projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
ACPI / LPSS: make code less confusing for reader
[deliverable/linux.git] / net / ipv4 / ip_gre.c
1 /*
2 * Linux NET3: GRE over IP protocol decoder.
3 *
4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
10 *
11 */
12
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15 #include <linux/capability.h>
16 #include <linux/module.h>
17 #include <linux/types.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
20 #include <asm/uaccess.h>
21 #include <linux/skbuff.h>
22 #include <linux/netdevice.h>
23 #include <linux/in.h>
24 #include <linux/tcp.h>
25 #include <linux/udp.h>
26 #include <linux/if_arp.h>
27 #include <linux/mroute.h>
28 #include <linux/init.h>
29 #include <linux/in6.h>
30 #include <linux/inetdevice.h>
31 #include <linux/igmp.h>
32 #include <linux/netfilter_ipv4.h>
33 #include <linux/etherdevice.h>
34 #include <linux/if_ether.h>
35
36 #include <net/sock.h>
37 #include <net/ip.h>
38 #include <net/icmp.h>
39 #include <net/protocol.h>
40 #include <net/ipip.h>
41 #include <net/arp.h>
42 #include <net/checksum.h>
43 #include <net/dsfield.h>
44 #include <net/inet_ecn.h>
45 #include <net/xfrm.h>
46 #include <net/net_namespace.h>
47 #include <net/netns/generic.h>
48 #include <net/rtnetlink.h>
49 #include <net/gre.h>
50
51 #if IS_ENABLED(CONFIG_IPV6)
52 #include <net/ipv6.h>
53 #include <net/ip6_fib.h>
54 #include <net/ip6_route.h>
55 #endif
56
57 /*
58 Problems & solutions
59 --------------------
60
61 1. The most important issue is detecting local dead loops.
62 They would cause complete host lockup in transmit, which
63 would be "resolved" by stack overflow or, if queueing is enabled,
64 with infinite looping in net_bh.
65
66 We cannot track such dead loops during route installation,
67 it is infeasible task. The most general solutions would be
68 to keep skb->encapsulation counter (sort of local ttl),
69 and silently drop packet when it expires. It is a good
70 solution, but it supposes maintaining new variable in ALL
71 skb, even if no tunneling is used.
72
73 Current solution: xmit_recursion breaks dead loops. This is a percpu
74 counter, since when we enter the first ndo_xmit(), cpu migration is
75 forbidden. We force an exit if this counter reaches RECURSION_LIMIT
76
77 2. Networking dead loops would not kill routers, but would really
78 kill network. IP hop limit plays role of "t->recursion" in this case,
79 if we copy it from packet being encapsulated to upper header.
80 It is very good solution, but it introduces two problems:
81
82 - Routing protocols, using packets with ttl=1 (OSPF, RIP2),
83 do not work over tunnels.
84 - traceroute does not work. I planned to relay ICMP from tunnel,
85 so that this problem would be solved and traceroute output
86 would even more informative. This idea appeared to be wrong:
87 only Linux complies to rfc1812 now (yes, guys, Linux is the only
88 true router now :-)), all routers (at least, in neighbourhood of mine)
89 return only 8 bytes of payload. It is the end.
90
91 Hence, if we want that OSPF worked or traceroute said something reasonable,
92 we should search for another solution.
93
94 One of them is to parse packet trying to detect inner encapsulation
95 made by our node. It is difficult or even impossible, especially,
96 taking into account fragmentation. TO be short, ttl is not solution at all.
97
98 Current solution: The solution was UNEXPECTEDLY SIMPLE.
99 We force DF flag on tunnels with preconfigured hop limit,
100 that is ALL. :-) Well, it does not remove the problem completely,
101 but exponential growth of network traffic is changed to linear
102 (branches, that exceed pmtu are pruned) and tunnel mtu
103 rapidly degrades to value <68, where looping stops.
104 Yes, it is not good if there exists a router in the loop,
105 which does not force DF, even when encapsulating packets have DF set.
106 But it is not our problem! Nobody could accuse us, we made
107 all that we could make. Even if it is your gated who injected
108 fatal route to network, even if it were you who configured
109 fatal static route: you are innocent. :-)
110
111
112
113 3. Really, ipv4/ipip.c, ipv4/ip_gre.c and ipv6/sit.c contain
114 practically identical code. It would be good to glue them
115 together, but it is not very evident, how to make them modular.
116 sit is integral part of IPv6, ipip and gre are naturally modular.
117 We could extract common parts (hash table, ioctl etc)
118 to a separate module (ip_tunnel.c).
119
120 Alexey Kuznetsov.
121 */
122
123 static bool log_ecn_error = true;
124 module_param(log_ecn_error, bool, 0644);
125 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
126
127 static struct rtnl_link_ops ipgre_link_ops __read_mostly;
128 static int ipgre_tunnel_init(struct net_device *dev);
129 static void ipgre_tunnel_setup(struct net_device *dev);
130 static int ipgre_tunnel_bind_dev(struct net_device *dev);
131
132 /* Fallback tunnel: no source, no destination, no key, no options */
133
134 #define HASH_SIZE 16
135
136 static int ipgre_net_id __read_mostly;
137 struct ipgre_net {
138 struct ip_tunnel __rcu *tunnels[4][HASH_SIZE];
139
140 struct net_device *fb_tunnel_dev;
141 };
142
143 /* Tunnel hash table */
144
145 /*
146 4 hash tables:
147
148 3: (remote,local)
149 2: (remote,*)
150 1: (*,local)
151 0: (*,*)
152
153 We require exact key match i.e. if a key is present in packet
154 it will match only tunnel with the same key; if it is not present,
155 it will match only keyless tunnel.
156
157 All keysless packets, if not matched configured keyless tunnels
158 will match fallback tunnel.
159 */
160
161 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
162
163 #define tunnels_r_l tunnels[3]
164 #define tunnels_r tunnels[2]
165 #define tunnels_l tunnels[1]
166 #define tunnels_wc tunnels[0]
167
168 static struct rtnl_link_stats64 *ipgre_get_stats64(struct net_device *dev,
169 struct rtnl_link_stats64 *tot)
170 {
171 int i;
172
173 for_each_possible_cpu(i) {
174 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
175 u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
176 unsigned int start;
177
178 do {
179 start = u64_stats_fetch_begin_bh(&tstats->syncp);
180 rx_packets = tstats->rx_packets;
181 tx_packets = tstats->tx_packets;
182 rx_bytes = tstats->rx_bytes;
183 tx_bytes = tstats->tx_bytes;
184 } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
185
186 tot->rx_packets += rx_packets;
187 tot->tx_packets += tx_packets;
188 tot->rx_bytes += rx_bytes;
189 tot->tx_bytes += tx_bytes;
190 }
191
192 tot->multicast = dev->stats.multicast;
193 tot->rx_crc_errors = dev->stats.rx_crc_errors;
194 tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
195 tot->rx_length_errors = dev->stats.rx_length_errors;
196 tot->rx_frame_errors = dev->stats.rx_frame_errors;
197 tot->rx_errors = dev->stats.rx_errors;
198
199 tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
200 tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
201 tot->tx_dropped = dev->stats.tx_dropped;
202 tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
203 tot->tx_errors = dev->stats.tx_errors;
204
205 return tot;
206 }
207
208 /* Does key in tunnel parameters match packet */
209 static bool ipgre_key_match(const struct ip_tunnel_parm *p,
210 __be16 flags, __be32 key)
211 {
212 if (p->i_flags & GRE_KEY) {
213 if (flags & GRE_KEY)
214 return key == p->i_key;
215 else
216 return false; /* key expected, none present */
217 } else
218 return !(flags & GRE_KEY);
219 }
220
221 /* Given src, dst and key, find appropriate for input tunnel. */
222
223 static struct ip_tunnel *ipgre_tunnel_lookup(struct net_device *dev,
224 __be32 remote, __be32 local,
225 __be16 flags, __be32 key,
226 __be16 gre_proto)
227 {
228 struct net *net = dev_net(dev);
229 int link = dev->ifindex;
230 unsigned int h0 = HASH(remote);
231 unsigned int h1 = HASH(key);
232 struct ip_tunnel *t, *cand = NULL;
233 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
234 int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
235 ARPHRD_ETHER : ARPHRD_IPGRE;
236 int score, cand_score = 4;
237
238 for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
239 if (local != t->parms.iph.saddr ||
240 remote != t->parms.iph.daddr ||
241 !(t->dev->flags & IFF_UP))
242 continue;
243
244 if (!ipgre_key_match(&t->parms, flags, key))
245 continue;
246
247 if (t->dev->type != ARPHRD_IPGRE &&
248 t->dev->type != dev_type)
249 continue;
250
251 score = 0;
252 if (t->parms.link != link)
253 score |= 1;
254 if (t->dev->type != dev_type)
255 score |= 2;
256 if (score == 0)
257 return t;
258
259 if (score < cand_score) {
260 cand = t;
261 cand_score = score;
262 }
263 }
264
265 for_each_ip_tunnel_rcu(t, ign->tunnels_r[h0 ^ h1]) {
266 if (remote != t->parms.iph.daddr ||
267 !(t->dev->flags & IFF_UP))
268 continue;
269
270 if (!ipgre_key_match(&t->parms, flags, key))
271 continue;
272
273 if (t->dev->type != ARPHRD_IPGRE &&
274 t->dev->type != dev_type)
275 continue;
276
277 score = 0;
278 if (t->parms.link != link)
279 score |= 1;
280 if (t->dev->type != dev_type)
281 score |= 2;
282 if (score == 0)
283 return t;
284
285 if (score < cand_score) {
286 cand = t;
287 cand_score = score;
288 }
289 }
290
291 for_each_ip_tunnel_rcu(t, ign->tunnels_l[h1]) {
292 if ((local != t->parms.iph.saddr &&
293 (local != t->parms.iph.daddr ||
294 !ipv4_is_multicast(local))) ||
295 !(t->dev->flags & IFF_UP))
296 continue;
297
298 if (!ipgre_key_match(&t->parms, flags, key))
299 continue;
300
301 if (t->dev->type != ARPHRD_IPGRE &&
302 t->dev->type != dev_type)
303 continue;
304
305 score = 0;
306 if (t->parms.link != link)
307 score |= 1;
308 if (t->dev->type != dev_type)
309 score |= 2;
310 if (score == 0)
311 return t;
312
313 if (score < cand_score) {
314 cand = t;
315 cand_score = score;
316 }
317 }
318
319 for_each_ip_tunnel_rcu(t, ign->tunnels_wc[h1]) {
320 if (t->parms.i_key != key ||
321 !(t->dev->flags & IFF_UP))
322 continue;
323
324 if (t->dev->type != ARPHRD_IPGRE &&
325 t->dev->type != dev_type)
326 continue;
327
328 score = 0;
329 if (t->parms.link != link)
330 score |= 1;
331 if (t->dev->type != dev_type)
332 score |= 2;
333 if (score == 0)
334 return t;
335
336 if (score < cand_score) {
337 cand = t;
338 cand_score = score;
339 }
340 }
341
342 if (cand != NULL)
343 return cand;
344
345 dev = ign->fb_tunnel_dev;
346 if (dev->flags & IFF_UP)
347 return netdev_priv(dev);
348
349 return NULL;
350 }
351
352 static struct ip_tunnel __rcu **__ipgre_bucket(struct ipgre_net *ign,
353 struct ip_tunnel_parm *parms)
354 {
355 __be32 remote = parms->iph.daddr;
356 __be32 local = parms->iph.saddr;
357 __be32 key = parms->i_key;
358 unsigned int h = HASH(key);
359 int prio = 0;
360
361 if (local)
362 prio |= 1;
363 if (remote && !ipv4_is_multicast(remote)) {
364 prio |= 2;
365 h ^= HASH(remote);
366 }
367
368 return &ign->tunnels[prio][h];
369 }
370
371 static inline struct ip_tunnel __rcu **ipgre_bucket(struct ipgre_net *ign,
372 struct ip_tunnel *t)
373 {
374 return __ipgre_bucket(ign, &t->parms);
375 }
376
377 static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
378 {
379 struct ip_tunnel __rcu **tp = ipgre_bucket(ign, t);
380
381 rcu_assign_pointer(t->next, rtnl_dereference(*tp));
382 rcu_assign_pointer(*tp, t);
383 }
384
385 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
386 {
387 struct ip_tunnel __rcu **tp;
388 struct ip_tunnel *iter;
389
390 for (tp = ipgre_bucket(ign, t);
391 (iter = rtnl_dereference(*tp)) != NULL;
392 tp = &iter->next) {
393 if (t == iter) {
394 rcu_assign_pointer(*tp, t->next);
395 break;
396 }
397 }
398 }
399
400 static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
401 struct ip_tunnel_parm *parms,
402 int type)
403 {
404 __be32 remote = parms->iph.daddr;
405 __be32 local = parms->iph.saddr;
406 __be32 key = parms->i_key;
407 int link = parms->link;
408 struct ip_tunnel *t;
409 struct ip_tunnel __rcu **tp;
410 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
411
412 for (tp = __ipgre_bucket(ign, parms);
413 (t = rtnl_dereference(*tp)) != NULL;
414 tp = &t->next)
415 if (local == t->parms.iph.saddr &&
416 remote == t->parms.iph.daddr &&
417 key == t->parms.i_key &&
418 link == t->parms.link &&
419 type == t->dev->type)
420 break;
421
422 return t;
423 }
424
425 static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
426 struct ip_tunnel_parm *parms, int create)
427 {
428 struct ip_tunnel *t, *nt;
429 struct net_device *dev;
430 char name[IFNAMSIZ];
431 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
432
433 t = ipgre_tunnel_find(net, parms, ARPHRD_IPGRE);
434 if (t || !create)
435 return t;
436
437 if (parms->name[0])
438 strlcpy(name, parms->name, IFNAMSIZ);
439 else
440 strcpy(name, "gre%d");
441
442 dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
443 if (!dev)
444 return NULL;
445
446 dev_net_set(dev, net);
447
448 nt = netdev_priv(dev);
449 nt->parms = *parms;
450 dev->rtnl_link_ops = &ipgre_link_ops;
451
452 dev->mtu = ipgre_tunnel_bind_dev(dev);
453
454 if (register_netdevice(dev) < 0)
455 goto failed_free;
456
457 /* Can use a lockless transmit, unless we generate output sequences */
458 if (!(nt->parms.o_flags & GRE_SEQ))
459 dev->features |= NETIF_F_LLTX;
460
461 dev_hold(dev);
462 ipgre_tunnel_link(ign, nt);
463 return nt;
464
465 failed_free:
466 free_netdev(dev);
467 return NULL;
468 }
469
470 static void ipgre_tunnel_uninit(struct net_device *dev)
471 {
472 struct net *net = dev_net(dev);
473 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
474
475 ipgre_tunnel_unlink(ign, netdev_priv(dev));
476 dev_put(dev);
477 }
478
479
480 static void ipgre_err(struct sk_buff *skb, u32 info)
481 {
482
483 /* All the routers (except for Linux) return only
484 8 bytes of packet payload. It means, that precise relaying of
485 ICMP in the real Internet is absolutely infeasible.
486
487 Moreover, Cisco "wise men" put GRE key to the third word
488 in GRE header. It makes impossible maintaining even soft state for keyed
489 GRE tunnels with enabled checksum. Tell them "thank you".
490
491 Well, I wonder, rfc1812 was written by Cisco employee,
492 what the hell these idiots break standards established
493 by themselves???
494 */
495
496 const struct iphdr *iph = (const struct iphdr *)skb->data;
497 __be16 *p = (__be16 *)(skb->data+(iph->ihl<<2));
498 int grehlen = (iph->ihl<<2) + 4;
499 const int type = icmp_hdr(skb)->type;
500 const int code = icmp_hdr(skb)->code;
501 struct ip_tunnel *t;
502 __be16 flags;
503 __be32 key = 0;
504
505 flags = p[0];
506 if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
507 if (flags&(GRE_VERSION|GRE_ROUTING))
508 return;
509 if (flags&GRE_KEY) {
510 grehlen += 4;
511 if (flags&GRE_CSUM)
512 grehlen += 4;
513 }
514 }
515
516 /* If only 8 bytes returned, keyed message will be dropped here */
517 if (skb_headlen(skb) < grehlen)
518 return;
519
520 if (flags & GRE_KEY)
521 key = *(((__be32 *)p) + (grehlen / 4) - 1);
522
523 switch (type) {
524 default:
525 case ICMP_PARAMETERPROB:
526 return;
527
528 case ICMP_DEST_UNREACH:
529 switch (code) {
530 case ICMP_SR_FAILED:
531 case ICMP_PORT_UNREACH:
532 /* Impossible event. */
533 return;
534 default:
535 /* All others are translated to HOST_UNREACH.
536 rfc2003 contains "deep thoughts" about NET_UNREACH,
537 I believe they are just ether pollution. --ANK
538 */
539 break;
540 }
541 break;
542 case ICMP_TIME_EXCEEDED:
543 if (code != ICMP_EXC_TTL)
544 return;
545 break;
546
547 case ICMP_REDIRECT:
548 break;
549 }
550
551 t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
552 flags, key, p[1]);
553
554 if (t == NULL)
555 return;
556
557 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
558 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
559 t->parms.link, 0, IPPROTO_GRE, 0);
560 return;
561 }
562 if (type == ICMP_REDIRECT) {
563 ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
564 IPPROTO_GRE, 0);
565 return;
566 }
567 if (t->parms.iph.daddr == 0 ||
568 ipv4_is_multicast(t->parms.iph.daddr))
569 return;
570
571 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
572 return;
573
574 if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
575 t->err_count++;
576 else
577 t->err_count = 1;
578 t->err_time = jiffies;
579 }
580
581 static inline u8
582 ipgre_ecn_encapsulate(u8 tos, const struct iphdr *old_iph, struct sk_buff *skb)
583 {
584 u8 inner = 0;
585 if (skb->protocol == htons(ETH_P_IP))
586 inner = old_iph->tos;
587 else if (skb->protocol == htons(ETH_P_IPV6))
588 inner = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
589 return INET_ECN_encapsulate(tos, inner);
590 }
591
592 static int ipgre_rcv(struct sk_buff *skb)
593 {
594 const struct iphdr *iph;
595 u8 *h;
596 __be16 flags;
597 __sum16 csum = 0;
598 __be32 key = 0;
599 u32 seqno = 0;
600 struct ip_tunnel *tunnel;
601 int offset = 4;
602 __be16 gre_proto;
603 int err;
604
605 if (!pskb_may_pull(skb, 16))
606 goto drop;
607
608 iph = ip_hdr(skb);
609 h = skb->data;
610 flags = *(__be16 *)h;
611
612 if (flags&(GRE_CSUM|GRE_KEY|GRE_ROUTING|GRE_SEQ|GRE_VERSION)) {
613 /* - Version must be 0.
614 - We do not support routing headers.
615 */
616 if (flags&(GRE_VERSION|GRE_ROUTING))
617 goto drop;
618
619 if (flags&GRE_CSUM) {
620 switch (skb->ip_summed) {
621 case CHECKSUM_COMPLETE:
622 csum = csum_fold(skb->csum);
623 if (!csum)
624 break;
625 /* fall through */
626 case CHECKSUM_NONE:
627 skb->csum = 0;
628 csum = __skb_checksum_complete(skb);
629 skb->ip_summed = CHECKSUM_COMPLETE;
630 }
631 offset += 4;
632 }
633 if (flags&GRE_KEY) {
634 key = *(__be32 *)(h + offset);
635 offset += 4;
636 }
637 if (flags&GRE_SEQ) {
638 seqno = ntohl(*(__be32 *)(h + offset));
639 offset += 4;
640 }
641 }
642
643 gre_proto = *(__be16 *)(h + 2);
644
645 tunnel = ipgre_tunnel_lookup(skb->dev,
646 iph->saddr, iph->daddr, flags, key,
647 gre_proto);
648 if (tunnel) {
649 struct pcpu_tstats *tstats;
650
651 secpath_reset(skb);
652
653 skb->protocol = gre_proto;
654 /* WCCP version 1 and 2 protocol decoding.
655 * - Change protocol to IP
656 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
657 */
658 if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
659 skb->protocol = htons(ETH_P_IP);
660 if ((*(h + offset) & 0xF0) != 0x40)
661 offset += 4;
662 }
663
664 skb->mac_header = skb->network_header;
665 __pskb_pull(skb, offset);
666 skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
667 skb->pkt_type = PACKET_HOST;
668 #ifdef CONFIG_NET_IPGRE_BROADCAST
669 if (ipv4_is_multicast(iph->daddr)) {
670 /* Looped back packet, drop it! */
671 if (rt_is_output_route(skb_rtable(skb)))
672 goto drop;
673 tunnel->dev->stats.multicast++;
674 skb->pkt_type = PACKET_BROADCAST;
675 }
676 #endif
677
678 if (((flags&GRE_CSUM) && csum) ||
679 (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
680 tunnel->dev->stats.rx_crc_errors++;
681 tunnel->dev->stats.rx_errors++;
682 goto drop;
683 }
684 if (tunnel->parms.i_flags&GRE_SEQ) {
685 if (!(flags&GRE_SEQ) ||
686 (tunnel->i_seqno && (s32)(seqno - tunnel->i_seqno) < 0)) {
687 tunnel->dev->stats.rx_fifo_errors++;
688 tunnel->dev->stats.rx_errors++;
689 goto drop;
690 }
691 tunnel->i_seqno = seqno + 1;
692 }
693
694 /* Warning: All skb pointers will be invalidated! */
695 if (tunnel->dev->type == ARPHRD_ETHER) {
696 if (!pskb_may_pull(skb, ETH_HLEN)) {
697 tunnel->dev->stats.rx_length_errors++;
698 tunnel->dev->stats.rx_errors++;
699 goto drop;
700 }
701
702 iph = ip_hdr(skb);
703 skb->protocol = eth_type_trans(skb, tunnel->dev);
704 skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
705 }
706
707 __skb_tunnel_rx(skb, tunnel->dev);
708
709 skb_reset_network_header(skb);
710 err = IP_ECN_decapsulate(iph, skb);
711 if (unlikely(err)) {
712 if (log_ecn_error)
713 net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
714 &iph->saddr, iph->tos);
715 if (err > 1) {
716 ++tunnel->dev->stats.rx_frame_errors;
717 ++tunnel->dev->stats.rx_errors;
718 goto drop;
719 }
720 }
721
722 tstats = this_cpu_ptr(tunnel->dev->tstats);
723 u64_stats_update_begin(&tstats->syncp);
724 tstats->rx_packets++;
725 tstats->rx_bytes += skb->len;
726 u64_stats_update_end(&tstats->syncp);
727
728 gro_cells_receive(&tunnel->gro_cells, skb);
729 return 0;
730 }
731 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
732
733 drop:
734 kfree_skb(skb);
735 return 0;
736 }
737
738 static struct sk_buff *handle_offloads(struct ip_tunnel *tunnel, struct sk_buff *skb)
739 {
740 int err;
741
742 if (skb_is_gso(skb)) {
743 err = skb_unclone(skb, GFP_ATOMIC);
744 if (unlikely(err))
745 goto error;
746 skb_shinfo(skb)->gso_type |= SKB_GSO_GRE;
747 return skb;
748 } else if (skb->ip_summed == CHECKSUM_PARTIAL &&
749 tunnel->parms.o_flags&GRE_CSUM) {
750 err = skb_checksum_help(skb);
751 if (unlikely(err))
752 goto error;
753 } else if (skb->ip_summed != CHECKSUM_PARTIAL)
754 skb->ip_summed = CHECKSUM_NONE;
755
756 return skb;
757
758 error:
759 kfree_skb(skb);
760 return ERR_PTR(err);
761 }
762
763 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
764 {
765 struct pcpu_tstats *tstats = this_cpu_ptr(dev->tstats);
766 struct ip_tunnel *tunnel = netdev_priv(dev);
767 const struct iphdr *old_iph;
768 const struct iphdr *tiph;
769 struct flowi4 fl4;
770 u8 tos;
771 __be16 df;
772 struct rtable *rt; /* Route to the other host */
773 struct net_device *tdev; /* Device to other host */
774 struct iphdr *iph; /* Our new IP header */
775 unsigned int max_headroom; /* The extra header space needed */
776 int gre_hlen;
777 __be32 dst;
778 int mtu;
779 u8 ttl;
780 int err;
781 int pkt_len;
782
783 skb = handle_offloads(tunnel, skb);
784 if (IS_ERR(skb)) {
785 dev->stats.tx_dropped++;
786 return NETDEV_TX_OK;
787 }
788
789 if (!skb->encapsulation) {
790 skb_reset_inner_headers(skb);
791 skb->encapsulation = 1;
792 }
793
794 old_iph = ip_hdr(skb);
795
796 if (dev->type == ARPHRD_ETHER)
797 IPCB(skb)->flags = 0;
798
799 if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
800 gre_hlen = 0;
801 if (skb->protocol == htons(ETH_P_IP))
802 tiph = (const struct iphdr *)skb->data;
803 else
804 tiph = &tunnel->parms.iph;
805 } else {
806 gre_hlen = tunnel->hlen;
807 tiph = &tunnel->parms.iph;
808 }
809
810 if ((dst = tiph->daddr) == 0) {
811 /* NBMA tunnel */
812
813 if (skb_dst(skb) == NULL) {
814 dev->stats.tx_fifo_errors++;
815 goto tx_error;
816 }
817
818 if (skb->protocol == htons(ETH_P_IP)) {
819 rt = skb_rtable(skb);
820 dst = rt_nexthop(rt, old_iph->daddr);
821 }
822 #if IS_ENABLED(CONFIG_IPV6)
823 else if (skb->protocol == htons(ETH_P_IPV6)) {
824 const struct in6_addr *addr6;
825 struct neighbour *neigh;
826 bool do_tx_error_icmp;
827 int addr_type;
828
829 neigh = dst_neigh_lookup(skb_dst(skb), &ipv6_hdr(skb)->daddr);
830 if (neigh == NULL)
831 goto tx_error;
832
833 addr6 = (const struct in6_addr *)&neigh->primary_key;
834 addr_type = ipv6_addr_type(addr6);
835
836 if (addr_type == IPV6_ADDR_ANY) {
837 addr6 = &ipv6_hdr(skb)->daddr;
838 addr_type = ipv6_addr_type(addr6);
839 }
840
841 if ((addr_type & IPV6_ADDR_COMPATv4) == 0)
842 do_tx_error_icmp = true;
843 else {
844 do_tx_error_icmp = false;
845 dst = addr6->s6_addr32[3];
846 }
847 neigh_release(neigh);
848 if (do_tx_error_icmp)
849 goto tx_error_icmp;
850 }
851 #endif
852 else
853 goto tx_error;
854 }
855
856 ttl = tiph->ttl;
857 tos = tiph->tos;
858 if (tos & 0x1) {
859 tos &= ~0x1;
860 if (skb->protocol == htons(ETH_P_IP))
861 tos = old_iph->tos;
862 else if (skb->protocol == htons(ETH_P_IPV6))
863 tos = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
864 }
865
866 rt = ip_route_output_gre(dev_net(dev), &fl4, dst, tiph->saddr,
867 tunnel->parms.o_key, RT_TOS(tos),
868 tunnel->parms.link);
869 if (IS_ERR(rt)) {
870 dev->stats.tx_carrier_errors++;
871 goto tx_error;
872 }
873 tdev = rt->dst.dev;
874
875 if (tdev == dev) {
876 ip_rt_put(rt);
877 dev->stats.collisions++;
878 goto tx_error;
879 }
880
881 df = tiph->frag_off;
882 if (df)
883 mtu = dst_mtu(&rt->dst) - dev->hard_header_len - tunnel->hlen;
884 else
885 mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
886
887 if (skb_dst(skb))
888 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
889
890 if (skb->protocol == htons(ETH_P_IP)) {
891 df |= (old_iph->frag_off&htons(IP_DF));
892
893 if (!skb_is_gso(skb) &&
894 (old_iph->frag_off&htons(IP_DF)) &&
895 mtu < ntohs(old_iph->tot_len)) {
896 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
897 ip_rt_put(rt);
898 goto tx_error;
899 }
900 }
901 #if IS_ENABLED(CONFIG_IPV6)
902 else if (skb->protocol == htons(ETH_P_IPV6)) {
903 struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
904
905 if (rt6 && mtu < dst_mtu(skb_dst(skb)) && mtu >= IPV6_MIN_MTU) {
906 if ((tunnel->parms.iph.daddr &&
907 !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
908 rt6->rt6i_dst.plen == 128) {
909 rt6->rt6i_flags |= RTF_MODIFIED;
910 dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
911 }
912 }
913
914 if (!skb_is_gso(skb) &&
915 mtu >= IPV6_MIN_MTU &&
916 mtu < skb->len - tunnel->hlen + gre_hlen) {
917 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
918 ip_rt_put(rt);
919 goto tx_error;
920 }
921 }
922 #endif
923
924 if (tunnel->err_count > 0) {
925 if (time_before(jiffies,
926 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
927 tunnel->err_count--;
928
929 dst_link_failure(skb);
930 } else
931 tunnel->err_count = 0;
932 }
933
934 max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->dst.header_len;
935
936 if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
937 (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
938 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
939 if (max_headroom > dev->needed_headroom)
940 dev->needed_headroom = max_headroom;
941 if (!new_skb) {
942 ip_rt_put(rt);
943 dev->stats.tx_dropped++;
944 dev_kfree_skb(skb);
945 return NETDEV_TX_OK;
946 }
947 if (skb->sk)
948 skb_set_owner_w(new_skb, skb->sk);
949 dev_kfree_skb(skb);
950 skb = new_skb;
951 old_iph = ip_hdr(skb);
952 /* Warning : tiph value might point to freed memory */
953 }
954
955 skb_push(skb, gre_hlen);
956 skb_reset_network_header(skb);
957 skb_set_transport_header(skb, sizeof(*iph));
958 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
959 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
960 IPSKB_REROUTED);
961 skb_dst_drop(skb);
962 skb_dst_set(skb, &rt->dst);
963
964 /*
965 * Push down and install the IPIP header.
966 */
967
968 iph = ip_hdr(skb);
969 iph->version = 4;
970 iph->ihl = sizeof(struct iphdr) >> 2;
971 iph->frag_off = df;
972 iph->protocol = IPPROTO_GRE;
973 iph->tos = ipgre_ecn_encapsulate(tos, old_iph, skb);
974 iph->daddr = fl4.daddr;
975 iph->saddr = fl4.saddr;
976 iph->ttl = ttl;
977
978 tunnel_ip_select_ident(skb, old_iph, &rt->dst);
979
980 if (ttl == 0) {
981 if (skb->protocol == htons(ETH_P_IP))
982 iph->ttl = old_iph->ttl;
983 #if IS_ENABLED(CONFIG_IPV6)
984 else if (skb->protocol == htons(ETH_P_IPV6))
985 iph->ttl = ((const struct ipv6hdr *)old_iph)->hop_limit;
986 #endif
987 else
988 iph->ttl = ip4_dst_hoplimit(&rt->dst);
989 }
990
991 ((__be16 *)(iph + 1))[0] = tunnel->parms.o_flags;
992 ((__be16 *)(iph + 1))[1] = (dev->type == ARPHRD_ETHER) ?
993 htons(ETH_P_TEB) : skb->protocol;
994
995 if (tunnel->parms.o_flags&(GRE_KEY|GRE_CSUM|GRE_SEQ)) {
996 __be32 *ptr = (__be32 *)(((u8 *)iph) + tunnel->hlen - 4);
997
998 if (tunnel->parms.o_flags&GRE_SEQ) {
999 ++tunnel->o_seqno;
1000 *ptr = htonl(tunnel->o_seqno);
1001 ptr--;
1002 }
1003 if (tunnel->parms.o_flags&GRE_KEY) {
1004 *ptr = tunnel->parms.o_key;
1005 ptr--;
1006 }
1007 /* Skip GRE checksum if skb is getting offloaded. */
1008 if (!(skb_shinfo(skb)->gso_type & SKB_GSO_GRE) &&
1009 (tunnel->parms.o_flags&GRE_CSUM)) {
1010 int offset = skb_transport_offset(skb);
1011
1012 if (skb_has_shared_frag(skb)) {
1013 err = __skb_linearize(skb);
1014 if (err)
1015 goto tx_error;
1016 }
1017
1018 *ptr = 0;
1019 *(__sum16 *)ptr = csum_fold(skb_checksum(skb, offset,
1020 skb->len - offset,
1021 0));
1022 }
1023 }
1024
1025 nf_reset(skb);
1026
1027 pkt_len = skb->len - skb_transport_offset(skb);
1028 err = ip_local_out(skb);
1029 if (likely(net_xmit_eval(err) == 0)) {
1030 u64_stats_update_begin(&tstats->syncp);
1031 tstats->tx_bytes += pkt_len;
1032 tstats->tx_packets++;
1033 u64_stats_update_end(&tstats->syncp);
1034 } else {
1035 dev->stats.tx_errors++;
1036 dev->stats.tx_aborted_errors++;
1037 }
1038 return NETDEV_TX_OK;
1039
1040 #if IS_ENABLED(CONFIG_IPV6)
1041 tx_error_icmp:
1042 dst_link_failure(skb);
1043 #endif
1044 tx_error:
1045 dev->stats.tx_errors++;
1046 dev_kfree_skb(skb);
1047 return NETDEV_TX_OK;
1048 }
1049
1050 static int ipgre_tunnel_bind_dev(struct net_device *dev)
1051 {
1052 struct net_device *tdev = NULL;
1053 struct ip_tunnel *tunnel;
1054 const struct iphdr *iph;
1055 int hlen = LL_MAX_HEADER;
1056 int mtu = ETH_DATA_LEN;
1057 int addend = sizeof(struct iphdr) + 4;
1058
1059 tunnel = netdev_priv(dev);
1060 iph = &tunnel->parms.iph;
1061
1062 /* Guess output device to choose reasonable mtu and needed_headroom */
1063
1064 if (iph->daddr) {
1065 struct flowi4 fl4;
1066 struct rtable *rt;
1067
1068 rt = ip_route_output_gre(dev_net(dev), &fl4,
1069 iph->daddr, iph->saddr,
1070 tunnel->parms.o_key,
1071 RT_TOS(iph->tos),
1072 tunnel->parms.link);
1073 if (!IS_ERR(rt)) {
1074 tdev = rt->dst.dev;
1075 ip_rt_put(rt);
1076 }
1077
1078 if (dev->type != ARPHRD_ETHER)
1079 dev->flags |= IFF_POINTOPOINT;
1080 }
1081
1082 if (!tdev && tunnel->parms.link)
1083 tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
1084
1085 if (tdev) {
1086 hlen = tdev->hard_header_len + tdev->needed_headroom;
1087 mtu = tdev->mtu;
1088 }
1089 dev->iflink = tunnel->parms.link;
1090
1091 /* Precalculate GRE options length */
1092 if (tunnel->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
1093 if (tunnel->parms.o_flags&GRE_CSUM)
1094 addend += 4;
1095 if (tunnel->parms.o_flags&GRE_KEY)
1096 addend += 4;
1097 if (tunnel->parms.o_flags&GRE_SEQ)
1098 addend += 4;
1099 }
1100 dev->needed_headroom = addend + hlen;
1101 mtu -= dev->hard_header_len + addend;
1102
1103 if (mtu < 68)
1104 mtu = 68;
1105
1106 tunnel->hlen = addend;
1107 /* TCP offload with GRE SEQ is not supported. */
1108 if (!(tunnel->parms.o_flags & GRE_SEQ)) {
1109 dev->features |= NETIF_F_GSO_SOFTWARE;
1110 dev->hw_features |= NETIF_F_GSO_SOFTWARE;
1111 }
1112
1113 return mtu;
1114 }
1115
1116 static int
1117 ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
1118 {
1119 int err = 0;
1120 struct ip_tunnel_parm p;
1121 struct ip_tunnel *t;
1122 struct net *net = dev_net(dev);
1123 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1124
1125 switch (cmd) {
1126 case SIOCGETTUNNEL:
1127 t = NULL;
1128 if (dev == ign->fb_tunnel_dev) {
1129 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
1130 err = -EFAULT;
1131 break;
1132 }
1133 t = ipgre_tunnel_locate(net, &p, 0);
1134 }
1135 if (t == NULL)
1136 t = netdev_priv(dev);
1137 memcpy(&p, &t->parms, sizeof(p));
1138 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
1139 err = -EFAULT;
1140 break;
1141
1142 case SIOCADDTUNNEL:
1143 case SIOCCHGTUNNEL:
1144 err = -EPERM;
1145 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1146 goto done;
1147
1148 err = -EFAULT;
1149 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1150 goto done;
1151
1152 err = -EINVAL;
1153 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
1154 p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
1155 ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
1156 goto done;
1157 if (p.iph.ttl)
1158 p.iph.frag_off |= htons(IP_DF);
1159
1160 if (!(p.i_flags&GRE_KEY))
1161 p.i_key = 0;
1162 if (!(p.o_flags&GRE_KEY))
1163 p.o_key = 0;
1164
1165 t = ipgre_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
1166
1167 if (dev != ign->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
1168 if (t != NULL) {
1169 if (t->dev != dev) {
1170 err = -EEXIST;
1171 break;
1172 }
1173 } else {
1174 unsigned int nflags = 0;
1175
1176 t = netdev_priv(dev);
1177
1178 if (ipv4_is_multicast(p.iph.daddr))
1179 nflags = IFF_BROADCAST;
1180 else if (p.iph.daddr)
1181 nflags = IFF_POINTOPOINT;
1182
1183 if ((dev->flags^nflags)&(IFF_POINTOPOINT|IFF_BROADCAST)) {
1184 err = -EINVAL;
1185 break;
1186 }
1187 ipgre_tunnel_unlink(ign, t);
1188 synchronize_net();
1189 t->parms.iph.saddr = p.iph.saddr;
1190 t->parms.iph.daddr = p.iph.daddr;
1191 t->parms.i_key = p.i_key;
1192 t->parms.o_key = p.o_key;
1193 memcpy(dev->dev_addr, &p.iph.saddr, 4);
1194 memcpy(dev->broadcast, &p.iph.daddr, 4);
1195 ipgre_tunnel_link(ign, t);
1196 netdev_state_change(dev);
1197 }
1198 }
1199
1200 if (t) {
1201 err = 0;
1202 if (cmd == SIOCCHGTUNNEL) {
1203 t->parms.iph.ttl = p.iph.ttl;
1204 t->parms.iph.tos = p.iph.tos;
1205 t->parms.iph.frag_off = p.iph.frag_off;
1206 if (t->parms.link != p.link) {
1207 t->parms.link = p.link;
1208 dev->mtu = ipgre_tunnel_bind_dev(dev);
1209 netdev_state_change(dev);
1210 }
1211 }
1212 if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
1213 err = -EFAULT;
1214 } else
1215 err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
1216 break;
1217
1218 case SIOCDELTUNNEL:
1219 err = -EPERM;
1220 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1221 goto done;
1222
1223 if (dev == ign->fb_tunnel_dev) {
1224 err = -EFAULT;
1225 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1226 goto done;
1227 err = -ENOENT;
1228 if ((t = ipgre_tunnel_locate(net, &p, 0)) == NULL)
1229 goto done;
1230 err = -EPERM;
1231 if (t == netdev_priv(ign->fb_tunnel_dev))
1232 goto done;
1233 dev = t->dev;
1234 }
1235 unregister_netdevice(dev);
1236 err = 0;
1237 break;
1238
1239 default:
1240 err = -EINVAL;
1241 }
1242
1243 done:
1244 return err;
1245 }
1246
1247 static int ipgre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
1248 {
1249 struct ip_tunnel *tunnel = netdev_priv(dev);
1250 if (new_mtu < 68 ||
1251 new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
1252 return -EINVAL;
1253 dev->mtu = new_mtu;
1254 return 0;
1255 }
1256
1257 /* Nice toy. Unfortunately, useless in real life :-)
1258 It allows to construct virtual multiprotocol broadcast "LAN"
1259 over the Internet, provided multicast routing is tuned.
1260
1261
1262 I have no idea was this bicycle invented before me,
1263 so that I had to set ARPHRD_IPGRE to a random value.
1264 I have an impression, that Cisco could make something similar,
1265 but this feature is apparently missing in IOS<=11.2(8).
1266
1267 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks
1268 with broadcast 224.66.66.66. If you have access to mbone, play with me :-)
1269
1270 ping -t 255 224.66.66.66
1271
1272 If nobody answers, mbone does not work.
1273
1274 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255
1275 ip addr add 10.66.66.<somewhat>/24 dev Universe
1276 ifconfig Universe up
1277 ifconfig Universe add fe80::<Your_real_addr>/10
1278 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96
1279 ftp 10.66.66.66
1280 ...
1281 ftp fec0:6666:6666::193.233.7.65
1282 ...
1283
1284 */
1285
1286 static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
1287 unsigned short type,
1288 const void *daddr, const void *saddr, unsigned int len)
1289 {
1290 struct ip_tunnel *t = netdev_priv(dev);
1291 struct iphdr *iph = (struct iphdr *)skb_push(skb, t->hlen);
1292 __be16 *p = (__be16 *)(iph+1);
1293
1294 memcpy(iph, &t->parms.iph, sizeof(struct iphdr));
1295 p[0] = t->parms.o_flags;
1296 p[1] = htons(type);
1297
1298 /*
1299 * Set the source hardware address.
1300 */
1301
1302 if (saddr)
1303 memcpy(&iph->saddr, saddr, 4);
1304 if (daddr)
1305 memcpy(&iph->daddr, daddr, 4);
1306 if (iph->daddr)
1307 return t->hlen;
1308
1309 return -t->hlen;
1310 }
1311
1312 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
1313 {
1314 const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
1315 memcpy(haddr, &iph->saddr, 4);
1316 return 4;
1317 }
1318
1319 static const struct header_ops ipgre_header_ops = {
1320 .create = ipgre_header,
1321 .parse = ipgre_header_parse,
1322 };
1323
1324 #ifdef CONFIG_NET_IPGRE_BROADCAST
1325 static int ipgre_open(struct net_device *dev)
1326 {
1327 struct ip_tunnel *t = netdev_priv(dev);
1328
1329 if (ipv4_is_multicast(t->parms.iph.daddr)) {
1330 struct flowi4 fl4;
1331 struct rtable *rt;
1332
1333 rt = ip_route_output_gre(dev_net(dev), &fl4,
1334 t->parms.iph.daddr,
1335 t->parms.iph.saddr,
1336 t->parms.o_key,
1337 RT_TOS(t->parms.iph.tos),
1338 t->parms.link);
1339 if (IS_ERR(rt))
1340 return -EADDRNOTAVAIL;
1341 dev = rt->dst.dev;
1342 ip_rt_put(rt);
1343 if (__in_dev_get_rtnl(dev) == NULL)
1344 return -EADDRNOTAVAIL;
1345 t->mlink = dev->ifindex;
1346 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
1347 }
1348 return 0;
1349 }
1350
1351 static int ipgre_close(struct net_device *dev)
1352 {
1353 struct ip_tunnel *t = netdev_priv(dev);
1354
1355 if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) {
1356 struct in_device *in_dev;
1357 in_dev = inetdev_by_index(dev_net(dev), t->mlink);
1358 if (in_dev)
1359 ip_mc_dec_group(in_dev, t->parms.iph.daddr);
1360 }
1361 return 0;
1362 }
1363
1364 #endif
1365
1366 static const struct net_device_ops ipgre_netdev_ops = {
1367 .ndo_init = ipgre_tunnel_init,
1368 .ndo_uninit = ipgre_tunnel_uninit,
1369 #ifdef CONFIG_NET_IPGRE_BROADCAST
1370 .ndo_open = ipgre_open,
1371 .ndo_stop = ipgre_close,
1372 #endif
1373 .ndo_start_xmit = ipgre_tunnel_xmit,
1374 .ndo_do_ioctl = ipgre_tunnel_ioctl,
1375 .ndo_change_mtu = ipgre_tunnel_change_mtu,
1376 .ndo_get_stats64 = ipgre_get_stats64,
1377 };
1378
1379 static void ipgre_dev_free(struct net_device *dev)
1380 {
1381 struct ip_tunnel *tunnel = netdev_priv(dev);
1382
1383 gro_cells_destroy(&tunnel->gro_cells);
1384 free_percpu(dev->tstats);
1385 free_netdev(dev);
1386 }
1387
1388 #define GRE_FEATURES (NETIF_F_SG | \
1389 NETIF_F_FRAGLIST | \
1390 NETIF_F_HIGHDMA | \
1391 NETIF_F_HW_CSUM)
1392
1393 static void ipgre_tunnel_setup(struct net_device *dev)
1394 {
1395 dev->netdev_ops = &ipgre_netdev_ops;
1396 dev->destructor = ipgre_dev_free;
1397
1398 dev->type = ARPHRD_IPGRE;
1399 dev->needed_headroom = LL_MAX_HEADER + sizeof(struct iphdr) + 4;
1400 dev->mtu = ETH_DATA_LEN - sizeof(struct iphdr) - 4;
1401 dev->flags = IFF_NOARP;
1402 dev->iflink = 0;
1403 dev->addr_len = 4;
1404 dev->features |= NETIF_F_NETNS_LOCAL;
1405 dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
1406
1407 dev->features |= GRE_FEATURES;
1408 dev->hw_features |= GRE_FEATURES;
1409 }
1410
1411 static int ipgre_tunnel_init(struct net_device *dev)
1412 {
1413 struct ip_tunnel *tunnel;
1414 struct iphdr *iph;
1415 int err;
1416
1417 tunnel = netdev_priv(dev);
1418 iph = &tunnel->parms.iph;
1419
1420 tunnel->dev = dev;
1421 strcpy(tunnel->parms.name, dev->name);
1422
1423 memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
1424 memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
1425
1426 if (iph->daddr) {
1427 #ifdef CONFIG_NET_IPGRE_BROADCAST
1428 if (ipv4_is_multicast(iph->daddr)) {
1429 if (!iph->saddr)
1430 return -EINVAL;
1431 dev->flags = IFF_BROADCAST;
1432 dev->header_ops = &ipgre_header_ops;
1433 }
1434 #endif
1435 } else
1436 dev->header_ops = &ipgre_header_ops;
1437
1438 dev->tstats = alloc_percpu(struct pcpu_tstats);
1439 if (!dev->tstats)
1440 return -ENOMEM;
1441
1442 err = gro_cells_init(&tunnel->gro_cells, dev);
1443 if (err) {
1444 free_percpu(dev->tstats);
1445 return err;
1446 }
1447
1448 return 0;
1449 }
1450
1451 static void ipgre_fb_tunnel_init(struct net_device *dev)
1452 {
1453 struct ip_tunnel *tunnel = netdev_priv(dev);
1454 struct iphdr *iph = &tunnel->parms.iph;
1455
1456 tunnel->dev = dev;
1457 strcpy(tunnel->parms.name, dev->name);
1458
1459 iph->version = 4;
1460 iph->protocol = IPPROTO_GRE;
1461 iph->ihl = 5;
1462 tunnel->hlen = sizeof(struct iphdr) + 4;
1463
1464 dev_hold(dev);
1465 }
1466
1467
1468 static const struct gre_protocol ipgre_protocol = {
1469 .handler = ipgre_rcv,
1470 .err_handler = ipgre_err,
1471 };
1472
1473 static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
1474 {
1475 int prio;
1476
1477 for (prio = 0; prio < 4; prio++) {
1478 int h;
1479 for (h = 0; h < HASH_SIZE; h++) {
1480 struct ip_tunnel *t;
1481
1482 t = rtnl_dereference(ign->tunnels[prio][h]);
1483
1484 while (t != NULL) {
1485 unregister_netdevice_queue(t->dev, head);
1486 t = rtnl_dereference(t->next);
1487 }
1488 }
1489 }
1490 }
1491
1492 static int __net_init ipgre_init_net(struct net *net)
1493 {
1494 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1495 int err;
1496
1497 ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0",
1498 ipgre_tunnel_setup);
1499 if (!ign->fb_tunnel_dev) {
1500 err = -ENOMEM;
1501 goto err_alloc_dev;
1502 }
1503 dev_net_set(ign->fb_tunnel_dev, net);
1504
1505 ipgre_fb_tunnel_init(ign->fb_tunnel_dev);
1506 ign->fb_tunnel_dev->rtnl_link_ops = &ipgre_link_ops;
1507
1508 if ((err = register_netdev(ign->fb_tunnel_dev)))
1509 goto err_reg_dev;
1510
1511 rcu_assign_pointer(ign->tunnels_wc[0],
1512 netdev_priv(ign->fb_tunnel_dev));
1513 return 0;
1514
1515 err_reg_dev:
1516 ipgre_dev_free(ign->fb_tunnel_dev);
1517 err_alloc_dev:
1518 return err;
1519 }
1520
1521 static void __net_exit ipgre_exit_net(struct net *net)
1522 {
1523 struct ipgre_net *ign;
1524 LIST_HEAD(list);
1525
1526 ign = net_generic(net, ipgre_net_id);
1527 rtnl_lock();
1528 ipgre_destroy_tunnels(ign, &list);
1529 unregister_netdevice_many(&list);
1530 rtnl_unlock();
1531 }
1532
1533 static struct pernet_operations ipgre_net_ops = {
1534 .init = ipgre_init_net,
1535 .exit = ipgre_exit_net,
1536 .id = &ipgre_net_id,
1537 .size = sizeof(struct ipgre_net),
1538 };
1539
1540 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
1541 {
1542 __be16 flags;
1543
1544 if (!data)
1545 return 0;
1546
1547 flags = 0;
1548 if (data[IFLA_GRE_IFLAGS])
1549 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
1550 if (data[IFLA_GRE_OFLAGS])
1551 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
1552 if (flags & (GRE_VERSION|GRE_ROUTING))
1553 return -EINVAL;
1554
1555 return 0;
1556 }
1557
1558 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[])
1559 {
1560 __be32 daddr;
1561
1562 if (tb[IFLA_ADDRESS]) {
1563 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
1564 return -EINVAL;
1565 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
1566 return -EADDRNOTAVAIL;
1567 }
1568
1569 if (!data)
1570 goto out;
1571
1572 if (data[IFLA_GRE_REMOTE]) {
1573 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4);
1574 if (!daddr)
1575 return -EINVAL;
1576 }
1577
1578 out:
1579 return ipgre_tunnel_validate(tb, data);
1580 }
1581
1582 static void ipgre_netlink_parms(struct nlattr *data[],
1583 struct ip_tunnel_parm *parms)
1584 {
1585 memset(parms, 0, sizeof(*parms));
1586
1587 parms->iph.protocol = IPPROTO_GRE;
1588
1589 if (!data)
1590 return;
1591
1592 if (data[IFLA_GRE_LINK])
1593 parms->link = nla_get_u32(data[IFLA_GRE_LINK]);
1594
1595 if (data[IFLA_GRE_IFLAGS])
1596 parms->i_flags = nla_get_be16(data[IFLA_GRE_IFLAGS]);
1597
1598 if (data[IFLA_GRE_OFLAGS])
1599 parms->o_flags = nla_get_be16(data[IFLA_GRE_OFLAGS]);
1600
1601 if (data[IFLA_GRE_IKEY])
1602 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]);
1603
1604 if (data[IFLA_GRE_OKEY])
1605 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]);
1606
1607 if (data[IFLA_GRE_LOCAL])
1608 parms->iph.saddr = nla_get_be32(data[IFLA_GRE_LOCAL]);
1609
1610 if (data[IFLA_GRE_REMOTE])
1611 parms->iph.daddr = nla_get_be32(data[IFLA_GRE_REMOTE]);
1612
1613 if (data[IFLA_GRE_TTL])
1614 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]);
1615
1616 if (data[IFLA_GRE_TOS])
1617 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]);
1618
1619 if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC]))
1620 parms->iph.frag_off = htons(IP_DF);
1621 }
1622
1623 static int ipgre_tap_init(struct net_device *dev)
1624 {
1625 struct ip_tunnel *tunnel;
1626
1627 tunnel = netdev_priv(dev);
1628
1629 tunnel->dev = dev;
1630 strcpy(tunnel->parms.name, dev->name);
1631
1632 ipgre_tunnel_bind_dev(dev);
1633
1634 dev->tstats = alloc_percpu(struct pcpu_tstats);
1635 if (!dev->tstats)
1636 return -ENOMEM;
1637
1638 return 0;
1639 }
1640
1641 static const struct net_device_ops ipgre_tap_netdev_ops = {
1642 .ndo_init = ipgre_tap_init,
1643 .ndo_uninit = ipgre_tunnel_uninit,
1644 .ndo_start_xmit = ipgre_tunnel_xmit,
1645 .ndo_set_mac_address = eth_mac_addr,
1646 .ndo_validate_addr = eth_validate_addr,
1647 .ndo_change_mtu = ipgre_tunnel_change_mtu,
1648 .ndo_get_stats64 = ipgre_get_stats64,
1649 };
1650
1651 static void ipgre_tap_setup(struct net_device *dev)
1652 {
1653
1654 ether_setup(dev);
1655
1656 dev->netdev_ops = &ipgre_tap_netdev_ops;
1657 dev->destructor = ipgre_dev_free;
1658
1659 dev->iflink = 0;
1660 dev->features |= NETIF_F_NETNS_LOCAL;
1661
1662 dev->features |= GRE_FEATURES;
1663 dev->hw_features |= GRE_FEATURES;
1664 }
1665
1666 static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
1667 struct nlattr *data[])
1668 {
1669 struct ip_tunnel *nt;
1670 struct net *net = dev_net(dev);
1671 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1672 int mtu;
1673 int err;
1674
1675 nt = netdev_priv(dev);
1676 ipgre_netlink_parms(data, &nt->parms);
1677
1678 if (ipgre_tunnel_find(net, &nt->parms, dev->type))
1679 return -EEXIST;
1680
1681 if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
1682 eth_hw_addr_random(dev);
1683
1684 mtu = ipgre_tunnel_bind_dev(dev);
1685 if (!tb[IFLA_MTU])
1686 dev->mtu = mtu;
1687
1688 /* Can use a lockless transmit, unless we generate output sequences */
1689 if (!(nt->parms.o_flags & GRE_SEQ))
1690 dev->features |= NETIF_F_LLTX;
1691
1692 err = register_netdevice(dev);
1693 if (err)
1694 goto out;
1695
1696 dev_hold(dev);
1697 ipgre_tunnel_link(ign, nt);
1698
1699 out:
1700 return err;
1701 }
1702
1703 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
1704 struct nlattr *data[])
1705 {
1706 struct ip_tunnel *t, *nt;
1707 struct net *net = dev_net(dev);
1708 struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1709 struct ip_tunnel_parm p;
1710 int mtu;
1711
1712 if (dev == ign->fb_tunnel_dev)
1713 return -EINVAL;
1714
1715 nt = netdev_priv(dev);
1716 ipgre_netlink_parms(data, &p);
1717
1718 t = ipgre_tunnel_locate(net, &p, 0);
1719
1720 if (t) {
1721 if (t->dev != dev)
1722 return -EEXIST;
1723 } else {
1724 t = nt;
1725
1726 if (dev->type != ARPHRD_ETHER) {
1727 unsigned int nflags = 0;
1728
1729 if (ipv4_is_multicast(p.iph.daddr))
1730 nflags = IFF_BROADCAST;
1731 else if (p.iph.daddr)
1732 nflags = IFF_POINTOPOINT;
1733
1734 if ((dev->flags ^ nflags) &
1735 (IFF_POINTOPOINT | IFF_BROADCAST))
1736 return -EINVAL;
1737 }
1738
1739 ipgre_tunnel_unlink(ign, t);
1740 t->parms.iph.saddr = p.iph.saddr;
1741 t->parms.iph.daddr = p.iph.daddr;
1742 t->parms.i_key = p.i_key;
1743 if (dev->type != ARPHRD_ETHER) {
1744 memcpy(dev->dev_addr, &p.iph.saddr, 4);
1745 memcpy(dev->broadcast, &p.iph.daddr, 4);
1746 }
1747 ipgre_tunnel_link(ign, t);
1748 netdev_state_change(dev);
1749 }
1750
1751 t->parms.o_key = p.o_key;
1752 t->parms.iph.ttl = p.iph.ttl;
1753 t->parms.iph.tos = p.iph.tos;
1754 t->parms.iph.frag_off = p.iph.frag_off;
1755
1756 if (t->parms.link != p.link) {
1757 t->parms.link = p.link;
1758 mtu = ipgre_tunnel_bind_dev(dev);
1759 if (!tb[IFLA_MTU])
1760 dev->mtu = mtu;
1761 netdev_state_change(dev);
1762 }
1763
1764 return 0;
1765 }
1766
1767 static size_t ipgre_get_size(const struct net_device *dev)
1768 {
1769 return
1770 /* IFLA_GRE_LINK */
1771 nla_total_size(4) +
1772 /* IFLA_GRE_IFLAGS */
1773 nla_total_size(2) +
1774 /* IFLA_GRE_OFLAGS */
1775 nla_total_size(2) +
1776 /* IFLA_GRE_IKEY */
1777 nla_total_size(4) +
1778 /* IFLA_GRE_OKEY */
1779 nla_total_size(4) +
1780 /* IFLA_GRE_LOCAL */
1781 nla_total_size(4) +
1782 /* IFLA_GRE_REMOTE */
1783 nla_total_size(4) +
1784 /* IFLA_GRE_TTL */
1785 nla_total_size(1) +
1786 /* IFLA_GRE_TOS */
1787 nla_total_size(1) +
1788 /* IFLA_GRE_PMTUDISC */
1789 nla_total_size(1) +
1790 0;
1791 }
1792
1793 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
1794 {
1795 struct ip_tunnel *t = netdev_priv(dev);
1796 struct ip_tunnel_parm *p = &t->parms;
1797
1798 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
1799 nla_put_be16(skb, IFLA_GRE_IFLAGS, p->i_flags) ||
1800 nla_put_be16(skb, IFLA_GRE_OFLAGS, p->o_flags) ||
1801 nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
1802 nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
1803 nla_put_be32(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
1804 nla_put_be32(skb, IFLA_GRE_REMOTE, p->iph.daddr) ||
1805 nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) ||
1806 nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) ||
1807 nla_put_u8(skb, IFLA_GRE_PMTUDISC,
1808 !!(p->iph.frag_off & htons(IP_DF))))
1809 goto nla_put_failure;
1810 return 0;
1811
1812 nla_put_failure:
1813 return -EMSGSIZE;
1814 }
1815
1816 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
1817 [IFLA_GRE_LINK] = { .type = NLA_U32 },
1818 [IFLA_GRE_IFLAGS] = { .type = NLA_U16 },
1819 [IFLA_GRE_OFLAGS] = { .type = NLA_U16 },
1820 [IFLA_GRE_IKEY] = { .type = NLA_U32 },
1821 [IFLA_GRE_OKEY] = { .type = NLA_U32 },
1822 [IFLA_GRE_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) },
1823 [IFLA_GRE_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
1824 [IFLA_GRE_TTL] = { .type = NLA_U8 },
1825 [IFLA_GRE_TOS] = { .type = NLA_U8 },
1826 [IFLA_GRE_PMTUDISC] = { .type = NLA_U8 },
1827 };
1828
1829 static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
1830 .kind = "gre",
1831 .maxtype = IFLA_GRE_MAX,
1832 .policy = ipgre_policy,
1833 .priv_size = sizeof(struct ip_tunnel),
1834 .setup = ipgre_tunnel_setup,
1835 .validate = ipgre_tunnel_validate,
1836 .newlink = ipgre_newlink,
1837 .changelink = ipgre_changelink,
1838 .get_size = ipgre_get_size,
1839 .fill_info = ipgre_fill_info,
1840 };
1841
1842 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = {
1843 .kind = "gretap",
1844 .maxtype = IFLA_GRE_MAX,
1845 .policy = ipgre_policy,
1846 .priv_size = sizeof(struct ip_tunnel),
1847 .setup = ipgre_tap_setup,
1848 .validate = ipgre_tap_validate,
1849 .newlink = ipgre_newlink,
1850 .changelink = ipgre_changelink,
1851 .get_size = ipgre_get_size,
1852 .fill_info = ipgre_fill_info,
1853 };
1854
1855 /*
1856 * And now the modules code and kernel interface.
1857 */
1858
1859 static int __init ipgre_init(void)
1860 {
1861 int err;
1862
1863 pr_info("GRE over IPv4 tunneling driver\n");
1864
1865 err = register_pernet_device(&ipgre_net_ops);
1866 if (err < 0)
1867 return err;
1868
1869 err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
1870 if (err < 0) {
1871 pr_info("%s: can't add protocol\n", __func__);
1872 goto add_proto_failed;
1873 }
1874
1875 err = rtnl_link_register(&ipgre_link_ops);
1876 if (err < 0)
1877 goto rtnl_link_failed;
1878
1879 err = rtnl_link_register(&ipgre_tap_ops);
1880 if (err < 0)
1881 goto tap_ops_failed;
1882
1883 out:
1884 return err;
1885
1886 tap_ops_failed:
1887 rtnl_link_unregister(&ipgre_link_ops);
1888 rtnl_link_failed:
1889 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
1890 add_proto_failed:
1891 unregister_pernet_device(&ipgre_net_ops);
1892 goto out;
1893 }
1894
1895 static void __exit ipgre_fini(void)
1896 {
1897 rtnl_link_unregister(&ipgre_tap_ops);
1898 rtnl_link_unregister(&ipgre_link_ops);
1899 if (gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0)
1900 pr_info("%s: can't remove protocol\n", __func__);
1901 unregister_pernet_device(&ipgre_net_ops);
1902 }
1903
1904 module_init(ipgre_init);
1905 module_exit(ipgre_fini);
1906 MODULE_LICENSE("GPL");
1907 MODULE_ALIAS_RTNL_LINK("gre");
1908 MODULE_ALIAS_RTNL_LINK("gretap");
1909 MODULE_ALIAS_NETDEV("gre0");
Linux kernel - Deliverables
This page took 0.222404 seconds and 5 git commands to generate.