1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Internet Control Message Protocol (ICMPv6)
4 * Linux INET6 implementation
7 * Pedro Roque <roque@di.fc.ul.pt>
9 * Based on net/ipv4/icmp.c
17 * Andi Kleen : exception handling
18 * Andi Kleen add rate limits. never reply to a icmp.
19 * add more length checks and other fixes.
20 * yoshfuji : ensure to sent parameter problem for
22 * YOSHIFUJI Hideaki @USAGI: added sysctl for icmp rate limit.
24 * YOSHIFUJI Hideaki @USAGI: Per-interface statistics support
25 * Kazunori MIYAZAWA @USAGI: change output process to use ip6_append_data
28 #define pr_fmt(fmt) "IPv6: " fmt
30 #include <linux/module.h>
31 #include <linux/errno.h>
32 #include <linux/types.h>
33 #include <linux/socket.h>
35 #include <linux/kernel.h>
36 #include <linux/sockios.h>
37 #include <linux/net.h>
38 #include <linux/skbuff.h>
39 #include <linux/init.h>
40 #include <linux/netfilter.h>
41 #include <linux/slab.h>
44 #include <linux/sysctl.h>
47 #include <linux/inet.h>
48 #include <linux/netdevice.h>
49 #include <linux/icmpv6.h>
55 #include <net/ip6_checksum.h>
57 #include <net/protocol.h>
59 #include <net/rawv6.h>
60 #include <net/transp_v6.h>
61 #include <net/ip6_route.h>
62 #include <net/addrconf.h>
65 #include <net/inet_common.h>
66 #include <net/dsfield.h>
67 #include <net/l3mdev.h>
69 #include <linux/uaccess.h>
72 * The ICMP socket(s). This is the most convenient way to flow control
73 * our ICMP output as well as maintain a clean interface throughout
74 * all layers. All Socketless IP sends will soon be gone.
76 * On SMP we have one ICMP socket per-cpu.
78 static struct sock *icmpv6_sk(struct net *net)
80 return this_cpu_read(*net->ipv6.icmp_sk);
83 static int icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
84 u8 type, u8 code, int offset, __be32 info)
86 /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
87 struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
88 struct net *net = dev_net(skb->dev);
90 if (type == ICMPV6_PKT_TOOBIG)
91 ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL));
92 else if (type == NDISC_REDIRECT)
93 ip6_redirect(skb, net, skb->dev->ifindex, 0,
94 sock_net_uid(net, NULL));
96 if (!(type & ICMPV6_INFOMSG_MASK))
97 if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
98 ping_err(skb, offset, ntohl(info));
103 static int icmpv6_rcv(struct sk_buff *skb);
105 static const struct inet6_protocol icmpv6_protocol = {
106 .handler = icmpv6_rcv,
107 .err_handler = icmpv6_err,
108 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
111 /* Called with BH disabled */
112 static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
117 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
118 /* This can happen if the output path (f.e. SIT or
119 * ip6ip6 tunnel) signals dst_link_failure() for an
120 * outgoing ICMP6 packet.
127 static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
129 spin_unlock(&sk->sk_lock.slock);
133 * Figure out, may we reply to this packet with icmp error.
135 * We do not reply, if:
136 * - it was icmp error message.
137 * - it is truncated, so that it is known, that protocol is ICMPV6
138 * (i.e. in the middle of some exthdr)
143 static bool is_ineligible(const struct sk_buff *skb)
145 int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
146 int len = skb->len - ptr;
147 __u8 nexthdr = ipv6_hdr(skb)->nexthdr;
153 ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
156 if (nexthdr == IPPROTO_ICMPV6) {
158 tp = skb_header_pointer(skb,
159 ptr+offsetof(struct icmp6hdr, icmp6_type),
160 sizeof(_type), &_type);
161 if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
167 static bool icmpv6_mask_allow(struct net *net, int type)
169 if (type > ICMPV6_MSG_MAX)
172 /* Limit if icmp type is set in ratemask. */
173 if (!test_bit(type, net->ipv6.sysctl.icmpv6_ratemask))
179 static bool icmpv6_global_allow(struct net *net, int type)
181 if (icmpv6_mask_allow(net, type))
184 if (icmp_global_allow())
191 * Check the ICMP output rate limit
193 static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
196 struct net *net = sock_net(sk);
197 struct dst_entry *dst;
200 if (icmpv6_mask_allow(net, type))
204 * Look up the output route.
205 * XXX: perhaps the expire for routing entries cloned by
206 * this lookup should be more aggressive (not longer than timeout).
208 dst = ip6_route_output(net, sk, fl6);
210 IP6_INC_STATS(net, ip6_dst_idev(dst),
211 IPSTATS_MIB_OUTNOROUTES);
212 } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
215 struct rt6_info *rt = (struct rt6_info *)dst;
216 int tmo = net->ipv6.sysctl.icmpv6_time;
217 struct inet_peer *peer;
219 /* Give more bandwidth to wider prefixes. */
220 if (rt->rt6i_dst.plen < 128)
221 tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
223 peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr, 1);
224 res = inet_peer_xrlim_allow(peer, tmo);
232 static bool icmpv6_rt_has_prefsrc(struct sock *sk, u8 type,
235 struct net *net = sock_net(sk);
236 struct dst_entry *dst;
239 dst = ip6_route_output(net, sk, fl6);
241 struct rt6_info *rt = (struct rt6_info *)dst;
242 struct in6_addr prefsrc;
244 rt6_get_prefsrc(rt, &prefsrc);
245 res = !ipv6_addr_any(&prefsrc);
252 * an inline helper for the "simple" if statement below
253 * checks if parameter problem report is caused by an
254 * unrecognized IPv6 option that has the Option Type
255 * highest-order two bits set to 10
258 static bool opt_unrec(struct sk_buff *skb, __u32 offset)
262 offset += skb_network_offset(skb);
263 op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
266 return (*op & 0xC0) == 0x80;
269 void icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
270 struct icmp6hdr *thdr, int len)
273 struct icmp6hdr *icmp6h;
275 skb = skb_peek(&sk->sk_write_queue);
279 icmp6h = icmp6_hdr(skb);
280 memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
281 icmp6h->icmp6_cksum = 0;
283 if (skb_queue_len(&sk->sk_write_queue) == 1) {
284 skb->csum = csum_partial(icmp6h,
285 sizeof(struct icmp6hdr), skb->csum);
286 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
288 len, fl6->flowi6_proto,
293 skb_queue_walk(&sk->sk_write_queue, skb) {
294 tmp_csum = csum_add(tmp_csum, skb->csum);
297 tmp_csum = csum_partial(icmp6h,
298 sizeof(struct icmp6hdr), tmp_csum);
299 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
301 len, fl6->flowi6_proto,
304 ip6_push_pending_frames(sk);
313 static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
315 struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
316 struct sk_buff *org_skb = msg->skb;
319 csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
321 skb->csum = csum_block_add(skb->csum, csum, odd);
322 if (!(msg->type & ICMPV6_INFOMSG_MASK))
323 nf_ct_attach(skb, org_skb);
327 #if IS_ENABLED(CONFIG_IPV6_MIP6)
328 static void mip6_addr_swap(struct sk_buff *skb)
330 struct ipv6hdr *iph = ipv6_hdr(skb);
331 struct inet6_skb_parm *opt = IP6CB(skb);
332 struct ipv6_destopt_hao *hao;
337 off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
338 if (likely(off >= 0)) {
339 hao = (struct ipv6_destopt_hao *)
340 (skb_network_header(skb) + off);
342 iph->saddr = hao->addr;
348 static inline void mip6_addr_swap(struct sk_buff *skb) {}
351 static struct dst_entry *icmpv6_route_lookup(struct net *net,
356 struct dst_entry *dst, *dst2;
360 err = ip6_dst_lookup(net, sk, &dst, fl6);
365 * We won't send icmp if the destination is known
368 if (ipv6_anycast_destination(dst, &fl6->daddr)) {
369 net_dbg_ratelimited("icmp6_send: acast source\n");
371 return ERR_PTR(-EINVAL);
374 /* No need to clone since we're just using its address. */
377 dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
382 if (PTR_ERR(dst) == -EPERM)
388 err = xfrm_decode_session_reverse(skb, flowi6_to_flowi(&fl2), AF_INET6);
390 goto relookup_failed;
392 err = ip6_dst_lookup(net, sk, &dst2, &fl2);
394 goto relookup_failed;
396 dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
406 goto relookup_failed;
415 static struct net_device *icmp6_dev(const struct sk_buff *skb)
417 struct net_device *dev = skb->dev;
419 /* for local traffic to local address, skb dev is the loopback
420 * device. Check if there is a dst attached to the skb and if so
421 * get the real device index. Same is needed for replies to a link
422 * local address on a device enslaved to an L3 master device
424 if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
425 const struct rt6_info *rt6 = skb_rt6_info(skb);
428 dev = rt6->rt6i_idev->dev;
434 static int icmp6_iif(const struct sk_buff *skb)
436 return icmp6_dev(skb)->ifindex;
440 * Send an ICMP message in response to a packet in error
442 void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
443 const struct in6_addr *force_saddr)
445 struct inet6_dev *idev = NULL;
446 struct ipv6hdr *hdr = ipv6_hdr(skb);
449 struct ipv6_pinfo *np;
450 const struct in6_addr *saddr = NULL;
451 struct dst_entry *dst;
452 struct icmp6hdr tmp_hdr;
454 struct icmpv6_msg msg;
455 struct ipcm6_cookie ipc6;
461 if ((u8 *)hdr < skb->head ||
462 (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
467 net = dev_net(skb->dev);
468 mark = IP6_REPLY_MARK(net, skb->mark);
470 * Make sure we respect the rules
471 * i.e. RFC 1885 2.4(e)
472 * Rule (e.1) is enforced by not using icmp6_send
473 * in any code that processes icmp errors.
475 addr_type = ipv6_addr_type(&hdr->daddr);
477 if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
478 ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
485 if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
486 if (type != ICMPV6_PKT_TOOBIG &&
487 !(type == ICMPV6_PARAMPROB &&
488 code == ICMPV6_UNK_OPTION &&
489 (opt_unrec(skb, info))))
495 addr_type = ipv6_addr_type(&hdr->saddr);
501 if (__ipv6_addr_needs_scope_id(addr_type)) {
502 iif = icmp6_iif(skb);
505 * The source device is used for looking up which routing table
506 * to use for sending an ICMP error.
508 iif = l3mdev_master_ifindex(skb->dev);
512 * Must not send error if the source does not uniquely
513 * identify a single node (RFC2463 Section 2.4).
514 * We check unspecified / multicast addresses here,
515 * and anycast addresses will be checked later.
517 if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
518 net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
519 &hdr->saddr, &hdr->daddr);
524 * Never answer to a ICMP packet.
526 if (is_ineligible(skb)) {
527 net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
528 &hdr->saddr, &hdr->daddr);
532 /* Needed by both icmp_global_allow and icmpv6_xmit_lock */
535 /* Check global sysctl_icmp_msgs_per_sec ratelimit */
536 if (!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, type))
541 sk = icmpv6_xmit_lock(net);
545 memset(&fl6, 0, sizeof(fl6));
546 fl6.flowi6_proto = IPPROTO_ICMPV6;
547 fl6.daddr = hdr->saddr;
552 } else if (!icmpv6_rt_has_prefsrc(sk, type, &fl6)) {
553 /* select a more meaningful saddr from input if */
554 struct net_device *in_netdev;
556 in_netdev = dev_get_by_index(net, IP6CB(skb)->iif);
558 ipv6_dev_get_saddr(net, in_netdev, &fl6.daddr,
559 inet6_sk(sk)->srcprefs,
564 fl6.flowi6_mark = mark;
565 fl6.flowi6_oif = iif;
566 fl6.fl6_icmp_type = type;
567 fl6.fl6_icmp_code = code;
568 fl6.flowi6_uid = sock_net_uid(net, NULL);
569 fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL);
570 security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
574 if (!icmpv6_xrlim_allow(sk, type, &fl6))
577 tmp_hdr.icmp6_type = type;
578 tmp_hdr.icmp6_code = code;
579 tmp_hdr.icmp6_cksum = 0;
580 tmp_hdr.icmp6_pointer = htonl(info);
582 if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
583 fl6.flowi6_oif = np->mcast_oif;
584 else if (!fl6.flowi6_oif)
585 fl6.flowi6_oif = np->ucast_oif;
587 ipcm6_init_sk(&ipc6, np);
588 ipc6.sockc.mark = mark;
589 fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
591 dst = icmpv6_route_lookup(net, skb, sk, &fl6);
595 ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
598 msg.offset = skb_network_offset(skb);
601 len = skb->len - msg.offset;
602 len = min_t(unsigned int, len, IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr));
604 net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
605 &hdr->saddr, &hdr->daddr);
606 goto out_dst_release;
610 idev = __in6_dev_get(skb->dev);
612 if (ip6_append_data(sk, icmpv6_getfrag, &msg,
613 len + sizeof(struct icmp6hdr),
614 sizeof(struct icmp6hdr),
615 &ipc6, &fl6, (struct rt6_info *)dst,
617 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
618 ip6_flush_pending_frames(sk);
620 icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
621 len + sizeof(struct icmp6hdr));
627 icmpv6_xmit_unlock(sk);
631 EXPORT_SYMBOL(icmp6_send);
633 /* Slightly more convenient version of icmp6_send.
635 void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
637 icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL);
641 /* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
642 * if sufficient data bytes are available
643 * @nhs is the size of the tunnel header(s) :
644 * Either an IPv4 header for SIT encap
645 * an IPv4 header + GRE header for GRE encap
647 int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
648 unsigned int data_len)
650 struct in6_addr temp_saddr;
652 struct sk_buff *skb2;
655 if (!pskb_may_pull(skb, nhs + sizeof(struct ipv6hdr) + 8))
658 /* RFC 4884 (partial) support for ICMP extensions */
659 if (data_len < 128 || (data_len & 7) || skb->len < data_len)
662 skb2 = data_len ? skb_copy(skb, GFP_ATOMIC) : skb_clone(skb, GFP_ATOMIC);
669 skb_reset_network_header(skb2);
671 rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr, NULL, 0,
674 if (rt && rt->dst.dev)
675 skb2->dev = rt->dst.dev;
677 ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, &temp_saddr);
680 /* RFC 4884 (partial) support :
681 * insert 0 padding at the end, before the extensions
683 __skb_push(skb2, nhs);
684 skb_reset_network_header(skb2);
685 memmove(skb2->data, skb2->data + nhs, data_len - nhs);
686 memset(skb2->data + data_len - nhs, 0, nhs);
687 /* RFC 4884 4.5 : Length is measured in 64-bit words,
688 * and stored in reserved[0]
690 info = (data_len/8) << 24;
692 if (type == ICMP_TIME_EXCEEDED)
693 icmp6_send(skb2, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
696 icmp6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH,
705 EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach);
707 static void icmpv6_echo_reply(struct sk_buff *skb)
709 struct net *net = dev_net(skb->dev);
711 struct inet6_dev *idev;
712 struct ipv6_pinfo *np;
713 const struct in6_addr *saddr = NULL;
714 struct icmp6hdr *icmph = icmp6_hdr(skb);
715 struct icmp6hdr tmp_hdr;
717 struct icmpv6_msg msg;
718 struct dst_entry *dst;
719 struct ipcm6_cookie ipc6;
720 u32 mark = IP6_REPLY_MARK(net, skb->mark);
723 if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) &&
724 net->ipv6.sysctl.icmpv6_echo_ignore_multicast)
727 saddr = &ipv6_hdr(skb)->daddr;
729 acast = ipv6_anycast_destination(skb_dst(skb), saddr);
730 if (acast && net->ipv6.sysctl.icmpv6_echo_ignore_anycast)
733 if (!ipv6_unicast_destination(skb) &&
734 !(net->ipv6.sysctl.anycast_src_echo_reply && acast))
737 memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
738 tmp_hdr.icmp6_type = ICMPV6_ECHO_REPLY;
740 memset(&fl6, 0, sizeof(fl6));
741 if (net->ipv6.sysctl.flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
742 fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb));
744 fl6.flowi6_proto = IPPROTO_ICMPV6;
745 fl6.daddr = ipv6_hdr(skb)->saddr;
748 fl6.flowi6_oif = icmp6_iif(skb);
749 fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
750 fl6.flowi6_mark = mark;
751 fl6.flowi6_uid = sock_net_uid(net, NULL);
752 security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
755 sk = icmpv6_xmit_lock(net);
760 if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
761 fl6.flowi6_oif = np->mcast_oif;
762 else if (!fl6.flowi6_oif)
763 fl6.flowi6_oif = np->ucast_oif;
765 if (ip6_dst_lookup(net, sk, &dst, &fl6))
767 dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
771 /* Check the ratelimit */
772 if ((!(skb->dev->flags & IFF_LOOPBACK) && !icmpv6_global_allow(net, ICMPV6_ECHO_REPLY)) ||
773 !icmpv6_xrlim_allow(sk, ICMPV6_ECHO_REPLY, &fl6))
774 goto out_dst_release;
776 idev = __in6_dev_get(skb->dev);
780 msg.type = ICMPV6_ECHO_REPLY;
782 ipcm6_init_sk(&ipc6, np);
783 ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
784 ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb));
785 ipc6.sockc.mark = mark;
787 if (ip6_append_data(sk, icmpv6_getfrag, &msg,
788 skb->len + sizeof(struct icmp6hdr),
789 sizeof(struct icmp6hdr), &ipc6, &fl6,
790 (struct rt6_info *)dst, MSG_DONTWAIT)) {
791 __ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
792 ip6_flush_pending_frames(sk);
794 icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
795 skb->len + sizeof(struct icmp6hdr));
800 icmpv6_xmit_unlock(sk);
805 void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
807 const struct inet6_protocol *ipprot;
811 struct net *net = dev_net(skb->dev);
813 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
816 nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
817 if (ipv6_ext_hdr(nexthdr)) {
818 /* now skip over extension headers */
819 inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
820 &nexthdr, &frag_off);
821 if (inner_offset < 0)
824 inner_offset = sizeof(struct ipv6hdr);
827 /* Checkin header including 8 bytes of inner protocol header. */
828 if (!pskb_may_pull(skb, inner_offset+8))
831 /* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
832 Without this we will not able f.e. to make source routed
834 Corresponding argument (opt) to notifiers is already added.
838 ipprot = rcu_dereference(inet6_protos[nexthdr]);
839 if (ipprot && ipprot->err_handler)
840 ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
842 raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
846 __ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
850 * Handle icmp messages
853 static int icmpv6_rcv(struct sk_buff *skb)
855 struct net *net = dev_net(skb->dev);
856 struct net_device *dev = icmp6_dev(skb);
857 struct inet6_dev *idev = __in6_dev_get(dev);
858 const struct in6_addr *saddr, *daddr;
859 struct icmp6hdr *hdr;
861 bool success = false;
863 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
864 struct sec_path *sp = skb_sec_path(skb);
867 if (!(sp && sp->xvec[sp->len - 1]->props.flags &
871 if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
874 nh = skb_network_offset(skb);
875 skb_set_network_header(skb, sizeof(*hdr));
877 if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN, skb))
880 skb_set_network_header(skb, nh);
883 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INMSGS);
885 saddr = &ipv6_hdr(skb)->saddr;
886 daddr = &ipv6_hdr(skb)->daddr;
888 if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
889 net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
894 if (!pskb_pull(skb, sizeof(*hdr)))
897 hdr = icmp6_hdr(skb);
899 type = hdr->icmp6_type;
901 ICMP6MSGIN_INC_STATS(dev_net(dev), idev, type);
904 case ICMPV6_ECHO_REQUEST:
905 if (!net->ipv6.sysctl.icmpv6_echo_ignore_all)
906 icmpv6_echo_reply(skb);
909 case ICMPV6_ECHO_REPLY:
910 success = ping_rcv(skb);
913 case ICMPV6_PKT_TOOBIG:
914 /* BUGGG_FUTURE: if packet contains rthdr, we cannot update
915 standard destination cache. Seems, only "advanced"
916 destination cache will allow to solve this problem
919 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
921 hdr = icmp6_hdr(skb);
925 case ICMPV6_DEST_UNREACH:
926 case ICMPV6_TIME_EXCEED:
927 case ICMPV6_PARAMPROB:
928 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
931 case NDISC_ROUTER_SOLICITATION:
932 case NDISC_ROUTER_ADVERTISEMENT:
933 case NDISC_NEIGHBOUR_SOLICITATION:
934 case NDISC_NEIGHBOUR_ADVERTISEMENT:
939 case ICMPV6_MGM_QUERY:
940 igmp6_event_query(skb);
943 case ICMPV6_MGM_REPORT:
944 igmp6_event_report(skb);
947 case ICMPV6_MGM_REDUCTION:
948 case ICMPV6_NI_QUERY:
949 case ICMPV6_NI_REPLY:
950 case ICMPV6_MLD2_REPORT:
951 case ICMPV6_DHAAD_REQUEST:
952 case ICMPV6_DHAAD_REPLY:
953 case ICMPV6_MOBILE_PREFIX_SOL:
954 case ICMPV6_MOBILE_PREFIX_ADV:
959 if (type & ICMPV6_INFOMSG_MASK)
962 net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
966 * error of unknown type.
967 * must pass to upper level
970 icmpv6_notify(skb, type, hdr->icmp6_code, hdr->icmp6_mtu);
973 /* until the v6 path can be better sorted assume failure and
974 * preserve the status quo behaviour for the rest of the paths to here
984 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_CSUMERRORS);
986 __ICMP6_INC_STATS(dev_net(dev), idev, ICMP6_MIB_INERRORS);
992 void icmpv6_flow_init(struct sock *sk, struct flowi6 *fl6,
994 const struct in6_addr *saddr,
995 const struct in6_addr *daddr,
998 memset(fl6, 0, sizeof(*fl6));
1000 fl6->daddr = *daddr;
1001 fl6->flowi6_proto = IPPROTO_ICMPV6;
1002 fl6->fl6_icmp_type = type;
1003 fl6->fl6_icmp_code = 0;
1004 fl6->flowi6_oif = oif;
1005 security_sk_classify_flow(sk, flowi6_to_flowi(fl6));
1008 static void __net_exit icmpv6_sk_exit(struct net *net)
1012 for_each_possible_cpu(i)
1013 inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv6.icmp_sk, i));
1014 free_percpu(net->ipv6.icmp_sk);
1017 static int __net_init icmpv6_sk_init(struct net *net)
1022 net->ipv6.icmp_sk = alloc_percpu(struct sock *);
1023 if (!net->ipv6.icmp_sk)
1026 for_each_possible_cpu(i) {
1027 err = inet_ctl_sock_create(&sk, PF_INET6,
1028 SOCK_RAW, IPPROTO_ICMPV6, net);
1030 pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
1035 *per_cpu_ptr(net->ipv6.icmp_sk, i) = sk;
1037 /* Enough space for 2 64K ICMP packets, including
1038 * sk_buff struct overhead.
1040 sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
1045 icmpv6_sk_exit(net);
1049 static struct pernet_operations icmpv6_sk_ops = {
1050 .init = icmpv6_sk_init,
1051 .exit = icmpv6_sk_exit,
1054 int __init icmpv6_init(void)
1058 err = register_pernet_subsys(&icmpv6_sk_ops);
1063 if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
1066 err = inet6_register_icmp_sender(icmp6_send);
1068 goto sender_reg_err;
1072 inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1074 pr_err("Failed to register ICMP6 protocol\n");
1075 unregister_pernet_subsys(&icmpv6_sk_ops);
1079 void icmpv6_cleanup(void)
1081 inet6_unregister_icmp_sender(icmp6_send);
1082 unregister_pernet_subsys(&icmpv6_sk_ops);
1083 inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1087 static const struct icmp6_err {
1095 { /* ADM_PROHIBITED */
1099 { /* Was NOT_NEIGHBOUR, now reserved */
1100 .err = EHOSTUNREACH,
1103 { /* ADDR_UNREACH */
1104 .err = EHOSTUNREACH,
1107 { /* PORT_UNREACH */
1108 .err = ECONNREFUSED,
1115 { /* REJECT_ROUTE */
1121 int icmpv6_err_convert(u8 type, u8 code, int *err)
1128 case ICMPV6_DEST_UNREACH:
1130 if (code < ARRAY_SIZE(tab_unreach)) {
1131 *err = tab_unreach[code].err;
1132 fatal = tab_unreach[code].fatal;
1136 case ICMPV6_PKT_TOOBIG:
1140 case ICMPV6_PARAMPROB:
1145 case ICMPV6_TIME_EXCEED:
1146 *err = EHOSTUNREACH;
1152 EXPORT_SYMBOL(icmpv6_err_convert);
1154 #ifdef CONFIG_SYSCTL
1155 static struct ctl_table ipv6_icmp_table_template[] = {
1157 .procname = "ratelimit",
1158 .data = &init_net.ipv6.sysctl.icmpv6_time,
1159 .maxlen = sizeof(int),
1161 .proc_handler = proc_dointvec_ms_jiffies,
1164 .procname = "echo_ignore_all",
1165 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_all,
1166 .maxlen = sizeof(int),
1168 .proc_handler = proc_dointvec,
1171 .procname = "echo_ignore_multicast",
1172 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_multicast,
1173 .maxlen = sizeof(int),
1175 .proc_handler = proc_dointvec,
1178 .procname = "echo_ignore_anycast",
1179 .data = &init_net.ipv6.sysctl.icmpv6_echo_ignore_anycast,
1180 .maxlen = sizeof(int),
1182 .proc_handler = proc_dointvec,
1185 .procname = "ratemask",
1186 .data = &init_net.ipv6.sysctl.icmpv6_ratemask_ptr,
1187 .maxlen = ICMPV6_MSG_MAX + 1,
1189 .proc_handler = proc_do_large_bitmap,
1194 struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1196 struct ctl_table *table;
1198 table = kmemdup(ipv6_icmp_table_template,
1199 sizeof(ipv6_icmp_table_template),
1203 table[0].data = &net->ipv6.sysctl.icmpv6_time;
1204 table[1].data = &net->ipv6.sysctl.icmpv6_echo_ignore_all;
1205 table[2].data = &net->ipv6.sysctl.icmpv6_echo_ignore_multicast;
1206 table[3].data = &net->ipv6.sysctl.icmpv6_echo_ignore_anycast;
1207 table[4].data = &net->ipv6.sysctl.icmpv6_ratemask_ptr;