1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Internet Control Message Protocol (ICMPv6) 4 * Linux INET6 implementation 5 * 6 * Authors: 7 * Pedro Roque <roque@di.fc.ul.pt> 8 * 9 * Based on net/ipv4/icmp.c 10 * 11 * RFC 1885 12 */ 13 14 /* 15 * Changes: 16 * 17 * Andi Kleen : exception handling 18 * Andi Kleen add rate limits. never reply to a icmp. 19 * add more length checks and other fixes. 20 * yoshfuji : ensure to sent parameter problem for 21 * fragments. 22 * YOSHIFUJI Hideaki @USAGI: added sysctl for icmp rate limit. 23 * Randy Dunlap and 24 * YOSHIFUJI Hideaki @USAGI: Per-interface statistics support 25 * Kazunori MIYAZAWA @USAGI: change output process to use ip6_append_data 26 */ 27 28 #define pr_fmt(fmt) "IPv6: " fmt 29 30 #include <linux/module.h> 31 #include <linux/errno.h> 32 #include <linux/types.h> 33 #include <linux/socket.h> 34 #include <linux/in.h> 35 #include <linux/kernel.h> 36 #include <linux/sockios.h> 37 #include <linux/net.h> 38 #include <linux/skbuff.h> 39 #include <linux/init.h> 40 #include <linux/netfilter.h> 41 #include <linux/slab.h> 42 43 #ifdef CONFIG_SYSCTL 44 #include <linux/sysctl.h> 45 #endif 46 47 #include <linux/inet.h> 48 #include <linux/netdevice.h> 49 #include <linux/icmpv6.h> 50 51 #include <net/ip.h> 52 #include <net/sock.h> 53 54 #include <net/ipv6.h> 55 #include <net/ip6_checksum.h> 56 #include <net/ping.h> 57 #include <net/protocol.h> 58 #include <net/raw.h> 59 #include <net/rawv6.h> 60 #include <net/seg6.h> 61 #include <net/transp_v6.h> 62 #include <net/ip6_route.h> 63 #include <net/addrconf.h> 64 #include <net/icmp.h> 65 #include <net/xfrm.h> 66 #include <net/inet_common.h> 67 #include <net/dsfield.h> 68 #include <net/l3mdev.h> 69 70 #include <linux/uaccess.h> 71 72 static DEFINE_PER_CPU(struct sock *, ipv6_icmp_sk); 73 74 static int icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 75 u8 type, u8 code, int offset, __be32 info) 76 { 77 /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */ 78 struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset); 79 struct net *net = dev_net(skb->dev); 80 81 if (type == ICMPV6_PKT_TOOBIG) 82 ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL)); 83 else if (type == NDISC_REDIRECT) 84 ip6_redirect(skb, net, skb->dev->ifindex, 0, 85 sock_net_uid(net, NULL)); 86 87 if (!(type & ICMPV6_INFOMSG_MASK)) 88 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST) 89 ping_err(skb, offset, ntohl(info)); 90 91 return 0; 92 } 93 94 static int icmpv6_rcv(struct sk_buff *skb); 95 96 static const struct inet6_protocol icmpv6_protocol = { 97 .handler = icmpv6_rcv, 98 .err_handler = icmpv6_err, 99 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, 100 }; 101 102 /* Called with BH disabled */ 103 static struct sock *icmpv6_xmit_lock(struct net *net) 104 { 105 struct sock *sk; 106 107 sk = this_cpu_read(ipv6_icmp_sk); 108 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { 109 /* This can happen if the output path (f.e. SIT or 110 * ip6ip6 tunnel) signals dst_link_failure() for an 111 * outgoing ICMP6 packet. 112 */ 113 return NULL; 114 } 115 sock_net_set(sk, net); 116 return sk; 117 } 118 119 static void icmpv6_xmit_unlock(struct sock *sk) 120 { 121 sock_net_set(sk, &init_net); 122 spin_unlock(&sk->sk_lock.slock); 123 } 124 125 /* 126 * Figure out, may we reply to this packet with icmp error. 127 * 128 * We do not reply, if: 129 * - it was icmp error message. 130 * - it is truncated, so that it is known, that protocol is ICMPV6 131 * (i.e. in the middle of some exthdr) 132 * 133 * --ANK (980726) 134 */ 135 136 static bool is_ineligible(const struct sk_buff *skb) 137 { 138 int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data; 139 int len = skb->len - ptr; 140 __u8 nexthdr = ipv6_hdr(skb)->nexthdr; 141 __be16 frag_off; 142 143 if (len < 0) 144 return true; 145 146 ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off); 147 if (ptr < 0) 148 return false; 149 if (nexthdr == IPPROTO_ICMPV6) { 150 u8 _type, *tp; 151 tp = skb_header_pointer(skb, 152 ptr+offsetof(struct icmp6hdr, icmp6_type), 153 sizeof(_type), &_type); 154 155 /* Based on RFC 8200, Section 4.5 Fragment Header, return 156 * false if this is a fragment packet with no icmp header info. 157 */ 158 if (!tp && frag_off != 0) 159 return false; 160 else if (!tp || !(*tp & ICMPV6_INFOMSG_MASK)) 161 return true; 162 } 163 return false; 164 } 165 166 static bool icmpv6_mask_allow(struct net *net, int type) 167 { 168 if (type > ICMPV6_MSG_MAX) 169 return true; 170 171 /* Limit if icmp type is set in ratemask. */ 172 if (!test_bit(type, net->ipv6.sysctl.icmpv6_ratemask)) 173 return true; 174 175 return false; 176 } 177 178 static bool icmpv6_global_allow(struct net *net, int type) 179 { 180 if (icmpv6_mask_allow(net, type)) 181 return true; 182 183 if (icmp_global_allow()) 184 return true; 185 186 return false; 187 } 188 189 /* 190 * Check the ICMP output rate limit 191 */ 192 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, 193 struct flowi6 *fl6) 194 { 195 struct net *net = sock_net(sk); 196 struct dst_entry *dst; 197 bool res = false; 198 199 if (icmpv6_mask_allow(net, type)) 200 return true; 201 202 /* 203 * Look up the output route. 204 * XXX: perhaps the expire for routing entries cloned by 205 * this lookup should be more aggressive (not longer than timeout). 206 */ 207 dst = ip6_route_output(net, sk, fl6); 208 if (dst->error) { 209 IP6_INC_STATS(net, ip6_dst_idev(dst), 210 IPSTATS_MIB_OUTNOROUTES); 211 } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) { 212 res = true; 213 } else { 214 struct rt6_info *rt = (struct rt6_info *)dst; 215 int tmo = net->ipv6.sysctl.icmpv6_time; 216 struct inet_peer *peer; 217 218 /* Give more bandwidth to wider prefixes. */ 219 if (rt->rt6i_dst.plen < 128) 220 tmo >>= ((128 - rt->rt6i_dst.plen)>>5); 221 222 peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1); 223 res = inet_peer_xrlim_allow(peer, tmo); 224 if (peer) 225 inet_putpeer(peer); 226 } 227 dst_release(dst); 228 return res; 229 } 230 231 static bool icmpv6_rt_has_prefsrc(struct sock *sk, u8 type, 232 struct flowi6 *fl6) 233 { 234 struct net *net = sock_net(sk); 235 struct dst_entry *dst; 236 bool res = false; 237 238 dst = ip6_route_output(net, sk, fl6); 239 if (!dst->error) { 240 struct rt6_info *rt = (struct rt6_info *)dst; 241 struct in6_addr prefsrc; 242 243 rt6_get_prefsrc(rt, &prefsrc); 244 res = !ipv6_addr_any(&prefsrc); 245 } 246 dst_release(dst); 247 return res; 248 } 249 250 /* 251 * an inline helper for the "simple" if statement below 252 * checks if parameter problem report is caused by an 253 * unrecognized IPv6 option that has the Option Type 254 * highest-order two bits set to 10 255 */ 256 257 static bool opt_unrec(struct sk_buff *skb, __u32 offset) 258 { 259 u8 _optval, *op; 260 261 offset += skb_network_offset(skb); 262 op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval); 263 if (!op) 264 return true; 265 return (*op & 0xC0) == 0x80; 266 } 267 268 void icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, 269 struct icmp6hdr *thdr, int len) 270 { 271 struct sk_buff *skb; 272 struct icmp6hdr *icmp6h; 273 274 skb = skb_peek(&sk->sk_write_queue); 275 if (!skb) 276 return; 277 278 icmp6h = icmp6_hdr(skb); 279 memcpy(icmp6h, thdr, sizeof(struct icmp6hdr)); 280 icmp6h->icmp6_cksum = 0; 281 282 if (skb_queue_len(&sk->sk_write_queue) == 1) { 283 skb->csum = csum_partial(icmp6h, 284 sizeof(struct icmp6hdr), skb->csum); 285 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr, 286 &fl6->daddr, 287 len, fl6->flowi6_proto, 288 skb->csum); 289 } else { 290 __wsum tmp_csum = 0; 291 292 skb_queue_walk(&sk->sk_write_queue, skb) { 293 tmp_csum = csum_add(tmp_csum, skb->csum); 294 } 295 296 tmp_csum = csum_partial(icmp6h, 297 sizeof(struct icmp6hdr), tmp_csum); 298 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr, 299 &fl6->daddr, 300 len, fl6->flowi6_proto, 301 tmp_csum); 302 } 303 ip6_push_pending_frames(sk); 304 } 305 306 struct icmpv6_msg { 307 struct sk_buff *skb; 308 int offset; 309 uint8_t type; 310 }; 311 312 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb) 313 { 314 struct icmpv6_msg *msg = (struct icmpv6_msg *) from; 315 struct sk_buff *org_skb = msg->skb; 316 __wsum csum; 317 318 csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset, 319 to, len); 320 skb->csum = csum_block_add(skb->csum, csum, odd); 321 if (!(msg->type & ICMPV6_INFOMSG_MASK)) 322 nf_ct_attach(skb, org_skb); 323 return 0; 324 } 325 326 #if IS_ENABLED(CONFIG_IPV6_MIP6) 327 static void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt) 328 { 329 struct ipv6hdr *iph = ipv6_hdr(skb); 330 struct ipv6_destopt_hao *hao; 331 struct in6_addr tmp; 332 int off; 333 334 if (opt->dsthao) { 335 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO); 336 if (likely(off >= 0)) { 337 hao = (struct ipv6_destopt_hao *) 338 (skb_network_header(skb) + off); 339 tmp = iph->saddr; 340 iph->saddr = hao->addr; 341 hao->addr = tmp; 342 } 343 } 344 } 345 #else 346 static inline void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt) {} 347 #endif 348 349 static struct dst_entry *icmpv6_route_lookup(struct net *net, 350 struct sk_buff *skb, 351 struct sock *sk, 352 struct flowi6 *fl6) 353 { 354 struct dst_entry *dst, *dst2; 355 struct flowi6 fl2; 356 int err; 357 358 err = ip6_dst_lookup(net, sk, &dst, fl6); 359 if (err) 360 return ERR_PTR(err); 361 362 /* 363 * We won't send icmp if the destination is known 364 * anycast. 365 */ 366 if (ipv6_anycast_destination(dst, &fl6->daddr)) { 367 net_dbg_ratelimited("icmp6_send: acast source\n"); 368 dst_release(dst); 369 return ERR_PTR(-EINVAL); 370 } 371 372 /* No need to clone since we're just using its address. */ 373 dst2 = dst; 374 375 dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0); 376 if (!IS_ERR(dst)) { 377 if (dst != dst2) 378 return dst; 379 } else { 380 if (PTR_ERR(dst) == -EPERM) 381 dst = NULL; 382 else 383 return dst; 384 } 385 386 err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6); 387 if (err) 388 goto relookup_failed; 389 390 err = ip6_dst_lookup(net, sk, &dst2, &fl2); 391 if (err) 392 goto relookup_failed; 393 394 dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP); 395 if (!IS_ERR(dst2)) { 396 dst_release(dst); 397 dst = dst2; 398 } else { 399 err = PTR_ERR(dst2); 400 if (err == -EPERM) { 401 dst_release(dst); 402 return dst2; 403 } else 404 goto relookup_failed; 405 } 406 407 relookup_failed: 408 if (dst) 409 return dst; 410 return ERR_PTR(err); 411 } 412 413 static struct net_device *icmp6_dev(const struct sk_buff *skb) 414 { 415 struct net_device *dev = skb->dev; 416 417 /* for local traffic to local address, skb dev is the loopback 418 * device. Check if there is a dst attached to the skb and if so 419 * get the real device index. Same is needed for replies to a link 420 * local address on a device enslaved to an L3 master device 421 */ 422 if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) { 423 const struct rt6_info *rt6 = skb_rt6_info(skb); 424 425 if (rt6) 426 dev = rt6->rt6i_idev->dev; 427 } 428 429 return dev; 430 } 431 432 static int icmp6_iif(const struct sk_buff *skb) 433 { 434 return icmp6_dev(skb)->ifindex; 435 } 436 437 /* 438 * Send an ICMP message in response to a packet in error 439 */ 440 void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, 441 const struct in6_addr *force_saddr, 442 const struct inet6_skb_parm *parm) 443 { 444 struct inet6_dev *idev = NULL; 445 struct ipv6hdr *hdr = ipv6_hdr(skb); 446 struct sock *sk; 447 struct net *net; 448 struct ipv6_pinfo *np; 449 const struct in6_addr *saddr = NULL; 450 struct dst_entry *dst; 451 struct icmp6hdr tmp_hdr; 452 struct flowi6 fl6; 453 struct icmpv6_msg msg; 454 struct ipcm6_cookie ipc6; 455 int iif = 0; 456 int addr_type = 0; 457 int len; 458 u32 mark; 459 460 if ((u8 *)hdr < skb->head || 461 (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb)) 462 return; 463 464 if (!skb->dev) 465 return; 466 net = dev_net(skb->dev); 467 mark = IP6_REPLY_MARK(net, skb->mark); 468 /* 469 * Make sure we respect the rules 470 * i.e. RFC 1885 2.4(e) 471 * Rule (e.1) is enforced by not using icmp6_send 472 * in any code that processes icmp errors. 473 */ 474 addr_type = ipv6_addr_type(&hdr->daddr); 475 476 if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) || 477 ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr)) 478 saddr = &hdr->daddr; 479 480 /* 481 * Dest addr check 482 */ 483 484 if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) { 485 if (type != ICMPV6_PKT_TOOBIG && 486 !(type == ICMPV6_PARAMPROB && 487 code == ICMPV6_UNK_OPTION && 488 (opt_unrec(skb, info)))) 489 return; 490 491 saddr = NULL; 492 } 493 494 addr_type = ipv6_addr_type(&hdr->saddr); 495 496 /* 497 * Source addr check 498 */ 499 500 if (__ipv6_addr_needs_scope_id(addr_type)) { 501 iif = icmp6_iif(skb); 502 } else { 503 /* 504 * The source device is used for looking up which routing table 505 * to use for sending an ICMP error. 506 */ 507 iif = l3mdev_master_ifindex(skb->dev); 508 } 509 510 /* 511 * Must not send error if the source does not uniquely 512 * identify a single node (RFC2463 Section 2.4). 513 * We check unspecified / multicast addresses here, 514 * and anycast addresses will be checked later. 515 */ 516 if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) { 517 net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n", 518 &hdr->saddr, &hdr->daddr); 519 return; 520 } 521 522 /* 523 * Never answer to a ICMP packet. 524 */ 525 if (is_ineligible(skb)) { 526 net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n", 527 &hdr->saddr, &hdr->daddr); 528 return; 529 } 530 531 /* Needed by both icmp_global_allow and icmpv6_xmit_lock */ 532 local_bh_disable(); 533 534 /* Check global sysctl_icmp_msgs_per_sec ratelimit */ 535 if (!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, type)) 536 goto out_bh_enable; 537 538 mip6_addr_swap(skb, parm); 539 540 sk = icmpv6_xmit_lock(net); 541 if (!sk) 542 goto out_bh_enable; 543 544 memset(&fl6, 0, sizeof(fl6)); 545 fl6.flowi6_proto = IPPROTO_ICMPV6; 546 fl6.daddr = hdr->saddr; 547 if (force_saddr) 548 saddr = force_saddr; 549 if (saddr) { 550 fl6.saddr = *saddr; 551 } else if (!icmpv6_rt_has_prefsrc(sk, type, &fl6)) { 552 /* select a more meaningful saddr from input if */ 553 struct net_device *in_netdev; 554 555 in_netdev = dev_get_by_index(net, parm->iif); 556 if (in_netdev) { 557 ipv6_dev_get_saddr(net, in_netdev, &fl6.daddr, 558 inet6_sk(sk)->srcprefs, 559 &fl6.saddr); 560 dev_put(in_netdev); 561 } 562 } 563 fl6.flowi6_mark = mark; 564 fl6.flowi6_oif = iif; 565 fl6.fl6_icmp_type = type; 566 fl6.fl6_icmp_code = code; 567 fl6.flowi6_uid = sock_net_uid(net, NULL); 568 fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL); 569 security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6)); 570 571 np = inet6_sk(sk); 572 573 if (!icmpv6_xrlim_allow(sk, type, &fl6)) 574 goto out; 575 576 tmp_hdr.icmp6_type = type; 577 tmp_hdr.icmp6_code = code; 578 tmp_hdr.icmp6_cksum = 0; 579 tmp_hdr.icmp6_pointer = htonl(info); 580 581 if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) 582 fl6.flowi6_oif = np->mcast_oif; 583 else if (!fl6.flowi6_oif) 584 fl6.flowi6_oif = np->ucast_oif; 585 586 ipcm6_init_sk(&ipc6, np); 587 ipc6.sockc.mark = mark; 588 fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel); 589 590 dst = icmpv6_route_lookup(net, skb, sk, &fl6); 591 if (IS_ERR(dst)) 592 goto out; 593 594 ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst); 595 596 msg.skb = skb; 597 msg.offset = skb_network_offset(skb); 598 msg.type = type; 599 600 len = skb->len - msg.offset; 601 len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr)); 602 if (len < 0) { 603 net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n", 604 &hdr->saddr, &hdr->daddr); 605 goto out_dst_release; 606 } 607 608 rcu_read_lock(); 609 idev = __in6_dev_get(skb->dev); 610 611 if (ip6_append_data(sk, icmpv6_getfrag, &msg, 612 len + sizeof(struct icmp6hdr), 613 sizeof(struct icmp6hdr), 614 &ipc6, &fl6, (struct rt6_info *)dst, 615 MSG_DONTWAIT)) { 616 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS); 617 ip6_flush_pending_frames(sk); 618 } else { 619 icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, 620 len + sizeof(struct icmp6hdr)); 621 } 622 rcu_read_unlock(); 623 out_dst_release: 624 dst_release(dst); 625 out: 626 icmpv6_xmit_unlock(sk); 627 out_bh_enable: 628 local_bh_enable(); 629 } 630 EXPORT_SYMBOL(icmp6_send); 631 632 /* Slightly more convenient version of icmp6_send with drop reasons. 633 */ 634 void icmpv6_param_prob_reason(struct sk_buff *skb, u8 code, int pos, 635 enum skb_drop_reason reason) 636 { 637 icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL, IP6CB(skb)); 638 kfree_skb_reason(skb, reason); 639 } 640 641 /* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH 642 * if sufficient data bytes are available 643 * @nhs is the size of the tunnel header(s) : 644 * Either an IPv4 header for SIT encap 645 * an IPv4 header + GRE header for GRE encap 646 */ 647 int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type, 648 unsigned int data_len) 649 { 650 struct in6_addr temp_saddr; 651 struct rt6_info *rt; 652 struct sk_buff *skb2; 653 u32 info = 0; 654 655 if (!pskb_may_pull(skb, nhs + sizeof(struct ipv6hdr) + 8)) 656 return 1; 657 658 /* RFC 4884 (partial) support for ICMP extensions */ 659 if (data_len < 128 || (data_len & 7) || skb->len < data_len) 660 data_len = 0; 661 662 skb2 = data_len ? skb_copy(skb, GFP_ATOMIC) : skb_clone(skb, GFP_ATOMIC); 663 664 if (!skb2) 665 return 1; 666 667 skb_dst_drop(skb2); 668 skb_pull(skb2, nhs); 669 skb_reset_network_header(skb2); 670 671 rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 672 skb, 0); 673 674 if (rt && rt->dst.dev) 675 skb2->dev = rt->dst.dev; 676 677 ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, &temp_saddr); 678 679 if (data_len) { 680 /* RFC 4884 (partial) support : 681 * insert 0 padding at the end, before the extensions 682 */ 683 __skb_push(skb2, nhs); 684 skb_reset_network_header(skb2); 685 memmove(skb2->data, skb2->data + nhs, data_len - nhs); 686 memset(skb2->data + data_len - nhs, 0, nhs); 687 /* RFC 4884 4.5 : Length is measured in 64-bit words, 688 * and stored in reserved[0] 689 */ 690 info = (data_len/8) << 24; 691 } 692 if (type == ICMP_TIME_EXCEEDED) 693 icmp6_send(skb2, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 694 info, &temp_saddr, IP6CB(skb2)); 695 else 696 icmp6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 697 info, &temp_saddr, IP6CB(skb2)); 698 if (rt) 699 ip6_rt_put(rt); 700 701 kfree_skb(skb2); 702 703 return 0; 704 } 705 EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach); 706 707 static void icmpv6_echo_reply(struct sk_buff *skb) 708 { 709 struct net *net = dev_net(skb->dev); 710 struct sock *sk; 711 struct inet6_dev *idev; 712 struct ipv6_pinfo *np; 713 const struct in6_addr *saddr = NULL; 714 struct icmp6hdr *icmph = icmp6_hdr(skb); 715 struct icmp6hdr tmp_hdr; 716 struct flowi6 fl6; 717 struct icmpv6_msg msg; 718 struct dst_entry *dst; 719 struct ipcm6_cookie ipc6; 720 u32 mark = IP6_REPLY_MARK(net, skb->mark); 721 bool acast; 722 u8 type; 723 724 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) && 725 net->ipv6.sysctl.icmpv6_echo_ignore_multicast) 726 return; 727 728 saddr = &ipv6_hdr(skb)->daddr; 729 730 acast = ipv6_anycast_destination(skb_dst(skb), saddr); 731 if (acast && net->ipv6.sysctl.icmpv6_echo_ignore_anycast) 732 return; 733 734 if (!ipv6_unicast_destination(skb) && 735 !(net->ipv6.sysctl.anycast_src_echo_reply && acast)) 736 saddr = NULL; 737 738 if (icmph->icmp6_type == ICMPV6_EXT_ECHO_REQUEST) 739 type = ICMPV6_EXT_ECHO_REPLY; 740 else 741 type = ICMPV6_ECHO_REPLY; 742 743 memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr)); 744 tmp_hdr.icmp6_type = type; 745 746 memset(&fl6, 0, sizeof(fl6)); 747 if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) 748 fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb)); 749 750 fl6.flowi6_proto = IPPROTO_ICMPV6; 751 fl6.daddr = ipv6_hdr(skb)->saddr; 752 if (saddr) 753 fl6.saddr = *saddr; 754 fl6.flowi6_oif = icmp6_iif(skb); 755 fl6.fl6_icmp_type = type; 756 fl6.flowi6_mark = mark; 757 fl6.flowi6_uid = sock_net_uid(net, NULL); 758 security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6)); 759 760 local_bh_disable(); 761 sk = icmpv6_xmit_lock(net); 762 if (!sk) 763 goto out_bh_enable; 764 np = inet6_sk(sk); 765 766 if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) 767 fl6.flowi6_oif = np->mcast_oif; 768 else if (!fl6.flowi6_oif) 769 fl6.flowi6_oif = np->ucast_oif; 770 771 if (ip6_dst_lookup(net, sk, &dst, &fl6)) 772 goto out; 773 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0); 774 if (IS_ERR(dst)) 775 goto out; 776 777 /* Check the ratelimit */ 778 if ((!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, ICMPV6_ECHO_REPLY)) || 779 !icmpv6_xrlim_allow(sk, ICMPV6_ECHO_REPLY, &fl6)) 780 goto out_dst_release; 781 782 idev = __in6_dev_get(skb->dev); 783 784 msg.skb = skb; 785 msg.offset = 0; 786 msg.type = type; 787 788 ipcm6_init_sk(&ipc6, np); 789 ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst); 790 ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb)); 791 ipc6.sockc.mark = mark; 792 793 if (icmph->icmp6_type == ICMPV6_EXT_ECHO_REQUEST) 794 if (!icmp_build_probe(skb, (struct icmphdr *)&tmp_hdr)) 795 goto out_dst_release; 796 797 if (ip6_append_data(sk, icmpv6_getfrag, &msg, 798 skb->len + sizeof(struct icmp6hdr), 799 sizeof(struct icmp6hdr), &ipc6, &fl6, 800 (struct rt6_info *)dst, MSG_DONTWAIT)) { 801 __ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS); 802 ip6_flush_pending_frames(sk); 803 } else { 804 icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, 805 skb->len + sizeof(struct icmp6hdr)); 806 } 807 out_dst_release: 808 dst_release(dst); 809 out: 810 icmpv6_xmit_unlock(sk); 811 out_bh_enable: 812 local_bh_enable(); 813 } 814 815 void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info) 816 { 817 struct inet6_skb_parm *opt = IP6CB(skb); 818 const struct inet6_protocol *ipprot; 819 int inner_offset; 820 __be16 frag_off; 821 u8 nexthdr; 822 struct net *net = dev_net(skb->dev); 823 824 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) 825 goto out; 826 827 seg6_icmp_srh(skb, opt); 828 829 nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr; 830 if (ipv6_ext_hdr(nexthdr)) { 831 /* now skip over extension headers */ 832 inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), 833 &nexthdr, &frag_off); 834 if (inner_offset < 0) 835 goto out; 836 } else { 837 inner_offset = sizeof(struct ipv6hdr); 838 } 839 840 /* Checkin header including 8 bytes of inner protocol header. */ 841 if (!pskb_may_pull(skb, inner_offset+8)) 842 goto out; 843 844 /* BUGGG_FUTURE: we should try to parse exthdrs in this packet. 845 Without this we will not able f.e. to make source routed 846 pmtu discovery. 847 Corresponding argument (opt) to notifiers is already added. 848 --ANK (980726) 849 */ 850 851 ipprot = rcu_dereference(inet6_protos[nexthdr]); 852 if (ipprot && ipprot->err_handler) 853 ipprot->err_handler(skb, opt, type, code, inner_offset, info); 854 855 raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info); 856 return; 857 858 out: 859 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS); 860 } 861 862 /* 863 * Handle icmp messages 864 */ 865 866 static int icmpv6_rcv(struct sk_buff *skb) 867 { 868 enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED; 869 struct net *net = dev_net(skb->dev); 870 struct net_device *dev = icmp6_dev(skb); 871 struct inet6_dev *idev = __in6_dev_get(dev); 872 const struct in6_addr *saddr, *daddr; 873 struct icmp6hdr *hdr; 874 u8 type; 875 876 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { 877 struct sec_path *sp = skb_sec_path(skb); 878 int nh; 879 880 if (!(sp && sp->xvec[sp->len - 1]->props.flags & 881 XFRM_STATE_ICMP)) { 882 reason = SKB_DROP_REASON_XFRM_POLICY; 883 goto drop_no_count; 884 } 885 886 if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr))) 887 goto drop_no_count; 888 889 nh = skb_network_offset(skb); 890 skb_set_network_header(skb, sizeof(*hdr)); 891 892 if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, 893 skb)) { 894 reason = SKB_DROP_REASON_XFRM_POLICY; 895 goto drop_no_count; 896 } 897 898 skb_set_network_header(skb, nh); 899 } 900 901 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS); 902 903 saddr = &ipv6_hdr(skb)->saddr; 904 daddr = &ipv6_hdr(skb)->daddr; 905 906 if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) { 907 net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n", 908 saddr, daddr); 909 goto csum_error; 910 } 911 912 if (!pskb_pull(skb, sizeof(*hdr))) 913 goto discard_it; 914 915 hdr = icmp6_hdr(skb); 916 917 type = hdr->icmp6_type; 918 919 ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type); 920 921 switch (type) { 922 case ICMPV6_ECHO_REQUEST: 923 if (!net->ipv6.sysctl.icmpv6_echo_ignore_all) 924 icmpv6_echo_reply(skb); 925 break; 926 case ICMPV6_EXT_ECHO_REQUEST: 927 if (!net->ipv6.sysctl.icmpv6_echo_ignore_all && 928 READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe)) 929 icmpv6_echo_reply(skb); 930 break; 931 932 case ICMPV6_ECHO_REPLY: 933 reason = ping_rcv(skb); 934 break; 935 936 case ICMPV6_EXT_ECHO_REPLY: 937 reason = ping_rcv(skb); 938 break; 939 940 case ICMPV6_PKT_TOOBIG: 941 /* BUGGG_FUTURE: if packet contains rthdr, we cannot update 942 standard destination cache. Seems, only "advanced" 943 destination cache will allow to solve this problem 944 --ANK (980726) 945 */ 946 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) 947 goto discard_it; 948 hdr = icmp6_hdr(skb); 949 950 /* to notify */ 951 fallthrough; 952 case ICMPV6_DEST_UNREACH: 953 case ICMPV6_TIME_EXCEED: 954 case ICMPV6_PARAMPROB: 955 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu); 956 break; 957 958 case NDISC_ROUTER_SOLICITATION: 959 case NDISC_ROUTER_ADVERTISEMENT: 960 case NDISC_NEIGHBOUR_SOLICITATION: 961 case NDISC_NEIGHBOUR_ADVERTISEMENT: 962 case NDISC_REDIRECT: 963 ndisc_rcv(skb); 964 break; 965 966 case ICMPV6_MGM_QUERY: 967 igmp6_event_query(skb); 968 return 0; 969 970 case ICMPV6_MGM_REPORT: 971 igmp6_event_report(skb); 972 return 0; 973 974 case ICMPV6_MGM_REDUCTION: 975 case ICMPV6_NI_QUERY: 976 case ICMPV6_NI_REPLY: 977 case ICMPV6_MLD2_REPORT: 978 case ICMPV6_DHAAD_REQUEST: 979 case ICMPV6_DHAAD_REPLY: 980 case ICMPV6_MOBILE_PREFIX_SOL: 981 case ICMPV6_MOBILE_PREFIX_ADV: 982 break; 983 984 default: 985 /* informational */ 986 if (type & ICMPV6_INFOMSG_MASK) 987 break; 988 989 net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n", 990 saddr, daddr); 991 992 /* 993 * error of unknown type. 994 * must pass to upper level 995 */ 996 997 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu); 998 } 999 1000 /* until the v6 path can be better sorted assume failure and 1001 * preserve the status quo behaviour for the rest of the paths to here 1002 */ 1003 if (reason) 1004 kfree_skb_reason(skb, reason); 1005 else 1006 consume_skb(skb); 1007 1008 return 0; 1009 1010 csum_error: 1011 reason = SKB_DROP_REASON_ICMP_CSUM; 1012 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS); 1013 discard_it: 1014 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS); 1015 drop_no_count: 1016 kfree_skb_reason(skb, reason); 1017 return 0; 1018 } 1019 1020 void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6, 1021 u8 type, 1022 const struct in6_addr *saddr, 1023 const struct in6_addr *daddr, 1024 int oif) 1025 { 1026 memset(fl6, 0, sizeof(*fl6)); 1027 fl6->saddr = *saddr; 1028 fl6->daddr = *daddr; 1029 fl6->flowi6_proto = IPPROTO_ICMPV6; 1030 fl6->fl6_icmp_type = type; 1031 fl6->fl6_icmp_code = 0; 1032 fl6->flowi6_oif = oif; 1033 security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6)); 1034 } 1035 1036 int __init icmpv6_init(void) 1037 { 1038 struct sock *sk; 1039 int err, i; 1040 1041 for_each_possible_cpu(i) { 1042 err = inet_ctl_sock_create(&sk, PF_INET6, 1043 SOCK_RAW, IPPROTO_ICMPV6, &init_net); 1044 if (err < 0) { 1045 pr_err("Failed to initialize the ICMP6 control socket (err %d)\n", 1046 err); 1047 return err; 1048 } 1049 1050 per_cpu(ipv6_icmp_sk, i) = sk; 1051 1052 /* Enough space for 2 64K ICMP packets, including 1053 * sk_buff struct overhead. 1054 */ 1055 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024); 1056 } 1057 1058 err = -EAGAIN; 1059 if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0) 1060 goto fail; 1061 1062 err = inet6_register_icmp_sender(icmp6_send); 1063 if (err) 1064 goto sender_reg_err; 1065 return 0; 1066 1067 sender_reg_err: 1068 inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6); 1069 fail: 1070 pr_err("Failed to register ICMP6 protocol\n"); 1071 return err; 1072 } 1073 1074 void icmpv6_cleanup(void) 1075 { 1076 inet6_unregister_icmp_sender(icmp6_send); 1077 inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6); 1078 } 1079 1080 1081 static const struct icmp6_err { 1082 int err; 1083 int fatal; 1084 } tab_unreach[] = { 1085 { /* NOROUTE */ 1086 .err = ENETUNREACH, 1087 .fatal = 0, 1088 }, 1089 { /* ADM_PROHIBITED */ 1090 .err = EACCES, 1091 .fatal = 1, 1092 }, 1093 { /* Was NOT_NEIGHBOUR, now reserved */ 1094 .err = EHOSTUNREACH, 1095 .fatal = 0, 1096 }, 1097 { /* ADDR_UNREACH */ 1098 .err = EHOSTUNREACH, 1099 .fatal = 0, 1100 }, 1101 { /* PORT_UNREACH */ 1102 .err = ECONNREFUSED, 1103 .fatal = 1, 1104 }, 1105 { /* POLICY_FAIL */ 1106 .err = EACCES, 1107 .fatal = 1, 1108 }, 1109 { /* REJECT_ROUTE */ 1110 .err = EACCES, 1111 .fatal = 1, 1112 }, 1113 }; 1114 1115 int icmpv6_err_convert(u8 type, u8 code, int *err) 1116 { 1117 int fatal = 0; 1118 1119 *err = EPROTO; 1120 1121 switch (type) { 1122 case ICMPV6_DEST_UNREACH: 1123 fatal = 1; 1124 if (code < ARRAY_SIZE(tab_unreach)) { 1125 *err = tab_unreach[code].err; 1126 fatal = tab_unreach[code].fatal; 1127 } 1128 break; 1129 1130 case ICMPV6_PKT_TOOBIG: 1131 *err = EMSGSIZE; 1132 break; 1133 1134 case ICMPV6_PARAMPROB: 1135 *err = EPROTO; 1136 fatal = 1; 1137 break; 1138 1139 case ICMPV6_TIME_EXCEED: 1140 *err = EHOSTUNREACH; 1141 break; 1142 } 1143 1144 return fatal; 1145 } 1146 EXPORT_SYMBOL(icmpv6_err_convert); 1147 1148 #ifdef CONFIG_SYSCTL 1149 static struct ctl_table ipv6_icmp_table_template[] = { 1150 { 1151 .procname = "ratelimit", 1152 .data = &init_net.ipv6.sysctl.icmpv6_time, 1153 .maxlen = sizeof(int), 1154 .mode = 0644, 1155 .proc_handler = proc_dointvec_ms_jiffies, 1156 }, 1157 { 1158 .procname = "echo_ignore_all", 1159 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_all, 1160 .maxlen = sizeof(u8), 1161 .mode = 0644, 1162 .proc_handler = proc_dou8vec_minmax, 1163 }, 1164 { 1165 .procname = "echo_ignore_multicast", 1166 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_multicast, 1167 .maxlen = sizeof(u8), 1168 .mode = 0644, 1169 .proc_handler = proc_dou8vec_minmax, 1170 }, 1171 { 1172 .procname = "echo_ignore_anycast", 1173 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_anycast, 1174 .maxlen = sizeof(u8), 1175 .mode = 0644, 1176 .proc_handler = proc_dou8vec_minmax, 1177 }, 1178 { 1179 .procname = "ratemask", 1180 .data = &init_net.ipv6.sysctl.icmpv6_ratemask_ptr, 1181 .maxlen = ICMPV6_MSG_MAX + 1, 1182 .mode = 0644, 1183 .proc_handler = proc_do_large_bitmap, 1184 }, 1185 { }, 1186 }; 1187 1188 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net) 1189 { 1190 struct ctl_table *table; 1191 1192 table = kmemdup(ipv6_icmp_table_template, 1193 sizeof(ipv6_icmp_table_template), 1194 GFP_KERNEL); 1195 1196 if (table) { 1197 table[0].data = &net->ipv6.sysctl.icmpv6_time; 1198 table[1].data = &net->ipv6.sysctl.icmpv6_echo_ignore_all; 1199 table[2].data = &net->ipv6.sysctl.icmpv6_echo_ignore_multicast; 1200 table[3].data = &net->ipv6.sysctl.icmpv6_echo_ignore_anycast; 1201 table[4].data = &net->ipv6.sysctl.icmpv6_ratemask_ptr; 1202 } 1203 return table; 1204 } 1205 #endif 1206