net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
  47 #include <net/xfrm.h>
  48 #endif
  49
  50 #include <asm/uaccess.h>
  51
  52 int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
  53 {
  54         const unsigned char *nh = skb_network_header(skb);
  55         int packet_len = skb->tail - skb->network_header;
  56         struct ipv6_opt_hdr *hdr;
  57         int len;
  58
  59         if (offset + 2 > packet_len)
  60                 goto bad;
  61         hdr = (struct ipv6_opt_hdr *)(nh + offset);
  62         len = ((hdr->hdrlen + 1) << 3);
  63
  64         if (offset + len > packet_len)
  65                 goto bad;
  66
  67         offset += 2;
  68         len -= 2;
  69
  70         while (len > 0) {
  71                 int opttype = nh[offset];
  72                 int optlen;
  73
  74                 if (opttype == type)
  75                         return offset;
  76
  77                 switch (opttype) {
  78                 case IPV6_TLV_PAD0:
  79                         optlen = 1;
  80                         break;
  81                 default:
  82                         optlen = nh[offset + 1] + 2;
  83                         if (optlen > len)
  84                                 goto bad;
  85                         break;
  86                 }
  87                 offset += optlen;
  88                 len -= optlen;
  89         }
  90         /* not_found */
  91  bad:
  92         return -1;
  93 }
  94 EXPORT_SYMBOL_GPL(ipv6_find_tlv);
  95
  96 /*
  97  *      Parsing tlv encoded headers.
  98  *
  99  *      Parsing function "func" returns 1, if parsing succeed
 100  *      and 0, if it failed.
 101  *      It MUST NOT touch skb->h.
 102  */
 103
 104 struct tlvtype_proc {
 105         int     type;
 106         int     (*func)(struct sk_buff *skb, int offset);
 107 };
 108
 109 /*********************
 110   Generic functions
 111  *********************/
 112
 113 /* An unknown option is detected, decide what to do */
 114
 115 static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
 116 {
 117         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
 118         case 0: /* ignore */
 119                 return 1;
 120
 121         case 1: /* drop packet */
 122                 break;
 123
 124         case 3: /* Send ICMP if not a multicast address and drop packet */
 125                 /* Actually, it is redundant check. icmp_send
 126                    will recheck in any case.
 127                  */
 128                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
 129                         break;
 130         case 2: /* send ICMP PARM PROB regardless and drop packet */
 131                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
 132                 return 0;
 133         }
 134
 135         kfree_skb(skb);
 136         return 0;
 137 }
 138
 139 /* Parse tlv encoded option header (hop-by-hop or destination) */
 140
 141 static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
 142 {
 143         struct tlvtype_proc *curr;
 144         const unsigned char *nh = skb_network_header(skb);
 145         int off = skb_network_header_len(skb);
 146         int len = (skb_transport_header(skb)[1] + 1) << 3;
 147
 148         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 149                 goto bad;
 150
 151         off += 2;
 152         len -= 2;
 153
 154         while (len > 0) {
 155                 int optlen = nh[off + 1] + 2;
 156                 int i;
 157
 158                 switch (nh[off]) {
 159                 case IPV6_TLV_PAD0:
 160                         optlen = 1;
 161                         break;
 162
 163                 case IPV6_TLV_PADN:
 164                         /* RFC 2460 states that the purpose of PadN is
 165                          * to align the containing header to multiples
 166                          * of 8. 7 is therefore the highest valid value.
 167                          * See also RFC 4942, Section 2.1.9.5.
 168                          */
 169                         if (optlen > 7)
 170                                 goto bad;
 171                         /* RFC 4942 recommends receiving hosts to
 172                          * actively check PadN payload to contain
 173                          * only zeroes.
 174                          */
 175                         for (i = 2; i < optlen; i++) {
 176                                 if (nh[off + i] != 0)
 177                                         goto bad;
 178                         }
 179                         break;
 180
 181                 default: /* Other TLV code so scan list */
 182                         if (optlen > len)
 183                                 goto bad;
 184                         for (curr=procs; curr->type >= 0; curr++) {
 185                                 if (curr->type == nh[off]) {
 186                                         /* type specific length/alignment
 187                                            checks will be performed in the
 188                                            func(). */
 189                                         if (curr->func(skb, off) == 0)
 190                                                 return 0;
 191                                         break;
 192                                 }
 193                         }
 194                         if (curr->type < 0) {
 195                                 if (ip6_tlvopt_unknown(skb, off) == 0)
 196                                         return 0;
 197                         }
 198                         break;
 199                 }
 200                 off += optlen;
 201                 len -= optlen;
 202         }
 203         if (len == 0)
 204                 return 1;
 205 bad:
 206         kfree_skb(skb);
 207         return 0;
 208 }
 209
 210 /*****************************
 211   Destination options header.
 212  *****************************/
 213
 214 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 215 static int ipv6_dest_hao(struct sk_buff *skb, int optoff)
 216 {
 217         struct ipv6_destopt_hao *hao;
 218         struct inet6_skb_parm *opt = IP6CB(skb);
 219         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 220         struct in6_addr tmp_addr;
 221         int ret;
 222
 223         if (opt->dsthao) {
 224                 LIMIT_NETDEBUG(KERN_DEBUG "hao duplicated\n");
 225                 goto discard;
 226         }
 227         opt->dsthao = opt->dst1;
 228         opt->dst1 = 0;
 229
 230         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 231
 232         if (hao->length != 16) {
 233                 LIMIT_NETDEBUG(
 234                         KERN_DEBUG "hao invalid option length = %d\n", hao->length);
 235                 goto discard;
 236         }
 237
 238         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 239                 LIMIT_NETDEBUG(
 240                         KERN_DEBUG "hao is not an unicast addr: %pI6\n", &hao->addr);
 241                 goto discard;
 242         }
 243
 244         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 245                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 246         if (unlikely(ret < 0))
 247                 goto discard;
 248
 249         if (skb_cloned(skb)) {
 250                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 251                         goto discard;
 252
 253                 /* update all variable using below by copied skbuff */
 254                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 255                                                   optoff);
 256                 ipv6h = ipv6_hdr(skb);
 257         }
 258
 259         if (skb->ip_summed == CHECKSUM_COMPLETE)
 260                 skb->ip_summed = CHECKSUM_NONE;
 261
 262         tmp_addr = ipv6h->saddr;
 263         ipv6h->saddr = hao->addr;
 264         hao->addr = tmp_addr;
 265
 266         if (skb->tstamp.tv64 == 0)
 267                 __net_timestamp(skb);
 268
 269         return 1;
 270
 271  discard:
 272         kfree_skb(skb);
 273         return 0;
 274 }
 275 #endif
 276
 277 static struct tlvtype_proc tlvprocdestopt_lst[] = {
 278 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 279         {
 280                 .type   = IPV6_TLV_HAO,
 281                 .func   = ipv6_dest_hao,
 282         },
 283 #endif
 284         {-1,                    NULL}
 285 };
 286
 287 static int ipv6_destopt_rcv(struct sk_buff *skb)
 288 {
 289         struct inet6_skb_parm *opt = IP6CB(skb);
 290 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 291         __u16 dstbuf;
 292 #endif
 293         struct dst_entry *dst = skb_dst(skb);
 294
 295         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 296             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 297                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 298                 IP6_INC_STATS_BH(dev_net(dst->dev), ip6_dst_idev(dst),
 299                                  IPSTATS_MIB_INHDRERRORS);
 300                 kfree_skb(skb);
 301                 return -1;
 302         }
 303
 304         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 305 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 306         dstbuf = opt->dst1;
 307 #endif
 308
 309         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
 310                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 311                 opt = IP6CB(skb);
 312 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 313                 opt->nhoff = dstbuf;
 314 #else
 315                 opt->nhoff = opt->dst1;
 316 #endif
 317                 return 1;
 318         }
 319
 320         IP6_INC_STATS_BH(dev_net(dst->dev),
 321                          ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 322         return -1;
 323 }
 324
 325 /********************************
 326   Routing header.
 327  ********************************/
 328
 329 /* called with rcu_read_lock() */
 330 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 331 {
 332         struct inet6_skb_parm *opt = IP6CB(skb);
 333         struct in6_addr *addr = NULL;
 334         struct in6_addr daddr;
 335         struct inet6_dev *idev;
 336         int n, i;
 337         struct ipv6_rt_hdr *hdr;
 338         struct rt0_hdr *rthdr;
 339         struct net *net = dev_net(skb->dev);
 340         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 341
 342         idev = __in6_dev_get(skb->dev);
 343         if (idev && accept_source_route > idev->cnf.accept_source_route)
 344                 accept_source_route = idev->cnf.accept_source_route;
 345
 346         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 347             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 348                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 349                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 350                                  IPSTATS_MIB_INHDRERRORS);
 351                 kfree_skb(skb);
 352                 return -1;
 353         }
 354
 355         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 356
 357         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 358             skb->pkt_type != PACKET_HOST) {
 359                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 360                                  IPSTATS_MIB_INADDRERRORS);
 361                 kfree_skb(skb);
 362                 return -1;
 363         }
 364
 365 looped_back:
 366         if (hdr->segments_left == 0) {
 367                 switch (hdr->type) {
 368 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 369                 case IPV6_SRCRT_TYPE_2:
 370                         /* Silently discard type 2 header unless it was
 371                          * processed by own
 372                          */
 373                         if (!addr) {
 374                                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 375                                                  IPSTATS_MIB_INADDRERRORS);
 376                                 kfree_skb(skb);
 377                                 return -1;
 378                         }
 379                         break;
 380 #endif
 381                 default:
 382                         break;
 383                 }
 384
 385                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 386                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 387                 opt->dst0 = opt->dst1;
 388                 opt->dst1 = 0;
 389                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 390                 return 1;
 391         }
 392
 393         switch (hdr->type) {
 394 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 395         case IPV6_SRCRT_TYPE_2:
 396                 if (accept_source_route < 0)
 397                         goto unknown_rh;
 398                 /* Silently discard invalid RTH type 2 */
 399                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 400                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 401                                          IPSTATS_MIB_INHDRERRORS);
 402                         kfree_skb(skb);
 403                         return -1;
 404                 }
 405                 break;
 406 #endif
 407         default:
 408                 goto unknown_rh;
 409         }
 410
 411         /*
 412          *      This is the routing header forwarding algorithm from
 413          *      RFC 2460, page 16.
 414          */
 415
 416         n = hdr->hdrlen >> 1;
 417
 418         if (hdr->segments_left > n) {
 419                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 420                                  IPSTATS_MIB_INHDRERRORS);
 421                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 422                                   ((&hdr->segments_left) -
 423                                    skb_network_header(skb)));
 424                 return -1;
 425         }
 426
 427         /* We are about to mangle packet header. Be careful!
 428            Do not damage packets queued somewhere.
 429          */
 430         if (skb_cloned(skb)) {
 431                 /* the copy is a forwarded packet */
 432                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 433                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 434                                          IPSTATS_MIB_OUTDISCARDS);
 435                         kfree_skb(skb);
 436                         return -1;
 437                 }
 438                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 439         }
 440
 441         if (skb->ip_summed == CHECKSUM_COMPLETE)
 442                 skb->ip_summed = CHECKSUM_NONE;
 443
 444         i = n - --hdr->segments_left;
 445
 446         rthdr = (struct rt0_hdr *) hdr;
 447         addr = rthdr->addr;
 448         addr += i - 1;
 449
 450         switch (hdr->type) {
 451 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 452         case IPV6_SRCRT_TYPE_2:
 453                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 454                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 455                                      IPPROTO_ROUTING) < 0) {
 456                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 457                                          IPSTATS_MIB_INADDRERRORS);
 458                         kfree_skb(skb);
 459                         return -1;
 460                 }
 461                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 462                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 463                                          IPSTATS_MIB_INADDRERRORS);
 464                         kfree_skb(skb);
 465                         return -1;
 466                 }
 467                 break;
 468 #endif
 469         default:
 470                 break;
 471         }
 472
 473         if (ipv6_addr_is_multicast(addr)) {
 474                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 475                                  IPSTATS_MIB_INADDRERRORS);
 476                 kfree_skb(skb);
 477                 return -1;
 478         }
 479
 480         daddr = *addr;
 481         *addr = ipv6_hdr(skb)->daddr;
 482         ipv6_hdr(skb)->daddr = daddr;
 483
 484         skb_dst_drop(skb);
 485         ip6_route_input(skb);
 486         if (skb_dst(skb)->error) {
 487                 skb_push(skb, skb->data - skb_network_header(skb));
 488                 dst_input(skb);
 489                 return -1;
 490         }
 491
 492         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 493                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 494                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 495                                          IPSTATS_MIB_INHDRERRORS);
 496                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 497                                     0);
 498                         kfree_skb(skb);
 499                         return -1;
 500                 }
 501                 ipv6_hdr(skb)->hop_limit--;
 502                 goto looped_back;
 503         }
 504
 505         skb_push(skb, skb->data - skb_network_header(skb));
 506         dst_input(skb);
 507         return -1;
 508
 509 unknown_rh:
 510         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
 511         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 512                           (&hdr->type) - skb_network_header(skb));
 513         return -1;
 514 }
 515
 516 static const struct inet6_protocol rthdr_protocol = {
 517         .handler        =       ipv6_rthdr_rcv,
 518         .flags          =       INET6_PROTO_NOPOLICY | INET6_PROTO_GSO_EXTHDR,
 519 };
 520
 521 static const struct inet6_protocol destopt_protocol = {
 522         .handler        =       ipv6_destopt_rcv,
 523         .flags          =       INET6_PROTO_NOPOLICY | INET6_PROTO_GSO_EXTHDR,
 524 };
 525
 526 static const struct inet6_protocol nodata_protocol = {
 527         .handler        =       dst_discard,
 528         .flags          =       INET6_PROTO_NOPOLICY,
 529 };
 530
 531 int __init ipv6_exthdrs_init(void)
 532 {
 533         int ret;
 534
 535         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 536         if (ret)
 537                 goto out;
 538
 539         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 540         if (ret)
 541                 goto out_rthdr;
 542
 543         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 544         if (ret)
 545                 goto out_destopt;
 546
 547 out:
 548         return ret;
 549 out_rthdr:
 550         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 551 out_destopt:
 552         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 553         goto out;
 554 };
 555
 556 void ipv6_exthdrs_exit(void)
 557 {
 558         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 559         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 560         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 561 }
 562
 563 /**********************************
 564   Hop-by-hop options.
 565  **********************************/
 566
 567 /*
 568  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 569  */
 570 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 571 {
 572         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 573 }
 574
 575 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 576 {
 577         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 578 }
 579
 580 /* Router Alert as of RFC 2711 */
 581
 582 static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 583 {
 584         const unsigned char *nh = skb_network_header(skb);
 585
 586         if (nh[optoff + 1] == 2) {
 587                 IP6CB(skb)->ra = optoff;
 588                 return 1;
 589         }
 590         LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
 591                        nh[optoff + 1]);
 592         kfree_skb(skb);
 593         return 0;
 594 }
 595
 596 /* Jumbo payload */
 597
 598 static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 599 {
 600         const unsigned char *nh = skb_network_header(skb);
 601         struct net *net = ipv6_skb_net(skb);
 602         u32 pkt_len;
 603
 604         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 605                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 606                                nh[optoff+1]);
 607                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 608                                  IPSTATS_MIB_INHDRERRORS);
 609                 goto drop;
 610         }
 611
 612         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 613         if (pkt_len <= IPV6_MAXPLEN) {
 614                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 615                                  IPSTATS_MIB_INHDRERRORS);
 616                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 617                 return 0;
 618         }
 619         if (ipv6_hdr(skb)->payload_len) {
 620                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 621                                  IPSTATS_MIB_INHDRERRORS);
 622                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 623                 return 0;
 624         }
 625
 626         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 627                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 628                                  IPSTATS_MIB_INTRUNCATEDPKTS);
 629                 goto drop;
 630         }
 631
 632         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 633                 goto drop;
 634
 635         return 1;
 636
 637 drop:
 638         kfree_skb(skb);
 639         return 0;
 640 }
 641
 642 static struct tlvtype_proc tlvprochopopt_lst[] = {
 643         {
 644                 .type   = IPV6_TLV_ROUTERALERT,
 645                 .func   = ipv6_hop_ra,
 646         },
 647         {
 648                 .type   = IPV6_TLV_JUMBO,
 649                 .func   = ipv6_hop_jumbo,
 650         },
 651         { -1, }
 652 };
 653
 654 int ipv6_parse_hopopts(struct sk_buff *skb)
 655 {
 656         struct inet6_skb_parm *opt = IP6CB(skb);
 657
 658         /*
 659          * skb_network_header(skb) is equal to skb->data, and
 660          * skb_network_header_len(skb) is always equal to
 661          * sizeof(struct ipv6hdr) by definition of
 662          * hop-by-hop options.
 663          */
 664         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 665             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 666                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 667                 kfree_skb(skb);
 668                 return -1;
 669         }
 670
 671         opt->hop = sizeof(struct ipv6hdr);
 672         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
 673                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 674                 opt = IP6CB(skb);
 675                 opt->nhoff = sizeof(struct ipv6hdr);
 676                 return 1;
 677         }
 678         return -1;
 679 }
 680
 681 /*
 682  *      Creating outbound headers.
 683  *
 684  *      "build" functions work when skb is filled from head to tail (datagram)
 685  *      "push"  functions work when headers are added from tail to head (tcp)
 686  *
 687  *      In both cases we assume, that caller reserved enough room
 688  *      for headers.
 689  */
 690
 691 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 692                             struct ipv6_rt_hdr *opt,
 693                             struct in6_addr **addr_p)
 694 {
 695         struct rt0_hdr *phdr, *ihdr;
 696         int hops;
 697
 698         ihdr = (struct rt0_hdr *) opt;
 699
 700         phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 701         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 702
 703         hops = ihdr->rt_hdr.hdrlen >> 1;
 704
 705         if (hops > 1)
 706                 memcpy(phdr->addr, ihdr->addr + 1,
 707                        (hops - 1) * sizeof(struct in6_addr));
 708
 709         phdr->addr[hops - 1] = **addr_p;
 710         *addr_p = ihdr->addr;
 711
 712         phdr->rt_hdr.nexthdr = *proto;
 713         *proto = NEXTHDR_ROUTING;
 714 }
 715
 716 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 717 {
 718         struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));
 719
 720         memcpy(h, opt, ipv6_optlen(opt));
 721         h->nexthdr = *proto;
 722         *proto = type;
 723 }
 724
 725 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 726                           u8 *proto,
 727                           struct in6_addr **daddr)
 728 {
 729         if (opt->srcrt) {
 730                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr);
 731                 /*
 732                  * IPV6_RTHDRDSTOPTS is ignored
 733                  * unless IPV6_RTHDR is set (RFC3542).
 734                  */
 735                 if (opt->dst0opt)
 736                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 737         }
 738         if (opt->hopopt)
 739                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 740 }
 741 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 742
 743 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 744 {
 745         if (opt->dst1opt)
 746                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 747 }
 748
 749 struct ipv6_txoptions *
 750 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 751 {
 752         struct ipv6_txoptions *opt2;
 753
 754         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 755         if (opt2) {
 756                 long dif = (char *)opt2 - (char *)opt;
 757                 memcpy(opt2, opt, opt->tot_len);
 758                 if (opt2->hopopt)
 759                         *((char **)&opt2->hopopt) += dif;
 760                 if (opt2->dst0opt)
 761                         *((char **)&opt2->dst0opt) += dif;
 762                 if (opt2->dst1opt)
 763                         *((char **)&opt2->dst1opt) += dif;
 764                 if (opt2->srcrt)
 765                         *((char **)&opt2->srcrt) += dif;
 766         }
 767         return opt2;
 768 }
 769 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 770
 771 static int ipv6_renew_option(void *ohdr,
 772                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
 773                              int inherit,
 774                              struct ipv6_opt_hdr **hdr,
 775                              char **p)
 776 {
 777         if (inherit) {
 778                 if (ohdr) {
 779                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
 780                         *hdr = (struct ipv6_opt_hdr *)*p;
 781                         *p += CMSG_ALIGN(ipv6_optlen(*(struct ipv6_opt_hdr **)hdr));
 782                 }
 783         } else {
 784                 if (newopt) {
 785                         if (copy_from_user(*p, newopt, newoptlen))
 786                                 return -EFAULT;
 787                         *hdr = (struct ipv6_opt_hdr *)*p;
 788                         if (ipv6_optlen(*(struct ipv6_opt_hdr **)hdr) > newoptlen)
 789                                 return -EINVAL;
 790                         *p += CMSG_ALIGN(newoptlen);
 791                 }
 792         }
 793         return 0;
 794 }
 795
 796 struct ipv6_txoptions *
 797 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
 798                    int newtype,
 799                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
 800 {
 801         int tot_len = 0;
 802         char *p;
 803         struct ipv6_txoptions *opt2;
 804         int err;
 805
 806         if (opt) {
 807                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
 808                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
 809                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
 810                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
 811                 if (newtype != IPV6_RTHDR && opt->srcrt)
 812                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
 813                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
 814                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
 815         }
 816
 817         if (newopt && newoptlen)
 818                 tot_len += CMSG_ALIGN(newoptlen);
 819
 820         if (!tot_len)
 821                 return NULL;
 822
 823         tot_len += sizeof(*opt2);
 824         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
 825         if (!opt2)
 826                 return ERR_PTR(-ENOBUFS);
 827
 828         memset(opt2, 0, tot_len);
 829
 830         opt2->tot_len = tot_len;
 831         p = (char *)(opt2 + 1);
 832
 833         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
 834                                 newtype != IPV6_HOPOPTS,
 835                                 &opt2->hopopt, &p);
 836         if (err)
 837                 goto out;
 838
 839         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
 840                                 newtype != IPV6_RTHDRDSTOPTS,
 841                                 &opt2->dst0opt, &p);
 842         if (err)
 843                 goto out;
 844
 845         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
 846                                 newtype != IPV6_RTHDR,
 847                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
 848         if (err)
 849                 goto out;
 850
 851         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
 852                                 newtype != IPV6_DSTOPTS,
 853                                 &opt2->dst1opt, &p);
 854         if (err)
 855                 goto out;
 856
 857         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
 858                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
 859                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
 860         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
 861
 862         return opt2;
 863 out:
 864         sock_kfree_s(sk, opt2, opt2->tot_len);
 865         return ERR_PTR(err);
 866 }
 867
 868 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 869                                           struct ipv6_txoptions *opt)
 870 {
 871         /*
 872          * ignore the dest before srcrt unless srcrt is being included.
 873          * --yoshfuji
 874          */
 875         if (opt && opt->dst0opt && !opt->srcrt) {
 876                 if (opt_space != opt) {
 877                         memcpy(opt_space, opt, sizeof(*opt_space));
 878                         opt = opt_space;
 879                 }
 880                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
 881                 opt->dst0opt = NULL;
 882         }
 883
 884         return opt;
 885 }
 886 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
 887
 888 /**
 889  * fl6_update_dst - update flowi destination address with info given
 890  *                  by srcrt option, if any.
 891  *
 892  * @fl6: flowi6 for which daddr is to be updated
 893  * @opt: struct ipv6_txoptions in which to look for srcrt opt
 894  * @orig: copy of original daddr address if modified
 895  *
 896  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
 897  * and initial value of fl6->daddr set in orig
 898  */
 899 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
 900                                 const struct ipv6_txoptions *opt,
 901                                 struct in6_addr *orig)
 902 {
 903         if (!opt || !opt->srcrt)
 904                 return NULL;
 905
 906         *orig = fl6->daddr;
 907         fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
 908         return orig;
 909 }
 910 EXPORT_SYMBOL_GPL(fl6_update_dst);