10 files changed, 159 insertions, 91 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a7fee6b27320..452a82ce4796 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -172,6 +172,7 @@ struct ipv6_devconf ipv6_devconf __read_mostly = {
 #endif
 #endif
         .proxy_ndp              = 0,
+        .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 };
 
 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -203,6 +204,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 #endif
 #endif
         .proxy_ndp              = 0,
+        .accept_source_route    = 0,    /* we do not accept RH0 by default. */
 };
 
 /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
@@ -342,6 +344,9 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         }
 #endif
 
+        if (netif_running(dev) && netif_carrier_ok(dev))
+                ndev->if_flags |= IF_READY;
+
         ipv6_mc_init_dev(ndev);
         ndev->tstamp = jiffies;
 #ifdef CONFIG_SYSCTL
@@ -804,7 +809,7 @@ struct ipv6_saddr_score {
 #define IPV6_SADDR_SCORE_LABEL          0x0020
 #define IPV6_SADDR_SCORE_PRIVACY        0x0040
 
-static int inline ipv6_saddr_preferred(int type)
+static inline int ipv6_saddr_preferred(int type)
 {
         if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
                     IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
@@ -813,7 +818,7 @@ static int inline ipv6_saddr_preferred(int type)
 }
 
 /* static matching label */
-static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
+static inline int ipv6_saddr_label(const struct in6_addr *addr, int type)
 {
  /*
   *     prefix (longest match)  label
@@ -3318,7 +3323,7 @@ errout:
                 rtnl_set_sk_err(RTNLGRP_IPV6_IFADDR, err);
 }
 
-static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
+static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
                                 __s32 *array, int bytes)
 {
         BUG_ON(bytes < (DEVCONF_MAX * 4));
@@ -3353,6 +3358,7 @@ static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
 #endif
         array[DEVCONF_PROXY_NDP] = cnf->proxy_ndp;
+        array[DEVCONF_ACCEPT_SOURCE_ROUTE] = cnf->accept_source_route;
 }
 
 static inline size_t inet6_if_nlmsg_size(void)
@@ -3881,6 +3887,14 @@ static struct addrconf_sysctl_table
                         .proc_handler   =       &proc_dointvec,
                 },
                 {
+                        .ctl_name       =       NET_IPV6_ACCEPT_SOURCE_ROUTE,
+                        .procname       =       "accept_source_route",
+                        .data           =       &ipv6_devconf.accept_source_route,
+                        .maxlen         =       sizeof(int),
+                        .mode           =       0644,
+                        .proc_handler   =       &proc_dointvec,
+                },
+                {
                         .ctl_name       =       0,      /* sentinel */
                 }
         },
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 28e0c6568272..fb39604c3d09 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -362,10 +362,27 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct in6_addr *addr = NULL;
         struct in6_addr daddr;
+        struct inet6_dev *idev;
         int n, i;
-
         struct ipv6_rt_hdr *hdr;
         struct rt0_hdr *rthdr;
+        int accept_source_route = ipv6_devconf.accept_source_route;
+
+        if (accept_source_route < 0 ||
+            ((idev = in6_dev_get(skb->dev)) == NULL)) {
+                kfree_skb(skb);
+                return -1;
+        }
+        if (idev->cnf.accept_source_route < 0) {
+                in6_dev_put(idev);
+                kfree_skb(skb);
+                return -1;
+        }
+
+        if (accept_source_route > idev->cnf.accept_source_route)
+                accept_source_route = idev->cnf.accept_source_route;
+
+        in6_dev_put(idev);
 
         if (!pskb_may_pull(skb, (skb->h.raw-skb->data)+8) ||
             !pskb_may_pull(skb, (skb->h.raw-skb->data)+((skb->h.raw[1]+1)<<3))) {
@@ -377,6 +394,22 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp)
 
         hdr = (struct ipv6_rt_hdr *) skb->h.raw;
 
+        switch (hdr->type) {
+#ifdef CONFIG_IPV6_MIP6
+                break;
+#endif
+        case IPV6_SRCRT_TYPE_0:
+                if (accept_source_route > 0)
+                        break;
+                kfree_skb(skb);
+                return -1;
+        default:
+                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+                                 IPSTATS_MIB_INHDRERRORS);
+                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
+                return -1;
+        }
+
         if (ipv6_addr_is_multicast(&skb->nh.ipv6h->daddr) ||
             skb->pkt_type != PACKET_HOST) {
                 IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
@@ -434,11 +467,6 @@ looped_back:
                 }
                 break;
 #endif
-        default:
-                IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
-                                 IPSTATS_MIB_INHDRERRORS);
-                icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, (&hdr->type) - skb->nh.raw);
-                return -1;
         }
 
         /*
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 0862809ffcf7..ea3035b4e3e8 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 
 static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
-        [FRA_DST]       = { .len = sizeof(struct in6_addr) },
 };
 
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
-        if (frh->src_len > 128 || frh->dst_len > 128)
-                goto errout;
-
         if (rule->action == FR_ACT_TO_TBL) {
                 if (rule->table == RT6_TABLE_UNSPEC)
                         goto errout;
@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
                            sizeof(struct in6_addr));
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
                            sizeof(struct in6_addr));
 
@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->tos && (rule6->tclass != frh->tos))
                 return 0;
 
-        if (tb[FRA_SRC] &&
+        if (frh->src_len &&
             nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
                 return 0;
 
-        if (tb[FRA_DST] &&
+        if (frh->dst_len &&
             nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
                 return 0;
 
@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib6_rules_ops = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
+        .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
         .match                  = fib6_rule_match,
         .configure              = fib6_rule_configure,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f4d7be77eb0f..268f476ef3db 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -658,6 +658,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                 ins = &iter->u.dst.rt6_next;
         }
 
+        /* Reset round-robin state, if necessary */
+        if (ins == &fn->leaf)
+                fn->rr_ptr = NULL;
+
         /*
          *      insert node
          */
@@ -1109,6 +1113,10 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         rt6_stats.fib_rt_entries--;
         rt6_stats.fib_discarded_routes++;
 
+        /* Reset round-robin state, if necessary */
+        if (fn->rr_ptr == rt)
+                fn->rr_ptr = NULL;
+
         /* Adjust walkers */
         read_lock(&fib6_walker_lock);
         FOR_WALKERS(w) {
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 11bfc7c43182..61e7a6c8141d 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -108,8 +108,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         /* pkt_len may be zero if Jumbo payload option is present */
         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
-                if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
-                        goto truncated;
+                if (pkt_len + sizeof(struct ipv6hdr) > skb->len) {
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
+                        goto drop;
+                }
                 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) {
                         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
                         goto drop;
@@ -128,8 +130,6 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         rcu_read_unlock();
 
         return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
-truncated:
-        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 err:
         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
 drop:
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 306d5d83c068..203e069e7fe9 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -687,9 +687,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int err;
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
          */
-        if (len < 0)
+        if (len > INT_MAX)
                 return -EMSGSIZE;
 
         /* Mirror BSD error message compatibility */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0e1f4b2cd3dd..aebb4e2d5ae3 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -308,27 +308,18 @@ static inline void rt6_probe(struct rt6_info *rt)
 /*
  * Default Router Selection (RFC 2461 6.3.6)
  */
-static int inline rt6_check_dev(struct rt6_info *rt, int oif)
+static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 {
         struct net_device *dev = rt->rt6i_dev;
-        int ret = 0;
-
-        if (!oif)
-                return 2;
-        if (dev->flags & IFF_LOOPBACK) {
-                if (!WARN_ON(rt->rt6i_idev == NULL) &&
-                    rt->rt6i_idev->dev->ifindex == oif)
-                        ret = 1;
-                else
-                        return 0;
-        }
-        if (dev->ifindex == oif)
+        if (!oif || dev->ifindex == oif)
                 return 2;
-
-        return ret;
+        if ((dev->flags & IFF_LOOPBACK) &&
+            rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
+                return 1;
+        return 0;
 }
 
-static int inline rt6_check_neigh(struct rt6_info *rt)
+static inline int rt6_check_neigh(struct rt6_info *rt)
 {
         struct neighbour *neigh = rt->rt6i_nexthop;
         int m = 0;
@@ -363,55 +354,76 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         return m;
 }
 
-static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
-                                   int strict)
+static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+                                   int *mpri, struct rt6_info *match)
 {
-        struct rt6_info *match = NULL, *last = NULL;
-        struct rt6_info *rt, *rt0 = *head;
-        u32 metric;
+        int m;
+
+        if (rt6_check_expired(rt))
+                goto out;
+
+        m = rt6_score_route(rt, oif, strict);
+        if (m < 0)
+                goto out;
+
+        if (m > *mpri) {
+                if (strict & RT6_LOOKUP_F_REACHABLE)
+                        rt6_probe(match);
+                *mpri = m;
+                match = rt;
+        } else if (strict & RT6_LOOKUP_F_REACHABLE) {
+                rt6_probe(rt);
+        }
+
+out:
+        return match;
+}
+
+static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+                                     struct rt6_info *rr_head,
+                                     u32 metric, int oif, int strict)
+{
+        struct rt6_info *rt, *match;
         int mpri = -1;
 
-        RT6_TRACE("%s(head=%p(*head=%p), oif=%d)\n",
-                  __FUNCTION__, head, head ? *head : NULL, oif);
+        match = NULL;
+        for (rt = rr_head; rt && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
+        for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
 
-        for (rt = rt0, metric = rt0->rt6i_metric;
-             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
-             rt = rt->u.dst.rt6_next) {
-                int m;
+        return match;
+}
 
-                if (rt6_check_expired(rt))
-                        continue;
+static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+{
+        struct rt6_info *match, *rt0;
 
-                last = rt;
+        RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
+                  __FUNCTION__, fn->leaf, oif);
 
-                m = rt6_score_route(rt, oif, strict);
-                if (m < 0)
-                        continue;
+        rt0 = fn->rr_ptr;
+        if (!rt0)
+                fn->rr_ptr = rt0 = fn->leaf;
 
-                if (m > mpri) {
-                        if (strict & RT6_LOOKUP_F_REACHABLE)
-                                rt6_probe(match);
-                        match = rt;
-                        mpri = m;
-                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
-                        rt6_probe(rt);
-                }
-        }
+        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
 
         if (!match &&
-            (strict & RT6_LOOKUP_F_REACHABLE) &&
-            last && last != rt0) {
+            (strict & RT6_LOOKUP_F_REACHABLE)) {
+                struct rt6_info *next = rt0->u.dst.rt6_next;
+
                 /* no entries matched; do round-robin */
-                static DEFINE_SPINLOCK(lock);
-                spin_lock(&lock);
-                *head = rt0->u.dst.rt6_next;
-                rt0->u.dst.rt6_next = last->u.dst.rt6_next;
-                last->u.dst.rt6_next = rt0;
-                spin_unlock(&lock);
+                if (!next || next->rt6i_metric != rt0->rt6i_metric)
+                        next = fn->leaf;
+
+                if (next != rt0)
+                        fn->rr_ptr = next;
         }
 
-        RT6_TRACE("%s() => %p, score=%d\n",
-                  __FUNCTION__, match, mpri);
+        RT6_TRACE("%s() => %p\n",
+                  __FUNCTION__, match);
 
         return (match ? match : &ip6_null_entry);
 }
@@ -657,7 +669,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->iif, strict | reachable);
+        rt = rt6_select(fn, fl->iif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -752,7 +764,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->oif, strict | reachable);
+        rt = rt6_select(fn, fl->oif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -1754,13 +1766,22 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
  *      Drop the packet on the floor
  */
 
-static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
+static inline int ip6_pkt_drop(struct sk_buff *skb, int code,
+                               int ipstats_mib_noroutes)
 {
-        int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
-        if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
-                IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INADDRERRORS);
-
-        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_OUTNOROUTES);
+        int type;
+        switch (ipstats_mib_noroutes) {
+        case IPSTATS_MIB_INNOROUTES:
+                type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
+                if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED) {
+                        IP6_INC_STATS(ip6_dst_idev(skb->dst), IPSTATS_MIB_INADDRERRORS);
+                        break;
+                }
+                /* FALLTHROUGH */
+        case IPSTATS_MIB_OUTNOROUTES:
+                IP6_INC_STATS(ip6_dst_idev(skb->dst), ipstats_mib_noroutes);
+                break;
+        }
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
         kfree_skb(skb);
         return 0;
@@ -1768,26 +1789,26 @@ static inline int ip6_pkt_drop(struct sk_buff *skb, int code)
 
 static int ip6_pkt_discard(struct sk_buff *skb)
 {
-        return ip6_pkt_drop(skb, ICMPV6_NOROUTE);
+        return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_INNOROUTES);
 }
 
 static int ip6_pkt_discard_out(struct sk_buff *skb)
 {
         skb->dev = skb->dst->dev;
-        return ip6_pkt_discard(skb);
+        return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
 }
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 
 static int ip6_pkt_prohibit(struct sk_buff *skb)
 {
-        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED);
+        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
 }
 
 static int ip6_pkt_prohibit_out(struct sk_buff *skb)
 {
         skb->dev = skb->dst->dev;
-        return ip6_pkt_prohibit(skb);
+        return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
 }
 
 static int ip6_pkt_blk_hole(struct sk_buff *skb)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f57a9baa6b27..92f99927d12d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            First: no IPv4 options.
          */
         newinet->opt = NULL;
+        newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
         newnp->rxopt.all = np->rxopt.all;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 0ad471909881..f590db57a7c9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -615,7 +615,7 @@ do_udp_sendmsg:
                 return udp_sendmsg(iocb, sk, msg, len);
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
            */
         if (len > INT_MAX - sizeof(struct udphdr))
                 return -EMSGSIZE;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index ee4b84a33ff4..93c42232aa39 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -58,7 +58,7 @@ static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
 static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
 
-static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
         unsigned h;
 
@@ -70,7 +70,7 @@ static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
         return h;
 }
 
-static unsigned inline xfrm6_tunnel_spi_hash_byspi(u32 spi)
+static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
 {
         return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }