net/ipv6/exthdrs.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      Extension Header handling for IPv6
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Andi Kleen              <ak@muc.de>
   9  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  10  */
  11
  12 /* Changes:
  13  *      yoshfuji                : ensure not to overrun while parsing
  14  *                                tlv options.
  15  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  16  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  17  *                                handlers as inet6_protocol{}.
  18  */
  19
  20 #include <linux/errno.h>
  21 #include <linux/types.h>
  22 #include <linux/socket.h>
  23 #include <linux/sockios.h>
  24 #include <linux/net.h>
  25 #include <linux/netdevice.h>
  26 #include <linux/in6.h>
  27 #include <linux/icmpv6.h>
  28 #include <linux/slab.h>
  29 #include <linux/export.h>
  30
  31 #include <net/dst.h>
  32 #include <net/sock.h>
  33 #include <net/snmp.h>
  34
  35 #include <net/ipv6.h>
  36 #include <net/protocol.h>
  37 #include <net/transp_v6.h>
  38 #include <net/rawv6.h>
  39 #include <net/ndisc.h>
  40 #include <net/ip6_route.h>
  41 #include <net/addrconf.h>
  42 #include <net/calipso.h>
  43 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  44 #include <net/xfrm.h>
  45 #endif
  46 #include <linux/seg6.h>
  47 #include <net/seg6.h>
  48 #ifdef CONFIG_IPV6_SEG6_HMAC
  49 #include <net/seg6_hmac.h>
  50 #endif
  51 #include <net/rpl.h>
  52 #include <linux/ioam6.h>
  53 #include <net/ioam6.h>
  54 #include <net/dst_metadata.h>
  55
  56 #include <linux/uaccess.h>
  57
  58 /*********************
  59   Generic functions
  60  *********************/
  61
  62 /* An unknown option is detected, decide what to do */
  63
  64 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff,
  65                                bool disallow_unknowns)
  66 {
  67         if (disallow_unknowns) {
  68                 /* If unknown TLVs are disallowed by configuration
  69                  * then always silently drop packet. Note this also
  70                  * means no ICMP parameter problem is sent which
  71                  * could be a good property to mitigate a reflection DOS
  72                  * attack.
  73                  */
  74
  75                 goto drop;
  76         }
  77
  78         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  79         case 0: /* ignore */
  80                 return true;
  81
  82         case 1: /* drop packet */
  83                 break;
  84
  85         case 3: /* Send ICMP if not a multicast address and drop packet */
  86                 /* Actually, it is redundant check. icmp_send
  87                    will recheck in any case.
  88                  */
  89                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
  90                         break;
  91                 fallthrough;
  92         case 2: /* send ICMP PARM PROB regardless and drop packet */
  93                 icmpv6_param_prob_reason(skb, ICMPV6_UNK_OPTION, optoff,
  94                                          SKB_DROP_REASON_UNHANDLED_PROTO);
  95                 return false;
  96         }
  97
  98 drop:
  99         kfree_skb_reason(skb, SKB_DROP_REASON_UNHANDLED_PROTO);
 100         return false;
 101 }
 102
 103 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff);
 104 static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff);
 105 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff);
 106 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff);
 107 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 108 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff);
 109 #endif
 110
 111 /* Parse tlv encoded option header (hop-by-hop or destination) */
 112
 113 static bool ip6_parse_tlv(bool hopbyhop,
 114                           struct sk_buff *skb,
 115                           int max_count)
 116 {
 117         int len = (skb_transport_header(skb)[1] + 1) << 3;
 118         const unsigned char *nh = skb_network_header(skb);
 119         int off = skb_network_header_len(skb);
 120         bool disallow_unknowns = false;
 121         int tlv_count = 0;
 122         int padlen = 0;
 123
 124         if (unlikely(max_count < 0)) {
 125                 disallow_unknowns = true;
 126                 max_count = -max_count;
 127         }
 128
 129         off += 2;
 130         len -= 2;
 131
 132         while (len > 0) {
 133                 int optlen, i;
 134
 135                 if (nh[off] == IPV6_TLV_PAD1) {
 136                         padlen++;
 137                         if (padlen > 7)
 138                                 goto bad;
 139                         off++;
 140                         len--;
 141                         continue;
 142                 }
 143                 if (len < 2)
 144                         goto bad;
 145                 optlen = nh[off + 1] + 2;
 146                 if (optlen > len)
 147                         goto bad;
 148
 149                 if (nh[off] == IPV6_TLV_PADN) {
 150                         /* RFC 2460 states that the purpose of PadN is
 151                          * to align the containing header to multiples
 152                          * of 8. 7 is therefore the highest valid value.
 153                          * See also RFC 4942, Section 2.1.9.5.
 154                          */
 155                         padlen += optlen;
 156                         if (padlen > 7)
 157                                 goto bad;
 158                         /* RFC 4942 recommends receiving hosts to
 159                          * actively check PadN payload to contain
 160                          * only zeroes.
 161                          */
 162                         for (i = 2; i < optlen; i++) {
 163                                 if (nh[off + i] != 0)
 164                                         goto bad;
 165                         }
 166                 } else {
 167                         tlv_count++;
 168                         if (tlv_count > max_count)
 169                                 goto bad;
 170
 171                         if (hopbyhop) {
 172                                 switch (nh[off]) {
 173                                 case IPV6_TLV_ROUTERALERT:
 174                                         if (!ipv6_hop_ra(skb, off))
 175                                                 return false;
 176                                         break;
 177                                 case IPV6_TLV_IOAM:
 178                                         if (!ipv6_hop_ioam(skb, off))
 179                                                 return false;
 180                                         break;
 181                                 case IPV6_TLV_JUMBO:
 182                                         if (!ipv6_hop_jumbo(skb, off))
 183                                                 return false;
 184                                         break;
 185                                 case IPV6_TLV_CALIPSO:
 186                                         if (!ipv6_hop_calipso(skb, off))
 187                                                 return false;
 188                                         break;
 189                                 default:
 190                                         if (!ip6_tlvopt_unknown(skb, off,
 191                                                                 disallow_unknowns))
 192                                                 return false;
 193                                         break;
 194                                 }
 195                         } else {
 196                                 switch (nh[off]) {
 197 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 198                                 case IPV6_TLV_HAO:
 199                                         if (!ipv6_dest_hao(skb, off))
 200                                                 return false;
 201                                         break;
 202 #endif
 203                                 default:
 204                                         if (!ip6_tlvopt_unknown(skb, off,
 205                                                                 disallow_unknowns))
 206                                                 return false;
 207                                         break;
 208                                 }
 209                         }
 210                         padlen = 0;
 211                 }
 212                 off += optlen;
 213                 len -= optlen;
 214         }
 215
 216         if (len == 0)
 217                 return true;
 218 bad:
 219         kfree_skb_reason(skb, SKB_DROP_REASON_IP_INHDR);
 220         return false;
 221 }
 222
 223 /*****************************
 224   Destination options header.
 225  *****************************/
 226
 227 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 228 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 229 {
 230         struct ipv6_destopt_hao *hao;
 231         struct inet6_skb_parm *opt = IP6CB(skb);
 232         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 233         SKB_DR(reason);
 234         int ret;
 235
 236         if (opt->dsthao) {
 237                 net_dbg_ratelimited("hao duplicated\n");
 238                 goto discard;
 239         }
 240         opt->dsthao = opt->dst1;
 241         opt->dst1 = 0;
 242
 243         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 244
 245         if (hao->length != 16) {
 246                 net_dbg_ratelimited("hao invalid option length = %d\n",
 247                                     hao->length);
 248                 SKB_DR_SET(reason, IP_INHDR);
 249                 goto discard;
 250         }
 251
 252         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 253                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 254                                     &hao->addr);
 255                 SKB_DR_SET(reason, INVALID_PROTO);
 256                 goto discard;
 257         }
 258
 259         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 260                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 261         if (unlikely(ret < 0)) {
 262                 SKB_DR_SET(reason, XFRM_POLICY);
 263                 goto discard;
 264         }
 265
 266         if (skb_cloned(skb)) {
 267                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 268                         goto discard;
 269
 270                 /* update all variable using below by copied skbuff */
 271                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 272                                                   optoff);
 273                 ipv6h = ipv6_hdr(skb);
 274         }
 275
 276         if (skb->ip_summed == CHECKSUM_COMPLETE)
 277                 skb->ip_summed = CHECKSUM_NONE;
 278
 279         swap(ipv6h->saddr, hao->addr);
 280
 281         if (skb->tstamp == 0)
 282                 __net_timestamp(skb);
 283
 284         return true;
 285
 286  discard:
 287         kfree_skb_reason(skb, reason);
 288         return false;
 289 }
 290 #endif
 291
 292 static int ipv6_destopt_rcv(struct sk_buff *skb)
 293 {
 294         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 295         struct inet6_skb_parm *opt = IP6CB(skb);
 296 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 297         __u16 dstbuf;
 298 #endif
 299         struct dst_entry *dst = skb_dst(skb);
 300         struct net *net = dev_net(skb->dev);
 301         int extlen;
 302
 303         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 304             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 305                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 306                 __IP6_INC_STATS(dev_net(dst->dev), idev,
 307                                 IPSTATS_MIB_INHDRERRORS);
 308 fail_and_free:
 309                 kfree_skb(skb);
 310                 return -1;
 311         }
 312
 313         extlen = (skb_transport_header(skb)[1] + 1) << 3;
 314         if (extlen > net->ipv6.sysctl.max_dst_opts_len)
 315                 goto fail_and_free;
 316
 317         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 318 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 319         dstbuf = opt->dst1;
 320 #endif
 321
 322         if (ip6_parse_tlv(false, skb, net->ipv6.sysctl.max_dst_opts_cnt)) {
 323                 skb->transport_header += extlen;
 324                 opt = IP6CB(skb);
 325 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 326                 opt->nhoff = dstbuf;
 327 #else
 328                 opt->nhoff = opt->dst1;
 329 #endif
 330                 return 1;
 331         }
 332
 333         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 334         return -1;
 335 }
 336
 337 static void seg6_update_csum(struct sk_buff *skb)
 338 {
 339         struct ipv6_sr_hdr *hdr;
 340         struct in6_addr *addr;
 341         __be32 from, to;
 342
 343         /* srh is at transport offset and seg_left is already decremented
 344          * but daddr is not yet updated with next segment
 345          */
 346
 347         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 348         addr = hdr->segments + hdr->segments_left;
 349
 350         hdr->segments_left++;
 351         from = *(__be32 *)hdr;
 352
 353         hdr->segments_left--;
 354         to = *(__be32 *)hdr;
 355
 356         /* update skb csum with diff resulting from seg_left decrement */
 357
 358         update_csum_diff4(skb, from, to);
 359
 360         /* compute csum diff between current and next segment and update */
 361
 362         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 363                            (__be32 *)addr);
 364 }
 365
 366 static int ipv6_srh_rcv(struct sk_buff *skb)
 367 {
 368         struct inet6_skb_parm *opt = IP6CB(skb);
 369         struct net *net = dev_net(skb->dev);
 370         struct ipv6_sr_hdr *hdr;
 371         struct inet6_dev *idev;
 372         struct in6_addr *addr;
 373         int accept_seg6;
 374
 375         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 376
 377         idev = __in6_dev_get(skb->dev);
 378
 379         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 380         if (accept_seg6 > idev->cnf.seg6_enabled)
 381                 accept_seg6 = idev->cnf.seg6_enabled;
 382
 383         if (!accept_seg6) {
 384                 kfree_skb(skb);
 385                 return -1;
 386         }
 387
 388 #ifdef CONFIG_IPV6_SEG6_HMAC
 389         if (!seg6_hmac_validate_skb(skb)) {
 390                 kfree_skb(skb);
 391                 return -1;
 392         }
 393 #endif
 394
 395 looped_back:
 396         if (hdr->segments_left == 0) {
 397                 if (hdr->nexthdr == NEXTHDR_IPV6 || hdr->nexthdr == NEXTHDR_IPV4) {
 398                         int offset = (hdr->hdrlen + 1) << 3;
 399
 400                         skb_postpull_rcsum(skb, skb_network_header(skb),
 401                                            skb_network_header_len(skb));
 402                         skb_pull(skb, offset);
 403                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 404                                            offset);
 405
 406                         skb_reset_network_header(skb);
 407                         skb_reset_transport_header(skb);
 408                         skb->encapsulation = 0;
 409                         if (hdr->nexthdr == NEXTHDR_IPV4)
 410                                 skb->protocol = htons(ETH_P_IP);
 411                         __skb_tunnel_rx(skb, skb->dev, net);
 412
 413                         netif_rx(skb);
 414                         return -1;
 415                 }
 416
 417                 opt->srcrt = skb_network_header_len(skb);
 418                 opt->lastopt = opt->srcrt;
 419                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 420                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 421
 422                 return 1;
 423         }
 424
 425         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 426                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 427                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 428                                   ((&hdr->segments_left) -
 429                                    skb_network_header(skb)));
 430                 return -1;
 431         }
 432
 433         if (skb_cloned(skb)) {
 434                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 435                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 436                                         IPSTATS_MIB_OUTDISCARDS);
 437                         kfree_skb(skb);
 438                         return -1;
 439                 }
 440
 441                 hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 442         }
 443
 444         hdr->segments_left--;
 445         addr = hdr->segments + hdr->segments_left;
 446
 447         skb_push(skb, sizeof(struct ipv6hdr));
 448
 449         if (skb->ip_summed == CHECKSUM_COMPLETE)
 450                 seg6_update_csum(skb);
 451
 452         ipv6_hdr(skb)->daddr = *addr;
 453
 454         ip6_route_input(skb);
 455
 456         if (skb_dst(skb)->error) {
 457                 dst_input(skb);
 458                 return -1;
 459         }
 460
 461         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 462                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 463                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 464                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 465                                     ICMPV6_EXC_HOPLIMIT, 0);
 466                         kfree_skb(skb);
 467                         return -1;
 468                 }
 469                 ipv6_hdr(skb)->hop_limit--;
 470
 471                 skb_pull(skb, sizeof(struct ipv6hdr));
 472                 goto looped_back;
 473         }
 474
 475         dst_input(skb);
 476
 477         return -1;
 478 }
 479
 480 static int ipv6_rpl_srh_rcv(struct sk_buff *skb)
 481 {
 482         struct ipv6_rpl_sr_hdr *hdr, *ohdr, *chdr;
 483         struct inet6_skb_parm *opt = IP6CB(skb);
 484         struct net *net = dev_net(skb->dev);
 485         struct inet6_dev *idev;
 486         struct ipv6hdr *oldhdr;
 487         unsigned char *buf;
 488         int accept_rpl_seg;
 489         int i, err;
 490         u64 n = 0;
 491         u32 r;
 492
 493         idev = __in6_dev_get(skb->dev);
 494
 495         accept_rpl_seg = net->ipv6.devconf_all->rpl_seg_enabled;
 496         if (accept_rpl_seg > idev->cnf.rpl_seg_enabled)
 497                 accept_rpl_seg = idev->cnf.rpl_seg_enabled;
 498
 499         if (!accept_rpl_seg) {
 500                 kfree_skb(skb);
 501                 return -1;
 502         }
 503
 504 looped_back:
 505         hdr = (struct ipv6_rpl_sr_hdr *)skb_transport_header(skb);
 506
 507         if (hdr->segments_left == 0) {
 508                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 509                         int offset = (hdr->hdrlen + 1) << 3;
 510
 511                         skb_postpull_rcsum(skb, skb_network_header(skb),
 512                                            skb_network_header_len(skb));
 513                         skb_pull(skb, offset);
 514                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 515                                            offset);
 516
 517                         skb_reset_network_header(skb);
 518                         skb_reset_transport_header(skb);
 519                         skb->encapsulation = 0;
 520
 521                         __skb_tunnel_rx(skb, skb->dev, net);
 522
 523                         netif_rx(skb);
 524                         return -1;
 525                 }
 526
 527                 opt->srcrt = skb_network_header_len(skb);
 528                 opt->lastopt = opt->srcrt;
 529                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 530                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 531
 532                 return 1;
 533         }
 534
 535         n = (hdr->hdrlen << 3) - hdr->pad - (16 - hdr->cmpre);
 536         r = do_div(n, (16 - hdr->cmpri));
 537         /* checks if calculation was without remainder and n fits into
 538          * unsigned char which is segments_left field. Should not be
 539          * higher than that.
 540          */
 541         if (r || (n + 1) > 255) {
 542                 kfree_skb(skb);
 543                 return -1;
 544         }
 545
 546         if (hdr->segments_left > n + 1) {
 547                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 548                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 549                                   ((&hdr->segments_left) -
 550                                    skb_network_header(skb)));
 551                 return -1;
 552         }
 553
 554         hdr->segments_left--;
 555         i = n - hdr->segments_left;
 556
 557         buf = kcalloc(struct_size(hdr, segments.addr, n + 2), 2, GFP_ATOMIC);
 558         if (unlikely(!buf)) {
 559                 kfree_skb(skb);
 560                 return -1;
 561         }
 562
 563         ohdr = (struct ipv6_rpl_sr_hdr *)buf;
 564         ipv6_rpl_srh_decompress(ohdr, hdr, &ipv6_hdr(skb)->daddr, n);
 565         chdr = (struct ipv6_rpl_sr_hdr *)(buf + ((ohdr->hdrlen + 1) << 3));
 566
 567         if (ipv6_addr_is_multicast(&ohdr->rpl_segaddr[i])) {
 568                 kfree_skb(skb);
 569                 kfree(buf);
 570                 return -1;
 571         }
 572
 573         err = ipv6_chk_rpl_srh_loop(net, ohdr->rpl_segaddr, n + 1);
 574         if (err) {
 575                 icmpv6_send(skb, ICMPV6_PARAMPROB, 0, 0);
 576                 kfree_skb(skb);
 577                 kfree(buf);
 578                 return -1;
 579         }
 580
 581         swap(ipv6_hdr(skb)->daddr, ohdr->rpl_segaddr[i]);
 582
 583         ipv6_rpl_srh_compress(chdr, ohdr, &ipv6_hdr(skb)->daddr, n);
 584
 585         oldhdr = ipv6_hdr(skb);
 586
 587         skb_pull(skb, ((hdr->hdrlen + 1) << 3));
 588         skb_postpull_rcsum(skb, oldhdr,
 589                            sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3));
 590         if (unlikely(!hdr->segments_left)) {
 591                 if (pskb_expand_head(skb, sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3), 0,
 592                                      GFP_ATOMIC)) {
 593                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_OUTDISCARDS);
 594                         kfree_skb(skb);
 595                         kfree(buf);
 596                         return -1;
 597                 }
 598
 599                 oldhdr = ipv6_hdr(skb);
 600         }
 601         skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr));
 602         skb_reset_network_header(skb);
 603         skb_mac_header_rebuild(skb);
 604         skb_set_transport_header(skb, sizeof(struct ipv6hdr));
 605
 606         memmove(ipv6_hdr(skb), oldhdr, sizeof(struct ipv6hdr));
 607         memcpy(skb_transport_header(skb), chdr, (chdr->hdrlen + 1) << 3);
 608
 609         ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
 610         skb_postpush_rcsum(skb, ipv6_hdr(skb),
 611                            sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3));
 612
 613         kfree(buf);
 614
 615         ip6_route_input(skb);
 616
 617         if (skb_dst(skb)->error) {
 618                 dst_input(skb);
 619                 return -1;
 620         }
 621
 622         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 623                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 624                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 625                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 626                                     ICMPV6_EXC_HOPLIMIT, 0);
 627                         kfree_skb(skb);
 628                         return -1;
 629                 }
 630                 ipv6_hdr(skb)->hop_limit--;
 631
 632                 skb_pull(skb, sizeof(struct ipv6hdr));
 633                 goto looped_back;
 634         }
 635
 636         dst_input(skb);
 637
 638         return -1;
 639 }
 640
 641 /********************************
 642   Routing header.
 643  ********************************/
 644
 645 /* called with rcu_read_lock() */
 646 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 647 {
 648         struct inet6_dev *idev = __in6_dev_get(skb->dev);
 649         struct inet6_skb_parm *opt = IP6CB(skb);
 650         struct in6_addr *addr = NULL;
 651         int n, i;
 652         struct ipv6_rt_hdr *hdr;
 653         struct rt0_hdr *rthdr;
 654         struct net *net = dev_net(skb->dev);
 655         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 656
 657         if (idev && accept_source_route > idev->cnf.accept_source_route)
 658                 accept_source_route = idev->cnf.accept_source_route;
 659
 660         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 661             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 662                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 663                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 664                 kfree_skb(skb);
 665                 return -1;
 666         }
 667
 668         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 669
 670         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 671             skb->pkt_type != PACKET_HOST) {
 672                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 673                 kfree_skb(skb);
 674                 return -1;
 675         }
 676
 677         switch (hdr->type) {
 678         case IPV6_SRCRT_TYPE_4:
 679                 /* segment routing */
 680                 return ipv6_srh_rcv(skb);
 681         case IPV6_SRCRT_TYPE_3:
 682                 /* rpl segment routing */
 683                 return ipv6_rpl_srh_rcv(skb);
 684         default:
 685                 break;
 686         }
 687
 688 looped_back:
 689         if (hdr->segments_left == 0) {
 690                 switch (hdr->type) {
 691 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 692                 case IPV6_SRCRT_TYPE_2:
 693                         /* Silently discard type 2 header unless it was
 694                          * processed by own
 695                          */
 696                         if (!addr) {
 697                                 __IP6_INC_STATS(net, idev,
 698                                                 IPSTATS_MIB_INADDRERRORS);
 699                                 kfree_skb(skb);
 700                                 return -1;
 701                         }
 702                         break;
 703 #endif
 704                 default:
 705                         break;
 706                 }
 707
 708                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 709                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 710                 opt->dst0 = opt->dst1;
 711                 opt->dst1 = 0;
 712                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 713                 return 1;
 714         }
 715
 716         switch (hdr->type) {
 717 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 718         case IPV6_SRCRT_TYPE_2:
 719                 if (accept_source_route < 0)
 720                         goto unknown_rh;
 721                 /* Silently discard invalid RTH type 2 */
 722                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 723                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 724                         kfree_skb(skb);
 725                         return -1;
 726                 }
 727                 break;
 728 #endif
 729         default:
 730                 goto unknown_rh;
 731         }
 732
 733         /*
 734          *      This is the routing header forwarding algorithm from
 735          *      RFC 2460, page 16.
 736          */
 737
 738         n = hdr->hdrlen >> 1;
 739
 740         if (hdr->segments_left > n) {
 741                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 742                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 743                                   ((&hdr->segments_left) -
 744                                    skb_network_header(skb)));
 745                 return -1;
 746         }
 747
 748         /* We are about to mangle packet header. Be careful!
 749            Do not damage packets queued somewhere.
 750          */
 751         if (skb_cloned(skb)) {
 752                 /* the copy is a forwarded packet */
 753                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 754                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 755                                         IPSTATS_MIB_OUTDISCARDS);
 756                         kfree_skb(skb);
 757                         return -1;
 758                 }
 759                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 760         }
 761
 762         if (skb->ip_summed == CHECKSUM_COMPLETE)
 763                 skb->ip_summed = CHECKSUM_NONE;
 764
 765         i = n - --hdr->segments_left;
 766
 767         rthdr = (struct rt0_hdr *) hdr;
 768         addr = rthdr->addr;
 769         addr += i - 1;
 770
 771         switch (hdr->type) {
 772 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 773         case IPV6_SRCRT_TYPE_2:
 774                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 775                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 776                                      IPPROTO_ROUTING) < 0) {
 777                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 778                         kfree_skb(skb);
 779                         return -1;
 780                 }
 781                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 782                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 783                         kfree_skb(skb);
 784                         return -1;
 785                 }
 786                 break;
 787 #endif
 788         default:
 789                 break;
 790         }
 791
 792         if (ipv6_addr_is_multicast(addr)) {
 793                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
 794                 kfree_skb(skb);
 795                 return -1;
 796         }
 797
 798         swap(*addr, ipv6_hdr(skb)->daddr);
 799
 800         ip6_route_input(skb);
 801         if (skb_dst(skb)->error) {
 802                 skb_push(skb, skb->data - skb_network_header(skb));
 803                 dst_input(skb);
 804                 return -1;
 805         }
 806
 807         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 808                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 809                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 810                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 811                                     0);
 812                         kfree_skb(skb);
 813                         return -1;
 814                 }
 815                 ipv6_hdr(skb)->hop_limit--;
 816                 goto looped_back;
 817         }
 818
 819         skb_push(skb, skb->data - skb_network_header(skb));
 820         dst_input(skb);
 821         return -1;
 822
 823 unknown_rh:
 824         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 825         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 826                           (&hdr->type) - skb_network_header(skb));
 827         return -1;
 828 }
 829
 830 static const struct inet6_protocol rthdr_protocol = {
 831         .handler        =       ipv6_rthdr_rcv,
 832         .flags          =       INET6_PROTO_NOPOLICY,
 833 };
 834
 835 static const struct inet6_protocol destopt_protocol = {
 836         .handler        =       ipv6_destopt_rcv,
 837         .flags          =       INET6_PROTO_NOPOLICY,
 838 };
 839
 840 static const struct inet6_protocol nodata_protocol = {
 841         .handler        =       dst_discard,
 842         .flags          =       INET6_PROTO_NOPOLICY,
 843 };
 844
 845 int __init ipv6_exthdrs_init(void)
 846 {
 847         int ret;
 848
 849         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 850         if (ret)
 851                 goto out;
 852
 853         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 854         if (ret)
 855                 goto out_rthdr;
 856
 857         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 858         if (ret)
 859                 goto out_destopt;
 860
 861 out:
 862         return ret;
 863 out_destopt:
 864         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 865 out_rthdr:
 866         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 867         goto out;
 868 };
 869
 870 void ipv6_exthdrs_exit(void)
 871 {
 872         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 873         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 874         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 875 }
 876
 877 /**********************************
 878   Hop-by-hop options.
 879  **********************************/
 880
 881 /*
 882  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 883  */
 884 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 885 {
 886         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 887 }
 888
 889 /* Router Alert as of RFC 2711 */
 890
 891 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 892 {
 893         const unsigned char *nh = skb_network_header(skb);
 894
 895         if (nh[optoff + 1] == 2) {
 896                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 897                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 898                 return true;
 899         }
 900         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 901                             nh[optoff + 1]);
 902         kfree_skb_reason(skb, SKB_DROP_REASON_IP_INHDR);
 903         return false;
 904 }
 905
 906 /* IOAM */
 907
 908 static bool ipv6_hop_ioam(struct sk_buff *skb, int optoff)
 909 {
 910         struct ioam6_trace_hdr *trace;
 911         struct ioam6_namespace *ns;
 912         struct ioam6_hdr *hdr;
 913
 914         /* Bad alignment (must be 4n-aligned) */
 915         if (optoff & 3)
 916                 goto drop;
 917
 918         /* Ignore if IOAM is not enabled on ingress */
 919         if (!__in6_dev_get(skb->dev)->cnf.ioam6_enabled)
 920                 goto ignore;
 921
 922         /* Truncated Option header */
 923         hdr = (struct ioam6_hdr *)(skb_network_header(skb) + optoff);
 924         if (hdr->opt_len < 2)
 925                 goto drop;
 926
 927         switch (hdr->type) {
 928         case IOAM6_TYPE_PREALLOC:
 929                 /* Truncated Pre-allocated Trace header */
 930                 if (hdr->opt_len < 2 + sizeof(*trace))
 931                         goto drop;
 932
 933                 /* Malformed Pre-allocated Trace header */
 934                 trace = (struct ioam6_trace_hdr *)((u8 *)hdr + sizeof(*hdr));
 935                 if (hdr->opt_len < 2 + sizeof(*trace) + trace->remlen * 4)
 936                         goto drop;
 937
 938                 /* Ignore if the IOAM namespace is unknown */
 939                 ns = ioam6_namespace(ipv6_skb_net(skb), trace->namespace_id);
 940                 if (!ns)
 941                         goto ignore;
 942
 943                 if (!skb_valid_dst(skb))
 944                         ip6_route_input(skb);
 945
 946                 ioam6_fill_trace_data(skb, ns, trace, true);
 947                 break;
 948         default:
 949                 break;
 950         }
 951
 952 ignore:
 953         return true;
 954
 955 drop:
 956         kfree_skb_reason(skb, SKB_DROP_REASON_IP_INHDR);
 957         return false;
 958 }
 959
 960 /* Jumbo payload */
 961
 962 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 963 {
 964         const unsigned char *nh = skb_network_header(skb);
 965         SKB_DR(reason);
 966         u32 pkt_len;
 967
 968         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 969                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 970                                     nh[optoff+1]);
 971                 SKB_DR_SET(reason, IP_INHDR);
 972                 goto drop;
 973         }
 974
 975         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 976         if (pkt_len <= IPV6_MAXPLEN) {
 977                 icmpv6_param_prob_reason(skb, ICMPV6_HDR_FIELD, optoff + 2,
 978                                          SKB_DROP_REASON_IP_INHDR);
 979                 return false;
 980         }
 981         if (ipv6_hdr(skb)->payload_len) {
 982                 icmpv6_param_prob_reason(skb, ICMPV6_HDR_FIELD, optoff,
 983                                          SKB_DROP_REASON_IP_INHDR);
 984                 return false;
 985         }
 986
 987         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 988                 SKB_DR_SET(reason, PKT_TOO_SMALL);
 989                 goto drop;
 990         }
 991
 992         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 993                 goto drop;
 994
 995         IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
 996         return true;
 997
 998 drop:
 999         kfree_skb_reason(skb, reason);
1000         return false;
1001 }
1002
1003 /* CALIPSO RFC 5570 */
1004
1005 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
1006 {
1007         const unsigned char *nh = skb_network_header(skb);
1008
1009         if (nh[optoff + 1] < 8)
1010                 goto drop;
1011
1012         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
1013                 goto drop;
1014
1015         if (!calipso_validate(skb, nh + optoff))
1016                 goto drop;
1017
1018         return true;
1019
1020 drop:
1021         kfree_skb_reason(skb, SKB_DROP_REASON_IP_INHDR);
1022         return false;
1023 }
1024
1025 int ipv6_parse_hopopts(struct sk_buff *skb)
1026 {
1027         struct inet6_skb_parm *opt = IP6CB(skb);
1028         struct net *net = dev_net(skb->dev);
1029         int extlen;
1030
1031         /*
1032          * skb_network_header(skb) is equal to skb->data, and
1033          * skb_network_header_len(skb) is always equal to
1034          * sizeof(struct ipv6hdr) by definition of
1035          * hop-by-hop options.
1036          */
1037         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
1038             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
1039                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
1040 fail_and_free:
1041                 kfree_skb(skb);
1042                 return -1;
1043         }
1044
1045         extlen = (skb_transport_header(skb)[1] + 1) << 3;
1046         if (extlen > net->ipv6.sysctl.max_hbh_opts_len)
1047                 goto fail_and_free;
1048
1049         opt->flags |= IP6SKB_HOPBYHOP;
1050         if (ip6_parse_tlv(true, skb, net->ipv6.sysctl.max_hbh_opts_cnt)) {
1051                 skb->transport_header += extlen;
1052                 opt = IP6CB(skb);
1053                 opt->nhoff = sizeof(struct ipv6hdr);
1054                 return 1;
1055         }
1056         return -1;
1057 }
1058
1059 /*
1060  *      Creating outbound headers.
1061  *
1062  *      "build" functions work when skb is filled from head to tail (datagram)
1063  *      "push"  functions work when headers are added from tail to head (tcp)
1064  *
1065  *      In both cases we assume, that caller reserved enough room
1066  *      for headers.
1067  */
1068
1069 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
1070                              struct ipv6_rt_hdr *opt,
1071                              struct in6_addr **addr_p, struct in6_addr *saddr)
1072 {
1073         struct rt0_hdr *phdr, *ihdr;
1074         int hops;
1075
1076         ihdr = (struct rt0_hdr *) opt;
1077
1078         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
1079         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
1080
1081         hops = ihdr->rt_hdr.hdrlen >> 1;
1082
1083         if (hops > 1)
1084                 memcpy(phdr->addr, ihdr->addr + 1,
1085                        (hops - 1) * sizeof(struct in6_addr));
1086
1087         phdr->addr[hops - 1] = **addr_p;
1088         *addr_p = ihdr->addr;
1089
1090         phdr->rt_hdr.nexthdr = *proto;
1091         *proto = NEXTHDR_ROUTING;
1092 }
1093
1094 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
1095                              struct ipv6_rt_hdr *opt,
1096                              struct in6_addr **addr_p, struct in6_addr *saddr)
1097 {
1098         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
1099         int plen, hops;
1100
1101         sr_ihdr = (struct ipv6_sr_hdr *)opt;
1102         plen = (sr_ihdr->hdrlen + 1) << 3;
1103
1104         sr_phdr = skb_push(skb, plen);
1105         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
1106
1107         hops = sr_ihdr->first_segment + 1;
1108         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
1109                (hops - 1) * sizeof(struct in6_addr));
1110
1111         sr_phdr->segments[0] = **addr_p;
1112         *addr_p = &sr_ihdr->segments[sr_ihdr->segments_left];
1113
1114         if (sr_ihdr->hdrlen > hops * 2) {
1115                 int tlvs_offset, tlvs_length;
1116
1117                 tlvs_offset = (1 + hops * 2) << 3;
1118                 tlvs_length = (sr_ihdr->hdrlen - hops * 2) << 3;
1119                 memcpy((char *)sr_phdr + tlvs_offset,
1120                        (char *)sr_ihdr + tlvs_offset, tlvs_length);
1121         }
1122
1123 #ifdef CONFIG_IPV6_SEG6_HMAC
1124         if (sr_has_hmac(sr_phdr)) {
1125                 struct net *net = NULL;
1126
1127                 if (skb->dev)
1128                         net = dev_net(skb->dev);
1129                 else if (skb->sk)
1130                         net = sock_net(skb->sk);
1131
1132                 WARN_ON(!net);
1133
1134                 if (net)
1135                         seg6_push_hmac(net, saddr, sr_phdr);
1136         }
1137 #endif
1138
1139         sr_phdr->nexthdr = *proto;
1140         *proto = NEXTHDR_ROUTING;
1141 }
1142
1143 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
1144                             struct ipv6_rt_hdr *opt,
1145                             struct in6_addr **addr_p, struct in6_addr *saddr)
1146 {
1147         switch (opt->type) {
1148         case IPV6_SRCRT_TYPE_0:
1149         case IPV6_SRCRT_STRICT:
1150         case IPV6_SRCRT_TYPE_2:
1151                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
1152                 break;
1153         case IPV6_SRCRT_TYPE_4:
1154                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
1155                 break;
1156         default:
1157                 break;
1158         }
1159 }
1160
1161 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
1162 {
1163         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
1164
1165         memcpy(h, opt, ipv6_optlen(opt));
1166         h->nexthdr = *proto;
1167         *proto = type;
1168 }
1169
1170 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
1171                           u8 *proto,
1172                           struct in6_addr **daddr, struct in6_addr *saddr)
1173 {
1174         if (opt->srcrt) {
1175                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
1176                 /*
1177                  * IPV6_RTHDRDSTOPTS is ignored
1178                  * unless IPV6_RTHDR is set (RFC3542).
1179                  */
1180                 if (opt->dst0opt)
1181                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
1182         }
1183         if (opt->hopopt)
1184                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
1185 }
1186
1187 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
1188 {
1189         if (opt->dst1opt)
1190                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
1191 }
1192 EXPORT_SYMBOL(ipv6_push_frag_opts);
1193
1194 struct ipv6_txoptions *
1195 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
1196 {
1197         struct ipv6_txoptions *opt2;
1198
1199         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
1200         if (opt2) {
1201                 long dif = (char *)opt2 - (char *)opt;
1202                 memcpy(opt2, opt, opt->tot_len);
1203                 if (opt2->hopopt)
1204                         *((char **)&opt2->hopopt) += dif;
1205                 if (opt2->dst0opt)
1206                         *((char **)&opt2->dst0opt) += dif;
1207                 if (opt2->dst1opt)
1208                         *((char **)&opt2->dst1opt) += dif;
1209                 if (opt2->srcrt)
1210                         *((char **)&opt2->srcrt) += dif;
1211                 refcount_set(&opt2->refcnt, 1);
1212         }
1213         return opt2;
1214 }
1215 EXPORT_SYMBOL_GPL(ipv6_dup_options);
1216
1217 static void ipv6_renew_option(int renewtype,
1218                               struct ipv6_opt_hdr **dest,
1219                               struct ipv6_opt_hdr *old,
1220                               struct ipv6_opt_hdr *new,
1221                               int newtype, char **p)
1222 {
1223         struct ipv6_opt_hdr *src;
1224
1225         src = (renewtype == newtype ? new : old);
1226         if (!src)
1227                 return;
1228
1229         memcpy(*p, src, ipv6_optlen(src));
1230         *dest = (struct ipv6_opt_hdr *)*p;
1231         *p += CMSG_ALIGN(ipv6_optlen(*dest));
1232 }
1233
1234 /**
1235  * ipv6_renew_options - replace a specific ext hdr with a new one.
1236  *
1237  * @sk: sock from which to allocate memory
1238  * @opt: original options
1239  * @newtype: option type to replace in @opt
1240  * @newopt: new option of type @newtype to replace (user-mem)
1241  *
1242  * Returns a new set of options which is a copy of @opt with the
1243  * option type @newtype replaced with @newopt.
1244  *
1245  * @opt may be NULL, in which case a new set of options is returned
1246  * containing just @newopt.
1247  *
1248  * @newopt may be NULL, in which case the specified option type is
1249  * not copied into the new set of options.
1250  *
1251  * The new set of options is allocated from the socket option memory
1252  * buffer of @sk.
1253  */
1254 struct ipv6_txoptions *
1255 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1256                    int newtype, struct ipv6_opt_hdr *newopt)
1257 {
1258         int tot_len = 0;
1259         char *p;
1260         struct ipv6_txoptions *opt2;
1261
1262         if (opt) {
1263                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1264                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1265                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1266                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1267                 if (newtype != IPV6_RTHDR && opt->srcrt)
1268                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1269                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1270                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1271         }
1272
1273         if (newopt)
1274                 tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
1275
1276         if (!tot_len)
1277                 return NULL;
1278
1279         tot_len += sizeof(*opt2);
1280         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1281         if (!opt2)
1282                 return ERR_PTR(-ENOBUFS);
1283
1284         memset(opt2, 0, tot_len);
1285         refcount_set(&opt2->refcnt, 1);
1286         opt2->tot_len = tot_len;
1287         p = (char *)(opt2 + 1);
1288
1289         ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
1290                           (opt ? opt->hopopt : NULL),
1291                           newopt, newtype, &p);
1292         ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
1293                           (opt ? opt->dst0opt : NULL),
1294                           newopt, newtype, &p);
1295         ipv6_renew_option(IPV6_RTHDR,
1296                           (struct ipv6_opt_hdr **)&opt2->srcrt,
1297                           (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
1298                           newopt, newtype, &p);
1299         ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
1300                           (opt ? opt->dst1opt : NULL),
1301                           newopt, newtype, &p);
1302
1303         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1304                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1305                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1306         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1307
1308         return opt2;
1309 }
1310
1311 struct ipv6_txoptions *__ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1312                                             struct ipv6_txoptions *opt)
1313 {
1314         /*
1315          * ignore the dest before srcrt unless srcrt is being included.
1316          * --yoshfuji
1317          */
1318         if (opt->dst0opt && !opt->srcrt) {
1319                 if (opt_space != opt) {
1320                         memcpy(opt_space, opt, sizeof(*opt_space));
1321                         opt = opt_space;
1322                 }
1323                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1324                 opt->dst0opt = NULL;
1325         }
1326
1327         return opt;
1328 }
1329 EXPORT_SYMBOL_GPL(__ipv6_fixup_options);
1330
1331 /**
1332  * fl6_update_dst - update flowi destination address with info given
1333  *                  by srcrt option, if any.
1334  *
1335  * @fl6: flowi6 for which daddr is to be updated
1336  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1337  * @orig: copy of original daddr address if modified
1338  *
1339  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1340  * and initial value of fl6->daddr set in orig
1341  */
1342 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1343                                 const struct ipv6_txoptions *opt,
1344                                 struct in6_addr *orig)
1345 {
1346         if (!opt || !opt->srcrt)
1347                 return NULL;
1348
1349         *orig = fl6->daddr;
1350
1351         switch (opt->srcrt->type) {
1352         case IPV6_SRCRT_TYPE_0:
1353         case IPV6_SRCRT_STRICT:
1354         case IPV6_SRCRT_TYPE_2:
1355                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1356                 break;
1357         case IPV6_SRCRT_TYPE_4:
1358         {
1359                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1360
1361                 fl6->daddr = srh->segments[srh->segments_left];
1362                 break;
1363         }
1364         default:
1365                 return NULL;
1366         }
1367
1368         return orig;
1369 }
1370 EXPORT_SYMBOL_GPL(fl6_update_dst);