Loading...
1// SPDX-License-Identifier: GPL-2.0-only
2#include <linux/kernel.h>
3#include <linux/skbuff.h>
4#include <linux/export.h>
5#include <linux/ip.h>
6#include <linux/ipv6.h>
7#include <linux/if_vlan.h>
8#include <net/dsa.h>
9#include <net/dst_metadata.h>
10#include <net/ip.h>
11#include <net/ipv6.h>
12#include <net/gre.h>
13#include <net/pptp.h>
14#include <net/tipc.h>
15#include <linux/igmp.h>
16#include <linux/icmp.h>
17#include <linux/sctp.h>
18#include <linux/dccp.h>
19#include <linux/if_tunnel.h>
20#include <linux/if_pppox.h>
21#include <linux/ppp_defs.h>
22#include <linux/stddef.h>
23#include <linux/if_ether.h>
24#include <linux/mpls.h>
25#include <linux/tcp.h>
26#include <linux/ptp_classify.h>
27#include <net/flow_dissector.h>
28#include <scsi/fc/fc_fcoe.h>
29#include <uapi/linux/batadv_packet.h>
30#include <linux/bpf.h>
31#if IS_ENABLED(CONFIG_NF_CONNTRACK)
32#include <net/netfilter/nf_conntrack_core.h>
33#include <net/netfilter/nf_conntrack_labels.h>
34#endif
35#include <linux/bpf-netns.h>
36
37static void dissector_set_key(struct flow_dissector *flow_dissector,
38 enum flow_dissector_key_id key_id)
39{
40 flow_dissector->used_keys |= (1 << key_id);
41}
42
43void skb_flow_dissector_init(struct flow_dissector *flow_dissector,
44 const struct flow_dissector_key *key,
45 unsigned int key_count)
46{
47 unsigned int i;
48
49 memset(flow_dissector, 0, sizeof(*flow_dissector));
50
51 for (i = 0; i < key_count; i++, key++) {
52 /* User should make sure that every key target offset is within
53 * boundaries of unsigned short.
54 */
55 BUG_ON(key->offset > USHRT_MAX);
56 BUG_ON(dissector_uses_key(flow_dissector,
57 key->key_id));
58
59 dissector_set_key(flow_dissector, key->key_id);
60 flow_dissector->offset[key->key_id] = key->offset;
61 }
62
63 /* Ensure that the dissector always includes control and basic key.
64 * That way we are able to avoid handling lack of these in fast path.
65 */
66 BUG_ON(!dissector_uses_key(flow_dissector,
67 FLOW_DISSECTOR_KEY_CONTROL));
68 BUG_ON(!dissector_uses_key(flow_dissector,
69 FLOW_DISSECTOR_KEY_BASIC));
70}
71EXPORT_SYMBOL(skb_flow_dissector_init);
72
73#ifdef CONFIG_BPF_SYSCALL
74int flow_dissector_bpf_prog_attach_check(struct net *net,
75 struct bpf_prog *prog)
76{
77 enum netns_bpf_attach_type type = NETNS_BPF_FLOW_DISSECTOR;
78
79 if (net == &init_net) {
80 /* BPF flow dissector in the root namespace overrides
81 * any per-net-namespace one. When attaching to root,
82 * make sure we don't have any BPF program attached
83 * to the non-root namespaces.
84 */
85 struct net *ns;
86
87 for_each_net(ns) {
88 if (ns == &init_net)
89 continue;
90 if (rcu_access_pointer(ns->bpf.run_array[type]))
91 return -EEXIST;
92 }
93 } else {
94 /* Make sure root flow dissector is not attached
95 * when attaching to the non-root namespace.
96 */
97 if (rcu_access_pointer(init_net.bpf.run_array[type]))
98 return -EEXIST;
99 }
100
101 return 0;
102}
103#endif /* CONFIG_BPF_SYSCALL */
104
105/**
106 * __skb_flow_get_ports - extract the upper layer ports and return them
107 * @skb: sk_buff to extract the ports from
108 * @thoff: transport header offset
109 * @ip_proto: protocol for which to get port offset
110 * @data: raw buffer pointer to the packet, if NULL use skb->data
111 * @hlen: packet header length, if @data is NULL use skb_headlen(skb)
112 *
113 * The function will try to retrieve the ports at offset thoff + poff where poff
114 * is the protocol port offset returned from proto_ports_offset
115 */
116__be32 __skb_flow_get_ports(const struct sk_buff *skb, int thoff, u8 ip_proto,
117 const void *data, int hlen)
118{
119 int poff = proto_ports_offset(ip_proto);
120
121 if (!data) {
122 data = skb->data;
123 hlen = skb_headlen(skb);
124 }
125
126 if (poff >= 0) {
127 __be32 *ports, _ports;
128
129 ports = __skb_header_pointer(skb, thoff + poff,
130 sizeof(_ports), data, hlen, &_ports);
131 if (ports)
132 return *ports;
133 }
134
135 return 0;
136}
137EXPORT_SYMBOL(__skb_flow_get_ports);
138
139static bool icmp_has_id(u8 type)
140{
141 switch (type) {
142 case ICMP_ECHO:
143 case ICMP_ECHOREPLY:
144 case ICMP_TIMESTAMP:
145 case ICMP_TIMESTAMPREPLY:
146 case ICMPV6_ECHO_REQUEST:
147 case ICMPV6_ECHO_REPLY:
148 return true;
149 }
150
151 return false;
152}
153
154/**
155 * skb_flow_get_icmp_tci - extract ICMP(6) Type, Code and Identifier fields
156 * @skb: sk_buff to extract from
157 * @key_icmp: struct flow_dissector_key_icmp to fill
158 * @data: raw buffer pointer to the packet
159 * @thoff: offset to extract at
160 * @hlen: packet header length
161 */
162void skb_flow_get_icmp_tci(const struct sk_buff *skb,
163 struct flow_dissector_key_icmp *key_icmp,
164 const void *data, int thoff, int hlen)
165{
166 struct icmphdr *ih, _ih;
167
168 ih = __skb_header_pointer(skb, thoff, sizeof(_ih), data, hlen, &_ih);
169 if (!ih)
170 return;
171
172 key_icmp->type = ih->type;
173 key_icmp->code = ih->code;
174
175 /* As we use 0 to signal that the Id field is not present,
176 * avoid confusion with packets without such field
177 */
178 if (icmp_has_id(ih->type))
179 key_icmp->id = ih->un.echo.id ? ntohs(ih->un.echo.id) : 1;
180 else
181 key_icmp->id = 0;
182}
183EXPORT_SYMBOL(skb_flow_get_icmp_tci);
184
185/* If FLOW_DISSECTOR_KEY_ICMP is set, dissect an ICMP packet
186 * using skb_flow_get_icmp_tci().
187 */
188static void __skb_flow_dissect_icmp(const struct sk_buff *skb,
189 struct flow_dissector *flow_dissector,
190 void *target_container, const void *data,
191 int thoff, int hlen)
192{
193 struct flow_dissector_key_icmp *key_icmp;
194
195 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ICMP))
196 return;
197
198 key_icmp = skb_flow_dissector_target(flow_dissector,
199 FLOW_DISSECTOR_KEY_ICMP,
200 target_container);
201
202 skb_flow_get_icmp_tci(skb, key_icmp, data, thoff, hlen);
203}
204
205void skb_flow_dissect_meta(const struct sk_buff *skb,
206 struct flow_dissector *flow_dissector,
207 void *target_container)
208{
209 struct flow_dissector_key_meta *meta;
210
211 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_META))
212 return;
213
214 meta = skb_flow_dissector_target(flow_dissector,
215 FLOW_DISSECTOR_KEY_META,
216 target_container);
217 meta->ingress_ifindex = skb->skb_iif;
218}
219EXPORT_SYMBOL(skb_flow_dissect_meta);
220
221static void
222skb_flow_dissect_set_enc_addr_type(enum flow_dissector_key_id type,
223 struct flow_dissector *flow_dissector,
224 void *target_container)
225{
226 struct flow_dissector_key_control *ctrl;
227
228 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_CONTROL))
229 return;
230
231 ctrl = skb_flow_dissector_target(flow_dissector,
232 FLOW_DISSECTOR_KEY_ENC_CONTROL,
233 target_container);
234 ctrl->addr_type = type;
235}
236
237void
238skb_flow_dissect_ct(const struct sk_buff *skb,
239 struct flow_dissector *flow_dissector,
240 void *target_container, u16 *ctinfo_map,
241 size_t mapsize, bool post_ct)
242{
243#if IS_ENABLED(CONFIG_NF_CONNTRACK)
244 struct flow_dissector_key_ct *key;
245 enum ip_conntrack_info ctinfo;
246 struct nf_conn_labels *cl;
247 struct nf_conn *ct;
248
249 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_CT))
250 return;
251
252 ct = nf_ct_get(skb, &ctinfo);
253 if (!ct && !post_ct)
254 return;
255
256 key = skb_flow_dissector_target(flow_dissector,
257 FLOW_DISSECTOR_KEY_CT,
258 target_container);
259
260 if (!ct) {
261 key->ct_state = TCA_FLOWER_KEY_CT_FLAGS_TRACKED |
262 TCA_FLOWER_KEY_CT_FLAGS_INVALID;
263 return;
264 }
265
266 if (ctinfo < mapsize)
267 key->ct_state = ctinfo_map[ctinfo];
268#if IS_ENABLED(CONFIG_NF_CONNTRACK_ZONES)
269 key->ct_zone = ct->zone.id;
270#endif
271#if IS_ENABLED(CONFIG_NF_CONNTRACK_MARK)
272 key->ct_mark = ct->mark;
273#endif
274
275 cl = nf_ct_labels_find(ct);
276 if (cl)
277 memcpy(key->ct_labels, cl->bits, sizeof(key->ct_labels));
278#endif /* CONFIG_NF_CONNTRACK */
279}
280EXPORT_SYMBOL(skb_flow_dissect_ct);
281
282void
283skb_flow_dissect_tunnel_info(const struct sk_buff *skb,
284 struct flow_dissector *flow_dissector,
285 void *target_container)
286{
287 struct ip_tunnel_info *info;
288 struct ip_tunnel_key *key;
289
290 /* A quick check to see if there might be something to do. */
291 if (!dissector_uses_key(flow_dissector,
292 FLOW_DISSECTOR_KEY_ENC_KEYID) &&
293 !dissector_uses_key(flow_dissector,
294 FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) &&
295 !dissector_uses_key(flow_dissector,
296 FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) &&
297 !dissector_uses_key(flow_dissector,
298 FLOW_DISSECTOR_KEY_ENC_CONTROL) &&
299 !dissector_uses_key(flow_dissector,
300 FLOW_DISSECTOR_KEY_ENC_PORTS) &&
301 !dissector_uses_key(flow_dissector,
302 FLOW_DISSECTOR_KEY_ENC_IP) &&
303 !dissector_uses_key(flow_dissector,
304 FLOW_DISSECTOR_KEY_ENC_OPTS))
305 return;
306
307 info = skb_tunnel_info(skb);
308 if (!info)
309 return;
310
311 key = &info->key;
312
313 switch (ip_tunnel_info_af(info)) {
314 case AF_INET:
315 skb_flow_dissect_set_enc_addr_type(FLOW_DISSECTOR_KEY_IPV4_ADDRS,
316 flow_dissector,
317 target_container);
318 if (dissector_uses_key(flow_dissector,
319 FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS)) {
320 struct flow_dissector_key_ipv4_addrs *ipv4;
321
322 ipv4 = skb_flow_dissector_target(flow_dissector,
323 FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS,
324 target_container);
325 ipv4->src = key->u.ipv4.src;
326 ipv4->dst = key->u.ipv4.dst;
327 }
328 break;
329 case AF_INET6:
330 skb_flow_dissect_set_enc_addr_type(FLOW_DISSECTOR_KEY_IPV6_ADDRS,
331 flow_dissector,
332 target_container);
333 if (dissector_uses_key(flow_dissector,
334 FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS)) {
335 struct flow_dissector_key_ipv6_addrs *ipv6;
336
337 ipv6 = skb_flow_dissector_target(flow_dissector,
338 FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS,
339 target_container);
340 ipv6->src = key->u.ipv6.src;
341 ipv6->dst = key->u.ipv6.dst;
342 }
343 break;
344 }
345
346 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_KEYID)) {
347 struct flow_dissector_key_keyid *keyid;
348
349 keyid = skb_flow_dissector_target(flow_dissector,
350 FLOW_DISSECTOR_KEY_ENC_KEYID,
351 target_container);
352 keyid->keyid = tunnel_id_to_key32(key->tun_id);
353 }
354
355 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_PORTS)) {
356 struct flow_dissector_key_ports *tp;
357
358 tp = skb_flow_dissector_target(flow_dissector,
359 FLOW_DISSECTOR_KEY_ENC_PORTS,
360 target_container);
361 tp->src = key->tp_src;
362 tp->dst = key->tp_dst;
363 }
364
365 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_IP)) {
366 struct flow_dissector_key_ip *ip;
367
368 ip = skb_flow_dissector_target(flow_dissector,
369 FLOW_DISSECTOR_KEY_ENC_IP,
370 target_container);
371 ip->tos = key->tos;
372 ip->ttl = key->ttl;
373 }
374
375 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_OPTS)) {
376 struct flow_dissector_key_enc_opts *enc_opt;
377
378 enc_opt = skb_flow_dissector_target(flow_dissector,
379 FLOW_DISSECTOR_KEY_ENC_OPTS,
380 target_container);
381
382 if (info->options_len) {
383 enc_opt->len = info->options_len;
384 ip_tunnel_info_opts_get(enc_opt->data, info);
385 enc_opt->dst_opt_type = info->key.tun_flags &
386 TUNNEL_OPTIONS_PRESENT;
387 }
388 }
389}
390EXPORT_SYMBOL(skb_flow_dissect_tunnel_info);
391
392void skb_flow_dissect_hash(const struct sk_buff *skb,
393 struct flow_dissector *flow_dissector,
394 void *target_container)
395{
396 struct flow_dissector_key_hash *key;
397
398 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_HASH))
399 return;
400
401 key = skb_flow_dissector_target(flow_dissector,
402 FLOW_DISSECTOR_KEY_HASH,
403 target_container);
404
405 key->hash = skb_get_hash_raw(skb);
406}
407EXPORT_SYMBOL(skb_flow_dissect_hash);
408
409static enum flow_dissect_ret
410__skb_flow_dissect_mpls(const struct sk_buff *skb,
411 struct flow_dissector *flow_dissector,
412 void *target_container, const void *data, int nhoff,
413 int hlen, int lse_index, bool *entropy_label)
414{
415 struct mpls_label *hdr, _hdr;
416 u32 entry, label, bos;
417
418 if (!dissector_uses_key(flow_dissector,
419 FLOW_DISSECTOR_KEY_MPLS_ENTROPY) &&
420 !dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_MPLS))
421 return FLOW_DISSECT_RET_OUT_GOOD;
422
423 if (lse_index >= FLOW_DIS_MPLS_MAX)
424 return FLOW_DISSECT_RET_OUT_GOOD;
425
426 hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data,
427 hlen, &_hdr);
428 if (!hdr)
429 return FLOW_DISSECT_RET_OUT_BAD;
430
431 entry = ntohl(hdr->entry);
432 label = (entry & MPLS_LS_LABEL_MASK) >> MPLS_LS_LABEL_SHIFT;
433 bos = (entry & MPLS_LS_S_MASK) >> MPLS_LS_S_SHIFT;
434
435 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_MPLS)) {
436 struct flow_dissector_key_mpls *key_mpls;
437 struct flow_dissector_mpls_lse *lse;
438
439 key_mpls = skb_flow_dissector_target(flow_dissector,
440 FLOW_DISSECTOR_KEY_MPLS,
441 target_container);
442 lse = &key_mpls->ls[lse_index];
443
444 lse->mpls_ttl = (entry & MPLS_LS_TTL_MASK) >> MPLS_LS_TTL_SHIFT;
445 lse->mpls_bos = bos;
446 lse->mpls_tc = (entry & MPLS_LS_TC_MASK) >> MPLS_LS_TC_SHIFT;
447 lse->mpls_label = label;
448 dissector_set_mpls_lse(key_mpls, lse_index);
449 }
450
451 if (*entropy_label &&
452 dissector_uses_key(flow_dissector,
453 FLOW_DISSECTOR_KEY_MPLS_ENTROPY)) {
454 struct flow_dissector_key_keyid *key_keyid;
455
456 key_keyid = skb_flow_dissector_target(flow_dissector,
457 FLOW_DISSECTOR_KEY_MPLS_ENTROPY,
458 target_container);
459 key_keyid->keyid = cpu_to_be32(label);
460 }
461
462 *entropy_label = label == MPLS_LABEL_ENTROPY;
463
464 return bos ? FLOW_DISSECT_RET_OUT_GOOD : FLOW_DISSECT_RET_PROTO_AGAIN;
465}
466
467static enum flow_dissect_ret
468__skb_flow_dissect_arp(const struct sk_buff *skb,
469 struct flow_dissector *flow_dissector,
470 void *target_container, const void *data,
471 int nhoff, int hlen)
472{
473 struct flow_dissector_key_arp *key_arp;
474 struct {
475 unsigned char ar_sha[ETH_ALEN];
476 unsigned char ar_sip[4];
477 unsigned char ar_tha[ETH_ALEN];
478 unsigned char ar_tip[4];
479 } *arp_eth, _arp_eth;
480 const struct arphdr *arp;
481 struct arphdr _arp;
482
483 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ARP))
484 return FLOW_DISSECT_RET_OUT_GOOD;
485
486 arp = __skb_header_pointer(skb, nhoff, sizeof(_arp), data,
487 hlen, &_arp);
488 if (!arp)
489 return FLOW_DISSECT_RET_OUT_BAD;
490
491 if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
492 arp->ar_pro != htons(ETH_P_IP) ||
493 arp->ar_hln != ETH_ALEN ||
494 arp->ar_pln != 4 ||
495 (arp->ar_op != htons(ARPOP_REPLY) &&
496 arp->ar_op != htons(ARPOP_REQUEST)))
497 return FLOW_DISSECT_RET_OUT_BAD;
498
499 arp_eth = __skb_header_pointer(skb, nhoff + sizeof(_arp),
500 sizeof(_arp_eth), data,
501 hlen, &_arp_eth);
502 if (!arp_eth)
503 return FLOW_DISSECT_RET_OUT_BAD;
504
505 key_arp = skb_flow_dissector_target(flow_dissector,
506 FLOW_DISSECTOR_KEY_ARP,
507 target_container);
508
509 memcpy(&key_arp->sip, arp_eth->ar_sip, sizeof(key_arp->sip));
510 memcpy(&key_arp->tip, arp_eth->ar_tip, sizeof(key_arp->tip));
511
512 /* Only store the lower byte of the opcode;
513 * this covers ARPOP_REPLY and ARPOP_REQUEST.
514 */
515 key_arp->op = ntohs(arp->ar_op) & 0xff;
516
517 ether_addr_copy(key_arp->sha, arp_eth->ar_sha);
518 ether_addr_copy(key_arp->tha, arp_eth->ar_tha);
519
520 return FLOW_DISSECT_RET_OUT_GOOD;
521}
522
523static enum flow_dissect_ret
524__skb_flow_dissect_gre(const struct sk_buff *skb,
525 struct flow_dissector_key_control *key_control,
526 struct flow_dissector *flow_dissector,
527 void *target_container, const void *data,
528 __be16 *p_proto, int *p_nhoff, int *p_hlen,
529 unsigned int flags)
530{
531 struct flow_dissector_key_keyid *key_keyid;
532 struct gre_base_hdr *hdr, _hdr;
533 int offset = 0;
534 u16 gre_ver;
535
536 hdr = __skb_header_pointer(skb, *p_nhoff, sizeof(_hdr),
537 data, *p_hlen, &_hdr);
538 if (!hdr)
539 return FLOW_DISSECT_RET_OUT_BAD;
540
541 /* Only look inside GRE without routing */
542 if (hdr->flags & GRE_ROUTING)
543 return FLOW_DISSECT_RET_OUT_GOOD;
544
545 /* Only look inside GRE for version 0 and 1 */
546 gre_ver = ntohs(hdr->flags & GRE_VERSION);
547 if (gre_ver > 1)
548 return FLOW_DISSECT_RET_OUT_GOOD;
549
550 *p_proto = hdr->protocol;
551 if (gre_ver) {
552 /* Version1 must be PPTP, and check the flags */
553 if (!(*p_proto == GRE_PROTO_PPP && (hdr->flags & GRE_KEY)))
554 return FLOW_DISSECT_RET_OUT_GOOD;
555 }
556
557 offset += sizeof(struct gre_base_hdr);
558
559 if (hdr->flags & GRE_CSUM)
560 offset += sizeof_field(struct gre_full_hdr, csum) +
561 sizeof_field(struct gre_full_hdr, reserved1);
562
563 if (hdr->flags & GRE_KEY) {
564 const __be32 *keyid;
565 __be32 _keyid;
566
567 keyid = __skb_header_pointer(skb, *p_nhoff + offset,
568 sizeof(_keyid),
569 data, *p_hlen, &_keyid);
570 if (!keyid)
571 return FLOW_DISSECT_RET_OUT_BAD;
572
573 if (dissector_uses_key(flow_dissector,
574 FLOW_DISSECTOR_KEY_GRE_KEYID)) {
575 key_keyid = skb_flow_dissector_target(flow_dissector,
576 FLOW_DISSECTOR_KEY_GRE_KEYID,
577 target_container);
578 if (gre_ver == 0)
579 key_keyid->keyid = *keyid;
580 else
581 key_keyid->keyid = *keyid & GRE_PPTP_KEY_MASK;
582 }
583 offset += sizeof_field(struct gre_full_hdr, key);
584 }
585
586 if (hdr->flags & GRE_SEQ)
587 offset += sizeof_field(struct pptp_gre_header, seq);
588
589 if (gre_ver == 0) {
590 if (*p_proto == htons(ETH_P_TEB)) {
591 const struct ethhdr *eth;
592 struct ethhdr _eth;
593
594 eth = __skb_header_pointer(skb, *p_nhoff + offset,
595 sizeof(_eth),
596 data, *p_hlen, &_eth);
597 if (!eth)
598 return FLOW_DISSECT_RET_OUT_BAD;
599 *p_proto = eth->h_proto;
600 offset += sizeof(*eth);
601
602 /* Cap headers that we access via pointers at the
603 * end of the Ethernet header as our maximum alignment
604 * at that point is only 2 bytes.
605 */
606 if (NET_IP_ALIGN)
607 *p_hlen = *p_nhoff + offset;
608 }
609 } else { /* version 1, must be PPTP */
610 u8 _ppp_hdr[PPP_HDRLEN];
611 u8 *ppp_hdr;
612
613 if (hdr->flags & GRE_ACK)
614 offset += sizeof_field(struct pptp_gre_header, ack);
615
616 ppp_hdr = __skb_header_pointer(skb, *p_nhoff + offset,
617 sizeof(_ppp_hdr),
618 data, *p_hlen, _ppp_hdr);
619 if (!ppp_hdr)
620 return FLOW_DISSECT_RET_OUT_BAD;
621
622 switch (PPP_PROTOCOL(ppp_hdr)) {
623 case PPP_IP:
624 *p_proto = htons(ETH_P_IP);
625 break;
626 case PPP_IPV6:
627 *p_proto = htons(ETH_P_IPV6);
628 break;
629 default:
630 /* Could probably catch some more like MPLS */
631 break;
632 }
633
634 offset += PPP_HDRLEN;
635 }
636
637 *p_nhoff += offset;
638 key_control->flags |= FLOW_DIS_ENCAPSULATION;
639 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
640 return FLOW_DISSECT_RET_OUT_GOOD;
641
642 return FLOW_DISSECT_RET_PROTO_AGAIN;
643}
644
645/**
646 * __skb_flow_dissect_batadv() - dissect batman-adv header
647 * @skb: sk_buff to with the batman-adv header
648 * @key_control: flow dissectors control key
649 * @data: raw buffer pointer to the packet, if NULL use skb->data
650 * @p_proto: pointer used to update the protocol to process next
651 * @p_nhoff: pointer used to update inner network header offset
652 * @hlen: packet header length
653 * @flags: any combination of FLOW_DISSECTOR_F_*
654 *
655 * ETH_P_BATMAN packets are tried to be dissected. Only
656 * &struct batadv_unicast packets are actually processed because they contain an
657 * inner ethernet header and are usually followed by actual network header. This
658 * allows the flow dissector to continue processing the packet.
659 *
660 * Return: FLOW_DISSECT_RET_PROTO_AGAIN when &struct batadv_unicast was found,
661 * FLOW_DISSECT_RET_OUT_GOOD when dissector should stop after encapsulation,
662 * otherwise FLOW_DISSECT_RET_OUT_BAD
663 */
664static enum flow_dissect_ret
665__skb_flow_dissect_batadv(const struct sk_buff *skb,
666 struct flow_dissector_key_control *key_control,
667 const void *data, __be16 *p_proto, int *p_nhoff,
668 int hlen, unsigned int flags)
669{
670 struct {
671 struct batadv_unicast_packet batadv_unicast;
672 struct ethhdr eth;
673 } *hdr, _hdr;
674
675 hdr = __skb_header_pointer(skb, *p_nhoff, sizeof(_hdr), data, hlen,
676 &_hdr);
677 if (!hdr)
678 return FLOW_DISSECT_RET_OUT_BAD;
679
680 if (hdr->batadv_unicast.version != BATADV_COMPAT_VERSION)
681 return FLOW_DISSECT_RET_OUT_BAD;
682
683 if (hdr->batadv_unicast.packet_type != BATADV_UNICAST)
684 return FLOW_DISSECT_RET_OUT_BAD;
685
686 *p_proto = hdr->eth.h_proto;
687 *p_nhoff += sizeof(*hdr);
688
689 key_control->flags |= FLOW_DIS_ENCAPSULATION;
690 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
691 return FLOW_DISSECT_RET_OUT_GOOD;
692
693 return FLOW_DISSECT_RET_PROTO_AGAIN;
694}
695
696static void
697__skb_flow_dissect_tcp(const struct sk_buff *skb,
698 struct flow_dissector *flow_dissector,
699 void *target_container, const void *data,
700 int thoff, int hlen)
701{
702 struct flow_dissector_key_tcp *key_tcp;
703 struct tcphdr *th, _th;
704
705 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_TCP))
706 return;
707
708 th = __skb_header_pointer(skb, thoff, sizeof(_th), data, hlen, &_th);
709 if (!th)
710 return;
711
712 if (unlikely(__tcp_hdrlen(th) < sizeof(_th)))
713 return;
714
715 key_tcp = skb_flow_dissector_target(flow_dissector,
716 FLOW_DISSECTOR_KEY_TCP,
717 target_container);
718 key_tcp->flags = (*(__be16 *) &tcp_flag_word(th) & htons(0x0FFF));
719}
720
721static void
722__skb_flow_dissect_ports(const struct sk_buff *skb,
723 struct flow_dissector *flow_dissector,
724 void *target_container, const void *data,
725 int nhoff, u8 ip_proto, int hlen)
726{
727 enum flow_dissector_key_id dissector_ports = FLOW_DISSECTOR_KEY_MAX;
728 struct flow_dissector_key_ports *key_ports;
729
730 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS))
731 dissector_ports = FLOW_DISSECTOR_KEY_PORTS;
732 else if (dissector_uses_key(flow_dissector,
733 FLOW_DISSECTOR_KEY_PORTS_RANGE))
734 dissector_ports = FLOW_DISSECTOR_KEY_PORTS_RANGE;
735
736 if (dissector_ports == FLOW_DISSECTOR_KEY_MAX)
737 return;
738
739 key_ports = skb_flow_dissector_target(flow_dissector,
740 dissector_ports,
741 target_container);
742 key_ports->ports = __skb_flow_get_ports(skb, nhoff, ip_proto,
743 data, hlen);
744}
745
746static void
747__skb_flow_dissect_ipv4(const struct sk_buff *skb,
748 struct flow_dissector *flow_dissector,
749 void *target_container, const void *data,
750 const struct iphdr *iph)
751{
752 struct flow_dissector_key_ip *key_ip;
753
754 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_IP))
755 return;
756
757 key_ip = skb_flow_dissector_target(flow_dissector,
758 FLOW_DISSECTOR_KEY_IP,
759 target_container);
760 key_ip->tos = iph->tos;
761 key_ip->ttl = iph->ttl;
762}
763
764static void
765__skb_flow_dissect_ipv6(const struct sk_buff *skb,
766 struct flow_dissector *flow_dissector,
767 void *target_container, const void *data,
768 const struct ipv6hdr *iph)
769{
770 struct flow_dissector_key_ip *key_ip;
771
772 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_IP))
773 return;
774
775 key_ip = skb_flow_dissector_target(flow_dissector,
776 FLOW_DISSECTOR_KEY_IP,
777 target_container);
778 key_ip->tos = ipv6_get_dsfield(iph);
779 key_ip->ttl = iph->hop_limit;
780}
781
782/* Maximum number of protocol headers that can be parsed in
783 * __skb_flow_dissect
784 */
785#define MAX_FLOW_DISSECT_HDRS 15
786
787static bool skb_flow_dissect_allowed(int *num_hdrs)
788{
789 ++*num_hdrs;
790
791 return (*num_hdrs <= MAX_FLOW_DISSECT_HDRS);
792}
793
794static void __skb_flow_bpf_to_target(const struct bpf_flow_keys *flow_keys,
795 struct flow_dissector *flow_dissector,
796 void *target_container)
797{
798 struct flow_dissector_key_ports *key_ports = NULL;
799 struct flow_dissector_key_control *key_control;
800 struct flow_dissector_key_basic *key_basic;
801 struct flow_dissector_key_addrs *key_addrs;
802 struct flow_dissector_key_tags *key_tags;
803
804 key_control = skb_flow_dissector_target(flow_dissector,
805 FLOW_DISSECTOR_KEY_CONTROL,
806 target_container);
807 key_control->thoff = flow_keys->thoff;
808 if (flow_keys->is_frag)
809 key_control->flags |= FLOW_DIS_IS_FRAGMENT;
810 if (flow_keys->is_first_frag)
811 key_control->flags |= FLOW_DIS_FIRST_FRAG;
812 if (flow_keys->is_encap)
813 key_control->flags |= FLOW_DIS_ENCAPSULATION;
814
815 key_basic = skb_flow_dissector_target(flow_dissector,
816 FLOW_DISSECTOR_KEY_BASIC,
817 target_container);
818 key_basic->n_proto = flow_keys->n_proto;
819 key_basic->ip_proto = flow_keys->ip_proto;
820
821 if (flow_keys->addr_proto == ETH_P_IP &&
822 dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
823 key_addrs = skb_flow_dissector_target(flow_dissector,
824 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
825 target_container);
826 key_addrs->v4addrs.src = flow_keys->ipv4_src;
827 key_addrs->v4addrs.dst = flow_keys->ipv4_dst;
828 key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
829 } else if (flow_keys->addr_proto == ETH_P_IPV6 &&
830 dissector_uses_key(flow_dissector,
831 FLOW_DISSECTOR_KEY_IPV6_ADDRS)) {
832 key_addrs = skb_flow_dissector_target(flow_dissector,
833 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
834 target_container);
835 memcpy(&key_addrs->v6addrs.src, &flow_keys->ipv6_src,
836 sizeof(key_addrs->v6addrs.src));
837 memcpy(&key_addrs->v6addrs.dst, &flow_keys->ipv6_dst,
838 sizeof(key_addrs->v6addrs.dst));
839 key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
840 }
841
842 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_PORTS))
843 key_ports = skb_flow_dissector_target(flow_dissector,
844 FLOW_DISSECTOR_KEY_PORTS,
845 target_container);
846 else if (dissector_uses_key(flow_dissector,
847 FLOW_DISSECTOR_KEY_PORTS_RANGE))
848 key_ports = skb_flow_dissector_target(flow_dissector,
849 FLOW_DISSECTOR_KEY_PORTS_RANGE,
850 target_container);
851
852 if (key_ports) {
853 key_ports->src = flow_keys->sport;
854 key_ports->dst = flow_keys->dport;
855 }
856
857 if (dissector_uses_key(flow_dissector,
858 FLOW_DISSECTOR_KEY_FLOW_LABEL)) {
859 key_tags = skb_flow_dissector_target(flow_dissector,
860 FLOW_DISSECTOR_KEY_FLOW_LABEL,
861 target_container);
862 key_tags->flow_label = ntohl(flow_keys->flow_label);
863 }
864}
865
866bool bpf_flow_dissect(struct bpf_prog *prog, struct bpf_flow_dissector *ctx,
867 __be16 proto, int nhoff, int hlen, unsigned int flags)
868{
869 struct bpf_flow_keys *flow_keys = ctx->flow_keys;
870 u32 result;
871
872 /* Pass parameters to the BPF program */
873 memset(flow_keys, 0, sizeof(*flow_keys));
874 flow_keys->n_proto = proto;
875 flow_keys->nhoff = nhoff;
876 flow_keys->thoff = flow_keys->nhoff;
877
878 BUILD_BUG_ON((int)BPF_FLOW_DISSECTOR_F_PARSE_1ST_FRAG !=
879 (int)FLOW_DISSECTOR_F_PARSE_1ST_FRAG);
880 BUILD_BUG_ON((int)BPF_FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL !=
881 (int)FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
882 BUILD_BUG_ON((int)BPF_FLOW_DISSECTOR_F_STOP_AT_ENCAP !=
883 (int)FLOW_DISSECTOR_F_STOP_AT_ENCAP);
884 flow_keys->flags = flags;
885
886 result = bpf_prog_run_pin_on_cpu(prog, ctx);
887
888 flow_keys->nhoff = clamp_t(u16, flow_keys->nhoff, nhoff, hlen);
889 flow_keys->thoff = clamp_t(u16, flow_keys->thoff,
890 flow_keys->nhoff, hlen);
891
892 return result == BPF_OK;
893}
894
895/**
896 * __skb_flow_dissect - extract the flow_keys struct and return it
897 * @net: associated network namespace, derived from @skb if NULL
898 * @skb: sk_buff to extract the flow from, can be NULL if the rest are specified
899 * @flow_dissector: list of keys to dissect
900 * @target_container: target structure to put dissected values into
901 * @data: raw buffer pointer to the packet, if NULL use skb->data
902 * @proto: protocol for which to get the flow, if @data is NULL use skb->protocol
903 * @nhoff: network header offset, if @data is NULL use skb_network_offset(skb)
904 * @hlen: packet header length, if @data is NULL use skb_headlen(skb)
905 * @flags: flags that control the dissection process, e.g.
906 * FLOW_DISSECTOR_F_STOP_AT_ENCAP.
907 *
908 * The function will try to retrieve individual keys into target specified
909 * by flow_dissector from either the skbuff or a raw buffer specified by the
910 * rest parameters.
911 *
912 * Caller must take care of zeroing target container memory.
913 */
914bool __skb_flow_dissect(const struct net *net,
915 const struct sk_buff *skb,
916 struct flow_dissector *flow_dissector,
917 void *target_container, const void *data,
918 __be16 proto, int nhoff, int hlen, unsigned int flags)
919{
920 struct flow_dissector_key_control *key_control;
921 struct flow_dissector_key_basic *key_basic;
922 struct flow_dissector_key_addrs *key_addrs;
923 struct flow_dissector_key_tags *key_tags;
924 struct flow_dissector_key_vlan *key_vlan;
925 enum flow_dissect_ret fdret;
926 enum flow_dissector_key_id dissector_vlan = FLOW_DISSECTOR_KEY_MAX;
927 bool mpls_el = false;
928 int mpls_lse = 0;
929 int num_hdrs = 0;
930 u8 ip_proto = 0;
931 bool ret;
932
933 if (!data) {
934 data = skb->data;
935 proto = skb_vlan_tag_present(skb) ?
936 skb->vlan_proto : skb->protocol;
937 nhoff = skb_network_offset(skb);
938 hlen = skb_headlen(skb);
939#if IS_ENABLED(CONFIG_NET_DSA)
940 if (unlikely(skb->dev && netdev_uses_dsa(skb->dev) &&
941 proto == htons(ETH_P_XDSA))) {
942 const struct dsa_device_ops *ops;
943 int offset = 0;
944
945 ops = skb->dev->dsa_ptr->tag_ops;
946 /* Only DSA header taggers break flow dissection */
947 if (ops->needed_headroom) {
948 if (ops->flow_dissect)
949 ops->flow_dissect(skb, &proto, &offset);
950 else
951 dsa_tag_generic_flow_dissect(skb,
952 &proto,
953 &offset);
954 hlen -= offset;
955 nhoff += offset;
956 }
957 }
958#endif
959 }
960
961 /* It is ensured by skb_flow_dissector_init() that control key will
962 * be always present.
963 */
964 key_control = skb_flow_dissector_target(flow_dissector,
965 FLOW_DISSECTOR_KEY_CONTROL,
966 target_container);
967
968 /* It is ensured by skb_flow_dissector_init() that basic key will
969 * be always present.
970 */
971 key_basic = skb_flow_dissector_target(flow_dissector,
972 FLOW_DISSECTOR_KEY_BASIC,
973 target_container);
974
975 if (skb) {
976 if (!net) {
977 if (skb->dev)
978 net = dev_net(skb->dev);
979 else if (skb->sk)
980 net = sock_net(skb->sk);
981 }
982 }
983
984 WARN_ON_ONCE(!net);
985 if (net) {
986 enum netns_bpf_attach_type type = NETNS_BPF_FLOW_DISSECTOR;
987 struct bpf_prog_array *run_array;
988
989 rcu_read_lock();
990 run_array = rcu_dereference(init_net.bpf.run_array[type]);
991 if (!run_array)
992 run_array = rcu_dereference(net->bpf.run_array[type]);
993
994 if (run_array) {
995 struct bpf_flow_keys flow_keys;
996 struct bpf_flow_dissector ctx = {
997 .flow_keys = &flow_keys,
998 .data = data,
999 .data_end = data + hlen,
1000 };
1001 __be16 n_proto = proto;
1002 struct bpf_prog *prog;
1003
1004 if (skb) {
1005 ctx.skb = skb;
1006 /* we can't use 'proto' in the skb case
1007 * because it might be set to skb->vlan_proto
1008 * which has been pulled from the data
1009 */
1010 n_proto = skb->protocol;
1011 }
1012
1013 prog = READ_ONCE(run_array->items[0].prog);
1014 ret = bpf_flow_dissect(prog, &ctx, n_proto, nhoff,
1015 hlen, flags);
1016 __skb_flow_bpf_to_target(&flow_keys, flow_dissector,
1017 target_container);
1018 rcu_read_unlock();
1019 return ret;
1020 }
1021 rcu_read_unlock();
1022 }
1023
1024 if (dissector_uses_key(flow_dissector,
1025 FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
1026 struct ethhdr *eth = eth_hdr(skb);
1027 struct flow_dissector_key_eth_addrs *key_eth_addrs;
1028
1029 key_eth_addrs = skb_flow_dissector_target(flow_dissector,
1030 FLOW_DISSECTOR_KEY_ETH_ADDRS,
1031 target_container);
1032 memcpy(key_eth_addrs, ð->h_dest, sizeof(*key_eth_addrs));
1033 }
1034
1035proto_again:
1036 fdret = FLOW_DISSECT_RET_CONTINUE;
1037
1038 switch (proto) {
1039 case htons(ETH_P_IP): {
1040 const struct iphdr *iph;
1041 struct iphdr _iph;
1042
1043 iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph);
1044 if (!iph || iph->ihl < 5) {
1045 fdret = FLOW_DISSECT_RET_OUT_BAD;
1046 break;
1047 }
1048
1049 nhoff += iph->ihl * 4;
1050
1051 ip_proto = iph->protocol;
1052
1053 if (dissector_uses_key(flow_dissector,
1054 FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
1055 key_addrs = skb_flow_dissector_target(flow_dissector,
1056 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
1057 target_container);
1058
1059 memcpy(&key_addrs->v4addrs.src, &iph->saddr,
1060 sizeof(key_addrs->v4addrs.src));
1061 memcpy(&key_addrs->v4addrs.dst, &iph->daddr,
1062 sizeof(key_addrs->v4addrs.dst));
1063 key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
1064 }
1065
1066 __skb_flow_dissect_ipv4(skb, flow_dissector,
1067 target_container, data, iph);
1068
1069 if (ip_is_fragment(iph)) {
1070 key_control->flags |= FLOW_DIS_IS_FRAGMENT;
1071
1072 if (iph->frag_off & htons(IP_OFFSET)) {
1073 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1074 break;
1075 } else {
1076 key_control->flags |= FLOW_DIS_FIRST_FRAG;
1077 if (!(flags &
1078 FLOW_DISSECTOR_F_PARSE_1ST_FRAG)) {
1079 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1080 break;
1081 }
1082 }
1083 }
1084
1085 break;
1086 }
1087 case htons(ETH_P_IPV6): {
1088 const struct ipv6hdr *iph;
1089 struct ipv6hdr _iph;
1090
1091 iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph);
1092 if (!iph) {
1093 fdret = FLOW_DISSECT_RET_OUT_BAD;
1094 break;
1095 }
1096
1097 ip_proto = iph->nexthdr;
1098 nhoff += sizeof(struct ipv6hdr);
1099
1100 if (dissector_uses_key(flow_dissector,
1101 FLOW_DISSECTOR_KEY_IPV6_ADDRS)) {
1102 key_addrs = skb_flow_dissector_target(flow_dissector,
1103 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
1104 target_container);
1105
1106 memcpy(&key_addrs->v6addrs.src, &iph->saddr,
1107 sizeof(key_addrs->v6addrs.src));
1108 memcpy(&key_addrs->v6addrs.dst, &iph->daddr,
1109 sizeof(key_addrs->v6addrs.dst));
1110 key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
1111 }
1112
1113 if ((dissector_uses_key(flow_dissector,
1114 FLOW_DISSECTOR_KEY_FLOW_LABEL) ||
1115 (flags & FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL)) &&
1116 ip6_flowlabel(iph)) {
1117 __be32 flow_label = ip6_flowlabel(iph);
1118
1119 if (dissector_uses_key(flow_dissector,
1120 FLOW_DISSECTOR_KEY_FLOW_LABEL)) {
1121 key_tags = skb_flow_dissector_target(flow_dissector,
1122 FLOW_DISSECTOR_KEY_FLOW_LABEL,
1123 target_container);
1124 key_tags->flow_label = ntohl(flow_label);
1125 }
1126 if (flags & FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL) {
1127 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1128 break;
1129 }
1130 }
1131
1132 __skb_flow_dissect_ipv6(skb, flow_dissector,
1133 target_container, data, iph);
1134
1135 break;
1136 }
1137 case htons(ETH_P_8021AD):
1138 case htons(ETH_P_8021Q): {
1139 const struct vlan_hdr *vlan = NULL;
1140 struct vlan_hdr _vlan;
1141 __be16 saved_vlan_tpid = proto;
1142
1143 if (dissector_vlan == FLOW_DISSECTOR_KEY_MAX &&
1144 skb && skb_vlan_tag_present(skb)) {
1145 proto = skb->protocol;
1146 } else {
1147 vlan = __skb_header_pointer(skb, nhoff, sizeof(_vlan),
1148 data, hlen, &_vlan);
1149 if (!vlan) {
1150 fdret = FLOW_DISSECT_RET_OUT_BAD;
1151 break;
1152 }
1153
1154 proto = vlan->h_vlan_encapsulated_proto;
1155 nhoff += sizeof(*vlan);
1156 }
1157
1158 if (dissector_vlan == FLOW_DISSECTOR_KEY_MAX) {
1159 dissector_vlan = FLOW_DISSECTOR_KEY_VLAN;
1160 } else if (dissector_vlan == FLOW_DISSECTOR_KEY_VLAN) {
1161 dissector_vlan = FLOW_DISSECTOR_KEY_CVLAN;
1162 } else {
1163 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
1164 break;
1165 }
1166
1167 if (dissector_uses_key(flow_dissector, dissector_vlan)) {
1168 key_vlan = skb_flow_dissector_target(flow_dissector,
1169 dissector_vlan,
1170 target_container);
1171
1172 if (!vlan) {
1173 key_vlan->vlan_id = skb_vlan_tag_get_id(skb);
1174 key_vlan->vlan_priority = skb_vlan_tag_get_prio(skb);
1175 } else {
1176 key_vlan->vlan_id = ntohs(vlan->h_vlan_TCI) &
1177 VLAN_VID_MASK;
1178 key_vlan->vlan_priority =
1179 (ntohs(vlan->h_vlan_TCI) &
1180 VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
1181 }
1182 key_vlan->vlan_tpid = saved_vlan_tpid;
1183 }
1184
1185 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
1186 break;
1187 }
1188 case htons(ETH_P_PPP_SES): {
1189 struct {
1190 struct pppoe_hdr hdr;
1191 __be16 proto;
1192 } *hdr, _hdr;
1193 hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data, hlen, &_hdr);
1194 if (!hdr) {
1195 fdret = FLOW_DISSECT_RET_OUT_BAD;
1196 break;
1197 }
1198
1199 proto = hdr->proto;
1200 nhoff += PPPOE_SES_HLEN;
1201 switch (proto) {
1202 case htons(PPP_IP):
1203 proto = htons(ETH_P_IP);
1204 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
1205 break;
1206 case htons(PPP_IPV6):
1207 proto = htons(ETH_P_IPV6);
1208 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
1209 break;
1210 default:
1211 fdret = FLOW_DISSECT_RET_OUT_BAD;
1212 break;
1213 }
1214 break;
1215 }
1216 case htons(ETH_P_TIPC): {
1217 struct tipc_basic_hdr *hdr, _hdr;
1218
1219 hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr),
1220 data, hlen, &_hdr);
1221 if (!hdr) {
1222 fdret = FLOW_DISSECT_RET_OUT_BAD;
1223 break;
1224 }
1225
1226 if (dissector_uses_key(flow_dissector,
1227 FLOW_DISSECTOR_KEY_TIPC)) {
1228 key_addrs = skb_flow_dissector_target(flow_dissector,
1229 FLOW_DISSECTOR_KEY_TIPC,
1230 target_container);
1231 key_addrs->tipckey.key = tipc_hdr_rps_key(hdr);
1232 key_control->addr_type = FLOW_DISSECTOR_KEY_TIPC;
1233 }
1234 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1235 break;
1236 }
1237
1238 case htons(ETH_P_MPLS_UC):
1239 case htons(ETH_P_MPLS_MC):
1240 fdret = __skb_flow_dissect_mpls(skb, flow_dissector,
1241 target_container, data,
1242 nhoff, hlen, mpls_lse,
1243 &mpls_el);
1244 nhoff += sizeof(struct mpls_label);
1245 mpls_lse++;
1246 break;
1247 case htons(ETH_P_FCOE):
1248 if ((hlen - nhoff) < FCOE_HEADER_LEN) {
1249 fdret = FLOW_DISSECT_RET_OUT_BAD;
1250 break;
1251 }
1252
1253 nhoff += FCOE_HEADER_LEN;
1254 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1255 break;
1256
1257 case htons(ETH_P_ARP):
1258 case htons(ETH_P_RARP):
1259 fdret = __skb_flow_dissect_arp(skb, flow_dissector,
1260 target_container, data,
1261 nhoff, hlen);
1262 break;
1263
1264 case htons(ETH_P_BATMAN):
1265 fdret = __skb_flow_dissect_batadv(skb, key_control, data,
1266 &proto, &nhoff, hlen, flags);
1267 break;
1268
1269 case htons(ETH_P_1588): {
1270 struct ptp_header *hdr, _hdr;
1271
1272 hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data,
1273 hlen, &_hdr);
1274 if (!hdr) {
1275 fdret = FLOW_DISSECT_RET_OUT_BAD;
1276 break;
1277 }
1278
1279 nhoff += ntohs(hdr->message_length);
1280 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1281 break;
1282 }
1283
1284 default:
1285 fdret = FLOW_DISSECT_RET_OUT_BAD;
1286 break;
1287 }
1288
1289 /* Process result of proto processing */
1290 switch (fdret) {
1291 case FLOW_DISSECT_RET_OUT_GOOD:
1292 goto out_good;
1293 case FLOW_DISSECT_RET_PROTO_AGAIN:
1294 if (skb_flow_dissect_allowed(&num_hdrs))
1295 goto proto_again;
1296 goto out_good;
1297 case FLOW_DISSECT_RET_CONTINUE:
1298 case FLOW_DISSECT_RET_IPPROTO_AGAIN:
1299 break;
1300 case FLOW_DISSECT_RET_OUT_BAD:
1301 default:
1302 goto out_bad;
1303 }
1304
1305ip_proto_again:
1306 fdret = FLOW_DISSECT_RET_CONTINUE;
1307
1308 switch (ip_proto) {
1309 case IPPROTO_GRE:
1310 fdret = __skb_flow_dissect_gre(skb, key_control, flow_dissector,
1311 target_container, data,
1312 &proto, &nhoff, &hlen, flags);
1313 break;
1314
1315 case NEXTHDR_HOP:
1316 case NEXTHDR_ROUTING:
1317 case NEXTHDR_DEST: {
1318 u8 _opthdr[2], *opthdr;
1319
1320 if (proto != htons(ETH_P_IPV6))
1321 break;
1322
1323 opthdr = __skb_header_pointer(skb, nhoff, sizeof(_opthdr),
1324 data, hlen, &_opthdr);
1325 if (!opthdr) {
1326 fdret = FLOW_DISSECT_RET_OUT_BAD;
1327 break;
1328 }
1329
1330 ip_proto = opthdr[0];
1331 nhoff += (opthdr[1] + 1) << 3;
1332
1333 fdret = FLOW_DISSECT_RET_IPPROTO_AGAIN;
1334 break;
1335 }
1336 case NEXTHDR_FRAGMENT: {
1337 struct frag_hdr _fh, *fh;
1338
1339 if (proto != htons(ETH_P_IPV6))
1340 break;
1341
1342 fh = __skb_header_pointer(skb, nhoff, sizeof(_fh),
1343 data, hlen, &_fh);
1344
1345 if (!fh) {
1346 fdret = FLOW_DISSECT_RET_OUT_BAD;
1347 break;
1348 }
1349
1350 key_control->flags |= FLOW_DIS_IS_FRAGMENT;
1351
1352 nhoff += sizeof(_fh);
1353 ip_proto = fh->nexthdr;
1354
1355 if (!(fh->frag_off & htons(IP6_OFFSET))) {
1356 key_control->flags |= FLOW_DIS_FIRST_FRAG;
1357 if (flags & FLOW_DISSECTOR_F_PARSE_1ST_FRAG) {
1358 fdret = FLOW_DISSECT_RET_IPPROTO_AGAIN;
1359 break;
1360 }
1361 }
1362
1363 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1364 break;
1365 }
1366 case IPPROTO_IPIP:
1367 proto = htons(ETH_P_IP);
1368
1369 key_control->flags |= FLOW_DIS_ENCAPSULATION;
1370 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP) {
1371 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1372 break;
1373 }
1374
1375 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
1376 break;
1377
1378 case IPPROTO_IPV6:
1379 proto = htons(ETH_P_IPV6);
1380
1381 key_control->flags |= FLOW_DIS_ENCAPSULATION;
1382 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP) {
1383 fdret = FLOW_DISSECT_RET_OUT_GOOD;
1384 break;
1385 }
1386
1387 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
1388 break;
1389
1390
1391 case IPPROTO_MPLS:
1392 proto = htons(ETH_P_MPLS_UC);
1393 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
1394 break;
1395
1396 case IPPROTO_TCP:
1397 __skb_flow_dissect_tcp(skb, flow_dissector, target_container,
1398 data, nhoff, hlen);
1399 break;
1400
1401 case IPPROTO_ICMP:
1402 case IPPROTO_ICMPV6:
1403 __skb_flow_dissect_icmp(skb, flow_dissector, target_container,
1404 data, nhoff, hlen);
1405 break;
1406
1407 default:
1408 break;
1409 }
1410
1411 if (!(key_control->flags & FLOW_DIS_IS_FRAGMENT))
1412 __skb_flow_dissect_ports(skb, flow_dissector, target_container,
1413 data, nhoff, ip_proto, hlen);
1414
1415 /* Process result of IP proto processing */
1416 switch (fdret) {
1417 case FLOW_DISSECT_RET_PROTO_AGAIN:
1418 if (skb_flow_dissect_allowed(&num_hdrs))
1419 goto proto_again;
1420 break;
1421 case FLOW_DISSECT_RET_IPPROTO_AGAIN:
1422 if (skb_flow_dissect_allowed(&num_hdrs))
1423 goto ip_proto_again;
1424 break;
1425 case FLOW_DISSECT_RET_OUT_GOOD:
1426 case FLOW_DISSECT_RET_CONTINUE:
1427 break;
1428 case FLOW_DISSECT_RET_OUT_BAD:
1429 default:
1430 goto out_bad;
1431 }
1432
1433out_good:
1434 ret = true;
1435
1436out:
1437 key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
1438 key_basic->n_proto = proto;
1439 key_basic->ip_proto = ip_proto;
1440
1441 return ret;
1442
1443out_bad:
1444 ret = false;
1445 goto out;
1446}
1447EXPORT_SYMBOL(__skb_flow_dissect);
1448
1449static siphash_key_t hashrnd __read_mostly;
1450static __always_inline void __flow_hash_secret_init(void)
1451{
1452 net_get_random_once(&hashrnd, sizeof(hashrnd));
1453}
1454
1455static const void *flow_keys_hash_start(const struct flow_keys *flow)
1456{
1457 BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % SIPHASH_ALIGNMENT);
1458 return &flow->FLOW_KEYS_HASH_START_FIELD;
1459}
1460
1461static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
1462{
1463 size_t diff = FLOW_KEYS_HASH_OFFSET + sizeof(flow->addrs);
1464
1465 BUILD_BUG_ON((sizeof(*flow) - FLOW_KEYS_HASH_OFFSET) % sizeof(u32));
1466
1467 switch (flow->control.addr_type) {
1468 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1469 diff -= sizeof(flow->addrs.v4addrs);
1470 break;
1471 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1472 diff -= sizeof(flow->addrs.v6addrs);
1473 break;
1474 case FLOW_DISSECTOR_KEY_TIPC:
1475 diff -= sizeof(flow->addrs.tipckey);
1476 break;
1477 }
1478 return sizeof(*flow) - diff;
1479}
1480
1481__be32 flow_get_u32_src(const struct flow_keys *flow)
1482{
1483 switch (flow->control.addr_type) {
1484 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1485 return flow->addrs.v4addrs.src;
1486 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1487 return (__force __be32)ipv6_addr_hash(
1488 &flow->addrs.v6addrs.src);
1489 case FLOW_DISSECTOR_KEY_TIPC:
1490 return flow->addrs.tipckey.key;
1491 default:
1492 return 0;
1493 }
1494}
1495EXPORT_SYMBOL(flow_get_u32_src);
1496
1497__be32 flow_get_u32_dst(const struct flow_keys *flow)
1498{
1499 switch (flow->control.addr_type) {
1500 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1501 return flow->addrs.v4addrs.dst;
1502 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1503 return (__force __be32)ipv6_addr_hash(
1504 &flow->addrs.v6addrs.dst);
1505 default:
1506 return 0;
1507 }
1508}
1509EXPORT_SYMBOL(flow_get_u32_dst);
1510
1511/* Sort the source and destination IP and the ports,
1512 * to have consistent hash within the two directions
1513 */
1514static inline void __flow_hash_consistentify(struct flow_keys *keys)
1515{
1516 int addr_diff, i;
1517
1518 switch (keys->control.addr_type) {
1519 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1520 addr_diff = (__force u32)keys->addrs.v4addrs.dst -
1521 (__force u32)keys->addrs.v4addrs.src;
1522 if (addr_diff < 0)
1523 swap(keys->addrs.v4addrs.src, keys->addrs.v4addrs.dst);
1524
1525 if ((__force u16)keys->ports.dst <
1526 (__force u16)keys->ports.src) {
1527 swap(keys->ports.src, keys->ports.dst);
1528 }
1529 break;
1530 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1531 addr_diff = memcmp(&keys->addrs.v6addrs.dst,
1532 &keys->addrs.v6addrs.src,
1533 sizeof(keys->addrs.v6addrs.dst));
1534 if (addr_diff < 0) {
1535 for (i = 0; i < 4; i++)
1536 swap(keys->addrs.v6addrs.src.s6_addr32[i],
1537 keys->addrs.v6addrs.dst.s6_addr32[i]);
1538 }
1539 if ((__force u16)keys->ports.dst <
1540 (__force u16)keys->ports.src) {
1541 swap(keys->ports.src, keys->ports.dst);
1542 }
1543 break;
1544 }
1545}
1546
1547static inline u32 __flow_hash_from_keys(struct flow_keys *keys,
1548 const siphash_key_t *keyval)
1549{
1550 u32 hash;
1551
1552 __flow_hash_consistentify(keys);
1553
1554 hash = siphash(flow_keys_hash_start(keys),
1555 flow_keys_hash_length(keys), keyval);
1556 if (!hash)
1557 hash = 1;
1558
1559 return hash;
1560}
1561
1562u32 flow_hash_from_keys(struct flow_keys *keys)
1563{
1564 __flow_hash_secret_init();
1565 return __flow_hash_from_keys(keys, &hashrnd);
1566}
1567EXPORT_SYMBOL(flow_hash_from_keys);
1568
1569static inline u32 ___skb_get_hash(const struct sk_buff *skb,
1570 struct flow_keys *keys,
1571 const siphash_key_t *keyval)
1572{
1573 skb_flow_dissect_flow_keys(skb, keys,
1574 FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
1575
1576 return __flow_hash_from_keys(keys, keyval);
1577}
1578
1579struct _flow_keys_digest_data {
1580 __be16 n_proto;
1581 u8 ip_proto;
1582 u8 padding;
1583 __be32 ports;
1584 __be32 src;
1585 __be32 dst;
1586};
1587
1588void make_flow_keys_digest(struct flow_keys_digest *digest,
1589 const struct flow_keys *flow)
1590{
1591 struct _flow_keys_digest_data *data =
1592 (struct _flow_keys_digest_data *)digest;
1593
1594 BUILD_BUG_ON(sizeof(*data) > sizeof(*digest));
1595
1596 memset(digest, 0, sizeof(*digest));
1597
1598 data->n_proto = flow->basic.n_proto;
1599 data->ip_proto = flow->basic.ip_proto;
1600 data->ports = flow->ports.ports;
1601 data->src = flow->addrs.v4addrs.src;
1602 data->dst = flow->addrs.v4addrs.dst;
1603}
1604EXPORT_SYMBOL(make_flow_keys_digest);
1605
1606static struct flow_dissector flow_keys_dissector_symmetric __read_mostly;
1607
1608u32 __skb_get_hash_symmetric(const struct sk_buff *skb)
1609{
1610 struct flow_keys keys;
1611
1612 __flow_hash_secret_init();
1613
1614 memset(&keys, 0, sizeof(keys));
1615 __skb_flow_dissect(NULL, skb, &flow_keys_dissector_symmetric,
1616 &keys, NULL, 0, 0, 0,
1617 FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
1618
1619 return __flow_hash_from_keys(&keys, &hashrnd);
1620}
1621EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
1622
1623/**
1624 * __skb_get_hash: calculate a flow hash
1625 * @skb: sk_buff to calculate flow hash from
1626 *
1627 * This function calculates a flow hash based on src/dst addresses
1628 * and src/dst port numbers. Sets hash in skb to non-zero hash value
1629 * on success, zero indicates no valid hash. Also, sets l4_hash in skb
1630 * if hash is a canonical 4-tuple hash over transport ports.
1631 */
1632void __skb_get_hash(struct sk_buff *skb)
1633{
1634 struct flow_keys keys;
1635 u32 hash;
1636
1637 __flow_hash_secret_init();
1638
1639 hash = ___skb_get_hash(skb, &keys, &hashrnd);
1640
1641 __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
1642}
1643EXPORT_SYMBOL(__skb_get_hash);
1644
1645__u32 skb_get_hash_perturb(const struct sk_buff *skb,
1646 const siphash_key_t *perturb)
1647{
1648 struct flow_keys keys;
1649
1650 return ___skb_get_hash(skb, &keys, perturb);
1651}
1652EXPORT_SYMBOL(skb_get_hash_perturb);
1653
1654u32 __skb_get_poff(const struct sk_buff *skb, const void *data,
1655 const struct flow_keys_basic *keys, int hlen)
1656{
1657 u32 poff = keys->control.thoff;
1658
1659 /* skip L4 headers for fragments after the first */
1660 if ((keys->control.flags & FLOW_DIS_IS_FRAGMENT) &&
1661 !(keys->control.flags & FLOW_DIS_FIRST_FRAG))
1662 return poff;
1663
1664 switch (keys->basic.ip_proto) {
1665 case IPPROTO_TCP: {
1666 /* access doff as u8 to avoid unaligned access */
1667 const u8 *doff;
1668 u8 _doff;
1669
1670 doff = __skb_header_pointer(skb, poff + 12, sizeof(_doff),
1671 data, hlen, &_doff);
1672 if (!doff)
1673 return poff;
1674
1675 poff += max_t(u32, sizeof(struct tcphdr), (*doff & 0xF0) >> 2);
1676 break;
1677 }
1678 case IPPROTO_UDP:
1679 case IPPROTO_UDPLITE:
1680 poff += sizeof(struct udphdr);
1681 break;
1682 /* For the rest, we do not really care about header
1683 * extensions at this point for now.
1684 */
1685 case IPPROTO_ICMP:
1686 poff += sizeof(struct icmphdr);
1687 break;
1688 case IPPROTO_ICMPV6:
1689 poff += sizeof(struct icmp6hdr);
1690 break;
1691 case IPPROTO_IGMP:
1692 poff += sizeof(struct igmphdr);
1693 break;
1694 case IPPROTO_DCCP:
1695 poff += sizeof(struct dccp_hdr);
1696 break;
1697 case IPPROTO_SCTP:
1698 poff += sizeof(struct sctphdr);
1699 break;
1700 }
1701
1702 return poff;
1703}
1704
1705/**
1706 * skb_get_poff - get the offset to the payload
1707 * @skb: sk_buff to get the payload offset from
1708 *
1709 * The function will get the offset to the payload as far as it could
1710 * be dissected. The main user is currently BPF, so that we can dynamically
1711 * truncate packets without needing to push actual payload to the user
1712 * space and can analyze headers only, instead.
1713 */
1714u32 skb_get_poff(const struct sk_buff *skb)
1715{
1716 struct flow_keys_basic keys;
1717
1718 if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
1719 NULL, 0, 0, 0, 0))
1720 return 0;
1721
1722 return __skb_get_poff(skb, skb->data, &keys, skb_headlen(skb));
1723}
1724
1725__u32 __get_hash_from_flowi6(const struct flowi6 *fl6, struct flow_keys *keys)
1726{
1727 memset(keys, 0, sizeof(*keys));
1728
1729 memcpy(&keys->addrs.v6addrs.src, &fl6->saddr,
1730 sizeof(keys->addrs.v6addrs.src));
1731 memcpy(&keys->addrs.v6addrs.dst, &fl6->daddr,
1732 sizeof(keys->addrs.v6addrs.dst));
1733 keys->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
1734 keys->ports.src = fl6->fl6_sport;
1735 keys->ports.dst = fl6->fl6_dport;
1736 keys->keyid.keyid = fl6->fl6_gre_key;
1737 keys->tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);
1738 keys->basic.ip_proto = fl6->flowi6_proto;
1739
1740 return flow_hash_from_keys(keys);
1741}
1742EXPORT_SYMBOL(__get_hash_from_flowi6);
1743
1744static const struct flow_dissector_key flow_keys_dissector_keys[] = {
1745 {
1746 .key_id = FLOW_DISSECTOR_KEY_CONTROL,
1747 .offset = offsetof(struct flow_keys, control),
1748 },
1749 {
1750 .key_id = FLOW_DISSECTOR_KEY_BASIC,
1751 .offset = offsetof(struct flow_keys, basic),
1752 },
1753 {
1754 .key_id = FLOW_DISSECTOR_KEY_IPV4_ADDRS,
1755 .offset = offsetof(struct flow_keys, addrs.v4addrs),
1756 },
1757 {
1758 .key_id = FLOW_DISSECTOR_KEY_IPV6_ADDRS,
1759 .offset = offsetof(struct flow_keys, addrs.v6addrs),
1760 },
1761 {
1762 .key_id = FLOW_DISSECTOR_KEY_TIPC,
1763 .offset = offsetof(struct flow_keys, addrs.tipckey),
1764 },
1765 {
1766 .key_id = FLOW_DISSECTOR_KEY_PORTS,
1767 .offset = offsetof(struct flow_keys, ports),
1768 },
1769 {
1770 .key_id = FLOW_DISSECTOR_KEY_VLAN,
1771 .offset = offsetof(struct flow_keys, vlan),
1772 },
1773 {
1774 .key_id = FLOW_DISSECTOR_KEY_FLOW_LABEL,
1775 .offset = offsetof(struct flow_keys, tags),
1776 },
1777 {
1778 .key_id = FLOW_DISSECTOR_KEY_GRE_KEYID,
1779 .offset = offsetof(struct flow_keys, keyid),
1780 },
1781};
1782
1783static const struct flow_dissector_key flow_keys_dissector_symmetric_keys[] = {
1784 {
1785 .key_id = FLOW_DISSECTOR_KEY_CONTROL,
1786 .offset = offsetof(struct flow_keys, control),
1787 },
1788 {
1789 .key_id = FLOW_DISSECTOR_KEY_BASIC,
1790 .offset = offsetof(struct flow_keys, basic),
1791 },
1792 {
1793 .key_id = FLOW_DISSECTOR_KEY_IPV4_ADDRS,
1794 .offset = offsetof(struct flow_keys, addrs.v4addrs),
1795 },
1796 {
1797 .key_id = FLOW_DISSECTOR_KEY_IPV6_ADDRS,
1798 .offset = offsetof(struct flow_keys, addrs.v6addrs),
1799 },
1800 {
1801 .key_id = FLOW_DISSECTOR_KEY_PORTS,
1802 .offset = offsetof(struct flow_keys, ports),
1803 },
1804};
1805
1806static const struct flow_dissector_key flow_keys_basic_dissector_keys[] = {
1807 {
1808 .key_id = FLOW_DISSECTOR_KEY_CONTROL,
1809 .offset = offsetof(struct flow_keys, control),
1810 },
1811 {
1812 .key_id = FLOW_DISSECTOR_KEY_BASIC,
1813 .offset = offsetof(struct flow_keys, basic),
1814 },
1815};
1816
1817struct flow_dissector flow_keys_dissector __read_mostly;
1818EXPORT_SYMBOL(flow_keys_dissector);
1819
1820struct flow_dissector flow_keys_basic_dissector __read_mostly;
1821EXPORT_SYMBOL(flow_keys_basic_dissector);
1822
1823static int __init init_default_flow_dissectors(void)
1824{
1825 skb_flow_dissector_init(&flow_keys_dissector,
1826 flow_keys_dissector_keys,
1827 ARRAY_SIZE(flow_keys_dissector_keys));
1828 skb_flow_dissector_init(&flow_keys_dissector_symmetric,
1829 flow_keys_dissector_symmetric_keys,
1830 ARRAY_SIZE(flow_keys_dissector_symmetric_keys));
1831 skb_flow_dissector_init(&flow_keys_basic_dissector,
1832 flow_keys_basic_dissector_keys,
1833 ARRAY_SIZE(flow_keys_basic_dissector_keys));
1834 return 0;
1835}
1836core_initcall(init_default_flow_dissectors);
1#include <linux/kernel.h>
2#include <linux/skbuff.h>
3#include <linux/export.h>
4#include <linux/ip.h>
5#include <linux/ipv6.h>
6#include <linux/if_vlan.h>
7#include <net/dsa.h>
8#include <net/dst_metadata.h>
9#include <net/ip.h>
10#include <net/ipv6.h>
11#include <net/gre.h>
12#include <net/pptp.h>
13#include <net/tipc.h>
14#include <linux/igmp.h>
15#include <linux/icmp.h>
16#include <linux/sctp.h>
17#include <linux/dccp.h>
18#include <linux/if_tunnel.h>
19#include <linux/if_pppox.h>
20#include <linux/ppp_defs.h>
21#include <linux/stddef.h>
22#include <linux/if_ether.h>
23#include <linux/mpls.h>
24#include <linux/tcp.h>
25#include <net/flow_dissector.h>
26#include <scsi/fc/fc_fcoe.h>
27#include <uapi/linux/batadv_packet.h>
28
29static void dissector_set_key(struct flow_dissector *flow_dissector,
30 enum flow_dissector_key_id key_id)
31{
32 flow_dissector->used_keys |= (1 << key_id);
33}
34
35void skb_flow_dissector_init(struct flow_dissector *flow_dissector,
36 const struct flow_dissector_key *key,
37 unsigned int key_count)
38{
39 unsigned int i;
40
41 memset(flow_dissector, 0, sizeof(*flow_dissector));
42
43 for (i = 0; i < key_count; i++, key++) {
44 /* User should make sure that every key target offset is withing
45 * boundaries of unsigned short.
46 */
47 BUG_ON(key->offset > USHRT_MAX);
48 BUG_ON(dissector_uses_key(flow_dissector,
49 key->key_id));
50
51 dissector_set_key(flow_dissector, key->key_id);
52 flow_dissector->offset[key->key_id] = key->offset;
53 }
54
55 /* Ensure that the dissector always includes control and basic key.
56 * That way we are able to avoid handling lack of these in fast path.
57 */
58 BUG_ON(!dissector_uses_key(flow_dissector,
59 FLOW_DISSECTOR_KEY_CONTROL));
60 BUG_ON(!dissector_uses_key(flow_dissector,
61 FLOW_DISSECTOR_KEY_BASIC));
62}
63EXPORT_SYMBOL(skb_flow_dissector_init);
64
65/**
66 * skb_flow_get_be16 - extract be16 entity
67 * @skb: sk_buff to extract from
68 * @poff: offset to extract at
69 * @data: raw buffer pointer to the packet
70 * @hlen: packet header length
71 *
72 * The function will try to retrieve a be32 entity at
73 * offset poff
74 */
75static __be16 skb_flow_get_be16(const struct sk_buff *skb, int poff,
76 void *data, int hlen)
77{
78 __be16 *u, _u;
79
80 u = __skb_header_pointer(skb, poff, sizeof(_u), data, hlen, &_u);
81 if (u)
82 return *u;
83
84 return 0;
85}
86
87/**
88 * __skb_flow_get_ports - extract the upper layer ports and return them
89 * @skb: sk_buff to extract the ports from
90 * @thoff: transport header offset
91 * @ip_proto: protocol for which to get port offset
92 * @data: raw buffer pointer to the packet, if NULL use skb->data
93 * @hlen: packet header length, if @data is NULL use skb_headlen(skb)
94 *
95 * The function will try to retrieve the ports at offset thoff + poff where poff
96 * is the protocol port offset returned from proto_ports_offset
97 */
98__be32 __skb_flow_get_ports(const struct sk_buff *skb, int thoff, u8 ip_proto,
99 void *data, int hlen)
100{
101 int poff = proto_ports_offset(ip_proto);
102
103 if (!data) {
104 data = skb->data;
105 hlen = skb_headlen(skb);
106 }
107
108 if (poff >= 0) {
109 __be32 *ports, _ports;
110
111 ports = __skb_header_pointer(skb, thoff + poff,
112 sizeof(_ports), data, hlen, &_ports);
113 if (ports)
114 return *ports;
115 }
116
117 return 0;
118}
119EXPORT_SYMBOL(__skb_flow_get_ports);
120
121static void
122skb_flow_dissect_set_enc_addr_type(enum flow_dissector_key_id type,
123 struct flow_dissector *flow_dissector,
124 void *target_container)
125{
126 struct flow_dissector_key_control *ctrl;
127
128 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_CONTROL))
129 return;
130
131 ctrl = skb_flow_dissector_target(flow_dissector,
132 FLOW_DISSECTOR_KEY_ENC_CONTROL,
133 target_container);
134 ctrl->addr_type = type;
135}
136
137void
138skb_flow_dissect_tunnel_info(const struct sk_buff *skb,
139 struct flow_dissector *flow_dissector,
140 void *target_container)
141{
142 struct ip_tunnel_info *info;
143 struct ip_tunnel_key *key;
144
145 /* A quick check to see if there might be something to do. */
146 if (!dissector_uses_key(flow_dissector,
147 FLOW_DISSECTOR_KEY_ENC_KEYID) &&
148 !dissector_uses_key(flow_dissector,
149 FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS) &&
150 !dissector_uses_key(flow_dissector,
151 FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS) &&
152 !dissector_uses_key(flow_dissector,
153 FLOW_DISSECTOR_KEY_ENC_CONTROL) &&
154 !dissector_uses_key(flow_dissector,
155 FLOW_DISSECTOR_KEY_ENC_PORTS))
156 return;
157
158 info = skb_tunnel_info(skb);
159 if (!info)
160 return;
161
162 key = &info->key;
163
164 switch (ip_tunnel_info_af(info)) {
165 case AF_INET:
166 skb_flow_dissect_set_enc_addr_type(FLOW_DISSECTOR_KEY_IPV4_ADDRS,
167 flow_dissector,
168 target_container);
169 if (dissector_uses_key(flow_dissector,
170 FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS)) {
171 struct flow_dissector_key_ipv4_addrs *ipv4;
172
173 ipv4 = skb_flow_dissector_target(flow_dissector,
174 FLOW_DISSECTOR_KEY_ENC_IPV4_ADDRS,
175 target_container);
176 ipv4->src = key->u.ipv4.src;
177 ipv4->dst = key->u.ipv4.dst;
178 }
179 break;
180 case AF_INET6:
181 skb_flow_dissect_set_enc_addr_type(FLOW_DISSECTOR_KEY_IPV6_ADDRS,
182 flow_dissector,
183 target_container);
184 if (dissector_uses_key(flow_dissector,
185 FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS)) {
186 struct flow_dissector_key_ipv6_addrs *ipv6;
187
188 ipv6 = skb_flow_dissector_target(flow_dissector,
189 FLOW_DISSECTOR_KEY_ENC_IPV6_ADDRS,
190 target_container);
191 ipv6->src = key->u.ipv6.src;
192 ipv6->dst = key->u.ipv6.dst;
193 }
194 break;
195 }
196
197 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_KEYID)) {
198 struct flow_dissector_key_keyid *keyid;
199
200 keyid = skb_flow_dissector_target(flow_dissector,
201 FLOW_DISSECTOR_KEY_ENC_KEYID,
202 target_container);
203 keyid->keyid = tunnel_id_to_key32(key->tun_id);
204 }
205
206 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ENC_PORTS)) {
207 struct flow_dissector_key_ports *tp;
208
209 tp = skb_flow_dissector_target(flow_dissector,
210 FLOW_DISSECTOR_KEY_ENC_PORTS,
211 target_container);
212 tp->src = key->tp_src;
213 tp->dst = key->tp_dst;
214 }
215}
216EXPORT_SYMBOL(skb_flow_dissect_tunnel_info);
217
218static enum flow_dissect_ret
219__skb_flow_dissect_mpls(const struct sk_buff *skb,
220 struct flow_dissector *flow_dissector,
221 void *target_container, void *data, int nhoff, int hlen)
222{
223 struct flow_dissector_key_keyid *key_keyid;
224 struct mpls_label *hdr, _hdr[2];
225 u32 entry, label;
226
227 if (!dissector_uses_key(flow_dissector,
228 FLOW_DISSECTOR_KEY_MPLS_ENTROPY) &&
229 !dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_MPLS))
230 return FLOW_DISSECT_RET_OUT_GOOD;
231
232 hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data,
233 hlen, &_hdr);
234 if (!hdr)
235 return FLOW_DISSECT_RET_OUT_BAD;
236
237 entry = ntohl(hdr[0].entry);
238 label = (entry & MPLS_LS_LABEL_MASK) >> MPLS_LS_LABEL_SHIFT;
239
240 if (dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_MPLS)) {
241 struct flow_dissector_key_mpls *key_mpls;
242
243 key_mpls = skb_flow_dissector_target(flow_dissector,
244 FLOW_DISSECTOR_KEY_MPLS,
245 target_container);
246 key_mpls->mpls_label = label;
247 key_mpls->mpls_ttl = (entry & MPLS_LS_TTL_MASK)
248 >> MPLS_LS_TTL_SHIFT;
249 key_mpls->mpls_tc = (entry & MPLS_LS_TC_MASK)
250 >> MPLS_LS_TC_SHIFT;
251 key_mpls->mpls_bos = (entry & MPLS_LS_S_MASK)
252 >> MPLS_LS_S_SHIFT;
253 }
254
255 if (label == MPLS_LABEL_ENTROPY) {
256 key_keyid = skb_flow_dissector_target(flow_dissector,
257 FLOW_DISSECTOR_KEY_MPLS_ENTROPY,
258 target_container);
259 key_keyid->keyid = hdr[1].entry & htonl(MPLS_LS_LABEL_MASK);
260 }
261 return FLOW_DISSECT_RET_OUT_GOOD;
262}
263
264static enum flow_dissect_ret
265__skb_flow_dissect_arp(const struct sk_buff *skb,
266 struct flow_dissector *flow_dissector,
267 void *target_container, void *data, int nhoff, int hlen)
268{
269 struct flow_dissector_key_arp *key_arp;
270 struct {
271 unsigned char ar_sha[ETH_ALEN];
272 unsigned char ar_sip[4];
273 unsigned char ar_tha[ETH_ALEN];
274 unsigned char ar_tip[4];
275 } *arp_eth, _arp_eth;
276 const struct arphdr *arp;
277 struct arphdr _arp;
278
279 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_ARP))
280 return FLOW_DISSECT_RET_OUT_GOOD;
281
282 arp = __skb_header_pointer(skb, nhoff, sizeof(_arp), data,
283 hlen, &_arp);
284 if (!arp)
285 return FLOW_DISSECT_RET_OUT_BAD;
286
287 if (arp->ar_hrd != htons(ARPHRD_ETHER) ||
288 arp->ar_pro != htons(ETH_P_IP) ||
289 arp->ar_hln != ETH_ALEN ||
290 arp->ar_pln != 4 ||
291 (arp->ar_op != htons(ARPOP_REPLY) &&
292 arp->ar_op != htons(ARPOP_REQUEST)))
293 return FLOW_DISSECT_RET_OUT_BAD;
294
295 arp_eth = __skb_header_pointer(skb, nhoff + sizeof(_arp),
296 sizeof(_arp_eth), data,
297 hlen, &_arp_eth);
298 if (!arp_eth)
299 return FLOW_DISSECT_RET_OUT_BAD;
300
301 key_arp = skb_flow_dissector_target(flow_dissector,
302 FLOW_DISSECTOR_KEY_ARP,
303 target_container);
304
305 memcpy(&key_arp->sip, arp_eth->ar_sip, sizeof(key_arp->sip));
306 memcpy(&key_arp->tip, arp_eth->ar_tip, sizeof(key_arp->tip));
307
308 /* Only store the lower byte of the opcode;
309 * this covers ARPOP_REPLY and ARPOP_REQUEST.
310 */
311 key_arp->op = ntohs(arp->ar_op) & 0xff;
312
313 ether_addr_copy(key_arp->sha, arp_eth->ar_sha);
314 ether_addr_copy(key_arp->tha, arp_eth->ar_tha);
315
316 return FLOW_DISSECT_RET_OUT_GOOD;
317}
318
319static enum flow_dissect_ret
320__skb_flow_dissect_gre(const struct sk_buff *skb,
321 struct flow_dissector_key_control *key_control,
322 struct flow_dissector *flow_dissector,
323 void *target_container, void *data,
324 __be16 *p_proto, int *p_nhoff, int *p_hlen,
325 unsigned int flags)
326{
327 struct flow_dissector_key_keyid *key_keyid;
328 struct gre_base_hdr *hdr, _hdr;
329 int offset = 0;
330 u16 gre_ver;
331
332 hdr = __skb_header_pointer(skb, *p_nhoff, sizeof(_hdr),
333 data, *p_hlen, &_hdr);
334 if (!hdr)
335 return FLOW_DISSECT_RET_OUT_BAD;
336
337 /* Only look inside GRE without routing */
338 if (hdr->flags & GRE_ROUTING)
339 return FLOW_DISSECT_RET_OUT_GOOD;
340
341 /* Only look inside GRE for version 0 and 1 */
342 gre_ver = ntohs(hdr->flags & GRE_VERSION);
343 if (gre_ver > 1)
344 return FLOW_DISSECT_RET_OUT_GOOD;
345
346 *p_proto = hdr->protocol;
347 if (gre_ver) {
348 /* Version1 must be PPTP, and check the flags */
349 if (!(*p_proto == GRE_PROTO_PPP && (hdr->flags & GRE_KEY)))
350 return FLOW_DISSECT_RET_OUT_GOOD;
351 }
352
353 offset += sizeof(struct gre_base_hdr);
354
355 if (hdr->flags & GRE_CSUM)
356 offset += sizeof(((struct gre_full_hdr *) 0)->csum) +
357 sizeof(((struct gre_full_hdr *) 0)->reserved1);
358
359 if (hdr->flags & GRE_KEY) {
360 const __be32 *keyid;
361 __be32 _keyid;
362
363 keyid = __skb_header_pointer(skb, *p_nhoff + offset,
364 sizeof(_keyid),
365 data, *p_hlen, &_keyid);
366 if (!keyid)
367 return FLOW_DISSECT_RET_OUT_BAD;
368
369 if (dissector_uses_key(flow_dissector,
370 FLOW_DISSECTOR_KEY_GRE_KEYID)) {
371 key_keyid = skb_flow_dissector_target(flow_dissector,
372 FLOW_DISSECTOR_KEY_GRE_KEYID,
373 target_container);
374 if (gre_ver == 0)
375 key_keyid->keyid = *keyid;
376 else
377 key_keyid->keyid = *keyid & GRE_PPTP_KEY_MASK;
378 }
379 offset += sizeof(((struct gre_full_hdr *) 0)->key);
380 }
381
382 if (hdr->flags & GRE_SEQ)
383 offset += sizeof(((struct pptp_gre_header *) 0)->seq);
384
385 if (gre_ver == 0) {
386 if (*p_proto == htons(ETH_P_TEB)) {
387 const struct ethhdr *eth;
388 struct ethhdr _eth;
389
390 eth = __skb_header_pointer(skb, *p_nhoff + offset,
391 sizeof(_eth),
392 data, *p_hlen, &_eth);
393 if (!eth)
394 return FLOW_DISSECT_RET_OUT_BAD;
395 *p_proto = eth->h_proto;
396 offset += sizeof(*eth);
397
398 /* Cap headers that we access via pointers at the
399 * end of the Ethernet header as our maximum alignment
400 * at that point is only 2 bytes.
401 */
402 if (NET_IP_ALIGN)
403 *p_hlen = *p_nhoff + offset;
404 }
405 } else { /* version 1, must be PPTP */
406 u8 _ppp_hdr[PPP_HDRLEN];
407 u8 *ppp_hdr;
408
409 if (hdr->flags & GRE_ACK)
410 offset += sizeof(((struct pptp_gre_header *) 0)->ack);
411
412 ppp_hdr = __skb_header_pointer(skb, *p_nhoff + offset,
413 sizeof(_ppp_hdr),
414 data, *p_hlen, _ppp_hdr);
415 if (!ppp_hdr)
416 return FLOW_DISSECT_RET_OUT_BAD;
417
418 switch (PPP_PROTOCOL(ppp_hdr)) {
419 case PPP_IP:
420 *p_proto = htons(ETH_P_IP);
421 break;
422 case PPP_IPV6:
423 *p_proto = htons(ETH_P_IPV6);
424 break;
425 default:
426 /* Could probably catch some more like MPLS */
427 break;
428 }
429
430 offset += PPP_HDRLEN;
431 }
432
433 *p_nhoff += offset;
434 key_control->flags |= FLOW_DIS_ENCAPSULATION;
435 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
436 return FLOW_DISSECT_RET_OUT_GOOD;
437
438 return FLOW_DISSECT_RET_PROTO_AGAIN;
439}
440
441/**
442 * __skb_flow_dissect_batadv() - dissect batman-adv header
443 * @skb: sk_buff to with the batman-adv header
444 * @key_control: flow dissectors control key
445 * @data: raw buffer pointer to the packet, if NULL use skb->data
446 * @p_proto: pointer used to update the protocol to process next
447 * @p_nhoff: pointer used to update inner network header offset
448 * @hlen: packet header length
449 * @flags: any combination of FLOW_DISSECTOR_F_*
450 *
451 * ETH_P_BATMAN packets are tried to be dissected. Only
452 * &struct batadv_unicast packets are actually processed because they contain an
453 * inner ethernet header and are usually followed by actual network header. This
454 * allows the flow dissector to continue processing the packet.
455 *
456 * Return: FLOW_DISSECT_RET_PROTO_AGAIN when &struct batadv_unicast was found,
457 * FLOW_DISSECT_RET_OUT_GOOD when dissector should stop after encapsulation,
458 * otherwise FLOW_DISSECT_RET_OUT_BAD
459 */
460static enum flow_dissect_ret
461__skb_flow_dissect_batadv(const struct sk_buff *skb,
462 struct flow_dissector_key_control *key_control,
463 void *data, __be16 *p_proto, int *p_nhoff, int hlen,
464 unsigned int flags)
465{
466 struct {
467 struct batadv_unicast_packet batadv_unicast;
468 struct ethhdr eth;
469 } *hdr, _hdr;
470
471 hdr = __skb_header_pointer(skb, *p_nhoff, sizeof(_hdr), data, hlen,
472 &_hdr);
473 if (!hdr)
474 return FLOW_DISSECT_RET_OUT_BAD;
475
476 if (hdr->batadv_unicast.version != BATADV_COMPAT_VERSION)
477 return FLOW_DISSECT_RET_OUT_BAD;
478
479 if (hdr->batadv_unicast.packet_type != BATADV_UNICAST)
480 return FLOW_DISSECT_RET_OUT_BAD;
481
482 *p_proto = hdr->eth.h_proto;
483 *p_nhoff += sizeof(*hdr);
484
485 key_control->flags |= FLOW_DIS_ENCAPSULATION;
486 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP)
487 return FLOW_DISSECT_RET_OUT_GOOD;
488
489 return FLOW_DISSECT_RET_PROTO_AGAIN;
490}
491
492static void
493__skb_flow_dissect_tcp(const struct sk_buff *skb,
494 struct flow_dissector *flow_dissector,
495 void *target_container, void *data, int thoff, int hlen)
496{
497 struct flow_dissector_key_tcp *key_tcp;
498 struct tcphdr *th, _th;
499
500 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_TCP))
501 return;
502
503 th = __skb_header_pointer(skb, thoff, sizeof(_th), data, hlen, &_th);
504 if (!th)
505 return;
506
507 if (unlikely(__tcp_hdrlen(th) < sizeof(_th)))
508 return;
509
510 key_tcp = skb_flow_dissector_target(flow_dissector,
511 FLOW_DISSECTOR_KEY_TCP,
512 target_container);
513 key_tcp->flags = (*(__be16 *) &tcp_flag_word(th) & htons(0x0FFF));
514}
515
516static void
517__skb_flow_dissect_ipv4(const struct sk_buff *skb,
518 struct flow_dissector *flow_dissector,
519 void *target_container, void *data, const struct iphdr *iph)
520{
521 struct flow_dissector_key_ip *key_ip;
522
523 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_IP))
524 return;
525
526 key_ip = skb_flow_dissector_target(flow_dissector,
527 FLOW_DISSECTOR_KEY_IP,
528 target_container);
529 key_ip->tos = iph->tos;
530 key_ip->ttl = iph->ttl;
531}
532
533static void
534__skb_flow_dissect_ipv6(const struct sk_buff *skb,
535 struct flow_dissector *flow_dissector,
536 void *target_container, void *data, const struct ipv6hdr *iph)
537{
538 struct flow_dissector_key_ip *key_ip;
539
540 if (!dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_IP))
541 return;
542
543 key_ip = skb_flow_dissector_target(flow_dissector,
544 FLOW_DISSECTOR_KEY_IP,
545 target_container);
546 key_ip->tos = ipv6_get_dsfield(iph);
547 key_ip->ttl = iph->hop_limit;
548}
549
550/* Maximum number of protocol headers that can be parsed in
551 * __skb_flow_dissect
552 */
553#define MAX_FLOW_DISSECT_HDRS 15
554
555static bool skb_flow_dissect_allowed(int *num_hdrs)
556{
557 ++*num_hdrs;
558
559 return (*num_hdrs <= MAX_FLOW_DISSECT_HDRS);
560}
561
562/**
563 * __skb_flow_dissect - extract the flow_keys struct and return it
564 * @skb: sk_buff to extract the flow from, can be NULL if the rest are specified
565 * @flow_dissector: list of keys to dissect
566 * @target_container: target structure to put dissected values into
567 * @data: raw buffer pointer to the packet, if NULL use skb->data
568 * @proto: protocol for which to get the flow, if @data is NULL use skb->protocol
569 * @nhoff: network header offset, if @data is NULL use skb_network_offset(skb)
570 * @hlen: packet header length, if @data is NULL use skb_headlen(skb)
571 *
572 * The function will try to retrieve individual keys into target specified
573 * by flow_dissector from either the skbuff or a raw buffer specified by the
574 * rest parameters.
575 *
576 * Caller must take care of zeroing target container memory.
577 */
578bool __skb_flow_dissect(const struct sk_buff *skb,
579 struct flow_dissector *flow_dissector,
580 void *target_container,
581 void *data, __be16 proto, int nhoff, int hlen,
582 unsigned int flags)
583{
584 struct flow_dissector_key_control *key_control;
585 struct flow_dissector_key_basic *key_basic;
586 struct flow_dissector_key_addrs *key_addrs;
587 struct flow_dissector_key_ports *key_ports;
588 struct flow_dissector_key_icmp *key_icmp;
589 struct flow_dissector_key_tags *key_tags;
590 struct flow_dissector_key_vlan *key_vlan;
591 enum flow_dissect_ret fdret;
592 bool skip_vlan = false;
593 int num_hdrs = 0;
594 u8 ip_proto = 0;
595 bool ret;
596
597 if (!data) {
598 data = skb->data;
599 proto = skb_vlan_tag_present(skb) ?
600 skb->vlan_proto : skb->protocol;
601 nhoff = skb_network_offset(skb);
602 hlen = skb_headlen(skb);
603#if IS_ENABLED(CONFIG_NET_DSA)
604 if (unlikely(skb->dev && netdev_uses_dsa(skb->dev))) {
605 const struct dsa_device_ops *ops;
606 int offset;
607
608 ops = skb->dev->dsa_ptr->tag_ops;
609 if (ops->flow_dissect &&
610 !ops->flow_dissect(skb, &proto, &offset)) {
611 hlen -= offset;
612 nhoff += offset;
613 }
614 }
615#endif
616 }
617
618 /* It is ensured by skb_flow_dissector_init() that control key will
619 * be always present.
620 */
621 key_control = skb_flow_dissector_target(flow_dissector,
622 FLOW_DISSECTOR_KEY_CONTROL,
623 target_container);
624
625 /* It is ensured by skb_flow_dissector_init() that basic key will
626 * be always present.
627 */
628 key_basic = skb_flow_dissector_target(flow_dissector,
629 FLOW_DISSECTOR_KEY_BASIC,
630 target_container);
631
632 if (dissector_uses_key(flow_dissector,
633 FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
634 struct ethhdr *eth = eth_hdr(skb);
635 struct flow_dissector_key_eth_addrs *key_eth_addrs;
636
637 key_eth_addrs = skb_flow_dissector_target(flow_dissector,
638 FLOW_DISSECTOR_KEY_ETH_ADDRS,
639 target_container);
640 memcpy(key_eth_addrs, ð->h_dest, sizeof(*key_eth_addrs));
641 }
642
643proto_again:
644 fdret = FLOW_DISSECT_RET_CONTINUE;
645
646 switch (proto) {
647 case htons(ETH_P_IP): {
648 const struct iphdr *iph;
649 struct iphdr _iph;
650
651 iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph);
652 if (!iph || iph->ihl < 5) {
653 fdret = FLOW_DISSECT_RET_OUT_BAD;
654 break;
655 }
656
657 nhoff += iph->ihl * 4;
658
659 ip_proto = iph->protocol;
660
661 if (dissector_uses_key(flow_dissector,
662 FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
663 key_addrs = skb_flow_dissector_target(flow_dissector,
664 FLOW_DISSECTOR_KEY_IPV4_ADDRS,
665 target_container);
666
667 memcpy(&key_addrs->v4addrs, &iph->saddr,
668 sizeof(key_addrs->v4addrs));
669 key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
670 }
671
672 if (ip_is_fragment(iph)) {
673 key_control->flags |= FLOW_DIS_IS_FRAGMENT;
674
675 if (iph->frag_off & htons(IP_OFFSET)) {
676 fdret = FLOW_DISSECT_RET_OUT_GOOD;
677 break;
678 } else {
679 key_control->flags |= FLOW_DIS_FIRST_FRAG;
680 if (!(flags &
681 FLOW_DISSECTOR_F_PARSE_1ST_FRAG)) {
682 fdret = FLOW_DISSECT_RET_OUT_GOOD;
683 break;
684 }
685 }
686 }
687
688 __skb_flow_dissect_ipv4(skb, flow_dissector,
689 target_container, data, iph);
690
691 if (flags & FLOW_DISSECTOR_F_STOP_AT_L3) {
692 fdret = FLOW_DISSECT_RET_OUT_GOOD;
693 break;
694 }
695
696 break;
697 }
698 case htons(ETH_P_IPV6): {
699 const struct ipv6hdr *iph;
700 struct ipv6hdr _iph;
701
702 iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph);
703 if (!iph) {
704 fdret = FLOW_DISSECT_RET_OUT_BAD;
705 break;
706 }
707
708 ip_proto = iph->nexthdr;
709 nhoff += sizeof(struct ipv6hdr);
710
711 if (dissector_uses_key(flow_dissector,
712 FLOW_DISSECTOR_KEY_IPV6_ADDRS)) {
713 key_addrs = skb_flow_dissector_target(flow_dissector,
714 FLOW_DISSECTOR_KEY_IPV6_ADDRS,
715 target_container);
716
717 memcpy(&key_addrs->v6addrs, &iph->saddr,
718 sizeof(key_addrs->v6addrs));
719 key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
720 }
721
722 if ((dissector_uses_key(flow_dissector,
723 FLOW_DISSECTOR_KEY_FLOW_LABEL) ||
724 (flags & FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL)) &&
725 ip6_flowlabel(iph)) {
726 __be32 flow_label = ip6_flowlabel(iph);
727
728 if (dissector_uses_key(flow_dissector,
729 FLOW_DISSECTOR_KEY_FLOW_LABEL)) {
730 key_tags = skb_flow_dissector_target(flow_dissector,
731 FLOW_DISSECTOR_KEY_FLOW_LABEL,
732 target_container);
733 key_tags->flow_label = ntohl(flow_label);
734 }
735 if (flags & FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL) {
736 fdret = FLOW_DISSECT_RET_OUT_GOOD;
737 break;
738 }
739 }
740
741 __skb_flow_dissect_ipv6(skb, flow_dissector,
742 target_container, data, iph);
743
744 if (flags & FLOW_DISSECTOR_F_STOP_AT_L3)
745 fdret = FLOW_DISSECT_RET_OUT_GOOD;
746
747 break;
748 }
749 case htons(ETH_P_8021AD):
750 case htons(ETH_P_8021Q): {
751 const struct vlan_hdr *vlan;
752 struct vlan_hdr _vlan;
753 bool vlan_tag_present = skb && skb_vlan_tag_present(skb);
754
755 if (vlan_tag_present)
756 proto = skb->protocol;
757
758 if (!vlan_tag_present || eth_type_vlan(skb->protocol)) {
759 vlan = __skb_header_pointer(skb, nhoff, sizeof(_vlan),
760 data, hlen, &_vlan);
761 if (!vlan) {
762 fdret = FLOW_DISSECT_RET_OUT_BAD;
763 break;
764 }
765
766 proto = vlan->h_vlan_encapsulated_proto;
767 nhoff += sizeof(*vlan);
768 if (skip_vlan) {
769 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
770 break;
771 }
772 }
773
774 skip_vlan = true;
775 if (dissector_uses_key(flow_dissector,
776 FLOW_DISSECTOR_KEY_VLAN)) {
777 key_vlan = skb_flow_dissector_target(flow_dissector,
778 FLOW_DISSECTOR_KEY_VLAN,
779 target_container);
780
781 if (vlan_tag_present) {
782 key_vlan->vlan_id = skb_vlan_tag_get_id(skb);
783 key_vlan->vlan_priority =
784 (skb_vlan_tag_get_prio(skb) >> VLAN_PRIO_SHIFT);
785 } else {
786 key_vlan->vlan_id = ntohs(vlan->h_vlan_TCI) &
787 VLAN_VID_MASK;
788 key_vlan->vlan_priority =
789 (ntohs(vlan->h_vlan_TCI) &
790 VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
791 }
792 }
793
794 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
795 break;
796 }
797 case htons(ETH_P_PPP_SES): {
798 struct {
799 struct pppoe_hdr hdr;
800 __be16 proto;
801 } *hdr, _hdr;
802 hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data, hlen, &_hdr);
803 if (!hdr) {
804 fdret = FLOW_DISSECT_RET_OUT_BAD;
805 break;
806 }
807
808 proto = hdr->proto;
809 nhoff += PPPOE_SES_HLEN;
810 switch (proto) {
811 case htons(PPP_IP):
812 proto = htons(ETH_P_IP);
813 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
814 break;
815 case htons(PPP_IPV6):
816 proto = htons(ETH_P_IPV6);
817 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
818 break;
819 default:
820 fdret = FLOW_DISSECT_RET_OUT_BAD;
821 break;
822 }
823 break;
824 }
825 case htons(ETH_P_TIPC): {
826 struct tipc_basic_hdr *hdr, _hdr;
827
828 hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr),
829 data, hlen, &_hdr);
830 if (!hdr) {
831 fdret = FLOW_DISSECT_RET_OUT_BAD;
832 break;
833 }
834
835 if (dissector_uses_key(flow_dissector,
836 FLOW_DISSECTOR_KEY_TIPC)) {
837 key_addrs = skb_flow_dissector_target(flow_dissector,
838 FLOW_DISSECTOR_KEY_TIPC,
839 target_container);
840 key_addrs->tipckey.key = tipc_hdr_rps_key(hdr);
841 key_control->addr_type = FLOW_DISSECTOR_KEY_TIPC;
842 }
843 fdret = FLOW_DISSECT_RET_OUT_GOOD;
844 break;
845 }
846
847 case htons(ETH_P_MPLS_UC):
848 case htons(ETH_P_MPLS_MC):
849 fdret = __skb_flow_dissect_mpls(skb, flow_dissector,
850 target_container, data,
851 nhoff, hlen);
852 break;
853 case htons(ETH_P_FCOE):
854 if ((hlen - nhoff) < FCOE_HEADER_LEN) {
855 fdret = FLOW_DISSECT_RET_OUT_BAD;
856 break;
857 }
858
859 nhoff += FCOE_HEADER_LEN;
860 fdret = FLOW_DISSECT_RET_OUT_GOOD;
861 break;
862
863 case htons(ETH_P_ARP):
864 case htons(ETH_P_RARP):
865 fdret = __skb_flow_dissect_arp(skb, flow_dissector,
866 target_container, data,
867 nhoff, hlen);
868 break;
869
870 case htons(ETH_P_BATMAN):
871 fdret = __skb_flow_dissect_batadv(skb, key_control, data,
872 &proto, &nhoff, hlen, flags);
873 break;
874
875 default:
876 fdret = FLOW_DISSECT_RET_OUT_BAD;
877 break;
878 }
879
880 /* Process result of proto processing */
881 switch (fdret) {
882 case FLOW_DISSECT_RET_OUT_GOOD:
883 goto out_good;
884 case FLOW_DISSECT_RET_PROTO_AGAIN:
885 if (skb_flow_dissect_allowed(&num_hdrs))
886 goto proto_again;
887 goto out_good;
888 case FLOW_DISSECT_RET_CONTINUE:
889 case FLOW_DISSECT_RET_IPPROTO_AGAIN:
890 break;
891 case FLOW_DISSECT_RET_OUT_BAD:
892 default:
893 goto out_bad;
894 }
895
896ip_proto_again:
897 fdret = FLOW_DISSECT_RET_CONTINUE;
898
899 switch (ip_proto) {
900 case IPPROTO_GRE:
901 fdret = __skb_flow_dissect_gre(skb, key_control, flow_dissector,
902 target_container, data,
903 &proto, &nhoff, &hlen, flags);
904 break;
905
906 case NEXTHDR_HOP:
907 case NEXTHDR_ROUTING:
908 case NEXTHDR_DEST: {
909 u8 _opthdr[2], *opthdr;
910
911 if (proto != htons(ETH_P_IPV6))
912 break;
913
914 opthdr = __skb_header_pointer(skb, nhoff, sizeof(_opthdr),
915 data, hlen, &_opthdr);
916 if (!opthdr) {
917 fdret = FLOW_DISSECT_RET_OUT_BAD;
918 break;
919 }
920
921 ip_proto = opthdr[0];
922 nhoff += (opthdr[1] + 1) << 3;
923
924 fdret = FLOW_DISSECT_RET_IPPROTO_AGAIN;
925 break;
926 }
927 case NEXTHDR_FRAGMENT: {
928 struct frag_hdr _fh, *fh;
929
930 if (proto != htons(ETH_P_IPV6))
931 break;
932
933 fh = __skb_header_pointer(skb, nhoff, sizeof(_fh),
934 data, hlen, &_fh);
935
936 if (!fh) {
937 fdret = FLOW_DISSECT_RET_OUT_BAD;
938 break;
939 }
940
941 key_control->flags |= FLOW_DIS_IS_FRAGMENT;
942
943 nhoff += sizeof(_fh);
944 ip_proto = fh->nexthdr;
945
946 if (!(fh->frag_off & htons(IP6_OFFSET))) {
947 key_control->flags |= FLOW_DIS_FIRST_FRAG;
948 if (flags & FLOW_DISSECTOR_F_PARSE_1ST_FRAG) {
949 fdret = FLOW_DISSECT_RET_IPPROTO_AGAIN;
950 break;
951 }
952 }
953
954 fdret = FLOW_DISSECT_RET_OUT_GOOD;
955 break;
956 }
957 case IPPROTO_IPIP:
958 proto = htons(ETH_P_IP);
959
960 key_control->flags |= FLOW_DIS_ENCAPSULATION;
961 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP) {
962 fdret = FLOW_DISSECT_RET_OUT_GOOD;
963 break;
964 }
965
966 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
967 break;
968
969 case IPPROTO_IPV6:
970 proto = htons(ETH_P_IPV6);
971
972 key_control->flags |= FLOW_DIS_ENCAPSULATION;
973 if (flags & FLOW_DISSECTOR_F_STOP_AT_ENCAP) {
974 fdret = FLOW_DISSECT_RET_OUT_GOOD;
975 break;
976 }
977
978 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
979 break;
980
981
982 case IPPROTO_MPLS:
983 proto = htons(ETH_P_MPLS_UC);
984 fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
985 break;
986
987 case IPPROTO_TCP:
988 __skb_flow_dissect_tcp(skb, flow_dissector, target_container,
989 data, nhoff, hlen);
990 break;
991
992 default:
993 break;
994 }
995
996 if (dissector_uses_key(flow_dissector,
997 FLOW_DISSECTOR_KEY_PORTS)) {
998 key_ports = skb_flow_dissector_target(flow_dissector,
999 FLOW_DISSECTOR_KEY_PORTS,
1000 target_container);
1001 key_ports->ports = __skb_flow_get_ports(skb, nhoff, ip_proto,
1002 data, hlen);
1003 }
1004
1005 if (dissector_uses_key(flow_dissector,
1006 FLOW_DISSECTOR_KEY_ICMP)) {
1007 key_icmp = skb_flow_dissector_target(flow_dissector,
1008 FLOW_DISSECTOR_KEY_ICMP,
1009 target_container);
1010 key_icmp->icmp = skb_flow_get_be16(skb, nhoff, data, hlen);
1011 }
1012
1013 /* Process result of IP proto processing */
1014 switch (fdret) {
1015 case FLOW_DISSECT_RET_PROTO_AGAIN:
1016 if (skb_flow_dissect_allowed(&num_hdrs))
1017 goto proto_again;
1018 break;
1019 case FLOW_DISSECT_RET_IPPROTO_AGAIN:
1020 if (skb_flow_dissect_allowed(&num_hdrs))
1021 goto ip_proto_again;
1022 break;
1023 case FLOW_DISSECT_RET_OUT_GOOD:
1024 case FLOW_DISSECT_RET_CONTINUE:
1025 break;
1026 case FLOW_DISSECT_RET_OUT_BAD:
1027 default:
1028 goto out_bad;
1029 }
1030
1031out_good:
1032 ret = true;
1033
1034out:
1035 key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen);
1036 key_basic->n_proto = proto;
1037 key_basic->ip_proto = ip_proto;
1038
1039 return ret;
1040
1041out_bad:
1042 ret = false;
1043 goto out;
1044}
1045EXPORT_SYMBOL(__skb_flow_dissect);
1046
1047static u32 hashrnd __read_mostly;
1048static __always_inline void __flow_hash_secret_init(void)
1049{
1050 net_get_random_once(&hashrnd, sizeof(hashrnd));
1051}
1052
1053static __always_inline u32 __flow_hash_words(const u32 *words, u32 length,
1054 u32 keyval)
1055{
1056 return jhash2(words, length, keyval);
1057}
1058
1059static inline const u32 *flow_keys_hash_start(const struct flow_keys *flow)
1060{
1061 const void *p = flow;
1062
1063 BUILD_BUG_ON(FLOW_KEYS_HASH_OFFSET % sizeof(u32));
1064 return (const u32 *)(p + FLOW_KEYS_HASH_OFFSET);
1065}
1066
1067static inline size_t flow_keys_hash_length(const struct flow_keys *flow)
1068{
1069 size_t diff = FLOW_KEYS_HASH_OFFSET + sizeof(flow->addrs);
1070 BUILD_BUG_ON((sizeof(*flow) - FLOW_KEYS_HASH_OFFSET) % sizeof(u32));
1071 BUILD_BUG_ON(offsetof(typeof(*flow), addrs) !=
1072 sizeof(*flow) - sizeof(flow->addrs));
1073
1074 switch (flow->control.addr_type) {
1075 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1076 diff -= sizeof(flow->addrs.v4addrs);
1077 break;
1078 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1079 diff -= sizeof(flow->addrs.v6addrs);
1080 break;
1081 case FLOW_DISSECTOR_KEY_TIPC:
1082 diff -= sizeof(flow->addrs.tipckey);
1083 break;
1084 }
1085 return (sizeof(*flow) - diff) / sizeof(u32);
1086}
1087
1088__be32 flow_get_u32_src(const struct flow_keys *flow)
1089{
1090 switch (flow->control.addr_type) {
1091 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1092 return flow->addrs.v4addrs.src;
1093 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1094 return (__force __be32)ipv6_addr_hash(
1095 &flow->addrs.v6addrs.src);
1096 case FLOW_DISSECTOR_KEY_TIPC:
1097 return flow->addrs.tipckey.key;
1098 default:
1099 return 0;
1100 }
1101}
1102EXPORT_SYMBOL(flow_get_u32_src);
1103
1104__be32 flow_get_u32_dst(const struct flow_keys *flow)
1105{
1106 switch (flow->control.addr_type) {
1107 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1108 return flow->addrs.v4addrs.dst;
1109 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1110 return (__force __be32)ipv6_addr_hash(
1111 &flow->addrs.v6addrs.dst);
1112 default:
1113 return 0;
1114 }
1115}
1116EXPORT_SYMBOL(flow_get_u32_dst);
1117
1118static inline void __flow_hash_consistentify(struct flow_keys *keys)
1119{
1120 int addr_diff, i;
1121
1122 switch (keys->control.addr_type) {
1123 case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
1124 addr_diff = (__force u32)keys->addrs.v4addrs.dst -
1125 (__force u32)keys->addrs.v4addrs.src;
1126 if ((addr_diff < 0) ||
1127 (addr_diff == 0 &&
1128 ((__force u16)keys->ports.dst <
1129 (__force u16)keys->ports.src))) {
1130 swap(keys->addrs.v4addrs.src, keys->addrs.v4addrs.dst);
1131 swap(keys->ports.src, keys->ports.dst);
1132 }
1133 break;
1134 case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
1135 addr_diff = memcmp(&keys->addrs.v6addrs.dst,
1136 &keys->addrs.v6addrs.src,
1137 sizeof(keys->addrs.v6addrs.dst));
1138 if ((addr_diff < 0) ||
1139 (addr_diff == 0 &&
1140 ((__force u16)keys->ports.dst <
1141 (__force u16)keys->ports.src))) {
1142 for (i = 0; i < 4; i++)
1143 swap(keys->addrs.v6addrs.src.s6_addr32[i],
1144 keys->addrs.v6addrs.dst.s6_addr32[i]);
1145 swap(keys->ports.src, keys->ports.dst);
1146 }
1147 break;
1148 }
1149}
1150
1151static inline u32 __flow_hash_from_keys(struct flow_keys *keys, u32 keyval)
1152{
1153 u32 hash;
1154
1155 __flow_hash_consistentify(keys);
1156
1157 hash = __flow_hash_words(flow_keys_hash_start(keys),
1158 flow_keys_hash_length(keys), keyval);
1159 if (!hash)
1160 hash = 1;
1161
1162 return hash;
1163}
1164
1165u32 flow_hash_from_keys(struct flow_keys *keys)
1166{
1167 __flow_hash_secret_init();
1168 return __flow_hash_from_keys(keys, hashrnd);
1169}
1170EXPORT_SYMBOL(flow_hash_from_keys);
1171
1172static inline u32 ___skb_get_hash(const struct sk_buff *skb,
1173 struct flow_keys *keys, u32 keyval)
1174{
1175 skb_flow_dissect_flow_keys(skb, keys,
1176 FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
1177
1178 return __flow_hash_from_keys(keys, keyval);
1179}
1180
1181struct _flow_keys_digest_data {
1182 __be16 n_proto;
1183 u8 ip_proto;
1184 u8 padding;
1185 __be32 ports;
1186 __be32 src;
1187 __be32 dst;
1188};
1189
1190void make_flow_keys_digest(struct flow_keys_digest *digest,
1191 const struct flow_keys *flow)
1192{
1193 struct _flow_keys_digest_data *data =
1194 (struct _flow_keys_digest_data *)digest;
1195
1196 BUILD_BUG_ON(sizeof(*data) > sizeof(*digest));
1197
1198 memset(digest, 0, sizeof(*digest));
1199
1200 data->n_proto = flow->basic.n_proto;
1201 data->ip_proto = flow->basic.ip_proto;
1202 data->ports = flow->ports.ports;
1203 data->src = flow->addrs.v4addrs.src;
1204 data->dst = flow->addrs.v4addrs.dst;
1205}
1206EXPORT_SYMBOL(make_flow_keys_digest);
1207
1208static struct flow_dissector flow_keys_dissector_symmetric __read_mostly;
1209
1210u32 __skb_get_hash_symmetric(const struct sk_buff *skb)
1211{
1212 struct flow_keys keys;
1213
1214 __flow_hash_secret_init();
1215
1216 memset(&keys, 0, sizeof(keys));
1217 __skb_flow_dissect(skb, &flow_keys_dissector_symmetric, &keys,
1218 NULL, 0, 0, 0,
1219 FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
1220
1221 return __flow_hash_from_keys(&keys, hashrnd);
1222}
1223EXPORT_SYMBOL_GPL(__skb_get_hash_symmetric);
1224
1225/**
1226 * __skb_get_hash: calculate a flow hash
1227 * @skb: sk_buff to calculate flow hash from
1228 *
1229 * This function calculates a flow hash based on src/dst addresses
1230 * and src/dst port numbers. Sets hash in skb to non-zero hash value
1231 * on success, zero indicates no valid hash. Also, sets l4_hash in skb
1232 * if hash is a canonical 4-tuple hash over transport ports.
1233 */
1234void __skb_get_hash(struct sk_buff *skb)
1235{
1236 struct flow_keys keys;
1237 u32 hash;
1238
1239 __flow_hash_secret_init();
1240
1241 hash = ___skb_get_hash(skb, &keys, hashrnd);
1242
1243 __skb_set_sw_hash(skb, hash, flow_keys_have_l4(&keys));
1244}
1245EXPORT_SYMBOL(__skb_get_hash);
1246
1247__u32 skb_get_hash_perturb(const struct sk_buff *skb, u32 perturb)
1248{
1249 struct flow_keys keys;
1250
1251 return ___skb_get_hash(skb, &keys, perturb);
1252}
1253EXPORT_SYMBOL(skb_get_hash_perturb);
1254
1255u32 __skb_get_poff(const struct sk_buff *skb, void *data,
1256 const struct flow_keys *keys, int hlen)
1257{
1258 u32 poff = keys->control.thoff;
1259
1260 /* skip L4 headers for fragments after the first */
1261 if ((keys->control.flags & FLOW_DIS_IS_FRAGMENT) &&
1262 !(keys->control.flags & FLOW_DIS_FIRST_FRAG))
1263 return poff;
1264
1265 switch (keys->basic.ip_proto) {
1266 case IPPROTO_TCP: {
1267 /* access doff as u8 to avoid unaligned access */
1268 const u8 *doff;
1269 u8 _doff;
1270
1271 doff = __skb_header_pointer(skb, poff + 12, sizeof(_doff),
1272 data, hlen, &_doff);
1273 if (!doff)
1274 return poff;
1275
1276 poff += max_t(u32, sizeof(struct tcphdr), (*doff & 0xF0) >> 2);
1277 break;
1278 }
1279 case IPPROTO_UDP:
1280 case IPPROTO_UDPLITE:
1281 poff += sizeof(struct udphdr);
1282 break;
1283 /* For the rest, we do not really care about header
1284 * extensions at this point for now.
1285 */
1286 case IPPROTO_ICMP:
1287 poff += sizeof(struct icmphdr);
1288 break;
1289 case IPPROTO_ICMPV6:
1290 poff += sizeof(struct icmp6hdr);
1291 break;
1292 case IPPROTO_IGMP:
1293 poff += sizeof(struct igmphdr);
1294 break;
1295 case IPPROTO_DCCP:
1296 poff += sizeof(struct dccp_hdr);
1297 break;
1298 case IPPROTO_SCTP:
1299 poff += sizeof(struct sctphdr);
1300 break;
1301 }
1302
1303 return poff;
1304}
1305
1306/**
1307 * skb_get_poff - get the offset to the payload
1308 * @skb: sk_buff to get the payload offset from
1309 *
1310 * The function will get the offset to the payload as far as it could
1311 * be dissected. The main user is currently BPF, so that we can dynamically
1312 * truncate packets without needing to push actual payload to the user
1313 * space and can analyze headers only, instead.
1314 */
1315u32 skb_get_poff(const struct sk_buff *skb)
1316{
1317 struct flow_keys keys;
1318
1319 if (!skb_flow_dissect_flow_keys(skb, &keys, 0))
1320 return 0;
1321
1322 return __skb_get_poff(skb, skb->data, &keys, skb_headlen(skb));
1323}
1324
1325__u32 __get_hash_from_flowi6(const struct flowi6 *fl6, struct flow_keys *keys)
1326{
1327 memset(keys, 0, sizeof(*keys));
1328
1329 memcpy(&keys->addrs.v6addrs.src, &fl6->saddr,
1330 sizeof(keys->addrs.v6addrs.src));
1331 memcpy(&keys->addrs.v6addrs.dst, &fl6->daddr,
1332 sizeof(keys->addrs.v6addrs.dst));
1333 keys->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
1334 keys->ports.src = fl6->fl6_sport;
1335 keys->ports.dst = fl6->fl6_dport;
1336 keys->keyid.keyid = fl6->fl6_gre_key;
1337 keys->tags.flow_label = (__force u32)fl6->flowlabel;
1338 keys->basic.ip_proto = fl6->flowi6_proto;
1339
1340 return flow_hash_from_keys(keys);
1341}
1342EXPORT_SYMBOL(__get_hash_from_flowi6);
1343
1344static const struct flow_dissector_key flow_keys_dissector_keys[] = {
1345 {
1346 .key_id = FLOW_DISSECTOR_KEY_CONTROL,
1347 .offset = offsetof(struct flow_keys, control),
1348 },
1349 {
1350 .key_id = FLOW_DISSECTOR_KEY_BASIC,
1351 .offset = offsetof(struct flow_keys, basic),
1352 },
1353 {
1354 .key_id = FLOW_DISSECTOR_KEY_IPV4_ADDRS,
1355 .offset = offsetof(struct flow_keys, addrs.v4addrs),
1356 },
1357 {
1358 .key_id = FLOW_DISSECTOR_KEY_IPV6_ADDRS,
1359 .offset = offsetof(struct flow_keys, addrs.v6addrs),
1360 },
1361 {
1362 .key_id = FLOW_DISSECTOR_KEY_TIPC,
1363 .offset = offsetof(struct flow_keys, addrs.tipckey),
1364 },
1365 {
1366 .key_id = FLOW_DISSECTOR_KEY_PORTS,
1367 .offset = offsetof(struct flow_keys, ports),
1368 },
1369 {
1370 .key_id = FLOW_DISSECTOR_KEY_VLAN,
1371 .offset = offsetof(struct flow_keys, vlan),
1372 },
1373 {
1374 .key_id = FLOW_DISSECTOR_KEY_FLOW_LABEL,
1375 .offset = offsetof(struct flow_keys, tags),
1376 },
1377 {
1378 .key_id = FLOW_DISSECTOR_KEY_GRE_KEYID,
1379 .offset = offsetof(struct flow_keys, keyid),
1380 },
1381};
1382
1383static const struct flow_dissector_key flow_keys_dissector_symmetric_keys[] = {
1384 {
1385 .key_id = FLOW_DISSECTOR_KEY_CONTROL,
1386 .offset = offsetof(struct flow_keys, control),
1387 },
1388 {
1389 .key_id = FLOW_DISSECTOR_KEY_BASIC,
1390 .offset = offsetof(struct flow_keys, basic),
1391 },
1392 {
1393 .key_id = FLOW_DISSECTOR_KEY_IPV4_ADDRS,
1394 .offset = offsetof(struct flow_keys, addrs.v4addrs),
1395 },
1396 {
1397 .key_id = FLOW_DISSECTOR_KEY_IPV6_ADDRS,
1398 .offset = offsetof(struct flow_keys, addrs.v6addrs),
1399 },
1400 {
1401 .key_id = FLOW_DISSECTOR_KEY_PORTS,
1402 .offset = offsetof(struct flow_keys, ports),
1403 },
1404};
1405
1406static const struct flow_dissector_key flow_keys_buf_dissector_keys[] = {
1407 {
1408 .key_id = FLOW_DISSECTOR_KEY_CONTROL,
1409 .offset = offsetof(struct flow_keys, control),
1410 },
1411 {
1412 .key_id = FLOW_DISSECTOR_KEY_BASIC,
1413 .offset = offsetof(struct flow_keys, basic),
1414 },
1415};
1416
1417struct flow_dissector flow_keys_dissector __read_mostly;
1418EXPORT_SYMBOL(flow_keys_dissector);
1419
1420struct flow_dissector flow_keys_buf_dissector __read_mostly;
1421
1422static int __init init_default_flow_dissectors(void)
1423{
1424 skb_flow_dissector_init(&flow_keys_dissector,
1425 flow_keys_dissector_keys,
1426 ARRAY_SIZE(flow_keys_dissector_keys));
1427 skb_flow_dissector_init(&flow_keys_dissector_symmetric,
1428 flow_keys_dissector_symmetric_keys,
1429 ARRAY_SIZE(flow_keys_dissector_symmetric_keys));
1430 skb_flow_dissector_init(&flow_keys_buf_dissector,
1431 flow_keys_buf_dissector_keys,
1432 ARRAY_SIZE(flow_keys_buf_dissector_keys));
1433 return 0;
1434}
1435
1436core_initcall(init_default_flow_dissectors);