net/ipv6/exthdrs_core.c

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * IPv6 library code, needed by static components when full IPv6 support is
0004  * not configured or static.
0005  */
0006 #include <linux/export.h>
0007 #include <net/ipv6.h>
0008
0009 /*
0010  * find out if nexthdr is a well-known extension header or a protocol
0011  */
0012
0013 bool ipv6_ext_hdr(u8 nexthdr)
0014 {
0015     /*
0016      * find out if nexthdr is an extension header or a protocol
0017      */
0018     return   (nexthdr == NEXTHDR_HOP)   ||
0019          (nexthdr == NEXTHDR_ROUTING)   ||
0020          (nexthdr == NEXTHDR_FRAGMENT)  ||
0021          (nexthdr == NEXTHDR_AUTH)  ||
0022          (nexthdr == NEXTHDR_NONE)  ||
0023          (nexthdr == NEXTHDR_DEST);
0024 }
0025 EXPORT_SYMBOL(ipv6_ext_hdr);
0026
0027 /*
0028  * Skip any extension headers. This is used by the ICMP module.
0029  *
0030  * Note that strictly speaking this conflicts with RFC 2460 4.0:
0031  * ...The contents and semantics of each extension header determine whether
0032  * or not to proceed to the next header.  Therefore, extension headers must
0033  * be processed strictly in the order they appear in the packet; a
0034  * receiver must not, for example, scan through a packet looking for a
0035  * particular kind of extension header and process that header prior to
0036  * processing all preceding ones.
0037  *
0038  * We do exactly this. This is a protocol bug. We can't decide after a
0039  * seeing an unknown discard-with-error flavour TLV option if it's a
0040  * ICMP error message or not (errors should never be send in reply to
0041  * ICMP error messages).
0042  *
0043  * But I see no other way to do this. This might need to be reexamined
0044  * when Linux implements ESP (and maybe AUTH) headers.
0045  * --AK
0046  *
0047  * This function parses (probably truncated) exthdr set "hdr".
0048  * "nexthdrp" initially points to some place,
0049  * where type of the first header can be found.
0050  *
0051  * It skips all well-known exthdrs, and returns pointer to the start
0052  * of unparsable area i.e. the first header with unknown type.
0053  * If it is not NULL *nexthdr is updated by type/protocol of this header.
0054  *
0055  * NOTES: - if packet terminated with NEXTHDR_NONE it returns NULL.
0056  *        - it may return pointer pointing beyond end of packet,
0057  *      if the last recognized header is truncated in the middle.
0058  *        - if packet is truncated, so that all parsed headers are skipped,
0059  *      it returns NULL.
0060  *    - First fragment header is skipped, not-first ones
0061  *      are considered as unparsable.
0062  *    - Reports the offset field of the final fragment header so it is
0063  *      possible to tell whether this is a first fragment, later fragment,
0064  *      or not fragmented.
0065  *    - ESP is unparsable for now and considered like
0066  *      normal payload protocol.
0067  *    - Note also special handling of AUTH header. Thanks to IPsec wizards.
0068  *
0069  * --ANK (980726)
0070  */
0071
0072 int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp,
0073              __be16 *frag_offp)
0074 {
0075     u8 nexthdr = *nexthdrp;
0076
0077     *frag_offp = 0;
0078
0079     while (ipv6_ext_hdr(nexthdr)) {
0080         struct ipv6_opt_hdr _hdr, *hp;
0081         int hdrlen;
0082
0083         if (nexthdr == NEXTHDR_NONE)
0084             return -1;
0085         hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
0086         if (!hp)
0087             return -1;
0088         if (nexthdr == NEXTHDR_FRAGMENT) {
0089             __be16 _frag_off, *fp;
0090             fp = skb_header_pointer(skb,
0091                         start+offsetof(struct frag_hdr,
0092                                    frag_off),
0093                         sizeof(_frag_off),
0094                         &_frag_off);
0095             if (!fp)
0096                 return -1;
0097
0098             *frag_offp = *fp;
0099             if (ntohs(*frag_offp) & ~0x7)
0100                 break;
0101             hdrlen = 8;
0102         } else if (nexthdr == NEXTHDR_AUTH)
0103             hdrlen = ipv6_authlen(hp);
0104         else
0105             hdrlen = ipv6_optlen(hp);
0106
0107         nexthdr = hp->nexthdr;
0108         start += hdrlen;
0109     }
0110
0111     *nexthdrp = nexthdr;
0112     return start;
0113 }
0114 EXPORT_SYMBOL(ipv6_skip_exthdr);
0115
0116 int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type)
0117 {
0118     const unsigned char *nh = skb_network_header(skb);
0119     int packet_len = skb_tail_pointer(skb) - skb_network_header(skb);
0120     struct ipv6_opt_hdr *hdr;
0121     int len;
0122
0123     if (offset + 2 > packet_len)
0124         goto bad;
0125     hdr = (struct ipv6_opt_hdr *)(nh + offset);
0126     len = ((hdr->hdrlen + 1) << 3);
0127
0128     if (offset + len > packet_len)
0129         goto bad;
0130
0131     offset += 2;
0132     len -= 2;
0133
0134     while (len > 0) {
0135         int opttype = nh[offset];
0136         int optlen;
0137
0138         if (opttype == type)
0139             return offset;
0140
0141         switch (opttype) {
0142         case IPV6_TLV_PAD1:
0143             optlen = 1;
0144             break;
0145         default:
0146             optlen = nh[offset + 1] + 2;
0147             if (optlen > len)
0148                 goto bad;
0149             break;
0150         }
0151         offset += optlen;
0152         len -= optlen;
0153     }
0154     /* not_found */
0155  bad:
0156     return -1;
0157 }
0158 EXPORT_SYMBOL_GPL(ipv6_find_tlv);
0159
0160 /*
0161  * find the offset to specified header or the protocol number of last header
0162  * if target < 0. "last header" is transport protocol header, ESP, or
0163  * "No next header".
0164  *
0165  * Note that *offset is used as input/output parameter, and if it is not zero,
0166  * then it must be a valid offset to an inner IPv6 header. This can be used
0167  * to explore inner IPv6 header, eg. ICMPv6 error messages.
0168  *
0169  * If target header is found, its offset is set in *offset and return protocol
0170  * number. Otherwise, return -1.
0171  *
0172  * If the first fragment doesn't contain the final protocol header or
0173  * NEXTHDR_NONE it is considered invalid.
0174  *
0175  * Note that non-1st fragment is special case that "the protocol number
0176  * of last header" is "next header" field in Fragment header. In this case,
0177  * *offset is meaningless and fragment offset is stored in *fragoff if fragoff
0178  * isn't NULL.
0179  *
0180  * if flags is not NULL and it's a fragment, then the frag flag
0181  * IP6_FH_F_FRAG will be set. If it's an AH header, the
0182  * IP6_FH_F_AUTH flag is set and target < 0, then this function will
0183  * stop at the AH header. If IP6_FH_F_SKIP_RH flag was passed, then this
0184  * function will skip all those routing headers, where segements_left was 0.
0185  */
0186 int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
0187           int target, unsigned short *fragoff, int *flags)
0188 {
0189     unsigned int start = skb_network_offset(skb) + sizeof(struct ipv6hdr);
0190     u8 nexthdr = ipv6_hdr(skb)->nexthdr;
0191     bool found;
0192
0193     if (fragoff)
0194         *fragoff = 0;
0195
0196     if (*offset) {
0197         struct ipv6hdr _ip6, *ip6;
0198
0199         ip6 = skb_header_pointer(skb, *offset, sizeof(_ip6), &_ip6);
0200         if (!ip6 || (ip6->version != 6))
0201             return -EBADMSG;
0202         start = *offset + sizeof(struct ipv6hdr);
0203         nexthdr = ip6->nexthdr;
0204     }
0205
0206     do {
0207         struct ipv6_opt_hdr _hdr, *hp;
0208         unsigned int hdrlen;
0209         found = (nexthdr == target);
0210
0211         if ((!ipv6_ext_hdr(nexthdr)) || nexthdr == NEXTHDR_NONE) {
0212             if (target < 0 || found)
0213                 break;
0214             return -ENOENT;
0215         }
0216
0217         hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
0218         if (!hp)
0219             return -EBADMSG;
0220
0221         if (nexthdr == NEXTHDR_ROUTING) {
0222             struct ipv6_rt_hdr _rh, *rh;
0223
0224             rh = skb_header_pointer(skb, start, sizeof(_rh),
0225                         &_rh);
0226             if (!rh)
0227                 return -EBADMSG;
0228
0229             if (flags && (*flags & IP6_FH_F_SKIP_RH) &&
0230                 rh->segments_left == 0)
0231                 found = false;
0232         }
0233
0234         if (nexthdr == NEXTHDR_FRAGMENT) {
0235             unsigned short _frag_off;
0236             __be16 *fp;
0237
0238             if (flags)  /* Indicate that this is a fragment */
0239                 *flags |= IP6_FH_F_FRAG;
0240             fp = skb_header_pointer(skb,
0241                         start+offsetof(struct frag_hdr,
0242                                    frag_off),
0243                         sizeof(_frag_off),
0244                         &_frag_off);
0245             if (!fp)
0246                 return -EBADMSG;
0247
0248             _frag_off = ntohs(*fp) & ~0x7;
0249             if (_frag_off) {
0250                 if (target < 0 &&
0251                     ((!ipv6_ext_hdr(hp->nexthdr)) ||
0252                      hp->nexthdr == NEXTHDR_NONE)) {
0253                     if (fragoff)
0254                         *fragoff = _frag_off;
0255                     return hp->nexthdr;
0256                 }
0257                 if (!found)
0258                     return -ENOENT;
0259                 if (fragoff)
0260                     *fragoff = _frag_off;
0261                 break;
0262             }
0263             hdrlen = 8;
0264         } else if (nexthdr == NEXTHDR_AUTH) {
0265             if (flags && (*flags & IP6_FH_F_AUTH) && (target < 0))
0266                 break;
0267             hdrlen = ipv6_authlen(hp);
0268         } else
0269             hdrlen = ipv6_optlen(hp);
0270
0271         if (!found) {
0272             nexthdr = hp->nexthdr;
0273             start += hdrlen;
0274         }
0275     } while (!found);
0276
0277     *offset = start;
0278     return nexthdr;
0279 }
0280 EXPORT_SYMBOL(ipv6_find_hdr);