]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/ipv6/exthdrs.c
Merge remote-tracking branch 'asoc/fix/dapm' into asoc-linus
[mirror_ubuntu-bionic-kernel.git] / net / ipv6 / exthdrs.c
CommitLineData
1da177e4
LT
1/*
2 * Extension Header handling for IPv6
3 * Linux INET6 implementation
4 *
5 * Authors:
6 * Pedro Roque <roque@di.fc.ul.pt>
7 * Andi Kleen <ak@muc.de>
8 * Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
9 *
1da177e4
LT
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License
12 * as published by the Free Software Foundation; either version
13 * 2 of the License, or (at your option) any later version.
14 */
15
16/* Changes:
1ab1457c 17 * yoshfuji : ensure not to overrun while parsing
1da177e4
LT
18 * tlv options.
19 * Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
20 * YOSHIFUJI Hideaki @USAGI Register inbound extension header
21 * handlers as inet6_protocol{}.
22 */
23
24#include <linux/errno.h>
25#include <linux/types.h>
26#include <linux/socket.h>
27#include <linux/sockios.h>
1da177e4
LT
28#include <linux/net.h>
29#include <linux/netdevice.h>
30#include <linux/in6.h>
31#include <linux/icmpv6.h>
5a0e3ad6 32#include <linux/slab.h>
bc3b2d7f 33#include <linux/export.h>
1da177e4 34
352e512c 35#include <net/dst.h>
1da177e4
LT
36#include <net/sock.h>
37#include <net/snmp.h>
38
39#include <net/ipv6.h>
40#include <net/protocol.h>
41#include <net/transp_v6.h>
42#include <net/rawv6.h>
43#include <net/ndisc.h>
44#include <net/ip6_route.h>
45#include <net/addrconf.h>
2e532b70 46#include <net/calipso.h>
07a93626 47#if IS_ENABLED(CONFIG_IPV6_MIP6)
65d4ed92
MN
48#include <net/xfrm.h>
49#endif
1da177e4 50
ce256981 51#include <linux/uaccess.h>
1da177e4
LT
52
53/*
54 * Parsing tlv encoded headers.
55 *
a50feda5
ED
56 * Parsing function "func" returns true, if parsing succeed
57 * and false, if it failed.
1da177e4
LT
58 * It MUST NOT touch skb->h.
59 */
60
61struct tlvtype_proc {
62 int type;
a50feda5 63 bool (*func)(struct sk_buff *skb, int offset);
1da177e4
LT
64};
65
66/*********************
67 Generic functions
68 *********************/
69
70/* An unknown option is detected, decide what to do */
71
a50feda5 72static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
1da177e4 73{
d56f90a7 74 switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
1da177e4 75 case 0: /* ignore */
a50feda5 76 return true;
1da177e4
LT
77
78 case 1: /* drop packet */
79 break;
80
81 case 3: /* Send ICMP if not a multicast address and drop packet */
82 /* Actually, it is redundant check. icmp_send
83 will recheck in any case.
84 */
0660e03f 85 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
1da177e4
LT
86 break;
87 case 2: /* send ICMP PARM PROB regardless and drop packet */
88 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
a50feda5 89 return false;
3ff50b79 90 }
1da177e4
LT
91
92 kfree_skb(skb);
a50feda5 93 return false;
1da177e4
LT
94}
95
96/* Parse tlv encoded option header (hop-by-hop or destination) */
97
a50feda5 98static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
1da177e4 99{
a50feda5 100 const struct tlvtype_proc *curr;
d56f90a7 101 const unsigned char *nh = skb_network_header(skb);
cfe1fc77 102 int off = skb_network_header_len(skb);
9c70220b 103 int len = (skb_transport_header(skb)[1] + 1) << 3;
9b905fe6 104 int padlen = 0;
1da177e4 105
ea2ae17d 106 if (skb_transport_offset(skb) + len > skb_headlen(skb))
1da177e4
LT
107 goto bad;
108
109 off += 2;
110 len -= 2;
111
112 while (len > 0) {
d56f90a7 113 int optlen = nh[off + 1] + 2;
c1412fce 114 int i;
1da177e4 115
d56f90a7 116 switch (nh[off]) {
1de5a71c 117 case IPV6_TLV_PAD1:
1da177e4 118 optlen = 1;
9b905fe6
EZ
119 padlen++;
120 if (padlen > 7)
121 goto bad;
1da177e4
LT
122 break;
123
124 case IPV6_TLV_PADN:
c1412fce
EZ
125 /* RFC 2460 states that the purpose of PadN is
126 * to align the containing header to multiples
127 * of 8. 7 is therefore the highest valid value.
128 * See also RFC 4942, Section 2.1.9.5.
129 */
9b905fe6
EZ
130 padlen += optlen;
131 if (padlen > 7)
c1412fce
EZ
132 goto bad;
133 /* RFC 4942 recommends receiving hosts to
134 * actively check PadN payload to contain
135 * only zeroes.
136 */
137 for (i = 2; i < optlen; i++) {
138 if (nh[off + i] != 0)
139 goto bad;
140 }
1da177e4
LT
141 break;
142
143 default: /* Other TLV code so scan list */
144 if (optlen > len)
145 goto bad;
67ba4152 146 for (curr = procs; curr->type >= 0; curr++) {
d56f90a7 147 if (curr->type == nh[off]) {
1ab1457c
YH
148 /* type specific length/alignment
149 checks will be performed in the
1da177e4 150 func(). */
a50feda5
ED
151 if (curr->func(skb, off) == false)
152 return false;
1da177e4
LT
153 break;
154 }
155 }
156 if (curr->type < 0) {
e5bbef20 157 if (ip6_tlvopt_unknown(skb, off) == 0)
a50feda5 158 return false;
1da177e4 159 }
9b905fe6 160 padlen = 0;
1da177e4
LT
161 break;
162 }
163 off += optlen;
164 len -= optlen;
165 }
9b905fe6 166
1da177e4 167 if (len == 0)
a50feda5 168 return true;
1da177e4
LT
169bad:
170 kfree_skb(skb);
a50feda5 171 return false;
1da177e4
LT
172}
173
174/*****************************
175 Destination options header.
176 *****************************/
177
07a93626 178#if IS_ENABLED(CONFIG_IPV6_MIP6)
a50feda5 179static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
a831f5bb 180{
a831f5bb
MN
181 struct ipv6_destopt_hao *hao;
182 struct inet6_skb_parm *opt = IP6CB(skb);
0660e03f 183 struct ipv6hdr *ipv6h = ipv6_hdr(skb);
a831f5bb
MN
184 struct in6_addr tmp_addr;
185 int ret;
186
187 if (opt->dsthao) {
ba7a46f1 188 net_dbg_ratelimited("hao duplicated\n");
a831f5bb
MN
189 goto discard;
190 }
191 opt->dsthao = opt->dst1;
192 opt->dst1 = 0;
193
d56f90a7 194 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
a831f5bb
MN
195
196 if (hao->length != 16) {
ba7a46f1
JP
197 net_dbg_ratelimited("hao invalid option length = %d\n",
198 hao->length);
a831f5bb
MN
199 goto discard;
200 }
201
202 if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
ba7a46f1
JP
203 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
204 &hao->addr);
a831f5bb
MN
205 goto discard;
206 }
207
208 ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
209 (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
210 if (unlikely(ret < 0))
211 goto discard;
212
213 if (skb_cloned(skb)) {
65c88466 214 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
a831f5bb
MN
215 goto discard;
216
a831f5bb 217 /* update all variable using below by copied skbuff */
65c88466 218 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
d56f90a7 219 optoff);
65c88466 220 ipv6h = ipv6_hdr(skb);
a831f5bb
MN
221 }
222
223 if (skb->ip_summed == CHECKSUM_COMPLETE)
224 skb->ip_summed = CHECKSUM_NONE;
225
4e3fd7a0
AD
226 tmp_addr = ipv6h->saddr;
227 ipv6h->saddr = hao->addr;
228 hao->addr = tmp_addr;
a831f5bb 229
b7aa0bf7 230 if (skb->tstamp.tv64 == 0)
a831f5bb
MN
231 __net_timestamp(skb);
232
a50feda5 233 return true;
a831f5bb
MN
234
235 discard:
236 kfree_skb(skb);
a50feda5 237 return false;
a831f5bb
MN
238}
239#endif
240
a50feda5 241static const struct tlvtype_proc tlvprocdestopt_lst[] = {
07a93626 242#if IS_ENABLED(CONFIG_IPV6_MIP6)
a831f5bb
MN
243 {
244 .type = IPV6_TLV_HAO,
245 .func = ipv6_dest_hao,
246 },
247#endif
1da177e4
LT
248 {-1, NULL}
249};
250
e5bbef20 251static int ipv6_destopt_rcv(struct sk_buff *skb)
1da177e4 252{
1da177e4 253 struct inet6_skb_parm *opt = IP6CB(skb);
07a93626 254#if IS_ENABLED(CONFIG_IPV6_MIP6)
a831f5bb
MN
255 __u16 dstbuf;
256#endif
897dc80b 257 struct dst_entry *dst = skb_dst(skb);
1da177e4 258
ea2ae17d
ACM
259 if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
260 !pskb_may_pull(skb, (skb_transport_offset(skb) +
9c70220b 261 ((skb_transport_header(skb)[1] + 1) << 3)))) {
1d015503
ED
262 __IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
263 IPSTATS_MIB_INHDRERRORS);
1da177e4
LT
264 kfree_skb(skb);
265 return -1;
266 }
267
cfe1fc77 268 opt->lastopt = opt->dst1 = skb_network_header_len(skb);
07a93626 269#if IS_ENABLED(CONFIG_IPV6_MIP6)
a831f5bb
MN
270 dstbuf = opt->dst1;
271#endif
1da177e4 272
e5bbef20 273 if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
b0e380b1 274 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
dc435e6d 275 opt = IP6CB(skb);
07a93626 276#if IS_ENABLED(CONFIG_IPV6_MIP6)
a831f5bb
MN
277 opt->nhoff = dstbuf;
278#else
951dbc8a 279 opt->nhoff = opt->dst1;
a831f5bb 280#endif
1da177e4
LT
281 return 1;
282 }
283
1d015503
ED
284 __IP6_INC_STATS(dev_net(dst->dev),
285 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
1da177e4
LT
286 return -1;
287}
288
1da177e4
LT
289/********************************
290 Routing header.
291 ********************************/
292
f6bc7d9e 293/* called with rcu_read_lock() */
e5bbef20 294static int ipv6_rthdr_rcv(struct sk_buff *skb)
1da177e4 295{
1da177e4 296 struct inet6_skb_parm *opt = IP6CB(skb);
65d4ed92 297 struct in6_addr *addr = NULL;
1da177e4 298 struct in6_addr daddr;
0bcbc926 299 struct inet6_dev *idev;
1da177e4 300 int n, i;
1da177e4
LT
301 struct ipv6_rt_hdr *hdr;
302 struct rt0_hdr *rthdr;
483a47d2
DL
303 struct net *net = dev_net(skb->dev);
304 int accept_source_route = net->ipv6.devconf_all->accept_source_route;
0bcbc926 305
f6bc7d9e
ED
306 idev = __in6_dev_get(skb->dev);
307 if (idev && accept_source_route > idev->cnf.accept_source_route)
308 accept_source_route = idev->cnf.accept_source_route;
0bcbc926 309
ea2ae17d
ACM
310 if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
311 !pskb_may_pull(skb, (skb_transport_offset(skb) +
9c70220b 312 ((skb_transport_header(skb)[1] + 1) << 3)))) {
1d015503
ED
313 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
314 IPSTATS_MIB_INHDRERRORS);
1da177e4
LT
315 kfree_skb(skb);
316 return -1;
317 }
318
9c70220b 319 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
1da177e4 320
0660e03f 321 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
1da177e4 322 skb->pkt_type != PACKET_HOST) {
1d015503
ED
323 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
324 IPSTATS_MIB_INADDRERRORS);
1da177e4
LT
325 kfree_skb(skb);
326 return -1;
327 }
328
329looped_back:
330 if (hdr->segments_left == 0) {
65d4ed92 331 switch (hdr->type) {
07a93626 332#if IS_ENABLED(CONFIG_IPV6_MIP6)
65d4ed92
MN
333 case IPV6_SRCRT_TYPE_2:
334 /* Silently discard type 2 header unless it was
335 * processed by own
336 */
337 if (!addr) {
1d015503
ED
338 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
339 IPSTATS_MIB_INADDRERRORS);
65d4ed92
MN
340 kfree_skb(skb);
341 return -1;
342 }
343 break;
344#endif
345 default:
346 break;
347 }
348
cfe1fc77 349 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
b0e380b1 350 skb->transport_header += (hdr->hdrlen + 1) << 3;
1da177e4
LT
351 opt->dst0 = opt->dst1;
352 opt->dst1 = 0;
d56f90a7 353 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
1da177e4
LT
354 return 1;
355 }
356
65d4ed92 357 switch (hdr->type) {
07a93626 358#if IS_ENABLED(CONFIG_IPV6_MIP6)
65d4ed92 359 case IPV6_SRCRT_TYPE_2:
c382bb9d
YH
360 if (accept_source_route < 0)
361 goto unknown_rh;
65d4ed92
MN
362 /* Silently discard invalid RTH type 2 */
363 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
1d015503
ED
364 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
365 IPSTATS_MIB_INHDRERRORS);
65d4ed92
MN
366 kfree_skb(skb);
367 return -1;
368 }
369 break;
370#endif
c382bb9d
YH
371 default:
372 goto unknown_rh;
1da177e4 373 }
1da177e4
LT
374
375 /*
376 * This is the routing header forwarding algorithm from
377 * RFC 2460, page 16.
378 */
379
380 n = hdr->hdrlen >> 1;
381
382 if (hdr->segments_left > n) {
1d015503
ED
383 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
384 IPSTATS_MIB_INHDRERRORS);
d56f90a7
ACM
385 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
386 ((&hdr->segments_left) -
387 skb_network_header(skb)));
1da177e4
LT
388 return -1;
389 }
390
391 /* We are about to mangle packet header. Be careful!
392 Do not damage packets queued somewhere.
393 */
394 if (skb_cloned(skb)) {
1da177e4 395 /* the copy is a forwarded packet */
65c88466 396 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
1d015503
ED
397 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
398 IPSTATS_MIB_OUTDISCARDS);
a11d206d 399 kfree_skb(skb);
1da177e4
LT
400 return -1;
401 }
65c88466 402 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
1da177e4
LT
403 }
404
84fa7933 405 if (skb->ip_summed == CHECKSUM_COMPLETE)
1da177e4
LT
406 skb->ip_summed = CHECKSUM_NONE;
407
408 i = n - --hdr->segments_left;
409
410 rthdr = (struct rt0_hdr *) hdr;
411 addr = rthdr->addr;
412 addr += i - 1;
413
65d4ed92 414 switch (hdr->type) {
07a93626 415#if IS_ENABLED(CONFIG_IPV6_MIP6)
65d4ed92
MN
416 case IPV6_SRCRT_TYPE_2:
417 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
0660e03f 418 (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
65d4ed92 419 IPPROTO_ROUTING) < 0) {
1d015503
ED
420 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
421 IPSTATS_MIB_INADDRERRORS);
65d4ed92
MN
422 kfree_skb(skb);
423 return -1;
424 }
adf30907 425 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
1d015503
ED
426 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
427 IPSTATS_MIB_INADDRERRORS);
65d4ed92
MN
428 kfree_skb(skb);
429 return -1;
430 }
431 break;
432#endif
433 default:
434 break;
435 }
436
1da177e4 437 if (ipv6_addr_is_multicast(addr)) {
1d015503
ED
438 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
439 IPSTATS_MIB_INADDRERRORS);
1da177e4
LT
440 kfree_skb(skb);
441 return -1;
442 }
443
4e3fd7a0
AD
444 daddr = *addr;
445 *addr = ipv6_hdr(skb)->daddr;
446 ipv6_hdr(skb)->daddr = daddr;
1da177e4 447
adf30907 448 skb_dst_drop(skb);
1da177e4 449 ip6_route_input(skb);
adf30907 450 if (skb_dst(skb)->error) {
d56f90a7 451 skb_push(skb, skb->data - skb_network_header(skb));
1da177e4
LT
452 dst_input(skb);
453 return -1;
454 }
455
adf30907 456 if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
0660e03f 457 if (ipv6_hdr(skb)->hop_limit <= 1) {
1d015503
ED
458 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
459 IPSTATS_MIB_INHDRERRORS);
1da177e4 460 icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
3ffe533c 461 0);
1da177e4
LT
462 kfree_skb(skb);
463 return -1;
464 }
0660e03f 465 ipv6_hdr(skb)->hop_limit--;
1da177e4
LT
466 goto looped_back;
467 }
468
d56f90a7 469 skb_push(skb, skb->data - skb_network_header(skb));
1da177e4
LT
470 dst_input(skb);
471 return -1;
c382bb9d
YH
472
473unknown_rh:
1d015503 474 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
c382bb9d
YH
475 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
476 (&hdr->type) - skb_network_header(skb));
477 return -1;
1da177e4
LT
478}
479
41135cc8 480static const struct inet6_protocol rthdr_protocol = {
1da177e4 481 .handler = ipv6_rthdr_rcv,
2207afc8 482 .flags = INET6_PROTO_NOPOLICY,
8ca896cf
VY
483};
484
41135cc8 485static const struct inet6_protocol destopt_protocol = {
248b238d 486 .handler = ipv6_destopt_rcv,
2207afc8 487 .flags = INET6_PROTO_NOPOLICY,
8ca896cf
VY
488};
489
41135cc8 490static const struct inet6_protocol nodata_protocol = {
248b238d
DL
491 .handler = dst_discard,
492 .flags = INET6_PROTO_NOPOLICY,
493};
494
495int __init ipv6_exthdrs_init(void)
1da177e4 496{
248b238d
DL
497 int ret;
498
3336288a
VY
499 ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
500 if (ret)
c6b641a4 501 goto out;
3336288a 502
248b238d
DL
503 ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
504 if (ret)
505 goto out_rthdr;
506
507 ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
508 if (ret)
509 goto out_destopt;
510
511out:
512 return ret;
248b238d
DL
513out_destopt:
514 inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
3336288a
VY
515out_rthdr:
516 inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
248b238d 517 goto out;
1da177e4
LT
518};
519
248b238d
DL
520void ipv6_exthdrs_exit(void)
521{
522 inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
523 inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
524 inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
525}
526
1da177e4
LT
527/**********************************
528 Hop-by-hop options.
529 **********************************/
530
e76b2b25 531/*
adf30907 532 * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
e76b2b25
YH
533 */
534static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
535{
adf30907 536 return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
e76b2b25
YH
537}
538
2570a4f5
DM
539static inline struct net *ipv6_skb_net(struct sk_buff *skb)
540{
541 return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
542}
543
1da177e4
LT
544/* Router Alert as of RFC 2711 */
545
a50feda5 546static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
1da177e4 547{
d56f90a7 548 const unsigned char *nh = skb_network_header(skb);
a80ff03e 549
d56f90a7 550 if (nh[optoff + 1] == 2) {
dd3332bf
YH
551 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
552 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
a50feda5 553 return true;
1da177e4 554 }
ba7a46f1
JP
555 net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
556 nh[optoff + 1]);
1da177e4 557 kfree_skb(skb);
a50feda5 558 return false;
1da177e4
LT
559}
560
561/* Jumbo payload */
562
a50feda5 563static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
1da177e4 564{
d56f90a7 565 const unsigned char *nh = skb_network_header(skb);
2570a4f5 566 struct net *net = ipv6_skb_net(skb);
1da177e4
LT
567 u32 pkt_len;
568
d56f90a7 569 if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
ba7a46f1
JP
570 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
571 nh[optoff+1]);
1d015503
ED
572 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
573 IPSTATS_MIB_INHDRERRORS);
1da177e4
LT
574 goto drop;
575 }
576
d56f90a7 577 pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
1da177e4 578 if (pkt_len <= IPV6_MAXPLEN) {
1d015503
ED
579 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
580 IPSTATS_MIB_INHDRERRORS);
1da177e4 581 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
a50feda5 582 return false;
1da177e4 583 }
0660e03f 584 if (ipv6_hdr(skb)->payload_len) {
1d015503
ED
585 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
586 IPSTATS_MIB_INHDRERRORS);
1da177e4 587 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
a50feda5 588 return false;
1da177e4
LT
589 }
590
591 if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
1d015503
ED
592 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
593 IPSTATS_MIB_INTRUNCATEDPKTS);
1da177e4
LT
594 goto drop;
595 }
42ca89c1
SH
596
597 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
598 goto drop;
599
a50feda5 600 return true;
1da177e4
LT
601
602drop:
603 kfree_skb(skb);
a50feda5 604 return false;
1da177e4
LT
605}
606
2e532b70
HD
607/* CALIPSO RFC 5570 */
608
609static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
610{
611 const unsigned char *nh = skb_network_header(skb);
612
613 if (nh[optoff + 1] < 8)
614 goto drop;
615
616 if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
617 goto drop;
618
619 if (!calipso_validate(skb, nh + optoff))
620 goto drop;
621
622 return true;
623
624drop:
625 kfree_skb(skb);
626 return false;
627}
628
a50feda5 629static const struct tlvtype_proc tlvprochopopt_lst[] = {
1da177e4
LT
630 {
631 .type = IPV6_TLV_ROUTERALERT,
632 .func = ipv6_hop_ra,
633 },
634 {
635 .type = IPV6_TLV_JUMBO,
636 .func = ipv6_hop_jumbo,
637 },
2e532b70
HD
638 {
639 .type = IPV6_TLV_CALIPSO,
640 .func = ipv6_hop_calipso,
641 },
1da177e4
LT
642 { -1, }
643};
644
e5bbef20 645int ipv6_parse_hopopts(struct sk_buff *skb)
1da177e4 646{
951dbc8a
PM
647 struct inet6_skb_parm *opt = IP6CB(skb);
648
ec670095 649 /*
d56f90a7 650 * skb_network_header(skb) is equal to skb->data, and
cfe1fc77 651 * skb_network_header_len(skb) is always equal to
ec670095
YH
652 * sizeof(struct ipv6hdr) by definition of
653 * hop-by-hop options.
654 */
655 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
9c70220b
ACM
656 !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
657 ((skb_transport_header(skb)[1] + 1) << 3)))) {
ec670095
YH
658 kfree_skb(skb);
659 return -1;
660 }
661
8b58a398 662 opt->flags |= IP6SKB_HOPBYHOP;
e5bbef20 663 if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
b0e380b1 664 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
dc435e6d 665 opt = IP6CB(skb);
951dbc8a 666 opt->nhoff = sizeof(struct ipv6hdr);
b809739a 667 return 1;
951dbc8a 668 }
1da177e4
LT
669 return -1;
670}
671
672/*
673 * Creating outbound headers.
674 *
675 * "build" functions work when skb is filled from head to tail (datagram)
676 * "push" functions work when headers are added from tail to head (tcp)
677 *
678 * In both cases we assume, that caller reserved enough room
679 * for headers.
680 */
681
682static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
683 struct ipv6_rt_hdr *opt,
684 struct in6_addr **addr_p)
685{
686 struct rt0_hdr *phdr, *ihdr;
687 int hops;
688
689 ihdr = (struct rt0_hdr *) opt;
1ab1457c 690
1da177e4
LT
691 phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
692 memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
693
694 hops = ihdr->rt_hdr.hdrlen >> 1;
695
696 if (hops > 1)
697 memcpy(phdr->addr, ihdr->addr + 1,
698 (hops - 1) * sizeof(struct in6_addr));
699
4e3fd7a0 700 phdr->addr[hops - 1] = **addr_p;
1da177e4
LT
701 *addr_p = ihdr->addr;
702
703 phdr->rt_hdr.nexthdr = *proto;
704 *proto = NEXTHDR_ROUTING;
705}
706
707static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
708{
709 struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));
710
711 memcpy(h, opt, ipv6_optlen(opt));
712 h->nexthdr = *proto;
713 *proto = type;
714}
715
716void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
717 u8 *proto,
718 struct in6_addr **daddr)
719{
333fad53 720 if (opt->srcrt) {
1da177e4 721 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr);
333fad53
YH
722 /*
723 * IPV6_RTHDRDSTOPTS is ignored
724 * unless IPV6_RTHDR is set (RFC3542).
725 */
726 if (opt->dst0opt)
727 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
728 }
1da177e4
LT
729 if (opt->hopopt)
730 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
731}
7159039a
YH
732EXPORT_SYMBOL(ipv6_push_nfrag_opts);
733
1da177e4
LT
734void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
735{
736 if (opt->dst1opt)
737 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
738}
739
740struct ipv6_txoptions *
741ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
742{
743 struct ipv6_txoptions *opt2;
744
745 opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
746 if (opt2) {
ac3c8172 747 long dif = (char *)opt2 - (char *)opt;
1da177e4
LT
748 memcpy(opt2, opt, opt->tot_len);
749 if (opt2->hopopt)
ac3c8172 750 *((char **)&opt2->hopopt) += dif;
1da177e4 751 if (opt2->dst0opt)
ac3c8172 752 *((char **)&opt2->dst0opt) += dif;
1da177e4 753 if (opt2->dst1opt)
ac3c8172 754 *((char **)&opt2->dst1opt) += dif;
1da177e4 755 if (opt2->srcrt)
ac3c8172 756 *((char **)&opt2->srcrt) += dif;
45f6fad8 757 atomic_set(&opt2->refcnt, 1);
1da177e4
LT
758 }
759 return opt2;
760}
3cf3dc6c
ACM
761EXPORT_SYMBOL_GPL(ipv6_dup_options);
762
333fad53
YH
763static int ipv6_renew_option(void *ohdr,
764 struct ipv6_opt_hdr __user *newopt, int newoptlen,
765 int inherit,
766 struct ipv6_opt_hdr **hdr,
767 char **p)
768{
769 if (inherit) {
770 if (ohdr) {
771 memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
772 *hdr = (struct ipv6_opt_hdr *)*p;
e3192690 773 *p += CMSG_ALIGN(ipv6_optlen(*hdr));
333fad53
YH
774 }
775 } else {
776 if (newopt) {
777 if (copy_from_user(*p, newopt, newoptlen))
778 return -EFAULT;
779 *hdr = (struct ipv6_opt_hdr *)*p;
e3192690 780 if (ipv6_optlen(*hdr) > newoptlen)
333fad53
YH
781 return -EINVAL;
782 *p += CMSG_ALIGN(newoptlen);
783 }
784 }
785 return 0;
786}
787
e67ae213
HD
788/**
789 * ipv6_renew_options - replace a specific ext hdr with a new one.
790 *
791 * @sk: sock from which to allocate memory
792 * @opt: original options
793 * @newtype: option type to replace in @opt
794 * @newopt: new option of type @newtype to replace (user-mem)
795 * @newoptlen: length of @newopt
796 *
797 * Returns a new set of options which is a copy of @opt with the
798 * option type @newtype replaced with @newopt.
799 *
800 * @opt may be NULL, in which case a new set of options is returned
801 * containing just @newopt.
802 *
803 * @newopt may be NULL, in which case the specified option type is
804 * not copied into the new set of options.
805 *
806 * The new set of options is allocated from the socket option memory
807 * buffer of @sk.
808 */
333fad53
YH
809struct ipv6_txoptions *
810ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
811 int newtype,
812 struct ipv6_opt_hdr __user *newopt, int newoptlen)
813{
814 int tot_len = 0;
815 char *p;
816 struct ipv6_txoptions *opt2;
817 int err;
818
99c7bc01
YH
819 if (opt) {
820 if (newtype != IPV6_HOPOPTS && opt->hopopt)
821 tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
822 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
823 tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
824 if (newtype != IPV6_RTHDR && opt->srcrt)
825 tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
826 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
827 tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
828 }
829
333fad53
YH
830 if (newopt && newoptlen)
831 tot_len += CMSG_ALIGN(newoptlen);
832
833 if (!tot_len)
834 return NULL;
835
8b8aa4b5 836 tot_len += sizeof(*opt2);
333fad53
YH
837 opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
838 if (!opt2)
839 return ERR_PTR(-ENOBUFS);
840
841 memset(opt2, 0, tot_len);
45f6fad8 842 atomic_set(&opt2->refcnt, 1);
333fad53
YH
843 opt2->tot_len = tot_len;
844 p = (char *)(opt2 + 1);
845
99c7bc01 846 err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
333fad53
YH
847 newtype != IPV6_HOPOPTS,
848 &opt2->hopopt, &p);
849 if (err)
850 goto out;
851
99c7bc01 852 err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
333fad53
YH
853 newtype != IPV6_RTHDRDSTOPTS,
854 &opt2->dst0opt, &p);
855 if (err)
856 goto out;
857
99c7bc01 858 err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
333fad53 859 newtype != IPV6_RTHDR,
99c7bc01 860 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
333fad53
YH
861 if (err)
862 goto out;
863
99c7bc01 864 err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
333fad53
YH
865 newtype != IPV6_DSTOPTS,
866 &opt2->dst1opt, &p);
867 if (err)
868 goto out;
869
870 opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
871 (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
872 (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
873 opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
874
875 return opt2;
876out:
8b8aa4b5 877 sock_kfree_s(sk, opt2, opt2->tot_len);
333fad53
YH
878 return ERR_PTR(err);
879}
880
e67ae213
HD
881/**
882 * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
883 *
884 * @sk: sock from which to allocate memory
885 * @opt: original options
886 * @newtype: option type to replace in @opt
887 * @newopt: new option of type @newtype to replace (kernel-mem)
888 * @newoptlen: length of @newopt
889 *
890 * See ipv6_renew_options(). The difference is that @newopt is
891 * kernel memory, rather than user memory.
892 */
893struct ipv6_txoptions *
894ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
895 int newtype, struct ipv6_opt_hdr *newopt,
896 int newoptlen)
897{
898 struct ipv6_txoptions *ret_val;
899 const mm_segment_t old_fs = get_fs();
900
901 set_fs(KERNEL_DS);
902 ret_val = ipv6_renew_options(sk, opt, newtype,
903 (struct ipv6_opt_hdr __user *)newopt,
904 newoptlen);
905 set_fs(old_fs);
906 return ret_val;
907}
908
df9890c3
YH
909struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
910 struct ipv6_txoptions *opt)
911{
912 /*
913 * ignore the dest before srcrt unless srcrt is being included.
914 * --yoshfuji
915 */
916 if (opt && opt->dst0opt && !opt->srcrt) {
917 if (opt_space != opt) {
918 memcpy(opt_space, opt, sizeof(*opt_space));
919 opt = opt_space;
920 }
921 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
922 opt->dst0opt = NULL;
923 }
924
925 return opt;
926}
a495f836 927EXPORT_SYMBOL_GPL(ipv6_fixup_options);
df9890c3 928
20c59de2
AE
929/**
930 * fl6_update_dst - update flowi destination address with info given
931 * by srcrt option, if any.
932 *
4c9483b2 933 * @fl6: flowi6 for which daddr is to be updated
20c59de2 934 * @opt: struct ipv6_txoptions in which to look for srcrt opt
4c9483b2 935 * @orig: copy of original daddr address if modified
20c59de2
AE
936 *
937 * Returns NULL if no txoptions or no srcrt, otherwise returns orig
4c9483b2 938 * and initial value of fl6->daddr set in orig
20c59de2 939 */
4c9483b2 940struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
20c59de2
AE
941 const struct ipv6_txoptions *opt,
942 struct in6_addr *orig)
943{
944 if (!opt || !opt->srcrt)
945 return NULL;
946
4e3fd7a0
AD
947 *orig = fl6->daddr;
948 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
20c59de2
AE
949 return orig;
950}
20c59de2 951EXPORT_SYMBOL_GPL(fl6_update_dst);