net/ipv6/seg6.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *  SR-IPv6 implementation
   4  *
   5  *  Author:
   6  *  David Lebrun <david.lebrun@uclouvain.be>
   7  */
   8
   9 #include <linux/errno.h>
  10 #include <linux/types.h>
  11 #include <linux/socket.h>
  12 #include <linux/net.h>
  13 #include <linux/in6.h>
  14 #include <linux/slab.h>
  15 #include <linux/rhashtable.h>
  16
  17 #include <net/ipv6.h>
  18 #include <net/protocol.h>
  19
  20 #include <net/seg6.h>
  21 #include <net/genetlink.h>
  22 #include <linux/seg6.h>
  23 #include <linux/seg6_genl.h>
  24 #ifdef CONFIG_IPV6_SEG6_HMAC
  25 #include <net/seg6_hmac.h>
  26 #endif
  27
  28 bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len)
  29 {
  30         int trailing;
  31         unsigned int tlv_offset;
  32
  33         if (srh->type != IPV6_SRCRT_TYPE_4)
  34                 return false;
  35
  36         if (((srh->hdrlen + 1) << 3) != len)
  37                 return false;
  38
  39         if (srh->segments_left > srh->first_segment)
  40                 return false;
  41
  42         tlv_offset = sizeof(*srh) + ((srh->first_segment + 1) << 4);
  43
  44         trailing = len - tlv_offset;
  45         if (trailing < 0)
  46                 return false;
  47
  48         while (trailing) {
  49                 struct sr6_tlv *tlv;
  50                 unsigned int tlv_len;
  51
  52                 if (trailing < sizeof(*tlv))
  53                         return false;
  54
  55                 tlv = (struct sr6_tlv *)((unsigned char *)srh + tlv_offset);
  56                 tlv_len = sizeof(*tlv) + tlv->len;
  57
  58                 trailing -= tlv_len;
  59                 if (trailing < 0)
  60                         return false;
  61
  62                 tlv_offset += tlv_len;
  63         }
  64
  65         return true;
  66 }
  67
  68 static struct genl_family seg6_genl_family;
  69
  70 static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {
  71         [SEG6_ATTR_DST]                         = { .type = NLA_BINARY,
  72                 .len = sizeof(struct in6_addr) },
  73         [SEG6_ATTR_DSTLEN]                      = { .type = NLA_S32, },
  74         [SEG6_ATTR_HMACKEYID]           = { .type = NLA_U32, },
  75         [SEG6_ATTR_SECRET]                      = { .type = NLA_BINARY, },
  76         [SEG6_ATTR_SECRETLEN]           = { .type = NLA_U8, },
  77         [SEG6_ATTR_ALGID]                       = { .type = NLA_U8, },
  78         [SEG6_ATTR_HMACINFO]            = { .type = NLA_NESTED, },
  79 };
  80
  81 #ifdef CONFIG_IPV6_SEG6_HMAC
  82
  83 static int seg6_genl_sethmac(struct sk_buff *skb, struct genl_info *info)
  84 {
  85         struct net *net = genl_info_net(info);
  86         struct seg6_pernet_data *sdata;
  87         struct seg6_hmac_info *hinfo;
  88         u32 hmackeyid;
  89         char *secret;
  90         int err = 0;
  91         u8 algid;
  92         u8 slen;
  93
  94         sdata = seg6_pernet(net);
  95
  96         if (!info->attrs[SEG6_ATTR_HMACKEYID] ||
  97             !info->attrs[SEG6_ATTR_SECRETLEN] ||
  98             !info->attrs[SEG6_ATTR_ALGID])
  99                 return -EINVAL;
 100
 101         hmackeyid = nla_get_u32(info->attrs[SEG6_ATTR_HMACKEYID]);
 102         slen = nla_get_u8(info->attrs[SEG6_ATTR_SECRETLEN]);
 103         algid = nla_get_u8(info->attrs[SEG6_ATTR_ALGID]);
 104
 105         if (hmackeyid == 0)
 106                 return -EINVAL;
 107
 108         if (slen > SEG6_HMAC_SECRET_LEN)
 109                 return -EINVAL;
 110
 111         mutex_lock(&sdata->lock);
 112         hinfo = seg6_hmac_info_lookup(net, hmackeyid);
 113
 114         if (!slen) {
 115                 if (!hinfo)
 116                         err = -ENOENT;
 117
 118                 err = seg6_hmac_info_del(net, hmackeyid);
 119
 120                 goto out_unlock;
 121         }
 122
 123         if (!info->attrs[SEG6_ATTR_SECRET]) {
 124                 err = -EINVAL;
 125                 goto out_unlock;
 126         }
 127
 128         if (hinfo) {
 129                 err = seg6_hmac_info_del(net, hmackeyid);
 130                 if (err)
 131                         goto out_unlock;
 132         }
 133
 134         secret = (char *)nla_data(info->attrs[SEG6_ATTR_SECRET]);
 135
 136         hinfo = kzalloc(sizeof(*hinfo), GFP_KERNEL);
 137         if (!hinfo) {
 138                 err = -ENOMEM;
 139                 goto out_unlock;
 140         }
 141
 142         memcpy(hinfo->secret, secret, slen);
 143         hinfo->slen = slen;
 144         hinfo->alg_id = algid;
 145         hinfo->hmackeyid = hmackeyid;
 146
 147         err = seg6_hmac_info_add(net, hmackeyid, hinfo);
 148         if (err)
 149                 kfree(hinfo);
 150
 151 out_unlock:
 152         mutex_unlock(&sdata->lock);
 153         return err;
 154 }
 155
 156 #else
 157
 158 static int seg6_genl_sethmac(struct sk_buff *skb, struct genl_info *info)
 159 {
 160         return -ENOTSUPP;
 161 }
 162
 163 #endif
 164
 165 static int seg6_genl_set_tunsrc(struct sk_buff *skb, struct genl_info *info)
 166 {
 167         struct net *net = genl_info_net(info);
 168         struct in6_addr *val, *t_old, *t_new;
 169         struct seg6_pernet_data *sdata;
 170
 171         sdata = seg6_pernet(net);
 172
 173         if (!info->attrs[SEG6_ATTR_DST])
 174                 return -EINVAL;
 175
 176         val = nla_data(info->attrs[SEG6_ATTR_DST]);
 177         t_new = kmemdup(val, sizeof(*val), GFP_KERNEL);
 178         if (!t_new)
 179                 return -ENOMEM;
 180
 181         mutex_lock(&sdata->lock);
 182
 183         t_old = sdata->tun_src;
 184         rcu_assign_pointer(sdata->tun_src, t_new);
 185
 186         mutex_unlock(&sdata->lock);
 187
 188         synchronize_net();
 189         kfree(t_old);
 190
 191         return 0;
 192 }
 193
 194 static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info)
 195 {
 196         struct net *net = genl_info_net(info);
 197         struct in6_addr *tun_src;
 198         struct sk_buff *msg;
 199         void *hdr;
 200
 201         msg = genlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 202         if (!msg)
 203                 return -ENOMEM;
 204
 205         hdr = genlmsg_put(msg, info->snd_portid, info->snd_seq,
 206                           &seg6_genl_family, 0, SEG6_CMD_GET_TUNSRC);
 207         if (!hdr)
 208                 goto free_msg;
 209
 210         rcu_read_lock();
 211         tun_src = rcu_dereference(seg6_pernet(net)->tun_src);
 212
 213         if (nla_put(msg, SEG6_ATTR_DST, sizeof(struct in6_addr), tun_src))
 214                 goto nla_put_failure;
 215
 216         rcu_read_unlock();
 217
 218         genlmsg_end(msg, hdr);
 219         return genlmsg_reply(msg, info);
 220
 221 nla_put_failure:
 222         rcu_read_unlock();
 223 free_msg:
 224         nlmsg_free(msg);
 225         return -ENOMEM;
 226 }
 227
 228 #ifdef CONFIG_IPV6_SEG6_HMAC
 229
 230 static int __seg6_hmac_fill_info(struct seg6_hmac_info *hinfo,
 231                                  struct sk_buff *msg)
 232 {
 233         if (nla_put_u32(msg, SEG6_ATTR_HMACKEYID, hinfo->hmackeyid) ||
 234             nla_put_u8(msg, SEG6_ATTR_SECRETLEN, hinfo->slen) ||
 235             nla_put(msg, SEG6_ATTR_SECRET, hinfo->slen, hinfo->secret) ||
 236             nla_put_u8(msg, SEG6_ATTR_ALGID, hinfo->alg_id))
 237                 return -1;
 238
 239         return 0;
 240 }
 241
 242 static int __seg6_genl_dumphmac_element(struct seg6_hmac_info *hinfo,
 243                                         u32 portid, u32 seq, u32 flags,
 244                                         struct sk_buff *skb, u8 cmd)
 245 {
 246         void *hdr;
 247
 248         hdr = genlmsg_put(skb, portid, seq, &seg6_genl_family, flags, cmd);
 249         if (!hdr)
 250                 return -ENOMEM;
 251
 252         if (__seg6_hmac_fill_info(hinfo, skb) < 0)
 253                 goto nla_put_failure;
 254
 255         genlmsg_end(skb, hdr);
 256         return 0;
 257
 258 nla_put_failure:
 259         genlmsg_cancel(skb, hdr);
 260         return -EMSGSIZE;
 261 }
 262
 263 static int seg6_genl_dumphmac_start(struct netlink_callback *cb)
 264 {
 265         struct net *net = sock_net(cb->skb->sk);
 266         struct seg6_pernet_data *sdata;
 267         struct rhashtable_iter *iter;
 268
 269         sdata = seg6_pernet(net);
 270         iter = (struct rhashtable_iter *)cb->args[0];
 271
 272         if (!iter) {
 273                 iter = kmalloc(sizeof(*iter), GFP_KERNEL);
 274                 if (!iter)
 275                         return -ENOMEM;
 276
 277                 cb->args[0] = (long)iter;
 278         }
 279
 280         rhashtable_walk_enter(&sdata->hmac_infos, iter);
 281
 282         return 0;
 283 }
 284
 285 static int seg6_genl_dumphmac_done(struct netlink_callback *cb)
 286 {
 287         struct rhashtable_iter *iter = (struct rhashtable_iter *)cb->args[0];
 288
 289         rhashtable_walk_exit(iter);
 290
 291         kfree(iter);
 292
 293         return 0;
 294 }
 295
 296 static int seg6_genl_dumphmac(struct sk_buff *skb, struct netlink_callback *cb)
 297 {
 298         struct rhashtable_iter *iter = (struct rhashtable_iter *)cb->args[0];
 299         struct seg6_hmac_info *hinfo;
 300         int ret;
 301
 302         rhashtable_walk_start(iter);
 303
 304         for (;;) {
 305                 hinfo = rhashtable_walk_next(iter);
 306
 307                 if (IS_ERR(hinfo)) {
 308                         if (PTR_ERR(hinfo) == -EAGAIN)
 309                                 continue;
 310                         ret = PTR_ERR(hinfo);
 311                         goto done;
 312                 } else if (!hinfo) {
 313                         break;
 314                 }
 315
 316                 ret = __seg6_genl_dumphmac_element(hinfo,
 317                                                    NETLINK_CB(cb->skb).portid,
 318                                                    cb->nlh->nlmsg_seq,
 319                                                    NLM_F_MULTI,
 320                                                    skb, SEG6_CMD_DUMPHMAC);
 321                 if (ret)
 322                         goto done;
 323         }
 324
 325         ret = skb->len;
 326
 327 done:
 328         rhashtable_walk_stop(iter);
 329         return ret;
 330 }
 331
 332 #else
 333
 334 static int seg6_genl_dumphmac_start(struct netlink_callback *cb)
 335 {
 336         return 0;
 337 }
 338
 339 static int seg6_genl_dumphmac_done(struct netlink_callback *cb)
 340 {
 341         return 0;
 342 }
 343
 344 static int seg6_genl_dumphmac(struct sk_buff *skb, struct netlink_callback *cb)
 345 {
 346         return -ENOTSUPP;
 347 }
 348
 349 #endif
 350
 351 static int __net_init seg6_net_init(struct net *net)
 352 {
 353         struct seg6_pernet_data *sdata;
 354
 355         sdata = kzalloc(sizeof(*sdata), GFP_KERNEL);
 356         if (!sdata)
 357                 return -ENOMEM;
 358
 359         mutex_init(&sdata->lock);
 360
 361         sdata->tun_src = kzalloc(sizeof(*sdata->tun_src), GFP_KERNEL);
 362         if (!sdata->tun_src) {
 363                 kfree(sdata);
 364                 return -ENOMEM;
 365         }
 366
 367         net->ipv6.seg6_data = sdata;
 368
 369 #ifdef CONFIG_IPV6_SEG6_HMAC
 370         seg6_hmac_net_init(net);
 371 #endif
 372
 373         return 0;
 374 }
 375
 376 static void __net_exit seg6_net_exit(struct net *net)
 377 {
 378         struct seg6_pernet_data *sdata = seg6_pernet(net);
 379
 380 #ifdef CONFIG_IPV6_SEG6_HMAC
 381         seg6_hmac_net_exit(net);
 382 #endif
 383
 384         kfree(sdata->tun_src);
 385         kfree(sdata);
 386 }
 387
 388 static struct pernet_operations ip6_segments_ops = {
 389         .init = seg6_net_init,
 390         .exit = seg6_net_exit,
 391 };
 392
 393 static const struct genl_ops seg6_genl_ops[] = {
 394         {
 395                 .cmd    = SEG6_CMD_SETHMAC,
 396                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 397                 .doit   = seg6_genl_sethmac,
 398                 .flags  = GENL_ADMIN_PERM,
 399         },
 400         {
 401                 .cmd    = SEG6_CMD_DUMPHMAC,
 402                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 403                 .start  = seg6_genl_dumphmac_start,
 404                 .dumpit = seg6_genl_dumphmac,
 405                 .done   = seg6_genl_dumphmac_done,
 406                 .flags  = GENL_ADMIN_PERM,
 407         },
 408         {
 409                 .cmd    = SEG6_CMD_SET_TUNSRC,
 410                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 411                 .doit   = seg6_genl_set_tunsrc,
 412                 .flags  = GENL_ADMIN_PERM,
 413         },
 414         {
 415                 .cmd    = SEG6_CMD_GET_TUNSRC,
 416                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 417                 .doit   = seg6_genl_get_tunsrc,
 418                 .flags  = GENL_ADMIN_PERM,
 419         },
 420 };
 421
 422 static struct genl_family seg6_genl_family __ro_after_init = {
 423         .hdrsize        = 0,
 424         .name           = SEG6_GENL_NAME,
 425         .version        = SEG6_GENL_VERSION,
 426         .maxattr        = SEG6_ATTR_MAX,
 427         .policy = seg6_genl_policy,
 428         .netnsok        = true,
 429         .parallel_ops   = true,
 430         .ops            = seg6_genl_ops,
 431         .n_ops          = ARRAY_SIZE(seg6_genl_ops),
 432         .module         = THIS_MODULE,
 433 };
 434
 435 int __init seg6_init(void)
 436 {
 437         int err = -ENOMEM;
 438
 439         err = genl_register_family(&seg6_genl_family);
 440         if (err)
 441                 goto out;
 442
 443         err = register_pernet_subsys(&ip6_segments_ops);
 444         if (err)
 445                 goto out_unregister_genl;
 446
 447 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 448         err = seg6_iptunnel_init();
 449         if (err)
 450                 goto out_unregister_pernet;
 451
 452         err = seg6_local_init();
 453         if (err)
 454                 goto out_unregister_pernet;
 455 #endif
 456
 457 #ifdef CONFIG_IPV6_SEG6_HMAC
 458         err = seg6_hmac_init();
 459         if (err)
 460                 goto out_unregister_iptun;
 461 #endif
 462
 463         pr_info("Segment Routing with IPv6\n");
 464
 465 out:
 466         return err;
 467 #ifdef CONFIG_IPV6_SEG6_HMAC
 468 out_unregister_iptun:
 469 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 470         seg6_local_exit();
 471         seg6_iptunnel_exit();
 472 #endif
 473 #endif
 474 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 475 out_unregister_pernet:
 476         unregister_pernet_subsys(&ip6_segments_ops);
 477 #endif
 478 out_unregister_genl:
 479         genl_unregister_family(&seg6_genl_family);
 480         goto out;
 481 }
 482
 483 void seg6_exit(void)
 484 {
 485 #ifdef CONFIG_IPV6_SEG6_HMAC
 486         seg6_hmac_exit();
 487 #endif
 488 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 489         seg6_iptunnel_exit();
 490 #endif
 491         unregister_pernet_subsys(&ip6_segments_ops);
 492         genl_unregister_family(&seg6_genl_family);
 493 }