net/ipv6/icmp.c

   1 /*
   2  *      Internet Control Message Protocol (ICMPv6)
   3  *      Linux INET6 implementation
   4  *
   5  *      Authors:
   6  *      Pedro Roque             <roque@di.fc.ul.pt>
   7  *
   8  *      Based on net/ipv4/icmp.c
   9  *
  10  *      RFC 1885
  11  *
  12  *      This program is free software; you can redistribute it and/or
  13  *      modify it under the terms of the GNU General Public License
  14  *      as published by the Free Software Foundation; either version
  15  *      2 of the License, or (at your option) any later version.
  16  */
  17
  18 /*
  19  *      Changes:
  20  *
  21  *      Andi Kleen              :       exception handling
  22  *      Andi Kleen                      add rate limits. never reply to a icmp.
  23  *                                      add more length checks and other fixes.
  24  *      yoshfuji                :       ensure to sent parameter problem for
  25  *                                      fragments.
  26  *      YOSHIFUJI Hideaki @USAGI:       added sysctl for icmp rate limit.
  27  *      Randy Dunlap and
  28  *      YOSHIFUJI Hideaki @USAGI:       Per-interface statistics support
  29  *      Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  30  */
  31
  32 #define pr_fmt(fmt) "IPv6: " fmt
  33
  34 #include <linux/module.h>
  35 #include <linux/errno.h>
  36 #include <linux/types.h>
  37 #include <linux/socket.h>
  38 #include <linux/in.h>
  39 #include <linux/kernel.h>
  40 #include <linux/sockios.h>
  41 #include <linux/net.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/init.h>
  44 #include <linux/netfilter.h>
  45 #include <linux/slab.h>
  46
  47 #ifdef CONFIG_SYSCTL
  48 #include <linux/sysctl.h>
  49 #endif
  50
  51 #include <linux/inet.h>
  52 #include <linux/netdevice.h>
  53 #include <linux/icmpv6.h>
  54
  55 #include <net/ip.h>
  56 #include <net/sock.h>
  57
  58 #include <net/ipv6.h>
  59 #include <net/ip6_checksum.h>
  60 #include <net/ping.h>
  61 #include <net/protocol.h>
  62 #include <net/raw.h>
  63 #include <net/rawv6.h>
  64 #include <net/transp_v6.h>
  65 #include <net/ip6_route.h>
  66 #include <net/addrconf.h>
  67 #include <net/icmp.h>
  68 #include <net/xfrm.h>
  69 #include <net/inet_common.h>
  70 #include <net/dsfield.h>
  71 #include <net/l3mdev.h>
  72
  73 #include <asm/uaccess.h>
  74
  75 /*
  76  *      The ICMP socket(s). This is the most convenient way to flow control
  77  *      our ICMP output as well as maintain a clean interface throughout
  78  *      all layers. All Socketless IP sends will soon be gone.
  79  *
  80  *      On SMP we have one ICMP socket per-cpu.
  81  */
  82 static inline struct sock *icmpv6_sk(struct net *net)
  83 {
  84         return net->ipv6.icmp_sk[smp_processor_id()];
  85 }
  86
  87 static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  88                        u8 type, u8 code, int offset, __be32 info)
  89 {
  90         /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  91         struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  92         struct net *net = dev_net(skb->dev);
  93
  94         if (type == ICMPV6_PKT_TOOBIG)
  95                 ip6_update_pmtu(skb, net, info, 0, 0);
  96         else if (type == NDISC_REDIRECT)
  97                 ip6_redirect(skb, net, skb->dev->ifindex, 0);
  98
  99         if (!(type & ICMPV6_INFOMSG_MASK))
 100                 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
 101                         ping_err(skb, offset, info);
 102 }
 103
 104 static int icmpv6_rcv(struct sk_buff *skb);
 105
 106 static const struct inet6_protocol icmpv6_protocol = {
 107         .handler        =       icmpv6_rcv,
 108         .err_handler    =       icmpv6_err,
 109         .flags          =       INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 110 };
 111
 112 static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
 113 {
 114         struct sock *sk;
 115
 116         local_bh_disable();
 117
 118         sk = icmpv6_sk(net);
 119         if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 120                 /* This can happen if the output path (f.e. SIT or
 121                  * ip6ip6 tunnel) signals dst_link_failure() for an
 122                  * outgoing ICMP6 packet.
 123                  */
 124                 local_bh_enable();
 125                 return NULL;
 126         }
 127         return sk;
 128 }
 129
 130 static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 131 {
 132         spin_unlock_bh(&sk->sk_lock.slock);
 133 }
 134
 135 /*
 136  * Figure out, may we reply to this packet with icmp error.
 137  *
 138  * We do not reply, if:
 139  *      - it was icmp error message.
 140  *      - it is truncated, so that it is known, that protocol is ICMPV6
 141  *        (i.e. in the middle of some exthdr)
 142  *
 143  *      --ANK (980726)
 144  */
 145
 146 static bool is_ineligible(const struct sk_buff *skb)
 147 {
 148         int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 149         int len = skb->len - ptr;
 150         __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 151         __be16 frag_off;
 152
 153         if (len < 0)
 154                 return true;
 155
 156         ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 157         if (ptr < 0)
 158                 return false;
 159         if (nexthdr == IPPROTO_ICMPV6) {
 160                 u8 _type, *tp;
 161                 tp = skb_header_pointer(skb,
 162                         ptr+offsetof(struct icmp6hdr, icmp6_type),
 163                         sizeof(_type), &_type);
 164                 if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
 165                         return true;
 166         }
 167         return false;
 168 }
 169
 170 /*
 171  * Check the ICMP output rate limit
 172  */
 173 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 174                                struct flowi6 *fl6)
 175 {
 176         struct net *net = sock_net(sk);
 177         struct dst_entry *dst;
 178         bool res = false;
 179
 180         /* Informational messages are not limited. */
 181         if (type & ICMPV6_INFOMSG_MASK)
 182                 return true;
 183
 184         /* Do not limit pmtu discovery, it would break it. */
 185         if (type == ICMPV6_PKT_TOOBIG)
 186                 return true;
 187
 188         /*
 189          * Look up the output route.
 190          * XXX: perhaps the expire for routing entries cloned by
 191          * this lookup should be more aggressive (not longer than timeout).
 192          */
 193         dst = ip6_route_output(net, sk, fl6);
 194         if (dst->error) {
 195                 IP6_INC_STATS(net, ip6_dst_idev(dst),
 196                               IPSTATS_MIB_OUTNOROUTES);
 197         } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
 198                 res = true;
 199         } else {
 200                 struct rt6_info *rt = (struct rt6_info *)dst;
 201                 int tmo = net->ipv6.sysctl.icmpv6_time;
 202
 203                 /* Give more bandwidth to wider prefixes. */
 204                 if (rt->rt6i_dst.plen < 128)
 205                         tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 206
 207                 if (icmp_global_allow()) {
 208                         struct inet_peer *peer;
 209
 210                         peer = inet_getpeer_v6(net->ipv6.peers,
 211                                                &fl6->daddr, 1);
 212                         res = inet_peer_xrlim_allow(peer, tmo);
 213                         if (peer)
 214                                 inet_putpeer(peer);
 215                 }
 216         }
 217         dst_release(dst);
 218         return res;
 219 }
 220
 221 /*
 222  *      an inline helper for the "simple" if statement below
 223  *      checks if parameter problem report is caused by an
 224  *      unrecognized IPv6 option that has the Option Type
 225  *      highest-order two bits set to 10
 226  */
 227
 228 static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 229 {
 230         u8 _optval, *op;
 231
 232         offset += skb_network_offset(skb);
 233         op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 234         if (!op)
 235                 return true;
 236         return (*op & 0xC0) == 0x80;
 237 }
 238
 239 int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 240                                struct icmp6hdr *thdr, int len)
 241 {
 242         struct sk_buff *skb;
 243         struct icmp6hdr *icmp6h;
 244         int err = 0;
 245
 246         skb = skb_peek(&sk->sk_write_queue);
 247         if (!skb)
 248                 goto out;
 249
 250         icmp6h = icmp6_hdr(skb);
 251         memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 252         icmp6h->icmp6_cksum = 0;
 253
 254         if (skb_queue_len(&sk->sk_write_queue) == 1) {
 255                 skb->csum = csum_partial(icmp6h,
 256                                         sizeof(struct icmp6hdr), skb->csum);
 257                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 258                                                       &fl6->daddr,
 259                                                       len, fl6->flowi6_proto,
 260                                                       skb->csum);
 261         } else {
 262                 __wsum tmp_csum = 0;
 263
 264                 skb_queue_walk(&sk->sk_write_queue, skb) {
 265                         tmp_csum = csum_add(tmp_csum, skb->csum);
 266                 }
 267
 268                 tmp_csum = csum_partial(icmp6h,
 269                                         sizeof(struct icmp6hdr), tmp_csum);
 270                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 271                                                       &fl6->daddr,
 272                                                       len, fl6->flowi6_proto,
 273                                                       tmp_csum);
 274         }
 275         ip6_push_pending_frames(sk);
 276 out:
 277         return err;
 278 }
 279
 280 struct icmpv6_msg {
 281         struct sk_buff  *skb;
 282         int             offset;
 283         uint8_t         type;
 284 };
 285
 286 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 287 {
 288         struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 289         struct sk_buff *org_skb = msg->skb;
 290         __wsum csum = 0;
 291
 292         csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 293                                       to, len, csum);
 294         skb->csum = csum_block_add(skb->csum, csum, odd);
 295         if (!(msg->type & ICMPV6_INFOMSG_MASK))
 296                 nf_ct_attach(skb, org_skb);
 297         return 0;
 298 }
 299
 300 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 301 static void mip6_addr_swap(struct sk_buff *skb)
 302 {
 303         struct ipv6hdr *iph = ipv6_hdr(skb);
 304         struct inet6_skb_parm *opt = IP6CB(skb);
 305         struct ipv6_destopt_hao *hao;
 306         struct in6_addr tmp;
 307         int off;
 308
 309         if (opt->dsthao) {
 310                 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 311                 if (likely(off >= 0)) {
 312                         hao = (struct ipv6_destopt_hao *)
 313                                         (skb_network_header(skb) + off);
 314                         tmp = iph->saddr;
 315                         iph->saddr = hao->addr;
 316                         hao->addr = tmp;
 317                 }
 318         }
 319 }
 320 #else
 321 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 322 #endif
 323
 324 static struct dst_entry *icmpv6_route_lookup(struct net *net,
 325                                              struct sk_buff *skb,
 326                                              struct sock *sk,
 327                                              struct flowi6 *fl6)
 328 {
 329         struct dst_entry *dst, *dst2;
 330         struct flowi6 fl2;
 331         int err;
 332
 333         err = ip6_dst_lookup(net, sk, &dst, fl6);
 334         if (err)
 335                 return ERR_PTR(err);
 336
 337         /*
 338          * We won't send icmp if the destination is known
 339          * anycast.
 340          */
 341         if (ipv6_anycast_destination(dst, &fl6->daddr)) {
 342                 net_dbg_ratelimited("icmp6_send: acast source\n");
 343                 dst_release(dst);
 344                 return ERR_PTR(-EINVAL);
 345         }
 346
 347         /* No need to clone since we're just using its address. */
 348         dst2 = dst;
 349
 350         dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 351         if (!IS_ERR(dst)) {
 352                 if (dst != dst2)
 353                         return dst;
 354         } else {
 355                 if (PTR_ERR(dst) == -EPERM)
 356                         dst = NULL;
 357                 else
 358                         return dst;
 359         }
 360
 361         err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
 362         if (err)
 363                 goto relookup_failed;
 364
 365         err = ip6_dst_lookup(net, sk, &dst2, &fl2);
 366         if (err)
 367                 goto relookup_failed;
 368
 369         dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 370         if (!IS_ERR(dst2)) {
 371                 dst_release(dst);
 372                 dst = dst2;
 373         } else {
 374                 err = PTR_ERR(dst2);
 375                 if (err == -EPERM) {
 376                         dst_release(dst);
 377                         return dst2;
 378                 } else
 379                         goto relookup_failed;
 380         }
 381
 382 relookup_failed:
 383         if (dst)
 384                 return dst;
 385         return ERR_PTR(err);
 386 }
 387
 388 /*
 389  *      Send an ICMP message in response to a packet in error
 390  */
 391 static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
 392 {
 393         struct net *net = dev_net(skb->dev);
 394         struct inet6_dev *idev = NULL;
 395         struct ipv6hdr *hdr = ipv6_hdr(skb);
 396         struct sock *sk;
 397         struct ipv6_pinfo *np;
 398         const struct in6_addr *saddr = NULL;
 399         struct dst_entry *dst;
 400         struct icmp6hdr tmp_hdr;
 401         struct flowi6 fl6;
 402         struct icmpv6_msg msg;
 403         struct sockcm_cookie sockc_unused = {0};
 404         struct ipcm6_cookie ipc6;
 405         int iif = 0;
 406         int addr_type = 0;
 407         int len;
 408         int err = 0;
 409         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 410
 411         if ((u8 *)hdr < skb->head ||
 412             (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 413                 return;
 414
 415         /*
 416          *      Make sure we respect the rules
 417          *      i.e. RFC 1885 2.4(e)
 418          *      Rule (e.1) is enforced by not using icmp6_send
 419          *      in any code that processes icmp errors.
 420          */
 421         addr_type = ipv6_addr_type(&hdr->daddr);
 422
 423         if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 424             ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 425                 saddr = &hdr->daddr;
 426
 427         /*
 428          *      Dest addr check
 429          */
 430
 431         if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
 432                 if (type != ICMPV6_PKT_TOOBIG &&
 433                     !(type == ICMPV6_PARAMPROB &&
 434                       code == ICMPV6_UNK_OPTION &&
 435                       (opt_unrec(skb, info))))
 436                         return;
 437
 438                 saddr = NULL;
 439         }
 440
 441         addr_type = ipv6_addr_type(&hdr->saddr);
 442
 443         /*
 444          *      Source addr check
 445          */
 446
 447         if (__ipv6_addr_needs_scope_id(addr_type))
 448                 iif = skb->dev->ifindex;
 449         else
 450                 iif = l3mdev_master_ifindex(skb->dev);
 451
 452         /*
 453          *      Must not send error if the source does not uniquely
 454          *      identify a single node (RFC2463 Section 2.4).
 455          *      We check unspecified / multicast addresses here,
 456          *      and anycast addresses will be checked later.
 457          */
 458         if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 459                 net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
 460                                     &hdr->saddr, &hdr->daddr);
 461                 return;
 462         }
 463
 464         /*
 465          *      Never answer to a ICMP packet.
 466          */
 467         if (is_ineligible(skb)) {
 468                 net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
 469                                     &hdr->saddr, &hdr->daddr);
 470                 return;
 471         }
 472
 473         mip6_addr_swap(skb);
 474
 475         memset(&fl6, 0, sizeof(fl6));
 476         fl6.flowi6_proto = IPPROTO_ICMPV6;
 477         fl6.daddr = hdr->saddr;
 478         if (saddr)
 479                 fl6.saddr = *saddr;
 480         fl6.flowi6_mark = mark;
 481         fl6.flowi6_oif = iif;
 482         fl6.fl6_icmp_type = type;
 483         fl6.fl6_icmp_code = code;
 484         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 485
 486         sk = icmpv6_xmit_lock(net);
 487         if (!sk)
 488                 return;
 489         sk->sk_mark = mark;
 490         np = inet6_sk(sk);
 491
 492         if (!icmpv6_xrlim_allow(sk, type, &fl6))
 493                 goto out;
 494
 495         tmp_hdr.icmp6_type = type;
 496         tmp_hdr.icmp6_code = code;
 497         tmp_hdr.icmp6_cksum = 0;
 498         tmp_hdr.icmp6_pointer = htonl(info);
 499
 500         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 501                 fl6.flowi6_oif = np->mcast_oif;
 502         else if (!fl6.flowi6_oif)
 503                 fl6.flowi6_oif = np->ucast_oif;
 504
 505         ipc6.tclass = np->tclass;
 506         fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 507
 508         dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 509         if (IS_ERR(dst))
 510                 goto out;
 511
 512         ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 513         ipc6.dontfrag = np->dontfrag;
 514         ipc6.opt = NULL;
 515
 516         msg.skb = skb;
 517         msg.offset = skb_network_offset(skb);
 518         msg.type = type;
 519
 520         len = skb->len - msg.offset;
 521         len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr));
 522         if (len < 0) {
 523                 net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
 524                                     &hdr->saddr, &hdr->daddr);
 525                 goto out_dst_release;
 526         }
 527
 528         rcu_read_lock();
 529         idev = __in6_dev_get(skb->dev);
 530
 531         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
 532                               len + sizeof(struct icmp6hdr),
 533                               sizeof(struct icmp6hdr),
 534                               &ipc6, &fl6, (struct rt6_info *)dst,
 535                               MSG_DONTWAIT, &sockc_unused);
 536         if (err) {
 537                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 538                 ip6_flush_pending_frames(sk);
 539         } else {
 540                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 541                                                  len + sizeof(struct icmp6hdr));
 542         }
 543         rcu_read_unlock();
 544 out_dst_release:
 545         dst_release(dst);
 546 out:
 547         icmpv6_xmit_unlock(sk);
 548 }
 549
 550 /* Slightly more convenient version of icmp6_send.
 551  */
 552 void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 553 {
 554         icmp6_send(skb, ICMPV6_PARAMPROB, code, pos);
 555         kfree_skb(skb);
 556 }
 557
 558 static void icmpv6_echo_reply(struct sk_buff *skb)
 559 {
 560         struct net *net = dev_net(skb->dev);
 561         struct sock *sk;
 562         struct inet6_dev *idev;
 563         struct ipv6_pinfo *np;
 564         const struct in6_addr *saddr = NULL;
 565         struct icmp6hdr *icmph = icmp6_hdr(skb);
 566         struct icmp6hdr tmp_hdr;
 567         struct flowi6 fl6;
 568         struct icmpv6_msg msg;
 569         struct dst_entry *dst;
 570         struct ipcm6_cookie ipc6;
 571         int err = 0;
 572         u32 mark = IP6_REPLY_MARK(net, skb->mark);
 573         struct sockcm_cookie sockc_unused = {0};
 574
 575         saddr = &ipv6_hdr(skb)->daddr;
 576
 577         if (!ipv6_unicast_destination(skb) &&
 578             !(net->ipv6.sysctl.anycast_src_echo_reply &&
 579               ipv6_anycast_destination(skb_dst(skb), saddr)))
 580                 saddr = NULL;
 581
 582         memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 583         tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
 584
 585         memset(&fl6, 0, sizeof(fl6));
 586         fl6.flowi6_proto = IPPROTO_ICMPV6;
 587         fl6.daddr = ipv6_hdr(skb)->saddr;
 588         if (saddr)
 589                 fl6.saddr = *saddr;
 590         fl6.flowi6_oif = skb->dev->ifindex;
 591         fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
 592         fl6.flowi6_mark = mark;
 593         security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
 594
 595         sk = icmpv6_xmit_lock(net);
 596         if (!sk)
 597                 return;
 598         sk->sk_mark = mark;
 599         np = inet6_sk(sk);
 600
 601         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 602                 fl6.flowi6_oif = np->mcast_oif;
 603         else if (!fl6.flowi6_oif)
 604                 fl6.flowi6_oif = np->ucast_oif;
 605
 606         err = ip6_dst_lookup(net, sk, &dst, &fl6);
 607         if (err)
 608                 goto out;
 609         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 610         if (IS_ERR(dst))
 611                 goto out;
 612
 613         idev = __in6_dev_get(skb->dev);
 614
 615         msg.skb = skb;
 616         msg.offset = 0;
 617         msg.type = ICMPV6_ECHO_REPLY;
 618
 619         ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 620         ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb));
 621         ipc6.dontfrag = np->dontfrag;
 622         ipc6.opt = NULL;
 623
 624         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
 625                                 sizeof(struct icmp6hdr), &ipc6, &fl6,
 626                                 (struct rt6_info *)dst, MSG_DONTWAIT,
 627                                 &sockc_unused);
 628
 629         if (err) {
 630                 __ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 631                 ip6_flush_pending_frames(sk);
 632         } else {
 633                 err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 634                                                  skb->len + sizeof(struct icmp6hdr));
 635         }
 636         dst_release(dst);
 637 out:
 638         icmpv6_xmit_unlock(sk);
 639 }
 640
 641 void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 642 {
 643         const struct inet6_protocol *ipprot;
 644         int inner_offset;
 645         __be16 frag_off;
 646         u8 nexthdr;
 647         struct net *net = dev_net(skb->dev);
 648
 649         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 650                 goto out;
 651
 652         nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
 653         if (ipv6_ext_hdr(nexthdr)) {
 654                 /* now skip over extension headers */
 655                 inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
 656                                                 &nexthdr, &frag_off);
 657                 if (inner_offset < 0)
 658                         goto out;
 659         } else {
 660                 inner_offset = sizeof(struct ipv6hdr);
 661         }
 662
 663         /* Checkin header including 8 bytes of inner protocol header. */
 664         if (!pskb_may_pull(skb, inner_offset+8))
 665                 goto out;
 666
 667         /* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
 668            Without this we will not able f.e. to make source routed
 669            pmtu discovery.
 670            Corresponding argument (opt) to notifiers is already added.
 671            --ANK (980726)
 672          */
 673
 674         ipprot = rcu_dereference(inet6_protos[nexthdr]);
 675         if (ipprot && ipprot->err_handler)
 676                 ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
 677
 678         raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
 679         return;
 680
 681 out:
 682         __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
 683 }
 684
 685 /*
 686  *      Handle icmp messages
 687  */
 688
 689 static int icmpv6_rcv(struct sk_buff *skb)
 690 {
 691         struct net_device *dev = skb->dev;
 692         struct inet6_dev *idev = __in6_dev_get(dev);
 693         const struct in6_addr *saddr, *daddr;
 694         struct icmp6hdr *hdr;
 695         u8 type;
 696         bool success = false;
 697
 698         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 699                 struct sec_path *sp = skb_sec_path(skb);
 700                 int nh;
 701
 702                 if (!(sp && sp->xvec[sp->len - 1]->props.flags &
 703                                  XFRM_STATE_ICMP))
 704                         goto drop_no_count;
 705
 706                 if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
 707                         goto drop_no_count;
 708
 709                 nh = skb_network_offset(skb);
 710                 skb_set_network_header(skb, sizeof(*hdr));
 711
 712                 if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
 713                         goto drop_no_count;
 714
 715                 skb_set_network_header(skb, nh);
 716         }
 717
 718         __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS);
 719
 720         saddr = &ipv6_hdr(skb)->saddr;
 721         daddr = &ipv6_hdr(skb)->daddr;
 722
 723         if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
 724                 net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
 725                                     saddr, daddr);
 726                 goto csum_error;
 727         }
 728
 729         if (!pskb_pull(skb, sizeof(*hdr)))
 730                 goto discard_it;
 731
 732         hdr = icmp6_hdr(skb);
 733
 734         type = hdr->icmp6_type;
 735
 736         ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type);
 737
 738         switch (type) {
 739         case ICMPV6_ECHO_REQUEST:
 740                 icmpv6_echo_reply(skb);
 741                 break;
 742
 743         case ICMPV6_ECHO_REPLY:
 744                 success = ping_rcv(skb);
 745                 break;
 746
 747         case ICMPV6_PKT_TOOBIG:
 748                 /* BUGGG_FUTURE: if packet contains rthdr, we cannot update
 749                    standard destination cache. Seems, only "advanced"
 750                    destination cache will allow to solve this problem
 751                    --ANK (980726)
 752                  */
 753                 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
 754                         goto discard_it;
 755                 hdr = icmp6_hdr(skb);
 756
 757                 /*
 758                  *      Drop through to notify
 759                  */
 760
 761         case ICMPV6_DEST_UNREACH:
 762         case ICMPV6_TIME_EXCEED:
 763         case ICMPV6_PARAMPROB:
 764                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 765                 break;
 766
 767         case NDISC_ROUTER_SOLICITATION:
 768         case NDISC_ROUTER_ADVERTISEMENT:
 769         case NDISC_NEIGHBOUR_SOLICITATION:
 770         case NDISC_NEIGHBOUR_ADVERTISEMENT:
 771         case NDISC_REDIRECT:
 772                 ndisc_rcv(skb);
 773                 break;
 774
 775         case ICMPV6_MGM_QUERY:
 776                 igmp6_event_query(skb);
 777                 break;
 778
 779         case ICMPV6_MGM_REPORT:
 780                 igmp6_event_report(skb);
 781                 break;
 782
 783         case ICMPV6_MGM_REDUCTION:
 784         case ICMPV6_NI_QUERY:
 785         case ICMPV6_NI_REPLY:
 786         case ICMPV6_MLD2_REPORT:
 787         case ICMPV6_DHAAD_REQUEST:
 788         case ICMPV6_DHAAD_REPLY:
 789         case ICMPV6_MOBILE_PREFIX_SOL:
 790         case ICMPV6_MOBILE_PREFIX_ADV:
 791                 break;
 792
 793         default:
 794                 /* informational */
 795                 if (type & ICMPV6_INFOMSG_MASK)
 796                         break;
 797
 798                 net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
 799                                     saddr, daddr);
 800
 801                 /*
 802                  * error of unknown type.
 803                  * must pass to upper level
 804                  */
 805
 806                 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
 807         }
 808
 809         /* until the v6 path can be better sorted assume failure and
 810          * preserve the status quo behaviour for the rest of the paths to here
 811          */
 812         if (success)
 813                 consume_skb(skb);
 814         else
 815                 kfree_skb(skb);
 816
 817         return 0;
 818
 819 csum_error:
 820         __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
 821 discard_it:
 822         __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS);
 823 drop_no_count:
 824         kfree_skb(skb);
 825         return 0;
 826 }
 827
 828 void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
 829                       u8 type,
 830                       const struct in6_addr *saddr,
 831                       const struct in6_addr *daddr,
 832                       int oif)
 833 {
 834         memset(fl6, 0, sizeof(*fl6));
 835         fl6->saddr = *saddr;
 836         fl6->daddr = *daddr;
 837         fl6->flowi6_proto       = IPPROTO_ICMPV6;
 838         fl6->fl6_icmp_type      = type;
 839         fl6->fl6_icmp_code      = 0;
 840         fl6->flowi6_oif         = oif;
 841         security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
 842 }
 843
 844 static int __net_init icmpv6_sk_init(struct net *net)
 845 {
 846         struct sock *sk;
 847         int err, i, j;
 848
 849         net->ipv6.icmp_sk =
 850                 kzalloc(nr_cpu_ids * sizeof(struct sock *), GFP_KERNEL);
 851         if (!net->ipv6.icmp_sk)
 852                 return -ENOMEM;
 853
 854         for_each_possible_cpu(i) {
 855                 err = inet_ctl_sock_create(&sk, PF_INET6,
 856                                            SOCK_RAW, IPPROTO_ICMPV6, net);
 857                 if (err < 0) {
 858                         pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
 859                                err);
 860                         goto fail;
 861                 }
 862
 863                 net->ipv6.icmp_sk[i] = sk;
 864
 865                 /* Enough space for 2 64K ICMP packets, including
 866                  * sk_buff struct overhead.
 867                  */
 868                 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
 869         }
 870         return 0;
 871
 872  fail:
 873         for (j = 0; j < i; j++)
 874                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[j]);
 875         kfree(net->ipv6.icmp_sk);
 876         return err;
 877 }
 878
 879 static void __net_exit icmpv6_sk_exit(struct net *net)
 880 {
 881         int i;
 882
 883         for_each_possible_cpu(i) {
 884                 inet_ctl_sock_destroy(net->ipv6.icmp_sk[i]);
 885         }
 886         kfree(net->ipv6.icmp_sk);
 887 }
 888
 889 static struct pernet_operations icmpv6_sk_ops = {
 890         .init = icmpv6_sk_init,
 891         .exit = icmpv6_sk_exit,
 892 };
 893
 894 int __init icmpv6_init(void)
 895 {
 896         int err;
 897
 898         err = register_pernet_subsys(&icmpv6_sk_ops);
 899         if (err < 0)
 900                 return err;
 901
 902         err = -EAGAIN;
 903         if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
 904                 goto fail;
 905
 906         err = inet6_register_icmp_sender(icmp6_send);
 907         if (err)
 908                 goto sender_reg_err;
 909         return 0;
 910
 911 sender_reg_err:
 912         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 913 fail:
 914         pr_err("Failed to register ICMP6 protocol\n");
 915         unregister_pernet_subsys(&icmpv6_sk_ops);
 916         return err;
 917 }
 918
 919 void icmpv6_cleanup(void)
 920 {
 921         inet6_unregister_icmp_sender(icmp6_send);
 922         unregister_pernet_subsys(&icmpv6_sk_ops);
 923         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
 924 }
 925
 926
 927 static const struct icmp6_err {
 928         int err;
 929         int fatal;
 930 } tab_unreach[] = {
 931         {       /* NOROUTE */
 932                 .err    = ENETUNREACH,
 933                 .fatal  = 0,
 934         },
 935         {       /* ADM_PROHIBITED */
 936                 .err    = EACCES,
 937                 .fatal  = 1,
 938         },
 939         {       /* Was NOT_NEIGHBOUR, now reserved */
 940                 .err    = EHOSTUNREACH,
 941                 .fatal  = 0,
 942         },
 943         {       /* ADDR_UNREACH */
 944                 .err    = EHOSTUNREACH,
 945                 .fatal  = 0,
 946         },
 947         {       /* PORT_UNREACH */
 948                 .err    = ECONNREFUSED,
 949                 .fatal  = 1,
 950         },
 951         {       /* POLICY_FAIL */
 952                 .err    = EACCES,
 953                 .fatal  = 1,
 954         },
 955         {       /* REJECT_ROUTE */
 956                 .err    = EACCES,
 957                 .fatal  = 1,
 958         },
 959 };
 960
 961 int icmpv6_err_convert(u8 type, u8 code, int *err)
 962 {
 963         int fatal = 0;
 964
 965         *err = EPROTO;
 966
 967         switch (type) {
 968         case ICMPV6_DEST_UNREACH:
 969                 fatal = 1;
 970                 if (code < ARRAY_SIZE(tab_unreach)) {
 971                         *err  = tab_unreach[code].err;
 972                         fatal = tab_unreach[code].fatal;
 973                 }
 974                 break;
 975
 976         case ICMPV6_PKT_TOOBIG:
 977                 *err = EMSGSIZE;
 978                 break;
 979
 980         case ICMPV6_PARAMPROB:
 981                 *err = EPROTO;
 982                 fatal = 1;
 983                 break;
 984
 985         case ICMPV6_TIME_EXCEED:
 986                 *err = EHOSTUNREACH;
 987                 break;
 988         }
 989
 990         return fatal;
 991 }
 992 EXPORT_SYMBOL(icmpv6_err_convert);
 993
 994 #ifdef CONFIG_SYSCTL
 995 static struct ctl_table ipv6_icmp_table_template[] = {
 996         {
 997                 .procname       = "ratelimit",
 998                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
 999                 .maxlen         = sizeof(int),
1000                 .mode           = 0644,
1001                 .proc_handler   = proc_dointvec_ms_jiffies,
1002         },
1003         { },
1004 };
1005
1006 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1007 {
1008         struct ctl_table *table;
1009
1010         table = kmemdup(ipv6_icmp_table_template,
1011                         sizeof(ipv6_icmp_table_template),
1012                         GFP_KERNEL);
1013
1014         if (table)
1015                 table[0].data = &net->ipv6.sysctl.icmpv6_time;
1016
1017         return table;
1018 }
1019 #endif