1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Management Component Transport Protocol (MCTP) - routing 4 * implementation. 5 * 6 * This is currently based on a simple routing table, with no dst cache. The 7 * number of routes should stay fairly small, so the lookup cost is small. 8 * 9 * Copyright (c) 2021 Code Construct 10 * Copyright (c) 2021 Google 11 */ 12 13 #include <linux/idr.h> 14 #include <linux/kconfig.h> 15 #include <linux/mctp.h> 16 #include <linux/netdevice.h> 17 #include <linux/rtnetlink.h> 18 #include <linux/skbuff.h> 19 20 #include <uapi/linux/if_arp.h> 21 22 #include <net/mctp.h> 23 #include <net/mctpdevice.h> 24 #include <net/netlink.h> 25 #include <net/sock.h> 26 27 #include <trace/events/mctp.h> 28 29 static const unsigned int mctp_message_maxlen = 64 * 1024; 30 static const unsigned long mctp_key_lifetime = 6 * CONFIG_HZ; 31 32 static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev); 33 34 /* route output callbacks */ 35 static int mctp_route_discard(struct mctp_route *route, struct sk_buff *skb) 36 { 37 kfree_skb(skb); 38 return 0; 39 } 40 41 static struct mctp_sock *mctp_lookup_bind(struct net *net, struct sk_buff *skb) 42 { 43 struct mctp_skb_cb *cb = mctp_cb(skb); 44 struct mctp_hdr *mh; 45 struct sock *sk; 46 u8 type; 47 48 WARN_ON(!rcu_read_lock_held()); 49 50 /* TODO: look up in skb->cb? */ 51 mh = mctp_hdr(skb); 52 53 if (!skb_headlen(skb)) 54 return NULL; 55 56 type = (*(u8 *)skb->data) & 0x7f; 57 58 sk_for_each_rcu(sk, &net->mctp.binds) { 59 struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk); 60 61 if (msk->bind_net != MCTP_NET_ANY && msk->bind_net != cb->net) 62 continue; 63 64 if (msk->bind_type != type) 65 continue; 66 67 if (!mctp_address_matches(msk->bind_addr, mh->dest)) 68 continue; 69 70 return msk; 71 } 72 73 return NULL; 74 } 75 76 static bool mctp_key_match(struct mctp_sk_key *key, mctp_eid_t local, 77 mctp_eid_t peer, u8 tag) 78 { 79 if (!mctp_address_matches(key->local_addr, local)) 80 return false; 81 82 if (key->peer_addr != peer) 83 return false; 84 85 if (key->tag != tag) 86 return false; 87 88 return true; 89 } 90 91 /* returns a key (with key->lock held, and refcounted), or NULL if no such 92 * key exists. 93 */ 94 static struct mctp_sk_key *mctp_lookup_key(struct net *net, struct sk_buff *skb, 95 mctp_eid_t peer, 96 unsigned long *irqflags) 97 __acquires(&key->lock) 98 { 99 struct mctp_sk_key *key, *ret; 100 unsigned long flags; 101 struct mctp_hdr *mh; 102 u8 tag; 103 104 mh = mctp_hdr(skb); 105 tag = mh->flags_seq_tag & (MCTP_HDR_TAG_MASK | MCTP_HDR_FLAG_TO); 106 107 ret = NULL; 108 spin_lock_irqsave(&net->mctp.keys_lock, flags); 109 110 hlist_for_each_entry(key, &net->mctp.keys, hlist) { 111 if (!mctp_key_match(key, mh->dest, peer, tag)) 112 continue; 113 114 spin_lock(&key->lock); 115 if (key->valid) { 116 refcount_inc(&key->refs); 117 ret = key; 118 break; 119 } 120 spin_unlock(&key->lock); 121 } 122 123 if (ret) { 124 spin_unlock(&net->mctp.keys_lock); 125 *irqflags = flags; 126 } else { 127 spin_unlock_irqrestore(&net->mctp.keys_lock, flags); 128 } 129 130 return ret; 131 } 132 133 static struct mctp_sk_key *mctp_key_alloc(struct mctp_sock *msk, 134 mctp_eid_t local, mctp_eid_t peer, 135 u8 tag, gfp_t gfp) 136 { 137 struct mctp_sk_key *key; 138 139 key = kzalloc(sizeof(*key), gfp); 140 if (!key) 141 return NULL; 142 143 key->peer_addr = peer; 144 key->local_addr = local; 145 key->tag = tag; 146 key->sk = &msk->sk; 147 key->valid = true; 148 spin_lock_init(&key->lock); 149 refcount_set(&key->refs, 1); 150 151 return key; 152 } 153 154 void mctp_key_unref(struct mctp_sk_key *key) 155 { 156 unsigned long flags; 157 158 if (!refcount_dec_and_test(&key->refs)) 159 return; 160 161 /* even though no refs exist here, the lock allows us to stay 162 * consistent with the locking requirement of mctp_dev_release_key 163 */ 164 spin_lock_irqsave(&key->lock, flags); 165 mctp_dev_release_key(key->dev, key); 166 spin_unlock_irqrestore(&key->lock, flags); 167 168 kfree(key); 169 } 170 171 static int mctp_key_add(struct mctp_sk_key *key, struct mctp_sock *msk) 172 { 173 struct net *net = sock_net(&msk->sk); 174 struct mctp_sk_key *tmp; 175 unsigned long flags; 176 int rc = 0; 177 178 spin_lock_irqsave(&net->mctp.keys_lock, flags); 179 180 hlist_for_each_entry(tmp, &net->mctp.keys, hlist) { 181 if (mctp_key_match(tmp, key->local_addr, key->peer_addr, 182 key->tag)) { 183 spin_lock(&tmp->lock); 184 if (tmp->valid) 185 rc = -EEXIST; 186 spin_unlock(&tmp->lock); 187 if (rc) 188 break; 189 } 190 } 191 192 if (!rc) { 193 refcount_inc(&key->refs); 194 key->expiry = jiffies + mctp_key_lifetime; 195 timer_reduce(&msk->key_expiry, key->expiry); 196 197 hlist_add_head(&key->hlist, &net->mctp.keys); 198 hlist_add_head(&key->sklist, &msk->keys); 199 } 200 201 spin_unlock_irqrestore(&net->mctp.keys_lock, flags); 202 203 return rc; 204 } 205 206 /* Helper for mctp_route_input(). 207 * We're done with the key; unlock and unref the key. 208 * For the usual case of automatic expiry we remove the key from lists. 209 * In the case that manual allocation is set on a key we release the lock 210 * and local ref, reset reassembly, but don't remove from lists. 211 */ 212 static void __mctp_key_done_in(struct mctp_sk_key *key, struct net *net, 213 unsigned long flags, unsigned long reason) 214 __releases(&key->lock) 215 { 216 struct sk_buff *skb; 217 218 trace_mctp_key_release(key, reason); 219 skb = key->reasm_head; 220 key->reasm_head = NULL; 221 222 if (!key->manual_alloc) { 223 key->reasm_dead = true; 224 key->valid = false; 225 mctp_dev_release_key(key->dev, key); 226 } 227 spin_unlock_irqrestore(&key->lock, flags); 228 229 if (!key->manual_alloc) { 230 spin_lock_irqsave(&net->mctp.keys_lock, flags); 231 hlist_del(&key->hlist); 232 hlist_del(&key->sklist); 233 spin_unlock_irqrestore(&net->mctp.keys_lock, flags); 234 235 /* unref for the lists */ 236 mctp_key_unref(key); 237 } 238 239 /* and one for the local reference */ 240 mctp_key_unref(key); 241 242 kfree_skb(skb); 243 } 244 245 #ifdef CONFIG_MCTP_FLOWS 246 static void mctp_skb_set_flow(struct sk_buff *skb, struct mctp_sk_key *key) 247 { 248 struct mctp_flow *flow; 249 250 flow = skb_ext_add(skb, SKB_EXT_MCTP); 251 if (!flow) 252 return; 253 254 refcount_inc(&key->refs); 255 flow->key = key; 256 } 257 258 static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) 259 { 260 struct mctp_sk_key *key; 261 struct mctp_flow *flow; 262 263 flow = skb_ext_find(skb, SKB_EXT_MCTP); 264 if (!flow) 265 return; 266 267 key = flow->key; 268 269 if (WARN_ON(key->dev && key->dev != dev)) 270 return; 271 272 mctp_dev_set_key(dev, key); 273 } 274 #else 275 static void mctp_skb_set_flow(struct sk_buff *skb, struct mctp_sk_key *key) {} 276 static void mctp_flow_prepare_output(struct sk_buff *skb, struct mctp_dev *dev) {} 277 #endif 278 279 static int mctp_frag_queue(struct mctp_sk_key *key, struct sk_buff *skb) 280 { 281 struct mctp_hdr *hdr = mctp_hdr(skb); 282 u8 exp_seq, this_seq; 283 284 this_seq = (hdr->flags_seq_tag >> MCTP_HDR_SEQ_SHIFT) 285 & MCTP_HDR_SEQ_MASK; 286 287 if (!key->reasm_head) { 288 key->reasm_head = skb; 289 key->reasm_tailp = &(skb_shinfo(skb)->frag_list); 290 key->last_seq = this_seq; 291 return 0; 292 } 293 294 exp_seq = (key->last_seq + 1) & MCTP_HDR_SEQ_MASK; 295 296 if (this_seq != exp_seq) 297 return -EINVAL; 298 299 if (key->reasm_head->len + skb->len > mctp_message_maxlen) 300 return -EINVAL; 301 302 skb->next = NULL; 303 skb->sk = NULL; 304 *key->reasm_tailp = skb; 305 key->reasm_tailp = &skb->next; 306 307 key->last_seq = this_seq; 308 309 key->reasm_head->data_len += skb->len; 310 key->reasm_head->len += skb->len; 311 key->reasm_head->truesize += skb->truesize; 312 313 return 0; 314 } 315 316 static int mctp_route_input(struct mctp_route *route, struct sk_buff *skb) 317 { 318 struct net *net = dev_net(skb->dev); 319 struct mctp_sk_key *key; 320 struct mctp_sock *msk; 321 struct mctp_hdr *mh; 322 unsigned long f; 323 u8 tag, flags; 324 int rc; 325 326 msk = NULL; 327 rc = -EINVAL; 328 329 /* we may be receiving a locally-routed packet; drop source sk 330 * accounting 331 */ 332 skb_orphan(skb); 333 334 /* ensure we have enough data for a header and a type */ 335 if (skb->len < sizeof(struct mctp_hdr) + 1) 336 goto out; 337 338 /* grab header, advance data ptr */ 339 mh = mctp_hdr(skb); 340 skb_pull(skb, sizeof(struct mctp_hdr)); 341 342 if (mh->ver != 1) 343 goto out; 344 345 flags = mh->flags_seq_tag & (MCTP_HDR_FLAG_SOM | MCTP_HDR_FLAG_EOM); 346 tag = mh->flags_seq_tag & (MCTP_HDR_TAG_MASK | MCTP_HDR_FLAG_TO); 347 348 rcu_read_lock(); 349 350 /* lookup socket / reasm context, exactly matching (src,dest,tag). 351 * we hold a ref on the key, and key->lock held. 352 */ 353 key = mctp_lookup_key(net, skb, mh->src, &f); 354 355 if (flags & MCTP_HDR_FLAG_SOM) { 356 if (key) { 357 msk = container_of(key->sk, struct mctp_sock, sk); 358 } else { 359 /* first response to a broadcast? do a more general 360 * key lookup to find the socket, but don't use this 361 * key for reassembly - we'll create a more specific 362 * one for future packets if required (ie, !EOM). 363 */ 364 key = mctp_lookup_key(net, skb, MCTP_ADDR_ANY, &f); 365 if (key) { 366 msk = container_of(key->sk, 367 struct mctp_sock, sk); 368 spin_unlock_irqrestore(&key->lock, f); 369 mctp_key_unref(key); 370 key = NULL; 371 } 372 } 373 374 if (!key && !msk && (tag & MCTP_HDR_FLAG_TO)) 375 msk = mctp_lookup_bind(net, skb); 376 377 if (!msk) { 378 rc = -ENOENT; 379 goto out_unlock; 380 } 381 382 /* single-packet message? deliver to socket, clean up any 383 * pending key. 384 */ 385 if (flags & MCTP_HDR_FLAG_EOM) { 386 sock_queue_rcv_skb(&msk->sk, skb); 387 if (key) { 388 /* we've hit a pending reassembly; not much we 389 * can do but drop it 390 */ 391 __mctp_key_done_in(key, net, f, 392 MCTP_TRACE_KEY_REPLIED); 393 key = NULL; 394 } 395 rc = 0; 396 goto out_unlock; 397 } 398 399 /* broadcast response or a bind() - create a key for further 400 * packets for this message 401 */ 402 if (!key) { 403 key = mctp_key_alloc(msk, mh->dest, mh->src, 404 tag, GFP_ATOMIC); 405 if (!key) { 406 rc = -ENOMEM; 407 goto out_unlock; 408 } 409 410 /* we can queue without the key lock here, as the 411 * key isn't observable yet 412 */ 413 mctp_frag_queue(key, skb); 414 415 /* if the key_add fails, we've raced with another 416 * SOM packet with the same src, dest and tag. There's 417 * no way to distinguish future packets, so all we 418 * can do is drop; we'll free the skb on exit from 419 * this function. 420 */ 421 rc = mctp_key_add(key, msk); 422 if (rc) { 423 kfree(key); 424 } else { 425 trace_mctp_key_acquire(key); 426 427 /* we don't need to release key->lock on exit */ 428 mctp_key_unref(key); 429 } 430 key = NULL; 431 432 } else { 433 if (key->reasm_head || key->reasm_dead) { 434 /* duplicate start? drop everything */ 435 __mctp_key_done_in(key, net, f, 436 MCTP_TRACE_KEY_INVALIDATED); 437 rc = -EEXIST; 438 key = NULL; 439 } else { 440 rc = mctp_frag_queue(key, skb); 441 } 442 } 443 444 } else if (key) { 445 /* this packet continues a previous message; reassemble 446 * using the message-specific key 447 */ 448 449 /* we need to be continuing an existing reassembly... */ 450 if (!key->reasm_head) 451 rc = -EINVAL; 452 else 453 rc = mctp_frag_queue(key, skb); 454 455 /* end of message? deliver to socket, and we're done with 456 * the reassembly/response key 457 */ 458 if (!rc && flags & MCTP_HDR_FLAG_EOM) { 459 msk = container_of(key->sk, struct mctp_sock, sk); 460 sock_queue_rcv_skb(key->sk, key->reasm_head); 461 key->reasm_head = NULL; 462 __mctp_key_done_in(key, net, f, MCTP_TRACE_KEY_REPLIED); 463 key = NULL; 464 } 465 466 } else { 467 /* not a start, no matching key */ 468 rc = -ENOENT; 469 } 470 471 out_unlock: 472 rcu_read_unlock(); 473 if (key) { 474 spin_unlock_irqrestore(&key->lock, f); 475 mctp_key_unref(key); 476 } 477 out: 478 if (rc) 479 kfree_skb(skb); 480 return rc; 481 } 482 483 static unsigned int mctp_route_mtu(struct mctp_route *rt) 484 { 485 return rt->mtu ?: READ_ONCE(rt->dev->dev->mtu); 486 } 487 488 static int mctp_route_output(struct mctp_route *route, struct sk_buff *skb) 489 { 490 struct mctp_skb_cb *cb = mctp_cb(skb); 491 struct mctp_hdr *hdr = mctp_hdr(skb); 492 char daddr_buf[MAX_ADDR_LEN]; 493 char *daddr = NULL; 494 unsigned int mtu; 495 int rc; 496 497 skb->protocol = htons(ETH_P_MCTP); 498 499 mtu = READ_ONCE(skb->dev->mtu); 500 if (skb->len > mtu) { 501 kfree_skb(skb); 502 return -EMSGSIZE; 503 } 504 505 if (cb->ifindex) { 506 /* direct route; use the hwaddr we stashed in sendmsg */ 507 daddr = cb->haddr; 508 } else { 509 /* If lookup fails let the device handle daddr==NULL */ 510 if (mctp_neigh_lookup(route->dev, hdr->dest, daddr_buf) == 0) 511 daddr = daddr_buf; 512 } 513 514 rc = dev_hard_header(skb, skb->dev, ntohs(skb->protocol), 515 daddr, skb->dev->dev_addr, skb->len); 516 if (rc) { 517 kfree_skb(skb); 518 return -EHOSTUNREACH; 519 } 520 521 mctp_flow_prepare_output(skb, route->dev); 522 523 rc = dev_queue_xmit(skb); 524 if (rc) 525 rc = net_xmit_errno(rc); 526 527 return rc; 528 } 529 530 /* route alloc/release */ 531 static void mctp_route_release(struct mctp_route *rt) 532 { 533 if (refcount_dec_and_test(&rt->refs)) { 534 mctp_dev_put(rt->dev); 535 kfree_rcu(rt, rcu); 536 } 537 } 538 539 /* returns a route with the refcount at 1 */ 540 static struct mctp_route *mctp_route_alloc(void) 541 { 542 struct mctp_route *rt; 543 544 rt = kzalloc(sizeof(*rt), GFP_KERNEL); 545 if (!rt) 546 return NULL; 547 548 INIT_LIST_HEAD(&rt->list); 549 refcount_set(&rt->refs, 1); 550 rt->output = mctp_route_discard; 551 552 return rt; 553 } 554 555 unsigned int mctp_default_net(struct net *net) 556 { 557 return READ_ONCE(net->mctp.default_net); 558 } 559 560 int mctp_default_net_set(struct net *net, unsigned int index) 561 { 562 if (index == 0) 563 return -EINVAL; 564 WRITE_ONCE(net->mctp.default_net, index); 565 return 0; 566 } 567 568 /* tag management */ 569 static void mctp_reserve_tag(struct net *net, struct mctp_sk_key *key, 570 struct mctp_sock *msk) 571 { 572 struct netns_mctp *mns = &net->mctp; 573 574 lockdep_assert_held(&mns->keys_lock); 575 576 key->expiry = jiffies + mctp_key_lifetime; 577 timer_reduce(&msk->key_expiry, key->expiry); 578 579 /* we hold the net->key_lock here, allowing updates to both 580 * then net and sk 581 */ 582 hlist_add_head_rcu(&key->hlist, &mns->keys); 583 hlist_add_head_rcu(&key->sklist, &msk->keys); 584 refcount_inc(&key->refs); 585 } 586 587 /* Allocate a locally-owned tag value for (saddr, daddr), and reserve 588 * it for the socket msk 589 */ 590 struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk, 591 mctp_eid_t daddr, mctp_eid_t saddr, 592 bool manual, u8 *tagp) 593 { 594 struct net *net = sock_net(&msk->sk); 595 struct netns_mctp *mns = &net->mctp; 596 struct mctp_sk_key *key, *tmp; 597 unsigned long flags; 598 u8 tagbits; 599 600 /* for NULL destination EIDs, we may get a response from any peer */ 601 if (daddr == MCTP_ADDR_NULL) 602 daddr = MCTP_ADDR_ANY; 603 604 /* be optimistic, alloc now */ 605 key = mctp_key_alloc(msk, saddr, daddr, 0, GFP_KERNEL); 606 if (!key) 607 return ERR_PTR(-ENOMEM); 608 609 /* 8 possible tag values */ 610 tagbits = 0xff; 611 612 spin_lock_irqsave(&mns->keys_lock, flags); 613 614 /* Walk through the existing keys, looking for potential conflicting 615 * tags. If we find a conflict, clear that bit from tagbits 616 */ 617 hlist_for_each_entry(tmp, &mns->keys, hlist) { 618 /* We can check the lookup fields (*_addr, tag) without the 619 * lock held, they don't change over the lifetime of the key. 620 */ 621 622 /* if we don't own the tag, it can't conflict */ 623 if (tmp->tag & MCTP_HDR_FLAG_TO) 624 continue; 625 626 if (!(mctp_address_matches(tmp->peer_addr, daddr) && 627 mctp_address_matches(tmp->local_addr, saddr))) 628 continue; 629 630 spin_lock(&tmp->lock); 631 /* key must still be valid. If we find a match, clear the 632 * potential tag value 633 */ 634 if (tmp->valid) 635 tagbits &= ~(1 << tmp->tag); 636 spin_unlock(&tmp->lock); 637 638 if (!tagbits) 639 break; 640 } 641 642 if (tagbits) { 643 key->tag = __ffs(tagbits); 644 mctp_reserve_tag(net, key, msk); 645 trace_mctp_key_acquire(key); 646 647 key->manual_alloc = manual; 648 *tagp = key->tag; 649 } 650 651 spin_unlock_irqrestore(&mns->keys_lock, flags); 652 653 if (!tagbits) { 654 kfree(key); 655 return ERR_PTR(-EBUSY); 656 } 657 658 return key; 659 } 660 661 static struct mctp_sk_key *mctp_lookup_prealloc_tag(struct mctp_sock *msk, 662 mctp_eid_t daddr, 663 u8 req_tag, u8 *tagp) 664 { 665 struct net *net = sock_net(&msk->sk); 666 struct netns_mctp *mns = &net->mctp; 667 struct mctp_sk_key *key, *tmp; 668 unsigned long flags; 669 670 req_tag &= ~(MCTP_TAG_PREALLOC | MCTP_TAG_OWNER); 671 key = NULL; 672 673 spin_lock_irqsave(&mns->keys_lock, flags); 674 675 hlist_for_each_entry(tmp, &mns->keys, hlist) { 676 if (tmp->tag != req_tag) 677 continue; 678 679 if (!mctp_address_matches(tmp->peer_addr, daddr)) 680 continue; 681 682 if (!tmp->manual_alloc) 683 continue; 684 685 spin_lock(&tmp->lock); 686 if (tmp->valid) { 687 key = tmp; 688 refcount_inc(&key->refs); 689 spin_unlock(&tmp->lock); 690 break; 691 } 692 spin_unlock(&tmp->lock); 693 } 694 spin_unlock_irqrestore(&mns->keys_lock, flags); 695 696 if (!key) 697 return ERR_PTR(-ENOENT); 698 699 if (tagp) 700 *tagp = key->tag; 701 702 return key; 703 } 704 705 /* routing lookups */ 706 static bool mctp_rt_match_eid(struct mctp_route *rt, 707 unsigned int net, mctp_eid_t eid) 708 { 709 return READ_ONCE(rt->dev->net) == net && 710 rt->min <= eid && rt->max >= eid; 711 } 712 713 /* compares match, used for duplicate prevention */ 714 static bool mctp_rt_compare_exact(struct mctp_route *rt1, 715 struct mctp_route *rt2) 716 { 717 ASSERT_RTNL(); 718 return rt1->dev->net == rt2->dev->net && 719 rt1->min == rt2->min && 720 rt1->max == rt2->max; 721 } 722 723 struct mctp_route *mctp_route_lookup(struct net *net, unsigned int dnet, 724 mctp_eid_t daddr) 725 { 726 struct mctp_route *tmp, *rt = NULL; 727 728 list_for_each_entry_rcu(tmp, &net->mctp.routes, list) { 729 /* TODO: add metrics */ 730 if (mctp_rt_match_eid(tmp, dnet, daddr)) { 731 if (refcount_inc_not_zero(&tmp->refs)) { 732 rt = tmp; 733 break; 734 } 735 } 736 } 737 738 return rt; 739 } 740 741 static struct mctp_route *mctp_route_lookup_null(struct net *net, 742 struct net_device *dev) 743 { 744 struct mctp_route *rt; 745 746 list_for_each_entry_rcu(rt, &net->mctp.routes, list) { 747 if (rt->dev->dev == dev && rt->type == RTN_LOCAL && 748 refcount_inc_not_zero(&rt->refs)) 749 return rt; 750 } 751 752 return NULL; 753 } 754 755 static int mctp_do_fragment_route(struct mctp_route *rt, struct sk_buff *skb, 756 unsigned int mtu, u8 tag) 757 { 758 const unsigned int hlen = sizeof(struct mctp_hdr); 759 struct mctp_hdr *hdr, *hdr2; 760 unsigned int pos, size; 761 struct sk_buff *skb2; 762 int rc; 763 u8 seq; 764 765 hdr = mctp_hdr(skb); 766 seq = 0; 767 rc = 0; 768 769 if (mtu < hlen + 1) { 770 kfree_skb(skb); 771 return -EMSGSIZE; 772 } 773 774 /* we've got the header */ 775 skb_pull(skb, hlen); 776 777 for (pos = 0; pos < skb->len;) { 778 /* size of message payload */ 779 size = min(mtu - hlen, skb->len - pos); 780 781 skb2 = alloc_skb(MCTP_HEADER_MAXLEN + hlen + size, GFP_KERNEL); 782 if (!skb2) { 783 rc = -ENOMEM; 784 break; 785 } 786 787 /* generic skb copy */ 788 skb2->protocol = skb->protocol; 789 skb2->priority = skb->priority; 790 skb2->dev = skb->dev; 791 memcpy(skb2->cb, skb->cb, sizeof(skb2->cb)); 792 793 if (skb->sk) 794 skb_set_owner_w(skb2, skb->sk); 795 796 /* establish packet */ 797 skb_reserve(skb2, MCTP_HEADER_MAXLEN); 798 skb_reset_network_header(skb2); 799 skb_put(skb2, hlen + size); 800 skb2->transport_header = skb2->network_header + hlen; 801 802 /* copy header fields, calculate SOM/EOM flags & seq */ 803 hdr2 = mctp_hdr(skb2); 804 hdr2->ver = hdr->ver; 805 hdr2->dest = hdr->dest; 806 hdr2->src = hdr->src; 807 hdr2->flags_seq_tag = tag & 808 (MCTP_HDR_TAG_MASK | MCTP_HDR_FLAG_TO); 809 810 if (pos == 0) 811 hdr2->flags_seq_tag |= MCTP_HDR_FLAG_SOM; 812 813 if (pos + size == skb->len) 814 hdr2->flags_seq_tag |= MCTP_HDR_FLAG_EOM; 815 816 hdr2->flags_seq_tag |= seq << MCTP_HDR_SEQ_SHIFT; 817 818 /* copy message payload */ 819 skb_copy_bits(skb, pos, skb_transport_header(skb2), size); 820 821 /* do route */ 822 rc = rt->output(rt, skb2); 823 if (rc) 824 break; 825 826 seq = (seq + 1) & MCTP_HDR_SEQ_MASK; 827 pos += size; 828 } 829 830 consume_skb(skb); 831 return rc; 832 } 833 834 int mctp_local_output(struct sock *sk, struct mctp_route *rt, 835 struct sk_buff *skb, mctp_eid_t daddr, u8 req_tag) 836 { 837 struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk); 838 struct mctp_skb_cb *cb = mctp_cb(skb); 839 struct mctp_route tmp_rt = {0}; 840 struct mctp_sk_key *key; 841 struct mctp_hdr *hdr; 842 unsigned long flags; 843 unsigned int mtu; 844 mctp_eid_t saddr; 845 bool ext_rt; 846 int rc; 847 u8 tag; 848 849 rc = -ENODEV; 850 851 if (rt) { 852 ext_rt = false; 853 if (WARN_ON(!rt->dev)) 854 goto out_release; 855 856 } else if (cb->ifindex) { 857 struct net_device *dev; 858 859 ext_rt = true; 860 rt = &tmp_rt; 861 862 rcu_read_lock(); 863 dev = dev_get_by_index_rcu(sock_net(sk), cb->ifindex); 864 if (!dev) { 865 rcu_read_unlock(); 866 return rc; 867 } 868 rt->dev = __mctp_dev_get(dev); 869 rcu_read_unlock(); 870 871 if (!rt->dev) 872 goto out_release; 873 874 /* establish temporary route - we set up enough to keep 875 * mctp_route_output happy 876 */ 877 rt->output = mctp_route_output; 878 rt->mtu = 0; 879 880 } else { 881 return -EINVAL; 882 } 883 884 spin_lock_irqsave(&rt->dev->addrs_lock, flags); 885 if (rt->dev->num_addrs == 0) { 886 rc = -EHOSTUNREACH; 887 } else { 888 /* use the outbound interface's first address as our source */ 889 saddr = rt->dev->addrs[0]; 890 rc = 0; 891 } 892 spin_unlock_irqrestore(&rt->dev->addrs_lock, flags); 893 894 if (rc) 895 goto out_release; 896 897 if (req_tag & MCTP_TAG_OWNER) { 898 if (req_tag & MCTP_TAG_PREALLOC) 899 key = mctp_lookup_prealloc_tag(msk, daddr, 900 req_tag, &tag); 901 else 902 key = mctp_alloc_local_tag(msk, daddr, saddr, 903 false, &tag); 904 905 if (IS_ERR(key)) { 906 rc = PTR_ERR(key); 907 goto out_release; 908 } 909 mctp_skb_set_flow(skb, key); 910 /* done with the key in this scope */ 911 mctp_key_unref(key); 912 tag |= MCTP_HDR_FLAG_TO; 913 } else { 914 key = NULL; 915 tag = req_tag & MCTP_TAG_MASK; 916 } 917 918 skb->protocol = htons(ETH_P_MCTP); 919 skb->priority = 0; 920 skb_reset_transport_header(skb); 921 skb_push(skb, sizeof(struct mctp_hdr)); 922 skb_reset_network_header(skb); 923 skb->dev = rt->dev->dev; 924 925 /* cb->net will have been set on initial ingress */ 926 cb->src = saddr; 927 928 /* set up common header fields */ 929 hdr = mctp_hdr(skb); 930 hdr->ver = 1; 931 hdr->dest = daddr; 932 hdr->src = saddr; 933 934 mtu = mctp_route_mtu(rt); 935 936 if (skb->len + sizeof(struct mctp_hdr) <= mtu) { 937 hdr->flags_seq_tag = MCTP_HDR_FLAG_SOM | 938 MCTP_HDR_FLAG_EOM | tag; 939 rc = rt->output(rt, skb); 940 } else { 941 rc = mctp_do_fragment_route(rt, skb, mtu, tag); 942 } 943 944 out_release: 945 if (!ext_rt) 946 mctp_route_release(rt); 947 948 mctp_dev_put(tmp_rt.dev); 949 950 return rc; 951 } 952 953 /* route management */ 954 static int mctp_route_add(struct mctp_dev *mdev, mctp_eid_t daddr_start, 955 unsigned int daddr_extent, unsigned int mtu, 956 unsigned char type) 957 { 958 int (*rtfn)(struct mctp_route *rt, struct sk_buff *skb); 959 struct net *net = dev_net(mdev->dev); 960 struct mctp_route *rt, *ert; 961 962 if (!mctp_address_unicast(daddr_start)) 963 return -EINVAL; 964 965 if (daddr_extent > 0xff || daddr_start + daddr_extent >= 255) 966 return -EINVAL; 967 968 switch (type) { 969 case RTN_LOCAL: 970 rtfn = mctp_route_input; 971 break; 972 case RTN_UNICAST: 973 rtfn = mctp_route_output; 974 break; 975 default: 976 return -EINVAL; 977 } 978 979 rt = mctp_route_alloc(); 980 if (!rt) 981 return -ENOMEM; 982 983 rt->min = daddr_start; 984 rt->max = daddr_start + daddr_extent; 985 rt->mtu = mtu; 986 rt->dev = mdev; 987 mctp_dev_hold(rt->dev); 988 rt->type = type; 989 rt->output = rtfn; 990 991 ASSERT_RTNL(); 992 /* Prevent duplicate identical routes. */ 993 list_for_each_entry(ert, &net->mctp.routes, list) { 994 if (mctp_rt_compare_exact(rt, ert)) { 995 mctp_route_release(rt); 996 return -EEXIST; 997 } 998 } 999 1000 list_add_rcu(&rt->list, &net->mctp.routes); 1001 1002 return 0; 1003 } 1004 1005 static int mctp_route_remove(struct mctp_dev *mdev, mctp_eid_t daddr_start, 1006 unsigned int daddr_extent, unsigned char type) 1007 { 1008 struct net *net = dev_net(mdev->dev); 1009 struct mctp_route *rt, *tmp; 1010 mctp_eid_t daddr_end; 1011 bool dropped; 1012 1013 if (daddr_extent > 0xff || daddr_start + daddr_extent >= 255) 1014 return -EINVAL; 1015 1016 daddr_end = daddr_start + daddr_extent; 1017 dropped = false; 1018 1019 ASSERT_RTNL(); 1020 1021 list_for_each_entry_safe(rt, tmp, &net->mctp.routes, list) { 1022 if (rt->dev == mdev && 1023 rt->min == daddr_start && rt->max == daddr_end && 1024 rt->type == type) { 1025 list_del_rcu(&rt->list); 1026 /* TODO: immediate RTM_DELROUTE */ 1027 mctp_route_release(rt); 1028 dropped = true; 1029 } 1030 } 1031 1032 return dropped ? 0 : -ENOENT; 1033 } 1034 1035 int mctp_route_add_local(struct mctp_dev *mdev, mctp_eid_t addr) 1036 { 1037 return mctp_route_add(mdev, addr, 0, 0, RTN_LOCAL); 1038 } 1039 1040 int mctp_route_remove_local(struct mctp_dev *mdev, mctp_eid_t addr) 1041 { 1042 return mctp_route_remove(mdev, addr, 0, RTN_LOCAL); 1043 } 1044 1045 /* removes all entries for a given device */ 1046 void mctp_route_remove_dev(struct mctp_dev *mdev) 1047 { 1048 struct net *net = dev_net(mdev->dev); 1049 struct mctp_route *rt, *tmp; 1050 1051 ASSERT_RTNL(); 1052 list_for_each_entry_safe(rt, tmp, &net->mctp.routes, list) { 1053 if (rt->dev == mdev) { 1054 list_del_rcu(&rt->list); 1055 /* TODO: immediate RTM_DELROUTE */ 1056 mctp_route_release(rt); 1057 } 1058 } 1059 } 1060 1061 /* Incoming packet-handling */ 1062 1063 static int mctp_pkttype_receive(struct sk_buff *skb, struct net_device *dev, 1064 struct packet_type *pt, 1065 struct net_device *orig_dev) 1066 { 1067 struct net *net = dev_net(dev); 1068 struct mctp_dev *mdev; 1069 struct mctp_skb_cb *cb; 1070 struct mctp_route *rt; 1071 struct mctp_hdr *mh; 1072 1073 rcu_read_lock(); 1074 mdev = __mctp_dev_get(dev); 1075 rcu_read_unlock(); 1076 if (!mdev) { 1077 /* basic non-data sanity checks */ 1078 goto err_drop; 1079 } 1080 1081 if (!pskb_may_pull(skb, sizeof(struct mctp_hdr))) 1082 goto err_drop; 1083 1084 skb_reset_transport_header(skb); 1085 skb_reset_network_header(skb); 1086 1087 /* We have enough for a header; decode and route */ 1088 mh = mctp_hdr(skb); 1089 if (mh->ver < MCTP_VER_MIN || mh->ver > MCTP_VER_MAX) 1090 goto err_drop; 1091 1092 /* source must be valid unicast or null; drop reserved ranges and 1093 * broadcast 1094 */ 1095 if (!(mctp_address_unicast(mh->src) || mctp_address_null(mh->src))) 1096 goto err_drop; 1097 1098 /* dest address: as above, but allow broadcast */ 1099 if (!(mctp_address_unicast(mh->dest) || mctp_address_null(mh->dest) || 1100 mctp_address_broadcast(mh->dest))) 1101 goto err_drop; 1102 1103 /* MCTP drivers must populate halen/haddr */ 1104 if (dev->type == ARPHRD_MCTP) { 1105 cb = mctp_cb(skb); 1106 } else { 1107 cb = __mctp_cb(skb); 1108 cb->halen = 0; 1109 } 1110 cb->net = READ_ONCE(mdev->net); 1111 cb->ifindex = dev->ifindex; 1112 1113 rt = mctp_route_lookup(net, cb->net, mh->dest); 1114 1115 /* NULL EID, but addressed to our physical address */ 1116 if (!rt && mh->dest == MCTP_ADDR_NULL && skb->pkt_type == PACKET_HOST) 1117 rt = mctp_route_lookup_null(net, dev); 1118 1119 if (!rt) 1120 goto err_drop; 1121 1122 rt->output(rt, skb); 1123 mctp_route_release(rt); 1124 mctp_dev_put(mdev); 1125 1126 return NET_RX_SUCCESS; 1127 1128 err_drop: 1129 kfree_skb(skb); 1130 mctp_dev_put(mdev); 1131 return NET_RX_DROP; 1132 } 1133 1134 static struct packet_type mctp_packet_type = { 1135 .type = cpu_to_be16(ETH_P_MCTP), 1136 .func = mctp_pkttype_receive, 1137 }; 1138 1139 /* netlink interface */ 1140 1141 static const struct nla_policy rta_mctp_policy[RTA_MAX + 1] = { 1142 [RTA_DST] = { .type = NLA_U8 }, 1143 [RTA_METRICS] = { .type = NLA_NESTED }, 1144 [RTA_OIF] = { .type = NLA_U32 }, 1145 }; 1146 1147 /* Common part for RTM_NEWROUTE and RTM_DELROUTE parsing. 1148 * tb must hold RTA_MAX+1 elements. 1149 */ 1150 static int mctp_route_nlparse(struct sk_buff *skb, struct nlmsghdr *nlh, 1151 struct netlink_ext_ack *extack, 1152 struct nlattr **tb, struct rtmsg **rtm, 1153 struct mctp_dev **mdev, mctp_eid_t *daddr_start) 1154 { 1155 struct net *net = sock_net(skb->sk); 1156 struct net_device *dev; 1157 unsigned int ifindex; 1158 int rc; 1159 1160 rc = nlmsg_parse(nlh, sizeof(struct rtmsg), tb, RTA_MAX, 1161 rta_mctp_policy, extack); 1162 if (rc < 0) { 1163 NL_SET_ERR_MSG(extack, "incorrect format"); 1164 return rc; 1165 } 1166 1167 if (!tb[RTA_DST]) { 1168 NL_SET_ERR_MSG(extack, "dst EID missing"); 1169 return -EINVAL; 1170 } 1171 *daddr_start = nla_get_u8(tb[RTA_DST]); 1172 1173 if (!tb[RTA_OIF]) { 1174 NL_SET_ERR_MSG(extack, "ifindex missing"); 1175 return -EINVAL; 1176 } 1177 ifindex = nla_get_u32(tb[RTA_OIF]); 1178 1179 *rtm = nlmsg_data(nlh); 1180 if ((*rtm)->rtm_family != AF_MCTP) { 1181 NL_SET_ERR_MSG(extack, "route family must be AF_MCTP"); 1182 return -EINVAL; 1183 } 1184 1185 dev = __dev_get_by_index(net, ifindex); 1186 if (!dev) { 1187 NL_SET_ERR_MSG(extack, "bad ifindex"); 1188 return -ENODEV; 1189 } 1190 *mdev = mctp_dev_get_rtnl(dev); 1191 if (!*mdev) 1192 return -ENODEV; 1193 1194 if (dev->flags & IFF_LOOPBACK) { 1195 NL_SET_ERR_MSG(extack, "no routes to loopback"); 1196 return -EINVAL; 1197 } 1198 1199 return 0; 1200 } 1201 1202 static const struct nla_policy rta_metrics_policy[RTAX_MAX + 1] = { 1203 [RTAX_MTU] = { .type = NLA_U32 }, 1204 }; 1205 1206 static int mctp_newroute(struct sk_buff *skb, struct nlmsghdr *nlh, 1207 struct netlink_ext_ack *extack) 1208 { 1209 struct nlattr *tb[RTA_MAX + 1]; 1210 struct nlattr *tbx[RTAX_MAX + 1]; 1211 mctp_eid_t daddr_start; 1212 struct mctp_dev *mdev; 1213 struct rtmsg *rtm; 1214 unsigned int mtu; 1215 int rc; 1216 1217 rc = mctp_route_nlparse(skb, nlh, extack, tb, 1218 &rtm, &mdev, &daddr_start); 1219 if (rc < 0) 1220 return rc; 1221 1222 if (rtm->rtm_type != RTN_UNICAST) { 1223 NL_SET_ERR_MSG(extack, "rtm_type must be RTN_UNICAST"); 1224 return -EINVAL; 1225 } 1226 1227 mtu = 0; 1228 if (tb[RTA_METRICS]) { 1229 rc = nla_parse_nested(tbx, RTAX_MAX, tb[RTA_METRICS], 1230 rta_metrics_policy, NULL); 1231 if (rc < 0) 1232 return rc; 1233 if (tbx[RTAX_MTU]) 1234 mtu = nla_get_u32(tbx[RTAX_MTU]); 1235 } 1236 1237 if (rtm->rtm_type != RTN_UNICAST) 1238 return -EINVAL; 1239 1240 rc = mctp_route_add(mdev, daddr_start, rtm->rtm_dst_len, mtu, 1241 rtm->rtm_type); 1242 return rc; 1243 } 1244 1245 static int mctp_delroute(struct sk_buff *skb, struct nlmsghdr *nlh, 1246 struct netlink_ext_ack *extack) 1247 { 1248 struct nlattr *tb[RTA_MAX + 1]; 1249 mctp_eid_t daddr_start; 1250 struct mctp_dev *mdev; 1251 struct rtmsg *rtm; 1252 int rc; 1253 1254 rc = mctp_route_nlparse(skb, nlh, extack, tb, 1255 &rtm, &mdev, &daddr_start); 1256 if (rc < 0) 1257 return rc; 1258 1259 /* we only have unicast routes */ 1260 if (rtm->rtm_type != RTN_UNICAST) 1261 return -EINVAL; 1262 1263 rc = mctp_route_remove(mdev, daddr_start, rtm->rtm_dst_len, RTN_UNICAST); 1264 return rc; 1265 } 1266 1267 static int mctp_fill_rtinfo(struct sk_buff *skb, struct mctp_route *rt, 1268 u32 portid, u32 seq, int event, unsigned int flags) 1269 { 1270 struct nlmsghdr *nlh; 1271 struct rtmsg *hdr; 1272 void *metrics; 1273 1274 nlh = nlmsg_put(skb, portid, seq, event, sizeof(*hdr), flags); 1275 if (!nlh) 1276 return -EMSGSIZE; 1277 1278 hdr = nlmsg_data(nlh); 1279 hdr->rtm_family = AF_MCTP; 1280 1281 /* we use the _len fields as a number of EIDs, rather than 1282 * a number of bits in the address 1283 */ 1284 hdr->rtm_dst_len = rt->max - rt->min; 1285 hdr->rtm_src_len = 0; 1286 hdr->rtm_tos = 0; 1287 hdr->rtm_table = RT_TABLE_DEFAULT; 1288 hdr->rtm_protocol = RTPROT_STATIC; /* everything is user-defined */ 1289 hdr->rtm_scope = RT_SCOPE_LINK; /* TODO: scope in mctp_route? */ 1290 hdr->rtm_type = rt->type; 1291 1292 if (nla_put_u8(skb, RTA_DST, rt->min)) 1293 goto cancel; 1294 1295 metrics = nla_nest_start_noflag(skb, RTA_METRICS); 1296 if (!metrics) 1297 goto cancel; 1298 1299 if (rt->mtu) { 1300 if (nla_put_u32(skb, RTAX_MTU, rt->mtu)) 1301 goto cancel; 1302 } 1303 1304 nla_nest_end(skb, metrics); 1305 1306 if (rt->dev) { 1307 if (nla_put_u32(skb, RTA_OIF, rt->dev->dev->ifindex)) 1308 goto cancel; 1309 } 1310 1311 /* TODO: conditional neighbour physaddr? */ 1312 1313 nlmsg_end(skb, nlh); 1314 1315 return 0; 1316 1317 cancel: 1318 nlmsg_cancel(skb, nlh); 1319 return -EMSGSIZE; 1320 } 1321 1322 static int mctp_dump_rtinfo(struct sk_buff *skb, struct netlink_callback *cb) 1323 { 1324 struct net *net = sock_net(skb->sk); 1325 struct mctp_route *rt; 1326 int s_idx, idx; 1327 1328 /* TODO: allow filtering on route data, possibly under 1329 * cb->strict_check 1330 */ 1331 1332 /* TODO: change to struct overlay */ 1333 s_idx = cb->args[0]; 1334 idx = 0; 1335 1336 rcu_read_lock(); 1337 list_for_each_entry_rcu(rt, &net->mctp.routes, list) { 1338 if (idx++ < s_idx) 1339 continue; 1340 if (mctp_fill_rtinfo(skb, rt, 1341 NETLINK_CB(cb->skb).portid, 1342 cb->nlh->nlmsg_seq, 1343 RTM_NEWROUTE, NLM_F_MULTI) < 0) 1344 break; 1345 } 1346 1347 rcu_read_unlock(); 1348 cb->args[0] = idx; 1349 1350 return skb->len; 1351 } 1352 1353 /* net namespace implementation */ 1354 static int __net_init mctp_routes_net_init(struct net *net) 1355 { 1356 struct netns_mctp *ns = &net->mctp; 1357 1358 INIT_LIST_HEAD(&ns->routes); 1359 INIT_HLIST_HEAD(&ns->binds); 1360 mutex_init(&ns->bind_lock); 1361 INIT_HLIST_HEAD(&ns->keys); 1362 spin_lock_init(&ns->keys_lock); 1363 WARN_ON(mctp_default_net_set(net, MCTP_INITIAL_DEFAULT_NET)); 1364 return 0; 1365 } 1366 1367 static void __net_exit mctp_routes_net_exit(struct net *net) 1368 { 1369 struct mctp_route *rt; 1370 1371 rcu_read_lock(); 1372 list_for_each_entry_rcu(rt, &net->mctp.routes, list) 1373 mctp_route_release(rt); 1374 rcu_read_unlock(); 1375 } 1376 1377 static struct pernet_operations mctp_net_ops = { 1378 .init = mctp_routes_net_init, 1379 .exit = mctp_routes_net_exit, 1380 }; 1381 1382 int __init mctp_routes_init(void) 1383 { 1384 dev_add_pack(&mctp_packet_type); 1385 1386 rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_GETROUTE, 1387 NULL, mctp_dump_rtinfo, 0); 1388 rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_NEWROUTE, 1389 mctp_newroute, NULL, 0); 1390 rtnl_register_module(THIS_MODULE, PF_MCTP, RTM_DELROUTE, 1391 mctp_delroute, NULL, 0); 1392 1393 return register_pernet_subsys(&mctp_net_ops); 1394 } 1395 1396 void __exit mctp_routes_exit(void) 1397 { 1398 unregister_pernet_subsys(&mctp_net_ops); 1399 rtnl_unregister(PF_MCTP, RTM_DELROUTE); 1400 rtnl_unregister(PF_MCTP, RTM_NEWROUTE); 1401 rtnl_unregister(PF_MCTP, RTM_GETROUTE); 1402 dev_remove_pack(&mctp_packet_type); 1403 } 1404 1405 #if IS_ENABLED(CONFIG_MCTP_TEST) 1406 #include "test/route-test.c" 1407 #endif 1408