2019-05-27 09:55:01 +03:00
// SPDX-License-Identifier: GPL-2.0-or-later
2005-04-17 02:20:36 +04:00
/*
* Internet Control Message Protocol ( ICMPv6 )
* Linux INET6 implementation
*
* Authors :
* Pedro Roque < roque @ di . fc . ul . pt >
*
* Based on net / ipv4 / icmp . c
*
* RFC 1885
*/
/*
* Changes :
*
* Andi Kleen : exception handling
* Andi Kleen add rate limits . never reply to a icmp .
* add more length checks and other fixes .
* yoshfuji : ensure to sent parameter problem for
* fragments .
* YOSHIFUJI Hideaki @ USAGI : added sysctl for icmp rate limit .
* Randy Dunlap and
* YOSHIFUJI Hideaki @ USAGI : Per - interface statistics support
* Kazunori MIYAZAWA @ USAGI : change output process to use ip6_append_data
*/
2012-05-15 18:11:53 +04:00
# define pr_fmt(fmt) "IPv6: " fmt
2005-04-17 02:20:36 +04:00
# include <linux/module.h>
# include <linux/errno.h>
# include <linux/types.h>
# include <linux/socket.h>
# include <linux/in.h>
# include <linux/kernel.h>
# include <linux/sockios.h>
# include <linux/net.h>
# include <linux/skbuff.h>
# include <linux/init.h>
2006-02-16 02:24:15 +03:00
# include <linux/netfilter.h>
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 11:04:11 +03:00
# include <linux/slab.h>
2005-04-17 02:20:36 +04:00
# ifdef CONFIG_SYSCTL
# include <linux/sysctl.h>
# endif
# include <linux/inet.h>
# include <linux/netdevice.h>
# include <linux/icmpv6.h>
# include <net/ip.h>
# include <net/sock.h>
# include <net/ipv6.h>
# include <net/ip6_checksum.h>
2013-05-23 00:17:31 +04:00
# include <net/ping.h>
2005-04-17 02:20:36 +04:00
# include <net/protocol.h>
# include <net/raw.h>
# include <net/rawv6.h>
2022-01-03 20:11:31 +03:00
# include <net/seg6.h>
2005-04-17 02:20:36 +04:00
# include <net/transp_v6.h>
# include <net/ip6_route.h>
# include <net/addrconf.h>
# include <net/icmp.h>
2007-12-12 21:44:43 +03:00
# include <net/xfrm.h>
2008-04-04 01:31:03 +04:00
# include <net/inet_common.h>
2014-01-11 14:55:46 +04:00
# include <net/dsfield.h>
2015-10-12 21:47:10 +03:00
# include <net/l3mdev.h>
2005-04-17 02:20:36 +04:00
2016-12-24 22:46:01 +03:00
# include <linux/uaccess.h>
2005-04-17 02:20:36 +04:00
2022-01-24 23:24:56 +03:00
static DEFINE_PER_CPU ( struct sock * , ipv6_icmp_sk ) ;
2005-04-17 02:20:36 +04:00
2018-11-08 14:19:21 +03:00
static int icmpv6_err ( struct sk_buff * skb , struct inet6_skb_parm * opt ,
2013-01-17 02:09:49 +04:00
u8 type , u8 code , int offset , __be32 info )
{
2013-05-23 00:17:31 +04:00
/* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
struct icmp6hdr * icmp6 = ( struct icmp6hdr * ) ( skb - > data + offset ) ;
2013-01-17 02:09:49 +04:00
struct net * net = dev_net ( skb - > dev ) ;
if ( type = = ICMPV6_PKT_TOOBIG )
2018-08-02 14:56:58 +03:00
ip6_update_pmtu ( skb , net , info , skb - > dev - > ifindex , 0 , sock_net_uid ( net , NULL ) ) ;
2013-01-17 02:09:49 +04:00
else if ( type = = NDISC_REDIRECT )
2016-11-03 20:23:43 +03:00
ip6_redirect ( skb , net , skb - > dev - > ifindex , 0 ,
sock_net_uid ( net , NULL ) ) ;
2013-05-23 00:17:31 +04:00
if ( ! ( type & ICMPV6_INFOMSG_MASK ) )
if ( icmp6 - > icmp6_type = = ICMPV6_ECHO_REQUEST )
2016-06-11 21:32:06 +03:00
ping_err ( skb , offset , ntohl ( info ) ) ;
2018-11-08 14:19:21 +03:00
return 0 ;
2013-01-17 02:09:49 +04:00
}
2007-10-15 23:50:28 +04:00
static int icmpv6_rcv ( struct sk_buff * skb ) ;
2005-04-17 02:20:36 +04:00
2009-09-14 16:22:28 +04:00
static const struct inet6_protocol icmpv6_protocol = {
2005-04-17 02:20:36 +04:00
. handler = icmpv6_rcv ,
2013-01-17 02:09:49 +04:00
. err_handler = icmpv6_err ,
2007-12-12 21:44:43 +03:00
. flags = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL ,
2005-04-17 02:20:36 +04:00
} ;
2017-01-09 18:04:14 +03:00
/* Called with BH disabled */
2022-01-24 23:24:56 +03:00
static struct sock * icmpv6_xmit_lock ( struct net * net )
2005-04-17 02:20:36 +04:00
{
2008-08-23 15:43:33 +04:00
struct sock * sk ;
2022-01-24 23:24:56 +03:00
sk = this_cpu_read ( ipv6_icmp_sk ) ;
2008-02-29 22:16:46 +03:00
if ( unlikely ( ! spin_trylock ( & sk - > sk_lock . slock ) ) ) {
2005-04-17 02:20:36 +04:00
/* This can happen if the output path (f.e. SIT or
* ip6ip6 tunnel ) signals dst_link_failure ( ) for an
* outgoing ICMP6 packet .
*/
2008-08-23 15:43:33 +04:00
return NULL ;
2005-04-17 02:20:36 +04:00
}
2022-01-24 23:24:56 +03:00
sock_net_set ( sk , net ) ;
2008-08-23 15:43:33 +04:00
return sk ;
2005-04-17 02:20:36 +04:00
}
2022-01-24 23:24:56 +03:00
static void icmpv6_xmit_unlock ( struct sock * sk )
2005-04-17 02:20:36 +04:00
{
2022-01-24 23:24:56 +03:00
sock_net_set ( sk , & init_net ) ;
2017-01-09 18:04:14 +03:00
spin_unlock ( & sk - > sk_lock . slock ) ;
2005-04-17 02:20:36 +04:00
}
/*
* Figure out , may we reply to this packet with icmp error .
*
* We do not reply , if :
* - it was icmp error message .
* - it is truncated , so that it is known , that protocol is ICMPV6
* ( i . e . in the middle of some exthdr )
*
* - - ANK ( 980726 )
*/
2012-05-18 22:57:34 +04:00
static bool is_ineligible ( const struct sk_buff * skb )
2005-04-17 02:20:36 +04:00
{
2007-04-26 04:54:47 +04:00
int ptr = ( u8 * ) ( ipv6_hdr ( skb ) + 1 ) - skb - > data ;
2005-04-17 02:20:36 +04:00
int len = skb - > len - ptr ;
2007-04-26 04:54:47 +04:00
__u8 nexthdr = ipv6_hdr ( skb ) - > nexthdr ;
2011-12-01 05:05:51 +04:00
__be16 frag_off ;
2005-04-17 02:20:36 +04:00
if ( len < 0 )
2012-05-18 22:57:34 +04:00
return true ;
2005-04-17 02:20:36 +04:00
2011-12-01 05:05:51 +04:00
ptr = ipv6_skip_exthdr ( skb , ptr , & nexthdr , & frag_off ) ;
2005-04-17 02:20:36 +04:00
if ( ptr < 0 )
2012-05-18 22:57:34 +04:00
return false ;
2005-04-17 02:20:36 +04:00
if ( nexthdr = = IPPROTO_ICMPV6 ) {
u8 _type , * tp ;
tp = skb_header_pointer ( skb ,
ptr + offsetof ( struct icmp6hdr , icmp6_type ) ,
sizeof ( _type ) , & _type ) ;
2020-10-27 15:33:13 +03:00
/* Based on RFC 8200, Section 4.5 Fragment Header, return
* false if this is a fragment packet with no icmp header info .
*/
if ( ! tp & & frag_off ! = 0 )
return false ;
else if ( ! tp | | ! ( * tp & ICMPV6_INFOMSG_MASK ) )
2012-05-18 22:57:34 +04:00
return true ;
2005-04-17 02:20:36 +04:00
}
2012-05-18 22:57:34 +04:00
return false ;
2005-04-17 02:20:36 +04:00
}
2019-04-17 23:35:49 +03:00
static bool icmpv6_mask_allow ( struct net * net , int type )
2017-01-09 18:04:09 +03:00
{
2019-04-17 23:35:49 +03:00
if ( type > ICMPV6_MSG_MAX )
2017-01-09 18:04:09 +03:00
return true ;
2019-04-17 23:35:49 +03:00
/* Limit if icmp type is set in ratemask. */
if ( ! test_bit ( type , net - > ipv6 . sysctl . icmpv6_ratemask ) )
2017-01-09 18:04:09 +03:00
return true ;
return false ;
}
2019-04-17 23:35:49 +03:00
static bool icmpv6_global_allow ( struct net * net , int type )
2017-01-09 18:04:09 +03:00
{
2019-04-17 23:35:49 +03:00
if ( icmpv6_mask_allow ( net , type ) )
2017-01-09 18:04:09 +03:00
return true ;
if ( icmp_global_allow ( ) )
return true ;
2023-01-25 03:16:52 +03:00
__ICMP_INC_STATS ( net , ICMP_MIB_RATELIMITGLOBAL ) ;
2017-01-09 18:04:09 +03:00
return false ;
}
2007-02-09 17:24:49 +03:00
/*
* Check the ICMP output rate limit
2005-04-17 02:20:36 +04:00
*/
2014-09-19 18:38:40 +04:00
static bool icmpv6_xrlim_allow ( struct sock * sk , u8 type ,
struct flowi6 * fl6 )
2005-04-17 02:20:36 +04:00
{
2008-03-25 20:26:21 +03:00
struct net * net = sock_net ( sk ) ;
2014-09-19 18:38:40 +04:00
struct dst_entry * dst ;
2011-02-05 02:55:25 +03:00
bool res = false ;
2005-04-17 02:20:36 +04:00
2019-04-17 23:35:49 +03:00
if ( icmpv6_mask_allow ( net , type ) )
2011-02-05 02:55:25 +03:00
return true ;
2005-04-17 02:20:36 +04:00
2007-02-09 17:24:49 +03:00
/*
2005-04-17 02:20:36 +04:00
* Look up the output route .
* XXX : perhaps the expire for routing entries cloned by
* this lookup should be more aggressive ( not longer than timeout ) .
*/
2011-03-13 00:22:43 +03:00
dst = ip6_route_output ( net , sk , fl6 ) ;
2005-04-17 02:20:36 +04:00
if ( dst - > error ) {
2008-10-08 21:54:51 +04:00
IP6_INC_STATS ( net , ip6_dst_idev ( dst ) ,
2006-11-04 14:11:37 +03:00
IPSTATS_MIB_OUTNOROUTES ) ;
2005-04-17 02:20:36 +04:00
} else if ( dst - > dev & & ( dst - > dev - > flags & IFF_LOOPBACK ) ) {
2011-02-05 02:55:25 +03:00
res = true ;
2005-04-17 02:20:36 +04:00
} else {
2024-04-26 18:19:52 +03:00
struct rt6_info * rt = dst_rt6_info ( dst ) ;
2008-03-05 21:49:18 +03:00
int tmo = net - > ipv6 . sysctl . icmpv6_time ;
2017-01-09 18:04:09 +03:00
struct inet_peer * peer ;
2005-04-17 02:20:36 +04:00
/* Give more bandwidth to wider prefixes. */
if ( rt - > rt6i_dst . plen < 128 )
tmo > > = ( ( 128 - rt - > rt6i_dst . plen ) > > 5 ) ;
2017-01-09 18:04:09 +03:00
peer = inet_getpeer_v6 ( net - > ipv6 . peers , & fl6 - > daddr , 1 ) ;
res = inet_peer_xrlim_allow ( peer , tmo ) ;
if ( peer )
inet_putpeer ( peer ) ;
2005-04-17 02:20:36 +04:00
}
2023-01-25 03:16:52 +03:00
if ( ! res )
__ICMP6_INC_STATS ( net , ip6_dst_idev ( dst ) ,
ICMP6_MIB_RATELIMITHOST ) ;
2005-04-17 02:20:36 +04:00
dst_release ( dst ) ;
return res ;
}
net: icmp6: do not select saddr from iif when route has prefsrc set
Since commit fac6fce9bdb5 ("net: icmp6: provide input address for
traceroute6") ICMPv6 errors have source addresses from the ingress
interface. However, this overrides when source address selection is
influenced by setting preferred source addresses on routes.
This can result in ICMP errors being lost to upstream BCP38 filters
when the wrong source addresses are used, breaking path MTU discovery
and traceroute.
This patch sets the modified source address selection to only take place
when the route used has no prefsrc set.
It can be tested with:
ip link add v1 type veth peer name v2
ip netns add test
ip netns exec test ip link set lo up
ip link set v2 netns test
ip link set v1 up
ip netns exec test ip link set v2 up
ip addr add 2001:db8::1/64 dev v1 nodad
ip addr add 2001:db8::3 dev v1 nodad
ip netns exec test ip addr add 2001:db8::2/64 dev v2 nodad
ip netns exec test ip route add unreachable 2001:db8:1::1
ip netns exec test ip addr add 2001:db8:100::1 dev lo
ip netns exec test ip route add 2001:db8::1 dev v2 src 2001:db8:100::1
ip route add 2001:db8:1000::1 via 2001:db8::2
traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute6 -s 2001:db8::3 2001:db8:1000::1
ip netns delete test
Output before:
$ traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 0.843 ms !N 0.396 ms !N 0.257 ms !N
$ traceroute6 -s 2001:db8::3 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 0.772 ms !N 0.257 ms !N 0.357 ms !N
After:
$ traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8:100::1 (2001:db8:100::1) 8.885 ms !N 0.310 ms !N 0.174 ms !N
$ traceroute6 -s 2001:db8::3 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 1.403 ms !N 0.205 ms !N 0.313 ms !N
Fixes: fac6fce9bdb5 ("net: icmp6: provide input address for traceroute6")
Signed-off-by: Tim Stallard <code@timstallard.me.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-04-03 23:22:57 +03:00
static bool icmpv6_rt_has_prefsrc ( struct sock * sk , u8 type ,
struct flowi6 * fl6 )
{
struct net * net = sock_net ( sk ) ;
struct dst_entry * dst ;
bool res = false ;
dst = ip6_route_output ( net , sk , fl6 ) ;
if ( ! dst - > error ) {
2024-04-26 18:19:52 +03:00
struct rt6_info * rt = dst_rt6_info ( dst ) ;
net: icmp6: do not select saddr from iif when route has prefsrc set
Since commit fac6fce9bdb5 ("net: icmp6: provide input address for
traceroute6") ICMPv6 errors have source addresses from the ingress
interface. However, this overrides when source address selection is
influenced by setting preferred source addresses on routes.
This can result in ICMP errors being lost to upstream BCP38 filters
when the wrong source addresses are used, breaking path MTU discovery
and traceroute.
This patch sets the modified source address selection to only take place
when the route used has no prefsrc set.
It can be tested with:
ip link add v1 type veth peer name v2
ip netns add test
ip netns exec test ip link set lo up
ip link set v2 netns test
ip link set v1 up
ip netns exec test ip link set v2 up
ip addr add 2001:db8::1/64 dev v1 nodad
ip addr add 2001:db8::3 dev v1 nodad
ip netns exec test ip addr add 2001:db8::2/64 dev v2 nodad
ip netns exec test ip route add unreachable 2001:db8:1::1
ip netns exec test ip addr add 2001:db8:100::1 dev lo
ip netns exec test ip route add 2001:db8::1 dev v2 src 2001:db8:100::1
ip route add 2001:db8:1000::1 via 2001:db8::2
traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute6 -s 2001:db8::3 2001:db8:1000::1
ip netns delete test
Output before:
$ traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 0.843 ms !N 0.396 ms !N 0.257 ms !N
$ traceroute6 -s 2001:db8::3 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 0.772 ms !N 0.257 ms !N 0.357 ms !N
After:
$ traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8:100::1 (2001:db8:100::1) 8.885 ms !N 0.310 ms !N 0.174 ms !N
$ traceroute6 -s 2001:db8::3 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 1.403 ms !N 0.205 ms !N 0.313 ms !N
Fixes: fac6fce9bdb5 ("net: icmp6: provide input address for traceroute6")
Signed-off-by: Tim Stallard <code@timstallard.me.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-04-03 23:22:57 +03:00
struct in6_addr prefsrc ;
rt6_get_prefsrc ( rt , & prefsrc ) ;
res = ! ipv6_addr_any ( & prefsrc ) ;
}
dst_release ( dst ) ;
return res ;
}
2005-04-17 02:20:36 +04:00
/*
* an inline helper for the " simple " if statement below
* checks if parameter problem report is caused by an
2007-02-09 17:24:49 +03:00
* unrecognized IPv6 option that has the Option Type
2005-04-17 02:20:36 +04:00
* highest - order two bits set to 10
*/
2012-05-18 22:57:34 +04:00
static bool opt_unrec ( struct sk_buff * skb , __u32 offset )
2005-04-17 02:20:36 +04:00
{
u8 _optval , * op ;
2007-03-11 04:16:10 +03:00
offset + = skb_network_offset ( skb ) ;
2005-04-17 02:20:36 +04:00
op = skb_header_pointer ( skb , offset , sizeof ( _optval ) , & _optval ) ;
2015-03-29 16:00:04 +03:00
if ( ! op )
2012-05-18 22:57:34 +04:00
return true ;
2005-04-17 02:20:36 +04:00
return ( * op & 0xC0 ) = = 0x80 ;
}
2017-10-06 09:46:14 +03:00
void icmpv6_push_pending_frames ( struct sock * sk , struct flowi6 * fl6 ,
struct icmp6hdr * thdr , int len )
2005-04-17 02:20:36 +04:00
{
struct sk_buff * skb ;
struct icmp6hdr * icmp6h ;
2014-11-24 00:28:43 +03:00
skb = skb_peek ( & sk - > sk_write_queue ) ;
2015-03-29 16:00:04 +03:00
if ( ! skb )
2017-10-06 09:46:14 +03:00
return ;
2005-04-17 02:20:36 +04:00
2007-03-13 20:03:22 +03:00
icmp6h = icmp6_hdr ( skb ) ;
2005-04-17 02:20:36 +04:00
memcpy ( icmp6h , thdr , sizeof ( struct icmp6hdr ) ) ;
icmp6h - > icmp6_cksum = 0 ;
if ( skb_queue_len ( & sk - > sk_write_queue ) = = 1 ) {
2008-11-20 02:44:53 +03:00
skb - > csum = csum_partial ( icmp6h ,
2005-04-17 02:20:36 +04:00
sizeof ( struct icmp6hdr ) , skb - > csum ) ;
2011-03-13 00:22:43 +03:00
icmp6h - > icmp6_cksum = csum_ipv6_magic ( & fl6 - > saddr ,
& fl6 - > daddr ,
len , fl6 - > flowi6_proto ,
2005-04-17 02:20:36 +04:00
skb - > csum ) ;
} else {
2006-11-15 08:35:48 +03:00
__wsum tmp_csum = 0 ;
2005-04-17 02:20:36 +04:00
skb_queue_walk ( & sk - > sk_write_queue , skb ) {
tmp_csum = csum_add ( tmp_csum , skb - > csum ) ;
}
2008-11-20 02:44:53 +03:00
tmp_csum = csum_partial ( icmp6h ,
2005-04-17 02:20:36 +04:00
sizeof ( struct icmp6hdr ) , tmp_csum ) ;
2011-03-13 00:22:43 +03:00
icmp6h - > icmp6_cksum = csum_ipv6_magic ( & fl6 - > saddr ,
& fl6 - > daddr ,
len , fl6 - > flowi6_proto ,
2006-11-15 08:35:48 +03:00
tmp_csum ) ;
2005-04-17 02:20:36 +04:00
}
ip6_push_pending_frames ( sk ) ;
}
struct icmpv6_msg {
struct sk_buff * skb ;
int offset ;
2006-02-16 02:24:15 +03:00
uint8_t type ;
2005-04-17 02:20:36 +04:00
} ;
static int icmpv6_getfrag ( void * from , char * to , int offset , int len , int odd , struct sk_buff * skb )
{
struct icmpv6_msg * msg = ( struct icmpv6_msg * ) from ;
struct sk_buff * org_skb = msg - > skb ;
2020-07-11 03:07:10 +03:00
__wsum csum ;
2005-04-17 02:20:36 +04:00
csum = skb_copy_and_csum_bits ( org_skb , msg - > offset + offset ,
2020-07-11 03:07:10 +03:00
to , len ) ;
2005-04-17 02:20:36 +04:00
skb - > csum = csum_block_add ( skb - > csum , csum , odd ) ;
2006-02-16 02:24:15 +03:00
if ( ! ( msg - > type & ICMPV6_INFOMSG_MASK ) )
nf_ct_attach ( skb , org_skb ) ;
2005-04-17 02:20:36 +04:00
return 0 ;
}
2012-10-29 20:23:10 +04:00
# if IS_ENABLED(CONFIG_IPV6_MIP6)
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
static void mip6_addr_swap ( struct sk_buff * skb , const struct inet6_skb_parm * opt )
2006-08-24 06:27:25 +04:00
{
2007-04-26 04:54:47 +04:00
struct ipv6hdr * iph = ipv6_hdr ( skb ) ;
2006-08-24 06:27:25 +04:00
struct ipv6_destopt_hao * hao ;
int off ;
if ( opt - > dsthao ) {
off = ipv6_find_tlv ( skb , opt - > dsthao , IPV6_TLV_HAO ) ;
if ( likely ( off > = 0 ) ) {
2007-04-11 07:50:43 +04:00
hao = ( struct ipv6_destopt_hao * )
( skb_network_header ( skb ) + off ) ;
2023-01-31 09:34:56 +03:00
swap ( iph - > saddr , hao - > addr ) ;
2006-08-24 06:27:25 +04:00
}
}
}
# else
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
static inline void mip6_addr_swap ( struct sk_buff * skb , const struct inet6_skb_parm * opt ) { }
2006-08-24 06:27:25 +04:00
# endif
2013-12-30 02:03:31 +04:00
static struct dst_entry * icmpv6_route_lookup ( struct net * net ,
struct sk_buff * skb ,
struct sock * sk ,
struct flowi6 * fl6 )
2011-03-02 09:06:22 +03:00
{
struct dst_entry * dst , * dst2 ;
2011-03-13 00:22:43 +03:00
struct flowi6 fl2 ;
2011-03-02 09:06:22 +03:00
int err ;
2015-07-30 23:34:53 +03:00
err = ip6_dst_lookup ( net , sk , & dst , fl6 ) ;
2011-03-02 09:06:22 +03:00
if ( err )
return ERR_PTR ( err ) ;
/*
* We won ' t send icmp if the destination is known
2023-04-19 04:32:38 +03:00
* anycast unless we need to treat anycast as unicast .
2011-03-02 09:06:22 +03:00
*/
2023-04-19 04:32:38 +03:00
if ( ! READ_ONCE ( net - > ipv6 . sysctl . icmpv6_error_anycast_as_unicast ) & &
ipv6_anycast_destination ( dst , & fl6 - > daddr ) ) {
2014-11-11 21:59:17 +03:00
net_dbg_ratelimited ( " icmp6_send: acast source \n " ) ;
2011-03-02 09:06:22 +03:00
dst_release ( dst ) ;
return ERR_PTR ( - EINVAL ) ;
}
/* No need to clone since we're just using its address. */
dst2 = dst ;
2011-03-13 00:22:43 +03:00
dst = xfrm_lookup ( net , dst , flowi6_to_flowi ( fl6 ) , sk , 0 ) ;
2011-03-03 00:27:41 +03:00
if ( ! IS_ERR ( dst ) ) {
2011-03-02 09:06:22 +03:00
if ( dst ! = dst2 )
return dst ;
2011-03-03 00:27:41 +03:00
} else {
if ( PTR_ERR ( dst ) = = - EPERM )
dst = NULL ;
else
return dst ;
2011-03-02 09:06:22 +03:00
}
2023-10-04 19:09:51 +03:00
err = xfrm_decode_session_reverse ( net , skb , flowi6_to_flowi ( & fl2 ) , AF_INET6 ) ;
2011-03-02 09:06:22 +03:00
if ( err )
goto relookup_failed ;
2015-07-30 23:34:53 +03:00
err = ip6_dst_lookup ( net , sk , & dst2 , & fl2 ) ;
2011-03-02 09:06:22 +03:00
if ( err )
goto relookup_failed ;
2011-03-13 00:22:43 +03:00
dst2 = xfrm_lookup ( net , dst2 , flowi6_to_flowi ( & fl2 ) , sk , XFRM_LOOKUP_ICMP ) ;
2011-03-03 00:27:41 +03:00
if ( ! IS_ERR ( dst2 ) ) {
2011-03-02 09:06:22 +03:00
dst_release ( dst ) ;
dst = dst2 ;
2011-03-03 00:27:41 +03:00
} else {
err = PTR_ERR ( dst2 ) ;
if ( err = = - EPERM ) {
dst_release ( dst ) ;
return dst2 ;
} else
goto relookup_failed ;
2011-03-02 09:06:22 +03:00
}
relookup_failed :
if ( dst )
return dst ;
return ERR_PTR ( err ) ;
}
2019-06-10 17:32:50 +03:00
static struct net_device * icmp6_dev ( const struct sk_buff * skb )
2017-08-28 23:53:34 +03:00
{
2019-06-10 17:32:50 +03:00
struct net_device * dev = skb - > dev ;
2017-08-28 23:53:34 +03:00
/* for local traffic to local address, skb dev is the loopback
* device . Check if there is a dst attached to the skb and if so
2018-07-19 22:41:18 +03:00
* get the real device index . Same is needed for replies to a link
* local address on a device enslaved to an L3 master device
2017-08-28 23:53:34 +03:00
*/
2019-06-10 17:32:50 +03:00
if ( unlikely ( dev - > ifindex = = LOOPBACK_IFINDEX | | netif_is_l3_master ( skb - > dev ) ) ) {
2017-08-28 23:53:34 +03:00
const struct rt6_info * rt6 = skb_rt6_info ( skb ) ;
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that
has the link-local address as src and dst IP and will be forwarded to
an external IP in the IPv6 Ext Hdr.
For example, the script below generates a packet whose src IP is the
link-local address and dst is updated to 11::.
# for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done
# python3
>>> from socket import *
>>> from scapy.all import *
>>>
>>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
>>>
>>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR)
>>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
>>>
>>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW)
>>> sk.sendto(bytes(pkt), (DST_ADDR, 0))
For such a packet, we call ip6_route_input() to look up a route for the
next destination in these three functions depending on the header type.
* ipv6_rthdr_rcv()
* ipv6_rpl_srh_rcv()
* ipv6_srh_rcv()
If no route is found, ip6_null_entry is set to skb, and the following
dst_input(skb) calls ip6_pkt_drop().
Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev
as the input device is the loopback interface. Then, we have to check if
skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref
for ip6_null_entry.
BUG: kernel NULL pointer dereference, address: 0000000000000000
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
FS: 00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
PKRU: 55555554
Call Trace:
<IRQ>
ip6_pkt_drop (net/ipv6/route.c:4513)
ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686)
ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5))
ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483)
__netif_receive_skb_one_core (net/core/dev.c:5455)
process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895)
__napi_poll (net/core/dev.c:6460)
net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660)
__do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554)
do_softirq (kernel/softirq.c:454 kernel/softirq.c:441)
</IRQ>
<TASK>
__local_bh_enable_ip (kernel/softirq.c:381)
__dev_queue_xmit (net/core/dev.c:4231)
ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135)
rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914)
sock_sendmsg (net/socket.c:725 net/socket.c:748)
__sys_sendto (net/socket.c:2134)
__x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142)
do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
RIP: 0033:0x7f9dc751baea
Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
RSP: 002b:00007ffe98712c38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007ffe98712cf8 RCX: 00007f9dc751baea
RDX: 0000000000000060 RSI: 00007f9dc6460b90 RDI: 0000000000000003
RBP: 00007f9dc56e8be0 R08: 00007ffe98712d70 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f9dc6af5d1b
</TASK>
Modules linked in:
CR2: 0000000000000000
---[ end trace 0000000000000000 ]---
RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503)
Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01
RSP: 0018:ffffc90000003c70 EFLAGS: 00000286
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0
RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18
RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001
R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10
R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0
FS: 00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0
PKRU: 55555554
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: disabled
Fixes: 4832c30d5458 ("net: ipv6: put host and anycast routes on device with address")
Reported-by: Wang Yufen <wangyufen@huawei.com>
Closes: https://lore.kernel.org/netdev/c41403a9-c2f6-3b7e-0c96-e1901e605cd0@huawei.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2023-07-08 04:43:27 +03:00
/* The destination could be an external IP in Ext Hdr (SRv6, RPL, etc.),
* and ip6_null_entry could be set to skb if no route is found .
*/
if ( rt6 & & rt6 - > rt6i_idev )
2019-06-10 17:32:50 +03:00
dev = rt6 - > rt6i_idev - > dev ;
2017-08-28 23:53:34 +03:00
}
2019-06-10 17:32:50 +03:00
return dev ;
}
static int icmp6_iif ( const struct sk_buff * skb )
{
return icmp6_dev ( skb ) - > ifindex ;
2017-08-28 23:53:34 +03:00
}
2005-04-17 02:20:36 +04:00
/*
* Send an ICMP message in response to a packet in error
*/
2020-06-19 22:02:59 +03:00
void icmp6_send ( struct sk_buff * skb , u8 type , u8 code , __u32 info ,
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
const struct in6_addr * force_saddr ,
const struct inet6_skb_parm * parm )
2005-04-17 02:20:36 +04:00
{
struct inet6_dev * idev = NULL ;
2007-04-26 04:54:47 +04:00
struct ipv6hdr * hdr = ipv6_hdr ( skb ) ;
2005-06-14 01:59:44 +04:00
struct sock * sk ;
2019-01-04 22:00:00 +03:00
struct net * net ;
2005-06-14 01:59:44 +04:00
struct ipv6_pinfo * np ;
2011-04-22 08:53:02 +04:00
const struct in6_addr * saddr = NULL ;
2005-04-17 02:20:36 +04:00
struct dst_entry * dst ;
struct icmp6hdr tmp_hdr ;
2011-03-13 00:22:43 +03:00
struct flowi6 fl6 ;
2005-04-17 02:20:36 +04:00
struct icmpv6_msg msg ;
2016-05-03 07:40:07 +03:00
struct ipcm6_cookie ipc6 ;
2005-04-17 02:20:36 +04:00
int iif = 0 ;
int addr_type = 0 ;
int len ;
2019-01-04 22:00:00 +03:00
u32 mark ;
2005-04-17 02:20:36 +04:00
2007-04-20 07:29:13 +04:00
if ( ( u8 * ) hdr < skb - > head | |
2013-05-29 00:34:26 +04:00
( skb_network_header ( skb ) + sizeof ( * hdr ) ) > skb_tail_pointer ( skb ) )
2005-04-17 02:20:36 +04:00
return ;
2019-01-04 22:00:00 +03:00
if ( ! skb - > dev )
return ;
net = dev_net ( skb - > dev ) ;
mark = IP6_REPLY_MARK ( net , skb - > mark ) ;
2005-04-17 02:20:36 +04:00
/*
2007-02-09 17:24:49 +03:00
* Make sure we respect the rules
2005-04-17 02:20:36 +04:00
* i . e . RFC 1885 2.4 ( e )
2013-04-25 15:08:30 +04:00
* Rule ( e .1 ) is enforced by not using icmp6_send
2005-04-17 02:20:36 +04:00
* in any code that processes icmp errors .
*/
addr_type = ipv6_addr_type ( & hdr - > daddr ) ;
2014-01-19 20:00:36 +04:00
if ( ipv6_chk_addr ( net , & hdr - > daddr , skb - > dev , 0 ) | |
2014-02-07 14:22:37 +04:00
ipv6_chk_acast_addr_src ( net , skb - > dev , & hdr - > daddr ) )
2005-04-17 02:20:36 +04:00
saddr = & hdr - > daddr ;
/*
* Dest addr check
*/
2015-01-14 12:23:59 +03:00
if ( addr_type & IPV6_ADDR_MULTICAST | | skb - > pkt_type ! = PACKET_HOST ) {
2005-04-17 02:20:36 +04:00
if ( type ! = ICMPV6_PKT_TOOBIG & &
2007-02-09 17:24:49 +03:00
! ( type = = ICMPV6_PARAMPROB & &
code = = ICMPV6_UNK_OPTION & &
2005-04-17 02:20:36 +04:00
( opt_unrec ( skb , info ) ) ) )
return ;
saddr = NULL ;
}
addr_type = ipv6_addr_type ( & hdr - > saddr ) ;
/*
* Source addr check
*/
2017-08-17 22:17:20 +03:00
if ( __ipv6_addr_needs_scope_id ( addr_type ) ) {
2017-08-28 23:53:34 +03:00
iif = icmp6_iif ( skb ) ;
2017-08-17 22:17:20 +03:00
} else {
2020-10-12 17:50:15 +03:00
/*
* The source device is used for looking up which routing table
* to use for sending an ICMP error .
*/
iif = l3mdev_master_ifindex ( skb - > dev ) ;
2016-11-28 05:52:53 +03:00
}
2005-04-17 02:20:36 +04:00
/*
2005-12-21 16:57:06 +03:00
* Must not send error if the source does not uniquely
* identify a single node ( RFC2463 Section 2.4 ) .
* We check unspecified / multicast addresses here ,
* and anycast addresses will be checked later .
2005-04-17 02:20:36 +04:00
*/
if ( ( addr_type = = IPV6_ADDR_ANY ) | | ( addr_type & IPV6_ADDR_MULTICAST ) ) {
2015-10-24 15:00:20 +03:00
net_dbg_ratelimited ( " icmp6_send: addr_any/mcast source [%pI6c > %pI6c] \n " ,
& hdr - > saddr , & hdr - > daddr ) ;
2005-04-17 02:20:36 +04:00
return ;
}
2007-02-09 17:24:49 +03:00
/*
2005-04-17 02:20:36 +04:00
* Never answer to a ICMP packet .
*/
if ( is_ineligible ( skb ) ) {
2015-10-24 15:00:20 +03:00
net_dbg_ratelimited ( " icmp6_send: no reply to icmp error [%pI6c > %pI6c] \n " ,
& hdr - > saddr , & hdr - > daddr ) ;
2005-04-17 02:20:36 +04:00
return ;
}
2017-01-09 18:04:14 +03:00
/* Needed by both icmp_global_allow and icmpv6_xmit_lock */
local_bh_disable ( ) ;
/* Check global sysctl_icmp_msgs_per_sec ratelimit */
2019-04-17 23:35:49 +03:00
if ( ! ( skb - > dev - > flags & IFF_LOOPBACK ) & & ! icmpv6_global_allow ( net , type ) )
2017-01-09 18:04:14 +03:00
goto out_bh_enable ;
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
mip6_addr_swap ( skb , parm ) ;
2006-08-24 06:27:25 +04:00
net: icmp6: provide input address for traceroute6
traceroute6 output can be confusing, in that it shows the address
that a router would use to reach the sender, rather than the address
the packet used to reach the router.
Consider this case:
------------------------ N2
| |
------ ------ N3 ----
| R1 | | R2 |------|H2|
------ ------ ----
| |
------------------------ N1
|
----
|H1|
----
where H1's default route is through R1, and R1's default route is
through R2 over N2.
traceroute6 from H1 to H2 shows R2's address on N1 rather than on N2.
The script below can be used to reproduce this scenario.
traceroute6 output without this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.036 ms 0.008 ms 0.006 ms
2 2000:101::2 (2000:101::2) 0.011 ms 0.008 ms 0.007 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.010 ms 0.009 ms
traceroute6 output with this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.056 ms 0.019 ms 0.006 ms
2 2000:102::2 (2000:102::2) 0.013 ms 0.008 ms 0.008 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.009 ms 0.009 ms
#!/bin/bash
#
# ------------------------ N2
# | |
# ------ ------ N3 ----
# | R1 | | R2 |------|H2|
# ------ ------ ----
# | |
# ------------------------ N1
# |
# ----
# |H1|
# ----
#
# N1: 2000:101::/64
# N2: 2000:102::/64
# N3: 2000:103::/64
#
# R1's host part of address: 1
# R2's host part of address: 2
# H1's host part of address: 3
# H2's host part of address: 4
#
# For example:
# the IPv6 address of R1's interface on N2 is 2000:102::1/64
#
# Nets are implemented by macvlan interfaces (bridge mode) over
# dummy interfaces.
#
# Create net namespaces
ip netns add host1
ip netns add host2
ip netns add rtr1
ip netns add rtr2
# Create nets
ip link add net1 type dummy; ip link set net1 up
ip link add net2 type dummy; ip link set net2 up
ip link add net3 type dummy; ip link set net3 up
# Add interfaces to net1, move them to their nemaspaces
ip link add link net1 dev host1net1 type macvlan mode bridge
ip link set host1net1 netns host1
ip link add link net1 dev rtr1net1 type macvlan mode bridge
ip link set rtr1net1 netns rtr1
ip link add link net1 dev rtr2net1 type macvlan mode bridge
ip link set rtr2net1 netns rtr2
# Add interfaces to net2, move them to their nemaspaces
ip link add link net2 dev rtr1net2 type macvlan mode bridge
ip link set rtr1net2 netns rtr1
ip link add link net2 dev rtr2net2 type macvlan mode bridge
ip link set rtr2net2 netns rtr2
# Add interfaces to net3, move them to their nemaspaces
ip link add link net3 dev rtr2net3 type macvlan mode bridge
ip link set rtr2net3 netns rtr2
ip link add link net3 dev host2net3 type macvlan mode bridge
ip link set host2net3 netns host2
# Configure interfaces and routes in host1
ip netns exec host1 ip link set lo up
ip netns exec host1 ip link set host1net1 up
ip netns exec host1 ip -6 addr add 2000:101::3/64 dev host1net1
ip netns exec host1 ip -6 route add default via 2000:101::1
# Configure interfaces and routes in rtr1
ip netns exec rtr1 ip link set lo up
ip netns exec rtr1 ip link set rtr1net1 up
ip netns exec rtr1 ip -6 addr add 2000:101::1/64 dev rtr1net1
ip netns exec rtr1 ip link set rtr1net2 up
ip netns exec rtr1 ip -6 addr add 2000:102::1/64 dev rtr1net2
ip netns exec rtr1 ip -6 route add default via 2000:102::2
ip netns exec rtr1 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in rtr2
ip netns exec rtr2 ip link set lo up
ip netns exec rtr2 ip link set rtr2net1 up
ip netns exec rtr2 ip -6 addr add 2000:101::2/64 dev rtr2net1
ip netns exec rtr2 ip link set rtr2net2 up
ip netns exec rtr2 ip -6 addr add 2000:102::2/64 dev rtr2net2
ip netns exec rtr2 ip link set rtr2net3 up
ip netns exec rtr2 ip -6 addr add 2000:103::2/64 dev rtr2net3
ip netns exec rtr2 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in host2
ip netns exec host2 ip link set lo up
ip netns exec host2 ip link set host2net3 up
ip netns exec host2 ip -6 addr add 2000:103::4/64 dev host2net3
ip netns exec host2 ip -6 route add default via 2000:103::2
# Ping host2 from host1
ip netns exec host1 ping6 -c5 2000:103::4
# Traceroute host2 from host1
ip netns exec host1 traceroute6 2000:103::4
# Delete nets
ip link del net3
ip link del net2
ip link del net1
# Delete namespaces
ip netns del rtr2
ip netns del rtr1
ip netns del host2
ip netns del host1
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Original-patch-by: Honggang Xu <hxu@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-31 03:40:02 +03:00
sk = icmpv6_xmit_lock ( net ) ;
if ( ! sk )
goto out_bh_enable ;
2011-03-13 00:22:43 +03:00
memset ( & fl6 , 0 , sizeof ( fl6 ) ) ;
fl6 . flowi6_proto = IPPROTO_ICMPV6 ;
2011-11-21 07:39:03 +04:00
fl6 . daddr = hdr - > saddr ;
2016-06-19 07:52:02 +03:00
if ( force_saddr )
saddr = force_saddr ;
net: icmp6: provide input address for traceroute6
traceroute6 output can be confusing, in that it shows the address
that a router would use to reach the sender, rather than the address
the packet used to reach the router.
Consider this case:
------------------------ N2
| |
------ ------ N3 ----
| R1 | | R2 |------|H2|
------ ------ ----
| |
------------------------ N1
|
----
|H1|
----
where H1's default route is through R1, and R1's default route is
through R2 over N2.
traceroute6 from H1 to H2 shows R2's address on N1 rather than on N2.
The script below can be used to reproduce this scenario.
traceroute6 output without this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.036 ms 0.008 ms 0.006 ms
2 2000:101::2 (2000:101::2) 0.011 ms 0.008 ms 0.007 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.010 ms 0.009 ms
traceroute6 output with this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.056 ms 0.019 ms 0.006 ms
2 2000:102::2 (2000:102::2) 0.013 ms 0.008 ms 0.008 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.009 ms 0.009 ms
#!/bin/bash
#
# ------------------------ N2
# | |
# ------ ------ N3 ----
# | R1 | | R2 |------|H2|
# ------ ------ ----
# | |
# ------------------------ N1
# |
# ----
# |H1|
# ----
#
# N1: 2000:101::/64
# N2: 2000:102::/64
# N3: 2000:103::/64
#
# R1's host part of address: 1
# R2's host part of address: 2
# H1's host part of address: 3
# H2's host part of address: 4
#
# For example:
# the IPv6 address of R1's interface on N2 is 2000:102::1/64
#
# Nets are implemented by macvlan interfaces (bridge mode) over
# dummy interfaces.
#
# Create net namespaces
ip netns add host1
ip netns add host2
ip netns add rtr1
ip netns add rtr2
# Create nets
ip link add net1 type dummy; ip link set net1 up
ip link add net2 type dummy; ip link set net2 up
ip link add net3 type dummy; ip link set net3 up
# Add interfaces to net1, move them to their nemaspaces
ip link add link net1 dev host1net1 type macvlan mode bridge
ip link set host1net1 netns host1
ip link add link net1 dev rtr1net1 type macvlan mode bridge
ip link set rtr1net1 netns rtr1
ip link add link net1 dev rtr2net1 type macvlan mode bridge
ip link set rtr2net1 netns rtr2
# Add interfaces to net2, move them to their nemaspaces
ip link add link net2 dev rtr1net2 type macvlan mode bridge
ip link set rtr1net2 netns rtr1
ip link add link net2 dev rtr2net2 type macvlan mode bridge
ip link set rtr2net2 netns rtr2
# Add interfaces to net3, move them to their nemaspaces
ip link add link net3 dev rtr2net3 type macvlan mode bridge
ip link set rtr2net3 netns rtr2
ip link add link net3 dev host2net3 type macvlan mode bridge
ip link set host2net3 netns host2
# Configure interfaces and routes in host1
ip netns exec host1 ip link set lo up
ip netns exec host1 ip link set host1net1 up
ip netns exec host1 ip -6 addr add 2000:101::3/64 dev host1net1
ip netns exec host1 ip -6 route add default via 2000:101::1
# Configure interfaces and routes in rtr1
ip netns exec rtr1 ip link set lo up
ip netns exec rtr1 ip link set rtr1net1 up
ip netns exec rtr1 ip -6 addr add 2000:101::1/64 dev rtr1net1
ip netns exec rtr1 ip link set rtr1net2 up
ip netns exec rtr1 ip -6 addr add 2000:102::1/64 dev rtr1net2
ip netns exec rtr1 ip -6 route add default via 2000:102::2
ip netns exec rtr1 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in rtr2
ip netns exec rtr2 ip link set lo up
ip netns exec rtr2 ip link set rtr2net1 up
ip netns exec rtr2 ip -6 addr add 2000:101::2/64 dev rtr2net1
ip netns exec rtr2 ip link set rtr2net2 up
ip netns exec rtr2 ip -6 addr add 2000:102::2/64 dev rtr2net2
ip netns exec rtr2 ip link set rtr2net3 up
ip netns exec rtr2 ip -6 addr add 2000:103::2/64 dev rtr2net3
ip netns exec rtr2 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in host2
ip netns exec host2 ip link set lo up
ip netns exec host2 ip link set host2net3 up
ip netns exec host2 ip -6 addr add 2000:103::4/64 dev host2net3
ip netns exec host2 ip -6 route add default via 2000:103::2
# Ping host2 from host1
ip netns exec host1 ping6 -c5 2000:103::4
# Traceroute host2 from host1
ip netns exec host1 traceroute6 2000:103::4
# Delete nets
ip link del net3
ip link del net2
ip link del net1
# Delete namespaces
ip netns del rtr2
ip netns del rtr1
ip netns del host2
ip netns del host1
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Original-patch-by: Honggang Xu <hxu@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-31 03:40:02 +03:00
if ( saddr ) {
2011-11-21 07:39:03 +04:00
fl6 . saddr = * saddr ;
net: icmp6: do not select saddr from iif when route has prefsrc set
Since commit fac6fce9bdb5 ("net: icmp6: provide input address for
traceroute6") ICMPv6 errors have source addresses from the ingress
interface. However, this overrides when source address selection is
influenced by setting preferred source addresses on routes.
This can result in ICMP errors being lost to upstream BCP38 filters
when the wrong source addresses are used, breaking path MTU discovery
and traceroute.
This patch sets the modified source address selection to only take place
when the route used has no prefsrc set.
It can be tested with:
ip link add v1 type veth peer name v2
ip netns add test
ip netns exec test ip link set lo up
ip link set v2 netns test
ip link set v1 up
ip netns exec test ip link set v2 up
ip addr add 2001:db8::1/64 dev v1 nodad
ip addr add 2001:db8::3 dev v1 nodad
ip netns exec test ip addr add 2001:db8::2/64 dev v2 nodad
ip netns exec test ip route add unreachable 2001:db8:1::1
ip netns exec test ip addr add 2001:db8:100::1 dev lo
ip netns exec test ip route add 2001:db8::1 dev v2 src 2001:db8:100::1
ip route add 2001:db8:1000::1 via 2001:db8::2
traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute6 -s 2001:db8::3 2001:db8:1000::1
ip netns delete test
Output before:
$ traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 0.843 ms !N 0.396 ms !N 0.257 ms !N
$ traceroute6 -s 2001:db8::3 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 0.772 ms !N 0.257 ms !N 0.357 ms !N
After:
$ traceroute6 -s 2001:db8::1 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8:100::1 (2001:db8:100::1) 8.885 ms !N 0.310 ms !N 0.174 ms !N
$ traceroute6 -s 2001:db8::3 2001:db8:1000::1
traceroute to 2001:db8:1000::1 (2001:db8:1000::1), 30 hops max, 80 byte packets
1 2001:db8::2 (2001:db8::2) 1.403 ms !N 0.205 ms !N 0.313 ms !N
Fixes: fac6fce9bdb5 ("net: icmp6: provide input address for traceroute6")
Signed-off-by: Tim Stallard <code@timstallard.me.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-04-03 23:22:57 +03:00
} else if ( ! icmpv6_rt_has_prefsrc ( sk , type , & fl6 ) ) {
net: icmp6: provide input address for traceroute6
traceroute6 output can be confusing, in that it shows the address
that a router would use to reach the sender, rather than the address
the packet used to reach the router.
Consider this case:
------------------------ N2
| |
------ ------ N3 ----
| R1 | | R2 |------|H2|
------ ------ ----
| |
------------------------ N1
|
----
|H1|
----
where H1's default route is through R1, and R1's default route is
through R2 over N2.
traceroute6 from H1 to H2 shows R2's address on N1 rather than on N2.
The script below can be used to reproduce this scenario.
traceroute6 output without this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.036 ms 0.008 ms 0.006 ms
2 2000:101::2 (2000:101::2) 0.011 ms 0.008 ms 0.007 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.010 ms 0.009 ms
traceroute6 output with this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.056 ms 0.019 ms 0.006 ms
2 2000:102::2 (2000:102::2) 0.013 ms 0.008 ms 0.008 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.009 ms 0.009 ms
#!/bin/bash
#
# ------------------------ N2
# | |
# ------ ------ N3 ----
# | R1 | | R2 |------|H2|
# ------ ------ ----
# | |
# ------------------------ N1
# |
# ----
# |H1|
# ----
#
# N1: 2000:101::/64
# N2: 2000:102::/64
# N3: 2000:103::/64
#
# R1's host part of address: 1
# R2's host part of address: 2
# H1's host part of address: 3
# H2's host part of address: 4
#
# For example:
# the IPv6 address of R1's interface on N2 is 2000:102::1/64
#
# Nets are implemented by macvlan interfaces (bridge mode) over
# dummy interfaces.
#
# Create net namespaces
ip netns add host1
ip netns add host2
ip netns add rtr1
ip netns add rtr2
# Create nets
ip link add net1 type dummy; ip link set net1 up
ip link add net2 type dummy; ip link set net2 up
ip link add net3 type dummy; ip link set net3 up
# Add interfaces to net1, move them to their nemaspaces
ip link add link net1 dev host1net1 type macvlan mode bridge
ip link set host1net1 netns host1
ip link add link net1 dev rtr1net1 type macvlan mode bridge
ip link set rtr1net1 netns rtr1
ip link add link net1 dev rtr2net1 type macvlan mode bridge
ip link set rtr2net1 netns rtr2
# Add interfaces to net2, move them to their nemaspaces
ip link add link net2 dev rtr1net2 type macvlan mode bridge
ip link set rtr1net2 netns rtr1
ip link add link net2 dev rtr2net2 type macvlan mode bridge
ip link set rtr2net2 netns rtr2
# Add interfaces to net3, move them to their nemaspaces
ip link add link net3 dev rtr2net3 type macvlan mode bridge
ip link set rtr2net3 netns rtr2
ip link add link net3 dev host2net3 type macvlan mode bridge
ip link set host2net3 netns host2
# Configure interfaces and routes in host1
ip netns exec host1 ip link set lo up
ip netns exec host1 ip link set host1net1 up
ip netns exec host1 ip -6 addr add 2000:101::3/64 dev host1net1
ip netns exec host1 ip -6 route add default via 2000:101::1
# Configure interfaces and routes in rtr1
ip netns exec rtr1 ip link set lo up
ip netns exec rtr1 ip link set rtr1net1 up
ip netns exec rtr1 ip -6 addr add 2000:101::1/64 dev rtr1net1
ip netns exec rtr1 ip link set rtr1net2 up
ip netns exec rtr1 ip -6 addr add 2000:102::1/64 dev rtr1net2
ip netns exec rtr1 ip -6 route add default via 2000:102::2
ip netns exec rtr1 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in rtr2
ip netns exec rtr2 ip link set lo up
ip netns exec rtr2 ip link set rtr2net1 up
ip netns exec rtr2 ip -6 addr add 2000:101::2/64 dev rtr2net1
ip netns exec rtr2 ip link set rtr2net2 up
ip netns exec rtr2 ip -6 addr add 2000:102::2/64 dev rtr2net2
ip netns exec rtr2 ip link set rtr2net3 up
ip netns exec rtr2 ip -6 addr add 2000:103::2/64 dev rtr2net3
ip netns exec rtr2 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in host2
ip netns exec host2 ip link set lo up
ip netns exec host2 ip link set host2net3 up
ip netns exec host2 ip -6 addr add 2000:103::4/64 dev host2net3
ip netns exec host2 ip -6 route add default via 2000:103::2
# Ping host2 from host1
ip netns exec host1 ping6 -c5 2000:103::4
# Traceroute host2 from host1
ip netns exec host1 traceroute6 2000:103::4
# Delete nets
ip link del net3
ip link del net2
ip link del net1
# Delete namespaces
ip netns del rtr2
ip netns del rtr1
ip netns del host2
ip netns del host1
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Original-patch-by: Honggang Xu <hxu@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-31 03:40:02 +03:00
/* select a more meaningful saddr from input if */
struct net_device * in_netdev ;
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
in_netdev = dev_get_by_index ( net , parm - > iif ) ;
net: icmp6: provide input address for traceroute6
traceroute6 output can be confusing, in that it shows the address
that a router would use to reach the sender, rather than the address
the packet used to reach the router.
Consider this case:
------------------------ N2
| |
------ ------ N3 ----
| R1 | | R2 |------|H2|
------ ------ ----
| |
------------------------ N1
|
----
|H1|
----
where H1's default route is through R1, and R1's default route is
through R2 over N2.
traceroute6 from H1 to H2 shows R2's address on N1 rather than on N2.
The script below can be used to reproduce this scenario.
traceroute6 output without this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.036 ms 0.008 ms 0.006 ms
2 2000:101::2 (2000:101::2) 0.011 ms 0.008 ms 0.007 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.010 ms 0.009 ms
traceroute6 output with this patch:
traceroute to 2000:103::4 (2000:103::4), 30 hops max, 80 byte packets
1 2000:101::1 (2000:101::1) 0.056 ms 0.019 ms 0.006 ms
2 2000:102::2 (2000:102::2) 0.013 ms 0.008 ms 0.008 ms
3 2000:103::4 (2000:103::4) 0.013 ms 0.009 ms 0.009 ms
#!/bin/bash
#
# ------------------------ N2
# | |
# ------ ------ N3 ----
# | R1 | | R2 |------|H2|
# ------ ------ ----
# | |
# ------------------------ N1
# |
# ----
# |H1|
# ----
#
# N1: 2000:101::/64
# N2: 2000:102::/64
# N3: 2000:103::/64
#
# R1's host part of address: 1
# R2's host part of address: 2
# H1's host part of address: 3
# H2's host part of address: 4
#
# For example:
# the IPv6 address of R1's interface on N2 is 2000:102::1/64
#
# Nets are implemented by macvlan interfaces (bridge mode) over
# dummy interfaces.
#
# Create net namespaces
ip netns add host1
ip netns add host2
ip netns add rtr1
ip netns add rtr2
# Create nets
ip link add net1 type dummy; ip link set net1 up
ip link add net2 type dummy; ip link set net2 up
ip link add net3 type dummy; ip link set net3 up
# Add interfaces to net1, move them to their nemaspaces
ip link add link net1 dev host1net1 type macvlan mode bridge
ip link set host1net1 netns host1
ip link add link net1 dev rtr1net1 type macvlan mode bridge
ip link set rtr1net1 netns rtr1
ip link add link net1 dev rtr2net1 type macvlan mode bridge
ip link set rtr2net1 netns rtr2
# Add interfaces to net2, move them to their nemaspaces
ip link add link net2 dev rtr1net2 type macvlan mode bridge
ip link set rtr1net2 netns rtr1
ip link add link net2 dev rtr2net2 type macvlan mode bridge
ip link set rtr2net2 netns rtr2
# Add interfaces to net3, move them to their nemaspaces
ip link add link net3 dev rtr2net3 type macvlan mode bridge
ip link set rtr2net3 netns rtr2
ip link add link net3 dev host2net3 type macvlan mode bridge
ip link set host2net3 netns host2
# Configure interfaces and routes in host1
ip netns exec host1 ip link set lo up
ip netns exec host1 ip link set host1net1 up
ip netns exec host1 ip -6 addr add 2000:101::3/64 dev host1net1
ip netns exec host1 ip -6 route add default via 2000:101::1
# Configure interfaces and routes in rtr1
ip netns exec rtr1 ip link set lo up
ip netns exec rtr1 ip link set rtr1net1 up
ip netns exec rtr1 ip -6 addr add 2000:101::1/64 dev rtr1net1
ip netns exec rtr1 ip link set rtr1net2 up
ip netns exec rtr1 ip -6 addr add 2000:102::1/64 dev rtr1net2
ip netns exec rtr1 ip -6 route add default via 2000:102::2
ip netns exec rtr1 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in rtr2
ip netns exec rtr2 ip link set lo up
ip netns exec rtr2 ip link set rtr2net1 up
ip netns exec rtr2 ip -6 addr add 2000:101::2/64 dev rtr2net1
ip netns exec rtr2 ip link set rtr2net2 up
ip netns exec rtr2 ip -6 addr add 2000:102::2/64 dev rtr2net2
ip netns exec rtr2 ip link set rtr2net3 up
ip netns exec rtr2 ip -6 addr add 2000:103::2/64 dev rtr2net3
ip netns exec rtr2 sysctl net.ipv6.conf.all.forwarding=1
# Configure interfaces and routes in host2
ip netns exec host2 ip link set lo up
ip netns exec host2 ip link set host2net3 up
ip netns exec host2 ip -6 addr add 2000:103::4/64 dev host2net3
ip netns exec host2 ip -6 route add default via 2000:103::2
# Ping host2 from host1
ip netns exec host1 ping6 -c5 2000:103::4
# Traceroute host2 from host1
ip netns exec host1 traceroute6 2000:103::4
# Delete nets
ip link del net3
ip link del net2
ip link del net1
# Delete namespaces
ip netns del rtr2
ip netns del rtr1
ip netns del host2
ip netns del host1
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Original-patch-by: Honggang Xu <hxu@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-10-31 03:40:02 +03:00
if ( in_netdev ) {
ipv6_dev_get_saddr ( net , in_netdev , & fl6 . daddr ,
inet6_sk ( sk ) - > srcprefs ,
& fl6 . saddr ) ;
dev_put ( in_netdev ) ;
}
}
2014-05-13 21:17:33 +04:00
fl6 . flowi6_mark = mark ;
2011-03-13 00:22:43 +03:00
fl6 . flowi6_oif = iif ;
2011-03-13 00:36:19 +03:00
fl6 . fl6_icmp_type = type ;
fl6 . fl6_icmp_code = code ;
2016-11-03 20:23:43 +03:00
fl6 . flowi6_uid = sock_net_uid ( net , NULL ) ;
2018-03-02 19:32:18 +03:00
fl6 . mp_hash = rt6_multipath_hash ( net , & fl6 , skb , NULL ) ;
2020-09-28 05:38:26 +03:00
security_skb_classify_flow ( skb , flowi6_to_flowi_common ( & fl6 ) ) ;
2005-04-17 02:20:36 +04:00
2008-08-23 15:43:33 +04:00
np = inet6_sk ( sk ) ;
2008-02-29 22:16:46 +03:00
2011-03-13 00:22:43 +03:00
if ( ! icmpv6_xrlim_allow ( sk , type , & fl6 ) )
2005-04-17 02:20:36 +04:00
goto out ;
tmp_hdr . icmp6_type = type ;
tmp_hdr . icmp6_code = code ;
tmp_hdr . icmp6_cksum = 0 ;
tmp_hdr . icmp6_pointer = htonl ( info ) ;
2011-03-13 00:22:43 +03:00
if ( ! fl6 . flowi6_oif & & ipv6_addr_is_multicast ( & fl6 . daddr ) )
2023-12-08 13:12:43 +03:00
fl6 . flowi6_oif = READ_ONCE ( np - > mcast_oif ) ;
2012-02-08 13:11:08 +04:00
else if ( ! fl6 . flowi6_oif )
2023-12-08 13:12:44 +03:00
fl6 . flowi6_oif = READ_ONCE ( np - > ucast_oif ) ;
2005-04-17 02:20:36 +04:00
2023-09-12 19:02:07 +03:00
ipcm6_init_sk ( & ipc6 , sk ) ;
2020-07-01 23:00:06 +03:00
ipc6 . sockc . mark = mark ;
2016-06-11 21:08:19 +03:00
fl6 . flowlabel = ip6_make_flowinfo ( ipc6 . tclass , fl6 . flowlabel ) ;
2011-03-13 00:22:43 +03:00
dst = icmpv6_route_lookup ( net , skb , sk , & fl6 ) ;
2011-03-02 09:06:22 +03:00
if ( IS_ERR ( dst ) )
2005-04-17 02:20:36 +04:00
goto out ;
2005-12-21 16:57:06 +03:00
2016-05-03 07:40:07 +03:00
ipc6 . hlimit = ip6_sk_dst_hoplimit ( np , & fl6 , dst ) ;
2005-04-17 02:20:36 +04:00
msg . skb = skb ;
2007-03-11 04:16:10 +03:00
msg . offset = skb_network_offset ( skb ) ;
2006-02-16 02:24:15 +03:00
msg . type = type ;
2005-04-17 02:20:36 +04:00
len = skb - > len - msg . offset ;
2014-08-25 00:53:10 +04:00
len = min_t ( unsigned int , len , IPV6_MIN_MTU - sizeof ( struct ipv6hdr ) - sizeof ( struct icmp6hdr ) ) ;
2005-04-17 02:20:36 +04:00
if ( len < 0 ) {
2015-10-24 15:00:20 +03:00
net_dbg_ratelimited ( " icmp: len problem [%pI6c > %pI6c] \n " ,
& hdr - > saddr , & hdr - > daddr ) ;
2005-04-17 02:20:36 +04:00
goto out_dst_release ;
}
2011-07-28 01:13:03 +04:00
rcu_read_lock ( ) ;
idev = __in6_dev_get ( skb - > dev ) ;
2005-04-17 02:20:36 +04:00
2017-10-06 09:46:14 +03:00
if ( ip6_append_data ( sk , icmpv6_getfrag , & msg ,
len + sizeof ( struct icmp6hdr ) ,
sizeof ( struct icmp6hdr ) ,
2024-04-26 18:19:52 +03:00
& ipc6 , & fl6 , dst_rt6_info ( dst ) ,
2018-07-06 17:12:57 +03:00
MSG_DONTWAIT ) ) {
2014-03-31 22:14:10 +04:00
ICMP6_INC_STATS ( net , idev , ICMP6_MIB_OUTERRORS ) ;
2005-04-17 02:20:36 +04:00
ip6_flush_pending_frames ( sk ) ;
2011-07-28 01:13:03 +04:00
} else {
2017-10-06 09:46:14 +03:00
icmpv6_push_pending_frames ( sk , & fl6 , & tmp_hdr ,
len + sizeof ( struct icmp6hdr ) ) ;
2005-04-17 02:20:36 +04:00
}
2011-07-28 01:13:03 +04:00
rcu_read_unlock ( ) ;
2005-04-17 02:20:36 +04:00
out_dst_release :
dst_release ( dst ) ;
out :
2008-02-29 22:16:46 +03:00
icmpv6_xmit_unlock ( sk ) ;
2017-01-09 18:04:14 +03:00
out_bh_enable :
local_bh_enable ( ) ;
2005-04-17 02:20:36 +04:00
}
2020-06-19 22:02:59 +03:00
EXPORT_SYMBOL ( icmp6_send ) ;
2013-04-25 15:08:30 +04:00
2022-04-13 11:15:56 +03:00
/* Slightly more convenient version of icmp6_send with drop reasons.
2013-04-25 15:08:30 +04:00
*/
2022-04-13 11:15:56 +03:00
void icmpv6_param_prob_reason ( struct sk_buff * skb , u8 code , int pos ,
enum skb_drop_reason reason )
2013-04-25 15:08:30 +04:00
{
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
icmp6_send ( skb , ICMPV6_PARAMPROB , code , pos , NULL , IP6CB ( skb ) ) ;
2022-04-13 11:15:56 +03:00
kfree_skb_reason ( skb , reason ) ;
2013-04-25 15:08:30 +04:00
}
2007-02-22 16:05:40 +03:00
2016-06-19 07:52:03 +03:00
/* Generate icmpv6 with type/code ICMPV6_DEST_UNREACH/ICMPV6_ADDR_UNREACH
* if sufficient data bytes are available
* @ nhs is the size of the tunnel header ( s ) :
* Either an IPv4 header for SIT encap
* an IPv4 header + GRE header for GRE encap
*/
2016-06-19 07:52:06 +03:00
int ip6_err_gen_icmpv6_unreach ( struct sk_buff * skb , int nhs , int type ,
unsigned int data_len )
2016-06-19 07:52:03 +03:00
{
2016-06-19 07:52:04 +03:00
struct in6_addr temp_saddr ;
2016-06-19 07:52:03 +03:00
struct rt6_info * rt ;
struct sk_buff * skb2 ;
2016-06-19 07:52:06 +03:00
u32 info = 0 ;
2016-06-19 07:52:03 +03:00
if ( ! pskb_may_pull ( skb , nhs + sizeof ( struct ipv6hdr ) + 8 ) )
return 1 ;
2016-06-19 07:52:06 +03:00
/* RFC 4884 (partial) support for ICMP extensions */
if ( data_len < 128 | | ( data_len & 7 ) | | skb - > len < data_len )
data_len = 0 ;
skb2 = data_len ? skb_copy ( skb , GFP_ATOMIC ) : skb_clone ( skb , GFP_ATOMIC ) ;
2016-06-19 07:52:03 +03:00
if ( ! skb2 )
return 1 ;
skb_dst_drop ( skb2 ) ;
skb_pull ( skb2 , nhs ) ;
skb_reset_network_header ( skb2 ) ;
2018-03-02 19:32:17 +03:00
rt = rt6_lookup ( dev_net ( skb - > dev ) , & ipv6_hdr ( skb2 ) - > saddr , NULL , 0 ,
skb , 0 ) ;
2016-06-19 07:52:03 +03:00
if ( rt & & rt - > dst . dev )
skb2 - > dev = rt - > dst . dev ;
2016-06-19 07:52:04 +03:00
ipv6_addr_set_v4mapped ( ip_hdr ( skb ) - > saddr , & temp_saddr ) ;
2016-06-19 07:52:06 +03:00
if ( data_len ) {
/* RFC 4884 (partial) support :
* insert 0 padding at the end , before the extensions
*/
__skb_push ( skb2 , nhs ) ;
skb_reset_network_header ( skb2 ) ;
memmove ( skb2 - > data , skb2 - > data + nhs , data_len - nhs ) ;
memset ( skb2 - > data + data_len - nhs , 0 , nhs ) ;
/* RFC 4884 4.5 : Length is measured in 64-bit words,
* and stored in reserved [ 0 ]
*/
info = ( data_len / 8 ) < < 24 ;
}
2016-06-19 07:52:04 +03:00
if ( type = = ICMP_TIME_EXCEEDED )
icmp6_send ( skb2 , ICMPV6_TIME_EXCEED , ICMPV6_EXC_HOPLIMIT ,
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
info , & temp_saddr , IP6CB ( skb2 ) ) ;
2016-06-19 07:52:04 +03:00
else
icmp6_send ( skb2 , ICMPV6_DEST_UNREACH , ICMPV6_ADDR_UNREACH ,
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
The icmp{,v6}_send functions make all sorts of use of skb->cb, casting
it with IPCB or IP6CB, assuming the skb to have come directly from the
inet layer. But when the packet comes from the ndo layer, especially
when forwarded, there's no telling what might be in skb->cb at that
point. As a result, the icmp sending code risks reading bogus memory
contents, which can result in nasty stack overflows such as this one
reported by a user:
panic+0x108/0x2ea
__stack_chk_fail+0x14/0x20
__icmp_send+0x5bd/0x5c0
icmp_ndo_send+0x148/0x160
In icmp_send, skb->cb is cast with IPCB and an ip_options struct is read
from it. The optlen parameter there is of particular note, as it can
induce writes beyond bounds. There are quite a few ways that can happen
in __ip_options_echo. For example:
// sptr/skb are attacker-controlled skb bytes
sptr = skb_network_header(skb);
// dptr/dopt points to stack memory allocated by __icmp_send
dptr = dopt->__data;
// sopt is the corrupt skb->cb in question
if (sopt->rr) {
optlen = sptr[sopt->rr+1]; // corrupt skb->cb + skb->data
soffset = sptr[sopt->rr+2]; // corrupt skb->cb + skb->data
// this now writes potentially attacker-controlled data, over
// flowing the stack:
memcpy(dptr, sptr+sopt->rr, optlen);
}
In the icmpv6_send case, the story is similar, but not as dire, as only
IP6CB(skb)->iif and IP6CB(skb)->dsthao are used. The dsthao case is
worse than the iif case, but it is passed to ipv6_find_tlv, which does
a bit of bounds checking on the value.
This is easy to simulate by doing a `memset(skb->cb, 0x41,
sizeof(skb->cb));` before calling icmp{,v6}_ndo_send, and it's only by
good fortune and the rarity of icmp sending from that context that we've
avoided reports like this until now. For example, in KASAN:
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xa0e/0x12b0
Write of size 38 at addr ffff888006f1f80e by task ping/89
CPU: 2 PID: 89 Comm: ping Not tainted 5.10.0-rc7-debug+ #5
Call Trace:
dump_stack+0x9a/0xcc
print_address_description.constprop.0+0x1a/0x160
__kasan_report.cold+0x20/0x38
kasan_report+0x32/0x40
check_memory_region+0x145/0x1a0
memcpy+0x39/0x60
__ip_options_echo+0xa0e/0x12b0
__icmp_send+0x744/0x1700
Actually, out of the 4 drivers that do this, only gtp zeroed the cb for
the v4 case, while the rest did not. So this commit actually removes the
gtp-specific zeroing, while putting the code where it belongs in the
shared infrastructure of icmp{,v6}_ndo_send.
This commit fixes the issue by passing an empty IPCB or IP6CB along to
the functions that actually do the work. For the icmp_send, this was
already trivial, thanks to __icmp_send providing the plumbing function.
For icmpv6_send, this required a tiny bit of refactoring to make it
behave like the v4 case, after which it was straight forward.
Fixes: a2b78e9b2cac ("sunvnet: generate ICMP PTMUD messages for smaller port MTUs")
Reported-by: SinYu <liuxyon@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/netdev/CAF=yD-LOF116aHub6RMe8vB8ZpnrrnoTdqhobEx+bvoA8AsP0w@mail.gmail.com/T/
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Link: https://lore.kernel.org/r/20210223131858.72082-1-Jason@zx2c4.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-02-23 16:18:58 +03:00
info , & temp_saddr , IP6CB ( skb2 ) ) ;
2016-06-19 07:52:03 +03:00
if ( rt )
ip6_rt_put ( rt ) ;
kfree_skb ( skb2 ) ;
return 0 ;
}
EXPORT_SYMBOL ( ip6_err_gen_icmpv6_unreach ) ;
2023-02-16 19:28:42 +03:00
static enum skb_drop_reason icmpv6_echo_reply ( struct sk_buff * skb )
2005-04-17 02:20:36 +04:00
{
2008-03-25 15:47:49 +03:00
struct net * net = dev_net ( skb - > dev ) ;
2005-06-14 01:59:44 +04:00
struct sock * sk ;
2005-04-17 02:20:36 +04:00
struct inet6_dev * idev ;
2005-06-14 01:59:44 +04:00
struct ipv6_pinfo * np ;
2011-04-22 08:53:02 +04:00
const struct in6_addr * saddr = NULL ;
2007-03-13 20:03:22 +03:00
struct icmp6hdr * icmph = icmp6_hdr ( skb ) ;
2005-04-17 02:20:36 +04:00
struct icmp6hdr tmp_hdr ;
2011-03-13 00:22:43 +03:00
struct flowi6 fl6 ;
2005-04-17 02:20:36 +04:00
struct icmpv6_msg msg ;
struct dst_entry * dst ;
2016-05-03 07:40:07 +03:00
struct ipcm6_cookie ipc6 ;
2014-05-13 21:17:33 +04:00
u32 mark = IP6_REPLY_MARK ( net , skb - > mark ) ;
2023-02-16 19:28:42 +03:00
SKB_DR ( reason ) ;
2019-03-20 17:29:27 +03:00
bool acast ;
2021-06-26 17:07:46 +03:00
u8 type ;
2005-04-17 02:20:36 +04:00
2019-03-19 19:37:12 +03:00
if ( ipv6_addr_is_multicast ( & ipv6_hdr ( skb ) - > daddr ) & &
net - > ipv6 . sysctl . icmpv6_echo_ignore_multicast )
2023-02-16 19:28:42 +03:00
return reason ;
2019-03-19 19:37:12 +03:00
2007-04-26 04:54:47 +04:00
saddr = & ipv6_hdr ( skb ) - > daddr ;
2005-04-17 02:20:36 +04:00
2019-03-20 17:29:27 +03:00
acast = ipv6_anycast_destination ( skb_dst ( skb ) , saddr ) ;
if ( acast & & net - > ipv6 . sysctl . icmpv6_echo_ignore_anycast )
2023-02-16 19:28:42 +03:00
return reason ;
2019-03-20 17:29:27 +03:00
2014-01-07 17:57:27 +04:00
if ( ! ipv6_unicast_destination ( skb ) & &
2019-03-20 17:29:27 +03:00
! ( net - > ipv6 . sysctl . anycast_src_echo_reply & & acast ) )
2005-04-17 02:20:36 +04:00
saddr = NULL ;
2021-06-26 17:07:46 +03:00
if ( icmph - > icmp6_type = = ICMPV6_EXT_ECHO_REQUEST )
type = ICMPV6_EXT_ECHO_REPLY ;
else
type = ICMPV6_ECHO_REPLY ;
2005-04-17 02:20:36 +04:00
memcpy ( & tmp_hdr , icmph , sizeof ( tmp_hdr ) ) ;
2021-06-26 17:07:46 +03:00
tmp_hdr . icmp6_type = type ;
2005-04-17 02:20:36 +04:00
2011-03-13 00:22:43 +03:00
memset ( & fl6 , 0 , sizeof ( fl6 ) ) ;
2019-07-01 16:39:36 +03:00
if ( net - > ipv6 . sysctl . flowlabel_reflect & FLOWLABEL_REFLECT_ICMPV6_ECHO_REPLIES )
fl6 . flowlabel = ip6_flowlabel ( ipv6_hdr ( skb ) ) ;
2011-03-13 00:22:43 +03:00
fl6 . flowi6_proto = IPPROTO_ICMPV6 ;
2011-11-21 07:39:03 +04:00
fl6 . daddr = ipv6_hdr ( skb ) - > saddr ;
2005-04-17 02:20:36 +04:00
if ( saddr )
2011-11-21 07:39:03 +04:00
fl6 . saddr = * saddr ;
2017-08-28 23:53:34 +03:00
fl6 . flowi6_oif = icmp6_iif ( skb ) ;
2021-06-26 17:07:46 +03:00
fl6 . fl6_icmp_type = type ;
2014-05-13 21:17:33 +04:00
fl6 . flowi6_mark = mark ;
2016-11-03 20:23:43 +03:00
fl6 . flowi6_uid = sock_net_uid ( net , NULL ) ;
2020-09-28 05:38:26 +03:00
security_skb_classify_flow ( skb , flowi6_to_flowi_common ( & fl6 ) ) ;
2005-04-17 02:20:36 +04:00
2017-01-09 18:04:14 +03:00
local_bh_disable ( ) ;
2008-08-23 15:43:33 +04:00
sk = icmpv6_xmit_lock ( net ) ;
2015-03-29 16:00:04 +03:00
if ( ! sk )
2017-01-09 18:04:14 +03:00
goto out_bh_enable ;
2008-08-23 15:43:33 +04:00
np = inet6_sk ( sk ) ;
2008-02-29 22:16:46 +03:00
2011-03-13 00:22:43 +03:00
if ( ! fl6 . flowi6_oif & & ipv6_addr_is_multicast ( & fl6 . daddr ) )
2023-12-08 13:12:43 +03:00
fl6 . flowi6_oif = READ_ONCE ( np - > mcast_oif ) ;
2012-02-08 13:11:08 +04:00
else if ( ! fl6 . flowi6_oif )
2023-12-08 13:12:44 +03:00
fl6 . flowi6_oif = READ_ONCE ( np - > ucast_oif ) ;
2005-04-17 02:20:36 +04:00
2017-10-06 09:46:14 +03:00
if ( ip6_dst_lookup ( net , sk , & dst , & fl6 ) )
2005-04-17 02:20:36 +04:00
goto out ;
2011-03-13 00:22:43 +03:00
dst = xfrm_lookup ( net , dst , flowi6_to_flowi ( & fl6 ) , sk , 0 ) ;
2011-03-03 00:27:41 +03:00
if ( IS_ERR ( dst ) )
2005-09-09 02:11:55 +04:00
goto out ;
2005-04-17 02:20:36 +04:00
2019-04-17 23:35:49 +03:00
/* Check the ratelimit */
if ( ( ! ( skb - > dev - > flags & IFF_LOOPBACK ) & & ! icmpv6_global_allow ( net , ICMPV6_ECHO_REPLY ) ) | |
! icmpv6_xrlim_allow ( sk , ICMPV6_ECHO_REPLY , & fl6 ) )
goto out_dst_release ;
2011-07-28 01:13:03 +04:00
idev = __in6_dev_get ( skb - > dev ) ;
2005-04-17 02:20:36 +04:00
msg . skb = skb ;
msg . offset = 0 ;
2021-06-26 17:07:46 +03:00
msg . type = type ;
2005-04-17 02:20:36 +04:00
2023-09-12 19:02:07 +03:00
ipcm6_init_sk ( & ipc6 , sk ) ;
2016-05-03 07:40:07 +03:00
ipc6 . hlimit = ip6_sk_dst_hoplimit ( np , & fl6 , dst ) ;
ipc6 . tclass = ipv6_get_dsfield ( ipv6_hdr ( skb ) ) ;
2020-07-01 23:00:06 +03:00
ipc6 . sockc . mark = mark ;
2016-05-03 07:40:07 +03:00
2021-06-26 17:07:46 +03:00
if ( icmph - > icmp6_type = = ICMPV6_EXT_ECHO_REQUEST )
if ( ! icmp_build_probe ( skb , ( struct icmphdr * ) & tmp_hdr ) )
goto out_dst_release ;
2017-10-06 09:46:14 +03:00
if ( ip6_append_data ( sk , icmpv6_getfrag , & msg ,
skb - > len + sizeof ( struct icmp6hdr ) ,
sizeof ( struct icmp6hdr ) , & ipc6 , & fl6 ,
2024-04-26 18:19:52 +03:00
dst_rt6_info ( dst ) , MSG_DONTWAIT ) ) {
2016-04-28 02:44:36 +03:00
__ICMP6_INC_STATS ( net , idev , ICMP6_MIB_OUTERRORS ) ;
2005-04-17 02:20:36 +04:00
ip6_flush_pending_frames ( sk ) ;
2011-07-28 01:13:03 +04:00
} else {
2017-10-06 09:46:14 +03:00
icmpv6_push_pending_frames ( sk , & fl6 , & tmp_hdr ,
skb - > len + sizeof ( struct icmp6hdr ) ) ;
2023-02-16 19:28:42 +03:00
reason = SKB_CONSUMED ;
2005-04-17 02:20:36 +04:00
}
2019-04-17 23:35:49 +03:00
out_dst_release :
2005-04-17 02:20:36 +04:00
dst_release ( dst ) ;
2007-02-09 17:24:49 +03:00
out :
2008-02-29 22:16:46 +03:00
icmpv6_xmit_unlock ( sk ) ;
2017-01-09 18:04:14 +03:00
out_bh_enable :
local_bh_enable ( ) ;
2023-02-16 19:28:42 +03:00
return reason ;
2005-04-17 02:20:36 +04:00
}
2023-02-10 21:47:07 +03:00
enum skb_drop_reason icmpv6_notify ( struct sk_buff * skb , u8 type ,
u8 code , __be32 info )
2005-04-17 02:20:36 +04:00
{
2022-01-03 20:11:31 +03:00
struct inet6_skb_parm * opt = IP6CB ( skb ) ;
2023-02-10 21:47:07 +03:00
struct net * net = dev_net ( skb - > dev ) ;
2009-09-14 16:22:28 +04:00
const struct inet6_protocol * ipprot ;
2023-02-10 21:47:07 +03:00
enum skb_drop_reason reason ;
2005-04-17 02:20:36 +04:00
int inner_offset ;
2011-12-01 05:05:51 +04:00
__be16 frag_off ;
2012-06-20 05:56:21 +04:00
u8 nexthdr ;
2005-04-17 02:20:36 +04:00
2023-02-10 21:47:07 +03:00
reason = pskb_may_pull_reason ( skb , sizeof ( struct ipv6hdr ) ) ;
if ( reason ! = SKB_NOT_DROPPED_YET )
2014-07-31 13:54:32 +04:00
goto out ;
2005-04-17 02:20:36 +04:00
2022-01-03 20:11:31 +03:00
seg6_icmp_srh ( skb , opt ) ;
2005-04-17 02:20:36 +04:00
nexthdr = ( ( struct ipv6hdr * ) skb - > data ) - > nexthdr ;
if ( ipv6_ext_hdr ( nexthdr ) ) {
/* now skip over extension headers */
2011-12-01 05:05:51 +04:00
inner_offset = ipv6_skip_exthdr ( skb , sizeof ( struct ipv6hdr ) ,
& nexthdr , & frag_off ) ;
2023-02-10 21:47:07 +03:00
if ( inner_offset < 0 ) {
SKB_DR_SET ( reason , IPV6_BAD_EXTHDR ) ;
2014-07-31 13:54:32 +04:00
goto out ;
2023-02-10 21:47:07 +03:00
}
2005-04-17 02:20:36 +04:00
} else {
inner_offset = sizeof ( struct ipv6hdr ) ;
}
/* Checkin header including 8 bytes of inner protocol header. */
2023-02-10 21:47:07 +03:00
reason = pskb_may_pull_reason ( skb , inner_offset + 8 ) ;
if ( reason ! = SKB_NOT_DROPPED_YET )
2014-07-31 13:54:32 +04:00
goto out ;
2005-04-17 02:20:36 +04:00
/* BUGGG_FUTURE: we should try to parse exthdrs in this packet.
Without this we will not able f . e . to make source routed
pmtu discovery .
Corresponding argument ( opt ) to notifiers is already added .
- - ANK ( 980726 )
*/
2012-06-20 05:56:21 +04:00
ipprot = rcu_dereference ( inet6_protos [ nexthdr ] ) ;
2005-04-17 02:20:36 +04:00
if ( ipprot & & ipprot - > err_handler )
2022-01-03 20:11:31 +03:00
ipprot - > err_handler ( skb , opt , type , code , inner_offset , info ) ;
2005-04-17 02:20:36 +04:00
2007-11-20 09:35:57 +03:00
raw6_icmp_error ( skb , nexthdr , type , code , inner_offset , info ) ;
2023-02-10 21:47:07 +03:00
return SKB_CONSUMED ;
2014-07-31 13:54:32 +04:00
out :
2016-04-28 02:44:36 +03:00
__ICMP6_INC_STATS ( net , __in6_dev_get ( skb - > dev ) , ICMP6_MIB_INERRORS ) ;
2023-02-10 21:47:07 +03:00
return reason ;
2005-04-17 02:20:36 +04:00
}
2007-02-09 17:24:49 +03:00
2005-04-17 02:20:36 +04:00
/*
* Handle icmp messages
*/
2007-10-15 23:50:28 +04:00
static int icmpv6_rcv ( struct sk_buff * skb )
2005-04-17 02:20:36 +04:00
{
2022-04-07 09:20:52 +03:00
enum skb_drop_reason reason = SKB_DROP_REASON_NOT_SPECIFIED ;
2018-08-10 18:48:15 +03:00
struct net * net = dev_net ( skb - > dev ) ;
2019-06-10 17:32:50 +03:00
struct net_device * dev = icmp6_dev ( skb ) ;
2005-04-17 02:20:36 +04:00
struct inet6_dev * idev = __in6_dev_get ( dev ) ;
2011-04-22 08:53:02 +04:00
const struct in6_addr * saddr , * daddr ;
2005-04-17 02:20:36 +04:00
struct icmp6hdr * hdr ;
2009-06-23 15:31:07 +04:00
u8 type ;
2005-04-17 02:20:36 +04:00
2007-12-13 05:54:16 +03:00
if ( ! xfrm6_policy_check ( NULL , XFRM_POLICY_IN , skb ) ) {
2008-10-28 23:24:06 +03:00
struct sec_path * sp = skb_sec_path ( skb ) ;
2007-12-12 21:44:43 +03:00
int nh ;
2008-10-28 23:24:06 +03:00
if ( ! ( sp & & sp - > xvec [ sp - > len - 1 ] - > props . flags &
2022-04-07 09:20:52 +03:00
XFRM_STATE_ICMP ) ) {
reason = SKB_DROP_REASON_XFRM_POLICY ;
2007-12-13 05:54:16 +03:00
goto drop_no_count ;
2022-04-07 09:20:52 +03:00
}
2007-12-13 05:54:16 +03:00
2012-06-16 01:54:11 +04:00
if ( ! pskb_may_pull ( skb , sizeof ( * hdr ) + sizeof ( struct ipv6hdr ) ) )
2007-12-12 21:44:43 +03:00
goto drop_no_count ;
nh = skb_network_offset ( skb ) ;
skb_set_network_header ( skb , sizeof ( * hdr ) ) ;
2022-04-07 09:20:52 +03:00
if ( ! xfrm6_policy_check_reverse ( NULL , XFRM_POLICY_IN ,
skb ) ) {
reason = SKB_DROP_REASON_XFRM_POLICY ;
2007-12-12 21:44:43 +03:00
goto drop_no_count ;
2022-04-07 09:20:52 +03:00
}
2007-12-12 21:44:43 +03:00
skb_set_network_header ( skb , nh ) ;
}
2016-04-28 02:44:36 +03:00
__ICMP6_INC_STATS ( dev_net ( dev ) , idev , ICMP6_MIB_INMSGS ) ;
2005-04-17 02:20:36 +04:00
2007-04-26 04:54:47 +04:00
saddr = & ipv6_hdr ( skb ) - > saddr ;
daddr = & ipv6_hdr ( skb ) - > daddr ;
2005-04-17 02:20:36 +04:00
2014-05-08 03:52:29 +04:00
if ( skb_checksum_validate ( skb , IPPROTO_ICMPV6 , ip6_compute_pseudo ) ) {
2014-11-11 21:59:17 +03:00
net_dbg_ratelimited ( " ICMPv6 checksum failed [%pI6c > %pI6c] \n " ,
saddr , daddr ) ;
2014-05-08 03:52:29 +04:00
goto csum_error ;
2005-04-17 02:20:36 +04:00
}
2008-02-05 14:15:50 +03:00
if ( ! pskb_pull ( skb , sizeof ( * hdr ) ) )
goto discard_it ;
2005-04-17 02:20:36 +04:00
2007-03-13 20:03:22 +03:00
hdr = icmp6_hdr ( skb ) ;
2005-04-17 02:20:36 +04:00
type = hdr - > icmp6_type ;
2016-04-28 02:44:42 +03:00
ICMP6MSGIN_INC_STATS ( dev_net ( dev ) , idev , type ) ;
2005-04-17 02:20:36 +04:00
switch ( type ) {
case ICMPV6_ECHO_REQUEST :
2018-08-10 18:48:15 +03:00
if ( ! net - > ipv6 . sysctl . icmpv6_echo_ignore_all )
2023-02-16 19:28:42 +03:00
reason = icmpv6_echo_reply ( skb ) ;
2005-04-17 02:20:36 +04:00
break ;
2021-06-26 17:07:46 +03:00
case ICMPV6_EXT_ECHO_REQUEST :
if ( ! net - > ipv6 . sysctl . icmpv6_echo_ignore_all & &
2022-07-12 03:15:23 +03:00
READ_ONCE ( net - > ipv4 . sysctl_icmp_echo_enable_probe ) )
2023-02-16 19:28:42 +03:00
reason = icmpv6_echo_reply ( skb ) ;
2021-06-26 17:07:46 +03:00
break ;
2005-04-17 02:20:36 +04:00
case ICMPV6_ECHO_REPLY :
2022-04-07 09:20:52 +03:00
reason = ping_rcv ( skb ) ;
2005-04-17 02:20:36 +04:00
break ;
2021-04-13 00:23:56 +03:00
case ICMPV6_EXT_ECHO_REPLY :
2022-04-07 09:20:52 +03:00
reason = ping_rcv ( skb ) ;
2021-04-13 00:23:56 +03:00
break ;
2005-04-17 02:20:36 +04:00
case ICMPV6_PKT_TOOBIG :
/* BUGGG_FUTURE: if packet contains rthdr, we cannot update
standard destination cache . Seems , only " advanced "
destination cache will allow to solve this problem
- - ANK ( 980726 )
*/
if ( ! pskb_may_pull ( skb , sizeof ( struct ipv6hdr ) ) )
goto discard_it ;
2007-03-13 20:03:22 +03:00
hdr = icmp6_hdr ( skb ) ;
2005-04-17 02:20:36 +04:00
2017-10-17 00:36:52 +03:00
/* to notify */
2020-03-13 01:50:22 +03:00
fallthrough ;
2005-04-17 02:20:36 +04:00
case ICMPV6_DEST_UNREACH :
case ICMPV6_TIME_EXCEED :
case ICMPV6_PARAMPROB :
2023-02-10 21:47:07 +03:00
reason = icmpv6_notify ( skb , type , hdr - > icmp6_code ,
hdr - > icmp6_mtu ) ;
2005-04-17 02:20:36 +04:00
break ;
case NDISC_ROUTER_SOLICITATION :
case NDISC_ROUTER_ADVERTISEMENT :
case NDISC_NEIGHBOUR_SOLICITATION :
case NDISC_NEIGHBOUR_ADVERTISEMENT :
case NDISC_REDIRECT :
2023-02-10 21:47:08 +03:00
reason = ndisc_rcv ( skb ) ;
2005-04-17 02:20:36 +04:00
break ;
case ICMPV6_MGM_QUERY :
igmp6_event_query ( skb ) ;
2021-03-25 19:16:56 +03:00
return 0 ;
2005-04-17 02:20:36 +04:00
case ICMPV6_MGM_REPORT :
igmp6_event_report ( skb ) ;
2021-03-25 19:16:56 +03:00
return 0 ;
2005-04-17 02:20:36 +04:00
case ICMPV6_MGM_REDUCTION :
case ICMPV6_NI_QUERY :
case ICMPV6_NI_REPLY :
case ICMPV6_MLD2_REPORT :
case ICMPV6_DHAAD_REQUEST :
case ICMPV6_DHAAD_REPLY :
case ICMPV6_MOBILE_PREFIX_SOL :
case ICMPV6_MOBILE_PREFIX_ADV :
break ;
default :
/* informational */
if ( type & ICMPV6_INFOMSG_MASK )
break ;
2015-10-24 15:00:20 +03:00
net_dbg_ratelimited ( " icmpv6: msg of unknown type [%pI6c > %pI6c] \n " ,
saddr , daddr ) ;
2014-10-08 00:33:53 +04:00
2007-02-09 17:24:49 +03:00
/*
* error of unknown type .
* must pass to upper level
2005-04-17 02:20:36 +04:00
*/
2023-02-10 21:47:07 +03:00
reason = icmpv6_notify ( skb , type , hdr - > icmp6_code ,
hdr - > icmp6_mtu ) ;
2007-04-21 04:09:22 +04:00
}
2014-11-18 01:04:29 +03:00
/* until the v6 path can be better sorted assume failure and
* preserve the status quo behaviour for the rest of the paths to here
*/
2022-04-07 09:20:52 +03:00
if ( reason )
kfree_skb_reason ( skb , reason ) ;
2014-11-18 01:04:29 +03:00
else
2022-04-07 09:20:52 +03:00
consume_skb ( skb ) ;
2014-11-18 01:04:29 +03:00
2005-04-17 02:20:36 +04:00
return 0 ;
2013-04-29 12:39:56 +04:00
csum_error :
2022-04-07 09:20:52 +03:00
reason = SKB_DROP_REASON_ICMP_CSUM ;
2016-04-28 02:44:36 +03:00
__ICMP6_INC_STATS ( dev_net ( dev ) , idev , ICMP6_MIB_CSUMERRORS ) ;
2005-04-17 02:20:36 +04:00
discard_it :
2016-04-28 02:44:36 +03:00
__ICMP6_INC_STATS ( dev_net ( dev ) , idev , ICMP6_MIB_INERRORS ) ;
2007-12-12 21:44:43 +03:00
drop_no_count :
2022-04-07 09:20:52 +03:00
kfree_skb_reason ( skb , reason ) ;
2005-04-17 02:20:36 +04:00
return 0 ;
}
2023-07-11 16:06:21 +03:00
void icmpv6_flow_init ( const struct sock * sk , struct flowi6 * fl6 , u8 type ,
2007-12-07 02:43:30 +03:00
const struct in6_addr * saddr ,
2023-07-11 16:06:21 +03:00
const struct in6_addr * daddr , int oif )
2007-12-07 02:43:30 +03:00
{
2011-03-13 00:22:43 +03:00
memset ( fl6 , 0 , sizeof ( * fl6 ) ) ;
2011-11-21 07:39:03 +04:00
fl6 - > saddr = * saddr ;
fl6 - > daddr = * daddr ;
2014-08-25 00:53:10 +04:00
fl6 - > flowi6_proto = IPPROTO_ICMPV6 ;
2011-03-13 00:36:19 +03:00
fl6 - > fl6_icmp_type = type ;
fl6 - > fl6_icmp_code = 0 ;
2011-03-13 00:22:43 +03:00
fl6 - > flowi6_oif = oif ;
2020-09-28 05:38:26 +03:00
security_sk_classify_flow ( sk , flowi6_to_flowi_common ( fl6 ) ) ;
2007-12-07 02:43:30 +03:00
}
2022-01-24 23:24:56 +03:00
int __init icmpv6_init ( void )
2005-04-17 02:20:36 +04:00
{
struct sock * sk ;
2019-02-23 10:28:27 +03:00
int err , i ;
2005-04-17 02:20:36 +04:00
2006-04-11 09:52:50 +04:00
for_each_possible_cpu ( i ) {
2008-04-04 01:31:03 +04:00
err = inet_ctl_sock_create ( & sk , PF_INET6 ,
2022-01-24 23:24:56 +03:00
SOCK_RAW , IPPROTO_ICMPV6 , & init_net ) ;
2005-04-17 02:20:36 +04:00
if ( err < 0 ) {
2012-05-15 18:11:53 +04:00
pr_err ( " Failed to initialize the ICMP6 control socket (err %d) \n " ,
2005-04-17 02:20:36 +04:00
err ) ;
2022-01-24 23:24:56 +03:00
return err ;
2005-04-17 02:20:36 +04:00
}
2022-01-24 23:24:56 +03:00
per_cpu ( ipv6_icmp_sk , i ) = sk ;
2008-02-29 22:19:22 +03:00
2005-04-17 02:20:36 +04:00
/* Enough space for 2 64K ICMP packets, including
* sk_buff struct overhead .
*/
2011-10-13 11:28:54 +04:00
sk - > sk_sndbuf = 2 * SKB_TRUESIZE ( 64 * 1024 ) ;
2005-04-17 02:20:36 +04:00
}
2008-02-29 22:21:22 +03:00
err = - EAGAIN ;
if ( inet6_add_protocol ( & icmpv6_protocol , IPPROTO_ICMPV6 ) < 0 )
goto fail ;
2013-04-25 15:08:30 +04:00
err = inet6_register_icmp_sender ( icmp6_send ) ;
if ( err )
goto sender_reg_err ;
2008-02-29 22:21:22 +03:00
return 0 ;
2013-04-25 15:08:30 +04:00
sender_reg_err :
inet6_del_protocol ( & icmpv6_protocol , IPPROTO_ICMPV6 ) ;
2008-02-29 22:21:22 +03:00
fail :
2012-05-15 18:11:53 +04:00
pr_err ( " Failed to register ICMP6 protocol \n " ) ;
2008-02-29 22:21:22 +03:00
return err ;
}
2008-03-03 23:02:54 +03:00
void icmpv6_cleanup ( void )
2008-02-29 22:21:22 +03:00
{
2013-04-25 15:08:30 +04:00
inet6_unregister_icmp_sender ( icmp6_send ) ;
2005-04-17 02:20:36 +04:00
inet6_del_protocol ( & icmpv6_protocol , IPPROTO_ICMPV6 ) ;
}
2008-02-29 22:21:22 +03:00
2005-11-30 03:21:38 +03:00
static const struct icmp6_err {
2005-04-17 02:20:36 +04:00
int err ;
int fatal ;
} tab_unreach [ ] = {
{ /* NOROUTE */
. err = ENETUNREACH ,
. fatal = 0 ,
} ,
{ /* ADM_PROHIBITED */
. err = EACCES ,
. fatal = 1 ,
} ,
{ /* Was NOT_NEIGHBOUR, now reserved */
. err = EHOSTUNREACH ,
. fatal = 0 ,
} ,
{ /* ADDR_UNREACH */
. err = EHOSTUNREACH ,
. fatal = 0 ,
} ,
{ /* PORT_UNREACH */
. err = ECONNREFUSED ,
. fatal = 1 ,
} ,
2013-08-30 13:18:45 +04:00
{ /* POLICY_FAIL */
. err = EACCES ,
. fatal = 1 ,
} ,
{ /* REJECT_ROUTE */
. err = EACCES ,
. fatal = 1 ,
} ,
2005-04-17 02:20:36 +04:00
} ;
2009-06-23 15:31:07 +04:00
int icmpv6_err_convert ( u8 type , u8 code , int * err )
2005-04-17 02:20:36 +04:00
{
int fatal = 0 ;
* err = EPROTO ;
switch ( type ) {
case ICMPV6_DEST_UNREACH :
fatal = 1 ;
2013-08-30 13:18:45 +04:00
if ( code < ARRAY_SIZE ( tab_unreach ) ) {
2005-04-17 02:20:36 +04:00
* err = tab_unreach [ code ] . err ;
fatal = tab_unreach [ code ] . fatal ;
}
break ;
case ICMPV6_PKT_TOOBIG :
* err = EMSGSIZE ;
break ;
2007-02-09 17:24:49 +03:00
2005-04-17 02:20:36 +04:00
case ICMPV6_PARAMPROB :
* err = EPROTO ;
fatal = 1 ;
break ;
case ICMPV6_TIME_EXCEED :
* err = EHOSTUNREACH ;
break ;
2007-04-21 04:09:22 +04:00
}
2005-04-17 02:20:36 +04:00
return fatal ;
}
2007-02-22 16:05:40 +03:00
EXPORT_SYMBOL ( icmpv6_err_convert ) ;
2005-04-17 02:20:36 +04:00
# ifdef CONFIG_SYSCTL
2013-12-30 02:03:31 +04:00
static struct ctl_table ipv6_icmp_table_template [ ] = {
2005-04-17 02:20:36 +04:00
{
. procname = " ratelimit " ,
2008-01-10 14:02:40 +03:00
. data = & init_net . ipv6 . sysctl . icmpv6_time ,
2005-04-17 02:20:36 +04:00
. maxlen = sizeof ( int ) ,
. mode = 0644 ,
2008-11-04 05:21:05 +03:00
. proc_handler = proc_dointvec_ms_jiffies ,
2005-04-17 02:20:36 +04:00
} ,
2018-08-10 18:48:15 +03:00
{
. procname = " echo_ignore_all " ,
. data = & init_net . ipv6 . sysctl . icmpv6_echo_ignore_all ,
2021-03-31 20:52:12 +03:00
. maxlen = sizeof ( u8 ) ,
2018-08-10 18:48:15 +03:00
. mode = 0644 ,
2021-03-31 20:52:12 +03:00
. proc_handler = proc_dou8vec_minmax ,
2018-08-10 18:48:15 +03:00
} ,
2019-03-19 19:37:12 +03:00
{
. procname = " echo_ignore_multicast " ,
. data = & init_net . ipv6 . sysctl . icmpv6_echo_ignore_multicast ,
2021-03-31 20:52:12 +03:00
. maxlen = sizeof ( u8 ) ,
2019-03-19 19:37:12 +03:00
. mode = 0644 ,
2021-03-31 20:52:12 +03:00
. proc_handler = proc_dou8vec_minmax ,
2019-03-19 19:37:12 +03:00
} ,
2019-03-20 17:29:27 +03:00
{
. procname = " echo_ignore_anycast " ,
. data = & init_net . ipv6 . sysctl . icmpv6_echo_ignore_anycast ,
2021-03-31 20:52:12 +03:00
. maxlen = sizeof ( u8 ) ,
2019-03-20 17:29:27 +03:00
. mode = 0644 ,
2021-03-31 20:52:12 +03:00
. proc_handler = proc_dou8vec_minmax ,
2019-03-20 17:29:27 +03:00
} ,
2019-04-17 23:35:49 +03:00
{
. procname = " ratemask " ,
. data = & init_net . ipv6 . sysctl . icmpv6_ratemask_ptr ,
. maxlen = ICMPV6_MSG_MAX + 1 ,
. mode = 0644 ,
. proc_handler = proc_do_large_bitmap ,
} ,
2023-04-19 04:32:38 +03:00
{
. procname = " error_anycast_as_unicast " ,
. data = & init_net . ipv6 . sysctl . icmpv6_error_anycast_as_unicast ,
. maxlen = sizeof ( u8 ) ,
. mode = 0644 ,
. proc_handler = proc_dou8vec_minmax ,
. extra1 = SYSCTL_ZERO ,
. extra2 = SYSCTL_ONE ,
} ,
2005-04-17 02:20:36 +04:00
} ;
2008-01-10 13:53:43 +03:00
2010-01-17 06:35:32 +03:00
struct ctl_table * __net_init ipv6_icmp_sysctl_init ( struct net * net )
2008-01-10 13:53:43 +03:00
{
struct ctl_table * table ;
table = kmemdup ( ipv6_icmp_table_template ,
sizeof ( ipv6_icmp_table_template ) ,
GFP_KERNEL ) ;
2008-02-27 18:24:28 +03:00
2018-08-10 18:48:15 +03:00
if ( table ) {
2008-02-27 18:24:28 +03:00
table [ 0 ] . data = & net - > ipv6 . sysctl . icmpv6_time ;
2018-08-10 18:48:15 +03:00
table [ 1 ] . data = & net - > ipv6 . sysctl . icmpv6_echo_ignore_all ;
2019-03-19 19:37:12 +03:00
table [ 2 ] . data = & net - > ipv6 . sysctl . icmpv6_echo_ignore_multicast ;
2019-03-20 17:29:27 +03:00
table [ 3 ] . data = & net - > ipv6 . sysctl . icmpv6_echo_ignore_anycast ;
2019-04-17 23:35:49 +03:00
table [ 4 ] . data = & net - > ipv6 . sysctl . icmpv6_ratemask_ptr ;
2023-04-19 04:32:38 +03:00
table [ 5 ] . data = & net - > ipv6 . sysctl . icmpv6_error_anycast_as_unicast ;
2018-08-10 18:48:15 +03:00
}
2008-01-10 13:53:43 +03:00
return table ;
}
2023-08-09 13:50:03 +03:00
size_t ipv6_icmp_sysctl_table_size ( void )
{
return ARRAY_SIZE ( ipv6_icmp_table_template ) ;
}
2005-04-17 02:20:36 +04:00
# endif