net/ipv6/mip6.c

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * Copyright (C)2003-2006 Helsinki University of Technology
0004  * Copyright (C)2003-2006 USAGI/WIDE Project
0005  */
0006 /*
0007  * Authors:
0008  *  Noriaki TAKAMIYA @USAGI
0009  *  Masahide NAKAMURA @USAGI
0010  */
0011
0012 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
0013
0014 #include <linux/module.h>
0015 #include <linux/skbuff.h>
0016 #include <linux/time.h>
0017 #include <linux/ipv6.h>
0018 #include <linux/icmpv6.h>
0019 #include <net/sock.h>
0020 #include <net/ipv6.h>
0021 #include <net/ip6_checksum.h>
0022 #include <net/rawv6.h>
0023 #include <net/xfrm.h>
0024 #include <net/mip6.h>
0025
0026 static inline unsigned int calc_padlen(unsigned int len, unsigned int n)
0027 {
0028     return (n - len + 16) & 0x7;
0029 }
0030
0031 static inline void *mip6_padn(__u8 *data, __u8 padlen)
0032 {
0033     if (!data)
0034         return NULL;
0035     if (padlen == 1) {
0036         data[0] = IPV6_TLV_PAD1;
0037     } else if (padlen > 1) {
0038         data[0] = IPV6_TLV_PADN;
0039         data[1] = padlen - 2;
0040         if (padlen > 2)
0041             memset(data+2, 0, data[1]);
0042     }
0043     return data + padlen;
0044 }
0045
0046 static inline void mip6_param_prob(struct sk_buff *skb, u8 code, int pos)
0047 {
0048     icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos);
0049 }
0050
0051 static int mip6_mh_len(int type)
0052 {
0053     int len = 0;
0054
0055     switch (type) {
0056     case IP6_MH_TYPE_BRR:
0057         len = 0;
0058         break;
0059     case IP6_MH_TYPE_HOTI:
0060     case IP6_MH_TYPE_COTI:
0061     case IP6_MH_TYPE_BU:
0062     case IP6_MH_TYPE_BACK:
0063         len = 1;
0064         break;
0065     case IP6_MH_TYPE_HOT:
0066     case IP6_MH_TYPE_COT:
0067     case IP6_MH_TYPE_BERROR:
0068         len = 2;
0069         break;
0070     }
0071     return len;
0072 }
0073
0074 static int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
0075 {
0076     struct ip6_mh _hdr;
0077     const struct ip6_mh *mh;
0078
0079     mh = skb_header_pointer(skb, skb_transport_offset(skb),
0080                 sizeof(_hdr), &_hdr);
0081     if (!mh)
0082         return -1;
0083
0084     if (((mh->ip6mh_hdrlen + 1) << 3) > skb->len)
0085         return -1;
0086
0087     if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
0088         net_dbg_ratelimited("mip6: MH message too short: %d vs >=%d\n",
0089                     mh->ip6mh_hdrlen,
0090                     mip6_mh_len(mh->ip6mh_type));
0091         mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_hdrlen) +
0092                 skb_network_header_len(skb));
0093         return -1;
0094     }
0095
0096     if (mh->ip6mh_proto != IPPROTO_NONE) {
0097         net_dbg_ratelimited("mip6: MH invalid payload proto = %d\n",
0098                     mh->ip6mh_proto);
0099         mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_proto) +
0100                 skb_network_header_len(skb));
0101         return -1;
0102     }
0103
0104     return 0;
0105 }
0106
0107 struct mip6_report_rate_limiter {
0108     spinlock_t lock;
0109     ktime_t stamp;
0110     int iif;
0111     struct in6_addr src;
0112     struct in6_addr dst;
0113 };
0114
0115 static struct mip6_report_rate_limiter mip6_report_rl = {
0116     .lock = __SPIN_LOCK_UNLOCKED(mip6_report_rl.lock)
0117 };
0118
0119 static int mip6_destopt_input(struct xfrm_state *x, struct sk_buff *skb)
0120 {
0121     const struct ipv6hdr *iph = ipv6_hdr(skb);
0122     struct ipv6_destopt_hdr *destopt = (struct ipv6_destopt_hdr *)skb->data;
0123     int err = destopt->nexthdr;
0124
0125     spin_lock(&x->lock);
0126     if (!ipv6_addr_equal(&iph->saddr, (struct in6_addr *)x->coaddr) &&
0127         !ipv6_addr_any((struct in6_addr *)x->coaddr))
0128         err = -ENOENT;
0129     spin_unlock(&x->lock);
0130
0131     return err;
0132 }
0133
0134 /* Destination Option Header is inserted.
0135  * IP Header's src address is replaced with Home Address Option in
0136  * Destination Option Header.
0137  */
0138 static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
0139 {
0140     struct ipv6hdr *iph;
0141     struct ipv6_destopt_hdr *dstopt;
0142     struct ipv6_destopt_hao *hao;
0143     u8 nexthdr;
0144     int len;
0145
0146     skb_push(skb, -skb_network_offset(skb));
0147     iph = ipv6_hdr(skb);
0148
0149     nexthdr = *skb_mac_header(skb);
0150     *skb_mac_header(skb) = IPPROTO_DSTOPTS;
0151
0152     dstopt = (struct ipv6_destopt_hdr *)skb_transport_header(skb);
0153     dstopt->nexthdr = nexthdr;
0154
0155     hao = mip6_padn((char *)(dstopt + 1),
0156             calc_padlen(sizeof(*dstopt), 6));
0157
0158     hao->type = IPV6_TLV_HAO;
0159     BUILD_BUG_ON(sizeof(*hao) != 18);
0160     hao->length = sizeof(*hao) - 2;
0161
0162     len = ((char *)hao - (char *)dstopt) + sizeof(*hao);
0163
0164     memcpy(&hao->addr, &iph->saddr, sizeof(hao->addr));
0165     spin_lock_bh(&x->lock);
0166     memcpy(&iph->saddr, x->coaddr, sizeof(iph->saddr));
0167     spin_unlock_bh(&x->lock);
0168
0169     WARN_ON(len != x->props.header_len);
0170     dstopt->hdrlen = (x->props.header_len >> 3) - 1;
0171
0172     return 0;
0173 }
0174
0175 static inline int mip6_report_rl_allow(ktime_t stamp,
0176                        const struct in6_addr *dst,
0177                        const struct in6_addr *src, int iif)
0178 {
0179     int allow = 0;
0180
0181     spin_lock_bh(&mip6_report_rl.lock);
0182     if (mip6_report_rl.stamp != stamp ||
0183         mip6_report_rl.iif != iif ||
0184         !ipv6_addr_equal(&mip6_report_rl.src, src) ||
0185         !ipv6_addr_equal(&mip6_report_rl.dst, dst)) {
0186         mip6_report_rl.stamp = stamp;
0187         mip6_report_rl.iif = iif;
0188         mip6_report_rl.src = *src;
0189         mip6_report_rl.dst = *dst;
0190         allow = 1;
0191     }
0192     spin_unlock_bh(&mip6_report_rl.lock);
0193     return allow;
0194 }
0195
0196 static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb,
0197                    const struct flowi *fl)
0198 {
0199     struct net *net = xs_net(x);
0200     struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb;
0201     const struct flowi6 *fl6 = &fl->u.ip6;
0202     struct ipv6_destopt_hao *hao = NULL;
0203     struct xfrm_selector sel;
0204     int offset;
0205     ktime_t stamp;
0206     int err = 0;
0207
0208     if (unlikely(fl6->flowi6_proto == IPPROTO_MH &&
0209              fl6->fl6_mh_type <= IP6_MH_TYPE_MAX))
0210         goto out;
0211
0212     if (likely(opt->dsthao)) {
0213         offset = ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO);
0214         if (likely(offset >= 0))
0215             hao = (struct ipv6_destopt_hao *)
0216                     (skb_network_header(skb) + offset);
0217     }
0218
0219     stamp = skb_get_ktime(skb);
0220
0221     if (!mip6_report_rl_allow(stamp, &ipv6_hdr(skb)->daddr,
0222                   hao ? &hao->addr : &ipv6_hdr(skb)->saddr,
0223                   opt->iif))
0224         goto out;
0225
0226     memset(&sel, 0, sizeof(sel));
0227     memcpy(&sel.daddr, (xfrm_address_t *)&ipv6_hdr(skb)->daddr,
0228            sizeof(sel.daddr));
0229     sel.prefixlen_d = 128;
0230     memcpy(&sel.saddr, (xfrm_address_t *)&ipv6_hdr(skb)->saddr,
0231            sizeof(sel.saddr));
0232     sel.prefixlen_s = 128;
0233     sel.family = AF_INET6;
0234     sel.proto = fl6->flowi6_proto;
0235     sel.dport = xfrm_flowi_dport(fl, &fl6->uli);
0236     if (sel.dport)
0237         sel.dport_mask = htons(~0);
0238     sel.sport = xfrm_flowi_sport(fl, &fl6->uli);
0239     if (sel.sport)
0240         sel.sport_mask = htons(~0);
0241     sel.ifindex = fl6->flowi6_oif;
0242
0243     err = km_report(net, IPPROTO_DSTOPTS, &sel,
0244             (hao ? (xfrm_address_t *)&hao->addr : NULL));
0245
0246  out:
0247     return err;
0248 }
0249
0250 static int mip6_destopt_init_state(struct xfrm_state *x)
0251 {
0252     if (x->id.spi) {
0253         pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
0254         return -EINVAL;
0255     }
0256     if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
0257         pr_info("%s: state's mode is not %u: %u\n",
0258             __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
0259         return -EINVAL;
0260     }
0261
0262     x->props.header_len = sizeof(struct ipv6_destopt_hdr) +
0263         calc_padlen(sizeof(struct ipv6_destopt_hdr), 6) +
0264         sizeof(struct ipv6_destopt_hao);
0265     WARN_ON(x->props.header_len != 24);
0266
0267     return 0;
0268 }
0269
0270 /*
0271  * Do nothing about destroying since it has no specific operation for
0272  * destination options header unlike IPsec protocols.
0273  */
0274 static void mip6_destopt_destroy(struct xfrm_state *x)
0275 {
0276 }
0277
0278 static const struct xfrm_type mip6_destopt_type = {
0279     .owner      = THIS_MODULE,
0280     .proto      = IPPROTO_DSTOPTS,
0281     .flags      = XFRM_TYPE_NON_FRAGMENT | XFRM_TYPE_LOCAL_COADDR,
0282     .init_state = mip6_destopt_init_state,
0283     .destructor = mip6_destopt_destroy,
0284     .input      = mip6_destopt_input,
0285     .output     = mip6_destopt_output,
0286     .reject     = mip6_destopt_reject,
0287 };
0288
0289 static int mip6_rthdr_input(struct xfrm_state *x, struct sk_buff *skb)
0290 {
0291     const struct ipv6hdr *iph = ipv6_hdr(skb);
0292     struct rt2_hdr *rt2 = (struct rt2_hdr *)skb->data;
0293     int err = rt2->rt_hdr.nexthdr;
0294
0295     spin_lock(&x->lock);
0296     if (!ipv6_addr_equal(&iph->daddr, (struct in6_addr *)x->coaddr) &&
0297         !ipv6_addr_any((struct in6_addr *)x->coaddr))
0298         err = -ENOENT;
0299     spin_unlock(&x->lock);
0300
0301     return err;
0302 }
0303
0304 /* Routing Header type 2 is inserted.
0305  * IP Header's dst address is replaced with Routing Header's Home Address.
0306  */
0307 static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb)
0308 {
0309     struct ipv6hdr *iph;
0310     struct rt2_hdr *rt2;
0311     u8 nexthdr;
0312
0313     skb_push(skb, -skb_network_offset(skb));
0314     iph = ipv6_hdr(skb);
0315
0316     nexthdr = *skb_mac_header(skb);
0317     *skb_mac_header(skb) = IPPROTO_ROUTING;
0318
0319     rt2 = (struct rt2_hdr *)skb_transport_header(skb);
0320     rt2->rt_hdr.nexthdr = nexthdr;
0321     rt2->rt_hdr.hdrlen = (x->props.header_len >> 3) - 1;
0322     rt2->rt_hdr.type = IPV6_SRCRT_TYPE_2;
0323     rt2->rt_hdr.segments_left = 1;
0324     memset(&rt2->reserved, 0, sizeof(rt2->reserved));
0325
0326     WARN_ON(rt2->rt_hdr.hdrlen != 2);
0327
0328     memcpy(&rt2->addr, &iph->daddr, sizeof(rt2->addr));
0329     spin_lock_bh(&x->lock);
0330     memcpy(&iph->daddr, x->coaddr, sizeof(iph->daddr));
0331     spin_unlock_bh(&x->lock);
0332
0333     return 0;
0334 }
0335
0336 static int mip6_rthdr_init_state(struct xfrm_state *x)
0337 {
0338     if (x->id.spi) {
0339         pr_info("%s: spi is not 0: %u\n", __func__, x->id.spi);
0340         return -EINVAL;
0341     }
0342     if (x->props.mode != XFRM_MODE_ROUTEOPTIMIZATION) {
0343         pr_info("%s: state's mode is not %u: %u\n",
0344             __func__, XFRM_MODE_ROUTEOPTIMIZATION, x->props.mode);
0345         return -EINVAL;
0346     }
0347
0348     x->props.header_len = sizeof(struct rt2_hdr);
0349
0350     return 0;
0351 }
0352
0353 /*
0354  * Do nothing about destroying since it has no specific operation for routing
0355  * header type 2 unlike IPsec protocols.
0356  */
0357 static void mip6_rthdr_destroy(struct xfrm_state *x)
0358 {
0359 }
0360
0361 static const struct xfrm_type mip6_rthdr_type = {
0362     .owner      = THIS_MODULE,
0363     .proto      = IPPROTO_ROUTING,
0364     .flags      = XFRM_TYPE_NON_FRAGMENT | XFRM_TYPE_REMOTE_COADDR,
0365     .init_state = mip6_rthdr_init_state,
0366     .destructor = mip6_rthdr_destroy,
0367     .input      = mip6_rthdr_input,
0368     .output     = mip6_rthdr_output,
0369 };
0370
0371 static int __init mip6_init(void)
0372 {
0373     pr_info("Mobile IPv6\n");
0374
0375     if (xfrm_register_type(&mip6_destopt_type, AF_INET6) < 0) {
0376         pr_info("%s: can't add xfrm type(destopt)\n", __func__);
0377         goto mip6_destopt_xfrm_fail;
0378     }
0379     if (xfrm_register_type(&mip6_rthdr_type, AF_INET6) < 0) {
0380         pr_info("%s: can't add xfrm type(rthdr)\n", __func__);
0381         goto mip6_rthdr_xfrm_fail;
0382     }
0383     if (rawv6_mh_filter_register(mip6_mh_filter) < 0) {
0384         pr_info("%s: can't add rawv6 mh filter\n", __func__);
0385         goto mip6_rawv6_mh_fail;
0386     }
0387
0388
0389     return 0;
0390
0391  mip6_rawv6_mh_fail:
0392     xfrm_unregister_type(&mip6_rthdr_type, AF_INET6);
0393  mip6_rthdr_xfrm_fail:
0394     xfrm_unregister_type(&mip6_destopt_type, AF_INET6);
0395  mip6_destopt_xfrm_fail:
0396     return -EAGAIN;
0397 }
0398
0399 static void __exit mip6_fini(void)
0400 {
0401     if (rawv6_mh_filter_unregister(mip6_mh_filter) < 0)
0402         pr_info("%s: can't remove rawv6 mh filter\n", __func__);
0403     xfrm_unregister_type(&mip6_rthdr_type, AF_INET6);
0404     xfrm_unregister_type(&mip6_destopt_type, AF_INET6);
0405 }
0406
0407 module_init(mip6_init);
0408 module_exit(mip6_fini);
0409
0410 MODULE_LICENSE("GPL");
0411 MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_DSTOPTS);
0412 MODULE_ALIAS_XFRM_TYPE(AF_INET6, XFRM_PROTO_ROUTING);