Linux Audio

Check our new training course

Loading...
v3.15
   1/*
   2 *	Internet Control Message Protocol (ICMPv6)
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on net/ipv4/icmp.c
   9 *
  10 *	RFC 1885
  11 *
  12 *	This program is free software; you can redistribute it and/or
  13 *      modify it under the terms of the GNU General Public License
  14 *      as published by the Free Software Foundation; either version
  15 *      2 of the License, or (at your option) any later version.
  16 */
  17
  18/*
  19 *	Changes:
  20 *
  21 *	Andi Kleen		:	exception handling
  22 *	Andi Kleen			add rate limits. never reply to a icmp.
  23 *					add more length checks and other fixes.
  24 *	yoshfuji		:	ensure to sent parameter problem for
  25 *					fragments.
  26 *	YOSHIFUJI Hideaki @USAGI:	added sysctl for icmp rate limit.
  27 *	Randy Dunlap and
  28 *	YOSHIFUJI Hideaki @USAGI:	Per-interface statistics support
  29 *	Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  30 */
  31
  32#define pr_fmt(fmt) "IPv6: " fmt
  33
  34#include <linux/module.h>
  35#include <linux/errno.h>
  36#include <linux/types.h>
  37#include <linux/socket.h>
  38#include <linux/in.h>
  39#include <linux/kernel.h>
  40#include <linux/sockios.h>
  41#include <linux/net.h>
  42#include <linux/skbuff.h>
  43#include <linux/init.h>
  44#include <linux/netfilter.h>
  45#include <linux/slab.h>
  46
  47#ifdef CONFIG_SYSCTL
  48#include <linux/sysctl.h>
  49#endif
  50
  51#include <linux/inet.h>
  52#include <linux/netdevice.h>
  53#include <linux/icmpv6.h>
  54
  55#include <net/ip.h>
  56#include <net/sock.h>
  57
  58#include <net/ipv6.h>
  59#include <net/ip6_checksum.h>
  60#include <net/ping.h>
  61#include <net/protocol.h>
  62#include <net/raw.h>
  63#include <net/rawv6.h>
  64#include <net/transp_v6.h>
  65#include <net/ip6_route.h>
  66#include <net/addrconf.h>
  67#include <net/icmp.h>
  68#include <net/xfrm.h>
  69#include <net/inet_common.h>
  70#include <net/dsfield.h>
 
  71
  72#include <asm/uaccess.h>
  73
  74/*
  75 *	The ICMP socket(s). This is the most convenient way to flow control
  76 *	our ICMP output as well as maintain a clean interface throughout
  77 *	all layers. All Socketless IP sends will soon be gone.
  78 *
  79 *	On SMP we have one ICMP socket per-cpu.
  80 */
  81static inline struct sock *icmpv6_sk(struct net *net)
  82{
  83	return net->ipv6.icmp_sk[smp_processor_id()];
  84}
  85
  86static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  87		       u8 type, u8 code, int offset, __be32 info)
  88{
  89	/* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  90	struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  91	struct net *net = dev_net(skb->dev);
  92
  93	if (type == ICMPV6_PKT_TOOBIG)
  94		ip6_update_pmtu(skb, net, info, 0, 0);
  95	else if (type == NDISC_REDIRECT)
  96		ip6_redirect(skb, net, skb->dev->ifindex, 0);
 
  97
  98	if (!(type & ICMPV6_INFOMSG_MASK))
  99		if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
 100			ping_err(skb, offset, info);
 101}
 102
 103static int icmpv6_rcv(struct sk_buff *skb);
 104
 105static const struct inet6_protocol icmpv6_protocol = {
 106	.handler	=	icmpv6_rcv,
 107	.err_handler	=	icmpv6_err,
 108	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 109};
 110
 
 111static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
 112{
 113	struct sock *sk;
 114
 115	local_bh_disable();
 116
 117	sk = icmpv6_sk(net);
 118	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 119		/* This can happen if the output path (f.e. SIT or
 120		 * ip6ip6 tunnel) signals dst_link_failure() for an
 121		 * outgoing ICMP6 packet.
 122		 */
 123		local_bh_enable();
 124		return NULL;
 125	}
 126	return sk;
 127}
 128
 129static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 130{
 131	spin_unlock_bh(&sk->sk_lock.slock);
 132}
 133
 134/*
 135 * Figure out, may we reply to this packet with icmp error.
 136 *
 137 * We do not reply, if:
 138 *	- it was icmp error message.
 139 *	- it is truncated, so that it is known, that protocol is ICMPV6
 140 *	  (i.e. in the middle of some exthdr)
 141 *
 142 *	--ANK (980726)
 143 */
 144
 145static bool is_ineligible(const struct sk_buff *skb)
 146{
 147	int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 148	int len = skb->len - ptr;
 149	__u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 150	__be16 frag_off;
 151
 152	if (len < 0)
 153		return true;
 154
 155	ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 156	if (ptr < 0)
 157		return false;
 158	if (nexthdr == IPPROTO_ICMPV6) {
 159		u8 _type, *tp;
 160		tp = skb_header_pointer(skb,
 161			ptr+offsetof(struct icmp6hdr, icmp6_type),
 162			sizeof(_type), &_type);
 163		if (tp == NULL ||
 164		    !(*tp & ICMPV6_INFOMSG_MASK))
 165			return true;
 166	}
 167	return false;
 168}
 169
 170/*
 171 * Check the ICMP output rate limit
 172 */
 173static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 174				      struct flowi6 *fl6)
 175{
 176	struct dst_entry *dst;
 177	struct net *net = sock_net(sk);
 178	bool res = false;
 179
 180	/* Informational messages are not limited. */
 181	if (type & ICMPV6_INFOMSG_MASK)
 182		return true;
 183
 184	/* Do not limit pmtu discovery, it would break it. */
 185	if (type == ICMPV6_PKT_TOOBIG)
 186		return true;
 187
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 188	/*
 189	 * Look up the output route.
 190	 * XXX: perhaps the expire for routing entries cloned by
 191	 * this lookup should be more aggressive (not longer than timeout).
 192	 */
 193	dst = ip6_route_output(net, sk, fl6);
 194	if (dst->error) {
 195		IP6_INC_STATS(net, ip6_dst_idev(dst),
 196			      IPSTATS_MIB_OUTNOROUTES);
 197	} else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 198		res = true;
 199	} else {
 200		struct rt6_info *rt = (struct rt6_info *)dst;
 201		int tmo = net->ipv6.sysctl.icmpv6_time;
 202		struct inet_peer *peer;
 203
 204		/* Give more bandwidth to wider prefixes. */
 205		if (rt->rt6i_dst.plen < 128)
 206			tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 207
 208		peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
 209		res = inet_peer_xrlim_allow(peer, tmo);
 210		if (peer)
 211			inet_putpeer(peer);
 212	}
 213	dst_release(dst);
 214	return res;
 215}
 216
 217/*
 218 *	an inline helper for the "simple" if statement below
 219 *	checks if parameter problem report is caused by an
 220 *	unrecognized IPv6 option that has the Option Type
 221 *	highest-order two bits set to 10
 222 */
 223
 224static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 225{
 226	u8 _optval, *op;
 227
 228	offset += skb_network_offset(skb);
 229	op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 230	if (op == NULL)
 231		return true;
 232	return (*op & 0xC0) == 0x80;
 233}
 234
 235int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 236			       struct icmp6hdr *thdr, int len)
 237{
 238	struct sk_buff *skb;
 239	struct icmp6hdr *icmp6h;
 240	int err = 0;
 241
 242	if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
 243		goto out;
 
 244
 245	icmp6h = icmp6_hdr(skb);
 246	memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 247	icmp6h->icmp6_cksum = 0;
 248
 249	if (skb_queue_len(&sk->sk_write_queue) == 1) {
 250		skb->csum = csum_partial(icmp6h,
 251					sizeof(struct icmp6hdr), skb->csum);
 252		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 253						      &fl6->daddr,
 254						      len, fl6->flowi6_proto,
 255						      skb->csum);
 256	} else {
 257		__wsum tmp_csum = 0;
 258
 259		skb_queue_walk(&sk->sk_write_queue, skb) {
 260			tmp_csum = csum_add(tmp_csum, skb->csum);
 261		}
 262
 263		tmp_csum = csum_partial(icmp6h,
 264					sizeof(struct icmp6hdr), tmp_csum);
 265		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 266						      &fl6->daddr,
 267						      len, fl6->flowi6_proto,
 268						      tmp_csum);
 269	}
 270	ip6_push_pending_frames(sk);
 271out:
 272	return err;
 273}
 274
 275struct icmpv6_msg {
 276	struct sk_buff	*skb;
 277	int		offset;
 278	uint8_t		type;
 279};
 280
 281static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 282{
 283	struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 284	struct sk_buff *org_skb = msg->skb;
 285	__wsum csum = 0;
 286
 287	csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 288				      to, len, csum);
 289	skb->csum = csum_block_add(skb->csum, csum, odd);
 290	if (!(msg->type & ICMPV6_INFOMSG_MASK))
 291		nf_ct_attach(skb, org_skb);
 292	return 0;
 293}
 294
 295#if IS_ENABLED(CONFIG_IPV6_MIP6)
 296static void mip6_addr_swap(struct sk_buff *skb)
 297{
 298	struct ipv6hdr *iph = ipv6_hdr(skb);
 299	struct inet6_skb_parm *opt = IP6CB(skb);
 300	struct ipv6_destopt_hao *hao;
 301	struct in6_addr tmp;
 302	int off;
 303
 304	if (opt->dsthao) {
 305		off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 306		if (likely(off >= 0)) {
 307			hao = (struct ipv6_destopt_hao *)
 308					(skb_network_header(skb) + off);
 309			tmp = iph->saddr;
 310			iph->saddr = hao->addr;
 311			hao->addr = tmp;
 312		}
 313	}
 314}
 315#else
 316static inline void mip6_addr_swap(struct sk_buff *skb) {}
 317#endif
 318
 319static struct dst_entry *icmpv6_route_lookup(struct net *net,
 320					     struct sk_buff *skb,
 321					     struct sock *sk,
 322					     struct flowi6 *fl6)
 323{
 324	struct dst_entry *dst, *dst2;
 325	struct flowi6 fl2;
 326	int err;
 327
 328	err = ip6_dst_lookup(sk, &dst, fl6);
 329	if (err)
 330		return ERR_PTR(err);
 331
 332	/*
 333	 * We won't send icmp if the destination is known
 334	 * anycast.
 335	 */
 336	if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
 337		LIMIT_NETDEBUG(KERN_DEBUG "icmp6_send: acast source\n");
 338		dst_release(dst);
 339		return ERR_PTR(-EINVAL);
 340	}
 341
 342	/* No need to clone since we're just using its address. */
 343	dst2 = dst;
 344
 345	dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 346	if (!IS_ERR(dst)) {
 347		if (dst != dst2)
 348			return dst;
 349	} else {
 350		if (PTR_ERR(dst) == -EPERM)
 351			dst = NULL;
 352		else
 353			return dst;
 354	}
 355
 356	err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
 357	if (err)
 358		goto relookup_failed;
 359
 360	err = ip6_dst_lookup(sk, &dst2, &fl2);
 361	if (err)
 362		goto relookup_failed;
 363
 364	dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 365	if (!IS_ERR(dst2)) {
 366		dst_release(dst);
 367		dst = dst2;
 368	} else {
 369		err = PTR_ERR(dst2);
 370		if (err == -EPERM) {
 371			dst_release(dst);
 372			return dst2;
 373		} else
 374			goto relookup_failed;
 375	}
 376
 377relookup_failed:
 378	if (dst)
 379		return dst;
 380	return ERR_PTR(err);
 381}
 382
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 383/*
 384 *	Send an ICMP message in response to a packet in error
 385 */
 386static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 
 387{
 388	struct net *net = dev_net(skb->dev);
 389	struct inet6_dev *idev = NULL;
 390	struct ipv6hdr *hdr = ipv6_hdr(skb);
 391	struct sock *sk;
 392	struct ipv6_pinfo *np;
 393	const struct in6_addr *saddr = NULL;
 394	struct dst_entry *dst;
 395	struct icmp6hdr tmp_hdr;
 396	struct flowi6 fl6;
 397	struct icmpv6_msg msg;
 
 
 398	int iif = 0;
 399	int addr_type = 0;
 400	int len;
 401	int hlimit;
 402	int err = 0;
 403
 404	if ((u8 *)hdr < skb->head ||
 405	    (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 406		return;
 407
 408	/*
 409	 *	Make sure we respect the rules
 410	 *	i.e. RFC 1885 2.4(e)
 411	 *	Rule (e.1) is enforced by not using icmp6_send
 412	 *	in any code that processes icmp errors.
 413	 */
 414	addr_type = ipv6_addr_type(&hdr->daddr);
 415
 416	if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 417	    ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 418		saddr = &hdr->daddr;
 419
 420	/*
 421	 *	Dest addr check
 422	 */
 423
 424	if ((addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST)) {
 425		if (type != ICMPV6_PKT_TOOBIG &&
 426		    !(type == ICMPV6_PARAMPROB &&
 427		      code == ICMPV6_UNK_OPTION &&
 428		      (opt_unrec(skb, info))))
 429			return;
 430
 431		saddr = NULL;
 432	}
 433
 434	addr_type = ipv6_addr_type(&hdr->saddr);
 435
 436	/*
 437	 *	Source addr check
 438	 */
 439
 440	if (__ipv6_addr_needs_scope_id(addr_type))
 441		iif = skb->dev->ifindex;
 
 
 
 
 442
 443	/*
 444	 *	Must not send error if the source does not uniquely
 445	 *	identify a single node (RFC2463 Section 2.4).
 446	 *	We check unspecified / multicast addresses here,
 447	 *	and anycast addresses will be checked later.
 448	 */
 449	if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 450		LIMIT_NETDEBUG(KERN_DEBUG "icmp6_send: addr_any/mcast source\n");
 
 451		return;
 452	}
 453
 454	/*
 455	 *	Never answer to a ICMP packet.
 456	 */
 457	if (is_ineligible(skb)) {
 458		LIMIT_NETDEBUG(KERN_DEBUG "icmp6_send: no reply to icmp error\n");
 
 459		return;
 460	}
 461
 
 
 
 
 
 
 
 462	mip6_addr_swap(skb);
 463
 464	memset(&fl6, 0, sizeof(fl6));
 465	fl6.flowi6_proto = IPPROTO_ICMPV6;
 466	fl6.daddr = hdr->saddr;
 
 
 467	if (saddr)
 468		fl6.saddr = *saddr;
 
 469	fl6.flowi6_oif = iif;
 470	fl6.fl6_icmp_type = type;
 471	fl6.fl6_icmp_code = code;
 
 
 472	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 473
 474	sk = icmpv6_xmit_lock(net);
 475	if (sk == NULL)
 476		return;
 
 
 477	np = inet6_sk(sk);
 478
 479	if (!icmpv6_xrlim_allow(sk, type, &fl6))
 480		goto out;
 481
 482	tmp_hdr.icmp6_type = type;
 483	tmp_hdr.icmp6_code = code;
 484	tmp_hdr.icmp6_cksum = 0;
 485	tmp_hdr.icmp6_pointer = htonl(info);
 486
 487	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 488		fl6.flowi6_oif = np->mcast_oif;
 489	else if (!fl6.flowi6_oif)
 490		fl6.flowi6_oif = np->ucast_oif;
 491
 
 
 
 492	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 493	if (IS_ERR(dst))
 494		goto out;
 495
 496	if (ipv6_addr_is_multicast(&fl6.daddr))
 497		hlimit = np->mcast_hops;
 498	else
 499		hlimit = np->hop_limit;
 500	if (hlimit < 0)
 501		hlimit = ip6_dst_hoplimit(dst);
 502
 503	msg.skb = skb;
 504	msg.offset = skb_network_offset(skb);
 505	msg.type = type;
 506
 507	len = skb->len - msg.offset;
 508	len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) -sizeof(struct icmp6hdr));
 509	if (len < 0) {
 510		LIMIT_NETDEBUG(KERN_DEBUG "icmp: len problem\n");
 
 511		goto out_dst_release;
 512	}
 513
 514	rcu_read_lock();
 515	idev = __in6_dev_get(skb->dev);
 516
 517	err = ip6_append_data(sk, icmpv6_getfrag, &msg,
 518			      len + sizeof(struct icmp6hdr),
 519			      sizeof(struct icmp6hdr), hlimit,
 520			      np->tclass, NULL, &fl6, (struct rt6_info *)dst,
 521			      MSG_DONTWAIT, np->dontfrag);
 522	if (err) {
 523		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 524		ip6_flush_pending_frames(sk);
 525	} else {
 526		err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 527						 len + sizeof(struct icmp6hdr));
 528	}
 529	rcu_read_unlock();
 530out_dst_release:
 531	dst_release(dst);
 532out:
 533	icmpv6_xmit_unlock(sk);
 
 
 534}
 535
 536/* Slightly more convenient version of icmp6_send.
 537 */
 538void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 539{
 540	icmp6_send(skb, ICMPV6_PARAMPROB, code, pos);
 541	kfree_skb(skb);
 542}
 543
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 544static void icmpv6_echo_reply(struct sk_buff *skb)
 545{
 546	struct net *net = dev_net(skb->dev);
 547	struct sock *sk;
 548	struct inet6_dev *idev;
 549	struct ipv6_pinfo *np;
 550	const struct in6_addr *saddr = NULL;
 551	struct icmp6hdr *icmph = icmp6_hdr(skb);
 552	struct icmp6hdr tmp_hdr;
 553	struct flowi6 fl6;
 554	struct icmpv6_msg msg;
 555	struct dst_entry *dst;
 556	int err = 0;
 557	int hlimit;
 558	u8 tclass;
 559
 560	saddr = &ipv6_hdr(skb)->daddr;
 561
 562	if (!ipv6_unicast_destination(skb) &&
 563	    !(net->ipv6.sysctl.anycast_src_echo_reply &&
 564	      ipv6_anycast_destination(skb)))
 565		saddr = NULL;
 566
 567	memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 568	tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
 569
 570	memset(&fl6, 0, sizeof(fl6));
 571	fl6.flowi6_proto = IPPROTO_ICMPV6;
 572	fl6.daddr = ipv6_hdr(skb)->saddr;
 573	if (saddr)
 574		fl6.saddr = *saddr;
 575	fl6.flowi6_oif = skb->dev->ifindex;
 576	fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
 
 
 577	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 578
 
 579	sk = icmpv6_xmit_lock(net);
 580	if (sk == NULL)
 581		return;
 
 582	np = inet6_sk(sk);
 583
 584	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 585		fl6.flowi6_oif = np->mcast_oif;
 586	else if (!fl6.flowi6_oif)
 587		fl6.flowi6_oif = np->ucast_oif;
 588
 589	err = ip6_dst_lookup(sk, &dst, &fl6);
 590	if (err)
 591		goto out;
 592	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 593	if (IS_ERR(dst))
 594		goto out;
 595
 596	if (ipv6_addr_is_multicast(&fl6.daddr))
 597		hlimit = np->mcast_hops;
 598	else
 599		hlimit = np->hop_limit;
 600	if (hlimit < 0)
 601		hlimit = ip6_dst_hoplimit(dst);
 602
 603	idev = __in6_dev_get(skb->dev);
 604
 605	msg.skb = skb;
 606	msg.offset = 0;
 607	msg.type = ICMPV6_ECHO_REPLY;
 608
 609	tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 610	err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
 611				sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl6,
 612				(struct rt6_info *)dst, MSG_DONTWAIT,
 613				np->dontfrag);
 614
 615	if (err) {
 616		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
 
 
 
 617		ip6_flush_pending_frames(sk);
 618	} else {
 619		err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 620						 skb->len + sizeof(struct icmp6hdr));
 621	}
 622	dst_release(dst);
 623out:
 624	icmpv6_xmit_unlock(sk);
 
 
 625}
 626
 627void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 628{
 629	const struct inet6_protocol *ipprot;
 630	int inner_offset;
 631	__be16 frag_off;
 632	u8 nexthdr;
 
 633
 634	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 635		return;
 636
 637	nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
 638	if (ipv6_ext_hdr(nexthdr)) {
 639		/* now skip over extension headers */
 640		inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 641						&nexthdr, &frag_off);
 642		if (inner_offset<0)
 643			return;
 644	} else {
 645		inner_offset = sizeof(struct ipv6hdr);
 646	}
 647
 648	/* Checkin header including 8 bytes of inner protocol header. */
 649	if (!pskb_may_pull(skb, inner_offset+8))
 650		return;
 651
 652	/* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
 653	   Without this we will not able f.e. to make source routed
 654	   pmtu discovery.
 655	   Corresponding argument (opt) to notifiers is already added.
 656	   --ANK (980726)
 657	 */
 658
 659	rcu_read_lock();
 660	ipprot = rcu_dereference(inet6_protos[nexthdr]);
 661	if (ipprot && ipprot->err_handler)
 662		ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
 663	rcu_read_unlock();
 664
 665	raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
 
 
 
 
 666}
 667
 668/*
 669 *	Handle icmp messages
 670 */
 671
 672static int icmpv6_rcv(struct sk_buff *skb)
 673{
 674	struct net_device *dev = skb->dev;
 675	struct inet6_dev *idev = __in6_dev_get(dev);
 676	const struct in6_addr *saddr, *daddr;
 677	struct icmp6hdr *hdr;
 678	u8 type;
 
 679
 680	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 681		struct sec_path *sp = skb_sec_path(skb);
 682		int nh;
 683
 684		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
 685				 XFRM_STATE_ICMP))
 686			goto drop_no_count;
 687
 688		if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
 689			goto drop_no_count;
 690
 691		nh = skb_network_offset(skb);
 692		skb_set_network_header(skb, sizeof(*hdr));
 693
 694		if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
 695			goto drop_no_count;
 696
 697		skb_set_network_header(skb, nh);
 698	}
 699
 700	ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INMSGS);
 701
 702	saddr = &ipv6_hdr(skb)->saddr;
 703	daddr = &ipv6_hdr(skb)->daddr;
 704
 705	/* Perform checksum. */
 706	switch (skb->ip_summed) {
 707	case CHECKSUM_COMPLETE:
 708		if (!csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_ICMPV6,
 709				     skb->csum))
 710			break;
 711		/* fall through */
 712	case CHECKSUM_NONE:
 713		skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
 714					     IPPROTO_ICMPV6, 0));
 715		if (__skb_checksum_complete(skb)) {
 716			LIMIT_NETDEBUG(KERN_DEBUG
 717				       "ICMPv6 checksum failed [%pI6c > %pI6c]\n",
 718				       saddr, daddr);
 719			goto csum_error;
 720		}
 721	}
 722
 723	if (!pskb_pull(skb, sizeof(*hdr)))
 724		goto discard_it;
 725
 726	hdr = icmp6_hdr(skb);
 727
 728	type = hdr->icmp6_type;
 729
 730	ICMP6MSGIN_INC_STATS_BH(dev_net(dev), idev, type);
 731
 732	switch (type) {
 733	case ICMPV6_ECHO_REQUEST:
 734		icmpv6_echo_reply(skb);
 735		break;
 736
 737	case ICMPV6_ECHO_REPLY:
 738		ping_rcv(skb);
 739		break;
 740
 741	case ICMPV6_PKT_TOOBIG:
 742		/* BUGGG_FUTURE: if packet contains rthdr, we cannot update
 743		   standard destination cache. Seems, only "advanced"
 744		   destination cache will allow to solve this problem
 745		   --ANK (980726)
 746		 */
 747		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 748			goto discard_it;
 749		hdr = icmp6_hdr(skb);
 750
 751		/*
 752		 *	Drop through to notify
 753		 */
 754
 755	case ICMPV6_DEST_UNREACH:
 756	case ICMPV6_TIME_EXCEED:
 757	case ICMPV6_PARAMPROB:
 758		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 759		break;
 760
 761	case NDISC_ROUTER_SOLICITATION:
 762	case NDISC_ROUTER_ADVERTISEMENT:
 763	case NDISC_NEIGHBOUR_SOLICITATION:
 764	case NDISC_NEIGHBOUR_ADVERTISEMENT:
 765	case NDISC_REDIRECT:
 766		ndisc_rcv(skb);
 767		break;
 768
 769	case ICMPV6_MGM_QUERY:
 770		igmp6_event_query(skb);
 771		break;
 772
 773	case ICMPV6_MGM_REPORT:
 774		igmp6_event_report(skb);
 775		break;
 776
 777	case ICMPV6_MGM_REDUCTION:
 778	case ICMPV6_NI_QUERY:
 779	case ICMPV6_NI_REPLY:
 780	case ICMPV6_MLD2_REPORT:
 781	case ICMPV6_DHAAD_REQUEST:
 782	case ICMPV6_DHAAD_REPLY:
 783	case ICMPV6_MOBILE_PREFIX_SOL:
 784	case ICMPV6_MOBILE_PREFIX_ADV:
 785		break;
 786
 787	default:
 788		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6: msg of unknown type\n");
 789
 790		/* informational */
 791		if (type & ICMPV6_INFOMSG_MASK)
 792			break;
 793
 
 
 
 794		/*
 795		 * error of unknown type.
 796		 * must pass to upper level
 797		 */
 798
 799		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 800	}
 801
 802	kfree_skb(skb);
 
 
 
 
 
 
 
 803	return 0;
 804
 805csum_error:
 806	ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
 807discard_it:
 808	ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INERRORS);
 809drop_no_count:
 810	kfree_skb(skb);
 811	return 0;
 812}
 813
 814void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
 815		      u8 type,
 816		      const struct in6_addr *saddr,
 817		      const struct in6_addr *daddr,
 818		      int oif)
 819{
 820	memset(fl6, 0, sizeof(*fl6));
 821	fl6->saddr = *saddr;
 822	fl6->daddr = *daddr;
 823	fl6->flowi6_proto 	= IPPROTO_ICMPV6;
 824	fl6->fl6_icmp_type	= type;
 825	fl6->fl6_icmp_code	= 0;
 826	fl6->flowi6_oif		= oif;
 827	security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
 828}
 829
 830/*
 831 * Special lock-class for __icmpv6_sk:
 832 */
 833static struct lock_class_key icmpv6_socket_sk_dst_lock_key;
 834
 835static int __net_init icmpv6_sk_init(struct net *net)
 836{
 837	struct sock *sk;
 838	int err, i, j;
 839
 840	net->ipv6.icmp_sk =
 841		kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
 842	if (net->ipv6.icmp_sk == NULL)
 843		return -ENOMEM;
 844
 845	for_each_possible_cpu(i) {
 846		err = inet_ctl_sock_create(&sk, PF_INET6,
 847					   SOCK_RAW, IPPROTO_ICMPV6, net);
 848		if (err < 0) {
 849			pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
 850			       err);
 851			goto fail;
 852		}
 853
 854		net->ipv6.icmp_sk[i] = sk;
 855
 856		/*
 857		 * Split off their lock-class, because sk->sk_dst_lock
 858		 * gets used from softirqs, which is safe for
 859		 * __icmpv6_sk (because those never get directly used
 860		 * via userspace syscalls), but unsafe for normal sockets.
 861		 */
 862		lockdep_set_class(&sk->sk_dst_lock,
 863				  &icmpv6_socket_sk_dst_lock_key);
 864
 865		/* Enough space for 2 64K ICMP packets, including
 866		 * sk_buff struct overhead.
 867		 */
 868		sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
 869	}
 870	return 0;
 871
 872 fail:
 873	for (j = 0; j < i; j++)
 874		inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
 875	kfree(net->ipv6.icmp_sk);
 876	return err;
 877}
 878
 879static void __net_exit icmpv6_sk_exit(struct net *net)
 880{
 881	int i;
 882
 883	for_each_possible_cpu(i) {
 884		inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
 885	}
 886	kfree(net->ipv6.icmp_sk);
 887}
 888
 889static struct pernet_operations icmpv6_sk_ops = {
 890       .init = icmpv6_sk_init,
 891       .exit = icmpv6_sk_exit,
 892};
 893
 894int __init icmpv6_init(void)
 895{
 896	int err;
 897
 898	err = register_pernet_subsys(&icmpv6_sk_ops);
 899	if (err < 0)
 900		return err;
 901
 902	err = -EAGAIN;
 903	if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
 904		goto fail;
 905
 906	err = inet6_register_icmp_sender(icmp6_send);
 907	if (err)
 908		goto sender_reg_err;
 909	return 0;
 910
 911sender_reg_err:
 912	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 913fail:
 914	pr_err("Failed to register ICMP6 protocol\n");
 915	unregister_pernet_subsys(&icmpv6_sk_ops);
 916	return err;
 917}
 918
 919void icmpv6_cleanup(void)
 920{
 921	inet6_unregister_icmp_sender(icmp6_send);
 922	unregister_pernet_subsys(&icmpv6_sk_ops);
 923	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 924}
 925
 926
 927static const struct icmp6_err {
 928	int err;
 929	int fatal;
 930} tab_unreach[] = {
 931	{	/* NOROUTE */
 932		.err	= ENETUNREACH,
 933		.fatal	= 0,
 934	},
 935	{	/* ADM_PROHIBITED */
 936		.err	= EACCES,
 937		.fatal	= 1,
 938	},
 939	{	/* Was NOT_NEIGHBOUR, now reserved */
 940		.err	= EHOSTUNREACH,
 941		.fatal	= 0,
 942	},
 943	{	/* ADDR_UNREACH	*/
 944		.err	= EHOSTUNREACH,
 945		.fatal	= 0,
 946	},
 947	{	/* PORT_UNREACH	*/
 948		.err	= ECONNREFUSED,
 949		.fatal	= 1,
 950	},
 951	{	/* POLICY_FAIL */
 952		.err	= EACCES,
 953		.fatal	= 1,
 954	},
 955	{	/* REJECT_ROUTE	*/
 956		.err	= EACCES,
 957		.fatal	= 1,
 958	},
 959};
 960
 961int icmpv6_err_convert(u8 type, u8 code, int *err)
 962{
 963	int fatal = 0;
 964
 965	*err = EPROTO;
 966
 967	switch (type) {
 968	case ICMPV6_DEST_UNREACH:
 969		fatal = 1;
 970		if (code < ARRAY_SIZE(tab_unreach)) {
 971			*err  = tab_unreach[code].err;
 972			fatal = tab_unreach[code].fatal;
 973		}
 974		break;
 975
 976	case ICMPV6_PKT_TOOBIG:
 977		*err = EMSGSIZE;
 978		break;
 979
 980	case ICMPV6_PARAMPROB:
 981		*err = EPROTO;
 982		fatal = 1;
 983		break;
 984
 985	case ICMPV6_TIME_EXCEED:
 986		*err = EHOSTUNREACH;
 987		break;
 988	}
 989
 990	return fatal;
 991}
 992EXPORT_SYMBOL(icmpv6_err_convert);
 993
 994#ifdef CONFIG_SYSCTL
 995static struct ctl_table ipv6_icmp_table_template[] = {
 996	{
 997		.procname	= "ratelimit",
 998		.data		= &init_net.ipv6.sysctl.icmpv6_time,
 999		.maxlen		= sizeof(int),
1000		.mode		= 0644,
1001		.proc_handler	= proc_dointvec_ms_jiffies,
1002	},
1003	{ },
1004};
1005
1006struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1007{
1008	struct ctl_table *table;
1009
1010	table = kmemdup(ipv6_icmp_table_template,
1011			sizeof(ipv6_icmp_table_template),
1012			GFP_KERNEL);
1013
1014	if (table)
1015		table[0].data = &net->ipv6.sysctl.icmpv6_time;
1016
1017	return table;
1018}
1019#endif
1020
v4.17
   1/*
   2 *	Internet Control Message Protocol (ICMPv6)
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *
   8 *	Based on net/ipv4/icmp.c
   9 *
  10 *	RFC 1885
  11 *
  12 *	This program is free software; you can redistribute it and/or
  13 *      modify it under the terms of the GNU General Public License
  14 *      as published by the Free Software Foundation; either version
  15 *      2 of the License, or (at your option) any later version.
  16 */
  17
  18/*
  19 *	Changes:
  20 *
  21 *	Andi Kleen		:	exception handling
  22 *	Andi Kleen			add rate limits. never reply to a icmp.
  23 *					add more length checks and other fixes.
  24 *	yoshfuji		:	ensure to sent parameter problem for
  25 *					fragments.
  26 *	YOSHIFUJI Hideaki @USAGI:	added sysctl for icmp rate limit.
  27 *	Randy Dunlap and
  28 *	YOSHIFUJI Hideaki @USAGI:	Per-interface statistics support
  29 *	Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  30 */
  31
  32#define pr_fmt(fmt) "IPv6: " fmt
  33
  34#include <linux/module.h>
  35#include <linux/errno.h>
  36#include <linux/types.h>
  37#include <linux/socket.h>
  38#include <linux/in.h>
  39#include <linux/kernel.h>
  40#include <linux/sockios.h>
  41#include <linux/net.h>
  42#include <linux/skbuff.h>
  43#include <linux/init.h>
  44#include <linux/netfilter.h>
  45#include <linux/slab.h>
  46
  47#ifdef CONFIG_SYSCTL
  48#include <linux/sysctl.h>
  49#endif
  50
  51#include <linux/inet.h>
  52#include <linux/netdevice.h>
  53#include <linux/icmpv6.h>
  54
  55#include <net/ip.h>
  56#include <net/sock.h>
  57
  58#include <net/ipv6.h>
  59#include <net/ip6_checksum.h>
  60#include <net/ping.h>
  61#include <net/protocol.h>
  62#include <net/raw.h>
  63#include <net/rawv6.h>
  64#include <net/transp_v6.h>
  65#include <net/ip6_route.h>
  66#include <net/addrconf.h>
  67#include <net/icmp.h>
  68#include <net/xfrm.h>
  69#include <net/inet_common.h>
  70#include <net/dsfield.h>
  71#include <net/l3mdev.h>
  72
  73#include <linux/uaccess.h>
  74
  75/*
  76 *	The ICMP socket(s). This is the most convenient way to flow control
  77 *	our ICMP output as well as maintain a clean interface throughout
  78 *	all layers. All Socketless IP sends will soon be gone.
  79 *
  80 *	On SMP we have one ICMP socket per-cpu.
  81 */
  82static inline struct sock *icmpv6_sk(struct net *net)
  83{
  84	return net->ipv6.icmp_sk[smp_processor_id()];
  85}
  86
  87static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  88		       u8 type, u8 code, int offset, __be32 info)
  89{
  90	/* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  91	struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  92	struct net *net = dev_net(skb->dev);
  93
  94	if (type == ICMPV6_PKT_TOOBIG)
  95		ip6_update_pmtu(skb, net, info, 0, 0, sock_net_uid(net, NULL));
  96	else if (type == NDISC_REDIRECT)
  97		ip6_redirect(skb, net, skb->dev->ifindex, 0,
  98			     sock_net_uid(net, NULL));
  99
 100	if (!(type & ICMPV6_INFOMSG_MASK))
 101		if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
 102			ping_err(skb, offset, ntohl(info));
 103}
 104
 105static int icmpv6_rcv(struct sk_buff *skb);
 106
 107static const struct inet6_protocol icmpv6_protocol = {
 108	.handler	=	icmpv6_rcv,
 109	.err_handler	=	icmpv6_err,
 110	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 111};
 112
 113/* Called with BH disabled */
 114static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
 115{
 116	struct sock *sk;
 117
 
 
 118	sk = icmpv6_sk(net);
 119	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 120		/* This can happen if the output path (f.e. SIT or
 121		 * ip6ip6 tunnel) signals dst_link_failure() for an
 122		 * outgoing ICMP6 packet.
 123		 */
 
 124		return NULL;
 125	}
 126	return sk;
 127}
 128
 129static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 130{
 131	spin_unlock(&sk->sk_lock.slock);
 132}
 133
 134/*
 135 * Figure out, may we reply to this packet with icmp error.
 136 *
 137 * We do not reply, if:
 138 *	- it was icmp error message.
 139 *	- it is truncated, so that it is known, that protocol is ICMPV6
 140 *	  (i.e. in the middle of some exthdr)
 141 *
 142 *	--ANK (980726)
 143 */
 144
 145static bool is_ineligible(const struct sk_buff *skb)
 146{
 147	int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 148	int len = skb->len - ptr;
 149	__u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 150	__be16 frag_off;
 151
 152	if (len < 0)
 153		return true;
 154
 155	ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 156	if (ptr < 0)
 157		return false;
 158	if (nexthdr == IPPROTO_ICMPV6) {
 159		u8 _type, *tp;
 160		tp = skb_header_pointer(skb,
 161			ptr+offsetof(struct icmp6hdr, icmp6_type),
 162			sizeof(_type), &_type);
 163		if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
 
 164			return true;
 165	}
 166	return false;
 167}
 168
 169static bool icmpv6_mask_allow(int type)
 
 
 
 
 170{
 
 
 
 
 171	/* Informational messages are not limited. */
 172	if (type & ICMPV6_INFOMSG_MASK)
 173		return true;
 174
 175	/* Do not limit pmtu discovery, it would break it. */
 176	if (type == ICMPV6_PKT_TOOBIG)
 177		return true;
 178
 179	return false;
 180}
 181
 182static bool icmpv6_global_allow(int type)
 183{
 184	if (icmpv6_mask_allow(type))
 185		return true;
 186
 187	if (icmp_global_allow())
 188		return true;
 189
 190	return false;
 191}
 192
 193/*
 194 * Check the ICMP output rate limit
 195 */
 196static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 197			       struct flowi6 *fl6)
 198{
 199	struct net *net = sock_net(sk);
 200	struct dst_entry *dst;
 201	bool res = false;
 202
 203	if (icmpv6_mask_allow(type))
 204		return true;
 205
 206	/*
 207	 * Look up the output route.
 208	 * XXX: perhaps the expire for routing entries cloned by
 209	 * this lookup should be more aggressive (not longer than timeout).
 210	 */
 211	dst = ip6_route_output(net, sk, fl6);
 212	if (dst->error) {
 213		IP6_INC_STATS(net, ip6_dst_idev(dst),
 214			      IPSTATS_MIB_OUTNOROUTES);
 215	} else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 216		res = true;
 217	} else {
 218		struct rt6_info *rt = (struct rt6_info *)dst;
 219		int tmo = net->ipv6.sysctl.icmpv6_time;
 220		struct inet_peer *peer;
 221
 222		/* Give more bandwidth to wider prefixes. */
 223		if (rt->rt6i_dst.plen < 128)
 224			tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 225
 226		peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1);
 227		res = inet_peer_xrlim_allow(peer, tmo);
 228		if (peer)
 229			inet_putpeer(peer);
 230	}
 231	dst_release(dst);
 232	return res;
 233}
 234
 235/*
 236 *	an inline helper for the "simple" if statement below
 237 *	checks if parameter problem report is caused by an
 238 *	unrecognized IPv6 option that has the Option Type
 239 *	highest-order two bits set to 10
 240 */
 241
 242static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 243{
 244	u8 _optval, *op;
 245
 246	offset += skb_network_offset(skb);
 247	op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 248	if (!op)
 249		return true;
 250	return (*op & 0xC0) == 0x80;
 251}
 252
 253void icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 254				struct icmp6hdr *thdr, int len)
 255{
 256	struct sk_buff *skb;
 257	struct icmp6hdr *icmp6h;
 
 258
 259	skb = skb_peek(&sk->sk_write_queue);
 260	if (!skb)
 261		return;
 262
 263	icmp6h = icmp6_hdr(skb);
 264	memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 265	icmp6h->icmp6_cksum = 0;
 266
 267	if (skb_queue_len(&sk->sk_write_queue) == 1) {
 268		skb->csum = csum_partial(icmp6h,
 269					sizeof(struct icmp6hdr), skb->csum);
 270		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 271						      &fl6->daddr,
 272						      len, fl6->flowi6_proto,
 273						      skb->csum);
 274	} else {
 275		__wsum tmp_csum = 0;
 276
 277		skb_queue_walk(&sk->sk_write_queue, skb) {
 278			tmp_csum = csum_add(tmp_csum, skb->csum);
 279		}
 280
 281		tmp_csum = csum_partial(icmp6h,
 282					sizeof(struct icmp6hdr), tmp_csum);
 283		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 284						      &fl6->daddr,
 285						      len, fl6->flowi6_proto,
 286						      tmp_csum);
 287	}
 288	ip6_push_pending_frames(sk);
 
 
 289}
 290
 291struct icmpv6_msg {
 292	struct sk_buff	*skb;
 293	int		offset;
 294	uint8_t		type;
 295};
 296
 297static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 298{
 299	struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 300	struct sk_buff *org_skb = msg->skb;
 301	__wsum csum = 0;
 302
 303	csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 304				      to, len, csum);
 305	skb->csum = csum_block_add(skb->csum, csum, odd);
 306	if (!(msg->type & ICMPV6_INFOMSG_MASK))
 307		nf_ct_attach(skb, org_skb);
 308	return 0;
 309}
 310
 311#if IS_ENABLED(CONFIG_IPV6_MIP6)
 312static void mip6_addr_swap(struct sk_buff *skb)
 313{
 314	struct ipv6hdr *iph = ipv6_hdr(skb);
 315	struct inet6_skb_parm *opt = IP6CB(skb);
 316	struct ipv6_destopt_hao *hao;
 317	struct in6_addr tmp;
 318	int off;
 319
 320	if (opt->dsthao) {
 321		off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 322		if (likely(off >= 0)) {
 323			hao = (struct ipv6_destopt_hao *)
 324					(skb_network_header(skb) + off);
 325			tmp = iph->saddr;
 326			iph->saddr = hao->addr;
 327			hao->addr = tmp;
 328		}
 329	}
 330}
 331#else
 332static inline void mip6_addr_swap(struct sk_buff *skb) {}
 333#endif
 334
 335static struct dst_entry *icmpv6_route_lookup(struct net *net,
 336					     struct sk_buff *skb,
 337					     struct sock *sk,
 338					     struct flowi6 *fl6)
 339{
 340	struct dst_entry *dst, *dst2;
 341	struct flowi6 fl2;
 342	int err;
 343
 344	err = ip6_dst_lookup(net, sk, &dst, fl6);
 345	if (err)
 346		return ERR_PTR(err);
 347
 348	/*
 349	 * We won't send icmp if the destination is known
 350	 * anycast.
 351	 */
 352	if (ipv6_anycast_destination(dst, &fl6->daddr)) {
 353		net_dbg_ratelimited("icmp6_send: acast source\n");
 354		dst_release(dst);
 355		return ERR_PTR(-EINVAL);
 356	}
 357
 358	/* No need to clone since we're just using its address. */
 359	dst2 = dst;
 360
 361	dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 362	if (!IS_ERR(dst)) {
 363		if (dst != dst2)
 364			return dst;
 365	} else {
 366		if (PTR_ERR(dst) == -EPERM)
 367			dst = NULL;
 368		else
 369			return dst;
 370	}
 371
 372	err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
 373	if (err)
 374		goto relookup_failed;
 375
 376	err = ip6_dst_lookup(net, sk, &dst2, &fl2);
 377	if (err)
 378		goto relookup_failed;
 379
 380	dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 381	if (!IS_ERR(dst2)) {
 382		dst_release(dst);
 383		dst = dst2;
 384	} else {
 385		err = PTR_ERR(dst2);
 386		if (err == -EPERM) {
 387			dst_release(dst);
 388			return dst2;
 389		} else
 390			goto relookup_failed;
 391	}
 392
 393relookup_failed:
 394	if (dst)
 395		return dst;
 396	return ERR_PTR(err);
 397}
 398
 399static int icmp6_iif(const struct sk_buff *skb)
 400{
 401	int iif = skb->dev->ifindex;
 402
 403	/* for local traffic to local address, skb dev is the loopback
 404	 * device. Check if there is a dst attached to the skb and if so
 405	 * get the real device index.
 406	 */
 407	if (unlikely(iif == LOOPBACK_IFINDEX)) {
 408		const struct rt6_info *rt6 = skb_rt6_info(skb);
 409
 410		if (rt6)
 411			iif = rt6->rt6i_idev->dev->ifindex;
 412	}
 413
 414	return iif;
 415}
 416
 417/*
 418 *	Send an ICMP message in response to a packet in error
 419 */
 420static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
 421		       const struct in6_addr *force_saddr)
 422{
 423	struct net *net = dev_net(skb->dev);
 424	struct inet6_dev *idev = NULL;
 425	struct ipv6hdr *hdr = ipv6_hdr(skb);
 426	struct sock *sk;
 427	struct ipv6_pinfo *np;
 428	const struct in6_addr *saddr = NULL;
 429	struct dst_entry *dst;
 430	struct icmp6hdr tmp_hdr;
 431	struct flowi6 fl6;
 432	struct icmpv6_msg msg;
 433	struct sockcm_cookie sockc_unused = {0};
 434	struct ipcm6_cookie ipc6;
 435	int iif = 0;
 436	int addr_type = 0;
 437	int len;
 438	u32 mark = IP6_REPLY_MARK(net, skb->mark);
 
 439
 440	if ((u8 *)hdr < skb->head ||
 441	    (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 442		return;
 443
 444	/*
 445	 *	Make sure we respect the rules
 446	 *	i.e. RFC 1885 2.4(e)
 447	 *	Rule (e.1) is enforced by not using icmp6_send
 448	 *	in any code that processes icmp errors.
 449	 */
 450	addr_type = ipv6_addr_type(&hdr->daddr);
 451
 452	if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 453	    ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 454		saddr = &hdr->daddr;
 455
 456	/*
 457	 *	Dest addr check
 458	 */
 459
 460	if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
 461		if (type != ICMPV6_PKT_TOOBIG &&
 462		    !(type == ICMPV6_PARAMPROB &&
 463		      code == ICMPV6_UNK_OPTION &&
 464		      (opt_unrec(skb, info))))
 465			return;
 466
 467		saddr = NULL;
 468	}
 469
 470	addr_type = ipv6_addr_type(&hdr->saddr);
 471
 472	/*
 473	 *	Source addr check
 474	 */
 475
 476	if (__ipv6_addr_needs_scope_id(addr_type)) {
 477		iif = icmp6_iif(skb);
 478	} else {
 479		dst = skb_dst(skb);
 480		iif = l3mdev_master_ifindex(dst ? dst->dev : skb->dev);
 481	}
 482
 483	/*
 484	 *	Must not send error if the source does not uniquely
 485	 *	identify a single node (RFC2463 Section 2.4).
 486	 *	We check unspecified / multicast addresses here,
 487	 *	and anycast addresses will be checked later.
 488	 */
 489	if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 490		net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
 491				    &hdr->saddr, &hdr->daddr);
 492		return;
 493	}
 494
 495	/*
 496	 *	Never answer to a ICMP packet.
 497	 */
 498	if (is_ineligible(skb)) {
 499		net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
 500				    &hdr->saddr, &hdr->daddr);
 501		return;
 502	}
 503
 504	/* Needed by both icmp_global_allow and icmpv6_xmit_lock */
 505	local_bh_disable();
 506
 507	/* Check global sysctl_icmp_msgs_per_sec ratelimit */
 508	if (!(skb->dev->flags&IFF_LOOPBACK) && !icmpv6_global_allow(type))
 509		goto out_bh_enable;
 510
 511	mip6_addr_swap(skb);
 512
 513	memset(&fl6, 0, sizeof(fl6));
 514	fl6.flowi6_proto = IPPROTO_ICMPV6;
 515	fl6.daddr = hdr->saddr;
 516	if (force_saddr)
 517		saddr = force_saddr;
 518	if (saddr)
 519		fl6.saddr = *saddr;
 520	fl6.flowi6_mark = mark;
 521	fl6.flowi6_oif = iif;
 522	fl6.fl6_icmp_type = type;
 523	fl6.fl6_icmp_code = code;
 524	fl6.flowi6_uid = sock_net_uid(net, NULL);
 525	fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL);
 526	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 527
 528	sk = icmpv6_xmit_lock(net);
 529	if (!sk)
 530		goto out_bh_enable;
 531
 532	sk->sk_mark = mark;
 533	np = inet6_sk(sk);
 534
 535	if (!icmpv6_xrlim_allow(sk, type, &fl6))
 536		goto out;
 537
 538	tmp_hdr.icmp6_type = type;
 539	tmp_hdr.icmp6_code = code;
 540	tmp_hdr.icmp6_cksum = 0;
 541	tmp_hdr.icmp6_pointer = htonl(info);
 542
 543	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 544		fl6.flowi6_oif = np->mcast_oif;
 545	else if (!fl6.flowi6_oif)
 546		fl6.flowi6_oif = np->ucast_oif;
 547
 548	ipc6.tclass = np->tclass;
 549	fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 550
 551	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 552	if (IS_ERR(dst))
 553		goto out;
 554
 555	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 556	ipc6.dontfrag = np->dontfrag;
 557	ipc6.opt = NULL;
 
 
 
 558
 559	msg.skb = skb;
 560	msg.offset = skb_network_offset(skb);
 561	msg.type = type;
 562
 563	len = skb->len - msg.offset;
 564	len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr));
 565	if (len < 0) {
 566		net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
 567				    &hdr->saddr, &hdr->daddr);
 568		goto out_dst_release;
 569	}
 570
 571	rcu_read_lock();
 572	idev = __in6_dev_get(skb->dev);
 573
 574	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
 575			    len + sizeof(struct icmp6hdr),
 576			    sizeof(struct icmp6hdr),
 577			    &ipc6, &fl6, (struct rt6_info *)dst,
 578			    MSG_DONTWAIT, &sockc_unused)) {
 
 579		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 580		ip6_flush_pending_frames(sk);
 581	} else {
 582		icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 583					   len + sizeof(struct icmp6hdr));
 584	}
 585	rcu_read_unlock();
 586out_dst_release:
 587	dst_release(dst);
 588out:
 589	icmpv6_xmit_unlock(sk);
 590out_bh_enable:
 591	local_bh_enable();
 592}
 593
 594/* Slightly more convenient version of icmp6_send.
 595 */
 596void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 597{
 598	icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL);
 599	kfree_skb(skb);
 600}
 601
 602/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
 603 * if sufficient data bytes are available
 604 * @nhs is the size of the tunnel header(s) :
 605 *  Either an IPv4 header for SIT encap
 606 *         an IPv4 header + GRE header for GRE encap
 607 */
 608int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
 609			       unsigned int data_len)
 610{
 611	struct in6_addr temp_saddr;
 612	struct rt6_info *rt;
 613	struct sk_buff *skb2;
 614	u32 info = 0;
 615
 616	if (!pskb_may_pull(skb, nhs + sizeof(struct ipv6hdr) + 8))
 617		return 1;
 618
 619	/* RFC 4884 (partial) support for ICMP extensions */
 620	if (data_len < 128 || (data_len & 7) || skb->len < data_len)
 621		data_len = 0;
 622
 623	skb2 = data_len ? skb_copy(skb, GFP_ATOMIC) : skb_clone(skb, GFP_ATOMIC);
 624
 625	if (!skb2)
 626		return 1;
 627
 628	skb_dst_drop(skb2);
 629	skb_pull(skb2, nhs);
 630	skb_reset_network_header(skb2);
 631
 632	rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0,
 633			skb, 0);
 634
 635	if (rt && rt->dst.dev)
 636		skb2->dev = rt->dst.dev;
 637
 638	ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, &temp_saddr);
 639
 640	if (data_len) {
 641		/* RFC 4884 (partial) support :
 642		 * insert 0 padding at the end, before the extensions
 643		 */
 644		__skb_push(skb2, nhs);
 645		skb_reset_network_header(skb2);
 646		memmove(skb2->data, skb2->data + nhs, data_len - nhs);
 647		memset(skb2->data + data_len - nhs, 0, nhs);
 648		/* RFC 4884 4.5 : Length is measured in 64-bit words,
 649		 * and stored in reserved[0]
 650		 */
 651		info = (data_len/8) << 24;
 652	}
 653	if (type == ICMP_TIME_EXCEEDED)
 654		icmp6_send(skb2, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 655			   info, &temp_saddr);
 656	else
 657		icmp6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH,
 658			   info, &temp_saddr);
 659	if (rt)
 660		ip6_rt_put(rt);
 661
 662	kfree_skb(skb2);
 663
 664	return 0;
 665}
 666EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach);
 667
 668static void icmpv6_echo_reply(struct sk_buff *skb)
 669{
 670	struct net *net = dev_net(skb->dev);
 671	struct sock *sk;
 672	struct inet6_dev *idev;
 673	struct ipv6_pinfo *np;
 674	const struct in6_addr *saddr = NULL;
 675	struct icmp6hdr *icmph = icmp6_hdr(skb);
 676	struct icmp6hdr tmp_hdr;
 677	struct flowi6 fl6;
 678	struct icmpv6_msg msg;
 679	struct dst_entry *dst;
 680	struct ipcm6_cookie ipc6;
 681	u32 mark = IP6_REPLY_MARK(net, skb->mark);
 682	struct sockcm_cookie sockc_unused = {0};
 683
 684	saddr = &ipv6_hdr(skb)->daddr;
 685
 686	if (!ipv6_unicast_destination(skb) &&
 687	    !(net->ipv6.sysctl.anycast_src_echo_reply &&
 688	      ipv6_anycast_destination(skb_dst(skb), saddr)))
 689		saddr = NULL;
 690
 691	memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 692	tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
 693
 694	memset(&fl6, 0, sizeof(fl6));
 695	fl6.flowi6_proto = IPPROTO_ICMPV6;
 696	fl6.daddr = ipv6_hdr(skb)->saddr;
 697	if (saddr)
 698		fl6.saddr = *saddr;
 699	fl6.flowi6_oif = icmp6_iif(skb);
 700	fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
 701	fl6.flowi6_mark = mark;
 702	fl6.flowi6_uid = sock_net_uid(net, NULL);
 703	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 704
 705	local_bh_disable();
 706	sk = icmpv6_xmit_lock(net);
 707	if (!sk)
 708		goto out_bh_enable;
 709	sk->sk_mark = mark;
 710	np = inet6_sk(sk);
 711
 712	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 713		fl6.flowi6_oif = np->mcast_oif;
 714	else if (!fl6.flowi6_oif)
 715		fl6.flowi6_oif = np->ucast_oif;
 716
 717	if (ip6_dst_lookup(net, sk, &dst, &fl6))
 
 718		goto out;
 719	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 720	if (IS_ERR(dst))
 721		goto out;
 722
 
 
 
 
 
 
 
 723	idev = __in6_dev_get(skb->dev);
 724
 725	msg.skb = skb;
 726	msg.offset = 0;
 727	msg.type = ICMPV6_ECHO_REPLY;
 728
 729	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 730	ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 731	ipc6.dontfrag = np->dontfrag;
 732	ipc6.opt = NULL;
 733
 734	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
 735			    skb->len + sizeof(struct icmp6hdr),
 736			    sizeof(struct icmp6hdr), &ipc6, &fl6,
 737			    (struct rt6_info *)dst, MSG_DONTWAIT,
 738			    &sockc_unused)) {
 739		__ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 740		ip6_flush_pending_frames(sk);
 741	} else {
 742		icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 743					   skb->len + sizeof(struct icmp6hdr));
 744	}
 745	dst_release(dst);
 746out:
 747	icmpv6_xmit_unlock(sk);
 748out_bh_enable:
 749	local_bh_enable();
 750}
 751
 752void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 753{
 754	const struct inet6_protocol *ipprot;
 755	int inner_offset;
 756	__be16 frag_off;
 757	u8 nexthdr;
 758	struct net *net = dev_net(skb->dev);
 759
 760	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 761		goto out;
 762
 763	nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
 764	if (ipv6_ext_hdr(nexthdr)) {
 765		/* now skip over extension headers */
 766		inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 767						&nexthdr, &frag_off);
 768		if (inner_offset < 0)
 769			goto out;
 770	} else {
 771		inner_offset = sizeof(struct ipv6hdr);
 772	}
 773
 774	/* Checkin header including 8 bytes of inner protocol header. */
 775	if (!pskb_may_pull(skb, inner_offset+8))
 776		goto out;
 777
 778	/* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
 779	   Without this we will not able f.e. to make source routed
 780	   pmtu discovery.
 781	   Corresponding argument (opt) to notifiers is already added.
 782	   --ANK (980726)
 783	 */
 784
 
 785	ipprot = rcu_dereference(inet6_protos[nexthdr]);
 786	if (ipprot && ipprot->err_handler)
 787		ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
 
 788
 789	raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
 790	return;
 791
 792out:
 793	__ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 794}
 795
 796/*
 797 *	Handle icmp messages
 798 */
 799
 800static int icmpv6_rcv(struct sk_buff *skb)
 801{
 802	struct net_device *dev = skb->dev;
 803	struct inet6_dev *idev = __in6_dev_get(dev);
 804	const struct in6_addr *saddr, *daddr;
 805	struct icmp6hdr *hdr;
 806	u8 type;
 807	bool success = false;
 808
 809	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 810		struct sec_path *sp = skb_sec_path(skb);
 811		int nh;
 812
 813		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
 814				 XFRM_STATE_ICMP))
 815			goto drop_no_count;
 816
 817		if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
 818			goto drop_no_count;
 819
 820		nh = skb_network_offset(skb);
 821		skb_set_network_header(skb, sizeof(*hdr));
 822
 823		if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
 824			goto drop_no_count;
 825
 826		skb_set_network_header(skb, nh);
 827	}
 828
 829	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS);
 830
 831	saddr = &ipv6_hdr(skb)->saddr;
 832	daddr = &ipv6_hdr(skb)->daddr;
 833
 834	if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
 835		net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
 836				    saddr, daddr);
 837		goto csum_error;
 
 
 
 
 
 
 
 
 
 
 
 
 838	}
 839
 840	if (!pskb_pull(skb, sizeof(*hdr)))
 841		goto discard_it;
 842
 843	hdr = icmp6_hdr(skb);
 844
 845	type = hdr->icmp6_type;
 846
 847	ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type);
 848
 849	switch (type) {
 850	case ICMPV6_ECHO_REQUEST:
 851		icmpv6_echo_reply(skb);
 852		break;
 853
 854	case ICMPV6_ECHO_REPLY:
 855		success = ping_rcv(skb);
 856		break;
 857
 858	case ICMPV6_PKT_TOOBIG:
 859		/* BUGGG_FUTURE: if packet contains rthdr, we cannot update
 860		   standard destination cache. Seems, only "advanced"
 861		   destination cache will allow to solve this problem
 862		   --ANK (980726)
 863		 */
 864		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 865			goto discard_it;
 866		hdr = icmp6_hdr(skb);
 867
 868		/* to notify */
 869		/* fall through */
 
 
 870	case ICMPV6_DEST_UNREACH:
 871	case ICMPV6_TIME_EXCEED:
 872	case ICMPV6_PARAMPROB:
 873		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 874		break;
 875
 876	case NDISC_ROUTER_SOLICITATION:
 877	case NDISC_ROUTER_ADVERTISEMENT:
 878	case NDISC_NEIGHBOUR_SOLICITATION:
 879	case NDISC_NEIGHBOUR_ADVERTISEMENT:
 880	case NDISC_REDIRECT:
 881		ndisc_rcv(skb);
 882		break;
 883
 884	case ICMPV6_MGM_QUERY:
 885		igmp6_event_query(skb);
 886		break;
 887
 888	case ICMPV6_MGM_REPORT:
 889		igmp6_event_report(skb);
 890		break;
 891
 892	case ICMPV6_MGM_REDUCTION:
 893	case ICMPV6_NI_QUERY:
 894	case ICMPV6_NI_REPLY:
 895	case ICMPV6_MLD2_REPORT:
 896	case ICMPV6_DHAAD_REQUEST:
 897	case ICMPV6_DHAAD_REPLY:
 898	case ICMPV6_MOBILE_PREFIX_SOL:
 899	case ICMPV6_MOBILE_PREFIX_ADV:
 900		break;
 901
 902	default:
 
 
 903		/* informational */
 904		if (type & ICMPV6_INFOMSG_MASK)
 905			break;
 906
 907		net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
 908				    saddr, daddr);
 909
 910		/*
 911		 * error of unknown type.
 912		 * must pass to upper level
 913		 */
 914
 915		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 916	}
 917
 918	/* until the v6 path can be better sorted assume failure and
 919	 * preserve the status quo behaviour for the rest of the paths to here
 920	 */
 921	if (success)
 922		consume_skb(skb);
 923	else
 924		kfree_skb(skb);
 925
 926	return 0;
 927
 928csum_error:
 929	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
 930discard_it:
 931	__ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS);
 932drop_no_count:
 933	kfree_skb(skb);
 934	return 0;
 935}
 936
 937void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
 938		      u8 type,
 939		      const struct in6_addr *saddr,
 940		      const struct in6_addr *daddr,
 941		      int oif)
 942{
 943	memset(fl6, 0, sizeof(*fl6));
 944	fl6->saddr = *saddr;
 945	fl6->daddr = *daddr;
 946	fl6->flowi6_proto	= IPPROTO_ICMPV6;
 947	fl6->fl6_icmp_type	= type;
 948	fl6->fl6_icmp_code	= 0;
 949	fl6->flowi6_oif		= oif;
 950	security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
 951}
 952
 
 
 
 
 
 953static int __net_init icmpv6_sk_init(struct net *net)
 954{
 955	struct sock *sk;
 956	int err, i, j;
 957
 958	net->ipv6.icmp_sk =
 959		kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
 960	if (!net->ipv6.icmp_sk)
 961		return -ENOMEM;
 962
 963	for_each_possible_cpu(i) {
 964		err = inet_ctl_sock_create(&sk, PF_INET6,
 965					   SOCK_RAW, IPPROTO_ICMPV6, net);
 966		if (err < 0) {
 967			pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
 968			       err);
 969			goto fail;
 970		}
 971
 972		net->ipv6.icmp_sk[i] = sk;
 973
 
 
 
 
 
 
 
 
 
 974		/* Enough space for 2 64K ICMP packets, including
 975		 * sk_buff struct overhead.
 976		 */
 977		sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
 978	}
 979	return 0;
 980
 981 fail:
 982	for (j = 0; j < i; j++)
 983		inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
 984	kfree(net->ipv6.icmp_sk);
 985	return err;
 986}
 987
 988static void __net_exit icmpv6_sk_exit(struct net *net)
 989{
 990	int i;
 991
 992	for_each_possible_cpu(i) {
 993		inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
 994	}
 995	kfree(net->ipv6.icmp_sk);
 996}
 997
 998static struct pernet_operations icmpv6_sk_ops = {
 999	.init = icmpv6_sk_init,
1000	.exit = icmpv6_sk_exit,
1001};
1002
1003int __init icmpv6_init(void)
1004{
1005	int err;
1006
1007	err = register_pernet_subsys(&icmpv6_sk_ops);
1008	if (err < 0)
1009		return err;
1010
1011	err = -EAGAIN;
1012	if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
1013		goto fail;
1014
1015	err = inet6_register_icmp_sender(icmp6_send);
1016	if (err)
1017		goto sender_reg_err;
1018	return 0;
1019
1020sender_reg_err:
1021	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1022fail:
1023	pr_err("Failed to register ICMP6 protocol\n");
1024	unregister_pernet_subsys(&icmpv6_sk_ops);
1025	return err;
1026}
1027
1028void icmpv6_cleanup(void)
1029{
1030	inet6_unregister_icmp_sender(icmp6_send);
1031	unregister_pernet_subsys(&icmpv6_sk_ops);
1032	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1033}
1034
1035
1036static const struct icmp6_err {
1037	int err;
1038	int fatal;
1039} tab_unreach[] = {
1040	{	/* NOROUTE */
1041		.err	= ENETUNREACH,
1042		.fatal	= 0,
1043	},
1044	{	/* ADM_PROHIBITED */
1045		.err	= EACCES,
1046		.fatal	= 1,
1047	},
1048	{	/* Was NOT_NEIGHBOUR, now reserved */
1049		.err	= EHOSTUNREACH,
1050		.fatal	= 0,
1051	},
1052	{	/* ADDR_UNREACH	*/
1053		.err	= EHOSTUNREACH,
1054		.fatal	= 0,
1055	},
1056	{	/* PORT_UNREACH	*/
1057		.err	= ECONNREFUSED,
1058		.fatal	= 1,
1059	},
1060	{	/* POLICY_FAIL */
1061		.err	= EACCES,
1062		.fatal	= 1,
1063	},
1064	{	/* REJECT_ROUTE	*/
1065		.err	= EACCES,
1066		.fatal	= 1,
1067	},
1068};
1069
1070int icmpv6_err_convert(u8 type, u8 code, int *err)
1071{
1072	int fatal = 0;
1073
1074	*err = EPROTO;
1075
1076	switch (type) {
1077	case ICMPV6_DEST_UNREACH:
1078		fatal = 1;
1079		if (code < ARRAY_SIZE(tab_unreach)) {
1080			*err  = tab_unreach[code].err;
1081			fatal = tab_unreach[code].fatal;
1082		}
1083		break;
1084
1085	case ICMPV6_PKT_TOOBIG:
1086		*err = EMSGSIZE;
1087		break;
1088
1089	case ICMPV6_PARAMPROB:
1090		*err = EPROTO;
1091		fatal = 1;
1092		break;
1093
1094	case ICMPV6_TIME_EXCEED:
1095		*err = EHOSTUNREACH;
1096		break;
1097	}
1098
1099	return fatal;
1100}
1101EXPORT_SYMBOL(icmpv6_err_convert);
1102
1103#ifdef CONFIG_SYSCTL
1104static struct ctl_table ipv6_icmp_table_template[] = {
1105	{
1106		.procname	= "ratelimit",
1107		.data		= &init_net.ipv6.sysctl.icmpv6_time,
1108		.maxlen		= sizeof(int),
1109		.mode		= 0644,
1110		.proc_handler	= proc_dointvec_ms_jiffies,
1111	},
1112	{ },
1113};
1114
1115struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1116{
1117	struct ctl_table *table;
1118
1119	table = kmemdup(ipv6_icmp_table_template,
1120			sizeof(ipv6_icmp_table_template),
1121			GFP_KERNEL);
1122
1123	if (table)
1124		table[0].data = &net->ipv6.sysctl.icmpv6_time;
1125
1126	return table;
1127}
1128#endif