Pileus Git - ~andy/linux/blob - net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  47 #include <net/xfrm.h>
  48 #endif
  49
  50 #include <asm/uaccess.h>
  51 #include "ip6_offload.h"
  52
  53 int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
  54 {
  55         const unsigned char *nh = skb_network_header(skb);
  56         int packet_len = skb->tail - skb->network_header;
  57         struct ipv6_opt_hdr *hdr;
  58         int len;
  59
  60         if (offset + 2 > packet_len)
  61                 goto bad;
  62         hdr = (struct ipv6_opt_hdr *)(nh + offset);
  63         len = ((hdr->hdrlen + 1) << 3);
  64
  65         if (offset + len > packet_len)
  66                 goto bad;
  67
  68         offset += 2;
  69         len -= 2;
  70
  71         while (len > 0) {
  72                 int opttype = nh[offset];
  73                 int optlen;
  74
  75                 if (opttype == type)
  76                         return offset;
  77
  78                 switch (opttype) {
  79                 case IPV6_TLV_PAD1:
  80                         optlen = 1;
  81                         break;
  82                 default:
  83                         optlen = nh[offset + 1] + 2;
  84                         if (optlen > len)
  85                                 goto bad;
  86                         break;
  87                 }
  88                 offset += optlen;
  89                 len -= optlen;
  90         }
  91         /* not_found */
  92  bad:
  93         return -1;
  94 }
  95 EXPORT_SYMBOL_GPL(ipv6_find_tlv);
  96
  97 /*
  98  *      Parsing tlv encoded headers.
  99  *
 100  *      Parsing function "func" returns true, if parsing succeed
 101  *      and false, if it failed.
 102  *      It MUST NOT touch skb->h.
 103  */
 104
 105 struct tlvtype_proc {
 106         int     type;
 107         bool    (*func)(struct sk_buff *skb, int offset);
 108 };
 109
 110 /*********************
 111   Generic functions
 112  *********************/
 113
 114 /* An unknown option is detected, decide what to do */
 115
 116 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
 117 {
 118         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
 119         case 0: /* ignore */
 120                 return true;
 121
 122         case 1: /* drop packet */
 123                 break;
 124
 125         case 3: /* Send ICMP if not a multicast address and drop packet */
 126                 /* Actually, it is redundant check. icmp_send
 127                    will recheck in any case.
 128                  */
 129                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
 130                         break;
 131         case 2: /* send ICMP PARM PROB regardless and drop packet */
 132                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
 133                 return false;
 134         }
 135
 136         kfree_skb(skb);
 137         return false;
 138 }
 139
 140 /* Parse tlv encoded option header (hop-by-hop or destination) */
 141
 142 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
 143 {
 144         const struct tlvtype_proc *curr;
 145         const unsigned char *nh = skb_network_header(skb);
 146         int off = skb_network_header_len(skb);
 147         int len = (skb_transport_header(skb)[1] + 1) << 3;
 148         int padlen = 0;
 149
 150         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 151                 goto bad;
 152
 153         off += 2;
 154         len -= 2;
 155
 156         while (len > 0) {
 157                 int optlen = nh[off + 1] + 2;
 158                 int i;
 159
 160                 switch (nh[off]) {
 161                 case IPV6_TLV_PAD1:
 162                         optlen = 1;
 163                         padlen++;
 164                         if (padlen > 7)
 165                                 goto bad;
 166                         break;
 167
 168                 case IPV6_TLV_PADN:
 169                         /* RFC 2460 states that the purpose of PadN is
 170                          * to align the containing header to multiples
 171                          * of 8. 7 is therefore the highest valid value.
 172                          * See also RFC 4942, Section 2.1.9.5.
 173                          */
 174                         padlen += optlen;
 175                         if (padlen > 7)
 176                                 goto bad;
 177                         /* RFC 4942 recommends receiving hosts to
 178                          * actively check PadN payload to contain
 179                          * only zeroes.
 180                          */
 181                         for (i = 2; i < optlen; i++) {
 182                                 if (nh[off + i] != 0)
 183                                         goto bad;
 184                         }
 185                         break;
 186
 187                 default: /* Other TLV code so scan list */
 188                         if (optlen > len)
 189                                 goto bad;
 190                         for (curr=procs; curr->type >= 0; curr++) {
 191                                 if (curr->type == nh[off]) {
 192                                         /* type specific length/alignment
 193                                            checks will be performed in the
 194                                            func(). */
 195                                         if (curr->func(skb, off) == false)
 196                                                 return false;
 197                                         break;
 198                                 }
 199                         }
 200                         if (curr->type < 0) {
 201                                 if (ip6_tlvopt_unknown(skb, off) == 0)
 202                                         return false;
 203                         }
 204                         padlen = 0;
 205                         break;
 206                 }
 207                 off += optlen;
 208                 len -= optlen;
 209         }
 210         /* This case will not be caught by above check since its padding
 211          * length is smaller than 7:
 212          * 1 byte NH + 1 byte Length + 6 bytes Padding
 213          */
 214         if ((padlen == 6) && ((off - skb_network_header_len(skb)) == 8))
 215                 goto bad;
 216
 217         if (len == 0)
 218                 return true;
 219 bad:
 220         kfree_skb(skb);
 221         return false;
 222 }
 223
 224 /*****************************
 225   Destination options header.
 226  *****************************/
 227
 228 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 229 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 230 {
 231         struct ipv6_destopt_hao *hao;
 232         struct inet6_skb_parm *opt = IP6CB(skb);
 233         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 234         struct in6_addr tmp_addr;
 235         int ret;
 236
 237         if (opt->dsthao) {
 238                 LIMIT_NETDEBUG(KERN_DEBUG "hao duplicated\n");
 239                 goto discard;
 240         }
 241         opt->dsthao = opt->dst1;
 242         opt->dst1 = 0;
 243
 244         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 245
 246         if (hao->length != 16) {
 247                 LIMIT_NETDEBUG(
 248                         KERN_DEBUG "hao invalid option length = %d\n", hao->length);
 249                 goto discard;
 250         }
 251
 252         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 253                 LIMIT_NETDEBUG(
 254                         KERN_DEBUG "hao is not an unicast addr: %pI6\n", &hao->addr);
 255                 goto discard;
 256         }
 257
 258         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 259                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 260         if (unlikely(ret < 0))
 261                 goto discard;
 262
 263         if (skb_cloned(skb)) {
 264                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 265                         goto discard;
 266
 267                 /* update all variable using below by copied skbuff */
 268                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 269                                                   optoff);
 270                 ipv6h = ipv6_hdr(skb);
 271         }
 272
 273         if (skb->ip_summed == CHECKSUM_COMPLETE)
 274                 skb->ip_summed = CHECKSUM_NONE;
 275
 276         tmp_addr = ipv6h->saddr;
 277         ipv6h->saddr = hao->addr;
 278         hao->addr = tmp_addr;
 279
 280         if (skb->tstamp.tv64 == 0)
 281                 __net_timestamp(skb);
 282
 283         return true;
 284
 285  discard:
 286         kfree_skb(skb);
 287         return false;
 288 }
 289 #endif
 290
 291 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 292 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 293         {
 294                 .type   = IPV6_TLV_HAO,
 295                 .func   = ipv6_dest_hao,
 296         },
 297 #endif
 298         {-1,                    NULL}
 299 };
 300
 301 static int ipv6_destopt_rcv(struct sk_buff *skb)
 302 {
 303         struct inet6_skb_parm *opt = IP6CB(skb);
 304 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 305         __u16 dstbuf;
 306 #endif
 307         struct dst_entry *dst = skb_dst(skb);
 308
 309         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 310             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 311                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 312                 IP6_INC_STATS_BH(dev_net(dst->dev), ip6_dst_idev(dst),
 313                                  IPSTATS_MIB_INHDRERRORS);
 314                 kfree_skb(skb);
 315                 return -1;
 316         }
 317
 318         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 319 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 320         dstbuf = opt->dst1;
 321 #endif
 322
 323         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
 324                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 325                 opt = IP6CB(skb);
 326 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 327                 opt->nhoff = dstbuf;
 328 #else
 329                 opt->nhoff = opt->dst1;
 330 #endif
 331                 return 1;
 332         }
 333
 334         IP6_INC_STATS_BH(dev_net(dst->dev),
 335                          ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 336         return -1;
 337 }
 338
 339 /********************************
 340   Routing header.
 341  ********************************/
 342
 343 /* called with rcu_read_lock() */
 344 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 345 {
 346         struct inet6_skb_parm *opt = IP6CB(skb);
 347         struct in6_addr *addr = NULL;
 348         struct in6_addr daddr;
 349         struct inet6_dev *idev;
 350         int n, i;
 351         struct ipv6_rt_hdr *hdr;
 352         struct rt0_hdr *rthdr;
 353         struct net *net = dev_net(skb->dev);
 354         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 355
 356         idev = __in6_dev_get(skb->dev);
 357         if (idev && accept_source_route > idev->cnf.accept_source_route)
 358                 accept_source_route = idev->cnf.accept_source_route;
 359
 360         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 361             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 362                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 363                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 364                                  IPSTATS_MIB_INHDRERRORS);
 365                 kfree_skb(skb);
 366                 return -1;
 367         }
 368
 369         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 370
 371         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 372             skb->pkt_type != PACKET_HOST) {
 373                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 374                                  IPSTATS_MIB_INADDRERRORS);
 375                 kfree_skb(skb);
 376                 return -1;
 377         }
 378
 379 looped_back:
 380         if (hdr->segments_left == 0) {
 381                 switch (hdr->type) {
 382 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 383                 case IPV6_SRCRT_TYPE_2:
 384                         /* Silently discard type 2 header unless it was
 385                          * processed by own
 386                          */
 387                         if (!addr) {
 388                                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 389                                                  IPSTATS_MIB_INADDRERRORS);
 390                                 kfree_skb(skb);
 391                                 return -1;
 392                         }
 393                         break;
 394 #endif
 395                 default:
 396                         break;
 397                 }
 398
 399                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 400                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 401                 opt->dst0 = opt->dst1;
 402                 opt->dst1 = 0;
 403                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 404                 return 1;
 405         }
 406
 407         switch (hdr->type) {
 408 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 409         case IPV6_SRCRT_TYPE_2:
 410                 if (accept_source_route < 0)
 411                         goto unknown_rh;
 412                 /* Silently discard invalid RTH type 2 */
 413                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 414                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 415                                          IPSTATS_MIB_INHDRERRORS);
 416                         kfree_skb(skb);
 417                         return -1;
 418                 }
 419                 break;
 420 #endif
 421         default:
 422                 goto unknown_rh;
 423         }
 424
 425         /*
 426          *      This is the routing header forwarding algorithm from
 427          *      RFC 2460, page 16.
 428          */
 429
 430         n = hdr->hdrlen >> 1;
 431
 432         if (hdr->segments_left > n) {
 433                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 434                                  IPSTATS_MIB_INHDRERRORS);
 435                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 436                                   ((&hdr->segments_left) -
 437                                    skb_network_header(skb)));
 438                 return -1;
 439         }
 440
 441         /* We are about to mangle packet header. Be careful!
 442            Do not damage packets queued somewhere.
 443          */
 444         if (skb_cloned(skb)) {
 445                 /* the copy is a forwarded packet */
 446                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 447                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 448                                          IPSTATS_MIB_OUTDISCARDS);
 449                         kfree_skb(skb);
 450                         return -1;
 451                 }
 452                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 453         }
 454
 455         if (skb->ip_summed == CHECKSUM_COMPLETE)
 456                 skb->ip_summed = CHECKSUM_NONE;
 457
 458         i = n - --hdr->segments_left;
 459
 460         rthdr = (struct rt0_hdr *) hdr;
 461         addr = rthdr->addr;
 462         addr += i - 1;
 463
 464         switch (hdr->type) {
 465 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 466         case IPV6_SRCRT_TYPE_2:
 467                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 468                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 469                                      IPPROTO_ROUTING) < 0) {
 470                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 471                                          IPSTATS_MIB_INADDRERRORS);
 472                         kfree_skb(skb);
 473                         return -1;
 474                 }
 475                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 476                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 477                                          IPSTATS_MIB_INADDRERRORS);
 478                         kfree_skb(skb);
 479                         return -1;
 480                 }
 481                 break;
 482 #endif
 483         default:
 484                 break;
 485         }
 486
 487         if (ipv6_addr_is_multicast(addr)) {
 488                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 489                                  IPSTATS_MIB_INADDRERRORS);
 490                 kfree_skb(skb);
 491                 return -1;
 492         }
 493
 494         daddr = *addr;
 495         *addr = ipv6_hdr(skb)->daddr;
 496         ipv6_hdr(skb)->daddr = daddr;
 497
 498         skb_dst_drop(skb);
 499         ip6_route_input(skb);
 500         if (skb_dst(skb)->error) {
 501                 skb_push(skb, skb->data - skb_network_header(skb));
 502                 dst_input(skb);
 503                 return -1;
 504         }
 505
 506         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 507                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 508                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 509                                          IPSTATS_MIB_INHDRERRORS);
 510                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 511                                     0);
 512                         kfree_skb(skb);
 513                         return -1;
 514                 }
 515                 ipv6_hdr(skb)->hop_limit--;
 516                 goto looped_back;
 517         }
 518
 519         skb_push(skb, skb->data - skb_network_header(skb));
 520         dst_input(skb);
 521         return -1;
 522
 523 unknown_rh:
 524         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
 525         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 526                           (&hdr->type) - skb_network_header(skb));
 527         return -1;
 528 }
 529
 530 static const struct inet6_protocol rthdr_protocol = {
 531         .handler        =       ipv6_rthdr_rcv,
 532         .flags          =       INET6_PROTO_NOPOLICY,
 533 };
 534
 535 static const struct inet6_protocol destopt_protocol = {
 536         .handler        =       ipv6_destopt_rcv,
 537         .flags          =       INET6_PROTO_NOPOLICY,
 538 };
 539
 540 static const struct inet6_protocol nodata_protocol = {
 541         .handler        =       dst_discard,
 542         .flags          =       INET6_PROTO_NOPOLICY,
 543 };
 544
 545 int __init ipv6_exthdrs_init(void)
 546 {
 547         int ret;
 548
 549         ret = ipv6_exthdrs_offload_init();
 550         if (ret)
 551                 goto out;
 552
 553         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 554         if (ret)
 555                 goto out_offload;
 556
 557         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 558         if (ret)
 559                 goto out_rthdr;
 560
 561         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 562         if (ret)
 563                 goto out_destopt;
 564
 565 out:
 566         return ret;
 567 out_destopt:
 568         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 569 out_rthdr:
 570         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 571 out_offload:
 572         ipv6_exthdrs_offload_exit();
 573         goto out;
 574 };
 575
 576 void ipv6_exthdrs_exit(void)
 577 {
 578         ipv6_exthdrs_offload_exit();
 579         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 580         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 581         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 582 }
 583
 584 /**********************************
 585   Hop-by-hop options.
 586  **********************************/
 587
 588 /*
 589  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 590  */
 591 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 592 {
 593         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 594 }
 595
 596 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 597 {
 598         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 599 }
 600
 601 /* Router Alert as of RFC 2711 */
 602
 603 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 604 {
 605         const unsigned char *nh = skb_network_header(skb);
 606
 607         if (nh[optoff + 1] == 2) {
 608                 IP6CB(skb)->ra = optoff;
 609                 return true;
 610         }
 611         LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
 612                        nh[optoff + 1]);
 613         kfree_skb(skb);
 614         return false;
 615 }
 616
 617 /* Jumbo payload */
 618
 619 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 620 {
 621         const unsigned char *nh = skb_network_header(skb);
 622         struct net *net = ipv6_skb_net(skb);
 623         u32 pkt_len;
 624
 625         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 626                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 627                                nh[optoff+1]);
 628                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 629                                  IPSTATS_MIB_INHDRERRORS);
 630                 goto drop;
 631         }
 632
 633         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 634         if (pkt_len <= IPV6_MAXPLEN) {
 635                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 636                                  IPSTATS_MIB_INHDRERRORS);
 637                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 638                 return false;
 639         }
 640         if (ipv6_hdr(skb)->payload_len) {
 641                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 642                                  IPSTATS_MIB_INHDRERRORS);
 643                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 644                 return false;
 645         }
 646
 647         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 648                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 649                                  IPSTATS_MIB_INTRUNCATEDPKTS);
 650                 goto drop;
 651         }
 652
 653         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 654                 goto drop;
 655
 656         return true;
 657
 658 drop:
 659         kfree_skb(skb);
 660         return false;
 661 }
 662
 663 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 664         {
 665                 .type   = IPV6_TLV_ROUTERALERT,
 666                 .func   = ipv6_hop_ra,
 667         },
 668         {
 669                 .type   = IPV6_TLV_JUMBO,
 670                 .func   = ipv6_hop_jumbo,
 671         },
 672         { -1, }
 673 };
 674
 675 int ipv6_parse_hopopts(struct sk_buff *skb)
 676 {
 677         struct inet6_skb_parm *opt = IP6CB(skb);
 678
 679         /*
 680          * skb_network_header(skb) is equal to skb->data, and
 681          * skb_network_header_len(skb) is always equal to
 682          * sizeof(struct ipv6hdr) by definition of
 683          * hop-by-hop options.
 684          */
 685         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 686             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 687                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 688                 kfree_skb(skb);
 689                 return -1;
 690         }
 691
 692         opt->hop = sizeof(struct ipv6hdr);
 693         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
 694                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 695                 opt = IP6CB(skb);
 696                 opt->nhoff = sizeof(struct ipv6hdr);
 697                 return 1;
 698         }
 699         return -1;
 700 }
 701
 702 /*
 703  *      Creating outbound headers.
 704  *
 705  *      "build" functions work when skb is filled from head to tail (datagram)
 706  *      "push"  functions work when headers are added from tail to head (tcp)
 707  *
 708  *      In both cases we assume, that caller reserved enough room
 709  *      for headers.
 710  */
 711
 712 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 713                             struct ipv6_rt_hdr *opt,
 714                             struct in6_addr **addr_p)
 715 {
 716         struct rt0_hdr *phdr, *ihdr;
 717         int hops;
 718
 719         ihdr = (struct rt0_hdr *) opt;
 720
 721         phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 722         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 723
 724         hops = ihdr->rt_hdr.hdrlen >> 1;
 725
 726         if (hops > 1)
 727                 memcpy(phdr->addr, ihdr->addr + 1,
 728                        (hops - 1) * sizeof(struct in6_addr));
 729
 730         phdr->addr[hops - 1] = **addr_p;
 731         *addr_p = ihdr->addr;
 732
 733         phdr->rt_hdr.nexthdr = *proto;
 734         *proto = NEXTHDR_ROUTING;
 735 }
 736
 737 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 738 {
 739         struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));
 740
 741         memcpy(h, opt, ipv6_optlen(opt));
 742         h->nexthdr = *proto;
 743         *proto = type;
 744 }
 745
 746 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 747                           u8 *proto,
 748                           struct in6_addr **daddr)
 749 {
 750         if (opt->srcrt) {
 751                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr);
 752                 /*
 753                  * IPV6_RTHDRDSTOPTS is ignored
 754                  * unless IPV6_RTHDR is set (RFC3542).
 755                  */
 756                 if (opt->dst0opt)
 757                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 758         }
 759         if (opt->hopopt)
 760                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 761 }
 762 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 763
 764 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 765 {
 766         if (opt->dst1opt)
 767                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 768 }
 769
 770 struct ipv6_txoptions *
 771 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 772 {
 773         struct ipv6_txoptions *opt2;
 774
 775         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 776         if (opt2) {
 777                 long dif = (char *)opt2 - (char *)opt;
 778                 memcpy(opt2, opt, opt->tot_len);
 779                 if (opt2->hopopt)
 780                         *((char **)&opt2->hopopt) += dif;
 781                 if (opt2->dst0opt)
 782                         *((char **)&opt2->dst0opt) += dif;
 783                 if (opt2->dst1opt)
 784                         *((char **)&opt2->dst1opt) += dif;
 785                 if (opt2->srcrt)
 786                         *((char **)&opt2->srcrt) += dif;
 787         }
 788         return opt2;
 789 }
 790 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 791
 792 static int ipv6_renew_option(void *ohdr,
 793                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
 794                              int inherit,
 795                              struct ipv6_opt_hdr **hdr,
 796                              char **p)
 797 {
 798         if (inherit) {
 799                 if (ohdr) {
 800                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
 801                         *hdr = (struct ipv6_opt_hdr *)*p;
 802                         *p += CMSG_ALIGN(ipv6_optlen(*hdr));
 803                 }
 804         } else {
 805                 if (newopt) {
 806                         if (copy_from_user(*p, newopt, newoptlen))
 807                                 return -EFAULT;
 808                         *hdr = (struct ipv6_opt_hdr *)*p;
 809                         if (ipv6_optlen(*hdr) > newoptlen)
 810                                 return -EINVAL;
 811                         *p += CMSG_ALIGN(newoptlen);
 812                 }
 813         }
 814         return 0;
 815 }
 816
 817 struct ipv6_txoptions *
 818 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
 819                    int newtype,
 820                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
 821 {
 822         int tot_len = 0;
 823         char *p;
 824         struct ipv6_txoptions *opt2;
 825         int err;
 826
 827         if (opt) {
 828                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
 829                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
 830                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
 831                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
 832                 if (newtype != IPV6_RTHDR && opt->srcrt)
 833                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
 834                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
 835                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
 836         }
 837
 838         if (newopt && newoptlen)
 839                 tot_len += CMSG_ALIGN(newoptlen);
 840
 841         if (!tot_len)
 842                 return NULL;
 843
 844         tot_len += sizeof(*opt2);
 845         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
 846         if (!opt2)
 847                 return ERR_PTR(-ENOBUFS);
 848
 849         memset(opt2, 0, tot_len);
 850
 851         opt2->tot_len = tot_len;
 852         p = (char *)(opt2 + 1);
 853
 854         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
 855                                 newtype != IPV6_HOPOPTS,
 856                                 &opt2->hopopt, &p);
 857         if (err)
 858                 goto out;
 859
 860         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
 861                                 newtype != IPV6_RTHDRDSTOPTS,
 862                                 &opt2->dst0opt, &p);
 863         if (err)
 864                 goto out;
 865
 866         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
 867                                 newtype != IPV6_RTHDR,
 868                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
 869         if (err)
 870                 goto out;
 871
 872         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
 873                                 newtype != IPV6_DSTOPTS,
 874                                 &opt2->dst1opt, &p);
 875         if (err)
 876                 goto out;
 877
 878         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
 879                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
 880                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
 881         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
 882
 883         return opt2;
 884 out:
 885         sock_kfree_s(sk, opt2, opt2->tot_len);
 886         return ERR_PTR(err);
 887 }
 888
 889 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 890                                           struct ipv6_txoptions *opt)
 891 {
 892         /*
 893          * ignore the dest before srcrt unless srcrt is being included.
 894          * --yoshfuji
 895          */
 896         if (opt && opt->dst0opt && !opt->srcrt) {
 897                 if (opt_space != opt) {
 898                         memcpy(opt_space, opt, sizeof(*opt_space));
 899                         opt = opt_space;
 900                 }
 901                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
 902                 opt->dst0opt = NULL;
 903         }
 904
 905         return opt;
 906 }
 907 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
 908
 909 /**
 910  * fl6_update_dst - update flowi destination address with info given
 911  *                  by srcrt option, if any.
 912  *
 913  * @fl6: flowi6 for which daddr is to be updated
 914  * @opt: struct ipv6_txoptions in which to look for srcrt opt
 915  * @orig: copy of original daddr address if modified
 916  *
 917  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
 918  * and initial value of fl6->daddr set in orig
 919  */
 920 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
 921                                 const struct ipv6_txoptions *opt,
 922                                 struct in6_addr *orig)
 923 {
 924         if (!opt || !opt->srcrt)
 925                 return NULL;
 926
 927         *orig = fl6->daddr;
 928         fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
 929         return orig;
 930 }
 931 EXPORT_SYMBOL_GPL(fl6_update_dst);