Linux 4.4.199
[linux/fpc-iii.git] / net / ipv4 / ip_vti.c
blobbbcbbc1cc2cc643894a6f9f3916ac7dddb147321
1 /*
2 * Linux NET3: IP/IP protocol decoder modified to support
3 * virtual tunnel interface
5 * Authors:
6 * Saurabh Mohan (saurabh.mohan@vyatta.com) 05/07/2012
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version
11 * 2 of the License, or (at your option) any later version.
16 This version of net/ipv4/ip_vti.c is cloned of net/ipv4/ipip.c
18 For comments look at net/ipv4/ip_gre.c --ANK
22 #include <linux/capability.h>
23 #include <linux/module.h>
24 #include <linux/types.h>
25 #include <linux/kernel.h>
26 #include <linux/uaccess.h>
27 #include <linux/skbuff.h>
28 #include <linux/netdevice.h>
29 #include <linux/in.h>
30 #include <linux/tcp.h>
31 #include <linux/udp.h>
32 #include <linux/if_arp.h>
33 #include <linux/mroute.h>
34 #include <linux/init.h>
35 #include <linux/netfilter_ipv4.h>
36 #include <linux/if_ether.h>
37 #include <linux/icmpv6.h>
39 #include <net/sock.h>
40 #include <net/ip.h>
41 #include <net/icmp.h>
42 #include <net/ip_tunnels.h>
43 #include <net/inet_ecn.h>
44 #include <net/xfrm.h>
45 #include <net/net_namespace.h>
46 #include <net/netns/generic.h>
48 static struct rtnl_link_ops vti_link_ops __read_mostly;
50 static int vti_net_id __read_mostly;
51 static int vti_tunnel_init(struct net_device *dev);
53 static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
54 int encap_type)
56 struct ip_tunnel *tunnel;
57 const struct iphdr *iph = ip_hdr(skb);
58 struct net *net = dev_net(skb->dev);
59 struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
61 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
62 iph->saddr, iph->daddr, 0);
63 if (tunnel) {
64 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
65 goto drop;
67 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
69 return xfrm_input(skb, nexthdr, spi, encap_type);
72 return -EINVAL;
73 drop:
74 kfree_skb(skb);
75 return 0;
78 static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
79 int encap_type)
81 struct ip_tunnel *tunnel;
82 const struct iphdr *iph = ip_hdr(skb);
83 struct net *net = dev_net(skb->dev);
84 struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
86 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
87 iph->saddr, iph->daddr, 0);
88 if (tunnel) {
89 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
90 goto drop;
92 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
94 skb->dev = tunnel->dev;
96 return xfrm_input(skb, nexthdr, spi, encap_type);
99 return -EINVAL;
100 drop:
101 kfree_skb(skb);
102 return 0;
105 static int vti_rcv(struct sk_buff *skb)
107 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
108 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
110 return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
113 static int vti_rcv_ipip(struct sk_buff *skb)
115 XFRM_SPI_SKB_CB(skb)->family = AF_INET;
116 XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
118 return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
121 static int vti_rcv_cb(struct sk_buff *skb, int err)
123 unsigned short family;
124 struct net_device *dev;
125 struct pcpu_sw_netstats *tstats;
126 struct xfrm_state *x;
127 struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
128 u32 orig_mark = skb->mark;
129 int ret;
131 if (!tunnel)
132 return 1;
134 dev = tunnel->dev;
136 if (err) {
137 dev->stats.rx_errors++;
138 dev->stats.rx_dropped++;
140 return 0;
143 x = xfrm_input_state(skb);
144 family = x->inner_mode->afinfo->family;
146 skb->mark = be32_to_cpu(tunnel->parms.i_key);
147 ret = xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family);
148 skb->mark = orig_mark;
150 if (!ret)
151 return -EPERM;
153 skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
154 skb->dev = dev;
156 tstats = this_cpu_ptr(dev->tstats);
158 u64_stats_update_begin(&tstats->syncp);
159 tstats->rx_packets++;
160 tstats->rx_bytes += skb->len;
161 u64_stats_update_end(&tstats->syncp);
163 return 0;
166 static bool vti_state_check(const struct xfrm_state *x, __be32 dst, __be32 src)
168 xfrm_address_t *daddr = (xfrm_address_t *)&dst;
169 xfrm_address_t *saddr = (xfrm_address_t *)&src;
171 /* if there is no transform then this tunnel is not functional.
172 * Or if the xfrm is not mode tunnel.
174 if (!x || x->props.mode != XFRM_MODE_TUNNEL ||
175 x->props.family != AF_INET)
176 return false;
178 if (!dst)
179 return xfrm_addr_equal(saddr, &x->props.saddr, AF_INET);
181 if (!xfrm_state_addr_check(x, daddr, saddr, AF_INET))
182 return false;
184 return true;
187 static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
188 struct flowi *fl)
190 struct ip_tunnel *tunnel = netdev_priv(dev);
191 struct ip_tunnel_parm *parms = &tunnel->parms;
192 struct dst_entry *dst = skb_dst(skb);
193 struct net_device *tdev; /* Device to other host */
194 int pkt_len = skb->len;
195 int err;
197 if (!dst) {
198 dev->stats.tx_carrier_errors++;
199 goto tx_error_icmp;
202 dst_hold(dst);
203 dst = xfrm_lookup(tunnel->net, dst, fl, NULL, 0);
204 if (IS_ERR(dst)) {
205 dev->stats.tx_carrier_errors++;
206 goto tx_error_icmp;
209 if (!vti_state_check(dst->xfrm, parms->iph.daddr, parms->iph.saddr)) {
210 dev->stats.tx_carrier_errors++;
211 dst_release(dst);
212 goto tx_error_icmp;
215 tdev = dst->dev;
217 if (tdev == dev) {
218 dst_release(dst);
219 dev->stats.collisions++;
220 goto tx_error;
223 if (tunnel->err_count > 0) {
224 if (time_before(jiffies,
225 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
226 tunnel->err_count--;
227 dst_link_failure(skb);
228 } else
229 tunnel->err_count = 0;
232 skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
233 skb_dst_set(skb, dst);
234 skb->dev = skb_dst(skb)->dev;
236 err = dst_output(tunnel->net, skb->sk, skb);
237 if (net_xmit_eval(err) == 0)
238 err = pkt_len;
239 iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
240 return NETDEV_TX_OK;
242 tx_error_icmp:
243 dst_link_failure(skb);
244 tx_error:
245 dev->stats.tx_errors++;
246 kfree_skb(skb);
247 return NETDEV_TX_OK;
250 /* This function assumes it is being called from dev_queue_xmit()
251 * and that skb is filled properly by that function.
253 static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
255 struct ip_tunnel *tunnel = netdev_priv(dev);
256 struct flowi fl;
258 memset(&fl, 0, sizeof(fl));
260 switch (skb->protocol) {
261 case htons(ETH_P_IP):
262 xfrm_decode_session(skb, &fl, AF_INET);
263 memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
264 break;
265 case htons(ETH_P_IPV6):
266 xfrm_decode_session(skb, &fl, AF_INET6);
267 memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
268 break;
269 default:
270 dev->stats.tx_errors++;
271 dev_kfree_skb(skb);
272 return NETDEV_TX_OK;
275 /* override mark with tunnel output key */
276 fl.flowi_mark = be32_to_cpu(tunnel->parms.o_key);
278 return vti_xmit(skb, dev, &fl);
281 static int vti4_err(struct sk_buff *skb, u32 info)
283 __be32 spi;
284 __u32 mark;
285 struct xfrm_state *x;
286 struct ip_tunnel *tunnel;
287 struct ip_esp_hdr *esph;
288 struct ip_auth_hdr *ah ;
289 struct ip_comp_hdr *ipch;
290 struct net *net = dev_net(skb->dev);
291 const struct iphdr *iph = (const struct iphdr *)skb->data;
292 int protocol = iph->protocol;
293 struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
295 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
296 iph->daddr, iph->saddr, 0);
297 if (!tunnel)
298 return -1;
300 mark = be32_to_cpu(tunnel->parms.o_key);
302 switch (protocol) {
303 case IPPROTO_ESP:
304 esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
305 spi = esph->spi;
306 break;
307 case IPPROTO_AH:
308 ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
309 spi = ah->spi;
310 break;
311 case IPPROTO_COMP:
312 ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
313 spi = htonl(ntohs(ipch->cpi));
314 break;
315 default:
316 return 0;
319 switch (icmp_hdr(skb)->type) {
320 case ICMP_DEST_UNREACH:
321 if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
322 return 0;
323 case ICMP_REDIRECT:
324 break;
325 default:
326 return 0;
329 x = xfrm_state_lookup(net, mark, (const xfrm_address_t *)&iph->daddr,
330 spi, protocol, AF_INET);
331 if (!x)
332 return 0;
334 if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
335 ipv4_update_pmtu(skb, net, info, 0, 0, protocol, 0);
336 else
337 ipv4_redirect(skb, net, 0, 0, protocol, 0);
338 xfrm_state_put(x);
340 return 0;
343 static int
344 vti_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
346 int err = 0;
347 struct ip_tunnel_parm p;
349 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
350 return -EFAULT;
352 if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
353 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
354 p.iph.ihl != 5)
355 return -EINVAL;
358 if (!(p.i_flags & GRE_KEY))
359 p.i_key = 0;
360 if (!(p.o_flags & GRE_KEY))
361 p.o_key = 0;
363 p.i_flags = VTI_ISVTI;
365 err = ip_tunnel_ioctl(dev, &p, cmd);
366 if (err)
367 return err;
369 if (cmd != SIOCDELTUNNEL) {
370 p.i_flags |= GRE_KEY;
371 p.o_flags |= GRE_KEY;
374 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
375 return -EFAULT;
376 return 0;
379 static const struct net_device_ops vti_netdev_ops = {
380 .ndo_init = vti_tunnel_init,
381 .ndo_uninit = ip_tunnel_uninit,
382 .ndo_start_xmit = vti_tunnel_xmit,
383 .ndo_do_ioctl = vti_tunnel_ioctl,
384 .ndo_change_mtu = ip_tunnel_change_mtu,
385 .ndo_get_stats64 = ip_tunnel_get_stats64,
386 .ndo_get_iflink = ip_tunnel_get_iflink,
389 static void vti_tunnel_setup(struct net_device *dev)
391 dev->netdev_ops = &vti_netdev_ops;
392 dev->type = ARPHRD_TUNNEL;
393 ip_tunnel_setup(dev, vti_net_id);
396 static int vti_tunnel_init(struct net_device *dev)
398 struct ip_tunnel *tunnel = netdev_priv(dev);
399 struct iphdr *iph = &tunnel->parms.iph;
401 memcpy(dev->dev_addr, &iph->saddr, 4);
402 memcpy(dev->broadcast, &iph->daddr, 4);
404 dev->mtu = ETH_DATA_LEN;
405 dev->flags = IFF_NOARP;
406 dev->addr_len = 4;
407 dev->features |= NETIF_F_LLTX;
408 netif_keep_dst(dev);
410 return ip_tunnel_init(dev);
413 static void __net_init vti_fb_tunnel_init(struct net_device *dev)
415 struct ip_tunnel *tunnel = netdev_priv(dev);
416 struct iphdr *iph = &tunnel->parms.iph;
418 iph->version = 4;
419 iph->protocol = IPPROTO_IPIP;
420 iph->ihl = 5;
423 static struct xfrm4_protocol vti_esp4_protocol __read_mostly = {
424 .handler = vti_rcv,
425 .input_handler = vti_input,
426 .cb_handler = vti_rcv_cb,
427 .err_handler = vti4_err,
428 .priority = 100,
431 static struct xfrm4_protocol vti_ah4_protocol __read_mostly = {
432 .handler = vti_rcv,
433 .input_handler = vti_input,
434 .cb_handler = vti_rcv_cb,
435 .err_handler = vti4_err,
436 .priority = 100,
439 static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
440 .handler = vti_rcv,
441 .input_handler = vti_input,
442 .cb_handler = vti_rcv_cb,
443 .err_handler = vti4_err,
444 .priority = 100,
447 static struct xfrm_tunnel ipip_handler __read_mostly = {
448 .handler = vti_rcv_ipip,
449 .err_handler = vti4_err,
450 .priority = 0,
453 static int __net_init vti_init_net(struct net *net)
455 int err;
456 struct ip_tunnel_net *itn;
458 err = ip_tunnel_init_net(net, vti_net_id, &vti_link_ops, "ip_vti0");
459 if (err)
460 return err;
461 itn = net_generic(net, vti_net_id);
462 vti_fb_tunnel_init(itn->fb_tunnel_dev);
463 return 0;
466 static void __net_exit vti_exit_net(struct net *net)
468 struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
469 ip_tunnel_delete_net(itn, &vti_link_ops);
472 static struct pernet_operations vti_net_ops = {
473 .init = vti_init_net,
474 .exit = vti_exit_net,
475 .id = &vti_net_id,
476 .size = sizeof(struct ip_tunnel_net),
479 static int vti_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
481 return 0;
484 static void vti_netlink_parms(struct nlattr *data[],
485 struct ip_tunnel_parm *parms)
487 memset(parms, 0, sizeof(*parms));
489 parms->iph.protocol = IPPROTO_IPIP;
491 if (!data)
492 return;
494 parms->i_flags = VTI_ISVTI;
496 if (data[IFLA_VTI_LINK])
497 parms->link = nla_get_u32(data[IFLA_VTI_LINK]);
499 if (data[IFLA_VTI_IKEY])
500 parms->i_key = nla_get_be32(data[IFLA_VTI_IKEY]);
502 if (data[IFLA_VTI_OKEY])
503 parms->o_key = nla_get_be32(data[IFLA_VTI_OKEY]);
505 if (data[IFLA_VTI_LOCAL])
506 parms->iph.saddr = nla_get_in_addr(data[IFLA_VTI_LOCAL]);
508 if (data[IFLA_VTI_REMOTE])
509 parms->iph.daddr = nla_get_in_addr(data[IFLA_VTI_REMOTE]);
513 static int vti_newlink(struct net *src_net, struct net_device *dev,
514 struct nlattr *tb[], struct nlattr *data[])
516 struct ip_tunnel_parm parms;
518 vti_netlink_parms(data, &parms);
519 return ip_tunnel_newlink(dev, tb, &parms);
522 static int vti_changelink(struct net_device *dev, struct nlattr *tb[],
523 struct nlattr *data[])
525 struct ip_tunnel_parm p;
527 vti_netlink_parms(data, &p);
528 return ip_tunnel_changelink(dev, tb, &p);
531 static size_t vti_get_size(const struct net_device *dev)
533 return
534 /* IFLA_VTI_LINK */
535 nla_total_size(4) +
536 /* IFLA_VTI_IKEY */
537 nla_total_size(4) +
538 /* IFLA_VTI_OKEY */
539 nla_total_size(4) +
540 /* IFLA_VTI_LOCAL */
541 nla_total_size(4) +
542 /* IFLA_VTI_REMOTE */
543 nla_total_size(4) +
547 static int vti_fill_info(struct sk_buff *skb, const struct net_device *dev)
549 struct ip_tunnel *t = netdev_priv(dev);
550 struct ip_tunnel_parm *p = &t->parms;
552 nla_put_u32(skb, IFLA_VTI_LINK, p->link);
553 nla_put_be32(skb, IFLA_VTI_IKEY, p->i_key);
554 nla_put_be32(skb, IFLA_VTI_OKEY, p->o_key);
555 nla_put_in_addr(skb, IFLA_VTI_LOCAL, p->iph.saddr);
556 nla_put_in_addr(skb, IFLA_VTI_REMOTE, p->iph.daddr);
558 return 0;
561 static const struct nla_policy vti_policy[IFLA_VTI_MAX + 1] = {
562 [IFLA_VTI_LINK] = { .type = NLA_U32 },
563 [IFLA_VTI_IKEY] = { .type = NLA_U32 },
564 [IFLA_VTI_OKEY] = { .type = NLA_U32 },
565 [IFLA_VTI_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) },
566 [IFLA_VTI_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
569 static struct rtnl_link_ops vti_link_ops __read_mostly = {
570 .kind = "vti",
571 .maxtype = IFLA_VTI_MAX,
572 .policy = vti_policy,
573 .priv_size = sizeof(struct ip_tunnel),
574 .setup = vti_tunnel_setup,
575 .validate = vti_tunnel_validate,
576 .newlink = vti_newlink,
577 .changelink = vti_changelink,
578 .dellink = ip_tunnel_dellink,
579 .get_size = vti_get_size,
580 .fill_info = vti_fill_info,
581 .get_link_net = ip_tunnel_get_link_net,
584 static bool is_vti_tunnel(const struct net_device *dev)
586 return dev->netdev_ops == &vti_netdev_ops;
589 static int vti_device_event(struct notifier_block *unused,
590 unsigned long event, void *ptr)
592 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
593 struct ip_tunnel *tunnel = netdev_priv(dev);
595 if (!is_vti_tunnel(dev))
596 return NOTIFY_DONE;
598 switch (event) {
599 case NETDEV_DOWN:
600 if (!net_eq(tunnel->net, dev_net(dev)))
601 xfrm_garbage_collect(tunnel->net);
602 break;
604 return NOTIFY_DONE;
607 static struct notifier_block vti_notifier_block __read_mostly = {
608 .notifier_call = vti_device_event,
611 static int __init vti_init(void)
613 const char *msg;
614 int err;
616 pr_info("IPv4 over IPsec tunneling driver\n");
618 register_netdevice_notifier(&vti_notifier_block);
620 msg = "tunnel device";
621 err = register_pernet_device(&vti_net_ops);
622 if (err < 0)
623 goto pernet_dev_failed;
625 msg = "tunnel protocols";
626 err = xfrm4_protocol_register(&vti_esp4_protocol, IPPROTO_ESP);
627 if (err < 0)
628 goto xfrm_proto_esp_failed;
629 err = xfrm4_protocol_register(&vti_ah4_protocol, IPPROTO_AH);
630 if (err < 0)
631 goto xfrm_proto_ah_failed;
632 err = xfrm4_protocol_register(&vti_ipcomp4_protocol, IPPROTO_COMP);
633 if (err < 0)
634 goto xfrm_proto_comp_failed;
636 msg = "ipip tunnel";
637 err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
638 if (err < 0) {
639 pr_info("%s: cant't register tunnel\n",__func__);
640 goto xfrm_tunnel_failed;
643 msg = "netlink interface";
644 err = rtnl_link_register(&vti_link_ops);
645 if (err < 0)
646 goto rtnl_link_failed;
648 return err;
650 rtnl_link_failed:
651 xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
652 xfrm_tunnel_failed:
653 xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
654 xfrm_proto_comp_failed:
655 xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
656 xfrm_proto_ah_failed:
657 xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
658 xfrm_proto_esp_failed:
659 unregister_pernet_device(&vti_net_ops);
660 pernet_dev_failed:
661 unregister_netdevice_notifier(&vti_notifier_block);
662 pr_err("vti init: failed to register %s\n", msg);
663 return err;
666 static void __exit vti_fini(void)
668 rtnl_link_unregister(&vti_link_ops);
669 xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
670 xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
671 xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
672 xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
673 unregister_pernet_device(&vti_net_ops);
674 unregister_netdevice_notifier(&vti_notifier_block);
677 module_init(vti_init);
678 module_exit(vti_fini);
679 MODULE_LICENSE("GPL");
680 MODULE_ALIAS_RTNL_LINK("vti");
681 MODULE_ALIAS_NETDEV("ip_vti0");