]> asedeno.scripts.mit.edu Git - linux.git/blob - net/ipv6/ip6_offload.c
ipv6: Prevent overrun when parsing v6 header options
[linux.git] / net / ipv6 / ip6_offload.c
1 /*
2  *      IPV6 GSO/GRO offload support
3  *      Linux INET6 implementation
4  *
5  *      This program is free software; you can redistribute it and/or
6  *      modify it under the terms of the GNU General Public License
7  *      as published by the Free Software Foundation; either version
8  *      2 of the License, or (at your option) any later version.
9  */
10
11 #include <linux/kernel.h>
12 #include <linux/socket.h>
13 #include <linux/netdevice.h>
14 #include <linux/skbuff.h>
15 #include <linux/printk.h>
16
17 #include <net/protocol.h>
18 #include <net/ipv6.h>
19 #include <net/inet_common.h>
20
21 #include "ip6_offload.h"
22
23 static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
24 {
25         const struct net_offload *ops = NULL;
26
27         for (;;) {
28                 struct ipv6_opt_hdr *opth;
29                 int len;
30
31                 if (proto != NEXTHDR_HOP) {
32                         ops = rcu_dereference(inet6_offloads[proto]);
33
34                         if (unlikely(!ops))
35                                 break;
36
37                         if (!(ops->flags & INET6_PROTO_GSO_EXTHDR))
38                                 break;
39                 }
40
41                 if (unlikely(!pskb_may_pull(skb, 8)))
42                         break;
43
44                 opth = (void *)skb->data;
45                 len = ipv6_optlen(opth);
46
47                 if (unlikely(!pskb_may_pull(skb, len)))
48                         break;
49
50                 opth = (void *)skb->data;
51                 proto = opth->nexthdr;
52                 __skb_pull(skb, len);
53         }
54
55         return proto;
56 }
57
58 static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
59         netdev_features_t features)
60 {
61         struct sk_buff *segs = ERR_PTR(-EINVAL);
62         struct ipv6hdr *ipv6h;
63         const struct net_offload *ops;
64         int proto;
65         struct frag_hdr *fptr;
66         unsigned int unfrag_ip6hlen;
67         unsigned int payload_len;
68         u8 *prevhdr;
69         int offset = 0;
70         bool encap, udpfrag;
71         int nhoff;
72         bool gso_partial;
73
74         skb_reset_network_header(skb);
75         nhoff = skb_network_header(skb) - skb_mac_header(skb);
76         if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))
77                 goto out;
78
79         encap = SKB_GSO_CB(skb)->encap_level > 0;
80         if (encap)
81                 features &= skb->dev->hw_enc_features;
82         SKB_GSO_CB(skb)->encap_level += sizeof(*ipv6h);
83
84         ipv6h = ipv6_hdr(skb);
85         __skb_pull(skb, sizeof(*ipv6h));
86         segs = ERR_PTR(-EPROTONOSUPPORT);
87
88         proto = ipv6_gso_pull_exthdrs(skb, ipv6h->nexthdr);
89
90         if (skb->encapsulation &&
91             skb_shinfo(skb)->gso_type & (SKB_GSO_IPXIP4 | SKB_GSO_IPXIP6))
92                 udpfrag = proto == IPPROTO_UDP && encap;
93         else
94                 udpfrag = proto == IPPROTO_UDP && !skb->encapsulation;
95
96         ops = rcu_dereference(inet6_offloads[proto]);
97         if (likely(ops && ops->callbacks.gso_segment)) {
98                 skb_reset_transport_header(skb);
99                 segs = ops->callbacks.gso_segment(skb, features);
100         }
101
102         if (IS_ERR_OR_NULL(segs))
103                 goto out;
104
105         gso_partial = !!(skb_shinfo(segs)->gso_type & SKB_GSO_PARTIAL);
106
107         for (skb = segs; skb; skb = skb->next) {
108                 ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
109                 if (gso_partial)
110                         payload_len = skb_shinfo(skb)->gso_size +
111                                       SKB_GSO_CB(skb)->data_offset +
112                                       skb->head - (unsigned char *)(ipv6h + 1);
113                 else
114                         payload_len = skb->len - nhoff - sizeof(*ipv6h);
115                 ipv6h->payload_len = htons(payload_len);
116                 skb->network_header = (u8 *)ipv6h - skb->head;
117
118                 if (udpfrag) {
119                         unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr);
120                         if (unfrag_ip6hlen < 0)
121                                 return ERR_PTR(unfrag_ip6hlen);
122                         fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen);
123                         fptr->frag_off = htons(offset);
124                         if (skb->next)
125                                 fptr->frag_off |= htons(IP6_MF);
126                         offset += (ntohs(ipv6h->payload_len) -
127                                    sizeof(struct frag_hdr));
128                 }
129                 if (encap)
130                         skb_reset_inner_headers(skb);
131         }
132
133 out:
134         return segs;
135 }
136
137 /* Return the total length of all the extension hdrs, following the same
138  * logic in ipv6_gso_pull_exthdrs() when parsing ext-hdrs.
139  */
140 static int ipv6_exthdrs_len(struct ipv6hdr *iph,
141                             const struct net_offload **opps)
142 {
143         struct ipv6_opt_hdr *opth = (void *)iph;
144         int len = 0, proto, optlen = sizeof(*iph);
145
146         proto = iph->nexthdr;
147         for (;;) {
148                 if (proto != NEXTHDR_HOP) {
149                         *opps = rcu_dereference(inet6_offloads[proto]);
150                         if (unlikely(!(*opps)))
151                                 break;
152                         if (!((*opps)->flags & INET6_PROTO_GSO_EXTHDR))
153                                 break;
154                 }
155                 opth = (void *)opth + optlen;
156                 optlen = ipv6_optlen(opth);
157                 len += optlen;
158                 proto = opth->nexthdr;
159         }
160         return len;
161 }
162
163 static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
164                                          struct sk_buff *skb)
165 {
166         const struct net_offload *ops;
167         struct sk_buff **pp = NULL;
168         struct sk_buff *p;
169         struct ipv6hdr *iph;
170         unsigned int nlen;
171         unsigned int hlen;
172         unsigned int off;
173         u16 flush = 1;
174         int proto;
175
176         off = skb_gro_offset(skb);
177         hlen = off + sizeof(*iph);
178         iph = skb_gro_header_fast(skb, off);
179         if (skb_gro_header_hard(skb, hlen)) {
180                 iph = skb_gro_header_slow(skb, hlen, off);
181                 if (unlikely(!iph))
182                         goto out;
183         }
184
185         skb_set_network_header(skb, off);
186         skb_gro_pull(skb, sizeof(*iph));
187         skb_set_transport_header(skb, skb_gro_offset(skb));
188
189         flush += ntohs(iph->payload_len) != skb_gro_len(skb);
190
191         rcu_read_lock();
192         proto = iph->nexthdr;
193         ops = rcu_dereference(inet6_offloads[proto]);
194         if (!ops || !ops->callbacks.gro_receive) {
195                 __pskb_pull(skb, skb_gro_offset(skb));
196                 skb_gro_frag0_invalidate(skb);
197                 proto = ipv6_gso_pull_exthdrs(skb, proto);
198                 skb_gro_pull(skb, -skb_transport_offset(skb));
199                 skb_reset_transport_header(skb);
200                 __skb_push(skb, skb_gro_offset(skb));
201
202                 ops = rcu_dereference(inet6_offloads[proto]);
203                 if (!ops || !ops->callbacks.gro_receive)
204                         goto out_unlock;
205
206                 iph = ipv6_hdr(skb);
207         }
208
209         NAPI_GRO_CB(skb)->proto = proto;
210
211         flush--;
212         nlen = skb_network_header_len(skb);
213
214         for (p = *head; p; p = p->next) {
215                 const struct ipv6hdr *iph2;
216                 __be32 first_word; /* <Version:4><Traffic_Class:8><Flow_Label:20> */
217
218                 if (!NAPI_GRO_CB(p)->same_flow)
219                         continue;
220
221                 iph2 = (struct ipv6hdr *)(p->data + off);
222                 first_word = *(__be32 *)iph ^ *(__be32 *)iph2;
223
224                 /* All fields must match except length and Traffic Class.
225                  * XXX skbs on the gro_list have all been parsed and pulled
226                  * already so we don't need to compare nlen
227                  * (nlen != (sizeof(*iph2) + ipv6_exthdrs_len(iph2, &ops)))
228                  * memcmp() alone below is suffcient, right?
229                  */
230                  if ((first_word & htonl(0xF00FFFFF)) ||
231                     memcmp(&iph->nexthdr, &iph2->nexthdr,
232                            nlen - offsetof(struct ipv6hdr, nexthdr))) {
233                         NAPI_GRO_CB(p)->same_flow = 0;
234                         continue;
235                 }
236                 /* flush if Traffic Class fields are different */
237                 NAPI_GRO_CB(p)->flush |= !!(first_word & htonl(0x0FF00000));
238                 NAPI_GRO_CB(p)->flush |= flush;
239
240                 /* If the previous IP ID value was based on an atomic
241                  * datagram we can overwrite the value and ignore it.
242                  */
243                 if (NAPI_GRO_CB(skb)->is_atomic)
244                         NAPI_GRO_CB(p)->flush_id = 0;
245         }
246
247         NAPI_GRO_CB(skb)->is_atomic = true;
248         NAPI_GRO_CB(skb)->flush |= flush;
249
250         skb_gro_postpull_rcsum(skb, iph, nlen);
251
252         pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
253
254 out_unlock:
255         rcu_read_unlock();
256
257 out:
258         skb_gro_flush_final(skb, pp, flush);
259
260         return pp;
261 }
262
263 static struct sk_buff **sit_ip6ip6_gro_receive(struct sk_buff **head,
264                                                struct sk_buff *skb)
265 {
266         /* Common GRO receive for SIT and IP6IP6 */
267
268         if (NAPI_GRO_CB(skb)->encap_mark) {
269                 NAPI_GRO_CB(skb)->flush = 1;
270                 return NULL;
271         }
272
273         NAPI_GRO_CB(skb)->encap_mark = 1;
274
275         return ipv6_gro_receive(head, skb);
276 }
277
278 static struct sk_buff **ip4ip6_gro_receive(struct sk_buff **head,
279                                            struct sk_buff *skb)
280 {
281         /* Common GRO receive for SIT and IP6IP6 */
282
283         if (NAPI_GRO_CB(skb)->encap_mark) {
284                 NAPI_GRO_CB(skb)->flush = 1;
285                 return NULL;
286         }
287
288         NAPI_GRO_CB(skb)->encap_mark = 1;
289
290         return inet_gro_receive(head, skb);
291 }
292
293 static int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
294 {
295         const struct net_offload *ops;
296         struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + nhoff);
297         int err = -ENOSYS;
298
299         if (skb->encapsulation) {
300                 skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IPV6));
301                 skb_set_inner_network_header(skb, nhoff);
302         }
303
304         iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
305
306         rcu_read_lock();
307
308         nhoff += sizeof(*iph) + ipv6_exthdrs_len(iph, &ops);
309         if (WARN_ON(!ops || !ops->callbacks.gro_complete))
310                 goto out_unlock;
311
312         err = ops->callbacks.gro_complete(skb, nhoff);
313
314 out_unlock:
315         rcu_read_unlock();
316
317         return err;
318 }
319
320 static int sit_gro_complete(struct sk_buff *skb, int nhoff)
321 {
322         skb->encapsulation = 1;
323         skb_shinfo(skb)->gso_type |= SKB_GSO_IPXIP4;
324         return ipv6_gro_complete(skb, nhoff);
325 }
326
327 static int ip6ip6_gro_complete(struct sk_buff *skb, int nhoff)
328 {
329         skb->encapsulation = 1;
330         skb_shinfo(skb)->gso_type |= SKB_GSO_IPXIP6;
331         return ipv6_gro_complete(skb, nhoff);
332 }
333
334 static int ip4ip6_gro_complete(struct sk_buff *skb, int nhoff)
335 {
336         skb->encapsulation = 1;
337         skb_shinfo(skb)->gso_type |= SKB_GSO_IPXIP6;
338         return inet_gro_complete(skb, nhoff);
339 }
340
341 static struct packet_offload ipv6_packet_offload __read_mostly = {
342         .type = cpu_to_be16(ETH_P_IPV6),
343         .callbacks = {
344                 .gso_segment = ipv6_gso_segment,
345                 .gro_receive = ipv6_gro_receive,
346                 .gro_complete = ipv6_gro_complete,
347         },
348 };
349
350 static const struct net_offload sit_offload = {
351         .callbacks = {
352                 .gso_segment    = ipv6_gso_segment,
353                 .gro_receive    = sit_ip6ip6_gro_receive,
354                 .gro_complete   = sit_gro_complete,
355         },
356 };
357
358 static const struct net_offload ip4ip6_offload = {
359         .callbacks = {
360                 .gso_segment    = inet_gso_segment,
361                 .gro_receive    = ip4ip6_gro_receive,
362                 .gro_complete   = ip4ip6_gro_complete,
363         },
364 };
365
366 static const struct net_offload ip6ip6_offload = {
367         .callbacks = {
368                 .gso_segment    = ipv6_gso_segment,
369                 .gro_receive    = sit_ip6ip6_gro_receive,
370                 .gro_complete   = ip6ip6_gro_complete,
371         },
372 };
373 static int __init ipv6_offload_init(void)
374 {
375
376         if (tcpv6_offload_init() < 0)
377                 pr_crit("%s: Cannot add TCP protocol offload\n", __func__);
378         if (ipv6_exthdrs_offload_init() < 0)
379                 pr_crit("%s: Cannot add EXTHDRS protocol offload\n", __func__);
380
381         dev_add_offload(&ipv6_packet_offload);
382
383         inet_add_offload(&sit_offload, IPPROTO_IPV6);
384         inet6_add_offload(&ip6ip6_offload, IPPROTO_IPV6);
385         inet6_add_offload(&ip4ip6_offload, IPPROTO_IPIP);
386
387         return 0;
388 }
389
390 fs_initcall(ipv6_offload_init);