1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 *	IPv6 BSD socket options interface
4 *	Linux INET6 implementation
5 *
6 *	Authors:
7 *	Pedro Roque		<roque@di.fc.ul.pt>
8 *
9 *	Based on linux/net/ipv4/ip_sockglue.c
10 *
11 *	FIXME: Make the setsockopt code POSIX compliant: That is
12 *
13 *	o	Truncate getsockopt returns
14 *	o	Return an optlen of the truncated length if need be
15 *
16 *	Changes:
17 *	David L Stevens <dlstevens@us.ibm.com>:
18 *		- added multicast source filtering API for MLDv2
19 */
20
21#include <linux/module.h>
22#include <linux/capability.h>
23#include <linux/errno.h>
24#include <linux/types.h>
25#include <linux/socket.h>
26#include <linux/sockios.h>
27#include <linux/net.h>
28#include <linux/in6.h>
29#include <linux/mroute6.h>
30#include <linux/netdevice.h>
31#include <linux/if_arp.h>
32#include <linux/init.h>
33#include <linux/sysctl.h>
34#include <linux/netfilter.h>
35#include <linux/slab.h>
36
37#include <net/sock.h>
38#include <net/snmp.h>
39#include <net/ipv6.h>
40#include <net/ndisc.h>
41#include <net/protocol.h>
42#include <net/transp_v6.h>
43#include <net/ip6_route.h>
44#include <net/addrconf.h>
45#include <net/inet_common.h>
46#include <net/tcp.h>
47#include <net/udp.h>
48#include <net/udplite.h>
49#include <net/xfrm.h>
50#include <net/compat.h>
51#include <net/seg6.h>
52
53#include <linux/uaccess.h>
54
55struct ip6_ra_chain *ip6_ra_chain;
56DEFINE_RWLOCK(ip6_ra_lock);
57
58int ip6_ra_control(struct sock *sk, int sel)
59{
60	struct ip6_ra_chain *ra, *new_ra, **rap;
61
62	/* RA packet may be delivered ONLY to IPPROTO_RAW socket */
63	if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num != IPPROTO_RAW)
64		return -ENOPROTOOPT;
65
66	new_ra = (sel >= 0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
67	if (sel >= 0 && !new_ra)
68		return -ENOMEM;
69
70	write_lock_bh(&ip6_ra_lock);
71	for (rap = &ip6_ra_chain; (ra = *rap) != NULL; rap = &ra->next) {
72		if (ra->sk == sk) {
73			if (sel >= 0) {
74				write_unlock_bh(&ip6_ra_lock);
75				kfree(new_ra);
76				return -EADDRINUSE;
77			}
78
79			*rap = ra->next;
80			write_unlock_bh(&ip6_ra_lock);
81
82			sock_put(sk);
83			kfree(ra);
84			return 0;
85		}
86	}
87	if (!new_ra) {
88		write_unlock_bh(&ip6_ra_lock);
89		return -ENOBUFS;
90	}
91	new_ra->sk = sk;
92	new_ra->sel = sel;
93	new_ra->next = ra;
94	*rap = new_ra;
95	sock_hold(sk);
96	write_unlock_bh(&ip6_ra_lock);
97	return 0;
98}
99
100struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
101					   struct ipv6_txoptions *opt)
102{
103	if (inet_sk(sk)->is_icsk) {
104		if (opt &&
105		    !((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
106		    inet_sk(sk)->inet_daddr != LOOPBACK4_IPV6) {
107			struct inet_connection_sock *icsk = inet_csk(sk);
108			icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
109			icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
110		}
111	}
112	opt = xchg((__force struct ipv6_txoptions **)&inet6_sk(sk)->opt,
113		   opt);
114	sk_dst_reset(sk);
115
116	return opt;
117}
118
119static bool setsockopt_needs_rtnl(int optname)
120{
121	switch (optname) {
122	case IPV6_ADDRFORM:
123	case IPV6_ADD_MEMBERSHIP:
124	case IPV6_DROP_MEMBERSHIP:
125	case IPV6_JOIN_ANYCAST:
126	case IPV6_LEAVE_ANYCAST:
127	case MCAST_JOIN_GROUP:
128	case MCAST_LEAVE_GROUP:
129	case MCAST_JOIN_SOURCE_GROUP:
130	case MCAST_LEAVE_SOURCE_GROUP:
131	case MCAST_BLOCK_SOURCE:
132	case MCAST_UNBLOCK_SOURCE:
133	case MCAST_MSFILTER:
134		return true;
135	}
136	return false;
137}
138
139static int copy_group_source_from_sockptr(struct group_source_req *greqs,
140		sockptr_t optval, int optlen)
141{
142	if (in_compat_syscall()) {
143		struct compat_group_source_req gr32;
144
145		if (optlen < sizeof(gr32))
146			return -EINVAL;
147		if (copy_from_sockptr(&gr32, optval, sizeof(gr32)))
148			return -EFAULT;
149		greqs->gsr_interface = gr32.gsr_interface;
150		greqs->gsr_group = gr32.gsr_group;
151		greqs->gsr_source = gr32.gsr_source;
152	} else {
153		if (optlen < sizeof(*greqs))
154			return -EINVAL;
155		if (copy_from_sockptr(greqs, optval, sizeof(*greqs)))
156			return -EFAULT;
157	}
158
159	return 0;
160}
161
162static int do_ipv6_mcast_group_source(struct sock *sk, int optname,
163		sockptr_t optval, int optlen)
164{
165	struct group_source_req greqs;
166	int omode, add;
167	int ret;
168
169	ret = copy_group_source_from_sockptr(&greqs, optval, optlen);
170	if (ret)
171		return ret;
172
173	if (greqs.gsr_group.ss_family != AF_INET6 ||
174	    greqs.gsr_source.ss_family != AF_INET6)
175		return -EADDRNOTAVAIL;
176
177	if (optname == MCAST_BLOCK_SOURCE) {
178		omode = MCAST_EXCLUDE;
179		add = 1;
180	} else if (optname == MCAST_UNBLOCK_SOURCE) {
181		omode = MCAST_EXCLUDE;
182		add = 0;
183	} else if (optname == MCAST_JOIN_SOURCE_GROUP) {
184		struct sockaddr_in6 *psin6;
185		int retv;
186
187		psin6 = (struct sockaddr_in6 *)&greqs.gsr_group;
188		retv = ipv6_sock_mc_join_ssm(sk, greqs.gsr_interface,
189					     &psin6->sin6_addr,
190					     MCAST_INCLUDE);
191		/* prior join w/ different source is ok */
192		if (retv && retv != -EADDRINUSE)
193			return retv;
194		omode = MCAST_INCLUDE;
195		add = 1;
196	} else /* MCAST_LEAVE_SOURCE_GROUP */ {
197		omode = MCAST_INCLUDE;
198		add = 0;
199	}
200	return ip6_mc_source(add, omode, sk, &greqs);
201}
202
203static int ipv6_set_mcast_msfilter(struct sock *sk, sockptr_t optval,
204		int optlen)
205{
206	struct group_filter *gsf;
207	int ret;
208
209	if (optlen < GROUP_FILTER_SIZE(0))
210		return -EINVAL;
211	if (optlen > READ_ONCE(sysctl_optmem_max))
212		return -ENOBUFS;
213
214	gsf = memdup_sockptr(optval, optlen);
215	if (IS_ERR(gsf))
216		return PTR_ERR(gsf);
217
218	/* numsrc >= (4G-140)/128 overflow in 32 bits */
219	ret = -ENOBUFS;
220	if (gsf->gf_numsrc >= 0x1ffffffU ||
221	    gsf->gf_numsrc > sysctl_mld_max_msf)
222		goto out_free_gsf;
223
224	ret = -EINVAL;
225	if (GROUP_FILTER_SIZE(gsf->gf_numsrc) > optlen)
226		goto out_free_gsf;
227
228	ret = ip6_mc_msfilter(sk, gsf, gsf->gf_slist);
229out_free_gsf:
230	kfree(gsf);
231	return ret;
232}
233
234static int compat_ipv6_set_mcast_msfilter(struct sock *sk, sockptr_t optval,
235		int optlen)
236{
237	const int size0 = offsetof(struct compat_group_filter, gf_slist);
238	struct compat_group_filter *gf32;
239	void *p;
240	int ret;
241	int n;
242
243	if (optlen < size0)
244		return -EINVAL;
245	if (optlen > READ_ONCE(sysctl_optmem_max) - 4)
246		return -ENOBUFS;
247
248	p = kmalloc(optlen + 4, GFP_KERNEL);
249	if (!p)
250		return -ENOMEM;
251
252	gf32 = p + 4; /* we want ->gf_group and ->gf_slist aligned */
253	ret = -EFAULT;
254	if (copy_from_sockptr(gf32, optval, optlen))
255		goto out_free_p;
256
257	/* numsrc >= (4G-140)/128 overflow in 32 bits */
258	ret = -ENOBUFS;
259	n = gf32->gf_numsrc;
260	if (n >= 0x1ffffffU || n > sysctl_mld_max_msf)
261		goto out_free_p;
262
263	ret = -EINVAL;
264	if (offsetof(struct compat_group_filter, gf_slist[n]) > optlen)
265		goto out_free_p;
266
267	ret = ip6_mc_msfilter(sk, &(struct group_filter){
268			.gf_interface = gf32->gf_interface,
269			.gf_group = gf32->gf_group,
270			.gf_fmode = gf32->gf_fmode,
271			.gf_numsrc = gf32->gf_numsrc}, gf32->gf_slist);
272
273out_free_p:
274	kfree(p);
275	return ret;
276}
277
278static int ipv6_mcast_join_leave(struct sock *sk, int optname,
279		sockptr_t optval, int optlen)
280{
281	struct sockaddr_in6 *psin6;
282	struct group_req greq;
283
284	if (optlen < sizeof(greq))
285		return -EINVAL;
286	if (copy_from_sockptr(&greq, optval, sizeof(greq)))
287		return -EFAULT;
288
289	if (greq.gr_group.ss_family != AF_INET6)
290		return -EADDRNOTAVAIL;
291	psin6 = (struct sockaddr_in6 *)&greq.gr_group;
292	if (optname == MCAST_JOIN_GROUP)
293		return ipv6_sock_mc_join(sk, greq.gr_interface,
294					 &psin6->sin6_addr);
295	return ipv6_sock_mc_drop(sk, greq.gr_interface, &psin6->sin6_addr);
296}
297
298static int compat_ipv6_mcast_join_leave(struct sock *sk, int optname,
299		sockptr_t optval, int optlen)
300{
301	struct compat_group_req gr32;
302	struct sockaddr_in6 *psin6;
303
304	if (optlen < sizeof(gr32))
305		return -EINVAL;
306	if (copy_from_sockptr(&gr32, optval, sizeof(gr32)))
307		return -EFAULT;
308
309	if (gr32.gr_group.ss_family != AF_INET6)
310		return -EADDRNOTAVAIL;
311	psin6 = (struct sockaddr_in6 *)&gr32.gr_group;
312	if (optname == MCAST_JOIN_GROUP)
313		return ipv6_sock_mc_join(sk, gr32.gr_interface,
314					&psin6->sin6_addr);
315	return ipv6_sock_mc_drop(sk, gr32.gr_interface, &psin6->sin6_addr);
316}
317
318static int ipv6_set_opt_hdr(struct sock *sk, int optname, sockptr_t optval,
319		int optlen)
320{
321	struct ipv6_pinfo *np = inet6_sk(sk);
322	struct ipv6_opt_hdr *new = NULL;
323	struct net *net = sock_net(sk);
324	struct ipv6_txoptions *opt;
325	int err;
326
327	/* hop-by-hop / destination options are privileged option */
328	if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
329		return -EPERM;
330
331	/* remove any sticky options header with a zero option
332	 * length, per RFC3542.
333	 */
334	if (optlen > 0) {
335		if (sockptr_is_null(optval))
336			return -EINVAL;
337		if (optlen < sizeof(struct ipv6_opt_hdr) ||
338		    optlen & 0x7 ||
339		    optlen > 8 * 255)
340			return -EINVAL;
341
342		new = memdup_sockptr(optval, optlen);
343		if (IS_ERR(new))
344			return PTR_ERR(new);
345		if (unlikely(ipv6_optlen(new) > optlen)) {
346			kfree(new);
347			return -EINVAL;
348		}
349	}
350
351	opt = rcu_dereference_protected(np->opt, lockdep_sock_is_held(sk));
352	opt = ipv6_renew_options(sk, opt, optname, new);
353	kfree(new);
354	if (IS_ERR(opt))
355		return PTR_ERR(opt);
356
357	/* routing header option needs extra check */
358	err = -EINVAL;
359	if (optname == IPV6_RTHDR && opt && opt->srcrt) {
360		struct ipv6_rt_hdr *rthdr = opt->srcrt;
361		switch (rthdr->type) {
362#if IS_ENABLED(CONFIG_IPV6_MIP6)
363		case IPV6_SRCRT_TYPE_2:
364			if (rthdr->hdrlen != 2 || rthdr->segments_left != 1)
365				goto sticky_done;
366			break;
367#endif
368		case IPV6_SRCRT_TYPE_4:
369		{
370			struct ipv6_sr_hdr *srh =
371				(struct ipv6_sr_hdr *)opt->srcrt;
372
373			if (!seg6_validate_srh(srh, optlen, false))
374				goto sticky_done;
375			break;
376		}
377		default:
378			goto sticky_done;
379		}
380	}
381
382	err = 0;
383	opt = ipv6_update_options(sk, opt);
384sticky_done:
385	if (opt) {
386		atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
387		txopt_put(opt);
388	}
389	return err;
390}
391
392static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
393		   sockptr_t optval, unsigned int optlen)
394{
395	struct ipv6_pinfo *np = inet6_sk(sk);
396	struct net *net = sock_net(sk);
397	int val, valbool;
398	int retv = -ENOPROTOOPT;
399	bool needs_rtnl = setsockopt_needs_rtnl(optname);
400
401	if (sockptr_is_null(optval))
402		val = 0;
403	else {
404		if (optlen >= sizeof(int)) {
405			if (copy_from_sockptr(&val, optval, sizeof(val)))
406				return -EFAULT;
407		} else
408			val = 0;
409	}
410
411	valbool = (val != 0);
412
413	if (ip6_mroute_opt(optname))
414		return ip6_mroute_setsockopt(sk, optname, optval, optlen);
415
416	if (needs_rtnl)
417		rtnl_lock();
418	lock_sock(sk);
419
420	/* Another thread has converted the socket into IPv4 with
421	 * IPV6_ADDRFORM concurrently.
422	 */
423	if (unlikely(sk->sk_family != AF_INET6))
424		goto unlock;
425
426	switch (optname) {
427
428	case IPV6_ADDRFORM:
429		if (optlen < sizeof(int))
430			goto e_inval;
431		if (val == PF_INET) {
432			if (sk->sk_type == SOCK_RAW)
433				break;
434
435			if (sk->sk_protocol == IPPROTO_UDP ||
436			    sk->sk_protocol == IPPROTO_UDPLITE) {
437				struct udp_sock *up = udp_sk(sk);
438				if (up->pending == AF_INET6) {
439					retv = -EBUSY;
440					break;
441				}
442			} else if (sk->sk_protocol == IPPROTO_TCP) {
443				if (sk->sk_prot != &tcpv6_prot) {
444					retv = -EBUSY;
445					break;
446				}
447			} else {
448				break;
449			}
450
451			if (sk->sk_state != TCP_ESTABLISHED) {
452				retv = -ENOTCONN;
453				break;
454			}
455
456			if (ipv6_only_sock(sk) ||
457			    !ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
458				retv = -EADDRNOTAVAIL;
459				break;
460			}
461
462			__ipv6_sock_mc_close(sk);
463			__ipv6_sock_ac_close(sk);
464
465			/*
466			 * Sock is moving from IPv6 to IPv4 (sk_prot), so
467			 * remove it from the refcnt debug socks count in the
468			 * original family...
469			 */
470			sk_refcnt_debug_dec(sk);
471
472			if (sk->sk_protocol == IPPROTO_TCP) {
473				struct inet_connection_sock *icsk = inet_csk(sk);
474				local_bh_disable();
475				sock_prot_inuse_add(net, sk->sk_prot, -1);
476				sock_prot_inuse_add(net, &tcp_prot, 1);
477				local_bh_enable();
478				/* Paired with READ_ONCE(sk->sk_prot) in inet6_stream_ops */
479				WRITE_ONCE(sk->sk_prot, &tcp_prot);
480				/* Paired with READ_ONCE() in tcp_(get|set)sockopt() */
481				WRITE_ONCE(icsk->icsk_af_ops, &ipv4_specific);
482				sk->sk_socket->ops = &inet_stream_ops;
483				sk->sk_family = PF_INET;
484				tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
485			} else {
486				struct proto *prot = &udp_prot;
487
488				if (sk->sk_protocol == IPPROTO_UDPLITE)
489					prot = &udplite_prot;
490				local_bh_disable();
491				sock_prot_inuse_add(net, sk->sk_prot, -1);
492				sock_prot_inuse_add(net, prot, 1);
493				local_bh_enable();
494				/* Paired with READ_ONCE(sk->sk_prot) in inet6_dgram_ops */
495				WRITE_ONCE(sk->sk_prot, prot);
496				sk->sk_socket->ops = &inet_dgram_ops;
497				sk->sk_family = PF_INET;
498			}
499
500			/* Disable all options not to allocate memory anymore,
501			 * but there is still a race.  See the lockless path
502			 * in udpv6_sendmsg() and ipv6_local_rxpmtu().
503			 */
504			np->rxopt.all = 0;
505
506			inet6_cleanup_sock(sk);
507
508			/*
509			 * ... and add it to the refcnt debug socks count
510			 * in the new family. -acme
511			 */
512			sk_refcnt_debug_inc(sk);
513			module_put(THIS_MODULE);
514			retv = 0;
515			break;
516		}
517		goto e_inval;
518
519	case IPV6_V6ONLY:
520		if (optlen < sizeof(int) ||
521		    inet_sk(sk)->inet_num)
522			goto e_inval;
523		sk->sk_ipv6only = valbool;
524		retv = 0;
525		break;
526
527	case IPV6_RECVPKTINFO:
528		if (optlen < sizeof(int))
529			goto e_inval;
530		np->rxopt.bits.rxinfo = valbool;
531		retv = 0;
532		break;
533
534	case IPV6_2292PKTINFO:
535		if (optlen < sizeof(int))
536			goto e_inval;
537		np->rxopt.bits.rxoinfo = valbool;
538		retv = 0;
539		break;
540
541	case IPV6_RECVHOPLIMIT:
542		if (optlen < sizeof(int))
543			goto e_inval;
544		np->rxopt.bits.rxhlim = valbool;
545		retv = 0;
546		break;
547
548	case IPV6_2292HOPLIMIT:
549		if (optlen < sizeof(int))
550			goto e_inval;
551		np->rxopt.bits.rxohlim = valbool;
552		retv = 0;
553		break;
554
555	case IPV6_RECVRTHDR:
556		if (optlen < sizeof(int))
557			goto e_inval;
558		np->rxopt.bits.srcrt = valbool;
559		retv = 0;
560		break;
561
562	case IPV6_2292RTHDR:
563		if (optlen < sizeof(int))
564			goto e_inval;
565		np->rxopt.bits.osrcrt = valbool;
566		retv = 0;
567		break;
568
569	case IPV6_RECVHOPOPTS:
570		if (optlen < sizeof(int))
571			goto e_inval;
572		np->rxopt.bits.hopopts = valbool;
573		retv = 0;
574		break;
575
576	case IPV6_2292HOPOPTS:
577		if (optlen < sizeof(int))
578			goto e_inval;
579		np->rxopt.bits.ohopopts = valbool;
580		retv = 0;
581		break;
582
583	case IPV6_RECVDSTOPTS:
584		if (optlen < sizeof(int))
585			goto e_inval;
586		np->rxopt.bits.dstopts = valbool;
587		retv = 0;
588		break;
589
590	case IPV6_2292DSTOPTS:
591		if (optlen < sizeof(int))
592			goto e_inval;
593		np->rxopt.bits.odstopts = valbool;
594		retv = 0;
595		break;
596
597	case IPV6_TCLASS:
598		if (optlen < sizeof(int))
599			goto e_inval;
600		if (val < -1 || val > 0xff)
601			goto e_inval;
602		/* RFC 3542, 6.5: default traffic class of 0x0 */
603		if (val == -1)
604			val = 0;
605		np->tclass = val;
606		retv = 0;
607		break;
608
609	case IPV6_RECVTCLASS:
610		if (optlen < sizeof(int))
611			goto e_inval;
612		np->rxopt.bits.rxtclass = valbool;
613		retv = 0;
614		break;
615
616	case IPV6_FLOWINFO:
617		if (optlen < sizeof(int))
618			goto e_inval;
619		np->rxopt.bits.rxflow = valbool;
620		retv = 0;
621		break;
622
623	case IPV6_RECVPATHMTU:
624		if (optlen < sizeof(int))
625			goto e_inval;
626		np->rxopt.bits.rxpmtu = valbool;
627		retv = 0;
628		break;
629
630	case IPV6_TRANSPARENT:
631		if (valbool && !ns_capable(net->user_ns, CAP_NET_RAW) &&
632		    !ns_capable(net->user_ns, CAP_NET_ADMIN)) {
633			retv = -EPERM;
634			break;
635		}
636		if (optlen < sizeof(int))
637			goto e_inval;
638		/* we don't have a separate transparent bit for IPV6 we use the one in the IPv4 socket */
639		inet_sk(sk)->transparent = valbool;
640		retv = 0;
641		break;
642
643	case IPV6_FREEBIND:
644		if (optlen < sizeof(int))
645			goto e_inval;
646		/* we also don't have a separate freebind bit for IPV6 */
647		inet_sk(sk)->freebind = valbool;
648		retv = 0;
649		break;
650
651	case IPV6_RECVORIGDSTADDR:
652		if (optlen < sizeof(int))
653			goto e_inval;
654		np->rxopt.bits.rxorigdstaddr = valbool;
655		retv = 0;
656		break;
657
658	case IPV6_HOPOPTS:
659	case IPV6_RTHDRDSTOPTS:
660	case IPV6_RTHDR:
661	case IPV6_DSTOPTS:
662		retv = ipv6_set_opt_hdr(sk, optname, optval, optlen);
663		break;
664
665	case IPV6_PKTINFO:
666	{
667		struct in6_pktinfo pkt;
668
669		if (optlen == 0)
670			goto e_inval;
671		else if (optlen < sizeof(struct in6_pktinfo) ||
672			 sockptr_is_null(optval))
673			goto e_inval;
674
675		if (copy_from_sockptr(&pkt, optval, sizeof(pkt))) {
676			retv = -EFAULT;
677			break;
678		}
679		if (!sk_dev_equal_l3scope(sk, pkt.ipi6_ifindex))
680			goto e_inval;
681
682		np->sticky_pktinfo.ipi6_ifindex = pkt.ipi6_ifindex;
683		np->sticky_pktinfo.ipi6_addr = pkt.ipi6_addr;
684		retv = 0;
685		break;
686	}
687
688	case IPV6_2292PKTOPTIONS:
689	{
690		struct ipv6_txoptions *opt = NULL;
691		struct msghdr msg;
692		struct flowi6 fl6;
693		struct ipcm6_cookie ipc6;
694
695		memset(&fl6, 0, sizeof(fl6));
696		fl6.flowi6_oif = sk->sk_bound_dev_if;
697		fl6.flowi6_mark = sk->sk_mark;
698
699		if (optlen == 0)
700			goto update;
701
702		/* 1K is probably excessive
703		 * 1K is surely not enough, 2K per standard header is 16K.
704		 */
705		retv = -EINVAL;
706		if (optlen > 64*1024)
707			break;
708
709		opt = sock_kmalloc(sk, sizeof(*opt) + optlen, GFP_KERNEL);
710		retv = -ENOBUFS;
711		if (!opt)
712			break;
713
714		memset(opt, 0, sizeof(*opt));
715		refcount_set(&opt->refcnt, 1);
716		opt->tot_len = sizeof(*opt) + optlen;
717		retv = -EFAULT;
718		if (copy_from_sockptr(opt + 1, optval, optlen))
719			goto done;
720
721		msg.msg_controllen = optlen;
722		msg.msg_control = (void *)(opt+1);
723		ipc6.opt = opt;
724
725		retv = ip6_datagram_send_ctl(net, sk, &msg, &fl6, &ipc6);
726		if (retv)
727			goto done;
728update:
729		retv = 0;
730		opt = ipv6_update_options(sk, opt);
731done:
732		if (opt) {
733			atomic_sub(opt->tot_len, &sk->sk_omem_alloc);
734			txopt_put(opt);
735		}
736		break;
737	}
738	case IPV6_UNICAST_HOPS:
739		if (optlen < sizeof(int))
740			goto e_inval;
741		if (val > 255 || val < -1)
742			goto e_inval;
743		np->hop_limit = val;
744		retv = 0;
745		break;
746
747	case IPV6_MULTICAST_HOPS:
748		if (sk->sk_type == SOCK_STREAM)
749			break;
750		if (optlen < sizeof(int))
751			goto e_inval;
752		if (val > 255 || val < -1)
753			goto e_inval;
754		np->mcast_hops = (val == -1 ? IPV6_DEFAULT_MCASTHOPS : val);
755		retv = 0;
756		break;
757
758	case IPV6_MULTICAST_LOOP:
759		if (optlen < sizeof(int))
760			goto e_inval;
761		if (val != valbool)
762			goto e_inval;
763		np->mc_loop = valbool;
764		retv = 0;
765		break;
766
767	case IPV6_UNICAST_IF:
768	{
769		struct net_device *dev = NULL;
770		int ifindex;
771
772		if (optlen != sizeof(int))
773			goto e_inval;
774
775		ifindex = (__force int)ntohl((__force __be32)val);
776		if (ifindex == 0) {
777			np->ucast_oif = 0;
778			retv = 0;
779			break;
780		}
781
782		dev = dev_get_by_index(net, ifindex);
783		retv = -EADDRNOTAVAIL;
784		if (!dev)
785			break;
786		dev_put(dev);
787
788		retv = -EINVAL;
789		if (sk->sk_bound_dev_if)
790			break;
791
792		np->ucast_oif = ifindex;
793		retv = 0;
794		break;
795	}
796
797	case IPV6_MULTICAST_IF:
798		if (sk->sk_type == SOCK_STREAM)
799			break;
800		if (optlen < sizeof(int))
801			goto e_inval;
802
803		if (val) {
804			struct net_device *dev;
805			int midx;
806
807			rcu_read_lock();
808
809			dev = dev_get_by_index_rcu(net, val);
810			if (!dev) {
811				rcu_read_unlock();
812				retv = -ENODEV;
813				break;
814			}
815			midx = l3mdev_master_ifindex_rcu(dev);
816
817			rcu_read_unlock();
818
819			if (sk->sk_bound_dev_if &&
820			    sk->sk_bound_dev_if != val &&
821			    (!midx || midx != sk->sk_bound_dev_if))
822				goto e_inval;
823		}
824		np->mcast_oif = val;
825		retv = 0;
826		break;
827	case IPV6_ADD_MEMBERSHIP:
828	case IPV6_DROP_MEMBERSHIP:
829	{
830		struct ipv6_mreq mreq;
831
832		if (optlen < sizeof(struct ipv6_mreq))
833			goto e_inval;
834
835		retv = -EPROTO;
836		if (inet_sk(sk)->is_icsk)
837			break;
838
839		retv = -EFAULT;
840		if (copy_from_sockptr(&mreq, optval, sizeof(struct ipv6_mreq)))
841			break;
842
843		if (optname == IPV6_ADD_MEMBERSHIP)
844			retv = ipv6_sock_mc_join(sk, mreq.ipv6mr_ifindex, &mreq.ipv6mr_multiaddr);
845		else
846			retv = ipv6_sock_mc_drop(sk, mreq.ipv6mr_ifindex, &mreq.ipv6mr_multiaddr);
847		break;
848	}
849	case IPV6_JOIN_ANYCAST:
850	case IPV6_LEAVE_ANYCAST:
851	{
852		struct ipv6_mreq mreq;
853
854		if (optlen < sizeof(struct ipv6_mreq))
855			goto e_inval;
856
857		retv = -EFAULT;
858		if (copy_from_sockptr(&mreq, optval, sizeof(struct ipv6_mreq)))
859			break;
860
861		if (optname == IPV6_JOIN_ANYCAST)
862			retv = ipv6_sock_ac_join(sk, mreq.ipv6mr_ifindex, &mreq.ipv6mr_acaddr);
863		else
864			retv = ipv6_sock_ac_drop(sk, mreq.ipv6mr_ifindex, &mreq.ipv6mr_acaddr);
865		break;
866	}
867	case IPV6_MULTICAST_ALL:
868		if (optlen < sizeof(int))
869			goto e_inval;
870		np->mc_all = valbool;
871		retv = 0;
872		break;
873
874	case MCAST_JOIN_GROUP:
875	case MCAST_LEAVE_GROUP:
876		if (in_compat_syscall())
877			retv = compat_ipv6_mcast_join_leave(sk, optname, optval,
878							    optlen);
879		else
880			retv = ipv6_mcast_join_leave(sk, optname, optval,
881						     optlen);
882		break;
883	case MCAST_JOIN_SOURCE_GROUP:
884	case MCAST_LEAVE_SOURCE_GROUP:
885	case MCAST_BLOCK_SOURCE:
886	case MCAST_UNBLOCK_SOURCE:
887		retv = do_ipv6_mcast_group_source(sk, optname, optval, optlen);
888		break;
889	case MCAST_MSFILTER:
890		if (in_compat_syscall())
891			retv = compat_ipv6_set_mcast_msfilter(sk, optval,
892							      optlen);
893		else
894			retv = ipv6_set_mcast_msfilter(sk, optval, optlen);
895		break;
896	case IPV6_ROUTER_ALERT:
897		if (optlen < sizeof(int))
898			goto e_inval;
899		retv = ip6_ra_control(sk, val);
900		break;
901	case IPV6_ROUTER_ALERT_ISOLATE:
902		if (optlen < sizeof(int))
903			goto e_inval;
904		np->rtalert_isolate = valbool;
905		retv = 0;
906		break;
907	case IPV6_MTU_DISCOVER:
908		if (optlen < sizeof(int))
909			goto e_inval;
910		if (val < IPV6_PMTUDISC_DONT || val > IPV6_PMTUDISC_OMIT)
911			goto e_inval;
912		np->pmtudisc = val;
913		retv = 0;
914		break;
915	case IPV6_MTU:
916		if (optlen < sizeof(int))
917			goto e_inval;
918		if (val && val < IPV6_MIN_MTU)
919			goto e_inval;
920		np->frag_size = val;
921		retv = 0;
922		break;
923	case IPV6_RECVERR:
924		if (optlen < sizeof(int))
925			goto e_inval;
926		np->recverr = valbool;
927		if (!val)
928			skb_queue_purge(&sk->sk_error_queue);
929		retv = 0;
930		break;
931	case IPV6_FLOWINFO_SEND:
932		if (optlen < sizeof(int))
933			goto e_inval;
934		np->sndflow = valbool;
935		retv = 0;
936		break;
937	case IPV6_FLOWLABEL_MGR:
938		retv = ipv6_flowlabel_opt(sk, optval, optlen);
939		break;
940	case IPV6_IPSEC_POLICY:
941	case IPV6_XFRM_POLICY:
942		retv = -EPERM;
943		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
944			break;
945		retv = xfrm_user_policy(sk, optname, optval, optlen);
946		break;
947
948	case IPV6_ADDR_PREFERENCES:
949		if (optlen < sizeof(int))
950			goto e_inval;
951		retv = __ip6_sock_set_addr_preferences(sk, val);
952		break;
953	case IPV6_MINHOPCOUNT:
954		if (optlen < sizeof(int))
955			goto e_inval;
956		if (val < 0 || val > 255)
957			goto e_inval;
958		np->min_hopcount = val;
959		retv = 0;
960		break;
961	case IPV6_DONTFRAG:
962		np->dontfrag = valbool;
963		retv = 0;
964		break;
965	case IPV6_AUTOFLOWLABEL:
966		np->autoflowlabel = valbool;
967		np->autoflowlabel_set = 1;
968		retv = 0;
969		break;
970	case IPV6_RECVFRAGSIZE:
971		np->rxopt.bits.recvfragsize = valbool;
972		retv = 0;
973		break;
974	case IPV6_RECVERR_RFC4884:
975		if (optlen < sizeof(int))
976			goto e_inval;
977		if (val < 0 || val > 1)
978			goto e_inval;
979		np->recverr_rfc4884 = valbool;
980		retv = 0;
981		break;
982	}
983
984unlock:
985	release_sock(sk);
986	if (needs_rtnl)
987		rtnl_unlock();
988
989	return retv;
990
991e_inval:
992	release_sock(sk);
993	if (needs_rtnl)
994		rtnl_unlock();
995	return -EINVAL;
996}
997
998int ipv6_setsockopt(struct sock *sk, int level, int optname, sockptr_t optval,
999		    unsigned int optlen)
1000{
1001	int err;
1002
1003	if (level == SOL_IP && sk->sk_type != SOCK_RAW)
1004		return udp_prot.setsockopt(sk, level, optname, optval, optlen);
1005
1006	if (level != SOL_IPV6)
1007		return -ENOPROTOOPT;
1008
1009	err = do_ipv6_setsockopt(sk, level, optname, optval, optlen);
1010#ifdef CONFIG_NETFILTER
1011	/* we need to exclude all possible ENOPROTOOPTs except default case */
1012	if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
1013			optname != IPV6_XFRM_POLICY)
1014		err = nf_setsockopt(sk, PF_INET6, optname, optval, optlen);
1015#endif
1016	return err;
1017}
1018EXPORT_SYMBOL(ipv6_setsockopt);
1019
1020static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
1021				  int optname, char __user *optval, int len)
1022{
1023	struct ipv6_opt_hdr *hdr;
1024
1025	if (!opt)
1026		return 0;
1027
1028	switch (optname) {
1029	case IPV6_HOPOPTS:
1030		hdr = opt->hopopt;
1031		break;
1032	case IPV6_RTHDRDSTOPTS:
1033		hdr = opt->dst0opt;
1034		break;
1035	case IPV6_RTHDR:
1036		hdr = (struct ipv6_opt_hdr *)opt->srcrt;
1037		break;
1038	case IPV6_DSTOPTS:
1039		hdr = opt->dst1opt;
1040		break;
1041	default:
1042		return -EINVAL;	/* should not happen */
1043	}
1044
1045	if (!hdr)
1046		return 0;
1047
1048	len = min_t(unsigned int, len, ipv6_optlen(hdr));
1049	if (copy_to_user(optval, hdr, len))
1050		return -EFAULT;
1051	return len;
1052}
1053
1054static int ipv6_get_msfilter(struct sock *sk, void __user *optval,
1055		int __user *optlen, int len)
1056{
1057	const int size0 = offsetof(struct group_filter, gf_slist);
1058	struct group_filter __user *p = optval;
1059	struct group_filter gsf;
1060	int num;
1061	int err;
1062
1063	if (len < size0)
1064		return -EINVAL;
1065	if (copy_from_user(&gsf, p, size0))
1066		return -EFAULT;
1067	if (gsf.gf_group.ss_family != AF_INET6)
1068		return -EADDRNOTAVAIL;
1069	num = gsf.gf_numsrc;
1070	lock_sock(sk);
1071	err = ip6_mc_msfget(sk, &gsf, p->gf_slist);
1072	if (!err) {
1073		if (num > gsf.gf_numsrc)
1074			num = gsf.gf_numsrc;
1075		if (put_user(GROUP_FILTER_SIZE(num), optlen) ||
1076		    copy_to_user(p, &gsf, size0))
1077			err = -EFAULT;
1078	}
1079	release_sock(sk);
1080	return err;
1081}
1082
1083static int compat_ipv6_get_msfilter(struct sock *sk, void __user *optval,
1084		int __user *optlen)
1085{
1086	const int size0 = offsetof(struct compat_group_filter, gf_slist);
1087	struct compat_group_filter __user *p = optval;
1088	struct compat_group_filter gf32;
1089	struct group_filter gf;
1090	int len, err;
1091	int num;
1092
1093	if (get_user(len, optlen))
1094		return -EFAULT;
1095	if (len < size0)
1096		return -EINVAL;
1097
1098	if (copy_from_user(&gf32, p, size0))
1099		return -EFAULT;
1100	gf.gf_interface = gf32.gf_interface;
1101	gf.gf_fmode = gf32.gf_fmode;
1102	num = gf.gf_numsrc = gf32.gf_numsrc;
1103	gf.gf_group = gf32.gf_group;
1104
1105	if (gf.gf_group.ss_family != AF_INET6)
1106		return -EADDRNOTAVAIL;
1107
1108	lock_sock(sk);
1109	err = ip6_mc_msfget(sk, &gf, p->gf_slist);
1110	release_sock(sk);
1111	if (err)
1112		return err;
1113	if (num > gf.gf_numsrc)
1114		num = gf.gf_numsrc;
1115	len = GROUP_FILTER_SIZE(num) - (sizeof(gf)-sizeof(gf32));
1116	if (put_user(len, optlen) ||
1117	    put_user(gf.gf_fmode, &p->gf_fmode) ||
1118	    put_user(gf.gf_numsrc, &p->gf_numsrc))
1119		return -EFAULT;
1120	return 0;
1121}
1122
1123static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
1124		    char __user *optval, int __user *optlen, unsigned int flags)
1125{
1126	struct ipv6_pinfo *np = inet6_sk(sk);
1127	int len;
1128	int val;
1129
1130	if (ip6_mroute_opt(optname))
1131		return ip6_mroute_getsockopt(sk, optname, optval, optlen);
1132
1133	if (get_user(len, optlen))
1134		return -EFAULT;
1135	switch (optname) {
1136	case IPV6_ADDRFORM:
1137		if (sk->sk_protocol != IPPROTO_UDP &&
1138		    sk->sk_protocol != IPPROTO_UDPLITE &&
1139		    sk->sk_protocol != IPPROTO_TCP)
1140			return -ENOPROTOOPT;
1141		if (sk->sk_state != TCP_ESTABLISHED)
1142			return -ENOTCONN;
1143		val = sk->sk_family;
1144		break;
1145	case MCAST_MSFILTER:
1146		if (in_compat_syscall())
1147			return compat_ipv6_get_msfilter(sk, optval, optlen);
1148		return ipv6_get_msfilter(sk, optval, optlen, len);
1149	case IPV6_2292PKTOPTIONS:
1150	{
1151		struct msghdr msg;
1152		struct sk_buff *skb;
1153
1154		if (sk->sk_type != SOCK_STREAM)
1155			return -ENOPROTOOPT;
1156
1157		msg.msg_control = optval;
1158		msg.msg_controllen = len;
1159		msg.msg_flags = flags;
1160		msg.msg_control_is_user = true;
1161
1162		lock_sock(sk);
1163		skb = np->pktoptions;
1164		if (skb)
1165			ip6_datagram_recv_ctl(sk, &msg, skb);
1166		release_sock(sk);
1167		if (!skb) {
1168			if (np->rxopt.bits.rxinfo) {
1169				struct in6_pktinfo src_info;
1170				src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif :
1171					np->sticky_pktinfo.ipi6_ifindex;
1172				src_info.ipi6_addr = np->mcast_oif ? sk->sk_v6_daddr : np->sticky_pktinfo.ipi6_addr;
1173				put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
1174			}
1175			if (np->rxopt.bits.rxhlim) {
1176				int hlim = np->mcast_hops;
1177				put_cmsg(&msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
1178			}
1179			if (np->rxopt.bits.rxtclass) {
1180				int tclass = (int)ip6_tclass(np->rcv_flowinfo);
1181
1182				put_cmsg(&msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
1183			}
1184			if (np->rxopt.bits.rxoinfo) {
1185				struct in6_pktinfo src_info;
1186				src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif :
1187					np->sticky_pktinfo.ipi6_ifindex;
1188				src_info.ipi6_addr = np->mcast_oif ? sk->sk_v6_daddr :
1189								     np->sticky_pktinfo.ipi6_addr;
1190				put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
1191			}
1192			if (np->rxopt.bits.rxohlim) {
1193				int hlim = np->mcast_hops;
1194				put_cmsg(&msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim);
1195			}
1196			if (np->rxopt.bits.rxflow) {
1197				__be32 flowinfo = np->rcv_flowinfo;
1198
1199				put_cmsg(&msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo);
1200			}
1201		}
1202		len -= msg.msg_controllen;
1203		return put_user(len, optlen);
1204	}
1205	case IPV6_MTU:
1206	{
1207		struct dst_entry *dst;
1208
1209		val = 0;
1210		rcu_read_lock();
1211		dst = __sk_dst_get(sk);
1212		if (dst)
1213			val = dst_mtu(dst);
1214		rcu_read_unlock();
1215		if (!val)
1216			return -ENOTCONN;
1217		break;
1218	}
1219
1220	case IPV6_V6ONLY:
1221		val = sk->sk_ipv6only;
1222		break;
1223
1224	case IPV6_RECVPKTINFO:
1225		val = np->rxopt.bits.rxinfo;
1226		break;
1227
1228	case IPV6_2292PKTINFO:
1229		val = np->rxopt.bits.rxoinfo;
1230		break;
1231
1232	case IPV6_RECVHOPLIMIT:
1233		val = np->rxopt.bits.rxhlim;
1234		break;
1235
1236	case IPV6_2292HOPLIMIT:
1237		val = np->rxopt.bits.rxohlim;
1238		break;
1239
1240	case IPV6_RECVRTHDR:
1241		val = np->rxopt.bits.srcrt;
1242		break;
1243
1244	case IPV6_2292RTHDR:
1245		val = np->rxopt.bits.osrcrt;
1246		break;
1247
1248	case IPV6_HOPOPTS:
1249	case IPV6_RTHDRDSTOPTS:
1250	case IPV6_RTHDR:
1251	case IPV6_DSTOPTS:
1252	{
1253		struct ipv6_txoptions *opt;
1254
1255		lock_sock(sk);
1256		opt = rcu_dereference_protected(np->opt,
1257						lockdep_sock_is_held(sk));
1258		len = ipv6_getsockopt_sticky(sk, opt, optname, optval, len);
1259		release_sock(sk);
1260		/* check if ipv6_getsockopt_sticky() returns err code */
1261		if (len < 0)
1262			return len;
1263		return put_user(len, optlen);
1264	}
1265
1266	case IPV6_RECVHOPOPTS:
1267		val = np->rxopt.bits.hopopts;
1268		break;
1269
1270	case IPV6_2292HOPOPTS:
1271		val = np->rxopt.bits.ohopopts;
1272		break;
1273
1274	case IPV6_RECVDSTOPTS:
1275		val = np->rxopt.bits.dstopts;
1276		break;
1277
1278	case IPV6_2292DSTOPTS:
1279		val = np->rxopt.bits.odstopts;
1280		break;
1281
1282	case IPV6_TCLASS:
1283		val = np->tclass;
1284		break;
1285
1286	case IPV6_RECVTCLASS:
1287		val = np->rxopt.bits.rxtclass;
1288		break;
1289
1290	case IPV6_FLOWINFO:
1291		val = np->rxopt.bits.rxflow;
1292		break;
1293
1294	case IPV6_RECVPATHMTU:
1295		val = np->rxopt.bits.rxpmtu;
1296		break;
1297
1298	case IPV6_PATHMTU:
1299	{
1300		struct dst_entry *dst;
1301		struct ip6_mtuinfo mtuinfo;
1302
1303		if (len < sizeof(mtuinfo))
1304			return -EINVAL;
1305
1306		len = sizeof(mtuinfo);
1307		memset(&mtuinfo, 0, sizeof(mtuinfo));
1308
1309		rcu_read_lock();
1310		dst = __sk_dst_get(sk);
1311		if (dst)
1312			mtuinfo.ip6m_mtu = dst_mtu(dst);
1313		rcu_read_unlock();
1314		if (!mtuinfo.ip6m_mtu)
1315			return -ENOTCONN;
1316
1317		if (put_user(len, optlen))
1318			return -EFAULT;
1319		if (copy_to_user(optval, &mtuinfo, len))
1320			return -EFAULT;
1321
1322		return 0;
1323	}
1324
1325	case IPV6_TRANSPARENT:
1326		val = inet_sk(sk)->transparent;
1327		break;
1328
1329	case IPV6_FREEBIND:
1330		val = inet_sk(sk)->freebind;
1331		break;
1332
1333	case IPV6_RECVORIGDSTADDR:
1334		val = np->rxopt.bits.rxorigdstaddr;
1335		break;
1336
1337	case IPV6_UNICAST_HOPS:
1338	case IPV6_MULTICAST_HOPS:
1339	{
1340		struct dst_entry *dst;
1341
1342		if (optname == IPV6_UNICAST_HOPS)
1343			val = np->hop_limit;
1344		else
1345			val = np->mcast_hops;
1346
1347		if (val < 0) {
1348			rcu_read_lock();
1349			dst = __sk_dst_get(sk);
1350			if (dst)
1351				val = ip6_dst_hoplimit(dst);
1352			rcu_read_unlock();
1353		}
1354
1355		if (val < 0)
1356			val = sock_net(sk)->ipv6.devconf_all->hop_limit;
1357		break;
1358	}
1359
1360	case IPV6_MULTICAST_LOOP:
1361		val = np->mc_loop;
1362		break;
1363
1364	case IPV6_MULTICAST_IF:
1365		val = np->mcast_oif;
1366		break;
1367
1368	case IPV6_MULTICAST_ALL:
1369		val = np->mc_all;
1370		break;
1371
1372	case IPV6_UNICAST_IF:
1373		val = (__force int)htonl((__u32) np->ucast_oif);
1374		break;
1375
1376	case IPV6_MTU_DISCOVER:
1377		val = np->pmtudisc;
1378		break;
1379
1380	case IPV6_RECVERR:
1381		val = np->recverr;
1382		break;
1383
1384	case IPV6_FLOWINFO_SEND:
1385		val = np->sndflow;
1386		break;
1387
1388	case IPV6_FLOWLABEL_MGR:
1389	{
1390		struct in6_flowlabel_req freq;
1391		int flags;
1392
1393		if (len < sizeof(freq))
1394			return -EINVAL;
1395
1396		if (copy_from_user(&freq, optval, sizeof(freq)))
1397			return -EFAULT;
1398
1399		if (freq.flr_action != IPV6_FL_A_GET)
1400			return -EINVAL;
1401
1402		len = sizeof(freq);
1403		flags = freq.flr_flags;
1404
1405		memset(&freq, 0, sizeof(freq));
1406
1407		val = ipv6_flowlabel_opt_get(sk, &freq, flags);
1408		if (val < 0)
1409			return val;
1410
1411		if (put_user(len, optlen))
1412			return -EFAULT;
1413		if (copy_to_user(optval, &freq, len))
1414			return -EFAULT;
1415
1416		return 0;
1417	}
1418
1419	case IPV6_ADDR_PREFERENCES:
1420		val = 0;
1421
1422		if (np->srcprefs & IPV6_PREFER_SRC_TMP)
1423			val |= IPV6_PREFER_SRC_TMP;
1424		else if (np->srcprefs & IPV6_PREFER_SRC_PUBLIC)
1425			val |= IPV6_PREFER_SRC_PUBLIC;
1426		else {
1427			/* XXX: should we return system default? */
1428			val |= IPV6_PREFER_SRC_PUBTMP_DEFAULT;
1429		}
1430
1431		if (np->srcprefs & IPV6_PREFER_SRC_COA)
1432			val |= IPV6_PREFER_SRC_COA;
1433		else
1434			val |= IPV6_PREFER_SRC_HOME;
1435		break;
1436
1437	case IPV6_MINHOPCOUNT:
1438		val = np->min_hopcount;
1439		break;
1440
1441	case IPV6_DONTFRAG:
1442		val = np->dontfrag;
1443		break;
1444
1445	case IPV6_AUTOFLOWLABEL:
1446		val = ip6_autoflowlabel(sock_net(sk), np);
1447		break;
1448
1449	case IPV6_RECVFRAGSIZE:
1450		val = np->rxopt.bits.recvfragsize;
1451		break;
1452
1453	case IPV6_ROUTER_ALERT_ISOLATE:
1454		val = np->rtalert_isolate;
1455		break;
1456
1457	case IPV6_RECVERR_RFC4884:
1458		val = np->recverr_rfc4884;
1459		break;
1460
1461	default:
1462		return -ENOPROTOOPT;
1463	}
1464	len = min_t(unsigned int, sizeof(int), len);
1465	if (put_user(len, optlen))
1466		return -EFAULT;
1467	if (copy_to_user(optval, &val, len))
1468		return -EFAULT;
1469	return 0;
1470}
1471
1472int ipv6_getsockopt(struct sock *sk, int level, int optname,
1473		    char __user *optval, int __user *optlen)
1474{
1475	int err;
1476
1477	if (level == SOL_IP && sk->sk_type != SOCK_RAW)
1478		return udp_prot.getsockopt(sk, level, optname, optval, optlen);
1479
1480	if (level != SOL_IPV6)
1481		return -ENOPROTOOPT;
1482
1483	err = do_ipv6_getsockopt(sk, level, optname, optval, optlen, 0);
1484#ifdef CONFIG_NETFILTER
1485	/* we need to exclude all possible ENOPROTOOPTs except default case */
1486	if (err == -ENOPROTOOPT && optname != IPV6_2292PKTOPTIONS) {
1487		int len;
1488
1489		if (get_user(len, optlen))
1490			return -EFAULT;
1491
1492		err = nf_getsockopt(sk, PF_INET6, optname, optval, &len);
1493		if (err >= 0)
1494			err = put_user(len, optlen);
1495	}
1496#endif
1497	return err;
1498}
1499EXPORT_SYMBOL(ipv6_getsockopt);
1500