xref: /openbmc/linux/net/ipv4/ipip.c (revision 384740dc)
1 /*
2  *	Linux NET3:	IP/IP protocol decoder.
3  *
4  *	Authors:
5  *		Sam Lantinga (slouken@cs.ucdavis.edu)  02/01/95
6  *
7  *	Fixes:
8  *		Alan Cox	:	Merged and made usable non modular (its so tiny its silly as
9  *					a module taking up 2 pages).
10  *		Alan Cox	: 	Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
11  *					to keep ip_forward happy.
12  *		Alan Cox	:	More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
13  *		Kai Schulte	:	Fixed #defines for IP_FIREWALL->FIREWALL
14  *              David Woodhouse :       Perform some basic ICMP handling.
15  *                                      IPIP Routing without decapsulation.
16  *              Carlos Picoto   :       GRE over IP support
17  *		Alexey Kuznetsov:	Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
18  *					I do not want to merge them together.
19  *
20  *	This program is free software; you can redistribute it and/or
21  *	modify it under the terms of the GNU General Public License
22  *	as published by the Free Software Foundation; either version
23  *	2 of the License, or (at your option) any later version.
24  *
25  */
26 
27 /* tunnel.c: an IP tunnel driver
28 
29 	The purpose of this driver is to provide an IP tunnel through
30 	which you can tunnel network traffic transparently across subnets.
31 
32 	This was written by looking at Nick Holloway's dummy driver
33 	Thanks for the great code!
34 
35 		-Sam Lantinga	(slouken@cs.ucdavis.edu)  02/01/95
36 
37 	Minor tweaks:
38 		Cleaned up the code a little and added some pre-1.3.0 tweaks.
39 		dev->hard_header/hard_header_len changed to use no headers.
40 		Comments/bracketing tweaked.
41 		Made the tunnels use dev->name not tunnel: when error reporting.
42 		Added tx_dropped stat
43 
44 		-Alan Cox	(Alan.Cox@linux.org) 21 March 95
45 
46 	Reworked:
47 		Changed to tunnel to destination gateway in addition to the
48 			tunnel's pointopoint address
49 		Almost completely rewritten
50 		Note:  There is currently no firewall or ICMP handling done.
51 
52 		-Sam Lantinga	(slouken@cs.ucdavis.edu) 02/13/96
53 
54 */
55 
56 /* Things I wish I had known when writing the tunnel driver:
57 
58 	When the tunnel_xmit() function is called, the skb contains the
59 	packet to be sent (plus a great deal of extra info), and dev
60 	contains the tunnel device that _we_ are.
61 
62 	When we are passed a packet, we are expected to fill in the
63 	source address with our source IP address.
64 
65 	What is the proper way to allocate, copy and free a buffer?
66 	After you allocate it, it is a "0 length" chunk of memory
67 	starting at zero.  If you want to add headers to the buffer
68 	later, you'll have to call "skb_reserve(skb, amount)" with
69 	the amount of memory you want reserved.  Then, you call
70 	"skb_put(skb, amount)" with the amount of space you want in
71 	the buffer.  skb_put() returns a pointer to the top (#0) of
72 	that buffer.  skb->len is set to the amount of space you have
73 	"allocated" with skb_put().  You can then write up to skb->len
74 	bytes to that buffer.  If you need more, you can call skb_put()
75 	again with the additional amount of space you need.  You can
76 	find out how much more space you can allocate by calling
77 	"skb_tailroom(skb)".
78 	Now, to add header space, call "skb_push(skb, header_len)".
79 	This creates space at the beginning of the buffer and returns
80 	a pointer to this new space.  If later you need to strip a
81 	header from a buffer, call "skb_pull(skb, header_len)".
82 	skb_headroom() will return how much space is left at the top
83 	of the buffer (before the main data).  Remember, this headroom
84 	space must be reserved before the skb_put() function is called.
85 	*/
86 
87 /*
88    This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c
89 
90    For comments look at net/ipv4/ip_gre.c --ANK
91  */
92 
93 
94 #include <linux/capability.h>
95 #include <linux/module.h>
96 #include <linux/types.h>
97 #include <linux/kernel.h>
98 #include <asm/uaccess.h>
99 #include <linux/skbuff.h>
100 #include <linux/netdevice.h>
101 #include <linux/in.h>
102 #include <linux/tcp.h>
103 #include <linux/udp.h>
104 #include <linux/if_arp.h>
105 #include <linux/mroute.h>
106 #include <linux/init.h>
107 #include <linux/netfilter_ipv4.h>
108 #include <linux/if_ether.h>
109 
110 #include <net/sock.h>
111 #include <net/ip.h>
112 #include <net/icmp.h>
113 #include <net/ipip.h>
114 #include <net/inet_ecn.h>
115 #include <net/xfrm.h>
116 #include <net/net_namespace.h>
117 #include <net/netns/generic.h>
118 
119 #define HASH_SIZE  16
120 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
121 
122 static int ipip_net_id;
123 struct ipip_net {
124 	struct ip_tunnel *tunnels_r_l[HASH_SIZE];
125 	struct ip_tunnel *tunnels_r[HASH_SIZE];
126 	struct ip_tunnel *tunnels_l[HASH_SIZE];
127 	struct ip_tunnel *tunnels_wc[1];
128 	struct ip_tunnel **tunnels[4];
129 
130 	struct net_device *fb_tunnel_dev;
131 };
132 
133 static int ipip_fb_tunnel_init(struct net_device *dev);
134 static int ipip_tunnel_init(struct net_device *dev);
135 static void ipip_tunnel_setup(struct net_device *dev);
136 
137 static DEFINE_RWLOCK(ipip_lock);
138 
139 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
140 		__be32 remote, __be32 local)
141 {
142 	unsigned h0 = HASH(remote);
143 	unsigned h1 = HASH(local);
144 	struct ip_tunnel *t;
145 	struct ipip_net *ipn = net_generic(net, ipip_net_id);
146 
147 	for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
148 		if (local == t->parms.iph.saddr &&
149 		    remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
150 			return t;
151 	}
152 	for (t = ipn->tunnels_r[h0]; t; t = t->next) {
153 		if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
154 			return t;
155 	}
156 	for (t = ipn->tunnels_l[h1]; t; t = t->next) {
157 		if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
158 			return t;
159 	}
160 	if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
161 		return t;
162 	return NULL;
163 }
164 
165 static struct ip_tunnel **__ipip_bucket(struct ipip_net *ipn,
166 		struct ip_tunnel_parm *parms)
167 {
168 	__be32 remote = parms->iph.daddr;
169 	__be32 local = parms->iph.saddr;
170 	unsigned h = 0;
171 	int prio = 0;
172 
173 	if (remote) {
174 		prio |= 2;
175 		h ^= HASH(remote);
176 	}
177 	if (local) {
178 		prio |= 1;
179 		h ^= HASH(local);
180 	}
181 	return &ipn->tunnels[prio][h];
182 }
183 
184 static inline struct ip_tunnel **ipip_bucket(struct ipip_net *ipn,
185 		struct ip_tunnel *t)
186 {
187 	return __ipip_bucket(ipn, &t->parms);
188 }
189 
190 static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
191 {
192 	struct ip_tunnel **tp;
193 
194 	for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
195 		if (t == *tp) {
196 			write_lock_bh(&ipip_lock);
197 			*tp = t->next;
198 			write_unlock_bh(&ipip_lock);
199 			break;
200 		}
201 	}
202 }
203 
204 static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
205 {
206 	struct ip_tunnel **tp = ipip_bucket(ipn, t);
207 
208 	t->next = *tp;
209 	write_lock_bh(&ipip_lock);
210 	*tp = t;
211 	write_unlock_bh(&ipip_lock);
212 }
213 
214 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
215 		struct ip_tunnel_parm *parms, int create)
216 {
217 	__be32 remote = parms->iph.daddr;
218 	__be32 local = parms->iph.saddr;
219 	struct ip_tunnel *t, **tp, *nt;
220 	struct net_device *dev;
221 	char name[IFNAMSIZ];
222 	struct ipip_net *ipn = net_generic(net, ipip_net_id);
223 
224 	for (tp = __ipip_bucket(ipn, parms); (t = *tp) != NULL; tp = &t->next) {
225 		if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
226 			return t;
227 	}
228 	if (!create)
229 		return NULL;
230 
231 	if (parms->name[0])
232 		strlcpy(name, parms->name, IFNAMSIZ);
233 	else
234 		sprintf(name, "tunl%%d");
235 
236 	dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
237 	if (dev == NULL)
238 		return NULL;
239 
240 	dev_net_set(dev, net);
241 
242 	if (strchr(name, '%')) {
243 		if (dev_alloc_name(dev, name) < 0)
244 			goto failed_free;
245 	}
246 
247 	nt = netdev_priv(dev);
248 	dev->init = ipip_tunnel_init;
249 	nt->parms = *parms;
250 
251 	if (register_netdevice(dev) < 0)
252 		goto failed_free;
253 
254 	dev_hold(dev);
255 	ipip_tunnel_link(ipn, nt);
256 	return nt;
257 
258 failed_free:
259 	free_netdev(dev);
260 	return NULL;
261 }
262 
263 static void ipip_tunnel_uninit(struct net_device *dev)
264 {
265 	struct net *net = dev_net(dev);
266 	struct ipip_net *ipn = net_generic(net, ipip_net_id);
267 
268 	if (dev == ipn->fb_tunnel_dev) {
269 		write_lock_bh(&ipip_lock);
270 		ipn->tunnels_wc[0] = NULL;
271 		write_unlock_bh(&ipip_lock);
272 	} else
273 		ipip_tunnel_unlink(ipn, netdev_priv(dev));
274 	dev_put(dev);
275 }
276 
277 static int ipip_err(struct sk_buff *skb, u32 info)
278 {
279 
280 /* All the routers (except for Linux) return only
281    8 bytes of packet payload. It means, that precise relaying of
282    ICMP in the real Internet is absolutely infeasible.
283  */
284 	struct iphdr *iph = (struct iphdr*)skb->data;
285 	const int type = icmp_hdr(skb)->type;
286 	const int code = icmp_hdr(skb)->code;
287 	struct ip_tunnel *t;
288 	int err;
289 
290 	switch (type) {
291 	default:
292 	case ICMP_PARAMETERPROB:
293 		return 0;
294 
295 	case ICMP_DEST_UNREACH:
296 		switch (code) {
297 		case ICMP_SR_FAILED:
298 		case ICMP_PORT_UNREACH:
299 			/* Impossible event. */
300 			return 0;
301 		case ICMP_FRAG_NEEDED:
302 			/* Soft state for pmtu is maintained by IP core. */
303 			return 0;
304 		default:
305 			/* All others are translated to HOST_UNREACH.
306 			   rfc2003 contains "deep thoughts" about NET_UNREACH,
307 			   I believe they are just ether pollution. --ANK
308 			 */
309 			break;
310 		}
311 		break;
312 	case ICMP_TIME_EXCEEDED:
313 		if (code != ICMP_EXC_TTL)
314 			return 0;
315 		break;
316 	}
317 
318 	err = -ENOENT;
319 
320 	read_lock(&ipip_lock);
321 	t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
322 	if (t == NULL || t->parms.iph.daddr == 0)
323 		goto out;
324 
325 	err = 0;
326 	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
327 		goto out;
328 
329 	if (jiffies - t->err_time < IPTUNNEL_ERR_TIMEO)
330 		t->err_count++;
331 	else
332 		t->err_count = 1;
333 	t->err_time = jiffies;
334 out:
335 	read_unlock(&ipip_lock);
336 	return err;
337 }
338 
339 static inline void ipip_ecn_decapsulate(const struct iphdr *outer_iph,
340 					struct sk_buff *skb)
341 {
342 	struct iphdr *inner_iph = ip_hdr(skb);
343 
344 	if (INET_ECN_is_ce(outer_iph->tos))
345 		IP_ECN_set_ce(inner_iph);
346 }
347 
348 static int ipip_rcv(struct sk_buff *skb)
349 {
350 	struct ip_tunnel *tunnel;
351 	const struct iphdr *iph = ip_hdr(skb);
352 
353 	read_lock(&ipip_lock);
354 	if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
355 					iph->saddr, iph->daddr)) != NULL) {
356 		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
357 			read_unlock(&ipip_lock);
358 			kfree_skb(skb);
359 			return 0;
360 		}
361 
362 		secpath_reset(skb);
363 
364 		skb->mac_header = skb->network_header;
365 		skb_reset_network_header(skb);
366 		skb->protocol = htons(ETH_P_IP);
367 		skb->pkt_type = PACKET_HOST;
368 
369 		tunnel->dev->stats.rx_packets++;
370 		tunnel->dev->stats.rx_bytes += skb->len;
371 		skb->dev = tunnel->dev;
372 		dst_release(skb->dst);
373 		skb->dst = NULL;
374 		nf_reset(skb);
375 		ipip_ecn_decapsulate(iph, skb);
376 		netif_rx(skb);
377 		read_unlock(&ipip_lock);
378 		return 0;
379 	}
380 	read_unlock(&ipip_lock);
381 
382 	return -1;
383 }
384 
385 /*
386  *	This function assumes it is being called from dev_queue_xmit()
387  *	and that skb is filled properly by that function.
388  */
389 
390 static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
391 {
392 	struct ip_tunnel *tunnel = netdev_priv(dev);
393 	struct net_device_stats *stats = &tunnel->dev->stats;
394 	struct iphdr  *tiph = &tunnel->parms.iph;
395 	u8     tos = tunnel->parms.iph.tos;
396 	__be16 df = tiph->frag_off;
397 	struct rtable *rt;     			/* Route to the other host */
398 	struct net_device *tdev;			/* Device to other host */
399 	struct iphdr  *old_iph = ip_hdr(skb);
400 	struct iphdr  *iph;			/* Our new IP header */
401 	unsigned int max_headroom;		/* The extra header space needed */
402 	__be32 dst = tiph->daddr;
403 	int    mtu;
404 
405 	if (tunnel->recursion++) {
406 		stats->collisions++;
407 		goto tx_error;
408 	}
409 
410 	if (skb->protocol != htons(ETH_P_IP))
411 		goto tx_error;
412 
413 	if (tos&1)
414 		tos = old_iph->tos;
415 
416 	if (!dst) {
417 		/* NBMA tunnel */
418 		if ((rt = skb->rtable) == NULL) {
419 			stats->tx_fifo_errors++;
420 			goto tx_error;
421 		}
422 		if ((dst = rt->rt_gateway) == 0)
423 			goto tx_error_icmp;
424 	}
425 
426 	{
427 		struct flowi fl = { .oif = tunnel->parms.link,
428 				    .nl_u = { .ip4_u =
429 					      { .daddr = dst,
430 						.saddr = tiph->saddr,
431 						.tos = RT_TOS(tos) } },
432 				    .proto = IPPROTO_IPIP };
433 		if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
434 			stats->tx_carrier_errors++;
435 			goto tx_error_icmp;
436 		}
437 	}
438 	tdev = rt->u.dst.dev;
439 
440 	if (tdev == dev) {
441 		ip_rt_put(rt);
442 		stats->collisions++;
443 		goto tx_error;
444 	}
445 
446 	if (tiph->frag_off)
447 		mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
448 	else
449 		mtu = skb->dst ? dst_mtu(skb->dst) : dev->mtu;
450 
451 	if (mtu < 68) {
452 		stats->collisions++;
453 		ip_rt_put(rt);
454 		goto tx_error;
455 	}
456 	if (skb->dst)
457 		skb->dst->ops->update_pmtu(skb->dst, mtu);
458 
459 	df |= (old_iph->frag_off&htons(IP_DF));
460 
461 	if ((old_iph->frag_off&htons(IP_DF)) && mtu < ntohs(old_iph->tot_len)) {
462 		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
463 		ip_rt_put(rt);
464 		goto tx_error;
465 	}
466 
467 	if (tunnel->err_count > 0) {
468 		if (jiffies - tunnel->err_time < IPTUNNEL_ERR_TIMEO) {
469 			tunnel->err_count--;
470 			dst_link_failure(skb);
471 		} else
472 			tunnel->err_count = 0;
473 	}
474 
475 	/*
476 	 * Okay, now see if we can stuff it in the buffer as-is.
477 	 */
478 	max_headroom = (LL_RESERVED_SPACE(tdev)+sizeof(struct iphdr));
479 
480 	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
481 	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
482 		struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
483 		if (!new_skb) {
484 			ip_rt_put(rt);
485 			stats->tx_dropped++;
486 			dev_kfree_skb(skb);
487 			tunnel->recursion--;
488 			return 0;
489 		}
490 		if (skb->sk)
491 			skb_set_owner_w(new_skb, skb->sk);
492 		dev_kfree_skb(skb);
493 		skb = new_skb;
494 		old_iph = ip_hdr(skb);
495 	}
496 
497 	skb->transport_header = skb->network_header;
498 	skb_push(skb, sizeof(struct iphdr));
499 	skb_reset_network_header(skb);
500 	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
501 	IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
502 			      IPSKB_REROUTED);
503 	dst_release(skb->dst);
504 	skb->dst = &rt->u.dst;
505 
506 	/*
507 	 *	Push down and install the IPIP header.
508 	 */
509 
510 	iph 			=	ip_hdr(skb);
511 	iph->version		=	4;
512 	iph->ihl		=	sizeof(struct iphdr)>>2;
513 	iph->frag_off		=	df;
514 	iph->protocol		=	IPPROTO_IPIP;
515 	iph->tos		=	INET_ECN_encapsulate(tos, old_iph->tos);
516 	iph->daddr		=	rt->rt_dst;
517 	iph->saddr		=	rt->rt_src;
518 
519 	if ((iph->ttl = tiph->ttl) == 0)
520 		iph->ttl	=	old_iph->ttl;
521 
522 	nf_reset(skb);
523 
524 	IPTUNNEL_XMIT();
525 	tunnel->recursion--;
526 	return 0;
527 
528 tx_error_icmp:
529 	dst_link_failure(skb);
530 tx_error:
531 	stats->tx_errors++;
532 	dev_kfree_skb(skb);
533 	tunnel->recursion--;
534 	return 0;
535 }
536 
537 static void ipip_tunnel_bind_dev(struct net_device *dev)
538 {
539 	struct net_device *tdev = NULL;
540 	struct ip_tunnel *tunnel;
541 	struct iphdr *iph;
542 
543 	tunnel = netdev_priv(dev);
544 	iph = &tunnel->parms.iph;
545 
546 	if (iph->daddr) {
547 		struct flowi fl = { .oif = tunnel->parms.link,
548 				    .nl_u = { .ip4_u =
549 					      { .daddr = iph->daddr,
550 						.saddr = iph->saddr,
551 						.tos = RT_TOS(iph->tos) } },
552 				    .proto = IPPROTO_IPIP };
553 		struct rtable *rt;
554 		if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
555 			tdev = rt->u.dst.dev;
556 			ip_rt_put(rt);
557 		}
558 		dev->flags |= IFF_POINTOPOINT;
559 	}
560 
561 	if (!tdev && tunnel->parms.link)
562 		tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
563 
564 	if (tdev) {
565 		dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
566 		dev->mtu = tdev->mtu - sizeof(struct iphdr);
567 	}
568 	dev->iflink = tunnel->parms.link;
569 }
570 
571 static int
572 ipip_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
573 {
574 	int err = 0;
575 	struct ip_tunnel_parm p;
576 	struct ip_tunnel *t;
577 	struct net *net = dev_net(dev);
578 	struct ipip_net *ipn = net_generic(net, ipip_net_id);
579 
580 	switch (cmd) {
581 	case SIOCGETTUNNEL:
582 		t = NULL;
583 		if (dev == ipn->fb_tunnel_dev) {
584 			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
585 				err = -EFAULT;
586 				break;
587 			}
588 			t = ipip_tunnel_locate(net, &p, 0);
589 		}
590 		if (t == NULL)
591 			t = netdev_priv(dev);
592 		memcpy(&p, &t->parms, sizeof(p));
593 		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
594 			err = -EFAULT;
595 		break;
596 
597 	case SIOCADDTUNNEL:
598 	case SIOCCHGTUNNEL:
599 		err = -EPERM;
600 		if (!capable(CAP_NET_ADMIN))
601 			goto done;
602 
603 		err = -EFAULT;
604 		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
605 			goto done;
606 
607 		err = -EINVAL;
608 		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
609 		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
610 			goto done;
611 		if (p.iph.ttl)
612 			p.iph.frag_off |= htons(IP_DF);
613 
614 		t = ipip_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
615 
616 		if (dev != ipn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
617 			if (t != NULL) {
618 				if (t->dev != dev) {
619 					err = -EEXIST;
620 					break;
621 				}
622 			} else {
623 				if (((dev->flags&IFF_POINTOPOINT) && !p.iph.daddr) ||
624 				    (!(dev->flags&IFF_POINTOPOINT) && p.iph.daddr)) {
625 					err = -EINVAL;
626 					break;
627 				}
628 				t = netdev_priv(dev);
629 				ipip_tunnel_unlink(ipn, t);
630 				t->parms.iph.saddr = p.iph.saddr;
631 				t->parms.iph.daddr = p.iph.daddr;
632 				memcpy(dev->dev_addr, &p.iph.saddr, 4);
633 				memcpy(dev->broadcast, &p.iph.daddr, 4);
634 				ipip_tunnel_link(ipn, t);
635 				netdev_state_change(dev);
636 			}
637 		}
638 
639 		if (t) {
640 			err = 0;
641 			if (cmd == SIOCCHGTUNNEL) {
642 				t->parms.iph.ttl = p.iph.ttl;
643 				t->parms.iph.tos = p.iph.tos;
644 				t->parms.iph.frag_off = p.iph.frag_off;
645 				if (t->parms.link != p.link) {
646 					t->parms.link = p.link;
647 					ipip_tunnel_bind_dev(dev);
648 					netdev_state_change(dev);
649 				}
650 			}
651 			if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
652 				err = -EFAULT;
653 		} else
654 			err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
655 		break;
656 
657 	case SIOCDELTUNNEL:
658 		err = -EPERM;
659 		if (!capable(CAP_NET_ADMIN))
660 			goto done;
661 
662 		if (dev == ipn->fb_tunnel_dev) {
663 			err = -EFAULT;
664 			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
665 				goto done;
666 			err = -ENOENT;
667 			if ((t = ipip_tunnel_locate(net, &p, 0)) == NULL)
668 				goto done;
669 			err = -EPERM;
670 			if (t->dev == ipn->fb_tunnel_dev)
671 				goto done;
672 			dev = t->dev;
673 		}
674 		unregister_netdevice(dev);
675 		err = 0;
676 		break;
677 
678 	default:
679 		err = -EINVAL;
680 	}
681 
682 done:
683 	return err;
684 }
685 
686 static int ipip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
687 {
688 	if (new_mtu < 68 || new_mtu > 0xFFF8 - sizeof(struct iphdr))
689 		return -EINVAL;
690 	dev->mtu = new_mtu;
691 	return 0;
692 }
693 
694 static void ipip_tunnel_setup(struct net_device *dev)
695 {
696 	dev->uninit		= ipip_tunnel_uninit;
697 	dev->hard_start_xmit	= ipip_tunnel_xmit;
698 	dev->do_ioctl		= ipip_tunnel_ioctl;
699 	dev->change_mtu		= ipip_tunnel_change_mtu;
700 	dev->destructor		= free_netdev;
701 
702 	dev->type		= ARPHRD_TUNNEL;
703 	dev->hard_header_len 	= LL_MAX_HEADER + sizeof(struct iphdr);
704 	dev->mtu		= ETH_DATA_LEN - sizeof(struct iphdr);
705 	dev->flags		= IFF_NOARP;
706 	dev->iflink		= 0;
707 	dev->addr_len		= 4;
708 	dev->features		|= NETIF_F_NETNS_LOCAL;
709 }
710 
711 static int ipip_tunnel_init(struct net_device *dev)
712 {
713 	struct ip_tunnel *tunnel;
714 
715 	tunnel = netdev_priv(dev);
716 
717 	tunnel->dev = dev;
718 	strcpy(tunnel->parms.name, dev->name);
719 
720 	memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
721 	memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
722 
723 	ipip_tunnel_bind_dev(dev);
724 
725 	return 0;
726 }
727 
728 static int ipip_fb_tunnel_init(struct net_device *dev)
729 {
730 	struct ip_tunnel *tunnel = netdev_priv(dev);
731 	struct iphdr *iph = &tunnel->parms.iph;
732 	struct ipip_net *ipn = net_generic(dev_net(dev), ipip_net_id);
733 
734 	tunnel->dev = dev;
735 	strcpy(tunnel->parms.name, dev->name);
736 
737 	iph->version		= 4;
738 	iph->protocol		= IPPROTO_IPIP;
739 	iph->ihl		= 5;
740 
741 	dev_hold(dev);
742 	ipn->tunnels_wc[0]	= tunnel;
743 	return 0;
744 }
745 
746 static struct xfrm_tunnel ipip_handler = {
747 	.handler	=	ipip_rcv,
748 	.err_handler	=	ipip_err,
749 	.priority	=	1,
750 };
751 
752 static char banner[] __initdata =
753 	KERN_INFO "IPv4 over IPv4 tunneling driver\n";
754 
755 static void ipip_destroy_tunnels(struct ipip_net *ipn)
756 {
757 	int prio;
758 
759 	for (prio = 1; prio < 4; prio++) {
760 		int h;
761 		for (h = 0; h < HASH_SIZE; h++) {
762 			struct ip_tunnel *t;
763 			while ((t = ipn->tunnels[prio][h]) != NULL)
764 				unregister_netdevice(t->dev);
765 		}
766 	}
767 }
768 
769 static int ipip_init_net(struct net *net)
770 {
771 	int err;
772 	struct ipip_net *ipn;
773 
774 	err = -ENOMEM;
775 	ipn = kzalloc(sizeof(struct ipip_net), GFP_KERNEL);
776 	if (ipn == NULL)
777 		goto err_alloc;
778 
779 	err = net_assign_generic(net, ipip_net_id, ipn);
780 	if (err < 0)
781 		goto err_assign;
782 
783 	ipn->tunnels[0] = ipn->tunnels_wc;
784 	ipn->tunnels[1] = ipn->tunnels_l;
785 	ipn->tunnels[2] = ipn->tunnels_r;
786 	ipn->tunnels[3] = ipn->tunnels_r_l;
787 
788 	ipn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel),
789 					   "tunl0",
790 					   ipip_tunnel_setup);
791 	if (!ipn->fb_tunnel_dev) {
792 		err = -ENOMEM;
793 		goto err_alloc_dev;
794 	}
795 
796 	ipn->fb_tunnel_dev->init = ipip_fb_tunnel_init;
797 	dev_net_set(ipn->fb_tunnel_dev, net);
798 
799 	if ((err = register_netdev(ipn->fb_tunnel_dev)))
800 		goto err_reg_dev;
801 
802 	return 0;
803 
804 err_reg_dev:
805 	free_netdev(ipn->fb_tunnel_dev);
806 err_alloc_dev:
807 	/* nothing */
808 err_assign:
809 	kfree(ipn);
810 err_alloc:
811 	return err;
812 }
813 
814 static void ipip_exit_net(struct net *net)
815 {
816 	struct ipip_net *ipn;
817 
818 	ipn = net_generic(net, ipip_net_id);
819 	rtnl_lock();
820 	ipip_destroy_tunnels(ipn);
821 	unregister_netdevice(ipn->fb_tunnel_dev);
822 	rtnl_unlock();
823 	kfree(ipn);
824 }
825 
826 static struct pernet_operations ipip_net_ops = {
827 	.init = ipip_init_net,
828 	.exit = ipip_exit_net,
829 };
830 
831 static int __init ipip_init(void)
832 {
833 	int err;
834 
835 	printk(banner);
836 
837 	if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) {
838 		printk(KERN_INFO "ipip init: can't register tunnel\n");
839 		return -EAGAIN;
840 	}
841 
842 	err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
843 	if (err)
844 		xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
845 
846 	return err;
847 }
848 
849 static void __exit ipip_fini(void)
850 {
851 	if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
852 		printk(KERN_INFO "ipip close: can't deregister tunnel\n");
853 
854 	unregister_pernet_gen_device(ipip_net_id, &ipip_net_ops);
855 }
856 
857 module_init(ipip_init);
858 module_exit(ipip_fini);
859 MODULE_LICENSE("GPL");
860