xref: /linux/net/ipv6/datagram.c (revision 9ce7677cfd7cd871adb457c80bea3b581b839641)
1 /*
2  *	common UDP/RAW code
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Pedro Roque		<roque@di.fc.ul.pt>
7  *
8  *	$Id: datagram.c,v 1.24 2002/02/01 22:01:04 davem Exp $
9  *
10  *	This program is free software; you can redistribute it and/or
11  *      modify it under the terms of the GNU General Public License
12  *      as published by the Free Software Foundation; either version
13  *      2 of the License, or (at your option) any later version.
14  */
15 
16 #include <linux/errno.h>
17 #include <linux/types.h>
18 #include <linux/kernel.h>
19 #include <linux/sched.h>
20 #include <linux/interrupt.h>
21 #include <linux/socket.h>
22 #include <linux/sockios.h>
23 #include <linux/in6.h>
24 #include <linux/ipv6.h>
25 #include <linux/route.h>
26 
27 #include <net/ipv6.h>
28 #include <net/ndisc.h>
29 #include <net/addrconf.h>
30 #include <net/transp_v6.h>
31 #include <net/ip6_route.h>
32 #include <net/tcp_states.h>
33 
34 #include <linux/errqueue.h>
35 #include <asm/uaccess.h>
36 
37 int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
38 {
39 	struct sockaddr_in6	*usin = (struct sockaddr_in6 *) uaddr;
40 	struct inet_sock      	*inet = inet_sk(sk);
41 	struct ipv6_pinfo      	*np = inet6_sk(sk);
42 	struct in6_addr		*daddr, *final_p = NULL, final;
43 	struct dst_entry	*dst;
44 	struct flowi		fl;
45 	struct ip6_flowlabel	*flowlabel = NULL;
46 	int			addr_type;
47 	int			err;
48 
49 	if (usin->sin6_family == AF_INET) {
50 		if (__ipv6_only_sock(sk))
51 			return -EAFNOSUPPORT;
52 		err = ip4_datagram_connect(sk, uaddr, addr_len);
53 		goto ipv4_connected;
54 	}
55 
56 	if (addr_len < SIN6_LEN_RFC2133)
57 	  	return -EINVAL;
58 
59 	if (usin->sin6_family != AF_INET6)
60 	  	return -EAFNOSUPPORT;
61 
62 	memset(&fl, 0, sizeof(fl));
63 	if (np->sndflow) {
64 		fl.fl6_flowlabel = usin->sin6_flowinfo&IPV6_FLOWINFO_MASK;
65 		if (fl.fl6_flowlabel&IPV6_FLOWLABEL_MASK) {
66 			flowlabel = fl6_sock_lookup(sk, fl.fl6_flowlabel);
67 			if (flowlabel == NULL)
68 				return -EINVAL;
69 			ipv6_addr_copy(&usin->sin6_addr, &flowlabel->dst);
70 		}
71 	}
72 
73 	addr_type = ipv6_addr_type(&usin->sin6_addr);
74 
75 	if (addr_type == IPV6_ADDR_ANY) {
76 		/*
77 		 *	connect to self
78 		 */
79 		usin->sin6_addr.s6_addr[15] = 0x01;
80 	}
81 
82 	daddr = &usin->sin6_addr;
83 
84 	if (addr_type == IPV6_ADDR_MAPPED) {
85 		struct sockaddr_in sin;
86 
87 		if (__ipv6_only_sock(sk)) {
88 			err = -ENETUNREACH;
89 			goto out;
90 		}
91 		sin.sin_family = AF_INET;
92 		sin.sin_addr.s_addr = daddr->s6_addr32[3];
93 		sin.sin_port = usin->sin6_port;
94 
95 		err = ip4_datagram_connect(sk,
96 					   (struct sockaddr*) &sin,
97 					   sizeof(sin));
98 
99 ipv4_connected:
100 		if (err)
101 			goto out;
102 
103 		ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
104 
105 		if (ipv6_addr_any(&np->saddr)) {
106 			ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000ffff),
107 				      inet->saddr);
108 		}
109 
110 		if (ipv6_addr_any(&np->rcv_saddr)) {
111 			ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000ffff),
112 				      inet->rcv_saddr);
113 		}
114 		goto out;
115 	}
116 
117 	if (addr_type&IPV6_ADDR_LINKLOCAL) {
118 		if (addr_len >= sizeof(struct sockaddr_in6) &&
119 		    usin->sin6_scope_id) {
120 			if (sk->sk_bound_dev_if &&
121 			    sk->sk_bound_dev_if != usin->sin6_scope_id) {
122 				err = -EINVAL;
123 				goto out;
124 			}
125 			sk->sk_bound_dev_if = usin->sin6_scope_id;
126 			if (!sk->sk_bound_dev_if &&
127 			    (addr_type & IPV6_ADDR_MULTICAST))
128 				fl.oif = np->mcast_oif;
129 		}
130 
131 		/* Connect to link-local address requires an interface */
132 		if (!sk->sk_bound_dev_if) {
133 			err = -EINVAL;
134 			goto out;
135 		}
136 	}
137 
138 	ipv6_addr_copy(&np->daddr, daddr);
139 	np->flow_label = fl.fl6_flowlabel;
140 
141 	inet->dport = usin->sin6_port;
142 
143 	/*
144 	 *	Check for a route to destination an obtain the
145 	 *	destination cache for it.
146 	 */
147 
148 	fl.proto = sk->sk_protocol;
149 	ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
150 	ipv6_addr_copy(&fl.fl6_src, &np->saddr);
151 	fl.oif = sk->sk_bound_dev_if;
152 	fl.fl_ip_dport = inet->dport;
153 	fl.fl_ip_sport = inet->sport;
154 
155 	if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
156 		fl.oif = np->mcast_oif;
157 
158 	if (flowlabel) {
159 		if (flowlabel->opt && flowlabel->opt->srcrt) {
160 			struct rt0_hdr *rt0 = (struct rt0_hdr *) flowlabel->opt->srcrt;
161 			ipv6_addr_copy(&final, &fl.fl6_dst);
162 			ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
163 			final_p = &final;
164 		}
165 	} else if (np->opt && np->opt->srcrt) {
166 		struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
167 		ipv6_addr_copy(&final, &fl.fl6_dst);
168 		ipv6_addr_copy(&fl.fl6_dst, rt0->addr);
169 		final_p = &final;
170 	}
171 
172 	err = ip6_dst_lookup(sk, &dst, &fl);
173 	if (err)
174 		goto out;
175 	if (final_p)
176 		ipv6_addr_copy(&fl.fl6_dst, final_p);
177 
178 	if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
179 		goto out;
180 
181 	/* source address lookup done in ip6_dst_lookup */
182 
183 	if (ipv6_addr_any(&np->saddr))
184 		ipv6_addr_copy(&np->saddr, &fl.fl6_src);
185 
186 	if (ipv6_addr_any(&np->rcv_saddr)) {
187 		ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
188 		inet->rcv_saddr = LOOPBACK4_IPV6;
189 	}
190 
191 	ip6_dst_store(sk, dst,
192 		      ipv6_addr_equal(&fl.fl6_dst, &np->daddr) ?
193 		      &np->daddr : NULL);
194 
195 	sk->sk_state = TCP_ESTABLISHED;
196 out:
197 	fl6_sock_release(flowlabel);
198 	return err;
199 }
200 
201 void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
202 		     u16 port, u32 info, u8 *payload)
203 {
204 	struct ipv6_pinfo *np  = inet6_sk(sk);
205 	struct icmp6hdr *icmph = (struct icmp6hdr *)skb->h.raw;
206 	struct sock_exterr_skb *serr;
207 
208 	if (!np->recverr)
209 		return;
210 
211 	skb = skb_clone(skb, GFP_ATOMIC);
212 	if (!skb)
213 		return;
214 
215 	serr = SKB_EXT_ERR(skb);
216 	serr->ee.ee_errno = err;
217 	serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
218 	serr->ee.ee_type = icmph->icmp6_type;
219 	serr->ee.ee_code = icmph->icmp6_code;
220 	serr->ee.ee_pad = 0;
221 	serr->ee.ee_info = info;
222 	serr->ee.ee_data = 0;
223 	serr->addr_offset = (u8*)&(((struct ipv6hdr*)(icmph+1))->daddr) - skb->nh.raw;
224 	serr->port = port;
225 
226 	skb->h.raw = payload;
227 	__skb_pull(skb, payload - skb->data);
228 
229 	if (sock_queue_err_skb(sk, skb))
230 		kfree_skb(skb);
231 }
232 
233 void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
234 {
235 	struct ipv6_pinfo *np = inet6_sk(sk);
236 	struct sock_exterr_skb *serr;
237 	struct ipv6hdr *iph;
238 	struct sk_buff *skb;
239 
240 	if (!np->recverr)
241 		return;
242 
243 	skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
244 	if (!skb)
245 		return;
246 
247 	iph = (struct ipv6hdr*)skb_put(skb, sizeof(struct ipv6hdr));
248 	skb->nh.ipv6h = iph;
249 	ipv6_addr_copy(&iph->daddr, &fl->fl6_dst);
250 
251 	serr = SKB_EXT_ERR(skb);
252 	serr->ee.ee_errno = err;
253 	serr->ee.ee_origin = SO_EE_ORIGIN_LOCAL;
254 	serr->ee.ee_type = 0;
255 	serr->ee.ee_code = 0;
256 	serr->ee.ee_pad = 0;
257 	serr->ee.ee_info = info;
258 	serr->ee.ee_data = 0;
259 	serr->addr_offset = (u8*)&iph->daddr - skb->nh.raw;
260 	serr->port = fl->fl_ip_dport;
261 
262 	skb->h.raw = skb->tail;
263 	__skb_pull(skb, skb->tail - skb->data);
264 
265 	if (sock_queue_err_skb(sk, skb))
266 		kfree_skb(skb);
267 }
268 
269 /*
270  *	Handle MSG_ERRQUEUE
271  */
272 int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
273 {
274 	struct ipv6_pinfo *np = inet6_sk(sk);
275 	struct sock_exterr_skb *serr;
276 	struct sk_buff *skb, *skb2;
277 	struct sockaddr_in6 *sin;
278 	struct {
279 		struct sock_extended_err ee;
280 		struct sockaddr_in6	 offender;
281 	} errhdr;
282 	int err;
283 	int copied;
284 
285 	err = -EAGAIN;
286 	skb = skb_dequeue(&sk->sk_error_queue);
287 	if (skb == NULL)
288 		goto out;
289 
290 	copied = skb->len;
291 	if (copied > len) {
292 		msg->msg_flags |= MSG_TRUNC;
293 		copied = len;
294 	}
295 	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
296 	if (err)
297 		goto out_free_skb;
298 
299 	sock_recv_timestamp(msg, sk, skb);
300 
301 	serr = SKB_EXT_ERR(skb);
302 
303 	sin = (struct sockaddr_in6 *)msg->msg_name;
304 	if (sin) {
305 		sin->sin6_family = AF_INET6;
306 		sin->sin6_flowinfo = 0;
307 		sin->sin6_port = serr->port;
308 		sin->sin6_scope_id = 0;
309 		if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
310 			ipv6_addr_copy(&sin->sin6_addr,
311 			  (struct in6_addr *)(skb->nh.raw + serr->addr_offset));
312 			if (np->sndflow)
313 				sin->sin6_flowinfo = *(u32*)(skb->nh.raw + serr->addr_offset - 24) & IPV6_FLOWINFO_MASK;
314 			if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
315 				sin->sin6_scope_id = IP6CB(skb)->iif;
316 		} else {
317 			ipv6_addr_set(&sin->sin6_addr, 0, 0,
318 				      htonl(0xffff),
319 				      *(u32*)(skb->nh.raw + serr->addr_offset));
320 		}
321 	}
322 
323 	memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
324 	sin = &errhdr.offender;
325 	sin->sin6_family = AF_UNSPEC;
326 	if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
327 		sin->sin6_family = AF_INET6;
328 		sin->sin6_flowinfo = 0;
329 		sin->sin6_scope_id = 0;
330 		if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
331 			ipv6_addr_copy(&sin->sin6_addr, &skb->nh.ipv6h->saddr);
332 			if (np->rxopt.all)
333 				datagram_recv_ctl(sk, msg, skb);
334 			if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
335 				sin->sin6_scope_id = IP6CB(skb)->iif;
336 		} else {
337 			struct inet_sock *inet = inet_sk(sk);
338 
339 			ipv6_addr_set(&sin->sin6_addr, 0, 0,
340 				      htonl(0xffff),
341 				      skb->nh.iph->saddr);
342 			if (inet->cmsg_flags)
343 				ip_cmsg_recv(msg, skb);
344 		}
345 	}
346 
347 	put_cmsg(msg, SOL_IPV6, IPV6_RECVERR, sizeof(errhdr), &errhdr);
348 
349 	/* Now we could try to dump offended packet options */
350 
351 	msg->msg_flags |= MSG_ERRQUEUE;
352 	err = copied;
353 
354 	/* Reset and regenerate socket error */
355 	spin_lock_bh(&sk->sk_error_queue.lock);
356 	sk->sk_err = 0;
357 	if ((skb2 = skb_peek(&sk->sk_error_queue)) != NULL) {
358 		sk->sk_err = SKB_EXT_ERR(skb2)->ee.ee_errno;
359 		spin_unlock_bh(&sk->sk_error_queue.lock);
360 		sk->sk_error_report(sk);
361 	} else {
362 		spin_unlock_bh(&sk->sk_error_queue.lock);
363 	}
364 
365 out_free_skb:
366 	kfree_skb(skb);
367 out:
368 	return err;
369 }
370 
371 
372 
373 int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
374 {
375 	struct ipv6_pinfo *np = inet6_sk(sk);
376 	struct inet6_skb_parm *opt = IP6CB(skb);
377 
378 	if (np->rxopt.bits.rxinfo) {
379 		struct in6_pktinfo src_info;
380 
381 		src_info.ipi6_ifindex = opt->iif;
382 		ipv6_addr_copy(&src_info.ipi6_addr, &skb->nh.ipv6h->daddr);
383 		put_cmsg(msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
384 	}
385 
386 	if (np->rxopt.bits.rxhlim) {
387 		int hlim = skb->nh.ipv6h->hop_limit;
388 		put_cmsg(msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
389 	}
390 
391 	if (np->rxopt.bits.rxtclass) {
392 		int tclass = (ntohl(*(u32 *)skb->nh.ipv6h) >> 20) & 0xff;
393 		put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
394 	}
395 
396 	if (np->rxopt.bits.rxflow && (*(u32*)skb->nh.raw & IPV6_FLOWINFO_MASK)) {
397 		u32 flowinfo = *(u32*)skb->nh.raw & IPV6_FLOWINFO_MASK;
398 		put_cmsg(msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo);
399 	}
400 
401 	/* HbH is allowed only once */
402 	if (np->rxopt.bits.hopopts && opt->hop) {
403 		u8 *ptr = skb->nh.raw + opt->hop;
404 		put_cmsg(msg, SOL_IPV6, IPV6_HOPOPTS, (ptr[1]+1)<<3, ptr);
405 	}
406 
407 	if (opt->lastopt &&
408 	    (np->rxopt.bits.dstopts || np->rxopt.bits.srcrt)) {
409 		/*
410 		 * Silly enough, but we need to reparse in order to
411 		 * report extension headers (except for HbH)
412 		 * in order.
413 		 *
414 		 * Also note that IPV6_RECVRTHDRDSTOPTS is NOT
415 		 * (and WILL NOT be) defined because
416 		 * IPV6_RECVDSTOPTS is more generic. --yoshfuji
417 		 */
418 		unsigned int off = sizeof(struct ipv6hdr);
419 		u8 nexthdr = skb->nh.ipv6h->nexthdr;
420 
421 		while (off <= opt->lastopt) {
422 			unsigned len;
423 			u8 *ptr = skb->nh.raw + off;
424 
425 			switch(nexthdr) {
426 			case IPPROTO_DSTOPTS:
427 				nexthdr = ptr[0];
428 				len = (ptr[1] + 1) << 3;
429 				if (np->rxopt.bits.dstopts)
430 					put_cmsg(msg, SOL_IPV6, IPV6_DSTOPTS, len, ptr);
431 				break;
432 			case IPPROTO_ROUTING:
433 				nexthdr = ptr[0];
434 				len = (ptr[1] + 1) << 3;
435 				if (np->rxopt.bits.srcrt)
436 					put_cmsg(msg, SOL_IPV6, IPV6_RTHDR, len, ptr);
437 				break;
438 			case IPPROTO_AH:
439 				nexthdr = ptr[0];
440 				len = (ptr[1] + 2) << 2;
441 				break;
442 			default:
443 				nexthdr = ptr[0];
444 				len = (ptr[1] + 1) << 3;
445 				break;
446 			}
447 
448 			off += len;
449 		}
450 	}
451 
452 	/* socket options in old style */
453 	if (np->rxopt.bits.rxoinfo) {
454 		struct in6_pktinfo src_info;
455 
456 		src_info.ipi6_ifindex = opt->iif;
457 		ipv6_addr_copy(&src_info.ipi6_addr, &skb->nh.ipv6h->daddr);
458 		put_cmsg(msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
459 	}
460 	if (np->rxopt.bits.rxohlim) {
461 		int hlim = skb->nh.ipv6h->hop_limit;
462 		put_cmsg(msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim);
463 	}
464 	if (np->rxopt.bits.ohopopts && opt->hop) {
465 		u8 *ptr = skb->nh.raw + opt->hop;
466 		put_cmsg(msg, SOL_IPV6, IPV6_2292HOPOPTS, (ptr[1]+1)<<3, ptr);
467 	}
468 	if (np->rxopt.bits.odstopts && opt->dst0) {
469 		u8 *ptr = skb->nh.raw + opt->dst0;
470 		put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
471 	}
472 	if (np->rxopt.bits.osrcrt && opt->srcrt) {
473 		struct ipv6_rt_hdr *rthdr = (struct ipv6_rt_hdr *)(skb->nh.raw + opt->srcrt);
474 		put_cmsg(msg, SOL_IPV6, IPV6_2292RTHDR, (rthdr->hdrlen+1) << 3, rthdr);
475 	}
476 	if (np->rxopt.bits.odstopts && opt->dst1) {
477 		u8 *ptr = skb->nh.raw + opt->dst1;
478 		put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
479 	}
480 	return 0;
481 }
482 
483 int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
484 		      struct ipv6_txoptions *opt,
485 		      int *hlimit, int *tclass)
486 {
487 	struct in6_pktinfo *src_info;
488 	struct cmsghdr *cmsg;
489 	struct ipv6_rt_hdr *rthdr;
490 	struct ipv6_opt_hdr *hdr;
491 	int len;
492 	int err = 0;
493 
494 	for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
495 		int addr_type;
496 		struct net_device *dev = NULL;
497 
498 		if (!CMSG_OK(msg, cmsg)) {
499 			err = -EINVAL;
500 			goto exit_f;
501 		}
502 
503 		if (cmsg->cmsg_level != SOL_IPV6)
504 			continue;
505 
506 		switch (cmsg->cmsg_type) {
507  		case IPV6_PKTINFO:
508  		case IPV6_2292PKTINFO:
509  			if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) {
510 				err = -EINVAL;
511 				goto exit_f;
512 			}
513 
514 			src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg);
515 
516 			if (src_info->ipi6_ifindex) {
517 				if (fl->oif && src_info->ipi6_ifindex != fl->oif)
518 					return -EINVAL;
519 				fl->oif = src_info->ipi6_ifindex;
520 			}
521 
522 			addr_type = ipv6_addr_type(&src_info->ipi6_addr);
523 
524 			if (addr_type == IPV6_ADDR_ANY)
525 				break;
526 
527 			if (addr_type & IPV6_ADDR_LINKLOCAL) {
528 				if (!src_info->ipi6_ifindex)
529 					return -EINVAL;
530 				else {
531 					dev = dev_get_by_index(src_info->ipi6_ifindex);
532 					if (!dev)
533 						return -ENODEV;
534 				}
535 			}
536 			if (!ipv6_chk_addr(&src_info->ipi6_addr, dev, 0)) {
537 				if (dev)
538 					dev_put(dev);
539 				err = -EINVAL;
540 				goto exit_f;
541 			}
542 			if (dev)
543 				dev_put(dev);
544 
545 			ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
546 			break;
547 
548 		case IPV6_FLOWINFO:
549                         if (cmsg->cmsg_len < CMSG_LEN(4)) {
550 				err = -EINVAL;
551 				goto exit_f;
552 			}
553 
554 			if (fl->fl6_flowlabel&IPV6_FLOWINFO_MASK) {
555 				if ((fl->fl6_flowlabel^*(u32 *)CMSG_DATA(cmsg))&~IPV6_FLOWINFO_MASK) {
556 					err = -EINVAL;
557 					goto exit_f;
558 				}
559 			}
560 			fl->fl6_flowlabel = IPV6_FLOWINFO_MASK & *(u32 *)CMSG_DATA(cmsg);
561 			break;
562 
563 		case IPV6_2292HOPOPTS:
564 		case IPV6_HOPOPTS:
565                         if (opt->hopopt || cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
566 				err = -EINVAL;
567 				goto exit_f;
568 			}
569 
570 			hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg);
571 			len = ((hdr->hdrlen + 1) << 3);
572 			if (cmsg->cmsg_len < CMSG_LEN(len)) {
573 				err = -EINVAL;
574 				goto exit_f;
575 			}
576 			if (!capable(CAP_NET_RAW)) {
577 				err = -EPERM;
578 				goto exit_f;
579 			}
580 			opt->opt_nflen += len;
581 			opt->hopopt = hdr;
582 			break;
583 
584 		case IPV6_2292DSTOPTS:
585                         if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
586 				err = -EINVAL;
587 				goto exit_f;
588 			}
589 
590 			hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg);
591 			len = ((hdr->hdrlen + 1) << 3);
592 			if (cmsg->cmsg_len < CMSG_LEN(len)) {
593 				err = -EINVAL;
594 				goto exit_f;
595 			}
596 			if (!capable(CAP_NET_RAW)) {
597 				err = -EPERM;
598 				goto exit_f;
599 			}
600 			if (opt->dst1opt) {
601 				err = -EINVAL;
602 				goto exit_f;
603 			}
604 			opt->opt_flen += len;
605 			opt->dst1opt = hdr;
606 			break;
607 
608 		case IPV6_DSTOPTS:
609 		case IPV6_RTHDRDSTOPTS:
610 			if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
611 				err = -EINVAL;
612 				goto exit_f;
613 			}
614 
615 			hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg);
616 			len = ((hdr->hdrlen + 1) << 3);
617 			if (cmsg->cmsg_len < CMSG_LEN(len)) {
618 				err = -EINVAL;
619 				goto exit_f;
620 			}
621 			if (!capable(CAP_NET_RAW)) {
622 				err = -EPERM;
623 				goto exit_f;
624 			}
625 			if (cmsg->cmsg_type == IPV6_DSTOPTS) {
626 				opt->opt_flen += len;
627 				opt->dst1opt = hdr;
628 			} else {
629 				opt->opt_nflen += len;
630 				opt->dst0opt = hdr;
631 			}
632 			break;
633 
634 		case IPV6_2292RTHDR:
635 		case IPV6_RTHDR:
636                         if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_rt_hdr))) {
637 				err = -EINVAL;
638 				goto exit_f;
639 			}
640 
641 			rthdr = (struct ipv6_rt_hdr *)CMSG_DATA(cmsg);
642 
643 			/*
644 			 *	TYPE 0
645 			 */
646 			if (rthdr->type) {
647 				err = -EINVAL;
648 				goto exit_f;
649 			}
650 
651 			len = ((rthdr->hdrlen + 1) << 3);
652 
653                         if (cmsg->cmsg_len < CMSG_LEN(len)) {
654 				err = -EINVAL;
655 				goto exit_f;
656 			}
657 
658 			/* segments left must also match */
659 			if ((rthdr->hdrlen >> 1) != rthdr->segments_left) {
660 				err = -EINVAL;
661 				goto exit_f;
662 			}
663 
664 			opt->opt_nflen += len;
665 			opt->srcrt = rthdr;
666 
667 			if (cmsg->cmsg_type == IPV6_2292RTHDR && opt->dst1opt) {
668 				int dsthdrlen = ((opt->dst1opt->hdrlen+1)<<3);
669 
670 				opt->opt_nflen += dsthdrlen;
671 				opt->dst0opt = opt->dst1opt;
672 				opt->dst1opt = NULL;
673 				opt->opt_flen -= dsthdrlen;
674 			}
675 
676 			break;
677 
678 		case IPV6_2292HOPLIMIT:
679 		case IPV6_HOPLIMIT:
680 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
681 				err = -EINVAL;
682 				goto exit_f;
683 			}
684 
685 			*hlimit = *(int *)CMSG_DATA(cmsg);
686 			break;
687 
688 		case IPV6_TCLASS:
689 		    {
690 			int tc;
691 
692 			err = -EINVAL;
693 			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
694 				goto exit_f;
695 			}
696 
697 			tc = *(int *)CMSG_DATA(cmsg);
698 			if (tc < 0 || tc > 0xff)
699 				goto exit_f;
700 
701 			err = 0;
702 			*tclass = tc;
703 
704 			break;
705 		    }
706 		default:
707 			LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
708 			               cmsg->cmsg_type);
709 			err = -EINVAL;
710 			break;
711 		};
712 	}
713 
714 exit_f:
715 	return err;
716 }
717