net/ipv6/icmp.c

   1 /*
   2  *      Internet Control Message Protocol (ICMPv6)
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on net/ipv4/icmp.c
   9  *
  10  *      RFC 1885
  11  *
  12  *      This program is free software; you can redistribute it and/or
  13  *      modify it under the terms of the GNU General Public License
  14  *      as published by the Free Software Foundation; either version
  15  *      2 of the License, or (at your option) any later version.
  16  */
  17
  18 /*
  19  *      Changes:
  20  *
  21  *      Andi Kleen              :       exception handling
  22  *      Andi Kleen                      add rate limits. never reply to a icmp.
  23  *                                      add more length checks and other fixes.
  24  *      yoshfuji                :       ensure to sent parameter problem for
  25  *                                      fragments.
  26  *      YOSHIFUJI Hideaki @USAGI:       added sysctl for icmp rate limit.
  27  *      Randy Dunlap and
  28  *      YOSHIFUJI Hideaki @USAGI:       Per-interface statistics support
  29  *      Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  30  */
  31
  32 #define pr_fmt(fmt) "IPv6: " fmt
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/types.h>
  37 #include <linux/socket.h>
  38 #include <linux/in.h>
  39 #include <linux/kernel.h>
  40 #include <linux/sockios.h>
  41 #include <linux/net.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/init.h>
  44 #include <linux/netfilter.h>
  45 #include <linux/slab.h>
  46
  47 #ifdef CONFIG_SYSCTL
  48 #include <linux/sysctl.h>
  49 #endif
  50
  51 #include <linux/inet.h>
  52 #include <linux/netdevice.h>
  53 #include <linux/icmpv6.h>
  54
  55 #include <net/ip.h>
  56 #include <net/sock.h>
  57
  58 #include <net/ipv6.h>
  59 #include <net/ip6_checksum.h>
  60 #include <net/ping.h>
  61 #include <net/protocol.h>
  62 #include <net/raw.h>
  63 #include <net/rawv6.h>
  64 #include <net/transp_v6.h>
  65 #include <net/ip6_route.h>
  66 #include <net/addrconf.h>
  67 #include <net/icmp.h>
  68 #include <net/xfrm.h>
  69 #include <net/inet_common.h>
  70 #include <net/dsfield.h>
  71 #include <net/l3mdev.h>
  72
  73 #include <asm/uaccess.h>
  74
  75 /*
  76  *      The ICMP socket(s). This is the most convenient way to flow control
  77  *      our ICMP output as well as maintain a clean interface throughout
  78  *      all layers. All Socketless IP sends will soon be gone.
  79  *
  80  *      On SMP we have one ICMP socket per-cpu.
  81  */
  82 static inline struct sock *icmpv6_sk(struct net *net)
  83 {
  84         return net->ipv6.icmp_sk[smp_processor_id()];
  85 }
  86
  87 static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  88                        u8 type, u8 code, int offset, __be32 info)
  89 {
  90         /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  91         struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  92         struct net *net = dev_net(skb->dev);
  93
  94         if (type == ICMPV6_PKT_TOOBIG)
  95                 ip6_update_pmtu(skb, net, info, 0, 0, sock_net_uid(net, NULL));
  96         else if (type == NDISC_REDIRECT)
  97                 ip6_redirect(skb, net, skb->dev->ifindex, 0,
  98                              sock_net_uid(net, NULL));
  99
 100         if (!(type & ICMPV6_INFOMSG_MASK))
 101                 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
 102                         ping_err(skb, offset, ntohl(info));
 103 }
 104
 105 static int icmpv6_rcv(struct sk_buff *skb);
 106
 107 static const struct inet6_protocol icmpv6_protocol = {
 108         .handler        =       icmpv6_rcv,
 109         .err_handler    =       icmpv6_err,
 110         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 111 };
 112
 113 static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
 114 {
 115         struct sock *sk;
 116
 117         local_bh_disable();
 118
 119         sk = icmpv6_sk(net);
 120         if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 121                 /* This can happen if the output path (f.e. SIT or
 122                  * ip6ip6 tunnel) signals dst_link_failure() for an
 123                  * outgoing ICMP6 packet.
 124                  */
 125                 local_bh_enable();
 126                 return NULL;
 127         }
 128         return sk;
 129 }
 130
 131 static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 132 {
 133         spin_unlock_bh(&sk->sk_lock.slock);
 134 }
 135
 136 /*
 137  * Figure out, may we reply to this packet with icmp error.
 138  *
 139  * We do not reply, if:
 140  *      - it was icmp error message.
 141  *      - it is truncated, so that it is known, that protocol is ICMPV6
 142  *        (i.e. in the middle of some exthdr)
 143  *
 144  *      --ANK (980726)
 145  */
 146
 147 static bool is_ineligible(const struct sk_buff *skb)
 148 {
 149         int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 150         int len = skb->len - ptr;
 151         __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 152         __be16 frag_off;
 153
 154         if (len < 0)
 155                 return true;
 156
 157         ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 158         if (ptr < 0)
 159                 return false;
 160         if (nexthdr == IPPROTO_ICMPV6) {
 161                 u8 _type, *tp;
 162                 tp = skb_header_pointer(skb,
 163                         ptr+offsetof(struct icmp6hdr, icmp6_type),
 164                         sizeof(_type), &_type);
 165                 if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
 166                         return true;
 167         }
 168         return false;
 169 }
 170
 171 /*
 172  * Check the ICMP output rate limit
 173  */
 174 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 175                                struct flowi6 *fl6)
 176 {
 177         struct net *net = sock_net(sk);
 178         struct dst_entry *dst;
 179         bool res = false;
 180
 181         /* Informational messages are not limited. */
 182         if (type & ICMPV6_INFOMSG_MASK)
 183                 return true;
 184
 185         /* Do not limit pmtu discovery, it would break it. */
 186         if (type == ICMPV6_PKT_TOOBIG)
 187                 return true;
 188
 189         /*
 190          * Look up the output route.
 191          * XXX: perhaps the expire for routing entries cloned by
 192          * this lookup should be more aggressive (not longer than timeout).
 193          */
 194         dst = ip6_route_output(net, sk, fl6);
 195         if (dst->error) {
 196                 IP6_INC_STATS(net, ip6_dst_idev(dst),
 197                               IPSTATS_MIB_OUTNOROUTES);
 198         } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 199                 res = true;
 200         } else {
 201                 struct rt6_info *rt = (struct rt6_info *)dst;
 202                 int tmo = net->ipv6.sysctl.icmpv6_time;
 203
 204                 /* Give more bandwidth to wider prefixes. */
 205                 if (rt->rt6i_dst.plen < 128)
 206                         tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 207
 208                 if (icmp_global_allow()) {
 209                         struct inet_peer *peer;
 210
 211                         peer = inet_getpeer_v6(net->ipv6.peers,
 212                                                &fl6->daddr, 1);
 213                         res = inet_peer_xrlim_allow(peer, tmo);
 214                         if (peer)
 215                                 inet_putpeer(peer);
 216                 }
 217         }
 218         dst_release(dst);
 219         return res;
 220 }
 221
 222 /*
 223  *      an inline helper for the "simple" if statement below
 224  *      checks if parameter problem report is caused by an
 225  *      unrecognized IPv6 option that has the Option Type
 226  *      highest-order two bits set to 10
 227  */
 228
 229 static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 230 {
 231         u8 _optval, *op;
 232
 233         offset += skb_network_offset(skb);
 234         op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 235         if (!op)
 236                 return true;
 237         return (*op & 0xC0) == 0x80;
 238 }
 239
 240 int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 241                                struct icmp6hdr *thdr, int len)
 242 {
 243         struct sk_buff *skb;
 244         struct icmp6hdr *icmp6h;
 245         int err = 0;
 246
 247         skb = skb_peek(&sk->sk_write_queue);
 248         if (!skb)
 249                 goto out;
 250
 251         icmp6h = icmp6_hdr(skb);
 252         memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 253         icmp6h->icmp6_cksum = 0;
 254
 255         if (skb_queue_len(&sk->sk_write_queue) == 1) {
 256                 skb->csum = csum_partial(icmp6h,
 257                                         sizeof(struct icmp6hdr), skb->csum);
 258                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 259                                                       &fl6->daddr,
 260                                                       len, fl6->flowi6_proto,
 261                                                       skb->csum);
 262         } else {
 263                 __wsum tmp_csum = 0;
 264
 265                 skb_queue_walk(&sk->sk_write_queue, skb) {
 266                         tmp_csum = csum_add(tmp_csum, skb->csum);
 267                 }
 268
 269                 tmp_csum = csum_partial(icmp6h,
 270                                         sizeof(struct icmp6hdr), tmp_csum);
 271                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 272                                                       &fl6->daddr,
 273                                                       len, fl6->flowi6_proto,
 274                                                       tmp_csum);
 275         }
 276         ip6_push_pending_frames(sk);
 277 out:
 278         return err;
 279 }
 280
 281 struct icmpv6_msg {
 282         struct sk_buff  *skb;
 283         int             offset;
 284         uint8_t         type;
 285 };
 286
 287 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 288 {
 289         struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 290         struct sk_buff *org_skb = msg->skb;
 291         __wsum csum = 0;
 292
 293         csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 294                                       to, len, csum);
 295         skb->csum = csum_block_add(skb->csum, csum, odd);
 296         if (!(msg->type & ICMPV6_INFOMSG_MASK))
 297                 nf_ct_attach(skb, org_skb);
 298         return 0;
 299 }
 300
 301 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 302 static void mip6_addr_swap(struct sk_buff *skb)
 303 {
 304         struct ipv6hdr *iph = ipv6_hdr(skb);
 305         struct inet6_skb_parm *opt = IP6CB(skb);
 306         struct ipv6_destopt_hao *hao;
 307         struct in6_addr tmp;
 308         int off;
 309
 310         if (opt->dsthao) {
 311                 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 312                 if (likely(off >= 0)) {
 313                         hao = (struct ipv6_destopt_hao *)
 314                                         (skb_network_header(skb) + off);
 315                         tmp = iph->saddr;
 316                         iph->saddr = hao->addr;
 317                         hao->addr = tmp;
 318                 }
 319         }
 320 }
 321 #else
 322 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 323 #endif
 324
 325 static struct dst_entry *icmpv6_route_lookup(struct net *net,
 326                                              struct sk_buff *skb,
 327                                              struct sock *sk,
 328                                              struct flowi6 *fl6)
 329 {
 330         struct dst_entry *dst, *dst2;
 331         struct flowi6 fl2;
 332         int err;
 333
 334         err = ip6_dst_lookup(net, sk, &dst, fl6);
 335         if (err)
 336                 return ERR_PTR(err);
 337
 338         /*
 339          * We won't send icmp if the destination is known
 340          * anycast.
 341          */
 342         if (ipv6_anycast_destination(dst, &fl6->daddr)) {
 343                 net_dbg_ratelimited("icmp6_send: acast source\n");
 344                 dst_release(dst);
 345                 return ERR_PTR(-EINVAL);
 346         }
 347
 348         /* No need to clone since we're just using its address. */
 349         dst2 = dst;
 350
 351         dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 352         if (!IS_ERR(dst)) {
 353                 if (dst != dst2)
 354                         return dst;
 355         } else {
 356                 if (PTR_ERR(dst) == -EPERM)
 357                         dst = NULL;
 358                 else
 359                         return dst;
 360         }
 361
 362         err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
 363         if (err)
 364                 goto relookup_failed;
 365
 366         err = ip6_dst_lookup(net, sk, &dst2, &fl2);
 367         if (err)
 368                 goto relookup_failed;
 369
 370         dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 371         if (!IS_ERR(dst2)) {
 372                 dst_release(dst);
 373                 dst = dst2;
 374         } else {
 375                 err = PTR_ERR(dst2);
 376                 if (err == -EPERM) {
 377                         dst_release(dst);
 378                         return dst2;
 379                 } else
 380                         goto relookup_failed;
 381         }
 382
 383 relookup_failed:
 384         if (dst)
 385                 return dst;
 386         return ERR_PTR(err);
 387 }
 388
 389 /*
 390  *      Send an ICMP message in response to a packet in error
 391  */
 392 static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 393 {
 394         struct net *net = dev_net(skb->dev);
 395         struct inet6_dev *idev = NULL;
 396         struct ipv6hdr *hdr = ipv6_hdr(skb);
 397         struct sock *sk;
 398         struct ipv6_pinfo *np;
 399         const struct in6_addr *saddr = NULL;
 400         struct dst_entry *dst;
 401         struct icmp6hdr tmp_hdr;
 402         struct flowi6 fl6;
 403         struct icmpv6_msg msg;
 404         int iif = 0;
 405         int addr_type = 0;
 406         int len;
 407         int hlimit;
 408         int err = 0;
 409         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 410
 411         if ((u8 *)hdr < skb->head ||
 412             (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 413                 return;
 414
 415         /*
 416          *      Make sure we respect the rules
 417          *      i.e. RFC 1885 2.4(e)
 418          *      Rule (e.1) is enforced by not using icmp6_send
 419          *      in any code that processes icmp errors.
 420          */
 421         addr_type = ipv6_addr_type(&hdr->daddr);
 422
 423         if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 424             ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 425                 saddr = &hdr->daddr;
 426
 427         /*
 428          *      Dest addr check
 429          */
 430
 431         if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
 432                 if (type != ICMPV6_PKT_TOOBIG &&
 433                     !(type == ICMPV6_PARAMPROB &&
 434                       code == ICMPV6_UNK_OPTION &&
 435                       (opt_unrec(skb, info))))
 436                         return;
 437
 438                 saddr = NULL;
 439         }
 440
 441         addr_type = ipv6_addr_type(&hdr->saddr);
 442
 443         /*
 444          *      Source addr check
 445          */
 446
 447         if (__ipv6_addr_needs_scope_id(addr_type))
 448                 iif = skb->dev->ifindex;
 449
 450         /*
 451          *      Must not send error if the source does not uniquely
 452          *      identify a single node (RFC2463 Section 2.4).
 453          *      We check unspecified / multicast addresses here,
 454          *      and anycast addresses will be checked later.
 455          */
 456         if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 457                 net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
 458                                     &hdr->saddr, &hdr->daddr);
 459                 return;
 460         }
 461
 462         /*
 463          *      Never answer to a ICMP packet.
 464          */
 465         if (is_ineligible(skb)) {
 466                 net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
 467                                     &hdr->saddr, &hdr->daddr);
 468                 return;
 469         }
 470
 471         mip6_addr_swap(skb);
 472
 473         memset(&fl6, 0, sizeof(fl6));
 474         fl6.flowi6_proto = IPPROTO_ICMPV6;
 475         fl6.daddr = hdr->saddr;
 476         if (saddr)
 477                 fl6.saddr = *saddr;
 478         fl6.flowi6_mark = mark;
 479         fl6.flowi6_oif = iif;
 480         fl6.fl6_icmp_type = type;
 481         fl6.fl6_icmp_code = code;
 482         fl6.flowi6_uid = sock_net_uid(net, NULL);
 483         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 484
 485         sk = icmpv6_xmit_lock(net);
 486         if (!sk)
 487                 return;
 488         sk->sk_mark = mark;
 489         np = inet6_sk(sk);
 490
 491         if (!icmpv6_xrlim_allow(sk, type, &fl6))
 492                 goto out;
 493
 494         tmp_hdr.icmp6_type = type;
 495         tmp_hdr.icmp6_code = code;
 496         tmp_hdr.icmp6_cksum = 0;
 497         tmp_hdr.icmp6_pointer = htonl(info);
 498
 499         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 500                 fl6.flowi6_oif = np->mcast_oif;
 501         else if (!fl6.flowi6_oif)
 502                 fl6.flowi6_oif = np->ucast_oif;
 503
 504         if (!fl6.flowi6_oif)
 505                 fl6.flowi6_oif = l3mdev_master_ifindex(skb->dev);
 506
 507         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 508         if (IS_ERR(dst))
 509                 goto out;
 510
 511         hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 512
 513         msg.skb = skb;
 514         msg.offset = skb_network_offset(skb);
 515         msg.type = type;
 516
 517         len = skb->len - msg.offset;
 518         len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr));
 519         if (len < 0) {
 520                 net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
 521                                     &hdr->saddr, &hdr->daddr);
 522                 goto out_dst_release;
 523         }
 524
 525         rcu_read_lock();
 526         idev = __in6_dev_get(skb->dev);
 527
 528         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
 529                               len + sizeof(struct icmp6hdr),
 530                               sizeof(struct icmp6hdr), hlimit,
 531                               np->tclass, NULL, &fl6, (struct rt6_info *)dst,
 532                               MSG_DONTWAIT, np->dontfrag);
 533         if (err) {
 534                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 535                 ip6_flush_pending_frames(sk);
 536         } else {
 537                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 538                                                  len + sizeof(struct icmp6hdr));
 539         }
 540         rcu_read_unlock();
 541 out_dst_release:
 542         dst_release(dst);
 543 out:
 544         icmpv6_xmit_unlock(sk);
 545 }
 546
 547 /* Slightly more convenient version of icmp6_send.
 548  */
 549 void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 550 {
 551         icmp6_send(skb, ICMPV6_PARAMPROB, code, pos);
 552         kfree_skb(skb);
 553 }
 554
 555 static void icmpv6_echo_reply(struct sk_buff *skb)
 556 {
 557         struct net *net = dev_net(skb->dev);
 558         struct sock *sk;
 559         struct inet6_dev *idev;
 560         struct ipv6_pinfo *np;
 561         const struct in6_addr *saddr = NULL;
 562         struct icmp6hdr *icmph = icmp6_hdr(skb);
 563         struct icmp6hdr tmp_hdr;
 564         struct flowi6 fl6;
 565         struct icmpv6_msg msg;
 566         struct dst_entry *dst;
 567         int err = 0;
 568         int hlimit;
 569         u8 tclass;
 570         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 571
 572         saddr = &ipv6_hdr(skb)->daddr;
 573
 574         if (!ipv6_unicast_destination(skb) &&
 575             !(net->ipv6.sysctl.anycast_src_echo_reply &&
 576               ipv6_anycast_destination(skb_dst(skb), saddr)))
 577                 saddr = NULL;
 578
 579         memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 580         tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
 581
 582         memset(&fl6, 0, sizeof(fl6));
 583         fl6.flowi6_proto = IPPROTO_ICMPV6;
 584         fl6.daddr = ipv6_hdr(skb)->saddr;
 585         if (saddr)
 586                 fl6.saddr = *saddr;
 587         fl6.flowi6_oif = l3mdev_fib_oif(skb->dev);
 588         fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
 589         fl6.flowi6_mark = mark;
 590         fl6.flowi6_uid = sock_net_uid(net, NULL);
 591         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 592
 593         sk = icmpv6_xmit_lock(net);
 594         if (!sk)
 595                 return;
 596         sk->sk_mark = mark;
 597         np = inet6_sk(sk);
 598
 599         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 600                 fl6.flowi6_oif = np->mcast_oif;
 601         else if (!fl6.flowi6_oif)
 602                 fl6.flowi6_oif = np->ucast_oif;
 603
 604         err = ip6_dst_lookup(net, sk, &dst, &fl6);
 605         if (err)
 606                 goto out;
 607         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 608         if (IS_ERR(dst))
 609                 goto out;
 610
 611         hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 612
 613         idev = __in6_dev_get(skb->dev);
 614
 615         msg.skb = skb;
 616         msg.offset = 0;
 617         msg.type = ICMPV6_ECHO_REPLY;
 618
 619         tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 620         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
 621                                 sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl6,
 622                                 (struct rt6_info *)dst, MSG_DONTWAIT,
 623                                 np->dontfrag);
 624
 625         if (err) {
 626                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
 627                 ip6_flush_pending_frames(sk);
 628         } else {
 629                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 630                                                  skb->len + sizeof(struct icmp6hdr));
 631         }
 632         dst_release(dst);
 633 out:
 634         icmpv6_xmit_unlock(sk);
 635 }
 636
 637 void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 638 {
 639         const struct inet6_protocol *ipprot;
 640         int inner_offset;
 641         __be16 frag_off;
 642         u8 nexthdr;
 643         struct net *net = dev_net(skb->dev);
 644
 645         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 646                 goto out;
 647
 648         nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
 649         if (ipv6_ext_hdr(nexthdr)) {
 650                 /* now skip over extension headers */
 651                 inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 652                                                 &nexthdr, &frag_off);
 653                 if (inner_offset < 0)
 654                         goto out;
 655         } else {
 656                 inner_offset = sizeof(struct ipv6hdr);
 657         }
 658
 659         /* Checkin header including 8 bytes of inner protocol header. */
 660         if (!pskb_may_pull(skb, inner_offset+8))
 661                 goto out;
 662
 663         /* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
 664            Without this we will not able f.e. to make source routed
 665            pmtu discovery.
 666            Corresponding argument (opt) to notifiers is already added.
 667            --ANK (980726)
 668          */
 669
 670         ipprot = rcu_dereference(inet6_protos[nexthdr]);
 671         if (ipprot && ipprot->err_handler)
 672                 ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
 673
 674         raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
 675         return;
 676
 677 out:
 678         ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 679 }
 680
 681 /*
 682  *      Handle icmp messages
 683  */
 684
 685 static int icmpv6_rcv(struct sk_buff *skb)
 686 {
 687         struct net_device *dev = skb->dev;
 688         struct inet6_dev *idev = __in6_dev_get(dev);
 689         const struct in6_addr *saddr, *daddr;
 690         struct icmp6hdr *hdr;
 691         u8 type;
 692         bool success = false;
 693
 694         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 695                 struct sec_path *sp = skb_sec_path(skb);
 696                 int nh;
 697
 698                 if (!(sp && sp->xvec[sp->len - 1]->props.flags &
 699                                  XFRM_STATE_ICMP))
 700                         goto drop_no_count;
 701
 702                 if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
 703                         goto drop_no_count;
 704
 705                 nh = skb_network_offset(skb);
 706                 skb_set_network_header(skb, sizeof(*hdr));
 707
 708                 if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
 709                         goto drop_no_count;
 710
 711                 skb_set_network_header(skb, nh);
 712         }
 713
 714         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INMSGS);
 715
 716         saddr = &ipv6_hdr(skb)->saddr;
 717         daddr = &ipv6_hdr(skb)->daddr;
 718
 719         if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
 720                 net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
 721                                     saddr, daddr);
 722                 goto csum_error;
 723         }
 724
 725         if (!pskb_pull(skb, sizeof(*hdr)))
 726                 goto discard_it;
 727
 728         hdr = icmp6_hdr(skb);
 729
 730         type = hdr->icmp6_type;
 731
 732         ICMP6MSGIN_INC_STATS_BH(dev_net(dev), idev, type);
 733
 734         switch (type) {
 735         case ICMPV6_ECHO_REQUEST:
 736                 icmpv6_echo_reply(skb);
 737                 break;
 738
 739         case ICMPV6_ECHO_REPLY:
 740                 success = ping_rcv(skb);
 741                 break;
 742
 743         case ICMPV6_PKT_TOOBIG:
 744                 /* BUGGG_FUTURE: if packet contains rthdr, we cannot update
 745                    standard destination cache. Seems, only "advanced"
 746                    destination cache will allow to solve this problem
 747                    --ANK (980726)
 748                  */
 749                 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 750                         goto discard_it;
 751                 hdr = icmp6_hdr(skb);
 752
 753                 /*
 754                  *      Drop through to notify
 755                  */
 756
 757         case ICMPV6_DEST_UNREACH:
 758         case ICMPV6_TIME_EXCEED:
 759         case ICMPV6_PARAMPROB:
 760                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 761                 break;
 762
 763         case NDISC_ROUTER_SOLICITATION:
 764         case NDISC_ROUTER_ADVERTISEMENT:
 765         case NDISC_NEIGHBOUR_SOLICITATION:
 766         case NDISC_NEIGHBOUR_ADVERTISEMENT:
 767         case NDISC_REDIRECT:
 768                 ndisc_rcv(skb);
 769                 break;
 770
 771         case ICMPV6_MGM_QUERY:
 772                 igmp6_event_query(skb);
 773                 break;
 774
 775         case ICMPV6_MGM_REPORT:
 776                 igmp6_event_report(skb);
 777                 break;
 778
 779         case ICMPV6_MGM_REDUCTION:
 780         case ICMPV6_NI_QUERY:
 781         case ICMPV6_NI_REPLY:
 782         case ICMPV6_MLD2_REPORT:
 783         case ICMPV6_DHAAD_REQUEST:
 784         case ICMPV6_DHAAD_REPLY:
 785         case ICMPV6_MOBILE_PREFIX_SOL:
 786         case ICMPV6_MOBILE_PREFIX_ADV:
 787                 break;
 788
 789         default:
 790                 /* informational */
 791                 if (type & ICMPV6_INFOMSG_MASK)
 792                         break;
 793
 794                 net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
 795                                     saddr, daddr);
 796
 797                 /*
 798                  * error of unknown type.
 799                  * must pass to upper level
 800                  */
 801
 802                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 803         }
 804
 805         /* until the v6 path can be better sorted assume failure and
 806          * preserve the status quo behaviour for the rest of the paths to here
 807          */
 808         if (success)
 809                 consume_skb(skb);
 810         else
 811                 kfree_skb(skb);
 812
 813         return 0;
 814
 815 csum_error:
 816         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
 817 discard_it:
 818         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INERRORS);
 819 drop_no_count:
 820         kfree_skb(skb);
 821         return 0;
 822 }
 823
 824 void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
 825                       u8 type,
 826                       const struct in6_addr *saddr,
 827                       const struct in6_addr *daddr,
 828                       int oif)
 829 {
 830         memset(fl6, 0, sizeof(*fl6));
 831         fl6->saddr = *saddr;
 832         fl6->daddr = *daddr;
 833         fl6->flowi6_proto       = IPPROTO_ICMPV6;
 834         fl6->fl6_icmp_type      = type;
 835         fl6->fl6_icmp_code      = 0;
 836         fl6->flowi6_oif         = oif;
 837         security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
 838 }
 839
 840 static int __net_init icmpv6_sk_init(struct net *net)
 841 {
 842         struct sock *sk;
 843         int err, i, j;
 844
 845         net->ipv6.icmp_sk =
 846                 kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
 847         if (!net->ipv6.icmp_sk)
 848                 return -ENOMEM;
 849
 850         for_each_possible_cpu(i) {
 851                 err = inet_ctl_sock_create(&sk, PF_INET6,
 852                                            SOCK_RAW, IPPROTO_ICMPV6, net);
 853                 if (err < 0) {
 854                         pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
 855                                err);
 856                         goto fail;
 857                 }
 858
 859                 net->ipv6.icmp_sk[i] = sk;
 860
 861                 /* Enough space for 2 64K ICMP packets, including
 862                  * sk_buff struct overhead.
 863                  */
 864                 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
 865         }
 866         return 0;
 867
 868  fail:
 869         for (j = 0; j < i; j++)
 870                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
 871         kfree(net->ipv6.icmp_sk);
 872         return err;
 873 }
 874
 875 static void __net_exit icmpv6_sk_exit(struct net *net)
 876 {
 877         int i;
 878
 879         for_each_possible_cpu(i) {
 880                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
 881         }
 882         kfree(net->ipv6.icmp_sk);
 883 }
 884
 885 static struct pernet_operations icmpv6_sk_ops = {
 886         .init = icmpv6_sk_init,
 887         .exit = icmpv6_sk_exit,
 888 };
 889
 890 int __init icmpv6_init(void)
 891 {
 892         int err;
 893
 894         err = register_pernet_subsys(&icmpv6_sk_ops);
 895         if (err < 0)
 896                 return err;
 897
 898         err = -EAGAIN;
 899         if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
 900                 goto fail;
 901
 902         err = inet6_register_icmp_sender(icmp6_send);
 903         if (err)
 904                 goto sender_reg_err;
 905         return 0;
 906
 907 sender_reg_err:
 908         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 909 fail:
 910         pr_err("Failed to register ICMP6 protocol\n");
 911         unregister_pernet_subsys(&icmpv6_sk_ops);
 912         return err;
 913 }
 914
 915 void icmpv6_cleanup(void)
 916 {
 917         inet6_unregister_icmp_sender(icmp6_send);
 918         unregister_pernet_subsys(&icmpv6_sk_ops);
 919         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 920 }
 921
 922
 923 static const struct icmp6_err {
 924         int err;
 925         int fatal;
 926 } tab_unreach[] = {
 927         {       /* NOROUTE */
 928                 .err    = ENETUNREACH,
 929                 .fatal  = 0,
 930         },
 931         {       /* ADM_PROHIBITED */
 932                 .err    = EACCES,
 933                 .fatal  = 1,
 934         },
 935         {       /* Was NOT_NEIGHBOUR, now reserved */
 936                 .err    = EHOSTUNREACH,
 937                 .fatal  = 0,
 938         },
 939         {       /* ADDR_UNREACH */
 940                 .err    = EHOSTUNREACH,
 941                 .fatal  = 0,
 942         },
 943         {       /* PORT_UNREACH */
 944                 .err    = ECONNREFUSED,
 945                 .fatal  = 1,
 946         },
 947         {       /* POLICY_FAIL */
 948                 .err    = EACCES,
 949                 .fatal  = 1,
 950         },
 951         {       /* REJECT_ROUTE */
 952                 .err    = EACCES,
 953                 .fatal  = 1,
 954         },
 955 };
 956
 957 int icmpv6_err_convert(u8 type, u8 code, int *err)
 958 {
 959         int fatal = 0;
 960
 961         *err = EPROTO;
 962
 963         switch (type) {
 964         case ICMPV6_DEST_UNREACH:
 965                 fatal = 1;
 966                 if (code < ARRAY_SIZE(tab_unreach)) {
 967                         *err  = tab_unreach[code].err;
 968                         fatal = tab_unreach[code].fatal;
 969                 }
 970                 break;
 971
 972         case ICMPV6_PKT_TOOBIG:
 973                 *err = EMSGSIZE;
 974                 break;
 975
 976         case ICMPV6_PARAMPROB:
 977                 *err = EPROTO;
 978                 fatal = 1;
 979                 break;
 980
 981         case ICMPV6_TIME_EXCEED:
 982                 *err = EHOSTUNREACH;
 983                 break;
 984         }
 985
 986         return fatal;
 987 }
 988 EXPORT_SYMBOL(icmpv6_err_convert);
 989
 990 #ifdef CONFIG_SYSCTL
 991 static struct ctl_table ipv6_icmp_table_template[] = {
 992         {
 993                 .procname       = "ratelimit",
 994                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
 995                 .maxlen         = sizeof(int),
 996                 .mode           = 0644,
 997                 .proc_handler   = proc_dointvec_ms_jiffies,
 998         },
 999         { },
1000 };
1001
1002 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1003 {
1004         struct ctl_table *table;
1005
1006         table = kmemdup(ipv6_icmp_table_template,
1007                         sizeof(ipv6_icmp_table_template),
1008                         GFP_KERNEL);
1009
1010         if (table)
1011                 table[0].data = &net->ipv6.sysctl.icmpv6_time;
1012
1013         return table;
1014 }
1015 #endif