seg6_iptunnel.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * SR-IPv6 implementation
  4. *
  5. * Author:
  6. * David Lebrun <david.lebrun@uclouvain.be>
  7. */
  8. #include <linux/types.h>
  9. #include <linux/skbuff.h>
  10. #include <linux/net.h>
  11. #include <linux/module.h>
  12. #include <net/ip.h>
  13. #include <net/ip_tunnels.h>
  14. #include <net/lwtunnel.h>
  15. #include <net/netevent.h>
  16. #include <net/netns/generic.h>
  17. #include <net/ip6_fib.h>
  18. #include <net/route.h>
  19. #include <net/seg6.h>
  20. #include <linux/seg6.h>
  21. #include <linux/seg6_iptunnel.h>
  22. #include <net/addrconf.h>
  23. #include <net/ip6_route.h>
  24. #include <net/dst_cache.h>
  25. #ifdef CONFIG_IPV6_SEG6_HMAC
  26. #include <net/seg6_hmac.h>
  27. #endif
  28. static size_t seg6_lwt_headroom(struct seg6_iptunnel_encap *tuninfo)
  29. {
  30. int head = 0;
  31. switch (tuninfo->mode) {
  32. case SEG6_IPTUN_MODE_INLINE:
  33. break;
  34. case SEG6_IPTUN_MODE_ENCAP:
  35. head = sizeof(struct ipv6hdr);
  36. break;
  37. case SEG6_IPTUN_MODE_L2ENCAP:
  38. return 0;
  39. }
  40. return ((tuninfo->srh->hdrlen + 1) << 3) + head;
  41. }
  42. struct seg6_lwt {
  43. struct dst_cache cache;
  44. struct seg6_iptunnel_encap tuninfo[];
  45. };
  46. static inline struct seg6_lwt *seg6_lwt_lwtunnel(struct lwtunnel_state *lwt)
  47. {
  48. return (struct seg6_lwt *)lwt->data;
  49. }
  50. static inline struct seg6_iptunnel_encap *
  51. seg6_encap_lwtunnel(struct lwtunnel_state *lwt)
  52. {
  53. return seg6_lwt_lwtunnel(lwt)->tuninfo;
  54. }
  55. static const struct nla_policy seg6_iptunnel_policy[SEG6_IPTUNNEL_MAX + 1] = {
  56. [SEG6_IPTUNNEL_SRH] = { .type = NLA_BINARY },
  57. };
  58. static int nla_put_srh(struct sk_buff *skb, int attrtype,
  59. struct seg6_iptunnel_encap *tuninfo)
  60. {
  61. struct seg6_iptunnel_encap *data;
  62. struct nlattr *nla;
  63. int len;
  64. len = SEG6_IPTUN_ENCAP_SIZE(tuninfo);
  65. nla = nla_reserve(skb, attrtype, len);
  66. if (!nla)
  67. return -EMSGSIZE;
  68. data = nla_data(nla);
  69. memcpy(data, tuninfo, len);
  70. return 0;
  71. }
  72. static void set_tun_src(struct net *net, struct net_device *dev,
  73. struct in6_addr *daddr, struct in6_addr *saddr)
  74. {
  75. struct seg6_pernet_data *sdata = seg6_pernet(net);
  76. struct in6_addr *tun_src;
  77. rcu_read_lock();
  78. tun_src = rcu_dereference(sdata->tun_src);
  79. if (!ipv6_addr_any(tun_src)) {
  80. memcpy(saddr, tun_src, sizeof(struct in6_addr));
  81. } else {
  82. ipv6_dev_get_saddr(net, dev, daddr, IPV6_PREFER_SRC_PUBLIC,
  83. saddr);
  84. }
  85. rcu_read_unlock();
  86. }
  87. /* Compute flowlabel for outer IPv6 header */
  88. static __be32 seg6_make_flowlabel(struct net *net, struct sk_buff *skb,
  89. struct ipv6hdr *inner_hdr)
  90. {
  91. int do_flowlabel = net->ipv6.sysctl.seg6_flowlabel;
  92. __be32 flowlabel = 0;
  93. u32 hash;
  94. if (do_flowlabel > 0) {
  95. hash = skb_get_hash(skb);
  96. hash = rol32(hash, 16);
  97. flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
  98. } else if (!do_flowlabel && skb->protocol == htons(ETH_P_IPV6)) {
  99. flowlabel = ip6_flowlabel(inner_hdr);
  100. }
  101. return flowlabel;
  102. }
  103. /* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */
  104. int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
  105. {
  106. struct dst_entry *dst = skb_dst(skb);
  107. struct net *net = dev_net(dst->dev);
  108. struct ipv6hdr *hdr, *inner_hdr;
  109. struct ipv6_sr_hdr *isrh;
  110. int hdrlen, tot_len, err;
  111. __be32 flowlabel;
  112. hdrlen = (osrh->hdrlen + 1) << 3;
  113. tot_len = hdrlen + sizeof(*hdr);
  114. err = skb_cow_head(skb, tot_len + skb->mac_len);
  115. if (unlikely(err))
  116. return err;
  117. inner_hdr = ipv6_hdr(skb);
  118. flowlabel = seg6_make_flowlabel(net, skb, inner_hdr);
  119. skb_push(skb, tot_len);
  120. skb_reset_network_header(skb);
  121. skb_mac_header_rebuild(skb);
  122. hdr = ipv6_hdr(skb);
  123. /* inherit tc, flowlabel and hlim
  124. * hlim will be decremented in ip6_forward() afterwards and
  125. * decapsulation will overwrite inner hlim with outer hlim
  126. */
  127. if (skb->protocol == htons(ETH_P_IPV6)) {
  128. ip6_flow_hdr(hdr, ip6_tclass(ip6_flowinfo(inner_hdr)),
  129. flowlabel);
  130. hdr->hop_limit = inner_hdr->hop_limit;
  131. } else {
  132. ip6_flow_hdr(hdr, 0, flowlabel);
  133. hdr->hop_limit = ip6_dst_hoplimit(skb_dst(skb));
  134. memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
  135. /* the control block has been erased, so we have to set the
  136. * iif once again.
  137. * We read the receiving interface index directly from the
  138. * skb->skb_iif as it is done in the IPv4 receiving path (i.e.:
  139. * ip_rcv_core(...)).
  140. */
  141. IP6CB(skb)->iif = skb->skb_iif;
  142. }
  143. hdr->nexthdr = NEXTHDR_ROUTING;
  144. isrh = (void *)hdr + sizeof(*hdr);
  145. memcpy(isrh, osrh, hdrlen);
  146. isrh->nexthdr = proto;
  147. hdr->daddr = isrh->segments[isrh->first_segment];
  148. set_tun_src(net, dst->dev, &hdr->daddr, &hdr->saddr);
  149. #ifdef CONFIG_IPV6_SEG6_HMAC
  150. if (sr_has_hmac(isrh)) {
  151. err = seg6_push_hmac(net, &hdr->saddr, isrh);
  152. if (unlikely(err))
  153. return err;
  154. }
  155. #endif
  156. skb_postpush_rcsum(skb, hdr, tot_len);
  157. return 0;
  158. }
  159. EXPORT_SYMBOL_GPL(seg6_do_srh_encap);
  160. /* insert an SRH within an IPv6 packet, just after the IPv6 header */
  161. int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh)
  162. {
  163. struct ipv6hdr *hdr, *oldhdr;
  164. struct ipv6_sr_hdr *isrh;
  165. int hdrlen, err;
  166. hdrlen = (osrh->hdrlen + 1) << 3;
  167. err = skb_cow_head(skb, hdrlen + skb->mac_len);
  168. if (unlikely(err))
  169. return err;
  170. oldhdr = ipv6_hdr(skb);
  171. skb_pull(skb, sizeof(struct ipv6hdr));
  172. skb_postpull_rcsum(skb, skb_network_header(skb),
  173. sizeof(struct ipv6hdr));
  174. skb_push(skb, sizeof(struct ipv6hdr) + hdrlen);
  175. skb_reset_network_header(skb);
  176. skb_mac_header_rebuild(skb);
  177. hdr = ipv6_hdr(skb);
  178. memmove(hdr, oldhdr, sizeof(*hdr));
  179. isrh = (void *)hdr + sizeof(*hdr);
  180. memcpy(isrh, osrh, hdrlen);
  181. isrh->nexthdr = hdr->nexthdr;
  182. hdr->nexthdr = NEXTHDR_ROUTING;
  183. isrh->segments[0] = hdr->daddr;
  184. hdr->daddr = isrh->segments[isrh->first_segment];
  185. #ifdef CONFIG_IPV6_SEG6_HMAC
  186. if (sr_has_hmac(isrh)) {
  187. struct net *net = dev_net(skb_dst(skb)->dev);
  188. err = seg6_push_hmac(net, &hdr->saddr, isrh);
  189. if (unlikely(err))
  190. return err;
  191. }
  192. #endif
  193. skb_postpush_rcsum(skb, hdr, sizeof(struct ipv6hdr) + hdrlen);
  194. return 0;
  195. }
  196. EXPORT_SYMBOL_GPL(seg6_do_srh_inline);
  197. static int seg6_do_srh(struct sk_buff *skb)
  198. {
  199. struct dst_entry *dst = skb_dst(skb);
  200. struct seg6_iptunnel_encap *tinfo;
  201. int proto, err = 0;
  202. tinfo = seg6_encap_lwtunnel(dst->lwtstate);
  203. switch (tinfo->mode) {
  204. case SEG6_IPTUN_MODE_INLINE:
  205. if (skb->protocol != htons(ETH_P_IPV6))
  206. return -EINVAL;
  207. err = seg6_do_srh_inline(skb, tinfo->srh);
  208. if (err)
  209. return err;
  210. break;
  211. case SEG6_IPTUN_MODE_ENCAP:
  212. err = iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6);
  213. if (err)
  214. return err;
  215. if (skb->protocol == htons(ETH_P_IPV6))
  216. proto = IPPROTO_IPV6;
  217. else if (skb->protocol == htons(ETH_P_IP))
  218. proto = IPPROTO_IPIP;
  219. else
  220. return -EINVAL;
  221. err = seg6_do_srh_encap(skb, tinfo->srh, proto);
  222. if (err)
  223. return err;
  224. skb_set_inner_transport_header(skb, skb_transport_offset(skb));
  225. skb_set_inner_protocol(skb, skb->protocol);
  226. skb->protocol = htons(ETH_P_IPV6);
  227. break;
  228. case SEG6_IPTUN_MODE_L2ENCAP:
  229. if (!skb_mac_header_was_set(skb))
  230. return -EINVAL;
  231. if (pskb_expand_head(skb, skb->mac_len, 0, GFP_ATOMIC) < 0)
  232. return -ENOMEM;
  233. skb_mac_header_rebuild(skb);
  234. skb_push(skb, skb->mac_len);
  235. err = seg6_do_srh_encap(skb, tinfo->srh, IPPROTO_ETHERNET);
  236. if (err)
  237. return err;
  238. skb->protocol = htons(ETH_P_IPV6);
  239. break;
  240. }
  241. ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
  242. skb_set_transport_header(skb, sizeof(struct ipv6hdr));
  243. return 0;
  244. }
  245. static int seg6_input(struct sk_buff *skb)
  246. {
  247. struct dst_entry *orig_dst = skb_dst(skb);
  248. struct dst_entry *dst = NULL;
  249. struct seg6_lwt *slwt;
  250. int err;
  251. err = seg6_do_srh(skb);
  252. if (unlikely(err)) {
  253. kfree_skb(skb);
  254. return err;
  255. }
  256. slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
  257. preempt_disable();
  258. dst = dst_cache_get(&slwt->cache);
  259. preempt_enable();
  260. skb_dst_drop(skb);
  261. if (!dst) {
  262. ip6_route_input(skb);
  263. dst = skb_dst(skb);
  264. if (!dst->error) {
  265. preempt_disable();
  266. dst_cache_set_ip6(&slwt->cache, dst,
  267. &ipv6_hdr(skb)->saddr);
  268. preempt_enable();
  269. }
  270. } else {
  271. skb_dst_set(skb, dst);
  272. }
  273. err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
  274. if (unlikely(err))
  275. return err;
  276. return dst_input(skb);
  277. }
  278. static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
  279. {
  280. struct dst_entry *orig_dst = skb_dst(skb);
  281. struct dst_entry *dst = NULL;
  282. struct seg6_lwt *slwt;
  283. int err = -EINVAL;
  284. err = seg6_do_srh(skb);
  285. if (unlikely(err))
  286. goto drop;
  287. slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
  288. preempt_disable();
  289. dst = dst_cache_get(&slwt->cache);
  290. preempt_enable();
  291. if (unlikely(!dst)) {
  292. struct ipv6hdr *hdr = ipv6_hdr(skb);
  293. struct flowi6 fl6;
  294. memset(&fl6, 0, sizeof(fl6));
  295. fl6.daddr = hdr->daddr;
  296. fl6.saddr = hdr->saddr;
  297. fl6.flowlabel = ip6_flowinfo(hdr);
  298. fl6.flowi6_mark = skb->mark;
  299. fl6.flowi6_proto = hdr->nexthdr;
  300. dst = ip6_route_output(net, NULL, &fl6);
  301. if (dst->error) {
  302. err = dst->error;
  303. dst_release(dst);
  304. goto drop;
  305. }
  306. preempt_disable();
  307. dst_cache_set_ip6(&slwt->cache, dst, &fl6.saddr);
  308. preempt_enable();
  309. }
  310. skb_dst_drop(skb);
  311. skb_dst_set(skb, dst);
  312. err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
  313. if (unlikely(err))
  314. goto drop;
  315. return dst_output(net, sk, skb);
  316. drop:
  317. kfree_skb(skb);
  318. return err;
  319. }
  320. static int seg6_build_state(struct net *net, struct nlattr *nla,
  321. unsigned int family, const void *cfg,
  322. struct lwtunnel_state **ts,
  323. struct netlink_ext_ack *extack)
  324. {
  325. struct nlattr *tb[SEG6_IPTUNNEL_MAX + 1];
  326. struct seg6_iptunnel_encap *tuninfo;
  327. struct lwtunnel_state *newts;
  328. int tuninfo_len, min_size;
  329. struct seg6_lwt *slwt;
  330. int err;
  331. if (family != AF_INET && family != AF_INET6)
  332. return -EINVAL;
  333. err = nla_parse_nested_deprecated(tb, SEG6_IPTUNNEL_MAX, nla,
  334. seg6_iptunnel_policy, extack);
  335. if (err < 0)
  336. return err;
  337. if (!tb[SEG6_IPTUNNEL_SRH])
  338. return -EINVAL;
  339. tuninfo = nla_data(tb[SEG6_IPTUNNEL_SRH]);
  340. tuninfo_len = nla_len(tb[SEG6_IPTUNNEL_SRH]);
  341. /* tuninfo must contain at least the iptunnel encap structure,
  342. * the SRH and one segment
  343. */
  344. min_size = sizeof(*tuninfo) + sizeof(struct ipv6_sr_hdr) +
  345. sizeof(struct in6_addr);
  346. if (tuninfo_len < min_size)
  347. return -EINVAL;
  348. switch (tuninfo->mode) {
  349. case SEG6_IPTUN_MODE_INLINE:
  350. if (family != AF_INET6)
  351. return -EINVAL;
  352. break;
  353. case SEG6_IPTUN_MODE_ENCAP:
  354. break;
  355. case SEG6_IPTUN_MODE_L2ENCAP:
  356. break;
  357. default:
  358. return -EINVAL;
  359. }
  360. /* verify that SRH is consistent */
  361. if (!seg6_validate_srh(tuninfo->srh, tuninfo_len - sizeof(*tuninfo), false))
  362. return -EINVAL;
  363. newts = lwtunnel_state_alloc(tuninfo_len + sizeof(*slwt));
  364. if (!newts)
  365. return -ENOMEM;
  366. slwt = seg6_lwt_lwtunnel(newts);
  367. err = dst_cache_init(&slwt->cache, GFP_ATOMIC);
  368. if (err) {
  369. kfree(newts);
  370. return err;
  371. }
  372. memcpy(&slwt->tuninfo, tuninfo, tuninfo_len);
  373. newts->type = LWTUNNEL_ENCAP_SEG6;
  374. newts->flags |= LWTUNNEL_STATE_INPUT_REDIRECT;
  375. if (tuninfo->mode != SEG6_IPTUN_MODE_L2ENCAP)
  376. newts->flags |= LWTUNNEL_STATE_OUTPUT_REDIRECT;
  377. newts->headroom = seg6_lwt_headroom(tuninfo);
  378. *ts = newts;
  379. return 0;
  380. }
  381. static void seg6_destroy_state(struct lwtunnel_state *lwt)
  382. {
  383. dst_cache_destroy(&seg6_lwt_lwtunnel(lwt)->cache);
  384. }
  385. static int seg6_fill_encap_info(struct sk_buff *skb,
  386. struct lwtunnel_state *lwtstate)
  387. {
  388. struct seg6_iptunnel_encap *tuninfo = seg6_encap_lwtunnel(lwtstate);
  389. if (nla_put_srh(skb, SEG6_IPTUNNEL_SRH, tuninfo))
  390. return -EMSGSIZE;
  391. return 0;
  392. }
  393. static int seg6_encap_nlsize(struct lwtunnel_state *lwtstate)
  394. {
  395. struct seg6_iptunnel_encap *tuninfo = seg6_encap_lwtunnel(lwtstate);
  396. return nla_total_size(SEG6_IPTUN_ENCAP_SIZE(tuninfo));
  397. }
  398. static int seg6_encap_cmp(struct lwtunnel_state *a, struct lwtunnel_state *b)
  399. {
  400. struct seg6_iptunnel_encap *a_hdr = seg6_encap_lwtunnel(a);
  401. struct seg6_iptunnel_encap *b_hdr = seg6_encap_lwtunnel(b);
  402. int len = SEG6_IPTUN_ENCAP_SIZE(a_hdr);
  403. if (len != SEG6_IPTUN_ENCAP_SIZE(b_hdr))
  404. return 1;
  405. return memcmp(a_hdr, b_hdr, len);
  406. }
  407. static const struct lwtunnel_encap_ops seg6_iptun_ops = {
  408. .build_state = seg6_build_state,
  409. .destroy_state = seg6_destroy_state,
  410. .output = seg6_output,
  411. .input = seg6_input,
  412. .fill_encap = seg6_fill_encap_info,
  413. .get_encap_size = seg6_encap_nlsize,
  414. .cmp_encap = seg6_encap_cmp,
  415. .owner = THIS_MODULE,
  416. };
  417. int __init seg6_iptunnel_init(void)
  418. {
  419. return lwtunnel_encap_add_ops(&seg6_iptun_ops, LWTUNNEL_ENCAP_SEG6);
  420. }
  421. void seg6_iptunnel_exit(void)
  422. {
  423. lwtunnel_encap_del_ops(&seg6_iptun_ops, LWTUNNEL_ENCAP_SEG6);
  424. }