1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * IPv6 IOAM Lightweight Tunnel implementation
4 *
5 * Author:
6 * Justin Iurman <justin.iurman@uliege.be>
7 */
8
9 #include <linux/kernel.h>
10 #include <linux/skbuff.h>
11 #include <linux/net.h>
12 #include <linux/in6.h>
13 #include <linux/ioam6.h>
14 #include <linux/ioam6_iptunnel.h>
15 #include <net/dst.h>
16 #include <net/sock.h>
17 #include <net/lwtunnel.h>
18 #include <net/ioam6.h>
19 #include <net/netlink.h>
20 #include <net/ipv6.h>
21 #include <net/dst_cache.h>
22 #include <net/ip6_route.h>
23 #include <net/addrconf.h>
24
25 #define IOAM6_MASK_SHORT_FIELDS 0xff100000
26 #define IOAM6_MASK_WIDE_FIELDS 0xe00000
27
28 struct ioam6_lwt_encap {
29 struct ipv6_hopopt_hdr eh;
30 u8 pad[2]; /* 2-octet padding for 4n-alignment */
31 struct ioam6_hdr ioamh;
32 struct ioam6_trace_hdr traceh;
33 } __packed;
34
35 struct ioam6_lwt_freq {
36 u32 k;
37 u32 n;
38 };
39
40 struct ioam6_lwt {
41 struct dst_cache cache;
42 struct ioam6_lwt_freq freq;
43 atomic_t pkt_cnt;
44 u8 mode;
45 bool has_tunsrc;
46 struct in6_addr tunsrc;
47 struct in6_addr tundst;
48 struct ioam6_lwt_encap tuninfo;
49 };
50
51 static const struct netlink_range_validation freq_range = {
52 .min = IOAM6_IPTUNNEL_FREQ_MIN,
53 .max = IOAM6_IPTUNNEL_FREQ_MAX,
54 };
55
ioam6_lwt_state(struct lwtunnel_state * lwt)56 static struct ioam6_lwt *ioam6_lwt_state(struct lwtunnel_state *lwt)
57 {
58 return (struct ioam6_lwt *)lwt->data;
59 }
60
ioam6_lwt_info(struct lwtunnel_state * lwt)61 static struct ioam6_lwt_encap *ioam6_lwt_info(struct lwtunnel_state *lwt)
62 {
63 return &ioam6_lwt_state(lwt)->tuninfo;
64 }
65
ioam6_lwt_trace(struct lwtunnel_state * lwt)66 static struct ioam6_trace_hdr *ioam6_lwt_trace(struct lwtunnel_state *lwt)
67 {
68 return &(ioam6_lwt_state(lwt)->tuninfo.traceh);
69 }
70
71 static const struct nla_policy ioam6_iptunnel_policy[IOAM6_IPTUNNEL_MAX + 1] = {
72 [IOAM6_IPTUNNEL_FREQ_K] = NLA_POLICY_FULL_RANGE(NLA_U32, &freq_range),
73 [IOAM6_IPTUNNEL_FREQ_N] = NLA_POLICY_FULL_RANGE(NLA_U32, &freq_range),
74 [IOAM6_IPTUNNEL_MODE] = NLA_POLICY_RANGE(NLA_U8,
75 IOAM6_IPTUNNEL_MODE_MIN,
76 IOAM6_IPTUNNEL_MODE_MAX),
77 [IOAM6_IPTUNNEL_SRC] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
78 [IOAM6_IPTUNNEL_DST] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
79 [IOAM6_IPTUNNEL_TRACE] = NLA_POLICY_EXACT_LEN(
80 sizeof(struct ioam6_trace_hdr)),
81 };
82
ioam6_validate_trace_hdr(struct ioam6_trace_hdr * trace)83 static bool ioam6_validate_trace_hdr(struct ioam6_trace_hdr *trace)
84 {
85 u32 fields;
86
87 if (!trace->type_be32 || !trace->remlen ||
88 trace->remlen > IOAM6_TRACE_DATA_SIZE_MAX / 4 ||
89 trace->type.bit12 | trace->type.bit13 | trace->type.bit14 |
90 trace->type.bit15 | trace->type.bit16 | trace->type.bit17 |
91 trace->type.bit18 | trace->type.bit19 | trace->type.bit20 |
92 trace->type.bit21 | trace->type.bit23)
93 return false;
94
95 trace->nodelen = 0;
96 fields = be32_to_cpu(trace->type_be32);
97
98 trace->nodelen += hweight32(fields & IOAM6_MASK_SHORT_FIELDS)
99 * (sizeof(__be32) / 4);
100 trace->nodelen += hweight32(fields & IOAM6_MASK_WIDE_FIELDS)
101 * (sizeof(__be64) / 4);
102
103 return true;
104 }
105
ioam6_build_state(struct net * net,struct nlattr * nla,unsigned int family,const void * cfg,struct lwtunnel_state ** ts,struct netlink_ext_ack * extack)106 static int ioam6_build_state(struct net *net, struct nlattr *nla,
107 unsigned int family, const void *cfg,
108 struct lwtunnel_state **ts,
109 struct netlink_ext_ack *extack)
110 {
111 struct nlattr *tb[IOAM6_IPTUNNEL_MAX + 1];
112 struct ioam6_lwt_encap *tuninfo;
113 struct ioam6_trace_hdr *trace;
114 struct lwtunnel_state *lwt;
115 struct ioam6_lwt *ilwt;
116 int len_aligned, err;
117 u32 freq_k, freq_n;
118 u8 mode;
119
120 if (family != AF_INET6)
121 return -EINVAL;
122
123 err = nla_parse_nested(tb, IOAM6_IPTUNNEL_MAX, nla,
124 ioam6_iptunnel_policy, extack);
125 if (err < 0)
126 return err;
127
128 if ((!tb[IOAM6_IPTUNNEL_FREQ_K] && tb[IOAM6_IPTUNNEL_FREQ_N]) ||
129 (tb[IOAM6_IPTUNNEL_FREQ_K] && !tb[IOAM6_IPTUNNEL_FREQ_N])) {
130 NL_SET_ERR_MSG(extack, "freq: missing parameter");
131 return -EINVAL;
132 } else if (!tb[IOAM6_IPTUNNEL_FREQ_K] && !tb[IOAM6_IPTUNNEL_FREQ_N]) {
133 freq_k = IOAM6_IPTUNNEL_FREQ_MIN;
134 freq_n = IOAM6_IPTUNNEL_FREQ_MIN;
135 } else {
136 freq_k = nla_get_u32(tb[IOAM6_IPTUNNEL_FREQ_K]);
137 freq_n = nla_get_u32(tb[IOAM6_IPTUNNEL_FREQ_N]);
138
139 if (freq_k > freq_n) {
140 NL_SET_ERR_MSG(extack, "freq: k > n is forbidden");
141 return -EINVAL;
142 }
143 }
144
145 if (!tb[IOAM6_IPTUNNEL_MODE])
146 mode = IOAM6_IPTUNNEL_MODE_INLINE;
147 else
148 mode = nla_get_u8(tb[IOAM6_IPTUNNEL_MODE]);
149
150 if (tb[IOAM6_IPTUNNEL_SRC] && mode == IOAM6_IPTUNNEL_MODE_INLINE) {
151 NL_SET_ERR_MSG(extack, "no tunnel src expected with this mode");
152 return -EINVAL;
153 }
154
155 if (!tb[IOAM6_IPTUNNEL_DST] && mode != IOAM6_IPTUNNEL_MODE_INLINE) {
156 NL_SET_ERR_MSG(extack, "this mode needs a tunnel destination");
157 return -EINVAL;
158 }
159
160 if (!tb[IOAM6_IPTUNNEL_TRACE]) {
161 NL_SET_ERR_MSG(extack, "missing trace");
162 return -EINVAL;
163 }
164
165 trace = nla_data(tb[IOAM6_IPTUNNEL_TRACE]);
166 if (!ioam6_validate_trace_hdr(trace)) {
167 NL_SET_ERR_MSG_ATTR(extack, tb[IOAM6_IPTUNNEL_TRACE],
168 "invalid trace validation");
169 return -EINVAL;
170 }
171
172 len_aligned = ALIGN(trace->remlen * 4, 8);
173 lwt = lwtunnel_state_alloc(sizeof(*ilwt) + len_aligned);
174 if (!lwt)
175 return -ENOMEM;
176
177 ilwt = ioam6_lwt_state(lwt);
178 err = dst_cache_init(&ilwt->cache, GFP_ATOMIC);
179 if (err)
180 goto free_lwt;
181
182 atomic_set(&ilwt->pkt_cnt, 0);
183 ilwt->freq.k = freq_k;
184 ilwt->freq.n = freq_n;
185
186 ilwt->mode = mode;
187
188 if (!tb[IOAM6_IPTUNNEL_SRC]) {
189 ilwt->has_tunsrc = false;
190 } else {
191 ilwt->has_tunsrc = true;
192 ilwt->tunsrc = nla_get_in6_addr(tb[IOAM6_IPTUNNEL_SRC]);
193
194 if (ipv6_addr_any(&ilwt->tunsrc)) {
195 NL_SET_ERR_MSG_ATTR(extack, tb[IOAM6_IPTUNNEL_SRC],
196 "invalid tunnel source address");
197 err = -EINVAL;
198 goto free_cache;
199 }
200 }
201
202 if (tb[IOAM6_IPTUNNEL_DST]) {
203 ilwt->tundst = nla_get_in6_addr(tb[IOAM6_IPTUNNEL_DST]);
204
205 if (ipv6_addr_any(&ilwt->tundst)) {
206 NL_SET_ERR_MSG_ATTR(extack, tb[IOAM6_IPTUNNEL_DST],
207 "invalid tunnel dest address");
208 err = -EINVAL;
209 goto free_cache;
210 }
211 }
212
213 tuninfo = ioam6_lwt_info(lwt);
214 tuninfo->eh.hdrlen = ((sizeof(*tuninfo) + len_aligned) >> 3) - 1;
215 tuninfo->pad[0] = IPV6_TLV_PADN;
216 tuninfo->ioamh.type = IOAM6_TYPE_PREALLOC;
217 tuninfo->ioamh.opt_type = IPV6_TLV_IOAM;
218 tuninfo->ioamh.opt_len = sizeof(tuninfo->ioamh) - 2 + sizeof(*trace)
219 + trace->remlen * 4;
220
221 memcpy(&tuninfo->traceh, trace, sizeof(*trace));
222
223 if (len_aligned - trace->remlen * 4) {
224 tuninfo->traceh.data[trace->remlen * 4] = IPV6_TLV_PADN;
225 tuninfo->traceh.data[trace->remlen * 4 + 1] = 2;
226 }
227
228 lwt->type = LWTUNNEL_ENCAP_IOAM6;
229 lwt->flags |= LWTUNNEL_STATE_OUTPUT_REDIRECT;
230
231 *ts = lwt;
232
233 return 0;
234 free_cache:
235 dst_cache_destroy(&ilwt->cache);
236 free_lwt:
237 kfree(lwt);
238 return err;
239 }
240
ioam6_do_fill(struct net * net,struct sk_buff * skb)241 static int ioam6_do_fill(struct net *net, struct sk_buff *skb)
242 {
243 struct ioam6_trace_hdr *trace;
244 struct ioam6_namespace *ns;
245
246 trace = (struct ioam6_trace_hdr *)(skb_transport_header(skb)
247 + sizeof(struct ipv6_hopopt_hdr) + 2
248 + sizeof(struct ioam6_hdr));
249
250 ns = ioam6_namespace(net, trace->namespace_id);
251 if (ns)
252 ioam6_fill_trace_data(skb, ns, trace, false);
253
254 return 0;
255 }
256
ioam6_do_inline(struct net * net,struct sk_buff * skb,struct ioam6_lwt_encap * tuninfo,struct dst_entry * cache_dst)257 static int ioam6_do_inline(struct net *net, struct sk_buff *skb,
258 struct ioam6_lwt_encap *tuninfo,
259 struct dst_entry *cache_dst)
260 {
261 struct ipv6hdr *oldhdr, *hdr;
262 int hdrlen, err;
263
264 hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
265
266 err = skb_cow_head(skb, hdrlen + dst_dev_overhead(cache_dst, skb));
267 if (unlikely(err))
268 return err;
269
270 oldhdr = ipv6_hdr(skb);
271 skb_pull(skb, sizeof(*oldhdr));
272 skb_postpull_rcsum(skb, skb_network_header(skb), sizeof(*oldhdr));
273
274 skb_push(skb, sizeof(*oldhdr) + hdrlen);
275 skb_reset_network_header(skb);
276 skb_mac_header_rebuild(skb);
277
278 hdr = ipv6_hdr(skb);
279 memmove(hdr, oldhdr, sizeof(*oldhdr));
280 tuninfo->eh.nexthdr = hdr->nexthdr;
281
282 skb_set_transport_header(skb, sizeof(*hdr));
283 skb_postpush_rcsum(skb, hdr, sizeof(*hdr) + hdrlen);
284
285 memcpy(skb_transport_header(skb), (u8 *)tuninfo, hdrlen);
286
287 hdr->nexthdr = NEXTHDR_HOP;
288 hdr->payload_len = cpu_to_be16(skb->len - sizeof(*hdr));
289
290 return ioam6_do_fill(net, skb);
291 }
292
ioam6_do_encap(struct net * net,struct sk_buff * skb,struct ioam6_lwt_encap * tuninfo,bool has_tunsrc,struct in6_addr * tunsrc,struct in6_addr * tundst,struct dst_entry * cache_dst)293 static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
294 struct ioam6_lwt_encap *tuninfo,
295 bool has_tunsrc,
296 struct in6_addr *tunsrc,
297 struct in6_addr *tundst,
298 struct dst_entry *cache_dst)
299 {
300 struct dst_entry *dst = skb_dst(skb);
301 struct ipv6hdr *hdr, *inner_hdr;
302 int hdrlen, len, err;
303
304 hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
305 len = sizeof(*hdr) + hdrlen;
306
307 err = skb_cow_head(skb, len + dst_dev_overhead(cache_dst, skb));
308 if (unlikely(err))
309 return err;
310
311 inner_hdr = ipv6_hdr(skb);
312
313 skb_push(skb, len);
314 skb_reset_network_header(skb);
315 skb_mac_header_rebuild(skb);
316 skb_set_transport_header(skb, sizeof(*hdr));
317
318 tuninfo->eh.nexthdr = NEXTHDR_IPV6;
319 memcpy(skb_transport_header(skb), (u8 *)tuninfo, hdrlen);
320
321 hdr = ipv6_hdr(skb);
322 memcpy(hdr, inner_hdr, sizeof(*hdr));
323
324 hdr->nexthdr = NEXTHDR_HOP;
325 hdr->payload_len = cpu_to_be16(skb->len - sizeof(*hdr));
326 hdr->daddr = *tundst;
327
328 if (has_tunsrc)
329 memcpy(&hdr->saddr, tunsrc, sizeof(*tunsrc));
330 else
331 ipv6_dev_get_saddr(net, dst->dev, &hdr->daddr,
332 IPV6_PREFER_SRC_PUBLIC, &hdr->saddr);
333
334 skb_postpush_rcsum(skb, hdr, len);
335
336 return ioam6_do_fill(net, skb);
337 }
338
ioam6_output(struct net * net,struct sock * sk,struct sk_buff * skb)339 static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
340 {
341 struct dst_entry *dst = skb_dst(skb), *cache_dst = NULL;
342 struct ioam6_lwt *ilwt;
343 int err = -EINVAL;
344 u32 pkt_cnt;
345
346 if (skb->protocol != htons(ETH_P_IPV6))
347 goto drop;
348
349 ilwt = ioam6_lwt_state(dst->lwtstate);
350
351 /* Check for insertion frequency (i.e., "k over n" insertions) */
352 pkt_cnt = atomic_fetch_inc(&ilwt->pkt_cnt);
353 if (pkt_cnt % ilwt->freq.n >= ilwt->freq.k)
354 goto out;
355
356 local_bh_disable();
357 cache_dst = dst_cache_get(&ilwt->cache);
358 local_bh_enable();
359
360 switch (ilwt->mode) {
361 case IOAM6_IPTUNNEL_MODE_INLINE:
362 do_inline:
363 /* Direct insertion - if there is no Hop-by-Hop yet */
364 if (ipv6_hdr(skb)->nexthdr == NEXTHDR_HOP)
365 goto out;
366
367 err = ioam6_do_inline(net, skb, &ilwt->tuninfo, cache_dst);
368 if (unlikely(err))
369 goto drop;
370
371 break;
372 case IOAM6_IPTUNNEL_MODE_ENCAP:
373 do_encap:
374 /* Encapsulation (ip6ip6) */
375 err = ioam6_do_encap(net, skb, &ilwt->tuninfo,
376 ilwt->has_tunsrc, &ilwt->tunsrc,
377 &ilwt->tundst, cache_dst);
378 if (unlikely(err))
379 goto drop;
380
381 break;
382 case IOAM6_IPTUNNEL_MODE_AUTO:
383 /* Automatic (RFC8200 compliant):
384 * - local packets -> INLINE mode
385 * - in-transit packets -> ENCAP mode
386 */
387 if (!skb->dev)
388 goto do_inline;
389
390 goto do_encap;
391 default:
392 goto drop;
393 }
394
395 if (unlikely(!cache_dst)) {
396 struct ipv6hdr *hdr = ipv6_hdr(skb);
397 struct flowi6 fl6;
398
399 memset(&fl6, 0, sizeof(fl6));
400 fl6.daddr = hdr->daddr;
401 fl6.saddr = hdr->saddr;
402 fl6.flowlabel = ip6_flowinfo(hdr);
403 fl6.flowi6_mark = skb->mark;
404 fl6.flowi6_proto = hdr->nexthdr;
405
406 cache_dst = ip6_route_output(net, NULL, &fl6);
407 if (cache_dst->error) {
408 err = cache_dst->error;
409 goto drop;
410 }
411
412 /* cache only if we don't create a dst reference loop */
413 if (dst->lwtstate != cache_dst->lwtstate) {
414 local_bh_disable();
415 dst_cache_set_ip6(&ilwt->cache, cache_dst, &fl6.saddr);
416 local_bh_enable();
417 }
418
419 err = skb_cow_head(skb, LL_RESERVED_SPACE(cache_dst->dev));
420 if (unlikely(err))
421 goto drop;
422 }
423
424 /* avoid lwtunnel_output() reentry loop when destination is the same
425 * after transformation (e.g., with the inline mode)
426 */
427 if (dst->lwtstate != cache_dst->lwtstate) {
428 skb_dst_drop(skb);
429 skb_dst_set(skb, cache_dst);
430 return dst_output(net, sk, skb);
431 }
432 out:
433 dst_release(cache_dst);
434 return dst->lwtstate->orig_output(net, sk, skb);
435 drop:
436 dst_release(cache_dst);
437 kfree_skb(skb);
438 return err;
439 }
440
ioam6_destroy_state(struct lwtunnel_state * lwt)441 static void ioam6_destroy_state(struct lwtunnel_state *lwt)
442 {
443 dst_cache_destroy(&ioam6_lwt_state(lwt)->cache);
444 }
445
ioam6_fill_encap_info(struct sk_buff * skb,struct lwtunnel_state * lwtstate)446 static int ioam6_fill_encap_info(struct sk_buff *skb,
447 struct lwtunnel_state *lwtstate)
448 {
449 struct ioam6_lwt *ilwt = ioam6_lwt_state(lwtstate);
450 int err;
451
452 err = nla_put_u32(skb, IOAM6_IPTUNNEL_FREQ_K, ilwt->freq.k);
453 if (err)
454 goto ret;
455
456 err = nla_put_u32(skb, IOAM6_IPTUNNEL_FREQ_N, ilwt->freq.n);
457 if (err)
458 goto ret;
459
460 err = nla_put_u8(skb, IOAM6_IPTUNNEL_MODE, ilwt->mode);
461 if (err)
462 goto ret;
463
464 if (ilwt->mode != IOAM6_IPTUNNEL_MODE_INLINE) {
465 if (ilwt->has_tunsrc) {
466 err = nla_put_in6_addr(skb, IOAM6_IPTUNNEL_SRC,
467 &ilwt->tunsrc);
468 if (err)
469 goto ret;
470 }
471
472 err = nla_put_in6_addr(skb, IOAM6_IPTUNNEL_DST, &ilwt->tundst);
473 if (err)
474 goto ret;
475 }
476
477 err = nla_put(skb, IOAM6_IPTUNNEL_TRACE, sizeof(ilwt->tuninfo.traceh),
478 &ilwt->tuninfo.traceh);
479 ret:
480 return err;
481 }
482
ioam6_encap_nlsize(struct lwtunnel_state * lwtstate)483 static int ioam6_encap_nlsize(struct lwtunnel_state *lwtstate)
484 {
485 struct ioam6_lwt *ilwt = ioam6_lwt_state(lwtstate);
486 int nlsize;
487
488 nlsize = nla_total_size(sizeof(ilwt->freq.k)) +
489 nla_total_size(sizeof(ilwt->freq.n)) +
490 nla_total_size(sizeof(ilwt->mode)) +
491 nla_total_size(sizeof(ilwt->tuninfo.traceh));
492
493 if (ilwt->mode != IOAM6_IPTUNNEL_MODE_INLINE) {
494 if (ilwt->has_tunsrc)
495 nlsize += nla_total_size(sizeof(ilwt->tunsrc));
496
497 nlsize += nla_total_size(sizeof(ilwt->tundst));
498 }
499
500 return nlsize;
501 }
502
ioam6_encap_cmp(struct lwtunnel_state * a,struct lwtunnel_state * b)503 static int ioam6_encap_cmp(struct lwtunnel_state *a, struct lwtunnel_state *b)
504 {
505 struct ioam6_trace_hdr *trace_a = ioam6_lwt_trace(a);
506 struct ioam6_trace_hdr *trace_b = ioam6_lwt_trace(b);
507 struct ioam6_lwt *ilwt_a = ioam6_lwt_state(a);
508 struct ioam6_lwt *ilwt_b = ioam6_lwt_state(b);
509
510 return (ilwt_a->freq.k != ilwt_b->freq.k ||
511 ilwt_a->freq.n != ilwt_b->freq.n ||
512 ilwt_a->mode != ilwt_b->mode ||
513 ilwt_a->has_tunsrc != ilwt_b->has_tunsrc ||
514 (ilwt_a->mode != IOAM6_IPTUNNEL_MODE_INLINE &&
515 !ipv6_addr_equal(&ilwt_a->tundst, &ilwt_b->tundst)) ||
516 (ilwt_a->mode != IOAM6_IPTUNNEL_MODE_INLINE &&
517 ilwt_a->has_tunsrc &&
518 !ipv6_addr_equal(&ilwt_a->tunsrc, &ilwt_b->tunsrc)) ||
519 trace_a->namespace_id != trace_b->namespace_id);
520 }
521
522 static const struct lwtunnel_encap_ops ioam6_iptun_ops = {
523 .build_state = ioam6_build_state,
524 .destroy_state = ioam6_destroy_state,
525 .output = ioam6_output,
526 .fill_encap = ioam6_fill_encap_info,
527 .get_encap_size = ioam6_encap_nlsize,
528 .cmp_encap = ioam6_encap_cmp,
529 .owner = THIS_MODULE,
530 };
531
ioam6_iptunnel_init(void)532 int __init ioam6_iptunnel_init(void)
533 {
534 return lwtunnel_encap_add_ops(&ioam6_iptun_ops, LWTUNNEL_ENCAP_IOAM6);
535 }
536
ioam6_iptunnel_exit(void)537 void ioam6_iptunnel_exit(void)
538 {
539 lwtunnel_encap_del_ops(&ioam6_iptun_ops, LWTUNNEL_ENCAP_IOAM6);
540 }
541