1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (C) 2009-2018  B.A.T.M.A.N. contributors:
3  *
4  * Marek Lindner
5  *
6  * This program is free software; you can redistribute it and/or
7  * modify it under the terms of version 2 of the GNU General Public
8  * License as published by the Free Software Foundation.
9  *
10  * This program is distributed in the hope that it will be useful, but
11  * WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13  * General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License
16  * along with this program; if not, see <http://www.gnu.org/licenses/>.
17  */
18 
19 #include "gateway_client.h"
20 #include "main.h"
21 
22 #include <linux/atomic.h>
23 #include <linux/byteorder/generic.h>
24 #include <linux/errno.h>
25 #include <linux/etherdevice.h>
26 #include <linux/gfp.h>
27 #include <linux/if_ether.h>
28 #include <linux/if_vlan.h>
29 #include <linux/in.h>
30 #include <linux/ip.h>
31 #include <linux/ipv6.h>
32 #include <linux/kernel.h>
33 #include <linux/kref.h>
34 #include <linux/list.h>
35 #include <linux/netdevice.h>
36 #include <linux/netlink.h>
37 #include <linux/rculist.h>
38 #include <linux/rcupdate.h>
39 #include <linux/seq_file.h>
40 #include <linux/skbuff.h>
41 #include <linux/slab.h>
42 #include <linux/spinlock.h>
43 #include <linux/stddef.h>
44 #include <linux/udp.h>
45 #include <net/sock.h>
46 #include <uapi/linux/batadv_packet.h>
47 #include <uapi/linux/batman_adv.h>
48 
49 #include "gateway_common.h"
50 #include "hard-interface.h"
51 #include "log.h"
52 #include "netlink.h"
53 #include "originator.h"
54 #include "routing.h"
55 #include "soft-interface.h"
56 #include "sysfs.h"
57 #include "translation-table.h"
58 
59 /* These are the offsets of the "hw type" and "hw address length" in the dhcp
60  * packet starting at the beginning of the dhcp header
61  */
62 #define BATADV_DHCP_HTYPE_OFFSET	1
63 #define BATADV_DHCP_HLEN_OFFSET		2
64 /* Value of htype representing Ethernet */
65 #define BATADV_DHCP_HTYPE_ETHERNET	0x01
66 /* This is the offset of the "chaddr" field in the dhcp packet starting at the
67  * beginning of the dhcp header
68  */
69 #define BATADV_DHCP_CHADDR_OFFSET	28
70 
71 /**
72  * batadv_gw_node_release() - release gw_node from lists and queue for free
73  *  after rcu grace period
74  * @ref: kref pointer of the gw_node
75  */
76 static void batadv_gw_node_release(struct kref *ref)
77 {
78 	struct batadv_gw_node *gw_node;
79 
80 	gw_node = container_of(ref, struct batadv_gw_node, refcount);
81 
82 	batadv_orig_node_put(gw_node->orig_node);
83 	kfree_rcu(gw_node, rcu);
84 }
85 
86 /**
87  * batadv_gw_node_put() - decrement the gw_node refcounter and possibly release
88  *  it
89  * @gw_node: gateway node to free
90  */
91 void batadv_gw_node_put(struct batadv_gw_node *gw_node)
92 {
93 	kref_put(&gw_node->refcount, batadv_gw_node_release);
94 }
95 
96 /**
97  * batadv_gw_get_selected_gw_node() - Get currently selected gateway
98  * @bat_priv: the bat priv with all the soft interface information
99  *
100  * Return: selected gateway (with increased refcnt), NULL on errors
101  */
102 struct batadv_gw_node *
103 batadv_gw_get_selected_gw_node(struct batadv_priv *bat_priv)
104 {
105 	struct batadv_gw_node *gw_node;
106 
107 	rcu_read_lock();
108 	gw_node = rcu_dereference(bat_priv->gw.curr_gw);
109 	if (!gw_node)
110 		goto out;
111 
112 	if (!kref_get_unless_zero(&gw_node->refcount))
113 		gw_node = NULL;
114 
115 out:
116 	rcu_read_unlock();
117 	return gw_node;
118 }
119 
120 /**
121  * batadv_gw_get_selected_orig() - Get originator of currently selected gateway
122  * @bat_priv: the bat priv with all the soft interface information
123  *
124  * Return: orig_node of selected gateway (with increased refcnt), NULL on errors
125  */
126 struct batadv_orig_node *
127 batadv_gw_get_selected_orig(struct batadv_priv *bat_priv)
128 {
129 	struct batadv_gw_node *gw_node;
130 	struct batadv_orig_node *orig_node = NULL;
131 
132 	gw_node = batadv_gw_get_selected_gw_node(bat_priv);
133 	if (!gw_node)
134 		goto out;
135 
136 	rcu_read_lock();
137 	orig_node = gw_node->orig_node;
138 	if (!orig_node)
139 		goto unlock;
140 
141 	if (!kref_get_unless_zero(&orig_node->refcount))
142 		orig_node = NULL;
143 
144 unlock:
145 	rcu_read_unlock();
146 out:
147 	if (gw_node)
148 		batadv_gw_node_put(gw_node);
149 	return orig_node;
150 }
151 
152 static void batadv_gw_select(struct batadv_priv *bat_priv,
153 			     struct batadv_gw_node *new_gw_node)
154 {
155 	struct batadv_gw_node *curr_gw_node;
156 
157 	spin_lock_bh(&bat_priv->gw.list_lock);
158 
159 	if (new_gw_node)
160 		kref_get(&new_gw_node->refcount);
161 
162 	curr_gw_node = rcu_dereference_protected(bat_priv->gw.curr_gw, 1);
163 	rcu_assign_pointer(bat_priv->gw.curr_gw, new_gw_node);
164 
165 	if (curr_gw_node)
166 		batadv_gw_node_put(curr_gw_node);
167 
168 	spin_unlock_bh(&bat_priv->gw.list_lock);
169 }
170 
171 /**
172  * batadv_gw_reselect() - force a gateway reselection
173  * @bat_priv: the bat priv with all the soft interface information
174  *
175  * Set a flag to remind the GW component to perform a new gateway reselection.
176  * However this function does not ensure that the current gateway is going to be
177  * deselected. The reselection mechanism may elect the same gateway once again.
178  *
179  * This means that invoking batadv_gw_reselect() does not guarantee a gateway
180  * change and therefore a uevent is not necessarily expected.
181  */
182 void batadv_gw_reselect(struct batadv_priv *bat_priv)
183 {
184 	atomic_set(&bat_priv->gw.reselect, 1);
185 }
186 
187 /**
188  * batadv_gw_check_client_stop() - check if client mode has been switched off
189  * @bat_priv: the bat priv with all the soft interface information
190  *
191  * This function assumes the caller has checked that the gw state *is actually
192  * changing*. This function is not supposed to be called when there is no state
193  * change.
194  */
195 void batadv_gw_check_client_stop(struct batadv_priv *bat_priv)
196 {
197 	struct batadv_gw_node *curr_gw;
198 
199 	if (atomic_read(&bat_priv->gw.mode) != BATADV_GW_MODE_CLIENT)
200 		return;
201 
202 	curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
203 	if (!curr_gw)
204 		return;
205 
206 	/* deselect the current gateway so that next time that client mode is
207 	 * enabled a proper GW_ADD event can be sent
208 	 */
209 	batadv_gw_select(bat_priv, NULL);
210 
211 	/* if batman-adv is switching the gw client mode off and a gateway was
212 	 * already selected, send a DEL uevent
213 	 */
214 	batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_DEL, NULL);
215 
216 	batadv_gw_node_put(curr_gw);
217 }
218 
219 /**
220  * batadv_gw_election() - Elect the best gateway
221  * @bat_priv: the bat priv with all the soft interface information
222  */
223 void batadv_gw_election(struct batadv_priv *bat_priv)
224 {
225 	struct batadv_gw_node *curr_gw = NULL;
226 	struct batadv_gw_node *next_gw = NULL;
227 	struct batadv_neigh_node *router = NULL;
228 	struct batadv_neigh_ifinfo *router_ifinfo = NULL;
229 	char gw_addr[18] = { '\0' };
230 
231 	if (atomic_read(&bat_priv->gw.mode) != BATADV_GW_MODE_CLIENT)
232 		goto out;
233 
234 	if (!bat_priv->algo_ops->gw.get_best_gw_node)
235 		goto out;
236 
237 	curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
238 
239 	if (!batadv_atomic_dec_not_zero(&bat_priv->gw.reselect) && curr_gw)
240 		goto out;
241 
242 	/* if gw.reselect is set to 1 it means that a previous call to
243 	 * gw.is_eligible() said that we have a new best GW, therefore it can
244 	 * now be picked from the list and selected
245 	 */
246 	next_gw = bat_priv->algo_ops->gw.get_best_gw_node(bat_priv);
247 
248 	if (curr_gw == next_gw)
249 		goto out;
250 
251 	if (next_gw) {
252 		sprintf(gw_addr, "%pM", next_gw->orig_node->orig);
253 
254 		router = batadv_orig_router_get(next_gw->orig_node,
255 						BATADV_IF_DEFAULT);
256 		if (!router) {
257 			batadv_gw_reselect(bat_priv);
258 			goto out;
259 		}
260 
261 		router_ifinfo = batadv_neigh_ifinfo_get(router,
262 							BATADV_IF_DEFAULT);
263 		if (!router_ifinfo) {
264 			batadv_gw_reselect(bat_priv);
265 			goto out;
266 		}
267 	}
268 
269 	if (curr_gw && !next_gw) {
270 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
271 			   "Removing selected gateway - no gateway in range\n");
272 		batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_DEL,
273 				    NULL);
274 	} else if (!curr_gw && next_gw) {
275 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
276 			   "Adding route to gateway %pM (bandwidth: %u.%u/%u.%u MBit, tq: %i)\n",
277 			   next_gw->orig_node->orig,
278 			   next_gw->bandwidth_down / 10,
279 			   next_gw->bandwidth_down % 10,
280 			   next_gw->bandwidth_up / 10,
281 			   next_gw->bandwidth_up % 10,
282 			   router_ifinfo->bat_iv.tq_avg);
283 		batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_ADD,
284 				    gw_addr);
285 	} else {
286 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
287 			   "Changing route to gateway %pM (bandwidth: %u.%u/%u.%u MBit, tq: %i)\n",
288 			   next_gw->orig_node->orig,
289 			   next_gw->bandwidth_down / 10,
290 			   next_gw->bandwidth_down % 10,
291 			   next_gw->bandwidth_up / 10,
292 			   next_gw->bandwidth_up % 10,
293 			   router_ifinfo->bat_iv.tq_avg);
294 		batadv_throw_uevent(bat_priv, BATADV_UEV_GW, BATADV_UEV_CHANGE,
295 				    gw_addr);
296 	}
297 
298 	batadv_gw_select(bat_priv, next_gw);
299 
300 out:
301 	if (curr_gw)
302 		batadv_gw_node_put(curr_gw);
303 	if (next_gw)
304 		batadv_gw_node_put(next_gw);
305 	if (router)
306 		batadv_neigh_node_put(router);
307 	if (router_ifinfo)
308 		batadv_neigh_ifinfo_put(router_ifinfo);
309 }
310 
311 /**
312  * batadv_gw_check_election() - Elect orig node as best gateway when eligible
313  * @bat_priv: the bat priv with all the soft interface information
314  * @orig_node: orig node which is to be checked
315  */
316 void batadv_gw_check_election(struct batadv_priv *bat_priv,
317 			      struct batadv_orig_node *orig_node)
318 {
319 	struct batadv_orig_node *curr_gw_orig;
320 
321 	/* abort immediately if the routing algorithm does not support gateway
322 	 * election
323 	 */
324 	if (!bat_priv->algo_ops->gw.is_eligible)
325 		return;
326 
327 	curr_gw_orig = batadv_gw_get_selected_orig(bat_priv);
328 	if (!curr_gw_orig)
329 		goto reselect;
330 
331 	/* this node already is the gateway */
332 	if (curr_gw_orig == orig_node)
333 		goto out;
334 
335 	if (!bat_priv->algo_ops->gw.is_eligible(bat_priv, curr_gw_orig,
336 						orig_node))
337 		goto out;
338 
339 reselect:
340 	batadv_gw_reselect(bat_priv);
341 out:
342 	if (curr_gw_orig)
343 		batadv_orig_node_put(curr_gw_orig);
344 }
345 
346 /**
347  * batadv_gw_node_add() - add gateway node to list of available gateways
348  * @bat_priv: the bat priv with all the soft interface information
349  * @orig_node: originator announcing gateway capabilities
350  * @gateway: announced bandwidth information
351  */
352 static void batadv_gw_node_add(struct batadv_priv *bat_priv,
353 			       struct batadv_orig_node *orig_node,
354 			       struct batadv_tvlv_gateway_data *gateway)
355 {
356 	struct batadv_gw_node *gw_node;
357 
358 	if (gateway->bandwidth_down == 0)
359 		return;
360 
361 	gw_node = kzalloc(sizeof(*gw_node), GFP_ATOMIC);
362 	if (!gw_node)
363 		return;
364 
365 	kref_init(&gw_node->refcount);
366 	INIT_HLIST_NODE(&gw_node->list);
367 	kref_get(&orig_node->refcount);
368 	gw_node->orig_node = orig_node;
369 	gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
370 	gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
371 
372 	spin_lock_bh(&bat_priv->gw.list_lock);
373 	kref_get(&gw_node->refcount);
374 	hlist_add_head_rcu(&gw_node->list, &bat_priv->gw.gateway_list);
375 	spin_unlock_bh(&bat_priv->gw.list_lock);
376 
377 	batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
378 		   "Found new gateway %pM -> gw bandwidth: %u.%u/%u.%u MBit\n",
379 		   orig_node->orig,
380 		   ntohl(gateway->bandwidth_down) / 10,
381 		   ntohl(gateway->bandwidth_down) % 10,
382 		   ntohl(gateway->bandwidth_up) / 10,
383 		   ntohl(gateway->bandwidth_up) % 10);
384 
385 	/* don't return reference to new gw_node */
386 	batadv_gw_node_put(gw_node);
387 }
388 
389 /**
390  * batadv_gw_node_get() - retrieve gateway node from list of available gateways
391  * @bat_priv: the bat priv with all the soft interface information
392  * @orig_node: originator announcing gateway capabilities
393  *
394  * Return: gateway node if found or NULL otherwise.
395  */
396 struct batadv_gw_node *batadv_gw_node_get(struct batadv_priv *bat_priv,
397 					  struct batadv_orig_node *orig_node)
398 {
399 	struct batadv_gw_node *gw_node_tmp, *gw_node = NULL;
400 
401 	rcu_read_lock();
402 	hlist_for_each_entry_rcu(gw_node_tmp, &bat_priv->gw.gateway_list,
403 				 list) {
404 		if (gw_node_tmp->orig_node != orig_node)
405 			continue;
406 
407 		if (!kref_get_unless_zero(&gw_node_tmp->refcount))
408 			continue;
409 
410 		gw_node = gw_node_tmp;
411 		break;
412 	}
413 	rcu_read_unlock();
414 
415 	return gw_node;
416 }
417 
418 /**
419  * batadv_gw_node_update() - update list of available gateways with changed
420  *  bandwidth information
421  * @bat_priv: the bat priv with all the soft interface information
422  * @orig_node: originator announcing gateway capabilities
423  * @gateway: announced bandwidth information
424  */
425 void batadv_gw_node_update(struct batadv_priv *bat_priv,
426 			   struct batadv_orig_node *orig_node,
427 			   struct batadv_tvlv_gateway_data *gateway)
428 {
429 	struct batadv_gw_node *gw_node, *curr_gw = NULL;
430 
431 	gw_node = batadv_gw_node_get(bat_priv, orig_node);
432 	if (!gw_node) {
433 		batadv_gw_node_add(bat_priv, orig_node, gateway);
434 		goto out;
435 	}
436 
437 	if (gw_node->bandwidth_down == ntohl(gateway->bandwidth_down) &&
438 	    gw_node->bandwidth_up == ntohl(gateway->bandwidth_up))
439 		goto out;
440 
441 	batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
442 		   "Gateway bandwidth of originator %pM changed from %u.%u/%u.%u MBit to %u.%u/%u.%u MBit\n",
443 		   orig_node->orig,
444 		   gw_node->bandwidth_down / 10,
445 		   gw_node->bandwidth_down % 10,
446 		   gw_node->bandwidth_up / 10,
447 		   gw_node->bandwidth_up % 10,
448 		   ntohl(gateway->bandwidth_down) / 10,
449 		   ntohl(gateway->bandwidth_down) % 10,
450 		   ntohl(gateway->bandwidth_up) / 10,
451 		   ntohl(gateway->bandwidth_up) % 10);
452 
453 	gw_node->bandwidth_down = ntohl(gateway->bandwidth_down);
454 	gw_node->bandwidth_up = ntohl(gateway->bandwidth_up);
455 
456 	if (ntohl(gateway->bandwidth_down) == 0) {
457 		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
458 			   "Gateway %pM removed from gateway list\n",
459 			   orig_node->orig);
460 
461 		/* Note: We don't need a NULL check here, since curr_gw never
462 		 * gets dereferenced.
463 		 */
464 		spin_lock_bh(&bat_priv->gw.list_lock);
465 		if (!hlist_unhashed(&gw_node->list)) {
466 			hlist_del_init_rcu(&gw_node->list);
467 			batadv_gw_node_put(gw_node);
468 		}
469 		spin_unlock_bh(&bat_priv->gw.list_lock);
470 
471 		curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
472 		if (gw_node == curr_gw)
473 			batadv_gw_reselect(bat_priv);
474 
475 		if (curr_gw)
476 			batadv_gw_node_put(curr_gw);
477 	}
478 
479 out:
480 	if (gw_node)
481 		batadv_gw_node_put(gw_node);
482 }
483 
484 /**
485  * batadv_gw_node_delete() - Remove orig_node from gateway list
486  * @bat_priv: the bat priv with all the soft interface information
487  * @orig_node: orig node which is currently in process of being removed
488  */
489 void batadv_gw_node_delete(struct batadv_priv *bat_priv,
490 			   struct batadv_orig_node *orig_node)
491 {
492 	struct batadv_tvlv_gateway_data gateway;
493 
494 	gateway.bandwidth_down = 0;
495 	gateway.bandwidth_up = 0;
496 
497 	batadv_gw_node_update(bat_priv, orig_node, &gateway);
498 }
499 
500 /**
501  * batadv_gw_node_free() - Free gateway information from soft interface
502  * @bat_priv: the bat priv with all the soft interface information
503  */
504 void batadv_gw_node_free(struct batadv_priv *bat_priv)
505 {
506 	struct batadv_gw_node *gw_node;
507 	struct hlist_node *node_tmp;
508 
509 	spin_lock_bh(&bat_priv->gw.list_lock);
510 	hlist_for_each_entry_safe(gw_node, node_tmp,
511 				  &bat_priv->gw.gateway_list, list) {
512 		hlist_del_init_rcu(&gw_node->list);
513 		batadv_gw_node_put(gw_node);
514 	}
515 	spin_unlock_bh(&bat_priv->gw.list_lock);
516 }
517 
518 #ifdef CONFIG_BATMAN_ADV_DEBUGFS
519 
520 /**
521  * batadv_gw_client_seq_print_text() - Print the gateway table in a seq file
522  * @seq: seq file to print on
523  * @offset: not used
524  *
525  * Return: always 0
526  */
527 int batadv_gw_client_seq_print_text(struct seq_file *seq, void *offset)
528 {
529 	struct net_device *net_dev = (struct net_device *)seq->private;
530 	struct batadv_priv *bat_priv = netdev_priv(net_dev);
531 	struct batadv_hard_iface *primary_if;
532 
533 	primary_if = batadv_seq_print_text_primary_if_get(seq);
534 	if (!primary_if)
535 		return 0;
536 
537 	seq_printf(seq, "[B.A.T.M.A.N. adv %s, MainIF/MAC: %s/%pM (%s %s)]\n",
538 		   BATADV_SOURCE_VERSION, primary_if->net_dev->name,
539 		   primary_if->net_dev->dev_addr, net_dev->name,
540 		   bat_priv->algo_ops->name);
541 
542 	batadv_hardif_put(primary_if);
543 
544 	if (!bat_priv->algo_ops->gw.print) {
545 		seq_puts(seq,
546 			 "No printing function for this routing protocol\n");
547 		return 0;
548 	}
549 
550 	bat_priv->algo_ops->gw.print(bat_priv, seq);
551 
552 	return 0;
553 }
554 #endif
555 
556 /**
557  * batadv_gw_dump() - Dump gateways into a message
558  * @msg: Netlink message to dump into
559  * @cb: Control block containing additional options
560  *
561  * Return: Error code, or length of message
562  */
563 int batadv_gw_dump(struct sk_buff *msg, struct netlink_callback *cb)
564 {
565 	struct batadv_hard_iface *primary_if = NULL;
566 	struct net *net = sock_net(cb->skb->sk);
567 	struct net_device *soft_iface;
568 	struct batadv_priv *bat_priv;
569 	int ifindex;
570 	int ret;
571 
572 	ifindex = batadv_netlink_get_ifindex(cb->nlh,
573 					     BATADV_ATTR_MESH_IFINDEX);
574 	if (!ifindex)
575 		return -EINVAL;
576 
577 	soft_iface = dev_get_by_index(net, ifindex);
578 	if (!soft_iface || !batadv_softif_is_valid(soft_iface)) {
579 		ret = -ENODEV;
580 		goto out;
581 	}
582 
583 	bat_priv = netdev_priv(soft_iface);
584 
585 	primary_if = batadv_primary_if_get_selected(bat_priv);
586 	if (!primary_if || primary_if->if_status != BATADV_IF_ACTIVE) {
587 		ret = -ENOENT;
588 		goto out;
589 	}
590 
591 	if (!bat_priv->algo_ops->gw.dump) {
592 		ret = -EOPNOTSUPP;
593 		goto out;
594 	}
595 
596 	bat_priv->algo_ops->gw.dump(msg, cb, bat_priv);
597 
598 	ret = msg->len;
599 
600 out:
601 	if (primary_if)
602 		batadv_hardif_put(primary_if);
603 	if (soft_iface)
604 		dev_put(soft_iface);
605 
606 	return ret;
607 }
608 
609 /**
610  * batadv_gw_dhcp_recipient_get() - check if a packet is a DHCP message
611  * @skb: the packet to check
612  * @header_len: a pointer to the batman-adv header size
613  * @chaddr: buffer where the client address will be stored. Valid
614  *  only if the function returns BATADV_DHCP_TO_CLIENT
615  *
616  * This function may re-allocate the data buffer of the skb passed as argument.
617  *
618  * Return:
619  * - BATADV_DHCP_NO if the packet is not a dhcp message or if there was an error
620  *   while parsing it
621  * - BATADV_DHCP_TO_SERVER if this is a message going to the DHCP server
622  * - BATADV_DHCP_TO_CLIENT if this is a message going to a DHCP client
623  */
624 enum batadv_dhcp_recipient
625 batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len,
626 			     u8 *chaddr)
627 {
628 	enum batadv_dhcp_recipient ret = BATADV_DHCP_NO;
629 	struct ethhdr *ethhdr;
630 	struct iphdr *iphdr;
631 	struct ipv6hdr *ipv6hdr;
632 	struct udphdr *udphdr;
633 	struct vlan_ethhdr *vhdr;
634 	int chaddr_offset;
635 	__be16 proto;
636 	u8 *p;
637 
638 	/* check for ethernet header */
639 	if (!pskb_may_pull(skb, *header_len + ETH_HLEN))
640 		return BATADV_DHCP_NO;
641 
642 	ethhdr = eth_hdr(skb);
643 	proto = ethhdr->h_proto;
644 	*header_len += ETH_HLEN;
645 
646 	/* check for initial vlan header */
647 	if (proto == htons(ETH_P_8021Q)) {
648 		if (!pskb_may_pull(skb, *header_len + VLAN_HLEN))
649 			return BATADV_DHCP_NO;
650 
651 		vhdr = vlan_eth_hdr(skb);
652 		proto = vhdr->h_vlan_encapsulated_proto;
653 		*header_len += VLAN_HLEN;
654 	}
655 
656 	/* check for ip header */
657 	switch (proto) {
658 	case htons(ETH_P_IP):
659 		if (!pskb_may_pull(skb, *header_len + sizeof(*iphdr)))
660 			return BATADV_DHCP_NO;
661 
662 		iphdr = (struct iphdr *)(skb->data + *header_len);
663 		*header_len += iphdr->ihl * 4;
664 
665 		/* check for udp header */
666 		if (iphdr->protocol != IPPROTO_UDP)
667 			return BATADV_DHCP_NO;
668 
669 		break;
670 	case htons(ETH_P_IPV6):
671 		if (!pskb_may_pull(skb, *header_len + sizeof(*ipv6hdr)))
672 			return BATADV_DHCP_NO;
673 
674 		ipv6hdr = (struct ipv6hdr *)(skb->data + *header_len);
675 		*header_len += sizeof(*ipv6hdr);
676 
677 		/* check for udp header */
678 		if (ipv6hdr->nexthdr != IPPROTO_UDP)
679 			return BATADV_DHCP_NO;
680 
681 		break;
682 	default:
683 		return BATADV_DHCP_NO;
684 	}
685 
686 	if (!pskb_may_pull(skb, *header_len + sizeof(*udphdr)))
687 		return BATADV_DHCP_NO;
688 
689 	udphdr = (struct udphdr *)(skb->data + *header_len);
690 	*header_len += sizeof(*udphdr);
691 
692 	/* check for bootp port */
693 	switch (proto) {
694 	case htons(ETH_P_IP):
695 		if (udphdr->dest == htons(67))
696 			ret = BATADV_DHCP_TO_SERVER;
697 		else if (udphdr->source == htons(67))
698 			ret = BATADV_DHCP_TO_CLIENT;
699 		break;
700 	case htons(ETH_P_IPV6):
701 		if (udphdr->dest == htons(547))
702 			ret = BATADV_DHCP_TO_SERVER;
703 		else if (udphdr->source == htons(547))
704 			ret = BATADV_DHCP_TO_CLIENT;
705 		break;
706 	}
707 
708 	chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET;
709 	/* store the client address if the message is going to a client */
710 	if (ret == BATADV_DHCP_TO_CLIENT &&
711 	    pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) {
712 		/* check if the DHCP packet carries an Ethernet DHCP */
713 		p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET;
714 		if (*p != BATADV_DHCP_HTYPE_ETHERNET)
715 			return BATADV_DHCP_NO;
716 
717 		/* check if the DHCP packet carries a valid Ethernet address */
718 		p = skb->data + *header_len + BATADV_DHCP_HLEN_OFFSET;
719 		if (*p != ETH_ALEN)
720 			return BATADV_DHCP_NO;
721 
722 		ether_addr_copy(chaddr, skb->data + chaddr_offset);
723 	}
724 
725 	return ret;
726 }
727 
728 /**
729  * batadv_gw_out_of_range() - check if the dhcp request destination is the best
730  *  gateway
731  * @bat_priv: the bat priv with all the soft interface information
732  * @skb: the outgoing packet
733  *
734  * Check if the skb is a DHCP request and if it is sent to the current best GW
735  * server. Due to topology changes it may be the case that the GW server
736  * previously selected is not the best one anymore.
737  *
738  * This call might reallocate skb data.
739  * Must be invoked only when the DHCP packet is going TO a DHCP SERVER.
740  *
741  * Return: true if the packet destination is unicast and it is not the best gw,
742  * false otherwise.
743  */
744 bool batadv_gw_out_of_range(struct batadv_priv *bat_priv,
745 			    struct sk_buff *skb)
746 {
747 	struct batadv_neigh_node *neigh_curr = NULL;
748 	struct batadv_neigh_node *neigh_old = NULL;
749 	struct batadv_orig_node *orig_dst_node = NULL;
750 	struct batadv_gw_node *gw_node = NULL;
751 	struct batadv_gw_node *curr_gw = NULL;
752 	struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo;
753 	struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
754 	bool out_of_range = false;
755 	u8 curr_tq_avg;
756 	unsigned short vid;
757 
758 	vid = batadv_get_vid(skb, 0);
759 
760 	if (is_multicast_ether_addr(ethhdr->h_dest))
761 		goto out;
762 
763 	orig_dst_node = batadv_transtable_search(bat_priv, ethhdr->h_source,
764 						 ethhdr->h_dest, vid);
765 	if (!orig_dst_node)
766 		goto out;
767 
768 	gw_node = batadv_gw_node_get(bat_priv, orig_dst_node);
769 	if (!gw_node)
770 		goto out;
771 
772 	switch (atomic_read(&bat_priv->gw.mode)) {
773 	case BATADV_GW_MODE_SERVER:
774 		/* If we are a GW then we are our best GW. We can artificially
775 		 * set the tq towards ourself as the maximum value
776 		 */
777 		curr_tq_avg = BATADV_TQ_MAX_VALUE;
778 		break;
779 	case BATADV_GW_MODE_CLIENT:
780 		curr_gw = batadv_gw_get_selected_gw_node(bat_priv);
781 		if (!curr_gw)
782 			goto out;
783 
784 		/* packet is going to our gateway */
785 		if (curr_gw->orig_node == orig_dst_node)
786 			goto out;
787 
788 		/* If the dhcp packet has been sent to a different gw,
789 		 * we have to evaluate whether the old gw is still
790 		 * reliable enough
791 		 */
792 		neigh_curr = batadv_find_router(bat_priv, curr_gw->orig_node,
793 						NULL);
794 		if (!neigh_curr)
795 			goto out;
796 
797 		curr_ifinfo = batadv_neigh_ifinfo_get(neigh_curr,
798 						      BATADV_IF_DEFAULT);
799 		if (!curr_ifinfo)
800 			goto out;
801 
802 		curr_tq_avg = curr_ifinfo->bat_iv.tq_avg;
803 		batadv_neigh_ifinfo_put(curr_ifinfo);
804 
805 		break;
806 	case BATADV_GW_MODE_OFF:
807 	default:
808 		goto out;
809 	}
810 
811 	neigh_old = batadv_find_router(bat_priv, orig_dst_node, NULL);
812 	if (!neigh_old)
813 		goto out;
814 
815 	old_ifinfo = batadv_neigh_ifinfo_get(neigh_old, BATADV_IF_DEFAULT);
816 	if (!old_ifinfo)
817 		goto out;
818 
819 	if ((curr_tq_avg - old_ifinfo->bat_iv.tq_avg) > BATADV_GW_THRESHOLD)
820 		out_of_range = true;
821 	batadv_neigh_ifinfo_put(old_ifinfo);
822 
823 out:
824 	if (orig_dst_node)
825 		batadv_orig_node_put(orig_dst_node);
826 	if (curr_gw)
827 		batadv_gw_node_put(curr_gw);
828 	if (gw_node)
829 		batadv_gw_node_put(gw_node);
830 	if (neigh_old)
831 		batadv_neigh_node_put(neigh_old);
832 	if (neigh_curr)
833 		batadv_neigh_node_put(neigh_curr);
834 	return out_of_range;
835 }
836