2 * Linux NET3: IP/IP protocol decoder modified to support
3 * virtual tunnel interface
6 * Saurabh Mohan (saurabh.mohan@vyatta.com) 05/07/2012
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version
11 * 2 of the License, or (at your option) any later version.
16 This version of net/ipv4/ip_vti.c is cloned of net/ipv4/ipip.c
18 For comments look at net/ipv4/ip_gre.c --ANK
22 #include <linux/capability.h>
23 #include <linux/module.h>
24 #include <linux/types.h>
25 #include <linux/kernel.h>
26 #include <linux/uaccess.h>
27 #include <linux/skbuff.h>
28 #include <linux/netdevice.h>
30 #include <linux/tcp.h>
31 #include <linux/udp.h>
32 #include <linux/if_arp.h>
33 #include <linux/mroute.h>
34 #include <linux/init.h>
35 #include <linux/netfilter_ipv4.h>
36 #include <linux/if_ether.h>
37 #include <linux/icmpv6.h>
42 #include <net/ip_tunnels.h>
43 #include <net/inet_ecn.h>
45 #include <net/net_namespace.h>
46 #include <net/netns/generic.h>
48 static struct rtnl_link_ops vti_link_ops __read_mostly
;
50 static int vti_net_id __read_mostly
;
51 static int vti_tunnel_init(struct net_device
*dev
);
53 static int vti_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
56 struct ip_tunnel
*tunnel
;
57 const struct iphdr
*iph
= ip_hdr(skb
);
58 struct net
*net
= dev_net(skb
->dev
);
59 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
61 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
62 iph
->saddr
, iph
->daddr
, 0);
64 if (!xfrm4_policy_check(NULL
, XFRM_POLICY_IN
, skb
))
67 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
= tunnel
;
69 return xfrm_input(skb
, nexthdr
, spi
, encap_type
);
78 static int vti_input_ipip(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
81 struct ip_tunnel
*tunnel
;
82 const struct iphdr
*iph
= ip_hdr(skb
);
83 struct net
*net
= dev_net(skb
->dev
);
84 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
86 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
87 iph
->saddr
, iph
->daddr
, 0);
89 if (!xfrm4_policy_check(NULL
, XFRM_POLICY_IN
, skb
))
92 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
= tunnel
;
94 skb
->dev
= tunnel
->dev
;
96 return xfrm_input(skb
, nexthdr
, spi
, encap_type
);
105 static int vti_rcv(struct sk_buff
*skb
)
107 XFRM_SPI_SKB_CB(skb
)->family
= AF_INET
;
108 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct iphdr
, daddr
);
110 return vti_input(skb
, ip_hdr(skb
)->protocol
, 0, 0);
113 static int vti_rcv_ipip(struct sk_buff
*skb
)
115 XFRM_SPI_SKB_CB(skb
)->family
= AF_INET
;
116 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct iphdr
, daddr
);
118 return vti_input_ipip(skb
, ip_hdr(skb
)->protocol
, ip_hdr(skb
)->saddr
, 0);
121 static int vti_rcv_cb(struct sk_buff
*skb
, int err
)
123 unsigned short family
;
124 struct net_device
*dev
;
125 struct pcpu_sw_netstats
*tstats
;
126 struct xfrm_state
*x
;
127 struct ip_tunnel
*tunnel
= XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
;
128 u32 orig_mark
= skb
->mark
;
137 dev
->stats
.rx_errors
++;
138 dev
->stats
.rx_dropped
++;
143 x
= xfrm_input_state(skb
);
144 family
= x
->inner_mode
->afinfo
->family
;
146 skb
->mark
= be32_to_cpu(tunnel
->parms
.i_key
);
147 ret
= xfrm_policy_check(NULL
, XFRM_POLICY_IN
, skb
, family
);
148 skb
->mark
= orig_mark
;
153 skb_scrub_packet(skb
, !net_eq(tunnel
->net
, dev_net(skb
->dev
)));
156 tstats
= this_cpu_ptr(dev
->tstats
);
158 u64_stats_update_begin(&tstats
->syncp
);
159 tstats
->rx_packets
++;
160 tstats
->rx_bytes
+= skb
->len
;
161 u64_stats_update_end(&tstats
->syncp
);
166 static bool vti_state_check(const struct xfrm_state
*x
, __be32 dst
, __be32 src
)
168 xfrm_address_t
*daddr
= (xfrm_address_t
*)&dst
;
169 xfrm_address_t
*saddr
= (xfrm_address_t
*)&src
;
171 /* if there is no transform then this tunnel is not functional.
172 * Or if the xfrm is not mode tunnel.
174 if (!x
|| x
->props
.mode
!= XFRM_MODE_TUNNEL
||
175 x
->props
.family
!= AF_INET
)
179 return xfrm_addr_equal(saddr
, &x
->props
.saddr
, AF_INET
);
181 if (!xfrm_state_addr_check(x
, daddr
, saddr
, AF_INET
))
187 static netdev_tx_t
vti_xmit(struct sk_buff
*skb
, struct net_device
*dev
,
190 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
191 struct ip_tunnel_parm
*parms
= &tunnel
->parms
;
192 struct dst_entry
*dst
= skb_dst(skb
);
193 struct net_device
*tdev
; /* Device to other host */
194 int pkt_len
= skb
->len
;
198 dev
->stats
.tx_carrier_errors
++;
203 dst
= xfrm_lookup(tunnel
->net
, dst
, fl
, NULL
, 0);
205 dev
->stats
.tx_carrier_errors
++;
209 if (!vti_state_check(dst
->xfrm
, parms
->iph
.daddr
, parms
->iph
.saddr
)) {
210 dev
->stats
.tx_carrier_errors
++;
219 dev
->stats
.collisions
++;
223 if (tunnel
->err_count
> 0) {
224 if (time_before(jiffies
,
225 tunnel
->err_time
+ IPTUNNEL_ERR_TIMEO
)) {
227 dst_link_failure(skb
);
229 tunnel
->err_count
= 0;
232 skb_scrub_packet(skb
, !net_eq(tunnel
->net
, dev_net(dev
)));
233 skb_dst_set(skb
, dst
);
234 skb
->dev
= skb_dst(skb
)->dev
;
236 err
= dst_output(tunnel
->net
, skb
->sk
, skb
);
237 if (net_xmit_eval(err
) == 0)
239 iptunnel_xmit_stats(err
, &dev
->stats
, dev
->tstats
);
243 dst_link_failure(skb
);
245 dev
->stats
.tx_errors
++;
250 /* This function assumes it is being called from dev_queue_xmit()
251 * and that skb is filled properly by that function.
253 static netdev_tx_t
vti_tunnel_xmit(struct sk_buff
*skb
, struct net_device
*dev
)
255 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
258 memset(&fl
, 0, sizeof(fl
));
260 switch (skb
->protocol
) {
261 case htons(ETH_P_IP
):
262 xfrm_decode_session(skb
, &fl
, AF_INET
);
263 memset(IPCB(skb
), 0, sizeof(*IPCB(skb
)));
265 case htons(ETH_P_IPV6
):
266 xfrm_decode_session(skb
, &fl
, AF_INET6
);
267 memset(IP6CB(skb
), 0, sizeof(*IP6CB(skb
)));
270 dev
->stats
.tx_errors
++;
275 /* override mark with tunnel output key */
276 fl
.flowi_mark
= be32_to_cpu(tunnel
->parms
.o_key
);
278 return vti_xmit(skb
, dev
, &fl
);
281 static int vti4_err(struct sk_buff
*skb
, u32 info
)
285 struct xfrm_state
*x
;
286 struct ip_tunnel
*tunnel
;
287 struct ip_esp_hdr
*esph
;
288 struct ip_auth_hdr
*ah
;
289 struct ip_comp_hdr
*ipch
;
290 struct net
*net
= dev_net(skb
->dev
);
291 const struct iphdr
*iph
= (const struct iphdr
*)skb
->data
;
292 int protocol
= iph
->protocol
;
293 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
295 tunnel
= ip_tunnel_lookup(itn
, skb
->dev
->ifindex
, TUNNEL_NO_KEY
,
296 iph
->daddr
, iph
->saddr
, 0);
300 mark
= be32_to_cpu(tunnel
->parms
.o_key
);
304 esph
= (struct ip_esp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
308 ah
= (struct ip_auth_hdr
*)(skb
->data
+(iph
->ihl
<<2));
312 ipch
= (struct ip_comp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
313 spi
= htonl(ntohs(ipch
->cpi
));
319 switch (icmp_hdr(skb
)->type
) {
320 case ICMP_DEST_UNREACH
:
321 if (icmp_hdr(skb
)->code
!= ICMP_FRAG_NEEDED
)
329 x
= xfrm_state_lookup(net
, mark
, (const xfrm_address_t
*)&iph
->daddr
,
330 spi
, protocol
, AF_INET
);
334 if (icmp_hdr(skb
)->type
== ICMP_DEST_UNREACH
)
335 ipv4_update_pmtu(skb
, net
, info
, 0, 0, protocol
, 0);
337 ipv4_redirect(skb
, net
, 0, 0, protocol
, 0);
344 vti_tunnel_ioctl(struct net_device
*dev
, struct ifreq
*ifr
, int cmd
)
347 struct ip_tunnel_parm p
;
349 if (copy_from_user(&p
, ifr
->ifr_ifru
.ifru_data
, sizeof(p
)))
352 if (cmd
== SIOCADDTUNNEL
|| cmd
== SIOCCHGTUNNEL
) {
353 if (p
.iph
.version
!= 4 || p
.iph
.protocol
!= IPPROTO_IPIP
||
358 if (!(p
.i_flags
& GRE_KEY
))
360 if (!(p
.o_flags
& GRE_KEY
))
363 p
.i_flags
= VTI_ISVTI
;
365 err
= ip_tunnel_ioctl(dev
, &p
, cmd
);
369 if (cmd
!= SIOCDELTUNNEL
) {
370 p
.i_flags
|= GRE_KEY
;
371 p
.o_flags
|= GRE_KEY
;
374 if (copy_to_user(ifr
->ifr_ifru
.ifru_data
, &p
, sizeof(p
)))
379 static const struct net_device_ops vti_netdev_ops
= {
380 .ndo_init
= vti_tunnel_init
,
381 .ndo_uninit
= ip_tunnel_uninit
,
382 .ndo_start_xmit
= vti_tunnel_xmit
,
383 .ndo_do_ioctl
= vti_tunnel_ioctl
,
384 .ndo_change_mtu
= ip_tunnel_change_mtu
,
385 .ndo_get_stats64
= ip_tunnel_get_stats64
,
386 .ndo_get_iflink
= ip_tunnel_get_iflink
,
389 static void vti_tunnel_setup(struct net_device
*dev
)
391 dev
->netdev_ops
= &vti_netdev_ops
;
392 dev
->type
= ARPHRD_TUNNEL
;
393 ip_tunnel_setup(dev
, vti_net_id
);
396 static int vti_tunnel_init(struct net_device
*dev
)
398 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
399 struct iphdr
*iph
= &tunnel
->parms
.iph
;
401 memcpy(dev
->dev_addr
, &iph
->saddr
, 4);
402 memcpy(dev
->broadcast
, &iph
->daddr
, 4);
404 dev
->mtu
= ETH_DATA_LEN
;
405 dev
->flags
= IFF_NOARP
;
407 dev
->features
|= NETIF_F_LLTX
;
410 return ip_tunnel_init(dev
);
413 static void __net_init
vti_fb_tunnel_init(struct net_device
*dev
)
415 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
416 struct iphdr
*iph
= &tunnel
->parms
.iph
;
419 iph
->protocol
= IPPROTO_IPIP
;
423 static struct xfrm4_protocol vti_esp4_protocol __read_mostly
= {
425 .input_handler
= vti_input
,
426 .cb_handler
= vti_rcv_cb
,
427 .err_handler
= vti4_err
,
431 static struct xfrm4_protocol vti_ah4_protocol __read_mostly
= {
433 .input_handler
= vti_input
,
434 .cb_handler
= vti_rcv_cb
,
435 .err_handler
= vti4_err
,
439 static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly
= {
441 .input_handler
= vti_input
,
442 .cb_handler
= vti_rcv_cb
,
443 .err_handler
= vti4_err
,
447 static struct xfrm_tunnel ipip_handler __read_mostly
= {
448 .handler
= vti_rcv_ipip
,
449 .err_handler
= vti4_err
,
453 static int __net_init
vti_init_net(struct net
*net
)
456 struct ip_tunnel_net
*itn
;
458 err
= ip_tunnel_init_net(net
, vti_net_id
, &vti_link_ops
, "ip_vti0");
461 itn
= net_generic(net
, vti_net_id
);
462 vti_fb_tunnel_init(itn
->fb_tunnel_dev
);
466 static void __net_exit
vti_exit_net(struct net
*net
)
468 struct ip_tunnel_net
*itn
= net_generic(net
, vti_net_id
);
469 ip_tunnel_delete_net(itn
, &vti_link_ops
);
472 static struct pernet_operations vti_net_ops
= {
473 .init
= vti_init_net
,
474 .exit
= vti_exit_net
,
476 .size
= sizeof(struct ip_tunnel_net
),
479 static int vti_tunnel_validate(struct nlattr
*tb
[], struct nlattr
*data
[])
484 static void vti_netlink_parms(struct nlattr
*data
[],
485 struct ip_tunnel_parm
*parms
)
487 memset(parms
, 0, sizeof(*parms
));
489 parms
->iph
.protocol
= IPPROTO_IPIP
;
494 parms
->i_flags
= VTI_ISVTI
;
496 if (data
[IFLA_VTI_LINK
])
497 parms
->link
= nla_get_u32(data
[IFLA_VTI_LINK
]);
499 if (data
[IFLA_VTI_IKEY
])
500 parms
->i_key
= nla_get_be32(data
[IFLA_VTI_IKEY
]);
502 if (data
[IFLA_VTI_OKEY
])
503 parms
->o_key
= nla_get_be32(data
[IFLA_VTI_OKEY
]);
505 if (data
[IFLA_VTI_LOCAL
])
506 parms
->iph
.saddr
= nla_get_in_addr(data
[IFLA_VTI_LOCAL
]);
508 if (data
[IFLA_VTI_REMOTE
])
509 parms
->iph
.daddr
= nla_get_in_addr(data
[IFLA_VTI_REMOTE
]);
513 static int vti_newlink(struct net
*src_net
, struct net_device
*dev
,
514 struct nlattr
*tb
[], struct nlattr
*data
[])
516 struct ip_tunnel_parm parms
;
518 vti_netlink_parms(data
, &parms
);
519 return ip_tunnel_newlink(dev
, tb
, &parms
);
522 static int vti_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
523 struct nlattr
*data
[])
525 struct ip_tunnel_parm p
;
527 vti_netlink_parms(data
, &p
);
528 return ip_tunnel_changelink(dev
, tb
, &p
);
531 static size_t vti_get_size(const struct net_device
*dev
)
542 /* IFLA_VTI_REMOTE */
547 static int vti_fill_info(struct sk_buff
*skb
, const struct net_device
*dev
)
549 struct ip_tunnel
*t
= netdev_priv(dev
);
550 struct ip_tunnel_parm
*p
= &t
->parms
;
552 nla_put_u32(skb
, IFLA_VTI_LINK
, p
->link
);
553 nla_put_be32(skb
, IFLA_VTI_IKEY
, p
->i_key
);
554 nla_put_be32(skb
, IFLA_VTI_OKEY
, p
->o_key
);
555 nla_put_in_addr(skb
, IFLA_VTI_LOCAL
, p
->iph
.saddr
);
556 nla_put_in_addr(skb
, IFLA_VTI_REMOTE
, p
->iph
.daddr
);
561 static const struct nla_policy vti_policy
[IFLA_VTI_MAX
+ 1] = {
562 [IFLA_VTI_LINK
] = { .type
= NLA_U32
},
563 [IFLA_VTI_IKEY
] = { .type
= NLA_U32
},
564 [IFLA_VTI_OKEY
] = { .type
= NLA_U32
},
565 [IFLA_VTI_LOCAL
] = { .len
= FIELD_SIZEOF(struct iphdr
, saddr
) },
566 [IFLA_VTI_REMOTE
] = { .len
= FIELD_SIZEOF(struct iphdr
, daddr
) },
569 static struct rtnl_link_ops vti_link_ops __read_mostly
= {
571 .maxtype
= IFLA_VTI_MAX
,
572 .policy
= vti_policy
,
573 .priv_size
= sizeof(struct ip_tunnel
),
574 .setup
= vti_tunnel_setup
,
575 .validate
= vti_tunnel_validate
,
576 .newlink
= vti_newlink
,
577 .changelink
= vti_changelink
,
578 .dellink
= ip_tunnel_dellink
,
579 .get_size
= vti_get_size
,
580 .fill_info
= vti_fill_info
,
581 .get_link_net
= ip_tunnel_get_link_net
,
584 static bool is_vti_tunnel(const struct net_device
*dev
)
586 return dev
->netdev_ops
== &vti_netdev_ops
;
589 static int vti_device_event(struct notifier_block
*unused
,
590 unsigned long event
, void *ptr
)
592 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
593 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
595 if (!is_vti_tunnel(dev
))
600 if (!net_eq(tunnel
->net
, dev_net(dev
)))
601 xfrm_garbage_collect(tunnel
->net
);
607 static struct notifier_block vti_notifier_block __read_mostly
= {
608 .notifier_call
= vti_device_event
,
611 static int __init
vti_init(void)
616 pr_info("IPv4 over IPsec tunneling driver\n");
618 register_netdevice_notifier(&vti_notifier_block
);
620 msg
= "tunnel device";
621 err
= register_pernet_device(&vti_net_ops
);
623 goto pernet_dev_failed
;
625 msg
= "tunnel protocols";
626 err
= xfrm4_protocol_register(&vti_esp4_protocol
, IPPROTO_ESP
);
628 goto xfrm_proto_esp_failed
;
629 err
= xfrm4_protocol_register(&vti_ah4_protocol
, IPPROTO_AH
);
631 goto xfrm_proto_ah_failed
;
632 err
= xfrm4_protocol_register(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
634 goto xfrm_proto_comp_failed
;
637 err
= xfrm4_tunnel_register(&ipip_handler
, AF_INET
);
639 pr_info("%s: cant't register tunnel\n",__func__
);
640 goto xfrm_tunnel_failed
;
643 msg
= "netlink interface";
644 err
= rtnl_link_register(&vti_link_ops
);
646 goto rtnl_link_failed
;
651 xfrm4_tunnel_deregister(&ipip_handler
, AF_INET
);
653 xfrm4_protocol_deregister(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
654 xfrm_proto_comp_failed
:
655 xfrm4_protocol_deregister(&vti_ah4_protocol
, IPPROTO_AH
);
656 xfrm_proto_ah_failed
:
657 xfrm4_protocol_deregister(&vti_esp4_protocol
, IPPROTO_ESP
);
658 xfrm_proto_esp_failed
:
659 unregister_pernet_device(&vti_net_ops
);
661 unregister_netdevice_notifier(&vti_notifier_block
);
662 pr_err("vti init: failed to register %s\n", msg
);
666 static void __exit
vti_fini(void)
668 rtnl_link_unregister(&vti_link_ops
);
669 xfrm4_tunnel_deregister(&ipip_handler
, AF_INET
);
670 xfrm4_protocol_deregister(&vti_ipcomp4_protocol
, IPPROTO_COMP
);
671 xfrm4_protocol_deregister(&vti_ah4_protocol
, IPPROTO_AH
);
672 xfrm4_protocol_deregister(&vti_esp4_protocol
, IPPROTO_ESP
);
673 unregister_pernet_device(&vti_net_ops
);
674 unregister_netdevice_notifier(&vti_notifier_block
);
677 module_init(vti_init
);
678 module_exit(vti_fini
);
679 MODULE_LICENSE("GPL");
680 MODULE_ALIAS_RTNL_LINK("vti");
681 MODULE_ALIAS_NETDEV("ip_vti0");