mcast_snoop.c 4.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  3. * Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue>
  4. *
  5. * Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki.
  6. */
  7. #include <linux/skbuff.h>
  8. #include <net/ipv6.h>
  9. #include <net/mld.h>
  10. #include <net/addrconf.h>
  11. #include <net/ip6_checksum.h>
  12. static int ipv6_mc_check_ip6hdr(struct sk_buff *skb)
  13. {
  14. const struct ipv6hdr *ip6h;
  15. unsigned int len;
  16. unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h);
  17. if (!pskb_may_pull(skb, offset))
  18. return -EINVAL;
  19. ip6h = ipv6_hdr(skb);
  20. if (ip6h->version != 6)
  21. return -EINVAL;
  22. len = offset + ntohs(ip6h->payload_len);
  23. if (skb->len < len || len <= offset)
  24. return -EINVAL;
  25. skb_set_transport_header(skb, offset);
  26. return 0;
  27. }
  28. static int ipv6_mc_check_exthdrs(struct sk_buff *skb)
  29. {
  30. const struct ipv6hdr *ip6h;
  31. int offset;
  32. u8 nexthdr;
  33. __be16 frag_off;
  34. ip6h = ipv6_hdr(skb);
  35. if (ip6h->nexthdr != IPPROTO_HOPOPTS)
  36. return -ENOMSG;
  37. nexthdr = ip6h->nexthdr;
  38. offset = skb_network_offset(skb) + sizeof(*ip6h);
  39. offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
  40. if (offset < 0)
  41. return -EINVAL;
  42. if (nexthdr != IPPROTO_ICMPV6)
  43. return -ENOMSG;
  44. skb_set_transport_header(skb, offset);
  45. return 0;
  46. }
  47. static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb)
  48. {
  49. unsigned int len = skb_transport_offset(skb);
  50. len += sizeof(struct mld2_report);
  51. return ipv6_mc_may_pull(skb, len) ? 0 : -EINVAL;
  52. }
  53. static int ipv6_mc_check_mld_query(struct sk_buff *skb)
  54. {
  55. unsigned int transport_len = ipv6_transport_len(skb);
  56. struct mld_msg *mld;
  57. unsigned int len;
  58. /* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
  59. if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
  60. return -EINVAL;
  61. /* MLDv1? */
  62. if (transport_len != sizeof(struct mld_msg)) {
  63. /* or MLDv2? */
  64. if (transport_len < sizeof(struct mld2_query))
  65. return -EINVAL;
  66. len = skb_transport_offset(skb) + sizeof(struct mld2_query);
  67. if (!ipv6_mc_may_pull(skb, len))
  68. return -EINVAL;
  69. }
  70. mld = (struct mld_msg *)skb_transport_header(skb);
  71. /* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
  72. * all-nodes destination address (ff02::1) for general queries
  73. */
  74. if (ipv6_addr_any(&mld->mld_mca) &&
  75. !ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
  76. return -EINVAL;
  77. return 0;
  78. }
  79. static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
  80. {
  81. unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg);
  82. struct mld_msg *mld;
  83. if (!ipv6_mc_may_pull(skb, len))
  84. return -ENODATA;
  85. mld = (struct mld_msg *)skb_transport_header(skb);
  86. switch (mld->mld_type) {
  87. case ICMPV6_MGM_REDUCTION:
  88. case ICMPV6_MGM_REPORT:
  89. return 0;
  90. case ICMPV6_MLD2_REPORT:
  91. return ipv6_mc_check_mld_reportv2(skb);
  92. case ICMPV6_MGM_QUERY:
  93. return ipv6_mc_check_mld_query(skb);
  94. default:
  95. return -ENODATA;
  96. }
  97. }
  98. static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
  99. {
  100. return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
  101. }
  102. static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
  103. {
  104. unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
  105. unsigned int transport_len = ipv6_transport_len(skb);
  106. struct sk_buff *skb_chk;
  107. if (!ipv6_mc_may_pull(skb, len))
  108. return -EINVAL;
  109. skb_chk = skb_checksum_trimmed(skb, transport_len,
  110. ipv6_mc_validate_checksum);
  111. if (!skb_chk)
  112. return -EINVAL;
  113. if (skb_chk != skb)
  114. kfree_skb(skb_chk);
  115. return 0;
  116. }
  117. /**
  118. * ipv6_mc_check_mld - checks whether this is a sane MLD packet
  119. * @skb: the skb to validate
  120. *
  121. * Checks whether an IPv6 packet is a valid MLD packet. If so sets
  122. * skb transport header accordingly and returns zero.
  123. *
  124. * -EINVAL: A broken packet was detected, i.e. it violates some internet
  125. * standard
  126. * -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet
  127. * with a hop-by-hop option.
  128. * -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded
  129. * but it is not an MLD packet.
  130. * -ENOMEM: A memory allocation failure happened.
  131. *
  132. * Caller needs to set the skb network header and free any returned skb if it
  133. * differs from the provided skb.
  134. */
  135. int ipv6_mc_check_mld(struct sk_buff *skb)
  136. {
  137. int ret;
  138. ret = ipv6_mc_check_ip6hdr(skb);
  139. if (ret < 0)
  140. return ret;
  141. ret = ipv6_mc_check_exthdrs(skb);
  142. if (ret < 0)
  143. return ret;
  144. ret = ipv6_mc_check_icmpv6(skb);
  145. if (ret < 0)
  146. return ret;
  147. return ipv6_mc_check_mld_msg(skb);
  148. }
  149. EXPORT_SYMBOL(ipv6_mc_check_mld);