1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (C) 2013-2020  B.A.T.M.A.N. contributors:
3  *
4  * Martin Hundebøll <martin@hundeboll.net>
5  */
6 
7 #include "fragmentation.h"
8 #include "main.h"
9 
10 #include <linux/atomic.h>
11 #include <linux/byteorder/generic.h>
12 #include <linux/errno.h>
13 #include <linux/etherdevice.h>
14 #include <linux/gfp.h>
15 #include <linux/if_ether.h>
16 #include <linux/jiffies.h>
17 #include <linux/kernel.h>
18 #include <linux/lockdep.h>
19 #include <linux/netdevice.h>
20 #include <linux/skbuff.h>
21 #include <linux/slab.h>
22 #include <linux/spinlock.h>
23 #include <linux/string.h>
24 #include <uapi/linux/batadv_packet.h>
25 
26 #include "hard-interface.h"
27 #include "originator.h"
28 #include "routing.h"
29 #include "send.h"
30 #include "soft-interface.h"
31 
32 /**
33  * batadv_frag_clear_chain() - delete entries in the fragment buffer chain
34  * @head: head of chain with entries.
35  * @dropped: whether the chain is cleared because all fragments are dropped
36  *
37  * Free fragments in the passed hlist. Should be called with appropriate lock.
38  */
39 static void batadv_frag_clear_chain(struct hlist_head *head, bool dropped)
40 {
41 	struct batadv_frag_list_entry *entry;
42 	struct hlist_node *node;
43 
44 	hlist_for_each_entry_safe(entry, node, head, list) {
45 		hlist_del(&entry->list);
46 
47 		if (dropped)
48 			kfree_skb(entry->skb);
49 		else
50 			consume_skb(entry->skb);
51 
52 		kfree(entry);
53 	}
54 }
55 
56 /**
57  * batadv_frag_purge_orig() - free fragments associated to an orig
58  * @orig_node: originator to free fragments from
59  * @check_cb: optional function to tell if an entry should be purged
60  */
61 void batadv_frag_purge_orig(struct batadv_orig_node *orig_node,
62 			    bool (*check_cb)(struct batadv_frag_table_entry *))
63 {
64 	struct batadv_frag_table_entry *chain;
65 	u8 i;
66 
67 	for (i = 0; i < BATADV_FRAG_BUFFER_COUNT; i++) {
68 		chain = &orig_node->fragments[i];
69 		spin_lock_bh(&chain->lock);
70 
71 		if (!check_cb || check_cb(chain)) {
72 			batadv_frag_clear_chain(&chain->fragment_list, true);
73 			chain->size = 0;
74 		}
75 
76 		spin_unlock_bh(&chain->lock);
77 	}
78 }
79 
80 /**
81  * batadv_frag_size_limit() - maximum possible size of packet to be fragmented
82  *
83  * Return: the maximum size of payload that can be fragmented.
84  */
85 static int batadv_frag_size_limit(void)
86 {
87 	int limit = BATADV_FRAG_MAX_FRAG_SIZE;
88 
89 	limit -= sizeof(struct batadv_frag_packet);
90 	limit *= BATADV_FRAG_MAX_FRAGMENTS;
91 
92 	return limit;
93 }
94 
95 /**
96  * batadv_frag_init_chain() - check and prepare fragment chain for new fragment
97  * @chain: chain in fragments table to init
98  * @seqno: sequence number of the received fragment
99  *
100  * Make chain ready for a fragment with sequence number "seqno". Delete existing
101  * entries if they have an "old" sequence number.
102  *
103  * Caller must hold chain->lock.
104  *
105  * Return: true if chain is empty and the caller can just insert the new
106  * fragment without searching for the right position.
107  */
108 static bool batadv_frag_init_chain(struct batadv_frag_table_entry *chain,
109 				   u16 seqno)
110 {
111 	lockdep_assert_held(&chain->lock);
112 
113 	if (chain->seqno == seqno)
114 		return false;
115 
116 	if (!hlist_empty(&chain->fragment_list))
117 		batadv_frag_clear_chain(&chain->fragment_list, true);
118 
119 	chain->size = 0;
120 	chain->seqno = seqno;
121 
122 	return true;
123 }
124 
125 /**
126  * batadv_frag_insert_packet() - insert a fragment into a fragment chain
127  * @orig_node: originator that the fragment was received from
128  * @skb: skb to insert
129  * @chain_out: list head to attach complete chains of fragments to
130  *
131  * Insert a new fragment into the reverse ordered chain in the right table
132  * entry. The hash table entry is cleared if "old" fragments exist in it.
133  *
134  * Return: true if skb is buffered, false on error. If the chain has all the
135  * fragments needed to merge the packet, the chain is moved to the passed head
136  * to avoid locking the chain in the table.
137  */
138 static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
139 				      struct sk_buff *skb,
140 				      struct hlist_head *chain_out)
141 {
142 	struct batadv_frag_table_entry *chain;
143 	struct batadv_frag_list_entry *frag_entry_new = NULL, *frag_entry_curr;
144 	struct batadv_frag_list_entry *frag_entry_last = NULL;
145 	struct batadv_frag_packet *frag_packet;
146 	u8 bucket;
147 	u16 seqno, hdr_size = sizeof(struct batadv_frag_packet);
148 	bool ret = false;
149 
150 	/* Linearize packet to avoid linearizing 16 packets in a row when doing
151 	 * the later merge. Non-linear merge should be added to remove this
152 	 * linearization.
153 	 */
154 	if (skb_linearize(skb) < 0)
155 		goto err;
156 
157 	frag_packet = (struct batadv_frag_packet *)skb->data;
158 	seqno = ntohs(frag_packet->seqno);
159 	bucket = seqno % BATADV_FRAG_BUFFER_COUNT;
160 
161 	frag_entry_new = kmalloc(sizeof(*frag_entry_new), GFP_ATOMIC);
162 	if (!frag_entry_new)
163 		goto err;
164 
165 	frag_entry_new->skb = skb;
166 	frag_entry_new->no = frag_packet->no;
167 
168 	/* Select entry in the "chain table" and delete any prior fragments
169 	 * with another sequence number. batadv_frag_init_chain() returns true,
170 	 * if the list is empty at return.
171 	 */
172 	chain = &orig_node->fragments[bucket];
173 	spin_lock_bh(&chain->lock);
174 	if (batadv_frag_init_chain(chain, seqno)) {
175 		hlist_add_head(&frag_entry_new->list, &chain->fragment_list);
176 		chain->size = skb->len - hdr_size;
177 		chain->timestamp = jiffies;
178 		chain->total_size = ntohs(frag_packet->total_size);
179 		ret = true;
180 		goto out;
181 	}
182 
183 	/* Find the position for the new fragment. */
184 	hlist_for_each_entry(frag_entry_curr, &chain->fragment_list, list) {
185 		/* Drop packet if fragment already exists. */
186 		if (frag_entry_curr->no == frag_entry_new->no)
187 			goto err_unlock;
188 
189 		/* Order fragments from highest to lowest. */
190 		if (frag_entry_curr->no < frag_entry_new->no) {
191 			hlist_add_before(&frag_entry_new->list,
192 					 &frag_entry_curr->list);
193 			chain->size += skb->len - hdr_size;
194 			chain->timestamp = jiffies;
195 			ret = true;
196 			goto out;
197 		}
198 
199 		/* store current entry because it could be the last in list */
200 		frag_entry_last = frag_entry_curr;
201 	}
202 
203 	/* Reached the end of the list, so insert after 'frag_entry_last'. */
204 	if (likely(frag_entry_last)) {
205 		hlist_add_behind(&frag_entry_new->list, &frag_entry_last->list);
206 		chain->size += skb->len - hdr_size;
207 		chain->timestamp = jiffies;
208 		ret = true;
209 	}
210 
211 out:
212 	if (chain->size > batadv_frag_size_limit() ||
213 	    chain->total_size != ntohs(frag_packet->total_size) ||
214 	    chain->total_size > batadv_frag_size_limit()) {
215 		/* Clear chain if total size of either the list or the packet
216 		 * exceeds the maximum size of one merged packet. Don't allow
217 		 * packets to have different total_size.
218 		 */
219 		batadv_frag_clear_chain(&chain->fragment_list, true);
220 		chain->size = 0;
221 	} else if (ntohs(frag_packet->total_size) == chain->size) {
222 		/* All fragments received. Hand over chain to caller. */
223 		hlist_move_list(&chain->fragment_list, chain_out);
224 		chain->size = 0;
225 	}
226 
227 err_unlock:
228 	spin_unlock_bh(&chain->lock);
229 
230 err:
231 	if (!ret) {
232 		kfree(frag_entry_new);
233 		kfree_skb(skb);
234 	}
235 
236 	return ret;
237 }
238 
239 /**
240  * batadv_frag_merge_packets() - merge a chain of fragments
241  * @chain: head of chain with fragments
242  *
243  * Expand the first skb in the chain and copy the content of the remaining
244  * skb's into the expanded one. After doing so, clear the chain.
245  *
246  * Return: the merged skb or NULL on error.
247  */
248 static struct sk_buff *
249 batadv_frag_merge_packets(struct hlist_head *chain)
250 {
251 	struct batadv_frag_packet *packet;
252 	struct batadv_frag_list_entry *entry;
253 	struct sk_buff *skb_out;
254 	int size, hdr_size = sizeof(struct batadv_frag_packet);
255 	bool dropped = false;
256 
257 	/* Remove first entry, as this is the destination for the rest of the
258 	 * fragments.
259 	 */
260 	entry = hlist_entry(chain->first, struct batadv_frag_list_entry, list);
261 	hlist_del(&entry->list);
262 	skb_out = entry->skb;
263 	kfree(entry);
264 
265 	packet = (struct batadv_frag_packet *)skb_out->data;
266 	size = ntohs(packet->total_size) + hdr_size;
267 
268 	/* Make room for the rest of the fragments. */
269 	if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
270 		kfree_skb(skb_out);
271 		skb_out = NULL;
272 		dropped = true;
273 		goto free;
274 	}
275 
276 	/* Move the existing MAC header to just before the payload. (Override
277 	 * the fragment header.)
278 	 */
279 	skb_pull(skb_out, hdr_size);
280 	skb_out->ip_summed = CHECKSUM_NONE;
281 	memmove(skb_out->data - ETH_HLEN, skb_mac_header(skb_out), ETH_HLEN);
282 	skb_set_mac_header(skb_out, -ETH_HLEN);
283 	skb_reset_network_header(skb_out);
284 	skb_reset_transport_header(skb_out);
285 
286 	/* Copy the payload of the each fragment into the last skb */
287 	hlist_for_each_entry(entry, chain, list) {
288 		size = entry->skb->len - hdr_size;
289 		skb_put_data(skb_out, entry->skb->data + hdr_size, size);
290 	}
291 
292 free:
293 	/* Locking is not needed, because 'chain' is not part of any orig. */
294 	batadv_frag_clear_chain(chain, dropped);
295 	return skb_out;
296 }
297 
298 /**
299  * batadv_frag_skb_buffer() - buffer fragment for later merge
300  * @skb: skb to buffer
301  * @orig_node_src: originator that the skb is received from
302  *
303  * Add fragment to buffer and merge fragments if possible.
304  *
305  * There are three possible outcomes: 1) Packet is merged: Return true and
306  * set *skb to merged packet; 2) Packet is buffered: Return true and set *skb
307  * to NULL; 3) Error: Return false and free skb.
308  *
309  * Return: true when the packet is merged or buffered, false when skb is not not
310  * used.
311  */
312 bool batadv_frag_skb_buffer(struct sk_buff **skb,
313 			    struct batadv_orig_node *orig_node_src)
314 {
315 	struct sk_buff *skb_out = NULL;
316 	struct hlist_head head = HLIST_HEAD_INIT;
317 	bool ret = false;
318 
319 	/* Add packet to buffer and table entry if merge is possible. */
320 	if (!batadv_frag_insert_packet(orig_node_src, *skb, &head))
321 		goto out_err;
322 
323 	/* Leave if more fragments are needed to merge. */
324 	if (hlist_empty(&head))
325 		goto out;
326 
327 	skb_out = batadv_frag_merge_packets(&head);
328 	if (!skb_out)
329 		goto out_err;
330 
331 out:
332 	ret = true;
333 out_err:
334 	*skb = skb_out;
335 	return ret;
336 }
337 
338 /**
339  * batadv_frag_skb_fwd() - forward fragments that would exceed MTU when merged
340  * @skb: skb to forward
341  * @recv_if: interface that the skb is received on
342  * @orig_node_src: originator that the skb is received from
343  *
344  * Look up the next-hop of the fragments payload and check if the merged packet
345  * will exceed the MTU towards the next-hop. If so, the fragment is forwarded
346  * without merging it.
347  *
348  * Return: true if the fragment is consumed/forwarded, false otherwise.
349  */
350 bool batadv_frag_skb_fwd(struct sk_buff *skb,
351 			 struct batadv_hard_iface *recv_if,
352 			 struct batadv_orig_node *orig_node_src)
353 {
354 	struct batadv_priv *bat_priv = netdev_priv(recv_if->soft_iface);
355 	struct batadv_orig_node *orig_node_dst;
356 	struct batadv_neigh_node *neigh_node = NULL;
357 	struct batadv_frag_packet *packet;
358 	u16 total_size;
359 	bool ret = false;
360 
361 	packet = (struct batadv_frag_packet *)skb->data;
362 	orig_node_dst = batadv_orig_hash_find(bat_priv, packet->dest);
363 	if (!orig_node_dst)
364 		goto out;
365 
366 	neigh_node = batadv_find_router(bat_priv, orig_node_dst, recv_if);
367 	if (!neigh_node)
368 		goto out;
369 
370 	/* Forward the fragment, if the merged packet would be too big to
371 	 * be assembled.
372 	 */
373 	total_size = ntohs(packet->total_size);
374 	if (total_size > neigh_node->if_incoming->net_dev->mtu) {
375 		batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_FWD);
376 		batadv_add_counter(bat_priv, BATADV_CNT_FRAG_FWD_BYTES,
377 				   skb->len + ETH_HLEN);
378 
379 		packet->ttl--;
380 		batadv_send_unicast_skb(skb, neigh_node);
381 		ret = true;
382 	}
383 
384 out:
385 	if (orig_node_dst)
386 		batadv_orig_node_put(orig_node_dst);
387 	if (neigh_node)
388 		batadv_neigh_node_put(neigh_node);
389 	return ret;
390 }
391 
392 /**
393  * batadv_frag_create() - create a fragment from skb
394  * @skb: skb to create fragment from
395  * @frag_head: header to use in new fragment
396  * @fragment_size: size of new fragment
397  *
398  * Split the passed skb into two fragments: A new one with size matching the
399  * passed mtu and the old one with the rest. The new skb contains data from the
400  * tail of the old skb.
401  *
402  * Return: the new fragment, NULL on error.
403  */
404 static struct sk_buff *batadv_frag_create(struct sk_buff *skb,
405 					  struct batadv_frag_packet *frag_head,
406 					  unsigned int fragment_size)
407 {
408 	struct sk_buff *skb_fragment;
409 	unsigned int header_size = sizeof(*frag_head);
410 	unsigned int mtu = fragment_size + header_size;
411 
412 	skb_fragment = netdev_alloc_skb(NULL, mtu + ETH_HLEN);
413 	if (!skb_fragment)
414 		goto err;
415 
416 	skb_fragment->priority = skb->priority;
417 
418 	/* Eat the last mtu-bytes of the skb */
419 	skb_reserve(skb_fragment, header_size + ETH_HLEN);
420 	skb_split(skb, skb_fragment, skb->len - fragment_size);
421 
422 	/* Add the header */
423 	skb_push(skb_fragment, header_size);
424 	memcpy(skb_fragment->data, frag_head, header_size);
425 
426 err:
427 	return skb_fragment;
428 }
429 
430 /**
431  * batadv_frag_send_packet() - create up to 16 fragments from the passed skb
432  * @skb: skb to create fragments from
433  * @orig_node: final destination of the created fragments
434  * @neigh_node: next-hop of the created fragments
435  *
436  * Return: the netdev tx status or a negative errno code on a failure
437  */
438 int batadv_frag_send_packet(struct sk_buff *skb,
439 			    struct batadv_orig_node *orig_node,
440 			    struct batadv_neigh_node *neigh_node)
441 {
442 	struct batadv_priv *bat_priv;
443 	struct batadv_hard_iface *primary_if = NULL;
444 	struct batadv_frag_packet frag_header;
445 	struct sk_buff *skb_fragment;
446 	unsigned int mtu = neigh_node->if_incoming->net_dev->mtu;
447 	unsigned int header_size = sizeof(frag_header);
448 	unsigned int max_fragment_size, num_fragments;
449 	int ret;
450 
451 	/* To avoid merge and refragmentation at next-hops we never send
452 	 * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
453 	 */
454 	mtu = min_t(unsigned int, mtu, BATADV_FRAG_MAX_FRAG_SIZE);
455 	max_fragment_size = mtu - header_size;
456 
457 	if (skb->len == 0 || max_fragment_size == 0)
458 		return -EINVAL;
459 
460 	num_fragments = (skb->len - 1) / max_fragment_size + 1;
461 	max_fragment_size = (skb->len - 1) / num_fragments + 1;
462 
463 	/* Don't even try to fragment, if we need more than 16 fragments */
464 	if (num_fragments > BATADV_FRAG_MAX_FRAGMENTS) {
465 		ret = -EAGAIN;
466 		goto free_skb;
467 	}
468 
469 	bat_priv = orig_node->bat_priv;
470 	primary_if = batadv_primary_if_get_selected(bat_priv);
471 	if (!primary_if) {
472 		ret = -EINVAL;
473 		goto free_skb;
474 	}
475 
476 	/* Create one header to be copied to all fragments */
477 	frag_header.packet_type = BATADV_UNICAST_FRAG;
478 	frag_header.version = BATADV_COMPAT_VERSION;
479 	frag_header.ttl = BATADV_TTL;
480 	frag_header.seqno = htons(atomic_inc_return(&bat_priv->frag_seqno));
481 	frag_header.reserved = 0;
482 	frag_header.no = 0;
483 	frag_header.total_size = htons(skb->len);
484 
485 	/* skb->priority values from 256->263 are magic values to
486 	 * directly indicate a specific 802.1d priority.  This is used
487 	 * to allow 802.1d priority to be passed directly in from VLAN
488 	 * tags, etc.
489 	 */
490 	if (skb->priority >= 256 && skb->priority <= 263)
491 		frag_header.priority = skb->priority - 256;
492 	else
493 		frag_header.priority = 0;
494 
495 	ether_addr_copy(frag_header.orig, primary_if->net_dev->dev_addr);
496 	ether_addr_copy(frag_header.dest, orig_node->orig);
497 
498 	/* Eat and send fragments from the tail of skb */
499 	while (skb->len > max_fragment_size) {
500 		/* The initial check in this function should cover this case */
501 		if (unlikely(frag_header.no == BATADV_FRAG_MAX_FRAGMENTS - 1)) {
502 			ret = -EINVAL;
503 			goto put_primary_if;
504 		}
505 
506 		skb_fragment = batadv_frag_create(skb, &frag_header,
507 						  max_fragment_size);
508 		if (!skb_fragment) {
509 			ret = -ENOMEM;
510 			goto put_primary_if;
511 		}
512 
513 		batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_TX);
514 		batadv_add_counter(bat_priv, BATADV_CNT_FRAG_TX_BYTES,
515 				   skb_fragment->len + ETH_HLEN);
516 		ret = batadv_send_unicast_skb(skb_fragment, neigh_node);
517 		if (ret != NET_XMIT_SUCCESS) {
518 			ret = NET_XMIT_DROP;
519 			goto put_primary_if;
520 		}
521 
522 		frag_header.no++;
523 	}
524 
525 	/* Make room for the fragment header. */
526 	if (batadv_skb_head_push(skb, header_size) < 0 ||
527 	    pskb_expand_head(skb, header_size + ETH_HLEN, 0, GFP_ATOMIC) < 0) {
528 		ret = -ENOMEM;
529 		goto put_primary_if;
530 	}
531 
532 	memcpy(skb->data, &frag_header, header_size);
533 
534 	/* Send the last fragment */
535 	batadv_inc_counter(bat_priv, BATADV_CNT_FRAG_TX);
536 	batadv_add_counter(bat_priv, BATADV_CNT_FRAG_TX_BYTES,
537 			   skb->len + ETH_HLEN);
538 	ret = batadv_send_unicast_skb(skb, neigh_node);
539 	/* skb was consumed */
540 	skb = NULL;
541 
542 put_primary_if:
543 	batadv_hardif_put(primary_if);
544 free_skb:
545 	kfree_skb(skb);
546 
547 	return ret;
548 }
549