icmp.c 21.8 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
/*
 *	Internet Control Message Protocol (ICMPv6)
 *	Linux INET6 implementation
 *
 *	Authors:
 *	Pedro Roque		<roque@di.fc.ul.pt>
 *
 *	Based on net/ipv4/icmp.c
 *
 *	RFC 1885
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

/*
 *	Changes:
 *
 *	Andi Kleen		:	exception handling
 *	Andi Kleen			add rate limits. never reply to a icmp.
 *					add more length checks and other fixes.
 *	yoshfuji		:	ensure to sent parameter problem for
 *					fragments.
 *	YOSHIFUJI Hideaki @USAGI:	added sysctl for icmp rate limit.
 *	Randy Dunlap and
 *	YOSHIFUJI Hideaki @USAGI:	Per-interface statistics support
 *	Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
 */

32 33
#define pr_fmt(fmt) "IPv6: " fmt

L
Linus Torvalds 已提交
34 35 36 37 38 39 40 41 42 43
#include <linux/module.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/kernel.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/init.h>
44
#include <linux/netfilter.h>
45
#include <linux/slab.h>
L
Linus Torvalds 已提交
46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
#endif

#include <linux/inet.h>
#include <linux/netdevice.h>
#include <linux/icmpv6.h>

#include <net/ip.h>
#include <net/sock.h>

#include <net/ipv6.h>
#include <net/ip6_checksum.h>
#include <net/protocol.h>
#include <net/raw.h>
#include <net/rawv6.h>
#include <net/transp_v6.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/icmp.h>
67
#include <net/xfrm.h>
68
#include <net/inet_common.h>
L
Linus Torvalds 已提交
69 70 71 72 73 74 75 76 77 78

#include <asm/uaccess.h>

/*
 *	The ICMP socket(s). This is the most convenient way to flow control
 *	our ICMP output as well as maintain a clean interface throughout
 *	all layers. All Socketless IP sends will soon be gone.
 *
 *	On SMP we have one ICMP socket per-cpu.
 */
79 80 81 82
static inline struct sock *icmpv6_sk(struct net *net)
{
	return net->ipv6.icmp_sk[smp_processor_id()];
}
L
Linus Torvalds 已提交
83

84
static int icmpv6_rcv(struct sk_buff *skb);
L
Linus Torvalds 已提交
85

86
static const struct inet6_protocol icmpv6_protocol = {
L
Linus Torvalds 已提交
87
	.handler	=	icmpv6_rcv,
88
	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
L
Linus Torvalds 已提交
89 90
};

91
static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
L
Linus Torvalds 已提交
92
{
93 94
	struct sock *sk;

L
Linus Torvalds 已提交
95 96
	local_bh_disable();

97
	sk = icmpv6_sk(net);
98
	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
L
Linus Torvalds 已提交
99 100 101 102 103
		/* This can happen if the output path (f.e. SIT or
		 * ip6ip6 tunnel) signals dst_link_failure() for an
		 * outgoing ICMP6 packet.
		 */
		local_bh_enable();
104
		return NULL;
L
Linus Torvalds 已提交
105
	}
106
	return sk;
L
Linus Torvalds 已提交
107 108
}

109
static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
L
Linus Torvalds 已提交
110
{
111
	spin_unlock_bh(&sk->sk_lock.slock);
L
Linus Torvalds 已提交
112 113
}

114
/*
L
Linus Torvalds 已提交
115 116
 * Slightly more convenient version of icmpv6_send.
 */
117
void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
L
Linus Torvalds 已提交
118
{
119
	icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos);
L
Linus Torvalds 已提交
120 121 122 123 124 125 126 127 128 129 130 131 132 133
	kfree_skb(skb);
}

/*
 * Figure out, may we reply to this packet with icmp error.
 *
 * We do not reply, if:
 *	- it was icmp error message.
 *	- it is truncated, so that it is known, that protocol is ICMPV6
 *	  (i.e. in the middle of some exthdr)
 *
 *	--ANK (980726)
 */

134
static bool is_ineligible(const struct sk_buff *skb)
L
Linus Torvalds 已提交
135
{
136
	int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
L
Linus Torvalds 已提交
137
	int len = skb->len - ptr;
138
	__u8 nexthdr = ipv6_hdr(skb)->nexthdr;
139
	__be16 frag_off;
L
Linus Torvalds 已提交
140 141

	if (len < 0)
142
		return true;
L
Linus Torvalds 已提交
143

144
	ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
L
Linus Torvalds 已提交
145
	if (ptr < 0)
146
		return false;
L
Linus Torvalds 已提交
147 148 149 150 151 152 153
	if (nexthdr == IPPROTO_ICMPV6) {
		u8 _type, *tp;
		tp = skb_header_pointer(skb,
			ptr+offsetof(struct icmp6hdr, icmp6_type),
			sizeof(_type), &_type);
		if (tp == NULL ||
		    !(*tp & ICMPV6_INFOMSG_MASK))
154
			return true;
L
Linus Torvalds 已提交
155
	}
156
	return false;
L
Linus Torvalds 已提交
157 158
}

159 160
/*
 * Check the ICMP output rate limit
L
Linus Torvalds 已提交
161
 */
162
static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
163
				      struct flowi6 *fl6)
L
Linus Torvalds 已提交
164 165
{
	struct dst_entry *dst;
166
	struct net *net = sock_net(sk);
167
	bool res = false;
L
Linus Torvalds 已提交
168 169 170

	/* Informational messages are not limited. */
	if (type & ICMPV6_INFOMSG_MASK)
171
		return true;
L
Linus Torvalds 已提交
172 173 174

	/* Do not limit pmtu discovery, it would break it. */
	if (type == ICMPV6_PKT_TOOBIG)
175
		return true;
L
Linus Torvalds 已提交
176

177
	/*
L
Linus Torvalds 已提交
178 179 180 181
	 * Look up the output route.
	 * XXX: perhaps the expire for routing entries cloned by
	 * this lookup should be more aggressive (not longer than timeout).
	 */
182
	dst = ip6_route_output(net, sk, fl6);
L
Linus Torvalds 已提交
183
	if (dst->error) {
184
		IP6_INC_STATS(net, ip6_dst_idev(dst),
185
			      IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
186
	} else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
187
		res = true;
L
Linus Torvalds 已提交
188 189
	} else {
		struct rt6_info *rt = (struct rt6_info *)dst;
190
		int tmo = net->ipv6.sysctl.icmpv6_time;
191
		struct inet_peer *peer;
L
Linus Torvalds 已提交
192 193 194 195 196

		/* Give more bandwidth to wider prefixes. */
		if (rt->rt6i_dst.plen < 128)
			tmo >>= ((128 - rt->rt6i_dst.plen)>>5);

197
		peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
198
		res = inet_peer_xrlim_allow(peer, tmo);
199 200
		if (peer)
			inet_putpeer(peer);
L
Linus Torvalds 已提交
201 202 203 204 205 206 207 208
	}
	dst_release(dst);
	return res;
}

/*
 *	an inline helper for the "simple" if statement below
 *	checks if parameter problem report is caused by an
209
 *	unrecognized IPv6 option that has the Option Type
L
Linus Torvalds 已提交
210 211 212
 *	highest-order two bits set to 10
 */

213
static bool opt_unrec(struct sk_buff *skb, __u32 offset)
L
Linus Torvalds 已提交
214 215 216
{
	u8 _optval, *op;

217
	offset += skb_network_offset(skb);
L
Linus Torvalds 已提交
218 219
	op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
	if (op == NULL)
220
		return true;
L
Linus Torvalds 已提交
221 222 223
	return (*op & 0xC0) == 0x80;
}

224
static int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, struct icmp6hdr *thdr, int len)
L
Linus Torvalds 已提交
225 226 227 228 229 230 231 232
{
	struct sk_buff *skb;
	struct icmp6hdr *icmp6h;
	int err = 0;

	if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
		goto out;

233
	icmp6h = icmp6_hdr(skb);
L
Linus Torvalds 已提交
234 235 236 237
	memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
	icmp6h->icmp6_cksum = 0;

	if (skb_queue_len(&sk->sk_write_queue) == 1) {
238
		skb->csum = csum_partial(icmp6h,
L
Linus Torvalds 已提交
239
					sizeof(struct icmp6hdr), skb->csum);
240 241 242
		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
						      &fl6->daddr,
						      len, fl6->flowi6_proto,
L
Linus Torvalds 已提交
243 244
						      skb->csum);
	} else {
245
		__wsum tmp_csum = 0;
L
Linus Torvalds 已提交
246 247 248 249 250

		skb_queue_walk(&sk->sk_write_queue, skb) {
			tmp_csum = csum_add(tmp_csum, skb->csum);
		}

251
		tmp_csum = csum_partial(icmp6h,
L
Linus Torvalds 已提交
252
					sizeof(struct icmp6hdr), tmp_csum);
253 254 255
		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
						      &fl6->daddr,
						      len, fl6->flowi6_proto,
256
						      tmp_csum);
L
Linus Torvalds 已提交
257 258 259 260 261 262 263 264 265
	}
	ip6_push_pending_frames(sk);
out:
	return err;
}

struct icmpv6_msg {
	struct sk_buff	*skb;
	int		offset;
266
	uint8_t		type;
L
Linus Torvalds 已提交
267 268 269 270 271 272
};

static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
{
	struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
	struct sk_buff *org_skb = msg->skb;
273
	__wsum csum = 0;
L
Linus Torvalds 已提交
274 275 276 277

	csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
				      to, len, csum);
	skb->csum = csum_block_add(skb->csum, csum, odd);
278 279
	if (!(msg->type & ICMPV6_INFOMSG_MASK))
		nf_ct_attach(skb, org_skb);
L
Linus Torvalds 已提交
280 281 282
	return 0;
}

283
#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
284 285
static void mip6_addr_swap(struct sk_buff *skb)
{
286
	struct ipv6hdr *iph = ipv6_hdr(skb);
287 288 289 290 291 292 293 294
	struct inet6_skb_parm *opt = IP6CB(skb);
	struct ipv6_destopt_hao *hao;
	struct in6_addr tmp;
	int off;

	if (opt->dsthao) {
		off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
		if (likely(off >= 0)) {
295 296
			hao = (struct ipv6_destopt_hao *)
					(skb_network_header(skb) + off);
A
Alexey Dobriyan 已提交
297 298 299
			tmp = iph->saddr;
			iph->saddr = hao->addr;
			hao->addr = tmp;
300 301 302 303 304 305 306
		}
	}
}
#else
static inline void mip6_addr_swap(struct sk_buff *skb) {}
#endif

307
static struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
308
					     struct sock *sk, struct flowi6 *fl6)
309 310
{
	struct dst_entry *dst, *dst2;
311
	struct flowi6 fl2;
312 313
	int err;

314
	err = ip6_dst_lookup(sk, &dst, fl6);
315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330
	if (err)
		return ERR_PTR(err);

	/*
	 * We won't send icmp if the destination is known
	 * anycast.
	 */
	if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
		dst_release(dst);
		return ERR_PTR(-EINVAL);
	}

	/* No need to clone since we're just using its address. */
	dst2 = dst;

331
	dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
332
	if (!IS_ERR(dst)) {
333 334
		if (dst != dst2)
			return dst;
335 336 337 338 339
	} else {
		if (PTR_ERR(dst) == -EPERM)
			dst = NULL;
		else
			return dst;
340 341
	}

342
	err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
343 344 345 346 347 348 349
	if (err)
		goto relookup_failed;

	err = ip6_dst_lookup(sk, &dst2, &fl2);
	if (err)
		goto relookup_failed;

350
	dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
351
	if (!IS_ERR(dst2)) {
352 353
		dst_release(dst);
		dst = dst2;
354 355 356 357 358 359 360
	} else {
		err = PTR_ERR(dst2);
		if (err == -EPERM) {
			dst_release(dst);
			return dst2;
		} else
			goto relookup_failed;
361 362 363 364 365 366 367 368
	}

relookup_failed:
	if (dst)
		return dst;
	return ERR_PTR(err);
}

L
Linus Torvalds 已提交
369 370 371
/*
 *	Send an ICMP message in response to a packet in error
 */
372
void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
L
Linus Torvalds 已提交
373
{
374
	struct net *net = dev_net(skb->dev);
L
Linus Torvalds 已提交
375
	struct inet6_dev *idev = NULL;
376
	struct ipv6hdr *hdr = ipv6_hdr(skb);
377 378
	struct sock *sk;
	struct ipv6_pinfo *np;
379
	const struct in6_addr *saddr = NULL;
L
Linus Torvalds 已提交
380 381
	struct dst_entry *dst;
	struct icmp6hdr tmp_hdr;
382
	struct flowi6 fl6;
L
Linus Torvalds 已提交
383 384 385 386
	struct icmpv6_msg msg;
	int iif = 0;
	int addr_type = 0;
	int len;
G
Gerrit Renker 已提交
387
	int hlimit;
L
Linus Torvalds 已提交
388 389
	int err = 0;

390 391
	if ((u8 *)hdr < skb->head ||
	    (skb->network_header + sizeof(*hdr)) > skb->tail)
L
Linus Torvalds 已提交
392 393 394
		return;

	/*
395
	 *	Make sure we respect the rules
L
Linus Torvalds 已提交
396 397 398 399 400 401
	 *	i.e. RFC 1885 2.4(e)
	 *	Rule (e.1) is enforced by not using icmpv6_send
	 *	in any code that processes icmp errors.
	 */
	addr_type = ipv6_addr_type(&hdr->daddr);

402
	if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0))
L
Linus Torvalds 已提交
403 404 405 406 407 408 409 410
		saddr = &hdr->daddr;

	/*
	 *	Dest addr check
	 */

	if ((addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST)) {
		if (type != ICMPV6_PKT_TOOBIG &&
411 412
		    !(type == ICMPV6_PARAMPROB &&
		      code == ICMPV6_UNK_OPTION &&
L
Linus Torvalds 已提交
413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428
		      (opt_unrec(skb, info))))
			return;

		saddr = NULL;
	}

	addr_type = ipv6_addr_type(&hdr->saddr);

	/*
	 *	Source addr check
	 */

	if (addr_type & IPV6_ADDR_LINKLOCAL)
		iif = skb->dev->ifindex;

	/*
429 430 431 432
	 *	Must not send error if the source does not uniquely
	 *	identify a single node (RFC2463 Section 2.4).
	 *	We check unspecified / multicast addresses here,
	 *	and anycast addresses will be checked later.
L
Linus Torvalds 已提交
433 434
	 */
	if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
435
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: addr_any/mcast source\n");
L
Linus Torvalds 已提交
436 437 438
		return;
	}

439
	/*
L
Linus Torvalds 已提交
440 441 442
	 *	Never answer to a ICMP packet.
	 */
	if (is_ineligible(skb)) {
443
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: no reply to icmp error\n");
L
Linus Torvalds 已提交
444 445 446
		return;
	}

447 448
	mip6_addr_swap(skb);

449 450
	memset(&fl6, 0, sizeof(fl6));
	fl6.flowi6_proto = IPPROTO_ICMPV6;
A
Alexey Dobriyan 已提交
451
	fl6.daddr = hdr->saddr;
L
Linus Torvalds 已提交
452
	if (saddr)
A
Alexey Dobriyan 已提交
453
		fl6.saddr = *saddr;
454
	fl6.flowi6_oif = iif;
455 456
	fl6.fl6_icmp_type = type;
	fl6.fl6_icmp_code = code;
457
	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
L
Linus Torvalds 已提交
458

459 460
	sk = icmpv6_xmit_lock(net);
	if (sk == NULL)
461
		return;
462
	np = inet6_sk(sk);
463

464
	if (!icmpv6_xrlim_allow(sk, type, &fl6))
L
Linus Torvalds 已提交
465 466 467 468 469 470 471
		goto out;

	tmp_hdr.icmp6_type = type;
	tmp_hdr.icmp6_code = code;
	tmp_hdr.icmp6_cksum = 0;
	tmp_hdr.icmp6_pointer = htonl(info);

472 473
	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
		fl6.flowi6_oif = np->mcast_oif;
474 475
	else if (!fl6.flowi6_oif)
		fl6.flowi6_oif = np->ucast_oif;
L
Linus Torvalds 已提交
476

477
	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
478
	if (IS_ERR(dst))
L
Linus Torvalds 已提交
479
		goto out;
480

481
	if (ipv6_addr_is_multicast(&fl6.daddr))
L
Linus Torvalds 已提交
482 483 484 485
		hlimit = np->mcast_hops;
	else
		hlimit = np->hop_limit;
	if (hlimit < 0)
486
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
487 488

	msg.skb = skb;
489
	msg.offset = skb_network_offset(skb);
490
	msg.type = type;
L
Linus Torvalds 已提交
491 492 493 494

	len = skb->len - msg.offset;
	len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) -sizeof(struct icmp6hdr));
	if (len < 0) {
495
		LIMIT_NETDEBUG(KERN_DEBUG "icmp: len problem\n");
L
Linus Torvalds 已提交
496 497 498
		goto out_dst_release;
	}

E
Eric Dumazet 已提交
499 500
	rcu_read_lock();
	idev = __in6_dev_get(skb->dev);
L
Linus Torvalds 已提交
501 502 503

	err = ip6_append_data(sk, icmpv6_getfrag, &msg,
			      len + sizeof(struct icmp6hdr),
G
Gerrit Renker 已提交
504
			      sizeof(struct icmp6hdr), hlimit,
505
			      np->tclass, NULL, &fl6, (struct rt6_info *)dst,
506
			      MSG_DONTWAIT, np->dontfrag);
L
Linus Torvalds 已提交
507
	if (err) {
E
Eric Dumazet 已提交
508
		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
L
Linus Torvalds 已提交
509
		ip6_flush_pending_frames(sk);
E
Eric Dumazet 已提交
510 511 512
	} else {
		err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
						 len + sizeof(struct icmp6hdr));
L
Linus Torvalds 已提交
513
	}
E
Eric Dumazet 已提交
514
	rcu_read_unlock();
L
Linus Torvalds 已提交
515 516 517
out_dst_release:
	dst_release(dst);
out:
518
	icmpv6_xmit_unlock(sk);
L
Linus Torvalds 已提交
519
}
520 521
EXPORT_SYMBOL(icmpv6_send);

L
Linus Torvalds 已提交
522 523
static void icmpv6_echo_reply(struct sk_buff *skb)
{
524
	struct net *net = dev_net(skb->dev);
525
	struct sock *sk;
L
Linus Torvalds 已提交
526
	struct inet6_dev *idev;
527
	struct ipv6_pinfo *np;
528
	const struct in6_addr *saddr = NULL;
529
	struct icmp6hdr *icmph = icmp6_hdr(skb);
L
Linus Torvalds 已提交
530
	struct icmp6hdr tmp_hdr;
531
	struct flowi6 fl6;
L
Linus Torvalds 已提交
532 533 534 535 536
	struct icmpv6_msg msg;
	struct dst_entry *dst;
	int err = 0;
	int hlimit;

537
	saddr = &ipv6_hdr(skb)->daddr;
L
Linus Torvalds 已提交
538 539 540 541 542 543 544

	if (!ipv6_unicast_destination(skb))
		saddr = NULL;

	memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
	tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;

545 546
	memset(&fl6, 0, sizeof(fl6));
	fl6.flowi6_proto = IPPROTO_ICMPV6;
A
Alexey Dobriyan 已提交
547
	fl6.daddr = ipv6_hdr(skb)->saddr;
L
Linus Torvalds 已提交
548
	if (saddr)
A
Alexey Dobriyan 已提交
549
		fl6.saddr = *saddr;
550
	fl6.flowi6_oif = skb->dev->ifindex;
551
	fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
552
	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
L
Linus Torvalds 已提交
553

554 555
	sk = icmpv6_xmit_lock(net);
	if (sk == NULL)
556
		return;
557
	np = inet6_sk(sk);
558

559 560
	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
		fl6.flowi6_oif = np->mcast_oif;
561 562
	else if (!fl6.flowi6_oif)
		fl6.flowi6_oif = np->ucast_oif;
L
Linus Torvalds 已提交
563

564
	err = ip6_dst_lookup(sk, &dst, &fl6);
L
Linus Torvalds 已提交
565 566
	if (err)
		goto out;
567
	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
568
	if (IS_ERR(dst))
569
		goto out;
L
Linus Torvalds 已提交
570

571
	if (ipv6_addr_is_multicast(&fl6.daddr))
L
Linus Torvalds 已提交
572 573 574 575
		hlimit = np->mcast_hops;
	else
		hlimit = np->hop_limit;
	if (hlimit < 0)
576
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
577

E
Eric Dumazet 已提交
578
	idev = __in6_dev_get(skb->dev);
L
Linus Torvalds 已提交
579 580 581

	msg.skb = skb;
	msg.offset = 0;
582
	msg.type = ICMPV6_ECHO_REPLY;
L
Linus Torvalds 已提交
583 584

	err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
585
				sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl6,
586
				(struct rt6_info *)dst, MSG_DONTWAIT,
587
				np->dontfrag);
L
Linus Torvalds 已提交
588 589

	if (err) {
E
Eric Dumazet 已提交
590
		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
L
Linus Torvalds 已提交
591
		ip6_flush_pending_frames(sk);
E
Eric Dumazet 已提交
592 593 594
	} else {
		err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
						 skb->len + sizeof(struct icmp6hdr));
L
Linus Torvalds 已提交
595 596
	}
	dst_release(dst);
597
out:
598
	icmpv6_xmit_unlock(sk);
L
Linus Torvalds 已提交
599 600
}

601
void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
L
Linus Torvalds 已提交
602
{
603
	const struct inet6_protocol *ipprot;
L
Linus Torvalds 已提交
604
	int inner_offset;
605
	__be16 frag_off;
606
	u8 nexthdr;
L
Linus Torvalds 已提交
607 608 609 610 611 612 613

	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
		return;

	nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
	if (ipv6_ext_hdr(nexthdr)) {
		/* now skip over extension headers */
614 615
		inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
						&nexthdr, &frag_off);
L
Linus Torvalds 已提交
616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633
		if (inner_offset<0)
			return;
	} else {
		inner_offset = sizeof(struct ipv6hdr);
	}

	/* Checkin header including 8 bytes of inner protocol header. */
	if (!pskb_may_pull(skb, inner_offset+8))
		return;

	/* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
	   Without this we will not able f.e. to make source routed
	   pmtu discovery.
	   Corresponding argument (opt) to notifiers is already added.
	   --ANK (980726)
	 */

	rcu_read_lock();
634
	ipprot = rcu_dereference(inet6_protos[nexthdr]);
L
Linus Torvalds 已提交
635 636 637 638
	if (ipprot && ipprot->err_handler)
		ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
	rcu_read_unlock();

639
	raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
L
Linus Torvalds 已提交
640
}
641

L
Linus Torvalds 已提交
642 643 644 645
/*
 *	Handle icmp messages
 */

646
static int icmpv6_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
647 648 649
{
	struct net_device *dev = skb->dev;
	struct inet6_dev *idev = __in6_dev_get(dev);
650
	const struct in6_addr *saddr, *daddr;
L
Linus Torvalds 已提交
651
	struct icmp6hdr *hdr;
652
	u8 type;
L
Linus Torvalds 已提交
653

654
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
655
		struct sec_path *sp = skb_sec_path(skb);
656 657
		int nh;

658
		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
659 660 661
				 XFRM_STATE_ICMP))
			goto drop_no_count;

662
		if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
663 664 665 666 667 668 669 670 671 672 673
			goto drop_no_count;

		nh = skb_network_offset(skb);
		skb_set_network_header(skb, sizeof(*hdr));

		if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
			goto drop_no_count;

		skb_set_network_header(skb, nh);
	}

674
	ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INMSGS);
L
Linus Torvalds 已提交
675

676 677
	saddr = &ipv6_hdr(skb)->saddr;
	daddr = &ipv6_hdr(skb)->daddr;
L
Linus Torvalds 已提交
678 679

	/* Perform checksum. */
680
	switch (skb->ip_summed) {
681
	case CHECKSUM_COMPLETE:
682 683 684 685 686
		if (!csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_ICMPV6,
				     skb->csum))
			break;
		/* fall through */
	case CHECKSUM_NONE:
687 688
		skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
					     IPPROTO_ICMPV6, 0));
689
		if (__skb_checksum_complete(skb)) {
H
Harvey Harrison 已提交
690
			LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [%pI6 > %pI6]\n",
691
				       saddr, daddr);
L
Linus Torvalds 已提交
692 693 694 695
			goto discard_it;
		}
	}

696 697
	if (!pskb_pull(skb, sizeof(*hdr)))
		goto discard_it;
L
Linus Torvalds 已提交
698

699
	hdr = icmp6_hdr(skb);
L
Linus Torvalds 已提交
700 701 702

	type = hdr->icmp6_type;

703
	ICMP6MSGIN_INC_STATS_BH(dev_net(dev), idev, type);
L
Linus Torvalds 已提交
704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721

	switch (type) {
	case ICMPV6_ECHO_REQUEST:
		icmpv6_echo_reply(skb);
		break;

	case ICMPV6_ECHO_REPLY:
		/* we couldn't care less */
		break;

	case ICMPV6_PKT_TOOBIG:
		/* BUGGG_FUTURE: if packet contains rthdr, we cannot update
		   standard destination cache. Seems, only "advanced"
		   destination cache will allow to solve this problem
		   --ANK (980726)
		 */
		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
			goto discard_it;
722
		hdr = icmp6_hdr(skb);
L
Linus Torvalds 已提交
723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760

		/*
		 *	Drop through to notify
		 */

	case ICMPV6_DEST_UNREACH:
	case ICMPV6_TIME_EXCEED:
	case ICMPV6_PARAMPROB:
		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
		break;

	case NDISC_ROUTER_SOLICITATION:
	case NDISC_ROUTER_ADVERTISEMENT:
	case NDISC_NEIGHBOUR_SOLICITATION:
	case NDISC_NEIGHBOUR_ADVERTISEMENT:
	case NDISC_REDIRECT:
		ndisc_rcv(skb);
		break;

	case ICMPV6_MGM_QUERY:
		igmp6_event_query(skb);
		break;

	case ICMPV6_MGM_REPORT:
		igmp6_event_report(skb);
		break;

	case ICMPV6_MGM_REDUCTION:
	case ICMPV6_NI_QUERY:
	case ICMPV6_NI_REPLY:
	case ICMPV6_MLD2_REPORT:
	case ICMPV6_DHAAD_REQUEST:
	case ICMPV6_DHAAD_REPLY:
	case ICMPV6_MOBILE_PREFIX_SOL:
	case ICMPV6_MOBILE_PREFIX_ADV:
		break;

	default:
761
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6: msg of unknown type\n");
L
Linus Torvalds 已提交
762 763 764 765 766

		/* informational */
		if (type & ICMPV6_INFOMSG_MASK)
			break;

767 768 769
		/*
		 * error of unknown type.
		 * must pass to upper level
L
Linus Torvalds 已提交
770 771 772
		 */

		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
773 774
	}

L
Linus Torvalds 已提交
775 776 777 778
	kfree_skb(skb);
	return 0;

discard_it:
779
	ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INERRORS);
780
drop_no_count:
L
Linus Torvalds 已提交
781 782 783 784
	kfree_skb(skb);
	return 0;
}

785
void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
786 787 788 789 790
		      u8 type,
		      const struct in6_addr *saddr,
		      const struct in6_addr *daddr,
		      int oif)
{
791
	memset(fl6, 0, sizeof(*fl6));
A
Alexey Dobriyan 已提交
792 793
	fl6->saddr = *saddr;
	fl6->daddr = *daddr;
794
	fl6->flowi6_proto 	= IPPROTO_ICMPV6;
795 796
	fl6->fl6_icmp_type	= type;
	fl6->fl6_icmp_code	= 0;
797 798
	fl6->flowi6_oif		= oif;
	security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
799 800
}

801
/*
802
 * Special lock-class for __icmpv6_sk:
803 804 805
 */
static struct lock_class_key icmpv6_socket_sk_dst_lock_key;

806
static int __net_init icmpv6_sk_init(struct net *net)
L
Linus Torvalds 已提交
807 808 809 810
{
	struct sock *sk;
	int err, i, j;

811 812 813
	net->ipv6.icmp_sk =
		kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
	if (net->ipv6.icmp_sk == NULL)
814 815
		return -ENOMEM;

816
	for_each_possible_cpu(i) {
817 818
		err = inet_ctl_sock_create(&sk, PF_INET6,
					   SOCK_RAW, IPPROTO_ICMPV6, net);
L
Linus Torvalds 已提交
819
		if (err < 0) {
820
			pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
L
Linus Torvalds 已提交
821 822 823 824
			       err);
			goto fail;
		}

825
		net->ipv6.icmp_sk[i] = sk;
826

827 828 829
		/*
		 * Split off their lock-class, because sk->sk_dst_lock
		 * gets used from softirqs, which is safe for
830
		 * __icmpv6_sk (because those never get directly used
831 832 833 834
		 * via userspace syscalls), but unsafe for normal sockets.
		 */
		lockdep_set_class(&sk->sk_dst_lock,
				  &icmpv6_socket_sk_dst_lock_key);
L
Linus Torvalds 已提交
835 836 837 838

		/* Enough space for 2 64K ICMP packets, including
		 * sk_buff struct overhead.
		 */
E
Eric Dumazet 已提交
839
		sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
L
Linus Torvalds 已提交
840 841 842 843
	}
	return 0;

 fail:
844
	for (j = 0; j < i; j++)
845
		inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
846
	kfree(net->ipv6.icmp_sk);
L
Linus Torvalds 已提交
847 848 849
	return err;
}

850
static void __net_exit icmpv6_sk_exit(struct net *net)
L
Linus Torvalds 已提交
851 852 853
{
	int i;

854
	for_each_possible_cpu(i) {
855
		inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
L
Linus Torvalds 已提交
856
	}
857 858 859
	kfree(net->ipv6.icmp_sk);
}

860
static struct pernet_operations icmpv6_sk_ops = {
861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878
       .init = icmpv6_sk_init,
       .exit = icmpv6_sk_exit,
};

int __init icmpv6_init(void)
{
	int err;

	err = register_pernet_subsys(&icmpv6_sk_ops);
	if (err < 0)
		return err;

	err = -EAGAIN;
	if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
		goto fail;
	return 0;

fail:
879
	pr_err("Failed to register ICMP6 protocol\n");
880 881 882 883
	unregister_pernet_subsys(&icmpv6_sk_ops);
	return err;
}

884
void icmpv6_cleanup(void)
885 886
{
	unregister_pernet_subsys(&icmpv6_sk_ops);
L
Linus Torvalds 已提交
887 888 889
	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
}

890

891
static const struct icmp6_err {
L
Linus Torvalds 已提交
892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916
	int err;
	int fatal;
} tab_unreach[] = {
	{	/* NOROUTE */
		.err	= ENETUNREACH,
		.fatal	= 0,
	},
	{	/* ADM_PROHIBITED */
		.err	= EACCES,
		.fatal	= 1,
	},
	{	/* Was NOT_NEIGHBOUR, now reserved */
		.err	= EHOSTUNREACH,
		.fatal	= 0,
	},
	{	/* ADDR_UNREACH	*/
		.err	= EHOSTUNREACH,
		.fatal	= 0,
	},
	{	/* PORT_UNREACH	*/
		.err	= ECONNREFUSED,
		.fatal	= 1,
	},
};

917
int icmpv6_err_convert(u8 type, u8 code, int *err)
L
Linus Torvalds 已提交
918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934
{
	int fatal = 0;

	*err = EPROTO;

	switch (type) {
	case ICMPV6_DEST_UNREACH:
		fatal = 1;
		if (code <= ICMPV6_PORT_UNREACH) {
			*err  = tab_unreach[code].err;
			fatal = tab_unreach[code].fatal;
		}
		break;

	case ICMPV6_PKT_TOOBIG:
		*err = EMSGSIZE;
		break;
935

L
Linus Torvalds 已提交
936 937 938 939 940 941 942 943
	case ICMPV6_PARAMPROB:
		*err = EPROTO;
		fatal = 1;
		break;

	case ICMPV6_TIME_EXCEED:
		*err = EHOSTUNREACH;
		break;
944
	}
L
Linus Torvalds 已提交
945 946 947

	return fatal;
}
948 949
EXPORT_SYMBOL(icmpv6_err_convert);

L
Linus Torvalds 已提交
950
#ifdef CONFIG_SYSCTL
951
ctl_table ipv6_icmp_table_template[] = {
L
Linus Torvalds 已提交
952 953
	{
		.procname	= "ratelimit",
954
		.data		= &init_net.ipv6.sysctl.icmpv6_time,
L
Linus Torvalds 已提交
955 956
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
957
		.proc_handler	= proc_dointvec_ms_jiffies,
L
Linus Torvalds 已提交
958
	},
959
	{ },
L
Linus Torvalds 已提交
960
};
961

962
struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
963 964 965 966 967 968
{
	struct ctl_table *table;

	table = kmemdup(ipv6_icmp_table_template,
			sizeof(ipv6_icmp_table_template),
			GFP_KERNEL);
969 970 971 972

	if (table)
		table[0].data = &net->ipv6.sysctl.icmpv6_time;

973 974
	return table;
}
L
Linus Torvalds 已提交
975 976
#endif