net/ipv6/icmp.c

   1 /*
   2  *      Internet Control Message Protocol (ICMPv6)
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on net/ipv4/icmp.c
   9  *
  10  *      RFC 1885
  11  *
  12  *      This program is free software; you can redistribute it and/or
  13  *      modify it under the terms of the GNU General Public License
  14  *      as published by the Free Software Foundation; either version
  15  *      2 of the License, or (at your option) any later version.
  16  */
  17
  18 /*
  19  *      Changes:
  20  *
  21  *      Andi Kleen              :       exception handling
  22  *      Andi Kleen                      add rate limits. never reply to a icmp.
  23  *                                      add more length checks and other fixes.
  24  *      yoshfuji                :       ensure to sent parameter problem for
  25  *                                      fragments.
  26  *      YOSHIFUJI Hideaki @USAGI:       added sysctl for icmp rate limit.
  27  *      Randy Dunlap and
  28  *      YOSHIFUJI Hideaki @USAGI:       Per-interface statistics support
  29  *      Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  30  */
  31
  32 #define pr_fmt(fmt) "IPv6: " fmt
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/types.h>
  37 #include <linux/socket.h>
  38 #include <linux/in.h>
  39 #include <linux/kernel.h>
  40 #include <linux/sockios.h>
  41 #include <linux/net.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/init.h>
  44 #include <linux/netfilter.h>
  45 #include <linux/slab.h>
  46
  47 #ifdef CONFIG_SYSCTL
  48 #include <linux/sysctl.h>
  49 #endif
  50
  51 #include <linux/inet.h>
  52 #include <linux/netdevice.h>
  53 #include <linux/icmpv6.h>
  54
  55 #include <net/ip.h>
  56 #include <net/sock.h>
  57
  58 #include <net/ipv6.h>
  59 #include <net/ip6_checksum.h>
  60 #include <net/ping.h>
  61 #include <net/protocol.h>
  62 #include <net/raw.h>
  63 #include <net/rawv6.h>
  64 #include <net/transp_v6.h>
  65 #include <net/ip6_route.h>
  66 #include <net/addrconf.h>
  67 #include <net/icmp.h>
  68 #include <net/xfrm.h>
  69 #include <net/inet_common.h>
  70 #include <net/dsfield.h>
  71 #include <net/l3mdev.h>
  72
  73 #include <asm/uaccess.h>
  74
  75 /*
  76  *      The ICMP socket(s). This is the most convenient way to flow control
  77  *      our ICMP output as well as maintain a clean interface throughout
  78  *      all layers. All Socketless IP sends will soon be gone.
  79  *
  80  *      On SMP we have one ICMP socket per-cpu.
  81  */
  82 static inline struct sock *icmpv6_sk(struct net *net)
  83 {
  84         return net->ipv6.icmp_sk[smp_processor_id()];
  85 }
  86
  87 static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  88                        u8 type, u8 code, int offset, __be32 info)
  89 {
  90         /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  91         struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  92         struct net *net = dev_net(skb->dev);
  93
  94         if (type == ICMPV6_PKT_TOOBIG)
  95                 ip6_update_pmtu(skb, net, info, 0, 0);
  96         else if (type == NDISC_REDIRECT)
  97                 ip6_redirect(skb, net, skb->dev->ifindex, 0);
  98
  99         if (!(type & ICMPV6_INFOMSG_MASK))
 100                 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
 101                         ping_err(skb, offset, ntohl(info));
 102 }
 103
 104 static int icmpv6_rcv(struct sk_buff *skb);
 105
 106 static const struct inet6_protocol icmpv6_protocol = {
 107         .handler        =       icmpv6_rcv,
 108         .err_handler    =       icmpv6_err,
 109         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 110 };
 111
 112 static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
 113 {
 114         struct sock *sk;
 115
 116         local_bh_disable();
 117
 118         sk = icmpv6_sk(net);
 119         if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 120                 /* This can happen if the output path (f.e. SIT or
 121                  * ip6ip6 tunnel) signals dst_link_failure() for an
 122                  * outgoing ICMP6 packet.
 123                  */
 124                 local_bh_enable();
 125                 return NULL;
 126         }
 127         return sk;
 128 }
 129
 130 static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 131 {
 132         spin_unlock_bh(&sk->sk_lock.slock);
 133 }
 134
 135 /*
 136  * Figure out, may we reply to this packet with icmp error.
 137  *
 138  * We do not reply, if:
 139  *      - it was icmp error message.
 140  *      - it is truncated, so that it is known, that protocol is ICMPV6
 141  *        (i.e. in the middle of some exthdr)
 142  *
 143  *      --ANK (980726)
 144  */
 145
 146 static bool is_ineligible(const struct sk_buff *skb)
 147 {
 148         int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 149         int len = skb->len - ptr;
 150         __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 151         __be16 frag_off;
 152
 153         if (len < 0)
 154                 return true;
 155
 156         ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 157         if (ptr < 0)
 158                 return false;
 159         if (nexthdr == IPPROTO_ICMPV6) {
 160                 u8 _type, *tp;
 161                 tp = skb_header_pointer(skb,
 162                         ptr+offsetof(struct icmp6hdr, icmp6_type),
 163                         sizeof(_type), &_type);
 164                 if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
 165                         return true;
 166         }
 167         return false;
 168 }
 169
 170 /*
 171  * Check the ICMP output rate limit
 172  */
 173 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 174                                struct flowi6 *fl6)
 175 {
 176         struct net *net = sock_net(sk);
 177         struct dst_entry *dst;
 178         bool res = false;
 179
 180         /* Informational messages are not limited. */
 181         if (type & ICMPV6_INFOMSG_MASK)
 182                 return true;
 183
 184         /* Do not limit pmtu discovery, it would break it. */
 185         if (type == ICMPV6_PKT_TOOBIG)
 186                 return true;
 187
 188         /*
 189          * Look up the output route.
 190          * XXX: perhaps the expire for routing entries cloned by
 191          * this lookup should be more aggressive (not longer than timeout).
 192          */
 193         dst = ip6_route_output(net, sk, fl6);
 194         if (dst->error) {
 195                 IP6_INC_STATS(net, ip6_dst_idev(dst),
 196                               IPSTATS_MIB_OUTNOROUTES);
 197         } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 198                 res = true;
 199         } else {
 200                 struct rt6_info *rt = (struct rt6_info *)dst;
 201                 int tmo = net->ipv6.sysctl.icmpv6_time;
 202
 203                 /* Give more bandwidth to wider prefixes. */
 204                 if (rt->rt6i_dst.plen < 128)
 205                         tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 206
 207                 if (icmp_global_allow()) {
 208                         struct inet_peer *peer;
 209
 210                         peer = inet_getpeer_v6(net->ipv6.peers,
 211                                                &fl6->daddr, 1);
 212                         res = inet_peer_xrlim_allow(peer, tmo);
 213                         if (peer)
 214                                 inet_putpeer(peer);
 215                 }
 216         }
 217         dst_release(dst);
 218         return res;
 219 }
 220
 221 /*
 222  *      an inline helper for the "simple" if statement below
 223  *      checks if parameter problem report is caused by an
 224  *      unrecognized IPv6 option that has the Option Type
 225  *      highest-order two bits set to 10
 226  */
 227
 228 static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 229 {
 230         u8 _optval, *op;
 231
 232         offset += skb_network_offset(skb);
 233         op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 234         if (!op)
 235                 return true;
 236         return (*op & 0xC0) == 0x80;
 237 }
 238
 239 int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 240                                struct icmp6hdr *thdr, int len)
 241 {
 242         struct sk_buff *skb;
 243         struct icmp6hdr *icmp6h;
 244         int err = 0;
 245
 246         skb = skb_peek(&sk->sk_write_queue);
 247         if (!skb)
 248                 goto out;
 249
 250         icmp6h = icmp6_hdr(skb);
 251         memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 252         icmp6h->icmp6_cksum = 0;
 253
 254         if (skb_queue_len(&sk->sk_write_queue) == 1) {
 255                 skb->csum = csum_partial(icmp6h,
 256                                         sizeof(struct icmp6hdr), skb->csum);
 257                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 258                                                       &fl6->daddr,
 259                                                       len, fl6->flowi6_proto,
 260                                                       skb->csum);
 261         } else {
 262                 __wsum tmp_csum = 0;
 263
 264                 skb_queue_walk(&sk->sk_write_queue, skb) {
 265                         tmp_csum = csum_add(tmp_csum, skb->csum);
 266                 }
 267
 268                 tmp_csum = csum_partial(icmp6h,
 269                                         sizeof(struct icmp6hdr), tmp_csum);
 270                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 271                                                       &fl6->daddr,
 272                                                       len, fl6->flowi6_proto,
 273                                                       tmp_csum);
 274         }
 275         ip6_push_pending_frames(sk);
 276 out:
 277         return err;
 278 }
 279
 280 struct icmpv6_msg {
 281         struct sk_buff  *skb;
 282         int             offset;
 283         uint8_t         type;
 284 };
 285
 286 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 287 {
 288         struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 289         struct sk_buff *org_skb = msg->skb;
 290         __wsum csum = 0;
 291
 292         csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 293                                       to, len, csum);
 294         skb->csum = csum_block_add(skb->csum, csum, odd);
 295         if (!(msg->type & ICMPV6_INFOMSG_MASK))
 296                 nf_ct_attach(skb, org_skb);
 297         return 0;
 298 }
 299
 300 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 301 static void mip6_addr_swap(struct sk_buff *skb)
 302 {
 303         struct ipv6hdr *iph = ipv6_hdr(skb);
 304         struct inet6_skb_parm *opt = IP6CB(skb);
 305         struct ipv6_destopt_hao *hao;
 306         struct in6_addr tmp;
 307         int off;
 308
 309         if (opt->dsthao) {
 310                 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 311                 if (likely(off >= 0)) {
 312                         hao = (struct ipv6_destopt_hao *)
 313                                         (skb_network_header(skb) + off);
 314                         tmp = iph->saddr;
 315                         iph->saddr = hao->addr;
 316                         hao->addr = tmp;
 317                 }
 318         }
 319 }
 320 #else
 321 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 322 #endif
 323
 324 static struct dst_entry *icmpv6_route_lookup(struct net *net,
 325                                              struct sk_buff *skb,
 326                                              struct sock *sk,
 327                                              struct flowi6 *fl6)
 328 {
 329         struct dst_entry *dst, *dst2;
 330         struct flowi6 fl2;
 331         int err;
 332
 333         err = ip6_dst_lookup(net, sk, &dst, fl6);
 334         if (err)
 335                 return ERR_PTR(err);
 336
 337         /*
 338          * We won't send icmp if the destination is known
 339          * anycast.
 340          */
 341         if (ipv6_anycast_destination(dst, &fl6->daddr)) {
 342                 net_dbg_ratelimited("icmp6_send: acast source\n");
 343                 dst_release(dst);
 344                 return ERR_PTR(-EINVAL);
 345         }
 346
 347         /* No need to clone since we're just using its address. */
 348         dst2 = dst;
 349
 350         dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 351         if (!IS_ERR(dst)) {
 352                 if (dst != dst2)
 353                         return dst;
 354         } else {
 355                 if (PTR_ERR(dst) == -EPERM)
 356                         dst = NULL;
 357                 else
 358                         return dst;
 359         }
 360
 361         err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
 362         if (err)
 363                 goto relookup_failed;
 364
 365         err = ip6_dst_lookup(net, sk, &dst2, &fl2);
 366         if (err)
 367                 goto relookup_failed;
 368
 369         dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 370         if (!IS_ERR(dst2)) {
 371                 dst_release(dst);
 372                 dst = dst2;
 373         } else {
 374                 err = PTR_ERR(dst2);
 375                 if (err == -EPERM) {
 376                         dst_release(dst);
 377                         return dst2;
 378                 } else
 379                         goto relookup_failed;
 380         }
 381
 382 relookup_failed:
 383         if (dst)
 384                 return dst;
 385         return ERR_PTR(err);
 386 }
 387
 388 /*
 389  *      Send an ICMP message in response to a packet in error
 390  */
 391 static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 392 {
 393         struct net *net = dev_net(skb->dev);
 394         struct inet6_dev *idev = NULL;
 395         struct ipv6hdr *hdr = ipv6_hdr(skb);
 396         struct sock *sk;
 397         struct ipv6_pinfo *np;
 398         const struct in6_addr *saddr = NULL;
 399         struct dst_entry *dst;
 400         struct icmp6hdr tmp_hdr;
 401         struct flowi6 fl6;
 402         struct icmpv6_msg msg;
 403         int iif = 0;
 404         int addr_type = 0;
 405         int len;
 406         int hlimit;
 407         int err = 0;
 408         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 409
 410         if ((u8 *)hdr < skb->head ||
 411             (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 412                 return;
 413
 414         /*
 415          *      Make sure we respect the rules
 416          *      i.e. RFC 1885 2.4(e)
 417          *      Rule (e.1) is enforced by not using icmp6_send
 418          *      in any code that processes icmp errors.
 419          */
 420         addr_type = ipv6_addr_type(&hdr->daddr);
 421
 422         if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 423             ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 424                 saddr = &hdr->daddr;
 425
 426         /*
 427          *      Dest addr check
 428          */
 429
 430         if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
 431                 if (type != ICMPV6_PKT_TOOBIG &&
 432                     !(type == ICMPV6_PARAMPROB &&
 433                       code == ICMPV6_UNK_OPTION &&
 434                       (opt_unrec(skb, info))))
 435                         return;
 436
 437                 saddr = NULL;
 438         }
 439
 440         addr_type = ipv6_addr_type(&hdr->saddr);
 441
 442         /*
 443          *      Source addr check
 444          */
 445
 446         if (__ipv6_addr_needs_scope_id(addr_type))
 447                 iif = skb->dev->ifindex;
 448         else {
 449                 dst = skb_dst(skb);
 450                 iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev);
 451         }
 452
 453         /*
 454          *      Must not send error if the source does not uniquely
 455          *      identify a single node (RFC2463 Section 2.4).
 456          *      We check unspecified / multicast addresses here,
 457          *      and anycast addresses will be checked later.
 458          */
 459         if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 460                 net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
 461                                     &hdr->saddr, &hdr->daddr);
 462                 return;
 463         }
 464
 465         /*
 466          *      Never answer to a ICMP packet.
 467          */
 468         if (is_ineligible(skb)) {
 469                 net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
 470                                     &hdr->saddr, &hdr->daddr);
 471                 return;
 472         }
 473
 474         mip6_addr_swap(skb);
 475
 476         memset(&fl6, 0, sizeof(fl6));
 477         fl6.flowi6_proto = IPPROTO_ICMPV6;
 478         fl6.daddr = hdr->saddr;
 479         if (saddr)
 480                 fl6.saddr = *saddr;
 481         fl6.flowi6_mark = mark;
 482         fl6.flowi6_oif = iif;
 483         fl6.fl6_icmp_type = type;
 484         fl6.fl6_icmp_code = code;
 485         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 486
 487         sk = icmpv6_xmit_lock(net);
 488         if (!sk)
 489                 return;
 490         sk->sk_mark = mark;
 491         np = inet6_sk(sk);
 492
 493         if (!icmpv6_xrlim_allow(sk, type, &fl6))
 494                 goto out;
 495
 496         tmp_hdr.icmp6_type = type;
 497         tmp_hdr.icmp6_code = code;
 498         tmp_hdr.icmp6_cksum = 0;
 499         tmp_hdr.icmp6_pointer = htonl(info);
 500
 501         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 502                 fl6.flowi6_oif = np->mcast_oif;
 503         else if (!fl6.flowi6_oif)
 504                 fl6.flowi6_oif = np->ucast_oif;
 505
 506         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 507         if (IS_ERR(dst))
 508                 goto out;
 509
 510         hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 511
 512         msg.skb = skb;
 513         msg.offset = skb_network_offset(skb);
 514         msg.type = type;
 515
 516         len = skb->len - msg.offset;
 517         len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr));
 518         if (len < 0) {
 519                 net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
 520                                     &hdr->saddr, &hdr->daddr);
 521                 goto out_dst_release;
 522         }
 523
 524         rcu_read_lock();
 525         idev = __in6_dev_get(skb->dev);
 526
 527         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
 528                               len + sizeof(struct icmp6hdr),
 529                               sizeof(struct icmp6hdr), hlimit,
 530                               np->tclass, NULL, &fl6, (struct rt6_info *)dst,
 531                               MSG_DONTWAIT, np->dontfrag);
 532         if (err) {
 533                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 534                 ip6_flush_pending_frames(sk);
 535         } else {
 536                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 537                                                  len + sizeof(struct icmp6hdr));
 538         }
 539         rcu_read_unlock();
 540 out_dst_release:
 541         dst_release(dst);
 542 out:
 543         icmpv6_xmit_unlock(sk);
 544 }
 545
 546 /* Slightly more convenient version of icmp6_send.
 547  */
 548 void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 549 {
 550         icmp6_send(skb, ICMPV6_PARAMPROB, code, pos);
 551         kfree_skb(skb);
 552 }
 553
 554 static void icmpv6_echo_reply(struct sk_buff *skb)
 555 {
 556         struct net *net = dev_net(skb->dev);
 557         struct sock *sk;
 558         struct inet6_dev *idev;
 559         struct ipv6_pinfo *np;
 560         const struct in6_addr *saddr = NULL;
 561         struct icmp6hdr *icmph = icmp6_hdr(skb);
 562         struct icmp6hdr tmp_hdr;
 563         struct flowi6 fl6;
 564         struct icmpv6_msg msg;
 565         struct dst_entry *dst;
 566         int err = 0;
 567         int hlimit;
 568         u8 tclass;
 569         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 570
 571         saddr = &ipv6_hdr(skb)->daddr;
 572
 573         if (!ipv6_unicast_destination(skb) &&
 574             !(net->ipv6.sysctl.anycast_src_echo_reply &&
 575               ipv6_anycast_destination(skb_dst(skb), saddr)))
 576                 saddr = NULL;
 577
 578         memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 579         tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
 580
 581         memset(&fl6, 0, sizeof(fl6));
 582         fl6.flowi6_proto = IPPROTO_ICMPV6;
 583         fl6.daddr = ipv6_hdr(skb)->saddr;
 584         if (saddr)
 585                 fl6.saddr = *saddr;
 586         fl6.flowi6_oif = l3mdev_fib_oif(skb->dev);
 587         fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
 588         fl6.flowi6_mark = mark;
 589         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 590
 591         sk = icmpv6_xmit_lock(net);
 592         if (!sk)
 593                 return;
 594         sk->sk_mark = mark;
 595         np = inet6_sk(sk);
 596
 597         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 598                 fl6.flowi6_oif = np->mcast_oif;
 599         else if (!fl6.flowi6_oif)
 600                 fl6.flowi6_oif = np->ucast_oif;
 601
 602         err = ip6_dst_lookup(net, sk, &dst, &fl6);
 603         if (err)
 604                 goto out;
 605         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 606         if (IS_ERR(dst))
 607                 goto out;
 608
 609         hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 610
 611         idev = __in6_dev_get(skb->dev);
 612
 613         msg.skb = skb;
 614         msg.offset = 0;
 615         msg.type = ICMPV6_ECHO_REPLY;
 616
 617         tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 618         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
 619                                 sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl6,
 620                                 (struct rt6_info *)dst, MSG_DONTWAIT,
 621                                 np->dontfrag);
 622
 623         if (err) {
 624                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
 625                 ip6_flush_pending_frames(sk);
 626         } else {
 627                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 628                                                  skb->len + sizeof(struct icmp6hdr));
 629         }
 630         dst_release(dst);
 631 out:
 632         icmpv6_xmit_unlock(sk);
 633 }
 634
 635 void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 636 {
 637         const struct inet6_protocol *ipprot;
 638         int inner_offset;
 639         __be16 frag_off;
 640         u8 nexthdr;
 641         struct net *net = dev_net(skb->dev);
 642
 643         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 644                 goto out;
 645
 646         nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
 647         if (ipv6_ext_hdr(nexthdr)) {
 648                 /* now skip over extension headers */
 649                 inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 650                                                 &nexthdr, &frag_off);
 651                 if (inner_offset < 0)
 652                         goto out;
 653         } else {
 654                 inner_offset = sizeof(struct ipv6hdr);
 655         }
 656
 657         /* Checkin header including 8 bytes of inner protocol header. */
 658         if (!pskb_may_pull(skb, inner_offset+8))
 659                 goto out;
 660
 661         /* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
 662            Without this we will not able f.e. to make source routed
 663            pmtu discovery.
 664            Corresponding argument (opt) to notifiers is already added.
 665            --ANK (980726)
 666          */
 667
 668         ipprot = rcu_dereference(inet6_protos[nexthdr]);
 669         if (ipprot && ipprot->err_handler)
 670                 ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
 671
 672         raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
 673         return;
 674
 675 out:
 676         ICMP6_INC_STATS_BH(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 677 }
 678
 679 /*
 680  *      Handle icmp messages
 681  */
 682
 683 static int icmpv6_rcv(struct sk_buff *skb)
 684 {
 685         struct net_device *dev = skb->dev;
 686         struct inet6_dev *idev = __in6_dev_get(dev);
 687         const struct in6_addr *saddr, *daddr;
 688         struct icmp6hdr *hdr;
 689         u8 type;
 690         bool success = false;
 691
 692         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 693                 struct sec_path *sp = skb_sec_path(skb);
 694                 int nh;
 695
 696                 if (!(sp && sp->xvec[sp->len - 1]->props.flags &
 697                                  XFRM_STATE_ICMP))
 698                         goto drop_no_count;
 699
 700                 if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
 701                         goto drop_no_count;
 702
 703                 nh = skb_network_offset(skb);
 704                 skb_set_network_header(skb, sizeof(*hdr));
 705
 706                 if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
 707                         goto drop_no_count;
 708
 709                 skb_set_network_header(skb, nh);
 710         }
 711
 712         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INMSGS);
 713
 714         saddr = &ipv6_hdr(skb)->saddr;
 715         daddr = &ipv6_hdr(skb)->daddr;
 716
 717         if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
 718                 net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
 719                                     saddr, daddr);
 720                 goto csum_error;
 721         }
 722
 723         if (!pskb_pull(skb, sizeof(*hdr)))
 724                 goto discard_it;
 725
 726         hdr = icmp6_hdr(skb);
 727
 728         type = hdr->icmp6_type;
 729
 730         ICMP6MSGIN_INC_STATS_BH(dev_net(dev), idev, type);
 731
 732         switch (type) {
 733         case ICMPV6_ECHO_REQUEST:
 734                 icmpv6_echo_reply(skb);
 735                 break;
 736
 737         case ICMPV6_ECHO_REPLY:
 738                 success = ping_rcv(skb);
 739                 break;
 740
 741         case ICMPV6_PKT_TOOBIG:
 742                 /* BUGGG_FUTURE: if packet contains rthdr, we cannot update
 743                    standard destination cache. Seems, only "advanced"
 744                    destination cache will allow to solve this problem
 745                    --ANK (980726)
 746                  */
 747                 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 748                         goto discard_it;
 749                 hdr = icmp6_hdr(skb);
 750
 751                 /*
 752                  *      Drop through to notify
 753                  */
 754
 755         case ICMPV6_DEST_UNREACH:
 756         case ICMPV6_TIME_EXCEED:
 757         case ICMPV6_PARAMPROB:
 758                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 759                 break;
 760
 761         case NDISC_ROUTER_SOLICITATION:
 762         case NDISC_ROUTER_ADVERTISEMENT:
 763         case NDISC_NEIGHBOUR_SOLICITATION:
 764         case NDISC_NEIGHBOUR_ADVERTISEMENT:
 765         case NDISC_REDIRECT:
 766                 ndisc_rcv(skb);
 767                 break;
 768
 769         case ICMPV6_MGM_QUERY:
 770                 igmp6_event_query(skb);
 771                 break;
 772
 773         case ICMPV6_MGM_REPORT:
 774                 igmp6_event_report(skb);
 775                 break;
 776
 777         case ICMPV6_MGM_REDUCTION:
 778         case ICMPV6_NI_QUERY:
 779         case ICMPV6_NI_REPLY:
 780         case ICMPV6_MLD2_REPORT:
 781         case ICMPV6_DHAAD_REQUEST:
 782         case ICMPV6_DHAAD_REPLY:
 783         case ICMPV6_MOBILE_PREFIX_SOL:
 784         case ICMPV6_MOBILE_PREFIX_ADV:
 785                 break;
 786
 787         default:
 788                 /* informational */
 789                 if (type & ICMPV6_INFOMSG_MASK)
 790                         break;
 791
 792                 net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
 793                                     saddr, daddr);
 794
 795                 /*
 796                  * error of unknown type.
 797                  * must pass to upper level
 798                  */
 799
 800                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 801         }
 802
 803         /* until the v6 path can be better sorted assume failure and
 804          * preserve the status quo behaviour for the rest of the paths to here
 805          */
 806         if (success)
 807                 consume_skb(skb);
 808         else
 809                 kfree_skb(skb);
 810
 811         return 0;
 812
 813 csum_error:
 814         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
 815 discard_it:
 816         ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INERRORS);
 817 drop_no_count:
 818         kfree_skb(skb);
 819         return 0;
 820 }
 821
 822 void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
 823                       u8 type,
 824                       const struct in6_addr *saddr,
 825                       const struct in6_addr *daddr,
 826                       int oif)
 827 {
 828         memset(fl6, 0, sizeof(*fl6));
 829         fl6->saddr = *saddr;
 830         fl6->daddr = *daddr;
 831         fl6->flowi6_proto       = IPPROTO_ICMPV6;
 832         fl6->fl6_icmp_type      = type;
 833         fl6->fl6_icmp_code      = 0;
 834         fl6->flowi6_oif         = oif;
 835         security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
 836 }
 837
 838 static int __net_init icmpv6_sk_init(struct net *net)
 839 {
 840         struct sock *sk;
 841         int err, i, j;
 842
 843         net->ipv6.icmp_sk =
 844                 kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
 845         if (!net->ipv6.icmp_sk)
 846                 return -ENOMEM;
 847
 848         for_each_possible_cpu(i) {
 849                 err = inet_ctl_sock_create(&sk, PF_INET6,
 850                                            SOCK_RAW, IPPROTO_ICMPV6, net);
 851                 if (err < 0) {
 852                         pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
 853                                err);
 854                         goto fail;
 855                 }
 856
 857                 net->ipv6.icmp_sk[i] = sk;
 858
 859                 /* Enough space for 2 64K ICMP packets, including
 860                  * sk_buff struct overhead.
 861                  */
 862                 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
 863         }
 864         return 0;
 865
 866  fail:
 867         for (j = 0; j < i; j++)
 868                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
 869         kfree(net->ipv6.icmp_sk);
 870         return err;
 871 }
 872
 873 static void __net_exit icmpv6_sk_exit(struct net *net)
 874 {
 875         int i;
 876
 877         for_each_possible_cpu(i) {
 878                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
 879         }
 880         kfree(net->ipv6.icmp_sk);
 881 }
 882
 883 static struct pernet_operations icmpv6_sk_ops = {
 884         .init = icmpv6_sk_init,
 885         .exit = icmpv6_sk_exit,
 886 };
 887
 888 int __init icmpv6_init(void)
 889 {
 890         int err;
 891
 892         err = register_pernet_subsys(&icmpv6_sk_ops);
 893         if (err < 0)
 894                 return err;
 895
 896         err = -EAGAIN;
 897         if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
 898                 goto fail;
 899
 900         err = inet6_register_icmp_sender(icmp6_send);
 901         if (err)
 902                 goto sender_reg_err;
 903         return 0;
 904
 905 sender_reg_err:
 906         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 907 fail:
 908         pr_err("Failed to register ICMP6 protocol\n");
 909         unregister_pernet_subsys(&icmpv6_sk_ops);
 910         return err;
 911 }
 912
 913 void icmpv6_cleanup(void)
 914 {
 915         inet6_unregister_icmp_sender(icmp6_send);
 916         unregister_pernet_subsys(&icmpv6_sk_ops);
 917         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 918 }
 919
 920
 921 static const struct icmp6_err {
 922         int err;
 923         int fatal;
 924 } tab_unreach[] = {
 925         {       /* NOROUTE */
 926                 .err    = ENETUNREACH,
 927                 .fatal  = 0,
 928         },
 929         {       /* ADM_PROHIBITED */
 930                 .err    = EACCES,
 931                 .fatal  = 1,
 932         },
 933         {       /* Was NOT_NEIGHBOUR, now reserved */
 934                 .err    = EHOSTUNREACH,
 935                 .fatal  = 0,
 936         },
 937         {       /* ADDR_UNREACH */
 938                 .err    = EHOSTUNREACH,
 939                 .fatal  = 0,
 940         },
 941         {       /* PORT_UNREACH */
 942                 .err    = ECONNREFUSED,
 943                 .fatal  = 1,
 944         },
 945         {       /* POLICY_FAIL */
 946                 .err    = EACCES,
 947                 .fatal  = 1,
 948         },
 949         {       /* REJECT_ROUTE */
 950                 .err    = EACCES,
 951                 .fatal  = 1,
 952         },
 953 };
 954
 955 int icmpv6_err_convert(u8 type, u8 code, int *err)
 956 {
 957         int fatal = 0;
 958
 959         *err = EPROTO;
 960
 961         switch (type) {
 962         case ICMPV6_DEST_UNREACH:
 963                 fatal = 1;
 964                 if (code < ARRAY_SIZE(tab_unreach)) {
 965                         *err  = tab_unreach[code].err;
 966                         fatal = tab_unreach[code].fatal;
 967                 }
 968                 break;
 969
 970         case ICMPV6_PKT_TOOBIG:
 971                 *err = EMSGSIZE;
 972                 break;
 973
 974         case ICMPV6_PARAMPROB:
 975                 *err = EPROTO;
 976                 fatal = 1;
 977                 break;
 978
 979         case ICMPV6_TIME_EXCEED:
 980                 *err = EHOSTUNREACH;
 981                 break;
 982         }
 983
 984         return fatal;
 985 }
 986 EXPORT_SYMBOL(icmpv6_err_convert);
 987
 988 #ifdef CONFIG_SYSCTL
 989 static struct ctl_table ipv6_icmp_table_template[] = {
 990         {
 991                 .procname       = "ratelimit",
 992                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
 993                 .maxlen         = sizeof(int),
 994                 .mode           = 0644,
 995                 .proc_handler   = proc_dointvec_ms_jiffies,
 996         },
 997         { },
 998 };
 999
1000 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1001 {
1002         struct ctl_table *table;
1003
1004         table = kmemdup(ipv6_icmp_table_template,
1005                         sizeof(ipv6_icmp_table_template),
1006                         GFP_KERNEL);
1007
1008         if (table)
1009                 table[0].data = &net->ipv6.sysctl.icmpv6_time;
1010
1011         return table;
1012 }
1013 #endif