1 | // SPDX-License-Identifier: GPL-2.0-or-later |
2 | /* |
3 | * SR-IPv6 implementation |
4 | * |
5 | * Author: |
6 | * David Lebrun <david.lebrun@uclouvain.be> |
7 | */ |
8 | |
9 | #include <linux/types.h> |
10 | #include <linux/skbuff.h> |
11 | #include <linux/net.h> |
12 | #include <linux/module.h> |
13 | #include <net/ip.h> |
14 | #include <net/ip_tunnels.h> |
15 | #include <net/lwtunnel.h> |
16 | #include <net/netevent.h> |
17 | #include <net/netns/generic.h> |
18 | #include <net/ip6_fib.h> |
19 | #include <net/route.h> |
20 | #include <net/seg6.h> |
21 | #include <linux/seg6.h> |
22 | #include <linux/seg6_iptunnel.h> |
23 | #include <net/addrconf.h> |
24 | #include <net/ip6_route.h> |
25 | #include <net/dst_cache.h> |
26 | #ifdef CONFIG_IPV6_SEG6_HMAC |
27 | #include <net/seg6_hmac.h> |
28 | #endif |
29 | #include <linux/netfilter.h> |
30 | |
31 | static size_t seg6_lwt_headroom(struct seg6_iptunnel_encap *tuninfo) |
32 | { |
33 | int head = 0; |
34 | |
35 | switch (tuninfo->mode) { |
36 | case SEG6_IPTUN_MODE_INLINE: |
37 | break; |
38 | case SEG6_IPTUN_MODE_ENCAP: |
39 | case SEG6_IPTUN_MODE_ENCAP_RED: |
40 | head = sizeof(struct ipv6hdr); |
41 | break; |
42 | case SEG6_IPTUN_MODE_L2ENCAP: |
43 | case SEG6_IPTUN_MODE_L2ENCAP_RED: |
44 | return 0; |
45 | } |
46 | |
47 | return ((tuninfo->srh->hdrlen + 1) << 3) + head; |
48 | } |
49 | |
50 | struct seg6_lwt { |
51 | struct dst_cache cache; |
52 | struct seg6_iptunnel_encap tuninfo[]; |
53 | }; |
54 | |
55 | static inline struct seg6_lwt *seg6_lwt_lwtunnel(struct lwtunnel_state *lwt) |
56 | { |
57 | return (struct seg6_lwt *)lwt->data; |
58 | } |
59 | |
60 | static inline struct seg6_iptunnel_encap * |
61 | seg6_encap_lwtunnel(struct lwtunnel_state *lwt) |
62 | { |
63 | return seg6_lwt_lwtunnel(lwt)->tuninfo; |
64 | } |
65 | |
66 | static const struct nla_policy seg6_iptunnel_policy[SEG6_IPTUNNEL_MAX + 1] = { |
67 | [SEG6_IPTUNNEL_SRH] = { .type = NLA_BINARY }, |
68 | }; |
69 | |
70 | static int nla_put_srh(struct sk_buff *skb, int attrtype, |
71 | struct seg6_iptunnel_encap *tuninfo) |
72 | { |
73 | struct seg6_iptunnel_encap *data; |
74 | struct nlattr *nla; |
75 | int len; |
76 | |
77 | len = SEG6_IPTUN_ENCAP_SIZE(tuninfo); |
78 | |
79 | nla = nla_reserve(skb, attrtype, attrlen: len); |
80 | if (!nla) |
81 | return -EMSGSIZE; |
82 | |
83 | data = nla_data(nla); |
84 | memcpy(data, tuninfo, len); |
85 | |
86 | return 0; |
87 | } |
88 | |
89 | static void set_tun_src(struct net *net, struct net_device *dev, |
90 | struct in6_addr *daddr, struct in6_addr *saddr) |
91 | { |
92 | struct seg6_pernet_data *sdata = seg6_pernet(net); |
93 | struct in6_addr *tun_src; |
94 | |
95 | rcu_read_lock(); |
96 | |
97 | tun_src = rcu_dereference(sdata->tun_src); |
98 | |
99 | if (!ipv6_addr_any(a: tun_src)) { |
100 | memcpy(saddr, tun_src, sizeof(struct in6_addr)); |
101 | } else { |
102 | ipv6_dev_get_saddr(net, dev, daddr, IPV6_PREFER_SRC_PUBLIC, |
103 | saddr); |
104 | } |
105 | |
106 | rcu_read_unlock(); |
107 | } |
108 | |
109 | /* Compute flowlabel for outer IPv6 header */ |
110 | static __be32 seg6_make_flowlabel(struct net *net, struct sk_buff *skb, |
111 | struct ipv6hdr *inner_hdr) |
112 | { |
113 | int do_flowlabel = net->ipv6.sysctl.seg6_flowlabel; |
114 | __be32 flowlabel = 0; |
115 | u32 hash; |
116 | |
117 | if (do_flowlabel > 0) { |
118 | hash = skb_get_hash(skb); |
119 | hash = rol32(word: hash, shift: 16); |
120 | flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK; |
121 | } else if (!do_flowlabel && skb->protocol == htons(ETH_P_IPV6)) { |
122 | flowlabel = ip6_flowlabel(hdr: inner_hdr); |
123 | } |
124 | return flowlabel; |
125 | } |
126 | |
127 | /* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */ |
128 | int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) |
129 | { |
130 | struct dst_entry *dst = skb_dst(skb); |
131 | struct net *net = dev_net(dev: dst->dev); |
132 | struct ipv6hdr *hdr, *inner_hdr; |
133 | struct ipv6_sr_hdr *isrh; |
134 | int hdrlen, tot_len, err; |
135 | __be32 flowlabel; |
136 | |
137 | hdrlen = (osrh->hdrlen + 1) << 3; |
138 | tot_len = hdrlen + sizeof(*hdr); |
139 | |
140 | err = skb_cow_head(skb, headroom: tot_len + skb->mac_len); |
141 | if (unlikely(err)) |
142 | return err; |
143 | |
144 | inner_hdr = ipv6_hdr(skb); |
145 | flowlabel = seg6_make_flowlabel(net, skb, inner_hdr); |
146 | |
147 | skb_push(skb, len: tot_len); |
148 | skb_reset_network_header(skb); |
149 | skb_mac_header_rebuild(skb); |
150 | hdr = ipv6_hdr(skb); |
151 | |
152 | /* inherit tc, flowlabel and hlim |
153 | * hlim will be decremented in ip6_forward() afterwards and |
154 | * decapsulation will overwrite inner hlim with outer hlim |
155 | */ |
156 | |
157 | if (skb->protocol == htons(ETH_P_IPV6)) { |
158 | ip6_flow_hdr(hdr, tclass: ip6_tclass(flowinfo: ip6_flowinfo(hdr: inner_hdr)), |
159 | flowlabel); |
160 | hdr->hop_limit = inner_hdr->hop_limit; |
161 | } else { |
162 | ip6_flow_hdr(hdr, tclass: 0, flowlabel); |
163 | hdr->hop_limit = ip6_dst_hoplimit(dst: skb_dst(skb)); |
164 | |
165 | memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); |
166 | |
167 | /* the control block has been erased, so we have to set the |
168 | * iif once again. |
169 | * We read the receiving interface index directly from the |
170 | * skb->skb_iif as it is done in the IPv4 receiving path (i.e.: |
171 | * ip_rcv_core(...)). |
172 | */ |
173 | IP6CB(skb)->iif = skb->skb_iif; |
174 | } |
175 | |
176 | hdr->nexthdr = NEXTHDR_ROUTING; |
177 | |
178 | isrh = (void *)hdr + sizeof(*hdr); |
179 | memcpy(isrh, osrh, hdrlen); |
180 | |
181 | isrh->nexthdr = proto; |
182 | |
183 | hdr->daddr = isrh->segments[isrh->first_segment]; |
184 | set_tun_src(net, dev: dst->dev, daddr: &hdr->daddr, saddr: &hdr->saddr); |
185 | |
186 | #ifdef CONFIG_IPV6_SEG6_HMAC |
187 | if (sr_has_hmac(isrh)) { |
188 | err = seg6_push_hmac(net, saddr: &hdr->saddr, srh: isrh); |
189 | if (unlikely(err)) |
190 | return err; |
191 | } |
192 | #endif |
193 | |
194 | hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); |
195 | |
196 | skb_postpush_rcsum(skb, start: hdr, len: tot_len); |
197 | |
198 | return 0; |
199 | } |
200 | EXPORT_SYMBOL_GPL(seg6_do_srh_encap); |
201 | |
202 | /* encapsulate an IPv6 packet within an outer IPv6 header with reduced SRH */ |
203 | static int seg6_do_srh_encap_red(struct sk_buff *skb, |
204 | struct ipv6_sr_hdr *osrh, int proto) |
205 | { |
206 | __u8 first_seg = osrh->first_segment; |
207 | struct dst_entry *dst = skb_dst(skb); |
208 | struct net *net = dev_net(dev: dst->dev); |
209 | struct ipv6hdr *hdr, *inner_hdr; |
210 | int hdrlen = ipv6_optlen(osrh); |
211 | int red_tlv_offset, tlv_offset; |
212 | struct ipv6_sr_hdr *isrh; |
213 | bool skip_srh = false; |
214 | __be32 flowlabel; |
215 | int tot_len, err; |
216 | int red_hdrlen; |
217 | int tlvs_len; |
218 | |
219 | if (first_seg > 0) { |
220 | red_hdrlen = hdrlen - sizeof(struct in6_addr); |
221 | } else { |
222 | /* NOTE: if tag/flags and/or other TLVs are introduced in the |
223 | * seg6_iptunnel infrastructure, they should be considered when |
224 | * deciding to skip the SRH. |
225 | */ |
226 | skip_srh = !sr_has_hmac(osrh); |
227 | |
228 | red_hdrlen = skip_srh ? 0 : hdrlen; |
229 | } |
230 | |
231 | tot_len = red_hdrlen + sizeof(struct ipv6hdr); |
232 | |
233 | err = skb_cow_head(skb, headroom: tot_len + skb->mac_len); |
234 | if (unlikely(err)) |
235 | return err; |
236 | |
237 | inner_hdr = ipv6_hdr(skb); |
238 | flowlabel = seg6_make_flowlabel(net, skb, inner_hdr); |
239 | |
240 | skb_push(skb, len: tot_len); |
241 | skb_reset_network_header(skb); |
242 | skb_mac_header_rebuild(skb); |
243 | hdr = ipv6_hdr(skb); |
244 | |
245 | /* based on seg6_do_srh_encap() */ |
246 | if (skb->protocol == htons(ETH_P_IPV6)) { |
247 | ip6_flow_hdr(hdr, tclass: ip6_tclass(flowinfo: ip6_flowinfo(hdr: inner_hdr)), |
248 | flowlabel); |
249 | hdr->hop_limit = inner_hdr->hop_limit; |
250 | } else { |
251 | ip6_flow_hdr(hdr, tclass: 0, flowlabel); |
252 | hdr->hop_limit = ip6_dst_hoplimit(dst: skb_dst(skb)); |
253 | |
254 | memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); |
255 | IP6CB(skb)->iif = skb->skb_iif; |
256 | } |
257 | |
258 | /* no matter if we have to skip the SRH or not, the first segment |
259 | * always comes in the pushed IPv6 header. |
260 | */ |
261 | hdr->daddr = osrh->segments[first_seg]; |
262 | |
263 | if (skip_srh) { |
264 | hdr->nexthdr = proto; |
265 | |
266 | set_tun_src(net, dev: dst->dev, daddr: &hdr->daddr, saddr: &hdr->saddr); |
267 | goto out; |
268 | } |
269 | |
270 | /* we cannot skip the SRH, slow path */ |
271 | |
272 | hdr->nexthdr = NEXTHDR_ROUTING; |
273 | isrh = (void *)hdr + sizeof(struct ipv6hdr); |
274 | |
275 | if (unlikely(!first_seg)) { |
276 | /* this is a very rare case; we have only one SID but |
277 | * we cannot skip the SRH since we are carrying some |
278 | * other info. |
279 | */ |
280 | memcpy(isrh, osrh, hdrlen); |
281 | goto srcaddr; |
282 | } |
283 | |
284 | tlv_offset = sizeof(*osrh) + (first_seg + 1) * sizeof(struct in6_addr); |
285 | red_tlv_offset = tlv_offset - sizeof(struct in6_addr); |
286 | |
287 | memcpy(isrh, osrh, red_tlv_offset); |
288 | |
289 | tlvs_len = hdrlen - tlv_offset; |
290 | if (unlikely(tlvs_len > 0)) { |
291 | const void *s = (const void *)osrh + tlv_offset; |
292 | void *d = (void *)isrh + red_tlv_offset; |
293 | |
294 | memcpy(d, s, tlvs_len); |
295 | } |
296 | |
297 | --isrh->first_segment; |
298 | isrh->hdrlen -= 2; |
299 | |
300 | srcaddr: |
301 | isrh->nexthdr = proto; |
302 | set_tun_src(net, dev: dst->dev, daddr: &hdr->daddr, saddr: &hdr->saddr); |
303 | |
304 | #ifdef CONFIG_IPV6_SEG6_HMAC |
305 | if (unlikely(!skip_srh && sr_has_hmac(isrh))) { |
306 | err = seg6_push_hmac(net, saddr: &hdr->saddr, srh: isrh); |
307 | if (unlikely(err)) |
308 | return err; |
309 | } |
310 | #endif |
311 | |
312 | out: |
313 | hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); |
314 | |
315 | skb_postpush_rcsum(skb, start: hdr, len: tot_len); |
316 | |
317 | return 0; |
318 | } |
319 | |
320 | /* insert an SRH within an IPv6 packet, just after the IPv6 header */ |
321 | int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) |
322 | { |
323 | struct ipv6hdr *hdr, *oldhdr; |
324 | struct ipv6_sr_hdr *isrh; |
325 | int hdrlen, err; |
326 | |
327 | hdrlen = (osrh->hdrlen + 1) << 3; |
328 | |
329 | err = skb_cow_head(skb, headroom: hdrlen + skb->mac_len); |
330 | if (unlikely(err)) |
331 | return err; |
332 | |
333 | oldhdr = ipv6_hdr(skb); |
334 | |
335 | skb_pull(skb, len: sizeof(struct ipv6hdr)); |
336 | skb_postpull_rcsum(skb, start: skb_network_header(skb), |
337 | len: sizeof(struct ipv6hdr)); |
338 | |
339 | skb_push(skb, len: sizeof(struct ipv6hdr) + hdrlen); |
340 | skb_reset_network_header(skb); |
341 | skb_mac_header_rebuild(skb); |
342 | |
343 | hdr = ipv6_hdr(skb); |
344 | |
345 | memmove(hdr, oldhdr, sizeof(*hdr)); |
346 | |
347 | isrh = (void *)hdr + sizeof(*hdr); |
348 | memcpy(isrh, osrh, hdrlen); |
349 | |
350 | isrh->nexthdr = hdr->nexthdr; |
351 | hdr->nexthdr = NEXTHDR_ROUTING; |
352 | |
353 | isrh->segments[0] = hdr->daddr; |
354 | hdr->daddr = isrh->segments[isrh->first_segment]; |
355 | |
356 | #ifdef CONFIG_IPV6_SEG6_HMAC |
357 | if (sr_has_hmac(isrh)) { |
358 | struct net *net = dev_net(dev: skb_dst(skb)->dev); |
359 | |
360 | err = seg6_push_hmac(net, saddr: &hdr->saddr, srh: isrh); |
361 | if (unlikely(err)) |
362 | return err; |
363 | } |
364 | #endif |
365 | |
366 | hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); |
367 | |
368 | skb_postpush_rcsum(skb, start: hdr, len: sizeof(struct ipv6hdr) + hdrlen); |
369 | |
370 | return 0; |
371 | } |
372 | EXPORT_SYMBOL_GPL(seg6_do_srh_inline); |
373 | |
374 | static int seg6_do_srh(struct sk_buff *skb) |
375 | { |
376 | struct dst_entry *dst = skb_dst(skb); |
377 | struct seg6_iptunnel_encap *tinfo; |
378 | int proto, err = 0; |
379 | |
380 | tinfo = seg6_encap_lwtunnel(lwt: dst->lwtstate); |
381 | |
382 | switch (tinfo->mode) { |
383 | case SEG6_IPTUN_MODE_INLINE: |
384 | if (skb->protocol != htons(ETH_P_IPV6)) |
385 | return -EINVAL; |
386 | |
387 | err = seg6_do_srh_inline(skb, tinfo->srh); |
388 | if (err) |
389 | return err; |
390 | break; |
391 | case SEG6_IPTUN_MODE_ENCAP: |
392 | case SEG6_IPTUN_MODE_ENCAP_RED: |
393 | err = iptunnel_handle_offloads(skb, gso_type_mask: SKB_GSO_IPXIP6); |
394 | if (err) |
395 | return err; |
396 | |
397 | if (skb->protocol == htons(ETH_P_IPV6)) |
398 | proto = IPPROTO_IPV6; |
399 | else if (skb->protocol == htons(ETH_P_IP)) |
400 | proto = IPPROTO_IPIP; |
401 | else |
402 | return -EINVAL; |
403 | |
404 | if (tinfo->mode == SEG6_IPTUN_MODE_ENCAP) |
405 | err = seg6_do_srh_encap(skb, tinfo->srh, proto); |
406 | else |
407 | err = seg6_do_srh_encap_red(skb, osrh: tinfo->srh, proto); |
408 | |
409 | if (err) |
410 | return err; |
411 | |
412 | skb_set_inner_transport_header(skb, offset: skb_transport_offset(skb)); |
413 | skb_set_inner_protocol(skb, protocol: skb->protocol); |
414 | skb->protocol = htons(ETH_P_IPV6); |
415 | break; |
416 | case SEG6_IPTUN_MODE_L2ENCAP: |
417 | case SEG6_IPTUN_MODE_L2ENCAP_RED: |
418 | if (!skb_mac_header_was_set(skb)) |
419 | return -EINVAL; |
420 | |
421 | if (pskb_expand_head(skb, nhead: skb->mac_len, ntail: 0, GFP_ATOMIC) < 0) |
422 | return -ENOMEM; |
423 | |
424 | skb_mac_header_rebuild(skb); |
425 | skb_push(skb, len: skb->mac_len); |
426 | |
427 | if (tinfo->mode == SEG6_IPTUN_MODE_L2ENCAP) |
428 | err = seg6_do_srh_encap(skb, tinfo->srh, |
429 | IPPROTO_ETHERNET); |
430 | else |
431 | err = seg6_do_srh_encap_red(skb, osrh: tinfo->srh, |
432 | IPPROTO_ETHERNET); |
433 | |
434 | if (err) |
435 | return err; |
436 | |
437 | skb->protocol = htons(ETH_P_IPV6); |
438 | break; |
439 | } |
440 | |
441 | skb_set_transport_header(skb, offset: sizeof(struct ipv6hdr)); |
442 | nf_reset_ct(skb); |
443 | |
444 | return 0; |
445 | } |
446 | |
447 | static int seg6_input_finish(struct net *net, struct sock *sk, |
448 | struct sk_buff *skb) |
449 | { |
450 | return dst_input(skb); |
451 | } |
452 | |
453 | static int seg6_input_core(struct net *net, struct sock *sk, |
454 | struct sk_buff *skb) |
455 | { |
456 | struct dst_entry *orig_dst = skb_dst(skb); |
457 | struct dst_entry *dst = NULL; |
458 | struct seg6_lwt *slwt; |
459 | int err; |
460 | |
461 | err = seg6_do_srh(skb); |
462 | if (unlikely(err)) { |
463 | kfree_skb(skb); |
464 | return err; |
465 | } |
466 | |
467 | slwt = seg6_lwt_lwtunnel(lwt: orig_dst->lwtstate); |
468 | |
469 | preempt_disable(); |
470 | dst = dst_cache_get(dst_cache: &slwt->cache); |
471 | preempt_enable(); |
472 | |
473 | if (!dst) { |
474 | ip6_route_input(skb); |
475 | dst = skb_dst(skb); |
476 | if (!dst->error) { |
477 | preempt_disable(); |
478 | dst_cache_set_ip6(dst_cache: &slwt->cache, dst, |
479 | saddr: &ipv6_hdr(skb)->saddr); |
480 | preempt_enable(); |
481 | } |
482 | } else { |
483 | skb_dst_drop(skb); |
484 | skb_dst_set(skb, dst); |
485 | } |
486 | |
487 | err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); |
488 | if (unlikely(err)) |
489 | return err; |
490 | |
491 | if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) |
492 | return NF_HOOK(pf: NFPROTO_IPV6, hook: NF_INET_LOCAL_OUT, |
493 | net: dev_net(dev: skb->dev), NULL, skb, NULL, |
494 | out: skb_dst(skb)->dev, okfn: seg6_input_finish); |
495 | |
496 | return seg6_input_finish(net: dev_net(dev: skb->dev), NULL, skb); |
497 | } |
498 | |
499 | static int seg6_input_nf(struct sk_buff *skb) |
500 | { |
501 | struct net_device *dev = skb_dst(skb)->dev; |
502 | struct net *net = dev_net(dev: skb->dev); |
503 | |
504 | switch (skb->protocol) { |
505 | case htons(ETH_P_IP): |
506 | return NF_HOOK(pf: NFPROTO_IPV4, hook: NF_INET_POST_ROUTING, net, NULL, |
507 | skb, NULL, out: dev, okfn: seg6_input_core); |
508 | case htons(ETH_P_IPV6): |
509 | return NF_HOOK(pf: NFPROTO_IPV6, hook: NF_INET_POST_ROUTING, net, NULL, |
510 | skb, NULL, out: dev, okfn: seg6_input_core); |
511 | } |
512 | |
513 | return -EINVAL; |
514 | } |
515 | |
516 | static int seg6_input(struct sk_buff *skb) |
517 | { |
518 | if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) |
519 | return seg6_input_nf(skb); |
520 | |
521 | return seg6_input_core(net: dev_net(dev: skb->dev), NULL, skb); |
522 | } |
523 | |
524 | static int seg6_output_core(struct net *net, struct sock *sk, |
525 | struct sk_buff *skb) |
526 | { |
527 | struct dst_entry *orig_dst = skb_dst(skb); |
528 | struct dst_entry *dst = NULL; |
529 | struct seg6_lwt *slwt; |
530 | int err; |
531 | |
532 | err = seg6_do_srh(skb); |
533 | if (unlikely(err)) |
534 | goto drop; |
535 | |
536 | slwt = seg6_lwt_lwtunnel(lwt: orig_dst->lwtstate); |
537 | |
538 | preempt_disable(); |
539 | dst = dst_cache_get(dst_cache: &slwt->cache); |
540 | preempt_enable(); |
541 | |
542 | if (unlikely(!dst)) { |
543 | struct ipv6hdr *hdr = ipv6_hdr(skb); |
544 | struct flowi6 fl6; |
545 | |
546 | memset(&fl6, 0, sizeof(fl6)); |
547 | fl6.daddr = hdr->daddr; |
548 | fl6.saddr = hdr->saddr; |
549 | fl6.flowlabel = ip6_flowinfo(hdr); |
550 | fl6.flowi6_mark = skb->mark; |
551 | fl6.flowi6_proto = hdr->nexthdr; |
552 | |
553 | dst = ip6_route_output(net, NULL, fl6: &fl6); |
554 | if (dst->error) { |
555 | err = dst->error; |
556 | dst_release(dst); |
557 | goto drop; |
558 | } |
559 | |
560 | preempt_disable(); |
561 | dst_cache_set_ip6(dst_cache: &slwt->cache, dst, saddr: &fl6.saddr); |
562 | preempt_enable(); |
563 | } |
564 | |
565 | skb_dst_drop(skb); |
566 | skb_dst_set(skb, dst); |
567 | |
568 | err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev)); |
569 | if (unlikely(err)) |
570 | goto drop; |
571 | |
572 | if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) |
573 | return NF_HOOK(pf: NFPROTO_IPV6, hook: NF_INET_LOCAL_OUT, net, sk, skb, |
574 | NULL, out: skb_dst(skb)->dev, okfn: dst_output); |
575 | |
576 | return dst_output(net, sk, skb); |
577 | drop: |
578 | kfree_skb(skb); |
579 | return err; |
580 | } |
581 | |
582 | static int seg6_output_nf(struct net *net, struct sock *sk, struct sk_buff *skb) |
583 | { |
584 | struct net_device *dev = skb_dst(skb)->dev; |
585 | |
586 | switch (skb->protocol) { |
587 | case htons(ETH_P_IP): |
588 | return NF_HOOK(pf: NFPROTO_IPV4, hook: NF_INET_POST_ROUTING, net, sk, skb, |
589 | NULL, out: dev, okfn: seg6_output_core); |
590 | case htons(ETH_P_IPV6): |
591 | return NF_HOOK(pf: NFPROTO_IPV6, hook: NF_INET_POST_ROUTING, net, sk, skb, |
592 | NULL, out: dev, okfn: seg6_output_core); |
593 | } |
594 | |
595 | return -EINVAL; |
596 | } |
597 | |
598 | static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb) |
599 | { |
600 | if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) |
601 | return seg6_output_nf(net, sk, skb); |
602 | |
603 | return seg6_output_core(net, sk, skb); |
604 | } |
605 | |
606 | static int seg6_build_state(struct net *net, struct nlattr *nla, |
607 | unsigned int family, const void *cfg, |
608 | struct lwtunnel_state **ts, |
609 | struct netlink_ext_ack *extack) |
610 | { |
611 | struct nlattr *tb[SEG6_IPTUNNEL_MAX + 1]; |
612 | struct seg6_iptunnel_encap *tuninfo; |
613 | struct lwtunnel_state *newts; |
614 | int tuninfo_len, min_size; |
615 | struct seg6_lwt *slwt; |
616 | int err; |
617 | |
618 | if (family != AF_INET && family != AF_INET6) |
619 | return -EINVAL; |
620 | |
621 | err = nla_parse_nested_deprecated(tb, SEG6_IPTUNNEL_MAX, nla, |
622 | policy: seg6_iptunnel_policy, extack); |
623 | |
624 | if (err < 0) |
625 | return err; |
626 | |
627 | if (!tb[SEG6_IPTUNNEL_SRH]) |
628 | return -EINVAL; |
629 | |
630 | tuninfo = nla_data(nla: tb[SEG6_IPTUNNEL_SRH]); |
631 | tuninfo_len = nla_len(nla: tb[SEG6_IPTUNNEL_SRH]); |
632 | |
633 | /* tuninfo must contain at least the iptunnel encap structure, |
634 | * the SRH and one segment |
635 | */ |
636 | min_size = sizeof(*tuninfo) + sizeof(struct ipv6_sr_hdr) + |
637 | sizeof(struct in6_addr); |
638 | if (tuninfo_len < min_size) |
639 | return -EINVAL; |
640 | |
641 | switch (tuninfo->mode) { |
642 | case SEG6_IPTUN_MODE_INLINE: |
643 | if (family != AF_INET6) |
644 | return -EINVAL; |
645 | |
646 | break; |
647 | case SEG6_IPTUN_MODE_ENCAP: |
648 | break; |
649 | case SEG6_IPTUN_MODE_L2ENCAP: |
650 | break; |
651 | case SEG6_IPTUN_MODE_ENCAP_RED: |
652 | break; |
653 | case SEG6_IPTUN_MODE_L2ENCAP_RED: |
654 | break; |
655 | default: |
656 | return -EINVAL; |
657 | } |
658 | |
659 | /* verify that SRH is consistent */ |
660 | if (!seg6_validate_srh(srh: tuninfo->srh, len: tuninfo_len - sizeof(*tuninfo), reduced: false)) |
661 | return -EINVAL; |
662 | |
663 | newts = lwtunnel_state_alloc(hdr_len: tuninfo_len + sizeof(*slwt)); |
664 | if (!newts) |
665 | return -ENOMEM; |
666 | |
667 | slwt = seg6_lwt_lwtunnel(lwt: newts); |
668 | |
669 | err = dst_cache_init(dst_cache: &slwt->cache, GFP_ATOMIC); |
670 | if (err) { |
671 | kfree(objp: newts); |
672 | return err; |
673 | } |
674 | |
675 | memcpy(&slwt->tuninfo, tuninfo, tuninfo_len); |
676 | |
677 | newts->type = LWTUNNEL_ENCAP_SEG6; |
678 | newts->flags |= LWTUNNEL_STATE_INPUT_REDIRECT; |
679 | |
680 | if (tuninfo->mode != SEG6_IPTUN_MODE_L2ENCAP) |
681 | newts->flags |= LWTUNNEL_STATE_OUTPUT_REDIRECT; |
682 | |
683 | newts->headroom = seg6_lwt_headroom(tuninfo); |
684 | |
685 | *ts = newts; |
686 | |
687 | return 0; |
688 | } |
689 | |
690 | static void seg6_destroy_state(struct lwtunnel_state *lwt) |
691 | { |
692 | dst_cache_destroy(dst_cache: &seg6_lwt_lwtunnel(lwt)->cache); |
693 | } |
694 | |
695 | static int seg6_fill_encap_info(struct sk_buff *skb, |
696 | struct lwtunnel_state *lwtstate) |
697 | { |
698 | struct seg6_iptunnel_encap *tuninfo = seg6_encap_lwtunnel(lwt: lwtstate); |
699 | |
700 | if (nla_put_srh(skb, attrtype: SEG6_IPTUNNEL_SRH, tuninfo)) |
701 | return -EMSGSIZE; |
702 | |
703 | return 0; |
704 | } |
705 | |
706 | static int seg6_encap_nlsize(struct lwtunnel_state *lwtstate) |
707 | { |
708 | struct seg6_iptunnel_encap *tuninfo = seg6_encap_lwtunnel(lwt: lwtstate); |
709 | |
710 | return nla_total_size(SEG6_IPTUN_ENCAP_SIZE(tuninfo)); |
711 | } |
712 | |
713 | static int seg6_encap_cmp(struct lwtunnel_state *a, struct lwtunnel_state *b) |
714 | { |
715 | struct seg6_iptunnel_encap *a_hdr = seg6_encap_lwtunnel(lwt: a); |
716 | struct seg6_iptunnel_encap *b_hdr = seg6_encap_lwtunnel(lwt: b); |
717 | int len = SEG6_IPTUN_ENCAP_SIZE(a_hdr); |
718 | |
719 | if (len != SEG6_IPTUN_ENCAP_SIZE(b_hdr)) |
720 | return 1; |
721 | |
722 | return memcmp(p: a_hdr, q: b_hdr, size: len); |
723 | } |
724 | |
725 | static const struct lwtunnel_encap_ops seg6_iptun_ops = { |
726 | .build_state = seg6_build_state, |
727 | .destroy_state = seg6_destroy_state, |
728 | .output = seg6_output, |
729 | .input = seg6_input, |
730 | .fill_encap = seg6_fill_encap_info, |
731 | .get_encap_size = seg6_encap_nlsize, |
732 | .cmp_encap = seg6_encap_cmp, |
733 | .owner = THIS_MODULE, |
734 | }; |
735 | |
736 | int __init seg6_iptunnel_init(void) |
737 | { |
738 | return lwtunnel_encap_add_ops(op: &seg6_iptun_ops, num: LWTUNNEL_ENCAP_SEG6); |
739 | } |
740 | |
741 | void seg6_iptunnel_exit(void) |
742 | { |
743 | lwtunnel_encap_del_ops(op: &seg6_iptun_ops, num: LWTUNNEL_ENCAP_SEG6); |
744 | } |
745 | |