net/ipv6/exthdrs.c

   1 /*
   2  *      Extension Header handling for IPv6
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *      Andi Kleen              <ak@muc.de>
   8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
   9  *
  10  *      This program is free software; you can redistribute it and/or
  11  *      modify it under the terms of the GNU General Public License
  12  *      as published by the Free Software Foundation; either version
  13  *      2 of the License, or (at your option) any later version.
  14  */
  15
  16 /* Changes:
  17  *      yoshfuji                : ensure not to overrun while parsing
  18  *                                tlv options.
  19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
  20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
  21  *                                handlers as inet6_protocol{}.
  22  */
  23
  24 #include <linux/errno.h>
  25 #include <linux/types.h>
  26 #include <linux/socket.h>
  27 #include <linux/sockios.h>
  28 #include <linux/net.h>
  29 #include <linux/netdevice.h>
  30 #include <linux/in6.h>
  31 #include <linux/icmpv6.h>
  32 #include <linux/slab.h>
  33 #include <linux/export.h>
  34
  35 #include <net/dst.h>
  36 #include <net/sock.h>
  37 #include <net/snmp.h>
  38
  39 #include <net/ipv6.h>
  40 #include <net/protocol.h>
  41 #include <net/transp_v6.h>
  42 #include <net/rawv6.h>
  43 #include <net/ndisc.h>
  44 #include <net/ip6_route.h>
  45 #include <net/addrconf.h>
  46 #if IS_ENABLED(CONFIG_IPV6_MIP6)
  47 #include <net/xfrm.h>
  48 #endif
  49
  50 #include <asm/uaccess.h>
  51 #include "ip6_offload.h"
  52
  53 /*
  54  *      Parsing tlv encoded headers.
  55  *
  56  *      Parsing function "func" returns true, if parsing succeed
  57  *      and false, if it failed.
  58  *      It MUST NOT touch skb->h.
  59  */
  60
  61 struct tlvtype_proc {
  62         int     type;
  63         bool    (*func)(struct sk_buff *skb, int offset);
  64 };
  65
  66 /*********************
  67   Generic functions
  68  *********************/
  69
  70 /* An unknown option is detected, decide what to do */
  71
  72 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
  73 {
  74         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
  75         case 0: /* ignore */
  76                 return true;
  77
  78         case 1: /* drop packet */
  79                 break;
  80
  81         case 3: /* Send ICMP if not a multicast address and drop packet */
  82                 /* Actually, it is redundant check. icmp_send
  83                    will recheck in any case.
  84                  */
  85                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
  86                         break;
  87         case 2: /* send ICMP PARM PROB regardless and drop packet */
  88                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
  89                 return false;
  90         }
  91
  92         kfree_skb(skb);
  93         return false;
  94 }
  95
  96 /* Parse tlv encoded option header (hop-by-hop or destination) */
  97
  98 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
  99 {
 100         const struct tlvtype_proc *curr;
 101         const unsigned char *nh = skb_network_header(skb);
 102         int off = skb_network_header_len(skb);
 103         int len = (skb_transport_header(skb)[1] + 1) << 3;
 104         int padlen = 0;
 105
 106         if (skb_transport_offset(skb) + len > skb_headlen(skb))
 107                 goto bad;
 108
 109         off += 2;
 110         len -= 2;
 111
 112         while (len > 0) {
 113                 int optlen = nh[off + 1] + 2;
 114                 int i;
 115
 116                 switch (nh[off]) {
 117                 case IPV6_TLV_PAD1:
 118                         optlen = 1;
 119                         padlen++;
 120                         if (padlen > 7)
 121                                 goto bad;
 122                         break;
 123
 124                 case IPV6_TLV_PADN:
 125                         /* RFC 2460 states that the purpose of PadN is
 126                          * to align the containing header to multiples
 127                          * of 8. 7 is therefore the highest valid value.
 128                          * See also RFC 4942, Section 2.1.9.5.
 129                          */
 130                         padlen += optlen;
 131                         if (padlen > 7)
 132                                 goto bad;
 133                         /* RFC 4942 recommends receiving hosts to
 134                          * actively check PadN payload to contain
 135                          * only zeroes.
 136                          */
 137                         for (i = 2; i < optlen; i++) {
 138                                 if (nh[off + i] != 0)
 139                                         goto bad;
 140                         }
 141                         break;
 142
 143                 default: /* Other TLV code so scan list */
 144                         if (optlen > len)
 145                                 goto bad;
 146                         for (curr=procs; curr->type >= 0; curr++) {
 147                                 if (curr->type == nh[off]) {
 148                                         /* type specific length/alignment
 149                                            checks will be performed in the
 150                                            func(). */
 151                                         if (curr->func(skb, off) == false)
 152                                                 return false;
 153                                         break;
 154                                 }
 155                         }
 156                         if (curr->type < 0) {
 157                                 if (ip6_tlvopt_unknown(skb, off) == 0)
 158                                         return false;
 159                         }
 160                         padlen = 0;
 161                         break;
 162                 }
 163                 off += optlen;
 164                 len -= optlen;
 165         }
 166         /* This case will not be caught by above check since its padding
 167          * length is smaller than 7:
 168          * 1 byte NH + 1 byte Length + 6 bytes Padding
 169          */
 170         if ((padlen == 6) && ((off - skb_network_header_len(skb)) == 8))
 171                 goto bad;
 172
 173         if (len == 0)
 174                 return true;
 175 bad:
 176         kfree_skb(skb);
 177         return false;
 178 }
 179
 180 /*****************************
 181   Destination options header.
 182  *****************************/
 183
 184 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 185 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
 186 {
 187         struct ipv6_destopt_hao *hao;
 188         struct inet6_skb_parm *opt = IP6CB(skb);
 189         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 190         struct in6_addr tmp_addr;
 191         int ret;
 192
 193         if (opt->dsthao) {
 194                 LIMIT_NETDEBUG(KERN_DEBUG "hao duplicated\n");
 195                 goto discard;
 196         }
 197         opt->dsthao = opt->dst1;
 198         opt->dst1 = 0;
 199
 200         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
 201
 202         if (hao->length != 16) {
 203                 LIMIT_NETDEBUG(
 204                         KERN_DEBUG "hao invalid option length = %d\n", hao->length);
 205                 goto discard;
 206         }
 207
 208         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
 209                 LIMIT_NETDEBUG(
 210                         KERN_DEBUG "hao is not an unicast addr: %pI6\n", &hao->addr);
 211                 goto discard;
 212         }
 213
 214         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
 215                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
 216         if (unlikely(ret < 0))
 217                 goto discard;
 218
 219         if (skb_cloned(skb)) {
 220                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
 221                         goto discard;
 222
 223                 /* update all variable using below by copied skbuff */
 224                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
 225                                                   optoff);
 226                 ipv6h = ipv6_hdr(skb);
 227         }
 228
 229         if (skb->ip_summed == CHECKSUM_COMPLETE)
 230                 skb->ip_summed = CHECKSUM_NONE;
 231
 232         tmp_addr = ipv6h->saddr;
 233         ipv6h->saddr = hao->addr;
 234         hao->addr = tmp_addr;
 235
 236         if (skb->tstamp.tv64 == 0)
 237                 __net_timestamp(skb);
 238
 239         return true;
 240
 241  discard:
 242         kfree_skb(skb);
 243         return false;
 244 }
 245 #endif
 246
 247 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
 248 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 249         {
 250                 .type   = IPV6_TLV_HAO,
 251                 .func   = ipv6_dest_hao,
 252         },
 253 #endif
 254         {-1,                    NULL}
 255 };
 256
 257 static int ipv6_destopt_rcv(struct sk_buff *skb)
 258 {
 259         struct inet6_skb_parm *opt = IP6CB(skb);
 260 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 261         __u16 dstbuf;
 262 #endif
 263         struct dst_entry *dst = skb_dst(skb);
 264
 265         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 266             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 267                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 268                 IP6_INC_STATS_BH(dev_net(dst->dev), ip6_dst_idev(dst),
 269                                  IPSTATS_MIB_INHDRERRORS);
 270                 kfree_skb(skb);
 271                 return -1;
 272         }
 273
 274         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
 275 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 276         dstbuf = opt->dst1;
 277 #endif
 278
 279         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
 280                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 281                 opt = IP6CB(skb);
 282 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 283                 opt->nhoff = dstbuf;
 284 #else
 285                 opt->nhoff = opt->dst1;
 286 #endif
 287                 return 1;
 288         }
 289
 290         IP6_INC_STATS_BH(dev_net(dst->dev),
 291                          ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
 292         return -1;
 293 }
 294
 295 /********************************
 296   Routing header.
 297  ********************************/
 298
 299 /* called with rcu_read_lock() */
 300 static int ipv6_rthdr_rcv(struct sk_buff *skb)
 301 {
 302         struct inet6_skb_parm *opt = IP6CB(skb);
 303         struct in6_addr *addr = NULL;
 304         struct in6_addr daddr;
 305         struct inet6_dev *idev;
 306         int n, i;
 307         struct ipv6_rt_hdr *hdr;
 308         struct rt0_hdr *rthdr;
 309         struct net *net = dev_net(skb->dev);
 310         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
 311
 312         idev = __in6_dev_get(skb->dev);
 313         if (idev && accept_source_route > idev->cnf.accept_source_route)
 314                 accept_source_route = idev->cnf.accept_source_route;
 315
 316         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
 317             !pskb_may_pull(skb, (skb_transport_offset(skb) +
 318                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 319                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 320                                  IPSTATS_MIB_INHDRERRORS);
 321                 kfree_skb(skb);
 322                 return -1;
 323         }
 324
 325         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 326
 327         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
 328             skb->pkt_type != PACKET_HOST) {
 329                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 330                                  IPSTATS_MIB_INADDRERRORS);
 331                 kfree_skb(skb);
 332                 return -1;
 333         }
 334
 335 looped_back:
 336         if (hdr->segments_left == 0) {
 337                 switch (hdr->type) {
 338 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 339                 case IPV6_SRCRT_TYPE_2:
 340                         /* Silently discard type 2 header unless it was
 341                          * processed by own
 342                          */
 343                         if (!addr) {
 344                                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 345                                                  IPSTATS_MIB_INADDRERRORS);
 346                                 kfree_skb(skb);
 347                                 return -1;
 348                         }
 349                         break;
 350 #endif
 351                 default:
 352                         break;
 353                 }
 354
 355                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
 356                 skb->transport_header += (hdr->hdrlen + 1) << 3;
 357                 opt->dst0 = opt->dst1;
 358                 opt->dst1 = 0;
 359                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
 360                 return 1;
 361         }
 362
 363         switch (hdr->type) {
 364 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 365         case IPV6_SRCRT_TYPE_2:
 366                 if (accept_source_route < 0)
 367                         goto unknown_rh;
 368                 /* Silently discard invalid RTH type 2 */
 369                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
 370                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 371                                          IPSTATS_MIB_INHDRERRORS);
 372                         kfree_skb(skb);
 373                         return -1;
 374                 }
 375                 break;
 376 #endif
 377         default:
 378                 goto unknown_rh;
 379         }
 380
 381         /*
 382          *      This is the routing header forwarding algorithm from
 383          *      RFC 2460, page 16.
 384          */
 385
 386         n = hdr->hdrlen >> 1;
 387
 388         if (hdr->segments_left > n) {
 389                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 390                                  IPSTATS_MIB_INHDRERRORS);
 391                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 392                                   ((&hdr->segments_left) -
 393                                    skb_network_header(skb)));
 394                 return -1;
 395         }
 396
 397         /* We are about to mangle packet header. Be careful!
 398            Do not damage packets queued somewhere.
 399          */
 400         if (skb_cloned(skb)) {
 401                 /* the copy is a forwarded packet */
 402                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
 403                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 404                                          IPSTATS_MIB_OUTDISCARDS);
 405                         kfree_skb(skb);
 406                         return -1;
 407                 }
 408                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
 409         }
 410
 411         if (skb->ip_summed == CHECKSUM_COMPLETE)
 412                 skb->ip_summed = CHECKSUM_NONE;
 413
 414         i = n - --hdr->segments_left;
 415
 416         rthdr = (struct rt0_hdr *) hdr;
 417         addr = rthdr->addr;
 418         addr += i - 1;
 419
 420         switch (hdr->type) {
 421 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 422         case IPV6_SRCRT_TYPE_2:
 423                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
 424                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
 425                                      IPPROTO_ROUTING) < 0) {
 426                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 427                                          IPSTATS_MIB_INADDRERRORS);
 428                         kfree_skb(skb);
 429                         return -1;
 430                 }
 431                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
 432                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 433                                          IPSTATS_MIB_INADDRERRORS);
 434                         kfree_skb(skb);
 435                         return -1;
 436                 }
 437                 break;
 438 #endif
 439         default:
 440                 break;
 441         }
 442
 443         if (ipv6_addr_is_multicast(addr)) {
 444                 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 445                                  IPSTATS_MIB_INADDRERRORS);
 446                 kfree_skb(skb);
 447                 return -1;
 448         }
 449
 450         daddr = *addr;
 451         *addr = ipv6_hdr(skb)->daddr;
 452         ipv6_hdr(skb)->daddr = daddr;
 453
 454         skb_dst_drop(skb);
 455         ip6_route_input(skb);
 456         if (skb_dst(skb)->error) {
 457                 skb_push(skb, skb->data - skb_network_header(skb));
 458                 dst_input(skb);
 459                 return -1;
 460         }
 461
 462         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
 463                 if (ipv6_hdr(skb)->hop_limit <= 1) {
 464                         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
 465                                          IPSTATS_MIB_INHDRERRORS);
 466                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 467                                     0);
 468                         kfree_skb(skb);
 469                         return -1;
 470                 }
 471                 ipv6_hdr(skb)->hop_limit--;
 472                 goto looped_back;
 473         }
 474
 475         skb_push(skb, skb->data - skb_network_header(skb));
 476         dst_input(skb);
 477         return -1;
 478
 479 unknown_rh:
 480         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
 481         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 482                           (&hdr->type) - skb_network_header(skb));
 483         return -1;
 484 }
 485
 486 static const struct inet6_protocol rthdr_protocol = {
 487         .handler        =       ipv6_rthdr_rcv,
 488         .flags          =       INET6_PROTO_NOPOLICY,
 489 };
 490
 491 static const struct inet6_protocol destopt_protocol = {
 492         .handler        =       ipv6_destopt_rcv,
 493         .flags          =       INET6_PROTO_NOPOLICY,
 494 };
 495
 496 static const struct inet6_protocol nodata_protocol = {
 497         .handler        =       dst_discard,
 498         .flags          =       INET6_PROTO_NOPOLICY,
 499 };
 500
 501 int __init ipv6_exthdrs_init(void)
 502 {
 503         int ret;
 504
 505         ret = ipv6_exthdrs_offload_init();
 506         if (ret)
 507                 goto out;
 508
 509         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 510         if (ret)
 511                 goto out_offload;
 512
 513         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 514         if (ret)
 515                 goto out_rthdr;
 516
 517         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
 518         if (ret)
 519                 goto out_destopt;
 520
 521 out:
 522         return ret;
 523 out_destopt:
 524         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 525 out_rthdr:
 526         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 527 out_offload:
 528         ipv6_exthdrs_offload_exit();
 529         goto out;
 530 };
 531
 532 void ipv6_exthdrs_exit(void)
 533 {
 534         ipv6_exthdrs_offload_exit();
 535         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
 536         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
 537         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
 538 }
 539
 540 /**********************************
 541   Hop-by-hop options.
 542  **********************************/
 543
 544 /*
 545  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
 546  */
 547 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
 548 {
 549         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 550 }
 551
 552 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
 553 {
 554         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
 555 }
 556
 557 /* Router Alert as of RFC 2711 */
 558
 559 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
 560 {
 561         const unsigned char *nh = skb_network_header(skb);
 562
 563         if (nh[optoff + 1] == 2) {
 564                 IP6CB(skb)->ra = optoff;
 565                 return true;
 566         }
 567         LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_ra: wrong RA length %d\n",
 568                        nh[optoff + 1]);
 569         kfree_skb(skb);
 570         return false;
 571 }
 572
 573 /* Jumbo payload */
 574
 575 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 576 {
 577         const unsigned char *nh = skb_network_header(skb);
 578         struct net *net = ipv6_skb_net(skb);
 579         u32 pkt_len;
 580
 581         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
 582                 LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 583                                nh[optoff+1]);
 584                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 585                                  IPSTATS_MIB_INHDRERRORS);
 586                 goto drop;
 587         }
 588
 589         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
 590         if (pkt_len <= IPV6_MAXPLEN) {
 591                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 592                                  IPSTATS_MIB_INHDRERRORS);
 593                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 594                 return false;
 595         }
 596         if (ipv6_hdr(skb)->payload_len) {
 597                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 598                                  IPSTATS_MIB_INHDRERRORS);
 599                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 600                 return false;
 601         }
 602
 603         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
 604                 IP6_INC_STATS_BH(net, ipv6_skb_idev(skb),
 605                                  IPSTATS_MIB_INTRUNCATEDPKTS);
 606                 goto drop;
 607         }
 608
 609         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 610                 goto drop;
 611
 612         return true;
 613
 614 drop:
 615         kfree_skb(skb);
 616         return false;
 617 }
 618
 619 static const struct tlvtype_proc tlvprochopopt_lst[] = {
 620         {
 621                 .type   = IPV6_TLV_ROUTERALERT,
 622                 .func   = ipv6_hop_ra,
 623         },
 624         {
 625                 .type   = IPV6_TLV_JUMBO,
 626                 .func   = ipv6_hop_jumbo,
 627         },
 628         { -1, }
 629 };
 630
 631 int ipv6_parse_hopopts(struct sk_buff *skb)
 632 {
 633         struct inet6_skb_parm *opt = IP6CB(skb);
 634
 635         /*
 636          * skb_network_header(skb) is equal to skb->data, and
 637          * skb_network_header_len(skb) is always equal to
 638          * sizeof(struct ipv6hdr) by definition of
 639          * hop-by-hop options.
 640          */
 641         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
 642             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
 643                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
 644                 kfree_skb(skb);
 645                 return -1;
 646         }
 647
 648         opt->hop = sizeof(struct ipv6hdr);
 649         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
 650                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
 651                 opt = IP6CB(skb);
 652                 opt->nhoff = sizeof(struct ipv6hdr);
 653                 return 1;
 654         }
 655         return -1;
 656 }
 657
 658 /*
 659  *      Creating outbound headers.
 660  *
 661  *      "build" functions work when skb is filled from head to tail (datagram)
 662  *      "push"  functions work when headers are added from tail to head (tcp)
 663  *
 664  *      In both cases we assume, that caller reserved enough room
 665  *      for headers.
 666  */
 667
 668 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
 669                             struct ipv6_rt_hdr *opt,
 670                             struct in6_addr **addr_p)
 671 {
 672         struct rt0_hdr *phdr, *ihdr;
 673         int hops;
 674
 675         ihdr = (struct rt0_hdr *) opt;
 676
 677         phdr = (struct rt0_hdr *) skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
 678         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
 679
 680         hops = ihdr->rt_hdr.hdrlen >> 1;
 681
 682         if (hops > 1)
 683                 memcpy(phdr->addr, ihdr->addr + 1,
 684                        (hops - 1) * sizeof(struct in6_addr));
 685
 686         phdr->addr[hops - 1] = **addr_p;
 687         *addr_p = ihdr->addr;
 688
 689         phdr->rt_hdr.nexthdr = *proto;
 690         *proto = NEXTHDR_ROUTING;
 691 }
 692
 693 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
 694 {
 695         struct ipv6_opt_hdr *h = (struct ipv6_opt_hdr *)skb_push(skb, ipv6_optlen(opt));
 696
 697         memcpy(h, opt, ipv6_optlen(opt));
 698         h->nexthdr = *proto;
 699         *proto = type;
 700 }
 701
 702 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
 703                           u8 *proto,
 704                           struct in6_addr **daddr)
 705 {
 706         if (opt->srcrt) {
 707                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr);
 708                 /*
 709                  * IPV6_RTHDRDSTOPTS is ignored
 710                  * unless IPV6_RTHDR is set (RFC3542).
 711                  */
 712                 if (opt->dst0opt)
 713                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
 714         }
 715         if (opt->hopopt)
 716                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 717 }
 718 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
 719
 720 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
 721 {
 722         if (opt->dst1opt)
 723                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
 724 }
 725
 726 struct ipv6_txoptions *
 727 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
 728 {
 729         struct ipv6_txoptions *opt2;
 730
 731         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
 732         if (opt2) {
 733                 long dif = (char *)opt2 - (char *)opt;
 734                 memcpy(opt2, opt, opt->tot_len);
 735                 if (opt2->hopopt)
 736                         *((char **)&opt2->hopopt) += dif;
 737                 if (opt2->dst0opt)
 738                         *((char **)&opt2->dst0opt) += dif;
 739                 if (opt2->dst1opt)
 740                         *((char **)&opt2->dst1opt) += dif;
 741                 if (opt2->srcrt)
 742                         *((char **)&opt2->srcrt) += dif;
 743         }
 744         return opt2;
 745 }
 746 EXPORT_SYMBOL_GPL(ipv6_dup_options);
 747
 748 static int ipv6_renew_option(void *ohdr,
 749                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
 750                              int inherit,
 751                              struct ipv6_opt_hdr **hdr,
 752                              char **p)
 753 {
 754         if (inherit) {
 755                 if (ohdr) {
 756                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
 757                         *hdr = (struct ipv6_opt_hdr *)*p;
 758                         *p += CMSG_ALIGN(ipv6_optlen(*hdr));
 759                 }
 760         } else {
 761                 if (newopt) {
 762                         if (copy_from_user(*p, newopt, newoptlen))
 763                                 return -EFAULT;
 764                         *hdr = (struct ipv6_opt_hdr *)*p;
 765                         if (ipv6_optlen(*hdr) > newoptlen)
 766                                 return -EINVAL;
 767                         *p += CMSG_ALIGN(newoptlen);
 768                 }
 769         }
 770         return 0;
 771 }
 772
 773 struct ipv6_txoptions *
 774 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
 775                    int newtype,
 776                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
 777 {
 778         int tot_len = 0;
 779         char *p;
 780         struct ipv6_txoptions *opt2;
 781         int err;
 782
 783         if (opt) {
 784                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
 785                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
 786                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
 787                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
 788                 if (newtype != IPV6_RTHDR && opt->srcrt)
 789                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
 790                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
 791                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
 792         }
 793
 794         if (newopt && newoptlen)
 795                 tot_len += CMSG_ALIGN(newoptlen);
 796
 797         if (!tot_len)
 798                 return NULL;
 799
 800         tot_len += sizeof(*opt2);
 801         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
 802         if (!opt2)
 803                 return ERR_PTR(-ENOBUFS);
 804
 805         memset(opt2, 0, tot_len);
 806
 807         opt2->tot_len = tot_len;
 808         p = (char *)(opt2 + 1);
 809
 810         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
 811                                 newtype != IPV6_HOPOPTS,
 812                                 &opt2->hopopt, &p);
 813         if (err)
 814                 goto out;
 815
 816         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
 817                                 newtype != IPV6_RTHDRDSTOPTS,
 818                                 &opt2->dst0opt, &p);
 819         if (err)
 820                 goto out;
 821
 822         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
 823                                 newtype != IPV6_RTHDR,
 824                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
 825         if (err)
 826                 goto out;
 827
 828         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
 829                                 newtype != IPV6_DSTOPTS,
 830                                 &opt2->dst1opt, &p);
 831         if (err)
 832                 goto out;
 833
 834         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
 835                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
 836                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
 837         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
 838
 839         return opt2;
 840 out:
 841         sock_kfree_s(sk, opt2, opt2->tot_len);
 842         return ERR_PTR(err);
 843 }
 844
 845 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
 846                                           struct ipv6_txoptions *opt)
 847 {
 848         /*
 849          * ignore the dest before srcrt unless srcrt is being included.
 850          * --yoshfuji
 851          */
 852         if (opt && opt->dst0opt && !opt->srcrt) {
 853                 if (opt_space != opt) {
 854                         memcpy(opt_space, opt, sizeof(*opt_space));
 855                         opt = opt_space;
 856                 }
 857                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
 858                 opt->dst0opt = NULL;
 859         }
 860
 861         return opt;
 862 }
 863 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
 864
 865 /**
 866  * fl6_update_dst - update flowi destination address with info given
 867  *                  by srcrt option, if any.
 868  *
 869  * @fl6: flowi6 for which daddr is to be updated
 870  * @opt: struct ipv6_txoptions in which to look for srcrt opt
 871  * @orig: copy of original daddr address if modified
 872  *
 873  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
 874  * and initial value of fl6->daddr set in orig
 875  */
 876 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
 877                                 const struct ipv6_txoptions *opt,
 878                                 struct in6_addr *orig)
 879 {
 880         if (!opt || !opt->srcrt)
 881                 return NULL;
 882
 883         *orig = fl6->daddr;
 884         fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
 885         return orig;
 886 }
 887 EXPORT_SYMBOL_GPL(fl6_update_dst);