[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / ipv6 / exthdrs.c

/*
 *	Extension Header handling for IPv6
 *	Linux INET6 implementation
 *
 *	Authors:
 *	Pedro Roque		<roque@di.fc.ul.pt>
 *	Andi Kleen		<ak@muc.de>
 *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
 *
 *	$Id: exthdrs.c,v 1.13 2001/06/19 15:58:56 davem Exp $
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

/* Changes:
 *	yoshfuji		: ensure not to overrun while parsing 
 *				  tlv options.
 *	Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
 *	YOSHIFUJI Hideaki @USAGI  Register inbound extension header
 *				  handlers as inet6_protocol{}.
 */

#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/sched.h>
#include <linux/net.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
#include <linux/icmpv6.h>

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/rawv6.h>
#include <net/ndisc.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>

#include <asm/uaccess.h>

/*
 *	Parsing tlv encoded headers.
 *
 *	Parsing function "func" returns 1, if parsing succeed
 *	and 0, if it failed.
 *	It MUST NOT touch skb->h.
 */

struct tlvtype_proc {
	int	type;
	int	(*func)(struct sk_buff *skb, int offset);
};

/*********************
  Generic functions
 *********************/

/* An unknown option is detected, decide what to do */

static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
{
	switch ((skb->nh.raw[optoff] & 0xC0) >> 6) {
	case 0: /* ignore */
		return 1;

	case 1: /* drop packet */
		break;

	case 3: /* Send ICMP if not a multicast address and drop packet */
		/* Actually, it is redundant check. icmp_send
		   will recheck in any case.
		 */
		if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr))
			break;
	case 2: /* send ICMP PARM PROB regardless and drop packet */
		icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
		return 0;
	};

	kfree_skb(skb);
	return 0;
}

/* Parse tlv encoded option header (hop-by-hop or destination) */

static int ip6_parse_tlv(struct tlvtype_proc *procs, struct sk_buff *skb)
{
	struct tlvtype_proc *curr;
	int off = skb->h.raw - skb->nh.raw;
	int len = ((skb->h.raw[1]+1)<<3);

	if ((skb->h.raw + len) - skb->data > skb_headlen(skb))
		goto bad;

	off += 2;
	len -= 2;

	while (len > 0) {
		int optlen = skb->nh.raw[off+1]+2;

		switch (skb->nh.raw[off]) {
		case IPV6_TLV_PAD0:
			optlen = 1;
			break;

		case IPV6_TLV_PADN:
			break;

		default: /* Other TLV code so scan list */
			if (optlen > len)
				goto bad;
			for (curr=procs; curr->type >= 0; curr++) {
				if (curr->type == skb->nh.raw[off]) {
					/* type specific length/alignment 
					   checks will be performed in the 
					   func(). */
					if (curr->func(skb, off) == 0)
						return 0;
					break;
				}
			}
			if (curr->type < 0) {
				if (ip6_tlvopt_unknown(skb, off) == 0)
					return 0;
			}
			break;
		}
		off += optlen;
		len -= optlen;
	}
	if (len == 0)
		return 1;
bad:
	kfree_skb(skb);
	return 0;
}

/*****************************
  Destination options header.
 *****************************/

static struct tlvtype_proc tlvprocdestopt_lst[] = {
	/* No destination options are defined now */
	{-1,			NULL}
};

static int ipv6_destopt_rcv(struct sk_buff **skbp)
{
	struct sk_buff *skb = *skbp;
	struct inet6_skb_parm *opt = IP6CB(skb);

	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
	    !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		kfree_skb(skb);
		return -1;
	}

	opt->lastopt = skb->h.raw - skb->nh.raw;
	opt->dst1 = skb->h.raw - skb->nh.raw;

	if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
		skb->h.raw += ((skb->h.raw[1]+1)<<3);
		opt->nhoff = opt->dst1;
		return 1;
	}

	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	return -1;
}

static struct inet6_protocol destopt_protocol = {
	.handler	=	ipv6_destopt_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

void __init ipv6_destopt_init(void)
{
	if (inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS) < 0)
		printk(KERN_ERR "ipv6_destopt_init: Could not register protocol\n");
}

/********************************
  NONE header. No data in packet.
 ********************************/

static int ipv6_nodata_rcv(struct sk_buff **skbp)
{
	struct sk_buff *skb = *skbp;

	kfree_skb(skb);
	return 0;
}

static struct inet6_protocol nodata_protocol = {
	.handler	=	ipv6_nodata_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

void __init ipv6_nodata_init(void)
{
	if (inet6_add_protocol(&nodata_protocol, IPPROTO_NONE) < 0)
		printk(KERN_ERR "ipv6_nodata_init: Could not register protocol\n");
}

/********************************
  Routing header.
 ********************************/

static int ipv6_rthdr_rcv(struct sk_buff **skbp)
{
	struct sk_buff *skb = *skbp;
	struct inet6_skb_parm *opt = IP6CB(skb);
	struct in6_addr *addr;
	struct in6_addr daddr;
	int n, i;

	struct ipv6_rt_hdr *hdr;
	struct rt0_hdr *rthdr;

	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
	    !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		kfree_skb(skb);
		return -1;
	}

	hdr = (struct ipv6_rt_hdr *) skb->h.raw;

	if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) ||
	    skb->pkt_type != PACKET_HOST) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
		kfree_skb(skb);
		return -1;
	}

looped_back:
	if (hdr->segments_left == 0) {
		opt->lastopt = skb->h.raw - skb->nh.raw;
		opt->srcrt = skb->h.raw - skb->nh.raw;
		skb->h.raw += (hdr->hdrlen + 1) << 3;
		opt->dst0 = opt->dst1;
		opt->dst1 = 0;
		opt->nhoff = (&hdr->nexthdr) - skb->nh.raw;
		return 1;
	}

	if (hdr->type != IPV6_SRCRT_TYPE_0) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
		return -1;
	}
	
	if (hdr->hdrlen & 0x01) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->hdrlen) - skb->nh.raw);
		return -1;
	}

	/*
	 *	This is the routing header forwarding algorithm from
	 *	RFC 2460, page 16.
	 */

	n = hdr->hdrlen >> 1;

	if (hdr->segments_left > n) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->segments_left) - skb->nh.raw);
		return -1;
	}

	/* We are about to mangle packet header. Be careful!
	   Do not damage packets queued somewhere.
	 */
	if (skb_cloned(skb)) {
		struct sk_buff *skb2 = skb_copy(skb, GFP_ATOMIC);
		kfree_skb(skb);
		/* the copy is a forwarded packet */
		if (skb2 == NULL) {
			IP6_INC_STATS_BH(IPSTATS_MIB_OUTDISCARDS);	
			return -1;
		}
		*skbp = skb = skb2;
		opt = IP6CB(skb2);
		hdr = (struct ipv6_rt_hdr *) skb2->h.raw;
	}

	if (skb->ip_summed == CHECKSUM_HW)
		skb->ip_summed = CHECKSUM_NONE;

	i = n - --hdr->segments_left;

	rthdr = (struct rt0_hdr *) hdr;
	addr = rthdr->addr;
	addr += i - 1;

	if (ipv6_addr_is_multicast(addr)) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
		kfree_skb(skb);
		return -1;
	}

	ipv6_addr_copy(&daddr, addr);
	ipv6_addr_copy(addr, &skb->nh.ipv6h->daddr);
	ipv6_addr_copy(&skb->nh.ipv6h->daddr, &daddr);

	dst_release(xchg(&skb->dst, NULL));
	ip6_route_input(skb);
	if (skb->dst->error) {
		skb_push(skb, skb->data - skb->nh.raw);
		dst_input(skb);
		return -1;
	}

	if (skb->dst->dev->flags&IFF_LOOPBACK) {
		if (skb->nh.ipv6h->hop_limit <= 1) {
			IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
			icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
				    0, skb->dev);
			kfree_skb(skb);
			return -1;
		}
		skb->nh.ipv6h->hop_limit--;
		goto looped_back;
	}

	skb_push(skb, skb->data - skb->nh.raw);
	dst_input(skb);
	return -1;
}

static struct inet6_protocol rthdr_protocol = {
	.handler	=	ipv6_rthdr_rcv,
	.flags		=	INET6_PROTO_NOPOLICY,
};

void __init ipv6_rthdr_init(void)
{
	if (inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING) < 0)
		printk(KERN_ERR "ipv6_rthdr_init: Could not register protocol\n");
};

/*
   This function inverts received rthdr.
   NOTE: specs allow to make it automatically only if
   packet authenticated.

   I will not discuss it here (though, I am really pissed off at
   this stupid requirement making rthdr idea useless)

   Actually, it creates severe problems  for us.
   Embryonic requests has no associated sockets,
   so that user have no control over it and
   cannot not only to set reply options, but
   even to know, that someone wants to connect
   without success. :-(

   For now we need to test the engine, so that I created
   temporary (or permanent) backdoor.
   If listening socket set IPV6_RTHDR to 2, then we invert header.
                                                   --ANK (980729)
 */

struct ipv6_txoptions *
ipv6_invert_rthdr(struct sock *sk, struct ipv6_rt_hdr *hdr)
{
	/* Received rthdr:

	   [ H1 -> H2 -> ... H_prev ]  daddr=ME

	   Inverted result:
	   [ H_prev -> ... -> H1 ] daddr =sender

	   Note, that IP output engine will rewrite this rthdr
	   by rotating it left by one addr.
	 */

	int n, i;
	struct rt0_hdr *rthdr = (struct rt0_hdr*)hdr;
	struct rt0_hdr *irthdr;
	struct ipv6_txoptions *opt;
	int hdrlen = ipv6_optlen(hdr);

	if (hdr->segments_left ||
	    hdr->type != IPV6_SRCRT_TYPE_0 ||
	    hdr->hdrlen & 0x01)
		return NULL;

	n = hdr->hdrlen >> 1;
	opt = sock_kmalloc(sk, sizeof(*opt) + hdrlen, GFP_ATOMIC);
	if (opt == NULL)
		return NULL;
	memset(opt, 0, sizeof(*opt));
	opt->tot_len = sizeof(*opt) + hdrlen;
	opt->srcrt = (void*)(opt+1);
	opt->opt_nflen = hdrlen;

	memcpy(opt->srcrt, hdr, sizeof(*hdr));
	irthdr = (struct rt0_hdr*)opt->srcrt;
	irthdr->reserved = 0;
	opt->srcrt->segments_left = n;
	for (i=0; i<n; i++)
		memcpy(irthdr->addr+i, rthdr->addr+(n-1-i), 16);
	return opt;
}

EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);

/**********************************
  Hop-by-hop options.
 **********************************/

/* Router Alert as of RFC 2711 */

static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
{
	if (skb->nh.raw[optoff+1] == 2) {
		IP6CB(skb)->ra = optoff;
		return 1;
	}
	LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
	               skb->nh.raw[optoff+1]);
	kfree_skb(skb);
	return 0;
}

/* Jumbo payload */

static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
{
	u32 pkt_len;

	if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
		LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
		               skb->nh.raw[optoff+1]);
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		goto drop;
	}

	pkt_len = ntohl(*(u32*)(skb->nh.raw+optoff+2));
	if (pkt_len <= IPV6_MAXPLEN) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
		return 0;
	}
	if (skb->nh.ipv6h->payload_len) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
		return 0;
	}

	if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
		IP6_INC_STATS_BH(IPSTATS_MIB_INTRUNCATEDPKTS);
		goto drop;
	}

	if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
		goto drop;

	return 1;

drop:
	kfree_skb(skb);
	return 0;
}

static struct tlvtype_proc tlvprochopopt_lst[] = {
	{
		.type	= IPV6_TLV_ROUTERALERT,
		.func	= ipv6_hop_ra,
	},
	{
		.type	= IPV6_TLV_JUMBO,
		.func	= ipv6_hop_jumbo,
	},
	{ -1, }
};

int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff)
{
	struct inet6_skb_parm *opt = IP6CB(skb);

	opt->hop = sizeof(struct ipv6hdr);
	if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
		skb->h.raw += (skb->h.raw[1]+1)<<3;
		opt->nhoff = sizeof(struct ipv6hdr);
		return sizeof(struct ipv6hdr);
	}
	return -1;
}

/*
 *	Creating outbound headers.
 *
 *	"build" functions work when skb is filled from head to tail (datagram)
 *	"push"	functions work when headers are added from tail to head (tcp)
 *
 *	In both cases we assume, that caller reserved enough room
 *	for headers.
 */

static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
			    struct ipv6_rt_hdr *opt,
			    struct in6_addr **addr_p)
{
	struct rt0_hdr *phdr, *ihdr;
	int hops;

	ihdr = (struct rt0_hdr *) opt;
	
	phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
	memcpy(phdr, ihdr, sizeof(struct rt0_hdr));

	hops = ihdr->rt_hdr.hdrlen >> 1;

	if (hops > 1)
		memcpy(phdr->addr, ihdr->addr + 1,
		       (hops - 1) * sizeof(struct in6_addr));

	ipv6_addr_copy(phdr->addr + (hops - 1), *addr_p);
	*addr_p = ihdr->addr;

	phdr->rt_hdr.nexthdr = *proto;
	*proto = NEXTHDR_ROUTING;
}

static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
{
	struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));

	memcpy(h, opt, ipv6_optlen(opt));
	h->nexthdr = *proto;
	*proto = type;
}

void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
			  u8 *proto,
			  struct in6_addr **daddr)
{
	if (opt->srcrt) {
		ipv6_push_rthdr(skb, proto, opt->srcrt, daddr);
		/*
		 * IPV6_RTHDRDSTOPTS is ignored
		 * unless IPV6_RTHDR is set (RFC3542).
		 */
		if (opt->dst0opt)
			ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
	}
	if (opt->hopopt)
		ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
}

void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
{
	if (opt->dst1opt)
		ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
}

struct ipv6_txoptions *
ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
{
	struct ipv6_txoptions *opt2;

	opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
	if (opt2) {
		long dif = (char*)opt2 - (char*)opt;
		memcpy(opt2, opt, opt->tot_len);
		if (opt2->hopopt)
			*((char**)&opt2->hopopt) += dif;
		if (opt2->dst0opt)
			*((char**)&opt2->dst0opt) += dif;
		if (opt2->dst1opt)
			*((char**)&opt2->dst1opt) += dif;
		if (opt2->srcrt)
			*((char**)&opt2->srcrt) += dif;
	}
	return opt2;
}

EXPORT_SYMBOL_GPL(ipv6_dup_options);

static int ipv6_renew_option(void *ohdr,
			     struct ipv6_opt_hdr __user *newopt, int newoptlen,
			     int inherit,
			     struct ipv6_opt_hdr **hdr,
			     char **p)
{
	if (inherit) {
		if (ohdr) {
			memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
			*hdr = (struct ipv6_opt_hdr *)*p;
			*p += CMSG_ALIGN(ipv6_optlen(*(struct ipv6_opt_hdr **)hdr));
		}
	} else {
		if (newopt) {
			if (copy_from_user(*p, newopt, newoptlen))
				return -EFAULT;
			*hdr = (struct ipv6_opt_hdr *)*p;
			if (ipv6_optlen(*(struct ipv6_opt_hdr **)hdr) > newoptlen)
				return -EINVAL;
			*p += CMSG_ALIGN(newoptlen);
		}
	}
	return 0;
}

struct ipv6_txoptions *
ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
		   int newtype,
		   struct ipv6_opt_hdr __user *newopt, int newoptlen)
{
	int tot_len = 0;
	char *p;
	struct ipv6_txoptions *opt2;
	int err;

	if (newtype != IPV6_HOPOPTS && opt->hopopt)
		tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
	if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
		tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
	if (newtype != IPV6_RTHDR && opt->srcrt)
		tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
	if (newtype != IPV6_DSTOPTS && opt->dst1opt)
		tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
	if (newopt && newoptlen)
		tot_len += CMSG_ALIGN(newoptlen);

	if (!tot_len)
		return NULL;

	tot_len += sizeof(*opt2);
	opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
	if (!opt2)
		return ERR_PTR(-ENOBUFS);

	memset(opt2, 0, tot_len);

	opt2->tot_len = tot_len;
	p = (char *)(opt2 + 1);

	err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,
				newtype != IPV6_HOPOPTS,
				&opt2->hopopt, &p);
	if (err)
		goto out;

	err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,
				newtype != IPV6_RTHDRDSTOPTS,
				&opt2->dst0opt, &p);
	if (err)
		goto out;

	err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,
				newtype != IPV6_RTHDR,
				(struct ipv6_opt_hdr **)opt2->srcrt, &p);
	if (err)
		goto out;

	err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,
				newtype != IPV6_DSTOPTS,
				&opt2->dst1opt, &p);
	if (err)
		goto out;

	opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
			  (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
			  (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
	opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);

	return opt2;
out:
	sock_kfree_s(sk, opt2, opt2->tot_len);
	return ERR_PTR(err);
}

struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
					  struct ipv6_txoptions *opt)
{
	/*
	 * ignore the dest before srcrt unless srcrt is being included.
	 * --yoshfuji
	 */
	if (opt && opt->dst0opt && !opt->srcrt) {
		if (opt_space != opt) {
			memcpy(opt_space, opt, sizeof(*opt_space));
			opt = opt_space;
		}
		opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
		opt->dst0opt = NULL;
	}

	return opt;
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	* Extension Header handling for IPv6
	3	* Linux INET6 implementation
	4	*
	5	* Authors:
	6	* Pedro Roque <roque@di.fc.ul.pt>
	7	* Andi Kleen <ak@muc.de>
	8	* Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
	9	*
	10	* $Id: exthdrs.c,v 1.13 2001/06/19 15:58:56 davem Exp $
	11	*
	12	* This program is free software; you can redistribute it and/or
	13	* modify it under the terms of the GNU General Public License
	14	* as published by the Free Software Foundation; either version
	15	* 2 of the License, or (at your option) any later version.
	16	*/
	17
	18	/* Changes:
	19	* yoshfuji : ensure not to overrun while parsing
	20	* tlv options.
	21	* Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
	22	* YOSHIFUJI Hideaki @USAGI Register inbound extension header
	23	* handlers as inet6_protocol{}.
	24	*/
	25
	26	#include <linux/errno.h>
	27	#include <linux/types.h>
	28	#include <linux/socket.h>
	29	#include <linux/sockios.h>
	30	#include <linux/sched.h>
	31	#include <linux/net.h>
	32	#include <linux/netdevice.h>
	33	#include <linux/in6.h>
	34	#include <linux/icmpv6.h>
	35
	36	#include <net/sock.h>
	37	#include <net/snmp.h>
	38
	39	#include <net/ipv6.h>
	40	#include <net/protocol.h>
	41	#include <net/transp_v6.h>
	42	#include <net/rawv6.h>
	43	#include <net/ndisc.h>
	44	#include <net/ip6_route.h>
	45	#include <net/addrconf.h>
	46
	47	#include <asm/uaccess.h>
	48
	49	/*
	50	* Parsing tlv encoded headers.
	51	*
	52	* Parsing function "func" returns 1, if parsing succeed
	53	* and 0, if it failed.
	54	* It MUST NOT touch skb->h.
	55	*/
	56
	57	struct tlvtype_proc {
	58	int type;
	59	int (func)(struct sk_buff skb, int offset);
	60	};
	61
	62	/*********************
	63	Generic functions
	64	*********************/
65
66	/* An unknown option is detected, decide what to do */
67
68	static int ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
69	{
70	switch ((skb->nh.raw[optoff] & 0xC0) >> 6) {
71	case 0: /* ignore */
72	return 1;
73
74	case 1: /* drop packet */
75	break;
76
77	case 3: /* Send ICMP if not a multicast address and drop packet */
78	/* Actually, it is redundant check. icmp_send
79	will recheck in any case.
80	*/
81	if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr))
82	break;
83	case 2: /* send ICMP PARM PROB regardless and drop packet */
84	icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
85	return 0;
86	};
87
88	kfree_skb(skb);
89	return 0;
90	}
91
92	/* Parse tlv encoded option header (hop-by-hop or destination) */
93
94	static int ip6_parse_tlv(struct tlvtype_proc procs, struct sk_buff skb)
95	{
96	struct tlvtype_proc *curr;
97	int off = skb->h.raw - skb->nh.raw;
98	int len = ((skb->h.raw[1]+1)<<3);
99
100	if ((skb->h.raw + len) - skb->data > skb_headlen(skb))
101	goto bad;
102
103	off += 2;
104	len -= 2;
105
106	while (len > 0) {
107	int optlen = skb->nh.raw[off+1]+2;
108
109	switch (skb->nh.raw[off]) {
110	case IPV6_TLV_PAD0:
111	optlen = 1;
112	break;
113
114	case IPV6_TLV_PADN:
115	break;
116
117	default: /* Other TLV code so scan list */
118	if (optlen > len)
119	goto bad;
120	for (curr=procs; curr->type >= 0; curr++) {
121	if (curr->type == skb->nh.raw[off]) {
122	/* type specific length/alignment
123	checks will be performed in the
124	func(). */
125	if (curr->func(skb, off) == 0)
126	return 0;
127	break;
128	}
129	}
130	if (curr->type < 0) {
131	if (ip6_tlvopt_unknown(skb, off) == 0)
132	return 0;
133	}
134	break;
135	}
136	off += optlen;
137	len -= optlen;
138	}
139	if (len == 0)
140	return 1;
141	bad:
142	kfree_skb(skb);
143	return 0;
144	}
145
146	/*****************************
147	Destination options header.
148	*****************************/
149
150	static struct tlvtype_proc tlvprocdestopt_lst[] = {
151	/* No destination options are defined now */
152	{-1, NULL}
153	};
154
951dbc8a	155	static int ipv6_destopt_rcv(struct sk_buff **skbp)
1da177e4 LT	156	{
	157	struct sk_buff skb = skbp;
	158	struct inet6_skb_parm *opt = IP6CB(skb);
	159
	160	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) \|\|
	161	!pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
	162	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	163	kfree_skb(skb);
	164	return -1;
	165	}
	166
333fad53	167	opt->lastopt = skb->h.raw - skb->nh.raw;
1da177e4 LT	168	opt->dst1 = skb->h.raw - skb->nh.raw;
	169
	170	if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
	171	skb->h.raw += ((skb->h.raw[1]+1)<<3);
951dbc8a	172	opt->nhoff = opt->dst1;
1da177e4 LT	173	return 1;
	174	}
	175
	176	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	177	return -1;
	178	}
	179
	180	static struct inet6_protocol destopt_protocol = {
	181	.handler = ipv6_destopt_rcv,
	182	.flags = INET6_PROTO_NOPOLICY,
	183	};
	184
	185	void __init ipv6_destopt_init(void)
	186	{
	187	if (inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS) < 0)
	188	printk(KERN_ERR "ipv6_destopt_init: Could not register protocol\n");
	189	}
	190
	191	/********************************
	192	NONE header. No data in packet.
	193	********************************/
	194
951dbc8a	195	static int ipv6_nodata_rcv(struct sk_buff **skbp)
1da177e4 LT	196	{
	197	struct sk_buff skb = skbp;
	198
	199	kfree_skb(skb);
	200	return 0;
	201	}
	202
	203	static struct inet6_protocol nodata_protocol = {
	204	.handler = ipv6_nodata_rcv,
	205	.flags = INET6_PROTO_NOPOLICY,
	206	};
	207
	208	void __init ipv6_nodata_init(void)
	209	{
	210	if (inet6_add_protocol(&nodata_protocol, IPPROTO_NONE) < 0)
	211	printk(KERN_ERR "ipv6_nodata_init: Could not register protocol\n");
	212	}
	213
	214	/********************************
	215	Routing header.
	216	********************************/
	217
951dbc8a	218	static int ipv6_rthdr_rcv(struct sk_buff **skbp)
1da177e4 LT	219	{
	220	struct sk_buff skb = skbp;
	221	struct inet6_skb_parm *opt = IP6CB(skb);
	222	struct in6_addr *addr;
	223	struct in6_addr daddr;
	224	int n, i;
	225
	226	struct ipv6_rt_hdr *hdr;
	227	struct rt0_hdr *rthdr;
	228
	229	if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) \|\|
	230	!pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
	231	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	232	kfree_skb(skb);
	233	return -1;
	234	}
	235
	236	hdr = (struct ipv6_rt_hdr *) skb->h.raw;
	237
	238	if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) \|\|
	239	skb->pkt_type != PACKET_HOST) {
	240	IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
	241	kfree_skb(skb);
	242	return -1;
	243	}
	244
	245	looped_back:
	246	if (hdr->segments_left == 0) {
333fad53	247	opt->lastopt = skb->h.raw - skb->nh.raw;
1da177e4 LT	248	opt->srcrt = skb->h.raw - skb->nh.raw;
	249	skb->h.raw += (hdr->hdrlen + 1) << 3;
	250	opt->dst0 = opt->dst1;
	251	opt->dst1 = 0;
951dbc8a	252	opt->nhoff = (&hdr->nexthdr) - skb->nh.raw;
1da177e4 LT	253	return 1;
	254	}
	255
	256	if (hdr->type != IPV6_SRCRT_TYPE_0) {
	257	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	258	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
	259	return -1;
	260	}
	261
	262	if (hdr->hdrlen & 0x01) {
	263	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	264	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->hdrlen) - skb->nh.raw);
	265	return -1;
	266	}
	267
	268	/*
	269	* This is the routing header forwarding algorithm from
	270	* RFC 2460, page 16.
	271	*/
	272
	273	n = hdr->hdrlen >> 1;
	274
	275	if (hdr->segments_left > n) {
	276	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	277	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->segments_left) - skb->nh.raw);
	278	return -1;
	279	}
	280
	281	/* We are about to mangle packet header. Be careful!
	282	Do not damage packets queued somewhere.
	283	*/
	284	if (skb_cloned(skb)) {
	285	struct sk_buff *skb2 = skb_copy(skb, GFP_ATOMIC);
	286	kfree_skb(skb);
	287	/* the copy is a forwarded packet */
	288	if (skb2 == NULL) {
	289	IP6_INC_STATS_BH(IPSTATS_MIB_OUTDISCARDS);
	290	return -1;
	291	}
	292	*skbp = skb = skb2;
	293	opt = IP6CB(skb2);
	294	hdr = (struct ipv6_rt_hdr *) skb2->h.raw;
	295	}
	296
	297	if (skb->ip_summed == CHECKSUM_HW)
	298	skb->ip_summed = CHECKSUM_NONE;
	299
	300	i = n - --hdr->segments_left;
	301
	302	rthdr = (struct rt0_hdr *) hdr;
	303	addr = rthdr->addr;
	304	addr += i - 1;
	305
	306	if (ipv6_addr_is_multicast(addr)) {
	307	IP6_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
	308	kfree_skb(skb);
	309	return -1;
	310	}
	311
	312	ipv6_addr_copy(&daddr, addr);
	313	ipv6_addr_copy(addr, &skb->nh.ipv6h->daddr);
	314	ipv6_addr_copy(&skb->nh.ipv6h->daddr, &daddr);
	315
	316	dst_release(xchg(&skb->dst, NULL));
317	ip6_route_input(skb);
318	if (skb->dst->error) {
319	skb_push(skb, skb->data - skb->nh.raw);
320	dst_input(skb);
321	return -1;
322	}
323
324	if (skb->dst->dev->flags&IFF_LOOPBACK) {
325	if (skb->nh.ipv6h->hop_limit <= 1) {
326	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
327	icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
328	0, skb->dev);
329	kfree_skb(skb);
330	return -1;
331	}
332	skb->nh.ipv6h->hop_limit--;
333	goto looped_back;
334	}
335
336	skb_push(skb, skb->data - skb->nh.raw);
337	dst_input(skb);
338	return -1;
339	}
340
341	static struct inet6_protocol rthdr_protocol = {
342	.handler = ipv6_rthdr_rcv,
343	.flags = INET6_PROTO_NOPOLICY,
344	};
345
346	void __init ipv6_rthdr_init(void)
347	{
348	if (inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING) < 0)
349	printk(KERN_ERR "ipv6_rthdr_init: Could not register protocol\n");
350	};
351
352	/*
353	This function inverts received rthdr.
354	NOTE: specs allow to make it automatically only if
355	packet authenticated.
356
357	I will not discuss it here (though, I am really pissed off at
358	this stupid requirement making rthdr idea useless)
359
360	Actually, it creates severe problems for us.
361	Embryonic requests has no associated sockets,
362	so that user have no control over it and
363	cannot not only to set reply options, but
364	even to know, that someone wants to connect
365	without success. :-(
366
367	For now we need to test the engine, so that I created
368	temporary (or permanent) backdoor.
369	If listening socket set IPV6_RTHDR to 2, then we invert header.
370	--ANK (980729)
371	*/
372
373	struct ipv6_txoptions *
374	ipv6_invert_rthdr(struct sock sk, struct ipv6_rt_hdr hdr)
375	{
376	/* Received rthdr:
377
378	[ H1 -> H2 -> ... H_prev ] daddr=ME
379
380	Inverted result:
381	[ H_prev -> ... -> H1 ] daddr =sender
382
383	Note, that IP output engine will rewrite this rthdr
384	by rotating it left by one addr.
385	*/
386
387	int n, i;
388	struct rt0_hdr rthdr = (struct rt0_hdr)hdr;
389	struct rt0_hdr *irthdr;
390	struct ipv6_txoptions *opt;
391	int hdrlen = ipv6_optlen(hdr);
392
393	if (hdr->segments_left \|\|
394	hdr->type != IPV6_SRCRT_TYPE_0 \|\|
395	hdr->hdrlen & 0x01)
396	return NULL;
397
398	n = hdr->hdrlen >> 1;
399	opt = sock_kmalloc(sk, sizeof(*opt) + hdrlen, GFP_ATOMIC);
400	if (opt == NULL)
401	return NULL;
402	memset(opt, 0, sizeof(*opt));
403	opt->tot_len = sizeof(*opt) + hdrlen;
404	opt->srcrt = (void*)(opt+1);
405	opt->opt_nflen = hdrlen;
406
407	memcpy(opt->srcrt, hdr, sizeof(*hdr));
408	irthdr = (struct rt0_hdr*)opt->srcrt;
e6df439b	409	irthdr->reserved = 0;
1da177e4 LT	410	opt->srcrt->segments_left = n;
	411	for (i=0; i<n; i++)
	412	memcpy(irthdr->addr+i, rthdr->addr+(n-1-i), 16);
	413	return opt;
	414	}
	415
3cf3dc6c ACM	416	EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);
3cf3dc6c ACM	417
1da177e4 LT	418	/**********************************
	419	Hop-by-hop options.
	420	**********************************/
	421
	422	/* Router Alert as of RFC 2711 */
	423
	424	static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
	425	{
	426	if (skb->nh.raw[optoff+1] == 2) {
	427	IP6CB(skb)->ra = optoff;
	428	return 1;
	429	}
64ce2073 PM	430	LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
64ce2073 PM	431	skb->nh.raw[optoff+1]);
1da177e4 LT	432	kfree_skb(skb);
	433	return 0;
	434	}
	435
	436	/* Jumbo payload */
	437
	438	static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
	439	{
	440	u32 pkt_len;
	441
	442	if (skb->nh.raw[optoff+1] != 4 \|\| (optoff&3) != 2) {
64ce2073 PM	443	LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
64ce2073 PM	444	skb->nh.raw[optoff+1]);
1da177e4 LT	445	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	446	goto drop;
	447	}
	448
	449	pkt_len = ntohl((u32)(skb->nh.raw+optoff+2));
	450	if (pkt_len <= IPV6_MAXPLEN) {
	451	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	452	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
	453	return 0;
	454	}
	455	if (skb->nh.ipv6h->payload_len) {
	456	IP6_INC_STATS_BH(IPSTATS_MIB_INHDRERRORS);
	457	icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
	458	return 0;
	459	}
	460
	461	if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
	462	IP6_INC_STATS_BH(IPSTATS_MIB_INTRUNCATEDPKTS);
	463	goto drop;
	464	}
42ca89c1 SH	465
	466	if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
	467	goto drop;
	468
1da177e4 LT	469	return 1;
	470
	471	drop:
	472	kfree_skb(skb);
	473	return 0;
	474	}
	475
	476	static struct tlvtype_proc tlvprochopopt_lst[] = {
	477	{
	478	.type = IPV6_TLV_ROUTERALERT,
	479	.func = ipv6_hop_ra,
	480	},
	481	{
	482	.type = IPV6_TLV_JUMBO,
	483	.func = ipv6_hop_jumbo,
	484	},
	485	{ -1, }
	486	};
	487
	488	int ipv6_parse_hopopts(struct sk_buff *skb, int nhoff)
	489	{
951dbc8a PM	490	struct inet6_skb_parm *opt = IP6CB(skb);
	491
	492	opt->hop = sizeof(struct ipv6hdr);
	493	if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
	494	skb->h.raw += (skb->h.raw[1]+1)<<3;
	495	opt->nhoff = sizeof(struct ipv6hdr);
1da177e4	496	return sizeof(struct ipv6hdr);
951dbc8a	497	}
1da177e4 LT	498	return -1;
	499	}
	500
	501	/*
	502	* Creating outbound headers.
	503	*
	504	* "build" functions work when skb is filled from head to tail (datagram)
	505	* "push" functions work when headers are added from tail to head (tcp)
	506	*
	507	* In both cases we assume, that caller reserved enough room
	508	* for headers.
	509	*/
	510
	511	static void ipv6_push_rthdr(struct sk_buff skb, u8 proto,
	512	struct ipv6_rt_hdr *opt,
	513	struct in6_addr **addr_p)
	514	{
	515	struct rt0_hdr phdr, ihdr;
	516	int hops;
	517
	518	ihdr = (struct rt0_hdr *) opt;
	519
	520	phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
	521	memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
	522
	523	hops = ihdr->rt_hdr.hdrlen >> 1;
	524
	525	if (hops > 1)
	526	memcpy(phdr->addr, ihdr->addr + 1,
	527	(hops - 1) * sizeof(struct in6_addr));
	528
	529	ipv6_addr_copy(phdr->addr + (hops - 1), *addr_p);
	530	*addr_p = ihdr->addr;
	531
	532	phdr->rt_hdr.nexthdr = *proto;
	533	*proto = NEXTHDR_ROUTING;
	534	}
	535
	536	static void ipv6_push_exthdr(struct sk_buff skb, u8 proto, u8 type, struct ipv6_opt_hdr *opt)
	537	{
	538	struct ipv6_opt_hdr h = (struct ipv6_opt_hdr )skb_push(skb, ipv6_optlen(opt));
	539
	540	memcpy(h, opt, ipv6_optlen(opt));
	541	h->nexthdr = *proto;
	542	*proto = type;
	543	}
	544
	545	void ipv6_push_nfrag_opts(struct sk_buff skb, struct ipv6_txoptions opt,
	546	u8 *proto,
	547	struct in6_addr **daddr)
	548	{
333fad53	549	if (opt->srcrt) {
1da177e4	550	ipv6_push_rthdr(skb, proto, opt->srcrt, daddr);
333fad53 YH	551	/*
	552	* IPV6_RTHDRDSTOPTS is ignored
	553	* unless IPV6_RTHDR is set (RFC3542).
	554	*/
	555	if (opt->dst0opt)
	556	ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
	557	}
1da177e4 LT	558	if (opt->hopopt)
	559	ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
	560	}
	561
	562	void ipv6_push_frag_opts(struct sk_buff skb, struct ipv6_txoptions opt, u8 *proto)
	563	{
	564	if (opt->dst1opt)
	565	ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
	566	}
	567
	568	struct ipv6_txoptions *
	569	ipv6_dup_options(struct sock sk, struct ipv6_txoptions opt)
	570	{
	571	struct ipv6_txoptions *opt2;
	572
	573	opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
	574	if (opt2) {
	575	long dif = (char)opt2 - (char)opt;
	576	memcpy(opt2, opt, opt->tot_len);
	577	if (opt2->hopopt)
	578	((char*)&opt2->hopopt) += dif;
	579	if (opt2->dst0opt)
	580	((char*)&opt2->dst0opt) += dif;
	581	if (opt2->dst1opt)
	582	((char*)&opt2->dst1opt) += dif;
	583	if (opt2->srcrt)
	584	((char*)&opt2->srcrt) += dif;
	585	}
	586	return opt2;
	587	}
333fad53	588
3cf3dc6c ACM	589	EXPORT_SYMBOL_GPL(ipv6_dup_options);
3cf3dc6c ACM	590
333fad53 YH	591	static int ipv6_renew_option(void *ohdr,
	592	struct ipv6_opt_hdr __user *newopt, int newoptlen,
	593	int inherit,
	594	struct ipv6_opt_hdr **hdr,
	595	char **p)
	596	{
	597	if (inherit) {
	598	if (ohdr) {
	599	memcpy(p, ohdr, ipv6_optlen((struct ipv6_opt_hdr )ohdr));
	600	hdr = (struct ipv6_opt_hdr )*p;
	601	p += CMSG_ALIGN(ipv6_optlen((struct ipv6_opt_hdr **)hdr));
	602	}
	603	} else {
	604	if (newopt) {
	605	if (copy_from_user(*p, newopt, newoptlen))
	606	return -EFAULT;
	607	hdr = (struct ipv6_opt_hdr )*p;
	608	if (ipv6_optlen((struct ipv6_opt_hdr *)hdr) > newoptlen)
	609	return -EINVAL;
	610	*p += CMSG_ALIGN(newoptlen);
	611	}
	612	}
	613	return 0;
	614	}
	615
	616	struct ipv6_txoptions *
	617	ipv6_renew_options(struct sock sk, struct ipv6_txoptions opt,
	618	int newtype,
	619	struct ipv6_opt_hdr __user *newopt, int newoptlen)
	620	{
	621	int tot_len = 0;
	622	char *p;
	623	struct ipv6_txoptions *opt2;
	624	int err;
	625
	626	if (newtype != IPV6_HOPOPTS && opt->hopopt)
	627	tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
	628	if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
	629	tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
	630	if (newtype != IPV6_RTHDR && opt->srcrt)
	631	tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
	632	if (newtype != IPV6_DSTOPTS && opt->dst1opt)
	633	tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
	634	if (newopt && newoptlen)
	635	tot_len += CMSG_ALIGN(newoptlen);
	636
	637	if (!tot_len)
	638	return NULL;
	639
8b8aa4b5	640	tot_len += sizeof(*opt2);
333fad53 YH	641	opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
	642	if (!opt2)
	643	return ERR_PTR(-ENOBUFS);
	644
	645	memset(opt2, 0, tot_len);
	646
	647	opt2->tot_len = tot_len;
	648	p = (char *)(opt2 + 1);
	649
	650	err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,
	651	newtype != IPV6_HOPOPTS,
	652	&opt2->hopopt, &p);
	653	if (err)
	654	goto out;
	655
	656	err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,
	657	newtype != IPV6_RTHDRDSTOPTS,
	658	&opt2->dst0opt, &p);
	659	if (err)
	660	goto out;
	661
	662	err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,
	663	newtype != IPV6_RTHDR,
	664	(struct ipv6_opt_hdr **)opt2->srcrt, &p);
	665	if (err)
	666	goto out;
	667
	668	err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,
	669	newtype != IPV6_DSTOPTS,
	670	&opt2->dst1opt, &p);
	671	if (err)
	672	goto out;
	673
	674	opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
	675	(opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
	676	(opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
	677	opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
	678
	679	return opt2;
	680	out:
8b8aa4b5	681	sock_kfree_s(sk, opt2, opt2->tot_len);
333fad53 YH	682	return ERR_PTR(err);
	683	}
	684
df9890c3 YH	685	struct ipv6_txoptions ipv6_fixup_options(struct ipv6_txoptions opt_space,
	686	struct ipv6_txoptions *opt)
	687	{
	688	/*
	689	* ignore the dest before srcrt unless srcrt is being included.
	690	* --yoshfuji
	691	*/
	692	if (opt && opt->dst0opt && !opt->srcrt) {
	693	if (opt_space != opt) {
	694	memcpy(opt_space, opt, sizeof(*opt_space));
	695	opt = opt_space;
	696	}
	697	opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
	698	opt->dst0opt = NULL;
	699	}
	700
	701	return opt;
	702	}
	703