net/ipv4/ipip.c

   1 /*
   2  *      Linux NET3:     IP/IP protocol decoder.
   3  *
   4  *      Authors:
   5  *              Sam Lantinga (slouken@cs.ucdavis.edu)  02/01/95
   6  *
   7  *      Fixes:
   8  *              Alan Cox        :       Merged and made usable non modular (its so tiny its silly as
   9  *                                      a module taking up 2 pages).
  10  *              Alan Cox        :       Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
  11  *                                      to keep ip_forward happy.
  12  *              Alan Cox        :       More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
  13  *              Kai Schulte     :       Fixed #defines for IP_FIREWALL->FIREWALL
  14  *              David Woodhouse :       Perform some basic ICMP handling.
  15  *                                      IPIP Routing without decapsulation.
  16  *              Carlos Picoto   :       GRE over IP support
  17  *              Alexey Kuznetsov:       Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
  18  *                                      I do not want to merge them together.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  *
  25  */
  26
  27 /* tunnel.c: an IP tunnel driver
  28
  29         The purpose of this driver is to provide an IP tunnel through
  30         which you can tunnel network traffic transparently across subnets.
  31
  32         This was written by looking at Nick Holloway's dummy driver
  33         Thanks for the great code!
  34
  35                 -Sam Lantinga   (slouken@cs.ucdavis.edu)  02/01/95
  36
  37         Minor tweaks:
  38                 Cleaned up the code a little and added some pre-1.3.0 tweaks.
  39                 dev->hard_header/hard_header_len changed to use no headers.
  40                 Comments/bracketing tweaked.
  41                 Made the tunnels use dev->name not tunnel: when error reporting.
  42                 Added tx_dropped stat
  43
  44                 -Alan Cox       (alan@lxorguk.ukuu.org.uk) 21 March 95
  45
  46         Reworked:
  47                 Changed to tunnel to destination gateway in addition to the
  48                         tunnel's pointopoint address
  49                 Almost completely rewritten
  50                 Note:  There is currently no firewall or ICMP handling done.
  51
  52                 -Sam Lantinga   (slouken@cs.ucdavis.edu) 02/13/96
  53
  54 */
  55
  56 /* Things I wish I had known when writing the tunnel driver:
  57
  58         When the tunnel_xmit() function is called, the skb contains the
  59         packet to be sent (plus a great deal of extra info), and dev
  60         contains the tunnel device that _we_ are.
  61
  62         When we are passed a packet, we are expected to fill in the
  63         source address with our source IP address.
  64
  65         What is the proper way to allocate, copy and free a buffer?
  66         After you allocate it, it is a "0 length" chunk of memory
  67         starting at zero.  If you want to add headers to the buffer
  68         later, you'll have to call "skb_reserve(skb, amount)" with
  69         the amount of memory you want reserved.  Then, you call
  70         "skb_put(skb, amount)" with the amount of space you want in
  71         the buffer.  skb_put() returns a pointer to the top (#0) of
  72         that buffer.  skb->len is set to the amount of space you have
  73         "allocated" with skb_put().  You can then write up to skb->len
  74         bytes to that buffer.  If you need more, you can call skb_put()
  75         again with the additional amount of space you need.  You can
  76         find out how much more space you can allocate by calling
  77         "skb_tailroom(skb)".
  78         Now, to add header space, call "skb_push(skb, header_len)".
  79         This creates space at the beginning of the buffer and returns
  80         a pointer to this new space.  If later you need to strip a
  81         header from a buffer, call "skb_pull(skb, header_len)".
  82         skb_headroom() will return how much space is left at the top
  83         of the buffer (before the main data).  Remember, this headroom
  84         space must be reserved before the skb_put() function is called.
  85         */
  86
  87 /*
  88    This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c
  89
  90    For comments look at net/ipv4/ip_gre.c --ANK
  91  */
  92
  93
  94 #include <linux/capability.h>
  95 #include <linux/module.h>
  96 #include <linux/types.h>
  97 #include <linux/kernel.h>
  98 #include <linux/slab.h>
  99 #include <asm/uaccess.h>
 100 #include <linux/skbuff.h>
 101 #include <linux/netdevice.h>
 102 #include <linux/in.h>
 103 #include <linux/tcp.h>
 104 #include <linux/udp.h>
 105 #include <linux/if_arp.h>
 106 #include <linux/mroute.h>
 107 #include <linux/init.h>
 108 #include <linux/netfilter_ipv4.h>
 109 #include <linux/if_ether.h>
 110
 111 #include <net/sock.h>
 112 #include <net/ip.h>
 113 #include <net/icmp.h>
 114 #include <net/ip_tunnels.h>
 115 #include <net/inet_ecn.h>
 116 #include <net/xfrm.h>
 117 #include <net/net_namespace.h>
 118 #include <net/netns/generic.h>
 119
 120 static bool log_ecn_error = true;
 121 module_param(log_ecn_error, bool, 0644);
 122 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
 123
 124 static int ipip_net_id __read_mostly;
 125
 126 static int ipip_tunnel_init(struct net_device *dev);
 127 static struct rtnl_link_ops ipip_link_ops __read_mostly;
 128
 129 static int ipip_err(struct sk_buff *skb, u32 info)
 130 {
 131
 132 /* All the routers (except for Linux) return only
 133    8 bytes of packet payload. It means, that precise relaying of
 134    ICMP in the real Internet is absolutely infeasible.
 135  */
 136         struct net *net = dev_net(skb->dev);
 137         struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
 138         const struct iphdr *iph = (const struct iphdr *)skb->data;
 139         struct ip_tunnel *t;
 140         int err;
 141         const int type = icmp_hdr(skb)->type;
 142         const int code = icmp_hdr(skb)->code;
 143
 144         err = -ENOENT;
 145         t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
 146                              iph->daddr, iph->saddr, 0);
 147         if (t == NULL)
 148                 goto out;
 149
 150         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
 151                 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
 152                                  t->dev->ifindex, 0, IPPROTO_IPIP, 0);
 153                 err = 0;
 154                 goto out;
 155         }
 156
 157         if (type == ICMP_REDIRECT) {
 158                 ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
 159                               IPPROTO_IPIP, 0);
 160                 err = 0;
 161                 goto out;
 162         }
 163
 164         if (t->parms.iph.daddr == 0)
 165                 goto out;
 166
 167         err = 0;
 168         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 169                 goto out;
 170
 171         if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
 172                 t->err_count++;
 173         else
 174                 t->err_count = 1;
 175         t->err_time = jiffies;
 176
 177 out:
 178         return err;
 179 }
 180
 181 static const struct tnl_ptk_info tpi = {
 182         /* no tunnel info required for ipip. */
 183         .proto = htons(ETH_P_IP),
 184 };
 185
 186 static int ipip_rcv(struct sk_buff *skb)
 187 {
 188         struct net *net = dev_net(skb->dev);
 189         struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
 190         struct ip_tunnel *tunnel;
 191         const struct iphdr *iph = ip_hdr(skb);
 192
 193         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
 194                         iph->saddr, iph->daddr, 0);
 195         if (tunnel) {
 196                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
 197                         goto drop;
 198                 return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
 199         }
 200
 201         return -1;
 202
 203 drop:
 204         kfree_skb(skb);
 205         return 0;
 206 }
 207
 208 /*
 209  *      This function assumes it is being called from dev_queue_xmit()
 210  *      and that skb is filled properly by that function.
 211  */
 212 static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 213 {
 214         struct ip_tunnel *tunnel = netdev_priv(dev);
 215         const struct iphdr  *tiph = &tunnel->parms.iph;
 216
 217         if (unlikely(skb->protocol != htons(ETH_P_IP)))
 218                 goto tx_error;
 219
 220         if (likely(!skb->encapsulation)) {
 221                 skb_reset_inner_headers(skb);
 222                 skb->encapsulation = 1;
 223         }
 224
 225         ip_tunnel_xmit(skb, dev, tiph);
 226         return NETDEV_TX_OK;
 227
 228 tx_error:
 229         dev->stats.tx_errors++;
 230         dev_kfree_skb(skb);
 231         return NETDEV_TX_OK;
 232 }
 233
 234 static int
 235 ipip_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 236 {
 237         int err = 0;
 238         struct ip_tunnel_parm p;
 239
 240         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
 241                 return -EFAULT;
 242
 243         if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
 244                         p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
 245                 return -EINVAL;
 246         if (p.i_key || p.o_key || p.i_flags || p.o_flags)
 247                 return -EINVAL;
 248         if (p.iph.ttl)
 249                 p.iph.frag_off |= htons(IP_DF);
 250
 251         err = ip_tunnel_ioctl(dev, &p, cmd);
 252         if (err)
 253                 return err;
 254
 255         if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
 256                 return -EFAULT;
 257
 258         return 0;
 259 }
 260
 261 static const struct net_device_ops ipip_netdev_ops = {
 262         .ndo_init       = ipip_tunnel_init,
 263         .ndo_uninit     = ip_tunnel_uninit,
 264         .ndo_start_xmit = ipip_tunnel_xmit,
 265         .ndo_do_ioctl   = ipip_tunnel_ioctl,
 266         .ndo_change_mtu = ip_tunnel_change_mtu,
 267         .ndo_get_stats64 = ip_tunnel_get_stats64,
 268 };
 269
 270 #define IPIP_FEATURES (NETIF_F_SG |             \
 271                        NETIF_F_FRAGLIST |       \
 272                        NETIF_F_HIGHDMA |        \
 273                        NETIF_F_HW_CSUM)
 274
 275 static void ipip_tunnel_setup(struct net_device *dev)
 276 {
 277         dev->netdev_ops         = &ipip_netdev_ops;
 278
 279         dev->type               = ARPHRD_TUNNEL;
 280         dev->flags              = IFF_NOARP;
 281         dev->iflink             = 0;
 282         dev->addr_len           = 4;
 283         dev->features           |= NETIF_F_NETNS_LOCAL;
 284         dev->features           |= NETIF_F_LLTX;
 285         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 286
 287         dev->features           |= IPIP_FEATURES;
 288         dev->hw_features        |= IPIP_FEATURES;
 289         ip_tunnel_setup(dev, ipip_net_id);
 290 }
 291
 292 static int ipip_tunnel_init(struct net_device *dev)
 293 {
 294         struct ip_tunnel *tunnel = netdev_priv(dev);
 295
 296         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
 297         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
 298
 299         tunnel->hlen = 0;
 300         tunnel->parms.iph.protocol = IPPROTO_IPIP;
 301         return ip_tunnel_init(dev);
 302 }
 303
 304 static void ipip_netlink_parms(struct nlattr *data[],
 305                                struct ip_tunnel_parm *parms)
 306 {
 307         memset(parms, 0, sizeof(*parms));
 308
 309         parms->iph.version = 4;
 310         parms->iph.protocol = IPPROTO_IPIP;
 311         parms->iph.ihl = 5;
 312
 313         if (!data)
 314                 return;
 315
 316         if (data[IFLA_IPTUN_LINK])
 317                 parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
 318
 319         if (data[IFLA_IPTUN_LOCAL])
 320                 parms->iph.saddr = nla_get_be32(data[IFLA_IPTUN_LOCAL]);
 321
 322         if (data[IFLA_IPTUN_REMOTE])
 323                 parms->iph.daddr = nla_get_be32(data[IFLA_IPTUN_REMOTE]);
 324
 325         if (data[IFLA_IPTUN_TTL]) {
 326                 parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
 327                 if (parms->iph.ttl)
 328                         parms->iph.frag_off = htons(IP_DF);
 329         }
 330
 331         if (data[IFLA_IPTUN_TOS])
 332                 parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);
 333
 334         if (!data[IFLA_IPTUN_PMTUDISC] || nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
 335                 parms->iph.frag_off = htons(IP_DF);
 336 }
 337
 338 static int ipip_newlink(struct net *src_net, struct net_device *dev,
 339                         struct nlattr *tb[], struct nlattr *data[])
 340 {
 341         struct ip_tunnel_parm p;
 342
 343         ipip_netlink_parms(data, &p);
 344         return ip_tunnel_newlink(dev, tb, &p);
 345 }
 346
 347 static int ipip_changelink(struct net_device *dev, struct nlattr *tb[],
 348                            struct nlattr *data[])
 349 {
 350         struct ip_tunnel_parm p;
 351
 352         ipip_netlink_parms(data, &p);
 353
 354         if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) ||
 355             (!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
 356                 return -EINVAL;
 357
 358         return ip_tunnel_changelink(dev, tb, &p);
 359 }
 360
 361 static size_t ipip_get_size(const struct net_device *dev)
 362 {
 363         return
 364                 /* IFLA_IPTUN_LINK */
 365                 nla_total_size(4) +
 366                 /* IFLA_IPTUN_LOCAL */
 367                 nla_total_size(4) +
 368                 /* IFLA_IPTUN_REMOTE */
 369                 nla_total_size(4) +
 370                 /* IFLA_IPTUN_TTL */
 371                 nla_total_size(1) +
 372                 /* IFLA_IPTUN_TOS */
 373                 nla_total_size(1) +
 374                 /* IFLA_IPTUN_PMTUDISC */
 375                 nla_total_size(1) +
 376                 0;
 377 }
 378
 379 static int ipip_fill_info(struct sk_buff *skb, const struct net_device *dev)
 380 {
 381         struct ip_tunnel *tunnel = netdev_priv(dev);
 382         struct ip_tunnel_parm *parm = &tunnel->parms;
 383
 384         if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
 385             nla_put_be32(skb, IFLA_IPTUN_LOCAL, parm->iph.saddr) ||
 386             nla_put_be32(skb, IFLA_IPTUN_REMOTE, parm->iph.daddr) ||
 387             nla_put_u8(skb, IFLA_IPTUN_TTL, parm->iph.ttl) ||
 388             nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
 389             nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
 390                        !!(parm->iph.frag_off & htons(IP_DF))))
 391                 goto nla_put_failure;
 392         return 0;
 393
 394 nla_put_failure:
 395         return -EMSGSIZE;
 396 }
 397
 398 static const struct nla_policy ipip_policy[IFLA_IPTUN_MAX + 1] = {
 399         [IFLA_IPTUN_LINK]               = { .type = NLA_U32 },
 400         [IFLA_IPTUN_LOCAL]              = { .type = NLA_U32 },
 401         [IFLA_IPTUN_REMOTE]             = { .type = NLA_U32 },
 402         [IFLA_IPTUN_TTL]                = { .type = NLA_U8 },
 403         [IFLA_IPTUN_TOS]                = { .type = NLA_U8 },
 404         [IFLA_IPTUN_PMTUDISC]           = { .type = NLA_U8 },
 405 };
 406
 407 static struct rtnl_link_ops ipip_link_ops __read_mostly = {
 408         .kind           = "ipip",
 409         .maxtype        = IFLA_IPTUN_MAX,
 410         .policy         = ipip_policy,
 411         .priv_size      = sizeof(struct ip_tunnel),
 412         .setup          = ipip_tunnel_setup,
 413         .newlink        = ipip_newlink,
 414         .changelink     = ipip_changelink,
 415         .dellink        = ip_tunnel_dellink,
 416         .get_size       = ipip_get_size,
 417         .fill_info      = ipip_fill_info,
 418 };
 419
 420 static struct xfrm_tunnel ipip_handler __read_mostly = {
 421         .handler        =       ipip_rcv,
 422         .err_handler    =       ipip_err,
 423         .priority       =       1,
 424 };
 425
 426 static int __net_init ipip_init_net(struct net *net)
 427 {
 428         return ip_tunnel_init_net(net, ipip_net_id, &ipip_link_ops, "tunl0");
 429 }
 430
 431 static void __net_exit ipip_exit_net(struct net *net)
 432 {
 433         struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
 434         ip_tunnel_delete_net(itn);
 435 }
 436
 437 static struct pernet_operations ipip_net_ops = {
 438         .init = ipip_init_net,
 439         .exit = ipip_exit_net,
 440         .id   = &ipip_net_id,
 441         .size = sizeof(struct ip_tunnel_net),
 442 };
 443
 444 static int __init ipip_init(void)
 445 {
 446         int err;
 447
 448         pr_info("ipip: IPv4 over IPv4 tunneling driver\n");
 449
 450         err = register_pernet_device(&ipip_net_ops);
 451         if (err < 0)
 452                 return err;
 453         err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
 454         if (err < 0) {
 455                 pr_info("%s: can't register tunnel\n", __func__);
 456                 goto xfrm_tunnel_failed;
 457         }
 458         err = rtnl_link_register(&ipip_link_ops);
 459         if (err < 0)
 460                 goto rtnl_link_failed;
 461
 462 out:
 463         return err;
 464
 465 rtnl_link_failed:
 466         xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
 467 xfrm_tunnel_failed:
 468         unregister_pernet_device(&ipip_net_ops);
 469         goto out;
 470 }
 471
 472 static void __exit ipip_fini(void)
 473 {
 474         rtnl_link_unregister(&ipip_link_ops);
 475         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
 476                 pr_info("%s: can't deregister tunnel\n", __func__);
 477
 478         unregister_pernet_device(&ipip_net_ops);
 479 }
 480
 481 module_init(ipip_init);
 482 module_exit(ipip_fini);
 483 MODULE_LICENSE("GPL");
 484 MODULE_ALIAS_NETDEV("tunl0");