Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

[linux.git] / net / ipv4 / route.c

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 621f83434b2494784ec2b92824a2743be8817e21..f88c93c38f1173614363b10cab7362771dd9ed8c 100644 (file)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1894,10 +1894,7 @@ static void ip_multipath_l3_keys(const struct sk_buff *skb,
        if (!icmph)
                goto out;
 
-       if (icmph->type != ICMP_DEST_UNREACH &&
-           icmph->type != ICMP_REDIRECT &&
-           icmph->type != ICMP_TIME_EXCEEDED &&
-           icmph->type != ICMP_PARAMETERPROB)
+       if (!icmp_is_err(icmph->type))
                goto out;
 
        inner_iph = skb_header_pointer(skb,
@@ -2022,10 +2019,52 @@ static int ip_mkroute_input(struct sk_buff *skb,
        return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
 }
 
+/* Implements all the saddr-related checks as ip_route_input_slow(),
+ * assuming daddr is valid and the destination is not a local broadcast one.
+ * Uses the provided hint instead of performing a route lookup.
+ */
+int ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                     u8 tos, struct net_device *dev,
+                     const struct sk_buff *hint)
+{
+       struct in_device *in_dev = __in_dev_get_rcu(dev);
+       struct rtable *rt = (struct rtable *)hint;
+       struct net *net = dev_net(dev);
+       int err = -EINVAL;
+       u32 tag = 0;
+
+       if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr))
+               goto martian_source;
+
+       if (ipv4_is_zeronet(saddr))
+               goto martian_source;
+
+       if (ipv4_is_loopback(saddr) && !IN_DEV_NET_ROUTE_LOCALNET(in_dev, net))
+               goto martian_source;
+
+       if (rt->rt_type != RTN_LOCAL)
+               goto skip_validate_source;
+
+       tos &= IPTOS_RT_MASK;
+       err = fib_validate_source(skb, saddr, daddr, tos, 0, dev, in_dev, &tag);
+       if (err < 0)
+               goto martian_source;
+
+skip_validate_source:
+       skb_dst_copy(skb, hint);
+       return 0;
+
+martian_source:
+       ip_handle_martian_source(dev, in_dev, skb, daddr, saddr);
+       return err;
+}
+
 /*
  *     NOTE. We drop all the packets that has local source
  *     addresses, because every properly looped back packet
  *     must have correct destination already attached by output routine.
+ *     Changes in the enforced policies must be applied also to
+ *     ip_route_use_hint().
  *
  *     Such approach solves two big problems:
  *     1. Not simplex devices are handled properly.