1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#include <linux/errno.h>
19#include <linux/types.h>
20#include <linux/socket.h>
21#include <linux/sockios.h>
22#include <linux/net.h>
23#include <linux/netdevice.h>
24#include <linux/in6.h>
25#include <linux/icmpv6.h>
26#include <linux/mroute6.h>
27#include <linux/slab.h>
28#include <linux/indirect_call_wrapper.h>
29
30#include <linux/netfilter.h>
31#include <linux/netfilter_ipv6.h>
32
33#include <net/sock.h>
34#include <net/snmp.h>
35
36#include <net/ipv6.h>
37#include <net/protocol.h>
38#include <net/transp_v6.h>
39#include <net/rawv6.h>
40#include <net/ndisc.h>
41#include <net/ip6_route.h>
42#include <net/addrconf.h>
43#include <net/xfrm.h>
44#include <net/inet_ecn.h>
45#include <net/dst_metadata.h>
46
47INDIRECT_CALLABLE_DECLARE(void udp_v6_early_demux(struct sk_buff *));
48INDIRECT_CALLABLE_DECLARE(void tcp_v6_early_demux(struct sk_buff *));
49static void ip6_rcv_finish_core(struct net *net, struct sock *sk,
50 struct sk_buff *skb)
51{
52 void (*edemux)(struct sk_buff *skb);
53
54 if (net->ipv4.sysctl_ip_early_demux && !skb_dst(skb) && skb->sk == NULL) {
55 const struct inet6_protocol *ipprot;
56
57 ipprot = rcu_dereference(inet6_protos[ipv6_hdr(skb)->nexthdr]);
58 if (ipprot && (edemux = READ_ONCE(ipprot->early_demux)))
59 INDIRECT_CALL_2(edemux, tcp_v6_early_demux,
60 udp_v6_early_demux, skb);
61 }
62 if (!skb_valid_dst(skb))
63 ip6_route_input(skb);
64}
65
66int ip6_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
67{
68
69
70
71 skb = l3mdev_ip6_rcv(skb);
72 if (!skb)
73 return NET_RX_SUCCESS;
74 ip6_rcv_finish_core(net, sk, skb);
75
76 return dst_input(skb);
77}
78
79static void ip6_sublist_rcv_finish(struct list_head *head)
80{
81 struct sk_buff *skb, *next;
82
83 list_for_each_entry_safe(skb, next, head, list)
84 dst_input(skb);
85}
86
87static void ip6_list_rcv_finish(struct net *net, struct sock *sk,
88 struct list_head *head)
89{
90 struct dst_entry *curr_dst = NULL;
91 struct sk_buff *skb, *next;
92 struct list_head sublist;
93
94 INIT_LIST_HEAD(&sublist);
95 list_for_each_entry_safe(skb, next, head, list) {
96 struct dst_entry *dst;
97
98 skb_list_del_init(skb);
99
100
101
102 skb = l3mdev_ip6_rcv(skb);
103 if (!skb)
104 continue;
105 ip6_rcv_finish_core(net, sk, skb);
106 dst = skb_dst(skb);
107 if (curr_dst != dst) {
108
109 if (!list_empty(&sublist))
110 ip6_sublist_rcv_finish(&sublist);
111
112 INIT_LIST_HEAD(&sublist);
113 curr_dst = dst;
114 }
115 list_add_tail(&skb->list, &sublist);
116 }
117
118 ip6_sublist_rcv_finish(&sublist);
119}
120
121static struct sk_buff *ip6_rcv_core(struct sk_buff *skb, struct net_device *dev,
122 struct net *net)
123{
124 const struct ipv6hdr *hdr;
125 u32 pkt_len;
126 struct inet6_dev *idev;
127
128 if (skb->pkt_type == PACKET_OTHERHOST) {
129 kfree_skb(skb);
130 return NULL;
131 }
132
133 rcu_read_lock();
134
135 idev = __in6_dev_get(skb->dev);
136
137 __IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_IN, skb->len);
138
139 if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
140 !idev || unlikely(idev->cnf.disable_ipv6)) {
141 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
142 goto drop;
143 }
144
145 memset(IP6CB(skb), 0, sizeof(struct inet6_skb_parm));
146
147
148
149
150
151
152
153
154
155
156
157
158 IP6CB(skb)->iif = skb_valid_dst(skb) ? ip6_dst_idev(skb_dst(skb))->dev->ifindex : dev->ifindex;
159
160 if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
161 goto err;
162
163 hdr = ipv6_hdr(skb);
164
165 if (hdr->version != 6)
166 goto err;
167
168 __IP6_ADD_STATS(net, idev,
169 IPSTATS_MIB_NOECTPKTS +
170 (ipv6_get_dsfield(hdr) & INET_ECN_MASK),
171 max_t(unsigned short, 1, skb_shinfo(skb)->gso_segs));
172
173
174
175
176
177
178
179 if ((ipv6_addr_loopback(&hdr->saddr) ||
180 ipv6_addr_loopback(&hdr->daddr)) &&
181 !(dev->flags & IFF_LOOPBACK) &&
182 !netif_is_l3_master(dev))
183 goto err;
184
185
186
187
188
189
190
191 if (!(skb->pkt_type == PACKET_LOOPBACK ||
192 dev->flags & IFF_LOOPBACK) &&
193 ipv6_addr_is_multicast(&hdr->daddr) &&
194 IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
195 goto err;
196
197
198
199
200
201 if (!ipv6_addr_is_multicast(&hdr->daddr) &&
202 (skb->pkt_type == PACKET_BROADCAST ||
203 skb->pkt_type == PACKET_MULTICAST) &&
204 idev->cnf.drop_unicast_in_l2_multicast)
205 goto err;
206
207
208
209
210
211
212 if (ipv6_addr_is_multicast(&hdr->daddr) &&
213 IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0)
214 goto err;
215
216
217
218
219
220
221 if (ipv6_addr_is_multicast(&hdr->saddr))
222 goto err;
223
224 skb->transport_header = skb->network_header + sizeof(*hdr);
225 IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
226
227 pkt_len = ntohs(hdr->payload_len);
228
229
230 if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
231 if (pkt_len + sizeof(struct ipv6hdr) > skb->len) {
232 __IP6_INC_STATS(net,
233 idev, IPSTATS_MIB_INTRUNCATEDPKTS);
234 goto drop;
235 }
236 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) {
237 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
238 goto drop;
239 }
240 hdr = ipv6_hdr(skb);
241 }
242
243 if (hdr->nexthdr == NEXTHDR_HOP) {
244 if (ipv6_parse_hopopts(skb) < 0) {
245 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
246 rcu_read_unlock();
247 return NULL;
248 }
249 }
250
251 rcu_read_unlock();
252
253
254 skb_orphan(skb);
255
256 return skb;
257err:
258 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
259drop:
260 rcu_read_unlock();
261 kfree_skb(skb);
262 return NULL;
263}
264
265int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt, struct net_device *orig_dev)
266{
267 struct net *net = dev_net(skb->dev);
268
269 skb = ip6_rcv_core(skb, dev, net);
270 if (skb == NULL)
271 return NET_RX_DROP;
272 return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING,
273 net, NULL, skb, dev, NULL,
274 ip6_rcv_finish);
275}
276
277static void ip6_sublist_rcv(struct list_head *head, struct net_device *dev,
278 struct net *net)
279{
280 NF_HOOK_LIST(NFPROTO_IPV6, NF_INET_PRE_ROUTING, net, NULL,
281 head, dev, NULL, ip6_rcv_finish);
282 ip6_list_rcv_finish(net, NULL, head);
283}
284
285
286void ipv6_list_rcv(struct list_head *head, struct packet_type *pt,
287 struct net_device *orig_dev)
288{
289 struct net_device *curr_dev = NULL;
290 struct net *curr_net = NULL;
291 struct sk_buff *skb, *next;
292 struct list_head sublist;
293
294 INIT_LIST_HEAD(&sublist);
295 list_for_each_entry_safe(skb, next, head, list) {
296 struct net_device *dev = skb->dev;
297 struct net *net = dev_net(dev);
298
299 skb_list_del_init(skb);
300 skb = ip6_rcv_core(skb, dev, net);
301 if (skb == NULL)
302 continue;
303
304 if (curr_dev != dev || curr_net != net) {
305
306 if (!list_empty(&sublist))
307 ip6_sublist_rcv(&sublist, curr_dev, curr_net);
308
309 INIT_LIST_HEAD(&sublist);
310 curr_dev = dev;
311 curr_net = net;
312 }
313 list_add_tail(&skb->list, &sublist);
314 }
315
316 ip6_sublist_rcv(&sublist, curr_dev, curr_net);
317}
318
319INDIRECT_CALLABLE_DECLARE(int udpv6_rcv(struct sk_buff *));
320INDIRECT_CALLABLE_DECLARE(int tcp_v6_rcv(struct sk_buff *));
321
322
323
324
325void ip6_protocol_deliver_rcu(struct net *net, struct sk_buff *skb, int nexthdr,
326 bool have_final)
327{
328 const struct inet6_protocol *ipprot;
329 struct inet6_dev *idev;
330 unsigned int nhoff;
331 bool raw;
332
333
334
335
336
337resubmit:
338 idev = ip6_dst_idev(skb_dst(skb));
339 nhoff = IP6CB(skb)->nhoff;
340 if (!have_final) {
341 if (!pskb_pull(skb, skb_transport_offset(skb)))
342 goto discard;
343 nexthdr = skb_network_header(skb)[nhoff];
344 }
345
346resubmit_final:
347 raw = raw6_local_deliver(skb, nexthdr);
348 ipprot = rcu_dereference(inet6_protos[nexthdr]);
349 if (ipprot) {
350 int ret;
351
352 if (have_final) {
353 if (!(ipprot->flags & INET6_PROTO_FINAL)) {
354
355
356
357
358
359 goto discard;
360 }
361 } else if (ipprot->flags & INET6_PROTO_FINAL) {
362 const struct ipv6hdr *hdr;
363 int sdif = inet6_sdif(skb);
364 struct net_device *dev;
365
366
367 have_final = true;
368
369
370
371
372 nf_reset(skb);
373
374 skb_postpull_rcsum(skb, skb_network_header(skb),
375 skb_network_header_len(skb));
376 hdr = ipv6_hdr(skb);
377
378
379 if (sdif) {
380 dev = dev_get_by_index_rcu(net, sdif);
381 if (!dev)
382 goto discard;
383 } else {
384 dev = skb->dev;
385 }
386
387 if (ipv6_addr_is_multicast(&hdr->daddr) &&
388 !ipv6_chk_mcast_addr(dev, &hdr->daddr,
389 &hdr->saddr) &&
390 !ipv6_is_mld(skb, nexthdr, skb_network_header_len(skb)))
391 goto discard;
392 }
393 if (!(ipprot->flags & INET6_PROTO_NOPOLICY) &&
394 !xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
395 goto discard;
396
397 ret = INDIRECT_CALL_2(ipprot->handler, tcp_v6_rcv, udpv6_rcv,
398 skb);
399 if (ret > 0) {
400 if (ipprot->flags & INET6_PROTO_FINAL) {
401
402
403
404
405
406 nexthdr = ret;
407 goto resubmit_final;
408 } else {
409 goto resubmit;
410 }
411 } else if (ret == 0) {
412 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDELIVERS);
413 }
414 } else {
415 if (!raw) {
416 if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
417 __IP6_INC_STATS(net, idev,
418 IPSTATS_MIB_INUNKNOWNPROTOS);
419 icmpv6_send(skb, ICMPV6_PARAMPROB,
420 ICMPV6_UNK_NEXTHDR, nhoff);
421 }
422 kfree_skb(skb);
423 } else {
424 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDELIVERS);
425 consume_skb(skb);
426 }
427 }
428 return;
429
430discard:
431 __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
432 kfree_skb(skb);
433}
434
435static int ip6_input_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
436{
437 rcu_read_lock();
438 ip6_protocol_deliver_rcu(net, skb, 0, false);
439 rcu_read_unlock();
440
441 return 0;
442}
443
444
445int ip6_input(struct sk_buff *skb)
446{
447 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_IN,
448 dev_net(skb->dev), NULL, skb, skb->dev, NULL,
449 ip6_input_finish);
450}
451EXPORT_SYMBOL_GPL(ip6_input);
452
453int ip6_mc_input(struct sk_buff *skb)
454{
455 int sdif = inet6_sdif(skb);
456 const struct ipv6hdr *hdr;
457 struct net_device *dev;
458 bool deliver;
459
460 __IP6_UPD_PO_STATS(dev_net(skb_dst(skb)->dev),
461 __in6_dev_get_safely(skb->dev), IPSTATS_MIB_INMCAST,
462 skb->len);
463
464
465 if (sdif) {
466 rcu_read_lock();
467 dev = dev_get_by_index_rcu(dev_net(skb->dev), sdif);
468 if (!dev) {
469 rcu_read_unlock();
470 kfree_skb(skb);
471 return -ENODEV;
472 }
473 } else {
474 dev = skb->dev;
475 }
476
477 hdr = ipv6_hdr(skb);
478 deliver = ipv6_chk_mcast_addr(dev, &hdr->daddr, NULL);
479 if (sdif)
480 rcu_read_unlock();
481
482#ifdef CONFIG_IPV6_MROUTE
483
484
485
486 if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding &&
487 !(ipv6_addr_type(&hdr->daddr) &
488 (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) &&
489 likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
490
491
492
493
494 struct sk_buff *skb2;
495 struct inet6_skb_parm *opt = IP6CB(skb);
496
497
498 if (unlikely(opt->flags & IP6SKB_ROUTERALERT)) {
499
500 u8 nexthdr = hdr->nexthdr;
501 __be16 frag_off;
502 int offset;
503
504
505
506
507 if (opt->ra == htons(IPV6_OPT_ROUTERALERT_MLD)) {
508 deliver = false;
509
510 if (!ipv6_ext_hdr(nexthdr)) {
511
512 goto out;
513 }
514 offset = ipv6_skip_exthdr(skb, sizeof(*hdr),
515 &nexthdr, &frag_off);
516 if (offset < 0)
517 goto out;
518
519 if (ipv6_is_mld(skb, nexthdr, offset))
520 deliver = true;
521
522 goto out;
523 }
524
525 }
526
527 if (deliver)
528 skb2 = skb_clone(skb, GFP_ATOMIC);
529 else {
530 skb2 = skb;
531 skb = NULL;
532 }
533
534 if (skb2) {
535 ip6_mr_input(skb2);
536 }
537 }
538out:
539#endif
540 if (likely(deliver))
541 ip6_input(skb);
542 else {
543
544 kfree_skb(skb);
545 }
546
547 return 0;
548}
549