1 /* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> 2 * Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue> 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of version 2 of the GNU General Public 6 * License as published by the Free Software Foundation. 7 * 8 * This program is distributed in the hope that it will be useful, but 9 * WITHOUT ANY WARRANTY; without even the implied warranty of 10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 11 * General Public License for more details. 12 * 13 * You should have received a copy of the GNU General Public License 14 * along with this program; if not, see <http://www.gnu.org/licenses/>. 15 * 16 * 17 * Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki. 18 */ 19 20 #include <linux/skbuff.h> 21 #include <net/ipv6.h> 22 #include <net/mld.h> 23 #include <net/addrconf.h> 24 #include <net/ip6_checksum.h> 25 26 static int ipv6_mc_check_ip6hdr(struct sk_buff *skb) 27 { 28 const struct ipv6hdr *ip6h; 29 unsigned int len; 30 unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h); 31 32 if (!pskb_may_pull(skb, offset)) 33 return -EINVAL; 34 35 ip6h = ipv6_hdr(skb); 36 37 if (ip6h->version != 6) 38 return -EINVAL; 39 40 len = offset + ntohs(ip6h->payload_len); 41 if (skb->len < len || len <= offset) 42 return -EINVAL; 43 44 skb_set_transport_header(skb, offset); 45 46 return 0; 47 } 48 49 static int ipv6_mc_check_exthdrs(struct sk_buff *skb) 50 { 51 const struct ipv6hdr *ip6h; 52 int offset; 53 u8 nexthdr; 54 __be16 frag_off; 55 56 ip6h = ipv6_hdr(skb); 57 58 if (ip6h->nexthdr != IPPROTO_HOPOPTS) 59 return -ENOMSG; 60 61 nexthdr = ip6h->nexthdr; 62 offset = skb_network_offset(skb) + sizeof(*ip6h); 63 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 64 65 if (offset < 0) 66 return -EINVAL; 67 68 if (nexthdr != IPPROTO_ICMPV6) 69 return -ENOMSG; 70 71 skb_set_transport_header(skb, offset); 72 73 return 0; 74 } 75 76 static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb) 77 { 78 unsigned int len = skb_transport_offset(skb); 79 80 len += sizeof(struct mld2_report); 81 82 return ipv6_mc_may_pull(skb, len) ? 0 : -EINVAL; 83 } 84 85 static int ipv6_mc_check_mld_query(struct sk_buff *skb) 86 { 87 unsigned int transport_len = ipv6_transport_len(skb); 88 struct mld_msg *mld; 89 unsigned int len; 90 91 /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */ 92 if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) 93 return -EINVAL; 94 95 /* MLDv1? */ 96 if (transport_len != sizeof(struct mld_msg)) { 97 /* or MLDv2? */ 98 if (transport_len < sizeof(struct mld2_query)) 99 return -EINVAL; 100 101 len = skb_transport_offset(skb) + sizeof(struct mld2_query); 102 if (!ipv6_mc_may_pull(skb, len)) 103 return -EINVAL; 104 } 105 106 mld = (struct mld_msg *)skb_transport_header(skb); 107 108 /* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer 109 * all-nodes destination address (ff02::1) for general queries 110 */ 111 if (ipv6_addr_any(&mld->mld_mca) && 112 !ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr)) 113 return -EINVAL; 114 115 return 0; 116 } 117 118 static int ipv6_mc_check_mld_msg(struct sk_buff *skb) 119 { 120 unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg); 121 struct mld_msg *mld; 122 123 if (!ipv6_mc_may_pull(skb, len)) 124 return -EINVAL; 125 126 mld = (struct mld_msg *)skb_transport_header(skb); 127 128 switch (mld->mld_type) { 129 case ICMPV6_MGM_REDUCTION: 130 case ICMPV6_MGM_REPORT: 131 /* fall through */ 132 return 0; 133 case ICMPV6_MLD2_REPORT: 134 return ipv6_mc_check_mld_reportv2(skb); 135 case ICMPV6_MGM_QUERY: 136 return ipv6_mc_check_mld_query(skb); 137 default: 138 return -ENOMSG; 139 } 140 } 141 142 static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb) 143 { 144 return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo); 145 } 146 147 int ipv6_mc_check_icmpv6(struct sk_buff *skb) 148 { 149 unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr); 150 unsigned int transport_len = ipv6_transport_len(skb); 151 struct sk_buff *skb_chk; 152 153 if (!ipv6_mc_may_pull(skb, len)) 154 return -EINVAL; 155 156 skb_chk = skb_checksum_trimmed(skb, transport_len, 157 ipv6_mc_validate_checksum); 158 if (!skb_chk) 159 return -EINVAL; 160 161 if (skb_chk != skb) 162 kfree_skb(skb_chk); 163 164 return 0; 165 } 166 EXPORT_SYMBOL(ipv6_mc_check_icmpv6); 167 168 /** 169 * ipv6_mc_check_mld - checks whether this is a sane MLD packet 170 * @skb: the skb to validate 171 * 172 * Checks whether an IPv6 packet is a valid MLD packet. If so sets 173 * skb transport header accordingly and returns zero. 174 * 175 * -EINVAL: A broken packet was detected, i.e. it violates some internet 176 * standard 177 * -ENOMSG: IP header validation succeeded but it is not an MLD packet. 178 * -ENOMEM: A memory allocation failure happened. 179 * 180 * Caller needs to set the skb network header and free any returned skb if it 181 * differs from the provided skb. 182 */ 183 int ipv6_mc_check_mld(struct sk_buff *skb) 184 { 185 int ret; 186 187 ret = ipv6_mc_check_ip6hdr(skb); 188 if (ret < 0) 189 return ret; 190 191 ret = ipv6_mc_check_exthdrs(skb); 192 if (ret < 0) 193 return ret; 194 195 ret = ipv6_mc_check_icmpv6(skb); 196 if (ret < 0) 197 return ret; 198 199 return ipv6_mc_check_mld_msg(skb); 200 } 201 EXPORT_SYMBOL(ipv6_mc_check_mld); 202