]> git.ipfire.org Git - people/arne_f/kernel.git/blame - net/ipv6/xfrm6_policy.c
xfrm6: fix a potential use after free in xfrm6_policy.c
[people/arne_f/kernel.git] / net / ipv6 / xfrm6_policy.c
CommitLineData
1da177e4
LT
1/*
2 * xfrm6_policy.c: based on xfrm4_policy.c
3 *
4 * Authors:
5 * Mitsuru KANDA @USAGI
67ba4152
IM
6 * Kazunori MIYAZAWA @USAGI
7 * Kunihiro Ishiguro <kunihiro@ipinfusion.com>
8 * IPv6 support
9 * YOSHIFUJI Hideaki
10 * Split up af-specific portion
1ab1457c 11 *
1da177e4
LT
12 */
13
66cdb3ca
HX
14#include <linux/err.h>
15#include <linux/kernel.h>
aabc9761
HX
16#include <linux/netdevice.h>
17#include <net/addrconf.h>
45ff5a3f 18#include <net/dst.h>
1da177e4
LT
19#include <net/xfrm.h>
20#include <net/ip.h>
21#include <net/ipv6.h>
22#include <net/ip6_route.h>
07a93626 23#if IS_ENABLED(CONFIG_IPV6_MIP6)
2ce4272a
MN
24#include <net/mip6.h>
25#endif
1da177e4 26
1da177e4
LT
27static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
28
c5b3cf46 29static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
5e6b930f
DM
30 const xfrm_address_t *saddr,
31 const xfrm_address_t *daddr)
1da177e4 32{
7e1dc7b6 33 struct flowi6 fl6;
66cdb3ca
HX
34 struct dst_entry *dst;
35 int err;
36
7e1dc7b6
DM
37 memset(&fl6, 0, sizeof(fl6));
38 memcpy(&fl6.daddr, daddr, sizeof(fl6.daddr));
66cdb3ca 39 if (saddr)
7e1dc7b6 40 memcpy(&fl6.saddr, saddr, sizeof(fl6.saddr));
66cdb3ca 41
4c9483b2 42 dst = ip6_route_output(net, NULL, &fl6);
66cdb3ca
HX
43
44 err = dst->error;
45 if (dst->error) {
4251320f 46 dst_release(dst);
66cdb3ca
HX
47 dst = ERR_PTR(err);
48 }
49
50 return dst;
1da177e4
LT
51}
52
fbda33b2
AD
53static int xfrm6_get_saddr(struct net *net,
54 xfrm_address_t *saddr, xfrm_address_t *daddr)
a1e59abf 55{
66cdb3ca 56 struct dst_entry *dst;
191cd582 57 struct net_device *dev;
66cdb3ca 58
fbda33b2 59 dst = xfrm6_dst_lookup(net, 0, NULL, daddr);
66cdb3ca
HX
60 if (IS_ERR(dst))
61 return -EHOSTUNREACH;
62
191cd582
BH
63 dev = ip6_dst_idev(dst)->dev;
64 ipv6_dev_get_saddr(dev_net(dev), dev,
7cbca67c 65 (struct in6_addr *)&daddr->a6, 0,
5e5f3f0f 66 (struct in6_addr *)&saddr->a6);
66cdb3ca
HX
67 dst_release(dst);
68 return 0;
a1e59abf
PM
69}
70
05d84025 71static int xfrm6_get_tos(const struct flowi *fl)
1da177e4 72{
25ee3286
HX
73 return 0;
74}
1da177e4 75
9d7b0fc1
PM
76static void xfrm6_init_dst(struct net *net, struct xfrm_dst *xdst)
77{
78 struct rt6_info *rt = (struct rt6_info *)xdst;
79
80 rt6_init_peer(rt, net->ipv6.peers);
81}
82
a1b05140
MN
83static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
84 int nfheader_len)
85{
86 if (dst->ops->family == AF_INET6) {
67ba4152 87 struct rt6_info *rt = (struct rt6_info *)dst;
a1b05140
MN
88 if (rt->rt6i_node)
89 path->path_cookie = rt->rt6i_node->fn_sernum;
90 }
91
92 path->u.rt6.rt6i_nfheader_len = nfheader_len;
93
94 return 0;
95}
96
87c1e12b 97static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
0c7b3eef 98 const struct flowi *fl)
25ee3286 99{
67ba4152 100 struct rt6_info *rt = (struct rt6_info *)xdst->route;
1da177e4 101
25ee3286
HX
102 xdst->u.dst.dev = dev;
103 dev_hold(dev);
1da177e4 104
bc8e4b95 105 xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
84c4a9df
CW
106 if (!xdst->u.rt6.rt6i_idev) {
107 dev_put(dev);
25ee3286 108 return -ENODEV;
84c4a9df 109 }
1da177e4 110
97bab73f 111 rt6_transfer_peer(&xdst->u.rt6, rt);
7cc2edb8 112
25ee3286
HX
113 /* Sheit... I remember I did this right. Apparently,
114 * it was magically lost, so this code needs audit */
115 xdst->u.rt6.rt6i_flags = rt->rt6i_flags & (RTF_ANYCAST |
116 RTF_LOCAL);
117 xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
118 xdst->u.rt6.rt6i_node = rt->rt6i_node;
a1b05140
MN
119 if (rt->rt6i_node)
120 xdst->route_cookie = rt->rt6i_node->fn_sernum;
25ee3286
HX
121 xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
122 xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
123 xdst->u.rt6.rt6i_src = rt->rt6i_src;
1da177e4 124
1da177e4 125 return 0;
1da177e4
LT
126}
127
128static inline void
d5422efe 129_decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
1da177e4 130{
7e1dc7b6 131 struct flowi6 *fl6 = &fl->u.ip6;
7e3a42a1 132 int onlyproto = 0;
cfe1fc77 133 u16 offset = skb_network_header_len(skb);
b71d1d42 134 const struct ipv6hdr *hdr = ipv6_hdr(skb);
e3cae904 135 struct ipv6_opt_hdr *exthdr;
d56f90a7
ACM
136 const unsigned char *nh = skb_network_header(skb);
137 u8 nexthdr = nh[IP6CB(skb)->nhoff];
84502b5e
SK
138 int oif = 0;
139
140 if (skb_dst(skb))
141 oif = skb_dst(skb)->dev->ifindex;
1da177e4 142
7e1dc7b6
DM
143 memset(fl6, 0, sizeof(struct flowi6));
144 fl6->flowi6_mark = skb->mark;
84502b5e 145 fl6->flowi6_oif = reverse ? skb->skb_iif : oif;
44b451f1 146
4e3fd7a0
AD
147 fl6->daddr = reverse ? hdr->saddr : hdr->daddr;
148 fl6->saddr = reverse ? hdr->daddr : hdr->saddr;
1da177e4 149
59cae009
WY
150 while (nh + offset + 1 < skb->data ||
151 pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
d56f90a7
ACM
152 nh = skb_network_header(skb);
153 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
e3cae904 154
1da177e4 155 switch (nexthdr) {
7e3a42a1
ND
156 case NEXTHDR_FRAGMENT:
157 onlyproto = 1;
1da177e4
LT
158 case NEXTHDR_ROUTING:
159 case NEXTHDR_HOP:
160 case NEXTHDR_DEST:
161 offset += ipv6_optlen(exthdr);
162 nexthdr = exthdr->nexthdr;
d56f90a7 163 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
1da177e4
LT
164 break;
165
166 case IPPROTO_UDP:
ba4e58ec 167 case IPPROTO_UDPLITE:
1da177e4
LT
168 case IPPROTO_TCP:
169 case IPPROTO_SCTP:
9e999993 170 case IPPROTO_DCCP:
59cae009
WY
171 if (!onlyproto && (nh + offset + 4 < skb->data ||
172 pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
789f2023 173 __be16 *ports;
1da177e4 174
789f2023
LR
175 nh = skb_network_header(skb);
176 ports = (__be16 *)(nh + offset);
1958b856
DM
177 fl6->fl6_sport = ports[!!reverse];
178 fl6->fl6_dport = ports[!reverse];
1da177e4 179 }
7e1dc7b6 180 fl6->flowi6_proto = nexthdr;
1da177e4
LT
181 return;
182
183 case IPPROTO_ICMPV6:
7e3a42a1 184 if (!onlyproto && pskb_may_pull(skb, nh + offset + 2 - skb->data)) {
789f2023 185 u8 *icmp;
1da177e4 186
789f2023
LR
187 nh = skb_network_header(skb);
188 icmp = (u8 *)(nh + offset);
1958b856
DM
189 fl6->fl6_icmp_type = icmp[0];
190 fl6->fl6_icmp_code = icmp[1];
1da177e4 191 }
7e1dc7b6 192 fl6->flowi6_proto = nexthdr;
1da177e4
LT
193 return;
194
07a93626 195#if IS_ENABLED(CONFIG_IPV6_MIP6)
2ce4272a 196 case IPPROTO_MH:
7e3a42a1 197 if (!onlyproto && pskb_may_pull(skb, nh + offset + 3 - skb->data)) {
2ce4272a 198 struct ip6_mh *mh;
2ce4272a 199
789f2023
LR
200 nh = skb_network_header(skb);
201 mh = (struct ip6_mh *)(nh + offset);
1958b856 202 fl6->fl6_mh_type = mh->ip6mh_type;
2ce4272a 203 }
7e1dc7b6 204 fl6->flowi6_proto = nexthdr;
2ce4272a
MN
205 return;
206#endif
207
1da177e4
LT
208 /* XXX Why are there these headers? */
209 case IPPROTO_AH:
210 case IPPROTO_ESP:
211 case IPPROTO_COMP:
212 default:
1958b856 213 fl6->fl6_ipsec_spi = 0;
7e1dc7b6 214 fl6->flowi6_proto = nexthdr;
1da177e4 215 return;
3ff50b79 216 }
1da177e4
LT
217 }
218}
219
569d3645 220static inline int xfrm6_garbage_collect(struct dst_ops *ops)
1da177e4 221{
d7c7544c
AD
222 struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
223
224 xfrm6_policy_afinfo.garbage_collect(net);
fc66f95c 225 return dst_entries_get_fast(ops) > ops->gc_thresh * 2;
1da177e4
LT
226}
227
6700c270
DM
228static void xfrm6_update_pmtu(struct dst_entry *dst, struct sock *sk,
229 struct sk_buff *skb, u32 mtu)
1da177e4
LT
230{
231 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
232 struct dst_entry *path = xdst->route;
233
6700c270 234 path->ops->update_pmtu(path, sk, skb, mtu);
1da177e4
LT
235}
236
6700c270
DM
237static void xfrm6_redirect(struct dst_entry *dst, struct sock *sk,
238 struct sk_buff *skb)
ec18d9a2
DM
239{
240 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
241 struct dst_entry *path = xdst->route;
242
6700c270 243 path->ops->redirect(path, sk, skb);
ec18d9a2
DM
244}
245
aabc9761
HX
246static void xfrm6_dst_destroy(struct dst_entry *dst)
247{
248 struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
249
250 if (likely(xdst->u.rt6.rt6i_idev))
251 in6_dev_put(xdst->u.rt6.rt6i_idev);
62fa8a84 252 dst_destroy_metrics_generic(dst);
97bab73f
DM
253 if (rt6_has_peer(&xdst->u.rt6)) {
254 struct inet_peer *peer = rt6_peer_ptr(&xdst->u.rt6);
255 inet_putpeer(peer);
256 }
aabc9761
HX
257 xfrm_dst_destroy(xdst);
258}
259
260static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
261 int unregister)
262{
263 struct xfrm_dst *xdst;
264
265 if (!unregister)
266 return;
267
268 xdst = (struct xfrm_dst *)dst;
269 if (xdst->u.rt6.rt6i_idev->dev == dev) {
5a3e55d6 270 struct inet6_dev *loopback_idev =
c346dca1 271 in6_dev_get(dev_net(dev)->loopback_dev);
aabc9761
HX
272 BUG_ON(!loopback_idev);
273
274 do {
275 in6_dev_put(xdst->u.rt6.rt6i_idev);
276 xdst->u.rt6.rt6i_idev = loopback_idev;
277 in6_dev_hold(loopback_idev);
278 xdst = (struct xfrm_dst *)xdst->u.dst.child;
279 } while (xdst->u.dst.xfrm);
280
281 __in6_dev_put(loopback_idev);
282 }
283
284 xfrm_dst_ifdown(dst, dev);
285}
286
1da177e4
LT
287static struct dst_ops xfrm6_dst_ops = {
288 .family = AF_INET6,
09640e63 289 .protocol = cpu_to_be16(ETH_P_IPV6),
1da177e4
LT
290 .gc = xfrm6_garbage_collect,
291 .update_pmtu = xfrm6_update_pmtu,
ec18d9a2 292 .redirect = xfrm6_redirect,
62fa8a84 293 .cow_metrics = dst_cow_metrics_generic,
aabc9761
HX
294 .destroy = xfrm6_dst_destroy,
295 .ifdown = xfrm6_dst_ifdown,
862b82c6 296 .local_out = __ip6_local_out,
eeb1b733 297 .gc_thresh = 32768,
1da177e4
LT
298};
299
300static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
301 .family = AF_INET6,
1da177e4
LT
302 .dst_ops = &xfrm6_dst_ops,
303 .dst_lookup = xfrm6_dst_lookup,
67ba4152 304 .get_saddr = xfrm6_get_saddr,
1da177e4 305 .decode_session = _decode_session6,
25ee3286 306 .get_tos = xfrm6_get_tos,
9d7b0fc1 307 .init_dst = xfrm6_init_dst,
a1b05140 308 .init_path = xfrm6_init_path,
25ee3286 309 .fill_dst = xfrm6_fill_dst,
2774c131 310 .blackhole_route = ip6_blackhole_route,
1da177e4
LT
311};
312
0013caba 313static int __init xfrm6_policy_init(void)
1da177e4 314{
0013caba 315 return xfrm_policy_register_afinfo(&xfrm6_policy_afinfo);
1da177e4
LT
316}
317
318static void xfrm6_policy_fini(void)
319{
320 xfrm_policy_unregister_afinfo(&xfrm6_policy_afinfo);
321}
322
db71789c 323#ifdef CONFIG_SYSCTL
a44a4a00
NH
324static struct ctl_table xfrm6_policy_table[] = {
325 {
a44a4a00 326 .procname = "xfrm6_gc_thresh",
67ba4152
IM
327 .data = &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
328 .maxlen = sizeof(int),
329 .mode = 0644,
a44a4a00
NH
330 .proc_handler = proc_dointvec,
331 },
332 { }
333};
334
8d068875
MK
335static int __net_init xfrm6_net_init(struct net *net)
336{
337 struct ctl_table *table;
338 struct ctl_table_header *hdr;
339
340 table = xfrm6_policy_table;
341 if (!net_eq(net, &init_net)) {
342 table = kmemdup(table, sizeof(xfrm6_policy_table), GFP_KERNEL);
343 if (!table)
344 goto err_alloc;
345
346 table[0].data = &net->xfrm.xfrm6_dst_ops.gc_thresh;
347 }
348
349 hdr = register_net_sysctl(net, "net/ipv6", table);
350 if (!hdr)
351 goto err_reg;
352
353 net->ipv6.sysctl.xfrm6_hdr = hdr;
354 return 0;
355
356err_reg:
357 if (!net_eq(net, &init_net))
358 kfree(table);
359err_alloc:
360 return -ENOMEM;
361}
362
363static void __net_exit xfrm6_net_exit(struct net *net)
364{
365 struct ctl_table *table;
366
367 if (net->ipv6.sysctl.xfrm6_hdr == NULL)
368 return;
369
370 table = net->ipv6.sysctl.xfrm6_hdr->ctl_table_arg;
371 unregister_net_sysctl_table(net->ipv6.sysctl.xfrm6_hdr);
372 if (!net_eq(net, &init_net))
373 kfree(table);
374}
375
376static struct pernet_operations xfrm6_net_ops = {
377 .init = xfrm6_net_init,
378 .exit = xfrm6_net_exit,
379};
db71789c 380#endif
a44a4a00 381
0013caba 382int __init xfrm6_init(void)
1da177e4 383{
0013caba 384 int ret;
c3813286 385
fc66f95c 386 dst_entries_init(&xfrm6_dst_ops);
d7c7544c
AD
387
388 ret = xfrm6_policy_init();
fc66f95c
ED
389 if (ret) {
390 dst_entries_destroy(&xfrm6_dst_ops);
d7c7544c 391 goto out;
fc66f95c 392 }
d7c7544c
AD
393 ret = xfrm6_state_init();
394 if (ret)
395 goto out_policy;
396
7e14ea15
SK
397 ret = xfrm6_protocol_init();
398 if (ret)
399 goto out_state;
400
db71789c 401#ifdef CONFIG_SYSCTL
8d068875 402 register_pernet_subsys(&xfrm6_net_ops);
db71789c 403#endif
0013caba
DL
404out:
405 return ret;
7e14ea15
SK
406out_state:
407 xfrm6_state_fini();
0013caba
DL
408out_policy:
409 xfrm6_policy_fini();
410 goto out;
1da177e4
LT
411}
412
413void xfrm6_fini(void)
414{
db71789c 415#ifdef CONFIG_SYSCTL
8d068875 416 unregister_pernet_subsys(&xfrm6_net_ops);
db71789c 417#endif
7e14ea15 418 xfrm6_protocol_fini();
1da177e4
LT
419 xfrm6_policy_fini();
420 xfrm6_state_fini();
fc66f95c 421 dst_entries_destroy(&xfrm6_dst_ops);
1da177e4 422}