1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * VXLAN: Virtual eXtensible Local Area Network 4 * 5 * Copyright (c) 2012-2013 Vyatta Inc. 6 */ 7 8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 9 10 #include <linux/kernel.h> 11 #include <linux/module.h> 12 #include <linux/errno.h> 13 #include <linux/slab.h> 14 #include <linux/udp.h> 15 #include <linux/igmp.h> 16 #include <linux/if_ether.h> 17 #include <linux/ethtool.h> 18 #include <linux/rhashtable.h> 19 #include <net/arp.h> 20 #include <net/ndisc.h> 21 #include <net/gro.h> 22 #include <net/ipv6_stubs.h> 23 #include <net/ip.h> 24 #include <net/icmp.h> 25 #include <net/rtnetlink.h> 26 #include <net/inet_ecn.h> 27 #include <net/net_namespace.h> 28 #include <net/netns/generic.h> 29 #include <net/netdev_lock.h> 30 #include <net/tun_proto.h> 31 #include <net/vxlan.h> 32 #include <net/nexthop.h> 33 34 #if IS_ENABLED(CONFIG_IPV6) 35 #include <net/ip6_tunnel.h> 36 #include <net/ip6_checksum.h> 37 #endif 38 39 #include "vxlan_private.h" 40 41 #define VXLAN_VERSION "0.1" 42 43 #define FDB_AGE_DEFAULT 300 /* 5 min */ 44 #define FDB_AGE_INTERVAL (10 * HZ) /* rescan interval */ 45 46 /* UDP port for VXLAN traffic. 47 * The IANA assigned port is 4789, but the Linux default is 8472 48 * for compatibility with early adopters. 49 */ 50 static unsigned short vxlan_port __read_mostly = 8472; 51 module_param_named(udp_port, vxlan_port, ushort, 0444); 52 MODULE_PARM_DESC(udp_port, "Destination UDP port"); 53 54 static bool log_ecn_error = true; 55 module_param(log_ecn_error, bool, 0644); 56 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN"); 57 58 unsigned int vxlan_net_id; 59 60 const u8 all_zeros_mac[ETH_ALEN + 2]; 61 static struct rtnl_link_ops vxlan_link_ops; 62 63 static int vxlan_sock_add(struct vxlan_dev *vxlan); 64 65 static void vxlan_vs_del_dev(struct vxlan_dev *vxlan); 66 67 static const struct rhashtable_params vxlan_fdb_rht_params = { 68 .head_offset = offsetof(struct vxlan_fdb, rhnode), 69 .key_offset = offsetof(struct vxlan_fdb, key), 70 .key_len = sizeof(struct vxlan_fdb_key), 71 .automatic_shrinking = true, 72 }; 73 74 static inline bool vxlan_collect_metadata(struct vxlan_sock *vs) 75 { 76 return vs->flags & VXLAN_F_COLLECT_METADATA || 77 ip_tunnel_collect_metadata(); 78 } 79 80 /* Find VXLAN socket based on network namespace, address family, UDP port, 81 * enabled unshareable flags and socket device binding (see l3mdev with 82 * non-default VRF). 83 */ 84 static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family, 85 __be16 port, u32 flags, int ifindex) 86 { 87 struct vxlan_sock *vs; 88 89 flags &= VXLAN_F_RCV_FLAGS; 90 91 hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) { 92 if (inet_sk(vs->sock->sk)->inet_sport == port && 93 vxlan_get_sk_family(vs) == family && 94 vs->flags == flags && 95 vs->sock->sk->sk_bound_dev_if == ifindex) 96 return vs; 97 } 98 return NULL; 99 } 100 101 static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, 102 int ifindex, __be32 vni, 103 struct vxlan_vni_node **vninode) 104 { 105 struct vxlan_vni_node *vnode; 106 struct vxlan_dev_node *node; 107 108 /* For flow based devices, map all packets to VNI 0 */ 109 if (vs->flags & VXLAN_F_COLLECT_METADATA && 110 !(vs->flags & VXLAN_F_VNIFILTER)) 111 vni = 0; 112 113 hlist_for_each_entry_rcu(node, vni_head(vs, vni), hlist) { 114 if (!node->vxlan) 115 continue; 116 vnode = NULL; 117 if (node->vxlan->cfg.flags & VXLAN_F_VNIFILTER) { 118 vnode = vxlan_vnifilter_lookup(node->vxlan, vni); 119 if (!vnode) 120 continue; 121 } else if (node->vxlan->default_dst.remote_vni != vni) { 122 continue; 123 } 124 125 if (IS_ENABLED(CONFIG_IPV6)) { 126 const struct vxlan_config *cfg = &node->vxlan->cfg; 127 128 if ((cfg->flags & VXLAN_F_IPV6_LINKLOCAL) && 129 cfg->remote_ifindex != ifindex) 130 continue; 131 } 132 133 if (vninode) 134 *vninode = vnode; 135 return node->vxlan; 136 } 137 138 return NULL; 139 } 140 141 /* Look up VNI in a per net namespace table */ 142 static struct vxlan_dev *vxlan_find_vni(struct net *net, int ifindex, 143 __be32 vni, sa_family_t family, 144 __be16 port, u32 flags) 145 { 146 struct vxlan_sock *vs; 147 148 vs = vxlan_find_sock(net, family, port, flags, ifindex); 149 if (!vs) 150 return NULL; 151 152 return vxlan_vs_find_vni(vs, ifindex, vni, NULL); 153 } 154 155 /* Fill in neighbour message in skbuff. */ 156 static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan, 157 const struct vxlan_fdb *fdb, 158 u32 portid, u32 seq, int type, unsigned int flags, 159 const struct vxlan_rdst *rdst) 160 { 161 unsigned long now = jiffies; 162 struct nda_cacheinfo ci; 163 bool send_ip, send_eth; 164 struct nlmsghdr *nlh; 165 struct nexthop *nh; 166 struct ndmsg *ndm; 167 int nh_family; 168 u32 nh_id; 169 170 nlh = nlmsg_put(skb, portid, seq, type, sizeof(*ndm), flags); 171 if (nlh == NULL) 172 return -EMSGSIZE; 173 174 ndm = nlmsg_data(nlh); 175 memset(ndm, 0, sizeof(*ndm)); 176 177 send_eth = send_ip = true; 178 179 rcu_read_lock(); 180 nh = rcu_dereference(fdb->nh); 181 if (nh) { 182 nh_family = nexthop_get_family(nh); 183 nh_id = nh->id; 184 } 185 rcu_read_unlock(); 186 187 if (type == RTM_GETNEIGH) { 188 if (rdst) { 189 send_ip = !vxlan_addr_any(&rdst->remote_ip); 190 ndm->ndm_family = send_ip ? rdst->remote_ip.sa.sa_family : AF_INET; 191 } else if (nh) { 192 ndm->ndm_family = nh_family; 193 } 194 send_eth = !is_zero_ether_addr(fdb->key.eth_addr); 195 } else 196 ndm->ndm_family = AF_BRIDGE; 197 ndm->ndm_state = fdb->state; 198 ndm->ndm_ifindex = vxlan->dev->ifindex; 199 ndm->ndm_flags = fdb->flags; 200 if (rdst && rdst->offloaded) 201 ndm->ndm_flags |= NTF_OFFLOADED; 202 ndm->ndm_type = RTN_UNICAST; 203 204 if (!net_eq(dev_net(vxlan->dev), vxlan->net) && 205 nla_put_s32(skb, NDA_LINK_NETNSID, 206 peernet2id(dev_net(vxlan->dev), vxlan->net))) 207 goto nla_put_failure; 208 209 if (send_eth && nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->key.eth_addr)) 210 goto nla_put_failure; 211 if (nh) { 212 if (nla_put_u32(skb, NDA_NH_ID, nh_id)) 213 goto nla_put_failure; 214 } else if (rdst) { 215 if (send_ip && vxlan_nla_put_addr(skb, NDA_DST, 216 &rdst->remote_ip)) 217 goto nla_put_failure; 218 219 if (rdst->remote_port && 220 rdst->remote_port != vxlan->cfg.dst_port && 221 nla_put_be16(skb, NDA_PORT, rdst->remote_port)) 222 goto nla_put_failure; 223 if (rdst->remote_vni != vxlan->default_dst.remote_vni && 224 nla_put_u32(skb, NDA_VNI, be32_to_cpu(rdst->remote_vni))) 225 goto nla_put_failure; 226 if (rdst->remote_ifindex && 227 nla_put_u32(skb, NDA_IFINDEX, rdst->remote_ifindex)) 228 goto nla_put_failure; 229 } 230 231 if ((vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA) && fdb->key.vni && 232 nla_put_u32(skb, NDA_SRC_VNI, 233 be32_to_cpu(fdb->key.vni))) 234 goto nla_put_failure; 235 236 ci.ndm_used = jiffies_to_clock_t(now - READ_ONCE(fdb->used)); 237 ci.ndm_confirmed = 0; 238 ci.ndm_updated = jiffies_to_clock_t(now - READ_ONCE(fdb->updated)); 239 ci.ndm_refcnt = 0; 240 241 if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci)) 242 goto nla_put_failure; 243 244 nlmsg_end(skb, nlh); 245 return 0; 246 247 nla_put_failure: 248 nlmsg_cancel(skb, nlh); 249 return -EMSGSIZE; 250 } 251 252 static inline size_t vxlan_nlmsg_size(void) 253 { 254 return NLMSG_ALIGN(sizeof(struct ndmsg)) 255 + nla_total_size(ETH_ALEN) /* NDA_LLADDR */ 256 + nla_total_size(sizeof(struct in6_addr)) /* NDA_DST */ 257 + nla_total_size(sizeof(__be16)) /* NDA_PORT */ 258 + nla_total_size(sizeof(__be32)) /* NDA_VNI */ 259 + nla_total_size(sizeof(__u32)) /* NDA_IFINDEX */ 260 + nla_total_size(sizeof(__s32)) /* NDA_LINK_NETNSID */ 261 + nla_total_size(sizeof(struct nda_cacheinfo)); 262 } 263 264 static void __vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb, 265 struct vxlan_rdst *rd, int type) 266 { 267 struct net *net = dev_net(vxlan->dev); 268 struct sk_buff *skb; 269 int err = -ENOBUFS; 270 271 skb = nlmsg_new(vxlan_nlmsg_size(), GFP_ATOMIC); 272 if (skb == NULL) 273 goto errout; 274 275 err = vxlan_fdb_info(skb, vxlan, fdb, 0, 0, type, 0, rd); 276 if (err < 0) { 277 /* -EMSGSIZE implies BUG in vxlan_nlmsg_size() */ 278 WARN_ON(err == -EMSGSIZE); 279 kfree_skb(skb); 280 goto errout; 281 } 282 283 rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC); 284 return; 285 errout: 286 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err); 287 } 288 289 static void vxlan_fdb_switchdev_notifier_info(const struct vxlan_dev *vxlan, 290 const struct vxlan_fdb *fdb, 291 const struct vxlan_rdst *rd, 292 struct netlink_ext_ack *extack, 293 struct switchdev_notifier_vxlan_fdb_info *fdb_info) 294 { 295 fdb_info->info.dev = vxlan->dev; 296 fdb_info->info.extack = extack; 297 fdb_info->remote_ip = rd->remote_ip; 298 fdb_info->remote_port = rd->remote_port; 299 fdb_info->remote_vni = rd->remote_vni; 300 fdb_info->remote_ifindex = rd->remote_ifindex; 301 memcpy(fdb_info->eth_addr, fdb->key.eth_addr, ETH_ALEN); 302 fdb_info->vni = fdb->key.vni; 303 fdb_info->offloaded = rd->offloaded; 304 fdb_info->added_by_user = fdb->flags & NTF_VXLAN_ADDED_BY_USER; 305 } 306 307 static int vxlan_fdb_switchdev_call_notifiers(struct vxlan_dev *vxlan, 308 struct vxlan_fdb *fdb, 309 struct vxlan_rdst *rd, 310 bool adding, 311 struct netlink_ext_ack *extack) 312 { 313 struct switchdev_notifier_vxlan_fdb_info info; 314 enum switchdev_notifier_type notifier_type; 315 int ret; 316 317 if (WARN_ON(!rd)) 318 return 0; 319 320 notifier_type = adding ? SWITCHDEV_VXLAN_FDB_ADD_TO_DEVICE 321 : SWITCHDEV_VXLAN_FDB_DEL_TO_DEVICE; 322 vxlan_fdb_switchdev_notifier_info(vxlan, fdb, rd, NULL, &info); 323 ret = call_switchdev_notifiers(notifier_type, vxlan->dev, 324 &info.info, extack); 325 return notifier_to_errno(ret); 326 } 327 328 static int vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb, 329 struct vxlan_rdst *rd, int type, bool swdev_notify, 330 struct netlink_ext_ack *extack) 331 { 332 int err; 333 334 if (swdev_notify && rd) { 335 switch (type) { 336 case RTM_NEWNEIGH: 337 err = vxlan_fdb_switchdev_call_notifiers(vxlan, fdb, rd, 338 true, extack); 339 if (err) 340 return err; 341 break; 342 case RTM_DELNEIGH: 343 vxlan_fdb_switchdev_call_notifiers(vxlan, fdb, rd, 344 false, extack); 345 break; 346 } 347 } 348 349 __vxlan_fdb_notify(vxlan, fdb, rd, type); 350 return 0; 351 } 352 353 static void vxlan_ip_miss(struct net_device *dev, union vxlan_addr *ipa) 354 { 355 struct vxlan_dev *vxlan = netdev_priv(dev); 356 struct vxlan_fdb f = { 357 .state = NUD_STALE, 358 }; 359 struct vxlan_rdst remote = { 360 .remote_ip = *ipa, /* goes to NDA_DST */ 361 .remote_vni = cpu_to_be32(VXLAN_N_VID), 362 }; 363 364 vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH, true, NULL); 365 } 366 367 static void vxlan_fdb_miss(struct vxlan_dev *vxlan, const u8 eth_addr[ETH_ALEN]) 368 { 369 struct vxlan_fdb f = { 370 .state = NUD_STALE, 371 }; 372 struct vxlan_rdst remote = { }; 373 374 memcpy(f.key.eth_addr, eth_addr, ETH_ALEN); 375 376 vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH, true, NULL); 377 } 378 379 /* Look up Ethernet address in forwarding table */ 380 static struct vxlan_fdb *vxlan_find_mac_rcu(struct vxlan_dev *vxlan, 381 const u8 *mac, __be32 vni) 382 { 383 struct vxlan_fdb_key key; 384 385 memset(&key, 0, sizeof(key)); 386 memcpy(key.eth_addr, mac, sizeof(key.eth_addr)); 387 if (!(vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA)) 388 key.vni = vxlan->default_dst.remote_vni; 389 else 390 key.vni = vni; 391 392 return rhashtable_lookup(&vxlan->fdb_hash_tbl, &key, 393 vxlan_fdb_rht_params); 394 } 395 396 static struct vxlan_fdb *vxlan_find_mac_tx(struct vxlan_dev *vxlan, 397 const u8 *mac, __be32 vni) 398 { 399 struct vxlan_fdb *f; 400 401 f = vxlan_find_mac_rcu(vxlan, mac, vni); 402 if (f) { 403 unsigned long now = jiffies; 404 405 if (READ_ONCE(f->used) != now) 406 WRITE_ONCE(f->used, now); 407 } 408 409 return f; 410 } 411 412 static struct vxlan_fdb *vxlan_find_mac(struct vxlan_dev *vxlan, 413 const u8 *mac, __be32 vni) 414 { 415 struct vxlan_fdb *f; 416 417 lockdep_assert_held_once(&vxlan->hash_lock); 418 419 rcu_read_lock(); 420 f = vxlan_find_mac_rcu(vxlan, mac, vni); 421 rcu_read_unlock(); 422 423 return f; 424 } 425 426 /* caller should hold vxlan->hash_lock */ 427 static struct vxlan_rdst *vxlan_fdb_find_rdst(struct vxlan_fdb *f, 428 union vxlan_addr *ip, __be16 port, 429 __be32 vni, __u32 ifindex) 430 { 431 struct vxlan_rdst *rd; 432 433 list_for_each_entry(rd, &f->remotes, list) { 434 if (vxlan_addr_equal(&rd->remote_ip, ip) && 435 rd->remote_port == port && 436 rd->remote_vni == vni && 437 rd->remote_ifindex == ifindex) 438 return rd; 439 } 440 441 return NULL; 442 } 443 444 int vxlan_fdb_find_uc(struct net_device *dev, const u8 *mac, __be32 vni, 445 struct switchdev_notifier_vxlan_fdb_info *fdb_info) 446 { 447 struct vxlan_dev *vxlan = netdev_priv(dev); 448 u8 eth_addr[ETH_ALEN + 2] = { 0 }; 449 struct vxlan_rdst *rdst; 450 struct vxlan_fdb *f; 451 int rc = 0; 452 453 if (is_multicast_ether_addr(mac) || 454 is_zero_ether_addr(mac)) 455 return -EINVAL; 456 457 ether_addr_copy(eth_addr, mac); 458 459 rcu_read_lock(); 460 461 f = vxlan_find_mac_rcu(vxlan, eth_addr, vni); 462 if (!f) { 463 rc = -ENOENT; 464 goto out; 465 } 466 467 rdst = first_remote_rcu(f); 468 vxlan_fdb_switchdev_notifier_info(vxlan, f, rdst, NULL, fdb_info); 469 470 out: 471 rcu_read_unlock(); 472 return rc; 473 } 474 EXPORT_SYMBOL_GPL(vxlan_fdb_find_uc); 475 476 static int vxlan_fdb_notify_one(struct notifier_block *nb, 477 const struct vxlan_dev *vxlan, 478 const struct vxlan_fdb *f, 479 const struct vxlan_rdst *rdst, 480 struct netlink_ext_ack *extack) 481 { 482 struct switchdev_notifier_vxlan_fdb_info fdb_info; 483 int rc; 484 485 vxlan_fdb_switchdev_notifier_info(vxlan, f, rdst, extack, &fdb_info); 486 rc = nb->notifier_call(nb, SWITCHDEV_VXLAN_FDB_ADD_TO_DEVICE, 487 &fdb_info); 488 return notifier_to_errno(rc); 489 } 490 491 int vxlan_fdb_replay(const struct net_device *dev, __be32 vni, 492 struct notifier_block *nb, 493 struct netlink_ext_ack *extack) 494 { 495 struct vxlan_dev *vxlan; 496 struct vxlan_rdst *rdst; 497 struct vxlan_fdb *f; 498 int rc = 0; 499 500 if (!netif_is_vxlan(dev)) 501 return -EINVAL; 502 vxlan = netdev_priv(dev); 503 504 spin_lock_bh(&vxlan->hash_lock); 505 hlist_for_each_entry(f, &vxlan->fdb_list, fdb_node) { 506 if (f->key.vni == vni) { 507 list_for_each_entry(rdst, &f->remotes, list) { 508 rc = vxlan_fdb_notify_one(nb, vxlan, f, rdst, 509 extack); 510 if (rc) 511 goto unlock; 512 } 513 } 514 } 515 spin_unlock_bh(&vxlan->hash_lock); 516 return 0; 517 518 unlock: 519 spin_unlock_bh(&vxlan->hash_lock); 520 return rc; 521 } 522 EXPORT_SYMBOL_GPL(vxlan_fdb_replay); 523 524 void vxlan_fdb_clear_offload(const struct net_device *dev, __be32 vni) 525 { 526 struct vxlan_dev *vxlan; 527 struct vxlan_rdst *rdst; 528 struct vxlan_fdb *f; 529 530 if (!netif_is_vxlan(dev)) 531 return; 532 vxlan = netdev_priv(dev); 533 534 spin_lock_bh(&vxlan->hash_lock); 535 hlist_for_each_entry(f, &vxlan->fdb_list, fdb_node) { 536 if (f->key.vni == vni) { 537 list_for_each_entry(rdst, &f->remotes, list) 538 rdst->offloaded = false; 539 } 540 } 541 spin_unlock_bh(&vxlan->hash_lock); 542 543 } 544 EXPORT_SYMBOL_GPL(vxlan_fdb_clear_offload); 545 546 /* Replace destination of unicast mac */ 547 static int vxlan_fdb_replace(struct vxlan_fdb *f, 548 union vxlan_addr *ip, __be16 port, __be32 vni, 549 __u32 ifindex, struct vxlan_rdst *oldrd) 550 { 551 struct vxlan_rdst *rd; 552 553 rd = vxlan_fdb_find_rdst(f, ip, port, vni, ifindex); 554 if (rd) 555 return 0; 556 557 rd = list_first_entry_or_null(&f->remotes, struct vxlan_rdst, list); 558 if (!rd) 559 return 0; 560 561 *oldrd = *rd; 562 dst_cache_reset(&rd->dst_cache); 563 rd->remote_ip = *ip; 564 rd->remote_port = port; 565 rd->remote_vni = vni; 566 rd->remote_ifindex = ifindex; 567 rd->offloaded = false; 568 return 1; 569 } 570 571 /* Add/update destinations for multicast */ 572 static int vxlan_fdb_append(struct vxlan_fdb *f, 573 union vxlan_addr *ip, __be16 port, __be32 vni, 574 __u32 ifindex, struct vxlan_rdst **rdp) 575 { 576 struct vxlan_rdst *rd; 577 578 rd = vxlan_fdb_find_rdst(f, ip, port, vni, ifindex); 579 if (rd) 580 return 0; 581 582 rd = kmalloc(sizeof(*rd), GFP_ATOMIC); 583 if (rd == NULL) 584 return -ENOMEM; 585 586 /* The driver can work correctly without a dst cache, so do not treat 587 * dst cache initialization errors as fatal. 588 */ 589 dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN); 590 591 rd->remote_ip = *ip; 592 rd->remote_port = port; 593 rd->offloaded = false; 594 rd->remote_vni = vni; 595 rd->remote_ifindex = ifindex; 596 597 list_add_tail_rcu(&rd->list, &f->remotes); 598 599 *rdp = rd; 600 return 1; 601 } 602 603 static bool vxlan_parse_gpe_proto(const struct vxlanhdr *hdr, __be16 *protocol) 604 { 605 const struct vxlanhdr_gpe *gpe = (const struct vxlanhdr_gpe *)hdr; 606 607 /* Need to have Next Protocol set for interfaces in GPE mode. */ 608 if (!gpe->np_applied) 609 return false; 610 /* "The initial version is 0. If a receiver does not support the 611 * version indicated it MUST drop the packet. 612 */ 613 if (gpe->version != 0) 614 return false; 615 /* "When the O bit is set to 1, the packet is an OAM packet and OAM 616 * processing MUST occur." However, we don't implement OAM 617 * processing, thus drop the packet. 618 */ 619 if (gpe->oam_flag) 620 return false; 621 622 *protocol = tun_p_to_eth_p(gpe->next_protocol); 623 if (!*protocol) 624 return false; 625 626 return true; 627 } 628 629 static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb, 630 unsigned int off, 631 struct vxlanhdr *vh, size_t hdrlen, 632 __be32 vni_field, 633 struct gro_remcsum *grc, 634 bool nopartial) 635 { 636 size_t start, offset; 637 638 if (skb->remcsum_offload) 639 return vh; 640 641 if (!NAPI_GRO_CB(skb)->csum_valid) 642 return NULL; 643 644 start = vxlan_rco_start(vni_field); 645 offset = start + vxlan_rco_offset(vni_field); 646 647 vh = skb_gro_remcsum_process(skb, (void *)vh, off, hdrlen, 648 start, offset, grc, nopartial); 649 650 skb->remcsum_offload = 1; 651 652 return vh; 653 } 654 655 static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk, 656 struct list_head *head, 657 struct sk_buff *skb, 658 struct gro_remcsum *grc) 659 { 660 struct sk_buff *p; 661 struct vxlanhdr *vh, *vh2; 662 unsigned int hlen, off_vx; 663 struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk); 664 __be32 flags; 665 666 skb_gro_remcsum_init(grc); 667 668 off_vx = skb_gro_offset(skb); 669 hlen = off_vx + sizeof(*vh); 670 vh = skb_gro_header(skb, hlen, off_vx); 671 if (unlikely(!vh)) 672 return NULL; 673 674 skb_gro_postpull_rcsum(skb, vh, sizeof(struct vxlanhdr)); 675 676 flags = vh->vx_flags; 677 678 if ((flags & VXLAN_HF_RCO) && (vs->flags & VXLAN_F_REMCSUM_RX)) { 679 vh = vxlan_gro_remcsum(skb, off_vx, vh, sizeof(struct vxlanhdr), 680 vh->vx_vni, grc, 681 !!(vs->flags & 682 VXLAN_F_REMCSUM_NOPARTIAL)); 683 684 if (!vh) 685 return NULL; 686 } 687 688 skb_gro_pull(skb, sizeof(struct vxlanhdr)); /* pull vxlan header */ 689 690 list_for_each_entry(p, head, list) { 691 if (!NAPI_GRO_CB(p)->same_flow) 692 continue; 693 694 vh2 = (struct vxlanhdr *)(p->data + off_vx); 695 if (vh->vx_flags != vh2->vx_flags || 696 vh->vx_vni != vh2->vx_vni) { 697 NAPI_GRO_CB(p)->same_flow = 0; 698 continue; 699 } 700 } 701 702 return vh; 703 } 704 705 static struct sk_buff *vxlan_gro_receive(struct sock *sk, 706 struct list_head *head, 707 struct sk_buff *skb) 708 { 709 struct sk_buff *pp = NULL; 710 struct gro_remcsum grc; 711 int flush = 1; 712 713 if (vxlan_gro_prepare_receive(sk, head, skb, &grc)) { 714 pp = call_gro_receive(eth_gro_receive, head, skb); 715 flush = 0; 716 } 717 skb_gro_flush_final_remcsum(skb, pp, flush, &grc); 718 return pp; 719 } 720 721 static struct sk_buff *vxlan_gpe_gro_receive(struct sock *sk, 722 struct list_head *head, 723 struct sk_buff *skb) 724 { 725 const struct packet_offload *ptype; 726 struct sk_buff *pp = NULL; 727 struct gro_remcsum grc; 728 struct vxlanhdr *vh; 729 __be16 protocol; 730 int flush = 1; 731 732 vh = vxlan_gro_prepare_receive(sk, head, skb, &grc); 733 if (vh) { 734 if (!vxlan_parse_gpe_proto(vh, &protocol)) 735 goto out; 736 ptype = gro_find_receive_by_type(protocol); 737 if (!ptype) 738 goto out; 739 pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb); 740 flush = 0; 741 } 742 out: 743 skb_gro_flush_final_remcsum(skb, pp, flush, &grc); 744 return pp; 745 } 746 747 static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff) 748 { 749 /* Sets 'skb->inner_mac_header' since we are always called with 750 * 'skb->encapsulation' set. 751 */ 752 return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr)); 753 } 754 755 static int vxlan_gpe_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff) 756 { 757 struct vxlanhdr *vh = (struct vxlanhdr *)(skb->data + nhoff); 758 const struct packet_offload *ptype; 759 int err = -ENOSYS; 760 __be16 protocol; 761 762 if (!vxlan_parse_gpe_proto(vh, &protocol)) 763 return err; 764 ptype = gro_find_complete_by_type(protocol); 765 if (ptype) 766 err = ptype->callbacks.gro_complete(skb, nhoff + sizeof(struct vxlanhdr)); 767 return err; 768 } 769 770 static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan, const u8 *mac, 771 __u16 state, __be32 src_vni, 772 __u16 ndm_flags) 773 { 774 struct vxlan_fdb *f; 775 776 f = kmalloc(sizeof(*f), GFP_ATOMIC); 777 if (!f) 778 return NULL; 779 memset(&f->key, 0, sizeof(f->key)); 780 f->state = state; 781 f->flags = ndm_flags; 782 f->updated = f->used = jiffies; 783 f->key.vni = src_vni; 784 f->nh = NULL; 785 RCU_INIT_POINTER(f->vdev, vxlan); 786 INIT_LIST_HEAD(&f->nh_list); 787 INIT_LIST_HEAD(&f->remotes); 788 memcpy(f->key.eth_addr, mac, ETH_ALEN); 789 790 return f; 791 } 792 793 static int vxlan_fdb_nh_update(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb, 794 u32 nhid, struct netlink_ext_ack *extack) 795 { 796 struct nexthop *old_nh = rtnl_dereference(fdb->nh); 797 struct nexthop *nh; 798 int err = -EINVAL; 799 800 if (old_nh && old_nh->id == nhid) 801 return 0; 802 803 nh = nexthop_find_by_id(vxlan->net, nhid); 804 if (!nh) { 805 NL_SET_ERR_MSG(extack, "Nexthop id does not exist"); 806 goto err_inval; 807 } 808 809 if (!nexthop_get(nh)) { 810 NL_SET_ERR_MSG(extack, "Nexthop has been deleted"); 811 nh = NULL; 812 goto err_inval; 813 } 814 if (!nexthop_is_fdb(nh)) { 815 NL_SET_ERR_MSG(extack, "Nexthop is not a fdb nexthop"); 816 goto err_inval; 817 } 818 819 if (!nexthop_is_multipath(nh)) { 820 NL_SET_ERR_MSG(extack, "Nexthop is not a multipath group"); 821 goto err_inval; 822 } 823 824 /* check nexthop group family */ 825 switch (vxlan->default_dst.remote_ip.sa.sa_family) { 826 case AF_INET: 827 if (!nexthop_has_v4(nh)) { 828 err = -EAFNOSUPPORT; 829 NL_SET_ERR_MSG(extack, "Nexthop group family not supported"); 830 goto err_inval; 831 } 832 break; 833 case AF_INET6: 834 if (nexthop_has_v4(nh)) { 835 err = -EAFNOSUPPORT; 836 NL_SET_ERR_MSG(extack, "Nexthop group family not supported"); 837 goto err_inval; 838 } 839 } 840 841 if (old_nh) { 842 list_del_rcu(&fdb->nh_list); 843 nexthop_put(old_nh); 844 } 845 rcu_assign_pointer(fdb->nh, nh); 846 list_add_tail_rcu(&fdb->nh_list, &nh->fdb_list); 847 return 1; 848 849 err_inval: 850 if (nh) 851 nexthop_put(nh); 852 return err; 853 } 854 855 int vxlan_fdb_create(struct vxlan_dev *vxlan, 856 const u8 *mac, union vxlan_addr *ip, 857 __u16 state, __be16 port, __be32 src_vni, 858 __be32 vni, __u32 ifindex, __u16 ndm_flags, 859 u32 nhid, struct vxlan_fdb **fdb, 860 struct netlink_ext_ack *extack) 861 { 862 struct vxlan_rdst *rd = NULL; 863 struct vxlan_fdb *f; 864 int rc; 865 866 if (vxlan->cfg.addrmax && 867 vxlan->addrcnt >= vxlan->cfg.addrmax) 868 return -ENOSPC; 869 870 netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip); 871 f = vxlan_fdb_alloc(vxlan, mac, state, src_vni, ndm_flags); 872 if (!f) 873 return -ENOMEM; 874 875 if (nhid) 876 rc = vxlan_fdb_nh_update(vxlan, f, nhid, extack); 877 else 878 rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd); 879 if (rc < 0) 880 goto errout; 881 882 rc = rhashtable_lookup_insert_fast(&vxlan->fdb_hash_tbl, &f->rhnode, 883 vxlan_fdb_rht_params); 884 if (rc) 885 goto destroy_remote; 886 887 ++vxlan->addrcnt; 888 hlist_add_head_rcu(&f->fdb_node, &vxlan->fdb_list); 889 890 *fdb = f; 891 892 return 0; 893 894 destroy_remote: 895 if (rcu_access_pointer(f->nh)) { 896 list_del_rcu(&f->nh_list); 897 nexthop_put(rtnl_dereference(f->nh)); 898 } else { 899 list_del(&rd->list); 900 dst_cache_destroy(&rd->dst_cache); 901 kfree(rd); 902 } 903 errout: 904 kfree(f); 905 return rc; 906 } 907 908 static void __vxlan_fdb_free(struct vxlan_fdb *f) 909 { 910 struct vxlan_rdst *rd, *nd; 911 struct nexthop *nh; 912 913 nh = rcu_dereference_raw(f->nh); 914 if (nh) { 915 rcu_assign_pointer(f->nh, NULL); 916 rcu_assign_pointer(f->vdev, NULL); 917 nexthop_put(nh); 918 } 919 920 list_for_each_entry_safe(rd, nd, &f->remotes, list) { 921 dst_cache_destroy(&rd->dst_cache); 922 kfree(rd); 923 } 924 kfree(f); 925 } 926 927 static void vxlan_fdb_free(struct rcu_head *head) 928 { 929 struct vxlan_fdb *f = container_of(head, struct vxlan_fdb, rcu); 930 931 __vxlan_fdb_free(f); 932 } 933 934 static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f, 935 bool do_notify, bool swdev_notify) 936 { 937 struct vxlan_rdst *rd; 938 939 netdev_dbg(vxlan->dev, "delete %pM\n", f->key.eth_addr); 940 941 --vxlan->addrcnt; 942 if (do_notify) { 943 if (rcu_access_pointer(f->nh)) 944 vxlan_fdb_notify(vxlan, f, NULL, RTM_DELNEIGH, 945 swdev_notify, NULL); 946 else 947 list_for_each_entry(rd, &f->remotes, list) 948 vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH, 949 swdev_notify, NULL); 950 } 951 952 hlist_del_init_rcu(&f->fdb_node); 953 rhashtable_remove_fast(&vxlan->fdb_hash_tbl, &f->rhnode, 954 vxlan_fdb_rht_params); 955 list_del_rcu(&f->nh_list); 956 call_rcu(&f->rcu, vxlan_fdb_free); 957 } 958 959 static void vxlan_dst_free(struct rcu_head *head) 960 { 961 struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu); 962 963 dst_cache_destroy(&rd->dst_cache); 964 kfree(rd); 965 } 966 967 static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan, 968 union vxlan_addr *ip, 969 __u16 state, __u16 flags, 970 __be16 port, __be32 vni, 971 __u32 ifindex, __u16 ndm_flags, 972 struct vxlan_fdb *f, u32 nhid, 973 bool swdev_notify, 974 struct netlink_ext_ack *extack) 975 { 976 __u16 fdb_flags = (ndm_flags & ~NTF_USE); 977 struct vxlan_rdst *rd = NULL; 978 struct vxlan_rdst oldrd; 979 int notify = 0; 980 int rc = 0; 981 int err; 982 983 if (nhid && !rcu_access_pointer(f->nh)) { 984 NL_SET_ERR_MSG(extack, 985 "Cannot replace an existing non nexthop fdb with a nexthop"); 986 return -EOPNOTSUPP; 987 } 988 989 if (nhid && (flags & NLM_F_APPEND)) { 990 NL_SET_ERR_MSG(extack, 991 "Cannot append to a nexthop fdb"); 992 return -EOPNOTSUPP; 993 } 994 995 /* Do not allow an externally learned entry to take over an entry added 996 * by the user. 997 */ 998 if (!(fdb_flags & NTF_EXT_LEARNED) || 999 !(f->flags & NTF_VXLAN_ADDED_BY_USER)) { 1000 if (f->state != state) { 1001 f->state = state; 1002 notify = 1; 1003 } 1004 if (f->flags != fdb_flags) { 1005 f->flags = fdb_flags; 1006 notify = 1; 1007 } 1008 } 1009 1010 if ((flags & NLM_F_REPLACE)) { 1011 /* Only change unicasts */ 1012 if (!(is_multicast_ether_addr(f->key.eth_addr) || 1013 is_zero_ether_addr(f->key.eth_addr))) { 1014 if (nhid) { 1015 rc = vxlan_fdb_nh_update(vxlan, f, nhid, extack); 1016 if (rc < 0) 1017 return rc; 1018 } else { 1019 rc = vxlan_fdb_replace(f, ip, port, vni, 1020 ifindex, &oldrd); 1021 } 1022 notify |= rc; 1023 } else { 1024 NL_SET_ERR_MSG(extack, "Cannot replace non-unicast fdb entries"); 1025 return -EOPNOTSUPP; 1026 } 1027 } 1028 if ((flags & NLM_F_APPEND) && 1029 (is_multicast_ether_addr(f->key.eth_addr) || 1030 is_zero_ether_addr(f->key.eth_addr))) { 1031 rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd); 1032 1033 if (rc < 0) 1034 return rc; 1035 notify |= rc; 1036 } 1037 1038 if (ndm_flags & NTF_USE) 1039 WRITE_ONCE(f->updated, jiffies); 1040 1041 if (notify) { 1042 if (rd == NULL) 1043 rd = first_remote_rtnl(f); 1044 1045 WRITE_ONCE(f->updated, jiffies); 1046 err = vxlan_fdb_notify(vxlan, f, rd, RTM_NEWNEIGH, 1047 swdev_notify, extack); 1048 if (err) 1049 goto err_notify; 1050 } 1051 1052 return 0; 1053 1054 err_notify: 1055 if (nhid) 1056 return err; 1057 if ((flags & NLM_F_REPLACE) && rc) 1058 *rd = oldrd; 1059 else if ((flags & NLM_F_APPEND) && rc) { 1060 list_del_rcu(&rd->list); 1061 call_rcu(&rd->rcu, vxlan_dst_free); 1062 } 1063 return err; 1064 } 1065 1066 static int vxlan_fdb_update_create(struct vxlan_dev *vxlan, 1067 const u8 *mac, union vxlan_addr *ip, 1068 __u16 state, __u16 flags, 1069 __be16 port, __be32 src_vni, __be32 vni, 1070 __u32 ifindex, __u16 ndm_flags, u32 nhid, 1071 bool swdev_notify, 1072 struct netlink_ext_ack *extack) 1073 { 1074 __u16 fdb_flags = (ndm_flags & ~NTF_USE); 1075 struct vxlan_fdb *f; 1076 int rc; 1077 1078 /* Disallow replace to add a multicast entry */ 1079 if ((flags & NLM_F_REPLACE) && 1080 (is_multicast_ether_addr(mac) || is_zero_ether_addr(mac))) 1081 return -EOPNOTSUPP; 1082 1083 netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip); 1084 rc = vxlan_fdb_create(vxlan, mac, ip, state, port, src_vni, 1085 vni, ifindex, fdb_flags, nhid, &f, extack); 1086 if (rc < 0) 1087 return rc; 1088 1089 rc = vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH, 1090 swdev_notify, extack); 1091 if (rc) 1092 goto err_notify; 1093 1094 return 0; 1095 1096 err_notify: 1097 vxlan_fdb_destroy(vxlan, f, false, false); 1098 return rc; 1099 } 1100 1101 /* Add new entry to forwarding table -- assumes lock held */ 1102 int vxlan_fdb_update(struct vxlan_dev *vxlan, 1103 const u8 *mac, union vxlan_addr *ip, 1104 __u16 state, __u16 flags, 1105 __be16 port, __be32 src_vni, __be32 vni, 1106 __u32 ifindex, __u16 ndm_flags, u32 nhid, 1107 bool swdev_notify, 1108 struct netlink_ext_ack *extack) 1109 { 1110 struct vxlan_fdb *f; 1111 1112 f = vxlan_find_mac(vxlan, mac, src_vni); 1113 if (f) { 1114 if (flags & NLM_F_EXCL) { 1115 netdev_dbg(vxlan->dev, 1116 "lost race to create %pM\n", mac); 1117 return -EEXIST; 1118 } 1119 1120 return vxlan_fdb_update_existing(vxlan, ip, state, flags, port, 1121 vni, ifindex, ndm_flags, f, 1122 nhid, swdev_notify, extack); 1123 } else { 1124 if (!(flags & NLM_F_CREATE)) 1125 return -ENOENT; 1126 1127 return vxlan_fdb_update_create(vxlan, mac, ip, state, flags, 1128 port, src_vni, vni, ifindex, 1129 ndm_flags, nhid, swdev_notify, 1130 extack); 1131 } 1132 } 1133 1134 static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f, 1135 struct vxlan_rdst *rd, bool swdev_notify) 1136 { 1137 list_del_rcu(&rd->list); 1138 vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH, swdev_notify, NULL); 1139 call_rcu(&rd->rcu, vxlan_dst_free); 1140 } 1141 1142 static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan, 1143 union vxlan_addr *ip, __be16 *port, __be32 *src_vni, 1144 __be32 *vni, u32 *ifindex, u32 *nhid, 1145 struct netlink_ext_ack *extack) 1146 { 1147 struct net *net = dev_net(vxlan->dev); 1148 int err; 1149 1150 if (tb[NDA_NH_ID] && 1151 (tb[NDA_DST] || tb[NDA_VNI] || tb[NDA_IFINDEX] || tb[NDA_PORT])) { 1152 NL_SET_ERR_MSG(extack, "DST, VNI, ifindex and port are mutually exclusive with NH_ID"); 1153 return -EINVAL; 1154 } 1155 1156 if (tb[NDA_DST]) { 1157 err = vxlan_nla_get_addr(ip, tb[NDA_DST]); 1158 if (err) { 1159 NL_SET_ERR_MSG(extack, "Unsupported address family"); 1160 return err; 1161 } 1162 } else { 1163 union vxlan_addr *remote = &vxlan->default_dst.remote_ip; 1164 1165 if (remote->sa.sa_family == AF_INET) { 1166 ip->sin.sin_addr.s_addr = htonl(INADDR_ANY); 1167 ip->sa.sa_family = AF_INET; 1168 #if IS_ENABLED(CONFIG_IPV6) 1169 } else { 1170 ip->sin6.sin6_addr = in6addr_any; 1171 ip->sa.sa_family = AF_INET6; 1172 #endif 1173 } 1174 } 1175 1176 if (tb[NDA_PORT]) { 1177 if (nla_len(tb[NDA_PORT]) != sizeof(__be16)) { 1178 NL_SET_ERR_MSG(extack, "Invalid vxlan port"); 1179 return -EINVAL; 1180 } 1181 *port = nla_get_be16(tb[NDA_PORT]); 1182 } else { 1183 *port = vxlan->cfg.dst_port; 1184 } 1185 1186 if (tb[NDA_VNI]) { 1187 if (nla_len(tb[NDA_VNI]) != sizeof(u32)) { 1188 NL_SET_ERR_MSG(extack, "Invalid vni"); 1189 return -EINVAL; 1190 } 1191 *vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI])); 1192 } else { 1193 *vni = vxlan->default_dst.remote_vni; 1194 } 1195 1196 if (tb[NDA_SRC_VNI]) { 1197 if (nla_len(tb[NDA_SRC_VNI]) != sizeof(u32)) { 1198 NL_SET_ERR_MSG(extack, "Invalid src vni"); 1199 return -EINVAL; 1200 } 1201 *src_vni = cpu_to_be32(nla_get_u32(tb[NDA_SRC_VNI])); 1202 } else { 1203 *src_vni = vxlan->default_dst.remote_vni; 1204 } 1205 1206 if (tb[NDA_IFINDEX]) { 1207 struct net_device *tdev; 1208 1209 if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32)) { 1210 NL_SET_ERR_MSG(extack, "Invalid ifindex"); 1211 return -EINVAL; 1212 } 1213 *ifindex = nla_get_u32(tb[NDA_IFINDEX]); 1214 tdev = __dev_get_by_index(net, *ifindex); 1215 if (!tdev) { 1216 NL_SET_ERR_MSG(extack, "Device not found"); 1217 return -EADDRNOTAVAIL; 1218 } 1219 } else { 1220 *ifindex = 0; 1221 } 1222 1223 *nhid = nla_get_u32_default(tb[NDA_NH_ID], 0); 1224 1225 return 0; 1226 } 1227 1228 /* Add static entry (via netlink) */ 1229 static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[], 1230 struct net_device *dev, 1231 const unsigned char *addr, u16 vid, u16 flags, 1232 bool *notified, struct netlink_ext_ack *extack) 1233 { 1234 struct vxlan_dev *vxlan = netdev_priv(dev); 1235 /* struct net *net = dev_net(vxlan->dev); */ 1236 union vxlan_addr ip; 1237 __be16 port; 1238 __be32 src_vni, vni; 1239 u32 ifindex, nhid; 1240 int err; 1241 1242 if (!(ndm->ndm_state & (NUD_PERMANENT|NUD_REACHABLE))) { 1243 pr_info("RTM_NEWNEIGH with invalid state %#x\n", 1244 ndm->ndm_state); 1245 return -EINVAL; 1246 } 1247 1248 if (!tb || (!tb[NDA_DST] && !tb[NDA_NH_ID])) 1249 return -EINVAL; 1250 1251 err = vxlan_fdb_parse(tb, vxlan, &ip, &port, &src_vni, &vni, &ifindex, 1252 &nhid, extack); 1253 if (err) 1254 return err; 1255 1256 if (vxlan->default_dst.remote_ip.sa.sa_family != ip.sa.sa_family) 1257 return -EAFNOSUPPORT; 1258 1259 spin_lock_bh(&vxlan->hash_lock); 1260 err = vxlan_fdb_update(vxlan, addr, &ip, ndm->ndm_state, flags, 1261 port, src_vni, vni, ifindex, 1262 ndm->ndm_flags | NTF_VXLAN_ADDED_BY_USER, 1263 nhid, true, extack); 1264 spin_unlock_bh(&vxlan->hash_lock); 1265 1266 if (!err) 1267 *notified = true; 1268 1269 return err; 1270 } 1271 1272 int __vxlan_fdb_delete(struct vxlan_dev *vxlan, 1273 const unsigned char *addr, union vxlan_addr ip, 1274 __be16 port, __be32 src_vni, __be32 vni, 1275 u32 ifindex, bool swdev_notify) 1276 { 1277 struct vxlan_rdst *rd = NULL; 1278 struct vxlan_fdb *f; 1279 int err = -ENOENT; 1280 1281 f = vxlan_find_mac(vxlan, addr, src_vni); 1282 if (!f) 1283 return err; 1284 1285 if (!vxlan_addr_any(&ip)) { 1286 rd = vxlan_fdb_find_rdst(f, &ip, port, vni, ifindex); 1287 if (!rd) 1288 goto out; 1289 } 1290 1291 /* remove a destination if it's not the only one on the list, 1292 * otherwise destroy the fdb entry 1293 */ 1294 if (rd && !list_is_singular(&f->remotes)) { 1295 vxlan_fdb_dst_destroy(vxlan, f, rd, swdev_notify); 1296 goto out; 1297 } 1298 1299 vxlan_fdb_destroy(vxlan, f, true, swdev_notify); 1300 1301 out: 1302 return 0; 1303 } 1304 1305 /* Delete entry (via netlink) */ 1306 static int vxlan_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[], 1307 struct net_device *dev, 1308 const unsigned char *addr, u16 vid, bool *notified, 1309 struct netlink_ext_ack *extack) 1310 { 1311 struct vxlan_dev *vxlan = netdev_priv(dev); 1312 union vxlan_addr ip; 1313 __be32 src_vni, vni; 1314 u32 ifindex, nhid; 1315 __be16 port; 1316 int err; 1317 1318 err = vxlan_fdb_parse(tb, vxlan, &ip, &port, &src_vni, &vni, &ifindex, 1319 &nhid, extack); 1320 if (err) 1321 return err; 1322 1323 spin_lock_bh(&vxlan->hash_lock); 1324 err = __vxlan_fdb_delete(vxlan, addr, ip, port, src_vni, vni, ifindex, 1325 true); 1326 spin_unlock_bh(&vxlan->hash_lock); 1327 1328 if (!err) 1329 *notified = true; 1330 1331 return err; 1332 } 1333 1334 /* Dump forwarding table */ 1335 static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb, 1336 struct net_device *dev, 1337 struct net_device *filter_dev, int *idx) 1338 { 1339 struct ndo_fdb_dump_context *ctx = (void *)cb->ctx; 1340 struct vxlan_dev *vxlan = netdev_priv(dev); 1341 struct vxlan_fdb *f; 1342 int err = 0; 1343 1344 rcu_read_lock(); 1345 hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) { 1346 struct vxlan_rdst *rd; 1347 1348 if (rcu_access_pointer(f->nh)) { 1349 if (*idx < ctx->fdb_idx) 1350 goto skip_nh; 1351 err = vxlan_fdb_info(skb, vxlan, f, 1352 NETLINK_CB(cb->skb).portid, 1353 cb->nlh->nlmsg_seq, 1354 RTM_NEWNEIGH, NLM_F_MULTI, NULL); 1355 if (err < 0) { 1356 rcu_read_unlock(); 1357 goto out; 1358 } 1359 skip_nh: 1360 *idx += 1; 1361 continue; 1362 } 1363 1364 list_for_each_entry_rcu(rd, &f->remotes, list) { 1365 if (*idx < ctx->fdb_idx) 1366 goto skip; 1367 1368 err = vxlan_fdb_info(skb, vxlan, f, 1369 NETLINK_CB(cb->skb).portid, 1370 cb->nlh->nlmsg_seq, 1371 RTM_NEWNEIGH, NLM_F_MULTI, rd); 1372 if (err < 0) { 1373 rcu_read_unlock(); 1374 goto out; 1375 } 1376 skip: 1377 *idx += 1; 1378 } 1379 } 1380 rcu_read_unlock(); 1381 out: 1382 return err; 1383 } 1384 1385 static int vxlan_fdb_get(struct sk_buff *skb, 1386 struct nlattr *tb[], 1387 struct net_device *dev, 1388 const unsigned char *addr, 1389 u16 vid, u32 portid, u32 seq, 1390 struct netlink_ext_ack *extack) 1391 { 1392 struct vxlan_dev *vxlan = netdev_priv(dev); 1393 struct vxlan_fdb *f; 1394 __be32 vni; 1395 int err; 1396 1397 if (tb[NDA_VNI]) 1398 vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI])); 1399 else 1400 vni = vxlan->default_dst.remote_vni; 1401 1402 rcu_read_lock(); 1403 1404 f = vxlan_find_mac_rcu(vxlan, addr, vni); 1405 if (!f) { 1406 NL_SET_ERR_MSG(extack, "Fdb entry not found"); 1407 err = -ENOENT; 1408 goto errout; 1409 } 1410 1411 err = vxlan_fdb_info(skb, vxlan, f, portid, seq, 1412 RTM_NEWNEIGH, 0, first_remote_rcu(f)); 1413 errout: 1414 rcu_read_unlock(); 1415 return err; 1416 } 1417 1418 /* Watch incoming packets to learn mapping between Ethernet address 1419 * and Tunnel endpoint. 1420 */ 1421 static enum skb_drop_reason vxlan_snoop(struct net_device *dev, 1422 union vxlan_addr *src_ip, 1423 const u8 *src_mac, u32 src_ifindex, 1424 __be32 vni) 1425 { 1426 struct vxlan_dev *vxlan = netdev_priv(dev); 1427 struct vxlan_fdb *f; 1428 u32 ifindex = 0; 1429 1430 /* Ignore packets from invalid src-address */ 1431 if (!is_valid_ether_addr(src_mac)) 1432 return SKB_DROP_REASON_MAC_INVALID_SOURCE; 1433 1434 #if IS_ENABLED(CONFIG_IPV6) 1435 if (src_ip->sa.sa_family == AF_INET6 && 1436 (ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL)) 1437 ifindex = src_ifindex; 1438 #endif 1439 1440 f = vxlan_find_mac_rcu(vxlan, src_mac, vni); 1441 if (likely(f)) { 1442 struct vxlan_rdst *rdst = first_remote_rcu(f); 1443 unsigned long now = jiffies; 1444 1445 if (READ_ONCE(f->updated) != now) 1446 WRITE_ONCE(f->updated, now); 1447 1448 /* Don't override an fdb with nexthop with a learnt entry */ 1449 if (rcu_access_pointer(f->nh)) 1450 return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS; 1451 1452 if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip) && 1453 rdst->remote_ifindex == ifindex)) 1454 return SKB_NOT_DROPPED_YET; 1455 1456 /* Don't migrate static entries, drop packets */ 1457 if (f->state & (NUD_PERMANENT | NUD_NOARP)) 1458 return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS; 1459 1460 if (net_ratelimit()) 1461 netdev_info(dev, 1462 "%pM migrated from %pIS to %pIS\n", 1463 src_mac, &rdst->remote_ip.sa, &src_ip->sa); 1464 1465 rdst->remote_ip = *src_ip; 1466 vxlan_fdb_notify(vxlan, f, rdst, RTM_NEWNEIGH, true, NULL); 1467 } else { 1468 /* learned new entry */ 1469 spin_lock(&vxlan->hash_lock); 1470 1471 /* close off race between vxlan_flush and incoming packets */ 1472 if (netif_running(dev)) 1473 vxlan_fdb_update(vxlan, src_mac, src_ip, 1474 NUD_REACHABLE, 1475 NLM_F_EXCL|NLM_F_CREATE, 1476 vxlan->cfg.dst_port, 1477 vni, 1478 vxlan->default_dst.remote_vni, 1479 ifindex, NTF_SELF, 0, true, NULL); 1480 spin_unlock(&vxlan->hash_lock); 1481 } 1482 1483 return SKB_NOT_DROPPED_YET; 1484 } 1485 1486 static bool __vxlan_sock_release_prep(struct vxlan_sock *vs) 1487 { 1488 ASSERT_RTNL(); 1489 1490 if (!vs) 1491 return false; 1492 if (!refcount_dec_and_test(&vs->refcnt)) 1493 return false; 1494 1495 hlist_del_rcu(&vs->hlist); 1496 udp_tunnel_notify_del_rx_port(vs->sock, 1497 (vs->flags & VXLAN_F_GPE) ? 1498 UDP_TUNNEL_TYPE_VXLAN_GPE : 1499 UDP_TUNNEL_TYPE_VXLAN); 1500 1501 return true; 1502 } 1503 1504 static void vxlan_sock_release(struct vxlan_dev *vxlan) 1505 { 1506 struct vxlan_sock *sock4 = rtnl_dereference(vxlan->vn4_sock); 1507 #if IS_ENABLED(CONFIG_IPV6) 1508 struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock); 1509 1510 RCU_INIT_POINTER(vxlan->vn6_sock, NULL); 1511 #endif 1512 1513 RCU_INIT_POINTER(vxlan->vn4_sock, NULL); 1514 synchronize_net(); 1515 1516 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) 1517 vxlan_vs_del_vnigrp(vxlan); 1518 else 1519 vxlan_vs_del_dev(vxlan); 1520 1521 if (__vxlan_sock_release_prep(sock4)) { 1522 udp_tunnel_sock_release(sock4->sock); 1523 kfree(sock4); 1524 } 1525 1526 #if IS_ENABLED(CONFIG_IPV6) 1527 if (__vxlan_sock_release_prep(sock6)) { 1528 udp_tunnel_sock_release(sock6->sock); 1529 kfree(sock6); 1530 } 1531 #endif 1532 } 1533 1534 static enum skb_drop_reason vxlan_remcsum(struct sk_buff *skb, u32 vxflags) 1535 { 1536 const struct vxlanhdr *vh = vxlan_hdr(skb); 1537 enum skb_drop_reason reason; 1538 size_t start, offset; 1539 1540 if (!(vh->vx_flags & VXLAN_HF_RCO) || skb->remcsum_offload) 1541 return SKB_NOT_DROPPED_YET; 1542 1543 start = vxlan_rco_start(vh->vx_vni); 1544 offset = start + vxlan_rco_offset(vh->vx_vni); 1545 1546 reason = pskb_may_pull_reason(skb, offset + sizeof(u16)); 1547 if (reason) 1548 return reason; 1549 1550 skb_remcsum_process(skb, (void *)(vxlan_hdr(skb) + 1), start, offset, 1551 !!(vxflags & VXLAN_F_REMCSUM_NOPARTIAL)); 1552 return SKB_NOT_DROPPED_YET; 1553 } 1554 1555 static void vxlan_parse_gbp_hdr(struct sk_buff *skb, u32 vxflags, 1556 struct vxlan_metadata *md) 1557 { 1558 const struct vxlanhdr *vh = vxlan_hdr(skb); 1559 const struct vxlanhdr_gbp *gbp; 1560 struct metadata_dst *tun_dst; 1561 1562 gbp = (const struct vxlanhdr_gbp *)vh; 1563 1564 if (!(vh->vx_flags & VXLAN_HF_GBP)) 1565 return; 1566 1567 md->gbp = ntohs(gbp->policy_id); 1568 1569 tun_dst = (struct metadata_dst *)skb_dst(skb); 1570 if (tun_dst) { 1571 __set_bit(IP_TUNNEL_VXLAN_OPT_BIT, 1572 tun_dst->u.tun_info.key.tun_flags); 1573 tun_dst->u.tun_info.options_len = sizeof(*md); 1574 } 1575 if (gbp->dont_learn) 1576 md->gbp |= VXLAN_GBP_DONT_LEARN; 1577 1578 if (gbp->policy_applied) 1579 md->gbp |= VXLAN_GBP_POLICY_APPLIED; 1580 1581 /* In flow-based mode, GBP is carried in dst_metadata */ 1582 if (!(vxflags & VXLAN_F_COLLECT_METADATA)) 1583 skb->mark = md->gbp; 1584 } 1585 1586 static enum skb_drop_reason vxlan_set_mac(struct vxlan_dev *vxlan, 1587 struct vxlan_sock *vs, 1588 struct sk_buff *skb, __be32 vni) 1589 { 1590 union vxlan_addr saddr; 1591 u32 ifindex = skb->dev->ifindex; 1592 1593 skb_reset_mac_header(skb); 1594 skb->protocol = eth_type_trans(skb, vxlan->dev); 1595 skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); 1596 1597 /* Ignore packet loops (and multicast echo) */ 1598 if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr)) 1599 return SKB_DROP_REASON_LOCAL_MAC; 1600 1601 /* Get address from the outer IP header */ 1602 if (vxlan_get_sk_family(vs) == AF_INET) { 1603 saddr.sin.sin_addr.s_addr = ip_hdr(skb)->saddr; 1604 saddr.sa.sa_family = AF_INET; 1605 #if IS_ENABLED(CONFIG_IPV6) 1606 } else { 1607 saddr.sin6.sin6_addr = ipv6_hdr(skb)->saddr; 1608 saddr.sa.sa_family = AF_INET6; 1609 #endif 1610 } 1611 1612 if (!(vxlan->cfg.flags & VXLAN_F_LEARN)) 1613 return SKB_NOT_DROPPED_YET; 1614 1615 return vxlan_snoop(skb->dev, &saddr, eth_hdr(skb)->h_source, 1616 ifindex, vni); 1617 } 1618 1619 static bool vxlan_ecn_decapsulate(struct vxlan_sock *vs, void *oiph, 1620 struct sk_buff *skb) 1621 { 1622 int err = 0; 1623 1624 if (vxlan_get_sk_family(vs) == AF_INET) 1625 err = IP_ECN_decapsulate(oiph, skb); 1626 #if IS_ENABLED(CONFIG_IPV6) 1627 else 1628 err = IP6_ECN_decapsulate(oiph, skb); 1629 #endif 1630 1631 if (unlikely(err) && log_ecn_error) { 1632 if (vxlan_get_sk_family(vs) == AF_INET) 1633 net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n", 1634 &((struct iphdr *)oiph)->saddr, 1635 ((struct iphdr *)oiph)->tos); 1636 else 1637 net_info_ratelimited("non-ECT from %pI6\n", 1638 &((struct ipv6hdr *)oiph)->saddr); 1639 } 1640 return err <= 1; 1641 } 1642 1643 static int vxlan_rcv(struct sock *sk, struct sk_buff *skb) 1644 { 1645 struct vxlan_vni_node *vninode = NULL; 1646 const struct vxlanhdr *vh; 1647 struct vxlan_dev *vxlan; 1648 struct vxlan_sock *vs; 1649 struct vxlan_metadata _md; 1650 struct vxlan_metadata *md = &_md; 1651 __be16 protocol = htons(ETH_P_TEB); 1652 enum skb_drop_reason reason; 1653 bool raw_proto = false; 1654 void *oiph; 1655 __be32 vni = 0; 1656 int nh; 1657 1658 /* Need UDP and VXLAN header to be present */ 1659 reason = pskb_may_pull_reason(skb, VXLAN_HLEN); 1660 if (reason) 1661 goto drop; 1662 1663 vh = vxlan_hdr(skb); 1664 /* VNI flag always required to be set */ 1665 if (!(vh->vx_flags & VXLAN_HF_VNI)) { 1666 netdev_dbg(skb->dev, "invalid vxlan flags=%#x vni=%#x\n", 1667 ntohl(vh->vx_flags), ntohl(vh->vx_vni)); 1668 reason = SKB_DROP_REASON_VXLAN_INVALID_HDR; 1669 /* Return non vxlan pkt */ 1670 goto drop; 1671 } 1672 1673 vs = rcu_dereference_sk_user_data(sk); 1674 if (!vs) 1675 goto drop; 1676 1677 vni = vxlan_vni(vh->vx_vni); 1678 1679 vxlan = vxlan_vs_find_vni(vs, skb->dev->ifindex, vni, &vninode); 1680 if (!vxlan) { 1681 reason = SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND; 1682 goto drop; 1683 } 1684 1685 if (vh->vx_flags & vxlan->cfg.reserved_bits.vx_flags || 1686 vh->vx_vni & vxlan->cfg.reserved_bits.vx_vni) { 1687 /* If the header uses bits besides those enabled by the 1688 * netdevice configuration, treat this as a malformed packet. 1689 * This behavior diverges from VXLAN RFC (RFC7348) which 1690 * stipulates that bits in reserved in reserved fields are to be 1691 * ignored. The approach here maintains compatibility with 1692 * previous stack code, and also is more robust and provides a 1693 * little more security in adding extensions to VXLAN. 1694 */ 1695 reason = SKB_DROP_REASON_VXLAN_INVALID_HDR; 1696 DEV_STATS_INC(vxlan->dev, rx_frame_errors); 1697 DEV_STATS_INC(vxlan->dev, rx_errors); 1698 vxlan_vnifilter_count(vxlan, vni, vninode, 1699 VXLAN_VNI_STATS_RX_ERRORS, 0); 1700 goto drop; 1701 } 1702 1703 if (vxlan->cfg.flags & VXLAN_F_GPE) { 1704 if (!vxlan_parse_gpe_proto(vh, &protocol)) 1705 goto drop; 1706 raw_proto = true; 1707 } 1708 1709 if (__iptunnel_pull_header(skb, VXLAN_HLEN, protocol, raw_proto, 1710 !net_eq(vxlan->net, dev_net(vxlan->dev)))) { 1711 reason = SKB_DROP_REASON_NOMEM; 1712 goto drop; 1713 } 1714 1715 if (vxlan->cfg.flags & VXLAN_F_REMCSUM_RX) { 1716 reason = vxlan_remcsum(skb, vxlan->cfg.flags); 1717 if (unlikely(reason)) 1718 goto drop; 1719 } 1720 1721 if (vxlan_collect_metadata(vs)) { 1722 IP_TUNNEL_DECLARE_FLAGS(flags) = { }; 1723 struct metadata_dst *tun_dst; 1724 1725 __set_bit(IP_TUNNEL_KEY_BIT, flags); 1726 tun_dst = udp_tun_rx_dst(skb, vxlan_get_sk_family(vs), flags, 1727 key32_to_tunnel_id(vni), sizeof(*md)); 1728 1729 if (!tun_dst) { 1730 reason = SKB_DROP_REASON_NOMEM; 1731 goto drop; 1732 } 1733 1734 md = ip_tunnel_info_opts(&tun_dst->u.tun_info); 1735 1736 skb_dst_set(skb, (struct dst_entry *)tun_dst); 1737 } else { 1738 memset(md, 0, sizeof(*md)); 1739 } 1740 1741 if (vxlan->cfg.flags & VXLAN_F_GBP) 1742 vxlan_parse_gbp_hdr(skb, vxlan->cfg.flags, md); 1743 /* Note that GBP and GPE can never be active together. This is 1744 * ensured in vxlan_dev_configure. 1745 */ 1746 1747 if (!raw_proto) { 1748 reason = vxlan_set_mac(vxlan, vs, skb, vni); 1749 if (reason) 1750 goto drop; 1751 } else { 1752 skb_reset_mac_header(skb); 1753 skb->dev = vxlan->dev; 1754 skb->pkt_type = PACKET_HOST; 1755 } 1756 1757 /* Save offset of outer header relative to skb->head, 1758 * because we are going to reset the network header to the inner header 1759 * and might change skb->head. 1760 */ 1761 nh = skb_network_header(skb) - skb->head; 1762 1763 skb_reset_network_header(skb); 1764 1765 reason = pskb_inet_may_pull_reason(skb); 1766 if (reason) { 1767 DEV_STATS_INC(vxlan->dev, rx_length_errors); 1768 DEV_STATS_INC(vxlan->dev, rx_errors); 1769 vxlan_vnifilter_count(vxlan, vni, vninode, 1770 VXLAN_VNI_STATS_RX_ERRORS, 0); 1771 goto drop; 1772 } 1773 1774 /* Get the outer header. */ 1775 oiph = skb->head + nh; 1776 1777 if (!vxlan_ecn_decapsulate(vs, oiph, skb)) { 1778 reason = SKB_DROP_REASON_IP_TUNNEL_ECN; 1779 DEV_STATS_INC(vxlan->dev, rx_frame_errors); 1780 DEV_STATS_INC(vxlan->dev, rx_errors); 1781 vxlan_vnifilter_count(vxlan, vni, vninode, 1782 VXLAN_VNI_STATS_RX_ERRORS, 0); 1783 goto drop; 1784 } 1785 1786 rcu_read_lock(); 1787 1788 if (unlikely(!(vxlan->dev->flags & IFF_UP))) { 1789 rcu_read_unlock(); 1790 dev_dstats_rx_dropped(vxlan->dev); 1791 vxlan_vnifilter_count(vxlan, vni, vninode, 1792 VXLAN_VNI_STATS_RX_DROPS, 0); 1793 reason = SKB_DROP_REASON_DEV_READY; 1794 goto drop; 1795 } 1796 1797 dev_dstats_rx_add(vxlan->dev, skb->len); 1798 vxlan_vnifilter_count(vxlan, vni, vninode, VXLAN_VNI_STATS_RX, skb->len); 1799 gro_cells_receive(&vxlan->gro_cells, skb); 1800 1801 rcu_read_unlock(); 1802 1803 return 0; 1804 1805 drop: 1806 reason = reason ?: SKB_DROP_REASON_NOT_SPECIFIED; 1807 /* Consume bad packet */ 1808 kfree_skb_reason(skb, reason); 1809 return 0; 1810 } 1811 1812 static int vxlan_err_lookup(struct sock *sk, struct sk_buff *skb) 1813 { 1814 struct vxlan_dev *vxlan; 1815 struct vxlan_sock *vs; 1816 struct vxlanhdr *hdr; 1817 __be32 vni; 1818 1819 if (!pskb_may_pull(skb, skb_transport_offset(skb) + VXLAN_HLEN)) 1820 return -EINVAL; 1821 1822 hdr = vxlan_hdr(skb); 1823 1824 if (!(hdr->vx_flags & VXLAN_HF_VNI)) 1825 return -EINVAL; 1826 1827 vs = rcu_dereference_sk_user_data(sk); 1828 if (!vs) 1829 return -ENOENT; 1830 1831 vni = vxlan_vni(hdr->vx_vni); 1832 vxlan = vxlan_vs_find_vni(vs, skb->dev->ifindex, vni, NULL); 1833 if (!vxlan) 1834 return -ENOENT; 1835 1836 return 0; 1837 } 1838 1839 static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) 1840 { 1841 struct vxlan_dev *vxlan = netdev_priv(dev); 1842 struct arphdr *parp; 1843 u8 *arpptr, *sha; 1844 __be32 sip, tip; 1845 struct neighbour *n; 1846 1847 if (dev->flags & IFF_NOARP) 1848 goto out; 1849 1850 if (!pskb_may_pull(skb, arp_hdr_len(dev))) { 1851 dev_dstats_tx_dropped(dev); 1852 vxlan_vnifilter_count(vxlan, vni, NULL, 1853 VXLAN_VNI_STATS_TX_DROPS, 0); 1854 goto out; 1855 } 1856 parp = arp_hdr(skb); 1857 1858 if ((parp->ar_hrd != htons(ARPHRD_ETHER) && 1859 parp->ar_hrd != htons(ARPHRD_IEEE802)) || 1860 parp->ar_pro != htons(ETH_P_IP) || 1861 parp->ar_op != htons(ARPOP_REQUEST) || 1862 parp->ar_hln != dev->addr_len || 1863 parp->ar_pln != 4) 1864 goto out; 1865 arpptr = (u8 *)parp + sizeof(struct arphdr); 1866 sha = arpptr; 1867 arpptr += dev->addr_len; /* sha */ 1868 memcpy(&sip, arpptr, sizeof(sip)); 1869 arpptr += sizeof(sip); 1870 arpptr += dev->addr_len; /* tha */ 1871 memcpy(&tip, arpptr, sizeof(tip)); 1872 1873 if (ipv4_is_loopback(tip) || 1874 ipv4_is_multicast(tip)) 1875 goto out; 1876 1877 n = neigh_lookup(&arp_tbl, &tip, dev); 1878 1879 if (n) { 1880 struct vxlan_rdst *rdst = NULL; 1881 struct vxlan_fdb *f; 1882 struct sk_buff *reply; 1883 1884 if (!(READ_ONCE(n->nud_state) & NUD_CONNECTED)) { 1885 neigh_release(n); 1886 goto out; 1887 } 1888 1889 rcu_read_lock(); 1890 f = vxlan_find_mac_tx(vxlan, n->ha, vni); 1891 if (f) 1892 rdst = first_remote_rcu(f); 1893 if (rdst && vxlan_addr_any(&rdst->remote_ip)) { 1894 /* bridge-local neighbor */ 1895 neigh_release(n); 1896 rcu_read_unlock(); 1897 goto out; 1898 } 1899 rcu_read_unlock(); 1900 1901 reply = arp_create(ARPOP_REPLY, ETH_P_ARP, sip, dev, tip, sha, 1902 n->ha, sha); 1903 1904 neigh_release(n); 1905 1906 if (reply == NULL) 1907 goto out; 1908 1909 skb_reset_mac_header(reply); 1910 __skb_pull(reply, skb_network_offset(reply)); 1911 reply->ip_summed = CHECKSUM_UNNECESSARY; 1912 reply->pkt_type = PACKET_HOST; 1913 1914 if (netif_rx(reply) == NET_RX_DROP) { 1915 dev_dstats_rx_dropped(dev); 1916 vxlan_vnifilter_count(vxlan, vni, NULL, 1917 VXLAN_VNI_STATS_RX_DROPS, 0); 1918 } 1919 1920 } else if (vxlan->cfg.flags & VXLAN_F_L3MISS) { 1921 union vxlan_addr ipa = { 1922 .sin.sin_addr.s_addr = tip, 1923 .sin.sin_family = AF_INET, 1924 }; 1925 1926 vxlan_ip_miss(dev, &ipa); 1927 } 1928 out: 1929 consume_skb(skb); 1930 return NETDEV_TX_OK; 1931 } 1932 1933 #if IS_ENABLED(CONFIG_IPV6) 1934 static struct sk_buff *vxlan_na_create(struct sk_buff *request, 1935 struct neighbour *n, bool isrouter) 1936 { 1937 struct net_device *dev = request->dev; 1938 struct sk_buff *reply; 1939 struct nd_msg *ns, *na; 1940 struct ipv6hdr *pip6; 1941 u8 *daddr; 1942 int na_olen = 8; /* opt hdr + ETH_ALEN for target */ 1943 int ns_olen; 1944 int i, len; 1945 1946 if (dev == NULL || !pskb_may_pull(request, request->len)) 1947 return NULL; 1948 1949 len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) + 1950 sizeof(*na) + na_olen + dev->needed_tailroom; 1951 reply = alloc_skb(len, GFP_ATOMIC); 1952 if (reply == NULL) 1953 return NULL; 1954 1955 reply->protocol = htons(ETH_P_IPV6); 1956 reply->dev = dev; 1957 skb_reserve(reply, LL_RESERVED_SPACE(request->dev)); 1958 skb_push(reply, sizeof(struct ethhdr)); 1959 skb_reset_mac_header(reply); 1960 1961 ns = (struct nd_msg *)(ipv6_hdr(request) + 1); 1962 1963 daddr = eth_hdr(request)->h_source; 1964 ns_olen = request->len - skb_network_offset(request) - 1965 sizeof(struct ipv6hdr) - sizeof(*ns); 1966 for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) { 1967 if (!ns->opt[i + 1]) { 1968 kfree_skb(reply); 1969 return NULL; 1970 } 1971 if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) { 1972 daddr = ns->opt + i + sizeof(struct nd_opt_hdr); 1973 break; 1974 } 1975 } 1976 1977 /* Ethernet header */ 1978 ether_addr_copy(eth_hdr(reply)->h_dest, daddr); 1979 ether_addr_copy(eth_hdr(reply)->h_source, n->ha); 1980 eth_hdr(reply)->h_proto = htons(ETH_P_IPV6); 1981 reply->protocol = htons(ETH_P_IPV6); 1982 1983 skb_pull(reply, sizeof(struct ethhdr)); 1984 skb_reset_network_header(reply); 1985 skb_put(reply, sizeof(struct ipv6hdr)); 1986 1987 /* IPv6 header */ 1988 1989 pip6 = ipv6_hdr(reply); 1990 memset(pip6, 0, sizeof(struct ipv6hdr)); 1991 pip6->version = 6; 1992 pip6->priority = ipv6_hdr(request)->priority; 1993 pip6->nexthdr = IPPROTO_ICMPV6; 1994 pip6->hop_limit = 255; 1995 pip6->daddr = ipv6_hdr(request)->saddr; 1996 pip6->saddr = *(struct in6_addr *)n->primary_key; 1997 1998 skb_pull(reply, sizeof(struct ipv6hdr)); 1999 skb_reset_transport_header(reply); 2000 2001 /* Neighbor Advertisement */ 2002 na = skb_put_zero(reply, sizeof(*na) + na_olen); 2003 na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT; 2004 na->icmph.icmp6_router = isrouter; 2005 na->icmph.icmp6_override = 1; 2006 na->icmph.icmp6_solicited = 1; 2007 na->target = ns->target; 2008 ether_addr_copy(&na->opt[2], n->ha); 2009 na->opt[0] = ND_OPT_TARGET_LL_ADDR; 2010 na->opt[1] = na_olen >> 3; 2011 2012 na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr, 2013 &pip6->daddr, sizeof(*na)+na_olen, IPPROTO_ICMPV6, 2014 csum_partial(na, sizeof(*na)+na_olen, 0)); 2015 2016 pip6->payload_len = htons(sizeof(*na)+na_olen); 2017 2018 skb_push(reply, sizeof(struct ipv6hdr)); 2019 2020 reply->ip_summed = CHECKSUM_UNNECESSARY; 2021 2022 return reply; 2023 } 2024 2025 static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni) 2026 { 2027 struct vxlan_dev *vxlan = netdev_priv(dev); 2028 const struct in6_addr *daddr; 2029 const struct ipv6hdr *iphdr; 2030 struct inet6_dev *in6_dev; 2031 struct neighbour *n; 2032 struct nd_msg *msg; 2033 2034 rcu_read_lock(); 2035 in6_dev = __in6_dev_get(dev); 2036 if (!in6_dev) 2037 goto out; 2038 2039 iphdr = ipv6_hdr(skb); 2040 daddr = &iphdr->daddr; 2041 msg = (struct nd_msg *)(iphdr + 1); 2042 2043 if (ipv6_addr_loopback(daddr) || 2044 ipv6_addr_is_multicast(&msg->target)) 2045 goto out; 2046 2047 n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev); 2048 2049 if (n) { 2050 struct vxlan_rdst *rdst = NULL; 2051 struct vxlan_fdb *f; 2052 struct sk_buff *reply; 2053 2054 if (!(READ_ONCE(n->nud_state) & NUD_CONNECTED)) { 2055 neigh_release(n); 2056 goto out; 2057 } 2058 2059 f = vxlan_find_mac_tx(vxlan, n->ha, vni); 2060 if (f) 2061 rdst = first_remote_rcu(f); 2062 if (rdst && vxlan_addr_any(&rdst->remote_ip)) { 2063 /* bridge-local neighbor */ 2064 neigh_release(n); 2065 goto out; 2066 } 2067 2068 reply = vxlan_na_create(skb, n, 2069 !!(f ? f->flags & NTF_ROUTER : 0)); 2070 2071 neigh_release(n); 2072 2073 if (reply == NULL) 2074 goto out; 2075 2076 if (netif_rx(reply) == NET_RX_DROP) { 2077 dev_dstats_rx_dropped(dev); 2078 vxlan_vnifilter_count(vxlan, vni, NULL, 2079 VXLAN_VNI_STATS_RX_DROPS, 0); 2080 } 2081 } else if (vxlan->cfg.flags & VXLAN_F_L3MISS) { 2082 union vxlan_addr ipa = { 2083 .sin6.sin6_addr = msg->target, 2084 .sin6.sin6_family = AF_INET6, 2085 }; 2086 2087 vxlan_ip_miss(dev, &ipa); 2088 } 2089 2090 out: 2091 rcu_read_unlock(); 2092 consume_skb(skb); 2093 return NETDEV_TX_OK; 2094 } 2095 #endif 2096 2097 static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb) 2098 { 2099 struct vxlan_dev *vxlan = netdev_priv(dev); 2100 struct neighbour *n; 2101 2102 if (is_multicast_ether_addr(eth_hdr(skb)->h_dest)) 2103 return false; 2104 2105 n = NULL; 2106 switch (ntohs(eth_hdr(skb)->h_proto)) { 2107 case ETH_P_IP: 2108 { 2109 struct iphdr *pip; 2110 2111 if (!pskb_may_pull(skb, sizeof(struct iphdr))) 2112 return false; 2113 pip = ip_hdr(skb); 2114 n = neigh_lookup(&arp_tbl, &pip->daddr, dev); 2115 if (!n && (vxlan->cfg.flags & VXLAN_F_L3MISS)) { 2116 union vxlan_addr ipa = { 2117 .sin.sin_addr.s_addr = pip->daddr, 2118 .sin.sin_family = AF_INET, 2119 }; 2120 2121 vxlan_ip_miss(dev, &ipa); 2122 return false; 2123 } 2124 2125 break; 2126 } 2127 #if IS_ENABLED(CONFIG_IPV6) 2128 case ETH_P_IPV6: 2129 { 2130 struct ipv6hdr *pip6; 2131 2132 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr))) 2133 return false; 2134 pip6 = ipv6_hdr(skb); 2135 n = neigh_lookup(ipv6_stub->nd_tbl, &pip6->daddr, dev); 2136 if (!n && (vxlan->cfg.flags & VXLAN_F_L3MISS)) { 2137 union vxlan_addr ipa = { 2138 .sin6.sin6_addr = pip6->daddr, 2139 .sin6.sin6_family = AF_INET6, 2140 }; 2141 2142 vxlan_ip_miss(dev, &ipa); 2143 return false; 2144 } 2145 2146 break; 2147 } 2148 #endif 2149 default: 2150 return false; 2151 } 2152 2153 if (n) { 2154 bool diff; 2155 2156 diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha); 2157 if (diff) { 2158 memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, 2159 dev->addr_len); 2160 memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len); 2161 } 2162 neigh_release(n); 2163 return diff; 2164 } 2165 2166 return false; 2167 } 2168 2169 static int vxlan_build_gpe_hdr(struct vxlanhdr *vxh, __be16 protocol) 2170 { 2171 struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)vxh; 2172 2173 gpe->np_applied = 1; 2174 gpe->next_protocol = tun_p_from_eth_p(protocol); 2175 if (!gpe->next_protocol) 2176 return -EPFNOSUPPORT; 2177 return 0; 2178 } 2179 2180 static int vxlan_build_skb(struct sk_buff *skb, struct dst_entry *dst, 2181 int iphdr_len, __be32 vni, 2182 struct vxlan_metadata *md, u32 vxflags, 2183 bool udp_sum) 2184 { 2185 struct vxlanhdr *vxh; 2186 int min_headroom; 2187 int err; 2188 int type = udp_sum ? SKB_GSO_UDP_TUNNEL_CSUM : SKB_GSO_UDP_TUNNEL; 2189 __be16 inner_protocol = htons(ETH_P_TEB); 2190 2191 if ((vxflags & VXLAN_F_REMCSUM_TX) && 2192 skb->ip_summed == CHECKSUM_PARTIAL) { 2193 int csum_start = skb_checksum_start_offset(skb); 2194 2195 if (csum_start <= VXLAN_MAX_REMCSUM_START && 2196 !(csum_start & VXLAN_RCO_SHIFT_MASK) && 2197 (skb->csum_offset == offsetof(struct udphdr, check) || 2198 skb->csum_offset == offsetof(struct tcphdr, check))) 2199 type |= SKB_GSO_TUNNEL_REMCSUM; 2200 } 2201 2202 min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len 2203 + VXLAN_HLEN + iphdr_len; 2204 2205 /* Need space for new headers (invalidates iph ptr) */ 2206 err = skb_cow_head(skb, min_headroom); 2207 if (unlikely(err)) 2208 return err; 2209 2210 err = iptunnel_handle_offloads(skb, type); 2211 if (err) 2212 return err; 2213 2214 vxh = __skb_push(skb, sizeof(*vxh)); 2215 vxh->vx_flags = VXLAN_HF_VNI; 2216 vxh->vx_vni = vxlan_vni_field(vni); 2217 2218 if (type & SKB_GSO_TUNNEL_REMCSUM) { 2219 unsigned int start; 2220 2221 start = skb_checksum_start_offset(skb) - sizeof(struct vxlanhdr); 2222 vxh->vx_vni |= vxlan_compute_rco(start, skb->csum_offset); 2223 vxh->vx_flags |= VXLAN_HF_RCO; 2224 2225 if (!skb_is_gso(skb)) { 2226 skb->ip_summed = CHECKSUM_NONE; 2227 skb->encapsulation = 0; 2228 } 2229 } 2230 2231 if (vxflags & VXLAN_F_GBP) 2232 vxlan_build_gbp_hdr(vxh, md); 2233 if (vxflags & VXLAN_F_GPE) { 2234 err = vxlan_build_gpe_hdr(vxh, skb->protocol); 2235 if (err < 0) 2236 return err; 2237 inner_protocol = skb->protocol; 2238 } 2239 2240 skb_set_inner_protocol(skb, inner_protocol); 2241 return 0; 2242 } 2243 2244 /* Bypass encapsulation if the destination is local */ 2245 static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan, 2246 struct vxlan_dev *dst_vxlan, __be32 vni, 2247 bool snoop) 2248 { 2249 union vxlan_addr loopback; 2250 union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip; 2251 unsigned int len = skb->len; 2252 struct net_device *dev; 2253 2254 skb->pkt_type = PACKET_HOST; 2255 skb->encapsulation = 0; 2256 skb->dev = dst_vxlan->dev; 2257 __skb_pull(skb, skb_network_offset(skb)); 2258 2259 if (remote_ip->sa.sa_family == AF_INET) { 2260 loopback.sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK); 2261 loopback.sa.sa_family = AF_INET; 2262 #if IS_ENABLED(CONFIG_IPV6) 2263 } else { 2264 loopback.sin6.sin6_addr = in6addr_loopback; 2265 loopback.sa.sa_family = AF_INET6; 2266 #endif 2267 } 2268 2269 rcu_read_lock(); 2270 dev = skb->dev; 2271 if (unlikely(!(dev->flags & IFF_UP))) { 2272 kfree_skb_reason(skb, SKB_DROP_REASON_DEV_READY); 2273 goto drop; 2274 } 2275 2276 if ((dst_vxlan->cfg.flags & VXLAN_F_LEARN) && snoop) 2277 vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni); 2278 2279 dev_dstats_tx_add(src_vxlan->dev, len); 2280 vxlan_vnifilter_count(src_vxlan, vni, NULL, VXLAN_VNI_STATS_TX, len); 2281 2282 if (__netif_rx(skb) == NET_RX_SUCCESS) { 2283 dev_dstats_rx_add(dst_vxlan->dev, len); 2284 vxlan_vnifilter_count(dst_vxlan, vni, NULL, VXLAN_VNI_STATS_RX, 2285 len); 2286 } else { 2287 drop: 2288 dev_dstats_rx_dropped(dev); 2289 vxlan_vnifilter_count(dst_vxlan, vni, NULL, 2290 VXLAN_VNI_STATS_RX_DROPS, 0); 2291 } 2292 rcu_read_unlock(); 2293 } 2294 2295 static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev, 2296 struct vxlan_dev *vxlan, 2297 int addr_family, 2298 __be16 dst_port, int dst_ifindex, __be32 vni, 2299 struct dst_entry *dst, 2300 u32 rt_flags) 2301 { 2302 #if IS_ENABLED(CONFIG_IPV6) 2303 /* IPv6 rt-flags are checked against RTF_LOCAL, but the value of 2304 * RTF_LOCAL is equal to RTCF_LOCAL. So to keep code simple 2305 * we can use RTCF_LOCAL which works for ipv4 and ipv6 route entry. 2306 */ 2307 BUILD_BUG_ON(RTCF_LOCAL != RTF_LOCAL); 2308 #endif 2309 /* Bypass encapsulation if the destination is local */ 2310 if (rt_flags & RTCF_LOCAL && 2311 !(rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) && 2312 vxlan->cfg.flags & VXLAN_F_LOCALBYPASS) { 2313 struct vxlan_dev *dst_vxlan; 2314 2315 dst_release(dst); 2316 dst_vxlan = vxlan_find_vni(vxlan->net, dst_ifindex, vni, 2317 addr_family, dst_port, 2318 vxlan->cfg.flags); 2319 if (!dst_vxlan) { 2320 DEV_STATS_INC(dev, tx_errors); 2321 vxlan_vnifilter_count(vxlan, vni, NULL, 2322 VXLAN_VNI_STATS_TX_ERRORS, 0); 2323 kfree_skb_reason(skb, SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND); 2324 2325 return -ENOENT; 2326 } 2327 vxlan_encap_bypass(skb, vxlan, dst_vxlan, vni, true); 2328 return 1; 2329 } 2330 2331 return 0; 2332 } 2333 2334 void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, 2335 __be32 default_vni, struct vxlan_rdst *rdst, bool did_rsc) 2336 { 2337 struct dst_cache *dst_cache; 2338 struct ip_tunnel_info *info; 2339 struct ip_tunnel_key *pkey; 2340 struct ip_tunnel_key key; 2341 struct vxlan_dev *vxlan = netdev_priv(dev); 2342 const struct iphdr *old_iph; 2343 struct vxlan_metadata _md; 2344 struct vxlan_metadata *md = &_md; 2345 unsigned int pkt_len = skb->len; 2346 __be16 src_port = 0, dst_port; 2347 struct dst_entry *ndst = NULL; 2348 int addr_family; 2349 __u8 tos, ttl; 2350 int ifindex; 2351 int err; 2352 u32 flags = vxlan->cfg.flags; 2353 bool use_cache; 2354 bool udp_sum = false; 2355 bool xnet = !net_eq(vxlan->net, dev_net(vxlan->dev)); 2356 enum skb_drop_reason reason; 2357 bool no_eth_encap; 2358 __be32 vni = 0; 2359 2360 no_eth_encap = flags & VXLAN_F_GPE && skb->protocol != htons(ETH_P_TEB); 2361 reason = skb_vlan_inet_prepare(skb, no_eth_encap); 2362 if (reason) 2363 goto drop; 2364 2365 reason = SKB_DROP_REASON_NOT_SPECIFIED; 2366 old_iph = ip_hdr(skb); 2367 2368 info = skb_tunnel_info(skb); 2369 use_cache = ip_tunnel_dst_cache_usable(skb, info); 2370 2371 if (rdst) { 2372 memset(&key, 0, sizeof(key)); 2373 pkey = &key; 2374 2375 if (vxlan_addr_any(&rdst->remote_ip)) { 2376 if (did_rsc) { 2377 /* short-circuited back to local bridge */ 2378 vxlan_encap_bypass(skb, vxlan, vxlan, 2379 default_vni, true); 2380 return; 2381 } 2382 goto drop; 2383 } 2384 2385 addr_family = vxlan->cfg.saddr.sa.sa_family; 2386 dst_port = rdst->remote_port ? rdst->remote_port : vxlan->cfg.dst_port; 2387 vni = (rdst->remote_vni) ? : default_vni; 2388 ifindex = rdst->remote_ifindex; 2389 2390 if (addr_family == AF_INET) { 2391 key.u.ipv4.src = vxlan->cfg.saddr.sin.sin_addr.s_addr; 2392 key.u.ipv4.dst = rdst->remote_ip.sin.sin_addr.s_addr; 2393 } else { 2394 key.u.ipv6.src = vxlan->cfg.saddr.sin6.sin6_addr; 2395 key.u.ipv6.dst = rdst->remote_ip.sin6.sin6_addr; 2396 } 2397 2398 dst_cache = &rdst->dst_cache; 2399 md->gbp = skb->mark; 2400 if (flags & VXLAN_F_TTL_INHERIT) { 2401 ttl = ip_tunnel_get_ttl(old_iph, skb); 2402 } else { 2403 ttl = vxlan->cfg.ttl; 2404 if (!ttl && vxlan_addr_multicast(&rdst->remote_ip)) 2405 ttl = 1; 2406 } 2407 tos = vxlan->cfg.tos; 2408 if (tos == 1) 2409 tos = ip_tunnel_get_dsfield(old_iph, skb); 2410 if (tos && !info) 2411 use_cache = false; 2412 2413 if (addr_family == AF_INET) 2414 udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM_TX); 2415 else 2416 udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX); 2417 #if IS_ENABLED(CONFIG_IPV6) 2418 switch (vxlan->cfg.label_policy) { 2419 case VXLAN_LABEL_FIXED: 2420 key.label = vxlan->cfg.label; 2421 break; 2422 case VXLAN_LABEL_INHERIT: 2423 key.label = ip_tunnel_get_flowlabel(old_iph, skb); 2424 break; 2425 default: 2426 DEBUG_NET_WARN_ON_ONCE(1); 2427 goto drop; 2428 } 2429 #endif 2430 } else { 2431 if (!info) { 2432 WARN_ONCE(1, "%s: Missing encapsulation instructions\n", 2433 dev->name); 2434 goto drop; 2435 } 2436 pkey = &info->key; 2437 addr_family = ip_tunnel_info_af(info); 2438 dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port; 2439 vni = tunnel_id_to_key32(info->key.tun_id); 2440 ifindex = 0; 2441 dst_cache = &info->dst_cache; 2442 if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) { 2443 if (info->options_len < sizeof(*md)) 2444 goto drop; 2445 md = ip_tunnel_info_opts(info); 2446 } 2447 ttl = info->key.ttl; 2448 tos = info->key.tos; 2449 udp_sum = test_bit(IP_TUNNEL_CSUM_BIT, info->key.tun_flags); 2450 } 2451 src_port = udp_flow_src_port(dev_net(dev), skb, vxlan->cfg.port_min, 2452 vxlan->cfg.port_max, true); 2453 2454 rcu_read_lock(); 2455 if (addr_family == AF_INET) { 2456 struct vxlan_sock *sock4 = rcu_dereference(vxlan->vn4_sock); 2457 u16 ipcb_flags = 0; 2458 struct rtable *rt; 2459 __be16 df = 0; 2460 __be32 saddr; 2461 2462 if (!ifindex) 2463 ifindex = sock4->sock->sk->sk_bound_dev_if; 2464 2465 rt = udp_tunnel_dst_lookup(skb, dev, vxlan->net, ifindex, 2466 &saddr, pkey, src_port, dst_port, 2467 tos, use_cache ? dst_cache : NULL); 2468 if (IS_ERR(rt)) { 2469 err = PTR_ERR(rt); 2470 reason = SKB_DROP_REASON_IP_OUTNOROUTES; 2471 goto tx_error; 2472 } 2473 2474 if (flags & VXLAN_F_MC_ROUTE) 2475 ipcb_flags |= IPSKB_MCROUTE; 2476 2477 if (!info) { 2478 /* Bypass encapsulation if the destination is local */ 2479 err = encap_bypass_if_local(skb, dev, vxlan, AF_INET, 2480 dst_port, ifindex, vni, 2481 &rt->dst, rt->rt_flags); 2482 if (err) 2483 goto out_unlock; 2484 2485 if (vxlan->cfg.df == VXLAN_DF_SET) { 2486 df = htons(IP_DF); 2487 } else if (vxlan->cfg.df == VXLAN_DF_INHERIT) { 2488 struct ethhdr *eth = eth_hdr(skb); 2489 2490 if (ntohs(eth->h_proto) == ETH_P_IPV6 || 2491 (ntohs(eth->h_proto) == ETH_P_IP && 2492 old_iph->frag_off & htons(IP_DF))) 2493 df = htons(IP_DF); 2494 } 2495 } else if (test_bit(IP_TUNNEL_DONT_FRAGMENT_BIT, 2496 info->key.tun_flags)) { 2497 df = htons(IP_DF); 2498 } 2499 2500 ndst = &rt->dst; 2501 err = skb_tunnel_check_pmtu(skb, ndst, vxlan_headroom(flags & VXLAN_F_GPE), 2502 netif_is_any_bridge_port(dev)); 2503 if (err < 0) { 2504 goto tx_error; 2505 } else if (err) { 2506 if (info) { 2507 struct ip_tunnel_info *unclone; 2508 2509 unclone = skb_tunnel_info_unclone(skb); 2510 if (unlikely(!unclone)) 2511 goto tx_error; 2512 2513 unclone->key.u.ipv4.src = pkey->u.ipv4.dst; 2514 unclone->key.u.ipv4.dst = saddr; 2515 } 2516 vxlan_encap_bypass(skb, vxlan, vxlan, vni, false); 2517 dst_release(ndst); 2518 goto out_unlock; 2519 } 2520 2521 tos = ip_tunnel_ecn_encap(tos, old_iph, skb); 2522 ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); 2523 err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), 2524 vni, md, flags, udp_sum); 2525 if (err < 0) { 2526 reason = SKB_DROP_REASON_NOMEM; 2527 goto tx_error; 2528 } 2529 2530 udp_tunnel_xmit_skb(rt, sock4->sock->sk, skb, saddr, 2531 pkey->u.ipv4.dst, tos, ttl, df, 2532 src_port, dst_port, xnet, !udp_sum, 2533 ipcb_flags); 2534 #if IS_ENABLED(CONFIG_IPV6) 2535 } else { 2536 struct vxlan_sock *sock6 = rcu_dereference(vxlan->vn6_sock); 2537 struct in6_addr saddr; 2538 u16 ip6cb_flags = 0; 2539 2540 if (!ifindex) 2541 ifindex = sock6->sock->sk->sk_bound_dev_if; 2542 2543 ndst = udp_tunnel6_dst_lookup(skb, dev, vxlan->net, sock6->sock, 2544 ifindex, &saddr, pkey, 2545 src_port, dst_port, tos, 2546 use_cache ? dst_cache : NULL); 2547 if (IS_ERR(ndst)) { 2548 err = PTR_ERR(ndst); 2549 ndst = NULL; 2550 reason = SKB_DROP_REASON_IP_OUTNOROUTES; 2551 goto tx_error; 2552 } 2553 2554 if (flags & VXLAN_F_MC_ROUTE) 2555 ip6cb_flags |= IP6SKB_MCROUTE; 2556 2557 if (!info) { 2558 u32 rt6i_flags = dst_rt6_info(ndst)->rt6i_flags; 2559 2560 err = encap_bypass_if_local(skb, dev, vxlan, AF_INET6, 2561 dst_port, ifindex, vni, 2562 ndst, rt6i_flags); 2563 if (err) 2564 goto out_unlock; 2565 } 2566 2567 err = skb_tunnel_check_pmtu(skb, ndst, 2568 vxlan_headroom((flags & VXLAN_F_GPE) | VXLAN_F_IPV6), 2569 netif_is_any_bridge_port(dev)); 2570 if (err < 0) { 2571 goto tx_error; 2572 } else if (err) { 2573 if (info) { 2574 struct ip_tunnel_info *unclone; 2575 2576 unclone = skb_tunnel_info_unclone(skb); 2577 if (unlikely(!unclone)) 2578 goto tx_error; 2579 2580 unclone->key.u.ipv6.src = pkey->u.ipv6.dst; 2581 unclone->key.u.ipv6.dst = saddr; 2582 } 2583 2584 vxlan_encap_bypass(skb, vxlan, vxlan, vni, false); 2585 dst_release(ndst); 2586 goto out_unlock; 2587 } 2588 2589 tos = ip_tunnel_ecn_encap(tos, old_iph, skb); 2590 ttl = ttl ? : ip6_dst_hoplimit(ndst); 2591 skb_scrub_packet(skb, xnet); 2592 err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr), 2593 vni, md, flags, udp_sum); 2594 if (err < 0) { 2595 reason = SKB_DROP_REASON_NOMEM; 2596 goto tx_error; 2597 } 2598 2599 udp_tunnel6_xmit_skb(ndst, sock6->sock->sk, skb, dev, 2600 &saddr, &pkey->u.ipv6.dst, tos, ttl, 2601 pkey->label, src_port, dst_port, !udp_sum, 2602 ip6cb_flags); 2603 #endif 2604 } 2605 vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX, pkt_len); 2606 out_unlock: 2607 rcu_read_unlock(); 2608 return; 2609 2610 drop: 2611 dev_dstats_tx_dropped(dev); 2612 vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_DROPS, 0); 2613 kfree_skb_reason(skb, reason); 2614 return; 2615 2616 tx_error: 2617 rcu_read_unlock(); 2618 if (err == -ELOOP) 2619 DEV_STATS_INC(dev, collisions); 2620 else if (err == -ENETUNREACH) 2621 DEV_STATS_INC(dev, tx_carrier_errors); 2622 dst_release(ndst); 2623 DEV_STATS_INC(dev, tx_errors); 2624 vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_ERRORS, 0); 2625 kfree_skb_reason(skb, reason); 2626 } 2627 2628 static void vxlan_xmit_nh(struct sk_buff *skb, struct net_device *dev, 2629 struct vxlan_fdb *f, __be32 vni, bool did_rsc) 2630 { 2631 struct vxlan_rdst nh_rdst; 2632 struct nexthop *nh; 2633 bool do_xmit; 2634 u32 hash; 2635 2636 memset(&nh_rdst, 0, sizeof(struct vxlan_rdst)); 2637 hash = skb_get_hash(skb); 2638 2639 nh = rcu_dereference(f->nh); 2640 if (!nh) 2641 goto drop; 2642 do_xmit = vxlan_fdb_nh_path_select(nh, hash, &nh_rdst); 2643 2644 if (likely(do_xmit)) 2645 vxlan_xmit_one(skb, dev, vni, &nh_rdst, did_rsc); 2646 else 2647 goto drop; 2648 2649 return; 2650 2651 drop: 2652 dev_dstats_tx_dropped(dev); 2653 vxlan_vnifilter_count(netdev_priv(dev), vni, NULL, 2654 VXLAN_VNI_STATS_TX_DROPS, 0); 2655 dev_kfree_skb(skb); 2656 } 2657 2658 static netdev_tx_t vxlan_xmit_nhid(struct sk_buff *skb, struct net_device *dev, 2659 u32 nhid, __be32 vni) 2660 { 2661 struct vxlan_dev *vxlan = netdev_priv(dev); 2662 struct vxlan_rdst nh_rdst; 2663 struct nexthop *nh; 2664 bool do_xmit; 2665 u32 hash; 2666 2667 memset(&nh_rdst, 0, sizeof(struct vxlan_rdst)); 2668 hash = skb_get_hash(skb); 2669 2670 rcu_read_lock(); 2671 nh = nexthop_find_by_id(dev_net(dev), nhid); 2672 if (unlikely(!nh || !nexthop_is_fdb(nh) || !nexthop_is_multipath(nh))) { 2673 rcu_read_unlock(); 2674 goto drop; 2675 } 2676 do_xmit = vxlan_fdb_nh_path_select(nh, hash, &nh_rdst); 2677 rcu_read_unlock(); 2678 2679 if (vxlan->cfg.saddr.sa.sa_family != nh_rdst.remote_ip.sa.sa_family) 2680 goto drop; 2681 2682 if (likely(do_xmit)) 2683 vxlan_xmit_one(skb, dev, vni, &nh_rdst, false); 2684 else 2685 goto drop; 2686 2687 return NETDEV_TX_OK; 2688 2689 drop: 2690 dev_dstats_tx_dropped(dev); 2691 vxlan_vnifilter_count(netdev_priv(dev), vni, NULL, 2692 VXLAN_VNI_STATS_TX_DROPS, 0); 2693 dev_kfree_skb(skb); 2694 return NETDEV_TX_OK; 2695 } 2696 2697 /* Transmit local packets over Vxlan 2698 * 2699 * Outer IP header inherits ECN and DF from inner header. 2700 * Outer UDP destination is the VXLAN assigned port. 2701 * source port is based on hash of flow 2702 */ 2703 static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev) 2704 { 2705 struct vxlan_dev *vxlan = netdev_priv(dev); 2706 struct vxlan_rdst *rdst, *fdst = NULL; 2707 const struct ip_tunnel_info *info; 2708 struct vxlan_fdb *f; 2709 struct ethhdr *eth; 2710 __be32 vni = 0; 2711 u32 nhid = 0; 2712 bool did_rsc; 2713 2714 info = skb_tunnel_info(skb); 2715 2716 skb_reset_mac_header(skb); 2717 2718 if (vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA) { 2719 if (info && info->mode & IP_TUNNEL_INFO_BRIDGE && 2720 info->mode & IP_TUNNEL_INFO_TX) { 2721 vni = tunnel_id_to_key32(info->key.tun_id); 2722 nhid = info->key.nhid; 2723 } else { 2724 if (info && info->mode & IP_TUNNEL_INFO_TX) 2725 vxlan_xmit_one(skb, dev, vni, NULL, false); 2726 else 2727 kfree_skb_reason(skb, SKB_DROP_REASON_TUNNEL_TXINFO); 2728 return NETDEV_TX_OK; 2729 } 2730 } 2731 2732 if (vxlan->cfg.flags & VXLAN_F_PROXY) { 2733 eth = eth_hdr(skb); 2734 if (ntohs(eth->h_proto) == ETH_P_ARP) 2735 return arp_reduce(dev, skb, vni); 2736 #if IS_ENABLED(CONFIG_IPV6) 2737 else if (ntohs(eth->h_proto) == ETH_P_IPV6 && 2738 pskb_may_pull(skb, sizeof(struct ipv6hdr) + 2739 sizeof(struct nd_msg)) && 2740 ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) { 2741 struct nd_msg *m = (struct nd_msg *)(ipv6_hdr(skb) + 1); 2742 2743 if (m->icmph.icmp6_code == 0 && 2744 m->icmph.icmp6_type == NDISC_NEIGHBOUR_SOLICITATION) 2745 return neigh_reduce(dev, skb, vni); 2746 } 2747 #endif 2748 } 2749 2750 if (nhid) 2751 return vxlan_xmit_nhid(skb, dev, nhid, vni); 2752 2753 if (vxlan->cfg.flags & VXLAN_F_MDB) { 2754 struct vxlan_mdb_entry *mdb_entry; 2755 2756 rcu_read_lock(); 2757 mdb_entry = vxlan_mdb_entry_skb_get(vxlan, skb, vni); 2758 if (mdb_entry) { 2759 netdev_tx_t ret; 2760 2761 ret = vxlan_mdb_xmit(vxlan, mdb_entry, skb); 2762 rcu_read_unlock(); 2763 return ret; 2764 } 2765 rcu_read_unlock(); 2766 } 2767 2768 eth = eth_hdr(skb); 2769 rcu_read_lock(); 2770 f = vxlan_find_mac_tx(vxlan, eth->h_dest, vni); 2771 did_rsc = false; 2772 2773 if (f && (f->flags & NTF_ROUTER) && (vxlan->cfg.flags & VXLAN_F_RSC) && 2774 (ntohs(eth->h_proto) == ETH_P_IP || 2775 ntohs(eth->h_proto) == ETH_P_IPV6)) { 2776 did_rsc = route_shortcircuit(dev, skb); 2777 if (did_rsc) 2778 f = vxlan_find_mac_tx(vxlan, eth->h_dest, vni); 2779 } 2780 2781 if (f == NULL) { 2782 f = vxlan_find_mac_tx(vxlan, all_zeros_mac, vni); 2783 if (f == NULL) { 2784 if ((vxlan->cfg.flags & VXLAN_F_L2MISS) && 2785 !is_multicast_ether_addr(eth->h_dest)) 2786 vxlan_fdb_miss(vxlan, eth->h_dest); 2787 2788 dev_dstats_tx_dropped(dev); 2789 vxlan_vnifilter_count(vxlan, vni, NULL, 2790 VXLAN_VNI_STATS_TX_DROPS, 0); 2791 kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET); 2792 goto out; 2793 } 2794 } 2795 2796 if (rcu_access_pointer(f->nh)) { 2797 vxlan_xmit_nh(skb, dev, f, 2798 (vni ? : vxlan->default_dst.remote_vni), did_rsc); 2799 } else { 2800 list_for_each_entry_rcu(rdst, &f->remotes, list) { 2801 struct sk_buff *skb1; 2802 2803 if (!fdst) { 2804 fdst = rdst; 2805 continue; 2806 } 2807 skb1 = skb_clone(skb, GFP_ATOMIC); 2808 if (skb1) 2809 vxlan_xmit_one(skb1, dev, vni, rdst, did_rsc); 2810 } 2811 if (fdst) 2812 vxlan_xmit_one(skb, dev, vni, fdst, did_rsc); 2813 else 2814 kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET); 2815 } 2816 2817 out: 2818 rcu_read_unlock(); 2819 return NETDEV_TX_OK; 2820 } 2821 2822 /* Walk the forwarding table and purge stale entries */ 2823 static void vxlan_cleanup(struct timer_list *t) 2824 { 2825 struct vxlan_dev *vxlan = timer_container_of(vxlan, t, age_timer); 2826 unsigned long next_timer = jiffies + FDB_AGE_INTERVAL; 2827 struct vxlan_fdb *f; 2828 2829 if (!netif_running(vxlan->dev)) 2830 return; 2831 2832 rcu_read_lock(); 2833 hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) { 2834 unsigned long timeout; 2835 2836 if (f->state & (NUD_PERMANENT | NUD_NOARP)) 2837 continue; 2838 2839 if (f->flags & NTF_EXT_LEARNED) 2840 continue; 2841 2842 timeout = READ_ONCE(f->updated) + vxlan->cfg.age_interval * HZ; 2843 if (time_before_eq(timeout, jiffies)) { 2844 spin_lock(&vxlan->hash_lock); 2845 if (!hlist_unhashed(&f->fdb_node)) { 2846 netdev_dbg(vxlan->dev, "garbage collect %pM\n", 2847 f->key.eth_addr); 2848 f->state = NUD_STALE; 2849 vxlan_fdb_destroy(vxlan, f, true, true); 2850 } 2851 spin_unlock(&vxlan->hash_lock); 2852 } else if (time_before(timeout, next_timer)) { 2853 next_timer = timeout; 2854 } 2855 } 2856 rcu_read_unlock(); 2857 2858 mod_timer(&vxlan->age_timer, next_timer); 2859 } 2860 2861 static void vxlan_vs_del_dev(struct vxlan_dev *vxlan) 2862 { 2863 ASSERT_RTNL(); 2864 2865 hlist_del_init_rcu(&vxlan->hlist4.hlist); 2866 #if IS_ENABLED(CONFIG_IPV6) 2867 hlist_del_init_rcu(&vxlan->hlist6.hlist); 2868 #endif 2869 } 2870 2871 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan, 2872 struct vxlan_dev_node *node) 2873 { 2874 __be32 vni = vxlan->default_dst.remote_vni; 2875 2876 ASSERT_RTNL(); 2877 2878 node->vxlan = vxlan; 2879 hlist_add_head_rcu(&node->hlist, vni_head(vs, vni)); 2880 } 2881 2882 /* Setup stats when device is created */ 2883 static int vxlan_init(struct net_device *dev) 2884 { 2885 struct vxlan_dev *vxlan = netdev_priv(dev); 2886 int err; 2887 2888 err = rhashtable_init(&vxlan->fdb_hash_tbl, &vxlan_fdb_rht_params); 2889 if (err) 2890 return err; 2891 2892 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) { 2893 err = vxlan_vnigroup_init(vxlan); 2894 if (err) 2895 goto err_rhashtable_destroy; 2896 } 2897 2898 err = gro_cells_init(&vxlan->gro_cells, dev); 2899 if (err) 2900 goto err_vnigroup_uninit; 2901 2902 err = vxlan_mdb_init(vxlan); 2903 if (err) 2904 goto err_gro_cells_destroy; 2905 2906 netdev_lockdep_set_classes(dev); 2907 return 0; 2908 2909 err_gro_cells_destroy: 2910 gro_cells_destroy(&vxlan->gro_cells); 2911 err_vnigroup_uninit: 2912 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) 2913 vxlan_vnigroup_uninit(vxlan); 2914 err_rhashtable_destroy: 2915 rhashtable_destroy(&vxlan->fdb_hash_tbl); 2916 return err; 2917 } 2918 2919 static void vxlan_uninit(struct net_device *dev) 2920 { 2921 struct vxlan_dev *vxlan = netdev_priv(dev); 2922 2923 vxlan_mdb_fini(vxlan); 2924 2925 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) 2926 vxlan_vnigroup_uninit(vxlan); 2927 2928 gro_cells_destroy(&vxlan->gro_cells); 2929 2930 rhashtable_destroy(&vxlan->fdb_hash_tbl); 2931 } 2932 2933 /* Start ageing timer and join group when device is brought up */ 2934 static int vxlan_open(struct net_device *dev) 2935 { 2936 struct vxlan_dev *vxlan = netdev_priv(dev); 2937 int ret; 2938 2939 ret = vxlan_sock_add(vxlan); 2940 if (ret < 0) 2941 return ret; 2942 2943 ret = vxlan_multicast_join(vxlan); 2944 if (ret) { 2945 vxlan_sock_release(vxlan); 2946 return ret; 2947 } 2948 2949 if (vxlan->cfg.age_interval) 2950 mod_timer(&vxlan->age_timer, jiffies + FDB_AGE_INTERVAL); 2951 2952 return ret; 2953 } 2954 2955 struct vxlan_fdb_flush_desc { 2956 bool ignore_default_entry; 2957 unsigned long state; 2958 unsigned long state_mask; 2959 unsigned long flags; 2960 unsigned long flags_mask; 2961 __be32 src_vni; 2962 u32 nhid; 2963 __be32 vni; 2964 __be16 port; 2965 union vxlan_addr dst_ip; 2966 }; 2967 2968 static bool vxlan_fdb_is_default_entry(const struct vxlan_fdb *f, 2969 const struct vxlan_dev *vxlan) 2970 { 2971 return is_zero_ether_addr(f->key.eth_addr) && 2972 f->key.vni == vxlan->cfg.vni; 2973 } 2974 2975 static bool vxlan_fdb_nhid_matches(const struct vxlan_fdb *f, u32 nhid) 2976 { 2977 struct nexthop *nh = rtnl_dereference(f->nh); 2978 2979 return nh && nh->id == nhid; 2980 } 2981 2982 static bool vxlan_fdb_flush_matches(const struct vxlan_fdb *f, 2983 const struct vxlan_dev *vxlan, 2984 const struct vxlan_fdb_flush_desc *desc) 2985 { 2986 if (desc->state_mask && (f->state & desc->state_mask) != desc->state) 2987 return false; 2988 2989 if (desc->flags_mask && (f->flags & desc->flags_mask) != desc->flags) 2990 return false; 2991 2992 if (desc->ignore_default_entry && vxlan_fdb_is_default_entry(f, vxlan)) 2993 return false; 2994 2995 if (desc->src_vni && f->key.vni != desc->src_vni) 2996 return false; 2997 2998 if (desc->nhid && !vxlan_fdb_nhid_matches(f, desc->nhid)) 2999 return false; 3000 3001 return true; 3002 } 3003 3004 static bool 3005 vxlan_fdb_flush_should_match_remotes(const struct vxlan_fdb_flush_desc *desc) 3006 { 3007 return desc->vni || desc->port || desc->dst_ip.sa.sa_family; 3008 } 3009 3010 static bool 3011 vxlan_fdb_flush_remote_matches(const struct vxlan_fdb_flush_desc *desc, 3012 const struct vxlan_rdst *rd) 3013 { 3014 if (desc->vni && rd->remote_vni != desc->vni) 3015 return false; 3016 3017 if (desc->port && rd->remote_port != desc->port) 3018 return false; 3019 3020 if (desc->dst_ip.sa.sa_family && 3021 !vxlan_addr_equal(&rd->remote_ip, &desc->dst_ip)) 3022 return false; 3023 3024 return true; 3025 } 3026 3027 static void 3028 vxlan_fdb_flush_match_remotes(struct vxlan_fdb *f, struct vxlan_dev *vxlan, 3029 const struct vxlan_fdb_flush_desc *desc, 3030 bool *p_destroy_fdb) 3031 { 3032 bool remotes_flushed = false; 3033 struct vxlan_rdst *rd, *tmp; 3034 3035 list_for_each_entry_safe(rd, tmp, &f->remotes, list) { 3036 if (!vxlan_fdb_flush_remote_matches(desc, rd)) 3037 continue; 3038 3039 vxlan_fdb_dst_destroy(vxlan, f, rd, true); 3040 remotes_flushed = true; 3041 } 3042 3043 *p_destroy_fdb = remotes_flushed && list_empty(&f->remotes); 3044 } 3045 3046 /* Purge the forwarding table */ 3047 static void vxlan_flush(struct vxlan_dev *vxlan, 3048 const struct vxlan_fdb_flush_desc *desc) 3049 { 3050 bool match_remotes = vxlan_fdb_flush_should_match_remotes(desc); 3051 struct vxlan_fdb *f; 3052 3053 rcu_read_lock(); 3054 hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) { 3055 if (!vxlan_fdb_flush_matches(f, vxlan, desc)) 3056 continue; 3057 3058 spin_lock_bh(&vxlan->hash_lock); 3059 if (hlist_unhashed(&f->fdb_node)) 3060 goto unlock; 3061 3062 if (match_remotes) { 3063 bool destroy_fdb = false; 3064 3065 vxlan_fdb_flush_match_remotes(f, vxlan, desc, 3066 &destroy_fdb); 3067 3068 if (!destroy_fdb) 3069 goto unlock; 3070 } 3071 3072 vxlan_fdb_destroy(vxlan, f, true, true); 3073 unlock: 3074 spin_unlock_bh(&vxlan->hash_lock); 3075 } 3076 rcu_read_unlock(); 3077 } 3078 3079 static const struct nla_policy vxlan_del_bulk_policy[NDA_MAX + 1] = { 3080 [NDA_SRC_VNI] = { .type = NLA_U32 }, 3081 [NDA_NH_ID] = { .type = NLA_U32 }, 3082 [NDA_VNI] = { .type = NLA_U32 }, 3083 [NDA_PORT] = { .type = NLA_U16 }, 3084 [NDA_DST] = NLA_POLICY_RANGE(NLA_BINARY, sizeof(struct in_addr), 3085 sizeof(struct in6_addr)), 3086 [NDA_NDM_STATE_MASK] = { .type = NLA_U16 }, 3087 [NDA_NDM_FLAGS_MASK] = { .type = NLA_U8 }, 3088 }; 3089 3090 #define VXLAN_FDB_FLUSH_IGNORED_NDM_FLAGS (NTF_MASTER | NTF_SELF) 3091 #define VXLAN_FDB_FLUSH_ALLOWED_NDM_STATES (NUD_PERMANENT | NUD_NOARP) 3092 #define VXLAN_FDB_FLUSH_ALLOWED_NDM_FLAGS (NTF_EXT_LEARNED | NTF_OFFLOADED | \ 3093 NTF_ROUTER) 3094 3095 static int vxlan_fdb_delete_bulk(struct nlmsghdr *nlh, struct net_device *dev, 3096 struct netlink_ext_ack *extack) 3097 { 3098 struct vxlan_dev *vxlan = netdev_priv(dev); 3099 struct vxlan_fdb_flush_desc desc = {}; 3100 struct ndmsg *ndm = nlmsg_data(nlh); 3101 struct nlattr *tb[NDA_MAX + 1]; 3102 u8 ndm_flags; 3103 int err; 3104 3105 ndm_flags = ndm->ndm_flags & ~VXLAN_FDB_FLUSH_IGNORED_NDM_FLAGS; 3106 3107 err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, vxlan_del_bulk_policy, 3108 extack); 3109 if (err) 3110 return err; 3111 3112 if (ndm_flags & ~VXLAN_FDB_FLUSH_ALLOWED_NDM_FLAGS) { 3113 NL_SET_ERR_MSG(extack, "Unsupported fdb flush ndm flag bits set"); 3114 return -EINVAL; 3115 } 3116 if (ndm->ndm_state & ~VXLAN_FDB_FLUSH_ALLOWED_NDM_STATES) { 3117 NL_SET_ERR_MSG(extack, "Unsupported fdb flush ndm state bits set"); 3118 return -EINVAL; 3119 } 3120 3121 desc.state = ndm->ndm_state; 3122 desc.flags = ndm_flags; 3123 3124 if (tb[NDA_NDM_STATE_MASK]) 3125 desc.state_mask = nla_get_u16(tb[NDA_NDM_STATE_MASK]); 3126 3127 if (tb[NDA_NDM_FLAGS_MASK]) 3128 desc.flags_mask = nla_get_u8(tb[NDA_NDM_FLAGS_MASK]); 3129 3130 if (tb[NDA_SRC_VNI]) 3131 desc.src_vni = cpu_to_be32(nla_get_u32(tb[NDA_SRC_VNI])); 3132 3133 if (tb[NDA_NH_ID]) 3134 desc.nhid = nla_get_u32(tb[NDA_NH_ID]); 3135 3136 if (tb[NDA_VNI]) 3137 desc.vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI])); 3138 3139 if (tb[NDA_PORT]) 3140 desc.port = nla_get_be16(tb[NDA_PORT]); 3141 3142 if (tb[NDA_DST]) { 3143 union vxlan_addr ip; 3144 3145 err = vxlan_nla_get_addr(&ip, tb[NDA_DST]); 3146 if (err) { 3147 NL_SET_ERR_MSG_ATTR(extack, tb[NDA_DST], 3148 "Unsupported address family"); 3149 return err; 3150 } 3151 desc.dst_ip = ip; 3152 } 3153 3154 vxlan_flush(vxlan, &desc); 3155 3156 return 0; 3157 } 3158 3159 /* Cleanup timer and forwarding table on shutdown */ 3160 static int vxlan_stop(struct net_device *dev) 3161 { 3162 struct vxlan_dev *vxlan = netdev_priv(dev); 3163 struct vxlan_fdb_flush_desc desc = { 3164 /* Default entry is deleted at vxlan_dellink. */ 3165 .ignore_default_entry = true, 3166 .state = 0, 3167 .state_mask = NUD_PERMANENT | NUD_NOARP, 3168 }; 3169 3170 vxlan_multicast_leave(vxlan); 3171 3172 timer_delete_sync(&vxlan->age_timer); 3173 3174 vxlan_flush(vxlan, &desc); 3175 vxlan_sock_release(vxlan); 3176 3177 return 0; 3178 } 3179 3180 /* Stub, nothing needs to be done. */ 3181 static void vxlan_set_multicast_list(struct net_device *dev) 3182 { 3183 } 3184 3185 static int vxlan_change_mtu(struct net_device *dev, int new_mtu) 3186 { 3187 struct vxlan_dev *vxlan = netdev_priv(dev); 3188 struct vxlan_rdst *dst = &vxlan->default_dst; 3189 struct net_device *lowerdev = __dev_get_by_index(vxlan->net, 3190 dst->remote_ifindex); 3191 3192 /* This check is different than dev->max_mtu, because it looks at 3193 * the lowerdev->mtu, rather than the static dev->max_mtu 3194 */ 3195 if (lowerdev) { 3196 int max_mtu = lowerdev->mtu - vxlan_headroom(vxlan->cfg.flags); 3197 if (new_mtu > max_mtu) 3198 return -EINVAL; 3199 } 3200 3201 WRITE_ONCE(dev->mtu, new_mtu); 3202 return 0; 3203 } 3204 3205 static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) 3206 { 3207 struct vxlan_dev *vxlan = netdev_priv(dev); 3208 struct ip_tunnel_info *info = skb_tunnel_info(skb); 3209 __be16 sport, dport; 3210 3211 sport = udp_flow_src_port(dev_net(dev), skb, vxlan->cfg.port_min, 3212 vxlan->cfg.port_max, true); 3213 dport = info->key.tp_dst ? : vxlan->cfg.dst_port; 3214 3215 if (ip_tunnel_info_af(info) == AF_INET) { 3216 struct vxlan_sock *sock4 = rcu_dereference(vxlan->vn4_sock); 3217 struct rtable *rt; 3218 3219 if (!sock4) 3220 return -EIO; 3221 3222 rt = udp_tunnel_dst_lookup(skb, dev, vxlan->net, 0, 3223 &info->key.u.ipv4.src, 3224 &info->key, 3225 sport, dport, info->key.tos, 3226 &info->dst_cache); 3227 if (IS_ERR(rt)) 3228 return PTR_ERR(rt); 3229 ip_rt_put(rt); 3230 } else { 3231 #if IS_ENABLED(CONFIG_IPV6) 3232 struct vxlan_sock *sock6 = rcu_dereference(vxlan->vn6_sock); 3233 struct dst_entry *ndst; 3234 3235 if (!sock6) 3236 return -EIO; 3237 3238 ndst = udp_tunnel6_dst_lookup(skb, dev, vxlan->net, sock6->sock, 3239 0, &info->key.u.ipv6.src, 3240 &info->key, 3241 sport, dport, info->key.tos, 3242 &info->dst_cache); 3243 if (IS_ERR(ndst)) 3244 return PTR_ERR(ndst); 3245 dst_release(ndst); 3246 #else /* !CONFIG_IPV6 */ 3247 return -EPFNOSUPPORT; 3248 #endif 3249 } 3250 info->key.tp_src = sport; 3251 info->key.tp_dst = dport; 3252 return 0; 3253 } 3254 3255 static const struct net_device_ops vxlan_netdev_ether_ops = { 3256 .ndo_init = vxlan_init, 3257 .ndo_uninit = vxlan_uninit, 3258 .ndo_open = vxlan_open, 3259 .ndo_stop = vxlan_stop, 3260 .ndo_start_xmit = vxlan_xmit, 3261 .ndo_set_rx_mode = vxlan_set_multicast_list, 3262 .ndo_change_mtu = vxlan_change_mtu, 3263 .ndo_validate_addr = eth_validate_addr, 3264 .ndo_set_mac_address = eth_mac_addr, 3265 .ndo_fdb_add = vxlan_fdb_add, 3266 .ndo_fdb_del = vxlan_fdb_delete, 3267 .ndo_fdb_del_bulk = vxlan_fdb_delete_bulk, 3268 .ndo_fdb_dump = vxlan_fdb_dump, 3269 .ndo_fdb_get = vxlan_fdb_get, 3270 .ndo_mdb_add = vxlan_mdb_add, 3271 .ndo_mdb_del = vxlan_mdb_del, 3272 .ndo_mdb_del_bulk = vxlan_mdb_del_bulk, 3273 .ndo_mdb_dump = vxlan_mdb_dump, 3274 .ndo_mdb_get = vxlan_mdb_get, 3275 .ndo_fill_metadata_dst = vxlan_fill_metadata_dst, 3276 }; 3277 3278 static const struct net_device_ops vxlan_netdev_raw_ops = { 3279 .ndo_init = vxlan_init, 3280 .ndo_uninit = vxlan_uninit, 3281 .ndo_open = vxlan_open, 3282 .ndo_stop = vxlan_stop, 3283 .ndo_start_xmit = vxlan_xmit, 3284 .ndo_change_mtu = vxlan_change_mtu, 3285 .ndo_fill_metadata_dst = vxlan_fill_metadata_dst, 3286 }; 3287 3288 /* Info for udev, that this is a virtual tunnel endpoint */ 3289 static const struct device_type vxlan_type = { 3290 .name = "vxlan", 3291 }; 3292 3293 /* Calls the ndo_udp_tunnel_add of the caller in order to 3294 * supply the listening VXLAN udp ports. Callers are expected 3295 * to implement the ndo_udp_tunnel_add. 3296 */ 3297 static void vxlan_offload_rx_ports(struct net_device *dev, bool push) 3298 { 3299 struct vxlan_sock *vs; 3300 struct net *net = dev_net(dev); 3301 struct vxlan_net *vn = net_generic(net, vxlan_net_id); 3302 unsigned int i; 3303 3304 ASSERT_RTNL(); 3305 3306 for (i = 0; i < PORT_HASH_SIZE; ++i) { 3307 hlist_for_each_entry(vs, &vn->sock_list[i], hlist) { 3308 unsigned short type; 3309 3310 if (vs->flags & VXLAN_F_GPE) 3311 type = UDP_TUNNEL_TYPE_VXLAN_GPE; 3312 else 3313 type = UDP_TUNNEL_TYPE_VXLAN; 3314 3315 if (push) 3316 udp_tunnel_push_rx_port(dev, vs->sock, type); 3317 else 3318 udp_tunnel_drop_rx_port(dev, vs->sock, type); 3319 } 3320 } 3321 } 3322 3323 /* Initialize the device structure. */ 3324 static void vxlan_setup(struct net_device *dev) 3325 { 3326 struct vxlan_dev *vxlan = netdev_priv(dev); 3327 3328 eth_hw_addr_random(dev); 3329 ether_setup(dev); 3330 3331 dev->needs_free_netdev = true; 3332 SET_NETDEV_DEVTYPE(dev, &vxlan_type); 3333 3334 dev->features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_FRAGLIST; 3335 dev->features |= NETIF_F_RXCSUM; 3336 dev->features |= NETIF_F_GSO_SOFTWARE; 3337 3338 dev->vlan_features = dev->features; 3339 dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_FRAGLIST; 3340 dev->hw_features |= NETIF_F_RXCSUM; 3341 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 3342 netif_keep_dst(dev); 3343 dev->priv_flags |= IFF_NO_QUEUE; 3344 dev->change_proto_down = true; 3345 dev->lltx = true; 3346 3347 /* MTU range: 68 - 65535 */ 3348 dev->min_mtu = ETH_MIN_MTU; 3349 dev->max_mtu = ETH_MAX_MTU; 3350 3351 dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS; 3352 INIT_LIST_HEAD(&vxlan->next); 3353 spin_lock_init(&vxlan->hash_lock); 3354 3355 timer_setup(&vxlan->age_timer, vxlan_cleanup, TIMER_DEFERRABLE); 3356 3357 vxlan->dev = dev; 3358 3359 INIT_HLIST_HEAD(&vxlan->fdb_list); 3360 } 3361 3362 static void vxlan_ether_setup(struct net_device *dev) 3363 { 3364 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 3365 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 3366 dev->netdev_ops = &vxlan_netdev_ether_ops; 3367 } 3368 3369 static void vxlan_raw_setup(struct net_device *dev) 3370 { 3371 dev->header_ops = NULL; 3372 dev->type = ARPHRD_NONE; 3373 dev->hard_header_len = 0; 3374 dev->addr_len = 0; 3375 dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; 3376 dev->netdev_ops = &vxlan_netdev_raw_ops; 3377 } 3378 3379 static const struct nla_policy vxlan_policy[IFLA_VXLAN_MAX + 1] = { 3380 [IFLA_VXLAN_UNSPEC] = { .strict_start_type = IFLA_VXLAN_LOCALBYPASS }, 3381 [IFLA_VXLAN_ID] = { .type = NLA_U32 }, 3382 [IFLA_VXLAN_GROUP] = { .len = sizeof_field(struct iphdr, daddr) }, 3383 [IFLA_VXLAN_GROUP6] = { .len = sizeof(struct in6_addr) }, 3384 [IFLA_VXLAN_LINK] = { .type = NLA_U32 }, 3385 [IFLA_VXLAN_LOCAL] = { .len = sizeof_field(struct iphdr, saddr) }, 3386 [IFLA_VXLAN_LOCAL6] = { .len = sizeof(struct in6_addr) }, 3387 [IFLA_VXLAN_TOS] = { .type = NLA_U8 }, 3388 [IFLA_VXLAN_TTL] = { .type = NLA_U8 }, 3389 [IFLA_VXLAN_LABEL] = { .type = NLA_U32 }, 3390 [IFLA_VXLAN_LEARNING] = { .type = NLA_U8 }, 3391 [IFLA_VXLAN_AGEING] = { .type = NLA_U32 }, 3392 [IFLA_VXLAN_LIMIT] = { .type = NLA_U32 }, 3393 [IFLA_VXLAN_PORT_RANGE] = { .len = sizeof(struct ifla_vxlan_port_range) }, 3394 [IFLA_VXLAN_PROXY] = { .type = NLA_U8 }, 3395 [IFLA_VXLAN_RSC] = { .type = NLA_U8 }, 3396 [IFLA_VXLAN_L2MISS] = { .type = NLA_U8 }, 3397 [IFLA_VXLAN_L3MISS] = { .type = NLA_U8 }, 3398 [IFLA_VXLAN_COLLECT_METADATA] = { .type = NLA_U8 }, 3399 [IFLA_VXLAN_PORT] = { .type = NLA_U16 }, 3400 [IFLA_VXLAN_UDP_CSUM] = { .type = NLA_U8 }, 3401 [IFLA_VXLAN_UDP_ZERO_CSUM6_TX] = { .type = NLA_U8 }, 3402 [IFLA_VXLAN_UDP_ZERO_CSUM6_RX] = { .type = NLA_U8 }, 3403 [IFLA_VXLAN_REMCSUM_TX] = { .type = NLA_U8 }, 3404 [IFLA_VXLAN_REMCSUM_RX] = { .type = NLA_U8 }, 3405 [IFLA_VXLAN_GBP] = { .type = NLA_FLAG, }, 3406 [IFLA_VXLAN_GPE] = { .type = NLA_FLAG, }, 3407 [IFLA_VXLAN_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG }, 3408 [IFLA_VXLAN_TTL_INHERIT] = { .type = NLA_FLAG }, 3409 [IFLA_VXLAN_DF] = { .type = NLA_U8 }, 3410 [IFLA_VXLAN_VNIFILTER] = { .type = NLA_U8 }, 3411 [IFLA_VXLAN_LOCALBYPASS] = NLA_POLICY_MAX(NLA_U8, 1), 3412 [IFLA_VXLAN_LABEL_POLICY] = NLA_POLICY_MAX(NLA_U32, VXLAN_LABEL_MAX), 3413 [IFLA_VXLAN_RESERVED_BITS] = NLA_POLICY_EXACT_LEN(sizeof(struct vxlanhdr)), 3414 [IFLA_VXLAN_MC_ROUTE] = NLA_POLICY_MAX(NLA_U8, 1), 3415 }; 3416 3417 static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[], 3418 struct netlink_ext_ack *extack) 3419 { 3420 if (tb[IFLA_ADDRESS]) { 3421 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) { 3422 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_ADDRESS], 3423 "Provided link layer address is not Ethernet"); 3424 return -EINVAL; 3425 } 3426 3427 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) { 3428 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_ADDRESS], 3429 "Provided Ethernet address is not unicast"); 3430 return -EADDRNOTAVAIL; 3431 } 3432 } 3433 3434 if (tb[IFLA_MTU]) { 3435 u32 mtu = nla_get_u32(tb[IFLA_MTU]); 3436 3437 if (mtu < ETH_MIN_MTU || mtu > ETH_MAX_MTU) { 3438 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_MTU], 3439 "MTU must be between 68 and 65535"); 3440 return -EINVAL; 3441 } 3442 } 3443 3444 if (!data) { 3445 NL_SET_ERR_MSG(extack, 3446 "Required attributes not provided to perform the operation"); 3447 return -EINVAL; 3448 } 3449 3450 if (data[IFLA_VXLAN_ID]) { 3451 u32 id = nla_get_u32(data[IFLA_VXLAN_ID]); 3452 3453 if (id >= VXLAN_N_VID) { 3454 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_ID], 3455 "VXLAN ID must be lower than 16777216"); 3456 return -ERANGE; 3457 } 3458 } 3459 3460 if (data[IFLA_VXLAN_PORT_RANGE]) { 3461 const struct ifla_vxlan_port_range *p 3462 = nla_data(data[IFLA_VXLAN_PORT_RANGE]); 3463 3464 if (ntohs(p->high) < ntohs(p->low)) { 3465 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_PORT_RANGE], 3466 "Invalid source port range"); 3467 return -EINVAL; 3468 } 3469 } 3470 3471 if (data[IFLA_VXLAN_DF]) { 3472 enum ifla_vxlan_df df = nla_get_u8(data[IFLA_VXLAN_DF]); 3473 3474 if (df < 0 || df > VXLAN_DF_MAX) { 3475 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_DF], 3476 "Invalid DF attribute"); 3477 return -EINVAL; 3478 } 3479 } 3480 3481 return 0; 3482 } 3483 3484 static void vxlan_get_drvinfo(struct net_device *netdev, 3485 struct ethtool_drvinfo *drvinfo) 3486 { 3487 strscpy(drvinfo->version, VXLAN_VERSION, sizeof(drvinfo->version)); 3488 strscpy(drvinfo->driver, "vxlan", sizeof(drvinfo->driver)); 3489 } 3490 3491 static int vxlan_get_link_ksettings(struct net_device *dev, 3492 struct ethtool_link_ksettings *cmd) 3493 { 3494 struct vxlan_dev *vxlan = netdev_priv(dev); 3495 struct vxlan_rdst *dst = &vxlan->default_dst; 3496 struct net_device *lowerdev = __dev_get_by_index(vxlan->net, 3497 dst->remote_ifindex); 3498 3499 if (!lowerdev) { 3500 cmd->base.duplex = DUPLEX_UNKNOWN; 3501 cmd->base.port = PORT_OTHER; 3502 cmd->base.speed = SPEED_UNKNOWN; 3503 3504 return 0; 3505 } 3506 3507 return __ethtool_get_link_ksettings(lowerdev, cmd); 3508 } 3509 3510 static const struct ethtool_ops vxlan_ethtool_ops = { 3511 .get_drvinfo = vxlan_get_drvinfo, 3512 .get_link = ethtool_op_get_link, 3513 .get_link_ksettings = vxlan_get_link_ksettings, 3514 }; 3515 3516 static struct socket *vxlan_create_sock(struct net *net, bool ipv6, 3517 __be16 port, u32 flags, int ifindex) 3518 { 3519 struct socket *sock; 3520 struct udp_port_cfg udp_conf; 3521 int err; 3522 3523 memset(&udp_conf, 0, sizeof(udp_conf)); 3524 3525 if (ipv6) { 3526 udp_conf.family = AF_INET6; 3527 udp_conf.use_udp6_rx_checksums = 3528 !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX); 3529 udp_conf.ipv6_v6only = 1; 3530 } else { 3531 udp_conf.family = AF_INET; 3532 } 3533 3534 udp_conf.local_udp_port = port; 3535 udp_conf.bind_ifindex = ifindex; 3536 3537 /* Open UDP socket */ 3538 err = udp_sock_create(net, &udp_conf, &sock); 3539 if (err < 0) 3540 return ERR_PTR(err); 3541 3542 udp_allow_gso(sock->sk); 3543 return sock; 3544 } 3545 3546 /* Create new listen socket if needed */ 3547 static struct vxlan_sock *vxlan_socket_create(struct net *net, bool ipv6, 3548 __be16 port, u32 flags, 3549 int ifindex) 3550 { 3551 struct vxlan_sock *vs; 3552 struct socket *sock; 3553 unsigned int h; 3554 struct udp_tunnel_sock_cfg tunnel_cfg; 3555 3556 ASSERT_RTNL(); 3557 3558 vs = kzalloc(sizeof(*vs), GFP_KERNEL); 3559 if (!vs) 3560 return ERR_PTR(-ENOMEM); 3561 3562 for (h = 0; h < VNI_HASH_SIZE; ++h) 3563 INIT_HLIST_HEAD(&vs->vni_list[h]); 3564 3565 sock = vxlan_create_sock(net, ipv6, port, flags, ifindex); 3566 if (IS_ERR(sock)) { 3567 kfree(vs); 3568 return ERR_CAST(sock); 3569 } 3570 3571 vs->sock = sock; 3572 refcount_set(&vs->refcnt, 1); 3573 vs->flags = (flags & VXLAN_F_RCV_FLAGS); 3574 3575 hlist_add_head_rcu(&vs->hlist, vs_head(net, port)); 3576 udp_tunnel_notify_add_rx_port(sock, 3577 (vs->flags & VXLAN_F_GPE) ? 3578 UDP_TUNNEL_TYPE_VXLAN_GPE : 3579 UDP_TUNNEL_TYPE_VXLAN); 3580 3581 /* Mark socket as an encapsulation socket. */ 3582 memset(&tunnel_cfg, 0, sizeof(tunnel_cfg)); 3583 tunnel_cfg.sk_user_data = vs; 3584 tunnel_cfg.encap_type = 1; 3585 tunnel_cfg.encap_rcv = vxlan_rcv; 3586 tunnel_cfg.encap_err_lookup = vxlan_err_lookup; 3587 tunnel_cfg.encap_destroy = NULL; 3588 if (vs->flags & VXLAN_F_GPE) { 3589 tunnel_cfg.gro_receive = vxlan_gpe_gro_receive; 3590 tunnel_cfg.gro_complete = vxlan_gpe_gro_complete; 3591 } else { 3592 tunnel_cfg.gro_receive = vxlan_gro_receive; 3593 tunnel_cfg.gro_complete = vxlan_gro_complete; 3594 } 3595 3596 setup_udp_tunnel_sock(net, sock, &tunnel_cfg); 3597 3598 return vs; 3599 } 3600 3601 static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6) 3602 { 3603 bool metadata = vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA; 3604 struct vxlan_sock *vs = NULL; 3605 struct vxlan_dev_node *node; 3606 int l3mdev_index = 0; 3607 3608 ASSERT_RTNL(); 3609 3610 if (vxlan->cfg.remote_ifindex) 3611 l3mdev_index = l3mdev_master_upper_ifindex_by_index( 3612 vxlan->net, vxlan->cfg.remote_ifindex); 3613 3614 if (!vxlan->cfg.no_share) { 3615 rcu_read_lock(); 3616 vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET, 3617 vxlan->cfg.dst_port, vxlan->cfg.flags, 3618 l3mdev_index); 3619 if (vs && !refcount_inc_not_zero(&vs->refcnt)) { 3620 rcu_read_unlock(); 3621 return -EBUSY; 3622 } 3623 rcu_read_unlock(); 3624 } 3625 if (!vs) 3626 vs = vxlan_socket_create(vxlan->net, ipv6, 3627 vxlan->cfg.dst_port, vxlan->cfg.flags, 3628 l3mdev_index); 3629 if (IS_ERR(vs)) 3630 return PTR_ERR(vs); 3631 #if IS_ENABLED(CONFIG_IPV6) 3632 if (ipv6) { 3633 rcu_assign_pointer(vxlan->vn6_sock, vs); 3634 node = &vxlan->hlist6; 3635 } else 3636 #endif 3637 { 3638 rcu_assign_pointer(vxlan->vn4_sock, vs); 3639 node = &vxlan->hlist4; 3640 } 3641 3642 if (metadata && (vxlan->cfg.flags & VXLAN_F_VNIFILTER)) 3643 vxlan_vs_add_vnigrp(vxlan, vs, ipv6); 3644 else 3645 vxlan_vs_add_dev(vs, vxlan, node); 3646 3647 return 0; 3648 } 3649 3650 static int vxlan_sock_add(struct vxlan_dev *vxlan) 3651 { 3652 bool metadata = vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA; 3653 bool ipv6 = vxlan->cfg.flags & VXLAN_F_IPV6 || metadata; 3654 bool ipv4 = !ipv6 || metadata; 3655 int ret = 0; 3656 3657 RCU_INIT_POINTER(vxlan->vn4_sock, NULL); 3658 #if IS_ENABLED(CONFIG_IPV6) 3659 RCU_INIT_POINTER(vxlan->vn6_sock, NULL); 3660 if (ipv6) { 3661 ret = __vxlan_sock_add(vxlan, true); 3662 if (ret < 0 && ret != -EAFNOSUPPORT) 3663 ipv4 = false; 3664 } 3665 #endif 3666 if (ipv4) 3667 ret = __vxlan_sock_add(vxlan, false); 3668 if (ret < 0) 3669 vxlan_sock_release(vxlan); 3670 return ret; 3671 } 3672 3673 int vxlan_vni_in_use(struct net *src_net, struct vxlan_dev *vxlan, 3674 struct vxlan_config *conf, __be32 vni) 3675 { 3676 struct vxlan_net *vn = net_generic(src_net, vxlan_net_id); 3677 struct vxlan_dev *tmp; 3678 3679 list_for_each_entry(tmp, &vn->vxlan_list, next) { 3680 if (tmp == vxlan) 3681 continue; 3682 if (tmp->cfg.flags & VXLAN_F_VNIFILTER) { 3683 if (!vxlan_vnifilter_lookup(tmp, vni)) 3684 continue; 3685 } else if (tmp->cfg.vni != vni) { 3686 continue; 3687 } 3688 if (tmp->cfg.dst_port != conf->dst_port) 3689 continue; 3690 if ((tmp->cfg.flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)) != 3691 (conf->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6))) 3692 continue; 3693 3694 if ((conf->flags & VXLAN_F_IPV6_LINKLOCAL) && 3695 tmp->cfg.remote_ifindex != conf->remote_ifindex) 3696 continue; 3697 3698 return -EEXIST; 3699 } 3700 3701 return 0; 3702 } 3703 3704 static int vxlan_config_validate(struct net *src_net, struct vxlan_config *conf, 3705 struct net_device **lower, 3706 struct vxlan_dev *old, 3707 struct netlink_ext_ack *extack) 3708 { 3709 bool use_ipv6 = false; 3710 3711 if (conf->flags & VXLAN_F_GPE) { 3712 /* For now, allow GPE only together with 3713 * COLLECT_METADATA. This can be relaxed later; in such 3714 * case, the other side of the PtP link will have to be 3715 * provided. 3716 */ 3717 if ((conf->flags & ~VXLAN_F_ALLOWED_GPE) || 3718 !(conf->flags & VXLAN_F_COLLECT_METADATA)) { 3719 NL_SET_ERR_MSG(extack, 3720 "VXLAN GPE does not support this combination of attributes"); 3721 return -EINVAL; 3722 } 3723 } 3724 3725 if (!conf->remote_ip.sa.sa_family && !conf->saddr.sa.sa_family) { 3726 /* Unless IPv6 is explicitly requested, assume IPv4 */ 3727 conf->remote_ip.sa.sa_family = AF_INET; 3728 conf->saddr.sa.sa_family = AF_INET; 3729 } else if (!conf->remote_ip.sa.sa_family) { 3730 conf->remote_ip.sa.sa_family = conf->saddr.sa.sa_family; 3731 } else if (!conf->saddr.sa.sa_family) { 3732 conf->saddr.sa.sa_family = conf->remote_ip.sa.sa_family; 3733 } 3734 3735 if (conf->saddr.sa.sa_family != conf->remote_ip.sa.sa_family) { 3736 NL_SET_ERR_MSG(extack, 3737 "Local and remote address must be from the same family"); 3738 return -EINVAL; 3739 } 3740 3741 if (vxlan_addr_multicast(&conf->saddr)) { 3742 NL_SET_ERR_MSG(extack, "Local address cannot be multicast"); 3743 return -EINVAL; 3744 } 3745 3746 if (conf->saddr.sa.sa_family == AF_INET6) { 3747 if (!IS_ENABLED(CONFIG_IPV6)) { 3748 NL_SET_ERR_MSG(extack, 3749 "IPv6 support not enabled in the kernel"); 3750 return -EPFNOSUPPORT; 3751 } 3752 use_ipv6 = true; 3753 conf->flags |= VXLAN_F_IPV6; 3754 3755 if (!(conf->flags & VXLAN_F_COLLECT_METADATA)) { 3756 int local_type = 3757 ipv6_addr_type(&conf->saddr.sin6.sin6_addr); 3758 int remote_type = 3759 ipv6_addr_type(&conf->remote_ip.sin6.sin6_addr); 3760 3761 if (local_type & IPV6_ADDR_LINKLOCAL) { 3762 if (!(remote_type & IPV6_ADDR_LINKLOCAL) && 3763 (remote_type != IPV6_ADDR_ANY)) { 3764 NL_SET_ERR_MSG(extack, 3765 "Invalid combination of local and remote address scopes"); 3766 return -EINVAL; 3767 } 3768 3769 conf->flags |= VXLAN_F_IPV6_LINKLOCAL; 3770 } else { 3771 if (remote_type == 3772 (IPV6_ADDR_UNICAST | IPV6_ADDR_LINKLOCAL)) { 3773 NL_SET_ERR_MSG(extack, 3774 "Invalid combination of local and remote address scopes"); 3775 return -EINVAL; 3776 } 3777 3778 conf->flags &= ~VXLAN_F_IPV6_LINKLOCAL; 3779 } 3780 } 3781 } 3782 3783 if (conf->label && !use_ipv6) { 3784 NL_SET_ERR_MSG(extack, 3785 "Label attribute only applies to IPv6 VXLAN devices"); 3786 return -EINVAL; 3787 } 3788 3789 if (conf->label_policy && !use_ipv6) { 3790 NL_SET_ERR_MSG(extack, 3791 "Label policy only applies to IPv6 VXLAN devices"); 3792 return -EINVAL; 3793 } 3794 3795 if (conf->remote_ifindex) { 3796 struct net_device *lowerdev; 3797 3798 lowerdev = __dev_get_by_index(src_net, conf->remote_ifindex); 3799 if (!lowerdev) { 3800 NL_SET_ERR_MSG(extack, 3801 "Invalid local interface, device not found"); 3802 return -ENODEV; 3803 } 3804 3805 #if IS_ENABLED(CONFIG_IPV6) 3806 if (use_ipv6) { 3807 struct inet6_dev *idev = __in6_dev_get(lowerdev); 3808 3809 if (idev && idev->cnf.disable_ipv6) { 3810 NL_SET_ERR_MSG(extack, 3811 "IPv6 support disabled by administrator"); 3812 return -EPERM; 3813 } 3814 } 3815 #endif 3816 3817 *lower = lowerdev; 3818 } else { 3819 if (vxlan_addr_multicast(&conf->remote_ip)) { 3820 NL_SET_ERR_MSG(extack, 3821 "Local interface required for multicast remote destination"); 3822 3823 return -EINVAL; 3824 } 3825 3826 #if IS_ENABLED(CONFIG_IPV6) 3827 if (conf->flags & VXLAN_F_IPV6_LINKLOCAL) { 3828 NL_SET_ERR_MSG(extack, 3829 "Local interface required for link-local local/remote addresses"); 3830 return -EINVAL; 3831 } 3832 #endif 3833 3834 *lower = NULL; 3835 } 3836 3837 if (!conf->dst_port) { 3838 if (conf->flags & VXLAN_F_GPE) 3839 conf->dst_port = htons(IANA_VXLAN_GPE_UDP_PORT); 3840 else 3841 conf->dst_port = htons(vxlan_port); 3842 } 3843 3844 if (!conf->age_interval) 3845 conf->age_interval = FDB_AGE_DEFAULT; 3846 3847 if (vxlan_vni_in_use(src_net, old, conf, conf->vni)) { 3848 NL_SET_ERR_MSG(extack, 3849 "A VXLAN device with the specified VNI already exists"); 3850 return -EEXIST; 3851 } 3852 3853 return 0; 3854 } 3855 3856 static void vxlan_config_apply(struct net_device *dev, 3857 struct vxlan_config *conf, 3858 struct net_device *lowerdev, 3859 struct net *src_net, 3860 bool changelink) 3861 { 3862 struct vxlan_dev *vxlan = netdev_priv(dev); 3863 struct vxlan_rdst *dst = &vxlan->default_dst; 3864 unsigned short needed_headroom = ETH_HLEN; 3865 int max_mtu = ETH_MAX_MTU; 3866 u32 flags = conf->flags; 3867 3868 if (!changelink) { 3869 if (flags & VXLAN_F_GPE) 3870 vxlan_raw_setup(dev); 3871 else 3872 vxlan_ether_setup(dev); 3873 3874 if (conf->mtu) 3875 dev->mtu = conf->mtu; 3876 3877 vxlan->net = src_net; 3878 } 3879 3880 dst->remote_vni = conf->vni; 3881 3882 memcpy(&dst->remote_ip, &conf->remote_ip, sizeof(conf->remote_ip)); 3883 3884 if (lowerdev) { 3885 dst->remote_ifindex = conf->remote_ifindex; 3886 3887 netif_inherit_tso_max(dev, lowerdev); 3888 3889 needed_headroom = lowerdev->hard_header_len; 3890 needed_headroom += lowerdev->needed_headroom; 3891 3892 dev->needed_tailroom = lowerdev->needed_tailroom; 3893 3894 max_mtu = lowerdev->mtu - vxlan_headroom(flags); 3895 if (max_mtu < ETH_MIN_MTU) 3896 max_mtu = ETH_MIN_MTU; 3897 3898 if (!changelink && !conf->mtu) 3899 dev->mtu = max_mtu; 3900 } 3901 3902 if (dev->mtu > max_mtu) 3903 dev->mtu = max_mtu; 3904 3905 if (flags & VXLAN_F_COLLECT_METADATA) 3906 flags |= VXLAN_F_IPV6; 3907 needed_headroom += vxlan_headroom(flags); 3908 dev->needed_headroom = needed_headroom; 3909 3910 memcpy(&vxlan->cfg, conf, sizeof(*conf)); 3911 } 3912 3913 static int vxlan_dev_configure(struct net *src_net, struct net_device *dev, 3914 struct vxlan_config *conf, 3915 struct netlink_ext_ack *extack) 3916 { 3917 struct vxlan_dev *vxlan = netdev_priv(dev); 3918 struct net_device *lowerdev; 3919 int ret; 3920 3921 ret = vxlan_config_validate(src_net, conf, &lowerdev, vxlan, extack); 3922 if (ret) 3923 return ret; 3924 3925 vxlan_config_apply(dev, conf, lowerdev, src_net, false); 3926 3927 return 0; 3928 } 3929 3930 static int __vxlan_dev_create(struct net *net, struct net_device *dev, 3931 struct vxlan_config *conf, 3932 struct netlink_ext_ack *extack) 3933 { 3934 struct vxlan_net *vn = net_generic(net, vxlan_net_id); 3935 struct vxlan_dev *vxlan = netdev_priv(dev); 3936 struct net_device *remote_dev = NULL; 3937 struct vxlan_rdst *dst; 3938 int err; 3939 3940 dst = &vxlan->default_dst; 3941 err = vxlan_dev_configure(net, dev, conf, extack); 3942 if (err) 3943 return err; 3944 3945 dev->ethtool_ops = &vxlan_ethtool_ops; 3946 3947 err = register_netdevice(dev); 3948 if (err) 3949 return err; 3950 3951 if (dst->remote_ifindex) { 3952 remote_dev = __dev_get_by_index(net, dst->remote_ifindex); 3953 if (!remote_dev) { 3954 err = -ENODEV; 3955 goto unregister; 3956 } 3957 3958 err = netdev_upper_dev_link(remote_dev, dev, extack); 3959 if (err) 3960 goto unregister; 3961 3962 dst->remote_dev = remote_dev; 3963 } 3964 3965 err = rtnl_configure_link(dev, NULL, 0, NULL); 3966 if (err < 0) 3967 goto unlink; 3968 3969 /* create an fdb entry for a valid default destination */ 3970 if (!vxlan_addr_any(&dst->remote_ip)) { 3971 spin_lock_bh(&vxlan->hash_lock); 3972 err = vxlan_fdb_update(vxlan, all_zeros_mac, 3973 &dst->remote_ip, 3974 NUD_REACHABLE | NUD_PERMANENT, 3975 NLM_F_EXCL | NLM_F_CREATE, 3976 vxlan->cfg.dst_port, 3977 dst->remote_vni, 3978 dst->remote_vni, 3979 dst->remote_ifindex, 3980 NTF_SELF, 0, true, extack); 3981 spin_unlock_bh(&vxlan->hash_lock); 3982 if (err) 3983 goto unlink; 3984 } 3985 3986 list_add(&vxlan->next, &vn->vxlan_list); 3987 3988 return 0; 3989 3990 unlink: 3991 if (remote_dev) 3992 netdev_upper_dev_unlink(remote_dev, dev); 3993 unregister: 3994 unregister_netdevice(dev); 3995 return err; 3996 } 3997 3998 /* Set/clear flags based on attribute */ 3999 static int vxlan_nl2flag(struct vxlan_config *conf, struct nlattr *tb[], 4000 int attrtype, unsigned long mask, bool changelink, 4001 bool changelink_supported, 4002 struct netlink_ext_ack *extack) 4003 { 4004 unsigned long flags; 4005 4006 if (!tb[attrtype]) 4007 return 0; 4008 4009 if (changelink && !changelink_supported) { 4010 vxlan_flag_attr_error(attrtype, extack); 4011 return -EOPNOTSUPP; 4012 } 4013 4014 if (vxlan_policy[attrtype].type == NLA_FLAG) 4015 flags = conf->flags | mask; 4016 else if (nla_get_u8(tb[attrtype])) 4017 flags = conf->flags | mask; 4018 else 4019 flags = conf->flags & ~mask; 4020 4021 conf->flags = flags; 4022 4023 return 0; 4024 } 4025 4026 static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[], 4027 struct net_device *dev, struct vxlan_config *conf, 4028 bool changelink, struct netlink_ext_ack *extack) 4029 { 4030 struct vxlanhdr used_bits = { 4031 .vx_flags = VXLAN_HF_VNI, 4032 .vx_vni = VXLAN_VNI_MASK, 4033 }; 4034 struct vxlan_dev *vxlan = netdev_priv(dev); 4035 int err = 0; 4036 4037 memset(conf, 0, sizeof(*conf)); 4038 4039 /* if changelink operation, start with old existing cfg */ 4040 if (changelink) 4041 memcpy(conf, &vxlan->cfg, sizeof(*conf)); 4042 4043 if (data[IFLA_VXLAN_ID]) { 4044 __be32 vni = cpu_to_be32(nla_get_u32(data[IFLA_VXLAN_ID])); 4045 4046 if (changelink && (vni != conf->vni)) { 4047 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_ID], "Cannot change VNI"); 4048 return -EOPNOTSUPP; 4049 } 4050 conf->vni = vni; 4051 } 4052 4053 if (data[IFLA_VXLAN_GROUP]) { 4054 if (changelink && (conf->remote_ip.sa.sa_family != AF_INET)) { 4055 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP], "New group address family does not match old group"); 4056 return -EOPNOTSUPP; 4057 } 4058 4059 conf->remote_ip.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_GROUP]); 4060 conf->remote_ip.sa.sa_family = AF_INET; 4061 } else if (data[IFLA_VXLAN_GROUP6]) { 4062 if (!IS_ENABLED(CONFIG_IPV6)) { 4063 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP6], "IPv6 support not enabled in the kernel"); 4064 return -EPFNOSUPPORT; 4065 } 4066 4067 if (changelink && (conf->remote_ip.sa.sa_family != AF_INET6)) { 4068 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP6], "New group address family does not match old group"); 4069 return -EOPNOTSUPP; 4070 } 4071 4072 conf->remote_ip.sin6.sin6_addr = nla_get_in6_addr(data[IFLA_VXLAN_GROUP6]); 4073 conf->remote_ip.sa.sa_family = AF_INET6; 4074 } 4075 4076 if (data[IFLA_VXLAN_LOCAL]) { 4077 if (changelink && (conf->saddr.sa.sa_family != AF_INET)) { 4078 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL], "New local address family does not match old"); 4079 return -EOPNOTSUPP; 4080 } 4081 4082 conf->saddr.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_LOCAL]); 4083 conf->saddr.sa.sa_family = AF_INET; 4084 } else if (data[IFLA_VXLAN_LOCAL6]) { 4085 if (!IS_ENABLED(CONFIG_IPV6)) { 4086 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL6], "IPv6 support not enabled in the kernel"); 4087 return -EPFNOSUPPORT; 4088 } 4089 4090 if (changelink && (conf->saddr.sa.sa_family != AF_INET6)) { 4091 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL6], "New local address family does not match old"); 4092 return -EOPNOTSUPP; 4093 } 4094 4095 /* TODO: respect scope id */ 4096 conf->saddr.sin6.sin6_addr = nla_get_in6_addr(data[IFLA_VXLAN_LOCAL6]); 4097 conf->saddr.sa.sa_family = AF_INET6; 4098 } 4099 4100 if (data[IFLA_VXLAN_LINK]) 4101 conf->remote_ifindex = nla_get_u32(data[IFLA_VXLAN_LINK]); 4102 4103 if (data[IFLA_VXLAN_TOS]) 4104 conf->tos = nla_get_u8(data[IFLA_VXLAN_TOS]); 4105 4106 if (data[IFLA_VXLAN_TTL]) 4107 conf->ttl = nla_get_u8(data[IFLA_VXLAN_TTL]); 4108 4109 if (data[IFLA_VXLAN_TTL_INHERIT]) { 4110 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_TTL_INHERIT, 4111 VXLAN_F_TTL_INHERIT, changelink, false, 4112 extack); 4113 if (err) 4114 return err; 4115 4116 } 4117 4118 if (data[IFLA_VXLAN_LABEL]) 4119 conf->label = nla_get_be32(data[IFLA_VXLAN_LABEL]) & 4120 IPV6_FLOWLABEL_MASK; 4121 if (data[IFLA_VXLAN_LABEL_POLICY]) 4122 conf->label_policy = nla_get_u32(data[IFLA_VXLAN_LABEL_POLICY]); 4123 4124 if (data[IFLA_VXLAN_LEARNING]) { 4125 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_LEARNING, 4126 VXLAN_F_LEARN, changelink, true, 4127 extack); 4128 if (err) 4129 return err; 4130 } else if (!changelink) { 4131 /* default to learn on a new device */ 4132 conf->flags |= VXLAN_F_LEARN; 4133 } 4134 4135 if (data[IFLA_VXLAN_AGEING]) 4136 conf->age_interval = nla_get_u32(data[IFLA_VXLAN_AGEING]); 4137 4138 if (data[IFLA_VXLAN_PROXY]) { 4139 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_PROXY, 4140 VXLAN_F_PROXY, changelink, false, 4141 extack); 4142 if (err) 4143 return err; 4144 } 4145 4146 if (data[IFLA_VXLAN_RSC]) { 4147 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_RSC, 4148 VXLAN_F_RSC, changelink, false, 4149 extack); 4150 if (err) 4151 return err; 4152 } 4153 4154 if (data[IFLA_VXLAN_L2MISS]) { 4155 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_L2MISS, 4156 VXLAN_F_L2MISS, changelink, false, 4157 extack); 4158 if (err) 4159 return err; 4160 } 4161 4162 if (data[IFLA_VXLAN_L3MISS]) { 4163 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_L3MISS, 4164 VXLAN_F_L3MISS, changelink, false, 4165 extack); 4166 if (err) 4167 return err; 4168 } 4169 4170 if (data[IFLA_VXLAN_LIMIT]) { 4171 if (changelink) { 4172 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LIMIT], 4173 "Cannot change limit"); 4174 return -EOPNOTSUPP; 4175 } 4176 conf->addrmax = nla_get_u32(data[IFLA_VXLAN_LIMIT]); 4177 } 4178 4179 if (data[IFLA_VXLAN_COLLECT_METADATA]) { 4180 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_COLLECT_METADATA, 4181 VXLAN_F_COLLECT_METADATA, changelink, false, 4182 extack); 4183 if (err) 4184 return err; 4185 } 4186 4187 if (data[IFLA_VXLAN_PORT_RANGE]) { 4188 if (!changelink) { 4189 const struct ifla_vxlan_port_range *p 4190 = nla_data(data[IFLA_VXLAN_PORT_RANGE]); 4191 conf->port_min = ntohs(p->low); 4192 conf->port_max = ntohs(p->high); 4193 } else { 4194 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_PORT_RANGE], 4195 "Cannot change port range"); 4196 return -EOPNOTSUPP; 4197 } 4198 } 4199 4200 if (data[IFLA_VXLAN_PORT]) { 4201 if (changelink) { 4202 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_PORT], 4203 "Cannot change port"); 4204 return -EOPNOTSUPP; 4205 } 4206 conf->dst_port = nla_get_be16(data[IFLA_VXLAN_PORT]); 4207 } 4208 4209 if (data[IFLA_VXLAN_UDP_CSUM]) { 4210 if (changelink) { 4211 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_UDP_CSUM], 4212 "Cannot change UDP_CSUM flag"); 4213 return -EOPNOTSUPP; 4214 } 4215 if (!nla_get_u8(data[IFLA_VXLAN_UDP_CSUM])) 4216 conf->flags |= VXLAN_F_UDP_ZERO_CSUM_TX; 4217 } 4218 4219 if (data[IFLA_VXLAN_LOCALBYPASS]) { 4220 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_LOCALBYPASS, 4221 VXLAN_F_LOCALBYPASS, changelink, 4222 true, extack); 4223 if (err) 4224 return err; 4225 } else if (!changelink) { 4226 /* default to local bypass on a new device */ 4227 conf->flags |= VXLAN_F_LOCALBYPASS; 4228 } 4229 4230 if (data[IFLA_VXLAN_UDP_ZERO_CSUM6_TX]) { 4231 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_UDP_ZERO_CSUM6_TX, 4232 VXLAN_F_UDP_ZERO_CSUM6_TX, changelink, 4233 false, extack); 4234 if (err) 4235 return err; 4236 } 4237 4238 if (data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]) { 4239 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_UDP_ZERO_CSUM6_RX, 4240 VXLAN_F_UDP_ZERO_CSUM6_RX, changelink, 4241 false, extack); 4242 if (err) 4243 return err; 4244 } 4245 4246 if (data[IFLA_VXLAN_REMCSUM_TX]) { 4247 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_TX, 4248 VXLAN_F_REMCSUM_TX, changelink, false, 4249 extack); 4250 if (err) 4251 return err; 4252 } 4253 4254 if (data[IFLA_VXLAN_REMCSUM_RX]) { 4255 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_RX, 4256 VXLAN_F_REMCSUM_RX, changelink, false, 4257 extack); 4258 if (err) 4259 return err; 4260 used_bits.vx_flags |= VXLAN_HF_RCO; 4261 used_bits.vx_vni |= ~VXLAN_VNI_MASK; 4262 } 4263 4264 if (data[IFLA_VXLAN_GBP]) { 4265 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_GBP, 4266 VXLAN_F_GBP, changelink, false, extack); 4267 if (err) 4268 return err; 4269 used_bits.vx_flags |= VXLAN_GBP_USED_BITS; 4270 } 4271 4272 if (data[IFLA_VXLAN_GPE]) { 4273 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_GPE, 4274 VXLAN_F_GPE, changelink, false, 4275 extack); 4276 if (err) 4277 return err; 4278 4279 used_bits.vx_flags |= VXLAN_GPE_USED_BITS; 4280 } 4281 4282 if (data[IFLA_VXLAN_RESERVED_BITS]) { 4283 struct vxlanhdr reserved_bits; 4284 4285 if (changelink) { 4286 NL_SET_ERR_MSG_ATTR(extack, 4287 data[IFLA_VXLAN_RESERVED_BITS], 4288 "Cannot change reserved_bits"); 4289 return -EOPNOTSUPP; 4290 } 4291 4292 nla_memcpy(&reserved_bits, data[IFLA_VXLAN_RESERVED_BITS], 4293 sizeof(reserved_bits)); 4294 if (used_bits.vx_flags & reserved_bits.vx_flags || 4295 used_bits.vx_vni & reserved_bits.vx_vni) { 4296 __be64 ub_be64, rb_be64; 4297 4298 memcpy(&ub_be64, &used_bits, sizeof(ub_be64)); 4299 memcpy(&rb_be64, &reserved_bits, sizeof(rb_be64)); 4300 4301 NL_SET_ERR_MSG_ATTR_FMT(extack, 4302 data[IFLA_VXLAN_RESERVED_BITS], 4303 "Used bits %#018llx cannot overlap reserved bits %#018llx", 4304 be64_to_cpu(ub_be64), 4305 be64_to_cpu(rb_be64)); 4306 return -EINVAL; 4307 } 4308 4309 conf->reserved_bits = reserved_bits; 4310 } else { 4311 /* For backwards compatibility, only allow reserved fields to be 4312 * used by VXLAN extensions if explicitly requested. 4313 */ 4314 conf->reserved_bits = (struct vxlanhdr) { 4315 .vx_flags = ~used_bits.vx_flags, 4316 .vx_vni = ~used_bits.vx_vni, 4317 }; 4318 } 4319 4320 if (data[IFLA_VXLAN_REMCSUM_NOPARTIAL]) { 4321 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_NOPARTIAL, 4322 VXLAN_F_REMCSUM_NOPARTIAL, changelink, 4323 false, extack); 4324 if (err) 4325 return err; 4326 } 4327 4328 if (data[IFLA_VXLAN_MC_ROUTE]) { 4329 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_MC_ROUTE, 4330 VXLAN_F_MC_ROUTE, changelink, 4331 true, extack); 4332 if (err) 4333 return err; 4334 } 4335 4336 if (tb[IFLA_MTU]) { 4337 if (changelink) { 4338 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_MTU], 4339 "Cannot change mtu"); 4340 return -EOPNOTSUPP; 4341 } 4342 conf->mtu = nla_get_u32(tb[IFLA_MTU]); 4343 } 4344 4345 if (data[IFLA_VXLAN_DF]) 4346 conf->df = nla_get_u8(data[IFLA_VXLAN_DF]); 4347 4348 if (data[IFLA_VXLAN_VNIFILTER]) { 4349 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_VNIFILTER, 4350 VXLAN_F_VNIFILTER, changelink, false, 4351 extack); 4352 if (err) 4353 return err; 4354 4355 if ((conf->flags & VXLAN_F_VNIFILTER) && 4356 !(conf->flags & VXLAN_F_COLLECT_METADATA)) { 4357 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_VNIFILTER], 4358 "vxlan vnifilter only valid in collect metadata mode"); 4359 return -EINVAL; 4360 } 4361 } 4362 4363 return 0; 4364 } 4365 4366 static int vxlan_newlink(struct net_device *dev, 4367 struct rtnl_newlink_params *params, 4368 struct netlink_ext_ack *extack) 4369 { 4370 struct net *link_net = rtnl_newlink_link_net(params); 4371 struct nlattr **data = params->data; 4372 struct nlattr **tb = params->tb; 4373 struct vxlan_config conf; 4374 int err; 4375 4376 err = vxlan_nl2conf(tb, data, dev, &conf, false, extack); 4377 if (err) 4378 return err; 4379 4380 return __vxlan_dev_create(link_net, dev, &conf, extack); 4381 } 4382 4383 static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], 4384 struct nlattr *data[], 4385 struct netlink_ext_ack *extack) 4386 { 4387 struct vxlan_dev *vxlan = netdev_priv(dev); 4388 bool rem_ip_changed, change_igmp; 4389 struct net_device *lowerdev; 4390 struct vxlan_config conf; 4391 struct vxlan_rdst *dst; 4392 int err; 4393 4394 dst = &vxlan->default_dst; 4395 err = vxlan_nl2conf(tb, data, dev, &conf, true, extack); 4396 if (err) 4397 return err; 4398 4399 err = vxlan_config_validate(vxlan->net, &conf, &lowerdev, 4400 vxlan, extack); 4401 if (err) 4402 return err; 4403 4404 if (dst->remote_dev == lowerdev) 4405 lowerdev = NULL; 4406 4407 err = netdev_adjacent_change_prepare(dst->remote_dev, lowerdev, dev, 4408 extack); 4409 if (err) 4410 return err; 4411 4412 rem_ip_changed = !vxlan_addr_equal(&conf.remote_ip, &dst->remote_ip); 4413 change_igmp = vxlan->dev->flags & IFF_UP && 4414 (rem_ip_changed || 4415 dst->remote_ifindex != conf.remote_ifindex); 4416 4417 /* handle default dst entry */ 4418 if (rem_ip_changed) { 4419 spin_lock_bh(&vxlan->hash_lock); 4420 if (!vxlan_addr_any(&conf.remote_ip)) { 4421 err = vxlan_fdb_update(vxlan, all_zeros_mac, 4422 &conf.remote_ip, 4423 NUD_REACHABLE | NUD_PERMANENT, 4424 NLM_F_APPEND | NLM_F_CREATE, 4425 vxlan->cfg.dst_port, 4426 conf.vni, conf.vni, 4427 conf.remote_ifindex, 4428 NTF_SELF, 0, true, extack); 4429 if (err) { 4430 spin_unlock_bh(&vxlan->hash_lock); 4431 netdev_adjacent_change_abort(dst->remote_dev, 4432 lowerdev, dev); 4433 return err; 4434 } 4435 } 4436 if (!vxlan_addr_any(&dst->remote_ip)) 4437 __vxlan_fdb_delete(vxlan, all_zeros_mac, 4438 dst->remote_ip, 4439 vxlan->cfg.dst_port, 4440 dst->remote_vni, 4441 dst->remote_vni, 4442 dst->remote_ifindex, 4443 true); 4444 spin_unlock_bh(&vxlan->hash_lock); 4445 4446 /* If vni filtering device, also update fdb entries of 4447 * all vnis that were using default remote ip 4448 */ 4449 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) { 4450 err = vxlan_vnilist_update_group(vxlan, &dst->remote_ip, 4451 &conf.remote_ip, extack); 4452 if (err) { 4453 netdev_adjacent_change_abort(dst->remote_dev, 4454 lowerdev, dev); 4455 return err; 4456 } 4457 } 4458 } 4459 4460 if (change_igmp && vxlan_addr_multicast(&dst->remote_ip)) 4461 err = vxlan_multicast_leave(vxlan); 4462 4463 if (conf.age_interval != vxlan->cfg.age_interval) 4464 mod_timer(&vxlan->age_timer, jiffies); 4465 4466 netdev_adjacent_change_commit(dst->remote_dev, lowerdev, dev); 4467 if (lowerdev && lowerdev != dst->remote_dev) 4468 dst->remote_dev = lowerdev; 4469 vxlan_config_apply(dev, &conf, lowerdev, vxlan->net, true); 4470 4471 if (!err && change_igmp && 4472 vxlan_addr_multicast(&dst->remote_ip)) 4473 err = vxlan_multicast_join(vxlan); 4474 4475 return err; 4476 } 4477 4478 static void vxlan_dellink(struct net_device *dev, struct list_head *head) 4479 { 4480 struct vxlan_dev *vxlan = netdev_priv(dev); 4481 struct vxlan_fdb_flush_desc desc = {}; 4482 4483 vxlan_flush(vxlan, &desc); 4484 4485 list_del(&vxlan->next); 4486 unregister_netdevice_queue(dev, head); 4487 if (vxlan->default_dst.remote_dev) 4488 netdev_upper_dev_unlink(vxlan->default_dst.remote_dev, dev); 4489 } 4490 4491 static size_t vxlan_get_size(const struct net_device *dev) 4492 { 4493 return nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_ID */ 4494 nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_GROUP{6} */ 4495 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_LINK */ 4496 nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_LOCAL{6} */ 4497 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_TTL */ 4498 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_TTL_INHERIT */ 4499 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_TOS */ 4500 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_DF */ 4501 nla_total_size(sizeof(__be32)) + /* IFLA_VXLAN_LABEL */ 4502 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_LABEL_POLICY */ 4503 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_LEARNING */ 4504 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_PROXY */ 4505 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_RSC */ 4506 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_L2MISS */ 4507 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_L3MISS */ 4508 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_COLLECT_METADATA */ 4509 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_AGEING */ 4510 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_LIMIT */ 4511 nla_total_size(sizeof(__be16)) + /* IFLA_VXLAN_PORT */ 4512 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_CSUM */ 4513 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_ZERO_CSUM6_TX */ 4514 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_ZERO_CSUM6_RX */ 4515 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_REMCSUM_TX */ 4516 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_REMCSUM_RX */ 4517 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_LOCALBYPASS */ 4518 /* IFLA_VXLAN_PORT_RANGE */ 4519 nla_total_size(sizeof(struct ifla_vxlan_port_range)) + 4520 nla_total_size(0) + /* IFLA_VXLAN_GBP */ 4521 nla_total_size(0) + /* IFLA_VXLAN_GPE */ 4522 nla_total_size(0) + /* IFLA_VXLAN_REMCSUM_NOPARTIAL */ 4523 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_VNIFILTER */ 4524 /* IFLA_VXLAN_RESERVED_BITS */ 4525 nla_total_size(sizeof(struct vxlanhdr)) + 4526 0; 4527 } 4528 4529 static int vxlan_fill_info(struct sk_buff *skb, const struct net_device *dev) 4530 { 4531 const struct vxlan_dev *vxlan = netdev_priv(dev); 4532 const struct vxlan_rdst *dst = &vxlan->default_dst; 4533 struct ifla_vxlan_port_range ports = { 4534 .low = htons(vxlan->cfg.port_min), 4535 .high = htons(vxlan->cfg.port_max), 4536 }; 4537 4538 if (nla_put_u32(skb, IFLA_VXLAN_ID, be32_to_cpu(dst->remote_vni))) 4539 goto nla_put_failure; 4540 4541 if (!vxlan_addr_any(&dst->remote_ip)) { 4542 if (dst->remote_ip.sa.sa_family == AF_INET) { 4543 if (nla_put_in_addr(skb, IFLA_VXLAN_GROUP, 4544 dst->remote_ip.sin.sin_addr.s_addr)) 4545 goto nla_put_failure; 4546 #if IS_ENABLED(CONFIG_IPV6) 4547 } else { 4548 if (nla_put_in6_addr(skb, IFLA_VXLAN_GROUP6, 4549 &dst->remote_ip.sin6.sin6_addr)) 4550 goto nla_put_failure; 4551 #endif 4552 } 4553 } 4554 4555 if (dst->remote_ifindex && nla_put_u32(skb, IFLA_VXLAN_LINK, dst->remote_ifindex)) 4556 goto nla_put_failure; 4557 4558 if (!vxlan_addr_any(&vxlan->cfg.saddr)) { 4559 if (vxlan->cfg.saddr.sa.sa_family == AF_INET) { 4560 if (nla_put_in_addr(skb, IFLA_VXLAN_LOCAL, 4561 vxlan->cfg.saddr.sin.sin_addr.s_addr)) 4562 goto nla_put_failure; 4563 #if IS_ENABLED(CONFIG_IPV6) 4564 } else { 4565 if (nla_put_in6_addr(skb, IFLA_VXLAN_LOCAL6, 4566 &vxlan->cfg.saddr.sin6.sin6_addr)) 4567 goto nla_put_failure; 4568 #endif 4569 } 4570 } 4571 4572 if (nla_put_u8(skb, IFLA_VXLAN_TTL, vxlan->cfg.ttl) || 4573 nla_put_u8(skb, IFLA_VXLAN_TTL_INHERIT, 4574 !!(vxlan->cfg.flags & VXLAN_F_TTL_INHERIT)) || 4575 nla_put_u8(skb, IFLA_VXLAN_TOS, vxlan->cfg.tos) || 4576 nla_put_u8(skb, IFLA_VXLAN_DF, vxlan->cfg.df) || 4577 nla_put_be32(skb, IFLA_VXLAN_LABEL, vxlan->cfg.label) || 4578 nla_put_u32(skb, IFLA_VXLAN_LABEL_POLICY, vxlan->cfg.label_policy) || 4579 nla_put_u8(skb, IFLA_VXLAN_LEARNING, 4580 !!(vxlan->cfg.flags & VXLAN_F_LEARN)) || 4581 nla_put_u8(skb, IFLA_VXLAN_PROXY, 4582 !!(vxlan->cfg.flags & VXLAN_F_PROXY)) || 4583 nla_put_u8(skb, IFLA_VXLAN_RSC, 4584 !!(vxlan->cfg.flags & VXLAN_F_RSC)) || 4585 nla_put_u8(skb, IFLA_VXLAN_L2MISS, 4586 !!(vxlan->cfg.flags & VXLAN_F_L2MISS)) || 4587 nla_put_u8(skb, IFLA_VXLAN_L3MISS, 4588 !!(vxlan->cfg.flags & VXLAN_F_L3MISS)) || 4589 nla_put_u8(skb, IFLA_VXLAN_COLLECT_METADATA, 4590 !!(vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA)) || 4591 nla_put_u32(skb, IFLA_VXLAN_AGEING, vxlan->cfg.age_interval) || 4592 nla_put_u32(skb, IFLA_VXLAN_LIMIT, vxlan->cfg.addrmax) || 4593 nla_put_be16(skb, IFLA_VXLAN_PORT, vxlan->cfg.dst_port) || 4594 nla_put_u8(skb, IFLA_VXLAN_UDP_CSUM, 4595 !(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM_TX)) || 4596 nla_put_u8(skb, IFLA_VXLAN_UDP_ZERO_CSUM6_TX, 4597 !!(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM6_TX)) || 4598 nla_put_u8(skb, IFLA_VXLAN_UDP_ZERO_CSUM6_RX, 4599 !!(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM6_RX)) || 4600 nla_put_u8(skb, IFLA_VXLAN_REMCSUM_TX, 4601 !!(vxlan->cfg.flags & VXLAN_F_REMCSUM_TX)) || 4602 nla_put_u8(skb, IFLA_VXLAN_REMCSUM_RX, 4603 !!(vxlan->cfg.flags & VXLAN_F_REMCSUM_RX)) || 4604 nla_put_u8(skb, IFLA_VXLAN_LOCALBYPASS, 4605 !!(vxlan->cfg.flags & VXLAN_F_LOCALBYPASS))) 4606 goto nla_put_failure; 4607 4608 if (nla_put(skb, IFLA_VXLAN_PORT_RANGE, sizeof(ports), &ports)) 4609 goto nla_put_failure; 4610 4611 if (vxlan->cfg.flags & VXLAN_F_GBP && 4612 nla_put_flag(skb, IFLA_VXLAN_GBP)) 4613 goto nla_put_failure; 4614 4615 if (vxlan->cfg.flags & VXLAN_F_GPE && 4616 nla_put_flag(skb, IFLA_VXLAN_GPE)) 4617 goto nla_put_failure; 4618 4619 if (vxlan->cfg.flags & VXLAN_F_REMCSUM_NOPARTIAL && 4620 nla_put_flag(skb, IFLA_VXLAN_REMCSUM_NOPARTIAL)) 4621 goto nla_put_failure; 4622 4623 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER && 4624 nla_put_u8(skb, IFLA_VXLAN_VNIFILTER, 4625 !!(vxlan->cfg.flags & VXLAN_F_VNIFILTER))) 4626 goto nla_put_failure; 4627 4628 if (nla_put(skb, IFLA_VXLAN_RESERVED_BITS, 4629 sizeof(vxlan->cfg.reserved_bits), 4630 &vxlan->cfg.reserved_bits)) 4631 goto nla_put_failure; 4632 4633 return 0; 4634 4635 nla_put_failure: 4636 return -EMSGSIZE; 4637 } 4638 4639 static struct net *vxlan_get_link_net(const struct net_device *dev) 4640 { 4641 struct vxlan_dev *vxlan = netdev_priv(dev); 4642 4643 return READ_ONCE(vxlan->net); 4644 } 4645 4646 static struct rtnl_link_ops vxlan_link_ops __read_mostly = { 4647 .kind = "vxlan", 4648 .maxtype = IFLA_VXLAN_MAX, 4649 .policy = vxlan_policy, 4650 .priv_size = sizeof(struct vxlan_dev), 4651 .setup = vxlan_setup, 4652 .validate = vxlan_validate, 4653 .newlink = vxlan_newlink, 4654 .changelink = vxlan_changelink, 4655 .dellink = vxlan_dellink, 4656 .get_size = vxlan_get_size, 4657 .fill_info = vxlan_fill_info, 4658 .get_link_net = vxlan_get_link_net, 4659 }; 4660 4661 struct net_device *vxlan_dev_create(struct net *net, const char *name, 4662 u8 name_assign_type, 4663 struct vxlan_config *conf) 4664 { 4665 struct nlattr *tb[IFLA_MAX + 1]; 4666 struct net_device *dev; 4667 int err; 4668 4669 memset(&tb, 0, sizeof(tb)); 4670 4671 dev = rtnl_create_link(net, name, name_assign_type, 4672 &vxlan_link_ops, tb, NULL); 4673 if (IS_ERR(dev)) 4674 return dev; 4675 4676 err = __vxlan_dev_create(net, dev, conf, NULL); 4677 if (err < 0) { 4678 free_netdev(dev); 4679 return ERR_PTR(err); 4680 } 4681 4682 err = rtnl_configure_link(dev, NULL, 0, NULL); 4683 if (err < 0) { 4684 LIST_HEAD(list_kill); 4685 4686 vxlan_dellink(dev, &list_kill); 4687 unregister_netdevice_many(&list_kill); 4688 return ERR_PTR(err); 4689 } 4690 4691 return dev; 4692 } 4693 EXPORT_SYMBOL_GPL(vxlan_dev_create); 4694 4695 static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn, 4696 struct net_device *dev) 4697 { 4698 struct vxlan_dev *vxlan, *next; 4699 LIST_HEAD(list_kill); 4700 4701 list_for_each_entry_safe(vxlan, next, &vn->vxlan_list, next) { 4702 struct vxlan_rdst *dst = &vxlan->default_dst; 4703 4704 /* In case we created vxlan device with carrier 4705 * and we loose the carrier due to module unload 4706 * we also need to remove vxlan device. In other 4707 * cases, it's not necessary and remote_ifindex 4708 * is 0 here, so no matches. 4709 */ 4710 if (dst->remote_ifindex == dev->ifindex) 4711 vxlan_dellink(vxlan->dev, &list_kill); 4712 } 4713 4714 unregister_netdevice_many(&list_kill); 4715 } 4716 4717 static int vxlan_netdevice_event(struct notifier_block *unused, 4718 unsigned long event, void *ptr) 4719 { 4720 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 4721 struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id); 4722 4723 if (event == NETDEV_UNREGISTER) 4724 vxlan_handle_lowerdev_unregister(vn, dev); 4725 else if (event == NETDEV_UDP_TUNNEL_PUSH_INFO) 4726 vxlan_offload_rx_ports(dev, true); 4727 else if (event == NETDEV_UDP_TUNNEL_DROP_INFO) 4728 vxlan_offload_rx_ports(dev, false); 4729 4730 return NOTIFY_DONE; 4731 } 4732 4733 static struct notifier_block vxlan_notifier_block __read_mostly = { 4734 .notifier_call = vxlan_netdevice_event, 4735 }; 4736 4737 static void 4738 vxlan_fdb_offloaded_set(struct net_device *dev, 4739 struct switchdev_notifier_vxlan_fdb_info *fdb_info) 4740 { 4741 struct vxlan_dev *vxlan = netdev_priv(dev); 4742 struct vxlan_rdst *rdst; 4743 struct vxlan_fdb *f; 4744 4745 spin_lock_bh(&vxlan->hash_lock); 4746 4747 f = vxlan_find_mac(vxlan, fdb_info->eth_addr, fdb_info->vni); 4748 if (!f) 4749 goto out; 4750 4751 rdst = vxlan_fdb_find_rdst(f, &fdb_info->remote_ip, 4752 fdb_info->remote_port, 4753 fdb_info->remote_vni, 4754 fdb_info->remote_ifindex); 4755 if (!rdst) 4756 goto out; 4757 4758 rdst->offloaded = fdb_info->offloaded; 4759 4760 out: 4761 spin_unlock_bh(&vxlan->hash_lock); 4762 } 4763 4764 static int 4765 vxlan_fdb_external_learn_add(struct net_device *dev, 4766 struct switchdev_notifier_vxlan_fdb_info *fdb_info) 4767 { 4768 struct vxlan_dev *vxlan = netdev_priv(dev); 4769 struct netlink_ext_ack *extack; 4770 int err; 4771 4772 extack = switchdev_notifier_info_to_extack(&fdb_info->info); 4773 4774 spin_lock_bh(&vxlan->hash_lock); 4775 err = vxlan_fdb_update(vxlan, fdb_info->eth_addr, &fdb_info->remote_ip, 4776 NUD_REACHABLE, 4777 NLM_F_CREATE | NLM_F_REPLACE, 4778 fdb_info->remote_port, 4779 fdb_info->vni, 4780 fdb_info->remote_vni, 4781 fdb_info->remote_ifindex, 4782 NTF_USE | NTF_SELF | NTF_EXT_LEARNED, 4783 0, false, extack); 4784 spin_unlock_bh(&vxlan->hash_lock); 4785 4786 return err; 4787 } 4788 4789 static int 4790 vxlan_fdb_external_learn_del(struct net_device *dev, 4791 struct switchdev_notifier_vxlan_fdb_info *fdb_info) 4792 { 4793 struct vxlan_dev *vxlan = netdev_priv(dev); 4794 struct vxlan_fdb *f; 4795 int err = 0; 4796 4797 spin_lock_bh(&vxlan->hash_lock); 4798 4799 f = vxlan_find_mac(vxlan, fdb_info->eth_addr, fdb_info->vni); 4800 if (!f) 4801 err = -ENOENT; 4802 else if (f->flags & NTF_EXT_LEARNED) 4803 err = __vxlan_fdb_delete(vxlan, fdb_info->eth_addr, 4804 fdb_info->remote_ip, 4805 fdb_info->remote_port, 4806 fdb_info->vni, 4807 fdb_info->remote_vni, 4808 fdb_info->remote_ifindex, 4809 false); 4810 4811 spin_unlock_bh(&vxlan->hash_lock); 4812 4813 return err; 4814 } 4815 4816 static int vxlan_switchdev_event(struct notifier_block *unused, 4817 unsigned long event, void *ptr) 4818 { 4819 struct net_device *dev = switchdev_notifier_info_to_dev(ptr); 4820 struct switchdev_notifier_vxlan_fdb_info *fdb_info; 4821 int err = 0; 4822 4823 switch (event) { 4824 case SWITCHDEV_VXLAN_FDB_OFFLOADED: 4825 vxlan_fdb_offloaded_set(dev, ptr); 4826 break; 4827 case SWITCHDEV_VXLAN_FDB_ADD_TO_BRIDGE: 4828 fdb_info = ptr; 4829 err = vxlan_fdb_external_learn_add(dev, fdb_info); 4830 if (err) { 4831 err = notifier_from_errno(err); 4832 break; 4833 } 4834 fdb_info->offloaded = true; 4835 vxlan_fdb_offloaded_set(dev, fdb_info); 4836 break; 4837 case SWITCHDEV_VXLAN_FDB_DEL_TO_BRIDGE: 4838 fdb_info = ptr; 4839 err = vxlan_fdb_external_learn_del(dev, fdb_info); 4840 if (err) { 4841 err = notifier_from_errno(err); 4842 break; 4843 } 4844 fdb_info->offloaded = false; 4845 vxlan_fdb_offloaded_set(dev, fdb_info); 4846 break; 4847 } 4848 4849 return err; 4850 } 4851 4852 static struct notifier_block vxlan_switchdev_notifier_block __read_mostly = { 4853 .notifier_call = vxlan_switchdev_event, 4854 }; 4855 4856 static void vxlan_fdb_nh_flush(struct nexthop *nh) 4857 { 4858 struct vxlan_fdb *fdb; 4859 struct vxlan_dev *vxlan; 4860 4861 rcu_read_lock(); 4862 list_for_each_entry_rcu(fdb, &nh->fdb_list, nh_list) { 4863 vxlan = rcu_dereference(fdb->vdev); 4864 WARN_ON(!vxlan); 4865 spin_lock_bh(&vxlan->hash_lock); 4866 if (!hlist_unhashed(&fdb->fdb_node)) 4867 vxlan_fdb_destroy(vxlan, fdb, false, false); 4868 spin_unlock_bh(&vxlan->hash_lock); 4869 } 4870 rcu_read_unlock(); 4871 } 4872 4873 static int vxlan_nexthop_event(struct notifier_block *nb, 4874 unsigned long event, void *ptr) 4875 { 4876 struct nh_notifier_info *info = ptr; 4877 struct nexthop *nh; 4878 4879 if (event != NEXTHOP_EVENT_DEL) 4880 return NOTIFY_DONE; 4881 4882 nh = nexthop_find_by_id(info->net, info->id); 4883 if (!nh) 4884 return NOTIFY_DONE; 4885 4886 vxlan_fdb_nh_flush(nh); 4887 4888 return NOTIFY_DONE; 4889 } 4890 4891 static __net_init int vxlan_init_net(struct net *net) 4892 { 4893 struct vxlan_net *vn = net_generic(net, vxlan_net_id); 4894 unsigned int h; 4895 4896 INIT_LIST_HEAD(&vn->vxlan_list); 4897 vn->nexthop_notifier_block.notifier_call = vxlan_nexthop_event; 4898 4899 for (h = 0; h < PORT_HASH_SIZE; ++h) 4900 INIT_HLIST_HEAD(&vn->sock_list[h]); 4901 4902 return register_nexthop_notifier(net, &vn->nexthop_notifier_block, 4903 NULL); 4904 } 4905 4906 static void __net_exit vxlan_destroy_tunnels(struct vxlan_net *vn, 4907 struct list_head *dev_to_kill) 4908 { 4909 struct vxlan_dev *vxlan, *next; 4910 4911 list_for_each_entry_safe(vxlan, next, &vn->vxlan_list, next) 4912 vxlan_dellink(vxlan->dev, dev_to_kill); 4913 } 4914 4915 static void __net_exit vxlan_exit_rtnl(struct net *net, 4916 struct list_head *dev_to_kill) 4917 { 4918 struct vxlan_net *vn = net_generic(net, vxlan_net_id); 4919 4920 ASSERT_RTNL_NET(net); 4921 4922 __unregister_nexthop_notifier(net, &vn->nexthop_notifier_block); 4923 vxlan_destroy_tunnels(vn, dev_to_kill); 4924 } 4925 4926 static void __net_exit vxlan_exit_net(struct net *net) 4927 { 4928 struct vxlan_net *vn = net_generic(net, vxlan_net_id); 4929 unsigned int h; 4930 4931 for (h = 0; h < PORT_HASH_SIZE; ++h) 4932 WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h])); 4933 } 4934 4935 static struct pernet_operations vxlan_net_ops = { 4936 .init = vxlan_init_net, 4937 .exit_rtnl = vxlan_exit_rtnl, 4938 .exit = vxlan_exit_net, 4939 .id = &vxlan_net_id, 4940 .size = sizeof(struct vxlan_net), 4941 }; 4942 4943 static int __init vxlan_init_module(void) 4944 { 4945 int rc; 4946 4947 rc = register_pernet_subsys(&vxlan_net_ops); 4948 if (rc) 4949 goto out1; 4950 4951 rc = register_netdevice_notifier(&vxlan_notifier_block); 4952 if (rc) 4953 goto out2; 4954 4955 rc = register_switchdev_notifier(&vxlan_switchdev_notifier_block); 4956 if (rc) 4957 goto out3; 4958 4959 rc = rtnl_link_register(&vxlan_link_ops); 4960 if (rc) 4961 goto out4; 4962 4963 rc = vxlan_vnifilter_init(); 4964 if (rc) 4965 goto out5; 4966 4967 return 0; 4968 out5: 4969 rtnl_link_unregister(&vxlan_link_ops); 4970 out4: 4971 unregister_switchdev_notifier(&vxlan_switchdev_notifier_block); 4972 out3: 4973 unregister_netdevice_notifier(&vxlan_notifier_block); 4974 out2: 4975 unregister_pernet_subsys(&vxlan_net_ops); 4976 out1: 4977 return rc; 4978 } 4979 late_initcall(vxlan_init_module); 4980 4981 static void __exit vxlan_cleanup_module(void) 4982 { 4983 vxlan_vnifilter_uninit(); 4984 rtnl_link_unregister(&vxlan_link_ops); 4985 unregister_switchdev_notifier(&vxlan_switchdev_notifier_block); 4986 unregister_netdevice_notifier(&vxlan_notifier_block); 4987 unregister_pernet_subsys(&vxlan_net_ops); 4988 /* rcu_barrier() is called by netns */ 4989 } 4990 module_exit(vxlan_cleanup_module); 4991 4992 MODULE_LICENSE("GPL"); 4993 MODULE_VERSION(VXLAN_VERSION); 4994 MODULE_AUTHOR("Stephen Hemminger <stephen@networkplumber.org>"); 4995 MODULE_DESCRIPTION("Driver for VXLAN encapsulated traffic"); 4996 MODULE_ALIAS_RTNL_LINK("vxlan"); 4997