~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv6/exthdrs.c

Version: ~ [ linux-5.15-rc1 ] ~ [ linux-5.14.5 ] ~ [ linux-5.13.18 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.66 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.147 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.206 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.246 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.282 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.283 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  *      Extension Header handling for IPv6
  3  *      Linux INET6 implementation
  4  *
  5  *      Authors:
  6  *      Pedro Roque             <roque@di.fc.ul.pt>
  7  *      Andi Kleen              <ak@muc.de>
  8  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  9  *
 10  *      This program is free software; you can redistribute it and/or
 11  *      modify it under the terms of the GNU General Public License
 12  *      as published by the Free Software Foundation; either version
 13  *      2 of the License, or (at your option) any later version.
 14  */
 15 
 16 /* Changes:
 17  *      yoshfuji                : ensure not to overrun while parsing
 18  *                                tlv options.
 19  *      Mitsuru KANDA @USAGI and: Remove ipv6_parse_exthdrs().
 20  *      YOSHIFUJI Hideaki @USAGI  Register inbound extension header
 21  *                                handlers as inet6_protocol{}.
 22  */
 23 
 24 #include <linux/errno.h>
 25 #include <linux/types.h>
 26 #include <linux/socket.h>
 27 #include <linux/sockios.h>
 28 #include <linux/net.h>
 29 #include <linux/netdevice.h>
 30 #include <linux/in6.h>
 31 #include <linux/icmpv6.h>
 32 #include <linux/slab.h>
 33 #include <linux/export.h>
 34 
 35 #include <net/dst.h>
 36 #include <net/sock.h>
 37 #include <net/snmp.h>
 38 
 39 #include <net/ipv6.h>
 40 #include <net/protocol.h>
 41 #include <net/transp_v6.h>
 42 #include <net/rawv6.h>
 43 #include <net/ndisc.h>
 44 #include <net/ip6_route.h>
 45 #include <net/addrconf.h>
 46 #include <net/calipso.h>
 47 #if IS_ENABLED(CONFIG_IPV6_MIP6)
 48 #include <net/xfrm.h>
 49 #endif
 50 #include <linux/seg6.h>
 51 #include <net/seg6.h>
 52 #ifdef CONFIG_IPV6_SEG6_HMAC
 53 #include <net/seg6_hmac.h>
 54 #endif
 55 
 56 #include <linux/uaccess.h>
 57 
 58 /*
 59  *      Parsing tlv encoded headers.
 60  *
 61  *      Parsing function "func" returns true, if parsing succeed
 62  *      and false, if it failed.
 63  *      It MUST NOT touch skb->h.
 64  */
 65 
 66 struct tlvtype_proc {
 67         int     type;
 68         bool    (*func)(struct sk_buff *skb, int offset);
 69 };
 70 
 71 /*********************
 72   Generic functions
 73  *********************/
 74 
 75 /* An unknown option is detected, decide what to do */
 76 
 77 static bool ip6_tlvopt_unknown(struct sk_buff *skb, int optoff)
 78 {
 79         switch ((skb_network_header(skb)[optoff] & 0xC0) >> 6) {
 80         case 0: /* ignore */
 81                 return true;
 82 
 83         case 1: /* drop packet */
 84                 break;
 85 
 86         case 3: /* Send ICMP if not a multicast address and drop packet */
 87                 /* Actually, it is redundant check. icmp_send
 88                    will recheck in any case.
 89                  */
 90                 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr))
 91                         break;
 92         case 2: /* send ICMP PARM PROB regardless and drop packet */
 93                 icmpv6_param_prob(skb, ICMPV6_UNK_OPTION, optoff);
 94                 return false;
 95         }
 96 
 97         kfree_skb(skb);
 98         return false;
 99 }
100 
101 /* Parse tlv encoded option header (hop-by-hop or destination) */
102 
103 static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
104 {
105         const struct tlvtype_proc *curr;
106         const unsigned char *nh = skb_network_header(skb);
107         int off = skb_network_header_len(skb);
108         int len = (skb_transport_header(skb)[1] + 1) << 3;
109         int padlen = 0;
110 
111         if (skb_transport_offset(skb) + len > skb_headlen(skb))
112                 goto bad;
113 
114         off += 2;
115         len -= 2;
116 
117         while (len > 0) {
118                 int optlen = nh[off + 1] + 2;
119                 int i;
120 
121                 switch (nh[off]) {
122                 case IPV6_TLV_PAD1:
123                         optlen = 1;
124                         padlen++;
125                         if (padlen > 7)
126                                 goto bad;
127                         break;
128 
129                 case IPV6_TLV_PADN:
130                         /* RFC 2460 states that the purpose of PadN is
131                          * to align the containing header to multiples
132                          * of 8. 7 is therefore the highest valid value.
133                          * See also RFC 4942, Section 2.1.9.5.
134                          */
135                         padlen += optlen;
136                         if (padlen > 7)
137                                 goto bad;
138                         /* RFC 4942 recommends receiving hosts to
139                          * actively check PadN payload to contain
140                          * only zeroes.
141                          */
142                         for (i = 2; i < optlen; i++) {
143                                 if (nh[off + i] != 0)
144                                         goto bad;
145                         }
146                         break;
147 
148                 default: /* Other TLV code so scan list */
149                         if (optlen > len)
150                                 goto bad;
151                         for (curr = procs; curr->type >= 0; curr++) {
152                                 if (curr->type == nh[off]) {
153                                         /* type specific length/alignment
154                                            checks will be performed in the
155                                            func(). */
156                                         if (curr->func(skb, off) == false)
157                                                 return false;
158                                         break;
159                                 }
160                         }
161                         if (curr->type < 0) {
162                                 if (ip6_tlvopt_unknown(skb, off) == 0)
163                                         return false;
164                         }
165                         padlen = 0;
166                         break;
167                 }
168                 off += optlen;
169                 len -= optlen;
170         }
171 
172         if (len == 0)
173                 return true;
174 bad:
175         kfree_skb(skb);
176         return false;
177 }
178 
179 /*****************************
180   Destination options header.
181  *****************************/
182 
183 #if IS_ENABLED(CONFIG_IPV6_MIP6)
184 static bool ipv6_dest_hao(struct sk_buff *skb, int optoff)
185 {
186         struct ipv6_destopt_hao *hao;
187         struct inet6_skb_parm *opt = IP6CB(skb);
188         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
189         struct in6_addr tmp_addr;
190         int ret;
191 
192         if (opt->dsthao) {
193                 net_dbg_ratelimited("hao duplicated\n");
194                 goto discard;
195         }
196         opt->dsthao = opt->dst1;
197         opt->dst1 = 0;
198 
199         hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) + optoff);
200 
201         if (hao->length != 16) {
202                 net_dbg_ratelimited("hao invalid option length = %d\n",
203                                     hao->length);
204                 goto discard;
205         }
206 
207         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
208                 net_dbg_ratelimited("hao is not an unicast addr: %pI6\n",
209                                     &hao->addr);
210                 goto discard;
211         }
212 
213         ret = xfrm6_input_addr(skb, (xfrm_address_t *)&ipv6h->daddr,
214                                (xfrm_address_t *)&hao->addr, IPPROTO_DSTOPTS);
215         if (unlikely(ret < 0))
216                 goto discard;
217 
218         if (skb_cloned(skb)) {
219                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
220                         goto discard;
221 
222                 /* update all variable using below by copied skbuff */
223                 hao = (struct ipv6_destopt_hao *)(skb_network_header(skb) +
224                                                   optoff);
225                 ipv6h = ipv6_hdr(skb);
226         }
227 
228         if (skb->ip_summed == CHECKSUM_COMPLETE)
229                 skb->ip_summed = CHECKSUM_NONE;
230 
231         tmp_addr = ipv6h->saddr;
232         ipv6h->saddr = hao->addr;
233         hao->addr = tmp_addr;
234 
235         if (skb->tstamp == 0)
236                 __net_timestamp(skb);
237 
238         return true;
239 
240  discard:
241         kfree_skb(skb);
242         return false;
243 }
244 #endif
245 
246 static const struct tlvtype_proc tlvprocdestopt_lst[] = {
247 #if IS_ENABLED(CONFIG_IPV6_MIP6)
248         {
249                 .type   = IPV6_TLV_HAO,
250                 .func   = ipv6_dest_hao,
251         },
252 #endif
253         {-1,                    NULL}
254 };
255 
256 static int ipv6_destopt_rcv(struct sk_buff *skb)
257 {
258         struct inet6_skb_parm *opt = IP6CB(skb);
259 #if IS_ENABLED(CONFIG_IPV6_MIP6)
260         __u16 dstbuf;
261 #endif
262         struct dst_entry *dst = skb_dst(skb);
263 
264         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
265             !pskb_may_pull(skb, (skb_transport_offset(skb) +
266                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
267                 __IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
268                                 IPSTATS_MIB_INHDRERRORS);
269                 kfree_skb(skb);
270                 return -1;
271         }
272 
273         opt->lastopt = opt->dst1 = skb_network_header_len(skb);
274 #if IS_ENABLED(CONFIG_IPV6_MIP6)
275         dstbuf = opt->dst1;
276 #endif
277 
278         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
279                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
280                 opt = IP6CB(skb);
281 #if IS_ENABLED(CONFIG_IPV6_MIP6)
282                 opt->nhoff = dstbuf;
283 #else
284                 opt->nhoff = opt->dst1;
285 #endif
286                 return 1;
287         }
288 
289         __IP6_INC_STATS(dev_net(dst->dev),
290                         ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
291         return -1;
292 }
293 
294 static void seg6_update_csum(struct sk_buff *skb)
295 {
296         struct ipv6_sr_hdr *hdr;
297         struct in6_addr *addr;
298         __be32 from, to;
299 
300         /* srh is at transport offset and seg_left is already decremented
301          * but daddr is not yet updated with next segment
302          */
303 
304         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
305         addr = hdr->segments + hdr->segments_left;
306 
307         hdr->segments_left++;
308         from = *(__be32 *)hdr;
309 
310         hdr->segments_left--;
311         to = *(__be32 *)hdr;
312 
313         /* update skb csum with diff resulting from seg_left decrement */
314 
315         update_csum_diff4(skb, from, to);
316 
317         /* compute csum diff between current and next segment and update */
318 
319         update_csum_diff16(skb, (__be32 *)(&ipv6_hdr(skb)->daddr),
320                            (__be32 *)addr);
321 }
322 
323 static int ipv6_srh_rcv(struct sk_buff *skb)
324 {
325         struct inet6_skb_parm *opt = IP6CB(skb);
326         struct net *net = dev_net(skb->dev);
327         struct ipv6_sr_hdr *hdr;
328         struct inet6_dev *idev;
329         struct in6_addr *addr;
330         int accept_seg6;
331 
332         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
333 
334         idev = __in6_dev_get(skb->dev);
335 
336         accept_seg6 = net->ipv6.devconf_all->seg6_enabled;
337         if (accept_seg6 > idev->cnf.seg6_enabled)
338                 accept_seg6 = idev->cnf.seg6_enabled;
339 
340         if (!accept_seg6) {
341                 kfree_skb(skb);
342                 return -1;
343         }
344 
345 #ifdef CONFIG_IPV6_SEG6_HMAC
346         if (!seg6_hmac_validate_skb(skb)) {
347                 kfree_skb(skb);
348                 return -1;
349         }
350 #endif
351 
352 looped_back:
353         if (hdr->segments_left == 0) {
354                 if (hdr->nexthdr == NEXTHDR_IPV6) {
355                         int offset = (hdr->hdrlen + 1) << 3;
356 
357                         skb_postpull_rcsum(skb, skb_network_header(skb),
358                                            skb_network_header_len(skb));
359 
360                         if (!pskb_pull(skb, offset)) {
361                                 kfree_skb(skb);
362                                 return -1;
363                         }
364                         skb_postpull_rcsum(skb, skb_transport_header(skb),
365                                            offset);
366 
367                         skb_reset_network_header(skb);
368                         skb_reset_transport_header(skb);
369                         skb->encapsulation = 0;
370 
371                         __skb_tunnel_rx(skb, skb->dev, net);
372 
373                         netif_rx(skb);
374                         return -1;
375                 }
376 
377                 opt->srcrt = skb_network_header_len(skb);
378                 opt->lastopt = opt->srcrt;
379                 skb->transport_header += (hdr->hdrlen + 1) << 3;
380                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
381 
382                 return 1;
383         }
384 
385         if (hdr->segments_left >= (hdr->hdrlen >> 1)) {
386                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
387                                 IPSTATS_MIB_INHDRERRORS);
388                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
389                                   ((&hdr->segments_left) -
390                                    skb_network_header(skb)));
391                 return -1;
392         }
393 
394         if (skb_cloned(skb)) {
395                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
396                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
397                                         IPSTATS_MIB_OUTDISCARDS);
398                         kfree_skb(skb);
399                         return -1;
400                 }
401         }
402 
403         hdr = (struct ipv6_sr_hdr *)skb_transport_header(skb);
404 
405         hdr->segments_left--;
406         addr = hdr->segments + hdr->segments_left;
407 
408         skb_push(skb, sizeof(struct ipv6hdr));
409 
410         if (skb->ip_summed == CHECKSUM_COMPLETE)
411                 seg6_update_csum(skb);
412 
413         ipv6_hdr(skb)->daddr = *addr;
414 
415         skb_dst_drop(skb);
416 
417         ip6_route_input(skb);
418 
419         if (skb_dst(skb)->error) {
420                 dst_input(skb);
421                 return -1;
422         }
423 
424         if (skb_dst(skb)->dev->flags & IFF_LOOPBACK) {
425                 if (ipv6_hdr(skb)->hop_limit <= 1) {
426                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
427                                         IPSTATS_MIB_INHDRERRORS);
428                         icmpv6_send(skb, ICMPV6_TIME_EXCEED,
429                                     ICMPV6_EXC_HOPLIMIT, 0);
430                         kfree_skb(skb);
431                         return -1;
432                 }
433                 ipv6_hdr(skb)->hop_limit--;
434 
435                 skb_pull(skb, sizeof(struct ipv6hdr));
436                 goto looped_back;
437         }
438 
439         dst_input(skb);
440 
441         return -1;
442 }
443 
444 /********************************
445   Routing header.
446  ********************************/
447 
448 /* called with rcu_read_lock() */
449 static int ipv6_rthdr_rcv(struct sk_buff *skb)
450 {
451         struct inet6_skb_parm *opt = IP6CB(skb);
452         struct in6_addr *addr = NULL;
453         struct in6_addr daddr;
454         struct inet6_dev *idev;
455         int n, i;
456         struct ipv6_rt_hdr *hdr;
457         struct rt0_hdr *rthdr;
458         struct net *net = dev_net(skb->dev);
459         int accept_source_route = net->ipv6.devconf_all->accept_source_route;
460 
461         idev = __in6_dev_get(skb->dev);
462         if (idev && accept_source_route > idev->cnf.accept_source_route)
463                 accept_source_route = idev->cnf.accept_source_route;
464 
465         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
466             !pskb_may_pull(skb, (skb_transport_offset(skb) +
467                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
468                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
469                                 IPSTATS_MIB_INHDRERRORS);
470                 kfree_skb(skb);
471                 return -1;
472         }
473 
474         hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
475 
476         if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) ||
477             skb->pkt_type != PACKET_HOST) {
478                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
479                                 IPSTATS_MIB_INADDRERRORS);
480                 kfree_skb(skb);
481                 return -1;
482         }
483 
484         /* segment routing */
485         if (hdr->type == IPV6_SRCRT_TYPE_4)
486                 return ipv6_srh_rcv(skb);
487 
488 looped_back:
489         if (hdr->segments_left == 0) {
490                 switch (hdr->type) {
491 #if IS_ENABLED(CONFIG_IPV6_MIP6)
492                 case IPV6_SRCRT_TYPE_2:
493                         /* Silently discard type 2 header unless it was
494                          * processed by own
495                          */
496                         if (!addr) {
497                                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
498                                                 IPSTATS_MIB_INADDRERRORS);
499                                 kfree_skb(skb);
500                                 return -1;
501                         }
502                         break;
503 #endif
504                 default:
505                         break;
506                 }
507 
508                 opt->lastopt = opt->srcrt = skb_network_header_len(skb);
509                 skb->transport_header += (hdr->hdrlen + 1) << 3;
510                 opt->dst0 = opt->dst1;
511                 opt->dst1 = 0;
512                 opt->nhoff = (&hdr->nexthdr) - skb_network_header(skb);
513                 return 1;
514         }
515 
516         switch (hdr->type) {
517 #if IS_ENABLED(CONFIG_IPV6_MIP6)
518         case IPV6_SRCRT_TYPE_2:
519                 if (accept_source_route < 0)
520                         goto unknown_rh;
521                 /* Silently discard invalid RTH type 2 */
522                 if (hdr->hdrlen != 2 || hdr->segments_left != 1) {
523                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
524                                         IPSTATS_MIB_INHDRERRORS);
525                         kfree_skb(skb);
526                         return -1;
527                 }
528                 break;
529 #endif
530         default:
531                 goto unknown_rh;
532         }
533 
534         /*
535          *      This is the routing header forwarding algorithm from
536          *      RFC 2460, page 16.
537          */
538 
539         n = hdr->hdrlen >> 1;
540 
541         if (hdr->segments_left > n) {
542                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
543                                 IPSTATS_MIB_INHDRERRORS);
544                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
545                                   ((&hdr->segments_left) -
546                                    skb_network_header(skb)));
547                 return -1;
548         }
549 
550         /* We are about to mangle packet header. Be careful!
551            Do not damage packets queued somewhere.
552          */
553         if (skb_cloned(skb)) {
554                 /* the copy is a forwarded packet */
555                 if (pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) {
556                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
557                                         IPSTATS_MIB_OUTDISCARDS);
558                         kfree_skb(skb);
559                         return -1;
560                 }
561                 hdr = (struct ipv6_rt_hdr *)skb_transport_header(skb);
562         }
563 
564         if (skb->ip_summed == CHECKSUM_COMPLETE)
565                 skb->ip_summed = CHECKSUM_NONE;
566 
567         i = n - --hdr->segments_left;
568 
569         rthdr = (struct rt0_hdr *) hdr;
570         addr = rthdr->addr;
571         addr += i - 1;
572 
573         switch (hdr->type) {
574 #if IS_ENABLED(CONFIG_IPV6_MIP6)
575         case IPV6_SRCRT_TYPE_2:
576                 if (xfrm6_input_addr(skb, (xfrm_address_t *)addr,
577                                      (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
578                                      IPPROTO_ROUTING) < 0) {
579                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
580                                         IPSTATS_MIB_INADDRERRORS);
581                         kfree_skb(skb);
582                         return -1;
583                 }
584                 if (!ipv6_chk_home_addr(dev_net(skb_dst(skb)->dev), addr)) {
585                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
586                                         IPSTATS_MIB_INADDRERRORS);
587                         kfree_skb(skb);
588                         return -1;
589                 }
590                 break;
591 #endif
592         default:
593                 break;
594         }
595 
596         if (ipv6_addr_is_multicast(addr)) {
597                 __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
598                                 IPSTATS_MIB_INADDRERRORS);
599                 kfree_skb(skb);
600                 return -1;
601         }
602 
603         daddr = *addr;
604         *addr = ipv6_hdr(skb)->daddr;
605         ipv6_hdr(skb)->daddr = daddr;
606 
607         skb_dst_drop(skb);
608         ip6_route_input(skb);
609         if (skb_dst(skb)->error) {
610                 skb_push(skb, skb->data - skb_network_header(skb));
611                 dst_input(skb);
612                 return -1;
613         }
614 
615         if (skb_dst(skb)->dev->flags&IFF_LOOPBACK) {
616                 if (ipv6_hdr(skb)->hop_limit <= 1) {
617                         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
618                                         IPSTATS_MIB_INHDRERRORS);
619                         icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
620                                     0);
621                         kfree_skb(skb);
622                         return -1;
623                 }
624                 ipv6_hdr(skb)->hop_limit--;
625                 goto looped_back;
626         }
627 
628         skb_push(skb, skb->data - skb_network_header(skb));
629         dst_input(skb);
630         return -1;
631 
632 unknown_rh:
633         __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_INHDRERRORS);
634         icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
635                           (&hdr->type) - skb_network_header(skb));
636         return -1;
637 }
638 
639 static const struct inet6_protocol rthdr_protocol = {
640         .handler        =       ipv6_rthdr_rcv,
641         .flags          =       INET6_PROTO_NOPOLICY,
642 };
643 
644 static const struct inet6_protocol destopt_protocol = {
645         .handler        =       ipv6_destopt_rcv,
646         .flags          =       INET6_PROTO_NOPOLICY,
647 };
648 
649 static const struct inet6_protocol nodata_protocol = {
650         .handler        =       dst_discard,
651         .flags          =       INET6_PROTO_NOPOLICY,
652 };
653 
654 int __init ipv6_exthdrs_init(void)
655 {
656         int ret;
657 
658         ret = inet6_add_protocol(&rthdr_protocol, IPPROTO_ROUTING);
659         if (ret)
660                 goto out;
661 
662         ret = inet6_add_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
663         if (ret)
664                 goto out_rthdr;
665 
666         ret = inet6_add_protocol(&nodata_protocol, IPPROTO_NONE);
667         if (ret)
668                 goto out_destopt;
669 
670 out:
671         return ret;
672 out_destopt:
673         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
674 out_rthdr:
675         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
676         goto out;
677 };
678 
679 void ipv6_exthdrs_exit(void)
680 {
681         inet6_del_protocol(&nodata_protocol, IPPROTO_NONE);
682         inet6_del_protocol(&destopt_protocol, IPPROTO_DSTOPTS);
683         inet6_del_protocol(&rthdr_protocol, IPPROTO_ROUTING);
684 }
685 
686 /**********************************
687   Hop-by-hop options.
688  **********************************/
689 
690 /*
691  * Note: we cannot rely on skb_dst(skb) before we assign it in ip6_route_input().
692  */
693 static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
694 {
695         return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
696 }
697 
698 static inline struct net *ipv6_skb_net(struct sk_buff *skb)
699 {
700         return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
701 }
702 
703 /* Router Alert as of RFC 2711 */
704 
705 static bool ipv6_hop_ra(struct sk_buff *skb, int optoff)
706 {
707         const unsigned char *nh = skb_network_header(skb);
708 
709         if (nh[optoff + 1] == 2) {
710                 IP6CB(skb)->flags |= IP6SKB_ROUTERALERT;
711                 memcpy(&IP6CB(skb)->ra, nh + optoff + 2, sizeof(IP6CB(skb)->ra));
712                 return true;
713         }
714         net_dbg_ratelimited("ipv6_hop_ra: wrong RA length %d\n",
715                             nh[optoff + 1]);
716         kfree_skb(skb);
717         return false;
718 }
719 
720 /* Jumbo payload */
721 
722 static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
723 {
724         const unsigned char *nh = skb_network_header(skb);
725         struct net *net = ipv6_skb_net(skb);
726         u32 pkt_len;
727 
728         if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
729                 net_dbg_ratelimited("ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
730                                     nh[optoff+1]);
731                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
732                                 IPSTATS_MIB_INHDRERRORS);
733                 goto drop;
734         }
735 
736         pkt_len = ntohl(*(__be32 *)(nh + optoff + 2));
737         if (pkt_len <= IPV6_MAXPLEN) {
738                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
739                                 IPSTATS_MIB_INHDRERRORS);
740                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
741                 return false;
742         }
743         if (ipv6_hdr(skb)->payload_len) {
744                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
745                                 IPSTATS_MIB_INHDRERRORS);
746                 icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
747                 return false;
748         }
749 
750         if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
751                 __IP6_INC_STATS(net, ipv6_skb_idev(skb),
752                                 IPSTATS_MIB_INTRUNCATEDPKTS);
753                 goto drop;
754         }
755 
756         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
757                 goto drop;
758 
759         IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
760         return true;
761 
762 drop:
763         kfree_skb(skb);
764         return false;
765 }
766 
767 /* CALIPSO RFC 5570 */
768 
769 static bool ipv6_hop_calipso(struct sk_buff *skb, int optoff)
770 {
771         const unsigned char *nh = skb_network_header(skb);
772 
773         if (nh[optoff + 1] < 8)
774                 goto drop;
775 
776         if (nh[optoff + 6] * 4 + 8 > nh[optoff + 1])
777                 goto drop;
778 
779         if (!calipso_validate(skb, nh + optoff))
780                 goto drop;
781 
782         return true;
783 
784 drop:
785         kfree_skb(skb);
786         return false;
787 }
788 
789 static const struct tlvtype_proc tlvprochopopt_lst[] = {
790         {
791                 .type   = IPV6_TLV_ROUTERALERT,
792                 .func   = ipv6_hop_ra,
793         },
794         {
795                 .type   = IPV6_TLV_JUMBO,
796                 .func   = ipv6_hop_jumbo,
797         },
798         {
799                 .type   = IPV6_TLV_CALIPSO,
800                 .func   = ipv6_hop_calipso,
801         },
802         { -1, }
803 };
804 
805 int ipv6_parse_hopopts(struct sk_buff *skb)
806 {
807         struct inet6_skb_parm *opt = IP6CB(skb);
808 
809         /*
810          * skb_network_header(skb) is equal to skb->data, and
811          * skb_network_header_len(skb) is always equal to
812          * sizeof(struct ipv6hdr) by definition of
813          * hop-by-hop options.
814          */
815         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + 8) ||
816             !pskb_may_pull(skb, (sizeof(struct ipv6hdr) +
817                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
818                 kfree_skb(skb);
819                 return -1;
820         }
821 
822         opt->flags |= IP6SKB_HOPBYHOP;
823         if (ip6_parse_tlv(tlvprochopopt_lst, skb)) {
824                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
825                 opt = IP6CB(skb);
826                 opt->nhoff = sizeof(struct ipv6hdr);
827                 return 1;
828         }
829         return -1;
830 }
831 
832 /*
833  *      Creating outbound headers.
834  *
835  *      "build" functions work when skb is filled from head to tail (datagram)
836  *      "push"  functions work when headers are added from tail to head (tcp)
837  *
838  *      In both cases we assume, that caller reserved enough room
839  *      for headers.
840  */
841 
842 static void ipv6_push_rthdr0(struct sk_buff *skb, u8 *proto,
843                              struct ipv6_rt_hdr *opt,
844                              struct in6_addr **addr_p, struct in6_addr *saddr)
845 {
846         struct rt0_hdr *phdr, *ihdr;
847         int hops;
848 
849         ihdr = (struct rt0_hdr *) opt;
850 
851         phdr = skb_push(skb, (ihdr->rt_hdr.hdrlen + 1) << 3);
852         memcpy(phdr, ihdr, sizeof(struct rt0_hdr));
853 
854         hops = ihdr->rt_hdr.hdrlen >> 1;
855 
856         if (hops > 1)
857                 memcpy(phdr->addr, ihdr->addr + 1,
858                        (hops - 1) * sizeof(struct in6_addr));
859 
860         phdr->addr[hops - 1] = **addr_p;
861         *addr_p = ihdr->addr;
862 
863         phdr->rt_hdr.nexthdr = *proto;
864         *proto = NEXTHDR_ROUTING;
865 }
866 
867 static void ipv6_push_rthdr4(struct sk_buff *skb, u8 *proto,
868                              struct ipv6_rt_hdr *opt,
869                              struct in6_addr **addr_p, struct in6_addr *saddr)
870 {
871         struct ipv6_sr_hdr *sr_phdr, *sr_ihdr;
872         int plen, hops;
873 
874         sr_ihdr = (struct ipv6_sr_hdr *)opt;
875         plen = (sr_ihdr->hdrlen + 1) << 3;
876 
877         sr_phdr = skb_push(skb, plen);
878         memcpy(sr_phdr, sr_ihdr, sizeof(struct ipv6_sr_hdr));
879 
880         hops = sr_ihdr->first_segment + 1;
881         memcpy(sr_phdr->segments + 1, sr_ihdr->segments + 1,
882                (hops - 1) * sizeof(struct in6_addr));
883 
884         sr_phdr->segments[0] = **addr_p;
885         *addr_p = &sr_ihdr->segments[hops - 1];
886 
887 #ifdef CONFIG_IPV6_SEG6_HMAC
888         if (sr_has_hmac(sr_phdr)) {
889                 struct net *net = NULL;
890 
891                 if (skb->dev)
892                         net = dev_net(skb->dev);
893                 else if (skb->sk)
894                         net = sock_net(skb->sk);
895 
896                 WARN_ON(!net);
897 
898                 if (net)
899                         seg6_push_hmac(net, saddr, sr_phdr);
900         }
901 #endif
902 
903         sr_phdr->nexthdr = *proto;
904         *proto = NEXTHDR_ROUTING;
905 }
906 
907 static void ipv6_push_rthdr(struct sk_buff *skb, u8 *proto,
908                             struct ipv6_rt_hdr *opt,
909                             struct in6_addr **addr_p, struct in6_addr *saddr)
910 {
911         switch (opt->type) {
912         case IPV6_SRCRT_TYPE_0:
913         case IPV6_SRCRT_STRICT:
914         case IPV6_SRCRT_TYPE_2:
915                 ipv6_push_rthdr0(skb, proto, opt, addr_p, saddr);
916                 break;
917         case IPV6_SRCRT_TYPE_4:
918                 ipv6_push_rthdr4(skb, proto, opt, addr_p, saddr);
919                 break;
920         default:
921                 break;
922         }
923 }
924 
925 static void ipv6_push_exthdr(struct sk_buff *skb, u8 *proto, u8 type, struct ipv6_opt_hdr *opt)
926 {
927         struct ipv6_opt_hdr *h = skb_push(skb, ipv6_optlen(opt));
928 
929         memcpy(h, opt, ipv6_optlen(opt));
930         h->nexthdr = *proto;
931         *proto = type;
932 }
933 
934 void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
935                           u8 *proto,
936                           struct in6_addr **daddr, struct in6_addr *saddr)
937 {
938         if (opt->srcrt) {
939                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr, saddr);
940                 /*
941                  * IPV6_RTHDRDSTOPTS is ignored
942                  * unless IPV6_RTHDR is set (RFC3542).
943                  */
944                 if (opt->dst0opt)
945                         ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
946         }
947         if (opt->hopopt)
948                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
949 }
950 
951 void ipv6_push_frag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt, u8 *proto)
952 {
953         if (opt->dst1opt)
954                 ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst1opt);
955 }
956 EXPORT_SYMBOL(ipv6_push_frag_opts);
957 
958 struct ipv6_txoptions *
959 ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
960 {
961         struct ipv6_txoptions *opt2;
962 
963         opt2 = sock_kmalloc(sk, opt->tot_len, GFP_ATOMIC);
964         if (opt2) {
965                 long dif = (char *)opt2 - (char *)opt;
966                 memcpy(opt2, opt, opt->tot_len);
967                 if (opt2->hopopt)
968                         *((char **)&opt2->hopopt) += dif;
969                 if (opt2->dst0opt)
970                         *((char **)&opt2->dst0opt) += dif;
971                 if (opt2->dst1opt)
972                         *((char **)&opt2->dst1opt) += dif;
973                 if (opt2->srcrt)
974                         *((char **)&opt2->srcrt) += dif;
975                 refcount_set(&opt2->refcnt, 1);
976         }
977         return opt2;
978 }
979 EXPORT_SYMBOL_GPL(ipv6_dup_options);
980 
981 static int ipv6_renew_option(void *ohdr,
982                              struct ipv6_opt_hdr __user *newopt, int newoptlen,
983                              int inherit,
984                              struct ipv6_opt_hdr **hdr,
985                              char **p)
986 {
987         if (inherit) {
988                 if (ohdr) {
989                         memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
990                         *hdr = (struct ipv6_opt_hdr *)*p;
991                         *p += CMSG_ALIGN(ipv6_optlen(*hdr));
992                 }
993         } else {
994                 if (newopt) {
995                         if (copy_from_user(*p, newopt, newoptlen))
996                                 return -EFAULT;
997                         *hdr = (struct ipv6_opt_hdr *)*p;
998                         if (ipv6_optlen(*hdr) > newoptlen)
999                                 return -EINVAL;
1000                         *p += CMSG_ALIGN(newoptlen);
1001                 }
1002         }
1003         return 0;
1004 }
1005 
1006 /**
1007  * ipv6_renew_options - replace a specific ext hdr with a new one.
1008  *
1009  * @sk: sock from which to allocate memory
1010  * @opt: original options
1011  * @newtype: option type to replace in @opt
1012  * @newopt: new option of type @newtype to replace (user-mem)
1013  * @newoptlen: length of @newopt
1014  *
1015  * Returns a new set of options which is a copy of @opt with the
1016  * option type @newtype replaced with @newopt.
1017  *
1018  * @opt may be NULL, in which case a new set of options is returned
1019  * containing just @newopt.
1020  *
1021  * @newopt may be NULL, in which case the specified option type is
1022  * not copied into the new set of options.
1023  *
1024  * The new set of options is allocated from the socket option memory
1025  * buffer of @sk.
1026  */
1027 struct ipv6_txoptions *
1028 ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
1029                    int newtype,
1030                    struct ipv6_opt_hdr __user *newopt, int newoptlen)
1031 {
1032         int tot_len = 0;
1033         char *p;
1034         struct ipv6_txoptions *opt2;
1035         int err;
1036 
1037         if (opt) {
1038                 if (newtype != IPV6_HOPOPTS && opt->hopopt)
1039                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
1040                 if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
1041                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
1042                 if (newtype != IPV6_RTHDR && opt->srcrt)
1043                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
1044                 if (newtype != IPV6_DSTOPTS && opt->dst1opt)
1045                         tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
1046         }
1047 
1048         if (newopt && newoptlen)
1049                 tot_len += CMSG_ALIGN(newoptlen);
1050 
1051         if (!tot_len)
1052                 return NULL;
1053 
1054         tot_len += sizeof(*opt2);
1055         opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
1056         if (!opt2)
1057                 return ERR_PTR(-ENOBUFS);
1058 
1059         memset(opt2, 0, tot_len);
1060         refcount_set(&opt2->refcnt, 1);
1061         opt2->tot_len = tot_len;
1062         p = (char *)(opt2 + 1);
1063 
1064         err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
1065                                 newtype != IPV6_HOPOPTS,
1066                                 &opt2->hopopt, &p);
1067         if (err)
1068                 goto out;
1069 
1070         err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
1071                                 newtype != IPV6_RTHDRDSTOPTS,
1072                                 &opt2->dst0opt, &p);
1073         if (err)
1074                 goto out;
1075 
1076         err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
1077                                 newtype != IPV6_RTHDR,
1078                                 (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
1079         if (err)
1080                 goto out;
1081 
1082         err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
1083                                 newtype != IPV6_DSTOPTS,
1084                                 &opt2->dst1opt, &p);
1085         if (err)
1086                 goto out;
1087 
1088         opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
1089                           (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
1090                           (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
1091         opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
1092 
1093         return opt2;
1094 out:
1095         sock_kfree_s(sk, opt2, opt2->tot_len);
1096         return ERR_PTR(err);
1097 }
1098 
1099 /**
1100  * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
1101  *
1102  * @sk: sock from which to allocate memory
1103  * @opt: original options
1104  * @newtype: option type to replace in @opt
1105  * @newopt: new option of type @newtype to replace (kernel-mem)
1106  * @newoptlen: length of @newopt
1107  *
1108  * See ipv6_renew_options().  The difference is that @newopt is
1109  * kernel memory, rather than user memory.
1110  */
1111 struct ipv6_txoptions *
1112 ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
1113                         int newtype, struct ipv6_opt_hdr *newopt,
1114                         int newoptlen)
1115 {
1116         struct ipv6_txoptions *ret_val;
1117         const mm_segment_t old_fs = get_fs();
1118 
1119         set_fs(KERNEL_DS);
1120         ret_val = ipv6_renew_options(sk, opt, newtype,
1121                                      (struct ipv6_opt_hdr __user *)newopt,
1122                                      newoptlen);
1123         set_fs(old_fs);
1124         return ret_val;
1125 }
1126 
1127 struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
1128                                           struct ipv6_txoptions *opt)
1129 {
1130         /*
1131          * ignore the dest before srcrt unless srcrt is being included.
1132          * --yoshfuji
1133          */
1134         if (opt && opt->dst0opt && !opt->srcrt) {
1135                 if (opt_space != opt) {
1136                         memcpy(opt_space, opt, sizeof(*opt_space));
1137                         opt = opt_space;
1138                 }
1139                 opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
1140                 opt->dst0opt = NULL;
1141         }
1142 
1143         return opt;
1144 }
1145 EXPORT_SYMBOL_GPL(ipv6_fixup_options);
1146 
1147 /**
1148  * fl6_update_dst - update flowi destination address with info given
1149  *                  by srcrt option, if any.
1150  *
1151  * @fl6: flowi6 for which daddr is to be updated
1152  * @opt: struct ipv6_txoptions in which to look for srcrt opt
1153  * @orig: copy of original daddr address if modified
1154  *
1155  * Returns NULL if no txoptions or no srcrt, otherwise returns orig
1156  * and initial value of fl6->daddr set in orig
1157  */
1158 struct in6_addr *fl6_update_dst(struct flowi6 *fl6,
1159                                 const struct ipv6_txoptions *opt,
1160                                 struct in6_addr *orig)
1161 {
1162         if (!opt || !opt->srcrt)
1163                 return NULL;
1164 
1165         *orig = fl6->daddr;
1166 
1167         switch (opt->srcrt->type) {
1168         case IPV6_SRCRT_TYPE_0:
1169         case IPV6_SRCRT_STRICT:
1170         case IPV6_SRCRT_TYPE_2:
1171                 fl6->daddr = *((struct rt0_hdr *)opt->srcrt)->addr;
1172                 break;
1173         case IPV6_SRCRT_TYPE_4:
1174         {
1175                 struct ipv6_sr_hdr *srh = (struct ipv6_sr_hdr *)opt->srcrt;
1176 
1177                 fl6->daddr = srh->segments[srh->first_segment];
1178                 break;
1179         }
1180         default:
1181                 return NULL;
1182         }
1183 
1184         return orig;
1185 }
1186 EXPORT_SYMBOL_GPL(fl6_update_dst);
1187 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp