1// SPDX-License-Identifier: GPL-2.0-only
  2/* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  3 * Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue>
  4 *
  5 * Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki.
  6 */
  7
  8#include <linux/skbuff.h>
  9#include <net/ipv6.h>
 10#include <net/mld.h>
 11#include <net/addrconf.h>
 12#include <net/ip6_checksum.h>
 13
 14static int ipv6_mc_check_ip6hdr(struct sk_buff *skb)
 15{
 16	const struct ipv6hdr *ip6h;
 17	unsigned int len;
 18	unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h);
 19
 20	if (!pskb_may_pull(skb, offset))
 21		return -EINVAL;
 22
 23	ip6h = ipv6_hdr(skb);
 24
 25	if (ip6h->version != 6)
 26		return -EINVAL;
 27
 28	len = offset + ntohs(ip6h->payload_len);
 29	if (skb->len < len || len <= offset)
 30		return -EINVAL;
 31
 32	skb_set_transport_header(skb, offset);
 33
 34	return 0;
 35}
 36
 37static int ipv6_mc_check_exthdrs(struct sk_buff *skb)
 38{
 39	const struct ipv6hdr *ip6h;
 40	int offset;
 41	u8 nexthdr;
 42	__be16 frag_off;
 43
 44	ip6h = ipv6_hdr(skb);
 45
 46	if (ip6h->nexthdr != IPPROTO_HOPOPTS)
 47		return -ENOMSG;
 48
 49	nexthdr = ip6h->nexthdr;
 50	offset = skb_network_offset(skb) + sizeof(*ip6h);
 51	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
 52
 53	if (offset < 0)
 54		return -EINVAL;
 55
 56	if (nexthdr != IPPROTO_ICMPV6)
 57		return -ENOMSG;
 58
 59	skb_set_transport_header(skb, offset);
 60
 61	return 0;
 62}
 63
 64static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb)
 65{
 66	unsigned int len = skb_transport_offset(skb);
 67
 68	len += sizeof(struct mld2_report);
 69
 70	return ipv6_mc_may_pull(skb, len) ? 0 : -EINVAL;
 71}
 72
 73static int ipv6_mc_check_mld_query(struct sk_buff *skb)
 74{
 75	unsigned int transport_len = ipv6_transport_len(skb);
 76	struct mld_msg *mld;
 77	unsigned int len;
 78
 79	/* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
 80	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
 81		return -EINVAL;
 82
 83	/* MLDv1? */
 84	if (transport_len != sizeof(struct mld_msg)) {
 85		/* or MLDv2? */
 86		if (transport_len < sizeof(struct mld2_query))
 87			return -EINVAL;
 88
 89		len = skb_transport_offset(skb) + sizeof(struct mld2_query);
 90		if (!ipv6_mc_may_pull(skb, len))
 91			return -EINVAL;
 92	}
 93
 94	mld = (struct mld_msg *)skb_transport_header(skb);
 95
 96	/* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
 97	 * all-nodes destination address (ff02::1) for general queries
 98	 */
 99	if (ipv6_addr_any(&mld->mld_mca) &&
100	    !ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
101		return -EINVAL;
102
103	return 0;
104}
105
106static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
107{
108	unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg);
109	struct mld_msg *mld;
110
111	if (!ipv6_mc_may_pull(skb, len))
112		return -ENODATA;
113
114	mld = (struct mld_msg *)skb_transport_header(skb);
115
116	switch (mld->mld_type) {
117	case ICMPV6_MGM_REDUCTION:
118	case ICMPV6_MGM_REPORT:
119		return 0;
120	case ICMPV6_MLD2_REPORT:
121		return ipv6_mc_check_mld_reportv2(skb);
122	case ICMPV6_MGM_QUERY:
123		return ipv6_mc_check_mld_query(skb);
124	default:
125		return -ENODATA;
126	}
127}
128
129static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
130{
131	return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
132}
133
134static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
135{
136	unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
137	unsigned int transport_len = ipv6_transport_len(skb);
138	struct sk_buff *skb_chk;
139
140	if (!ipv6_mc_may_pull(skb, len))
141		return -EINVAL;
142
143	skb_chk = skb_checksum_trimmed(skb, transport_len,
144				       ipv6_mc_validate_checksum);
145	if (!skb_chk)
146		return -EINVAL;
147
148	if (skb_chk != skb)
149		kfree_skb(skb_chk);
150
151	return 0;
152}
153
154/**
155 * ipv6_mc_check_mld - checks whether this is a sane MLD packet
156 * @skb: the skb to validate
157 *
158 * Checks whether an IPv6 packet is a valid MLD packet. If so sets
159 * skb transport header accordingly and returns zero.
160 *
161 * -EINVAL: A broken packet was detected, i.e. it violates some internet
162 *  standard
163 * -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet
164 *  with a hop-by-hop option.
165 * -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded
166 *  but it is not an MLD packet.
167 * -ENOMEM: A memory allocation failure happened.
168 *
169 * Caller needs to set the skb network header and free any returned skb if it
170 * differs from the provided skb.
171 */
172int ipv6_mc_check_mld(struct sk_buff *skb)
173{
174	int ret;
175
176	ret = ipv6_mc_check_ip6hdr(skb);
177	if (ret < 0)
178		return ret;
179
180	ret = ipv6_mc_check_exthdrs(skb);
181	if (ret < 0)
182		return ret;
183
184	ret = ipv6_mc_check_icmpv6(skb);
185	if (ret < 0)
186		return ret;
187
188	return ipv6_mc_check_mld_msg(skb);
189}
190EXPORT_SYMBOL(ipv6_mc_check_mld);