1 /* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> 2 * Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue> 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of version 2 of the GNU General Public 6 * License as published by the Free Software Foundation. 7 * 8 * This program is distributed in the hope that it will be useful, but 9 * WITHOUT ANY WARRANTY; without even the implied warranty of 10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 11 * General Public License for more details. 12 * 13 * You should have received a copy of the GNU General Public License 14 * along with this program; if not, see <http://www.gnu.org/licenses/>. 15 * 16 * 17 * Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki. 18 */ 19 20 #include <linux/skbuff.h> 21 #include <net/ipv6.h> 22 #include <net/mld.h> 23 #include <net/addrconf.h> 24 #include <net/ip6_checksum.h> 25 26 static int ipv6_mc_check_ip6hdr(struct sk_buff *skb) 27 { 28 const struct ipv6hdr *ip6h; 29 unsigned int len; 30 unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h); 31 32 if (!pskb_may_pull(skb, offset)) 33 return -EINVAL; 34 35 ip6h = ipv6_hdr(skb); 36 37 if (ip6h->version != 6) 38 return -EINVAL; 39 40 len = offset + ntohs(ip6h->payload_len); 41 if (skb->len < len || len <= offset) 42 return -EINVAL; 43 44 skb_set_transport_header(skb, offset); 45 46 return 0; 47 } 48 49 static int ipv6_mc_check_exthdrs(struct sk_buff *skb) 50 { 51 const struct ipv6hdr *ip6h; 52 int offset; 53 u8 nexthdr; 54 __be16 frag_off; 55 56 ip6h = ipv6_hdr(skb); 57 58 if (ip6h->nexthdr != IPPROTO_HOPOPTS) 59 return -ENOMSG; 60 61 nexthdr = ip6h->nexthdr; 62 offset = skb_network_offset(skb) + sizeof(*ip6h); 63 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 64 65 if (offset < 0) 66 return -EINVAL; 67 68 if (nexthdr != IPPROTO_ICMPV6) 69 return -ENOMSG; 70 71 skb_set_transport_header(skb, offset); 72 73 return 0; 74 } 75 76 static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb) 77 { 78 unsigned int len = skb_transport_offset(skb); 79 80 len += sizeof(struct mld2_report); 81 82 return ipv6_mc_may_pull(skb, len) ? 0 : -EINVAL; 83 } 84 85 static int ipv6_mc_check_mld_query(struct sk_buff *skb) 86 { 87 unsigned int transport_len = ipv6_transport_len(skb); 88 struct mld_msg *mld; 89 unsigned int len; 90 91 /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */ 92 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) 93 return -EINVAL; 94 95 /* MLDv1? */ 96 if (transport_len != sizeof(struct mld_msg)) { 97 /* or MLDv2? */ 98 if (transport_len < sizeof(struct mld2_query)) 99 return -EINVAL; 100 101 len = skb_transport_offset(skb) + sizeof(struct mld2_query); 102 if (!ipv6_mc_may_pull(skb, len)) 103 return -EINVAL; 104 } 105 106 mld = (struct mld_msg *)skb_transport_header(skb); 107 108 /* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer 109 * all-nodes destination address (ff02::1) for general queries 110 */ 111 if (ipv6_addr_any(&mld->mld_mca) && 112 !ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr)) 113 return -EINVAL; 114 115 return 0; 116 } 117 118 static int ipv6_mc_check_mld_msg(struct sk_buff *skb) 119 { 120 unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg); 121 struct mld_msg *mld; 122 123 if (!ipv6_mc_may_pull(skb, len)) 124 return -EINVAL; 125 126 mld = (struct mld_msg *)skb_transport_header(skb); 127 128 switch (mld->mld_type) { 129 case ICMPV6_MGM_REDUCTION: 130 case ICMPV6_MGM_REPORT: 131 return 0; 132 case ICMPV6_MLD2_REPORT: 133 return ipv6_mc_check_mld_reportv2(skb); 134 case ICMPV6_MGM_QUERY: 135 return ipv6_mc_check_mld_query(skb); 136 default: 137 return -ENOMSG; 138 } 139 } 140 141 static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb) 142 { 143 return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo); 144 } 145 146 int ipv6_mc_check_icmpv6(struct sk_buff *skb) 147 { 148 unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr); 149 unsigned int transport_len = ipv6_transport_len(skb); 150 struct sk_buff *skb_chk; 151 152 if (!ipv6_mc_may_pull(skb, len)) 153 return -EINVAL; 154 155 skb_chk = skb_checksum_trimmed(skb, transport_len, 156 ipv6_mc_validate_checksum); 157 if (!skb_chk) 158 return -EINVAL; 159 160 if (skb_chk != skb) 161 kfree_skb(skb_chk); 162 163 return 0; 164 } 165 EXPORT_SYMBOL(ipv6_mc_check_icmpv6); 166 167 /** 168 * ipv6_mc_check_mld - checks whether this is a sane MLD packet 169 * @skb: the skb to validate 170 * 171 * Checks whether an IPv6 packet is a valid MLD packet. If so sets 172 * skb transport header accordingly and returns zero. 173 * 174 * -EINVAL: A broken packet was detected, i.e. it violates some internet 175 * standard 176 * -ENOMSG: IP header validation succeeded but it is not an MLD packet. 177 * -ENOMEM: A memory allocation failure happened. 178 * 179 * Caller needs to set the skb network header and free any returned skb if it 180 * differs from the provided skb. 181 */ 182 int ipv6_mc_check_mld(struct sk_buff *skb) 183 { 184 int ret; 185 186 ret = ipv6_mc_check_ip6hdr(skb); 187 if (ret < 0) 188 return ret; 189 190 ret = ipv6_mc_check_exthdrs(skb); 191 if (ret < 0) 192 return ret; 193 194 ret = ipv6_mc_check_icmpv6(skb); 195 if (ret < 0) 196 return ret; 197 198 return ipv6_mc_check_mld_msg(skb); 199 } 200 EXPORT_SYMBOL(ipv6_mc_check_mld); 201