1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* xfrm4_protocol.c - Generic xfrm protocol multiplexer.
3  *
4  * Copyright (C) 2013 secunet Security Networks AG
5  *
6  * Author:
7  * Steffen Klassert <steffen.klassert@secunet.com>
8  *
9  * Based on:
10  * net/ipv4/tunnel4.c
11  */
12 
13 #include <linux/init.h>
14 #include <linux/mutex.h>
15 #include <linux/skbuff.h>
16 #include <net/icmp.h>
17 #include <net/ip.h>
18 #include <net/protocol.h>
19 #include <net/xfrm.h>
20 
21 static struct xfrm4_protocol __rcu *esp4_handlers __read_mostly;
22 static struct xfrm4_protocol __rcu *ah4_handlers __read_mostly;
23 static struct xfrm4_protocol __rcu *ipcomp4_handlers __read_mostly;
24 static DEFINE_MUTEX(xfrm4_protocol_mutex);
25 
proto_handlers(u8 protocol)26 static inline struct xfrm4_protocol __rcu **proto_handlers(u8 protocol)
27 {
28 	switch (protocol) {
29 	case IPPROTO_ESP:
30 		return &esp4_handlers;
31 	case IPPROTO_AH:
32 		return &ah4_handlers;
33 	case IPPROTO_COMP:
34 		return &ipcomp4_handlers;
35 	}
36 
37 	return NULL;
38 }
39 
40 #define for_each_protocol_rcu(head, handler)		\
41 	for (handler = rcu_dereference(head);		\
42 	     handler != NULL;				\
43 	     handler = rcu_dereference(handler->next))	\
44 
xfrm4_rcv_cb(struct sk_buff * skb,u8 protocol,int err)45 static int xfrm4_rcv_cb(struct sk_buff *skb, u8 protocol, int err)
46 {
47 	int ret;
48 	struct xfrm4_protocol *handler;
49 	struct xfrm4_protocol __rcu **head = proto_handlers(protocol);
50 
51 	if (!head)
52 		return 0;
53 
54 	for_each_protocol_rcu(*head, handler)
55 		if ((ret = handler->cb_handler(skb, err)) <= 0)
56 			return ret;
57 
58 	return 0;
59 }
60 
xfrm4_rcv_encap(struct sk_buff * skb,int nexthdr,__be32 spi,int encap_type)61 int xfrm4_rcv_encap(struct sk_buff *skb, int nexthdr, __be32 spi,
62 		    int encap_type)
63 {
64 	int ret;
65 	struct xfrm4_protocol *handler;
66 	struct xfrm4_protocol __rcu **head = proto_handlers(nexthdr);
67 
68 	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
69 	XFRM_SPI_SKB_CB(skb)->family = AF_INET;
70 	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
71 
72 	if (!head)
73 		goto out;
74 
75 	if (!skb_dst(skb)) {
76 		const struct iphdr *iph = ip_hdr(skb);
77 
78 		if (ip_route_input_noref(skb, iph->daddr, iph->saddr,
79 					 iph->tos, skb->dev))
80 			goto drop;
81 	}
82 
83 	for_each_protocol_rcu(*head, handler)
84 		if ((ret = handler->input_handler(skb, nexthdr, spi, encap_type)) != -EINVAL)
85 			return ret;
86 
87 out:
88 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
89 
90 drop:
91 	kfree_skb(skb);
92 	return 0;
93 }
94 EXPORT_SYMBOL(xfrm4_rcv_encap);
95 
xfrm4_esp_rcv(struct sk_buff * skb)96 static int xfrm4_esp_rcv(struct sk_buff *skb)
97 {
98 	int ret;
99 	struct xfrm4_protocol *handler;
100 
101 	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
102 
103 	for_each_protocol_rcu(esp4_handlers, handler)
104 		if ((ret = handler->handler(skb)) != -EINVAL)
105 			return ret;
106 
107 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
108 
109 	kfree_skb(skb);
110 	return 0;
111 }
112 
xfrm4_esp_err(struct sk_buff * skb,u32 info)113 static int xfrm4_esp_err(struct sk_buff *skb, u32 info)
114 {
115 	struct xfrm4_protocol *handler;
116 
117 	for_each_protocol_rcu(esp4_handlers, handler)
118 		if (!handler->err_handler(skb, info))
119 			return 0;
120 
121 	return -ENOENT;
122 }
123 
xfrm4_ah_rcv(struct sk_buff * skb)124 static int xfrm4_ah_rcv(struct sk_buff *skb)
125 {
126 	int ret;
127 	struct xfrm4_protocol *handler;
128 
129 	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
130 
131 	for_each_protocol_rcu(ah4_handlers, handler)
132 		if ((ret = handler->handler(skb)) != -EINVAL)
133 			return ret;
134 
135 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
136 
137 	kfree_skb(skb);
138 	return 0;
139 }
140 
xfrm4_ah_err(struct sk_buff * skb,u32 info)141 static int xfrm4_ah_err(struct sk_buff *skb, u32 info)
142 {
143 	struct xfrm4_protocol *handler;
144 
145 	for_each_protocol_rcu(ah4_handlers, handler)
146 		if (!handler->err_handler(skb, info))
147 			return 0;
148 
149 	return -ENOENT;
150 }
151 
xfrm4_ipcomp_rcv(struct sk_buff * skb)152 static int xfrm4_ipcomp_rcv(struct sk_buff *skb)
153 {
154 	int ret;
155 	struct xfrm4_protocol *handler;
156 
157 	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = NULL;
158 
159 	for_each_protocol_rcu(ipcomp4_handlers, handler)
160 		if ((ret = handler->handler(skb)) != -EINVAL)
161 			return ret;
162 
163 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
164 
165 	kfree_skb(skb);
166 	return 0;
167 }
168 
xfrm4_ipcomp_err(struct sk_buff * skb,u32 info)169 static int xfrm4_ipcomp_err(struct sk_buff *skb, u32 info)
170 {
171 	struct xfrm4_protocol *handler;
172 
173 	for_each_protocol_rcu(ipcomp4_handlers, handler)
174 		if (!handler->err_handler(skb, info))
175 			return 0;
176 
177 	return -ENOENT;
178 }
179 
180 static const struct net_protocol esp4_protocol = {
181 	.handler	=	xfrm4_esp_rcv,
182 	.err_handler	=	xfrm4_esp_err,
183 	.no_policy	=	1,
184 };
185 
186 static const struct net_protocol ah4_protocol = {
187 	.handler	=	xfrm4_ah_rcv,
188 	.err_handler	=	xfrm4_ah_err,
189 	.no_policy	=	1,
190 };
191 
192 static const struct net_protocol ipcomp4_protocol = {
193 	.handler	=	xfrm4_ipcomp_rcv,
194 	.err_handler	=	xfrm4_ipcomp_err,
195 	.no_policy	=	1,
196 };
197 
198 static const struct xfrm_input_afinfo xfrm4_input_afinfo = {
199 	.family		=	AF_INET,
200 	.callback	=	xfrm4_rcv_cb,
201 };
202 
netproto(unsigned char protocol)203 static inline const struct net_protocol *netproto(unsigned char protocol)
204 {
205 	switch (protocol) {
206 	case IPPROTO_ESP:
207 		return &esp4_protocol;
208 	case IPPROTO_AH:
209 		return &ah4_protocol;
210 	case IPPROTO_COMP:
211 		return &ipcomp4_protocol;
212 	}
213 
214 	return NULL;
215 }
216 
xfrm4_protocol_register(struct xfrm4_protocol * handler,unsigned char protocol)217 int xfrm4_protocol_register(struct xfrm4_protocol *handler,
218 			    unsigned char protocol)
219 {
220 	struct xfrm4_protocol __rcu **pprev;
221 	struct xfrm4_protocol *t;
222 	bool add_netproto = false;
223 	int ret = -EEXIST;
224 	int priority = handler->priority;
225 
226 	if (!proto_handlers(protocol) || !netproto(protocol))
227 		return -EINVAL;
228 
229 	mutex_lock(&xfrm4_protocol_mutex);
230 
231 	if (!rcu_dereference_protected(*proto_handlers(protocol),
232 				       lockdep_is_held(&xfrm4_protocol_mutex)))
233 		add_netproto = true;
234 
235 	for (pprev = proto_handlers(protocol);
236 	     (t = rcu_dereference_protected(*pprev,
237 			lockdep_is_held(&xfrm4_protocol_mutex))) != NULL;
238 	     pprev = &t->next) {
239 		if (t->priority < priority)
240 			break;
241 		if (t->priority == priority)
242 			goto err;
243 	}
244 
245 	handler->next = *pprev;
246 	rcu_assign_pointer(*pprev, handler);
247 
248 	ret = 0;
249 
250 err:
251 	mutex_unlock(&xfrm4_protocol_mutex);
252 
253 	if (add_netproto) {
254 		if (inet_add_protocol(netproto(protocol), protocol)) {
255 			pr_err("%s: can't add protocol\n", __func__);
256 			ret = -EAGAIN;
257 		}
258 	}
259 
260 	return ret;
261 }
262 EXPORT_SYMBOL(xfrm4_protocol_register);
263 
xfrm4_protocol_deregister(struct xfrm4_protocol * handler,unsigned char protocol)264 int xfrm4_protocol_deregister(struct xfrm4_protocol *handler,
265 			      unsigned char protocol)
266 {
267 	struct xfrm4_protocol __rcu **pprev;
268 	struct xfrm4_protocol *t;
269 	int ret = -ENOENT;
270 
271 	if (!proto_handlers(protocol) || !netproto(protocol))
272 		return -EINVAL;
273 
274 	mutex_lock(&xfrm4_protocol_mutex);
275 
276 	for (pprev = proto_handlers(protocol);
277 	     (t = rcu_dereference_protected(*pprev,
278 			lockdep_is_held(&xfrm4_protocol_mutex))) != NULL;
279 	     pprev = &t->next) {
280 		if (t == handler) {
281 			*pprev = handler->next;
282 			ret = 0;
283 			break;
284 		}
285 	}
286 
287 	if (!rcu_dereference_protected(*proto_handlers(protocol),
288 				       lockdep_is_held(&xfrm4_protocol_mutex))) {
289 		if (inet_del_protocol(netproto(protocol), protocol) < 0) {
290 			pr_err("%s: can't remove protocol\n", __func__);
291 			ret = -EAGAIN;
292 		}
293 	}
294 
295 	mutex_unlock(&xfrm4_protocol_mutex);
296 
297 	synchronize_net();
298 
299 	return ret;
300 }
301 EXPORT_SYMBOL(xfrm4_protocol_deregister);
302 
xfrm4_protocol_init(void)303 void __init xfrm4_protocol_init(void)
304 {
305 	xfrm_input_register_afinfo(&xfrm4_input_afinfo);
306 }
307