datagram.c 21.2 KB
Newer Older
L
Linus Torvalds 已提交
1 2
/*
 *	common UDP/RAW code
3
 *	Linux INET6 implementation
L
Linus Torvalds 已提交
4 5
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

14
#include <linux/capability.h>
L
Linus Torvalds 已提交
15 16 17 18 19 20 21 22 23
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/interrupt.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/in6.h>
#include <linux/ipv6.h>
#include <linux/route.h>
24
#include <linux/slab.h>
25
#include <linux/export.h>
L
Linus Torvalds 已提交
26 27 28 29 30 31

#include <net/ipv6.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
#include <net/transp_v6.h>
#include <net/ip6_route.h>
32
#include <net/tcp_states.h>
33
#include <net/dsfield.h>
L
Linus Torvalds 已提交
34 35 36 37

#include <linux/errqueue.h>
#include <asm/uaccess.h>

38
static bool ipv6_mapped_addr_any(const struct in6_addr *a)
39
{
40
	return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0);
41 42
}

L
Linus Torvalds 已提交
43 44 45 46 47
int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
{
	struct sockaddr_in6	*usin = (struct sockaddr_in6 *) uaddr;
	struct inet_sock      	*inet = inet_sk(sk);
	struct ipv6_pinfo      	*np = inet6_sk(sk);
48
	struct in6_addr		*daddr, *final_p, final;
L
Linus Torvalds 已提交
49
	struct dst_entry	*dst;
50
	struct flowi6		fl6;
L
Linus Torvalds 已提交
51
	struct ip6_flowlabel	*flowlabel = NULL;
52
	struct ipv6_txoptions   *opt;
L
Linus Torvalds 已提交
53 54 55 56 57 58 59 60 61 62 63
	int			addr_type;
	int			err;

	if (usin->sin6_family == AF_INET) {
		if (__ipv6_only_sock(sk))
			return -EAFNOSUPPORT;
		err = ip4_datagram_connect(sk, uaddr, addr_len);
		goto ipv4_connected;
	}

	if (addr_len < SIN6_LEN_RFC2133)
64
		return -EINVAL;
L
Linus Torvalds 已提交
65

66 67
	if (usin->sin6_family != AF_INET6)
		return -EAFNOSUPPORT;
L
Linus Torvalds 已提交
68

69
	memset(&fl6, 0, sizeof(fl6));
L
Linus Torvalds 已提交
70
	if (np->sndflow) {
71 72 73
		fl6.flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
		if (fl6.flowlabel&IPV6_FLOWLABEL_MASK) {
			flowlabel = fl6_sock_lookup(sk, fl6.flowlabel);
L
Linus Torvalds 已提交
74 75
			if (flowlabel == NULL)
				return -EINVAL;
A
Alexey Dobriyan 已提交
76
			usin->sin6_addr = flowlabel->dst;
L
Linus Torvalds 已提交
77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101
		}
	}

	addr_type = ipv6_addr_type(&usin->sin6_addr);

	if (addr_type == IPV6_ADDR_ANY) {
		/*
		 *	connect to self
		 */
		usin->sin6_addr.s6_addr[15] = 0x01;
	}

	daddr = &usin->sin6_addr;

	if (addr_type == IPV6_ADDR_MAPPED) {
		struct sockaddr_in sin;

		if (__ipv6_only_sock(sk)) {
			err = -ENETUNREACH;
			goto out;
		}
		sin.sin_family = AF_INET;
		sin.sin_addr.s_addr = daddr->s6_addr32[3];
		sin.sin_port = usin->sin6_port;

102
		err = ip4_datagram_connect(sk,
103
					   (struct sockaddr *) &sin,
L
Linus Torvalds 已提交
104 105 106 107 108
					   sizeof(sin));

ipv4_connected:
		if (err)
			goto out;
109

110
		ipv6_addr_set_v4mapped(inet->inet_daddr, &sk->sk_v6_daddr);
L
Linus Torvalds 已提交
111

112 113
		if (ipv6_addr_any(&np->saddr) ||
		    ipv6_mapped_addr_any(&np->saddr))
E
Eric Dumazet 已提交
114
			ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
B
Brian Haley 已提交
115

116 117
		if (ipv6_addr_any(&sk->sk_v6_rcv_saddr) ||
		    ipv6_mapped_addr_any(&sk->sk_v6_rcv_saddr)) {
E
Eric Dumazet 已提交
118
			ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
119
					       &sk->sk_v6_rcv_saddr);
E
Eric Dumazet 已提交
120 121 122
			if (sk->sk_prot->rehash)
				sk->sk_prot->rehash(sk);
		}
L
Linus Torvalds 已提交
123 124 125 126

		goto out;
	}

127
	if (__ipv6_addr_needs_scope_id(addr_type)) {
L
Linus Torvalds 已提交
128 129 130 131 132 133 134 135 136 137
		if (addr_len >= sizeof(struct sockaddr_in6) &&
		    usin->sin6_scope_id) {
			if (sk->sk_bound_dev_if &&
			    sk->sk_bound_dev_if != usin->sin6_scope_id) {
				err = -EINVAL;
				goto out;
			}
			sk->sk_bound_dev_if = usin->sin6_scope_id;
		}

138 139 140
		if (!sk->sk_bound_dev_if && (addr_type & IPV6_ADDR_MULTICAST))
			sk->sk_bound_dev_if = np->mcast_oif;

L
Linus Torvalds 已提交
141 142 143 144 145 146 147
		/* Connect to link-local address requires an interface */
		if (!sk->sk_bound_dev_if) {
			err = -EINVAL;
			goto out;
		}
	}

148
	sk->sk_v6_daddr = *daddr;
149
	np->flow_label = fl6.flowlabel;
L
Linus Torvalds 已提交
150

E
Eric Dumazet 已提交
151
	inet->inet_dport = usin->sin6_port;
L
Linus Torvalds 已提交
152 153 154 155 156 157

	/*
	 *	Check for a route to destination an obtain the
	 *	destination cache for it.
	 */

158
	fl6.flowi6_proto = sk->sk_protocol;
159
	fl6.daddr = sk->sk_v6_daddr;
A
Alexey Dobriyan 已提交
160
	fl6.saddr = np->saddr;
161 162
	fl6.flowi6_oif = sk->sk_bound_dev_if;
	fl6.flowi6_mark = sk->sk_mark;
163 164
	fl6.fl6_dport = inet->inet_dport;
	fl6.fl6_sport = inet->inet_sport;
L
Linus Torvalds 已提交
165

166 167
	if (!fl6.flowi6_oif && (addr_type&IPV6_ADDR_MULTICAST))
		fl6.flowi6_oif = np->mcast_oif;
L
Linus Torvalds 已提交
168

169
	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
V
Venkat Yekkirala 已提交
170

171
	opt = flowlabel ? flowlabel->opt : np->opt;
172
	final_p = fl6_update_dst(&fl6, opt, &final);
L
Linus Torvalds 已提交
173

174
	dst = ip6_dst_lookup_flow(sk, &fl6, final_p, true);
175 176 177
	err = 0;
	if (IS_ERR(dst)) {
		err = PTR_ERR(dst);
L
Linus Torvalds 已提交
178
		goto out;
179
	}
L
Linus Torvalds 已提交
180 181 182 183

	/* source address lookup done in ip6_dst_lookup */

	if (ipv6_addr_any(&np->saddr))
A
Alexey Dobriyan 已提交
184
		np->saddr = fl6.saddr;
L
Linus Torvalds 已提交
185

186 187
	if (ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
		sk->sk_v6_rcv_saddr = fl6.saddr;
E
Eric Dumazet 已提交
188
		inet->inet_rcv_saddr = LOOPBACK4_IPV6;
E
Eric Dumazet 已提交
189 190
		if (sk->sk_prot->rehash)
			sk->sk_prot->rehash(sk);
L
Linus Torvalds 已提交
191 192 193
	}

	ip6_dst_store(sk, dst,
194 195
		      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
		      &sk->sk_v6_daddr : NULL,
196
#ifdef CONFIG_IPV6_SUBTREES
197
		      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
198 199 200
		      &np->saddr :
#endif
		      NULL);
L
Linus Torvalds 已提交
201 202 203 204 205 206

	sk->sk_state = TCP_ESTABLISHED;
out:
	fl6_sock_release(flowlabel);
	return err;
}
207
EXPORT_SYMBOL_GPL(ip6_datagram_connect);
L
Linus Torvalds 已提交
208

209
void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
A
Al Viro 已提交
210
		     __be16 port, u32 info, u8 *payload)
L
Linus Torvalds 已提交
211 212
{
	struct ipv6_pinfo *np  = inet6_sk(sk);
213
	struct icmp6hdr *icmph = icmp6_hdr(skb);
L
Linus Torvalds 已提交
214 215 216 217 218 219 220 221 222
	struct sock_exterr_skb *serr;

	if (!np->recverr)
		return;

	skb = skb_clone(skb, GFP_ATOMIC);
	if (!skb)
		return;

223 224
	skb->protocol = htons(ETH_P_IPV6);

L
Linus Torvalds 已提交
225 226 227
	serr = SKB_EXT_ERR(skb);
	serr->ee.ee_errno = err;
	serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
228
	serr->ee.ee_type = icmph->icmp6_type;
L
Linus Torvalds 已提交
229 230 231 232
	serr->ee.ee_code = icmph->icmp6_code;
	serr->ee.ee_pad = 0;
	serr->ee.ee_info = info;
	serr->ee.ee_data = 0;
233 234
	serr->addr_offset = (u8 *)&(((struct ipv6hdr *)(icmph + 1))->daddr) -
				  skb_network_header(skb);
L
Linus Torvalds 已提交
235 236 237
	serr->port = port;

	__skb_pull(skb, payload - skb->data);
238
	skb_reset_transport_header(skb);
L
Linus Torvalds 已提交
239 240 241 242 243

	if (sock_queue_err_skb(sk, skb))
		kfree_skb(skb);
}

244
void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info)
L
Linus Torvalds 已提交
245 246 247 248 249 250 251 252 253 254 255 256 257
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct sock_exterr_skb *serr;
	struct ipv6hdr *iph;
	struct sk_buff *skb;

	if (!np->recverr)
		return;

	skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
	if (!skb)
		return;

258 259
	skb->protocol = htons(ETH_P_IPV6);

260 261
	skb_put(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
262
	iph = ipv6_hdr(skb);
A
Alexey Dobriyan 已提交
263
	iph->daddr = fl6->daddr;
L
Linus Torvalds 已提交
264 265 266 267

	serr = SKB_EXT_ERR(skb);
	serr->ee.ee_errno = err;
	serr->ee.ee_origin = SO_EE_ORIGIN_LOCAL;
268
	serr->ee.ee_type = 0;
L
Linus Torvalds 已提交
269 270 271 272
	serr->ee.ee_code = 0;
	serr->ee.ee_pad = 0;
	serr->ee.ee_info = info;
	serr->ee.ee_data = 0;
273
	serr->addr_offset = (u8 *)&iph->daddr - skb_network_header(skb);
274
	serr->port = fl6->fl6_dport;
L
Linus Torvalds 已提交
275

276
	__skb_pull(skb, skb_tail_pointer(skb) - skb->data);
277
	skb_reset_transport_header(skb);
L
Linus Torvalds 已提交
278 279 280 281 282

	if (sock_queue_err_skb(sk, skb))
		kfree_skb(skb);
}

283
void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu)
284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct ipv6hdr *iph;
	struct sk_buff *skb;
	struct ip6_mtuinfo *mtu_info;

	if (!np->rxopt.bits.rxpmtu)
		return;

	skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
	if (!skb)
		return;

	skb_put(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
	iph = ipv6_hdr(skb);
A
Alexey Dobriyan 已提交
300
	iph->daddr = fl6->daddr;
301 302 303 304 305 306 307

	mtu_info = IP6CBMTU(skb);

	mtu_info->ip6m_mtu = mtu;
	mtu_info->ip6m_addr.sin6_family = AF_INET6;
	mtu_info->ip6m_addr.sin6_port = 0;
	mtu_info->ip6m_addr.sin6_flowinfo = 0;
308
	mtu_info->ip6m_addr.sin6_scope_id = fl6->flowi6_oif;
A
Alexey Dobriyan 已提交
309
	mtu_info->ip6m_addr.sin6_addr = ipv6_hdr(skb)->daddr;
310 311 312 313 314 315 316 317

	__skb_pull(skb, skb_tail_pointer(skb) - skb->data);
	skb_reset_transport_header(skb);

	skb = xchg(&np->rxpmtu, skb);
	kfree_skb(skb);
}

318
/*
L
Linus Torvalds 已提交
319 320
 *	Handle MSG_ERRQUEUE
 */
321
int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
L
Linus Torvalds 已提交
322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct sock_exterr_skb *serr;
	struct sk_buff *skb, *skb2;
	struct sockaddr_in6 *sin;
	struct {
		struct sock_extended_err ee;
		struct sockaddr_in6	 offender;
	} errhdr;
	int err;
	int copied;

	err = -EAGAIN;
	skb = skb_dequeue(&sk->sk_error_queue);
	if (skb == NULL)
		goto out;

	copied = skb->len;
	if (copied > len) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}
	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
	if (err)
		goto out_free_skb;

	sock_recv_timestamp(msg, sk, skb);

	serr = SKB_EXT_ERR(skb);

	sin = (struct sockaddr_in6 *)msg->msg_name;
	if (sin) {
354
		const unsigned char *nh = skb_network_header(skb);
L
Linus Torvalds 已提交
355 356
		sin->sin6_family = AF_INET6;
		sin->sin6_flowinfo = 0;
357
		sin->sin6_port = serr->port;
358
		if (skb->protocol == htons(ETH_P_IPV6)) {
359 360 361
			const struct ipv6hdr *ip6h = container_of((struct in6_addr *)(nh + serr->addr_offset),
								  struct ipv6hdr, daddr);
			sin->sin6_addr = ip6h->daddr;
L
Linus Torvalds 已提交
362
			if (np->sndflow)
363
				sin->sin6_flowinfo = ip6_flowinfo(ip6h);
364 365 366
			sin->sin6_scope_id =
				ipv6_iface_scope_id(&sin->sin6_addr,
						    IP6CB(skb)->iif);
L
Linus Torvalds 已提交
367
		} else {
B
Brian Haley 已提交
368 369
			ipv6_addr_set_v4mapped(*(__be32 *)(nh + serr->addr_offset),
					       &sin->sin6_addr);
370
			sin->sin6_scope_id = 0;
L
Linus Torvalds 已提交
371
		}
372
		*addr_len = sizeof(*sin);
L
Linus Torvalds 已提交
373 374 375 376 377 378 379 380
	}

	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
	sin = &errhdr.offender;
	sin->sin6_family = AF_UNSPEC;
	if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
		sin->sin6_family = AF_INET6;
		sin->sin6_flowinfo = 0;
381
		sin->sin6_port = 0;
382
		if (skb->protocol == htons(ETH_P_IPV6)) {
A
Alexey Dobriyan 已提交
383
			sin->sin6_addr = ipv6_hdr(skb)->saddr;
L
Linus Torvalds 已提交
384
			if (np->rxopt.all)
385
				ip6_datagram_recv_ctl(sk, msg, skb);
386 387 388
			sin->sin6_scope_id =
				ipv6_iface_scope_id(&sin->sin6_addr,
						    IP6CB(skb)->iif);
L
Linus Torvalds 已提交
389 390 391
		} else {
			struct inet_sock *inet = inet_sk(sk);

B
Brian Haley 已提交
392 393
			ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
					       &sin->sin6_addr);
394
			sin->sin6_scope_id = 0;
L
Linus Torvalds 已提交
395 396 397 398 399 400 401 402 403 404 405 406 407
			if (inet->cmsg_flags)
				ip_cmsg_recv(msg, skb);
		}
	}

	put_cmsg(msg, SOL_IPV6, IPV6_RECVERR, sizeof(errhdr), &errhdr);

	/* Now we could try to dump offended packet options */

	msg->msg_flags |= MSG_ERRQUEUE;
	err = copied;

	/* Reset and regenerate socket error */
408
	spin_lock_bh(&sk->sk_error_queue.lock);
L
Linus Torvalds 已提交
409 410 411
	sk->sk_err = 0;
	if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
		sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
412
		spin_unlock_bh(&sk->sk_error_queue.lock);
L
Linus Torvalds 已提交
413 414
		sk->sk_error_report(sk);
	} else {
415
		spin_unlock_bh(&sk->sk_error_queue.lock);
L
Linus Torvalds 已提交
416 417
	}

418
out_free_skb:
L
Linus Torvalds 已提交
419 420 421 422
	kfree_skb(skb);
out:
	return err;
}
423
EXPORT_SYMBOL_GPL(ipv6_recv_error);
L
Linus Torvalds 已提交
424

425 426 427
/*
 *	Handle IPV6_RECVPATHMTU
 */
428 429
int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len,
		     int *addr_len)
430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct sk_buff *skb;
	struct sockaddr_in6 *sin;
	struct ip6_mtuinfo mtu_info;
	int err;
	int copied;

	err = -EAGAIN;
	skb = xchg(&np->rxpmtu, NULL);
	if (skb == NULL)
		goto out;

	copied = skb->len;
	if (copied > len) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}
	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
	if (err)
		goto out_free_skb;

	sock_recv_timestamp(msg, sk, skb);

	memcpy(&mtu_info, IP6CBMTU(skb), sizeof(mtu_info));

	sin = (struct sockaddr_in6 *)msg->msg_name;
	if (sin) {
		sin->sin6_family = AF_INET6;
		sin->sin6_flowinfo = 0;
		sin->sin6_port = 0;
		sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
A
Alexey Dobriyan 已提交
462
		sin->sin6_addr = mtu_info.ip6m_addr.sin6_addr;
463
		*addr_len = sizeof(*sin);
464 465 466 467 468 469 470 471 472 473 474
	}

	put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);

	err = copied;

out_free_skb:
	kfree_skb(skb);
out:
	return err;
}
L
Linus Torvalds 已提交
475 476


477 478
int ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
			  struct sk_buff *skb)
L
Linus Torvalds 已提交
479 480 481
{
	struct ipv6_pinfo *np = inet6_sk(sk);
	struct inet6_skb_parm *opt = IP6CB(skb);
482
	unsigned char *nh = skb_network_header(skb);
L
Linus Torvalds 已提交
483 484 485 486 487

	if (np->rxopt.bits.rxinfo) {
		struct in6_pktinfo src_info;

		src_info.ipi6_ifindex = opt->iif;
A
Alexey Dobriyan 已提交
488
		src_info.ipi6_addr = ipv6_hdr(skb)->daddr;
L
Linus Torvalds 已提交
489 490 491 492
		put_cmsg(msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
	}

	if (np->rxopt.bits.rxhlim) {
493
		int hlim = ipv6_hdr(skb)->hop_limit;
L
Linus Torvalds 已提交
494 495 496
		put_cmsg(msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
	}

497
	if (np->rxopt.bits.rxtclass) {
498
		int tclass = ipv6_get_dsfield(ipv6_hdr(skb));
499 500 501
		put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
	}

502 503 504 505
	if (np->rxopt.bits.rxflow) {
		__be32 flowinfo = ip6_flowinfo((struct ipv6hdr *)nh);
		if (flowinfo)
			put_cmsg(msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo);
L
Linus Torvalds 已提交
506
	}
507 508

	/* HbH is allowed only once */
L
Linus Torvalds 已提交
509
	if (np->rxopt.bits.hopopts && opt->hop) {
510
		u8 *ptr = nh + opt->hop;
L
Linus Torvalds 已提交
511 512
		put_cmsg(msg, SOL_IPV6, IPV6_HOPOPTS, (ptr[1]+1)<<3, ptr);
	}
513 514 515 516 517 518 519 520

	if (opt->lastopt &&
	    (np->rxopt.bits.dstopts || np->rxopt.bits.srcrt)) {
		/*
		 * Silly enough, but we need to reparse in order to
		 * report extension headers (except for HbH)
		 * in order.
		 *
521
		 * Also note that IPV6_RECVRTHDRDSTOPTS is NOT
522 523 524 525
		 * (and WILL NOT be) defined because
		 * IPV6_RECVDSTOPTS is more generic. --yoshfuji
		 */
		unsigned int off = sizeof(struct ipv6hdr);
526
		u8 nexthdr = ipv6_hdr(skb)->nexthdr;
527 528

		while (off <= opt->lastopt) {
529
			unsigned int len;
530
			u8 *ptr = nh + off;
531

532
			switch (nexthdr) {
533 534 535 536 537 538 539 540 541 542 543 544 545 546
			case IPPROTO_DSTOPTS:
				nexthdr = ptr[0];
				len = (ptr[1] + 1) << 3;
				if (np->rxopt.bits.dstopts)
					put_cmsg(msg, SOL_IPV6, IPV6_DSTOPTS, len, ptr);
				break;
			case IPPROTO_ROUTING:
				nexthdr = ptr[0];
				len = (ptr[1] + 1) << 3;
				if (np->rxopt.bits.srcrt)
					put_cmsg(msg, SOL_IPV6, IPV6_RTHDR, len, ptr);
				break;
			case IPPROTO_AH:
				nexthdr = ptr[0];
547
				len = (ptr[1] + 2) << 2;
548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563
				break;
			default:
				nexthdr = ptr[0];
				len = (ptr[1] + 1) << 3;
				break;
			}

			off += len;
		}
	}

	/* socket options in old style */
	if (np->rxopt.bits.rxoinfo) {
		struct in6_pktinfo src_info;

		src_info.ipi6_ifindex = opt->iif;
A
Alexey Dobriyan 已提交
564
		src_info.ipi6_addr = ipv6_hdr(skb)->daddr;
565 566 567
		put_cmsg(msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
	}
	if (np->rxopt.bits.rxohlim) {
568
		int hlim = ipv6_hdr(skb)->hop_limit;
569 570 571
		put_cmsg(msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim);
	}
	if (np->rxopt.bits.ohopopts && opt->hop) {
572
		u8 *ptr = nh + opt->hop;
573 574 575
		put_cmsg(msg, SOL_IPV6, IPV6_2292HOPOPTS, (ptr[1]+1)<<3, ptr);
	}
	if (np->rxopt.bits.odstopts && opt->dst0) {
576
		u8 *ptr = nh + opt->dst0;
577
		put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
L
Linus Torvalds 已提交
578
	}
579
	if (np->rxopt.bits.osrcrt && opt->srcrt) {
580
		struct ipv6_rt_hdr *rthdr = (struct ipv6_rt_hdr *)(nh + opt->srcrt);
581
		put_cmsg(msg, SOL_IPV6, IPV6_2292RTHDR, (rthdr->hdrlen+1) << 3, rthdr);
L
Linus Torvalds 已提交
582
	}
583
	if (np->rxopt.bits.odstopts && opt->dst1) {
584
		u8 *ptr = nh + opt->dst1;
585
		put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
L
Linus Torvalds 已提交
586
	}
587 588
	if (np->rxopt.bits.rxorigdstaddr) {
		struct sockaddr_in6 sin6;
E
Eric Dumazet 已提交
589
		__be16 *ports = (__be16 *) skb_transport_header(skb);
590 591 592 593 594 595 596 597

		if (skb_transport_offset(skb) + 4 <= skb->len) {
			/* All current transport protocols have the port numbers in the
			 * first four bytes of the transport header and this function is
			 * written with this assumption in mind.
			 */

			sin6.sin6_family = AF_INET6;
A
Alexey Dobriyan 已提交
598
			sin6.sin6_addr = ipv6_hdr(skb)->daddr;
599 600
			sin6.sin6_port = ports[1];
			sin6.sin6_flowinfo = 0;
601 602 603
			sin6.sin6_scope_id =
				ipv6_iface_scope_id(&ipv6_hdr(skb)->daddr,
						    opt->iif);
604 605 606 607

			put_cmsg(msg, SOL_IPV6, IPV6_ORIGDSTADDR, sizeof(sin6), &sin6);
		}
	}
L
Linus Torvalds 已提交
608 609
	return 0;
}
T
Tom Parkin 已提交
610
EXPORT_SYMBOL_GPL(ip6_datagram_recv_ctl);
L
Linus Torvalds 已提交
611

612 613 614 615
int ip6_datagram_send_ctl(struct net *net, struct sock *sk,
			  struct msghdr *msg, struct flowi6 *fl6,
			  struct ipv6_txoptions *opt,
			  int *hlimit, int *tclass, int *dontfrag)
L
Linus Torvalds 已提交
616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635
{
	struct in6_pktinfo *src_info;
	struct cmsghdr *cmsg;
	struct ipv6_rt_hdr *rthdr;
	struct ipv6_opt_hdr *hdr;
	int len;
	int err = 0;

	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
		int addr_type;

		if (!CMSG_OK(msg, cmsg)) {
			err = -EINVAL;
			goto exit_f;
		}

		if (cmsg->cmsg_level != SOL_IPV6)
			continue;

		switch (cmsg->cmsg_type) {
636 637
		case IPV6_PKTINFO:
		case IPV6_2292PKTINFO:
638 639 640
		    {
			struct net_device *dev = NULL;

641
			if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) {
L
Linus Torvalds 已提交
642 643 644 645 646
				err = -EINVAL;
				goto exit_f;
			}

			src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
647

L
Linus Torvalds 已提交
648
			if (src_info->ipi6_ifindex) {
649 650
				if (fl6->flowi6_oif &&
				    src_info->ipi6_ifindex != fl6->flowi6_oif)
L
Linus Torvalds 已提交
651
					return -EINVAL;
652
				fl6->flowi6_oif = src_info->ipi6_ifindex;
L
Linus Torvalds 已提交
653 654
			}

655
			addr_type = __ipv6_addr_type(&src_info->ipi6_addr);
L
Linus Torvalds 已提交
656

657
			rcu_read_lock();
658 659
			if (fl6->flowi6_oif) {
				dev = dev_get_by_index_rcu(net, fl6->flowi6_oif);
660 661
				if (!dev) {
					rcu_read_unlock();
662
					return -ENODEV;
663 664 665
				}
			} else if (addr_type & IPV6_ADDR_LINKLOCAL) {
				rcu_read_unlock();
666
				return -EINVAL;
667
			}
668

669 670
			if (addr_type != IPV6_ADDR_ANY) {
				int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
671
				if (!(inet_sk(sk)->freebind || inet_sk(sk)->transparent) &&
672
				    !ipv6_chk_addr(net, &src_info->ipi6_addr,
673 674 675
						   strict ? dev : NULL, 0))
					err = -EINVAL;
				else
A
Alexey Dobriyan 已提交
676
					fl6->saddr = src_info->ipi6_addr;
L
Linus Torvalds 已提交
677
			}
678

679
			rcu_read_unlock();
L
Linus Torvalds 已提交
680

681 682 683
			if (err)
				goto exit_f;

L
Linus Torvalds 已提交
684
			break;
685
		    }
L
Linus Torvalds 已提交
686 687

		case IPV6_FLOWINFO:
688
			if (cmsg->cmsg_len < CMSG_LEN(4)) {
L
Linus Torvalds 已提交
689 690 691 692
				err = -EINVAL;
				goto exit_f;
			}

693 694
			if (fl6->flowlabel&IPV6_FLOWINFO_MASK) {
				if ((fl6->flowlabel^*(__be32 *)CMSG_DATA(cmsg))&~IPV6_FLOWINFO_MASK) {
L
Linus Torvalds 已提交
695 696 697 698
					err = -EINVAL;
					goto exit_f;
				}
			}
699
			fl6->flowlabel = IPV6_FLOWINFO_MASK & *(__be32 *)CMSG_DATA(cmsg);
L
Linus Torvalds 已提交
700 701
			break;

702
		case IPV6_2292HOPOPTS:
L
Linus Torvalds 已提交
703
		case IPV6_HOPOPTS:
704
			if (opt->hopopt || cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
L
Linus Torvalds 已提交
705 706 707 708 709 710 711 712 713 714
				err = -EINVAL;
				goto exit_f;
			}

			hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg);
			len = ((hdr->hdrlen + 1) << 3);
			if (cmsg->cmsg_len < CMSG_LEN(len)) {
				err = -EINVAL;
				goto exit_f;
			}
715
			if (!ns_capable(net->user_ns, CAP_NET_RAW)) {
L
Linus Torvalds 已提交
716 717 718 719 720 721 722
				err = -EPERM;
				goto exit_f;
			}
			opt->opt_nflen += len;
			opt->hopopt = hdr;
			break;

723
		case IPV6_2292DSTOPTS:
724
			if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
L
Linus Torvalds 已提交
725 726 727 728 729 730 731 732 733 734
				err = -EINVAL;
				goto exit_f;
			}

			hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg);
			len = ((hdr->hdrlen + 1) << 3);
			if (cmsg->cmsg_len < CMSG_LEN(len)) {
				err = -EINVAL;
				goto exit_f;
			}
735
			if (!ns_capable(net->user_ns, CAP_NET_RAW)) {
L
Linus Torvalds 已提交
736 737 738 739 740 741 742 743 744 745 746
				err = -EPERM;
				goto exit_f;
			}
			if (opt->dst1opt) {
				err = -EINVAL;
				goto exit_f;
			}
			opt->opt_flen += len;
			opt->dst1opt = hdr;
			break;

747 748 749 750 751 752 753 754 755 756 757 758 759
		case IPV6_DSTOPTS:
		case IPV6_RTHDRDSTOPTS:
			if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
				err = -EINVAL;
				goto exit_f;
			}

			hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg);
			len = ((hdr->hdrlen + 1) << 3);
			if (cmsg->cmsg_len < CMSG_LEN(len)) {
				err = -EINVAL;
				goto exit_f;
			}
760
			if (!ns_capable(net->user_ns, CAP_NET_RAW)) {
761 762 763 764 765 766 767 768 769 770 771 772 773
				err = -EPERM;
				goto exit_f;
			}
			if (cmsg->cmsg_type == IPV6_DSTOPTS) {
				opt->opt_flen += len;
				opt->dst1opt = hdr;
			} else {
				opt->opt_nflen += len;
				opt->dst0opt = hdr;
			}
			break;

		case IPV6_2292RTHDR:
L
Linus Torvalds 已提交
774
		case IPV6_RTHDR:
775
			if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_rt_hdr))) {
L
Linus Torvalds 已提交
776 777 778 779 780 781
				err = -EINVAL;
				goto exit_f;
			}

			rthdr = (struct ipv6_rt_hdr *)CMSG_DATA(cmsg);

782
			switch (rthdr->type) {
A
Amerigo Wang 已提交
783
#if IS_ENABLED(CONFIG_IPV6_MIP6)
784
			case IPV6_SRCRT_TYPE_2:
B
Brian Haley 已提交
785 786 787 788 789
				if (rthdr->hdrlen != 2 ||
				    rthdr->segments_left != 1) {
					err = -EINVAL;
					goto exit_f;
				}
790
				break;
791
#endif
792
			default:
L
Linus Torvalds 已提交
793 794 795 796 797 798
				err = -EINVAL;
				goto exit_f;
			}

			len = ((rthdr->hdrlen + 1) << 3);

799
			if (cmsg->cmsg_len < CMSG_LEN(len)) {
L
Linus Torvalds 已提交
800 801 802 803 804 805 806 807 808 809 810 811 812
				err = -EINVAL;
				goto exit_f;
			}

			/* segments left must also match */
			if ((rthdr->hdrlen >> 1) != rthdr->segments_left) {
				err = -EINVAL;
				goto exit_f;
			}

			opt->opt_nflen += len;
			opt->srcrt = rthdr;

813
			if (cmsg->cmsg_type == IPV6_2292RTHDR && opt->dst1opt) {
L
Linus Torvalds 已提交
814 815 816 817 818 819 820 821 822 823
				int dsthdrlen = ((opt->dst1opt->hdrlen+1)<<3);

				opt->opt_nflen += dsthdrlen;
				opt->dst0opt = opt->dst1opt;
				opt->dst1opt = NULL;
				opt->opt_flen -= dsthdrlen;
			}

			break;

824
		case IPV6_2292HOPLIMIT:
L
Linus Torvalds 已提交
825 826 827 828 829 830 831
		case IPV6_HOPLIMIT:
			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
				err = -EINVAL;
				goto exit_f;
			}

			*hlimit = *(int *)CMSG_DATA(cmsg);
832 833 834 835 836
			if (*hlimit < -1 || *hlimit > 0xff) {
				err = -EINVAL;
				goto exit_f;
			}

L
Linus Torvalds 已提交
837 838
			break;

839 840 841 842 843
		case IPV6_TCLASS:
		    {
			int tc;

			err = -EINVAL;
844
			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
845 846 847
				goto exit_f;

			tc = *(int *)CMSG_DATA(cmsg);
848
			if (tc < -1 || tc > 0xff)
849 850 851 852 853
				goto exit_f;

			err = 0;
			*tclass = tc;

854 855 856 857 858 859 860 861
			break;
		    }

		case IPV6_DONTFRAG:
		    {
			int df;

			err = -EINVAL;
862
			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
863 864 865 866 867 868 869 870 871
				goto exit_f;

			df = *(int *)CMSG_DATA(cmsg);
			if (df < 0 || df > 1)
				goto exit_f;

			err = 0;
			*dontfrag = df;

872 873
			break;
		    }
L
Linus Torvalds 已提交
874
		default:
875
			LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
876
				       cmsg->cmsg_type);
L
Linus Torvalds 已提交
877
			err = -EINVAL;
878
			goto exit_f;
879
		}
L
Linus Torvalds 已提交
880 881 882 883 884
	}

exit_f:
	return err;
}
885
EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
886 887 888 889 890 891

void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
			     __u16 srcp, __u16 destp, int bucket)
{
	const struct in6_addr *dest, *src;

892 893
	dest  = &sp->sk_v6_daddr;
	src   = &sp->sk_v6_rcv_saddr;
894 895
	seq_printf(seq,
		   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
896
		   "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d\n",
897 898 899 900 901 902 903 904 905 906 907 908 909 910 911
		   bucket,
		   src->s6_addr32[0], src->s6_addr32[1],
		   src->s6_addr32[2], src->s6_addr32[3], srcp,
		   dest->s6_addr32[0], dest->s6_addr32[1],
		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
		   sp->sk_state,
		   sk_wmem_alloc_get(sp),
		   sk_rmem_alloc_get(sp),
		   0, 0L, 0,
		   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
		   0,
		   sock_i_ino(sp),
		   atomic_read(&sp->sk_refcnt), sp,
		   atomic_read(&sp->sk_drops));
}