PageRenderTime 110ms CodeModel.GetById 17ms app.highlight 84ms RepoModel.GetById 1ms app.codeStats 0ms

/net/ipv6/icmp.c

http://github.com/mirrors/linux
C | 1207 lines | 873 code | 189 blank | 145 comment | 145 complexity | 38c5bea30d0dc71a0ec24803332f1210 MD5 | raw file
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	Internet Control Message Protocol (ICMPv6)
   4 *	Linux INET6 implementation
   5 *
   6 *	Authors:
   7 *	Pedro Roque		<roque@di.fc.ul.pt>
   8 *
   9 *	Based on net/ipv4/icmp.c
  10 *
  11 *	RFC 1885
  12 */
  13
  14/*
  15 *	Changes:
  16 *
  17 *	Andi Kleen		:	exception handling
  18 *	Andi Kleen			add rate limits. never reply to a icmp.
  19 *					add more length checks and other fixes.
  20 *	yoshfuji		:	ensure to sent parameter problem for
  21 *					fragments.
  22 *	YOSHIFUJI Hideaki @USAGI:	added sysctl for icmp rate limit.
  23 *	Randy Dunlap and
  24 *	YOSHIFUJI Hideaki @USAGI:	Per-interface statistics support
  25 *	Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  26 */
  27
  28#define pr_fmt(fmt) "IPv6: " fmt
  29
  30#include <linux/module.h>
  31#include <linux/errno.h>
  32#include <linux/types.h>
  33#include <linux/socket.h>
  34#include <linux/in.h>
  35#include <linux/kernel.h>
  36#include <linux/sockios.h>
  37#include <linux/net.h>
  38#include <linux/skbuff.h>
  39#include <linux/init.h>
  40#include <linux/netfilter.h>
  41#include <linux/slab.h>
  42
  43#ifdef CONFIG_SYSCTL
  44#include <linux/sysctl.h>
  45#endif
  46
  47#include <linux/inet.h>
  48#include <linux/netdevice.h>
  49#include <linux/icmpv6.h>
  50
  51#include <net/ip.h>
  52#include <net/sock.h>
  53
  54#include <net/ipv6.h>
  55#include <net/ip6_checksum.h>
  56#include <net/ping.h>
  57#include <net/protocol.h>
  58#include <net/raw.h>
  59#include <net/rawv6.h>
  60#include <net/transp_v6.h>
  61#include <net/ip6_route.h>
  62#include <net/addrconf.h>
  63#include <net/icmp.h>
  64#include <net/xfrm.h>
  65#include <net/inet_common.h>
  66#include <net/dsfield.h>
  67#include <net/l3mdev.h>
  68
  69#include <linux/uaccess.h>
  70
  71/*
  72 *	The ICMP socket(s). This is the most convenient way to flow control
  73 *	our ICMP output as well as maintain a clean interface throughout
  74 *	all layers. All Socketless IP sends will soon be gone.
  75 *
  76 *	On SMP we have one ICMP socket per-cpu.
  77 */
  78static struct sock *icmpv6_sk(struct net *net)
  79{
  80	return this_cpu_read(*net->ipv6.icmp_sk);
  81}
  82
  83static int icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  84		       u8 type, u8 code, int offset, __be32 info)
  85{
  86	/* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  87	struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  88	struct net *net = dev_net(skb->dev);
  89
  90	if (type == ICMPV6_PKT_TOOBIG)
  91		ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL));
  92	else if (type == NDISC_REDIRECT)
  93		ip6_redirect(skb, net, skb->dev->ifindex, 0,
  94			     sock_net_uid(net, NULL));
  95
  96	if (!(type & ICMPV6_INFOMSG_MASK))
  97		if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
  98			ping_err(skb, offset, ntohl(info));
  99
 100	return 0;
 101}
 102
 103static int icmpv6_rcv(struct sk_buff *skb);
 104
 105static const struct inet6_protocol icmpv6_protocol = {
 106	.handler	=	icmpv6_rcv,
 107	.err_handler	=	icmpv6_err,
 108	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 109};
 110
 111/* Called with BH disabled */
 112static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
 113{
 114	struct sock *sk;
 115
 116	sk = icmpv6_sk(net);
 117	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 118		/* This can happen if the output path (f.e. SIT or
 119		 * ip6ip6 tunnel) signals dst_link_failure() for an
 120		 * outgoing ICMP6 packet.
 121		 */
 122		return NULL;
 123	}
 124	return sk;
 125}
 126
 127static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 128{
 129	spin_unlock(&sk->sk_lock.slock);
 130}
 131
 132/*
 133 * Figure out, may we reply to this packet with icmp error.
 134 *
 135 * We do not reply, if:
 136 *	- it was icmp error message.
 137 *	- it is truncated, so that it is known, that protocol is ICMPV6
 138 *	  (i.e. in the middle of some exthdr)
 139 *
 140 *	--ANK (980726)
 141 */
 142
 143static bool is_ineligible(const struct sk_buff *skb)
 144{
 145	int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 146	int len = skb->len - ptr;
 147	__u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 148	__be16 frag_off;
 149
 150	if (len < 0)
 151		return true;
 152
 153	ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 154	if (ptr < 0)
 155		return false;
 156	if (nexthdr == IPPROTO_ICMPV6) {
 157		u8 _type, *tp;
 158		tp = skb_header_pointer(skb,
 159			ptr+offsetof(struct icmp6hdr, icmp6_type),
 160			sizeof(_type), &_type);
 161		if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
 162			return true;
 163	}
 164	return false;
 165}
 166
 167static bool icmpv6_mask_allow(struct net *net, int type)
 168{
 169	if (type > ICMPV6_MSG_MAX)
 170		return true;
 171
 172	/* Limit if icmp type is set in ratemask. */
 173	if (!test_bit(type, net->ipv6.sysctl.icmpv6_ratemask))
 174		return true;
 175
 176	return false;
 177}
 178
 179static bool icmpv6_global_allow(struct net *net, int type)
 180{
 181	if (icmpv6_mask_allow(net, type))
 182		return true;
 183
 184	if (icmp_global_allow())
 185		return true;
 186
 187	return false;
 188}
 189
 190/*
 191 * Check the ICMP output rate limit
 192 */
 193static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 194			       struct flowi6 *fl6)
 195{
 196	struct net *net = sock_net(sk);
 197	struct dst_entry *dst;
 198	bool res = false;
 199
 200	if (icmpv6_mask_allow(net, type))
 201		return true;
 202
 203	/*
 204	 * Look up the output route.
 205	 * XXX: perhaps the expire for routing entries cloned by
 206	 * this lookup should be more aggressive (not longer than timeout).
 207	 */
 208	dst = ip6_route_output(net, sk, fl6);
 209	if (dst->error) {
 210		IP6_INC_STATS(net, ip6_dst_idev(dst),
 211			      IPSTATS_MIB_OUTNOROUTES);
 212	} else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 213		res = true;
 214	} else {
 215		struct rt6_info *rt = (struct rt6_info *)dst;
 216		int tmo = net->ipv6.sysctl.icmpv6_time;
 217		struct inet_peer *peer;
 218
 219		/* Give more bandwidth to wider prefixes. */
 220		if (rt->rt6i_dst.plen < 128)
 221			tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 222
 223		peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1);
 224		res = inet_peer_xrlim_allow(peer, tmo);
 225		if (peer)
 226			inet_putpeer(peer);
 227	}
 228	dst_release(dst);
 229	return res;
 230}
 231
 232static bool icmpv6_rt_has_prefsrc(struct sock *sk, u8 type,
 233				  struct flowi6 *fl6)
 234{
 235	struct net *net = sock_net(sk);
 236	struct dst_entry *dst;
 237	bool res = false;
 238
 239	dst = ip6_route_output(net, sk, fl6);
 240	if (!dst->error) {
 241		struct rt6_info *rt = (struct rt6_info *)dst;
 242		struct in6_addr prefsrc;
 243
 244		rt6_get_prefsrc(rt, &prefsrc);
 245		res = !ipv6_addr_any(&prefsrc);
 246	}
 247	dst_release(dst);
 248	return res;
 249}
 250
 251/*
 252 *	an inline helper for the "simple" if statement below
 253 *	checks if parameter problem report is caused by an
 254 *	unrecognized IPv6 option that has the Option Type
 255 *	highest-order two bits set to 10
 256 */
 257
 258static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 259{
 260	u8 _optval, *op;
 261
 262	offset += skb_network_offset(skb);
 263	op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 264	if (!op)
 265		return true;
 266	return (*op & 0xC0) == 0x80;
 267}
 268
 269void icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 270				struct icmp6hdr *thdr, int len)
 271{
 272	struct sk_buff *skb;
 273	struct icmp6hdr *icmp6h;
 274
 275	skb = skb_peek(&sk->sk_write_queue);
 276	if (!skb)
 277		return;
 278
 279	icmp6h = icmp6_hdr(skb);
 280	memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 281	icmp6h->icmp6_cksum = 0;
 282
 283	if (skb_queue_len(&sk->sk_write_queue) == 1) {
 284		skb->csum = csum_partial(icmp6h,
 285					sizeof(struct icmp6hdr), skb->csum);
 286		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 287						      &fl6->daddr,
 288						      len, fl6->flowi6_proto,
 289						      skb->csum);
 290	} else {
 291		__wsum tmp_csum = 0;
 292
 293		skb_queue_walk(&sk->sk_write_queue, skb) {
 294			tmp_csum = csum_add(tmp_csum, skb->csum);
 295		}
 296
 297		tmp_csum = csum_partial(icmp6h,
 298					sizeof(struct icmp6hdr), tmp_csum);
 299		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 300						      &fl6->daddr,
 301						      len, fl6->flowi6_proto,
 302						      tmp_csum);
 303	}
 304	ip6_push_pending_frames(sk);
 305}
 306
 307struct icmpv6_msg {
 308	struct sk_buff	*skb;
 309	int		offset;
 310	uint8_t		type;
 311};
 312
 313static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 314{
 315	struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 316	struct sk_buff *org_skb = msg->skb;
 317	__wsum csum = 0;
 318
 319	csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 320				      to, len, csum);
 321	skb->csum = csum_block_add(skb->csum, csum, odd);
 322	if (!(msg->type & ICMPV6_INFOMSG_MASK))
 323		nf_ct_attach(skb, org_skb);
 324	return 0;
 325}
 326
 327#if IS_ENABLED(CONFIG_IPV6_MIP6)
 328static void mip6_addr_swap(struct sk_buff *skb)
 329{
 330	struct ipv6hdr *iph = ipv6_hdr(skb);
 331	struct inet6_skb_parm *opt = IP6CB(skb);
 332	struct ipv6_destopt_hao *hao;
 333	struct in6_addr tmp;
 334	int off;
 335
 336	if (opt->dsthao) {
 337		off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 338		if (likely(off >= 0)) {
 339			hao = (struct ipv6_destopt_hao *)
 340					(skb_network_header(skb) + off);
 341			tmp = iph->saddr;
 342			iph->saddr = hao->addr;
 343			hao->addr = tmp;
 344		}
 345	}
 346}
 347#else
 348static inline void mip6_addr_swap(struct sk_buff *skb) {}
 349#endif
 350
 351static struct dst_entry *icmpv6_route_lookup(struct net *net,
 352					     struct sk_buff *skb,
 353					     struct sock *sk,
 354					     struct flowi6 *fl6)
 355{
 356	struct dst_entry *dst, *dst2;
 357	struct flowi6 fl2;
 358	int err;
 359
 360	err = ip6_dst_lookup(net, sk, &dst, fl6);
 361	if (err)
 362		return ERR_PTR(err);
 363
 364	/*
 365	 * We won't send icmp if the destination is known
 366	 * anycast.
 367	 */
 368	if (ipv6_anycast_destination(dst, &fl6->daddr)) {
 369		net_dbg_ratelimited("icmp6_send: acast source\n");
 370		dst_release(dst);
 371		return ERR_PTR(-EINVAL);
 372	}
 373
 374	/* No need to clone since we're just using its address. */
 375	dst2 = dst;
 376
 377	dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 378	if (!IS_ERR(dst)) {
 379		if (dst != dst2)
 380			return dst;
 381	} else {
 382		if (PTR_ERR(dst) == -EPERM)
 383			dst = NULL;
 384		else
 385			return dst;
 386	}
 387
 388	err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
 389	if (err)
 390		goto relookup_failed;
 391
 392	err = ip6_dst_lookup(net, sk, &dst2, &fl2);
 393	if (err)
 394		goto relookup_failed;
 395
 396	dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 397	if (!IS_ERR(dst2)) {
 398		dst_release(dst);
 399		dst = dst2;
 400	} else {
 401		err = PTR_ERR(dst2);
 402		if (err == -EPERM) {
 403			dst_release(dst);
 404			return dst2;
 405		} else
 406			goto relookup_failed;
 407	}
 408
 409relookup_failed:
 410	if (dst)
 411		return dst;
 412	return ERR_PTR(err);
 413}
 414
 415static struct net_device *icmp6_dev(const struct sk_buff *skb)
 416{
 417	struct net_device *dev = skb->dev;
 418
 419	/* for local traffic to local address, skb dev is the loopback
 420	 * device. Check if there is a dst attached to the skb and if so
 421	 * get the real device index. Same is needed for replies to a link
 422	 * local address on a device enslaved to an L3 master device
 423	 */
 424	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
 425		const struct rt6_info *rt6 = skb_rt6_info(skb);
 426
 427		if (rt6)
 428			dev = rt6->rt6i_idev->dev;
 429	}
 430
 431	return dev;
 432}
 433
 434static int icmp6_iif(const struct sk_buff *skb)
 435{
 436	return icmp6_dev(skb)->ifindex;
 437}
 438
 439/*
 440 *	Send an ICMP message in response to a packet in error
 441 */
 442static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
 443		       const struct in6_addr *force_saddr)
 444{
 445	struct inet6_dev *idev = NULL;
 446	struct ipv6hdr *hdr = ipv6_hdr(skb);
 447	struct sock *sk;
 448	struct net *net;
 449	struct ipv6_pinfo *np;
 450	const struct in6_addr *saddr = NULL;
 451	struct dst_entry *dst;
 452	struct icmp6hdr tmp_hdr;
 453	struct flowi6 fl6;
 454	struct icmpv6_msg msg;
 455	struct ipcm6_cookie ipc6;
 456	int iif = 0;
 457	int addr_type = 0;
 458	int len;
 459	u32 mark;
 460
 461	if ((u8 *)hdr < skb->head ||
 462	    (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 463		return;
 464
 465	if (!skb->dev)
 466		return;
 467	net = dev_net(skb->dev);
 468	mark = IP6_REPLY_MARK(net, skb->mark);
 469	/*
 470	 *	Make sure we respect the rules
 471	 *	i.e. RFC 1885 2.4(e)
 472	 *	Rule (e.1) is enforced by not using icmp6_send
 473	 *	in any code that processes icmp errors.
 474	 */
 475	addr_type = ipv6_addr_type(&hdr->daddr);
 476
 477	if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 478	    ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 479		saddr = &hdr->daddr;
 480
 481	/*
 482	 *	Dest addr check
 483	 */
 484
 485	if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
 486		if (type != ICMPV6_PKT_TOOBIG &&
 487		    !(type == ICMPV6_PARAMPROB &&
 488		      code == ICMPV6_UNK_OPTION &&
 489		      (opt_unrec(skb, info))))
 490			return;
 491
 492		saddr = NULL;
 493	}
 494
 495	addr_type = ipv6_addr_type(&hdr->saddr);
 496
 497	/*
 498	 *	Source addr check
 499	 */
 500
 501	if (__ipv6_addr_needs_scope_id(addr_type)) {
 502		iif = icmp6_iif(skb);
 503	} else {
 504		dst = skb_dst(skb);
 505		iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev);
 506	}
 507
 508	/*
 509	 *	Must not send error if the source does not uniquely
 510	 *	identify a single node (RFC2463 Section 2.4).
 511	 *	We check unspecified / multicast addresses here,
 512	 *	and anycast addresses will be checked later.
 513	 */
 514	if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 515		net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
 516				    &hdr->saddr, &hdr->daddr);
 517		return;
 518	}
 519
 520	/*
 521	 *	Never answer to a ICMP packet.
 522	 */
 523	if (is_ineligible(skb)) {
 524		net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
 525				    &hdr->saddr, &hdr->daddr);
 526		return;
 527	}
 528
 529	/* Needed by both icmp_global_allow and icmpv6_xmit_lock */
 530	local_bh_disable();
 531
 532	/* Check global sysctl_icmp_msgs_per_sec ratelimit */
 533	if (!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, type))
 534		goto out_bh_enable;
 535
 536	mip6_addr_swap(skb);
 537
 538	sk = icmpv6_xmit_lock(net);
 539	if (!sk)
 540		goto out_bh_enable;
 541
 542	memset(&fl6, 0, sizeof(fl6));
 543	fl6.flowi6_proto = IPPROTO_ICMPV6;
 544	fl6.daddr = hdr->saddr;
 545	if (force_saddr)
 546		saddr = force_saddr;
 547	if (saddr) {
 548		fl6.saddr = *saddr;
 549	} else if (!icmpv6_rt_has_prefsrc(sk, type, &fl6)) {
 550		/* select a more meaningful saddr from input if */
 551		struct net_device *in_netdev;
 552
 553		in_netdev = dev_get_by_index(net, IP6CB(skb)->iif);
 554		if (in_netdev) {
 555			ipv6_dev_get_saddr(net, in_netdev, &fl6.daddr,
 556					   inet6_sk(sk)->srcprefs,
 557					   &fl6.saddr);
 558			dev_put(in_netdev);
 559		}
 560	}
 561	fl6.flowi6_mark = mark;
 562	fl6.flowi6_oif = iif;
 563	fl6.fl6_icmp_type = type;
 564	fl6.fl6_icmp_code = code;
 565	fl6.flowi6_uid = sock_net_uid(net, NULL);
 566	fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL);
 567	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 568
 569	sk->sk_mark = mark;
 570	np = inet6_sk(sk);
 571
 572	if (!icmpv6_xrlim_allow(sk, type, &fl6))
 573		goto out;
 574
 575	tmp_hdr.icmp6_type = type;
 576	tmp_hdr.icmp6_code = code;
 577	tmp_hdr.icmp6_cksum = 0;
 578	tmp_hdr.icmp6_pointer = htonl(info);
 579
 580	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 581		fl6.flowi6_oif = np->mcast_oif;
 582	else if (!fl6.flowi6_oif)
 583		fl6.flowi6_oif = np->ucast_oif;
 584
 585	ipcm6_init_sk(&ipc6, np);
 586	fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 587
 588	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 589	if (IS_ERR(dst))
 590		goto out;
 591
 592	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 593
 594	msg.skb = skb;
 595	msg.offset = skb_network_offset(skb);
 596	msg.type = type;
 597
 598	len = skb->len - msg.offset;
 599	len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr));
 600	if (len < 0) {
 601		net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
 602				    &hdr->saddr, &hdr->daddr);
 603		goto out_dst_release;
 604	}
 605
 606	rcu_read_lock();
 607	idev = __in6_dev_get(skb->dev);
 608
 609	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
 610			    len + sizeof(struct icmp6hdr),
 611			    sizeof(struct icmp6hdr),
 612			    &ipc6, &fl6, (struct rt6_info *)dst,
 613			    MSG_DONTWAIT)) {
 614		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 615		ip6_flush_pending_frames(sk);
 616	} else {
 617		icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 618					   len + sizeof(struct icmp6hdr));
 619	}
 620	rcu_read_unlock();
 621out_dst_release:
 622	dst_release(dst);
 623out:
 624	icmpv6_xmit_unlock(sk);
 625out_bh_enable:
 626	local_bh_enable();
 627}
 628
 629/* Slightly more convenient version of icmp6_send.
 630 */
 631void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 632{
 633	icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL);
 634	kfree_skb(skb);
 635}
 636
 637/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
 638 * if sufficient data bytes are available
 639 * @nhs is the size of the tunnel header(s) :
 640 *  Either an IPv4 header for SIT encap
 641 *         an IPv4 header + GRE header for GRE encap
 642 */
 643int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
 644			       unsigned int data_len)
 645{
 646	struct in6_addr temp_saddr;
 647	struct rt6_info *rt;
 648	struct sk_buff *skb2;
 649	u32 info = 0;
 650
 651	if (!pskb_may_pull(skb, nhs + sizeof(struct ipv6hdr) + 8))
 652		return 1;
 653
 654	/* RFC 4884 (partial) support for ICMP extensions */
 655	if (data_len < 128 || (data_len & 7) || skb->len < data_len)
 656		data_len = 0;
 657
 658	skb2 = data_len ? skb_copy(skb, GFP_ATOMIC) : skb_clone(skb, GFP_ATOMIC);
 659
 660	if (!skb2)
 661		return 1;
 662
 663	skb_dst_drop(skb2);
 664	skb_pull(skb2, nhs);
 665	skb_reset_network_header(skb2);
 666
 667	rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0,
 668			skb, 0);
 669
 670	if (rt && rt->dst.dev)
 671		skb2->dev = rt->dst.dev;
 672
 673	ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, &temp_saddr);
 674
 675	if (data_len) {
 676		/* RFC 4884 (partial) support :
 677		 * insert 0 padding at the end, before the extensions
 678		 */
 679		__skb_push(skb2, nhs);
 680		skb_reset_network_header(skb2);
 681		memmove(skb2->data, skb2->data + nhs, data_len - nhs);
 682		memset(skb2->data + data_len - nhs, 0, nhs);
 683		/* RFC 4884 4.5 : Length is measured in 64-bit words,
 684		 * and stored in reserved[0]
 685		 */
 686		info = (data_len/8) << 24;
 687	}
 688	if (type == ICMP_TIME_EXCEEDED)
 689		icmp6_send(skb2, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 690			   info, &temp_saddr);
 691	else
 692		icmp6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH,
 693			   info, &temp_saddr);
 694	if (rt)
 695		ip6_rt_put(rt);
 696
 697	kfree_skb(skb2);
 698
 699	return 0;
 700}
 701EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach);
 702
 703static void icmpv6_echo_reply(struct sk_buff *skb)
 704{
 705	struct net *net = dev_net(skb->dev);
 706	struct sock *sk;
 707	struct inet6_dev *idev;
 708	struct ipv6_pinfo *np;
 709	const struct in6_addr *saddr = NULL;
 710	struct icmp6hdr *icmph = icmp6_hdr(skb);
 711	struct icmp6hdr tmp_hdr;
 712	struct flowi6 fl6;
 713	struct icmpv6_msg msg;
 714	struct dst_entry *dst;
 715	struct ipcm6_cookie ipc6;
 716	u32 mark = IP6_REPLY_MARK(net, skb->mark);
 717	bool acast;
 718
 719	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) &&
 720	    net->ipv6.sysctl.icmpv6_echo_ignore_multicast)
 721		return;
 722
 723	saddr = &ipv6_hdr(skb)->daddr;
 724
 725	acast = ipv6_anycast_destination(skb_dst(skb), saddr);
 726	if (acast && net->ipv6.sysctl.icmpv6_echo_ignore_anycast)
 727		return;
 728
 729	if (!ipv6_unicast_destination(skb) &&
 730	    !(net->ipv6.sysctl.anycast_src_echo_reply && acast))
 731		saddr = NULL;
 732
 733	memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 734	tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
 735
 736	memset(&fl6, 0, sizeof(fl6));
 737	if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
 738		fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb));
 739
 740	fl6.flowi6_proto = IPPROTO_ICMPV6;
 741	fl6.daddr = ipv6_hdr(skb)->saddr;
 742	if (saddr)
 743		fl6.saddr = *saddr;
 744	fl6.flowi6_oif = icmp6_iif(skb);
 745	fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
 746	fl6.flowi6_mark = mark;
 747	fl6.flowi6_uid = sock_net_uid(net, NULL);
 748	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 749
 750	local_bh_disable();
 751	sk = icmpv6_xmit_lock(net);
 752	if (!sk)
 753		goto out_bh_enable;
 754	sk->sk_mark = mark;
 755	np = inet6_sk(sk);
 756
 757	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 758		fl6.flowi6_oif = np->mcast_oif;
 759	else if (!fl6.flowi6_oif)
 760		fl6.flowi6_oif = np->ucast_oif;
 761
 762	if (ip6_dst_lookup(net, sk, &dst, &fl6))
 763		goto out;
 764	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 765	if (IS_ERR(dst))
 766		goto out;
 767
 768	/* Check the ratelimit */
 769	if ((!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, ICMPV6_ECHO_REPLY)) ||
 770	    !icmpv6_xrlim_allow(sk, ICMPV6_ECHO_REPLY, &fl6))
 771		goto out_dst_release;
 772
 773	idev = __in6_dev_get(skb->dev);
 774
 775	msg.skb = skb;
 776	msg.offset = 0;
 777	msg.type = ICMPV6_ECHO_REPLY;
 778
 779	ipcm6_init_sk(&ipc6, np);
 780	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 781	ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 782
 783	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
 784			    skb->len + sizeof(struct icmp6hdr),
 785			    sizeof(struct icmp6hdr), &ipc6, &fl6,
 786			    (struct rt6_info *)dst, MSG_DONTWAIT)) {
 787		__ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 788		ip6_flush_pending_frames(sk);
 789	} else {
 790		icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 791					   skb->len + sizeof(struct icmp6hdr));
 792	}
 793out_dst_release:
 794	dst_release(dst);
 795out:
 796	icmpv6_xmit_unlock(sk);
 797out_bh_enable:
 798	local_bh_enable();
 799}
 800
 801void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 802{
 803	const struct inet6_protocol *ipprot;
 804	int inner_offset;
 805	__be16 frag_off;
 806	u8 nexthdr;
 807	struct net *net = dev_net(skb->dev);
 808
 809	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 810		goto out;
 811
 812	nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
 813	if (ipv6_ext_hdr(nexthdr)) {
 814		/* now skip over extension headers */
 815		inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 816						&nexthdr, &frag_off);
 817		if (inner_offset < 0)
 818			goto out;
 819	} else {
 820		inner_offset = sizeof(struct ipv6hdr);
 821	}
 822
 823	/* Checkin header including 8 bytes of inner protocol header. */
 824	if (!pskb_may_pull(skb, inner_offset+8))
 825		goto out;
 826
 827	/* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
 828	   Without this we will not able f.e. to make source routed
 829	   pmtu discovery.
 830	   Corresponding argument (opt) to notifiers is already added.
 831	   --ANK (980726)
 832	 */
 833
 834	ipprot = rcu_dereference(inet6_protos[nexthdr]);
 835	if (ipprot && ipprot->err_handler)
 836		ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
 837
 838	raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
 839	return;
 840
 841out:
 842	__ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 843}
 844
 845/*
 846 *	Handle icmp messages
 847 */
 848
 849static int icmpv6_rcv(struct sk_buff *skb)
 850{
 851	struct net *net = dev_net(skb->dev);
 852	struct net_device *dev = icmp6_dev(skb);
 853	struct inet6_dev *idev = __in6_dev_get(dev);
 854	const struct in6_addr *saddr, *daddr;
 855	struct icmp6hdr *hdr;
 856	u8 type;
 857	bool success = false;
 858
 859	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 860		struct sec_path *sp = skb_sec_path(skb);
 861		int nh;
 862
 863		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
 864				 XFRM_STATE_ICMP))
 865			goto drop_no_count;
 866
 867		if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
 868			goto drop_no_count;
 869
 870		nh = skb_network_offset(skb);
 871		skb_set_network_header(skb, sizeof(*hdr));
 872
 873		if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
 874			goto drop_no_count;
 875
 876		skb_set_network_header(skb, nh);
 877	}
 878
 879	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS);
 880
 881	saddr = &ipv6_hdr(skb)->saddr;
 882	daddr = &ipv6_hdr(skb)->daddr;
 883
 884	if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
 885		net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
 886				    saddr, daddr);
 887		goto csum_error;
 888	}
 889
 890	if (!pskb_pull(skb, sizeof(*hdr)))
 891		goto discard_it;
 892
 893	hdr = icmp6_hdr(skb);
 894
 895	type = hdr->icmp6_type;
 896
 897	ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type);
 898
 899	switch (type) {
 900	case ICMPV6_ECHO_REQUEST:
 901		if (!net->ipv6.sysctl.icmpv6_echo_ignore_all)
 902			icmpv6_echo_reply(skb);
 903		break;
 904
 905	case ICMPV6_ECHO_REPLY:
 906		success = ping_rcv(skb);
 907		break;
 908
 909	case ICMPV6_PKT_TOOBIG:
 910		/* BUGGG_FUTURE: if packet contains rthdr, we cannot update
 911		   standard destination cache. Seems, only "advanced"
 912		   destination cache will allow to solve this problem
 913		   --ANK (980726)
 914		 */
 915		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 916			goto discard_it;
 917		hdr = icmp6_hdr(skb);
 918
 919		/* to notify */
 920		fallthrough;
 921	case ICMPV6_DEST_UNREACH:
 922	case ICMPV6_TIME_EXCEED:
 923	case ICMPV6_PARAMPROB:
 924		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 925		break;
 926
 927	case NDISC_ROUTER_SOLICITATION:
 928	case NDISC_ROUTER_ADVERTISEMENT:
 929	case NDISC_NEIGHBOUR_SOLICITATION:
 930	case NDISC_NEIGHBOUR_ADVERTISEMENT:
 931	case NDISC_REDIRECT:
 932		ndisc_rcv(skb);
 933		break;
 934
 935	case ICMPV6_MGM_QUERY:
 936		igmp6_event_query(skb);
 937		break;
 938
 939	case ICMPV6_MGM_REPORT:
 940		igmp6_event_report(skb);
 941		break;
 942
 943	case ICMPV6_MGM_REDUCTION:
 944	case ICMPV6_NI_QUERY:
 945	case ICMPV6_NI_REPLY:
 946	case ICMPV6_MLD2_REPORT:
 947	case ICMPV6_DHAAD_REQUEST:
 948	case ICMPV6_DHAAD_REPLY:
 949	case ICMPV6_MOBILE_PREFIX_SOL:
 950	case ICMPV6_MOBILE_PREFIX_ADV:
 951		break;
 952
 953	default:
 954		/* informational */
 955		if (type & ICMPV6_INFOMSG_MASK)
 956			break;
 957
 958		net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
 959				    saddr, daddr);
 960
 961		/*
 962		 * error of unknown type.
 963		 * must pass to upper level
 964		 */
 965
 966		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 967	}
 968
 969	/* until the v6 path can be better sorted assume failure and
 970	 * preserve the status quo behaviour for the rest of the paths to here
 971	 */
 972	if (success)
 973		consume_skb(skb);
 974	else
 975		kfree_skb(skb);
 976
 977	return 0;
 978
 979csum_error:
 980	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
 981discard_it:
 982	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS);
 983drop_no_count:
 984	kfree_skb(skb);
 985	return 0;
 986}
 987
 988void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
 989		      u8 type,
 990		      const struct in6_addr *saddr,
 991		      const struct in6_addr *daddr,
 992		      int oif)
 993{
 994	memset(fl6, 0, sizeof(*fl6));
 995	fl6->saddr = *saddr;
 996	fl6->daddr = *daddr;
 997	fl6->flowi6_proto	= IPPROTO_ICMPV6;
 998	fl6->fl6_icmp_type	= type;
 999	fl6->fl6_icmp_code	= 0;
1000	fl6->flowi6_oif		= oif;
1001	security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
1002}
1003
1004static void __net_exit icmpv6_sk_exit(struct net *net)
1005{
1006	int i;
1007
1008	for_each_possible_cpu(i)
1009		inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv6.icmp_sk, i));
1010	free_percpu(net->ipv6.icmp_sk);
1011}
1012
1013static int __net_init icmpv6_sk_init(struct net *net)
1014{
1015	struct sock *sk;
1016	int err, i;
1017
1018	net->ipv6.icmp_sk = alloc_percpu(struct sock *);
1019	if (!net->ipv6.icmp_sk)
1020		return -ENOMEM;
1021
1022	for_each_possible_cpu(i) {
1023		err = inet_ctl_sock_create(&sk, PF_INET6,
1024					   SOCK_RAW, IPPROTO_ICMPV6, net);
1025		if (err < 0) {
1026			pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
1027			       err);
1028			goto fail;
1029		}
1030
1031		*per_cpu_ptr(net->ipv6.icmp_sk, i) = sk;
1032
1033		/* Enough space for 2 64K ICMP packets, including
1034		 * sk_buff struct overhead.
1035		 */
1036		sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
1037	}
1038	return 0;
1039
1040 fail:
1041	icmpv6_sk_exit(net);
1042	return err;
1043}
1044
1045static struct pernet_operations icmpv6_sk_ops = {
1046	.init = icmpv6_sk_init,
1047	.exit = icmpv6_sk_exit,
1048};
1049
1050int __init icmpv6_init(void)
1051{
1052	int err;
1053
1054	err = register_pernet_subsys(&icmpv6_sk_ops);
1055	if (err < 0)
1056		return err;
1057
1058	err = -EAGAIN;
1059	if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
1060		goto fail;
1061
1062	err = inet6_register_icmp_sender(icmp6_send);
1063	if (err)
1064		goto sender_reg_err;
1065	return 0;
1066
1067sender_reg_err:
1068	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1069fail:
1070	pr_err("Failed to register ICMP6 protocol\n");
1071	unregister_pernet_subsys(&icmpv6_sk_ops);
1072	return err;
1073}
1074
1075void icmpv6_cleanup(void)
1076{
1077	inet6_unregister_icmp_sender(icmp6_send);
1078	unregister_pernet_subsys(&icmpv6_sk_ops);
1079	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1080}
1081
1082
1083static const struct icmp6_err {
1084	int err;
1085	int fatal;
1086} tab_unreach[] = {
1087	{	/* NOROUTE */
1088		.err	= ENETUNREACH,
1089		.fatal	= 0,
1090	},
1091	{	/* ADM_PROHIBITED */
1092		.err	= EACCES,
1093		.fatal	= 1,
1094	},
1095	{	/* Was NOT_NEIGHBOUR, now reserved */
1096		.err	= EHOSTUNREACH,
1097		.fatal	= 0,
1098	},
1099	{	/* ADDR_UNREACH	*/
1100		.err	= EHOSTUNREACH,
1101		.fatal	= 0,
1102	},
1103	{	/* PORT_UNREACH	*/
1104		.err	= ECONNREFUSED,
1105		.fatal	= 1,
1106	},
1107	{	/* POLICY_FAIL */
1108		.err	= EACCES,
1109		.fatal	= 1,
1110	},
1111	{	/* REJECT_ROUTE	*/
1112		.err	= EACCES,
1113		.fatal	= 1,
1114	},
1115};
1116
1117int icmpv6_err_convert(u8 type, u8 code, int *err)
1118{
1119	int fatal = 0;
1120
1121	*err = EPROTO;
1122
1123	switch (type) {
1124	case ICMPV6_DEST_UNREACH:
1125		fatal = 1;
1126		if (code < ARRAY_SIZE(tab_unreach)) {
1127			*err  = tab_unreach[code].err;
1128			fatal = tab_unreach[code].fatal;
1129		}
1130		break;
1131
1132	case ICMPV6_PKT_TOOBIG:
1133		*err = EMSGSIZE;
1134		break;
1135
1136	case ICMPV6_PARAMPROB:
1137		*err = EPROTO;
1138		fatal = 1;
1139		break;
1140
1141	case ICMPV6_TIME_EXCEED:
1142		*err = EHOSTUNREACH;
1143		break;
1144	}
1145
1146	return fatal;
1147}
1148EXPORT_SYMBOL(icmpv6_err_convert);
1149
1150#ifdef CONFIG_SYSCTL
1151static struct ctl_table ipv6_icmp_table_template[] = {
1152	{
1153		.procname	= "ratelimit",
1154		.data		= &init_net.ipv6.sysctl.icmpv6_time,
1155		.maxlen		= sizeof(int),
1156		.mode		= 0644,
1157		.proc_handler	= proc_dointvec_ms_jiffies,
1158	},
1159	{
1160		.procname	= "echo_ignore_all",
1161		.data		= &init_net.ipv6.sysctl.icmpv6_echo_ignore_all,
1162		.maxlen		= sizeof(int),
1163		.mode		= 0644,
1164		.proc_handler = proc_dointvec,
1165	},
1166	{
1167		.procname	= "echo_ignore_multicast",
1168		.data		= &init_net.ipv6.sysctl.icmpv6_echo_ignore_multicast,
1169		.maxlen		= sizeof(int),
1170		.mode		= 0644,
1171		.proc_handler = proc_dointvec,
1172	},
1173	{
1174		.procname	= "echo_ignore_anycast",
1175		.data		= &init_net.ipv6.sysctl.icmpv6_echo_ignore_anycast,
1176		.maxlen		= sizeof(int),
1177		.mode		= 0644,
1178		.proc_handler = proc_dointvec,
1179	},
1180	{
1181		.procname	= "ratemask",
1182		.data		= &init_net.ipv6.sysctl.icmpv6_ratemask_ptr,
1183		.maxlen		= ICMPV6_MSG_MAX + 1,
1184		.mode		= 0644,
1185		.proc_handler = proc_do_large_bitmap,
1186	},
1187	{ },
1188};
1189
1190struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1191{
1192	struct ctl_table *table;
1193
1194	table = kmemdup(ipv6_icmp_table_template,
1195			sizeof(ipv6_icmp_table_template),
1196			GFP_KERNEL);
1197
1198	if (table) {
1199		table[0].data = &net->ipv6.sysctl.icmpv6_time;
1200		table[1].data = &net->ipv6.sysctl.icmpv6_echo_ignore_all;
1201		table[2].data = &net->ipv6.sysctl.icmpv6_echo_ignore_multicast;
1202		table[3].data = &net->ipv6.sysctl.icmpv6_echo_ignore_anycast;
1203		table[4].data = &net->ipv6.sysctl.icmpv6_ratemask_ptr;
1204	}
1205	return table;
1206}
1207#endif