linux/net/ipv6/mcast_snoop.c
Linus Lüssing 9901408815 net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
The IPv6 Multicast Router Advertisements parsing has the following two
issues:

For one thing, ICMPv6 MRD Advertisements are smaller than ICMPv6 MLD
messages (ICMPv6 MRD Adv.: 8 bytes vs. ICMPv6 MLDv1/2: >= 24 bytes,
assuming MLDv2 Reports with at least one multicast address entry).
When ipv6_mc_check_mld_msg() tries to parse an Multicast Router
Advertisement its MLD length check will fail - and it will wrongly
return -EINVAL, even if we have a valid MRD Advertisement. With the
returned -EINVAL the bridge code will assume a broken packet and will
wrongly discard it, potentially leading to multicast packet loss towards
multicast routers.

The second issue is the MRD header parsing in
br_ip6_multicast_mrd_rcv(): It wrongly checks for an ICMPv6 header
immediately after the IPv6 header (IPv6 next header type). However
according to RFC4286, section 2 all MRD messages contain a Router Alert
option (just like MLD). So instead there is an IPv6 Hop-by-Hop option
for the Router Alert between the IPv6 and ICMPv6 header, again leading
to the bridge wrongly discarding Multicast Router Advertisements.

To fix these two issues, introduce a new return value -ENODATA to
ipv6_mc_check_mld() to indicate a valid ICMPv6 packet with a hop-by-hop
option which is not an MLD but potentially an MRD packet. This also
simplifies further parsing in the bridge code, as ipv6_mc_check_mld()
already fully checks the ICMPv6 header and hop-by-hop option.

These issues were found and fixed with the help of the mrdisc tool
(https://github.com/troglobit/mrdisc).

Fixes: 4b3087c7e3 ("bridge: Snoop Multicast Router Advertisements")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-04-27 14:02:06 -07:00

191 lines
4.4 KiB
C

// SPDX-License-Identifier: GPL-2.0-only
/* Copyright (C) 2010: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
* Copyright (C) 2015: Linus Lüssing <linus.luessing@c0d3.blue>
*
* Based on the MLD support added to br_multicast.c by YOSHIFUJI Hideaki.
*/
#include <linux/skbuff.h>
#include <net/ipv6.h>
#include <net/mld.h>
#include <net/addrconf.h>
#include <net/ip6_checksum.h>
static int ipv6_mc_check_ip6hdr(struct sk_buff *skb)
{
const struct ipv6hdr *ip6h;
unsigned int len;
unsigned int offset = skb_network_offset(skb) + sizeof(*ip6h);
if (!pskb_may_pull(skb, offset))
return -EINVAL;
ip6h = ipv6_hdr(skb);
if (ip6h->version != 6)
return -EINVAL;
len = offset + ntohs(ip6h->payload_len);
if (skb->len < len || len <= offset)
return -EINVAL;
skb_set_transport_header(skb, offset);
return 0;
}
static int ipv6_mc_check_exthdrs(struct sk_buff *skb)
{
const struct ipv6hdr *ip6h;
int offset;
u8 nexthdr;
__be16 frag_off;
ip6h = ipv6_hdr(skb);
if (ip6h->nexthdr != IPPROTO_HOPOPTS)
return -ENOMSG;
nexthdr = ip6h->nexthdr;
offset = skb_network_offset(skb) + sizeof(*ip6h);
offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
if (offset < 0)
return -EINVAL;
if (nexthdr != IPPROTO_ICMPV6)
return -ENOMSG;
skb_set_transport_header(skb, offset);
return 0;
}
static int ipv6_mc_check_mld_reportv2(struct sk_buff *skb)
{
unsigned int len = skb_transport_offset(skb);
len += sizeof(struct mld2_report);
return ipv6_mc_may_pull(skb, len) ? 0 : -EINVAL;
}
static int ipv6_mc_check_mld_query(struct sk_buff *skb)
{
unsigned int transport_len = ipv6_transport_len(skb);
struct mld_msg *mld;
unsigned int len;
/* RFC2710+RFC3810 (MLDv1+MLDv2) require link-local source addresses */
if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL))
return -EINVAL;
/* MLDv1? */
if (transport_len != sizeof(struct mld_msg)) {
/* or MLDv2? */
if (transport_len < sizeof(struct mld2_query))
return -EINVAL;
len = skb_transport_offset(skb) + sizeof(struct mld2_query);
if (!ipv6_mc_may_pull(skb, len))
return -EINVAL;
}
mld = (struct mld_msg *)skb_transport_header(skb);
/* RFC2710+RFC3810 (MLDv1+MLDv2) require the multicast link layer
* all-nodes destination address (ff02::1) for general queries
*/
if (ipv6_addr_any(&mld->mld_mca) &&
!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
return -EINVAL;
return 0;
}
static int ipv6_mc_check_mld_msg(struct sk_buff *skb)
{
unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg);
struct mld_msg *mld;
if (!ipv6_mc_may_pull(skb, len))
return -ENODATA;
mld = (struct mld_msg *)skb_transport_header(skb);
switch (mld->mld_type) {
case ICMPV6_MGM_REDUCTION:
case ICMPV6_MGM_REPORT:
return 0;
case ICMPV6_MLD2_REPORT:
return ipv6_mc_check_mld_reportv2(skb);
case ICMPV6_MGM_QUERY:
return ipv6_mc_check_mld_query(skb);
default:
return -ENODATA;
}
}
static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
{
return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
}
static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
{
unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
unsigned int transport_len = ipv6_transport_len(skb);
struct sk_buff *skb_chk;
if (!ipv6_mc_may_pull(skb, len))
return -EINVAL;
skb_chk = skb_checksum_trimmed(skb, transport_len,
ipv6_mc_validate_checksum);
if (!skb_chk)
return -EINVAL;
if (skb_chk != skb)
kfree_skb(skb_chk);
return 0;
}
/**
* ipv6_mc_check_mld - checks whether this is a sane MLD packet
* @skb: the skb to validate
*
* Checks whether an IPv6 packet is a valid MLD packet. If so sets
* skb transport header accordingly and returns zero.
*
* -EINVAL: A broken packet was detected, i.e. it violates some internet
* standard
* -ENOMSG: IP header validation succeeded but it is not an ICMPv6 packet
* with a hop-by-hop option.
* -ENODATA: IP+ICMPv6 header with hop-by-hop option validation succeeded
* but it is not an MLD packet.
* -ENOMEM: A memory allocation failure happened.
*
* Caller needs to set the skb network header and free any returned skb if it
* differs from the provided skb.
*/
int ipv6_mc_check_mld(struct sk_buff *skb)
{
int ret;
ret = ipv6_mc_check_ip6hdr(skb);
if (ret < 0)
return ret;
ret = ipv6_mc_check_exthdrs(skb);
if (ret < 0)
return ret;
ret = ipv6_mc_check_icmpv6(skb);
if (ret < 0)
return ret;
return ipv6_mc_check_mld_msg(skb);
}
EXPORT_SYMBOL(ipv6_mc_check_mld);