1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * SR-IPv6 implementation 4 * 5 * Authors: 6 * David Lebrun <david.lebrun@uclouvain.be> 7 * eBPF support: Mathieu Xhonneux <m.xhonneux@gmail.com> 8 */ 9 10 #include <linux/filter.h> 11 #include <linux/types.h> 12 #include <linux/skbuff.h> 13 #include <linux/net.h> 14 #include <linux/module.h> 15 #include <net/ip.h> 16 #include <net/lwtunnel.h> 17 #include <net/netevent.h> 18 #include <net/netns/generic.h> 19 #include <net/ip6_fib.h> 20 #include <net/route.h> 21 #include <net/seg6.h> 22 #include <linux/seg6.h> 23 #include <linux/seg6_local.h> 24 #include <net/addrconf.h> 25 #include <net/ip6_route.h> 26 #include <net/dst_cache.h> 27 #include <net/ip_tunnels.h> 28 #ifdef CONFIG_IPV6_SEG6_HMAC 29 #include <net/seg6_hmac.h> 30 #endif 31 #include <net/seg6_local.h> 32 #include <linux/etherdevice.h> 33 #include <linux/bpf.h> 34 #include <linux/netfilter.h> 35 36 #define SEG6_F_ATTR(i) BIT(i) 37 38 struct seg6_local_lwt; 39 40 /* callbacks used for customizing the creation and destruction of a behavior */ 41 struct seg6_local_lwtunnel_ops { 42 int (*build_state)(struct seg6_local_lwt *slwt, const void *cfg, 43 struct netlink_ext_ack *extack); 44 void (*destroy_state)(struct seg6_local_lwt *slwt); 45 }; 46 47 struct seg6_action_desc { 48 int action; 49 unsigned long attrs; 50 51 /* The optattrs field is used for specifying all the optional 52 * attributes supported by a specific behavior. 53 * It means that if one of these attributes is not provided in the 54 * netlink message during the behavior creation, no errors will be 55 * returned to the userspace. 56 * 57 * Each attribute can be only of two types (mutually exclusive): 58 * 1) required or 2) optional. 59 * Every user MUST obey to this rule! If you set an attribute as 60 * required the same attribute CANNOT be set as optional and vice 61 * versa. 62 */ 63 unsigned long optattrs; 64 65 int (*input)(struct sk_buff *skb, struct seg6_local_lwt *slwt); 66 int static_headroom; 67 68 struct seg6_local_lwtunnel_ops slwt_ops; 69 }; 70 71 struct bpf_lwt_prog { 72 struct bpf_prog *prog; 73 char *name; 74 }; 75 76 /* default length values (expressed in bits) for both Locator-Block and 77 * Locator-Node Function. 78 * 79 * Both SEG6_LOCAL_LCBLOCK_DBITS and SEG6_LOCAL_LCNODE_FN_DBITS *must* be: 80 * i) greater than 0; 81 * ii) evenly divisible by 8. In other terms, the lengths of the 82 * Locator-Block and Locator-Node Function must be byte-aligned (we can 83 * relax this constraint in the future if really needed). 84 * 85 * Moreover, a third condition must hold: 86 * iii) SEG6_LOCAL_LCBLOCK_DBITS + SEG6_LOCAL_LCNODE_FN_DBITS <= 128. 87 * 88 * The correctness of SEG6_LOCAL_LCBLOCK_DBITS and SEG6_LOCAL_LCNODE_FN_DBITS 89 * values are checked during the kernel compilation. If the compilation stops, 90 * check the value of these parameters to see if they meet conditions (i), (ii) 91 * and (iii). 92 */ 93 #define SEG6_LOCAL_LCBLOCK_DBITS 32 94 #define SEG6_LOCAL_LCNODE_FN_DBITS 16 95 96 /* The following next_csid_chk_{cntr,lcblock,lcblock_fn}_bits macros can be 97 * used directly to check whether the lengths (in bits) of Locator-Block and 98 * Locator-Node Function are valid according to (i), (ii), (iii). 99 */ 100 #define next_csid_chk_cntr_bits(blen, flen) \ 101 ((blen) + (flen) > 128) 102 103 #define next_csid_chk_lcblock_bits(blen) \ 104 ({ \ 105 typeof(blen) __tmp = blen; \ 106 (!__tmp || __tmp > 120 || (__tmp & 0x07)); \ 107 }) 108 109 #define next_csid_chk_lcnode_fn_bits(flen) \ 110 next_csid_chk_lcblock_bits(flen) 111 112 /* flag indicating that flavors are set up for a given End* behavior */ 113 #define SEG6_F_LOCAL_FLAVORS SEG6_F_ATTR(SEG6_LOCAL_FLAVORS) 114 115 #define SEG6_F_LOCAL_FLV_OP(flvname) BIT(SEG6_LOCAL_FLV_OP_##flvname) 116 #define SEG6_F_LOCAL_FLV_NEXT_CSID SEG6_F_LOCAL_FLV_OP(NEXT_CSID) 117 #define SEG6_F_LOCAL_FLV_PSP SEG6_F_LOCAL_FLV_OP(PSP) 118 119 /* Supported RFC8986 Flavor operations are reported in this bitmask */ 120 #define SEG6_LOCAL_FLV8986_SUPP_OPS SEG6_F_LOCAL_FLV_PSP 121 122 #define SEG6_LOCAL_END_FLV_SUPP_OPS (SEG6_F_LOCAL_FLV_NEXT_CSID | \ 123 SEG6_LOCAL_FLV8986_SUPP_OPS) 124 #define SEG6_LOCAL_END_X_FLV_SUPP_OPS SEG6_F_LOCAL_FLV_NEXT_CSID 125 126 struct seg6_flavors_info { 127 /* Flavor operations */ 128 __u32 flv_ops; 129 130 /* Locator-Block length, expressed in bits */ 131 __u8 lcblock_bits; 132 /* Locator-Node Function length, expressed in bits*/ 133 __u8 lcnode_func_bits; 134 }; 135 136 enum seg6_end_dt_mode { 137 DT_INVALID_MODE = -EINVAL, 138 DT_LEGACY_MODE = 0, 139 DT_VRF_MODE = 1, 140 }; 141 142 struct seg6_end_dt_info { 143 enum seg6_end_dt_mode mode; 144 145 struct net *net; 146 /* VRF device associated to the routing table used by the SRv6 147 * End.DT4/DT6 behavior for routing IPv4/IPv6 packets. 148 */ 149 int vrf_ifindex; 150 int vrf_table; 151 152 /* tunneled packet family (IPv4 or IPv6). 153 * Protocol and header length are inferred from family. 154 */ 155 u16 family; 156 }; 157 158 struct pcpu_seg6_local_counters { 159 u64_stats_t packets; 160 u64_stats_t bytes; 161 u64_stats_t errors; 162 163 struct u64_stats_sync syncp; 164 }; 165 166 /* This struct groups all the SRv6 Behavior counters supported so far. 167 * 168 * put_nla_counters() makes use of this data structure to collect all counter 169 * values after the per-CPU counter evaluation has been performed. 170 * Finally, each counter value (in seg6_local_counters) is stored in the 171 * corresponding netlink attribute and sent to user space. 172 * 173 * NB: we don't want to expose this structure to user space! 174 */ 175 struct seg6_local_counters { 176 __u64 packets; 177 __u64 bytes; 178 __u64 errors; 179 }; 180 181 #define seg6_local_alloc_pcpu_counters(__gfp) \ 182 __netdev_alloc_pcpu_stats(struct pcpu_seg6_local_counters, \ 183 ((__gfp) | __GFP_ZERO)) 184 185 #define SEG6_F_LOCAL_COUNTERS SEG6_F_ATTR(SEG6_LOCAL_COUNTERS) 186 187 struct seg6_local_lwt { 188 int action; 189 struct ipv6_sr_hdr *srh; 190 int table; 191 struct in_addr nh4; 192 struct in6_addr nh6; 193 int iif; 194 int oif; 195 struct bpf_lwt_prog bpf; 196 #ifdef CONFIG_NET_L3_MASTER_DEV 197 struct seg6_end_dt_info dt_info; 198 #endif 199 struct seg6_flavors_info flv_info; 200 201 struct pcpu_seg6_local_counters __percpu *pcpu_counters; 202 203 int headroom; 204 struct seg6_action_desc *desc; 205 /* unlike the required attrs, we have to track the optional attributes 206 * that have been effectively parsed. 207 */ 208 unsigned long parsed_optattrs; 209 }; 210 211 static struct seg6_local_lwt *seg6_local_lwtunnel(struct lwtunnel_state *lwt) 212 { 213 return (struct seg6_local_lwt *)lwt->data; 214 } 215 216 static struct ipv6_sr_hdr *get_and_validate_srh(struct sk_buff *skb) 217 { 218 struct ipv6_sr_hdr *srh; 219 220 srh = seg6_get_srh(skb, IP6_FH_F_SKIP_RH); 221 if (!srh) 222 return NULL; 223 224 #ifdef CONFIG_IPV6_SEG6_HMAC 225 if (!seg6_hmac_validate_skb(skb)) 226 return NULL; 227 #endif 228 229 return srh; 230 } 231 232 static bool decap_and_validate(struct sk_buff *skb, int proto) 233 { 234 struct ipv6_sr_hdr *srh; 235 unsigned int off = 0; 236 237 srh = seg6_get_srh(skb, 0); 238 if (srh && srh->segments_left > 0) 239 return false; 240 241 #ifdef CONFIG_IPV6_SEG6_HMAC 242 if (srh && !seg6_hmac_validate_skb(skb)) 243 return false; 244 #endif 245 246 if (ipv6_find_hdr(skb, &off, proto, NULL, NULL) < 0) 247 return false; 248 249 if (!pskb_pull(skb, off)) 250 return false; 251 252 skb_postpull_rcsum(skb, skb_network_header(skb), off); 253 254 skb_reset_network_header(skb); 255 skb_reset_transport_header(skb); 256 if (iptunnel_pull_offloads(skb)) 257 return false; 258 259 if (proto == IPPROTO_IPIP) { 260 int iif = IP6CB(skb)->iif; 261 262 memset(IPCB(skb), 0, sizeof(*IPCB(skb))); 263 IPCB(skb)->iif = iif; 264 } else if (proto == IPPROTO_IPV6) { 265 bool l3slave = ipv6_l3mdev_skb(IP6CB(skb)->flags); 266 int iif = IP6CB(skb)->iif; 267 268 memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); 269 IP6CB(skb)->iif = iif; 270 IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); 271 if (l3slave) 272 IP6CB(skb)->flags |= IP6SKB_L3SLAVE; 273 } 274 275 return true; 276 } 277 278 static void advance_nextseg(struct ipv6_sr_hdr *srh, struct in6_addr *daddr) 279 { 280 struct in6_addr *addr; 281 282 srh->segments_left--; 283 addr = srh->segments + srh->segments_left; 284 *daddr = *addr; 285 } 286 287 static int 288 seg6_lookup_any_nexthop(struct sk_buff *skb, struct in6_addr *nhaddr, 289 u32 tbl_id, bool local_delivery, int oif) 290 { 291 struct net *net = dev_net(skb->dev); 292 struct ipv6hdr *hdr = ipv6_hdr(skb); 293 int flags = RT6_LOOKUP_F_HAS_SADDR; 294 struct dst_entry *dst = NULL; 295 struct rt6_info *rt; 296 struct flowi6 fl6; 297 int dev_flags = 0; 298 299 memset(&fl6, 0, sizeof(fl6)); 300 fl6.flowi6_iif = skb->dev->ifindex; 301 fl6.flowi6_oif = oif; 302 fl6.daddr = nhaddr ? *nhaddr : hdr->daddr; 303 fl6.saddr = hdr->saddr; 304 fl6.flowlabel = ip6_flowinfo(hdr); 305 fl6.flowi6_mark = skb->mark; 306 fl6.flowi6_proto = hdr->nexthdr; 307 308 if (nhaddr) 309 fl6.flowi6_flags = FLOWI_FLAG_KNOWN_NH; 310 311 if (!tbl_id && !oif) { 312 dst = ip6_route_input_lookup(net, skb->dev, &fl6, skb, flags); 313 } else if (tbl_id) { 314 struct fib6_table *table; 315 316 table = fib6_get_table(net, tbl_id); 317 if (!table) 318 goto out; 319 320 rt = ip6_pol_route(net, table, oif, &fl6, skb, flags); 321 dst = &rt->dst; 322 } else { 323 dst = ip6_route_output(net, NULL, &fl6); 324 } 325 326 /* we want to discard traffic destined for local packet processing, 327 * if @local_delivery is set to false. 328 */ 329 if (!local_delivery) 330 dev_flags |= IFF_LOOPBACK; 331 332 if (dst && (dst_dev(dst)->flags & dev_flags) && !dst->error) { 333 dst_release(dst); 334 dst = NULL; 335 } 336 337 out: 338 if (!dst) { 339 rt = net->ipv6.ip6_blk_hole_entry; 340 dst = &rt->dst; 341 dst_hold(dst); 342 } 343 344 skb_dst_drop(skb); 345 skb_dst_set(skb, dst); 346 return dst->error; 347 } 348 349 int seg6_lookup_nexthop(struct sk_buff *skb, 350 struct in6_addr *nhaddr, u32 tbl_id) 351 { 352 return seg6_lookup_any_nexthop(skb, nhaddr, tbl_id, false, 0); 353 } 354 355 static __u8 seg6_flv_lcblock_octects(const struct seg6_flavors_info *finfo) 356 { 357 return finfo->lcblock_bits >> 3; 358 } 359 360 static __u8 seg6_flv_lcnode_func_octects(const struct seg6_flavors_info *finfo) 361 { 362 return finfo->lcnode_func_bits >> 3; 363 } 364 365 static bool seg6_next_csid_is_arg_zero(const struct in6_addr *addr, 366 const struct seg6_flavors_info *finfo) 367 { 368 __u8 fnc_octects = seg6_flv_lcnode_func_octects(finfo); 369 __u8 blk_octects = seg6_flv_lcblock_octects(finfo); 370 __u8 arg_octects; 371 int i; 372 373 arg_octects = 16 - blk_octects - fnc_octects; 374 for (i = 0; i < arg_octects; ++i) { 375 if (addr->s6_addr[blk_octects + fnc_octects + i] != 0x00) 376 return false; 377 } 378 379 return true; 380 } 381 382 /* assume that DA.Argument length > 0 */ 383 static void seg6_next_csid_advance_arg(struct in6_addr *addr, 384 const struct seg6_flavors_info *finfo) 385 { 386 __u8 fnc_octects = seg6_flv_lcnode_func_octects(finfo); 387 __u8 blk_octects = seg6_flv_lcblock_octects(finfo); 388 389 /* advance DA.Argument */ 390 memmove(&addr->s6_addr[blk_octects], 391 &addr->s6_addr[blk_octects + fnc_octects], 392 16 - blk_octects - fnc_octects); 393 394 memset(&addr->s6_addr[16 - fnc_octects], 0x00, fnc_octects); 395 } 396 397 static int input_action_end_finish(struct sk_buff *skb, 398 struct seg6_local_lwt *slwt) 399 { 400 seg6_lookup_nexthop(skb, NULL, 0); 401 402 return dst_input(skb); 403 } 404 405 static int input_action_end_core(struct sk_buff *skb, 406 struct seg6_local_lwt *slwt) 407 { 408 struct ipv6_sr_hdr *srh; 409 410 srh = get_and_validate_srh(skb); 411 if (!srh) 412 goto drop; 413 414 advance_nextseg(srh, &ipv6_hdr(skb)->daddr); 415 416 return input_action_end_finish(skb, slwt); 417 418 drop: 419 kfree_skb(skb); 420 return -EINVAL; 421 } 422 423 static int end_next_csid_core(struct sk_buff *skb, struct seg6_local_lwt *slwt) 424 { 425 const struct seg6_flavors_info *finfo = &slwt->flv_info; 426 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 427 428 if (seg6_next_csid_is_arg_zero(daddr, finfo)) 429 return input_action_end_core(skb, slwt); 430 431 /* update DA */ 432 seg6_next_csid_advance_arg(daddr, finfo); 433 434 return input_action_end_finish(skb, slwt); 435 } 436 437 static int input_action_end_x_finish(struct sk_buff *skb, 438 struct seg6_local_lwt *slwt) 439 { 440 seg6_lookup_any_nexthop(skb, &slwt->nh6, 0, false, slwt->oif); 441 442 return dst_input(skb); 443 } 444 445 static int input_action_end_x_core(struct sk_buff *skb, 446 struct seg6_local_lwt *slwt) 447 { 448 struct ipv6_sr_hdr *srh; 449 450 srh = get_and_validate_srh(skb); 451 if (!srh) 452 goto drop; 453 454 advance_nextseg(srh, &ipv6_hdr(skb)->daddr); 455 456 return input_action_end_x_finish(skb, slwt); 457 458 drop: 459 kfree_skb(skb); 460 return -EINVAL; 461 } 462 463 static int end_x_next_csid_core(struct sk_buff *skb, 464 struct seg6_local_lwt *slwt) 465 { 466 const struct seg6_flavors_info *finfo = &slwt->flv_info; 467 struct in6_addr *daddr = &ipv6_hdr(skb)->daddr; 468 469 if (seg6_next_csid_is_arg_zero(daddr, finfo)) 470 return input_action_end_x_core(skb, slwt); 471 472 /* update DA */ 473 seg6_next_csid_advance_arg(daddr, finfo); 474 475 return input_action_end_x_finish(skb, slwt); 476 } 477 478 static bool seg6_next_csid_enabled(__u32 fops) 479 { 480 return fops & SEG6_F_LOCAL_FLV_NEXT_CSID; 481 } 482 483 /* Processing of SRv6 End, End.X, and End.T behaviors can be extended through 484 * the flavors framework. These behaviors must report the subset of (flavor) 485 * operations they currently implement. In this way, if a user specifies a 486 * flavor combination that is not supported by a given End* behavior, the 487 * kernel refuses to instantiate the tunnel reporting the error. 488 */ 489 static int seg6_flv_supp_ops_by_action(int action, __u32 *fops) 490 { 491 switch (action) { 492 case SEG6_LOCAL_ACTION_END: 493 *fops = SEG6_LOCAL_END_FLV_SUPP_OPS; 494 break; 495 case SEG6_LOCAL_ACTION_END_X: 496 *fops = SEG6_LOCAL_END_X_FLV_SUPP_OPS; 497 break; 498 default: 499 return -EOPNOTSUPP; 500 } 501 502 return 0; 503 } 504 505 /* We describe the packet state in relation to the absence/presence of the SRH 506 * and the Segment Left (SL) field. 507 * For our purposes, it is not necessary to record the exact value of the SL 508 * when the SID List consists of two or more segments. 509 */ 510 enum seg6_local_pktinfo { 511 /* the order really matters! */ 512 SEG6_LOCAL_PKTINFO_NOHDR = 0, 513 SEG6_LOCAL_PKTINFO_SL_ZERO, 514 SEG6_LOCAL_PKTINFO_SL_ONE, 515 SEG6_LOCAL_PKTINFO_SL_MORE, 516 __SEG6_LOCAL_PKTINFO_MAX, 517 }; 518 519 #define SEG6_LOCAL_PKTINFO_MAX (__SEG6_LOCAL_PKTINFO_MAX - 1) 520 521 static enum seg6_local_pktinfo seg6_get_srh_pktinfo(struct ipv6_sr_hdr *srh) 522 { 523 __u8 sgl; 524 525 if (!srh) 526 return SEG6_LOCAL_PKTINFO_NOHDR; 527 528 sgl = srh->segments_left; 529 if (sgl < 2) 530 return SEG6_LOCAL_PKTINFO_SL_ZERO + sgl; 531 532 return SEG6_LOCAL_PKTINFO_SL_MORE; 533 } 534 535 enum seg6_local_flv_action { 536 SEG6_LOCAL_FLV_ACT_UNSPEC = 0, 537 SEG6_LOCAL_FLV_ACT_END, 538 SEG6_LOCAL_FLV_ACT_PSP, 539 SEG6_LOCAL_FLV_ACT_USP, 540 SEG6_LOCAL_FLV_ACT_USD, 541 __SEG6_LOCAL_FLV_ACT_MAX 542 }; 543 544 #define SEG6_LOCAL_FLV_ACT_MAX (__SEG6_LOCAL_FLV_ACT_MAX - 1) 545 546 /* The action table for RFC8986 flavors (see the flv8986_act_tbl below) 547 * contains the actions (i.e. processing operations) to be applied on packets 548 * when flavors are configured for an End* behavior. 549 * By combining the pkinfo data and from the flavors mask, the macro 550 * computes the index used to access the elements (actions) stored in the 551 * action table. The index is structured as follows: 552 * 553 * index 554 * _______________/\________________ 555 * / \ 556 * +----------------+----------------+ 557 * | pf | afm | 558 * +----------------+----------------+ 559 * ph-1 ... p1 p0 fk-1 ... f1 f0 560 * MSB LSB 561 * 562 * where: 563 * - 'afm' (adjusted flavor mask) is the mask containing a combination of the 564 * RFC8986 flavors currently supported. 'afm' corresponds to the @fm 565 * argument of the macro whose value is righ-shifted by 1 bit. By doing so, 566 * we discard the SEG6_LOCAL_FLV_OP_UNSPEC flag (bit 0 in @fm) which is 567 * never used here; 568 * - 'pf' encodes the packet info (pktinfo) regarding the presence/absence of 569 * the SRH, SL = 0, etc. 'pf' is set with the value of @pf provided as 570 * argument to the macro. 571 */ 572 #define flv8986_act_tbl_idx(pf, fm) \ 573 ((((pf) << bits_per(SEG6_LOCAL_FLV8986_SUPP_OPS)) | \ 574 ((fm) & SEG6_LOCAL_FLV8986_SUPP_OPS)) >> SEG6_LOCAL_FLV_OP_PSP) 575 576 /* We compute the size of the action table by considering the RFC8986 flavors 577 * actually supported by the kernel. In this way, the size is automatically 578 * adjusted when new flavors are supported. 579 */ 580 #define FLV8986_ACT_TBL_SIZE \ 581 roundup_pow_of_two(flv8986_act_tbl_idx(SEG6_LOCAL_PKTINFO_MAX, \ 582 SEG6_LOCAL_FLV8986_SUPP_OPS)) 583 584 /* tbl_cfg(act, pf, fm) macro is used to easily configure the action 585 * table; it accepts 3 arguments: 586 * i) @act, the suffix from SEG6_LOCAL_FLV_ACT_{act} representing 587 * the action that should be applied on the packet; 588 * ii) @pf, the suffix from SEG6_LOCAL_PKTINFO_{pf} reporting the packet 589 * info about the lack/presence of SRH, SRH with SL = 0, etc; 590 * iii) @fm, the mask of flavors. 591 */ 592 #define tbl_cfg(act, pf, fm) \ 593 [flv8986_act_tbl_idx(SEG6_LOCAL_PKTINFO_##pf, \ 594 (fm))] = SEG6_LOCAL_FLV_ACT_##act 595 596 /* shorthand for improving readability */ 597 #define F_PSP SEG6_F_LOCAL_FLV_PSP 598 599 /* The table contains, for each combination of the pktinfo data and 600 * flavors, the action that should be taken on a packet (e.g. 601 * "standard" Endpoint processing, Penultimate Segment Pop, etc). 602 * 603 * By default, table entries not explicitly configured are initialized with the 604 * SEG6_LOCAL_FLV_ACT_UNSPEC action, which generally has the effect of 605 * discarding the processed packet. 606 */ 607 static const u8 flv8986_act_tbl[FLV8986_ACT_TBL_SIZE] = { 608 /* PSP variant for packet where SRH with SL = 1 */ 609 tbl_cfg(PSP, SL_ONE, F_PSP), 610 /* End for packet where the SRH with SL > 1*/ 611 tbl_cfg(END, SL_MORE, F_PSP), 612 }; 613 614 #undef F_PSP 615 #undef tbl_cfg 616 617 /* For each flavor defined in RFC8986 (or a combination of them) an action is 618 * performed on the packet. The specific action depends on: 619 * - info extracted from the packet (i.e. pktinfo data) regarding the 620 * lack/presence of the SRH, and if the SRH is available, on the value of 621 * Segment Left field; 622 * - the mask of flavors configured for the specific SRv6 End* behavior. 623 * 624 * The function combines both the pkinfo and the flavors mask to evaluate the 625 * corresponding action to be taken on the packet. 626 */ 627 static enum seg6_local_flv_action 628 seg6_local_flv8986_act_lookup(enum seg6_local_pktinfo pinfo, __u32 flvmask) 629 { 630 unsigned long index; 631 632 /* check if the provided mask of flavors is supported */ 633 if (unlikely(flvmask & ~SEG6_LOCAL_FLV8986_SUPP_OPS)) 634 return SEG6_LOCAL_FLV_ACT_UNSPEC; 635 636 index = flv8986_act_tbl_idx(pinfo, flvmask); 637 if (unlikely(index >= FLV8986_ACT_TBL_SIZE)) 638 return SEG6_LOCAL_FLV_ACT_UNSPEC; 639 640 return flv8986_act_tbl[index]; 641 } 642 643 /* skb->data must be aligned with skb->network_header */ 644 static bool seg6_pop_srh(struct sk_buff *skb, int srhoff) 645 { 646 struct ipv6_sr_hdr *srh; 647 struct ipv6hdr *iph; 648 __u8 srh_nexthdr; 649 int thoff = -1; 650 int srhlen; 651 int nhlen; 652 653 if (unlikely(srhoff < sizeof(*iph) || 654 !pskb_may_pull(skb, srhoff + sizeof(*srh)))) 655 return false; 656 657 srh = (struct ipv6_sr_hdr *)(skb->data + srhoff); 658 srhlen = ipv6_optlen(srh); 659 660 /* we are about to mangle the pkt, let's check if we can write on it */ 661 if (unlikely(skb_ensure_writable(skb, srhoff + srhlen))) 662 return false; 663 664 /* skb_ensure_writable() may change skb pointers; evaluate srh again */ 665 srh = (struct ipv6_sr_hdr *)(skb->data + srhoff); 666 srh_nexthdr = srh->nexthdr; 667 668 if (unlikely(!skb_transport_header_was_set(skb))) 669 goto pull; 670 671 nhlen = skb_network_header_len(skb); 672 /* we have to deal with the transport header: it could be set before 673 * the SRH, after the SRH, or within it (which is considered wrong, 674 * however). 675 */ 676 if (likely(nhlen <= srhoff)) 677 thoff = nhlen; 678 else if (nhlen >= srhoff + srhlen) 679 /* transport_header is set after the SRH */ 680 thoff = nhlen - srhlen; 681 else 682 /* transport_header falls inside the SRH; hence, we can't 683 * restore the transport_header pointer properly after 684 * SRH removing operation. 685 */ 686 return false; 687 pull: 688 /* we need to pop the SRH: 689 * 1) first of all, we pull out everything from IPv6 header up to SRH 690 * (included) evaluating also the rcsum; 691 * 2) we overwrite (and then remove) the SRH by properly moving the 692 * IPv6 along with any extension header that precedes the SRH; 693 * 3) At the end, we push back the pulled headers (except for SRH, 694 * obviously). 695 */ 696 skb_pull_rcsum(skb, srhoff + srhlen); 697 memmove(skb_network_header(skb) + srhlen, skb_network_header(skb), 698 srhoff); 699 skb_push(skb, srhoff); 700 701 skb_reset_network_header(skb); 702 skb_mac_header_rebuild(skb); 703 if (likely(thoff >= 0)) 704 skb_set_transport_header(skb, thoff); 705 706 iph = ipv6_hdr(skb); 707 if (iph->nexthdr == NEXTHDR_ROUTING) { 708 iph->nexthdr = srh_nexthdr; 709 } else { 710 /* we must look for the extension header (EXTH, for short) that 711 * immediately precedes the SRH we have just removed. 712 * Then, we update the value of the EXTH nexthdr with the one 713 * contained in the SRH nexthdr. 714 */ 715 unsigned int off = sizeof(*iph); 716 struct ipv6_opt_hdr *hp, _hdr; 717 __u8 nexthdr = iph->nexthdr; 718 719 for (;;) { 720 if (unlikely(!ipv6_ext_hdr(nexthdr) || 721 nexthdr == NEXTHDR_NONE)) 722 return false; 723 724 hp = skb_header_pointer(skb, off, sizeof(_hdr), &_hdr); 725 if (unlikely(!hp)) 726 return false; 727 728 if (hp->nexthdr == NEXTHDR_ROUTING) { 729 hp->nexthdr = srh_nexthdr; 730 break; 731 } 732 733 switch (nexthdr) { 734 case NEXTHDR_FRAGMENT: 735 fallthrough; 736 case NEXTHDR_AUTH: 737 /* we expect SRH before FRAG and AUTH */ 738 return false; 739 default: 740 off += ipv6_optlen(hp); 741 break; 742 } 743 744 nexthdr = hp->nexthdr; 745 } 746 } 747 748 iph->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); 749 750 skb_postpush_rcsum(skb, iph, srhoff); 751 752 return true; 753 } 754 755 /* process the packet on the basis of the RFC8986 flavors set for the given 756 * SRv6 End behavior instance. 757 */ 758 static int end_flv8986_core(struct sk_buff *skb, struct seg6_local_lwt *slwt) 759 { 760 const struct seg6_flavors_info *finfo = &slwt->flv_info; 761 enum seg6_local_flv_action action; 762 enum seg6_local_pktinfo pinfo; 763 struct ipv6_sr_hdr *srh; 764 __u32 flvmask; 765 int srhoff; 766 767 srh = seg6_get_srh(skb, 0); 768 srhoff = srh ? ((unsigned char *)srh - skb->data) : 0; 769 pinfo = seg6_get_srh_pktinfo(srh); 770 #ifdef CONFIG_IPV6_SEG6_HMAC 771 if (srh && !seg6_hmac_validate_skb(skb)) 772 goto drop; 773 #endif 774 flvmask = finfo->flv_ops; 775 if (unlikely(flvmask & ~SEG6_LOCAL_FLV8986_SUPP_OPS)) { 776 pr_warn_once("seg6local: invalid RFC8986 flavors\n"); 777 goto drop; 778 } 779 780 /* retrieve the action triggered by the combination of pktinfo data and 781 * the flavors mask. 782 */ 783 action = seg6_local_flv8986_act_lookup(pinfo, flvmask); 784 switch (action) { 785 case SEG6_LOCAL_FLV_ACT_END: 786 /* process the packet as the "standard" End behavior */ 787 advance_nextseg(srh, &ipv6_hdr(skb)->daddr); 788 break; 789 case SEG6_LOCAL_FLV_ACT_PSP: 790 advance_nextseg(srh, &ipv6_hdr(skb)->daddr); 791 792 if (unlikely(!seg6_pop_srh(skb, srhoff))) 793 goto drop; 794 break; 795 case SEG6_LOCAL_FLV_ACT_UNSPEC: 796 fallthrough; 797 default: 798 /* by default, we drop the packet since we could not find a 799 * suitable action. 800 */ 801 goto drop; 802 } 803 804 return input_action_end_finish(skb, slwt); 805 806 drop: 807 kfree_skb(skb); 808 return -EINVAL; 809 } 810 811 /* regular endpoint function */ 812 static int input_action_end(struct sk_buff *skb, struct seg6_local_lwt *slwt) 813 { 814 const struct seg6_flavors_info *finfo = &slwt->flv_info; 815 __u32 fops = finfo->flv_ops; 816 817 if (!fops) 818 return input_action_end_core(skb, slwt); 819 820 /* check for the presence of NEXT-C-SID since it applies first */ 821 if (seg6_next_csid_enabled(fops)) 822 return end_next_csid_core(skb, slwt); 823 824 /* the specific processing function to be performed on the packet 825 * depends on the combination of flavors defined in RFC8986 and some 826 * information extracted from the packet, e.g. presence/absence of SRH, 827 * Segment Left = 0, etc. 828 */ 829 return end_flv8986_core(skb, slwt); 830 } 831 832 /* regular endpoint, and forward to specified nexthop */ 833 static int input_action_end_x(struct sk_buff *skb, struct seg6_local_lwt *slwt) 834 { 835 const struct seg6_flavors_info *finfo = &slwt->flv_info; 836 __u32 fops = finfo->flv_ops; 837 838 /* check for the presence of NEXT-C-SID since it applies first */ 839 if (seg6_next_csid_enabled(fops)) 840 return end_x_next_csid_core(skb, slwt); 841 842 return input_action_end_x_core(skb, slwt); 843 } 844 845 static int input_action_end_t(struct sk_buff *skb, struct seg6_local_lwt *slwt) 846 { 847 struct ipv6_sr_hdr *srh; 848 849 srh = get_and_validate_srh(skb); 850 if (!srh) 851 goto drop; 852 853 advance_nextseg(srh, &ipv6_hdr(skb)->daddr); 854 855 seg6_lookup_nexthop(skb, NULL, slwt->table); 856 857 return dst_input(skb); 858 859 drop: 860 kfree_skb(skb); 861 return -EINVAL; 862 } 863 864 /* decapsulate and forward inner L2 frame on specified interface */ 865 static int input_action_end_dx2(struct sk_buff *skb, 866 struct seg6_local_lwt *slwt) 867 { 868 struct net *net = dev_net(skb->dev); 869 struct net_device *odev; 870 struct ethhdr *eth; 871 872 if (!decap_and_validate(skb, IPPROTO_ETHERNET)) 873 goto drop; 874 875 if (!pskb_may_pull(skb, ETH_HLEN)) 876 goto drop; 877 878 skb_reset_mac_header(skb); 879 eth = (struct ethhdr *)skb->data; 880 881 /* To determine the frame's protocol, we assume it is 802.3. This avoids 882 * a call to eth_type_trans(), which is not really relevant for our 883 * use case. 884 */ 885 if (!eth_proto_is_802_3(eth->h_proto)) 886 goto drop; 887 888 odev = dev_get_by_index_rcu(net, slwt->oif); 889 if (!odev) 890 goto drop; 891 892 /* As we accept Ethernet frames, make sure the egress device is of 893 * the correct type. 894 */ 895 if (odev->type != ARPHRD_ETHER) 896 goto drop; 897 898 if (!(odev->flags & IFF_UP) || !netif_carrier_ok(odev)) 899 goto drop; 900 901 skb_orphan(skb); 902 903 if (skb_warn_if_lro(skb)) 904 goto drop; 905 906 skb_forward_csum(skb); 907 908 if (skb->len - ETH_HLEN > odev->mtu) 909 goto drop; 910 911 skb->dev = odev; 912 skb->protocol = eth->h_proto; 913 914 return dev_queue_xmit(skb); 915 916 drop: 917 kfree_skb(skb); 918 return -EINVAL; 919 } 920 921 static int input_action_end_dx6_finish(struct net *net, struct sock *sk, 922 struct sk_buff *skb) 923 { 924 struct dst_entry *orig_dst = skb_dst(skb); 925 struct in6_addr *nhaddr = NULL; 926 struct seg6_local_lwt *slwt; 927 928 slwt = seg6_local_lwtunnel(orig_dst->lwtstate); 929 930 /* The inner packet is not associated to any local interface, 931 * so we do not call netif_rx(). 932 * 933 * If slwt->nh6 is set to ::, then lookup the nexthop for the 934 * inner packet's DA. Otherwise, use the specified nexthop. 935 */ 936 if (!ipv6_addr_any(&slwt->nh6)) 937 nhaddr = &slwt->nh6; 938 939 seg6_lookup_nexthop(skb, nhaddr, 0); 940 941 return dst_input(skb); 942 } 943 944 /* decapsulate and forward to specified nexthop */ 945 static int input_action_end_dx6(struct sk_buff *skb, 946 struct seg6_local_lwt *slwt) 947 { 948 /* this function accepts IPv6 encapsulated packets, with either 949 * an SRH with SL=0, or no SRH. 950 */ 951 952 if (!decap_and_validate(skb, IPPROTO_IPV6)) 953 goto drop; 954 955 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) 956 goto drop; 957 958 skb_set_transport_header(skb, sizeof(struct ipv6hdr)); 959 nf_reset_ct(skb); 960 961 if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) 962 return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, 963 dev_net(skb->dev), NULL, skb, skb->dev, 964 NULL, input_action_end_dx6_finish); 965 966 return input_action_end_dx6_finish(dev_net(skb->dev), NULL, skb); 967 drop: 968 kfree_skb(skb); 969 return -EINVAL; 970 } 971 972 static int input_action_end_dx4_finish(struct net *net, struct sock *sk, 973 struct sk_buff *skb) 974 { 975 struct dst_entry *orig_dst = skb_dst(skb); 976 enum skb_drop_reason reason; 977 struct seg6_local_lwt *slwt; 978 struct iphdr *iph; 979 __be32 nhaddr; 980 981 slwt = seg6_local_lwtunnel(orig_dst->lwtstate); 982 983 iph = ip_hdr(skb); 984 985 nhaddr = slwt->nh4.s_addr ?: iph->daddr; 986 987 skb_dst_drop(skb); 988 989 reason = ip_route_input(skb, nhaddr, iph->saddr, 0, skb->dev); 990 if (reason) { 991 kfree_skb_reason(skb, reason); 992 return -EINVAL; 993 } 994 995 return dst_input(skb); 996 } 997 998 static int input_action_end_dx4(struct sk_buff *skb, 999 struct seg6_local_lwt *slwt) 1000 { 1001 if (!decap_and_validate(skb, IPPROTO_IPIP)) 1002 goto drop; 1003 1004 if (!pskb_may_pull(skb, sizeof(struct iphdr))) 1005 goto drop; 1006 1007 skb->protocol = htons(ETH_P_IP); 1008 skb_set_transport_header(skb, sizeof(struct iphdr)); 1009 nf_reset_ct(skb); 1010 1011 if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) 1012 return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, 1013 dev_net(skb->dev), NULL, skb, skb->dev, 1014 NULL, input_action_end_dx4_finish); 1015 1016 return input_action_end_dx4_finish(dev_net(skb->dev), NULL, skb); 1017 drop: 1018 kfree_skb(skb); 1019 return -EINVAL; 1020 } 1021 1022 #ifdef CONFIG_NET_L3_MASTER_DEV 1023 static struct net *fib6_config_get_net(const struct fib6_config *fib6_cfg) 1024 { 1025 const struct nl_info *nli = &fib6_cfg->fc_nlinfo; 1026 1027 return nli->nl_net; 1028 } 1029 1030 static int __seg6_end_dt_vrf_build(struct seg6_local_lwt *slwt, const void *cfg, 1031 u16 family, struct netlink_ext_ack *extack) 1032 { 1033 struct seg6_end_dt_info *info = &slwt->dt_info; 1034 int vrf_ifindex; 1035 struct net *net; 1036 1037 net = fib6_config_get_net(cfg); 1038 1039 /* note that vrf_table was already set by parse_nla_vrftable() */ 1040 vrf_ifindex = l3mdev_ifindex_lookup_by_table_id(L3MDEV_TYPE_VRF, net, 1041 info->vrf_table); 1042 if (vrf_ifindex < 0) { 1043 if (vrf_ifindex == -EPERM) { 1044 NL_SET_ERR_MSG(extack, 1045 "Strict mode for VRF is disabled"); 1046 } else if (vrf_ifindex == -ENODEV) { 1047 NL_SET_ERR_MSG(extack, 1048 "Table has no associated VRF device"); 1049 } else { 1050 pr_debug("seg6local: SRv6 End.DT* creation error=%d\n", 1051 vrf_ifindex); 1052 } 1053 1054 return vrf_ifindex; 1055 } 1056 1057 info->net = net; 1058 info->vrf_ifindex = vrf_ifindex; 1059 1060 info->family = family; 1061 info->mode = DT_VRF_MODE; 1062 1063 return 0; 1064 } 1065 1066 /* The SRv6 End.DT4/DT6 behavior extracts the inner (IPv4/IPv6) packet and 1067 * routes the IPv4/IPv6 packet by looking at the configured routing table. 1068 * 1069 * In the SRv6 End.DT4/DT6 use case, we can receive traffic (IPv6+Segment 1070 * Routing Header packets) from several interfaces and the outer IPv6 1071 * destination address (DA) is used for retrieving the specific instance of the 1072 * End.DT4/DT6 behavior that should process the packets. 1073 * 1074 * However, the inner IPv4/IPv6 packet is not really bound to any receiving 1075 * interface and thus the End.DT4/DT6 sets the VRF (associated with the 1076 * corresponding routing table) as the *receiving* interface. 1077 * In other words, the End.DT4/DT6 processes a packet as if it has been received 1078 * directly by the VRF (and not by one of its slave devices, if any). 1079 * In this way, the VRF interface is used for routing the IPv4/IPv6 packet in 1080 * according to the routing table configured by the End.DT4/DT6 instance. 1081 * 1082 * This design allows you to get some interesting features like: 1083 * 1) the statistics on rx packets; 1084 * 2) the possibility to install a packet sniffer on the receiving interface 1085 * (the VRF one) for looking at the incoming packets; 1086 * 3) the possibility to leverage the netfilter prerouting hook for the inner 1087 * IPv4 packet. 1088 * 1089 * This function returns: 1090 * - the sk_buff* when the VRF rcv handler has processed the packet correctly; 1091 * - NULL when the skb is consumed by the VRF rcv handler; 1092 * - a pointer which encodes a negative error number in case of error. 1093 * Note that in this case, the function takes care of freeing the skb. 1094 */ 1095 static struct sk_buff *end_dt_vrf_rcv(struct sk_buff *skb, u16 family, 1096 struct net_device *dev) 1097 { 1098 /* based on l3mdev_ip_rcv; we are only interested in the master */ 1099 if (unlikely(!netif_is_l3_master(dev) && !netif_has_l3_rx_handler(dev))) 1100 goto drop; 1101 1102 if (unlikely(!dev->l3mdev_ops->l3mdev_l3_rcv)) 1103 goto drop; 1104 1105 /* the decap packet IPv4/IPv6 does not come with any mac header info. 1106 * We must unset the mac header to allow the VRF device to rebuild it, 1107 * just in case there is a sniffer attached on the device. 1108 */ 1109 skb_unset_mac_header(skb); 1110 1111 skb = dev->l3mdev_ops->l3mdev_l3_rcv(dev, skb, family); 1112 if (!skb) 1113 /* the skb buffer was consumed by the handler */ 1114 return NULL; 1115 1116 /* when a packet is received by a VRF or by one of its slaves, the 1117 * master device reference is set into the skb. 1118 */ 1119 if (unlikely(skb->dev != dev || skb->skb_iif != dev->ifindex)) 1120 goto drop; 1121 1122 return skb; 1123 1124 drop: 1125 kfree_skb(skb); 1126 return ERR_PTR(-EINVAL); 1127 } 1128 1129 static struct net_device *end_dt_get_vrf_rcu(struct sk_buff *skb, 1130 struct seg6_end_dt_info *info) 1131 { 1132 int vrf_ifindex = info->vrf_ifindex; 1133 struct net *net = info->net; 1134 1135 if (unlikely(vrf_ifindex < 0)) 1136 goto error; 1137 1138 if (unlikely(!net_eq(dev_net(skb->dev), net))) 1139 goto error; 1140 1141 return dev_get_by_index_rcu(net, vrf_ifindex); 1142 1143 error: 1144 return NULL; 1145 } 1146 1147 static struct sk_buff *end_dt_vrf_core(struct sk_buff *skb, 1148 struct seg6_local_lwt *slwt, u16 family) 1149 { 1150 struct seg6_end_dt_info *info = &slwt->dt_info; 1151 struct net_device *vrf; 1152 __be16 protocol; 1153 int hdrlen; 1154 1155 vrf = end_dt_get_vrf_rcu(skb, info); 1156 if (unlikely(!vrf)) 1157 goto drop; 1158 1159 switch (family) { 1160 case AF_INET: 1161 protocol = htons(ETH_P_IP); 1162 hdrlen = sizeof(struct iphdr); 1163 break; 1164 case AF_INET6: 1165 protocol = htons(ETH_P_IPV6); 1166 hdrlen = sizeof(struct ipv6hdr); 1167 break; 1168 case AF_UNSPEC: 1169 fallthrough; 1170 default: 1171 goto drop; 1172 } 1173 1174 if (unlikely(info->family != AF_UNSPEC && info->family != family)) { 1175 pr_warn_once("seg6local: SRv6 End.DT* family mismatch"); 1176 goto drop; 1177 } 1178 1179 skb->protocol = protocol; 1180 1181 skb_dst_drop(skb); 1182 1183 skb_set_transport_header(skb, hdrlen); 1184 nf_reset_ct(skb); 1185 1186 return end_dt_vrf_rcv(skb, family, vrf); 1187 1188 drop: 1189 kfree_skb(skb); 1190 return ERR_PTR(-EINVAL); 1191 } 1192 1193 static int input_action_end_dt4(struct sk_buff *skb, 1194 struct seg6_local_lwt *slwt) 1195 { 1196 enum skb_drop_reason reason; 1197 struct iphdr *iph; 1198 1199 if (!decap_and_validate(skb, IPPROTO_IPIP)) 1200 goto drop; 1201 1202 if (!pskb_may_pull(skb, sizeof(struct iphdr))) 1203 goto drop; 1204 1205 skb = end_dt_vrf_core(skb, slwt, AF_INET); 1206 if (!skb) 1207 /* packet has been processed and consumed by the VRF */ 1208 return 0; 1209 1210 if (IS_ERR(skb)) 1211 return PTR_ERR(skb); 1212 1213 iph = ip_hdr(skb); 1214 1215 reason = ip_route_input(skb, iph->daddr, iph->saddr, 0, skb->dev); 1216 if (unlikely(reason)) 1217 goto drop; 1218 1219 return dst_input(skb); 1220 1221 drop: 1222 kfree_skb(skb); 1223 return -EINVAL; 1224 } 1225 1226 static int seg6_end_dt4_build(struct seg6_local_lwt *slwt, const void *cfg, 1227 struct netlink_ext_ack *extack) 1228 { 1229 return __seg6_end_dt_vrf_build(slwt, cfg, AF_INET, extack); 1230 } 1231 1232 static enum 1233 seg6_end_dt_mode seg6_end_dt6_parse_mode(struct seg6_local_lwt *slwt) 1234 { 1235 unsigned long parsed_optattrs = slwt->parsed_optattrs; 1236 bool legacy, vrfmode; 1237 1238 legacy = !!(parsed_optattrs & SEG6_F_ATTR(SEG6_LOCAL_TABLE)); 1239 vrfmode = !!(parsed_optattrs & SEG6_F_ATTR(SEG6_LOCAL_VRFTABLE)); 1240 1241 if (!(legacy ^ vrfmode)) 1242 /* both are absent or present: invalid DT6 mode */ 1243 return DT_INVALID_MODE; 1244 1245 return legacy ? DT_LEGACY_MODE : DT_VRF_MODE; 1246 } 1247 1248 static enum seg6_end_dt_mode seg6_end_dt6_get_mode(struct seg6_local_lwt *slwt) 1249 { 1250 struct seg6_end_dt_info *info = &slwt->dt_info; 1251 1252 return info->mode; 1253 } 1254 1255 static int seg6_end_dt6_build(struct seg6_local_lwt *slwt, const void *cfg, 1256 struct netlink_ext_ack *extack) 1257 { 1258 enum seg6_end_dt_mode mode = seg6_end_dt6_parse_mode(slwt); 1259 struct seg6_end_dt_info *info = &slwt->dt_info; 1260 1261 switch (mode) { 1262 case DT_LEGACY_MODE: 1263 info->mode = DT_LEGACY_MODE; 1264 return 0; 1265 case DT_VRF_MODE: 1266 return __seg6_end_dt_vrf_build(slwt, cfg, AF_INET6, extack); 1267 default: 1268 NL_SET_ERR_MSG(extack, "table or vrftable must be specified"); 1269 return -EINVAL; 1270 } 1271 } 1272 #endif 1273 1274 static int input_action_end_dt6(struct sk_buff *skb, 1275 struct seg6_local_lwt *slwt) 1276 { 1277 if (!decap_and_validate(skb, IPPROTO_IPV6)) 1278 goto drop; 1279 1280 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) 1281 goto drop; 1282 1283 #ifdef CONFIG_NET_L3_MASTER_DEV 1284 if (seg6_end_dt6_get_mode(slwt) == DT_LEGACY_MODE) 1285 goto legacy_mode; 1286 1287 /* DT6_VRF_MODE */ 1288 skb = end_dt_vrf_core(skb, slwt, AF_INET6); 1289 if (!skb) 1290 /* packet has been processed and consumed by the VRF */ 1291 return 0; 1292 1293 if (IS_ERR(skb)) 1294 return PTR_ERR(skb); 1295 1296 /* note: this time we do not need to specify the table because the VRF 1297 * takes care of selecting the correct table. 1298 */ 1299 seg6_lookup_any_nexthop(skb, NULL, 0, true, 0); 1300 1301 return dst_input(skb); 1302 1303 legacy_mode: 1304 #endif 1305 skb_set_transport_header(skb, sizeof(struct ipv6hdr)); 1306 1307 seg6_lookup_any_nexthop(skb, NULL, slwt->table, true, 0); 1308 1309 return dst_input(skb); 1310 1311 drop: 1312 kfree_skb(skb); 1313 return -EINVAL; 1314 } 1315 1316 #ifdef CONFIG_NET_L3_MASTER_DEV 1317 static int seg6_end_dt46_build(struct seg6_local_lwt *slwt, const void *cfg, 1318 struct netlink_ext_ack *extack) 1319 { 1320 return __seg6_end_dt_vrf_build(slwt, cfg, AF_UNSPEC, extack); 1321 } 1322 1323 static int input_action_end_dt46(struct sk_buff *skb, 1324 struct seg6_local_lwt *slwt) 1325 { 1326 unsigned int off = 0; 1327 int nexthdr; 1328 1329 nexthdr = ipv6_find_hdr(skb, &off, -1, NULL, NULL); 1330 if (unlikely(nexthdr < 0)) 1331 goto drop; 1332 1333 switch (nexthdr) { 1334 case IPPROTO_IPIP: 1335 return input_action_end_dt4(skb, slwt); 1336 case IPPROTO_IPV6: 1337 return input_action_end_dt6(skb, slwt); 1338 } 1339 1340 drop: 1341 kfree_skb(skb); 1342 return -EINVAL; 1343 } 1344 #endif 1345 1346 /* push an SRH on top of the current one */ 1347 static int input_action_end_b6(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1348 { 1349 struct ipv6_sr_hdr *srh; 1350 int err = -EINVAL; 1351 1352 srh = get_and_validate_srh(skb); 1353 if (!srh) 1354 goto drop; 1355 1356 err = seg6_do_srh_inline(skb, slwt->srh); 1357 if (err) 1358 goto drop; 1359 1360 skb_set_transport_header(skb, sizeof(struct ipv6hdr)); 1361 1362 seg6_lookup_nexthop(skb, NULL, 0); 1363 1364 return dst_input(skb); 1365 1366 drop: 1367 kfree_skb(skb); 1368 return err; 1369 } 1370 1371 /* encapsulate within an outer IPv6 header and a specified SRH */ 1372 static int input_action_end_b6_encap(struct sk_buff *skb, 1373 struct seg6_local_lwt *slwt) 1374 { 1375 struct ipv6_sr_hdr *srh; 1376 int err = -EINVAL; 1377 1378 srh = get_and_validate_srh(skb); 1379 if (!srh) 1380 goto drop; 1381 1382 advance_nextseg(srh, &ipv6_hdr(skb)->daddr); 1383 1384 skb_reset_inner_headers(skb); 1385 skb->encapsulation = 1; 1386 1387 err = seg6_do_srh_encap(skb, slwt->srh, IPPROTO_IPV6); 1388 if (err) 1389 goto drop; 1390 1391 skb_set_transport_header(skb, sizeof(struct ipv6hdr)); 1392 1393 seg6_lookup_nexthop(skb, NULL, 0); 1394 1395 return dst_input(skb); 1396 1397 drop: 1398 kfree_skb(skb); 1399 return err; 1400 } 1401 1402 DEFINE_PER_CPU(struct seg6_bpf_srh_state, seg6_bpf_srh_states) = { 1403 .bh_lock = INIT_LOCAL_LOCK(bh_lock), 1404 }; 1405 1406 bool seg6_bpf_has_valid_srh(struct sk_buff *skb) 1407 { 1408 struct seg6_bpf_srh_state *srh_state = 1409 this_cpu_ptr(&seg6_bpf_srh_states); 1410 struct ipv6_sr_hdr *srh = srh_state->srh; 1411 1412 lockdep_assert_held(&srh_state->bh_lock); 1413 if (unlikely(srh == NULL)) 1414 return false; 1415 1416 if (unlikely(!srh_state->valid)) { 1417 if ((srh_state->hdrlen & 7) != 0) 1418 return false; 1419 1420 srh->hdrlen = (u8)(srh_state->hdrlen >> 3); 1421 if (!seg6_validate_srh(srh, (srh->hdrlen + 1) << 3, true)) 1422 return false; 1423 1424 srh_state->valid = true; 1425 } 1426 1427 return true; 1428 } 1429 1430 static int input_action_end_bpf(struct sk_buff *skb, 1431 struct seg6_local_lwt *slwt) 1432 { 1433 struct seg6_bpf_srh_state *srh_state; 1434 struct ipv6_sr_hdr *srh; 1435 int ret; 1436 1437 srh = get_and_validate_srh(skb); 1438 if (!srh) { 1439 kfree_skb(skb); 1440 return -EINVAL; 1441 } 1442 advance_nextseg(srh, &ipv6_hdr(skb)->daddr); 1443 1444 /* The access to the per-CPU buffer srh_state is protected by running 1445 * always in softirq context (with disabled BH). On PREEMPT_RT the 1446 * required locking is provided by the following local_lock_nested_bh() 1447 * statement. It is also accessed by the bpf_lwt_seg6_* helpers via 1448 * bpf_prog_run_save_cb(). 1449 */ 1450 local_lock_nested_bh(&seg6_bpf_srh_states.bh_lock); 1451 srh_state = this_cpu_ptr(&seg6_bpf_srh_states); 1452 srh_state->srh = srh; 1453 srh_state->hdrlen = srh->hdrlen << 3; 1454 srh_state->valid = true; 1455 1456 rcu_read_lock(); 1457 bpf_compute_data_pointers(skb); 1458 ret = bpf_prog_run_save_cb(slwt->bpf.prog, skb); 1459 rcu_read_unlock(); 1460 1461 switch (ret) { 1462 case BPF_OK: 1463 case BPF_REDIRECT: 1464 break; 1465 case BPF_DROP: 1466 goto drop; 1467 default: 1468 pr_warn_once("bpf-seg6local: Illegal return value %u\n", ret); 1469 goto drop; 1470 } 1471 1472 if (srh_state->srh && !seg6_bpf_has_valid_srh(skb)) 1473 goto drop; 1474 local_unlock_nested_bh(&seg6_bpf_srh_states.bh_lock); 1475 1476 if (ret != BPF_REDIRECT) 1477 seg6_lookup_nexthop(skb, NULL, 0); 1478 1479 return dst_input(skb); 1480 1481 drop: 1482 local_unlock_nested_bh(&seg6_bpf_srh_states.bh_lock); 1483 kfree_skb(skb); 1484 return -EINVAL; 1485 } 1486 1487 static struct seg6_action_desc seg6_action_table[] = { 1488 { 1489 .action = SEG6_LOCAL_ACTION_END, 1490 .attrs = 0, 1491 .optattrs = SEG6_F_LOCAL_COUNTERS | 1492 SEG6_F_LOCAL_FLAVORS, 1493 .input = input_action_end, 1494 }, 1495 { 1496 .action = SEG6_LOCAL_ACTION_END_X, 1497 .attrs = SEG6_F_ATTR(SEG6_LOCAL_NH6), 1498 .optattrs = SEG6_F_LOCAL_COUNTERS | 1499 SEG6_F_LOCAL_FLAVORS | 1500 SEG6_F_ATTR(SEG6_LOCAL_OIF), 1501 .input = input_action_end_x, 1502 }, 1503 { 1504 .action = SEG6_LOCAL_ACTION_END_T, 1505 .attrs = SEG6_F_ATTR(SEG6_LOCAL_TABLE), 1506 .optattrs = SEG6_F_LOCAL_COUNTERS, 1507 .input = input_action_end_t, 1508 }, 1509 { 1510 .action = SEG6_LOCAL_ACTION_END_DX2, 1511 .attrs = SEG6_F_ATTR(SEG6_LOCAL_OIF), 1512 .optattrs = SEG6_F_LOCAL_COUNTERS, 1513 .input = input_action_end_dx2, 1514 }, 1515 { 1516 .action = SEG6_LOCAL_ACTION_END_DX6, 1517 .attrs = SEG6_F_ATTR(SEG6_LOCAL_NH6), 1518 .optattrs = SEG6_F_LOCAL_COUNTERS, 1519 .input = input_action_end_dx6, 1520 }, 1521 { 1522 .action = SEG6_LOCAL_ACTION_END_DX4, 1523 .attrs = SEG6_F_ATTR(SEG6_LOCAL_NH4), 1524 .optattrs = SEG6_F_LOCAL_COUNTERS, 1525 .input = input_action_end_dx4, 1526 }, 1527 { 1528 .action = SEG6_LOCAL_ACTION_END_DT4, 1529 .attrs = SEG6_F_ATTR(SEG6_LOCAL_VRFTABLE), 1530 .optattrs = SEG6_F_LOCAL_COUNTERS, 1531 #ifdef CONFIG_NET_L3_MASTER_DEV 1532 .input = input_action_end_dt4, 1533 .slwt_ops = { 1534 .build_state = seg6_end_dt4_build, 1535 }, 1536 #endif 1537 }, 1538 { 1539 .action = SEG6_LOCAL_ACTION_END_DT6, 1540 #ifdef CONFIG_NET_L3_MASTER_DEV 1541 .attrs = 0, 1542 .optattrs = SEG6_F_LOCAL_COUNTERS | 1543 SEG6_F_ATTR(SEG6_LOCAL_TABLE) | 1544 SEG6_F_ATTR(SEG6_LOCAL_VRFTABLE), 1545 .slwt_ops = { 1546 .build_state = seg6_end_dt6_build, 1547 }, 1548 #else 1549 .attrs = SEG6_F_ATTR(SEG6_LOCAL_TABLE), 1550 .optattrs = SEG6_F_LOCAL_COUNTERS, 1551 #endif 1552 .input = input_action_end_dt6, 1553 }, 1554 { 1555 .action = SEG6_LOCAL_ACTION_END_DT46, 1556 .attrs = SEG6_F_ATTR(SEG6_LOCAL_VRFTABLE), 1557 .optattrs = SEG6_F_LOCAL_COUNTERS, 1558 #ifdef CONFIG_NET_L3_MASTER_DEV 1559 .input = input_action_end_dt46, 1560 .slwt_ops = { 1561 .build_state = seg6_end_dt46_build, 1562 }, 1563 #endif 1564 }, 1565 { 1566 .action = SEG6_LOCAL_ACTION_END_B6, 1567 .attrs = SEG6_F_ATTR(SEG6_LOCAL_SRH), 1568 .optattrs = SEG6_F_LOCAL_COUNTERS, 1569 .input = input_action_end_b6, 1570 }, 1571 { 1572 .action = SEG6_LOCAL_ACTION_END_B6_ENCAP, 1573 .attrs = SEG6_F_ATTR(SEG6_LOCAL_SRH), 1574 .optattrs = SEG6_F_LOCAL_COUNTERS, 1575 .input = input_action_end_b6_encap, 1576 .static_headroom = sizeof(struct ipv6hdr), 1577 }, 1578 { 1579 .action = SEG6_LOCAL_ACTION_END_BPF, 1580 .attrs = SEG6_F_ATTR(SEG6_LOCAL_BPF), 1581 .optattrs = SEG6_F_LOCAL_COUNTERS, 1582 .input = input_action_end_bpf, 1583 }, 1584 1585 }; 1586 1587 static struct seg6_action_desc *__get_action_desc(int action) 1588 { 1589 struct seg6_action_desc *desc; 1590 int i, count; 1591 1592 count = ARRAY_SIZE(seg6_action_table); 1593 for (i = 0; i < count; i++) { 1594 desc = &seg6_action_table[i]; 1595 if (desc->action == action) 1596 return desc; 1597 } 1598 1599 return NULL; 1600 } 1601 1602 static bool seg6_lwtunnel_counters_enabled(struct seg6_local_lwt *slwt) 1603 { 1604 return slwt->parsed_optattrs & SEG6_F_LOCAL_COUNTERS; 1605 } 1606 1607 static void seg6_local_update_counters(struct seg6_local_lwt *slwt, 1608 unsigned int len, int err) 1609 { 1610 struct pcpu_seg6_local_counters *pcounters; 1611 1612 pcounters = this_cpu_ptr(slwt->pcpu_counters); 1613 u64_stats_update_begin(&pcounters->syncp); 1614 1615 if (likely(!err)) { 1616 u64_stats_inc(&pcounters->packets); 1617 u64_stats_add(&pcounters->bytes, len); 1618 } else { 1619 u64_stats_inc(&pcounters->errors); 1620 } 1621 1622 u64_stats_update_end(&pcounters->syncp); 1623 } 1624 1625 static int seg6_local_input_core(struct net *net, struct sock *sk, 1626 struct sk_buff *skb) 1627 { 1628 struct dst_entry *orig_dst = skb_dst(skb); 1629 struct seg6_action_desc *desc; 1630 struct seg6_local_lwt *slwt; 1631 unsigned int len = skb->len; 1632 int rc; 1633 1634 slwt = seg6_local_lwtunnel(orig_dst->lwtstate); 1635 desc = slwt->desc; 1636 1637 rc = desc->input(skb, slwt); 1638 1639 if (!seg6_lwtunnel_counters_enabled(slwt)) 1640 return rc; 1641 1642 seg6_local_update_counters(slwt, len, rc); 1643 1644 return rc; 1645 } 1646 1647 static int seg6_local_input(struct sk_buff *skb) 1648 { 1649 if (skb->protocol != htons(ETH_P_IPV6)) { 1650 kfree_skb(skb); 1651 return -EINVAL; 1652 } 1653 1654 if (static_branch_unlikely(&nf_hooks_lwtunnel_enabled)) 1655 return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_IN, 1656 dev_net(skb->dev), NULL, skb, skb->dev, NULL, 1657 seg6_local_input_core); 1658 1659 return seg6_local_input_core(dev_net(skb->dev), NULL, skb); 1660 } 1661 1662 static const struct nla_policy seg6_local_policy[SEG6_LOCAL_MAX + 1] = { 1663 [SEG6_LOCAL_ACTION] = { .type = NLA_U32 }, 1664 [SEG6_LOCAL_SRH] = { .type = NLA_BINARY }, 1665 [SEG6_LOCAL_TABLE] = { .type = NLA_U32 }, 1666 [SEG6_LOCAL_VRFTABLE] = { .type = NLA_U32 }, 1667 [SEG6_LOCAL_NH4] = NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)), 1668 [SEG6_LOCAL_NH6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 1669 [SEG6_LOCAL_IIF] = { .type = NLA_U32 }, 1670 [SEG6_LOCAL_OIF] = { .type = NLA_U32 }, 1671 [SEG6_LOCAL_BPF] = { .type = NLA_NESTED }, 1672 [SEG6_LOCAL_COUNTERS] = { .type = NLA_NESTED }, 1673 [SEG6_LOCAL_FLAVORS] = { .type = NLA_NESTED }, 1674 }; 1675 1676 static int parse_nla_srh(struct nlattr **attrs, struct seg6_local_lwt *slwt, 1677 struct netlink_ext_ack *extack) 1678 { 1679 struct ipv6_sr_hdr *srh; 1680 int len; 1681 1682 srh = nla_data(attrs[SEG6_LOCAL_SRH]); 1683 len = nla_len(attrs[SEG6_LOCAL_SRH]); 1684 1685 /* SRH must contain at least one segment */ 1686 if (len < sizeof(*srh) + sizeof(struct in6_addr)) 1687 return -EINVAL; 1688 1689 if (!seg6_validate_srh(srh, len, false)) 1690 return -EINVAL; 1691 1692 slwt->srh = kmemdup(srh, len, GFP_KERNEL); 1693 if (!slwt->srh) 1694 return -ENOMEM; 1695 1696 slwt->headroom += len; 1697 1698 return 0; 1699 } 1700 1701 static int put_nla_srh(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1702 { 1703 struct ipv6_sr_hdr *srh; 1704 struct nlattr *nla; 1705 int len; 1706 1707 srh = slwt->srh; 1708 len = (srh->hdrlen + 1) << 3; 1709 1710 nla = nla_reserve(skb, SEG6_LOCAL_SRH, len); 1711 if (!nla) 1712 return -EMSGSIZE; 1713 1714 memcpy(nla_data(nla), srh, len); 1715 1716 return 0; 1717 } 1718 1719 static int cmp_nla_srh(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1720 { 1721 int len = (a->srh->hdrlen + 1) << 3; 1722 1723 if (len != ((b->srh->hdrlen + 1) << 3)) 1724 return 1; 1725 1726 return memcmp(a->srh, b->srh, len); 1727 } 1728 1729 static void destroy_attr_srh(struct seg6_local_lwt *slwt) 1730 { 1731 kfree(slwt->srh); 1732 } 1733 1734 static int parse_nla_table(struct nlattr **attrs, struct seg6_local_lwt *slwt, 1735 struct netlink_ext_ack *extack) 1736 { 1737 slwt->table = nla_get_u32(attrs[SEG6_LOCAL_TABLE]); 1738 1739 return 0; 1740 } 1741 1742 static int put_nla_table(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1743 { 1744 if (nla_put_u32(skb, SEG6_LOCAL_TABLE, slwt->table)) 1745 return -EMSGSIZE; 1746 1747 return 0; 1748 } 1749 1750 static int cmp_nla_table(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1751 { 1752 if (a->table != b->table) 1753 return 1; 1754 1755 return 0; 1756 } 1757 1758 static struct 1759 seg6_end_dt_info *seg6_possible_end_dt_info(struct seg6_local_lwt *slwt) 1760 { 1761 #ifdef CONFIG_NET_L3_MASTER_DEV 1762 return &slwt->dt_info; 1763 #else 1764 return ERR_PTR(-EOPNOTSUPP); 1765 #endif 1766 } 1767 1768 static int parse_nla_vrftable(struct nlattr **attrs, 1769 struct seg6_local_lwt *slwt, 1770 struct netlink_ext_ack *extack) 1771 { 1772 struct seg6_end_dt_info *info = seg6_possible_end_dt_info(slwt); 1773 1774 if (IS_ERR(info)) 1775 return PTR_ERR(info); 1776 1777 info->vrf_table = nla_get_u32(attrs[SEG6_LOCAL_VRFTABLE]); 1778 1779 return 0; 1780 } 1781 1782 static int put_nla_vrftable(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1783 { 1784 struct seg6_end_dt_info *info = seg6_possible_end_dt_info(slwt); 1785 1786 if (IS_ERR(info)) 1787 return PTR_ERR(info); 1788 1789 if (nla_put_u32(skb, SEG6_LOCAL_VRFTABLE, info->vrf_table)) 1790 return -EMSGSIZE; 1791 1792 return 0; 1793 } 1794 1795 static int cmp_nla_vrftable(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1796 { 1797 struct seg6_end_dt_info *info_a = seg6_possible_end_dt_info(a); 1798 struct seg6_end_dt_info *info_b = seg6_possible_end_dt_info(b); 1799 1800 if (info_a->vrf_table != info_b->vrf_table) 1801 return 1; 1802 1803 return 0; 1804 } 1805 1806 static int parse_nla_nh4(struct nlattr **attrs, struct seg6_local_lwt *slwt, 1807 struct netlink_ext_ack *extack) 1808 { 1809 memcpy(&slwt->nh4, nla_data(attrs[SEG6_LOCAL_NH4]), 1810 sizeof(struct in_addr)); 1811 1812 return 0; 1813 } 1814 1815 static int put_nla_nh4(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1816 { 1817 struct nlattr *nla; 1818 1819 nla = nla_reserve(skb, SEG6_LOCAL_NH4, sizeof(struct in_addr)); 1820 if (!nla) 1821 return -EMSGSIZE; 1822 1823 memcpy(nla_data(nla), &slwt->nh4, sizeof(struct in_addr)); 1824 1825 return 0; 1826 } 1827 1828 static int cmp_nla_nh4(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1829 { 1830 return memcmp(&a->nh4, &b->nh4, sizeof(struct in_addr)); 1831 } 1832 1833 static int parse_nla_nh6(struct nlattr **attrs, struct seg6_local_lwt *slwt, 1834 struct netlink_ext_ack *extack) 1835 { 1836 memcpy(&slwt->nh6, nla_data(attrs[SEG6_LOCAL_NH6]), 1837 sizeof(struct in6_addr)); 1838 1839 return 0; 1840 } 1841 1842 static int put_nla_nh6(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1843 { 1844 struct nlattr *nla; 1845 1846 nla = nla_reserve(skb, SEG6_LOCAL_NH6, sizeof(struct in6_addr)); 1847 if (!nla) 1848 return -EMSGSIZE; 1849 1850 memcpy(nla_data(nla), &slwt->nh6, sizeof(struct in6_addr)); 1851 1852 return 0; 1853 } 1854 1855 static int cmp_nla_nh6(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1856 { 1857 return memcmp(&a->nh6, &b->nh6, sizeof(struct in6_addr)); 1858 } 1859 1860 static int parse_nla_iif(struct nlattr **attrs, struct seg6_local_lwt *slwt, 1861 struct netlink_ext_ack *extack) 1862 { 1863 slwt->iif = nla_get_u32(attrs[SEG6_LOCAL_IIF]); 1864 1865 return 0; 1866 } 1867 1868 static int put_nla_iif(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1869 { 1870 if (nla_put_u32(skb, SEG6_LOCAL_IIF, slwt->iif)) 1871 return -EMSGSIZE; 1872 1873 return 0; 1874 } 1875 1876 static int cmp_nla_iif(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1877 { 1878 if (a->iif != b->iif) 1879 return 1; 1880 1881 return 0; 1882 } 1883 1884 static int parse_nla_oif(struct nlattr **attrs, struct seg6_local_lwt *slwt, 1885 struct netlink_ext_ack *extack) 1886 { 1887 slwt->oif = nla_get_u32(attrs[SEG6_LOCAL_OIF]); 1888 1889 return 0; 1890 } 1891 1892 static int put_nla_oif(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1893 { 1894 if (nla_put_u32(skb, SEG6_LOCAL_OIF, slwt->oif)) 1895 return -EMSGSIZE; 1896 1897 return 0; 1898 } 1899 1900 static int cmp_nla_oif(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1901 { 1902 if (a->oif != b->oif) 1903 return 1; 1904 1905 return 0; 1906 } 1907 1908 #define MAX_PROG_NAME 256 1909 static const struct nla_policy bpf_prog_policy[SEG6_LOCAL_BPF_PROG_MAX + 1] = { 1910 [SEG6_LOCAL_BPF_PROG] = { .type = NLA_U32, }, 1911 [SEG6_LOCAL_BPF_PROG_NAME] = { .type = NLA_NUL_STRING, 1912 .len = MAX_PROG_NAME }, 1913 }; 1914 1915 static int parse_nla_bpf(struct nlattr **attrs, struct seg6_local_lwt *slwt, 1916 struct netlink_ext_ack *extack) 1917 { 1918 struct nlattr *tb[SEG6_LOCAL_BPF_PROG_MAX + 1]; 1919 struct bpf_prog *p; 1920 int ret; 1921 u32 fd; 1922 1923 ret = nla_parse_nested_deprecated(tb, SEG6_LOCAL_BPF_PROG_MAX, 1924 attrs[SEG6_LOCAL_BPF], 1925 bpf_prog_policy, NULL); 1926 if (ret < 0) 1927 return ret; 1928 1929 if (!tb[SEG6_LOCAL_BPF_PROG] || !tb[SEG6_LOCAL_BPF_PROG_NAME]) 1930 return -EINVAL; 1931 1932 slwt->bpf.name = nla_memdup(tb[SEG6_LOCAL_BPF_PROG_NAME], GFP_KERNEL); 1933 if (!slwt->bpf.name) 1934 return -ENOMEM; 1935 1936 fd = nla_get_u32(tb[SEG6_LOCAL_BPF_PROG]); 1937 p = bpf_prog_get_type(fd, BPF_PROG_TYPE_LWT_SEG6LOCAL); 1938 if (IS_ERR(p)) { 1939 kfree(slwt->bpf.name); 1940 return PTR_ERR(p); 1941 } 1942 1943 slwt->bpf.prog = p; 1944 return 0; 1945 } 1946 1947 static int put_nla_bpf(struct sk_buff *skb, struct seg6_local_lwt *slwt) 1948 { 1949 struct nlattr *nest; 1950 1951 if (!slwt->bpf.prog) 1952 return 0; 1953 1954 nest = nla_nest_start_noflag(skb, SEG6_LOCAL_BPF); 1955 if (!nest) 1956 return -EMSGSIZE; 1957 1958 if (nla_put_u32(skb, SEG6_LOCAL_BPF_PROG, slwt->bpf.prog->aux->id)) 1959 return -EMSGSIZE; 1960 1961 if (slwt->bpf.name && 1962 nla_put_string(skb, SEG6_LOCAL_BPF_PROG_NAME, slwt->bpf.name)) 1963 return -EMSGSIZE; 1964 1965 return nla_nest_end(skb, nest); 1966 } 1967 1968 static int cmp_nla_bpf(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 1969 { 1970 if (!a->bpf.name && !b->bpf.name) 1971 return 0; 1972 1973 if (!a->bpf.name || !b->bpf.name) 1974 return 1; 1975 1976 return strcmp(a->bpf.name, b->bpf.name); 1977 } 1978 1979 static void destroy_attr_bpf(struct seg6_local_lwt *slwt) 1980 { 1981 kfree(slwt->bpf.name); 1982 if (slwt->bpf.prog) 1983 bpf_prog_put(slwt->bpf.prog); 1984 } 1985 1986 static const struct 1987 nla_policy seg6_local_counters_policy[SEG6_LOCAL_CNT_MAX + 1] = { 1988 [SEG6_LOCAL_CNT_PACKETS] = { .type = NLA_U64 }, 1989 [SEG6_LOCAL_CNT_BYTES] = { .type = NLA_U64 }, 1990 [SEG6_LOCAL_CNT_ERRORS] = { .type = NLA_U64 }, 1991 }; 1992 1993 static int parse_nla_counters(struct nlattr **attrs, 1994 struct seg6_local_lwt *slwt, 1995 struct netlink_ext_ack *extack) 1996 { 1997 struct pcpu_seg6_local_counters __percpu *pcounters; 1998 struct nlattr *tb[SEG6_LOCAL_CNT_MAX + 1]; 1999 int ret; 2000 2001 ret = nla_parse_nested_deprecated(tb, SEG6_LOCAL_CNT_MAX, 2002 attrs[SEG6_LOCAL_COUNTERS], 2003 seg6_local_counters_policy, NULL); 2004 if (ret < 0) 2005 return ret; 2006 2007 /* basic support for SRv6 Behavior counters requires at least: 2008 * packets, bytes and errors. 2009 */ 2010 if (!tb[SEG6_LOCAL_CNT_PACKETS] || !tb[SEG6_LOCAL_CNT_BYTES] || 2011 !tb[SEG6_LOCAL_CNT_ERRORS]) 2012 return -EINVAL; 2013 2014 /* counters are always zero initialized */ 2015 pcounters = seg6_local_alloc_pcpu_counters(GFP_KERNEL); 2016 if (!pcounters) 2017 return -ENOMEM; 2018 2019 slwt->pcpu_counters = pcounters; 2020 2021 return 0; 2022 } 2023 2024 static int seg6_local_fill_nla_counters(struct sk_buff *skb, 2025 struct seg6_local_counters *counters) 2026 { 2027 if (nla_put_u64_64bit(skb, SEG6_LOCAL_CNT_PACKETS, counters->packets, 2028 SEG6_LOCAL_CNT_PAD)) 2029 return -EMSGSIZE; 2030 2031 if (nla_put_u64_64bit(skb, SEG6_LOCAL_CNT_BYTES, counters->bytes, 2032 SEG6_LOCAL_CNT_PAD)) 2033 return -EMSGSIZE; 2034 2035 if (nla_put_u64_64bit(skb, SEG6_LOCAL_CNT_ERRORS, counters->errors, 2036 SEG6_LOCAL_CNT_PAD)) 2037 return -EMSGSIZE; 2038 2039 return 0; 2040 } 2041 2042 static int put_nla_counters(struct sk_buff *skb, struct seg6_local_lwt *slwt) 2043 { 2044 struct seg6_local_counters counters = { 0, 0, 0 }; 2045 struct nlattr *nest; 2046 int rc, i; 2047 2048 nest = nla_nest_start(skb, SEG6_LOCAL_COUNTERS); 2049 if (!nest) 2050 return -EMSGSIZE; 2051 2052 for_each_possible_cpu(i) { 2053 struct pcpu_seg6_local_counters *pcounters; 2054 u64 packets, bytes, errors; 2055 unsigned int start; 2056 2057 pcounters = per_cpu_ptr(slwt->pcpu_counters, i); 2058 do { 2059 start = u64_stats_fetch_begin(&pcounters->syncp); 2060 2061 packets = u64_stats_read(&pcounters->packets); 2062 bytes = u64_stats_read(&pcounters->bytes); 2063 errors = u64_stats_read(&pcounters->errors); 2064 2065 } while (u64_stats_fetch_retry(&pcounters->syncp, start)); 2066 2067 counters.packets += packets; 2068 counters.bytes += bytes; 2069 counters.errors += errors; 2070 } 2071 2072 rc = seg6_local_fill_nla_counters(skb, &counters); 2073 if (rc < 0) { 2074 nla_nest_cancel(skb, nest); 2075 return rc; 2076 } 2077 2078 return nla_nest_end(skb, nest); 2079 } 2080 2081 static int cmp_nla_counters(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 2082 { 2083 /* a and b are equal if both have pcpu_counters set or not */ 2084 return (!!((unsigned long)a->pcpu_counters)) ^ 2085 (!!((unsigned long)b->pcpu_counters)); 2086 } 2087 2088 static void destroy_attr_counters(struct seg6_local_lwt *slwt) 2089 { 2090 free_percpu(slwt->pcpu_counters); 2091 } 2092 2093 static const 2094 struct nla_policy seg6_local_flavors_policy[SEG6_LOCAL_FLV_MAX + 1] = { 2095 [SEG6_LOCAL_FLV_OPERATION] = { .type = NLA_U32 }, 2096 [SEG6_LOCAL_FLV_LCBLOCK_BITS] = { .type = NLA_U8 }, 2097 [SEG6_LOCAL_FLV_LCNODE_FN_BITS] = { .type = NLA_U8 }, 2098 }; 2099 2100 /* check whether the lengths of the Locator-Block and Locator-Node Function 2101 * are compatible with the dimension of a C-SID container. 2102 */ 2103 static int seg6_chk_next_csid_cfg(__u8 block_len, __u8 func_len) 2104 { 2105 /* Locator-Block and Locator-Node Function cannot exceed 128 bits 2106 * (i.e. C-SID container length). 2107 */ 2108 if (next_csid_chk_cntr_bits(block_len, func_len)) 2109 return -EINVAL; 2110 2111 /* Locator-Block length must be greater than zero and evenly divisible 2112 * by 8. There must be room for a Locator-Node Function, at least. 2113 */ 2114 if (next_csid_chk_lcblock_bits(block_len)) 2115 return -EINVAL; 2116 2117 /* Locator-Node Function length must be greater than zero and evenly 2118 * divisible by 8. There must be room for the Locator-Block. 2119 */ 2120 if (next_csid_chk_lcnode_fn_bits(func_len)) 2121 return -EINVAL; 2122 2123 return 0; 2124 } 2125 2126 static int seg6_parse_nla_next_csid_cfg(struct nlattr **tb, 2127 struct seg6_flavors_info *finfo, 2128 struct netlink_ext_ack *extack) 2129 { 2130 __u8 func_len = SEG6_LOCAL_LCNODE_FN_DBITS; 2131 __u8 block_len = SEG6_LOCAL_LCBLOCK_DBITS; 2132 int rc; 2133 2134 if (tb[SEG6_LOCAL_FLV_LCBLOCK_BITS]) 2135 block_len = nla_get_u8(tb[SEG6_LOCAL_FLV_LCBLOCK_BITS]); 2136 2137 if (tb[SEG6_LOCAL_FLV_LCNODE_FN_BITS]) 2138 func_len = nla_get_u8(tb[SEG6_LOCAL_FLV_LCNODE_FN_BITS]); 2139 2140 rc = seg6_chk_next_csid_cfg(block_len, func_len); 2141 if (rc < 0) { 2142 NL_SET_ERR_MSG(extack, 2143 "Invalid Locator Block/Node Function lengths"); 2144 return rc; 2145 } 2146 2147 finfo->lcblock_bits = block_len; 2148 finfo->lcnode_func_bits = func_len; 2149 2150 return 0; 2151 } 2152 2153 static int parse_nla_flavors(struct nlattr **attrs, struct seg6_local_lwt *slwt, 2154 struct netlink_ext_ack *extack) 2155 { 2156 struct seg6_flavors_info *finfo = &slwt->flv_info; 2157 struct nlattr *tb[SEG6_LOCAL_FLV_MAX + 1]; 2158 int action = slwt->action; 2159 __u32 fops, supp_fops; 2160 int rc; 2161 2162 rc = nla_parse_nested_deprecated(tb, SEG6_LOCAL_FLV_MAX, 2163 attrs[SEG6_LOCAL_FLAVORS], 2164 seg6_local_flavors_policy, NULL); 2165 if (rc < 0) 2166 return rc; 2167 2168 /* this attribute MUST always be present since it represents the Flavor 2169 * operation(s) to be carried out. 2170 */ 2171 if (!tb[SEG6_LOCAL_FLV_OPERATION]) 2172 return -EINVAL; 2173 2174 fops = nla_get_u32(tb[SEG6_LOCAL_FLV_OPERATION]); 2175 rc = seg6_flv_supp_ops_by_action(action, &supp_fops); 2176 if (rc < 0 || (fops & ~supp_fops)) { 2177 NL_SET_ERR_MSG(extack, "Unsupported Flavor operation(s)"); 2178 return -EOPNOTSUPP; 2179 } 2180 2181 finfo->flv_ops = fops; 2182 2183 if (seg6_next_csid_enabled(fops)) { 2184 /* Locator-Block and Locator-Node Function lengths can be 2185 * provided by the user space. Otherwise, default values are 2186 * applied. 2187 */ 2188 rc = seg6_parse_nla_next_csid_cfg(tb, finfo, extack); 2189 if (rc < 0) 2190 return rc; 2191 } 2192 2193 return 0; 2194 } 2195 2196 static int seg6_fill_nla_next_csid_cfg(struct sk_buff *skb, 2197 struct seg6_flavors_info *finfo) 2198 { 2199 if (nla_put_u8(skb, SEG6_LOCAL_FLV_LCBLOCK_BITS, finfo->lcblock_bits)) 2200 return -EMSGSIZE; 2201 2202 if (nla_put_u8(skb, SEG6_LOCAL_FLV_LCNODE_FN_BITS, 2203 finfo->lcnode_func_bits)) 2204 return -EMSGSIZE; 2205 2206 return 0; 2207 } 2208 2209 static int put_nla_flavors(struct sk_buff *skb, struct seg6_local_lwt *slwt) 2210 { 2211 struct seg6_flavors_info *finfo = &slwt->flv_info; 2212 __u32 fops = finfo->flv_ops; 2213 struct nlattr *nest; 2214 int rc; 2215 2216 nest = nla_nest_start(skb, SEG6_LOCAL_FLAVORS); 2217 if (!nest) 2218 return -EMSGSIZE; 2219 2220 if (nla_put_u32(skb, SEG6_LOCAL_FLV_OPERATION, fops)) { 2221 rc = -EMSGSIZE; 2222 goto err; 2223 } 2224 2225 if (seg6_next_csid_enabled(fops)) { 2226 rc = seg6_fill_nla_next_csid_cfg(skb, finfo); 2227 if (rc < 0) 2228 goto err; 2229 } 2230 2231 return nla_nest_end(skb, nest); 2232 2233 err: 2234 nla_nest_cancel(skb, nest); 2235 return rc; 2236 } 2237 2238 static int seg6_cmp_nla_next_csid_cfg(struct seg6_flavors_info *finfo_a, 2239 struct seg6_flavors_info *finfo_b) 2240 { 2241 if (finfo_a->lcblock_bits != finfo_b->lcblock_bits) 2242 return 1; 2243 2244 if (finfo_a->lcnode_func_bits != finfo_b->lcnode_func_bits) 2245 return 1; 2246 2247 return 0; 2248 } 2249 2250 static int cmp_nla_flavors(struct seg6_local_lwt *a, struct seg6_local_lwt *b) 2251 { 2252 struct seg6_flavors_info *finfo_a = &a->flv_info; 2253 struct seg6_flavors_info *finfo_b = &b->flv_info; 2254 2255 if (finfo_a->flv_ops != finfo_b->flv_ops) 2256 return 1; 2257 2258 if (seg6_next_csid_enabled(finfo_a->flv_ops)) { 2259 if (seg6_cmp_nla_next_csid_cfg(finfo_a, finfo_b)) 2260 return 1; 2261 } 2262 2263 return 0; 2264 } 2265 2266 static int encap_size_flavors(struct seg6_local_lwt *slwt) 2267 { 2268 struct seg6_flavors_info *finfo = &slwt->flv_info; 2269 int nlsize; 2270 2271 nlsize = nla_total_size(0) + /* nest SEG6_LOCAL_FLAVORS */ 2272 nla_total_size(4); /* SEG6_LOCAL_FLV_OPERATION */ 2273 2274 if (seg6_next_csid_enabled(finfo->flv_ops)) 2275 nlsize += nla_total_size(1) + /* SEG6_LOCAL_FLV_LCBLOCK_BITS */ 2276 nla_total_size(1); /* SEG6_LOCAL_FLV_LCNODE_FN_BITS */ 2277 2278 return nlsize; 2279 } 2280 2281 struct seg6_action_param { 2282 int (*parse)(struct nlattr **attrs, struct seg6_local_lwt *slwt, 2283 struct netlink_ext_ack *extack); 2284 int (*put)(struct sk_buff *skb, struct seg6_local_lwt *slwt); 2285 int (*cmp)(struct seg6_local_lwt *a, struct seg6_local_lwt *b); 2286 2287 /* optional destroy() callback useful for releasing resources which 2288 * have been previously acquired in the corresponding parse() 2289 * function. 2290 */ 2291 void (*destroy)(struct seg6_local_lwt *slwt); 2292 }; 2293 2294 static struct seg6_action_param seg6_action_params[SEG6_LOCAL_MAX + 1] = { 2295 [SEG6_LOCAL_SRH] = { .parse = parse_nla_srh, 2296 .put = put_nla_srh, 2297 .cmp = cmp_nla_srh, 2298 .destroy = destroy_attr_srh }, 2299 2300 [SEG6_LOCAL_TABLE] = { .parse = parse_nla_table, 2301 .put = put_nla_table, 2302 .cmp = cmp_nla_table }, 2303 2304 [SEG6_LOCAL_NH4] = { .parse = parse_nla_nh4, 2305 .put = put_nla_nh4, 2306 .cmp = cmp_nla_nh4 }, 2307 2308 [SEG6_LOCAL_NH6] = { .parse = parse_nla_nh6, 2309 .put = put_nla_nh6, 2310 .cmp = cmp_nla_nh6 }, 2311 2312 [SEG6_LOCAL_IIF] = { .parse = parse_nla_iif, 2313 .put = put_nla_iif, 2314 .cmp = cmp_nla_iif }, 2315 2316 [SEG6_LOCAL_OIF] = { .parse = parse_nla_oif, 2317 .put = put_nla_oif, 2318 .cmp = cmp_nla_oif }, 2319 2320 [SEG6_LOCAL_BPF] = { .parse = parse_nla_bpf, 2321 .put = put_nla_bpf, 2322 .cmp = cmp_nla_bpf, 2323 .destroy = destroy_attr_bpf }, 2324 2325 [SEG6_LOCAL_VRFTABLE] = { .parse = parse_nla_vrftable, 2326 .put = put_nla_vrftable, 2327 .cmp = cmp_nla_vrftable }, 2328 2329 [SEG6_LOCAL_COUNTERS] = { .parse = parse_nla_counters, 2330 .put = put_nla_counters, 2331 .cmp = cmp_nla_counters, 2332 .destroy = destroy_attr_counters }, 2333 2334 [SEG6_LOCAL_FLAVORS] = { .parse = parse_nla_flavors, 2335 .put = put_nla_flavors, 2336 .cmp = cmp_nla_flavors }, 2337 }; 2338 2339 /* call the destroy() callback (if available) for each set attribute in 2340 * @parsed_attrs, starting from the first attribute up to the @max_parsed 2341 * (excluded) attribute. 2342 */ 2343 static void __destroy_attrs(unsigned long parsed_attrs, int max_parsed, 2344 struct seg6_local_lwt *slwt) 2345 { 2346 struct seg6_action_param *param; 2347 int i; 2348 2349 /* Every required seg6local attribute is identified by an ID which is 2350 * encoded as a flag (i.e: 1 << ID) in the 'attrs' bitmask; 2351 * 2352 * We scan the 'parsed_attrs' bitmask, starting from the first attribute 2353 * up to the @max_parsed (excluded) attribute. 2354 * For each set attribute, we retrieve the corresponding destroy() 2355 * callback. If the callback is not available, then we skip to the next 2356 * attribute; otherwise, we call the destroy() callback. 2357 */ 2358 for (i = SEG6_LOCAL_SRH; i < max_parsed; ++i) { 2359 if (!(parsed_attrs & SEG6_F_ATTR(i))) 2360 continue; 2361 2362 param = &seg6_action_params[i]; 2363 2364 if (param->destroy) 2365 param->destroy(slwt); 2366 } 2367 } 2368 2369 /* release all the resources that may have been acquired during parsing 2370 * operations. 2371 */ 2372 static void destroy_attrs(struct seg6_local_lwt *slwt) 2373 { 2374 unsigned long attrs = slwt->desc->attrs | slwt->parsed_optattrs; 2375 2376 __destroy_attrs(attrs, SEG6_LOCAL_MAX + 1, slwt); 2377 } 2378 2379 static int parse_nla_optional_attrs(struct nlattr **attrs, 2380 struct seg6_local_lwt *slwt, 2381 struct netlink_ext_ack *extack) 2382 { 2383 struct seg6_action_desc *desc = slwt->desc; 2384 unsigned long parsed_optattrs = 0; 2385 struct seg6_action_param *param; 2386 int err, i; 2387 2388 for (i = SEG6_LOCAL_SRH; i < SEG6_LOCAL_MAX + 1; ++i) { 2389 if (!(desc->optattrs & SEG6_F_ATTR(i)) || !attrs[i]) 2390 continue; 2391 2392 /* once here, the i-th attribute is provided by the 2393 * userspace AND it is identified optional as well. 2394 */ 2395 param = &seg6_action_params[i]; 2396 2397 err = param->parse(attrs, slwt, extack); 2398 if (err < 0) 2399 goto parse_optattrs_err; 2400 2401 /* current attribute has been correctly parsed */ 2402 parsed_optattrs |= SEG6_F_ATTR(i); 2403 } 2404 2405 /* store in the tunnel state all the optional attributed successfully 2406 * parsed. 2407 */ 2408 slwt->parsed_optattrs = parsed_optattrs; 2409 2410 return 0; 2411 2412 parse_optattrs_err: 2413 __destroy_attrs(parsed_optattrs, i, slwt); 2414 2415 return err; 2416 } 2417 2418 /* call the custom constructor of the behavior during its initialization phase 2419 * and after that all its attributes have been parsed successfully. 2420 */ 2421 static int 2422 seg6_local_lwtunnel_build_state(struct seg6_local_lwt *slwt, const void *cfg, 2423 struct netlink_ext_ack *extack) 2424 { 2425 struct seg6_action_desc *desc = slwt->desc; 2426 struct seg6_local_lwtunnel_ops *ops; 2427 2428 ops = &desc->slwt_ops; 2429 if (!ops->build_state) 2430 return 0; 2431 2432 return ops->build_state(slwt, cfg, extack); 2433 } 2434 2435 /* call the custom destructor of the behavior which is invoked before the 2436 * tunnel is going to be destroyed. 2437 */ 2438 static void seg6_local_lwtunnel_destroy_state(struct seg6_local_lwt *slwt) 2439 { 2440 struct seg6_action_desc *desc = slwt->desc; 2441 struct seg6_local_lwtunnel_ops *ops; 2442 2443 ops = &desc->slwt_ops; 2444 if (!ops->destroy_state) 2445 return; 2446 2447 ops->destroy_state(slwt); 2448 } 2449 2450 static int parse_nla_action(struct nlattr **attrs, struct seg6_local_lwt *slwt, 2451 struct netlink_ext_ack *extack) 2452 { 2453 struct seg6_action_param *param; 2454 struct seg6_action_desc *desc; 2455 unsigned long invalid_attrs; 2456 int i, err; 2457 2458 desc = __get_action_desc(slwt->action); 2459 if (!desc) 2460 return -EINVAL; 2461 2462 if (!desc->input) 2463 return -EOPNOTSUPP; 2464 2465 slwt->desc = desc; 2466 slwt->headroom += desc->static_headroom; 2467 2468 /* Forcing the desc->optattrs *set* and the desc->attrs *set* to be 2469 * disjoined, this allow us to release acquired resources by optional 2470 * attributes and by required attributes independently from each other 2471 * without any interference. 2472 * In other terms, we are sure that we do not release some the acquired 2473 * resources twice. 2474 * 2475 * Note that if an attribute is configured both as required and as 2476 * optional, it means that the user has messed something up in the 2477 * seg6_action_table. Therefore, this check is required for SRv6 2478 * behaviors to work properly. 2479 */ 2480 invalid_attrs = desc->attrs & desc->optattrs; 2481 if (invalid_attrs) { 2482 WARN_ONCE(1, 2483 "An attribute cannot be both required AND optional"); 2484 return -EINVAL; 2485 } 2486 2487 /* parse the required attributes */ 2488 for (i = SEG6_LOCAL_SRH; i < SEG6_LOCAL_MAX + 1; i++) { 2489 if (desc->attrs & SEG6_F_ATTR(i)) { 2490 if (!attrs[i]) 2491 return -EINVAL; 2492 2493 param = &seg6_action_params[i]; 2494 2495 err = param->parse(attrs, slwt, extack); 2496 if (err < 0) 2497 goto parse_attrs_err; 2498 } 2499 } 2500 2501 /* parse the optional attributes, if any */ 2502 err = parse_nla_optional_attrs(attrs, slwt, extack); 2503 if (err < 0) 2504 goto parse_attrs_err; 2505 2506 return 0; 2507 2508 parse_attrs_err: 2509 /* release any resource that may have been acquired during the i-1 2510 * parse() operations. 2511 */ 2512 __destroy_attrs(desc->attrs, i, slwt); 2513 2514 return err; 2515 } 2516 2517 static int seg6_local_build_state(struct net *net, struct nlattr *nla, 2518 unsigned int family, const void *cfg, 2519 struct lwtunnel_state **ts, 2520 struct netlink_ext_ack *extack) 2521 { 2522 struct nlattr *tb[SEG6_LOCAL_MAX + 1]; 2523 struct lwtunnel_state *newts; 2524 struct seg6_local_lwt *slwt; 2525 int err; 2526 2527 if (family != AF_INET6) 2528 return -EINVAL; 2529 2530 err = nla_parse_nested_deprecated(tb, SEG6_LOCAL_MAX, nla, 2531 seg6_local_policy, extack); 2532 2533 if (err < 0) 2534 return err; 2535 2536 if (!tb[SEG6_LOCAL_ACTION]) 2537 return -EINVAL; 2538 2539 newts = lwtunnel_state_alloc(sizeof(*slwt)); 2540 if (!newts) 2541 return -ENOMEM; 2542 2543 slwt = seg6_local_lwtunnel(newts); 2544 slwt->action = nla_get_u32(tb[SEG6_LOCAL_ACTION]); 2545 2546 err = parse_nla_action(tb, slwt, extack); 2547 if (err < 0) 2548 goto out_free; 2549 2550 err = seg6_local_lwtunnel_build_state(slwt, cfg, extack); 2551 if (err < 0) 2552 goto out_destroy_attrs; 2553 2554 newts->type = LWTUNNEL_ENCAP_SEG6_LOCAL; 2555 newts->flags = LWTUNNEL_STATE_INPUT_REDIRECT; 2556 newts->headroom = slwt->headroom; 2557 2558 *ts = newts; 2559 2560 return 0; 2561 2562 out_destroy_attrs: 2563 destroy_attrs(slwt); 2564 out_free: 2565 kfree(newts); 2566 return err; 2567 } 2568 2569 static void seg6_local_destroy_state(struct lwtunnel_state *lwt) 2570 { 2571 struct seg6_local_lwt *slwt = seg6_local_lwtunnel(lwt); 2572 2573 seg6_local_lwtunnel_destroy_state(slwt); 2574 2575 destroy_attrs(slwt); 2576 2577 return; 2578 } 2579 2580 static int seg6_local_fill_encap(struct sk_buff *skb, 2581 struct lwtunnel_state *lwt) 2582 { 2583 struct seg6_local_lwt *slwt = seg6_local_lwtunnel(lwt); 2584 struct seg6_action_param *param; 2585 unsigned long attrs; 2586 int i, err; 2587 2588 if (nla_put_u32(skb, SEG6_LOCAL_ACTION, slwt->action)) 2589 return -EMSGSIZE; 2590 2591 attrs = slwt->desc->attrs | slwt->parsed_optattrs; 2592 2593 for (i = SEG6_LOCAL_SRH; i < SEG6_LOCAL_MAX + 1; i++) { 2594 if (attrs & SEG6_F_ATTR(i)) { 2595 param = &seg6_action_params[i]; 2596 err = param->put(skb, slwt); 2597 if (err < 0) 2598 return err; 2599 } 2600 } 2601 2602 return 0; 2603 } 2604 2605 static int seg6_local_get_encap_size(struct lwtunnel_state *lwt) 2606 { 2607 struct seg6_local_lwt *slwt = seg6_local_lwtunnel(lwt); 2608 unsigned long attrs; 2609 int nlsize; 2610 2611 nlsize = nla_total_size(4); /* action */ 2612 2613 attrs = slwt->desc->attrs | slwt->parsed_optattrs; 2614 2615 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_SRH)) 2616 nlsize += nla_total_size((slwt->srh->hdrlen + 1) << 3); 2617 2618 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_TABLE)) 2619 nlsize += nla_total_size(4); 2620 2621 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_NH4)) 2622 nlsize += nla_total_size(4); 2623 2624 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_NH6)) 2625 nlsize += nla_total_size(16); 2626 2627 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_IIF)) 2628 nlsize += nla_total_size(4); 2629 2630 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_OIF)) 2631 nlsize += nla_total_size(4); 2632 2633 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_BPF)) 2634 nlsize += nla_total_size(sizeof(struct nlattr)) + 2635 nla_total_size(MAX_PROG_NAME) + 2636 nla_total_size(4); 2637 2638 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_VRFTABLE)) 2639 nlsize += nla_total_size(4); 2640 2641 if (attrs & SEG6_F_LOCAL_COUNTERS) 2642 nlsize += nla_total_size(0) + /* nest SEG6_LOCAL_COUNTERS */ 2643 /* SEG6_LOCAL_CNT_PACKETS */ 2644 nla_total_size_64bit(sizeof(__u64)) + 2645 /* SEG6_LOCAL_CNT_BYTES */ 2646 nla_total_size_64bit(sizeof(__u64)) + 2647 /* SEG6_LOCAL_CNT_ERRORS */ 2648 nla_total_size_64bit(sizeof(__u64)); 2649 2650 if (attrs & SEG6_F_ATTR(SEG6_LOCAL_FLAVORS)) 2651 nlsize += encap_size_flavors(slwt); 2652 2653 return nlsize; 2654 } 2655 2656 static int seg6_local_cmp_encap(struct lwtunnel_state *a, 2657 struct lwtunnel_state *b) 2658 { 2659 struct seg6_local_lwt *slwt_a, *slwt_b; 2660 struct seg6_action_param *param; 2661 unsigned long attrs_a, attrs_b; 2662 int i; 2663 2664 slwt_a = seg6_local_lwtunnel(a); 2665 slwt_b = seg6_local_lwtunnel(b); 2666 2667 if (slwt_a->action != slwt_b->action) 2668 return 1; 2669 2670 attrs_a = slwt_a->desc->attrs | slwt_a->parsed_optattrs; 2671 attrs_b = slwt_b->desc->attrs | slwt_b->parsed_optattrs; 2672 2673 if (attrs_a != attrs_b) 2674 return 1; 2675 2676 for (i = SEG6_LOCAL_SRH; i < SEG6_LOCAL_MAX + 1; i++) { 2677 if (attrs_a & SEG6_F_ATTR(i)) { 2678 param = &seg6_action_params[i]; 2679 if (param->cmp(slwt_a, slwt_b)) 2680 return 1; 2681 } 2682 } 2683 2684 return 0; 2685 } 2686 2687 static const struct lwtunnel_encap_ops seg6_local_ops = { 2688 .build_state = seg6_local_build_state, 2689 .destroy_state = seg6_local_destroy_state, 2690 .input = seg6_local_input, 2691 .fill_encap = seg6_local_fill_encap, 2692 .get_encap_size = seg6_local_get_encap_size, 2693 .cmp_encap = seg6_local_cmp_encap, 2694 .owner = THIS_MODULE, 2695 }; 2696 2697 int __init seg6_local_init(void) 2698 { 2699 /* If the max total number of defined attributes is reached, then your 2700 * kernel build stops here. 2701 * 2702 * This check is required to avoid arithmetic overflows when processing 2703 * behavior attributes and the maximum number of defined attributes 2704 * exceeds the allowed value. 2705 */ 2706 BUILD_BUG_ON(SEG6_LOCAL_MAX + 1 > BITS_PER_TYPE(unsigned long)); 2707 2708 /* Check whether the number of defined flavors exceeds the maximum 2709 * allowed value. 2710 */ 2711 BUILD_BUG_ON(SEG6_LOCAL_FLV_OP_MAX + 1 > BITS_PER_TYPE(__u32)); 2712 2713 /* If the default NEXT-C-SID Locator-Block/Node Function lengths (in 2714 * bits) have been changed with invalid values, kernel build stops 2715 * here. 2716 */ 2717 BUILD_BUG_ON(next_csid_chk_cntr_bits(SEG6_LOCAL_LCBLOCK_DBITS, 2718 SEG6_LOCAL_LCNODE_FN_DBITS)); 2719 BUILD_BUG_ON(next_csid_chk_lcblock_bits(SEG6_LOCAL_LCBLOCK_DBITS)); 2720 BUILD_BUG_ON(next_csid_chk_lcnode_fn_bits(SEG6_LOCAL_LCNODE_FN_DBITS)); 2721 2722 /* To be memory efficient, we use 'u8' to represent the different 2723 * actions related to RFC8986 flavors. If the kernel build stops here, 2724 * it means that it is not possible to correctly encode these actions 2725 * with the data type chosen for the action table. 2726 */ 2727 BUILD_BUG_ON(SEG6_LOCAL_FLV_ACT_MAX > (typeof(flv8986_act_tbl[0]))~0U); 2728 2729 return lwtunnel_encap_add_ops(&seg6_local_ops, 2730 LWTUNNEL_ENCAP_SEG6_LOCAL); 2731 } 2732 2733 void seg6_local_exit(void) 2734 { 2735 lwtunnel_encap_del_ops(&seg6_local_ops, LWTUNNEL_ENCAP_SEG6_LOCAL); 2736 } 2737