1// SPDX-License-Identifier: GPL-2.0+
2/*
3 *  IPv6 IOAM Lightweight Tunnel implementation
4 *
5 *  Author:
6 *  Justin Iurman <justin.iurman@uliege.be>
7 */
8
9#include <linux/kernel.h>
10#include <linux/skbuff.h>
11#include <linux/net.h>
12#include <linux/in6.h>
13#include <linux/ioam6.h>
14#include <linux/ioam6_iptunnel.h>
15#include <net/dst.h>
16#include <net/sock.h>
17#include <net/lwtunnel.h>
18#include <net/ioam6.h>
19#include <net/netlink.h>
20#include <net/ipv6.h>
21#include <net/dst_cache.h>
22#include <net/ip6_route.h>
23#include <net/addrconf.h>
24
25#define IOAM6_MASK_SHORT_FIELDS 0xff100000
26#define IOAM6_MASK_WIDE_FIELDS 0xe00000
27
28struct ioam6_lwt_encap {
29	struct ipv6_hopopt_hdr eh;
30	u8 pad[2];			/* 2-octet padding for 4n-alignment */
31	struct ioam6_hdr ioamh;
32	struct ioam6_trace_hdr traceh;
33} __packed;
34
35struct ioam6_lwt_freq {
36	u32 k;
37	u32 n;
38};
39
40struct ioam6_lwt {
41	struct dst_cache cache;
42	struct ioam6_lwt_freq freq;
43	atomic_t pkt_cnt;
44	u8 mode;
45	struct in6_addr tundst;
46	struct ioam6_lwt_encap	tuninfo;
47};
48
49static const struct netlink_range_validation freq_range = {
50	.min = IOAM6_IPTUNNEL_FREQ_MIN,
51	.max = IOAM6_IPTUNNEL_FREQ_MAX,
52};
53
54static struct ioam6_lwt *ioam6_lwt_state(struct lwtunnel_state *lwt)
55{
56	return (struct ioam6_lwt *)lwt->data;
57}
58
59static struct ioam6_lwt_encap *ioam6_lwt_info(struct lwtunnel_state *lwt)
60{
61	return &ioam6_lwt_state(lwt)->tuninfo;
62}
63
64static struct ioam6_trace_hdr *ioam6_lwt_trace(struct lwtunnel_state *lwt)
65{
66	return &(ioam6_lwt_state(lwt)->tuninfo.traceh);
67}
68
69static const struct nla_policy ioam6_iptunnel_policy[IOAM6_IPTUNNEL_MAX + 1] = {
70	[IOAM6_IPTUNNEL_FREQ_K] = NLA_POLICY_FULL_RANGE(NLA_U32, &freq_range),
71	[IOAM6_IPTUNNEL_FREQ_N] = NLA_POLICY_FULL_RANGE(NLA_U32, &freq_range),
72	[IOAM6_IPTUNNEL_MODE]	= NLA_POLICY_RANGE(NLA_U8,
73						   IOAM6_IPTUNNEL_MODE_MIN,
74						   IOAM6_IPTUNNEL_MODE_MAX),
75	[IOAM6_IPTUNNEL_DST]	= NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)),
76	[IOAM6_IPTUNNEL_TRACE]	= NLA_POLICY_EXACT_LEN(sizeof(struct ioam6_trace_hdr)),
77};
78
79static bool ioam6_validate_trace_hdr(struct ioam6_trace_hdr *trace)
80{
81	u32 fields;
82
83	if (!trace->type_be32 || !trace->remlen ||
84	    trace->remlen > IOAM6_TRACE_DATA_SIZE_MAX / 4 ||
85	    trace->type.bit12 | trace->type.bit13 | trace->type.bit14 |
86	    trace->type.bit15 | trace->type.bit16 | trace->type.bit17 |
87	    trace->type.bit18 | trace->type.bit19 | trace->type.bit20 |
88	    trace->type.bit21)
89		return false;
90
91	trace->nodelen = 0;
92	fields = be32_to_cpu(trace->type_be32);
93
94	trace->nodelen += hweight32(fields & IOAM6_MASK_SHORT_FIELDS)
95				* (sizeof(__be32) / 4);
96	trace->nodelen += hweight32(fields & IOAM6_MASK_WIDE_FIELDS)
97				* (sizeof(__be64) / 4);
98
99	return true;
100}
101
102static int ioam6_build_state(struct net *net, struct nlattr *nla,
103			     unsigned int family, const void *cfg,
104			     struct lwtunnel_state **ts,
105			     struct netlink_ext_ack *extack)
106{
107	struct nlattr *tb[IOAM6_IPTUNNEL_MAX + 1];
108	struct ioam6_lwt_encap *tuninfo;
109	struct ioam6_trace_hdr *trace;
110	struct lwtunnel_state *lwt;
111	struct ioam6_lwt *ilwt;
112	int len_aligned, err;
113	u32 freq_k, freq_n;
114	u8 mode;
115
116	if (family != AF_INET6)
117		return -EINVAL;
118
119	err = nla_parse_nested(tb, IOAM6_IPTUNNEL_MAX, nla,
120			       ioam6_iptunnel_policy, extack);
121	if (err < 0)
122		return err;
123
124	if ((!tb[IOAM6_IPTUNNEL_FREQ_K] && tb[IOAM6_IPTUNNEL_FREQ_N]) ||
125	    (tb[IOAM6_IPTUNNEL_FREQ_K] && !tb[IOAM6_IPTUNNEL_FREQ_N])) {
126		NL_SET_ERR_MSG(extack, "freq: missing parameter");
127		return -EINVAL;
128	} else if (!tb[IOAM6_IPTUNNEL_FREQ_K] && !tb[IOAM6_IPTUNNEL_FREQ_N]) {
129		freq_k = IOAM6_IPTUNNEL_FREQ_MIN;
130		freq_n = IOAM6_IPTUNNEL_FREQ_MIN;
131	} else {
132		freq_k = nla_get_u32(tb[IOAM6_IPTUNNEL_FREQ_K]);
133		freq_n = nla_get_u32(tb[IOAM6_IPTUNNEL_FREQ_N]);
134
135		if (freq_k > freq_n) {
136			NL_SET_ERR_MSG(extack, "freq: k > n is forbidden");
137			return -EINVAL;
138		}
139	}
140
141	if (!tb[IOAM6_IPTUNNEL_MODE])
142		mode = IOAM6_IPTUNNEL_MODE_INLINE;
143	else
144		mode = nla_get_u8(tb[IOAM6_IPTUNNEL_MODE]);
145
146	if (!tb[IOAM6_IPTUNNEL_DST] && mode != IOAM6_IPTUNNEL_MODE_INLINE) {
147		NL_SET_ERR_MSG(extack, "this mode needs a tunnel destination");
148		return -EINVAL;
149	}
150
151	if (!tb[IOAM6_IPTUNNEL_TRACE]) {
152		NL_SET_ERR_MSG(extack, "missing trace");
153		return -EINVAL;
154	}
155
156	trace = nla_data(tb[IOAM6_IPTUNNEL_TRACE]);
157	if (!ioam6_validate_trace_hdr(trace)) {
158		NL_SET_ERR_MSG_ATTR(extack, tb[IOAM6_IPTUNNEL_TRACE],
159				    "invalid trace validation");
160		return -EINVAL;
161	}
162
163	len_aligned = ALIGN(trace->remlen * 4, 8);
164	lwt = lwtunnel_state_alloc(sizeof(*ilwt) + len_aligned);
165	if (!lwt)
166		return -ENOMEM;
167
168	ilwt = ioam6_lwt_state(lwt);
169	err = dst_cache_init(&ilwt->cache, GFP_ATOMIC);
170	if (err) {
171		kfree(lwt);
172		return err;
173	}
174
175	atomic_set(&ilwt->pkt_cnt, 0);
176	ilwt->freq.k = freq_k;
177	ilwt->freq.n = freq_n;
178
179	ilwt->mode = mode;
180	if (tb[IOAM6_IPTUNNEL_DST])
181		ilwt->tundst = nla_get_in6_addr(tb[IOAM6_IPTUNNEL_DST]);
182
183	tuninfo = ioam6_lwt_info(lwt);
184	tuninfo->eh.hdrlen = ((sizeof(*tuninfo) + len_aligned) >> 3) - 1;
185	tuninfo->pad[0] = IPV6_TLV_PADN;
186	tuninfo->ioamh.type = IOAM6_TYPE_PREALLOC;
187	tuninfo->ioamh.opt_type = IPV6_TLV_IOAM;
188	tuninfo->ioamh.opt_len = sizeof(tuninfo->ioamh) - 2 + sizeof(*trace)
189					+ trace->remlen * 4;
190
191	memcpy(&tuninfo->traceh, trace, sizeof(*trace));
192
193	if (len_aligned - trace->remlen * 4) {
194		tuninfo->traceh.data[trace->remlen * 4] = IPV6_TLV_PADN;
195		tuninfo->traceh.data[trace->remlen * 4 + 1] = 2;
196	}
197
198	lwt->type = LWTUNNEL_ENCAP_IOAM6;
199	lwt->flags |= LWTUNNEL_STATE_OUTPUT_REDIRECT;
200
201	*ts = lwt;
202
203	return 0;
204}
205
206static int ioam6_do_fill(struct net *net, struct sk_buff *skb)
207{
208	struct ioam6_trace_hdr *trace;
209	struct ioam6_namespace *ns;
210
211	trace = (struct ioam6_trace_hdr *)(skb_transport_header(skb)
212					   + sizeof(struct ipv6_hopopt_hdr) + 2
213					   + sizeof(struct ioam6_hdr));
214
215	ns = ioam6_namespace(net, trace->namespace_id);
216	if (ns)
217		ioam6_fill_trace_data(skb, ns, trace, false);
218
219	return 0;
220}
221
222static int ioam6_do_inline(struct net *net, struct sk_buff *skb,
223			   struct ioam6_lwt_encap *tuninfo)
224{
225	struct ipv6hdr *oldhdr, *hdr;
226	int hdrlen, err;
227
228	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
229
230	err = skb_cow_head(skb, hdrlen + skb->mac_len);
231	if (unlikely(err))
232		return err;
233
234	oldhdr = ipv6_hdr(skb);
235	skb_pull(skb, sizeof(*oldhdr));
236	skb_postpull_rcsum(skb, skb_network_header(skb), sizeof(*oldhdr));
237
238	skb_push(skb, sizeof(*oldhdr) + hdrlen);
239	skb_reset_network_header(skb);
240	skb_mac_header_rebuild(skb);
241
242	hdr = ipv6_hdr(skb);
243	memmove(hdr, oldhdr, sizeof(*oldhdr));
244	tuninfo->eh.nexthdr = hdr->nexthdr;
245
246	skb_set_transport_header(skb, sizeof(*hdr));
247	skb_postpush_rcsum(skb, hdr, sizeof(*hdr) + hdrlen);
248
249	memcpy(skb_transport_header(skb), (u8 *)tuninfo, hdrlen);
250
251	hdr->nexthdr = NEXTHDR_HOP;
252	hdr->payload_len = cpu_to_be16(skb->len - sizeof(*hdr));
253
254	return ioam6_do_fill(net, skb);
255}
256
257static int ioam6_do_encap(struct net *net, struct sk_buff *skb,
258			  struct ioam6_lwt_encap *tuninfo,
259			  struct in6_addr *tundst)
260{
261	struct dst_entry *dst = skb_dst(skb);
262	struct ipv6hdr *hdr, *inner_hdr;
263	int hdrlen, len, err;
264
265	hdrlen = (tuninfo->eh.hdrlen + 1) << 3;
266	len = sizeof(*hdr) + hdrlen;
267
268	err = skb_cow_head(skb, len + skb->mac_len);
269	if (unlikely(err))
270		return err;
271
272	inner_hdr = ipv6_hdr(skb);
273
274	skb_push(skb, len);
275	skb_reset_network_header(skb);
276	skb_mac_header_rebuild(skb);
277	skb_set_transport_header(skb, sizeof(*hdr));
278
279	tuninfo->eh.nexthdr = NEXTHDR_IPV6;
280	memcpy(skb_transport_header(skb), (u8 *)tuninfo, hdrlen);
281
282	hdr = ipv6_hdr(skb);
283	memcpy(hdr, inner_hdr, sizeof(*hdr));
284
285	hdr->nexthdr = NEXTHDR_HOP;
286	hdr->payload_len = cpu_to_be16(skb->len - sizeof(*hdr));
287	hdr->daddr = *tundst;
288	ipv6_dev_get_saddr(net, dst->dev, &hdr->daddr,
289			   IPV6_PREFER_SRC_PUBLIC, &hdr->saddr);
290
291	skb_postpush_rcsum(skb, hdr, len);
292
293	return ioam6_do_fill(net, skb);
294}
295
296static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
297{
298	struct dst_entry *dst = skb_dst(skb);
299	struct in6_addr orig_daddr;
300	struct ioam6_lwt *ilwt;
301	int err = -EINVAL;
302	u32 pkt_cnt;
303
304	if (skb->protocol != htons(ETH_P_IPV6))
305		goto drop;
306
307	ilwt = ioam6_lwt_state(dst->lwtstate);
308
309	/* Check for insertion frequency (i.e., "k over n" insertions) */
310	pkt_cnt = atomic_fetch_inc(&ilwt->pkt_cnt);
311	if (pkt_cnt % ilwt->freq.n >= ilwt->freq.k)
312		goto out;
313
314	orig_daddr = ipv6_hdr(skb)->daddr;
315
316	switch (ilwt->mode) {
317	case IOAM6_IPTUNNEL_MODE_INLINE:
318do_inline:
319		/* Direct insertion - if there is no Hop-by-Hop yet */
320		if (ipv6_hdr(skb)->nexthdr == NEXTHDR_HOP)
321			goto out;
322
323		err = ioam6_do_inline(net, skb, &ilwt->tuninfo);
324		if (unlikely(err))
325			goto drop;
326
327		break;
328	case IOAM6_IPTUNNEL_MODE_ENCAP:
329do_encap:
330		/* Encapsulation (ip6ip6) */
331		err = ioam6_do_encap(net, skb, &ilwt->tuninfo, &ilwt->tundst);
332		if (unlikely(err))
333			goto drop;
334
335		break;
336	case IOAM6_IPTUNNEL_MODE_AUTO:
337		/* Automatic (RFC8200 compliant):
338		 *  - local packets -> INLINE mode
339		 *  - in-transit packets -> ENCAP mode
340		 */
341		if (!skb->dev)
342			goto do_inline;
343
344		goto do_encap;
345	default:
346		goto drop;
347	}
348
349	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
350	if (unlikely(err))
351		goto drop;
352
353	if (!ipv6_addr_equal(&orig_daddr, &ipv6_hdr(skb)->daddr)) {
354		preempt_disable();
355		dst = dst_cache_get(&ilwt->cache);
356		preempt_enable();
357
358		if (unlikely(!dst)) {
359			struct ipv6hdr *hdr = ipv6_hdr(skb);
360			struct flowi6 fl6;
361
362			memset(&fl6, 0, sizeof(fl6));
363			fl6.daddr = hdr->daddr;
364			fl6.saddr = hdr->saddr;
365			fl6.flowlabel = ip6_flowinfo(hdr);
366			fl6.flowi6_mark = skb->mark;
367			fl6.flowi6_proto = hdr->nexthdr;
368
369			dst = ip6_route_output(net, NULL, &fl6);
370			if (dst->error) {
371				err = dst->error;
372				dst_release(dst);
373				goto drop;
374			}
375
376			preempt_disable();
377			dst_cache_set_ip6(&ilwt->cache, dst, &fl6.saddr);
378			preempt_enable();
379		}
380
381		skb_dst_drop(skb);
382		skb_dst_set(skb, dst);
383
384		return dst_output(net, sk, skb);
385	}
386out:
387	return dst->lwtstate->orig_output(net, sk, skb);
388drop:
389	kfree_skb(skb);
390	return err;
391}
392
393static void ioam6_destroy_state(struct lwtunnel_state *lwt)
394{
395	dst_cache_destroy(&ioam6_lwt_state(lwt)->cache);
396}
397
398static int ioam6_fill_encap_info(struct sk_buff *skb,
399				 struct lwtunnel_state *lwtstate)
400{
401	struct ioam6_lwt *ilwt = ioam6_lwt_state(lwtstate);
402	int err;
403
404	err = nla_put_u32(skb, IOAM6_IPTUNNEL_FREQ_K, ilwt->freq.k);
405	if (err)
406		goto ret;
407
408	err = nla_put_u32(skb, IOAM6_IPTUNNEL_FREQ_N, ilwt->freq.n);
409	if (err)
410		goto ret;
411
412	err = nla_put_u8(skb, IOAM6_IPTUNNEL_MODE, ilwt->mode);
413	if (err)
414		goto ret;
415
416	if (ilwt->mode != IOAM6_IPTUNNEL_MODE_INLINE) {
417		err = nla_put_in6_addr(skb, IOAM6_IPTUNNEL_DST, &ilwt->tundst);
418		if (err)
419			goto ret;
420	}
421
422	err = nla_put(skb, IOAM6_IPTUNNEL_TRACE, sizeof(ilwt->tuninfo.traceh),
423		      &ilwt->tuninfo.traceh);
424ret:
425	return err;
426}
427
428static int ioam6_encap_nlsize(struct lwtunnel_state *lwtstate)
429{
430	struct ioam6_lwt *ilwt = ioam6_lwt_state(lwtstate);
431	int nlsize;
432
433	nlsize = nla_total_size(sizeof(ilwt->freq.k)) +
434		  nla_total_size(sizeof(ilwt->freq.n)) +
435		  nla_total_size(sizeof(ilwt->mode)) +
436		  nla_total_size(sizeof(ilwt->tuninfo.traceh));
437
438	if (ilwt->mode != IOAM6_IPTUNNEL_MODE_INLINE)
439		nlsize += nla_total_size(sizeof(ilwt->tundst));
440
441	return nlsize;
442}
443
444static int ioam6_encap_cmp(struct lwtunnel_state *a, struct lwtunnel_state *b)
445{
446	struct ioam6_trace_hdr *trace_a = ioam6_lwt_trace(a);
447	struct ioam6_trace_hdr *trace_b = ioam6_lwt_trace(b);
448	struct ioam6_lwt *ilwt_a = ioam6_lwt_state(a);
449	struct ioam6_lwt *ilwt_b = ioam6_lwt_state(b);
450
451	return (ilwt_a->freq.k != ilwt_b->freq.k ||
452		ilwt_a->freq.n != ilwt_b->freq.n ||
453		ilwt_a->mode != ilwt_b->mode ||
454		(ilwt_a->mode != IOAM6_IPTUNNEL_MODE_INLINE &&
455		 !ipv6_addr_equal(&ilwt_a->tundst, &ilwt_b->tundst)) ||
456		trace_a->namespace_id != trace_b->namespace_id);
457}
458
459static const struct lwtunnel_encap_ops ioam6_iptun_ops = {
460	.build_state		= ioam6_build_state,
461	.destroy_state		= ioam6_destroy_state,
462	.output		= ioam6_output,
463	.fill_encap		= ioam6_fill_encap_info,
464	.get_encap_size	= ioam6_encap_nlsize,
465	.cmp_encap		= ioam6_encap_cmp,
466	.owner			= THIS_MODULE,
467};
468
469int __init ioam6_iptunnel_init(void)
470{
471	return lwtunnel_encap_add_ops(&ioam6_iptun_ops, LWTUNNEL_ENCAP_IOAM6);
472}
473
474void ioam6_iptunnel_exit(void)
475{
476	lwtunnel_encap_del_ops(&ioam6_iptun_ops, LWTUNNEL_ENCAP_IOAM6);
477}
478