net/ipv6/ip6_input.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *      IPv6 input
   4  *      Linux INET6 implementation
   5  *
   6  *      Authors:
   7  *      Pedro Roque             <roque@di.fc.ul.pt>
   8  *      Ian P. Morris           <I.P.Morris@soton.ac.uk>
   9  *
  10  *      Based in linux/net/ipv4/ip_input.c
  11  */
  12 /* Changes
  13  *
  14  *      Mitsuru KANDA @USAGI and
  15  *      YOSHIFUJI Hideaki @USAGI: Remove ipv6_parse_exthdrs().
  16  */
  17
  18 #include <linux/errno.h>
  19 #include <linux/types.h>
  20 #include <linux/socket.h>
  21 #include <linux/sockios.h>
  22 #include <linux/net.h>
  23 #include <linux/netdevice.h>
  24 #include <linux/in6.h>
  25 #include <linux/icmpv6.h>
  26 #include <linux/mroute6.h>
  27 #include <linux/slab.h>
  28 #include <linux/indirect_call_wrapper.h>
  29
  30 #include <linux/netfilter.h>
  31 #include <linux/netfilter_ipv6.h>
  32
  33 #include <net/sock.h>
  34 #include <net/snmp.h>
  35 #include <net/udp.h>
  36
  37 #include <net/ipv6.h>
  38 #include <net/protocol.h>
  39 #include <net/transp_v6.h>
  40 #include <net/rawv6.h>
  41 #include <net/ndisc.h>
  42 #include <net/ip6_route.h>
  43 #include <net/addrconf.h>
  44 #include <net/xfrm.h>
  45 #include <net/inet_ecn.h>
  46 #include <net/dst_metadata.h>
  47
  48 static void ip6_rcv_finish_core(struct net *net, struct sock *sk,
  49                                 struct sk_buff *skb)
  50 {
  51         if (READ_ONCE(net->ipv4.sysctl_ip_early_demux) &&
  52             !skb_dst(skb) && !skb->sk) {
  53                 switch (ipv6_hdr(skb)->nexthdr) {
  54                 case IPPROTO_TCP:
  55                         if (READ_ONCE(net->ipv4.sysctl_tcp_early_demux))
  56                                 tcp_v6_early_demux(skb);
  57                         break;
  58                 case IPPROTO_UDP:
  59                         if (READ_ONCE(net->ipv4.sysctl_udp_early_demux))
  60                                 udp_v6_early_demux(skb);
  61                         break;
  62                 }
  63         }
  64
  65         if (!skb_valid_dst(skb))
  66                 ip6_route_input(skb);
  67 }
  68
  69 int ip6_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
  70 {
  71         /* if ingress device is enslaved to an L3 master device pass the
  72          * skb to its handler for processing
  73          */
  74         skb = l3mdev_ip6_rcv(skb);
  75         if (!skb)
  76                 return NET_RX_SUCCESS;
  77         ip6_rcv_finish_core(net, sk, skb);
  78
  79         return dst_input(skb);
  80 }
  81
  82 static void ip6_sublist_rcv_finish(struct list_head *head)
  83 {
  84         struct sk_buff *skb, *next;
  85
  86         list_for_each_entry_safe(skb, next, head, list) {
  87                 skb_list_del_init(skb);
  88                 dst_input(skb);
  89         }
  90 }
  91
  92 static bool ip6_can_use_hint(const struct sk_buff *skb,
  93                              const struct sk_buff *hint)
  94 {
  95         return hint && !skb_dst(skb) &&
  96                ipv6_addr_equal(&ipv6_hdr(hint)->daddr, &ipv6_hdr(skb)->daddr);
  97 }
  98
  99 static struct sk_buff *ip6_extract_route_hint(const struct net *net,
 100                                               struct sk_buff *skb)
 101 {
 102         if (fib6_routes_require_src(net) || fib6_has_custom_rules(net) ||
 103             IP6CB(skb)->flags & IP6SKB_MULTIPATH)
 104                 return NULL;
 105
 106         return skb;
 107 }
 108
 109 static void ip6_list_rcv_finish(struct net *net, struct sock *sk,
 110                                 struct list_head *head)
 111 {
 112         struct sk_buff *skb, *next, *hint = NULL;
 113         struct dst_entry *curr_dst = NULL;
 114         struct list_head sublist;
 115
 116         INIT_LIST_HEAD(&sublist);
 117         list_for_each_entry_safe(skb, next, head, list) {
 118                 struct dst_entry *dst;
 119
 120                 skb_list_del_init(skb);
 121                 /* if ingress device is enslaved to an L3 master device pass the
 122                  * skb to its handler for processing
 123                  */
 124                 skb = l3mdev_ip6_rcv(skb);
 125                 if (!skb)
 126                         continue;
 127
 128                 if (ip6_can_use_hint(skb, hint))
 129                         skb_dst_copy(skb, hint);
 130                 else
 131                         ip6_rcv_finish_core(net, sk, skb);
 132                 dst = skb_dst(skb);
 133                 if (curr_dst != dst) {
 134                         hint = ip6_extract_route_hint(net, skb);
 135
 136                         /* dispatch old sublist */
 137                         if (!list_empty(&sublist))
 138                                 ip6_sublist_rcv_finish(&sublist);
 139                         /* start new sublist */
 140                         INIT_LIST_HEAD(&sublist);
 141                         curr_dst = dst;
 142                 }
 143                 list_add_tail(&skb->list, &sublist);
 144         }
 145         /* dispatch final sublist */
 146         ip6_sublist_rcv_finish(&sublist);
 147 }
 148
 149 static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,
 150                                     struct net *net)
 151 {
 152         enum skb_drop_reason reason;
 153         const struct ipv6hdr *hdr;
 154         u32 pkt_len;
 155         struct inet6_dev *idev;
 156
 157         if (skb->pkt_type == PACKET_OTHERHOST) {
 158                 dev_core_stats_rx_otherhost_dropped_inc(skb->dev);
 159                 kfree_skb_reason(skb, SKB_DROP_REASON_OTHERHOST);
 160                 return NULL;
 161         }
 162
 163         rcu_read_lock();
 164
 165         idev = __in6_dev_get(skb->dev);
 166
 167         __IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_IN, skb->len);
 168
 169         SKB_DR_SET(reason, NOT_SPECIFIED);
 170         if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
 171             !idev || unlikely(idev->cnf.disable_ipv6)) {
 172                 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
 173                 if (idev && unlikely(idev->cnf.disable_ipv6))
 174                         SKB_DR_SET(reason, IPV6DISABLED);
 175                 goto drop;
 176         }
 177
 178         memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
 179
 180         /*
 181          * Store incoming device index. When the packet will
 182          * be queued, we cannot refer to skb->dev anymore.
 183          *
 184          * BTW, when we send a packet for our own local address on a
 185          * non-loopback interface (e.g. ethX), it is being delivered
 186          * via the loopback interface (lo) here; skb->dev = loopback_dev.
 187          * It, however, should be considered as if it is being
 188          * arrived via the sending interface (ethX), because of the
 189          * nature of scoping architecture. --yoshfuji
 190          */
 191         IP6CB(skb)->iif = skb_valid_dst(skb) ? ip6_dst_idev(skb_dst(skb))->dev->ifindex : dev->ifindex;
 192
 193         if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
 194                 goto err;
 195
 196         hdr = ipv6_hdr(skb);
 197
 198         if (hdr->version != 6) {
 199                 SKB_DR_SET(reason, UNHANDLED_PROTO);
 200                 goto err;
 201         }
 202
 203         __IP6_ADD_STATS(net, idev,
 204                         IPSTATS_MIB_NOECTPKTS +
 205                                 (ipv6_get_dsfield(hdr) & INET_ECN_MASK),
 206                         max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
 207         /*
 208          * RFC4291 2.5.3
 209          * The loopback address must not be used as the source address in IPv6
 210          * packets that are sent outside of a single node. [..]
 211          * A packet received on an interface with a destination address
 212          * of loopback must be dropped.
 213          */
 214         if ((ipv6_addr_loopback(&hdr->saddr) ||
 215              ipv6_addr_loopback(&hdr->daddr)) &&
 216             !(dev->flags & IFF_LOOPBACK) &&
 217             !netif_is_l3_master(dev))
 218                 goto err;
 219
 220         /* RFC4291 Errata ID: 3480
 221          * Interface-Local scope spans only a single interface on a
 222          * node and is useful only for loopback transmission of
 223          * multicast.  Packets with interface-local scope received
 224          * from another node must be discarded.
 225          */
 226         if (!(skb->pkt_type == PACKET_LOOPBACK ||
 227               dev->flags & IFF_LOOPBACK) &&
 228             ipv6_addr_is_multicast(&hdr->daddr) &&
 229             IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
 230                 goto err;
 231
 232         /* If enabled, drop unicast packets that were encapsulated in link-layer
 233          * multicast or broadcast to protected against the so-called "hole-196"
 234          * attack in 802.11 wireless.
 235          */
 236         if (!ipv6_addr_is_multicast(&hdr->daddr) &&
 237             (skb->pkt_type == PACKET_BROADCAST ||
 238              skb->pkt_type == PACKET_MULTICAST) &&
 239             idev->cnf.drop_unicast_in_l2_multicast) {
 240                 SKB_DR_SET(reason, UNICAST_IN_L2_MULTICAST);
 241                 goto err;
 242         }
 243
 244         /* RFC4291 2.7
 245          * Nodes must not originate a packet to a multicast address whose scope
 246          * field contains the reserved value 0; if such a packet is received, it
 247          * must be silently dropped.
 248          */
 249         if (ipv6_addr_is_multicast(&hdr->daddr) &&
 250             IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0)
 251                 goto err;
 252
 253         /*
 254          * RFC4291 2.7
 255          * Multicast addresses must not be used as source addresses in IPv6
 256          * packets or appear in any Routing header.
 257          */
 258         if (ipv6_addr_is_multicast(&hdr->saddr))
 259                 goto err;
 260
 261         skb->transport_header = skb->network_header + sizeof(*hdr);
 262         IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 263
 264         pkt_len = ntohs(hdr->payload_len);
 265
 266         /* pkt_len may be zero if Jumbo payload option is present */
 267         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
 268                 if (pkt_len + sizeof(struct ipv6hdr) > skb->len) {
 269                         __IP6_INC_STATS(net,
 270                                         idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 271                         SKB_DR_SET(reason, PKT_TOO_SMALL);
 272                         goto drop;
 273                 }
 274                 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
 275                         goto err;
 276                 hdr = ipv6_hdr(skb);
 277         }
 278
 279         if (hdr->nexthdr == NEXTHDR_HOP) {
 280                 if (ipv6_parse_hopopts(skb) < 0) {
 281                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 282                         rcu_read_unlock();
 283                         return NULL;
 284                 }
 285         }
 286
 287         rcu_read_unlock();
 288
 289         /* Must drop socket now because of tproxy. */
 290         if (!skb_sk_is_prefetched(skb))
 291                 skb_orphan(skb);
 292
 293         return skb;
 294 err:
 295         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
 296         SKB_DR_OR(reason, IP_INHDR);
 297 drop:
 298         rcu_read_unlock();
 299         kfree_skb_reason(skb, reason);
 300         return NULL;
 301 }
 302
 303 int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
 304 {
 305         struct net *net = dev_net(skb->dev);
 306
 307         skb = ip6_rcv_core(skb, dev, net);
 308         if (skb == NULL)
 309                 return NET_RX_DROP;
 310         return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
 311                        net, NULL, skb, dev, NULL,
 312                        ip6_rcv_finish);
 313 }
 314
 315 static void ip6_sublist_rcv(struct list_head *head, struct net_device *dev,
 316                             struct net *net)
 317 {
 318         NF_HOOK_LIST(NFPROTO_IPV6, NF_INET_PRE_ROUTING, net, NULL,
 319                      head, dev, NULL, ip6_rcv_finish);
 320         ip6_list_rcv_finish(net, NULL, head);
 321 }
 322
 323 /* Receive a list of IPv6 packets */
 324 void ipv6_list_rcv(struct list_head *head, struct packet_type *pt,
 325                    struct net_device *orig_dev)
 326 {
 327         struct net_device *curr_dev = NULL;
 328         struct net *curr_net = NULL;
 329         struct sk_buff *skb, *next;
 330         struct list_head sublist;
 331
 332         INIT_LIST_HEAD(&sublist);
 333         list_for_each_entry_safe(skb, next, head, list) {
 334                 struct net_device *dev = skb->dev;
 335                 struct net *net = dev_net(dev);
 336
 337                 skb_list_del_init(skb);
 338                 skb = ip6_rcv_core(skb, dev, net);
 339                 if (skb == NULL)
 340                         continue;
 341
 342                 if (curr_dev != dev || curr_net != net) {
 343                         /* dispatch old sublist */
 344                         if (!list_empty(&sublist))
 345                                 ip6_sublist_rcv(&sublist, curr_dev, curr_net);
 346                         /* start new sublist */
 347                         INIT_LIST_HEAD(&sublist);
 348                         curr_dev = dev;
 349                         curr_net = net;
 350                 }
 351                 list_add_tail(&skb->list, &sublist);
 352         }
 353         /* dispatch final sublist */
 354         if (!list_empty(&sublist))
 355                 ip6_sublist_rcv(&sublist, curr_dev, curr_net);
 356 }
 357
 358 INDIRECT_CALLABLE_DECLARE(int tcp_v6_rcv(struct sk_buff *));
 359
 360 /*
 361  *      Deliver the packet to the host
 362  */
 363 void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
 364                               bool have_final)
 365 {
 366         const struct inet6_protocol *ipprot;
 367         struct inet6_dev *idev;
 368         unsigned int nhoff;
 369         SKB_DR(reason);
 370         bool raw;
 371
 372         /*
 373          *      Parse extension headers
 374          */
 375
 376 resubmit:
 377         idev = ip6_dst_idev(skb_dst(skb));
 378         nhoff = IP6CB(skb)->nhoff;
 379         if (!have_final) {
 380                 if (!pskb_pull(skb, skb_transport_offset(skb)))
 381                         goto discard;
 382                 nexthdr = skb_network_header(skb)[nhoff];
 383         }
 384
 385 resubmit_final:
 386         raw = raw6_local_deliver(skb, nexthdr);
 387         ipprot = rcu_dereference(inet6_protos[nexthdr]);
 388         if (ipprot) {
 389                 int ret;
 390
 391                 if (have_final) {
 392                         if (!(ipprot->flags & INET6_PROTO_FINAL)) {
 393                                 /* Once we've seen a final protocol don't
 394                                  * allow encapsulation on any non-final
 395                                  * ones. This allows foo in UDP encapsulation
 396                                  * to work.
 397                                  */
 398                                 goto discard;
 399                         }
 400                 } else if (ipprot->flags & INET6_PROTO_FINAL) {
 401                         const struct ipv6hdr *hdr;
 402                         int sdif = inet6_sdif(skb);
 403                         struct net_device *dev;
 404
 405                         /* Only do this once for first final protocol */
 406                         have_final = true;
 407
 408
 409                         skb_postpull_rcsum(skb, skb_network_header(skb),
 410                                            skb_network_header_len(skb));
 411                         hdr = ipv6_hdr(skb);
 412
 413                         /* skb->dev passed may be master dev for vrfs. */
 414                         if (sdif) {
 415                                 dev = dev_get_by_index_rcu(net, sdif);
 416                                 if (!dev)
 417                                         goto discard;
 418                         } else {
 419                                 dev = skb->dev;
 420                         }
 421
 422                         if (ipv6_addr_is_multicast(&hdr->daddr) &&
 423                             !ipv6_chk_mcast_addr(dev, &hdr->daddr,
 424                                                  &hdr->saddr) &&
 425                             !ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb))) {
 426                                 SKB_DR_SET(reason, IP_INADDRERRORS);
 427                                 goto discard;
 428                         }
 429                 }
 430                 if (!(ipprot->flags & INET6_PROTO_NOPOLICY)) {
 431                         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 432                                 SKB_DR_SET(reason, XFRM_POLICY);
 433                                 goto discard;
 434                         }
 435                         nf_reset_ct(skb);
 436                 }
 437
 438                 ret = INDIRECT_CALL_2(ipprot->handler, tcp_v6_rcv, udpv6_rcv,
 439                                       skb);
 440                 if (ret > 0) {
 441                         if (ipprot->flags & INET6_PROTO_FINAL) {
 442                                 /* Not an extension header, most likely UDP
 443                                  * encapsulation. Use return value as nexthdr
 444                                  * protocol not nhoff (which presumably is
 445                                  * not set by handler).
 446                                  */
 447                                 nexthdr = ret;
 448                                 goto resubmit_final;
 449                         } else {
 450                                 goto resubmit;
 451                         }
 452                 } else if (ret == 0) {
 453                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDELIVERS);
 454                 }
 455         } else {
 456                 if (!raw) {
 457                         if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 458                                 __IP6_INC_STATS(net, idev,
 459                                                 IPSTATS_MIB_INUNKNOWNPROTOS);
 460                                 icmpv6_send(skb, ICMPV6_PARAMPROB,
 461                                             ICMPV6_UNK_NEXTHDR, nhoff);
 462                                 SKB_DR_SET(reason, IP_NOPROTO);
 463                         } else {
 464                                 SKB_DR_SET(reason, XFRM_POLICY);
 465                         }
 466                         kfree_skb_reason(skb, reason);
 467                 } else {
 468                         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDELIVERS);
 469                         consume_skb(skb);
 470                 }
 471         }
 472         return;
 473
 474 discard:
 475         __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
 476         kfree_skb_reason(skb, reason);
 477 }
 478
 479 static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 480 {
 481         skb_clear_delivery_time(skb);
 482         rcu_read_lock();
 483         ip6_protocol_deliver_rcu(net, skb, 0, false);
 484         rcu_read_unlock();
 485
 486         return 0;
 487 }
 488
 489
 490 int ip6_input(struct sk_buff *skb)
 491 {
 492         return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_IN,
 493                        dev_net(skb->dev), NULL, skb, skb->dev, NULL,
 494                        ip6_input_finish);
 495 }
 496 EXPORT_SYMBOL_GPL(ip6_input);
 497
 498 int ip6_mc_input(struct sk_buff *skb)
 499 {
 500         int sdif = inet6_sdif(skb);
 501         const struct ipv6hdr *hdr;
 502         struct net_device *dev;
 503         bool deliver;
 504
 505         __IP6_UPD_PO_STATS(dev_net(skb_dst(skb)->dev),
 506                          __in6_dev_get_safely(skb->dev), IPSTATS_MIB_INMCAST,
 507                          skb->len);
 508
 509         /* skb->dev passed may be master dev for vrfs. */
 510         if (sdif) {
 511                 rcu_read_lock();
 512                 dev = dev_get_by_index_rcu(dev_net(skb->dev), sdif);
 513                 if (!dev) {
 514                         rcu_read_unlock();
 515                         kfree_skb(skb);
 516                         return -ENODEV;
 517                 }
 518         } else {
 519                 dev = skb->dev;
 520         }
 521
 522         hdr = ipv6_hdr(skb);
 523         deliver = ipv6_chk_mcast_addr(dev, &hdr->daddr, NULL);
 524         if (sdif)
 525                 rcu_read_unlock();
 526
 527 #ifdef CONFIG_IPV6_MROUTE
 528         /*
 529          *      IPv6 multicast router mode is now supported ;)
 530          */
 531         if (atomic_read(&dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding) &&
 532             !(ipv6_addr_type(&hdr->daddr) &
 533               (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) &&
 534             likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
 535                 /*
 536                  * Okay, we try to forward - split and duplicate
 537                  * packets.
 538                  */
 539                 struct sk_buff *skb2;
 540                 struct inet6_skb_parm *opt = IP6CB(skb);
 541
 542                 /* Check for MLD */
 543                 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
 544                         /* Check if this is a mld message */
 545                         u8 nexthdr = hdr->nexthdr;
 546                         __be16 frag_off;
 547                         int offset;
 548
 549                         /* Check if the value of Router Alert
 550                          * is for MLD (0x0000).
 551                          */
 552                         if (opt->ra == htons(IPV6_OPT_ROUTERALERT_MLD)) {
 553                                 deliver = false;
 554
 555                                 if (!ipv6_ext_hdr(nexthdr)) {
 556                                         /* BUG */
 557                                         goto out;
 558                                 }
 559                                 offset = ipv6_skip_exthdr(skb, sizeof(*hdr),
 560                                                           &nexthdr, &frag_off);
 561                                 if (offset < 0)
 562                                         goto out;
 563
 564                                 if (ipv6_is_mld(skb, nexthdr, offset))
 565                                         deliver = true;
 566
 567                                 goto out;
 568                         }
 569                         /* unknown RA - process it normally */
 570                 }
 571
 572                 if (deliver)
 573                         skb2 = skb_clone(skb, GFP_ATOMIC);
 574                 else {
 575                         skb2 = skb;
 576                         skb = NULL;
 577                 }
 578
 579                 if (skb2) {
 580                         ip6_mr_input(skb2);
 581                 }
 582         }
 583 out:
 584 #endif
 585         if (likely(deliver))
 586                 ip6_input(skb);
 587         else {
 588                 /* discard */
 589                 kfree_skb(skb);
 590         }
 591
 592         return 0;
 593 }