icmp.c

   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	Internet Control Message Protocol (ICMPv6)
   4 *	Linux INET6 implementation
   5 *
   6 *	Authors:
   7 *	Pedro Roque		<roque@di.fc.ul.pt>
   8 *
   9 *	Based on net/ipv4/icmp.c
  10 *
  11 *	RFC 1885
  12 */
  13
  14/*
  15 *	Changes:
  16 *
  17 *	Andi Kleen		:	exception handling
  18 *	Andi Kleen			add rate limits. never reply to a icmp.
  19 *					add more length checks and other fixes.
  20 *	yoshfuji		:	ensure to sent parameter problem for
  21 *					fragments.
  22 *	YOSHIFUJI Hideaki @USAGI:	added sysctl for icmp rate limit.
  23 *	Randy Dunlap and
  24 *	YOSHIFUJI Hideaki @USAGI:	Per-interface statistics support
  25 *	Kazunori MIYAZAWA @USAGI:       change output process to use ip6_append_data
  26 */
  27
  28#define pr_fmt(fmt) "IPv6: " fmt
  29
  30#include <linux/module.h>
  31#include <linux/errno.h>
  32#include <linux/types.h>
  33#include <linux/socket.h>
  34#include <linux/in.h>
  35#include <linux/kernel.h>
  36#include <linux/sockios.h>
  37#include <linux/net.h>
  38#include <linux/skbuff.h>
  39#include <linux/init.h>
  40#include <linux/netfilter.h>
  41#include <linux/slab.h>
  42
  43#ifdef CONFIG_SYSCTL
  44#include <linux/sysctl.h>
  45#endif
  46
  47#include <linux/inet.h>
  48#include <linux/netdevice.h>
  49#include <linux/icmpv6.h>
  50
  51#include <net/ip.h>
  52#include <net/sock.h>
  53
  54#include <net/ipv6.h>
  55#include <net/ip6_checksum.h>
  56#include <net/ping.h>
  57#include <net/protocol.h>
  58#include <net/raw.h>
  59#include <net/rawv6.h>
  60#include <net/seg6.h>
  61#include <net/transp_v6.h>
  62#include <net/ip6_route.h>
  63#include <net/addrconf.h>
  64#include <net/icmp.h>
  65#include <net/xfrm.h>
  66#include <net/inet_common.h>
  67#include <net/dsfield.h>
  68#include <net/l3mdev.h>
  69
  70#include <linux/uaccess.h>
  71
  72static DEFINE_PER_CPU(struct sock *, ipv6_icmp_sk);
  73
  74static int icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
  75		       u8 type, u8 code, int offset, __be32 info)
  76{
  77	/* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
  78	struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
  79	struct net *net = dev_net_rcu(skb->dev);
  80
  81	if (type == ICMPV6_PKT_TOOBIG)
  82		ip6_update_pmtu(skb, net, info, skb->dev->ifindex, 0, sock_net_uid(net, NULL));
  83	else if (type == NDISC_REDIRECT)
  84		ip6_redirect(skb, net, skb->dev->ifindex, 0,
  85			     sock_net_uid(net, NULL));
  86
  87	if (!(type & ICMPV6_INFOMSG_MASK))
  88		if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
  89			ping_err(skb, offset, ntohl(info));
  90
  91	return 0;
  92}
  93
  94static int icmpv6_rcv(struct sk_buff *skb);
  95
  96static const struct inet6_protocol icmpv6_protocol = {
  97	.handler	=	icmpv6_rcv,
  98	.err_handler	=	icmpv6_err,
  99	.flags		=	INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 100};
 101
 102/* Called with BH disabled */
 103static struct sock *icmpv6_xmit_lock(struct net *net)
 104{
 105	struct sock *sk;
 106
 107	sk = this_cpu_read(ipv6_icmp_sk);
 108	if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
 109		/* This can happen if the output path (f.e. SIT or
 110		 * ip6ip6 tunnel) signals dst_link_failure() for an
 111		 * outgoing ICMP6 packet.
 112		 */
 113		return NULL;
 114	}
 115	sock_net_set(sk, net);
 116	return sk;
 117}
 118
 119static void icmpv6_xmit_unlock(struct sock *sk)
 120{
 121	sock_net_set(sk, &init_net);
 122	spin_unlock(&sk->sk_lock.slock);
 123}
 124
 125/*
 126 * Figure out, may we reply to this packet with icmp error.
 127 *
 128 * We do not reply, if:
 129 *	- it was icmp error message.
 130 *	- it is truncated, so that it is known, that protocol is ICMPV6
 131 *	  (i.e. in the middle of some exthdr)
 132 *
 133 *	--ANK (980726)
 134 */
 135
 136static bool is_ineligible(const struct sk_buff *skb)
 137{
 138	int ptr = (u8 *)(ipv6_hdr(skb) + 1) - skb->data;
 139	int len = skb->len - ptr;
 140	__u8 nexthdr = ipv6_hdr(skb)->nexthdr;
 141	__be16 frag_off;
 142
 143	if (len < 0)
 144		return true;
 145
 146	ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, &frag_off);
 147	if (ptr < 0)
 148		return false;
 149	if (nexthdr == IPPROTO_ICMPV6) {
 150		u8 _type, *tp;
 151		tp = skb_header_pointer(skb,
 152			ptr+offsetof(struct icmp6hdr, icmp6_type),
 153			sizeof(_type), &_type);
 154
 155		/* Based on RFC 8200, Section 4.5 Fragment Header, return
 156		 * false if this is a fragment packet with no icmp header info.
 157		 */
 158		if (!tp && frag_off != 0)
 159			return false;
 160		else if (!tp || !(*tp & ICMPV6_INFOMSG_MASK))
 161			return true;
 162	}
 163	return false;
 164}
 165
 166static bool icmpv6_mask_allow(struct net *net, int type)
 167{
 168	if (type > ICMPV6_MSG_MAX)
 169		return true;
 170
 171	/* Limit if icmp type is set in ratemask. */
 172	if (!test_bit(type, net->ipv6.sysctl.icmpv6_ratemask))
 173		return true;
 174
 175	return false;
 176}
 177
 178static bool icmpv6_global_allow(struct net *net, int type,
 179				bool *apply_ratelimit)
 180{
 181	if (icmpv6_mask_allow(net, type))
 182		return true;
 183
 184	if (icmp_global_allow(net)) {
 185		*apply_ratelimit = true;
 186		return true;
 187	}
 188	__ICMP_INC_STATS(net, ICMP_MIB_RATELIMITGLOBAL);
 189	return false;
 190}
 191
 192/*
 193 * Check the ICMP output rate limit
 194 */
 195static bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
 196			       struct flowi6 *fl6, bool apply_ratelimit)
 197{
 198	struct net *net = sock_net(sk);
 199	struct net_device *dev;
 200	struct dst_entry *dst;
 201	bool res = false;
 202
 203	if (!apply_ratelimit)
 204		return true;
 205
 206	/*
 207	 * Look up the output route.
 208	 * XXX: perhaps the expire for routing entries cloned by
 209	 * this lookup should be more aggressive (not longer than timeout).
 210	 */
 211	dst = ip6_route_output(net, sk, fl6);
 212	rcu_read_lock();
 213	dev = dst_dev_rcu(dst);
 214	if (dst->error) {
 215		IP6_INC_STATS(net, ip6_dst_idev(dst),
 216			      IPSTATS_MIB_OUTNOROUTES);
 217	} else if (dev && (dev->flags & IFF_LOOPBACK)) {
 218		res = true;
 219	} else {
 220		int tmo = READ_ONCE(net->ipv6.sysctl.icmpv6_time);
 221		struct inet_peer *peer;
 222
 223		peer = inet_getpeer_v6(net->ipv6.peers, &fl6->daddr);
 224		res = inet_peer_xrlim_allow(peer, tmo);
 225	}
 226	rcu_read_unlock();
 227	if (!res)
 228		__ICMP6_INC_STATS(net, NULL, ICMP6_MIB_RATELIMITHOST);
 229	else
 230		icmp_global_consume(net);
 231	dst_release(dst);
 232	return res;
 233}
 234
 235static bool icmpv6_rt_has_prefsrc(struct sock *sk, u8 type,
 236				  struct flowi6 *fl6)
 237{
 238	struct net *net = sock_net(sk);
 239	struct dst_entry *dst;
 240	bool res = false;
 241
 242	dst = ip6_route_output(net, sk, fl6);
 243	if (!dst->error) {
 244		struct rt6_info *rt = dst_rt6_info(dst);
 245		struct in6_addr prefsrc;
 246
 247		rt6_get_prefsrc(rt, &prefsrc);
 248		res = !ipv6_addr_any(&prefsrc);
 249	}
 250	dst_release(dst);
 251	return res;
 252}
 253
 254/*
 255 *	an inline helper for the "simple" if statement below
 256 *	checks if parameter problem report is caused by an
 257 *	unrecognized IPv6 option that has the Option Type
 258 *	highest-order two bits set to 10
 259 */
 260
 261static bool opt_unrec(struct sk_buff *skb, __u32 offset)
 262{
 263	u8 _optval, *op;
 264
 265	offset += skb_network_offset(skb);
 266	op = skb_header_pointer(skb, offset, sizeof(_optval), &_optval);
 267	if (!op)
 268		return true;
 269	return (*op & 0xC0) == 0x80;
 270}
 271
 272void icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
 273				struct icmp6hdr *thdr, int len)
 274{
 275	struct sk_buff *skb;
 276	struct icmp6hdr *icmp6h;
 277
 278	skb = skb_peek(&sk->sk_write_queue);
 279	if (!skb)
 280		return;
 281
 282	icmp6h = icmp6_hdr(skb);
 283	memcpy(icmp6h, thdr, sizeof(struct icmp6hdr));
 284	icmp6h->icmp6_cksum = 0;
 285
 286	if (skb_queue_len(&sk->sk_write_queue) == 1) {
 287		skb->csum = csum_partial(icmp6h,
 288					sizeof(struct icmp6hdr), skb->csum);
 289		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 290						      &fl6->daddr,
 291						      len, fl6->flowi6_proto,
 292						      skb->csum);
 293	} else {
 294		__wsum tmp_csum = 0;
 295
 296		skb_queue_walk(&sk->sk_write_queue, skb) {
 297			tmp_csum = csum_add(tmp_csum, skb->csum);
 298		}
 299
 300		tmp_csum = csum_partial(icmp6h,
 301					sizeof(struct icmp6hdr), tmp_csum);
 302		icmp6h->icmp6_cksum = csum_ipv6_magic(&fl6->saddr,
 303						      &fl6->daddr,
 304						      len, fl6->flowi6_proto,
 305						      tmp_csum);
 306	}
 307	ip6_push_pending_frames(sk);
 308}
 309
 310struct icmpv6_msg {
 311	struct sk_buff	*skb;
 312	int		offset;
 313	uint8_t		type;
 314};
 315
 316static int icmpv6_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 317{
 318	struct icmpv6_msg *msg = (struct icmpv6_msg *) from;
 319	struct sk_buff *org_skb = msg->skb;
 320	__wsum csum;
 321
 322	csum = skb_copy_and_csum_bits(org_skb, msg->offset + offset,
 323				      to, len);
 324	skb->csum = csum_block_add(skb->csum, csum, odd);
 325	if (!(msg->type & ICMPV6_INFOMSG_MASK))
 326		nf_ct_attach(skb, org_skb);
 327	return 0;
 328}
 329
 330#if IS_ENABLED(CONFIG_IPV6_MIP6)
 331static void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt)
 332{
 333	struct ipv6hdr *iph = ipv6_hdr(skb);
 334	struct ipv6_destopt_hao *hao;
 335	int off;
 336
 337	if (opt->dsthao) {
 338		off = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
 339		if (likely(off >= 0)) {
 340			hao = (struct ipv6_destopt_hao *)
 341					(skb_network_header(skb) + off);
 342			swap(iph->saddr, hao->addr);
 343		}
 344	}
 345}
 346#else
 347static inline void mip6_addr_swap(struct sk_buff *skb, const struct inet6_skb_parm *opt) {}
 348#endif
 349
 350static struct dst_entry *icmpv6_route_lookup(struct net *net,
 351					     struct sk_buff *skb,
 352					     struct sock *sk,
 353					     struct flowi6 *fl6)
 354{
 355	struct dst_entry *dst, *dst2;
 356	struct flowi6 fl2;
 357	int err;
 358
 359	err = ip6_dst_lookup(net, sk, &dst, fl6);
 360	if (err)
 361		return ERR_PTR(err);
 362
 363	/*
 364	 * We won't send icmp if the destination is known
 365	 * anycast unless we need to treat anycast as unicast.
 366	 */
 367	if (!READ_ONCE(net->ipv6.sysctl.icmpv6_error_anycast_as_unicast) &&
 368	    ipv6_anycast_destination(dst, &fl6->daddr)) {
 369		net_dbg_ratelimited("icmp6_send: acast source\n");
 370		dst_release(dst);
 371		return ERR_PTR(-EINVAL);
 372	}
 373
 374	/* No need to clone since we're just using its address. */
 375	dst2 = dst;
 376
 377	dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), sk, 0);
 378	if (!IS_ERR(dst)) {
 379		if (dst != dst2)
 380			return dst;
 381	} else {
 382		if (PTR_ERR(dst) == -EPERM)
 383			dst = NULL;
 384		else
 385			return dst;
 386	}
 387
 388	err = xfrm_decode_session_reverse(net, skb, flowi6_to_flowi(&fl2), AF_INET6);
 389	if (err)
 390		goto relookup_failed;
 391
 392	err = ip6_dst_lookup(net, sk, &dst2, &fl2);
 393	if (err)
 394		goto relookup_failed;
 395
 396	dst2 = xfrm_lookup(net, dst2, flowi6_to_flowi(&fl2), sk, XFRM_LOOKUP_ICMP);
 397	if (!IS_ERR(dst2)) {
 398		dst_release(dst);
 399		dst = dst2;
 400	} else {
 401		err = PTR_ERR(dst2);
 402		if (err == -EPERM) {
 403			dst_release(dst);
 404			return dst2;
 405		} else
 406			goto relookup_failed;
 407	}
 408
 409relookup_failed:
 410	if (dst)
 411		return dst;
 412	return ERR_PTR(err);
 413}
 414
 415static struct net_device *icmp6_dev(const struct sk_buff *skb)
 416{
 417	struct net_device *dev = skb->dev;
 418
 419	/* for local traffic to local address, skb dev is the loopback
 420	 * device. Check if there is a dst attached to the skb and if so
 421	 * get the real device index. Same is needed for replies to a link
 422	 * local address on a device enslaved to an L3 master device
 423	 */
 424	if (unlikely(dev->ifindex == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) {
 425		const struct rt6_info *rt6 = skb_rt6_info(skb);
 426
 427		/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
 428		 * and ip6_null_entry could be set to skb if no route is found.
 429		 */
 430		if (rt6 && rt6->rt6i_idev)
 431			dev = rt6->rt6i_idev->dev;
 432	}
 433
 434	return dev;
 435}
 436
 437static int icmp6_iif(const struct sk_buff *skb)
 438{
 439	return icmp6_dev(skb)->ifindex;
 440}
 441
 442struct icmp6_ext_iio_addr6_subobj {
 443	__be16 afi;
 444	__be16 reserved;
 445	struct in6_addr addr6;
 446};
 447
 448static unsigned int icmp6_ext_iio_len(void)
 449{
 450	return sizeof(struct icmp_extobj_hdr) +
 451		/* ifIndex */
 452		sizeof(__be32) +
 453		/* Interface Address Sub-Object */
 454		sizeof(struct icmp6_ext_iio_addr6_subobj) +
 455		/* Interface Name Sub-Object. Length must be a multiple of 4
 456		 * bytes.
 457		 */
 458		ALIGN(sizeof(struct icmp_ext_iio_name_subobj), 4) +
 459		/* MTU */
 460		sizeof(__be32);
 461}
 462
 463static unsigned int icmp6_ext_max_len(u8 ext_objs)
 464{
 465	unsigned int ext_max_len;
 466
 467	ext_max_len = sizeof(struct icmp_ext_hdr);
 468
 469	if (ext_objs & BIT(ICMP_ERR_EXT_IIO_IIF))
 470		ext_max_len += icmp6_ext_iio_len();
 471
 472	return ext_max_len;
 473}
 474
 475static struct in6_addr *icmp6_ext_iio_addr6_find(const struct net_device *dev)
 476{
 477	struct inet6_dev *in6_dev;
 478	struct inet6_ifaddr *ifa;
 479
 480	in6_dev = __in6_dev_get(dev);
 481	if (!in6_dev)
 482		return NULL;
 483
 484	/* It is unclear from RFC 5837 which IP address should be chosen, but
 485	 * it makes sense to choose a global unicast address.
 486	 */
 487	list_for_each_entry_rcu(ifa, &in6_dev->addr_list, if_list) {
 488		if (ifa->flags & (IFA_F_TENTATIVE | IFA_F_DADFAILED))
 489			continue;
 490		if (ipv6_addr_type(&ifa->addr) != IPV6_ADDR_UNICAST ||
 491		    ipv6_addr_src_scope(&ifa->addr) != IPV6_ADDR_SCOPE_GLOBAL)
 492			continue;
 493		return &ifa->addr;
 494	}
 495
 496	return NULL;
 497}
 498
 499static void icmp6_ext_iio_iif_append(struct net *net, struct sk_buff *skb,
 500				     int iif)
 501{
 502	struct icmp_ext_iio_name_subobj *name_subobj;
 503	struct icmp_extobj_hdr *objh;
 504	struct net_device *dev;
 505	struct in6_addr *addr6;
 506	__be32 data;
 507
 508	if (!iif)
 509		return;
 510
 511	/* Add the fields in the order specified by RFC 5837. */
 512	objh = skb_put(skb, sizeof(*objh));
 513	objh->class_num = ICMP_EXT_OBJ_CLASS_IIO;
 514	objh->class_type = ICMP_EXT_CTYPE_IIO_ROLE(ICMP_EXT_CTYPE_IIO_ROLE_IIF);
 515
 516	data = htonl(iif);
 517	skb_put_data(skb, &data, sizeof(__be32));
 518	objh->class_type |= ICMP_EXT_CTYPE_IIO_IFINDEX;
 519
 520	rcu_read_lock();
 521
 522	dev = dev_get_by_index_rcu(net, iif);
 523	if (!dev)
 524		goto out;
 525
 526	addr6 = icmp6_ext_iio_addr6_find(dev);
 527	if (addr6) {
 528		struct icmp6_ext_iio_addr6_subobj *addr6_subobj;
 529
 530		addr6_subobj = skb_put_zero(skb, sizeof(*addr6_subobj));
 531		addr6_subobj->afi = htons(ICMP_AFI_IP6);
 532		addr6_subobj->addr6 = *addr6;
 533		objh->class_type |= ICMP_EXT_CTYPE_IIO_IPADDR;
 534	}
 535
 536	name_subobj = skb_put_zero(skb, ALIGN(sizeof(*name_subobj), 4));
 537	name_subobj->len = ALIGN(sizeof(*name_subobj), 4);
 538	netdev_copy_name(dev, name_subobj->name);
 539	objh->class_type |= ICMP_EXT_CTYPE_IIO_NAME;
 540
 541	data = htonl(READ_ONCE(dev->mtu));
 542	skb_put_data(skb, &data, sizeof(__be32));
 543	objh->class_type |= ICMP_EXT_CTYPE_IIO_MTU;
 544
 545out:
 546	rcu_read_unlock();
 547	objh->length = htons(skb_tail_pointer(skb) - (unsigned char *)objh);
 548}
 549
 550static void icmp6_ext_objs_append(struct net *net, struct sk_buff *skb,
 551				  u8 ext_objs, int iif)
 552{
 553	if (ext_objs & BIT(ICMP_ERR_EXT_IIO_IIF))
 554		icmp6_ext_iio_iif_append(net, skb, iif);
 555}
 556
 557static struct sk_buff *
 558icmp6_ext_append(struct net *net, struct sk_buff *skb_in,
 559		 struct icmp6hdr *icmp6h, unsigned int room, int iif)
 560{
 561	unsigned int payload_len, ext_max_len, ext_len;
 562	struct icmp_ext_hdr *ext_hdr;
 563	struct sk_buff *skb;
 564	u8 ext_objs;
 565	int nhoff;
 566
 567	switch (icmp6h->icmp6_type) {
 568	case ICMPV6_DEST_UNREACH:
 569	case ICMPV6_TIME_EXCEED:
 570		break;
 571	default:
 572		return NULL;
 573	}
 574
 575	/* Do not overwrite existing extensions. This can happen when we
 576	 * receive an ICMPv4 message with extensions from a tunnel and
 577	 * translate it to an ICMPv6 message towards an IPv6 host in the
 578	 * overlay network.
 579	 */
 580	if (icmp6h->icmp6_datagram_len)
 581		return NULL;
 582
 583	ext_objs = READ_ONCE(net->ipv6.sysctl.icmpv6_errors_extension_mask);
 584	if (!ext_objs)
 585		return NULL;
 586
 587	ext_max_len = icmp6_ext_max_len(ext_objs);
 588	if (ICMP_EXT_ORIG_DGRAM_MIN_LEN + ext_max_len > room)
 589		return NULL;
 590
 591	skb = skb_clone(skb_in, GFP_ATOMIC);
 592	if (!skb)
 593		return NULL;
 594
 595	nhoff = skb_network_offset(skb);
 596	payload_len = min(skb->len - nhoff, ICMP_EXT_ORIG_DGRAM_MIN_LEN);
 597
 598	if (!pskb_network_may_pull(skb, payload_len))
 599		goto free_skb;
 600
 601	if (pskb_trim(skb, nhoff + ICMP_EXT_ORIG_DGRAM_MIN_LEN) ||
 602	    __skb_put_padto(skb, nhoff + ICMP_EXT_ORIG_DGRAM_MIN_LEN, false))
 603		goto free_skb;
 604
 605	if (pskb_expand_head(skb, 0, ext_max_len, GFP_ATOMIC))
 606		goto free_skb;
 607
 608	ext_hdr = skb_put_zero(skb, sizeof(*ext_hdr));
 609	ext_hdr->version = ICMP_EXT_VERSION_2;
 610
 611	icmp6_ext_objs_append(net, skb, ext_objs, iif);
 612
 613	/* Do not send an empty extension structure. */
 614	ext_len = skb_tail_pointer(skb) - (unsigned char *)ext_hdr;
 615	if (ext_len == sizeof(*ext_hdr))
 616		goto free_skb;
 617
 618	ext_hdr->checksum = ip_compute_csum(ext_hdr, ext_len);
 619	/* The length of the original datagram in 64-bit words (RFC 4884). */
 620	icmp6h->icmp6_datagram_len = ICMP_EXT_ORIG_DGRAM_MIN_LEN / sizeof(u64);
 621
 622	return skb;
 623
 624free_skb:
 625	consume_skb(skb);
 626	return NULL;
 627}
 628
 629/*
 630 *	Send an ICMP message in response to a packet in error
 631 */
 632void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
 633		const struct in6_addr *force_saddr,
 634		const struct inet6_skb_parm *parm)
 635{
 636	struct inet6_dev *idev = NULL;
 637	struct ipv6hdr *hdr = ipv6_hdr(skb);
 638	struct sock *sk;
 639	struct net *net;
 640	struct ipv6_pinfo *np;
 641	const struct in6_addr *saddr = NULL;
 642	bool apply_ratelimit = false;
 643	struct sk_buff *ext_skb;
 644	struct dst_entry *dst;
 645	unsigned int room;
 646	struct icmp6hdr tmp_hdr;
 647	struct flowi6 fl6;
 648	struct icmpv6_msg msg;
 649	struct ipcm6_cookie ipc6;
 650	int iif = 0;
 651	int addr_type = 0;
 652	int len;
 653	u32 mark;
 654
 655	if ((u8 *)hdr < skb->head ||
 656	    (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
 657		return;
 658
 659	if (!skb->dev)
 660		return;
 661
 662	rcu_read_lock();
 663
 664	net = dev_net_rcu(skb->dev);
 665	mark = IP6_REPLY_MARK(net, skb->mark);
 666	/*
 667	 *	Make sure we respect the rules
 668	 *	i.e. RFC 1885 2.4(e)
 669	 *	Rule (e.1) is enforced by not using icmp6_send
 670	 *	in any code that processes icmp errors.
 671	 */
 672	addr_type = ipv6_addr_type(&hdr->daddr);
 673
 674	if (ipv6_chk_addr(net, &hdr->daddr, skb->dev, 0) ||
 675	    ipv6_chk_acast_addr_src(net, skb->dev, &hdr->daddr))
 676		saddr = &hdr->daddr;
 677
 678	/*
 679	 *	Dest addr check
 680	 */
 681
 682	if (addr_type & IPV6_ADDR_MULTICAST || skb->pkt_type != PACKET_HOST) {
 683		if (type != ICMPV6_PKT_TOOBIG &&
 684		    !(type == ICMPV6_PARAMPROB &&
 685		      code == ICMPV6_UNK_OPTION &&
 686		      (opt_unrec(skb, info))))
 687			goto out;
 688
 689		saddr = NULL;
 690	}
 691
 692	addr_type = ipv6_addr_type(&hdr->saddr);
 693
 694	/*
 695	 *	Source addr check
 696	 */
 697
 698	if (__ipv6_addr_needs_scope_id(addr_type)) {
 699		iif = icmp6_iif(skb);
 700	} else {
 701		/*
 702		 * The source device is used for looking up which routing table
 703		 * to use for sending an ICMP error.
 704		 */
 705		iif = l3mdev_master_ifindex(skb->dev);
 706	}
 707
 708	/*
 709	 *	Must not send error if the source does not uniquely
 710	 *	identify a single node (RFC2463 Section 2.4).
 711	 *	We check unspecified / multicast addresses here,
 712	 *	and anycast addresses will be checked later.
 713	 */
 714	if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
 715		net_dbg_ratelimited("icmp6_send: addr_any/mcast source [%pI6c > %pI6c]\n",
 716				    &hdr->saddr, &hdr->daddr);
 717		goto out;
 718	}
 719
 720	/*
 721	 *	Never answer to a ICMP packet.
 722	 */
 723	if (is_ineligible(skb)) {
 724		net_dbg_ratelimited("icmp6_send: no reply to icmp error [%pI6c > %pI6c]\n",
 725				    &hdr->saddr, &hdr->daddr);
 726		goto out;
 727	}
 728
 729	/* Needed by both icmpv6_global_allow and icmpv6_xmit_lock */
 730	local_bh_disable();
 731
 732	/* Check global sysctl_icmp_msgs_per_sec ratelimit */
 733	if (!(skb->dev->flags & IFF_LOOPBACK) &&
 734	    !icmpv6_global_allow(net, type, &apply_ratelimit))
 735		goto out_bh_enable;
 736
 737	mip6_addr_swap(skb, parm);
 738
 739	sk = icmpv6_xmit_lock(net);
 740	if (!sk)
 741		goto out_bh_enable;
 742
 743	memset(&fl6, 0, sizeof(fl6));
 744	fl6.flowi6_proto = IPPROTO_ICMPV6;
 745	fl6.daddr = hdr->saddr;
 746	if (force_saddr)
 747		saddr = force_saddr;
 748	if (saddr) {
 749		fl6.saddr = *saddr;
 750	} else if (!icmpv6_rt_has_prefsrc(sk, type, &fl6)) {
 751		/* select a more meaningful saddr from input if */
 752		struct net_device *in_netdev;
 753
 754		in_netdev = dev_get_by_index(net, parm->iif);
 755		if (in_netdev) {
 756			ipv6_dev_get_saddr(net, in_netdev, &fl6.daddr,
 757					   inet6_sk(sk)->srcprefs,
 758					   &fl6.saddr);
 759			dev_put(in_netdev);
 760		}
 761	}
 762	fl6.flowi6_mark = mark;
 763	fl6.flowi6_oif = iif;
 764	fl6.fl6_icmp_type = type;
 765	fl6.fl6_icmp_code = code;
 766	fl6.flowi6_uid = sock_net_uid(net, NULL);
 767	fl6.mp_hash = rt6_multipath_hash(net, &fl6, skb, NULL);
 768	security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6));
 769
 770	np = inet6_sk(sk);
 771
 772	if (!icmpv6_xrlim_allow(sk, type, &fl6, apply_ratelimit))
 773		goto out_unlock;
 774
 775	tmp_hdr.icmp6_type = type;
 776	tmp_hdr.icmp6_code = code;
 777	tmp_hdr.icmp6_cksum = 0;
 778	tmp_hdr.icmp6_pointer = htonl(info);
 779
 780	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 781		fl6.flowi6_oif = READ_ONCE(np->mcast_oif);
 782	else if (!fl6.flowi6_oif)
 783		fl6.flowi6_oif = READ_ONCE(np->ucast_oif);
 784
 785	ipcm6_init_sk(&ipc6, sk);
 786	ipc6.sockc.mark = mark;
 787	fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 788
 789	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 790	if (IS_ERR(dst))
 791		goto out_unlock;
 792
 793	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
 794
 795	msg.skb = skb;
 796	msg.offset = skb_network_offset(skb);
 797	msg.type = type;
 798
 799	room = IPV6_MIN_MTU - sizeof(struct ipv6hdr) - sizeof(struct icmp6hdr);
 800	ext_skb = icmp6_ext_append(net, skb, &tmp_hdr, room, parm->iif);
 801	if (ext_skb)
 802		msg.skb = ext_skb;
 803
 804	len = msg.skb->len - msg.offset;
 805	len = min_t(unsigned int, len, room);
 806	if (len < 0) {
 807		net_dbg_ratelimited("icmp: len problem [%pI6c > %pI6c]\n",
 808				    &hdr->saddr, &hdr->daddr);
 809		goto out_dst_release;
 810	}
 811
 812	idev = __in6_dev_get(skb->dev);
 813
 814	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
 815			    len + sizeof(struct icmp6hdr),
 816			    sizeof(struct icmp6hdr),
 817			    &ipc6, &fl6, dst_rt6_info(dst),
 818			    MSG_DONTWAIT)) {
 819		ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
 820		ip6_flush_pending_frames(sk);
 821	} else {
 822		icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
 823					   len + sizeof(struct icmp6hdr));
 824	}
 825
 826out_dst_release:
 827	if (ext_skb)
 828		consume_skb(ext_skb);
 829	dst_release(dst);
 830out_unlock:
 831	icmpv6_xmit_unlock(sk);
 832out_bh_enable:
 833	local_bh_enable();
 834out:
 835	rcu_read_unlock();
 836}
 837EXPORT_SYMBOL(icmp6_send);
 838
 839/* Slightly more convenient version of icmp6_send with drop reasons.
 840 */
 841void icmpv6_param_prob_reason(struct sk_buff *skb, u8 code, int pos,
 842			      enum skb_drop_reason reason)
 843{
 844	icmp6_send(skb, ICMPV6_PARAMPROB, code, pos, NULL, IP6CB(skb));
 845	kfree_skb_reason(skb, reason);
 846}
 847
 848/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
 849 * if sufficient data bytes are available
 850 * @nhs is the size of the tunnel header(s) :
 851 *  Either an IPv4 header for SIT encap
 852 *         an IPv4 header + GRE header for GRE encap
 853 */
 854int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type,
 855			       unsigned int data_len)
 856{
 857	struct in6_addr temp_saddr;
 858	struct rt6_info *rt;
 859	struct sk_buff *skb2;
 860	u32 info = 0;
 861
 862	if (!pskb_may_pull(skb, nhs + sizeof(struct ipv6hdr) + 8))
 863		return 1;
 864
 865	/* RFC 4884 (partial) support for ICMP extensions */
 866	if (data_len < 128 || (data_len & 7) || skb->len < data_len)
 867		data_len = 0;
 868
 869	skb2 = data_len ? skb_copy(skb, GFP_ATOMIC) : skb_clone(skb, GFP_ATOMIC);
 870
 871	if (!skb2)
 872		return 1;
 873
 874	/* Remove debris left by IPv4 stack. */
 875	memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2)));
 876
 877	skb_dst_drop(skb2);
 878	skb_pull(skb2, nhs);
 879	skb_reset_network_header(skb2);
 880
 881	rt = rt6_lookup(dev_net_rcu(skb->dev), &ipv6_hdr(skb2)->saddr,
 882			NULL, 0, skb, 0);
 883
 884	if (rt && rt->dst.dev)
 885		skb2->dev = rt->dst.dev;
 886
 887	ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr, &temp_saddr);
 888
 889	if (data_len) {
 890		/* RFC 4884 (partial) support :
 891		 * insert 0 padding at the end, before the extensions
 892		 */
 893		__skb_push(skb2, nhs);
 894		skb_reset_network_header(skb2);
 895		memmove(skb2->data, skb2->data + nhs, data_len - nhs);
 896		memset(skb2->data + data_len - nhs, 0, nhs);
 897		/* RFC 4884 4.5 : Length is measured in 64-bit words,
 898		 * and stored in reserved[0]
 899		 */
 900		info = (data_len/8) << 24;
 901	}
 902	if (type == ICMP_TIME_EXCEEDED)
 903		icmp6_send(skb2, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
 904			   info, &temp_saddr, IP6CB(skb2));
 905	else
 906		icmp6_send(skb2, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH,
 907			   info, &temp_saddr, IP6CB(skb2));
 908	if (rt)
 909		ip6_rt_put(rt);
 910
 911	kfree_skb(skb2);
 912
 913	return 0;
 914}
 915EXPORT_SYMBOL(ip6_err_gen_icmpv6_unreach);
 916
 917static enum skb_drop_reason icmpv6_echo_reply(struct sk_buff *skb)
 918{
 919	struct net *net = dev_net_rcu(skb->dev);
 920	struct sock *sk;
 921	struct inet6_dev *idev;
 922	struct ipv6_pinfo *np;
 923	const struct in6_addr *saddr = NULL;
 924	struct icmp6hdr *icmph = icmp6_hdr(skb);
 925	bool apply_ratelimit = false;
 926	struct icmp6hdr tmp_hdr;
 927	struct flowi6 fl6;
 928	struct icmpv6_msg msg;
 929	struct dst_entry *dst;
 930	struct ipcm6_cookie ipc6;
 931	u32 mark = IP6_REPLY_MARK(net, skb->mark);
 932	SKB_DR(reason);
 933	bool acast;
 934	u8 type;
 935
 936	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr) &&
 937	    net->ipv6.sysctl.icmpv6_echo_ignore_multicast)
 938		return reason;
 939
 940	saddr = &ipv6_hdr(skb)->daddr;
 941
 942	acast = ipv6_anycast_destination(skb_dst(skb), saddr);
 943	if (acast && net->ipv6.sysctl.icmpv6_echo_ignore_anycast)
 944		return reason;
 945
 946	if (!ipv6_unicast_destination(skb) &&
 947	    !(net->ipv6.sysctl.anycast_src_echo_reply && acast))
 948		saddr = NULL;
 949
 950	if (icmph->icmp6_type == ICMPV6_EXT_ECHO_REQUEST)
 951		type = ICMPV6_EXT_ECHO_REPLY;
 952	else
 953		type = ICMPV6_ECHO_REPLY;
 954
 955	memcpy(&tmp_hdr, icmph, sizeof(tmp_hdr));
 956	tmp_hdr.icmp6_type = type;
 957
 958	memset(&fl6, 0, sizeof(fl6));
 959	if (READ_ONCE(net->ipv6.sysctl.flowlabel_reflect) &
 960	    FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES)
 961		fl6.flowlabel = ip6_flowlabel(ipv6_hdr(skb));
 962
 963	fl6.flowi6_proto = IPPROTO_ICMPV6;
 964	fl6.daddr = ipv6_hdr(skb)->saddr;
 965	if (saddr)
 966		fl6.saddr = *saddr;
 967	fl6.flowi6_oif = ipv6_addr_loopback(&fl6.daddr) ?
 968			 skb->dev->ifindex :
 969			 icmp6_iif(skb);
 970	fl6.fl6_icmp_type = type;
 971	fl6.flowi6_mark = mark;
 972	fl6.flowi6_uid = sock_net_uid(net, NULL);
 973	security_skb_classify_flow(skb, flowi6_to_flowi_common(&fl6));
 974
 975	local_bh_disable();
 976	sk = icmpv6_xmit_lock(net);
 977	if (!sk)
 978		goto out_bh_enable;
 979	np = inet6_sk(sk);
 980
 981	if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
 982		fl6.flowi6_oif = READ_ONCE(np->mcast_oif);
 983	else if (!fl6.flowi6_oif)
 984		fl6.flowi6_oif = READ_ONCE(np->ucast_oif);
 985
 986	if (ip6_dst_lookup(net, sk, &dst, &fl6))
 987		goto out;
 988	dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0);
 989	if (IS_ERR(dst))
 990		goto out;
 991
 992	/* Check the ratelimit */
 993	if ((!(skb->dev->flags & IFF_LOOPBACK) &&
 994	    !icmpv6_global_allow(net, ICMPV6_ECHO_REPLY, &apply_ratelimit)) ||
 995	    !icmpv6_xrlim_allow(sk, ICMPV6_ECHO_REPLY, &fl6, apply_ratelimit))
 996		goto out_dst_release;
 997
 998	idev = __in6_dev_get(skb->dev);
 999
1000	msg.skb = skb;
1001	msg.offset = 0;
1002	msg.type = type;
1003
1004	ipcm6_init_sk(&ipc6, sk);
1005	ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
1006	ipc6.tclass = ipv6_get_dsfield(ipv6_hdr(skb));
1007	ipc6.sockc.mark = mark;
1008
1009	if (icmph->icmp6_type == ICMPV6_EXT_ECHO_REQUEST)
1010		if (!icmp_build_probe(skb, (struct icmphdr *)&tmp_hdr))
1011			goto out_dst_release;
1012
1013	if (ip6_append_data(sk, icmpv6_getfrag, &msg,
1014			    skb->len + sizeof(struct icmp6hdr),
1015			    sizeof(struct icmp6hdr), &ipc6, &fl6,
1016			    dst_rt6_info(dst), MSG_DONTWAIT)) {
1017		__ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTERRORS);
1018		ip6_flush_pending_frames(sk);
1019	} else {
1020		icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
1021					   skb->len + sizeof(struct icmp6hdr));
1022		reason = SKB_CONSUMED;
1023	}
1024out_dst_release:
1025	dst_release(dst);
1026out:
1027	icmpv6_xmit_unlock(sk);
1028out_bh_enable:
1029	local_bh_enable();
1030	return reason;
1031}
1032
1033enum skb_drop_reason icmpv6_notify(struct sk_buff *skb, u8 type,
1034				   u8 code, __be32 info)
1035{
1036	struct inet6_skb_parm *opt = IP6CB(skb);
1037	struct net *net = dev_net_rcu(skb->dev);
1038	const struct inet6_protocol *ipprot;
1039	enum skb_drop_reason reason;
1040	int inner_offset;
1041	__be16 frag_off;
1042	u8 nexthdr;
1043
1044	reason = pskb_may_pull_reason(skb, sizeof(struct ipv6hdr));
1045	if (reason != SKB_NOT_DROPPED_YET)
1046		goto out;
1047
1048	seg6_icmp_srh(skb, opt);
1049
1050	nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
1051	if (ipv6_ext_hdr(nexthdr)) {
1052		/* now skip over extension headers */
1053		inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr),
1054						&nexthdr, &frag_off);
1055		if (inner_offset < 0) {
1056			SKB_DR_SET(reason, IPV6_BAD_EXTHDR);
1057			goto out;
1058		}
1059	} else {
1060		inner_offset = sizeof(struct ipv6hdr);
1061	}
1062
1063	/* Checkin header including 8 bytes of inner protocol header. */
1064	reason = pskb_may_pull_reason(skb, inner_offset + 8);
1065	if (reason != SKB_NOT_DROPPED_YET)
1066		goto out;
1067
1068	if (nexthdr == IPPROTO_RAW) {
1069		/* Add a more specific reason later ? */
1070		reason = SKB_DROP_REASON_NOT_SPECIFIED;
1071		goto out;
1072	}
1073
1074	/* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
1075	   Without this we will not able f.e. to make source routed
1076	   pmtu discovery.
1077	   Corresponding argument (opt) to notifiers is already added.
1078	   --ANK (980726)
1079	 */
1080
1081	ipprot = rcu_dereference(inet6_protos[nexthdr]);
1082	if (ipprot && ipprot->err_handler)
1083		ipprot->err_handler(skb, opt, type, code, inner_offset, info);
1084
1085	raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
1086	return SKB_CONSUMED;
1087
1088out:
1089	__ICMP6_INC_STATS(net, __in6_dev_get(skb->dev), ICMP6_MIB_INERRORS);
1090	return reason;
1091}
1092
1093/*
1094 *	Handle icmp messages
1095 */
1096
1097static int icmpv6_rcv(struct sk_buff *skb)
1098{
1099	enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED;
1100	struct net *net = dev_net_rcu(skb->dev);
1101	struct net_device *dev = icmp6_dev(skb);
1102	struct inet6_dev *idev = __in6_dev_get(dev);
1103	const struct in6_addr *saddr, *daddr;
1104	struct icmp6hdr *hdr;
1105	u8 type;
1106
1107	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
1108		struct sec_path *sp = skb_sec_path(skb);
1109		int nh;
1110
1111		if (!(sp && sp->xvec[sp->len - 1]->props.flags &
1112				 XFRM_STATE_ICMP)) {
1113			reason = SKB_DROP_REASON_XFRM_POLICY;
1114			goto drop_no_count;
1115		}
1116
1117		if (!pskb_may_pull(skb, sizeof(*hdr) + sizeof(struct ipv6hdr)))
1118			goto drop_no_count;
1119
1120		nh = skb_network_offset(skb);
1121		skb_set_network_header(skb, sizeof(*hdr));
1122
1123		if (!xfrm6_policy_check_reverse(NULL, XFRM_POLICY_IN,
1124						skb)) {
1125			reason = SKB_DROP_REASON_XFRM_POLICY;
1126			goto drop_no_count;
1127		}
1128
1129		skb_set_network_header(skb, nh);
1130	}
1131
1132	__ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_INMSGS);
1133
1134	saddr = &ipv6_hdr(skb)->saddr;
1135	daddr = &ipv6_hdr(skb)->daddr;
1136
1137	if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
1138		net_dbg_ratelimited("ICMPv6 checksum failed [%pI6c > %pI6c]\n",
1139				    saddr, daddr);
1140		goto csum_error;
1141	}
1142
1143	if (!pskb_pull(skb, sizeof(*hdr)))
1144		goto discard_it;
1145
1146	hdr = icmp6_hdr(skb);
1147
1148	type = hdr->icmp6_type;
1149
1150	ICMP6MSGIN_INC_STATS(dev_net_rcu(dev), idev, type);
1151
1152	switch (type) {
1153	case ICMPV6_ECHO_REQUEST:
1154		if (!net->ipv6.sysctl.icmpv6_echo_ignore_all)
1155			reason = icmpv6_echo_reply(skb);
1156		break;
1157	case ICMPV6_EXT_ECHO_REQUEST:
1158		if (!net->ipv6.sysctl.icmpv6_echo_ignore_all &&
1159		    READ_ONCE(net->ipv4.sysctl_icmp_echo_enable_probe))
1160			reason = icmpv6_echo_reply(skb);
1161		break;
1162
1163	case ICMPV6_ECHO_REPLY:
1164	case ICMPV6_EXT_ECHO_REPLY:
1165		ping_rcv(skb);
1166		return 0;
1167
1168	case ICMPV6_PKT_TOOBIG:
1169		/* BUGGG_FUTURE: if packet contains rthdr, we cannot update
1170		   standard destination cache. Seems, only "advanced"
1171		   destination cache will allow to solve this problem
1172		   --ANK (980726)
1173		 */
1174		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
1175			goto discard_it;
1176		hdr = icmp6_hdr(skb);
1177
1178		/* to notify */
1179		fallthrough;
1180	case ICMPV6_DEST_UNREACH:
1181	case ICMPV6_TIME_EXCEED:
1182	case ICMPV6_PARAMPROB:
1183		reason = icmpv6_notify(skb, type, hdr->icmp6_code,
1184				       hdr->icmp6_mtu);
1185		break;
1186
1187	case NDISC_ROUTER_SOLICITATION:
1188	case NDISC_ROUTER_ADVERTISEMENT:
1189	case NDISC_NEIGHBOUR_SOLICITATION:
1190	case NDISC_NEIGHBOUR_ADVERTISEMENT:
1191	case NDISC_REDIRECT:
1192		reason = ndisc_rcv(skb);
1193		break;
1194
1195	case ICMPV6_MGM_QUERY:
1196		igmp6_event_query(skb);
1197		return 0;
1198
1199	case ICMPV6_MGM_REPORT:
1200		igmp6_event_report(skb);
1201		return 0;
1202
1203	case ICMPV6_MGM_REDUCTION:
1204	case ICMPV6_NI_QUERY:
1205	case ICMPV6_NI_REPLY:
1206	case ICMPV6_MLD2_REPORT:
1207	case ICMPV6_DHAAD_REQUEST:
1208	case ICMPV6_DHAAD_REPLY:
1209	case ICMPV6_MOBILE_PREFIX_SOL:
1210	case ICMPV6_MOBILE_PREFIX_ADV:
1211		break;
1212
1213	default:
1214		/* informational */
1215		if (type & ICMPV6_INFOMSG_MASK)
1216			break;
1217
1218		net_dbg_ratelimited("icmpv6: msg of unknown type [%pI6c > %pI6c]\n",
1219				    saddr, daddr);
1220
1221		/*
1222		 * error of unknown type.
1223		 * must pass to upper level
1224		 */
1225
1226		reason = icmpv6_notify(skb, type, hdr->icmp6_code,
1227				       hdr->icmp6_mtu);
1228	}
1229
1230	/* until the v6 path can be better sorted assume failure and
1231	 * preserve the status quo behaviour for the rest of the paths to here
1232	 */
1233	if (reason)
1234		kfree_skb_reason(skb, reason);
1235	else
1236		consume_skb(skb);
1237
1238	return 0;
1239
1240csum_error:
1241	reason = SKB_DROP_REASON_ICMP_CSUM;
1242	__ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_CSUMERRORS);
1243discard_it:
1244	__ICMP6_INC_STATS(dev_net_rcu(dev), idev, ICMP6_MIB_INERRORS);
1245drop_no_count:
1246	kfree_skb_reason(skb, reason);
1247	return 0;
1248}
1249
1250void icmpv6_flow_init(const struct sock *sk, struct flowi6 *fl6, u8 type,
1251		      const struct in6_addr *saddr,
1252		      const struct in6_addr *daddr, int oif)
1253{
1254	memset(fl6, 0, sizeof(*fl6));
1255	fl6->saddr = *saddr;
1256	fl6->daddr = *daddr;
1257	fl6->flowi6_proto	= IPPROTO_ICMPV6;
1258	fl6->fl6_icmp_type	= type;
1259	fl6->fl6_icmp_code	= 0;
1260	fl6->flowi6_oif		= oif;
1261	security_sk_classify_flow(sk, flowi6_to_flowi_common(fl6));
1262}
1263
1264int __init icmpv6_init(void)
1265{
1266	struct sock *sk;
1267	int err, i;
1268
1269	for_each_possible_cpu(i) {
1270		err = inet_ctl_sock_create(&sk, PF_INET6,
1271					   SOCK_RAW, IPPROTO_ICMPV6, &init_net);
1272		if (err < 0) {
1273			pr_err("Failed to initialize the ICMP6 control socket (err %d)\n",
1274			       err);
1275			return err;
1276		}
1277
1278		per_cpu(ipv6_icmp_sk, i) = sk;
1279
1280		/* Enough space for 2 64K ICMP packets, including
1281		 * sk_buff struct overhead.
1282		 */
1283		sk->sk_sndbuf = 2 * SKB_TRUESIZE(64 * 1024);
1284	}
1285
1286	err = -EAGAIN;
1287	if (inet6_add_protocol(&icmpv6_protocol, IPPROTO_ICMPV6) < 0)
1288		goto fail;
1289
1290	err = inet6_register_icmp_sender(icmp6_send);
1291	if (err)
1292		goto sender_reg_err;
1293	return 0;
1294
1295sender_reg_err:
1296	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1297fail:
1298	pr_err("Failed to register ICMP6 protocol\n");
1299	return err;
1300}
1301
1302void icmpv6_cleanup(void)
1303{
1304	inet6_unregister_icmp_sender(icmp6_send);
1305	inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
1306}
1307
1308
1309static const struct icmp6_err {
1310	int err;
1311	int fatal;
1312} tab_unreach[] = {
1313	{	/* NOROUTE */
1314		.err	= ENETUNREACH,
1315		.fatal	= 0,
1316	},
1317	{	/* ADM_PROHIBITED */
1318		.err	= EACCES,
1319		.fatal	= 1,
1320	},
1321	{	/* Was NOT_NEIGHBOUR, now reserved */
1322		.err	= EHOSTUNREACH,
1323		.fatal	= 0,
1324	},
1325	{	/* ADDR_UNREACH	*/
1326		.err	= EHOSTUNREACH,
1327		.fatal	= 0,
1328	},
1329	{	/* PORT_UNREACH	*/
1330		.err	= ECONNREFUSED,
1331		.fatal	= 1,
1332	},
1333	{	/* POLICY_FAIL */
1334		.err	= EACCES,
1335		.fatal	= 1,
1336	},
1337	{	/* REJECT_ROUTE	*/
1338		.err	= EACCES,
1339		.fatal	= 1,
1340	},
1341};
1342
1343int icmpv6_err_convert(u8 type, u8 code, int *err)
1344{
1345	int fatal = 0;
1346
1347	*err = EPROTO;
1348
1349	switch (type) {
1350	case ICMPV6_DEST_UNREACH:
1351		fatal = 1;
1352		if (code < ARRAY_SIZE(tab_unreach)) {
1353			*err  = tab_unreach[code].err;
1354			fatal = tab_unreach[code].fatal;
1355		}
1356		break;
1357
1358	case ICMPV6_PKT_TOOBIG:
1359		*err = EMSGSIZE;
1360		break;
1361
1362	case ICMPV6_PARAMPROB:
1363		*err = EPROTO;
1364		fatal = 1;
1365		break;
1366
1367	case ICMPV6_TIME_EXCEED:
1368		*err = EHOSTUNREACH;
1369		break;
1370	}
1371
1372	return fatal;
1373}
1374EXPORT_SYMBOL(icmpv6_err_convert);
1375
1376#ifdef CONFIG_SYSCTL
1377
1378static u32 icmpv6_errors_extension_mask_all =
1379	GENMASK_U8(ICMP_ERR_EXT_COUNT - 1, 0);
1380
1381static struct ctl_table ipv6_icmp_table_template[] = {
1382	{
1383		.procname	= "ratelimit",
1384		.data		= &init_net.ipv6.sysctl.icmpv6_time,
1385		.maxlen		= sizeof(int),
1386		.mode		= 0644,
1387		.proc_handler	= proc_dointvec_ms_jiffies,
1388	},
1389	{
1390		.procname	= "echo_ignore_all",
1391		.data		= &init_net.ipv6.sysctl.icmpv6_echo_ignore_all,
1392		.maxlen		= sizeof(u8),
1393		.mode		= 0644,
1394		.proc_handler = proc_dou8vec_minmax,
1395	},
1396	{
1397		.procname	= "echo_ignore_multicast",
1398		.data		= &init_net.ipv6.sysctl.icmpv6_echo_ignore_multicast,
1399		.maxlen		= sizeof(u8),
1400		.mode		= 0644,
1401		.proc_handler = proc_dou8vec_minmax,
1402	},
1403	{
1404		.procname	= "echo_ignore_anycast",
1405		.data		= &init_net.ipv6.sysctl.icmpv6_echo_ignore_anycast,
1406		.maxlen		= sizeof(u8),
1407		.mode		= 0644,
1408		.proc_handler = proc_dou8vec_minmax,
1409	},
1410	{
1411		.procname	= "ratemask",
1412		.data		= &init_net.ipv6.sysctl.icmpv6_ratemask_ptr,
1413		.maxlen		= ICMPV6_MSG_MAX + 1,
1414		.mode		= 0644,
1415		.proc_handler = proc_do_large_bitmap,
1416	},
1417	{
1418		.procname	= "error_anycast_as_unicast",
1419		.data		= &init_net.ipv6.sysctl.icmpv6_error_anycast_as_unicast,
1420		.maxlen		= sizeof(u8),
1421		.mode		= 0644,
1422		.proc_handler	= proc_dou8vec_minmax,
1423		.extra1		= SYSCTL_ZERO,
1424		.extra2		= SYSCTL_ONE,
1425	},
1426	{
1427		.procname	= "errors_extension_mask",
1428		.data		= &init_net.ipv6.sysctl.icmpv6_errors_extension_mask,
1429		.maxlen		= sizeof(u8),
1430		.mode		= 0644,
1431		.proc_handler	= proc_dou8vec_minmax,
1432		.extra1		= SYSCTL_ZERO,
1433		.extra2		= &icmpv6_errors_extension_mask_all,
1434	},
1435};
1436
1437struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
1438{
1439	struct ctl_table *table;
1440
1441	table = kmemdup(ipv6_icmp_table_template,
1442			sizeof(ipv6_icmp_table_template),
1443			GFP_KERNEL);
1444
1445	if (table) {
1446		table[0].data = &net->ipv6.sysctl.icmpv6_time;
1447		table[1].data = &net->ipv6.sysctl.icmpv6_echo_ignore_all;
1448		table[2].data = &net->ipv6.sysctl.icmpv6_echo_ignore_multicast;
1449		table[3].data = &net->ipv6.sysctl.icmpv6_echo_ignore_anycast;
1450		table[4].data = &net->ipv6.sysctl.icmpv6_ratemask_ptr;
1451		table[5].data = &net->ipv6.sysctl.icmpv6_error_anycast_as_unicast;
1452		table[6].data = &net->ipv6.sysctl.icmpv6_errors_extension_mask;
1453	}
1454	return table;
1455}
1456
1457size_t ipv6_icmp_sysctl_table_size(void)
1458{
1459	return ARRAY_SIZE(ipv6_icmp_table_template);
1460}
1461#endif