net: ipv4: fix RCU races on dst refcounts
[platform/adaptation/renesas_rcar/renesas_kernel.git] / net / decnet / dn_route.c
1 /*
2  * DECnet       An implementation of the DECnet protocol suite for the LINUX
3  *              operating system.  DECnet is implemented using the  BSD Socket
4  *              interface as the means of communication with the user level.
5  *
6  *              DECnet Routing Functions (Endnode and Router)
7  *
8  * Authors:     Steve Whitehouse <SteveW@ACM.org>
9  *              Eduardo Marcelo Serrat <emserrat@geocities.com>
10  *
11  * Changes:
12  *              Steve Whitehouse : Fixes to allow "intra-ethernet" and
13  *                                 "return-to-sender" bits on outgoing
14  *                                 packets.
15  *              Steve Whitehouse : Timeouts for cached routes.
16  *              Steve Whitehouse : Use dst cache for input routes too.
17  *              Steve Whitehouse : Fixed error values in dn_send_skb.
18  *              Steve Whitehouse : Rework routing functions to better fit
19  *                                 DECnet routing design
20  *              Alexey Kuznetsov : New SMP locking
21  *              Steve Whitehouse : More SMP locking changes & dn_cache_dump()
22  *              Steve Whitehouse : Prerouting NF hook, now really is prerouting.
23  *                                 Fixed possible skb leak in rtnetlink funcs.
24  *              Steve Whitehouse : Dave Miller's dynamic hash table sizing and
25  *                                 Alexey Kuznetsov's finer grained locking
26  *                                 from ipv4/route.c.
27  *              Steve Whitehouse : Routing is now starting to look like a
28  *                                 sensible set of code now, mainly due to
29  *                                 my copying the IPv4 routing code. The
30  *                                 hooks here are modified and will continue
31  *                                 to evolve for a while.
32  *              Steve Whitehouse : Real SMP at last :-) Also new netfilter
33  *                                 stuff. Look out raw sockets your days
34  *                                 are numbered!
35  *              Steve Whitehouse : Added return-to-sender functions. Added
36  *                                 backlog congestion level return codes.
37  *              Steve Whitehouse : Fixed bug where routes were set up with
38  *                                 no ref count on net devices.
39  *              Steve Whitehouse : RCU for the route cache
40  *              Steve Whitehouse : Preparations for the flow cache
41  *              Steve Whitehouse : Prepare for nonlinear skbs
42  */
43
44 /******************************************************************************
45     (c) 1995-1998 E.M. Serrat           emserrat@geocities.com
46
47     This program is free software; you can redistribute it and/or modify
48     it under the terms of the GNU General Public License as published by
49     the Free Software Foundation; either version 2 of the License, or
50     any later version.
51
52     This program is distributed in the hope that it will be useful,
53     but WITHOUT ANY WARRANTY; without even the implied warranty of
54     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
55     GNU General Public License for more details.
56 *******************************************************************************/
57
58 #include <linux/errno.h>
59 #include <linux/types.h>
60 #include <linux/socket.h>
61 #include <linux/in.h>
62 #include <linux/kernel.h>
63 #include <linux/sockios.h>
64 #include <linux/net.h>
65 #include <linux/netdevice.h>
66 #include <linux/inet.h>
67 #include <linux/route.h>
68 #include <linux/in_route.h>
69 #include <linux/slab.h>
70 #include <net/sock.h>
71 #include <linux/mm.h>
72 #include <linux/proc_fs.h>
73 #include <linux/seq_file.h>
74 #include <linux/init.h>
75 #include <linux/rtnetlink.h>
76 #include <linux/string.h>
77 #include <linux/netfilter_decnet.h>
78 #include <linux/rcupdate.h>
79 #include <linux/times.h>
80 #include <linux/export.h>
81 #include <asm/errno.h>
82 #include <net/net_namespace.h>
83 #include <net/netlink.h>
84 #include <net/neighbour.h>
85 #include <net/dst.h>
86 #include <net/flow.h>
87 #include <net/fib_rules.h>
88 #include <net/dn.h>
89 #include <net/dn_dev.h>
90 #include <net/dn_nsp.h>
91 #include <net/dn_route.h>
92 #include <net/dn_neigh.h>
93 #include <net/dn_fib.h>
94
95 struct dn_rt_hash_bucket
96 {
97         struct dn_route __rcu *chain;
98         spinlock_t lock;
99 };
100
101 extern struct neigh_table dn_neigh_table;
102
103
104 static unsigned char dn_hiord_addr[6] = {0xAA,0x00,0x04,0x00,0x00,0x00};
105
106 static const int dn_rt_min_delay = 2 * HZ;
107 static const int dn_rt_max_delay = 10 * HZ;
108 static const int dn_rt_mtu_expires = 10 * 60 * HZ;
109
110 static unsigned long dn_rt_deadline;
111
112 static int dn_dst_gc(struct dst_ops *ops);
113 static struct dst_entry *dn_dst_check(struct dst_entry *, __u32);
114 static unsigned int dn_dst_default_advmss(const struct dst_entry *dst);
115 static unsigned int dn_dst_mtu(const struct dst_entry *dst);
116 static void dn_dst_destroy(struct dst_entry *);
117 static void dn_dst_ifdown(struct dst_entry *, struct net_device *dev, int how);
118 static struct dst_entry *dn_dst_negative_advice(struct dst_entry *);
119 static void dn_dst_link_failure(struct sk_buff *);
120 static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
121                                struct sk_buff *skb , u32 mtu);
122 static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk,
123                             struct sk_buff *skb);
124 static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst,
125                                              struct sk_buff *skb,
126                                              const void *daddr);
127 static int dn_route_input(struct sk_buff *);
128 static void dn_run_flush(unsigned long dummy);
129
130 static struct dn_rt_hash_bucket *dn_rt_hash_table;
131 static unsigned int dn_rt_hash_mask;
132
133 static struct timer_list dn_route_timer;
134 static DEFINE_TIMER(dn_rt_flush_timer, dn_run_flush, 0, 0);
135 int decnet_dst_gc_interval = 2;
136
137 static struct dst_ops dn_dst_ops = {
138         .family =               PF_DECnet,
139         .protocol =             cpu_to_be16(ETH_P_DNA_RT),
140         .gc_thresh =            128,
141         .gc =                   dn_dst_gc,
142         .check =                dn_dst_check,
143         .default_advmss =       dn_dst_default_advmss,
144         .mtu =                  dn_dst_mtu,
145         .cow_metrics =          dst_cow_metrics_generic,
146         .destroy =              dn_dst_destroy,
147         .ifdown =               dn_dst_ifdown,
148         .negative_advice =      dn_dst_negative_advice,
149         .link_failure =         dn_dst_link_failure,
150         .update_pmtu =          dn_dst_update_pmtu,
151         .redirect =             dn_dst_redirect,
152         .neigh_lookup =         dn_dst_neigh_lookup,
153 };
154
155 static void dn_dst_destroy(struct dst_entry *dst)
156 {
157         struct dn_route *rt = (struct dn_route *) dst;
158
159         if (rt->n)
160                 neigh_release(rt->n);
161         dst_destroy_metrics_generic(dst);
162 }
163
164 static void dn_dst_ifdown(struct dst_entry *dst, struct net_device *dev, int how)
165 {
166         if (how) {
167                 struct dn_route *rt = (struct dn_route *) dst;
168                 struct neighbour *n = rt->n;
169
170                 if (n && n->dev == dev) {
171                         n->dev = dev_net(dev)->loopback_dev;
172                         dev_hold(n->dev);
173                         dev_put(dev);
174                 }
175         }
176 }
177
178 static __inline__ unsigned int dn_hash(__le16 src, __le16 dst)
179 {
180         __u16 tmp = (__u16 __force)(src ^ dst);
181         tmp ^= (tmp >> 3);
182         tmp ^= (tmp >> 5);
183         tmp ^= (tmp >> 10);
184         return dn_rt_hash_mask & (unsigned int)tmp;
185 }
186
187 static inline void dst_rcu_free(struct rcu_head *head)
188 {
189         struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
190         dst_free(dst);
191 }
192
193 static inline void dnrt_free(struct dn_route *rt)
194 {
195         call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
196 }
197
198 static inline void dnrt_drop(struct dn_route *rt)
199 {
200         dst_release(&rt->dst);
201         call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
202 }
203
204 static void dn_dst_check_expire(unsigned long dummy)
205 {
206         int i;
207         struct dn_route *rt;
208         struct dn_route __rcu **rtp;
209         unsigned long now = jiffies;
210         unsigned long expire = 120 * HZ;
211
212         for (i = 0; i <= dn_rt_hash_mask; i++) {
213                 rtp = &dn_rt_hash_table[i].chain;
214
215                 spin_lock(&dn_rt_hash_table[i].lock);
216                 while ((rt = rcu_dereference_protected(*rtp,
217                                                 lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
218                         if (atomic_read(&rt->dst.__refcnt) ||
219                                         (now - rt->dst.lastuse) < expire) {
220                                 rtp = &rt->dst.dn_next;
221                                 continue;
222                         }
223                         *rtp = rt->dst.dn_next;
224                         rt->dst.dn_next = NULL;
225                         dnrt_free(rt);
226                 }
227                 spin_unlock(&dn_rt_hash_table[i].lock);
228
229                 if ((jiffies - now) > 0)
230                         break;
231         }
232
233         mod_timer(&dn_route_timer, now + decnet_dst_gc_interval * HZ);
234 }
235
236 static int dn_dst_gc(struct dst_ops *ops)
237 {
238         struct dn_route *rt;
239         struct dn_route __rcu **rtp;
240         int i;
241         unsigned long now = jiffies;
242         unsigned long expire = 10 * HZ;
243
244         for (i = 0; i <= dn_rt_hash_mask; i++) {
245
246                 spin_lock_bh(&dn_rt_hash_table[i].lock);
247                 rtp = &dn_rt_hash_table[i].chain;
248
249                 while ((rt = rcu_dereference_protected(*rtp,
250                                                 lockdep_is_held(&dn_rt_hash_table[i].lock))) != NULL) {
251                         if (atomic_read(&rt->dst.__refcnt) ||
252                                         (now - rt->dst.lastuse) < expire) {
253                                 rtp = &rt->dst.dn_next;
254                                 continue;
255                         }
256                         *rtp = rt->dst.dn_next;
257                         rt->dst.dn_next = NULL;
258                         dnrt_drop(rt);
259                         break;
260                 }
261                 spin_unlock_bh(&dn_rt_hash_table[i].lock);
262         }
263
264         return 0;
265 }
266
267 /*
268  * The decnet standards don't impose a particular minimum mtu, what they
269  * do insist on is that the routing layer accepts a datagram of at least
270  * 230 bytes long. Here we have to subtract the routing header length from
271  * 230 to get the minimum acceptable mtu. If there is no neighbour, then we
272  * assume the worst and use a long header size.
273  *
274  * We update both the mtu and the advertised mss (i.e. the segment size we
275  * advertise to the other end).
276  */
277 static void dn_dst_update_pmtu(struct dst_entry *dst, struct sock *sk,
278                                struct sk_buff *skb, u32 mtu)
279 {
280         struct dn_route *rt = (struct dn_route *) dst;
281         struct neighbour *n = rt->n;
282         u32 min_mtu = 230;
283         struct dn_dev *dn;
284
285         dn = n ? rcu_dereference_raw(n->dev->dn_ptr) : NULL;
286
287         if (dn && dn->use_long == 0)
288                 min_mtu -= 6;
289         else
290                 min_mtu -= 21;
291
292         if (dst_metric(dst, RTAX_MTU) > mtu && mtu >= min_mtu) {
293                 if (!(dst_metric_locked(dst, RTAX_MTU))) {
294                         dst_metric_set(dst, RTAX_MTU, mtu);
295                         dst_set_expires(dst, dn_rt_mtu_expires);
296                 }
297                 if (!(dst_metric_locked(dst, RTAX_ADVMSS))) {
298                         u32 mss = mtu - DN_MAX_NSP_DATA_HEADER;
299                         u32 existing_mss = dst_metric_raw(dst, RTAX_ADVMSS);
300                         if (!existing_mss || existing_mss > mss)
301                                 dst_metric_set(dst, RTAX_ADVMSS, mss);
302                 }
303         }
304 }
305
306 static void dn_dst_redirect(struct dst_entry *dst, struct sock *sk,
307                             struct sk_buff *skb)
308 {
309 }
310
311 /*
312  * When a route has been marked obsolete. (e.g. routing cache flush)
313  */
314 static struct dst_entry *dn_dst_check(struct dst_entry *dst, __u32 cookie)
315 {
316         return NULL;
317 }
318
319 static struct dst_entry *dn_dst_negative_advice(struct dst_entry *dst)
320 {
321         dst_release(dst);
322         return NULL;
323 }
324
325 static void dn_dst_link_failure(struct sk_buff *skb)
326 {
327 }
328
329 static inline int compare_keys(struct flowidn *fl1, struct flowidn *fl2)
330 {
331         return ((fl1->daddr ^ fl2->daddr) |
332                 (fl1->saddr ^ fl2->saddr) |
333                 (fl1->flowidn_mark ^ fl2->flowidn_mark) |
334                 (fl1->flowidn_scope ^ fl2->flowidn_scope) |
335                 (fl1->flowidn_oif ^ fl2->flowidn_oif) |
336                 (fl1->flowidn_iif ^ fl2->flowidn_iif)) == 0;
337 }
338
339 static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_route **rp)
340 {
341         struct dn_route *rth;
342         struct dn_route __rcu **rthp;
343         unsigned long now = jiffies;
344
345         rthp = &dn_rt_hash_table[hash].chain;
346
347         spin_lock_bh(&dn_rt_hash_table[hash].lock);
348         while ((rth = rcu_dereference_protected(*rthp,
349                                                 lockdep_is_held(&dn_rt_hash_table[hash].lock))) != NULL) {
350                 if (compare_keys(&rth->fld, &rt->fld)) {
351                         /* Put it first */
352                         *rthp = rth->dst.dn_next;
353                         rcu_assign_pointer(rth->dst.dn_next,
354                                            dn_rt_hash_table[hash].chain);
355                         rcu_assign_pointer(dn_rt_hash_table[hash].chain, rth);
356
357                         dst_use(&rth->dst, now);
358                         spin_unlock_bh(&dn_rt_hash_table[hash].lock);
359
360                         dnrt_drop(rt);
361                         *rp = rth;
362                         return 0;
363                 }
364                 rthp = &rth->dst.dn_next;
365         }
366
367         rcu_assign_pointer(rt->dst.dn_next, dn_rt_hash_table[hash].chain);
368         rcu_assign_pointer(dn_rt_hash_table[hash].chain, rt);
369
370         dst_use(&rt->dst, now);
371         spin_unlock_bh(&dn_rt_hash_table[hash].lock);
372         *rp = rt;
373         return 0;
374 }
375
376 static void dn_run_flush(unsigned long dummy)
377 {
378         int i;
379         struct dn_route *rt, *next;
380
381         for (i = 0; i < dn_rt_hash_mask; i++) {
382                 spin_lock_bh(&dn_rt_hash_table[i].lock);
383
384                 if ((rt = xchg((struct dn_route **)&dn_rt_hash_table[i].chain, NULL)) == NULL)
385                         goto nothing_to_declare;
386
387                 for(; rt; rt = next) {
388                         next = rcu_dereference_raw(rt->dst.dn_next);
389                         RCU_INIT_POINTER(rt->dst.dn_next, NULL);
390                         dst_free((struct dst_entry *)rt);
391                 }
392
393 nothing_to_declare:
394                 spin_unlock_bh(&dn_rt_hash_table[i].lock);
395         }
396 }
397
398 static DEFINE_SPINLOCK(dn_rt_flush_lock);
399
400 void dn_rt_cache_flush(int delay)
401 {
402         unsigned long now = jiffies;
403         int user_mode = !in_interrupt();
404
405         if (delay < 0)
406                 delay = dn_rt_min_delay;
407
408         spin_lock_bh(&dn_rt_flush_lock);
409
410         if (del_timer(&dn_rt_flush_timer) && delay > 0 && dn_rt_deadline) {
411                 long tmo = (long)(dn_rt_deadline - now);
412
413                 if (user_mode && tmo < dn_rt_max_delay - dn_rt_min_delay)
414                         tmo = 0;
415
416                 if (delay > tmo)
417                         delay = tmo;
418         }
419
420         if (delay <= 0) {
421                 spin_unlock_bh(&dn_rt_flush_lock);
422                 dn_run_flush(0);
423                 return;
424         }
425
426         if (dn_rt_deadline == 0)
427                 dn_rt_deadline = now + dn_rt_max_delay;
428
429         dn_rt_flush_timer.expires = now + delay;
430         add_timer(&dn_rt_flush_timer);
431         spin_unlock_bh(&dn_rt_flush_lock);
432 }
433
434 /**
435  * dn_return_short - Return a short packet to its sender
436  * @skb: The packet to return
437  *
438  */
439 static int dn_return_short(struct sk_buff *skb)
440 {
441         struct dn_skb_cb *cb;
442         unsigned char *ptr;
443         __le16 *src;
444         __le16 *dst;
445
446         /* Add back headers */
447         skb_push(skb, skb->data - skb_network_header(skb));
448
449         if ((skb = skb_unshare(skb, GFP_ATOMIC)) == NULL)
450                 return NET_RX_DROP;
451
452         cb = DN_SKB_CB(skb);
453         /* Skip packet length and point to flags */
454         ptr = skb->data + 2;
455         *ptr++ = (cb->rt_flags & ~DN_RT_F_RQR) | DN_RT_F_RTS;
456
457         dst = (__le16 *)ptr;
458         ptr += 2;
459         src = (__le16 *)ptr;
460         ptr += 2;
461         *ptr = 0; /* Zero hop count */
462
463         swap(*src, *dst);
464
465         skb->pkt_type = PACKET_OUTGOING;
466         dn_rt_finish_output(skb, NULL, NULL);
467         return NET_RX_SUCCESS;
468 }
469
470 /**
471  * dn_return_long - Return a long packet to its sender
472  * @skb: The long format packet to return
473  *
474  */
475 static int dn_return_long(struct sk_buff *skb)
476 {
477         struct dn_skb_cb *cb;
478         unsigned char *ptr;
479         unsigned char *src_addr, *dst_addr;
480         unsigned char tmp[ETH_ALEN];
481
482         /* Add back all headers */
483         skb_push(skb, skb->data - skb_network_header(skb));
484
485         if ((skb = skb_unshare(skb, GFP_ATOMIC)) == NULL)
486                 return NET_RX_DROP;
487
488         cb = DN_SKB_CB(skb);
489         /* Ignore packet length and point to flags */
490         ptr = skb->data + 2;
491
492         /* Skip padding */
493         if (*ptr & DN_RT_F_PF) {
494                 char padlen = (*ptr & ~DN_RT_F_PF);
495                 ptr += padlen;
496         }
497
498         *ptr++ = (cb->rt_flags & ~DN_RT_F_RQR) | DN_RT_F_RTS;
499         ptr += 2;
500         dst_addr = ptr;
501         ptr += 8;
502         src_addr = ptr;
503         ptr += 6;
504         *ptr = 0; /* Zero hop count */
505
506         /* Swap source and destination */
507         memcpy(tmp, src_addr, ETH_ALEN);
508         memcpy(src_addr, dst_addr, ETH_ALEN);
509         memcpy(dst_addr, tmp, ETH_ALEN);
510
511         skb->pkt_type = PACKET_OUTGOING;
512         dn_rt_finish_output(skb, dst_addr, src_addr);
513         return NET_RX_SUCCESS;
514 }
515
516 /**
517  * dn_route_rx_packet - Try and find a route for an incoming packet
518  * @skb: The packet to find a route for
519  *
520  * Returns: result of input function if route is found, error code otherwise
521  */
522 static int dn_route_rx_packet(struct sk_buff *skb)
523 {
524         struct dn_skb_cb *cb;
525         int err;
526
527         if ((err = dn_route_input(skb)) == 0)
528                 return dst_input(skb);
529
530         cb = DN_SKB_CB(skb);
531         if (decnet_debug_level & 4) {
532                 char *devname = skb->dev ? skb->dev->name : "???";
533
534                 printk(KERN_DEBUG
535                         "DECnet: dn_route_rx_packet: rt_flags=0x%02x dev=%s len=%d src=0x%04hx dst=0x%04hx err=%d type=%d\n",
536                         (int)cb->rt_flags, devname, skb->len,
537                         le16_to_cpu(cb->src), le16_to_cpu(cb->dst),
538                         err, skb->pkt_type);
539         }
540
541         if ((skb->pkt_type == PACKET_HOST) && (cb->rt_flags & DN_RT_F_RQR)) {
542                 switch (cb->rt_flags & DN_RT_PKT_MSK) {
543                 case DN_RT_PKT_SHORT:
544                         return dn_return_short(skb);
545                 case DN_RT_PKT_LONG:
546                         return dn_return_long(skb);
547                 }
548         }
549
550         kfree_skb(skb);
551         return NET_RX_DROP;
552 }
553
554 static int dn_route_rx_long(struct sk_buff *skb)
555 {
556         struct dn_skb_cb *cb = DN_SKB_CB(skb);
557         unsigned char *ptr = skb->data;
558
559         if (!pskb_may_pull(skb, 21)) /* 20 for long header, 1 for shortest nsp */
560                 goto drop_it;
561
562         skb_pull(skb, 20);
563         skb_reset_transport_header(skb);
564
565         /* Destination info */
566         ptr += 2;
567         cb->dst = dn_eth2dn(ptr);
568         if (memcmp(ptr, dn_hiord_addr, 4) != 0)
569                 goto drop_it;
570         ptr += 6;
571
572
573         /* Source info */
574         ptr += 2;
575         cb->src = dn_eth2dn(ptr);
576         if (memcmp(ptr, dn_hiord_addr, 4) != 0)
577                 goto drop_it;
578         ptr += 6;
579         /* Other junk */
580         ptr++;
581         cb->hops = *ptr++; /* Visit Count */
582
583         return NF_HOOK(NFPROTO_DECNET, NF_DN_PRE_ROUTING, skb, skb->dev, NULL,
584                        dn_route_rx_packet);
585
586 drop_it:
587         kfree_skb(skb);
588         return NET_RX_DROP;
589 }
590
591
592
593 static int dn_route_rx_short(struct sk_buff *skb)
594 {
595         struct dn_skb_cb *cb = DN_SKB_CB(skb);
596         unsigned char *ptr = skb->data;
597
598         if (!pskb_may_pull(skb, 6)) /* 5 for short header + 1 for shortest nsp */
599                 goto drop_it;
600
601         skb_pull(skb, 5);
602         skb_reset_transport_header(skb);
603
604         cb->dst = *(__le16 *)ptr;
605         ptr += 2;
606         cb->src = *(__le16 *)ptr;
607         ptr += 2;
608         cb->hops = *ptr & 0x3f;
609
610         return NF_HOOK(NFPROTO_DECNET, NF_DN_PRE_ROUTING, skb, skb->dev, NULL,
611                        dn_route_rx_packet);
612
613 drop_it:
614         kfree_skb(skb);
615         return NET_RX_DROP;
616 }
617
618 static int dn_route_discard(struct sk_buff *skb)
619 {
620         /*
621          * I know we drop the packet here, but thats considered success in
622          * this case
623          */
624         kfree_skb(skb);
625         return NET_RX_SUCCESS;
626 }
627
628 static int dn_route_ptp_hello(struct sk_buff *skb)
629 {
630         dn_dev_hello(skb);
631         dn_neigh_pointopoint_hello(skb);
632         return NET_RX_SUCCESS;
633 }
634
635 int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
636 {
637         struct dn_skb_cb *cb;
638         unsigned char flags = 0;
639         __u16 len = le16_to_cpu(*(__le16 *)skb->data);
640         struct dn_dev *dn = rcu_dereference(dev->dn_ptr);
641         unsigned char padlen = 0;
642
643         if (!net_eq(dev_net(dev), &init_net))
644                 goto dump_it;
645
646         if (dn == NULL)
647                 goto dump_it;
648
649         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
650                 goto out;
651
652         if (!pskb_may_pull(skb, 3))
653                 goto dump_it;
654
655         skb_pull(skb, 2);
656
657         if (len > skb->len)
658                 goto dump_it;
659
660         skb_trim(skb, len);
661
662         flags = *skb->data;
663
664         cb = DN_SKB_CB(skb);
665         cb->stamp = jiffies;
666         cb->iif = dev->ifindex;
667
668         /*
669          * If we have padding, remove it.
670          */
671         if (flags & DN_RT_F_PF) {
672                 padlen = flags & ~DN_RT_F_PF;
673                 if (!pskb_may_pull(skb, padlen + 1))
674                         goto dump_it;
675                 skb_pull(skb, padlen);
676                 flags = *skb->data;
677         }
678
679         skb_reset_network_header(skb);
680
681         /*
682          * Weed out future version DECnet
683          */
684         if (flags & DN_RT_F_VER)
685                 goto dump_it;
686
687         cb->rt_flags = flags;
688
689         if (decnet_debug_level & 1)
690                 printk(KERN_DEBUG
691                         "dn_route_rcv: got 0x%02x from %s [%d %d %d]\n",
692                         (int)flags, (dev) ? dev->name : "???", len, skb->len,
693                         padlen);
694
695         if (flags & DN_RT_PKT_CNTL) {
696                 if (unlikely(skb_linearize(skb)))
697                         goto dump_it;
698
699                 switch (flags & DN_RT_CNTL_MSK) {
700                 case DN_RT_PKT_INIT:
701                         dn_dev_init_pkt(skb);
702                         break;
703                 case DN_RT_PKT_VERI:
704                         dn_dev_veri_pkt(skb);
705                         break;
706                 }
707
708                 if (dn->parms.state != DN_DEV_S_RU)
709                         goto dump_it;
710
711                 switch (flags & DN_RT_CNTL_MSK) {
712                 case DN_RT_PKT_HELO:
713                         return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
714                                        skb, skb->dev, NULL,
715                                        dn_route_ptp_hello);
716
717                 case DN_RT_PKT_L1RT:
718                 case DN_RT_PKT_L2RT:
719                         return NF_HOOK(NFPROTO_DECNET, NF_DN_ROUTE,
720                                        skb, skb->dev, NULL,
721                                        dn_route_discard);
722                 case DN_RT_PKT_ERTH:
723                         return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
724                                        skb, skb->dev, NULL,
725                                        dn_neigh_router_hello);
726
727                 case DN_RT_PKT_EEDH:
728                         return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
729                                        skb, skb->dev, NULL,
730                                        dn_neigh_endnode_hello);
731                 }
732         } else {
733                 if (dn->parms.state != DN_DEV_S_RU)
734                         goto dump_it;
735
736                 skb_pull(skb, 1); /* Pull flags */
737
738                 switch (flags & DN_RT_PKT_MSK) {
739                 case DN_RT_PKT_LONG:
740                         return dn_route_rx_long(skb);
741                 case DN_RT_PKT_SHORT:
742                         return dn_route_rx_short(skb);
743                 }
744         }
745
746 dump_it:
747         kfree_skb(skb);
748 out:
749         return NET_RX_DROP;
750 }
751
752 static int dn_to_neigh_output(struct sk_buff *skb)
753 {
754         struct dst_entry *dst = skb_dst(skb);
755         struct dn_route *rt = (struct dn_route *) dst;
756         struct neighbour *n = rt->n;
757
758         return n->output(n, skb);
759 }
760
761 static int dn_output(struct sk_buff *skb)
762 {
763         struct dst_entry *dst = skb_dst(skb);
764         struct dn_route *rt = (struct dn_route *)dst;
765         struct net_device *dev = dst->dev;
766         struct dn_skb_cb *cb = DN_SKB_CB(skb);
767
768         int err = -EINVAL;
769
770         if (rt->n == NULL)
771                 goto error;
772
773         skb->dev = dev;
774
775         cb->src = rt->rt_saddr;
776         cb->dst = rt->rt_daddr;
777
778         /*
779          * Always set the Intra-Ethernet bit on all outgoing packets
780          * originated on this node. Only valid flag from upper layers
781          * is return-to-sender-requested. Set hop count to 0 too.
782          */
783         cb->rt_flags &= ~DN_RT_F_RQR;
784         cb->rt_flags |= DN_RT_F_IE;
785         cb->hops = 0;
786
787         return NF_HOOK(NFPROTO_DECNET, NF_DN_LOCAL_OUT, skb, NULL, dev,
788                        dn_to_neigh_output);
789
790 error:
791         net_dbg_ratelimited("dn_output: This should not happen\n");
792
793         kfree_skb(skb);
794
795         return err;
796 }
797
798 static int dn_forward(struct sk_buff *skb)
799 {
800         struct dn_skb_cb *cb = DN_SKB_CB(skb);
801         struct dst_entry *dst = skb_dst(skb);
802         struct dn_dev *dn_db = rcu_dereference(dst->dev->dn_ptr);
803         struct dn_route *rt;
804         int header_len;
805 #ifdef CONFIG_NETFILTER
806         struct net_device *dev = skb->dev;
807 #endif
808
809         if (skb->pkt_type != PACKET_HOST)
810                 goto drop;
811
812         /* Ensure that we have enough space for headers */
813         rt = (struct dn_route *)skb_dst(skb);
814         header_len = dn_db->use_long ? 21 : 6;
815         if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+header_len))
816                 goto drop;
817
818         /*
819          * Hop count exceeded.
820          */
821         if (++cb->hops > 30)
822                 goto drop;
823
824         skb->dev = rt->dst.dev;
825
826         /*
827          * If packet goes out same interface it came in on, then set
828          * the Intra-Ethernet bit. This has no effect for short
829          * packets, so we don't need to test for them here.
830          */
831         cb->rt_flags &= ~DN_RT_F_IE;
832         if (rt->rt_flags & RTCF_DOREDIRECT)
833                 cb->rt_flags |= DN_RT_F_IE;
834
835         return NF_HOOK(NFPROTO_DECNET, NF_DN_FORWARD, skb, dev, skb->dev,
836                        dn_to_neigh_output);
837
838 drop:
839         kfree_skb(skb);
840         return NET_RX_DROP;
841 }
842
843 /*
844  * Used to catch bugs. This should never normally get
845  * called.
846  */
847 static int dn_rt_bug(struct sk_buff *skb)
848 {
849         struct dn_skb_cb *cb = DN_SKB_CB(skb);
850
851         net_dbg_ratelimited("dn_rt_bug: skb from:%04x to:%04x\n",
852                             le16_to_cpu(cb->src), le16_to_cpu(cb->dst));
853
854         kfree_skb(skb);
855
856         return NET_RX_DROP;
857 }
858
859 static unsigned int dn_dst_default_advmss(const struct dst_entry *dst)
860 {
861         return dn_mss_from_pmtu(dst->dev, dst_mtu(dst));
862 }
863
864 static unsigned int dn_dst_mtu(const struct dst_entry *dst)
865 {
866         unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
867
868         return mtu ? : dst->dev->mtu;
869 }
870
871 static struct neighbour *dn_dst_neigh_lookup(const struct dst_entry *dst,
872                                              struct sk_buff *skb,
873                                              const void *daddr)
874 {
875         return __neigh_lookup_errno(&dn_neigh_table, daddr, dst->dev);
876 }
877
878 static int dn_rt_set_next_hop(struct dn_route *rt, struct dn_fib_res *res)
879 {
880         struct dn_fib_info *fi = res->fi;
881         struct net_device *dev = rt->dst.dev;
882         unsigned int mss_metric;
883         struct neighbour *n;
884
885         if (fi) {
886                 if (DN_FIB_RES_GW(*res) &&
887                     DN_FIB_RES_NH(*res).nh_scope == RT_SCOPE_LINK)
888                         rt->rt_gateway = DN_FIB_RES_GW(*res);
889                 dst_init_metrics(&rt->dst, fi->fib_metrics, true);
890         }
891         rt->rt_type = res->type;
892
893         if (dev != NULL && rt->n == NULL) {
894                 n = __neigh_lookup_errno(&dn_neigh_table, &rt->rt_gateway, dev);
895                 if (IS_ERR(n))
896                         return PTR_ERR(n);
897                 rt->n = n;
898         }
899
900         if (dst_metric(&rt->dst, RTAX_MTU) > rt->dst.dev->mtu)
901                 dst_metric_set(&rt->dst, RTAX_MTU, rt->dst.dev->mtu);
902         mss_metric = dst_metric_raw(&rt->dst, RTAX_ADVMSS);
903         if (mss_metric) {
904                 unsigned int mss = dn_mss_from_pmtu(dev, dst_mtu(&rt->dst));
905                 if (mss_metric > mss)
906                         dst_metric_set(&rt->dst, RTAX_ADVMSS, mss);
907         }
908         return 0;
909 }
910
911 static inline int dn_match_addr(__le16 addr1, __le16 addr2)
912 {
913         __u16 tmp = le16_to_cpu(addr1) ^ le16_to_cpu(addr2);
914         int match = 16;
915         while(tmp) {
916                 tmp >>= 1;
917                 match--;
918         }
919         return match;
920 }
921
922 static __le16 dnet_select_source(const struct net_device *dev, __le16 daddr, int scope)
923 {
924         __le16 saddr = 0;
925         struct dn_dev *dn_db;
926         struct dn_ifaddr *ifa;
927         int best_match = 0;
928         int ret;
929
930         rcu_read_lock();
931         dn_db = rcu_dereference(dev->dn_ptr);
932         for (ifa = rcu_dereference(dn_db->ifa_list);
933              ifa != NULL;
934              ifa = rcu_dereference(ifa->ifa_next)) {
935                 if (ifa->ifa_scope > scope)
936                         continue;
937                 if (!daddr) {
938                         saddr = ifa->ifa_local;
939                         break;
940                 }
941                 ret = dn_match_addr(daddr, ifa->ifa_local);
942                 if (ret > best_match)
943                         saddr = ifa->ifa_local;
944                 if (best_match == 0)
945                         saddr = ifa->ifa_local;
946         }
947         rcu_read_unlock();
948
949         return saddr;
950 }
951
952 static inline __le16 __dn_fib_res_prefsrc(struct dn_fib_res *res)
953 {
954         return dnet_select_source(DN_FIB_RES_DEV(*res), DN_FIB_RES_GW(*res), res->scope);
955 }
956
957 static inline __le16 dn_fib_rules_map_destination(__le16 daddr, struct dn_fib_res *res)
958 {
959         __le16 mask = dnet_make_mask(res->prefixlen);
960         return (daddr&~mask)|res->fi->fib_nh->nh_gw;
961 }
962
963 static int dn_route_output_slow(struct dst_entry **pprt, const struct flowidn *oldflp, int try_hard)
964 {
965         struct flowidn fld = {
966                 .daddr = oldflp->daddr,
967                 .saddr = oldflp->saddr,
968                 .flowidn_scope = RT_SCOPE_UNIVERSE,
969                 .flowidn_mark = oldflp->flowidn_mark,
970                 .flowidn_iif = init_net.loopback_dev->ifindex,
971                 .flowidn_oif = oldflp->flowidn_oif,
972         };
973         struct dn_route *rt = NULL;
974         struct net_device *dev_out = NULL, *dev;
975         struct neighbour *neigh = NULL;
976         unsigned int hash;
977         unsigned int flags = 0;
978         struct dn_fib_res res = { .fi = NULL, .type = RTN_UNICAST };
979         int err;
980         int free_res = 0;
981         __le16 gateway = 0;
982
983         if (decnet_debug_level & 16)
984                 printk(KERN_DEBUG
985                        "dn_route_output_slow: dst=%04x src=%04x mark=%d"
986                        " iif=%d oif=%d\n", le16_to_cpu(oldflp->daddr),
987                        le16_to_cpu(oldflp->saddr),
988                        oldflp->flowidn_mark, init_net.loopback_dev->ifindex,
989                        oldflp->flowidn_oif);
990
991         /* If we have an output interface, verify its a DECnet device */
992         if (oldflp->flowidn_oif) {
993                 dev_out = dev_get_by_index(&init_net, oldflp->flowidn_oif);
994                 err = -ENODEV;
995                 if (dev_out && dev_out->dn_ptr == NULL) {
996                         dev_put(dev_out);
997                         dev_out = NULL;
998                 }
999                 if (dev_out == NULL)
1000                         goto out;
1001         }
1002
1003         /* If we have a source address, verify that its a local address */
1004         if (oldflp->saddr) {
1005                 err = -EADDRNOTAVAIL;
1006
1007                 if (dev_out) {
1008                         if (dn_dev_islocal(dev_out, oldflp->saddr))
1009                                 goto source_ok;
1010                         dev_put(dev_out);
1011                         goto out;
1012                 }
1013                 rcu_read_lock();
1014                 for_each_netdev_rcu(&init_net, dev) {
1015                         if (!dev->dn_ptr)
1016                                 continue;
1017                         if (!dn_dev_islocal(dev, oldflp->saddr))
1018                                 continue;
1019                         if ((dev->flags & IFF_LOOPBACK) &&
1020                             oldflp->daddr &&
1021                             !dn_dev_islocal(dev, oldflp->daddr))
1022                                 continue;
1023
1024                         dev_out = dev;
1025                         break;
1026                 }
1027                 rcu_read_unlock();
1028                 if (dev_out == NULL)
1029                         goto out;
1030                 dev_hold(dev_out);
1031 source_ok:
1032                 ;
1033         }
1034
1035         /* No destination? Assume its local */
1036         if (!fld.daddr) {
1037                 fld.daddr = fld.saddr;
1038
1039                 err = -EADDRNOTAVAIL;
1040                 if (dev_out)
1041                         dev_put(dev_out);
1042                 dev_out = init_net.loopback_dev;
1043                 dev_hold(dev_out);
1044                 if (!fld.daddr) {
1045                         fld.daddr =
1046                         fld.saddr = dnet_select_source(dev_out, 0,
1047                                                        RT_SCOPE_HOST);
1048                         if (!fld.daddr)
1049                                 goto out;
1050                 }
1051                 fld.flowidn_oif = init_net.loopback_dev->ifindex;
1052                 res.type = RTN_LOCAL;
1053                 goto make_route;
1054         }
1055
1056         if (decnet_debug_level & 16)
1057                 printk(KERN_DEBUG
1058                        "dn_route_output_slow: initial checks complete."
1059                        " dst=%o4x src=%04x oif=%d try_hard=%d\n",
1060                        le16_to_cpu(fld.daddr), le16_to_cpu(fld.saddr),
1061                        fld.flowidn_oif, try_hard);
1062
1063         /*
1064          * N.B. If the kernel is compiled without router support then
1065          * dn_fib_lookup() will evaluate to non-zero so this if () block
1066          * will always be executed.
1067          */
1068         err = -ESRCH;
1069         if (try_hard || (err = dn_fib_lookup(&fld, &res)) != 0) {
1070                 struct dn_dev *dn_db;
1071                 if (err != -ESRCH)
1072                         goto out;
1073                 /*
1074                  * Here the fallback is basically the standard algorithm for
1075                  * routing in endnodes which is described in the DECnet routing
1076                  * docs
1077                  *
1078                  * If we are not trying hard, look in neighbour cache.
1079                  * The result is tested to ensure that if a specific output
1080                  * device/source address was requested, then we honour that
1081                  * here
1082                  */
1083                 if (!try_hard) {
1084                         neigh = neigh_lookup_nodev(&dn_neigh_table, &init_net, &fld.daddr);
1085                         if (neigh) {
1086                                 if ((oldflp->flowidn_oif &&
1087                                     (neigh->dev->ifindex != oldflp->flowidn_oif)) ||
1088                                     (oldflp->saddr &&
1089                                     (!dn_dev_islocal(neigh->dev,
1090                                                      oldflp->saddr)))) {
1091                                         neigh_release(neigh);
1092                                         neigh = NULL;
1093                                 } else {
1094                                         if (dev_out)
1095                                                 dev_put(dev_out);
1096                                         if (dn_dev_islocal(neigh->dev, fld.daddr)) {
1097                                                 dev_out = init_net.loopback_dev;
1098                                                 res.type = RTN_LOCAL;
1099                                         } else {
1100                                                 dev_out = neigh->dev;
1101                                         }
1102                                         dev_hold(dev_out);
1103                                         goto select_source;
1104                                 }
1105                         }
1106                 }
1107
1108                 /* Not there? Perhaps its a local address */
1109                 if (dev_out == NULL)
1110                         dev_out = dn_dev_get_default();
1111                 err = -ENODEV;
1112                 if (dev_out == NULL)
1113                         goto out;
1114                 dn_db = rcu_dereference_raw(dev_out->dn_ptr);
1115                 /* Possible improvement - check all devices for local addr */
1116                 if (dn_dev_islocal(dev_out, fld.daddr)) {
1117                         dev_put(dev_out);
1118                         dev_out = init_net.loopback_dev;
1119                         dev_hold(dev_out);
1120                         res.type = RTN_LOCAL;
1121                         goto select_source;
1122                 }
1123                 /* Not local either.... try sending it to the default router */
1124                 neigh = neigh_clone(dn_db->router);
1125                 BUG_ON(neigh && neigh->dev != dev_out);
1126
1127                 /* Ok then, we assume its directly connected and move on */
1128 select_source:
1129                 if (neigh)
1130                         gateway = ((struct dn_neigh *)neigh)->addr;
1131                 if (gateway == 0)
1132                         gateway = fld.daddr;
1133                 if (fld.saddr == 0) {
1134                         fld.saddr = dnet_select_source(dev_out, gateway,
1135                                                        res.type == RTN_LOCAL ?
1136                                                        RT_SCOPE_HOST :
1137                                                        RT_SCOPE_LINK);
1138                         if (fld.saddr == 0 && res.type != RTN_LOCAL)
1139                                 goto e_addr;
1140                 }
1141                 fld.flowidn_oif = dev_out->ifindex;
1142                 goto make_route;
1143         }
1144         free_res = 1;
1145
1146         if (res.type == RTN_NAT)
1147                 goto e_inval;
1148
1149         if (res.type == RTN_LOCAL) {
1150                 if (!fld.saddr)
1151                         fld.saddr = fld.daddr;
1152                 if (dev_out)
1153                         dev_put(dev_out);
1154                 dev_out = init_net.loopback_dev;
1155                 dev_hold(dev_out);
1156                 fld.flowidn_oif = dev_out->ifindex;
1157                 if (res.fi)
1158                         dn_fib_info_put(res.fi);
1159                 res.fi = NULL;
1160                 goto make_route;
1161         }
1162
1163         if (res.fi->fib_nhs > 1 && fld.flowidn_oif == 0)
1164                 dn_fib_select_multipath(&fld, &res);
1165
1166         /*
1167          * We could add some logic to deal with default routes here and
1168          * get rid of some of the special casing above.
1169          */
1170
1171         if (!fld.saddr)
1172                 fld.saddr = DN_FIB_RES_PREFSRC(res);
1173
1174         if (dev_out)
1175                 dev_put(dev_out);
1176         dev_out = DN_FIB_RES_DEV(res);
1177         dev_hold(dev_out);
1178         fld.flowidn_oif = dev_out->ifindex;
1179         gateway = DN_FIB_RES_GW(res);
1180
1181 make_route:
1182         if (dev_out->flags & IFF_LOOPBACK)
1183                 flags |= RTCF_LOCAL;
1184
1185         rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST);
1186         if (rt == NULL)
1187                 goto e_nobufs;
1188
1189         memset(&rt->fld, 0, sizeof(rt->fld));
1190         rt->fld.saddr        = oldflp->saddr;
1191         rt->fld.daddr        = oldflp->daddr;
1192         rt->fld.flowidn_oif  = oldflp->flowidn_oif;
1193         rt->fld.flowidn_iif  = 0;
1194         rt->fld.flowidn_mark = oldflp->flowidn_mark;
1195
1196         rt->rt_saddr      = fld.saddr;
1197         rt->rt_daddr      = fld.daddr;
1198         rt->rt_gateway    = gateway ? gateway : fld.daddr;
1199         rt->rt_local_src  = fld.saddr;
1200
1201         rt->rt_dst_map    = fld.daddr;
1202         rt->rt_src_map    = fld.saddr;
1203
1204         rt->n = neigh;
1205         neigh = NULL;
1206
1207         rt->dst.lastuse = jiffies;
1208         rt->dst.output  = dn_output;
1209         rt->dst.input   = dn_rt_bug;
1210         rt->rt_flags      = flags;
1211         if (flags & RTCF_LOCAL)
1212                 rt->dst.input = dn_nsp_rx;
1213
1214         err = dn_rt_set_next_hop(rt, &res);
1215         if (err)
1216                 goto e_neighbour;
1217
1218         hash = dn_hash(rt->fld.saddr, rt->fld.daddr);
1219         dn_insert_route(rt, hash, (struct dn_route **)pprt);
1220
1221 done:
1222         if (neigh)
1223                 neigh_release(neigh);
1224         if (free_res)
1225                 dn_fib_res_put(&res);
1226         if (dev_out)
1227                 dev_put(dev_out);
1228 out:
1229         return err;
1230
1231 e_addr:
1232         err = -EADDRNOTAVAIL;
1233         goto done;
1234 e_inval:
1235         err = -EINVAL;
1236         goto done;
1237 e_nobufs:
1238         err = -ENOBUFS;
1239         goto done;
1240 e_neighbour:
1241         dst_free(&rt->dst);
1242         goto e_nobufs;
1243 }
1244
1245
1246 /*
1247  * N.B. The flags may be moved into the flowi at some future stage.
1248  */
1249 static int __dn_route_output_key(struct dst_entry **pprt, const struct flowidn *flp, int flags)
1250 {
1251         unsigned int hash = dn_hash(flp->saddr, flp->daddr);
1252         struct dn_route *rt = NULL;
1253
1254         if (!(flags & MSG_TRYHARD)) {
1255                 rcu_read_lock_bh();
1256                 for (rt = rcu_dereference_bh(dn_rt_hash_table[hash].chain); rt;
1257                         rt = rcu_dereference_bh(rt->dst.dn_next)) {
1258                         if ((flp->daddr == rt->fld.daddr) &&
1259                             (flp->saddr == rt->fld.saddr) &&
1260                             (flp->flowidn_mark == rt->fld.flowidn_mark) &&
1261                             dn_is_output_route(rt) &&
1262                             (rt->fld.flowidn_oif == flp->flowidn_oif)) {
1263                                 dst_use(&rt->dst, jiffies);
1264                                 rcu_read_unlock_bh();
1265                                 *pprt = &rt->dst;
1266                                 return 0;
1267                         }
1268                 }
1269                 rcu_read_unlock_bh();
1270         }
1271
1272         return dn_route_output_slow(pprt, flp, flags);
1273 }
1274
1275 static int dn_route_output_key(struct dst_entry **pprt, struct flowidn *flp, int flags)
1276 {
1277         int err;
1278
1279         err = __dn_route_output_key(pprt, flp, flags);
1280         if (err == 0 && flp->flowidn_proto) {
1281                 *pprt = xfrm_lookup(&init_net, *pprt,
1282                                     flowidn_to_flowi(flp), NULL, 0);
1283                 if (IS_ERR(*pprt)) {
1284                         err = PTR_ERR(*pprt);
1285                         *pprt = NULL;
1286                 }
1287         }
1288         return err;
1289 }
1290
1291 int dn_route_output_sock(struct dst_entry **pprt, struct flowidn *fl, struct sock *sk, int flags)
1292 {
1293         int err;
1294
1295         err = __dn_route_output_key(pprt, fl, flags & MSG_TRYHARD);
1296         if (err == 0 && fl->flowidn_proto) {
1297                 if (!(flags & MSG_DONTWAIT))
1298                         fl->flowidn_flags |= FLOWI_FLAG_CAN_SLEEP;
1299                 *pprt = xfrm_lookup(&init_net, *pprt,
1300                                     flowidn_to_flowi(fl), sk, 0);
1301                 if (IS_ERR(*pprt)) {
1302                         err = PTR_ERR(*pprt);
1303                         *pprt = NULL;
1304                 }
1305         }
1306         return err;
1307 }
1308
1309 static int dn_route_input_slow(struct sk_buff *skb)
1310 {
1311         struct dn_route *rt = NULL;
1312         struct dn_skb_cb *cb = DN_SKB_CB(skb);
1313         struct net_device *in_dev = skb->dev;
1314         struct net_device *out_dev = NULL;
1315         struct dn_dev *dn_db;
1316         struct neighbour *neigh = NULL;
1317         unsigned int hash;
1318         int flags = 0;
1319         __le16 gateway = 0;
1320         __le16 local_src = 0;
1321         struct flowidn fld = {
1322                 .daddr = cb->dst,
1323                 .saddr = cb->src,
1324                 .flowidn_scope = RT_SCOPE_UNIVERSE,
1325                 .flowidn_mark = skb->mark,
1326                 .flowidn_iif = skb->dev->ifindex,
1327         };
1328         struct dn_fib_res res = { .fi = NULL, .type = RTN_UNREACHABLE };
1329         int err = -EINVAL;
1330         int free_res = 0;
1331
1332         dev_hold(in_dev);
1333
1334         if ((dn_db = rcu_dereference(in_dev->dn_ptr)) == NULL)
1335                 goto out;
1336
1337         /* Zero source addresses are not allowed */
1338         if (fld.saddr == 0)
1339                 goto out;
1340
1341         /*
1342          * In this case we've just received a packet from a source
1343          * outside ourselves pretending to come from us. We don't
1344          * allow it any further to prevent routing loops, spoofing and
1345          * other nasties. Loopback packets already have the dst attached
1346          * so this only affects packets which have originated elsewhere.
1347          */
1348         err  = -ENOTUNIQ;
1349         if (dn_dev_islocal(in_dev, cb->src))
1350                 goto out;
1351
1352         err = dn_fib_lookup(&fld, &res);
1353         if (err) {
1354                 if (err != -ESRCH)
1355                         goto out;
1356                 /*
1357                  * Is the destination us ?
1358                  */
1359                 if (!dn_dev_islocal(in_dev, cb->dst))
1360                         goto e_inval;
1361
1362                 res.type = RTN_LOCAL;
1363         } else {
1364                 __le16 src_map = fld.saddr;
1365                 free_res = 1;
1366
1367                 out_dev = DN_FIB_RES_DEV(res);
1368                 if (out_dev == NULL) {
1369                         net_crit_ratelimited("Bug in dn_route_input_slow() No output device\n");
1370                         goto e_inval;
1371                 }
1372                 dev_hold(out_dev);
1373
1374                 if (res.r)
1375                         src_map = fld.saddr; /* no NAT support for now */
1376
1377                 gateway = DN_FIB_RES_GW(res);
1378                 if (res.type == RTN_NAT) {
1379                         fld.daddr = dn_fib_rules_map_destination(fld.daddr, &res);
1380                         dn_fib_res_put(&res);
1381                         free_res = 0;
1382                         if (dn_fib_lookup(&fld, &res))
1383                                 goto e_inval;
1384                         free_res = 1;
1385                         if (res.type != RTN_UNICAST)
1386                                 goto e_inval;
1387                         flags |= RTCF_DNAT;
1388                         gateway = fld.daddr;
1389                 }
1390                 fld.saddr = src_map;
1391         }
1392
1393         switch(res.type) {
1394         case RTN_UNICAST:
1395                 /*
1396                  * Forwarding check here, we only check for forwarding
1397                  * being turned off, if you want to only forward intra
1398                  * area, its up to you to set the routing tables up
1399                  * correctly.
1400                  */
1401                 if (dn_db->parms.forwarding == 0)
1402                         goto e_inval;
1403
1404                 if (res.fi->fib_nhs > 1 && fld.flowidn_oif == 0)
1405                         dn_fib_select_multipath(&fld, &res);
1406
1407                 /*
1408                  * Check for out_dev == in_dev. We use the RTCF_DOREDIRECT
1409                  * flag as a hint to set the intra-ethernet bit when
1410                  * forwarding. If we've got NAT in operation, we don't do
1411                  * this optimisation.
1412                  */
1413                 if (out_dev == in_dev && !(flags & RTCF_NAT))
1414                         flags |= RTCF_DOREDIRECT;
1415
1416                 local_src = DN_FIB_RES_PREFSRC(res);
1417
1418         case RTN_BLACKHOLE:
1419         case RTN_UNREACHABLE:
1420                 break;
1421         case RTN_LOCAL:
1422                 flags |= RTCF_LOCAL;
1423                 fld.saddr = cb->dst;
1424                 fld.daddr = cb->src;
1425
1426                 /* Routing tables gave us a gateway */
1427                 if (gateway)
1428                         goto make_route;
1429
1430                 /* Packet was intra-ethernet, so we know its on-link */
1431                 if (cb->rt_flags & DN_RT_F_IE) {
1432                         gateway = cb->src;
1433                         goto make_route;
1434                 }
1435
1436                 /* Use the default router if there is one */
1437                 neigh = neigh_clone(dn_db->router);
1438                 if (neigh) {
1439                         gateway = ((struct dn_neigh *)neigh)->addr;
1440                         goto make_route;
1441                 }
1442
1443                 /* Close eyes and pray */
1444                 gateway = cb->src;
1445                 goto make_route;
1446         default:
1447                 goto e_inval;
1448         }
1449
1450 make_route:
1451         rt = dst_alloc(&dn_dst_ops, out_dev, 0, DST_OBSOLETE_NONE, DST_HOST);
1452         if (rt == NULL)
1453                 goto e_nobufs;
1454
1455         memset(&rt->fld, 0, sizeof(rt->fld));
1456         rt->rt_saddr      = fld.saddr;
1457         rt->rt_daddr      = fld.daddr;
1458         rt->rt_gateway    = fld.daddr;
1459         if (gateway)
1460                 rt->rt_gateway = gateway;
1461         rt->rt_local_src  = local_src ? local_src : rt->rt_saddr;
1462
1463         rt->rt_dst_map    = fld.daddr;
1464         rt->rt_src_map    = fld.saddr;
1465
1466         rt->fld.saddr        = cb->src;
1467         rt->fld.daddr        = cb->dst;
1468         rt->fld.flowidn_oif  = 0;
1469         rt->fld.flowidn_iif  = in_dev->ifindex;
1470         rt->fld.flowidn_mark = fld.flowidn_mark;
1471
1472         rt->n = neigh;
1473         rt->dst.lastuse = jiffies;
1474         rt->dst.output = dn_rt_bug;
1475         switch (res.type) {
1476         case RTN_UNICAST:
1477                 rt->dst.input = dn_forward;
1478                 break;
1479         case RTN_LOCAL:
1480                 rt->dst.output = dn_output;
1481                 rt->dst.input = dn_nsp_rx;
1482                 rt->dst.dev = in_dev;
1483                 flags |= RTCF_LOCAL;
1484                 break;
1485         default:
1486         case RTN_UNREACHABLE:
1487         case RTN_BLACKHOLE:
1488                 rt->dst.input = dst_discard;
1489         }
1490         rt->rt_flags = flags;
1491
1492         err = dn_rt_set_next_hop(rt, &res);
1493         if (err)
1494                 goto e_neighbour;
1495
1496         hash = dn_hash(rt->fld.saddr, rt->fld.daddr);
1497         dn_insert_route(rt, hash, &rt);
1498         skb_dst_set(skb, &rt->dst);
1499
1500 done:
1501         if (neigh)
1502                 neigh_release(neigh);
1503         if (free_res)
1504                 dn_fib_res_put(&res);
1505         dev_put(in_dev);
1506         if (out_dev)
1507                 dev_put(out_dev);
1508 out:
1509         return err;
1510
1511 e_inval:
1512         err = -EINVAL;
1513         goto done;
1514
1515 e_nobufs:
1516         err = -ENOBUFS;
1517         goto done;
1518
1519 e_neighbour:
1520         dst_free(&rt->dst);
1521         goto done;
1522 }
1523
1524 static int dn_route_input(struct sk_buff *skb)
1525 {
1526         struct dn_route *rt;
1527         struct dn_skb_cb *cb = DN_SKB_CB(skb);
1528         unsigned int hash = dn_hash(cb->src, cb->dst);
1529
1530         if (skb_dst(skb))
1531                 return 0;
1532
1533         rcu_read_lock();
1534         for(rt = rcu_dereference(dn_rt_hash_table[hash].chain); rt != NULL;
1535             rt = rcu_dereference(rt->dst.dn_next)) {
1536                 if ((rt->fld.saddr == cb->src) &&
1537                     (rt->fld.daddr == cb->dst) &&
1538                     (rt->fld.flowidn_oif == 0) &&
1539                     (rt->fld.flowidn_mark == skb->mark) &&
1540                     (rt->fld.flowidn_iif == cb->iif)) {
1541                         dst_use(&rt->dst, jiffies);
1542                         rcu_read_unlock();
1543                         skb_dst_set(skb, (struct dst_entry *)rt);
1544                         return 0;
1545                 }
1546         }
1547         rcu_read_unlock();
1548
1549         return dn_route_input_slow(skb);
1550 }
1551
1552 static int dn_rt_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
1553                            int event, int nowait, unsigned int flags)
1554 {
1555         struct dn_route *rt = (struct dn_route *)skb_dst(skb);
1556         struct rtmsg *r;
1557         struct nlmsghdr *nlh;
1558         long expires;
1559
1560         nlh = nlmsg_put(skb, pid, seq, event, sizeof(*r), flags);
1561         if (!nlh)
1562                 return -EMSGSIZE;
1563
1564         r = nlmsg_data(nlh);
1565         r->rtm_family = AF_DECnet;
1566         r->rtm_dst_len = 16;
1567         r->rtm_src_len = 0;
1568         r->rtm_tos = 0;
1569         r->rtm_table = RT_TABLE_MAIN;
1570         r->rtm_type = rt->rt_type;
1571         r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
1572         r->rtm_scope = RT_SCOPE_UNIVERSE;
1573         r->rtm_protocol = RTPROT_UNSPEC;
1574
1575         if (rt->rt_flags & RTCF_NOTIFY)
1576                 r->rtm_flags |= RTM_F_NOTIFY;
1577
1578         if (nla_put_u32(skb, RTA_TABLE, RT_TABLE_MAIN) < 0 ||
1579             nla_put_le16(skb, RTA_DST, rt->rt_daddr) < 0)
1580                 goto errout;
1581
1582         if (rt->fld.saddr) {
1583                 r->rtm_src_len = 16;
1584                 if (nla_put_le16(skb, RTA_SRC, rt->fld.saddr) < 0)
1585                         goto errout;
1586         }
1587         if (rt->dst.dev &&
1588             nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex) < 0)
1589                 goto errout;
1590
1591         /*
1592          * Note to self - change this if input routes reverse direction when
1593          * they deal only with inputs and not with replies like they do
1594          * currently.
1595          */
1596         if (nla_put_le16(skb, RTA_PREFSRC, rt->rt_local_src) < 0)
1597                 goto errout;
1598
1599         if (rt->rt_daddr != rt->rt_gateway &&
1600             nla_put_le16(skb, RTA_GATEWAY, rt->rt_gateway) < 0)
1601                 goto errout;
1602
1603         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
1604                 goto errout;
1605
1606         expires = rt->dst.expires ? rt->dst.expires - jiffies : 0;
1607         if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires,
1608                                rt->dst.error) < 0)
1609                 goto errout;
1610
1611         if (dn_is_input_route(rt) &&
1612             nla_put_u32(skb, RTA_IIF, rt->fld.flowidn_iif) < 0)
1613                 goto errout;
1614
1615         return nlmsg_end(skb, nlh);
1616
1617 errout:
1618         nlmsg_cancel(skb, nlh);
1619         return -EMSGSIZE;
1620 }
1621
1622 /*
1623  * This is called by both endnodes and routers now.
1624  */
1625 static int dn_cache_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, void *arg)
1626 {
1627         struct net *net = sock_net(in_skb->sk);
1628         struct rtattr **rta = arg;
1629         struct rtmsg *rtm = nlmsg_data(nlh);
1630         struct dn_route *rt = NULL;
1631         struct dn_skb_cb *cb;
1632         int err;
1633         struct sk_buff *skb;
1634         struct flowidn fld;
1635
1636         if (!net_eq(net, &init_net))
1637                 return -EINVAL;
1638
1639         memset(&fld, 0, sizeof(fld));
1640         fld.flowidn_proto = DNPROTO_NSP;
1641
1642         skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1643         if (skb == NULL)
1644                 return -ENOBUFS;
1645         skb_reset_mac_header(skb);
1646         cb = DN_SKB_CB(skb);
1647
1648         if (rta[RTA_SRC-1])
1649                 memcpy(&fld.saddr, RTA_DATA(rta[RTA_SRC-1]), 2);
1650         if (rta[RTA_DST-1])
1651                 memcpy(&fld.daddr, RTA_DATA(rta[RTA_DST-1]), 2);
1652         if (rta[RTA_IIF-1])
1653                 memcpy(&fld.flowidn_iif, RTA_DATA(rta[RTA_IIF-1]), sizeof(int));
1654
1655         if (fld.flowidn_iif) {
1656                 struct net_device *dev;
1657                 if ((dev = dev_get_by_index(&init_net, fld.flowidn_iif)) == NULL) {
1658                         kfree_skb(skb);
1659                         return -ENODEV;
1660                 }
1661                 if (!dev->dn_ptr) {
1662                         dev_put(dev);
1663                         kfree_skb(skb);
1664                         return -ENODEV;
1665                 }
1666                 skb->protocol = htons(ETH_P_DNA_RT);
1667                 skb->dev = dev;
1668                 cb->src = fld.saddr;
1669                 cb->dst = fld.daddr;
1670                 local_bh_disable();
1671                 err = dn_route_input(skb);
1672                 local_bh_enable();
1673                 memset(cb, 0, sizeof(struct dn_skb_cb));
1674                 rt = (struct dn_route *)skb_dst(skb);
1675                 if (!err && -rt->dst.error)
1676                         err = rt->dst.error;
1677         } else {
1678                 int oif = 0;
1679                 if (rta[RTA_OIF - 1])
1680                         memcpy(&oif, RTA_DATA(rta[RTA_OIF - 1]), sizeof(int));
1681                 fld.flowidn_oif = oif;
1682                 err = dn_route_output_key((struct dst_entry **)&rt, &fld, 0);
1683         }
1684
1685         if (skb->dev)
1686                 dev_put(skb->dev);
1687         skb->dev = NULL;
1688         if (err)
1689                 goto out_free;
1690         skb_dst_set(skb, &rt->dst);
1691         if (rtm->rtm_flags & RTM_F_NOTIFY)
1692                 rt->rt_flags |= RTCF_NOTIFY;
1693
1694         err = dn_rt_fill_info(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq, RTM_NEWROUTE, 0, 0);
1695
1696         if (err == 0)
1697                 goto out_free;
1698         if (err < 0) {
1699                 err = -EMSGSIZE;
1700                 goto out_free;
1701         }
1702
1703         return rtnl_unicast(skb, &init_net, NETLINK_CB(in_skb).pid);
1704
1705 out_free:
1706         kfree_skb(skb);
1707         return err;
1708 }
1709
1710 /*
1711  * For routers, this is called from dn_fib_dump, but for endnodes its
1712  * called directly from the rtnetlink dispatch table.
1713  */
1714 int dn_cache_dump(struct sk_buff *skb, struct netlink_callback *cb)
1715 {
1716         struct net *net = sock_net(skb->sk);
1717         struct dn_route *rt;
1718         int h, s_h;
1719         int idx, s_idx;
1720         struct rtmsg *rtm;
1721
1722         if (!net_eq(net, &init_net))
1723                 return 0;
1724
1725         if (nlmsg_len(cb->nlh) < sizeof(struct rtmsg))
1726                 return -EINVAL;
1727
1728         rtm = nlmsg_data(cb->nlh);
1729         if (!(rtm->rtm_flags & RTM_F_CLONED))
1730                 return 0;
1731
1732         s_h = cb->args[0];
1733         s_idx = idx = cb->args[1];
1734         for(h = 0; h <= dn_rt_hash_mask; h++) {
1735                 if (h < s_h)
1736                         continue;
1737                 if (h > s_h)
1738                         s_idx = 0;
1739                 rcu_read_lock_bh();
1740                 for(rt = rcu_dereference_bh(dn_rt_hash_table[h].chain), idx = 0;
1741                         rt;
1742                         rt = rcu_dereference_bh(rt->dst.dn_next), idx++) {
1743                         if (idx < s_idx)
1744                                 continue;
1745                         skb_dst_set(skb, dst_clone(&rt->dst));
1746                         if (dn_rt_fill_info(skb, NETLINK_CB(cb->skb).pid,
1747                                         cb->nlh->nlmsg_seq, RTM_NEWROUTE,
1748                                         1, NLM_F_MULTI) <= 0) {
1749                                 skb_dst_drop(skb);
1750                                 rcu_read_unlock_bh();
1751                                 goto done;
1752                         }
1753                         skb_dst_drop(skb);
1754                 }
1755                 rcu_read_unlock_bh();
1756         }
1757
1758 done:
1759         cb->args[0] = h;
1760         cb->args[1] = idx;
1761         return skb->len;
1762 }
1763
1764 #ifdef CONFIG_PROC_FS
1765 struct dn_rt_cache_iter_state {
1766         int bucket;
1767 };
1768
1769 static struct dn_route *dn_rt_cache_get_first(struct seq_file *seq)
1770 {
1771         struct dn_route *rt = NULL;
1772         struct dn_rt_cache_iter_state *s = seq->private;
1773
1774         for(s->bucket = dn_rt_hash_mask; s->bucket >= 0; --s->bucket) {
1775                 rcu_read_lock_bh();
1776                 rt = rcu_dereference_bh(dn_rt_hash_table[s->bucket].chain);
1777                 if (rt)
1778                         break;
1779                 rcu_read_unlock_bh();
1780         }
1781         return rt;
1782 }
1783
1784 static struct dn_route *dn_rt_cache_get_next(struct seq_file *seq, struct dn_route *rt)
1785 {
1786         struct dn_rt_cache_iter_state *s = seq->private;
1787
1788         rt = rcu_dereference_bh(rt->dst.dn_next);
1789         while (!rt) {
1790                 rcu_read_unlock_bh();
1791                 if (--s->bucket < 0)
1792                         break;
1793                 rcu_read_lock_bh();
1794                 rt = rcu_dereference_bh(dn_rt_hash_table[s->bucket].chain);
1795         }
1796         return rt;
1797 }
1798
1799 static void *dn_rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
1800 {
1801         struct dn_route *rt = dn_rt_cache_get_first(seq);
1802
1803         if (rt) {
1804                 while(*pos && (rt = dn_rt_cache_get_next(seq, rt)))
1805                         --*pos;
1806         }
1807         return *pos ? NULL : rt;
1808 }
1809
1810 static void *dn_rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
1811 {
1812         struct dn_route *rt = dn_rt_cache_get_next(seq, v);
1813         ++*pos;
1814         return rt;
1815 }
1816
1817 static void dn_rt_cache_seq_stop(struct seq_file *seq, void *v)
1818 {
1819         if (v)
1820                 rcu_read_unlock_bh();
1821 }
1822
1823 static int dn_rt_cache_seq_show(struct seq_file *seq, void *v)
1824 {
1825         struct dn_route *rt = v;
1826         char buf1[DN_ASCBUF_LEN], buf2[DN_ASCBUF_LEN];
1827
1828         seq_printf(seq, "%-8s %-7s %-7s %04d %04d %04d\n",
1829                    rt->dst.dev ? rt->dst.dev->name : "*",
1830                    dn_addr2asc(le16_to_cpu(rt->rt_daddr), buf1),
1831                    dn_addr2asc(le16_to_cpu(rt->rt_saddr), buf2),
1832                    atomic_read(&rt->dst.__refcnt),
1833                    rt->dst.__use, 0);
1834         return 0;
1835 }
1836
1837 static const struct seq_operations dn_rt_cache_seq_ops = {
1838         .start  = dn_rt_cache_seq_start,
1839         .next   = dn_rt_cache_seq_next,
1840         .stop   = dn_rt_cache_seq_stop,
1841         .show   = dn_rt_cache_seq_show,
1842 };
1843
1844 static int dn_rt_cache_seq_open(struct inode *inode, struct file *file)
1845 {
1846         return seq_open_private(file, &dn_rt_cache_seq_ops,
1847                         sizeof(struct dn_rt_cache_iter_state));
1848 }
1849
1850 static const struct file_operations dn_rt_cache_seq_fops = {
1851         .owner   = THIS_MODULE,
1852         .open    = dn_rt_cache_seq_open,
1853         .read    = seq_read,
1854         .llseek  = seq_lseek,
1855         .release = seq_release_private,
1856 };
1857
1858 #endif /* CONFIG_PROC_FS */
1859
1860 void __init dn_route_init(void)
1861 {
1862         int i, goal, order;
1863
1864         dn_dst_ops.kmem_cachep =
1865                 kmem_cache_create("dn_dst_cache", sizeof(struct dn_route), 0,
1866                                   SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
1867         dst_entries_init(&dn_dst_ops);
1868         setup_timer(&dn_route_timer, dn_dst_check_expire, 0);
1869         dn_route_timer.expires = jiffies + decnet_dst_gc_interval * HZ;
1870         add_timer(&dn_route_timer);
1871
1872         goal = totalram_pages >> (26 - PAGE_SHIFT);
1873
1874         for(order = 0; (1UL << order) < goal; order++)
1875                 /* NOTHING */;
1876
1877         /*
1878          * Only want 1024 entries max, since the table is very, very unlikely
1879          * to be larger than that.
1880          */
1881         while(order && ((((1UL << order) * PAGE_SIZE) /
1882                                 sizeof(struct dn_rt_hash_bucket)) >= 2048))
1883                 order--;
1884
1885         do {
1886                 dn_rt_hash_mask = (1UL << order) * PAGE_SIZE /
1887                         sizeof(struct dn_rt_hash_bucket);
1888                 while(dn_rt_hash_mask & (dn_rt_hash_mask - 1))
1889                         dn_rt_hash_mask--;
1890                 dn_rt_hash_table = (struct dn_rt_hash_bucket *)
1891                         __get_free_pages(GFP_ATOMIC, order);
1892         } while (dn_rt_hash_table == NULL && --order > 0);
1893
1894         if (!dn_rt_hash_table)
1895                 panic("Failed to allocate DECnet route cache hash table\n");
1896
1897         printk(KERN_INFO
1898                 "DECnet: Routing cache hash table of %u buckets, %ldKbytes\n",
1899                 dn_rt_hash_mask,
1900                 (long)(dn_rt_hash_mask*sizeof(struct dn_rt_hash_bucket))/1024);
1901
1902         dn_rt_hash_mask--;
1903         for(i = 0; i <= dn_rt_hash_mask; i++) {
1904                 spin_lock_init(&dn_rt_hash_table[i].lock);
1905                 dn_rt_hash_table[i].chain = NULL;
1906         }
1907
1908         dn_dst_ops.gc_thresh = (dn_rt_hash_mask + 1);
1909
1910         proc_net_fops_create(&init_net, "decnet_cache", S_IRUGO, &dn_rt_cache_seq_fops);
1911
1912 #ifdef CONFIG_DECNET_ROUTER
1913         rtnl_register(PF_DECnet, RTM_GETROUTE, dn_cache_getroute,
1914                       dn_fib_dump, NULL);
1915 #else
1916         rtnl_register(PF_DECnet, RTM_GETROUTE, dn_cache_getroute,
1917                       dn_cache_dump, NULL);
1918 #endif
1919 }
1920
1921 void __exit dn_route_cleanup(void)
1922 {
1923         del_timer(&dn_route_timer);
1924         dn_run_flush(0);
1925
1926         proc_net_remove(&init_net, "decnet_cache");
1927         dst_entries_destroy(&dn_dst_ops);
1928 }
1929