1// SPDX-License-Identifier: GPL-2.0
   2/* Copyright (C) B.A.T.M.A.N. contributors:
   3 *
   4 * Antonio Quartulli
   5 */
   6
   7#include "distributed-arp-table.h"
   8#include "main.h"
   9
  10#include <asm/unaligned.h>
  11#include <linux/atomic.h>
  12#include <linux/bitops.h>
  13#include <linux/byteorder/generic.h>
 
  14#include <linux/errno.h>
  15#include <linux/etherdevice.h>
  16#include <linux/gfp.h>
  17#include <linux/if_arp.h>
  18#include <linux/if_ether.h>
  19#include <linux/if_vlan.h>
  20#include <linux/in.h>
  21#include <linux/ip.h>
  22#include <linux/jiffies.h>
  23#include <linux/kernel.h>
  24#include <linux/kref.h>
  25#include <linux/list.h>
  26#include <linux/netlink.h>
  27#include <linux/rculist.h>
  28#include <linux/rcupdate.h>
  29#include <linux/skbuff.h>
  30#include <linux/slab.h>
  31#include <linux/spinlock.h>
  32#include <linux/stddef.h>
  33#include <linux/string.h>
  34#include <linux/udp.h>
  35#include <linux/workqueue.h>
  36#include <net/arp.h>
  37#include <net/genetlink.h>
  38#include <net/netlink.h>
  39#include <net/sock.h>
  40#include <uapi/linux/batman_adv.h>
  41
  42#include "bridge_loop_avoidance.h"
  43#include "hard-interface.h"
  44#include "hash.h"
  45#include "log.h"
  46#include "netlink.h"
  47#include "originator.h"
  48#include "send.h"
  49#include "soft-interface.h"
  50#include "translation-table.h"
  51#include "tvlv.h"
  52
  53enum batadv_bootpop {
  54	BATADV_BOOTREPLY	= 2,
  55};
  56
  57enum batadv_boothtype {
  58	BATADV_HTYPE_ETHERNET	= 1,
  59};
  60
  61enum batadv_dhcpoptioncode {
  62	BATADV_DHCP_OPT_PAD		= 0,
  63	BATADV_DHCP_OPT_MSG_TYPE	= 53,
  64	BATADV_DHCP_OPT_END		= 255,
  65};
  66
  67enum batadv_dhcptype {
  68	BATADV_DHCPACK		= 5,
  69};
  70
  71/* { 99, 130, 83, 99 } */
  72#define BATADV_DHCP_MAGIC 1669485411
  73
  74struct batadv_dhcp_packet {
  75	__u8 op;
  76	__u8 htype;
  77	__u8 hlen;
  78	__u8 hops;
  79	__be32 xid;
  80	__be16 secs;
  81	__be16 flags;
  82	__be32 ciaddr;
  83	__be32 yiaddr;
  84	__be32 siaddr;
  85	__be32 giaddr;
  86	__u8 chaddr[16];
  87	__u8 sname[64];
  88	__u8 file[128];
  89	__be32 magic;
  90	/* __u8 options[]; */
  91};
  92
  93#define BATADV_DHCP_YIADDR_LEN sizeof(((struct batadv_dhcp_packet *)0)->yiaddr)
  94#define BATADV_DHCP_CHADDR_LEN sizeof(((struct batadv_dhcp_packet *)0)->chaddr)
  95
  96static void batadv_dat_purge(struct work_struct *work);
  97
  98/**
  99 * batadv_dat_start_timer() - initialise the DAT periodic worker
 100 * @bat_priv: the bat priv with all the soft interface information
 101 */
 102static void batadv_dat_start_timer(struct batadv_priv *bat_priv)
 103{
 104	INIT_DELAYED_WORK(&bat_priv->dat.work, batadv_dat_purge);
 105	queue_delayed_work(batadv_event_workqueue, &bat_priv->dat.work,
 106			   msecs_to_jiffies(10000));
 107}
 108
 109/**
 110 * batadv_dat_entry_release() - release dat_entry from lists and queue for free
 111 *  after rcu grace period
 112 * @ref: kref pointer of the dat_entry
 113 */
 114static void batadv_dat_entry_release(struct kref *ref)
 115{
 116	struct batadv_dat_entry *dat_entry;
 117
 118	dat_entry = container_of(ref, struct batadv_dat_entry, refcount);
 119
 120	kfree_rcu(dat_entry, rcu);
 121}
 122
 123/**
 124 * batadv_dat_entry_put() - decrement the dat_entry refcounter and possibly
 125 *  release it
 126 * @dat_entry: dat_entry to be free'd
 127 */
 128static void batadv_dat_entry_put(struct batadv_dat_entry *dat_entry)
 129{
 
 
 
 130	kref_put(&dat_entry->refcount, batadv_dat_entry_release);
 131}
 132
 133/**
 134 * batadv_dat_to_purge() - check whether a dat_entry has to be purged or not
 135 * @dat_entry: the entry to check
 136 *
 137 * Return: true if the entry has to be purged now, false otherwise.
 138 */
 139static bool batadv_dat_to_purge(struct batadv_dat_entry *dat_entry)
 140{
 141	return batadv_has_timed_out(dat_entry->last_update,
 142				    BATADV_DAT_ENTRY_TIMEOUT);
 143}
 144
 145/**
 146 * __batadv_dat_purge() - delete entries from the DAT local storage
 147 * @bat_priv: the bat priv with all the soft interface information
 148 * @to_purge: function in charge to decide whether an entry has to be purged or
 149 *	      not. This function takes the dat_entry as argument and has to
 150 *	      returns a boolean value: true is the entry has to be deleted,
 151 *	      false otherwise
 152 *
 153 * Loops over each entry in the DAT local storage and deletes it if and only if
 154 * the to_purge function passed as argument returns true.
 155 */
 156static void __batadv_dat_purge(struct batadv_priv *bat_priv,
 157			       bool (*to_purge)(struct batadv_dat_entry *))
 158{
 159	spinlock_t *list_lock; /* protects write access to the hash lists */
 160	struct batadv_dat_entry *dat_entry;
 161	struct hlist_node *node_tmp;
 162	struct hlist_head *head;
 163	u32 i;
 164
 165	if (!bat_priv->dat.hash)
 166		return;
 167
 168	for (i = 0; i < bat_priv->dat.hash->size; i++) {
 169		head = &bat_priv->dat.hash->table[i];
 170		list_lock = &bat_priv->dat.hash->list_locks[i];
 171
 172		spin_lock_bh(list_lock);
 173		hlist_for_each_entry_safe(dat_entry, node_tmp, head,
 174					  hash_entry) {
 175			/* if a helper function has been passed as parameter,
 176			 * ask it if the entry has to be purged or not
 177			 */
 178			if (to_purge && !to_purge(dat_entry))
 179				continue;
 180
 181			hlist_del_rcu(&dat_entry->hash_entry);
 182			batadv_dat_entry_put(dat_entry);
 183		}
 184		spin_unlock_bh(list_lock);
 185	}
 186}
 187
 188/**
 189 * batadv_dat_purge() - periodic task that deletes old entries from the local
 190 *  DAT hash table
 191 * @work: kernel work struct
 192 */
 193static void batadv_dat_purge(struct work_struct *work)
 194{
 195	struct delayed_work *delayed_work;
 196	struct batadv_priv_dat *priv_dat;
 197	struct batadv_priv *bat_priv;
 198
 199	delayed_work = to_delayed_work(work);
 200	priv_dat = container_of(delayed_work, struct batadv_priv_dat, work);
 201	bat_priv = container_of(priv_dat, struct batadv_priv, dat);
 202
 203	__batadv_dat_purge(bat_priv, batadv_dat_to_purge);
 204	batadv_dat_start_timer(bat_priv);
 205}
 206
 207/**
 208 * batadv_compare_dat() - comparing function used in the local DAT hash table
 209 * @node: node in the local table
 210 * @data2: second object to compare the node to
 211 *
 212 * Return: true if the two entries are the same, false otherwise.
 213 */
 214static bool batadv_compare_dat(const struct hlist_node *node, const void *data2)
 215{
 216	const void *data1 = container_of(node, struct batadv_dat_entry,
 217					 hash_entry);
 218
 219	return memcmp(data1, data2, sizeof(__be32)) == 0;
 220}
 221
 222/**
 223 * batadv_arp_hw_src() - extract the hw_src field from an ARP packet
 224 * @skb: ARP packet
 225 * @hdr_size: size of the possible header before the ARP packet
 226 *
 227 * Return: the value of the hw_src field in the ARP packet.
 228 */
 229static u8 *batadv_arp_hw_src(struct sk_buff *skb, int hdr_size)
 230{
 231	u8 *addr;
 232
 233	addr = (u8 *)(skb->data + hdr_size);
 234	addr += ETH_HLEN + sizeof(struct arphdr);
 235
 236	return addr;
 237}
 238
 239/**
 240 * batadv_arp_ip_src() - extract the ip_src field from an ARP packet
 241 * @skb: ARP packet
 242 * @hdr_size: size of the possible header before the ARP packet
 243 *
 244 * Return: the value of the ip_src field in the ARP packet.
 245 */
 246static __be32 batadv_arp_ip_src(struct sk_buff *skb, int hdr_size)
 247{
 248	return *(__force __be32 *)(batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN);
 249}
 250
 251/**
 252 * batadv_arp_hw_dst() - extract the hw_dst field from an ARP packet
 253 * @skb: ARP packet
 254 * @hdr_size: size of the possible header before the ARP packet
 255 *
 256 * Return: the value of the hw_dst field in the ARP packet.
 257 */
 258static u8 *batadv_arp_hw_dst(struct sk_buff *skb, int hdr_size)
 259{
 260	return batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN + 4;
 261}
 262
 263/**
 264 * batadv_arp_ip_dst() - extract the ip_dst field from an ARP packet
 265 * @skb: ARP packet
 266 * @hdr_size: size of the possible header before the ARP packet
 267 *
 268 * Return: the value of the ip_dst field in the ARP packet.
 269 */
 270static __be32 batadv_arp_ip_dst(struct sk_buff *skb, int hdr_size)
 271{
 272	u8 *dst = batadv_arp_hw_src(skb, hdr_size) + ETH_ALEN * 2 + 4;
 273
 274	return *(__force __be32 *)dst;
 275}
 276
 277/**
 278 * batadv_hash_dat() - compute the hash value for an IP address
 279 * @data: data to hash
 280 * @size: size of the hash table
 281 *
 282 * Return: the selected index in the hash table for the given data.
 283 */
 284static u32 batadv_hash_dat(const void *data, u32 size)
 285{
 286	u32 hash = 0;
 287	const struct batadv_dat_entry *dat = data;
 288	const unsigned char *key;
 289	__be16 vid;
 290	u32 i;
 291
 292	key = (__force const unsigned char *)&dat->ip;
 293	for (i = 0; i < sizeof(dat->ip); i++) {
 294		hash += key[i];
 295		hash += (hash << 10);
 296		hash ^= (hash >> 6);
 297	}
 298
 299	vid = htons(dat->vid);
 300	key = (__force const unsigned char *)&vid;
 301	for (i = 0; i < sizeof(dat->vid); i++) {
 302		hash += key[i];
 303		hash += (hash << 10);
 304		hash ^= (hash >> 6);
 305	}
 306
 307	hash += (hash << 3);
 308	hash ^= (hash >> 11);
 309	hash += (hash << 15);
 310
 311	return hash % size;
 312}
 313
 314/**
 315 * batadv_dat_entry_hash_find() - look for a given dat_entry in the local hash
 316 * table
 317 * @bat_priv: the bat priv with all the soft interface information
 318 * @ip: search key
 319 * @vid: VLAN identifier
 320 *
 321 * Return: the dat_entry if found, NULL otherwise.
 322 */
 323static struct batadv_dat_entry *
 324batadv_dat_entry_hash_find(struct batadv_priv *bat_priv, __be32 ip,
 325			   unsigned short vid)
 326{
 327	struct hlist_head *head;
 328	struct batadv_dat_entry to_find, *dat_entry, *dat_entry_tmp = NULL;
 329	struct batadv_hashtable *hash = bat_priv->dat.hash;
 330	u32 index;
 331
 332	if (!hash)
 333		return NULL;
 334
 335	to_find.ip = ip;
 336	to_find.vid = vid;
 337
 338	index = batadv_hash_dat(&to_find, hash->size);
 339	head = &hash->table[index];
 340
 341	rcu_read_lock();
 342	hlist_for_each_entry_rcu(dat_entry, head, hash_entry) {
 343		if (dat_entry->ip != ip)
 344			continue;
 345
 346		if (!kref_get_unless_zero(&dat_entry->refcount))
 347			continue;
 348
 349		dat_entry_tmp = dat_entry;
 350		break;
 351	}
 352	rcu_read_unlock();
 353
 354	return dat_entry_tmp;
 355}
 356
 357/**
 358 * batadv_dat_entry_add() - add a new dat entry or update it if already exists
 359 * @bat_priv: the bat priv with all the soft interface information
 360 * @ip: ipv4 to add/edit
 361 * @mac_addr: mac address to assign to the given ipv4
 362 * @vid: VLAN identifier
 363 */
 364static void batadv_dat_entry_add(struct batadv_priv *bat_priv, __be32 ip,
 365				 u8 *mac_addr, unsigned short vid)
 366{
 367	struct batadv_dat_entry *dat_entry;
 368	int hash_added;
 369
 370	dat_entry = batadv_dat_entry_hash_find(bat_priv, ip, vid);
 371	/* if this entry is already known, just update it */
 372	if (dat_entry) {
 373		if (!batadv_compare_eth(dat_entry->mac_addr, mac_addr))
 374			ether_addr_copy(dat_entry->mac_addr, mac_addr);
 375		dat_entry->last_update = jiffies;
 376		batadv_dbg(BATADV_DBG_DAT, bat_priv,
 377			   "Entry updated: %pI4 %pM (vid: %d)\n",
 378			   &dat_entry->ip, dat_entry->mac_addr,
 379			   batadv_print_vid(vid));
 380		goto out;
 381	}
 382
 383	dat_entry = kmalloc(sizeof(*dat_entry), GFP_ATOMIC);
 384	if (!dat_entry)
 385		goto out;
 386
 387	dat_entry->ip = ip;
 388	dat_entry->vid = vid;
 389	ether_addr_copy(dat_entry->mac_addr, mac_addr);
 390	dat_entry->last_update = jiffies;
 391	kref_init(&dat_entry->refcount);
 392
 393	kref_get(&dat_entry->refcount);
 394	hash_added = batadv_hash_add(bat_priv->dat.hash, batadv_compare_dat,
 395				     batadv_hash_dat, dat_entry,
 396				     &dat_entry->hash_entry);
 397
 398	if (unlikely(hash_added != 0)) {
 399		/* remove the reference for the hash */
 400		batadv_dat_entry_put(dat_entry);
 401		goto out;
 402	}
 403
 404	batadv_dbg(BATADV_DBG_DAT, bat_priv, "New entry added: %pI4 %pM (vid: %d)\n",
 405		   &dat_entry->ip, dat_entry->mac_addr, batadv_print_vid(vid));
 406
 407out:
 408	if (dat_entry)
 409		batadv_dat_entry_put(dat_entry);
 410}
 411
 412#ifdef CONFIG_BATMAN_ADV_DEBUG
 413
 414/**
 415 * batadv_dbg_arp() - print a debug message containing all the ARP packet
 416 *  details
 417 * @bat_priv: the bat priv with all the soft interface information
 418 * @skb: ARP packet
 419 * @hdr_size: size of the possible header before the ARP packet
 420 * @msg: message to print together with the debugging information
 421 */
 422static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
 423			   int hdr_size, char *msg)
 424{
 425	struct batadv_unicast_4addr_packet *unicast_4addr_packet;
 426	struct batadv_bcast_packet *bcast_pkt;
 427	u8 *orig_addr;
 428	__be32 ip_src, ip_dst;
 429
 430	if (msg)
 431		batadv_dbg(BATADV_DBG_DAT, bat_priv, "%s\n", msg);
 432
 433	ip_src = batadv_arp_ip_src(skb, hdr_size);
 434	ip_dst = batadv_arp_ip_dst(skb, hdr_size);
 435	batadv_dbg(BATADV_DBG_DAT, bat_priv,
 436		   "ARP MSG = [src: %pM-%pI4 dst: %pM-%pI4]\n",
 437		   batadv_arp_hw_src(skb, hdr_size), &ip_src,
 438		   batadv_arp_hw_dst(skb, hdr_size), &ip_dst);
 439
 440	if (hdr_size < sizeof(struct batadv_unicast_packet))
 441		return;
 442
 443	unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
 444
 445	switch (unicast_4addr_packet->u.packet_type) {
 446	case BATADV_UNICAST:
 447		batadv_dbg(BATADV_DBG_DAT, bat_priv,
 448			   "* encapsulated within a UNICAST packet\n");
 449		break;
 450	case BATADV_UNICAST_4ADDR:
 451		batadv_dbg(BATADV_DBG_DAT, bat_priv,
 452			   "* encapsulated within a UNICAST_4ADDR packet (src: %pM)\n",
 453			   unicast_4addr_packet->src);
 454		switch (unicast_4addr_packet->subtype) {
 455		case BATADV_P_DAT_DHT_PUT:
 456			batadv_dbg(BATADV_DBG_DAT, bat_priv, "* type: DAT_DHT_PUT\n");
 457			break;
 458		case BATADV_P_DAT_DHT_GET:
 459			batadv_dbg(BATADV_DBG_DAT, bat_priv, "* type: DAT_DHT_GET\n");
 460			break;
 461		case BATADV_P_DAT_CACHE_REPLY:
 462			batadv_dbg(BATADV_DBG_DAT, bat_priv,
 463				   "* type: DAT_CACHE_REPLY\n");
 464			break;
 465		case BATADV_P_DATA:
 466			batadv_dbg(BATADV_DBG_DAT, bat_priv, "* type: DATA\n");
 467			break;
 468		default:
 469			batadv_dbg(BATADV_DBG_DAT, bat_priv, "* type: Unknown (%u)!\n",
 470				   unicast_4addr_packet->u.packet_type);
 471		}
 472		break;
 473	case BATADV_BCAST:
 474		bcast_pkt = (struct batadv_bcast_packet *)unicast_4addr_packet;
 475		orig_addr = bcast_pkt->orig;
 476		batadv_dbg(BATADV_DBG_DAT, bat_priv,
 477			   "* encapsulated within a BCAST packet (src: %pM)\n",
 478			   orig_addr);
 479		break;
 480	default:
 481		batadv_dbg(BATADV_DBG_DAT, bat_priv,
 482			   "* encapsulated within an unknown packet type (0x%x)\n",
 483			   unicast_4addr_packet->u.packet_type);
 484	}
 485}
 486
 487#else
 488
 489static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
 490			   int hdr_size, char *msg)
 491{
 492}
 493
 494#endif /* CONFIG_BATMAN_ADV_DEBUG */
 495
 496/**
 497 * batadv_is_orig_node_eligible() - check whether a node can be a DHT candidate
 498 * @res: the array with the already selected candidates
 499 * @select: number of already selected candidates
 500 * @tmp_max: address of the currently evaluated node
 501 * @max: current round max address
 502 * @last_max: address of the last selected candidate
 503 * @candidate: orig_node under evaluation
 504 * @max_orig_node: last selected candidate
 505 *
 506 * Return: true if the node has been elected as next candidate or false
 507 * otherwise.
 508 */
 509static bool batadv_is_orig_node_eligible(struct batadv_dat_candidate *res,
 510					 int select, batadv_dat_addr_t tmp_max,
 511					 batadv_dat_addr_t max,
 512					 batadv_dat_addr_t last_max,
 513					 struct batadv_orig_node *candidate,
 514					 struct batadv_orig_node *max_orig_node)
 515{
 516	bool ret = false;
 517	int j;
 518
 519	/* check if orig node candidate is running DAT */
 520	if (!test_bit(BATADV_ORIG_CAPA_HAS_DAT, &candidate->capabilities))
 521		goto out;
 522
 523	/* Check if this node has already been selected... */
 524	for (j = 0; j < select; j++)
 525		if (res[j].orig_node == candidate)
 526			break;
 527	/* ..and possibly skip it */
 528	if (j < select)
 529		goto out;
 530	/* sanity check: has it already been selected? This should not happen */
 531	if (tmp_max > last_max)
 532		goto out;
 533	/* check if during this iteration an originator with a closer dht
 534	 * address has already been found
 535	 */
 536	if (tmp_max < max)
 537		goto out;
 538	/* this is an hash collision with the temporary selected node. Choose
 539	 * the one with the lowest address
 540	 */
 541	if (tmp_max == max && max_orig_node &&
 542	    batadv_compare_eth(candidate->orig, max_orig_node->orig))
 543		goto out;
 544
 545	ret = true;
 546out:
 547	return ret;
 548}
 549
 550/**
 551 * batadv_choose_next_candidate() - select the next DHT candidate
 552 * @bat_priv: the bat priv with all the soft interface information
 553 * @cands: candidates array
 554 * @select: number of candidates already present in the array
 555 * @ip_key: key to look up in the DHT
 556 * @last_max: pointer where the address of the selected candidate will be saved
 557 */
 558static void batadv_choose_next_candidate(struct batadv_priv *bat_priv,
 559					 struct batadv_dat_candidate *cands,
 560					 int select, batadv_dat_addr_t ip_key,
 561					 batadv_dat_addr_t *last_max)
 562{
 563	batadv_dat_addr_t max = 0;
 564	batadv_dat_addr_t tmp_max = 0;
 565	struct batadv_orig_node *orig_node, *max_orig_node = NULL;
 566	struct batadv_hashtable *hash = bat_priv->orig_hash;
 567	struct hlist_head *head;
 568	int i;
 569
 570	/* if no node is eligible as candidate, leave the candidate type as
 571	 * NOT_FOUND
 572	 */
 573	cands[select].type = BATADV_DAT_CANDIDATE_NOT_FOUND;
 574
 575	/* iterate over the originator list and find the node with the closest
 576	 * dat_address which has not been selected yet
 577	 */
 578	for (i = 0; i < hash->size; i++) {
 579		head = &hash->table[i];
 580
 581		rcu_read_lock();
 582		hlist_for_each_entry_rcu(orig_node, head, hash_entry) {
 583			/* the dht space is a ring using unsigned addresses */
 584			tmp_max = BATADV_DAT_ADDR_MAX - orig_node->dat_addr +
 585				  ip_key;
 586
 587			if (!batadv_is_orig_node_eligible(cands, select,
 588							  tmp_max, max,
 589							  *last_max, orig_node,
 590							  max_orig_node))
 591				continue;
 592
 593			if (!kref_get_unless_zero(&orig_node->refcount))
 594				continue;
 595
 596			max = tmp_max;
 597			if (max_orig_node)
 598				batadv_orig_node_put(max_orig_node);
 599			max_orig_node = orig_node;
 600		}
 601		rcu_read_unlock();
 602	}
 603	if (max_orig_node) {
 604		cands[select].type = BATADV_DAT_CANDIDATE_ORIG;
 605		cands[select].orig_node = max_orig_node;
 606		batadv_dbg(BATADV_DBG_DAT, bat_priv,
 607			   "dat_select_candidates() %d: selected %pM addr=%u dist=%u\n",
 608			   select, max_orig_node->orig, max_orig_node->dat_addr,
 609			   max);
 610	}
 611	*last_max = max;
 612}
 613
 614/**
 615 * batadv_dat_select_candidates() - select the nodes which the DHT message has
 616 *  to be sent to
 617 * @bat_priv: the bat priv with all the soft interface information
 618 * @ip_dst: ipv4 to look up in the DHT
 619 * @vid: VLAN identifier
 620 *
 621 * An originator O is selected if and only if its DHT_ID value is one of three
 622 * closest values (from the LEFT, with wrap around if needed) then the hash
 623 * value of the key. ip_dst is the key.
 624 *
 625 * Return: the candidate array of size BATADV_DAT_CANDIDATE_NUM.
 626 */
 627static struct batadv_dat_candidate *
 628batadv_dat_select_candidates(struct batadv_priv *bat_priv, __be32 ip_dst,
 629			     unsigned short vid)
 630{
 631	int select;
 632	batadv_dat_addr_t last_max = BATADV_DAT_ADDR_MAX, ip_key;
 633	struct batadv_dat_candidate *res;
 634	struct batadv_dat_entry dat;
 635
 636	if (!bat_priv->orig_hash)
 637		return NULL;
 638
 639	res = kmalloc_array(BATADV_DAT_CANDIDATES_NUM, sizeof(*res),
 640			    GFP_ATOMIC);
 641	if (!res)
 642		return NULL;
 643
 644	dat.ip = ip_dst;
 645	dat.vid = vid;
 646	ip_key = (batadv_dat_addr_t)batadv_hash_dat(&dat,
 647						    BATADV_DAT_ADDR_MAX);
 648
 649	batadv_dbg(BATADV_DBG_DAT, bat_priv,
 650		   "%s(): IP=%pI4 hash(IP)=%u\n", __func__, &ip_dst,
 651		   ip_key);
 652
 653	for (select = 0; select < BATADV_DAT_CANDIDATES_NUM; select++)
 654		batadv_choose_next_candidate(bat_priv, res, select, ip_key,
 655					     &last_max);
 656
 657	return res;
 658}
 659
 660/**
 661 * batadv_dat_forward_data() - copy and send payload to the selected candidates
 662 * @bat_priv: the bat priv with all the soft interface information
 663 * @skb: payload to send
 664 * @ip: the DHT key
 665 * @vid: VLAN identifier
 666 * @packet_subtype: unicast4addr packet subtype to use
 667 *
 668 * This function copies the skb with pskb_copy() and is sent as a unicast packet
 669 * to each of the selected candidates.
 670 *
 671 * Return: true if the packet is sent to at least one candidate, false
 672 * otherwise.
 673 */
 674static bool batadv_dat_forward_data(struct batadv_priv *bat_priv,
 675				    struct sk_buff *skb, __be32 ip,
 676				    unsigned short vid, int packet_subtype)
 677{
 678	int i;
 679	bool ret = false;
 680	int send_status;
 681	struct batadv_neigh_node *neigh_node = NULL;
 682	struct sk_buff *tmp_skb;
 683	struct batadv_dat_candidate *cand;
 684
 685	cand = batadv_dat_select_candidates(bat_priv, ip, vid);
 686	if (!cand)
 687		goto out;
 688
 689	batadv_dbg(BATADV_DBG_DAT, bat_priv, "DHT_SEND for %pI4\n", &ip);
 690
 691	for (i = 0; i < BATADV_DAT_CANDIDATES_NUM; i++) {
 692		if (cand[i].type == BATADV_DAT_CANDIDATE_NOT_FOUND)
 693			continue;
 694
 695		neigh_node = batadv_orig_router_get(cand[i].orig_node,
 696						    BATADV_IF_DEFAULT);
 697		if (!neigh_node)
 698			goto free_orig;
 699
 700		tmp_skb = pskb_copy_for_clone(skb, GFP_ATOMIC);
 701		if (!batadv_send_skb_prepare_unicast_4addr(bat_priv, tmp_skb,
 702							   cand[i].orig_node,
 703							   packet_subtype)) {
 704			kfree_skb(tmp_skb);
 705			goto free_neigh;
 706		}
 707
 708		send_status = batadv_send_unicast_skb(tmp_skb, neigh_node);
 709		if (send_status == NET_XMIT_SUCCESS) {
 710			/* count the sent packet */
 711			switch (packet_subtype) {
 712			case BATADV_P_DAT_DHT_GET:
 713				batadv_inc_counter(bat_priv,
 714						   BATADV_CNT_DAT_GET_TX);
 715				break;
 716			case BATADV_P_DAT_DHT_PUT:
 717				batadv_inc_counter(bat_priv,
 718						   BATADV_CNT_DAT_PUT_TX);
 719				break;
 720			}
 721
 722			/* packet sent to a candidate: return true */
 723			ret = true;
 724		}
 725free_neigh:
 726		batadv_neigh_node_put(neigh_node);
 727free_orig:
 728		batadv_orig_node_put(cand[i].orig_node);
 729	}
 730
 731out:
 732	kfree(cand);
 733	return ret;
 734}
 735
 736/**
 737 * batadv_dat_tvlv_container_update() - update the dat tvlv container after dat
 738 *  setting change
 739 * @bat_priv: the bat priv with all the soft interface information
 740 */
 741static void batadv_dat_tvlv_container_update(struct batadv_priv *bat_priv)
 742{
 743	char dat_mode;
 744
 745	dat_mode = atomic_read(&bat_priv->distributed_arp_table);
 746
 747	switch (dat_mode) {
 748	case 0:
 749		batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_DAT, 1);
 750		break;
 751	case 1:
 752		batadv_tvlv_container_register(bat_priv, BATADV_TVLV_DAT, 1,
 753					       NULL, 0);
 754		break;
 755	}
 756}
 757
 758/**
 759 * batadv_dat_status_update() - update the dat tvlv container after dat
 760 *  setting change
 761 * @net_dev: the soft interface net device
 762 */
 763void batadv_dat_status_update(struct net_device *net_dev)
 764{
 765	struct batadv_priv *bat_priv = netdev_priv(net_dev);
 766
 767	batadv_dat_tvlv_container_update(bat_priv);
 768}
 769
 770/**
 771 * batadv_dat_tvlv_ogm_handler_v1() - process incoming dat tvlv container
 772 * @bat_priv: the bat priv with all the soft interface information
 773 * @orig: the orig_node of the ogm
 774 * @flags: flags indicating the tvlv state (see batadv_tvlv_handler_flags)
 775 * @tvlv_value: tvlv buffer containing the gateway data
 776 * @tvlv_value_len: tvlv buffer length
 777 */
 778static void batadv_dat_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
 779					   struct batadv_orig_node *orig,
 780					   u8 flags,
 781					   void *tvlv_value, u16 tvlv_value_len)
 782{
 783	if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
 784		clear_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
 785	else
 786		set_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
 787}
 788
 789/**
 790 * batadv_dat_hash_free() - free the local DAT hash table
 791 * @bat_priv: the bat priv with all the soft interface information
 792 */
 793static void batadv_dat_hash_free(struct batadv_priv *bat_priv)
 794{
 795	if (!bat_priv->dat.hash)
 796		return;
 797
 798	__batadv_dat_purge(bat_priv, NULL);
 799
 800	batadv_hash_destroy(bat_priv->dat.hash);
 801
 802	bat_priv->dat.hash = NULL;
 803}
 804
 805/**
 806 * batadv_dat_init() - initialise the DAT internals
 807 * @bat_priv: the bat priv with all the soft interface information
 808 *
 809 * Return: 0 in case of success, a negative error code otherwise
 810 */
 811int batadv_dat_init(struct batadv_priv *bat_priv)
 812{
 813	if (bat_priv->dat.hash)
 814		return 0;
 815
 816	bat_priv->dat.hash = batadv_hash_new(1024);
 817
 818	if (!bat_priv->dat.hash)
 819		return -ENOMEM;
 820
 
 821	batadv_dat_start_timer(bat_priv);
 822
 823	batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1,
 824				     NULL, BATADV_TVLV_DAT, 1,
 825				     BATADV_TVLV_HANDLER_OGM_CIFNOTFND);
 826	batadv_dat_tvlv_container_update(bat_priv);
 827	return 0;
 828}
 829
 830/**
 831 * batadv_dat_free() - free the DAT internals
 832 * @bat_priv: the bat priv with all the soft interface information
 833 */
 834void batadv_dat_free(struct batadv_priv *bat_priv)
 835{
 836	batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_DAT, 1);
 837	batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_DAT, 1);
 838
 839	cancel_delayed_work_sync(&bat_priv->dat.work);
 840
 841	batadv_dat_hash_free(bat_priv);
 842}
 843
 844/**
 845 * batadv_dat_cache_dump_entry() - dump one entry of the DAT cache table to a
 846 *  netlink socket
 847 * @msg: buffer for the message
 848 * @portid: netlink port
 849 * @cb: Control block containing additional options
 850 * @dat_entry: entry to dump
 851 *
 852 * Return: 0 or error code.
 853 */
 854static int
 855batadv_dat_cache_dump_entry(struct sk_buff *msg, u32 portid,
 856			    struct netlink_callback *cb,
 857			    struct batadv_dat_entry *dat_entry)
 858{
 859	int msecs;
 860	void *hdr;
 861
 862	hdr = genlmsg_put(msg, portid, cb->nlh->nlmsg_seq,
 863			  &batadv_netlink_family, NLM_F_MULTI,
 864			  BATADV_CMD_GET_DAT_CACHE);
 865	if (!hdr)
 866		return -ENOBUFS;
 867
 868	genl_dump_check_consistent(cb, hdr);
 869
 870	msecs = jiffies_to_msecs(jiffies - dat_entry->last_update);
 871
 872	if (nla_put_in_addr(msg, BATADV_ATTR_DAT_CACHE_IP4ADDRESS,
 873			    dat_entry->ip) ||
 874	    nla_put(msg, BATADV_ATTR_DAT_CACHE_HWADDRESS, ETH_ALEN,
 875		    dat_entry->mac_addr) ||
 876	    nla_put_u16(msg, BATADV_ATTR_DAT_CACHE_VID, dat_entry->vid) ||
 877	    nla_put_u32(msg, BATADV_ATTR_LAST_SEEN_MSECS, msecs)) {
 878		genlmsg_cancel(msg, hdr);
 879		return -EMSGSIZE;
 880	}
 881
 882	genlmsg_end(msg, hdr);
 883	return 0;
 884}
 885
 886/**
 887 * batadv_dat_cache_dump_bucket() - dump one bucket of the DAT cache table to
 888 *  a netlink socket
 889 * @msg: buffer for the message
 890 * @portid: netlink port
 891 * @cb: Control block containing additional options
 892 * @hash: hash to dump
 893 * @bucket: bucket index to dump
 894 * @idx_skip: How many entries to skip
 895 *
 896 * Return: 0 or error code.
 897 */
 898static int
 899batadv_dat_cache_dump_bucket(struct sk_buff *msg, u32 portid,
 900			     struct netlink_callback *cb,
 901			     struct batadv_hashtable *hash, unsigned int bucket,
 902			     int *idx_skip)
 903{
 904	struct batadv_dat_entry *dat_entry;
 905	int idx = 0;
 906
 907	spin_lock_bh(&hash->list_locks[bucket]);
 908	cb->seq = atomic_read(&hash->generation) << 1 | 1;
 909
 910	hlist_for_each_entry(dat_entry, &hash->table[bucket], hash_entry) {
 911		if (idx < *idx_skip)
 912			goto skip;
 913
 914		if (batadv_dat_cache_dump_entry(msg, portid, cb, dat_entry)) {
 915			spin_unlock_bh(&hash->list_locks[bucket]);
 916			*idx_skip = idx;
 917
 918			return -EMSGSIZE;
 919		}
 920
 921skip:
 922		idx++;
 923	}
 924	spin_unlock_bh(&hash->list_locks[bucket]);
 925
 926	return 0;
 927}
 928
 929/**
 930 * batadv_dat_cache_dump() - dump DAT cache table to a netlink socket
 931 * @msg: buffer for the message
 932 * @cb: callback structure containing arguments
 933 *
 934 * Return: message length.
 935 */
 936int batadv_dat_cache_dump(struct sk_buff *msg, struct netlink_callback *cb)
 937{
 938	struct batadv_hard_iface *primary_if = NULL;
 939	int portid = NETLINK_CB(cb->skb).portid;
 940	struct net *net = sock_net(cb->skb->sk);
 941	struct net_device *soft_iface;
 942	struct batadv_hashtable *hash;
 943	struct batadv_priv *bat_priv;
 944	int bucket = cb->args[0];
 945	int idx = cb->args[1];
 946	int ifindex;
 947	int ret = 0;
 948
 949	ifindex = batadv_netlink_get_ifindex(cb->nlh,
 950					     BATADV_ATTR_MESH_IFINDEX);
 951	if (!ifindex)
 952		return -EINVAL;
 953
 954	soft_iface = dev_get_by_index(net, ifindex);
 955	if (!soft_iface || !batadv_softif_is_valid(soft_iface)) {
 956		ret = -ENODEV;
 957		goto out;
 958	}
 959
 960	bat_priv = netdev_priv(soft_iface);
 961	hash = bat_priv->dat.hash;
 962
 963	primary_if = batadv_primary_if_get_selected(bat_priv);
 964	if (!primary_if || primary_if->if_status != BATADV_IF_ACTIVE) {
 965		ret = -ENOENT;
 966		goto out;
 967	}
 968
 969	while (bucket < hash->size) {
 970		if (batadv_dat_cache_dump_bucket(msg, portid, cb, hash, bucket,
 971						 &idx))
 972			break;
 973
 974		bucket++;
 975		idx = 0;
 976	}
 977
 978	cb->args[0] = bucket;
 979	cb->args[1] = idx;
 980
 981	ret = msg->len;
 982
 983out:
 984	if (primary_if)
 985		batadv_hardif_put(primary_if);
 986
 987	if (soft_iface)
 988		dev_put(soft_iface);
 989
 990	return ret;
 991}
 992
 993/**
 994 * batadv_arp_get_type() - parse an ARP packet and gets the type
 995 * @bat_priv: the bat priv with all the soft interface information
 996 * @skb: packet to analyse
 997 * @hdr_size: size of the possible header before the ARP packet in the skb
 998 *
 999 * Return: the ARP type if the skb contains a valid ARP packet, 0 otherwise.
1000 */
1001static u16 batadv_arp_get_type(struct batadv_priv *bat_priv,
1002			       struct sk_buff *skb, int hdr_size)
1003{
1004	struct arphdr *arphdr;
1005	struct ethhdr *ethhdr;
1006	__be32 ip_src, ip_dst;
1007	u8 *hw_src, *hw_dst;
1008	u16 type = 0;
1009
1010	/* pull the ethernet header */
1011	if (unlikely(!pskb_may_pull(skb, hdr_size + ETH_HLEN)))
1012		goto out;
1013
1014	ethhdr = (struct ethhdr *)(skb->data + hdr_size);
1015
1016	if (ethhdr->h_proto != htons(ETH_P_ARP))
1017		goto out;
1018
1019	/* pull the ARP payload */
1020	if (unlikely(!pskb_may_pull(skb, hdr_size + ETH_HLEN +
1021				    arp_hdr_len(skb->dev))))
1022		goto out;
1023
1024	arphdr = (struct arphdr *)(skb->data + hdr_size + ETH_HLEN);
1025
1026	/* check whether the ARP packet carries a valid IP information */
1027	if (arphdr->ar_hrd != htons(ARPHRD_ETHER))
1028		goto out;
1029
1030	if (arphdr->ar_pro != htons(ETH_P_IP))
1031		goto out;
1032
1033	if (arphdr->ar_hln != ETH_ALEN)
1034		goto out;
1035
1036	if (arphdr->ar_pln != 4)
1037		goto out;
1038
1039	/* Check for bad reply/request. If the ARP message is not sane, DAT
1040	 * will simply ignore it
1041	 */
1042	ip_src = batadv_arp_ip_src(skb, hdr_size);
1043	ip_dst = batadv_arp_ip_dst(skb, hdr_size);
1044	if (ipv4_is_loopback(ip_src) || ipv4_is_multicast(ip_src) ||
1045	    ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst) ||
1046	    ipv4_is_zeronet(ip_src) || ipv4_is_lbcast(ip_src) ||
1047	    ipv4_is_zeronet(ip_dst) || ipv4_is_lbcast(ip_dst))
1048		goto out;
1049
1050	hw_src = batadv_arp_hw_src(skb, hdr_size);
1051	if (is_zero_ether_addr(hw_src) || is_multicast_ether_addr(hw_src))
1052		goto out;
1053
1054	/* don't care about the destination MAC address in ARP requests */
1055	if (arphdr->ar_op != htons(ARPOP_REQUEST)) {
1056		hw_dst = batadv_arp_hw_dst(skb, hdr_size);
1057		if (is_zero_ether_addr(hw_dst) ||
1058		    is_multicast_ether_addr(hw_dst))
1059			goto out;
1060	}
1061
1062	type = ntohs(arphdr->ar_op);
1063out:
1064	return type;
1065}
1066
1067/**
1068 * batadv_dat_get_vid() - extract the VLAN identifier from skb if any
1069 * @skb: the buffer containing the packet to extract the VID from
1070 * @hdr_size: the size of the batman-adv header encapsulating the packet
1071 *
1072 * Return: If the packet embedded in the skb is vlan tagged this function
1073 * returns the VID with the BATADV_VLAN_HAS_TAG flag. Otherwise BATADV_NO_FLAGS
1074 * is returned.
1075 */
1076static unsigned short batadv_dat_get_vid(struct sk_buff *skb, int *hdr_size)
1077{
1078	unsigned short vid;
1079
1080	vid = batadv_get_vid(skb, *hdr_size);
1081
1082	/* ARP parsing functions jump forward of hdr_size + ETH_HLEN.
1083	 * If the header contained in the packet is a VLAN one (which is longer)
1084	 * hdr_size is updated so that the functions will still skip the
1085	 * correct amount of bytes.
1086	 */
1087	if (vid & BATADV_VLAN_HAS_TAG)
1088		*hdr_size += VLAN_HLEN;
1089
1090	return vid;
1091}
1092
1093/**
1094 * batadv_dat_arp_create_reply() - create an ARP Reply
1095 * @bat_priv: the bat priv with all the soft interface information
1096 * @ip_src: ARP sender IP
1097 * @ip_dst: ARP target IP
1098 * @hw_src: Ethernet source and ARP sender MAC
1099 * @hw_dst: Ethernet destination and ARP target MAC
1100 * @vid: VLAN identifier (optional, set to zero otherwise)
1101 *
1102 * Creates an ARP Reply from the given values, optionally encapsulated in a
1103 * VLAN header.
1104 *
1105 * Return: An skb containing an ARP Reply.
1106 */
1107static struct sk_buff *
1108batadv_dat_arp_create_reply(struct batadv_priv *bat_priv, __be32 ip_src,
1109			    __be32 ip_dst, u8 *hw_src, u8 *hw_dst,
1110			    unsigned short vid)
1111{
1112	struct sk_buff *skb;
1113
1114	skb = arp_create(ARPOP_REPLY, ETH_P_ARP, ip_dst, bat_priv->soft_iface,
1115			 ip_src, hw_dst, hw_src, hw_dst);
1116	if (!skb)
1117		return NULL;
1118
1119	skb_reset_mac_header(skb);
1120
1121	if (vid & BATADV_VLAN_HAS_TAG)
1122		skb = vlan_insert_tag(skb, htons(ETH_P_8021Q),
1123				      vid & VLAN_VID_MASK);
1124
1125	return skb;
1126}
1127
1128/**
1129 * batadv_dat_snoop_outgoing_arp_request() - snoop the ARP request and try to
1130 * answer using DAT
1131 * @bat_priv: the bat priv with all the soft interface information
1132 * @skb: packet to check
1133 *
1134 * Return: true if the message has been sent to the dht candidates, false
1135 * otherwise. In case of a positive return value the message has to be enqueued
1136 * to permit the fallback.
1137 */
1138bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
1139					   struct sk_buff *skb)
1140{
1141	u16 type = 0;
1142	__be32 ip_dst, ip_src;
1143	u8 *hw_src;
1144	bool ret = false;
1145	struct batadv_dat_entry *dat_entry = NULL;
1146	struct sk_buff *skb_new;
1147	struct net_device *soft_iface = bat_priv->soft_iface;
1148	int hdr_size = 0;
1149	unsigned short vid;
1150
1151	if (!atomic_read(&bat_priv->distributed_arp_table))
1152		goto out;
1153
1154	vid = batadv_dat_get_vid(skb, &hdr_size);
1155
1156	type = batadv_arp_get_type(bat_priv, skb, hdr_size);
1157	/* If the node gets an ARP_REQUEST it has to send a DHT_GET unicast
1158	 * message to the selected DHT candidates
1159	 */
1160	if (type != ARPOP_REQUEST)
1161		goto out;
1162
1163	batadv_dbg_arp(bat_priv, skb, hdr_size, "Parsing outgoing ARP REQUEST");
1164
1165	ip_src = batadv_arp_ip_src(skb, hdr_size);
1166	hw_src = batadv_arp_hw_src(skb, hdr_size);
1167	ip_dst = batadv_arp_ip_dst(skb, hdr_size);
1168
1169	batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
1170
1171	dat_entry = batadv_dat_entry_hash_find(bat_priv, ip_dst, vid);
1172	if (dat_entry) {
1173		/* If the ARP request is destined for a local client the local
1174		 * client will answer itself. DAT would only generate a
1175		 * duplicate packet.
1176		 *
1177		 * Moreover, if the soft-interface is enslaved into a bridge, an
1178		 * additional DAT answer may trigger kernel warnings about
1179		 * a packet coming from the wrong port.
1180		 */
1181		if (batadv_is_my_client(bat_priv, dat_entry->mac_addr, vid)) {
1182			ret = true;
1183			goto out;
1184		}
1185
1186		/* If BLA is enabled, only send ARP replies if we have claimed
1187		 * the destination for the ARP request or if no one else of
1188		 * the backbone gws belonging to our backbone has claimed the
1189		 * destination.
1190		 */
1191		if (!batadv_bla_check_claim(bat_priv,
1192					    dat_entry->mac_addr, vid)) {
1193			batadv_dbg(BATADV_DBG_DAT, bat_priv,
1194				   "Device %pM claimed by another backbone gw. Don't send ARP reply!",
1195				   dat_entry->mac_addr);
1196			ret = true;
1197			goto out;
1198		}
1199
1200		skb_new = batadv_dat_arp_create_reply(bat_priv, ip_dst, ip_src,
1201						      dat_entry->mac_addr,
1202						      hw_src, vid);
1203		if (!skb_new)
1204			goto out;
1205
1206		skb_new->protocol = eth_type_trans(skb_new, soft_iface);
1207
1208		batadv_inc_counter(bat_priv, BATADV_CNT_RX);
1209		batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
1210				   skb->len + ETH_HLEN + hdr_size);
1211
1212		netif_rx(skb_new);
1213		batadv_dbg(BATADV_DBG_DAT, bat_priv, "ARP request replied locally\n");
1214		ret = true;
1215	} else {
1216		/* Send the request to the DHT */
1217		ret = batadv_dat_forward_data(bat_priv, skb, ip_dst, vid,
1218					      BATADV_P_DAT_DHT_GET);
1219	}
1220out:
1221	if (dat_entry)
1222		batadv_dat_entry_put(dat_entry);
1223	return ret;
1224}
1225
1226/**
1227 * batadv_dat_snoop_incoming_arp_request() - snoop the ARP request and try to
1228 * answer using the local DAT storage
1229 * @bat_priv: the bat priv with all the soft interface information
1230 * @skb: packet to check
1231 * @hdr_size: size of the encapsulation header
1232 *
1233 * Return: true if the request has been answered, false otherwise.
1234 */
1235bool batadv_dat_snoop_incoming_arp_request(struct batadv_priv *bat_priv,
1236					   struct sk_buff *skb, int hdr_size)
1237{
1238	u16 type;
1239	__be32 ip_src, ip_dst;
1240	u8 *hw_src;
1241	struct sk_buff *skb_new;
1242	struct batadv_dat_entry *dat_entry = NULL;
1243	bool ret = false;
1244	unsigned short vid;
1245	int err;
1246
1247	if (!atomic_read(&bat_priv->distributed_arp_table))
1248		goto out;
1249
1250	vid = batadv_dat_get_vid(skb, &hdr_size);
1251
1252	type = batadv_arp_get_type(bat_priv, skb, hdr_size);
1253	if (type != ARPOP_REQUEST)
1254		goto out;
1255
1256	hw_src = batadv_arp_hw_src(skb, hdr_size);
1257	ip_src = batadv_arp_ip_src(skb, hdr_size);
1258	ip_dst = batadv_arp_ip_dst(skb, hdr_size);
1259
1260	batadv_dbg_arp(bat_priv, skb, hdr_size, "Parsing incoming ARP REQUEST");
1261
1262	batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
1263
1264	dat_entry = batadv_dat_entry_hash_find(bat_priv, ip_dst, vid);
1265	if (!dat_entry)
1266		goto out;
1267
1268	skb_new = batadv_dat_arp_create_reply(bat_priv, ip_dst, ip_src,
1269					      dat_entry->mac_addr, hw_src, vid);
1270	if (!skb_new)
1271		goto out;
1272
1273	/* To preserve backwards compatibility, the node has choose the outgoing
1274	 * format based on the incoming request packet type. The assumption is
1275	 * that a node not using the 4addr packet format doesn't support it.
1276	 */
1277	if (hdr_size == sizeof(struct batadv_unicast_4addr_packet))
1278		err = batadv_send_skb_via_tt_4addr(bat_priv, skb_new,
1279						   BATADV_P_DAT_CACHE_REPLY,
1280						   NULL, vid);
1281	else
1282		err = batadv_send_skb_via_tt(bat_priv, skb_new, NULL, vid);
1283
1284	if (err != NET_XMIT_DROP) {
1285		batadv_inc_counter(bat_priv, BATADV_CNT_DAT_CACHED_REPLY_TX);
1286		ret = true;
1287	}
1288out:
1289	if (dat_entry)
1290		batadv_dat_entry_put(dat_entry);
1291	if (ret)
1292		kfree_skb(skb);
1293	return ret;
1294}
1295
1296/**
1297 * batadv_dat_snoop_outgoing_arp_reply() - snoop the ARP reply and fill the DHT
1298 * @bat_priv: the bat priv with all the soft interface information
1299 * @skb: packet to check
1300 */
1301void batadv_dat_snoop_outgoing_arp_reply(struct batadv_priv *bat_priv,
1302					 struct sk_buff *skb)
1303{
1304	u16 type;
1305	__be32 ip_src, ip_dst;
1306	u8 *hw_src, *hw_dst;
1307	int hdr_size = 0;
1308	unsigned short vid;
1309
1310	if (!atomic_read(&bat_priv->distributed_arp_table))
1311		return;
1312
1313	vid = batadv_dat_get_vid(skb, &hdr_size);
1314
1315	type = batadv_arp_get_type(bat_priv, skb, hdr_size);
1316	if (type != ARPOP_REPLY)
1317		return;
1318
1319	batadv_dbg_arp(bat_priv, skb, hdr_size, "Parsing outgoing ARP REPLY");
1320
1321	hw_src = batadv_arp_hw_src(skb, hdr_size);
1322	ip_src = batadv_arp_ip_src(skb, hdr_size);
1323	hw_dst = batadv_arp_hw_dst(skb, hdr_size);
1324	ip_dst = batadv_arp_ip_dst(skb, hdr_size);
1325
1326	batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
1327	batadv_dat_entry_add(bat_priv, ip_dst, hw_dst, vid);
1328
1329	/* Send the ARP reply to the candidates for both the IP addresses that
1330	 * the node obtained from the ARP reply
1331	 */
1332	batadv_dat_forward_data(bat_priv, skb, ip_src, vid,
1333				BATADV_P_DAT_DHT_PUT);
1334	batadv_dat_forward_data(bat_priv, skb, ip_dst, vid,
1335				BATADV_P_DAT_DHT_PUT);
1336}
1337
1338/**
1339 * batadv_dat_snoop_incoming_arp_reply() - snoop the ARP reply and fill the
1340 *  local DAT storage only
1341 * @bat_priv: the bat priv with all the soft interface information
1342 * @skb: packet to check
1343 * @hdr_size: size of the encapsulation header
1344 *
1345 * Return: true if the packet was snooped and consumed by DAT. False if the
1346 * packet has to be delivered to the interface
1347 */
1348bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
1349					 struct sk_buff *skb, int hdr_size)
1350{
1351	struct batadv_dat_entry *dat_entry = NULL;
1352	u16 type;
1353	__be32 ip_src, ip_dst;
1354	u8 *hw_src, *hw_dst;
1355	bool dropped = false;
1356	unsigned short vid;
1357
1358	if (!atomic_read(&bat_priv->distributed_arp_table))
1359		goto out;
1360
1361	vid = batadv_dat_get_vid(skb, &hdr_size);
1362
1363	type = batadv_arp_get_type(bat_priv, skb, hdr_size);
1364	if (type != ARPOP_REPLY)
1365		goto out;
1366
1367	batadv_dbg_arp(bat_priv, skb, hdr_size, "Parsing incoming ARP REPLY");
1368
1369	hw_src = batadv_arp_hw_src(skb, hdr_size);
1370	ip_src = batadv_arp_ip_src(skb, hdr_size);
1371	hw_dst = batadv_arp_hw_dst(skb, hdr_size);
1372	ip_dst = batadv_arp_ip_dst(skb, hdr_size);
1373
1374	/* If ip_dst is already in cache and has the right mac address,
1375	 * drop this frame if this ARP reply is destined for us because it's
1376	 * most probably an ARP reply generated by another node of the DHT.
1377	 * We have most probably received already a reply earlier. Delivering
1378	 * this frame would lead to doubled receive of an ARP reply.
1379	 */
1380	dat_entry = batadv_dat_entry_hash_find(bat_priv, ip_src, vid);
1381	if (dat_entry && batadv_compare_eth(hw_src, dat_entry->mac_addr)) {
1382		batadv_dbg(BATADV_DBG_DAT, bat_priv, "Doubled ARP reply removed: ARP MSG = [src: %pM-%pI4 dst: %pM-%pI4]; dat_entry: %pM-%pI4\n",
1383			   hw_src, &ip_src, hw_dst, &ip_dst,
1384			   dat_entry->mac_addr,	&dat_entry->ip);
1385		dropped = true;
1386	}
1387
1388	/* Update our internal cache with both the IP addresses the node got
1389	 * within the ARP reply
1390	 */
1391	batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
1392	batadv_dat_entry_add(bat_priv, ip_dst, hw_dst, vid);
1393
1394	if (dropped)
1395		goto out;
1396
1397	/* If BLA is enabled, only forward ARP replies if we have claimed the
1398	 * source of the ARP reply or if no one else of the same backbone has
1399	 * already claimed that client. This prevents that different gateways
1400	 * to the same backbone all forward the ARP reply leading to multiple
1401	 * replies in the backbone.
1402	 */
1403	if (!batadv_bla_check_claim(bat_priv, hw_src, vid)) {
1404		batadv_dbg(BATADV_DBG_DAT, bat_priv,
1405			   "Device %pM claimed by another backbone gw. Drop ARP reply.\n",
1406			   hw_src);
1407		dropped = true;
1408		goto out;
1409	}
1410
1411	/* if this REPLY is directed to a client of mine, let's deliver the
1412	 * packet to the interface
1413	 */
1414	dropped = !batadv_is_my_client(bat_priv, hw_dst, vid);
1415
1416	/* if this REPLY is sent on behalf of a client of mine, let's drop the
1417	 * packet because the client will reply by itself
1418	 */
1419	dropped |= batadv_is_my_client(bat_priv, hw_src, vid);
1420out:
1421	if (dropped)
1422		kfree_skb(skb);
1423	if (dat_entry)
1424		batadv_dat_entry_put(dat_entry);
1425	/* if dropped == false -> deliver to the interface */
1426	return dropped;
1427}
1428
1429/**
1430 * batadv_dat_check_dhcp_ipudp() - check skb for IP+UDP headers valid for DHCP
1431 * @skb: the packet to check
1432 * @ip_src: a buffer to store the IPv4 source address in
1433 *
1434 * Checks whether the given skb has an IP and UDP header valid for a DHCP
1435 * message from a DHCP server. And if so, stores the IPv4 source address in
1436 * the provided buffer.
1437 *
1438 * Return: True if valid, false otherwise.
1439 */
1440static bool
1441batadv_dat_check_dhcp_ipudp(struct sk_buff *skb, __be32 *ip_src)
1442{
1443	unsigned int offset = skb_network_offset(skb);
1444	struct udphdr *udphdr, _udphdr;
1445	struct iphdr *iphdr, _iphdr;
1446
1447	iphdr = skb_header_pointer(skb, offset, sizeof(_iphdr), &_iphdr);
1448	if (!iphdr || iphdr->version != 4 || iphdr->ihl * 4 < sizeof(_iphdr))
1449		return false;
1450
1451	if (iphdr->protocol != IPPROTO_UDP)
1452		return false;
1453
1454	offset += iphdr->ihl * 4;
1455	skb_set_transport_header(skb, offset);
1456
1457	udphdr = skb_header_pointer(skb, offset, sizeof(_udphdr), &_udphdr);
1458	if (!udphdr || udphdr->source != htons(67))
1459		return false;
1460
1461	*ip_src = get_unaligned(&iphdr->saddr);
1462
1463	return true;
1464}
1465
1466/**
1467 * batadv_dat_check_dhcp() - examine packet for valid DHCP message
1468 * @skb: the packet to check
1469 * @proto: ethernet protocol hint (behind a potential vlan)
1470 * @ip_src: a buffer to store the IPv4 source address in
1471 *
1472 * Checks whether the given skb is a valid DHCP packet. And if so, stores the
1473 * IPv4 source address in the provided buffer.
1474 *
1475 * Caller needs to ensure that the skb network header is set correctly.
1476 *
1477 * Return: If skb is a valid DHCP packet, then returns its op code
1478 * (e.g. BOOTREPLY vs. BOOTREQUEST). Otherwise returns -EINVAL.
1479 */
1480static int
1481batadv_dat_check_dhcp(struct sk_buff *skb, __be16 proto, __be32 *ip_src)
1482{
1483	__be32 *magic, _magic;
1484	unsigned int offset;
1485	struct {
1486		__u8 op;
1487		__u8 htype;
1488		__u8 hlen;
1489		__u8 hops;
1490	} *dhcp_h, _dhcp_h;
1491
1492	if (proto != htons(ETH_P_IP))
1493		return -EINVAL;
1494
1495	if (!batadv_dat_check_dhcp_ipudp(skb, ip_src))
1496		return -EINVAL;
1497
1498	offset = skb_transport_offset(skb) + sizeof(struct udphdr);
1499	if (skb->len < offset + sizeof(struct batadv_dhcp_packet))
1500		return -EINVAL;
1501
1502	dhcp_h = skb_header_pointer(skb, offset, sizeof(_dhcp_h), &_dhcp_h);
1503	if (!dhcp_h || dhcp_h->htype != BATADV_HTYPE_ETHERNET ||
1504	    dhcp_h->hlen != ETH_ALEN)
1505		return -EINVAL;
1506
1507	offset += offsetof(struct batadv_dhcp_packet, magic);
1508
1509	magic = skb_header_pointer(skb, offset, sizeof(_magic), &_magic);
1510	if (!magic || get_unaligned(magic) != htonl(BATADV_DHCP_MAGIC))
1511		return -EINVAL;
1512
1513	return dhcp_h->op;
1514}
1515
1516/**
1517 * batadv_dat_get_dhcp_message_type() - get message type of a DHCP packet
1518 * @skb: the DHCP packet to parse
1519 *
1520 * Iterates over the DHCP options of the given DHCP packet to find a
1521 * DHCP Message Type option and parse it.
1522 *
1523 * Caller needs to ensure that the given skb is a valid DHCP packet and
1524 * that the skb transport header is set correctly.
1525 *
1526 * Return: The found DHCP message type value, if found. -EINVAL otherwise.
1527 */
1528static int batadv_dat_get_dhcp_message_type(struct sk_buff *skb)
1529{
1530	unsigned int offset = skb_transport_offset(skb) + sizeof(struct udphdr);
1531	u8 *type, _type;
1532	struct {
1533		u8 type;
1534		u8 len;
1535	} *tl, _tl;
1536
1537	offset += sizeof(struct batadv_dhcp_packet);
1538
1539	while ((tl = skb_header_pointer(skb, offset, sizeof(_tl), &_tl))) {
1540		if (tl->type == BATADV_DHCP_OPT_MSG_TYPE)
1541			break;
1542
1543		if (tl->type == BATADV_DHCP_OPT_END)
1544			break;
1545
1546		if (tl->type == BATADV_DHCP_OPT_PAD)
1547			offset++;
1548		else
1549			offset += tl->len + sizeof(_tl);
1550	}
1551
1552	/* Option Overload Code not supported */
1553	if (!tl || tl->type != BATADV_DHCP_OPT_MSG_TYPE ||
1554	    tl->len != sizeof(_type))
1555		return -EINVAL;
1556
1557	offset += sizeof(_tl);
1558
1559	type = skb_header_pointer(skb, offset, sizeof(_type), &_type);
1560	if (!type)
1561		return -EINVAL;
1562
1563	return *type;
1564}
1565
1566/**
1567 * batadv_dat_dhcp_get_yiaddr() - get yiaddr from a DHCP packet
1568 * @skb: the DHCP packet to parse
1569 * @buf: a buffer to store the yiaddr in
1570 *
1571 * Caller needs to ensure that the given skb is a valid DHCP packet and
1572 * that the skb transport header is set correctly.
1573 *
1574 * Return: True on success, false otherwise.
1575 */
1576static bool batadv_dat_dhcp_get_yiaddr(struct sk_buff *skb, __be32 *buf)
1577{
1578	unsigned int offset = skb_transport_offset(skb) + sizeof(struct udphdr);
1579	__be32 *yiaddr;
1580
1581	offset += offsetof(struct batadv_dhcp_packet, yiaddr);
1582	yiaddr = skb_header_pointer(skb, offset, BATADV_DHCP_YIADDR_LEN, buf);
1583
1584	if (!yiaddr)
1585		return false;
1586
1587	if (yiaddr != buf)
1588		*buf = get_unaligned(yiaddr);
1589
1590	return true;
1591}
1592
1593/**
1594 * batadv_dat_get_dhcp_chaddr() - get chaddr from a DHCP packet
1595 * @skb: the DHCP packet to parse
1596 * @buf: a buffer to store the chaddr in
1597 *
1598 * Caller needs to ensure that the given skb is a valid DHCP packet and
1599 * that the skb transport header is set correctly.
1600 *
1601 * Return: True on success, false otherwise
1602 */
1603static bool batadv_dat_get_dhcp_chaddr(struct sk_buff *skb, u8 *buf)
1604{
1605	unsigned int offset = skb_transport_offset(skb) + sizeof(struct udphdr);
1606	u8 *chaddr;
1607
1608	offset += offsetof(struct batadv_dhcp_packet, chaddr);
1609	chaddr = skb_header_pointer(skb, offset, BATADV_DHCP_CHADDR_LEN, buf);
1610
1611	if (!chaddr)
1612		return false;
1613
1614	if (chaddr != buf)
1615		memcpy(buf, chaddr, BATADV_DHCP_CHADDR_LEN);
1616
1617	return true;
1618}
1619
1620/**
1621 * batadv_dat_put_dhcp() - puts addresses from a DHCP packet into the DHT and
1622 *  DAT cache
1623 * @bat_priv: the bat priv with all the soft interface information
1624 * @chaddr: the DHCP client MAC address
1625 * @yiaddr: the DHCP client IP address
1626 * @hw_dst: the DHCP server MAC address
1627 * @ip_dst: the DHCP server IP address
1628 * @vid: VLAN identifier
1629 *
1630 * Adds given MAC/IP pairs to the local DAT cache and propagates them further
1631 * into the DHT.
1632 *
1633 * For the DHT propagation, client MAC + IP will appear as the ARP Reply
1634 * transmitter (and hw_dst/ip_dst as the target).
1635 */
1636static void batadv_dat_put_dhcp(struct batadv_priv *bat_priv, u8 *chaddr,
1637				__be32 yiaddr, u8 *hw_dst, __be32 ip_dst,
1638				unsigned short vid)
1639{
1640	struct sk_buff *skb;
1641
1642	skb = batadv_dat_arp_create_reply(bat_priv, yiaddr, ip_dst, chaddr,
1643					  hw_dst, vid);
1644	if (!skb)
1645		return;
1646
1647	skb_set_network_header(skb, ETH_HLEN);
1648
1649	batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
1650	batadv_dat_entry_add(bat_priv, ip_dst, hw_dst, vid);
1651
1652	batadv_dat_forward_data(bat_priv, skb, yiaddr, vid,
1653				BATADV_P_DAT_DHT_PUT);
1654	batadv_dat_forward_data(bat_priv, skb, ip_dst, vid,
1655				BATADV_P_DAT_DHT_PUT);
1656
1657	consume_skb(skb);
1658
1659	batadv_dbg(BATADV_DBG_DAT, bat_priv,
1660		   "Snooped from outgoing DHCPACK (server address): %pI4, %pM (vid: %i)\n",
1661		   &ip_dst, hw_dst, batadv_print_vid(vid));
1662	batadv_dbg(BATADV_DBG_DAT, bat_priv,
1663		   "Snooped from outgoing DHCPACK (client address): %pI4, %pM (vid: %i)\n",
1664		   &yiaddr, chaddr, batadv_print_vid(vid));
1665}
1666
1667/**
1668 * batadv_dat_check_dhcp_ack() - examine packet for valid DHCP message
1669 * @skb: the packet to check
1670 * @proto: ethernet protocol hint (behind a potential vlan)
1671 * @ip_src: a buffer to store the IPv4 source address in
1672 * @chaddr: a buffer to store the DHCP Client Hardware Address in
1673 * @yiaddr: a buffer to store the DHCP Your IP Address in
1674 *
1675 * Checks whether the given skb is a valid DHCPACK. And if so, stores the
1676 * IPv4 server source address (ip_src), client MAC address (chaddr) and client
1677 * IPv4 address (yiaddr) in the provided buffers.
1678 *
1679 * Caller needs to ensure that the skb network header is set correctly.
1680 *
1681 * Return: True if the skb is a valid DHCPACK. False otherwise.
1682 */
1683static bool
1684batadv_dat_check_dhcp_ack(struct sk_buff *skb, __be16 proto, __be32 *ip_src,
1685			  u8 *chaddr, __be32 *yiaddr)
1686{
1687	int type;
1688
1689	type = batadv_dat_check_dhcp(skb, proto, ip_src);
1690	if (type != BATADV_BOOTREPLY)
1691		return false;
1692
1693	type = batadv_dat_get_dhcp_message_type(skb);
1694	if (type != BATADV_DHCPACK)
1695		return false;
1696
1697	if (!batadv_dat_dhcp_get_yiaddr(skb, yiaddr))
1698		return false;
1699
1700	if (!batadv_dat_get_dhcp_chaddr(skb, chaddr))
1701		return false;
1702
1703	return true;
1704}
1705
1706/**
1707 * batadv_dat_snoop_outgoing_dhcp_ack() - snoop DHCPACK and fill DAT with it
1708 * @bat_priv: the bat priv with all the soft interface information
1709 * @skb: the packet to snoop
1710 * @proto: ethernet protocol hint (behind a potential vlan)
1711 * @vid: VLAN identifier
1712 *
1713 * This function first checks whether the given skb is a valid DHCPACK. If
1714 * so then its source MAC and IP as well as its DHCP Client Hardware Address
1715 * field and DHCP Your IP Address field are added to the local DAT cache and
1716 * propagated into the DHT.
1717 *
1718 * Caller needs to ensure that the skb mac and network headers are set
1719 * correctly.
1720 */
1721void batadv_dat_snoop_outgoing_dhcp_ack(struct batadv_priv *bat_priv,
1722					struct sk_buff *skb,
1723					__be16 proto,
1724					unsigned short vid)
1725{
1726	u8 chaddr[BATADV_DHCP_CHADDR_LEN];
1727	__be32 ip_src, yiaddr;
1728
1729	if (!atomic_read(&bat_priv->distributed_arp_table))
1730		return;
1731
1732	if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
1733		return;
1734
1735	batadv_dat_put_dhcp(bat_priv, chaddr, yiaddr, eth_hdr(skb)->h_source,
1736			    ip_src, vid);
1737}
1738
1739/**
1740 * batadv_dat_snoop_incoming_dhcp_ack() - snoop DHCPACK and fill DAT cache
1741 * @bat_priv: the bat priv with all the soft interface information
1742 * @skb: the packet to snoop
1743 * @hdr_size: header size, up to the tail of the batman-adv header
1744 *
1745 * This function first checks whether the given skb is a valid DHCPACK. If
1746 * so then its source MAC and IP as well as its DHCP Client Hardware Address
1747 * field and DHCP Your IP Address field are added to the local DAT cache.
1748 */
1749void batadv_dat_snoop_incoming_dhcp_ack(struct batadv_priv *bat_priv,
1750					struct sk_buff *skb, int hdr_size)
1751{
1752	u8 chaddr[BATADV_DHCP_CHADDR_LEN];
1753	struct ethhdr *ethhdr;
1754	__be32 ip_src, yiaddr;
1755	unsigned short vid;
1756	__be16 proto;
1757	u8 *hw_src;
1758
1759	if (!atomic_read(&bat_priv->distributed_arp_table))
1760		return;
1761
1762	if (unlikely(!pskb_may_pull(skb, hdr_size + ETH_HLEN)))
1763		return;
1764
1765	ethhdr = (struct ethhdr *)(skb->data + hdr_size);
1766	skb_set_network_header(skb, hdr_size + ETH_HLEN);
1767	proto = ethhdr->h_proto;
1768
1769	if (!batadv_dat_check_dhcp_ack(skb, proto, &ip_src, chaddr, &yiaddr))
1770		return;
1771
1772	hw_src = ethhdr->h_source;
1773	vid = batadv_dat_get_vid(skb, &hdr_size);
1774
1775	batadv_dat_entry_add(bat_priv, yiaddr, chaddr, vid);
1776	batadv_dat_entry_add(bat_priv, ip_src, hw_src, vid);
1777
1778	batadv_dbg(BATADV_DBG_DAT, bat_priv,
1779		   "Snooped from incoming DHCPACK (server address): %pI4, %pM (vid: %i)\n",
1780		   &ip_src, hw_src, batadv_print_vid(vid));
1781	batadv_dbg(BATADV_DBG_DAT, bat_priv,
1782		   "Snooped from incoming DHCPACK (client address): %pI4, %pM (vid: %i)\n",
1783		   &yiaddr, chaddr, batadv_print_vid(vid));
1784}
1785
1786/**
1787 * batadv_dat_drop_broadcast_packet() - check if an ARP request has to be
1788 *  dropped (because the node has already obtained the reply via DAT) or not
1789 * @bat_priv: the bat priv with all the soft interface information
1790 * @forw_packet: the broadcast packet
1791 *
1792 * Return: true if the node can drop the packet, false otherwise.
1793 */
1794bool batadv_dat_drop_broadcast_packet(struct batadv_priv *bat_priv,
1795				      struct batadv_forw_packet *forw_packet)
1796{
1797	u16 type;
1798	__be32 ip_dst;
1799	struct batadv_dat_entry *dat_entry = NULL;
1800	bool ret = false;
1801	int hdr_size = sizeof(struct batadv_bcast_packet);
1802	unsigned short vid;
1803
1804	if (!atomic_read(&bat_priv->distributed_arp_table))
1805		goto out;
1806
1807	/* If this packet is an ARP_REQUEST and the node already has the
1808	 * information that it is going to ask, then the packet can be dropped
1809	 */
1810	if (batadv_forw_packet_is_rebroadcast(forw_packet))
1811		goto out;
1812
1813	vid = batadv_dat_get_vid(forw_packet->skb, &hdr_size);
1814
1815	type = batadv_arp_get_type(bat_priv, forw_packet->skb, hdr_size);
1816	if (type != ARPOP_REQUEST)
1817		goto out;
1818
1819	ip_dst = batadv_arp_ip_dst(forw_packet->skb, hdr_size);
1820	dat_entry = batadv_dat_entry_hash_find(bat_priv, ip_dst, vid);
1821	/* check if the node already got this entry */
1822	if (!dat_entry) {
1823		batadv_dbg(BATADV_DBG_DAT, bat_priv,
1824			   "ARP Request for %pI4: fallback\n", &ip_dst);
1825		goto out;
1826	}
1827
1828	batadv_dbg(BATADV_DBG_DAT, bat_priv,
1829		   "ARP Request for %pI4: fallback prevented\n", &ip_dst);
1830	ret = true;
1831
1832out:
1833	if (dat_entry)
1834		batadv_dat_entry_put(dat_entry);
1835	return ret;
1836}