1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * Internet Control Message Protocol (ICMPv6) 4 * Linux INET6 implementation 5 * 6 * Authors: 7 * Pedro Roque <roque@di.fc.ul.pt> 8 * 9 * Based on net/ipv4/icmp.c 10 * 11 * RFC 1885 12 */ 13 14 /* 15 * Changes: 16 * 17 * Andi Kleen : exception handling 18 * Andi Kleen add rate limits. never reply to a icmp. 19 * add more length checks and other fixes. 20 * yoshfuji : ensure to sent parameter problem for 21 * fragments. 22 * YOSHIFUJI Hideaki @USAGI: added sysctl for icmp rate limit. 23 * Randy Dunlap and 24 * YOSHIFUJI Hideaki @USAGI: Per-interface statistics support 25 * Kazunori MIYAZAWA @USAGI: change output process to use ip6_append_data 26 */ 27 28 #define pr_fmt(fmt) "IPv6: " fmt 29 30 #include <linux/module.h> 31 #include <linux/errno.h> 32 #include <linux/types.h> 33 #include <linux/socket.h> 34 #include <linux/in.h> 35 #include <linux/kernel.h> 36 #include <linux/sockios.h> 37 #include <linux/net.h> 38 #include <linux/skbuff.h> 39 #include <linux/init.h> 40 #include <linux/netfilter.h> 41 #include <linux/slab.h> 42 43 #ifdef CONFIG_SYSCTL 44 #include <linux/sysctl.h> 45 #endif 46 47 #include <linux/inet.h> 48 #include <linux/netdevice.h> 49 #include <linux/icmpv6.h> 50 51 #include <net/ip.h> 52 #include <net/sock.h> 53 54 #include <net/ipv6.h> 55 #include <net/ip6_checksum.h> 56 #include <net/ping.h> 57 #include <net/protocol.h> 58 #include <net/raw.h> 59 #include <net/rawv6.h> 60 #include <net/seg6.h> 61 #include <net/transp_v6.h> 62 #include <net/ip6_route.h> 63 #include <net/addrconf.h> 64 #include <net/icmp.h> 65 #include <net/xfrm.h> 66 #include <net/inet_common.h> 67 #include <net/dsfield.h> 68 #include <net/l3mdev.h> 69 70 #include <linux/uaccess.h> 71 72 static DEFINE_PER_CPU(struct sock *, ipv6_icmp_sk); 73 74 static int icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, 75 u8 type, u8 code, int offset, __be32 info) 76 { 77 /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */ 78 struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset); 79 struct net *net = dev_net(skb->dev); 80 81 if (type == ICMPV6_PKT_TOOBIG) 82 ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL)); 83 else if (type == NDISC_REDIRECT) 84 ip6_redirect(skb, net, skb->dev->ifindex, 0, 85 sock_net_uid(net, NULL)); 86 87 if (!(type & ICMPV6_INFOMSG_MASK)) 88 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST) 89 ping_err(skb, offset, ntohl(info)); 90 91 return 0; 92 } 93 94 static int icmpv6_rcv(struct sk_buff *skb); 95 96 static const struct inet6_protocol icmpv6_protocol = { 97 .handler = icmpv6_rcv, 98 .err_handler = icmpv6_err, 99 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, 100 }; 101 102 /* Called with BH disabled */ 103 static struct sock *icmpv6_xmit_lock(struct net *net) 104 { 105 struct sock *sk; 106 107 sk = this_cpu_read(ipv6_icmp_sk); 108 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { 109 /* This can happen if the output path (f.e. SIT or 110 * ip6ip6 tunnel) signals dst_link_failure() for an 111 * outgoing ICMP6 packet. 112 */ 113 return NULL; 114 } 115 sock_net_set(sk, net); 116 return sk; 117 } 118 119 static void icmpv6_xmit_unlock(struct sock *sk) 120 { 121 sock_net_set(sk, &init_net); 122 spin_unlock(&sk->sk_lock.slock); 123 } 124 125 /* 126 * Figure out, may we reply to this packet with icmp error. 127 * 128 * We do not reply, if: 129 * - it was icmp error message. 130 * - it is truncated, so that it is known, that protocol is ICMPV6 131 * (i.e. in the middle of some exthdr) 132 * 133 * --ANK (980726) 134 */ 135 136 static bool is_ineligible(const struct sk_buff *skb) 137 { 138 int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data; 139 int len = skb->len - ptr; 140 __u8 nexthdr = ipv6_hdr(skb)->nexthdr; 141 __be16 frag_off; 142 143 if (len < 0) 144 return true; 145 146 ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off); 147 if (ptr < 0) 148 return false; 149 if (nexthdr == IPPROTO_ICMPV6) { 150 u8 _type, *tp; 151 tp = skb_header_pointer(skb, 152 ptr+offsetof(struct icmp6hdr, icmp6_type), 153 sizeof(_type), &_type); 154 155 /* Based on RFC 8200, Section 4.5 Fragment Header, return 156 * false if this is a fragment packet with no icmp header info. 157 */ 158 if (!tp && frag_off != 0) 159 return false; 160 else if (!tp || !(*tp & ICMPV6_INFOMSG_MASK)) 161 return true; 162 } 163 return false; 164 } 165 166 static bool icmpv6_mask_allow(struct net *net, int type) 167 { 168 if (type > ICMPV6_MSG_MAX) 169 return true; 170 171 /* Limit if icmp type is set in ratemask. */ 172 if (!test_bit(type, net->ipv6.sysctl.icmpv6_ratemask)) 173 return true; 174 175 return false; 176 } 177 178 static bool icmpv6_global_allow(struct net *net, int type) 179 { 180 if (icmpv6_mask_allow(net, type)) 181 return true; 182 183 if (icmp_global_allow()) 184 return true; 185 186 __ICMP_INC_STATS(net, ICMP_MIB_RATELIMITGLOBAL); 187 return false; 188 } 189 190 /* 191 * Check the ICMP output rate limit 192 */ 193 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type, 194 struct flowi6 *fl6) 195 { 196 struct net *net = sock_net(sk); 197 struct dst_entry *dst; 198 bool res = false; 199 200 if (icmpv6_mask_allow(net, type)) 201 return true; 202 203 /* 204 * Look up the output route. 205 * XXX: perhaps the expire for routing entries cloned by 206 * this lookup should be more aggressive (not longer than timeout). 207 */ 208 dst = ip6_route_output(net, sk, fl6); 209 if (dst->error) { 210 IP6_INC_STATS(net, ip6_dst_idev(dst), 211 IPSTATS_MIB_OUTNOROUTES); 212 } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) { 213 res = true; 214 } else { 215 struct rt6_info *rt = (struct rt6_info *)dst; 216 int tmo = net->ipv6.sysctl.icmpv6_time; 217 struct inet_peer *peer; 218 219 /* Give more bandwidth to wider prefixes. */ 220 if (rt->rt6i_dst.plen < 128) 221 tmo >>= ((128 - rt->rt6i_dst.plen)>>5); 222 223 peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1); 224 res = inet_peer_xrlim_allow(peer, tmo); 225 if (peer) 226 inet_putpeer(peer); 227 } 228 if (!res) 229 __ICMP6_INC_STATS(net, ip6_dst_idev(dst), 230 ICMP6_MIB_RATELIMITHOST); 231 dst_release(dst); 232 return res; 233 } 234 235 static bool icmpv6_rt_has_prefsrc(struct sock *sk, u8 type, 236 struct flowi6 *fl6) 237 { 238 struct net *net = sock_net(sk); 239 struct dst_entry *dst; 240 bool res = false; 241 242 dst = ip6_route_output(net, sk, fl6); 243 if (!dst->error) { 244 struct rt6_info *rt = (struct rt6_info *)dst; 245 struct in6_addr prefsrc; 246 247 rt6_get_prefsrc(rt, &prefsrc); 248 res = !ipv6_addr_any(&prefsrc); 249 } 250 dst_release(dst); 251 return res; 252 } 253 254 /* 255 * an inline helper for the "simple" if statement below 256 * checks if parameter problem report is caused by an 257 * unrecognized IPv6 option that has the Option Type 258 * highest-order two bits set to 10 259 */ 260 261 static bool opt_unrec(struct sk_buff *skb, __u32 offset) 262 { 263 u8 _optval, *op; 264 265 offset += skb_network_offset(skb); 266 op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval); 267 if (!op) 268 return true; 269 return (*op & 0xC0) == 0x80; 270 } 271 272 void icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, 273 struct icmp6hdr *thdr, int len) 274 { 275 struct sk_buff *skb; 276 struct icmp6hdr *icmp6h; 277 278 skb = skb_peek(&sk->sk_write_queue); 279 if (!skb) 280 return; 281 282 icmp6h = icmp6_hdr(skb); 283 memcpy(icmp6h, thdr, sizeof(struct icmp6hdr)); 284 icmp6h->icmp6_cksum = 0; 285 286 if (skb_queue_len(&sk->sk_write_queue) == 1) { 287 skb->csum = csum_partial(icmp6h, 288 sizeof(struct icmp6hdr), skb->csum); 289 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr, 290 &fl6->daddr, 291 len, fl6->flowi6_proto, 292 skb->csum); 293 } else { 294 __wsum tmp_csum = 0; 295 296 skb_queue_walk(&sk->sk_write_queue, skb) { 297 tmp_csum = csum_add(tmp_csum, skb->csum); 298 } 299 300 tmp_csum = csum_partial(icmp6h, 301 sizeof(struct icmp6hdr), tmp_csum); 302 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr, 303 &fl6->daddr, 304 len, fl6->flowi6_proto, 305 tmp_csum); 306 } 307 ip6_push_pending_frames(sk); 308 } 309 310 struct icmpv6_msg { 311 struct sk_buff *skb; 312 int offset; 313 uint8_t type; 314 }; 315 316 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb) 317 { 318 struct icmpv6_msg *msg = (struct icmpv6_msg *) from; 319 struct sk_buff *org_skb = msg->skb; 320 __wsum csum; 321 322 csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset, 323 to, len); 324 skb->csum = csum_block_add(skb->csum, csum, odd); 325 if (!(msg->type & ICMPV6_INFOMSG_MASK)) 326 nf_ct_attach(skb, org_skb); 327 return 0; 328 } 329 330 #if IS_ENABLED(CONFIG_IPV6_MIP6) 331 static void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt) 332 { 333 struct ipv6hdr *iph = ipv6_hdr(skb); 334 struct ipv6_destopt_hao *hao; 335 int off; 336 337 if (opt->dsthao) { 338 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO); 339 if (likely(off >= 0)) { 340 hao = (struct ipv6_destopt_hao *) 341 (skb_network_header(skb) + off); 342 swap(iph->saddr, hao->addr); 343 } 344 } 345 } 346 #else 347 static inline void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt) {} 348 #endif 349 350 static struct dst_entry *icmpv6_route_lookup(struct net *net, 351 struct sk_buff *skb, 352 struct sock *sk, 353 struct flowi6 *fl6) 354 { 355 struct dst_entry *dst, *dst2; 356 struct flowi6 fl2; 357 int err; 358 359 err = ip6_dst_lookup(net, sk, &dst, fl6); 360 if (err) 361 return ERR_PTR(err); 362 363 /* 364 * We won't send icmp if the destination is known 365 * anycast unless we need to treat anycast as unicast. 366 */ 367 if (!READ_ONCE(net->ipv6.sysctl.icmpv6_error_anycast_as_unicast) && 368 ipv6_anycast_destination(dst, &fl6->daddr)) { 369 net_dbg_ratelimited("icmp6_send: acast source\n"); 370 dst_release(dst); 371 return ERR_PTR(-EINVAL); 372 } 373 374 /* No need to clone since we're just using its address. */ 375 dst2 = dst; 376 377 dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0); 378 if (!IS_ERR(dst)) { 379 if (dst != dst2) 380 return dst; 381 } else { 382 if (PTR_ERR(dst) == -EPERM) 383 dst = NULL; 384 else 385 return dst; 386 } 387 388 err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6); 389 if (err) 390 goto relookup_failed; 391 392 err = ip6_dst_lookup(net, sk, &dst2, &fl2); 393 if (err) 394 goto relookup_failed; 395 396 dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP); 397 if (!IS_ERR(dst2)) { 398 dst_release(dst); 399 dst = dst2; 400 } else { 401 err = PTR_ERR(dst2); 402 if (err == -EPERM) { 403 dst_release(dst); 404 return dst2; 405 } else 406 goto relookup_failed; 407 } 408 409 relookup_failed: 410 if (dst) 411 return dst; 412 return ERR_PTR(err); 413 } 414 415 static struct net_device *icmp6_dev(const struct sk_buff *skb) 416 { 417 struct net_device *dev = skb->dev; 418 419 /* for local traffic to local address, skb dev is the loopback 420 * device. Check if there is a dst attached to the skb and if so 421 * get the real device index. Same is needed for replies to a link 422 * local address on a device enslaved to an L3 master device 423 */ 424 if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) { 425 const struct rt6_info *rt6 = skb_rt6_info(skb); 426 427 if (rt6) 428 dev = rt6->rt6i_idev->dev; 429 } 430 431 return dev; 432 } 433 434 static int icmp6_iif(const struct sk_buff *skb) 435 { 436 return icmp6_dev(skb)->ifindex; 437 } 438 439 /* 440 * Send an ICMP message in response to a packet in error 441 */ 442 void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info, 443 const struct in6_addr *force_saddr, 444 const struct inet6_skb_parm *parm) 445 { 446 struct inet6_dev *idev = NULL; 447 struct ipv6hdr *hdr = ipv6_hdr(skb); 448 struct sock *sk; 449 struct net *net; 450 struct ipv6_pinfo *np; 451 const struct in6_addr *saddr = NULL; 452 struct dst_entry *dst; 453 struct icmp6hdr tmp_hdr; 454 struct flowi6 fl6; 455 struct icmpv6_msg msg; 456 struct ipcm6_cookie ipc6; 457 int iif = 0; 458 int addr_type = 0; 459 int len; 460 u32 mark; 461 462 if ((u8 *)hdr < skb->head || 463 (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb)) 464 return; 465 466 if (!skb->dev) 467 return; 468 net = dev_net(skb->dev); 469 mark = IP6_REPLY_MARK(net, skb->mark); 470 /* 471 * Make sure we respect the rules 472 * i.e. RFC 1885 2.4(e) 473 * Rule (e.1) is enforced by not using icmp6_send 474 * in any code that processes icmp errors. 475 */ 476 addr_type = ipv6_addr_type(&hdr->daddr); 477 478 if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) || 479 ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr)) 480 saddr = &hdr->daddr; 481 482 /* 483 * Dest addr check 484 */ 485 486 if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) { 487 if (type != ICMPV6_PKT_TOOBIG && 488 !(type == ICMPV6_PARAMPROB && 489 code == ICMPV6_UNK_OPTION && 490 (opt_unrec(skb, info)))) 491 return; 492 493 saddr = NULL; 494 } 495 496 addr_type = ipv6_addr_type(&hdr->saddr); 497 498 /* 499 * Source addr check 500 */ 501 502 if (__ipv6_addr_needs_scope_id(addr_type)) { 503 iif = icmp6_iif(skb); 504 } else { 505 /* 506 * The source device is used for looking up which routing table 507 * to use for sending an ICMP error. 508 */ 509 iif = l3mdev_master_ifindex(skb->dev); 510 } 511 512 /* 513 * Must not send error if the source does not uniquely 514 * identify a single node (RFC2463 Section 2.4). 515 * We check unspecified / multicast addresses here, 516 * and anycast addresses will be checked later. 517 */ 518 if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) { 519 net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n", 520 &hdr->saddr, &hdr->daddr); 521 return; 522 } 523 524 /* 525 * Never answer to a ICMP packet. 526 */ 527 if (is_ineligible(skb)) { 528 net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n", 529 &hdr->saddr, &hdr->daddr); 530 return; 531 } 532 533 /* Needed by both icmp_global_allow and icmpv6_xmit_lock */ 534 local_bh_disable(); 535 536 /* Check global sysctl_icmp_msgs_per_sec ratelimit */ 537 if (!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, type)) 538 goto out_bh_enable; 539 540 mip6_addr_swap(skb, parm); 541 542 sk = icmpv6_xmit_lock(net); 543 if (!sk) 544 goto out_bh_enable; 545 546 memset(&fl6, 0, sizeof(fl6)); 547 fl6.flowi6_proto = IPPROTO_ICMPV6; 548 fl6.daddr = hdr->saddr; 549 if (force_saddr) 550 saddr = force_saddr; 551 if (saddr) { 552 fl6.saddr = *saddr; 553 } else if (!icmpv6_rt_has_prefsrc(sk, type, &fl6)) { 554 /* select a more meaningful saddr from input if */ 555 struct net_device *in_netdev; 556 557 in_netdev = dev_get_by_index(net, parm->iif); 558 if (in_netdev) { 559 ipv6_dev_get_saddr(net, in_netdev, &fl6.daddr, 560 inet6_sk(sk)->srcprefs, 561 &fl6.saddr); 562 dev_put(in_netdev); 563 } 564 } 565 fl6.flowi6_mark = mark; 566 fl6.flowi6_oif = iif; 567 fl6.fl6_icmp_type = type; 568 fl6.fl6_icmp_code = code; 569 fl6.flowi6_uid = sock_net_uid(net, NULL); 570 fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL); 571 security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6)); 572 573 np = inet6_sk(sk); 574 575 if (!icmpv6_xrlim_allow(sk, type, &fl6)) 576 goto out; 577 578 tmp_hdr.icmp6_type = type; 579 tmp_hdr.icmp6_code = code; 580 tmp_hdr.icmp6_cksum = 0; 581 tmp_hdr.icmp6_pointer = htonl(info); 582 583 if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) 584 fl6.flowi6_oif = np->mcast_oif; 585 else if (!fl6.flowi6_oif) 586 fl6.flowi6_oif = np->ucast_oif; 587 588 ipcm6_init_sk(&ipc6, np); 589 ipc6.sockc.mark = mark; 590 fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel); 591 592 dst = icmpv6_route_lookup(net, skb, sk, &fl6); 593 if (IS_ERR(dst)) 594 goto out; 595 596 ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst); 597 598 msg.skb = skb; 599 msg.offset = skb_network_offset(skb); 600 msg.type = type; 601 602 len = skb->len - msg.offset; 603 len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr)); 604 if (len < 0) { 605 net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n", 606 &hdr->saddr, &hdr->daddr); 607 goto out_dst_release; 608 } 609 610 rcu_read_lock(); 611 idev = __in6_dev_get(skb->dev); 612 613 if (ip6_append_data(sk, icmpv6_getfrag, &msg, 614 len + sizeof(struct icmp6hdr), 615 sizeof(struct icmp6hdr), 616 &ipc6, &fl6, (struct rt6_info *)dst, 617 MSG_DONTWAIT)) { 618 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS); 619 ip6_flush_pending_frames(sk); 620 } else { 621 icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, 622 len + sizeof(struct icmp6hdr)); 623 } 624 rcu_read_unlock(); 625 out_dst_release: 626 dst_release(dst); 627 out: 628 icmpv6_xmit_unlock(sk); 629 out_bh_enable: 630 local_bh_enable(); 631 } 632 EXPORT_SYMBOL(icmp6_send); 633 634 /* Slightly more convenient version of icmp6_send with drop reasons. 635 */ 636 void icmpv6_param_prob_reason(struct sk_buff *skb, u8 code, int pos, 637 enum skb_drop_reason reason) 638 { 639 icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL, IP6CB(skb)); 640 kfree_skb_reason(skb, reason); 641 } 642 643 /* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH 644 * if sufficient data bytes are available 645 * @nhs is the size of the tunnel header(s) : 646 * Either an IPv4 header for SIT encap 647 * an IPv4 header + GRE header for GRE encap 648 */ 649 int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type, 650 unsigned int data_len) 651 { 652 struct in6_addr temp_saddr; 653 struct rt6_info *rt; 654 struct sk_buff *skb2; 655 u32 info = 0; 656 657 if (!pskb_may_pull(skb, nhs + sizeof(struct ipv6hdr) + 8)) 658 return 1; 659 660 /* RFC 4884 (partial) support for ICMP extensions */ 661 if (data_len < 128 || (data_len & 7) || skb->len < data_len) 662 data_len = 0; 663 664 skb2 = data_len ? skb_copy(skb, GFP_ATOMIC) : skb_clone(skb, GFP_ATOMIC); 665 666 if (!skb2) 667 return 1; 668 669 skb_dst_drop(skb2); 670 skb_pull(skb2, nhs); 671 skb_reset_network_header(skb2); 672 673 rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0, 674 skb, 0); 675 676 if (rt && rt->dst.dev) 677 skb2->dev = rt->dst.dev; 678 679 ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, &temp_saddr); 680 681 if (data_len) { 682 /* RFC 4884 (partial) support : 683 * insert 0 padding at the end, before the extensions 684 */ 685 __skb_push(skb2, nhs); 686 skb_reset_network_header(skb2); 687 memmove(skb2->data, skb2->data + nhs, data_len - nhs); 688 memset(skb2->data + data_len - nhs, 0, nhs); 689 /* RFC 4884 4.5 : Length is measured in 64-bit words, 690 * and stored in reserved[0] 691 */ 692 info = (data_len/8) << 24; 693 } 694 if (type == ICMP_TIME_EXCEEDED) 695 icmp6_send(skb2, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 696 info, &temp_saddr, IP6CB(skb2)); 697 else 698 icmp6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 699 info, &temp_saddr, IP6CB(skb2)); 700 if (rt) 701 ip6_rt_put(rt); 702 703 kfree_skb(skb2); 704 705 return 0; 706 } 707 EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach); 708 709 static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb) 710 { 711 struct net *net = dev_net(skb->dev); 712 struct sock *sk; 713 struct inet6_dev *idev; 714 struct ipv6_pinfo *np; 715 const struct in6_addr *saddr = NULL; 716 struct icmp6hdr *icmph = icmp6_hdr(skb); 717 struct icmp6hdr tmp_hdr; 718 struct flowi6 fl6; 719 struct icmpv6_msg msg; 720 struct dst_entry *dst; 721 struct ipcm6_cookie ipc6; 722 u32 mark = IP6_REPLY_MARK(net, skb->mark); 723 SKB_DR(reason); 724 bool acast; 725 u8 type; 726 727 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) && 728 net->ipv6.sysctl.icmpv6_echo_ignore_multicast) 729 return reason; 730 731 saddr = &ipv6_hdr(skb)->daddr; 732 733 acast = ipv6_anycast_destination(skb_dst(skb), saddr); 734 if (acast && net->ipv6.sysctl.icmpv6_echo_ignore_anycast) 735 return reason; 736 737 if (!ipv6_unicast_destination(skb) && 738 !(net->ipv6.sysctl.anycast_src_echo_reply && acast)) 739 saddr = NULL; 740 741 if (icmph->icmp6_type == ICMPV6_EXT_ECHO_REQUEST) 742 type = ICMPV6_EXT_ECHO_REPLY; 743 else 744 type = ICMPV6_ECHO_REPLY; 745 746 memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr)); 747 tmp_hdr.icmp6_type = type; 748 749 memset(&fl6, 0, sizeof(fl6)); 750 if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES) 751 fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb)); 752 753 fl6.flowi6_proto = IPPROTO_ICMPV6; 754 fl6.daddr = ipv6_hdr(skb)->saddr; 755 if (saddr) 756 fl6.saddr = *saddr; 757 fl6.flowi6_oif = icmp6_iif(skb); 758 fl6.fl6_icmp_type = type; 759 fl6.flowi6_mark = mark; 760 fl6.flowi6_uid = sock_net_uid(net, NULL); 761 security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6)); 762 763 local_bh_disable(); 764 sk = icmpv6_xmit_lock(net); 765 if (!sk) 766 goto out_bh_enable; 767 np = inet6_sk(sk); 768 769 if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) 770 fl6.flowi6_oif = np->mcast_oif; 771 else if (!fl6.flowi6_oif) 772 fl6.flowi6_oif = np->ucast_oif; 773 774 if (ip6_dst_lookup(net, sk, &dst, &fl6)) 775 goto out; 776 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0); 777 if (IS_ERR(dst)) 778 goto out; 779 780 /* Check the ratelimit */ 781 if ((!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, ICMPV6_ECHO_REPLY)) || 782 !icmpv6_xrlim_allow(sk, ICMPV6_ECHO_REPLY, &fl6)) 783 goto out_dst_release; 784 785 idev = __in6_dev_get(skb->dev); 786 787 msg.skb = skb; 788 msg.offset = 0; 789 msg.type = type; 790 791 ipcm6_init_sk(&ipc6, np); 792 ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst); 793 ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb)); 794 ipc6.sockc.mark = mark; 795 796 if (icmph->icmp6_type == ICMPV6_EXT_ECHO_REQUEST) 797 if (!icmp_build_probe(skb, (struct icmphdr *)&tmp_hdr)) 798 goto out_dst_release; 799 800 if (ip6_append_data(sk, icmpv6_getfrag, &msg, 801 skb->len + sizeof(struct icmp6hdr), 802 sizeof(struct icmp6hdr), &ipc6, &fl6, 803 (struct rt6_info *)dst, MSG_DONTWAIT)) { 804 __ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS); 805 ip6_flush_pending_frames(sk); 806 } else { 807 icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, 808 skb->len + sizeof(struct icmp6hdr)); 809 reason = SKB_CONSUMED; 810 } 811 out_dst_release: 812 dst_release(dst); 813 out: 814 icmpv6_xmit_unlock(sk); 815 out_bh_enable: 816 local_bh_enable(); 817 return reason; 818 } 819 820 enum skb_drop_reason icmpv6_notify(struct sk_buff *skb, u8 type, 821 u8 code, __be32 info) 822 { 823 struct inet6_skb_parm *opt = IP6CB(skb); 824 struct net *net = dev_net(skb->dev); 825 const struct inet6_protocol *ipprot; 826 enum skb_drop_reason reason; 827 int inner_offset; 828 __be16 frag_off; 829 u8 nexthdr; 830 831 reason = pskb_may_pull_reason(skb, sizeof(struct ipv6hdr)); 832 if (reason != SKB_NOT_DROPPED_YET) 833 goto out; 834 835 seg6_icmp_srh(skb, opt); 836 837 nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr; 838 if (ipv6_ext_hdr(nexthdr)) { 839 /* now skip over extension headers */ 840 inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), 841 &nexthdr, &frag_off); 842 if (inner_offset < 0) { 843 SKB_DR_SET(reason, IPV6_BAD_EXTHDR); 844 goto out; 845 } 846 } else { 847 inner_offset = sizeof(struct ipv6hdr); 848 } 849 850 /* Checkin header including 8 bytes of inner protocol header. */ 851 reason = pskb_may_pull_reason(skb, inner_offset + 8); 852 if (reason != SKB_NOT_DROPPED_YET) 853 goto out; 854 855 /* BUGGG_FUTURE: we should try to parse exthdrs in this packet. 856 Without this we will not able f.e. to make source routed 857 pmtu discovery. 858 Corresponding argument (opt) to notifiers is already added. 859 --ANK (980726) 860 */ 861 862 ipprot = rcu_dereference(inet6_protos[nexthdr]); 863 if (ipprot && ipprot->err_handler) 864 ipprot->err_handler(skb, opt, type, code, inner_offset, info); 865 866 raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info); 867 return SKB_CONSUMED; 868 869 out: 870 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS); 871 return reason; 872 } 873 874 /* 875 * Handle icmp messages 876 */ 877 878 static int icmpv6_rcv(struct sk_buff *skb) 879 { 880 enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED; 881 struct net *net = dev_net(skb->dev); 882 struct net_device *dev = icmp6_dev(skb); 883 struct inet6_dev *idev = __in6_dev_get(dev); 884 const struct in6_addr *saddr, *daddr; 885 struct icmp6hdr *hdr; 886 u8 type; 887 888 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { 889 struct sec_path *sp = skb_sec_path(skb); 890 int nh; 891 892 if (!(sp && sp->xvec[sp->len - 1]->props.flags & 893 XFRM_STATE_ICMP)) { 894 reason = SKB_DROP_REASON_XFRM_POLICY; 895 goto drop_no_count; 896 } 897 898 if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr))) 899 goto drop_no_count; 900 901 nh = skb_network_offset(skb); 902 skb_set_network_header(skb, sizeof(*hdr)); 903 904 if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, 905 skb)) { 906 reason = SKB_DROP_REASON_XFRM_POLICY; 907 goto drop_no_count; 908 } 909 910 skb_set_network_header(skb, nh); 911 } 912 913 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS); 914 915 saddr = &ipv6_hdr(skb)->saddr; 916 daddr = &ipv6_hdr(skb)->daddr; 917 918 if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) { 919 net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n", 920 saddr, daddr); 921 goto csum_error; 922 } 923 924 if (!pskb_pull(skb, sizeof(*hdr))) 925 goto discard_it; 926 927 hdr = icmp6_hdr(skb); 928 929 type = hdr->icmp6_type; 930 931 ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type); 932 933 switch (type) { 934 case ICMPV6_ECHO_REQUEST: 935 if (!net->ipv6.sysctl.icmpv6_echo_ignore_all) 936 reason = icmpv6_echo_reply(skb); 937 break; 938 case ICMPV6_EXT_ECHO_REQUEST: 939 if (!net->ipv6.sysctl.icmpv6_echo_ignore_all && 940 READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe)) 941 reason = icmpv6_echo_reply(skb); 942 break; 943 944 case ICMPV6_ECHO_REPLY: 945 reason = ping_rcv(skb); 946 break; 947 948 case ICMPV6_EXT_ECHO_REPLY: 949 reason = ping_rcv(skb); 950 break; 951 952 case ICMPV6_PKT_TOOBIG: 953 /* BUGGG_FUTURE: if packet contains rthdr, we cannot update 954 standard destination cache. Seems, only "advanced" 955 destination cache will allow to solve this problem 956 --ANK (980726) 957 */ 958 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) 959 goto discard_it; 960 hdr = icmp6_hdr(skb); 961 962 /* to notify */ 963 fallthrough; 964 case ICMPV6_DEST_UNREACH: 965 case ICMPV6_TIME_EXCEED: 966 case ICMPV6_PARAMPROB: 967 reason = icmpv6_notify(skb, type, hdr->icmp6_code, 968 hdr->icmp6_mtu); 969 break; 970 971 case NDISC_ROUTER_SOLICITATION: 972 case NDISC_ROUTER_ADVERTISEMENT: 973 case NDISC_NEIGHBOUR_SOLICITATION: 974 case NDISC_NEIGHBOUR_ADVERTISEMENT: 975 case NDISC_REDIRECT: 976 reason = ndisc_rcv(skb); 977 break; 978 979 case ICMPV6_MGM_QUERY: 980 igmp6_event_query(skb); 981 return 0; 982 983 case ICMPV6_MGM_REPORT: 984 igmp6_event_report(skb); 985 return 0; 986 987 case ICMPV6_MGM_REDUCTION: 988 case ICMPV6_NI_QUERY: 989 case ICMPV6_NI_REPLY: 990 case ICMPV6_MLD2_REPORT: 991 case ICMPV6_DHAAD_REQUEST: 992 case ICMPV6_DHAAD_REPLY: 993 case ICMPV6_MOBILE_PREFIX_SOL: 994 case ICMPV6_MOBILE_PREFIX_ADV: 995 break; 996 997 default: 998 /* informational */ 999 if (type & ICMPV6_INFOMSG_MASK) 1000 break; 1001 1002 net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n", 1003 saddr, daddr); 1004 1005 /* 1006 * error of unknown type. 1007 * must pass to upper level 1008 */ 1009 1010 reason = icmpv6_notify(skb, type, hdr->icmp6_code, 1011 hdr->icmp6_mtu); 1012 } 1013 1014 /* until the v6 path can be better sorted assume failure and 1015 * preserve the status quo behaviour for the rest of the paths to here 1016 */ 1017 if (reason) 1018 kfree_skb_reason(skb, reason); 1019 else 1020 consume_skb(skb); 1021 1022 return 0; 1023 1024 csum_error: 1025 reason = SKB_DROP_REASON_ICMP_CSUM; 1026 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS); 1027 discard_it: 1028 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS); 1029 drop_no_count: 1030 kfree_skb_reason(skb, reason); 1031 return 0; 1032 } 1033 1034 void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6, 1035 u8 type, 1036 const struct in6_addr *saddr, 1037 const struct in6_addr *daddr, 1038 int oif) 1039 { 1040 memset(fl6, 0, sizeof(*fl6)); 1041 fl6->saddr = *saddr; 1042 fl6->daddr = *daddr; 1043 fl6->flowi6_proto = IPPROTO_ICMPV6; 1044 fl6->fl6_icmp_type = type; 1045 fl6->fl6_icmp_code = 0; 1046 fl6->flowi6_oif = oif; 1047 security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6)); 1048 } 1049 1050 int __init icmpv6_init(void) 1051 { 1052 struct sock *sk; 1053 int err, i; 1054 1055 for_each_possible_cpu(i) { 1056 err = inet_ctl_sock_create(&sk, PF_INET6, 1057 SOCK_RAW, IPPROTO_ICMPV6, &init_net); 1058 if (err < 0) { 1059 pr_err("Failed to initialize the ICMP6 control socket (err %d)\n", 1060 err); 1061 return err; 1062 } 1063 1064 per_cpu(ipv6_icmp_sk, i) = sk; 1065 1066 /* Enough space for 2 64K ICMP packets, including 1067 * sk_buff struct overhead. 1068 */ 1069 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024); 1070 } 1071 1072 err = -EAGAIN; 1073 if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0) 1074 goto fail; 1075 1076 err = inet6_register_icmp_sender(icmp6_send); 1077 if (err) 1078 goto sender_reg_err; 1079 return 0; 1080 1081 sender_reg_err: 1082 inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6); 1083 fail: 1084 pr_err("Failed to register ICMP6 protocol\n"); 1085 return err; 1086 } 1087 1088 void icmpv6_cleanup(void) 1089 { 1090 inet6_unregister_icmp_sender(icmp6_send); 1091 inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6); 1092 } 1093 1094 1095 static const struct icmp6_err { 1096 int err; 1097 int fatal; 1098 } tab_unreach[] = { 1099 { /* NOROUTE */ 1100 .err = ENETUNREACH, 1101 .fatal = 0, 1102 }, 1103 { /* ADM_PROHIBITED */ 1104 .err = EACCES, 1105 .fatal = 1, 1106 }, 1107 { /* Was NOT_NEIGHBOUR, now reserved */ 1108 .err = EHOSTUNREACH, 1109 .fatal = 0, 1110 }, 1111 { /* ADDR_UNREACH */ 1112 .err = EHOSTUNREACH, 1113 .fatal = 0, 1114 }, 1115 { /* PORT_UNREACH */ 1116 .err = ECONNREFUSED, 1117 .fatal = 1, 1118 }, 1119 { /* POLICY_FAIL */ 1120 .err = EACCES, 1121 .fatal = 1, 1122 }, 1123 { /* REJECT_ROUTE */ 1124 .err = EACCES, 1125 .fatal = 1, 1126 }, 1127 }; 1128 1129 int icmpv6_err_convert(u8 type, u8 code, int *err) 1130 { 1131 int fatal = 0; 1132 1133 *err = EPROTO; 1134 1135 switch (type) { 1136 case ICMPV6_DEST_UNREACH: 1137 fatal = 1; 1138 if (code < ARRAY_SIZE(tab_unreach)) { 1139 *err = tab_unreach[code].err; 1140 fatal = tab_unreach[code].fatal; 1141 } 1142 break; 1143 1144 case ICMPV6_PKT_TOOBIG: 1145 *err = EMSGSIZE; 1146 break; 1147 1148 case ICMPV6_PARAMPROB: 1149 *err = EPROTO; 1150 fatal = 1; 1151 break; 1152 1153 case ICMPV6_TIME_EXCEED: 1154 *err = EHOSTUNREACH; 1155 break; 1156 } 1157 1158 return fatal; 1159 } 1160 EXPORT_SYMBOL(icmpv6_err_convert); 1161 1162 #ifdef CONFIG_SYSCTL 1163 static struct ctl_table ipv6_icmp_table_template[] = { 1164 { 1165 .procname = "ratelimit", 1166 .data = &init_net.ipv6.sysctl.icmpv6_time, 1167 .maxlen = sizeof(int), 1168 .mode = 0644, 1169 .proc_handler = proc_dointvec_ms_jiffies, 1170 }, 1171 { 1172 .procname = "echo_ignore_all", 1173 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_all, 1174 .maxlen = sizeof(u8), 1175 .mode = 0644, 1176 .proc_handler = proc_dou8vec_minmax, 1177 }, 1178 { 1179 .procname = "echo_ignore_multicast", 1180 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_multicast, 1181 .maxlen = sizeof(u8), 1182 .mode = 0644, 1183 .proc_handler = proc_dou8vec_minmax, 1184 }, 1185 { 1186 .procname = "echo_ignore_anycast", 1187 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_anycast, 1188 .maxlen = sizeof(u8), 1189 .mode = 0644, 1190 .proc_handler = proc_dou8vec_minmax, 1191 }, 1192 { 1193 .procname = "ratemask", 1194 .data = &init_net.ipv6.sysctl.icmpv6_ratemask_ptr, 1195 .maxlen = ICMPV6_MSG_MAX + 1, 1196 .mode = 0644, 1197 .proc_handler = proc_do_large_bitmap, 1198 }, 1199 { 1200 .procname = "error_anycast_as_unicast", 1201 .data = &init_net.ipv6.sysctl.icmpv6_error_anycast_as_unicast, 1202 .maxlen = sizeof(u8), 1203 .mode = 0644, 1204 .proc_handler = proc_dou8vec_minmax, 1205 .extra1 = SYSCTL_ZERO, 1206 .extra2 = SYSCTL_ONE, 1207 }, 1208 { }, 1209 }; 1210 1211 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net) 1212 { 1213 struct ctl_table *table; 1214 1215 table = kmemdup(ipv6_icmp_table_template, 1216 sizeof(ipv6_icmp_table_template), 1217 GFP_KERNEL); 1218 1219 if (table) { 1220 table[0].data = &net->ipv6.sysctl.icmpv6_time; 1221 table[1].data = &net->ipv6.sysctl.icmpv6_echo_ignore_all; 1222 table[2].data = &net->ipv6.sysctl.icmpv6_echo_ignore_multicast; 1223 table[3].data = &net->ipv6.sysctl.icmpv6_echo_ignore_anycast; 1224 table[4].data = &net->ipv6.sysctl.icmpv6_ratemask_ptr; 1225 table[5].data = &net->ipv6.sysctl.icmpv6_error_anycast_as_unicast; 1226 } 1227 return table; 1228 } 1229 #endif 1230