1 /* 2 * Linux NET3: GRE over IP protocol decoder. 3 * 4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 * 11 */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/capability.h> 16 #include <linux/module.h> 17 #include <linux/types.h> 18 #include <linux/kernel.h> 19 #include <linux/slab.h> 20 #include <linux/uaccess.h> 21 #include <linux/skbuff.h> 22 #include <linux/netdevice.h> 23 #include <linux/in.h> 24 #include <linux/tcp.h> 25 #include <linux/udp.h> 26 #include <linux/if_arp.h> 27 #include <linux/if_vlan.h> 28 #include <linux/init.h> 29 #include <linux/in6.h> 30 #include <linux/inetdevice.h> 31 #include <linux/igmp.h> 32 #include <linux/netfilter_ipv4.h> 33 #include <linux/etherdevice.h> 34 #include <linux/if_ether.h> 35 36 #include <net/sock.h> 37 #include <net/ip.h> 38 #include <net/icmp.h> 39 #include <net/protocol.h> 40 #include <net/ip_tunnels.h> 41 #include <net/arp.h> 42 #include <net/checksum.h> 43 #include <net/dsfield.h> 44 #include <net/inet_ecn.h> 45 #include <net/xfrm.h> 46 #include <net/net_namespace.h> 47 #include <net/netns/generic.h> 48 #include <net/rtnetlink.h> 49 #include <net/gre.h> 50 #include <net/dst_metadata.h> 51 #include <net/erspan.h> 52 53 /* 54 Problems & solutions 55 -------------------- 56 57 1. The most important issue is detecting local dead loops. 58 They would cause complete host lockup in transmit, which 59 would be "resolved" by stack overflow or, if queueing is enabled, 60 with infinite looping in net_bh. 61 62 We cannot track such dead loops during route installation, 63 it is infeasible task. The most general solutions would be 64 to keep skb->encapsulation counter (sort of local ttl), 65 and silently drop packet when it expires. It is a good 66 solution, but it supposes maintaining new variable in ALL 67 skb, even if no tunneling is used. 68 69 Current solution: xmit_recursion breaks dead loops. This is a percpu 70 counter, since when we enter the first ndo_xmit(), cpu migration is 71 forbidden. We force an exit if this counter reaches RECURSION_LIMIT 72 73 2. Networking dead loops would not kill routers, but would really 74 kill network. IP hop limit plays role of "t->recursion" in this case, 75 if we copy it from packet being encapsulated to upper header. 76 It is very good solution, but it introduces two problems: 77 78 - Routing protocols, using packets with ttl=1 (OSPF, RIP2), 79 do not work over tunnels. 80 - traceroute does not work. I planned to relay ICMP from tunnel, 81 so that this problem would be solved and traceroute output 82 would even more informative. This idea appeared to be wrong: 83 only Linux complies to rfc1812 now (yes, guys, Linux is the only 84 true router now :-)), all routers (at least, in neighbourhood of mine) 85 return only 8 bytes of payload. It is the end. 86 87 Hence, if we want that OSPF worked or traceroute said something reasonable, 88 we should search for another solution. 89 90 One of them is to parse packet trying to detect inner encapsulation 91 made by our node. It is difficult or even impossible, especially, 92 taking into account fragmentation. TO be short, ttl is not solution at all. 93 94 Current solution: The solution was UNEXPECTEDLY SIMPLE. 95 We force DF flag on tunnels with preconfigured hop limit, 96 that is ALL. :-) Well, it does not remove the problem completely, 97 but exponential growth of network traffic is changed to linear 98 (branches, that exceed pmtu are pruned) and tunnel mtu 99 rapidly degrades to value <68, where looping stops. 100 Yes, it is not good if there exists a router in the loop, 101 which does not force DF, even when encapsulating packets have DF set. 102 But it is not our problem! Nobody could accuse us, we made 103 all that we could make. Even if it is your gated who injected 104 fatal route to network, even if it were you who configured 105 fatal static route: you are innocent. :-) 106 107 Alexey Kuznetsov. 108 */ 109 110 static bool log_ecn_error = true; 111 module_param(log_ecn_error, bool, 0644); 112 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN"); 113 114 static struct rtnl_link_ops ipgre_link_ops __read_mostly; 115 static int ipgre_tunnel_init(struct net_device *dev); 116 static void erspan_build_header(struct sk_buff *skb, 117 u32 id, u32 index, 118 bool truncate, bool is_ipv4); 119 120 static unsigned int ipgre_net_id __read_mostly; 121 static unsigned int gre_tap_net_id __read_mostly; 122 static unsigned int erspan_net_id __read_mostly; 123 124 static void ipgre_err(struct sk_buff *skb, u32 info, 125 const struct tnl_ptk_info *tpi) 126 { 127 128 /* All the routers (except for Linux) return only 129 8 bytes of packet payload. It means, that precise relaying of 130 ICMP in the real Internet is absolutely infeasible. 131 132 Moreover, Cisco "wise men" put GRE key to the third word 133 in GRE header. It makes impossible maintaining even soft 134 state for keyed GRE tunnels with enabled checksum. Tell 135 them "thank you". 136 137 Well, I wonder, rfc1812 was written by Cisco employee, 138 what the hell these idiots break standards established 139 by themselves??? 140 */ 141 struct net *net = dev_net(skb->dev); 142 struct ip_tunnel_net *itn; 143 const struct iphdr *iph; 144 const int type = icmp_hdr(skb)->type; 145 const int code = icmp_hdr(skb)->code; 146 unsigned int data_len = 0; 147 struct ip_tunnel *t; 148 149 switch (type) { 150 default: 151 case ICMP_PARAMETERPROB: 152 return; 153 154 case ICMP_DEST_UNREACH: 155 switch (code) { 156 case ICMP_SR_FAILED: 157 case ICMP_PORT_UNREACH: 158 /* Impossible event. */ 159 return; 160 default: 161 /* All others are translated to HOST_UNREACH. 162 rfc2003 contains "deep thoughts" about NET_UNREACH, 163 I believe they are just ether pollution. --ANK 164 */ 165 break; 166 } 167 break; 168 169 case ICMP_TIME_EXCEEDED: 170 if (code != ICMP_EXC_TTL) 171 return; 172 data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */ 173 break; 174 175 case ICMP_REDIRECT: 176 break; 177 } 178 179 if (tpi->proto == htons(ETH_P_TEB)) 180 itn = net_generic(net, gre_tap_net_id); 181 else 182 itn = net_generic(net, ipgre_net_id); 183 184 iph = (const struct iphdr *)(icmp_hdr(skb) + 1); 185 t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags, 186 iph->daddr, iph->saddr, tpi->key); 187 188 if (!t) 189 return; 190 191 #if IS_ENABLED(CONFIG_IPV6) 192 if (tpi->proto == htons(ETH_P_IPV6) && 193 !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4 + tpi->hdr_len, 194 type, data_len)) 195 return; 196 #endif 197 198 if (t->parms.iph.daddr == 0 || 199 ipv4_is_multicast(t->parms.iph.daddr)) 200 return; 201 202 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED) 203 return; 204 205 if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO)) 206 t->err_count++; 207 else 208 t->err_count = 1; 209 t->err_time = jiffies; 210 } 211 212 static void gre_err(struct sk_buff *skb, u32 info) 213 { 214 /* All the routers (except for Linux) return only 215 * 8 bytes of packet payload. It means, that precise relaying of 216 * ICMP in the real Internet is absolutely infeasible. 217 * 218 * Moreover, Cisco "wise men" put GRE key to the third word 219 * in GRE header. It makes impossible maintaining even soft 220 * state for keyed 221 * GRE tunnels with enabled checksum. Tell them "thank you". 222 * 223 * Well, I wonder, rfc1812 was written by Cisco employee, 224 * what the hell these idiots break standards established 225 * by themselves??? 226 */ 227 228 const struct iphdr *iph = (struct iphdr *)skb->data; 229 const int type = icmp_hdr(skb)->type; 230 const int code = icmp_hdr(skb)->code; 231 struct tnl_ptk_info tpi; 232 bool csum_err = false; 233 234 if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 235 iph->ihl * 4) < 0) { 236 if (!csum_err) /* ignore csum errors. */ 237 return; 238 } 239 240 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { 241 ipv4_update_pmtu(skb, dev_net(skb->dev), info, 242 skb->dev->ifindex, 0, IPPROTO_GRE, 0); 243 return; 244 } 245 if (type == ICMP_REDIRECT) { 246 ipv4_redirect(skb, dev_net(skb->dev), skb->dev->ifindex, 0, 247 IPPROTO_GRE, 0); 248 return; 249 } 250 251 ipgre_err(skb, info, &tpi); 252 } 253 254 static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, 255 int gre_hdr_len) 256 { 257 struct net *net = dev_net(skb->dev); 258 struct metadata_dst *tun_dst = NULL; 259 struct erspan_base_hdr *ershdr; 260 struct erspan_metadata *pkt_md; 261 struct ip_tunnel_net *itn; 262 struct ip_tunnel *tunnel; 263 const struct iphdr *iph; 264 struct erspan_md2 *md2; 265 int ver; 266 int len; 267 268 itn = net_generic(net, erspan_net_id); 269 len = gre_hdr_len + sizeof(*ershdr); 270 271 /* Check based hdr len */ 272 if (unlikely(!pskb_may_pull(skb, len))) 273 return PACKET_REJECT; 274 275 iph = ip_hdr(skb); 276 ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); 277 ver = ershdr->ver; 278 279 /* The original GRE header does not have key field, 280 * Use ERSPAN 10-bit session ID as key. 281 */ 282 tpi->key = cpu_to_be32(get_session_id(ershdr)); 283 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, 284 tpi->flags | TUNNEL_KEY, 285 iph->saddr, iph->daddr, tpi->key); 286 287 if (tunnel) { 288 len = gre_hdr_len + erspan_hdr_len(ver); 289 if (unlikely(!pskb_may_pull(skb, len))) 290 return PACKET_REJECT; 291 292 ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); 293 pkt_md = (struct erspan_metadata *)(ershdr + 1); 294 295 if (__iptunnel_pull_header(skb, 296 len, 297 htons(ETH_P_TEB), 298 false, false) < 0) 299 goto drop; 300 301 if (tunnel->collect_md) { 302 struct ip_tunnel_info *info; 303 struct erspan_metadata *md; 304 __be64 tun_id; 305 __be16 flags; 306 307 tpi->flags |= TUNNEL_KEY; 308 flags = tpi->flags; 309 tun_id = key32_to_tunnel_id(tpi->key); 310 311 tun_dst = ip_tun_rx_dst(skb, flags, 312 tun_id, sizeof(*md)); 313 if (!tun_dst) 314 return PACKET_REJECT; 315 316 md = ip_tunnel_info_opts(&tun_dst->u.tun_info); 317 md->version = ver; 318 md2 = &md->u.md2; 319 memcpy(md2, pkt_md, ver == 1 ? ERSPAN_V1_MDSIZE : 320 ERSPAN_V2_MDSIZE); 321 322 info = &tun_dst->u.tun_info; 323 info->key.tun_flags |= TUNNEL_ERSPAN_OPT; 324 info->options_len = sizeof(*md); 325 } 326 327 skb_reset_mac_header(skb); 328 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error); 329 return PACKET_RCVD; 330 } 331 drop: 332 kfree_skb(skb); 333 return PACKET_RCVD; 334 } 335 336 static int __ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi, 337 struct ip_tunnel_net *itn, int hdr_len, bool raw_proto) 338 { 339 struct metadata_dst *tun_dst = NULL; 340 const struct iphdr *iph; 341 struct ip_tunnel *tunnel; 342 343 iph = ip_hdr(skb); 344 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags, 345 iph->saddr, iph->daddr, tpi->key); 346 347 if (tunnel) { 348 if (__iptunnel_pull_header(skb, hdr_len, tpi->proto, 349 raw_proto, false) < 0) 350 goto drop; 351 352 if (tunnel->dev->type != ARPHRD_NONE) 353 skb_pop_mac_header(skb); 354 else 355 skb_reset_mac_header(skb); 356 if (tunnel->collect_md) { 357 __be16 flags; 358 __be64 tun_id; 359 360 flags = tpi->flags & (TUNNEL_CSUM | TUNNEL_KEY); 361 tun_id = key32_to_tunnel_id(tpi->key); 362 tun_dst = ip_tun_rx_dst(skb, flags, tun_id, 0); 363 if (!tun_dst) 364 return PACKET_REJECT; 365 } 366 367 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error); 368 return PACKET_RCVD; 369 } 370 return PACKET_NEXT; 371 372 drop: 373 kfree_skb(skb); 374 return PACKET_RCVD; 375 } 376 377 static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi, 378 int hdr_len) 379 { 380 struct net *net = dev_net(skb->dev); 381 struct ip_tunnel_net *itn; 382 int res; 383 384 if (tpi->proto == htons(ETH_P_TEB)) 385 itn = net_generic(net, gre_tap_net_id); 386 else 387 itn = net_generic(net, ipgre_net_id); 388 389 res = __ipgre_rcv(skb, tpi, itn, hdr_len, false); 390 if (res == PACKET_NEXT && tpi->proto == htons(ETH_P_TEB)) { 391 /* ipgre tunnels in collect metadata mode should receive 392 * also ETH_P_TEB traffic. 393 */ 394 itn = net_generic(net, ipgre_net_id); 395 res = __ipgre_rcv(skb, tpi, itn, hdr_len, true); 396 } 397 return res; 398 } 399 400 static int gre_rcv(struct sk_buff *skb) 401 { 402 struct tnl_ptk_info tpi; 403 bool csum_err = false; 404 int hdr_len; 405 406 #ifdef CONFIG_NET_IPGRE_BROADCAST 407 if (ipv4_is_multicast(ip_hdr(skb)->daddr)) { 408 /* Looped back packet, drop it! */ 409 if (rt_is_output_route(skb_rtable(skb))) 410 goto drop; 411 } 412 #endif 413 414 hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 0); 415 if (hdr_len < 0) 416 goto drop; 417 418 if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) || 419 tpi.proto == htons(ETH_P_ERSPAN2))) { 420 if (erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) 421 return 0; 422 goto out; 423 } 424 425 if (ipgre_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) 426 return 0; 427 428 out: 429 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); 430 drop: 431 kfree_skb(skb); 432 return 0; 433 } 434 435 static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, 436 const struct iphdr *tnl_params, 437 __be16 proto) 438 { 439 struct ip_tunnel *tunnel = netdev_priv(dev); 440 441 if (tunnel->parms.o_flags & TUNNEL_SEQ) 442 tunnel->o_seqno++; 443 444 /* Push GRE header. */ 445 gre_build_header(skb, tunnel->tun_hlen, 446 tunnel->parms.o_flags, proto, tunnel->parms.o_key, 447 htonl(tunnel->o_seqno)); 448 449 ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); 450 } 451 452 static int gre_handle_offloads(struct sk_buff *skb, bool csum) 453 { 454 return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); 455 } 456 457 static struct rtable *gre_get_rt(struct sk_buff *skb, 458 struct net_device *dev, 459 struct flowi4 *fl, 460 const struct ip_tunnel_key *key) 461 { 462 struct net *net = dev_net(dev); 463 464 memset(fl, 0, sizeof(*fl)); 465 fl->daddr = key->u.ipv4.dst; 466 fl->saddr = key->u.ipv4.src; 467 fl->flowi4_tos = RT_TOS(key->tos); 468 fl->flowi4_mark = skb->mark; 469 fl->flowi4_proto = IPPROTO_GRE; 470 471 return ip_route_output_key(net, fl); 472 } 473 474 static struct rtable *prepare_fb_xmit(struct sk_buff *skb, 475 struct net_device *dev, 476 struct flowi4 *fl, 477 int tunnel_hlen) 478 { 479 struct ip_tunnel_info *tun_info; 480 const struct ip_tunnel_key *key; 481 struct rtable *rt = NULL; 482 int min_headroom; 483 bool use_cache; 484 int err; 485 486 tun_info = skb_tunnel_info(skb); 487 key = &tun_info->key; 488 use_cache = ip_tunnel_dst_cache_usable(skb, tun_info); 489 490 if (use_cache) 491 rt = dst_cache_get_ip4(&tun_info->dst_cache, &fl->saddr); 492 if (!rt) { 493 rt = gre_get_rt(skb, dev, fl, key); 494 if (IS_ERR(rt)) 495 goto err_free_skb; 496 if (use_cache) 497 dst_cache_set_ip4(&tun_info->dst_cache, &rt->dst, 498 fl->saddr); 499 } 500 501 min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len 502 + tunnel_hlen + sizeof(struct iphdr); 503 if (skb_headroom(skb) < min_headroom || skb_header_cloned(skb)) { 504 int head_delta = SKB_DATA_ALIGN(min_headroom - 505 skb_headroom(skb) + 506 16); 507 err = pskb_expand_head(skb, max_t(int, head_delta, 0), 508 0, GFP_ATOMIC); 509 if (unlikely(err)) 510 goto err_free_rt; 511 } 512 return rt; 513 514 err_free_rt: 515 ip_rt_put(rt); 516 err_free_skb: 517 kfree_skb(skb); 518 dev->stats.tx_dropped++; 519 return NULL; 520 } 521 522 static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev, 523 __be16 proto) 524 { 525 struct ip_tunnel *tunnel = netdev_priv(dev); 526 struct ip_tunnel_info *tun_info; 527 const struct ip_tunnel_key *key; 528 struct rtable *rt = NULL; 529 struct flowi4 fl; 530 int tunnel_hlen; 531 __be16 df, flags; 532 533 tun_info = skb_tunnel_info(skb); 534 if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || 535 ip_tunnel_info_af(tun_info) != AF_INET)) 536 goto err_free_skb; 537 538 key = &tun_info->key; 539 tunnel_hlen = gre_calc_hlen(key->tun_flags); 540 541 rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen); 542 if (!rt) 543 return; 544 545 /* Push Tunnel header. */ 546 if (gre_handle_offloads(skb, !!(tun_info->key.tun_flags & TUNNEL_CSUM))) 547 goto err_free_rt; 548 549 flags = tun_info->key.tun_flags & 550 (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ); 551 gre_build_header(skb, tunnel_hlen, flags, proto, 552 tunnel_id_to_key32(tun_info->key.tun_id), 553 (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); 554 555 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; 556 557 iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE, 558 key->tos, key->ttl, df, false); 559 return; 560 561 err_free_rt: 562 ip_rt_put(rt); 563 err_free_skb: 564 kfree_skb(skb); 565 dev->stats.tx_dropped++; 566 } 567 568 static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev, 569 __be16 proto) 570 { 571 struct ip_tunnel *tunnel = netdev_priv(dev); 572 struct ip_tunnel_info *tun_info; 573 const struct ip_tunnel_key *key; 574 struct erspan_metadata *md; 575 struct rtable *rt = NULL; 576 bool truncate = false; 577 struct flowi4 fl; 578 int tunnel_hlen; 579 int version; 580 __be16 df; 581 int nhoff; 582 int thoff; 583 584 tun_info = skb_tunnel_info(skb); 585 if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || 586 ip_tunnel_info_af(tun_info) != AF_INET)) 587 goto err_free_skb; 588 589 key = &tun_info->key; 590 md = ip_tunnel_info_opts(tun_info); 591 if (!md) 592 goto err_free_rt; 593 594 /* ERSPAN has fixed 8 byte GRE header */ 595 version = md->version; 596 tunnel_hlen = 8 + erspan_hdr_len(version); 597 598 rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen); 599 if (!rt) 600 return; 601 602 if (gre_handle_offloads(skb, false)) 603 goto err_free_rt; 604 605 if (skb->len > dev->mtu + dev->hard_header_len) { 606 pskb_trim(skb, dev->mtu + dev->hard_header_len); 607 truncate = true; 608 } 609 610 nhoff = skb_network_header(skb) - skb_mac_header(skb); 611 if (skb->protocol == htons(ETH_P_IP) && 612 (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff)) 613 truncate = true; 614 615 thoff = skb_transport_header(skb) - skb_mac_header(skb); 616 if (skb->protocol == htons(ETH_P_IPV6) && 617 (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff)) 618 truncate = true; 619 620 if (version == 1) { 621 erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)), 622 ntohl(md->u.index), truncate, true); 623 } else if (version == 2) { 624 erspan_build_header_v2(skb, 625 ntohl(tunnel_id_to_key32(key->tun_id)), 626 md->u.md2.dir, 627 get_hwid(&md->u.md2), 628 truncate, true); 629 } else { 630 goto err_free_rt; 631 } 632 633 gre_build_header(skb, 8, TUNNEL_SEQ, 634 htons(ETH_P_ERSPAN), 0, htonl(tunnel->o_seqno++)); 635 636 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; 637 638 iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE, 639 key->tos, key->ttl, df, false); 640 return; 641 642 err_free_rt: 643 ip_rt_put(rt); 644 err_free_skb: 645 kfree_skb(skb); 646 dev->stats.tx_dropped++; 647 } 648 649 static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) 650 { 651 struct ip_tunnel_info *info = skb_tunnel_info(skb); 652 struct rtable *rt; 653 struct flowi4 fl4; 654 655 if (ip_tunnel_info_af(info) != AF_INET) 656 return -EINVAL; 657 658 rt = gre_get_rt(skb, dev, &fl4, &info->key); 659 if (IS_ERR(rt)) 660 return PTR_ERR(rt); 661 662 ip_rt_put(rt); 663 info->key.u.ipv4.src = fl4.saddr; 664 return 0; 665 } 666 667 static netdev_tx_t ipgre_xmit(struct sk_buff *skb, 668 struct net_device *dev) 669 { 670 struct ip_tunnel *tunnel = netdev_priv(dev); 671 const struct iphdr *tnl_params; 672 673 if (tunnel->collect_md) { 674 gre_fb_xmit(skb, dev, skb->protocol); 675 return NETDEV_TX_OK; 676 } 677 678 if (dev->header_ops) { 679 /* Need space for new headers */ 680 if (skb_cow_head(skb, dev->needed_headroom - 681 (tunnel->hlen + sizeof(struct iphdr)))) 682 goto free_skb; 683 684 tnl_params = (const struct iphdr *)skb->data; 685 686 /* Pull skb since ip_tunnel_xmit() needs skb->data pointing 687 * to gre header. 688 */ 689 skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); 690 skb_reset_mac_header(skb); 691 } else { 692 if (skb_cow_head(skb, dev->needed_headroom)) 693 goto free_skb; 694 695 tnl_params = &tunnel->parms.iph; 696 } 697 698 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM))) 699 goto free_skb; 700 701 __gre_xmit(skb, dev, tnl_params, skb->protocol); 702 return NETDEV_TX_OK; 703 704 free_skb: 705 kfree_skb(skb); 706 dev->stats.tx_dropped++; 707 return NETDEV_TX_OK; 708 } 709 710 static netdev_tx_t erspan_xmit(struct sk_buff *skb, 711 struct net_device *dev) 712 { 713 struct ip_tunnel *tunnel = netdev_priv(dev); 714 bool truncate = false; 715 716 if (tunnel->collect_md) { 717 erspan_fb_xmit(skb, dev, skb->protocol); 718 return NETDEV_TX_OK; 719 } 720 721 if (gre_handle_offloads(skb, false)) 722 goto free_skb; 723 724 if (skb_cow_head(skb, dev->needed_headroom)) 725 goto free_skb; 726 727 if (skb->len > dev->mtu + dev->hard_header_len) { 728 pskb_trim(skb, dev->mtu + dev->hard_header_len); 729 truncate = true; 730 } 731 732 /* Push ERSPAN header */ 733 if (tunnel->erspan_ver == 1) 734 erspan_build_header(skb, ntohl(tunnel->parms.o_key), 735 tunnel->index, 736 truncate, true); 737 else if (tunnel->erspan_ver == 2) 738 erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key), 739 tunnel->dir, tunnel->hwid, 740 truncate, true); 741 else 742 goto free_skb; 743 744 tunnel->parms.o_flags &= ~TUNNEL_KEY; 745 __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN)); 746 return NETDEV_TX_OK; 747 748 free_skb: 749 kfree_skb(skb); 750 dev->stats.tx_dropped++; 751 return NETDEV_TX_OK; 752 } 753 754 static netdev_tx_t gre_tap_xmit(struct sk_buff *skb, 755 struct net_device *dev) 756 { 757 struct ip_tunnel *tunnel = netdev_priv(dev); 758 759 if (tunnel->collect_md) { 760 gre_fb_xmit(skb, dev, htons(ETH_P_TEB)); 761 return NETDEV_TX_OK; 762 } 763 764 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM))) 765 goto free_skb; 766 767 if (skb_cow_head(skb, dev->needed_headroom)) 768 goto free_skb; 769 770 __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB)); 771 return NETDEV_TX_OK; 772 773 free_skb: 774 kfree_skb(skb); 775 dev->stats.tx_dropped++; 776 return NETDEV_TX_OK; 777 } 778 779 static void ipgre_link_update(struct net_device *dev, bool set_mtu) 780 { 781 struct ip_tunnel *tunnel = netdev_priv(dev); 782 int len; 783 784 len = tunnel->tun_hlen; 785 tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags); 786 len = tunnel->tun_hlen - len; 787 tunnel->hlen = tunnel->hlen + len; 788 789 dev->needed_headroom = dev->needed_headroom + len; 790 if (set_mtu) 791 dev->mtu = max_t(int, dev->mtu - len, 68); 792 793 if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) { 794 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) || 795 tunnel->encap.type == TUNNEL_ENCAP_NONE) { 796 dev->features |= NETIF_F_GSO_SOFTWARE; 797 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 798 } else { 799 dev->features &= ~NETIF_F_GSO_SOFTWARE; 800 dev->hw_features &= ~NETIF_F_GSO_SOFTWARE; 801 } 802 dev->features |= NETIF_F_LLTX; 803 } else { 804 dev->hw_features &= ~NETIF_F_GSO_SOFTWARE; 805 dev->features &= ~(NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE); 806 } 807 } 808 809 static int ipgre_tunnel_ioctl(struct net_device *dev, 810 struct ifreq *ifr, int cmd) 811 { 812 struct ip_tunnel_parm p; 813 int err; 814 815 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) 816 return -EFAULT; 817 818 if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) { 819 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE || 820 p.iph.ihl != 5 || (p.iph.frag_off & htons(~IP_DF)) || 821 ((p.i_flags | p.o_flags) & (GRE_VERSION | GRE_ROUTING))) 822 return -EINVAL; 823 } 824 825 p.i_flags = gre_flags_to_tnl_flags(p.i_flags); 826 p.o_flags = gre_flags_to_tnl_flags(p.o_flags); 827 828 err = ip_tunnel_ioctl(dev, &p, cmd); 829 if (err) 830 return err; 831 832 if (cmd == SIOCCHGTUNNEL) { 833 struct ip_tunnel *t = netdev_priv(dev); 834 835 t->parms.i_flags = p.i_flags; 836 t->parms.o_flags = p.o_flags; 837 838 if (strcmp(dev->rtnl_link_ops->kind, "erspan")) 839 ipgre_link_update(dev, true); 840 } 841 842 p.i_flags = gre_tnl_flags_to_gre_flags(p.i_flags); 843 p.o_flags = gre_tnl_flags_to_gre_flags(p.o_flags); 844 845 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p))) 846 return -EFAULT; 847 848 return 0; 849 } 850 851 /* Nice toy. Unfortunately, useless in real life :-) 852 It allows to construct virtual multiprotocol broadcast "LAN" 853 over the Internet, provided multicast routing is tuned. 854 855 856 I have no idea was this bicycle invented before me, 857 so that I had to set ARPHRD_IPGRE to a random value. 858 I have an impression, that Cisco could make something similar, 859 but this feature is apparently missing in IOS<=11.2(8). 860 861 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks 862 with broadcast 224.66.66.66. If you have access to mbone, play with me :-) 863 864 ping -t 255 224.66.66.66 865 866 If nobody answers, mbone does not work. 867 868 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255 869 ip addr add 10.66.66.<somewhat>/24 dev Universe 870 ifconfig Universe up 871 ifconfig Universe add fe80::<Your_real_addr>/10 872 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96 873 ftp 10.66.66.66 874 ... 875 ftp fec0:6666:6666::193.233.7.65 876 ... 877 */ 878 static int ipgre_header(struct sk_buff *skb, struct net_device *dev, 879 unsigned short type, 880 const void *daddr, const void *saddr, unsigned int len) 881 { 882 struct ip_tunnel *t = netdev_priv(dev); 883 struct iphdr *iph; 884 struct gre_base_hdr *greh; 885 886 iph = skb_push(skb, t->hlen + sizeof(*iph)); 887 greh = (struct gre_base_hdr *)(iph+1); 888 greh->flags = gre_tnl_flags_to_gre_flags(t->parms.o_flags); 889 greh->protocol = htons(type); 890 891 memcpy(iph, &t->parms.iph, sizeof(struct iphdr)); 892 893 /* Set the source hardware address. */ 894 if (saddr) 895 memcpy(&iph->saddr, saddr, 4); 896 if (daddr) 897 memcpy(&iph->daddr, daddr, 4); 898 if (iph->daddr) 899 return t->hlen + sizeof(*iph); 900 901 return -(t->hlen + sizeof(*iph)); 902 } 903 904 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr) 905 { 906 const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb); 907 memcpy(haddr, &iph->saddr, 4); 908 return 4; 909 } 910 911 static const struct header_ops ipgre_header_ops = { 912 .create = ipgre_header, 913 .parse = ipgre_header_parse, 914 }; 915 916 #ifdef CONFIG_NET_IPGRE_BROADCAST 917 static int ipgre_open(struct net_device *dev) 918 { 919 struct ip_tunnel *t = netdev_priv(dev); 920 921 if (ipv4_is_multicast(t->parms.iph.daddr)) { 922 struct flowi4 fl4; 923 struct rtable *rt; 924 925 rt = ip_route_output_gre(t->net, &fl4, 926 t->parms.iph.daddr, 927 t->parms.iph.saddr, 928 t->parms.o_key, 929 RT_TOS(t->parms.iph.tos), 930 t->parms.link); 931 if (IS_ERR(rt)) 932 return -EADDRNOTAVAIL; 933 dev = rt->dst.dev; 934 ip_rt_put(rt); 935 if (!__in_dev_get_rtnl(dev)) 936 return -EADDRNOTAVAIL; 937 t->mlink = dev->ifindex; 938 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr); 939 } 940 return 0; 941 } 942 943 static int ipgre_close(struct net_device *dev) 944 { 945 struct ip_tunnel *t = netdev_priv(dev); 946 947 if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) { 948 struct in_device *in_dev; 949 in_dev = inetdev_by_index(t->net, t->mlink); 950 if (in_dev) 951 ip_mc_dec_group(in_dev, t->parms.iph.daddr); 952 } 953 return 0; 954 } 955 #endif 956 957 static const struct net_device_ops ipgre_netdev_ops = { 958 .ndo_init = ipgre_tunnel_init, 959 .ndo_uninit = ip_tunnel_uninit, 960 #ifdef CONFIG_NET_IPGRE_BROADCAST 961 .ndo_open = ipgre_open, 962 .ndo_stop = ipgre_close, 963 #endif 964 .ndo_start_xmit = ipgre_xmit, 965 .ndo_do_ioctl = ipgre_tunnel_ioctl, 966 .ndo_change_mtu = ip_tunnel_change_mtu, 967 .ndo_get_stats64 = ip_tunnel_get_stats64, 968 .ndo_get_iflink = ip_tunnel_get_iflink, 969 }; 970 971 #define GRE_FEATURES (NETIF_F_SG | \ 972 NETIF_F_FRAGLIST | \ 973 NETIF_F_HIGHDMA | \ 974 NETIF_F_HW_CSUM) 975 976 static void ipgre_tunnel_setup(struct net_device *dev) 977 { 978 dev->netdev_ops = &ipgre_netdev_ops; 979 dev->type = ARPHRD_IPGRE; 980 ip_tunnel_setup(dev, ipgre_net_id); 981 } 982 983 static void __gre_tunnel_init(struct net_device *dev) 984 { 985 struct ip_tunnel *tunnel; 986 int t_hlen; 987 988 tunnel = netdev_priv(dev); 989 tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags); 990 tunnel->parms.iph.protocol = IPPROTO_GRE; 991 992 tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen; 993 994 t_hlen = tunnel->hlen + sizeof(struct iphdr); 995 996 dev->features |= GRE_FEATURES; 997 dev->hw_features |= GRE_FEATURES; 998 999 if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) { 1000 /* TCP offload with GRE SEQ is not supported, nor 1001 * can we support 2 levels of outer headers requiring 1002 * an update. 1003 */ 1004 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) || 1005 (tunnel->encap.type == TUNNEL_ENCAP_NONE)) { 1006 dev->features |= NETIF_F_GSO_SOFTWARE; 1007 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 1008 } 1009 1010 /* Can use a lockless transmit, unless we generate 1011 * output sequences 1012 */ 1013 dev->features |= NETIF_F_LLTX; 1014 } 1015 } 1016 1017 static int ipgre_tunnel_init(struct net_device *dev) 1018 { 1019 struct ip_tunnel *tunnel = netdev_priv(dev); 1020 struct iphdr *iph = &tunnel->parms.iph; 1021 1022 __gre_tunnel_init(dev); 1023 1024 memcpy(dev->dev_addr, &iph->saddr, 4); 1025 memcpy(dev->broadcast, &iph->daddr, 4); 1026 1027 dev->flags = IFF_NOARP; 1028 netif_keep_dst(dev); 1029 dev->addr_len = 4; 1030 1031 if (iph->daddr && !tunnel->collect_md) { 1032 #ifdef CONFIG_NET_IPGRE_BROADCAST 1033 if (ipv4_is_multicast(iph->daddr)) { 1034 if (!iph->saddr) 1035 return -EINVAL; 1036 dev->flags = IFF_BROADCAST; 1037 dev->header_ops = &ipgre_header_ops; 1038 } 1039 #endif 1040 } else if (!tunnel->collect_md) { 1041 dev->header_ops = &ipgre_header_ops; 1042 } 1043 1044 return ip_tunnel_init(dev); 1045 } 1046 1047 static const struct gre_protocol ipgre_protocol = { 1048 .handler = gre_rcv, 1049 .err_handler = gre_err, 1050 }; 1051 1052 static int __net_init ipgre_init_net(struct net *net) 1053 { 1054 return ip_tunnel_init_net(net, ipgre_net_id, &ipgre_link_ops, NULL); 1055 } 1056 1057 static void __net_exit ipgre_exit_batch_net(struct list_head *list_net) 1058 { 1059 ip_tunnel_delete_nets(list_net, ipgre_net_id, &ipgre_link_ops); 1060 } 1061 1062 static struct pernet_operations ipgre_net_ops = { 1063 .init = ipgre_init_net, 1064 .exit_batch = ipgre_exit_batch_net, 1065 .id = &ipgre_net_id, 1066 .size = sizeof(struct ip_tunnel_net), 1067 }; 1068 1069 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[], 1070 struct netlink_ext_ack *extack) 1071 { 1072 __be16 flags; 1073 1074 if (!data) 1075 return 0; 1076 1077 flags = 0; 1078 if (data[IFLA_GRE_IFLAGS]) 1079 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]); 1080 if (data[IFLA_GRE_OFLAGS]) 1081 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]); 1082 if (flags & (GRE_VERSION|GRE_ROUTING)) 1083 return -EINVAL; 1084 1085 if (data[IFLA_GRE_COLLECT_METADATA] && 1086 data[IFLA_GRE_ENCAP_TYPE] && 1087 nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE) 1088 return -EINVAL; 1089 1090 return 0; 1091 } 1092 1093 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[], 1094 struct netlink_ext_ack *extack) 1095 { 1096 __be32 daddr; 1097 1098 if (tb[IFLA_ADDRESS]) { 1099 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) 1100 return -EINVAL; 1101 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) 1102 return -EADDRNOTAVAIL; 1103 } 1104 1105 if (!data) 1106 goto out; 1107 1108 if (data[IFLA_GRE_REMOTE]) { 1109 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4); 1110 if (!daddr) 1111 return -EINVAL; 1112 } 1113 1114 out: 1115 return ipgre_tunnel_validate(tb, data, extack); 1116 } 1117 1118 static int erspan_validate(struct nlattr *tb[], struct nlattr *data[], 1119 struct netlink_ext_ack *extack) 1120 { 1121 __be16 flags = 0; 1122 int ret; 1123 1124 if (!data) 1125 return 0; 1126 1127 ret = ipgre_tap_validate(tb, data, extack); 1128 if (ret) 1129 return ret; 1130 1131 /* ERSPAN should only have GRE sequence and key flag */ 1132 if (data[IFLA_GRE_OFLAGS]) 1133 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]); 1134 if (data[IFLA_GRE_IFLAGS]) 1135 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]); 1136 if (!data[IFLA_GRE_COLLECT_METADATA] && 1137 flags != (GRE_SEQ | GRE_KEY)) 1138 return -EINVAL; 1139 1140 /* ERSPAN Session ID only has 10-bit. Since we reuse 1141 * 32-bit key field as ID, check it's range. 1142 */ 1143 if (data[IFLA_GRE_IKEY] && 1144 (ntohl(nla_get_be32(data[IFLA_GRE_IKEY])) & ~ID_MASK)) 1145 return -EINVAL; 1146 1147 if (data[IFLA_GRE_OKEY] && 1148 (ntohl(nla_get_be32(data[IFLA_GRE_OKEY])) & ~ID_MASK)) 1149 return -EINVAL; 1150 1151 return 0; 1152 } 1153 1154 static int ipgre_netlink_parms(struct net_device *dev, 1155 struct nlattr *data[], 1156 struct nlattr *tb[], 1157 struct ip_tunnel_parm *parms, 1158 __u32 *fwmark) 1159 { 1160 struct ip_tunnel *t = netdev_priv(dev); 1161 1162 memset(parms, 0, sizeof(*parms)); 1163 1164 parms->iph.protocol = IPPROTO_GRE; 1165 1166 if (!data) 1167 return 0; 1168 1169 if (data[IFLA_GRE_LINK]) 1170 parms->link = nla_get_u32(data[IFLA_GRE_LINK]); 1171 1172 if (data[IFLA_GRE_IFLAGS]) 1173 parms->i_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_IFLAGS])); 1174 1175 if (data[IFLA_GRE_OFLAGS]) 1176 parms->o_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_OFLAGS])); 1177 1178 if (data[IFLA_GRE_IKEY]) 1179 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]); 1180 1181 if (data[IFLA_GRE_OKEY]) 1182 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]); 1183 1184 if (data[IFLA_GRE_LOCAL]) 1185 parms->iph.saddr = nla_get_in_addr(data[IFLA_GRE_LOCAL]); 1186 1187 if (data[IFLA_GRE_REMOTE]) 1188 parms->iph.daddr = nla_get_in_addr(data[IFLA_GRE_REMOTE]); 1189 1190 if (data[IFLA_GRE_TTL]) 1191 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]); 1192 1193 if (data[IFLA_GRE_TOS]) 1194 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]); 1195 1196 if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC])) { 1197 if (t->ignore_df) 1198 return -EINVAL; 1199 parms->iph.frag_off = htons(IP_DF); 1200 } 1201 1202 if (data[IFLA_GRE_COLLECT_METADATA]) { 1203 t->collect_md = true; 1204 if (dev->type == ARPHRD_IPGRE) 1205 dev->type = ARPHRD_NONE; 1206 } 1207 1208 if (data[IFLA_GRE_IGNORE_DF]) { 1209 if (nla_get_u8(data[IFLA_GRE_IGNORE_DF]) 1210 && (parms->iph.frag_off & htons(IP_DF))) 1211 return -EINVAL; 1212 t->ignore_df = !!nla_get_u8(data[IFLA_GRE_IGNORE_DF]); 1213 } 1214 1215 if (data[IFLA_GRE_FWMARK]) 1216 *fwmark = nla_get_u32(data[IFLA_GRE_FWMARK]); 1217 1218 if (data[IFLA_GRE_ERSPAN_VER]) { 1219 t->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]); 1220 1221 if (t->erspan_ver != 1 && t->erspan_ver != 2) 1222 return -EINVAL; 1223 } 1224 1225 if (t->erspan_ver == 1) { 1226 if (data[IFLA_GRE_ERSPAN_INDEX]) { 1227 t->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]); 1228 if (t->index & ~INDEX_MASK) 1229 return -EINVAL; 1230 } 1231 } else if (t->erspan_ver == 2) { 1232 if (data[IFLA_GRE_ERSPAN_DIR]) { 1233 t->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]); 1234 if (t->dir & ~(DIR_MASK >> DIR_OFFSET)) 1235 return -EINVAL; 1236 } 1237 if (data[IFLA_GRE_ERSPAN_HWID]) { 1238 t->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]); 1239 if (t->hwid & ~(HWID_MASK >> HWID_OFFSET)) 1240 return -EINVAL; 1241 } 1242 } 1243 1244 return 0; 1245 } 1246 1247 /* This function returns true when ENCAP attributes are present in the nl msg */ 1248 static bool ipgre_netlink_encap_parms(struct nlattr *data[], 1249 struct ip_tunnel_encap *ipencap) 1250 { 1251 bool ret = false; 1252 1253 memset(ipencap, 0, sizeof(*ipencap)); 1254 1255 if (!data) 1256 return ret; 1257 1258 if (data[IFLA_GRE_ENCAP_TYPE]) { 1259 ret = true; 1260 ipencap->type = nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]); 1261 } 1262 1263 if (data[IFLA_GRE_ENCAP_FLAGS]) { 1264 ret = true; 1265 ipencap->flags = nla_get_u16(data[IFLA_GRE_ENCAP_FLAGS]); 1266 } 1267 1268 if (data[IFLA_GRE_ENCAP_SPORT]) { 1269 ret = true; 1270 ipencap->sport = nla_get_be16(data[IFLA_GRE_ENCAP_SPORT]); 1271 } 1272 1273 if (data[IFLA_GRE_ENCAP_DPORT]) { 1274 ret = true; 1275 ipencap->dport = nla_get_be16(data[IFLA_GRE_ENCAP_DPORT]); 1276 } 1277 1278 return ret; 1279 } 1280 1281 static int gre_tap_init(struct net_device *dev) 1282 { 1283 __gre_tunnel_init(dev); 1284 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1285 netif_keep_dst(dev); 1286 1287 return ip_tunnel_init(dev); 1288 } 1289 1290 static const struct net_device_ops gre_tap_netdev_ops = { 1291 .ndo_init = gre_tap_init, 1292 .ndo_uninit = ip_tunnel_uninit, 1293 .ndo_start_xmit = gre_tap_xmit, 1294 .ndo_set_mac_address = eth_mac_addr, 1295 .ndo_validate_addr = eth_validate_addr, 1296 .ndo_change_mtu = ip_tunnel_change_mtu, 1297 .ndo_get_stats64 = ip_tunnel_get_stats64, 1298 .ndo_get_iflink = ip_tunnel_get_iflink, 1299 .ndo_fill_metadata_dst = gre_fill_metadata_dst, 1300 }; 1301 1302 static int erspan_tunnel_init(struct net_device *dev) 1303 { 1304 struct ip_tunnel *tunnel = netdev_priv(dev); 1305 int t_hlen; 1306 1307 tunnel->tun_hlen = 8; 1308 tunnel->parms.iph.protocol = IPPROTO_GRE; 1309 tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen + 1310 erspan_hdr_len(tunnel->erspan_ver); 1311 t_hlen = tunnel->hlen + sizeof(struct iphdr); 1312 1313 dev->features |= GRE_FEATURES; 1314 dev->hw_features |= GRE_FEATURES; 1315 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1316 netif_keep_dst(dev); 1317 1318 return ip_tunnel_init(dev); 1319 } 1320 1321 static const struct net_device_ops erspan_netdev_ops = { 1322 .ndo_init = erspan_tunnel_init, 1323 .ndo_uninit = ip_tunnel_uninit, 1324 .ndo_start_xmit = erspan_xmit, 1325 .ndo_set_mac_address = eth_mac_addr, 1326 .ndo_validate_addr = eth_validate_addr, 1327 .ndo_change_mtu = ip_tunnel_change_mtu, 1328 .ndo_get_stats64 = ip_tunnel_get_stats64, 1329 .ndo_get_iflink = ip_tunnel_get_iflink, 1330 .ndo_fill_metadata_dst = gre_fill_metadata_dst, 1331 }; 1332 1333 static void ipgre_tap_setup(struct net_device *dev) 1334 { 1335 ether_setup(dev); 1336 dev->max_mtu = 0; 1337 dev->netdev_ops = &gre_tap_netdev_ops; 1338 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 1339 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1340 ip_tunnel_setup(dev, gre_tap_net_id); 1341 } 1342 1343 bool is_gretap_dev(const struct net_device *dev) 1344 { 1345 return dev->netdev_ops == &gre_tap_netdev_ops; 1346 } 1347 EXPORT_SYMBOL_GPL(is_gretap_dev); 1348 1349 static int ipgre_newlink(struct net *src_net, struct net_device *dev, 1350 struct nlattr *tb[], struct nlattr *data[], 1351 struct netlink_ext_ack *extack) 1352 { 1353 struct ip_tunnel_parm p; 1354 struct ip_tunnel_encap ipencap; 1355 __u32 fwmark = 0; 1356 int err; 1357 1358 if (ipgre_netlink_encap_parms(data, &ipencap)) { 1359 struct ip_tunnel *t = netdev_priv(dev); 1360 err = ip_tunnel_encap_setup(t, &ipencap); 1361 1362 if (err < 0) 1363 return err; 1364 } 1365 1366 err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark); 1367 if (err < 0) 1368 return err; 1369 return ip_tunnel_newlink(dev, tb, &p, fwmark); 1370 } 1371 1372 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[], 1373 struct nlattr *data[], 1374 struct netlink_ext_ack *extack) 1375 { 1376 struct ip_tunnel *t = netdev_priv(dev); 1377 struct ip_tunnel_encap ipencap; 1378 __u32 fwmark = t->fwmark; 1379 struct ip_tunnel_parm p; 1380 int err; 1381 1382 if (ipgre_netlink_encap_parms(data, &ipencap)) { 1383 err = ip_tunnel_encap_setup(t, &ipencap); 1384 1385 if (err < 0) 1386 return err; 1387 } 1388 1389 err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark); 1390 if (err < 0) 1391 return err; 1392 1393 err = ip_tunnel_changelink(dev, tb, &p, fwmark); 1394 if (err < 0) 1395 return err; 1396 1397 t->parms.i_flags = p.i_flags; 1398 t->parms.o_flags = p.o_flags; 1399 1400 if (strcmp(dev->rtnl_link_ops->kind, "erspan")) 1401 ipgre_link_update(dev, !tb[IFLA_MTU]); 1402 1403 return 0; 1404 } 1405 1406 static size_t ipgre_get_size(const struct net_device *dev) 1407 { 1408 return 1409 /* IFLA_GRE_LINK */ 1410 nla_total_size(4) + 1411 /* IFLA_GRE_IFLAGS */ 1412 nla_total_size(2) + 1413 /* IFLA_GRE_OFLAGS */ 1414 nla_total_size(2) + 1415 /* IFLA_GRE_IKEY */ 1416 nla_total_size(4) + 1417 /* IFLA_GRE_OKEY */ 1418 nla_total_size(4) + 1419 /* IFLA_GRE_LOCAL */ 1420 nla_total_size(4) + 1421 /* IFLA_GRE_REMOTE */ 1422 nla_total_size(4) + 1423 /* IFLA_GRE_TTL */ 1424 nla_total_size(1) + 1425 /* IFLA_GRE_TOS */ 1426 nla_total_size(1) + 1427 /* IFLA_GRE_PMTUDISC */ 1428 nla_total_size(1) + 1429 /* IFLA_GRE_ENCAP_TYPE */ 1430 nla_total_size(2) + 1431 /* IFLA_GRE_ENCAP_FLAGS */ 1432 nla_total_size(2) + 1433 /* IFLA_GRE_ENCAP_SPORT */ 1434 nla_total_size(2) + 1435 /* IFLA_GRE_ENCAP_DPORT */ 1436 nla_total_size(2) + 1437 /* IFLA_GRE_COLLECT_METADATA */ 1438 nla_total_size(0) + 1439 /* IFLA_GRE_IGNORE_DF */ 1440 nla_total_size(1) + 1441 /* IFLA_GRE_FWMARK */ 1442 nla_total_size(4) + 1443 /* IFLA_GRE_ERSPAN_INDEX */ 1444 nla_total_size(4) + 1445 /* IFLA_GRE_ERSPAN_VER */ 1446 nla_total_size(1) + 1447 /* IFLA_GRE_ERSPAN_DIR */ 1448 nla_total_size(1) + 1449 /* IFLA_GRE_ERSPAN_HWID */ 1450 nla_total_size(2) + 1451 0; 1452 } 1453 1454 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev) 1455 { 1456 struct ip_tunnel *t = netdev_priv(dev); 1457 struct ip_tunnel_parm *p = &t->parms; 1458 1459 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) || 1460 nla_put_be16(skb, IFLA_GRE_IFLAGS, 1461 gre_tnl_flags_to_gre_flags(p->i_flags)) || 1462 nla_put_be16(skb, IFLA_GRE_OFLAGS, 1463 gre_tnl_flags_to_gre_flags(p->o_flags)) || 1464 nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) || 1465 nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) || 1466 nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) || 1467 nla_put_in_addr(skb, IFLA_GRE_REMOTE, p->iph.daddr) || 1468 nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) || 1469 nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) || 1470 nla_put_u8(skb, IFLA_GRE_PMTUDISC, 1471 !!(p->iph.frag_off & htons(IP_DF))) || 1472 nla_put_u32(skb, IFLA_GRE_FWMARK, t->fwmark)) 1473 goto nla_put_failure; 1474 1475 if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE, 1476 t->encap.type) || 1477 nla_put_be16(skb, IFLA_GRE_ENCAP_SPORT, 1478 t->encap.sport) || 1479 nla_put_be16(skb, IFLA_GRE_ENCAP_DPORT, 1480 t->encap.dport) || 1481 nla_put_u16(skb, IFLA_GRE_ENCAP_FLAGS, 1482 t->encap.flags)) 1483 goto nla_put_failure; 1484 1485 if (nla_put_u8(skb, IFLA_GRE_IGNORE_DF, t->ignore_df)) 1486 goto nla_put_failure; 1487 1488 if (t->collect_md) { 1489 if (nla_put_flag(skb, IFLA_GRE_COLLECT_METADATA)) 1490 goto nla_put_failure; 1491 } 1492 1493 if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver)) 1494 goto nla_put_failure; 1495 1496 if (t->erspan_ver == 1) { 1497 if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index)) 1498 goto nla_put_failure; 1499 } else if (t->erspan_ver == 2) { 1500 if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir)) 1501 goto nla_put_failure; 1502 if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid)) 1503 goto nla_put_failure; 1504 } 1505 1506 return 0; 1507 1508 nla_put_failure: 1509 return -EMSGSIZE; 1510 } 1511 1512 static void erspan_setup(struct net_device *dev) 1513 { 1514 ether_setup(dev); 1515 dev->netdev_ops = &erspan_netdev_ops; 1516 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 1517 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1518 ip_tunnel_setup(dev, erspan_net_id); 1519 } 1520 1521 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = { 1522 [IFLA_GRE_LINK] = { .type = NLA_U32 }, 1523 [IFLA_GRE_IFLAGS] = { .type = NLA_U16 }, 1524 [IFLA_GRE_OFLAGS] = { .type = NLA_U16 }, 1525 [IFLA_GRE_IKEY] = { .type = NLA_U32 }, 1526 [IFLA_GRE_OKEY] = { .type = NLA_U32 }, 1527 [IFLA_GRE_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) }, 1528 [IFLA_GRE_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) }, 1529 [IFLA_GRE_TTL] = { .type = NLA_U8 }, 1530 [IFLA_GRE_TOS] = { .type = NLA_U8 }, 1531 [IFLA_GRE_PMTUDISC] = { .type = NLA_U8 }, 1532 [IFLA_GRE_ENCAP_TYPE] = { .type = NLA_U16 }, 1533 [IFLA_GRE_ENCAP_FLAGS] = { .type = NLA_U16 }, 1534 [IFLA_GRE_ENCAP_SPORT] = { .type = NLA_U16 }, 1535 [IFLA_GRE_ENCAP_DPORT] = { .type = NLA_U16 }, 1536 [IFLA_GRE_COLLECT_METADATA] = { .type = NLA_FLAG }, 1537 [IFLA_GRE_IGNORE_DF] = { .type = NLA_U8 }, 1538 [IFLA_GRE_FWMARK] = { .type = NLA_U32 }, 1539 [IFLA_GRE_ERSPAN_INDEX] = { .type = NLA_U32 }, 1540 [IFLA_GRE_ERSPAN_VER] = { .type = NLA_U8 }, 1541 [IFLA_GRE_ERSPAN_DIR] = { .type = NLA_U8 }, 1542 [IFLA_GRE_ERSPAN_HWID] = { .type = NLA_U16 }, 1543 }; 1544 1545 static struct rtnl_link_ops ipgre_link_ops __read_mostly = { 1546 .kind = "gre", 1547 .maxtype = IFLA_GRE_MAX, 1548 .policy = ipgre_policy, 1549 .priv_size = sizeof(struct ip_tunnel), 1550 .setup = ipgre_tunnel_setup, 1551 .validate = ipgre_tunnel_validate, 1552 .newlink = ipgre_newlink, 1553 .changelink = ipgre_changelink, 1554 .dellink = ip_tunnel_dellink, 1555 .get_size = ipgre_get_size, 1556 .fill_info = ipgre_fill_info, 1557 .get_link_net = ip_tunnel_get_link_net, 1558 }; 1559 1560 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = { 1561 .kind = "gretap", 1562 .maxtype = IFLA_GRE_MAX, 1563 .policy = ipgre_policy, 1564 .priv_size = sizeof(struct ip_tunnel), 1565 .setup = ipgre_tap_setup, 1566 .validate = ipgre_tap_validate, 1567 .newlink = ipgre_newlink, 1568 .changelink = ipgre_changelink, 1569 .dellink = ip_tunnel_dellink, 1570 .get_size = ipgre_get_size, 1571 .fill_info = ipgre_fill_info, 1572 .get_link_net = ip_tunnel_get_link_net, 1573 }; 1574 1575 static struct rtnl_link_ops erspan_link_ops __read_mostly = { 1576 .kind = "erspan", 1577 .maxtype = IFLA_GRE_MAX, 1578 .policy = ipgre_policy, 1579 .priv_size = sizeof(struct ip_tunnel), 1580 .setup = erspan_setup, 1581 .validate = erspan_validate, 1582 .newlink = ipgre_newlink, 1583 .changelink = ipgre_changelink, 1584 .dellink = ip_tunnel_dellink, 1585 .get_size = ipgre_get_size, 1586 .fill_info = ipgre_fill_info, 1587 .get_link_net = ip_tunnel_get_link_net, 1588 }; 1589 1590 struct net_device *gretap_fb_dev_create(struct net *net, const char *name, 1591 u8 name_assign_type) 1592 { 1593 struct nlattr *tb[IFLA_MAX + 1]; 1594 struct net_device *dev; 1595 LIST_HEAD(list_kill); 1596 struct ip_tunnel *t; 1597 int err; 1598 1599 memset(&tb, 0, sizeof(tb)); 1600 1601 dev = rtnl_create_link(net, name, name_assign_type, 1602 &ipgre_tap_ops, tb); 1603 if (IS_ERR(dev)) 1604 return dev; 1605 1606 /* Configure flow based GRE device. */ 1607 t = netdev_priv(dev); 1608 t->collect_md = true; 1609 1610 err = ipgre_newlink(net, dev, tb, NULL, NULL); 1611 if (err < 0) { 1612 free_netdev(dev); 1613 return ERR_PTR(err); 1614 } 1615 1616 /* openvswitch users expect packet sizes to be unrestricted, 1617 * so set the largest MTU we can. 1618 */ 1619 err = __ip_tunnel_change_mtu(dev, IP_MAX_MTU, false); 1620 if (err) 1621 goto out; 1622 1623 err = rtnl_configure_link(dev, NULL); 1624 if (err < 0) 1625 goto out; 1626 1627 return dev; 1628 out: 1629 ip_tunnel_dellink(dev, &list_kill); 1630 unregister_netdevice_many(&list_kill); 1631 return ERR_PTR(err); 1632 } 1633 EXPORT_SYMBOL_GPL(gretap_fb_dev_create); 1634 1635 static int __net_init ipgre_tap_init_net(struct net *net) 1636 { 1637 return ip_tunnel_init_net(net, gre_tap_net_id, &ipgre_tap_ops, "gretap0"); 1638 } 1639 1640 static void __net_exit ipgre_tap_exit_batch_net(struct list_head *list_net) 1641 { 1642 ip_tunnel_delete_nets(list_net, gre_tap_net_id, &ipgre_tap_ops); 1643 } 1644 1645 static struct pernet_operations ipgre_tap_net_ops = { 1646 .init = ipgre_tap_init_net, 1647 .exit_batch = ipgre_tap_exit_batch_net, 1648 .id = &gre_tap_net_id, 1649 .size = sizeof(struct ip_tunnel_net), 1650 }; 1651 1652 static int __net_init erspan_init_net(struct net *net) 1653 { 1654 return ip_tunnel_init_net(net, erspan_net_id, 1655 &erspan_link_ops, "erspan0"); 1656 } 1657 1658 static void __net_exit erspan_exit_batch_net(struct list_head *net_list) 1659 { 1660 ip_tunnel_delete_nets(net_list, erspan_net_id, &erspan_link_ops); 1661 } 1662 1663 static struct pernet_operations erspan_net_ops = { 1664 .init = erspan_init_net, 1665 .exit_batch = erspan_exit_batch_net, 1666 .id = &erspan_net_id, 1667 .size = sizeof(struct ip_tunnel_net), 1668 }; 1669 1670 static int __init ipgre_init(void) 1671 { 1672 int err; 1673 1674 pr_info("GRE over IPv4 tunneling driver\n"); 1675 1676 err = register_pernet_device(&ipgre_net_ops); 1677 if (err < 0) 1678 return err; 1679 1680 err = register_pernet_device(&ipgre_tap_net_ops); 1681 if (err < 0) 1682 goto pnet_tap_failed; 1683 1684 err = register_pernet_device(&erspan_net_ops); 1685 if (err < 0) 1686 goto pnet_erspan_failed; 1687 1688 err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO); 1689 if (err < 0) { 1690 pr_info("%s: can't add protocol\n", __func__); 1691 goto add_proto_failed; 1692 } 1693 1694 err = rtnl_link_register(&ipgre_link_ops); 1695 if (err < 0) 1696 goto rtnl_link_failed; 1697 1698 err = rtnl_link_register(&ipgre_tap_ops); 1699 if (err < 0) 1700 goto tap_ops_failed; 1701 1702 err = rtnl_link_register(&erspan_link_ops); 1703 if (err < 0) 1704 goto erspan_link_failed; 1705 1706 return 0; 1707 1708 erspan_link_failed: 1709 rtnl_link_unregister(&ipgre_tap_ops); 1710 tap_ops_failed: 1711 rtnl_link_unregister(&ipgre_link_ops); 1712 rtnl_link_failed: 1713 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO); 1714 add_proto_failed: 1715 unregister_pernet_device(&erspan_net_ops); 1716 pnet_erspan_failed: 1717 unregister_pernet_device(&ipgre_tap_net_ops); 1718 pnet_tap_failed: 1719 unregister_pernet_device(&ipgre_net_ops); 1720 return err; 1721 } 1722 1723 static void __exit ipgre_fini(void) 1724 { 1725 rtnl_link_unregister(&ipgre_tap_ops); 1726 rtnl_link_unregister(&ipgre_link_ops); 1727 rtnl_link_unregister(&erspan_link_ops); 1728 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO); 1729 unregister_pernet_device(&ipgre_tap_net_ops); 1730 unregister_pernet_device(&ipgre_net_ops); 1731 unregister_pernet_device(&erspan_net_ops); 1732 } 1733 1734 module_init(ipgre_init); 1735 module_exit(ipgre_fini); 1736 MODULE_LICENSE("GPL"); 1737 MODULE_ALIAS_RTNL_LINK("gre"); 1738 MODULE_ALIAS_RTNL_LINK("gretap"); 1739 MODULE_ALIAS_RTNL_LINK("erspan"); 1740 MODULE_ALIAS_NETDEV("gre0"); 1741 MODULE_ALIAS_NETDEV("gretap0"); 1742 MODULE_ALIAS_NETDEV("erspan0"); 1743