2 * Linux NET3: IP/IP protocol decoder modified to support
3 * virtual tunnel interface
6 * Saurabh Mohan (saurabh.mohan@vyatta.com) 05/07/2012
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version
11 * 2 of the License, or (at your option) any later version.
16 This version of net/ipv4/ip_vti.c is cloned of net/ipv4/ipip.c
18 For comments look at net/ipv4/ip_gre.c --ANK
22 #include <linux/capability.h>
23 #include <linux/module.h>
24 #include <linux/types.h>
25 #include <linux/kernel.h>
26 #include <linux/uaccess.h>
27 #include <linux/skbuff.h>
28 #include <linux/netdevice.h>
30 #include <linux/tcp.h>
31 #include <linux/udp.h>
32 #include <linux/if_arp.h>
33 #include <linux/init.h>
34 #include <linux/netfilter_ipv4.h>
35 #include <linux/if_ether.h>
36 #include <linux/icmpv6.h>
41 #include <net/ip_tunnels.h>
42 #include <net/inet_ecn.h>
44 #include <net/net_namespace.h>
45 #include <net/netns/generic.h>
47 static struct rtnl_link_ops vti_link_ops __read_mostly
;
49 static unsigned int vti_net_id __read_mostly
;
50 static int vti_tunnel_init(struct net_device
*dev
);
52 static int vti_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
55 struct ip_tunnel
*tunnel
;
56 const struct iphdr
*iph
= ip_hdr(skb
);
57 struct net
*net
= dev_net(skb
->dev
);
58 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
60 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
61 iph
->saddr
, iph
->daddr
, 0);
63 if (!xfrm4_policy_check(NULL
, XFRM_POLICY_IN
, skb
))
66 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
= tunnel
;
68 return xfrm_input(skb
, nexthdr
, spi
, encap_type
);
77 static int vti_input_ipip(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
80 struct ip_tunnel
*tunnel
;
81 const struct iphdr
*iph
= ip_hdr(skb
);
82 struct net
*net
= dev_net(skb
->dev
);
83 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
85 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
86 iph
->saddr
, iph
->daddr
, 0);
88 if (!xfrm4_policy_check(NULL
, XFRM_POLICY_IN
, skb
))
91 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
= tunnel
;
93 skb
->dev
= tunnel
->dev
;
95 return xfrm_input(skb
, nexthdr
, spi
, encap_type
);
104 static int vti_rcv(struct sk_buff
*skb
)
106 XFRM_SPI_SKB_CB(skb
)->family
= AF_INET
;
107 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct iphdr
, daddr
);
109 return vti_input(skb
, ip_hdr(skb
)->protocol
, 0, 0);
112 static int vti_rcv_ipip(struct sk_buff
*skb
)
114 XFRM_SPI_SKB_CB(skb
)->family
= AF_INET
;
115 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct iphdr
, daddr
);
117 return vti_input_ipip(skb
, ip_hdr(skb
)->protocol
, ip_hdr(skb
)->saddr
, 0);
120 static int vti_rcv_cb(struct sk_buff
*skb
, int err
)
122 unsigned short family
;
123 struct net_device
*dev
;
124 struct pcpu_sw_netstats
*tstats
;
125 struct xfrm_state
*x
;
126 struct xfrm_mode
*inner_mode
;
127 struct ip_tunnel
*tunnel
= XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
;
128 u32 orig_mark
= skb
->mark
;
137 dev
->stats
.rx_errors
++;
138 dev
->stats
.rx_dropped
++;
143 x
= xfrm_input_state(skb
);
145 inner_mode
= x
->inner_mode
;
147 if (x
->sel
.family
== AF_UNSPEC
) {
148 inner_mode
= xfrm_ip2inner_mode(x
, XFRM_MODE_SKB_CB(skb
)->protocol
);
149 if (inner_mode
== NULL
) {
150 XFRM_INC_STATS(dev_net(skb
->dev
),
151 LINUX_MIB_XFRMINSTATEMODEERROR
);
156 family
= inner_mode
->afinfo
->family
;
158 skb
->mark
= be32_to_cpu(tunnel
->parms
.i_key
);
159 ret
= xfrm_policy_check(NULL
, XFRM_POLICY_IN
, skb
, family
);
160 skb
->mark
= orig_mark
;
165 skb_scrub_packet(skb
, !net_eq(tunnel
->net
, dev_net(skb
->dev
)));
168 tstats
= this_cpu_ptr(dev
->tstats
);
170 u64_stats_update_begin(&tstats
->syncp
);
171 tstats
->rx_packets
++;
172 tstats
->rx_bytes
+= skb
->len
;
173 u64_stats_update_end(&tstats
->syncp
);
178 static bool vti_state_check(const struct xfrm_state
*x
, __be32 dst
, __be32 src
)
180 xfrm_address_t
*daddr
= (xfrm_address_t
*)&dst
;
181 xfrm_address_t
*saddr
= (xfrm_address_t
*)&src
;
183 /* if there is no transform then this tunnel is not functional.
184 * Or if the xfrm is not mode tunnel.
186 if (!x
|| x
->props
.mode
!= XFRM_MODE_TUNNEL
||
187 x
->props
.family
!= AF_INET
)
191 return xfrm_addr_equal(saddr
, &x
->props
.saddr
, AF_INET
);
193 if (!xfrm_state_addr_check(x
, daddr
, saddr
, AF_INET
))
199 static netdev_tx_t
vti_xmit(struct sk_buff
*skb
, struct net_device
*dev
,
202 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
203 struct ip_tunnel_parm
*parms
= &tunnel
->parms
;
204 struct dst_entry
*dst
= skb_dst(skb
);
205 struct net_device
*tdev
; /* Device to other host */
206 int pkt_len
= skb
->len
;
211 dev
->stats
.tx_carrier_errors
++;
216 dst
= xfrm_lookup(tunnel
->net
, dst
, fl
, NULL
, 0);
218 dev
->stats
.tx_carrier_errors
++;
222 if (!vti_state_check(dst
->xfrm
, parms
->iph
.daddr
, parms
->iph
.saddr
)) {
223 dev
->stats
.tx_carrier_errors
++;
232 dev
->stats
.collisions
++;
237 if (skb
->len
> mtu
) {
238 skb_dst_update_pmtu(skb
, mtu
);
239 if (skb
->protocol
== htons(ETH_P_IP
)) {
240 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_FRAG_NEEDED
,
243 if (mtu
< IPV6_MIN_MTU
)
246 icmpv6_send(skb
, ICMPV6_PKT_TOOBIG
, 0, mtu
);
253 skb_scrub_packet(skb
, !net_eq(tunnel
->net
, dev_net(dev
)));
254 skb_dst_set(skb
, dst
);
255 skb
->dev
= skb_dst(skb
)->dev
;
257 err
= dst_output(tunnel
->net
, skb
->sk
, skb
);
258 if (net_xmit_eval(err
) == 0)
260 iptunnel_xmit_stats(dev
, err
);
264 dst_link_failure(skb
);
266 dev
->stats
.tx_errors
++;
271 /* This function assumes it is being called from dev_queue_xmit()
272 * and that skb is filled properly by that function.
274 static netdev_tx_t
vti_tunnel_xmit(struct sk_buff
*skb
, struct net_device
*dev
)
276 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
279 if (!pskb_inet_may_pull(skb
))
282 memset(&fl
, 0, sizeof(fl
));
284 switch (skb
->protocol
) {
285 case htons(ETH_P_IP
):
286 xfrm_decode_session(skb
, &fl
, AF_INET
);
287 memset(IPCB(skb
), 0, sizeof(*IPCB(skb
)));
289 case htons(ETH_P_IPV6
):
290 xfrm_decode_session(skb
, &fl
, AF_INET6
);
291 memset(IP6CB(skb
), 0, sizeof(*IP6CB(skb
)));
297 /* override mark with tunnel output key */
298 fl
.flowi_mark
= be32_to_cpu(tunnel
->parms
.o_key
);
300 return vti_xmit(skb
, dev
, &fl
);
303 dev
->stats
.tx_errors
++;
308 static int vti4_err(struct sk_buff
*skb
, u32 info
)
312 struct xfrm_state
*x
;
313 struct ip_tunnel
*tunnel
;
314 struct ip_esp_hdr
*esph
;
315 struct ip_auth_hdr
*ah
;
316 struct ip_comp_hdr
*ipch
;
317 struct net
*net
= dev_net(skb
->dev
);
318 const struct iphdr
*iph
= (const struct iphdr
*)skb
->data
;
319 int protocol
= iph
->protocol
;
320 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
322 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
323 iph
->daddr
, iph
->saddr
, 0);
327 mark
= be32_to_cpu(tunnel
->parms
.o_key
);
331 esph
= (struct ip_esp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
335 ah
= (struct ip_auth_hdr
*)(skb
->data
+(iph
->ihl
<<2));
339 ipch
= (struct ip_comp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
340 spi
= htonl(ntohs(ipch
->cpi
));
346 switch (icmp_hdr(skb
)->type
) {
347 case ICMP_DEST_UNREACH
:
348 if (icmp_hdr(skb
)->code
!= ICMP_FRAG_NEEDED
)
356 x
= xfrm_state_lookup(net
, mark
, (const xfrm_address_t
*)&iph
->daddr
,
357 spi
, protocol
, AF_INET
);
361 if (icmp_hdr(skb
)->type
== ICMP_DEST_UNREACH
)
362 ipv4_update_pmtu(skb
, net
, info
, 0, 0, protocol
, 0);
364 ipv4_redirect(skb
, net
, 0, 0, protocol
, 0);
371 vti_tunnel_ioctl(struct net_device
*dev
, struct ifreq
*ifr
, int cmd
)
374 struct ip_tunnel_parm p
;
376 if (copy_from_user(&p
, ifr
->ifr_ifru
.ifru_data
, sizeof(p
)))
379 if (cmd
== SIOCADDTUNNEL
|| cmd
== SIOCCHGTUNNEL
) {
380 if (p
.iph
.version
!= 4 || p
.iph
.protocol
!= IPPROTO_IPIP
||
385 if (!(p
.i_flags
& GRE_KEY
))
387 if (!(p
.o_flags
& GRE_KEY
))
390 p
.i_flags
= VTI_ISVTI
;
392 err
= ip_tunnel_ioctl(dev
, &p
, cmd
);
396 if (cmd
!= SIOCDELTUNNEL
) {
397 p
.i_flags
|= GRE_KEY
;
398 p
.o_flags
|= GRE_KEY
;
401 if (copy_to_user(ifr
->ifr_ifru
.ifru_data
, &p
, sizeof(p
)))
406 static const struct net_device_ops vti_netdev_ops
= {
407 .ndo_init
= vti_tunnel_init
,
408 .ndo_uninit
= ip_tunnel_uninit
,
409 .ndo_start_xmit
= vti_tunnel_xmit
,
410 .ndo_do_ioctl
= vti_tunnel_ioctl
,
411 .ndo_change_mtu
= ip_tunnel_change_mtu
,
412 .ndo_get_stats64
= ip_tunnel_get_stats64
,
413 .ndo_get_iflink
= ip_tunnel_get_iflink
,
416 static void vti_tunnel_setup(struct net_device
*dev
)
418 dev
->netdev_ops
= &vti_netdev_ops
;
419 dev
->type
= ARPHRD_TUNNEL
;
420 ip_tunnel_setup(dev
, vti_net_id
);
423 static int vti_tunnel_init(struct net_device
*dev
)
425 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
426 struct iphdr
*iph
= &tunnel
->parms
.iph
;
428 memcpy(dev
->dev_addr
, &iph
->saddr
, 4);
429 memcpy(dev
->broadcast
, &iph
->daddr
, 4);
431 dev
->flags
= IFF_NOARP
;
433 dev
->features
|= NETIF_F_LLTX
;
436 return ip_tunnel_init(dev
);
439 static void __net_init
vti_fb_tunnel_init(struct net_device
*dev
)
441 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
442 struct iphdr
*iph
= &tunnel
->parms
.iph
;
445 iph
->protocol
= IPPROTO_IPIP
;
449 static struct xfrm4_protocol vti_esp4_protocol __read_mostly
= {
451 .input_handler
= vti_input
,
452 .cb_handler
= vti_rcv_cb
,
453 .err_handler
= vti4_err
,
457 static struct xfrm4_protocol vti_ah4_protocol __read_mostly
= {
459 .input_handler
= vti_input
,
460 .cb_handler
= vti_rcv_cb
,
461 .err_handler
= vti4_err
,
465 static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly
= {
467 .input_handler
= vti_input
,
468 .cb_handler
= vti_rcv_cb
,
469 .err_handler
= vti4_err
,
473 static struct xfrm_tunnel ipip_handler __read_mostly
= {
474 .handler
= vti_rcv_ipip
,
475 .err_handler
= vti4_err
,
479 static int __net_init
vti_init_net(struct net
*net
)
482 struct ip_tunnel_net
*itn
;
484 err
= ip_tunnel_init_net(net
, vti_net_id
, &vti_link_ops
, "ip_vti0");
487 itn
= net_generic(net
, vti_net_id
);
488 if (itn
->fb_tunnel_dev
)
489 vti_fb_tunnel_init(itn
->fb_tunnel_dev
);
493 static void __net_exit
vti_exit_batch_net(struct list_head
*list_net
)
495 ip_tunnel_delete_nets(list_net
, vti_net_id
, &vti_link_ops
);
498 static struct pernet_operations vti_net_ops
= {
499 .init
= vti_init_net
,
500 .exit_batch
= vti_exit_batch_net
,
502 .size
= sizeof(struct ip_tunnel_net
),
505 static int vti_tunnel_validate(struct nlattr
*tb
[], struct nlattr
*data
[],
506 struct netlink_ext_ack
*extack
)
511 static void vti_netlink_parms(struct nlattr
*data
[],
512 struct ip_tunnel_parm
*parms
,
515 memset(parms
, 0, sizeof(*parms
));
517 parms
->iph
.protocol
= IPPROTO_IPIP
;
522 parms
->i_flags
= VTI_ISVTI
;
524 if (data
[IFLA_VTI_LINK
])
525 parms
->link
= nla_get_u32(data
[IFLA_VTI_LINK
]);
527 if (data
[IFLA_VTI_IKEY
])
528 parms
->i_key
= nla_get_be32(data
[IFLA_VTI_IKEY
]);
530 if (data
[IFLA_VTI_OKEY
])
531 parms
->o_key
= nla_get_be32(data
[IFLA_VTI_OKEY
]);
533 if (data
[IFLA_VTI_LOCAL
])
534 parms
->iph
.saddr
= nla_get_in_addr(data
[IFLA_VTI_LOCAL
]);
536 if (data
[IFLA_VTI_REMOTE
])
537 parms
->iph
.daddr
= nla_get_in_addr(data
[IFLA_VTI_REMOTE
]);
539 if (data
[IFLA_VTI_FWMARK
])
540 *fwmark
= nla_get_u32(data
[IFLA_VTI_FWMARK
]);
543 static int vti_newlink(struct net
*src_net
, struct net_device
*dev
,
544 struct nlattr
*tb
[], struct nlattr
*data
[],
545 struct netlink_ext_ack
*extack
)
547 struct ip_tunnel_parm parms
;
550 vti_netlink_parms(data
, &parms
, &fwmark
);
551 return ip_tunnel_newlink(dev
, tb
, &parms
, fwmark
);
554 static int vti_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
555 struct nlattr
*data
[],
556 struct netlink_ext_ack
*extack
)
558 struct ip_tunnel
*t
= netdev_priv(dev
);
559 __u32 fwmark
= t
->fwmark
;
560 struct ip_tunnel_parm p
;
562 vti_netlink_parms(data
, &p
, &fwmark
);
563 return ip_tunnel_changelink(dev
, tb
, &p
, fwmark
);
566 static size_t vti_get_size(const struct net_device
*dev
)
577 /* IFLA_VTI_REMOTE */
579 /* IFLA_VTI_FWMARK */
584 static int vti_fill_info(struct sk_buff
*skb
, const struct net_device
*dev
)
586 struct ip_tunnel
*t
= netdev_priv(dev
);
587 struct ip_tunnel_parm
*p
= &t
->parms
;
589 if (nla_put_u32(skb
, IFLA_VTI_LINK
, p
->link
) ||
590 nla_put_be32(skb
, IFLA_VTI_IKEY
, p
->i_key
) ||
591 nla_put_be32(skb
, IFLA_VTI_OKEY
, p
->o_key
) ||
592 nla_put_in_addr(skb
, IFLA_VTI_LOCAL
, p
->iph
.saddr
) ||
593 nla_put_in_addr(skb
, IFLA_VTI_REMOTE
, p
->iph
.daddr
) ||
594 nla_put_u32(skb
, IFLA_VTI_FWMARK
, t
->fwmark
))
600 static const struct nla_policy vti_policy
[IFLA_VTI_MAX
+ 1] = {
601 [IFLA_VTI_LINK
] = { .type
= NLA_U32
},
602 [IFLA_VTI_IKEY
] = { .type
= NLA_U32
},
603 [IFLA_VTI_OKEY
] = { .type
= NLA_U32
},
604 [IFLA_VTI_LOCAL
] = { .len
= FIELD_SIZEOF(struct iphdr
, saddr
) },
605 [IFLA_VTI_REMOTE
] = { .len
= FIELD_SIZEOF(struct iphdr
, daddr
) },
606 [IFLA_VTI_FWMARK
] = { .type
= NLA_U32
},
609 static struct rtnl_link_ops vti_link_ops __read_mostly
= {
611 .maxtype
= IFLA_VTI_MAX
,
612 .policy
= vti_policy
,
613 .priv_size
= sizeof(struct ip_tunnel
),
614 .setup
= vti_tunnel_setup
,
615 .validate
= vti_tunnel_validate
,
616 .newlink
= vti_newlink
,
617 .changelink
= vti_changelink
,
618 .dellink
= ip_tunnel_dellink
,
619 .get_size
= vti_get_size
,
620 .fill_info
= vti_fill_info
,
621 .get_link_net
= ip_tunnel_get_link_net
,
624 static int __init
vti_init(void)
629 pr_info("IPv4 over IPsec tunneling driver\n");
631 msg
= "tunnel device";
632 err
= register_pernet_device(&vti_net_ops
);
634 goto pernet_dev_failed
;
636 msg
= "tunnel protocols";
637 err
= xfrm4_protocol_register(&vti_esp4_protocol
, IPPROTO_ESP
);
639 goto xfrm_proto_esp_failed
;
640 err
= xfrm4_protocol_register(&vti_ah4_protocol
, IPPROTO_AH
);
642 goto xfrm_proto_ah_failed
;
643 err
= xfrm4_protocol_register(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
645 goto xfrm_proto_comp_failed
;
648 err
= xfrm4_tunnel_register(&ipip_handler
, AF_INET
);
650 pr_info("%s: cant't register tunnel\n",__func__
);
651 goto xfrm_tunnel_failed
;
654 msg
= "netlink interface";
655 err
= rtnl_link_register(&vti_link_ops
);
657 goto rtnl_link_failed
;
662 xfrm4_tunnel_deregister(&ipip_handler
, AF_INET
);
664 xfrm4_protocol_deregister(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
665 xfrm_proto_comp_failed
:
666 xfrm4_protocol_deregister(&vti_ah4_protocol
, IPPROTO_AH
);
667 xfrm_proto_ah_failed
:
668 xfrm4_protocol_deregister(&vti_esp4_protocol
, IPPROTO_ESP
);
669 xfrm_proto_esp_failed
:
670 unregister_pernet_device(&vti_net_ops
);
672 pr_err("vti init: failed to register %s\n", msg
);
676 static void __exit
vti_fini(void)
678 rtnl_link_unregister(&vti_link_ops
);
679 xfrm4_tunnel_deregister(&ipip_handler
, AF_INET
);
680 xfrm4_protocol_deregister(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
681 xfrm4_protocol_deregister(&vti_ah4_protocol
, IPPROTO_AH
);
682 xfrm4_protocol_deregister(&vti_esp4_protocol
, IPPROTO_ESP
);
683 unregister_pernet_device(&vti_net_ops
);
686 module_init(vti_init
);
687 module_exit(vti_fini
);
688 MODULE_LICENSE("GPL");
689 MODULE_ALIAS_RTNL_LINK("vti");
690 MODULE_ALIAS_NETDEV("ip_vti0");