1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (C) 2009-2020  B.A.T.M.A.N. contributors:
3  *
4  * Marek Lindner
5  */
6 
7 #include "gateway_client.h"
8 #include "main.h"
9 
10 #include <linux/atomic.h>
11 #include <linux/byteorder/generic.h>
12 #include <linux/errno.h>
13 #include <linux/etherdevice.h>
14 #include <linux/gfp.h>
15 #include <linux/if_ether.h>
16 #include <linux/if_vlan.h>
17 #include <linux/in.h>
18 #include <linux/ip.h>
19 #include <linux/ipv6.h>
20 #include <linux/kernel.h>
21 #include <linux/kref.h>
22 #include <linux/list.h>
23 #include <linux/lockdep.h>
24 #include <linux/netdevice.h>
25 #include <linux/netlink.h>
26 #include <linux/rculist.h>
27 #include <linux/rcupdate.h>
28 #include <linux/skbuff.h>
29 #include <linux/slab.h>
30 #include <linux/spinlock.h>
31 #include <linux/stddef.h>
32 #include <linux/udp.h>
33 #include <net/sock.h>
34 #include <uapi/linux/batadv_packet.h>
35 #include <uapi/linux/batman_adv.h>
36 
37 #include "hard-interface.h"
38 #include "log.h"
39 #include "netlink.h"
40 #include "originator.h"
41 #include "routing.h"
42 #include "soft-interface.h"
43 #include "translation-table.h"
44 
45 /* These are the offsets of the "hw type" and "hw address length" in the dhcp
46  * packet starting at the beginning of the dhcp header
47  */
48 #define BATADV_DHCP_HTYPE_OFFSET	1
49 #define BATADV_DHCP_HLEN_OFFSET		2
50 /* Value of htype representing Ethernet */
51 #define BATADV_DHCP_HTYPE_ETHERNET	0x01
52 /* This is the offset of the "chaddr" field in the dhcp packet starting at the
53  * beginning of the dhcp header
54  */
55 #define BATADV_DHCP_CHADDR_OFFSET	28
56 
57 /**
58  * batadv_gw_node_release() - release gw_node from lists and queue for free
59  *  after rcu grace period
60  * @ref: kref pointer of the gw_node
61  */
62 static void batadv_gw_node_release(struct kref *ref)
63 {
64 	struct batadv_gw_node *gw_node;
65 
66 	gw_node = container_of(ref, struct batadv_gw_node, refcount);
67 
68 	batadv_orig_node_put(gw_node->orig_node);
69 	kfree_rcu(gw_node, rcu);
70 }
71 
72 /**
73  * batadv_gw_node_put() - decrement the gw_node refcounter and possibly release
74  *  it
75  * @gw_node: gateway node to free
76  */
77 void batadv_gw_node_put(struct batadv_gw_node *gw_node)
78 {
79 	kref_put(&gw_node->refcount, batadv_gw_node_release);
80 }
81 
82 /**
83  * batadv_gw_get_selected_gw_node() - Get currently selected gateway
84  * @bat_priv: the bat priv with all the soft interface information
85  *
86  * Return: selected gateway (with increased refcnt), NULL on errors
87  */
88 struct batadv_gw_node *
89 batadv_gw_get_selected_gw_node(struct batadv_priv *bat_priv)
90 {
91 	struct batadv_gw_node *gw_node;
92 
93 	rcu_read_lock();
94 	gw_node = rcu_dereference(bat_priv->gw.curr_gw);
95 	if (!gw_node)
96 		goto out;
97 
98 	if (!kref_get_unless_zero(&gw_node->refcount))
99 		gw_node = NULL;
100 
101 out:
102 	rcu_read_unlock();
103 	return gw_node;
104 }
105 
106 /**
107  * batadv_gw_get_selected_orig() - Get originator of currently selected gateway
108  * @bat_priv: the bat priv with all the soft interface information
109  *
110  * Return: orig_node of selected gateway (with increased refcnt), NULL on errors
111  */
112 struct batadv_orig_node *
113 batadv_gw_get_selected_orig(struct batadv_priv *bat_priv)
114 {
115 	struct batadv_gw_node *gw_node;
116 	struct batadv_orig_node *orig_node = NULL;
117 
118 	gw_node = batadv_gw_get_selected_gw_node(bat_priv);
119 	if (!gw_node)
120 		goto out;
121 
122 	rcu_read_lock();
123 	orig_node = gw_node->orig_node;
124 	if (!orig_node)
125 		goto unlock;
126 
127 	if (!kref_get_unless_zero(&orig_node->refcount))
128 		orig_node = NULL;
129 
130 unlock:
131 	rcu_read_unlock();
132 out:
133 	if (gw_node)
134 		batadv_gw_node_put(gw_node);
135 	return orig_node;
136 }
137 
138 static void batadv_gw_select(struct batadv_priv *bat_priv,
139 			     struct batadv_gw_node *new_gw_node)
140 {
141 	struct batadv_gw_node *curr_gw_node;
142 
143 	spin_lock_bh(&bat_priv->gw.list_lock);
144 
145 	if (new_gw_node)
146 		kref_get(&new_gw_node->refcount);
147 
148 	curr_gw_node = rcu_replace_pointer(bat_priv->gw.curr_gw, new_gw_node,
149 					   true);
150 
151 	if (curr_gw_node)
152 		batadv_gw_node_put(curr_gw_node);
153 
154 	spin_unlock_bh(&bat_priv->gw.list_lock);
155 }
156 
157 /**
158  * batadv_gw_reselect() - force a gateway reselection
159  * @bat_priv: the bat priv with all the soft interface information
160  *
161  * Set a flag to remind the GW component to perform a new gateway reselection.
162  * However this function does not ensure that the current gateway is going to be
163  * deselected. The reselection mechanism may elect the same gateway once again.
164  *
165  * This means that invoking batadv_gw_reselect() does not guarantee a gateway
166  * change and therefore a uevent is not necessarily expected.
167  */
168 void batadv_gw_reselect(struct batadv_priv *bat_priv)
169 {
170 	atomic_set(&bat_priv->gw.reselect, 1);
171 }
172 
173 /**
174  * batadv_gw_check_client_stop() - check if client mode has been switched off
175  * @bat_priv: the bat priv with all the soft interface information
176  *
177  * This function assumes the caller has checked that the gw state *is actually
178  * changing*. This function is not supposed to be called when there is no state
179  * change.
180  */
181 void batadv_gw_check_client_stop(struct batadv_priv *bat_priv)
182 {
183 	struct batadv_gw_node *curr_gw;
184 
185 	if (atomic_read(&bat_priv->gw.mode) != BATADV_GW_MODE_CLIENT)
186 		return;
187 
188 	curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
189 	if (!curr_gw)
190 		return;
191 
192 	/* deselect the current gateway so that next time that client mode is
193 	 * enabled a proper GW_ADD event can be sent
194 	 */
195 	batadv_gw_select(bat_priv, NULL);
196 
197 	/* if batman-adv is switching the gw client mode off and a gateway was
198 	 * already selected, send a DEL uevent
199 	 */
200 	batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_DEL, NULL);
201 
202 	batadv_gw_node_put(curr_gw);
203 }
204 
205 /**
206  * batadv_gw_election() - Elect the best gateway
207  * @bat_priv: the bat priv with all the soft interface information
208  */
209 void batadv_gw_election(struct batadv_priv *bat_priv)
210 {
211 	struct batadv_gw_node *curr_gw = NULL;
212 	struct batadv_gw_node *next_gw = NULL;
213 	struct batadv_neigh_node *router = NULL;
214 	struct batadv_neigh_ifinfo *router_ifinfo = NULL;
215 	char gw_addr[18] = { '\0' };
216 
217 	if (atomic_read(&bat_priv->gw.mode) != BATADV_GW_MODE_CLIENT)
218 		goto out;
219 
220 	if (!bat_priv->algo_ops->gw.get_best_gw_node)
221 		goto out;
222 
223 	curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
224 
225 	if (!batadv_atomic_dec_not_zero(&bat_priv->gw.reselect) && curr_gw)
226 		goto out;
227 
228 	/* if gw.reselect is set to 1 it means that a previous call to
229 	 * gw.is_eligible() said that we have a new best GW, therefore it can
230 	 * now be picked from the list and selected
231 	 */
232 	next_gw = bat_priv->algo_ops->gw.get_best_gw_node(bat_priv);
233 
234 	if (curr_gw == next_gw)
235 		goto out;
236 
237 	if (next_gw) {
238 		sprintf(gw_addr, "%pM", next_gw->orig_node->orig);
239 
240 		router = batadv_orig_router_get(next_gw->orig_node,
241 						BATADV_IF_DEFAULT);
242 		if (!router) {
243 			batadv_gw_reselect(bat_priv);
244 			goto out;
245 		}
246 
247 		router_ifinfo = batadv_neigh_ifinfo_get(router,
248 							BATADV_IF_DEFAULT);
249 		if (!router_ifinfo) {
250 			batadv_gw_reselect(bat_priv);
251 			goto out;
252 		}
253 	}
254 
255 	if (curr_gw && !next_gw) {
256 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
257 			   "Removing selected gateway - no gateway in range\n");
258 		batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_DEL,
259 				    NULL);
260 	} else if (!curr_gw && next_gw) {
261 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
262 			   "Adding route to gateway %pM (bandwidth: %u.%u/%u.%u MBit, tq: %i)\n",
263 			   next_gw->orig_node->orig,
264 			   next_gw->bandwidth_down / 10,
265 			   next_gw->bandwidth_down % 10,
266 			   next_gw->bandwidth_up / 10,
267 			   next_gw->bandwidth_up % 10,
268 			   router_ifinfo->bat_iv.tq_avg);
269 		batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_ADD,
270 				    gw_addr);
271 	} else {
272 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
273 			   "Changing route to gateway %pM (bandwidth: %u.%u/%u.%u MBit, tq: %i)\n",
274 			   next_gw->orig_node->orig,
275 			   next_gw->bandwidth_down / 10,
276 			   next_gw->bandwidth_down % 10,
277 			   next_gw->bandwidth_up / 10,
278 			   next_gw->bandwidth_up % 10,
279 			   router_ifinfo->bat_iv.tq_avg);
280 		batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_CHANGE,
281 				    gw_addr);
282 	}
283 
284 	batadv_gw_select(bat_priv, next_gw);
285 
286 out:
287 	if (curr_gw)
288 		batadv_gw_node_put(curr_gw);
289 	if (next_gw)
290 		batadv_gw_node_put(next_gw);
291 	if (router)
292 		batadv_neigh_node_put(router);
293 	if (router_ifinfo)
294 		batadv_neigh_ifinfo_put(router_ifinfo);
295 }
296 
297 /**
298  * batadv_gw_check_election() - Elect orig node as best gateway when eligible
299  * @bat_priv: the bat priv with all the soft interface information
300  * @orig_node: orig node which is to be checked
301  */
302 void batadv_gw_check_election(struct batadv_priv *bat_priv,
303 			      struct batadv_orig_node *orig_node)
304 {
305 	struct batadv_orig_node *curr_gw_orig;
306 
307 	/* abort immediately if the routing algorithm does not support gateway
308 	 * election
309 	 */
310 	if (!bat_priv->algo_ops->gw.is_eligible)
311 		return;
312 
313 	curr_gw_orig = batadv_gw_get_selected_orig(bat_priv);
314 	if (!curr_gw_orig)
315 		goto reselect;
316 
317 	/* this node already is the gateway */
318 	if (curr_gw_orig == orig_node)
319 		goto out;
320 
321 	if (!bat_priv->algo_ops->gw.is_eligible(bat_priv, curr_gw_orig,
322 						orig_node))
323 		goto out;
324 
325 reselect:
326 	batadv_gw_reselect(bat_priv);
327 out:
328 	if (curr_gw_orig)
329 		batadv_orig_node_put(curr_gw_orig);
330 }
331 
332 /**
333  * batadv_gw_node_add() - add gateway node to list of available gateways
334  * @bat_priv: the bat priv with all the soft interface information
335  * @orig_node: originator announcing gateway capabilities
336  * @gateway: announced bandwidth information
337  *
338  * Has to be called with the appropriate locks being acquired
339  * (gw.list_lock).
340  */
341 static void batadv_gw_node_add(struct batadv_priv *bat_priv,
342 			       struct batadv_orig_node *orig_node,
343 			       struct batadv_tvlv_gateway_data *gateway)
344 {
345 	struct batadv_gw_node *gw_node;
346 
347 	lockdep_assert_held(&bat_priv->gw.list_lock);
348 
349 	if (gateway->bandwidth_down == 0)
350 		return;
351 
352 	gw_node = kzalloc(sizeof(*gw_node), GFP_ATOMIC);
353 	if (!gw_node)
354 		return;
355 
356 	kref_init(&gw_node->refcount);
357 	INIT_HLIST_NODE(&gw_node->list);
358 	kref_get(&orig_node->refcount);
359 	gw_node->orig_node = orig_node;
360 	gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
361 	gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
362 
363 	kref_get(&gw_node->refcount);
364 	hlist_add_head_rcu(&gw_node->list, &bat_priv->gw.gateway_list);
365 	bat_priv->gw.generation++;
366 
367 	batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
368 		   "Found new gateway %pM -> gw bandwidth: %u.%u/%u.%u MBit\n",
369 		   orig_node->orig,
370 		   ntohl(gateway->bandwidth_down) / 10,
371 		   ntohl(gateway->bandwidth_down) % 10,
372 		   ntohl(gateway->bandwidth_up) / 10,
373 		   ntohl(gateway->bandwidth_up) % 10);
374 
375 	/* don't return reference to new gw_node */
376 	batadv_gw_node_put(gw_node);
377 }
378 
379 /**
380  * batadv_gw_node_get() - retrieve gateway node from list of available gateways
381  * @bat_priv: the bat priv with all the soft interface information
382  * @orig_node: originator announcing gateway capabilities
383  *
384  * Return: gateway node if found or NULL otherwise.
385  */
386 struct batadv_gw_node *batadv_gw_node_get(struct batadv_priv *bat_priv,
387 					  struct batadv_orig_node *orig_node)
388 {
389 	struct batadv_gw_node *gw_node_tmp, *gw_node = NULL;
390 
391 	rcu_read_lock();
392 	hlist_for_each_entry_rcu(gw_node_tmp, &bat_priv->gw.gateway_list,
393 				 list) {
394 		if (gw_node_tmp->orig_node != orig_node)
395 			continue;
396 
397 		if (!kref_get_unless_zero(&gw_node_tmp->refcount))
398 			continue;
399 
400 		gw_node = gw_node_tmp;
401 		break;
402 	}
403 	rcu_read_unlock();
404 
405 	return gw_node;
406 }
407 
408 /**
409  * batadv_gw_node_update() - update list of available gateways with changed
410  *  bandwidth information
411  * @bat_priv: the bat priv with all the soft interface information
412  * @orig_node: originator announcing gateway capabilities
413  * @gateway: announced bandwidth information
414  */
415 void batadv_gw_node_update(struct batadv_priv *bat_priv,
416 			   struct batadv_orig_node *orig_node,
417 			   struct batadv_tvlv_gateway_data *gateway)
418 {
419 	struct batadv_gw_node *gw_node, *curr_gw = NULL;
420 
421 	spin_lock_bh(&bat_priv->gw.list_lock);
422 	gw_node = batadv_gw_node_get(bat_priv, orig_node);
423 	if (!gw_node) {
424 		batadv_gw_node_add(bat_priv, orig_node, gateway);
425 		spin_unlock_bh(&bat_priv->gw.list_lock);
426 		goto out;
427 	}
428 	spin_unlock_bh(&bat_priv->gw.list_lock);
429 
430 	if (gw_node->bandwidth_down == ntohl(gateway->bandwidth_down) &&
431 	    gw_node->bandwidth_up == ntohl(gateway->bandwidth_up))
432 		goto out;
433 
434 	batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
435 		   "Gateway bandwidth of originator %pM changed from %u.%u/%u.%u MBit to %u.%u/%u.%u MBit\n",
436 		   orig_node->orig,
437 		   gw_node->bandwidth_down / 10,
438 		   gw_node->bandwidth_down % 10,
439 		   gw_node->bandwidth_up / 10,
440 		   gw_node->bandwidth_up % 10,
441 		   ntohl(gateway->bandwidth_down) / 10,
442 		   ntohl(gateway->bandwidth_down) % 10,
443 		   ntohl(gateway->bandwidth_up) / 10,
444 		   ntohl(gateway->bandwidth_up) % 10);
445 
446 	gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
447 	gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
448 
449 	if (ntohl(gateway->bandwidth_down) == 0) {
450 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
451 			   "Gateway %pM removed from gateway list\n",
452 			   orig_node->orig);
453 
454 		/* Note: We don't need a NULL check here, since curr_gw never
455 		 * gets dereferenced.
456 		 */
457 		spin_lock_bh(&bat_priv->gw.list_lock);
458 		if (!hlist_unhashed(&gw_node->list)) {
459 			hlist_del_init_rcu(&gw_node->list);
460 			batadv_gw_node_put(gw_node);
461 			bat_priv->gw.generation++;
462 		}
463 		spin_unlock_bh(&bat_priv->gw.list_lock);
464 
465 		curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
466 		if (gw_node == curr_gw)
467 			batadv_gw_reselect(bat_priv);
468 
469 		if (curr_gw)
470 			batadv_gw_node_put(curr_gw);
471 	}
472 
473 out:
474 	if (gw_node)
475 		batadv_gw_node_put(gw_node);
476 }
477 
478 /**
479  * batadv_gw_node_delete() - Remove orig_node from gateway list
480  * @bat_priv: the bat priv with all the soft interface information
481  * @orig_node: orig node which is currently in process of being removed
482  */
483 void batadv_gw_node_delete(struct batadv_priv *bat_priv,
484 			   struct batadv_orig_node *orig_node)
485 {
486 	struct batadv_tvlv_gateway_data gateway;
487 
488 	gateway.bandwidth_down = 0;
489 	gateway.bandwidth_up = 0;
490 
491 	batadv_gw_node_update(bat_priv, orig_node, &gateway);
492 }
493 
494 /**
495  * batadv_gw_node_free() - Free gateway information from soft interface
496  * @bat_priv: the bat priv with all the soft interface information
497  */
498 void batadv_gw_node_free(struct batadv_priv *bat_priv)
499 {
500 	struct batadv_gw_node *gw_node;
501 	struct hlist_node *node_tmp;
502 
503 	spin_lock_bh(&bat_priv->gw.list_lock);
504 	hlist_for_each_entry_safe(gw_node, node_tmp,
505 				  &bat_priv->gw.gateway_list, list) {
506 		hlist_del_init_rcu(&gw_node->list);
507 		batadv_gw_node_put(gw_node);
508 		bat_priv->gw.generation++;
509 	}
510 	spin_unlock_bh(&bat_priv->gw.list_lock);
511 }
512 
513 /**
514  * batadv_gw_dump() - Dump gateways into a message
515  * @msg: Netlink message to dump into
516  * @cb: Control block containing additional options
517  *
518  * Return: Error code, or length of message
519  */
520 int batadv_gw_dump(struct sk_buff *msg, struct netlink_callback *cb)
521 {
522 	struct batadv_hard_iface *primary_if = NULL;
523 	struct net *net = sock_net(cb->skb->sk);
524 	struct net_device *soft_iface;
525 	struct batadv_priv *bat_priv;
526 	int ifindex;
527 	int ret;
528 
529 	ifindex = batadv_netlink_get_ifindex(cb->nlh,
530 					     BATADV_ATTR_MESH_IFINDEX);
531 	if (!ifindex)
532 		return -EINVAL;
533 
534 	soft_iface = dev_get_by_index(net, ifindex);
535 	if (!soft_iface || !batadv_softif_is_valid(soft_iface)) {
536 		ret = -ENODEV;
537 		goto out;
538 	}
539 
540 	bat_priv = netdev_priv(soft_iface);
541 
542 	primary_if = batadv_primary_if_get_selected(bat_priv);
543 	if (!primary_if || primary_if->if_status != BATADV_IF_ACTIVE) {
544 		ret = -ENOENT;
545 		goto out;
546 	}
547 
548 	if (!bat_priv->algo_ops->gw.dump) {
549 		ret = -EOPNOTSUPP;
550 		goto out;
551 	}
552 
553 	bat_priv->algo_ops->gw.dump(msg, cb, bat_priv);
554 
555 	ret = msg->len;
556 
557 out:
558 	if (primary_if)
559 		batadv_hardif_put(primary_if);
560 	if (soft_iface)
561 		dev_put(soft_iface);
562 
563 	return ret;
564 }
565 
566 /**
567  * batadv_gw_dhcp_recipient_get() - check if a packet is a DHCP message
568  * @skb: the packet to check
569  * @header_len: a pointer to the batman-adv header size
570  * @chaddr: buffer where the client address will be stored. Valid
571  *  only if the function returns BATADV_DHCP_TO_CLIENT
572  *
573  * This function may re-allocate the data buffer of the skb passed as argument.
574  *
575  * Return:
576  * - BATADV_DHCP_NO if the packet is not a dhcp message or if there was an error
577  *   while parsing it
578  * - BATADV_DHCP_TO_SERVER if this is a message going to the DHCP server
579  * - BATADV_DHCP_TO_CLIENT if this is a message going to a DHCP client
580  */
581 enum batadv_dhcp_recipient
582 batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
583 			     u8 *chaddr)
584 {
585 	enum batadv_dhcp_recipient ret = BATADV_DHCP_NO;
586 	struct ethhdr *ethhdr;
587 	struct iphdr *iphdr;
588 	struct ipv6hdr *ipv6hdr;
589 	struct udphdr *udphdr;
590 	struct vlan_ethhdr *vhdr;
591 	int chaddr_offset;
592 	__be16 proto;
593 	u8 *p;
594 
595 	/* check for ethernet header */
596 	if (!pskb_may_pull(skb, *header_len + ETH_HLEN))
597 		return BATADV_DHCP_NO;
598 
599 	ethhdr = eth_hdr(skb);
600 	proto = ethhdr->h_proto;
601 	*header_len += ETH_HLEN;
602 
603 	/* check for initial vlan header */
604 	if (proto == htons(ETH_P_8021Q)) {
605 		if (!pskb_may_pull(skb, *header_len + VLAN_HLEN))
606 			return BATADV_DHCP_NO;
607 
608 		vhdr = vlan_eth_hdr(skb);
609 		proto = vhdr->h_vlan_encapsulated_proto;
610 		*header_len += VLAN_HLEN;
611 	}
612 
613 	/* check for ip header */
614 	switch (proto) {
615 	case htons(ETH_P_IP):
616 		if (!pskb_may_pull(skb, *header_len + sizeof(*iphdr)))
617 			return BATADV_DHCP_NO;
618 
619 		iphdr = (struct iphdr *)(skb->data + *header_len);
620 		*header_len += iphdr->ihl * 4;
621 
622 		/* check for udp header */
623 		if (iphdr->protocol != IPPROTO_UDP)
624 			return BATADV_DHCP_NO;
625 
626 		break;
627 	case htons(ETH_P_IPV6):
628 		if (!pskb_may_pull(skb, *header_len + sizeof(*ipv6hdr)))
629 			return BATADV_DHCP_NO;
630 
631 		ipv6hdr = (struct ipv6hdr *)(skb->data + *header_len);
632 		*header_len += sizeof(*ipv6hdr);
633 
634 		/* check for udp header */
635 		if (ipv6hdr->nexthdr != IPPROTO_UDP)
636 			return BATADV_DHCP_NO;
637 
638 		break;
639 	default:
640 		return BATADV_DHCP_NO;
641 	}
642 
643 	if (!pskb_may_pull(skb, *header_len + sizeof(*udphdr)))
644 		return BATADV_DHCP_NO;
645 
646 	udphdr = (struct udphdr *)(skb->data + *header_len);
647 	*header_len += sizeof(*udphdr);
648 
649 	/* check for bootp port */
650 	switch (proto) {
651 	case htons(ETH_P_IP):
652 		if (udphdr->dest == htons(67))
653 			ret = BATADV_DHCP_TO_SERVER;
654 		else if (udphdr->source == htons(67))
655 			ret = BATADV_DHCP_TO_CLIENT;
656 		break;
657 	case htons(ETH_P_IPV6):
658 		if (udphdr->dest == htons(547))
659 			ret = BATADV_DHCP_TO_SERVER;
660 		else if (udphdr->source == htons(547))
661 			ret = BATADV_DHCP_TO_CLIENT;
662 		break;
663 	}
664 
665 	chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET;
666 	/* store the client address if the message is going to a client */
667 	if (ret == BATADV_DHCP_TO_CLIENT) {
668 		if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN))
669 			return BATADV_DHCP_NO;
670 
671 		/* check if the DHCP packet carries an Ethernet DHCP */
672 		p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET;
673 		if (*p != BATADV_DHCP_HTYPE_ETHERNET)
674 			return BATADV_DHCP_NO;
675 
676 		/* check if the DHCP packet carries a valid Ethernet address */
677 		p = skb->data + *header_len + BATADV_DHCP_HLEN_OFFSET;
678 		if (*p != ETH_ALEN)
679 			return BATADV_DHCP_NO;
680 
681 		ether_addr_copy(chaddr, skb->data + chaddr_offset);
682 	}
683 
684 	return ret;
685 }
686 
687 /**
688  * batadv_gw_out_of_range() - check if the dhcp request destination is the best
689  *  gateway
690  * @bat_priv: the bat priv with all the soft interface information
691  * @skb: the outgoing packet
692  *
693  * Check if the skb is a DHCP request and if it is sent to the current best GW
694  * server. Due to topology changes it may be the case that the GW server
695  * previously selected is not the best one anymore.
696  *
697  * This call might reallocate skb data.
698  * Must be invoked only when the DHCP packet is going TO a DHCP SERVER.
699  *
700  * Return: true if the packet destination is unicast and it is not the best gw,
701  * false otherwise.
702  */
703 bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
704 			    struct sk_buff *skb)
705 {
706 	struct batadv_neigh_node *neigh_curr = NULL;
707 	struct batadv_neigh_node *neigh_old = NULL;
708 	struct batadv_orig_node *orig_dst_node = NULL;
709 	struct batadv_gw_node *gw_node = NULL;
710 	struct batadv_gw_node *curr_gw = NULL;
711 	struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo;
712 	struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
713 	bool out_of_range = false;
714 	u8 curr_tq_avg;
715 	unsigned short vid;
716 
717 	vid = batadv_get_vid(skb, 0);
718 
719 	if (is_multicast_ether_addr(ethhdr->h_dest))
720 		goto out;
721 
722 	orig_dst_node = batadv_transtable_search(bat_priv, ethhdr->h_source,
723 						 ethhdr->h_dest, vid);
724 	if (!orig_dst_node)
725 		goto out;
726 
727 	gw_node = batadv_gw_node_get(bat_priv, orig_dst_node);
728 	if (!gw_node)
729 		goto out;
730 
731 	switch (atomic_read(&bat_priv->gw.mode)) {
732 	case BATADV_GW_MODE_SERVER:
733 		/* If we are a GW then we are our best GW. We can artificially
734 		 * set the tq towards ourself as the maximum value
735 		 */
736 		curr_tq_avg = BATADV_TQ_MAX_VALUE;
737 		break;
738 	case BATADV_GW_MODE_CLIENT:
739 		curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
740 		if (!curr_gw)
741 			goto out;
742 
743 		/* packet is going to our gateway */
744 		if (curr_gw->orig_node == orig_dst_node)
745 			goto out;
746 
747 		/* If the dhcp packet has been sent to a different gw,
748 		 * we have to evaluate whether the old gw is still
749 		 * reliable enough
750 		 */
751 		neigh_curr = batadv_find_router(bat_priv, curr_gw->orig_node,
752 						NULL);
753 		if (!neigh_curr)
754 			goto out;
755 
756 		curr_ifinfo = batadv_neigh_ifinfo_get(neigh_curr,
757 						      BATADV_IF_DEFAULT);
758 		if (!curr_ifinfo)
759 			goto out;
760 
761 		curr_tq_avg = curr_ifinfo->bat_iv.tq_avg;
762 		batadv_neigh_ifinfo_put(curr_ifinfo);
763 
764 		break;
765 	case BATADV_GW_MODE_OFF:
766 	default:
767 		goto out;
768 	}
769 
770 	neigh_old = batadv_find_router(bat_priv, orig_dst_node, NULL);
771 	if (!neigh_old)
772 		goto out;
773 
774 	old_ifinfo = batadv_neigh_ifinfo_get(neigh_old, BATADV_IF_DEFAULT);
775 	if (!old_ifinfo)
776 		goto out;
777 
778 	if ((curr_tq_avg - old_ifinfo->bat_iv.tq_avg) > BATADV_GW_THRESHOLD)
779 		out_of_range = true;
780 	batadv_neigh_ifinfo_put(old_ifinfo);
781 
782 out:
783 	if (orig_dst_node)
784 		batadv_orig_node_put(orig_dst_node);
785 	if (curr_gw)
786 		batadv_gw_node_put(curr_gw);
787 	if (gw_node)
788 		batadv_gw_node_put(gw_node);
789 	if (neigh_old)
790 		batadv_neigh_node_put(neigh_old);
791 	if (neigh_curr)
792 		batadv_neigh_node_put(neigh_curr);
793 	return out_of_range;
794 }
795