net/ipv6/icmp.c

   1 /*
   2  *      Internet Control Message Protocol (ICMPv6)
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on net/ipv4/icmp.c
   9  *
  10  *      RFC 1885
  11  *
  12  *      This program is free software; you can redistribute it and/or
  13  *      modify it under the terms of the GNU General Public License
  14  *      as published by the Free Software Foundation; either version
  15  *      2 of the License, or (at your option) any later version.
  16  */
  17
  18 /*
  19  *      Changes:
  20  *
  21  *      Andi Kleen              :       exception handling
  22  *      Andi Kleen                      add rate limits. never reply to a icmp.
  23  *                                      add more length checks and other fixes.
  24  *      yoshfuji                :       ensure to sent parameter problem for
  25  *                                      fragments.
  26  *      YOSHIFUJI Hideaki @USAGI:       added sysctl for icmp rate limit.
  27  *      Randy Dunlap and
  28  *      YOSHIFUJI Hideaki @USAGI:       Per-interface statistics support
  29  *      Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  30  */
  31
  32 #define pr_fmt(fmt) "IPv6: " fmt
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/types.h>
  37 #include <linux/socket.h>
  38 #include <linux/in.h>
  39 #include <linux/kernel.h>
  40 #include <linux/sockios.h>
  41 #include <linux/net.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/init.h>
  44 #include <linux/netfilter.h>
  45 #include <linux/slab.h>
  46
  47 #ifdef CONFIG_SYSCTL
  48 #include <linux/sysctl.h>
  49 #endif
  50
  51 #include <linux/inet.h>
  52 #include <linux/netdevice.h>
  53 #include <linux/icmpv6.h>
  54
  55 #include <net/ip.h>
  56 #include <net/sock.h>
  57
  58 #include <net/ipv6.h>
  59 #include <net/ip6_checksum.h>
  60 #include <net/ping.h>
  61 #include <net/protocol.h>
  62 #include <net/raw.h>
  63 #include <net/rawv6.h>
  64 #include <net/transp_v6.h>
  65 #include <net/ip6_route.h>
  66 #include <net/addrconf.h>
  67 #include <net/icmp.h>
  68 #include <net/xfrm.h>
  69 #include <net/inet_common.h>
  70 #include <net/dsfield.h>
  71 #include <net/l3mdev.h>
  72
  73 #include <asm/uaccess.h>
  74
  75 /*
  76  *      The ICMP socket(s). This is the most convenient way to flow control
  77  *      our ICMP output as well as maintain a clean interface throughout
  78  *      all layers. All Socketless IP sends will soon be gone.
  79  *
  80  *      On SMP we have one ICMP socket per-cpu.
  81  */
  82 static inline struct sock *icmpv6_sk(struct net *net)
  83 {
  84         return net->ipv6.icmp_sk[smp_processor_id()];
  85 }
  86
  87 static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  88                        u8 type, u8 code, int offset, __be32 info)
  89 {
  90         /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  91         struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  92         struct net *net = dev_net(skb->dev);
  93
  94         if (type == ICMPV6_PKT_TOOBIG)
  95                 ip6_update_pmtu(skb, net, info, 0, 0);
  96         else if (type == NDISC_REDIRECT)
  97                 ip6_redirect(skb, net, skb->dev->ifindex, 0);
  98
  99         if (!(type & ICMPV6_INFOMSG_MASK))
 100                 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
 101                         ping_err(skb, offset, info);
 102 }
 103
 104 static int icmpv6_rcv(struct sk_buff *skb);
 105
 106 static const struct inet6_protocol icmpv6_protocol = {
 107         .handler        =       icmpv6_rcv,
 108         .err_handler    =       icmpv6_err,
 109         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 110 };
 111
 112 static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
 113 {
 114         struct sock *sk;
 115
 116         local_bh_disable();
 117
 118         sk = icmpv6_sk(net);
 119         if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 120                 /* This can happen if the output path (f.e. SIT or
 121                  * ip6ip6 tunnel) signals dst_link_failure() for an
 122                  * outgoing ICMP6 packet.
 123                  */
 124                 local_bh_enable();
 125                 return NULL;
 126         }
 127         return sk;
 128 }
 129
 130 static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 131 {
 132         spin_unlock_bh(&sk->sk_lock.slock);
 133 }
 134
 135 /*
 136  * Figure out, may we reply to this packet with icmp error.
 137  *
 138  * We do not reply, if:
 139  *      - it was icmp error message.
 140  *      - it is truncated, so that it is known, that protocol is ICMPV6
 141  *        (i.e. in the middle of some exthdr)
 142  *
 143  *      --ANK (980726)
 144  */
 145
 146 static bool is_ineligible(const struct sk_buff *skb)
 147 {
 148         int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 149         int len = skb->len - ptr;
 150         __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 151         __be16 frag_off;
 152
 153         if (len < 0)
 154                 return true;
 155
 156         ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 157         if (ptr < 0)
 158                 return false;
 159         if (nexthdr == IPPROTO_ICMPV6) {
 160                 u8 _type, *tp;
 161                 tp = skb_header_pointer(skb,
 162                         ptr+offsetof(struct icmp6hdr, icmp6_type),
 163                         sizeof(_type), &_type);
 164                 if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
 165                         return true;
 166         }
 167         return false;
 168 }
 169
 170 /*
 171  * Check the ICMP output rate limit
 172  */
 173 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 174                                struct flowi6 *fl6)
 175 {
 176         struct net *net = sock_net(sk);
 177         struct dst_entry *dst;
 178         bool res = false;
 179
 180         /* Informational messages are not limited. */
 181         if (type & ICMPV6_INFOMSG_MASK)
 182                 return true;
 183
 184         /* Do not limit pmtu discovery, it would break it. */
 185         if (type == ICMPV6_PKT_TOOBIG)
 186                 return true;
 187
 188         /*
 189          * Look up the output route.
 190          * XXX: perhaps the expire for routing entries cloned by
 191          * this lookup should be more aggressive (not longer than timeout).
 192          */
 193         dst = ip6_route_output(net, sk, fl6);
 194         if (dst->error) {
 195                 IP6_INC_STATS(net, ip6_dst_idev(dst),
 196                               IPSTATS_MIB_OUTNOROUTES);
 197         } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 198                 res = true;
 199         } else {
 200                 struct rt6_info *rt = (struct rt6_info *)dst;
 201                 int tmo = net->ipv6.sysctl.icmpv6_time;
 202
 203                 /* Give more bandwidth to wider prefixes. */
 204                 if (rt->rt6i_dst.plen < 128)
 205                         tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 206
 207                 if (icmp_global_allow()) {
 208                         struct inet_peer *peer;
 209
 210                         peer = inet_getpeer_v6(net->ipv6.peers,
 211                                                &fl6->daddr, 1);
 212                         res = inet_peer_xrlim_allow(peer, tmo);
 213                         if (peer)
 214                                 inet_putpeer(peer);
 215                 }
 216         }
 217         dst_release(dst);
 218         return res;
 219 }
 220
 221 /*
 222  *      an inline helper for the "simple" if statement below
 223  *      checks if parameter problem report is caused by an
 224  *      unrecognized IPv6 option that has the Option Type
 225  *      highest-order two bits set to 10
 226  */
 227
 228 static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 229 {
 230         u8 _optval, *op;
 231
 232         offset += skb_network_offset(skb);
 233         op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 234         if (!op)
 235                 return true;
 236         return (*op & 0xC0) == 0x80;
 237 }
 238
 239 int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 240                                struct icmp6hdr *thdr, int len)
 241 {
 242         struct sk_buff *skb;
 243         struct icmp6hdr *icmp6h;
 244         int err = 0;
 245
 246         skb = skb_peek(&sk->sk_write_queue);
 247         if (!skb)
 248                 goto out;
 249
 250         icmp6h = icmp6_hdr(skb);
 251         memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 252         icmp6h->icmp6_cksum = 0;
 253
 254         if (skb_queue_len(&sk->sk_write_queue) == 1) {
 255                 skb->csum = csum_partial(icmp6h,
 256                                         sizeof(struct icmp6hdr), skb->csum);
 257                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 258                                                       &fl6->daddr,
 259                                                       len, fl6->flowi6_proto,
 260                                                       skb->csum);
 261         } else {
 262                 __wsum tmp_csum = 0;
 263
 264                 skb_queue_walk(&sk->sk_write_queue, skb) {
 265                         tmp_csum = csum_add(tmp_csum, skb->csum);
 266                 }
 267
 268                 tmp_csum = csum_partial(icmp6h,
 269                                         sizeof(struct icmp6hdr), tmp_csum);
 270                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 271                                                       &fl6->daddr,
 272                                                       len, fl6->flowi6_proto,
 273                                                       tmp_csum);
 274         }
 275         ip6_push_pending_frames(sk);
 276 out:
 277         return err;
 278 }
 279
 280 struct icmpv6_msg {
 281         struct sk_buff  *skb;
 282         int             offset;
 283         uint8_t         type;
 284 };
 285
 286 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 287 {
 288         struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 289         struct sk_buff *org_skb = msg->skb;
 290         __wsum csum = 0;
 291
 292         csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 293                                       to, len, csum);
 294         skb->csum = csum_block_add(skb->csum, csum, odd);
 295         if (!(msg->type & ICMPV6_INFOMSG_MASK))
 296                 nf_ct_attach(skb, org_skb);
 297         return 0;
 298 }
 299
 300 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 301 static void mip6_addr_swap(struct sk_buff *skb)
 302 {
 303         struct ipv6hdr *iph = ipv6_hdr(skb);
 304         struct inet6_skb_parm *opt = IP6CB(skb);
 305         struct ipv6_destopt_hao *hao;
 306         struct in6_addr tmp;
 307         int off;
 308
 309         if (opt->dsthao) {
 310                 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 311                 if (likely(off >= 0)) {
 312                         hao = (struct ipv6_destopt_hao *)
 313                                         (skb_network_header(skb) + off);
 314                         tmp = iph->saddr;
 315                         iph->saddr = hao->addr;
 316                         hao->addr = tmp;
 317                 }
 318         }
 319 }
 320 #else
 321 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 322 #endif
 323
 324 static struct dst_entry *icmpv6_route_lookup(struct net *net,
 325                                              struct sk_buff *skb,
 326                                              struct sock *sk,
 327                                              struct flowi6 *fl6)
 328 {
 329         struct dst_entry *dst, *dst2;
 330         struct flowi6 fl2;
 331         int err;
 332
 333         err = ip6_dst_lookup(net, sk, &dst, fl6);
 334         if (err)
 335                 return ERR_PTR(err);
 336
 337         /*
 338          * We won't send icmp if the destination is known
 339          * anycast.
 340          */
 341         if (ipv6_anycast_destination(dst, &fl6->daddr)) {
 342                 net_dbg_ratelimited("icmp6_send: acast source\n");
 343                 dst_release(dst);
 344                 return ERR_PTR(-EINVAL);
 345         }
 346
 347         /* No need to clone since we're just using its address. */
 348         dst2 = dst;
 349
 350         dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 351         if (!IS_ERR(dst)) {
 352                 if (dst != dst2)
 353                         return dst;
 354         } else {
 355                 if (PTR_ERR(dst) == -EPERM)
 356                         dst = NULL;
 357                 else
 358                         return dst;
 359         }
 360
 361         err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
 362         if (err)
 363                 goto relookup_failed;
 364
 365         err = ip6_dst_lookup(net, sk, &dst2, &fl2);
 366         if (err)
 367                 goto relookup_failed;
 368
 369         dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 370         if (!IS_ERR(dst2)) {
 371                 dst_release(dst);
 372                 dst = dst2;
 373         } else {
 374                 err = PTR_ERR(dst2);
 375                 if (err == -EPERM) {
 376                         dst_release(dst);
 377                         return dst2;
 378                 } else
 379                         goto relookup_failed;
 380         }
 381
 382 relookup_failed:
 383         if (dst)
 384                 return dst;
 385         return ERR_PTR(err);
 386 }
 387
 388 /*
 389  *      Send an ICMP message in response to a packet in error
 390  */
 391 static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 392 {
 393         struct net *net = dev_net(skb->dev);
 394         struct inet6_dev *idev = NULL;
 395         struct ipv6hdr *hdr = ipv6_hdr(skb);
 396         struct sock *sk;
 397         struct ipv6_pinfo *np;
 398         const struct in6_addr *saddr = NULL;
 399         struct dst_entry *dst;
 400         struct icmp6hdr tmp_hdr;
 401         struct flowi6 fl6;
 402         struct icmpv6_msg msg;
 403         int iif = 0;
 404         int addr_type = 0;
 405         int len;
 406         int hlimit;
 407         int err = 0;
 408         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 409
 410         if ((u8 *)hdr < skb->head ||
 411             (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 412                 return;
 413
 414         /*
 415          *      Make sure we respect the rules
 416          *      i.e. RFC 1885 2.4(e)
 417          *      Rule (e.1) is enforced by not using icmp6_send
 418          *      in any code that processes icmp errors.
 419          */
 420         addr_type = ipv6_addr_type(&hdr->daddr);
 421
 422         if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 423             ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 424                 saddr = &hdr->daddr;
 425
 426         /*
 427          *      Dest addr check
 428          */
 429
 430         if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
 431                 if (type != ICMPV6_PKT_TOOBIG &&
 432                     !(type == ICMPV6_PARAMPROB &&
 433                       code == ICMPV6_UNK_OPTION &&
 434                       (opt_unrec(skb, info))))
 435                         return;
 436
 437                 saddr = NULL;
 438         }
 439
 440         addr_type = ipv6_addr_type(&hdr->saddr);
 441
 442         /*
 443          *      Source addr check
 444          */
 445
 446         if (__ipv6_addr_needs_scope_id(addr_type))
 447                 iif = skb->dev->ifindex;
 448
 449         /*
 450          *      Must not send error if the source does not uniquely
 451          *      identify a single node (RFC2463 Section 2.4).
 452          *      We check unspecified / multicast addresses here,
 453          *      and anycast addresses will be checked later.
 454          */
 455         if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 456                 net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
 457                                     &hdr->saddr, &hdr->daddr);
 458                 return;
 459         }
 460
 461         /*
 462          *      Never answer to a ICMP packet.
 463          */
 464         if (is_ineligible(skb)) {
 465                 net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
 466                                     &hdr->saddr, &hdr->daddr);
 467                 return;
 468         }
 469
 470         mip6_addr_swap(skb);
 471
 472         memset(&fl6, 0, sizeof(fl6));
 473         fl6.flowi6_proto = IPPROTO_ICMPV6;
 474         fl6.daddr = hdr->saddr;
 475         if (saddr)
 476                 fl6.saddr = *saddr;
 477         fl6.flowi6_mark = mark;
 478         fl6.flowi6_oif = iif;
 479         fl6.fl6_icmp_type = type;
 480         fl6.fl6_icmp_code = code;
 481         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 482
 483         sk = icmpv6_xmit_lock(net);
 484         if (!sk)
 485                 return;
 486         sk->sk_mark = mark;
 487         np = inet6_sk(sk);
 488
 489         if (!icmpv6_xrlim_allow(sk, type, &fl6))
 490                 goto out;
 491
 492         tmp_hdr.icmp6_type = type;
 493         tmp_hdr.icmp6_code = code;
 494         tmp_hdr.icmp6_cksum = 0;
 495         tmp_hdr.icmp6_pointer = htonl(info);
 496
 497         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 498                 fl6.flowi6_oif = np->mcast_oif;
 499         else if (!fl6.flowi6_oif)
 500                 fl6.flowi6_oif = np->ucast_oif;
 501
 502         if (!fl6.flowi6_oif)
 503                 fl6.flowi6_oif = l3mdev_master_ifindex(skb->dev);
 504
 505         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 506         if (IS_ERR(dst))
 507                 goto out;
 508
 509         hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 510
 511         msg.skb = skb;
 512         msg.offset = skb_network_offset(skb);
 513         msg.type = type;
 514
 515         len = skb->len - msg.offset;
 516         len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr));
 517         if (len < 0) {
 518                 net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
 519                                     &hdr->saddr, &hdr->daddr);
 520                 goto out_dst_release;
 521         }
 522
 523         rcu_read_lock();
 524         idev = __in6_dev_get(skb->dev);
 525
 526         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
 527                               len + sizeof(struct icmp6hdr),
 528                               sizeof(struct icmp6hdr), hlimit,
 529                               np->tclass, NULL, &fl6, (struct rt6_info *)dst,
 530                               MSG_DONTWAIT, np->dontfrag);
 531         if (err) {
 532                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 533                 ip6_flush_pending_frames(sk);
 534         } else {
 535                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 536                                                  len + sizeof(struct icmp6hdr));
 537         }
 538         rcu_read_unlock();
 539 out_dst_release:
 540         dst_release(dst);
 541 out:
 542         icmpv6_xmit_unlock(sk);
 543 }
 544
 545 /* Slightly more convenient version of icmp6_send.
 546  */
 547 void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 548 {
 549         icmp6_send(skb, ICMPV6_PARAMPROB, code, pos);
 550         kfree_skb(skb);
 551 }
 552
 553 static void icmpv6_echo_reply(struct sk_buff *skb)
 554 {
 555         struct net *net = dev_net(skb->dev);
 556         struct sock *sk;
 557         struct inet6_dev *idev;
 558         struct ipv6_pinfo *np;
 559         const struct in6_addr *saddr = NULL;
 560         struct icmp6hdr *icmph = icmp6_hdr(skb);
 561         struct icmp6hdr tmp_hdr;
 562         struct flowi6 fl6;
 563         struct icmpv6_msg msg;
 564         struct dst_entry *dst;
 565         int err = 0;
 566         int hlimit;
 567         u8 tclass;
 568         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 569
 570         saddr = &ipv6_hdr(skb)->daddr;
 571
 572         if (!ipv6_unicast_destination(skb) &&
 573             !(net->ipv6.sysctl.anycast_src_echo_reply &&
 574               ipv6_anycast_destination(skb_dst(skb), saddr)))
 575                 saddr = NULL;
 576
 577         memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 578         tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
 579
 580         memset(&fl6, 0, sizeof(fl6));
 581         fl6.flowi6_proto = IPPROTO_ICMPV6;
 582         fl6.daddr = ipv6_hdr(skb)->saddr;
 583         if (saddr)
 584                 fl6.saddr = *saddr;
 585         fl6.flowi6_oif = l3mdev_fib_oif(skb->dev);
 586         fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
 587         fl6.flowi6_mark = mark;
 588         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 589
 590         sk = icmpv6_xmit_lock(net);
 591         if (!sk)
 592                 return;
 593         sk->sk_mark = mark;
 594         np = inet6_sk(sk);
 595
 596         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 597                 fl6.flowi6_oif = np->mcast_oif;
 598         else if (!fl6.flowi6_oif)
 599                 fl6.flowi6_oif = np->ucast_oif;
 600
 601         err = ip6_dst_lookup(net, sk, &dst, &fl6);
 602         if (err)
 603                 goto out;
 604         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 605         if (IS_ERR(dst))
 606                 goto out;
 607
 608         hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 609
 610         idev = __in6_dev_get(skb->dev);
 611
 612         msg.skb = skb;
 613         msg.offset = 0;
 614         msg.type = ICMPV6_ECHO_REPLY;
 615
 616         tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 617         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
 618                                 sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl6,
 619                                 (struct rt6_info *)dst, MSG_DONTWAIT,
 620                                 np->dontfrag);
 621
 622         if (err) {
 623                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
 624                 ip6_flush_pending_frames(sk);
 625         } else {
 626                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 627                                                  skb->len + sizeof(struct icmp6hdr));
 628         }
 629         dst_release(dst);
 630 out:
 631         icmpv6_xmit_unlock(sk);
 632 }
 633
 634 void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 635 {
 636         const struct inet6_protocol *ipprot;
 637         int inner_offset;
 638         __be16 frag_off;
 639         u8 nexthdr;
 640         struct net *net = dev_net(skb->dev);
 641
 642         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 643                 goto out;
 644
 645         nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
 646         if (ipv6_ext_hdr(nexthdr)) {
 647                 /* now skip over extension headers */
 648                 inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 649                                                 &nexthdr, &frag_off);
 650                 if (inner_offset < 0)
 651                         goto out;
 652         } else {
 653                 inner_offset = sizeof(struct ipv6hdr);
 654         }
 655
 656         /* Checkin header including 8 bytes of inner protocol header. */
 657         if (!pskb_may_pull(skb, inner_offset+8))
 658                 goto out;
 659
 660         /* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
 661            Without this we will not able f.e. to make source routed
 662            pmtu discovery.
 663            Corresponding argument (opt) to notifiers is already added.
 664            --ANK (980726)
 665          */
 666
 667         ipprot = rcu_dereference(inet6_protos[nexthdr]);
 668         if (ipprot && ipprot->err_handler)
 669                 ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
 670
 671         raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
 672         return;
 673
 674 out:
 675         ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 676 }
 677
 678 /*
 679  *      Handle icmp messages
 680  */
 681
 682 static int icmpv6_rcv(struct sk_buff *skb)
 683 {
 684         struct net_device *dev = skb->dev;
 685         struct inet6_dev *idev = __in6_dev_get(dev);
 686         const struct in6_addr *saddr, *daddr;
 687         struct icmp6hdr *hdr;
 688         u8 type;
 689         bool success = false;
 690
 691         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 692                 struct sec_path *sp = skb_sec_path(skb);
 693                 int nh;
 694
 695                 if (!(sp && sp->xvec[sp->len - 1]->props.flags &
 696                                  XFRM_STATE_ICMP))
 697                         goto drop_no_count;
 698
 699                 if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
 700                         goto drop_no_count;
 701
 702                 nh = skb_network_offset(skb);
 703                 skb_set_network_header(skb, sizeof(*hdr));
 704
 705                 if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
 706                         goto drop_no_count;
 707
 708                 skb_set_network_header(skb, nh);
 709         }
 710
 711         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INMSGS);
 712
 713         saddr = &ipv6_hdr(skb)->saddr;
 714         daddr = &ipv6_hdr(skb)->daddr;
 715
 716         if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
 717                 net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
 718                                     saddr, daddr);
 719                 goto csum_error;
 720         }
 721
 722         if (!pskb_pull(skb, sizeof(*hdr)))
 723                 goto discard_it;
 724
 725         hdr = icmp6_hdr(skb);
 726
 727         type = hdr->icmp6_type;
 728
 729         ICMP6MSGIN_INC_STATS_BH(dev_net(dev), idev, type);
 730
 731         switch (type) {
 732         case ICMPV6_ECHO_REQUEST:
 733                 icmpv6_echo_reply(skb);
 734                 break;
 735
 736         case ICMPV6_ECHO_REPLY:
 737                 success = ping_rcv(skb);
 738                 break;
 739
 740         case ICMPV6_PKT_TOOBIG:
 741                 /* BUGGG_FUTURE: if packet contains rthdr, we cannot update
 742                    standard destination cache. Seems, only "advanced"
 743                    destination cache will allow to solve this problem
 744                    --ANK (980726)
 745                  */
 746                 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 747                         goto discard_it;
 748                 hdr = icmp6_hdr(skb);
 749
 750                 /*
 751                  *      Drop through to notify
 752                  */
 753
 754         case ICMPV6_DEST_UNREACH:
 755         case ICMPV6_TIME_EXCEED:
 756         case ICMPV6_PARAMPROB:
 757                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 758                 break;
 759
 760         case NDISC_ROUTER_SOLICITATION:
 761         case NDISC_ROUTER_ADVERTISEMENT:
 762         case NDISC_NEIGHBOUR_SOLICITATION:
 763         case NDISC_NEIGHBOUR_ADVERTISEMENT:
 764         case NDISC_REDIRECT:
 765                 ndisc_rcv(skb);
 766                 break;
 767
 768         case ICMPV6_MGM_QUERY:
 769                 igmp6_event_query(skb);
 770                 break;
 771
 772         case ICMPV6_MGM_REPORT:
 773                 igmp6_event_report(skb);
 774                 break;
 775
 776         case ICMPV6_MGM_REDUCTION:
 777         case ICMPV6_NI_QUERY:
 778         case ICMPV6_NI_REPLY:
 779         case ICMPV6_MLD2_REPORT:
 780         case ICMPV6_DHAAD_REQUEST:
 781         case ICMPV6_DHAAD_REPLY:
 782         case ICMPV6_MOBILE_PREFIX_SOL:
 783         case ICMPV6_MOBILE_PREFIX_ADV:
 784                 break;
 785
 786         default:
 787                 /* informational */
 788                 if (type & ICMPV6_INFOMSG_MASK)
 789                         break;
 790
 791                 net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
 792                                     saddr, daddr);
 793
 794                 /*
 795                  * error of unknown type.
 796                  * must pass to upper level
 797                  */
 798
 799                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 800         }
 801
 802         /* until the v6 path can be better sorted assume failure and
 803          * preserve the status quo behaviour for the rest of the paths to here
 804          */
 805         if (success)
 806                 consume_skb(skb);
 807         else
 808                 kfree_skb(skb);
 809
 810         return 0;
 811
 812 csum_error:
 813         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
 814 discard_it:
 815         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INERRORS);
 816 drop_no_count:
 817         kfree_skb(skb);
 818         return 0;
 819 }
 820
 821 void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
 822                       u8 type,
 823                       const struct in6_addr *saddr,
 824                       const struct in6_addr *daddr,
 825                       int oif)
 826 {
 827         memset(fl6, 0, sizeof(*fl6));
 828         fl6->saddr = *saddr;
 829         fl6->daddr = *daddr;
 830         fl6->flowi6_proto       = IPPROTO_ICMPV6;
 831         fl6->fl6_icmp_type      = type;
 832         fl6->fl6_icmp_code      = 0;
 833         fl6->flowi6_oif         = oif;
 834         security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
 835 }
 836
 837 /*
 838  * Special lock-class for __icmpv6_sk:
 839  */
 840 static struct lock_class_key icmpv6_socket_sk_dst_lock_key;
 841
 842 static int __net_init icmpv6_sk_init(struct net *net)
 843 {
 844         struct sock *sk;
 845         int err, i, j;
 846
 847         net->ipv6.icmp_sk =
 848                 kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
 849         if (!net->ipv6.icmp_sk)
 850                 return -ENOMEM;
 851
 852         for_each_possible_cpu(i) {
 853                 err = inet_ctl_sock_create(&sk, PF_INET6,
 854                                            SOCK_RAW, IPPROTO_ICMPV6, net);
 855                 if (err < 0) {
 856                         pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
 857                                err);
 858                         goto fail;
 859                 }
 860
 861                 net->ipv6.icmp_sk[i] = sk;
 862
 863                 /*
 864                  * Split off their lock-class, because sk->sk_dst_lock
 865                  * gets used from softirqs, which is safe for
 866                  * __icmpv6_sk (because those never get directly used
 867                  * via userspace syscalls), but unsafe for normal sockets.
 868                  */
 869                 lockdep_set_class(&sk->sk_dst_lock,
 870                                   &icmpv6_socket_sk_dst_lock_key);
 871
 872                 /* Enough space for 2 64K ICMP packets, including
 873                  * sk_buff struct overhead.
 874                  */
 875                 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
 876         }
 877         return 0;
 878
 879  fail:
 880         for (j = 0; j < i; j++)
 881                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
 882         kfree(net->ipv6.icmp_sk);
 883         return err;
 884 }
 885
 886 static void __net_exit icmpv6_sk_exit(struct net *net)
 887 {
 888         int i;
 889
 890         for_each_possible_cpu(i) {
 891                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
 892         }
 893         kfree(net->ipv6.icmp_sk);
 894 }
 895
 896 static struct pernet_operations icmpv6_sk_ops = {
 897         .init = icmpv6_sk_init,
 898         .exit = icmpv6_sk_exit,
 899 };
 900
 901 int __init icmpv6_init(void)
 902 {
 903         int err;
 904
 905         err = register_pernet_subsys(&icmpv6_sk_ops);
 906         if (err < 0)
 907                 return err;
 908
 909         err = -EAGAIN;
 910         if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
 911                 goto fail;
 912
 913         err = inet6_register_icmp_sender(icmp6_send);
 914         if (err)
 915                 goto sender_reg_err;
 916         return 0;
 917
 918 sender_reg_err:
 919         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 920 fail:
 921         pr_err("Failed to register ICMP6 protocol\n");
 922         unregister_pernet_subsys(&icmpv6_sk_ops);
 923         return err;
 924 }
 925
 926 void icmpv6_cleanup(void)
 927 {
 928         inet6_unregister_icmp_sender(icmp6_send);
 929         unregister_pernet_subsys(&icmpv6_sk_ops);
 930         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 931 }
 932
 933
 934 static const struct icmp6_err {
 935         int err;
 936         int fatal;
 937 } tab_unreach[] = {
 938         {       /* NOROUTE */
 939                 .err    = ENETUNREACH,
 940                 .fatal  = 0,
 941         },
 942         {       /* ADM_PROHIBITED */
 943                 .err    = EACCES,
 944                 .fatal  = 1,
 945         },
 946         {       /* Was NOT_NEIGHBOUR, now reserved */
 947                 .err    = EHOSTUNREACH,
 948                 .fatal  = 0,
 949         },
 950         {       /* ADDR_UNREACH */
 951                 .err    = EHOSTUNREACH,
 952                 .fatal  = 0,
 953         },
 954         {       /* PORT_UNREACH */
 955                 .err    = ECONNREFUSED,
 956                 .fatal  = 1,
 957         },
 958         {       /* POLICY_FAIL */
 959                 .err    = EACCES,
 960                 .fatal  = 1,
 961         },
 962         {       /* REJECT_ROUTE */
 963                 .err    = EACCES,
 964                 .fatal  = 1,
 965         },
 966 };
 967
 968 int icmpv6_err_convert(u8 type, u8 code, int *err)
 969 {
 970         int fatal = 0;
 971
 972         *err = EPROTO;
 973
 974         switch (type) {
 975         case ICMPV6_DEST_UNREACH:
 976                 fatal = 1;
 977                 if (code < ARRAY_SIZE(tab_unreach)) {
 978                         *err  = tab_unreach[code].err;
 979                         fatal = tab_unreach[code].fatal;
 980                 }
 981                 break;
 982
 983         case ICMPV6_PKT_TOOBIG:
 984                 *err = EMSGSIZE;
 985                 break;
 986
 987         case ICMPV6_PARAMPROB:
 988                 *err = EPROTO;
 989                 fatal = 1;
 990                 break;
 991
 992         case ICMPV6_TIME_EXCEED:
 993                 *err = EHOSTUNREACH;
 994                 break;
 995         }
 996
 997         return fatal;
 998 }
 999 EXPORT_SYMBOL(icmpv6_err_convert);
1000
1001 #ifdef CONFIG_SYSCTL
1002 static struct ctl_table ipv6_icmp_table_template[] = {
1003         {
1004                 .procname       = "ratelimit",
1005                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
1006                 .maxlen         = sizeof(int),
1007                 .mode           = 0644,
1008                 .proc_handler   = proc_dointvec_ms_jiffies,
1009         },
1010         { },
1011 };
1012
1013 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1014 {
1015         struct ctl_table *table;
1016
1017         table = kmemdup(ipv6_icmp_table_template,
1018                         sizeof(ipv6_icmp_table_template),
1019                         GFP_KERNEL);
1020
1021         if (table)
1022                 table[0].data = &net->ipv6.sysctl.icmpv6_time;
1023
1024         return table;
1025 }
1026 #endif