1 // SPDX-License-Identifier: GPL-2.0-only 2 3 #include <linux/if_arp.h> 4 5 #include <net/6lowpan.h> 6 #include <net/mac802154.h> 7 #include <net/ieee802154_netdev.h> 8 9 #include "6lowpan_i.h" 10 11 #define LOWPAN_DISPATCH_FIRST 0xc0 12 #define LOWPAN_DISPATCH_FRAG_MASK 0xf8 13 14 #define LOWPAN_DISPATCH_NALP 0x00 15 #define LOWPAN_DISPATCH_ESC 0x40 16 #define LOWPAN_DISPATCH_HC1 0x42 17 #define LOWPAN_DISPATCH_DFF 0x43 18 #define LOWPAN_DISPATCH_BC0 0x50 19 #define LOWPAN_DISPATCH_MESH 0x80 20 21 static int lowpan_give_skb_to_device(struct sk_buff *skb) 22 { 23 skb->protocol = htons(ETH_P_IPV6); 24 skb->dev->stats.rx_packets++; 25 skb->dev->stats.rx_bytes += skb->len; 26 27 return netif_rx(skb); 28 } 29 30 static int lowpan_rx_handlers_result(struct sk_buff *skb, lowpan_rx_result res) 31 { 32 switch (res) { 33 case RX_CONTINUE: 34 /* nobody cared about this packet */ 35 net_warn_ratelimited("%s: received unknown dispatch\n", 36 __func__); 37 38 fallthrough; 39 case RX_DROP_UNUSABLE: 40 kfree_skb(skb); 41 42 fallthrough; 43 case RX_DROP: 44 return NET_RX_DROP; 45 case RX_QUEUED: 46 return lowpan_give_skb_to_device(skb); 47 default: 48 break; 49 } 50 51 return NET_RX_DROP; 52 } 53 54 static inline bool lowpan_is_frag1(u8 dispatch) 55 { 56 return (dispatch & LOWPAN_DISPATCH_FRAG_MASK) == LOWPAN_DISPATCH_FRAG1; 57 } 58 59 static inline bool lowpan_is_fragn(u8 dispatch) 60 { 61 return (dispatch & LOWPAN_DISPATCH_FRAG_MASK) == LOWPAN_DISPATCH_FRAGN; 62 } 63 64 static lowpan_rx_result lowpan_rx_h_frag(struct sk_buff *skb) 65 { 66 int ret; 67 68 if (!(lowpan_is_frag1(*skb_network_header(skb)) || 69 lowpan_is_fragn(*skb_network_header(skb)))) 70 return RX_CONTINUE; 71 72 ret = lowpan_frag_rcv(skb, *skb_network_header(skb) & 73 LOWPAN_DISPATCH_FRAG_MASK); 74 if (ret == 1) 75 return RX_QUEUED; 76 77 /* Packet is freed by lowpan_frag_rcv on error or put into the frag 78 * bucket. 79 */ 80 return RX_DROP; 81 } 82 83 int lowpan_iphc_decompress(struct sk_buff *skb) 84 { 85 struct ieee802154_hdr hdr; 86 87 if (ieee802154_hdr_peek_addrs(skb, &hdr) < 0) 88 return -EINVAL; 89 90 return lowpan_header_decompress(skb, skb->dev, &hdr.dest, &hdr.source); 91 } 92 93 static lowpan_rx_result lowpan_rx_h_iphc(struct sk_buff *skb) 94 { 95 int ret; 96 97 if (!lowpan_is_iphc(*skb_network_header(skb))) 98 return RX_CONTINUE; 99 100 /* Setting datagram_offset to zero indicates non frag handling 101 * while doing lowpan_header_decompress. 102 */ 103 lowpan_802154_cb(skb)->d_size = 0; 104 105 ret = lowpan_iphc_decompress(skb); 106 if (ret < 0) 107 return RX_DROP_UNUSABLE; 108 109 return RX_QUEUED; 110 } 111 112 lowpan_rx_result lowpan_rx_h_ipv6(struct sk_buff *skb) 113 { 114 if (!lowpan_is_ipv6(*skb_network_header(skb))) 115 return RX_CONTINUE; 116 117 /* Pull off the 1-byte of 6lowpan header. */ 118 skb_pull(skb, 1); 119 return RX_QUEUED; 120 } 121 122 static inline bool lowpan_is_esc(u8 dispatch) 123 { 124 return dispatch == LOWPAN_DISPATCH_ESC; 125 } 126 127 static lowpan_rx_result lowpan_rx_h_esc(struct sk_buff *skb) 128 { 129 if (!lowpan_is_esc(*skb_network_header(skb))) 130 return RX_CONTINUE; 131 132 net_warn_ratelimited("%s: %s\n", skb->dev->name, 133 "6LoWPAN ESC not supported\n"); 134 135 return RX_DROP_UNUSABLE; 136 } 137 138 static inline bool lowpan_is_hc1(u8 dispatch) 139 { 140 return dispatch == LOWPAN_DISPATCH_HC1; 141 } 142 143 static lowpan_rx_result lowpan_rx_h_hc1(struct sk_buff *skb) 144 { 145 if (!lowpan_is_hc1(*skb_network_header(skb))) 146 return RX_CONTINUE; 147 148 net_warn_ratelimited("%s: %s\n", skb->dev->name, 149 "6LoWPAN HC1 not supported\n"); 150 151 return RX_DROP_UNUSABLE; 152 } 153 154 static inline bool lowpan_is_dff(u8 dispatch) 155 { 156 return dispatch == LOWPAN_DISPATCH_DFF; 157 } 158 159 static lowpan_rx_result lowpan_rx_h_dff(struct sk_buff *skb) 160 { 161 if (!lowpan_is_dff(*skb_network_header(skb))) 162 return RX_CONTINUE; 163 164 net_warn_ratelimited("%s: %s\n", skb->dev->name, 165 "6LoWPAN DFF not supported\n"); 166 167 return RX_DROP_UNUSABLE; 168 } 169 170 static inline bool lowpan_is_bc0(u8 dispatch) 171 { 172 return dispatch == LOWPAN_DISPATCH_BC0; 173 } 174 175 static lowpan_rx_result lowpan_rx_h_bc0(struct sk_buff *skb) 176 { 177 if (!lowpan_is_bc0(*skb_network_header(skb))) 178 return RX_CONTINUE; 179 180 net_warn_ratelimited("%s: %s\n", skb->dev->name, 181 "6LoWPAN BC0 not supported\n"); 182 183 return RX_DROP_UNUSABLE; 184 } 185 186 static inline bool lowpan_is_mesh(u8 dispatch) 187 { 188 return (dispatch & LOWPAN_DISPATCH_FIRST) == LOWPAN_DISPATCH_MESH; 189 } 190 191 static lowpan_rx_result lowpan_rx_h_mesh(struct sk_buff *skb) 192 { 193 if (!lowpan_is_mesh(*skb_network_header(skb))) 194 return RX_CONTINUE; 195 196 net_warn_ratelimited("%s: %s\n", skb->dev->name, 197 "6LoWPAN MESH not supported\n"); 198 199 return RX_DROP_UNUSABLE; 200 } 201 202 static int lowpan_invoke_rx_handlers(struct sk_buff *skb) 203 { 204 lowpan_rx_result res; 205 206 #define CALL_RXH(rxh) \ 207 do { \ 208 res = rxh(skb); \ 209 if (res != RX_CONTINUE) \ 210 goto rxh_next; \ 211 } while (0) 212 213 /* likely at first */ 214 CALL_RXH(lowpan_rx_h_iphc); 215 CALL_RXH(lowpan_rx_h_frag); 216 CALL_RXH(lowpan_rx_h_ipv6); 217 CALL_RXH(lowpan_rx_h_esc); 218 CALL_RXH(lowpan_rx_h_hc1); 219 CALL_RXH(lowpan_rx_h_dff); 220 CALL_RXH(lowpan_rx_h_bc0); 221 CALL_RXH(lowpan_rx_h_mesh); 222 223 rxh_next: 224 return lowpan_rx_handlers_result(skb, res); 225 #undef CALL_RXH 226 } 227 228 static inline bool lowpan_is_nalp(u8 dispatch) 229 { 230 return (dispatch & LOWPAN_DISPATCH_FIRST) == LOWPAN_DISPATCH_NALP; 231 } 232 233 /* Lookup for reserved dispatch values at: 234 * https://www.iana.org/assignments/_6lowpan-parameters/_6lowpan-parameters.xhtml#_6lowpan-parameters-1 235 * 236 * Last Updated: 2015-01-22 237 */ 238 static inline bool lowpan_is_reserved(u8 dispatch) 239 { 240 return ((dispatch >= 0x44 && dispatch <= 0x4F) || 241 (dispatch >= 0x51 && dispatch <= 0x5F) || 242 (dispatch >= 0xc8 && dispatch <= 0xdf) || 243 dispatch >= 0xe8); 244 } 245 246 /* lowpan_rx_h_check checks on generic 6LoWPAN requirements 247 * in MAC and 6LoWPAN header. 248 * 249 * Don't manipulate the skb here, it could be shared buffer. 250 */ 251 static inline bool lowpan_rx_h_check(struct sk_buff *skb) 252 { 253 __le16 fc = ieee802154_get_fc_from_skb(skb); 254 255 /* check on ieee802154 conform 6LoWPAN header */ 256 if (!ieee802154_is_data(fc) || 257 !ieee802154_skb_is_intra_pan_addressing(fc, skb)) 258 return false; 259 260 /* check if we can dereference the dispatch */ 261 if (unlikely(!skb->len)) 262 return false; 263 264 if (lowpan_is_nalp(*skb_network_header(skb)) || 265 lowpan_is_reserved(*skb_network_header(skb))) 266 return false; 267 268 return true; 269 } 270 271 static int lowpan_rcv(struct sk_buff *skb, struct net_device *wdev, 272 struct packet_type *pt, struct net_device *orig_wdev) 273 { 274 struct net_device *ldev; 275 276 if (wdev->type != ARPHRD_IEEE802154 || 277 skb->pkt_type == PACKET_OTHERHOST || 278 !lowpan_rx_h_check(skb)) 279 goto drop; 280 281 ldev = wdev->ieee802154_ptr->lowpan_dev; 282 if (!ldev || !netif_running(ldev)) 283 goto drop; 284 285 /* Replacing skb->dev and followed rx handlers will manipulate skb. */ 286 skb = skb_share_check(skb, GFP_ATOMIC); 287 if (!skb) 288 goto out; 289 skb->dev = ldev; 290 291 /* When receive frag1 it's likely that we manipulate the buffer. 292 * When recevie iphc we manipulate the data buffer. So we need 293 * to unshare the buffer. 294 */ 295 if (lowpan_is_frag1(*skb_network_header(skb)) || 296 lowpan_is_iphc(*skb_network_header(skb))) { 297 skb = skb_unshare(skb, GFP_ATOMIC); 298 if (!skb) 299 goto out; 300 } 301 302 return lowpan_invoke_rx_handlers(skb); 303 304 drop: 305 kfree_skb(skb); 306 out: 307 return NET_RX_DROP; 308 } 309 310 static struct packet_type lowpan_packet_type = { 311 .type = htons(ETH_P_IEEE802154), 312 .func = lowpan_rcv, 313 }; 314 315 void lowpan_rx_init(void) 316 { 317 dev_add_pack(&lowpan_packet_type); 318 } 319 320 void lowpan_rx_exit(void) 321 { 322 dev_remove_pack(&lowpan_packet_type); 323 } 324