^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * SR-IPv6 implementation -- HMAC functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Author:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * David Lebrun <david.lebrun@uclouvain.be>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #include <linux/errno.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/types.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/socket.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/sockios.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/net.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/netdevice.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/in6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/icmpv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/mroute6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <linux/rhashtable.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <linux/netfilter.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <linux/netfilter_ipv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <net/sock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <net/snmp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <net/ipv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #include <net/protocol.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <net/transp_v6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #include <net/rawv6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #include <net/ndisc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) #include <net/ip6_route.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) #include <net/addrconf.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) #include <net/xfrm.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) #include <crypto/hash.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #include <crypto/sha.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #include <net/seg6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) #include <net/genetlink.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) #include <net/seg6_hmac.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) #include <linux/random.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) static DEFINE_PER_CPU(char [SEG6_HMAC_RING_SIZE], hmac_ring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) static int seg6_hmac_cmpfn(struct rhashtable_compare_arg *arg, const void *obj)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) const struct seg6_hmac_info *hinfo = obj;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) return (hinfo->hmackeyid != *(__u32 *)arg->key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) static inline void seg6_hinfo_release(struct seg6_hmac_info *hinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) kfree_rcu(hinfo, rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) static void seg6_free_hi(void *ptr, void *arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) struct seg6_hmac_info *hinfo = (struct seg6_hmac_info *)ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) if (hinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) seg6_hinfo_release(hinfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) static const struct rhashtable_params rht_params = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) .head_offset = offsetof(struct seg6_hmac_info, node),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) .key_offset = offsetof(struct seg6_hmac_info, hmackeyid),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) .key_len = sizeof(u32),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) .automatic_shrinking = true,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) .obj_cmpfn = seg6_hmac_cmpfn,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) static struct seg6_hmac_algo hmac_algos[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) .alg_id = SEG6_HMAC_ALGO_SHA1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) .name = "hmac(sha1)",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) .alg_id = SEG6_HMAC_ALGO_SHA256,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) .name = "hmac(sha256)",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) static struct sr6_tlv_hmac *seg6_get_tlv_hmac(struct ipv6_sr_hdr *srh)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) struct sr6_tlv_hmac *tlv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) if (srh->hdrlen < (srh->first_segment + 1) * 2 + 5)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) if (!sr_has_hmac(srh))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) tlv = (struct sr6_tlv_hmac *)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) ((char *)srh + ((srh->hdrlen + 1) << 3) - 40);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) if (tlv->tlvhdr.type != SR6_TLV_HMAC || tlv->tlvhdr.len != 38)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) return tlv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) static struct seg6_hmac_algo *__hmac_get_algo(u8 alg_id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) struct seg6_hmac_algo *algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) int i, alg_count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) alg_count = ARRAY_SIZE(hmac_algos);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) for (i = 0; i < alg_count; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) algo = &hmac_algos[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) if (algo->alg_id == alg_id)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) return algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) static int __do_hmac(struct seg6_hmac_info *hinfo, const char *text, u8 psize,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) u8 *output, int outlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) struct seg6_hmac_algo *algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) struct crypto_shash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) struct shash_desc *shash;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) int ret, dgsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) algo = __hmac_get_algo(hinfo->alg_id);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) if (!algo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) return -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) tfm = *this_cpu_ptr(algo->tfms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) dgsize = crypto_shash_digestsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) if (dgsize > outlen) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) pr_debug("sr-ipv6: __do_hmac: digest size too big (%d / %d)\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) dgsize, outlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) ret = crypto_shash_setkey(tfm, hinfo->secret, hinfo->slen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) pr_debug("sr-ipv6: crypto_shash_setkey failed: err %d\n", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) goto failed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) shash = *this_cpu_ptr(algo->shashs);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) shash->tfm = tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) ret = crypto_shash_digest(shash, text, psize, output);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) if (ret < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) pr_debug("sr-ipv6: crypto_shash_digest failed: err %d\n", ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) goto failed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) return dgsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) failed:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) int seg6_hmac_compute(struct seg6_hmac_info *hinfo, struct ipv6_sr_hdr *hdr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) struct in6_addr *saddr, u8 *output)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) __be32 hmackeyid = cpu_to_be32(hinfo->hmackeyid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) u8 tmp_out[SEG6_HMAC_MAX_DIGESTSIZE];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) int plen, i, dgsize, wrsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) char *ring, *off;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) /* a 160-byte buffer for digest output allows to store highest known
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) * hash function (RadioGatun) with up to 1216 bits
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) /* saddr(16) + first_seg(1) + flags(1) + keyid(4) + seglist(16n) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) plen = 16 + 1 + 1 + 4 + (hdr->first_segment + 1) * 16;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) /* this limit allows for 14 segments */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) if (plen >= SEG6_HMAC_RING_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) /* Let's build the HMAC text on the ring buffer. The text is composed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) * as follows, in order:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) * 1. Source IPv6 address (128 bits)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) * 2. first_segment value (8 bits)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) * 3. Flags (8 bits)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) * 4. HMAC Key ID (32 bits)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) * 5. All segments in the segments list (n * 128 bits)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) local_bh_disable();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) ring = this_cpu_ptr(hmac_ring);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) off = ring;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) /* source address */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) memcpy(off, saddr, 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) off += 16;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) /* first_segment value */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) *off++ = hdr->first_segment;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) /* flags */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) *off++ = hdr->flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) /* HMAC Key ID */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) memcpy(off, &hmackeyid, 4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) off += 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) /* all segments in the list */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) for (i = 0; i < hdr->first_segment + 1; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) memcpy(off, hdr->segments + i, 16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) off += 16;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) dgsize = __do_hmac(hinfo, ring, plen, tmp_out,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) SEG6_HMAC_MAX_DIGESTSIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) local_bh_enable();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) if (dgsize < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) return dgsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) wrsize = SEG6_HMAC_FIELD_LEN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) if (wrsize > dgsize)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) wrsize = dgsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) memset(output, 0, SEG6_HMAC_FIELD_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) memcpy(output, tmp_out, wrsize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) EXPORT_SYMBOL(seg6_hmac_compute);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) /* checks if an incoming SR-enabled packet's HMAC status matches
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) * the incoming policy.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) * called with rcu_read_lock()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) bool seg6_hmac_validate_skb(struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) u8 hmac_output[SEG6_HMAC_FIELD_LEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) struct net *net = dev_net(skb->dev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) struct seg6_hmac_info *hinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) struct sr6_tlv_hmac *tlv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) struct ipv6_sr_hdr *srh;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) struct inet6_dev *idev;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) idev = __in6_dev_get(skb->dev);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) srh = (struct ipv6_sr_hdr *)skb_transport_header(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) tlv = seg6_get_tlv_hmac(srh);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) /* mandatory check but no tlv */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) if (idev->cnf.seg6_require_hmac > 0 && !tlv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) /* no check */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) if (idev->cnf.seg6_require_hmac < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) /* check only if present */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) if (idev->cnf.seg6_require_hmac == 0 && !tlv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) /* now, seg6_require_hmac >= 0 && tlv */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) hinfo = seg6_hmac_info_lookup(net, be32_to_cpu(tlv->hmackeyid));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) if (!hinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) if (seg6_hmac_compute(hinfo, srh, &ipv6_hdr(skb)->saddr, hmac_output))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) if (memcmp(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN) != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) return false;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) return true;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) EXPORT_SYMBOL(seg6_hmac_validate_skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) /* called with rcu_read_lock() */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) struct seg6_hmac_info *seg6_hmac_info_lookup(struct net *net, u32 key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) struct seg6_pernet_data *sdata = seg6_pernet(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) struct seg6_hmac_info *hinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) hinfo = rhashtable_lookup_fast(&sdata->hmac_infos, &key, rht_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) return hinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) EXPORT_SYMBOL(seg6_hmac_info_lookup);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) int seg6_hmac_info_add(struct net *net, u32 key, struct seg6_hmac_info *hinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) struct seg6_pernet_data *sdata = seg6_pernet(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) err = rhashtable_lookup_insert_fast(&sdata->hmac_infos, &hinfo->node,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) rht_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) EXPORT_SYMBOL(seg6_hmac_info_add);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) int seg6_hmac_info_del(struct net *net, u32 key)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) struct seg6_pernet_data *sdata = seg6_pernet(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) struct seg6_hmac_info *hinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) int err = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) hinfo = rhashtable_lookup_fast(&sdata->hmac_infos, &key, rht_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) if (!hinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) err = rhashtable_remove_fast(&sdata->hmac_infos, &hinfo->node,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) rht_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) seg6_hinfo_release(hinfo);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) EXPORT_SYMBOL(seg6_hmac_info_del);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) int seg6_push_hmac(struct net *net, struct in6_addr *saddr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) struct ipv6_sr_hdr *srh)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) struct seg6_hmac_info *hinfo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) struct sr6_tlv_hmac *tlv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) int err = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) tlv = seg6_get_tlv_hmac(srh);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) if (!tlv)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) hinfo = seg6_hmac_info_lookup(net, be32_to_cpu(tlv->hmackeyid));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) if (!hinfo)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) memset(tlv->hmac, 0, SEG6_HMAC_FIELD_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) err = seg6_hmac_compute(hinfo, srh, saddr, tlv->hmac);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) EXPORT_SYMBOL(seg6_push_hmac);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) static int seg6_hmac_init_algo(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) struct seg6_hmac_algo *algo;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) struct crypto_shash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) struct shash_desc *shash;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) int i, alg_count, cpu;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) alg_count = ARRAY_SIZE(hmac_algos);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) for (i = 0; i < alg_count; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) struct crypto_shash **p_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) int shsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) algo = &hmac_algos[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) algo->tfms = alloc_percpu(struct crypto_shash *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) if (!algo->tfms)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) for_each_possible_cpu(cpu) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) tfm = crypto_alloc_shash(algo->name, 0, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) if (IS_ERR(tfm))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) return PTR_ERR(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) p_tfm = per_cpu_ptr(algo->tfms, cpu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) *p_tfm = tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) p_tfm = raw_cpu_ptr(algo->tfms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) tfm = *p_tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) shsize = sizeof(*shash) + crypto_shash_descsize(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) algo->shashs = alloc_percpu(struct shash_desc *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) if (!algo->shashs)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) for_each_possible_cpu(cpu) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) shash = kzalloc_node(shsize, GFP_KERNEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) cpu_to_node(cpu));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) if (!shash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) *per_cpu_ptr(algo->shashs, cpu) = shash;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) int __init seg6_hmac_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) return seg6_hmac_init_algo();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) EXPORT_SYMBOL(seg6_hmac_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) int __net_init seg6_hmac_net_init(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) struct seg6_pernet_data *sdata = seg6_pernet(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) rhashtable_init(&sdata->hmac_infos, &rht_params);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) EXPORT_SYMBOL(seg6_hmac_net_init);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) void seg6_hmac_exit(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) struct seg6_hmac_algo *algo = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) int i, alg_count, cpu;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) alg_count = ARRAY_SIZE(hmac_algos);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) for (i = 0; i < alg_count; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) algo = &hmac_algos[i];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) for_each_possible_cpu(cpu) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) struct crypto_shash *tfm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) struct shash_desc *shash;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) shash = *per_cpu_ptr(algo->shashs, cpu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) kfree(shash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) tfm = *per_cpu_ptr(algo->tfms, cpu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) crypto_free_shash(tfm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) free_percpu(algo->tfms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) free_percpu(algo->shashs);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) EXPORT_SYMBOL(seg6_hmac_exit);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) void __net_exit seg6_hmac_net_exit(struct net *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) struct seg6_pernet_data *sdata = seg6_pernet(net);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) rhashtable_free_and_destroy(&sdata->hmac_infos, seg6_free_hi, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) EXPORT_SYMBOL(seg6_hmac_net_exit);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags