icmp.c 22.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41
/*
 *	Internet Control Message Protocol (ICMPv6)
 *	Linux INET6 implementation
 *
 *	Authors:
 *	Pedro Roque		<roque@di.fc.ul.pt>
 *
 *	Based on net/ipv4/icmp.c
 *
 *	RFC 1885
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 */

/*
 *	Changes:
 *
 *	Andi Kleen		:	exception handling
 *	Andi Kleen			add rate limits. never reply to a icmp.
 *					add more length checks and other fixes.
 *	yoshfuji		:	ensure to sent parameter problem for
 *					fragments.
 *	YOSHIFUJI Hideaki @USAGI:	added sysctl for icmp rate limit.
 *	Randy Dunlap and
 *	YOSHIFUJI Hideaki @USAGI:	Per-interface statistics support
 *	Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
 */

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/in.h>
#include <linux/kernel.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/skbuff.h>
#include <linux/init.h>
42
#include <linux/netfilter.h>
43
#include <linux/slab.h>
L
Linus Torvalds 已提交
44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64

#ifdef CONFIG_SYSCTL
#include <linux/sysctl.h>
#endif

#include <linux/inet.h>
#include <linux/netdevice.h>
#include <linux/icmpv6.h>

#include <net/ip.h>
#include <net/sock.h>

#include <net/ipv6.h>
#include <net/ip6_checksum.h>
#include <net/protocol.h>
#include <net/raw.h>
#include <net/rawv6.h>
#include <net/transp_v6.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/icmp.h>
65
#include <net/xfrm.h>
66
#include <net/inet_common.h>
L
Linus Torvalds 已提交
67 68 69 70 71 72 73 74 75 76 77

#include <asm/uaccess.h>
#include <asm/system.h>

/*
 *	The ICMP socket(s). This is the most convenient way to flow control
 *	our ICMP output as well as maintain a clean interface throughout
 *	all layers. All Socketless IP sends will soon be gone.
 *
 *	On SMP we have one ICMP socket per-cpu.
 */
78 79 80 81
static inline struct sock *icmpv6_sk(struct net *net)
{
	return net->ipv6.icmp_sk[smp_processor_id()];
}
L
Linus Torvalds 已提交
82

83
static int icmpv6_rcv(struct sk_buff *skb);
L
Linus Torvalds 已提交
84

85
static const struct inet6_protocol icmpv6_protocol = {
L
Linus Torvalds 已提交
86
	.handler	=	icmpv6_rcv,
87
	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
L
Linus Torvalds 已提交
88 89
};

90
static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
L
Linus Torvalds 已提交
91
{
92 93
	struct sock *sk;

L
Linus Torvalds 已提交
94 95
	local_bh_disable();

96
	sk = icmpv6_sk(net);
97
	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
L
Linus Torvalds 已提交
98 99 100 101 102
		/* This can happen if the output path (f.e. SIT or
		 * ip6ip6 tunnel) signals dst_link_failure() for an
		 * outgoing ICMP6 packet.
		 */
		local_bh_enable();
103
		return NULL;
L
Linus Torvalds 已提交
104
	}
105
	return sk;
L
Linus Torvalds 已提交
106 107
}

108
static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
L
Linus Torvalds 已提交
109
{
110
	spin_unlock_bh(&sk->sk_lock.slock);
L
Linus Torvalds 已提交
111 112
}

113
/*
L
Linus Torvalds 已提交
114 115
 * Slightly more convenient version of icmpv6_send.
 */
116
void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
L
Linus Torvalds 已提交
117
{
118
	icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos);
L
Linus Torvalds 已提交
119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134
	kfree_skb(skb);
}

/*
 * Figure out, may we reply to this packet with icmp error.
 *
 * We do not reply, if:
 *	- it was icmp error message.
 *	- it is truncated, so that it is known, that protocol is ICMPV6
 *	  (i.e. in the middle of some exthdr)
 *
 *	--ANK (980726)
 */

static int is_ineligible(struct sk_buff *skb)
{
135
	int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
L
Linus Torvalds 已提交
136
	int len = skb->len - ptr;
137
	__u8 nexthdr = ipv6_hdr(skb)->nexthdr;
L
Linus Torvalds 已提交
138 139 140 141

	if (len < 0)
		return 1;

142
	ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr);
L
Linus Torvalds 已提交
143 144 145 146 147 148 149 150 151 152 153 154 155 156
	if (ptr < 0)
		return 0;
	if (nexthdr == IPPROTO_ICMPV6) {
		u8 _type, *tp;
		tp = skb_header_pointer(skb,
			ptr+offsetof(struct icmp6hdr, icmp6_type),
			sizeof(_type), &_type);
		if (tp == NULL ||
		    !(*tp & ICMPV6_INFOMSG_MASK))
			return 1;
	}
	return 0;
}

157 158
/*
 * Check the ICMP output rate limit
L
Linus Torvalds 已提交
159
 */
160
static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
161
				      struct flowi6 *fl6)
L
Linus Torvalds 已提交
162 163
{
	struct dst_entry *dst;
164
	struct net *net = sock_net(sk);
165
	bool res = false;
L
Linus Torvalds 已提交
166 167 168

	/* Informational messages are not limited. */
	if (type & ICMPV6_INFOMSG_MASK)
169
		return true;
L
Linus Torvalds 已提交
170 171 172

	/* Do not limit pmtu discovery, it would break it. */
	if (type == ICMPV6_PKT_TOOBIG)
173
		return true;
L
Linus Torvalds 已提交
174

175
	/*
L
Linus Torvalds 已提交
176 177 178 179
	 * Look up the output route.
	 * XXX: perhaps the expire for routing entries cloned by
	 * this lookup should be more aggressive (not longer than timeout).
	 */
180
	dst = ip6_route_output(net, sk, fl6);
L
Linus Torvalds 已提交
181
	if (dst->error) {
182
		IP6_INC_STATS(net, ip6_dst_idev(dst),
183
			      IPSTATS_MIB_OUTNOROUTES);
L
Linus Torvalds 已提交
184
	} else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
185
		res = true;
L
Linus Torvalds 已提交
186 187
	} else {
		struct rt6_info *rt = (struct rt6_info *)dst;
188
		int tmo = net->ipv6.sysctl.icmpv6_time;
L
Linus Torvalds 已提交
189 190 191 192 193

		/* Give more bandwidth to wider prefixes. */
		if (rt->rt6i_dst.plen < 128)
			tmo >>= ((128 - rt->rt6i_dst.plen)>>5);

194 195 196
		if (!rt->rt6i_peer)
			rt6_bind_peer(rt, 1);
		res = inet_peer_xrlim_allow(rt->rt6i_peer, tmo);
L
Linus Torvalds 已提交
197 198 199 200 201 202 203 204
	}
	dst_release(dst);
	return res;
}

/*
 *	an inline helper for the "simple" if statement below
 *	checks if parameter problem report is caused by an
205
 *	unrecognized IPv6 option that has the Option Type
L
Linus Torvalds 已提交
206 207 208 209 210 211 212
 *	highest-order two bits set to 10
 */

static __inline__ int opt_unrec(struct sk_buff *skb, __u32 offset)
{
	u8 _optval, *op;

213
	offset += skb_network_offset(skb);
L
Linus Torvalds 已提交
214 215 216 217 218 219
	op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
	if (op == NULL)
		return 1;
	return (*op & 0xC0) == 0x80;
}

220
static int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, struct icmp6hdr *thdr, int len)
L
Linus Torvalds 已提交
221 222 223 224 225 226 227 228
{
	struct sk_buff *skb;
	struct icmp6hdr *icmp6h;
	int err = 0;

	if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
		goto out;

229
	icmp6h = icmp6_hdr(skb);
L
Linus Torvalds 已提交
230 231 232 233
	memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
	icmp6h->icmp6_cksum = 0;

	if (skb_queue_len(&sk->sk_write_queue) == 1) {
234
		skb->csum = csum_partial(icmp6h,
L
Linus Torvalds 已提交
235
					sizeof(struct icmp6hdr), skb->csum);
236 237 238
		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
						      &fl6->daddr,
						      len, fl6->flowi6_proto,
L
Linus Torvalds 已提交
239 240
						      skb->csum);
	} else {
241
		__wsum tmp_csum = 0;
L
Linus Torvalds 已提交
242 243 244 245 246

		skb_queue_walk(&sk->sk_write_queue, skb) {
			tmp_csum = csum_add(tmp_csum, skb->csum);
		}

247
		tmp_csum = csum_partial(icmp6h,
L
Linus Torvalds 已提交
248
					sizeof(struct icmp6hdr), tmp_csum);
249 250 251
		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
						      &fl6->daddr,
						      len, fl6->flowi6_proto,
252
						      tmp_csum);
L
Linus Torvalds 已提交
253 254 255 256 257 258 259 260 261
	}
	ip6_push_pending_frames(sk);
out:
	return err;
}

struct icmpv6_msg {
	struct sk_buff	*skb;
	int		offset;
262
	uint8_t		type;
L
Linus Torvalds 已提交
263 264 265 266 267 268
};

static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
{
	struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
	struct sk_buff *org_skb = msg->skb;
269
	__wsum csum = 0;
L
Linus Torvalds 已提交
270 271 272 273

	csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
				      to, len, csum);
	skb->csum = csum_block_add(skb->csum, csum, odd);
274 275
	if (!(msg->type & ICMPV6_INFOMSG_MASK))
		nf_ct_attach(skb, org_skb);
L
Linus Torvalds 已提交
276 277 278
	return 0;
}

279
#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
280 281
static void mip6_addr_swap(struct sk_buff *skb)
{
282
	struct ipv6hdr *iph = ipv6_hdr(skb);
283 284 285 286 287 288 289 290
	struct inet6_skb_parm *opt = IP6CB(skb);
	struct ipv6_destopt_hao *hao;
	struct in6_addr tmp;
	int off;

	if (opt->dsthao) {
		off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
		if (likely(off >= 0)) {
291 292
			hao = (struct ipv6_destopt_hao *)
					(skb_network_header(skb) + off);
293 294 295 296 297 298 299 300 301 302
			ipv6_addr_copy(&tmp, &iph->saddr);
			ipv6_addr_copy(&iph->saddr, &hao->addr);
			ipv6_addr_copy(&hao->addr, &tmp);
		}
	}
}
#else
static inline void mip6_addr_swap(struct sk_buff *skb) {}
#endif

303
static struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
304
					     struct sock *sk, struct flowi6 *fl6)
305 306
{
	struct dst_entry *dst, *dst2;
307
	struct flowi6 fl2;
308 309
	int err;

310
	err = ip6_dst_lookup(sk, &dst, fl6);
311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326
	if (err)
		return ERR_PTR(err);

	/*
	 * We won't send icmp if the destination is known
	 * anycast.
	 */
	if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
		dst_release(dst);
		return ERR_PTR(-EINVAL);
	}

	/* No need to clone since we're just using its address. */
	dst2 = dst;

327
	dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
328
	if (!IS_ERR(dst)) {
329 330
		if (dst != dst2)
			return dst;
331 332 333 334 335
	} else {
		if (PTR_ERR(dst) == -EPERM)
			dst = NULL;
		else
			return dst;
336 337
	}

338
	err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
339 340 341 342 343 344 345
	if (err)
		goto relookup_failed;

	err = ip6_dst_lookup(sk, &dst2, &fl2);
	if (err)
		goto relookup_failed;

346
	dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
347
	if (!IS_ERR(dst2)) {
348 349
		dst_release(dst);
		dst = dst2;
350 351 352 353 354 355 356
	} else {
		err = PTR_ERR(dst2);
		if (err == -EPERM) {
			dst_release(dst);
			return dst2;
		} else
			goto relookup_failed;
357 358 359 360 361 362 363 364
	}

relookup_failed:
	if (dst)
		return dst;
	return ERR_PTR(err);
}

L
Linus Torvalds 已提交
365 366 367
/*
 *	Send an ICMP message in response to a packet in error
 */
368
void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
L
Linus Torvalds 已提交
369
{
370
	struct net *net = dev_net(skb->dev);
L
Linus Torvalds 已提交
371
	struct inet6_dev *idev = NULL;
372
	struct ipv6hdr *hdr = ipv6_hdr(skb);
373 374
	struct sock *sk;
	struct ipv6_pinfo *np;
L
Linus Torvalds 已提交
375 376 377
	struct in6_addr *saddr = NULL;
	struct dst_entry *dst;
	struct icmp6hdr tmp_hdr;
378
	struct flowi6 fl6;
L
Linus Torvalds 已提交
379 380 381 382
	struct icmpv6_msg msg;
	int iif = 0;
	int addr_type = 0;
	int len;
G
Gerrit Renker 已提交
383
	int hlimit;
L
Linus Torvalds 已提交
384 385
	int err = 0;

386 387
	if ((u8 *)hdr < skb->head ||
	    (skb->network_header + sizeof(*hdr)) > skb->tail)
L
Linus Torvalds 已提交
388 389 390
		return;

	/*
391
	 *	Make sure we respect the rules
L
Linus Torvalds 已提交
392 393 394 395 396 397
	 *	i.e. RFC 1885 2.4(e)
	 *	Rule (e.1) is enforced by not using icmpv6_send
	 *	in any code that processes icmp errors.
	 */
	addr_type = ipv6_addr_type(&hdr->daddr);

398
	if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0))
L
Linus Torvalds 已提交
399 400 401 402 403 404 405 406
		saddr = &hdr->daddr;

	/*
	 *	Dest addr check
	 */

	if ((addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST)) {
		if (type != ICMPV6_PKT_TOOBIG &&
407 408
		    !(type == ICMPV6_PARAMPROB &&
		      code == ICMPV6_UNK_OPTION &&
L
Linus Torvalds 已提交
409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424
		      (opt_unrec(skb, info))))
			return;

		saddr = NULL;
	}

	addr_type = ipv6_addr_type(&hdr->saddr);

	/*
	 *	Source addr check
	 */

	if (addr_type & IPV6_ADDR_LINKLOCAL)
		iif = skb->dev->ifindex;

	/*
425 426 427 428
	 *	Must not send error if the source does not uniquely
	 *	identify a single node (RFC2463 Section 2.4).
	 *	We check unspecified / multicast addresses here,
	 *	and anycast addresses will be checked later.
L
Linus Torvalds 已提交
429 430
	 */
	if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
431
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: addr_any/mcast source\n");
L
Linus Torvalds 已提交
432 433 434
		return;
	}

435
	/*
L
Linus Torvalds 已提交
436 437 438
	 *	Never answer to a ICMP packet.
	 */
	if (is_ineligible(skb)) {
439
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: no reply to icmp error\n");
L
Linus Torvalds 已提交
440 441 442
		return;
	}

443 444
	mip6_addr_swap(skb);

445 446 447
	memset(&fl6, 0, sizeof(fl6));
	fl6.flowi6_proto = IPPROTO_ICMPV6;
	ipv6_addr_copy(&fl6.daddr, &hdr->saddr);
L
Linus Torvalds 已提交
448
	if (saddr)
449 450
		ipv6_addr_copy(&fl6.saddr, saddr);
	fl6.flowi6_oif = iif;
451 452
	fl6.fl6_icmp_type = type;
	fl6.fl6_icmp_code = code;
453
	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
L
Linus Torvalds 已提交
454

455 456
	sk = icmpv6_xmit_lock(net);
	if (sk == NULL)
457
		return;
458
	np = inet6_sk(sk);
459

460
	if (!icmpv6_xrlim_allow(sk, type, &fl6))
L
Linus Torvalds 已提交
461 462 463 464 465 466 467
		goto out;

	tmp_hdr.icmp6_type = type;
	tmp_hdr.icmp6_code = code;
	tmp_hdr.icmp6_cksum = 0;
	tmp_hdr.icmp6_pointer = htonl(info);

468 469
	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
		fl6.flowi6_oif = np->mcast_oif;
L
Linus Torvalds 已提交
470

471
	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
472
	if (IS_ERR(dst))
L
Linus Torvalds 已提交
473
		goto out;
474

475
	if (ipv6_addr_is_multicast(&fl6.daddr))
L
Linus Torvalds 已提交
476 477 478 479
		hlimit = np->mcast_hops;
	else
		hlimit = np->hop_limit;
	if (hlimit < 0)
480
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
481 482

	msg.skb = skb;
483
	msg.offset = skb_network_offset(skb);
484
	msg.type = type;
L
Linus Torvalds 已提交
485 486 487 488

	len = skb->len - msg.offset;
	len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) -sizeof(struct icmp6hdr));
	if (len < 0) {
489
		LIMIT_NETDEBUG(KERN_DEBUG "icmp: len problem\n");
L
Linus Torvalds 已提交
490 491 492 493 494 495 496
		goto out_dst_release;
	}

	idev = in6_dev_get(skb->dev);

	err = ip6_append_data(sk, icmpv6_getfrag, &msg,
			      len + sizeof(struct icmp6hdr),
G
Gerrit Renker 已提交
497
			      sizeof(struct icmp6hdr), hlimit,
498
			      np->tclass, NULL, &fl6, (struct rt6_info*)dst,
499
			      MSG_DONTWAIT, np->dontfrag);
L
Linus Torvalds 已提交
500
	if (err) {
E
Eric Dumazet 已提交
501
		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
L
Linus Torvalds 已提交
502 503 504
		ip6_flush_pending_frames(sk);
		goto out_put;
	}
505
	err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, len + sizeof(struct icmp6hdr));
L
Linus Torvalds 已提交
506 507 508 509 510 511 512

out_put:
	if (likely(idev != NULL))
		in6_dev_put(idev);
out_dst_release:
	dst_release(dst);
out:
513
	icmpv6_xmit_unlock(sk);
L
Linus Torvalds 已提交
514 515
}

516 517
EXPORT_SYMBOL(icmpv6_send);

L
Linus Torvalds 已提交
518 519
static void icmpv6_echo_reply(struct sk_buff *skb)
{
520
	struct net *net = dev_net(skb->dev);
521
	struct sock *sk;
L
Linus Torvalds 已提交
522
	struct inet6_dev *idev;
523
	struct ipv6_pinfo *np;
L
Linus Torvalds 已提交
524
	struct in6_addr *saddr = NULL;
525
	struct icmp6hdr *icmph = icmp6_hdr(skb);
L
Linus Torvalds 已提交
526
	struct icmp6hdr tmp_hdr;
527
	struct flowi6 fl6;
L
Linus Torvalds 已提交
528 529 530 531 532
	struct icmpv6_msg msg;
	struct dst_entry *dst;
	int err = 0;
	int hlimit;

533
	saddr = &ipv6_hdr(skb)->daddr;
L
Linus Torvalds 已提交
534 535 536 537 538 539 540

	if (!ipv6_unicast_destination(skb))
		saddr = NULL;

	memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
	tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;

541 542 543
	memset(&fl6, 0, sizeof(fl6));
	fl6.flowi6_proto = IPPROTO_ICMPV6;
	ipv6_addr_copy(&fl6.daddr, &ipv6_hdr(skb)->saddr);
L
Linus Torvalds 已提交
544
	if (saddr)
545 546
		ipv6_addr_copy(&fl6.saddr, saddr);
	fl6.flowi6_oif = skb->dev->ifindex;
547
	fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
548
	security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
L
Linus Torvalds 已提交
549

550 551
	sk = icmpv6_xmit_lock(net);
	if (sk == NULL)
552
		return;
553
	np = inet6_sk(sk);
554

555 556
	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
		fl6.flowi6_oif = np->mcast_oif;
L
Linus Torvalds 已提交
557

558
	err = ip6_dst_lookup(sk, &dst, &fl6);
L
Linus Torvalds 已提交
559 560
	if (err)
		goto out;
561
	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
562
	if (IS_ERR(dst))
563
		goto out;
L
Linus Torvalds 已提交
564

565
	if (ipv6_addr_is_multicast(&fl6.daddr))
L
Linus Torvalds 已提交
566 567 568 569
		hlimit = np->mcast_hops;
	else
		hlimit = np->hop_limit;
	if (hlimit < 0)
570
		hlimit = ip6_dst_hoplimit(dst);
L
Linus Torvalds 已提交
571 572 573 574 575

	idev = in6_dev_get(skb->dev);

	msg.skb = skb;
	msg.offset = 0;
576
	msg.type = ICMPV6_ECHO_REPLY;
L
Linus Torvalds 已提交
577 578

	err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
579
				sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl6,
580 581
				(struct rt6_info*)dst, MSG_DONTWAIT,
				np->dontfrag);
L
Linus Torvalds 已提交
582 583

	if (err) {
E
Eric Dumazet 已提交
584
		ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
L
Linus Torvalds 已提交
585 586 587
		ip6_flush_pending_frames(sk);
		goto out_put;
	}
588
	err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, skb->len + sizeof(struct icmp6hdr));
L
Linus Torvalds 已提交
589

590
out_put:
L
Linus Torvalds 已提交
591 592 593
	if (likely(idev != NULL))
		in6_dev_put(idev);
	dst_release(dst);
594
out:
595
	icmpv6_xmit_unlock(sk);
L
Linus Torvalds 已提交
596 597
}

598
static void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
L
Linus Torvalds 已提交
599
{
600
	const struct inet6_protocol *ipprot;
L
Linus Torvalds 已提交
601 602 603 604 605 606 607 608 609 610
	int inner_offset;
	int hash;
	u8 nexthdr;

	if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
		return;

	nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
	if (ipv6_ext_hdr(nexthdr)) {
		/* now skip over extension headers */
611
		inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
L
Linus Torvalds 已提交
612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636
		if (inner_offset<0)
			return;
	} else {
		inner_offset = sizeof(struct ipv6hdr);
	}

	/* Checkin header including 8 bytes of inner protocol header. */
	if (!pskb_may_pull(skb, inner_offset+8))
		return;

	/* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
	   Without this we will not able f.e. to make source routed
	   pmtu discovery.
	   Corresponding argument (opt) to notifiers is already added.
	   --ANK (980726)
	 */

	hash = nexthdr & (MAX_INET_PROTOS - 1);

	rcu_read_lock();
	ipprot = rcu_dereference(inet6_protos[hash]);
	if (ipprot && ipprot->err_handler)
		ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
	rcu_read_unlock();

637
	raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
L
Linus Torvalds 已提交
638
}
639

L
Linus Torvalds 已提交
640 641 642 643
/*
 *	Handle icmp messages
 */

644
static int icmpv6_rcv(struct sk_buff *skb)
L
Linus Torvalds 已提交
645 646 647 648 649 650
{
	struct net_device *dev = skb->dev;
	struct inet6_dev *idev = __in6_dev_get(dev);
	struct in6_addr *saddr, *daddr;
	struct ipv6hdr *orig_hdr;
	struct icmp6hdr *hdr;
651
	u8 type;
L
Linus Torvalds 已提交
652

653
	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
654
		struct sec_path *sp = skb_sec_path(skb);
655 656
		int nh;

657
		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
658 659 660
				 XFRM_STATE_ICMP))
			goto drop_no_count;

661 662 663 664 665 666 667 668 669 670 671 672
		if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(*orig_hdr)))
			goto drop_no_count;

		nh = skb_network_offset(skb);
		skb_set_network_header(skb, sizeof(*hdr));

		if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
			goto drop_no_count;

		skb_set_network_header(skb, nh);
	}

673
	ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INMSGS);
L
Linus Torvalds 已提交
674

675 676
	saddr = &ipv6_hdr(skb)->saddr;
	daddr = &ipv6_hdr(skb)->daddr;
L
Linus Torvalds 已提交
677 678

	/* Perform checksum. */
679
	switch (skb->ip_summed) {
680
	case CHECKSUM_COMPLETE:
681 682 683 684 685
		if (!csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_ICMPV6,
				     skb->csum))
			break;
		/* fall through */
	case CHECKSUM_NONE:
686 687
		skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
					     IPPROTO_ICMPV6, 0));
688
		if (__skb_checksum_complete(skb)) {
H
Harvey Harrison 已提交
689
			LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [%pI6 > %pI6]\n",
690
				       saddr, daddr);
L
Linus Torvalds 已提交
691 692 693 694
			goto discard_it;
		}
	}

695 696
	if (!pskb_pull(skb, sizeof(*hdr)))
		goto discard_it;
L
Linus Torvalds 已提交
697

698
	hdr = icmp6_hdr(skb);
L
Linus Torvalds 已提交
699 700 701

	type = hdr->icmp6_type;

702
	ICMP6MSGIN_INC_STATS_BH(dev_net(dev), idev, type);
L
Linus Torvalds 已提交
703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720

	switch (type) {
	case ICMPV6_ECHO_REQUEST:
		icmpv6_echo_reply(skb);
		break;

	case ICMPV6_ECHO_REPLY:
		/* we couldn't care less */
		break;

	case ICMPV6_PKT_TOOBIG:
		/* BUGGG_FUTURE: if packet contains rthdr, we cannot update
		   standard destination cache. Seems, only "advanced"
		   destination cache will allow to solve this problem
		   --ANK (980726)
		 */
		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
			goto discard_it;
721
		hdr = icmp6_hdr(skb);
L
Linus Torvalds 已提交
722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762
		orig_hdr = (struct ipv6hdr *) (hdr + 1);
		rt6_pmtu_discovery(&orig_hdr->daddr, &orig_hdr->saddr, dev,
				   ntohl(hdr->icmp6_mtu));

		/*
		 *	Drop through to notify
		 */

	case ICMPV6_DEST_UNREACH:
	case ICMPV6_TIME_EXCEED:
	case ICMPV6_PARAMPROB:
		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
		break;

	case NDISC_ROUTER_SOLICITATION:
	case NDISC_ROUTER_ADVERTISEMENT:
	case NDISC_NEIGHBOUR_SOLICITATION:
	case NDISC_NEIGHBOUR_ADVERTISEMENT:
	case NDISC_REDIRECT:
		ndisc_rcv(skb);
		break;

	case ICMPV6_MGM_QUERY:
		igmp6_event_query(skb);
		break;

	case ICMPV6_MGM_REPORT:
		igmp6_event_report(skb);
		break;

	case ICMPV6_MGM_REDUCTION:
	case ICMPV6_NI_QUERY:
	case ICMPV6_NI_REPLY:
	case ICMPV6_MLD2_REPORT:
	case ICMPV6_DHAAD_REQUEST:
	case ICMPV6_DHAAD_REPLY:
	case ICMPV6_MOBILE_PREFIX_SOL:
	case ICMPV6_MOBILE_PREFIX_ADV:
		break;

	default:
763
		LIMIT_NETDEBUG(KERN_DEBUG "icmpv6: msg of unknown type\n");
L
Linus Torvalds 已提交
764 765 766 767 768

		/* informational */
		if (type & ICMPV6_INFOMSG_MASK)
			break;

769 770 771
		/*
		 * error of unknown type.
		 * must pass to upper level
L
Linus Torvalds 已提交
772 773 774
		 */

		icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
775 776
	}

L
Linus Torvalds 已提交
777 778 779 780
	kfree_skb(skb);
	return 0;

discard_it:
781
	ICMP6_INC_STATS_BH(dev_net(dev), idev, ICMP6_MIB_INERRORS);
782
drop_no_count:
L
Linus Torvalds 已提交
783 784 785 786
	kfree_skb(skb);
	return 0;
}

787
void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
788 789 790 791 792
		      u8 type,
		      const struct in6_addr *saddr,
		      const struct in6_addr *daddr,
		      int oif)
{
793 794 795 796
	memset(fl6, 0, sizeof(*fl6));
	ipv6_addr_copy(&fl6->saddr, saddr);
	ipv6_addr_copy(&fl6->daddr, daddr);
	fl6->flowi6_proto 	= IPPROTO_ICMPV6;
797 798
	fl6->fl6_icmp_type	= type;
	fl6->fl6_icmp_code	= 0;
799 800
	fl6->flowi6_oif		= oif;
	security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
801 802
}

803
/*
804
 * Special lock-class for __icmpv6_sk:
805 806 807
 */
static struct lock_class_key icmpv6_socket_sk_dst_lock_key;

808
static int __net_init icmpv6_sk_init(struct net *net)
L
Linus Torvalds 已提交
809 810 811 812
{
	struct sock *sk;
	int err, i, j;

813 814 815
	net->ipv6.icmp_sk =
		kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
	if (net->ipv6.icmp_sk == NULL)
816 817
		return -ENOMEM;

818
	for_each_possible_cpu(i) {
819 820
		err = inet_ctl_sock_create(&sk, PF_INET6,
					   SOCK_RAW, IPPROTO_ICMPV6, net);
L
Linus Torvalds 已提交
821 822 823 824 825 826 827 828
		if (err < 0) {
			printk(KERN_ERR
			       "Failed to initialize the ICMP6 control socket "
			       "(err %d).\n",
			       err);
			goto fail;
		}

829
		net->ipv6.icmp_sk[i] = sk;
830

831 832 833
		/*
		 * Split off their lock-class, because sk->sk_dst_lock
		 * gets used from softirqs, which is safe for
834
		 * __icmpv6_sk (because those never get directly used
835 836 837 838
		 * via userspace syscalls), but unsafe for normal sockets.
		 */
		lockdep_set_class(&sk->sk_dst_lock,
				  &icmpv6_socket_sk_dst_lock_key);
L
Linus Torvalds 已提交
839 840 841 842 843 844 845 846 847 848

		/* Enough space for 2 64K ICMP packets, including
		 * sk_buff struct overhead.
		 */
		sk->sk_sndbuf =
			(2 * ((64 * 1024) + sizeof(struct sk_buff)));
	}
	return 0;

 fail:
849
	for (j = 0; j < i; j++)
850
		inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
851
	kfree(net->ipv6.icmp_sk);
L
Linus Torvalds 已提交
852 853 854
	return err;
}

855
static void __net_exit icmpv6_sk_exit(struct net *net)
L
Linus Torvalds 已提交
856 857 858
{
	int i;

859
	for_each_possible_cpu(i) {
860
		inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
L
Linus Torvalds 已提交
861
	}
862 863 864
	kfree(net->ipv6.icmp_sk);
}

865
static struct pernet_operations icmpv6_sk_ops = {
866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888
       .init = icmpv6_sk_init,
       .exit = icmpv6_sk_exit,
};

int __init icmpv6_init(void)
{
	int err;

	err = register_pernet_subsys(&icmpv6_sk_ops);
	if (err < 0)
		return err;

	err = -EAGAIN;
	if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
		goto fail;
	return 0;

fail:
	printk(KERN_ERR "Failed to register ICMP6 protocol\n");
	unregister_pernet_subsys(&icmpv6_sk_ops);
	return err;
}

889
void icmpv6_cleanup(void)
890 891
{
	unregister_pernet_subsys(&icmpv6_sk_ops);
L
Linus Torvalds 已提交
892 893 894
	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
}

895

896
static const struct icmp6_err {
L
Linus Torvalds 已提交
897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921
	int err;
	int fatal;
} tab_unreach[] = {
	{	/* NOROUTE */
		.err	= ENETUNREACH,
		.fatal	= 0,
	},
	{	/* ADM_PROHIBITED */
		.err	= EACCES,
		.fatal	= 1,
	},
	{	/* Was NOT_NEIGHBOUR, now reserved */
		.err	= EHOSTUNREACH,
		.fatal	= 0,
	},
	{	/* ADDR_UNREACH	*/
		.err	= EHOSTUNREACH,
		.fatal	= 0,
	},
	{	/* PORT_UNREACH	*/
		.err	= ECONNREFUSED,
		.fatal	= 1,
	},
};

922
int icmpv6_err_convert(u8 type, u8 code, int *err)
L
Linus Torvalds 已提交
923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939
{
	int fatal = 0;

	*err = EPROTO;

	switch (type) {
	case ICMPV6_DEST_UNREACH:
		fatal = 1;
		if (code <= ICMPV6_PORT_UNREACH) {
			*err  = tab_unreach[code].err;
			fatal = tab_unreach[code].fatal;
		}
		break;

	case ICMPV6_PKT_TOOBIG:
		*err = EMSGSIZE;
		break;
940

L
Linus Torvalds 已提交
941 942 943 944 945 946 947 948
	case ICMPV6_PARAMPROB:
		*err = EPROTO;
		fatal = 1;
		break;

	case ICMPV6_TIME_EXCEED:
		*err = EHOSTUNREACH;
		break;
949
	}
L
Linus Torvalds 已提交
950 951 952 953

	return fatal;
}

954 955
EXPORT_SYMBOL(icmpv6_err_convert);

L
Linus Torvalds 已提交
956
#ifdef CONFIG_SYSCTL
957
ctl_table ipv6_icmp_table_template[] = {
L
Linus Torvalds 已提交
958 959
	{
		.procname	= "ratelimit",
960
		.data		= &init_net.ipv6.sysctl.icmpv6_time,
L
Linus Torvalds 已提交
961 962
		.maxlen		= sizeof(int),
		.mode		= 0644,
A
Alexey Dobriyan 已提交
963
		.proc_handler	= proc_dointvec_ms_jiffies,
L
Linus Torvalds 已提交
964
	},
965
	{ },
L
Linus Torvalds 已提交
966
};
967

968
struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
969 970 971 972 973 974
{
	struct ctl_table *table;

	table = kmemdup(ipv6_icmp_table_template,
			sizeof(ipv6_icmp_table_template),
			GFP_KERNEL);
975 976 977 978

	if (table)
		table[0].data = &net->ipv6.sysctl.icmpv6_time;

979 980
	return table;
}
L
Linus Torvalds 已提交
981 982
#endif