1/* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  2 * Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue>
  3 *
  4 * This program is free software; you can redistribute it and/or
  5 * modify it under the terms of version 2 of the GNU General Public
  6 * License as published by the Free Software Foundation.
  7 *
  8 * This program is distributed in the hope that it will be useful, but
  9 * WITHOUT ANY WARRANTY; without even the implied warranty of
 10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 11 * General Public License for more details.
 12 *
 13 * You should have received a copy of the GNU General Public License
 14 * along with this program; if not, see <http://www.gnu.org/licenses/>.
 15 *
 16 *
 17 * Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki.
 18 */
 19
 20#include <linux/skbuff.h>
 21#include <net/ipv6.h>
 22#include <net/mld.h>
 23#include <net/addrconf.h>
 24#include <net/ip6_checksum.h>
 25
 26static int ipv6_mc_check_ip6hdr(struct sk_buff *skb)
 27{
 28	const struct ipv6hdr *ip6h;
 29	unsigned int len;
 30	unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h);
 31
 32	if (!pskb_may_pull(skb, offset))
 33		return -EINVAL;
 34
 35	ip6h = ipv6_hdr(skb);
 36
 37	if (ip6h->version != 6)
 38		return -EINVAL;
 39
 40	len = offset + ntohs(ip6h->payload_len);
 41	if (skb->len < len || len <= offset)
 42		return -EINVAL;
 43
 44	return 0;
 45}
 46
 47static int ipv6_mc_check_exthdrs(struct sk_buff *skb)
 48{
 49	const struct ipv6hdr *ip6h;
 50	int offset;
 51	u8 nexthdr;
 52	__be16 frag_off;
 53
 54	ip6h = ipv6_hdr(skb);
 55
 56	if (ip6h->nexthdr != IPPROTO_HOPOPTS)
 57		return -ENOMSG;
 58
 59	nexthdr = ip6h->nexthdr;
 60	offset = skb_network_offset(skb) + sizeof(*ip6h);
 61	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
 62
 63	if (offset < 0)
 64		return -EINVAL;
 65
 66	if (nexthdr != IPPROTO_ICMPV6)
 67		return -ENOMSG;
 68
 69	skb_set_transport_header(skb, offset);
 70
 71	return 0;
 72}
 73
 74static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb)
 75{
 76	unsigned int len = skb_transport_offset(skb);
 77
 78	len += sizeof(struct mld2_report);
 79
 80	return pskb_may_pull(skb, len) ? 0 : -EINVAL;
 81}
 82
 83static int ipv6_mc_check_mld_query(struct sk_buff *skb)
 84{
 85	struct mld_msg *mld;
 86	unsigned int len = skb_transport_offset(skb);
 87
 88	/* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
 89	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
 90		return -EINVAL;
 91
 92	len += sizeof(struct mld_msg);
 93	if (skb->len < len)
 94		return -EINVAL;
 95
 96	/* MLDv1? */
 97	if (skb->len != len) {
 98		/* or MLDv2? */
 99		len += sizeof(struct mld2_query) - sizeof(struct mld_msg);
100		if (skb->len < len || !pskb_may_pull(skb, len))
101			return -EINVAL;
102	}
103
104	mld = (struct mld_msg *)skb_transport_header(skb);
105
106	/* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
107	 * all-nodes destination address (ff02::1) for general queries
108	 */
109	if (ipv6_addr_any(&mld->mld_mca) &&
110	    !ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
111		return -EINVAL;
112
113	return 0;
114}
115
116static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
117{
118	struct mld_msg *mld = (struct mld_msg *)skb_transport_header(skb);
119
120	switch (mld->mld_type) {
121	case ICMPV6_MGM_REDUCTION:
122	case ICMPV6_MGM_REPORT:
123		/* fall through */
124		return 0;
125	case ICMPV6_MLD2_REPORT:
126		return ipv6_mc_check_mld_reportv2(skb);
127	case ICMPV6_MGM_QUERY:
128		return ipv6_mc_check_mld_query(skb);
129	default:
130		return -ENOMSG;
131	}
132}
133
134static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
135{
136	return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
137}
138
139static int __ipv6_mc_check_mld(struct sk_buff *skb,
140			       struct sk_buff **skb_trimmed)
141
142{
143	struct sk_buff *skb_chk = NULL;
144	unsigned int transport_len;
145	unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg);
146	int ret = -EINVAL;
147
148	transport_len = ntohs(ipv6_hdr(skb)->payload_len);
149	transport_len -= skb_transport_offset(skb) - sizeof(struct ipv6hdr);
150
151	skb_chk = skb_checksum_trimmed(skb, transport_len,
152				       ipv6_mc_validate_checksum);
153	if (!skb_chk)
154		goto err;
155
156	if (!pskb_may_pull(skb_chk, len))
157		goto err;
158
159	ret = ipv6_mc_check_mld_msg(skb_chk);
160	if (ret)
161		goto err;
162
163	if (skb_trimmed)
164		*skb_trimmed = skb_chk;
165	/* free now unneeded clone */
166	else if (skb_chk != skb)
167		kfree_skb(skb_chk);
168
169	ret = 0;
170
171err:
172	if (ret && skb_chk && skb_chk != skb)
173		kfree_skb(skb_chk);
174
175	return ret;
176}
177
178/**
179 * ipv6_mc_check_mld - checks whether this is a sane MLD packet
180 * @skb: the skb to validate
181 * @skb_trimmed: to store an skb pointer trimmed to IPv6 packet tail (optional)
182 *
183 * Checks whether an IPv6 packet is a valid MLD packet. If so sets
184 * skb transport header accordingly and returns zero.
185 *
186 * -EINVAL: A broken packet was detected, i.e. it violates some internet
187 *  standard
188 * -ENOMSG: IP header validation succeeded but it is not an MLD packet.
189 * -ENOMEM: A memory allocation failure happened.
190 *
191 * Optionally, an skb pointer might be provided via skb_trimmed (or set it
192 * to NULL): After parsing an MLD packet successfully it will point to
193 * an skb which has its tail aligned to the IP packet end. This might
194 * either be the originally provided skb or a trimmed, cloned version if
195 * the skb frame had data beyond the IP packet. A cloned skb allows us
196 * to leave the original skb and its full frame unchanged (which might be
197 * desirable for layer 2 frame jugglers).
198 *
199 * Caller needs to set the skb network header and free any returned skb if it
200 * differs from the provided skb.
201 */
202int ipv6_mc_check_mld(struct sk_buff *skb, struct sk_buff **skb_trimmed)
203{
204	int ret;
205
206	ret = ipv6_mc_check_ip6hdr(skb);
207	if (ret < 0)
208		return ret;
209
210	ret = ipv6_mc_check_exthdrs(skb);
211	if (ret < 0)
212		return ret;
213
214	return __ipv6_mc_check_mld(skb, skb_trimmed);
215}
216EXPORT_SYMBOL(ipv6_mc_check_mld);