1 /* 2 * Linux NET3: GRE over IP protocol decoder. 3 * 4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 * 11 */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/capability.h> 16 #include <linux/module.h> 17 #include <linux/types.h> 18 #include <linux/kernel.h> 19 #include <linux/slab.h> 20 #include <linux/uaccess.h> 21 #include <linux/skbuff.h> 22 #include <linux/netdevice.h> 23 #include <linux/in.h> 24 #include <linux/tcp.h> 25 #include <linux/udp.h> 26 #include <linux/if_arp.h> 27 #include <linux/if_vlan.h> 28 #include <linux/init.h> 29 #include <linux/in6.h> 30 #include <linux/inetdevice.h> 31 #include <linux/igmp.h> 32 #include <linux/netfilter_ipv4.h> 33 #include <linux/etherdevice.h> 34 #include <linux/if_ether.h> 35 36 #include <net/sock.h> 37 #include <net/ip.h> 38 #include <net/icmp.h> 39 #include <net/protocol.h> 40 #include <net/ip_tunnels.h> 41 #include <net/arp.h> 42 #include <net/checksum.h> 43 #include <net/dsfield.h> 44 #include <net/inet_ecn.h> 45 #include <net/xfrm.h> 46 #include <net/net_namespace.h> 47 #include <net/netns/generic.h> 48 #include <net/rtnetlink.h> 49 #include <net/gre.h> 50 #include <net/dst_metadata.h> 51 #include <net/erspan.h> 52 53 /* 54 Problems & solutions 55 -------------------- 56 57 1. The most important issue is detecting local dead loops. 58 They would cause complete host lockup in transmit, which 59 would be "resolved" by stack overflow or, if queueing is enabled, 60 with infinite looping in net_bh. 61 62 We cannot track such dead loops during route installation, 63 it is infeasible task. The most general solutions would be 64 to keep skb->encapsulation counter (sort of local ttl), 65 and silently drop packet when it expires. It is a good 66 solution, but it supposes maintaining new variable in ALL 67 skb, even if no tunneling is used. 68 69 Current solution: xmit_recursion breaks dead loops. This is a percpu 70 counter, since when we enter the first ndo_xmit(), cpu migration is 71 forbidden. We force an exit if this counter reaches RECURSION_LIMIT 72 73 2. Networking dead loops would not kill routers, but would really 74 kill network. IP hop limit plays role of "t->recursion" in this case, 75 if we copy it from packet being encapsulated to upper header. 76 It is very good solution, but it introduces two problems: 77 78 - Routing protocols, using packets with ttl=1 (OSPF, RIP2), 79 do not work over tunnels. 80 - traceroute does not work. I planned to relay ICMP from tunnel, 81 so that this problem would be solved and traceroute output 82 would even more informative. This idea appeared to be wrong: 83 only Linux complies to rfc1812 now (yes, guys, Linux is the only 84 true router now :-)), all routers (at least, in neighbourhood of mine) 85 return only 8 bytes of payload. It is the end. 86 87 Hence, if we want that OSPF worked or traceroute said something reasonable, 88 we should search for another solution. 89 90 One of them is to parse packet trying to detect inner encapsulation 91 made by our node. It is difficult or even impossible, especially, 92 taking into account fragmentation. TO be short, ttl is not solution at all. 93 94 Current solution: The solution was UNEXPECTEDLY SIMPLE. 95 We force DF flag on tunnels with preconfigured hop limit, 96 that is ALL. :-) Well, it does not remove the problem completely, 97 but exponential growth of network traffic is changed to linear 98 (branches, that exceed pmtu are pruned) and tunnel mtu 99 rapidly degrades to value <68, where looping stops. 100 Yes, it is not good if there exists a router in the loop, 101 which does not force DF, even when encapsulating packets have DF set. 102 But it is not our problem! Nobody could accuse us, we made 103 all that we could make. Even if it is your gated who injected 104 fatal route to network, even if it were you who configured 105 fatal static route: you are innocent. :-) 106 107 Alexey Kuznetsov. 108 */ 109 110 static bool log_ecn_error = true; 111 module_param(log_ecn_error, bool, 0644); 112 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN"); 113 114 static struct rtnl_link_ops ipgre_link_ops __read_mostly; 115 static int ipgre_tunnel_init(struct net_device *dev); 116 static void erspan_build_header(struct sk_buff *skb, 117 u32 id, u32 index, 118 bool truncate, bool is_ipv4); 119 120 static unsigned int ipgre_net_id __read_mostly; 121 static unsigned int gre_tap_net_id __read_mostly; 122 static unsigned int erspan_net_id __read_mostly; 123 124 static void ipgre_err(struct sk_buff *skb, u32 info, 125 const struct tnl_ptk_info *tpi) 126 { 127 128 /* All the routers (except for Linux) return only 129 8 bytes of packet payload. It means, that precise relaying of 130 ICMP in the real Internet is absolutely infeasible. 131 132 Moreover, Cisco "wise men" put GRE key to the third word 133 in GRE header. It makes impossible maintaining even soft 134 state for keyed GRE tunnels with enabled checksum. Tell 135 them "thank you". 136 137 Well, I wonder, rfc1812 was written by Cisco employee, 138 what the hell these idiots break standards established 139 by themselves??? 140 */ 141 struct net *net = dev_net(skb->dev); 142 struct ip_tunnel_net *itn; 143 const struct iphdr *iph; 144 const int type = icmp_hdr(skb)->type; 145 const int code = icmp_hdr(skb)->code; 146 unsigned int data_len = 0; 147 struct ip_tunnel *t; 148 149 switch (type) { 150 default: 151 case ICMP_PARAMETERPROB: 152 return; 153 154 case ICMP_DEST_UNREACH: 155 switch (code) { 156 case ICMP_SR_FAILED: 157 case ICMP_PORT_UNREACH: 158 /* Impossible event. */ 159 return; 160 default: 161 /* All others are translated to HOST_UNREACH. 162 rfc2003 contains "deep thoughts" about NET_UNREACH, 163 I believe they are just ether pollution. --ANK 164 */ 165 break; 166 } 167 break; 168 169 case ICMP_TIME_EXCEEDED: 170 if (code != ICMP_EXC_TTL) 171 return; 172 data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */ 173 break; 174 175 case ICMP_REDIRECT: 176 break; 177 } 178 179 if (tpi->proto == htons(ETH_P_TEB)) 180 itn = net_generic(net, gre_tap_net_id); 181 else 182 itn = net_generic(net, ipgre_net_id); 183 184 iph = (const struct iphdr *)(icmp_hdr(skb) + 1); 185 t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags, 186 iph->daddr, iph->saddr, tpi->key); 187 188 if (!t) 189 return; 190 191 #if IS_ENABLED(CONFIG_IPV6) 192 if (tpi->proto == htons(ETH_P_IPV6) && 193 !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4 + tpi->hdr_len, 194 type, data_len)) 195 return; 196 #endif 197 198 if (t->parms.iph.daddr == 0 || 199 ipv4_is_multicast(t->parms.iph.daddr)) 200 return; 201 202 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED) 203 return; 204 205 if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO)) 206 t->err_count++; 207 else 208 t->err_count = 1; 209 t->err_time = jiffies; 210 } 211 212 static void gre_err(struct sk_buff *skb, u32 info) 213 { 214 /* All the routers (except for Linux) return only 215 * 8 bytes of packet payload. It means, that precise relaying of 216 * ICMP in the real Internet is absolutely infeasible. 217 * 218 * Moreover, Cisco "wise men" put GRE key to the third word 219 * in GRE header. It makes impossible maintaining even soft 220 * state for keyed 221 * GRE tunnels with enabled checksum. Tell them "thank you". 222 * 223 * Well, I wonder, rfc1812 was written by Cisco employee, 224 * what the hell these idiots break standards established 225 * by themselves??? 226 */ 227 228 const struct iphdr *iph = (struct iphdr *)skb->data; 229 const int type = icmp_hdr(skb)->type; 230 const int code = icmp_hdr(skb)->code; 231 struct tnl_ptk_info tpi; 232 bool csum_err = false; 233 234 if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 235 iph->ihl * 4) < 0) { 236 if (!csum_err) /* ignore csum errors. */ 237 return; 238 } 239 240 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { 241 ipv4_update_pmtu(skb, dev_net(skb->dev), info, 242 skb->dev->ifindex, 0, IPPROTO_GRE, 0); 243 return; 244 } 245 if (type == ICMP_REDIRECT) { 246 ipv4_redirect(skb, dev_net(skb->dev), skb->dev->ifindex, 0, 247 IPPROTO_GRE, 0); 248 return; 249 } 250 251 ipgre_err(skb, info, &tpi); 252 } 253 254 static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, 255 int gre_hdr_len) 256 { 257 struct net *net = dev_net(skb->dev); 258 struct metadata_dst *tun_dst = NULL; 259 struct erspan_base_hdr *ershdr; 260 struct erspan_metadata *pkt_md; 261 struct ip_tunnel_net *itn; 262 struct ip_tunnel *tunnel; 263 const struct iphdr *iph; 264 int ver; 265 int len; 266 267 itn = net_generic(net, erspan_net_id); 268 len = gre_hdr_len + sizeof(*ershdr); 269 270 /* Check based hdr len */ 271 if (unlikely(!pskb_may_pull(skb, len))) 272 return PACKET_REJECT; 273 274 iph = ip_hdr(skb); 275 ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); 276 ver = ershdr->ver; 277 278 /* The original GRE header does not have key field, 279 * Use ERSPAN 10-bit session ID as key. 280 */ 281 tpi->key = cpu_to_be32(get_session_id(ershdr)); 282 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, 283 tpi->flags | TUNNEL_KEY, 284 iph->saddr, iph->daddr, tpi->key); 285 286 if (tunnel) { 287 len = gre_hdr_len + erspan_hdr_len(ver); 288 if (unlikely(!pskb_may_pull(skb, len))) 289 return PACKET_REJECT; 290 291 ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len); 292 pkt_md = (struct erspan_metadata *)(ershdr + 1); 293 294 if (__iptunnel_pull_header(skb, 295 len, 296 htons(ETH_P_TEB), 297 false, false) < 0) 298 goto drop; 299 300 if (tunnel->collect_md) { 301 struct ip_tunnel_info *info; 302 struct erspan_metadata *md; 303 __be64 tun_id; 304 __be16 flags; 305 306 tpi->flags |= TUNNEL_KEY; 307 flags = tpi->flags; 308 tun_id = key32_to_tunnel_id(tpi->key); 309 310 tun_dst = ip_tun_rx_dst(skb, flags, 311 tun_id, sizeof(*md)); 312 if (!tun_dst) 313 return PACKET_REJECT; 314 315 md = ip_tunnel_info_opts(&tun_dst->u.tun_info); 316 memcpy(md, pkt_md, sizeof(*md)); 317 md->version = ver; 318 319 info = &tun_dst->u.tun_info; 320 info->key.tun_flags |= TUNNEL_ERSPAN_OPT; 321 info->options_len = sizeof(*md); 322 } else { 323 tunnel->erspan_ver = ver; 324 if (ver == 1) { 325 tunnel->index = ntohl(pkt_md->u.index); 326 } else { 327 tunnel->dir = pkt_md->u.md2.dir; 328 tunnel->hwid = get_hwid(&pkt_md->u.md2); 329 } 330 331 } 332 333 skb_reset_mac_header(skb); 334 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error); 335 return PACKET_RCVD; 336 } 337 drop: 338 kfree_skb(skb); 339 return PACKET_RCVD; 340 } 341 342 static int __ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi, 343 struct ip_tunnel_net *itn, int hdr_len, bool raw_proto) 344 { 345 struct metadata_dst *tun_dst = NULL; 346 const struct iphdr *iph; 347 struct ip_tunnel *tunnel; 348 349 iph = ip_hdr(skb); 350 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags, 351 iph->saddr, iph->daddr, tpi->key); 352 353 if (tunnel) { 354 if (__iptunnel_pull_header(skb, hdr_len, tpi->proto, 355 raw_proto, false) < 0) 356 goto drop; 357 358 if (tunnel->dev->type != ARPHRD_NONE) 359 skb_pop_mac_header(skb); 360 else 361 skb_reset_mac_header(skb); 362 if (tunnel->collect_md) { 363 __be16 flags; 364 __be64 tun_id; 365 366 flags = tpi->flags & (TUNNEL_CSUM | TUNNEL_KEY); 367 tun_id = key32_to_tunnel_id(tpi->key); 368 tun_dst = ip_tun_rx_dst(skb, flags, tun_id, 0); 369 if (!tun_dst) 370 return PACKET_REJECT; 371 } 372 373 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error); 374 return PACKET_RCVD; 375 } 376 return PACKET_NEXT; 377 378 drop: 379 kfree_skb(skb); 380 return PACKET_RCVD; 381 } 382 383 static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi, 384 int hdr_len) 385 { 386 struct net *net = dev_net(skb->dev); 387 struct ip_tunnel_net *itn; 388 int res; 389 390 if (tpi->proto == htons(ETH_P_TEB)) 391 itn = net_generic(net, gre_tap_net_id); 392 else 393 itn = net_generic(net, ipgre_net_id); 394 395 res = __ipgre_rcv(skb, tpi, itn, hdr_len, false); 396 if (res == PACKET_NEXT && tpi->proto == htons(ETH_P_TEB)) { 397 /* ipgre tunnels in collect metadata mode should receive 398 * also ETH_P_TEB traffic. 399 */ 400 itn = net_generic(net, ipgre_net_id); 401 res = __ipgre_rcv(skb, tpi, itn, hdr_len, true); 402 } 403 return res; 404 } 405 406 static int gre_rcv(struct sk_buff *skb) 407 { 408 struct tnl_ptk_info tpi; 409 bool csum_err = false; 410 int hdr_len; 411 412 #ifdef CONFIG_NET_IPGRE_BROADCAST 413 if (ipv4_is_multicast(ip_hdr(skb)->daddr)) { 414 /* Looped back packet, drop it! */ 415 if (rt_is_output_route(skb_rtable(skb))) 416 goto drop; 417 } 418 #endif 419 420 hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 0); 421 if (hdr_len < 0) 422 goto drop; 423 424 if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) || 425 tpi.proto == htons(ETH_P_ERSPAN2))) { 426 if (erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) 427 return 0; 428 goto out; 429 } 430 431 if (ipgre_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) 432 return 0; 433 434 out: 435 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); 436 drop: 437 kfree_skb(skb); 438 return 0; 439 } 440 441 static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, 442 const struct iphdr *tnl_params, 443 __be16 proto) 444 { 445 struct ip_tunnel *tunnel = netdev_priv(dev); 446 447 if (tunnel->parms.o_flags & TUNNEL_SEQ) 448 tunnel->o_seqno++; 449 450 /* Push GRE header. */ 451 gre_build_header(skb, tunnel->tun_hlen, 452 tunnel->parms.o_flags, proto, tunnel->parms.o_key, 453 htonl(tunnel->o_seqno)); 454 455 ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); 456 } 457 458 static int gre_handle_offloads(struct sk_buff *skb, bool csum) 459 { 460 return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); 461 } 462 463 static struct rtable *gre_get_rt(struct sk_buff *skb, 464 struct net_device *dev, 465 struct flowi4 *fl, 466 const struct ip_tunnel_key *key) 467 { 468 struct net *net = dev_net(dev); 469 470 memset(fl, 0, sizeof(*fl)); 471 fl->daddr = key->u.ipv4.dst; 472 fl->saddr = key->u.ipv4.src; 473 fl->flowi4_tos = RT_TOS(key->tos); 474 fl->flowi4_mark = skb->mark; 475 fl->flowi4_proto = IPPROTO_GRE; 476 477 return ip_route_output_key(net, fl); 478 } 479 480 static struct rtable *prepare_fb_xmit(struct sk_buff *skb, 481 struct net_device *dev, 482 struct flowi4 *fl, 483 int tunnel_hlen) 484 { 485 struct ip_tunnel_info *tun_info; 486 const struct ip_tunnel_key *key; 487 struct rtable *rt = NULL; 488 int min_headroom; 489 bool use_cache; 490 int err; 491 492 tun_info = skb_tunnel_info(skb); 493 key = &tun_info->key; 494 use_cache = ip_tunnel_dst_cache_usable(skb, tun_info); 495 496 if (use_cache) 497 rt = dst_cache_get_ip4(&tun_info->dst_cache, &fl->saddr); 498 if (!rt) { 499 rt = gre_get_rt(skb, dev, fl, key); 500 if (IS_ERR(rt)) 501 goto err_free_skb; 502 if (use_cache) 503 dst_cache_set_ip4(&tun_info->dst_cache, &rt->dst, 504 fl->saddr); 505 } 506 507 min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len 508 + tunnel_hlen + sizeof(struct iphdr); 509 if (skb_headroom(skb) < min_headroom || skb_header_cloned(skb)) { 510 int head_delta = SKB_DATA_ALIGN(min_headroom - 511 skb_headroom(skb) + 512 16); 513 err = pskb_expand_head(skb, max_t(int, head_delta, 0), 514 0, GFP_ATOMIC); 515 if (unlikely(err)) 516 goto err_free_rt; 517 } 518 return rt; 519 520 err_free_rt: 521 ip_rt_put(rt); 522 err_free_skb: 523 kfree_skb(skb); 524 dev->stats.tx_dropped++; 525 return NULL; 526 } 527 528 static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev, 529 __be16 proto) 530 { 531 struct ip_tunnel_info *tun_info; 532 const struct ip_tunnel_key *key; 533 struct rtable *rt = NULL; 534 struct flowi4 fl; 535 int tunnel_hlen; 536 __be16 df, flags; 537 538 tun_info = skb_tunnel_info(skb); 539 if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || 540 ip_tunnel_info_af(tun_info) != AF_INET)) 541 goto err_free_skb; 542 543 key = &tun_info->key; 544 tunnel_hlen = gre_calc_hlen(key->tun_flags); 545 546 rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen); 547 if (!rt) 548 return; 549 550 /* Push Tunnel header. */ 551 if (gre_handle_offloads(skb, !!(tun_info->key.tun_flags & TUNNEL_CSUM))) 552 goto err_free_rt; 553 554 flags = tun_info->key.tun_flags & (TUNNEL_CSUM | TUNNEL_KEY); 555 gre_build_header(skb, tunnel_hlen, flags, proto, 556 tunnel_id_to_key32(tun_info->key.tun_id), 0); 557 558 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; 559 560 iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE, 561 key->tos, key->ttl, df, false); 562 return; 563 564 err_free_rt: 565 ip_rt_put(rt); 566 err_free_skb: 567 kfree_skb(skb); 568 dev->stats.tx_dropped++; 569 } 570 571 static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev, 572 __be16 proto) 573 { 574 struct ip_tunnel *tunnel = netdev_priv(dev); 575 struct ip_tunnel_info *tun_info; 576 const struct ip_tunnel_key *key; 577 struct erspan_metadata *md; 578 struct rtable *rt = NULL; 579 bool truncate = false; 580 struct flowi4 fl; 581 int tunnel_hlen; 582 int version; 583 __be16 df; 584 585 tun_info = skb_tunnel_info(skb); 586 if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) || 587 ip_tunnel_info_af(tun_info) != AF_INET)) 588 goto err_free_skb; 589 590 key = &tun_info->key; 591 md = ip_tunnel_info_opts(tun_info); 592 if (!md) 593 goto err_free_rt; 594 595 /* ERSPAN has fixed 8 byte GRE header */ 596 version = md->version; 597 tunnel_hlen = 8 + erspan_hdr_len(version); 598 599 rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen); 600 if (!rt) 601 return; 602 603 if (gre_handle_offloads(skb, false)) 604 goto err_free_rt; 605 606 if (skb->len > dev->mtu + dev->hard_header_len) { 607 pskb_trim(skb, dev->mtu + dev->hard_header_len); 608 truncate = true; 609 } 610 611 if (version == 1) { 612 erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)), 613 ntohl(md->u.index), truncate, true); 614 } else if (version == 2) { 615 erspan_build_header_v2(skb, 616 ntohl(tunnel_id_to_key32(key->tun_id)), 617 md->u.md2.dir, 618 get_hwid(&md->u.md2), 619 truncate, true); 620 } else { 621 goto err_free_rt; 622 } 623 624 gre_build_header(skb, 8, TUNNEL_SEQ, 625 htons(ETH_P_ERSPAN), 0, htonl(tunnel->o_seqno++)); 626 627 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0; 628 629 iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE, 630 key->tos, key->ttl, df, false); 631 return; 632 633 err_free_rt: 634 ip_rt_put(rt); 635 err_free_skb: 636 kfree_skb(skb); 637 dev->stats.tx_dropped++; 638 } 639 640 static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) 641 { 642 struct ip_tunnel_info *info = skb_tunnel_info(skb); 643 struct rtable *rt; 644 struct flowi4 fl4; 645 646 if (ip_tunnel_info_af(info) != AF_INET) 647 return -EINVAL; 648 649 rt = gre_get_rt(skb, dev, &fl4, &info->key); 650 if (IS_ERR(rt)) 651 return PTR_ERR(rt); 652 653 ip_rt_put(rt); 654 info->key.u.ipv4.src = fl4.saddr; 655 return 0; 656 } 657 658 static netdev_tx_t ipgre_xmit(struct sk_buff *skb, 659 struct net_device *dev) 660 { 661 struct ip_tunnel *tunnel = netdev_priv(dev); 662 const struct iphdr *tnl_params; 663 664 if (tunnel->collect_md) { 665 gre_fb_xmit(skb, dev, skb->protocol); 666 return NETDEV_TX_OK; 667 } 668 669 if (dev->header_ops) { 670 /* Need space for new headers */ 671 if (skb_cow_head(skb, dev->needed_headroom - 672 (tunnel->hlen + sizeof(struct iphdr)))) 673 goto free_skb; 674 675 tnl_params = (const struct iphdr *)skb->data; 676 677 /* Pull skb since ip_tunnel_xmit() needs skb->data pointing 678 * to gre header. 679 */ 680 skb_pull(skb, tunnel->hlen + sizeof(struct iphdr)); 681 skb_reset_mac_header(skb); 682 } else { 683 if (skb_cow_head(skb, dev->needed_headroom)) 684 goto free_skb; 685 686 tnl_params = &tunnel->parms.iph; 687 } 688 689 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM))) 690 goto free_skb; 691 692 __gre_xmit(skb, dev, tnl_params, skb->protocol); 693 return NETDEV_TX_OK; 694 695 free_skb: 696 kfree_skb(skb); 697 dev->stats.tx_dropped++; 698 return NETDEV_TX_OK; 699 } 700 701 static netdev_tx_t erspan_xmit(struct sk_buff *skb, 702 struct net_device *dev) 703 { 704 struct ip_tunnel *tunnel = netdev_priv(dev); 705 bool truncate = false; 706 707 if (tunnel->collect_md) { 708 erspan_fb_xmit(skb, dev, skb->protocol); 709 return NETDEV_TX_OK; 710 } 711 712 if (gre_handle_offloads(skb, false)) 713 goto free_skb; 714 715 if (skb_cow_head(skb, dev->needed_headroom)) 716 goto free_skb; 717 718 if (skb->len > dev->mtu + dev->hard_header_len) { 719 pskb_trim(skb, dev->mtu + dev->hard_header_len); 720 truncate = true; 721 } 722 723 /* Push ERSPAN header */ 724 if (tunnel->erspan_ver == 1) 725 erspan_build_header(skb, ntohl(tunnel->parms.o_key), 726 tunnel->index, 727 truncate, true); 728 else 729 erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key), 730 tunnel->dir, tunnel->hwid, 731 truncate, true); 732 733 tunnel->parms.o_flags &= ~TUNNEL_KEY; 734 __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN)); 735 return NETDEV_TX_OK; 736 737 free_skb: 738 kfree_skb(skb); 739 dev->stats.tx_dropped++; 740 return NETDEV_TX_OK; 741 } 742 743 static netdev_tx_t gre_tap_xmit(struct sk_buff *skb, 744 struct net_device *dev) 745 { 746 struct ip_tunnel *tunnel = netdev_priv(dev); 747 748 if (tunnel->collect_md) { 749 gre_fb_xmit(skb, dev, htons(ETH_P_TEB)); 750 return NETDEV_TX_OK; 751 } 752 753 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM))) 754 goto free_skb; 755 756 if (skb_cow_head(skb, dev->needed_headroom)) 757 goto free_skb; 758 759 __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB)); 760 return NETDEV_TX_OK; 761 762 free_skb: 763 kfree_skb(skb); 764 dev->stats.tx_dropped++; 765 return NETDEV_TX_OK; 766 } 767 768 static void ipgre_link_update(struct net_device *dev, bool set_mtu) 769 { 770 struct ip_tunnel *tunnel = netdev_priv(dev); 771 int len; 772 773 len = tunnel->tun_hlen; 774 tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags); 775 len = tunnel->tun_hlen - len; 776 tunnel->hlen = tunnel->hlen + len; 777 778 dev->needed_headroom = dev->needed_headroom + len; 779 if (set_mtu) 780 dev->mtu = max_t(int, dev->mtu - len, 68); 781 782 if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) { 783 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) || 784 tunnel->encap.type == TUNNEL_ENCAP_NONE) { 785 dev->features |= NETIF_F_GSO_SOFTWARE; 786 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 787 } 788 dev->features |= NETIF_F_LLTX; 789 } 790 } 791 792 static int ipgre_tunnel_ioctl(struct net_device *dev, 793 struct ifreq *ifr, int cmd) 794 { 795 struct ip_tunnel_parm p; 796 int err; 797 798 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) 799 return -EFAULT; 800 801 if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) { 802 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE || 803 p.iph.ihl != 5 || (p.iph.frag_off & htons(~IP_DF)) || 804 ((p.i_flags | p.o_flags) & (GRE_VERSION | GRE_ROUTING))) 805 return -EINVAL; 806 } 807 808 p.i_flags = gre_flags_to_tnl_flags(p.i_flags); 809 p.o_flags = gre_flags_to_tnl_flags(p.o_flags); 810 811 err = ip_tunnel_ioctl(dev, &p, cmd); 812 if (err) 813 return err; 814 815 if (cmd == SIOCCHGTUNNEL) { 816 struct ip_tunnel *t = netdev_priv(dev); 817 818 t->parms.i_flags = p.i_flags; 819 t->parms.o_flags = p.o_flags; 820 821 if (strcmp(dev->rtnl_link_ops->kind, "erspan")) 822 ipgre_link_update(dev, true); 823 } 824 825 p.i_flags = gre_tnl_flags_to_gre_flags(p.i_flags); 826 p.o_flags = gre_tnl_flags_to_gre_flags(p.o_flags); 827 828 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p))) 829 return -EFAULT; 830 831 return 0; 832 } 833 834 /* Nice toy. Unfortunately, useless in real life :-) 835 It allows to construct virtual multiprotocol broadcast "LAN" 836 over the Internet, provided multicast routing is tuned. 837 838 839 I have no idea was this bicycle invented before me, 840 so that I had to set ARPHRD_IPGRE to a random value. 841 I have an impression, that Cisco could make something similar, 842 but this feature is apparently missing in IOS<=11.2(8). 843 844 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks 845 with broadcast 224.66.66.66. If you have access to mbone, play with me :-) 846 847 ping -t 255 224.66.66.66 848 849 If nobody answers, mbone does not work. 850 851 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255 852 ip addr add 10.66.66.<somewhat>/24 dev Universe 853 ifconfig Universe up 854 ifconfig Universe add fe80::<Your_real_addr>/10 855 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96 856 ftp 10.66.66.66 857 ... 858 ftp fec0:6666:6666::193.233.7.65 859 ... 860 */ 861 static int ipgre_header(struct sk_buff *skb, struct net_device *dev, 862 unsigned short type, 863 const void *daddr, const void *saddr, unsigned int len) 864 { 865 struct ip_tunnel *t = netdev_priv(dev); 866 struct iphdr *iph; 867 struct gre_base_hdr *greh; 868 869 iph = skb_push(skb, t->hlen + sizeof(*iph)); 870 greh = (struct gre_base_hdr *)(iph+1); 871 greh->flags = gre_tnl_flags_to_gre_flags(t->parms.o_flags); 872 greh->protocol = htons(type); 873 874 memcpy(iph, &t->parms.iph, sizeof(struct iphdr)); 875 876 /* Set the source hardware address. */ 877 if (saddr) 878 memcpy(&iph->saddr, saddr, 4); 879 if (daddr) 880 memcpy(&iph->daddr, daddr, 4); 881 if (iph->daddr) 882 return t->hlen + sizeof(*iph); 883 884 return -(t->hlen + sizeof(*iph)); 885 } 886 887 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr) 888 { 889 const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb); 890 memcpy(haddr, &iph->saddr, 4); 891 return 4; 892 } 893 894 static const struct header_ops ipgre_header_ops = { 895 .create = ipgre_header, 896 .parse = ipgre_header_parse, 897 }; 898 899 #ifdef CONFIG_NET_IPGRE_BROADCAST 900 static int ipgre_open(struct net_device *dev) 901 { 902 struct ip_tunnel *t = netdev_priv(dev); 903 904 if (ipv4_is_multicast(t->parms.iph.daddr)) { 905 struct flowi4 fl4; 906 struct rtable *rt; 907 908 rt = ip_route_output_gre(t->net, &fl4, 909 t->parms.iph.daddr, 910 t->parms.iph.saddr, 911 t->parms.o_key, 912 RT_TOS(t->parms.iph.tos), 913 t->parms.link); 914 if (IS_ERR(rt)) 915 return -EADDRNOTAVAIL; 916 dev = rt->dst.dev; 917 ip_rt_put(rt); 918 if (!__in_dev_get_rtnl(dev)) 919 return -EADDRNOTAVAIL; 920 t->mlink = dev->ifindex; 921 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr); 922 } 923 return 0; 924 } 925 926 static int ipgre_close(struct net_device *dev) 927 { 928 struct ip_tunnel *t = netdev_priv(dev); 929 930 if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) { 931 struct in_device *in_dev; 932 in_dev = inetdev_by_index(t->net, t->mlink); 933 if (in_dev) 934 ip_mc_dec_group(in_dev, t->parms.iph.daddr); 935 } 936 return 0; 937 } 938 #endif 939 940 static const struct net_device_ops ipgre_netdev_ops = { 941 .ndo_init = ipgre_tunnel_init, 942 .ndo_uninit = ip_tunnel_uninit, 943 #ifdef CONFIG_NET_IPGRE_BROADCAST 944 .ndo_open = ipgre_open, 945 .ndo_stop = ipgre_close, 946 #endif 947 .ndo_start_xmit = ipgre_xmit, 948 .ndo_do_ioctl = ipgre_tunnel_ioctl, 949 .ndo_change_mtu = ip_tunnel_change_mtu, 950 .ndo_get_stats64 = ip_tunnel_get_stats64, 951 .ndo_get_iflink = ip_tunnel_get_iflink, 952 }; 953 954 #define GRE_FEATURES (NETIF_F_SG | \ 955 NETIF_F_FRAGLIST | \ 956 NETIF_F_HIGHDMA | \ 957 NETIF_F_HW_CSUM) 958 959 static void ipgre_tunnel_setup(struct net_device *dev) 960 { 961 dev->netdev_ops = &ipgre_netdev_ops; 962 dev->type = ARPHRD_IPGRE; 963 ip_tunnel_setup(dev, ipgre_net_id); 964 } 965 966 static void __gre_tunnel_init(struct net_device *dev) 967 { 968 struct ip_tunnel *tunnel; 969 int t_hlen; 970 971 tunnel = netdev_priv(dev); 972 tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags); 973 tunnel->parms.iph.protocol = IPPROTO_GRE; 974 975 tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen; 976 977 t_hlen = tunnel->hlen + sizeof(struct iphdr); 978 979 dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4; 980 dev->mtu = ETH_DATA_LEN - t_hlen - 4; 981 982 dev->features |= GRE_FEATURES; 983 dev->hw_features |= GRE_FEATURES; 984 985 if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) { 986 /* TCP offload with GRE SEQ is not supported, nor 987 * can we support 2 levels of outer headers requiring 988 * an update. 989 */ 990 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) || 991 (tunnel->encap.type == TUNNEL_ENCAP_NONE)) { 992 dev->features |= NETIF_F_GSO_SOFTWARE; 993 dev->hw_features |= NETIF_F_GSO_SOFTWARE; 994 } 995 996 /* Can use a lockless transmit, unless we generate 997 * output sequences 998 */ 999 dev->features |= NETIF_F_LLTX; 1000 } 1001 } 1002 1003 static int ipgre_tunnel_init(struct net_device *dev) 1004 { 1005 struct ip_tunnel *tunnel = netdev_priv(dev); 1006 struct iphdr *iph = &tunnel->parms.iph; 1007 1008 __gre_tunnel_init(dev); 1009 1010 memcpy(dev->dev_addr, &iph->saddr, 4); 1011 memcpy(dev->broadcast, &iph->daddr, 4); 1012 1013 dev->flags = IFF_NOARP; 1014 netif_keep_dst(dev); 1015 dev->addr_len = 4; 1016 1017 if (iph->daddr && !tunnel->collect_md) { 1018 #ifdef CONFIG_NET_IPGRE_BROADCAST 1019 if (ipv4_is_multicast(iph->daddr)) { 1020 if (!iph->saddr) 1021 return -EINVAL; 1022 dev->flags = IFF_BROADCAST; 1023 dev->header_ops = &ipgre_header_ops; 1024 } 1025 #endif 1026 } else if (!tunnel->collect_md) { 1027 dev->header_ops = &ipgre_header_ops; 1028 } 1029 1030 return ip_tunnel_init(dev); 1031 } 1032 1033 static const struct gre_protocol ipgre_protocol = { 1034 .handler = gre_rcv, 1035 .err_handler = gre_err, 1036 }; 1037 1038 static int __net_init ipgre_init_net(struct net *net) 1039 { 1040 return ip_tunnel_init_net(net, ipgre_net_id, &ipgre_link_ops, NULL); 1041 } 1042 1043 static void __net_exit ipgre_exit_batch_net(struct list_head *list_net) 1044 { 1045 ip_tunnel_delete_nets(list_net, ipgre_net_id, &ipgre_link_ops); 1046 } 1047 1048 static struct pernet_operations ipgre_net_ops = { 1049 .init = ipgre_init_net, 1050 .exit_batch = ipgre_exit_batch_net, 1051 .id = &ipgre_net_id, 1052 .size = sizeof(struct ip_tunnel_net), 1053 }; 1054 1055 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[], 1056 struct netlink_ext_ack *extack) 1057 { 1058 __be16 flags; 1059 1060 if (!data) 1061 return 0; 1062 1063 flags = 0; 1064 if (data[IFLA_GRE_IFLAGS]) 1065 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]); 1066 if (data[IFLA_GRE_OFLAGS]) 1067 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]); 1068 if (flags & (GRE_VERSION|GRE_ROUTING)) 1069 return -EINVAL; 1070 1071 if (data[IFLA_GRE_COLLECT_METADATA] && 1072 data[IFLA_GRE_ENCAP_TYPE] && 1073 nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE) 1074 return -EINVAL; 1075 1076 return 0; 1077 } 1078 1079 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[], 1080 struct netlink_ext_ack *extack) 1081 { 1082 __be32 daddr; 1083 1084 if (tb[IFLA_ADDRESS]) { 1085 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) 1086 return -EINVAL; 1087 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) 1088 return -EADDRNOTAVAIL; 1089 } 1090 1091 if (!data) 1092 goto out; 1093 1094 if (data[IFLA_GRE_REMOTE]) { 1095 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4); 1096 if (!daddr) 1097 return -EINVAL; 1098 } 1099 1100 out: 1101 return ipgre_tunnel_validate(tb, data, extack); 1102 } 1103 1104 static int erspan_validate(struct nlattr *tb[], struct nlattr *data[], 1105 struct netlink_ext_ack *extack) 1106 { 1107 __be16 flags = 0; 1108 int ret; 1109 1110 if (!data) 1111 return 0; 1112 1113 ret = ipgre_tap_validate(tb, data, extack); 1114 if (ret) 1115 return ret; 1116 1117 /* ERSPAN should only have GRE sequence and key flag */ 1118 if (data[IFLA_GRE_OFLAGS]) 1119 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]); 1120 if (data[IFLA_GRE_IFLAGS]) 1121 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]); 1122 if (!data[IFLA_GRE_COLLECT_METADATA] && 1123 flags != (GRE_SEQ | GRE_KEY)) 1124 return -EINVAL; 1125 1126 /* ERSPAN Session ID only has 10-bit. Since we reuse 1127 * 32-bit key field as ID, check it's range. 1128 */ 1129 if (data[IFLA_GRE_IKEY] && 1130 (ntohl(nla_get_be32(data[IFLA_GRE_IKEY])) & ~ID_MASK)) 1131 return -EINVAL; 1132 1133 if (data[IFLA_GRE_OKEY] && 1134 (ntohl(nla_get_be32(data[IFLA_GRE_OKEY])) & ~ID_MASK)) 1135 return -EINVAL; 1136 1137 return 0; 1138 } 1139 1140 static int ipgre_netlink_parms(struct net_device *dev, 1141 struct nlattr *data[], 1142 struct nlattr *tb[], 1143 struct ip_tunnel_parm *parms, 1144 __u32 *fwmark) 1145 { 1146 struct ip_tunnel *t = netdev_priv(dev); 1147 1148 memset(parms, 0, sizeof(*parms)); 1149 1150 parms->iph.protocol = IPPROTO_GRE; 1151 1152 if (!data) 1153 return 0; 1154 1155 if (data[IFLA_GRE_LINK]) 1156 parms->link = nla_get_u32(data[IFLA_GRE_LINK]); 1157 1158 if (data[IFLA_GRE_IFLAGS]) 1159 parms->i_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_IFLAGS])); 1160 1161 if (data[IFLA_GRE_OFLAGS]) 1162 parms->o_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_OFLAGS])); 1163 1164 if (data[IFLA_GRE_IKEY]) 1165 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]); 1166 1167 if (data[IFLA_GRE_OKEY]) 1168 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]); 1169 1170 if (data[IFLA_GRE_LOCAL]) 1171 parms->iph.saddr = nla_get_in_addr(data[IFLA_GRE_LOCAL]); 1172 1173 if (data[IFLA_GRE_REMOTE]) 1174 parms->iph.daddr = nla_get_in_addr(data[IFLA_GRE_REMOTE]); 1175 1176 if (data[IFLA_GRE_TTL]) 1177 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]); 1178 1179 if (data[IFLA_GRE_TOS]) 1180 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]); 1181 1182 if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC])) { 1183 if (t->ignore_df) 1184 return -EINVAL; 1185 parms->iph.frag_off = htons(IP_DF); 1186 } 1187 1188 if (data[IFLA_GRE_COLLECT_METADATA]) { 1189 t->collect_md = true; 1190 if (dev->type == ARPHRD_IPGRE) 1191 dev->type = ARPHRD_NONE; 1192 } 1193 1194 if (data[IFLA_GRE_IGNORE_DF]) { 1195 if (nla_get_u8(data[IFLA_GRE_IGNORE_DF]) 1196 && (parms->iph.frag_off & htons(IP_DF))) 1197 return -EINVAL; 1198 t->ignore_df = !!nla_get_u8(data[IFLA_GRE_IGNORE_DF]); 1199 } 1200 1201 if (data[IFLA_GRE_FWMARK]) 1202 *fwmark = nla_get_u32(data[IFLA_GRE_FWMARK]); 1203 1204 if (data[IFLA_GRE_ERSPAN_VER]) { 1205 t->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]); 1206 1207 if (t->erspan_ver != 1 && t->erspan_ver != 2) 1208 return -EINVAL; 1209 } 1210 1211 if (t->erspan_ver == 1) { 1212 if (data[IFLA_GRE_ERSPAN_INDEX]) { 1213 t->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]); 1214 if (t->index & ~INDEX_MASK) 1215 return -EINVAL; 1216 } 1217 } else if (t->erspan_ver == 2) { 1218 if (data[IFLA_GRE_ERSPAN_DIR]) { 1219 t->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]); 1220 if (t->dir & ~(DIR_MASK >> DIR_OFFSET)) 1221 return -EINVAL; 1222 } 1223 if (data[IFLA_GRE_ERSPAN_HWID]) { 1224 t->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]); 1225 if (t->hwid & ~(HWID_MASK >> HWID_OFFSET)) 1226 return -EINVAL; 1227 } 1228 } 1229 1230 return 0; 1231 } 1232 1233 /* This function returns true when ENCAP attributes are present in the nl msg */ 1234 static bool ipgre_netlink_encap_parms(struct nlattr *data[], 1235 struct ip_tunnel_encap *ipencap) 1236 { 1237 bool ret = false; 1238 1239 memset(ipencap, 0, sizeof(*ipencap)); 1240 1241 if (!data) 1242 return ret; 1243 1244 if (data[IFLA_GRE_ENCAP_TYPE]) { 1245 ret = true; 1246 ipencap->type = nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]); 1247 } 1248 1249 if (data[IFLA_GRE_ENCAP_FLAGS]) { 1250 ret = true; 1251 ipencap->flags = nla_get_u16(data[IFLA_GRE_ENCAP_FLAGS]); 1252 } 1253 1254 if (data[IFLA_GRE_ENCAP_SPORT]) { 1255 ret = true; 1256 ipencap->sport = nla_get_be16(data[IFLA_GRE_ENCAP_SPORT]); 1257 } 1258 1259 if (data[IFLA_GRE_ENCAP_DPORT]) { 1260 ret = true; 1261 ipencap->dport = nla_get_be16(data[IFLA_GRE_ENCAP_DPORT]); 1262 } 1263 1264 return ret; 1265 } 1266 1267 static int gre_tap_init(struct net_device *dev) 1268 { 1269 __gre_tunnel_init(dev); 1270 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1271 netif_keep_dst(dev); 1272 1273 return ip_tunnel_init(dev); 1274 } 1275 1276 static const struct net_device_ops gre_tap_netdev_ops = { 1277 .ndo_init = gre_tap_init, 1278 .ndo_uninit = ip_tunnel_uninit, 1279 .ndo_start_xmit = gre_tap_xmit, 1280 .ndo_set_mac_address = eth_mac_addr, 1281 .ndo_validate_addr = eth_validate_addr, 1282 .ndo_change_mtu = ip_tunnel_change_mtu, 1283 .ndo_get_stats64 = ip_tunnel_get_stats64, 1284 .ndo_get_iflink = ip_tunnel_get_iflink, 1285 .ndo_fill_metadata_dst = gre_fill_metadata_dst, 1286 }; 1287 1288 static int erspan_tunnel_init(struct net_device *dev) 1289 { 1290 struct ip_tunnel *tunnel = netdev_priv(dev); 1291 int t_hlen; 1292 1293 tunnel->tun_hlen = 8; 1294 tunnel->parms.iph.protocol = IPPROTO_GRE; 1295 tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen + 1296 erspan_hdr_len(tunnel->erspan_ver); 1297 t_hlen = tunnel->hlen + sizeof(struct iphdr); 1298 1299 dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4; 1300 dev->mtu = ETH_DATA_LEN - t_hlen - 4; 1301 dev->features |= GRE_FEATURES; 1302 dev->hw_features |= GRE_FEATURES; 1303 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1304 netif_keep_dst(dev); 1305 1306 return ip_tunnel_init(dev); 1307 } 1308 1309 static const struct net_device_ops erspan_netdev_ops = { 1310 .ndo_init = erspan_tunnel_init, 1311 .ndo_uninit = ip_tunnel_uninit, 1312 .ndo_start_xmit = erspan_xmit, 1313 .ndo_set_mac_address = eth_mac_addr, 1314 .ndo_validate_addr = eth_validate_addr, 1315 .ndo_change_mtu = ip_tunnel_change_mtu, 1316 .ndo_get_stats64 = ip_tunnel_get_stats64, 1317 .ndo_get_iflink = ip_tunnel_get_iflink, 1318 .ndo_fill_metadata_dst = gre_fill_metadata_dst, 1319 }; 1320 1321 static void ipgre_tap_setup(struct net_device *dev) 1322 { 1323 ether_setup(dev); 1324 dev->max_mtu = 0; 1325 dev->netdev_ops = &gre_tap_netdev_ops; 1326 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 1327 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1328 ip_tunnel_setup(dev, gre_tap_net_id); 1329 } 1330 1331 static int ipgre_newlink(struct net *src_net, struct net_device *dev, 1332 struct nlattr *tb[], struct nlattr *data[], 1333 struct netlink_ext_ack *extack) 1334 { 1335 struct ip_tunnel_parm p; 1336 struct ip_tunnel_encap ipencap; 1337 __u32 fwmark = 0; 1338 int err; 1339 1340 if (ipgre_netlink_encap_parms(data, &ipencap)) { 1341 struct ip_tunnel *t = netdev_priv(dev); 1342 err = ip_tunnel_encap_setup(t, &ipencap); 1343 1344 if (err < 0) 1345 return err; 1346 } 1347 1348 err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark); 1349 if (err < 0) 1350 return err; 1351 return ip_tunnel_newlink(dev, tb, &p, fwmark); 1352 } 1353 1354 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[], 1355 struct nlattr *data[], 1356 struct netlink_ext_ack *extack) 1357 { 1358 struct ip_tunnel *t = netdev_priv(dev); 1359 struct ip_tunnel_encap ipencap; 1360 __u32 fwmark = t->fwmark; 1361 struct ip_tunnel_parm p; 1362 int err; 1363 1364 if (ipgre_netlink_encap_parms(data, &ipencap)) { 1365 err = ip_tunnel_encap_setup(t, &ipencap); 1366 1367 if (err < 0) 1368 return err; 1369 } 1370 1371 err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark); 1372 if (err < 0) 1373 return err; 1374 1375 err = ip_tunnel_changelink(dev, tb, &p, fwmark); 1376 if (err < 0) 1377 return err; 1378 1379 t->parms.i_flags = p.i_flags; 1380 t->parms.o_flags = p.o_flags; 1381 1382 if (strcmp(dev->rtnl_link_ops->kind, "erspan")) 1383 ipgre_link_update(dev, !tb[IFLA_MTU]); 1384 1385 return 0; 1386 } 1387 1388 static size_t ipgre_get_size(const struct net_device *dev) 1389 { 1390 return 1391 /* IFLA_GRE_LINK */ 1392 nla_total_size(4) + 1393 /* IFLA_GRE_IFLAGS */ 1394 nla_total_size(2) + 1395 /* IFLA_GRE_OFLAGS */ 1396 nla_total_size(2) + 1397 /* IFLA_GRE_IKEY */ 1398 nla_total_size(4) + 1399 /* IFLA_GRE_OKEY */ 1400 nla_total_size(4) + 1401 /* IFLA_GRE_LOCAL */ 1402 nla_total_size(4) + 1403 /* IFLA_GRE_REMOTE */ 1404 nla_total_size(4) + 1405 /* IFLA_GRE_TTL */ 1406 nla_total_size(1) + 1407 /* IFLA_GRE_TOS */ 1408 nla_total_size(1) + 1409 /* IFLA_GRE_PMTUDISC */ 1410 nla_total_size(1) + 1411 /* IFLA_GRE_ENCAP_TYPE */ 1412 nla_total_size(2) + 1413 /* IFLA_GRE_ENCAP_FLAGS */ 1414 nla_total_size(2) + 1415 /* IFLA_GRE_ENCAP_SPORT */ 1416 nla_total_size(2) + 1417 /* IFLA_GRE_ENCAP_DPORT */ 1418 nla_total_size(2) + 1419 /* IFLA_GRE_COLLECT_METADATA */ 1420 nla_total_size(0) + 1421 /* IFLA_GRE_IGNORE_DF */ 1422 nla_total_size(1) + 1423 /* IFLA_GRE_FWMARK */ 1424 nla_total_size(4) + 1425 /* IFLA_GRE_ERSPAN_INDEX */ 1426 nla_total_size(4) + 1427 /* IFLA_GRE_ERSPAN_VER */ 1428 nla_total_size(1) + 1429 /* IFLA_GRE_ERSPAN_DIR */ 1430 nla_total_size(1) + 1431 /* IFLA_GRE_ERSPAN_HWID */ 1432 nla_total_size(2) + 1433 0; 1434 } 1435 1436 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev) 1437 { 1438 struct ip_tunnel *t = netdev_priv(dev); 1439 struct ip_tunnel_parm *p = &t->parms; 1440 1441 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) || 1442 nla_put_be16(skb, IFLA_GRE_IFLAGS, 1443 gre_tnl_flags_to_gre_flags(p->i_flags)) || 1444 nla_put_be16(skb, IFLA_GRE_OFLAGS, 1445 gre_tnl_flags_to_gre_flags(p->o_flags)) || 1446 nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) || 1447 nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) || 1448 nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) || 1449 nla_put_in_addr(skb, IFLA_GRE_REMOTE, p->iph.daddr) || 1450 nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) || 1451 nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) || 1452 nla_put_u8(skb, IFLA_GRE_PMTUDISC, 1453 !!(p->iph.frag_off & htons(IP_DF))) || 1454 nla_put_u32(skb, IFLA_GRE_FWMARK, t->fwmark)) 1455 goto nla_put_failure; 1456 1457 if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE, 1458 t->encap.type) || 1459 nla_put_be16(skb, IFLA_GRE_ENCAP_SPORT, 1460 t->encap.sport) || 1461 nla_put_be16(skb, IFLA_GRE_ENCAP_DPORT, 1462 t->encap.dport) || 1463 nla_put_u16(skb, IFLA_GRE_ENCAP_FLAGS, 1464 t->encap.flags)) 1465 goto nla_put_failure; 1466 1467 if (nla_put_u8(skb, IFLA_GRE_IGNORE_DF, t->ignore_df)) 1468 goto nla_put_failure; 1469 1470 if (t->collect_md) { 1471 if (nla_put_flag(skb, IFLA_GRE_COLLECT_METADATA)) 1472 goto nla_put_failure; 1473 } 1474 1475 if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver)) 1476 goto nla_put_failure; 1477 1478 if (t->erspan_ver == 1) { 1479 if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index)) 1480 goto nla_put_failure; 1481 } else if (t->erspan_ver == 2) { 1482 if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir)) 1483 goto nla_put_failure; 1484 if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid)) 1485 goto nla_put_failure; 1486 } 1487 1488 return 0; 1489 1490 nla_put_failure: 1491 return -EMSGSIZE; 1492 } 1493 1494 static void erspan_setup(struct net_device *dev) 1495 { 1496 ether_setup(dev); 1497 dev->netdev_ops = &erspan_netdev_ops; 1498 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 1499 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1500 ip_tunnel_setup(dev, erspan_net_id); 1501 } 1502 1503 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = { 1504 [IFLA_GRE_LINK] = { .type = NLA_U32 }, 1505 [IFLA_GRE_IFLAGS] = { .type = NLA_U16 }, 1506 [IFLA_GRE_OFLAGS] = { .type = NLA_U16 }, 1507 [IFLA_GRE_IKEY] = { .type = NLA_U32 }, 1508 [IFLA_GRE_OKEY] = { .type = NLA_U32 }, 1509 [IFLA_GRE_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) }, 1510 [IFLA_GRE_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) }, 1511 [IFLA_GRE_TTL] = { .type = NLA_U8 }, 1512 [IFLA_GRE_TOS] = { .type = NLA_U8 }, 1513 [IFLA_GRE_PMTUDISC] = { .type = NLA_U8 }, 1514 [IFLA_GRE_ENCAP_TYPE] = { .type = NLA_U16 }, 1515 [IFLA_GRE_ENCAP_FLAGS] = { .type = NLA_U16 }, 1516 [IFLA_GRE_ENCAP_SPORT] = { .type = NLA_U16 }, 1517 [IFLA_GRE_ENCAP_DPORT] = { .type = NLA_U16 }, 1518 [IFLA_GRE_COLLECT_METADATA] = { .type = NLA_FLAG }, 1519 [IFLA_GRE_IGNORE_DF] = { .type = NLA_U8 }, 1520 [IFLA_GRE_FWMARK] = { .type = NLA_U32 }, 1521 [IFLA_GRE_ERSPAN_INDEX] = { .type = NLA_U32 }, 1522 [IFLA_GRE_ERSPAN_VER] = { .type = NLA_U8 }, 1523 [IFLA_GRE_ERSPAN_DIR] = { .type = NLA_U8 }, 1524 [IFLA_GRE_ERSPAN_HWID] = { .type = NLA_U16 }, 1525 }; 1526 1527 static struct rtnl_link_ops ipgre_link_ops __read_mostly = { 1528 .kind = "gre", 1529 .maxtype = IFLA_GRE_MAX, 1530 .policy = ipgre_policy, 1531 .priv_size = sizeof(struct ip_tunnel), 1532 .setup = ipgre_tunnel_setup, 1533 .validate = ipgre_tunnel_validate, 1534 .newlink = ipgre_newlink, 1535 .changelink = ipgre_changelink, 1536 .dellink = ip_tunnel_dellink, 1537 .get_size = ipgre_get_size, 1538 .fill_info = ipgre_fill_info, 1539 .get_link_net = ip_tunnel_get_link_net, 1540 }; 1541 1542 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = { 1543 .kind = "gretap", 1544 .maxtype = IFLA_GRE_MAX, 1545 .policy = ipgre_policy, 1546 .priv_size = sizeof(struct ip_tunnel), 1547 .setup = ipgre_tap_setup, 1548 .validate = ipgre_tap_validate, 1549 .newlink = ipgre_newlink, 1550 .changelink = ipgre_changelink, 1551 .dellink = ip_tunnel_dellink, 1552 .get_size = ipgre_get_size, 1553 .fill_info = ipgre_fill_info, 1554 .get_link_net = ip_tunnel_get_link_net, 1555 }; 1556 1557 static struct rtnl_link_ops erspan_link_ops __read_mostly = { 1558 .kind = "erspan", 1559 .maxtype = IFLA_GRE_MAX, 1560 .policy = ipgre_policy, 1561 .priv_size = sizeof(struct ip_tunnel), 1562 .setup = erspan_setup, 1563 .validate = erspan_validate, 1564 .newlink = ipgre_newlink, 1565 .changelink = ipgre_changelink, 1566 .dellink = ip_tunnel_dellink, 1567 .get_size = ipgre_get_size, 1568 .fill_info = ipgre_fill_info, 1569 .get_link_net = ip_tunnel_get_link_net, 1570 }; 1571 1572 struct net_device *gretap_fb_dev_create(struct net *net, const char *name, 1573 u8 name_assign_type) 1574 { 1575 struct nlattr *tb[IFLA_MAX + 1]; 1576 struct net_device *dev; 1577 LIST_HEAD(list_kill); 1578 struct ip_tunnel *t; 1579 int err; 1580 1581 memset(&tb, 0, sizeof(tb)); 1582 1583 dev = rtnl_create_link(net, name, name_assign_type, 1584 &ipgre_tap_ops, tb); 1585 if (IS_ERR(dev)) 1586 return dev; 1587 1588 /* Configure flow based GRE device. */ 1589 t = netdev_priv(dev); 1590 t->collect_md = true; 1591 1592 err = ipgre_newlink(net, dev, tb, NULL, NULL); 1593 if (err < 0) { 1594 free_netdev(dev); 1595 return ERR_PTR(err); 1596 } 1597 1598 /* openvswitch users expect packet sizes to be unrestricted, 1599 * so set the largest MTU we can. 1600 */ 1601 err = __ip_tunnel_change_mtu(dev, IP_MAX_MTU, false); 1602 if (err) 1603 goto out; 1604 1605 err = rtnl_configure_link(dev, NULL); 1606 if (err < 0) 1607 goto out; 1608 1609 return dev; 1610 out: 1611 ip_tunnel_dellink(dev, &list_kill); 1612 unregister_netdevice_many(&list_kill); 1613 return ERR_PTR(err); 1614 } 1615 EXPORT_SYMBOL_GPL(gretap_fb_dev_create); 1616 1617 static int __net_init ipgre_tap_init_net(struct net *net) 1618 { 1619 return ip_tunnel_init_net(net, gre_tap_net_id, &ipgre_tap_ops, "gretap0"); 1620 } 1621 1622 static void __net_exit ipgre_tap_exit_batch_net(struct list_head *list_net) 1623 { 1624 ip_tunnel_delete_nets(list_net, gre_tap_net_id, &ipgre_tap_ops); 1625 } 1626 1627 static struct pernet_operations ipgre_tap_net_ops = { 1628 .init = ipgre_tap_init_net, 1629 .exit_batch = ipgre_tap_exit_batch_net, 1630 .id = &gre_tap_net_id, 1631 .size = sizeof(struct ip_tunnel_net), 1632 }; 1633 1634 static int __net_init erspan_init_net(struct net *net) 1635 { 1636 return ip_tunnel_init_net(net, erspan_net_id, 1637 &erspan_link_ops, "erspan0"); 1638 } 1639 1640 static void __net_exit erspan_exit_batch_net(struct list_head *net_list) 1641 { 1642 ip_tunnel_delete_nets(net_list, erspan_net_id, &erspan_link_ops); 1643 } 1644 1645 static struct pernet_operations erspan_net_ops = { 1646 .init = erspan_init_net, 1647 .exit_batch = erspan_exit_batch_net, 1648 .id = &erspan_net_id, 1649 .size = sizeof(struct ip_tunnel_net), 1650 }; 1651 1652 static int __init ipgre_init(void) 1653 { 1654 int err; 1655 1656 pr_info("GRE over IPv4 tunneling driver\n"); 1657 1658 err = register_pernet_device(&ipgre_net_ops); 1659 if (err < 0) 1660 return err; 1661 1662 err = register_pernet_device(&ipgre_tap_net_ops); 1663 if (err < 0) 1664 goto pnet_tap_failed; 1665 1666 err = register_pernet_device(&erspan_net_ops); 1667 if (err < 0) 1668 goto pnet_erspan_failed; 1669 1670 err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO); 1671 if (err < 0) { 1672 pr_info("%s: can't add protocol\n", __func__); 1673 goto add_proto_failed; 1674 } 1675 1676 err = rtnl_link_register(&ipgre_link_ops); 1677 if (err < 0) 1678 goto rtnl_link_failed; 1679 1680 err = rtnl_link_register(&ipgre_tap_ops); 1681 if (err < 0) 1682 goto tap_ops_failed; 1683 1684 err = rtnl_link_register(&erspan_link_ops); 1685 if (err < 0) 1686 goto erspan_link_failed; 1687 1688 return 0; 1689 1690 erspan_link_failed: 1691 rtnl_link_unregister(&ipgre_tap_ops); 1692 tap_ops_failed: 1693 rtnl_link_unregister(&ipgre_link_ops); 1694 rtnl_link_failed: 1695 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO); 1696 add_proto_failed: 1697 unregister_pernet_device(&erspan_net_ops); 1698 pnet_erspan_failed: 1699 unregister_pernet_device(&ipgre_tap_net_ops); 1700 pnet_tap_failed: 1701 unregister_pernet_device(&ipgre_net_ops); 1702 return err; 1703 } 1704 1705 static void __exit ipgre_fini(void) 1706 { 1707 rtnl_link_unregister(&ipgre_tap_ops); 1708 rtnl_link_unregister(&ipgre_link_ops); 1709 rtnl_link_unregister(&erspan_link_ops); 1710 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO); 1711 unregister_pernet_device(&ipgre_tap_net_ops); 1712 unregister_pernet_device(&ipgre_net_ops); 1713 unregister_pernet_device(&erspan_net_ops); 1714 } 1715 1716 module_init(ipgre_init); 1717 module_exit(ipgre_fini); 1718 MODULE_LICENSE("GPL"); 1719 MODULE_ALIAS_RTNL_LINK("gre"); 1720 MODULE_ALIAS_RTNL_LINK("gretap"); 1721 MODULE_ALIAS_RTNL_LINK("erspan"); 1722 MODULE_ALIAS_NETDEV("gre0"); 1723 MODULE_ALIAS_NETDEV("gretap0"); 1724 MODULE_ALIAS_NETDEV("erspan0"); 1725