icmp: ICMPV6: Examine invoking packet for Segment Route Headers.

RFC8754 says:

ICMP error packets generated within the SR domain are sent to source
nodes within the SR domain.  The invoking packet in the ICMP error
message may contain an SRH.  Since the destination address of a packet
with an SRH changes as each segment is processed, it may not be the
destination used by the socket or application that generated the
invoking packet.

For the source of an invoking packet to process the ICMP error
message, the ultimate destination address of the IPv6 header may be
required.  The following logic is used to determine the destination
address for use by protocol-error handlers.

*  Walk all extension headers of the invoking IPv6 packet to the
   routing extension header preceding the upper-layer header.

   -  If routing header is type 4 Segment Routing Header (SRH)

      o  The SID at Segment List[0] may be used as the destination
         address of the invoking packet.

Mangle the skb so the network header points to the invoking packet
inside the ICMP packet. The seg6 helpers can then be used on the skb
to find any segment routing headers. If found, mark this fact in the
IPv6 control block of the skb, and store the offset into the packet of
the SRH. Then restore the skb back to its old state.

Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 20c1f968da7c1223a9721deb88f94175bc718389..a59d25f1938571e6836f743f0989187e6df9426b 100644 (file)
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -133,6 +133,7 @@ struct inet6_skb_parm {
        __u16                   dsthao;
 #endif
        __u16                   frag_max_size;
+       __u16                   srhoff;
 
 #define IP6SKB_XFRM_TRANSFORMED        1
 #define IP6SKB_FORWARDED       2
@@ -142,6 +143,7 @@ struct inet6_skb_parm {
 #define IP6SKB_HOPBYHOP        32
 #define IP6SKB_L3SLAVE         64
 #define IP6SKB_JUMBOGRAM      128
+#define IP6SKB_SEG6          256
 };
 
 #if defined(CONFIG_NET_L3_MASTER_DEV)

diff --git a/include/net/seg6.h b/include/net/seg6.h
index a6f25983670aa9eaf20bcf7788c2cb6b9c2d5411..02b0cd305787656f372a2af8d414d3c9b6f46fb8 100644 (file)
--- a/include/net/seg6.h
+++ b/include/net/seg6.h
@@ -59,6 +59,7 @@ extern void seg6_local_exit(void);
 
 extern bool seg6_validate_srh(struct ipv6_sr_hdr *srh, int len, bool reduced);
 extern struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb, int flags);
+extern void seg6_icmp_srh(struct sk_buff *skb, struct inet6_skb_parm *opt);
 extern int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh,
                             int proto);
 extern int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh);

diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index a7c31ab67c5d6a8d8bea964af45e821861c28171..96c5cc0f30cebb02280a8384e34234701989f0d6 100644 (file)
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -57,6 +57,7 @@
 #include <net/protocol.h>
 #include <net/raw.h>
 #include <net/rawv6.h>
+#include <net/seg6.h>
 #include <net/transp_v6.h>
 #include <net/ip6_route.h>
 #include <net/addrconf.h>
@@ -820,6 +821,7 @@ out_bh_enable:
 
 void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 {
+       struct inet6_skb_parm *opt = IP6CB(skb);
        const struct inet6_protocol *ipprot;
        int inner_offset;
        __be16 frag_off;
@@ -829,6 +831,8 @@ void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                goto out;
 
+       seg6_icmp_srh(skb, opt);
+
        nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
        if (ipv6_ext_hdr(nexthdr)) {
                /* now skip over extension headers */
@@ -853,7 +857,7 @@ void icmpv6_notify(struct sk_buff *skb, u8 type, u8 code, __be32 info)
 
        ipprot = rcu_dereference(inet6_protos[nexthdr]);
        if (ipprot && ipprot->err_handler)
-               ipprot->err_handler(skb, NULL, type, code, inner_offset, info);
+               ipprot->err_handler(skb, opt, type, code, inner_offset, info);
 
        raw6_icmp_error(skb, nexthdr, type, code, inner_offset, info);
        return;

diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 5bc9bf89219925eaadea842eea77ff5747cee519..73aaabf0e966551a1b1e12b12888475a13dbf74b 100644 (file)
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -104,6 +104,36 @@ struct ipv6_sr_hdr *seg6_get_srh(struct sk_buff *skb, int flags)
        return srh;
 }
 
+/* Determine if an ICMP invoking packet contains a segment routing
+ * header.  If it does, extract the offset to the true destination
+ * address, which is in the first segment address.
+ */
+void seg6_icmp_srh(struct sk_buff *skb, struct inet6_skb_parm *opt)
+{
+       __u16 network_header = skb->network_header;
+       struct ipv6_sr_hdr *srh;
+
+       /* Update network header to point to the invoking packet
+        * inside the ICMP packet, so we can use the seg6_get_srh()
+        * helper.
+        */
+       skb_reset_network_header(skb);
+
+       srh = seg6_get_srh(skb, 0);
+       if (!srh)
+               goto out;
+
+       if (srh->type != IPV6_SRCRT_TYPE_4)
+               goto out;
+
+       opt->flags |= IP6SKB_SEG6;
+       opt->srhoff = (unsigned char *)srh - skb->data;
+
+out:
+       /* Restore the network header back to the ICMP packet */
+       skb->network_header = network_header;
+}
+
 static struct genl_family seg6_genl_family;
 
 static const struct nla_policy seg6_genl_policy[SEG6_ATTR_MAX + 1] = {