route.c 99.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5
/*
 *	Linux INET6 implementation
 *	FIB front-end.
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

/*	Changes:
 *
 *	YOSHIFUJI Hideaki @USAGI
 *		reworked default router selection.
 *		- respect outgoing interface
 *		- select from (probably) reachable routers (i.e.
 *		routers in REACHABLE, STALE, DELAY or PROBE states).
 *		- always select the same router if it is (probably)
 *		reachable.  otherwise, round-robin the list.
23 24
 *	Ville Nuorvala
 *		Fixed routing subtrees.
L
Linus Torvalds 已提交
25 26
 */

27 28
#define pr_fmt(fmt) "IPv6: " fmt

29
#include <linux/capability.h>
L
Linus Torvalds 已提交
30
#include <linux/errno.h>
31
#include <linux/export.h>
L
Linus Torvalds 已提交
32 33 34 35 36 37 38 39
#include <linux/types.h>
#include <linux/times.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/route.h>
#include <linux/netdevice.h>
#include <linux/in6.h>
40
#include <linux/mroute6.h>
L
Linus Torvalds 已提交
41 42 43 44
#include <linux/init.h>
#include <linux/if_arp.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
45
#include <linux/nsproxy.h>
46
#include <linux/slab.h>
47
#include <net/net_namespace.h>
L
Linus Torvalds 已提交
48 49 50 51 52 53 54 55 56
#include <net/snmp.h>
#include <net/ipv6.h>
#include <net/ip6_fib.h>
#include <net/ip6_route.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
#include <net/tcp.h>
#include <linux/rtnetlink.h>
#include <net/dst.h>
57
#include <net/dst_metadata.h>
L
Linus Torvalds 已提交
58
#include <net/xfrm.h>
59
#include <net/netevent.h>
60
#include <net/netlink.h>
61
#include <net/nexthop.h>
62
#include <net/lwtunnel.h>
63
#include <net/ip_tunnels.h>
D
David Ahern 已提交
64
#include <net/l3mdev.h>
D
David Ahern 已提交
65
#include <trace/events/fib6.h>
L
Linus Torvalds 已提交
66

67
#include <linux/uaccess.h>
L
Linus Torvalds 已提交
68 69 70 71 72

#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
#endif

73
enum rt6_nud_state {
J
Jiri Benc 已提交
74 75 76
	RT6_NUD_FAIL_HARD = -3,
	RT6_NUD_FAIL_PROBE = -2,
	RT6_NUD_FAIL_DO_RR = -1,
77 78 79
	RT6_NUD_SUCCEED = 1
};

M
Martin KaFai Lau 已提交
80
static void ip6_rt_copy_init(struct rt6_info *rt, struct rt6_info *ort);
L
Linus Torvalds 已提交
81
static struct dst_entry	*ip6_dst_check(struct dst_entry *dst, u32 cookie);
82
static unsigned int	 ip6_default_advmss(const struct dst_entry *dst);
83
static unsigned int	 ip6_mtu(const struct dst_entry *dst);
L
Linus Torvalds 已提交
84 85 86 87
static struct dst_entry *ip6_negative_advice(struct dst_entry *);
static void		ip6_dst_destroy(struct dst_entry *);
static void		ip6_dst_ifdown(struct dst_entry *,
				       struct net_device *dev, int how);
88
static int		 ip6_dst_gc(struct dst_ops *ops);
L
Linus Torvalds 已提交
89 90

static int		ip6_pkt_discard(struct sk_buff *skb);
E
Eric W. Biederman 已提交
91
static int		ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
92
static int		ip6_pkt_prohibit(struct sk_buff *skb);
E
Eric W. Biederman 已提交
93
static int		ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
L
Linus Torvalds 已提交
94
static void		ip6_link_failure(struct sk_buff *skb);
95 96 97 98
static void		ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
					   struct sk_buff *skb, u32 mtu);
static void		rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
					struct sk_buff *skb);
99
static void		rt6_dst_from_metrics_check(struct rt6_info *rt);
100
static int rt6_score_route(struct rt6_info *rt, int oif, int strict);
101 102 103 104 105 106
static size_t rt6_nlmsg_size(struct rt6_info *rt);
static int rt6_fill_node(struct net *net,
			 struct sk_buff *skb, struct rt6_info *rt,
			 struct in6_addr *dst, struct in6_addr *src,
			 int iif, int type, u32 portid, u32 seq,
			 unsigned int flags);
L
Linus Torvalds 已提交
107

108
#ifdef CONFIG_IPV6_ROUTE_INFO
109
static struct rt6_info *rt6_add_route_info(struct net *net,
110
					   const struct in6_addr *prefix, int prefixlen,
111 112
					   const struct in6_addr *gwaddr,
					   struct net_device *dev,
113
					   unsigned int pref);
114
static struct rt6_info *rt6_get_route_info(struct net *net,
115
					   const struct in6_addr *prefix, int prefixlen,
116 117
					   const struct in6_addr *gwaddr,
					   struct net_device *dev);
118 119
#endif

120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154
struct uncached_list {
	spinlock_t		lock;
	struct list_head	head;
};

static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt6_uncached_list);

static void rt6_uncached_list_add(struct rt6_info *rt)
{
	struct uncached_list *ul = raw_cpu_ptr(&rt6_uncached_list);

	rt->dst.flags |= DST_NOCACHE;
	rt->rt6i_uncached_list = ul;

	spin_lock_bh(&ul->lock);
	list_add_tail(&rt->rt6i_uncached, &ul->head);
	spin_unlock_bh(&ul->lock);
}

static void rt6_uncached_list_del(struct rt6_info *rt)
{
	if (!list_empty(&rt->rt6i_uncached)) {
		struct uncached_list *ul = rt->rt6i_uncached_list;

		spin_lock_bh(&ul->lock);
		list_del(&rt->rt6i_uncached);
		spin_unlock_bh(&ul->lock);
	}
}

static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev)
{
	struct net_device *loopback_dev = net->loopback_dev;
	int cpu;

155 156 157
	if (dev == loopback_dev)
		return;

158 159 160 161 162 163 164 165 166
	for_each_possible_cpu(cpu) {
		struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);
		struct rt6_info *rt;

		spin_lock_bh(&ul->lock);
		list_for_each_entry(rt, &ul->head, rt6i_uncached) {
			struct inet6_dev *rt_idev = rt->rt6i_idev;
			struct net_device *rt_dev = rt->dst.dev;

167
			if (rt_idev->dev == dev) {
168 169 170 171
				rt->rt6i_idev = in6_dev_get(loopback_dev);
				in6_dev_put(rt_idev);
			}

172
			if (rt_dev == dev) {
173 174 175 176 177 178 179 180 181
				rt->dst.dev = loopback_dev;
				dev_hold(rt->dst.dev);
				dev_put(rt_dev);
			}
		}
		spin_unlock_bh(&ul->lock);
	}
}

M
Martin KaFai Lau 已提交
182 183 184 185 186
static u32 *rt6_pcpu_cow_metrics(struct rt6_info *rt)
{
	return dst_metrics_write_ptr(rt->dst.from);
}

187 188
static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
{
189
	struct rt6_info *rt = (struct rt6_info *)dst;
190

M
Martin KaFai Lau 已提交
191 192 193
	if (rt->rt6i_flags & RTF_PCPU)
		return rt6_pcpu_cow_metrics(rt);
	else if (rt->rt6i_flags & RTF_CACHE)
194 195
		return NULL;
	else
196
		return dst_cow_metrics_generic(dst, old);
197 198
}

199 200 201
static inline const void *choose_neigh_daddr(struct rt6_info *rt,
					     struct sk_buff *skb,
					     const void *daddr)
202 203 204
{
	struct in6_addr *p = &rt->rt6i_gateway;

D
David S. Miller 已提交
205
	if (!ipv6_addr_any(p))
206
		return (const void *) p;
207 208
	else if (skb)
		return &ipv6_hdr(skb)->daddr;
209 210 211
	return daddr;
}

212 213 214
static struct neighbour *ip6_neigh_lookup(const struct dst_entry *dst,
					  struct sk_buff *skb,
					  const void *daddr)
215
{
216 217 218
	struct rt6_info *rt = (struct rt6_info *) dst;
	struct neighbour *n;

219
	daddr = choose_neigh_daddr(rt, skb, daddr);
220
	n = __ipv6_neigh_lookup(dst->dev, daddr);
221 222 223 224 225
	if (n)
		return n;
	return neigh_create(&nd_tbl, daddr, dst->dev);
}

226 227 228 229 230 231 232 233 234 235 236 237 238 239 240
static void ip6_confirm_neigh(const struct dst_entry *dst, const void *daddr)
{
	struct net_device *dev = dst->dev;
	struct rt6_info *rt = (struct rt6_info *)dst;

	daddr = choose_neigh_daddr(rt, NULL, daddr);
	if (!daddr)
		return;
	if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
		return;
	if (ipv6_addr_is_multicast((const struct in6_addr *)daddr))
		return;
	__ipv6_confirm_neigh(dev, daddr);
}

241
static struct dst_ops ip6_dst_ops_template = {
L
Linus Torvalds 已提交
242 243 244 245
	.family			=	AF_INET6,
	.gc			=	ip6_dst_gc,
	.gc_thresh		=	1024,
	.check			=	ip6_dst_check,
246
	.default_advmss		=	ip6_default_advmss,
247
	.mtu			=	ip6_mtu,
248
	.cow_metrics		=	ipv6_cow_metrics,
L
Linus Torvalds 已提交
249 250 251 252 253
	.destroy		=	ip6_dst_destroy,
	.ifdown			=	ip6_dst_ifdown,
	.negative_advice	=	ip6_negative_advice,
	.link_failure		=	ip6_link_failure,
	.update_pmtu		=	ip6_rt_update_pmtu,
254
	.redirect		=	rt6_do_redirect,
255
	.local_out		=	__ip6_local_out,
256
	.neigh_lookup		=	ip6_neigh_lookup,
257
	.confirm_neigh		=	ip6_confirm_neigh,
L
Linus Torvalds 已提交
258 259
};

260
static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
261
{
262 263 264
	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);

	return mtu ? : dst->dev->mtu;
265 266
}

267 268
static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
					 struct sk_buff *skb, u32 mtu)
269 270 271
{
}

272 273
static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
				      struct sk_buff *skb)
274 275 276
{
}

277 278 279 280
static struct dst_ops ip6_dst_blackhole_ops = {
	.family			=	AF_INET6,
	.destroy		=	ip6_dst_destroy,
	.check			=	ip6_dst_check,
281
	.mtu			=	ip6_blackhole_mtu,
282
	.default_advmss		=	ip6_default_advmss,
283
	.update_pmtu		=	ip6_rt_blackhole_update_pmtu,
284
	.redirect		=	ip6_rt_blackhole_redirect,
285
	.cow_metrics		=	dst_cow_metrics_generic,
286
	.neigh_lookup		=	ip6_neigh_lookup,
287 288
};

289
static const u32 ip6_template_metrics[RTAX_MAX] = {
L
Li RongQing 已提交
290
	[RTAX_HOPLIMIT - 1] = 0,
291 292
};

293
static const struct rt6_info ip6_null_entry_template = {
294 295 296
	.dst = {
		.__refcnt	= ATOMIC_INIT(1),
		.__use		= 1,
297
		.obsolete	= DST_OBSOLETE_FORCE_CHK,
298 299 300
		.error		= -ENETUNREACH,
		.input		= ip6_pkt_discard,
		.output		= ip6_pkt_discard_out,
L
Linus Torvalds 已提交
301 302
	},
	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
303
	.rt6i_protocol  = RTPROT_KERNEL,
L
Linus Torvalds 已提交
304 305 306 307
	.rt6i_metric	= ~(u32) 0,
	.rt6i_ref	= ATOMIC_INIT(1),
};

T
Thomas Graf 已提交
308 309
#ifdef CONFIG_IPV6_MULTIPLE_TABLES

310
static const struct rt6_info ip6_prohibit_entry_template = {
311 312 313
	.dst = {
		.__refcnt	= ATOMIC_INIT(1),
		.__use		= 1,
314
		.obsolete	= DST_OBSOLETE_FORCE_CHK,
315 316 317
		.error		= -EACCES,
		.input		= ip6_pkt_prohibit,
		.output		= ip6_pkt_prohibit_out,
T
Thomas Graf 已提交
318 319
	},
	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
320
	.rt6i_protocol  = RTPROT_KERNEL,
T
Thomas Graf 已提交
321 322 323 324
	.rt6i_metric	= ~(u32) 0,
	.rt6i_ref	= ATOMIC_INIT(1),
};

325
static const struct rt6_info ip6_blk_hole_entry_template = {
326 327 328
	.dst = {
		.__refcnt	= ATOMIC_INIT(1),
		.__use		= 1,
329
		.obsolete	= DST_OBSOLETE_FORCE_CHK,
330 331
		.error		= -EINVAL,
		.input		= dst_discard,
E
Eric W. Biederman 已提交
332
		.output		= dst_discard_out,
T
Thomas Graf 已提交
333 334
	},
	.rt6i_flags	= (RTF_REJECT | RTF_NONEXTHOP),
335
	.rt6i_protocol  = RTPROT_KERNEL,
T
Thomas Graf 已提交
336 337 338 339 340 341
	.rt6i_metric	= ~(u32) 0,
	.rt6i_ref	= ATOMIC_INIT(1),
};

#endif

342 343 344 345 346 347 348 349 350
static void rt6_info_init(struct rt6_info *rt)
{
	struct dst_entry *dst = &rt->dst;

	memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
	INIT_LIST_HEAD(&rt->rt6i_siblings);
	INIT_LIST_HEAD(&rt->rt6i_uncached);
}

L
Linus Torvalds 已提交
351
/* allocate dst with ip6_dst_ops */
M
Martin KaFai Lau 已提交
352 353
static struct rt6_info *__ip6_dst_alloc(struct net *net,
					struct net_device *dev,
354
					int flags)
L
Linus Torvalds 已提交
355
{
356
	struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
357
					0, DST_OBSOLETE_FORCE_CHK, flags);
358

359 360
	if (rt)
		rt6_info_init(rt);
361

362
	return rt;
L
Linus Torvalds 已提交
363 364
}

365 366 367
struct rt6_info *ip6_dst_alloc(struct net *net,
			       struct net_device *dev,
			       int flags)
M
Martin KaFai Lau 已提交
368
{
369
	struct rt6_info *rt = __ip6_dst_alloc(net, dev, flags);
M
Martin KaFai Lau 已提交
370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390

	if (rt) {
		rt->rt6i_pcpu = alloc_percpu_gfp(struct rt6_info *, GFP_ATOMIC);
		if (rt->rt6i_pcpu) {
			int cpu;

			for_each_possible_cpu(cpu) {
				struct rt6_info **p;

				p = per_cpu_ptr(rt->rt6i_pcpu, cpu);
				/* no one shares rt */
				*p =  NULL;
			}
		} else {
			dst_destroy((struct dst_entry *)rt);
			return NULL;
		}
	}

	return rt;
}
391
EXPORT_SYMBOL(ip6_dst_alloc);
M
Martin KaFai Lau 已提交
392

L
Linus Torvalds 已提交
393 394 395
static void ip6_dst_destroy(struct dst_entry *dst)
{
	struct rt6_info *rt = (struct rt6_info *)dst;
396
	struct dst_entry *from = dst->from;
397
	struct inet6_dev *idev;
L
Linus Torvalds 已提交
398

399
	dst_destroy_metrics_generic(dst);
400
	free_percpu(rt->rt6i_pcpu);
401 402 403
	rt6_uncached_list_del(rt);

	idev = rt->rt6i_idev;
404
	if (idev) {
L
Linus Torvalds 已提交
405 406
		rt->rt6i_idev = NULL;
		in6_dev_put(idev);
407
	}
408

409 410
	dst->from = NULL;
	dst_release(from);
411 412
}

L
Linus Torvalds 已提交
413 414 415 416 417
static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
			   int how)
{
	struct rt6_info *rt = (struct rt6_info *)dst;
	struct inet6_dev *idev = rt->rt6i_idev;
418
	struct net_device *loopback_dev =
419
		dev_net(dev)->loopback_dev;
L
Linus Torvalds 已提交
420

421 422 423 424 425 426 427 428 429
	if (dev != loopback_dev) {
		if (idev && idev->dev == dev) {
			struct inet6_dev *loopback_idev =
				in6_dev_get(loopback_dev);
			if (loopback_idev) {
				rt->rt6i_idev = loopback_idev;
				in6_dev_put(idev);
			}
		}
L
Linus Torvalds 已提交
430 431 432
	}
}

433 434 435 436 437 438 439 440
static bool __rt6_check_expired(const struct rt6_info *rt)
{
	if (rt->rt6i_flags & RTF_EXPIRES)
		return time_after(jiffies, rt->dst.expires);
	else
		return false;
}

441
static bool rt6_check_expired(const struct rt6_info *rt)
L
Linus Torvalds 已提交
442
{
443 444
	if (rt->rt6i_flags & RTF_EXPIRES) {
		if (time_after(jiffies, rt->dst.expires))
445
			return true;
446
	} else if (rt->dst.from) {
447
		return rt6_check_expired((struct rt6_info *) rt->dst.from);
448
	}
449
	return false;
L
Linus Torvalds 已提交
450 451
}

452 453 454 455 456 457 458
/* Multipath route selection:
 *   Hash based function using packet header and flowlabel.
 * Adapted from fib_info_hashfn()
 */
static int rt6_info_hash_nhsfn(unsigned int candidate_count,
			       const struct flowi6 *fl6)
{
459
	return get_hash_from_flowi6(fl6) % candidate_count;
460 461 462
}

static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
463 464
					     struct flowi6 *fl6, int oif,
					     int strict)
465 466 467 468 469 470 471 472 473 474 475 476 477
{
	struct rt6_info *sibling, *next_sibling;
	int route_choosen;

	route_choosen = rt6_info_hash_nhsfn(match->rt6i_nsiblings + 1, fl6);
	/* Don't change the route, if route_choosen == 0
	 * (siblings does not include ourself)
	 */
	if (route_choosen)
		list_for_each_entry_safe(sibling, next_sibling,
				&match->rt6i_siblings, rt6i_siblings) {
			route_choosen--;
			if (route_choosen == 0) {
478 479
				if (rt6_score_route(sibling, oif, strict) < 0)
					break;
480 481 482 483 484 485 486
				match = sibling;
				break;
			}
		}
	return match;
}

L
Linus Torvalds 已提交
487
/*
T
Thomas Graf 已提交
488
 *	Route lookup. Any table->tb6_lock is implied.
L
Linus Torvalds 已提交
489 490
 */

491 492
static inline struct rt6_info *rt6_device_match(struct net *net,
						    struct rt6_info *rt,
493
						    const struct in6_addr *saddr,
L
Linus Torvalds 已提交
494
						    int oif,
495
						    int flags)
L
Linus Torvalds 已提交
496 497 498 499
{
	struct rt6_info *local = NULL;
	struct rt6_info *sprt;

500 501 502
	if (!oif && ipv6_addr_any(saddr))
		goto out;

503
	for (sprt = rt; sprt; sprt = sprt->dst.rt6_next) {
504
		struct net_device *dev = sprt->dst.dev;
505 506

		if (oif) {
L
Linus Torvalds 已提交
507 508 509
			if (dev->ifindex == oif)
				return sprt;
			if (dev->flags & IFF_LOOPBACK) {
510
				if (!sprt->rt6i_idev ||
L
Linus Torvalds 已提交
511
				    sprt->rt6i_idev->dev->ifindex != oif) {
512
					if (flags & RT6_LOOKUP_F_IFACE)
L
Linus Torvalds 已提交
513
						continue;
514 515
					if (local &&
					    local->rt6i_idev->dev->ifindex == oif)
L
Linus Torvalds 已提交
516 517 518 519
						continue;
				}
				local = sprt;
			}
520 521 522 523
		} else {
			if (ipv6_chk_addr(net, saddr, dev,
					  flags & RT6_LOOKUP_F_IFACE))
				return sprt;
L
Linus Torvalds 已提交
524
		}
525
	}
L
Linus Torvalds 已提交
526

527
	if (oif) {
L
Linus Torvalds 已提交
528 529 530
		if (local)
			return local;

531
		if (flags & RT6_LOOKUP_F_IFACE)
532
			return net->ipv6.ip6_null_entry;
L
Linus Torvalds 已提交
533
	}
534
out:
L
Linus Torvalds 已提交
535 536 537
	return rt;
}

538
#ifdef CONFIG_IPV6_ROUTER_PREF
539 540 541 542 543 544 545 546 547 548 549 550 551
struct __rt6_probe_work {
	struct work_struct work;
	struct in6_addr target;
	struct net_device *dev;
};

static void rt6_probe_deferred(struct work_struct *w)
{
	struct in6_addr mcaddr;
	struct __rt6_probe_work *work =
		container_of(w, struct __rt6_probe_work, work);

	addrconf_addr_solict_mult(&work->target, &mcaddr);
552
	ndisc_send_ns(work->dev, &work->target, &mcaddr, NULL, 0);
553
	dev_put(work->dev);
554
	kfree(work);
555 556
}

557 558
static void rt6_probe(struct rt6_info *rt)
{
559
	struct __rt6_probe_work *work;
560
	struct neighbour *neigh;
561 562 563 564 565 566 567 568
	/*
	 * Okay, this does not seem to be appropriate
	 * for now, however, we need to check if it
	 * is really so; aka Router Reachability Probing.
	 *
	 * Router Reachability Probe MUST be rate-limited
	 * to no more than one per minute.
	 */
569
	if (!rt || !(rt->rt6i_flags & RTF_GATEWAY))
570
		return;
571 572 573
	rcu_read_lock_bh();
	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
	if (neigh) {
574 575 576
		if (neigh->nud_state & NUD_VALID)
			goto out;

577
		work = NULL;
578
		write_lock(&neigh->lock);
579 580 581 582 583 584 585
		if (!(neigh->nud_state & NUD_VALID) &&
		    time_after(jiffies,
			       neigh->updated +
			       rt->rt6i_idev->cnf.rtr_probe_interval)) {
			work = kmalloc(sizeof(*work), GFP_ATOMIC);
			if (work)
				__neigh_set_probe_once(neigh);
586
		}
587
		write_unlock(&neigh->lock);
588 589
	} else {
		work = kmalloc(sizeof(*work), GFP_ATOMIC);
590
	}
591 592 593 594 595 596 597 598 599

	if (work) {
		INIT_WORK(&work->work, rt6_probe_deferred);
		work->target = rt->rt6i_gateway;
		dev_hold(rt->dst.dev);
		work->dev = rt->dst.dev;
		schedule_work(&work->work);
	}

600
out:
601
	rcu_read_unlock_bh();
602 603 604 605 606 607 608
}
#else
static inline void rt6_probe(struct rt6_info *rt)
{
}
#endif

L
Linus Torvalds 已提交
609
/*
610
 * Default Router Selection (RFC 2461 6.3.6)
L
Linus Torvalds 已提交
611
 */
D
Dave Jones 已提交
612
static inline int rt6_check_dev(struct rt6_info *rt, int oif)
613
{
614
	struct net_device *dev = rt->dst.dev;
615
	if (!oif || dev->ifindex == oif)
616
		return 2;
617 618 619 620
	if ((dev->flags & IFF_LOOPBACK) &&
	    rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
		return 1;
	return 0;
621
}
L
Linus Torvalds 已提交
622

623
static inline enum rt6_nud_state rt6_check_neigh(struct rt6_info *rt)
L
Linus Torvalds 已提交
624
{
625
	struct neighbour *neigh;
626
	enum rt6_nud_state ret = RT6_NUD_FAIL_HARD;
627

628 629
	if (rt->rt6i_flags & RTF_NONEXTHOP ||
	    !(rt->rt6i_flags & RTF_GATEWAY))
630
		return RT6_NUD_SUCCEED;
631 632 633 634 635

	rcu_read_lock_bh();
	neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
	if (neigh) {
		read_lock(&neigh->lock);
636
		if (neigh->nud_state & NUD_VALID)
637
			ret = RT6_NUD_SUCCEED;
638
#ifdef CONFIG_IPV6_ROUTER_PREF
639
		else if (!(neigh->nud_state & NUD_FAILED))
640
			ret = RT6_NUD_SUCCEED;
J
Jiri Benc 已提交
641 642
		else
			ret = RT6_NUD_FAIL_PROBE;
643
#endif
644
		read_unlock(&neigh->lock);
645 646
	} else {
		ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
J
Jiri Benc 已提交
647
		      RT6_NUD_SUCCEED : RT6_NUD_FAIL_DO_RR;
648
	}
649 650
	rcu_read_unlock_bh();

651
	return ret;
L
Linus Torvalds 已提交
652 653
}

654 655
static int rt6_score_route(struct rt6_info *rt, int oif,
			   int strict)
L
Linus Torvalds 已提交
656
{
657
	int m;
658

659
	m = rt6_check_dev(rt, oif);
660
	if (!m && (strict & RT6_LOOKUP_F_IFACE))
661
		return RT6_NUD_FAIL_HARD;
662 663 664
#ifdef CONFIG_IPV6_ROUTER_PREF
	m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->rt6i_flags)) << 2;
#endif
665 666 667 668 669
	if (strict & RT6_LOOKUP_F_REACHABLE) {
		int n = rt6_check_neigh(rt);
		if (n < 0)
			return n;
	}
670 671 672
	return m;
}

673
static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
674 675
				   int *mpri, struct rt6_info *match,
				   bool *do_rr)
676
{
677
	int m;
678
	bool match_do_rr = false;
679 680 681 682
	struct inet6_dev *idev = rt->rt6i_idev;
	struct net_device *dev = rt->dst.dev;

	if (dev && !netif_carrier_ok(dev) &&
683 684
	    idev->cnf.ignore_routes_with_linkdown &&
	    !(strict & RT6_LOOKUP_F_IGNORE_LINKSTATE))
685
		goto out;
686 687 688 689 690

	if (rt6_check_expired(rt))
		goto out;

	m = rt6_score_route(rt, oif, strict);
J
Jiri Benc 已提交
691
	if (m == RT6_NUD_FAIL_DO_RR) {
692 693
		match_do_rr = true;
		m = 0; /* lowest valid score */
J
Jiri Benc 已提交
694
	} else if (m == RT6_NUD_FAIL_HARD) {
695
		goto out;
696 697 698 699
	}

	if (strict & RT6_LOOKUP_F_REACHABLE)
		rt6_probe(rt);
700

J
Jiri Benc 已提交
701
	/* note that m can be RT6_NUD_FAIL_PROBE at this point */
702
	if (m > *mpri) {
703
		*do_rr = match_do_rr;
704 705 706 707 708 709 710 711 712
		*mpri = m;
		match = rt;
	}
out:
	return match;
}

static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
				     struct rt6_info *rr_head,
713 714
				     u32 metric, int oif, int strict,
				     bool *do_rr)
715
{
716
	struct rt6_info *rt, *match, *cont;
717
	int mpri = -1;
L
Linus Torvalds 已提交
718

719
	match = NULL;
720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735
	cont = NULL;
	for (rt = rr_head; rt; rt = rt->dst.rt6_next) {
		if (rt->rt6i_metric != metric) {
			cont = rt;
			break;
		}

		match = find_match(rt, oif, strict, &mpri, match, do_rr);
	}

	for (rt = fn->leaf; rt && rt != rr_head; rt = rt->dst.rt6_next) {
		if (rt->rt6i_metric != metric) {
			cont = rt;
			break;
		}

736
		match = find_match(rt, oif, strict, &mpri, match, do_rr);
737 738 739 740 741 742
	}

	if (match || !cont)
		return match;

	for (rt = cont; rt; rt = rt->dst.rt6_next)
743
		match = find_match(rt, oif, strict, &mpri, match, do_rr);
L
Linus Torvalds 已提交
744

745 746
	return match;
}
L
Linus Torvalds 已提交
747

748 749 750
static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
{
	struct rt6_info *match, *rt0;
751
	struct net *net;
752
	bool do_rr = false;
L
Linus Torvalds 已提交
753

754 755 756
	rt0 = fn->rr_ptr;
	if (!rt0)
		fn->rr_ptr = rt0 = fn->leaf;
L
Linus Torvalds 已提交
757

758 759
	match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict,
			     &do_rr);
L
Linus Torvalds 已提交
760

761
	if (do_rr) {
762
		struct rt6_info *next = rt0->dst.rt6_next;
763

764
		/* no entries matched; do round-robin */
765 766 767 768 769
		if (!next || next->rt6i_metric != rt0->rt6i_metric)
			next = fn->leaf;

		if (next != rt0)
			fn->rr_ptr = next;
L
Linus Torvalds 已提交
770 771
	}

772
	net = dev_net(rt0->dst.dev);
E
Eric Dumazet 已提交
773
	return match ? match : net->ipv6.ip6_null_entry;
L
Linus Torvalds 已提交
774 775
}

776 777 778 779 780
static bool rt6_is_gw_or_nonexthop(const struct rt6_info *rt)
{
	return (rt->rt6i_flags & (RTF_NONEXTHOP | RTF_GATEWAY));
}

781 782
#ifdef CONFIG_IPV6_ROUTE_INFO
int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
783
		  const struct in6_addr *gwaddr)
784
{
785
	struct net *net = dev_net(dev);
786 787 788
	struct route_info *rinfo = (struct route_info *) opt;
	struct in6_addr prefix_buf, *prefix;
	unsigned int pref;
789
	unsigned long lifetime;
790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812
	struct rt6_info *rt;

	if (len < sizeof(struct route_info)) {
		return -EINVAL;
	}

	/* Sanity check for prefix_len and length */
	if (rinfo->length > 3) {
		return -EINVAL;
	} else if (rinfo->prefix_len > 128) {
		return -EINVAL;
	} else if (rinfo->prefix_len > 64) {
		if (rinfo->length < 2) {
			return -EINVAL;
		}
	} else if (rinfo->prefix_len > 0) {
		if (rinfo->length < 1) {
			return -EINVAL;
		}
	}

	pref = rinfo->route_pref;
	if (pref == ICMPV6_ROUTER_PREF_INVALID)
813
		return -EINVAL;
814

815
	lifetime = addrconf_timeout_fixup(ntohl(rinfo->lifetime), HZ);
816 817 818 819 820 821 822 823 824 825 826

	if (rinfo->length == 3)
		prefix = (struct in6_addr *)rinfo->prefix;
	else {
		/* this function is safe */
		ipv6_addr_prefix(&prefix_buf,
				 (struct in6_addr *)rinfo->prefix,
				 rinfo->prefix_len);
		prefix = &prefix_buf;
	}

827 828 829 830
	if (rinfo->prefix_len == 0)
		rt = rt6_get_dflt_router(gwaddr, dev);
	else
		rt = rt6_get_route_info(net, prefix, rinfo->prefix_len,
831
					gwaddr, dev);
832 833

	if (rt && !lifetime) {
834
		ip6_del_rt(rt);
835 836 837 838
		rt = NULL;
	}

	if (!rt && lifetime)
839 840
		rt = rt6_add_route_info(net, prefix, rinfo->prefix_len, gwaddr,
					dev, pref);
841 842 843 844 845
	else if (rt)
		rt->rt6i_flags = RTF_ROUTEINFO |
				 (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);

	if (rt) {
846 847 848 849 850
		if (!addrconf_finite_timeout(lifetime))
			rt6_clean_expires(rt);
		else
			rt6_set_expires(rt, jiffies + HZ * lifetime);

A
Amerigo Wang 已提交
851
		ip6_rt_put(rt);
852 853 854 855 856
	}
	return 0;
}
#endif

M
Martin KaFai Lau 已提交
857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872
static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
					struct in6_addr *saddr)
{
	struct fib6_node *pn;
	while (1) {
		if (fn->fn_flags & RTN_TL_ROOT)
			return NULL;
		pn = fn->parent;
		if (FIB6_SUBTREE(pn) && FIB6_SUBTREE(pn) != fn)
			fn = fib6_lookup(FIB6_SUBTREE(pn), NULL, saddr);
		else
			fn = pn;
		if (fn->fn_flags & RTN_RTINFO)
			return fn;
	}
}
T
Thomas Graf 已提交
873

874 875
static struct rt6_info *ip6_pol_route_lookup(struct net *net,
					     struct fib6_table *table,
876
					     struct flowi6 *fl6, int flags)
L
Linus Torvalds 已提交
877 878 879 880
{
	struct fib6_node *fn;
	struct rt6_info *rt;

T
Thomas Graf 已提交
881
	read_lock_bh(&table->tb6_lock);
882
	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
T
Thomas Graf 已提交
883 884
restart:
	rt = fn->leaf;
885
	rt = rt6_device_match(net, rt, &fl6->saddr, fl6->flowi6_oif, flags);
886
	if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
887
		rt = rt6_multipath_select(rt, fl6, fl6->flowi6_oif, flags);
M
Martin KaFai Lau 已提交
888 889 890 891 892
	if (rt == net->ipv6.ip6_null_entry) {
		fn = fib6_backtrack(fn, &fl6->saddr);
		if (fn)
			goto restart;
	}
893
	dst_use(&rt->dst, jiffies);
T
Thomas Graf 已提交
894
	read_unlock_bh(&table->tb6_lock);
D
David Ahern 已提交
895 896 897

	trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);

T
Thomas Graf 已提交
898 899 900 901
	return rt;

}

902
struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
F
Florian Westphal 已提交
903 904 905 906 907 908
				    int flags)
{
	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_lookup);
}
EXPORT_SYMBOL_GPL(ip6_route_lookup);

909 910
struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
			    const struct in6_addr *saddr, int oif, int strict)
T
Thomas Graf 已提交
911
{
912 913 914
	struct flowi6 fl6 = {
		.flowi6_oif = oif,
		.daddr = *daddr,
T
Thomas Graf 已提交
915 916
	};
	struct dst_entry *dst;
917
	int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
T
Thomas Graf 已提交
918

919
	if (saddr) {
920
		memcpy(&fl6.saddr, saddr, sizeof(*saddr));
921 922 923
		flags |= RT6_LOOKUP_F_HAS_SADDR;
	}

924
	dst = fib6_rule_lookup(net, &fl6, flags, ip6_pol_route_lookup);
T
Thomas Graf 已提交
925 926 927 928 929
	if (dst->error == 0)
		return (struct rt6_info *) dst;

	dst_release(dst);

L
Linus Torvalds 已提交
930 931
	return NULL;
}
932 933
EXPORT_SYMBOL(rt6_lookup);

T
Thomas Graf 已提交
934
/* ip6_ins_rt is called with FREE table->tb6_lock.
L
Linus Torvalds 已提交
935 936 937 938 939
   It takes new route entry, the addition fails by any reason the
   route is freed. In any case, if caller does not hold it, it may
   be destroyed.
 */

940
static int __ip6_ins_rt(struct rt6_info *rt, struct nl_info *info,
941
			struct mx6_config *mxc)
L
Linus Torvalds 已提交
942 943
{
	int err;
T
Thomas Graf 已提交
944
	struct fib6_table *table;
L
Linus Torvalds 已提交
945

T
Thomas Graf 已提交
946 947
	table = rt->rt6i_table;
	write_lock_bh(&table->tb6_lock);
948
	err = fib6_add(&table->tb6_root, rt, info, mxc);
T
Thomas Graf 已提交
949
	write_unlock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
950 951 952 953

	return err;
}

954 955
int ip6_ins_rt(struct rt6_info *rt)
{
956 957 958 959
	struct nl_info info = {	.nl_net = dev_net(rt->dst.dev), };
	struct mx6_config mxc = { .mx = NULL, };

	return __ip6_ins_rt(rt, &info, &mxc);
960 961
}

962 963 964
static struct rt6_info *ip6_rt_cache_alloc(struct rt6_info *ort,
					   const struct in6_addr *daddr,
					   const struct in6_addr *saddr)
L
Linus Torvalds 已提交
965 966 967 968 969 970 971
{
	struct rt6_info *rt;

	/*
	 *	Clone the route.
	 */

M
Martin KaFai Lau 已提交
972
	if (ort->rt6i_flags & (RTF_CACHE | RTF_PCPU))
M
Martin KaFai Lau 已提交
973
		ort = (struct rt6_info *)ort->dst.from;
L
Linus Torvalds 已提交
974

975
	rt = __ip6_dst_alloc(dev_net(ort->dst.dev), ort->dst.dev, 0);
M
Martin KaFai Lau 已提交
976 977 978 979 980 981 982 983 984 985

	if (!rt)
		return NULL;

	ip6_rt_copy_init(rt, ort);
	rt->rt6i_flags |= RTF_CACHE;
	rt->rt6i_metric = 0;
	rt->dst.flags |= DST_HOST;
	rt->rt6i_dst.addr = *daddr;
	rt->rt6i_dst.plen = 128;
L
Linus Torvalds 已提交
986

M
Martin KaFai Lau 已提交
987 988 989 990
	if (!rt6_is_gw_or_nonexthop(ort)) {
		if (ort->rt6i_dst.plen != 128 &&
		    ipv6_addr_equal(&ort->rt6i_dst.addr, daddr))
			rt->rt6i_flags |= RTF_ANYCAST;
L
Linus Torvalds 已提交
991
#ifdef CONFIG_IPV6_SUBTREES
M
Martin KaFai Lau 已提交
992 993 994
		if (rt->rt6i_src.plen && saddr) {
			rt->rt6i_src.addr = *saddr;
			rt->rt6i_src.plen = 128;
995
		}
M
Martin KaFai Lau 已提交
996
#endif
997
	}
L
Linus Torvalds 已提交
998

999 1000
	return rt;
}
L
Linus Torvalds 已提交
1001

M
Martin KaFai Lau 已提交
1002 1003 1004 1005 1006
static struct rt6_info *ip6_rt_pcpu_alloc(struct rt6_info *rt)
{
	struct rt6_info *pcpu_rt;

	pcpu_rt = __ip6_dst_alloc(dev_net(rt->dst.dev),
1007
				  rt->dst.dev, rt->dst.flags);
M
Martin KaFai Lau 已提交
1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019

	if (!pcpu_rt)
		return NULL;
	ip6_rt_copy_init(pcpu_rt, rt);
	pcpu_rt->rt6i_protocol = rt->rt6i_protocol;
	pcpu_rt->rt6i_flags |= RTF_PCPU;
	return pcpu_rt;
}

/* It should be called with read_lock_bh(&tb6_lock) acquired */
static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt)
{
1020
	struct rt6_info *pcpu_rt, **p;
M
Martin KaFai Lau 已提交
1021 1022 1023 1024

	p = this_cpu_ptr(rt->rt6i_pcpu);
	pcpu_rt = *p;

1025 1026 1027 1028 1029 1030 1031 1032 1033
	if (pcpu_rt) {
		dst_hold(&pcpu_rt->dst);
		rt6_dst_from_metrics_check(pcpu_rt);
	}
	return pcpu_rt;
}

static struct rt6_info *rt6_make_pcpu_route(struct rt6_info *rt)
{
1034
	struct fib6_table *table = rt->rt6i_table;
1035
	struct rt6_info *pcpu_rt, *prev, **p;
M
Martin KaFai Lau 已提交
1036 1037 1038 1039 1040

	pcpu_rt = ip6_rt_pcpu_alloc(rt);
	if (!pcpu_rt) {
		struct net *net = dev_net(rt->dst.dev);

1041 1042
		dst_hold(&net->ipv6.ip6_null_entry->dst);
		return net->ipv6.ip6_null_entry;
M
Martin KaFai Lau 已提交
1043 1044
	}

1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060
	read_lock_bh(&table->tb6_lock);
	if (rt->rt6i_pcpu) {
		p = this_cpu_ptr(rt->rt6i_pcpu);
		prev = cmpxchg(p, NULL, pcpu_rt);
		if (prev) {
			/* If someone did it before us, return prev instead */
			dst_destroy(&pcpu_rt->dst);
			pcpu_rt = prev;
		}
	} else {
		/* rt has been removed from the fib6 tree
		 * before we have a chance to acquire the read_lock.
		 * In this case, don't brother to create a pcpu rt
		 * since rt is going away anyway.  The next
		 * dst_check() will trigger a re-lookup.
		 */
M
Martin KaFai Lau 已提交
1061
		dst_destroy(&pcpu_rt->dst);
1062
		pcpu_rt = rt;
M
Martin KaFai Lau 已提交
1063 1064 1065
	}
	dst_hold(&pcpu_rt->dst);
	rt6_dst_from_metrics_check(pcpu_rt);
1066
	read_unlock_bh(&table->tb6_lock);
M
Martin KaFai Lau 已提交
1067 1068 1069
	return pcpu_rt;
}

1070 1071
struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
			       int oif, struct flowi6 *fl6, int flags)
L
Linus Torvalds 已提交
1072
{
1073
	struct fib6_node *fn, *saved_fn;
1074
	struct rt6_info *rt;
T
Thomas Graf 已提交
1075
	int strict = 0;
L
Linus Torvalds 已提交
1076

1077
	strict |= flags & RT6_LOOKUP_F_IFACE;
1078
	strict |= flags & RT6_LOOKUP_F_IGNORE_LINKSTATE;
1079 1080
	if (net->ipv6.devconf_all->forwarding == 0)
		strict |= RT6_LOOKUP_F_REACHABLE;
L
Linus Torvalds 已提交
1081

T
Thomas Graf 已提交
1082
	read_lock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
1083

1084
	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
1085
	saved_fn = fn;
L
Linus Torvalds 已提交
1086

D
David Ahern 已提交
1087 1088 1089
	if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF)
		oif = 0;

M
Martin KaFai Lau 已提交
1090
redo_rt6_select:
1091
	rt = rt6_select(fn, oif, strict);
1092
	if (rt->rt6i_nsiblings)
1093
		rt = rt6_multipath_select(rt, fl6, oif, strict);
M
Martin KaFai Lau 已提交
1094 1095 1096 1097
	if (rt == net->ipv6.ip6_null_entry) {
		fn = fib6_backtrack(fn, &fl6->saddr);
		if (fn)
			goto redo_rt6_select;
1098 1099 1100 1101 1102 1103
		else if (strict & RT6_LOOKUP_F_REACHABLE) {
			/* also consider unreachable route */
			strict &= ~RT6_LOOKUP_F_REACHABLE;
			fn = saved_fn;
			goto redo_rt6_select;
		}
M
Martin KaFai Lau 已提交
1104 1105
	}

1106

1107
	if (rt == net->ipv6.ip6_null_entry || (rt->rt6i_flags & RTF_CACHE)) {
M
Martin KaFai Lau 已提交
1108 1109 1110 1111
		dst_use(&rt->dst, jiffies);
		read_unlock_bh(&table->tb6_lock);

		rt6_dst_from_metrics_check(rt);
D
David Ahern 已提交
1112 1113

		trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
M
Martin KaFai Lau 已提交
1114
		return rt;
1115 1116 1117 1118 1119 1120 1121 1122 1123 1124
	} else if (unlikely((fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH) &&
			    !(rt->rt6i_flags & RTF_GATEWAY))) {
		/* Create a RTF_CACHE clone which will not be
		 * owned by the fib6 tree.  It is for the special case where
		 * the daddr in the skb during the neighbor look-up is different
		 * from the fl6->daddr used to look-up route here.
		 */

		struct rt6_info *uncached_rt;

M
Martin KaFai Lau 已提交
1125 1126 1127
		dst_use(&rt->dst, jiffies);
		read_unlock_bh(&table->tb6_lock);

1128 1129
		uncached_rt = ip6_rt_cache_alloc(rt, &fl6->daddr, NULL);
		dst_release(&rt->dst);
T
Thomas Graf 已提交
1130

1131
		if (uncached_rt)
1132
			rt6_uncached_list_add(uncached_rt);
1133 1134
		else
			uncached_rt = net->ipv6.ip6_null_entry;
M
Martin KaFai Lau 已提交
1135

1136
		dst_hold(&uncached_rt->dst);
D
David Ahern 已提交
1137 1138

		trace_fib6_table_lookup(net, uncached_rt, table->tb6_id, fl6);
1139 1140
		return uncached_rt;

M
Martin KaFai Lau 已提交
1141 1142 1143 1144 1145 1146 1147 1148 1149
	} else {
		/* Get a percpu copy */

		struct rt6_info *pcpu_rt;

		rt->dst.lastuse = jiffies;
		rt->dst.__use++;
		pcpu_rt = rt6_get_pcpu_route(rt);

1150 1151 1152 1153 1154 1155 1156 1157 1158
		if (pcpu_rt) {
			read_unlock_bh(&table->tb6_lock);
		} else {
			/* We have to do the read_unlock first
			 * because rt6_make_pcpu_route() may trigger
			 * ip6_dst_gc() which will take the write_lock.
			 */
			dst_hold(&rt->dst);
			read_unlock_bh(&table->tb6_lock);
1159
			pcpu_rt = rt6_make_pcpu_route(rt);
1160 1161
			dst_release(&rt->dst);
		}
M
Martin KaFai Lau 已提交
1162

D
David Ahern 已提交
1163
		trace_fib6_table_lookup(net, pcpu_rt, table->tb6_id, fl6);
M
Martin KaFai Lau 已提交
1164
		return pcpu_rt;
1165

M
Martin KaFai Lau 已提交
1166
	}
L
Linus Torvalds 已提交
1167
}
1168
EXPORT_SYMBOL_GPL(ip6_pol_route);
L
Linus Torvalds 已提交
1169

1170
static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
1171
					    struct flowi6 *fl6, int flags)
1172
{
1173
	return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
1174 1175
}

1176 1177 1178
struct dst_entry *ip6_route_input_lookup(struct net *net,
					 struct net_device *dev,
					 struct flowi6 *fl6, int flags)
1179 1180 1181 1182 1183 1184
{
	if (rt6_need_strict(&fl6->daddr) && dev->type != ARPHRD_PIMREG)
		flags |= RT6_LOOKUP_F_IFACE;

	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_input);
}
1185
EXPORT_SYMBOL_GPL(ip6_route_input_lookup);
1186

T
Thomas Graf 已提交
1187 1188
void ip6_route_input(struct sk_buff *skb)
{
1189
	const struct ipv6hdr *iph = ipv6_hdr(skb);
1190
	struct net *net = dev_net(skb->dev);
1191
	int flags = RT6_LOOKUP_F_HAS_SADDR;
1192
	struct ip_tunnel_info *tun_info;
1193
	struct flowi6 fl6 = {
1194
		.flowi6_iif = skb->dev->ifindex,
1195 1196
		.daddr = iph->daddr,
		.saddr = iph->saddr,
1197
		.flowlabel = ip6_flowinfo(iph),
1198 1199
		.flowi6_mark = skb->mark,
		.flowi6_proto = iph->nexthdr,
T
Thomas Graf 已提交
1200
	};
1201

1202
	tun_info = skb_tunnel_info(skb);
1203
	if (tun_info && !(tun_info->mode & IP_TUNNEL_INFO_TX))
1204
		fl6.flowi6_tun_key.tun_id = tun_info->key.tun_id;
1205
	skb_dst_drop(skb);
1206
	skb_dst_set(skb, ip6_route_input_lookup(net, skb->dev, &fl6, flags));
T
Thomas Graf 已提交
1207 1208
}

1209
static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
1210
					     struct flowi6 *fl6, int flags)
L
Linus Torvalds 已提交
1211
{
1212
	return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
T
Thomas Graf 已提交
1213 1214
}

1215 1216
struct dst_entry *ip6_route_output_flags(struct net *net, const struct sock *sk,
					 struct flowi6 *fl6, int flags)
T
Thomas Graf 已提交
1217
{
1218
	bool any_src;
T
Thomas Graf 已提交
1219

1220 1221 1222 1223 1224 1225 1226
	if (rt6_need_strict(&fl6->daddr)) {
		struct dst_entry *dst;

		dst = l3mdev_link_scope_lookup(net, fl6);
		if (dst)
			return dst;
	}
D
David Ahern 已提交
1227

1228
	fl6->flowi6_iif = LOOPBACK_IFINDEX;
1229

1230
	any_src = ipv6_addr_any(&fl6->saddr);
1231
	if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr) ||
1232
	    (fl6->flowi6_oif && any_src))
1233
		flags |= RT6_LOOKUP_F_IFACE;
T
Thomas Graf 已提交
1234

1235
	if (!any_src)
1236
		flags |= RT6_LOOKUP_F_HAS_SADDR;
1237 1238
	else if (sk)
		flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
1239

1240
	return fib6_rule_lookup(net, fl6, flags, ip6_pol_route_output);
L
Linus Torvalds 已提交
1241
}
1242
EXPORT_SYMBOL_GPL(ip6_route_output_flags);
L
Linus Torvalds 已提交
1243

1244
struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
1245
{
1246
	struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
1247 1248
	struct dst_entry *new = NULL;

1249
	rt = dst_alloc(&ip6_dst_blackhole_ops, ort->dst.dev, 1, DST_OBSOLETE_NONE, 0);
1250
	if (rt) {
1251
		rt6_info_init(rt);
1252

1253
		new = &rt->dst;
1254
		new->__use = 1;
1255
		new->input = dst_discard;
E
Eric W. Biederman 已提交
1256
		new->output = dst_discard_out;
1257

1258
		dst_copy_metrics(new, &ort->dst);
1259 1260 1261 1262
		rt->rt6i_idev = ort->rt6i_idev;
		if (rt->rt6i_idev)
			in6_dev_hold(rt->rt6i_idev);

A
Alexey Dobriyan 已提交
1263
		rt->rt6i_gateway = ort->rt6i_gateway;
1264
		rt->rt6i_flags = ort->rt6i_flags & ~RTF_PCPU;
1265 1266 1267 1268 1269 1270 1271 1272 1273 1274
		rt->rt6i_metric = 0;

		memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
#ifdef CONFIG_IPV6_SUBTREES
		memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
#endif

		dst_free(new);
	}

1275 1276
	dst_release(dst_orig);
	return new ? new : ERR_PTR(-ENOMEM);
1277 1278
}

L
Linus Torvalds 已提交
1279 1280 1281 1282
/*
 *	Destination cache support functions
 */

1283 1284 1285 1286 1287 1288 1289
static void rt6_dst_from_metrics_check(struct rt6_info *rt)
{
	if (rt->dst.from &&
	    dst_metrics_ptr(&rt->dst) != dst_metrics_ptr(rt->dst.from))
		dst_init_metrics(&rt->dst, dst_metrics_ptr(rt->dst.from), true);
}

1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302
static struct dst_entry *rt6_check(struct rt6_info *rt, u32 cookie)
{
	if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
		return NULL;

	if (rt6_check_expired(rt))
		return NULL;

	return &rt->dst;
}

static struct dst_entry *rt6_dst_from_check(struct rt6_info *rt, u32 cookie)
{
1303 1304
	if (!__rt6_check_expired(rt) &&
	    rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1305 1306 1307 1308 1309 1310
	    rt6_check((struct rt6_info *)(rt->dst.from), cookie))
		return &rt->dst;
	else
		return NULL;
}

L
Linus Torvalds 已提交
1311 1312 1313 1314 1315 1316
static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
{
	struct rt6_info *rt;

	rt = (struct rt6_info *) dst;

1317 1318 1319 1320
	/* All IPV6 dsts are created with ->obsolete set to the value
	 * DST_OBSOLETE_FORCE_CHK which forces validation calls down
	 * into this function always.
	 */
1321

1322 1323
	rt6_dst_from_metrics_check(rt);

1324 1325
	if (rt->rt6i_flags & RTF_PCPU ||
	    (unlikely(dst->flags & DST_NOCACHE) && rt->dst.from))
1326 1327 1328
		return rt6_dst_from_check(rt, cookie);
	else
		return rt6_check(rt, cookie);
L
Linus Torvalds 已提交
1329 1330 1331 1332 1333 1334 1335
}

static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
{
	struct rt6_info *rt = (struct rt6_info *) dst;

	if (rt) {
1336 1337 1338 1339 1340 1341
		if (rt->rt6i_flags & RTF_CACHE) {
			if (rt6_check_expired(rt)) {
				ip6_del_rt(rt);
				dst = NULL;
			}
		} else {
L
Linus Torvalds 已提交
1342
			dst_release(dst);
1343 1344
			dst = NULL;
		}
L
Linus Torvalds 已提交
1345
	}
1346
	return dst;
L
Linus Torvalds 已提交
1347 1348 1349 1350 1351 1352
}

static void ip6_link_failure(struct sk_buff *skb)
{
	struct rt6_info *rt;

1353
	icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
L
Linus Torvalds 已提交
1354

E
Eric Dumazet 已提交
1355
	rt = (struct rt6_info *) skb_dst(skb);
L
Linus Torvalds 已提交
1356
	if (rt) {
1357 1358
		if (rt->rt6i_flags & RTF_CACHE) {
			dst_hold(&rt->dst);
M
Martin KaFai Lau 已提交
1359
			ip6_del_rt(rt);
1360
		} else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) {
L
Linus Torvalds 已提交
1361
			rt->rt6i_node->fn_sernum = -1;
1362
		}
L
Linus Torvalds 已提交
1363 1364 1365
	}
}

1366 1367 1368 1369 1370 1371 1372 1373 1374
static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
{
	struct net *net = dev_net(rt->dst.dev);

	rt->rt6i_flags |= RTF_MODIFIED;
	rt->rt6i_pmtu = mtu;
	rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
}

1375 1376 1377 1378 1379 1380
static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
{
	return !(rt->rt6i_flags & RTF_CACHE) &&
		(rt->rt6i_flags & RTF_PCPU || rt->rt6i_node);
}

1381 1382
static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
				 const struct ipv6hdr *iph, u32 mtu)
L
Linus Torvalds 已提交
1383
{
1384
	const struct in6_addr *daddr, *saddr;
1385
	struct rt6_info *rt6 = (struct rt6_info *)dst;
L
Linus Torvalds 已提交
1386

1387 1388
	if (rt6->rt6i_flags & RTF_LOCAL)
		return;
1389

1390 1391 1392
	if (dst_metric_locked(dst, RTAX_MTU))
		return;

1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403
	if (iph) {
		daddr = &iph->daddr;
		saddr = &iph->saddr;
	} else if (sk) {
		daddr = &sk->sk_v6_daddr;
		saddr = &inet6_sk(sk)->saddr;
	} else {
		daddr = NULL;
		saddr = NULL;
	}
	dst_confirm_neigh(dst, daddr);
1404 1405 1406
	mtu = max_t(u32, mtu, IPV6_MIN_MTU);
	if (mtu >= dst_mtu(dst))
		return;
1407

1408
	if (!rt6_cache_allowed_for_pmtu(rt6)) {
1409
		rt6_do_update_pmtu(rt6, mtu);
1410
	} else if (daddr) {
1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423
		struct rt6_info *nrt6;

		nrt6 = ip6_rt_cache_alloc(rt6, daddr, saddr);
		if (nrt6) {
			rt6_do_update_pmtu(nrt6, mtu);

			/* ip6_ins_rt(nrt6) will bump the
			 * rt6->rt6i_node->fn_sernum
			 * which will fail the next rt6_check() and
			 * invalidate the sk->sk_dst_cache.
			 */
			ip6_ins_rt(nrt6);
		}
L
Linus Torvalds 已提交
1424 1425 1426
	}
}

1427 1428 1429 1430 1431 1432
static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
			       struct sk_buff *skb, u32 mtu)
{
	__ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu);
}

1433
void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
1434
		     int oif, u32 mark, kuid_t uid)
1435 1436 1437 1438 1439 1440 1441
{
	const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
	fl6.flowi6_oif = oif;
1442
	fl6.flowi6_mark = mark ? mark : IP6_REPLY_MARK(net, skb->mark);
1443 1444
	fl6.daddr = iph->daddr;
	fl6.saddr = iph->saddr;
1445
	fl6.flowlabel = ip6_flowinfo(iph);
1446
	fl6.flowi6_uid = uid;
1447 1448 1449

	dst = ip6_route_output(net, NULL, &fl6);
	if (!dst->error)
1450
		__ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu));
1451 1452 1453 1454 1455 1456
	dst_release(dst);
}
EXPORT_SYMBOL_GPL(ip6_update_pmtu);

void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
{
1457 1458
	struct dst_entry *dst;

1459
	ip6_update_pmtu(skb, sock_net(sk), mtu,
1460
			sk->sk_bound_dev_if, sk->sk_mark, sk->sk_uid);
1461 1462 1463 1464 1465 1466 1467 1468 1469 1470

	dst = __sk_dst_get(sk);
	if (!dst || !dst->obsolete ||
	    dst->ops->check(dst, inet6_sk(sk)->dst_cookie))
		return;

	bh_lock_sock(sk);
	if (!sock_owned_by_user(sk) && !ipv6_addr_v4mapped(&sk->sk_v6_daddr))
		ip6_datagram_dst_update(sk, false);
	bh_unlock_sock(sk);
1471 1472 1473
}
EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);

1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489
/* Handle redirects */
struct ip6rd_flowi {
	struct flowi6 fl6;
	struct in6_addr gateway;
};

static struct rt6_info *__ip6_route_redirect(struct net *net,
					     struct fib6_table *table,
					     struct flowi6 *fl6,
					     int flags)
{
	struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
	struct rt6_info *rt;
	struct fib6_node *fn;

	/* Get the "current" route for this destination and
A
Alexander Alemayhu 已提交
1490
	 * check if the redirect has come from appropriate router.
1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519
	 *
	 * RFC 4861 specifies that redirects should only be
	 * accepted if they come from the nexthop to the target.
	 * Due to the way the routes are chosen, this notion
	 * is a bit fuzzy and one might need to check all possible
	 * routes.
	 */

	read_lock_bh(&table->tb6_lock);
	fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
restart:
	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
		if (rt6_check_expired(rt))
			continue;
		if (rt->dst.error)
			break;
		if (!(rt->rt6i_flags & RTF_GATEWAY))
			continue;
		if (fl6->flowi6_oif != rt->dst.dev->ifindex)
			continue;
		if (!ipv6_addr_equal(&rdfl->gateway, &rt->rt6i_gateway))
			continue;
		break;
	}

	if (!rt)
		rt = net->ipv6.ip6_null_entry;
	else if (rt->dst.error) {
		rt = net->ipv6.ip6_null_entry;
1520 1521 1522 1523
		goto out;
	}

	if (rt == net->ipv6.ip6_null_entry) {
M
Martin KaFai Lau 已提交
1524 1525 1526
		fn = fib6_backtrack(fn, &fl6->saddr);
		if (fn)
			goto restart;
1527
	}
M
Martin KaFai Lau 已提交
1528

1529
out:
1530 1531 1532 1533
	dst_hold(&rt->dst);

	read_unlock_bh(&table->tb6_lock);

D
David Ahern 已提交
1534
	trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551
	return rt;
};

static struct dst_entry *ip6_route_redirect(struct net *net,
					const struct flowi6 *fl6,
					const struct in6_addr *gateway)
{
	int flags = RT6_LOOKUP_F_HAS_SADDR;
	struct ip6rd_flowi rdfl;

	rdfl.fl6 = *fl6;
	rdfl.gateway = *gateway;

	return fib6_rule_lookup(net, &rdfl.fl6,
				flags, __ip6_route_redirect);
}

1552 1553
void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark,
		  kuid_t uid)
1554 1555 1556 1557 1558 1559
{
	const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
1560
	fl6.flowi6_iif = LOOPBACK_IFINDEX;
1561 1562 1563 1564
	fl6.flowi6_oif = oif;
	fl6.flowi6_mark = mark;
	fl6.daddr = iph->daddr;
	fl6.saddr = iph->saddr;
1565
	fl6.flowlabel = ip6_flowinfo(iph);
1566
	fl6.flowi6_uid = uid;
1567

1568 1569
	dst = ip6_route_redirect(net, &fl6, &ipv6_hdr(skb)->saddr);
	rt6_do_redirect(dst, NULL, skb);
1570 1571 1572 1573
	dst_release(dst);
}
EXPORT_SYMBOL_GPL(ip6_redirect);

1574 1575 1576 1577 1578 1579 1580 1581 1582
void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
			    u32 mark)
{
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
	struct dst_entry *dst;
	struct flowi6 fl6;

	memset(&fl6, 0, sizeof(fl6));
1583
	fl6.flowi6_iif = LOOPBACK_IFINDEX;
1584 1585 1586 1587
	fl6.flowi6_oif = oif;
	fl6.flowi6_mark = mark;
	fl6.daddr = msg->dest;
	fl6.saddr = iph->daddr;
1588
	fl6.flowi6_uid = sock_net_uid(net, NULL);
1589

1590 1591
	dst = ip6_route_redirect(net, &fl6, &iph->saddr);
	rt6_do_redirect(dst, NULL, skb);
1592 1593 1594
	dst_release(dst);
}

1595 1596
void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
{
1597 1598
	ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark,
		     sk->sk_uid);
1599 1600 1601
}
EXPORT_SYMBOL_GPL(ip6_sk_redirect);

1602
static unsigned int ip6_default_advmss(const struct dst_entry *dst)
L
Linus Torvalds 已提交
1603
{
1604 1605 1606 1607
	struct net_device *dev = dst->dev;
	unsigned int mtu = dst_mtu(dst);
	struct net *net = dev_net(dev);

L
Linus Torvalds 已提交
1608 1609
	mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);

1610 1611
	if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
		mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
L
Linus Torvalds 已提交
1612 1613

	/*
1614 1615 1616
	 * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
	 * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
	 * IPV6_MAXPLEN is also valid and means: "any MSS,
L
Linus Torvalds 已提交
1617 1618 1619 1620 1621 1622 1623
	 * rely only on pmtu discovery"
	 */
	if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
		mtu = IPV6_MAXPLEN;
	return mtu;
}

1624
static unsigned int ip6_mtu(const struct dst_entry *dst)
1625
{
1626 1627
	const struct rt6_info *rt = (const struct rt6_info *)dst;
	unsigned int mtu = rt->rt6i_pmtu;
1628
	struct inet6_dev *idev;
1629

1630 1631 1632 1633
	if (mtu)
		goto out;

	mtu = dst_metric_raw(dst, RTAX_MTU);
1634
	if (mtu)
E
Eric Dumazet 已提交
1635
		goto out;
1636 1637

	mtu = IPV6_MIN_MTU;
1638 1639 1640 1641 1642 1643 1644

	rcu_read_lock();
	idev = __in6_dev_get(dst->dev);
	if (idev)
		mtu = idev->cnf.mtu6;
	rcu_read_unlock();

E
Eric Dumazet 已提交
1645
out:
1646 1647 1648
	mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);

	return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
1649 1650
}

1651 1652
static struct dst_entry *icmp6_dst_gc_list;
static DEFINE_SPINLOCK(icmp6_dst_lock);
1653

1654
struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
1655
				  struct flowi6 *fl6)
L
Linus Torvalds 已提交
1656
{
1657
	struct dst_entry *dst;
L
Linus Torvalds 已提交
1658 1659
	struct rt6_info *rt;
	struct inet6_dev *idev = in6_dev_get(dev);
1660
	struct net *net = dev_net(dev);
L
Linus Torvalds 已提交
1661

1662
	if (unlikely(!idev))
E
Eric Dumazet 已提交
1663
		return ERR_PTR(-ENODEV);
L
Linus Torvalds 已提交
1664

1665
	rt = ip6_dst_alloc(net, dev, 0);
1666
	if (unlikely(!rt)) {
L
Linus Torvalds 已提交
1667
		in6_dev_put(idev);
1668
		dst = ERR_PTR(-ENOMEM);
L
Linus Torvalds 已提交
1669 1670 1671
		goto out;
	}

1672 1673
	rt->dst.flags |= DST_HOST;
	rt->dst.output  = ip6_output;
1674
	atomic_set(&rt->dst.__refcnt, 1);
1675
	rt->rt6i_gateway  = fl6->daddr;
1676
	rt->rt6i_dst.addr = fl6->daddr;
1677 1678
	rt->rt6i_dst.plen = 128;
	rt->rt6i_idev     = idev;
L
Li RongQing 已提交
1679
	dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 0);
L
Linus Torvalds 已提交
1680

1681
	spin_lock_bh(&icmp6_dst_lock);
1682 1683
	rt->dst.next = icmp6_dst_gc_list;
	icmp6_dst_gc_list = &rt->dst;
1684
	spin_unlock_bh(&icmp6_dst_lock);
L
Linus Torvalds 已提交
1685

1686
	fib6_force_start_gc(net);
L
Linus Torvalds 已提交
1687

1688 1689
	dst = xfrm_lookup(net, &rt->dst, flowi6_to_flowi(fl6), NULL, 0);

L
Linus Torvalds 已提交
1690
out:
1691
	return dst;
L
Linus Torvalds 已提交
1692 1693
}

1694
int icmp6_dst_gc(void)
L
Linus Torvalds 已提交
1695
{
1696
	struct dst_entry *dst, **pprev;
1697
	int more = 0;
L
Linus Torvalds 已提交
1698

1699 1700
	spin_lock_bh(&icmp6_dst_lock);
	pprev = &icmp6_dst_gc_list;
1701

L
Linus Torvalds 已提交
1702 1703 1704 1705 1706 1707
	while ((dst = *pprev) != NULL) {
		if (!atomic_read(&dst->__refcnt)) {
			*pprev = dst->next;
			dst_free(dst);
		} else {
			pprev = &dst->next;
1708
			++more;
L
Linus Torvalds 已提交
1709 1710 1711
		}
	}

1712
	spin_unlock_bh(&icmp6_dst_lock);
1713

1714
	return more;
L
Linus Torvalds 已提交
1715 1716
}

1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735
static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
			    void *arg)
{
	struct dst_entry *dst, **pprev;

	spin_lock_bh(&icmp6_dst_lock);
	pprev = &icmp6_dst_gc_list;
	while ((dst = *pprev) != NULL) {
		struct rt6_info *rt = (struct rt6_info *) dst;
		if (func(rt, arg)) {
			*pprev = dst->next;
			dst_free(dst);
		} else {
			pprev = &dst->next;
		}
	}
	spin_unlock_bh(&icmp6_dst_lock);
}

1736
static int ip6_dst_gc(struct dst_ops *ops)
L
Linus Torvalds 已提交
1737
{
1738
	struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
1739 1740 1741 1742 1743
	int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
	int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
	int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
	int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
	unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
1744
	int entries;
1745

1746
	entries = dst_entries_get_fast(ops);
1747
	if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
1748
	    entries <= rt_max_size)
L
Linus Torvalds 已提交
1749 1750
		goto out;

1751
	net->ipv6.ip6_rt_gc_expire++;
1752
	fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, true);
1753 1754
	entries = dst_entries_get_slow(ops);
	if (entries < ops->gc_thresh)
1755
		net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
L
Linus Torvalds 已提交
1756
out:
1757
	net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
1758
	return entries > rt_max_size;
L
Linus Torvalds 已提交
1759 1760
}

1761 1762 1763
static int ip6_convert_metrics(struct mx6_config *mxc,
			       const struct fib6_config *cfg)
{
1764
	bool ecn_ca = false;
1765 1766 1767 1768
	struct nlattr *nla;
	int remaining;
	u32 *mp;

1769
	if (!cfg->fc_mx)
1770 1771 1772 1773 1774 1775 1776 1777
		return 0;

	mp = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
	if (unlikely(!mp))
		return -ENOMEM;

	nla_for_each_attr(nla, cfg->fc_mx, cfg->fc_mx_len, remaining) {
		int type = nla_type(nla);
1778
		u32 val;
1779

1780 1781 1782 1783
		if (!type)
			continue;
		if (unlikely(type > RTAX_MAX))
			goto err;
1784

1785 1786
		if (type == RTAX_CC_ALGO) {
			char tmp[TCP_CA_NAME_MAX];
1787

1788
			nla_strlcpy(tmp, nla, sizeof(tmp));
1789
			val = tcp_ca_get_key_by_name(tmp, &ecn_ca);
1790 1791 1792 1793
			if (val == TCP_CA_UNSPEC)
				goto err;
		} else {
			val = nla_get_u32(nla);
1794
		}
1795 1796
		if (type == RTAX_HOPLIMIT && val > 255)
			val = 255;
1797 1798
		if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK))
			goto err;
1799 1800 1801

		mp[type - 1] = val;
		__set_bit(type - 1, mxc->mx_valid);
1802 1803
	}

1804 1805 1806 1807
	if (ecn_ca) {
		__set_bit(RTAX_FEATURES - 1, mxc->mx_valid);
		mp[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA;
	}
1808

1809
	mxc->mx = mp;
1810 1811 1812 1813 1814
	return 0;
 err:
	kfree(mp);
	return -EINVAL;
}
L
Linus Torvalds 已提交
1815

1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826
static struct rt6_info *ip6_nh_lookup_table(struct net *net,
					    struct fib6_config *cfg,
					    const struct in6_addr *gw_addr)
{
	struct flowi6 fl6 = {
		.flowi6_oif = cfg->fc_ifindex,
		.daddr = *gw_addr,
		.saddr = cfg->fc_prefsrc,
	};
	struct fib6_table *table;
	struct rt6_info *rt;
1827
	int flags = RT6_LOOKUP_F_IFACE | RT6_LOOKUP_F_IGNORE_LINKSTATE;
1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846

	table = fib6_get_table(net, cfg->fc_table);
	if (!table)
		return NULL;

	if (!ipv6_addr_any(&cfg->fc_prefsrc))
		flags |= RT6_LOOKUP_F_HAS_SADDR;

	rt = ip6_pol_route(net, table, cfg->fc_ifindex, &fl6, flags);

	/* if table lookup failed, fall back to full lookup */
	if (rt == net->ipv6.ip6_null_entry) {
		ip6_rt_put(rt);
		rt = NULL;
	}

	return rt;
}

1847
static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg)
L
Linus Torvalds 已提交
1848
{
1849
	struct net *net = cfg->fc_nlinfo.nl_net;
L
Linus Torvalds 已提交
1850 1851 1852
	struct rt6_info *rt = NULL;
	struct net_device *dev = NULL;
	struct inet6_dev *idev = NULL;
T
Thomas Graf 已提交
1853
	struct fib6_table *table;
L
Linus Torvalds 已提交
1854
	int addr_type;
1855
	int err = -EINVAL;
L
Linus Torvalds 已提交
1856

1857 1858 1859 1860
	/* RTF_PCPU is an internal flag; can not be set by userspace */
	if (cfg->fc_flags & RTF_PCPU)
		goto out;

1861
	if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
1862
		goto out;
L
Linus Torvalds 已提交
1863
#ifndef CONFIG_IPV6_SUBTREES
1864
	if (cfg->fc_src_len)
1865
		goto out;
L
Linus Torvalds 已提交
1866
#endif
1867
	if (cfg->fc_ifindex) {
L
Linus Torvalds 已提交
1868
		err = -ENODEV;
1869
		dev = dev_get_by_index(net, cfg->fc_ifindex);
L
Linus Torvalds 已提交
1870 1871 1872 1873 1874 1875 1876
		if (!dev)
			goto out;
		idev = in6_dev_get(dev);
		if (!idev)
			goto out;
	}

1877 1878
	if (cfg->fc_metric == 0)
		cfg->fc_metric = IP6_RT_PRIO_USER;
L
Linus Torvalds 已提交
1879

1880
	err = -ENOBUFS;
1881 1882
	if (cfg->fc_nlinfo.nlh &&
	    !(cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_CREATE)) {
1883
		table = fib6_get_table(net, cfg->fc_table);
1884
		if (!table) {
1885
			pr_warn("NLM_F_CREATE should be specified when creating new route\n");
1886 1887 1888 1889 1890
			table = fib6_new_table(net, cfg->fc_table);
		}
	} else {
		table = fib6_new_table(net, cfg->fc_table);
	}
1891 1892

	if (!table)
T
Thomas Graf 已提交
1893 1894
		goto out;

1895 1896
	rt = ip6_dst_alloc(net, NULL,
			   (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT);
L
Linus Torvalds 已提交
1897

1898
	if (!rt) {
L
Linus Torvalds 已提交
1899 1900 1901 1902
		err = -ENOMEM;
		goto out;
	}

1903 1904 1905 1906 1907
	if (cfg->fc_flags & RTF_EXPIRES)
		rt6_set_expires(rt, jiffies +
				clock_t_to_jiffies(cfg->fc_expires));
	else
		rt6_clean_expires(rt);
L
Linus Torvalds 已提交
1908

1909 1910 1911 1912 1913
	if (cfg->fc_protocol == RTPROT_UNSPEC)
		cfg->fc_protocol = RTPROT_BOOT;
	rt->rt6i_protocol = cfg->fc_protocol;

	addr_type = ipv6_addr_type(&cfg->fc_dst);
L
Linus Torvalds 已提交
1914 1915

	if (addr_type & IPV6_ADDR_MULTICAST)
1916
		rt->dst.input = ip6_mc_input;
1917 1918
	else if (cfg->fc_flags & RTF_LOCAL)
		rt->dst.input = ip6_input;
L
Linus Torvalds 已提交
1919
	else
1920
		rt->dst.input = ip6_forward;
L
Linus Torvalds 已提交
1921

1922
	rt->dst.output = ip6_output;
L
Linus Torvalds 已提交
1923

1924 1925 1926
	if (cfg->fc_encap) {
		struct lwtunnel_state *lwtstate;

1927
		err = lwtunnel_build_state(cfg->fc_encap_type,
1928 1929
					   cfg->fc_encap, AF_INET6, cfg,
					   &lwtstate);
1930 1931
		if (err)
			goto out;
1932 1933 1934 1935
		rt->dst.lwtstate = lwtstate_get(lwtstate);
		if (lwtunnel_output_redirect(rt->dst.lwtstate)) {
			rt->dst.lwtstate->orig_output = rt->dst.output;
			rt->dst.output = lwtunnel_output;
1936
		}
1937 1938 1939
		if (lwtunnel_input_redirect(rt->dst.lwtstate)) {
			rt->dst.lwtstate->orig_input = rt->dst.input;
			rt->dst.input = lwtunnel_input;
1940
		}
1941 1942
	}

1943 1944
	ipv6_addr_prefix(&rt->rt6i_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
	rt->rt6i_dst.plen = cfg->fc_dst_len;
1945
	if (rt->rt6i_dst.plen == 128)
1946 1947
		rt->dst.flags |= DST_HOST;

L
Linus Torvalds 已提交
1948
#ifdef CONFIG_IPV6_SUBTREES
1949 1950
	ipv6_addr_prefix(&rt->rt6i_src.addr, &cfg->fc_src, cfg->fc_src_len);
	rt->rt6i_src.plen = cfg->fc_src_len;
L
Linus Torvalds 已提交
1951 1952
#endif

1953
	rt->rt6i_metric = cfg->fc_metric;
L
Linus Torvalds 已提交
1954 1955 1956 1957

	/* We cannot add true routes via loopback here,
	   they would result in kernel looping; promote them to reject routes
	 */
1958
	if ((cfg->fc_flags & RTF_REJECT) ||
1959 1960 1961
	    (dev && (dev->flags & IFF_LOOPBACK) &&
	     !(addr_type & IPV6_ADDR_LOOPBACK) &&
	     !(cfg->fc_flags & RTF_LOCAL))) {
L
Linus Torvalds 已提交
1962
		/* hold loopback dev/idev if we haven't done so. */
1963
		if (dev != net->loopback_dev) {
L
Linus Torvalds 已提交
1964 1965 1966 1967
			if (dev) {
				dev_put(dev);
				in6_dev_put(idev);
			}
1968
			dev = net->loopback_dev;
L
Linus Torvalds 已提交
1969 1970 1971 1972 1973 1974 1975 1976
			dev_hold(dev);
			idev = in6_dev_get(dev);
			if (!idev) {
				err = -ENODEV;
				goto out;
			}
		}
		rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
1977 1978 1979
		switch (cfg->fc_type) {
		case RTN_BLACKHOLE:
			rt->dst.error = -EINVAL;
E
Eric W. Biederman 已提交
1980
			rt->dst.output = dst_discard_out;
1981
			rt->dst.input = dst_discard;
1982 1983 1984
			break;
		case RTN_PROHIBIT:
			rt->dst.error = -EACCES;
1985 1986
			rt->dst.output = ip6_pkt_prohibit_out;
			rt->dst.input = ip6_pkt_prohibit;
1987
			break;
1988
		case RTN_THROW:
1989
		case RTN_UNREACHABLE:
1990
		default:
1991
			rt->dst.error = (cfg->fc_type == RTN_THROW) ? -EAGAIN
1992 1993
					: (cfg->fc_type == RTN_UNREACHABLE)
					? -EHOSTUNREACH : -ENETUNREACH;
1994 1995
			rt->dst.output = ip6_pkt_discard_out;
			rt->dst.input = ip6_pkt_discard;
1996 1997
			break;
		}
L
Linus Torvalds 已提交
1998 1999 2000
		goto install_route;
	}

2001
	if (cfg->fc_flags & RTF_GATEWAY) {
2002
		const struct in6_addr *gw_addr;
L
Linus Torvalds 已提交
2003 2004
		int gwa_type;

2005
		gw_addr = &cfg->fc_gateway;
2006
		gwa_type = ipv6_addr_type(gw_addr);
2007 2008 2009 2010 2011 2012 2013

		/* if gw_addr is local we will fail to detect this in case
		 * address is still TENTATIVE (DAD in progress). rt6_lookup()
		 * will return already-added prefix route via interface that
		 * prefix route was assigned to, which might be non-loopback.
		 */
		err = -EINVAL;
2014 2015 2016
		if (ipv6_chk_addr_and_flags(net, gw_addr,
					    gwa_type & IPV6_ADDR_LINKLOCAL ?
					    dev : NULL, 0, 0))
2017 2018
			goto out;

A
Alexey Dobriyan 已提交
2019
		rt->rt6i_gateway = *gw_addr;
L
Linus Torvalds 已提交
2020 2021

		if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
2022
			struct rt6_info *grt = NULL;
L
Linus Torvalds 已提交
2023 2024 2025 2026 2027 2028 2029

			/* IPv6 strictly inhibits using not link-local
			   addresses as nexthop address.
			   Otherwise, router will not able to send redirects.
			   It is very good, but in some (rare!) circumstances
			   (SIT, PtP, NBMA NOARP links) it is handy to allow
			   some exceptions. --ANK
2030 2031
			   We allow IPv4-mapped nexthops to support RFC4798-type
			   addressing
L
Linus Torvalds 已提交
2032
			 */
2033 2034
			if (!(gwa_type & (IPV6_ADDR_UNICAST |
					  IPV6_ADDR_MAPPED)))
L
Linus Torvalds 已提交
2035 2036
				goto out;

2037
			if (cfg->fc_table) {
2038 2039
				grt = ip6_nh_lookup_table(net, cfg, gw_addr);

2040 2041 2042 2043 2044 2045 2046 2047 2048
				if (grt) {
					if (grt->rt6i_flags & RTF_GATEWAY ||
					    (dev && dev != grt->dst.dev)) {
						ip6_rt_put(grt);
						grt = NULL;
					}
				}
			}

2049 2050 2051
			if (!grt)
				grt = rt6_lookup(net, gw_addr, NULL,
						 cfg->fc_ifindex, 1);
L
Linus Torvalds 已提交
2052 2053

			err = -EHOSTUNREACH;
2054
			if (!grt)
L
Linus Torvalds 已提交
2055 2056
				goto out;
			if (dev) {
2057
				if (dev != grt->dst.dev) {
A
Amerigo Wang 已提交
2058
					ip6_rt_put(grt);
L
Linus Torvalds 已提交
2059 2060 2061
					goto out;
				}
			} else {
2062
				dev = grt->dst.dev;
L
Linus Torvalds 已提交
2063 2064 2065 2066
				idev = grt->rt6i_idev;
				dev_hold(dev);
				in6_dev_hold(grt->rt6i_idev);
			}
2067
			if (!(grt->rt6i_flags & RTF_GATEWAY))
L
Linus Torvalds 已提交
2068
				err = 0;
A
Amerigo Wang 已提交
2069
			ip6_rt_put(grt);
L
Linus Torvalds 已提交
2070 2071 2072 2073 2074

			if (err)
				goto out;
		}
		err = -EINVAL;
2075
		if (!dev || (dev->flags & IFF_LOOPBACK))
L
Linus Torvalds 已提交
2076 2077 2078 2079
			goto out;
	}

	err = -ENODEV;
2080
	if (!dev)
L
Linus Torvalds 已提交
2081 2082
		goto out;

2083 2084 2085 2086 2087
	if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
		if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
			err = -EINVAL;
			goto out;
		}
A
Alexey Dobriyan 已提交
2088
		rt->rt6i_prefsrc.addr = cfg->fc_prefsrc;
2089 2090 2091 2092
		rt->rt6i_prefsrc.plen = 128;
	} else
		rt->rt6i_prefsrc.plen = 0;

2093
	rt->rt6i_flags = cfg->fc_flags;
L
Linus Torvalds 已提交
2094 2095

install_route:
2096
	rt->dst.dev = dev;
L
Linus Torvalds 已提交
2097
	rt->rt6i_idev = idev;
T
Thomas Graf 已提交
2098
	rt->rt6i_table = table;
2099

2100
	cfg->fc_nlinfo.nl_net = dev_net(dev);
2101

2102
	return rt;
2103 2104 2105 2106 2107 2108 2109 2110
out:
	if (dev)
		dev_put(dev);
	if (idev)
		in6_dev_put(idev);
	if (rt)
		dst_free(&rt->dst);

2111
	return ERR_PTR(err);
2112 2113 2114 2115 2116
}

int ip6_route_add(struct fib6_config *cfg)
{
	struct mx6_config mxc = { .mx = NULL, };
2117
	struct rt6_info *rt;
2118 2119
	int err;

2120 2121 2122 2123
	rt = ip6_route_info_create(cfg);
	if (IS_ERR(rt)) {
		err = PTR_ERR(rt);
		rt = NULL;
2124
		goto out;
2125
	}
2126

2127 2128 2129
	err = ip6_convert_metrics(&mxc, cfg);
	if (err)
		goto out;
L
Linus Torvalds 已提交
2130

2131 2132 2133
	err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, &mxc);

	kfree(mxc.mx);
2134

2135
	return err;
L
Linus Torvalds 已提交
2136 2137
out:
	if (rt)
2138
		dst_free(&rt->dst);
2139

L
Linus Torvalds 已提交
2140 2141 2142
	return err;
}

2143
static int __ip6_del_rt(struct rt6_info *rt, struct nl_info *info)
L
Linus Torvalds 已提交
2144 2145
{
	int err;
T
Thomas Graf 已提交
2146
	struct fib6_table *table;
2147
	struct net *net = dev_net(rt->dst.dev);
L
Linus Torvalds 已提交
2148

M
Martin KaFai Lau 已提交
2149 2150
	if (rt == net->ipv6.ip6_null_entry ||
	    rt->dst.flags & DST_NOCACHE) {
2151 2152 2153
		err = -ENOENT;
		goto out;
	}
2154

T
Thomas Graf 已提交
2155 2156
	table = rt->rt6i_table;
	write_lock_bh(&table->tb6_lock);
2157
	err = fib6_del(rt, info);
T
Thomas Graf 已提交
2158
	write_unlock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
2159

2160
out:
A
Amerigo Wang 已提交
2161
	ip6_rt_put(rt);
L
Linus Torvalds 已提交
2162 2163 2164
	return err;
}

2165 2166
int ip6_del_rt(struct rt6_info *rt)
{
2167
	struct nl_info info = {
2168
		.nl_net = dev_net(rt->dst.dev),
2169
	};
2170
	return __ip6_del_rt(rt, &info);
2171 2172
}

2173 2174 2175
static int __ip6_del_rt_siblings(struct rt6_info *rt, struct fib6_config *cfg)
{
	struct nl_info *info = &cfg->fc_nlinfo;
2176
	struct net *net = info->nl_net;
2177
	struct sk_buff *skb = NULL;
2178
	struct fib6_table *table;
2179
	int err = -ENOENT;
2180

2181 2182
	if (rt == net->ipv6.ip6_null_entry)
		goto out_put;
2183 2184 2185 2186 2187 2188
	table = rt->rt6i_table;
	write_lock_bh(&table->tb6_lock);

	if (rt->rt6i_nsiblings && cfg->fc_delete_all_nh) {
		struct rt6_info *sibling, *next_sibling;

2189 2190 2191 2192 2193
		/* prefer to send a single notification with all hops */
		skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any());
		if (skb) {
			u32 seq = info->nlh ? info->nlh->nlmsg_seq : 0;

2194
			if (rt6_fill_node(net, skb, rt,
2195 2196 2197 2198 2199 2200 2201 2202
					  NULL, NULL, 0, RTM_DELROUTE,
					  info->portid, seq, 0) < 0) {
				kfree_skb(skb);
				skb = NULL;
			} else
				info->skip_notify = 1;
		}

2203 2204 2205 2206 2207
		list_for_each_entry_safe(sibling, next_sibling,
					 &rt->rt6i_siblings,
					 rt6i_siblings) {
			err = fib6_del(sibling, info);
			if (err)
2208
				goto out_unlock;
2209 2210 2211 2212
		}
	}

	err = fib6_del(rt, info);
2213
out_unlock:
2214
	write_unlock_bh(&table->tb6_lock);
2215
out_put:
2216
	ip6_rt_put(rt);
2217 2218

	if (skb) {
2219
		rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
2220 2221
			    info->nlh, gfp_any());
	}
2222 2223 2224
	return err;
}

2225
static int ip6_route_del(struct fib6_config *cfg)
L
Linus Torvalds 已提交
2226
{
T
Thomas Graf 已提交
2227
	struct fib6_table *table;
L
Linus Torvalds 已提交
2228 2229 2230 2231
	struct fib6_node *fn;
	struct rt6_info *rt;
	int err = -ESRCH;

2232
	table = fib6_get_table(cfg->fc_nlinfo.nl_net, cfg->fc_table);
2233
	if (!table)
T
Thomas Graf 已提交
2234 2235 2236
		return err;

	read_lock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
2237

T
Thomas Graf 已提交
2238
	fn = fib6_locate(&table->tb6_root,
2239 2240
			 &cfg->fc_dst, cfg->fc_dst_len,
			 &cfg->fc_src, cfg->fc_src_len);
2241

L
Linus Torvalds 已提交
2242
	if (fn) {
2243
		for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
2244 2245 2246
			if ((rt->rt6i_flags & RTF_CACHE) &&
			    !(cfg->fc_flags & RTF_CACHE))
				continue;
2247
			if (cfg->fc_ifindex &&
2248 2249
			    (!rt->dst.dev ||
			     rt->dst.dev->ifindex != cfg->fc_ifindex))
L
Linus Torvalds 已提交
2250
				continue;
2251 2252
			if (cfg->fc_flags & RTF_GATEWAY &&
			    !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
L
Linus Torvalds 已提交
2253
				continue;
2254
			if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric)
L
Linus Torvalds 已提交
2255
				continue;
2256 2257
			if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol)
				continue;
2258
			dst_hold(&rt->dst);
T
Thomas Graf 已提交
2259
			read_unlock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
2260

2261 2262 2263 2264 2265
			/* if gateway was specified only delete the one hop */
			if (cfg->fc_flags & RTF_GATEWAY)
				return __ip6_del_rt(rt, &cfg->fc_nlinfo);

			return __ip6_del_rt_siblings(rt, cfg);
L
Linus Torvalds 已提交
2266 2267
		}
	}
T
Thomas Graf 已提交
2268
	read_unlock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
2269 2270 2271 2272

	return err;
}

2273
static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
2274 2275
{
	struct netevent_redirect netevent;
2276 2277 2278 2279
	struct rt6_info *rt, *nrt = NULL;
	struct ndisc_options ndopts;
	struct inet6_dev *in6_dev;
	struct neighbour *neigh;
2280
	struct rd_msg *msg;
2281 2282
	int optlen, on_link;
	u8 *lladdr;
2283

2284
	optlen = skb_tail_pointer(skb) - skb_transport_header(skb);
2285
	optlen -= sizeof(*msg);
2286 2287

	if (optlen < 0) {
2288
		net_dbg_ratelimited("rt6_do_redirect: packet too short\n");
2289 2290 2291
		return;
	}

2292
	msg = (struct rd_msg *)icmp6_hdr(skb);
2293

2294
	if (ipv6_addr_is_multicast(&msg->dest)) {
2295
		net_dbg_ratelimited("rt6_do_redirect: destination address is multicast\n");
2296 2297 2298
		return;
	}

2299
	on_link = 0;
2300
	if (ipv6_addr_equal(&msg->dest, &msg->target)) {
2301
		on_link = 1;
2302
	} else if (ipv6_addr_type(&msg->target) !=
2303
		   (IPV6_ADDR_UNICAST|IPV6_ADDR_LINKLOCAL)) {
2304
		net_dbg_ratelimited("rt6_do_redirect: target address is not link-local unicast\n");
2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318
		return;
	}

	in6_dev = __in6_dev_get(skb->dev);
	if (!in6_dev)
		return;
	if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects)
		return;

	/* RFC2461 8.1:
	 *	The IP source address of the Redirect MUST be the same as the current
	 *	first-hop router for the specified ICMP Destination Address.
	 */

2319
	if (!ndisc_parse_options(skb->dev, msg->opt, optlen, &ndopts)) {
2320 2321 2322
		net_dbg_ratelimited("rt6_redirect: invalid ND options\n");
		return;
	}
2323 2324

	lladdr = NULL;
2325 2326 2327 2328 2329 2330 2331 2332 2333
	if (ndopts.nd_opts_tgt_lladdr) {
		lladdr = ndisc_opt_addr_data(ndopts.nd_opts_tgt_lladdr,
					     skb->dev);
		if (!lladdr) {
			net_dbg_ratelimited("rt6_redirect: invalid link-layer address length\n");
			return;
		}
	}

2334
	rt = (struct rt6_info *) dst;
2335
	if (rt->rt6i_flags & RTF_REJECT) {
2336
		net_dbg_ratelimited("rt6_redirect: source isn't a valid nexthop for redirect target\n");
2337
		return;
2338
	}
2339

2340 2341 2342 2343
	/* Redirect received -> path was valid.
	 * Look, redirects are sent only in response to data packets,
	 * so that this nexthop apparently is reachable. --ANK
	 */
2344
	dst_confirm_neigh(&rt->dst, &ipv6_hdr(skb)->saddr);
2345

2346
	neigh = __neigh_lookup(&nd_tbl, &msg->target, skb->dev, 1);
2347 2348
	if (!neigh)
		return;
2349

L
Linus Torvalds 已提交
2350 2351 2352 2353
	/*
	 *	We have finally decided to accept it.
	 */

2354
	ndisc_update(skb->dev, neigh, lladdr, NUD_STALE,
L
Linus Torvalds 已提交
2355 2356 2357
		     NEIGH_UPDATE_F_WEAK_OVERRIDE|
		     NEIGH_UPDATE_F_OVERRIDE|
		     (on_link ? 0 : (NEIGH_UPDATE_F_OVERRIDE_ISROUTER|
2358 2359
				     NEIGH_UPDATE_F_ISROUTER)),
		     NDISC_REDIRECT, &ndopts);
L
Linus Torvalds 已提交
2360

M
Martin KaFai Lau 已提交
2361
	nrt = ip6_rt_cache_alloc(rt, &msg->dest, NULL);
2362
	if (!nrt)
L
Linus Torvalds 已提交
2363 2364 2365 2366 2367 2368
		goto out;

	nrt->rt6i_flags = RTF_GATEWAY|RTF_UP|RTF_DYNAMIC|RTF_CACHE;
	if (on_link)
		nrt->rt6i_flags &= ~RTF_GATEWAY;

A
Alexey Dobriyan 已提交
2369
	nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
L
Linus Torvalds 已提交
2370

2371
	if (ip6_ins_rt(nrt))
L
Linus Torvalds 已提交
2372 2373
		goto out;

2374 2375
	netevent.old = &rt->dst;
	netevent.new = &nrt->dst;
2376
	netevent.daddr = &msg->dest;
2377
	netevent.neigh = neigh;
2378 2379
	call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);

2380
	if (rt->rt6i_flags & RTF_CACHE) {
2381
		rt = (struct rt6_info *) dst_clone(&rt->dst);
2382
		ip6_del_rt(rt);
L
Linus Torvalds 已提交
2383 2384 2385
	}

out:
2386
	neigh_release(neigh);
2387 2388
}

L
Linus Torvalds 已提交
2389 2390 2391 2392
/*
 *	Misc support functions
 */

2393 2394 2395 2396 2397 2398 2399 2400 2401 2402
static void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
{
	BUG_ON(from->dst.from);

	rt->rt6i_flags &= ~RTF_EXPIRES;
	dst_hold(&from->dst);
	rt->dst.from = &from->dst;
	dst_init_metrics(&rt->dst, dst_metrics_ptr(&from->dst), true);
}

M
Martin KaFai Lau 已提交
2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416
static void ip6_rt_copy_init(struct rt6_info *rt, struct rt6_info *ort)
{
	rt->dst.input = ort->dst.input;
	rt->dst.output = ort->dst.output;
	rt->rt6i_dst = ort->rt6i_dst;
	rt->dst.error = ort->dst.error;
	rt->rt6i_idev = ort->rt6i_idev;
	if (rt->rt6i_idev)
		in6_dev_hold(rt->rt6i_idev);
	rt->dst.lastuse = jiffies;
	rt->rt6i_gateway = ort->rt6i_gateway;
	rt->rt6i_flags = ort->rt6i_flags;
	rt6_set_from(rt, ort);
	rt->rt6i_metric = ort->rt6i_metric;
L
Linus Torvalds 已提交
2417
#ifdef CONFIG_IPV6_SUBTREES
M
Martin KaFai Lau 已提交
2418
	rt->rt6i_src = ort->rt6i_src;
L
Linus Torvalds 已提交
2419
#endif
M
Martin KaFai Lau 已提交
2420 2421
	rt->rt6i_prefsrc = ort->rt6i_prefsrc;
	rt->rt6i_table = ort->rt6i_table;
2422
	rt->dst.lwtstate = lwtstate_get(ort->dst.lwtstate);
L
Linus Torvalds 已提交
2423 2424
}

2425
#ifdef CONFIG_IPV6_ROUTE_INFO
2426
static struct rt6_info *rt6_get_route_info(struct net *net,
2427
					   const struct in6_addr *prefix, int prefixlen,
2428 2429
					   const struct in6_addr *gwaddr,
					   struct net_device *dev)
2430
{
2431 2432
	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_INFO;
	int ifindex = dev->ifindex;
2433 2434
	struct fib6_node *fn;
	struct rt6_info *rt = NULL;
T
Thomas Graf 已提交
2435 2436
	struct fib6_table *table;

2437
	table = fib6_get_table(net, tb_id);
2438
	if (!table)
T
Thomas Graf 已提交
2439
		return NULL;
2440

2441
	read_lock_bh(&table->tb6_lock);
2442
	fn = fib6_locate(&table->tb6_root, prefix, prefixlen, NULL, 0);
2443 2444 2445
	if (!fn)
		goto out;

2446
	for (rt = fn->leaf; rt; rt = rt->dst.rt6_next) {
2447
		if (rt->dst.dev->ifindex != ifindex)
2448 2449 2450 2451 2452
			continue;
		if ((rt->rt6i_flags & (RTF_ROUTEINFO|RTF_GATEWAY)) != (RTF_ROUTEINFO|RTF_GATEWAY))
			continue;
		if (!ipv6_addr_equal(&rt->rt6i_gateway, gwaddr))
			continue;
2453
		dst_hold(&rt->dst);
2454 2455 2456
		break;
	}
out:
2457
	read_unlock_bh(&table->tb6_lock);
2458 2459 2460
	return rt;
}

2461
static struct rt6_info *rt6_add_route_info(struct net *net,
2462
					   const struct in6_addr *prefix, int prefixlen,
2463 2464
					   const struct in6_addr *gwaddr,
					   struct net_device *dev,
2465
					   unsigned int pref)
2466
{
2467
	struct fib6_config cfg = {
2468
		.fc_metric	= IP6_RT_PRIO_USER,
2469
		.fc_ifindex	= dev->ifindex,
2470 2471 2472
		.fc_dst_len	= prefixlen,
		.fc_flags	= RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
				  RTF_UP | RTF_PREF(pref),
2473
		.fc_nlinfo.portid = 0,
2474 2475
		.fc_nlinfo.nlh = NULL,
		.fc_nlinfo.nl_net = net,
2476 2477
	};

2478
	cfg.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_INFO,
A
Alexey Dobriyan 已提交
2479 2480
	cfg.fc_dst = *prefix;
	cfg.fc_gateway = *gwaddr;
2481

2482 2483
	/* We should treat it as a default route if prefix length is 0. */
	if (!prefixlen)
2484
		cfg.fc_flags |= RTF_DEFAULT;
2485

2486
	ip6_route_add(&cfg);
2487

2488
	return rt6_get_route_info(net, prefix, prefixlen, gwaddr, dev);
2489 2490 2491
}
#endif

2492
struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_device *dev)
2493
{
2494
	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_DFLT;
L
Linus Torvalds 已提交
2495
	struct rt6_info *rt;
T
Thomas Graf 已提交
2496
	struct fib6_table *table;
L
Linus Torvalds 已提交
2497

2498
	table = fib6_get_table(dev_net(dev), tb_id);
2499
	if (!table)
T
Thomas Graf 已提交
2500
		return NULL;
L
Linus Torvalds 已提交
2501

2502
	read_lock_bh(&table->tb6_lock);
2503
	for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
2504
		if (dev == rt->dst.dev &&
2505
		    ((rt->rt6i_flags & (RTF_ADDRCONF | RTF_DEFAULT)) == (RTF_ADDRCONF | RTF_DEFAULT)) &&
L
Linus Torvalds 已提交
2506 2507 2508 2509
		    ipv6_addr_equal(&rt->rt6i_gateway, addr))
			break;
	}
	if (rt)
2510
		dst_hold(&rt->dst);
2511
	read_unlock_bh(&table->tb6_lock);
L
Linus Torvalds 已提交
2512 2513 2514
	return rt;
}

2515
struct rt6_info *rt6_add_dflt_router(const struct in6_addr *gwaddr,
2516 2517
				     struct net_device *dev,
				     unsigned int pref)
L
Linus Torvalds 已提交
2518
{
2519
	struct fib6_config cfg = {
D
David Ahern 已提交
2520
		.fc_table	= l3mdev_fib_table(dev) ? : RT6_TABLE_DFLT,
2521
		.fc_metric	= IP6_RT_PRIO_USER,
2522 2523 2524
		.fc_ifindex	= dev->ifindex,
		.fc_flags	= RTF_GATEWAY | RTF_ADDRCONF | RTF_DEFAULT |
				  RTF_UP | RTF_EXPIRES | RTF_PREF(pref),
2525
		.fc_nlinfo.portid = 0,
2526
		.fc_nlinfo.nlh = NULL,
2527
		.fc_nlinfo.nl_net = dev_net(dev),
2528
	};
L
Linus Torvalds 已提交
2529

A
Alexey Dobriyan 已提交
2530
	cfg.fc_gateway = *gwaddr;
L
Linus Torvalds 已提交
2531

2532 2533 2534 2535 2536 2537 2538
	if (!ip6_route_add(&cfg)) {
		struct fib6_table *table;

		table = fib6_get_table(dev_net(dev), cfg.fc_table);
		if (table)
			table->flags |= RT6_TABLE_HAS_DFLT_ROUTER;
	}
L
Linus Torvalds 已提交
2539 2540 2541 2542

	return rt6_get_dflt_router(gwaddr, dev);
}

2543
static void __rt6_purge_dflt_routers(struct fib6_table *table)
L
Linus Torvalds 已提交
2544 2545 2546 2547
{
	struct rt6_info *rt;

restart:
T
Thomas Graf 已提交
2548
	read_lock_bh(&table->tb6_lock);
2549
	for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
2550 2551
		if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
		    (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
2552
			dst_hold(&rt->dst);
T
Thomas Graf 已提交
2553
			read_unlock_bh(&table->tb6_lock);
2554
			ip6_del_rt(rt);
L
Linus Torvalds 已提交
2555 2556 2557
			goto restart;
		}
	}
T
Thomas Graf 已提交
2558
	read_unlock_bh(&table->tb6_lock);
2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579

	table->flags &= ~RT6_TABLE_HAS_DFLT_ROUTER;
}

void rt6_purge_dflt_routers(struct net *net)
{
	struct fib6_table *table;
	struct hlist_head *head;
	unsigned int h;

	rcu_read_lock();

	for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
		head = &net->ipv6.fib_table_hash[h];
		hlist_for_each_entry_rcu(table, head, tb6_hlist) {
			if (table->flags & RT6_TABLE_HAS_DFLT_ROUTER)
				__rt6_purge_dflt_routers(table);
		}
	}

	rcu_read_unlock();
L
Linus Torvalds 已提交
2580 2581
}

2582 2583
static void rtmsg_to_fib6_config(struct net *net,
				 struct in6_rtmsg *rtmsg,
2584 2585 2586 2587
				 struct fib6_config *cfg)
{
	memset(cfg, 0, sizeof(*cfg));

D
David Ahern 已提交
2588 2589
	cfg->fc_table = l3mdev_fib_table_by_index(net, rtmsg->rtmsg_ifindex) ?
			 : RT6_TABLE_MAIN;
2590 2591 2592 2593 2594 2595 2596
	cfg->fc_ifindex = rtmsg->rtmsg_ifindex;
	cfg->fc_metric = rtmsg->rtmsg_metric;
	cfg->fc_expires = rtmsg->rtmsg_info;
	cfg->fc_dst_len = rtmsg->rtmsg_dst_len;
	cfg->fc_src_len = rtmsg->rtmsg_src_len;
	cfg->fc_flags = rtmsg->rtmsg_flags;

2597
	cfg->fc_nlinfo.nl_net = net;
2598

A
Alexey Dobriyan 已提交
2599 2600 2601
	cfg->fc_dst = rtmsg->rtmsg_dst;
	cfg->fc_src = rtmsg->rtmsg_src;
	cfg->fc_gateway = rtmsg->rtmsg_gateway;
2602 2603
}

2604
int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
L
Linus Torvalds 已提交
2605
{
2606
	struct fib6_config cfg;
L
Linus Torvalds 已提交
2607 2608 2609
	struct in6_rtmsg rtmsg;
	int err;

2610
	switch (cmd) {
L
Linus Torvalds 已提交
2611 2612
	case SIOCADDRT:		/* Add a route */
	case SIOCDELRT:		/* Delete a route */
2613
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
L
Linus Torvalds 已提交
2614 2615 2616 2617 2618
			return -EPERM;
		err = copy_from_user(&rtmsg, arg,
				     sizeof(struct in6_rtmsg));
		if (err)
			return -EFAULT;
2619

2620
		rtmsg_to_fib6_config(net, &rtmsg, &cfg);
2621

L
Linus Torvalds 已提交
2622 2623 2624
		rtnl_lock();
		switch (cmd) {
		case SIOCADDRT:
2625
			err = ip6_route_add(&cfg);
L
Linus Torvalds 已提交
2626 2627
			break;
		case SIOCDELRT:
2628
			err = ip6_route_del(&cfg);
L
Linus Torvalds 已提交
2629 2630 2631 2632 2633 2634 2635
			break;
		default:
			err = -EINVAL;
		}
		rtnl_unlock();

		return err;
2636
	}
L
Linus Torvalds 已提交
2637 2638 2639 2640 2641 2642 2643 2644

	return -EINVAL;
}

/*
 *	Drop the packet on the floor
 */

2645
static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
L
Linus Torvalds 已提交
2646
{
2647
	int type;
E
Eric Dumazet 已提交
2648
	struct dst_entry *dst = skb_dst(skb);
2649 2650
	switch (ipstats_mib_noroutes) {
	case IPSTATS_MIB_INNOROUTES:
2651
		type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
U
Ulrich Weber 已提交
2652
		if (type == IPV6_ADDR_ANY) {
2653 2654
			IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
				      IPSTATS_MIB_INADDRERRORS);
2655 2656 2657 2658
			break;
		}
		/* FALLTHROUGH */
	case IPSTATS_MIB_OUTNOROUTES:
2659 2660
		IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
			      ipstats_mib_noroutes);
2661 2662
		break;
	}
2663
	icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0);
L
Linus Torvalds 已提交
2664 2665 2666 2667
	kfree_skb(skb);
	return 0;
}

2668 2669
static int ip6_pkt_discard(struct sk_buff *skb)
{
2670
	return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_INNOROUTES);
2671 2672
}

E
Eric W. Biederman 已提交
2673
static int ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb)
L
Linus Torvalds 已提交
2674
{
E
Eric Dumazet 已提交
2675
	skb->dev = skb_dst(skb)->dev;
2676
	return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
2677 2678
}

2679 2680
static int ip6_pkt_prohibit(struct sk_buff *skb)
{
2681
	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
2682 2683
}

E
Eric W. Biederman 已提交
2684
static int ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb)
2685
{
E
Eric Dumazet 已提交
2686
	skb->dev = skb_dst(skb)->dev;
2687
	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
2688 2689
}

L
Linus Torvalds 已提交
2690 2691 2692 2693 2694 2695
/*
 *	Allocate a dst for local (unicast / anycast) address.
 */

struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
				    const struct in6_addr *addr,
2696
				    bool anycast)
L
Linus Torvalds 已提交
2697
{
D
David Ahern 已提交
2698
	u32 tb_id;
2699
	struct net *net = dev_net(idev->dev);
2700 2701 2702 2703 2704 2705 2706 2707 2708 2709
	struct net_device *dev = net->loopback_dev;
	struct rt6_info *rt;

	/* use L3 Master device as loopback for host routes if device
	 * is enslaved and address is not link local or multicast
	 */
	if (!rt6_need_strict(addr))
		dev = l3mdev_master_dev_rcu(idev->dev) ? : dev;

	rt = ip6_dst_alloc(net, dev, DST_NOCOUNT);
2710
	if (!rt)
L
Linus Torvalds 已提交
2711 2712 2713 2714
		return ERR_PTR(-ENOMEM);

	in6_dev_hold(idev);

2715
	rt->dst.flags |= DST_HOST;
2716 2717
	rt->dst.input = ip6_input;
	rt->dst.output = ip6_output;
L
Linus Torvalds 已提交
2718 2719
	rt->rt6i_idev = idev;

2720
	rt->rt6i_protocol = RTPROT_KERNEL;
L
Linus Torvalds 已提交
2721
	rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
2722 2723 2724
	if (anycast)
		rt->rt6i_flags |= RTF_ANYCAST;
	else
L
Linus Torvalds 已提交
2725 2726
		rt->rt6i_flags |= RTF_LOCAL;

2727
	rt->rt6i_gateway  = *addr;
A
Alexey Dobriyan 已提交
2728
	rt->rt6i_dst.addr = *addr;
L
Linus Torvalds 已提交
2729
	rt->rt6i_dst.plen = 128;
D
David Ahern 已提交
2730 2731
	tb_id = l3mdev_fib_table(idev->dev) ? : RT6_TABLE_LOCAL;
	rt->rt6i_table = fib6_get_table(net, tb_id);
M
Martin KaFai Lau 已提交
2732
	rt->dst.flags |= DST_NOCACHE;
L
Linus Torvalds 已提交
2733

2734
	atomic_set(&rt->dst.__refcnt, 1);
L
Linus Torvalds 已提交
2735 2736 2737 2738

	return rt;
}

2739 2740 2741 2742 2743 2744 2745 2746 2747 2748 2749 2750 2751
/* remove deleted ip from prefsrc entries */
struct arg_dev_net_ip {
	struct net_device *dev;
	struct net *net;
	struct in6_addr *addr;
};

static int fib6_remove_prefsrc(struct rt6_info *rt, void *arg)
{
	struct net_device *dev = ((struct arg_dev_net_ip *)arg)->dev;
	struct net *net = ((struct arg_dev_net_ip *)arg)->net;
	struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;

2752
	if (((void *)rt->dst.dev == dev || !dev) &&
2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768
	    rt != net->ipv6.ip6_null_entry &&
	    ipv6_addr_equal(addr, &rt->rt6i_prefsrc.addr)) {
		/* remove prefsrc entry */
		rt->rt6i_prefsrc.plen = 0;
	}
	return 0;
}

void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
{
	struct net *net = dev_net(ifp->idev->dev);
	struct arg_dev_net_ip adni = {
		.dev = ifp->idev->dev,
		.net = net,
		.addr = &ifp->addr,
	};
2769
	fib6_clean_all(net, fib6_remove_prefsrc, &adni);
2770 2771
}

2772 2773 2774 2775 2776 2777 2778 2779 2780 2781 2782 2783 2784 2785 2786 2787 2788 2789 2790 2791 2792
#define RTF_RA_ROUTER		(RTF_ADDRCONF | RTF_DEFAULT | RTF_GATEWAY)
#define RTF_CACHE_GATEWAY	(RTF_GATEWAY | RTF_CACHE)

/* Remove routers and update dst entries when gateway turn into host. */
static int fib6_clean_tohost(struct rt6_info *rt, void *arg)
{
	struct in6_addr *gateway = (struct in6_addr *)arg;

	if ((((rt->rt6i_flags & RTF_RA_ROUTER) == RTF_RA_ROUTER) ||
	     ((rt->rt6i_flags & RTF_CACHE_GATEWAY) == RTF_CACHE_GATEWAY)) &&
	     ipv6_addr_equal(gateway, &rt->rt6i_gateway)) {
		return -1;
	}
	return 0;
}

void rt6_clean_tohost(struct net *net, struct in6_addr *gateway)
{
	fib6_clean_all(net, fib6_clean_tohost, gateway);
}

2793 2794 2795 2796 2797
struct arg_dev_net {
	struct net_device *dev;
	struct net *net;
};

2798
/* called with write lock held for table with rt */
L
Linus Torvalds 已提交
2799 2800
static int fib6_ifdown(struct rt6_info *rt, void *arg)
{
S
stephen hemminger 已提交
2801 2802
	const struct arg_dev_net *adn = arg;
	const struct net_device *dev = adn->dev;
2803

2804
	if ((rt->dst.dev == dev || !dev) &&
2805 2806 2807
	    rt != adn->net->ipv6.ip6_null_entry &&
	    (rt->rt6i_nsiblings == 0 ||
	     !rt->rt6i_idev->cnf.ignore_routes_with_linkdown))
L
Linus Torvalds 已提交
2808
		return -1;
2809

L
Linus Torvalds 已提交
2810 2811 2812
	return 0;
}

2813
void rt6_ifdown(struct net *net, struct net_device *dev)
L
Linus Torvalds 已提交
2814
{
2815 2816 2817 2818 2819
	struct arg_dev_net adn = {
		.dev = dev,
		.net = net,
	};

2820
	fib6_clean_all(net, fib6_ifdown, &adn);
2821
	icmp6_clean_all(fib6_ifdown, &adn);
2822 2823
	if (dev)
		rt6_uncached_list_flush_dev(net, dev);
L
Linus Torvalds 已提交
2824 2825
}

2826
struct rt6_mtu_change_arg {
L
Linus Torvalds 已提交
2827
	struct net_device *dev;
2828
	unsigned int mtu;
L
Linus Torvalds 已提交
2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842
};

static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
{
	struct rt6_mtu_change_arg *arg = (struct rt6_mtu_change_arg *) p_arg;
	struct inet6_dev *idev;

	/* In IPv6 pmtu discovery is not optional,
	   so that RTAX_MTU lock cannot disable it.
	   We still use this lock to block changes
	   caused by addrconf/ndisc.
	*/

	idev = __in6_dev_get(arg->dev);
2843
	if (!idev)
L
Linus Torvalds 已提交
2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857
		return 0;

	/* For administrative MTU increase, there is no way to discover
	   IPv6 PMTU increase, so PMTU increase should be updated here.
	   Since RFC 1981 doesn't include administrative MTU increase
	   update PMTU increase is a MUST. (i.e. jumbo frame)
	 */
	/*
	   If new MTU is less than route PMTU, this new MTU will be the
	   lowest MTU in the path, update the route PMTU to reflect PMTU
	   decreases; if new MTU is greater than route PMTU, and the
	   old MTU is the lowest MTU in the path, update the route PMTU
	   to reflect the increase. In this case if the other nodes' MTU
	   also have the lowest MTU, TOO BIG MESSAGE will be lead to
A
Alexander Alemayhu 已提交
2858
	   PMTU discovery.
L
Linus Torvalds 已提交
2859
	 */
2860
	if (rt->dst.dev == arg->dev &&
2861
	    dst_metric_raw(&rt->dst, RTAX_MTU) &&
2862 2863 2864 2865 2866 2867 2868 2869 2870 2871 2872 2873 2874 2875
	    !dst_metric_locked(&rt->dst, RTAX_MTU)) {
		if (rt->rt6i_flags & RTF_CACHE) {
			/* For RTF_CACHE with rt6i_pmtu == 0
			 * (i.e. a redirected route),
			 * the metrics of its rt->dst.from has already
			 * been updated.
			 */
			if (rt->rt6i_pmtu && rt->rt6i_pmtu > arg->mtu)
				rt->rt6i_pmtu = arg->mtu;
		} else if (dst_mtu(&rt->dst) >= arg->mtu ||
			   (dst_mtu(&rt->dst) < arg->mtu &&
			    dst_mtu(&rt->dst) == idev->cnf.mtu6)) {
			dst_metric_set(&rt->dst, RTAX_MTU, arg->mtu);
		}
2876
	}
L
Linus Torvalds 已提交
2877 2878 2879
	return 0;
}

2880
void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
L
Linus Torvalds 已提交
2881
{
T
Thomas Graf 已提交
2882 2883 2884 2885
	struct rt6_mtu_change_arg arg = {
		.dev = dev,
		.mtu = mtu,
	};
L
Linus Torvalds 已提交
2886

2887
	fib6_clean_all(dev_net(dev), rt6_mtu_change_route, &arg);
L
Linus Torvalds 已提交
2888 2889
}

2890
static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
2891
	[RTA_GATEWAY]           = { .len = sizeof(struct in6_addr) },
2892
	[RTA_OIF]               = { .type = NLA_U32 },
2893
	[RTA_IIF]		= { .type = NLA_U32 },
2894 2895
	[RTA_PRIORITY]          = { .type = NLA_U32 },
	[RTA_METRICS]           = { .type = NLA_NESTED },
2896
	[RTA_MULTIPATH]		= { .len = sizeof(struct rtnexthop) },
2897
	[RTA_PREF]              = { .type = NLA_U8 },
2898 2899
	[RTA_ENCAP_TYPE]	= { .type = NLA_U16 },
	[RTA_ENCAP]		= { .type = NLA_NESTED },
2900
	[RTA_EXPIRES]		= { .type = NLA_U32 },
2901
	[RTA_UID]		= { .type = NLA_U32 },
2902
	[RTA_MARK]		= { .type = NLA_U32 },
2903 2904 2905 2906
};

static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
			      struct fib6_config *cfg)
L
Linus Torvalds 已提交
2907
{
2908 2909
	struct rtmsg *rtm;
	struct nlattr *tb[RTA_MAX+1];
2910
	unsigned int pref;
2911
	int err;
L
Linus Torvalds 已提交
2912

2913 2914 2915
	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
	if (err < 0)
		goto errout;
L
Linus Torvalds 已提交
2916

2917 2918 2919 2920 2921 2922 2923 2924 2925
	err = -EINVAL;
	rtm = nlmsg_data(nlh);
	memset(cfg, 0, sizeof(*cfg));

	cfg->fc_table = rtm->rtm_table;
	cfg->fc_dst_len = rtm->rtm_dst_len;
	cfg->fc_src_len = rtm->rtm_src_len;
	cfg->fc_flags = RTF_UP;
	cfg->fc_protocol = rtm->rtm_protocol;
2926
	cfg->fc_type = rtm->rtm_type;
2927

2928 2929
	if (rtm->rtm_type == RTN_UNREACHABLE ||
	    rtm->rtm_type == RTN_BLACKHOLE ||
2930 2931
	    rtm->rtm_type == RTN_PROHIBIT ||
	    rtm->rtm_type == RTN_THROW)
2932 2933
		cfg->fc_flags |= RTF_REJECT;

2934 2935 2936
	if (rtm->rtm_type == RTN_LOCAL)
		cfg->fc_flags |= RTF_LOCAL;

2937 2938 2939
	if (rtm->rtm_flags & RTM_F_CLONED)
		cfg->fc_flags |= RTF_CACHE;

2940
	cfg->fc_nlinfo.portid = NETLINK_CB(skb).portid;
2941
	cfg->fc_nlinfo.nlh = nlh;
2942
	cfg->fc_nlinfo.nl_net = sock_net(skb->sk);
2943 2944

	if (tb[RTA_GATEWAY]) {
2945
		cfg->fc_gateway = nla_get_in6_addr(tb[RTA_GATEWAY]);
2946
		cfg->fc_flags |= RTF_GATEWAY;
L
Linus Torvalds 已提交
2947
	}
2948 2949 2950 2951 2952 2953 2954 2955

	if (tb[RTA_DST]) {
		int plen = (rtm->rtm_dst_len + 7) >> 3;

		if (nla_len(tb[RTA_DST]) < plen)
			goto errout;

		nla_memcpy(&cfg->fc_dst, tb[RTA_DST], plen);
L
Linus Torvalds 已提交
2956
	}
2957 2958 2959 2960 2961 2962 2963 2964

	if (tb[RTA_SRC]) {
		int plen = (rtm->rtm_src_len + 7) >> 3;

		if (nla_len(tb[RTA_SRC]) < plen)
			goto errout;

		nla_memcpy(&cfg->fc_src, tb[RTA_SRC], plen);
L
Linus Torvalds 已提交
2965
	}
2966

2967
	if (tb[RTA_PREFSRC])
2968
		cfg->fc_prefsrc = nla_get_in6_addr(tb[RTA_PREFSRC]);
2969

2970 2971 2972 2973 2974 2975 2976 2977 2978
	if (tb[RTA_OIF])
		cfg->fc_ifindex = nla_get_u32(tb[RTA_OIF]);

	if (tb[RTA_PRIORITY])
		cfg->fc_metric = nla_get_u32(tb[RTA_PRIORITY]);

	if (tb[RTA_METRICS]) {
		cfg->fc_mx = nla_data(tb[RTA_METRICS]);
		cfg->fc_mx_len = nla_len(tb[RTA_METRICS]);
L
Linus Torvalds 已提交
2979
	}
2980 2981 2982 2983

	if (tb[RTA_TABLE])
		cfg->fc_table = nla_get_u32(tb[RTA_TABLE]);

2984 2985 2986
	if (tb[RTA_MULTIPATH]) {
		cfg->fc_mp = nla_data(tb[RTA_MULTIPATH]);
		cfg->fc_mp_len = nla_len(tb[RTA_MULTIPATH]);
2987 2988 2989 2990 2991

		err = lwtunnel_valid_encap_type_attr(cfg->fc_mp,
						     cfg->fc_mp_len);
		if (err < 0)
			goto errout;
2992 2993
	}

2994 2995 2996 2997 2998 2999 3000 3001
	if (tb[RTA_PREF]) {
		pref = nla_get_u8(tb[RTA_PREF]);
		if (pref != ICMPV6_ROUTER_PREF_LOW &&
		    pref != ICMPV6_ROUTER_PREF_HIGH)
			pref = ICMPV6_ROUTER_PREF_MEDIUM;
		cfg->fc_flags |= RTF_PREF(pref);
	}

3002 3003 3004
	if (tb[RTA_ENCAP])
		cfg->fc_encap = tb[RTA_ENCAP];

3005
	if (tb[RTA_ENCAP_TYPE]) {
3006 3007
		cfg->fc_encap_type = nla_get_u16(tb[RTA_ENCAP_TYPE]);

3008 3009 3010 3011 3012
		err = lwtunnel_valid_encap_type(cfg->fc_encap_type);
		if (err < 0)
			goto errout;
	}

3013 3014 3015 3016 3017 3018 3019 3020 3021
	if (tb[RTA_EXPIRES]) {
		unsigned long timeout = addrconf_timeout_fixup(nla_get_u32(tb[RTA_EXPIRES]), HZ);

		if (addrconf_finite_timeout(timeout)) {
			cfg->fc_expires = jiffies_to_clock_t(timeout * HZ);
			cfg->fc_flags |= RTF_EXPIRES;
		}
	}

3022 3023 3024
	err = 0;
errout:
	return err;
L
Linus Torvalds 已提交
3025 3026
}

3027 3028 3029 3030 3031 3032 3033 3034 3035 3036 3037 3038
struct rt6_nh {
	struct rt6_info *rt6_info;
	struct fib6_config r_cfg;
	struct mx6_config mxc;
	struct list_head next;
};

static void ip6_print_replace_route_err(struct list_head *rt6_nh_list)
{
	struct rt6_nh *nh;

	list_for_each_entry(nh, rt6_nh_list, next) {
3039
		pr_warn("IPV6: multipath route replace failed (check consistency of installed routes): %pI6c nexthop %pI6c ifi %d\n",
3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050 3051 3052 3053 3054 3055 3056 3057 3058 3059 3060 3061 3062 3063 3064 3065 3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077
		        &nh->r_cfg.fc_dst, &nh->r_cfg.fc_gateway,
		        nh->r_cfg.fc_ifindex);
	}
}

static int ip6_route_info_append(struct list_head *rt6_nh_list,
				 struct rt6_info *rt, struct fib6_config *r_cfg)
{
	struct rt6_nh *nh;
	struct rt6_info *rtnh;
	int err = -EEXIST;

	list_for_each_entry(nh, rt6_nh_list, next) {
		/* check if rt6_info already exists */
		rtnh = nh->rt6_info;

		if (rtnh->dst.dev == rt->dst.dev &&
		    rtnh->rt6i_idev == rt->rt6i_idev &&
		    ipv6_addr_equal(&rtnh->rt6i_gateway,
				    &rt->rt6i_gateway))
			return err;
	}

	nh = kzalloc(sizeof(*nh), GFP_KERNEL);
	if (!nh)
		return -ENOMEM;
	nh->rt6_info = rt;
	err = ip6_convert_metrics(&nh->mxc, r_cfg);
	if (err) {
		kfree(nh);
		return err;
	}
	memcpy(&nh->r_cfg, r_cfg, sizeof(*r_cfg));
	list_add_tail(&nh->next, rt6_nh_list);

	return 0;
}

3078 3079 3080 3081 3082 3083 3084 3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098
static void ip6_route_mpath_notify(struct rt6_info *rt,
				   struct rt6_info *rt_last,
				   struct nl_info *info,
				   __u16 nlflags)
{
	/* if this is an APPEND route, then rt points to the first route
	 * inserted and rt_last points to last route inserted. Userspace
	 * wants a consistent dump of the route which starts at the first
	 * nexthop. Since sibling routes are always added at the end of
	 * the list, find the first sibling of the last route appended
	 */
	if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->rt6i_nsiblings) {
		rt = list_first_entry(&rt_last->rt6i_siblings,
				      struct rt6_info,
				      rt6i_siblings);
	}

	if (rt)
		inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags);
}

3099
static int ip6_route_multipath_add(struct fib6_config *cfg)
3100
{
3101 3102
	struct rt6_info *rt_notif = NULL, *rt_last = NULL;
	struct nl_info *info = &cfg->fc_nlinfo;
3103 3104
	struct fib6_config r_cfg;
	struct rtnexthop *rtnh;
3105 3106 3107
	struct rt6_info *rt;
	struct rt6_nh *err_nh;
	struct rt6_nh *nh, *nh_safe;
3108
	__u16 nlflags;
3109 3110
	int remaining;
	int attrlen;
3111 3112 3113 3114 3115
	int err = 1;
	int nhn = 0;
	int replace = (cfg->fc_nlinfo.nlh &&
		       (cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_REPLACE));
	LIST_HEAD(rt6_nh_list);
3116

3117 3118 3119 3120
	nlflags = replace ? NLM_F_REPLACE : NLM_F_CREATE;
	if (info->nlh && info->nlh->nlmsg_flags & NLM_F_APPEND)
		nlflags |= NLM_F_APPEND;

3121
	remaining = cfg->fc_mp_len;
3122 3123
	rtnh = (struct rtnexthop *)cfg->fc_mp;

3124 3125 3126
	/* Parse a Multipath Entry and build a list (rt6_nh_list) of
	 * rt6_info structs per nexthop
	 */
3127 3128 3129 3130 3131 3132 3133 3134 3135 3136 3137
	while (rtnh_ok(rtnh, remaining)) {
		memcpy(&r_cfg, cfg, sizeof(*cfg));
		if (rtnh->rtnh_ifindex)
			r_cfg.fc_ifindex = rtnh->rtnh_ifindex;

		attrlen = rtnh_attrlen(rtnh);
		if (attrlen > 0) {
			struct nlattr *nla, *attrs = rtnh_attrs(rtnh);

			nla = nla_find(attrs, attrlen, RTA_GATEWAY);
			if (nla) {
3138
				r_cfg.fc_gateway = nla_get_in6_addr(nla);
3139 3140
				r_cfg.fc_flags |= RTF_GATEWAY;
			}
3141 3142 3143 3144
			r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);
			nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
			if (nla)
				r_cfg.fc_encap_type = nla_get_u16(nla);
3145
		}
3146

3147 3148 3149 3150
		rt = ip6_route_info_create(&r_cfg);
		if (IS_ERR(rt)) {
			err = PTR_ERR(rt);
			rt = NULL;
3151
			goto cleanup;
3152
		}
3153 3154

		err = ip6_route_info_append(&rt6_nh_list, rt, &r_cfg);
3155
		if (err) {
3156 3157 3158 3159 3160 3161 3162
			dst_free(&rt->dst);
			goto cleanup;
		}

		rtnh = rtnh_next(rtnh, &remaining);
	}

3163 3164 3165 3166 3167 3168
	/* for add and replace send one notification with all nexthops.
	 * Skip the notification in fib6_add_rt2node and send one with
	 * the full route when done
	 */
	info->skip_notify = 1;

3169 3170
	err_nh = NULL;
	list_for_each_entry(nh, &rt6_nh_list, next) {
3171 3172 3173 3174 3175 3176
		rt_last = nh->rt6_info;
		err = __ip6_ins_rt(nh->rt6_info, info, &nh->mxc);
		/* save reference to first route for notification */
		if (!rt_notif && !err)
			rt_notif = nh->rt6_info;

3177 3178 3179 3180 3181 3182 3183
		/* nh->rt6_info is used or freed at this point, reset to NULL*/
		nh->rt6_info = NULL;
		if (err) {
			if (replace && nhn)
				ip6_print_replace_route_err(&rt6_nh_list);
			err_nh = nh;
			goto add_errout;
3184
		}
3185

3186
		/* Because each route is added like a single route we remove
3187 3188 3189 3190 3191
		 * these flags after the first nexthop: if there is a collision,
		 * we have already failed to add the first nexthop:
		 * fib6_add_rt2node() has rejected it; when replacing, old
		 * nexthops have been replaced by first new, the rest should
		 * be added to it.
3192
		 */
3193 3194
		cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
						     NLM_F_REPLACE);
3195 3196 3197
		nhn++;
	}

3198 3199
	/* success ... tell user about new route */
	ip6_route_mpath_notify(rt_notif, rt_last, info, nlflags);
3200 3201 3202
	goto cleanup;

add_errout:
3203 3204 3205 3206 3207 3208 3209
	/* send notification for routes that were added so that
	 * the delete notifications sent by ip6_route_del are
	 * coherent
	 */
	if (rt_notif)
		ip6_route_mpath_notify(rt_notif, rt_last, info, nlflags);

3210 3211 3212 3213 3214 3215 3216 3217 3218 3219 3220
	/* Delete routes that were already added */
	list_for_each_entry(nh, &rt6_nh_list, next) {
		if (err_nh == nh)
			break;
		ip6_route_del(&nh->r_cfg);
	}

cleanup:
	list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, next) {
		if (nh->rt6_info)
			dst_free(&nh->rt6_info->dst);
3221
		kfree(nh->mxc.mx);
3222 3223 3224 3225 3226 3227 3228 3229 3230 3231 3232 3233 3234 3235 3236 3237 3238 3239 3240 3241 3242 3243 3244 3245 3246 3247 3248 3249 3250 3251 3252 3253 3254 3255 3256 3257 3258 3259
		list_del(&nh->next);
		kfree(nh);
	}

	return err;
}

static int ip6_route_multipath_del(struct fib6_config *cfg)
{
	struct fib6_config r_cfg;
	struct rtnexthop *rtnh;
	int remaining;
	int attrlen;
	int err = 1, last_err = 0;

	remaining = cfg->fc_mp_len;
	rtnh = (struct rtnexthop *)cfg->fc_mp;

	/* Parse a Multipath Entry */
	while (rtnh_ok(rtnh, remaining)) {
		memcpy(&r_cfg, cfg, sizeof(*cfg));
		if (rtnh->rtnh_ifindex)
			r_cfg.fc_ifindex = rtnh->rtnh_ifindex;

		attrlen = rtnh_attrlen(rtnh);
		if (attrlen > 0) {
			struct nlattr *nla, *attrs = rtnh_attrs(rtnh);

			nla = nla_find(attrs, attrlen, RTA_GATEWAY);
			if (nla) {
				nla_memcpy(&r_cfg.fc_gateway, nla, 16);
				r_cfg.fc_flags |= RTF_GATEWAY;
			}
		}
		err = ip6_route_del(&r_cfg);
		if (err)
			last_err = err;

3260 3261 3262 3263 3264 3265
		rtnh = rtnh_next(rtnh, &remaining);
	}

	return last_err;
}

3266
static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
3267
{
3268 3269
	struct fib6_config cfg;
	int err;
L
Linus Torvalds 已提交
3270

3271 3272 3273 3274
	err = rtm_to_fib6_config(skb, nlh, &cfg);
	if (err < 0)
		return err;

3275
	if (cfg.fc_mp)
3276
		return ip6_route_multipath_del(&cfg);
3277 3278
	else {
		cfg.fc_delete_all_nh = 1;
3279
		return ip6_route_del(&cfg);
3280
	}
L
Linus Torvalds 已提交
3281 3282
}

3283
static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
3284
{
3285 3286
	struct fib6_config cfg;
	int err;
L
Linus Torvalds 已提交
3287

3288 3289 3290 3291
	err = rtm_to_fib6_config(skb, nlh, &cfg);
	if (err < 0)
		return err;

3292
	if (cfg.fc_mp)
3293
		return ip6_route_multipath_add(&cfg);
3294 3295
	else
		return ip6_route_add(&cfg);
L
Linus Torvalds 已提交
3296 3297
}

3298
static size_t rt6_nlmsg_size(struct rt6_info *rt)
3299
{
3300 3301 3302 3303 3304 3305 3306 3307 3308 3309 3310
	int nexthop_len = 0;

	if (rt->rt6i_nsiblings) {
		nexthop_len = nla_total_size(0)	 /* RTA_MULTIPATH */
			    + NLA_ALIGN(sizeof(struct rtnexthop))
			    + nla_total_size(16) /* RTA_GATEWAY */
			    + lwtunnel_get_encap_size(rt->dst.lwtstate);

		nexthop_len *= rt->rt6i_nsiblings;
	}

3311 3312 3313 3314 3315 3316 3317 3318 3319
	return NLMSG_ALIGN(sizeof(struct rtmsg))
	       + nla_total_size(16) /* RTA_SRC */
	       + nla_total_size(16) /* RTA_DST */
	       + nla_total_size(16) /* RTA_GATEWAY */
	       + nla_total_size(16) /* RTA_PREFSRC */
	       + nla_total_size(4) /* RTA_TABLE */
	       + nla_total_size(4) /* RTA_IIF */
	       + nla_total_size(4) /* RTA_OIF */
	       + nla_total_size(4) /* RTA_PRIORITY */
3320
	       + RTAX_MAX * nla_total_size(4) /* RTA_METRICS */
3321
	       + nla_total_size(sizeof(struct rta_cacheinfo))
3322
	       + nla_total_size(TCP_CA_NAME_MAX) /* RTAX_CC_ALGO */
3323
	       + nla_total_size(1) /* RTA_PREF */
3324 3325 3326 3327 3328
	       + lwtunnel_get_encap_size(rt->dst.lwtstate)
	       + nexthop_len;
}

static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
3329
			    unsigned int *flags, bool skip_oif)
3330 3331 3332 3333 3334 3335 3336 3337 3338 3339 3340 3341
{
	if (!netif_running(rt->dst.dev) || !netif_carrier_ok(rt->dst.dev)) {
		*flags |= RTNH_F_LINKDOWN;
		if (rt->rt6i_idev->cnf.ignore_routes_with_linkdown)
			*flags |= RTNH_F_DEAD;
	}

	if (rt->rt6i_flags & RTF_GATEWAY) {
		if (nla_put_in6_addr(skb, RTA_GATEWAY, &rt->rt6i_gateway) < 0)
			goto nla_put_failure;
	}

3342 3343
	/* not needed for multipath encoding b/c it has a rtnexthop struct */
	if (!skip_oif && rt->dst.dev &&
3344 3345 3346 3347 3348 3349 3350 3351 3352 3353 3354 3355 3356
	    nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
		goto nla_put_failure;

	if (rt->dst.lwtstate &&
	    lwtunnel_fill_encap(skb, rt->dst.lwtstate) < 0)
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -EMSGSIZE;
}

3357
/* add multipath next hop */
3358 3359 3360 3361 3362 3363 3364 3365 3366 3367 3368 3369
static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
{
	struct rtnexthop *rtnh;
	unsigned int flags = 0;

	rtnh = nla_reserve_nohdr(skb, sizeof(*rtnh));
	if (!rtnh)
		goto nla_put_failure;

	rtnh->rtnh_hops = 0;
	rtnh->rtnh_ifindex = rt->dst.dev ? rt->dst.dev->ifindex : 0;

3370
	if (rt6_nexthop_info(skb, rt, &flags, true) < 0)
3371 3372 3373 3374 3375 3376 3377 3378 3379 3380 3381
		goto nla_put_failure;

	rtnh->rtnh_flags = flags;

	/* length of rtnetlink header + attributes */
	rtnh->rtnh_len = nlmsg_get_pos(skb) - (void *)rtnh;

	return 0;

nla_put_failure:
	return -EMSGSIZE;
3382 3383
}

3384 3385
static int rt6_fill_node(struct net *net,
			 struct sk_buff *skb, struct rt6_info *rt,
3386
			 struct in6_addr *dst, struct in6_addr *src,
3387
			 int iif, int type, u32 portid, u32 seq,
3388
			 unsigned int flags)
L
Linus Torvalds 已提交
3389
{
3390
	u32 metrics[RTAX_MAX];
L
Linus Torvalds 已提交
3391
	struct rtmsg *rtm;
3392
	struct nlmsghdr *nlh;
3393
	long expires;
3394
	u32 table;
L
Linus Torvalds 已提交
3395

3396
	nlh = nlmsg_put(skb, portid, seq, type, sizeof(*rtm), flags);
3397
	if (!nlh)
3398
		return -EMSGSIZE;
3399 3400

	rtm = nlmsg_data(nlh);
L
Linus Torvalds 已提交
3401 3402 3403 3404
	rtm->rtm_family = AF_INET6;
	rtm->rtm_dst_len = rt->rt6i_dst.plen;
	rtm->rtm_src_len = rt->rt6i_src.plen;
	rtm->rtm_tos = 0;
T
Thomas Graf 已提交
3405
	if (rt->rt6i_table)
3406
		table = rt->rt6i_table->tb6_id;
T
Thomas Graf 已提交
3407
	else
3408 3409
		table = RT6_TABLE_UNSPEC;
	rtm->rtm_table = table;
D
David S. Miller 已提交
3410 3411
	if (nla_put_u32(skb, RTA_TABLE, table))
		goto nla_put_failure;
3412 3413 3414 3415 3416 3417 3418 3419
	if (rt->rt6i_flags & RTF_REJECT) {
		switch (rt->dst.error) {
		case -EINVAL:
			rtm->rtm_type = RTN_BLACKHOLE;
			break;
		case -EACCES:
			rtm->rtm_type = RTN_PROHIBIT;
			break;
3420 3421 3422
		case -EAGAIN:
			rtm->rtm_type = RTN_THROW;
			break;
3423 3424 3425 3426 3427
		default:
			rtm->rtm_type = RTN_UNREACHABLE;
			break;
		}
	}
3428
	else if (rt->rt6i_flags & RTF_LOCAL)
3429
		rtm->rtm_type = RTN_LOCAL;
3430 3431
	else if (rt->rt6i_flags & RTF_ANYCAST)
		rtm->rtm_type = RTN_ANYCAST;
3432
	else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
L
Linus Torvalds 已提交
3433 3434 3435 3436 3437 3438
		rtm->rtm_type = RTN_LOCAL;
	else
		rtm->rtm_type = RTN_UNICAST;
	rtm->rtm_flags = 0;
	rtm->rtm_scope = RT_SCOPE_UNIVERSE;
	rtm->rtm_protocol = rt->rt6i_protocol;
3439
	if (rt->rt6i_flags & RTF_DYNAMIC)
L
Linus Torvalds 已提交
3440
		rtm->rtm_protocol = RTPROT_REDIRECT;
3441 3442 3443 3444 3445 3446
	else if (rt->rt6i_flags & RTF_ADDRCONF) {
		if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ROUTEINFO))
			rtm->rtm_protocol = RTPROT_RA;
		else
			rtm->rtm_protocol = RTPROT_KERNEL;
	}
L
Linus Torvalds 已提交
3447

3448
	if (rt->rt6i_flags & RTF_CACHE)
L
Linus Torvalds 已提交
3449 3450 3451
		rtm->rtm_flags |= RTM_F_CLONED;

	if (dst) {
3452
		if (nla_put_in6_addr(skb, RTA_DST, dst))
D
David S. Miller 已提交
3453
			goto nla_put_failure;
3454
		rtm->rtm_dst_len = 128;
L
Linus Torvalds 已提交
3455
	} else if (rtm->rtm_dst_len)
3456
		if (nla_put_in6_addr(skb, RTA_DST, &rt->rt6i_dst.addr))
D
David S. Miller 已提交
3457
			goto nla_put_failure;
L
Linus Torvalds 已提交
3458 3459
#ifdef CONFIG_IPV6_SUBTREES
	if (src) {
3460
		if (nla_put_in6_addr(skb, RTA_SRC, src))
D
David S. Miller 已提交
3461
			goto nla_put_failure;
3462
		rtm->rtm_src_len = 128;
D
David S. Miller 已提交
3463
	} else if (rtm->rtm_src_len &&
3464
		   nla_put_in6_addr(skb, RTA_SRC, &rt->rt6i_src.addr))
D
David S. Miller 已提交
3465
		goto nla_put_failure;
L
Linus Torvalds 已提交
3466
#endif
3467 3468 3469
	if (iif) {
#ifdef CONFIG_IPV6_MROUTE
		if (ipv6_addr_is_multicast(&rt->rt6i_dst.addr)) {
3470 3471 3472 3473 3474 3475
			int err = ip6mr_get_route(net, skb, rtm, portid);

			if (err == 0)
				return 0;
			if (err < 0)
				goto nla_put_failure;
3476 3477
		} else
#endif
D
David S. Miller 已提交
3478 3479
			if (nla_put_u32(skb, RTA_IIF, iif))
				goto nla_put_failure;
3480
	} else if (dst) {
L
Linus Torvalds 已提交
3481
		struct in6_addr saddr_buf;
D
David S. Miller 已提交
3482
		if (ip6_route_get_saddr(net, rt, dst, 0, &saddr_buf) == 0 &&
3483
		    nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
D
David S. Miller 已提交
3484
			goto nla_put_failure;
L
Linus Torvalds 已提交
3485
	}
3486

3487 3488
	if (rt->rt6i_prefsrc.plen) {
		struct in6_addr saddr_buf;
A
Alexey Dobriyan 已提交
3489
		saddr_buf = rt->rt6i_prefsrc.addr;
3490
		if (nla_put_in6_addr(skb, RTA_PREFSRC, &saddr_buf))
D
David S. Miller 已提交
3491
			goto nla_put_failure;
3492 3493
	}

3494 3495 3496 3497
	memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
	if (rt->rt6i_pmtu)
		metrics[RTAX_MTU - 1] = rt->rt6i_pmtu;
	if (rtnetlink_put_metrics(skb, metrics) < 0)
3498 3499
		goto nla_put_failure;

D
David S. Miller 已提交
3500 3501
	if (nla_put_u32(skb, RTA_PRIORITY, rt->rt6i_metric))
		goto nla_put_failure;
3502

3503 3504 3505 3506 3507 3508 3509 3510 3511 3512 3513 3514 3515 3516 3517 3518 3519 3520 3521 3522 3523 3524
	/* For multipath routes, walk the siblings list and add
	 * each as a nexthop within RTA_MULTIPATH.
	 */
	if (rt->rt6i_nsiblings) {
		struct rt6_info *sibling, *next_sibling;
		struct nlattr *mp;

		mp = nla_nest_start(skb, RTA_MULTIPATH);
		if (!mp)
			goto nla_put_failure;

		if (rt6_add_nexthop(skb, rt) < 0)
			goto nla_put_failure;

		list_for_each_entry_safe(sibling, next_sibling,
					 &rt->rt6i_siblings, rt6i_siblings) {
			if (rt6_add_nexthop(skb, sibling) < 0)
				goto nla_put_failure;
		}

		nla_nest_end(skb, mp);
	} else {
3525
		if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags, false) < 0)
3526 3527 3528
			goto nla_put_failure;
	}

3529
	expires = (rt->rt6i_flags & RTF_EXPIRES) ? rt->dst.expires - jiffies : 0;
3530

3531
	if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, rt->dst.error) < 0)
3532
		goto nla_put_failure;
3533

3534 3535 3536
	if (nla_put_u8(skb, RTA_PREF, IPV6_EXTRACT_PREF(rt->rt6i_flags)))
		goto nla_put_failure;

3537

3538 3539
	nlmsg_end(skb, nlh);
	return 0;
3540 3541

nla_put_failure:
3542 3543
	nlmsg_cancel(skb, nlh);
	return -EMSGSIZE;
L
Linus Torvalds 已提交
3544 3545
}

3546
int rt6_dump_route(struct rt6_info *rt, void *p_arg)
L
Linus Torvalds 已提交
3547 3548
{
	struct rt6_rtnl_dump_arg *arg = (struct rt6_rtnl_dump_arg *) p_arg;
3549 3550 3551 3552
	struct net *net = arg->net;

	if (rt == net->ipv6.ip6_null_entry)
		return 0;
L
Linus Torvalds 已提交
3553

3554 3555
	if (nlmsg_len(arg->cb->nlh) >= sizeof(struct rtmsg)) {
		struct rtmsg *rtm = nlmsg_data(arg->cb->nlh);
3556 3557 3558 3559 3560 3561 3562 3563

		/* user wants prefix routes only */
		if (rtm->rtm_flags & RTM_F_PREFIX &&
		    !(rt->rt6i_flags & RTF_PREFIX_RT)) {
			/* success since this is not a prefix route */
			return 1;
		}
	}
L
Linus Torvalds 已提交
3564

3565
	return rt6_fill_node(net,
3566
		     arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
3567
		     NETLINK_CB(arg->cb->skb).portid, arg->cb->nlh->nlmsg_seq,
3568
		     NLM_F_MULTI);
L
Linus Torvalds 已提交
3569 3570
}

3571
static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh)
L
Linus Torvalds 已提交
3572
{
3573
	struct net *net = sock_net(in_skb->sk);
3574 3575
	struct nlattr *tb[RTA_MAX+1];
	struct rt6_info *rt;
L
Linus Torvalds 已提交
3576
	struct sk_buff *skb;
3577
	struct rtmsg *rtm;
3578
	struct flowi6 fl6;
3579
	int err, iif = 0, oif = 0;
L
Linus Torvalds 已提交
3580

3581 3582 3583
	err = nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX, rtm_ipv6_policy);
	if (err < 0)
		goto errout;
L
Linus Torvalds 已提交
3584

3585
	err = -EINVAL;
3586
	memset(&fl6, 0, sizeof(fl6));
3587 3588
	rtm = nlmsg_data(nlh);
	fl6.flowlabel = ip6_make_flowinfo(rtm->rtm_tos, 0);
L
Linus Torvalds 已提交
3589

3590 3591 3592 3593
	if (tb[RTA_SRC]) {
		if (nla_len(tb[RTA_SRC]) < sizeof(struct in6_addr))
			goto errout;

A
Alexey Dobriyan 已提交
3594
		fl6.saddr = *(struct in6_addr *)nla_data(tb[RTA_SRC]);
3595 3596 3597 3598 3599 3600
	}

	if (tb[RTA_DST]) {
		if (nla_len(tb[RTA_DST]) < sizeof(struct in6_addr))
			goto errout;

A
Alexey Dobriyan 已提交
3601
		fl6.daddr = *(struct in6_addr *)nla_data(tb[RTA_DST]);
3602 3603 3604 3605 3606 3607
	}

	if (tb[RTA_IIF])
		iif = nla_get_u32(tb[RTA_IIF]);

	if (tb[RTA_OIF])
3608
		oif = nla_get_u32(tb[RTA_OIF]);
L
Linus Torvalds 已提交
3609

3610 3611 3612
	if (tb[RTA_MARK])
		fl6.flowi6_mark = nla_get_u32(tb[RTA_MARK]);

3613 3614 3615 3616 3617 3618
	if (tb[RTA_UID])
		fl6.flowi6_uid = make_kuid(current_user_ns(),
					   nla_get_u32(tb[RTA_UID]));
	else
		fl6.flowi6_uid = iif ? INVALID_UID : current_uid();

L
Linus Torvalds 已提交
3619 3620
	if (iif) {
		struct net_device *dev;
3621 3622
		int flags = 0;

3623
		dev = __dev_get_by_index(net, iif);
L
Linus Torvalds 已提交
3624 3625
		if (!dev) {
			err = -ENODEV;
3626
			goto errout;
L
Linus Torvalds 已提交
3627
		}
3628 3629 3630 3631 3632 3633 3634 3635 3636 3637 3638 3639

		fl6.flowi6_iif = iif;

		if (!ipv6_addr_any(&fl6.saddr))
			flags |= RT6_LOOKUP_F_HAS_SADDR;

		rt = (struct rt6_info *)ip6_route_input_lookup(net, dev, &fl6,
							       flags);
	} else {
		fl6.flowi6_oif = oif;

		rt = (struct rt6_info *)ip6_route_output(net, NULL, &fl6);
L
Linus Torvalds 已提交
3640 3641
	}

3642 3643 3644 3645 3646 3647
	if (rt == net->ipv6.ip6_null_entry) {
		err = rt->dst.error;
		ip6_rt_put(rt);
		goto errout;
	}

3648
	skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
3649
	if (!skb) {
A
Amerigo Wang 已提交
3650
		ip6_rt_put(rt);
3651 3652 3653
		err = -ENOBUFS;
		goto errout;
	}
L
Linus Torvalds 已提交
3654

3655
	skb_dst_set(skb, &rt->dst);
L
Linus Torvalds 已提交
3656

3657
	err = rt6_fill_node(net, skb, rt, &fl6.daddr, &fl6.saddr, iif,
3658
			    RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
3659
			    nlh->nlmsg_seq, 0);
L
Linus Torvalds 已提交
3660
	if (err < 0) {
3661 3662
		kfree_skb(skb);
		goto errout;
L
Linus Torvalds 已提交
3663 3664
	}

3665
	err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
3666
errout:
L
Linus Torvalds 已提交
3667 3668 3669
	return err;
}

3670 3671
void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info,
		     unsigned int nlm_flags)
L
Linus Torvalds 已提交
3672 3673
{
	struct sk_buff *skb;
3674
	struct net *net = info->nl_net;
3675 3676 3677 3678
	u32 seq;
	int err;

	err = -ENOBUFS;
3679
	seq = info->nlh ? info->nlh->nlmsg_seq : 0;
3680

3681
	skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any());
3682
	if (!skb)
3683 3684
		goto errout;

3685
	err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
3686
				event, info->portid, seq, nlm_flags);
3687 3688 3689 3690 3691 3692
	if (err < 0) {
		/* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
		WARN_ON(err == -EMSGSIZE);
		kfree_skb(skb);
		goto errout;
	}
3693
	rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
3694 3695
		    info->nlh, gfp_any());
	return;
3696 3697
errout:
	if (err < 0)
3698
		rtnl_set_sk_err(net, RTNLGRP_IPV6_ROUTE, err);
L
Linus Torvalds 已提交
3699 3700
}

3701
static int ip6_route_dev_notify(struct notifier_block *this,
3702
				unsigned long event, void *ptr)
3703
{
3704
	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
3705
	struct net *net = dev_net(dev);
3706 3707

	if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
3708
		net->ipv6.ip6_null_entry->dst.dev = dev;
3709 3710
		net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
3711
		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
3712
		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
3713
		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
3714 3715 3716 3717 3718 3719 3720
		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
	}

	return NOTIFY_OK;
}

L
Linus Torvalds 已提交
3721 3722 3723 3724 3725 3726
/*
 *	/proc
 */

#ifdef CONFIG_PROC_FS

3727 3728 3729 3730 3731
static const struct file_operations ipv6_route_proc_fops = {
	.owner		= THIS_MODULE,
	.open		= ipv6_route_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
3732
	.release	= seq_release_net,
3733 3734
};

L
Linus Torvalds 已提交
3735 3736
static int rt6_stats_seq_show(struct seq_file *seq, void *v)
{
3737
	struct net *net = (struct net *)seq->private;
L
Linus Torvalds 已提交
3738
	seq_printf(seq, "%04x %04x %04x %04x %04x %04x %04x\n",
3739 3740 3741 3742 3743
		   net->ipv6.rt6_stats->fib_nodes,
		   net->ipv6.rt6_stats->fib_route_nodes,
		   net->ipv6.rt6_stats->fib_rt_alloc,
		   net->ipv6.rt6_stats->fib_rt_entries,
		   net->ipv6.rt6_stats->fib_rt_cache,
3744
		   dst_entries_get_slow(&net->ipv6.ip6_dst_ops),
3745
		   net->ipv6.rt6_stats->fib_discarded_routes);
L
Linus Torvalds 已提交
3746 3747 3748 3749 3750 3751

	return 0;
}

static int rt6_stats_seq_open(struct inode *inode, struct file *file)
{
3752
	return single_open_net(inode, file, rt6_stats_seq_show);
3753 3754
}

3755
static const struct file_operations rt6_stats_seq_fops = {
L
Linus Torvalds 已提交
3756 3757 3758 3759
	.owner	 = THIS_MODULE,
	.open	 = rt6_stats_seq_open,
	.read	 = seq_read,
	.llseek	 = seq_lseek,
3760
	.release = single_release_net,
L
Linus Torvalds 已提交
3761 3762 3763 3764 3765 3766
};
#endif	/* CONFIG_PROC_FS */

#ifdef CONFIG_SYSCTL

static
3767
int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
L
Linus Torvalds 已提交
3768 3769
			      void __user *buffer, size_t *lenp, loff_t *ppos)
{
3770 3771 3772
	struct net *net;
	int delay;
	if (!write)
L
Linus Torvalds 已提交
3773
		return -EINVAL;
3774 3775 3776 3777

	net = (struct net *)ctl->extra1;
	delay = net->ipv6.sysctl.flush_delay;
	proc_dointvec(ctl, write, buffer, lenp, ppos);
3778
	fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
3779
	return 0;
L
Linus Torvalds 已提交
3780 3781
}

3782
struct ctl_table ipv6_route_table_template[] = {
3783
	{
L
Linus Torvalds 已提交
3784
		.procname	=	"flush",
3785
		.data		=	&init_net.ipv6.sysctl.flush_delay,
L
Linus Torvalds 已提交
3786
		.maxlen		=	sizeof(int),
3787
		.mode		=	0200,
A
Alexey Dobriyan 已提交
3788
		.proc_handler	=	ipv6_sysctl_rtcache_flush
L
Linus Torvalds 已提交
3789 3790 3791
	},
	{
		.procname	=	"gc_thresh",
3792
		.data		=	&ip6_dst_ops_template.gc_thresh,
L
Linus Torvalds 已提交
3793 3794
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
3795
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
3796 3797 3798
	},
	{
		.procname	=	"max_size",
3799
		.data		=	&init_net.ipv6.sysctl.ip6_rt_max_size,
L
Linus Torvalds 已提交
3800 3801
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
3802
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
3803 3804 3805
	},
	{
		.procname	=	"gc_min_interval",
3806
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
L
Linus Torvalds 已提交
3807 3808
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
3809
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
3810 3811 3812
	},
	{
		.procname	=	"gc_timeout",
3813
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_timeout,
L
Linus Torvalds 已提交
3814 3815
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
3816
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
3817 3818 3819
	},
	{
		.procname	=	"gc_interval",
3820
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_interval,
L
Linus Torvalds 已提交
3821 3822
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
3823
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
3824 3825 3826
	},
	{
		.procname	=	"gc_elasticity",
3827
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_elasticity,
L
Linus Torvalds 已提交
3828 3829
		.maxlen		=	sizeof(int),
		.mode		=	0644,
3830
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
3831 3832 3833
	},
	{
		.procname	=	"mtu_expires",
3834
		.data		=	&init_net.ipv6.sysctl.ip6_rt_mtu_expires,
L
Linus Torvalds 已提交
3835 3836
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
3837
		.proc_handler	=	proc_dointvec_jiffies,
L
Linus Torvalds 已提交
3838 3839 3840
	},
	{
		.procname	=	"min_adv_mss",
3841
		.data		=	&init_net.ipv6.sysctl.ip6_rt_min_advmss,
L
Linus Torvalds 已提交
3842 3843
		.maxlen		=	sizeof(int),
		.mode		=	0644,
3844
		.proc_handler	=	proc_dointvec,
L
Linus Torvalds 已提交
3845 3846 3847
	},
	{
		.procname	=	"gc_min_interval_ms",
3848
		.data		=	&init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
L
Linus Torvalds 已提交
3849 3850
		.maxlen		=	sizeof(int),
		.mode		=	0644,
A
Alexey Dobriyan 已提交
3851
		.proc_handler	=	proc_dointvec_ms_jiffies,
L
Linus Torvalds 已提交
3852
	},
3853
	{ }
L
Linus Torvalds 已提交
3854 3855
};

3856
struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
3857 3858 3859 3860 3861 3862
{
	struct ctl_table *table;

	table = kmemdup(ipv6_route_table_template,
			sizeof(ipv6_route_table_template),
			GFP_KERNEL);
3863 3864 3865

	if (table) {
		table[0].data = &net->ipv6.sysctl.flush_delay;
3866
		table[0].extra1 = net;
3867
		table[1].data = &net->ipv6.ip6_dst_ops.gc_thresh;
3868 3869 3870 3871 3872 3873 3874
		table[2].data = &net->ipv6.sysctl.ip6_rt_max_size;
		table[3].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
		table[4].data = &net->ipv6.sysctl.ip6_rt_gc_timeout;
		table[5].data = &net->ipv6.sysctl.ip6_rt_gc_interval;
		table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
		table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
		table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
3875
		table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
3876 3877 3878 3879

		/* Don't export sysctls to unprivileged users */
		if (net->user_ns != &init_user_ns)
			table[0].procname = NULL;
3880 3881
	}

3882 3883
	return table;
}
L
Linus Torvalds 已提交
3884 3885
#endif

3886
static int __net_init ip6_route_net_init(struct net *net)
3887
{
3888
	int ret = -ENOMEM;
3889

3890 3891
	memcpy(&net->ipv6.ip6_dst_ops, &ip6_dst_ops_template,
	       sizeof(net->ipv6.ip6_dst_ops));
3892

3893 3894 3895
	if (dst_entries_init(&net->ipv6.ip6_dst_ops) < 0)
		goto out_ip6_dst_ops;

3896 3897 3898 3899
	net->ipv6.ip6_null_entry = kmemdup(&ip6_null_entry_template,
					   sizeof(*net->ipv6.ip6_null_entry),
					   GFP_KERNEL);
	if (!net->ipv6.ip6_null_entry)
3900
		goto out_ip6_dst_entries;
3901
	net->ipv6.ip6_null_entry->dst.path =
3902
		(struct dst_entry *)net->ipv6.ip6_null_entry;
3903
	net->ipv6.ip6_null_entry->dst.ops = &net->ipv6.ip6_dst_ops;
3904 3905
	dst_init_metrics(&net->ipv6.ip6_null_entry->dst,
			 ip6_template_metrics, true);
3906 3907 3908 3909 3910

#ifdef CONFIG_IPV6_MULTIPLE_TABLES
	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
					       sizeof(*net->ipv6.ip6_prohibit_entry),
					       GFP_KERNEL);
3911 3912
	if (!net->ipv6.ip6_prohibit_entry)
		goto out_ip6_null_entry;
3913
	net->ipv6.ip6_prohibit_entry->dst.path =
3914
		(struct dst_entry *)net->ipv6.ip6_prohibit_entry;
3915
	net->ipv6.ip6_prohibit_entry->dst.ops = &net->ipv6.ip6_dst_ops;
3916 3917
	dst_init_metrics(&net->ipv6.ip6_prohibit_entry->dst,
			 ip6_template_metrics, true);
3918 3919 3920 3921

	net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
					       sizeof(*net->ipv6.ip6_blk_hole_entry),
					       GFP_KERNEL);
3922 3923
	if (!net->ipv6.ip6_blk_hole_entry)
		goto out_ip6_prohibit_entry;
3924
	net->ipv6.ip6_blk_hole_entry->dst.path =
3925
		(struct dst_entry *)net->ipv6.ip6_blk_hole_entry;
3926
	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
3927 3928
	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
			 ip6_template_metrics, true);
3929 3930
#endif

3931 3932 3933 3934 3935 3936 3937 3938 3939
	net->ipv6.sysctl.flush_delay = 0;
	net->ipv6.sysctl.ip6_rt_max_size = 4096;
	net->ipv6.sysctl.ip6_rt_gc_min_interval = HZ / 2;
	net->ipv6.sysctl.ip6_rt_gc_timeout = 60*HZ;
	net->ipv6.sysctl.ip6_rt_gc_interval = 30*HZ;
	net->ipv6.sysctl.ip6_rt_gc_elasticity = 9;
	net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
	net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;

3940 3941
	net->ipv6.ip6_rt_gc_expire = 30*HZ;

3942 3943 3944
	ret = 0;
out:
	return ret;
3945

3946 3947 3948 3949 3950 3951
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
out_ip6_prohibit_entry:
	kfree(net->ipv6.ip6_prohibit_entry);
out_ip6_null_entry:
	kfree(net->ipv6.ip6_null_entry);
#endif
3952 3953
out_ip6_dst_entries:
	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
3954 3955
out_ip6_dst_ops:
	goto out;
3956 3957
}

3958
static void __net_exit ip6_route_net_exit(struct net *net)
3959
{
3960 3961 3962 3963 3964
	kfree(net->ipv6.ip6_null_entry);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
	kfree(net->ipv6.ip6_prohibit_entry);
	kfree(net->ipv6.ip6_blk_hole_entry);
#endif
3965
	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
3966 3967
}

3968 3969 3970
static int __net_init ip6_route_net_init_late(struct net *net)
{
#ifdef CONFIG_PROC_FS
3971 3972
	proc_create("ipv6_route", 0, net->proc_net, &ipv6_route_proc_fops);
	proc_create("rt6_stats", S_IRUGO, net->proc_net, &rt6_stats_seq_fops);
3973 3974 3975 3976 3977 3978 3979
#endif
	return 0;
}

static void __net_exit ip6_route_net_exit_late(struct net *net)
{
#ifdef CONFIG_PROC_FS
3980 3981
	remove_proc_entry("ipv6_route", net->proc_net);
	remove_proc_entry("rt6_stats", net->proc_net);
3982 3983 3984
#endif
}

3985 3986 3987 3988 3989
static struct pernet_operations ip6_route_net_ops = {
	.init = ip6_route_net_init,
	.exit = ip6_route_net_exit,
};

3990 3991 3992 3993 3994 3995 3996 3997 3998 3999 4000 4001 4002 4003 4004 4005
static int __net_init ipv6_inetpeer_init(struct net *net)
{
	struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);

	if (!bp)
		return -ENOMEM;
	inet_peer_base_init(bp);
	net->ipv6.peers = bp;
	return 0;
}

static void __net_exit ipv6_inetpeer_exit(struct net *net)
{
	struct inet_peer_base *bp = net->ipv6.peers;

	net->ipv6.peers = NULL;
4006
	inetpeer_invalidate_tree(bp);
4007 4008 4009
	kfree(bp);
}

4010
static struct pernet_operations ipv6_inetpeer_ops = {
4011 4012 4013 4014
	.init	=	ipv6_inetpeer_init,
	.exit	=	ipv6_inetpeer_exit,
};

4015 4016 4017 4018 4019
static struct pernet_operations ip6_route_net_late_ops = {
	.init = ip6_route_net_init_late,
	.exit = ip6_route_net_exit_late,
};

4020 4021 4022 4023 4024
static struct notifier_block ip6_route_dev_notifier = {
	.notifier_call = ip6_route_dev_notify,
	.priority = 0,
};

4025
int __init ip6_route_init(void)
L
Linus Torvalds 已提交
4026
{
4027
	int ret;
4028
	int cpu;
4029

4030 4031
	ret = -ENOMEM;
	ip6_dst_ops_template.kmem_cachep =
A
Alexey Dobriyan 已提交
4032
		kmem_cache_create("ip6_dst_cache", sizeof(struct rt6_info), 0,
4033
				  SLAB_HWCACHE_ALIGN, NULL);
4034
	if (!ip6_dst_ops_template.kmem_cachep)
4035
		goto out;
4036

4037
	ret = dst_entries_init(&ip6_dst_blackhole_ops);
4038
	if (ret)
4039 4040
		goto out_kmem_cache;

4041 4042
	ret = register_pernet_subsys(&ipv6_inetpeer_ops);
	if (ret)
4043
		goto out_dst_entries;
4044

4045 4046 4047
	ret = register_pernet_subsys(&ip6_route_net_ops);
	if (ret)
		goto out_register_inetpeer;
4048

4049 4050
	ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;

4051 4052 4053
	/* Registering of the loopback is done before this portion of code,
	 * the loopback reference in rt6_info will not be taken, do it
	 * manually for init_net */
4054
	init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
4055 4056
	init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
4057
	init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
4058
	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
4059
	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
4060 4061
	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  #endif
4062
	ret = fib6_init();
4063
	if (ret)
4064
		goto out_register_subsys;
4065 4066 4067

	ret = xfrm6_init();
	if (ret)
4068
		goto out_fib6_init;
4069

4070 4071 4072
	ret = fib6_rules_init();
	if (ret)
		goto xfrm6_init;
4073

4074 4075 4076 4077
	ret = register_pernet_subsys(&ip6_route_net_late_ops);
	if (ret)
		goto fib6_rules_init;

4078
	ret = -ENOBUFS;
4079 4080 4081
	if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
	    __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
	    __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
4082
		goto out_register_late_subsys;
4083

4084
	ret = register_netdevice_notifier(&ip6_route_dev_notifier);
4085
	if (ret)
4086
		goto out_register_late_subsys;
4087

4088 4089 4090 4091 4092 4093 4094
	for_each_possible_cpu(cpu) {
		struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);

		INIT_LIST_HEAD(&ul->head);
		spin_lock_init(&ul->lock);
	}

4095 4096 4097
out:
	return ret;

4098 4099
out_register_late_subsys:
	unregister_pernet_subsys(&ip6_route_net_late_ops);
4100 4101 4102 4103
fib6_rules_init:
	fib6_rules_cleanup();
xfrm6_init:
	xfrm6_fini();
4104 4105
out_fib6_init:
	fib6_gc_cleanup();
4106 4107
out_register_subsys:
	unregister_pernet_subsys(&ip6_route_net_ops);
4108 4109
out_register_inetpeer:
	unregister_pernet_subsys(&ipv6_inetpeer_ops);
4110 4111
out_dst_entries:
	dst_entries_destroy(&ip6_dst_blackhole_ops);
4112
out_kmem_cache:
4113
	kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
4114
	goto out;
L
Linus Torvalds 已提交
4115 4116 4117 4118
}

void ip6_route_cleanup(void)
{
4119
	unregister_netdevice_notifier(&ip6_route_dev_notifier);
4120
	unregister_pernet_subsys(&ip6_route_net_late_ops);
T
Thomas Graf 已提交
4121
	fib6_rules_cleanup();
L
Linus Torvalds 已提交
4122 4123
	xfrm6_fini();
	fib6_gc_cleanup();
4124
	unregister_pernet_subsys(&ipv6_inetpeer_ops);
4125
	unregister_pernet_subsys(&ip6_route_net_ops);
4126
	dst_entries_destroy(&ip6_dst_blackhole_ops);
4127
	kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
L
Linus Torvalds 已提交
4128
}