net/ipv6/exthdrs.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Extension Header handling for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Andi Kleen              <ak@muc.de>
   9  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  10  */
  11
  12 /* Changes:
  13  *      yoshfuji                : ensure not to overrun while parsing
  14  *                                tlv options.
  15  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  16  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  17  *                                handlers as inet6_protocol{}.
  18  */
  19
  20 #include <linux/errno.h>
  21 #include <linux/types.h>
  22 #include <linux/socket.h>
  23 #include <linux/sockios.h>
  24 #include <linux/net.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/in6.h>
  27 #include <linux/icmpv6.h>
  28 #include <linux/slab.h>
  29 #include <linux/export.h>
  30
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/snmp.h>
  34
  35 #include <net/ipv6.h>
  36 #include <net/protocol.h>
  37 #include <net/transp_v6.h>
  38 #include <net/rawv6.h>
  39 #include <net/ndisc.h>
  40 #include <net/ip6_route.h>
  41 #include <net/addrconf.h>
  42 #include <net/calipso.h>
  43 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  44 #include <net/xfrm.h>
  45 #endif
  46 #include <linux/seg6.h>
  47 #include <net/seg6.h>
  48 #ifdef CONFIG_IPV6_SEG6_HMAC
  49 #include <net/seg6_hmac.h>
  50 #endif
  51 #include <net/rpl.h>
  52
  53 #include <linux/uaccess.h>
  54
  55 /*
  56  *      Parsing tlv encoded headers.
  57  *
  58  *      Parsing function "func" returns true, if parsing succeed
  59  *      and false, if it failed.
  60  *      It MUST NOT touch skb->h.
  61  */
  62
  63 struct tlvtype_proc {
  64         int     type;
  65         bool    (*func)(struct sk_buff *skb, int offset);
  66 };
  67
  68 /*********************
  69   Generic functions
  70  *********************/
  71
  72 /* An unknown option is detected, decide what to do */
  73
  74 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff,
  75                                bool disallow_unknowns)
  76 {
  77         if (disallow_unknowns) {
  78                 /* If unknown TLVs are disallowed by configuration
  79                  * then always silently drop packet. Note this also
  80                  * means no ICMP parameter problem is sent which
  81                  * could be a good property to mitigate a reflection DOS
  82                  * attack.
  83                  */
  84
  85                 goto drop;
  86         }
  87
  88         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  89         case 0: /* ignore */
  90                 return true;
  91
  92         case 1: /* drop packet */
  93                 break;
  94
  95         case 3: /* Send ICMP if not a multicast address and drop packet */
  96                 /* Actually, it is redundant check. icmp_send
  97                    will recheck in any case.
  98                  */
  99                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
 100                         break;
 101                 fallthrough;
 102         case 2: /* send ICMP PARM PROB regardless and drop packet */
 103                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
 104                 return false;
 105         }
 106
 107 drop:
 108         kfree_skb(skb);
 109         return false;
 110 }
 111
 112 /* Parse tlv encoded option header (hop-by-hop or destination) */
 113
 114 static bool ip6_parse_tlv(const struct tlvtype_proc *procs,
 115                           struct sk_buff *skb,
 116                           int max_count)
 117 {
 118         int len = (skb_transport_header(skb)[1] + 1) << 3;
 119         const unsigned char *nh = skb_network_header(skb);
 120         int off = skb_network_header_len(skb);
 121         const struct tlvtype_proc *curr;
 122         bool disallow_unknowns = false;
 123         int tlv_count = 0;
 124         int padlen = 0;
 125
 126         if (unlikely(max_count < 0)) {
 127                 disallow_unknowns = true;
 128                 max_count = -max_count;
 129         }
 130
 131         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 132                 goto bad;
 133
 134         off += 2;
 135         len -= 2;
 136
 137         while (len > 0) {
 138                 int optlen, i;
 139
 140                 if (nh[off] == IPV6_TLV_PAD1) {
 141                         padlen++;
 142                         if (padlen > 7)
 143                                 goto bad;
 144                         off++;
 145                         len--;
 146                         continue;
 147                 }
 148                 if (len < 2)
 149                         goto bad;
 150                 optlen = nh[off + 1] + 2;
 151                 if (optlen > len)
 152                         goto bad;
 153
 154                 if (nh[off] == IPV6_TLV_PADN) {
 155                         /* RFC 2460 states that the purpose of PadN is
 156                          * to align the containing header to multiples
 157                          * of 8. 7 is therefore the highest valid value.
 158                          * See also RFC 4942, Section 2.1.9.5.
 159                          */
 160                         padlen += optlen;
 161                         if (padlen > 7)
 162                                 goto bad;
 163                         /* RFC 4942 recommends receiving hosts to
 164                          * actively check PadN payload to contain
 165                          * only zeroes.
 166                          */
 167                         for (i = 2; i < optlen; i++) {
 168                                 if (nh[off + i] != 0)
 169                                         goto bad;
 170                         }
 171                 } else {
 172                         tlv_count++;
 173                         if (tlv_count > max_count)
 174                                 goto bad;
 175
 176                         for (curr = procs; curr->type >= 0; curr++) {
 177                                 if (curr->type == nh[off]) {
 178                                         /* type specific length/alignment
 179                                            checks will be performed in the
 180                                            func(). */
 181                                         if (curr->func(skb, off) == false)
 182                                                 return false;
 183                                         break;
 184                                 }
 185                         }
 186                         if (curr->type < 0 &&
 187                             !ip6_tlvopt_unknown(skb, off, disallow_unknowns))
 188                                 return false;
 189
 190                         padlen = 0;
 191                 }
 192                 off += optlen;
 193                 len -= optlen;
 194         }
 195
 196         if (len == 0)
 197                 return true;
 198 bad:
 199         kfree_skb(skb);
 200         return false;
 201 }
 202
 203 /*****************************
 204   Destination options header.
 205  *****************************/
 206
 207 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 208 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 209 {
 210         struct ipv6_destopt_hao *hao;
 211         struct inet6_skb_parm *opt = IP6CB(skb);
 212         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 213         int ret;
 214
 215         if (opt->dsthao) {
 216                 net_dbg_ratelimited("hao duplicated\n");
 217                 goto discard;
 218         }
 219         opt->dsthao = opt->dst1;
 220         opt->dst1 = 0;
 221
 222         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 223
 224         if (hao->length != 16) {
 225                 net_dbg_ratelimited("hao invalid option length = %d\n",
 226                                     hao->length);
 227                 goto discard;
 228         }
 229
 230         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 231                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 232                                     &hao->addr);
 233                 goto discard;
 234         }
 235
 236         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 237                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 238         if (unlikely(ret < 0))
 239                 goto discard;
 240
 241         if (skb_cloned(skb)) {
 242                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 243                         goto discard;
 244
 245                 /* update all variable using below by copied skbuff */
 246                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 247                                                   optoff);
 248                 ipv6h = ipv6_hdr(skb);
 249         }
 250
 251         if (skb->ip_summed == CHECKSUM_COMPLETE)
 252                 skb->ip_summed = CHECKSUM_NONE;
 253
 254         swap(ipv6h->saddr, hao->addr);
 255
 256         if (skb->tstamp == 0)
 257                 __net_timestamp(skb);
 258
 259         return true;
 260
 261  discard:
 262         kfree_skb(skb);
 263         return false;
 264 }
 265 #endif
 266
 267 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 268 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 269         {
 270                 .type   = IPV6_TLV_HAO,
 271                 .func   = ipv6_dest_hao,
 272         },
 273 #endif
 274         {-1,                    NULL}
 275 };
 276
 277 static int ipv6_destopt_rcv(struct sk_buff *skb)
 278 {
 279         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 280         struct inet6_skb_parm *opt = IP6CB(skb);
 281 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 282         __u16 dstbuf;
 283 #endif
 284         struct dst_entry *dst = skb_dst(skb);
 285         struct net *net = dev_net(skb->dev);
 286         int extlen;
 287
 288         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 289             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 290                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 291                 __IP6_INC_STATS(dev_net(dst->dev), idev,
 292                                 IPSTATS_MIB_INHDRERRORS);
 293 fail_and_free:
 294                 kfree_skb(skb);
 295                 return -1;
 296         }
 297
 298         extlen = (skb_transport_header(skb)[1] + 1) << 3;
 299         if (extlen > net->ipv6.sysctl.max_dst_opts_len)
 300                 goto fail_and_free;
 301
 302         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 303 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 304         dstbuf = opt->dst1;
 305 #endif
 306
 307         if (ip6_parse_tlv(tlvprocdestopt_lst, skb,
 308                           net->ipv6.sysctl.max_dst_opts_cnt)) {
 309                 skb->transport_header += extlen;
 310                 opt = IP6CB(skb);
 311 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 312                 opt->nhoff = dstbuf;
 313 #else
 314                 opt->nhoff = opt->dst1;
 315 #endif
 316                 return 1;
 317         }
 318
 319         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 320         return -1;
 321 }
 322
 323 static void seg6_update_csum(struct sk_buff *skb)
 324 {
 325         struct ipv6_sr_hdr *hdr;
 326         struct in6_addr *addr;
 327         __be32 from, to;
 328
 329         /* srh is at transport offset and seg_left is already decremented
 330          * but daddr is not yet updated with next segment
 331          */
 332
 333         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 334         addr = hdr->segments + hdr->segments_left;
 335
 336         hdr->segments_left++;
 337         from = *(__be32 *)hdr;
 338
 339         hdr->segments_left--;
 340         to = *(__be32 *)hdr;
 341
 342         /* update skb csum with diff resulting from seg_left decrement */
 343
 344         update_csum_diff4(skb, from, to);
 345
 346         /* compute csum diff between current and next segment and update */
 347
 348         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 349                            (__be32 *)addr);
 350 }
 351
 352 static int ipv6_srh_rcv(struct sk_buff *skb)
 353 {
 354         struct inet6_skb_parm *opt = IP6CB(skb);
 355         struct net *net = dev_net(skb->dev);
 356         struct ipv6_sr_hdr *hdr;
 357         struct inet6_dev *idev;
 358         struct in6_addr *addr;
 359         int accept_seg6;
 360
 361         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 362
 363         idev = __in6_dev_get(skb->dev);
 364
 365         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 366         if (accept_seg6 > idev->cnf.seg6_enabled)
 367                 accept_seg6 = idev->cnf.seg6_enabled;
 368
 369         if (!accept_seg6) {
 370                 kfree_skb(skb);
 371                 return -1;
 372         }
 373
 374 #ifdef CONFIG_IPV6_SEG6_HMAC
 375         if (!seg6_hmac_validate_skb(skb)) {
 376                 kfree_skb(skb);
 377                 return -1;
 378         }
 379 #endif
 380
 381 looped_back:
 382         if (hdr->segments_left == 0) {
 383                 if (hdr->nexthdr == NEXTHDR_IPV6 || hdr->nexthdr == NEXTHDR_IPV4) {
 384                         int offset = (hdr->hdrlen + 1) << 3;
 385
 386                         skb_postpull_rcsum(skb, skb_network_header(skb),
 387                                            skb_network_header_len(skb));
 388
 389                         if (!pskb_pull(skb, offset)) {
 390                                 kfree_skb(skb);
 391                                 return -1;
 392                         }
 393                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 394                                            offset);
 395
 396                         skb_reset_network_header(skb);
 397                         skb_reset_transport_header(skb);
 398                         skb->encapsulation = 0;
 399                         if (hdr->nexthdr == NEXTHDR_IPV4)
 400                                 skb->protocol = htons(ETH_P_IP);
 401                         __skb_tunnel_rx(skb, skb->dev, net);
 402
 403                         netif_rx(skb);
 404                         return -1;
 405                 }
 406
 407                 opt->srcrt = skb_network_header_len(skb);
 408                 opt->lastopt = opt->srcrt;
 409                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 410                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 411
 412                 return 1;
 413         }
 414
 415         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 416                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 417                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 418                                   ((&hdr->segments_left) -
 419                                    skb_network_header(skb)));
 420                 return -1;
 421         }
 422
 423         if (skb_cloned(skb)) {
 424                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 425                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 426                                         IPSTATS_MIB_OUTDISCARDS);
 427                         kfree_skb(skb);
 428                         return -1;
 429                 }
 430         }
 431
 432         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 433
 434         hdr->segments_left--;
 435         addr = hdr->segments + hdr->segments_left;
 436
 437         skb_push(skb, sizeof(struct ipv6hdr));
 438
 439         if (skb->ip_summed == CHECKSUM_COMPLETE)
 440                 seg6_update_csum(skb);
 441
 442         ipv6_hdr(skb)->daddr = *addr;
 443
 444         skb_dst_drop(skb);
 445
 446         ip6_route_input(skb);
 447
 448         if (skb_dst(skb)->error) {
 449                 dst_input(skb);
 450                 return -1;
 451         }
 452
 453         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 454                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 455                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 456                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 457                                     ICMPV6_EXC_HOPLIMIT, 0);
 458                         kfree_skb(skb);
 459                         return -1;
 460                 }
 461                 ipv6_hdr(skb)->hop_limit--;
 462
 463                 skb_pull(skb, sizeof(struct ipv6hdr));
 464                 goto looped_back;
 465         }
 466
 467         dst_input(skb);
 468
 469         return -1;
 470 }
 471
 472 static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 473 {
 474         struct ipv6_rpl_sr_hdr *hdr, *ohdr, *chdr;
 475         struct inet6_skb_parm *opt = IP6CB(skb);
 476         struct net *net = dev_net(skb->dev);
 477         struct inet6_dev *idev;
 478         struct ipv6hdr *oldhdr;
 479         struct in6_addr addr;
 480         unsigned char *buf;
 481         int accept_rpl_seg;
 482         int i, err;
 483         u64 n = 0;
 484         u32 r;
 485
 486         idev = __in6_dev_get(skb->dev);
 487
 488         accept_rpl_seg = net->ipv6.devconf_all->rpl_seg_enabled;
 489         if (accept_rpl_seg > idev->cnf.rpl_seg_enabled)
 490                 accept_rpl_seg = idev->cnf.rpl_seg_enabled;
 491
 492         if (!accept_rpl_seg) {
 493                 kfree_skb(skb);
 494                 return -1;
 495         }
 496
 497 looped_back:
 498         hdr = (struct ipv6_rpl_sr_hdr *)skb_transport_header(skb);
 499
 500         if (hdr->segments_left == 0) {
 501                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 502                         int offset = (hdr->hdrlen + 1) << 3;
 503
 504                         skb_postpull_rcsum(skb, skb_network_header(skb),
 505                                            skb_network_header_len(skb));
 506
 507                         if (!pskb_pull(skb, offset)) {
 508                                 kfree_skb(skb);
 509                                 return -1;
 510                         }
 511                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 512                                            offset);
 513
 514                         skb_reset_network_header(skb);
 515                         skb_reset_transport_header(skb);
 516                         skb->encapsulation = 0;
 517
 518                         __skb_tunnel_rx(skb, skb->dev, net);
 519
 520                         netif_rx(skb);
 521                         return -1;
 522                 }
 523
 524                 opt->srcrt = skb_network_header_len(skb);
 525                 opt->lastopt = opt->srcrt;
 526                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 527                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 528
 529                 return 1;
 530         }
 531
 532         if (!pskb_may_pull(skb, sizeof(*hdr))) {
 533                 kfree_skb(skb);
 534                 return -1;
 535         }
 536
 537         n = (hdr->hdrlen << 3) - hdr->pad - (16 - hdr->cmpre);
 538         r = do_div(n, (16 - hdr->cmpri));
 539         /* checks if calculation was without remainder and n fits into
 540          * unsigned char which is segments_left field. Should not be
 541          * higher than that.
 542          */
 543         if (r || (n + 1) > 255) {
 544                 kfree_skb(skb);
 545                 return -1;
 546         }
 547
 548         if (hdr->segments_left > n + 1) {
 549                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 550                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 551                                   ((&hdr->segments_left) -
 552                                    skb_network_header(skb)));
 553                 return -1;
 554         }
 555
 556         if (skb_cloned(skb)) {
 557                 if (pskb_expand_head(skb, IPV6_RPL_SRH_WORST_SWAP_SIZE, 0,
 558                                      GFP_ATOMIC)) {
 559                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 560                                         IPSTATS_MIB_OUTDISCARDS);
 561                         kfree_skb(skb);
 562                         return -1;
 563                 }
 564         } else {
 565                 err = skb_cow_head(skb, IPV6_RPL_SRH_WORST_SWAP_SIZE);
 566                 if (unlikely(err)) {
 567                         kfree_skb(skb);
 568                         return -1;
 569                 }
 570         }
 571
 572         hdr = (struct ipv6_rpl_sr_hdr *)skb_transport_header(skb);
 573
 574         if (!pskb_may_pull(skb, ipv6_rpl_srh_size(n, hdr->cmpri,
 575                                                   hdr->cmpre))) {
 576                 kfree_skb(skb);
 577                 return -1;
 578         }
 579
 580         hdr->segments_left--;
 581         i = n - hdr->segments_left;
 582
 583         buf = kcalloc(struct_size(hdr, segments.addr, n + 2), 2, GFP_ATOMIC);
 584         if (unlikely(!buf)) {
 585                 kfree_skb(skb);
 586                 return -1;
 587         }
 588
 589         ohdr = (struct ipv6_rpl_sr_hdr *)buf;
 590         ipv6_rpl_srh_decompress(ohdr, hdr, &ipv6_hdr(skb)->daddr, n);
 591         chdr = (struct ipv6_rpl_sr_hdr *)(buf + ((ohdr->hdrlen + 1) << 3));
 592
 593         if ((ipv6_addr_type(&ipv6_hdr(skb)->daddr) & IPV6_ADDR_MULTICAST) ||
 594             (ipv6_addr_type(&ohdr->rpl_segaddr[i]) & IPV6_ADDR_MULTICAST)) {
 595                 kfree_skb(skb);
 596                 kfree(buf);
 597                 return -1;
 598         }
 599
 600         err = ipv6_chk_rpl_srh_loop(net, ohdr->rpl_segaddr, n + 1);
 601         if (err) {
 602                 icmpv6_send(skb, ICMPV6_PARAMPROB, 0, 0);
 603                 kfree_skb(skb);
 604                 kfree(buf);
 605                 return -1;
 606         }
 607
 608         addr = ipv6_hdr(skb)->daddr;
 609         ipv6_hdr(skb)->daddr = ohdr->rpl_segaddr[i];
 610         ohdr->rpl_segaddr[i] = addr;
 611
 612         ipv6_rpl_srh_compress(chdr, ohdr, &ipv6_hdr(skb)->daddr, n);
 613
 614         oldhdr = ipv6_hdr(skb);
 615
 616         skb_pull(skb, ((hdr->hdrlen + 1) << 3));
 617         skb_postpull_rcsum(skb, oldhdr,
 618                            sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3));
 619         skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr));
 620         skb_reset_network_header(skb);
 621         skb_mac_header_rebuild(skb);
 622         skb_set_transport_header(skb, sizeof(struct ipv6hdr));
 623
 624         memmove(ipv6_hdr(skb), oldhdr, sizeof(struct ipv6hdr));
 625         memcpy(skb_transport_header(skb), chdr, (chdr->hdrlen + 1) << 3);
 626
 627         ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 628         skb_postpush_rcsum(skb, ipv6_hdr(skb),
 629                            sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3));
 630
 631         kfree(buf);
 632
 633         skb_dst_drop(skb);
 634
 635         ip6_route_input(skb);
 636
 637         if (skb_dst(skb)->error) {
 638                 dst_input(skb);
 639                 return -1;
 640         }
 641
 642         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 643                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 644                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 645                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 646                                     ICMPV6_EXC_HOPLIMIT, 0);
 647                         kfree_skb(skb);
 648                         return -1;
 649                 }
 650                 ipv6_hdr(skb)->hop_limit--;
 651
 652                 skb_pull(skb, sizeof(struct ipv6hdr));
 653                 goto looped_back;
 654         }
 655
 656         dst_input(skb);
 657
 658         return -1;
 659 }
 660
 661 /********************************
 662   Routing header.
 663  ********************************/
 664
 665 /* called with rcu_read_lock() */
 666 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 667 {
 668         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 669         struct inet6_skb_parm *opt = IP6CB(skb);
 670         struct in6_addr *addr = NULL;
 671         struct in6_addr daddr;
 672         int n, i;
 673         struct ipv6_rt_hdr *hdr;
 674         struct rt0_hdr *rthdr;
 675         struct net *net = dev_net(skb->dev);
 676         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 677
 678         idev = __in6_dev_get(skb->dev);
 679         if (idev && accept_source_route > idev->cnf.accept_source_route)
 680                 accept_source_route = idev->cnf.accept_source_route;
 681
 682         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 683             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 684                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 685                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 686                 kfree_skb(skb);
 687                 return -1;
 688         }
 689
 690         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 691
 692         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 693             skb->pkt_type != PACKET_HOST) {
 694                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 695                 kfree_skb(skb);
 696                 return -1;
 697         }
 698
 699         switch (hdr->type) {
 700         case IPV6_SRCRT_TYPE_4:
 701                 /* segment routing */
 702                 return ipv6_srh_rcv(skb);
 703         case IPV6_SRCRT_TYPE_3:
 704                 /* rpl segment routing */
 705                 return ipv6_rpl_srh_rcv(skb);
 706         default:
 707                 break;
 708         }
 709
 710 looped_back:
 711         if (hdr->segments_left == 0) {
 712                 switch (hdr->type) {
 713 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 714                 case IPV6_SRCRT_TYPE_2:
 715                         /* Silently discard type 2 header unless it was
 716                          * processed by own
 717                          */
 718                         if (!addr) {
 719                                 __IP6_INC_STATS(net, idev,
 720                                                 IPSTATS_MIB_INADDRERRORS);
 721                                 kfree_skb(skb);
 722                                 return -1;
 723                         }
 724                         break;
 725 #endif
 726                 default:
 727                         break;
 728                 }
 729
 730                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 731                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 732                 opt->dst0 = opt->dst1;
 733                 opt->dst1 = 0;
 734                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 735                 return 1;
 736         }
 737
 738         switch (hdr->type) {
 739 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 740         case IPV6_SRCRT_TYPE_2:
 741                 if (accept_source_route < 0)
 742                         goto unknown_rh;
 743                 /* Silently discard invalid RTH type 2 */
 744                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 745                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 746                         kfree_skb(skb);
 747                         return -1;
 748                 }
 749                 break;
 750 #endif
 751         default:
 752                 goto unknown_rh;
 753         }
 754
 755         /*
 756          *      This is the routing header forwarding algorithm from
 757          *      RFC 2460, page 16.
 758          */
 759
 760         n = hdr->hdrlen >> 1;
 761
 762         if (hdr->segments_left > n) {
 763                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 764                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 765                                   ((&hdr->segments_left) -
 766                                    skb_network_header(skb)));
 767                 return -1;
 768         }
 769
 770         /* We are about to mangle packet header. Be careful!
 771            Do not damage packets queued somewhere.
 772          */
 773         if (skb_cloned(skb)) {
 774                 /* the copy is a forwarded packet */
 775                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 776                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 777                                         IPSTATS_MIB_OUTDISCARDS);
 778                         kfree_skb(skb);
 779                         return -1;
 780                 }
 781                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 782         }
 783
 784         if (skb->ip_summed == CHECKSUM_COMPLETE)
 785                 skb->ip_summed = CHECKSUM_NONE;
 786
 787         i = n - --hdr->segments_left;
 788
 789         rthdr = (struct rt0_hdr *) hdr;
 790         addr = rthdr->addr;
 791         addr += i - 1;
 792
 793         switch (hdr->type) {
 794 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 795         case IPV6_SRCRT_TYPE_2:
 796                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 797                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 798                                      IPPROTO_ROUTING) < 0) {
 799                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 800                         kfree_skb(skb);
 801                         return -1;
 802                 }
 803                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 804                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 805                         kfree_skb(skb);
 806                         return -1;
 807                 }
 808                 break;
 809 #endif
 810         default:
 811                 break;
 812         }
 813
 814         if (ipv6_addr_is_multicast(addr)) {
 815                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 816                 kfree_skb(skb);
 817                 return -1;
 818         }
 819
 820         daddr = *addr;
 821         *addr = ipv6_hdr(skb)->daddr;
 822         ipv6_hdr(skb)->daddr = daddr;
 823
 824         skb_dst_drop(skb);
 825         ip6_route_input(skb);
 826         if (skb_dst(skb)->error) {
 827                 skb_push(skb, skb->data - skb_network_header(skb));
 828                 dst_input(skb);
 829                 return -1;
 830         }
 831
 832         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 833                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 834                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 835                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 836                                     0);
 837                         kfree_skb(skb);
 838                         return -1;
 839                 }
 840                 ipv6_hdr(skb)->hop_limit--;
 841                 goto looped_back;
 842         }
 843
 844         skb_push(skb, skb->data - skb_network_header(skb));
 845         dst_input(skb);
 846         return -1;
 847
 848 unknown_rh:
 849         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 850         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 851                           (&hdr->type) - skb_network_header(skb));
 852         return -1;
 853 }
 854
 855 static const struct inet6_protocol rthdr_protocol = {
 856         .handler        =       ipv6_rthdr_rcv,
 857         .flags          =       INET6_PROTO_NOPOLICY,
 858 };
 859
 860 static const struct inet6_protocol destopt_protocol = {
 861         .handler        =       ipv6_destopt_rcv,
 862         .flags          =       INET6_PROTO_NOPOLICY,
 863 };
 864
 865 static const struct inet6_protocol nodata_protocol = {
 866         .handler        =       dst_discard,
 867         .flags          =       INET6_PROTO_NOPOLICY,
 868 };
 869
 870 int __init ipv6_exthdrs_init(void)
 871 {
 872         int ret;
 873
 874         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 875         if (ret)
 876                 goto out;
 877
 878         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 879         if (ret)
 880                 goto out_rthdr;
 881
 882         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 883         if (ret)
 884                 goto out_destopt;
 885
 886 out:
 887         return ret;
 888 out_destopt:
 889         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 890 out_rthdr:
 891         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 892         goto out;
 893 };
 894
 895 void ipv6_exthdrs_exit(void)
 896 {
 897         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 898         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 899         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 900 }
 901
 902 /**********************************
 903   Hop-by-hop options.
 904  **********************************/
 905
 906 /*
 907  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 908  */
 909 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 910 {
 911         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 912 }
 913
 914 /* Router Alert as of RFC 2711 */
 915
 916 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 917 {
 918         const unsigned char *nh = skb_network_header(skb);
 919
 920         if (nh[optoff + 1] == 2) {
 921                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 922                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 923                 return true;
 924         }
 925         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 926                             nh[optoff + 1]);
 927         kfree_skb(skb);
 928         return false;
 929 }
 930
 931 /* Jumbo payload */
 932
 933 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 934 {
 935         const unsigned char *nh = skb_network_header(skb);
 936         struct inet6_dev *idev = __in6_dev_get_safely(skb->dev);
 937         struct net *net = ipv6_skb_net(skb);
 938         u32 pkt_len;
 939
 940         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 941                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 942                                     nh[optoff+1]);
 943                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 944                 goto drop;
 945         }
 946
 947         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 948         if (pkt_len <= IPV6_MAXPLEN) {
 949                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 950                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 951                 return false;
 952         }
 953         if (ipv6_hdr(skb)->payload_len) {
 954                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 955                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 956                 return false;
 957         }
 958
 959         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 960                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 961                 goto drop;
 962         }
 963
 964         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 965                 goto drop;
 966
 967         IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
 968         return true;
 969
 970 drop:
 971         kfree_skb(skb);
 972         return false;
 973 }
 974
 975 /* CALIPSO RFC 5570 */
 976
 977 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 978 {
 979         const unsigned char *nh = skb_network_header(skb);
 980
 981         if (nh[optoff + 1] < 8)
 982                 goto drop;
 983
 984         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 985                 goto drop;
 986
 987         if (!calipso_validate(skb, nh + optoff))
 988                 goto drop;
 989
 990         return true;
 991
 992 drop:
 993         kfree_skb(skb);
 994         return false;
 995 }
 996
 997 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 998         {
 999                 .type   = IPV6_TLV_ROUTERALERT,
1000                 .func   = ipv6_hop_ra,
1001         },
1002         {
1003                 .type   = IPV6_TLV_JUMBO,
1004                 .func   = ipv6_hop_jumbo,
1005         },
1006         {
1007                 .type   = IPV6_TLV_CALIPSO,
1008                 .func   = ipv6_hop_calipso,
1009         },
1010         { -1, }
1011 };
1012
1013 int ipv6_parse_hopopts(struct sk_buff *skb)
1014 {
1015         struct inet6_skb_parm *opt = IP6CB(skb);
1016         struct net *net = dev_net(skb->dev);
1017         int extlen;
1018
1019         /*
1020          * skb_network_header(skb) is equal to skb->data, and
1021          * skb_network_header_len(skb) is always equal to
1022          * sizeof(struct ipv6hdr) by definition of
1023          * hop-by-hop options.
1024          */
1025         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
1026             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
1027                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
1028 fail_and_free:
1029                 kfree_skb(skb);
1030                 return -1;
1031         }
1032
1033         extlen = (skb_transport_header(skb)[1] + 1) << 3;
1034         if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
1035                 goto fail_and_free;
1036
1037         opt->flags |= IP6SKB_HOPBYHOP;
1038         if (ip6_parse_tlv(tlvprochopopt_lst, skb,
1039                           net->ipv6.sysctl.max_hbh_opts_cnt)) {
1040                 skb->transport_header += extlen;
1041                 opt = IP6CB(skb);
1042                 opt->nhoff = sizeof(struct ipv6hdr);
1043                 return 1;
1044         }
1045         return -1;
1046 }
1047
1048 /*
1049  *      Creating outbound headers.
1050  *
1051  *      "build" functions work when skb is filled from head to tail (datagram)
1052  *      "push"  functions work when headers are added from tail to head (tcp)
1053  *
1054  *      In both cases we assume, that caller reserved enough room
1055  *      for headers.
1056  */
1057
1058 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
1059                              struct ipv6_rt_hdr *opt,
1060                              struct in6_addr **addr_p, struct in6_addr *saddr)
1061 {
1062         struct rt0_hdr *phdr, *ihdr;
1063         int hops;
1064
1065         ihdr = (struct rt0_hdr *) opt;
1066
1067         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
1068         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
1069
1070         hops = ihdr->rt_hdr.hdrlen >> 1;
1071
1072         if (hops > 1)
1073                 memcpy(phdr->addr, ihdr->addr + 1,
1074                        (hops - 1) * sizeof(struct in6_addr));
1075
1076         phdr->addr[hops - 1] = **addr_p;
1077         *addr_p = ihdr->addr;
1078
1079         phdr->rt_hdr.nexthdr = *proto;
1080         *proto = NEXTHDR_ROUTING;
1081 }
1082
1083 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
1084                              struct ipv6_rt_hdr *opt,
1085                              struct in6_addr **addr_p, struct in6_addr *saddr)
1086 {
1087         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
1088         int plen, hops;
1089
1090         sr_ihdr = (struct ipv6_sr_hdr *)opt;
1091         plen = (sr_ihdr->hdrlen + 1) << 3;
1092
1093         sr_phdr = skb_push(skb, plen);
1094         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
1095
1096         hops = sr_ihdr->first_segment + 1;
1097         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
1098                (hops - 1) * sizeof(struct in6_addr));
1099
1100         sr_phdr->segments[0] = **addr_p;
1101         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
1102
1103         if (sr_ihdr->hdrlen > hops * 2) {
1104                 int tlvs_offset, tlvs_length;
1105
1106                 tlvs_offset = (1 + hops * 2) << 3;
1107                 tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
1108                 memcpy((char *)sr_phdr + tlvs_offset,
1109                        (char *)sr_ihdr + tlvs_offset, tlvs_length);
1110         }
1111
1112 #ifdef CONFIG_IPV6_SEG6_HMAC
1113         if (sr_has_hmac(sr_phdr)) {
1114                 struct net *net = NULL;
1115
1116                 if (skb->dev)
1117                         net = dev_net(skb->dev);
1118                 else if (skb->sk)
1119                         net = sock_net(skb->sk);
1120
1121                 WARN_ON(!net);
1122
1123                 if (net)
1124                         seg6_push_hmac(net, saddr, sr_phdr);
1125         }
1126 #endif
1127
1128         sr_phdr->nexthdr = *proto;
1129         *proto = NEXTHDR_ROUTING;
1130 }
1131
1132 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
1133                             struct ipv6_rt_hdr *opt,
1134                             struct in6_addr **addr_p, struct in6_addr *saddr)
1135 {
1136         switch (opt->type) {
1137         case IPV6_SRCRT_TYPE_0:
1138         case IPV6_SRCRT_STRICT:
1139         case IPV6_SRCRT_TYPE_2:
1140                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
1141                 break;
1142         case IPV6_SRCRT_TYPE_4:
1143                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
1144                 break;
1145         default:
1146                 break;
1147         }
1148 }
1149
1150 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
1151 {
1152         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
1153
1154         memcpy(h, opt, ipv6_optlen(opt));
1155         h->nexthdr = *proto;
1156         *proto = type;
1157 }
1158
1159 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
1160                           u8 *proto,
1161                           struct in6_addr **daddr, struct in6_addr *saddr)
1162 {
1163         if (opt->srcrt) {
1164                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
1165                 /*
1166                  * IPV6_RTHDRDSTOPTS is ignored
1167                  * unless IPV6_RTHDR is set (RFC3542).
1168                  */
1169                 if (opt->dst0opt)
1170                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
1171         }
1172         if (opt->hopopt)
1173                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
1174 }
1175
1176 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
1177 {
1178         if (opt->dst1opt)
1179                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
1180 }
1181 EXPORT_SYMBOL(ipv6_push_frag_opts);
1182
1183 struct ipv6_txoptions *
1184 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
1185 {
1186         struct ipv6_txoptions *opt2;
1187
1188         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
1189         if (opt2) {
1190                 long dif = (char *)opt2 - (char *)opt;
1191                 memcpy(opt2, opt, opt->tot_len);
1192                 if (opt2->hopopt)
1193                         *((char **)&opt2->hopopt) += dif;
1194                 if (opt2->dst0opt)
1195                         *((char **)&opt2->dst0opt) += dif;
1196                 if (opt2->dst1opt)
1197                         *((char **)&opt2->dst1opt) += dif;
1198                 if (opt2->srcrt)
1199                         *((char **)&opt2->srcrt) += dif;
1200                 refcount_set(&opt2->refcnt, 1);
1201         }
1202         return opt2;
1203 }
1204 EXPORT_SYMBOL_GPL(ipv6_dup_options);
1205
1206 static void ipv6_renew_option(int renewtype,
1207                               struct ipv6_opt_hdr **dest,
1208                               struct ipv6_opt_hdr *old,
1209                               struct ipv6_opt_hdr *new,
1210                               int newtype, char **p)
1211 {
1212         struct ipv6_opt_hdr *src;
1213
1214         src = (renewtype == newtype ? new : old);
1215         if (!src)
1216                 return;
1217
1218         memcpy(*p, src, ipv6_optlen(src));
1219         *dest = (struct ipv6_opt_hdr *)*p;
1220         *p += CMSG_ALIGN(ipv6_optlen(*dest));
1221 }
1222
1223 /**
1224  * ipv6_renew_options - replace a specific ext hdr with a new one.
1225  *
1226  * @sk: sock from which to allocate memory
1227  * @opt: original options
1228  * @newtype: option type to replace in @opt
1229  * @newopt: new option of type @newtype to replace (user-mem)
1230  *
1231  * Returns a new set of options which is a copy of @opt with the
1232  * option type @newtype replaced with @newopt.
1233  *
1234  * @opt may be NULL, in which case a new set of options is returned
1235  * containing just @newopt.
1236  *
1237  * @newopt may be NULL, in which case the specified option type is
1238  * not copied into the new set of options.
1239  *
1240  * The new set of options is allocated from the socket option memory
1241  * buffer of @sk.
1242  */
1243 struct ipv6_txoptions *
1244 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1245                    int newtype, struct ipv6_opt_hdr *newopt)
1246 {
1247         int tot_len = 0;
1248         char *p;
1249         struct ipv6_txoptions *opt2;
1250
1251         if (opt) {
1252                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1253                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1254                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1255                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1256                 if (newtype != IPV6_RTHDR && opt->srcrt)
1257                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1258                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1259                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1260         }
1261
1262         if (newopt)
1263                 tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
1264
1265         if (!tot_len)
1266                 return NULL;
1267
1268         tot_len += sizeof(*opt2);
1269         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1270         if (!opt2)
1271                 return ERR_PTR(-ENOBUFS);
1272
1273         memset(opt2, 0, tot_len);
1274         refcount_set(&opt2->refcnt, 1);
1275         opt2->tot_len = tot_len;
1276         p = (char *)(opt2 + 1);
1277
1278         ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
1279                           (opt ? opt->hopopt : NULL),
1280                           newopt, newtype, &p);
1281         ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
1282                           (opt ? opt->dst0opt : NULL),
1283                           newopt, newtype, &p);
1284         ipv6_renew_option(IPV6_RTHDR,
1285                           (struct ipv6_opt_hdr **)&opt2->srcrt,
1286                           (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
1287                           newopt, newtype, &p);
1288         ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
1289                           (opt ? opt->dst1opt : NULL),
1290                           newopt, newtype, &p);
1291
1292         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1293                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1294                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1295         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1296
1297         return opt2;
1298 }
1299
1300 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1301                                           struct ipv6_txoptions *opt)
1302 {
1303         /*
1304          * ignore the dest before srcrt unless srcrt is being included.
1305          * --yoshfuji
1306          */
1307         if (opt && opt->dst0opt && !opt->srcrt) {
1308                 if (opt_space != opt) {
1309                         memcpy(opt_space, opt, sizeof(*opt_space));
1310                         opt = opt_space;
1311                 }
1312                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1313                 opt->dst0opt = NULL;
1314         }
1315
1316         return opt;
1317 }
1318 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1319
1320 /**
1321  * fl6_update_dst - update flowi destination address with info given
1322  *                  by srcrt option, if any.
1323  *
1324  * @fl6: flowi6 for which daddr is to be updated
1325  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1326  * @orig: copy of original daddr address if modified
1327  *
1328  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1329  * and initial value of fl6->daddr set in orig
1330  */
1331 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1332                                 const struct ipv6_txoptions *opt,
1333                                 struct in6_addr *orig)
1334 {
1335         if (!opt || !opt->srcrt)
1336                 return NULL;
1337
1338         *orig = fl6->daddr;
1339
1340         switch (opt->srcrt->type) {
1341         case IPV6_SRCRT_TYPE_0:
1342         case IPV6_SRCRT_STRICT:
1343         case IPV6_SRCRT_TYPE_2:
1344                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1345                 break;
1346         case IPV6_SRCRT_TYPE_4:
1347         {
1348                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1349
1350                 fl6->daddr = srh->segments[srh->segments_left];
1351                 break;
1352         }
1353         default:
1354                 return NULL;
1355         }
1356
1357         return orig;
1358 }
1359 EXPORT_SYMBOL_GPL(fl6_update_dst);