1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Vxlan vni filter for collect metadata mode 4 * 5 * Authors: Roopa Prabhu <roopa@nvidia.com> 6 * 7 */ 8 9 #include <linux/kernel.h> 10 #include <linux/slab.h> 11 #include <linux/etherdevice.h> 12 #include <linux/rhashtable.h> 13 #include <net/rtnetlink.h> 14 #include <net/net_namespace.h> 15 #include <net/sock.h> 16 #include <net/vxlan.h> 17 18 #include "vxlan_private.h" 19 20 static inline int vxlan_vni_cmp(struct rhashtable_compare_arg *arg, 21 const void *ptr) 22 { 23 const struct vxlan_vni_node *vnode = ptr; 24 __be32 vni = *(__be32 *)arg->key; 25 26 return vnode->vni != vni; 27 } 28 29 const struct rhashtable_params vxlan_vni_rht_params = { 30 .head_offset = offsetof(struct vxlan_vni_node, vnode), 31 .key_offset = offsetof(struct vxlan_vni_node, vni), 32 .key_len = sizeof(__be32), 33 .nelem_hint = 3, 34 .max_size = VXLAN_N_VID, 35 .obj_cmpfn = vxlan_vni_cmp, 36 .automatic_shrinking = true, 37 }; 38 39 static void vxlan_vs_add_del_vninode(struct vxlan_dev *vxlan, 40 struct vxlan_vni_node *v, 41 bool del) 42 { 43 struct vxlan_dev_node *node; 44 struct vxlan_sock *vs; 45 46 ASSERT_RTNL(); 47 48 if (del) { 49 if (!hlist_unhashed(&v->hlist4.hlist)) 50 hlist_del_init_rcu(&v->hlist4.hlist); 51 #if IS_ENABLED(CONFIG_IPV6) 52 if (!hlist_unhashed(&v->hlist6.hlist)) 53 hlist_del_init_rcu(&v->hlist6.hlist); 54 #endif 55 return; 56 } 57 58 #if IS_ENABLED(CONFIG_IPV6) 59 vs = rtnl_dereference(vxlan->vn6_sock); 60 if (vs && v) { 61 node = &v->hlist6; 62 hlist_add_head_rcu(&node->hlist, vni_head(vs, v->vni)); 63 } 64 #endif 65 vs = rtnl_dereference(vxlan->vn4_sock); 66 if (vs && v) { 67 node = &v->hlist4; 68 hlist_add_head_rcu(&node->hlist, vni_head(vs, v->vni)); 69 } 70 } 71 72 void vxlan_vs_add_vnigrp(struct vxlan_dev *vxlan, 73 struct vxlan_sock *vs, 74 bool ipv6) 75 { 76 struct vxlan_vni_group *vg = rtnl_dereference(vxlan->vnigrp); 77 struct vxlan_vni_node *v, *tmp; 78 struct vxlan_dev_node *node; 79 80 ASSERT_RTNL(); 81 82 if (!vg) 83 return; 84 85 list_for_each_entry_safe(v, tmp, &vg->vni_list, vlist) { 86 #if IS_ENABLED(CONFIG_IPV6) 87 if (ipv6) 88 node = &v->hlist6; 89 else 90 #endif 91 node = &v->hlist4; 92 node->vxlan = vxlan; 93 hlist_add_head_rcu(&node->hlist, vni_head(vs, v->vni)); 94 } 95 } 96 97 void vxlan_vs_del_vnigrp(struct vxlan_dev *vxlan) 98 { 99 struct vxlan_vni_group *vg = rtnl_dereference(vxlan->vnigrp); 100 struct vxlan_vni_node *v, *tmp; 101 102 ASSERT_RTNL(); 103 104 if (!vg) 105 return; 106 107 list_for_each_entry_safe(v, tmp, &vg->vni_list, vlist) { 108 hlist_del_init_rcu(&v->hlist4.hlist); 109 #if IS_ENABLED(CONFIG_IPV6) 110 hlist_del_init_rcu(&v->hlist6.hlist); 111 #endif 112 } 113 } 114 115 static void vxlan_vnifilter_stats_get(const struct vxlan_vni_node *vninode, 116 struct vxlan_vni_stats *dest) 117 { 118 int i; 119 120 memset(dest, 0, sizeof(*dest)); 121 for_each_possible_cpu(i) { 122 struct vxlan_vni_stats_pcpu *pstats; 123 struct vxlan_vni_stats temp; 124 unsigned int start; 125 126 pstats = per_cpu_ptr(vninode->stats, i); 127 do { 128 start = u64_stats_fetch_begin(&pstats->syncp); 129 u64_stats_copy(&temp, &pstats->stats, sizeof(temp)); 130 } while (u64_stats_fetch_retry(&pstats->syncp, start)); 131 132 dest->rx_packets += temp.rx_packets; 133 dest->rx_bytes += temp.rx_bytes; 134 dest->rx_drops += temp.rx_drops; 135 dest->rx_errors += temp.rx_errors; 136 dest->tx_packets += temp.tx_packets; 137 dest->tx_bytes += temp.tx_bytes; 138 dest->tx_drops += temp.tx_drops; 139 dest->tx_errors += temp.tx_errors; 140 } 141 } 142 143 static void vxlan_vnifilter_stats_add(struct vxlan_vni_node *vninode, 144 int type, unsigned int len) 145 { 146 struct vxlan_vni_stats_pcpu *pstats = this_cpu_ptr(vninode->stats); 147 148 u64_stats_update_begin(&pstats->syncp); 149 switch (type) { 150 case VXLAN_VNI_STATS_RX: 151 pstats->stats.rx_bytes += len; 152 pstats->stats.rx_packets++; 153 break; 154 case VXLAN_VNI_STATS_RX_DROPS: 155 pstats->stats.rx_drops++; 156 break; 157 case VXLAN_VNI_STATS_RX_ERRORS: 158 pstats->stats.rx_errors++; 159 break; 160 case VXLAN_VNI_STATS_TX: 161 pstats->stats.tx_bytes += len; 162 pstats->stats.tx_packets++; 163 break; 164 case VXLAN_VNI_STATS_TX_DROPS: 165 pstats->stats.tx_drops++; 166 break; 167 case VXLAN_VNI_STATS_TX_ERRORS: 168 pstats->stats.tx_errors++; 169 break; 170 } 171 u64_stats_update_end(&pstats->syncp); 172 } 173 174 void vxlan_vnifilter_count(struct vxlan_dev *vxlan, 175 const struct vxlan_config *cfg, __be32 vni, 176 struct vxlan_vni_node *vninode, 177 int type, unsigned int len) 178 { 179 struct vxlan_vni_node *vnode; 180 181 if (!(cfg->flags & VXLAN_F_VNIFILTER)) 182 return; 183 184 if (vninode) { 185 vnode = vninode; 186 } else { 187 vnode = vxlan_vnifilter_lookup(vxlan, vni); 188 if (!vnode) 189 return; 190 } 191 192 vxlan_vnifilter_stats_add(vnode, type, len); 193 } 194 195 static u32 vnirange(struct vxlan_vni_node *vbegin, 196 struct vxlan_vni_node *vend) 197 { 198 return (be32_to_cpu(vend->vni) - be32_to_cpu(vbegin->vni)); 199 } 200 201 static size_t vxlan_vnifilter_entry_nlmsg_size(void) 202 { 203 return NLMSG_ALIGN(sizeof(struct tunnel_msg)) 204 + nla_total_size(0) /* VXLAN_VNIFILTER_ENTRY */ 205 + nla_total_size(sizeof(u32)) /* VXLAN_VNIFILTER_ENTRY_START */ 206 + nla_total_size(sizeof(u32)) /* VXLAN_VNIFILTER_ENTRY_END */ 207 + nla_total_size(sizeof(struct in6_addr));/* VXLAN_VNIFILTER_ENTRY_GROUP{6} */ 208 } 209 210 static int __vnifilter_entry_fill_stats(struct sk_buff *skb, 211 const struct vxlan_vni_node *vbegin) 212 { 213 struct vxlan_vni_stats vstats; 214 struct nlattr *vstats_attr; 215 216 vstats_attr = nla_nest_start(skb, VXLAN_VNIFILTER_ENTRY_STATS); 217 if (!vstats_attr) 218 goto out_stats_err; 219 220 vxlan_vnifilter_stats_get(vbegin, &vstats); 221 if (nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_RX_BYTES, 222 vstats.rx_bytes, VNIFILTER_ENTRY_STATS_PAD) || 223 nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_RX_PKTS, 224 vstats.rx_packets, VNIFILTER_ENTRY_STATS_PAD) || 225 nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_RX_DROPS, 226 vstats.rx_drops, VNIFILTER_ENTRY_STATS_PAD) || 227 nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_RX_ERRORS, 228 vstats.rx_errors, VNIFILTER_ENTRY_STATS_PAD) || 229 nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_TX_BYTES, 230 vstats.tx_bytes, VNIFILTER_ENTRY_STATS_PAD) || 231 nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_TX_PKTS, 232 vstats.tx_packets, VNIFILTER_ENTRY_STATS_PAD) || 233 nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_TX_DROPS, 234 vstats.tx_drops, VNIFILTER_ENTRY_STATS_PAD) || 235 nla_put_u64_64bit(skb, VNIFILTER_ENTRY_STATS_TX_ERRORS, 236 vstats.tx_errors, VNIFILTER_ENTRY_STATS_PAD)) 237 goto out_stats_err; 238 239 nla_nest_end(skb, vstats_attr); 240 241 return 0; 242 243 out_stats_err: 244 nla_nest_cancel(skb, vstats_attr); 245 return -EMSGSIZE; 246 } 247 248 static bool vxlan_fill_vni_filter_entry(struct sk_buff *skb, 249 struct vxlan_vni_node *vbegin, 250 struct vxlan_vni_node *vend, 251 bool fill_stats) 252 { 253 struct nlattr *ventry; 254 u32 vs = be32_to_cpu(vbegin->vni); 255 u32 ve = 0; 256 257 if (vbegin != vend) 258 ve = be32_to_cpu(vend->vni); 259 260 ventry = nla_nest_start(skb, VXLAN_VNIFILTER_ENTRY); 261 if (!ventry) 262 return false; 263 264 if (nla_put_u32(skb, VXLAN_VNIFILTER_ENTRY_START, vs)) 265 goto out_err; 266 267 if (ve && nla_put_u32(skb, VXLAN_VNIFILTER_ENTRY_END, ve)) 268 goto out_err; 269 270 if (!vxlan_addr_any(&vbegin->remote_ip)) { 271 if (vbegin->remote_ip.sa.sa_family == AF_INET) { 272 if (nla_put_in_addr(skb, VXLAN_VNIFILTER_ENTRY_GROUP, 273 vbegin->remote_ip.sin.sin_addr.s_addr)) 274 goto out_err; 275 #if IS_ENABLED(CONFIG_IPV6) 276 } else { 277 if (nla_put_in6_addr(skb, VXLAN_VNIFILTER_ENTRY_GROUP6, 278 &vbegin->remote_ip.sin6.sin6_addr)) 279 goto out_err; 280 #endif 281 } 282 } 283 284 if (fill_stats && __vnifilter_entry_fill_stats(skb, vbegin)) 285 goto out_err; 286 287 nla_nest_end(skb, ventry); 288 289 return true; 290 291 out_err: 292 nla_nest_cancel(skb, ventry); 293 294 return false; 295 } 296 297 static void vxlan_vnifilter_notify(const struct vxlan_dev *vxlan, 298 struct vxlan_vni_node *vninode, int cmd) 299 { 300 struct tunnel_msg *tmsg; 301 struct sk_buff *skb; 302 struct nlmsghdr *nlh; 303 struct net *net = dev_net(vxlan->dev); 304 int err = -ENOBUFS; 305 306 skb = nlmsg_new(vxlan_vnifilter_entry_nlmsg_size(), GFP_KERNEL); 307 if (!skb) 308 goto out_err; 309 310 err = -EMSGSIZE; 311 nlh = nlmsg_put(skb, 0, 0, cmd, sizeof(*tmsg), 0); 312 if (!nlh) 313 goto out_err; 314 tmsg = nlmsg_data(nlh); 315 memset(tmsg, 0, sizeof(*tmsg)); 316 tmsg->family = AF_BRIDGE; 317 tmsg->ifindex = vxlan->dev->ifindex; 318 319 if (!vxlan_fill_vni_filter_entry(skb, vninode, vninode, false)) 320 goto out_err; 321 322 nlmsg_end(skb, nlh); 323 rtnl_notify(skb, net, 0, RTNLGRP_TUNNEL, NULL, GFP_KERNEL); 324 325 return; 326 327 out_err: 328 rtnl_set_sk_err(net, RTNLGRP_TUNNEL, err); 329 330 kfree_skb(skb); 331 } 332 333 static int vxlan_vnifilter_dump_dev(const struct net_device *dev, 334 struct sk_buff *skb, 335 struct netlink_callback *cb) 336 { 337 struct vxlan_vni_node *v, *vbegin = NULL, *vend = NULL; 338 struct vxlan_dev *vxlan = netdev_priv(dev); 339 struct tunnel_msg *new_tmsg, *tmsg; 340 const struct vxlan_config *cfg; 341 struct vxlan_vni_group *vg; 342 struct nlmsghdr *nlh; 343 int idx = 0, s_idx; 344 bool dump_stats; 345 int err = 0; 346 347 if (cb->args[2] != dev->ifindex) { 348 cb->args[1] = 0; 349 cb->args[2] = dev->ifindex; 350 } 351 s_idx = cb->args[1]; 352 353 cfg = rcu_dereference(vxlan->cfg); 354 if (!(cfg->flags & VXLAN_F_VNIFILTER)) { 355 cb->args[1] = 0; 356 cb->args[2] = 0; 357 return -EINVAL; 358 } 359 360 /* RCU needed because of the vni locking rules (rcu || rtnl) */ 361 vg = rcu_dereference(vxlan->vnigrp); 362 if (!vg || !vg->num_vnis) { 363 cb->args[1] = 0; 364 cb->args[2] = 0; 365 return 0; 366 } 367 368 tmsg = nlmsg_data(cb->nlh); 369 dump_stats = !!(tmsg->flags & TUNNEL_MSG_FLAG_STATS); 370 371 nlh = nlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, 372 RTM_NEWTUNNEL, sizeof(*new_tmsg), NLM_F_MULTI); 373 if (!nlh) 374 return -EMSGSIZE; 375 new_tmsg = nlmsg_data(nlh); 376 memset(new_tmsg, 0, sizeof(*new_tmsg)); 377 new_tmsg->family = PF_BRIDGE; 378 new_tmsg->ifindex = dev->ifindex; 379 380 list_for_each_entry_rcu(v, &vg->vni_list, vlist) { 381 if (idx < s_idx) { 382 idx++; 383 continue; 384 } 385 if (!vbegin) { 386 vbegin = v; 387 vend = v; 388 continue; 389 } 390 if (!dump_stats && vnirange(vend, v) == 1 && 391 vxlan_addr_equal(&v->remote_ip, &vend->remote_ip)) { 392 goto update_end; 393 } else { 394 if (!vxlan_fill_vni_filter_entry(skb, vbegin, vend, 395 dump_stats)) { 396 err = -EMSGSIZE; 397 break; 398 } 399 idx += vnirange(vbegin, vend) + 1; 400 vbegin = v; 401 } 402 update_end: 403 vend = v; 404 } 405 406 if (!err && vbegin) { 407 if (!vxlan_fill_vni_filter_entry(skb, vbegin, vend, dump_stats)) 408 err = -EMSGSIZE; 409 } 410 411 cb->args[1] = err ? idx : 0; 412 cb->args[2] = err ? dev->ifindex : 0; 413 414 nlmsg_end(skb, nlh); 415 416 nl_dump_check_consistent(cb, nlh); 417 418 return err; 419 } 420 421 static u32 vxlan_vnifilter_base_seq(const struct net *net) 422 { 423 const struct vxlan_net *vn = net_generic(net, vxlan_net_id); 424 u32 res = atomic_read(&vn->vnifilter_seq); 425 426 /* Must not return 0 (see nl_dump_check_consistent()) */ 427 if (!res) 428 res = 0x80000000; 429 return res; 430 } 431 432 static int vxlan_vnifilter_dump(struct sk_buff *skb, struct netlink_callback *cb) 433 { 434 int idx = 0, err = 0, s_idx = cb->args[0]; 435 struct net *net = sock_net(skb->sk); 436 struct tunnel_msg *tmsg; 437 struct net_device *dev; 438 439 tmsg = nlmsg_payload(cb->nlh, sizeof(*tmsg)); 440 if (!tmsg) { 441 NL_SET_ERR_MSG(cb->extack, "Invalid msg length"); 442 return -EINVAL; 443 } 444 445 if (tmsg->flags & ~TUNNEL_MSG_VALID_USER_FLAGS) { 446 NL_SET_ERR_MSG(cb->extack, "Invalid tunnelmsg flags in ancillary header"); 447 return -EINVAL; 448 } 449 450 rcu_read_lock(); 451 452 cb->seq = vxlan_vnifilter_base_seq(net); 453 454 if (tmsg->ifindex) { 455 dev = dev_get_by_index_rcu(net, tmsg->ifindex); 456 if (!dev) { 457 err = -ENODEV; 458 goto out_err; 459 } 460 if (!netif_is_vxlan(dev)) { 461 NL_SET_ERR_MSG(cb->extack, 462 "The device is not a vxlan device"); 463 err = -EINVAL; 464 goto out_err; 465 } 466 err = vxlan_vnifilter_dump_dev(dev, skb, cb); 467 /* if the dump completed without an error we return 0 here */ 468 if (err != -EMSGSIZE) 469 goto out_err; 470 } else { 471 for_each_netdev_rcu(net, dev) { 472 if (!netif_is_vxlan(dev)) 473 continue; 474 if (idx < s_idx) 475 goto skip; 476 err = vxlan_vnifilter_dump_dev(dev, skb, cb); 477 if (err == -EMSGSIZE) 478 break; 479 skip: 480 idx++; 481 } 482 } 483 cb->args[0] = idx; 484 rcu_read_unlock(); 485 486 return skb->len; 487 488 out_err: 489 rcu_read_unlock(); 490 491 return err; 492 } 493 494 static const struct nla_policy vni_filter_entry_policy[VXLAN_VNIFILTER_ENTRY_MAX + 1] = { 495 [VXLAN_VNIFILTER_ENTRY_START] = { .type = NLA_U32 }, 496 [VXLAN_VNIFILTER_ENTRY_END] = { .type = NLA_U32 }, 497 [VXLAN_VNIFILTER_ENTRY_GROUP] = NLA_POLICY_EXACT_LEN(sizeof_field(struct iphdr, daddr)), 498 [VXLAN_VNIFILTER_ENTRY_GROUP6] = NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 499 }; 500 501 static const struct nla_policy vni_filter_policy[VXLAN_VNIFILTER_MAX + 1] = { 502 [VXLAN_VNIFILTER_ENTRY] = NLA_POLICY_NESTED(vni_filter_entry_policy), 503 }; 504 505 bool vxlan_vnifilter_has_multicast(const struct vxlan_dev *vxlan) 506 { 507 struct vxlan_vni_group *vg = rtnl_dereference(vxlan->vnigrp); 508 struct vxlan_vni_node *v; 509 510 if (!vg) 511 return false; 512 513 list_for_each_entry(v, &vg->vni_list, vlist) { 514 if (vxlan_addr_multicast(&v->remote_ip)) 515 return true; 516 } 517 518 return false; 519 } 520 521 int vxlan_update_default_fdb_entry(struct vxlan_dev *vxlan, __be32 vni, 522 const union vxlan_addr *old_remote_ip, 523 const union vxlan_addr *remote_ip, 524 u32 old_ifindex, u32 new_ifindex, 525 struct netlink_ext_ack *extack) 526 { 527 const struct vxlan_config *cfg = rtnl_dereference(vxlan->cfg); 528 int err = 0; 529 530 if (old_remote_ip && remote_ip && 531 vxlan_addr_equal(old_remote_ip, remote_ip) && 532 old_ifindex == new_ifindex) 533 return 0; 534 535 spin_lock_bh(&vxlan->hash_lock); 536 if (remote_ip && !vxlan_addr_any(remote_ip)) { 537 union vxlan_addr rip = *remote_ip; 538 539 err = vxlan_fdb_update(vxlan, all_zeros_mac, 540 &rip, 541 NUD_REACHABLE | NUD_PERMANENT, 542 NLM_F_APPEND | NLM_F_CREATE, 543 cfg->dst_port, 544 vni, 545 vni, 546 new_ifindex, 547 NTF_SELF, 0, true, extack); 548 if (err && extack) { 549 spin_unlock_bh(&vxlan->hash_lock); 550 return err; 551 } 552 } 553 554 if (old_remote_ip && !vxlan_addr_any(old_remote_ip)) { 555 __vxlan_fdb_delete(vxlan, all_zeros_mac, 556 *old_remote_ip, 557 cfg->dst_port, 558 vni, vni, 559 old_ifindex, 560 true); 561 } 562 spin_unlock_bh(&vxlan->hash_lock); 563 564 return err; 565 } 566 567 static int vxlan_vni_update_group(struct vxlan_dev *vxlan, 568 struct vxlan_vni_node *vninode, 569 union vxlan_addr *group, 570 bool create, bool *changed, 571 struct netlink_ext_ack *extack) 572 { 573 struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); 574 const struct vxlan_config *cfg = rtnl_dereference(vxlan->cfg); 575 const union vxlan_addr *newrip = NULL, *oldrip = NULL; 576 union vxlan_addr old_remote_ip; 577 int ret = 0; 578 579 memcpy(&old_remote_ip, &vninode->remote_ip, sizeof(old_remote_ip)); 580 581 /* if per vni remote ip is not present use vxlan dev 582 * default dst remote ip for fdb entry 583 */ 584 if (group && !vxlan_addr_any(group)) { 585 newrip = group; 586 } else { 587 if (!vxlan_addr_any(&cfg->remote_ip)) 588 newrip = &cfg->remote_ip; 589 } 590 591 if (!create) { 592 if (!vxlan_addr_any(&old_remote_ip)) 593 oldrip = &old_remote_ip; 594 else if (!vxlan_addr_any(&cfg->remote_ip)) 595 oldrip = &cfg->remote_ip; 596 } 597 598 if (!newrip && !oldrip) 599 return 0; 600 601 if (!create && oldrip && newrip && vxlan_addr_equal(oldrip, newrip)) 602 return 0; 603 604 ret = vxlan_update_default_fdb_entry(vxlan, vninode->vni, 605 oldrip, newrip, 606 cfg->remote_ifindex, 607 cfg->remote_ifindex, 608 extack); 609 if (ret) 610 goto out; 611 612 if (group) { 613 memcpy(&vninode->remote_ip, group, sizeof(vninode->remote_ip)); 614 if (!create) 615 vxlan_vnifilter_seq_inc(dev_net(vxlan->dev)); 616 } 617 618 if (vxlan->dev->flags & IFF_UP) { 619 if (vxlan_addr_multicast(&old_remote_ip) && 620 !vxlan_group_used(vn, vxlan, vninode->vni, 621 &old_remote_ip, 622 cfg->remote_ifindex)) { 623 ret = vxlan_igmp_leave(vxlan, &old_remote_ip, 624 0); 625 if (ret == -EADDRNOTAVAIL) 626 ret = 0; 627 if (ret) 628 goto out; 629 } 630 631 if (vxlan_addr_multicast(&vninode->remote_ip)) { 632 ret = vxlan_igmp_join(vxlan, &vninode->remote_ip, 0); 633 if (ret == -EADDRINUSE) 634 ret = 0; 635 if (ret) 636 goto out; 637 } 638 } 639 640 *changed = true; 641 642 return 0; 643 out: 644 return ret; 645 } 646 647 int vxlan_vnilist_update_group(struct vxlan_dev *vxlan, 648 const union vxlan_addr *old_remote_ip, 649 const union vxlan_addr *new_remote_ip, 650 u32 old_ifindex, u32 new_ifindex, 651 struct netlink_ext_ack *extack) 652 { 653 const union vxlan_addr *oldrip, *newrip; 654 struct list_head *headp, *hpos; 655 struct vxlan_vni_group *vg; 656 struct vxlan_vni_node *vent; 657 int ret; 658 659 vg = rtnl_dereference(vxlan->vnigrp); 660 661 headp = &vg->vni_list; 662 list_for_each_prev(hpos, headp) { 663 vent = list_entry(hpos, struct vxlan_vni_node, vlist); 664 665 if (vxlan_addr_any(&vent->remote_ip)) { 666 oldrip = old_remote_ip; 667 newrip = new_remote_ip; 668 } else { 669 /* A vni with its own group keeps it, but its fdb entry 670 * is still keyed on the device remote_ifindex. 671 */ 672 oldrip = &vent->remote_ip; 673 newrip = &vent->remote_ip; 674 } 675 676 ret = vxlan_update_default_fdb_entry(vxlan, vent->vni, 677 oldrip, newrip, 678 old_ifindex, new_ifindex, 679 extack); 680 if (ret) 681 goto err_unwind; 682 } 683 684 return 0; 685 686 err_unwind: 687 list_for_each_continue(hpos, headp) { 688 vent = list_entry(hpos, struct vxlan_vni_node, vlist); 689 690 if (vxlan_addr_any(&vent->remote_ip)) { 691 oldrip = old_remote_ip; 692 newrip = new_remote_ip; 693 } else { 694 oldrip = &vent->remote_ip; 695 newrip = &vent->remote_ip; 696 } 697 698 vxlan_update_default_fdb_entry(vxlan, vent->vni, 699 newrip, oldrip, 700 new_ifindex, old_ifindex, 701 NULL); 702 } 703 return ret; 704 } 705 706 static void vxlan_vni_delete_group(struct vxlan_dev *vxlan, 707 struct vxlan_vni_node *vninode) 708 { 709 struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); 710 const struct vxlan_config *cfg = rtnl_dereference(vxlan->cfg); 711 712 /* if per vni remote_ip not present, delete the 713 * default dst remote_ip previously added for this vni 714 */ 715 if (!vxlan_addr_any(&vninode->remote_ip) || 716 !vxlan_addr_any(&cfg->remote_ip)) { 717 spin_lock_bh(&vxlan->hash_lock); 718 __vxlan_fdb_delete(vxlan, all_zeros_mac, 719 (vxlan_addr_any(&vninode->remote_ip) ? 720 cfg->remote_ip : vninode->remote_ip), 721 cfg->dst_port, 722 vninode->vni, vninode->vni, 723 cfg->remote_ifindex, 724 true); 725 spin_unlock_bh(&vxlan->hash_lock); 726 } 727 728 if (vxlan->dev->flags & IFF_UP) { 729 if (vxlan_addr_multicast(&vninode->remote_ip) && 730 !vxlan_group_used(vn, vxlan, vninode->vni, 731 &vninode->remote_ip, 732 cfg->remote_ifindex)) { 733 vxlan_igmp_leave(vxlan, &vninode->remote_ip, 0); 734 } 735 } 736 } 737 738 static int vxlan_vni_update(struct vxlan_dev *vxlan, 739 struct vxlan_vni_group *vg, 740 __be32 vni, union vxlan_addr *group, 741 bool *changed, 742 struct netlink_ext_ack *extack) 743 { 744 struct vxlan_vni_node *vninode; 745 int ret; 746 747 vninode = rhashtable_lookup_fast(&vg->vni_hash, &vni, 748 vxlan_vni_rht_params); 749 if (!vninode) 750 return 0; 751 752 ret = vxlan_vni_update_group(vxlan, vninode, group, false, changed, 753 extack); 754 if (ret) 755 return ret; 756 757 if (*changed) 758 vxlan_vnifilter_notify(vxlan, vninode, RTM_NEWTUNNEL); 759 760 return 0; 761 } 762 763 static void __vxlan_vni_add_list(struct vxlan_dev *vxlan, 764 struct vxlan_vni_group *vg, 765 struct vxlan_vni_node *v) 766 { 767 struct list_head *headp, *hpos; 768 struct vxlan_vni_node *vent; 769 770 headp = &vg->vni_list; 771 list_for_each_prev(hpos, headp) { 772 vent = list_entry(hpos, struct vxlan_vni_node, vlist); 773 if (be32_to_cpu(v->vni) < be32_to_cpu(vent->vni)) 774 continue; 775 else 776 break; 777 } 778 list_add_rcu(&v->vlist, hpos); 779 vg->num_vnis++; 780 vxlan_vnifilter_seq_inc(dev_net(vxlan->dev)); 781 } 782 783 static void __vxlan_vni_del_list(struct vxlan_dev *vxlan, 784 struct vxlan_vni_group *vg, 785 struct vxlan_vni_node *v) 786 { 787 list_del_rcu(&v->vlist); 788 vg->num_vnis--; 789 vxlan_vnifilter_seq_inc(dev_net(vxlan->dev)); 790 } 791 792 static struct vxlan_vni_node *vxlan_vni_alloc(struct vxlan_dev *vxlan, 793 __be32 vni) 794 { 795 struct vxlan_vni_node *vninode; 796 797 vninode = kzalloc_obj(*vninode); 798 if (!vninode) 799 return NULL; 800 vninode->stats = netdev_alloc_pcpu_stats(struct vxlan_vni_stats_pcpu); 801 if (!vninode->stats) { 802 kfree(vninode); 803 return NULL; 804 } 805 vninode->vni = vni; 806 vninode->hlist4.vxlan = vxlan; 807 #if IS_ENABLED(CONFIG_IPV6) 808 vninode->hlist6.vxlan = vxlan; 809 #endif 810 811 return vninode; 812 } 813 814 static void vxlan_vni_free(struct vxlan_vni_node *vninode) 815 { 816 free_percpu(vninode->stats); 817 kfree(vninode); 818 } 819 820 static int vxlan_vni_add(struct vxlan_dev *vxlan, 821 struct vxlan_vni_group *vg, 822 u32 vni, union vxlan_addr *group, 823 struct netlink_ext_ack *extack) 824 { 825 const struct vxlan_config *cfg = rtnl_dereference(vxlan->cfg); 826 struct vxlan_vni_node *vninode; 827 __be32 v = cpu_to_be32(vni); 828 bool changed = false; 829 int err = 0; 830 831 if (vxlan_vnifilter_lookup(vxlan, v)) 832 return vxlan_vni_update(vxlan, vg, v, group, &changed, extack); 833 834 err = vxlan_vni_in_use(vxlan->net, vxlan, cfg, v); 835 if (err) { 836 NL_SET_ERR_MSG(extack, "VNI in use"); 837 return err; 838 } 839 840 vninode = vxlan_vni_alloc(vxlan, v); 841 if (!vninode) 842 return -ENOMEM; 843 844 err = rhashtable_lookup_insert_fast(&vg->vni_hash, 845 &vninode->vnode, 846 vxlan_vni_rht_params); 847 if (err) { 848 vxlan_vni_free(vninode); 849 return err; 850 } 851 852 __vxlan_vni_add_list(vxlan, vg, vninode); 853 854 if (vxlan->dev->flags & IFF_UP) 855 vxlan_vs_add_del_vninode(vxlan, vninode, false); 856 857 err = vxlan_vni_update_group(vxlan, vninode, group, true, &changed, 858 extack); 859 860 vxlan_vnifilter_notify(vxlan, vninode, RTM_NEWTUNNEL); 861 862 return err; 863 } 864 865 static void vxlan_vni_node_rcu_free(struct rcu_head *rcu) 866 { 867 struct vxlan_vni_node *v; 868 869 v = container_of(rcu, struct vxlan_vni_node, rcu); 870 vxlan_vni_free(v); 871 } 872 873 static int vxlan_vni_del(struct vxlan_dev *vxlan, 874 struct vxlan_vni_group *vg, 875 u32 vni, struct netlink_ext_ack *extack) 876 { 877 struct vxlan_vni_node *vninode; 878 __be32 v = cpu_to_be32(vni); 879 int err = 0; 880 881 vg = rtnl_dereference(vxlan->vnigrp); 882 883 vninode = rhashtable_lookup_fast(&vg->vni_hash, &v, 884 vxlan_vni_rht_params); 885 if (!vninode) { 886 err = -ENOENT; 887 goto out; 888 } 889 890 vxlan_vni_delete_group(vxlan, vninode); 891 892 err = rhashtable_remove_fast(&vg->vni_hash, 893 &vninode->vnode, 894 vxlan_vni_rht_params); 895 if (err) 896 goto out; 897 898 __vxlan_vni_del_list(vxlan, vg, vninode); 899 900 vxlan_vnifilter_notify(vxlan, vninode, RTM_DELTUNNEL); 901 902 if (vxlan->dev->flags & IFF_UP) 903 vxlan_vs_add_del_vninode(vxlan, vninode, true); 904 905 call_rcu(&vninode->rcu, vxlan_vni_node_rcu_free); 906 907 return 0; 908 out: 909 return err; 910 } 911 912 static int vxlan_vni_add_del(struct vxlan_dev *vxlan, __u32 start_vni, 913 __u32 end_vni, union vxlan_addr *group, 914 int cmd, struct netlink_ext_ack *extack) 915 { 916 struct vxlan_vni_group *vg; 917 int v, err = 0; 918 919 vg = rtnl_dereference(vxlan->vnigrp); 920 921 for (v = start_vni; v <= end_vni; v++) { 922 switch (cmd) { 923 case RTM_NEWTUNNEL: 924 err = vxlan_vni_add(vxlan, vg, v, group, extack); 925 break; 926 case RTM_DELTUNNEL: 927 err = vxlan_vni_del(vxlan, vg, v, extack); 928 break; 929 default: 930 err = -EOPNOTSUPP; 931 break; 932 } 933 if (err) 934 goto out; 935 } 936 937 return 0; 938 out: 939 return err; 940 } 941 942 static int vxlan_process_vni_filter(struct vxlan_dev *vxlan, 943 struct nlattr *nlvnifilter, 944 int cmd, struct netlink_ext_ack *extack) 945 { 946 struct nlattr *vattrs[VXLAN_VNIFILTER_ENTRY_MAX + 1]; 947 const struct vxlan_config *cfg; 948 u32 vni_start = 0, vni_end = 0; 949 union vxlan_addr group; 950 int err; 951 952 err = nla_parse_nested(vattrs, 953 VXLAN_VNIFILTER_ENTRY_MAX, 954 nlvnifilter, vni_filter_entry_policy, 955 extack); 956 if (err) 957 return err; 958 959 if (vattrs[VXLAN_VNIFILTER_ENTRY_START]) { 960 vni_start = nla_get_u32(vattrs[VXLAN_VNIFILTER_ENTRY_START]); 961 vni_end = vni_start; 962 } 963 964 if (vattrs[VXLAN_VNIFILTER_ENTRY_END]) 965 vni_end = nla_get_u32(vattrs[VXLAN_VNIFILTER_ENTRY_END]); 966 967 if (!vni_start && !vni_end) { 968 NL_SET_ERR_MSG_ATTR(extack, nlvnifilter, 969 "vni start nor end found in vni entry"); 970 return -EINVAL; 971 } 972 973 if (vattrs[VXLAN_VNIFILTER_ENTRY_GROUP]) { 974 group.sin.sin_addr.s_addr = 975 nla_get_in_addr(vattrs[VXLAN_VNIFILTER_ENTRY_GROUP]); 976 group.sa.sa_family = AF_INET; 977 } else if (vattrs[VXLAN_VNIFILTER_ENTRY_GROUP6]) { 978 group.sin6.sin6_addr = 979 nla_get_in6_addr(vattrs[VXLAN_VNIFILTER_ENTRY_GROUP6]); 980 group.sa.sa_family = AF_INET6; 981 } else { 982 memset(&group, 0, sizeof(group)); 983 } 984 985 cfg = rtnl_dereference(vxlan->cfg); 986 if (vxlan_addr_multicast(&group) && !cfg->remote_ifindex) { 987 NL_SET_ERR_MSG(extack, 988 "Local interface required for multicast remote group"); 989 990 return -EINVAL; 991 } 992 993 err = vxlan_vni_add_del(vxlan, vni_start, vni_end, &group, cmd, 994 extack); 995 if (err) 996 return err; 997 998 return 0; 999 } 1000 1001 void vxlan_vnigroup_uninit(struct vxlan_dev *vxlan) 1002 { 1003 struct vxlan_vni_node *v, *tmp; 1004 struct vxlan_vni_group *vg; 1005 1006 vg = rtnl_dereference(vxlan->vnigrp); 1007 list_for_each_entry_safe(v, tmp, &vg->vni_list, vlist) { 1008 rhashtable_remove_fast(&vg->vni_hash, &v->vnode, 1009 vxlan_vni_rht_params); 1010 hlist_del_init_rcu(&v->hlist4.hlist); 1011 #if IS_ENABLED(CONFIG_IPV6) 1012 hlist_del_init_rcu(&v->hlist6.hlist); 1013 #endif 1014 __vxlan_vni_del_list(vxlan, vg, v); 1015 vxlan_vnifilter_notify(vxlan, v, RTM_DELTUNNEL); 1016 call_rcu(&v->rcu, vxlan_vni_node_rcu_free); 1017 } 1018 rhashtable_destroy(&vg->vni_hash); 1019 kfree(vg); 1020 } 1021 1022 int vxlan_vnigroup_init(struct vxlan_dev *vxlan) 1023 { 1024 struct vxlan_vni_group *vg; 1025 int ret; 1026 1027 vg = kzalloc_obj(*vg); 1028 if (!vg) 1029 return -ENOMEM; 1030 ret = rhashtable_init(&vg->vni_hash, &vxlan_vni_rht_params); 1031 if (ret) { 1032 kfree(vg); 1033 return ret; 1034 } 1035 INIT_LIST_HEAD(&vg->vni_list); 1036 rcu_assign_pointer(vxlan->vnigrp, vg); 1037 1038 return 0; 1039 } 1040 1041 static int vxlan_vnifilter_process(struct sk_buff *skb, struct nlmsghdr *nlh, 1042 struct netlink_ext_ack *extack) 1043 { 1044 struct net *net = sock_net(skb->sk); 1045 const struct vxlan_config *cfg; 1046 struct tunnel_msg *tmsg; 1047 struct vxlan_dev *vxlan; 1048 struct net_device *dev; 1049 struct nlattr *attr; 1050 int err, vnis = 0; 1051 int rem; 1052 1053 /* this should validate the header and check for remaining bytes */ 1054 err = nlmsg_parse(nlh, sizeof(*tmsg), NULL, VXLAN_VNIFILTER_MAX, 1055 vni_filter_policy, extack); 1056 if (err < 0) 1057 return err; 1058 1059 tmsg = nlmsg_data(nlh); 1060 dev = __dev_get_by_index(net, tmsg->ifindex); 1061 if (!dev) 1062 return -ENODEV; 1063 1064 if (!netif_is_vxlan(dev)) { 1065 NL_SET_ERR_MSG_MOD(extack, "The device is not a vxlan device"); 1066 return -EINVAL; 1067 } 1068 1069 vxlan = netdev_priv(dev); 1070 cfg = rtnl_dereference(vxlan->cfg); 1071 1072 if (!(cfg->flags & VXLAN_F_VNIFILTER)) 1073 return -EOPNOTSUPP; 1074 1075 nlmsg_for_each_attr_type(attr, VXLAN_VNIFILTER_ENTRY, nlh, 1076 sizeof(*tmsg), rem) { 1077 err = vxlan_process_vni_filter(vxlan, attr, nlh->nlmsg_type, 1078 extack); 1079 vnis++; 1080 if (err) 1081 break; 1082 } 1083 1084 if (!vnis) { 1085 NL_SET_ERR_MSG_MOD(extack, "No vnis found to process"); 1086 err = -EINVAL; 1087 } 1088 1089 return err; 1090 } 1091 1092 static const struct rtnl_msg_handler vxlan_vnifilter_rtnl_msg_handlers[] = { 1093 {THIS_MODULE, PF_BRIDGE, RTM_GETTUNNEL, NULL, vxlan_vnifilter_dump, 0}, 1094 {THIS_MODULE, PF_BRIDGE, RTM_NEWTUNNEL, vxlan_vnifilter_process, NULL, 0}, 1095 {THIS_MODULE, PF_BRIDGE, RTM_DELTUNNEL, vxlan_vnifilter_process, NULL, 0}, 1096 }; 1097 1098 int vxlan_vnifilter_init(void) 1099 { 1100 return rtnl_register_many(vxlan_vnifilter_rtnl_msg_handlers); 1101 } 1102 1103 void vxlan_vnifilter_uninit(void) 1104 { 1105 rtnl_unregister_many(vxlan_vnifilter_rtnl_msg_handlers); 1106 } 1107