[linux-2.6-block.git] / net / ipv6 / mcast_snoop.c

// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
 * Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue>
 *
 * Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki.
 */

#include <linux/skbuff.h>
#include <net/ipv6.h>
#include <net/mld.h>
#include <net/addrconf.h>
#include <net/ip6_checksum.h>

static int ipv6_mc_check_ip6hdr(struct sk_buff *skb)
{
	const struct ipv6hdr *ip6h;
	unsigned int len;
	unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h);

	if (!pskb_may_pull(skb, offset))
		return -EINVAL;

	ip6h = ipv6_hdr(skb);

	if (ip6h->version != 6)
		return -EINVAL;

	len = offset + ntohs(ip6h->payload_len);
	if (skb->len < len || len <= offset)
		return -EINVAL;

	skb_set_transport_header(skb, offset);

	return 0;
}

static int ipv6_mc_check_exthdrs(struct sk_buff *skb)
{
	const struct ipv6hdr *ip6h;
	int offset;
	u8 nexthdr;
	__be16 frag_off;

	ip6h = ipv6_hdr(skb);

	if (ip6h->nexthdr != IPPROTO_HOPOPTS)
		return -ENOMSG;

	nexthdr = ip6h->nexthdr;
	offset = skb_network_offset(skb) + sizeof(*ip6h);
	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);

	if (offset < 0)
		return -EINVAL;

	if (nexthdr != IPPROTO_ICMPV6)
		return -ENOMSG;

	skb_set_transport_header(skb, offset);

	return 0;
}

static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb)
{
	unsigned int len = skb_transport_offset(skb);

	len += sizeof(struct mld2_report);

	return ipv6_mc_may_pull(skb, len) ? 0 : -EINVAL;
}

static int ipv6_mc_check_mld_query(struct sk_buff *skb)
{
	unsigned int transport_len = ipv6_transport_len(skb);
	struct mld_msg *mld;
	unsigned int len;

	/* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
		return -EINVAL;

	/* MLDv1? */
	if (transport_len != sizeof(struct mld_msg)) {
		/* or MLDv2? */
		if (transport_len < sizeof(struct mld2_query))
			return -EINVAL;

		len = skb_transport_offset(skb) + sizeof(struct mld2_query);
		if (!ipv6_mc_may_pull(skb, len))
			return -EINVAL;
	}

	mld = (struct mld_msg *)skb_transport_header(skb);

	/* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
	 * all-nodes destination address (ff02::1) for general queries
	 */
	if (ipv6_addr_any(&mld->mld_mca) &&
	    !ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
		return -EINVAL;

	return 0;
}

static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
{
	unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg);
	struct mld_msg *mld;

	if (!ipv6_mc_may_pull(skb, len))
		return -EINVAL;

	mld = (struct mld_msg *)skb_transport_header(skb);

	switch (mld->mld_type) {
	case ICMPV6_MGM_REDUCTION:
	case ICMPV6_MGM_REPORT:
		return 0;
	case ICMPV6_MLD2_REPORT:
		return ipv6_mc_check_mld_reportv2(skb);
	case ICMPV6_MGM_QUERY:
		return ipv6_mc_check_mld_query(skb);
	default:
		return -ENOMSG;
	}
}

static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
{
	return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
}

int ipv6_mc_check_icmpv6(struct sk_buff *skb)
{
	unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
	unsigned int transport_len = ipv6_transport_len(skb);
	struct sk_buff *skb_chk;

	if (!ipv6_mc_may_pull(skb, len))
		return -EINVAL;

	skb_chk = skb_checksum_trimmed(skb, transport_len,
				       ipv6_mc_validate_checksum);
	if (!skb_chk)
		return -EINVAL;

	if (skb_chk != skb)
		kfree_skb(skb_chk);

	return 0;
}
EXPORT_SYMBOL(ipv6_mc_check_icmpv6);

/**
 * ipv6_mc_check_mld - checks whether this is a sane MLD packet
 * @skb: the skb to validate
 *
 * Checks whether an IPv6 packet is a valid MLD packet. If so sets
 * skb transport header accordingly and returns zero.
 *
 * -EINVAL: A broken packet was detected, i.e. it violates some internet
 *  standard
 * -ENOMSG: IP header validation succeeded but it is not an MLD packet.
 * -ENOMEM: A memory allocation failure happened.
 *
 * Caller needs to set the skb network header and free any returned skb if it
 * differs from the provided skb.
 */
int ipv6_mc_check_mld(struct sk_buff *skb)
{
	int ret;

	ret = ipv6_mc_check_ip6hdr(skb);
	if (ret < 0)
		return ret;

	ret = ipv6_mc_check_exthdrs(skb);
	if (ret < 0)
		return ret;

	ret = ipv6_mc_check_icmpv6(skb);
	if (ret < 0)
		return ret;

	return ipv6_mc_check_mld_msg(skb);
}
EXPORT_SYMBOL(ipv6_mc_check_mld);
Commit	Line	Data
b7c320ff	1	// SPDX-License-Identifier: GPL-2.0-only
9afd85c9 LL	2	/* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
	3	* Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue>
	4	*
9afd85c9 LL	5	* Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki.
	6	*/
	7
	8	#include <linux/skbuff.h>
	9	#include <net/ipv6.h>
	10	#include <net/mld.h>
	11	#include <net/addrconf.h>
	12	#include <net/ip6_checksum.h>
	13
	14	static int ipv6_mc_check_ip6hdr(struct sk_buff *skb)
	15	{
	16	const struct ipv6hdr *ip6h;
	17	unsigned int len;
	18	unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h);
	19
	20	if (!pskb_may_pull(skb, offset))
	21	return -EINVAL;
	22
	23	ip6h = ipv6_hdr(skb);
	24
	25	if (ip6h->version != 6)
	26	return -EINVAL;
	27
	28	len = offset + ntohs(ip6h->payload_len);
	29	if (skb->len < len \|\| len <= offset)
	30	return -EINVAL;
	31
4b3087c7 LL	32	skb_set_transport_header(skb, offset);
4b3087c7 LL	33
9afd85c9 LL	34	return 0;
	35	}
	36
	37	static int ipv6_mc_check_exthdrs(struct sk_buff *skb)
	38	{
	39	const struct ipv6hdr *ip6h;
fcba67c9	40	int offset;
9afd85c9 LL	41	u8 nexthdr;
	42	__be16 frag_off;
	43
	44	ip6h = ipv6_hdr(skb);
	45
	46	if (ip6h->nexthdr != IPPROTO_HOPOPTS)
	47	return -ENOMSG;
	48
	49	nexthdr = ip6h->nexthdr;
	50	offset = skb_network_offset(skb) + sizeof(*ip6h);
	51	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
	52
	53	if (offset < 0)
	54	return -EINVAL;
	55
	56	if (nexthdr != IPPROTO_ICMPV6)
	57	return -ENOMSG;
	58
	59	skb_set_transport_header(skb, offset);
	60
	61	return 0;
	62	}
	63
	64	static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb)
	65	{
	66	unsigned int len = skb_transport_offset(skb);
	67
	68	len += sizeof(struct mld2_report);
	69
a2e2ca3b	70	return ipv6_mc_may_pull(skb, len) ? 0 : -EINVAL;
9afd85c9 LL	71	}
	72
	73	static int ipv6_mc_check_mld_query(struct sk_buff *skb)
	74	{
a2e2ca3b	75	unsigned int transport_len = ipv6_transport_len(skb);
9afd85c9	76	struct mld_msg *mld;
a2e2ca3b	77	unsigned int len;
9afd85c9 LL	78
	79	/* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
	80	if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
	81	return -EINVAL;
	82
9afd85c9	83	/* MLDv1? */
a2e2ca3b	84	if (transport_len != sizeof(struct mld_msg)) {
9afd85c9	85	/* or MLDv2? */
a2e2ca3b LL	86	if (transport_len < sizeof(struct mld2_query))
	87	return -EINVAL;
	88
	89	len = skb_transport_offset(skb) + sizeof(struct mld2_query);
	90	if (!ipv6_mc_may_pull(skb, len))
9afd85c9 LL	91	return -EINVAL;
	92	}
	93
	94	mld = (struct mld_msg *)skb_transport_header(skb);
	95
	96	/* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
	97	* all-nodes destination address (ff02::1) for general queries
	98	*/
	99	if (ipv6_addr_any(&mld->mld_mca) &&
	100	!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
	101	return -EINVAL;
	102
	103	return 0;
	104	}
	105
	106	static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
	107	{
a2e2ca3b LL	108	unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg);
	109	struct mld_msg *mld;
	110
	111	if (!ipv6_mc_may_pull(skb, len))
	112	return -EINVAL;
	113
	114	mld = (struct mld_msg *)skb_transport_header(skb);
9afd85c9 LL	115
	116	switch (mld->mld_type) {
	117	case ICMPV6_MGM_REDUCTION:
	118	case ICMPV6_MGM_REPORT:
9afd85c9 LL	119	return 0;
	120	case ICMPV6_MLD2_REPORT:
	121	return ipv6_mc_check_mld_reportv2(skb);
	122	case ICMPV6_MGM_QUERY:
	123	return ipv6_mc_check_mld_query(skb);
	124	default:
	125	return -ENOMSG;
	126	}
	127	}
	128
	129	static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
	130	{
	131	return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
	132	}
	133
4b3087c7	134	int ipv6_mc_check_icmpv6(struct sk_buff *skb)
9afd85c9	135	{
a2e2ca3b LL	136	unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
	137	unsigned int transport_len = ipv6_transport_len(skb);
	138	struct sk_buff *skb_chk;
9afd85c9	139
a2e2ca3b LL	140	if (!ipv6_mc_may_pull(skb, len))
a2e2ca3b LL	141	return -EINVAL;
9afd85c9	142
9afd85c9 LL	143	skb_chk = skb_checksum_trimmed(skb, transport_len,
	144	ipv6_mc_validate_checksum);
	145	if (!skb_chk)
a2e2ca3b	146	return -EINVAL;
a516993f	147
a2e2ca3b	148	if (skb_chk != skb)
a516993f LL	149	kfree_skb(skb_chk);
a516993f LL	150
a2e2ca3b	151	return 0;
9afd85c9	152	}
4b3087c7	153	EXPORT_SYMBOL(ipv6_mc_check_icmpv6);
9afd85c9 LL	154
	155	/**
	156	* ipv6_mc_check_mld - checks whether this is a sane MLD packet
	157	* @skb: the skb to validate
9afd85c9 LL	158	*
9afd85c9 LL	159	* Checks whether an IPv6 packet is a valid MLD packet. If so sets
a516993f	160	* skb transport header accordingly and returns zero.
9afd85c9 LL	161	*
	162	* -EINVAL: A broken packet was detected, i.e. it violates some internet
	163	* standard
	164	* -ENOMSG: IP header validation succeeded but it is not an MLD packet.
	165	* -ENOMEM: A memory allocation failure happened.
	166	*
a516993f LL	167	* Caller needs to set the skb network header and free any returned skb if it
a516993f LL	168	* differs from the provided skb.
9afd85c9	169	*/
ba5ea614	170	int ipv6_mc_check_mld(struct sk_buff *skb)
9afd85c9 LL	171	{
	172	int ret;
	173
	174	ret = ipv6_mc_check_ip6hdr(skb);
	175	if (ret < 0)
	176	return ret;
	177
	178	ret = ipv6_mc_check_exthdrs(skb);
	179	if (ret < 0)
	180	return ret;
	181
a2e2ca3b LL	182	ret = ipv6_mc_check_icmpv6(skb);
	183	if (ret < 0)
	184	return ret;
	185
	186	return ipv6_mc_check_mld_msg(skb);
9afd85c9 LL	187	}
9afd85c9 LL	188	EXPORT_SYMBOL(ipv6_mc_check_mld);