net/ipv6/exthdrs.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Extension Header handling for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Andi Kleen              <ak@muc.de>
   9  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  10  */
  11
  12 /* Changes:
  13  *      yoshfuji                : ensure not to overrun while parsing
  14  *                                tlv options.
  15  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  16  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  17  *                                handlers as inet6_protocol{}.
  18  */
  19
  20 #include <linux/errno.h>
  21 #include <linux/types.h>
  22 #include <linux/socket.h>
  23 #include <linux/sockios.h>
  24 #include <linux/net.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/in6.h>
  27 #include <linux/icmpv6.h>
  28 #include <linux/slab.h>
  29 #include <linux/export.h>
  30
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/snmp.h>
  34
  35 #include <net/ipv6.h>
  36 #include <net/protocol.h>
  37 #include <net/transp_v6.h>
  38 #include <net/rawv6.h>
  39 #include <net/ndisc.h>
  40 #include <net/ip6_route.h>
  41 #include <net/addrconf.h>
  42 #include <net/calipso.h>
  43 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  44 #include <net/xfrm.h>
  45 #endif
  46 #include <linux/seg6.h>
  47 #include <net/seg6.h>
  48 #ifdef CONFIG_IPV6_SEG6_HMAC
  49 #include <net/seg6_hmac.h>
  50 #endif
  51 #include <net/rpl.h>
  52
  53 #include <linux/uaccess.h>
  54
  55 /*
  56  *      Parsing tlv encoded headers.
  57  *
  58  *      Parsing function "func" returns true, if parsing succeed
  59  *      and false, if it failed.
  60  *      It MUST NOT touch skb->h.
  61  */
  62
  63 struct tlvtype_proc {
  64         int     type;
  65         bool    (*func)(struct sk_buff *skb, int offset);
  66 };
  67
  68 /*********************
  69   Generic functions
  70  *********************/
  71
  72 /* An unknown option is detected, decide what to do */
  73
  74 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff,
  75                                bool disallow_unknowns)
  76 {
  77         if (disallow_unknowns) {
  78                 /* If unknown TLVs are disallowed by configuration
  79                  * then always silently drop packet. Note this also
  80                  * means no ICMP parameter problem is sent which
  81                  * could be a good property to mitigate a reflection DOS
  82                  * attack.
  83                  */
  84
  85                 goto drop;
  86         }
  87
  88         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  89         case 0: /* ignore */
  90                 return true;
  91
  92         case 1: /* drop packet */
  93                 break;
  94
  95         case 3: /* Send ICMP if not a multicast address and drop packet */
  96                 /* Actually, it is redundant check. icmp_send
  97                    will recheck in any case.
  98                  */
  99                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
 100                         break;
 101                 fallthrough;
 102         case 2: /* send ICMP PARM PROB regardless and drop packet */
 103                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
 104                 return false;
 105         }
 106
 107 drop:
 108         kfree_skb(skb);
 109         return false;
 110 }
 111
 112 /* Parse tlv encoded option header (hop-by-hop or destination) */
 113
 114 static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
 115                           struct sk_buff *skb,
 116                           int max_count)
 117 {
 118         int len = (skb_transport_header(skb)[1] + 1) << 3;
 119         const unsigned char *nh = skb_network_header(skb);
 120         int off = skb_network_header_len(skb);
 121         const struct tlvtype_proc *curr;
 122         bool disallow_unknowns = false;
 123         int tlv_count = 0;
 124         int padlen = 0;
 125
 126         if (unlikely(max_count < 0)) {
 127                 disallow_unknowns = true;
 128                 max_count = -max_count;
 129         }
 130
 131         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 132                 goto bad;
 133
 134         off += 2;
 135         len -= 2;
 136
 137         while (len > 0) {
 138                 int optlen = nh[off + 1] + 2;
 139                 int i;
 140
 141                 switch (nh[off]) {
 142                 case IPV6_TLV_PAD1:
 143                         optlen = 1;
 144                         padlen++;
 145                         if (padlen > 7)
 146                                 goto bad;
 147                         break;
 148
 149                 case IPV6_TLV_PADN:
 150                         /* RFC 2460 states that the purpose of PadN is
 151                          * to align the containing header to multiples
 152                          * of 8. 7 is therefore the highest valid value.
 153                          * See also RFC 4942, Section 2.1.9.5.
 154                          */
 155                         padlen += optlen;
 156                         if (padlen > 7)
 157                                 goto bad;
 158                         /* RFC 4942 recommends receiving hosts to
 159                          * actively check PadN payload to contain
 160                          * only zeroes.
 161                          */
 162                         for (i = 2; i < optlen; i++) {
 163                                 if (nh[off + i] != 0)
 164                                         goto bad;
 165                         }
 166                         break;
 167
 168                 default: /* Other TLV code so scan list */
 169                         if (optlen > len)
 170                                 goto bad;
 171
 172                         tlv_count++;
 173                         if (tlv_count > max_count)
 174                                 goto bad;
 175
 176                         for (curr = procs; curr->type >= 0; curr++) {
 177                                 if (curr->type == nh[off]) {
 178                                         /* type specific length/alignment
 179                                            checks will be performed in the
 180                                            func(). */
 181                                         if (curr->func(skb, off) == false)
 182                                                 return false;
 183                                         break;
 184                                 }
 185                         }
 186                         if (curr->type < 0 &&
 187                             !ip6_tlvopt_unknown(skb, off, disallow_unknowns))
 188                                 return false;
 189
 190                         padlen = 0;
 191                         break;
 192                 }
 193                 off += optlen;
 194                 len -= optlen;
 195         }
 196
 197         if (len == 0)
 198                 return true;
 199 bad:
 200         kfree_skb(skb);
 201         return false;
 202 }
 203
 204 /*****************************
 205   Destination options header.
 206  *****************************/
 207
 208 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 209 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 210 {
 211         struct ipv6_destopt_hao *hao;
 212         struct inet6_skb_parm *opt = IP6CB(skb);
 213         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 214         int ret;
 215
 216         if (opt->dsthao) {
 217                 net_dbg_ratelimited("hao duplicated\n");
 218                 goto discard;
 219         }
 220         opt->dsthao = opt->dst1;
 221         opt->dst1 = 0;
 222
 223         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 224
 225         if (hao->length != 16) {
 226                 net_dbg_ratelimited("hao invalid option length = %d\n",
 227                                     hao->length);
 228                 goto discard;
 229         }
 230
 231         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 232                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 233                                     &hao->addr);
 234                 goto discard;
 235         }
 236
 237         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 238                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 239         if (unlikely(ret < 0))
 240                 goto discard;
 241
 242         if (skb_cloned(skb)) {
 243                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 244                         goto discard;
 245
 246                 /* update all variable using below by copied skbuff */
 247                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 248                                                   optoff);
 249                 ipv6h = ipv6_hdr(skb);
 250         }
 251
 252         if (skb->ip_summed == CHECKSUM_COMPLETE)
 253                 skb->ip_summed = CHECKSUM_NONE;
 254
 255         swap(ipv6h->saddr, hao->addr);
 256
 257         if (skb->tstamp == 0)
 258                 __net_timestamp(skb);
 259
 260         return true;
 261
 262  discard:
 263         kfree_skb(skb);
 264         return false;
 265 }
 266 #endif
 267
 268 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 269 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 270         {
 271                 .type   = IPV6_TLV_HAO,
 272                 .func   = ipv6_dest_hao,
 273         },
 274 #endif
 275         {-1,                    NULL}
 276 };
 277
 278 static int ipv6_destopt_rcv(struct sk_buff *skb)
 279 {
 280         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 281         struct inet6_skb_parm *opt = IP6CB(skb);
 282 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 283         __u16 dstbuf;
 284 #endif
 285         struct dst_entry *dst = skb_dst(skb);
 286         struct net *net = dev_net(skb->dev);
 287         int extlen;
 288
 289         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 290             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 291                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 292                 __IP6_INC_STATS(dev_net(dst->dev), idev,
 293                                 IPSTATS_MIB_INHDRERRORS);
 294 fail_and_free:
 295                 kfree_skb(skb);
 296                 return -1;
 297         }
 298
 299         extlen = (skb_transport_header(skb)[1] + 1) << 3;
 300         if (extlen > net->ipv6.sysctl.max_dst_opts_len)
 301                 goto fail_and_free;
 302
 303         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 304 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 305         dstbuf = opt->dst1;
 306 #endif
 307
 308         if (ip6_parse_tlv(tlvprocdestopt_lst, skb,
 309                           init_net.ipv6.sysctl.max_dst_opts_cnt)) {
 310                 skb->transport_header += extlen;
 311                 opt = IP6CB(skb);
 312 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 313                 opt->nhoff = dstbuf;
 314 #else
 315                 opt->nhoff = opt->dst1;
 316 #endif
 317                 return 1;
 318         }
 319
 320         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 321         return -1;
 322 }
 323
 324 static void seg6_update_csum(struct sk_buff *skb)
 325 {
 326         struct ipv6_sr_hdr *hdr;
 327         struct in6_addr *addr;
 328         __be32 from, to;
 329
 330         /* srh is at transport offset and seg_left is already decremented
 331          * but daddr is not yet updated with next segment
 332          */
 333
 334         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 335         addr = hdr->segments + hdr->segments_left;
 336
 337         hdr->segments_left++;
 338         from = *(__be32 *)hdr;
 339
 340         hdr->segments_left--;
 341         to = *(__be32 *)hdr;
 342
 343         /* update skb csum with diff resulting from seg_left decrement */
 344
 345         update_csum_diff4(skb, from, to);
 346
 347         /* compute csum diff between current and next segment and update */
 348
 349         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 350                            (__be32 *)addr);
 351 }
 352
 353 static int ipv6_srh_rcv(struct sk_buff *skb)
 354 {
 355         struct inet6_skb_parm *opt = IP6CB(skb);
 356         struct net *net = dev_net(skb->dev);
 357         struct ipv6_sr_hdr *hdr;
 358         struct inet6_dev *idev;
 359         struct in6_addr *addr;
 360         int accept_seg6;
 361
 362         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 363
 364         idev = __in6_dev_get(skb->dev);
 365
 366         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 367         if (accept_seg6 > idev->cnf.seg6_enabled)
 368                 accept_seg6 = idev->cnf.seg6_enabled;
 369
 370         if (!accept_seg6) {
 371                 kfree_skb(skb);
 372                 return -1;
 373         }
 374
 375 #ifdef CONFIG_IPV6_SEG6_HMAC
 376         if (!seg6_hmac_validate_skb(skb)) {
 377                 kfree_skb(skb);
 378                 return -1;
 379         }
 380 #endif
 381
 382 looped_back:
 383         if (hdr->segments_left == 0) {
 384                 if (hdr->nexthdr == NEXTHDR_IPV6 || hdr->nexthdr == NEXTHDR_IPV4) {
 385                         int offset = (hdr->hdrlen + 1) << 3;
 386
 387                         skb_postpull_rcsum(skb, skb_network_header(skb),
 388                                            skb_network_header_len(skb));
 389
 390                         if (!pskb_pull(skb, offset)) {
 391                                 kfree_skb(skb);
 392                                 return -1;
 393                         }
 394                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 395                                            offset);
 396
 397                         skb_reset_network_header(skb);
 398                         skb_reset_transport_header(skb);
 399                         skb->encapsulation = 0;
 400                         if (hdr->nexthdr == NEXTHDR_IPV4)
 401                                 skb->protocol = htons(ETH_P_IP);
 402                         __skb_tunnel_rx(skb, skb->dev, net);
 403
 404                         netif_rx(skb);
 405                         return -1;
 406                 }
 407
 408                 opt->srcrt = skb_network_header_len(skb);
 409                 opt->lastopt = opt->srcrt;
 410                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 411                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 412
 413                 return 1;
 414         }
 415
 416         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 417                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 418                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 419                                   ((&hdr->segments_left) -
 420                                    skb_network_header(skb)));
 421                 return -1;
 422         }
 423
 424         if (skb_cloned(skb)) {
 425                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 426                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 427                                         IPSTATS_MIB_OUTDISCARDS);
 428                         kfree_skb(skb);
 429                         return -1;
 430                 }
 431         }
 432
 433         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 434
 435         hdr->segments_left--;
 436         addr = hdr->segments + hdr->segments_left;
 437
 438         skb_push(skb, sizeof(struct ipv6hdr));
 439
 440         if (skb->ip_summed == CHECKSUM_COMPLETE)
 441                 seg6_update_csum(skb);
 442
 443         ipv6_hdr(skb)->daddr = *addr;
 444
 445         skb_dst_drop(skb);
 446
 447         ip6_route_input(skb);
 448
 449         if (skb_dst(skb)->error) {
 450                 dst_input(skb);
 451                 return -1;
 452         }
 453
 454         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 455                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 456                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 457                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 458                                     ICMPV6_EXC_HOPLIMIT, 0);
 459                         kfree_skb(skb);
 460                         return -1;
 461                 }
 462                 ipv6_hdr(skb)->hop_limit--;
 463
 464                 skb_pull(skb, sizeof(struct ipv6hdr));
 465                 goto looped_back;
 466         }
 467
 468         dst_input(skb);
 469
 470         return -1;
 471 }
 472
 473 static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 474 {
 475         struct ipv6_rpl_sr_hdr *hdr, *ohdr, *chdr;
 476         struct inet6_skb_parm *opt = IP6CB(skb);
 477         struct net *net = dev_net(skb->dev);
 478         struct inet6_dev *idev;
 479         struct ipv6hdr *oldhdr;
 480         struct in6_addr addr;
 481         unsigned char *buf;
 482         int accept_rpl_seg;
 483         int i, err;
 484         u64 n = 0;
 485         u32 r;
 486
 487         idev = __in6_dev_get(skb->dev);
 488
 489         accept_rpl_seg = net->ipv6.devconf_all->rpl_seg_enabled;
 490         if (accept_rpl_seg > idev->cnf.rpl_seg_enabled)
 491                 accept_rpl_seg = idev->cnf.rpl_seg_enabled;
 492
 493         if (!accept_rpl_seg) {
 494                 kfree_skb(skb);
 495                 return -1;
 496         }
 497
 498 looped_back:
 499         hdr = (struct ipv6_rpl_sr_hdr *)skb_transport_header(skb);
 500
 501         if (hdr->segments_left == 0) {
 502                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 503                         int offset = (hdr->hdrlen + 1) << 3;
 504
 505                         skb_postpull_rcsum(skb, skb_network_header(skb),
 506                                            skb_network_header_len(skb));
 507
 508                         if (!pskb_pull(skb, offset)) {
 509                                 kfree_skb(skb);
 510                                 return -1;
 511                         }
 512                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 513                                            offset);
 514
 515                         skb_reset_network_header(skb);
 516                         skb_reset_transport_header(skb);
 517                         skb->encapsulation = 0;
 518
 519                         __skb_tunnel_rx(skb, skb->dev, net);
 520
 521                         netif_rx(skb);
 522                         return -1;
 523                 }
 524
 525                 opt->srcrt = skb_network_header_len(skb);
 526                 opt->lastopt = opt->srcrt;
 527                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 528                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 529
 530                 return 1;
 531         }
 532
 533         if (!pskb_may_pull(skb, sizeof(*hdr))) {
 534                 kfree_skb(skb);
 535                 return -1;
 536         }
 537
 538         n = (hdr->hdrlen << 3) - hdr->pad - (16 - hdr->cmpre);
 539         r = do_div(n, (16 - hdr->cmpri));
 540         /* checks if calculation was without remainder and n fits into
 541          * unsigned char which is segments_left field. Should not be
 542          * higher than that.
 543          */
 544         if (r || (n + 1) > 255) {
 545                 kfree_skb(skb);
 546                 return -1;
 547         }
 548
 549         if (hdr->segments_left > n + 1) {
 550                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 551                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 552                                   ((&hdr->segments_left) -
 553                                    skb_network_header(skb)));
 554                 return -1;
 555         }
 556
 557         if (skb_cloned(skb)) {
 558                 if (pskb_expand_head(skb, IPV6_RPL_SRH_WORST_SWAP_SIZE, 0,
 559                                      GFP_ATOMIC)) {
 560                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 561                                         IPSTATS_MIB_OUTDISCARDS);
 562                         kfree_skb(skb);
 563                         return -1;
 564                 }
 565         } else {
 566                 err = skb_cow_head(skb, IPV6_RPL_SRH_WORST_SWAP_SIZE);
 567                 if (unlikely(err)) {
 568                         kfree_skb(skb);
 569                         return -1;
 570                 }
 571         }
 572
 573         hdr = (struct ipv6_rpl_sr_hdr *)skb_transport_header(skb);
 574
 575         if (!pskb_may_pull(skb, ipv6_rpl_srh_size(n, hdr->cmpri,
 576                                                   hdr->cmpre))) {
 577                 kfree_skb(skb);
 578                 return -1;
 579         }
 580
 581         hdr->segments_left--;
 582         i = n - hdr->segments_left;
 583
 584         buf = kcalloc(struct_size(hdr, segments.addr, n + 2), 2, GFP_ATOMIC);
 585         if (unlikely(!buf)) {
 586                 kfree_skb(skb);
 587                 return -1;
 588         }
 589
 590         ohdr = (struct ipv6_rpl_sr_hdr *)buf;
 591         ipv6_rpl_srh_decompress(ohdr, hdr, &ipv6_hdr(skb)->daddr, n);
 592         chdr = (struct ipv6_rpl_sr_hdr *)(buf + ((ohdr->hdrlen + 1) << 3));
 593
 594         if ((ipv6_addr_type(&ipv6_hdr(skb)->daddr) & IPV6_ADDR_MULTICAST) ||
 595             (ipv6_addr_type(&ohdr->rpl_segaddr[i]) & IPV6_ADDR_MULTICAST)) {
 596                 kfree_skb(skb);
 597                 kfree(buf);
 598                 return -1;
 599         }
 600
 601         err = ipv6_chk_rpl_srh_loop(net, ohdr->rpl_segaddr, n + 1);
 602         if (err) {
 603                 icmpv6_send(skb, ICMPV6_PARAMPROB, 0, 0);
 604                 kfree_skb(skb);
 605                 kfree(buf);
 606                 return -1;
 607         }
 608
 609         addr = ipv6_hdr(skb)->daddr;
 610         ipv6_hdr(skb)->daddr = ohdr->rpl_segaddr[i];
 611         ohdr->rpl_segaddr[i] = addr;
 612
 613         ipv6_rpl_srh_compress(chdr, ohdr, &ipv6_hdr(skb)->daddr, n);
 614
 615         oldhdr = ipv6_hdr(skb);
 616
 617         skb_pull(skb, ((hdr->hdrlen + 1) << 3));
 618         skb_postpull_rcsum(skb, oldhdr,
 619                            sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3));
 620         skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr));
 621         skb_reset_network_header(skb);
 622         skb_mac_header_rebuild(skb);
 623         skb_set_transport_header(skb, sizeof(struct ipv6hdr));
 624
 625         memmove(ipv6_hdr(skb), oldhdr, sizeof(struct ipv6hdr));
 626         memcpy(skb_transport_header(skb), chdr, (chdr->hdrlen + 1) << 3);
 627
 628         ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 629         skb_postpush_rcsum(skb, ipv6_hdr(skb),
 630                            sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3));
 631
 632         kfree(buf);
 633
 634         skb_dst_drop(skb);
 635
 636         ip6_route_input(skb);
 637
 638         if (skb_dst(skb)->error) {
 639                 dst_input(skb);
 640                 return -1;
 641         }
 642
 643         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 644                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 645                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 646                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 647                                     ICMPV6_EXC_HOPLIMIT, 0);
 648                         kfree_skb(skb);
 649                         return -1;
 650                 }
 651                 ipv6_hdr(skb)->hop_limit--;
 652
 653                 skb_pull(skb, sizeof(struct ipv6hdr));
 654                 goto looped_back;
 655         }
 656
 657         dst_input(skb);
 658
 659         return -1;
 660 }
 661
 662 /********************************
 663   Routing header.
 664  ********************************/
 665
 666 /* called with rcu_read_lock() */
 667 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 668 {
 669         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 670         struct inet6_skb_parm *opt = IP6CB(skb);
 671         struct in6_addr *addr = NULL;
 672         struct in6_addr daddr;
 673         int n, i;
 674         struct ipv6_rt_hdr *hdr;
 675         struct rt0_hdr *rthdr;
 676         struct net *net = dev_net(skb->dev);
 677         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 678
 679         idev = __in6_dev_get(skb->dev);
 680         if (idev && accept_source_route > idev->cnf.accept_source_route)
 681                 accept_source_route = idev->cnf.accept_source_route;
 682
 683         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 684             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 685                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 686                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 687                 kfree_skb(skb);
 688                 return -1;
 689         }
 690
 691         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 692
 693         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 694             skb->pkt_type != PACKET_HOST) {
 695                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 696                 kfree_skb(skb);
 697                 return -1;
 698         }
 699
 700         switch (hdr->type) {
 701         case IPV6_SRCRT_TYPE_4:
 702                 /* segment routing */
 703                 return ipv6_srh_rcv(skb);
 704         case IPV6_SRCRT_TYPE_3:
 705                 /* rpl segment routing */
 706                 return ipv6_rpl_srh_rcv(skb);
 707         default:
 708                 break;
 709         }
 710
 711 looped_back:
 712         if (hdr->segments_left == 0) {
 713                 switch (hdr->type) {
 714 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 715                 case IPV6_SRCRT_TYPE_2:
 716                         /* Silently discard type 2 header unless it was
 717                          * processed by own
 718                          */
 719                         if (!addr) {
 720                                 __IP6_INC_STATS(net, idev,
 721                                                 IPSTATS_MIB_INADDRERRORS);
 722                                 kfree_skb(skb);
 723                                 return -1;
 724                         }
 725                         break;
 726 #endif
 727                 default:
 728                         break;
 729                 }
 730
 731                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 732                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 733                 opt->dst0 = opt->dst1;
 734                 opt->dst1 = 0;
 735                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 736                 return 1;
 737         }
 738
 739         switch (hdr->type) {
 740 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 741         case IPV6_SRCRT_TYPE_2:
 742                 if (accept_source_route < 0)
 743                         goto unknown_rh;
 744                 /* Silently discard invalid RTH type 2 */
 745                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 746                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 747                         kfree_skb(skb);
 748                         return -1;
 749                 }
 750                 break;
 751 #endif
 752         default:
 753                 goto unknown_rh;
 754         }
 755
 756         /*
 757          *      This is the routing header forwarding algorithm from
 758          *      RFC 2460, page 16.
 759          */
 760
 761         n = hdr->hdrlen >> 1;
 762
 763         if (hdr->segments_left > n) {
 764                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 765                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 766                                   ((&hdr->segments_left) -
 767                                    skb_network_header(skb)));
 768                 return -1;
 769         }
 770
 771         /* We are about to mangle packet header. Be careful!
 772            Do not damage packets queued somewhere.
 773          */
 774         if (skb_cloned(skb)) {
 775                 /* the copy is a forwarded packet */
 776                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 777                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 778                                         IPSTATS_MIB_OUTDISCARDS);
 779                         kfree_skb(skb);
 780                         return -1;
 781                 }
 782                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 783         }
 784
 785         if (skb->ip_summed == CHECKSUM_COMPLETE)
 786                 skb->ip_summed = CHECKSUM_NONE;
 787
 788         i = n - --hdr->segments_left;
 789
 790         rthdr = (struct rt0_hdr *) hdr;
 791         addr = rthdr->addr;
 792         addr += i - 1;
 793
 794         switch (hdr->type) {
 795 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 796         case IPV6_SRCRT_TYPE_2:
 797                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 798                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 799                                      IPPROTO_ROUTING) < 0) {
 800                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 801                         kfree_skb(skb);
 802                         return -1;
 803                 }
 804                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 805                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 806                         kfree_skb(skb);
 807                         return -1;
 808                 }
 809                 break;
 810 #endif
 811         default:
 812                 break;
 813         }
 814
 815         if (ipv6_addr_is_multicast(addr)) {
 816                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 817                 kfree_skb(skb);
 818                 return -1;
 819         }
 820
 821         daddr = *addr;
 822         *addr = ipv6_hdr(skb)->daddr;
 823         ipv6_hdr(skb)->daddr = daddr;
 824
 825         skb_dst_drop(skb);
 826         ip6_route_input(skb);
 827         if (skb_dst(skb)->error) {
 828                 skb_push(skb, skb->data - skb_network_header(skb));
 829                 dst_input(skb);
 830                 return -1;
 831         }
 832
 833         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 834                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 835                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 836                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 837                                     0);
 838                         kfree_skb(skb);
 839                         return -1;
 840                 }
 841                 ipv6_hdr(skb)->hop_limit--;
 842                 goto looped_back;
 843         }
 844
 845         skb_push(skb, skb->data - skb_network_header(skb));
 846         dst_input(skb);
 847         return -1;
 848
 849 unknown_rh:
 850         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 851         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 852                           (&hdr->type) - skb_network_header(skb));
 853         return -1;
 854 }
 855
 856 static const struct inet6_protocol rthdr_protocol = {
 857         .handler        =       ipv6_rthdr_rcv,
 858         .flags          =       INET6_PROTO_NOPOLICY,
 859 };
 860
 861 static const struct inet6_protocol destopt_protocol = {
 862         .handler        =       ipv6_destopt_rcv,
 863         .flags          =       INET6_PROTO_NOPOLICY,
 864 };
 865
 866 static const struct inet6_protocol nodata_protocol = {
 867         .handler        =       dst_discard,
 868         .flags          =       INET6_PROTO_NOPOLICY,
 869 };
 870
 871 int __init ipv6_exthdrs_init(void)
 872 {
 873         int ret;
 874
 875         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 876         if (ret)
 877                 goto out;
 878
 879         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 880         if (ret)
 881                 goto out_rthdr;
 882
 883         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 884         if (ret)
 885                 goto out_destopt;
 886
 887 out:
 888         return ret;
 889 out_destopt:
 890         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 891 out_rthdr:
 892         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 893         goto out;
 894 };
 895
 896 void ipv6_exthdrs_exit(void)
 897 {
 898         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 899         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 900         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 901 }
 902
 903 /**********************************
 904   Hop-by-hop options.
 905  **********************************/
 906
 907 /*
 908  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 909  */
 910 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 911 {
 912         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 913 }
 914
 915 /* Router Alert as of RFC 2711 */
 916
 917 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 918 {
 919         const unsigned char *nh = skb_network_header(skb);
 920
 921         if (nh[optoff + 1] == 2) {
 922                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 923                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 924                 return true;
 925         }
 926         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 927                             nh[optoff + 1]);
 928         kfree_skb(skb);
 929         return false;
 930 }
 931
 932 /* Jumbo payload */
 933
 934 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 935 {
 936         const unsigned char *nh = skb_network_header(skb);
 937         struct inet6_dev *idev = __in6_dev_get_safely(skb->dev);
 938         struct net *net = ipv6_skb_net(skb);
 939         u32 pkt_len;
 940
 941         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 942                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 943                                     nh[optoff+1]);
 944                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 945                 goto drop;
 946         }
 947
 948         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 949         if (pkt_len <= IPV6_MAXPLEN) {
 950                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 951                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 952                 return false;
 953         }
 954         if (ipv6_hdr(skb)->payload_len) {
 955                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 956                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 957                 return false;
 958         }
 959
 960         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 961                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 962                 goto drop;
 963         }
 964
 965         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 966                 goto drop;
 967
 968         IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
 969         return true;
 970
 971 drop:
 972         kfree_skb(skb);
 973         return false;
 974 }
 975
 976 /* CALIPSO RFC 5570 */
 977
 978 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 979 {
 980         const unsigned char *nh = skb_network_header(skb);
 981
 982         if (nh[optoff + 1] < 8)
 983                 goto drop;
 984
 985         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 986                 goto drop;
 987
 988         if (!calipso_validate(skb, nh + optoff))
 989                 goto drop;
 990
 991         return true;
 992
 993 drop:
 994         kfree_skb(skb);
 995         return false;
 996 }
 997
 998 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 999         {
1000                 .type   = IPV6_TLV_ROUTERALERT,
1001                 .func   = ipv6_hop_ra,
1002         },
1003         {
1004                 .type   = IPV6_TLV_JUMBO,
1005                 .func   = ipv6_hop_jumbo,
1006         },
1007         {
1008                 .type   = IPV6_TLV_CALIPSO,
1009                 .func   = ipv6_hop_calipso,
1010         },
1011         { -1, }
1012 };
1013
1014 int ipv6_parse_hopopts(struct sk_buff *skb)
1015 {
1016         struct inet6_skb_parm *opt = IP6CB(skb);
1017         struct net *net = dev_net(skb->dev);
1018         int extlen;
1019
1020         /*
1021          * skb_network_header(skb) is equal to skb->data, and
1022          * skb_network_header_len(skb) is always equal to
1023          * sizeof(struct ipv6hdr) by definition of
1024          * hop-by-hop options.
1025          */
1026         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
1027             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
1028                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
1029 fail_and_free:
1030                 kfree_skb(skb);
1031                 return -1;
1032         }
1033
1034         extlen = (skb_transport_header(skb)[1] + 1) << 3;
1035         if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
1036                 goto fail_and_free;
1037
1038         opt->flags |= IP6SKB_HOPBYHOP;
1039         if (ip6_parse_tlv(tlvprochopopt_lst, skb,
1040                           init_net.ipv6.sysctl.max_hbh_opts_cnt)) {
1041                 skb->transport_header += extlen;
1042                 opt = IP6CB(skb);
1043                 opt->nhoff = sizeof(struct ipv6hdr);
1044                 return 1;
1045         }
1046         return -1;
1047 }
1048
1049 /*
1050  *      Creating outbound headers.
1051  *
1052  *      "build" functions work when skb is filled from head to tail (datagram)
1053  *      "push"  functions work when headers are added from tail to head (tcp)
1054  *
1055  *      In both cases we assume, that caller reserved enough room
1056  *      for headers.
1057  */
1058
1059 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
1060                              struct ipv6_rt_hdr *opt,
1061                              struct in6_addr **addr_p, struct in6_addr *saddr)
1062 {
1063         struct rt0_hdr *phdr, *ihdr;
1064         int hops;
1065
1066         ihdr = (struct rt0_hdr *) opt;
1067
1068         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
1069         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
1070
1071         hops = ihdr->rt_hdr.hdrlen >> 1;
1072
1073         if (hops > 1)
1074                 memcpy(phdr->addr, ihdr->addr + 1,
1075                        (hops - 1) * sizeof(struct in6_addr));
1076
1077         phdr->addr[hops - 1] = **addr_p;
1078         *addr_p = ihdr->addr;
1079
1080         phdr->rt_hdr.nexthdr = *proto;
1081         *proto = NEXTHDR_ROUTING;
1082 }
1083
1084 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
1085                              struct ipv6_rt_hdr *opt,
1086                              struct in6_addr **addr_p, struct in6_addr *saddr)
1087 {
1088         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
1089         int plen, hops;
1090
1091         sr_ihdr = (struct ipv6_sr_hdr *)opt;
1092         plen = (sr_ihdr->hdrlen + 1) << 3;
1093
1094         sr_phdr = skb_push(skb, plen);
1095         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
1096
1097         hops = sr_ihdr->first_segment + 1;
1098         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
1099                (hops - 1) * sizeof(struct in6_addr));
1100
1101         sr_phdr->segments[0] = **addr_p;
1102         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
1103
1104         if (sr_ihdr->hdrlen > hops * 2) {
1105                 int tlvs_offset, tlvs_length;
1106
1107                 tlvs_offset = (1 + hops * 2) << 3;
1108                 tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
1109                 memcpy((char *)sr_phdr + tlvs_offset,
1110                        (char *)sr_ihdr + tlvs_offset, tlvs_length);
1111         }
1112
1113 #ifdef CONFIG_IPV6_SEG6_HMAC
1114         if (sr_has_hmac(sr_phdr)) {
1115                 struct net *net = NULL;
1116
1117                 if (skb->dev)
1118                         net = dev_net(skb->dev);
1119                 else if (skb->sk)
1120                         net = sock_net(skb->sk);
1121
1122                 WARN_ON(!net);
1123
1124                 if (net)
1125                         seg6_push_hmac(net, saddr, sr_phdr);
1126         }
1127 #endif
1128
1129         sr_phdr->nexthdr = *proto;
1130         *proto = NEXTHDR_ROUTING;
1131 }
1132
1133 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
1134                             struct ipv6_rt_hdr *opt,
1135                             struct in6_addr **addr_p, struct in6_addr *saddr)
1136 {
1137         switch (opt->type) {
1138         case IPV6_SRCRT_TYPE_0:
1139         case IPV6_SRCRT_STRICT:
1140         case IPV6_SRCRT_TYPE_2:
1141                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
1142                 break;
1143         case IPV6_SRCRT_TYPE_4:
1144                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
1145                 break;
1146         default:
1147                 break;
1148         }
1149 }
1150
1151 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
1152 {
1153         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
1154
1155         memcpy(h, opt, ipv6_optlen(opt));
1156         h->nexthdr = *proto;
1157         *proto = type;
1158 }
1159
1160 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
1161                           u8 *proto,
1162                           struct in6_addr **daddr, struct in6_addr *saddr)
1163 {
1164         if (opt->srcrt) {
1165                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
1166                 /*
1167                  * IPV6_RTHDRDSTOPTS is ignored
1168                  * unless IPV6_RTHDR is set (RFC3542).
1169                  */
1170                 if (opt->dst0opt)
1171                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
1172         }
1173         if (opt->hopopt)
1174                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
1175 }
1176
1177 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
1178 {
1179         if (opt->dst1opt)
1180                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
1181 }
1182 EXPORT_SYMBOL(ipv6_push_frag_opts);
1183
1184 struct ipv6_txoptions *
1185 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
1186 {
1187         struct ipv6_txoptions *opt2;
1188
1189         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
1190         if (opt2) {
1191                 long dif = (char *)opt2 - (char *)opt;
1192                 memcpy(opt2, opt, opt->tot_len);
1193                 if (opt2->hopopt)
1194                         *((char **)&opt2->hopopt) += dif;
1195                 if (opt2->dst0opt)
1196                         *((char **)&opt2->dst0opt) += dif;
1197                 if (opt2->dst1opt)
1198                         *((char **)&opt2->dst1opt) += dif;
1199                 if (opt2->srcrt)
1200                         *((char **)&opt2->srcrt) += dif;
1201                 refcount_set(&opt2->refcnt, 1);
1202         }
1203         return opt2;
1204 }
1205 EXPORT_SYMBOL_GPL(ipv6_dup_options);
1206
1207 static void ipv6_renew_option(int renewtype,
1208                               struct ipv6_opt_hdr **dest,
1209                               struct ipv6_opt_hdr *old,
1210                               struct ipv6_opt_hdr *new,
1211                               int newtype, char **p)
1212 {
1213         struct ipv6_opt_hdr *src;
1214
1215         src = (renewtype == newtype ? new : old);
1216         if (!src)
1217                 return;
1218
1219         memcpy(*p, src, ipv6_optlen(src));
1220         *dest = (struct ipv6_opt_hdr *)*p;
1221         *p += CMSG_ALIGN(ipv6_optlen(*dest));
1222 }
1223
1224 /**
1225  * ipv6_renew_options - replace a specific ext hdr with a new one.
1226  *
1227  * @sk: sock from which to allocate memory
1228  * @opt: original options
1229  * @newtype: option type to replace in @opt
1230  * @newopt: new option of type @newtype to replace (user-mem)
1231  *
1232  * Returns a new set of options which is a copy of @opt with the
1233  * option type @newtype replaced with @newopt.
1234  *
1235  * @opt may be NULL, in which case a new set of options is returned
1236  * containing just @newopt.
1237  *
1238  * @newopt may be NULL, in which case the specified option type is
1239  * not copied into the new set of options.
1240  *
1241  * The new set of options is allocated from the socket option memory
1242  * buffer of @sk.
1243  */
1244 struct ipv6_txoptions *
1245 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1246                    int newtype, struct ipv6_opt_hdr *newopt)
1247 {
1248         int tot_len = 0;
1249         char *p;
1250         struct ipv6_txoptions *opt2;
1251
1252         if (opt) {
1253                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1254                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1255                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1256                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1257                 if (newtype != IPV6_RTHDR && opt->srcrt)
1258                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1259                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1260                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1261         }
1262
1263         if (newopt)
1264                 tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
1265
1266         if (!tot_len)
1267                 return NULL;
1268
1269         tot_len += sizeof(*opt2);
1270         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1271         if (!opt2)
1272                 return ERR_PTR(-ENOBUFS);
1273
1274         memset(opt2, 0, tot_len);
1275         refcount_set(&opt2->refcnt, 1);
1276         opt2->tot_len = tot_len;
1277         p = (char *)(opt2 + 1);
1278
1279         ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
1280                           (opt ? opt->hopopt : NULL),
1281                           newopt, newtype, &p);
1282         ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
1283                           (opt ? opt->dst0opt : NULL),
1284                           newopt, newtype, &p);
1285         ipv6_renew_option(IPV6_RTHDR,
1286                           (struct ipv6_opt_hdr **)&opt2->srcrt,
1287                           (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
1288                           newopt, newtype, &p);
1289         ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
1290                           (opt ? opt->dst1opt : NULL),
1291                           newopt, newtype, &p);
1292
1293         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1294                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1295                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1296         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1297
1298         return opt2;
1299 }
1300
1301 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1302                                           struct ipv6_txoptions *opt)
1303 {
1304         /*
1305          * ignore the dest before srcrt unless srcrt is being included.
1306          * --yoshfuji
1307          */
1308         if (opt && opt->dst0opt && !opt->srcrt) {
1309                 if (opt_space != opt) {
1310                         memcpy(opt_space, opt, sizeof(*opt_space));
1311                         opt = opt_space;
1312                 }
1313                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1314                 opt->dst0opt = NULL;
1315         }
1316
1317         return opt;
1318 }
1319 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1320
1321 /**
1322  * fl6_update_dst - update flowi destination address with info given
1323  *                  by srcrt option, if any.
1324  *
1325  * @fl6: flowi6 for which daddr is to be updated
1326  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1327  * @orig: copy of original daddr address if modified
1328  *
1329  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1330  * and initial value of fl6->daddr set in orig
1331  */
1332 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1333                                 const struct ipv6_txoptions *opt,
1334                                 struct in6_addr *orig)
1335 {
1336         if (!opt || !opt->srcrt)
1337                 return NULL;
1338
1339         *orig = fl6->daddr;
1340
1341         switch (opt->srcrt->type) {
1342         case IPV6_SRCRT_TYPE_0:
1343         case IPV6_SRCRT_STRICT:
1344         case IPV6_SRCRT_TYPE_2:
1345                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1346                 break;
1347         case IPV6_SRCRT_TYPE_4:
1348         {
1349                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1350
1351                 fl6->daddr = srh->segments[srh->segments_left];
1352                 break;
1353         }
1354         default:
1355                 return NULL;
1356         }
1357
1358         return orig;
1359 }
1360 EXPORT_SYMBOL_GPL(fl6_update_dst);