route.c 124.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5
/*
 *	Linux INET6 implementation
 *	FIB front-end.
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

/*	Changes:
 *
 *	YOSHIFUJI Hideaki @USAGI
 *		reworked default router selection.
 *		- respect outgoing interface
 *		- select from (probably) reachable routers (i.e.
 *		routers in REACHABLE, STALE, DELAY or PROBE states).
 *		- always select the same router if it is (probably)
 *		reachable.  otherwise, round-robin the list.
23 24
 *	Ville Nuorvala
 *		Fixed routing subtrees.
L
Linus Torvalds 已提交
25 26
 */

27 28
#define pr_fmt(fmt) "IPv6: " fmt

29
#include <linux/capability.h>
L
Linus Torvalds 已提交
30
#include <linux/errno.h>
31
#include <linux/export.h>
L
Linus Torvalds 已提交
32 33 34 35 36 37 38 39
#include <linux/types.h>
#include <linux/times.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/route.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
40
#include <linux/mroute6.h>
L
Linus Torvalds 已提交
41 42 43 44
#include <linux/init.h>
#include <linux/if_arp.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
45
#include <linux/nsproxy.h>
46
#include <linux/slab.h>
47
#include <linux/jhash.h>
48
#include <net/net_namespace.h>
L
Linus Torvalds 已提交
49 50 51 52 53 54 55 56 57
#include <net/snmp.h>
#include <net/ipv6.h>
#include <net/ip6_fib.h>
#include <net/ip6_route.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
#include <net/tcp.h>
#include <linux/rtnetlink.h>
#include <net/dst.h>
58
#include <net/dst_metadata.h>
L
Linus Torvalds 已提交
59
#include <net/xfrm.h>
60
#include <net/netevent.h>
61
#include <net/netlink.h>
62
#include <net/nexthop.h>
63
#include <net/lwtunnel.h>
64
#include <net/ip_tunnels.h>
D
David Ahern 已提交
65
#include <net/l3mdev.h>
D
David Ahern 已提交
66
#include <trace/events/fib6.h>
L
Linus Torvalds 已提交
67

68
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
69 70 71 72 73

#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
#endif

74
enum rt6_nud_state {
J
Jiri Benc 已提交
75 76 77
	RT6_NUD_FAIL_HARD = -3,
	RT6_NUD_FAIL_PROBE = -2,
	RT6_NUD_FAIL_DO_RR = -1,
78 79 80
	RT6_NUD_SUCCEED = 1
};

M
Martin KaFai Lau 已提交
81
static void ip6_rt_copy_init(struct rt6_info *rt, struct rt6_info *ort);
L
Linus Torvalds 已提交
82
static struct dst_entry	*ip6_dst_check(struct dst_entry *dst, u32 cookie);
83
static unsigned int	 ip6_default_advmss(const struct dst_entry *dst);
84
static unsigned int	 ip6_mtu(const struct dst_entry *dst);
L
Linus Torvalds 已提交
85 86 87 88
static struct dst_entry *ip6_negative_advice(struct dst_entry *);
static void		ip6_dst_destroy(struct dst_entry *);
static void		ip6_dst_ifdown(struct dst_entry *,
				       struct net_device *dev, int how);
89
static int		 ip6_dst_gc(struct dst_ops *ops);
L
Linus Torvalds 已提交
90 91

static int		ip6_pkt_discard(struct sk_buff *skb);
E
Eric W. Biederman 已提交
92
static int		ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
93
static int		ip6_pkt_prohibit(struct sk_buff *skb);
E
Eric W. Biederman 已提交
94
static int		ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
L
Linus Torvalds 已提交
95
static void		ip6_link_failure(struct sk_buff *skb);
96 97 98 99
static void		ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
					   struct sk_buff *skb, u32 mtu);
static void		rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
					struct sk_buff *skb);
100
static void		rt6_dst_from_metrics_check(struct rt6_info *rt);
101
static int rt6_score_route(struct rt6_info *rt, int oif, int strict);
102 103 104 105 106 107
static size_t rt6_nlmsg_size(struct rt6_info *rt);
static int rt6_fill_node(struct net *net,
			 struct sk_buff *skb, struct rt6_info *rt,
			 struct in6_addr *dst, struct in6_addr *src,
			 int iif, int type, u32 portid, u32 seq,
			 unsigned int flags);
108 109 110
static struct rt6_info *rt6_find_cached_rt(struct rt6_info *rt,
					   struct in6_addr *daddr,
					   struct in6_addr *saddr);
L
Linus Torvalds 已提交
111

112
#ifdef CONFIG_IPV6_ROUTE_INFO
113
static struct rt6_info *rt6_add_route_info(struct net *net,
114
					   const struct in6_addr *prefix, int prefixlen,
115 116
					   const struct in6_addr *gwaddr,
					   struct net_device *dev,
117
					   unsigned int pref);
118
static struct rt6_info *rt6_get_route_info(struct net *net,
119
					   const struct in6_addr *prefix, int prefixlen,
120 121
					   const struct in6_addr *gwaddr,
					   struct net_device *dev);
122 123
#endif

124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145
struct uncached_list {
	spinlock_t		lock;
	struct list_head	head;
};

static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt6_uncached_list);

static void rt6_uncached_list_add(struct rt6_info *rt)
{
	struct uncached_list *ul = raw_cpu_ptr(&rt6_uncached_list);

	rt->rt6i_uncached_list = ul;

	spin_lock_bh(&ul->lock);
	list_add_tail(&rt->rt6i_uncached, &ul->head);
	spin_unlock_bh(&ul->lock);
}

static void rt6_uncached_list_del(struct rt6_info *rt)
{
	if (!list_empty(&rt->rt6i_uncached)) {
		struct uncached_list *ul = rt->rt6i_uncached_list;
W
Wei Wang 已提交
146
		struct net *net = dev_net(rt->dst.dev);
147 148 149

		spin_lock_bh(&ul->lock);
		list_del(&rt->rt6i_uncached);
W
Wei Wang 已提交
150
		atomic_dec(&net->ipv6.rt6_stats->fib_rt_uncache);
151 152 153 154 155 156 157 158 159
		spin_unlock_bh(&ul->lock);
	}
}

static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev)
{
	struct net_device *loopback_dev = net->loopback_dev;
	int cpu;

160 161 162
	if (dev == loopback_dev)
		return;

163 164 165 166 167 168 169 170 171
	for_each_possible_cpu(cpu) {
		struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);
		struct rt6_info *rt;

		spin_lock_bh(&ul->lock);
		list_for_each_entry(rt, &ul->head, rt6i_uncached) {
			struct inet6_dev *rt_idev = rt->rt6i_idev;
			struct net_device *rt_dev = rt->dst.dev;

172
			if (rt_idev->dev == dev) {
173 174 175 176
				rt->rt6i_idev = in6_dev_get(loopback_dev);
				in6_dev_put(rt_idev);
			}

177
			if (rt_dev == dev) {
178 179 180 181 182 183 184 185 186
				rt->dst.dev = loopback_dev;
				dev_hold(rt->dst.dev);
				dev_put(rt_dev);
			}
		}
		spin_unlock_bh(&ul->lock);
	}
}

M
Martin KaFai Lau 已提交
187 188
static u32 *rt6_pcpu_cow_metrics(struct rt6_info *rt)
{
189
	return dst_metrics_write_ptr(&rt->from->dst);
M
Martin KaFai Lau 已提交
190 191
}

192 193
static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
{
194
	struct rt6_info *rt = (struct rt6_info *)dst;
195

M
Martin KaFai Lau 已提交
196 197 198
	if (rt->rt6i_flags & RTF_PCPU)
		return rt6_pcpu_cow_metrics(rt);
	else if (rt->rt6i_flags & RTF_CACHE)
199 200
		return NULL;
	else
201
		return dst_cow_metrics_generic(dst, old);
202 203
}

204 205 206
static inline const void *choose_neigh_daddr(struct rt6_info *rt,
					     struct sk_buff *skb,
					     const void *daddr)
207 208 209
{
	struct in6_addr *p = &rt->rt6i_gateway;

D
David S. Miller 已提交
210
	if (!ipv6_addr_any(p))
211
		return (const void *) p;
212 213
	else if (skb)
		return &ipv6_hdr(skb)->daddr;
214 215 216
	return daddr;
}

217 218 219
static struct neighbour *ip6_neigh_lookup(const struct dst_entry *dst,
					  struct sk_buff *skb,
					  const void *daddr)
220
{
221 222 223
	struct rt6_info *rt = (struct rt6_info *) dst;
	struct neighbour *n;

224
	daddr = choose_neigh_daddr(rt, skb, daddr);
225
	n = __ipv6_neigh_lookup(dst->dev, daddr);
226 227 228 229 230
	if (n)
		return n;
	return neigh_create(&nd_tbl, daddr, dst->dev);
}

231 232 233 234 235 236 237 238 239 240 241 242 243 244 245
static void ip6_confirm_neigh(const struct dst_entry *dst, const void *daddr)
{
	struct net_device *dev = dst->dev;
	struct rt6_info *rt = (struct rt6_info *)dst;

	daddr = choose_neigh_daddr(rt, NULL, daddr);
	if (!daddr)
		return;
	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
		return;
	if (ipv6_addr_is_multicast((const struct in6_addr *)daddr))
		return;
	__ipv6_confirm_neigh(dev, daddr);
}

246
static struct dst_ops ip6_dst_ops_template = {
L
Linus Torvalds 已提交
247 248 249 250
	.family			=	AF_INET6,
	.gc			=	ip6_dst_gc,
	.gc_thresh		=	1024,
	.check			=	ip6_dst_check,
251
	.default_advmss		=	ip6_default_advmss,
252
	.mtu			=	ip6_mtu,
253
	.cow_metrics		=	ipv6_cow_metrics,
L
Linus Torvalds 已提交
254 255 256 257 258
	.destroy		=	ip6_dst_destroy,
	.ifdown			=	ip6_dst_ifdown,
	.negative_advice	=	ip6_negative_advice,
	.link_failure		=	ip6_link_failure,
	.update_pmtu		=	ip6_rt_update_pmtu,
259
	.redirect		=	rt6_do_redirect,
260
	.local_out		=	__ip6_local_out,
261
	.neigh_lookup		=	ip6_neigh_lookup,
262
	.confirm_neigh		=	ip6_confirm_neigh,
L
Linus Torvalds 已提交
263 264
};

265
static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
266
{
267 268 269
	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);

	return mtu ? : dst->dev->mtu;
270 271
}

272 273
static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
					 struct sk_buff *skb, u32 mtu)
274 275 276
{
}

277 278
static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
				      struct sk_buff *skb)
279 280 281
{
}

282 283 284 285
static struct dst_ops ip6_dst_blackhole_ops = {
	.family			=	AF_INET6,
	.destroy		=	ip6_dst_destroy,
	.check			=	ip6_dst_check,
286
	.mtu			=	ip6_blackhole_mtu,
287
	.default_advmss		=	ip6_default_advmss,
288
	.update_pmtu		=	ip6_rt_blackhole_update_pmtu,
289
	.redirect		=	ip6_rt_blackhole_redirect,
290
	.cow_metrics		=	dst_cow_metrics_generic,
291
	.neigh_lookup		=	ip6_neigh_lookup,
292 293
};

294
static const u32 ip6_template_metrics[RTAX_MAX] = {
L
Li RongQing 已提交
295
	[RTAX_HOPLIMIT - 1] = 0,
296 297
};

298
static const struct rt6_info ip6_null_entry_template = {
299 300 301
	.dst = {
		.__refcnt	= ATOMIC_INIT(1),
		.__use		= 1,
302
		.obsolete	= DST_OBSOLETE_FORCE_CHK,
303 304 305
		.error		= -ENETUNREACH,
		.input		= ip6_pkt_discard,
		.output		= ip6_pkt_discard_out,
L
Linus Torvalds 已提交
306 307
	},
	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
308
	.rt6i_protocol  = RTPROT_KERNEL,
L
Linus Torvalds 已提交
309 310 311 312
	.rt6i_metric	= ~(u32) 0,
	.rt6i_ref	= ATOMIC_INIT(1),
};

T
Thomas Graf 已提交
313 314
#ifdef CONFIG_IPV6_MULTIPLE_TABLES

315
static const struct rt6_info ip6_prohibit_entry_template = {
316 317 318
	.dst = {
		.__refcnt	= ATOMIC_INIT(1),
		.__use		= 1,
319
		.obsolete	= DST_OBSOLETE_FORCE_CHK,
320 321 322
		.error		= -EACCES,
		.input		= ip6_pkt_prohibit,
		.output		= ip6_pkt_prohibit_out,
T
Thomas Graf 已提交
323 324
	},
	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
325
	.rt6i_protocol  = RTPROT_KERNEL,
T
Thomas Graf 已提交
326 327 328 329
	.rt6i_metric	= ~(u32) 0,
	.rt6i_ref	= ATOMIC_INIT(1),
};

330
static const struct rt6_info ip6_blk_hole_entry_template = {
331 332 333
	.dst = {
		.__refcnt	= ATOMIC_INIT(1),
		.__use		= 1,
334
		.obsolete	= DST_OBSOLETE_FORCE_CHK,
335 336
		.error		= -EINVAL,
		.input		= dst_discard,
E
Eric W. Biederman 已提交
337
		.output		= dst_discard_out,
T
Thomas Graf 已提交
338 339
	},
	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
340
	.rt6i_protocol  = RTPROT_KERNEL,
T
Thomas Graf 已提交
341 342 343 344 345 346
	.rt6i_metric	= ~(u32) 0,
	.rt6i_ref	= ATOMIC_INIT(1),
};

#endif

347 348 349 350 351 352 353 354 355
static void rt6_info_init(struct rt6_info *rt)
{
	struct dst_entry *dst = &rt->dst;

	memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
	INIT_LIST_HEAD(&rt->rt6i_siblings);
	INIT_LIST_HEAD(&rt->rt6i_uncached);
}

L
Linus Torvalds 已提交
356
/* allocate dst with ip6_dst_ops */
M
Martin KaFai Lau 已提交
357 358
static struct rt6_info *__ip6_dst_alloc(struct net *net,
					struct net_device *dev,
359
					int flags)
L
Linus Torvalds 已提交
360
{
361
	struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
W
Wei Wang 已提交
362
					1, DST_OBSOLETE_FORCE_CHK, flags);
363

W
Wei Wang 已提交
364
	if (rt) {
365
		rt6_info_init(rt);
W
Wei Wang 已提交
366 367
		atomic_inc(&net->ipv6.rt6_stats->fib_rt_alloc);
	}
368

369
	return rt;
L
Linus Torvalds 已提交
370 371
}

372 373 374
struct rt6_info *ip6_dst_alloc(struct net *net,
			       struct net_device *dev,
			       int flags)
M
Martin KaFai Lau 已提交
375
{
376
	struct rt6_info *rt = __ip6_dst_alloc(net, dev, flags);
M
Martin KaFai Lau 已提交
377 378 379

	if (rt) {
		rt->rt6i_pcpu = alloc_percpu_gfp(struct rt6_info *, GFP_ATOMIC);
380
		if (!rt->rt6i_pcpu) {
381
			dst_release_immediate(&rt->dst);
M
Martin KaFai Lau 已提交
382 383 384 385 386 387
			return NULL;
		}
	}

	return rt;
}
388
EXPORT_SYMBOL(ip6_dst_alloc);
M
Martin KaFai Lau 已提交
389

L
Linus Torvalds 已提交
390 391 392
static void ip6_dst_destroy(struct dst_entry *dst)
{
	struct rt6_info *rt = (struct rt6_info *)dst;
393
	struct rt6_exception_bucket *bucket;
394
	struct rt6_info *from = rt->from;
395
	struct inet6_dev *idev;
L
Linus Torvalds 已提交
396

397
	dst_destroy_metrics_generic(dst);
398
	free_percpu(rt->rt6i_pcpu);
399 400 401
	rt6_uncached_list_del(rt);

	idev = rt->rt6i_idev;
402
	if (idev) {
L
Linus Torvalds 已提交
403 404
		rt->rt6i_idev = NULL;
		in6_dev_put(idev);
405
	}
406 407 408 409 410
	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket, 1);
	if (bucket) {
		rt->rt6i_exception_bucket = NULL;
		kfree(bucket);
	}
411

412 413
	rt->from = NULL;
	dst_release(&from->dst);
414 415
}

L
Linus Torvalds 已提交
416 417 418 419 420
static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
			   int how)
{
	struct rt6_info *rt = (struct rt6_info *)dst;
	struct inet6_dev *idev = rt->rt6i_idev;
421
	struct net_device *loopback_dev =
422
		dev_net(dev)->loopback_dev;
L
Linus Torvalds 已提交
423

424 425 426 427 428
	if (idev && idev->dev != loopback_dev) {
		struct inet6_dev *loopback_idev = in6_dev_get(loopback_dev);
		if (loopback_idev) {
			rt->rt6i_idev = loopback_idev;
			in6_dev_put(idev);
429
		}
L
Linus Torvalds 已提交
430 431 432
	}
}

433 434 435 436 437 438 439 440
static bool __rt6_check_expired(const struct rt6_info *rt)
{
	if (rt->rt6i_flags & RTF_EXPIRES)
		return time_after(jiffies, rt->dst.expires);
	else
		return false;
}

441
static bool rt6_check_expired(const struct rt6_info *rt)
L
Linus Torvalds 已提交
442
{
443 444
	if (rt->rt6i_flags & RTF_EXPIRES) {
		if (time_after(jiffies, rt->dst.expires))
445
			return true;
446
	} else if (rt->from) {
447
		return rt->dst.obsolete != DST_OBSOLETE_FORCE_CHK ||
448
			rt6_check_expired(rt->from);
449
	}
450
	return false;
L
Linus Torvalds 已提交
451 452
}

453
static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
454 455
					     struct flowi6 *fl6, int oif,
					     int strict)
456 457 458
{
	struct rt6_info *sibling, *next_sibling;

459 460 461 462 463 464
	/* We might have already computed the hash for ICMPv6 errors. In such
	 * case it will always be non-zero. Otherwise now is the time to do it.
	 */
	if (!fl6->mp_hash)
		fl6->mp_hash = rt6_multipath_hash(fl6, NULL);

465 466 467 468 469 470 471 472 473 474 475 476 477
	if (fl6->mp_hash <= atomic_read(&match->rt6i_nh_upper_bound))
		return match;

	list_for_each_entry_safe(sibling, next_sibling, &match->rt6i_siblings,
				 rt6i_siblings) {
		if (fl6->mp_hash > atomic_read(&sibling->rt6i_nh_upper_bound))
			continue;
		if (rt6_score_route(sibling, oif, strict) < 0)
			break;
		match = sibling;
		break;
	}

478 479 480
	return match;
}

L
Linus Torvalds 已提交
481
/*
482
 *	Route lookup. rcu_read_lock() should be held.
L
Linus Torvalds 已提交
483 484
 */

485 486
static inline struct rt6_info *rt6_device_match(struct net *net,
						    struct rt6_info *rt,
487
						    const struct in6_addr *saddr,
L
Linus Torvalds 已提交
488
						    int oif,
489
						    int flags)
L
Linus Torvalds 已提交
490 491 492 493
{
	struct rt6_info *local = NULL;
	struct rt6_info *sprt;

494 495
	if (!oif && ipv6_addr_any(saddr) && !(rt->rt6i_nh_flags & RTNH_F_DEAD))
		return rt;
496

497
	for (sprt = rt; sprt; sprt = rcu_dereference(sprt->rt6_next)) {
498
		struct net_device *dev = sprt->dst.dev;
499

500 501 502
		if (sprt->rt6i_nh_flags & RTNH_F_DEAD)
			continue;

503
		if (oif) {
L
Linus Torvalds 已提交
504 505 506
			if (dev->ifindex == oif)
				return sprt;
			if (dev->flags & IFF_LOOPBACK) {
507
				if (!sprt->rt6i_idev ||
L
Linus Torvalds 已提交
508
				    sprt->rt6i_idev->dev->ifindex != oif) {
509
					if (flags & RT6_LOOKUP_F_IFACE)
L
Linus Torvalds 已提交
510
						continue;
511 512
					if (local &&
					    local->rt6i_idev->dev->ifindex == oif)
L
Linus Torvalds 已提交
513 514 515 516
						continue;
				}
				local = sprt;
			}
517 518 519 520
		} else {
			if (ipv6_chk_addr(net, saddr, dev,
					  flags & RT6_LOOKUP_F_IFACE))
				return sprt;
L
Linus Torvalds 已提交
521
		}
522
	}
L
Linus Torvalds 已提交
523

524
	if (oif) {
L
Linus Torvalds 已提交
525 526 527
		if (local)
			return local;

528
		if (flags & RT6_LOOKUP_F_IFACE)
529
			return net->ipv6.ip6_null_entry;
L
Linus Torvalds 已提交
530
	}
531 532

	return rt->rt6i_nh_flags & RTNH_F_DEAD ? net->ipv6.ip6_null_entry : rt;
L
Linus Torvalds 已提交
533 534
}

535
#ifdef CONFIG_IPV6_ROUTER_PREF
536 537 538 539 540 541 542 543 544 545 546 547 548
struct __rt6_probe_work {
	struct work_struct work;
	struct in6_addr target;
	struct net_device *dev;
};

static void rt6_probe_deferred(struct work_struct *w)
{
	struct in6_addr mcaddr;
	struct __rt6_probe_work *work =
		container_of(w, struct __rt6_probe_work, work);

	addrconf_addr_solict_mult(&work->target, &mcaddr);
549
	ndisc_send_ns(work->dev, &work->target, &mcaddr, NULL, 0);
550
	dev_put(work->dev);
551
	kfree(work);
552 553
}

554 555
static void rt6_probe(struct rt6_info *rt)
{
556
	struct __rt6_probe_work *work;
557
	struct neighbour *neigh;
558 559 560 561 562 563 564 565
	/*
	 * Okay, this does not seem to be appropriate
	 * for now, however, we need to check if it
	 * is really so; aka Router Reachability Probing.
	 *
	 * Router Reachability Probe MUST be rate-limited
	 * to no more than one per minute.
	 */
566
	if (!rt || !(rt->rt6i_flags & RTF_GATEWAY))
567
		return;
568 569 570
	rcu_read_lock_bh();
	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
	if (neigh) {
571 572 573
		if (neigh->nud_state & NUD_VALID)
			goto out;

574
		work = NULL;
575
		write_lock(&neigh->lock);
576 577 578 579 580 581 582
		if (!(neigh->nud_state & NUD_VALID) &&
		    time_after(jiffies,
			       neigh->updated +
			       rt->rt6i_idev->cnf.rtr_probe_interval)) {
			work = kmalloc(sizeof(*work), GFP_ATOMIC);
			if (work)
				__neigh_set_probe_once(neigh);
583
		}
584
		write_unlock(&neigh->lock);
585 586
	} else {
		work = kmalloc(sizeof(*work), GFP_ATOMIC);
587
	}
588 589 590 591 592 593 594 595 596

	if (work) {
		INIT_WORK(&work->work, rt6_probe_deferred);
		work->target = rt->rt6i_gateway;
		dev_hold(rt->dst.dev);
		work->dev = rt->dst.dev;
		schedule_work(&work->work);
	}

597
out:
598
	rcu_read_unlock_bh();
599 600 601 602 603 604 605
}
#else
static inline void rt6_probe(struct rt6_info *rt)
{
}
#endif

L
Linus Torvalds 已提交
606
/*
607
 * Default Router Selection (RFC 2461 6.3.6)
L
Linus Torvalds 已提交
608
 */
D
Dave Jones 已提交
609
static inline int rt6_check_dev(struct rt6_info *rt, int oif)
610
{
611
	struct net_device *dev = rt->dst.dev;
612
	if (!oif || dev->ifindex == oif)
613
		return 2;
614 615 616 617
	if ((dev->flags & IFF_LOOPBACK) &&
	    rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
		return 1;
	return 0;
618
}
L
Linus Torvalds 已提交
619

620
static inline enum rt6_nud_state rt6_check_neigh(struct rt6_info *rt)
L
Linus Torvalds 已提交
621
{
622
	struct neighbour *neigh;
623
	enum rt6_nud_state ret = RT6_NUD_FAIL_HARD;
624

625 626
	if (rt->rt6i_flags & RTF_NONEXTHOP ||
	    !(rt->rt6i_flags & RTF_GATEWAY))
627
		return RT6_NUD_SUCCEED;
628 629 630 631 632

	rcu_read_lock_bh();
	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
	if (neigh) {
		read_lock(&neigh->lock);
633
		if (neigh->nud_state & NUD_VALID)
634
			ret = RT6_NUD_SUCCEED;
635
#ifdef CONFIG_IPV6_ROUTER_PREF
636
		else if (!(neigh->nud_state & NUD_FAILED))
637
			ret = RT6_NUD_SUCCEED;
J
Jiri Benc 已提交
638 639
		else
			ret = RT6_NUD_FAIL_PROBE;
640
#endif
641
		read_unlock(&neigh->lock);
642 643
	} else {
		ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
J
Jiri Benc 已提交
644
		      RT6_NUD_SUCCEED : RT6_NUD_FAIL_DO_RR;
645
	}
646 647
	rcu_read_unlock_bh();

648
	return ret;
L
Linus Torvalds 已提交
649 650
}

651 652
static int rt6_score_route(struct rt6_info *rt, int oif,
			   int strict)
L
Linus Torvalds 已提交
653
{
654
	int m;
655

656
	m = rt6_check_dev(rt, oif);
657
	if (!m && (strict & RT6_LOOKUP_F_IFACE))
658
		return RT6_NUD_FAIL_HARD;
659 660 661
#ifdef CONFIG_IPV6_ROUTER_PREF
	m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
#endif
662 663 664 665 666
	if (strict & RT6_LOOKUP_F_REACHABLE) {
		int n = rt6_check_neigh(rt);
		if (n < 0)
			return n;
	}
667 668 669
	return m;
}

670
static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
671 672
				   int *mpri, struct rt6_info *match,
				   bool *do_rr)
673
{
674
	int m;
675
	bool match_do_rr = false;
676 677
	struct inet6_dev *idev = rt->rt6i_idev;

678 679 680
	if (rt->rt6i_nh_flags & RTNH_F_DEAD)
		goto out;

681 682
	if (idev->cnf.ignore_routes_with_linkdown &&
	    rt->rt6i_nh_flags & RTNH_F_LINKDOWN &&
683
	    !(strict & RT6_LOOKUP_F_IGNORE_LINKSTATE))
684
		goto out;
685 686 687 688 689

	if (rt6_check_expired(rt))
		goto out;

	m = rt6_score_route(rt, oif, strict);
J
Jiri Benc 已提交
690
	if (m == RT6_NUD_FAIL_DO_RR) {
691 692
		match_do_rr = true;
		m = 0; /* lowest valid score */
J
Jiri Benc 已提交
693
	} else if (m == RT6_NUD_FAIL_HARD) {
694
		goto out;
695 696 697 698
	}

	if (strict & RT6_LOOKUP_F_REACHABLE)
		rt6_probe(rt);
699

J
Jiri Benc 已提交
700
	/* note that m can be RT6_NUD_FAIL_PROBE at this point */
701
	if (m > *mpri) {
702
		*do_rr = match_do_rr;
703 704 705 706 707 708 709 710
		*mpri = m;
		match = rt;
	}
out:
	return match;
}

static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
W
Wei Wang 已提交
711
				     struct rt6_info *leaf,
712
				     struct rt6_info *rr_head,
713 714
				     u32 metric, int oif, int strict,
				     bool *do_rr)
715
{
716
	struct rt6_info *rt, *match, *cont;
717
	int mpri = -1;
L
Linus Torvalds 已提交
718

719
	match = NULL;
720
	cont = NULL;
721
	for (rt = rr_head; rt; rt = rcu_dereference(rt->rt6_next)) {
722 723 724 725 726 727 728 729
		if (rt->rt6i_metric != metric) {
			cont = rt;
			break;
		}

		match = find_match(rt, oif, strict, &mpri, match, do_rr);
	}

730
	for (rt = leaf; rt && rt != rr_head;
731
	     rt = rcu_dereference(rt->rt6_next)) {
732 733 734 735 736
		if (rt->rt6i_metric != metric) {
			cont = rt;
			break;
		}

737
		match = find_match(rt, oif, strict, &mpri, match, do_rr);
738 739 740 741 742
	}

	if (match || !cont)
		return match;

743
	for (rt = cont; rt; rt = rcu_dereference(rt->rt6_next))
744
		match = find_match(rt, oif, strict, &mpri, match, do_rr);
L
Linus Torvalds 已提交
745

746 747
	return match;
}
L
Linus Torvalds 已提交
748

W
Wei Wang 已提交
749 750
static struct rt6_info *rt6_select(struct net *net, struct fib6_node *fn,
				   int oif, int strict)
751
{
752
	struct rt6_info *leaf = rcu_dereference(fn->leaf);
753
	struct rt6_info *match, *rt0;
754
	bool do_rr = false;
755
	int key_plen;
L
Linus Torvalds 已提交
756

757
	if (!leaf || leaf == net->ipv6.ip6_null_entry)
W
Wei Wang 已提交
758 759
		return net->ipv6.ip6_null_entry;

760
	rt0 = rcu_dereference(fn->rr_ptr);
761
	if (!rt0)
762
		rt0 = leaf;
L
Linus Torvalds 已提交
763

764 765 766 767 768 769 770 771 772 773 774 775 776
	/* Double check to make sure fn is not an intermediate node
	 * and fn->leaf does not points to its child's leaf
	 * (This might happen if all routes under fn are deleted from
	 * the tree and fib6_repair_tree() is called on the node.)
	 */
	key_plen = rt0->rt6i_dst.plen;
#ifdef CONFIG_IPV6_SUBTREES
	if (rt0->rt6i_src.plen)
		key_plen = rt0->rt6i_src.plen;
#endif
	if (fn->fn_bit != key_plen)
		return net->ipv6.ip6_null_entry;

W
Wei Wang 已提交
777
	match = find_rr_leaf(fn, leaf, rt0, rt0->rt6i_metric, oif, strict,
778
			     &do_rr);
L
Linus Torvalds 已提交
779

780
	if (do_rr) {
781
		struct rt6_info *next = rcu_dereference(rt0->rt6_next);
782

783
		/* no entries matched; do round-robin */
784
		if (!next || next->rt6i_metric != rt0->rt6i_metric)
W
Wei Wang 已提交
785
			next = leaf;
786

787 788 789 790 791 792 793
		if (next != rt0) {
			spin_lock_bh(&leaf->rt6i_table->tb6_lock);
			/* make sure next is not being deleted from the tree */
			if (next->rt6i_node)
				rcu_assign_pointer(fn->rr_ptr, next);
			spin_unlock_bh(&leaf->rt6i_table->tb6_lock);
		}
L
Linus Torvalds 已提交
794 795
	}

E
Eric Dumazet 已提交
796
	return match ? match : net->ipv6.ip6_null_entry;
L
Linus Torvalds 已提交
797 798
}

799 800 801 802 803
static bool rt6_is_gw_or_nonexthop(const struct rt6_info *rt)
{
	return (rt->rt6i_flags & (RTF_NONEXTHOP | RTF_GATEWAY));
}

804 805
#ifdef CONFIG_IPV6_ROUTE_INFO
int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
806
		  const struct in6_addr *gwaddr)
807
{
808
	struct net *net = dev_net(dev);
809 810 811
	struct route_info *rinfo = (struct route_info *) opt;
	struct in6_addr prefix_buf, *prefix;
	unsigned int pref;
812
	unsigned long lifetime;
813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835
	struct rt6_info *rt;

	if (len < sizeof(struct route_info)) {
		return -EINVAL;
	}

	/* Sanity check for prefix_len and length */
	if (rinfo->length > 3) {
		return -EINVAL;
	} else if (rinfo->prefix_len > 128) {
		return -EINVAL;
	} else if (rinfo->prefix_len > 64) {
		if (rinfo->length < 2) {
			return -EINVAL;
		}
	} else if (rinfo->prefix_len > 0) {
		if (rinfo->length < 1) {
			return -EINVAL;
		}
	}

	pref = rinfo->route_pref;
	if (pref == ICMPV6_ROUTER_PREF_INVALID)
836
		return -EINVAL;
837

838
	lifetime = addrconf_timeout_fixup(ntohl(rinfo->lifetime), HZ);
839 840 841 842 843 844 845 846 847 848 849

	if (rinfo->length == 3)
		prefix = (struct in6_addr *)rinfo->prefix;
	else {
		/* this function is safe */
		ipv6_addr_prefix(&prefix_buf,
				 (struct in6_addr *)rinfo->prefix,
				 rinfo->prefix_len);
		prefix = &prefix_buf;
	}

850 851 852 853
	if (rinfo->prefix_len == 0)
		rt = rt6_get_dflt_router(gwaddr, dev);
	else
		rt = rt6_get_route_info(net, prefix, rinfo->prefix_len,
854
					gwaddr, dev);
855 856

	if (rt && !lifetime) {
857
		ip6_del_rt(rt);
858 859 860 861
		rt = NULL;
	}

	if (!rt && lifetime)
862 863
		rt = rt6_add_route_info(net, prefix, rinfo->prefix_len, gwaddr,
					dev, pref);
864 865 866 867 868
	else if (rt)
		rt->rt6i_flags = RTF_ROUTEINFO |
				 (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);

	if (rt) {
869 870 871 872 873
		if (!addrconf_finite_timeout(lifetime))
			rt6_clean_expires(rt);
		else
			rt6_set_expires(rt, jiffies + HZ * lifetime);

A
Amerigo Wang 已提交
874
		ip6_rt_put(rt);
875 876 877 878 879
	}
	return 0;
}
#endif

M
Martin KaFai Lau 已提交
880 881 882
static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
					struct in6_addr *saddr)
{
883
	struct fib6_node *pn, *sn;
M
Martin KaFai Lau 已提交
884 885 886
	while (1) {
		if (fn->fn_flags & RTN_TL_ROOT)
			return NULL;
887 888 889 890
		pn = rcu_dereference(fn->parent);
		sn = FIB6_SUBTREE(pn);
		if (sn && sn != fn)
			fn = fib6_lookup(sn, NULL, saddr);
M
Martin KaFai Lau 已提交
891 892 893 894 895 896
		else
			fn = pn;
		if (fn->fn_flags & RTN_RTINFO)
			return fn;
	}
}
T
Thomas Graf 已提交
897

898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914
static bool ip6_hold_safe(struct net *net, struct rt6_info **prt,
			  bool null_fallback)
{
	struct rt6_info *rt = *prt;

	if (dst_hold_safe(&rt->dst))
		return true;
	if (null_fallback) {
		rt = net->ipv6.ip6_null_entry;
		dst_hold(&rt->dst);
	} else {
		rt = NULL;
	}
	*prt = rt;
	return false;
}

915 916
static struct rt6_info *ip6_pol_route_lookup(struct net *net,
					     struct fib6_table *table,
917
					     struct flowi6 *fl6, int flags)
L
Linus Torvalds 已提交
918
{
919
	struct rt6_info *rt, *rt_cache;
L
Linus Torvalds 已提交
920 921
	struct fib6_node *fn;

922
	rcu_read_lock();
923
	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
T
Thomas Graf 已提交
924
restart:
925 926 927 928 929 930 931 932 933 934
	rt = rcu_dereference(fn->leaf);
	if (!rt) {
		rt = net->ipv6.ip6_null_entry;
	} else {
		rt = rt6_device_match(net, rt, &fl6->saddr,
				      fl6->flowi6_oif, flags);
		if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
			rt = rt6_multipath_select(rt, fl6,
						  fl6->flowi6_oif, flags);
	}
M
Martin KaFai Lau 已提交
935 936 937 938 939
	if (rt == net->ipv6.ip6_null_entry) {
		fn = fib6_backtrack(fn, &fl6->saddr);
		if (fn)
			goto restart;
	}
940 941 942 943 944
	/* Search through exception table */
	rt_cache = rt6_find_cached_rt(rt, &fl6->daddr, &fl6->saddr);
	if (rt_cache)
		rt = rt_cache;

945 946 947
	if (ip6_hold_safe(net, &rt, true))
		dst_use_noref(&rt->dst, jiffies);

948
	rcu_read_unlock();
D
David Ahern 已提交
949

950
	trace_fib6_table_lookup(net, rt, table, fl6);
D
David Ahern 已提交
951

T
Thomas Graf 已提交
952 953 954 955
	return rt;

}

956
struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
F
Florian Westphal 已提交
957 958 959 960 961 962
				    int flags)
{
	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_lookup);
}
EXPORT_SYMBOL_GPL(ip6_route_lookup);

963 964
struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
			    const struct in6_addr *saddr, int oif, int strict)
T
Thomas Graf 已提交
965
{
966 967 968
	struct flowi6 fl6 = {
		.flowi6_oif = oif,
		.daddr = *daddr,
T
Thomas Graf 已提交
969 970
	};
	struct dst_entry *dst;
971
	int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
T
Thomas Graf 已提交
972

973
	if (saddr) {
974
		memcpy(&fl6.saddr, saddr, sizeof(*saddr));
975 976 977
		flags |= RT6_LOOKUP_F_HAS_SADDR;
	}

978
	dst = fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_lookup);
T
Thomas Graf 已提交
979 980 981 982 983
	if (dst->error == 0)
		return (struct rt6_info *) dst;

	dst_release(dst);

L
Linus Torvalds 已提交
984 985
	return NULL;
}
986 987
EXPORT_SYMBOL(rt6_lookup);

T
Thomas Graf 已提交
988
/* ip6_ins_rt is called with FREE table->tb6_lock.
989 990 991
 * It takes new route entry, the addition fails by any reason the
 * route is released.
 * Caller must hold dst before calling it.
L
Linus Torvalds 已提交
992 993
 */

994
static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info,
995 996
			struct mx6_config *mxc,
			struct netlink_ext_ack *extack)
L
Linus Torvalds 已提交
997 998
{
	int err;
T
Thomas Graf 已提交
999
	struct fib6_table *table;
L
Linus Torvalds 已提交
1000

T
Thomas Graf 已提交
1001
	table = rt->rt6i_table;
1002
	spin_lock_bh(&table->tb6_lock);
1003
	err = fib6_add(&table->tb6_root, rt, info, mxc, extack);
1004
	spin_unlock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
1005 1006 1007 1008

	return err;
}

1009 1010
int ip6_ins_rt(struct rt6_info *rt)
{
1011 1012 1013
	struct nl_info info = {	.nl_net = dev_net(rt->dst.dev), };
	struct mx6_config mxc = { .mx = NULL, };

1014 1015
	/* Hold dst to account for the reference from the fib6 tree */
	dst_hold(&rt->dst);
1016
	return __ip6_ins_rt(rt, &info, &mxc, NULL);
1017 1018
}

1019 1020 1021 1022 1023
/* called with rcu_lock held */
static struct net_device *ip6_rt_get_dev_rcu(struct rt6_info *rt)
{
	struct net_device *dev = rt->dst.dev;

1024
	if (rt->rt6i_flags & (RTF_LOCAL | RTF_ANYCAST)) {
1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041
		/* for copies of local routes, dst->dev needs to be the
		 * device if it is a master device, the master device if
		 * device is enslaved, and the loopback as the default
		 */
		if (netif_is_l3_slave(dev) &&
		    !rt6_need_strict(&rt->rt6i_dst.addr))
			dev = l3mdev_master_dev_rcu(dev);
		else if (!netif_is_l3_master(dev))
			dev = dev_net(dev)->loopback_dev;
		/* last case is netif_is_l3_master(dev) is true in which
		 * case we want dev returned to be dev
		 */
	}

	return dev;
}

1042 1043 1044
static struct rt6_info *ip6_rt_cache_alloc(struct rt6_info *ort,
					   const struct in6_addr *daddr,
					   const struct in6_addr *saddr)
L
Linus Torvalds 已提交
1045
{
1046
	struct net_device *dev;
L
Linus Torvalds 已提交
1047 1048 1049 1050 1051 1052
	struct rt6_info *rt;

	/*
	 *	Clone the route.
	 */

M
Martin KaFai Lau 已提交
1053
	if (ort->rt6i_flags & (RTF_CACHE | RTF_PCPU))
1054
		ort = ort->from;
L
Linus Torvalds 已提交
1055

1056 1057 1058 1059
	rcu_read_lock();
	dev = ip6_rt_get_dev_rcu(ort);
	rt = __ip6_dst_alloc(dev_net(dev), dev, 0);
	rcu_read_unlock();
M
Martin KaFai Lau 已提交
1060 1061 1062 1063 1064 1065 1066 1067 1068
	if (!rt)
		return NULL;

	ip6_rt_copy_init(rt, ort);
	rt->rt6i_flags |= RTF_CACHE;
	rt->rt6i_metric = 0;
	rt->dst.flags |= DST_HOST;
	rt->rt6i_dst.addr = *daddr;
	rt->rt6i_dst.plen = 128;
L
Linus Torvalds 已提交
1069

M
Martin KaFai Lau 已提交
1070 1071 1072 1073
	if (!rt6_is_gw_or_nonexthop(ort)) {
		if (ort->rt6i_dst.plen != 128 &&
		    ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
			rt->rt6i_flags |= RTF_ANYCAST;
L
Linus Torvalds 已提交
1074
#ifdef CONFIG_IPV6_SUBTREES
M
Martin KaFai Lau 已提交
1075 1076 1077
		if (rt->rt6i_src.plen && saddr) {
			rt->rt6i_src.addr = *saddr;
			rt->rt6i_src.plen = 128;
1078
		}
M
Martin KaFai Lau 已提交
1079
#endif
1080
	}
L
Linus Torvalds 已提交
1081

1082 1083
	return rt;
}
L
Linus Torvalds 已提交
1084

M
Martin KaFai Lau 已提交
1085 1086
static struct rt6_info *ip6_rt_pcpu_alloc(struct rt6_info *rt)
{
1087
	struct net_device *dev;
M
Martin KaFai Lau 已提交
1088 1089
	struct rt6_info *pcpu_rt;

1090 1091 1092 1093
	rcu_read_lock();
	dev = ip6_rt_get_dev_rcu(rt);
	pcpu_rt = __ip6_dst_alloc(dev_net(dev), dev, rt->dst.flags);
	rcu_read_unlock();
M
Martin KaFai Lau 已提交
1094 1095 1096 1097 1098 1099 1100 1101
	if (!pcpu_rt)
		return NULL;
	ip6_rt_copy_init(pcpu_rt, rt);
	pcpu_rt->rt6i_protocol = rt->rt6i_protocol;
	pcpu_rt->rt6i_flags |= RTF_PCPU;
	return pcpu_rt;
}

1102
/* It should be called with rcu_read_lock() acquired */
M
Martin KaFai Lau 已提交
1103 1104
static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt)
{
1105
	struct rt6_info *pcpu_rt, **p;
M
Martin KaFai Lau 已提交
1106 1107 1108 1109

	p = this_cpu_ptr(rt->rt6i_pcpu);
	pcpu_rt = *p;

1110
	if (pcpu_rt && ip6_hold_safe(NULL, &pcpu_rt, false))
1111
		rt6_dst_from_metrics_check(pcpu_rt);
1112

1113 1114 1115 1116 1117 1118
	return pcpu_rt;
}

static struct rt6_info *rt6_make_pcpu_route(struct rt6_info *rt)
{
	struct rt6_info *pcpu_rt, *prev, **p;
M
Martin KaFai Lau 已提交
1119 1120 1121 1122 1123

	pcpu_rt = ip6_rt_pcpu_alloc(rt);
	if (!pcpu_rt) {
		struct net *net = dev_net(rt->dst.dev);

1124 1125
		dst_hold(&net->ipv6.ip6_null_entry->dst);
		return net->ipv6.ip6_null_entry;
M
Martin KaFai Lau 已提交
1126 1127
	}

1128 1129 1130
	dst_hold(&pcpu_rt->dst);
	p = this_cpu_ptr(rt->rt6i_pcpu);
	prev = cmpxchg(p, NULL, pcpu_rt);
1131
	BUG_ON(prev);
1132

M
Martin KaFai Lau 已提交
1133 1134 1135 1136
	rt6_dst_from_metrics_check(pcpu_rt);
	return pcpu_rt;
}

1137 1138 1139 1140 1141 1142 1143 1144 1145 1146
/* exception hash table implementation
 */
static DEFINE_SPINLOCK(rt6_exception_lock);

/* Remove rt6_ex from hash table and free the memory
 * Caller must hold rt6_exception_lock
 */
static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
				 struct rt6_exception *rt6_ex)
{
1147
	struct net *net;
W
Wei Wang 已提交
1148

1149 1150
	if (!bucket || !rt6_ex)
		return;
1151 1152

	net = dev_net(rt6_ex->rt6i->dst.dev);
1153 1154 1155 1156 1157 1158
	rt6_ex->rt6i->rt6i_node = NULL;
	hlist_del_rcu(&rt6_ex->hlist);
	rt6_release(rt6_ex->rt6i);
	kfree_rcu(rt6_ex, rcu);
	WARN_ON_ONCE(!bucket->depth);
	bucket->depth--;
W
Wei Wang 已提交
1159
	net->ipv6.rt6_stats->fib_rt_cache--;
1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265
}

/* Remove oldest rt6_ex in bucket and free the memory
 * Caller must hold rt6_exception_lock
 */
static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
{
	struct rt6_exception *rt6_ex, *oldest = NULL;

	if (!bucket)
		return;

	hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
		if (!oldest || time_before(rt6_ex->stamp, oldest->stamp))
			oldest = rt6_ex;
	}
	rt6_remove_exception(bucket, oldest);
}

static u32 rt6_exception_hash(const struct in6_addr *dst,
			      const struct in6_addr *src)
{
	static u32 seed __read_mostly;
	u32 val;

	net_get_random_once(&seed, sizeof(seed));
	val = jhash(dst, sizeof(*dst), seed);

#ifdef CONFIG_IPV6_SUBTREES
	if (src)
		val = jhash(src, sizeof(*src), val);
#endif
	return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
}

/* Helper function to find the cached rt in the hash table
 * and update bucket pointer to point to the bucket for this
 * (daddr, saddr) pair
 * Caller must hold rt6_exception_lock
 */
static struct rt6_exception *
__rt6_find_exception_spinlock(struct rt6_exception_bucket **bucket,
			      const struct in6_addr *daddr,
			      const struct in6_addr *saddr)
{
	struct rt6_exception *rt6_ex;
	u32 hval;

	if (!(*bucket) || !daddr)
		return NULL;

	hval = rt6_exception_hash(daddr, saddr);
	*bucket += hval;

	hlist_for_each_entry(rt6_ex, &(*bucket)->chain, hlist) {
		struct rt6_info *rt6 = rt6_ex->rt6i;
		bool matched = ipv6_addr_equal(daddr, &rt6->rt6i_dst.addr);

#ifdef CONFIG_IPV6_SUBTREES
		if (matched && saddr)
			matched = ipv6_addr_equal(saddr, &rt6->rt6i_src.addr);
#endif
		if (matched)
			return rt6_ex;
	}
	return NULL;
}

/* Helper function to find the cached rt in the hash table
 * and update bucket pointer to point to the bucket for this
 * (daddr, saddr) pair
 * Caller must hold rcu_read_lock()
 */
static struct rt6_exception *
__rt6_find_exception_rcu(struct rt6_exception_bucket **bucket,
			 const struct in6_addr *daddr,
			 const struct in6_addr *saddr)
{
	struct rt6_exception *rt6_ex;
	u32 hval;

	WARN_ON_ONCE(!rcu_read_lock_held());

	if (!(*bucket) || !daddr)
		return NULL;

	hval = rt6_exception_hash(daddr, saddr);
	*bucket += hval;

	hlist_for_each_entry_rcu(rt6_ex, &(*bucket)->chain, hlist) {
		struct rt6_info *rt6 = rt6_ex->rt6i;
		bool matched = ipv6_addr_equal(daddr, &rt6->rt6i_dst.addr);

#ifdef CONFIG_IPV6_SUBTREES
		if (matched && saddr)
			matched = ipv6_addr_equal(saddr, &rt6->rt6i_src.addr);
#endif
		if (matched)
			return rt6_ex;
	}
	return NULL;
}

static int rt6_insert_exception(struct rt6_info *nrt,
				struct rt6_info *ort)
{
W
Wei Wang 已提交
1266
	struct net *net = dev_net(ort->dst.dev);
1267 1268 1269 1270 1271 1272 1273
	struct rt6_exception_bucket *bucket;
	struct in6_addr *src_key = NULL;
	struct rt6_exception *rt6_ex;
	int err = 0;

	/* ort can't be a cache or pcpu route */
	if (ort->rt6i_flags & (RTF_CACHE | RTF_PCPU))
1274
		ort = ort->from;
1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305
	WARN_ON_ONCE(ort->rt6i_flags & (RTF_CACHE | RTF_PCPU));

	spin_lock_bh(&rt6_exception_lock);

	if (ort->exception_bucket_flushed) {
		err = -EINVAL;
		goto out;
	}

	bucket = rcu_dereference_protected(ort->rt6i_exception_bucket,
					lockdep_is_held(&rt6_exception_lock));
	if (!bucket) {
		bucket = kcalloc(FIB6_EXCEPTION_BUCKET_SIZE, sizeof(*bucket),
				 GFP_ATOMIC);
		if (!bucket) {
			err = -ENOMEM;
			goto out;
		}
		rcu_assign_pointer(ort->rt6i_exception_bucket, bucket);
	}

#ifdef CONFIG_IPV6_SUBTREES
	/* rt6i_src.plen != 0 indicates ort is in subtree
	 * and exception table is indexed by a hash of
	 * both rt6i_dst and rt6i_src.
	 * Otherwise, the exception table is indexed by
	 * a hash of only rt6i_dst.
	 */
	if (ort->rt6i_src.plen)
		src_key = &nrt->rt6i_src.addr;
#endif
1306 1307 1308 1309 1310

	/* Update rt6i_prefsrc as it could be changed
	 * in rt6_remove_prefsrc()
	 */
	nrt->rt6i_prefsrc = ort->rt6i_prefsrc;
1311 1312 1313 1314 1315 1316 1317 1318
	/* rt6_mtu_change() might lower mtu on ort.
	 * Only insert this exception route if its mtu
	 * is less than ort's mtu value.
	 */
	if (nrt->rt6i_pmtu >= dst_mtu(&ort->dst)) {
		err = -EINVAL;
		goto out;
	}
1319

1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335
	rt6_ex = __rt6_find_exception_spinlock(&bucket, &nrt->rt6i_dst.addr,
					       src_key);
	if (rt6_ex)
		rt6_remove_exception(bucket, rt6_ex);

	rt6_ex = kzalloc(sizeof(*rt6_ex), GFP_ATOMIC);
	if (!rt6_ex) {
		err = -ENOMEM;
		goto out;
	}
	rt6_ex->rt6i = nrt;
	rt6_ex->stamp = jiffies;
	atomic_inc(&nrt->rt6i_ref);
	nrt->rt6i_node = ort->rt6i_node;
	hlist_add_head_rcu(&rt6_ex->hlist, &bucket->chain);
	bucket->depth++;
W
Wei Wang 已提交
1336
	net->ipv6.rt6_stats->fib_rt_cache++;
1337 1338 1339 1340 1341 1342 1343 1344

	if (bucket->depth > FIB6_MAX_DEPTH)
		rt6_exception_remove_oldest(bucket);

out:
	spin_unlock_bh(&rt6_exception_lock);

	/* Update fn->fn_sernum to invalidate all cached dst */
1345
	if (!err) {
1346
		spin_lock_bh(&ort->rt6i_table->tb6_lock);
1347
		fib6_update_sernum(ort);
1348
		spin_unlock_bh(&ort->rt6i_table->tb6_lock);
1349 1350
		fib6_force_start_gc(net);
	}
1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417

	return err;
}

void rt6_flush_exceptions(struct rt6_info *rt)
{
	struct rt6_exception_bucket *bucket;
	struct rt6_exception *rt6_ex;
	struct hlist_node *tmp;
	int i;

	spin_lock_bh(&rt6_exception_lock);
	/* Prevent rt6_insert_exception() to recreate the bucket list */
	rt->exception_bucket_flushed = 1;

	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
				    lockdep_is_held(&rt6_exception_lock));
	if (!bucket)
		goto out;

	for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
		hlist_for_each_entry_safe(rt6_ex, tmp, &bucket->chain, hlist)
			rt6_remove_exception(bucket, rt6_ex);
		WARN_ON_ONCE(bucket->depth);
		bucket++;
	}

out:
	spin_unlock_bh(&rt6_exception_lock);
}

/* Find cached rt in the hash table inside passed in rt
 * Caller has to hold rcu_read_lock()
 */
static struct rt6_info *rt6_find_cached_rt(struct rt6_info *rt,
					   struct in6_addr *daddr,
					   struct in6_addr *saddr)
{
	struct rt6_exception_bucket *bucket;
	struct in6_addr *src_key = NULL;
	struct rt6_exception *rt6_ex;
	struct rt6_info *res = NULL;

	bucket = rcu_dereference(rt->rt6i_exception_bucket);

#ifdef CONFIG_IPV6_SUBTREES
	/* rt6i_src.plen != 0 indicates rt is in subtree
	 * and exception table is indexed by a hash of
	 * both rt6i_dst and rt6i_src.
	 * Otherwise, the exception table is indexed by
	 * a hash of only rt6i_dst.
	 */
	if (rt->rt6i_src.plen)
		src_key = saddr;
#endif
	rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);

	if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
		res = rt6_ex->rt6i;

	return res;
}

/* Remove the passed in cached rt from the hash table that contains it */
int rt6_remove_exception_rt(struct rt6_info *rt)
{
	struct rt6_exception_bucket *bucket;
1418
	struct rt6_info *from = rt->from;
1419 1420 1421 1422 1423
	struct in6_addr *src_key = NULL;
	struct rt6_exception *rt6_ex;
	int err;

	if (!from ||
1424
	    !(rt->rt6i_flags & RTF_CACHE))
1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462
		return -EINVAL;

	if (!rcu_access_pointer(from->rt6i_exception_bucket))
		return -ENOENT;

	spin_lock_bh(&rt6_exception_lock);
	bucket = rcu_dereference_protected(from->rt6i_exception_bucket,
				    lockdep_is_held(&rt6_exception_lock));
#ifdef CONFIG_IPV6_SUBTREES
	/* rt6i_src.plen != 0 indicates 'from' is in subtree
	 * and exception table is indexed by a hash of
	 * both rt6i_dst and rt6i_src.
	 * Otherwise, the exception table is indexed by
	 * a hash of only rt6i_dst.
	 */
	if (from->rt6i_src.plen)
		src_key = &rt->rt6i_src.addr;
#endif
	rt6_ex = __rt6_find_exception_spinlock(&bucket,
					       &rt->rt6i_dst.addr,
					       src_key);
	if (rt6_ex) {
		rt6_remove_exception(bucket, rt6_ex);
		err = 0;
	} else {
		err = -ENOENT;
	}

	spin_unlock_bh(&rt6_exception_lock);
	return err;
}

/* Find rt6_ex which contains the passed in rt cache and
 * refresh its stamp
 */
static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
{
	struct rt6_exception_bucket *bucket;
1463
	struct rt6_info *from = rt->from;
1464 1465 1466 1467
	struct in6_addr *src_key = NULL;
	struct rt6_exception *rt6_ex;

	if (!from ||
1468
	    !(rt->rt6i_flags & RTF_CACHE))
1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492
		return;

	rcu_read_lock();
	bucket = rcu_dereference(from->rt6i_exception_bucket);

#ifdef CONFIG_IPV6_SUBTREES
	/* rt6i_src.plen != 0 indicates 'from' is in subtree
	 * and exception table is indexed by a hash of
	 * both rt6i_dst and rt6i_src.
	 * Otherwise, the exception table is indexed by
	 * a hash of only rt6i_dst.
	 */
	if (from->rt6i_src.plen)
		src_key = &rt->rt6i_src.addr;
#endif
	rt6_ex = __rt6_find_exception_rcu(&bucket,
					  &rt->rt6i_dst.addr,
					  src_key);
	if (rt6_ex)
		rt6_ex->stamp = jiffies;

	rcu_read_unlock();
}

1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511
static void rt6_exceptions_remove_prefsrc(struct rt6_info *rt)
{
	struct rt6_exception_bucket *bucket;
	struct rt6_exception *rt6_ex;
	int i;

	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
					lockdep_is_held(&rt6_exception_lock));

	if (bucket) {
		for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
			hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
				rt6_ex->rt6i->rt6i_prefsrc.plen = 0;
			}
			bucket++;
		}
	}
}

1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537
static void rt6_exceptions_update_pmtu(struct rt6_info *rt, int mtu)
{
	struct rt6_exception_bucket *bucket;
	struct rt6_exception *rt6_ex;
	int i;

	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
					lockdep_is_held(&rt6_exception_lock));

	if (bucket) {
		for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
			hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
				struct rt6_info *entry = rt6_ex->rt6i;
				/* For RTF_CACHE with rt6i_pmtu == 0
				 * (i.e. a redirected route),
				 * the metrics of its rt->dst.from has already
				 * been updated.
				 */
				if (entry->rt6i_pmtu && entry->rt6i_pmtu > mtu)
					entry->rt6i_pmtu = mtu;
			}
			bucket++;
		}
	}
}

1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574
#define RTF_CACHE_GATEWAY	(RTF_GATEWAY | RTF_CACHE)

static void rt6_exceptions_clean_tohost(struct rt6_info *rt,
					struct in6_addr *gateway)
{
	struct rt6_exception_bucket *bucket;
	struct rt6_exception *rt6_ex;
	struct hlist_node *tmp;
	int i;

	if (!rcu_access_pointer(rt->rt6i_exception_bucket))
		return;

	spin_lock_bh(&rt6_exception_lock);
	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
				     lockdep_is_held(&rt6_exception_lock));

	if (bucket) {
		for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
			hlist_for_each_entry_safe(rt6_ex, tmp,
						  &bucket->chain, hlist) {
				struct rt6_info *entry = rt6_ex->rt6i;

				if ((entry->rt6i_flags & RTF_CACHE_GATEWAY) ==
				    RTF_CACHE_GATEWAY &&
				    ipv6_addr_equal(gateway,
						    &entry->rt6i_gateway)) {
					rt6_remove_exception(bucket, rt6_ex);
				}
			}
			bucket++;
		}
	}

	spin_unlock_bh(&rt6_exception_lock);
}

1575 1576 1577 1578 1579 1580 1581
static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket,
				      struct rt6_exception *rt6_ex,
				      struct fib6_gc_args *gc_args,
				      unsigned long now)
{
	struct rt6_info *rt = rt6_ex->rt6i;

1582 1583 1584 1585 1586 1587
	/* we are pruning and obsoleting aged-out and non gateway exceptions
	 * even if others have still references to them, so that on next
	 * dst_check() such references can be dropped.
	 * EXPIRES exceptions - e.g. pmtu-generated ones are pruned when
	 * expired, independently from their aging, as per RFC 8201 section 4
	 */
W
Wei Wang 已提交
1588 1589 1590 1591 1592 1593 1594 1595
	if (!(rt->rt6i_flags & RTF_EXPIRES)) {
		if (time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) {
			RT6_TRACE("aging clone %p\n", rt);
			rt6_remove_exception(bucket, rt6_ex);
			return;
		}
	} else if (time_after(jiffies, rt->dst.expires)) {
		RT6_TRACE("purging expired route %p\n", rt);
1596 1597
		rt6_remove_exception(bucket, rt6_ex);
		return;
W
Wei Wang 已提交
1598 1599 1600
	}

	if (rt->rt6i_flags & RTF_GATEWAY) {
1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615
		struct neighbour *neigh;
		__u8 neigh_flags = 0;

		neigh = dst_neigh_lookup(&rt->dst, &rt->rt6i_gateway);
		if (neigh) {
			neigh_flags = neigh->flags;
			neigh_release(neigh);
		}
		if (!(neigh_flags & NTF_ROUTER)) {
			RT6_TRACE("purging route %p via non-router but gateway\n",
				  rt);
			rt6_remove_exception(bucket, rt6_ex);
			return;
		}
	}
W
Wei Wang 已提交
1616

1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648
	gc_args->more++;
}

void rt6_age_exceptions(struct rt6_info *rt,
			struct fib6_gc_args *gc_args,
			unsigned long now)
{
	struct rt6_exception_bucket *bucket;
	struct rt6_exception *rt6_ex;
	struct hlist_node *tmp;
	int i;

	if (!rcu_access_pointer(rt->rt6i_exception_bucket))
		return;

	spin_lock_bh(&rt6_exception_lock);
	bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
				    lockdep_is_held(&rt6_exception_lock));

	if (bucket) {
		for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
			hlist_for_each_entry_safe(rt6_ex, tmp,
						  &bucket->chain, hlist) {
				rt6_age_examine_exception(bucket, rt6_ex,
							  gc_args, now);
			}
			bucket++;
		}
	}
	spin_unlock_bh(&rt6_exception_lock);
}

1649 1650
struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
			       int oif, struct flowi6 *fl6, int flags)
L
Linus Torvalds 已提交
1651
{
1652
	struct fib6_node *fn, *saved_fn;
1653
	struct rt6_info *rt, *rt_cache;
T
Thomas Graf 已提交
1654
	int strict = 0;
L
Linus Torvalds 已提交
1655

1656
	strict |= flags & RT6_LOOKUP_F_IFACE;
1657
	strict |= flags & RT6_LOOKUP_F_IGNORE_LINKSTATE;
1658 1659
	if (net->ipv6.devconf_all->forwarding == 0)
		strict |= RT6_LOOKUP_F_REACHABLE;
L
Linus Torvalds 已提交
1660

1661
	rcu_read_lock();
L
Linus Torvalds 已提交
1662

1663
	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
1664
	saved_fn = fn;
L
Linus Torvalds 已提交
1665

D
David Ahern 已提交
1666 1667 1668
	if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF)
		oif = 0;

M
Martin KaFai Lau 已提交
1669
redo_rt6_select:
W
Wei Wang 已提交
1670
	rt = rt6_select(net, fn, oif, strict);
1671
	if (rt->rt6i_nsiblings)
1672
		rt = rt6_multipath_select(rt, fl6, oif, strict);
M
Martin KaFai Lau 已提交
1673 1674 1675 1676
	if (rt == net->ipv6.ip6_null_entry) {
		fn = fib6_backtrack(fn, &fl6->saddr);
		if (fn)
			goto redo_rt6_select;
1677 1678 1679 1680 1681 1682
		else if (strict & RT6_LOOKUP_F_REACHABLE) {
			/* also consider unreachable route */
			strict &= ~RT6_LOOKUP_F_REACHABLE;
			fn = saved_fn;
			goto redo_rt6_select;
		}
M
Martin KaFai Lau 已提交
1683 1684
	}

1685 1686 1687 1688
	/*Search through exception table */
	rt_cache = rt6_find_cached_rt(rt, &fl6->daddr, &fl6->saddr);
	if (rt_cache)
		rt = rt_cache;
1689

1690
	if (rt == net->ipv6.ip6_null_entry) {
1691
		rcu_read_unlock();
1692
		dst_hold(&rt->dst);
1693
		trace_fib6_table_lookup(net, rt, table, fl6);
1694 1695 1696 1697 1698 1699
		return rt;
	} else if (rt->rt6i_flags & RTF_CACHE) {
		if (ip6_hold_safe(net, &rt, true)) {
			dst_use_noref(&rt->dst, jiffies);
			rt6_dst_from_metrics_check(rt);
		}
1700
		rcu_read_unlock();
1701
		trace_fib6_table_lookup(net, rt, table, fl6);
M
Martin KaFai Lau 已提交
1702
		return rt;
1703 1704 1705 1706 1707 1708 1709 1710 1711 1712
	} else if (unlikely((fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH) &&
			    !(rt->rt6i_flags & RTF_GATEWAY))) {
		/* Create a RTF_CACHE clone which will not be
		 * owned by the fib6 tree.  It is for the special case where
		 * the daddr in the skb during the neighbor look-up is different
		 * from the fl6->daddr used to look-up route here.
		 */

		struct rt6_info *uncached_rt;

1713 1714 1715
		if (ip6_hold_safe(net, &rt, true)) {
			dst_use_noref(&rt->dst, jiffies);
		} else {
1716
			rcu_read_unlock();
1717 1718 1719
			uncached_rt = rt;
			goto uncached_rt_out;
		}
1720
		rcu_read_unlock();
M
Martin KaFai Lau 已提交
1721

1722 1723
		uncached_rt = ip6_rt_cache_alloc(rt, &fl6->daddr, NULL);
		dst_release(&rt->dst);
T
Thomas Graf 已提交
1724

1725 1726 1727 1728
		if (uncached_rt) {
			/* Uncached_rt's refcnt is taken during ip6_rt_cache_alloc()
			 * No need for another dst_hold()
			 */
1729
			rt6_uncached_list_add(uncached_rt);
W
Wei Wang 已提交
1730
			atomic_inc(&net->ipv6.rt6_stats->fib_rt_uncache);
1731
		} else {
1732
			uncached_rt = net->ipv6.ip6_null_entry;
1733 1734
			dst_hold(&uncached_rt->dst);
		}
D
David Ahern 已提交
1735

1736
uncached_rt_out:
1737
		trace_fib6_table_lookup(net, uncached_rt, table, fl6);
1738 1739
		return uncached_rt;

M
Martin KaFai Lau 已提交
1740 1741 1742 1743 1744
	} else {
		/* Get a percpu copy */

		struct rt6_info *pcpu_rt;

1745
		dst_use_noref(&rt->dst, jiffies);
1746
		local_bh_disable();
M
Martin KaFai Lau 已提交
1747 1748
		pcpu_rt = rt6_get_pcpu_route(rt);

1749
		if (!pcpu_rt) {
1750 1751
			/* atomic_inc_not_zero() is needed when using rcu */
			if (atomic_inc_not_zero(&rt->rt6i_ref)) {
1752
				/* No dst_hold() on rt is needed because grabbing
1753 1754 1755 1756 1757 1758 1759 1760 1761
				 * rt->rt6i_ref makes sure rt can't be released.
				 */
				pcpu_rt = rt6_make_pcpu_route(rt);
				rt6_release(rt);
			} else {
				/* rt is already removed from tree */
				pcpu_rt = net->ipv6.ip6_null_entry;
				dst_hold(&pcpu_rt->dst);
			}
1762
		}
1763 1764
		local_bh_enable();
		rcu_read_unlock();
1765
		trace_fib6_table_lookup(net, pcpu_rt, table, fl6);
M
Martin KaFai Lau 已提交
1766 1767
		return pcpu_rt;
	}
L
Linus Torvalds 已提交
1768
}
1769
EXPORT_SYMBOL_GPL(ip6_pol_route);
L
Linus Torvalds 已提交
1770

1771
static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
1772
					    struct flowi6 *fl6, int flags)
1773
{
1774
	return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
1775 1776
}

1777 1778 1779
struct dst_entry *ip6_route_input_lookup(struct net *net,
					 struct net_device *dev,
					 struct flowi6 *fl6, int flags)
1780 1781 1782 1783 1784 1785
{
	if (rt6_need_strict(&fl6->daddr) && dev->type != ARPHRD_PIMREG)
		flags |= RT6_LOOKUP_F_IFACE;

	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_input);
}
1786
EXPORT_SYMBOL_GPL(ip6_route_input_lookup);
1787

1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829
static void ip6_multipath_l3_keys(const struct sk_buff *skb,
				  struct flow_keys *keys)
{
	const struct ipv6hdr *outer_iph = ipv6_hdr(skb);
	const struct ipv6hdr *key_iph = outer_iph;
	const struct ipv6hdr *inner_iph;
	const struct icmp6hdr *icmph;
	struct ipv6hdr _inner_iph;

	if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
		goto out;

	icmph = icmp6_hdr(skb);
	if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
	    icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
	    icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
	    icmph->icmp6_type != ICMPV6_PARAMPROB)
		goto out;

	inner_iph = skb_header_pointer(skb,
				       skb_transport_offset(skb) + sizeof(*icmph),
				       sizeof(_inner_iph), &_inner_iph);
	if (!inner_iph)
		goto out;

	key_iph = inner_iph;
out:
	memset(keys, 0, sizeof(*keys));
	keys->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
	keys->addrs.v6addrs.src = key_iph->saddr;
	keys->addrs.v6addrs.dst = key_iph->daddr;
	keys->tags.flow_label = ip6_flowinfo(key_iph);
	keys->basic.ip_proto = key_iph->nexthdr;
}

/* if skb is set it will be used and fl6 can be NULL */
u32 rt6_multipath_hash(const struct flowi6 *fl6, const struct sk_buff *skb)
{
	struct flow_keys hash_keys;

	if (skb) {
		ip6_multipath_l3_keys(skb, &hash_keys);
I
Ido Schimmel 已提交
1830
		return flow_hash_from_keys(&hash_keys) >> 1;
1831 1832
	}

I
Ido Schimmel 已提交
1833
	return get_hash_from_flowi6(fl6) >> 1;
1834 1835
}

T
Thomas Graf 已提交
1836 1837
void ip6_route_input(struct sk_buff *skb)
{
1838
	const struct ipv6hdr *iph = ipv6_hdr(skb);
1839
	struct net *net = dev_net(skb->dev);
1840
	int flags = RT6_LOOKUP_F_HAS_SADDR;
1841
	struct ip_tunnel_info *tun_info;
1842
	struct flowi6 fl6 = {
1843
		.flowi6_iif = skb->dev->ifindex,
1844 1845
		.daddr = iph->daddr,
		.saddr = iph->saddr,
1846
		.flowlabel = ip6_flowinfo(iph),
1847 1848
		.flowi6_mark = skb->mark,
		.flowi6_proto = iph->nexthdr,
T
Thomas Graf 已提交
1849
	};
1850

1851
	tun_info = skb_tunnel_info(skb);
1852
	if (tun_info && !(tun_info->mode & IP_TUNNEL_INFO_TX))
1853
		fl6.flowi6_tun_key.tun_id = tun_info->key.tun_id;
1854 1855
	if (unlikely(fl6.flowi6_proto == IPPROTO_ICMPV6))
		fl6.mp_hash = rt6_multipath_hash(&fl6, skb);
1856
	skb_dst_drop(skb);
1857
	skb_dst_set(skb, ip6_route_input_lookup(net, skb->dev, &fl6, flags));
T
Thomas Graf 已提交
1858 1859
}

1860
static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
1861
					     struct flowi6 *fl6, int flags)
L
Linus Torvalds 已提交
1862
{
1863
	return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
T
Thomas Graf 已提交
1864 1865
}

1866 1867
struct dst_entry *ip6_route_output_flags(struct net *net, const struct sock *sk,
					 struct flowi6 *fl6, int flags)
T
Thomas Graf 已提交
1868
{
1869
	bool any_src;
T
Thomas Graf 已提交
1870

1871 1872 1873 1874 1875 1876 1877
	if (rt6_need_strict(&fl6->daddr)) {
		struct dst_entry *dst;

		dst = l3mdev_link_scope_lookup(net, fl6);
		if (dst)
			return dst;
	}
D
David Ahern 已提交
1878

1879
	fl6->flowi6_iif = LOOPBACK_IFINDEX;
1880

1881
	any_src = ipv6_addr_any(&fl6->saddr);
1882
	if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr) ||
1883
	    (fl6->flowi6_oif && any_src))
1884
		flags |= RT6_LOOKUP_F_IFACE;
T
Thomas Graf 已提交
1885

1886
	if (!any_src)
1887
		flags |= RT6_LOOKUP_F_HAS_SADDR;
1888 1889
	else if (sk)
		flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
1890

1891
	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_output);
L
Linus Torvalds 已提交
1892
}
1893
EXPORT_SYMBOL_GPL(ip6_route_output_flags);
L
Linus Torvalds 已提交
1894

1895
struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
1896
{
1897
	struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
1898
	struct net_device *loopback_dev = net->loopback_dev;
1899 1900
	struct dst_entry *new = NULL;

1901
	rt = dst_alloc(&ip6_dst_blackhole_ops, loopback_dev, 1,
1902
		       DST_OBSOLETE_DEAD, 0);
1903
	if (rt) {
1904
		rt6_info_init(rt);
W
Wei Wang 已提交
1905
		atomic_inc(&net->ipv6.rt6_stats->fib_rt_alloc);
1906

1907
		new = &rt->dst;
1908
		new->__use = 1;
1909
		new->input = dst_discard;
E
Eric W. Biederman 已提交
1910
		new->output = dst_discard_out;
1911

1912
		dst_copy_metrics(new, &ort->dst);
1913

1914
		rt->rt6i_idev = in6_dev_get(loopback_dev);
A
Alexey Dobriyan 已提交
1915
		rt->rt6i_gateway = ort->rt6i_gateway;
1916
		rt->rt6i_flags = ort->rt6i_flags & ~RTF_PCPU;
1917 1918 1919 1920 1921 1922 1923 1924
		rt->rt6i_metric = 0;

		memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
#ifdef CONFIG_IPV6_SUBTREES
		memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
#endif
	}

1925 1926
	dst_release(dst_orig);
	return new ? new : ERR_PTR(-ENOMEM);
1927 1928
}

L
Linus Torvalds 已提交
1929 1930 1931 1932
/*
 *	Destination cache support functions
 */

1933 1934
static void rt6_dst_from_metrics_check(struct rt6_info *rt)
{
1935 1936 1937
	if (rt->from &&
	    dst_metrics_ptr(&rt->dst) != dst_metrics_ptr(&rt->from->dst))
		dst_init_metrics(&rt->dst, dst_metrics_ptr(&rt->from->dst), true);
1938 1939
}

1940 1941
static struct dst_entry *rt6_check(struct rt6_info *rt, u32 cookie)
{
1942
	u32 rt_cookie = 0;
1943 1944

	if (!rt6_get_cookie_safe(rt, &rt_cookie) || rt_cookie != cookie)
1945 1946 1947 1948 1949 1950 1951 1952 1953 1954
		return NULL;

	if (rt6_check_expired(rt))
		return NULL;

	return &rt->dst;
}

static struct dst_entry *rt6_dst_from_check(struct rt6_info *rt, u32 cookie)
{
1955 1956
	if (!__rt6_check_expired(rt) &&
	    rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1957
	    rt6_check(rt->from, cookie))
1958 1959 1960 1961 1962
		return &rt->dst;
	else
		return NULL;
}

L
Linus Torvalds 已提交
1963 1964 1965 1966 1967 1968
static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
{
	struct rt6_info *rt;

	rt = (struct rt6_info *) dst;

1969 1970 1971 1972
	/* All IPV6 dsts are created with ->obsolete set to the value
	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
	 * into this function always.
	 */
1973

1974 1975
	rt6_dst_from_metrics_check(rt);

1976
	if (rt->rt6i_flags & RTF_PCPU ||
1977
	    (unlikely(!list_empty(&rt->rt6i_uncached)) && rt->from))
1978 1979 1980
		return rt6_dst_from_check(rt, cookie);
	else
		return rt6_check(rt, cookie);
L
Linus Torvalds 已提交
1981 1982 1983 1984 1985 1986 1987
}

static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
{
	struct rt6_info *rt = (struct rt6_info *) dst;

	if (rt) {
1988 1989 1990 1991 1992 1993
		if (rt->rt6i_flags & RTF_CACHE) {
			if (rt6_check_expired(rt)) {
				ip6_del_rt(rt);
				dst = NULL;
			}
		} else {
L
Linus Torvalds 已提交
1994
			dst_release(dst);
1995 1996
			dst = NULL;
		}
L
Linus Torvalds 已提交
1997
	}
1998
	return dst;
L
Linus Torvalds 已提交
1999 2000 2001 2002 2003 2004
}

static void ip6_link_failure(struct sk_buff *skb)
{
	struct rt6_info *rt;

2005
	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
L
Linus Torvalds 已提交
2006

E
Eric Dumazet 已提交
2007
	rt = (struct rt6_info *) skb_dst(skb);
L
Linus Torvalds 已提交
2008
	if (rt) {
2009
		if (rt->rt6i_flags & RTF_CACHE) {
W
Wei Wang 已提交
2010 2011
			if (dst_hold_safe(&rt->dst))
				ip6_del_rt(rt);
2012 2013 2014 2015 2016 2017 2018 2019
		} else {
			struct fib6_node *fn;

			rcu_read_lock();
			fn = rcu_dereference(rt->rt6i_node);
			if (fn && (rt->rt6i_flags & RTF_DEFAULT))
				fn->fn_sernum = -1;
			rcu_read_unlock();
2020
		}
L
Linus Torvalds 已提交
2021 2022 2023
	}
}

2024 2025 2026 2027 2028 2029 2030 2031 2032
static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
{
	struct net *net = dev_net(rt->dst.dev);

	rt->rt6i_flags |= RTF_MODIFIED;
	rt->rt6i_pmtu = mtu;
	rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
}

2033 2034 2035
static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
{
	return !(rt->rt6i_flags & RTF_CACHE) &&
W
Wei Wang 已提交
2036 2037
		(rt->rt6i_flags & RTF_PCPU ||
		 rcu_access_pointer(rt->rt6i_node));
2038 2039
}

2040 2041
static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
				 const struct ipv6hdr *iph, u32 mtu)
L
Linus Torvalds 已提交
2042
{
2043
	const struct in6_addr *daddr, *saddr;
2044
	struct rt6_info *rt6 = (struct rt6_info *)dst;
L
Linus Torvalds 已提交
2045

2046 2047
	if (rt6->rt6i_flags & RTF_LOCAL)
		return;
2048

2049 2050 2051
	if (dst_metric_locked(dst, RTAX_MTU))
		return;

2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062
	if (iph) {
		daddr = &iph->daddr;
		saddr = &iph->saddr;
	} else if (sk) {
		daddr = &sk->sk_v6_daddr;
		saddr = &inet6_sk(sk)->saddr;
	} else {
		daddr = NULL;
		saddr = NULL;
	}
	dst_confirm_neigh(dst, daddr);
2063 2064 2065
	mtu = max_t(u32, mtu, IPV6_MIN_MTU);
	if (mtu >= dst_mtu(dst))
		return;
2066

2067
	if (!rt6_cache_allowed_for_pmtu(rt6)) {
2068
		rt6_do_update_pmtu(rt6, mtu);
2069 2070 2071
		/* update rt6_ex->stamp for cache */
		if (rt6->rt6i_flags & RTF_CACHE)
			rt6_update_exception_stamp_rt(rt6);
2072
	} else if (daddr) {
2073 2074 2075 2076 2077
		struct rt6_info *nrt6;

		nrt6 = ip6_rt_cache_alloc(rt6, daddr, saddr);
		if (nrt6) {
			rt6_do_update_pmtu(nrt6, mtu);
2078 2079
			if (rt6_insert_exception(nrt6, rt6))
				dst_release_immediate(&nrt6->dst);
2080
		}
L
Linus Torvalds 已提交
2081 2082 2083
	}
}

2084 2085 2086 2087 2088 2089
static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
			       struct sk_buff *skb, u32 mtu)
{
	__ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu);
}

2090
void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
2091
		     int oif, u32 mark, kuid_t uid)
2092 2093 2094 2095 2096 2097 2098
{
	const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
	fl6.flowi6_oif = oif;
2099
	fl6.flowi6_mark = mark ? mark : IP6_REPLY_MARK(net, skb->mark);
2100 2101
	fl6.daddr = iph->daddr;
	fl6.saddr = iph->saddr;
2102
	fl6.flowlabel = ip6_flowinfo(iph);
2103
	fl6.flowi6_uid = uid;
2104 2105 2106

	dst = ip6_route_output(net, NULL, &fl6);
	if (!dst->error)
2107
		__ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu));
2108 2109 2110 2111 2112 2113
	dst_release(dst);
}
EXPORT_SYMBOL_GPL(ip6_update_pmtu);

void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
{
2114 2115
	struct dst_entry *dst;

2116
	ip6_update_pmtu(skb, sock_net(sk), mtu,
2117
			sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid);
2118 2119 2120 2121 2122 2123 2124 2125 2126 2127

	dst = __sk_dst_get(sk);
	if (!dst || !dst->obsolete ||
	    dst->ops->check(dst, inet6_sk(sk)->dst_cookie))
		return;

	bh_lock_sock(sk);
	if (!sock_owned_by_user(sk) && !ipv6_addr_v4mapped(&sk->sk_v6_daddr))
		ip6_datagram_dst_update(sk, false);
	bh_unlock_sock(sk);
2128 2129 2130
}
EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);

2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142
/* Handle redirects */
struct ip6rd_flowi {
	struct flowi6 fl6;
	struct in6_addr gateway;
};

static struct rt6_info *__ip6_route_redirect(struct net *net,
					     struct fib6_table *table,
					     struct flowi6 *fl6,
					     int flags)
{
	struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
2143
	struct rt6_info *rt, *rt_cache;
2144 2145 2146
	struct fib6_node *fn;

	/* Get the "current" route for this destination and
A
Alexander Alemayhu 已提交
2147
	 * check if the redirect has come from appropriate router.
2148 2149 2150 2151 2152 2153 2154 2155
	 *
	 * RFC 4861 specifies that redirects should only be
	 * accepted if they come from the nexthop to the target.
	 * Due to the way the routes are chosen, this notion
	 * is a bit fuzzy and one might need to check all possible
	 * routes.
	 */

2156
	rcu_read_lock();
2157 2158
	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
restart:
2159
	for_each_fib6_node_rt_rcu(fn) {
2160 2161
		if (rt->rt6i_nh_flags & RTNH_F_DEAD)
			continue;
2162 2163 2164 2165 2166 2167 2168 2169
		if (rt6_check_expired(rt))
			continue;
		if (rt->dst.error)
			break;
		if (!(rt->rt6i_flags & RTF_GATEWAY))
			continue;
		if (fl6->flowi6_oif != rt->dst.dev->ifindex)
			continue;
2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184
		/* rt_cache's gateway might be different from its 'parent'
		 * in the case of an ip redirect.
		 * So we keep searching in the exception table if the gateway
		 * is different.
		 */
		if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway)) {
			rt_cache = rt6_find_cached_rt(rt,
						      &fl6->daddr,
						      &fl6->saddr);
			if (rt_cache &&
			    ipv6_addr_equal(&rdfl->gateway,
					    &rt_cache->rt6i_gateway)) {
				rt = rt_cache;
				break;
			}
2185
			continue;
2186
		}
2187 2188 2189 2190 2191 2192 2193
		break;
	}

	if (!rt)
		rt = net->ipv6.ip6_null_entry;
	else if (rt->dst.error) {
		rt = net->ipv6.ip6_null_entry;
2194 2195 2196 2197
		goto out;
	}

	if (rt == net->ipv6.ip6_null_entry) {
M
Martin KaFai Lau 已提交
2198 2199 2200
		fn = fib6_backtrack(fn, &fl6->saddr);
		if (fn)
			goto restart;
2201
	}
M
Martin KaFai Lau 已提交
2202

2203
out:
2204
	ip6_hold_safe(net, &rt, true);
2205

2206
	rcu_read_unlock();
2207

2208
	trace_fib6_table_lookup(net, rt, table, fl6);
2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225
	return rt;
};

static struct dst_entry *ip6_route_redirect(struct net *net,
					const struct flowi6 *fl6,
					const struct in6_addr *gateway)
{
	int flags = RT6_LOOKUP_F_HAS_SADDR;
	struct ip6rd_flowi rdfl;

	rdfl.fl6 = *fl6;
	rdfl.gateway = *gateway;

	return fib6_rule_lookup(net, &rdfl.fl6,
				flags, __ip6_route_redirect);
}

2226 2227
void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark,
		  kuid_t uid)
2228 2229 2230 2231 2232 2233
{
	const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
2234
	fl6.flowi6_iif = LOOPBACK_IFINDEX;
2235 2236 2237 2238
	fl6.flowi6_oif = oif;
	fl6.flowi6_mark = mark;
	fl6.daddr = iph->daddr;
	fl6.saddr = iph->saddr;
2239
	fl6.flowlabel = ip6_flowinfo(iph);
2240
	fl6.flowi6_uid = uid;
2241

2242 2243
	dst = ip6_route_redirect(net, &fl6, &ipv6_hdr(skb)->saddr);
	rt6_do_redirect(dst, NULL, skb);
2244 2245 2246 2247
	dst_release(dst);
}
EXPORT_SYMBOL_GPL(ip6_redirect);

2248 2249 2250 2251 2252 2253 2254 2255 2256
void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
			    u32 mark)
{
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
2257
	fl6.flowi6_iif = LOOPBACK_IFINDEX;
2258 2259 2260 2261
	fl6.flowi6_oif = oif;
	fl6.flowi6_mark = mark;
	fl6.daddr = msg->dest;
	fl6.saddr = iph->daddr;
2262
	fl6.flowi6_uid = sock_net_uid(net, NULL);
2263

2264 2265
	dst = ip6_route_redirect(net, &fl6, &iph->saddr);
	rt6_do_redirect(dst, NULL, skb);
2266 2267 2268
	dst_release(dst);
}

2269 2270
void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
{
2271 2272
	ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark,
		     sk->sk_uid);
2273 2274 2275
}
EXPORT_SYMBOL_GPL(ip6_sk_redirect);

2276
static unsigned int ip6_default_advmss(const struct dst_entry *dst)
L
Linus Torvalds 已提交
2277
{
2278 2279 2280 2281
	struct net_device *dev = dst->dev;
	unsigned int mtu = dst_mtu(dst);
	struct net *net = dev_net(dev);

L
Linus Torvalds 已提交
2282 2283
	mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);

2284 2285
	if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
		mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
L
Linus Torvalds 已提交
2286 2287

	/*
2288 2289 2290
	 * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
	 * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
	 * IPV6_MAXPLEN is also valid and means: "any MSS,
L
Linus Torvalds 已提交
2291 2292 2293 2294 2295 2296 2297
	 * rely only on pmtu discovery"
	 */
	if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
		mtu = IPV6_MAXPLEN;
	return mtu;
}

2298
static unsigned int ip6_mtu(const struct dst_entry *dst)
2299
{
2300 2301
	const struct rt6_info *rt = (const struct rt6_info *)dst;
	unsigned int mtu = rt->rt6i_pmtu;
2302
	struct inet6_dev *idev;
2303

2304 2305 2306 2307
	if (mtu)
		goto out;

	mtu = dst_metric_raw(dst, RTAX_MTU);
2308
	if (mtu)
E
Eric Dumazet 已提交
2309
		goto out;
2310 2311

	mtu = IPV6_MIN_MTU;
2312 2313 2314 2315 2316 2317 2318

	rcu_read_lock();
	idev = __in6_dev_get(dst->dev);
	if (idev)
		mtu = idev->cnf.mtu6;
	rcu_read_unlock();

E
Eric Dumazet 已提交
2319
out:
2320 2321 2322
	mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);

	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
2323 2324
}

2325
struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
2326
				  struct flowi6 *fl6)
L
Linus Torvalds 已提交
2327
{
2328
	struct dst_entry *dst;
L
Linus Torvalds 已提交
2329 2330
	struct rt6_info *rt;
	struct inet6_dev *idev = in6_dev_get(dev);
2331
	struct net *net = dev_net(dev);
L
Linus Torvalds 已提交
2332

2333
	if (unlikely(!idev))
E
Eric Dumazet 已提交
2334
		return ERR_PTR(-ENODEV);
L
Linus Torvalds 已提交
2335

2336
	rt = ip6_dst_alloc(net, dev, 0);
2337
	if (unlikely(!rt)) {
L
Linus Torvalds 已提交
2338
		in6_dev_put(idev);
2339
		dst = ERR_PTR(-ENOMEM);
L
Linus Torvalds 已提交
2340 2341 2342
		goto out;
	}

2343
	rt->dst.flags |= DST_HOST;
2344
	rt->dst.input = ip6_input;
2345
	rt->dst.output  = ip6_output;
2346
	rt->rt6i_gateway  = fl6->daddr;
2347
	rt->rt6i_dst.addr = fl6->daddr;
2348 2349
	rt->rt6i_dst.plen = 128;
	rt->rt6i_idev     = idev;
L
Li RongQing 已提交
2350
	dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 0);
L
Linus Torvalds 已提交
2351

2352
	/* Add this dst into uncached_list so that rt6_disable_ip() can
2353 2354 2355
	 * do proper release of the net_device
	 */
	rt6_uncached_list_add(rt);
W
Wei Wang 已提交
2356
	atomic_inc(&net->ipv6.rt6_stats->fib_rt_uncache);
L
Linus Torvalds 已提交
2357

2358 2359
	dst = xfrm_lookup(net, &rt->dst, flowi6_to_flowi(fl6), NULL, 0);

L
Linus Torvalds 已提交
2360
out:
2361
	return dst;
L
Linus Torvalds 已提交
2362 2363
}

2364
static int ip6_dst_gc(struct dst_ops *ops)
L
Linus Torvalds 已提交
2365
{
2366
	struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
2367 2368 2369 2370 2371
	int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
	int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
	int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
	int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
	unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
2372
	int entries;
2373

2374
	entries = dst_entries_get_fast(ops);
2375
	if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
2376
	    entries <= rt_max_size)
L
Linus Torvalds 已提交
2377 2378
		goto out;

2379
	net->ipv6.ip6_rt_gc_expire++;
2380
	fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, true);
2381 2382
	entries = dst_entries_get_slow(ops);
	if (entries < ops->gc_thresh)
2383
		net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
L
Linus Torvalds 已提交
2384
out:
2385
	net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
2386
	return entries > rt_max_size;
L
Linus Torvalds 已提交
2387 2388
}

2389 2390 2391
static int ip6_convert_metrics(struct mx6_config *mxc,
			       const struct fib6_config *cfg)
{
2392
	struct net *net = cfg->fc_nlinfo.nl_net;
2393
	bool ecn_ca = false;
2394 2395 2396 2397
	struct nlattr *nla;
	int remaining;
	u32 *mp;

2398
	if (!cfg->fc_mx)
2399 2400 2401 2402 2403 2404 2405 2406
		return 0;

	mp = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
	if (unlikely(!mp))
		return -ENOMEM;

	nla_for_each_attr(nla, cfg->fc_mx, cfg->fc_mx_len, remaining) {
		int type = nla_type(nla);
2407
		u32 val;
2408

2409 2410 2411 2412
		if (!type)
			continue;
		if (unlikely(type > RTAX_MAX))
			goto err;
2413

2414 2415
		if (type == RTAX_CC_ALGO) {
			char tmp[TCP_CA_NAME_MAX];
2416

2417
			nla_strlcpy(tmp, nla, sizeof(tmp));
2418
			val = tcp_ca_get_key_by_name(net, tmp, &ecn_ca);
2419 2420 2421 2422
			if (val == TCP_CA_UNSPEC)
				goto err;
		} else {
			val = nla_get_u32(nla);
2423
		}
2424 2425
		if (type == RTAX_HOPLIMIT && val > 255)
			val = 255;
2426 2427
		if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
			goto err;
2428 2429 2430

		mp[type - 1] = val;
		__set_bit(type - 1, mxc->mx_valid);
2431 2432
	}

2433 2434 2435 2436
	if (ecn_ca) {
		__set_bit(RTAX_FEATURES - 1, mxc->mx_valid);
		mp[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
	}
2437

2438
	mxc->mx = mp;
2439 2440 2441 2442 2443
	return 0;
 err:
	kfree(mp);
	return -EINVAL;
}
L
Linus Torvalds 已提交
2444

2445 2446
static struct rt6_info *ip6_nh_lookup_table(struct net *net,
					    struct fib6_config *cfg,
2447 2448
					    const struct in6_addr *gw_addr,
					    u32 tbid, int flags)
2449 2450 2451 2452 2453 2454 2455 2456 2457
{
	struct flowi6 fl6 = {
		.flowi6_oif = cfg->fc_ifindex,
		.daddr = *gw_addr,
		.saddr = cfg->fc_prefsrc,
	};
	struct fib6_table *table;
	struct rt6_info *rt;

2458
	table = fib6_get_table(net, tbid);
2459 2460 2461 2462 2463 2464
	if (!table)
		return NULL;

	if (!ipv6_addr_any(&cfg->fc_prefsrc))
		flags |= RT6_LOOKUP_F_HAS_SADDR;

2465
	flags |= RT6_LOOKUP_F_IGNORE_LINKSTATE;
2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476
	rt = ip6_pol_route(net, table, cfg->fc_ifindex, &fl6, flags);

	/* if table lookup failed, fall back to full lookup */
	if (rt == net->ipv6.ip6_null_entry) {
		ip6_rt_put(rt);
		rt = NULL;
	}

	return rt;
}

2477 2478 2479 2480 2481
static int ip6_route_check_nh_onlink(struct net *net,
				     struct fib6_config *cfg,
				     struct net_device *dev,
				     struct netlink_ext_ack *extack)
{
2482
	u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
2483 2484 2485 2486 2487 2488 2489 2490
	const struct in6_addr *gw_addr = &cfg->fc_gateway;
	u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT;
	struct rt6_info *grt;
	int err;

	err = 0;
	grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
	if (grt) {
2491 2492
		if (!grt->dst.error &&
		    (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
2493 2494
			NL_SET_ERR_MSG(extack,
				       "Nexthop has invalid gateway or device mismatch");
2495 2496 2497 2498 2499 2500 2501 2502 2503
			err = -EINVAL;
		}

		ip6_rt_put(grt);
	}

	return err;
}

2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514
static int ip6_route_check_nh(struct net *net,
			      struct fib6_config *cfg,
			      struct net_device **_dev,
			      struct inet6_dev **idev)
{
	const struct in6_addr *gw_addr = &cfg->fc_gateway;
	struct net_device *dev = _dev ? *_dev : NULL;
	struct rt6_info *grt = NULL;
	int err = -EHOSTUNREACH;

	if (cfg->fc_table) {
2515 2516 2517 2518
		int flags = RT6_LOOKUP_F_IFACE;

		grt = ip6_nh_lookup_table(net, cfg, gw_addr,
					  cfg->fc_table, flags);
2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554
		if (grt) {
			if (grt->rt6i_flags & RTF_GATEWAY ||
			    (dev && dev != grt->dst.dev)) {
				ip6_rt_put(grt);
				grt = NULL;
			}
		}
	}

	if (!grt)
		grt = rt6_lookup(net, gw_addr, NULL, cfg->fc_ifindex, 1);

	if (!grt)
		goto out;

	if (dev) {
		if (dev != grt->dst.dev) {
			ip6_rt_put(grt);
			goto out;
		}
	} else {
		*_dev = dev = grt->dst.dev;
		*idev = grt->rt6i_idev;
		dev_hold(dev);
		in6_dev_hold(grt->rt6i_idev);
	}

	if (!(grt->rt6i_flags & RTF_GATEWAY))
		err = 0;

	ip6_rt_put(grt);

out:
	return err;
}

2555 2556
static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg,
					      struct netlink_ext_ack *extack)
L
Linus Torvalds 已提交
2557
{
2558
	struct net *net = cfg->fc_nlinfo.nl_net;
L
Linus Torvalds 已提交
2559 2560 2561
	struct rt6_info *rt = NULL;
	struct net_device *dev = NULL;
	struct inet6_dev *idev = NULL;
T
Thomas Graf 已提交
2562
	struct fib6_table *table;
L
Linus Torvalds 已提交
2563
	int addr_type;
2564
	int err = -EINVAL;
L
Linus Torvalds 已提交
2565

2566
	/* RTF_PCPU is an internal flag; can not be set by userspace */
2567 2568
	if (cfg->fc_flags & RTF_PCPU) {
		NL_SET_ERR_MSG(extack, "Userspace can not set RTF_PCPU");
2569
		goto out;
2570
	}
2571

2572 2573 2574 2575 2576 2577
	/* RTF_CACHE is an internal flag; can not be set by userspace */
	if (cfg->fc_flags & RTF_CACHE) {
		NL_SET_ERR_MSG(extack, "Userspace can not set RTF_CACHE");
		goto out;
	}

2578 2579 2580 2581 2582 2583
	if (cfg->fc_dst_len > 128) {
		NL_SET_ERR_MSG(extack, "Invalid prefix length");
		goto out;
	}
	if (cfg->fc_src_len > 128) {
		NL_SET_ERR_MSG(extack, "Invalid source address length");
2584
		goto out;
2585
	}
L
Linus Torvalds 已提交
2586
#ifndef CONFIG_IPV6_SUBTREES
2587 2588 2589
	if (cfg->fc_src_len) {
		NL_SET_ERR_MSG(extack,
			       "Specifying source address requires IPV6_SUBTREES to be enabled");
2590
		goto out;
2591
	}
L
Linus Torvalds 已提交
2592
#endif
2593
	if (cfg->fc_ifindex) {
L
Linus Torvalds 已提交
2594
		err = -ENODEV;
2595
		dev = dev_get_by_index(net, cfg->fc_ifindex);
L
Linus Torvalds 已提交
2596 2597 2598 2599 2600 2601 2602
		if (!dev)
			goto out;
		idev = in6_dev_get(dev);
		if (!idev)
			goto out;
	}

2603 2604
	if (cfg->fc_metric == 0)
		cfg->fc_metric = IP6_RT_PRIO_USER;
L
Linus Torvalds 已提交
2605

2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620
	if (cfg->fc_flags & RTNH_F_ONLINK) {
		if (!dev) {
			NL_SET_ERR_MSG(extack,
				       "Nexthop device required for onlink");
			err = -ENODEV;
			goto out;
		}

		if (!(dev->flags & IFF_UP)) {
			NL_SET_ERR_MSG(extack, "Nexthop device is not up");
			err = -ENETDOWN;
			goto out;
		}
	}

2621
	err = -ENOBUFS;
2622 2623
	if (cfg->fc_nlinfo.nlh &&
	    !(cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_CREATE)) {
2624
		table = fib6_get_table(net, cfg->fc_table);
2625
		if (!table) {
2626
			pr_warn("NLM_F_CREATE should be specified when creating new route\n");
2627 2628 2629 2630 2631
			table = fib6_new_table(net, cfg->fc_table);
		}
	} else {
		table = fib6_new_table(net, cfg->fc_table);
	}
2632 2633

	if (!table)
T
Thomas Graf 已提交
2634 2635
		goto out;

2636 2637
	rt = ip6_dst_alloc(net, NULL,
			   (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT);
L
Linus Torvalds 已提交
2638

2639
	if (!rt) {
L
Linus Torvalds 已提交
2640 2641 2642 2643
		err = -ENOMEM;
		goto out;
	}

2644 2645 2646 2647 2648
	if (cfg->fc_flags & RTF_EXPIRES)
		rt6_set_expires(rt, jiffies +
				clock_t_to_jiffies(cfg->fc_expires));
	else
		rt6_clean_expires(rt);
L
Linus Torvalds 已提交
2649

2650 2651 2652 2653 2654
	if (cfg->fc_protocol == RTPROT_UNSPEC)
		cfg->fc_protocol = RTPROT_BOOT;
	rt->rt6i_protocol = cfg->fc_protocol;

	addr_type = ipv6_addr_type(&cfg->fc_dst);
L
Linus Torvalds 已提交
2655 2656

	if (addr_type & IPV6_ADDR_MULTICAST)
2657
		rt->dst.input = ip6_mc_input;
2658 2659
	else if (cfg->fc_flags & RTF_LOCAL)
		rt->dst.input = ip6_input;
L
Linus Torvalds 已提交
2660
	else
2661
		rt->dst.input = ip6_forward;
L
Linus Torvalds 已提交
2662

2663
	rt->dst.output = ip6_output;
L
Linus Torvalds 已提交
2664

2665 2666 2667
	if (cfg->fc_encap) {
		struct lwtunnel_state *lwtstate;

2668
		err = lwtunnel_build_state(cfg->fc_encap_type,
2669
					   cfg->fc_encap, AF_INET6, cfg,
2670
					   &lwtstate, extack);
2671 2672
		if (err)
			goto out;
2673
		rt->dst.lwtstate = lwtstate_get(lwtstate);
2674
		lwtunnel_set_redirect(&rt->dst);
2675 2676
	}

2677 2678
	ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
	rt->rt6i_dst.plen = cfg->fc_dst_len;
2679
	if (rt->rt6i_dst.plen == 128)
2680 2681
		rt->dst.flags |= DST_HOST;

L
Linus Torvalds 已提交
2682
#ifdef CONFIG_IPV6_SUBTREES
2683 2684
	ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
	rt->rt6i_src.plen = cfg->fc_src_len;
L
Linus Torvalds 已提交
2685 2686
#endif

2687
	rt->rt6i_metric = cfg->fc_metric;
2688
	rt->rt6i_nh_weight = 1;
L
Linus Torvalds 已提交
2689 2690 2691 2692

	/* We cannot add true routes via loopback here,
	   they would result in kernel looping; promote them to reject routes
	 */
2693
	if ((cfg->fc_flags & RTF_REJECT) ||
2694 2695 2696
	    (dev && (dev->flags & IFF_LOOPBACK) &&
	     !(addr_type & IPV6_ADDR_LOOPBACK) &&
	     !(cfg->fc_flags & RTF_LOCAL))) {
L
Linus Torvalds 已提交
2697
		/* hold loopback dev/idev if we haven't done so. */
2698
		if (dev != net->loopback_dev) {
L
Linus Torvalds 已提交
2699 2700 2701 2702
			if (dev) {
				dev_put(dev);
				in6_dev_put(idev);
			}
2703
			dev = net->loopback_dev;
L
Linus Torvalds 已提交
2704 2705 2706 2707 2708 2709 2710 2711
			dev_hold(dev);
			idev = in6_dev_get(dev);
			if (!idev) {
				err = -ENODEV;
				goto out;
			}
		}
		rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
2712 2713 2714
		switch (cfg->fc_type) {
		case RTN_BLACKHOLE:
			rt->dst.error = -EINVAL;
E
Eric W. Biederman 已提交
2715
			rt->dst.output = dst_discard_out;
2716
			rt->dst.input = dst_discard;
2717 2718 2719
			break;
		case RTN_PROHIBIT:
			rt->dst.error = -EACCES;
2720 2721
			rt->dst.output = ip6_pkt_prohibit_out;
			rt->dst.input = ip6_pkt_prohibit;
2722
			break;
2723
		case RTN_THROW:
2724
		case RTN_UNREACHABLE:
2725
		default:
2726
			rt->dst.error = (cfg->fc_type == RTN_THROW) ? -EAGAIN
2727 2728
					: (cfg->fc_type == RTN_UNREACHABLE)
					? -EHOSTUNREACH : -ENETUNREACH;
2729 2730
			rt->dst.output = ip6_pkt_discard_out;
			rt->dst.input = ip6_pkt_discard;
2731 2732
			break;
		}
L
Linus Torvalds 已提交
2733 2734 2735
		goto install_route;
	}

2736
	if (cfg->fc_flags & RTF_GATEWAY) {
2737
		const struct in6_addr *gw_addr;
L
Linus Torvalds 已提交
2738 2739
		int gwa_type;

2740
		gw_addr = &cfg->fc_gateway;
2741
		gwa_type = ipv6_addr_type(gw_addr);
2742 2743 2744 2745 2746 2747 2748

		/* if gw_addr is local we will fail to detect this in case
		 * address is still TENTATIVE (DAD in progress). rt6_lookup()
		 * will return already-added prefix route via interface that
		 * prefix route was assigned to, which might be non-loopback.
		 */
		err = -EINVAL;
2749 2750
		if (ipv6_chk_addr_and_flags(net, gw_addr,
					    gwa_type & IPV6_ADDR_LINKLOCAL ?
2751 2752
					    dev : NULL, 0, 0)) {
			NL_SET_ERR_MSG(extack, "Invalid gateway address");
2753
			goto out;
2754
		}
A
Alexey Dobriyan 已提交
2755
		rt->rt6i_gateway = *gw_addr;
L
Linus Torvalds 已提交
2756 2757 2758 2759 2760 2761 2762 2763

		if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
			/* IPv6 strictly inhibits using not link-local
			   addresses as nexthop address.
			   Otherwise, router will not able to send redirects.
			   It is very good, but in some (rare!) circumstances
			   (SIT, PtP, NBMA NOARP links) it is handy to allow
			   some exceptions. --ANK
2764 2765
			   We allow IPv4-mapped nexthops to support RFC4798-type
			   addressing
L
Linus Torvalds 已提交
2766
			 */
2767
			if (!(gwa_type & (IPV6_ADDR_UNICAST |
2768 2769 2770
					  IPV6_ADDR_MAPPED))) {
				NL_SET_ERR_MSG(extack,
					       "Invalid gateway address");
L
Linus Torvalds 已提交
2771
				goto out;
2772
			}
L
Linus Torvalds 已提交
2773

2774 2775 2776 2777 2778 2779
			if (cfg->fc_flags & RTNH_F_ONLINK) {
				err = ip6_route_check_nh_onlink(net, cfg, dev,
								extack);
			} else {
				err = ip6_route_check_nh(net, cfg, &dev, &idev);
			}
L
Linus Torvalds 已提交
2780 2781 2782 2783
			if (err)
				goto out;
		}
		err = -EINVAL;
2784 2785 2786 2787 2788 2789
		if (!dev) {
			NL_SET_ERR_MSG(extack, "Egress device not specified");
			goto out;
		} else if (dev->flags & IFF_LOOPBACK) {
			NL_SET_ERR_MSG(extack,
				       "Egress device can not be loopback device for this route");
L
Linus Torvalds 已提交
2790
			goto out;
2791
		}
L
Linus Torvalds 已提交
2792 2793 2794
	}

	err = -ENODEV;
2795
	if (!dev)
L
Linus Torvalds 已提交
2796 2797
		goto out;

2798 2799 2800 2801 2802 2803
	if (!(dev->flags & IFF_UP)) {
		NL_SET_ERR_MSG(extack, "Nexthop device is not up");
		err = -ENETDOWN;
		goto out;
	}

2804 2805
	if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
		if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
2806
			NL_SET_ERR_MSG(extack, "Invalid source address");
2807 2808 2809
			err = -EINVAL;
			goto out;
		}
A
Alexey Dobriyan 已提交
2810
		rt->rt6i_prefsrc.addr = cfg->fc_prefsrc;
2811 2812 2813 2814
		rt->rt6i_prefsrc.plen = 128;
	} else
		rt->rt6i_prefsrc.plen = 0;

2815
	rt->rt6i_flags = cfg->fc_flags;
L
Linus Torvalds 已提交
2816 2817

install_route:
2818 2819 2820
	if (!(rt->rt6i_flags & (RTF_LOCAL | RTF_ANYCAST)) &&
	    !netif_carrier_ok(dev))
		rt->rt6i_nh_flags |= RTNH_F_LINKDOWN;
2821
	rt->rt6i_nh_flags |= (cfg->fc_flags & RTNH_F_ONLINK);
2822
	rt->dst.dev = dev;
L
Linus Torvalds 已提交
2823
	rt->rt6i_idev = idev;
T
Thomas Graf 已提交
2824
	rt->rt6i_table = table;
2825

2826
	cfg->fc_nlinfo.nl_net = dev_net(dev);
2827

2828
	return rt;
2829 2830 2831 2832 2833
out:
	if (dev)
		dev_put(dev);
	if (idev)
		in6_dev_put(idev);
2834 2835
	if (rt)
		dst_release_immediate(&rt->dst);
2836

2837
	return ERR_PTR(err);
2838 2839
}

2840 2841
int ip6_route_add(struct fib6_config *cfg,
		  struct netlink_ext_ack *extack)
2842 2843
{
	struct mx6_config mxc = { .mx = NULL, };
2844
	struct rt6_info *rt;
2845 2846
	int err;

2847
	rt = ip6_route_info_create(cfg, extack);
2848 2849 2850
	if (IS_ERR(rt)) {
		err = PTR_ERR(rt);
		rt = NULL;
2851
		goto out;
2852
	}
2853

2854 2855 2856
	err = ip6_convert_metrics(&mxc, cfg);
	if (err)
		goto out;
L
Linus Torvalds 已提交
2857

2858
	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, &mxc, extack);
2859 2860

	kfree(mxc.mx);
2861

2862
	return err;
L
Linus Torvalds 已提交
2863
out:
2864 2865
	if (rt)
		dst_release_immediate(&rt->dst);
2866

L
Linus Torvalds 已提交
2867 2868 2869
	return err;
}

2870
static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
L
Linus Torvalds 已提交
2871 2872
{
	int err;
T
Thomas Graf 已提交
2873
	struct fib6_table *table;
2874
	struct net *net = dev_net(rt->dst.dev);
L
Linus Torvalds 已提交
2875

W
Wei Wang 已提交
2876
	if (rt == net->ipv6.ip6_null_entry) {
2877 2878 2879
		err = -ENOENT;
		goto out;
	}
2880

T
Thomas Graf 已提交
2881
	table = rt->rt6i_table;
2882
	spin_lock_bh(&table->tb6_lock);
2883
	err = fib6_del(rt, info);
2884
	spin_unlock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
2885

2886
out:
A
Amerigo Wang 已提交
2887
	ip6_rt_put(rt);
L
Linus Torvalds 已提交
2888 2889 2890
	return err;
}

2891 2892
int ip6_del_rt(struct rt6_info *rt)
{
2893
	struct nl_info info = {
2894
		.nl_net = dev_net(rt->dst.dev),
2895
	};
2896
	return __ip6_del_rt(rt, &info);
2897 2898
}

2899 2900 2901
static int __ip6_del_rt_siblings(struct rt6_info *rt, struct fib6_config *cfg)
{
	struct nl_info *info = &cfg->fc_nlinfo;
2902
	struct net *net = info->nl_net;
2903
	struct sk_buff *skb = NULL;
2904
	struct fib6_table *table;
2905
	int err = -ENOENT;
2906

2907 2908
	if (rt == net->ipv6.ip6_null_entry)
		goto out_put;
2909
	table = rt->rt6i_table;
2910
	spin_lock_bh(&table->tb6_lock);
2911 2912 2913 2914

	if (rt->rt6i_nsiblings && cfg->fc_delete_all_nh) {
		struct rt6_info *sibling, *next_sibling;

2915 2916 2917 2918 2919
		/* prefer to send a single notification with all hops */
		skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any());
		if (skb) {
			u32 seq = info->nlh ? info->nlh->nlmsg_seq : 0;

2920
			if (rt6_fill_node(net, skb, rt,
2921 2922 2923 2924 2925 2926 2927 2928
					  NULL, NULL, 0, RTM_DELROUTE,
					  info->portid, seq, 0) < 0) {
				kfree_skb(skb);
				skb = NULL;
			} else
				info->skip_notify = 1;
		}

2929 2930 2931 2932 2933
		list_for_each_entry_safe(sibling, next_sibling,
					 &rt->rt6i_siblings,
					 rt6i_siblings) {
			err = fib6_del(sibling, info);
			if (err)
2934
				goto out_unlock;
2935 2936 2937 2938
		}
	}

	err = fib6_del(rt, info);
2939
out_unlock:
2940
	spin_unlock_bh(&table->tb6_lock);
2941
out_put:
2942
	ip6_rt_put(rt);
2943 2944

	if (skb) {
2945
		rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
2946 2947
			    info->nlh, gfp_any());
	}
2948 2949 2950
	return err;
}

2951 2952
static int ip6_route_del(struct fib6_config *cfg,
			 struct netlink_ext_ack *extack)
L
Linus Torvalds 已提交
2953
{
2954
	struct rt6_info *rt, *rt_cache;
T
Thomas Graf 已提交
2955
	struct fib6_table *table;
L
Linus Torvalds 已提交
2956 2957 2958
	struct fib6_node *fn;
	int err = -ESRCH;

2959
	table = fib6_get_table(cfg->fc_nlinfo.nl_net, cfg->fc_table);
2960 2961
	if (!table) {
		NL_SET_ERR_MSG(extack, "FIB table does not exist");
T
Thomas Graf 已提交
2962
		return err;
2963
	}
T
Thomas Graf 已提交
2964

2965
	rcu_read_lock();
L
Linus Torvalds 已提交
2966

T
Thomas Graf 已提交
2967
	fn = fib6_locate(&table->tb6_root,
2968
			 &cfg->fc_dst, cfg->fc_dst_len,
2969
			 &cfg->fc_src, cfg->fc_src_len,
2970
			 !(cfg->fc_flags & RTF_CACHE));
2971

L
Linus Torvalds 已提交
2972
	if (fn) {
2973
		for_each_fib6_node_rt_rcu(fn) {
2974 2975 2976 2977 2978 2979 2980
			if (cfg->fc_flags & RTF_CACHE) {
				rt_cache = rt6_find_cached_rt(rt, &cfg->fc_dst,
							      &cfg->fc_src);
				if (!rt_cache)
					continue;
				rt = rt_cache;
			}
2981
			if (cfg->fc_ifindex &&
2982 2983
			    (!rt->dst.dev ||
			     rt->dst.dev->ifindex != cfg->fc_ifindex))
L
Linus Torvalds 已提交
2984
				continue;
2985 2986
			if (cfg->fc_flags & RTF_GATEWAY &&
			    !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
L
Linus Torvalds 已提交
2987
				continue;
2988
			if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric)
L
Linus Torvalds 已提交
2989
				continue;
2990 2991
			if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol)
				continue;
2992 2993
			if (!dst_hold_safe(&rt->dst))
				break;
2994
			rcu_read_unlock();
L
Linus Torvalds 已提交
2995

2996 2997 2998 2999 3000
			/* if gateway was specified only delete the one hop */
			if (cfg->fc_flags & RTF_GATEWAY)
				return __ip6_del_rt(rt, &cfg->fc_nlinfo);

			return __ip6_del_rt_siblings(rt, cfg);
L
Linus Torvalds 已提交
3001 3002
		}
	}
3003
	rcu_read_unlock();
L
Linus Torvalds 已提交
3004 3005 3006 3007

	return err;
}

3008
static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
3009 3010
{
	struct netevent_redirect netevent;
3011 3012 3013 3014
	struct rt6_info *rt, *nrt = NULL;
	struct ndisc_options ndopts;
	struct inet6_dev *in6_dev;
	struct neighbour *neigh;
3015
	struct rd_msg *msg;
3016 3017
	int optlen, on_link;
	u8 *lladdr;
3018

3019
	optlen = skb_tail_pointer(skb) - skb_transport_header(skb);
3020
	optlen -= sizeof(*msg);
3021 3022

	if (optlen < 0) {
3023
		net_dbg_ratelimited("rt6_do_redirect: packet too short\n");
3024 3025 3026
		return;
	}

3027
	msg = (struct rd_msg *)icmp6_hdr(skb);
3028

3029
	if (ipv6_addr_is_multicast(&msg->dest)) {
3030
		net_dbg_ratelimited("rt6_do_redirect: destination address is multicast\n");
3031 3032 3033
		return;
	}

3034
	on_link = 0;
3035
	if (ipv6_addr_equal(&msg->dest, &msg->target)) {
3036
		on_link = 1;
3037
	} else if (ipv6_addr_type(&msg->target) !=
3038
		   (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
3039
		net_dbg_ratelimited("rt6_do_redirect: target address is not link-local unicast\n");
3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053
		return;
	}

	in6_dev = __in6_dev_get(skb->dev);
	if (!in6_dev)
		return;
	if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects)
		return;

	/* RFC2461 8.1:
	 *	The IP source address of the Redirect MUST be the same as the current
	 *	first-hop router for the specified ICMP Destination Address.
	 */

3054
	if (!ndisc_parse_options(skb->dev, msg->opt, optlen, &ndopts)) {
3055 3056 3057
		net_dbg_ratelimited("rt6_redirect: invalid ND options\n");
		return;
	}
3058 3059

	lladdr = NULL;
3060 3061 3062 3063 3064 3065 3066 3067 3068
	if (ndopts.nd_opts_tgt_lladdr) {
		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
					     skb->dev);
		if (!lladdr) {
			net_dbg_ratelimited("rt6_redirect: invalid link-layer address length\n");
			return;
		}
	}

3069
	rt = (struct rt6_info *) dst;
3070
	if (rt->rt6i_flags & RTF_REJECT) {
3071
		net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
3072
		return;
3073
	}
3074

3075 3076 3077 3078
	/* Redirect received -> path was valid.
	 * Look, redirects are sent only in response to data packets,
	 * so that this nexthop apparently is reachable. --ANK
	 */
3079
	dst_confirm_neigh(&rt->dst, &ipv6_hdr(skb)->saddr);
3080

3081
	neigh = __neigh_lookup(&nd_tbl, &msg->target, skb->dev, 1);
3082 3083
	if (!neigh)
		return;
3084

L
Linus Torvalds 已提交
3085 3086 3087 3088
	/*
	 *	We have finally decided to accept it.
	 */

3089
	ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
L
Linus Torvalds 已提交
3090 3091 3092
		     NEIGH_UPDATE_F_WEAK_OVERRIDE|
		     NEIGH_UPDATE_F_OVERRIDE|
		     (on_link ? 0 : (NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
3093 3094
				     NEIGH_UPDATE_F_ISROUTER)),
		     NDISC_REDIRECT, &ndopts);
L
Linus Torvalds 已提交
3095

M
Martin KaFai Lau 已提交
3096
	nrt = ip6_rt_cache_alloc(rt, &msg->dest, NULL);
3097
	if (!nrt)
L
Linus Torvalds 已提交
3098 3099 3100 3101 3102 3103
		goto out;

	nrt->rt6i_flags = RTF_GATEWAY|RTF_UP|RTF_DYNAMIC|RTF_CACHE;
	if (on_link)
		nrt->rt6i_flags &= ~RTF_GATEWAY;

3104
	nrt->rt6i_protocol = RTPROT_REDIRECT;
A
Alexey Dobriyan 已提交
3105
	nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
L
Linus Torvalds 已提交
3106

3107 3108 3109 3110 3111 3112 3113 3114
	/* No need to remove rt from the exception table if rt is
	 * a cached route because rt6_insert_exception() will
	 * takes care of it
	 */
	if (rt6_insert_exception(nrt, rt)) {
		dst_release_immediate(&nrt->dst);
		goto out;
	}
L
Linus Torvalds 已提交
3115

3116 3117
	netevent.old = &rt->dst;
	netevent.new = &nrt->dst;
3118
	netevent.daddr = &msg->dest;
3119
	netevent.neigh = neigh;
3120 3121
	call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);

L
Linus Torvalds 已提交
3122
out:
3123
	neigh_release(neigh);
3124 3125
}

L
Linus Torvalds 已提交
3126 3127 3128 3129
/*
 *	Misc support functions
 */

3130 3131
static void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
{
3132
	BUG_ON(from->from);
3133 3134 3135

	rt->rt6i_flags &= ~RTF_EXPIRES;
	dst_hold(&from->dst);
3136
	rt->from = from;
3137 3138 3139
	dst_init_metrics(&rt->dst, dst_metrics_ptr(&from->dst), true);
}

M
Martin KaFai Lau 已提交
3140 3141 3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153
static void ip6_rt_copy_init(struct rt6_info *rt, struct rt6_info *ort)
{
	rt->dst.input = ort->dst.input;
	rt->dst.output = ort->dst.output;
	rt->rt6i_dst = ort->rt6i_dst;
	rt->dst.error = ort->dst.error;
	rt->rt6i_idev = ort->rt6i_idev;
	if (rt->rt6i_idev)
		in6_dev_hold(rt->rt6i_idev);
	rt->dst.lastuse = jiffies;
	rt->rt6i_gateway = ort->rt6i_gateway;
	rt->rt6i_flags = ort->rt6i_flags;
	rt6_set_from(rt, ort);
	rt->rt6i_metric = ort->rt6i_metric;
L
Linus Torvalds 已提交
3154
#ifdef CONFIG_IPV6_SUBTREES
M
Martin KaFai Lau 已提交
3155
	rt->rt6i_src = ort->rt6i_src;
L
Linus Torvalds 已提交
3156
#endif
M
Martin KaFai Lau 已提交
3157 3158
	rt->rt6i_prefsrc = ort->rt6i_prefsrc;
	rt->rt6i_table = ort->rt6i_table;
3159
	rt->dst.lwtstate = lwtstate_get(ort->dst.lwtstate);
L
Linus Torvalds 已提交
3160 3161
}

3162
#ifdef CONFIG_IPV6_ROUTE_INFO
3163
static struct rt6_info *rt6_get_route_info(struct net *net,
3164
					   const struct in6_addr *prefix, int prefixlen,
3165 3166
					   const struct in6_addr *gwaddr,
					   struct net_device *dev)
3167
{
3168 3169
	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_INFO;
	int ifindex = dev->ifindex;
3170 3171
	struct fib6_node *fn;
	struct rt6_info *rt = NULL;
T
Thomas Graf 已提交
3172 3173
	struct fib6_table *table;

3174
	table = fib6_get_table(net, tb_id);
3175
	if (!table)
T
Thomas Graf 已提交
3176
		return NULL;
3177

3178
	rcu_read_lock();
3179
	fn = fib6_locate(&table->tb6_root, prefix, prefixlen, NULL, 0, true);
3180 3181 3182
	if (!fn)
		goto out;

3183
	for_each_fib6_node_rt_rcu(fn) {
3184
		if (rt->dst.dev->ifindex != ifindex)
3185 3186 3187 3188 3189
			continue;
		if ((rt->rt6i_flags & (RTF_ROUTEINFO|RTF_GATEWAY)) != (RTF_ROUTEINFO|RTF_GATEWAY))
			continue;
		if (!ipv6_addr_equal(&rt->rt6i_gateway, gwaddr))
			continue;
3190
		ip6_hold_safe(NULL, &rt, false);
3191 3192 3193
		break;
	}
out:
3194
	rcu_read_unlock();
3195 3196 3197
	return rt;
}

3198
static struct rt6_info *rt6_add_route_info(struct net *net,
3199
					   const struct in6_addr *prefix, int prefixlen,
3200 3201
					   const struct in6_addr *gwaddr,
					   struct net_device *dev,
3202
					   unsigned int pref)
3203
{
3204
	struct fib6_config cfg = {
3205
		.fc_metric	= IP6_RT_PRIO_USER,
3206
		.fc_ifindex	= dev->ifindex,
3207 3208 3209
		.fc_dst_len	= prefixlen,
		.fc_flags	= RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
				  RTF_UP | RTF_PREF(pref),
3210
		.fc_protocol = RTPROT_RA,
3211
		.fc_nlinfo.portid = 0,
3212 3213
		.fc_nlinfo.nlh = NULL,
		.fc_nlinfo.nl_net = net,
3214 3215
	};

3216
	cfg.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_INFO,
A
Alexey Dobriyan 已提交
3217 3218
	cfg.fc_dst = *prefix;
	cfg.fc_gateway = *gwaddr;
3219

3220 3221
	/* We should treat it as a default route if prefix length is 0. */
	if (!prefixlen)
3222
		cfg.fc_flags |= RTF_DEFAULT;
3223

3224
	ip6_route_add(&cfg, NULL);
3225

3226
	return rt6_get_route_info(net, prefix, prefixlen, gwaddr, dev);
3227 3228 3229
}
#endif

3230
struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_device *dev)
3231
{
3232
	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_DFLT;
L
Linus Torvalds 已提交
3233
	struct rt6_info *rt;
T
Thomas Graf 已提交
3234
	struct fib6_table *table;
L
Linus Torvalds 已提交
3235

3236
	table = fib6_get_table(dev_net(dev), tb_id);
3237
	if (!table)
T
Thomas Graf 已提交
3238
		return NULL;
L
Linus Torvalds 已提交
3239

3240 3241
	rcu_read_lock();
	for_each_fib6_node_rt_rcu(&table->tb6_root) {
3242
		if (dev == rt->dst.dev &&
3243
		    ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
L
Linus Torvalds 已提交
3244 3245 3246 3247
		    ipv6_addr_equal(&rt->rt6i_gateway, addr))
			break;
	}
	if (rt)
3248
		ip6_hold_safe(NULL, &rt, false);
3249
	rcu_read_unlock();
L
Linus Torvalds 已提交
3250 3251 3252
	return rt;
}

3253
struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
3254 3255
				     struct net_device *dev,
				     unsigned int pref)
L
Linus Torvalds 已提交
3256
{
3257
	struct fib6_config cfg = {
D
David Ahern 已提交
3258
		.fc_table	= l3mdev_fib_table(dev) ? : RT6_TABLE_DFLT,
3259
		.fc_metric	= IP6_RT_PRIO_USER,
3260 3261 3262
		.fc_ifindex	= dev->ifindex,
		.fc_flags	= RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
				  RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
3263
		.fc_protocol = RTPROT_RA,
3264
		.fc_nlinfo.portid = 0,
3265
		.fc_nlinfo.nlh = NULL,
3266
		.fc_nlinfo.nl_net = dev_net(dev),
3267
	};
L
Linus Torvalds 已提交
3268

A
Alexey Dobriyan 已提交
3269
	cfg.fc_gateway = *gwaddr;
L
Linus Torvalds 已提交
3270

3271
	if (!ip6_route_add(&cfg, NULL)) {
3272 3273 3274 3275 3276 3277
		struct fib6_table *table;

		table = fib6_get_table(dev_net(dev), cfg.fc_table);
		if (table)
			table->flags |= RT6_TABLE_HAS_DFLT_ROUTER;
	}
L
Linus Torvalds 已提交
3278 3279 3280 3281

	return rt6_get_dflt_router(gwaddr, dev);
}

3282
static void __rt6_purge_dflt_routers(struct fib6_table *table)
L
Linus Torvalds 已提交
3283 3284 3285 3286
{
	struct rt6_info *rt;

restart:
3287 3288
	rcu_read_lock();
	for_each_fib6_node_rt_rcu(&table->tb6_root) {
3289 3290
		if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
		    (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
3291
			if (dst_hold_safe(&rt->dst)) {
3292
				rcu_read_unlock();
3293 3294
				ip6_del_rt(rt);
			} else {
3295
				rcu_read_unlock();
3296
			}
L
Linus Torvalds 已提交
3297 3298 3299
			goto restart;
		}
	}
3300
	rcu_read_unlock();
3301 3302 3303 3304 3305 3306 3307 3308 3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320 3321

	table->flags &= ~RT6_TABLE_HAS_DFLT_ROUTER;
}

void rt6_purge_dflt_routers(struct net *net)
{
	struct fib6_table *table;
	struct hlist_head *head;
	unsigned int h;

	rcu_read_lock();

	for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
		head = &net->ipv6.fib_table_hash[h];
		hlist_for_each_entry_rcu(table, head, tb6_hlist) {
			if (table->flags & RT6_TABLE_HAS_DFLT_ROUTER)
				__rt6_purge_dflt_routers(table);
		}
	}

	rcu_read_unlock();
L
Linus Torvalds 已提交
3322 3323
}

3324 3325
static void rtmsg_to_fib6_config(struct net *net,
				 struct in6_rtmsg *rtmsg,
3326 3327 3328 3329
				 struct fib6_config *cfg)
{
	memset(cfg, 0, sizeof(*cfg));

D
David Ahern 已提交
3330 3331
	cfg->fc_table = l3mdev_fib_table_by_index(net, rtmsg->rtmsg_ifindex) ?
			 : RT6_TABLE_MAIN;
3332 3333 3334 3335 3336 3337 3338
	cfg->fc_ifindex = rtmsg->rtmsg_ifindex;
	cfg->fc_metric = rtmsg->rtmsg_metric;
	cfg->fc_expires = rtmsg->rtmsg_info;
	cfg->fc_dst_len = rtmsg->rtmsg_dst_len;
	cfg->fc_src_len = rtmsg->rtmsg_src_len;
	cfg->fc_flags = rtmsg->rtmsg_flags;

3339
	cfg->fc_nlinfo.nl_net = net;
3340

A
Alexey Dobriyan 已提交
3341 3342 3343
	cfg->fc_dst = rtmsg->rtmsg_dst;
	cfg->fc_src = rtmsg->rtmsg_src;
	cfg->fc_gateway = rtmsg->rtmsg_gateway;
3344 3345
}

3346
int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
L
Linus Torvalds 已提交
3347
{
3348
	struct fib6_config cfg;
L
Linus Torvalds 已提交
3349 3350 3351
	struct in6_rtmsg rtmsg;
	int err;

3352
	switch (cmd) {
L
Linus Torvalds 已提交
3353 3354
	case SIOCADDRT:		/* Add a route */
	case SIOCDELRT:		/* Delete a route */
3355
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
L
Linus Torvalds 已提交
3356 3357 3358 3359 3360
			return -EPERM;
		err = copy_from_user(&rtmsg, arg,
				     sizeof(struct in6_rtmsg));
		if (err)
			return -EFAULT;
3361

3362
		rtmsg_to_fib6_config(net, &rtmsg, &cfg);
3363

L
Linus Torvalds 已提交
3364 3365 3366
		rtnl_lock();
		switch (cmd) {
		case SIOCADDRT:
3367
			err = ip6_route_add(&cfg, NULL);
L
Linus Torvalds 已提交
3368 3369
			break;
		case SIOCDELRT:
3370
			err = ip6_route_del(&cfg, NULL);
L
Linus Torvalds 已提交
3371 3372 3373 3374 3375 3376 3377
			break;
		default:
			err = -EINVAL;
		}
		rtnl_unlock();

		return err;
3378
	}
L
Linus Torvalds 已提交
3379 3380 3381 3382 3383 3384 3385 3386

	return -EINVAL;
}

/*
 *	Drop the packet on the floor
 */

3387
static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
L
Linus Torvalds 已提交
3388
{
3389
	int type;
E
Eric Dumazet 已提交
3390
	struct dst_entry *dst = skb_dst(skb);
3391 3392
	switch (ipstats_mib_noroutes) {
	case IPSTATS_MIB_INNOROUTES:
3393
		type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
U
Ulrich Weber 已提交
3394
		if (type == IPV6_ADDR_ANY) {
3395 3396
			IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
				      IPSTATS_MIB_INADDRERRORS);
3397 3398 3399 3400
			break;
		}
		/* FALLTHROUGH */
	case IPSTATS_MIB_OUTNOROUTES:
3401 3402
		IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
			      ipstats_mib_noroutes);
3403 3404
		break;
	}
3405
	icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0);
L
Linus Torvalds 已提交
3406 3407 3408 3409
	kfree_skb(skb);
	return 0;
}

3410 3411
static int ip6_pkt_discard(struct sk_buff *skb)
{
3412
	return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_INNOROUTES);
3413 3414
}

E
Eric W. Biederman 已提交
3415
static int ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
3416
{
E
Eric Dumazet 已提交
3417
	skb->dev = skb_dst(skb)->dev;
3418
	return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
3419 3420
}

3421 3422
static int ip6_pkt_prohibit(struct sk_buff *skb)
{
3423
	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
3424 3425
}

E
Eric W. Biederman 已提交
3426
static int ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb)
3427
{
E
Eric Dumazet 已提交
3428
	skb->dev = skb_dst(skb)->dev;
3429
	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
3430 3431
}

L
Linus Torvalds 已提交
3432 3433 3434 3435 3436 3437
/*
 *	Allocate a dst for local (unicast / anycast) address.
 */

struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
				    const struct in6_addr *addr,
3438
				    bool anycast)
L
Linus Torvalds 已提交
3439
{
D
David Ahern 已提交
3440
	u32 tb_id;
3441
	struct net *net = dev_net(idev->dev);
3442
	struct net_device *dev = idev->dev;
3443 3444 3445
	struct rt6_info *rt;

	rt = ip6_dst_alloc(net, dev, DST_NOCOUNT);
3446
	if (!rt)
L
Linus Torvalds 已提交
3447 3448 3449 3450
		return ERR_PTR(-ENOMEM);

	in6_dev_hold(idev);

3451
	rt->dst.flags |= DST_HOST;
3452 3453
	rt->dst.input = ip6_input;
	rt->dst.output = ip6_output;
L
Linus Torvalds 已提交
3454 3455
	rt->rt6i_idev = idev;

3456
	rt->rt6i_protocol = RTPROT_KERNEL;
L
Linus Torvalds 已提交
3457
	rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
3458 3459 3460
	if (anycast)
		rt->rt6i_flags |= RTF_ANYCAST;
	else
L
Linus Torvalds 已提交
3461 3462
		rt->rt6i_flags |= RTF_LOCAL;

3463
	rt->rt6i_gateway  = *addr;
A
Alexey Dobriyan 已提交
3464
	rt->rt6i_dst.addr = *addr;
L
Linus Torvalds 已提交
3465
	rt->rt6i_dst.plen = 128;
D
David Ahern 已提交
3466 3467
	tb_id = l3mdev_fib_table(idev->dev) ? : RT6_TABLE_LOCAL;
	rt->rt6i_table = fib6_get_table(net, tb_id);
L
Linus Torvalds 已提交
3468 3469 3470 3471

	return rt;
}

3472 3473 3474 3475 3476 3477 3478 3479 3480 3481 3482 3483 3484
/* remove deleted ip from prefsrc entries */
struct arg_dev_net_ip {
	struct net_device *dev;
	struct net *net;
	struct in6_addr *addr;
};

static int fib6_remove_prefsrc(struct rt6_info *rt, void *arg)
{
	struct net_device *dev = ((struct arg_dev_net_ip *)arg)->dev;
	struct net *net = ((struct arg_dev_net_ip *)arg)->net;
	struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;

3485
	if (((void *)rt->dst.dev == dev || !dev) &&
3486 3487
	    rt != net->ipv6.ip6_null_entry &&
	    ipv6_addr_equal(addr, &rt->rt6i_prefsrc.addr)) {
3488
		spin_lock_bh(&rt6_exception_lock);
3489 3490
		/* remove prefsrc entry */
		rt->rt6i_prefsrc.plen = 0;
3491 3492 3493
		/* need to update cache as well */
		rt6_exceptions_remove_prefsrc(rt);
		spin_unlock_bh(&rt6_exception_lock);
3494 3495 3496 3497 3498 3499 3500 3501 3502 3503 3504 3505
	}
	return 0;
}

void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
{
	struct net *net = dev_net(ifp->idev->dev);
	struct arg_dev_net_ip adni = {
		.dev = ifp->idev->dev,
		.net = net,
		.addr = &ifp->addr,
	};
3506
	fib6_clean_all(net, fib6_remove_prefsrc, &adni);
3507 3508
}

3509 3510 3511 3512 3513 3514 3515
#define RTF_RA_ROUTER		(RTF_ADDRCONF | RTF_DEFAULT | RTF_GATEWAY)

/* Remove routers and update dst entries when gateway turn into host. */
static int fib6_clean_tohost(struct rt6_info *rt, void *arg)
{
	struct in6_addr *gateway = (struct in6_addr *)arg;

3516 3517
	if (((rt->rt6i_flags & RTF_RA_ROUTER) == RTF_RA_ROUTER) &&
	    ipv6_addr_equal(gateway, &rt->rt6i_gateway)) {
3518 3519
		return -1;
	}
3520 3521 3522 3523 3524 3525 3526

	/* Further clean up cached routes in exception table.
	 * This is needed because cached route may have a different
	 * gateway than its 'parent' in the case of an ip redirect.
	 */
	rt6_exceptions_clean_tohost(rt, gateway);

3527 3528 3529 3530 3531 3532 3533 3534
	return 0;
}

void rt6_clean_tohost(struct net *net, struct in6_addr *gateway)
{
	fib6_clean_all(net, fib6_clean_tohost, gateway);
}

3535 3536
struct arg_netdev_event {
	const struct net_device *dev;
3537 3538 3539 3540
	union {
		unsigned int nh_flags;
		unsigned long event;
	};
3541 3542
};

3543 3544 3545 3546 3547 3548 3549 3550 3551 3552 3553 3554 3555 3556 3557 3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568 3569 3570 3571 3572 3573 3574 3575 3576 3577 3578
static struct rt6_info *rt6_multipath_first_sibling(const struct rt6_info *rt)
{
	struct rt6_info *iter;
	struct fib6_node *fn;

	fn = rcu_dereference_protected(rt->rt6i_node,
			lockdep_is_held(&rt->rt6i_table->tb6_lock));
	iter = rcu_dereference_protected(fn->leaf,
			lockdep_is_held(&rt->rt6i_table->tb6_lock));
	while (iter) {
		if (iter->rt6i_metric == rt->rt6i_metric &&
		    rt6_qualify_for_ecmp(iter))
			return iter;
		iter = rcu_dereference_protected(iter->rt6_next,
				lockdep_is_held(&rt->rt6i_table->tb6_lock));
	}

	return NULL;
}

static bool rt6_is_dead(const struct rt6_info *rt)
{
	if (rt->rt6i_nh_flags & RTNH_F_DEAD ||
	    (rt->rt6i_nh_flags & RTNH_F_LINKDOWN &&
	     rt->rt6i_idev->cnf.ignore_routes_with_linkdown))
		return true;

	return false;
}

static int rt6_multipath_total_weight(const struct rt6_info *rt)
{
	struct rt6_info *iter;
	int total = 0;

	if (!rt6_is_dead(rt))
3579
		total += rt->rt6i_nh_weight;
3580 3581 3582

	list_for_each_entry(iter, &rt->rt6i_siblings, rt6i_siblings) {
		if (!rt6_is_dead(iter))
3583
			total += iter->rt6i_nh_weight;
3584 3585 3586 3587 3588 3589 3590 3591 3592 3593
	}

	return total;
}

static void rt6_upper_bound_set(struct rt6_info *rt, int *weight, int total)
{
	int upper_bound = -1;

	if (!rt6_is_dead(rt)) {
3594
		*weight += rt->rt6i_nh_weight;
3595 3596 3597 3598 3599 3600 3601 3602 3603 3604 3605 3606 3607 3608 3609 3610 3611 3612 3613 3614 3615 3616 3617 3618 3619 3620 3621 3622 3623 3624 3625 3626 3627 3628 3629 3630 3631 3632 3633 3634 3635
		upper_bound = DIV_ROUND_CLOSEST_ULL((u64) (*weight) << 31,
						    total) - 1;
	}
	atomic_set(&rt->rt6i_nh_upper_bound, upper_bound);
}

static void rt6_multipath_upper_bound_set(struct rt6_info *rt, int total)
{
	struct rt6_info *iter;
	int weight = 0;

	rt6_upper_bound_set(rt, &weight, total);

	list_for_each_entry(iter, &rt->rt6i_siblings, rt6i_siblings)
		rt6_upper_bound_set(iter, &weight, total);
}

void rt6_multipath_rebalance(struct rt6_info *rt)
{
	struct rt6_info *first;
	int total;

	/* In case the entire multipath route was marked for flushing,
	 * then there is no need to rebalance upon the removal of every
	 * sibling route.
	 */
	if (!rt->rt6i_nsiblings || rt->should_flush)
		return;

	/* During lookup routes are evaluated in order, so we need to
	 * make sure upper bounds are assigned from the first sibling
	 * onwards.
	 */
	first = rt6_multipath_first_sibling(rt);
	if (WARN_ON_ONCE(!first))
		return;

	total = rt6_multipath_total_weight(first);
	rt6_multipath_upper_bound_set(first, total);
}

3636 3637 3638 3639 3640
static int fib6_ifup(struct rt6_info *rt, void *p_arg)
{
	const struct arg_netdev_event *arg = p_arg;
	const struct net *net = dev_net(arg->dev);

3641
	if (rt != net->ipv6.ip6_null_entry && rt->dst.dev == arg->dev) {
3642
		rt->rt6i_nh_flags &= ~arg->nh_flags;
3643
		fib6_update_sernum_upto_root(dev_net(rt->dst.dev), rt);
3644
		rt6_multipath_rebalance(rt);
3645
	}
3646 3647 3648 3649 3650 3651 3652 3653

	return 0;
}

void rt6_sync_up(struct net_device *dev, unsigned int nh_flags)
{
	struct arg_netdev_event arg = {
		.dev = dev,
I
Ido Schimmel 已提交
3654 3655 3656
		{
			.nh_flags = nh_flags,
		},
3657 3658 3659 3660 3661 3662 3663 3664
	};

	if (nh_flags & RTNH_F_DEAD && netif_carrier_ok(dev))
		arg.nh_flags |= RTNH_F_LINKDOWN;

	fib6_clean_all(dev_net(dev), fib6_ifup, &arg);
}

3665 3666 3667 3668 3669 3670 3671 3672 3673 3674 3675 3676 3677 3678 3679 3680 3681 3682 3683 3684 3685 3686 3687 3688 3689 3690 3691 3692 3693 3694 3695 3696 3697 3698 3699 3700 3701 3702 3703 3704 3705 3706 3707 3708 3709 3710 3711 3712 3713 3714 3715 3716
static bool rt6_multipath_uses_dev(const struct rt6_info *rt,
				   const struct net_device *dev)
{
	struct rt6_info *iter;

	if (rt->dst.dev == dev)
		return true;
	list_for_each_entry(iter, &rt->rt6i_siblings, rt6i_siblings)
		if (iter->dst.dev == dev)
			return true;

	return false;
}

static void rt6_multipath_flush(struct rt6_info *rt)
{
	struct rt6_info *iter;

	rt->should_flush = 1;
	list_for_each_entry(iter, &rt->rt6i_siblings, rt6i_siblings)
		iter->should_flush = 1;
}

static unsigned int rt6_multipath_dead_count(const struct rt6_info *rt,
					     const struct net_device *down_dev)
{
	struct rt6_info *iter;
	unsigned int dead = 0;

	if (rt->dst.dev == down_dev || rt->rt6i_nh_flags & RTNH_F_DEAD)
		dead++;
	list_for_each_entry(iter, &rt->rt6i_siblings, rt6i_siblings)
		if (iter->dst.dev == down_dev ||
		    iter->rt6i_nh_flags & RTNH_F_DEAD)
			dead++;

	return dead;
}

static void rt6_multipath_nh_flags_set(struct rt6_info *rt,
				       const struct net_device *dev,
				       unsigned int nh_flags)
{
	struct rt6_info *iter;

	if (rt->dst.dev == dev)
		rt->rt6i_nh_flags |= nh_flags;
	list_for_each_entry(iter, &rt->rt6i_siblings, rt6i_siblings)
		if (iter->dst.dev == dev)
			iter->rt6i_nh_flags |= nh_flags;
}

3717
/* called with write lock held for table with rt */
3718
static int fib6_ifdown(struct rt6_info *rt, void *p_arg)
L
Linus Torvalds 已提交
3719
{
3720 3721 3722
	const struct arg_netdev_event *arg = p_arg;
	const struct net_device *dev = arg->dev;
	const struct net *net = dev_net(dev);
3723

3724
	if (rt == net->ipv6.ip6_null_entry)
3725 3726 3727 3728
		return 0;

	switch (arg->event) {
	case NETDEV_UNREGISTER:
3729
		return rt->dst.dev == dev ? -1 : 0;
3730
	case NETDEV_DOWN:
3731
		if (rt->should_flush)
3732
			return -1;
3733 3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745
		if (!rt->rt6i_nsiblings)
			return rt->dst.dev == dev ? -1 : 0;
		if (rt6_multipath_uses_dev(rt, dev)) {
			unsigned int count;

			count = rt6_multipath_dead_count(rt, dev);
			if (rt->rt6i_nsiblings + 1 == count) {
				rt6_multipath_flush(rt);
				return -1;
			}
			rt6_multipath_nh_flags_set(rt, dev, RTNH_F_DEAD |
						   RTNH_F_LINKDOWN);
			fib6_update_sernum(rt);
3746
			rt6_multipath_rebalance(rt);
3747 3748
		}
		return -2;
3749
	case NETDEV_CHANGE:
3750 3751
		if (rt->dst.dev != dev ||
		    rt->rt6i_flags & (RTF_LOCAL | RTF_ANYCAST))
3752 3753
			break;
		rt->rt6i_nh_flags |= RTNH_F_LINKDOWN;
3754
		rt6_multipath_rebalance(rt);
3755
		break;
3756
	}
3757

L
Linus Torvalds 已提交
3758 3759 3760
	return 0;
}

3761
void rt6_sync_down_dev(struct net_device *dev, unsigned long event)
L
Linus Torvalds 已提交
3762
{
3763
	struct arg_netdev_event arg = {
3764
		.dev = dev,
I
Ido Schimmel 已提交
3765 3766 3767
		{
			.event = event,
		},
3768 3769
	};

3770 3771 3772 3773 3774 3775 3776 3777
	fib6_clean_all(dev_net(dev), fib6_ifdown, &arg);
}

void rt6_disable_ip(struct net_device *dev, unsigned long event)
{
	rt6_sync_down_dev(dev, event);
	rt6_uncached_list_flush_dev(dev_net(dev), dev);
	neigh_ifdown(&nd_tbl, dev);
L
Linus Torvalds 已提交
3778 3779
}

3780
struct rt6_mtu_change_arg {
L
Linus Torvalds 已提交
3781
	struct net_device *dev;
3782
	unsigned int mtu;
L
Linus Torvalds 已提交
3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796
};

static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
{
	struct rt6_mtu_change_arg *arg = (struct rt6_mtu_change_arg *) p_arg;
	struct inet6_dev *idev;

	/* In IPv6 pmtu discovery is not optional,
	   so that RTAX_MTU lock cannot disable it.
	   We still use this lock to block changes
	   caused by addrconf/ndisc.
	*/

	idev = __in6_dev_get(arg->dev);
3797
	if (!idev)
L
Linus Torvalds 已提交
3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811
		return 0;

	/* For administrative MTU increase, there is no way to discover
	   IPv6 PMTU increase, so PMTU increase should be updated here.
	   Since RFC 1981 doesn't include administrative MTU increase
	   update PMTU increase is a MUST. (i.e. jumbo frame)
	 */
	/*
	   If new MTU is less than route PMTU, this new MTU will be the
	   lowest MTU in the path, update the route PMTU to reflect PMTU
	   decreases; if new MTU is greater than route PMTU, and the
	   old MTU is the lowest MTU in the path, update the route PMTU
	   to reflect the increase. In this case if the other nodes' MTU
	   also have the lowest MTU, TOO BIG MESSAGE will be lead to
A
Alexander Alemayhu 已提交
3812
	   PMTU discovery.
L
Linus Torvalds 已提交
3813
	 */
3814
	if (rt->dst.dev == arg->dev &&
3815
	    dst_metric_raw(&rt->dst, RTAX_MTU) &&
3816
	    !dst_metric_locked(&rt->dst, RTAX_MTU)) {
3817
		spin_lock_bh(&rt6_exception_lock);
3818 3819 3820
		if (dst_mtu(&rt->dst) >= arg->mtu ||
		    (dst_mtu(&rt->dst) < arg->mtu &&
		     dst_mtu(&rt->dst) == idev->cnf.mtu6)) {
3821 3822
			dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
		}
3823 3824
		rt6_exceptions_update_pmtu(rt, arg->mtu);
		spin_unlock_bh(&rt6_exception_lock);
3825
	}
L
Linus Torvalds 已提交
3826 3827 3828
	return 0;
}

3829
void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
L
Linus Torvalds 已提交
3830
{
T
Thomas Graf 已提交
3831 3832 3833 3834
	struct rt6_mtu_change_arg arg = {
		.dev = dev,
		.mtu = mtu,
	};
L
Linus Torvalds 已提交
3835

3836
	fib6_clean_all(dev_net(dev), rt6_mtu_change_route, &arg);
L
Linus Torvalds 已提交
3837 3838
}

3839
static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
3840
	[RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
3841
	[RTA_OIF]               = { .type = NLA_U32 },
3842
	[RTA_IIF]		= { .type = NLA_U32 },
3843 3844
	[RTA_PRIORITY]          = { .type = NLA_U32 },
	[RTA_METRICS]           = { .type = NLA_NESTED },
3845
	[RTA_MULTIPATH]		= { .len = sizeof(struct rtnexthop) },
3846
	[RTA_PREF]              = { .type = NLA_U8 },
3847 3848
	[RTA_ENCAP_TYPE]	= { .type = NLA_U16 },
	[RTA_ENCAP]		= { .type = NLA_NESTED },
3849
	[RTA_EXPIRES]		= { .type = NLA_U32 },
3850
	[RTA_UID]		= { .type = NLA_U32 },
3851
	[RTA_MARK]		= { .type = NLA_U32 },
3852 3853 3854
};

static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
3855 3856
			      struct fib6_config *cfg,
			      struct netlink_ext_ack *extack)
L
Linus Torvalds 已提交
3857
{
3858 3859
	struct rtmsg *rtm;
	struct nlattr *tb[RTA_MAX+1];
3860
	unsigned int pref;
3861
	int err;
L
Linus Torvalds 已提交
3862

3863 3864
	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy,
			  NULL);
3865 3866
	if (err < 0)
		goto errout;
L
Linus Torvalds 已提交
3867

3868 3869 3870 3871 3872 3873 3874 3875 3876
	err = -EINVAL;
	rtm = nlmsg_data(nlh);
	memset(cfg, 0, sizeof(*cfg));

	cfg->fc_table = rtm->rtm_table;
	cfg->fc_dst_len = rtm->rtm_dst_len;
	cfg->fc_src_len = rtm->rtm_src_len;
	cfg->fc_flags = RTF_UP;
	cfg->fc_protocol = rtm->rtm_protocol;
3877
	cfg->fc_type = rtm->rtm_type;
3878

3879 3880
	if (rtm->rtm_type == RTN_UNREACHABLE ||
	    rtm->rtm_type == RTN_BLACKHOLE ||
3881 3882
	    rtm->rtm_type == RTN_PROHIBIT ||
	    rtm->rtm_type == RTN_THROW)
3883 3884
		cfg->fc_flags |= RTF_REJECT;

3885 3886 3887
	if (rtm->rtm_type == RTN_LOCAL)
		cfg->fc_flags |= RTF_LOCAL;

3888 3889 3890
	if (rtm->rtm_flags & RTM_F_CLONED)
		cfg->fc_flags |= RTF_CACHE;

3891 3892
	cfg->fc_flags |= (rtm->rtm_flags & RTNH_F_ONLINK);

3893
	cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid;
3894
	cfg->fc_nlinfo.nlh = nlh;
3895
	cfg->fc_nlinfo.nl_net = sock_net(skb->sk);
3896 3897

	if (tb[RTA_GATEWAY]) {
3898
		cfg->fc_gateway = nla_get_in6_addr(tb[RTA_GATEWAY]);
3899
		cfg->fc_flags |= RTF_GATEWAY;
L
Linus Torvalds 已提交
3900
	}
3901 3902 3903 3904 3905 3906 3907 3908

	if (tb[RTA_DST]) {
		int plen = (rtm->rtm_dst_len + 7) >> 3;

		if (nla_len(tb[RTA_DST]) < plen)
			goto errout;

		nla_memcpy(&cfg->fc_dst, tb[RTA_DST], plen);
L
Linus Torvalds 已提交
3909
	}
3910 3911 3912 3913 3914 3915 3916 3917

	if (tb[RTA_SRC]) {
		int plen = (rtm->rtm_src_len + 7) >> 3;

		if (nla_len(tb[RTA_SRC]) < plen)
			goto errout;

		nla_memcpy(&cfg->fc_src, tb[RTA_SRC], plen);
L
Linus Torvalds 已提交
3918
	}
3919

3920
	if (tb[RTA_PREFSRC])
3921
		cfg->fc_prefsrc = nla_get_in6_addr(tb[RTA_PREFSRC]);
3922

3923 3924 3925 3926 3927 3928 3929 3930 3931
	if (tb[RTA_OIF])
		cfg->fc_ifindex = nla_get_u32(tb[RTA_OIF]);

	if (tb[RTA_PRIORITY])
		cfg->fc_metric = nla_get_u32(tb[RTA_PRIORITY]);

	if (tb[RTA_METRICS]) {
		cfg->fc_mx = nla_data(tb[RTA_METRICS]);
		cfg->fc_mx_len = nla_len(tb[RTA_METRICS]);
L
Linus Torvalds 已提交
3932
	}
3933 3934 3935 3936

	if (tb[RTA_TABLE])
		cfg->fc_table = nla_get_u32(tb[RTA_TABLE]);

3937 3938 3939
	if (tb[RTA_MULTIPATH]) {
		cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
		cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
3940 3941

		err = lwtunnel_valid_encap_type_attr(cfg->fc_mp,
3942
						     cfg->fc_mp_len, extack);
3943 3944
		if (err < 0)
			goto errout;
3945 3946
	}

3947 3948 3949 3950 3951 3952 3953 3954
	if (tb[RTA_PREF]) {
		pref = nla_get_u8(tb[RTA_PREF]);
		if (pref != ICMPV6_ROUTER_PREF_LOW &&
		    pref != ICMPV6_ROUTER_PREF_HIGH)
			pref = ICMPV6_ROUTER_PREF_MEDIUM;
		cfg->fc_flags |= RTF_PREF(pref);
	}

3955 3956 3957
	if (tb[RTA_ENCAP])
		cfg->fc_encap = tb[RTA_ENCAP];

3958
	if (tb[RTA_ENCAP_TYPE]) {
3959 3960
		cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]);

3961
		err = lwtunnel_valid_encap_type(cfg->fc_encap_type, extack);
3962 3963 3964 3965
		if (err < 0)
			goto errout;
	}

3966 3967 3968 3969 3970 3971 3972 3973 3974
	if (tb[RTA_EXPIRES]) {
		unsigned long timeout = addrconf_timeout_fixup(nla_get_u32(tb[RTA_EXPIRES]), HZ);

		if (addrconf_finite_timeout(timeout)) {
			cfg->fc_expires = jiffies_to_clock_t(timeout * HZ);
			cfg->fc_flags |= RTF_EXPIRES;
		}
	}

3975 3976 3977
	err = 0;
errout:
	return err;
L
Linus Torvalds 已提交
3978 3979
}

3980 3981 3982 3983 3984 3985 3986 3987 3988 3989 3990 3991
struct rt6_nh {
	struct rt6_info *rt6_info;
	struct fib6_config r_cfg;
	struct mx6_config mxc;
	struct list_head next;
};

static void ip6_print_replace_route_err(struct list_head *rt6_nh_list)
{
	struct rt6_nh *nh;

	list_for_each_entry(nh, rt6_nh_list, next) {
3992
		pr_warn("IPV6: multipath route replace failed (check consistency of installed routes): %pI6c nexthop %pI6c ifi %d\n",
3993 3994 3995 3996 3997 3998 3999 4000 4001 4002 4003 4004 4005
		        &nh->r_cfg.fc_dst, &nh->r_cfg.fc_gateway,
		        nh->r_cfg.fc_ifindex);
	}
}

static int ip6_route_info_append(struct list_head *rt6_nh_list,
				 struct rt6_info *rt, struct fib6_config *r_cfg)
{
	struct rt6_nh *nh;
	int err = -EEXIST;

	list_for_each_entry(nh, rt6_nh_list, next) {
		/* check if rt6_info already exists */
4006
		if (rt6_duplicate_nexthop(nh->rt6_info, rt))
4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018 4019 4020 4021 4022 4023 4024
			return err;
	}

	nh = kzalloc(sizeof(*nh), GFP_KERNEL);
	if (!nh)
		return -ENOMEM;
	nh->rt6_info = rt;
	err = ip6_convert_metrics(&nh->mxc, r_cfg);
	if (err) {
		kfree(nh);
		return err;
	}
	memcpy(&nh->r_cfg, r_cfg, sizeof(*r_cfg));
	list_add_tail(&nh->next, rt6_nh_list);

	return 0;
}

4025 4026 4027 4028 4029 4030 4031 4032 4033 4034 4035 4036 4037 4038 4039 4040 4041 4042 4043 4044 4045
static void ip6_route_mpath_notify(struct rt6_info *rt,
				   struct rt6_info *rt_last,
				   struct nl_info *info,
				   __u16 nlflags)
{
	/* if this is an APPEND route, then rt points to the first route
	 * inserted and rt_last points to last route inserted. Userspace
	 * wants a consistent dump of the route which starts at the first
	 * nexthop. Since sibling routes are always added at the end of
	 * the list, find the first sibling of the last route appended
	 */
	if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->rt6i_nsiblings) {
		rt = list_first_entry(&rt_last->rt6i_siblings,
				      struct rt6_info,
				      rt6i_siblings);
	}

	if (rt)
		inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags);
}

4046 4047
static int ip6_route_multipath_add(struct fib6_config *cfg,
				   struct netlink_ext_ack *extack)
4048
{
4049 4050
	struct rt6_info *rt_notif = NULL, *rt_last = NULL;
	struct nl_info *info = &cfg->fc_nlinfo;
4051 4052
	struct fib6_config r_cfg;
	struct rtnexthop *rtnh;
4053 4054 4055
	struct rt6_info *rt;
	struct rt6_nh *err_nh;
	struct rt6_nh *nh, *nh_safe;
4056
	__u16 nlflags;
4057 4058
	int remaining;
	int attrlen;
4059 4060 4061 4062 4063
	int err = 1;
	int nhn = 0;
	int replace = (cfg->fc_nlinfo.nlh &&
		       (cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_REPLACE));
	LIST_HEAD(rt6_nh_list);
4064

4065 4066 4067 4068
	nlflags = replace ? NLM_F_REPLACE : NLM_F_CREATE;
	if (info->nlh && info->nlh->nlmsg_flags & NLM_F_APPEND)
		nlflags |= NLM_F_APPEND;

4069
	remaining = cfg->fc_mp_len;
4070 4071
	rtnh = (struct rtnexthop *)cfg->fc_mp;

4072 4073 4074
	/* Parse a Multipath Entry and build a list (rt6_nh_list) of
	 * rt6_info structs per nexthop
	 */
4075 4076 4077 4078 4079 4080 4081 4082 4083 4084 4085
	while (rtnh_ok(rtnh, remaining)) {
		memcpy(&r_cfg, cfg, sizeof(*cfg));
		if (rtnh->rtnh_ifindex)
			r_cfg.fc_ifindex = rtnh->rtnh_ifindex;

		attrlen = rtnh_attrlen(rtnh);
		if (attrlen > 0) {
			struct nlattr *nla, *attrs = rtnh_attrs(rtnh);

			nla = nla_find(attrs, attrlen, RTA_GATEWAY);
			if (nla) {
4086
				r_cfg.fc_gateway = nla_get_in6_addr(nla);
4087 4088
				r_cfg.fc_flags |= RTF_GATEWAY;
			}
4089 4090 4091 4092
			r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);
			nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
			if (nla)
				r_cfg.fc_encap_type = nla_get_u16(nla);
4093
		}
4094

4095
		rt = ip6_route_info_create(&r_cfg, extack);
4096 4097 4098
		if (IS_ERR(rt)) {
			err = PTR_ERR(rt);
			rt = NULL;
4099
			goto cleanup;
4100
		}
4101

4102 4103
		rt->rt6i_nh_weight = rtnh->rtnh_hops + 1;

4104
		err = ip6_route_info_append(&rt6_nh_list, rt, &r_cfg);
4105
		if (err) {
4106
			dst_release_immediate(&rt->dst);
4107 4108 4109 4110 4111 4112
			goto cleanup;
		}

		rtnh = rtnh_next(rtnh, &remaining);
	}

4113 4114 4115 4116 4117 4118
	/* for add and replace send one notification with all nexthops.
	 * Skip the notification in fib6_add_rt2node and send one with
	 * the full route when done
	 */
	info->skip_notify = 1;

4119 4120
	err_nh = NULL;
	list_for_each_entry(nh, &rt6_nh_list, next) {
4121
		rt_last = nh->rt6_info;
4122
		err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc, extack);
4123 4124 4125 4126
		/* save reference to first route for notification */
		if (!rt_notif && !err)
			rt_notif = nh->rt6_info;

4127 4128 4129 4130 4131 4132 4133
		/* nh->rt6_info is used or freed at this point, reset to NULL*/
		nh->rt6_info = NULL;
		if (err) {
			if (replace && nhn)
				ip6_print_replace_route_err(&rt6_nh_list);
			err_nh = nh;
			goto add_errout;
4134
		}
4135

4136
		/* Because each route is added like a single route we remove
4137 4138 4139 4140 4141
		 * these flags after the first nexthop: if there is a collision,
		 * we have already failed to add the first nexthop:
		 * fib6_add_rt2node() has rejected it; when replacing, old
		 * nexthops have been replaced by first new, the rest should
		 * be added to it.
4142
		 */
4143 4144
		cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
						     NLM_F_REPLACE);
4145 4146 4147
		nhn++;
	}

4148 4149
	/* success ... tell user about new route */
	ip6_route_mpath_notify(rt_notif, rt_last, info, nlflags);
4150 4151 4152
	goto cleanup;

add_errout:
4153 4154 4155 4156 4157 4158 4159
	/* send notification for routes that were added so that
	 * the delete notifications sent by ip6_route_del are
	 * coherent
	 */
	if (rt_notif)
		ip6_route_mpath_notify(rt_notif, rt_last, info, nlflags);

4160 4161 4162 4163
	/* Delete routes that were already added */
	list_for_each_entry(nh, &rt6_nh_list, next) {
		if (err_nh == nh)
			break;
4164
		ip6_route_del(&nh->r_cfg, extack);
4165 4166 4167 4168
	}

cleanup:
	list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, next) {
4169 4170
		if (nh->rt6_info)
			dst_release_immediate(&nh->rt6_info->dst);
4171
		kfree(nh->mxc.mx);
4172 4173 4174 4175 4176 4177 4178
		list_del(&nh->next);
		kfree(nh);
	}

	return err;
}

4179 4180
static int ip6_route_multipath_del(struct fib6_config *cfg,
				   struct netlink_ext_ack *extack)
4181 4182 4183 4184 4185 4186 4187 4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206
{
	struct fib6_config r_cfg;
	struct rtnexthop *rtnh;
	int remaining;
	int attrlen;
	int err = 1, last_err = 0;

	remaining = cfg->fc_mp_len;
	rtnh = (struct rtnexthop *)cfg->fc_mp;

	/* Parse a Multipath Entry */
	while (rtnh_ok(rtnh, remaining)) {
		memcpy(&r_cfg, cfg, sizeof(*cfg));
		if (rtnh->rtnh_ifindex)
			r_cfg.fc_ifindex = rtnh->rtnh_ifindex;

		attrlen = rtnh_attrlen(rtnh);
		if (attrlen > 0) {
			struct nlattr *nla, *attrs = rtnh_attrs(rtnh);

			nla = nla_find(attrs, attrlen, RTA_GATEWAY);
			if (nla) {
				nla_memcpy(&r_cfg.fc_gateway, nla, 16);
				r_cfg.fc_flags |= RTF_GATEWAY;
			}
		}
4207
		err = ip6_route_del(&r_cfg, extack);
4208 4209 4210
		if (err)
			last_err = err;

4211 4212 4213 4214 4215 4216
		rtnh = rtnh_next(rtnh, &remaining);
	}

	return last_err;
}

4217 4218
static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh,
			      struct netlink_ext_ack *extack)
L
Linus Torvalds 已提交
4219
{
4220 4221
	struct fib6_config cfg;
	int err;
L
Linus Torvalds 已提交
4222

4223
	err = rtm_to_fib6_config(skb, nlh, &cfg, extack);
4224 4225 4226
	if (err < 0)
		return err;

4227
	if (cfg.fc_mp)
4228
		return ip6_route_multipath_del(&cfg, extack);
4229 4230
	else {
		cfg.fc_delete_all_nh = 1;
4231
		return ip6_route_del(&cfg, extack);
4232
	}
L
Linus Torvalds 已提交
4233 4234
}

4235 4236
static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh,
			      struct netlink_ext_ack *extack)
L
Linus Torvalds 已提交
4237
{
4238 4239
	struct fib6_config cfg;
	int err;
L
Linus Torvalds 已提交
4240

4241
	err = rtm_to_fib6_config(skb, nlh, &cfg, extack);
4242 4243 4244
	if (err < 0)
		return err;

4245
	if (cfg.fc_mp)
4246
		return ip6_route_multipath_add(&cfg, extack);
4247
	else
4248
		return ip6_route_add(&cfg, extack);
L
Linus Torvalds 已提交
4249 4250
}

4251
static size_t rt6_nlmsg_size(struct rt6_info *rt)
4252
{
4253 4254 4255 4256 4257 4258 4259 4260 4261 4262 4263
	int nexthop_len = 0;

	if (rt->rt6i_nsiblings) {
		nexthop_len = nla_total_size(0)	 /* RTA_MULTIPATH */
			    + NLA_ALIGN(sizeof(struct rtnexthop))
			    + nla_total_size(16) /* RTA_GATEWAY */
			    + lwtunnel_get_encap_size(rt->dst.lwtstate);

		nexthop_len *= rt->rt6i_nsiblings;
	}

4264 4265 4266 4267 4268 4269 4270 4271 4272
	return NLMSG_ALIGN(sizeof(struct rtmsg))
	       + nla_total_size(16) /* RTA_SRC */
	       + nla_total_size(16) /* RTA_DST */
	       + nla_total_size(16) /* RTA_GATEWAY */
	       + nla_total_size(16) /* RTA_PREFSRC */
	       + nla_total_size(4) /* RTA_TABLE */
	       + nla_total_size(4) /* RTA_IIF */
	       + nla_total_size(4) /* RTA_OIF */
	       + nla_total_size(4) /* RTA_PRIORITY */
4273
	       + RTAX_MAX * nla_total_size(4) /* RTA_METRICS */
4274
	       + nla_total_size(sizeof(struct rta_cacheinfo))
4275
	       + nla_total_size(TCP_CA_NAME_MAX) /* RTAX_CC_ALGO */
4276
	       + nla_total_size(1) /* RTA_PREF */
4277 4278 4279 4280 4281
	       + lwtunnel_get_encap_size(rt->dst.lwtstate)
	       + nexthop_len;
}

static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
4282
			    unsigned int *flags, bool skip_oif)
4283
{
4284 4285 4286
	if (rt->rt6i_nh_flags & RTNH_F_DEAD)
		*flags |= RTNH_F_DEAD;

4287
	if (rt->rt6i_nh_flags & RTNH_F_LINKDOWN) {
4288 4289 4290 4291 4292 4293 4294 4295 4296 4297
		*flags |= RTNH_F_LINKDOWN;
		if (rt->rt6i_idev->cnf.ignore_routes_with_linkdown)
			*flags |= RTNH_F_DEAD;
	}

	if (rt->rt6i_flags & RTF_GATEWAY) {
		if (nla_put_in6_addr(skb, RTA_GATEWAY, &rt->rt6i_gateway) < 0)
			goto nla_put_failure;
	}

4298
	*flags |= (rt->rt6i_nh_flags & RTNH_F_ONLINK);
4299
	if (rt->rt6i_nh_flags & RTNH_F_OFFLOAD)
4300 4301
		*flags |= RTNH_F_OFFLOAD;

4302 4303
	/* not needed for multipath encoding b/c it has a rtnexthop struct */
	if (!skip_oif && rt->dst.dev &&
4304 4305 4306 4307 4308 4309 4310 4311 4312 4313 4314 4315 4316
	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
		goto nla_put_failure;

	if (rt->dst.lwtstate &&
	    lwtunnel_fill_encap(skb, rt->dst.lwtstate) < 0)
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -EMSGSIZE;
}

4317
/* add multipath next hop */
4318 4319 4320 4321 4322 4323 4324 4325 4326
static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
{
	struct rtnexthop *rtnh;
	unsigned int flags = 0;

	rtnh = nla_reserve_nohdr(skb, sizeof(*rtnh));
	if (!rtnh)
		goto nla_put_failure;

4327
	rtnh->rtnh_hops = rt->rt6i_nh_weight - 1;
4328 4329
	rtnh->rtnh_ifindex = rt->dst.dev ? rt->dst.dev->ifindex : 0;

4330
	if (rt6_nexthop_info(skb, rt, &flags, true) < 0)
4331 4332 4333 4334 4335 4336 4337 4338 4339 4340 4341
		goto nla_put_failure;

	rtnh->rtnh_flags = flags;

	/* length of rtnetlink header + attributes */
	rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *)rtnh;

	return 0;

nla_put_failure:
	return -EMSGSIZE;
4342 4343
}

4344 4345
static int rt6_fill_node(struct net *net,
			 struct sk_buff *skb, struct rt6_info *rt,
4346
			 struct in6_addr *dst, struct in6_addr *src,
4347
			 int iif, int type, u32 portid, u32 seq,
4348
			 unsigned int flags)
L
Linus Torvalds 已提交
4349
{
4350
	u32 metrics[RTAX_MAX];
L
Linus Torvalds 已提交
4351
	struct rtmsg *rtm;
4352
	struct nlmsghdr *nlh;
4353
	long expires;
4354
	u32 table;
L
Linus Torvalds 已提交
4355

4356
	nlh = nlmsg_put(skb, portid, seq, type, sizeof(*rtm), flags);
4357
	if (!nlh)
4358
		return -EMSGSIZE;
4359 4360

	rtm = nlmsg_data(nlh);
L
Linus Torvalds 已提交
4361 4362 4363 4364
	rtm->rtm_family = AF_INET6;
	rtm->rtm_dst_len = rt->rt6i_dst.plen;
	rtm->rtm_src_len = rt->rt6i_src.plen;
	rtm->rtm_tos = 0;
T
Thomas Graf 已提交
4365
	if (rt->rt6i_table)
4366
		table = rt->rt6i_table->tb6_id;
T
Thomas Graf 已提交
4367
	else
4368 4369
		table = RT6_TABLE_UNSPEC;
	rtm->rtm_table = table;
D
David S. Miller 已提交
4370 4371
	if (nla_put_u32(skb, RTA_TABLE, table))
		goto nla_put_failure;
4372 4373 4374 4375 4376 4377 4378 4379
	if (rt->rt6i_flags & RTF_REJECT) {
		switch (rt->dst.error) {
		case -EINVAL:
			rtm->rtm_type = RTN_BLACKHOLE;
			break;
		case -EACCES:
			rtm->rtm_type = RTN_PROHIBIT;
			break;
4380 4381 4382
		case -EAGAIN:
			rtm->rtm_type = RTN_THROW;
			break;
4383 4384 4385 4386 4387
		default:
			rtm->rtm_type = RTN_UNREACHABLE;
			break;
		}
	}
4388
	else if (rt->rt6i_flags & RTF_LOCAL)
4389
		rtm->rtm_type = RTN_LOCAL;
4390 4391
	else if (rt->rt6i_flags & RTF_ANYCAST)
		rtm->rtm_type = RTN_ANYCAST;
4392
	else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
L
Linus Torvalds 已提交
4393 4394 4395 4396 4397 4398 4399
		rtm->rtm_type = RTN_LOCAL;
	else
		rtm->rtm_type = RTN_UNICAST;
	rtm->rtm_flags = 0;
	rtm->rtm_scope = RT_SCOPE_UNIVERSE;
	rtm->rtm_protocol = rt->rt6i_protocol;

4400
	if (rt->rt6i_flags & RTF_CACHE)
L
Linus Torvalds 已提交
4401 4402 4403
		rtm->rtm_flags |= RTM_F_CLONED;

	if (dst) {
4404
		if (nla_put_in6_addr(skb, RTA_DST, dst))
D
David S. Miller 已提交
4405
			goto nla_put_failure;
4406
		rtm->rtm_dst_len = 128;
L
Linus Torvalds 已提交
4407
	} else if (rtm->rtm_dst_len)
4408
		if (nla_put_in6_addr(skb, RTA_DST, &rt->rt6i_dst.addr))
D
David S. Miller 已提交
4409
			goto nla_put_failure;
L
Linus Torvalds 已提交
4410 4411
#ifdef CONFIG_IPV6_SUBTREES
	if (src) {
4412
		if (nla_put_in6_addr(skb, RTA_SRC, src))
D
David S. Miller 已提交
4413
			goto nla_put_failure;
4414
		rtm->rtm_src_len = 128;
D
David S. Miller 已提交
4415
	} else if (rtm->rtm_src_len &&
4416
		   nla_put_in6_addr(skb, RTA_SRC, &rt->rt6i_src.addr))
D
David S. Miller 已提交
4417
		goto nla_put_failure;
L
Linus Torvalds 已提交
4418
#endif
4419 4420 4421
	if (iif) {
#ifdef CONFIG_IPV6_MROUTE
		if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr)) {
4422 4423 4424 4425 4426 4427
			int err = ip6mr_get_route(net, skb, rtm, portid);

			if (err == 0)
				return 0;
			if (err < 0)
				goto nla_put_failure;
4428 4429
		} else
#endif
D
David S. Miller 已提交
4430 4431
			if (nla_put_u32(skb, RTA_IIF, iif))
				goto nla_put_failure;
4432
	} else if (dst) {
L
Linus Torvalds 已提交
4433
		struct in6_addr saddr_buf;
D
David S. Miller 已提交
4434
		if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0 &&
4435
		    nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
D
David S. Miller 已提交
4436
			goto nla_put_failure;
L
Linus Torvalds 已提交
4437
	}
4438

4439 4440
	if (rt->rt6i_prefsrc.plen) {
		struct in6_addr saddr_buf;
A
Alexey Dobriyan 已提交
4441
		saddr_buf = rt->rt6i_prefsrc.addr;
4442
		if (nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
D
David S. Miller 已提交
4443
			goto nla_put_failure;
4444 4445
	}

4446 4447 4448 4449
	memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
	if (rt->rt6i_pmtu)
		metrics[RTAX_MTU - 1] = rt->rt6i_pmtu;
	if (rtnetlink_put_metrics(skb, metrics) < 0)
4450 4451
		goto nla_put_failure;

D
David S. Miller 已提交
4452 4453
	if (nla_put_u32(skb, RTA_PRIORITY, rt->rt6i_metric))
		goto nla_put_failure;
4454

4455 4456 4457 4458 4459 4460 4461 4462 4463 4464 4465 4466 4467 4468 4469 4470 4471 4472 4473 4474 4475 4476
	/* For multipath routes, walk the siblings list and add
	 * each as a nexthop within RTA_MULTIPATH.
	 */
	if (rt->rt6i_nsiblings) {
		struct rt6_info *sibling, *next_sibling;
		struct nlattr *mp;

		mp = nla_nest_start(skb, RTA_MULTIPATH);
		if (!mp)
			goto nla_put_failure;

		if (rt6_add_nexthop(skb, rt) < 0)
			goto nla_put_failure;

		list_for_each_entry_safe(sibling, next_sibling,
					 &rt->rt6i_siblings, rt6i_siblings) {
			if (rt6_add_nexthop(skb, sibling) < 0)
				goto nla_put_failure;
		}

		nla_nest_end(skb, mp);
	} else {
4477
		if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags, false) < 0)
4478 4479 4480
			goto nla_put_failure;
	}

4481
	expires = (rt->rt6i_flags & RTF_EXPIRES) ? rt->dst.expires - jiffies : 0;
4482

4483
	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, rt->dst.error) < 0)
4484
		goto nla_put_failure;
4485

4486 4487 4488
	if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->rt6i_flags)))
		goto nla_put_failure;

4489

4490 4491
	nlmsg_end(skb, nlh);
	return 0;
4492 4493

nla_put_failure:
4494 4495
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
4496 4497
}

4498
int rt6_dump_route(struct rt6_info *rt, void *p_arg)
L
Linus Torvalds 已提交
4499 4500
{
	struct rt6_rtnl_dump_arg *arg = (struct rt6_rtnl_dump_arg *) p_arg;
4501 4502 4503 4504
	struct net *net = arg->net;

	if (rt == net->ipv6.ip6_null_entry)
		return 0;
L
Linus Torvalds 已提交
4505

4506 4507
	if (nlmsg_len(arg->cb->nlh) >= sizeof(struct rtmsg)) {
		struct rtmsg *rtm = nlmsg_data(arg->cb->nlh);
4508 4509 4510 4511 4512 4513 4514 4515

		/* user wants prefix routes only */
		if (rtm->rtm_flags & RTM_F_PREFIX &&
		    !(rt->rt6i_flags & RTF_PREFIX_RT)) {
			/* success since this is not a prefix route */
			return 1;
		}
	}
L
Linus Torvalds 已提交
4516

4517
	return rt6_fill_node(net,
4518
		     arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
4519
		     NETLINK_CB(arg->cb->skb).portid, arg->cb->nlh->nlmsg_seq,
4520
		     NLM_F_MULTI);
L
Linus Torvalds 已提交
4521 4522
}

4523 4524
static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
			      struct netlink_ext_ack *extack)
L
Linus Torvalds 已提交
4525
{
4526
	struct net *net = sock_net(in_skb->sk);
4527
	struct nlattr *tb[RTA_MAX+1];
4528 4529
	int err, iif = 0, oif = 0;
	struct dst_entry *dst;
4530
	struct rt6_info *rt;
L
Linus Torvalds 已提交
4531
	struct sk_buff *skb;
4532
	struct rtmsg *rtm;
4533
	struct flowi6 fl6;
4534
	bool fibmatch;
L
Linus Torvalds 已提交
4535

4536
	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy,
4537
			  extack);
4538 4539
	if (err < 0)
		goto errout;
L
Linus Torvalds 已提交
4540

4541
	err = -EINVAL;
4542
	memset(&fl6, 0, sizeof(fl6));
4543 4544
	rtm = nlmsg_data(nlh);
	fl6.flowlabel = ip6_make_flowinfo(rtm->rtm_tos, 0);
4545
	fibmatch = !!(rtm->rtm_flags & RTM_F_FIB_MATCH);
L
Linus Torvalds 已提交
4546

4547 4548 4549 4550
	if (tb[RTA_SRC]) {
		if (nla_len(tb[RTA_SRC]) < sizeof(struct in6_addr))
			goto errout;

A
Alexey Dobriyan 已提交
4551
		fl6.saddr = *(struct in6_addr *)nla_data(tb[RTA_SRC]);
4552 4553 4554 4555 4556 4557
	}

	if (tb[RTA_DST]) {
		if (nla_len(tb[RTA_DST]) < sizeof(struct in6_addr))
			goto errout;

A
Alexey Dobriyan 已提交
4558
		fl6.daddr = *(struct in6_addr *)nla_data(tb[RTA_DST]);
4559 4560 4561 4562 4563 4564
	}

	if (tb[RTA_IIF])
		iif = nla_get_u32(tb[RTA_IIF]);

	if (tb[RTA_OIF])
4565
		oif = nla_get_u32(tb[RTA_OIF]);
L
Linus Torvalds 已提交
4566

4567 4568 4569
	if (tb[RTA_MARK])
		fl6.flowi6_mark = nla_get_u32(tb[RTA_MARK]);

4570 4571 4572 4573 4574 4575
	if (tb[RTA_UID])
		fl6.flowi6_uid = make_kuid(current_user_ns(),
					   nla_get_u32(tb[RTA_UID]));
	else
		fl6.flowi6_uid = iif ? INVALID_UID : current_uid();

L
Linus Torvalds 已提交
4576 4577
	if (iif) {
		struct net_device *dev;
4578 4579
		int flags = 0;

4580 4581 4582
		rcu_read_lock();

		dev = dev_get_by_index_rcu(net, iif);
L
Linus Torvalds 已提交
4583
		if (!dev) {
4584
			rcu_read_unlock();
L
Linus Torvalds 已提交
4585
			err = -ENODEV;
4586
			goto errout;
L
Linus Torvalds 已提交
4587
		}
4588 4589 4590 4591 4592 4593

		fl6.flowi6_iif = iif;

		if (!ipv6_addr_any(&fl6.saddr))
			flags |= RT6_LOOKUP_F_HAS_SADDR;

4594
		dst = ip6_route_input_lookup(net, dev, &fl6, flags);
4595 4596

		rcu_read_unlock();
4597 4598 4599
	} else {
		fl6.flowi6_oif = oif;

4600
		dst = ip6_route_output(net, NULL, &fl6);
4601 4602 4603 4604 4605 4606 4607 4608
	}


	rt = container_of(dst, struct rt6_info, dst);
	if (rt->dst.error) {
		err = rt->dst.error;
		ip6_rt_put(rt);
		goto errout;
L
Linus Torvalds 已提交
4609 4610
	}

4611 4612 4613 4614 4615 4616
	if (rt == net->ipv6.ip6_null_entry) {
		err = rt->dst.error;
		ip6_rt_put(rt);
		goto errout;
	}

4617 4618
	if (fibmatch && rt->from) {
		struct rt6_info *ort = rt->from;
4619 4620 4621 4622 4623 4624

		dst_hold(&ort->dst);
		ip6_rt_put(rt);
		rt = ort;
	}

4625
	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
4626
	if (!skb) {
A
Amerigo Wang 已提交
4627
		ip6_rt_put(rt);
4628 4629 4630
		err = -ENOBUFS;
		goto errout;
	}
L
Linus Torvalds 已提交
4631

4632
	skb_dst_set(skb, &rt->dst);
4633 4634 4635 4636 4637 4638 4639 4640
	if (fibmatch)
		err = rt6_fill_node(net, skb, rt, NULL, NULL, iif,
				    RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
				    nlh->nlmsg_seq, 0);
	else
		err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
				    RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
				    nlh->nlmsg_seq, 0);
L
Linus Torvalds 已提交
4641
	if (err < 0) {
4642 4643
		kfree_skb(skb);
		goto errout;
L
Linus Torvalds 已提交
4644 4645
	}

4646
	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
4647
errout:
L
Linus Torvalds 已提交
4648 4649 4650
	return err;
}

4651 4652
void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info,
		     unsigned int nlm_flags)
L
Linus Torvalds 已提交
4653 4654
{
	struct sk_buff *skb;
4655
	struct net *net = info->nl_net;
4656 4657 4658 4659
	u32 seq;
	int err;

	err = -ENOBUFS;
4660
	seq = info->nlh ? info->nlh->nlmsg_seq : 0;
4661

4662
	skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any());
4663
	if (!skb)
4664 4665
		goto errout;

4666
	err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
4667
				event, info->portid, seq, nlm_flags);
4668 4669 4670 4671 4672 4673
	if (err < 0) {
		/* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
		WARN_ON(err == -EMSGSIZE);
		kfree_skb(skb);
		goto errout;
	}
4674
	rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
4675 4676
		    info->nlh, gfp_any());
	return;
4677 4678
errout:
	if (err < 0)
4679
		rtnl_set_sk_err(net, RTNLGRP_IPV6_ROUTE, err);
L
Linus Torvalds 已提交
4680 4681
}

4682
static int ip6_route_dev_notify(struct notifier_block *this,
4683
				unsigned long event, void *ptr)
4684
{
4685
	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
4686
	struct net *net = dev_net(dev);
4687

4688 4689 4690 4691
	if (!(dev->flags & IFF_LOOPBACK))
		return NOTIFY_OK;

	if (event == NETDEV_REGISTER) {
4692
		net->ipv6.ip6_null_entry->dst.dev = dev;
4693 4694
		net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
4695
		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
4696
		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
4697
		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
4698
		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
4699
#endif
4700 4701 4702 4703 4704
	 } else if (event == NETDEV_UNREGISTER &&
		    dev->reg_state != NETREG_UNREGISTERED) {
		/* NETDEV_UNREGISTER could be fired for multiple times by
		 * netdev_wait_allrefs(). Make sure we only call this once.
		 */
4705
		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
4706
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
4707 4708
		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
4709 4710 4711 4712 4713 4714
#endif
	}

	return NOTIFY_OK;
}

L
Linus Torvalds 已提交
4715 4716 4717 4718 4719 4720
/*
 *	/proc
 */

#ifdef CONFIG_PROC_FS

4721 4722 4723 4724
static const struct file_operations ipv6_route_proc_fops = {
	.open		= ipv6_route_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
4725
	.release	= seq_release_net,
4726 4727
};

L
Linus Torvalds 已提交
4728 4729
static int rt6_stats_seq_show(struct seq_file *seq, void *v)
{
4730
	struct net *net = (struct net *)seq->private;
L
Linus Torvalds 已提交
4731
	seq_printf(seq, "%04x %04x %04x %04x %04x %04x %04x\n",
4732 4733
		   net->ipv6.rt6_stats->fib_nodes,
		   net->ipv6.rt6_stats->fib_route_nodes,
W
Wei Wang 已提交
4734
		   atomic_read(&net->ipv6.rt6_stats->fib_rt_alloc),
4735 4736
		   net->ipv6.rt6_stats->fib_rt_entries,
		   net->ipv6.rt6_stats->fib_rt_cache,
4737
		   dst_entries_get_slow(&net->ipv6.ip6_dst_ops),
4738
		   net->ipv6.rt6_stats->fib_discarded_routes);
L
Linus Torvalds 已提交
4739 4740 4741 4742 4743 4744

	return 0;
}

static int rt6_stats_seq_open(struct inode *inode, struct file *file)
{
4745
	return single_open_net(inode, file, rt6_stats_seq_show);
4746 4747
}

4748
static const struct file_operations rt6_stats_seq_fops = {
L
Linus Torvalds 已提交
4749 4750 4751
	.open	 = rt6_stats_seq_open,
	.read	 = seq_read,
	.llseek	 = seq_lseek,
4752
	.release = single_release_net,
L
Linus Torvalds 已提交
4753 4754 4755 4756 4757 4758
};
#endif	/* CONFIG_PROC_FS */

#ifdef CONFIG_SYSCTL

static
4759
int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
L
Linus Torvalds 已提交
4760 4761
			      void __user *buffer, size_t *lenp, loff_t *ppos)
{
4762 4763 4764
	struct net *net;
	int delay;
	if (!write)
L
Linus Torvalds 已提交
4765
		return -EINVAL;
4766 4767 4768 4769

	net = (struct net *)ctl->extra1;
	delay = net->ipv6.sysctl.flush_delay;
	proc_dointvec(ctl, write, buffer, lenp, ppos);
4770
	fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
4771
	return 0;
L
Linus Torvalds 已提交
4772 4773
}

4774
struct ctl_table ipv6_route_table_template[] = {
4775
	{
L
Linus Torvalds 已提交
4776
		.procname	=	"flush",
4777
		.data		=	&init_net.ipv6.sysctl.flush_delay,
L
Linus Torvalds 已提交
4778
		.maxlen		=	sizeof(int),
4779
		.mode		=	0200,
A
Alexey Dobriyan 已提交
4780
		.proc_handler	=	ipv6_sysctl_rtcache_flush
L
Linus Torvalds 已提交
4781 4782 4783
	},
	{
		.procname	=	"gc_thresh",
4784
		.data		=	&ip6_dst_ops_template.gc_thresh,
L
Linus Torvalds 已提交
4785 4786
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
4787
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
4788 4789 4790
	},
	{
		.procname	=	"max_size",
4791
		.data		=	&init_net.ipv6.sysctl.ip6_rt_max_size,
L
Linus Torvalds 已提交
4792 4793
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
4794
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
4795 4796 4797
	},
	{
		.procname	=	"gc_min_interval",
4798
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
L
Linus Torvalds 已提交
4799 4800
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
4801
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
4802 4803 4804
	},
	{
		.procname	=	"gc_timeout",
4805
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_timeout,
L
Linus Torvalds 已提交
4806 4807
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
4808
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
4809 4810 4811
	},
	{
		.procname	=	"gc_interval",
4812
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_interval,
L
Linus Torvalds 已提交
4813 4814
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
4815
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
4816 4817 4818
	},
	{
		.procname	=	"gc_elasticity",
4819
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_elasticity,
L
Linus Torvalds 已提交
4820 4821
		.maxlen		=	sizeof(int),
		.mode		=	0644,
4822
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
4823 4824 4825
	},
	{
		.procname	=	"mtu_expires",
4826
		.data		=	&init_net.ipv6.sysctl.ip6_rt_mtu_expires,
L
Linus Torvalds 已提交
4827 4828
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
4829
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
4830 4831 4832
	},
	{
		.procname	=	"min_adv_mss",
4833
		.data		=	&init_net.ipv6.sysctl.ip6_rt_min_advmss,
L
Linus Torvalds 已提交
4834 4835
		.maxlen		=	sizeof(int),
		.mode		=	0644,
4836
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
4837 4838 4839
	},
	{
		.procname	=	"gc_min_interval_ms",
4840
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
L
Linus Torvalds 已提交
4841 4842
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
4843
		.proc_handler	=	proc_dointvec_ms_jiffies,
L
Linus Torvalds 已提交
4844
	},
4845
	{ }
L
Linus Torvalds 已提交
4846 4847
};

4848
struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
4849 4850 4851 4852 4853 4854
{
	struct ctl_table *table;

	table = kmemdup(ipv6_route_table_template,
			sizeof(ipv6_route_table_template),
			GFP_KERNEL);
4855 4856 4857

	if (table) {
		table[0].data = &net->ipv6.sysctl.flush_delay;
4858
		table[0].extra1 = net;
4859
		table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
4860 4861 4862 4863 4864 4865 4866
		table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
		table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
		table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;
		table[5].data = &net->ipv6.sysctl.ip6_rt_gc_interval;
		table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
		table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
		table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
4867
		table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
4868 4869 4870 4871

		/* Don't export sysctls to unprivileged users */
		if (net->user_ns != &init_user_ns)
			table[0].procname = NULL;
4872 4873
	}

4874 4875
	return table;
}
L
Linus Torvalds 已提交
4876 4877
#endif

4878
static int __net_init ip6_route_net_init(struct net *net)
4879
{
4880
	int ret = -ENOMEM;
4881

4882 4883
	memcpy(&net->ipv6.ip6_dst_ops, &ip6_dst_ops_template,
	       sizeof(net->ipv6.ip6_dst_ops));
4884

4885 4886 4887
	if (dst_entries_init(&net->ipv6.ip6_dst_ops) < 0)
		goto out_ip6_dst_ops;

4888 4889 4890 4891
	net->ipv6.ip6_null_entry = kmemdup(&ip6_null_entry_template,
					   sizeof(*net->ipv6.ip6_null_entry),
					   GFP_KERNEL);
	if (!net->ipv6.ip6_null_entry)
4892
		goto out_ip6_dst_entries;
4893
	net->ipv6.ip6_null_entry->dst.ops = &net->ipv6.ip6_dst_ops;
4894 4895
	dst_init_metrics(&net->ipv6.ip6_null_entry->dst,
			 ip6_template_metrics, true);
4896 4897

#ifdef CONFIG_IPV6_MULTIPLE_TABLES
4898
	net->ipv6.fib6_has_custom_rules = false;
4899 4900 4901
	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
					       sizeof(*net->ipv6.ip6_prohibit_entry),
					       GFP_KERNEL);
4902 4903
	if (!net->ipv6.ip6_prohibit_entry)
		goto out_ip6_null_entry;
4904
	net->ipv6.ip6_prohibit_entry->dst.ops = &net->ipv6.ip6_dst_ops;
4905 4906
	dst_init_metrics(&net->ipv6.ip6_prohibit_entry->dst,
			 ip6_template_metrics, true);
4907 4908 4909 4910

	net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
					       sizeof(*net->ipv6.ip6_blk_hole_entry),
					       GFP_KERNEL);
4911 4912
	if (!net->ipv6.ip6_blk_hole_entry)
		goto out_ip6_prohibit_entry;
4913
	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
4914 4915
	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
			 ip6_template_metrics, true);
4916 4917
#endif

4918 4919 4920 4921 4922 4923 4924 4925 4926
	net->ipv6.sysctl.flush_delay = 0;
	net->ipv6.sysctl.ip6_rt_max_size = 4096;
	net->ipv6.sysctl.ip6_rt_gc_min_interval = HZ / 2;
	net->ipv6.sysctl.ip6_rt_gc_timeout = 60*HZ;
	net->ipv6.sysctl.ip6_rt_gc_interval = 30*HZ;
	net->ipv6.sysctl.ip6_rt_gc_elasticity = 9;
	net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
	net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;

4927 4928
	net->ipv6.ip6_rt_gc_expire = 30*HZ;

4929 4930 4931
	ret = 0;
out:
	return ret;
4932

4933 4934 4935 4936 4937 4938
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
out_ip6_prohibit_entry:
	kfree(net->ipv6.ip6_prohibit_entry);
out_ip6_null_entry:
	kfree(net->ipv6.ip6_null_entry);
#endif
4939 4940
out_ip6_dst_entries:
	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
4941 4942
out_ip6_dst_ops:
	goto out;
4943 4944
}

4945
static void __net_exit ip6_route_net_exit(struct net *net)
4946
{
4947 4948 4949 4950 4951
	kfree(net->ipv6.ip6_null_entry);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
	kfree(net->ipv6.ip6_prohibit_entry);
	kfree(net->ipv6.ip6_blk_hole_entry);
#endif
4952
	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
4953 4954
}

4955 4956 4957
static int __net_init ip6_route_net_init_late(struct net *net)
{
#ifdef CONFIG_PROC_FS
4958 4959
	proc_create("ipv6_route", 0, net->proc_net, &ipv6_route_proc_fops);
	proc_create("rt6_stats", S_IRUGO, net->proc_net, &rt6_stats_seq_fops);
4960 4961 4962 4963 4964 4965 4966
#endif
	return 0;
}

static void __net_exit ip6_route_net_exit_late(struct net *net)
{
#ifdef CONFIG_PROC_FS
4967 4968
	remove_proc_entry("ipv6_route", net->proc_net);
	remove_proc_entry("rt6_stats", net->proc_net);
4969 4970 4971
#endif
}

4972 4973 4974
static struct pernet_operations ip6_route_net_ops = {
	.init = ip6_route_net_init,
	.exit = ip6_route_net_exit,
4975
	.async = true,
4976 4977
};

4978 4979 4980 4981 4982 4983 4984 4985 4986 4987 4988 4989 4990 4991 4992 4993
static int __net_init ipv6_inetpeer_init(struct net *net)
{
	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);

	if (!bp)
		return -ENOMEM;
	inet_peer_base_init(bp);
	net->ipv6.peers = bp;
	return 0;
}

static void __net_exit ipv6_inetpeer_exit(struct net *net)
{
	struct inet_peer_base *bp = net->ipv6.peers;

	net->ipv6.peers = NULL;
4994
	inetpeer_invalidate_tree(bp);
4995 4996 4997
	kfree(bp);
}

4998
static struct pernet_operations ipv6_inetpeer_ops = {
4999 5000
	.init	=	ipv6_inetpeer_init,
	.exit	=	ipv6_inetpeer_exit,
K
Kirill Tkhai 已提交
5001
	.async	=	true,
5002 5003
};

5004 5005 5006
static struct pernet_operations ip6_route_net_late_ops = {
	.init = ip6_route_net_init_late,
	.exit = ip6_route_net_exit_late,
5007
	.async = true,
5008 5009
};

5010 5011
static struct notifier_block ip6_route_dev_notifier = {
	.notifier_call = ip6_route_dev_notify,
5012
	.priority = ADDRCONF_NOTIFY_PRIORITY - 10,
5013 5014
};

5015 5016 5017 5018 5019 5020 5021 5022 5023 5024 5025 5026 5027 5028 5029
void __init ip6_route_init_special_entries(void)
{
	/* Registering of the loopback is done before this portion of code,
	 * the loopback reference in rt6_info will not be taken, do it
	 * manually for init_net */
	init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
	init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
	init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  #endif
}

5030
int __init ip6_route_init(void)
L
Linus Torvalds 已提交
5031
{
5032
	int ret;
5033
	int cpu;
5034

5035 5036
	ret = -ENOMEM;
	ip6_dst_ops_template.kmem_cachep =
A
Alexey Dobriyan 已提交
5037
		kmem_cache_create("ip6_dst_cache", sizeof(struct rt6_info), 0,
5038
				  SLAB_HWCACHE_ALIGN, NULL);
5039
	if (!ip6_dst_ops_template.kmem_cachep)
5040
		goto out;
5041

5042
	ret = dst_entries_init(&ip6_dst_blackhole_ops);
5043
	if (ret)
5044 5045
		goto out_kmem_cache;

5046 5047
	ret = register_pernet_subsys(&ipv6_inetpeer_ops);
	if (ret)
5048
		goto out_dst_entries;
5049

5050 5051 5052
	ret = register_pernet_subsys(&ip6_route_net_ops);
	if (ret)
		goto out_register_inetpeer;
5053

5054 5055
	ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;

5056
	ret = fib6_init();
5057
	if (ret)
5058
		goto out_register_subsys;
5059 5060 5061

	ret = xfrm6_init();
	if (ret)
5062
		goto out_fib6_init;
5063

5064 5065 5066
	ret = fib6_rules_init();
	if (ret)
		goto xfrm6_init;
5067

5068 5069 5070 5071
	ret = register_pernet_subsys(&ip6_route_net_late_ops);
	if (ret)
		goto fib6_rules_init;

5072 5073 5074 5075 5076 5077 5078 5079 5080 5081 5082 5083 5084 5085
	ret = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_NEWROUTE,
				   inet6_rtm_newroute, NULL, 0);
	if (ret < 0)
		goto out_register_late_subsys;

	ret = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_DELROUTE,
				   inet6_rtm_delroute, NULL, 0);
	if (ret < 0)
		goto out_register_late_subsys;

	ret = rtnl_register_module(THIS_MODULE, PF_INET6, RTM_GETROUTE,
				   inet6_rtm_getroute, NULL,
				   RTNL_FLAG_DOIT_UNLOCKED);
	if (ret < 0)
5086
		goto out_register_late_subsys;
5087

5088
	ret = register_netdevice_notifier(&ip6_route_dev_notifier);
5089
	if (ret)
5090
		goto out_register_late_subsys;
5091

5092 5093 5094 5095 5096 5097 5098
	for_each_possible_cpu(cpu) {
		struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);

		INIT_LIST_HEAD(&ul->head);
		spin_lock_init(&ul->lock);
	}

5099 5100 5101
out:
	return ret;

5102
out_register_late_subsys:
5103
	rtnl_unregister_all(PF_INET6);
5104
	unregister_pernet_subsys(&ip6_route_net_late_ops);
5105 5106 5107 5108
fib6_rules_init:
	fib6_rules_cleanup();
xfrm6_init:
	xfrm6_fini();
5109 5110
out_fib6_init:
	fib6_gc_cleanup();
5111 5112
out_register_subsys:
	unregister_pernet_subsys(&ip6_route_net_ops);
5113 5114
out_register_inetpeer:
	unregister_pernet_subsys(&ipv6_inetpeer_ops);
5115 5116
out_dst_entries:
	dst_entries_destroy(&ip6_dst_blackhole_ops);
5117
out_kmem_cache:
5118
	kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
5119
	goto out;
L
Linus Torvalds 已提交
5120 5121 5122 5123
}

void ip6_route_cleanup(void)
{
5124
	unregister_netdevice_notifier(&ip6_route_dev_notifier);
5125
	unregister_pernet_subsys(&ip6_route_net_late_ops);
T
Thomas Graf 已提交
5126
	fib6_rules_cleanup();
L
Linus Torvalds 已提交
5127 5128
	xfrm6_fini();
	fib6_gc_cleanup();
5129
	unregister_pernet_subsys(&ipv6_inetpeer_ops);
5130
	unregister_pernet_subsys(&ip6_route_net_ops);
5131
	dst_entries_destroy(&ip6_dst_blackhole_ops);
5132
	kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
L
Linus Torvalds 已提交
5133
}