1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * Copyright (C)2003-2006 Helsinki University of Technology |
4 | * Copyright (C)2003-2006 USAGI/WIDE Project |
5 | */ |
6 | /* |
7 | * Authors: |
8 | * Noriaki TAKAMIYA @USAGI |
9 | * Masahide NAKAMURA @USAGI |
10 | */ |
11 | |
12 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
13 | |
14 | #include <linux/module.h> |
15 | #include <linux/skbuff.h> |
16 | #include <linux/time.h> |
17 | #include <linux/ipv6.h> |
18 | #include <linux/icmpv6.h> |
19 | #include <net/sock.h> |
20 | #include <net/ipv6.h> |
21 | #include <net/ip6_checksum.h> |
22 | #include <net/rawv6.h> |
23 | #include <net/xfrm.h> |
24 | #include <net/mip6.h> |
25 | |
26 | static inline unsigned int calc_padlen(unsigned int len, unsigned int n) |
27 | { |
28 | return (n - len + 16) & 0x7; |
29 | } |
30 | |
31 | static inline void *mip6_padn(__u8 *data, __u8 padlen) |
32 | { |
33 | if (!data) |
34 | return NULL; |
35 | if (padlen == 1) { |
36 | data[0] = IPV6_TLV_PAD1; |
37 | } else if (padlen > 1) { |
38 | data[0] = IPV6_TLV_PADN; |
39 | data[1] = padlen - 2; |
40 | if (padlen > 2) |
41 | memset(data+2, 0, data[1]); |
42 | } |
43 | return data + padlen; |
44 | } |
45 | |
46 | static inline void mip6_param_prob(struct sk_buff *skb, u8 code, int pos) |
47 | { |
48 | icmpv6_send(skb, ICMPV6_PARAMPROB, code, info: pos); |
49 | } |
50 | |
51 | static int mip6_mh_len(int type) |
52 | { |
53 | int len = 0; |
54 | |
55 | switch (type) { |
56 | case IP6_MH_TYPE_BRR: |
57 | len = 0; |
58 | break; |
59 | case IP6_MH_TYPE_HOTI: |
60 | case IP6_MH_TYPE_COTI: |
61 | case IP6_MH_TYPE_BU: |
62 | case IP6_MH_TYPE_BACK: |
63 | len = 1; |
64 | break; |
65 | case IP6_MH_TYPE_HOT: |
66 | case IP6_MH_TYPE_COT: |
67 | case IP6_MH_TYPE_BERROR: |
68 | len = 2; |
69 | break; |
70 | } |
71 | return len; |
72 | } |
73 | |
74 | static int mip6_mh_filter(struct sock *sk, struct sk_buff *skb) |
75 | { |
76 | struct ip6_mh _hdr; |
77 | const struct ip6_mh *mh; |
78 | |
79 | mh = skb_header_pointer(skb, offset: skb_transport_offset(skb), |
80 | len: sizeof(_hdr), buffer: &_hdr); |
81 | if (!mh) |
82 | return -1; |
83 | |
84 | if (((mh->ip6mh_hdrlen + 1) << 3) > skb->len) |
85 | return -1; |
86 | |
87 | if (mh->ip6mh_hdrlen < mip6_mh_len(type: mh->ip6mh_type)) { |
88 | net_dbg_ratelimited("mip6: MH message too short: %d vs >=%d\n" , |
89 | mh->ip6mh_hdrlen, |
90 | mip6_mh_len(mh->ip6mh_type)); |
91 | mip6_param_prob(skb, code: 0, offsetof(struct ip6_mh, ip6mh_hdrlen) + |
92 | skb_network_header_len(skb)); |
93 | return -1; |
94 | } |
95 | |
96 | if (mh->ip6mh_proto != IPPROTO_NONE) { |
97 | net_dbg_ratelimited("mip6: MH invalid payload proto = %d\n" , |
98 | mh->ip6mh_proto); |
99 | mip6_param_prob(skb, code: 0, offsetof(struct ip6_mh, ip6mh_proto) + |
100 | skb_network_header_len(skb)); |
101 | return -1; |
102 | } |
103 | |
104 | return 0; |
105 | } |
106 | |
107 | struct mip6_report_rate_limiter { |
108 | spinlock_t lock; |
109 | ktime_t stamp; |
110 | int iif; |
111 | struct in6_addr src; |
112 | struct in6_addr dst; |
113 | }; |
114 | |
115 | static struct mip6_report_rate_limiter mip6_report_rl = { |
116 | .lock = __SPIN_LOCK_UNLOCKED(mip6_report_rl.lock) |
117 | }; |
118 | |
119 | static int mip6_destopt_input(struct xfrm_state *x, struct sk_buff *skb) |
120 | { |
121 | const struct ipv6hdr *iph = ipv6_hdr(skb); |
122 | struct ipv6_destopt_hdr *destopt = (struct ipv6_destopt_hdr *)skb->data; |
123 | int err = destopt->nexthdr; |
124 | |
125 | spin_lock(lock: &x->lock); |
126 | if (!ipv6_addr_equal(a1: &iph->saddr, a2: (struct in6_addr *)x->coaddr) && |
127 | !ipv6_addr_any(a: (struct in6_addr *)x->coaddr)) |
128 | err = -ENOENT; |
129 | spin_unlock(lock: &x->lock); |
130 | |
131 | return err; |
132 | } |
133 | |
134 | /* Destination Option Header is inserted. |
135 | * IP Header's src address is replaced with Home Address Option in |
136 | * Destination Option Header. |
137 | */ |
138 | static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb) |
139 | { |
140 | struct ipv6hdr *iph; |
141 | struct ipv6_destopt_hdr *dstopt; |
142 | struct ipv6_destopt_hao *hao; |
143 | u8 nexthdr; |
144 | int len; |
145 | |
146 | skb_push(skb, len: -skb_network_offset(skb)); |
147 | iph = ipv6_hdr(skb); |
148 | |
149 | nexthdr = *skb_mac_header(skb); |
150 | *skb_mac_header(skb) = IPPROTO_DSTOPTS; |
151 | |
152 | dstopt = (struct ipv6_destopt_hdr *)skb_transport_header(skb); |
153 | dstopt->nexthdr = nexthdr; |
154 | |
155 | hao = mip6_padn(data: (char *)(dstopt + 1), |
156 | padlen: calc_padlen(len: sizeof(*dstopt), n: 6)); |
157 | |
158 | hao->type = IPV6_TLV_HAO; |
159 | BUILD_BUG_ON(sizeof(*hao) != 18); |
160 | hao->length = sizeof(*hao) - 2; |
161 | |
162 | len = ((char *)hao - (char *)dstopt) + sizeof(*hao); |
163 | |
164 | memcpy(&hao->addr, &iph->saddr, sizeof(hao->addr)); |
165 | spin_lock_bh(lock: &x->lock); |
166 | memcpy(&iph->saddr, x->coaddr, sizeof(iph->saddr)); |
167 | spin_unlock_bh(lock: &x->lock); |
168 | |
169 | WARN_ON(len != x->props.header_len); |
170 | dstopt->hdrlen = (x->props.header_len >> 3) - 1; |
171 | |
172 | return 0; |
173 | } |
174 | |
175 | static inline int mip6_report_rl_allow(ktime_t stamp, |
176 | const struct in6_addr *dst, |
177 | const struct in6_addr *src, int iif) |
178 | { |
179 | int allow = 0; |
180 | |
181 | spin_lock_bh(lock: &mip6_report_rl.lock); |
182 | if (mip6_report_rl.stamp != stamp || |
183 | mip6_report_rl.iif != iif || |
184 | !ipv6_addr_equal(a1: &mip6_report_rl.src, a2: src) || |
185 | !ipv6_addr_equal(a1: &mip6_report_rl.dst, a2: dst)) { |
186 | mip6_report_rl.stamp = stamp; |
187 | mip6_report_rl.iif = iif; |
188 | mip6_report_rl.src = *src; |
189 | mip6_report_rl.dst = *dst; |
190 | allow = 1; |
191 | } |
192 | spin_unlock_bh(lock: &mip6_report_rl.lock); |
193 | return allow; |
194 | } |
195 | |
196 | static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, |
197 | const struct flowi *fl) |
198 | { |
199 | struct net *net = xs_net(x); |
200 | struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb; |
201 | const struct flowi6 *fl6 = &fl->u.ip6; |
202 | struct ipv6_destopt_hao *hao = NULL; |
203 | struct xfrm_selector sel; |
204 | int offset; |
205 | ktime_t stamp; |
206 | int err = 0; |
207 | |
208 | if (unlikely(fl6->flowi6_proto == IPPROTO_MH && |
209 | fl6->fl6_mh_type <= IP6_MH_TYPE_MAX)) |
210 | goto out; |
211 | |
212 | if (likely(opt->dsthao)) { |
213 | offset = ipv6_find_tlv(skb, offset: opt->dsthao, IPV6_TLV_HAO); |
214 | if (likely(offset >= 0)) |
215 | hao = (struct ipv6_destopt_hao *) |
216 | (skb_network_header(skb) + offset); |
217 | } |
218 | |
219 | stamp = skb_get_ktime(skb); |
220 | |
221 | if (!mip6_report_rl_allow(stamp, dst: &ipv6_hdr(skb)->daddr, |
222 | src: hao ? &hao->addr : &ipv6_hdr(skb)->saddr, |
223 | iif: opt->iif)) |
224 | goto out; |
225 | |
226 | memset(&sel, 0, sizeof(sel)); |
227 | memcpy(&sel.daddr, (xfrm_address_t *)&ipv6_hdr(skb)->daddr, |
228 | sizeof(sel.daddr)); |
229 | sel.prefixlen_d = 128; |
230 | memcpy(&sel.saddr, (xfrm_address_t *)&ipv6_hdr(skb)->saddr, |
231 | sizeof(sel.saddr)); |
232 | sel.prefixlen_s = 128; |
233 | sel.family = AF_INET6; |
234 | sel.proto = fl6->flowi6_proto; |
235 | sel.dport = xfrm_flowi_dport(fl, uli: &fl6->uli); |
236 | if (sel.dport) |
237 | sel.dport_mask = htons(~0); |
238 | sel.sport = xfrm_flowi_sport(fl, uli: &fl6->uli); |
239 | if (sel.sport) |
240 | sel.sport_mask = htons(~0); |
241 | sel.ifindex = fl6->flowi6_oif; |
242 | |
243 | err = km_report(net, IPPROTO_DSTOPTS, sel: &sel, |
244 | addr: (hao ? (xfrm_address_t *)&hao->addr : NULL)); |
245 | |
246 | out: |
247 | return err; |
248 | } |
249 | |
250 | static int mip6_destopt_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack) |
251 | { |
252 | if (x->id.spi) { |
253 | NL_SET_ERR_MSG(extack, "SPI must be 0" ); |
254 | return -EINVAL; |
255 | } |
256 | if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) { |
257 | NL_SET_ERR_MSG(extack, "XFRM mode must be XFRM_MODE_ROUTEOPTIMIZATION" ); |
258 | return -EINVAL; |
259 | } |
260 | |
261 | x->props.header_len = sizeof(struct ipv6_destopt_hdr) + |
262 | calc_padlen(len: sizeof(struct ipv6_destopt_hdr), n: 6) + |
263 | sizeof(struct ipv6_destopt_hao); |
264 | WARN_ON(x->props.header_len != 24); |
265 | |
266 | return 0; |
267 | } |
268 | |
269 | /* |
270 | * Do nothing about destroying since it has no specific operation for |
271 | * destination options header unlike IPsec protocols. |
272 | */ |
273 | static void mip6_destopt_destroy(struct xfrm_state *x) |
274 | { |
275 | } |
276 | |
277 | static const struct xfrm_type mip6_destopt_type = { |
278 | .owner = THIS_MODULE, |
279 | .proto = IPPROTO_DSTOPTS, |
280 | .flags = XFRM_TYPE_NON_FRAGMENT | XFRM_TYPE_LOCAL_COADDR, |
281 | .init_state = mip6_destopt_init_state, |
282 | .destructor = mip6_destopt_destroy, |
283 | .input = mip6_destopt_input, |
284 | .output = mip6_destopt_output, |
285 | .reject = mip6_destopt_reject, |
286 | }; |
287 | |
288 | static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb) |
289 | { |
290 | const struct ipv6hdr *iph = ipv6_hdr(skb); |
291 | struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data; |
292 | int err = rt2->rt_hdr.nexthdr; |
293 | |
294 | spin_lock(lock: &x->lock); |
295 | if (!ipv6_addr_equal(a1: &iph->daddr, a2: (struct in6_addr *)x->coaddr) && |
296 | !ipv6_addr_any(a: (struct in6_addr *)x->coaddr)) |
297 | err = -ENOENT; |
298 | spin_unlock(lock: &x->lock); |
299 | |
300 | return err; |
301 | } |
302 | |
303 | /* Routing Header type 2 is inserted. |
304 | * IP Header's dst address is replaced with Routing Header's Home Address. |
305 | */ |
306 | static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb) |
307 | { |
308 | struct ipv6hdr *iph; |
309 | struct rt2_hdr *rt2; |
310 | u8 nexthdr; |
311 | |
312 | skb_push(skb, len: -skb_network_offset(skb)); |
313 | iph = ipv6_hdr(skb); |
314 | |
315 | nexthdr = *skb_mac_header(skb); |
316 | *skb_mac_header(skb) = IPPROTO_ROUTING; |
317 | |
318 | rt2 = (struct rt2_hdr *)skb_transport_header(skb); |
319 | rt2->rt_hdr.nexthdr = nexthdr; |
320 | rt2->rt_hdr.hdrlen = (x->props.header_len >> 3) - 1; |
321 | rt2->rt_hdr.type = IPV6_SRCRT_TYPE_2; |
322 | rt2->rt_hdr.segments_left = 1; |
323 | memset(&rt2->reserved, 0, sizeof(rt2->reserved)); |
324 | |
325 | WARN_ON(rt2->rt_hdr.hdrlen != 2); |
326 | |
327 | memcpy(&rt2->addr, &iph->daddr, sizeof(rt2->addr)); |
328 | spin_lock_bh(lock: &x->lock); |
329 | memcpy(&iph->daddr, x->coaddr, sizeof(iph->daddr)); |
330 | spin_unlock_bh(lock: &x->lock); |
331 | |
332 | return 0; |
333 | } |
334 | |
335 | static int mip6_rthdr_init_state(struct xfrm_state *x, struct netlink_ext_ack *extack) |
336 | { |
337 | if (x->id.spi) { |
338 | NL_SET_ERR_MSG(extack, "SPI must be 0" ); |
339 | return -EINVAL; |
340 | } |
341 | if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) { |
342 | NL_SET_ERR_MSG(extack, "XFRM mode must be XFRM_MODE_ROUTEOPTIMIZATION" ); |
343 | return -EINVAL; |
344 | } |
345 | |
346 | x->props.header_len = sizeof(struct rt2_hdr); |
347 | |
348 | return 0; |
349 | } |
350 | |
351 | /* |
352 | * Do nothing about destroying since it has no specific operation for routing |
353 | * header type 2 unlike IPsec protocols. |
354 | */ |
355 | static void mip6_rthdr_destroy(struct xfrm_state *x) |
356 | { |
357 | } |
358 | |
359 | static const struct xfrm_type mip6_rthdr_type = { |
360 | .owner = THIS_MODULE, |
361 | .proto = IPPROTO_ROUTING, |
362 | .flags = XFRM_TYPE_NON_FRAGMENT | XFRM_TYPE_REMOTE_COADDR, |
363 | .init_state = mip6_rthdr_init_state, |
364 | .destructor = mip6_rthdr_destroy, |
365 | .input = mip6_rthdr_input, |
366 | .output = mip6_rthdr_output, |
367 | }; |
368 | |
369 | static int __init mip6_init(void) |
370 | { |
371 | pr_info("Mobile IPv6\n" ); |
372 | |
373 | if (xfrm_register_type(type: &mip6_destopt_type, AF_INET6) < 0) { |
374 | pr_info("%s: can't add xfrm type(destopt)\n" , __func__); |
375 | goto mip6_destopt_xfrm_fail; |
376 | } |
377 | if (xfrm_register_type(type: &mip6_rthdr_type, AF_INET6) < 0) { |
378 | pr_info("%s: can't add xfrm type(rthdr)\n" , __func__); |
379 | goto mip6_rthdr_xfrm_fail; |
380 | } |
381 | if (rawv6_mh_filter_register(filter: mip6_mh_filter) < 0) { |
382 | pr_info("%s: can't add rawv6 mh filter\n" , __func__); |
383 | goto mip6_rawv6_mh_fail; |
384 | } |
385 | |
386 | |
387 | return 0; |
388 | |
389 | mip6_rawv6_mh_fail: |
390 | xfrm_unregister_type(type: &mip6_rthdr_type, AF_INET6); |
391 | mip6_rthdr_xfrm_fail: |
392 | xfrm_unregister_type(type: &mip6_destopt_type, AF_INET6); |
393 | mip6_destopt_xfrm_fail: |
394 | return -EAGAIN; |
395 | } |
396 | |
397 | static void __exit mip6_fini(void) |
398 | { |
399 | if (rawv6_mh_filter_unregister(filter: mip6_mh_filter) < 0) |
400 | pr_info("%s: can't remove rawv6 mh filter\n" , __func__); |
401 | xfrm_unregister_type(type: &mip6_rthdr_type, AF_INET6); |
402 | xfrm_unregister_type(type: &mip6_destopt_type, AF_INET6); |
403 | } |
404 | |
405 | module_init(mip6_init); |
406 | module_exit(mip6_fini); |
407 | |
408 | MODULE_LICENSE("GPL" ); |
409 | MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_DSTOPTS); |
410 | MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_ROUTING); |
411 | |