net/ipv6/ip6_input.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      IPv6 input
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Ian P. Morris           <I.P.Morris@soton.ac.uk>
   9  *
  10  *      Based in linux/net/ipv4/ip_input.c
  11  */
  12 /* Changes
  13  *
  14  *      Mitsuru KANDA @USAGI and
  15  *      YOSHIFUJI Hideaki @USAGI: Remove ipv6_parse_exthdrs().
  16  */
  17
  18 #include <linux/errno.h>
  19 #include <linux/types.h>
  20 #include <linux/socket.h>
  21 #include <linux/sockios.h>
  22 #include <linux/net.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/in6.h>
  25 #include <linux/icmpv6.h>
  26 #include <linux/mroute6.h>
  27 #include <linux/slab.h>
  28 #include <linux/indirect_call_wrapper.h>
  29
  30 #include <linux/netfilter.h>
  31 #include <linux/netfilter_ipv6.h>
  32
  33 #include <net/sock.h>
  34 #include <net/snmp.h>
  35 #include <net/udp.h>
  36
  37 #include <net/ipv6.h>
  38 #include <net/protocol.h>
  39 #include <net/transp_v6.h>
  40 #include <net/rawv6.h>
  41 #include <net/ndisc.h>
  42 #include <net/ip6_route.h>
  43 #include <net/addrconf.h>
  44 #include <net/xfrm.h>
  45 #include <net/inet_ecn.h>
  46 #include <net/dst_metadata.h>
  47
  48 static void ip6_rcv_finish_core(struct net *net, struct sock *sk,
  49                                 struct sk_buff *skb)
  50 {
  51         if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
  52             !skb_dst(skb) && !skb->sk) {
  53                 switch (ipv6_hdr(skb)->nexthdr) {
  54                 case IPPROTO_TCP:
  55                         if (READ_ONCE(net->ipv4.sysctl_tcp_early_demux))
  56                                 tcp_v6_early_demux(skb);
  57                         break;
  58                 case IPPROTO_UDP:
  59                         if (READ_ONCE(net->ipv4.sysctl_udp_early_demux))
  60                                 udp_v6_early_demux(skb);
  61                         break;
  62                 }
  63         }
  64
  65         if (!skb_valid_dst(skb))
  66                 ip6_route_input(skb);
  67 }
  68
  69 int ip6_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  70 {
  71         /* if ingress device is enslaved to an L3 master device pass the
  72          * skb to its handler for processing
  73          */
  74         skb = l3mdev_ip6_rcv(skb);
  75         if (!skb)
  76                 return NET_RX_SUCCESS;
  77         ip6_rcv_finish_core(net, sk, skb);
  78
  79         return dst_input(skb);
  80 }
  81
  82 static void ip6_sublist_rcv_finish(struct list_head *head)
  83 {
  84         struct sk_buff *skb, *next;
  85
  86         list_for_each_entry_safe(skb, next, head, list) {
  87                 skb_list_del_init(skb);
  88                 dst_input(skb);
  89         }
  90 }
  91
  92 static bool ip6_can_use_hint(const struct sk_buff *skb,
  93                              const struct sk_buff *hint)
  94 {
  95         return hint && !skb_dst(skb) &&
  96                ipv6_addr_equal(&ipv6_hdr(hint)->daddr, &ipv6_hdr(skb)->daddr);
  97 }
  98
  99 static struct sk_buff *ip6_extract_route_hint(const struct net *net,
 100                                               struct sk_buff *skb)
 101 {
 102         if (fib6_routes_require_src(net) || fib6_has_custom_rules(net))
 103                 return NULL;
 104
 105         return skb;
 106 }
 107
 108 static void ip6_list_rcv_finish(struct net *net, struct sock *sk,
 109                                 struct list_head *head)
 110 {
 111         struct sk_buff *skb, *next, *hint = NULL;
 112         struct dst_entry *curr_dst = NULL;
 113         struct list_head sublist;
 114
 115         INIT_LIST_HEAD(&sublist);
 116         list_for_each_entry_safe(skb, next, head, list) {
 117                 struct dst_entry *dst;
 118
 119                 skb_list_del_init(skb);
 120                 /* if ingress device is enslaved to an L3 master device pass the
 121                  * skb to its handler for processing
 122                  */
 123                 skb = l3mdev_ip6_rcv(skb);
 124                 if (!skb)
 125                         continue;
 126
 127                 if (ip6_can_use_hint(skb, hint))
 128                         skb_dst_copy(skb, hint);
 129                 else
 130                         ip6_rcv_finish_core(net, sk, skb);
 131                 dst = skb_dst(skb);
 132                 if (curr_dst != dst) {
 133                         hint = ip6_extract_route_hint(net, skb);
 134
 135                         /* dispatch old sublist */
 136                         if (!list_empty(&sublist))
 137                                 ip6_sublist_rcv_finish(&sublist);
 138                         /* start new sublist */
 139                         INIT_LIST_HEAD(&sublist);
 140                         curr_dst = dst;
 141                 }
 142                 list_add_tail(&skb->list, &sublist);
 143         }
 144         /* dispatch final sublist */
 145         ip6_sublist_rcv_finish(&sublist);
 146 }
 147
 148 static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,
 149                                     struct net *net)
 150 {
 151         const struct ipv6hdr *hdr;
 152         u32 pkt_len;
 153         struct inet6_dev *idev;
 154
 155         if (skb->pkt_type == PACKET_OTHERHOST) {
 156                 kfree_skb(skb);
 157                 return NULL;
 158         }
 159
 160         rcu_read_lock();
 161
 162         idev = __in6_dev_get(skb->dev);
 163
 164         __IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_IN, skb->len);
 165
 166         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
 167             !idev || unlikely(idev->cnf.disable_ipv6)) {
 168                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
 169                 goto drop;
 170         }
 171
 172         memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 173
 174         /*
 175          * Store incoming device index. When the packet will
 176          * be queued, we cannot refer to skb->dev anymore.
 177          *
 178          * BTW, when we send a packet for our own local address on a
 179          * non-loopback interface (e.g. ethX), it is being delivered
 180          * via the loopback interface (lo) here; skb->dev = loopback_dev.
 181          * It, however, should be considered as if it is being
 182          * arrived via the sending interface (ethX), because of the
 183          * nature of scoping architecture. --yoshfuji
 184          */
 185         IP6CB(skb)->iif = skb_valid_dst(skb) ? ip6_dst_idev(skb_dst(skb))->dev->ifindex : dev->ifindex;
 186
 187         if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
 188                 goto err;
 189
 190         hdr = ipv6_hdr(skb);
 191
 192         if (hdr->version != 6)
 193                 goto err;
 194
 195         __IP6_ADD_STATS(net, idev,
 196                         IPSTATS_MIB_NOECTPKTS +
 197                                 (ipv6_get_dsfield(hdr) & INET_ECN_MASK),
 198                         max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
 199         /*
 200          * RFC4291 2.5.3
 201          * The loopback address must not be used as the source address in IPv6
 202          * packets that are sent outside of a single node. [..]
 203          * A packet received on an interface with a destination address
 204          * of loopback must be dropped.
 205          */
 206         if ((ipv6_addr_loopback(&hdr->saddr) ||
 207              ipv6_addr_loopback(&hdr->daddr)) &&
 208             !(dev->flags & IFF_LOOPBACK) &&
 209             !netif_is_l3_master(dev))
 210                 goto err;
 211
 212         /* RFC4291 Errata ID: 3480
 213          * Interface-Local scope spans only a single interface on a
 214          * node and is useful only for loopback transmission of
 215          * multicast.  Packets with interface-local scope received
 216          * from another node must be discarded.
 217          */
 218         if (!(skb->pkt_type == PACKET_LOOPBACK ||
 219               dev->flags & IFF_LOOPBACK) &&
 220             ipv6_addr_is_multicast(&hdr->daddr) &&
 221             IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
 222                 goto err;
 223
 224         /* If enabled, drop unicast packets that were encapsulated in link-layer
 225          * multicast or broadcast to protected against the so-called "hole-196"
 226          * attack in 802.11 wireless.
 227          */
 228         if (!ipv6_addr_is_multicast(&hdr->daddr) &&
 229             (skb->pkt_type == PACKET_BROADCAST ||
 230              skb->pkt_type == PACKET_MULTICAST) &&
 231             idev->cnf.drop_unicast_in_l2_multicast)
 232                 goto err;
 233
 234         /* RFC4291 2.7
 235          * Nodes must not originate a packet to a multicast address whose scope
 236          * field contains the reserved value 0; if such a packet is received, it
 237          * must be silently dropped.
 238          */
 239         if (ipv6_addr_is_multicast(&hdr->daddr) &&
 240             IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0)
 241                 goto err;
 242
 243         /*
 244          * RFC4291 2.7
 245          * Multicast addresses must not be used as source addresses in IPv6
 246          * packets or appear in any Routing header.
 247          */
 248         if (ipv6_addr_is_multicast(&hdr->saddr))
 249                 goto err;
 250
 251         skb->transport_header = skb->network_header + sizeof(*hdr);
 252         IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 253
 254         pkt_len = ntohs(hdr->payload_len);
 255
 256         /* pkt_len may be zero if Jumbo payload option is present */
 257         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
 258                 if (pkt_len + sizeof(struct ipv6hdr) > skb->len) {
 259                         __IP6_INC_STATS(net,
 260                                         idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 261                         goto drop;
 262                 }
 263                 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) {
 264                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 265                         goto drop;
 266                 }
 267                 hdr = ipv6_hdr(skb);
 268         }
 269
 270         if (hdr->nexthdr == NEXTHDR_HOP) {
 271                 if (ipv6_parse_hopopts(skb) < 0) {
 272                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 273                         rcu_read_unlock();
 274                         return NULL;
 275                 }
 276         }
 277
 278         rcu_read_unlock();
 279
 280         /* Must drop socket now because of tproxy. */
 281         if (!skb_sk_is_prefetched(skb))
 282                 skb_orphan(skb);
 283
 284         return skb;
 285 err:
 286         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 287 drop:
 288         rcu_read_unlock();
 289         kfree_skb(skb);
 290         return NULL;
 291 }
 292
 293 int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 294 {
 295         struct net *net = dev_net(skb->dev);
 296
 297         skb = ip6_rcv_core(skb, dev, net);
 298         if (skb == NULL)
 299                 return NET_RX_DROP;
 300         return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
 301                        net, NULL, skb, dev, NULL,
 302                        ip6_rcv_finish);
 303 }
 304
 305 static void ip6_sublist_rcv(struct list_head *head, struct net_device *dev,
 306                             struct net *net)
 307 {
 308         NF_HOOK_LIST(NFPROTO_IPV6, NF_INET_PRE_ROUTING, net, NULL,
 309                      head, dev, NULL, ip6_rcv_finish);
 310         ip6_list_rcv_finish(net, NULL, head);
 311 }
 312
 313 /* Receive a list of IPv6 packets */
 314 void ipv6_list_rcv(struct list_head *head, struct packet_type *pt,
 315                    struct net_device *orig_dev)
 316 {
 317         struct net_device *curr_dev = NULL;
 318         struct net *curr_net = NULL;
 319         struct sk_buff *skb, *next;
 320         struct list_head sublist;
 321
 322         INIT_LIST_HEAD(&sublist);
 323         list_for_each_entry_safe(skb, next, head, list) {
 324                 struct net_device *dev = skb->dev;
 325                 struct net *net = dev_net(dev);
 326
 327                 skb_list_del_init(skb);
 328                 skb = ip6_rcv_core(skb, dev, net);
 329                 if (skb == NULL)
 330                         continue;
 331
 332                 if (curr_dev != dev || curr_net != net) {
 333                         /* dispatch old sublist */
 334                         if (!list_empty(&sublist))
 335                                 ip6_sublist_rcv(&sublist, curr_dev, curr_net);
 336                         /* start new sublist */
 337                         INIT_LIST_HEAD(&sublist);
 338                         curr_dev = dev;
 339                         curr_net = net;
 340                 }
 341                 list_add_tail(&skb->list, &sublist);
 342         }
 343         /* dispatch final sublist */
 344         if (!list_empty(&sublist))
 345                 ip6_sublist_rcv(&sublist, curr_dev, curr_net);
 346 }
 347
 348 INDIRECT_CALLABLE_DECLARE(int tcp_v6_rcv(struct sk_buff *));
 349
 350 /*
 351  *      Deliver the packet to the host
 352  */
 353 void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
 354                               bool have_final)
 355 {
 356         const struct inet6_protocol *ipprot;
 357         struct inet6_dev *idev;
 358         unsigned int nhoff;
 359         bool raw;
 360
 361         /*
 362          *      Parse extension headers
 363          */
 364
 365 resubmit:
 366         idev = ip6_dst_idev(skb_dst(skb));
 367         nhoff = IP6CB(skb)->nhoff;
 368         if (!have_final) {
 369                 if (!pskb_pull(skb, skb_transport_offset(skb)))
 370                         goto discard;
 371                 nexthdr = skb_network_header(skb)[nhoff];
 372         }
 373
 374 resubmit_final:
 375         raw = raw6_local_deliver(skb, nexthdr);
 376         ipprot = rcu_dereference(inet6_protos[nexthdr]);
 377         if (ipprot) {
 378                 int ret;
 379
 380                 if (have_final) {
 381                         if (!(ipprot->flags & INET6_PROTO_FINAL)) {
 382                                 /* Once we've seen a final protocol don't
 383                                  * allow encapsulation on any non-final
 384                                  * ones. This allows foo in UDP encapsulation
 385                                  * to work.
 386                                  */
 387                                 goto discard;
 388                         }
 389                 } else if (ipprot->flags & INET6_PROTO_FINAL) {
 390                         const struct ipv6hdr *hdr;
 391                         int sdif = inet6_sdif(skb);
 392                         struct net_device *dev;
 393
 394                         /* Only do this once for first final protocol */
 395                         have_final = true;
 396
 397                         /* Free reference early: we don't need it any more,
 398                            and it may hold ip_conntrack module loaded
 399                            indefinitely. */
 400                         nf_reset_ct(skb);
 401
 402                         skb_postpull_rcsum(skb, skb_network_header(skb),
 403                                            skb_network_header_len(skb));
 404                         hdr = ipv6_hdr(skb);
 405
 406                         /* skb->dev passed may be master dev for vrfs. */
 407                         if (sdif) {
 408                                 dev = dev_get_by_index_rcu(net, sdif);
 409                                 if (!dev)
 410                                         goto discard;
 411                         } else {
 412                                 dev = skb->dev;
 413                         }
 414
 415                         if (ipv6_addr_is_multicast(&hdr->daddr) &&
 416                             !ipv6_chk_mcast_addr(dev, &hdr->daddr,
 417                                                  &hdr->saddr) &&
 418                             !ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb)))
 419                                 goto discard;
 420                 }
 421                 if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
 422                     !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
 423                         goto discard;
 424
 425                 ret = INDIRECT_CALL_2(ipprot->handler, tcp_v6_rcv, udpv6_rcv,
 426                                       skb);
 427                 if (ret > 0) {
 428                         if (ipprot->flags & INET6_PROTO_FINAL) {
 429                                 /* Not an extension header, most likely UDP
 430                                  * encapsulation. Use return value as nexthdr
 431                                  * protocol not nhoff (which presumably is
 432                                  * not set by handler).
 433                                  */
 434                                 nexthdr = ret;
 435                                 goto resubmit_final;
 436                         } else {
 437                                 goto resubmit;
 438                         }
 439                 } else if (ret == 0) {
 440                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDELIVERS);
 441                 }
 442         } else {
 443                 if (!raw) {
 444                         if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 445                                 __IP6_INC_STATS(net, idev,
 446                                                 IPSTATS_MIB_INUNKNOWNPROTOS);
 447                                 icmpv6_send(skb, ICMPV6_PARAMPROB,
 448                                             ICMPV6_UNK_NEXTHDR, nhoff);
 449                         }
 450                         kfree_skb(skb);
 451                 } else {
 452                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDELIVERS);
 453                         consume_skb(skb);
 454                 }
 455         }
 456         return;
 457
 458 discard:
 459         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
 460         kfree_skb(skb);
 461 }
 462
 463 static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 464 {
 465         rcu_read_lock();
 466         ip6_protocol_deliver_rcu(net, skb, 0, false);
 467         rcu_read_unlock();
 468
 469         return 0;
 470 }
 471
 472
 473 int ip6_input(struct sk_buff *skb)
 474 {
 475         return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_IN,
 476                        dev_net(skb->dev), NULL, skb, skb->dev, NULL,
 477                        ip6_input_finish);
 478 }
 479 EXPORT_SYMBOL_GPL(ip6_input);
 480
 481 int ip6_mc_input(struct sk_buff *skb)
 482 {
 483         int sdif = inet6_sdif(skb);
 484         const struct ipv6hdr *hdr;
 485         struct net_device *dev;
 486         bool deliver;
 487
 488         __IP6_UPD_PO_STATS(dev_net(skb_dst(skb)->dev),
 489                          __in6_dev_get_safely(skb->dev), IPSTATS_MIB_INMCAST,
 490                          skb->len);
 491
 492         /* skb->dev passed may be master dev for vrfs. */
 493         if (sdif) {
 494                 rcu_read_lock();
 495                 dev = dev_get_by_index_rcu(dev_net(skb->dev), sdif);
 496                 if (!dev) {
 497                         rcu_read_unlock();
 498                         kfree_skb(skb);
 499                         return -ENODEV;
 500                 }
 501         } else {
 502                 dev = skb->dev;
 503         }
 504
 505         hdr = ipv6_hdr(skb);
 506         deliver = ipv6_chk_mcast_addr(dev, &hdr->daddr, NULL);
 507         if (sdif)
 508                 rcu_read_unlock();
 509
 510 #ifdef CONFIG_IPV6_MROUTE
 511         /*
 512          *      IPv6 multicast router mode is now supported ;)
 513          */
 514         if (atomic_read(&dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding) &&
 515             !(ipv6_addr_type(&hdr->daddr) &
 516               (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) &&
 517             likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
 518                 /*
 519                  * Okay, we try to forward - split and duplicate
 520                  * packets.
 521                  */
 522                 struct sk_buff *skb2;
 523                 struct inet6_skb_parm *opt = IP6CB(skb);
 524
 525                 /* Check for MLD */
 526                 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
 527                         /* Check if this is a mld message */
 528                         u8 nexthdr = hdr->nexthdr;
 529                         __be16 frag_off;
 530                         int offset;
 531
 532                         /* Check if the value of Router Alert
 533                          * is for MLD (0x0000).
 534                          */
 535                         if (opt->ra == htons(IPV6_OPT_ROUTERALERT_MLD)) {
 536                                 deliver = false;
 537
 538                                 if (!ipv6_ext_hdr(nexthdr)) {
 539                                         /* BUG */
 540                                         goto out;
 541                                 }
 542                                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr),
 543                                                           &nexthdr, &frag_off);
 544                                 if (offset < 0)
 545                                         goto out;
 546
 547                                 if (ipv6_is_mld(skb, nexthdr, offset))
 548                                         deliver = true;
 549
 550                                 goto out;
 551                         }
 552                         /* unknown RA - process it normally */
 553                 }
 554
 555                 if (deliver)
 556                         skb2 = skb_clone(skb, GFP_ATOMIC);
 557                 else {
 558                         skb2 = skb;
 559                         skb = NULL;
 560                 }
 561
 562                 if (skb2) {
 563                         ip6_mr_input(skb2);
 564                 }
 565         }
 566 out:
 567 #endif
 568         if (likely(deliver))
 569                 ip6_input(skb);
 570         else {
 571                 /* discard */
 572                 kfree_skb(skb);
 573         }
 574
 575         return 0;
 576 }