idev = __in6_dev_get_safely(skb->dev);
 748         struct net *net = ipv6_skb_net(skb);
 749         u32 pkt_len;
 750
 751         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 752                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 753                                     nh[optoff+1]);
 754                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 755                 goto drop;
 756         }
 757
 758         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 759         if (pkt_len <= IPV6_MAXPLEN) {
 760                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 761                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 762                 return false;
 763         }
 764         if (ipv6_hdr(skb)->payload_len) {
 765                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 766                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 767                 return false;
 768         }
 769
 770         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 771                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 772                 goto drop;
 773         }
 774
 775         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 776                 goto drop;
 777
 778         IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
 779         return true;
 780
 781 drop:
 782         kfree_skb(skb);
 783         return false;
 784 }
 785
 786 /* CALIPSO RFC 5570 */
 787
 788 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 789 {
 790         const unsigned char *nh = skb_network_header(skb);
 791
 792         if (nh[optoff + 1] < 8)
 793                 goto drop;
 794
 795         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 796                 goto drop;
 797
 798         if (!calipso_validate(skb, nh + optoff))
 799                 goto drop;
 800
 801         return true;
 802
 803 drop:
 804         kfree_skb(skb);
 805         return false;
 806 }
 807
 808 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 809         {
 810                 .type   = IPV6_TLV_ROUTERALERT,
 811                 .func   = ipv6_hop_ra,
 812         },
 813         {
 814                 .type   = IPV6_TLV_JUMBO,
 815                 .func   = ipv6_hop_jumbo,
 816         },
 817         {
 818                 .type   = IPV6_TLV_CALIPSO,
 819                 .func   = ipv6_hop_calipso,
 820         },
 821         { -1, }
 822 };
 823
 824 int ipv6_parse_hopopts(struct sk_buff *skb)
 825 {
 826         struct inet6_skb_parm *opt = IP6CB(skb);
 827         struct net *net = dev_net(skb->dev);
 828         int extlen;
 829
 830         /*
 831          * skb_network_header(skb) is equal to skb->data, and
 832          * skb_network_header_len(skb) is always equal to
 833          * sizeof(struct ipv6hdr) by definition of
 834          * hop-by-hop options.
 835          */
 836         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 837             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 838                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 839 fail_and_free:
 840                 kfree_skb(skb);
 841                 return -1;
 842         }
 843
 844         extlen = (skb_transport_header(skb)[1] + 1) << 3;
 845         if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
 846                 goto fail_and_free;
 847
 848         opt->flags |= IP6SKB_HOPBYHOP;
 849         if (ip6_parse_tlv(tlvprochopopt_lst, skb,
 850                           net->ipv6.sysctl.max_hbh_opts_cnt)) {
 851                 skb->transport_header += extlen;
 852                 opt = IP6CB(skb);
 853                 opt->nhoff = sizeof(struct ipv6hdr);
 854                 return 1;
 855         }
 856         return -1;
 857 }
 858
 859 /*
 860  *      Creating outbound headers.
 861  *
 862  *      "build" functions work when skb is filled from head to tail (datagram)
 863  *      "push"  functions work when headers are added from tail to head (tcp)
 864  *
 865  *      In both cases we assume, that caller reserved enough room
 866  *      for headers.
 867  */
 868
 869 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
 870                              struct ipv6_rt_hdr *opt,
 871                              struct in6_addr **addr_p, struct in6_addr *saddr)
 872 {
 873         struct rt0_hdr *phdr, *ihdr;
 874         int hops;
 875
 876         ihdr = (struct rt0_hdr *) opt;
 877
 878         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 879         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 880
 881         hops = ihdr->rt_hdr.hdrlen >> 1;
 882
 883         if (hops > 1)
 884                 memcpy(phdr->addr, ihdr->addr + 1,
 885                        (hops - 1) * sizeof(struct in6_addr));
 886
 887         phdr->addr[hops - 1] = **addr_p;
 888         *addr_p = ihdr->addr;
 889
 890         phdr->rt_hdr.nexthdr = *proto;
 891         *proto = NEXTHDR_ROUTING;
 892 }
 893
 894 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
 895                              struct ipv6_rt_hdr *opt,
 896                              struct in6_addr **addr_p, struct in6_addr *saddr)
 897 {
 898         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
 899         int plen, hops;
 900
 901         sr_ihdr = (struct ipv6_sr_hdr *)opt;
 902         plen = (sr_ihdr->hdrlen + 1) << 3;
 903
 904         sr_phdr = skb_push(skb, plen);
 905         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
 906
 907         hops = sr_ihdr->first_segment + 1;
 908         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
 909                (hops - 1) * sizeof(struct in6_addr));
 910
 911         sr_phdr->segments[0] = **addr_p;
 912         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
 913
 914         if (sr_ihdr->hdrlen > hops * 2) {
 915                 int tlvs_offset, tlvs_length;
 916
 917                 tlvs_offset = (1 + hops * 2) << 3;
 918                 tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
 919                 memcpy((char *)sr_phdr + tlvs_offset,
 920                        (char *)sr_ihdr + tlvs_offset, tlvs_length);
 921         }
 922
 923 #ifdef CONFIG_IPV6_SEG6_HMAC
 924         if (sr_has_hmac(sr_phdr)) {
 925                 struct net *net = NULL;
 926
 927                 if (skb->dev)
 928                         net = dev_net(skb->dev);
 929                 else if (skb->sk)
 930                         net = sock_net(skb->sk);
 931
 932                 WARN_ON(!net);
 933
 934                 if (net)
 935                         seg6_push_hmac(net, saddr, sr_phdr);
 936         }
 937 #endif
 938
 939         sr_phdr->nexthdr = *proto;
 940         *proto = NEXTHDR_ROUTING;
 941 }
 942
 943 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 944                             struct ipv6_rt_hdr *opt,
 945                             struct in6_addr **addr_p, struct in6_addr *saddr)
 946 {
 947         switch (opt->type) {
 948         case IPV6_SRCRT_TYPE_0:
 949         case IPV6_SRCRT_STRICT:
 950         case IPV6_SRCRT_TYPE_2:
 951                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
 952                 break;
 953         case IPV6_SRCRT_TYPE_4:
 954                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
 955                 break;
 956         default:
 957                 break;
 958         }
 959 }
 960
 961 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 962 {
 963         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
 964
 965         memcpy(h, opt, ipv6_optlen(opt));
 966         h->nexthdr = *proto;
 967         *proto = type;
 968 }
 969
 970 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 971                           u8 *proto,
 972                           struct in6_addr **daddr, struct in6_addr *saddr)
 973 {
 974         if (opt->srcrt) {
 975                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
 976                 /*
 977                  * IPV6_RTHDRDSTOPTS is ignored
 978                  * unless IPV6_RTHDR is set (RFC3542).
 979                  */
 980                 if (opt->dst0opt)
 981                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 982         }
 983         if (opt->hopopt)
 984                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 985 }
 986
 987 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 988 {
 989         if (opt->dst1opt)
 990                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 991 }
 992 EXPORT_SYMBOL(ipv6_push_frag_opts);
 993
 994 struct ipv6_txoptions *
 995 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 996 {
 997         struct ipv6_txoptions *opt2;
 998
 999         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
1000         if (opt2) {
1001                 long dif = (char *)opt2 - (char *)opt;
1002                 memcpy(opt2, opt, opt->tot_len);
1003                 if (opt2->hopopt)
1004                         *((char **)&opt2->hopopt) += dif;
1005                 if (opt2->dst0opt)
1006                         *((char **)&opt2->dst0opt) += dif;
1007                 if (opt2->dst1opt)
1008                         *((char **)&opt2->dst1opt) += dif;
1009                 if (opt2->srcrt)
1010                         *((char **)&opt2->srcrt) += dif;
1011                 refcount_set(&opt2->refcnt, 1);
1012         }
1013         return opt2;
1014 }
1015 EXPORT_SYMBOL_GPL(ipv6_dup_options);
1016
1017 static void ipv6_renew_option(int renewtype,
1018                               struct ipv6_opt_hdr **dest,
1019                               struct ipv6_opt_hdr *old,
1020                               struct ipv6_opt_hdr *new,
1021                               int newtype, char **p)
1022 {
1023         struct ipv6_opt_hdr *src;
1024
1025         src = (renewtype == newtype ? new : old);
1026         if (!src)
1027                 return;
1028
1029         memcpy(*p, src, ipv6_optlen(src));
1030         *dest = (struct ipv6_opt_hdr *)*p;
1031         *p += CMSG_ALIGN(ipv6_optlen(*dest));
1032 }
1033
1034 /**
1035  * ipv6_renew_options - replace a specific ext hdr with a new one.
1036  *
1037  * @sk: sock from which to allocate memory
1038  * @opt: original options
1039  * @newtype: option type to replace in @opt
1040  * @newopt: new option of type @newtype to replace (user-mem)
1041  * @newoptlen: length of @newopt
1042  *
1043  * Returns a new set of options which is a copy of @opt with the
1044  * option type @newtype replaced with @newopt.
1045  *
1046  * @opt may be NULL, in which case a new set of options is returned
1047  * containing just @newopt.
1048  *
1049  * @newopt may be NULL, in which case the specified option type is
1050  * not copied into the new set of options.
1051  *
1052  * The new set of options is allocated from the socket option memory
1053  * buffer of @sk.
1054  */
1055 struct ipv6_txoptions *
1056 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1057                    int newtype, struct ipv6_opt_hdr *newopt)
1058 {
1059         int tot_len = 0;
1060         char *p;
1061         struct ipv6_txoptions *opt2;
1062
1063         if (opt) {
1064                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1065                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1066                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1067                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1068                 if (newtype != IPV6_RTHDR && opt->srcrt)
1069                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1070                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1071                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1072         }
1073
1074         if (newopt)
1075                 tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
1076
1077         if (!tot_len)
1078                 return NULL;
1079
1080         tot_len += sizeof(*opt2);
1081         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1082         if (!opt2)
1083                 return ERR_PTR(-ENOBUFS);
1084
1085         memset(opt2, 0, tot_len);
1086         refcount_set(&opt2->refcnt, 1);
1087         opt2->tot_len = tot_len;
1088         p = (char *)(opt2 + 1);
1089
1090         ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
1091                           (opt ? opt->hopopt : NULL),
1092                           newopt, newtype, &p);
1093         ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
1094                           (opt ? opt->dst0opt : NULL),
1095                           newopt, newtype, &p);
1096         ipv6_renew_option(IPV6_RTHDR,
1097                           (struct ipv6_opt_hdr **)&opt2->srcrt,
1098                           (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
1099                           newopt, newtype, &p);
1100         ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
1101                           (opt ? opt->dst1opt : NULL),
1102                           newopt, newtype, &p);
1103
1104         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1105                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1106                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1107         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1108
1109         return opt2;
1110 }
1111
1112 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1113                                           struct ipv6_txoptions *opt)
1114 {
1115         /*
1116          * ignore the dest before srcrt unless srcrt is being included.
1117          * --yoshfuji
1118          */
1119         if (opt && opt->dst0opt && !opt->srcrt) {
1120                 if (opt_space != opt) {
1121                         memcpy(opt_space, opt, sizeof(*opt_space));
1122                         opt = opt_space;
1123                 }
1124                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1125                 opt->dst0opt = NULL;
1126         }
1127
1128         return opt;
1129 }
1130 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1131
1132 /**
1133  * fl6_update_dst - update flowi destination address with info given
1134  *                  by srcrt option, if any.
1135  *
1136  * @fl6: flowi6 for which daddr is to be updated
1137  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1138  * @orig: copy of original daddr address if modified
1139  *
1140  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1141  * and initial value of fl6->daddr set in orig
1142  */
1143 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1144                                 const struct ipv6_txoptions *opt,
1145                                 struct in6_addr *orig)
1146 {
1147         if (!opt || !opt->srcrt)
1148                 return NULL;
1149
1150         *orig = fl6->daddr;
1151
1152         switch (opt->srcrt->type) {
1153         case IPV6_SRCRT_TYPE_0:
1154         case IPV6_SRCRT_STRICT:
1155         case IPV6_SRCRT_TYPE_2:
1156                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1157                 break;
1158         case IPV6_SRCRT_TYPE_4:
1159         {
1160                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1161
1162                 fl6->daddr = srh->segments[srh->segments_left];
1163                 break;
1164         }
1165         default:
1166                 return NULL;
1167         }
1168
1169         return orig;
1170 }
1171 EXPORT_SYMBOL_GPL(fl6_update_dst);