1 /* 2 * Linux NET3: GRE over IP protocol decoder. 3 * 4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 * 11 */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/capability.h> 16 #include <linux/module.h> 17 #include <linux/types.h> 18 #include <linux/kernel.h> 19 #include <linux/slab.h> 20 #include <linux/uaccess.h> 21 #include <linux/skbuff.h> 22 #include <linux/netdevice.h> 23 #include <linux/in.h> 24 #include <linux/tcp.h> 25 #include <linux/udp.h> 26 #include <linux/if_arp.h> 27 #include <linux/if_vlan.h> 28 #include <linux/init.h> 29 #include <linux/in6.h> 30 #include <linux/inetdevice.h> 31 #include <linux/igmp.h> 32 #include <linux/netfilter_ipv4.h> 33 #include <linux/etherdevice.h> 34 #include <linux/if_ether.h> 35 36 #include <net/sock.h> 37 #include <net/ip.h> 38 #include <net/icmp.h> 39 #include <net/protocol.h> 40 #include <net/ip_tunnels.h> 41 #include <net/arp.h> 42 #include <net/checksum.h> 43 #include <net/dsfield.h> 44 #include <net/inet_ecn.h> 45 #include <net/xfrm.h> 46 #include <net/net_namespace.h> 47 #include <net/netns/generic.h> 48 #include <net/rtnetlink.h> 49 #include <net/gre.h> 50 #include <net/dst_metadata.h> 51 #include <net/erspan.h> 52 53 /* 54 Problems & solutions 55 -------------------- 56 57 1. The most important issue is detecting local dead loops. 58 They would cause complete host lockup in transmit, which 59 would be "resolved" by stack overflow or, if queueing is enabled, 60 with infinite looping in net_bh. 61 62 We cannot track such dead loops during route installation, 63 it is infeasible task. The most general solutions would be 64 to keep skb->encapsulation counter (sort of local ttl), 65 and silently drop packet when it expires. It is a good 66 solution, but it supposes maintaining new variable in ALL 67 skb, even if no tunneling is used. 68 69 Current solution: xmit_recursion breaks dead loops. This is a percpu 70 counter, since when we enter the first ndo_xmit(), cpu migration is 71 forbidden. We force an exit if this counter reaches RECURSION_LIMIT 72 73 2. Networking dead loops would not kill routers, but would really 74 kill network. IP hop limit plays role of "t->recursion" in this case, 75 if we copy it from packet being encapsulated to upper header. 76 It is very good solution, but it introduces two problems: 77 78 - Routing protocols, using packets with ttl=1 (OSPF, RIP2), 79 do not work over tunnels. 80 - traceroute does not work. I planned to relay ICMP from tunnel, 81 so that this problem would be solved and traceroute output 82 would even more informative. This idea appeared to be wrong: 83 only Linux complies to rfc1812 now (yes, guys, Linux is the only 84 true router now :-)), all routers (at least, in neighbourhood of mine) 85 return only 8 bytes of payload. It is the end. 86 87 Hence, if we want that OSPF worked or traceroute said something reasonable, 88 we should search for another solution. 89 90 One of them is to parse packet trying to detect inner encapsulation 91 made by our node. It is difficult or even impossible, especially, 92 taking into account fragmentation. TO be short, ttl is not solution at all. 93 94 Current solution: The solution was UNEXPECTEDLY SIMPLE. 95 We force DF flag on tunnels with preconfigured hop limit, 96 that is ALL. :-) Well, it does not remove the problem completely, 97 but exponential growth of network traffic is changed to linear 98 (branches, that exceed pmtu are pruned) and tunnel mtu 99 rapidly degrades to value <68, where looping stops. 100 Yes, it is not good if there exists a router in the loop, 101 which does not force DF, even when encapsulating packets have DF set. 102 But it is not our problem! Nobody could accuse us, we made 103 all that we could make. Even if it is your gated who injected 104 fatal route to network, even if it were you who configured 105 fatal static route: you are innocent. :-) 106 107 Alexey Kuznetsov. 108 */ 109 110 static bool log_ecn_error = true; 111 module_param(log_ecn_error, bool, 0644); 112 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN"); 113 114 static struct rtnl_link_ops ipgre_link_ops __read_mostly; 115 static int ipgre_tunnel_init(struct net_device *dev); 116 static void erspan_build_header(struct sk_buff *skb, 117 u32 id, u32 index, 118 bool truncate, bool is_ipv4); 119 120 static unsigned int ipgre_net_id __read_mostly; 121 static unsigned int gre_tap_net_id __read_mostly; 122 static unsigned int erspan_net_id __read_mostly; 123 124 static void ipgre_err(struct sk_buff *skb, u32 info, 125 const struct tnl_ptk_info *tpi) 126 { 127 128 /* All the routers (except for Linux) return only 129 8 bytes of packet payload. It means, that precise relaying of 130 ICMP in the real Internet is absolutely infeasible. 131 132 Moreover, Cisco "wise men" put GRE key to the third word 133 in GRE header. It makes impossible maintaining even soft 134 state for keyed GRE tunnels with enabled checksum. Tell 135 them "thank you". 136 137 Well, I wonder, rfc1812 was written by Cisco employee, 138 what the hell these idiots break standards established 139 by themselves??? 140 */ 141 struct net *net = dev_net(skb->dev); 142 struct ip_tunnel_net *itn; 143 const struct iphdr *iph; 144 const int type = icmp_hdr(skb)->type; 145 const int code = icmp_hdr(skb)->code; 146 unsigned int data_len = 0; 147 struct ip_tunnel *t; 148 149 switch (type) { 150 default: 151 case ICMP_PARAMETERPROB: 152 return; 153 154 case ICMP_DEST_UNREACH: 155 switch (code) { 156 case ICMP_SR_FAILED: 157 case ICMP_PORT_UNREACH: 158 /* Impossible event. */ 159 return; 160 default: 161 /* All others are translated to HOST_UNREACH. 162 rfc2003 contains "deep thoughts" about NET_UNREACH, 163 I believe they are just ether pollution. --ANK 164 */ 165 break; 166 } 167 break; 168 169 case ICMP_TIME_EXCEEDED: 170 if (code != ICMP_EXC_TTL) 171 return; 172 data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */ 173 break; 174 175 case ICMP_REDIRECT: 176 break; 177 } 178 179 if (tpi->proto == htons(ETH_P_TEB)) 180 itn = net_generic(net, gre_tap_net_id); 181 else 182 itn = net_generic(net, ipgre_net_id); 183 184 iph = (const struct iphdr *)(icmp_hdr(skb) + 1); 185 t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags, 186 iph->daddr, iph->saddr, tpi->key); 187 188 if (!t) 189 return; 190 191 #if IS_ENABLED(CONFIG_IPV6) 192 if (tpi->proto == htons(ETH_P_IPV6) && 193 !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4 + tpi->hdr_len, 194 type, data_len)) 195 return; 196 #endif 197 198 if (t->parms.iph.daddr == 0 || 199 ipv4_is_multicast(t->parms.iph.daddr)) 200 return; 201 202 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED) 203 return; 204 205 if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO)) 206 t->err_count++; 207 else 208 t->err_count = 1; 209 t->err_time = jiffies; 210 } 211 212 static void gre_err(struct sk_buff *skb, u32 info) 213 { 214 /* All the routers (except for Linux) return only 215 * 8 bytes of packet payload. It means, that precise relaying of 216 * ICMP in the real Internet is absolutely infeasible. 217 * 218 * Moreover, Cisco "wise men" put GRE key to the third word 219 * in GRE header. It makes impossible maintaining even soft 220 * state for keyed 221 * GRE tunnels with enabled checksum. Tell them "thank you". 222 * 223 * Well, I wonder, rfc1812 was written by Cisco employee, 224 * what the hell these idiots break standards established 225 * by themselves??? 226 */ 227 228 const struct iphdr *iph = (struct iphdr *)skb->data; 229 const int type = icmp_hdr(skb)->type; 230 const int code = icmp_hdr(skb)->code; 231 struct tnl_ptk_info tpi; 232 bool csum_err = false; 233 234 if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 235 iph->ihl * 4) < 0) { 236 if (!csum_err) /* ignore csum errors. */ 237 return; 238 } 239 240 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { 241 ipv4_update_pmtu(skb, dev_net(skb->dev), info, 242 skb->dev->ifindex, 0, IPPROTO_GRE, 0); 243 return; 244 } 245 if (type == ICMP_REDIRECT) { 246 ipv4_redirect(skb, dev_net(skb->dev), skb->dev->ifindex, 0, 247 IPPROTO_GRE, 0); 248 return; 249 } 250 251 ipgre_err(skb, info, &tpi); 252 } 253 254 static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, 255 int gre_hdr_len) 256 { 257 struct net *net = dev_net(skb->dev); 258 struct metadata_dst *tun_dst = NULL; 259 struct erspan_base_hdr *ershdr; 260 struct erspan_metadata *pkt_md; 261 struct ip_tunnel_net *itn; 262 struct ip_tunnel *tunnel; 263 const struct iphdr *iph; 264 struct erspan_md2 *md2; 265 int ver; 266 int len; 267 268 itn = net_generic(net, erspan_net_id); 269 len = gre_hdr_len + sizeof(*ershdr); 270 271 /* Check based hdr len */ 272 if (unlikely(!pskb_may_pull(skb, len))) 273 return PACKET_REJECT; 274 275 iph = ip_hdr(skb); 276 ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); 277 ver = ershdr->ver; 278 279 /* The original GRE header does not have key field, 280 * Use ERSPAN 10-bit session ID as key. 281 */ 282 tpi->key = cpu_to_be32(get_session_id(ershdr)); 283 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, 284 tpi->flags | TUNNEL_KEY, 285 iph->saddr, iph->daddr, tpi->key); 286 287 if (tunnel) { 288 len = gre_hdr_len + erspan_hdr_len(ver); 289 if (unlikely(!pskb_may_pull(skb, len))) 290 return PACKET_REJECT; 291 292 ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); 293 pkt_md = (struct erspan_metadata *)(ershdr + 1); 294 295 if (__iptunnel_pull_header(skb, 296 len, 297 htons(ETH_P_TEB), 298 false, false) < 0) 299 goto drop; 300 301 if (tunnel->collect_md) { 302 struct ip_tunnel_info *info; 303 struct erspan_metadata *md; 304 __be64 tun_id; 305 __be16 flags; 306 307 tpi->flags |= TUNNEL_KEY; 308 flags = tpi->flags; 309 tun_id = key32_to_tunnel_id(tpi->key); 310 311 tun_dst = ip_tun_rx_dst(skb, flags, 312 tun_id, sizeof(*md)); 313 if (!tun_dst) 314 return PACKET_REJECT; 315 316 md = ip_tunnel_info_opts(&tun_dst->u.tun_info); 317 md->version = ver; 318 md2 = &md->u.md2; 319 memcpy(md2, pkt_md, ver == 1 ? ERSPAN_V1_MDSIZE : 320 ERSPAN_V2_MDSIZE); 321 322 info = &tun_dst->u.tun_info; 323 info->key.tun_flags |= TUNNEL_ERSPAN_OPT; 324 info->options_len = sizeof(*md); 325 } 326 327 skb_reset_mac_header(skb); 328 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error); 329 return PACKET_RCVD; 330 } 331 drop: 332 kfree_skb(skb); 333 return PACKET_RCVD; 334 } 335 336 static int __ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi, 337 struct ip_tunnel_net *itn, int hdr_len, bool raw_proto) 338 { 339 struct metadata_dst *tun_dst = NULL; 340 const struct iphdr *iph; 341 struct ip_tunnel *tunnel; 342 343 iph = ip_hdr(skb); 344 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags, 345 iph->saddr, iph->daddr, tpi->key); 346 347 if (tunnel) { 348 if (__iptunnel_pull_header(skb, hdr_len, tpi->proto, 349 raw_proto, false) < 0) 350 goto drop; 351 352 if (tunnel->dev->type != ARPHRD_NONE) 353 skb_pop_mac_header(skb); 354 else 355 skb_reset_mac_header(skb); 356 if (tunnel->collect_md) { 357 __be16 flags; 358 __be64 tun_id; 359 360 flags = tpi->flags & (TUNNEL_CSUM | TUNNEL_KEY); 361 tun_id = key32_to_tunnel_id(tpi->key); 362 tun_dst = ip_tun_rx_dst(skb, flags, tun_id, 0); 363 if (!tun_dst) 364 return PACKET_REJECT; 365 } 366 367 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error); 368 return PACKET_RCVD; 369 } 370 return PACKET_NEXT; 371 372 drop: 373 kfree_skb(skb); 374 return PACKET_RCVD; 375 } 376 377 static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi, 378 int hdr_len) 379 { 380 struct net *net = dev_net(skb->dev); 381 struct ip_tunnel_net *itn; 382 int res; 383 384 if (tpi->proto == htons(ETH_P_TEB)) 385 itn = net_generic(net, gre_tap_net_id); 386 else 387 itn = net_generic(net, ipgre_net_id); 388 389 res = __ipgre_rcv(skb, tpi, itn, hdr_len, false); 390 if (res == PACKET_NEXT && tpi->proto == htons(ETH_P_TEB)) { 391 /* ipgre tunnels in collect metadata mode should receive 392 * also ETH_P_TEB traffic. 393 */ 394 itn = net_generic(net, ipgre_net_id); 395 res = __ipgre_rcv(skb, tpi, itn, hdr_len, true); 396 } 397 return res; 398 } 399 400 static int gre_rcv(struct sk_buff *skb) 401 { 402 struct tnl_ptk_info tpi; 403 bool csum_err = false; 404 int hdr_len; 405 406 #ifdef CONFIG_NET_IPGRE_BROADCAST 407 if (ipv4_is_multicast(ip_hdr(skb)->daddr)) { 408 /* Looped back packet, drop it! */ 409 if (rt_is_output_route(skb_rtable(skb))) 410 goto drop; 411 } 412 #endif 413 414 hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 0); 415 if (hdr_len < 0) 416 goto drop; 417 418 if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) || 419 tpi.proto == htons(ETH_P_ERSPAN2))) { 420 if (erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) 421 return 0; 422 goto out; 423 } 424 425 if (ipgre_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) 426 return 0; 427 428 out: 429 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); 430 drop: 431 kfree_skb(skb); 432 return 0; 433 } 434 435 static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, 436 const struct iphdr *tnl_params, 437 __be16 proto) 438 { 439 struct ip_tunnel *tunnel = netdev_priv(dev); 440 441 if (tunnel->parms.o_flags & TUNNEL_SEQ) 442 tunnel->o_seqno++; 443 444 /* Push GRE header. */ 445 gre_build_header(skb, tunnel->tun_hlen, 446 tunnel->parms.o_flags, proto, tunnel->parms.o_key, 447 htonl(tunnel->o_seqno)); 448 449 ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); 450 } 451 452 static int gre_handle_offloads(struct sk_buff *skb, bool csum) 453 { 454 return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); 455 } 456 457 static struct rtable *gre_get_rt(struct sk_buff *skb, 458 struct net_device *dev, 459 struct flowi4 *fl, 460 const struct ip_tunnel_key *key) 461 { 462 struct net *net = dev_net(dev); 463 464 memset(fl, 0, sizeof(*fl)); 465 fl->daddr = key->u.ipv4.dst; 466 fl->saddr = key->u.ipv4.src; 467 fl->flowi4_tos = RT_TOS(key->tos); 468 fl->flowi4_mark = skb->mark; 469 fl->flowi4_proto = IPPROTO_GRE; 470 471 return ip_route_output_key(net, fl); 472 } 473 474 static struct rtable *prepare_fb_xmit(struct sk_buff *skb, 475 struct net_device *dev, 476 struct flowi4 *fl, 477 int tunnel_hlen) 478 { 479 struct ip_tunnel_info *tun_info; 480 const struct ip_tunnel_key *key; 481 struct rtable *rt = NULL; 482 int min_headroom; 483 bool use_cache; 484 int err; 485 486 tun_info = skb_tunnel_info(skb); 487 key = &tun_info->key; 488 use_cache = ip_tunnel_dst_cache_usable(skb, tun_info); 489 490 if (use_cache) 491 rt = dst_cache_get_ip4(&tun_info->dst_cache, &fl->saddr); 492 if (!rt) { 493 rt = gre_get_rt(skb, dev, fl, key); 494 if (IS_ERR(rt)) 495 goto err_free_skb; 496 if (use_cache) 497 dst_cache_set_ip4(&tun_info->dst_cache, &rt->dst, 498 fl->saddr); 499 } 500 501 min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len 502 + tunnel_hlen + sizeof(struct iphdr); 503 if (skb_headroom(skb) < min_headroom || skb_header_cloned(skb)) { 504 int head_delta = SKB_DATA_ALIGN(min_headroom - 505 skb_headroom(skb) + 506 16); 507 err = pskb_expand_head(skb, max_t(int, head_delta, 0), 508 0, GFP_ATOMIC); 509 if (unlikely(err)) 510 goto err_free_rt; 511 } 512 return rt; 513 514 err_free_rt: 515 ip_rt_put(rt); 516 err_free_skb: 517 kfree_skb(skb); 518 dev->stats.tx_dropped++; 519 return NULL; 520 } 521 522 static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev, 523 __be16 proto) 524 { 525 struct ip_tunnel *tunnel = netdev_priv(dev); 526 struct ip_tunnel_info *tun_info; 527 const struct ip_tunnel_key *key; 528 struct rtable *rt = NULL; 529 struct flowi4 fl; 530 int tunnel_hlen; 531 __be16 df, flags; 532 533 tun_info = skb_tunnel_info(skb); 534 if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || 535 ip_tunnel_info_af(tun_info) != AF_INET)) 536 goto err_free_skb; 537 538 key = &tun_info->key; 539 tunnel_hlen = gre_calc_hlen(key->tun_flags); 540 541 rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen); 542 if (!rt) 543 return; 544 545 /* Push Tunnel header. */ 546 if (gre_handle_offloads(skb, !!(tun_info->key.tun_flags & TUNNEL_CSUM))) 547 goto err_free_rt; 548 549 flags = tun_info->key.tun_flags & 550 (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ); 551 gre_build_header(skb, tunnel_hlen, flags, proto, 552 tunnel_id_to_key32(tun_info->key.tun_id), 553 (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); 554 555 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; 556 557 iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE, 558 key->tos, key->ttl, df, false); 559 return; 560 561 err_free_rt: 562 ip_rt_put(rt); 563 err_free_skb: 564 kfree_skb(skb); 565 dev->stats.tx_dropped++; 566 } 567 568 static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev, 569 __be16 proto) 570 { 571 struct ip_tunnel *tunnel = netdev_priv(dev); 572 struct ip_tunnel_info *tun_info; 573 const struct ip_tunnel_key *key; 574 struct erspan_metadata *md; 575 struct rtable *rt = NULL; 576 bool truncate = false; 577 struct flowi4 fl; 578 int tunnel_hlen; 579 int version; 580 __be16 df; 581 int nhoff; 582 int thoff; 583 584 tun_info = skb_tunnel_info(skb); 585 if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || 586 ip_tunnel_info_af(tun_info) != AF_INET)) 587 goto err_free_skb; 588 589 key = &tun_info->key; 590 if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT)) 591 goto err_free_rt; 592 md = ip_tunnel_info_opts(tun_info); 593 if (!md) 594 goto err_free_rt; 595 596 /* ERSPAN has fixed 8 byte GRE header */ 597 version = md->version; 598 tunnel_hlen = 8 + erspan_hdr_len(version); 599 600 rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen); 601 if (!rt) 602 return; 603 604 if (gre_handle_offloads(skb, false)) 605 goto err_free_rt; 606 607 if (skb->len > dev->mtu + dev->hard_header_len) { 608 pskb_trim(skb, dev->mtu + dev->hard_header_len); 609 truncate = true; 610 } 611 612 nhoff = skb_network_header(skb) - skb_mac_header(skb); 613 if (skb->protocol == htons(ETH_P_IP) && 614 (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) 615 truncate = true; 616 617 thoff = skb_transport_header(skb) - skb_mac_header(skb); 618 if (skb->protocol == htons(ETH_P_IPV6) && 619 (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)) 620 truncate = true; 621 622 if (version == 1) { 623 erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)), 624 ntohl(md->u.index), truncate, true); 625 } else if (version == 2) { 626 erspan_build_header_v2(skb, 627 ntohl(tunnel_id_to_key32(key->tun_id)), 628 md->u.md2.dir, 629 get_hwid(&md->u.md2), 630 truncate, true); 631 } else { 632 goto err_free_rt; 633 } 634 635 gre_build_header(skb, 8, TUNNEL_SEQ, 636 htons(ETH_P_ERSPAN), 0, htonl(tunnel->o_seqno++)); 637 638 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; 639 640 iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE, 641 key->tos, key->ttl, df, false); 642 return; 643 644 err_free_rt: 645 ip_rt_put(rt); 646 err_free_skb: 647 kfree_skb(skb); 648 dev->stats.tx_dropped++; 649 } 650 651 static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) 652 { 653 struct ip_tunnel_info *info = skb_tunnel_info(skb); 654 struct rtable *rt; 655 struct flowi4 fl4; 656 657 if (ip_tunnel_info_af(info) != AF_INET) 658 return -EINVAL; 659 660 rt = gre_get_rt(skb, dev, &fl4, &info->key); 661 if (IS_ERR(rt)) 662 return PTR_ERR(rt); 663 664 ip_rt_put(rt); 665 info->key.u.ipv4.src = fl4.saddr; 666 return 0; 667 } 668 669 static netdev_tx_t ipgre_xmit(struct sk_buff *skb, 670 struct net_device *dev) 671 { 672 struct ip_tunnel *tunnel = netdev_priv(dev); 673 const struct iphdr *tnl_params; 674 675 if (tunnel->collect_md) { 676 gre_fb_xmit(skb, dev, skb->protocol); 677 return NETDEV_TX_OK; 678 } 679 680 if (dev->header_ops) { 681 /* Need space for new headers */ 682 if (skb_cow_head(skb, dev->needed_headroom - 683 (tunnel->hlen + sizeof(struct iphdr)))) 684 goto free_skb; 685 686 tnl_params = (const struct iphdr *)skb->data; 687 688 /* Pull skb since ip_tunnel_xmit() needs skb->data pointing 689 * to gre header. 690 */ 691 skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); 692 skb_reset_mac_header(skb); 693 } else { 694 if (skb_cow_head(skb, dev->needed_headroom)) 695 goto free_skb; 696 697 tnl_params = &tunnel->parms.iph; 698 } 699 700 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM))) 701 goto free_skb; 702 703 __gre_xmit(skb, dev, tnl_params, skb->protocol); 704 return NETDEV_TX_OK; 705 706 free_skb: 707 kfree_skb(skb); 708 dev->stats.tx_dropped++; 709 return NETDEV_TX_OK; 710 } 711 712 static netdev_tx_t erspan_xmit(struct sk_buff *skb, 713 struct net_device *dev) 714 { 715 struct ip_tunnel *tunnel = netdev_priv(dev); 716 bool truncate = false; 717 718 if (tunnel->collect_md) { 719 erspan_fb_xmit(skb, dev, skb->protocol); 720 return NETDEV_TX_OK; 721 } 722 723 if (gre_handle_offloads(skb, false)) 724 goto free_skb; 725 726 if (skb_cow_head(skb, dev->needed_headroom)) 727 goto free_skb; 728 729 if (skb->len > dev->mtu + dev->hard_header_len) { 730 pskb_trim(skb, dev->mtu + dev->hard_header_len); 731 truncate = true; 732 } 733 734 /* Push ERSPAN header */ 735 if (tunnel->erspan_ver == 1) 736 erspan_build_header(skb, ntohl(tunnel->parms.o_key), 737 tunnel->index, 738 truncate, true); 739 else if (tunnel->erspan_ver == 2) 740 erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key), 741 tunnel->dir, tunnel->hwid, 742 truncate, true); 743 else 744 goto free_skb; 745 746 tunnel->parms.o_flags &= ~TUNNEL_KEY; 747 __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN)); 748 return NETDEV_TX_OK; 749 750 free_skb: 751 kfree_skb(skb); 752 dev->stats.tx_dropped++; 753 return NETDEV_TX_OK; 754 } 755 756 static netdev_tx_t gre_tap_xmit(struct sk_buff *skb, 757 struct net_device *dev) 758 { 759 struct ip_tunnel *tunnel = netdev_priv(dev); 760 761 if (tunnel->collect_md) { 762 gre_fb_xmit(skb, dev, htons(ETH_P_TEB)); 763 return NETDEV_TX_OK; 764 } 765 766 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM))) 767 goto free_skb; 768 769 if (skb_cow_head(skb, dev->needed_headroom)) 770 goto free_skb; 771 772 __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB)); 773 return NETDEV_TX_OK; 774 775 free_skb: 776 kfree_skb(skb); 777 dev->stats.tx_dropped++; 778 return NETDEV_TX_OK; 779 } 780 781 static void ipgre_link_update(struct net_device *dev, bool set_mtu) 782 { 783 struct ip_tunnel *tunnel = netdev_priv(dev); 784 int len; 785 786 len = tunnel->tun_hlen; 787 tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags); 788 len = tunnel->tun_hlen - len; 789 tunnel->hlen = tunnel->hlen + len; 790 791 dev->needed_headroom = dev->needed_headroom + len; 792 if (set_mtu) 793 dev->mtu = max_t(int, dev->mtu - len, 68); 794 795 if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) { 796 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) || 797 tunnel->encap.type == TUNNEL_ENCAP_NONE) { 798 dev->features |= NETIF_F_GSO_SOFTWARE; 799 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 800 } else { 801 dev->features &= ~NETIF_F_GSO_SOFTWARE; 802 dev->hw_features &= ~NETIF_F_GSO_SOFTWARE; 803 } 804 dev->features |= NETIF_F_LLTX; 805 } else { 806 dev->hw_features &= ~NETIF_F_GSO_SOFTWARE; 807 dev->features &= ~(NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE); 808 } 809 } 810 811 static int ipgre_tunnel_ioctl(struct net_device *dev, 812 struct ifreq *ifr, int cmd) 813 { 814 struct ip_tunnel_parm p; 815 int err; 816 817 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) 818 return -EFAULT; 819 820 if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) { 821 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE || 822 p.iph.ihl != 5 || (p.iph.frag_off & htons(~IP_DF)) || 823 ((p.i_flags | p.o_flags) & (GRE_VERSION | GRE_ROUTING))) 824 return -EINVAL; 825 } 826 827 p.i_flags = gre_flags_to_tnl_flags(p.i_flags); 828 p.o_flags = gre_flags_to_tnl_flags(p.o_flags); 829 830 err = ip_tunnel_ioctl(dev, &p, cmd); 831 if (err) 832 return err; 833 834 if (cmd == SIOCCHGTUNNEL) { 835 struct ip_tunnel *t = netdev_priv(dev); 836 837 t->parms.i_flags = p.i_flags; 838 t->parms.o_flags = p.o_flags; 839 840 if (strcmp(dev->rtnl_link_ops->kind, "erspan")) 841 ipgre_link_update(dev, true); 842 } 843 844 p.i_flags = gre_tnl_flags_to_gre_flags(p.i_flags); 845 p.o_flags = gre_tnl_flags_to_gre_flags(p.o_flags); 846 847 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p))) 848 return -EFAULT; 849 850 return 0; 851 } 852 853 /* Nice toy. Unfortunately, useless in real life :-) 854 It allows to construct virtual multiprotocol broadcast "LAN" 855 over the Internet, provided multicast routing is tuned. 856 857 858 I have no idea was this bicycle invented before me, 859 so that I had to set ARPHRD_IPGRE to a random value. 860 I have an impression, that Cisco could make something similar, 861 but this feature is apparently missing in IOS<=11.2(8). 862 863 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks 864 with broadcast 224.66.66.66. If you have access to mbone, play with me :-) 865 866 ping -t 255 224.66.66.66 867 868 If nobody answers, mbone does not work. 869 870 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255 871 ip addr add 10.66.66.<somewhat>/24 dev Universe 872 ifconfig Universe up 873 ifconfig Universe add fe80::<Your_real_addr>/10 874 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96 875 ftp 10.66.66.66 876 ... 877 ftp fec0:6666:6666::193.233.7.65 878 ... 879 */ 880 static int ipgre_header(struct sk_buff *skb, struct net_device *dev, 881 unsigned short type, 882 const void *daddr, const void *saddr, unsigned int len) 883 { 884 struct ip_tunnel *t = netdev_priv(dev); 885 struct iphdr *iph; 886 struct gre_base_hdr *greh; 887 888 iph = skb_push(skb, t->hlen + sizeof(*iph)); 889 greh = (struct gre_base_hdr *)(iph+1); 890 greh->flags = gre_tnl_flags_to_gre_flags(t->parms.o_flags); 891 greh->protocol = htons(type); 892 893 memcpy(iph, &t->parms.iph, sizeof(struct iphdr)); 894 895 /* Set the source hardware address. */ 896 if (saddr) 897 memcpy(&iph->saddr, saddr, 4); 898 if (daddr) 899 memcpy(&iph->daddr, daddr, 4); 900 if (iph->daddr) 901 return t->hlen + sizeof(*iph); 902 903 return -(t->hlen + sizeof(*iph)); 904 } 905 906 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr) 907 { 908 const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb); 909 memcpy(haddr, &iph->saddr, 4); 910 return 4; 911 } 912 913 static const struct header_ops ipgre_header_ops = { 914 .create = ipgre_header, 915 .parse = ipgre_header_parse, 916 }; 917 918 #ifdef CONFIG_NET_IPGRE_BROADCAST 919 static int ipgre_open(struct net_device *dev) 920 { 921 struct ip_tunnel *t = netdev_priv(dev); 922 923 if (ipv4_is_multicast(t->parms.iph.daddr)) { 924 struct flowi4 fl4; 925 struct rtable *rt; 926 927 rt = ip_route_output_gre(t->net, &fl4, 928 t->parms.iph.daddr, 929 t->parms.iph.saddr, 930 t->parms.o_key, 931 RT_TOS(t->parms.iph.tos), 932 t->parms.link); 933 if (IS_ERR(rt)) 934 return -EADDRNOTAVAIL; 935 dev = rt->dst.dev; 936 ip_rt_put(rt); 937 if (!__in_dev_get_rtnl(dev)) 938 return -EADDRNOTAVAIL; 939 t->mlink = dev->ifindex; 940 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr); 941 } 942 return 0; 943 } 944 945 static int ipgre_close(struct net_device *dev) 946 { 947 struct ip_tunnel *t = netdev_priv(dev); 948 949 if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) { 950 struct in_device *in_dev; 951 in_dev = inetdev_by_index(t->net, t->mlink); 952 if (in_dev) 953 ip_mc_dec_group(in_dev, t->parms.iph.daddr); 954 } 955 return 0; 956 } 957 #endif 958 959 static const struct net_device_ops ipgre_netdev_ops = { 960 .ndo_init = ipgre_tunnel_init, 961 .ndo_uninit = ip_tunnel_uninit, 962 #ifdef CONFIG_NET_IPGRE_BROADCAST 963 .ndo_open = ipgre_open, 964 .ndo_stop = ipgre_close, 965 #endif 966 .ndo_start_xmit = ipgre_xmit, 967 .ndo_do_ioctl = ipgre_tunnel_ioctl, 968 .ndo_change_mtu = ip_tunnel_change_mtu, 969 .ndo_get_stats64 = ip_tunnel_get_stats64, 970 .ndo_get_iflink = ip_tunnel_get_iflink, 971 }; 972 973 #define GRE_FEATURES (NETIF_F_SG | \ 974 NETIF_F_FRAGLIST | \ 975 NETIF_F_HIGHDMA | \ 976 NETIF_F_HW_CSUM) 977 978 static void ipgre_tunnel_setup(struct net_device *dev) 979 { 980 dev->netdev_ops = &ipgre_netdev_ops; 981 dev->type = ARPHRD_IPGRE; 982 ip_tunnel_setup(dev, ipgre_net_id); 983 } 984 985 static void __gre_tunnel_init(struct net_device *dev) 986 { 987 struct ip_tunnel *tunnel; 988 int t_hlen; 989 990 tunnel = netdev_priv(dev); 991 tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags); 992 tunnel->parms.iph.protocol = IPPROTO_GRE; 993 994 tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen; 995 996 t_hlen = tunnel->hlen + sizeof(struct iphdr); 997 998 dev->features |= GRE_FEATURES; 999 dev->hw_features |= GRE_FEATURES; 1000 1001 if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) { 1002 /* TCP offload with GRE SEQ is not supported, nor 1003 * can we support 2 levels of outer headers requiring 1004 * an update. 1005 */ 1006 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) || 1007 (tunnel->encap.type == TUNNEL_ENCAP_NONE)) { 1008 dev->features |= NETIF_F_GSO_SOFTWARE; 1009 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 1010 } 1011 1012 /* Can use a lockless transmit, unless we generate 1013 * output sequences 1014 */ 1015 dev->features |= NETIF_F_LLTX; 1016 } 1017 } 1018 1019 static int ipgre_tunnel_init(struct net_device *dev) 1020 { 1021 struct ip_tunnel *tunnel = netdev_priv(dev); 1022 struct iphdr *iph = &tunnel->parms.iph; 1023 1024 __gre_tunnel_init(dev); 1025 1026 memcpy(dev->dev_addr, &iph->saddr, 4); 1027 memcpy(dev->broadcast, &iph->daddr, 4); 1028 1029 dev->flags = IFF_NOARP; 1030 netif_keep_dst(dev); 1031 dev->addr_len = 4; 1032 1033 if (iph->daddr && !tunnel->collect_md) { 1034 #ifdef CONFIG_NET_IPGRE_BROADCAST 1035 if (ipv4_is_multicast(iph->daddr)) { 1036 if (!iph->saddr) 1037 return -EINVAL; 1038 dev->flags = IFF_BROADCAST; 1039 dev->header_ops = &ipgre_header_ops; 1040 } 1041 #endif 1042 } else if (!tunnel->collect_md) { 1043 dev->header_ops = &ipgre_header_ops; 1044 } 1045 1046 return ip_tunnel_init(dev); 1047 } 1048 1049 static const struct gre_protocol ipgre_protocol = { 1050 .handler = gre_rcv, 1051 .err_handler = gre_err, 1052 }; 1053 1054 static int __net_init ipgre_init_net(struct net *net) 1055 { 1056 return ip_tunnel_init_net(net, ipgre_net_id, &ipgre_link_ops, NULL); 1057 } 1058 1059 static void __net_exit ipgre_exit_batch_net(struct list_head *list_net) 1060 { 1061 ip_tunnel_delete_nets(list_net, ipgre_net_id, &ipgre_link_ops); 1062 } 1063 1064 static struct pernet_operations ipgre_net_ops = { 1065 .init = ipgre_init_net, 1066 .exit_batch = ipgre_exit_batch_net, 1067 .id = &ipgre_net_id, 1068 .size = sizeof(struct ip_tunnel_net), 1069 }; 1070 1071 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[], 1072 struct netlink_ext_ack *extack) 1073 { 1074 __be16 flags; 1075 1076 if (!data) 1077 return 0; 1078 1079 flags = 0; 1080 if (data[IFLA_GRE_IFLAGS]) 1081 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]); 1082 if (data[IFLA_GRE_OFLAGS]) 1083 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]); 1084 if (flags & (GRE_VERSION|GRE_ROUTING)) 1085 return -EINVAL; 1086 1087 if (data[IFLA_GRE_COLLECT_METADATA] && 1088 data[IFLA_GRE_ENCAP_TYPE] && 1089 nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE) 1090 return -EINVAL; 1091 1092 return 0; 1093 } 1094 1095 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[], 1096 struct netlink_ext_ack *extack) 1097 { 1098 __be32 daddr; 1099 1100 if (tb[IFLA_ADDRESS]) { 1101 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) 1102 return -EINVAL; 1103 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) 1104 return -EADDRNOTAVAIL; 1105 } 1106 1107 if (!data) 1108 goto out; 1109 1110 if (data[IFLA_GRE_REMOTE]) { 1111 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4); 1112 if (!daddr) 1113 return -EINVAL; 1114 } 1115 1116 out: 1117 return ipgre_tunnel_validate(tb, data, extack); 1118 } 1119 1120 static int erspan_validate(struct nlattr *tb[], struct nlattr *data[], 1121 struct netlink_ext_ack *extack) 1122 { 1123 __be16 flags = 0; 1124 int ret; 1125 1126 if (!data) 1127 return 0; 1128 1129 ret = ipgre_tap_validate(tb, data, extack); 1130 if (ret) 1131 return ret; 1132 1133 /* ERSPAN should only have GRE sequence and key flag */ 1134 if (data[IFLA_GRE_OFLAGS]) 1135 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]); 1136 if (data[IFLA_GRE_IFLAGS]) 1137 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]); 1138 if (!data[IFLA_GRE_COLLECT_METADATA] && 1139 flags != (GRE_SEQ | GRE_KEY)) 1140 return -EINVAL; 1141 1142 /* ERSPAN Session ID only has 10-bit. Since we reuse 1143 * 32-bit key field as ID, check it's range. 1144 */ 1145 if (data[IFLA_GRE_IKEY] && 1146 (ntohl(nla_get_be32(data[IFLA_GRE_IKEY])) & ~ID_MASK)) 1147 return -EINVAL; 1148 1149 if (data[IFLA_GRE_OKEY] && 1150 (ntohl(nla_get_be32(data[IFLA_GRE_OKEY])) & ~ID_MASK)) 1151 return -EINVAL; 1152 1153 return 0; 1154 } 1155 1156 static int ipgre_netlink_parms(struct net_device *dev, 1157 struct nlattr *data[], 1158 struct nlattr *tb[], 1159 struct ip_tunnel_parm *parms, 1160 __u32 *fwmark) 1161 { 1162 struct ip_tunnel *t = netdev_priv(dev); 1163 1164 memset(parms, 0, sizeof(*parms)); 1165 1166 parms->iph.protocol = IPPROTO_GRE; 1167 1168 if (!data) 1169 return 0; 1170 1171 if (data[IFLA_GRE_LINK]) 1172 parms->link = nla_get_u32(data[IFLA_GRE_LINK]); 1173 1174 if (data[IFLA_GRE_IFLAGS]) 1175 parms->i_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_IFLAGS])); 1176 1177 if (data[IFLA_GRE_OFLAGS]) 1178 parms->o_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_OFLAGS])); 1179 1180 if (data[IFLA_GRE_IKEY]) 1181 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]); 1182 1183 if (data[IFLA_GRE_OKEY]) 1184 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]); 1185 1186 if (data[IFLA_GRE_LOCAL]) 1187 parms->iph.saddr = nla_get_in_addr(data[IFLA_GRE_LOCAL]); 1188 1189 if (data[IFLA_GRE_REMOTE]) 1190 parms->iph.daddr = nla_get_in_addr(data[IFLA_GRE_REMOTE]); 1191 1192 if (data[IFLA_GRE_TTL]) 1193 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]); 1194 1195 if (data[IFLA_GRE_TOS]) 1196 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]); 1197 1198 if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC])) { 1199 if (t->ignore_df) 1200 return -EINVAL; 1201 parms->iph.frag_off = htons(IP_DF); 1202 } 1203 1204 if (data[IFLA_GRE_COLLECT_METADATA]) { 1205 t->collect_md = true; 1206 if (dev->type == ARPHRD_IPGRE) 1207 dev->type = ARPHRD_NONE; 1208 } 1209 1210 if (data[IFLA_GRE_IGNORE_DF]) { 1211 if (nla_get_u8(data[IFLA_GRE_IGNORE_DF]) 1212 && (parms->iph.frag_off & htons(IP_DF))) 1213 return -EINVAL; 1214 t->ignore_df = !!nla_get_u8(data[IFLA_GRE_IGNORE_DF]); 1215 } 1216 1217 if (data[IFLA_GRE_FWMARK]) 1218 *fwmark = nla_get_u32(data[IFLA_GRE_FWMARK]); 1219 1220 if (data[IFLA_GRE_ERSPAN_VER]) { 1221 t->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]); 1222 1223 if (t->erspan_ver != 1 && t->erspan_ver != 2) 1224 return -EINVAL; 1225 } 1226 1227 if (t->erspan_ver == 1) { 1228 if (data[IFLA_GRE_ERSPAN_INDEX]) { 1229 t->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]); 1230 if (t->index & ~INDEX_MASK) 1231 return -EINVAL; 1232 } 1233 } else if (t->erspan_ver == 2) { 1234 if (data[IFLA_GRE_ERSPAN_DIR]) { 1235 t->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]); 1236 if (t->dir & ~(DIR_MASK >> DIR_OFFSET)) 1237 return -EINVAL; 1238 } 1239 if (data[IFLA_GRE_ERSPAN_HWID]) { 1240 t->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]); 1241 if (t->hwid & ~(HWID_MASK >> HWID_OFFSET)) 1242 return -EINVAL; 1243 } 1244 } 1245 1246 return 0; 1247 } 1248 1249 /* This function returns true when ENCAP attributes are present in the nl msg */ 1250 static bool ipgre_netlink_encap_parms(struct nlattr *data[], 1251 struct ip_tunnel_encap *ipencap) 1252 { 1253 bool ret = false; 1254 1255 memset(ipencap, 0, sizeof(*ipencap)); 1256 1257 if (!data) 1258 return ret; 1259 1260 if (data[IFLA_GRE_ENCAP_TYPE]) { 1261 ret = true; 1262 ipencap->type = nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]); 1263 } 1264 1265 if (data[IFLA_GRE_ENCAP_FLAGS]) { 1266 ret = true; 1267 ipencap->flags = nla_get_u16(data[IFLA_GRE_ENCAP_FLAGS]); 1268 } 1269 1270 if (data[IFLA_GRE_ENCAP_SPORT]) { 1271 ret = true; 1272 ipencap->sport = nla_get_be16(data[IFLA_GRE_ENCAP_SPORT]); 1273 } 1274 1275 if (data[IFLA_GRE_ENCAP_DPORT]) { 1276 ret = true; 1277 ipencap->dport = nla_get_be16(data[IFLA_GRE_ENCAP_DPORT]); 1278 } 1279 1280 return ret; 1281 } 1282 1283 static int gre_tap_init(struct net_device *dev) 1284 { 1285 __gre_tunnel_init(dev); 1286 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1287 netif_keep_dst(dev); 1288 1289 return ip_tunnel_init(dev); 1290 } 1291 1292 static const struct net_device_ops gre_tap_netdev_ops = { 1293 .ndo_init = gre_tap_init, 1294 .ndo_uninit = ip_tunnel_uninit, 1295 .ndo_start_xmit = gre_tap_xmit, 1296 .ndo_set_mac_address = eth_mac_addr, 1297 .ndo_validate_addr = eth_validate_addr, 1298 .ndo_change_mtu = ip_tunnel_change_mtu, 1299 .ndo_get_stats64 = ip_tunnel_get_stats64, 1300 .ndo_get_iflink = ip_tunnel_get_iflink, 1301 .ndo_fill_metadata_dst = gre_fill_metadata_dst, 1302 }; 1303 1304 static int erspan_tunnel_init(struct net_device *dev) 1305 { 1306 struct ip_tunnel *tunnel = netdev_priv(dev); 1307 int t_hlen; 1308 1309 tunnel->tun_hlen = 8; 1310 tunnel->parms.iph.protocol = IPPROTO_GRE; 1311 tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen + 1312 erspan_hdr_len(tunnel->erspan_ver); 1313 t_hlen = tunnel->hlen + sizeof(struct iphdr); 1314 1315 dev->features |= GRE_FEATURES; 1316 dev->hw_features |= GRE_FEATURES; 1317 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1318 netif_keep_dst(dev); 1319 1320 return ip_tunnel_init(dev); 1321 } 1322 1323 static const struct net_device_ops erspan_netdev_ops = { 1324 .ndo_init = erspan_tunnel_init, 1325 .ndo_uninit = ip_tunnel_uninit, 1326 .ndo_start_xmit = erspan_xmit, 1327 .ndo_set_mac_address = eth_mac_addr, 1328 .ndo_validate_addr = eth_validate_addr, 1329 .ndo_change_mtu = ip_tunnel_change_mtu, 1330 .ndo_get_stats64 = ip_tunnel_get_stats64, 1331 .ndo_get_iflink = ip_tunnel_get_iflink, 1332 .ndo_fill_metadata_dst = gre_fill_metadata_dst, 1333 }; 1334 1335 static void ipgre_tap_setup(struct net_device *dev) 1336 { 1337 ether_setup(dev); 1338 dev->max_mtu = 0; 1339 dev->netdev_ops = &gre_tap_netdev_ops; 1340 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 1341 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1342 ip_tunnel_setup(dev, gre_tap_net_id); 1343 } 1344 1345 bool is_gretap_dev(const struct net_device *dev) 1346 { 1347 return dev->netdev_ops == &gre_tap_netdev_ops; 1348 } 1349 EXPORT_SYMBOL_GPL(is_gretap_dev); 1350 1351 static int ipgre_newlink(struct net *src_net, struct net_device *dev, 1352 struct nlattr *tb[], struct nlattr *data[], 1353 struct netlink_ext_ack *extack) 1354 { 1355 struct ip_tunnel_parm p; 1356 struct ip_tunnel_encap ipencap; 1357 __u32 fwmark = 0; 1358 int err; 1359 1360 if (ipgre_netlink_encap_parms(data, &ipencap)) { 1361 struct ip_tunnel *t = netdev_priv(dev); 1362 err = ip_tunnel_encap_setup(t, &ipencap); 1363 1364 if (err < 0) 1365 return err; 1366 } 1367 1368 err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark); 1369 if (err < 0) 1370 return err; 1371 return ip_tunnel_newlink(dev, tb, &p, fwmark); 1372 } 1373 1374 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[], 1375 struct nlattr *data[], 1376 struct netlink_ext_ack *extack) 1377 { 1378 struct ip_tunnel *t = netdev_priv(dev); 1379 struct ip_tunnel_encap ipencap; 1380 __u32 fwmark = t->fwmark; 1381 struct ip_tunnel_parm p; 1382 int err; 1383 1384 if (ipgre_netlink_encap_parms(data, &ipencap)) { 1385 err = ip_tunnel_encap_setup(t, &ipencap); 1386 1387 if (err < 0) 1388 return err; 1389 } 1390 1391 err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark); 1392 if (err < 0) 1393 return err; 1394 1395 err = ip_tunnel_changelink(dev, tb, &p, fwmark); 1396 if (err < 0) 1397 return err; 1398 1399 t->parms.i_flags = p.i_flags; 1400 t->parms.o_flags = p.o_flags; 1401 1402 if (strcmp(dev->rtnl_link_ops->kind, "erspan")) 1403 ipgre_link_update(dev, !tb[IFLA_MTU]); 1404 1405 return 0; 1406 } 1407 1408 static size_t ipgre_get_size(const struct net_device *dev) 1409 { 1410 return 1411 /* IFLA_GRE_LINK */ 1412 nla_total_size(4) + 1413 /* IFLA_GRE_IFLAGS */ 1414 nla_total_size(2) + 1415 /* IFLA_GRE_OFLAGS */ 1416 nla_total_size(2) + 1417 /* IFLA_GRE_IKEY */ 1418 nla_total_size(4) + 1419 /* IFLA_GRE_OKEY */ 1420 nla_total_size(4) + 1421 /* IFLA_GRE_LOCAL */ 1422 nla_total_size(4) + 1423 /* IFLA_GRE_REMOTE */ 1424 nla_total_size(4) + 1425 /* IFLA_GRE_TTL */ 1426 nla_total_size(1) + 1427 /* IFLA_GRE_TOS */ 1428 nla_total_size(1) + 1429 /* IFLA_GRE_PMTUDISC */ 1430 nla_total_size(1) + 1431 /* IFLA_GRE_ENCAP_TYPE */ 1432 nla_total_size(2) + 1433 /* IFLA_GRE_ENCAP_FLAGS */ 1434 nla_total_size(2) + 1435 /* IFLA_GRE_ENCAP_SPORT */ 1436 nla_total_size(2) + 1437 /* IFLA_GRE_ENCAP_DPORT */ 1438 nla_total_size(2) + 1439 /* IFLA_GRE_COLLECT_METADATA */ 1440 nla_total_size(0) + 1441 /* IFLA_GRE_IGNORE_DF */ 1442 nla_total_size(1) + 1443 /* IFLA_GRE_FWMARK */ 1444 nla_total_size(4) + 1445 /* IFLA_GRE_ERSPAN_INDEX */ 1446 nla_total_size(4) + 1447 /* IFLA_GRE_ERSPAN_VER */ 1448 nla_total_size(1) + 1449 /* IFLA_GRE_ERSPAN_DIR */ 1450 nla_total_size(1) + 1451 /* IFLA_GRE_ERSPAN_HWID */ 1452 nla_total_size(2) + 1453 0; 1454 } 1455 1456 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev) 1457 { 1458 struct ip_tunnel *t = netdev_priv(dev); 1459 struct ip_tunnel_parm *p = &t->parms; 1460 1461 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) || 1462 nla_put_be16(skb, IFLA_GRE_IFLAGS, 1463 gre_tnl_flags_to_gre_flags(p->i_flags)) || 1464 nla_put_be16(skb, IFLA_GRE_OFLAGS, 1465 gre_tnl_flags_to_gre_flags(p->o_flags)) || 1466 nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) || 1467 nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) || 1468 nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) || 1469 nla_put_in_addr(skb, IFLA_GRE_REMOTE, p->iph.daddr) || 1470 nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) || 1471 nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) || 1472 nla_put_u8(skb, IFLA_GRE_PMTUDISC, 1473 !!(p->iph.frag_off & htons(IP_DF))) || 1474 nla_put_u32(skb, IFLA_GRE_FWMARK, t->fwmark)) 1475 goto nla_put_failure; 1476 1477 if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE, 1478 t->encap.type) || 1479 nla_put_be16(skb, IFLA_GRE_ENCAP_SPORT, 1480 t->encap.sport) || 1481 nla_put_be16(skb, IFLA_GRE_ENCAP_DPORT, 1482 t->encap.dport) || 1483 nla_put_u16(skb, IFLA_GRE_ENCAP_FLAGS, 1484 t->encap.flags)) 1485 goto nla_put_failure; 1486 1487 if (nla_put_u8(skb, IFLA_GRE_IGNORE_DF, t->ignore_df)) 1488 goto nla_put_failure; 1489 1490 if (t->collect_md) { 1491 if (nla_put_flag(skb, IFLA_GRE_COLLECT_METADATA)) 1492 goto nla_put_failure; 1493 } 1494 1495 if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver)) 1496 goto nla_put_failure; 1497 1498 if (t->erspan_ver == 1) { 1499 if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index)) 1500 goto nla_put_failure; 1501 } else if (t->erspan_ver == 2) { 1502 if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir)) 1503 goto nla_put_failure; 1504 if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid)) 1505 goto nla_put_failure; 1506 } 1507 1508 return 0; 1509 1510 nla_put_failure: 1511 return -EMSGSIZE; 1512 } 1513 1514 static void erspan_setup(struct net_device *dev) 1515 { 1516 ether_setup(dev); 1517 dev->netdev_ops = &erspan_netdev_ops; 1518 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 1519 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1520 ip_tunnel_setup(dev, erspan_net_id); 1521 } 1522 1523 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = { 1524 [IFLA_GRE_LINK] = { .type = NLA_U32 }, 1525 [IFLA_GRE_IFLAGS] = { .type = NLA_U16 }, 1526 [IFLA_GRE_OFLAGS] = { .type = NLA_U16 }, 1527 [IFLA_GRE_IKEY] = { .type = NLA_U32 }, 1528 [IFLA_GRE_OKEY] = { .type = NLA_U32 }, 1529 [IFLA_GRE_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) }, 1530 [IFLA_GRE_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) }, 1531 [IFLA_GRE_TTL] = { .type = NLA_U8 }, 1532 [IFLA_GRE_TOS] = { .type = NLA_U8 }, 1533 [IFLA_GRE_PMTUDISC] = { .type = NLA_U8 }, 1534 [IFLA_GRE_ENCAP_TYPE] = { .type = NLA_U16 }, 1535 [IFLA_GRE_ENCAP_FLAGS] = { .type = NLA_U16 }, 1536 [IFLA_GRE_ENCAP_SPORT] = { .type = NLA_U16 }, 1537 [IFLA_GRE_ENCAP_DPORT] = { .type = NLA_U16 }, 1538 [IFLA_GRE_COLLECT_METADATA] = { .type = NLA_FLAG }, 1539 [IFLA_GRE_IGNORE_DF] = { .type = NLA_U8 }, 1540 [IFLA_GRE_FWMARK] = { .type = NLA_U32 }, 1541 [IFLA_GRE_ERSPAN_INDEX] = { .type = NLA_U32 }, 1542 [IFLA_GRE_ERSPAN_VER] = { .type = NLA_U8 }, 1543 [IFLA_GRE_ERSPAN_DIR] = { .type = NLA_U8 }, 1544 [IFLA_GRE_ERSPAN_HWID] = { .type = NLA_U16 }, 1545 }; 1546 1547 static struct rtnl_link_ops ipgre_link_ops __read_mostly = { 1548 .kind = "gre", 1549 .maxtype = IFLA_GRE_MAX, 1550 .policy = ipgre_policy, 1551 .priv_size = sizeof(struct ip_tunnel), 1552 .setup = ipgre_tunnel_setup, 1553 .validate = ipgre_tunnel_validate, 1554 .newlink = ipgre_newlink, 1555 .changelink = ipgre_changelink, 1556 .dellink = ip_tunnel_dellink, 1557 .get_size = ipgre_get_size, 1558 .fill_info = ipgre_fill_info, 1559 .get_link_net = ip_tunnel_get_link_net, 1560 }; 1561 1562 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = { 1563 .kind = "gretap", 1564 .maxtype = IFLA_GRE_MAX, 1565 .policy = ipgre_policy, 1566 .priv_size = sizeof(struct ip_tunnel), 1567 .setup = ipgre_tap_setup, 1568 .validate = ipgre_tap_validate, 1569 .newlink = ipgre_newlink, 1570 .changelink = ipgre_changelink, 1571 .dellink = ip_tunnel_dellink, 1572 .get_size = ipgre_get_size, 1573 .fill_info = ipgre_fill_info, 1574 .get_link_net = ip_tunnel_get_link_net, 1575 }; 1576 1577 static struct rtnl_link_ops erspan_link_ops __read_mostly = { 1578 .kind = "erspan", 1579 .maxtype = IFLA_GRE_MAX, 1580 .policy = ipgre_policy, 1581 .priv_size = sizeof(struct ip_tunnel), 1582 .setup = erspan_setup, 1583 .validate = erspan_validate, 1584 .newlink = ipgre_newlink, 1585 .changelink = ipgre_changelink, 1586 .dellink = ip_tunnel_dellink, 1587 .get_size = ipgre_get_size, 1588 .fill_info = ipgre_fill_info, 1589 .get_link_net = ip_tunnel_get_link_net, 1590 }; 1591 1592 struct net_device *gretap_fb_dev_create(struct net *net, const char *name, 1593 u8 name_assign_type) 1594 { 1595 struct nlattr *tb[IFLA_MAX + 1]; 1596 struct net_device *dev; 1597 LIST_HEAD(list_kill); 1598 struct ip_tunnel *t; 1599 int err; 1600 1601 memset(&tb, 0, sizeof(tb)); 1602 1603 dev = rtnl_create_link(net, name, name_assign_type, 1604 &ipgre_tap_ops, tb); 1605 if (IS_ERR(dev)) 1606 return dev; 1607 1608 /* Configure flow based GRE device. */ 1609 t = netdev_priv(dev); 1610 t->collect_md = true; 1611 1612 err = ipgre_newlink(net, dev, tb, NULL, NULL); 1613 if (err < 0) { 1614 free_netdev(dev); 1615 return ERR_PTR(err); 1616 } 1617 1618 /* openvswitch users expect packet sizes to be unrestricted, 1619 * so set the largest MTU we can. 1620 */ 1621 err = __ip_tunnel_change_mtu(dev, IP_MAX_MTU, false); 1622 if (err) 1623 goto out; 1624 1625 err = rtnl_configure_link(dev, NULL); 1626 if (err < 0) 1627 goto out; 1628 1629 return dev; 1630 out: 1631 ip_tunnel_dellink(dev, &list_kill); 1632 unregister_netdevice_many(&list_kill); 1633 return ERR_PTR(err); 1634 } 1635 EXPORT_SYMBOL_GPL(gretap_fb_dev_create); 1636 1637 static int __net_init ipgre_tap_init_net(struct net *net) 1638 { 1639 return ip_tunnel_init_net(net, gre_tap_net_id, &ipgre_tap_ops, "gretap0"); 1640 } 1641 1642 static void __net_exit ipgre_tap_exit_batch_net(struct list_head *list_net) 1643 { 1644 ip_tunnel_delete_nets(list_net, gre_tap_net_id, &ipgre_tap_ops); 1645 } 1646 1647 static struct pernet_operations ipgre_tap_net_ops = { 1648 .init = ipgre_tap_init_net, 1649 .exit_batch = ipgre_tap_exit_batch_net, 1650 .id = &gre_tap_net_id, 1651 .size = sizeof(struct ip_tunnel_net), 1652 }; 1653 1654 static int __net_init erspan_init_net(struct net *net) 1655 { 1656 return ip_tunnel_init_net(net, erspan_net_id, 1657 &erspan_link_ops, "erspan0"); 1658 } 1659 1660 static void __net_exit erspan_exit_batch_net(struct list_head *net_list) 1661 { 1662 ip_tunnel_delete_nets(net_list, erspan_net_id, &erspan_link_ops); 1663 } 1664 1665 static struct pernet_operations erspan_net_ops = { 1666 .init = erspan_init_net, 1667 .exit_batch = erspan_exit_batch_net, 1668 .id = &erspan_net_id, 1669 .size = sizeof(struct ip_tunnel_net), 1670 }; 1671 1672 static int __init ipgre_init(void) 1673 { 1674 int err; 1675 1676 pr_info("GRE over IPv4 tunneling driver\n"); 1677 1678 err = register_pernet_device(&ipgre_net_ops); 1679 if (err < 0) 1680 return err; 1681 1682 err = register_pernet_device(&ipgre_tap_net_ops); 1683 if (err < 0) 1684 goto pnet_tap_failed; 1685 1686 err = register_pernet_device(&erspan_net_ops); 1687 if (err < 0) 1688 goto pnet_erspan_failed; 1689 1690 err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO); 1691 if (err < 0) { 1692 pr_info("%s: can't add protocol\n", __func__); 1693 goto add_proto_failed; 1694 } 1695 1696 err = rtnl_link_register(&ipgre_link_ops); 1697 if (err < 0) 1698 goto rtnl_link_failed; 1699 1700 err = rtnl_link_register(&ipgre_tap_ops); 1701 if (err < 0) 1702 goto tap_ops_failed; 1703 1704 err = rtnl_link_register(&erspan_link_ops); 1705 if (err < 0) 1706 goto erspan_link_failed; 1707 1708 return 0; 1709 1710 erspan_link_failed: 1711 rtnl_link_unregister(&ipgre_tap_ops); 1712 tap_ops_failed: 1713 rtnl_link_unregister(&ipgre_link_ops); 1714 rtnl_link_failed: 1715 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO); 1716 add_proto_failed: 1717 unregister_pernet_device(&erspan_net_ops); 1718 pnet_erspan_failed: 1719 unregister_pernet_device(&ipgre_tap_net_ops); 1720 pnet_tap_failed: 1721 unregister_pernet_device(&ipgre_net_ops); 1722 return err; 1723 } 1724 1725 static void __exit ipgre_fini(void) 1726 { 1727 rtnl_link_unregister(&ipgre_tap_ops); 1728 rtnl_link_unregister(&ipgre_link_ops); 1729 rtnl_link_unregister(&erspan_link_ops); 1730 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO); 1731 unregister_pernet_device(&ipgre_tap_net_ops); 1732 unregister_pernet_device(&ipgre_net_ops); 1733 unregister_pernet_device(&erspan_net_ops); 1734 } 1735 1736 module_init(ipgre_init); 1737 module_exit(ipgre_fini); 1738 MODULE_LICENSE("GPL"); 1739 MODULE_ALIAS_RTNL_LINK("gre"); 1740 MODULE_ALIAS_RTNL_LINK("gretap"); 1741 MODULE_ALIAS_RTNL_LINK("erspan"); 1742 MODULE_ALIAS_NETDEV("gre0"); 1743 MODULE_ALIAS_NETDEV("gretap0"); 1744 MODULE_ALIAS_NETDEV("erspan0"); 1745