1 // SPDX-License-Identifier: GPL-2.0-or-later
4 * Linux INET6 implementation
7 * Pedro Roque <roque@di.fc.ul.pt>
8 * Ian P. Morris <I.P.Morris@soton.ac.uk>
10 * Based in linux/net/ipv4/ip_input.c
14 * Mitsuru KANDA @USAGI and
15 * YOSHIFUJI Hideaki @USAGI: Remove ipv6_parse_exthdrs().
18 #include <linux/errno.h>
19 #include <linux/types.h>
20 #include <linux/socket.h>
21 #include <linux/sockios.h>
22 #include <linux/net.h>
23 #include <linux/netdevice.h>
24 #include <linux/in6.h>
25 #include <linux/icmpv6.h>
26 #include <linux/mroute6.h>
27 #include <linux/slab.h>
28 #include <linux/indirect_call_wrapper.h>
30 #include <linux/netfilter.h>
31 #include <linux/netfilter_ipv6.h>
37 #include <net/protocol.h>
38 #include <net/transp_v6.h>
39 #include <net/rawv6.h>
40 #include <net/ndisc.h>
41 #include <net/ip6_route.h>
42 #include <net/addrconf.h>
44 #include <net/inet_ecn.h>
45 #include <net/dst_metadata.h>
47 INDIRECT_CALLABLE_DECLARE(void udp_v6_early_demux(struct sk_buff
*));
48 INDIRECT_CALLABLE_DECLARE(void tcp_v6_early_demux(struct sk_buff
*));
49 static void ip6_rcv_finish_core(struct net
*net
, struct sock
*sk
,
52 void (*edemux
)(struct sk_buff
*skb
);
54 if (net
->ipv4
.sysctl_ip_early_demux
&& !skb_dst(skb
) && skb
->sk
== NULL
) {
55 const struct inet6_protocol
*ipprot
;
57 ipprot
= rcu_dereference(inet6_protos
[ipv6_hdr(skb
)->nexthdr
]);
58 if (ipprot
&& (edemux
= READ_ONCE(ipprot
->early_demux
)))
59 INDIRECT_CALL_2(edemux
, tcp_v6_early_demux
,
60 udp_v6_early_demux
, skb
);
62 if (!skb_valid_dst(skb
))
66 int ip6_rcv_finish(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
68 /* if ingress device is enslaved to an L3 master device pass the
69 * skb to its handler for processing
71 skb
= l3mdev_ip6_rcv(skb
);
73 return NET_RX_SUCCESS
;
74 ip6_rcv_finish_core(net
, sk
, skb
);
76 return dst_input(skb
);
79 static void ip6_sublist_rcv_finish(struct list_head
*head
)
81 struct sk_buff
*skb
, *next
;
83 list_for_each_entry_safe(skb
, next
, head
, list
) {
84 skb_list_del_init(skb
);
89 static void ip6_list_rcv_finish(struct net
*net
, struct sock
*sk
,
90 struct list_head
*head
)
92 struct dst_entry
*curr_dst
= NULL
;
93 struct sk_buff
*skb
, *next
;
94 struct list_head sublist
;
96 INIT_LIST_HEAD(&sublist
);
97 list_for_each_entry_safe(skb
, next
, head
, list
) {
98 struct dst_entry
*dst
;
100 skb_list_del_init(skb
);
101 /* if ingress device is enslaved to an L3 master device pass the
102 * skb to its handler for processing
104 skb
= l3mdev_ip6_rcv(skb
);
107 ip6_rcv_finish_core(net
, sk
, skb
);
109 if (curr_dst
!= dst
) {
110 /* dispatch old sublist */
111 if (!list_empty(&sublist
))
112 ip6_sublist_rcv_finish(&sublist
);
113 /* start new sublist */
114 INIT_LIST_HEAD(&sublist
);
117 list_add_tail(&skb
->list
, &sublist
);
119 /* dispatch final sublist */
120 ip6_sublist_rcv_finish(&sublist
);
123 static struct sk_buff
*ip6_rcv_core(struct sk_buff
*skb
, struct net_device
*dev
,
126 const struct ipv6hdr
*hdr
;
128 struct inet6_dev
*idev
;
130 if (skb
->pkt_type
== PACKET_OTHERHOST
) {
137 idev
= __in6_dev_get(skb
->dev
);
139 __IP6_UPD_PO_STATS(net
, idev
, IPSTATS_MIB_IN
, skb
->len
);
141 if ((skb
= skb_share_check(skb
, GFP_ATOMIC
)) == NULL
||
142 !idev
|| unlikely(idev
->cnf
.disable_ipv6
)) {
143 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INDISCARDS
);
147 memset(IP6CB(skb
), 0, sizeof(struct inet6_skb_parm
));
150 * Store incoming device index. When the packet will
151 * be queued, we cannot refer to skb->dev anymore.
153 * BTW, when we send a packet for our own local address on a
154 * non-loopback interface (e.g. ethX), it is being delivered
155 * via the loopback interface (lo) here; skb->dev = loopback_dev.
156 * It, however, should be considered as if it is being
157 * arrived via the sending interface (ethX), because of the
158 * nature of scoping architecture. --yoshfuji
160 IP6CB(skb
)->iif
= skb_valid_dst(skb
) ? ip6_dst_idev(skb_dst(skb
))->dev
->ifindex
: dev
->ifindex
;
162 if (unlikely(!pskb_may_pull(skb
, sizeof(*hdr
))))
167 if (hdr
->version
!= 6)
170 __IP6_ADD_STATS(net
, idev
,
171 IPSTATS_MIB_NOECTPKTS
+
172 (ipv6_get_dsfield(hdr
) & INET_ECN_MASK
),
173 max_t(unsigned short, 1, skb_shinfo(skb
)->gso_segs
));
176 * The loopback address must not be used as the source address in IPv6
177 * packets that are sent outside of a single node. [..]
178 * A packet received on an interface with a destination address
179 * of loopback must be dropped.
181 if ((ipv6_addr_loopback(&hdr
->saddr
) ||
182 ipv6_addr_loopback(&hdr
->daddr
)) &&
183 !(dev
->flags
& IFF_LOOPBACK
) &&
184 !netif_is_l3_master(dev
))
187 /* RFC4291 Errata ID: 3480
188 * Interface-Local scope spans only a single interface on a
189 * node and is useful only for loopback transmission of
190 * multicast. Packets with interface-local scope received
191 * from another node must be discarded.
193 if (!(skb
->pkt_type
== PACKET_LOOPBACK
||
194 dev
->flags
& IFF_LOOPBACK
) &&
195 ipv6_addr_is_multicast(&hdr
->daddr
) &&
196 IPV6_ADDR_MC_SCOPE(&hdr
->daddr
) == 1)
199 /* If enabled, drop unicast packets that were encapsulated in link-layer
200 * multicast or broadcast to protected against the so-called "hole-196"
201 * attack in 802.11 wireless.
203 if (!ipv6_addr_is_multicast(&hdr
->daddr
) &&
204 (skb
->pkt_type
== PACKET_BROADCAST
||
205 skb
->pkt_type
== PACKET_MULTICAST
) &&
206 idev
->cnf
.drop_unicast_in_l2_multicast
)
210 * Nodes must not originate a packet to a multicast address whose scope
211 * field contains the reserved value 0; if such a packet is received, it
212 * must be silently dropped.
214 if (ipv6_addr_is_multicast(&hdr
->daddr
) &&
215 IPV6_ADDR_MC_SCOPE(&hdr
->daddr
) == 0)
220 * Multicast addresses must not be used as source addresses in IPv6
221 * packets or appear in any Routing header.
223 if (ipv6_addr_is_multicast(&hdr
->saddr
))
226 /* While RFC4291 is not explicit about v4mapped addresses
227 * in IPv6 headers, it seems clear linux dual-stack
228 * model can not deal properly with these.
229 * Security models could be fooled by ::ffff:127.0.0.1 for example.
231 * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
233 if (ipv6_addr_v4mapped(&hdr
->saddr
))
236 skb
->transport_header
= skb
->network_header
+ sizeof(*hdr
);
237 IP6CB(skb
)->nhoff
= offsetof(struct ipv6hdr
, nexthdr
);
239 pkt_len
= ntohs(hdr
->payload_len
);
241 /* pkt_len may be zero if Jumbo payload option is present */
242 if (pkt_len
|| hdr
->nexthdr
!= NEXTHDR_HOP
) {
243 if (pkt_len
+ sizeof(struct ipv6hdr
) > skb
->len
) {
245 idev
, IPSTATS_MIB_INTRUNCATEDPKTS
);
248 if (pskb_trim_rcsum(skb
, pkt_len
+ sizeof(struct ipv6hdr
))) {
249 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INHDRERRORS
);
255 if (hdr
->nexthdr
== NEXTHDR_HOP
) {
256 if (ipv6_parse_hopopts(skb
) < 0) {
257 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INHDRERRORS
);
265 /* Must drop socket now because of tproxy. */
270 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INHDRERRORS
);
277 int ipv6_rcv(struct sk_buff
*skb
, struct net_device
*dev
, struct packet_type
*pt
, struct net_device
*orig_dev
)
279 struct net
*net
= dev_net(skb
->dev
);
281 skb
= ip6_rcv_core(skb
, dev
, net
);
284 return NF_HOOK(NFPROTO_IPV6
, NF_INET_PRE_ROUTING
,
285 net
, NULL
, skb
, dev
, NULL
,
289 static void ip6_sublist_rcv(struct list_head
*head
, struct net_device
*dev
,
292 NF_HOOK_LIST(NFPROTO_IPV6
, NF_INET_PRE_ROUTING
, net
, NULL
,
293 head
, dev
, NULL
, ip6_rcv_finish
);
294 ip6_list_rcv_finish(net
, NULL
, head
);
297 /* Receive a list of IPv6 packets */
298 void ipv6_list_rcv(struct list_head
*head
, struct packet_type
*pt
,
299 struct net_device
*orig_dev
)
301 struct net_device
*curr_dev
= NULL
;
302 struct net
*curr_net
= NULL
;
303 struct sk_buff
*skb
, *next
;
304 struct list_head sublist
;
306 INIT_LIST_HEAD(&sublist
);
307 list_for_each_entry_safe(skb
, next
, head
, list
) {
308 struct net_device
*dev
= skb
->dev
;
309 struct net
*net
= dev_net(dev
);
311 skb_list_del_init(skb
);
312 skb
= ip6_rcv_core(skb
, dev
, net
);
316 if (curr_dev
!= dev
|| curr_net
!= net
) {
317 /* dispatch old sublist */
318 if (!list_empty(&sublist
))
319 ip6_sublist_rcv(&sublist
, curr_dev
, curr_net
);
320 /* start new sublist */
321 INIT_LIST_HEAD(&sublist
);
325 list_add_tail(&skb
->list
, &sublist
);
327 /* dispatch final sublist */
328 ip6_sublist_rcv(&sublist
, curr_dev
, curr_net
);
331 INDIRECT_CALLABLE_DECLARE(int udpv6_rcv(struct sk_buff
*));
332 INDIRECT_CALLABLE_DECLARE(int tcp_v6_rcv(struct sk_buff
*));
335 * Deliver the packet to the host
337 void ip6_protocol_deliver_rcu(struct net
*net
, struct sk_buff
*skb
, int nexthdr
,
340 const struct inet6_protocol
*ipprot
;
341 struct inet6_dev
*idev
;
346 * Parse extension headers
350 idev
= ip6_dst_idev(skb_dst(skb
));
351 nhoff
= IP6CB(skb
)->nhoff
;
353 if (!pskb_pull(skb
, skb_transport_offset(skb
)))
355 nexthdr
= skb_network_header(skb
)[nhoff
];
359 raw
= raw6_local_deliver(skb
, nexthdr
);
360 ipprot
= rcu_dereference(inet6_protos
[nexthdr
]);
365 if (!(ipprot
->flags
& INET6_PROTO_FINAL
)) {
366 /* Once we've seen a final protocol don't
367 * allow encapsulation on any non-final
368 * ones. This allows foo in UDP encapsulation
373 } else if (ipprot
->flags
& INET6_PROTO_FINAL
) {
374 const struct ipv6hdr
*hdr
;
375 int sdif
= inet6_sdif(skb
);
376 struct net_device
*dev
;
378 /* Only do this once for first final protocol */
381 /* Free reference early: we don't need it any more,
382 and it may hold ip_conntrack module loaded
386 skb_postpull_rcsum(skb
, skb_network_header(skb
),
387 skb_network_header_len(skb
));
390 /* skb->dev passed may be master dev for vrfs. */
392 dev
= dev_get_by_index_rcu(net
, sdif
);
399 if (ipv6_addr_is_multicast(&hdr
->daddr
) &&
400 !ipv6_chk_mcast_addr(dev
, &hdr
->daddr
,
402 !ipv6_is_mld(skb
, nexthdr
, skb_network_header_len(skb
)))
405 if (!(ipprot
->flags
& INET6_PROTO_NOPOLICY
) &&
406 !xfrm6_policy_check(NULL
, XFRM_POLICY_IN
, skb
))
409 ret
= INDIRECT_CALL_2(ipprot
->handler
, tcp_v6_rcv
, udpv6_rcv
,
412 if (ipprot
->flags
& INET6_PROTO_FINAL
) {
413 /* Not an extension header, most likely UDP
414 * encapsulation. Use return value as nexthdr
415 * protocol not nhoff (which presumably is
416 * not set by handler).
423 } else if (ret
== 0) {
424 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INDELIVERS
);
428 if (xfrm6_policy_check(NULL
, XFRM_POLICY_IN
, skb
)) {
429 __IP6_INC_STATS(net
, idev
,
430 IPSTATS_MIB_INUNKNOWNPROTOS
);
431 icmpv6_send(skb
, ICMPV6_PARAMPROB
,
432 ICMPV6_UNK_NEXTHDR
, nhoff
);
436 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INDELIVERS
);
443 __IP6_INC_STATS(net
, idev
, IPSTATS_MIB_INDISCARDS
);
447 static int ip6_input_finish(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
450 ip6_protocol_deliver_rcu(net
, skb
, 0, false);
457 int ip6_input(struct sk_buff
*skb
)
459 return NF_HOOK(NFPROTO_IPV6
, NF_INET_LOCAL_IN
,
460 dev_net(skb
->dev
), NULL
, skb
, skb
->dev
, NULL
,
463 EXPORT_SYMBOL_GPL(ip6_input
);
465 int ip6_mc_input(struct sk_buff
*skb
)
467 int sdif
= inet6_sdif(skb
);
468 const struct ipv6hdr
*hdr
;
469 struct net_device
*dev
;
472 __IP6_UPD_PO_STATS(dev_net(skb_dst(skb
)->dev
),
473 __in6_dev_get_safely(skb
->dev
), IPSTATS_MIB_INMCAST
,
476 /* skb->dev passed may be master dev for vrfs. */
479 dev
= dev_get_by_index_rcu(dev_net(skb
->dev
), sdif
);
490 deliver
= ipv6_chk_mcast_addr(dev
, &hdr
->daddr
, NULL
);
494 #ifdef CONFIG_IPV6_MROUTE
496 * IPv6 multicast router mode is now supported ;)
498 if (dev_net(skb
->dev
)->ipv6
.devconf_all
->mc_forwarding
&&
499 !(ipv6_addr_type(&hdr
->daddr
) &
500 (IPV6_ADDR_LOOPBACK
|IPV6_ADDR_LINKLOCAL
)) &&
501 likely(!(IP6CB(skb
)->flags
& IP6SKB_FORWARDED
))) {
503 * Okay, we try to forward - split and duplicate
506 struct sk_buff
*skb2
;
507 struct inet6_skb_parm
*opt
= IP6CB(skb
);
510 if (unlikely(opt
->flags
& IP6SKB_ROUTERALERT
)) {
511 /* Check if this is a mld message */
512 u8 nexthdr
= hdr
->nexthdr
;
516 /* Check if the value of Router Alert
517 * is for MLD (0x0000).
519 if (opt
->ra
== htons(IPV6_OPT_ROUTERALERT_MLD
)) {
522 if (!ipv6_ext_hdr(nexthdr
)) {
526 offset
= ipv6_skip_exthdr(skb
, sizeof(*hdr
),
527 &nexthdr
, &frag_off
);
531 if (ipv6_is_mld(skb
, nexthdr
, offset
))
536 /* unknown RA - process it normally */
540 skb2
= skb_clone(skb
, GFP_ATOMIC
);