net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
[sfrench/cifs-2.6.git] / net / ipv6 / route.c
1 /*
2  *      Linux INET6 implementation
3  *      FIB front-end.
4  *
5  *      Authors:
6  *      Pedro Roque             <roque@di.fc.ul.pt>
7  *
8  *      This program is free software; you can redistribute it and/or
9  *      modify it under the terms of the GNU General Public License
10  *      as published by the Free Software Foundation; either version
11  *      2 of the License, or (at your option) any later version.
12  */
13
14 /*      Changes:
15  *
16  *      YOSHIFUJI Hideaki @USAGI
17  *              reworked default router selection.
18  *              - respect outgoing interface
19  *              - select from (probably) reachable routers (i.e.
20  *              routers in REACHABLE, STALE, DELAY or PROBE states).
21  *              - always select the same router if it is (probably)
22  *              reachable.  otherwise, round-robin the list.
23  *      Ville Nuorvala
24  *              Fixed routing subtrees.
25  */
26
27 #define pr_fmt(fmt) "IPv6: " fmt
28
29 #include <linux/capability.h>
30 #include <linux/errno.h>
31 #include <linux/export.h>
32 #include <linux/types.h>
33 #include <linux/times.h>
34 #include <linux/socket.h>
35 #include <linux/sockios.h>
36 #include <linux/net.h>
37 #include <linux/route.h>
38 #include <linux/netdevice.h>
39 #include <linux/in6.h>
40 #include <linux/mroute6.h>
41 #include <linux/init.h>
42 #include <linux/if_arp.h>
43 #include <linux/proc_fs.h>
44 #include <linux/seq_file.h>
45 #include <linux/nsproxy.h>
46 #include <linux/slab.h>
47 #include <linux/jhash.h>
48 #include <net/net_namespace.h>
49 #include <net/snmp.h>
50 #include <net/ipv6.h>
51 #include <net/ip6_fib.h>
52 #include <net/ip6_route.h>
53 #include <net/ndisc.h>
54 #include <net/addrconf.h>
55 #include <net/tcp.h>
56 #include <linux/rtnetlink.h>
57 #include <net/dst.h>
58 #include <net/dst_metadata.h>
59 #include <net/xfrm.h>
60 #include <net/netevent.h>
61 #include <net/netlink.h>
62 #include <net/nexthop.h>
63 #include <net/lwtunnel.h>
64 #include <net/ip_tunnels.h>
65 #include <net/l3mdev.h>
66 #include <net/ip.h>
67 #include <linux/uaccess.h>
68
69 #ifdef CONFIG_SYSCTL
70 #include <linux/sysctl.h>
71 #endif
72
73 static int ip6_rt_type_to_error(u8 fib6_type);
74
75 #define CREATE_TRACE_POINTS
76 #include <trace/events/fib6.h>
77 EXPORT_TRACEPOINT_SYMBOL_GPL(fib6_table_lookup);
78 #undef CREATE_TRACE_POINTS
79
80 enum rt6_nud_state {
81         RT6_NUD_FAIL_HARD = -3,
82         RT6_NUD_FAIL_PROBE = -2,
83         RT6_NUD_FAIL_DO_RR = -1,
84         RT6_NUD_SUCCEED = 1
85 };
86
87 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie);
88 static unsigned int      ip6_default_advmss(const struct dst_entry *dst);
89 static unsigned int      ip6_mtu(const struct dst_entry *dst);
90 static struct dst_entry *ip6_negative_advice(struct dst_entry *);
91 static void             ip6_dst_destroy(struct dst_entry *);
92 static void             ip6_dst_ifdown(struct dst_entry *,
93                                        struct net_device *dev, int how);
94 static int               ip6_dst_gc(struct dst_ops *ops);
95
96 static int              ip6_pkt_discard(struct sk_buff *skb);
97 static int              ip6_pkt_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb);
98 static int              ip6_pkt_prohibit(struct sk_buff *skb);
99 static int              ip6_pkt_prohibit_out(struct net *net, struct sock *sk, struct sk_buff *skb);
100 static void             ip6_link_failure(struct sk_buff *skb);
101 static void             ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
102                                            struct sk_buff *skb, u32 mtu);
103 static void             rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
104                                         struct sk_buff *skb);
105 static int rt6_score_route(struct fib6_info *rt, int oif, int strict);
106 static size_t rt6_nlmsg_size(struct fib6_info *rt);
107 static int rt6_fill_node(struct net *net, struct sk_buff *skb,
108                          struct fib6_info *rt, struct dst_entry *dst,
109                          struct in6_addr *dest, struct in6_addr *src,
110                          int iif, int type, u32 portid, u32 seq,
111                          unsigned int flags);
112 static struct rt6_info *rt6_find_cached_rt(struct fib6_info *rt,
113                                            struct in6_addr *daddr,
114                                            struct in6_addr *saddr);
115
116 #ifdef CONFIG_IPV6_ROUTE_INFO
117 static struct fib6_info *rt6_add_route_info(struct net *net,
118                                            const struct in6_addr *prefix, int prefixlen,
119                                            const struct in6_addr *gwaddr,
120                                            struct net_device *dev,
121                                            unsigned int pref);
122 static struct fib6_info *rt6_get_route_info(struct net *net,
123                                            const struct in6_addr *prefix, int prefixlen,
124                                            const struct in6_addr *gwaddr,
125                                            struct net_device *dev);
126 #endif
127
128 struct uncached_list {
129         spinlock_t              lock;
130         struct list_head        head;
131 };
132
133 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt6_uncached_list);
134
135 void rt6_uncached_list_add(struct rt6_info *rt)
136 {
137         struct uncached_list *ul = raw_cpu_ptr(&rt6_uncached_list);
138
139         rt->rt6i_uncached_list = ul;
140
141         spin_lock_bh(&ul->lock);
142         list_add_tail(&rt->rt6i_uncached, &ul->head);
143         spin_unlock_bh(&ul->lock);
144 }
145
146 void rt6_uncached_list_del(struct rt6_info *rt)
147 {
148         if (!list_empty(&rt->rt6i_uncached)) {
149                 struct uncached_list *ul = rt->rt6i_uncached_list;
150                 struct net *net = dev_net(rt->dst.dev);
151
152                 spin_lock_bh(&ul->lock);
153                 list_del(&rt->rt6i_uncached);
154                 atomic_dec(&net->ipv6.rt6_stats->fib_rt_uncache);
155                 spin_unlock_bh(&ul->lock);
156         }
157 }
158
159 static void rt6_uncached_list_flush_dev(struct net *net, struct net_device *dev)
160 {
161         struct net_device *loopback_dev = net->loopback_dev;
162         int cpu;
163
164         if (dev == loopback_dev)
165                 return;
166
167         for_each_possible_cpu(cpu) {
168                 struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);
169                 struct rt6_info *rt;
170
171                 spin_lock_bh(&ul->lock);
172                 list_for_each_entry(rt, &ul->head, rt6i_uncached) {
173                         struct inet6_dev *rt_idev = rt->rt6i_idev;
174                         struct net_device *rt_dev = rt->dst.dev;
175
176                         if (rt_idev->dev == dev) {
177                                 rt->rt6i_idev = in6_dev_get(loopback_dev);
178                                 in6_dev_put(rt_idev);
179                         }
180
181                         if (rt_dev == dev) {
182                                 rt->dst.dev = loopback_dev;
183                                 dev_hold(rt->dst.dev);
184                                 dev_put(rt_dev);
185                         }
186                 }
187                 spin_unlock_bh(&ul->lock);
188         }
189 }
190
191 static inline const void *choose_neigh_daddr(const struct in6_addr *p,
192                                              struct sk_buff *skb,
193                                              const void *daddr)
194 {
195         if (!ipv6_addr_any(p))
196                 return (const void *) p;
197         else if (skb)
198                 return &ipv6_hdr(skb)->daddr;
199         return daddr;
200 }
201
202 struct neighbour *ip6_neigh_lookup(const struct in6_addr *gw,
203                                    struct net_device *dev,
204                                    struct sk_buff *skb,
205                                    const void *daddr)
206 {
207         struct neighbour *n;
208
209         daddr = choose_neigh_daddr(gw, skb, daddr);
210         n = __ipv6_neigh_lookup(dev, daddr);
211         if (n)
212                 return n;
213
214         n = neigh_create(&nd_tbl, daddr, dev);
215         return IS_ERR(n) ? NULL : n;
216 }
217
218 static struct neighbour *ip6_dst_neigh_lookup(const struct dst_entry *dst,
219                                               struct sk_buff *skb,
220                                               const void *daddr)
221 {
222         const struct rt6_info *rt = container_of(dst, struct rt6_info, dst);
223
224         return ip6_neigh_lookup(&rt->rt6i_gateway, dst->dev, skb, daddr);
225 }
226
227 static void ip6_confirm_neigh(const struct dst_entry *dst, const void *daddr)
228 {
229         struct net_device *dev = dst->dev;
230         struct rt6_info *rt = (struct rt6_info *)dst;
231
232         daddr = choose_neigh_daddr(&rt->rt6i_gateway, NULL, daddr);
233         if (!daddr)
234                 return;
235         if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
236                 return;
237         if (ipv6_addr_is_multicast((const struct in6_addr *)daddr))
238                 return;
239         __ipv6_confirm_neigh(dev, daddr);
240 }
241
242 static struct dst_ops ip6_dst_ops_template = {
243         .family                 =       AF_INET6,
244         .gc                     =       ip6_dst_gc,
245         .gc_thresh              =       1024,
246         .check                  =       ip6_dst_check,
247         .default_advmss         =       ip6_default_advmss,
248         .mtu                    =       ip6_mtu,
249         .cow_metrics            =       dst_cow_metrics_generic,
250         .destroy                =       ip6_dst_destroy,
251         .ifdown                 =       ip6_dst_ifdown,
252         .negative_advice        =       ip6_negative_advice,
253         .link_failure           =       ip6_link_failure,
254         .update_pmtu            =       ip6_rt_update_pmtu,
255         .redirect               =       rt6_do_redirect,
256         .local_out              =       __ip6_local_out,
257         .neigh_lookup           =       ip6_dst_neigh_lookup,
258         .confirm_neigh          =       ip6_confirm_neigh,
259 };
260
261 static unsigned int ip6_blackhole_mtu(const struct dst_entry *dst)
262 {
263         unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
264
265         return mtu ? : dst->dev->mtu;
266 }
267
268 static void ip6_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
269                                          struct sk_buff *skb, u32 mtu)
270 {
271 }
272
273 static void ip6_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
274                                       struct sk_buff *skb)
275 {
276 }
277
278 static struct dst_ops ip6_dst_blackhole_ops = {
279         .family                 =       AF_INET6,
280         .destroy                =       ip6_dst_destroy,
281         .check                  =       ip6_dst_check,
282         .mtu                    =       ip6_blackhole_mtu,
283         .default_advmss         =       ip6_default_advmss,
284         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
285         .redirect               =       ip6_rt_blackhole_redirect,
286         .cow_metrics            =       dst_cow_metrics_generic,
287         .neigh_lookup           =       ip6_dst_neigh_lookup,
288 };
289
290 static const u32 ip6_template_metrics[RTAX_MAX] = {
291         [RTAX_HOPLIMIT - 1] = 0,
292 };
293
294 static const struct fib6_info fib6_null_entry_template = {
295         .fib6_flags     = (RTF_REJECT | RTF_NONEXTHOP),
296         .fib6_protocol  = RTPROT_KERNEL,
297         .fib6_metric    = ~(u32)0,
298         .fib6_ref       = ATOMIC_INIT(1),
299         .fib6_type      = RTN_UNREACHABLE,
300         .fib6_metrics   = (struct dst_metrics *)&dst_default_metrics,
301 };
302
303 static const struct rt6_info ip6_null_entry_template = {
304         .dst = {
305                 .__refcnt       = ATOMIC_INIT(1),
306                 .__use          = 1,
307                 .obsolete       = DST_OBSOLETE_FORCE_CHK,
308                 .error          = -ENETUNREACH,
309                 .input          = ip6_pkt_discard,
310                 .output         = ip6_pkt_discard_out,
311         },
312         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
313 };
314
315 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
316
317 static const struct rt6_info ip6_prohibit_entry_template = {
318         .dst = {
319                 .__refcnt       = ATOMIC_INIT(1),
320                 .__use          = 1,
321                 .obsolete       = DST_OBSOLETE_FORCE_CHK,
322                 .error          = -EACCES,
323                 .input          = ip6_pkt_prohibit,
324                 .output         = ip6_pkt_prohibit_out,
325         },
326         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
327 };
328
329 static const struct rt6_info ip6_blk_hole_entry_template = {
330         .dst = {
331                 .__refcnt       = ATOMIC_INIT(1),
332                 .__use          = 1,
333                 .obsolete       = DST_OBSOLETE_FORCE_CHK,
334                 .error          = -EINVAL,
335                 .input          = dst_discard,
336                 .output         = dst_discard_out,
337         },
338         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
339 };
340
341 #endif
342
343 static void rt6_info_init(struct rt6_info *rt)
344 {
345         struct dst_entry *dst = &rt->dst;
346
347         memset(dst + 1, 0, sizeof(*rt) - sizeof(*dst));
348         INIT_LIST_HEAD(&rt->rt6i_uncached);
349 }
350
351 /* allocate dst with ip6_dst_ops */
352 struct rt6_info *ip6_dst_alloc(struct net *net, struct net_device *dev,
353                                int flags)
354 {
355         struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
356                                         1, DST_OBSOLETE_FORCE_CHK, flags);
357
358         if (rt) {
359                 rt6_info_init(rt);
360                 atomic_inc(&net->ipv6.rt6_stats->fib_rt_alloc);
361         }
362
363         return rt;
364 }
365 EXPORT_SYMBOL(ip6_dst_alloc);
366
367 static void ip6_dst_destroy(struct dst_entry *dst)
368 {
369         struct rt6_info *rt = (struct rt6_info *)dst;
370         struct fib6_info *from;
371         struct inet6_dev *idev;
372
373         ip_dst_metrics_put(dst);
374         rt6_uncached_list_del(rt);
375
376         idev = rt->rt6i_idev;
377         if (idev) {
378                 rt->rt6i_idev = NULL;
379                 in6_dev_put(idev);
380         }
381
382         rcu_read_lock();
383         from = rcu_dereference(rt->from);
384         rcu_assign_pointer(rt->from, NULL);
385         fib6_info_release(from);
386         rcu_read_unlock();
387 }
388
389 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
390                            int how)
391 {
392         struct rt6_info *rt = (struct rt6_info *)dst;
393         struct inet6_dev *idev = rt->rt6i_idev;
394         struct net_device *loopback_dev =
395                 dev_net(dev)->loopback_dev;
396
397         if (idev && idev->dev != loopback_dev) {
398                 struct inet6_dev *loopback_idev = in6_dev_get(loopback_dev);
399                 if (loopback_idev) {
400                         rt->rt6i_idev = loopback_idev;
401                         in6_dev_put(idev);
402                 }
403         }
404 }
405
406 static bool __rt6_check_expired(const struct rt6_info *rt)
407 {
408         if (rt->rt6i_flags & RTF_EXPIRES)
409                 return time_after(jiffies, rt->dst.expires);
410         else
411                 return false;
412 }
413
414 static bool rt6_check_expired(const struct rt6_info *rt)
415 {
416         struct fib6_info *from;
417
418         from = rcu_dereference(rt->from);
419
420         if (rt->rt6i_flags & RTF_EXPIRES) {
421                 if (time_after(jiffies, rt->dst.expires))
422                         return true;
423         } else if (from) {
424                 return rt->dst.obsolete != DST_OBSOLETE_FORCE_CHK ||
425                         fib6_check_expired(from);
426         }
427         return false;
428 }
429
430 struct fib6_info *fib6_multipath_select(const struct net *net,
431                                         struct fib6_info *match,
432                                         struct flowi6 *fl6, int oif,
433                                         const struct sk_buff *skb,
434                                         int strict)
435 {
436         struct fib6_info *sibling, *next_sibling;
437
438         /* We might have already computed the hash for ICMPv6 errors. In such
439          * case it will always be non-zero. Otherwise now is the time to do it.
440          */
441         if (!fl6->mp_hash)
442                 fl6->mp_hash = rt6_multipath_hash(net, fl6, skb, NULL);
443
444         if (fl6->mp_hash <= atomic_read(&match->fib6_nh.nh_upper_bound))
445                 return match;
446
447         list_for_each_entry_safe(sibling, next_sibling, &match->fib6_siblings,
448                                  fib6_siblings) {
449                 int nh_upper_bound;
450
451                 nh_upper_bound = atomic_read(&sibling->fib6_nh.nh_upper_bound);
452                 if (fl6->mp_hash > nh_upper_bound)
453                         continue;
454                 if (rt6_score_route(sibling, oif, strict) < 0)
455                         break;
456                 match = sibling;
457                 break;
458         }
459
460         return match;
461 }
462
463 /*
464  *      Route lookup. rcu_read_lock() should be held.
465  */
466
467 static inline struct fib6_info *rt6_device_match(struct net *net,
468                                                  struct fib6_info *rt,
469                                                     const struct in6_addr *saddr,
470                                                     int oif,
471                                                     int flags)
472 {
473         struct fib6_info *sprt;
474
475         if (!oif && ipv6_addr_any(saddr) &&
476             !(rt->fib6_nh.nh_flags & RTNH_F_DEAD))
477                 return rt;
478
479         for (sprt = rt; sprt; sprt = rcu_dereference(sprt->fib6_next)) {
480                 const struct net_device *dev = sprt->fib6_nh.nh_dev;
481
482                 if (sprt->fib6_nh.nh_flags & RTNH_F_DEAD)
483                         continue;
484
485                 if (oif) {
486                         if (dev->ifindex == oif)
487                                 return sprt;
488                 } else {
489                         if (ipv6_chk_addr(net, saddr, dev,
490                                           flags & RT6_LOOKUP_F_IFACE))
491                                 return sprt;
492                 }
493         }
494
495         if (oif && flags & RT6_LOOKUP_F_IFACE)
496                 return net->ipv6.fib6_null_entry;
497
498         return rt->fib6_nh.nh_flags & RTNH_F_DEAD ? net->ipv6.fib6_null_entry : rt;
499 }
500
501 #ifdef CONFIG_IPV6_ROUTER_PREF
502 struct __rt6_probe_work {
503         struct work_struct work;
504         struct in6_addr target;
505         struct net_device *dev;
506 };
507
508 static void rt6_probe_deferred(struct work_struct *w)
509 {
510         struct in6_addr mcaddr;
511         struct __rt6_probe_work *work =
512                 container_of(w, struct __rt6_probe_work, work);
513
514         addrconf_addr_solict_mult(&work->target, &mcaddr);
515         ndisc_send_ns(work->dev, &work->target, &mcaddr, NULL, 0);
516         dev_put(work->dev);
517         kfree(work);
518 }
519
520 static void rt6_probe(struct fib6_info *rt)
521 {
522         struct __rt6_probe_work *work = NULL;
523         const struct in6_addr *nh_gw;
524         struct neighbour *neigh;
525         struct net_device *dev;
526         struct inet6_dev *idev;
527
528         /*
529          * Okay, this does not seem to be appropriate
530          * for now, however, we need to check if it
531          * is really so; aka Router Reachability Probing.
532          *
533          * Router Reachability Probe MUST be rate-limited
534          * to no more than one per minute.
535          */
536         if (!rt || !(rt->fib6_flags & RTF_GATEWAY))
537                 return;
538
539         nh_gw = &rt->fib6_nh.nh_gw;
540         dev = rt->fib6_nh.nh_dev;
541         rcu_read_lock_bh();
542         idev = __in6_dev_get(dev);
543         neigh = __ipv6_neigh_lookup_noref(dev, nh_gw);
544         if (neigh) {
545                 if (neigh->nud_state & NUD_VALID)
546                         goto out;
547
548                 write_lock(&neigh->lock);
549                 if (!(neigh->nud_state & NUD_VALID) &&
550                     time_after(jiffies,
551                                neigh->updated + idev->cnf.rtr_probe_interval)) {
552                         work = kmalloc(sizeof(*work), GFP_ATOMIC);
553                         if (work)
554                                 __neigh_set_probe_once(neigh);
555                 }
556                 write_unlock(&neigh->lock);
557         } else if (time_after(jiffies, rt->last_probe +
558                                        idev->cnf.rtr_probe_interval)) {
559                 work = kmalloc(sizeof(*work), GFP_ATOMIC);
560         }
561
562         if (work) {
563                 rt->last_probe = jiffies;
564                 INIT_WORK(&work->work, rt6_probe_deferred);
565                 work->target = *nh_gw;
566                 dev_hold(dev);
567                 work->dev = dev;
568                 schedule_work(&work->work);
569         }
570
571 out:
572         rcu_read_unlock_bh();
573 }
574 #else
575 static inline void rt6_probe(struct fib6_info *rt)
576 {
577 }
578 #endif
579
580 /*
581  * Default Router Selection (RFC 2461 6.3.6)
582  */
583 static inline int rt6_check_dev(struct fib6_info *rt, int oif)
584 {
585         const struct net_device *dev = rt->fib6_nh.nh_dev;
586
587         if (!oif || dev->ifindex == oif)
588                 return 2;
589         return 0;
590 }
591
592 static inline enum rt6_nud_state rt6_check_neigh(struct fib6_info *rt)
593 {
594         enum rt6_nud_state ret = RT6_NUD_FAIL_HARD;
595         struct neighbour *neigh;
596
597         if (rt->fib6_flags & RTF_NONEXTHOP ||
598             !(rt->fib6_flags & RTF_GATEWAY))
599                 return RT6_NUD_SUCCEED;
600
601         rcu_read_lock_bh();
602         neigh = __ipv6_neigh_lookup_noref(rt->fib6_nh.nh_dev,
603                                           &rt->fib6_nh.nh_gw);
604         if (neigh) {
605                 read_lock(&neigh->lock);
606                 if (neigh->nud_state & NUD_VALID)
607                         ret = RT6_NUD_SUCCEED;
608 #ifdef CONFIG_IPV6_ROUTER_PREF
609                 else if (!(neigh->nud_state & NUD_FAILED))
610                         ret = RT6_NUD_SUCCEED;
611                 else
612                         ret = RT6_NUD_FAIL_PROBE;
613 #endif
614                 read_unlock(&neigh->lock);
615         } else {
616                 ret = IS_ENABLED(CONFIG_IPV6_ROUTER_PREF) ?
617                       RT6_NUD_SUCCEED : RT6_NUD_FAIL_DO_RR;
618         }
619         rcu_read_unlock_bh();
620
621         return ret;
622 }
623
624 static int rt6_score_route(struct fib6_info *rt, int oif, int strict)
625 {
626         int m;
627
628         m = rt6_check_dev(rt, oif);
629         if (!m && (strict & RT6_LOOKUP_F_IFACE))
630                 return RT6_NUD_FAIL_HARD;
631 #ifdef CONFIG_IPV6_ROUTER_PREF
632         m |= IPV6_DECODE_PREF(IPV6_EXTRACT_PREF(rt->fib6_flags)) << 2;
633 #endif
634         if (strict & RT6_LOOKUP_F_REACHABLE) {
635                 int n = rt6_check_neigh(rt);
636                 if (n < 0)
637                         return n;
638         }
639         return m;
640 }
641
642 /* called with rc_read_lock held */
643 static inline bool fib6_ignore_linkdown(const struct fib6_info *f6i)
644 {
645         const struct net_device *dev = fib6_info_nh_dev(f6i);
646         bool rc = false;
647
648         if (dev) {
649                 const struct inet6_dev *idev = __in6_dev_get(dev);
650
651                 rc = !!idev->cnf.ignore_routes_with_linkdown;
652         }
653
654         return rc;
655 }
656
657 static struct fib6_info *find_match(struct fib6_info *rt, int oif, int strict,
658                                    int *mpri, struct fib6_info *match,
659                                    bool *do_rr)
660 {
661         int m;
662         bool match_do_rr = false;
663
664         if (rt->fib6_nh.nh_flags & RTNH_F_DEAD)
665                 goto out;
666
667         if (fib6_ignore_linkdown(rt) &&
668             rt->fib6_nh.nh_flags & RTNH_F_LINKDOWN &&
669             !(strict & RT6_LOOKUP_F_IGNORE_LINKSTATE))
670                 goto out;
671
672         if (fib6_check_expired(rt))
673                 goto out;
674
675         m = rt6_score_route(rt, oif, strict);
676         if (m == RT6_NUD_FAIL_DO_RR) {
677                 match_do_rr = true;
678                 m = 0; /* lowest valid score */
679         } else if (m == RT6_NUD_FAIL_HARD) {
680                 goto out;
681         }
682
683         if (strict & RT6_LOOKUP_F_REACHABLE)
684                 rt6_probe(rt);
685
686         /* note that m can be RT6_NUD_FAIL_PROBE at this point */
687         if (m > *mpri) {
688                 *do_rr = match_do_rr;
689                 *mpri = m;
690                 match = rt;
691         }
692 out:
693         return match;
694 }
695
696 static struct fib6_info *find_rr_leaf(struct fib6_node *fn,
697                                      struct fib6_info *leaf,
698                                      struct fib6_info *rr_head,
699                                      u32 metric, int oif, int strict,
700                                      bool *do_rr)
701 {
702         struct fib6_info *rt, *match, *cont;
703         int mpri = -1;
704
705         match = NULL;
706         cont = NULL;
707         for (rt = rr_head; rt; rt = rcu_dereference(rt->fib6_next)) {
708                 if (rt->fib6_metric != metric) {
709                         cont = rt;
710                         break;
711                 }
712
713                 match = find_match(rt, oif, strict, &mpri, match, do_rr);
714         }
715
716         for (rt = leaf; rt && rt != rr_head;
717              rt = rcu_dereference(rt->fib6_next)) {
718                 if (rt->fib6_metric != metric) {
719                         cont = rt;
720                         break;
721                 }
722
723                 match = find_match(rt, oif, strict, &mpri, match, do_rr);
724         }
725
726         if (match || !cont)
727                 return match;
728
729         for (rt = cont; rt; rt = rcu_dereference(rt->fib6_next))
730                 match = find_match(rt, oif, strict, &mpri, match, do_rr);
731
732         return match;
733 }
734
735 static struct fib6_info *rt6_select(struct net *net, struct fib6_node *fn,
736                                    int oif, int strict)
737 {
738         struct fib6_info *leaf = rcu_dereference(fn->leaf);
739         struct fib6_info *match, *rt0;
740         bool do_rr = false;
741         int key_plen;
742
743         if (!leaf || leaf == net->ipv6.fib6_null_entry)
744                 return net->ipv6.fib6_null_entry;
745
746         rt0 = rcu_dereference(fn->rr_ptr);
747         if (!rt0)
748                 rt0 = leaf;
749
750         /* Double check to make sure fn is not an intermediate node
751          * and fn->leaf does not points to its child's leaf
752          * (This might happen if all routes under fn are deleted from
753          * the tree and fib6_repair_tree() is called on the node.)
754          */
755         key_plen = rt0->fib6_dst.plen;
756 #ifdef CONFIG_IPV6_SUBTREES
757         if (rt0->fib6_src.plen)
758                 key_plen = rt0->fib6_src.plen;
759 #endif
760         if (fn->fn_bit != key_plen)
761                 return net->ipv6.fib6_null_entry;
762
763         match = find_rr_leaf(fn, leaf, rt0, rt0->fib6_metric, oif, strict,
764                              &do_rr);
765
766         if (do_rr) {
767                 struct fib6_info *next = rcu_dereference(rt0->fib6_next);
768
769                 /* no entries matched; do round-robin */
770                 if (!next || next->fib6_metric != rt0->fib6_metric)
771                         next = leaf;
772
773                 if (next != rt0) {
774                         spin_lock_bh(&leaf->fib6_table->tb6_lock);
775                         /* make sure next is not being deleted from the tree */
776                         if (next->fib6_node)
777                                 rcu_assign_pointer(fn->rr_ptr, next);
778                         spin_unlock_bh(&leaf->fib6_table->tb6_lock);
779                 }
780         }
781
782         return match ? match : net->ipv6.fib6_null_entry;
783 }
784
785 static bool rt6_is_gw_or_nonexthop(const struct fib6_info *rt)
786 {
787         return (rt->fib6_flags & (RTF_NONEXTHOP | RTF_GATEWAY));
788 }
789
790 #ifdef CONFIG_IPV6_ROUTE_INFO
791 int rt6_route_rcv(struct net_device *dev, u8 *opt, int len,
792                   const struct in6_addr *gwaddr)
793 {
794         struct net *net = dev_net(dev);
795         struct route_info *rinfo = (struct route_info *) opt;
796         struct in6_addr prefix_buf, *prefix;
797         unsigned int pref;
798         unsigned long lifetime;
799         struct fib6_info *rt;
800
801         if (len < sizeof(struct route_info)) {
802                 return -EINVAL;
803         }
804
805         /* Sanity check for prefix_len and length */
806         if (rinfo->length > 3) {
807                 return -EINVAL;
808         } else if (rinfo->prefix_len > 128) {
809                 return -EINVAL;
810         } else if (rinfo->prefix_len > 64) {
811                 if (rinfo->length < 2) {
812                         return -EINVAL;
813                 }
814         } else if (rinfo->prefix_len > 0) {
815                 if (rinfo->length < 1) {
816                         return -EINVAL;
817                 }
818         }
819
820         pref = rinfo->route_pref;
821         if (pref == ICMPV6_ROUTER_PREF_INVALID)
822                 return -EINVAL;
823
824         lifetime = addrconf_timeout_fixup(ntohl(rinfo->lifetime), HZ);
825
826         if (rinfo->length == 3)
827                 prefix = (struct in6_addr *)rinfo->prefix;
828         else {
829                 /* this function is safe */
830                 ipv6_addr_prefix(&prefix_buf,
831                                  (struct in6_addr *)rinfo->prefix,
832                                  rinfo->prefix_len);
833                 prefix = &prefix_buf;
834         }
835
836         if (rinfo->prefix_len == 0)
837                 rt = rt6_get_dflt_router(net, gwaddr, dev);
838         else
839                 rt = rt6_get_route_info(net, prefix, rinfo->prefix_len,
840                                         gwaddr, dev);
841
842         if (rt && !lifetime) {
843                 ip6_del_rt(net, rt);
844                 rt = NULL;
845         }
846
847         if (!rt && lifetime)
848                 rt = rt6_add_route_info(net, prefix, rinfo->prefix_len, gwaddr,
849                                         dev, pref);
850         else if (rt)
851                 rt->fib6_flags = RTF_ROUTEINFO |
852                                  (rt->fib6_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
853
854         if (rt) {
855                 if (!addrconf_finite_timeout(lifetime))
856                         fib6_clean_expires(rt);
857                 else
858                         fib6_set_expires(rt, jiffies + HZ * lifetime);
859
860                 fib6_info_release(rt);
861         }
862         return 0;
863 }
864 #endif
865
866 /*
867  *      Misc support functions
868  */
869
870 /* called with rcu_lock held */
871 static struct net_device *ip6_rt_get_dev_rcu(struct fib6_info *rt)
872 {
873         struct net_device *dev = rt->fib6_nh.nh_dev;
874
875         if (rt->fib6_flags & (RTF_LOCAL | RTF_ANYCAST)) {
876                 /* for copies of local routes, dst->dev needs to be the
877                  * device if it is a master device, the master device if
878                  * device is enslaved, and the loopback as the default
879                  */
880                 if (netif_is_l3_slave(dev) &&
881                     !rt6_need_strict(&rt->fib6_dst.addr))
882                         dev = l3mdev_master_dev_rcu(dev);
883                 else if (!netif_is_l3_master(dev))
884                         dev = dev_net(dev)->loopback_dev;
885                 /* last case is netif_is_l3_master(dev) is true in which
886                  * case we want dev returned to be dev
887                  */
888         }
889
890         return dev;
891 }
892
893 static const int fib6_prop[RTN_MAX + 1] = {
894         [RTN_UNSPEC]    = 0,
895         [RTN_UNICAST]   = 0,
896         [RTN_LOCAL]     = 0,
897         [RTN_BROADCAST] = 0,
898         [RTN_ANYCAST]   = 0,
899         [RTN_MULTICAST] = 0,
900         [RTN_BLACKHOLE] = -EINVAL,
901         [RTN_UNREACHABLE] = -EHOSTUNREACH,
902         [RTN_PROHIBIT]  = -EACCES,
903         [RTN_THROW]     = -EAGAIN,
904         [RTN_NAT]       = -EINVAL,
905         [RTN_XRESOLVE]  = -EINVAL,
906 };
907
908 static int ip6_rt_type_to_error(u8 fib6_type)
909 {
910         return fib6_prop[fib6_type];
911 }
912
913 static unsigned short fib6_info_dst_flags(struct fib6_info *rt)
914 {
915         unsigned short flags = 0;
916
917         if (rt->dst_nocount)
918                 flags |= DST_NOCOUNT;
919         if (rt->dst_nopolicy)
920                 flags |= DST_NOPOLICY;
921         if (rt->dst_host)
922                 flags |= DST_HOST;
923
924         return flags;
925 }
926
927 static void ip6_rt_init_dst_reject(struct rt6_info *rt, struct fib6_info *ort)
928 {
929         rt->dst.error = ip6_rt_type_to_error(ort->fib6_type);
930
931         switch (ort->fib6_type) {
932         case RTN_BLACKHOLE:
933                 rt->dst.output = dst_discard_out;
934                 rt->dst.input = dst_discard;
935                 break;
936         case RTN_PROHIBIT:
937                 rt->dst.output = ip6_pkt_prohibit_out;
938                 rt->dst.input = ip6_pkt_prohibit;
939                 break;
940         case RTN_THROW:
941         case RTN_UNREACHABLE:
942         default:
943                 rt->dst.output = ip6_pkt_discard_out;
944                 rt->dst.input = ip6_pkt_discard;
945                 break;
946         }
947 }
948
949 static void ip6_rt_init_dst(struct rt6_info *rt, struct fib6_info *ort)
950 {
951         if (ort->fib6_flags & RTF_REJECT) {
952                 ip6_rt_init_dst_reject(rt, ort);
953                 return;
954         }
955
956         rt->dst.error = 0;
957         rt->dst.output = ip6_output;
958
959         if (ort->fib6_type == RTN_LOCAL || ort->fib6_type == RTN_ANYCAST) {
960                 rt->dst.input = ip6_input;
961         } else if (ipv6_addr_type(&ort->fib6_dst.addr) & IPV6_ADDR_MULTICAST) {
962                 rt->dst.input = ip6_mc_input;
963         } else {
964                 rt->dst.input = ip6_forward;
965         }
966
967         if (ort->fib6_nh.nh_lwtstate) {
968                 rt->dst.lwtstate = lwtstate_get(ort->fib6_nh.nh_lwtstate);
969                 lwtunnel_set_redirect(&rt->dst);
970         }
971
972         rt->dst.lastuse = jiffies;
973 }
974
975 /* Caller must already hold reference to @from */
976 static void rt6_set_from(struct rt6_info *rt, struct fib6_info *from)
977 {
978         rt->rt6i_flags &= ~RTF_EXPIRES;
979         rcu_assign_pointer(rt->from, from);
980         ip_dst_init_metrics(&rt->dst, from->fib6_metrics);
981 }
982
983 /* Caller must already hold reference to @ort */
984 static void ip6_rt_copy_init(struct rt6_info *rt, struct fib6_info *ort)
985 {
986         struct net_device *dev = fib6_info_nh_dev(ort);
987
988         ip6_rt_init_dst(rt, ort);
989
990         rt->rt6i_dst = ort->fib6_dst;
991         rt->rt6i_idev = dev ? in6_dev_get(dev) : NULL;
992         rt->rt6i_gateway = ort->fib6_nh.nh_gw;
993         rt->rt6i_flags = ort->fib6_flags;
994         rt6_set_from(rt, ort);
995 #ifdef CONFIG_IPV6_SUBTREES
996         rt->rt6i_src = ort->fib6_src;
997 #endif
998 }
999
1000 static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
1001                                         struct in6_addr *saddr)
1002 {
1003         struct fib6_node *pn, *sn;
1004         while (1) {
1005                 if (fn->fn_flags & RTN_TL_ROOT)
1006                         return NULL;
1007                 pn = rcu_dereference(fn->parent);
1008                 sn = FIB6_SUBTREE(pn);
1009                 if (sn && sn != fn)
1010                         fn = fib6_node_lookup(sn, NULL, saddr);
1011                 else
1012                         fn = pn;
1013                 if (fn->fn_flags & RTN_RTINFO)
1014                         return fn;
1015         }
1016 }
1017
1018 static bool ip6_hold_safe(struct net *net, struct rt6_info **prt,
1019                           bool null_fallback)
1020 {
1021         struct rt6_info *rt = *prt;
1022
1023         if (dst_hold_safe(&rt->dst))
1024                 return true;
1025         if (null_fallback) {
1026                 rt = net->ipv6.ip6_null_entry;
1027                 dst_hold(&rt->dst);
1028         } else {
1029                 rt = NULL;
1030         }
1031         *prt = rt;
1032         return false;
1033 }
1034
1035 /* called with rcu_lock held */
1036 static struct rt6_info *ip6_create_rt_rcu(struct fib6_info *rt)
1037 {
1038         unsigned short flags = fib6_info_dst_flags(rt);
1039         struct net_device *dev = rt->fib6_nh.nh_dev;
1040         struct rt6_info *nrt;
1041
1042         if (!fib6_info_hold_safe(rt))
1043                 return NULL;
1044
1045         nrt = ip6_dst_alloc(dev_net(dev), dev, flags);
1046         if (nrt)
1047                 ip6_rt_copy_init(nrt, rt);
1048         else
1049                 fib6_info_release(rt);
1050
1051         return nrt;
1052 }
1053
1054 static struct rt6_info *ip6_pol_route_lookup(struct net *net,
1055                                              struct fib6_table *table,
1056                                              struct flowi6 *fl6,
1057                                              const struct sk_buff *skb,
1058                                              int flags)
1059 {
1060         struct fib6_info *f6i;
1061         struct fib6_node *fn;
1062         struct rt6_info *rt;
1063
1064         if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF)
1065                 flags &= ~RT6_LOOKUP_F_IFACE;
1066
1067         rcu_read_lock();
1068         fn = fib6_node_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
1069 restart:
1070         f6i = rcu_dereference(fn->leaf);
1071         if (!f6i) {
1072                 f6i = net->ipv6.fib6_null_entry;
1073         } else {
1074                 f6i = rt6_device_match(net, f6i, &fl6->saddr,
1075                                       fl6->flowi6_oif, flags);
1076                 if (f6i->fib6_nsiblings && fl6->flowi6_oif == 0)
1077                         f6i = fib6_multipath_select(net, f6i, fl6,
1078                                                     fl6->flowi6_oif, skb,
1079                                                     flags);
1080         }
1081         if (f6i == net->ipv6.fib6_null_entry) {
1082                 fn = fib6_backtrack(fn, &fl6->saddr);
1083                 if (fn)
1084                         goto restart;
1085         }
1086
1087         trace_fib6_table_lookup(net, f6i, table, fl6);
1088
1089         /* Search through exception table */
1090         rt = rt6_find_cached_rt(f6i, &fl6->daddr, &fl6->saddr);
1091         if (rt) {
1092                 if (ip6_hold_safe(net, &rt, true))
1093                         dst_use_noref(&rt->dst, jiffies);
1094         } else if (f6i == net->ipv6.fib6_null_entry) {
1095                 rt = net->ipv6.ip6_null_entry;
1096                 dst_hold(&rt->dst);
1097         } else {
1098                 rt = ip6_create_rt_rcu(f6i);
1099                 if (!rt) {
1100                         rt = net->ipv6.ip6_null_entry;
1101                         dst_hold(&rt->dst);
1102                 }
1103         }
1104
1105         rcu_read_unlock();
1106
1107         return rt;
1108 }
1109
1110 struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
1111                                    const struct sk_buff *skb, int flags)
1112 {
1113         return fib6_rule_lookup(net, fl6, skb, flags, ip6_pol_route_lookup);
1114 }
1115 EXPORT_SYMBOL_GPL(ip6_route_lookup);
1116
1117 struct rt6_info *rt6_lookup(struct net *net, const struct in6_addr *daddr,
1118                             const struct in6_addr *saddr, int oif,
1119                             const struct sk_buff *skb, int strict)
1120 {
1121         struct flowi6 fl6 = {
1122                 .flowi6_oif = oif,
1123                 .daddr = *daddr,
1124         };
1125         struct dst_entry *dst;
1126         int flags = strict ? RT6_LOOKUP_F_IFACE : 0;
1127
1128         if (saddr) {
1129                 memcpy(&fl6.saddr, saddr, sizeof(*saddr));
1130                 flags |= RT6_LOOKUP_F_HAS_SADDR;
1131         }
1132
1133         dst = fib6_rule_lookup(net, &fl6, skb, flags, ip6_pol_route_lookup);
1134         if (dst->error == 0)
1135                 return (struct rt6_info *) dst;
1136
1137         dst_release(dst);
1138
1139         return NULL;
1140 }
1141 EXPORT_SYMBOL(rt6_lookup);
1142
1143 /* ip6_ins_rt is called with FREE table->tb6_lock.
1144  * It takes new route entry, the addition fails by any reason the
1145  * route is released.
1146  * Caller must hold dst before calling it.
1147  */
1148
1149 static int __ip6_ins_rt(struct fib6_info *rt, struct nl_info *info,
1150                         struct netlink_ext_ack *extack)
1151 {
1152         int err;
1153         struct fib6_table *table;
1154
1155         table = rt->fib6_table;
1156         spin_lock_bh(&table->tb6_lock);
1157         err = fib6_add(&table->tb6_root, rt, info, extack);
1158         spin_unlock_bh(&table->tb6_lock);
1159
1160         return err;
1161 }
1162
1163 int ip6_ins_rt(struct net *net, struct fib6_info *rt)
1164 {
1165         struct nl_info info = { .nl_net = net, };
1166
1167         return __ip6_ins_rt(rt, &info, NULL);
1168 }
1169
1170 static struct rt6_info *ip6_rt_cache_alloc(struct fib6_info *ort,
1171                                            const struct in6_addr *daddr,
1172                                            const struct in6_addr *saddr)
1173 {
1174         struct net_device *dev;
1175         struct rt6_info *rt;
1176
1177         /*
1178          *      Clone the route.
1179          */
1180
1181         if (!fib6_info_hold_safe(ort))
1182                 return NULL;
1183
1184         dev = ip6_rt_get_dev_rcu(ort);
1185         rt = ip6_dst_alloc(dev_net(dev), dev, 0);
1186         if (!rt) {
1187                 fib6_info_release(ort);
1188                 return NULL;
1189         }
1190
1191         ip6_rt_copy_init(rt, ort);
1192         rt->rt6i_flags |= RTF_CACHE;
1193         rt->dst.flags |= DST_HOST;
1194         rt->rt6i_dst.addr = *daddr;
1195         rt->rt6i_dst.plen = 128;
1196
1197         if (!rt6_is_gw_or_nonexthop(ort)) {
1198                 if (ort->fib6_dst.plen != 128 &&
1199                     ipv6_addr_equal(&ort->fib6_dst.addr, daddr))
1200                         rt->rt6i_flags |= RTF_ANYCAST;
1201 #ifdef CONFIG_IPV6_SUBTREES
1202                 if (rt->rt6i_src.plen && saddr) {
1203                         rt->rt6i_src.addr = *saddr;
1204                         rt->rt6i_src.plen = 128;
1205                 }
1206 #endif
1207         }
1208
1209         return rt;
1210 }
1211
1212 static struct rt6_info *ip6_rt_pcpu_alloc(struct fib6_info *rt)
1213 {
1214         unsigned short flags = fib6_info_dst_flags(rt);
1215         struct net_device *dev;
1216         struct rt6_info *pcpu_rt;
1217
1218         if (!fib6_info_hold_safe(rt))
1219                 return NULL;
1220
1221         rcu_read_lock();
1222         dev = ip6_rt_get_dev_rcu(rt);
1223         pcpu_rt = ip6_dst_alloc(dev_net(dev), dev, flags);
1224         rcu_read_unlock();
1225         if (!pcpu_rt) {
1226                 fib6_info_release(rt);
1227                 return NULL;
1228         }
1229         ip6_rt_copy_init(pcpu_rt, rt);
1230         pcpu_rt->rt6i_flags |= RTF_PCPU;
1231         return pcpu_rt;
1232 }
1233
1234 /* It should be called with rcu_read_lock() acquired */
1235 static struct rt6_info *rt6_get_pcpu_route(struct fib6_info *rt)
1236 {
1237         struct rt6_info *pcpu_rt, **p;
1238
1239         p = this_cpu_ptr(rt->rt6i_pcpu);
1240         pcpu_rt = *p;
1241
1242         if (pcpu_rt)
1243                 ip6_hold_safe(NULL, &pcpu_rt, false);
1244
1245         return pcpu_rt;
1246 }
1247
1248 static struct rt6_info *rt6_make_pcpu_route(struct net *net,
1249                                             struct fib6_info *rt)
1250 {
1251         struct rt6_info *pcpu_rt, *prev, **p;
1252
1253         pcpu_rt = ip6_rt_pcpu_alloc(rt);
1254         if (!pcpu_rt) {
1255                 dst_hold(&net->ipv6.ip6_null_entry->dst);
1256                 return net->ipv6.ip6_null_entry;
1257         }
1258
1259         dst_hold(&pcpu_rt->dst);
1260         p = this_cpu_ptr(rt->rt6i_pcpu);
1261         prev = cmpxchg(p, NULL, pcpu_rt);
1262         BUG_ON(prev);
1263
1264         return pcpu_rt;
1265 }
1266
1267 /* exception hash table implementation
1268  */
1269 static DEFINE_SPINLOCK(rt6_exception_lock);
1270
1271 /* Remove rt6_ex from hash table and free the memory
1272  * Caller must hold rt6_exception_lock
1273  */
1274 static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
1275                                  struct rt6_exception *rt6_ex)
1276 {
1277         struct fib6_info *from;
1278         struct net *net;
1279
1280         if (!bucket || !rt6_ex)
1281                 return;
1282
1283         net = dev_net(rt6_ex->rt6i->dst.dev);
1284         net->ipv6.rt6_stats->fib_rt_cache--;
1285
1286         /* purge completely the exception to allow releasing the held resources:
1287          * some [sk] cache may keep the dst around for unlimited time
1288          */
1289         from = rcu_dereference_protected(rt6_ex->rt6i->from,
1290                                          lockdep_is_held(&rt6_exception_lock));
1291         rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
1292         fib6_info_release(from);
1293         dst_dev_put(&rt6_ex->rt6i->dst);
1294
1295         hlist_del_rcu(&rt6_ex->hlist);
1296         dst_release(&rt6_ex->rt6i->dst);
1297         kfree_rcu(rt6_ex, rcu);
1298         WARN_ON_ONCE(!bucket->depth);
1299         bucket->depth--;
1300 }
1301
1302 /* Remove oldest rt6_ex in bucket and free the memory
1303  * Caller must hold rt6_exception_lock
1304  */
1305 static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
1306 {
1307         struct rt6_exception *rt6_ex, *oldest = NULL;
1308
1309         if (!bucket)
1310                 return;
1311
1312         hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
1313                 if (!oldest || time_before(rt6_ex->stamp, oldest->stamp))
1314                         oldest = rt6_ex;
1315         }
1316         rt6_remove_exception(bucket, oldest);
1317 }
1318
1319 static u32 rt6_exception_hash(const struct in6_addr *dst,
1320                               const struct in6_addr *src)
1321 {
1322         static u32 seed __read_mostly;
1323         u32 val;
1324
1325         net_get_random_once(&seed, sizeof(seed));
1326         val = jhash(dst, sizeof(*dst), seed);
1327
1328 #ifdef CONFIG_IPV6_SUBTREES
1329         if (src)
1330                 val = jhash(src, sizeof(*src), val);
1331 #endif
1332         return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
1333 }
1334
1335 /* Helper function to find the cached rt in the hash table
1336  * and update bucket pointer to point to the bucket for this
1337  * (daddr, saddr) pair
1338  * Caller must hold rt6_exception_lock
1339  */
1340 static struct rt6_exception *
1341 __rt6_find_exception_spinlock(struct rt6_exception_bucket **bucket,
1342                               const struct in6_addr *daddr,
1343                               const struct in6_addr *saddr)
1344 {
1345         struct rt6_exception *rt6_ex;
1346         u32 hval;
1347
1348         if (!(*bucket) || !daddr)
1349                 return NULL;
1350
1351         hval = rt6_exception_hash(daddr, saddr);
1352         *bucket += hval;
1353
1354         hlist_for_each_entry(rt6_ex, &(*bucket)->chain, hlist) {
1355                 struct rt6_info *rt6 = rt6_ex->rt6i;
1356                 bool matched = ipv6_addr_equal(daddr, &rt6->rt6i_dst.addr);
1357
1358 #ifdef CONFIG_IPV6_SUBTREES
1359                 if (matched && saddr)
1360                         matched = ipv6_addr_equal(saddr, &rt6->rt6i_src.addr);
1361 #endif
1362                 if (matched)
1363                         return rt6_ex;
1364         }
1365         return NULL;
1366 }
1367
1368 /* Helper function to find the cached rt in the hash table
1369  * and update bucket pointer to point to the bucket for this
1370  * (daddr, saddr) pair
1371  * Caller must hold rcu_read_lock()
1372  */
1373 static struct rt6_exception *
1374 __rt6_find_exception_rcu(struct rt6_exception_bucket **bucket,
1375                          const struct in6_addr *daddr,
1376                          const struct in6_addr *saddr)
1377 {
1378         struct rt6_exception *rt6_ex;
1379         u32 hval;
1380
1381         WARN_ON_ONCE(!rcu_read_lock_held());
1382
1383         if (!(*bucket) || !daddr)
1384                 return NULL;
1385
1386         hval = rt6_exception_hash(daddr, saddr);
1387         *bucket += hval;
1388
1389         hlist_for_each_entry_rcu(rt6_ex, &(*bucket)->chain, hlist) {
1390                 struct rt6_info *rt6 = rt6_ex->rt6i;
1391                 bool matched = ipv6_addr_equal(daddr, &rt6->rt6i_dst.addr);
1392
1393 #ifdef CONFIG_IPV6_SUBTREES
1394                 if (matched && saddr)
1395                         matched = ipv6_addr_equal(saddr, &rt6->rt6i_src.addr);
1396 #endif
1397                 if (matched)
1398                         return rt6_ex;
1399         }
1400         return NULL;
1401 }
1402
1403 static unsigned int fib6_mtu(const struct fib6_info *rt)
1404 {
1405         unsigned int mtu;
1406
1407         if (rt->fib6_pmtu) {
1408                 mtu = rt->fib6_pmtu;
1409         } else {
1410                 struct net_device *dev = fib6_info_nh_dev(rt);
1411                 struct inet6_dev *idev;
1412
1413                 rcu_read_lock();
1414                 idev = __in6_dev_get(dev);
1415                 mtu = idev->cnf.mtu6;
1416                 rcu_read_unlock();
1417         }
1418
1419         mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);
1420
1421         return mtu - lwtunnel_headroom(rt->fib6_nh.nh_lwtstate, mtu);
1422 }
1423
1424 static int rt6_insert_exception(struct rt6_info *nrt,
1425                                 struct fib6_info *ort)
1426 {
1427         struct net *net = dev_net(nrt->dst.dev);
1428         struct rt6_exception_bucket *bucket;
1429         struct in6_addr *src_key = NULL;
1430         struct rt6_exception *rt6_ex;
1431         int err = 0;
1432
1433         spin_lock_bh(&rt6_exception_lock);
1434
1435         if (ort->exception_bucket_flushed) {
1436                 err = -EINVAL;
1437                 goto out;
1438         }
1439
1440         bucket = rcu_dereference_protected(ort->rt6i_exception_bucket,
1441                                         lockdep_is_held(&rt6_exception_lock));
1442         if (!bucket) {
1443                 bucket = kcalloc(FIB6_EXCEPTION_BUCKET_SIZE, sizeof(*bucket),
1444                                  GFP_ATOMIC);
1445                 if (!bucket) {
1446                         err = -ENOMEM;
1447                         goto out;
1448                 }
1449                 rcu_assign_pointer(ort->rt6i_exception_bucket, bucket);
1450         }
1451
1452 #ifdef CONFIG_IPV6_SUBTREES
1453         /* rt6i_src.plen != 0 indicates ort is in subtree
1454          * and exception table is indexed by a hash of
1455          * both rt6i_dst and rt6i_src.
1456          * Otherwise, the exception table is indexed by
1457          * a hash of only rt6i_dst.
1458          */
1459         if (ort->fib6_src.plen)
1460                 src_key = &nrt->rt6i_src.addr;
1461 #endif
1462         /* rt6_mtu_change() might lower mtu on ort.
1463          * Only insert this exception route if its mtu
1464          * is less than ort's mtu value.
1465          */
1466         if (dst_metric_raw(&nrt->dst, RTAX_MTU) >= fib6_mtu(ort)) {
1467                 err = -EINVAL;
1468                 goto out;
1469         }
1470
1471         rt6_ex = __rt6_find_exception_spinlock(&bucket, &nrt->rt6i_dst.addr,
1472                                                src_key);
1473         if (rt6_ex)
1474                 rt6_remove_exception(bucket, rt6_ex);
1475
1476         rt6_ex = kzalloc(sizeof(*rt6_ex), GFP_ATOMIC);
1477         if (!rt6_ex) {
1478                 err = -ENOMEM;
1479                 goto out;
1480         }
1481         rt6_ex->rt6i = nrt;
1482         rt6_ex->stamp = jiffies;
1483         hlist_add_head_rcu(&rt6_ex->hlist, &bucket->chain);
1484         bucket->depth++;
1485         net->ipv6.rt6_stats->fib_rt_cache++;
1486
1487         if (bucket->depth > FIB6_MAX_DEPTH)
1488                 rt6_exception_remove_oldest(bucket);
1489
1490 out:
1491         spin_unlock_bh(&rt6_exception_lock);
1492
1493         /* Update fn->fn_sernum to invalidate all cached dst */
1494         if (!err) {
1495                 spin_lock_bh(&ort->fib6_table->tb6_lock);
1496                 fib6_update_sernum(net, ort);
1497                 spin_unlock_bh(&ort->fib6_table->tb6_lock);
1498                 fib6_force_start_gc(net);
1499         }
1500
1501         return err;
1502 }
1503
1504 void rt6_flush_exceptions(struct fib6_info *rt)
1505 {
1506         struct rt6_exception_bucket *bucket;
1507         struct rt6_exception *rt6_ex;
1508         struct hlist_node *tmp;
1509         int i;
1510
1511         spin_lock_bh(&rt6_exception_lock);
1512         /* Prevent rt6_insert_exception() to recreate the bucket list */
1513         rt->exception_bucket_flushed = 1;
1514
1515         bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
1516                                     lockdep_is_held(&rt6_exception_lock));
1517         if (!bucket)
1518                 goto out;
1519
1520         for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
1521                 hlist_for_each_entry_safe(rt6_ex, tmp, &bucket->chain, hlist)
1522                         rt6_remove_exception(bucket, rt6_ex);
1523                 WARN_ON_ONCE(bucket->depth);
1524                 bucket++;
1525         }
1526
1527 out:
1528         spin_unlock_bh(&rt6_exception_lock);
1529 }
1530
1531 /* Find cached rt in the hash table inside passed in rt
1532  * Caller has to hold rcu_read_lock()
1533  */
1534 static struct rt6_info *rt6_find_cached_rt(struct fib6_info *rt,
1535                                            struct in6_addr *daddr,
1536                                            struct in6_addr *saddr)
1537 {
1538         struct rt6_exception_bucket *bucket;
1539         struct in6_addr *src_key = NULL;
1540         struct rt6_exception *rt6_ex;
1541         struct rt6_info *res = NULL;
1542
1543         bucket = rcu_dereference(rt->rt6i_exception_bucket);
1544
1545 #ifdef CONFIG_IPV6_SUBTREES
1546         /* rt6i_src.plen != 0 indicates rt is in subtree
1547          * and exception table is indexed by a hash of
1548          * both rt6i_dst and rt6i_src.
1549          * Otherwise, the exception table is indexed by
1550          * a hash of only rt6i_dst.
1551          */
1552         if (rt->fib6_src.plen)
1553                 src_key = saddr;
1554 #endif
1555         rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);
1556
1557         if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
1558                 res = rt6_ex->rt6i;
1559
1560         return res;
1561 }
1562
1563 /* Remove the passed in cached rt from the hash table that contains it */
1564 static int rt6_remove_exception_rt(struct rt6_info *rt)
1565 {
1566         struct rt6_exception_bucket *bucket;
1567         struct in6_addr *src_key = NULL;
1568         struct rt6_exception *rt6_ex;
1569         struct fib6_info *from;
1570         int err;
1571
1572         from = rcu_dereference(rt->from);
1573         if (!from ||
1574             !(rt->rt6i_flags & RTF_CACHE))
1575                 return -EINVAL;
1576
1577         if (!rcu_access_pointer(from->rt6i_exception_bucket))
1578                 return -ENOENT;
1579
1580         spin_lock_bh(&rt6_exception_lock);
1581         bucket = rcu_dereference_protected(from->rt6i_exception_bucket,
1582                                     lockdep_is_held(&rt6_exception_lock));
1583 #ifdef CONFIG_IPV6_SUBTREES
1584         /* rt6i_src.plen != 0 indicates 'from' is in subtree
1585          * and exception table is indexed by a hash of
1586          * both rt6i_dst and rt6i_src.
1587          * Otherwise, the exception table is indexed by
1588          * a hash of only rt6i_dst.
1589          */
1590         if (from->fib6_src.plen)
1591                 src_key = &rt->rt6i_src.addr;
1592 #endif
1593         rt6_ex = __rt6_find_exception_spinlock(&bucket,
1594                                                &rt->rt6i_dst.addr,
1595                                                src_key);
1596         if (rt6_ex) {
1597                 rt6_remove_exception(bucket, rt6_ex);
1598                 err = 0;
1599         } else {
1600                 err = -ENOENT;
1601         }
1602
1603         spin_unlock_bh(&rt6_exception_lock);
1604         return err;
1605 }
1606
1607 /* Find rt6_ex which contains the passed in rt cache and
1608  * refresh its stamp
1609  */
1610 static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
1611 {
1612         struct rt6_exception_bucket *bucket;
1613         struct in6_addr *src_key = NULL;
1614         struct rt6_exception *rt6_ex;
1615         struct fib6_info *from;
1616
1617         rcu_read_lock();
1618         from = rcu_dereference(rt->from);
1619         if (!from || !(rt->rt6i_flags & RTF_CACHE))
1620                 goto unlock;
1621
1622         bucket = rcu_dereference(from->rt6i_exception_bucket);
1623
1624 #ifdef CONFIG_IPV6_SUBTREES
1625         /* rt6i_src.plen != 0 indicates 'from' is in subtree
1626          * and exception table is indexed by a hash of
1627          * both rt6i_dst and rt6i_src.
1628          * Otherwise, the exception table is indexed by
1629          * a hash of only rt6i_dst.
1630          */
1631         if (from->fib6_src.plen)
1632                 src_key = &rt->rt6i_src.addr;
1633 #endif
1634         rt6_ex = __rt6_find_exception_rcu(&bucket,
1635                                           &rt->rt6i_dst.addr,
1636                                           src_key);
1637         if (rt6_ex)
1638                 rt6_ex->stamp = jiffies;
1639
1640 unlock:
1641         rcu_read_unlock();
1642 }
1643
1644 static bool rt6_mtu_change_route_allowed(struct inet6_dev *idev,
1645                                          struct rt6_info *rt, int mtu)
1646 {
1647         /* If the new MTU is lower than the route PMTU, this new MTU will be the
1648          * lowest MTU in the path: always allow updating the route PMTU to
1649          * reflect PMTU decreases.
1650          *
1651          * If the new MTU is higher, and the route PMTU is equal to the local
1652          * MTU, this means the old MTU is the lowest in the path, so allow
1653          * updating it: if other nodes now have lower MTUs, PMTU discovery will
1654          * handle this.
1655          */
1656
1657         if (dst_mtu(&rt->dst) >= mtu)
1658                 return true;
1659
1660         if (dst_mtu(&rt->dst) == idev->cnf.mtu6)
1661                 return true;
1662
1663         return false;
1664 }
1665
1666 static void rt6_exceptions_update_pmtu(struct inet6_dev *idev,
1667                                        struct fib6_info *rt, int mtu)
1668 {
1669         struct rt6_exception_bucket *bucket;
1670         struct rt6_exception *rt6_ex;
1671         int i;
1672
1673         bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
1674                                         lockdep_is_held(&rt6_exception_lock));
1675
1676         if (!bucket)
1677                 return;
1678
1679         for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
1680                 hlist_for_each_entry(rt6_ex, &bucket->chain, hlist) {
1681                         struct rt6_info *entry = rt6_ex->rt6i;
1682
1683                         /* For RTF_CACHE with rt6i_pmtu == 0 (i.e. a redirected
1684                          * route), the metrics of its rt->from have already
1685                          * been updated.
1686                          */
1687                         if (dst_metric_raw(&entry->dst, RTAX_MTU) &&
1688                             rt6_mtu_change_route_allowed(idev, entry, mtu))
1689                                 dst_metric_set(&entry->dst, RTAX_MTU, mtu);
1690                 }
1691                 bucket++;
1692         }
1693 }
1694
1695 #define RTF_CACHE_GATEWAY       (RTF_GATEWAY | RTF_CACHE)
1696
1697 static void rt6_exceptions_clean_tohost(struct fib6_info *rt,
1698                                         struct in6_addr *gateway)
1699 {
1700         struct rt6_exception_bucket *bucket;
1701         struct rt6_exception *rt6_ex;
1702         struct hlist_node *tmp;
1703         int i;
1704
1705         if (!rcu_access_pointer(rt->rt6i_exception_bucket))
1706                 return;
1707
1708         spin_lock_bh(&rt6_exception_lock);
1709         bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
1710                                      lockdep_is_held(&rt6_exception_lock));
1711
1712         if (bucket) {
1713                 for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
1714                         hlist_for_each_entry_safe(rt6_ex, tmp,
1715                                                   &bucket->chain, hlist) {
1716                                 struct rt6_info *entry = rt6_ex->rt6i;
1717
1718                                 if ((entry->rt6i_flags & RTF_CACHE_GATEWAY) ==
1719                                     RTF_CACHE_GATEWAY &&
1720                                     ipv6_addr_equal(gateway,
1721                                                     &entry->rt6i_gateway)) {
1722                                         rt6_remove_exception(bucket, rt6_ex);
1723                                 }
1724                         }
1725                         bucket++;
1726                 }
1727         }
1728
1729         spin_unlock_bh(&rt6_exception_lock);
1730 }
1731
1732 static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket,
1733                                       struct rt6_exception *rt6_ex,
1734                                       struct fib6_gc_args *gc_args,
1735                                       unsigned long now)
1736 {
1737         struct rt6_info *rt = rt6_ex->rt6i;
1738
1739         /* we are pruning and obsoleting aged-out and non gateway exceptions
1740          * even if others have still references to them, so that on next
1741          * dst_check() such references can be dropped.
1742          * EXPIRES exceptions - e.g. pmtu-generated ones are pruned when
1743          * expired, independently from their aging, as per RFC 8201 section 4
1744          */
1745         if (!(rt->rt6i_flags & RTF_EXPIRES)) {
1746                 if (time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) {
1747                         RT6_TRACE("aging clone %p\n", rt);
1748                         rt6_remove_exception(bucket, rt6_ex);
1749                         return;
1750                 }
1751         } else if (time_after(jiffies, rt->dst.expires)) {
1752                 RT6_TRACE("purging expired route %p\n", rt);
1753                 rt6_remove_exception(bucket, rt6_ex);
1754                 return;
1755         }
1756
1757         if (rt->rt6i_flags & RTF_GATEWAY) {
1758                 struct neighbour *neigh;
1759                 __u8 neigh_flags = 0;
1760
1761                 neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
1762                 if (neigh)
1763                         neigh_flags = neigh->flags;
1764
1765                 if (!(neigh_flags & NTF_ROUTER)) {
1766                         RT6_TRACE("purging route %p via non-router but gateway\n",
1767                                   rt);
1768                         rt6_remove_exception(bucket, rt6_ex);
1769                         return;
1770                 }
1771         }
1772
1773         gc_args->more++;
1774 }
1775
1776 void rt6_age_exceptions(struct fib6_info *rt,
1777                         struct fib6_gc_args *gc_args,
1778                         unsigned long now)
1779 {
1780         struct rt6_exception_bucket *bucket;
1781         struct rt6_exception *rt6_ex;
1782         struct hlist_node *tmp;
1783         int i;
1784
1785         if (!rcu_access_pointer(rt->rt6i_exception_bucket))
1786                 return;
1787
1788         rcu_read_lock_bh();
1789         spin_lock(&rt6_exception_lock);
1790         bucket = rcu_dereference_protected(rt->rt6i_exception_bucket,
1791                                     lockdep_is_held(&rt6_exception_lock));
1792
1793         if (bucket) {
1794                 for (i = 0; i < FIB6_EXCEPTION_BUCKET_SIZE; i++) {
1795                         hlist_for_each_entry_safe(rt6_ex, tmp,
1796                                                   &bucket->chain, hlist) {
1797                                 rt6_age_examine_exception(bucket, rt6_ex,
1798                                                           gc_args, now);
1799                         }
1800                         bucket++;
1801                 }
1802         }
1803         spin_unlock(&rt6_exception_lock);
1804         rcu_read_unlock_bh();
1805 }
1806
1807 /* must be called with rcu lock held */
1808 struct fib6_info *fib6_table_lookup(struct net *net, struct fib6_table *table,
1809                                     int oif, struct flowi6 *fl6, int strict)
1810 {
1811         struct fib6_node *fn, *saved_fn;
1812         struct fib6_info *f6i;
1813
1814         fn = fib6_node_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
1815         saved_fn = fn;
1816
1817         if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF)
1818                 oif = 0;
1819
1820 redo_rt6_select:
1821         f6i = rt6_select(net, fn, oif, strict);
1822         if (f6i == net->ipv6.fib6_null_entry) {
1823                 fn = fib6_backtrack(fn, &fl6->saddr);
1824                 if (fn)
1825                         goto redo_rt6_select;
1826                 else if (strict & RT6_LOOKUP_F_REACHABLE) {
1827                         /* also consider unreachable route */
1828                         strict &= ~RT6_LOOKUP_F_REACHABLE;
1829                         fn = saved_fn;
1830                         goto redo_rt6_select;
1831                 }
1832         }
1833
1834         trace_fib6_table_lookup(net, f6i, table, fl6);
1835
1836         return f6i;
1837 }
1838
1839 struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
1840                                int oif, struct flowi6 *fl6,
1841                                const struct sk_buff *skb, int flags)
1842 {
1843         struct fib6_info *f6i;
1844         struct rt6_info *rt;
1845         int strict = 0;
1846
1847         strict |= flags & RT6_LOOKUP_F_IFACE;
1848         strict |= flags & RT6_LOOKUP_F_IGNORE_LINKSTATE;
1849         if (net->ipv6.devconf_all->forwarding == 0)
1850                 strict |= RT6_LOOKUP_F_REACHABLE;
1851
1852         rcu_read_lock();
1853
1854         f6i = fib6_table_lookup(net, table, oif, fl6, strict);
1855         if (f6i->fib6_nsiblings)
1856                 f6i = fib6_multipath_select(net, f6i, fl6, oif, skb, strict);
1857
1858         if (f6i == net->ipv6.fib6_null_entry) {
1859                 rt = net->ipv6.ip6_null_entry;
1860                 rcu_read_unlock();
1861                 dst_hold(&rt->dst);
1862                 return rt;
1863         }
1864
1865         /*Search through exception table */
1866         rt = rt6_find_cached_rt(f6i, &fl6->daddr, &fl6->saddr);
1867         if (rt) {
1868                 if (ip6_hold_safe(net, &rt, true))
1869                         dst_use_noref(&rt->dst, jiffies);
1870
1871                 rcu_read_unlock();
1872                 return rt;
1873         } else if (unlikely((fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH) &&
1874                             !(f6i->fib6_flags & RTF_GATEWAY))) {
1875                 /* Create a RTF_CACHE clone which will not be
1876                  * owned by the fib6 tree.  It is for the special case where
1877                  * the daddr in the skb during the neighbor look-up is different
1878                  * from the fl6->daddr used to look-up route here.
1879                  */
1880                 struct rt6_info *uncached_rt;
1881
1882                 uncached_rt = ip6_rt_cache_alloc(f6i, &fl6->daddr, NULL);
1883
1884                 rcu_read_unlock();
1885
1886                 if (uncached_rt) {
1887                         /* Uncached_rt's refcnt is taken during ip6_rt_cache_alloc()
1888                          * No need for another dst_hold()
1889                          */
1890                         rt6_uncached_list_add(uncached_rt);
1891                         atomic_inc(&net->ipv6.rt6_stats->fib_rt_uncache);
1892                 } else {
1893                         uncached_rt = net->ipv6.ip6_null_entry;
1894                         dst_hold(&uncached_rt->dst);
1895                 }
1896
1897                 return uncached_rt;
1898         } else {
1899                 /* Get a percpu copy */
1900
1901                 struct rt6_info *pcpu_rt;
1902
1903                 local_bh_disable();
1904                 pcpu_rt = rt6_get_pcpu_route(f6i);
1905
1906                 if (!pcpu_rt)
1907                         pcpu_rt = rt6_make_pcpu_route(net, f6i);
1908
1909                 local_bh_enable();
1910                 rcu_read_unlock();
1911
1912                 return pcpu_rt;
1913         }
1914 }
1915 EXPORT_SYMBOL_GPL(ip6_pol_route);
1916
1917 static struct rt6_info *ip6_pol_route_input(struct net *net,
1918                                             struct fib6_table *table,
1919                                             struct flowi6 *fl6,
1920                                             const struct sk_buff *skb,
1921                                             int flags)
1922 {
1923         return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, skb, flags);
1924 }
1925
1926 struct dst_entry *ip6_route_input_lookup(struct net *net,
1927                                          struct net_device *dev,
1928                                          struct flowi6 *fl6,
1929                                          const struct sk_buff *skb,
1930                                          int flags)
1931 {
1932         if (rt6_need_strict(&fl6->daddr) && dev->type != ARPHRD_PIMREG)
1933                 flags |= RT6_LOOKUP_F_IFACE;
1934
1935         return fib6_rule_lookup(net, fl6, skb, flags, ip6_pol_route_input);
1936 }
1937 EXPORT_SYMBOL_GPL(ip6_route_input_lookup);
1938
1939 static void ip6_multipath_l3_keys(const struct sk_buff *skb,
1940                                   struct flow_keys *keys,
1941                                   struct flow_keys *flkeys)
1942 {
1943         const struct ipv6hdr *outer_iph = ipv6_hdr(skb);
1944         const struct ipv6hdr *key_iph = outer_iph;
1945         struct flow_keys *_flkeys = flkeys;
1946         const struct ipv6hdr *inner_iph;
1947         const struct icmp6hdr *icmph;
1948         struct ipv6hdr _inner_iph;
1949         struct icmp6hdr _icmph;
1950
1951         if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6))
1952                 goto out;
1953
1954         icmph = skb_header_pointer(skb, skb_transport_offset(skb),
1955                                    sizeof(_icmph), &_icmph);
1956         if (!icmph)
1957                 goto out;
1958
1959         if (icmph->icmp6_type != ICMPV6_DEST_UNREACH &&
1960             icmph->icmp6_type != ICMPV6_PKT_TOOBIG &&
1961             icmph->icmp6_type != ICMPV6_TIME_EXCEED &&
1962             icmph->icmp6_type != ICMPV6_PARAMPROB)
1963                 goto out;
1964
1965         inner_iph = skb_header_pointer(skb,
1966                                        skb_transport_offset(skb) + sizeof(*icmph),
1967                                        sizeof(_inner_iph), &_inner_iph);
1968         if (!inner_iph)
1969                 goto out;
1970
1971         key_iph = inner_iph;
1972         _flkeys = NULL;
1973 out:
1974         if (_flkeys) {
1975                 keys->addrs.v6addrs.src = _flkeys->addrs.v6addrs.src;
1976                 keys->addrs.v6addrs.dst = _flkeys->addrs.v6addrs.dst;
1977                 keys->tags.flow_label = _flkeys->tags.flow_label;
1978                 keys->basic.ip_proto = _flkeys->basic.ip_proto;
1979         } else {
1980                 keys->addrs.v6addrs.src = key_iph->saddr;
1981                 keys->addrs.v6addrs.dst = key_iph->daddr;
1982                 keys->tags.flow_label = ip6_flowlabel(key_iph);
1983                 keys->basic.ip_proto = key_iph->nexthdr;
1984         }
1985 }
1986
1987 /* if skb is set it will be used and fl6 can be NULL */
1988 u32 rt6_multipath_hash(const struct net *net, const struct flowi6 *fl6,
1989                        const struct sk_buff *skb, struct flow_keys *flkeys)
1990 {
1991         struct flow_keys hash_keys;
1992         u32 mhash;
1993
1994         switch (ip6_multipath_hash_policy(net)) {
1995         case 0:
1996                 memset(&hash_keys, 0, sizeof(hash_keys));
1997                 hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
1998                 if (skb) {
1999                         ip6_multipath_l3_keys(skb, &hash_keys, flkeys);
2000                 } else {
2001                         hash_keys.addrs.v6addrs.src = fl6->saddr;
2002                         hash_keys.addrs.v6addrs.dst = fl6->daddr;
2003                         hash_keys.tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);
2004                         hash_keys.basic.ip_proto = fl6->flowi6_proto;
2005                 }
2006                 break;
2007         case 1:
2008                 if (skb) {
2009                         unsigned int flag = FLOW_DISSECTOR_F_STOP_AT_ENCAP;
2010                         struct flow_keys keys;
2011
2012                         /* short-circuit if we already have L4 hash present */
2013                         if (skb->l4_hash)
2014                                 return skb_get_hash_raw(skb) >> 1;
2015
2016                         memset(&hash_keys, 0, sizeof(hash_keys));
2017
2018                         if (!flkeys) {
2019                                 skb_flow_dissect_flow_keys(skb, &keys, flag);
2020                                 flkeys = &keys;
2021                         }
2022                         hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
2023                         hash_keys.addrs.v6addrs.src = flkeys->addrs.v6addrs.src;
2024                         hash_keys.addrs.v6addrs.dst = flkeys->addrs.v6addrs.dst;
2025                         hash_keys.ports.src = flkeys->ports.src;
2026                         hash_keys.ports.dst = flkeys->ports.dst;
2027                         hash_keys.basic.ip_proto = flkeys->basic.ip_proto;
2028                 } else {
2029                         memset(&hash_keys, 0, sizeof(hash_keys));
2030                         hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
2031                         hash_keys.addrs.v6addrs.src = fl6->saddr;
2032                         hash_keys.addrs.v6addrs.dst = fl6->daddr;
2033                         hash_keys.ports.src = fl6->fl6_sport;
2034                         hash_keys.ports.dst = fl6->fl6_dport;
2035                         hash_keys.basic.ip_proto = fl6->flowi6_proto;
2036                 }
2037                 break;
2038         }
2039         mhash = flow_hash_from_keys(&hash_keys);
2040
2041         return mhash >> 1;
2042 }
2043
2044 void ip6_route_input(struct sk_buff *skb)
2045 {
2046         const struct ipv6hdr *iph = ipv6_hdr(skb);
2047         struct net *net = dev_net(skb->dev);
2048         int flags = RT6_LOOKUP_F_HAS_SADDR;
2049         struct ip_tunnel_info *tun_info;
2050         struct flowi6 fl6 = {
2051                 .flowi6_iif = skb->dev->ifindex,
2052                 .daddr = iph->daddr,
2053                 .saddr = iph->saddr,
2054                 .flowlabel = ip6_flowinfo(iph),
2055                 .flowi6_mark = skb->mark,
2056                 .flowi6_proto = iph->nexthdr,
2057         };
2058         struct flow_keys *flkeys = NULL, _flkeys;
2059
2060         tun_info = skb_tunnel_info(skb);
2061         if (tun_info && !(tun_info->mode & IP_TUNNEL_INFO_TX))
2062                 fl6.flowi6_tun_key.tun_id = tun_info->key.tun_id;
2063
2064         if (fib6_rules_early_flow_dissect(net, skb, &fl6, &_flkeys))
2065                 flkeys = &_flkeys;
2066
2067         if (unlikely(fl6.flowi6_proto == IPPROTO_ICMPV6))
2068                 fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, flkeys);
2069         skb_dst_drop(skb);
2070         skb_dst_set(skb,
2071                     ip6_route_input_lookup(net, skb->dev, &fl6, skb, flags));
2072 }
2073
2074 static struct rt6_info *ip6_pol_route_output(struct net *net,
2075                                              struct fib6_table *table,
2076                                              struct flowi6 *fl6,
2077                                              const struct sk_buff *skb,
2078                                              int flags)
2079 {
2080         return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, skb, flags);
2081 }
2082
2083 struct dst_entry *ip6_route_output_flags(struct net *net, const struct sock *sk,
2084                                          struct flowi6 *fl6, int flags)
2085 {
2086         bool any_src;
2087
2088         if (ipv6_addr_type(&fl6->daddr) &
2089             (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)) {
2090                 struct dst_entry *dst;
2091
2092                 dst = l3mdev_link_scope_lookup(net, fl6);
2093                 if (dst)
2094                         return dst;
2095         }
2096
2097         fl6->flowi6_iif = LOOPBACK_IFINDEX;
2098
2099         any_src = ipv6_addr_any(&fl6->saddr);
2100         if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr) ||
2101             (fl6->flowi6_oif && any_src))
2102                 flags |= RT6_LOOKUP_F_IFACE;
2103
2104         if (!any_src)
2105                 flags |= RT6_LOOKUP_F_HAS_SADDR;
2106         else if (sk)
2107                 flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
2108
2109         return fib6_rule_lookup(net, fl6, NULL, flags, ip6_pol_route_output);
2110 }
2111 EXPORT_SYMBOL_GPL(ip6_route_output_flags);
2112
2113 struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
2114 {
2115         struct rt6_info *rt, *ort = (struct rt6_info *) dst_orig;
2116         struct net_device *loopback_dev = net->loopback_dev;
2117         struct dst_entry *new = NULL;
2118
2119         rt = dst_alloc(&ip6_dst_blackhole_ops, loopback_dev, 1,
2120                        DST_OBSOLETE_DEAD, 0);
2121         if (rt) {
2122                 rt6_info_init(rt);
2123                 atomic_inc(&net->ipv6.rt6_stats->fib_rt_alloc);
2124
2125                 new = &rt->dst;
2126                 new->__use = 1;
2127                 new->input = dst_discard;
2128                 new->output = dst_discard_out;
2129
2130                 dst_copy_metrics(new, &ort->dst);
2131
2132                 rt->rt6i_idev = in6_dev_get(loopback_dev);
2133                 rt->rt6i_gateway = ort->rt6i_gateway;
2134                 rt->rt6i_flags = ort->rt6i_flags & ~RTF_PCPU;
2135
2136                 memcpy(&rt->rt6i_dst, &ort->rt6i_dst, sizeof(struct rt6key));
2137 #ifdef CONFIG_IPV6_SUBTREES
2138                 memcpy(&rt->rt6i_src, &ort->rt6i_src, sizeof(struct rt6key));
2139 #endif
2140         }
2141
2142         dst_release(dst_orig);
2143         return new ? new : ERR_PTR(-ENOMEM);
2144 }
2145
2146 /*
2147  *      Destination cache support functions
2148  */
2149
2150 static bool fib6_check(struct fib6_info *f6i, u32 cookie)
2151 {
2152         u32 rt_cookie = 0;
2153
2154         if (!fib6_get_cookie_safe(f6i, &rt_cookie) || rt_cookie != cookie)
2155                 return false;
2156
2157         if (fib6_check_expired(f6i))
2158                 return false;
2159
2160         return true;
2161 }
2162
2163 static struct dst_entry *rt6_check(struct rt6_info *rt,
2164                                    struct fib6_info *from,
2165                                    u32 cookie)
2166 {
2167         u32 rt_cookie = 0;
2168
2169         if ((from && !fib6_get_cookie_safe(from, &rt_cookie)) ||
2170             rt_cookie != cookie)
2171                 return NULL;
2172
2173         if (rt6_check_expired(rt))
2174                 return NULL;
2175
2176         return &rt->dst;
2177 }
2178
2179 static struct dst_entry *rt6_dst_from_check(struct rt6_info *rt,
2180                                             struct fib6_info *from,
2181                                             u32 cookie)
2182 {
2183         if (!__rt6_check_expired(rt) &&
2184             rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
2185             fib6_check(from, cookie))
2186                 return &rt->dst;
2187         else
2188                 return NULL;
2189 }
2190
2191 static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
2192 {
2193         struct dst_entry *dst_ret;
2194         struct fib6_info *from;
2195         struct rt6_info *rt;
2196
2197         rt = container_of(dst, struct rt6_info, dst);
2198
2199         rcu_read_lock();
2200
2201         /* All IPV6 dsts are created with ->obsolete set to the value
2202          * DST_OBSOLETE_FORCE_CHK which forces validation calls down
2203          * into this function always.
2204          */
2205
2206         from = rcu_dereference(rt->from);
2207
2208         if (from && (rt->rt6i_flags & RTF_PCPU ||
2209             unlikely(!list_empty(&rt->rt6i_uncached))))
2210                 dst_ret = rt6_dst_from_check(rt, from, cookie);
2211         else
2212                 dst_ret = rt6_check(rt, from, cookie);
2213
2214         rcu_read_unlock();
2215
2216         return dst_ret;
2217 }
2218
2219 static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
2220 {
2221         struct rt6_info *rt = (struct rt6_info *) dst;
2222
2223         if (rt) {
2224                 if (rt->rt6i_flags & RTF_CACHE) {
2225                         rcu_read_lock();
2226                         if (rt6_check_expired(rt)) {
2227                                 rt6_remove_exception_rt(rt);
2228                                 dst = NULL;
2229                         }
2230                         rcu_read_unlock();
2231                 } else {
2232                         dst_release(dst);
2233                         dst = NULL;
2234                 }
2235         }
2236         return dst;
2237 }
2238
2239 static void ip6_link_failure(struct sk_buff *skb)
2240 {
2241         struct rt6_info *rt;
2242
2243         icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
2244
2245         rt = (struct rt6_info *) skb_dst(skb);
2246         if (rt) {
2247                 rcu_read_lock();
2248                 if (rt->rt6i_flags & RTF_CACHE) {
2249                         rt6_remove_exception_rt(rt);
2250                 } else {
2251                         struct fib6_info *from;
2252                         struct fib6_node *fn;
2253
2254                         from = rcu_dereference(rt->from);
2255                         if (from) {
2256                                 fn = rcu_dereference(from->fib6_node);
2257                                 if (fn && (rt->rt6i_flags & RTF_DEFAULT))
2258                                         fn->fn_sernum = -1;
2259                         }
2260                 }
2261                 rcu_read_unlock();
2262         }
2263 }
2264
2265 static void rt6_update_expires(struct rt6_info *rt0, int timeout)
2266 {
2267         if (!(rt0->rt6i_flags & RTF_EXPIRES)) {
2268                 struct fib6_info *from;
2269
2270                 rcu_read_lock();
2271                 from = rcu_dereference(rt0->from);
2272                 if (from)
2273                         rt0->dst.expires = from->expires;
2274                 rcu_read_unlock();
2275         }
2276
2277         dst_set_expires(&rt0->dst, timeout);
2278         rt0->rt6i_flags |= RTF_EXPIRES;
2279 }
2280
2281 static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu)
2282 {
2283         struct net *net = dev_net(rt->dst.dev);
2284
2285         dst_metric_set(&rt->dst, RTAX_MTU, mtu);
2286         rt->rt6i_flags |= RTF_MODIFIED;
2287         rt6_update_expires(rt, net->ipv6.sysctl.ip6_rt_mtu_expires);
2288 }
2289
2290 static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt)
2291 {
2292         bool from_set;
2293
2294         rcu_read_lock();
2295         from_set = !!rcu_dereference(rt->from);
2296         rcu_read_unlock();
2297
2298         return !(rt->rt6i_flags & RTF_CACHE) &&
2299                 (rt->rt6i_flags & RTF_PCPU || from_set);
2300 }
2301
2302 static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk,
2303                                  const struct ipv6hdr *iph, u32 mtu)
2304 {
2305         const struct in6_addr *daddr, *saddr;
2306         struct rt6_info *rt6 = (struct rt6_info *)dst;
2307
2308         if (dst_metric_locked(dst, RTAX_MTU))
2309                 return;
2310
2311         if (iph) {
2312                 daddr = &iph->daddr;
2313                 saddr = &iph->saddr;
2314         } else if (sk) {
2315                 daddr = &sk->sk_v6_daddr;
2316                 saddr = &inet6_sk(sk)->saddr;
2317         } else {
2318                 daddr = NULL;
2319                 saddr = NULL;
2320         }
2321         dst_confirm_neigh(dst, daddr);
2322         mtu = max_t(u32, mtu, IPV6_MIN_MTU);
2323         if (mtu >= dst_mtu(dst))
2324                 return;
2325
2326         if (!rt6_cache_allowed_for_pmtu(rt6)) {
2327                 rt6_do_update_pmtu(rt6, mtu);
2328                 /* update rt6_ex->stamp for cache */
2329                 if (rt6->rt6i_flags & RTF_CACHE)
2330                         rt6_update_exception_stamp_rt(rt6);
2331         } else if (daddr) {
2332                 struct fib6_info *from;
2333                 struct rt6_info *nrt6;
2334
2335                 rcu_read_lock();
2336                 from = rcu_dereference(rt6->from);
2337                 nrt6 = ip6_rt_cache_alloc(from, daddr, saddr);
2338                 if (nrt6) {
2339                         rt6_do_update_pmtu(nrt6, mtu);
2340                         if (rt6_insert_exception(nrt6, from))
2341                                 dst_release_immediate(&nrt6->dst);
2342                 }
2343                 rcu_read_unlock();
2344         }
2345 }
2346
2347 static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
2348                                struct sk_buff *skb, u32 mtu)
2349 {
2350         __ip6_rt_update_pmtu(dst, sk, skb ? ipv6_hdr(skb) : NULL, mtu);
2351 }
2352
2353 void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
2354                      int oif, u32 mark, kuid_t uid)
2355 {
2356         const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
2357         struct dst_entry *dst;
2358         struct flowi6 fl6 = {
2359                 .flowi6_oif = oif,
2360                 .flowi6_mark = mark ? mark : IP6_REPLY_MARK(net, skb->mark),
2361                 .daddr = iph->daddr,
2362                 .saddr = iph->saddr,
2363                 .flowlabel = ip6_flowinfo(iph),
2364                 .flowi6_uid = uid,
2365         };
2366
2367         dst = ip6_route_output(net, NULL, &fl6);
2368         if (!dst->error)
2369                 __ip6_rt_update_pmtu(dst, NULL, iph, ntohl(mtu));
2370         dst_release(dst);
2371 }
2372 EXPORT_SYMBOL_GPL(ip6_update_pmtu);
2373
2374 void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
2375 {
2376         int oif = sk->sk_bound_dev_if;
2377         struct dst_entry *dst;
2378
2379         if (!oif && skb->dev)
2380                 oif = l3mdev_master_ifindex(skb->dev);
2381
2382         ip6_update_pmtu(skb, sock_net(sk), mtu, oif, sk->sk_mark, sk->sk_uid);
2383
2384         dst = __sk_dst_get(sk);
2385         if (!dst || !dst->obsolete ||
2386             dst->ops->check(dst, inet6_sk(sk)->dst_cookie))
2387                 return;
2388
2389         bh_lock_sock(sk);
2390         if (!sock_owned_by_user(sk) && !ipv6_addr_v4mapped(&sk->sk_v6_daddr))
2391                 ip6_datagram_dst_update(sk, false);
2392         bh_unlock_sock(sk);
2393 }
2394 EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);
2395
2396 void ip6_sk_dst_store_flow(struct sock *sk, struct dst_entry *dst,
2397                            const struct flowi6 *fl6)
2398 {
2399 #ifdef CONFIG_IPV6_SUBTREES
2400         struct ipv6_pinfo *np = inet6_sk(sk);
2401 #endif
2402
2403         ip6_dst_store(sk, dst,
2404                       ipv6_addr_equal(&fl6->daddr, &sk->sk_v6_daddr) ?
2405                       &sk->sk_v6_daddr : NULL,
2406 #ifdef CONFIG_IPV6_SUBTREES
2407                       ipv6_addr_equal(&fl6->saddr, &np->saddr) ?
2408                       &np->saddr :
2409 #endif
2410                       NULL);
2411 }
2412
2413 /* Handle redirects */
2414 struct ip6rd_flowi {
2415         struct flowi6 fl6;
2416         struct in6_addr gateway;
2417 };
2418
2419 static struct rt6_info *__ip6_route_redirect(struct net *net,
2420                                              struct fib6_table *table,
2421                                              struct flowi6 *fl6,
2422                                              const struct sk_buff *skb,
2423                                              int flags)
2424 {
2425         struct ip6rd_flowi *rdfl = (struct ip6rd_flowi *)fl6;
2426         struct rt6_info *ret = NULL, *rt_cache;
2427         struct fib6_info *rt;
2428         struct fib6_node *fn;
2429
2430         /* Get the "current" route for this destination and
2431          * check if the redirect has come from appropriate router.
2432          *
2433          * RFC 4861 specifies that redirects should only be
2434          * accepted if they come from the nexthop to the target.
2435          * Due to the way the routes are chosen, this notion
2436          * is a bit fuzzy and one might need to check all possible
2437          * routes.
2438          */
2439
2440         rcu_read_lock();
2441         fn = fib6_node_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr);
2442 restart:
2443         for_each_fib6_node_rt_rcu(fn) {
2444                 if (rt->fib6_nh.nh_flags & RTNH_F_DEAD)
2445                         continue;
2446                 if (fib6_check_expired(rt))
2447                         continue;
2448                 if (rt->fib6_flags & RTF_REJECT)
2449                         break;
2450                 if (!(rt->fib6_flags & RTF_GATEWAY))
2451                         continue;
2452                 if (fl6->flowi6_oif != rt->fib6_nh.nh_dev->ifindex)
2453                         continue;
2454                 /* rt_cache's gateway might be different from its 'parent'
2455                  * in the case of an ip redirect.
2456                  * So we keep searching in the exception table if the gateway
2457                  * is different.
2458                  */
2459                 if (!ipv6_addr_equal(&rdfl->gateway, &rt->fib6_nh.nh_gw)) {
2460                         rt_cache = rt6_find_cached_rt(rt,
2461                                                       &fl6->daddr,
2462                                                       &fl6->saddr);
2463                         if (rt_cache &&
2464                             ipv6_addr_equal(&rdfl->gateway,
2465                                             &rt_cache->rt6i_gateway)) {
2466                                 ret = rt_cache;
2467                                 break;
2468                         }
2469                         continue;
2470                 }
2471                 break;
2472         }
2473
2474         if (!rt)
2475                 rt = net->ipv6.fib6_null_entry;
2476         else if (rt->fib6_flags & RTF_REJECT) {
2477                 ret = net->ipv6.ip6_null_entry;
2478                 goto out;
2479         }
2480
2481         if (rt == net->ipv6.fib6_null_entry) {
2482                 fn = fib6_backtrack(fn, &fl6->saddr);
2483                 if (fn)
2484                         goto restart;
2485         }
2486
2487 out:
2488         if (ret)
2489                 ip6_hold_safe(net, &ret, true);
2490         else
2491                 ret = ip6_create_rt_rcu(rt);
2492
2493         rcu_read_unlock();
2494
2495         trace_fib6_table_lookup(net, rt, table, fl6);
2496         return ret;
2497 };
2498
2499 static struct dst_entry *ip6_route_redirect(struct net *net,
2500                                             const struct flowi6 *fl6,
2501                                             const struct sk_buff *skb,
2502                                             const struct in6_addr *gateway)
2503 {
2504         int flags = RT6_LOOKUP_F_HAS_SADDR;
2505         struct ip6rd_flowi rdfl;
2506
2507         rdfl.fl6 = *fl6;
2508         rdfl.gateway = *gateway;
2509
2510         return fib6_rule_lookup(net, &rdfl.fl6, skb,
2511                                 flags, __ip6_route_redirect);
2512 }
2513
2514 void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark,
2515                   kuid_t uid)
2516 {
2517         const struct ipv6hdr *iph = (struct ipv6hdr *) skb->data;
2518         struct dst_entry *dst;
2519         struct flowi6 fl6 = {
2520                 .flowi6_iif = LOOPBACK_IFINDEX,
2521                 .flowi6_oif = oif,
2522                 .flowi6_mark = mark,
2523                 .daddr = iph->daddr,
2524                 .saddr = iph->saddr,
2525                 .flowlabel = ip6_flowinfo(iph),
2526                 .flowi6_uid = uid,
2527         };
2528
2529         dst = ip6_route_redirect(net, &fl6, skb, &ipv6_hdr(skb)->saddr);
2530         rt6_do_redirect(dst, NULL, skb);
2531         dst_release(dst);
2532 }
2533 EXPORT_SYMBOL_GPL(ip6_redirect);
2534
2535 void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif)
2536 {
2537         const struct ipv6hdr *iph = ipv6_hdr(skb);
2538         const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
2539         struct dst_entry *dst;
2540         struct flowi6 fl6 = {
2541                 .flowi6_iif = LOOPBACK_IFINDEX,
2542                 .flowi6_oif = oif,
2543                 .daddr = msg->dest,
2544                 .saddr = iph->daddr,
2545                 .flowi6_uid = sock_net_uid(net, NULL),
2546         };
2547
2548         dst = ip6_route_redirect(net, &fl6, skb, &iph->saddr);
2549         rt6_do_redirect(dst, NULL, skb);
2550         dst_release(dst);
2551 }
2552
2553 void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
2554 {
2555         ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark,
2556                      sk->sk_uid);
2557 }
2558 EXPORT_SYMBOL_GPL(ip6_sk_redirect);
2559
2560 static unsigned int ip6_default_advmss(const struct dst_entry *dst)
2561 {
2562         struct net_device *dev = dst->dev;
2563         unsigned int mtu = dst_mtu(dst);
2564         struct net *net = dev_net(dev);
2565
2566         mtu -= sizeof(struct ipv6hdr) + sizeof(struct tcphdr);
2567
2568         if (mtu < net->ipv6.sysctl.ip6_rt_min_advmss)
2569                 mtu = net->ipv6.sysctl.ip6_rt_min_advmss;
2570
2571         /*
2572          * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and
2573          * corresponding MSS is IPV6_MAXPLEN - tcp_header_size.
2574          * IPV6_MAXPLEN is also valid and means: "any MSS,
2575          * rely only on pmtu discovery"
2576          */
2577         if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr))
2578                 mtu = IPV6_MAXPLEN;
2579         return mtu;
2580 }
2581
2582 static unsigned int ip6_mtu(const struct dst_entry *dst)
2583 {
2584         struct inet6_dev *idev;
2585         unsigned int mtu;
2586
2587         mtu = dst_metric_raw(dst, RTAX_MTU);
2588         if (mtu)
2589                 goto out;
2590
2591         mtu = IPV6_MIN_MTU;
2592
2593         rcu_read_lock();
2594         idev = __in6_dev_get(dst->dev);
2595         if (idev)
2596                 mtu = idev->cnf.mtu6;
2597         rcu_read_unlock();
2598
2599 out:
2600         mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);
2601
2602         return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
2603 }
2604
2605 /* MTU selection:
2606  * 1. mtu on route is locked - use it
2607  * 2. mtu from nexthop exception
2608  * 3. mtu from egress device
2609  *
2610  * based on ip6_dst_mtu_forward and exception logic of
2611  * rt6_find_cached_rt; called with rcu_read_lock
2612  */
2613 u32 ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr,
2614                       struct in6_addr *saddr)
2615 {
2616         struct rt6_exception_bucket *bucket;
2617         struct rt6_exception *rt6_ex;
2618         struct in6_addr *src_key;
2619         struct inet6_dev *idev;
2620         u32 mtu = 0;
2621
2622         if (unlikely(fib6_metric_locked(f6i, RTAX_MTU))) {
2623                 mtu = f6i->fib6_pmtu;
2624                 if (mtu)
2625                         goto out;
2626         }
2627
2628         src_key = NULL;
2629 #ifdef CONFIG_IPV6_SUBTREES
2630         if (f6i->fib6_src.plen)
2631                 src_key = saddr;
2632 #endif
2633
2634         bucket = rcu_dereference(f6i->rt6i_exception_bucket);
2635         rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);
2636         if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
2637                 mtu = dst_metric_raw(&rt6_ex->rt6i->dst, RTAX_MTU);
2638
2639         if (likely(!mtu)) {
2640                 struct net_device *dev = fib6_info_nh_dev(f6i);
2641
2642                 mtu = IPV6_MIN_MTU;
2643                 idev = __in6_dev_get(dev);
2644                 if (idev && idev->cnf.mtu6 > mtu)
2645                         mtu = idev->cnf.mtu6;
2646         }
2647
2648         mtu = min_t(unsigned int, mtu, IP6_MAX_MTU);
2649 out:
2650         return mtu - lwtunnel_headroom(fib6_info_nh_lwt(f6i), mtu);
2651 }
2652
2653 struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
2654                                   struct flowi6 *fl6)
2655 {
2656         struct dst_entry *dst;
2657         struct rt6_info *rt;
2658         struct inet6_dev *idev = in6_dev_get(dev);
2659         struct net *net = dev_net(dev);
2660
2661         if (unlikely(!idev))
2662                 return ERR_PTR(-ENODEV);
2663
2664         rt = ip6_dst_alloc(net, dev, 0);
2665         if (unlikely(!rt)) {
2666                 in6_dev_put(idev);
2667                 dst = ERR_PTR(-ENOMEM);
2668                 goto out;
2669         }
2670
2671         rt->dst.flags |= DST_HOST;
2672         rt->dst.input = ip6_input;
2673         rt->dst.output  = ip6_output;
2674         rt->rt6i_gateway  = fl6->daddr;
2675         rt->rt6i_dst.addr = fl6->daddr;
2676         rt->rt6i_dst.plen = 128;
2677         rt->rt6i_idev     = idev;
2678         dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 0);
2679
2680         /* Add this dst into uncached_list so that rt6_disable_ip() can
2681          * do proper release of the net_device
2682          */
2683         rt6_uncached_list_add(rt);
2684         atomic_inc(&net->ipv6.rt6_stats->fib_rt_uncache);
2685
2686         dst = xfrm_lookup(net, &rt->dst, flowi6_to_flowi(fl6), NULL, 0);
2687
2688 out:
2689         return dst;
2690 }
2691
2692 static int ip6_dst_gc(struct dst_ops *ops)
2693 {
2694         struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
2695         int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
2696         int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
2697         int rt_elasticity = net->ipv6.sysctl.ip6_rt_gc_elasticity;
2698         int rt_gc_timeout = net->ipv6.sysctl.ip6_rt_gc_timeout;
2699         unsigned long rt_last_gc = net->ipv6.ip6_rt_last_gc;
2700         int entries;
2701
2702         entries = dst_entries_get_fast(ops);
2703         if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
2704             entries <= rt_max_size)
2705                 goto out;
2706
2707         net->ipv6.ip6_rt_gc_expire++;
2708         fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, true);
2709         entries = dst_entries_get_slow(ops);
2710         if (entries < ops->gc_thresh)
2711                 net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
2712 out:
2713         net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
2714         return entries > rt_max_size;
2715 }
2716
2717 static struct rt6_info *ip6_nh_lookup_table(struct net *net,
2718                                             struct fib6_config *cfg,
2719                                             const struct in6_addr *gw_addr,
2720                                             u32 tbid, int flags)
2721 {
2722         struct flowi6 fl6 = {
2723                 .flowi6_oif = cfg->fc_ifindex,
2724                 .daddr = *gw_addr,
2725                 .saddr = cfg->fc_prefsrc,
2726         };
2727         struct fib6_table *table;
2728         struct rt6_info *rt;
2729
2730         table = fib6_get_table(net, tbid);
2731         if (!table)
2732                 return NULL;
2733
2734         if (!ipv6_addr_any(&cfg->fc_prefsrc))
2735                 flags |= RT6_LOOKUP_F_HAS_SADDR;
2736
2737         flags |= RT6_LOOKUP_F_IGNORE_LINKSTATE;
2738         rt = ip6_pol_route(net, table, cfg->fc_ifindex, &fl6, NULL, flags);
2739
2740         /* if table lookup failed, fall back to full lookup */
2741         if (rt == net->ipv6.ip6_null_entry) {
2742                 ip6_rt_put(rt);
2743                 rt = NULL;
2744         }
2745
2746         return rt;
2747 }
2748
2749 static int ip6_route_check_nh_onlink(struct net *net,
2750                                      struct fib6_config *cfg,
2751                                      const struct net_device *dev,
2752                                      struct netlink_ext_ack *extack)
2753 {
2754         u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
2755         const struct in6_addr *gw_addr = &cfg->fc_gateway;
2756         u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT;
2757         struct fib6_info *from;
2758         struct rt6_info *grt;
2759         int err;
2760
2761         err = 0;
2762         grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
2763         if (grt) {
2764                 rcu_read_lock();
2765                 from = rcu_dereference(grt->from);
2766                 if (!grt->dst.error &&
2767                     /* ignore match if it is the default route */
2768                     from && !ipv6_addr_any(&from->fib6_dst.addr) &&
2769                     (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
2770                         NL_SET_ERR_MSG(extack,
2771                                        "Nexthop has invalid gateway or device mismatch");
2772                         err = -EINVAL;
2773                 }
2774                 rcu_read_unlock();
2775
2776                 ip6_rt_put(grt);
2777         }
2778
2779         return err;
2780 }
2781
2782 static int ip6_route_check_nh(struct net *net,
2783                               struct fib6_config *cfg,
2784                               struct net_device **_dev,
2785                               struct inet6_dev **idev)
2786 {
2787         const struct in6_addr *gw_addr = &cfg->fc_gateway;
2788         struct net_device *dev = _dev ? *_dev : NULL;
2789         struct rt6_info *grt = NULL;
2790         int err = -EHOSTUNREACH;
2791
2792         if (cfg->fc_table) {
2793                 int flags = RT6_LOOKUP_F_IFACE;
2794
2795                 grt = ip6_nh_lookup_table(net, cfg, gw_addr,
2796                                           cfg->fc_table, flags);
2797                 if (grt) {
2798                         if (grt->rt6i_flags & RTF_GATEWAY ||
2799                             (dev && dev != grt->dst.dev)) {
2800                                 ip6_rt_put(grt);
2801                                 grt = NULL;
2802                         }
2803                 }
2804         }
2805
2806         if (!grt)
2807                 grt = rt6_lookup(net, gw_addr, NULL, cfg->fc_ifindex, NULL, 1);
2808
2809         if (!grt)
2810                 goto out;
2811
2812         if (dev) {
2813                 if (dev != grt->dst.dev) {
2814                         ip6_rt_put(grt);
2815                         goto out;
2816                 }
2817         } else {
2818                 *_dev = dev = grt->dst.dev;
2819                 *idev = grt->rt6i_idev;
2820                 dev_hold(dev);
2821                 in6_dev_hold(grt->rt6i_idev);
2822         }
2823
2824         if (!(grt->rt6i_flags & RTF_GATEWAY))
2825                 err = 0;
2826
2827         ip6_rt_put(grt);
2828
2829 out:
2830         return err;
2831 }
2832
2833 static int ip6_validate_gw(struct net *net, struct fib6_config *cfg,
2834                            struct net_device **_dev, struct inet6_dev **idev,
2835                            struct netlink_ext_ack *extack)
2836 {
2837         const struct in6_addr *gw_addr = &cfg->fc_gateway;
2838         int gwa_type = ipv6_addr_type(gw_addr);
2839         bool skip_dev = gwa_type & IPV6_ADDR_LINKLOCAL ? false : true;
2840         const struct net_device *dev = *_dev;
2841         bool need_addr_check = !dev;
2842         int err = -EINVAL;
2843
2844         /* if gw_addr is local we will fail to detect this in case
2845          * address is still TENTATIVE (DAD in progress). rt6_lookup()
2846          * will return already-added prefix route via interface that
2847          * prefix route was assigned to, which might be non-loopback.
2848          */
2849         if (dev &&
2850             ipv6_chk_addr_and_flags(net, gw_addr, dev, skip_dev, 0, 0)) {
2851                 NL_SET_ERR_MSG(extack, "Gateway can not be a local address");
2852                 goto out;
2853         }
2854
2855         if (gwa_type != (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_UNICAST)) {
2856                 /* IPv6 strictly inhibits using not link-local
2857                  * addresses as nexthop address.
2858                  * Otherwise, router will not able to send redirects.
2859                  * It is very good, but in some (rare!) circumstances
2860                  * (SIT, PtP, NBMA NOARP links) it is handy to allow
2861                  * some exceptions. --ANK
2862                  * We allow IPv4-mapped nexthops to support RFC4798-type
2863                  * addressing
2864                  */
2865                 if (!(gwa_type & (IPV6_ADDR_UNICAST | IPV6_ADDR_MAPPED))) {
2866                         NL_SET_ERR_MSG(extack, "Invalid gateway address");
2867                         goto out;
2868                 }
2869
2870                 if (cfg->fc_flags & RTNH_F_ONLINK)
2871                         err = ip6_route_check_nh_onlink(net, cfg, dev, extack);
2872                 else
2873                         err = ip6_route_check_nh(net, cfg, _dev, idev);
2874
2875                 if (err)
2876                         goto out;
2877         }
2878
2879         /* reload in case device was changed */
2880         dev = *_dev;
2881
2882         err = -EINVAL;
2883         if (!dev) {
2884                 NL_SET_ERR_MSG(extack, "Egress device not specified");
2885                 goto out;
2886         } else if (dev->flags & IFF_LOOPBACK) {
2887                 NL_SET_ERR_MSG(extack,
2888                                "Egress device can not be loopback device for this route");
2889                 goto out;
2890         }
2891
2892         /* if we did not check gw_addr above, do so now that the
2893          * egress device has been resolved.
2894          */
2895         if (need_addr_check &&
2896             ipv6_chk_addr_and_flags(net, gw_addr, dev, skip_dev, 0, 0)) {
2897                 NL_SET_ERR_MSG(extack, "Gateway can not be a local address");
2898                 goto out;
2899         }
2900
2901         err = 0;
2902 out:
2903         return err;
2904 }
2905
2906 static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
2907                                               gfp_t gfp_flags,
2908                                               struct netlink_ext_ack *extack)
2909 {
2910         struct net *net = cfg->fc_nlinfo.nl_net;
2911         struct fib6_info *rt = NULL;
2912         struct net_device *dev = NULL;
2913         struct inet6_dev *idev = NULL;
2914         struct fib6_table *table;
2915         int addr_type;
2916         int err = -EINVAL;
2917
2918         /* RTF_PCPU is an internal flag; can not be set by userspace */
2919         if (cfg->fc_flags & RTF_PCPU) {
2920                 NL_SET_ERR_MSG(extack, "Userspace can not set RTF_PCPU");
2921                 goto out;
2922         }
2923
2924         /* RTF_CACHE is an internal flag; can not be set by userspace */
2925         if (cfg->fc_flags & RTF_CACHE) {
2926                 NL_SET_ERR_MSG(extack, "Userspace can not set RTF_CACHE");
2927                 goto out;
2928         }
2929
2930         if (cfg->fc_type > RTN_MAX) {
2931                 NL_SET_ERR_MSG(extack, "Invalid route type");
2932                 goto out;
2933         }
2934
2935         if (cfg->fc_dst_len > 128) {
2936                 NL_SET_ERR_MSG(extack, "Invalid prefix length");
2937                 goto out;
2938         }
2939         if (cfg->fc_src_len > 128) {
2940                 NL_SET_ERR_MSG(extack, "Invalid source address length");
2941                 goto out;
2942         }
2943 #ifndef CONFIG_IPV6_SUBTREES
2944         if (cfg->fc_src_len) {
2945                 NL_SET_ERR_MSG(extack,
2946                                "Specifying source address requires IPV6_SUBTREES to be enabled");
2947                 goto out;
2948         }
2949 #endif
2950         if (cfg->fc_ifindex) {
2951                 err = -ENODEV;
2952                 dev = dev_get_by_index(net, cfg->fc_ifindex);
2953                 if (!dev)
2954                         goto out;
2955                 idev = in6_dev_get(dev);
2956                 if (!idev)
2957                         goto out;
2958         }
2959
2960         if (cfg->fc_metric == 0)
2961                 cfg->fc_metric = IP6_RT_PRIO_USER;
2962
2963         if (cfg->fc_flags & RTNH_F_ONLINK) {
2964                 if (!dev) {
2965                         NL_SET_ERR_MSG(extack,
2966                                        "Nexthop device required for onlink");
2967                         err = -ENODEV;
2968                         goto out;
2969                 }
2970
2971                 if (!(dev->flags & IFF_UP)) {
2972                         NL_SET_ERR_MSG(extack, "Nexthop device is not up");
2973                         err = -ENETDOWN;
2974                         goto out;
2975                 }
2976         }
2977
2978         err = -ENOBUFS;
2979         if (cfg->fc_nlinfo.nlh &&
2980             !(cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_CREATE)) {
2981                 table = fib6_get_table(net, cfg->fc_table);
2982                 if (!table) {
2983                         pr_warn("NLM_F_CREATE should be specified when creating new route\n");
2984                         table = fib6_new_table(net, cfg->fc_table);
2985                 }
2986         } else {
2987                 table = fib6_new_table(net, cfg->fc_table);
2988         }
2989
2990         if (!table)
2991                 goto out;
2992
2993         err = -ENOMEM;
2994         rt = fib6_info_alloc(gfp_flags);
2995         if (!rt)
2996                 goto out;
2997
2998         rt->fib6_metrics = ip_fib_metrics_init(net, cfg->fc_mx, cfg->fc_mx_len,
2999                                                extack);
3000         if (IS_ERR(rt->fib6_metrics)) {
3001                 err = PTR_ERR(rt->fib6_metrics);
3002                 /* Do not leave garbage there. */
3003                 rt->fib6_metrics = (struct dst_metrics *)&dst_default_metrics;
3004                 goto out;
3005         }
3006
3007         if (cfg->fc_flags & RTF_ADDRCONF)
3008                 rt->dst_nocount = true;
3009
3010         if (cfg->fc_flags & RTF_EXPIRES)
3011                 fib6_set_expires(rt, jiffies +
3012                                 clock_t_to_jiffies(cfg->fc_expires));
3013         else
3014                 fib6_clean_expires(rt);
3015
3016         if (cfg->fc_protocol == RTPROT_UNSPEC)
3017                 cfg->fc_protocol = RTPROT_BOOT;
3018         rt->fib6_protocol = cfg->fc_protocol;
3019
3020         addr_type = ipv6_addr_type(&cfg->fc_dst);
3021
3022         if (cfg->fc_encap) {
3023                 struct lwtunnel_state *lwtstate;
3024
3025                 err = lwtunnel_build_state(cfg->fc_encap_type,
3026                                            cfg->fc_encap, AF_INET6, cfg,
3027                                            &lwtstate, extack);
3028                 if (err)
3029                         goto out;
3030                 rt->fib6_nh.nh_lwtstate = lwtstate_get(lwtstate);
3031         }
3032
3033         ipv6_addr_prefix(&rt->fib6_dst.addr, &cfg->fc_dst, cfg->fc_dst_len);
3034         rt->fib6_dst.plen = cfg->fc_dst_len;
3035         if (rt->fib6_dst.plen == 128)
3036                 rt->dst_host = true;
3037
3038 #ifdef CONFIG_IPV6_SUBTREES
3039         ipv6_addr_prefix(&rt->fib6_src.addr, &cfg->fc_src, cfg->fc_src_len);
3040         rt->fib6_src.plen = cfg->fc_src_len;
3041 #endif
3042
3043         rt->fib6_metric = cfg->fc_metric;
3044         rt->fib6_nh.nh_weight = 1;
3045
3046         rt->fib6_type = cfg->fc_type;
3047
3048         /* We cannot add true routes via loopback here,
3049            they would result in kernel looping; promote them to reject routes
3050          */
3051         if ((cfg->fc_flags & RTF_REJECT) ||
3052             (dev && (dev->flags & IFF_LOOPBACK) &&
3053              !(addr_type & IPV6_ADDR_LOOPBACK) &&
3054              !(cfg->fc_flags & RTF_LOCAL))) {
3055                 /* hold loopback dev/idev if we haven't done so. */
3056                 if (dev != net->loopback_dev) {
3057                         if (dev) {
3058                                 dev_put(dev);
3059                                 in6_dev_put(idev);
3060                         }
3061                         dev = net->loopback_dev;
3062                         dev_hold(dev);
3063                         idev = in6_dev_get(dev);
3064                         if (!idev) {
3065                                 err = -ENODEV;
3066                                 goto out;
3067                         }
3068                 }
3069                 rt->fib6_flags = RTF_REJECT|RTF_NONEXTHOP;
3070                 goto install_route;
3071         }
3072
3073         if (cfg->fc_flags & RTF_GATEWAY) {
3074                 err = ip6_validate_gw(net, cfg, &dev, &idev, extack);
3075                 if (err)
3076                         goto out;
3077
3078                 rt->fib6_nh.nh_gw = cfg->fc_gateway;
3079         }
3080
3081         err = -ENODEV;
3082         if (!dev)
3083                 goto out;
3084
3085         if (idev->cnf.disable_ipv6) {
3086                 NL_SET_ERR_MSG(extack, "IPv6 is disabled on nexthop device");
3087                 err = -EACCES;
3088                 goto out;
3089         }
3090
3091         if (!(dev->flags & IFF_UP)) {
3092                 NL_SET_ERR_MSG(extack, "Nexthop device is not up");
3093                 err = -ENETDOWN;
3094                 goto out;
3095         }
3096
3097         if (!ipv6_addr_any(&cfg->fc_prefsrc)) {
3098                 if (!ipv6_chk_addr(net, &cfg->fc_prefsrc, dev, 0)) {
3099                         NL_SET_ERR_MSG(extack, "Invalid source address");
3100                         err = -EINVAL;
3101                         goto out;
3102                 }
3103                 rt->fib6_prefsrc.addr = cfg->fc_prefsrc;
3104                 rt->fib6_prefsrc.plen = 128;
3105         } else
3106                 rt->fib6_prefsrc.plen = 0;
3107
3108         rt->fib6_flags = cfg->fc_flags;
3109
3110 install_route:
3111         if (!(rt->fib6_flags & (RTF_LOCAL | RTF_ANYCAST)) &&
3112             !netif_carrier_ok(dev))
3113                 rt->fib6_nh.nh_flags |= RTNH_F_LINKDOWN;
3114         rt->fib6_nh.nh_flags |= (cfg->fc_flags & RTNH_F_ONLINK);
3115         rt->fib6_nh.nh_dev = dev;
3116         rt->fib6_table = table;
3117
3118         if (idev)
3119                 in6_dev_put(idev);
3120
3121         return rt;
3122 out:
3123         if (dev)
3124                 dev_put(dev);
3125         if (idev)
3126                 in6_dev_put(idev);
3127
3128         fib6_info_release(rt);
3129         return ERR_PTR(err);
3130 }
3131
3132 int ip6_route_add(struct fib6_config *cfg, gfp_t gfp_flags,
3133                   struct netlink_ext_ack *extack)
3134 {
3135         struct fib6_info *rt;
3136         int err;
3137
3138         rt = ip6_route_info_create(cfg, gfp_flags, extack);
3139         if (IS_ERR(rt))
3140                 return PTR_ERR(rt);
3141
3142         err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, extack);
3143         fib6_info_release(rt);
3144
3145         return err;
3146 }
3147
3148 static int __ip6_del_rt(struct fib6_info *rt, struct nl_info *info)
3149 {
3150         struct net *net = info->nl_net;
3151         struct fib6_table *table;
3152         int err;
3153
3154         if (rt == net->ipv6.fib6_null_entry) {
3155                 err = -ENOENT;
3156                 goto out;
3157         }
3158
3159         table = rt->fib6_table;
3160         spin_lock_bh(&table->tb6_lock);
3161         err = fib6_del(rt, info);
3162         spin_unlock_bh(&table->tb6_lock);
3163
3164 out:
3165         fib6_info_release(rt);
3166         return err;
3167 }
3168
3169 int ip6_del_rt(struct net *net, struct fib6_info *rt)
3170 {
3171         struct nl_info info = { .nl_net = net };
3172
3173         return __ip6_del_rt(rt, &info);
3174 }
3175
3176 static int __ip6_del_rt_siblings(struct fib6_info *rt, struct fib6_config *cfg)
3177 {
3178         struct nl_info *info = &cfg->fc_nlinfo;
3179         struct net *net = info->nl_net;
3180         struct sk_buff *skb = NULL;
3181         struct fib6_table *table;
3182         int err = -ENOENT;
3183
3184         if (rt == net->ipv6.fib6_null_entry)
3185                 goto out_put;
3186         table = rt->fib6_table;
3187         spin_lock_bh(&table->tb6_lock);
3188
3189         if (rt->fib6_nsiblings && cfg->fc_delete_all_nh) {
3190                 struct fib6_info *sibling, *next_sibling;
3191
3192                 /* prefer to send a single notification with all hops */
3193                 skb = nlmsg_new(rt6_nlmsg_size(rt), gfp_any());
3194                 if (skb) {
3195                         u32 seq = info->nlh ? info->nlh->nlmsg_seq : 0;
3196
3197                         if (rt6_fill_node(net, skb, rt, NULL,
3198                                           NULL, NULL, 0, RTM_DELROUTE,
3199                                           info->portid, seq, 0) < 0) {
3200                                 kfree_skb(skb);
3201                                 skb = NULL;
3202                         } else
3203                                 info->skip_notify = 1;
3204                 }
3205
3206                 list_for_each_entry_safe(sibling, next_sibling,
3207                                          &rt->fib6_siblings,
3208                                          fib6_siblings) {
3209                         err = fib6_del(sibling, info);
3210                         if (err)
3211                                 goto out_unlock;
3212                 }
3213         }
3214
3215         err = fib6_del(rt, info);
3216 out_unlock:
3217         spin_unlock_bh(&table->tb6_lock);
3218 out_put:
3219         fib6_info_release(rt);
3220
3221         if (skb) {
3222                 rtnl_notify(skb, net, info->portid, RTNLGRP_IPV6_ROUTE,
3223                             info->nlh, gfp_any());
3224         }
3225         return err;
3226 }
3227
3228 static int ip6_del_cached_rt(struct rt6_info *rt, struct fib6_config *cfg)
3229 {
3230         int rc = -ESRCH;
3231
3232         if (cfg->fc_ifindex && rt->dst.dev->ifindex != cfg->fc_ifindex)
3233                 goto out;
3234
3235         if (cfg->fc_flags & RTF_GATEWAY &&
3236             !ipv6_addr_equal(&cfg->fc_gateway, &rt->rt6i_gateway))
3237                 goto out;
3238
3239         rc = rt6_remove_exception_rt(rt);
3240 out:
3241         return rc;
3242 }
3243
3244 static int ip6_route_del(struct fib6_config *cfg,
3245                          struct netlink_ext_ack *extack)
3246 {
3247         struct rt6_info *rt_cache;
3248         struct fib6_table *table;
3249         struct fib6_info *rt;
3250         struct fib6_node *fn;
3251         int err = -ESRCH;
3252
3253         table = fib6_get_table(cfg->fc_nlinfo.nl_net, cfg->fc_table);
3254         if (!table) {
3255                 NL_SET_ERR_MSG(extack, "FIB table does not exist");
3256                 return err;
3257         }
3258
3259         rcu_read_lock();
3260
3261         fn = fib6_locate(&table->tb6_root,
3262                          &cfg->fc_dst, cfg->fc_dst_len,
3263                          &cfg->fc_src, cfg->fc_src_len,
3264                          !(cfg->fc_flags & RTF_CACHE));
3265
3266         if (fn) {
3267                 for_each_fib6_node_rt_rcu(fn) {
3268                         if (cfg->fc_flags & RTF_CACHE) {
3269                                 int rc;
3270
3271                                 rt_cache = rt6_find_cached_rt(rt, &cfg->fc_dst,
3272                                                               &cfg->fc_src);
3273                                 if (rt_cache) {
3274                                         rc = ip6_del_cached_rt(rt_cache, cfg);
3275                                         if (rc != -ESRCH) {
3276                                                 rcu_read_unlock();
3277                                                 return rc;
3278                                         }
3279                                 }
3280                                 continue;
3281                         }
3282                         if (cfg->fc_ifindex &&
3283                             (!rt->fib6_nh.nh_dev ||
3284                              rt->fib6_nh.nh_dev->ifindex != cfg->fc_ifindex))
3285                                 continue;
3286                         if (cfg->fc_flags & RTF_GATEWAY &&
3287                             !ipv6_addr_equal(&cfg->fc_gateway, &rt->fib6_nh.nh_gw))
3288                                 continue;
3289                         if (cfg->fc_metric && cfg->fc_metric != rt->fib6_metric)
3290                                 continue;
3291                         if (cfg->fc_protocol && cfg->fc_protocol != rt->fib6_protocol)
3292                           &nbs