1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * SR-IPv6 implementation 4 * 5 * Author: 6 * David Lebrun <david.lebrun@uclouvain.be> 7 */ 8 9 #include <linux/errno.h> 10 #include <linux/types.h> 11 #include <linux/socket.h> 12 #include <linux/net.h> 13 #include <linux/in6.h> 14 #include <linux/slab.h> 15 #include <linux/rhashtable.h> 16 17 #include <net/ipv6.h> 18 #include <net/protocol.h> 19 20 #include <net/seg6.h> 21 #include <net/genetlink.h> 22 #include <linux/seg6.h> 23 #include <linux/seg6_genl.h> 24 #ifdef CONFIG_IPV6_SEG6_HMAC 25 #include <net/seg6_hmac.h> 26 #endif 27 28 bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced) 29 { 30 unsigned int tlv_offset; 31 int max_last_entry; 32 int trailing; 33 34 if (srh->type != IPV6_SRCRT_TYPE_4) 35 return false; 36 37 if (((srh->hdrlen + 1) << 3) != len) 38 return false; 39 40 if (!reduced && srh->segments_left > srh->first_segment) { 41 return false; 42 } else { 43 max_last_entry = (srh->hdrlen / 2) - 1; 44 45 if (srh->first_segment > max_last_entry) 46 return false; 47 48 if (srh->segments_left > srh->first_segment + 1) 49 return false; 50 } 51 52 tlv_offset = sizeof(*srh) + ((srh->first_segment + 1) << 4); 53 54 trailing = len - tlv_offset; 55 if (trailing < 0) 56 return false; 57 58 while (trailing) { 59 struct sr6_tlv *tlv; 60 unsigned int tlv_len; 61 62 if (trailing < sizeof(*tlv)) 63 return false; 64 65 tlv = (struct sr6_tlv *)((unsigned char *)srh + tlv_offset); 66 tlv_len = sizeof(*tlv) + tlv->len; 67 68 trailing -= tlv_len; 69 if (trailing < 0) 70 return false; 71 72 tlv_offset += tlv_len; 73 } 74 75 return true; 76 } 77 78 static struct genl_family seg6_genl_family; 79 80 static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = { 81 [SEG6_ATTR_DST] = { .type = NLA_BINARY, 82 .len = sizeof(struct in6_addr) }, 83 [SEG6_ATTR_DSTLEN] = { .type = NLA_S32, }, 84 [SEG6_ATTR_HMACKEYID] = { .type = NLA_U32, }, 85 [SEG6_ATTR_SECRET] = { .type = NLA_BINARY, }, 86 [SEG6_ATTR_SECRETLEN] = { .type = NLA_U8, }, 87 [SEG6_ATTR_ALGID] = { .type = NLA_U8, }, 88 [SEG6_ATTR_HMACINFO] = { .type = NLA_NESTED, }, 89 }; 90 91 #ifdef CONFIG_IPV6_SEG6_HMAC 92 93 static int seg6_genl_sethmac(struct sk_buff *skb, struct genl_info *info) 94 { 95 struct net *net = genl_info_net(info); 96 struct seg6_pernet_data *sdata; 97 struct seg6_hmac_info *hinfo; 98 u32 hmackeyid; 99 char *secret; 100 int err = 0; 101 u8 algid; 102 u8 slen; 103 104 sdata = seg6_pernet(net); 105 106 if (!info->attrs[SEG6_ATTR_HMACKEYID] || 107 !info->attrs[SEG6_ATTR_SECRETLEN] || 108 !info->attrs[SEG6_ATTR_ALGID]) 109 return -EINVAL; 110 111 hmackeyid = nla_get_u32(info->attrs[SEG6_ATTR_HMACKEYID]); 112 slen = nla_get_u8(info->attrs[SEG6_ATTR_SECRETLEN]); 113 algid = nla_get_u8(info->attrs[SEG6_ATTR_ALGID]); 114 115 if (hmackeyid == 0) 116 return -EINVAL; 117 118 if (slen > SEG6_HMAC_SECRET_LEN) 119 return -EINVAL; 120 121 mutex_lock(&sdata->lock); 122 hinfo = seg6_hmac_info_lookup(net, hmackeyid); 123 124 if (!slen) { 125 err = seg6_hmac_info_del(net, hmackeyid); 126 127 goto out_unlock; 128 } 129 130 if (!info->attrs[SEG6_ATTR_SECRET]) { 131 err = -EINVAL; 132 goto out_unlock; 133 } 134 135 if (hinfo) { 136 err = seg6_hmac_info_del(net, hmackeyid); 137 if (err) 138 goto out_unlock; 139 } 140 141 secret = (char *)nla_data(info->attrs[SEG6_ATTR_SECRET]); 142 143 hinfo = kzalloc(sizeof(*hinfo), GFP_KERNEL); 144 if (!hinfo) { 145 err = -ENOMEM; 146 goto out_unlock; 147 } 148 149 memcpy(hinfo->secret, secret, slen); 150 hinfo->slen = slen; 151 hinfo->alg_id = algid; 152 hinfo->hmackeyid = hmackeyid; 153 154 err = seg6_hmac_info_add(net, hmackeyid, hinfo); 155 if (err) 156 kfree(hinfo); 157 158 out_unlock: 159 mutex_unlock(&sdata->lock); 160 return err; 161 } 162 163 #else 164 165 static int seg6_genl_sethmac(struct sk_buff *skb, struct genl_info *info) 166 { 167 return -ENOTSUPP; 168 } 169 170 #endif 171 172 static int seg6_genl_set_tunsrc(struct sk_buff *skb, struct genl_info *info) 173 { 174 struct net *net = genl_info_net(info); 175 struct in6_addr *val, *t_old, *t_new; 176 struct seg6_pernet_data *sdata; 177 178 sdata = seg6_pernet(net); 179 180 if (!info->attrs[SEG6_ATTR_DST]) 181 return -EINVAL; 182 183 val = nla_data(info->attrs[SEG6_ATTR_DST]); 184 t_new = kmemdup(val, sizeof(*val), GFP_KERNEL); 185 if (!t_new) 186 return -ENOMEM; 187 188 mutex_lock(&sdata->lock); 189 190 t_old = sdata->tun_src; 191 rcu_assign_pointer(sdata->tun_src, t_new); 192 193 mutex_unlock(&sdata->lock); 194 195 synchronize_net(); 196 kfree(t_old); 197 198 return 0; 199 } 200 201 static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info) 202 { 203 struct net *net = genl_info_net(info); 204 struct in6_addr *tun_src; 205 struct sk_buff *msg; 206 void *hdr; 207 208 msg = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 209 if (!msg) 210 return -ENOMEM; 211 212 hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq, 213 &seg6_genl_family, 0, SEG6_CMD_GET_TUNSRC); 214 if (!hdr) 215 goto free_msg; 216 217 rcu_read_lock(); 218 tun_src = rcu_dereference(seg6_pernet(net)->tun_src); 219 220 if (nla_put(msg, SEG6_ATTR_DST, sizeof(struct in6_addr), tun_src)) 221 goto nla_put_failure; 222 223 rcu_read_unlock(); 224 225 genlmsg_end(msg, hdr); 226 return genlmsg_reply(msg, info); 227 228 nla_put_failure: 229 rcu_read_unlock(); 230 free_msg: 231 nlmsg_free(msg); 232 return -ENOMEM; 233 } 234 235 #ifdef CONFIG_IPV6_SEG6_HMAC 236 237 static int __seg6_hmac_fill_info(struct seg6_hmac_info *hinfo, 238 struct sk_buff *msg) 239 { 240 if (nla_put_u32(msg, SEG6_ATTR_HMACKEYID, hinfo->hmackeyid) || 241 nla_put_u8(msg, SEG6_ATTR_SECRETLEN, hinfo->slen) || 242 nla_put(msg, SEG6_ATTR_SECRET, hinfo->slen, hinfo->secret) || 243 nla_put_u8(msg, SEG6_ATTR_ALGID, hinfo->alg_id)) 244 return -1; 245 246 return 0; 247 } 248 249 static int __seg6_genl_dumphmac_element(struct seg6_hmac_info *hinfo, 250 u32 portid, u32 seq, u32 flags, 251 struct sk_buff *skb, u8 cmd) 252 { 253 void *hdr; 254 255 hdr = genlmsg_put(skb, portid, seq, &seg6_genl_family, flags, cmd); 256 if (!hdr) 257 return -ENOMEM; 258 259 if (__seg6_hmac_fill_info(hinfo, skb) < 0) 260 goto nla_put_failure; 261 262 genlmsg_end(skb, hdr); 263 return 0; 264 265 nla_put_failure: 266 genlmsg_cancel(skb, hdr); 267 return -EMSGSIZE; 268 } 269 270 static int seg6_genl_dumphmac_start(struct netlink_callback *cb) 271 { 272 struct net *net = sock_net(cb->skb->sk); 273 struct seg6_pernet_data *sdata; 274 struct rhashtable_iter *iter; 275 276 sdata = seg6_pernet(net); 277 iter = (struct rhashtable_iter *)cb->args[0]; 278 279 if (!iter) { 280 iter = kmalloc(sizeof(*iter), GFP_KERNEL); 281 if (!iter) 282 return -ENOMEM; 283 284 cb->args[0] = (long)iter; 285 } 286 287 rhashtable_walk_enter(&sdata->hmac_infos, iter); 288 289 return 0; 290 } 291 292 static int seg6_genl_dumphmac_done(struct netlink_callback *cb) 293 { 294 struct rhashtable_iter *iter = (struct rhashtable_iter *)cb->args[0]; 295 296 rhashtable_walk_exit(iter); 297 298 kfree(iter); 299 300 return 0; 301 } 302 303 static int seg6_genl_dumphmac(struct sk_buff *skb, struct netlink_callback *cb) 304 { 305 struct rhashtable_iter *iter = (struct rhashtable_iter *)cb->args[0]; 306 struct seg6_hmac_info *hinfo; 307 int ret; 308 309 rhashtable_walk_start(iter); 310 311 for (;;) { 312 hinfo = rhashtable_walk_next(iter); 313 314 if (IS_ERR(hinfo)) { 315 if (PTR_ERR(hinfo) == -EAGAIN) 316 continue; 317 ret = PTR_ERR(hinfo); 318 goto done; 319 } else if (!hinfo) { 320 break; 321 } 322 323 ret = __seg6_genl_dumphmac_element(hinfo, 324 NETLINK_CB(cb->skb).portid, 325 cb->nlh->nlmsg_seq, 326 NLM_F_MULTI, 327 skb, SEG6_CMD_DUMPHMAC); 328 if (ret) 329 goto done; 330 } 331 332 ret = skb->len; 333 334 done: 335 rhashtable_walk_stop(iter); 336 return ret; 337 } 338 339 #else 340 341 static int seg6_genl_dumphmac_start(struct netlink_callback *cb) 342 { 343 return 0; 344 } 345 346 static int seg6_genl_dumphmac_done(struct netlink_callback *cb) 347 { 348 return 0; 349 } 350 351 static int seg6_genl_dumphmac(struct sk_buff *skb, struct netlink_callback *cb) 352 { 353 return -ENOTSUPP; 354 } 355 356 #endif 357 358 static int __net_init seg6_net_init(struct net *net) 359 { 360 struct seg6_pernet_data *sdata; 361 362 sdata = kzalloc(sizeof(*sdata), GFP_KERNEL); 363 if (!sdata) 364 return -ENOMEM; 365 366 mutex_init(&sdata->lock); 367 368 sdata->tun_src = kzalloc(sizeof(*sdata->tun_src), GFP_KERNEL); 369 if (!sdata->tun_src) { 370 kfree(sdata); 371 return -ENOMEM; 372 } 373 374 net->ipv6.seg6_data = sdata; 375 376 #ifdef CONFIG_IPV6_SEG6_HMAC 377 if (seg6_hmac_net_init(net)) { 378 kfree(rcu_dereference_raw(sdata->tun_src)); 379 kfree(sdata); 380 return -ENOMEM; 381 } 382 #endif 383 384 return 0; 385 } 386 387 static void __net_exit seg6_net_exit(struct net *net) 388 { 389 struct seg6_pernet_data *sdata = seg6_pernet(net); 390 391 #ifdef CONFIG_IPV6_SEG6_HMAC 392 seg6_hmac_net_exit(net); 393 #endif 394 395 kfree(rcu_dereference_raw(sdata->tun_src)); 396 kfree(sdata); 397 } 398 399 static struct pernet_operations ip6_segments_ops = { 400 .init = seg6_net_init, 401 .exit = seg6_net_exit, 402 }; 403 404 static const struct genl_ops seg6_genl_ops[] = { 405 { 406 .cmd = SEG6_CMD_SETHMAC, 407 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 408 .doit = seg6_genl_sethmac, 409 .flags = GENL_ADMIN_PERM, 410 }, 411 { 412 .cmd = SEG6_CMD_DUMPHMAC, 413 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 414 .start = seg6_genl_dumphmac_start, 415 .dumpit = seg6_genl_dumphmac, 416 .done = seg6_genl_dumphmac_done, 417 .flags = GENL_ADMIN_PERM, 418 }, 419 { 420 .cmd = SEG6_CMD_SET_TUNSRC, 421 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 422 .doit = seg6_genl_set_tunsrc, 423 .flags = GENL_ADMIN_PERM, 424 }, 425 { 426 .cmd = SEG6_CMD_GET_TUNSRC, 427 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 428 .doit = seg6_genl_get_tunsrc, 429 .flags = GENL_ADMIN_PERM, 430 }, 431 }; 432 433 static struct genl_family seg6_genl_family __ro_after_init = { 434 .hdrsize = 0, 435 .name = SEG6_GENL_NAME, 436 .version = SEG6_GENL_VERSION, 437 .maxattr = SEG6_ATTR_MAX, 438 .policy = seg6_genl_policy, 439 .netnsok = true, 440 .parallel_ops = true, 441 .ops = seg6_genl_ops, 442 .n_ops = ARRAY_SIZE(seg6_genl_ops), 443 .module = THIS_MODULE, 444 }; 445 446 int __init seg6_init(void) 447 { 448 int err; 449 450 err = genl_register_family(&seg6_genl_family); 451 if (err) 452 goto out; 453 454 err = register_pernet_subsys(&ip6_segments_ops); 455 if (err) 456 goto out_unregister_genl; 457 458 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL 459 err = seg6_iptunnel_init(); 460 if (err) 461 goto out_unregister_pernet; 462 463 err = seg6_local_init(); 464 if (err) 465 goto out_unregister_pernet; 466 #endif 467 468 #ifdef CONFIG_IPV6_SEG6_HMAC 469 err = seg6_hmac_init(); 470 if (err) 471 goto out_unregister_iptun; 472 #endif 473 474 pr_info("Segment Routing with IPv6\n"); 475 476 out: 477 return err; 478 #ifdef CONFIG_IPV6_SEG6_HMAC 479 out_unregister_iptun: 480 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL 481 seg6_local_exit(); 482 seg6_iptunnel_exit(); 483 #endif 484 #endif 485 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL 486 out_unregister_pernet: 487 unregister_pernet_subsys(&ip6_segments_ops); 488 #endif 489 out_unregister_genl: 490 genl_unregister_family(&seg6_genl_family); 491 goto out; 492 } 493 494 void seg6_exit(void) 495 { 496 #ifdef CONFIG_IPV6_SEG6_HMAC 497 seg6_hmac_exit(); 498 #endif 499 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL 500 seg6_iptunnel_exit(); 501 #endif 502 unregister_pernet_subsys(&ip6_segments_ops); 503 genl_unregister_family(&seg6_genl_family); 504 } 505