xref: /openbmc/linux/net/ipv6/ip6_tunnel.c (revision e2f1cf25)
1 /*
2  *	IPv6 tunneling device
3  *	Linux INET6 implementation
4  *
5  *	Authors:
6  *	Ville Nuorvala		<vnuorval@tcs.hut.fi>
7  *	Yasuyuki Kozakai	<kozakai@linux-ipv6.org>
8  *
9  *      Based on:
10  *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
11  *
12  *      RFC 2473
13  *
14  *	This program is free software; you can redistribute it and/or
15  *      modify it under the terms of the GNU General Public License
16  *      as published by the Free Software Foundation; either version
17  *      2 of the License, or (at your option) any later version.
18  *
19  */
20 
21 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
22 
23 #include <linux/module.h>
24 #include <linux/capability.h>
25 #include <linux/errno.h>
26 #include <linux/types.h>
27 #include <linux/sockios.h>
28 #include <linux/icmp.h>
29 #include <linux/if.h>
30 #include <linux/in.h>
31 #include <linux/ip.h>
32 #include <linux/net.h>
33 #include <linux/in6.h>
34 #include <linux/netdevice.h>
35 #include <linux/if_arp.h>
36 #include <linux/icmpv6.h>
37 #include <linux/init.h>
38 #include <linux/route.h>
39 #include <linux/rtnetlink.h>
40 #include <linux/netfilter_ipv6.h>
41 #include <linux/slab.h>
42 #include <linux/hash.h>
43 #include <linux/etherdevice.h>
44 
45 #include <asm/uaccess.h>
46 #include <linux/atomic.h>
47 
48 #include <net/icmp.h>
49 #include <net/ip.h>
50 #include <net/ip_tunnels.h>
51 #include <net/ipv6.h>
52 #include <net/ip6_route.h>
53 #include <net/addrconf.h>
54 #include <net/ip6_tunnel.h>
55 #include <net/xfrm.h>
56 #include <net/dsfield.h>
57 #include <net/inet_ecn.h>
58 #include <net/net_namespace.h>
59 #include <net/netns/generic.h>
60 
61 MODULE_AUTHOR("Ville Nuorvala");
62 MODULE_DESCRIPTION("IPv6 tunneling device");
63 MODULE_LICENSE("GPL");
64 MODULE_ALIAS_RTNL_LINK("ip6tnl");
65 MODULE_ALIAS_NETDEV("ip6tnl0");
66 
67 #define HASH_SIZE_SHIFT  5
68 #define HASH_SIZE (1 << HASH_SIZE_SHIFT)
69 
70 static bool log_ecn_error = true;
71 module_param(log_ecn_error, bool, 0644);
72 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
73 
74 static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
75 {
76 	u32 hash = ipv6_addr_hash(addr1) ^ ipv6_addr_hash(addr2);
77 
78 	return hash_32(hash, HASH_SIZE_SHIFT);
79 }
80 
81 static int ip6_tnl_dev_init(struct net_device *dev);
82 static void ip6_tnl_dev_setup(struct net_device *dev);
83 static struct rtnl_link_ops ip6_link_ops __read_mostly;
84 
85 static int ip6_tnl_net_id __read_mostly;
86 struct ip6_tnl_net {
87 	/* the IPv6 tunnel fallback device */
88 	struct net_device *fb_tnl_dev;
89 	/* lists for storing tunnels in use */
90 	struct ip6_tnl __rcu *tnls_r_l[HASH_SIZE];
91 	struct ip6_tnl __rcu *tnls_wc[1];
92 	struct ip6_tnl __rcu **tnls[2];
93 };
94 
95 static struct net_device_stats *ip6_get_stats(struct net_device *dev)
96 {
97 	struct pcpu_sw_netstats tmp, sum = { 0 };
98 	int i;
99 
100 	for_each_possible_cpu(i) {
101 		unsigned int start;
102 		const struct pcpu_sw_netstats *tstats =
103 						   per_cpu_ptr(dev->tstats, i);
104 
105 		do {
106 			start = u64_stats_fetch_begin_irq(&tstats->syncp);
107 			tmp.rx_packets = tstats->rx_packets;
108 			tmp.rx_bytes = tstats->rx_bytes;
109 			tmp.tx_packets = tstats->tx_packets;
110 			tmp.tx_bytes =  tstats->tx_bytes;
111 		} while (u64_stats_fetch_retry_irq(&tstats->syncp, start));
112 
113 		sum.rx_packets += tmp.rx_packets;
114 		sum.rx_bytes   += tmp.rx_bytes;
115 		sum.tx_packets += tmp.tx_packets;
116 		sum.tx_bytes   += tmp.tx_bytes;
117 	}
118 	dev->stats.rx_packets = sum.rx_packets;
119 	dev->stats.rx_bytes   = sum.rx_bytes;
120 	dev->stats.tx_packets = sum.tx_packets;
121 	dev->stats.tx_bytes   = sum.tx_bytes;
122 	return &dev->stats;
123 }
124 
125 /*
126  * Locking : hash tables are protected by RCU and RTNL
127  */
128 
129 struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
130 {
131 	struct dst_entry *dst = t->dst_cache;
132 
133 	if (dst && dst->obsolete &&
134 	    !dst->ops->check(dst, t->dst_cookie)) {
135 		t->dst_cache = NULL;
136 		dst_release(dst);
137 		return NULL;
138 	}
139 
140 	return dst;
141 }
142 EXPORT_SYMBOL_GPL(ip6_tnl_dst_check);
143 
144 void ip6_tnl_dst_reset(struct ip6_tnl *t)
145 {
146 	dst_release(t->dst_cache);
147 	t->dst_cache = NULL;
148 }
149 EXPORT_SYMBOL_GPL(ip6_tnl_dst_reset);
150 
151 void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
152 {
153 	struct rt6_info *rt = (struct rt6_info *) dst;
154 	t->dst_cookie = rt6_get_cookie(rt);
155 	dst_release(t->dst_cache);
156 	t->dst_cache = dst;
157 }
158 EXPORT_SYMBOL_GPL(ip6_tnl_dst_store);
159 
160 /**
161  * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
162  *   @remote: the address of the tunnel exit-point
163  *   @local: the address of the tunnel entry-point
164  *
165  * Return:
166  *   tunnel matching given end-points if found,
167  *   else fallback tunnel if its device is up,
168  *   else %NULL
169  **/
170 
171 #define for_each_ip6_tunnel_rcu(start) \
172 	for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
173 
174 static struct ip6_tnl *
175 ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
176 {
177 	unsigned int hash = HASH(remote, local);
178 	struct ip6_tnl *t;
179 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
180 	struct in6_addr any;
181 
182 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
183 		if (ipv6_addr_equal(local, &t->parms.laddr) &&
184 		    ipv6_addr_equal(remote, &t->parms.raddr) &&
185 		    (t->dev->flags & IFF_UP))
186 			return t;
187 	}
188 
189 	memset(&any, 0, sizeof(any));
190 	hash = HASH(&any, local);
191 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
192 		if (ipv6_addr_equal(local, &t->parms.laddr) &&
193 		    (t->dev->flags & IFF_UP))
194 			return t;
195 	}
196 
197 	hash = HASH(remote, &any);
198 	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
199 		if (ipv6_addr_equal(remote, &t->parms.raddr) &&
200 		    (t->dev->flags & IFF_UP))
201 			return t;
202 	}
203 
204 	t = rcu_dereference(ip6n->tnls_wc[0]);
205 	if (t && (t->dev->flags & IFF_UP))
206 		return t;
207 
208 	return NULL;
209 }
210 
211 /**
212  * ip6_tnl_bucket - get head of list matching given tunnel parameters
213  *   @p: parameters containing tunnel end-points
214  *
215  * Description:
216  *   ip6_tnl_bucket() returns the head of the list matching the
217  *   &struct in6_addr entries laddr and raddr in @p.
218  *
219  * Return: head of IPv6 tunnel list
220  **/
221 
222 static struct ip6_tnl __rcu **
223 ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct __ip6_tnl_parm *p)
224 {
225 	const struct in6_addr *remote = &p->raddr;
226 	const struct in6_addr *local = &p->laddr;
227 	unsigned int h = 0;
228 	int prio = 0;
229 
230 	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
231 		prio = 1;
232 		h = HASH(remote, local);
233 	}
234 	return &ip6n->tnls[prio][h];
235 }
236 
237 /**
238  * ip6_tnl_link - add tunnel to hash table
239  *   @t: tunnel to be added
240  **/
241 
242 static void
243 ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
244 {
245 	struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
246 
247 	rcu_assign_pointer(t->next , rtnl_dereference(*tp));
248 	rcu_assign_pointer(*tp, t);
249 }
250 
251 /**
252  * ip6_tnl_unlink - remove tunnel from hash table
253  *   @t: tunnel to be removed
254  **/
255 
256 static void
257 ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
258 {
259 	struct ip6_tnl __rcu **tp;
260 	struct ip6_tnl *iter;
261 
262 	for (tp = ip6_tnl_bucket(ip6n, &t->parms);
263 	     (iter = rtnl_dereference(*tp)) != NULL;
264 	     tp = &iter->next) {
265 		if (t == iter) {
266 			rcu_assign_pointer(*tp, t->next);
267 			break;
268 		}
269 	}
270 }
271 
272 static void ip6_dev_free(struct net_device *dev)
273 {
274 	free_percpu(dev->tstats);
275 	free_netdev(dev);
276 }
277 
278 static int ip6_tnl_create2(struct net_device *dev)
279 {
280 	struct ip6_tnl *t = netdev_priv(dev);
281 	struct net *net = dev_net(dev);
282 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
283 	int err;
284 
285 	t = netdev_priv(dev);
286 
287 	err = register_netdevice(dev);
288 	if (err < 0)
289 		goto out;
290 
291 	strcpy(t->parms.name, dev->name);
292 	dev->rtnl_link_ops = &ip6_link_ops;
293 
294 	dev_hold(dev);
295 	ip6_tnl_link(ip6n, t);
296 	return 0;
297 
298 out:
299 	return err;
300 }
301 
302 /**
303  * ip6_tnl_create - create a new tunnel
304  *   @p: tunnel parameters
305  *   @pt: pointer to new tunnel
306  *
307  * Description:
308  *   Create tunnel matching given parameters.
309  *
310  * Return:
311  *   created tunnel or error pointer
312  **/
313 
314 static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
315 {
316 	struct net_device *dev;
317 	struct ip6_tnl *t;
318 	char name[IFNAMSIZ];
319 	int err = -ENOMEM;
320 
321 	if (p->name[0])
322 		strlcpy(name, p->name, IFNAMSIZ);
323 	else
324 		sprintf(name, "ip6tnl%%d");
325 
326 	dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
327 			   ip6_tnl_dev_setup);
328 	if (!dev)
329 		goto failed;
330 
331 	dev_net_set(dev, net);
332 
333 	t = netdev_priv(dev);
334 	t->parms = *p;
335 	t->net = dev_net(dev);
336 	err = ip6_tnl_create2(dev);
337 	if (err < 0)
338 		goto failed_free;
339 
340 	return t;
341 
342 failed_free:
343 	ip6_dev_free(dev);
344 failed:
345 	return ERR_PTR(err);
346 }
347 
348 /**
349  * ip6_tnl_locate - find or create tunnel matching given parameters
350  *   @p: tunnel parameters
351  *   @create: != 0 if allowed to create new tunnel if no match found
352  *
353  * Description:
354  *   ip6_tnl_locate() first tries to locate an existing tunnel
355  *   based on @parms. If this is unsuccessful, but @create is set a new
356  *   tunnel device is created and registered for use.
357  *
358  * Return:
359  *   matching tunnel or error pointer
360  **/
361 
362 static struct ip6_tnl *ip6_tnl_locate(struct net *net,
363 		struct __ip6_tnl_parm *p, int create)
364 {
365 	const struct in6_addr *remote = &p->raddr;
366 	const struct in6_addr *local = &p->laddr;
367 	struct ip6_tnl __rcu **tp;
368 	struct ip6_tnl *t;
369 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
370 
371 	for (tp = ip6_tnl_bucket(ip6n, p);
372 	     (t = rtnl_dereference(*tp)) != NULL;
373 	     tp = &t->next) {
374 		if (ipv6_addr_equal(local, &t->parms.laddr) &&
375 		    ipv6_addr_equal(remote, &t->parms.raddr)) {
376 			if (create)
377 				return ERR_PTR(-EEXIST);
378 
379 			return t;
380 		}
381 	}
382 	if (!create)
383 		return ERR_PTR(-ENODEV);
384 	return ip6_tnl_create(net, p);
385 }
386 
387 /**
388  * ip6_tnl_dev_uninit - tunnel device uninitializer
389  *   @dev: the device to be destroyed
390  *
391  * Description:
392  *   ip6_tnl_dev_uninit() removes tunnel from its list
393  **/
394 
395 static void
396 ip6_tnl_dev_uninit(struct net_device *dev)
397 {
398 	struct ip6_tnl *t = netdev_priv(dev);
399 	struct net *net = t->net;
400 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
401 
402 	if (dev == ip6n->fb_tnl_dev)
403 		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
404 	else
405 		ip6_tnl_unlink(ip6n, t);
406 	ip6_tnl_dst_reset(t);
407 	dev_put(dev);
408 }
409 
410 /**
411  * parse_tvl_tnl_enc_lim - handle encapsulation limit option
412  *   @skb: received socket buffer
413  *
414  * Return:
415  *   0 if none was found,
416  *   else index to encapsulation limit
417  **/
418 
419 __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
420 {
421 	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
422 	__u8 nexthdr = ipv6h->nexthdr;
423 	__u16 off = sizeof(*ipv6h);
424 
425 	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
426 		__u16 optlen = 0;
427 		struct ipv6_opt_hdr *hdr;
428 		if (raw + off + sizeof(*hdr) > skb->data &&
429 		    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
430 			break;
431 
432 		hdr = (struct ipv6_opt_hdr *) (raw + off);
433 		if (nexthdr == NEXTHDR_FRAGMENT) {
434 			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
435 			if (frag_hdr->frag_off)
436 				break;
437 			optlen = 8;
438 		} else if (nexthdr == NEXTHDR_AUTH) {
439 			optlen = (hdr->hdrlen + 2) << 2;
440 		} else {
441 			optlen = ipv6_optlen(hdr);
442 		}
443 		if (nexthdr == NEXTHDR_DEST) {
444 			__u16 i = off + 2;
445 			while (1) {
446 				struct ipv6_tlv_tnl_enc_lim *tel;
447 
448 				/* No more room for encapsulation limit */
449 				if (i + sizeof (*tel) > off + optlen)
450 					break;
451 
452 				tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
453 				/* return index of option if found and valid */
454 				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
455 				    tel->length == 1)
456 					return i;
457 				/* else jump to next option */
458 				if (tel->type)
459 					i += tel->length + 2;
460 				else
461 					i++;
462 			}
463 		}
464 		nexthdr = hdr->nexthdr;
465 		off += optlen;
466 	}
467 	return 0;
468 }
469 EXPORT_SYMBOL(ip6_tnl_parse_tlv_enc_lim);
470 
471 /**
472  * ip6_tnl_err - tunnel error handler
473  *
474  * Description:
475  *   ip6_tnl_err() should handle errors in the tunnel according
476  *   to the specifications in RFC 2473.
477  **/
478 
479 static int
480 ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
481 	    u8 *type, u8 *code, int *msg, __u32 *info, int offset)
482 {
483 	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) skb->data;
484 	struct ip6_tnl *t;
485 	int rel_msg = 0;
486 	u8 rel_type = ICMPV6_DEST_UNREACH;
487 	u8 rel_code = ICMPV6_ADDR_UNREACH;
488 	u8 tproto;
489 	__u32 rel_info = 0;
490 	__u16 len;
491 	int err = -ENOENT;
492 
493 	/* If the packet doesn't contain the original IPv6 header we are
494 	   in trouble since we might need the source address for further
495 	   processing of the error. */
496 
497 	rcu_read_lock();
498 	t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr, &ipv6h->saddr);
499 	if (!t)
500 		goto out;
501 
502 	tproto = ACCESS_ONCE(t->parms.proto);
503 	if (tproto != ipproto && tproto != 0)
504 		goto out;
505 
506 	err = 0;
507 
508 	switch (*type) {
509 		__u32 teli;
510 		struct ipv6_tlv_tnl_enc_lim *tel;
511 		__u32 mtu;
512 	case ICMPV6_DEST_UNREACH:
513 		net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
514 				     t->parms.name);
515 		rel_msg = 1;
516 		break;
517 	case ICMPV6_TIME_EXCEED:
518 		if ((*code) == ICMPV6_EXC_HOPLIMIT) {
519 			net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
520 					     t->parms.name);
521 			rel_msg = 1;
522 		}
523 		break;
524 	case ICMPV6_PARAMPROB:
525 		teli = 0;
526 		if ((*code) == ICMPV6_HDR_FIELD)
527 			teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
528 
529 		if (teli && teli == *info - 2) {
530 			tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
531 			if (tel->encap_limit == 0) {
532 				net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
533 						     t->parms.name);
534 				rel_msg = 1;
535 			}
536 		} else {
537 			net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
538 					     t->parms.name);
539 		}
540 		break;
541 	case ICMPV6_PKT_TOOBIG:
542 		mtu = *info - offset;
543 		if (mtu < IPV6_MIN_MTU)
544 			mtu = IPV6_MIN_MTU;
545 		t->dev->mtu = mtu;
546 
547 		len = sizeof(*ipv6h) + ntohs(ipv6h->payload_len);
548 		if (len > mtu) {
549 			rel_type = ICMPV6_PKT_TOOBIG;
550 			rel_code = 0;
551 			rel_info = mtu;
552 			rel_msg = 1;
553 		}
554 		break;
555 	}
556 
557 	*type = rel_type;
558 	*code = rel_code;
559 	*info = rel_info;
560 	*msg = rel_msg;
561 
562 out:
563 	rcu_read_unlock();
564 	return err;
565 }
566 
567 static int
568 ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
569 	   u8 type, u8 code, int offset, __be32 info)
570 {
571 	int rel_msg = 0;
572 	u8 rel_type = type;
573 	u8 rel_code = code;
574 	__u32 rel_info = ntohl(info);
575 	int err;
576 	struct sk_buff *skb2;
577 	const struct iphdr *eiph;
578 	struct rtable *rt;
579 	struct flowi4 fl4;
580 
581 	err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
582 			  &rel_msg, &rel_info, offset);
583 	if (err < 0)
584 		return err;
585 
586 	if (rel_msg == 0)
587 		return 0;
588 
589 	switch (rel_type) {
590 	case ICMPV6_DEST_UNREACH:
591 		if (rel_code != ICMPV6_ADDR_UNREACH)
592 			return 0;
593 		rel_type = ICMP_DEST_UNREACH;
594 		rel_code = ICMP_HOST_UNREACH;
595 		break;
596 	case ICMPV6_PKT_TOOBIG:
597 		if (rel_code != 0)
598 			return 0;
599 		rel_type = ICMP_DEST_UNREACH;
600 		rel_code = ICMP_FRAG_NEEDED;
601 		break;
602 	case NDISC_REDIRECT:
603 		rel_type = ICMP_REDIRECT;
604 		rel_code = ICMP_REDIR_HOST;
605 	default:
606 		return 0;
607 	}
608 
609 	if (!pskb_may_pull(skb, offset + sizeof(struct iphdr)))
610 		return 0;
611 
612 	skb2 = skb_clone(skb, GFP_ATOMIC);
613 	if (!skb2)
614 		return 0;
615 
616 	skb_dst_drop(skb2);
617 
618 	skb_pull(skb2, offset);
619 	skb_reset_network_header(skb2);
620 	eiph = ip_hdr(skb2);
621 
622 	/* Try to guess incoming interface */
623 	rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
624 				   eiph->saddr, 0,
625 				   0, 0,
626 				   IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
627 	if (IS_ERR(rt))
628 		goto out;
629 
630 	skb2->dev = rt->dst.dev;
631 
632 	/* route "incoming" packet */
633 	if (rt->rt_flags & RTCF_LOCAL) {
634 		ip_rt_put(rt);
635 		rt = NULL;
636 		rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
637 					   eiph->daddr, eiph->saddr,
638 					   0, 0,
639 					   IPPROTO_IPIP,
640 					   RT_TOS(eiph->tos), 0);
641 		if (IS_ERR(rt) ||
642 		    rt->dst.dev->type != ARPHRD_TUNNEL) {
643 			if (!IS_ERR(rt))
644 				ip_rt_put(rt);
645 			goto out;
646 		}
647 		skb_dst_set(skb2, &rt->dst);
648 	} else {
649 		ip_rt_put(rt);
650 		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
651 				   skb2->dev) ||
652 		    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
653 			goto out;
654 	}
655 
656 	/* change mtu on this route */
657 	if (rel_type == ICMP_DEST_UNREACH && rel_code == ICMP_FRAG_NEEDED) {
658 		if (rel_info > dst_mtu(skb_dst(skb2)))
659 			goto out;
660 
661 		skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), NULL, skb2, rel_info);
662 	}
663 	if (rel_type == ICMP_REDIRECT)
664 		skb_dst(skb2)->ops->redirect(skb_dst(skb2), NULL, skb2);
665 
666 	icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
667 
668 out:
669 	kfree_skb(skb2);
670 	return 0;
671 }
672 
673 static int
674 ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
675 	   u8 type, u8 code, int offset, __be32 info)
676 {
677 	int rel_msg = 0;
678 	u8 rel_type = type;
679 	u8 rel_code = code;
680 	__u32 rel_info = ntohl(info);
681 	int err;
682 
683 	err = ip6_tnl_err(skb, IPPROTO_IPV6, opt, &rel_type, &rel_code,
684 			  &rel_msg, &rel_info, offset);
685 	if (err < 0)
686 		return err;
687 
688 	if (rel_msg && pskb_may_pull(skb, offset + sizeof(struct ipv6hdr))) {
689 		struct rt6_info *rt;
690 		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
691 
692 		if (!skb2)
693 			return 0;
694 
695 		skb_dst_drop(skb2);
696 		skb_pull(skb2, offset);
697 		skb_reset_network_header(skb2);
698 
699 		/* Try to guess incoming interface */
700 		rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr,
701 				NULL, 0, 0);
702 
703 		if (rt && rt->dst.dev)
704 			skb2->dev = rt->dst.dev;
705 
706 		icmpv6_send(skb2, rel_type, rel_code, rel_info);
707 
708 		ip6_rt_put(rt);
709 
710 		kfree_skb(skb2);
711 	}
712 
713 	return 0;
714 }
715 
716 static int ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
717 				       const struct ipv6hdr *ipv6h,
718 				       struct sk_buff *skb)
719 {
720 	__u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;
721 
722 	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
723 		ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
724 
725 	return IP6_ECN_decapsulate(ipv6h, skb);
726 }
727 
728 static int ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
729 				       const struct ipv6hdr *ipv6h,
730 				       struct sk_buff *skb)
731 {
732 	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
733 		ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
734 
735 	return IP6_ECN_decapsulate(ipv6h, skb);
736 }
737 
738 __u32 ip6_tnl_get_cap(struct ip6_tnl *t,
739 			     const struct in6_addr *laddr,
740 			     const struct in6_addr *raddr)
741 {
742 	struct __ip6_tnl_parm *p = &t->parms;
743 	int ltype = ipv6_addr_type(laddr);
744 	int rtype = ipv6_addr_type(raddr);
745 	__u32 flags = 0;
746 
747 	if (ltype == IPV6_ADDR_ANY || rtype == IPV6_ADDR_ANY) {
748 		flags = IP6_TNL_F_CAP_PER_PACKET;
749 	} else if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
750 		   rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
751 		   !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
752 		   (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
753 		if (ltype&IPV6_ADDR_UNICAST)
754 			flags |= IP6_TNL_F_CAP_XMIT;
755 		if (rtype&IPV6_ADDR_UNICAST)
756 			flags |= IP6_TNL_F_CAP_RCV;
757 	}
758 	return flags;
759 }
760 EXPORT_SYMBOL(ip6_tnl_get_cap);
761 
762 /* called with rcu_read_lock() */
763 int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
764 				  const struct in6_addr *laddr,
765 				  const struct in6_addr *raddr)
766 {
767 	struct __ip6_tnl_parm *p = &t->parms;
768 	int ret = 0;
769 	struct net *net = t->net;
770 
771 	if ((p->flags & IP6_TNL_F_CAP_RCV) ||
772 	    ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
773 	     (ip6_tnl_get_cap(t, laddr, raddr) & IP6_TNL_F_CAP_RCV))) {
774 		struct net_device *ldev = NULL;
775 
776 		if (p->link)
777 			ldev = dev_get_by_index_rcu(net, p->link);
778 
779 		if ((ipv6_addr_is_multicast(laddr) ||
780 		     likely(ipv6_chk_addr(net, laddr, ldev, 0))) &&
781 		    likely(!ipv6_chk_addr(net, raddr, NULL, 0)))
782 			ret = 1;
783 	}
784 	return ret;
785 }
786 EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
787 
788 /**
789  * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
790  *   @skb: received socket buffer
791  *   @protocol: ethernet protocol ID
792  *   @dscp_ecn_decapsulate: the function to decapsulate DSCP code and ECN
793  *
794  * Return: 0
795  **/
796 
797 static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
798 		       __u8 ipproto,
799 		       int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
800 						   const struct ipv6hdr *ipv6h,
801 						   struct sk_buff *skb))
802 {
803 	struct ip6_tnl *t;
804 	const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
805 	u8 tproto;
806 	int err;
807 
808 	rcu_read_lock();
809 	t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr, &ipv6h->daddr);
810 	if (t) {
811 		struct pcpu_sw_netstats *tstats;
812 
813 		tproto = ACCESS_ONCE(t->parms.proto);
814 		if (tproto != ipproto && tproto != 0) {
815 			rcu_read_unlock();
816 			goto discard;
817 		}
818 
819 		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
820 			rcu_read_unlock();
821 			goto discard;
822 		}
823 
824 		if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) {
825 			t->dev->stats.rx_dropped++;
826 			rcu_read_unlock();
827 			goto discard;
828 		}
829 		skb->mac_header = skb->network_header;
830 		skb_reset_network_header(skb);
831 		skb->protocol = htons(protocol);
832 		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
833 
834 		__skb_tunnel_rx(skb, t->dev, t->net);
835 
836 		err = dscp_ecn_decapsulate(t, ipv6h, skb);
837 		if (unlikely(err)) {
838 			if (log_ecn_error)
839 				net_info_ratelimited("non-ECT from %pI6 with dsfield=%#x\n",
840 						     &ipv6h->saddr,
841 						     ipv6_get_dsfield(ipv6h));
842 			if (err > 1) {
843 				++t->dev->stats.rx_frame_errors;
844 				++t->dev->stats.rx_errors;
845 				rcu_read_unlock();
846 				goto discard;
847 			}
848 		}
849 
850 		tstats = this_cpu_ptr(t->dev->tstats);
851 		u64_stats_update_begin(&tstats->syncp);
852 		tstats->rx_packets++;
853 		tstats->rx_bytes += skb->len;
854 		u64_stats_update_end(&tstats->syncp);
855 
856 		netif_rx(skb);
857 
858 		rcu_read_unlock();
859 		return 0;
860 	}
861 	rcu_read_unlock();
862 	return 1;
863 
864 discard:
865 	kfree_skb(skb);
866 	return 0;
867 }
868 
869 static int ip4ip6_rcv(struct sk_buff *skb)
870 {
871 	return ip6_tnl_rcv(skb, ETH_P_IP, IPPROTO_IPIP,
872 			   ip4ip6_dscp_ecn_decapsulate);
873 }
874 
875 static int ip6ip6_rcv(struct sk_buff *skb)
876 {
877 	return ip6_tnl_rcv(skb, ETH_P_IPV6, IPPROTO_IPV6,
878 			   ip6ip6_dscp_ecn_decapsulate);
879 }
880 
881 struct ipv6_tel_txoption {
882 	struct ipv6_txoptions ops;
883 	__u8 dst_opt[8];
884 };
885 
886 static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
887 {
888 	memset(opt, 0, sizeof(struct ipv6_tel_txoption));
889 
890 	opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
891 	opt->dst_opt[3] = 1;
892 	opt->dst_opt[4] = encap_limit;
893 	opt->dst_opt[5] = IPV6_TLV_PADN;
894 	opt->dst_opt[6] = 1;
895 
896 	opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
897 	opt->ops.opt_nflen = 8;
898 }
899 
900 /**
901  * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
902  *   @t: the outgoing tunnel device
903  *   @hdr: IPv6 header from the incoming packet
904  *
905  * Description:
906  *   Avoid trivial tunneling loop by checking that tunnel exit-point
907  *   doesn't match source of incoming packet.
908  *
909  * Return:
910  *   1 if conflict,
911  *   0 else
912  **/
913 
914 static inline bool
915 ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
916 {
917 	return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
918 }
919 
920 int ip6_tnl_xmit_ctl(struct ip6_tnl *t,
921 		     const struct in6_addr *laddr,
922 		     const struct in6_addr *raddr)
923 {
924 	struct __ip6_tnl_parm *p = &t->parms;
925 	int ret = 0;
926 	struct net *net = t->net;
927 
928 	if ((p->flags & IP6_TNL_F_CAP_XMIT) ||
929 	    ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
930 	     (ip6_tnl_get_cap(t, laddr, raddr) & IP6_TNL_F_CAP_XMIT))) {
931 		struct net_device *ldev = NULL;
932 
933 		rcu_read_lock();
934 		if (p->link)
935 			ldev = dev_get_by_index_rcu(net, p->link);
936 
937 		if (unlikely(!ipv6_chk_addr(net, laddr, ldev, 0)))
938 			pr_warn("%s xmit: Local address not yet configured!\n",
939 				p->name);
940 		else if (!ipv6_addr_is_multicast(raddr) &&
941 			 unlikely(ipv6_chk_addr(net, raddr, NULL, 0)))
942 			pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
943 				p->name);
944 		else
945 			ret = 1;
946 		rcu_read_unlock();
947 	}
948 	return ret;
949 }
950 EXPORT_SYMBOL_GPL(ip6_tnl_xmit_ctl);
951 
952 /**
953  * ip6_tnl_xmit2 - encapsulate packet and send
954  *   @skb: the outgoing socket buffer
955  *   @dev: the outgoing tunnel device
956  *   @dsfield: dscp code for outer header
957  *   @fl: flow of tunneled packet
958  *   @encap_limit: encapsulation limit
959  *   @pmtu: Path MTU is stored if packet is too big
960  *
961  * Description:
962  *   Build new header and do some sanity checks on the packet before sending
963  *   it.
964  *
965  * Return:
966  *   0 on success
967  *   -1 fail
968  *   %-EMSGSIZE message too big. return mtu in this case.
969  **/
970 
971 static int ip6_tnl_xmit2(struct sk_buff *skb,
972 			 struct net_device *dev,
973 			 __u8 dsfield,
974 			 struct flowi6 *fl6,
975 			 int encap_limit,
976 			 __u32 *pmtu)
977 {
978 	struct ip6_tnl *t = netdev_priv(dev);
979 	struct net *net = t->net;
980 	struct net_device_stats *stats = &t->dev->stats;
981 	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
982 	struct ipv6_tel_txoption opt;
983 	struct dst_entry *dst = NULL, *ndst = NULL;
984 	struct net_device *tdev;
985 	int mtu;
986 	unsigned int max_headroom = sizeof(struct ipv6hdr);
987 	u8 proto;
988 	int err = -1;
989 
990 	/* NBMA tunnel */
991 	if (ipv6_addr_any(&t->parms.raddr)) {
992 		struct in6_addr *addr6;
993 		struct neighbour *neigh;
994 		int addr_type;
995 
996 		if (!skb_dst(skb))
997 			goto tx_err_link_failure;
998 
999 		neigh = dst_neigh_lookup(skb_dst(skb),
1000 					 &ipv6_hdr(skb)->daddr);
1001 		if (!neigh)
1002 			goto tx_err_link_failure;
1003 
1004 		addr6 = (struct in6_addr *)&neigh->primary_key;
1005 		addr_type = ipv6_addr_type(addr6);
1006 
1007 		if (addr_type == IPV6_ADDR_ANY)
1008 			addr6 = &ipv6_hdr(skb)->daddr;
1009 
1010 		memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
1011 		neigh_release(neigh);
1012 	} else if (!fl6->flowi6_mark)
1013 		dst = ip6_tnl_dst_check(t);
1014 
1015 	if (!ip6_tnl_xmit_ctl(t, &fl6->saddr, &fl6->daddr))
1016 		goto tx_err_link_failure;
1017 
1018 	if (!dst) {
1019 		ndst = ip6_route_output(net, NULL, fl6);
1020 
1021 		if (ndst->error)
1022 			goto tx_err_link_failure;
1023 		ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
1024 		if (IS_ERR(ndst)) {
1025 			err = PTR_ERR(ndst);
1026 			ndst = NULL;
1027 			goto tx_err_link_failure;
1028 		}
1029 		dst = ndst;
1030 	}
1031 
1032 	tdev = dst->dev;
1033 
1034 	if (tdev == dev) {
1035 		stats->collisions++;
1036 		net_warn_ratelimited("%s: Local routing loop detected!\n",
1037 				     t->parms.name);
1038 		goto tx_err_dst_release;
1039 	}
1040 	mtu = dst_mtu(dst) - sizeof(*ipv6h);
1041 	if (encap_limit >= 0) {
1042 		max_headroom += 8;
1043 		mtu -= 8;
1044 	}
1045 	if (mtu < IPV6_MIN_MTU)
1046 		mtu = IPV6_MIN_MTU;
1047 	if (skb_dst(skb))
1048 		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
1049 	if (skb->len > mtu) {
1050 		*pmtu = mtu;
1051 		err = -EMSGSIZE;
1052 		goto tx_err_dst_release;
1053 	}
1054 
1055 	skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
1056 
1057 	/*
1058 	 * Okay, now see if we can stuff it in the buffer as-is.
1059 	 */
1060 	max_headroom += LL_RESERVED_SPACE(tdev);
1061 
1062 	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
1063 	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
1064 		struct sk_buff *new_skb;
1065 
1066 		new_skb = skb_realloc_headroom(skb, max_headroom);
1067 		if (!new_skb)
1068 			goto tx_err_dst_release;
1069 
1070 		if (skb->sk)
1071 			skb_set_owner_w(new_skb, skb->sk);
1072 		consume_skb(skb);
1073 		skb = new_skb;
1074 	}
1075 	if (fl6->flowi6_mark) {
1076 		skb_dst_set(skb, dst);
1077 		ndst = NULL;
1078 	} else {
1079 		skb_dst_set_noref(skb, dst);
1080 	}
1081 	skb->transport_header = skb->network_header;
1082 
1083 	proto = fl6->flowi6_proto;
1084 	if (encap_limit >= 0) {
1085 		init_tel_txopt(&opt, encap_limit);
1086 		ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
1087 	}
1088 
1089 	if (likely(!skb->encapsulation)) {
1090 		skb_reset_inner_headers(skb);
1091 		skb->encapsulation = 1;
1092 	}
1093 
1094 	skb_push(skb, sizeof(struct ipv6hdr));
1095 	skb_reset_network_header(skb);
1096 	ipv6h = ipv6_hdr(skb);
1097 	ip6_flow_hdr(ipv6h, INET_ECN_encapsulate(0, dsfield),
1098 		     ip6_make_flowlabel(net, skb, fl6->flowlabel, false));
1099 	ipv6h->hop_limit = t->parms.hop_limit;
1100 	ipv6h->nexthdr = proto;
1101 	ipv6h->saddr = fl6->saddr;
1102 	ipv6h->daddr = fl6->daddr;
1103 	ip6tunnel_xmit(NULL, skb, dev);
1104 	if (ndst)
1105 		ip6_tnl_dst_store(t, ndst);
1106 	return 0;
1107 tx_err_link_failure:
1108 	stats->tx_carrier_errors++;
1109 	dst_link_failure(skb);
1110 tx_err_dst_release:
1111 	dst_release(ndst);
1112 	return err;
1113 }
1114 
1115 static inline int
1116 ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
1117 {
1118 	struct ip6_tnl *t = netdev_priv(dev);
1119 	const struct iphdr  *iph = ip_hdr(skb);
1120 	int encap_limit = -1;
1121 	struct flowi6 fl6;
1122 	__u8 dsfield;
1123 	__u32 mtu;
1124 	u8 tproto;
1125 	int err;
1126 
1127 	tproto = ACCESS_ONCE(t->parms.proto);
1128 	if (tproto != IPPROTO_IPIP && tproto != 0)
1129 		return -1;
1130 
1131 	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1132 		encap_limit = t->parms.encap_limit;
1133 
1134 	memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
1135 	fl6.flowi6_proto = IPPROTO_IPIP;
1136 
1137 	dsfield = ipv4_get_dsfield(iph);
1138 
1139 	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1140 		fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
1141 					  & IPV6_TCLASS_MASK;
1142 	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
1143 		fl6.flowi6_mark = skb->mark;
1144 
1145 	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
1146 	if (err != 0) {
1147 		/* XXX: send ICMP error even if DF is not set. */
1148 		if (err == -EMSGSIZE)
1149 			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
1150 				  htonl(mtu));
1151 		return -1;
1152 	}
1153 
1154 	return 0;
1155 }
1156 
1157 static inline int
1158 ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
1159 {
1160 	struct ip6_tnl *t = netdev_priv(dev);
1161 	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
1162 	int encap_limit = -1;
1163 	__u16 offset;
1164 	struct flowi6 fl6;
1165 	__u8 dsfield;
1166 	__u32 mtu;
1167 	u8 tproto;
1168 	int err;
1169 
1170 	tproto = ACCESS_ONCE(t->parms.proto);
1171 	if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
1172 	    ip6_tnl_addr_conflict(t, ipv6h))
1173 		return -1;
1174 
1175 	offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
1176 	if (offset > 0) {
1177 		struct ipv6_tlv_tnl_enc_lim *tel;
1178 		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
1179 		if (tel->encap_limit == 0) {
1180 			icmpv6_send(skb, ICMPV6_PARAMPROB,
1181 				    ICMPV6_HDR_FIELD, offset + 2);
1182 			return -1;
1183 		}
1184 		encap_limit = tel->encap_limit - 1;
1185 	} else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1186 		encap_limit = t->parms.encap_limit;
1187 
1188 	memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
1189 	fl6.flowi6_proto = IPPROTO_IPV6;
1190 
1191 	dsfield = ipv6_get_dsfield(ipv6h);
1192 	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1193 		fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
1194 	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
1195 		fl6.flowlabel |= ip6_flowlabel(ipv6h);
1196 	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
1197 		fl6.flowi6_mark = skb->mark;
1198 
1199 	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
1200 	if (err != 0) {
1201 		if (err == -EMSGSIZE)
1202 			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1203 		return -1;
1204 	}
1205 
1206 	return 0;
1207 }
1208 
1209 static netdev_tx_t
1210 ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
1211 {
1212 	struct ip6_tnl *t = netdev_priv(dev);
1213 	struct net_device_stats *stats = &t->dev->stats;
1214 	int ret;
1215 
1216 	switch (skb->protocol) {
1217 	case htons(ETH_P_IP):
1218 		ret = ip4ip6_tnl_xmit(skb, dev);
1219 		break;
1220 	case htons(ETH_P_IPV6):
1221 		ret = ip6ip6_tnl_xmit(skb, dev);
1222 		break;
1223 	default:
1224 		goto tx_err;
1225 	}
1226 
1227 	if (ret < 0)
1228 		goto tx_err;
1229 
1230 	return NETDEV_TX_OK;
1231 
1232 tx_err:
1233 	stats->tx_errors++;
1234 	stats->tx_dropped++;
1235 	kfree_skb(skb);
1236 	return NETDEV_TX_OK;
1237 }
1238 
1239 static void ip6_tnl_link_config(struct ip6_tnl *t)
1240 {
1241 	struct net_device *dev = t->dev;
1242 	struct __ip6_tnl_parm *p = &t->parms;
1243 	struct flowi6 *fl6 = &t->fl.u.ip6;
1244 
1245 	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
1246 	memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
1247 
1248 	/* Set up flowi template */
1249 	fl6->saddr = p->laddr;
1250 	fl6->daddr = p->raddr;
1251 	fl6->flowi6_oif = p->link;
1252 	fl6->flowlabel = 0;
1253 
1254 	if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
1255 		fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
1256 	if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
1257 		fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
1258 
1259 	p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV|IP6_TNL_F_CAP_PER_PACKET);
1260 	p->flags |= ip6_tnl_get_cap(t, &p->laddr, &p->raddr);
1261 
1262 	if (p->flags&IP6_TNL_F_CAP_XMIT && p->flags&IP6_TNL_F_CAP_RCV)
1263 		dev->flags |= IFF_POINTOPOINT;
1264 	else
1265 		dev->flags &= ~IFF_POINTOPOINT;
1266 
1267 	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1268 		int strict = (ipv6_addr_type(&p->raddr) &
1269 			      (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
1270 
1271 		struct rt6_info *rt = rt6_lookup(t->net,
1272 						 &p->raddr, &p->laddr,
1273 						 p->link, strict);
1274 
1275 		if (!rt)
1276 			return;
1277 
1278 		if (rt->dst.dev) {
1279 			dev->hard_header_len = rt->dst.dev->hard_header_len +
1280 				sizeof(struct ipv6hdr);
1281 
1282 			dev->mtu = rt->dst.dev->mtu - sizeof(struct ipv6hdr);
1283 			if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1284 				dev->mtu -= 8;
1285 
1286 			if (dev->mtu < IPV6_MIN_MTU)
1287 				dev->mtu = IPV6_MIN_MTU;
1288 		}
1289 		ip6_rt_put(rt);
1290 	}
1291 }
1292 
1293 /**
1294  * ip6_tnl_change - update the tunnel parameters
1295  *   @t: tunnel to be changed
1296  *   @p: tunnel configuration parameters
1297  *
1298  * Description:
1299  *   ip6_tnl_change() updates the tunnel parameters
1300  **/
1301 
1302 static int
1303 ip6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
1304 {
1305 	t->parms.laddr = p->laddr;
1306 	t->parms.raddr = p->raddr;
1307 	t->parms.flags = p->flags;
1308 	t->parms.hop_limit = p->hop_limit;
1309 	t->parms.encap_limit = p->encap_limit;
1310 	t->parms.flowinfo = p->flowinfo;
1311 	t->parms.link = p->link;
1312 	t->parms.proto = p->proto;
1313 	ip6_tnl_dst_reset(t);
1314 	ip6_tnl_link_config(t);
1315 	return 0;
1316 }
1317 
1318 static int ip6_tnl_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
1319 {
1320 	struct net *net = t->net;
1321 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1322 	int err;
1323 
1324 	ip6_tnl_unlink(ip6n, t);
1325 	synchronize_net();
1326 	err = ip6_tnl_change(t, p);
1327 	ip6_tnl_link(ip6n, t);
1328 	netdev_state_change(t->dev);
1329 	return err;
1330 }
1331 
1332 static int ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
1333 {
1334 	/* for default tnl0 device allow to change only the proto */
1335 	t->parms.proto = p->proto;
1336 	netdev_state_change(t->dev);
1337 	return 0;
1338 }
1339 
1340 static void
1341 ip6_tnl_parm_from_user(struct __ip6_tnl_parm *p, const struct ip6_tnl_parm *u)
1342 {
1343 	p->laddr = u->laddr;
1344 	p->raddr = u->raddr;
1345 	p->flags = u->flags;
1346 	p->hop_limit = u->hop_limit;
1347 	p->encap_limit = u->encap_limit;
1348 	p->flowinfo = u->flowinfo;
1349 	p->link = u->link;
1350 	p->proto = u->proto;
1351 	memcpy(p->name, u->name, sizeof(u->name));
1352 }
1353 
1354 static void
1355 ip6_tnl_parm_to_user(struct ip6_tnl_parm *u, const struct __ip6_tnl_parm *p)
1356 {
1357 	u->laddr = p->laddr;
1358 	u->raddr = p->raddr;
1359 	u->flags = p->flags;
1360 	u->hop_limit = p->hop_limit;
1361 	u->encap_limit = p->encap_limit;
1362 	u->flowinfo = p->flowinfo;
1363 	u->link = p->link;
1364 	u->proto = p->proto;
1365 	memcpy(u->name, p->name, sizeof(u->name));
1366 }
1367 
1368 /**
1369  * ip6_tnl_ioctl - configure ipv6 tunnels from userspace
1370  *   @dev: virtual device associated with tunnel
1371  *   @ifr: parameters passed from userspace
1372  *   @cmd: command to be performed
1373  *
1374  * Description:
1375  *   ip6_tnl_ioctl() is used for managing IPv6 tunnels
1376  *   from userspace.
1377  *
1378  *   The possible commands are the following:
1379  *     %SIOCGETTUNNEL: get tunnel parameters for device
1380  *     %SIOCADDTUNNEL: add tunnel matching given tunnel parameters
1381  *     %SIOCCHGTUNNEL: change tunnel parameters to those given
1382  *     %SIOCDELTUNNEL: delete tunnel
1383  *
1384  *   The fallback device "ip6tnl0", created during module
1385  *   initialization, can be used for creating other tunnel devices.
1386  *
1387  * Return:
1388  *   0 on success,
1389  *   %-EFAULT if unable to copy data to or from userspace,
1390  *   %-EPERM if current process hasn't %CAP_NET_ADMIN set
1391  *   %-EINVAL if passed tunnel parameters are invalid,
1392  *   %-EEXIST if changing a tunnel's parameters would cause a conflict
1393  *   %-ENODEV if attempting to change or delete a nonexisting device
1394  **/
1395 
1396 static int
1397 ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
1398 {
1399 	int err = 0;
1400 	struct ip6_tnl_parm p;
1401 	struct __ip6_tnl_parm p1;
1402 	struct ip6_tnl *t = netdev_priv(dev);
1403 	struct net *net = t->net;
1404 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1405 
1406 	switch (cmd) {
1407 	case SIOCGETTUNNEL:
1408 		if (dev == ip6n->fb_tnl_dev) {
1409 			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
1410 				err = -EFAULT;
1411 				break;
1412 			}
1413 			ip6_tnl_parm_from_user(&p1, &p);
1414 			t = ip6_tnl_locate(net, &p1, 0);
1415 			if (IS_ERR(t))
1416 				t = netdev_priv(dev);
1417 		} else {
1418 			memset(&p, 0, sizeof(p));
1419 		}
1420 		ip6_tnl_parm_to_user(&p, &t->parms);
1421 		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p))) {
1422 			err = -EFAULT;
1423 		}
1424 		break;
1425 	case SIOCADDTUNNEL:
1426 	case SIOCCHGTUNNEL:
1427 		err = -EPERM;
1428 		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1429 			break;
1430 		err = -EFAULT;
1431 		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1432 			break;
1433 		err = -EINVAL;
1434 		if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
1435 		    p.proto != 0)
1436 			break;
1437 		ip6_tnl_parm_from_user(&p1, &p);
1438 		t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
1439 		if (cmd == SIOCCHGTUNNEL) {
1440 			if (!IS_ERR(t)) {
1441 				if (t->dev != dev) {
1442 					err = -EEXIST;
1443 					break;
1444 				}
1445 			} else
1446 				t = netdev_priv(dev);
1447 			if (dev == ip6n->fb_tnl_dev)
1448 				err = ip6_tnl0_update(t, &p1);
1449 			else
1450 				err = ip6_tnl_update(t, &p1);
1451 		}
1452 		if (!IS_ERR(t)) {
1453 			err = 0;
1454 			ip6_tnl_parm_to_user(&p, &t->parms);
1455 			if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
1456 				err = -EFAULT;
1457 
1458 		} else {
1459 			err = PTR_ERR(t);
1460 		}
1461 		break;
1462 	case SIOCDELTUNNEL:
1463 		err = -EPERM;
1464 		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1465 			break;
1466 
1467 		if (dev == ip6n->fb_tnl_dev) {
1468 			err = -EFAULT;
1469 			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1470 				break;
1471 			err = -ENOENT;
1472 			ip6_tnl_parm_from_user(&p1, &p);
1473 			t = ip6_tnl_locate(net, &p1, 0);
1474 			if (IS_ERR(t))
1475 				break;
1476 			err = -EPERM;
1477 			if (t->dev == ip6n->fb_tnl_dev)
1478 				break;
1479 			dev = t->dev;
1480 		}
1481 		err = 0;
1482 		unregister_netdevice(dev);
1483 		break;
1484 	default:
1485 		err = -EINVAL;
1486 	}
1487 	return err;
1488 }
1489 
1490 /**
1491  * ip6_tnl_change_mtu - change mtu manually for tunnel device
1492  *   @dev: virtual device associated with tunnel
1493  *   @new_mtu: the new mtu
1494  *
1495  * Return:
1496  *   0 on success,
1497  *   %-EINVAL if mtu too small
1498  **/
1499 
1500 static int
1501 ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
1502 {
1503 	struct ip6_tnl *tnl = netdev_priv(dev);
1504 
1505 	if (tnl->parms.proto == IPPROTO_IPIP) {
1506 		if (new_mtu < 68)
1507 			return -EINVAL;
1508 	} else {
1509 		if (new_mtu < IPV6_MIN_MTU)
1510 			return -EINVAL;
1511 	}
1512 	if (new_mtu > 0xFFF8 - dev->hard_header_len)
1513 		return -EINVAL;
1514 	dev->mtu = new_mtu;
1515 	return 0;
1516 }
1517 
1518 int ip6_tnl_get_iflink(const struct net_device *dev)
1519 {
1520 	struct ip6_tnl *t = netdev_priv(dev);
1521 
1522 	return t->parms.link;
1523 }
1524 EXPORT_SYMBOL(ip6_tnl_get_iflink);
1525 
1526 static const struct net_device_ops ip6_tnl_netdev_ops = {
1527 	.ndo_init	= ip6_tnl_dev_init,
1528 	.ndo_uninit	= ip6_tnl_dev_uninit,
1529 	.ndo_start_xmit = ip6_tnl_xmit,
1530 	.ndo_do_ioctl	= ip6_tnl_ioctl,
1531 	.ndo_change_mtu = ip6_tnl_change_mtu,
1532 	.ndo_get_stats	= ip6_get_stats,
1533 	.ndo_get_iflink = ip6_tnl_get_iflink,
1534 };
1535 
1536 
1537 /**
1538  * ip6_tnl_dev_setup - setup virtual tunnel device
1539  *   @dev: virtual device associated with tunnel
1540  *
1541  * Description:
1542  *   Initialize function pointers and device parameters
1543  **/
1544 
1545 static void ip6_tnl_dev_setup(struct net_device *dev)
1546 {
1547 	struct ip6_tnl *t;
1548 
1549 	dev->netdev_ops = &ip6_tnl_netdev_ops;
1550 	dev->destructor = ip6_dev_free;
1551 
1552 	dev->type = ARPHRD_TUNNEL6;
1553 	dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr);
1554 	dev->mtu = ETH_DATA_LEN - sizeof(struct ipv6hdr);
1555 	t = netdev_priv(dev);
1556 	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1557 		dev->mtu -= 8;
1558 	dev->flags |= IFF_NOARP;
1559 	dev->addr_len = sizeof(struct in6_addr);
1560 	netif_keep_dst(dev);
1561 	/* This perm addr will be used as interface identifier by IPv6 */
1562 	dev->addr_assign_type = NET_ADDR_RANDOM;
1563 	eth_random_addr(dev->perm_addr);
1564 }
1565 
1566 
1567 /**
1568  * ip6_tnl_dev_init_gen - general initializer for all tunnel devices
1569  *   @dev: virtual device associated with tunnel
1570  **/
1571 
1572 static inline int
1573 ip6_tnl_dev_init_gen(struct net_device *dev)
1574 {
1575 	struct ip6_tnl *t = netdev_priv(dev);
1576 
1577 	t->dev = dev;
1578 	t->net = dev_net(dev);
1579 	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
1580 	if (!dev->tstats)
1581 		return -ENOMEM;
1582 	return 0;
1583 }
1584 
1585 /**
1586  * ip6_tnl_dev_init - initializer for all non fallback tunnel devices
1587  *   @dev: virtual device associated with tunnel
1588  **/
1589 
1590 static int ip6_tnl_dev_init(struct net_device *dev)
1591 {
1592 	struct ip6_tnl *t = netdev_priv(dev);
1593 	int err = ip6_tnl_dev_init_gen(dev);
1594 
1595 	if (err)
1596 		return err;
1597 	ip6_tnl_link_config(t);
1598 	return 0;
1599 }
1600 
1601 /**
1602  * ip6_fb_tnl_dev_init - initializer for fallback tunnel device
1603  *   @dev: fallback device
1604  *
1605  * Return: 0
1606  **/
1607 
1608 static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
1609 {
1610 	struct ip6_tnl *t = netdev_priv(dev);
1611 	struct net *net = dev_net(dev);
1612 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1613 
1614 	t->parms.proto = IPPROTO_IPV6;
1615 	dev_hold(dev);
1616 
1617 	rcu_assign_pointer(ip6n->tnls_wc[0], t);
1618 	return 0;
1619 }
1620 
1621 static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[])
1622 {
1623 	u8 proto;
1624 
1625 	if (!data || !data[IFLA_IPTUN_PROTO])
1626 		return 0;
1627 
1628 	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1629 	if (proto != IPPROTO_IPV6 &&
1630 	    proto != IPPROTO_IPIP &&
1631 	    proto != 0)
1632 		return -EINVAL;
1633 
1634 	return 0;
1635 }
1636 
1637 static void ip6_tnl_netlink_parms(struct nlattr *data[],
1638 				  struct __ip6_tnl_parm *parms)
1639 {
1640 	memset(parms, 0, sizeof(*parms));
1641 
1642 	if (!data)
1643 		return;
1644 
1645 	if (data[IFLA_IPTUN_LINK])
1646 		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
1647 
1648 	if (data[IFLA_IPTUN_LOCAL])
1649 		parms->laddr = nla_get_in6_addr(data[IFLA_IPTUN_LOCAL]);
1650 
1651 	if (data[IFLA_IPTUN_REMOTE])
1652 		parms->raddr = nla_get_in6_addr(data[IFLA_IPTUN_REMOTE]);
1653 
1654 	if (data[IFLA_IPTUN_TTL])
1655 		parms->hop_limit = nla_get_u8(data[IFLA_IPTUN_TTL]);
1656 
1657 	if (data[IFLA_IPTUN_ENCAP_LIMIT])
1658 		parms->encap_limit = nla_get_u8(data[IFLA_IPTUN_ENCAP_LIMIT]);
1659 
1660 	if (data[IFLA_IPTUN_FLOWINFO])
1661 		parms->flowinfo = nla_get_be32(data[IFLA_IPTUN_FLOWINFO]);
1662 
1663 	if (data[IFLA_IPTUN_FLAGS])
1664 		parms->flags = nla_get_u32(data[IFLA_IPTUN_FLAGS]);
1665 
1666 	if (data[IFLA_IPTUN_PROTO])
1667 		parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1668 }
1669 
1670 static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
1671 			   struct nlattr *tb[], struct nlattr *data[])
1672 {
1673 	struct net *net = dev_net(dev);
1674 	struct ip6_tnl *nt, *t;
1675 
1676 	nt = netdev_priv(dev);
1677 	ip6_tnl_netlink_parms(data, &nt->parms);
1678 
1679 	t = ip6_tnl_locate(net, &nt->parms, 0);
1680 	if (!IS_ERR(t))
1681 		return -EEXIST;
1682 
1683 	return ip6_tnl_create2(dev);
1684 }
1685 
1686 static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
1687 			      struct nlattr *data[])
1688 {
1689 	struct ip6_tnl *t = netdev_priv(dev);
1690 	struct __ip6_tnl_parm p;
1691 	struct net *net = t->net;
1692 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1693 
1694 	if (dev == ip6n->fb_tnl_dev)
1695 		return -EINVAL;
1696 
1697 	ip6_tnl_netlink_parms(data, &p);
1698 
1699 	t = ip6_tnl_locate(net, &p, 0);
1700 	if (!IS_ERR(t)) {
1701 		if (t->dev != dev)
1702 			return -EEXIST;
1703 	} else
1704 		t = netdev_priv(dev);
1705 
1706 	return ip6_tnl_update(t, &p);
1707 }
1708 
1709 static void ip6_tnl_dellink(struct net_device *dev, struct list_head *head)
1710 {
1711 	struct net *net = dev_net(dev);
1712 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1713 
1714 	if (dev != ip6n->fb_tnl_dev)
1715 		unregister_netdevice_queue(dev, head);
1716 }
1717 
1718 static size_t ip6_tnl_get_size(const struct net_device *dev)
1719 {
1720 	return
1721 		/* IFLA_IPTUN_LINK */
1722 		nla_total_size(4) +
1723 		/* IFLA_IPTUN_LOCAL */
1724 		nla_total_size(sizeof(struct in6_addr)) +
1725 		/* IFLA_IPTUN_REMOTE */
1726 		nla_total_size(sizeof(struct in6_addr)) +
1727 		/* IFLA_IPTUN_TTL */
1728 		nla_total_size(1) +
1729 		/* IFLA_IPTUN_ENCAP_LIMIT */
1730 		nla_total_size(1) +
1731 		/* IFLA_IPTUN_FLOWINFO */
1732 		nla_total_size(4) +
1733 		/* IFLA_IPTUN_FLAGS */
1734 		nla_total_size(4) +
1735 		/* IFLA_IPTUN_PROTO */
1736 		nla_total_size(1) +
1737 		0;
1738 }
1739 
1740 static int ip6_tnl_fill_info(struct sk_buff *skb, const struct net_device *dev)
1741 {
1742 	struct ip6_tnl *tunnel = netdev_priv(dev);
1743 	struct __ip6_tnl_parm *parm = &tunnel->parms;
1744 
1745 	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
1746 	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
1747 	    nla_put_in6_addr(skb, IFLA_IPTUN_REMOTE, &parm->raddr) ||
1748 	    nla_put_u8(skb, IFLA_IPTUN_TTL, parm->hop_limit) ||
1749 	    nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
1750 	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
1751 	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
1752 	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto))
1753 		goto nla_put_failure;
1754 	return 0;
1755 
1756 nla_put_failure:
1757 	return -EMSGSIZE;
1758 }
1759 
1760 struct net *ip6_tnl_get_link_net(const struct net_device *dev)
1761 {
1762 	struct ip6_tnl *tunnel = netdev_priv(dev);
1763 
1764 	return tunnel->net;
1765 }
1766 EXPORT_SYMBOL(ip6_tnl_get_link_net);
1767 
1768 static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
1769 	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
1770 	[IFLA_IPTUN_LOCAL]		= { .len = sizeof(struct in6_addr) },
1771 	[IFLA_IPTUN_REMOTE]		= { .len = sizeof(struct in6_addr) },
1772 	[IFLA_IPTUN_TTL]		= { .type = NLA_U8 },
1773 	[IFLA_IPTUN_ENCAP_LIMIT]	= { .type = NLA_U8 },
1774 	[IFLA_IPTUN_FLOWINFO]		= { .type = NLA_U32 },
1775 	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U32 },
1776 	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
1777 };
1778 
1779 static struct rtnl_link_ops ip6_link_ops __read_mostly = {
1780 	.kind		= "ip6tnl",
1781 	.maxtype	= IFLA_IPTUN_MAX,
1782 	.policy		= ip6_tnl_policy,
1783 	.priv_size	= sizeof(struct ip6_tnl),
1784 	.setup		= ip6_tnl_dev_setup,
1785 	.validate	= ip6_tnl_validate,
1786 	.newlink	= ip6_tnl_newlink,
1787 	.changelink	= ip6_tnl_changelink,
1788 	.dellink	= ip6_tnl_dellink,
1789 	.get_size	= ip6_tnl_get_size,
1790 	.fill_info	= ip6_tnl_fill_info,
1791 	.get_link_net	= ip6_tnl_get_link_net,
1792 };
1793 
1794 static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
1795 	.handler	= ip4ip6_rcv,
1796 	.err_handler	= ip4ip6_err,
1797 	.priority	=	1,
1798 };
1799 
1800 static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
1801 	.handler	= ip6ip6_rcv,
1802 	.err_handler	= ip6ip6_err,
1803 	.priority	=	1,
1804 };
1805 
1806 static void __net_exit ip6_tnl_destroy_tunnels(struct net *net)
1807 {
1808 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1809 	struct net_device *dev, *aux;
1810 	int h;
1811 	struct ip6_tnl *t;
1812 	LIST_HEAD(list);
1813 
1814 	for_each_netdev_safe(net, dev, aux)
1815 		if (dev->rtnl_link_ops == &ip6_link_ops)
1816 			unregister_netdevice_queue(dev, &list);
1817 
1818 	for (h = 0; h < HASH_SIZE; h++) {
1819 		t = rtnl_dereference(ip6n->tnls_r_l[h]);
1820 		while (t) {
1821 			/* If dev is in the same netns, it has already
1822 			 * been added to the list by the previous loop.
1823 			 */
1824 			if (!net_eq(dev_net(t->dev), net))
1825 				unregister_netdevice_queue(t->dev, &list);
1826 			t = rtnl_dereference(t->next);
1827 		}
1828 	}
1829 
1830 	unregister_netdevice_many(&list);
1831 }
1832 
1833 static int __net_init ip6_tnl_init_net(struct net *net)
1834 {
1835 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1836 	struct ip6_tnl *t = NULL;
1837 	int err;
1838 
1839 	ip6n->tnls[0] = ip6n->tnls_wc;
1840 	ip6n->tnls[1] = ip6n->tnls_r_l;
1841 
1842 	err = -ENOMEM;
1843 	ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0",
1844 					NET_NAME_UNKNOWN, ip6_tnl_dev_setup);
1845 
1846 	if (!ip6n->fb_tnl_dev)
1847 		goto err_alloc_dev;
1848 	dev_net_set(ip6n->fb_tnl_dev, net);
1849 	ip6n->fb_tnl_dev->rtnl_link_ops = &ip6_link_ops;
1850 	/* FB netdevice is special: we have one, and only one per netns.
1851 	 * Allowing to move it to another netns is clearly unsafe.
1852 	 */
1853 	ip6n->fb_tnl_dev->features |= NETIF_F_NETNS_LOCAL;
1854 
1855 	err = ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
1856 	if (err < 0)
1857 		goto err_register;
1858 
1859 	err = register_netdev(ip6n->fb_tnl_dev);
1860 	if (err < 0)
1861 		goto err_register;
1862 
1863 	t = netdev_priv(ip6n->fb_tnl_dev);
1864 
1865 	strcpy(t->parms.name, ip6n->fb_tnl_dev->name);
1866 	return 0;
1867 
1868 err_register:
1869 	ip6_dev_free(ip6n->fb_tnl_dev);
1870 err_alloc_dev:
1871 	return err;
1872 }
1873 
1874 static void __net_exit ip6_tnl_exit_net(struct net *net)
1875 {
1876 	rtnl_lock();
1877 	ip6_tnl_destroy_tunnels(net);
1878 	rtnl_unlock();
1879 }
1880 
1881 static struct pernet_operations ip6_tnl_net_ops = {
1882 	.init = ip6_tnl_init_net,
1883 	.exit = ip6_tnl_exit_net,
1884 	.id   = &ip6_tnl_net_id,
1885 	.size = sizeof(struct ip6_tnl_net),
1886 };
1887 
1888 /**
1889  * ip6_tunnel_init - register protocol and reserve needed resources
1890  *
1891  * Return: 0 on success
1892  **/
1893 
1894 static int __init ip6_tunnel_init(void)
1895 {
1896 	int  err;
1897 
1898 	err = register_pernet_device(&ip6_tnl_net_ops);
1899 	if (err < 0)
1900 		goto out_pernet;
1901 
1902 	err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
1903 	if (err < 0) {
1904 		pr_err("%s: can't register ip4ip6\n", __func__);
1905 		goto out_ip4ip6;
1906 	}
1907 
1908 	err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
1909 	if (err < 0) {
1910 		pr_err("%s: can't register ip6ip6\n", __func__);
1911 		goto out_ip6ip6;
1912 	}
1913 	err = rtnl_link_register(&ip6_link_ops);
1914 	if (err < 0)
1915 		goto rtnl_link_failed;
1916 
1917 	return 0;
1918 
1919 rtnl_link_failed:
1920 	xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
1921 out_ip6ip6:
1922 	xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
1923 out_ip4ip6:
1924 	unregister_pernet_device(&ip6_tnl_net_ops);
1925 out_pernet:
1926 	return err;
1927 }
1928 
1929 /**
1930  * ip6_tunnel_cleanup - free resources and unregister protocol
1931  **/
1932 
1933 static void __exit ip6_tunnel_cleanup(void)
1934 {
1935 	rtnl_link_unregister(&ip6_link_ops);
1936 	if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
1937 		pr_info("%s: can't deregister ip4ip6\n", __func__);
1938 
1939 	if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
1940 		pr_info("%s: can't deregister ip6ip6\n", __func__);
1941 
1942 	unregister_pernet_device(&ip6_tnl_net_ops);
1943 }
1944 
1945 module_init(ip6_tunnel_init);
1946 module_exit(ip6_tunnel_cleanup);
1947