net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #include <net/calipso.h>
  47 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  48 #include <net/xfrm.h>
  49 #endif
  50 #include <linux/seg6.h>
  51 #include <net/seg6.h>
  52 #ifdef CONFIG_IPV6_SEG6_HMAC
  53 #include <net/seg6_hmac.h>
  54 #endif
  55
  56 #include <linux/uaccess.h>
  57
  58 /*
  59  *      Parsing tlv encoded headers.
  60  *
  61  *      Parsing function "func" returns true, if parsing succeed
  62  *      and false, if it failed.
  63  *      It MUST NOT touch skb->h.
  64  */
  65
  66 struct tlvtype_proc {
  67         int     type;
  68         bool    (*func)(struct sk_buff *skb, int offset);
  69 };
  70
  71 /*********************
  72   Generic functions
  73  *********************/
  74
  75 /* An unknown option is detected, decide what to do */
  76
  77 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
  78 {
  79         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  80         case 0: /* ignore */
  81                 return true;
  82
  83         case 1: /* drop packet */
  84                 break;
  85
  86         case 3: /* Send ICMP if not a multicast address and drop packet */
  87                 /* Actually, it is redundant check. icmp_send
  88                    will recheck in any case.
  89                  */
  90                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
  91                         break;
  92         case 2: /* send ICMP PARM PROB regardless and drop packet */
  93                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
  94                 return false;
  95         }
  96
  97         kfree_skb(skb);
  98         return false;
  99 }
 100
 101 /* Parse tlv encoded option header (hop-by-hop or destination) */
 102
 103 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
 104 {
 105         const struct tlvtype_proc *curr;
 106         const unsigned char *nh = skb_network_header(skb);
 107         int off = skb_network_header_len(skb);
 108         int len = (skb_transport_header(skb)[1] + 1) << 3;
 109         int padlen = 0;
 110
 111         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 112                 goto bad;
 113
 114         off += 2;
 115         len -= 2;
 116
 117         while (len > 0) {
 118                 int optlen = nh[off + 1] + 2;
 119                 int i;
 120
 121                 switch (nh[off]) {
 122                 case IPV6_TLV_PAD1:
 123                         optlen = 1;
 124                         padlen++;
 125                         if (padlen > 7)
 126                                 goto bad;
 127                         break;
 128
 129                 case IPV6_TLV_PADN:
 130                         /* RFC 2460 states that the purpose of PadN is
 131                          * to align the containing header to multiples
 132                          * of 8. 7 is therefore the highest valid value.
 133                          * See also RFC 4942, Section 2.1.9.5.
 134                          */
 135                         padlen += optlen;
 136                         if (padlen > 7)
 137                                 goto bad;
 138                         /* RFC 4942 recommends receiving hosts to
 139                          * actively check PadN payload to contain
 140                          * only zeroes.
 141                          */
 142                         for (i = 2; i < optlen; i++) {
 143                                 if (nh[off + i] != 0)
 144                                         goto bad;
 145                         }
 146                         break;
 147
 148                 default: /* Other TLV code so scan list */
 149                         if (optlen > len)
 150                                 goto bad;
 151                         for (curr = procs; curr->type >= 0; curr++) {
 152                                 if (curr->type == nh[off]) {
 153                                         /* type specific length/alignment
 154                                            checks will be performed in the
 155                                            func(). */
 156                                         if (curr->func(skb, off) == false)
 157                                                 return false;
 158                                         break;
 159                                 }
 160                         }
 161                         if (curr->type < 0) {
 162                                 if (ip6_tlvopt_unknown(skb, off) == 0)
 163                                         return false;
 164                         }
 165                         padlen = 0;
 166                         break;
 167                 }
 168                 off += optlen;
 169                 len -= optlen;
 170         }
 171
 172         if (len == 0)
 173                 return true;
 174 bad:
 175         kfree_skb(skb);
 176         return false;
 177 }
 178
 179 /*****************************
 180   Destination options header.
 181  *****************************/
 182
 183 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 184 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 185 {
 186         struct ipv6_destopt_hao *hao;
 187         struct inet6_skb_parm *opt = IP6CB(skb);
 188         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 189         struct in6_addr tmp_addr;
 190         int ret;
 191
 192         if (opt->dsthao) {
 193                 net_dbg_ratelimited("hao duplicated\n");
 194                 goto discard;
 195         }
 196         opt->dsthao = opt->dst1;
 197         opt->dst1 = 0;
 198
 199         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 200
 201         if (hao->length != 16) {
 202                 net_dbg_ratelimited("hao invalid option length = %d\n",
 203                                     hao->length);
 204                 goto discard;
 205         }
 206
 207         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 208                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
 209                                     &hao->addr);
 210                 goto discard;
 211         }
 212
 213         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 214                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 215         if (unlikely(ret < 0))
 216                 goto discard;
 217
 218         if (skb_cloned(skb)) {
 219                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 220                         goto discard;
 221
 222                 /* update all variable using below by copied skbuff */
 223                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 224                                                   optoff);
 225                 ipv6h = ipv6_hdr(skb);
 226         }
 227
 228         if (skb->ip_summed == CHECKSUM_COMPLETE)
 229                 skb->ip_summed = CHECKSUM_NONE;
 230
 231         tmp_addr = ipv6h->saddr;
 232         ipv6h->saddr = hao->addr;
 233         hao->addr = tmp_addr;
 234
 235         if (skb->tstamp == 0)
 236                 __net_timestamp(skb);
 237
 238         return true;
 239
 240  discard:
 241         kfree_skb(skb);
 242         return false;
 243 }
 244 #endif
 245
 246 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 247 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 248         {
 249                 .type   = IPV6_TLV_HAO,
 250                 .func   = ipv6_dest_hao,
 251         },
 252 #endif
 253         {-1,                    NULL}
 254 };
 255
 256 static int ipv6_destopt_rcv(struct sk_buff *skb)
 257 {
 258         struct inet6_skb_parm *opt = IP6CB(skb);
 259 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 260         __u16 dstbuf;
 261 #endif
 262         struct dst_entry *dst = skb_dst(skb);
 263
 264         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 265             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 266                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 267                 __IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
 268                                 IPSTATS_MIB_INHDRERRORS);
 269                 kfree_skb(skb);
 270                 return -1;
 271         }
 272
 273         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 274 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 275         dstbuf = opt->dst1;
 276 #endif
 277
 278         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
 279                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 280                 opt = IP6CB(skb);
 281 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 282                 opt->nhoff = dstbuf;
 283 #else
 284                 opt->nhoff = opt->dst1;
 285 #endif
 286                 return 1;
 287         }
 288
 289         __IP6_INC_STATS(dev_net(dst->dev),
 290                         ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 291         return -1;
 292 }
 293
 294 static void seg6_update_csum(struct sk_buff *skb)
 295 {
 296         struct ipv6_sr_hdr *hdr;
 297         struct in6_addr *addr;
 298         __be32 from, to;
 299
 300         /* srh is at transport offset and seg_left is already decremented
 301          * but daddr is not yet updated with next segment
 302          */
 303
 304         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 305         addr = hdr->segments + hdr->segments_left;
 306
 307         hdr->segments_left++;
 308         from = *(__be32 *)hdr;
 309
 310         hdr->segments_left--;
 311         to = *(__be32 *)hdr;
 312
 313         /* update skb csum with diff resulting from seg_left decrement */
 314
 315         update_csum_diff4(skb, from, to);
 316
 317         /* compute csum diff between current and next segment and update */
 318
 319         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
 320                            (__be32 *)addr);
 321 }
 322
 323 static int ipv6_srh_rcv(struct sk_buff *skb)
 324 {
 325         struct inet6_skb_parm *opt = IP6CB(skb);
 326         struct net *net = dev_net(skb->dev);
 327         struct ipv6_sr_hdr *hdr;
 328         struct inet6_dev *idev;
 329         struct in6_addr *addr;
 330         int accept_seg6;
 331
 332         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 333
 334         idev = __in6_dev_get(skb->dev);
 335
 336         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
 337         if (accept_seg6 > idev->cnf.seg6_enabled)
 338                 accept_seg6 = idev->cnf.seg6_enabled;
 339
 340         if (!accept_seg6) {
 341                 kfree_skb(skb);
 342                 return -1;
 343         }
 344
 345 #ifdef CONFIG_IPV6_SEG6_HMAC
 346         if (!seg6_hmac_validate_skb(skb)) {
 347                 kfree_skb(skb);
 348                 return -1;
 349         }
 350 #endif
 351
 352 looped_back:
 353         if (hdr->segments_left == 0) {
 354                 if (hdr->nexthdr == NEXTHDR_IPV6) {
 355                         int offset = (hdr->hdrlen + 1) << 3;
 356
 357                         skb_postpull_rcsum(skb, skb_network_header(skb),
 358                                            skb_network_header_len(skb));
 359
 360                         if (!pskb_pull(skb, offset)) {
 361                                 kfree_skb(skb);
 362                                 return -1;
 363                         }
 364                         skb_postpull_rcsum(skb, skb_transport_header(skb),
 365                                            offset);
 366
 367                         skb_reset_network_header(skb);
 368                         skb_reset_transport_header(skb);
 369                         skb->encapsulation = 0;
 370
 371                         __skb_tunnel_rx(skb, skb->dev, net);
 372
 373                         netif_rx(skb);
 374                         return -1;
 375                 }
 376
 377                 opt->srcrt = skb_network_header_len(skb);
 378                 opt->lastopt = opt->srcrt;
 379                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 380                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 381
 382                 return 1;
 383         }
 384
 385         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
 386                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 387                                 IPSTATS_MIB_INHDRERRORS);
 388                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 389                                   ((&hdr->segments_left) -
 390                                    skb_network_header(skb)));
 391                 kfree_skb(skb);
 392                 return -1;
 393         }
 394
 395         if (skb_cloned(skb)) {
 396                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 397                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 398                                         IPSTATS_MIB_OUTDISCARDS);
 399                         kfree_skb(skb);
 400                         return -1;
 401                 }
 402         }
 403
 404         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
 405
 406         hdr->segments_left--;
 407         addr = hdr->segments + hdr->segments_left;
 408
 409         skb_push(skb, sizeof(struct ipv6hdr));
 410
 411         if (skb->ip_summed == CHECKSUM_COMPLETE)
 412                 seg6_update_csum(skb);
 413
 414         ipv6_hdr(skb)->daddr = *addr;
 415
 416         skb_dst_drop(skb);
 417
 418         ip6_route_input(skb);
 419
 420         if (skb_dst(skb)->error) {
 421                 dst_input(skb);
 422                 return -1;
 423         }
 424
 425         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
 426                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 427                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 428                                         IPSTATS_MIB_INHDRERRORS);
 429                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
 430                                     ICMPV6_EXC_HOPLIMIT, 0);
 431                         kfree_skb(skb);
 432                         return -1;
 433                 }
 434                 ipv6_hdr(skb)->hop_limit--;
 435
 436                 skb_pull(skb, sizeof(struct ipv6hdr));
 437                 goto looped_back;
 438         }
 439
 440         dst_input(skb);
 441
 442         return -1;
 443 }
 444
 445 /********************************
 446   Routing header.
 447  ********************************/
 448
 449 /* called with rcu_read_lock() */
 450 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 451 {
 452         struct inet6_skb_parm *opt = IP6CB(skb);
 453         struct in6_addr *addr = NULL;
 454         struct in6_addr daddr;
 455         struct inet6_dev *idev;
 456         int n, i;
 457         struct ipv6_rt_hdr *hdr;
 458         struct rt0_hdr *rthdr;
 459         struct net *net = dev_net(skb->dev);
 460         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 461
 462         idev = __in6_dev_get(skb->dev);
 463         if (idev && accept_source_route > idev->cnf.accept_source_route)
 464                 accept_source_route = idev->cnf.accept_source_route;
 465
 466         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 467             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 468                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 469                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 470                                 IPSTATS_MIB_INHDRERRORS);
 471                 kfree_skb(skb);
 472                 return -1;
 473         }
 474
 475         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 476
 477         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 478             skb->pkt_type != PACKET_HOST) {
 479                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 480                                 IPSTATS_MIB_INADDRERRORS);
 481                 kfree_skb(skb);
 482                 return -1;
 483         }
 484
 485         /* segment routing */
 486         if (hdr->type == IPV6_SRCRT_TYPE_4)
 487                 return ipv6_srh_rcv(skb);
 488
 489 looped_back:
 490         if (hdr->segments_left == 0) {
 491                 switch (hdr->type) {
 492 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 493                 case IPV6_SRCRT_TYPE_2:
 494                         /* Silently discard type 2 header unless it was
 495                          * processed by own
 496                          */
 497                         if (!addr) {
 498                                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 499                                                 IPSTATS_MIB_INADDRERRORS);
 500                                 kfree_skb(skb);
 501                                 return -1;
 502                         }
 503                         break;
 504 #endif
 505                 default:
 506                         break;
 507                 }
 508
 509                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 510                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 511                 opt->dst0 = opt->dst1;
 512                 opt->dst1 = 0;
 513                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 514                 return 1;
 515         }
 516
 517         switch (hdr->type) {
 518 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 519         case IPV6_SRCRT_TYPE_2:
 520                 if (accept_source_route < 0)
 521                         goto unknown_rh;
 522                 /* Silently discard invalid RTH type 2 */
 523                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 524                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 525                                         IPSTATS_MIB_INHDRERRORS);
 526                         kfree_skb(skb);
 527                         return -1;
 528                 }
 529                 break;
 530 #endif
 531         default:
 532                 goto unknown_rh;
 533         }
 534
 535         /*
 536          *      This is the routing header forwarding algorithm from
 537          *      RFC 2460, page 16.
 538          */
 539
 540         n = hdr->hdrlen >> 1;
 541
 542         if (hdr->segments_left > n) {
 543                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 544                                 IPSTATS_MIB_INHDRERRORS);
 545                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 546                                   ((&hdr->segments_left) -
 547                                    skb_network_header(skb)));
 548                 return -1;
 549         }
 550
 551         /* We are about to mangle packet header. Be careful!
 552            Do not damage packets queued somewhere.
 553          */
 554         if (skb_cloned(skb)) {
 555                 /* the copy is a forwarded packet */
 556                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 557                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 558                                         IPSTATS_MIB_OUTDISCARDS);
 559                         kfree_skb(skb);
 560                         return -1;
 561                 }
 562                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 563         }
 564
 565         if (skb->ip_summed == CHECKSUM_COMPLETE)
 566                 skb->ip_summed = CHECKSUM_NONE;
 567
 568         i = n - --hdr->segments_left;
 569
 570         rthdr = (struct rt0_hdr *) hdr;
 571         addr = rthdr->addr;
 572         addr += i - 1;
 573
 574         switch (hdr->type) {
 575 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 576         case IPV6_SRCRT_TYPE_2:
 577                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 578                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 579                                      IPPROTO_ROUTING) < 0) {
 580                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 581                                         IPSTATS_MIB_INADDRERRORS);
 582                         kfree_skb(skb);
 583                         return -1;
 584                 }
 585                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 586                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 587                                         IPSTATS_MIB_INADDRERRORS);
 588                         kfree_skb(skb);
 589                         return -1;
 590                 }
 591                 break;
 592 #endif
 593         default:
 594                 break;
 595         }
 596
 597         if (ipv6_addr_is_multicast(addr)) {
 598                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 599                                 IPSTATS_MIB_INADDRERRORS);
 600                 kfree_skb(skb);
 601                 return -1;
 602         }
 603
 604         daddr = *addr;
 605         *addr = ipv6_hdr(skb)->daddr;
 606         ipv6_hdr(skb)->daddr = daddr;
 607
 608         skb_dst_drop(skb);
 609         ip6_route_input(skb);
 610         if (skb_dst(skb)->error) {
 611                 skb_push(skb, skb->data - skb_network_header(skb));
 612                 dst_input(skb);
 613                 return -1;
 614         }
 615
 616         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 617                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 618                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
 619                                         IPSTATS_MIB_INHDRERRORS);
 620                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 621                                     0);
 622                         kfree_skb(skb);
 623                         return -1;
 624                 }
 625                 ipv6_hdr(skb)->hop_limit--;
 626                 goto looped_back;
 627         }
 628
 629         skb_push(skb, skb->data - skb_network_header(skb));
 630         dst_input(skb);
 631         return -1;
 632
 633 unknown_rh:
 634         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
 635         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 636                           (&hdr->type) - skb_network_header(skb));
 637         return -1;
 638 }
 639
 640 static const struct inet6_protocol rthdr_protocol = {
 641         .handler        =       ipv6_rthdr_rcv,
 642         .flags          =       INET6_PROTO_NOPOLICY,
 643 };
 644
 645 static const struct inet6_protocol destopt_protocol = {
 646         .handler        =       ipv6_destopt_rcv,
 647         .flags          =       INET6_PROTO_NOPOLICY,
 648 };
 649
 650 static const struct inet6_protocol nodata_protocol = {
 651         .handler        =       dst_discard,
 652         .flags          =       INET6_PROTO_NOPOLICY,
 653 };
 654
 655 int __init ipv6_exthdrs_init(void)
 656 {
 657         int ret;
 658
 659         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 660         if (ret)
 661                 goto out;
 662
 663         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 664         if (ret)
 665                 goto out_rthdr;
 666
 667         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 668         if (ret)
 669                 goto out_destopt;
 670
 671 out:
 672         return ret;
 673 out_destopt:
 674         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 675 out_rthdr:
 676         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 677         goto out;
 678 };
 679
 680 void ipv6_exthdrs_exit(void)
 681 {
 682         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 683         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 684         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 685 }
 686
 687 /**********************************
 688   Hop-by-hop options.
 689  **********************************/
 690
 691 /*
 692  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 693  */
 694 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 695 {
 696         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 697 }
 698
 699 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 700 {
 701         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 702 }
 703
 704 /* Router Alert as of RFC 2711 */
 705
 706 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 707 {
 708         const unsigned char *nh = skb_network_header(skb);
 709
 710         if (nh[optoff + 1] == 2) {
 711                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
 712                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
 713                 return true;
 714         }
 715         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
 716                             nh[optoff + 1]);
 717         kfree_skb(skb);
 718         return false;
 719 }
 720
 721 /* Jumbo payload */
 722
 723 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 724 {
 725         const unsigned char *nh = skb_network_header(skb);
 726         struct net *net = ipv6_skb_net(skb);
 727         u32 pkt_len;
 728
 729         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 730                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 731                                     nh[optoff+1]);
 732                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 733                                 IPSTATS_MIB_INHDRERRORS);
 734                 goto drop;
 735         }
 736
 737         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 738         if (pkt_len <= IPV6_MAXPLEN) {
 739                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 740                                 IPSTATS_MIB_INHDRERRORS);
 741                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 742                 return false;
 743         }
 744         if (ipv6_hdr(skb)->payload_len) {
 745                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 746                                 IPSTATS_MIB_INHDRERRORS);
 747                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 748                 return false;
 749         }
 750
 751         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 752                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
 753                                 IPSTATS_MIB_INTRUNCATEDPKTS);
 754                 goto drop;
 755         }
 756
 757         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 758                 goto drop;
 759
 760         return true;
 761
 762 drop:
 763         kfree_skb(skb);
 764         return false;
 765 }
 766
 767 /* CALIPSO RFC 5570 */
 768
 769 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
 770 {
 771         const unsigned char *nh = skb_network_header(skb);
 772
 773         if (nh[optoff + 1] < 8)
 774                 goto drop;
 775
 776         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
 777                 goto drop;
 778
 779         if (!calipso_validate(skb, nh + optoff))
 780                 goto drop;
 781
 782         return true;
 783
 784 drop:
 785         kfree_skb(skb);
 786         return false;
 787 }
 788
 789 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 790         {
 791                 .type   = IPV6_TLV_ROUTERALERT,
 792                 .func   = ipv6_hop_ra,
 793         },
 794         {
 795                 .type   = IPV6_TLV_JUMBO,
 796                 .func   = ipv6_hop_jumbo,
 797         },
 798         {
 799                 .type   = IPV6_TLV_CALIPSO,
 800                 .func   = ipv6_hop_calipso,
 801         },
 802         { -1, }
 803 };
 804
 805 int ipv6_parse_hopopts(struct sk_buff *skb)
 806 {
 807         struct inet6_skb_parm *opt = IP6CB(skb);
 808
 809         /*
 810          * skb_network_header(skb) is equal to skb->data, and
 811          * skb_network_header_len(skb) is always equal to
 812          * sizeof(struct ipv6hdr) by definition of
 813          * hop-by-hop options.
 814          */
 815         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 816             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 817                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 818                 kfree_skb(skb);
 819                 return -1;
 820         }
 821
 822         opt->flags |= IP6SKB_HOPBYHOP;
 823         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
 824                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 825                 opt = IP6CB(skb);
 826                 opt->nhoff = sizeof(struct ipv6hdr);
 827                 return 1;
 828         }
 829         return -1;
 830 }
 831
 832 /*
 833  *      Creating outbound headers.
 834  *
 835  *      "build" functions work when skb is filled from head to tail (datagram)
 836  *      "push"  functions work when headers are added from tail to head (tcp)
 837  *
 838  *      In both cases we assume, that caller reserved enough room
 839  *      for headers.
 840  */
 841
 842 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
 843                              struct ipv6_rt_hdr *opt,
 844                              struct in6_addr **addr_p, struct in6_addr *saddr)
 845 {
 846         struct rt0_hdr *phdr, *ihdr;
 847         int hops;
 848
 849         ihdr = (struct rt0_hdr *) opt;
 850
 851         phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 852         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 853
 854         hops = ihdr->rt_hdr.hdrlen >> 1;
 855
 856         if (hops > 1)
 857                 memcpy(phdr->addr, ihdr->addr + 1,
 858                        (hops - 1) * sizeof(struct in6_addr));
 859
 860         phdr->addr[hops - 1] = **addr_p;
 861         *addr_p = ihdr->addr;
 862
 863         phdr->rt_hdr.nexthdr = *proto;
 864         *proto = NEXTHDR_ROUTING;
 865 }
 866
 867 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
 868                              struct ipv6_rt_hdr *opt,
 869                              struct in6_addr **addr_p, struct in6_addr *saddr)
 870 {
 871         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
 872         int plen, hops;
 873
 874         sr_ihdr = (struct ipv6_sr_hdr *)opt;
 875         plen = (sr_ihdr->hdrlen + 1) << 3;
 876
 877         sr_phdr = (struct ipv6_sr_hdr *)skb_push(skb, plen);
 878         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
 879
 880         hops = sr_ihdr->first_segment + 1;
 881         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
 882                (hops - 1) * sizeof(struct in6_addr));
 883
 884         sr_phdr->segments[0] = **addr_p;
 885         *addr_p = &sr_ihdr->segments[hops - 1];
 886
 887 #ifdef CONFIG_IPV6_SEG6_HMAC
 888         if (sr_has_hmac(sr_phdr)) {
 889                 struct net *net = NULL;
 890
 891                 if (skb->dev)
 892                         net = dev_net(skb->dev);
 893                 else if (skb->sk)
 894                         net = sock_net(skb->sk);
 895
 896                 WARN_ON(!net);
 897
 898                 if (net)
 899                         seg6_push_hmac(net, saddr, sr_phdr);
 900         }
 901 #endif
 902
 903         sr_phdr->nexthdr = *proto;
 904         *proto = NEXTHDR_ROUTING;
 905 }
 906
 907 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 908                             struct ipv6_rt_hdr *opt,
 909                             struct in6_addr **addr_p, struct in6_addr *saddr)
 910 {
 911         switch (opt->type) {
 912         case IPV6_SRCRT_TYPE_0:
 913                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
 914                 break;
 915         case IPV6_SRCRT_TYPE_4:
 916                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
 917                 break;
 918         default:
 919                 break;
 920         }
 921 }
 922
 923 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 924 {
 925         struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));
 926
 927         memcpy(h, opt, ipv6_optlen(opt));
 928         h->nexthdr = *proto;
 929         *proto = type;
 930 }
 931
 932 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 933                           u8 *proto,
 934                           struct in6_addr **daddr, struct in6_addr *saddr)
 935 {
 936         if (opt->srcrt) {
 937                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
 938                 /*
 939                  * IPV6_RTHDRDSTOPTS is ignored
 940                  * unless IPV6_RTHDR is set (RFC3542).
 941                  */
 942                 if (opt->dst0opt)
 943                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 944         }
 945         if (opt->hopopt)
 946                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 947 }
 948 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 949
 950 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 951 {
 952         if (opt->dst1opt)
 953                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 954 }
 955
 956 struct ipv6_txoptions *
 957 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 958 {
 959         struct ipv6_txoptions *opt2;
 960
 961         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 962         if (opt2) {
 963                 long dif = (char *)opt2 - (char *)opt;
 964                 memcpy(opt2, opt, opt->tot_len);
 965                 if (opt2->hopopt)
 966                         *((char **)&opt2->hopopt) += dif;
 967                 if (opt2->dst0opt)
 968                         *((char **)&opt2->dst0opt) += dif;
 969                 if (opt2->dst1opt)
 970                         *((char **)&opt2->dst1opt) += dif;
 971                 if (opt2->srcrt)
 972                         *((char **)&opt2->srcrt) += dif;
 973                 atomic_set(&opt2->refcnt, 1);
 974         }
 975         return opt2;
 976 }
 977 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 978
 979 static int ipv6_renew_option(void *ohdr,
 980                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
 981                              int inherit,
 982                              struct ipv6_opt_hdr **hdr,
 983                              char **p)
 984 {
 985         if (inherit) {
 986                 if (ohdr) {
 987                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
 988                         *hdr = (struct ipv6_opt_hdr *)*p;
 989                         *p += CMSG_ALIGN(ipv6_optlen(*hdr));
 990                 }
 991         } else {
 992                 if (newopt) {
 993                         if (copy_from_user(*p, newopt, newoptlen))
 994                                 return -EFAULT;
 995                         *hdr = (struct ipv6_opt_hdr *)*p;
 996                         if (ipv6_optlen(*hdr) > newoptlen)
 997                                 return -EINVAL;
 998                         *p += CMSG_ALIGN(newoptlen);
 999                 }
1000         }
1001         return 0;
1002 }
1003
1004 /**
1005  * ipv6_renew_options - replace a specific ext hdr with a new one.
1006  *
1007  * @sk: sock from which to allocate memory
1008  * @opt: original options
1009  * @newtype: option type to replace in @opt
1010  * @newopt: new option of type @newtype to replace (user-mem)
1011  * @newoptlen: length of @newopt
1012  *
1013  * Returns a new set of options which is a copy of @opt with the
1014  * option type @newtype replaced with @newopt.
1015  *
1016  * @opt may be NULL, in which case a new set of options is returned
1017  * containing just @newopt.
1018  *
1019  * @newopt may be NULL, in which case the specified option type is
1020  * not copied into the new set of options.
1021  *
1022  * The new set of options is allocated from the socket option memory
1023  * buffer of @sk.
1024  */
1025 struct ipv6_txoptions *
1026 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1027                    int newtype,
1028                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
1029 {
1030         int tot_len = 0;
1031         char *p;
1032         struct ipv6_txoptions *opt2;
1033         int err;
1034
1035         if (opt) {
1036                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1037                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1038                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1039                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1040                 if (newtype != IPV6_RTHDR && opt->srcrt)
1041                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1042                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1043                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1044         }
1045
1046         if (newopt && newoptlen)
1047                 tot_len += CMSG_ALIGN(newoptlen);
1048
1049         if (!tot_len)
1050                 return NULL;
1051
1052         tot_len += sizeof(*opt2);
1053         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1054         if (!opt2)
1055                 return ERR_PTR(-ENOBUFS);
1056
1057         memset(opt2, 0, tot_len);
1058         atomic_set(&opt2->refcnt, 1);
1059         opt2->tot_len = tot_len;
1060         p = (char *)(opt2 + 1);
1061
1062         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
1063                                 newtype != IPV6_HOPOPTS,
1064                                 &opt2->hopopt, &p);
1065         if (err)
1066                 goto out;
1067
1068         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
1069                                 newtype != IPV6_RTHDRDSTOPTS,
1070                                 &opt2->dst0opt, &p);
1071         if (err)
1072                 goto out;
1073
1074         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
1075                                 newtype != IPV6_RTHDR,
1076                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
1077         if (err)
1078                 goto out;
1079
1080         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
1081                                 newtype != IPV6_DSTOPTS,
1082                                 &opt2->dst1opt, &p);
1083         if (err)
1084                 goto out;
1085
1086         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1087                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1088                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1089         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1090
1091         return opt2;
1092 out:
1093         sock_kfree_s(sk, opt2, opt2->tot_len);
1094         return ERR_PTR(err);
1095 }
1096
1097 /**
1098  * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
1099  *
1100  * @sk: sock from which to allocate memory
1101  * @opt: original options
1102  * @newtype: option type to replace in @opt
1103  * @newopt: new option of type @newtype to replace (kernel-mem)
1104  * @newoptlen: length of @newopt
1105  *
1106  * See ipv6_renew_options().  The difference is that @newopt is
1107  * kernel memory, rather than user memory.
1108  */
1109 struct ipv6_txoptions *
1110 ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
1111                         int newtype, struct ipv6_opt_hdr *newopt,
1112                         int newoptlen)
1113 {
1114         struct ipv6_txoptions *ret_val;
1115         const mm_segment_t old_fs = get_fs();
1116
1117         set_fs(KERNEL_DS);
1118         ret_val = ipv6_renew_options(sk, opt, newtype,
1119                                      (struct ipv6_opt_hdr __user *)newopt,
1120                                      newoptlen);
1121         set_fs(old_fs);
1122         return ret_val;
1123 }
1124
1125 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1126                                           struct ipv6_txoptions *opt)
1127 {
1128         /*
1129          * ignore the dest before srcrt unless srcrt is being included.
1130          * --yoshfuji
1131          */
1132         if (opt && opt->dst0opt && !opt->srcrt) {
1133                 if (opt_space != opt) {
1134                         memcpy(opt_space, opt, sizeof(*opt_space));
1135                         opt = opt_space;
1136                 }
1137                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1138                 opt->dst0opt = NULL;
1139         }
1140
1141         return opt;
1142 }
1143 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1144
1145 /**
1146  * fl6_update_dst - update flowi destination address with info given
1147  *                  by srcrt option, if any.
1148  *
1149  * @fl6: flowi6 for which daddr is to be updated
1150  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1151  * @orig: copy of original daddr address if modified
1152  *
1153  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1154  * and initial value of fl6->daddr set in orig
1155  */
1156 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1157                                 const struct ipv6_txoptions *opt,
1158                                 struct in6_addr *orig)
1159 {
1160         if (!opt || !opt->srcrt)
1161                 return NULL;
1162
1163         *orig = fl6->daddr;
1164
1165         switch (opt->srcrt->type) {
1166         case IPV6_SRCRT_TYPE_0:
1167                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1168                 break;
1169         case IPV6_SRCRT_TYPE_4:
1170         {
1171                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1172
1173                 fl6->daddr = srh->segments[srh->first_segment];
1174                 break;
1175         }
1176         default:
1177                 return NULL;
1178         }
1179
1180         return orig;
1181 }
1182 EXPORT_SYMBOL_GPL(fl6_update_dst);