net/ipv4/route.c

   1 /*
   2  * INET         An implementation of the TCP/IP protocol suite for the LINUX
   3  *              operating system.  INET is implemented using the  BSD Socket
   4  *              interface as the means of communication with the user level.
   5  *
   6  *              ROUTE - implementation of the IP router.
   7  *
   8  * Authors:     Ross Biro
   9  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  10  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  11  *              Linus Torvalds, <Linus.Torvalds@helsinki.fi>
  12  *              Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
  13  *
  14  * Fixes:
  15  *              Alan Cox        :       Verify area fixes.
  16  *              Alan Cox        :       cli() protects routing changes
  17  *              Rui Oliveira    :       ICMP routing table updates
  18  *              (rco@di.uminho.pt)      Routing table insertion and update
  19  *              Linus Torvalds  :       Rewrote bits to be sensible
  20  *              Alan Cox        :       Added BSD route gw semantics
  21  *              Alan Cox        :       Super /proc >4K
  22  *              Alan Cox        :       MTU in route table
  23  *              Alan Cox        :       MSS actually. Also added the window
  24  *                                      clamper.
  25  *              Sam Lantinga    :       Fixed route matching in rt_del()
  26  *              Alan Cox        :       Routing cache support.
  27  *              Alan Cox        :       Removed compatibility cruft.
  28  *              Alan Cox        :       RTF_REJECT support.
  29  *              Alan Cox        :       TCP irtt support.
  30  *              Jonathan Naylor :       Added Metric support.
  31  *      Miquel van Smoorenburg  :       BSD API fixes.
  32  *      Miquel van Smoorenburg  :       Metrics.
  33  *              Alan Cox        :       Use __u32 properly
  34  *              Alan Cox        :       Aligned routing errors more closely with BSD
  35  *                                      our system is still very different.
  36  *              Alan Cox        :       Faster /proc handling
  37  *      Alexey Kuznetsov        :       Massive rework to support tree based routing,
  38  *                                      routing caches and better behaviour.
  39  *
  40  *              Olaf Erb        :       irtt wasn't being copied right.
  41  *              Bjorn Ekwall    :       Kerneld route support.
  42  *              Alan Cox        :       Multicast fixed (I hope)
  43  *              Pavel Krauz     :       Limited broadcast fixed
  44  *              Mike McLagan    :       Routing by source
  45  *      Alexey Kuznetsov        :       End of old history. Split to fib.c and
  46  *                                      route.c and rewritten from scratch.
  47  *              Andi Kleen      :       Load-limit warning messages.
  48  *      Vitaly E. Lavrov        :       Transparent proxy revived after year coma.
  49  *      Vitaly E. Lavrov        :       Race condition in ip_route_input_slow.
  50  *      Tobias Ringstrom        :       Uninitialized res.type in ip_route_output_slow.
  51  *      Vladimir V. Ivanov      :       IP rule info (flowid) is really useful.
  52  *              Marc Boucher    :       routing by fwmark
  53  *      Robert Olsson           :       Added rt_cache statistics
  54  *      Arnaldo C. Melo         :       Convert proc stuff to seq_file
  55  *      Eric Dumazet            :       hashed spinlocks and rt_check_expire() fixes.
  56  *      Ilia Sotnikov           :       Ignore TOS on PMTUD and Redirect
  57  *      Ilia Sotnikov           :       Removed TOS from hash calculations
  58  *
  59  *              This program is free software; you can redistribute it and/or
  60  *              modify it under the terms of the GNU General Public License
  61  *              as published by the Free Software Foundation; either version
  62  *              2 of the License, or (at your option) any later version.
  63  */
  64
  65 #define pr_fmt(fmt) "IPv4: " fmt
  66
  67 #include <linux/module.h>
  68 #include <linux/uaccess.h>
  69 #include <linux/bitops.h>
  70 #include <linux/types.h>
  71 #include <linux/kernel.h>
  72 #include <linux/mm.h>
  73 #include <linux/string.h>
  74 #include <linux/socket.h>
  75 #include <linux/sockios.h>
  76 #include <linux/errno.h>
  77 #include <linux/in.h>
  78 #include <linux/inet.h>
  79 #include <linux/netdevice.h>
  80 #include <linux/proc_fs.h>
  81 #include <linux/init.h>
  82 #include <linux/skbuff.h>
  83 #include <linux/inetdevice.h>
  84 #include <linux/igmp.h>
  85 #include <linux/pkt_sched.h>
  86 #include <linux/mroute.h>
  87 #include <linux/netfilter_ipv4.h>
  88 #include <linux/random.h>
  89 #include <linux/rcupdate.h>
  90 #include <linux/times.h>
  91 #include <linux/slab.h>
  92 #include <linux/jhash.h>
  93 #include <net/dst.h>
  94 #include <net/dst_metadata.h>
  95 #include <net/net_namespace.h>
  96 #include <net/protocol.h>
  97 #include <net/ip.h>
  98 #include <net/route.h>
  99 #include <net/inetpeer.h>
 100 #include <net/sock.h>
 101 #include <net/ip_fib.h>
 102 #include <net/arp.h>
 103 #include <net/tcp.h>
 104 #include <net/icmp.h>
 105 #include <net/xfrm.h>
 106 #include <net/lwtunnel.h>
 107 #include <net/netevent.h>
 108 #include <net/rtnetlink.h>
 109 #ifdef CONFIG_SYSCTL
 110 #include <linux/sysctl.h>
 111 #endif
 112 #include <net/secure_seq.h>
 113 #include <net/ip_tunnels.h>
 114 #include <net/l3mdev.h>
 115
 116 #include "fib_lookup.h"
 117
 118 #define RT_FL_TOS(oldflp4) \
 119         ((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
 120
 121 #define RT_GC_TIMEOUT (300*HZ)
 122
 123 static int ip_rt_max_size;
 124 static int ip_rt_redirect_number __read_mostly  = 9;
 125 static int ip_rt_redirect_load __read_mostly    = HZ / 50;
 126 static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1));
 127 static int ip_rt_error_cost __read_mostly       = HZ;
 128 static int ip_rt_error_burst __read_mostly      = 5 * HZ;
 129 static int ip_rt_mtu_expires __read_mostly      = 10 * 60 * HZ;
 130 static u32 ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 131 static int ip_rt_min_advmss __read_mostly       = 256;
 132
 133 static int ip_rt_gc_timeout __read_mostly       = RT_GC_TIMEOUT;
 134
 135 /*
 136  *      Interface to generic destination cache.
 137  */
 138
 139 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
 140 static unsigned int      ipv4_default_advmss(const struct dst_entry *dst);
 141 static unsigned int      ipv4_mtu(const struct dst_entry *dst);
 142 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
 143 static void              ipv4_link_failure(struct sk_buff *skb);
 144 static void              ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
 145                                            struct sk_buff *skb, u32 mtu);
 146 static void              ip_do_redirect(struct dst_entry *dst, struct sock *sk,
 147                                         struct sk_buff *skb);
 148 static void             ipv4_dst_destroy(struct dst_entry *dst);
 149
 150 static u32 *ipv4_cow_metrics(struct dst_entry *dst, unsigned long old)
 151 {
 152         WARN_ON(1);
 153         return NULL;
 154 }
 155
 156 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
 157                                            struct sk_buff *skb,
 158                                            const void *daddr);
 159 static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr);
 160
 161 static struct dst_ops ipv4_dst_ops = {
 162         .family =               AF_INET,
 163         .check =                ipv4_dst_check,
 164         .default_advmss =       ipv4_default_advmss,
 165         .mtu =                  ipv4_mtu,
 166         .cow_metrics =          ipv4_cow_metrics,
 167         .destroy =              ipv4_dst_destroy,
 168         .negative_advice =      ipv4_negative_advice,
 169         .link_failure =         ipv4_link_failure,
 170         .update_pmtu =          ip_rt_update_pmtu,
 171         .redirect =             ip_do_redirect,
 172         .local_out =            __ip_local_out,
 173         .neigh_lookup =         ipv4_neigh_lookup,
 174         .confirm_neigh =        ipv4_confirm_neigh,
 175 };
 176
 177 #define ECN_OR_COST(class)      TC_PRIO_##class
 178
 179 const __u8 ip_tos2prio[16] = {
 180         TC_PRIO_BESTEFFORT,
 181         ECN_OR_COST(BESTEFFORT),
 182         TC_PRIO_BESTEFFORT,
 183         ECN_OR_COST(BESTEFFORT),
 184         TC_PRIO_BULK,
 185         ECN_OR_COST(BULK),
 186         TC_PRIO_BULK,
 187         ECN_OR_COST(BULK),
 188         TC_PRIO_INTERACTIVE,
 189         ECN_OR_COST(INTERACTIVE),
 190         TC_PRIO_INTERACTIVE,
 191         ECN_OR_COST(INTERACTIVE),
 192         TC_PRIO_INTERACTIVE_BULK,
 193         ECN_OR_COST(INTERACTIVE_BULK),
 194         TC_PRIO_INTERACTIVE_BULK,
 195         ECN_OR_COST(INTERACTIVE_BULK)
 196 };
 197 EXPORT_SYMBOL(ip_tos2prio);
 198
 199 static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
 200 #define RT_CACHE_STAT_INC(field) raw_cpu_inc(rt_cache_stat.field)
 201
 202 #ifdef CONFIG_PROC_FS
 203 static void *rt_cache_seq_start(struct seq_file *seq, loff_t *pos)
 204 {
 205         if (*pos)
 206                 return NULL;
 207         return SEQ_START_TOKEN;
 208 }
 209
 210 static void *rt_cache_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 211 {
 212         ++*pos;
 213         return NULL;
 214 }
 215
 216 static void rt_cache_seq_stop(struct seq_file *seq, void *v)
 217 {
 218 }
 219
 220 static int rt_cache_seq_show(struct seq_file *seq, void *v)
 221 {
 222         if (v == SEQ_START_TOKEN)
 223                 seq_printf(seq, "%-127s\n",
 224                            "Iface\tDestination\tGateway \tFlags\t\tRefCnt\tUse\t"
 225                            "Metric\tSource\t\tMTU\tWindow\tIRTT\tTOS\tHHRef\t"
 226                            "HHUptod\tSpecDst");
 227         return 0;
 228 }
 229
 230 static const struct seq_operations rt_cache_seq_ops = {
 231         .start  = rt_cache_seq_start,
 232         .next   = rt_cache_seq_next,
 233         .stop   = rt_cache_seq_stop,
 234         .show   = rt_cache_seq_show,
 235 };
 236
 237 static int rt_cache_seq_open(struct inode *inode, struct file *file)
 238 {
 239         return seq_open(file, &rt_cache_seq_ops);
 240 }
 241
 242 static const struct file_operations rt_cache_seq_fops = {
 243         .open    = rt_cache_seq_open,
 244         .read    = seq_read,
 245         .llseek  = seq_lseek,
 246         .release = seq_release,
 247 };
 248
 249
 250 static void *rt_cpu_seq_start(struct seq_file *seq, loff_t *pos)
 251 {
 252         int cpu;
 253
 254         if (*pos == 0)
 255                 return SEQ_START_TOKEN;
 256
 257         for (cpu = *pos-1; cpu < nr_cpu_ids; ++cpu) {
 258                 if (!cpu_possible(cpu))
 259                         continue;
 260                 *pos = cpu+1;
 261                 return &per_cpu(rt_cache_stat, cpu);
 262         }
 263         return NULL;
 264 }
 265
 266 static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 267 {
 268         int cpu;
 269
 270         for (cpu = *pos; cpu < nr_cpu_ids; ++cpu) {
 271                 if (!cpu_possible(cpu))
 272                         continue;
 273                 *pos = cpu+1;
 274                 return &per_cpu(rt_cache_stat, cpu);
 275         }
 276         return NULL;
 277
 278 }
 279
 280 static void rt_cpu_seq_stop(struct seq_file *seq, void *v)
 281 {
 282
 283 }
 284
 285 static int rt_cpu_seq_show(struct seq_file *seq, void *v)
 286 {
 287         struct rt_cache_stat *st = v;
 288
 289         if (v == SEQ_START_TOKEN) {
 290                 seq_printf(seq, "entries  in_hit in_slow_tot in_slow_mc in_no_route in_brd in_martian_dst in_martian_src  out_hit out_slow_tot out_slow_mc  gc_total gc_ignored gc_goal_miss gc_dst_overflow in_hlist_search out_hlist_search\n");
 291                 return 0;
 292         }
 293
 294         seq_printf(seq,"%08x  %08x %08x %08x %08x %08x %08x %08x "
 295                    " %08x %08x %08x %08x %08x %08x %08x %08x %08x \n",
 296                    dst_entries_get_slow(&ipv4_dst_ops),
 297                    0, /* st->in_hit */
 298                    st->in_slow_tot,
 299                    st->in_slow_mc,
 300                    st->in_no_route,
 301                    st->in_brd,
 302                    st->in_martian_dst,
 303                    st->in_martian_src,
 304
 305                    0, /* st->out_hit */
 306                    st->out_slow_tot,
 307                    st->out_slow_mc,
 308
 309                    0, /* st->gc_total */
 310                    0, /* st->gc_ignored */
 311                    0, /* st->gc_goal_miss */
 312                    0, /* st->gc_dst_overflow */
 313                    0, /* st->in_hlist_search */
 314                    0  /* st->out_hlist_search */
 315                 );
 316         return 0;
 317 }
 318
 319 static const struct seq_operations rt_cpu_seq_ops = {
 320         .start  = rt_cpu_seq_start,
 321         .next   = rt_cpu_seq_next,
 322         .stop   = rt_cpu_seq_stop,
 323         .show   = rt_cpu_seq_show,
 324 };
 325
 326
 327 static int rt_cpu_seq_open(struct inode *inode, struct file *file)
 328 {
 329         return seq_open(file, &rt_cpu_seq_ops);
 330 }
 331
 332 static const struct file_operations rt_cpu_seq_fops = {
 333         .open    = rt_cpu_seq_open,
 334         .read    = seq_read,
 335         .llseek  = seq_lseek,
 336         .release = seq_release,
 337 };
 338
 339 #ifdef CONFIG_IP_ROUTE_CLASSID
 340 static int rt_acct_proc_show(struct seq_file *m, void *v)
 341 {
 342         struct ip_rt_acct *dst, *src;
 343         unsigned int i, j;
 344
 345         dst = kcalloc(256, sizeof(struct ip_rt_acct), GFP_KERNEL);
 346         if (!dst)
 347                 return -ENOMEM;
 348
 349         for_each_possible_cpu(i) {
 350                 src = (struct ip_rt_acct *)per_cpu_ptr(ip_rt_acct, i);
 351                 for (j = 0; j < 256; j++) {
 352                         dst[j].o_bytes   += src[j].o_bytes;
 353                         dst[j].o_packets += src[j].o_packets;
 354                         dst[j].i_bytes   += src[j].i_bytes;
 355                         dst[j].i_packets += src[j].i_packets;
 356                 }
 357         }
 358
 359         seq_write(m, dst, 256 * sizeof(struct ip_rt_acct));
 360         kfree(dst);
 361         return 0;
 362 }
 363 #endif
 364
 365 static int __net_init ip_rt_do_proc_init(struct net *net)
 366 {
 367         struct proc_dir_entry *pde;
 368
 369         pde = proc_create("rt_cache", 0444, net->proc_net,
 370                           &rt_cache_seq_fops);
 371         if (!pde)
 372                 goto err1;
 373
 374         pde = proc_create("rt_cache", 0444,
 375                           net->proc_net_stat, &rt_cpu_seq_fops);
 376         if (!pde)
 377                 goto err2;
 378
 379 #ifdef CONFIG_IP_ROUTE_CLASSID
 380         pde = proc_create_single("rt_acct", 0, net->proc_net,
 381                         rt_acct_proc_show);
 382         if (!pde)
 383                 goto err3;
 384 #endif
 385         return 0;
 386
 387 #ifdef CONFIG_IP_ROUTE_CLASSID
 388 err3:
 389         remove_proc_entry("rt_cache", net->proc_net_stat);
 390 #endif
 391 err2:
 392         remove_proc_entry("rt_cache", net->proc_net);
 393 err1:
 394         return -ENOMEM;
 395 }
 396
 397 static void __net_exit ip_rt_do_proc_exit(struct net *net)
 398 {
 399         remove_proc_entry("rt_cache", net->proc_net_stat);
 400         remove_proc_entry("rt_cache", net->proc_net);
 401 #ifdef CONFIG_IP_ROUTE_CLASSID
 402         remove_proc_entry("rt_acct", net->proc_net);
 403 #endif
 404 }
 405
 406 static struct pernet_operations ip_rt_proc_ops __net_initdata =  {
 407         .init = ip_rt_do_proc_init,
 408         .exit = ip_rt_do_proc_exit,
 409 };
 410
 411 static int __init ip_rt_proc_init(void)
 412 {
 413         return register_pernet_subsys(&ip_rt_proc_ops);
 414 }
 415
 416 #else
 417 static inline int ip_rt_proc_init(void)
 418 {
 419         return 0;
 420 }
 421 #endif /* CONFIG_PROC_FS */
 422
 423 static inline bool rt_is_expired(const struct rtable *rth)
 424 {
 425         return rth->rt_genid != rt_genid_ipv4(dev_net(rth->dst.dev));
 426 }
 427
 428 void rt_cache_flush(struct net *net)
 429 {
 430         rt_genid_bump_ipv4(net);
 431 }
 432
 433 static struct neighbour *ipv4_neigh_lookup(const struct dst_entry *dst,
 434                                            struct sk_buff *skb,
 435                                            const void *daddr)
 436 {
 437         struct net_device *dev = dst->dev;
 438         const __be32 *pkey = daddr;
 439         const struct rtable *rt;
 440         struct neighbour *n;
 441
 442         rt = (const struct rtable *) dst;
 443         if (rt->rt_gateway)
 444                 pkey = (const __be32 *) &rt->rt_gateway;
 445         else if (skb)
 446                 pkey = &ip_hdr(skb)->daddr;
 447
 448         n = __ipv4_neigh_lookup(dev, *(__force u32 *)pkey);
 449         if (n)
 450                 return n;
 451         return neigh_create(&arp_tbl, pkey, dev);
 452 }
 453
 454 static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr)
 455 {
 456         struct net_device *dev = dst->dev;
 457         const __be32 *pkey = daddr;
 458         const struct rtable *rt;
 459
 460         rt = (const struct rtable *)dst;
 461         if (rt->rt_gateway)
 462                 pkey = (const __be32 *)&rt->rt_gateway;
 463         else if (!daddr ||
 464                  (rt->rt_flags &
 465                   (RTCF_MULTICAST | RTCF_BROADCAST | RTCF_LOCAL)))
 466                 return;
 467
 468         __ipv4_confirm_neigh(dev, *(__force u32 *)pkey);
 469 }
 470
 471 #define IP_IDENTS_SZ 2048u
 472
 473 static atomic_t *ip_idents __read_mostly;
 474 static u32 *ip_tstamps __read_mostly;
 475
 476 /* In order to protect privacy, we add a perturbation to identifiers
 477  * if one generator is seldom used. This makes hard for an attacker
 478  * to infer how many packets were sent between two points in time.
 479  */
 480 u32 ip_idents_reserve(u32 hash, int segs)
 481 {
 482         u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
 483         atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
 484         u32 old = READ_ONCE(*p_tstamp);
 485         u32 now = (u32)jiffies;
 486         u32 new, delta = 0;
 487
 488         if (old != now && cmpxchg(p_tstamp, old, now) == old)
 489                 delta = prandom_u32_max(now - old);
 490
 491         /* Do not use atomic_add_return() as it makes UBSAN unhappy */
 492         do {
 493                 old = (u32)atomic_read(p_id);
 494                 new = old + delta + segs;
 495         } while (atomic_cmpxchg(p_id, old, new) != old);
 496
 497         return new - segs;
 498 }
 499 EXPORT_SYMBOL(ip_idents_reserve);
 500
 501 void __ip_select_ident(struct net *net, struct iphdr *iph, int segs)
 502 {
 503         static u32 ip_idents_hashrnd __read_mostly;
 504         u32 hash, id;
 505
 506         net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
 507
 508         hash = jhash_3words((__force u32)iph->daddr,
 509                             (__force u32)iph->saddr,
 510                             iph->protocol ^ net_hash_mix(net),
 511                             ip_idents_hashrnd);
 512         id = ip_idents_reserve(hash, segs);
 513         iph->id = htons(id);
 514 }
 515 EXPORT_SYMBOL(__ip_select_ident);
 516
 517 static void __build_flow_key(const struct net *net, struct flowi4 *fl4,
 518                              const struct sock *sk,
 519                              const struct iphdr *iph,
 520                              int oif, u8 tos,
 521                              u8 prot, u32 mark, int flow_flags)
 522 {
 523         if (sk) {
 524                 const struct inet_sock *inet = inet_sk(sk);
 525
 526                 oif = sk->sk_bound_dev_if;
 527                 mark = sk->sk_mark;
 528                 tos = RT_CONN_FLAGS(sk);
 529                 prot = inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol;
 530         }
 531         flowi4_init_output(fl4, oif, mark, tos,
 532                            RT_SCOPE_UNIVERSE, prot,
 533                            flow_flags,
 534                            iph->daddr, iph->saddr, 0, 0,
 535                            sock_net_uid(net, sk));
 536 }
 537
 538 static void build_skb_flow_key(struct flowi4 *fl4, const struct sk_buff *skb,
 539                                const struct sock *sk)
 540 {
 541         const struct net *net = dev_net(skb->dev);
 542         const struct iphdr *iph = ip_hdr(skb);
 543         int oif = skb->dev->ifindex;
 544         u8 tos = RT_TOS(iph->tos);
 545         u8 prot = iph->protocol;
 546         u32 mark = skb->mark;
 547
 548         __build_flow_key(net, fl4, sk, iph, oif, tos, prot, mark, 0);
 549 }
 550
 551 static void build_sk_flow_key(struct flowi4 *fl4, const struct sock *sk)
 552 {
 553         const struct inet_sock *inet = inet_sk(sk);
 554         const struct ip_options_rcu *inet_opt;
 555         __be32 daddr = inet->inet_daddr;
 556
 557         rcu_read_lock();
 558         inet_opt = rcu_dereference(inet->inet_opt);
 559         if (inet_opt && inet_opt->opt.srr)
 560                 daddr = inet_opt->opt.faddr;
 561         flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
 562                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
 563                            inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol,
 564                            inet_sk_flowi_flags(sk),
 565                            daddr, inet->inet_saddr, 0, 0, sk->sk_uid);
 566         rcu_read_unlock();
 567 }
 568
 569 static void ip_rt_build_flow_key(struct flowi4 *fl4, const struct sock *sk,
 570                                  const struct sk_buff *skb)
 571 {
 572         if (skb)
 573                 build_skb_flow_key(fl4, skb, sk);
 574         else
 575                 build_sk_flow_key(fl4, sk);
 576 }
 577
 578 static DEFINE_SPINLOCK(fnhe_lock);
 579
 580 static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
 581 {
 582         struct rtable *rt;
 583
 584         rt = rcu_dereference(fnhe->fnhe_rth_input);
 585         if (rt) {
 586                 RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
 587                 dst_dev_put(&rt->dst);
 588                 dst_release(&rt->dst);
 589         }
 590         rt = rcu_dereference(fnhe->fnhe_rth_output);
 591         if (rt) {
 592                 RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
 593                 dst_dev_put(&rt->dst);
 594                 dst_release(&rt->dst);
 595         }
 596 }
 597
 598 static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
 599 {
 600         struct fib_nh_exception *fnhe, *oldest;
 601
 602         oldest = rcu_dereference(hash->chain);
 603         for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
 604              fnhe = rcu_dereference(fnhe->fnhe_next)) {
 605                 if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
 606                         oldest = fnhe;
 607         }
 608         fnhe_flush_routes(oldest);
 609         return oldest;
 610 }
 611
 612 static inline u32 fnhe_hashfun(__be32 daddr)
 613 {
 614         static u32 fnhe_hashrnd __read_mostly;
 615         u32 hval;
 616
 617         net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
 618         hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
 619         return hash_32(hval, FNHE_HASH_SHIFT);
 620 }
 621
 622 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
 623 {
 624         rt->rt_pmtu = fnhe->fnhe_pmtu;
 625         rt->rt_mtu_locked = fnhe->fnhe_mtu_locked;
 626         rt->dst.expires = fnhe->fnhe_expires;
 627
 628         if (fnhe->fnhe_gw) {
 629                 rt->rt_flags |= RTCF_REDIRECTED;
 630                 rt->rt_gateway = fnhe->fnhe_gw;
 631                 rt->rt_uses_gateway = 1;
 632         }
 633 }
 634
 635 static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,
 636                                   u32 pmtu, bool lock, unsigned long expires)
 637 {
 638         struct fnhe_hash_bucket *hash;
 639         struct fib_nh_exception *fnhe;
 640         struct rtable *rt;
 641         u32 genid, hval;
 642         unsigned int i;
 643         int depth;
 644
 645         genid = fnhe_genid(dev_net(nh->nh_dev));
 646         hval = fnhe_hashfun(daddr);
 647
 648         spin_lock_bh(&fnhe_lock);
 649
 650         hash = rcu_dereference(nh->nh_exceptions);
 651         if (!hash) {
 652                 hash = kcalloc(FNHE_HASH_SIZE, sizeof(*hash), GFP_ATOMIC);
 653                 if (!hash)
 654                         goto out_unlock;
 655                 rcu_assign_pointer(nh->nh_exceptions, hash);
 656         }
 657
 658         hash += hval;
 659
 660         depth = 0;
 661         for (fnhe = rcu_dereference(hash->chain); fnhe;
 662              fnhe = rcu_dereference(fnhe->fnhe_next)) {
 663                 if (fnhe->fnhe_daddr == daddr)
 664                         break;
 665                 depth++;
 666         }
 667
 668         if (fnhe) {
 669                 if (fnhe->fnhe_genid != genid)
 670                         fnhe->fnhe_genid = genid;
 671                 if (gw)
 672                         fnhe->fnhe_gw = gw;
 673                 if (pmtu) {
 674                         fnhe->fnhe_pmtu = pmtu;
 675                         fnhe->fnhe_mtu_locked = lock;
 676                 }
 677                 fnhe->fnhe_expires = max(1UL, expires);
 678                 /* Update all cached dsts too */
 679                 rt = rcu_dereference(fnhe->fnhe_rth_input);
 680                 if (rt)
 681                         fill_route_from_fnhe(rt, fnhe);
 682                 rt = rcu_dereference(fnhe->fnhe_rth_output);
 683                 if (rt)
 684                         fill_route_from_fnhe(rt, fnhe);
 685         } else {
 686                 if (depth > FNHE_RECLAIM_DEPTH)
 687                         fnhe = fnhe_oldest(hash);
 688                 else {
 689                         fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
 690                         if (!fnhe)
 691                                 goto out_unlock;
 692
 693                         fnhe->fnhe_next = hash->chain;
 694                         rcu_assign_pointer(hash->chain, fnhe);
 695                 }
 696                 fnhe->fnhe_genid = genid;
 697                 fnhe->fnhe_daddr = daddr;
 698                 fnhe->fnhe_gw = gw;
 699                 fnhe->fnhe_pmtu = pmtu;
 700                 fnhe->fnhe_mtu_locked = lock;
 701                 fnhe->fnhe_expires = max(1UL, expires);
 702
 703                 /* Exception created; mark the cached routes for the nexthop
 704                  * stale, so anyone caching it rechecks if this exception
 705                  * applies to them.
 706                  */
 707                 rt = rcu_dereference(nh->nh_rth_input);
 708                 if (rt)
 709                         rt->dst.obsolete = DST_OBSOLETE_KILL;
 710
 711                 for_each_possible_cpu(i) {
 712                         struct rtable __rcu **prt;
 713                         prt = per_cpu_ptr(nh->nh_pcpu_rth_output, i);
 714                         rt = rcu_dereference(*prt);
 715                         if (rt)
 716                                 rt->dst.obsolete = DST_OBSOLETE_KILL;
 717                 }
 718         }
 719
 720         fnhe->fnhe_stamp = jiffies;
 721
 722 out_unlock:
 723         spin_unlock_bh(&fnhe_lock);
 724 }
 725
 726 static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flowi4 *fl4,
 727                              bool kill_route)
 728 {
 729         __be32 new_gw = icmp_hdr(skb)->un.gateway;
 730         __be32 old_gw = ip_hdr(skb)->saddr;
 731         struct net_device *dev = skb->dev;
 732         struct in_device *in_dev;
 733         struct fib_result res;
 734         struct neighbour *n;
 735         struct net *net;
 736
 737         switch (icmp_hdr(skb)->code & 7) {
 738         case ICMP_REDIR_NET:
 739         case ICMP_REDIR_NETTOS:
 740         case ICMP_REDIR_HOST:
 741         case ICMP_REDIR_HOSTTOS:
 742                 break;
 743
 744         default:
 745                 return;
 746         }
 747
 748         if (rt->rt_gateway != old_gw)
 749                 return;
 750
 751         in_dev = __in_dev_get_rcu(dev);
 752         if (!in_dev)
 753                 return;
 754
 755         net = dev_net(dev);
 756         if (new_gw == old_gw || !IN_DEV_RX_REDIRECTS(in_dev) ||
 757             ipv4_is_multicast(new_gw) || ipv4_is_lbcast(new_gw) ||
 758             ipv4_is_zeronet(new_gw))
 759                 goto reject_redirect;
 760
 761         if (!IN_DEV_SHARED_MEDIA(in_dev)) {
 762                 if (!inet_addr_onlink(in_dev, new_gw, old_gw))
 763                         goto reject_redirect;
 764                 if (IN_DEV_SEC_REDIRECTS(in_dev) && ip_fib_check_default(new_gw, dev))
 765                         goto reject_redirect;
 766         } else {
 767                 if (inet_addr_type(net, new_gw) != RTN_UNICAST)
 768                         goto reject_redirect;
 769         }
 770
 771         n = __ipv4_neigh_lookup(rt->dst.dev, new_gw);
 772         if (!n)
 773                 n = neigh_create(&arp_tbl, &new_gw, rt->dst.dev);
 774         if (!IS_ERR(n)) {
 775                 if (!(n->nud_state & NUD_VALID)) {
 776                         neigh_event_send(n, NULL);
 777                 } else {
 778                         if (fib_lookup(net, fl4, &res, 0) == 0) {
 779                                 struct fib_nh *nh = &FIB_RES_NH(res);
 780
 781                                 update_or_create_fnhe(nh, fl4->daddr, new_gw,
 782                                                 0, false,
 783                                                 jiffies + ip_rt_gc_timeout);
 784                         }
 785                         if (kill_route)
 786                                 rt->dst.obsolete = DST_OBSOLETE_KILL;
 787                         call_netevent_notifiers(NETEVENT_NEIGH_UPDATE, n);
 788                 }
 789                 neigh_release(n);
 790         }
 791         return;
 792
 793 reject_redirect:
 794 #ifdef CONFIG_IP_ROUTE_VERBOSE
 795         if (IN_DEV_LOG_MARTIANS(in_dev)) {
 796                 const struct iphdr *iph = (const struct iphdr *) skb->data;
 797                 __be32 daddr = iph->daddr;
 798                 __be32 saddr = iph->saddr;
 799
 800                 net_info_ratelimited("Redirect from %pI4 on %s about %pI4 ignored\n"
 801                                      "  Advised path = %pI4 -> %pI4\n",
 802                                      &old_gw, dev->name, &new_gw,
 803                                      &saddr, &daddr);
 804         }
 805 #endif
 806         ;
 807 }
 808
 809 static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buff *skb)
 810 {
 811         struct rtable *rt;
 812         struct flowi4 fl4;
 813         const struct iphdr *iph = (const struct iphdr *) skb->data;
 814         struct net *net = dev_net(skb->dev);
 815         int oif = skb->dev->ifindex;
 816         u8 tos = RT_TOS(iph->tos);
 817         u8 prot = iph->protocol;
 818         u32 mark = skb->mark;
 819
 820         rt = (struct rtable *) dst;
 821
 822         __build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0);
 823         __ip_do_redirect(rt, skb, &fl4, true);
 824 }
 825
 826 static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
 827 {
 828         struct rtable *rt = (struct rtable *)dst;
 829         struct dst_entry *ret = dst;
 830
 831         if (rt) {
 832                 if (dst->obsolete > 0) {
 833                         ip_rt_put(rt);
 834                         ret = NULL;
 835                 } else if ((rt->rt_flags & RTCF_REDIRECTED) ||
 836                            rt->dst.expires) {
 837                         ip_rt_put(rt);
 838                         ret = NULL;
 839                 }
 840         }
 841         return ret;
 842 }
 843
 844 /*
 845  * Algorithm:
 846  *      1. The first ip_rt_redirect_number redirects are sent
 847  *         with exponential backoff, then we stop sending them at all,
 848  *         assuming that the host ignores our redirects.
 849  *      2. If we did not see packets requiring redirects
 850  *         during ip_rt_redirect_silence, we assume that the host
 851  *         forgot redirected route and start to send redirects again.
 852  *
 853  * This algorithm is much cheaper and more intelligent than dumb load limiting
 854  * in icmp.c.
 855  *
 856  * NOTE. Do not forget to inhibit load limiting for redirects (redundant)
 857  * and "frag. need" (breaks PMTU discovery) in icmp.c.
 858  */
 859
 860 void ip_rt_send_redirect(struct sk_buff *skb)
 861 {
 862         struct rtable *rt = skb_rtable(skb);
 863         struct in_device *in_dev;
 864         struct inet_peer *peer;
 865         struct net *net;
 866         int log_martians;
 867         int vif;
 868
 869         rcu_read_lock();
 870         in_dev = __in_dev_get_rcu(rt->dst.dev);
 871         if (!in_dev || !IN_DEV_TX_REDIRECTS(in_dev)) {
 872                 rcu_read_unlock();
 873                 return;
 874         }
 875         log_martians = IN_DEV_LOG_MARTIANS(in_dev);
 876         vif = l3mdev_master_ifindex_rcu(rt->dst.dev);
 877         rcu_read_unlock();
 878
 879         net = dev_net(rt->dst.dev);
 880         peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr, vif, 1);
 881         if (!peer) {
 882                 icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST,
 883                           rt_nexthop(rt, ip_hdr(skb)->daddr));
 884                 return;
 885         }
 886
 887         /* No redirected packets during ip_rt_redirect_silence;
 888          * reset the algorithm.
 889          */
 890         if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
 891                 peer->rate_tokens = 0;
 892                 peer->n_redirects = 0;
 893         }
 894
 895         /* Too many ignored redirects; do not send anything
 896          * set dst.rate_last to the last seen redirected packet.
 897          */
 898         if (peer->n_redirects >= ip_rt_redirect_number) {
 899                 peer->rate_last = jiffies;
 900                 goto out_put_peer;
 901         }
 902
 903         /* Check for load limit; set rate_last to the latest sent
 904          * redirect.
 905          */
 906         if (peer->rate_tokens == 0 ||
 907             time_after(jiffies,
 908                        (peer->rate_last +
 909                         (ip_rt_redirect_load << peer->rate_tokens)))) {
 910                 __be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
 911
 912                 icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
 913                 peer->rate_last = jiffies;
 914                 ++peer->rate_tokens;
 915                 ++peer->n_redirects;
 916 #ifdef CONFIG_IP_ROUTE_VERBOSE
 917                 if (log_martians &&
 918                     peer->rate_tokens == ip_rt_redirect_number)
 919                         net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
 920                                              &ip_hdr(skb)->saddr, inet_iif(skb),
 921                                              &ip_hdr(skb)->daddr, &gw);
 922 #endif
 923         }
 924 out_put_peer:
 925         inet_putpeer(peer);
 926 }
 927
 928 static int ip_error(struct sk_buff *skb)
 929 {
 930         struct rtable *rt = skb_rtable(skb);
 931         struct net_device *dev = skb->dev;
 932         struct in_device *in_dev;
 933         struct inet_peer *peer;
 934         unsigned long now;
 935         struct net *net;
 936         bool send;
 937         int code;
 938
 939         if (netif_is_l3_master(skb->dev)) {
 940                 dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
 941                 if (!dev)
 942                         goto out;
 943         }
 944
 945         in_dev = __in_dev_get_rcu(dev);
 946
 947         /* IP on this device is disabled. */
 948         if (!in_dev)
 949                 goto out;
 950
 951         net = dev_net(rt->dst.dev);
 952         if (!IN_DEV_FORWARD(in_dev)) {
 953                 switch (rt->dst.error) {
 954                 case EHOSTUNREACH:
 955                         __IP_INC_STATS(net, IPSTATS_MIB_INADDRERRORS);
 956                         break;
 957
 958                 case ENETUNREACH:
 959                         __IP_INC_STATS(net, IPSTATS_MIB_INNOROUTES);
 960                         break;
 961                 }
 962                 goto out;
 963         }
 964
 965         switch (rt->dst.error) {
 966         case EINVAL:
 967         default:
 968                 goto out;
 969         case EHOSTUNREACH:
 970                 code = ICMP_HOST_UNREACH;
 971                 break;
 972         case ENETUNREACH:
 973                 code = ICMP_NET_UNREACH;
 974                 __IP_INC_STATS(net, IPSTATS_MIB_INNOROUTES);
 975                 break;
 976         case EACCES:
 977                 code = ICMP_PKT_FILTERED;
 978                 break;
 979         }
 980
 981         peer = inet_getpeer_v4(net->ipv4.peers, ip_hdr(skb)->saddr,
 982                                l3mdev_master_ifindex(skb->dev), 1);
 983
 984         send = true;
 985         if (peer) {
 986                 now = jiffies;
 987                 peer->rate_tokens += now - peer->rate_last;
 988                 if (peer->rate_tokens > ip_rt_error_burst)
 989                         peer->rate_tokens = ip_rt_error_burst;
 990                 peer->rate_last = now;
 991                 if (peer->rate_tokens >= ip_rt_error_cost)
 992                         peer->rate_tokens -= ip_rt_error_cost;
 993                 else
 994                         send = false;
 995                 inet_putpeer(peer);
 996         }
 997         if (send)
 998                 icmp_send(skb, ICMP_DEST_UNREACH, code, 0);
 999
1000 out:    kfree_skb(skb);
1001         return 0;
1002 }
1003
1004 static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
1005 {
1006         struct dst_entry *dst = &rt->dst;
1007         u32 old_mtu = ipv4_mtu(dst);
1008         struct fib_result res;
1009         bool lock = false;
1010
1011         if (ip_mtu_locked(dst))
1012                 return;
1013
1014         if (old_mtu < mtu)
1015                 return;
1016
1017         if (mtu < ip_rt_min_pmtu) {
1018                 lock = true;
1019                 mtu = min(old_mtu, ip_rt_min_pmtu);
1020         }
1021
1022         if (rt->rt_pmtu == mtu && !lock &&
1023             time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2))
1024                 return;
1025
1026         rcu_read_lock();
1027         if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) {
1028                 struct fib_nh *nh = &FIB_RES_NH(res);
1029
1030                 update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock,
1031                                       jiffies + ip_rt_mtu_expires);
1032         }
1033         rcu_read_unlock();
1034 }
1035
1036 static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
1037                               struct sk_buff *skb, u32 mtu)
1038 {
1039         struct rtable *rt = (struct rtable *) dst;
1040         struct flowi4 fl4;
1041
1042         ip_rt_build_flow_key(&fl4, sk, skb);
1043         __ip_rt_update_pmtu(rt, &fl4, mtu);
1044 }
1045
1046 void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
1047                       int oif, u8 protocol)
1048 {
1049         const struct iphdr *iph = (const struct iphdr *) skb->data;
1050         struct flowi4 fl4;
1051         struct rtable *rt;
1052         u32 mark = IP4_REPLY_MARK(net, skb->mark);
1053
1054         __build_flow_key(net, &fl4, NULL, iph, oif,
1055                          RT_TOS(iph->tos), protocol, mark, 0);
1056         rt = __ip_route_output_key(net, &fl4);
1057         if (!IS_ERR(rt)) {
1058                 __ip_rt_update_pmtu(rt, &fl4, mtu);
1059                 ip_rt_put(rt);
1060         }
1061 }
1062 EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
1063
1064 static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1065 {
1066         const struct iphdr *iph = (const struct iphdr *) skb->data;
1067         struct flowi4 fl4;
1068         struct rtable *rt;
1069
1070         __build_flow_key(sock_net(sk), &fl4, sk, iph, 0, 0, 0, 0, 0);
1071
1072         if (!fl4.flowi4_mark)
1073                 fl4.flowi4_mark = IP4_REPLY_MARK(sock_net(sk), skb->mark);
1074
1075         rt = __ip_route_output_key(sock_net(sk), &fl4);
1076         if (!IS_ERR(rt)) {
1077                 __ip_rt_update_pmtu(rt, &fl4, mtu);
1078                 ip_rt_put(rt);
1079         }
1080 }
1081
1082 void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
1083 {
1084         const struct iphdr *iph = (const struct iphdr *) skb->data;
1085         struct flowi4 fl4;
1086         struct rtable *rt;
1087         struct dst_entry *odst = NULL;
1088         bool new = false;
1089         struct net *net = sock_net(sk);
1090
1091         bh_lock_sock(sk);
1092
1093         if (!ip_sk_accept_pmtu(sk))
1094                 goto out;
1095
1096         odst = sk_dst_get(sk);
1097
1098         if (sock_owned_by_user(sk) || !odst) {
1099                 __ipv4_sk_update_pmtu(skb, sk, mtu);
1100                 goto out;
1101         }
1102
1103         __build_flow_key(net, &fl4, sk, iph, 0, 0, 0, 0, 0);
1104
1105         rt = (struct rtable *)odst;
1106         if (odst->obsolete && !odst->ops->check(odst, 0)) {
1107                 rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1108                 if (IS_ERR(rt))
1109                         goto out;
1110
1111                 new = true;
1112         }
1113
1114         __ip_rt_update_pmtu((struct rtable *) xfrm_dst_path(&rt->dst), &fl4, mtu);
1115
1116         if (!dst_check(&rt->dst, 0)) {
1117                 if (new)
1118                         dst_release(&rt->dst);
1119
1120                 rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1121                 if (IS_ERR(rt))
1122                         goto out;
1123
1124                 new = true;
1125         }
1126
1127         if (new)
1128                 sk_dst_set(sk, &rt->dst);
1129
1130 out:
1131         bh_unlock_sock(sk);
1132         dst_release(odst);
1133 }
1134 EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
1135
1136 void ipv4_redirect(struct sk_buff *skb, struct net *net,
1137                    int oif, u8 protocol)
1138 {
1139         const struct iphdr *iph = (const struct iphdr *) skb->data;
1140         struct flowi4 fl4;
1141         struct rtable *rt;
1142
1143         __build_flow_key(net, &fl4, NULL, iph, oif,
1144                          RT_TOS(iph->tos), protocol, 0, 0);
1145         rt = __ip_route_output_key(net, &fl4);
1146         if (!IS_ERR(rt)) {
1147                 __ip_do_redirect(rt, skb, &fl4, false);
1148                 ip_rt_put(rt);
1149         }
1150 }
1151 EXPORT_SYMBOL_GPL(ipv4_redirect);
1152
1153 void ipv4_sk_redirect(struct sk_buff *skb, struct sock *sk)
1154 {
1155         const struct iphdr *iph = (const struct iphdr *) skb->data;
1156         struct flowi4 fl4;
1157         struct rtable *rt;
1158         struct net *net = sock_net(sk);
1159
1160         __build_flow_key(net, &fl4, sk, iph, 0, 0, 0, 0, 0);
1161         rt = __ip_route_output_key(net, &fl4);
1162         if (!IS_ERR(rt)) {
1163                 __ip_do_redirect(rt, skb, &fl4, false);
1164                 ip_rt_put(rt);
1165         }
1166 }
1167 EXPORT_SYMBOL_GPL(ipv4_sk_redirect);
1168
1169 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
1170 {
1171         struct rtable *rt = (struct rtable *) dst;
1172
1173         /* All IPV4 dsts are created with ->obsolete set to the value
1174          * DST_OBSOLETE_FORCE_CHK which forces validation calls down
1175          * into this function always.
1176          *
1177          * When a PMTU/redirect information update invalidates a route,
1178          * this is indicated by setting obsolete to DST_OBSOLETE_KILL or
1179          * DST_OBSOLETE_DEAD by dst_free().
1180          */
1181         if (dst->obsolete != DST_OBSOLETE_FORCE_CHK || rt_is_expired(rt))
1182                 return NULL;
1183         return dst;
1184 }
1185
1186 static void ipv4_link_failure(struct sk_buff *skb)
1187 {
1188         struct ip_options opt;
1189         struct rtable *rt;
1190         int res;
1191
1192         /* Recompile ip options since IPCB may not be valid anymore.
1193          */
1194         memset(&opt, 0, sizeof(opt));
1195         opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
1196
1197         rcu_read_lock();
1198         res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
1199         rcu_read_unlock();
1200
1201         if (res)
1202                 return;
1203
1204         __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
1205
1206         rt = skb_rtable(skb);
1207         if (rt)
1208                 dst_set_expires(&rt->dst, 0);
1209 }
1210
1211 static int ip_rt_bug(struct net *net, struct sock *sk, struct sk_buff *skb)
1212 {
1213         pr_debug("%s: %pI4 -> %pI4, %s\n",
1214                  __func__, &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
1215                  skb->dev ? skb->dev->name : "?");
1216         kfree_skb(skb);
1217         WARN_ON(1);
1218         return 0;
1219 }
1220
1221 /*
1222    We do not cache source address of outgoing interface,
1223    because it is used only by IP RR, TS and SRR options,
1224    so that it out of fast path.
1225
1226    BTW remember: "addr" is allowed to be not aligned
1227    in IP options!
1228  */
1229
1230 void ip_rt_get_source(u8 *addr, struct sk_buff *skb, struct rtable *rt)
1231 {
1232         __be32 src;
1233
1234         if (rt_is_output_route(rt))
1235                 src = ip_hdr(skb)->saddr;
1236         else {
1237                 struct fib_result res;
1238                 struct iphdr *iph = ip_hdr(skb);
1239                 struct flowi4 fl4 = {
1240                         .daddr = iph->daddr,
1241                         .saddr = iph->saddr,
1242                         .flowi4_tos = RT_TOS(iph->tos),
1243                         .flowi4_oif = rt->dst.dev->ifindex,
1244                         .flowi4_iif = skb->dev->ifindex,
1245                         .flowi4_mark = skb->mark,
1246                 };
1247
1248                 rcu_read_lock();
1249                 if (fib_lookup(dev_net(rt->dst.dev), &fl4, &res, 0) == 0)
1250                         src = FIB_RES_PREFSRC(dev_net(rt->dst.dev), res);
1251                 else
1252                         src = inet_select_addr(rt->dst.dev,
1253                                                rt_nexthop(rt, iph->daddr),
1254                                                RT_SCOPE_UNIVERSE);
1255                 rcu_read_unlock();
1256         }
1257         memcpy(addr, &src, 4);
1258 }
1259
1260 #ifdef CONFIG_IP_ROUTE_CLASSID
1261 static void set_class_tag(struct rtable *rt, u32 tag)
1262 {
1263         if (!(rt->dst.tclassid & 0xFFFF))
1264                 rt->dst.tclassid |= tag & 0xFFFF;
1265         if (!(rt->dst.tclassid & 0xFFFF0000))
1266                 rt->dst.tclassid |= tag & 0xFFFF0000;
1267 }
1268 #endif
1269
1270 static unsigned int ipv4_default_advmss(const struct dst_entry *dst)
1271 {
1272         unsigned int header_size = sizeof(struct tcphdr) + sizeof(struct iphdr);
1273         unsigned int advmss = max_t(unsigned int, ipv4_mtu(dst) - header_size,
1274                                     ip_rt_min_advmss);
1275
1276         return min(advmss, IPV4_MAX_PMTU - header_size);
1277 }
1278
1279 static unsigned int ipv4_mtu(const struct dst_entry *dst)
1280 {
1281         const struct rtable *rt = (const struct rtable *) dst;
1282         unsigned int mtu = rt->rt_pmtu;
1283
1284         if (!mtu || time_after_eq(jiffies, rt->dst.expires))
1285                 mtu = dst_metric_raw(dst, RTAX_MTU);
1286
1287         if (mtu)
1288                 return mtu;
1289
1290         mtu = READ_ONCE(dst->dev->mtu);
1291
1292         if (unlikely(ip_mtu_locked(dst))) {
1293                 if (rt->rt_uses_gateway && mtu > 576)
1294                         mtu = 576;
1295         }
1296
1297         mtu = min_t(unsigned int, mtu, IP_MAX_MTU);
1298
1299         return mtu - lwtunnel_headroom(dst->lwtstate, mtu);
1300 }
1301
1302 static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
1303 {
1304         struct fnhe_hash_bucket *hash;
1305         struct fib_nh_exception *fnhe, __rcu **fnhe_p;
1306         u32 hval = fnhe_hashfun(daddr);
1307
1308         spin_lock_bh(&fnhe_lock);
1309
1310         hash = rcu_dereference_protected(nh->nh_exceptions,
1311                                          lockdep_is_held(&fnhe_lock));
1312         hash += hval;
1313
1314         fnhe_p = &hash->chain;
1315         fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
1316         while (fnhe) {
1317                 if (fnhe->fnhe_daddr == daddr) {
1318                         rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
1319                                 fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
1320                         /* set fnhe_daddr to 0 to ensure it won't bind with
1321                          * new dsts in rt_bind_exception().
1322                          */
1323                         fnhe->fnhe_daddr = 0;
1324                         fnhe_flush_routes(fnhe);
1325                         kfree_rcu(fnhe, rcu);
1326                         break;
1327                 }
1328                 fnhe_p = &fnhe->fnhe_next;
1329                 fnhe = rcu_dereference_protected(fnhe->fnhe_next,
1330                                                  lockdep_is_held(&fnhe_lock));
1331         }
1332
1333         spin_unlock_bh(&fnhe_lock);
1334 }
1335
1336 static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr)
1337 {
1338         struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions);
1339         struct fib_nh_exception *fnhe;
1340         u32 hval;
1341
1342         if (!hash)
1343                 return NULL;
1344
1345         hval = fnhe_hashfun(daddr);
1346
1347         for (fnhe = rcu_dereference(hash[hval].chain); fnhe;
1348              fnhe = rcu_dereference(fnhe->fnhe_next)) {
1349                 if (fnhe->fnhe_daddr == daddr) {
1350                         if (fnhe->fnhe_expires &&
1351                             time_after(jiffies, fnhe->fnhe_expires)) {
1352                                 ip_del_fnhe(nh, daddr);
1353                                 break;
1354                         }
1355                         return fnhe;
1356                 }
1357         }
1358         return NULL;
1359 }
1360
1361 /* MTU selection:
1362  * 1. mtu on route is locked - use it
1363  * 2. mtu from nexthop exception
1364  * 3. mtu from egress device
1365  */
1366
1367 u32 ip_mtu_from_fib_result(struct fib_result *res, __be32 daddr)
1368 {
1369         struct fib_info *fi = res->fi;
1370         struct fib_nh *nh = &fi->fib_nh[res->nh_sel];
1371         struct net_device *dev = nh->nh_dev;
1372         u32 mtu = 0;
1373
1374         if (dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu ||
1375             fi->fib_metrics->metrics[RTAX_LOCK - 1] & (1 << RTAX_MTU))
1376                 mtu = fi->fib_mtu;
1377
1378         if (likely(!mtu)) {
1379                 struct fib_nh_exception *fnhe;
1380
1381                 fnhe = find_exception(nh, daddr);
1382                 if (fnhe && !time_after_eq(jiffies, fnhe->fnhe_expires))
1383                         mtu = fnhe->fnhe_pmtu;
1384         }
1385
1386         if (likely(!mtu))
1387                 mtu = min(READ_ONCE(dev->mtu), IP_MAX_MTU);
1388
1389         return mtu - lwtunnel_headroom(nh->nh_lwtstate, mtu);
1390 }
1391
1392 static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
1393                               __be32 daddr, const bool do_cache)
1394 {
1395         bool ret = false;
1396
1397         spin_lock_bh(&fnhe_lock);
1398
1399         if (daddr == fnhe->fnhe_daddr) {
1400                 struct rtable __rcu **porig;
1401                 struct rtable *orig;
1402                 int genid = fnhe_genid(dev_net(rt->dst.dev));
1403
1404                 if (rt_is_input_route(rt))
1405                         porig = &fnhe->fnhe_rth_input;
1406                 else
1407                         porig = &fnhe->fnhe_rth_output;
1408                 orig = rcu_dereference(*porig);
1409
1410                 if (fnhe->fnhe_genid != genid) {
1411                         fnhe->fnhe_genid = genid;
1412                         fnhe->fnhe_gw = 0;
1413                         fnhe->fnhe_pmtu = 0;
1414                         fnhe->fnhe_expires = 0;
1415                         fnhe->fnhe_mtu_locked = false;
1416                         fnhe_flush_routes(fnhe);
1417                         orig = NULL;
1418                 }
1419                 fill_route_from_fnhe(rt, fnhe);
1420                 if (!rt->rt_gateway)
1421                         rt->rt_gateway = daddr;
1422
1423                 if (do_cache) {
1424                         dst_hold(&rt->dst);
1425                         rcu_assign_pointer(*porig, rt);
1426                         if (orig) {
1427                                 dst_dev_put(&orig->dst);
1428                                 dst_release(&orig->dst);
1429                         }
1430                         ret = true;
1431                 }
1432
1433                 fnhe->fnhe_stamp = jiffies;
1434         }
1435         spin_unlock_bh(&fnhe_lock);
1436
1437         return ret;
1438 }
1439
1440 static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
1441 {
1442         struct rtable *orig, *prev, **p;
1443         bool ret = true;
1444
1445         if (rt_is_input_route(rt)) {
1446                 p = (struct rtable **)&nh->nh_rth_input;
1447         } else {
1448                 p = (struct rtable **)raw_cpu_ptr(nh->nh_pcpu_rth_output);
1449         }
1450         orig = *p;
1451
1452         /* hold dst before doing cmpxchg() to avoid race condition
1453          * on this dst
1454          */
1455         dst_hold(&rt->dst);
1456         prev = cmpxchg(p, orig, rt);
1457         if (prev == orig) {
1458                 if (orig) {
1459                         dst_dev_put(&orig->dst);
1460                         dst_release(&orig->dst);
1461                 }
1462         } else {
1463                 dst_release(&rt->dst);
1464                 ret = false;
1465         }
1466
1467         return ret;
1468 }
1469
1470 struct uncached_list {
1471         spinlock_t              lock;
1472         struct list_head        head;
1473 };
1474
1475 static DEFINE_PER_CPU_ALIGNED(struct uncached_list, rt_uncached_list);
1476
1477 void rt_add_uncached_list(struct rtable *rt)
1478 {
1479         struct uncached_list *ul = raw_cpu_ptr(&rt_uncached_list);
1480
1481         rt->rt_uncached_list = ul;
1482
1483         spin_lock_bh(&ul->lock);
1484         list_add_tail(&rt->rt_uncached, &ul->head);
1485         spin_unlock_bh(&ul->lock);
1486 }
1487
1488 void rt_del_uncached_list(struct rtable *rt)
1489 {
1490         if (!list_empty(&rt->rt_uncached)) {
1491                 struct uncached_list *ul = rt->rt_uncached_list;
1492
1493                 spin_lock_bh(&ul->lock);
1494                 list_del(&rt->rt_uncached);
1495                 spin_unlock_bh(&ul->lock);
1496         }
1497 }
1498
1499 static void ipv4_dst_destroy(struct dst_entry *dst)
1500 {
1501         struct rtable *rt = (struct rtable *)dst;
1502
1503         ip_dst_metrics_put(dst);
1504         rt_del_uncached_list(rt);
1505 }
1506
1507 void rt_flush_dev(struct net_device *dev)
1508 {
1509         struct net *net = dev_net(dev);
1510         struct rtable *rt;
1511         int cpu;
1512
1513         for_each_possible_cpu(cpu) {
1514                 struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
1515
1516                 spin_lock_bh(&ul->lock);
1517                 list_for_each_entry(rt, &ul->head, rt_uncached) {
1518                         if (rt->dst.dev != dev)
1519                                 continue;
1520                         rt->dst.dev = net->loopback_dev;
1521                         dev_hold(rt->dst.dev);
1522                         dev_put(dev);
1523                 }
1524                 spin_unlock_bh(&ul->lock);
1525         }
1526 }
1527
1528 static bool rt_cache_valid(const struct rtable *rt)
1529 {
1530         return  rt &&
1531                 rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
1532                 !rt_is_expired(rt);
1533 }
1534
1535 static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
1536                            const struct fib_result *res,
1537                            struct fib_nh_exception *fnhe,
1538                            struct fib_info *fi, u16 type, u32 itag,
1539                            const bool do_cache)
1540 {
1541         bool cached = false;
1542
1543         if (fi) {
1544                 struct fib_nh *nh = &FIB_RES_NH(*res);
1545
1546                 if (nh->nh_gw && nh->nh_scope == RT_SCOPE_LINK) {
1547                         rt->rt_gateway = nh->nh_gw;
1548                         rt->rt_uses_gateway = 1;
1549                 }
1550                 ip_dst_init_metrics(&rt->dst, fi->fib_metrics);
1551
1552 #ifdef CONFIG_IP_ROUTE_CLASSID
1553                 rt->dst.tclassid = nh->nh_tclassid;
1554 #endif
1555                 rt->dst.lwtstate = lwtstate_get(nh->nh_lwtstate);
1556                 if (unlikely(fnhe))
1557                         cached = rt_bind_exception(rt, fnhe, daddr, do_cache);
1558                 else if (do_cache)
1559                         cached = rt_cache_route(nh, rt);
1560                 if (unlikely(!cached)) {
1561                         /* Routes we intend to cache in nexthop exception or
1562                          * FIB nexthop have the DST_NOCACHE bit clear.
1563                          * However, if we are unsuccessful at storing this
1564                          * route into the cache we really need to set it.
1565                          */
1566                         if (!rt->rt_gateway)
1567                                 rt->rt_gateway = daddr;
1568                         rt_add_uncached_list(rt);
1569                 }
1570         } else
1571                 rt_add_uncached_list(rt);
1572
1573 #ifdef CONFIG_IP_ROUTE_CLASSID
1574 #ifdef CONFIG_IP_MULTIPLE_TABLES
1575         set_class_tag(rt, res->tclassid);
1576 #endif
1577         set_class_tag(rt, itag);
1578 #endif
1579 }
1580
1581 struct rtable *rt_dst_alloc(struct net_device *dev,
1582                             unsigned int flags, u16 type,
1583                             bool nopolicy, bool noxfrm, bool will_cache)
1584 {
1585         struct rtable *rt;
1586
1587         rt = dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
1588                        (will_cache ? 0 : DST_HOST) |
1589                        (nopolicy ? DST_NOPOLICY : 0) |
1590                        (noxfrm ? DST_NOXFRM : 0));
1591
1592         if (rt) {
1593                 rt->rt_genid = rt_genid_ipv4(dev_net(dev));
1594                 rt->rt_flags = flags;
1595                 rt->rt_type = type;
1596                 rt->rt_is_input = 0;
1597                 rt->rt_iif = 0;
1598                 rt->rt_pmtu = 0;
1599                 rt->rt_mtu_locked = 0;
1600                 rt->rt_gateway = 0;
1601                 rt->rt_uses_gateway = 0;
1602                 INIT_LIST_HEAD(&rt->rt_uncached);
1603
1604                 rt->dst.output = ip_output;
1605                 if (flags & RTCF_LOCAL)
1606                         rt->dst.input = ip_local_deliver;
1607         }
1608
1609         return rt;
1610 }
1611 EXPORT_SYMBOL(rt_dst_alloc);
1612
1613 /* called in rcu_read_lock() section */
1614 int ip_mc_validate_source(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1615                           u8 tos, struct net_device *dev,
1616                           struct in_device *in_dev, u32 *itag)
1617 {
1618         int err;
1619
1620         /* Primary sanity checks. */
1621         if (!in_dev)
1622                 return -EINVAL;
1623
1624         if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr) ||
1625             skb->protocol != htons(ETH_P_IP))
1626                 return -EINVAL;
1627
1628         if (ipv4_is_loopback(saddr) && !IN_DEV_ROUTE_LOCALNET(in_dev))
1629                 return -EINVAL;
1630
1631         if (ipv4_is_zeronet(saddr)) {
1632                 if (!ipv4_is_local_multicast(daddr) &&
1633                     ip_hdr(skb)->protocol != IPPROTO_IGMP)
1634                         return -EINVAL;
1635         } else {
1636                 err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
1637                                           in_dev, itag);
1638                 if (err < 0)
1639                         return err;
1640         }
1641         return 0;
1642 }
1643
1644 /* called in rcu_read_lock() section */
1645 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1646                              u8 tos, struct net_device *dev, int our)
1647 {
1648         struct in_device *in_dev = __in_dev_get_rcu(dev);
1649         unsigned int flags = RTCF_MULTICAST;
1650         struct rtable *rth;
1651         u32 itag = 0;
1652         int err;
1653
1654         err = ip_mc_validate_source(skb, daddr, saddr, tos, dev, in_dev, &itag);
1655         if (err)
1656                 return err;
1657
1658         if (our)
1659                 flags |= RTCF_LOCAL;
1660
1661         rth = rt_dst_alloc(dev_net(dev)->loopback_dev, flags, RTN_MULTICAST,
1662                            IN_DEV_CONF_GET(in_dev, NOPOLICY), false, false);
1663         if (!rth)
1664                 return -ENOBUFS;
1665
1666 #ifdef CONFIG_IP_ROUTE_CLASSID
1667         rth->dst.tclassid = itag;
1668 #endif
1669         rth->dst.output = ip_rt_bug;
1670         rth->rt_is_input= 1;
1671
1672 #ifdef CONFIG_IP_MROUTE
1673         if (!ipv4_is_local_multicast(daddr) && IN_DEV_MFORWARD(in_dev))
1674                 rth->dst.input = ip_mr_input;
1675 #endif
1676         RT_CACHE_STAT_INC(in_slow_mc);
1677
1678         skb_dst_set(skb, &rth->dst);
1679         return 0;
1680 }
1681
1682
1683 static void ip_handle_martian_source(struct net_device *dev,
1684                                      struct in_device *in_dev,
1685                                      struct sk_buff *skb,
1686                                      __be32 daddr,
1687                                      __be32 saddr)
1688 {
1689         RT_CACHE_STAT_INC(in_martian_src);
1690 #ifdef CONFIG_IP_ROUTE_VERBOSE
1691         if (IN_DEV_LOG_MARTIANS(in_dev) && net_ratelimit()) {
1692                 /*
1693                  *      RFC1812 recommendation, if source is martian,
1694                  *      the only hint is MAC header.
1695                  */
1696                 pr_warn("martian source %pI4 from %pI4, on dev %s\n",
1697                         &daddr, &saddr, dev->name);
1698                 if (dev->hard_header_len && skb_mac_header_was_set(skb)) {
1699                         print_hex_dump(KERN_WARNING, "ll header: ",
1700                                        DUMP_PREFIX_OFFSET, 16, 1,
1701                                        skb_mac_header(skb),
1702                                        dev->hard_header_len, false);
1703                 }
1704         }
1705 #endif
1706 }
1707
1708 /* called in rcu_read_lock() section */
1709 static int __mkroute_input(struct sk_buff *skb,
1710                            const struct fib_result *res,
1711                            struct in_device *in_dev,
1712                            __be32 daddr, __be32 saddr, u32 tos)
1713 {
1714         struct fib_nh_exception *fnhe;
1715         struct rtable *rth;
1716         int err;
1717         struct in_device *out_dev;
1718         bool do_cache;
1719         u32 itag = 0;
1720
1721         /* get a working reference to the output device */
1722         out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
1723         if (!out_dev) {
1724                 net_crit_ratelimited("Bug in ip_route_input_slow(). Please report.\n");
1725                 return -EINVAL;
1726         }
1727
1728         err = fib_validate_source(skb, saddr, daddr, tos, FIB_RES_OIF(*res),
1729                                   in_dev->dev, in_dev, &itag);
1730         if (err < 0) {
1731                 ip_handle_martian_source(in_dev->dev, in_dev, skb, daddr,
1732                                          saddr);
1733
1734                 goto cleanup;
1735         }
1736
1737         do_cache = res->fi && !itag;
1738         if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
1739             skb->protocol == htons(ETH_P_IP) &&
1740             (IN_DEV_SHARED_MEDIA(out_dev) ||
1741              inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
1742                 IPCB(skb)->flags |= IPSKB_DOREDIRECT;
1743
1744         if (skb->protocol != htons(ETH_P_IP)) {
1745                 /* Not IP (i.e. ARP). Do not create route, if it is
1746                  * invalid for proxy arp. DNAT routes are always valid.
1747                  *
1748                  * Proxy arp feature have been extended to allow, ARP
1749                  * replies back to the same interface, to support
1750                  * Private VLAN switch technologies. See arp.c.
1751                  */
1752                 if (out_dev == in_dev &&
1753                     IN_DEV_PROXY_ARP_PVLAN(in_dev) == 0) {
1754                         err = -EINVAL;
1755                         goto cleanup;
1756                 }
1757         }
1758
1759         fnhe = find_exception(&FIB_RES_NH(*res), daddr);
1760         if (do_cache) {
1761                 if (fnhe)
1762                         rth = rcu_dereference(fnhe->fnhe_rth_input);
1763                 else
1764                         rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
1765                 if (rt_cache_valid(rth)) {
1766                         skb_dst_set_noref(skb, &rth->dst);
1767                         goto out;
1768                 }
1769         }
1770
1771         rth = rt_dst_alloc(out_dev->dev, 0, res->type,
1772                            IN_DEV_CONF_GET(in_dev, NOPOLICY),
1773                            IN_DEV_CONF_GET(out_dev, NOXFRM), do_cache);
1774         if (!rth) {
1775                 err = -ENOBUFS;
1776                 goto cleanup;
1777         }
1778
1779         rth->rt_is_input = 1;
1780         RT_CACHE_STAT_INC(in_slow_tot);
1781
1782         rth->dst.input = ip_forward;
1783
1784         rt_set_nexthop(rth, daddr, res, fnhe, res->fi, res->type, itag,
1785                        do_cache);
1786         lwtunnel_set_redirect(&rth->dst);
1787         skb_dst_set(skb, &rth->dst);
1788 out:
1789         err = 0;
1790  cleanup:
1791         return err;
1792 }
1793
1794 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1795 /* To make ICMP packets follow the right flow, the multipath hash is
1796  * calculated from the inner IP addresses.
1797  */
1798 static void ip_multipath_l3_keys(const struct sk_buff *skb,
1799                                  struct flow_keys *hash_keys)
1800 {
1801         const struct iphdr *outer_iph = ip_hdr(skb);
1802         const struct iphdr *key_iph = outer_iph;
1803         const struct iphdr *inner_iph;
1804         const struct icmphdr *icmph;
1805         struct iphdr _inner_iph;
1806         struct icmphdr _icmph;
1807
1808         if (likely(outer_iph->protocol != IPPROTO_ICMP))
1809                 goto out;
1810
1811         if (unlikely((outer_iph->frag_off & htons(IP_OFFSET)) != 0))
1812                 goto out;
1813
1814         icmph = skb_header_pointer(skb, outer_iph->ihl * 4, sizeof(_icmph),
1815                                    &_icmph);
1816         if (!icmph)
1817                 goto out;
1818
1819         if (icmph->type != ICMP_DEST_UNREACH &&
1820             icmph->type != ICMP_REDIRECT &&
1821             icmph->type != ICMP_TIME_EXCEEDED &&
1822             icmph->type != ICMP_PARAMETERPROB)
1823                 goto out;
1824
1825         inner_iph = skb_header_pointer(skb,
1826                                        outer_iph->ihl * 4 + sizeof(_icmph),
1827                                        sizeof(_inner_iph), &_inner_iph);
1828         if (!inner_iph)
1829                 goto out;
1830
1831         key_iph = inner_iph;
1832 out:
1833         hash_keys->addrs.v4addrs.src = key_iph->saddr;
1834         hash_keys->addrs.v4addrs.dst = key_iph->daddr;
1835 }
1836
1837 /* if skb is set it will be used and fl4 can be NULL */
1838 int fib_multipath_hash(const struct net *net, const struct flowi4 *fl4,
1839                        const struct sk_buff *skb, struct flow_keys *flkeys)
1840 {
1841         u32 multipath_hash = fl4 ? fl4->flowi4_multipath_hash : 0;
1842         struct flow_keys hash_keys;
1843         u32 mhash;
1844
1845         switch (net->ipv4.sysctl_fib_multipath_hash_policy) {
1846         case 0:
1847                 memset(&hash_keys, 0, sizeof(hash_keys));
1848                 hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
1849                 if (skb) {
1850                         ip_multipath_l3_keys(skb, &hash_keys);
1851                 } else {
1852                         hash_keys.addrs.v4addrs.src = fl4->saddr;
1853                         hash_keys.addrs.v4addrs.dst = fl4->daddr;
1854                 }
1855                 break;
1856         case 1:
1857                 /* skb is currently provided only when forwarding */
1858                 if (skb) {
1859                         unsigned int flag = FLOW_DISSECTOR_F_STOP_AT_ENCAP;
1860                         struct flow_keys keys;
1861
1862                         /* short-circuit if we already have L4 hash present */
1863                         if (skb->l4_hash)
1864                                 return skb_get_hash_raw(skb) >> 1;
1865
1866                         memset(&hash_keys, 0, sizeof(hash_keys));
1867
1868                         if (!flkeys) {
1869                                 skb_flow_dissect_flow_keys(skb, &keys, flag);
1870                                 flkeys = &keys;
1871                         }
1872
1873                         hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
1874                         hash_keys.addrs.v4addrs.src = flkeys->addrs.v4addrs.src;
1875                         hash_keys.addrs.v4addrs.dst = flkeys->addrs.v4addrs.dst;
1876                         hash_keys.ports.src = flkeys->ports.src;
1877                         hash_keys.ports.dst = flkeys->ports.dst;
1878                         hash_keys.basic.ip_proto = flkeys->basic.ip_proto;
1879                 } else {
1880                         memset(&hash_keys, 0, sizeof(hash_keys));
1881                         hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
1882                         hash_keys.addrs.v4addrs.src = fl4->saddr;
1883                         hash_keys.addrs.v4addrs.dst = fl4->daddr;
1884                         hash_keys.ports.src = fl4->fl4_sport;
1885                         hash_keys.ports.dst = fl4->fl4_dport;
1886                         hash_keys.basic.ip_proto = fl4->flowi4_proto;
1887                 }
1888                 break;
1889         }
1890         mhash = flow_hash_from_keys(&hash_keys);
1891
1892         if (multipath_hash)
1893                 mhash = jhash_2words(mhash, multipath_hash, 0);
1894
1895         return mhash >> 1;
1896 }
1897 #endif /* CONFIG_IP_ROUTE_MULTIPATH */
1898
1899 static int ip_mkroute_input(struct sk_buff *skb,
1900                             struct fib_result *res,
1901                             struct in_device *in_dev,
1902                             __be32 daddr, __be32 saddr, u32 tos,
1903                             struct flow_keys *hkeys)
1904 {
1905 #ifdef CONFIG_IP_ROUTE_MULTIPATH
1906         if (res->fi && res->fi->fib_nhs > 1) {
1907                 int h = fib_multipath_hash(res->fi->fib_net, NULL, skb, hkeys);
1908
1909                 fib_select_multipath(res, h);
1910         }
1911 #endif
1912
1913         /* create a routing cache entry */
1914         return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
1915 }
1916
1917 /*
1918  *      NOTE. We drop all the packets that has local source
1919  *      addresses, because every properly looped back packet
1920  *      must have correct destination already attached by output routine.
1921  *
1922  *      Such approach solves two big problems:
1923  *      1. Not simplex devices are handled properly.
1924  *      2. IP spoofing attempts are filtered with 100% of guarantee.
1925  *      called with rcu_read_lock()
1926  */
1927
1928 static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
1929                                u8 tos, struct net_device *dev,
1930                                struct fib_result *res)
1931 {
1932         struct in_device *in_dev = __in_dev_get_rcu(dev);
1933         struct flow_keys *flkeys = NULL, _flkeys;
1934         struct net    *net = dev_net(dev);
1935         struct ip_tunnel_info *tun_info;
1936         int             err = -EINVAL;
1937         unsigned int    flags = 0;
1938         u32             itag = 0;
1939         struct rtable   *rth;
1940         struct flowi4   fl4;
1941         bool do_cache;
1942
1943         /* IP on this device is disabled. */
1944
1945         if (!in_dev)
1946                 goto out;
1947
1948         /* Check for the most weird martians, which can be not detected
1949            by fib_lookup.
1950          */
1951
1952         tun_info = skb_tunnel_info(skb);
1953         if (tun_info && !(tun_info->mode & IP_TUNNEL_INFO_TX))
1954                 fl4.flowi4_tun_key.tun_id = tun_info->key.tun_id;
1955         else
1956                 fl4.flowi4_tun_key.tun_id = 0;
1957         skb_dst_drop(skb);
1958
1959         if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
1960                 goto martian_source;
1961
1962         res->fi = NULL;
1963         res->table = NULL;
1964         if (ipv4_is_lbcast(daddr) || (saddr == 0 && daddr == 0))
1965                 goto brd_input;
1966
1967         /* Accept zero addresses only to limited broadcast;
1968          * I even do not know to fix it or not. Waiting for complains :-)
1969          */
1970         if (ipv4_is_zeronet(saddr))
1971                 goto martian_source;
1972
1973         if (ipv4_is_zeronet(daddr))
1974                 goto martian_destination;
1975
1976         /* Following code try to avoid calling IN_DEV_NET_ROUTE_LOCALNET(),
1977          * and call it once if daddr or/and saddr are loopback addresses
1978          */
1979         if (ipv4_is_loopback(daddr)) {
1980                 if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1981                         goto martian_destination;
1982         } else if (ipv4_is_loopback(saddr)) {
1983                 if (!IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
1984                         goto martian_source;
1985         }
1986
1987         /*
1988          *      Now we are ready to route packet.
1989          */
1990         fl4.flowi4_oif = 0;
1991         fl4.flowi4_iif = dev->ifindex;
1992         fl4.flowi4_mark = skb->mark;
1993         fl4.flowi4_tos = tos;
1994         fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
1995         fl4.flowi4_flags = 0;
1996         fl4.daddr = daddr;
1997         fl4.saddr = saddr;
1998         fl4.flowi4_uid = sock_net_uid(net, NULL);
1999
2000         if (fib4_rules_early_flow_dissect(net, skb, &fl4, &_flkeys)) {
2001                 flkeys = &_flkeys;
2002         } else {
2003                 fl4.flowi4_proto = 0;
2004                 fl4.fl4_sport = 0;
2005                 fl4.fl4_dport = 0;
2006         }
2007
2008         err = fib_lookup(net, &fl4, res, 0);
2009         if (err != 0) {
2010                 if (!IN_DEV_FORWARD(in_dev))
2011                         err = -EHOSTUNREACH;
2012                 goto no_route;
2013         }
2014
2015         if (res->type == RTN_BROADCAST) {
2016                 if (IN_DEV_BFORWARD(in_dev))
2017                         goto make_route;
2018                 goto brd_input;
2019         }
2020
2021         if (res->type == RTN_LOCAL) {
2022                 err = fib_validate_source(skb, saddr, daddr, tos,
2023                                           0, dev, in_dev, &itag);
2024                 if (err < 0)
2025                         goto martian_source;
2026                 goto local_input;
2027         }
2028
2029         if (!IN_DEV_FORWARD(in_dev)) {
2030                 err = -EHOSTUNREACH;
2031                 goto no_route;
2032         }
2033         if (res->type != RTN_UNICAST)
2034                 goto martian_destination;
2035
2036 make_route:
2037         err = ip_mkroute_input(skb, res, in_dev, daddr, saddr, tos, flkeys);
2038 out:    return err;
2039
2040 brd_input:
2041         if (skb->protocol != htons(ETH_P_IP))
2042                 goto e_inval;
2043
2044         if (!ipv4_is_zeronet(saddr)) {
2045                 err = fib_validate_source(skb, saddr, 0, tos, 0, dev,
2046                                           in_dev, &itag);
2047                 if (err < 0)
2048                         goto martian_source;
2049         }
2050         flags |= RTCF_BROADCAST;
2051         res->type = RTN_BROADCAST;
2052         RT_CACHE_STAT_INC(in_brd);
2053
2054 local_input:
2055         do_cache = false;
2056         if (res->fi) {
2057                 if (!itag) {
2058                         rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
2059                         if (rt_cache_valid(rth)) {
2060                                 skb_dst_set_noref(skb, &rth->dst);
2061                                 err = 0;
2062                                 goto out;
2063                         }
2064                         do_cache = true;
2065                 }
2066         }
2067
2068         rth = rt_dst_alloc(l3mdev_master_dev_rcu(dev) ? : net->loopback_dev,
2069                            flags | RTCF_LOCAL, res->type,
2070                            IN_DEV_CONF_GET(in_dev, NOPOLICY), false, do_cache);
2071         if (!rth)
2072                 goto e_nobufs;
2073
2074         rth->dst.output= ip_rt_bug;
2075 #ifdef CONFIG_IP_ROUTE_CLASSID
2076         rth->dst.tclassid = itag;
2077 #endif
2078         rth->rt_is_input = 1;
2079
2080         RT_CACHE_STAT_INC(in_slow_tot);
2081         if (res->type == RTN_UNREACHABLE) {
2082                 rth->dst.input= ip_error;
2083                 rth->dst.error= -err;
2084                 rth->rt_flags   &= ~RTCF_LOCAL;
2085         }
2086
2087         if (do_cache) {
2088                 struct fib_nh *nh = &FIB_RES_NH(*res);
2089
2090                 rth->dst.lwtstate = lwtstate_get(nh->nh_lwtstate);
2091                 if (lwtunnel_input_redirect(rth->dst.lwtstate)) {
2092                         WARN_ON(rth->dst.input == lwtunnel_input);
2093                         rth->dst.lwtstate->orig_input = rth->dst.input;
2094                         rth->dst.input = lwtunnel_input;
2095                 }
2096
2097                 if (unlikely(!rt_cache_route(nh, rth)))
2098                         rt_add_uncached_list(rth);
2099         }
2100         skb_dst_set(skb, &rth->dst);
2101         err = 0;
2102         goto out;
2103
2104 no_route:
2105         RT_CACHE_STAT_INC(in_no_route);
2106         res->type = RTN_UNREACHABLE;
2107         res->fi = NULL;
2108         res->table = NULL;
2109         goto local_input;
2110
2111         /*
2112          *      Do not cache martian addresses: they should be logged (RFC1812)
2113          */
2114 martian_destination:
2115         RT_CACHE_STAT_INC(in_martian_dst);
2116 #ifdef CONFIG_IP_ROUTE_VERBOSE
2117         if (IN_DEV_LOG_MARTIANS(in_dev))
2118                 net_warn_ratelimited("martian destination %pI4 from %pI4, dev %s\n",
2119                                      &daddr, &saddr, dev->name);
2120 #endif
2121
2122 e_inval:
2123         err = -EINVAL;
2124         goto out;
2125
2126 e_nobufs:
2127         err = -ENOBUFS;
2128         goto out;
2129
2130 martian_source:
2131         ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
2132         goto out;
2133 }
2134
2135 int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
2136                          u8 tos, struct net_device *dev)
2137 {
2138         struct fib_result res;
2139         int err;
2140
2141         tos &= IPTOS_RT_MASK;
2142         rcu_read_lock();
2143         err = ip_route_input_rcu(skb, daddr, saddr, tos, dev, &res);
2144         rcu_read_unlock();
2145
2146         return err;
2147 }
2148 EXPORT_SYMBOL(ip_route_input_noref);
2149
2150 /* called with rcu_read_lock held */
2151 int ip_route_input_rcu(struct sk_buff *skb, __be32 daddr, __be32 saddr,
2152                        u8 tos, struct net_device *dev, struct fib_result *res)
2153 {
2154         /* Multicast recognition logic is moved from route cache to here.
2155            The problem was that too many Ethernet cards have broken/missing
2156            hardware multicast filters :-( As result the host on multicasting
2157            network acquires a lot of useless route cache entries, sort of
2158            SDR messages from all the world. Now we try to get rid of them.
2159            Really, provided software IP multicast filter is organized
2160            reasonably (at least, hashed), it does not result in a slowdown
2161            comparing with route cache reject entries.
2162            Note, that multicast routers are not affected, because
2163            route cache entry is created eventually.
2164          */
2165         if (ipv4_is_multicast(daddr)) {
2166                 struct in_device *in_dev = __in_dev_get_rcu(dev);
2167                 int our = 0;
2168                 int err = -EINVAL;
2169
2170                 if (!in_dev)
2171                         return err;
2172                 our = ip_check_mc_rcu(in_dev, daddr, saddr,
2173                                       ip_hdr(skb)->protocol);
2174
2175                 /* check l3 master if no match yet */
2176                 if (!our && netif_is_l3_slave(dev)) {
2177                         struct in_device *l3_in_dev;
2178
2179                         l3_in_dev = __in_dev_get_rcu(skb->dev);
2180                         if (l3_in_dev)
2181                                 our = ip_check_mc_rcu(l3_in_dev, daddr, saddr,
2182                                                       ip_hdr(skb)->protocol);
2183                 }
2184
2185                 if (our
2186 #ifdef CONFIG_IP_MROUTE
2187                         ||
2188                     (!ipv4_is_local_multicast(daddr) &&
2189                      IN_DEV_MFORWARD(in_dev))
2190 #endif
2191                    ) {
2192                         err = ip_route_input_mc(skb, daddr, saddr,
2193                                                 tos, dev, our);
2194                 }
2195                 return err;
2196         }
2197
2198         return ip_route_input_slow(skb, daddr, saddr, tos, dev, res);
2199 }
2200
2201 /* called with rcu_read_lock() */
2202 static struct rtable *__mkroute_output(const struct fib_result *res,
2203                                        const struct flowi4 *fl4, int orig_oif,
2204                                        struct net_device *dev_out,
2205                                        unsigned int flags)
2206 {
2207         struct fib_info *fi = res->fi;
2208         struct fib_nh_exception *fnhe;
2209         struct in_device *in_dev;
2210         u16 type = res->type;
2211         struct rtable *rth;
2212         bool do_cache;
2213
2214         in_dev = __in_dev_get_rcu(dev_out);
2215         if (!in_dev)
2216                 return ERR_PTR(-EINVAL);
2217
2218         if (likely(!IN_DEV_ROUTE_LOCALNET(in_dev)))
2219                 if (ipv4_is_loopback(fl4->saddr) &&
2220                     !(dev_out->flags & IFF_LOOPBACK) &&
2221                     !netif_is_l3_master(dev_out))
2222                         return ERR_PTR(-EINVAL);
2223
2224         if (ipv4_is_lbcast(fl4->daddr))
2225                 type = RTN_BROADCAST;
2226         else if (ipv4_is_multicast(fl4->daddr))
2227                 type = RTN_MULTICAST;
2228         else if (ipv4_is_zeronet(fl4->daddr))
2229                 return ERR_PTR(-EINVAL);
2230
2231         if (dev_out->flags & IFF_LOOPBACK)
2232                 flags |= RTCF_LOCAL;
2233
2234         do_cache = true;
2235         if (type == RTN_BROADCAST) {
2236                 flags |= RTCF_BROADCAST | RTCF_LOCAL;
2237                 fi = NULL;
2238         } else if (type == RTN_MULTICAST) {
2239                 flags |= RTCF_MULTICAST | RTCF_LOCAL;
2240                 if (!ip_check_mc_rcu(in_dev, fl4->daddr, fl4->saddr,
2241                                      fl4->flowi4_proto))
2242                         flags &= ~RTCF_LOCAL;
2243                 else
2244                         do_cache = false;
2245                 /* If multicast route do not exist use
2246                  * default one, but do not gateway in this case.
2247                  * Yes, it is hack.
2248                  */
2249                 if (fi && res->prefixlen < 4)
2250                         fi = NULL;
2251         } else if ((type == RTN_LOCAL) && (orig_oif != 0) &&
2252                    (orig_oif != dev_out->ifindex)) {
2253                 /* For local routes that require a particular output interface
2254                  * we do not want to cache the result.  Caching the result
2255                  * causes incorrect behaviour when there are multiple source
2256                  * addresses on the interface, the end result being that if the
2257                  * intended recipient is waiting on that interface for the
2258                  * packet he won't receive it because it will be delivered on
2259                  * the loopback interface and the IP_PKTINFO ipi_ifindex will
2260                  * be set to the loopback interface as well.
2261                  */
2262                 do_cache = false;
2263         }
2264
2265         fnhe = NULL;
2266         do_cache &= fi != NULL;
2267         if (fi) {
2268                 struct rtable __rcu **prth;
2269                 struct fib_nh *nh = &FIB_RES_NH(*res);
2270
2271                 fnhe = find_exception(nh, fl4->daddr);
2272                 if (!do_cache)
2273                         goto add;
2274                 if (fnhe) {
2275                         prth = &fnhe->fnhe_rth_output;
2276                 } else {
2277                         if (unlikely(fl4->flowi4_flags &
2278                                      FLOWI_FLAG_KNOWN_NH &&
2279                                      !(nh->nh_gw &&
2280                                        nh->nh_scope == RT_SCOPE_LINK))) {
2281                                 do_cache = false;
2282                                 goto add;
2283                         }
2284                         prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
2285                 }
2286                 rth = rcu_dereference(*prth);
2287                 if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst))
2288                         return rth;
2289         }
2290
2291 add:
2292         rth = rt_dst_alloc(dev_out, flags, type,
2293                            IN_DEV_CONF_GET(in_dev, NOPOLICY),
2294                            IN_DEV_CONF_GET(in_dev, NOXFRM),
2295                            do_cache);
2296         if (!rth)
2297                 return ERR_PTR(-ENOBUFS);
2298
2299         rth->rt_iif = orig_oif;
2300
2301         RT_CACHE_STAT_INC(out_slow_tot);
2302
2303         if (flags & (RTCF_BROADCAST | RTCF_MULTICAST)) {
2304                 if (flags & RTCF_LOCAL &&
2305                     !(dev_out->flags & IFF_LOOPBACK)) {
2306                         rth->dst.output = ip_mc_output;
2307                         RT_CACHE_STAT_INC(out_slow_mc);
2308                 }
2309 #ifdef CONFIG_IP_MROUTE
2310                 if (type == RTN_MULTICAST) {
2311                         if (IN_DEV_MFORWARD(in_dev) &&
2312                             !ipv4_is_local_multicast(fl4->daddr)) {
2313                                 rth->dst.input = ip_mr_input;
2314                                 rth->dst.output = ip_mc_output;
2315                         }
2316                 }
2317 #endif
2318         }
2319
2320         rt_set_nexthop(rth, fl4->daddr, res, fnhe, fi, type, 0, do_cache);
2321         lwtunnel_set_redirect(&rth->dst);
2322
2323         return rth;
2324 }
2325
2326 /*
2327  * Major route resolver routine.
2328  */
2329
2330 struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
2331                                         const struct sk_buff *skb)
2332 {
2333         __u8 tos = RT_FL_TOS(fl4);
2334         struct fib_result res = {
2335                 .type           = RTN_UNSPEC,
2336                 .fi             = NULL,
2337                 .table          = NULL,
2338                 .tclassid       = 0,
2339         };
2340         struct rtable *rth;
2341
2342         fl4->flowi4_iif = LOOPBACK_IFINDEX;
2343         fl4->flowi4_tos = tos & IPTOS_RT_MASK;
2344         fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
2345                          RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
2346
2347         rcu_read_lock();
2348         rth = ip_route_output_key_hash_rcu(net, fl4, &res, skb);
2349         rcu_read_unlock();
2350
2351         return rth;
2352 }
2353 EXPORT_SYMBOL_GPL(ip_route_output_key_hash);
2354
2355 struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4,
2356                                             struct fib_result *res,
2357                                             const struct sk_buff *skb)
2358 {
2359         struct net_device *dev_out = NULL;
2360         int orig_oif = fl4->flowi4_oif;
2361         unsigned int flags = 0;
2362         struct rtable *rth;
2363         int err = -ENETUNREACH;
2364
2365         if (fl4->saddr) {
2366                 rth = ERR_PTR(-EINVAL);
2367                 if (ipv4_is_multicast(fl4->saddr) ||
2368                     ipv4_is_lbcast(fl4->saddr) ||
2369                     ipv4_is_zeronet(fl4->saddr))
2370                         goto out;
2371
2372                 /* I removed check for oif == dev_out->oif here.
2373                    It was wrong for two reasons:
2374                    1. ip_dev_find(net, saddr) can return wrong iface, if saddr
2375                       is assigned to multiple interfaces.
2376                    2. Moreover, we are allowed to send packets with saddr
2377                       of another iface. --ANK
2378                  */
2379
2380                 if (fl4->flowi4_oif == 0 &&
2381                     (ipv4_is_multicast(fl4->daddr) ||
2382                      ipv4_is_lbcast(fl4->daddr))) {
2383                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2384                         dev_out = __ip_dev_find(net, fl4->saddr, false);
2385                         if (!dev_out)
2386                                 goto out;
2387
2388                         /* Special hack: user can direct multicasts
2389                            and limited broadcast via necessary interface
2390                            without fiddling with IP_MULTICAST_IF or IP_PKTINFO.
2391                            This hack is not just for fun, it allows
2392                            vic,vat and friends to work.
2393                            They bind socket to loopback, set ttl to zero
2394                            and expect that it will work.
2395                            From the viewpoint of routing cache they are broken,
2396                            because we are not allowed to build multicast path
2397                            with loopback source addr (look, routing cache
2398                            cannot know, that ttl is zero, so that packet
2399                            will not leave this host and route is valid).
2400                            Luckily, this hack is good workaround.
2401                          */
2402
2403                         fl4->flowi4_oif = dev_out->ifindex;
2404                         goto make_route;
2405                 }
2406
2407                 if (!(fl4->flowi4_flags & FLOWI_FLAG_ANYSRC)) {
2408                         /* It is equivalent to inet_addr_type(saddr) == RTN_LOCAL */
2409                         if (!__ip_dev_find(net, fl4->saddr, false))
2410                                 goto out;
2411                 }
2412         }
2413
2414
2415         if (fl4->flowi4_oif) {
2416                 dev_out = dev_get_by_index_rcu(net, fl4->flowi4_oif);
2417                 rth = ERR_PTR(-ENODEV);
2418                 if (!dev_out)
2419                         goto out;
2420
2421                 /* RACE: Check return value of inet_select_addr instead. */
2422                 if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
2423                         rth = ERR_PTR(-ENETUNREACH);
2424                         goto out;
2425                 }
2426                 if (ipv4_is_local_multicast(fl4->daddr) ||
2427                     ipv4_is_lbcast(fl4->daddr) ||
2428                     fl4->flowi4_proto == IPPROTO_IGMP) {
2429                         if (!fl4->saddr)
2430                                 fl4->saddr = inet_select_addr(dev_out, 0,
2431                                                               RT_SCOPE_LINK);
2432                         goto make_route;
2433                 }
2434                 if (!fl4->saddr) {
2435                         if (ipv4_is_multicast(fl4->daddr))
2436                                 fl4->saddr = inet_select_addr(dev_out, 0,
2437                                                               fl4->flowi4_scope);
2438                         else if (!fl4->daddr)
2439                                 fl4->saddr = inet_select_addr(dev_out, 0,
2440                                                               RT_SCOPE_HOST);
2441                 }
2442         }
2443
2444         if (!fl4->daddr) {
2445                 fl4->daddr = fl4->saddr;
2446                 if (!fl4->daddr)
2447                         fl4->daddr = fl4->saddr = htonl(INADDR_LOOPBACK);
2448                 dev_out = net->loopback_dev;
2449                 fl4->flowi4_oif = LOOPBACK_IFINDEX;
2450                 res->type = RTN_LOCAL;
2451                 flags |= RTCF_LOCAL;
2452                 goto make_route;
2453         }
2454
2455         err = fib_lookup(net, fl4, res, 0);
2456         if (err) {
2457                 res->fi = NULL;
2458                 res->table = NULL;
2459                 if (fl4->flowi4_oif &&
2460                     (ipv4_is_multicast(fl4->daddr) ||
2461                     !netif_index_is_l3_master(net, fl4->flowi4_oif))) {
2462                         /* Apparently, routing tables are wrong. Assume,
2463                            that the destination is on link.
2464
2465                            WHY? DW.
2466                            Because we are allowed to send to iface
2467                            even if it has NO routes and NO assigned
2468                            addresses. When oif is specified, routing
2469                            tables are looked up with only one purpose:
2470                            to catch if destination is gatewayed, rather than
2471                            direct. Moreover, if MSG_DONTROUTE is set,
2472                            we send packet, ignoring both routing tables
2473                            and ifaddr state. --ANK
2474
2475
2476                            We could make it even if oif is unknown,
2477                            likely IPv6, but we do not.
2478                          */
2479
2480                         if (fl4->saddr == 0)
2481                                 fl4->saddr = inet_select_addr(dev_out, 0,
2482                                                               RT_SCOPE_LINK);
2483                         res->type = RTN_UNICAST;
2484                         goto make_route;
2485                 }
2486                 rth = ERR_PTR(err);
2487                 goto out;
2488         }
2489
2490         if (res->type == RTN_LOCAL) {
2491                 if (!fl4->saddr) {
2492                         if (res->fi->fib_prefsrc)
2493                                 fl4->saddr = res->fi->fib_prefsrc;
2494                         else
2495                                 fl4->saddr = fl4->daddr;
2496                 }
2497
2498                 /* L3 master device is the loopback for that domain */
2499                 dev_out = l3mdev_master_dev_rcu(FIB_RES_DEV(*res)) ? :
2500                         net->loopback_dev;
2501
2502                 /* make sure orig_oif points to fib result device even
2503                  * though packet rx/tx happens over loopback or l3mdev
2504                  */
2505                 orig_oif = FIB_RES_OIF(*res);
2506
2507                 fl4->flowi4_oif = dev_out->ifindex;
2508                 flags |= RTCF_LOCAL;
2509                 goto make_route;
2510         }
2511
2512         fib_select_path(net, res, fl4, skb);
2513
2514         dev_out = FIB_RES_DEV(*res);
2515         fl4->flowi4_oif = dev_out->ifindex;
2516
2517
2518 make_route:
2519         rth = __mkroute_output(res, fl4, orig_oif, dev_out, flags);
2520
2521 out:
2522         return rth;
2523 }
2524
2525 static struct dst_entry *ipv4_blackhole_dst_check(struct dst_entry *dst, u32 cookie)
2526 {
2527         return NULL;
2528 }
2529
2530 static unsigned int ipv4_blackhole_mtu(const struct dst_entry *dst)
2531 {
2532         unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
2533
2534         return mtu ? : dst->dev->mtu;
2535 }
2536
2537 static void ipv4_rt_blackhole_update_pmtu(struct dst_entry *dst, struct sock *sk,
2538                                           struct sk_buff *skb, u32 mtu)
2539 {
2540 }
2541
2542 static void ipv4_rt_blackhole_redirect(struct dst_entry *dst, struct sock *sk,
2543                                        struct sk_buff *skb)
2544 {
2545 }
2546
2547 static u32 *ipv4_rt_blackhole_cow_metrics(struct dst_entry *dst,
2548                                           unsigned long old)
2549 {
2550         return NULL;
2551 }
2552
2553 static struct dst_ops ipv4_dst_blackhole_ops = {
2554         .family                 =       AF_INET,
2555         .check                  =       ipv4_blackhole_dst_check,
2556         .mtu                    =       ipv4_blackhole_mtu,
2557         .default_advmss         =       ipv4_default_advmss,
2558         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
2559         .redirect               =       ipv4_rt_blackhole_redirect,
2560         .cow_metrics            =       ipv4_rt_blackhole_cow_metrics,
2561         .neigh_lookup           =       ipv4_neigh_lookup,
2562 };
2563
2564 struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_orig)
2565 {
2566         struct rtable *ort = (struct rtable *) dst_orig;
2567         struct rtable *rt;
2568
2569         rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_DEAD, 0);
2570         if (rt) {
2571                 struct dst_entry *new = &rt->dst;
2572
2573                 new->__use = 1;
2574                 new->input = dst_discard;
2575                 new->output = dst_discard_out;
2576
2577                 new->dev = net->loopback_dev;
2578                 if (new->dev)
2579                         dev_hold(new->dev);
2580
2581                 rt->rt_is_input = ort->rt_is_input;
2582                 rt->rt_iif = ort->rt_iif;
2583                 rt->rt_pmtu = ort->rt_pmtu;
2584                 rt->rt_mtu_locked = ort->rt_mtu_locked;
2585
2586                 rt->rt_genid = rt_genid_ipv4(net);
2587                 rt->rt_flags = ort->rt_flags;
2588                 rt->rt_type = ort->rt_type;
2589                 rt->rt_gateway = ort->rt_gateway;
2590                 rt->rt_uses_gateway = ort->rt_uses_gateway;
2591
2592                 INIT_LIST_HEAD(&rt->rt_uncached);
2593         }
2594
2595         dst_release(dst_orig);
2596
2597         return rt ? &rt->dst : ERR_PTR(-ENOMEM);
2598 }
2599
2600 struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
2601                                     const struct sock *sk)
2602 {
2603         struct rtable *rt = __ip_route_output_key(net, flp4);
2604
2605         if (IS_ERR(rt))
2606                 return rt;
2607
2608         if (flp4->flowi4_proto)
2609                 rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
2610                                                         flowi4_to_flowi(flp4),
2611                                                         sk, 0);
2612
2613         return rt;
2614 }
2615 EXPORT_SYMBOL_GPL(ip_route_output_flow);
2616
2617 /* called with rcu_read_lock held */
2618 static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
2619                         struct rtable *rt, u32 table_id, struct flowi4 *fl4,
2620                         struct sk_buff *skb, u32 portid, u32 seq)
2621 {
2622         struct rtmsg *r;
2623         struct nlmsghdr *nlh;
2624         unsigned long expires = 0;
2625         u32 error;
2626         u32 metrics[RTAX_MAX];
2627
2628         nlh = nlmsg_put(skb, portid, seq, RTM_NEWROUTE, sizeof(*r), 0);
2629         if (!nlh)
2630                 return -EMSGSIZE;
2631
2632         r = nlmsg_data(nlh);
2633         r->rtm_family    = AF_INET;
2634         r->rtm_dst_len  = 32;
2635         r->rtm_src_len  = 0;
2636         r->rtm_tos      = fl4->flowi4_tos;
2637         r->rtm_table    = table_id < 256 ? table_id : RT_TABLE_COMPAT;
2638         if (nla_put_u32(skb, RTA_TABLE, table_id))
2639                 goto nla_put_failure;
2640         r->rtm_type     = rt->rt_type;
2641         r->rtm_scope    = RT_SCOPE_UNIVERSE;
2642         r->rtm_protocol = RTPROT_UNSPEC;
2643         r->rtm_flags    = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
2644         if (rt->rt_flags & RTCF_NOTIFY)
2645                 r->rtm_flags |= RTM_F_NOTIFY;
2646         if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
2647                 r->rtm_flags |= RTCF_DOREDIRECT;
2648
2649         if (nla_put_in_addr(skb, RTA_DST, dst))
2650                 goto nla_put_failure;
2651         if (src) {
2652                 r->rtm_src_len = 32;
2653                 if (nla_put_in_addr(skb, RTA_SRC, src))
2654                         goto nla_put_failure;
2655         }
2656         if (rt->dst.dev &&
2657             nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
2658                 goto nla_put_failure;
2659 #ifdef CONFIG_IP_ROUTE_CLASSID
2660         if (rt->dst.tclassid &&
2661             nla_put_u32(skb, RTA_FLOW, rt->dst.tclassid))
2662                 goto nla_put_failure;
2663 #endif
2664         if (!rt_is_input_route(rt) &&
2665             fl4->saddr != src) {
2666                 if (nla_put_in_addr(skb, RTA_PREFSRC, fl4->saddr))
2667                         goto nla_put_failure;
2668         }
2669         if (rt->rt_uses_gateway &&
2670             nla_put_in_addr(skb, RTA_GATEWAY, rt->rt_gateway))
2671                 goto nla_put_failure;
2672
2673         expires = rt->dst.expires;
2674         if (expires) {
2675                 unsigned long now = jiffies;
2676
2677                 if (time_before(now, expires))
2678                         expires -= now;
2679                 else
2680                         expires = 0;
2681         }
2682
2683         memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics));
2684         if (rt->rt_pmtu && expires)
2685                 metrics[RTAX_MTU - 1] = rt->rt_pmtu;
2686         if (rt->rt_mtu_locked && expires)
2687                 metrics[RTAX_LOCK - 1] |= BIT(RTAX_MTU);
2688         if (rtnetlink_put_metrics(skb, metrics) < 0)
2689                 goto nla_put_failure;
2690
2691         if (fl4->flowi4_mark &&
2692             nla_put_u32(skb, RTA_MARK, fl4->flowi4_mark))
2693                 goto nla_put_failure;
2694
2695         if (!uid_eq(fl4->flowi4_uid, INVALID_UID) &&
2696             nla_put_u32(skb, RTA_UID,
2697                         from_kuid_munged(current_user_ns(), fl4->flowi4_uid)))
2698                 goto nla_put_failure;
2699
2700         error = rt->dst.error;
2701
2702         if (rt_is_input_route(rt)) {
2703 #ifdef CONFIG_IP_MROUTE
2704                 if (ipv4_is_multicast(dst) && !ipv4_is_local_multicast(dst) &&
2705                     IPV4_DEVCONF_ALL(net, MC_FORWARDING)) {
2706                         int err = ipmr_get_route(net, skb,
2707                                                  fl4->saddr, fl4->daddr,
2708                                                  r, portid);
2709
2710                         if (err <= 0) {
2711                                 if (err == 0)
2712                                         return 0;
2713                                 goto nla_put_failure;
2714                         }
2715                 } else
2716 #endif
2717                         if (nla_put_u32(skb, RTA_IIF, fl4->flowi4_iif))
2718                                 goto nla_put_failure;
2719         }
2720
2721         if (rtnl_put_cacheinfo(skb, &rt->dst, 0, expires, error) < 0)
2722                 goto nla_put_failure;
2723
2724         nlmsg_end(skb, nlh);
2725         return 0;
2726
2727 nla_put_failure:
2728         nlmsg_cancel(skb, nlh);
2729         return -EMSGSIZE;
2730 }
2731
2732 static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst,
2733                                                    u8 ip_proto, __be16 sport,
2734                                                    __be16 dport)
2735 {
2736         struct sk_buff *skb;
2737         struct iphdr *iph;
2738
2739         skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
2740         if (!skb)
2741                 return NULL;
2742
2743         /* Reserve room for dummy headers, this skb can pass
2744          * through good chunk of routing engine.
2745          */
2746         skb_reset_mac_header(skb);
2747         skb_reset_network_header(skb);
2748         skb->protocol = htons(ETH_P_IP);
2749         iph = skb_put(skb, sizeof(struct iphdr));
2750         iph->protocol = ip_proto;
2751         iph->saddr = src;
2752         iph->daddr = dst;
2753         iph->version = 0x4;
2754         iph->frag_off = 0;
2755         iph->ihl = 0x5;
2756         skb_set_transport_header(skb, skb->len);
2757
2758         switch (iph->protocol) {
2759         case IPPROTO_UDP: {
2760                 struct udphdr *udph;
2761
2762                 udph = skb_put_zero(skb, sizeof(struct udphdr));
2763                 udph->source = sport;
2764                 udph->dest = dport;
2765                 udph->len = sizeof(struct udphdr);
2766                 udph->check = 0;
2767                 break;
2768         }
2769         case IPPROTO_TCP: {
2770                 struct tcphdr *tcph;
2771
2772                 tcph = skb_put_zero(skb, sizeof(struct tcphdr));
2773                 tcph->source    = sport;
2774                 tcph->dest      = dport;
2775                 tcph->doff      = sizeof(struct tcphdr) / 4;
2776                 tcph->rst = 1;
2777                 tcph->check = ~tcp_v4_check(sizeof(struct tcphdr),
2778                                             src, dst, 0);
2779                 break;
2780         }
2781         case IPPROTO_ICMP: {
2782                 struct icmphdr *icmph;
2783
2784                 icmph = skb_put_zero(skb, sizeof(struct icmphdr));
2785                 icmph->type = ICMP_ECHO;
2786                 icmph->code = 0;
2787         }
2788         }
2789
2790         return skb;
2791 }
2792
2793 static int inet_rtm_valid_getroute_req(struct sk_buff *skb,
2794                                        const struct nlmsghdr *nlh,
2795                                        struct nlattr **tb,
2796                                        struct netlink_ext_ack *extack)
2797 {
2798         struct rtmsg *rtm;
2799         int i, err;
2800
2801         if (nlh->nlmsg_len < nlmsg_msg_size(sizeof(*rtm))) {
2802                 NL_SET_ERR_MSG(extack,
2803                                "ipv4: Invalid header for route get request");
2804                 return -EINVAL;
2805         }
2806
2807         if (!netlink_strict_get_check(skb))
2808                 return nlmsg_parse(nlh, sizeof(*rtm), tb, RTA_MAX,
2809                                    rtm_ipv4_policy, extack);
2810
2811         rtm = nlmsg_data(nlh);
2812         if ((rtm->rtm_src_len && rtm->rtm_src_len != 32) ||
2813             (rtm->rtm_dst_len && rtm->rtm_dst_len != 32) ||
2814             rtm->rtm_table || rtm->rtm_protocol ||
2815             rtm->rtm_scope || rtm->rtm_type) {
2816                 NL_SET_ERR_MSG(extack, "ipv4: Invalid values in header for route get request");
2817                 return -EINVAL;
2818         }
2819
2820         if (rtm->rtm_flags & ~(RTM_F_NOTIFY |
2821                                RTM_F_LOOKUP_TABLE |
2822                                RTM_F_FIB_MATCH)) {
2823                 NL_SET_ERR_MSG(extack, "ipv4: Unsupported rtm_flags for route get request");
2824                 return -EINVAL;
2825         }
2826
2827         err = nlmsg_parse_strict(nlh, sizeof(*rtm), tb, RTA_MAX,
2828                                  rtm_ipv4_policy, extack);
2829         if (err)
2830                 return err;
2831
2832         if ((tb[RTA_SRC] && !rtm->rtm_src_len) ||
2833             (tb[RTA_DST] && !rtm->rtm_dst_len)) {
2834                 NL_SET_ERR_MSG(extack, "ipv4: rtm_src_len and rtm_dst_len must be 32 for IPv4");
2835                 return -EINVAL;
2836         }
2837
2838         for (i = 0; i <= RTA_MAX; i++) {
2839                 if (!tb[i])
2840                         continue;
2841
2842                 switch (i) {
2843                 case RTA_IIF:
2844                 case RTA_OIF:
2845                 case RTA_SRC:
2846                 case RTA_DST:
2847                 case RTA_IP_PROTO:
2848                 case RTA_SPORT:
2849                 case RTA_DPORT:
2850                 case RTA_MARK:
2851                 case RTA_UID:
2852                         break;
2853                 default:
2854                         NL_SET_ERR_MSG(extack, "ipv4: Unsupported attribute in route get request");
2855                         return -EINVAL;
2856                 }
2857         }
2858
2859         return 0;
2860 }
2861
2862 static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
2863                              struct netlink_ext_ack *extack)
2864 {
2865         struct net *net = sock_net(in_skb->sk);
2866         struct nlattr *tb[RTA_MAX+1];
2867         u32 table_id = RT_TABLE_MAIN;
2868         __be16 sport = 0, dport = 0;
2869         struct fib_result res = {};
2870         u8 ip_proto = IPPROTO_UDP;
2871         struct rtable *rt = NULL;
2872         struct sk_buff *skb;
2873         struct rtmsg *rtm;
2874         struct flowi4 fl4 = {};
2875         __be32 dst = 0;
2876         __be32 src = 0;
2877         kuid_t uid;
2878         u32 iif;
2879         int err;
2880         int mark;
2881
2882         err = inet_rtm_valid_getroute_req(in_skb, nlh, tb, extack);
2883         if (err < 0)
2884                 return err;
2885
2886         rtm = nlmsg_data(nlh);
2887         src = tb[RTA_SRC] ? nla_get_in_addr(tb[RTA_SRC]) : 0;
2888         dst = tb[RTA_DST] ? nla_get_in_addr(tb[RTA_DST]) : 0;
2889         iif = tb[RTA_IIF] ? nla_get_u32(tb[RTA_IIF]) : 0;
2890         mark = tb[RTA_MARK] ? nla_get_u32(tb[RTA_MARK]) : 0;
2891         if (tb[RTA_UID])
2892                 uid = make_kuid(current_user_ns(), nla_get_u32(tb[RTA_UID]));
2893         else
2894                 uid = (iif ? INVALID_UID : current_uid());
2895
2896         if (tb[RTA_IP_PROTO]) {
2897                 err = rtm_getroute_parse_ip_proto(tb[RTA_IP_PROTO],
2898                                                   &ip_proto, AF_INET, extack);
2899                 if (err)
2900                         return err;
2901         }
2902
2903         if (tb[RTA_SPORT])
2904                 sport = nla_get_be16(tb[RTA_SPORT]);
2905
2906         if (tb[RTA_DPORT])
2907                 dport = nla_get_be16(tb[RTA_DPORT]);
2908
2909         skb = inet_rtm_getroute_build_skb(src, dst, ip_proto, sport, dport);
2910         if (!skb)
2911                 return -ENOBUFS;
2912
2913         fl4.daddr = dst;
2914         fl4.saddr = src;
2915         fl4.flowi4_tos = rtm->rtm_tos;
2916         fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0;
2917         fl4.flowi4_mark = mark;
2918         fl4.flowi4_uid = uid;
2919         if (sport)
2920                 fl4.fl4_sport = sport;
2921         if (dport)
2922                 fl4.fl4_dport = dport;
2923         fl4.flowi4_proto = ip_proto;
2924
2925         rcu_read_lock();
2926
2927         if (iif) {
2928                 struct net_device *dev;
2929
2930                 dev = dev_get_by_index_rcu(net, iif);
2931                 if (!dev) {
2932                         err = -ENODEV;
2933                         goto errout_rcu;
2934                 }
2935
2936                 fl4.flowi4_iif = iif; /* for rt_fill_info */
2937                 skb->dev        = dev;
2938                 skb->mark       = mark;
2939                 err = ip_route_input_rcu(skb, dst, src, rtm->rtm_tos,
2940                                          dev, &res);
2941
2942                 rt = skb_rtable(skb);
2943                 if (err == 0 && rt->dst.error)
2944                         err = -rt->dst.error;
2945         } else {
2946                 fl4.flowi4_iif = LOOPBACK_IFINDEX;
2947                 skb->dev = net->loopback_dev;
2948                 rt = ip_route_output_key_hash_rcu(net, &fl4, &res, skb);
2949                 err = 0;
2950                 if (IS_ERR(rt))
2951                         err = PTR_ERR(rt);
2952                 else
2953                         skb_dst_set(skb, &rt->dst);
2954         }
2955
2956         if (err)
2957                 goto errout_rcu;
2958
2959         if (rtm->rtm_flags & RTM_F_NOTIFY)
2960                 rt->rt_flags |= RTCF_NOTIFY;
2961
2962         if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
2963                 table_id = res.table ? res.table->tb_id : 0;
2964
2965         /* reset skb for netlink reply msg */
2966         skb_trim(skb, 0);
2967         skb_reset_network_header(skb);
2968         skb_reset_transport_header(skb);
2969         skb_reset_mac_header(skb);
2970
2971         if (rtm->rtm_flags & RTM_F_FIB_MATCH) {
2972                 if (!res.fi) {
2973                         err = fib_props[res.type].error;
2974                         if (!err)
2975                                 err = -EHOSTUNREACH;
2976                         goto errout_rcu;
2977                 }
2978                 err = fib_dump_info(skb, NETLINK_CB(in_skb).portid,
2979                                     nlh->nlmsg_seq, RTM_NEWROUTE, table_id,
2980                                     rt->rt_type, res.prefix, res.prefixlen,
2981                                     fl4.flowi4_tos, res.fi, 0);
2982         } else {
2983                 err = rt_fill_info(net, dst, src, rt, table_id, &fl4, skb,
2984                                    NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
2985         }
2986         if (err < 0)
2987                 goto errout_rcu;
2988
2989         rcu_read_unlock();
2990
2991         err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).portid);
2992
2993 errout_free:
2994         return err;
2995 errout_rcu:
2996         rcu_read_unlock();
2997         kfree_skb(skb);
2998         goto errout_free;
2999 }
3000
3001 void ip_rt_multicast_event(struct in_device *in_dev)
3002 {
3003         rt_cache_flush(dev_net(in_dev->dev));
3004 }
3005
3006 #ifdef CONFIG_SYSCTL
3007 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
3008 static int ip_rt_gc_min_interval __read_mostly  = HZ / 2;
3009 static int ip_rt_gc_elasticity __read_mostly    = 8;
3010 static int ip_min_valid_pmtu __read_mostly      = IPV4_MIN_MTU;
3011
3012 static int ipv4_sysctl_rtcache_flush(struct ctl_table *__ctl, int write,
3013                                         void __user *buffer,
3014                                         size_t *lenp, loff_t *ppos)
3015 {
3016         struct net *net = (struct net *)__ctl->extra1;
3017
3018         if (write) {
3019                 rt_cache_flush(net);
3020                 fnhe_genid_bump(net);
3021                 return 0;
3022         }
3023
3024         return -EINVAL;
3025 }
3026
3027 static struct ctl_table ipv4_route_table[] = {
3028         {
3029                 .procname       = "gc_thresh",
3030                 .data           = &ipv4_dst_ops.gc_thresh,
3031                 .maxlen         = sizeof(int),
3032                 .mode           = 0644,
3033                 .proc_handler   = proc_dointvec,
3034         },
3035         {
3036                 .procname       = "max_size",
3037                 .data           = &ip_rt_max_size,
3038                 .maxlen         = sizeof(int),
3039                 .mode           = 0644,
3040                 .proc_handler   = proc_dointvec,
3041         },
3042         {
3043                 /*  Deprecated. Use gc_min_interval_ms */
3044
3045                 .procname       = "gc_min_interval",
3046                 .data           = &ip_rt_gc_min_interval,
3047                 .maxlen         = sizeof(int),
3048                 .mode           = 0644,
3049                 .proc_handler   = proc_dointvec_jiffies,
3050         },
3051         {
3052                 .procname       = "gc_min_interval_ms",
3053                 .data           = &ip_rt_gc_min_interval,
3054                 .maxlen         = sizeof(int),
3055                 .mode           = 0644,
3056                 .proc_handler   = proc_dointvec_ms_jiffies,
3057         },
3058         {
3059                 .procname       = "gc_timeout",
3060                 .data           = &ip_rt_gc_timeout,
3061                 .maxlen         = sizeof(int),
3062                 .mode           = 0644,
3063                 .proc_handler   = proc_dointvec_jiffies,
3064         },
3065         {
3066                 .procname       = "gc_interval",
3067                 .data           = &ip_rt_gc_interval,
3068                 .maxlen         = sizeof(int),
3069                 .mode           = 0644,
3070                 .proc_handler   = proc_dointvec_jiffies,
3071         },
3072         {
3073                 .procname       = "redirect_load",
3074                 .data           = &ip_rt_redirect_load,
3075                 .maxlen         = sizeof(int),
3076                 .mode           = 0644,
3077                 .proc_handler   = proc_dointvec,
3078         },
3079         {
3080                 .procname       = "redirect_number",
3081                 .data           = &ip_rt_redirect_number,
3082                 .maxlen         = sizeof(int),
3083                 .mode           = 0644,
3084                 .proc_handler   = proc_dointvec,
3085         },
3086         {
3087                 .procname       = "redirect_silence",
3088                 .data           = &ip_rt_redirect_silence,
3089                 .maxlen         = sizeof(int),
3090                 .mode           = 0644,
3091                 .proc_handler   = proc_dointvec,
3092         },
3093         {
3094                 .procname       = "error_cost",
3095                 .data           = &ip_rt_error_cost,
3096                 .maxlen         = sizeof(int),
3097                 .mode           = 0644,
3098                 .proc_handler   = proc_dointvec,
3099         },
3100         {
3101                 .procname       = "error_burst",
3102                 .data           = &ip_rt_error_burst,
3103                 .maxlen         = sizeof(int),
3104                 .mode           = 0644,
3105                 .proc_handler   = proc_dointvec,
3106         },
3107         {
3108                 .procname       = "gc_elasticity",
3109                 .data           = &ip_rt_gc_elasticity,
3110                 .maxlen         = sizeof(int),
3111                 .mode           = 0644,
3112                 .proc_handler   = proc_dointvec,
3113         },
3114         {
3115                 .procname       = "mtu_expires",
3116                 .data           = &ip_rt_mtu_expires,
3117                 .maxlen         = sizeof(int),
3118                 .mode           = 0644,
3119                 .proc_handler   = proc_dointvec_jiffies,
3120         },
3121         {
3122                 .procname       = "min_pmtu",
3123                 .data           = &ip_rt_min_pmtu,
3124                 .maxlen         = sizeof(int),
3125                 .mode           = 0644,
3126                 .proc_handler   = proc_dointvec_minmax,
3127                 .extra1         = &ip_min_valid_pmtu,
3128         },
3129         {
3130                 .procname       = "min_adv_mss",
3131                 .data           = &ip_rt_min_advmss,
3132                 .maxlen         = sizeof(int),
3133                 .mode           = 0644,
3134                 .proc_handler   = proc_dointvec,
3135         },
3136         { }
3137 };
3138
3139 static struct ctl_table ipv4_route_flush_table[] = {
3140         {
3141                 .procname       = "flush",
3142                 .maxlen         = sizeof(int),
3143                 .mode           = 0200,
3144                 .proc_handler   = ipv4_sysctl_rtcache_flush,
3145         },
3146         { },
3147 };
3148
3149 static __net_init int sysctl_route_net_init(struct net *net)
3150 {
3151         struct ctl_table *tbl;
3152
3153         tbl = ipv4_route_flush_table;
3154         if (!net_eq(net, &init_net)) {
3155                 tbl = kmemdup(tbl, sizeof(ipv4_route_flush_table), GFP_KERNEL);
3156                 if (!tbl)
3157                         goto err_dup;
3158
3159                 /* Don't export sysctls to unprivileged users */
3160                 if (net->user_ns != &init_user_ns)
3161                         tbl[0].procname = NULL;
3162         }
3163         tbl[0].extra1 = net;
3164
3165         net->ipv4.route_hdr = register_net_sysctl(net, "net/ipv4/route", tbl);
3166         if (!net->ipv4.route_hdr)
3167                 goto err_reg;
3168         return 0;
3169
3170 err_reg:
3171         if (tbl != ipv4_route_flush_table)
3172                 kfree(tbl);
3173 err_dup:
3174         return -ENOMEM;
3175 }
3176
3177 static __net_exit void sysctl_route_net_exit(struct net *net)
3178 {
3179         struct ctl_table *tbl;
3180
3181         tbl = net->ipv4.route_hdr->ctl_table_arg;
3182         unregister_net_sysctl_table(net->ipv4.route_hdr);
3183         BUG_ON(tbl == ipv4_route_flush_table);
3184         kfree(tbl);
3185 }
3186
3187 static __net_initdata struct pernet_operations sysctl_route_ops = {
3188         .init = sysctl_route_net_init,
3189         .exit = sysctl_route_net_exit,
3190 };
3191 #endif
3192
3193 static __net_init int rt_genid_init(struct net *net)
3194 {
3195         atomic_set(&net->ipv4.rt_genid, 0);
3196         atomic_set(&net->fnhe_genid, 0);
3197         atomic_set(&net->ipv4.dev_addr_genid, get_random_int());
3198         return 0;
3199 }
3200
3201 static __net_initdata struct pernet_operations rt_genid_ops = {
3202         .init = rt_genid_init,
3203 };
3204
3205 static int __net_init ipv4_inetpeer_init(struct net *net)
3206 {
3207         struct inet_peer_base *bp = kmalloc(sizeof(*bp), GFP_KERNEL);
3208
3209         if (!bp)
3210                 return -ENOMEM;
3211         inet_peer_base_init(bp);
3212         net->ipv4.peers = bp;
3213         return 0;
3214 }
3215
3216 static void __net_exit ipv4_inetpeer_exit(struct net *net)
3217 {
3218         struct inet_peer_base *bp = net->ipv4.peers;
3219
3220         net->ipv4.peers = NULL;
3221         inetpeer_invalidate_tree(bp);
3222         kfree(bp);
3223 }
3224
3225 static __net_initdata struct pernet_operations ipv4_inetpeer_ops = {
3226         .init   =       ipv4_inetpeer_init,
3227         .exit   =       ipv4_inetpeer_exit,
3228 };
3229
3230 #ifdef CONFIG_IP_ROUTE_CLASSID
3231 struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
3232 #endif /* CONFIG_IP_ROUTE_CLASSID */
3233
3234 int __init ip_rt_init(void)
3235 {
3236         int cpu;
3237
3238         ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
3239                                   GFP_KERNEL);
3240         if (!ip_idents)
3241                 panic("IP: failed to allocate ip_idents\n");
3242
3243         prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
3244
3245         ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
3246         if (!ip_tstamps)
3247                 panic("IP: failed to allocate ip_tstamps\n");
3248
3249         for_each_possible_cpu(cpu) {
3250                 struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);
3251
3252                 INIT_LIST_HEAD(&ul->head);
3253                 spin_lock_init(&ul->lock);
3254         }
3255 #ifdef CONFIG_IP_ROUTE_CLASSID
3256         ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
3257         if (!ip_rt_acct)
3258                 panic("IP: failed to allocate ip_rt_acct\n");
3259 #endif
3260
3261         ipv4_dst_ops.kmem_cachep =
3262                 kmem_cache_create("ip_dst_cache", sizeof(struct rtable), 0,
3263                                   SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
3264
3265         ipv4_dst_blackhole_ops.kmem_cachep = ipv4_dst_ops.kmem_cachep;
3266
3267         if (dst_entries_init(&ipv4_dst_ops) < 0)
3268                 panic("IP: failed to allocate ipv4_dst_ops counter\n");
3269
3270         if (dst_entries_init(&ipv4_dst_blackhole_ops) < 0)
3271                 panic("IP: failed to allocate ipv4_dst_blackhole_ops counter\n");
3272
3273         ipv4_dst_ops.gc_thresh = ~0;
3274         ip_rt_max_size = INT_MAX;
3275
3276         devinet_init();
3277         ip_fib_init();
3278
3279         if (ip_rt_proc_init())
3280                 pr_err("Unable to create route proc files\n");
3281 #ifdef CONFIG_XFRM
3282         xfrm_init();
3283         xfrm4_init();
3284 #endif
3285         rtnl_register(PF_INET, RTM_GETROUTE, inet_rtm_getroute, NULL,
3286                       RTNL_FLAG_DOIT_UNLOCKED);
3287
3288 #ifdef CONFIG_SYSCTL
3289         register_pernet_subsys(&sysctl_route_ops);
3290 #endif
3291         register_pernet_subsys(&rt_genid_ops);
3292         register_pernet_subsys(&ipv4_inetpeer_ops);
3293         return 0;
3294 }
3295
3296 #ifdef CONFIG_SYSCTL
3297 /*
3298  * We really need to sanitize the damn ipv4 init order, then all
3299  * this nonsense will go away.
3300  */
3301 void __init ip_static_sysctl_init(void)
3302 {
3303         register_net_sysctl(&init_net, "net/ipv4/route", ipv4_route_table);
3304 }
3305 #endif