projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ip_gre: make ipgre_tunnel_xmit() not parse network header as IP unconditionally
[deliverable/linux.git] / net / ipv4 / ip_gre.c
1 /*
2 * Linux NET3: GRE over IP protocol decoder.
3 *
4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15 #include <linux/capability.h>
16 #include <linux/module.h>
17 #include <linux/types.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
20 #include <asm/uaccess.h>
21 #include <linux/skbuff.h>
22 #include <linux/netdevice.h>
23 #include <linux/in.h>
24 #include <linux/tcp.h>
25 #include <linux/udp.h>
26 #include <linux/if_arp.h>
27 #include <linux/mroute.h>
28 #include <linux/init.h>
29 #include <linux/in6.h>
30 #include <linux/inetdevice.h>
31 #include <linux/igmp.h>
32 #include <linux/netfilter_ipv4.h>
33 #include <linux/etherdevice.h>
34 #include <linux/if_ether.h>
35
36 #include <net/sock.h>
37 #include <net/ip.h>
38 #include <net/icmp.h>
39 #include <net/protocol.h>
40 #include <net/ipip.h>
41 #include <net/arp.h>
42 #include <net/checksum.h>
43 #include <net/dsfield.h>
44 #include <net/inet_ecn.h>
45 #include <net/xfrm.h>
46 #include <net/net_namespace.h>
47 #include <net/netns/generic.h>
48 #include <net/rtnetlink.h>
49 #include <net/gre.h>
50
51 #if IS_ENABLED(CONFIG_IPV6)
52 #include <net/ipv6.h>
53 #include <net/ip6_fib.h>
54 #include <net/ip6_route.h>
55 #endif
56
57 /*
58 Problems & solutions
59 --------------------
60
61 1. The most important issue is detecting local dead loops.
62 They would cause complete host lockup in transmit, which
63 would be "resolved" by stack overflow or, if queueing is enabled,
64 with infinite looping in net_bh.
65
66 We cannot track such dead loops during route installation,
67 it is infeasible task. The most general solutions would be
68 to keep skb->encapsulation counter (sort of local ttl),
69 and silently drop packet when it expires. It is a good
70 solution, but it supposes maintaining new variable in ALL
71 skb, even if no tunneling is used.
72
73 Current solution: xmit_recursion breaks dead loops. This is a percpu
74 counter, since when we enter the first ndo_xmit(), cpu migration is
75 forbidden. We force an exit if this counter reaches RECURSION_LIMIT
76
77 2. Networking dead loops would not kill routers, but would really
78 kill network. IP hop limit plays role of "t->recursion" in this case,
79 if we copy it from packet being encapsulated to upper header.
80 It is very good solution, but it introduces two problems:
81
82 - Routing protocols, using packets with ttl=1 (OSPF, RIP2),
83 do not work over tunnels.
84 - traceroute does not work. I planned to relay ICMP from tunnel,
85 so that this problem would be solved and traceroute output
86 would even more informative. This idea appeared to be wrong:
87 only Linux complies to rfc1812 now (yes, guys, Linux is the only
88 true router now :-)), all routers (at least, in neighbourhood of mine)
89 return only 8 bytes of payload. It is the end.
90
91 Hence, if we want that OSPF worked or traceroute said something reasonable,
92 we should search for another solution.
93
94 One of them is to parse packet trying to detect inner encapsulation
95 made by our node. It is difficult or even impossible, especially,
96 taking into account fragmentation. TO be short, ttl is not solution at all.
97
98 Current solution: The solution was UNEXPECTEDLY SIMPLE.
99 We force DF flag on tunnels with preconfigured hop limit,
100 that is ALL. :-) Well, it does not remove the problem completely,
101 but exponential growth of network traffic is changed to linear
102 (branches, that exceed pmtu are pruned) and tunnel mtu
103 rapidly degrades to value <68, where looping stops.
104 Yes, it is not good if there exists a router in the loop,
105 which does not force DF, even when encapsulating packets have DF set.
106 But it is not our problem! Nobody could accuse us, we made
107 all that we could make. Even if it is your gated who injected
108 fatal route to network, even if it were you who configured
109 fatal static route: you are innocent. :-)
110
111
112
113 3. Really, ipv4/ipip.c, ipv4/ip_gre.c and ipv6/sit.c contain
114 practically identical code. It would be good to glue them
115 together, but it is not very evident, how to make them modular.
116 sit is integral part of IPv6, ipip and gre are naturally modular.
117 We could extract common parts (hash table, ioctl etc)
118 to a separate module (ip_tunnel.c).
119
120 Alexey Kuznetsov.
121 */
122
123 static bool log_ecn_error = true;
124 module_param(log_ecn_error, bool, 0644);
125 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
126
127 static struct rtnl_link_ops ipgre_link_ops __read_mostly;
128 static int ipgre_tunnel_init(struct net_device *dev);
129 static void ipgre_tunnel_setup(struct net_device *dev);
130 static int ipgre_tunnel_bind_dev(struct net_device *dev);
131
132 /* Fallback tunnel: no source, no destination, no key, no options */
133
134 #define HASH_SIZE 16
135
136 static int ipgre_net_id __read_mostly;
137 struct ipgre_net {
138 struct ip_tunnel __rcu *tunnels[4][HASH_SIZE];
139
140 struct net_device *fb_tunnel_dev;
141 };
142
143 /* Tunnel hash table */
144
145 /*
146 4 hash tables:
147
148 3: (remote,local)
149 2: (remote,*)
150 1: (*,local)
151 0: (*,*)
152
153 We require exact key match i.e. if a key is present in packet
154 it will match only tunnel with the same key; if it is not present,
155 it will match only keyless tunnel.
156
157 All keysless packets, if not matched configured keyless tunnels
158 will match fallback tunnel.
159 */
160
161 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
162
163 #define tunnels_r_l tunnels[3]
164 #define tunnels_r tunnels[2]
165 #define tunnels_l tunnels[1]
166 #define tunnels_wc tunnels[0]
167
168 static struct rtnl_link_stats64 *ipgre_get_stats64(struct net_device *dev,
169 struct rtnl_link_stats64 *tot)
170 {
171 int i;
172
173 for_each_possible_cpu(i) {
174 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
175 u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
176 unsigned int start;
177
178 do {
179 start = u64_stats_fetch_begin_bh(&tstats->syncp);
180 rx_packets = tstats->rx_packets;
181 tx_packets = tstats->tx_packets;
182 rx_bytes = tstats->rx_bytes;
183 tx_bytes = tstats->tx_bytes;
184 } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
185
186 tot->rx_packets += rx_packets;
187 tot->tx_packets += tx_packets;
188 tot->rx_bytes += rx_bytes;
189 tot->tx_bytes += tx_bytes;
190 }
191
192 tot->multicast = dev->stats.multicast;
193 tot->rx_crc_errors = dev->stats.rx_crc_errors;
194 tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
195 tot->rx_length_errors = dev->stats.rx_length_errors;
196 tot->rx_frame_errors = dev->stats.rx_frame_errors;
197 tot->rx_errors = dev->stats.rx_errors;
198
199 tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
200 tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
201 tot->tx_dropped = dev->stats.tx_dropped;
202 tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
203 tot->tx_errors = dev->stats.tx_errors;
204
205 return tot;
206 }
207
208 /* Does key in tunnel parameters match packet */
209 static bool ipgre_key_match(const struct ip_tunnel_parm *p,
210 __be16 flags, __be32 key)
211 {
212 if (p->i_flags & GRE_KEY) {
213 if (flags & GRE_KEY)
214 return key == p->i_key;
215 else
216 return false; /* key expected, none present */
217 } else
218 return !(flags & GRE_KEY);
219 }
220
221 /* Given src, dst and key, find appropriate for input tunnel. */
222
223 static struct ip_tunnel *ipgre_tunnel_lookup(struct net_device *dev,
224 __be32 remote, __be32 local,
225 __be16 flags, __be32 key,
226 __be16 gre_proto)
227 {
228 struct net *net = dev_net(dev);
229 int link = dev->ifindex;
230 unsigned int h0 = HASH(remote);
231 unsigned int h1 = HASH(key);
232 struct ip_tunnel *t, *cand = NULL;
233 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
234 int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
235 ARPHRD_ETHER : ARPHRD_IPGRE;
236 int score, cand_score = 4;
237
238 for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
239 if (local != t->parms.iph.saddr ||
240 remote != t->parms.iph.daddr ||
241 !(t->dev->flags & IFF_UP))
242 continue;
243
244 if (!ipgre_key_match(&t->parms, flags, key))
245 continue;
246
247 if (t->dev->type != ARPHRD_IPGRE &&
248 t->dev->type != dev_type)
249 continue;
250
251 score = 0;
252 if (t->parms.link != link)
253 score |= 1;
254 if (t->dev->type != dev_type)
255 score |= 2;
256 if (score == 0)
257 return t;
258
259 if (score < cand_score) {
260 cand = t;
261 cand_score = score;
262 }
263 }
264
265 for_each_ip_tunnel_rcu(t, ign->tunnels_r[h0 ^ h1]) {
266 if (remote != t->parms.iph.daddr ||
267 !(t->dev->flags & IFF_UP))
268 continue;
269
270 if (!ipgre_key_match(&t->parms, flags, key))
271 continue;
272
273 if (t->dev->type != ARPHRD_IPGRE &&
274 t->dev->type != dev_type)
275 continue;
276
277 score = 0;
278 if (t->parms.link != link)
279 score |= 1;
280 if (t->dev->type != dev_type)
281 score |= 2;
282 if (score == 0)
283 return t;
284
285 if (score < cand_score) {
286 cand = t;
287 cand_score = score;
288 }
289 }
290
291 for_each_ip_tunnel_rcu(t, ign->tunnels_l[h1]) {
292 if ((local != t->parms.iph.saddr &&
293 (local != t->parms.iph.daddr ||
294 !ipv4_is_multicast(local))) ||
295 !(t->dev->flags & IFF_UP))
296 continue;
297
298 if (!ipgre_key_match(&t->parms, flags, key))
299 continue;
300
301 if (t->dev->type != ARPHRD_IPGRE &&
302 t->dev->type != dev_type)
303 continue;
304
305 score = 0;
306 if (t->parms.link != link)
307 score |= 1;
308 if (t->dev->type != dev_type)
309 score |= 2;
310 if (score == 0)
311 return t;
312
313 if (score < cand_score) {
314 cand = t;
315 cand_score = score;
316 }
317 }
318
319 for_each_ip_tunnel_rcu(t, ign->tunnels_wc[h1]) {
320 if (t->parms.i_key != key ||
321 !(t->dev->flags & IFF_UP))
322 continue;
323
324 if (t->dev->type != ARPHRD_IPGRE &&
325 t->dev->type != dev_type)
326 continue;
327
328 score = 0;
329 if (t->parms.link != link)
330 score |= 1;
331 if (t->dev->type != dev_type)
332 score |= 2;
333 if (score == 0)
334 return t;
335
336 if (score < cand_score) {
337 cand = t;
338 cand_score = score;
339 }
340 }
341
342 if (cand != NULL)
343 return cand;
344
345 dev = ign->fb_tunnel_dev;
346 if (dev->flags & IFF_UP)
347 return netdev_priv(dev);
348
349 return NULL;
350 }
351
352 static struct ip_tunnel __rcu **__ipgre_bucket(struct ipgre_net *ign,
353 struct ip_tunnel_parm *parms)
354 {
355 __be32 remote = parms->iph.daddr;
356 __be32 local = parms->iph.saddr;
357 __be32 key = parms->i_key;
358 unsigned int h = HASH(key);
359 int prio = 0;
360
361 if (local)
362 prio |= 1;
363 if (remote && !ipv4_is_multicast(remote)) {
364 prio |= 2;
365 h ^= HASH(remote);
366 }
367
368 return &ign->tunnels[prio][h];
369 }
370
371 static inline struct ip_tunnel __rcu **ipgre_bucket(struct ipgre_net *ign,
372 struct ip_tunnel *t)
373 {
374 return __ipgre_bucket(ign, &t->parms);
375 }
376
377 static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
378 {
379 struct ip_tunnel __rcu **tp = ipgre_bucket(ign, t);
380
381 rcu_assign_pointer(t->next, rtnl_dereference(*tp));
382 rcu_assign_pointer(*tp, t);
383 }
384
385 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
386 {
387 struct ip_tunnel __rcu **tp;
388 struct ip_tunnel *iter;
389
390 for (tp = ipgre_bucket(ign, t);
391 (iter = rtnl_dereference(*tp)) != NULL;
392 tp = &iter->next) {
393 if (t == iter) {
394 rcu_assign_pointer(*tp, t->next);
395 break;
396 }
397 }
398 }
399
400 static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
401 struct ip_tunnel_parm *parms,
402 int type)
403 {
404 __be32 remote = parms->iph.daddr;
405 __be32 local = parms->iph.saddr;
406 __be32 key = parms->i_key;
407 int link = parms->link;
408 struct ip_tunnel *t;
409 struct ip_tunnel __rcu **tp;
410 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
411
412 for (tp = __ipgre_bucket(ign, parms);
413 (t = rtnl_dereference(*tp)) != NULL;
414 tp = &t->next)
415 if (local == t->parms.iph.saddr &&
416 remote == t->parms.iph.daddr &&
417 key == t->parms.i_key &&
418 link == t->parms.link &&
419 type == t->dev->type)
420 break;
421
422 return t;
423 }
424
425 static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
426 struct ip_tunnel_parm *parms, int create)
427 {
428 struct ip_tunnel *t, *nt;
429 struct net_device *dev;
430 char name[IFNAMSIZ];
431 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
432
433 t = ipgre_tunnel_find(net, parms, ARPHRD_IPGRE);
434 if (t || !create)
435 return t;
436
437 if (parms->name[0])
438 strlcpy(name, parms->name, IFNAMSIZ);
439 else
440 strcpy(name, "gre%d");
441
442 dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
443 if (!dev)
444 return NULL;
445
446 dev_net_set(dev, net);
447
448 nt = netdev_priv(dev);
449 nt->parms = *parms;
450 dev->rtnl_link_ops = &ipgre_link_ops;
451
452 dev->mtu = ipgre_tunnel_bind_dev(dev);
453
454 if (register_netdevice(dev) < 0)
455 goto failed_free;
456
457 /* Can use a lockless transmit, unless we generate output sequences */
458 if (!(nt->parms.o_flags & GRE_SEQ))
459 dev->features |= NETIF_F_LLTX;
460
461 dev_hold(dev);
462 ipgre_tunnel_link(ign, nt);
463 return nt;
464
465 failed_free:
466 free_netdev(dev);
467 return NULL;
468 }
469
470 static void ipgre_tunnel_uninit(struct net_device *dev)
471 {
472 struct net *net = dev_net(dev);
473 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
474
475 ipgre_tunnel_unlink(ign, netdev_priv(dev));
476 dev_put(dev);
477 }
478
479
480 static void ipgre_err(struct sk_buff *skb, u32 info)
481 {
482
483 /* All the routers (except for Linux) return only
484 8 bytes of packet payload. It means, that precise relaying of
485 ICMP in the real Internet is absolutely infeasible.
486
487 Moreover, Cisco "wise men" put GRE key to the third word
488 in GRE header. It makes impossible maintaining even soft state for keyed
489 GRE tunnels with enabled checksum. Tell them "thank you".
490
491 Well, I wonder, rfc1812 was written by Cisco employee,
492 what the hell these idiots break standards established
493 by themselves???
494 */
495
496 const struct iphdr *iph = (const struct iphdr *)skb->data;
497 __be16 *p = (__be16 *)(skb->data+(iph->ihl<<2));
498 int grehlen = (iph->ihl<<2) + 4;
499 const int type = icmp_hdr(skb)->type;
500 const int code = icmp_hdr(skb)->code;
501 struct ip_tunnel *t;
502 __be16 flags;
503 __be32 key = 0;
504
505 flags = p[0];
506 if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
507 if (flags&(GRE_VERSION|GRE_ROUTING))
508 return;
509 if (flags&GRE_KEY) {
510 grehlen += 4;
511 if (flags&GRE_CSUM)
512 grehlen += 4;
513 }
514 }
515
516 /* If only 8 bytes returned, keyed message will be dropped here */
517 if (skb_headlen(skb) < grehlen)
518 return;
519
520 if (flags & GRE_KEY)
521 key = *(((__be32 *)p) + (grehlen / 4) - 1);
522
523 switch (type) {
524 default:
525 case ICMP_PARAMETERPROB:
526 return;
527
528 case ICMP_DEST_UNREACH:
529 switch (code) {
530 case ICMP_SR_FAILED:
531 case ICMP_PORT_UNREACH:
532 /* Impossible event. */
533 return;
534 default:
535 /* All others are translated to HOST_UNREACH.
536 rfc2003 contains "deep thoughts" about NET_UNREACH,
537 I believe they are just ether pollution. --ANK
538 */
539 break;
540 }
541 break;
542 case ICMP_TIME_EXCEEDED:
543 if (code != ICMP_EXC_TTL)
544 return;
545 break;
546
547 case ICMP_REDIRECT:
548 break;
549 }
550
551 t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
552 flags, key, p[1]);
553
554 if (t == NULL)
555 return;
556
557 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
558 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
559 t->parms.link, 0, IPPROTO_GRE, 0);
560 return;
561 }
562 if (type == ICMP_REDIRECT) {
563 ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
564 IPPROTO_GRE, 0);
565 return;
566 }
567 if (t->parms.iph.daddr == 0 ||
568 ipv4_is_multicast(t->parms.iph.daddr))
569 return;
570
571 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
572 return;
573
574 if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
575 t->err_count++;
576 else
577 t->err_count = 1;
578 t->err_time = jiffies;
579 }
580
581 static inline u8
582 ipgre_ecn_encapsulate(u8 tos, const struct iphdr *old_iph, struct sk_buff *skb)
583 {
584 u8 inner = 0;
585 if (skb->protocol == htons(ETH_P_IP))
586 inner = old_iph->tos;
587 else if (skb->protocol == htons(ETH_P_IPV6))
588 inner = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
589 return INET_ECN_encapsulate(tos, inner);
590 }
591
592 static int ipgre_rcv(struct sk_buff *skb)
593 {
594 const struct iphdr *iph;
595 u8 *h;
596 __be16 flags;
597 __sum16 csum = 0;
598 __be32 key = 0;
599 u32 seqno = 0;
600 struct ip_tunnel *tunnel;
601 int offset = 4;
602 __be16 gre_proto;
603 int err;
604
605 if (!pskb_may_pull(skb, 16))
606 goto drop;
607
608 iph = ip_hdr(skb);
609 h = skb->data;
610 flags = *(__be16 *)h;
611
612 if (flags&(GRE_CSUM|GRE_KEY|GRE_ROUTING|GRE_SEQ|GRE_VERSION)) {
613 /* - Version must be 0.
614 - We do not support routing headers.
615 */
616 if (flags&(GRE_VERSION|GRE_ROUTING))
617 goto drop;
618
619 if (flags&GRE_CSUM) {
620 switch (skb->ip_summed) {
621 case CHECKSUM_COMPLETE:
622 csum = csum_fold(skb->csum);
623 if (!csum)
624 break;
625 /* fall through */
626 case CHECKSUM_NONE:
627 skb->csum = 0;
628 csum = __skb_checksum_complete(skb);
629 skb->ip_summed = CHECKSUM_COMPLETE;
630 }
631 offset += 4;
632 }
633 if (flags&GRE_KEY) {
634 key = *(__be32 *)(h + offset);
635 offset += 4;
636 }
637 if (flags&GRE_SEQ) {
638 seqno = ntohl(*(__be32 *)(h + offset));
639 offset += 4;
640 }
641 }
642
643 gre_proto = *(__be16 *)(h + 2);
644
645 tunnel = ipgre_tunnel_lookup(skb->dev,
646 iph->saddr, iph->daddr, flags, key,
647 gre_proto);
648 if (tunnel) {
649 struct pcpu_tstats *tstats;
650
651 secpath_reset(skb);
652
653 skb->protocol = gre_proto;
654 /* WCCP version 1 and 2 protocol decoding.
655 * - Change protocol to IP
656 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
657 */
658 if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
659 skb->protocol = htons(ETH_P_IP);
660 if ((*(h + offset) & 0xF0) != 0x40)
661 offset += 4;
662 }
663
664 skb->mac_header = skb->network_header;
665 __pskb_pull(skb, offset);
666 skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
667 skb->pkt_type = PACKET_HOST;
668 #ifdef CONFIG_NET_IPGRE_BROADCAST
669 if (ipv4_is_multicast(iph->daddr)) {
670 /* Looped back packet, drop it! */
671 if (rt_is_output_route(skb_rtable(skb)))
672 goto drop;
673 tunnel->dev->stats.multicast++;
674 skb->pkt_type = PACKET_BROADCAST;
675 }
676 #endif
677
678 if (((flags&GRE_CSUM) && csum) ||
679 (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
680 tunnel->dev->stats.rx_crc_errors++;
681 tunnel->dev->stats.rx_errors++;
682 goto drop;
683 }
684 if (tunnel->parms.i_flags&GRE_SEQ) {
685 if (!(flags&GRE_SEQ) ||
686 (tunnel->i_seqno && (s32)(seqno - tunnel->i_seqno) < 0)) {
687 tunnel->dev->stats.rx_fifo_errors++;
688 tunnel->dev->stats.rx_errors++;
689 goto drop;
690 }
691 tunnel->i_seqno = seqno + 1;
692 }
693
694 /* Warning: All skb pointers will be invalidated! */
695 if (tunnel->dev->type == ARPHRD_ETHER) {
696 if (!pskb_may_pull(skb, ETH_HLEN)) {
697 tunnel->dev->stats.rx_length_errors++;
698 tunnel->dev->stats.rx_errors++;
699 goto drop;
700 }
701
702 iph = ip_hdr(skb);
703 skb->protocol = eth_type_trans(skb, tunnel->dev);
704 skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
705 }
706
707 __skb_tunnel_rx(skb, tunnel->dev);
708
709 skb_reset_network_header(skb);
710 err = IP_ECN_decapsulate(iph, skb);
711 if (unlikely(err)) {
712 if (log_ecn_error)
713 net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
714 &iph->saddr, iph->tos);
715 if (err > 1) {
716 ++tunnel->dev->stats.rx_frame_errors;
717 ++tunnel->dev->stats.rx_errors;
718 goto drop;
719 }
720 }
721
722 tstats = this_cpu_ptr(tunnel->dev->tstats);
723 u64_stats_update_begin(&tstats->syncp);
724 tstats->rx_packets++;
725 tstats->rx_bytes += skb->len;
726 u64_stats_update_end(&tstats->syncp);
727
728 gro_cells_receive(&tunnel->gro_cells, skb);
729 return 0;
730 }
731 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
732
733 drop:
734 kfree_skb(skb);
735 return 0;
736 }
737
738 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
739 {
740 struct ip_tunnel *tunnel = netdev_priv(dev);
741 const struct iphdr *old_iph = ip_hdr(skb);
742 const struct iphdr *tiph;
743 struct flowi4 fl4;
744 u8 tos;
745 __be16 df;
746 struct rtable *rt; /* Route to the other host */
747 struct net_device *tdev; /* Device to other host */
748 struct iphdr *iph; /* Our new IP header */
749 unsigned int max_headroom; /* The extra header space needed */
750 int gre_hlen;
751 __be32 dst;
752 int mtu;
753
754 if (skb->ip_summed == CHECKSUM_PARTIAL &&
755 skb_checksum_help(skb))
756 goto tx_error;
757
758 if (dev->type == ARPHRD_ETHER)
759 IPCB(skb)->flags = 0;
760
761 if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
762 gre_hlen = 0;
763 if (skb->protocol == htons(ETH_P_IP))
764 tiph = (const struct iphdr *)skb->data;
765 else
766 tiph = &tunnel->parms.iph;
767 } else {
768 gre_hlen = tunnel->hlen;
769 tiph = &tunnel->parms.iph;
770 }
771
772 if ((dst = tiph->daddr) == 0) {
773 /* NBMA tunnel */
774
775 if (skb_dst(skb) == NULL) {
776 dev->stats.tx_fifo_errors++;
777 goto tx_error;
778 }
779
780 if (skb->protocol == htons(ETH_P_IP)) {
781 rt = skb_rtable(skb);
782 dst = rt_nexthop(rt, old_iph->daddr);
783 }
784 #if IS_ENABLED(CONFIG_IPV6)
785 else if (skb->protocol == htons(ETH_P_IPV6)) {
786 const struct in6_addr *addr6;
787 struct neighbour *neigh;
788 bool do_tx_error_icmp;
789 int addr_type;
790
791 neigh = dst_neigh_lookup(skb_dst(skb), &ipv6_hdr(skb)->daddr);
792 if (neigh == NULL)
793 goto tx_error;
794
795 addr6 = (const struct in6_addr *)&neigh->primary_key;
796 addr_type = ipv6_addr_type(addr6);
797
798 if (addr_type == IPV6_ADDR_ANY) {
799 addr6 = &ipv6_hdr(skb)->daddr;
800 addr_type = ipv6_addr_type(addr6);
801 }
802
803 if ((addr_type & IPV6_ADDR_COMPATv4) == 0)
804 do_tx_error_icmp = true;
805 else {
806 do_tx_error_icmp = false;
807 dst = addr6->s6_addr32[3];
808 }
809 neigh_release(neigh);
810 if (do_tx_error_icmp)
811 goto tx_error_icmp;
812 }
813 #endif
814 else
815 goto tx_error;
816 }
817
818 tos = tiph->tos;
819 if (tos == 1) {
820 tos = 0;
821 if (skb->protocol == htons(ETH_P_IP))
822 tos = old_iph->tos;
823 else if (skb->protocol == htons(ETH_P_IPV6))
824 tos = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
825 }
826
827 rt = ip_route_output_gre(dev_net(dev), &fl4, dst, tiph->saddr,
828 tunnel->parms.o_key, RT_TOS(tos),
829 tunnel->parms.link);
830 if (IS_ERR(rt)) {
831 dev->stats.tx_carrier_errors++;
832 goto tx_error;
833 }
834 tdev = rt->dst.dev;
835
836 if (tdev == dev) {
837 ip_rt_put(rt);
838 dev->stats.collisions++;
839 goto tx_error;
840 }
841
842 df = tiph->frag_off;
843 if (df)
844 mtu = dst_mtu(&rt->dst) - dev->hard_header_len - tunnel->hlen;
845 else
846 mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
847
848 if (skb_dst(skb))
849 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
850
851 if (skb->protocol == htons(ETH_P_IP)) {
852 df |= (old_iph->frag_off&htons(IP_DF));
853
854 if ((old_iph->frag_off&htons(IP_DF)) &&
855 mtu < ntohs(old_iph->tot_len)) {
856 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
857 ip_rt_put(rt);
858 goto tx_error;
859 }
860 }
861 #if IS_ENABLED(CONFIG_IPV6)
862 else if (skb->protocol == htons(ETH_P_IPV6)) {
863 struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
864
865 if (rt6 && mtu < dst_mtu(skb_dst(skb)) && mtu >= IPV6_MIN_MTU) {
866 if ((tunnel->parms.iph.daddr &&
867 !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
868 rt6->rt6i_dst.plen == 128) {
869 rt6->rt6i_flags |= RTF_MODIFIED;
870 dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
871 }
872 }
873
874 if (mtu >= IPV6_MIN_MTU && mtu < skb->len - tunnel->hlen + gre_hlen) {
875 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
876 ip_rt_put(rt);
877 goto tx_error;
878 }
879 }
880 #endif
881
882 if (tunnel->err_count > 0) {
883 if (time_before(jiffies,
884 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
885 tunnel->err_count--;
886
887 dst_link_failure(skb);
888 } else
889 tunnel->err_count = 0;
890 }
891
892 max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->dst.header_len;
893
894 if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
895 (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
896 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
897 if (max_headroom > dev->needed_headroom)
898 dev->needed_headroom = max_headroom;
899 if (!new_skb) {
900 ip_rt_put(rt);
901 dev->stats.tx_dropped++;
902 dev_kfree_skb(skb);
903 return NETDEV_TX_OK;
904 }
905 if (skb->sk)
906 skb_set_owner_w(new_skb, skb->sk);
907 dev_kfree_skb(skb);
908 skb = new_skb;
909 old_iph = ip_hdr(skb);
910 }
911
912 skb_reset_transport_header(skb);
913 skb_push(skb, gre_hlen);
914 skb_reset_network_header(skb);
915 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
916 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
917 IPSKB_REROUTED);
918 skb_dst_drop(skb);
919 skb_dst_set(skb, &rt->dst);
920
921 /*
922 * Push down and install the IPIP header.
923 */
924
925 iph = ip_hdr(skb);
926 iph->version = 4;
927 iph->ihl = sizeof(struct iphdr) >> 2;
928 iph->frag_off = df;
929 iph->protocol = IPPROTO_GRE;
930 iph->tos = ipgre_ecn_encapsulate(tos, old_iph, skb);
931 iph->daddr = fl4.daddr;
932 iph->saddr = fl4.saddr;
933
934 if ((iph->ttl = tiph->ttl) == 0) {
935 if (skb->protocol == htons(ETH_P_IP))
936 iph->ttl = old_iph->ttl;
937 #if IS_ENABLED(CONFIG_IPV6)
938 else if (skb->protocol == htons(ETH_P_IPV6))
939 iph->ttl = ((const struct ipv6hdr *)old_iph)->hop_limit;
940 #endif
941 else
942 iph->ttl = ip4_dst_hoplimit(&rt->dst);
943 }
944
945 ((__be16 *)(iph + 1))[0] = tunnel->parms.o_flags;
946 ((__be16 *)(iph + 1))[1] = (dev->type == ARPHRD_ETHER) ?
947 htons(ETH_P_TEB) : skb->protocol;
948
949 if (tunnel->parms.o_flags&(GRE_KEY|GRE_CSUM|GRE_SEQ)) {
950 __be32 *ptr = (__be32 *)(((u8 *)iph) + tunnel->hlen - 4);
951
952 if (tunnel->parms.o_flags&GRE_SEQ) {
953 ++tunnel->o_seqno;
954 *ptr = htonl(tunnel->o_seqno);
955 ptr--;
956 }
957 if (tunnel->parms.o_flags&GRE_KEY) {
958 *ptr = tunnel->parms.o_key;
959 ptr--;
960 }
961 if (tunnel->parms.o_flags&GRE_CSUM) {
962 *ptr = 0;
963 *(__sum16 *)ptr = ip_compute_csum((void *)(iph+1), skb->len - sizeof(struct iphdr));
964 }
965 }
966
967 iptunnel_xmit(skb, dev);
968 return NETDEV_TX_OK;
969
970 #if IS_ENABLED(CONFIG_IPV6)
971 tx_error_icmp:
972 dst_link_failure(skb);
973 #endif
974 tx_error:
975 dev->stats.tx_errors++;
976 dev_kfree_skb(skb);
977 return NETDEV_TX_OK;
978 }
979
980 static int ipgre_tunnel_bind_dev(struct net_device *dev)
981 {
982 struct net_device *tdev = NULL;
983 struct ip_tunnel *tunnel;
984 const struct iphdr *iph;
985 int hlen = LL_MAX_HEADER;
986 int mtu = ETH_DATA_LEN;
987 int addend = sizeof(struct iphdr) + 4;
988
989 tunnel = netdev_priv(dev);
990 iph = &tunnel->parms.iph;
991
992 /* Guess output device to choose reasonable mtu and needed_headroom */
993
994 if (iph->daddr) {
995 struct flowi4 fl4;
996 struct rtable *rt;
997
998 rt = ip_route_output_gre(dev_net(dev), &fl4,
999 iph->daddr, iph->saddr,
1000 tunnel->parms.o_key,
1001 RT_TOS(iph->tos),
1002 tunnel->parms.link);
1003 if (!IS_ERR(rt)) {
1004 tdev = rt->dst.dev;
1005 ip_rt_put(rt);
1006 }
1007
1008 if (dev->type != ARPHRD_ETHER)
1009 dev->flags |= IFF_POINTOPOINT;
1010 }
1011
1012 if (!tdev && tunnel->parms.link)
1013 tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
1014
1015 if (tdev) {
1016 hlen = tdev->hard_header_len + tdev->needed_headroom;
1017 mtu = tdev->mtu;
1018 }
1019 dev->iflink = tunnel->parms.link;
1020
1021 /* Precalculate GRE options length */
1022 if (tunnel->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
1023 if (tunnel->parms.o_flags&GRE_CSUM)
1024 addend += 4;
1025 if (tunnel->parms.o_flags&GRE_KEY)
1026 addend += 4;
1027 if (tunnel->parms.o_flags&GRE_SEQ)
1028 addend += 4;
1029 }
1030 dev->needed_headroom = addend + hlen;
1031 mtu -= dev->hard_header_len + addend;
1032
1033 if (mtu < 68)
1034 mtu = 68;
1035
1036 tunnel->hlen = addend;
1037
1038 return mtu;
1039 }
1040
1041 static int
1042 ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
1043 {
1044 int err = 0;
1045 struct ip_tunnel_parm p;
1046 struct ip_tunnel *t;
1047 struct net *net = dev_net(dev);
1048 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1049
1050 switch (cmd) {
1051 case SIOCGETTUNNEL:
1052 t = NULL;
1053 if (dev == ign->fb_tunnel_dev) {
1054 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
1055 err = -EFAULT;
1056 break;
1057 }
1058 t = ipgre_tunnel_locate(net, &p, 0);
1059 }
1060 if (t == NULL)
1061 t = netdev_priv(dev);
1062 memcpy(&p, &t->parms, sizeof(p));
1063 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
1064 err = -EFAULT;
1065 break;
1066
1067 case SIOCADDTUNNEL:
1068 case SIOCCHGTUNNEL:
1069 err = -EPERM;
1070 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1071 goto done;
1072
1073 err = -EFAULT;
1074 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1075 goto done;
1076
1077 err = -EINVAL;
1078 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
1079 p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
1080 ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
1081 goto done;
1082 if (p.iph.ttl)
1083 p.iph.frag_off |= htons(IP_DF);
1084
1085 if (!(p.i_flags&GRE_KEY))
1086 p.i_key = 0;
1087 if (!(p.o_flags&GRE_KEY))
1088 p.o_key = 0;
1089
1090 t = ipgre_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
1091
1092 if (dev != ign->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
1093 if (t != NULL) {
1094 if (t->dev != dev) {
1095 err = -EEXIST;
1096 break;
1097 }
1098 } else {
1099 unsigned int nflags = 0;
1100
1101 t = netdev_priv(dev);
1102
1103 if (ipv4_is_multicast(p.iph.daddr))
1104 nflags = IFF_BROADCAST;
1105 else if (p.iph.daddr)
1106 nflags = IFF_POINTOPOINT;
1107
1108 if ((dev->flags^nflags)&(IFF_POINTOPOINT|IFF_BROADCAST)) {
1109 err = -EINVAL;
1110 break;
1111 }
1112 ipgre_tunnel_unlink(ign, t);
1113 synchronize_net();
1114 t->parms.iph.saddr = p.iph.saddr;
1115 t->parms.iph.daddr = p.iph.daddr;
1116 t->parms.i_key = p.i_key;
1117 t->parms.o_key = p.o_key;
1118 memcpy(dev->dev_addr, &p.iph.saddr, 4);
1119 memcpy(dev->broadcast, &p.iph.daddr, 4);
1120 ipgre_tunnel_link(ign, t);
1121 netdev_state_change(dev);
1122 }
1123 }
1124
1125 if (t) {
1126 err = 0;
1127 if (cmd == SIOCCHGTUNNEL) {
1128 t->parms.iph.ttl = p.iph.ttl;
1129 t->parms.iph.tos = p.iph.tos;
1130 t->parms.iph.frag_off = p.iph.frag_off;
1131 if (t->parms.link != p.link) {
1132 t->parms.link = p.link;
1133 dev->mtu = ipgre_tunnel_bind_dev(dev);
1134 netdev_state_change(dev);
1135 }
1136 }
1137 if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
1138 err = -EFAULT;
1139 } else
1140 err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
1141 break;
1142
1143 case SIOCDELTUNNEL:
1144 err = -EPERM;
1145 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1146 goto done;
1147
1148 if (dev == ign->fb_tunnel_dev) {
1149 err = -EFAULT;
1150 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1151 goto done;
1152 err = -ENOENT;
1153 if ((t = ipgre_tunnel_locate(net, &p, 0)) == NULL)
1154 goto done;
1155 err = -EPERM;
1156 if (t == netdev_priv(ign->fb_tunnel_dev))
1157 goto done;
1158 dev = t->dev;
1159 }
1160 unregister_netdevice(dev);
1161 err = 0;
1162 break;
1163
1164 default:
1165 err = -EINVAL;
1166 }
1167
1168 done:
1169 return err;
1170 }
1171
1172 static int ipgre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
1173 {
1174 struct ip_tunnel *tunnel = netdev_priv(dev);
1175 if (new_mtu < 68 ||
1176 new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
1177 return -EINVAL;
1178 dev->mtu = new_mtu;
1179 return 0;
1180 }
1181
1182 /* Nice toy. Unfortunately, useless in real life :-)
1183 It allows to construct virtual multiprotocol broadcast "LAN"
1184 over the Internet, provided multicast routing is tuned.
1185
1186
1187 I have no idea was this bicycle invented before me,
1188 so that I had to set ARPHRD_IPGRE to a random value.
1189 I have an impression, that Cisco could make something similar,
1190 but this feature is apparently missing in IOS<=11.2(8).
1191
1192 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks
1193 with broadcast 224.66.66.66. If you have access to mbone, play with me :-)
1194
1195 ping -t 255 224.66.66.66
1196
1197 If nobody answers, mbone does not work.
1198
1199 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255
1200 ip addr add 10.66.66.<somewhat>/24 dev Universe
1201 ifconfig Universe up
1202 ifconfig Universe add fe80::<Your_real_addr>/10
1203 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96
1204 ftp 10.66.66.66
1205 ...
1206 ftp fec0:6666:6666::193.233.7.65
1207 ...
1208
1209 */
1210
1211 static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
1212 unsigned short type,
1213 const void *daddr, const void *saddr, unsigned int len)
1214 {
1215 struct ip_tunnel *t = netdev_priv(dev);
1216 struct iphdr *iph = (struct iphdr *)skb_push(skb, t->hlen);
1217 __be16 *p = (__be16 *)(iph+1);
1218
1219 memcpy(iph, &t->parms.iph, sizeof(struct iphdr));
1220 p[0] = t->parms.o_flags;
1221 p[1] = htons(type);
1222
1223 /*
1224 * Set the source hardware address.
1225 */
1226
1227 if (saddr)
1228 memcpy(&iph->saddr, saddr, 4);
1229 if (daddr)
1230 memcpy(&iph->daddr, daddr, 4);
1231 if (iph->daddr)
1232 return t->hlen;
1233
1234 return -t->hlen;
1235 }
1236
1237 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
1238 {
1239 const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
1240 memcpy(haddr, &iph->saddr, 4);
1241 return 4;
1242 }
1243
1244 static const struct header_ops ipgre_header_ops = {
1245 .create = ipgre_header,
1246 .parse = ipgre_header_parse,
1247 };
1248
1249 #ifdef CONFIG_NET_IPGRE_BROADCAST
1250 static int ipgre_open(struct net_device *dev)
1251 {
1252 struct ip_tunnel *t = netdev_priv(dev);
1253
1254 if (ipv4_is_multicast(t->parms.iph.daddr)) {
1255 struct flowi4 fl4;
1256 struct rtable *rt;
1257
1258 rt = ip_route_output_gre(dev_net(dev), &fl4,
1259 t->parms.iph.daddr,
1260 t->parms.iph.saddr,
1261 t->parms.o_key,
1262 RT_TOS(t->parms.iph.tos),
1263 t->parms.link);
1264 if (IS_ERR(rt))
1265 return -EADDRNOTAVAIL;
1266 dev = rt->dst.dev;
1267 ip_rt_put(rt);
1268 if (__in_dev_get_rtnl(dev) == NULL)
1269 return -EADDRNOTAVAIL;
1270 t->mlink = dev->ifindex;
1271 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
1272 }
1273 return 0;
1274 }
1275
1276 static int ipgre_close(struct net_device *dev)
1277 {
1278 struct ip_tunnel *t = netdev_priv(dev);
1279
1280 if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) {
1281 struct in_device *in_dev;
1282 in_dev = inetdev_by_index(dev_net(dev), t->mlink);
1283 if (in_dev)
1284 ip_mc_dec_group(in_dev, t->parms.iph.daddr);
1285 }
1286 return 0;
1287 }
1288
1289 #endif
1290
1291 static const struct net_device_ops ipgre_netdev_ops = {
1292 .ndo_init = ipgre_tunnel_init,
1293 .ndo_uninit = ipgre_tunnel_uninit,
1294 #ifdef CONFIG_NET_IPGRE_BROADCAST
1295 .ndo_open = ipgre_open,
1296 .ndo_stop = ipgre_close,
1297 #endif
1298 .ndo_start_xmit = ipgre_tunnel_xmit,
1299 .ndo_do_ioctl = ipgre_tunnel_ioctl,
1300 .ndo_change_mtu = ipgre_tunnel_change_mtu,
1301 .ndo_get_stats64 = ipgre_get_stats64,
1302 };
1303
1304 static void ipgre_dev_free(struct net_device *dev)
1305 {
1306 struct ip_tunnel *tunnel = netdev_priv(dev);
1307
1308 gro_cells_destroy(&tunnel->gro_cells);
1309 free_percpu(dev->tstats);
1310 free_netdev(dev);
1311 }
1312
1313 #define GRE_FEATURES (NETIF_F_SG | \
1314 NETIF_F_FRAGLIST | \
1315 NETIF_F_HIGHDMA | \
1316 NETIF_F_HW_CSUM)
1317
1318 static void ipgre_tunnel_setup(struct net_device *dev)
1319 {
1320 dev->netdev_ops = &ipgre_netdev_ops;
1321 dev->destructor = ipgre_dev_free;
1322
1323 dev->type = ARPHRD_IPGRE;
1324 dev->needed_headroom = LL_MAX_HEADER + sizeof(struct iphdr) + 4;
1325 dev->mtu = ETH_DATA_LEN - sizeof(struct iphdr) - 4;
1326 dev->flags = IFF_NOARP;
1327 dev->iflink = 0;
1328 dev->addr_len = 4;
1329 dev->features |= NETIF_F_NETNS_LOCAL;
1330 dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
1331
1332 dev->features |= GRE_FEATURES;
1333 dev->hw_features |= GRE_FEATURES;
1334 }
1335
1336 static int ipgre_tunnel_init(struct net_device *dev)
1337 {
1338 struct ip_tunnel *tunnel;
1339 struct iphdr *iph;
1340 int err;
1341
1342 tunnel = netdev_priv(dev);
1343 iph = &tunnel->parms.iph;
1344
1345 tunnel->dev = dev;
1346 strcpy(tunnel->parms.name, dev->name);
1347
1348 memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
1349 memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
1350
1351 if (iph->daddr) {
1352 #ifdef CONFIG_NET_IPGRE_BROADCAST
1353 if (ipv4_is_multicast(iph->daddr)) {
1354 if (!iph->saddr)
1355 return -EINVAL;
1356 dev->flags = IFF_BROADCAST;
1357 dev->header_ops = &ipgre_header_ops;
1358 }
1359 #endif
1360 } else
1361 dev->header_ops = &ipgre_header_ops;
1362
1363 dev->tstats = alloc_percpu(struct pcpu_tstats);
1364 if (!dev->tstats)
1365 return -ENOMEM;
1366
1367 err = gro_cells_init(&tunnel->gro_cells, dev);
1368 if (err) {
1369 free_percpu(dev->tstats);
1370 return err;
1371 }
1372
1373 return 0;
1374 }
1375
1376 static void ipgre_fb_tunnel_init(struct net_device *dev)
1377 {
1378 struct ip_tunnel *tunnel = netdev_priv(dev);
1379 struct iphdr *iph = &tunnel->parms.iph;
1380
1381 tunnel->dev = dev;
1382 strcpy(tunnel->parms.name, dev->name);
1383
1384 iph->version = 4;
1385 iph->protocol = IPPROTO_GRE;
1386 iph->ihl = 5;
1387 tunnel->hlen = sizeof(struct iphdr) + 4;
1388
1389 dev_hold(dev);
1390 }
1391
1392
1393 static const struct gre_protocol ipgre_protocol = {
1394 .handler = ipgre_rcv,
1395 .err_handler = ipgre_err,
1396 };
1397
1398 static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
1399 {
1400 int prio;
1401
1402 for (prio = 0; prio < 4; prio++) {
1403 int h;
1404 for (h = 0; h < HASH_SIZE; h++) {
1405 struct ip_tunnel *t;
1406
1407 t = rtnl_dereference(ign->tunnels[prio][h]);
1408
1409 while (t != NULL) {
1410 unregister_netdevice_queue(t->dev, head);
1411 t = rtnl_dereference(t->next);
1412 }
1413 }
1414 }
1415 }
1416
1417 static int __net_init ipgre_init_net(struct net *net)
1418 {
1419 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1420 int err;
1421
1422 ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0",
1423 ipgre_tunnel_setup);
1424 if (!ign->fb_tunnel_dev) {
1425 err = -ENOMEM;
1426 goto err_alloc_dev;
1427 }
1428 dev_net_set(ign->fb_tunnel_dev, net);
1429
1430 ipgre_fb_tunnel_init(ign->fb_tunnel_dev);
1431 ign->fb_tunnel_dev->rtnl_link_ops = &ipgre_link_ops;
1432
1433 if ((err = register_netdev(ign->fb_tunnel_dev)))
1434 goto err_reg_dev;
1435
1436 rcu_assign_pointer(ign->tunnels_wc[0],
1437 netdev_priv(ign->fb_tunnel_dev));
1438 return 0;
1439
1440 err_reg_dev:
1441 ipgre_dev_free(ign->fb_tunnel_dev);
1442 err_alloc_dev:
1443 return err;
1444 }
1445
1446 static void __net_exit ipgre_exit_net(struct net *net)
1447 {
1448 struct ipgre_net *ign;
1449 LIST_HEAD(list);
1450
1451 ign = net_generic(net, ipgre_net_id);
1452 rtnl_lock();
1453 ipgre_destroy_tunnels(ign, &list);
1454 unregister_netdevice_many(&list);
1455 rtnl_unlock();
1456 }
1457
1458 static struct pernet_operations ipgre_net_ops = {
1459 .init = ipgre_init_net,
1460 .exit = ipgre_exit_net,
1461 .id = &ipgre_net_id,
1462 .size = sizeof(struct ipgre_net),
1463 };
1464
1465 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
1466 {
1467 __be16 flags;
1468
1469 if (!data)
1470 return 0;
1471
1472 flags = 0;
1473 if (data[IFLA_GRE_IFLAGS])
1474 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
1475 if (data[IFLA_GRE_OFLAGS])
1476 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
1477 if (flags & (GRE_VERSION|GRE_ROUTING))
1478 return -EINVAL;
1479
1480 return 0;
1481 }
1482
1483 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[])
1484 {
1485 __be32 daddr;
1486
1487 if (tb[IFLA_ADDRESS]) {
1488 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
1489 return -EINVAL;
1490 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
1491 return -EADDRNOTAVAIL;
1492 }
1493
1494 if (!data)
1495 goto out;
1496
1497 if (data[IFLA_GRE_REMOTE]) {
1498 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4);
1499 if (!daddr)
1500 return -EINVAL;
1501 }
1502
1503 out:
1504 return ipgre_tunnel_validate(tb, data);
1505 }
1506
1507 static void ipgre_netlink_parms(struct nlattr *data[],
1508 struct ip_tunnel_parm *parms)
1509 {
1510 memset(parms, 0, sizeof(*parms));
1511
1512 parms->iph.protocol = IPPROTO_GRE;
1513
1514 if (!data)
1515 return;
1516
1517 if (data[IFLA_GRE_LINK])
1518 parms->link = nla_get_u32(data[IFLA_GRE_LINK]);
1519
1520 if (data[IFLA_GRE_IFLAGS])
1521 parms->i_flags = nla_get_be16(data[IFLA_GRE_IFLAGS]);
1522
1523 if (data[IFLA_GRE_OFLAGS])
1524 parms->o_flags = nla_get_be16(data[IFLA_GRE_OFLAGS]);
1525
1526 if (data[IFLA_GRE_IKEY])
1527 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]);
1528
1529 if (data[IFLA_GRE_OKEY])
1530 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]);
1531
1532 if (data[IFLA_GRE_LOCAL])
1533 parms->iph.saddr = nla_get_be32(data[IFLA_GRE_LOCAL]);
1534
1535 if (data[IFLA_GRE_REMOTE])
1536 parms->iph.daddr = nla_get_be32(data[IFLA_GRE_REMOTE]);
1537
1538 if (data[IFLA_GRE_TTL])
1539 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]);
1540
1541 if (data[IFLA_GRE_TOS])
1542 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]);
1543
1544 if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC]))
1545 parms->iph.frag_off = htons(IP_DF);
1546 }
1547
1548 static int ipgre_tap_init(struct net_device *dev)
1549 {
1550 struct ip_tunnel *tunnel;
1551
1552 tunnel = netdev_priv(dev);
1553
1554 tunnel->dev = dev;
1555 strcpy(tunnel->parms.name, dev->name);
1556
1557 ipgre_tunnel_bind_dev(dev);
1558
1559 dev->tstats = alloc_percpu(struct pcpu_tstats);
1560 if (!dev->tstats)
1561 return -ENOMEM;
1562
1563 return 0;
1564 }
1565
1566 static const struct net_device_ops ipgre_tap_netdev_ops = {
1567 .ndo_init = ipgre_tap_init,
1568 .ndo_uninit = ipgre_tunnel_uninit,
1569 .ndo_start_xmit = ipgre_tunnel_xmit,
1570 .ndo_set_mac_address = eth_mac_addr,
1571 .ndo_validate_addr = eth_validate_addr,
1572 .ndo_change_mtu = ipgre_tunnel_change_mtu,
1573 .ndo_get_stats64 = ipgre_get_stats64,
1574 };
1575
1576 static void ipgre_tap_setup(struct net_device *dev)
1577 {
1578
1579 ether_setup(dev);
1580
1581 dev->netdev_ops = &ipgre_tap_netdev_ops;
1582 dev->destructor = ipgre_dev_free;
1583
1584 dev->iflink = 0;
1585 dev->features |= NETIF_F_NETNS_LOCAL;
1586 }
1587
1588 static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
1589 struct nlattr *data[])
1590 {
1591 struct ip_tunnel *nt;
1592 struct net *net = dev_net(dev);
1593 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1594 int mtu;
1595 int err;
1596
1597 nt = netdev_priv(dev);
1598 ipgre_netlink_parms(data, &nt->parms);
1599
1600 if (ipgre_tunnel_find(net, &nt->parms, dev->type))
1601 return -EEXIST;
1602
1603 if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
1604 eth_hw_addr_random(dev);
1605
1606 mtu = ipgre_tunnel_bind_dev(dev);
1607 if (!tb[IFLA_MTU])
1608 dev->mtu = mtu;
1609
1610 /* Can use a lockless transmit, unless we generate output sequences */
1611 if (!(nt->parms.o_flags & GRE_SEQ))
1612 dev->features |= NETIF_F_LLTX;
1613
1614 err = register_netdevice(dev);
1615 if (err)
1616 goto out;
1617
1618 dev_hold(dev);
1619 ipgre_tunnel_link(ign, nt);
1620
1621 out:
1622 return err;
1623 }
1624
1625 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
1626 struct nlattr *data[])
1627 {
1628 struct ip_tunnel *t, *nt;
1629 struct net *net = dev_net(dev);
1630 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1631 struct ip_tunnel_parm p;
1632 int mtu;
1633
1634 if (dev == ign->fb_tunnel_dev)
1635 return -EINVAL;
1636
1637 nt = netdev_priv(dev);
1638 ipgre_netlink_parms(data, &p);
1639
1640 t = ipgre_tunnel_locate(net, &p, 0);
1641
1642 if (t) {
1643 if (t->dev != dev)
1644 return -EEXIST;
1645 } else {
1646 t = nt;
1647
1648 if (dev->type != ARPHRD_ETHER) {
1649 unsigned int nflags = 0;
1650
1651 if (ipv4_is_multicast(p.iph.daddr))
1652 nflags = IFF_BROADCAST;
1653 else if (p.iph.daddr)
1654 nflags = IFF_POINTOPOINT;
1655
1656 if ((dev->flags ^ nflags) &
1657 (IFF_POINTOPOINT | IFF_BROADCAST))
1658 return -EINVAL;
1659 }
1660
1661 ipgre_tunnel_unlink(ign, t);
1662 t->parms.iph.saddr = p.iph.saddr;
1663 t->parms.iph.daddr = p.iph.daddr;
1664 t->parms.i_key = p.i_key;
1665 if (dev->type != ARPHRD_ETHER) {
1666 memcpy(dev->dev_addr, &p.iph.saddr, 4);
1667 memcpy(dev->broadcast, &p.iph.daddr, 4);
1668 }
1669 ipgre_tunnel_link(ign, t);
1670 netdev_state_change(dev);
1671 }
1672
1673 t->parms.o_key = p.o_key;
1674 t->parms.iph.ttl = p.iph.ttl;
1675 t->parms.iph.tos = p.iph.tos;
1676 t->parms.iph.frag_off = p.iph.frag_off;
1677
1678 if (t->parms.link != p.link) {
1679 t->parms.link = p.link;
1680 mtu = ipgre_tunnel_bind_dev(dev);
1681 if (!tb[IFLA_MTU])
1682 dev->mtu = mtu;
1683 netdev_state_change(dev);
1684 }
1685
1686 return 0;
1687 }
1688
1689 static size_t ipgre_get_size(const struct net_device *dev)
1690 {
1691 return
1692 /* IFLA_GRE_LINK */
1693 nla_total_size(4) +
1694 /* IFLA_GRE_IFLAGS */
1695 nla_total_size(2) +
1696 /* IFLA_GRE_OFLAGS */
1697 nla_total_size(2) +
1698 /* IFLA_GRE_IKEY */
1699 nla_total_size(4) +
1700 /* IFLA_GRE_OKEY */
1701 nla_total_size(4) +
1702 /* IFLA_GRE_LOCAL */
1703 nla_total_size(4) +
1704 /* IFLA_GRE_REMOTE */
1705 nla_total_size(4) +
1706 /* IFLA_GRE_TTL */
1707 nla_total_size(1) +
1708 /* IFLA_GRE_TOS */
1709 nla_total_size(1) +
1710 /* IFLA_GRE_PMTUDISC */
1711 nla_total_size(1) +
1712 0;
1713 }
1714
1715 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
1716 {
1717 struct ip_tunnel *t = netdev_priv(dev);
1718 struct ip_tunnel_parm *p = &t->parms;
1719
1720 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
1721 nla_put_be16(skb, IFLA_GRE_IFLAGS, p->i_flags) ||
1722 nla_put_be16(skb, IFLA_GRE_OFLAGS, p->o_flags) ||
1723 nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
1724 nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
1725 nla_put_be32(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
1726 nla_put_be32(skb, IFLA_GRE_REMOTE, p->iph.daddr) ||
1727 nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) ||
1728 nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) ||
1729 nla_put_u8(skb, IFLA_GRE_PMTUDISC,
1730 !!(p->iph.frag_off & htons(IP_DF))))
1731 goto nla_put_failure;
1732 return 0;
1733
1734 nla_put_failure:
1735 return -EMSGSIZE;
1736 }
1737
1738 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
1739 [IFLA_GRE_LINK] = { .type = NLA_U32 },
1740 [IFLA_GRE_IFLAGS] = { .type = NLA_U16 },
1741 [IFLA_GRE_OFLAGS] = { .type = NLA_U16 },
1742 [IFLA_GRE_IKEY] = { .type = NLA_U32 },
1743 [IFLA_GRE_OKEY] = { .type = NLA_U32 },
1744 [IFLA_GRE_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) },
1745 [IFLA_GRE_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
1746 [IFLA_GRE_TTL] = { .type = NLA_U8 },
1747 [IFLA_GRE_TOS] = { .type = NLA_U8 },
1748 [IFLA_GRE_PMTUDISC] = { .type = NLA_U8 },
1749 };
1750
1751 static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
1752 .kind = "gre",
1753 .maxtype = IFLA_GRE_MAX,
1754 .policy = ipgre_policy,
1755 .priv_size = sizeof(struct ip_tunnel),
1756 .setup = ipgre_tunnel_setup,
1757 .validate = ipgre_tunnel_validate,
1758 .newlink = ipgre_newlink,
1759 .changelink = ipgre_changelink,
1760 .get_size = ipgre_get_size,
1761 .fill_info = ipgre_fill_info,
1762 };
1763
1764 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = {
1765 .kind = "gretap",
1766 .maxtype = IFLA_GRE_MAX,
1767 .policy = ipgre_policy,
1768 .priv_size = sizeof(struct ip_tunnel),
1769 .setup = ipgre_tap_setup,
1770 .validate = ipgre_tap_validate,
1771 .newlink = ipgre_newlink,
1772 .changelink = ipgre_changelink,
1773 .get_size = ipgre_get_size,
1774 .fill_info = ipgre_fill_info,
1775 };
1776
1777 /*
1778 * And now the modules code and kernel interface.
1779 */
1780
1781 static int __init ipgre_init(void)
1782 {
1783 int err;
1784
1785 pr_info("GRE over IPv4 tunneling driver\n");
1786
1787 err = register_pernet_device(&ipgre_net_ops);
1788 if (err < 0)
1789 return err;
1790
1791 err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
1792 if (err < 0) {
1793 pr_info("%s: can't add protocol\n", __func__);
1794 goto add_proto_failed;
1795 }
1796
1797 err = rtnl_link_register(&ipgre_link_ops);
1798 if (err < 0)
1799 goto rtnl_link_failed;
1800
1801 err = rtnl_link_register(&ipgre_tap_ops);
1802 if (err < 0)
1803 goto tap_ops_failed;
1804
1805 out:
1806 return err;
1807
1808 tap_ops_failed:
1809 rtnl_link_unregister(&ipgre_link_ops);
1810 rtnl_link_failed:
1811 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
1812 add_proto_failed:
1813 unregister_pernet_device(&ipgre_net_ops);
1814 goto out;
1815 }
1816
1817 static void __exit ipgre_fini(void)
1818 {
1819 rtnl_link_unregister(&ipgre_tap_ops);
1820 rtnl_link_unregister(&ipgre_link_ops);
1821 if (gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0)
1822 pr_info("%s: can't remove protocol\n", __func__);
1823 unregister_pernet_device(&ipgre_net_ops);
1824 }
1825
1826 module_init(ipgre_init);
1827 module_exit(ipgre_fini);
1828 MODULE_LICENSE("GPL");
1829 MODULE_ALIAS_RTNL_LINK("gre");
1830 MODULE_ALIAS_RTNL_LINK("gretap");
1831 MODULE_ALIAS_NETDEV("gre0");
Linux kernel - Deliverables
This page took 0.130134 seconds and 5 git commands to generate.