ip6_tunnel.c 37.0 KB
Newer Older
L
Linus Torvalds 已提交
1
/*
2
 *	IPv6 tunneling device
L
Linus Torvalds 已提交
3 4 5
 *	Linux INET6 implementation
 *
 *	Authors:
6
 *	Ville Nuorvala		<vnuorval@tcs.hut.fi>
7
 *	Yasuyuki Kozakai	<kozakai@linux-ipv6.org>
L
Linus Torvalds 已提交
8 9
 *
 *      Based on:
10
 *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
L
Linus Torvalds 已提交
11 12 13 14 15 16 17 18 19 20 21
 *
 *      RFC 2473
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 */

#include <linux/module.h>
22
#include <linux/capability.h>
L
Linus Torvalds 已提交
23 24 25
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/sockios.h>
26
#include <linux/icmp.h>
L
Linus Torvalds 已提交
27 28 29 30 31 32 33 34 35 36 37 38 39
#include <linux/if.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/if_tunnel.h>
#include <linux/net.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/icmpv6.h>
#include <linux/init.h>
#include <linux/route.h>
#include <linux/rtnetlink.h>
#include <linux/netfilter_ipv6.h>
40
#include <linux/slab.h>
L
Linus Torvalds 已提交
41 42

#include <asm/uaccess.h>
A
Arun Sharma 已提交
43
#include <linux/atomic.h>
L
Linus Torvalds 已提交
44

45
#include <net/icmp.h>
L
Linus Torvalds 已提交
46 47 48 49 50 51 52 53
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/ip6_tunnel.h>
#include <net/xfrm.h>
#include <net/dsfield.h>
#include <net/inet_ecn.h>
54 55
#include <net/net_namespace.h>
#include <net/netns/generic.h>
L
Linus Torvalds 已提交
56 57

MODULE_AUTHOR("Ville Nuorvala");
58
MODULE_DESCRIPTION("IPv6 tunneling device");
L
Linus Torvalds 已提交
59
MODULE_LICENSE("GPL");
S
stephen hemminger 已提交
60
MODULE_ALIAS_NETDEV("ip6tnl0");
L
Linus Torvalds 已提交
61 62

#ifdef IP6_TNL_DEBUG
63
#define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
L
Linus Torvalds 已提交
64 65 66 67 68
#else
#define IP6_TNL_TRACE(x...) do {;} while(0)
#endif

#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
69
#define IPV6_TCLASS_SHIFT 20
L
Linus Torvalds 已提交
70 71 72

#define HASH_SIZE  32

A
Al Viro 已提交
73
#define HASH(addr) ((__force u32)((addr)->s6_addr32[0] ^ (addr)->s6_addr32[1] ^ \
74 75
		     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
		    (HASH_SIZE - 1))
L
Linus Torvalds 已提交
76

E
Eric Dumazet 已提交
77
static int ip6_tnl_dev_init(struct net_device *dev);
78
static void ip6_tnl_dev_setup(struct net_device *dev);
L
Linus Torvalds 已提交
79

80
static int ip6_tnl_net_id __read_mostly;
81
struct ip6_tnl_net {
82 83
	/* the IPv6 tunnel fallback device */
	struct net_device *fb_tnl_dev;
84
	/* lists for storing tunnels in use */
E
Eric Dumazet 已提交
85 86 87
	struct ip6_tnl __rcu *tnls_r_l[HASH_SIZE];
	struct ip6_tnl __rcu *tnls_wc[1];
	struct ip6_tnl __rcu **tnls[2];
88 89
};

E
Eric Dumazet 已提交
90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117
/* often modified stats are per cpu, other are shared (netdev->stats) */
struct pcpu_tstats {
	unsigned long	rx_packets;
	unsigned long	rx_bytes;
	unsigned long	tx_packets;
	unsigned long	tx_bytes;
};

static struct net_device_stats *ip6_get_stats(struct net_device *dev)
{
	struct pcpu_tstats sum = { 0 };
	int i;

	for_each_possible_cpu(i) {
		const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);

		sum.rx_packets += tstats->rx_packets;
		sum.rx_bytes   += tstats->rx_bytes;
		sum.tx_packets += tstats->tx_packets;
		sum.tx_bytes   += tstats->tx_bytes;
	}
	dev->stats.rx_packets = sum.rx_packets;
	dev->stats.rx_bytes   = sum.rx_bytes;
	dev->stats.tx_packets = sum.tx_packets;
	dev->stats.tx_bytes   = sum.tx_bytes;
	return &dev->stats;
}

118
/*
E
Eric Dumazet 已提交
119
 * Locking : hash tables are protected by RCU and RTNL
120
 */
L
Linus Torvalds 已提交
121 122 123 124 125

static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
{
	struct dst_entry *dst = t->dst_cache;

126
	if (dst && dst->obsolete &&
L
Linus Torvalds 已提交
127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150
	    dst->ops->check(dst, t->dst_cookie) == NULL) {
		t->dst_cache = NULL;
		dst_release(dst);
		return NULL;
	}

	return dst;
}

static inline void ip6_tnl_dst_reset(struct ip6_tnl *t)
{
	dst_release(t->dst_cache);
	t->dst_cache = NULL;
}

static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
{
	struct rt6_info *rt = (struct rt6_info *) dst;
	t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
	dst_release(t->dst_cache);
	t->dst_cache = dst;
}

/**
151
 * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
152 153
 *   @remote: the address of the tunnel exit-point
 *   @local: the address of the tunnel entry-point
L
Linus Torvalds 已提交
154
 *
155
 * Return:
L
Linus Torvalds 已提交
156
 *   tunnel matching given end-points if found,
157
 *   else fallback tunnel if its device is up,
L
Linus Torvalds 已提交
158 159 160
 *   else %NULL
 **/

161 162 163
#define for_each_ip6_tunnel_rcu(start) \
	for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))

L
Linus Torvalds 已提交
164
static struct ip6_tnl *
165
ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
L
Linus Torvalds 已提交
166
{
E
Eric Dumazet 已提交
167 168
	unsigned int h0 = HASH(remote);
	unsigned int h1 = HASH(local);
L
Linus Torvalds 已提交
169
	struct ip6_tnl *t;
170
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
171

172
	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[h0 ^ h1]) {
L
Linus Torvalds 已提交
173 174 175 176 177
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
		    ipv6_addr_equal(remote, &t->parms.raddr) &&
		    (t->dev->flags & IFF_UP))
			return t;
	}
178 179
	t = rcu_dereference(ip6n->tnls_wc[0]);
	if (t && (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
180 181 182 183 184 185
		return t;

	return NULL;
}

/**
186
 * ip6_tnl_bucket - get head of list matching given tunnel parameters
187
 *   @p: parameters containing tunnel end-points
L
Linus Torvalds 已提交
188 189
 *
 * Description:
190
 *   ip6_tnl_bucket() returns the head of the list matching the
L
Linus Torvalds 已提交
191 192
 *   &struct in6_addr entries laddr and raddr in @p.
 *
193
 * Return: head of IPv6 tunnel list
L
Linus Torvalds 已提交
194 195
 **/

E
Eric Dumazet 已提交
196
static struct ip6_tnl __rcu **
197
ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
198
{
199 200
	const struct in6_addr *remote = &p->raddr;
	const struct in6_addr *local = &p->laddr;
L
Linus Torvalds 已提交
201 202 203 204 205 206 207
	unsigned h = 0;
	int prio = 0;

	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
		prio = 1;
		h = HASH(remote) ^ HASH(local);
	}
208
	return &ip6n->tnls[prio][h];
L
Linus Torvalds 已提交
209 210 211
}

/**
212
 * ip6_tnl_link - add tunnel to hash table
L
Linus Torvalds 已提交
213 214 215 216
 *   @t: tunnel to be added
 **/

static void
217
ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
218
{
E
Eric Dumazet 已提交
219
	struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
L
Linus Torvalds 已提交
220

221 222
	RCU_INIT_POINTER(t->next , rtnl_dereference(*tp));
	RCU_INIT_POINTER(*tp, t);
L
Linus Torvalds 已提交
223 224 225
}

/**
226
 * ip6_tnl_unlink - remove tunnel from hash table
L
Linus Torvalds 已提交
227 228 229 230
 *   @t: tunnel to be removed
 **/

static void
231
ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
232
{
E
Eric Dumazet 已提交
233 234 235 236 237 238 239
	struct ip6_tnl __rcu **tp;
	struct ip6_tnl *iter;

	for (tp = ip6_tnl_bucket(ip6n, &t->parms);
	     (iter = rtnl_dereference(*tp)) != NULL;
	     tp = &iter->next) {
		if (t == iter) {
240
			RCU_INIT_POINTER(*tp, t->next);
L
Linus Torvalds 已提交
241 242 243 244 245
			break;
		}
	}
}

E
Eric Dumazet 已提交
246 247 248 249 250 251
static void ip6_dev_free(struct net_device *dev)
{
	free_percpu(dev->tstats);
	free_netdev(dev);
}

L
Linus Torvalds 已提交
252 253 254 255 256 257 258
/**
 * ip6_tnl_create() - create a new tunnel
 *   @p: tunnel parameters
 *   @pt: pointer to new tunnel
 *
 * Description:
 *   Create tunnel matching given parameters.
259 260
 *
 * Return:
261
 *   created tunnel or NULL
L
Linus Torvalds 已提交
262 263
 **/

264
static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
265 266 267 268 269
{
	struct net_device *dev;
	struct ip6_tnl *t;
	char name[IFNAMSIZ];
	int err;
270
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
271

272
	if (p->name[0])
L
Linus Torvalds 已提交
273
		strlcpy(name, p->name, IFNAMSIZ);
274 275 276
	else
		sprintf(name, "ip6tnl%%d");

277
	dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup);
L
Linus Torvalds 已提交
278
	if (dev == NULL)
279
		goto failed;
L
Linus Torvalds 已提交
280

281 282
	dev_net_set(dev, net);

283
	t = netdev_priv(dev);
L
Linus Torvalds 已提交
284
	t->parms = *p;
E
Eric Dumazet 已提交
285 286 287
	err = ip6_tnl_dev_init(dev);
	if (err < 0)
		goto failed_free;
L
Linus Torvalds 已提交
288

289 290 291
	if ((err = register_netdevice(dev)) < 0)
		goto failed_free;

L
Linus Torvalds 已提交
292
	dev_hold(dev);
293
	ip6_tnl_link(ip6n, t);
294
	return t;
295 296

failed_free:
E
Eric Dumazet 已提交
297
	ip6_dev_free(dev);
298 299
failed:
	return NULL;
L
Linus Torvalds 已提交
300 301 302
}

/**
303
 * ip6_tnl_locate - find or create tunnel matching given parameters
304
 *   @p: tunnel parameters
L
Linus Torvalds 已提交
305 306 307
 *   @create: != 0 if allowed to create new tunnel if no match found
 *
 * Description:
308
 *   ip6_tnl_locate() first tries to locate an existing tunnel
L
Linus Torvalds 已提交
309 310 311 312
 *   based on @parms. If this is unsuccessful, but @create is set a new
 *   tunnel device is created and registered for use.
 *
 * Return:
313
 *   matching tunnel or NULL
L
Linus Torvalds 已提交
314 315
 **/

316 317
static struct ip6_tnl *ip6_tnl_locate(struct net *net,
		struct ip6_tnl_parm *p, int create)
L
Linus Torvalds 已提交
318
{
319 320
	const struct in6_addr *remote = &p->raddr;
	const struct in6_addr *local = &p->laddr;
E
Eric Dumazet 已提交
321
	struct ip6_tnl __rcu **tp;
L
Linus Torvalds 已提交
322
	struct ip6_tnl *t;
323
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
324

E
Eric Dumazet 已提交
325 326 327
	for (tp = ip6_tnl_bucket(ip6n, p);
	     (t = rtnl_dereference(*tp)) != NULL;
	     tp = &t->next) {
L
Linus Torvalds 已提交
328
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
329 330
		    ipv6_addr_equal(remote, &t->parms.raddr))
			return t;
L
Linus Torvalds 已提交
331 332
	}
	if (!create)
333
		return NULL;
334
	return ip6_tnl_create(net, p);
L
Linus Torvalds 已提交
335 336 337
}

/**
338
 * ip6_tnl_dev_uninit - tunnel device uninitializer
L
Linus Torvalds 已提交
339
 *   @dev: the device to be destroyed
340
 *
L
Linus Torvalds 已提交
341
 * Description:
342
 *   ip6_tnl_dev_uninit() removes tunnel from its list
L
Linus Torvalds 已提交
343 344 345
 **/

static void
346
ip6_tnl_dev_uninit(struct net_device *dev)
L
Linus Torvalds 已提交
347
{
348
	struct ip6_tnl *t = netdev_priv(dev);
349 350
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
351

E
Eric Dumazet 已提交
352
	if (dev == ip6n->fb_tnl_dev)
353
		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
E
Eric Dumazet 已提交
354
	else
355
		ip6_tnl_unlink(ip6n, t);
L
Linus Torvalds 已提交
356 357 358 359 360 361 362 363
	ip6_tnl_dst_reset(t);
	dev_put(dev);
}

/**
 * parse_tvl_tnl_enc_lim - handle encapsulation limit option
 *   @skb: received socket buffer
 *
364 365
 * Return:
 *   0 if none was found,
L
Linus Torvalds 已提交
366 367 368 369 370 371
 *   else index to encapsulation limit
 **/

static __u16
parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
{
372
	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
L
Linus Torvalds 已提交
373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421
	__u8 nexthdr = ipv6h->nexthdr;
	__u16 off = sizeof (*ipv6h);

	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
		__u16 optlen = 0;
		struct ipv6_opt_hdr *hdr;
		if (raw + off + sizeof (*hdr) > skb->data &&
		    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
			break;

		hdr = (struct ipv6_opt_hdr *) (raw + off);
		if (nexthdr == NEXTHDR_FRAGMENT) {
			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
			if (frag_hdr->frag_off)
				break;
			optlen = 8;
		} else if (nexthdr == NEXTHDR_AUTH) {
			optlen = (hdr->hdrlen + 2) << 2;
		} else {
			optlen = ipv6_optlen(hdr);
		}
		if (nexthdr == NEXTHDR_DEST) {
			__u16 i = off + 2;
			while (1) {
				struct ipv6_tlv_tnl_enc_lim *tel;

				/* No more room for encapsulation limit */
				if (i + sizeof (*tel) > off + optlen)
					break;

				tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
				/* return index of option if found and valid */
				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
				    tel->length == 1)
					return i;
				/* else jump to next option */
				if (tel->type)
					i += tel->length + 2;
				else
					i++;
			}
		}
		nexthdr = hdr->nexthdr;
		off += optlen;
	}
	return 0;
}

/**
422
 * ip6_tnl_err - tunnel error handler
L
Linus Torvalds 已提交
423 424
 *
 * Description:
425
 *   ip6_tnl_err() should handle errors in the tunnel according
L
Linus Torvalds 已提交
426 427 428
 *   to the specifications in RFC 2473.
 **/

H
Herbert Xu 已提交
429
static int
430
ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
431
	    u8 *type, u8 *code, int *msg, __u32 *info, int offset)
L
Linus Torvalds 已提交
432
{
433
	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) skb->data;
L
Linus Torvalds 已提交
434 435
	struct ip6_tnl *t;
	int rel_msg = 0;
436 437
	u8 rel_type = ICMPV6_DEST_UNREACH;
	u8 rel_code = ICMPV6_ADDR_UNREACH;
L
Linus Torvalds 已提交
438 439
	__u32 rel_info = 0;
	__u16 len;
H
Herbert Xu 已提交
440
	int err = -ENOENT;
L
Linus Torvalds 已提交
441

442 443
	/* If the packet doesn't contain the original IPv6 header we are
	   in trouble since we might need the source address for further
L
Linus Torvalds 已提交
444 445
	   processing of the error. */

446
	rcu_read_lock();
447
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
448
					&ipv6h->saddr)) == NULL)
L
Linus Torvalds 已提交
449 450
		goto out;

451 452 453
	if (t->parms.proto != ipproto && t->parms.proto != 0)
		goto out;

H
Herbert Xu 已提交
454 455
	err = 0;

456
	switch (*type) {
L
Linus Torvalds 已提交
457 458 459 460 461 462 463 464 465 466 467
		__u32 teli;
		struct ipv6_tlv_tnl_enc_lim *tel;
		__u32 mtu;
	case ICMPV6_DEST_UNREACH:
		if (net_ratelimit())
			printk(KERN_WARNING
			       "%s: Path to destination invalid "
			       "or inactive!\n", t->parms.name);
		rel_msg = 1;
		break;
	case ICMPV6_TIME_EXCEED:
468
		if ((*code) == ICMPV6_EXC_HOPLIMIT) {
L
Linus Torvalds 已提交
469 470 471
			if (net_ratelimit())
				printk(KERN_WARNING
				       "%s: Too small hop limit or "
472
				       "routing loop in tunnel!\n",
L
Linus Torvalds 已提交
473 474 475 476 477
				       t->parms.name);
			rel_msg = 1;
		}
		break;
	case ICMPV6_PARAMPROB:
478
		teli = 0;
479
		if ((*code) == ICMPV6_HDR_FIELD)
480
			teli = parse_tlv_tnl_enc_lim(skb, skb->data);
L
Linus Torvalds 已提交
481

A
Al Viro 已提交
482
		if (teli && teli == *info - 2) {
L
Linus Torvalds 已提交
483 484 485 486 487 488 489 490 491
			tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
			if (tel->encap_limit == 0) {
				if (net_ratelimit())
					printk(KERN_WARNING
					       "%s: Too small encapsulation "
					       "limit or routing loop in "
					       "tunnel!\n", t->parms.name);
				rel_msg = 1;
			}
492 493 494 495
		} else if (net_ratelimit()) {
			printk(KERN_WARNING
			       "%s: Recipient unable to parse tunneled "
			       "packet!\n ", t->parms.name);
L
Linus Torvalds 已提交
496 497 498
		}
		break;
	case ICMPV6_PKT_TOOBIG:
A
Al Viro 已提交
499
		mtu = *info - offset;
L
Linus Torvalds 已提交
500 501 502 503
		if (mtu < IPV6_MIN_MTU)
			mtu = IPV6_MIN_MTU;
		t->dev->mtu = mtu;

A
Al Viro 已提交
504
		if ((len = sizeof (*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
L
Linus Torvalds 已提交
505 506 507 508 509 510 511
			rel_type = ICMPV6_PKT_TOOBIG;
			rel_code = 0;
			rel_info = mtu;
			rel_msg = 1;
		}
		break;
	}
512 513 514 515 516 517 518

	*type = rel_type;
	*code = rel_code;
	*info = rel_info;
	*msg = rel_msg;

out:
519
	rcu_read_unlock();
520 521 522
	return err;
}

523 524
static int
ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
525
	   u8 type, u8 code, int offset, __be32 info)
526 527
{
	int rel_msg = 0;
528 529
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
530
	__u32 rel_info = ntohl(info);
531 532
	int err;
	struct sk_buff *skb2;
533
	const struct iphdr *eiph;
534
	struct rtable *rt;
535
	struct flowi4 fl4;
536

537 538
	err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568
	if (err < 0)
		return err;

	if (rel_msg == 0)
		return 0;

	switch (rel_type) {
	case ICMPV6_DEST_UNREACH:
		if (rel_code != ICMPV6_ADDR_UNREACH)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_HOST_UNREACH;
		break;
	case ICMPV6_PKT_TOOBIG:
		if (rel_code != 0)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_FRAG_NEEDED;
		break;
	default:
		return 0;
	}

	if (!pskb_may_pull(skb, offset + sizeof(struct iphdr)))
		return 0;

	skb2 = skb_clone(skb, GFP_ATOMIC);
	if (!skb2)
		return 0;

E
Eric Dumazet 已提交
569 570
	skb_dst_drop(skb2);

571
	skb_pull(skb2, offset);
572
	skb_reset_network_header(skb2);
573
	eiph = ip_hdr(skb2);
574 575

	/* Try to guess incoming interface */
576
	rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
577 578 579
				   eiph->saddr, 0,
				   0, 0,
				   IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
580
	if (IS_ERR(rt))
581 582
		goto out;

583
	skb2->dev = rt->dst.dev;
584 585 586 587 588

	/* route "incoming" packet */
	if (rt->rt_flags & RTCF_LOCAL) {
		ip_rt_put(rt);
		rt = NULL;
589
		rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
590 591 592 593
					   eiph->daddr, eiph->saddr,
					   0, 0,
					   IPPROTO_IPIP,
					   RT_TOS(eiph->tos), 0);
594
		if (IS_ERR(rt) ||
595
		    rt->dst.dev->type != ARPHRD_TUNNEL) {
596 597
			if (!IS_ERR(rt))
				ip_rt_put(rt);
598 599
			goto out;
		}
600
		skb_dst_set(skb2, &rt->dst);
601 602 603 604
	} else {
		ip_rt_put(rt);
		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
				   skb2->dev) ||
E
Eric Dumazet 已提交
605
		    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
606 607 608 609 610
			goto out;
	}

	/* change mtu on this route */
	if (rel_type == ICMP_DEST_UNREACH && rel_code == ICMP_FRAG_NEEDED) {
E
Eric Dumazet 已提交
611
		if (rel_info > dst_mtu(skb_dst(skb2)))
612 613
			goto out;

E
Eric Dumazet 已提交
614
		skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), rel_info);
615 616
	}

A
Al Viro 已提交
617
	icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
618 619 620 621 622 623

out:
	kfree_skb(skb2);
	return 0;
}

624 625
static int
ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
626
	   u8 type, u8 code, int offset, __be32 info)
627 628
{
	int rel_msg = 0;
629 630
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
631
	__u32 rel_info = ntohl(info);
632 633
	int err;

634 635
	err = ip6_tnl_err(skb, IPPROTO_IPV6, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
636 637 638 639
	if (err < 0)
		return err;

	if (rel_msg && pskb_may_pull(skb, offset + sizeof(struct ipv6hdr))) {
L
Linus Torvalds 已提交
640 641
		struct rt6_info *rt;
		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
642

L
Linus Torvalds 已提交
643
		if (!skb2)
644
			return 0;
L
Linus Torvalds 已提交
645

E
Eric Dumazet 已提交
646
		skb_dst_drop(skb2);
L
Linus Torvalds 已提交
647
		skb_pull(skb2, offset);
648
		skb_reset_network_header(skb2);
L
Linus Torvalds 已提交
649 650

		/* Try to guess incoming interface */
651 652
		rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr,
				NULL, 0, 0);
L
Linus Torvalds 已提交
653 654 655 656

		if (rt && rt->rt6i_dev)
			skb2->dev = rt->rt6i_dev;

657
		icmpv6_send(skb2, rel_type, rel_code, rel_info);
L
Linus Torvalds 已提交
658 659

		if (rt)
660
			dst_release(&rt->dst);
L
Linus Torvalds 已提交
661 662 663

		kfree_skb(skb2);
	}
664 665

	return 0;
L
Linus Torvalds 已提交
666 667
}

668 669
static void ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
					const struct ipv6hdr *ipv6h,
670 671 672 673 674
					struct sk_buff *skb)
{
	__u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;

	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
675
		ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
676 677

	if (INET_ECN_is_ce(dsfield))
678
		IP_ECN_set_ce(ip_hdr(skb));
679 680
}

681 682
static void ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
					const struct ipv6hdr *ipv6h,
683
					struct sk_buff *skb)
L
Linus Torvalds 已提交
684
{
685
	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
686
		ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
L
Linus Torvalds 已提交
687

688
	if (INET_ECN_is_ce(ipv6_get_dsfield(ipv6h)))
689
		IP6_ECN_set_ce(ipv6_hdr(skb));
L
Linus Torvalds 已提交
690
}
691

E
Eric Dumazet 已提交
692
/* called with rcu_read_lock() */
693 694 695 696
static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
	int ret = 0;
697
	struct net *net = dev_net(t->dev);
698 699

	if (p->flags & IP6_TNL_F_CAP_RCV) {
700
		struct net_device *ldev = NULL;
701 702

		if (p->link)
E
Eric Dumazet 已提交
703
			ldev = dev_get_by_index_rcu(net, p->link);
704 705

		if ((ipv6_addr_is_multicast(&p->laddr) ||
706 707
		     likely(ipv6_chk_addr(net, &p->laddr, ldev, 0))) &&
		    likely(!ipv6_chk_addr(net, &p->raddr, NULL, 0)))
708 709 710 711 712
			ret = 1;

	}
	return ret;
}
L
Linus Torvalds 已提交
713 714

/**
715
 * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
L
Linus Torvalds 已提交
716
 *   @skb: received socket buffer
717 718
 *   @protocol: ethernet protocol ID
 *   @dscp_ecn_decapsulate: the function to decapsulate DSCP code and ECN
L
Linus Torvalds 已提交
719 720 721 722
 *
 * Return: 0
 **/

723
static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
724
		       __u8 ipproto,
725 726
		       void (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
						    const struct ipv6hdr *ipv6h,
727
						    struct sk_buff *skb))
L
Linus Torvalds 已提交
728 729
{
	struct ip6_tnl *t;
730
	const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
L
Linus Torvalds 已提交
731

732
	rcu_read_lock();
L
Linus Torvalds 已提交
733

734
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
735
					&ipv6h->daddr)) != NULL) {
E
Eric Dumazet 已提交
736 737
		struct pcpu_tstats *tstats;

738
		if (t->parms.proto != ipproto && t->parms.proto != 0) {
739
			rcu_read_unlock();
740 741 742
			goto discard;
		}

L
Linus Torvalds 已提交
743
		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
744
			rcu_read_unlock();
745
			goto discard;
L
Linus Torvalds 已提交
746 747
		}

748
		if (!ip6_tnl_rcv_ctl(t)) {
749
			t->dev->stats.rx_dropped++;
750
			rcu_read_unlock();
L
Linus Torvalds 已提交
751 752 753
			goto discard;
		}
		secpath_reset(skb);
754
		skb->mac_header = skb->network_header;
755
		skb_reset_network_header(skb);
756
		skb->protocol = htons(protocol);
L
Linus Torvalds 已提交
757 758
		skb->pkt_type = PACKET_HOST;
		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
759

E
Eric Dumazet 已提交
760 761 762 763 764
		tstats = this_cpu_ptr(t->dev->tstats);
		tstats->rx_packets++;
		tstats->rx_bytes += skb->len;

		__skb_tunnel_rx(skb, t->dev);
765

766
		dscp_ecn_decapsulate(t, ipv6h, skb);
E
Eric Dumazet 已提交
767

768
		netif_rx(skb);
E
Eric Dumazet 已提交
769

770
		rcu_read_unlock();
L
Linus Torvalds 已提交
771 772
		return 0;
	}
773
	rcu_read_unlock();
L
Linus Torvalds 已提交
774
	return 1;
775 776 777 778

discard:
	kfree_skb(skb);
	return 0;
L
Linus Torvalds 已提交
779 780
}

781 782
static int ip4ip6_rcv(struct sk_buff *skb)
{
783 784
	return ip6_tnl_rcv(skb, ETH_P_IP, IPPROTO_IPIP,
			   ip4ip6_dscp_ecn_decapsulate);
785 786
}

787 788
static int ip6ip6_rcv(struct sk_buff *skb)
{
789 790
	return ip6_tnl_rcv(skb, ETH_P_IPV6, IPPROTO_IPV6,
			   ip6ip6_dscp_ecn_decapsulate);
791 792
}

793 794 795 796
struct ipv6_tel_txoption {
	struct ipv6_txoptions ops;
	__u8 dst_opt[8];
};
L
Linus Torvalds 已提交
797

798 799 800
static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
{
	memset(opt, 0, sizeof(struct ipv6_tel_txoption));
L
Linus Torvalds 已提交
801

802 803 804 805 806
	opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
	opt->dst_opt[3] = 1;
	opt->dst_opt[4] = encap_limit;
	opt->dst_opt[5] = IPV6_TLV_PADN;
	opt->dst_opt[6] = 1;
L
Linus Torvalds 已提交
807

808 809
	opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
	opt->ops.opt_nflen = 8;
L
Linus Torvalds 已提交
810 811 812
}

/**
813
 * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
L
Linus Torvalds 已提交
814
 *   @t: the outgoing tunnel device
815
 *   @hdr: IPv6 header from the incoming packet
L
Linus Torvalds 已提交
816 817
 *
 * Description:
818
 *   Avoid trivial tunneling loop by checking that tunnel exit-point
L
Linus Torvalds 已提交
819 820
 *   doesn't match source of incoming packet.
 *
821
 * Return:
L
Linus Torvalds 已提交
822 823 824 825 826
 *   1 if conflict,
 *   0 else
 **/

static inline int
827
ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
L
Linus Torvalds 已提交
828 829 830 831
{
	return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
}

832 833 834 835
static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
	int ret = 0;
836
	struct net *net = dev_net(t->dev);
837

838
	if (p->flags & IP6_TNL_F_CAP_XMIT) {
839 840
		struct net_device *ldev = NULL;

E
Eric Dumazet 已提交
841
		rcu_read_lock();
842
		if (p->link)
E
Eric Dumazet 已提交
843
			ldev = dev_get_by_index_rcu(net, p->link);
844

845
		if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
846 847 848 849
			printk(KERN_WARNING
			       "%s xmit: Local address not yet configured!\n",
			       p->name);
		else if (!ipv6_addr_is_multicast(&p->raddr) &&
850
			 unlikely(ipv6_chk_addr(net, &p->raddr, NULL, 0)))
851 852 853 854 855 856
			printk(KERN_WARNING
			       "%s xmit: Routing loop! "
			       "Remote address found on this node!\n",
			       p->name);
		else
			ret = 1;
E
Eric Dumazet 已提交
857
		rcu_read_unlock();
858 859 860
	}
	return ret;
}
L
Linus Torvalds 已提交
861
/**
862
 * ip6_tnl_xmit2 - encapsulate packet and send
L
Linus Torvalds 已提交
863
 *   @skb: the outgoing socket buffer
864
 *   @dev: the outgoing tunnel device
865 866 867 868
 *   @dsfield: dscp code for outer header
 *   @fl: flow of tunneled packet
 *   @encap_limit: encapsulation limit
 *   @pmtu: Path MTU is stored if packet is too big
L
Linus Torvalds 已提交
869 870 871 872 873
 *
 * Description:
 *   Build new header and do some sanity checks on the packet before sending
 *   it.
 *
874
 * Return:
875
 *   0 on success
876 877
 *   -1 fail
 *   %-EMSGSIZE message too big. return mtu in this case.
L
Linus Torvalds 已提交
878 879
 **/

880 881 882
static int ip6_tnl_xmit2(struct sk_buff *skb,
			 struct net_device *dev,
			 __u8 dsfield,
883
			 struct flowi6 *fl6,
884 885
			 int encap_limit,
			 __u32 *pmtu)
L
Linus Torvalds 已提交
886
{
A
Alexey Dobriyan 已提交
887
	struct net *net = dev_net(dev);
888
	struct ip6_tnl *t = netdev_priv(dev);
889
	struct net_device_stats *stats = &t->dev->stats;
890
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
891
	struct ipv6_tel_txoption opt;
892
	struct dst_entry *dst = NULL, *ndst = NULL;
L
Linus Torvalds 已提交
893 894
	struct net_device *tdev;
	int mtu;
895
	unsigned int max_headroom = sizeof(struct ipv6hdr);
L
Linus Torvalds 已提交
896
	u8 proto;
897
	int err = -1;
L
Linus Torvalds 已提交
898 899
	int pkt_len;

900 901
	if (!fl6->flowi6_mark)
		dst = ip6_tnl_dst_check(t);
902 903
	if (!dst) {
		ndst = ip6_route_output(net, NULL, fl6);
L
Linus Torvalds 已提交
904

905
		if (ndst->error)
906
			goto tx_err_link_failure;
907 908 909 910
		ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
		if (IS_ERR(ndst)) {
			err = PTR_ERR(ndst);
			ndst = NULL;
911 912
			goto tx_err_link_failure;
		}
913
		dst = ndst;
914
	}
L
Linus Torvalds 已提交
915 916 917 918 919 920

	tdev = dst->dev;

	if (tdev == dev) {
		stats->collisions++;
		if (net_ratelimit())
921
			printk(KERN_WARNING
L
Linus Torvalds 已提交
922 923 924 925 926
			       "%s: Local routing loop detected!\n",
			       t->parms.name);
		goto tx_err_dst_release;
	}
	mtu = dst_mtu(dst) - sizeof (*ipv6h);
927
	if (encap_limit >= 0) {
L
Linus Torvalds 已提交
928 929 930 931 932
		max_headroom += 8;
		mtu -= 8;
	}
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;
E
Eric Dumazet 已提交
933 934
	if (skb_dst(skb))
		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
L
Linus Torvalds 已提交
935
	if (skb->len > mtu) {
936 937
		*pmtu = mtu;
		err = -EMSGSIZE;
L
Linus Torvalds 已提交
938 939 940 941 942 943 944
		goto tx_err_dst_release;
	}

	/*
	 * Okay, now see if we can stuff it in the buffer as-is.
	 */
	max_headroom += LL_RESERVED_SPACE(tdev);
945

946 947
	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
L
Linus Torvalds 已提交
948
		struct sk_buff *new_skb;
949

L
Linus Torvalds 已提交
950 951 952 953 954 955 956 957
		if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
			goto tx_err_dst_release;

		if (skb->sk)
			skb_set_owner_w(new_skb, skb->sk);
		kfree_skb(skb);
		skb = new_skb;
	}
E
Eric Dumazet 已提交
958
	skb_dst_drop(skb);
959 960 961 962 963 964
	if (fl6->flowi6_mark) {
		skb_dst_set(skb, dst);
		ndst = NULL;
	} else {
		skb_dst_set_noref(skb, dst);
	}
965
	skb->transport_header = skb->network_header;
L
Linus Torvalds 已提交
966

967
	proto = fl6->flowi6_proto;
968 969 970 971
	if (encap_limit >= 0) {
		init_tel_txopt(&opt, encap_limit);
		ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
	}
972 973
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
974
	ipv6h = ipv6_hdr(skb);
975
	*(__be32*)ipv6h = fl6->flowlabel | htonl(0x60000000);
L
Linus Torvalds 已提交
976 977 978 979
	dsfield = INET_ECN_encapsulate(0, dsfield);
	ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
	ipv6h->hop_limit = t->parms.hop_limit;
	ipv6h->nexthdr = proto;
980 981
	ipv6_addr_copy(&ipv6h->saddr, &fl6->saddr);
	ipv6_addr_copy(&ipv6h->daddr, &fl6->daddr);
L
Linus Torvalds 已提交
982 983
	nf_reset(skb);
	pkt_len = skb->len;
H
Herbert Xu 已提交
984
	err = ip6_local_out(skb);
L
Linus Torvalds 已提交
985

986
	if (net_xmit_eval(err) == 0) {
E
Eric Dumazet 已提交
987 988 989 990
		struct pcpu_tstats *tstats = this_cpu_ptr(t->dev->tstats);

		tstats->tx_bytes += pkt_len;
		tstats->tx_packets++;
L
Linus Torvalds 已提交
991 992 993 994
	} else {
		stats->tx_errors++;
		stats->tx_aborted_errors++;
	}
995 996
	if (ndst)
		ip6_tnl_dst_store(t, ndst);
L
Linus Torvalds 已提交
997 998 999 1000 1001
	return 0;
tx_err_link_failure:
	stats->tx_carrier_errors++;
	dst_link_failure(skb);
tx_err_dst_release:
1002
	dst_release(ndst);
1003 1004 1005
	return err;
}

1006 1007 1008 1009
static inline int
ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1010
	const struct iphdr  *iph = ip_hdr(skb);
1011
	int encap_limit = -1;
1012
	struct flowi6 fl6;
1013 1014 1015 1016
	__u8 dsfield;
	__u32 mtu;
	int err;

1017 1018
	if ((t->parms.proto != IPPROTO_IPIP && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t))
1019 1020 1021 1022 1023
		return -1;

	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

1024 1025
	memcpy(&fl6, &t->fl.u.ip6, sizeof (fl6));
	fl6.flowi6_proto = IPPROTO_IPIP;
1026 1027 1028

	dsfield = ipv4_get_dsfield(iph);

1029
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1030
		fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
A
Al Viro 已提交
1031
					  & IPV6_TCLASS_MASK;
1032 1033
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
		fl6.flowi6_mark = skb->mark;
1034

1035
	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046
	if (err != 0) {
		/* XXX: send ICMP error even if DF is not set. */
		if (err == -EMSGSIZE)
			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
				  htonl(mtu));
		return -1;
	}

	return 0;
}

1047 1048 1049 1050
static inline int
ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1051
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
1052 1053
	int encap_limit = -1;
	__u16 offset;
1054
	struct flowi6 fl6;
1055 1056 1057 1058
	__u8 dsfield;
	__u32 mtu;
	int err;

1059 1060
	if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
1061 1062
		return -1;

1063 1064
	offset = parse_tlv_tnl_enc_lim(skb, skb_network_header(skb));
	if (offset > 0) {
1065
		struct ipv6_tlv_tnl_enc_lim *tel;
1066
		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
1067 1068
		if (tel->encap_limit == 0) {
			icmpv6_send(skb, ICMPV6_PARAMPROB,
1069
				    ICMPV6_HDR_FIELD, offset + 2);
1070 1071 1072 1073 1074 1075
			return -1;
		}
		encap_limit = tel->encap_limit - 1;
	} else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

1076 1077
	memcpy(&fl6, &t->fl.u.ip6, sizeof (fl6));
	fl6.flowi6_proto = IPPROTO_IPV6;
1078 1079

	dsfield = ipv6_get_dsfield(ipv6h);
1080
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1081
		fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
1082
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
1083
		fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
1084 1085
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
		fl6.flowi6_mark = skb->mark;
1086

1087
	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
1088 1089
	if (err != 0) {
		if (err == -EMSGSIZE)
1090
			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1091 1092 1093 1094 1095 1096
		return -1;
	}

	return 0;
}

1097
static netdev_tx_t
1098 1099 1100
ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1101
	struct net_device_stats *stats = &t->dev->stats;
1102 1103 1104
	int ret;

	switch (skb->protocol) {
1105
	case htons(ETH_P_IP):
1106 1107
		ret = ip4ip6_tnl_xmit(skb, dev);
		break;
1108
	case htons(ETH_P_IPV6):
1109 1110 1111 1112 1113 1114 1115 1116 1117
		ret = ip6ip6_tnl_xmit(skb, dev);
		break;
	default:
		goto tx_err;
	}

	if (ret < 0)
		goto tx_err;

1118
	return NETDEV_TX_OK;
1119

L
Linus Torvalds 已提交
1120 1121 1122 1123
tx_err:
	stats->tx_errors++;
	stats->tx_dropped++;
	kfree_skb(skb);
1124
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
1125 1126 1127 1128 1129
}

static void ip6_tnl_set_cap(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
1130 1131
	int ltype = ipv6_addr_type(&p->laddr);
	int rtype = ipv6_addr_type(&p->raddr);
L
Linus Torvalds 已提交
1132 1133 1134

	p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV);

1135 1136 1137
	if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
	    rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
	    !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
1138
	    (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
1139 1140 1141 1142
		if (ltype&IPV6_ADDR_UNICAST)
			p->flags |= IP6_TNL_F_CAP_XMIT;
		if (rtype&IPV6_ADDR_UNICAST)
			p->flags |= IP6_TNL_F_CAP_RCV;
L
Linus Torvalds 已提交
1143 1144 1145
	}
}

1146
static void ip6_tnl_link_config(struct ip6_tnl *t)
L
Linus Torvalds 已提交
1147 1148 1149
{
	struct net_device *dev = t->dev;
	struct ip6_tnl_parm *p = &t->parms;
1150
	struct flowi6 *fl6 = &t->fl.u.ip6;
L
Linus Torvalds 已提交
1151

1152 1153
	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
	memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
L
Linus Torvalds 已提交
1154 1155

	/* Set up flowi template */
1156 1157 1158 1159
	ipv6_addr_copy(&fl6->saddr, &p->laddr);
	ipv6_addr_copy(&fl6->daddr, &p->raddr);
	fl6->flowi6_oif = p->link;
	fl6->flowlabel = 0;
L
Linus Torvalds 已提交
1160 1161

	if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
1162
		fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
L
Linus Torvalds 已提交
1163
	if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
1164
		fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
L
Linus Torvalds 已提交
1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175

	ip6_tnl_set_cap(t);

	if (p->flags&IP6_TNL_F_CAP_XMIT && p->flags&IP6_TNL_F_CAP_RCV)
		dev->flags |= IFF_POINTOPOINT;
	else
		dev->flags &= ~IFF_POINTOPOINT;

	dev->iflink = p->link;

	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1176 1177 1178
		int strict = (ipv6_addr_type(&p->raddr) &
			      (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));

1179 1180
		struct rt6_info *rt = rt6_lookup(dev_net(dev),
						 &p->raddr, &p->laddr,
1181
						 p->link, strict);
L
Linus Torvalds 已提交
1182 1183 1184 1185 1186 1187 1188 1189 1190

		if (rt == NULL)
			return;

		if (rt->rt6i_dev) {
			dev->hard_header_len = rt->rt6i_dev->hard_header_len +
				sizeof (struct ipv6hdr);

			dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);
1191 1192
			if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
				dev->mtu-=8;
L
Linus Torvalds 已提交
1193 1194 1195 1196

			if (dev->mtu < IPV6_MIN_MTU)
				dev->mtu = IPV6_MIN_MTU;
		}
1197
		dst_release(&rt->dst);
L
Linus Torvalds 已提交
1198 1199 1200 1201
	}
}

/**
1202
 * ip6_tnl_change - update the tunnel parameters
L
Linus Torvalds 已提交
1203 1204 1205 1206
 *   @t: tunnel to be changed
 *   @p: tunnel configuration parameters
 *
 * Description:
1207
 *   ip6_tnl_change() updates the tunnel parameters
L
Linus Torvalds 已提交
1208 1209 1210
 **/

static int
1211
ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
1212 1213 1214 1215 1216 1217 1218
{
	ipv6_addr_copy(&t->parms.laddr, &p->laddr);
	ipv6_addr_copy(&t->parms.raddr, &p->raddr);
	t->parms.flags = p->flags;
	t->parms.hop_limit = p->hop_limit;
	t->parms.encap_limit = p->encap_limit;
	t->parms.flowinfo = p->flowinfo;
1219
	t->parms.link = p->link;
1220
	t->parms.proto = p->proto;
1221
	ip6_tnl_dst_reset(t);
1222
	ip6_tnl_link_config(t);
L
Linus Torvalds 已提交
1223 1224 1225 1226
	return 0;
}

/**
1227
 * ip6_tnl_ioctl - configure ipv6 tunnels from userspace
L
Linus Torvalds 已提交
1228 1229 1230 1231 1232
 *   @dev: virtual device associated with tunnel
 *   @ifr: parameters passed from userspace
 *   @cmd: command to be performed
 *
 * Description:
1233
 *   ip6_tnl_ioctl() is used for managing IPv6 tunnels
1234
 *   from userspace.
L
Linus Torvalds 已提交
1235 1236 1237 1238 1239 1240 1241
 *
 *   The possible commands are the following:
 *     %SIOCGETTUNNEL: get tunnel parameters for device
 *     %SIOCADDTUNNEL: add tunnel matching given tunnel parameters
 *     %SIOCCHGTUNNEL: change tunnel parameters to those given
 *     %SIOCDELTUNNEL: delete tunnel
 *
1242
 *   The fallback device "ip6tnl0", created during module
L
Linus Torvalds 已提交
1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254
 *   initialization, can be used for creating other tunnel devices.
 *
 * Return:
 *   0 on success,
 *   %-EFAULT if unable to copy data to or from userspace,
 *   %-EPERM if current process hasn't %CAP_NET_ADMIN set
 *   %-EINVAL if passed tunnel parameters are invalid,
 *   %-EEXIST if changing a tunnel's parameters would cause a conflict
 *   %-ENODEV if attempting to change or delete a nonexisting device
 **/

static int
1255
ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
L
Linus Torvalds 已提交
1256 1257 1258 1259
{
	int err = 0;
	struct ip6_tnl_parm p;
	struct ip6_tnl *t = NULL;
1260 1261
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
1262 1263 1264

	switch (cmd) {
	case SIOCGETTUNNEL:
1265
		if (dev == ip6n->fb_tnl_dev) {
1266
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p))) {
L
Linus Torvalds 已提交
1267 1268 1269
				err = -EFAULT;
				break;
			}
1270
			t = ip6_tnl_locate(net, &p, 0);
1271 1272
		}
		if (t == NULL)
1273
			t = netdev_priv(dev);
L
Linus Torvalds 已提交
1274 1275 1276 1277 1278 1279 1280 1281 1282 1283
		memcpy(&p, &t->parms, sizeof (p));
		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
			err = -EFAULT;
		}
		break;
	case SIOCADDTUNNEL:
	case SIOCCHGTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
			break;
1284 1285
		err = -EFAULT;
		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1286
			break;
1287
		err = -EINVAL;
1288 1289
		if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
		    p.proto != 0)
L
Linus Torvalds 已提交
1290
			break;
1291
		t = ip6_tnl_locate(net, &p, cmd == SIOCADDTUNNEL);
1292
		if (dev != ip6n->fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
1293 1294 1295 1296 1297 1298 1299 1300
			if (t != NULL) {
				if (t->dev != dev) {
					err = -EEXIST;
					break;
				}
			} else
				t = netdev_priv(dev);

1301
			ip6_tnl_unlink(ip6n, t);
1302
			synchronize_net();
1303
			err = ip6_tnl_change(t, &p);
1304
			ip6_tnl_link(ip6n, t);
L
Linus Torvalds 已提交
1305 1306
			netdev_state_change(dev);
		}
1307
		if (t) {
L
Linus Torvalds 已提交
1308
			err = 0;
1309 1310 1311 1312 1313
			if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof (p)))
				err = -EFAULT;

		} else
			err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
L
Linus Torvalds 已提交
1314 1315 1316 1317 1318 1319
		break;
	case SIOCDELTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
			break;

1320
		if (dev == ip6n->fb_tnl_dev) {
1321 1322
			err = -EFAULT;
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1323
				break;
1324
			err = -ENOENT;
1325
			if ((t = ip6_tnl_locate(net, &p, 0)) == NULL)
L
Linus Torvalds 已提交
1326
				break;
1327
			err = -EPERM;
1328
			if (t->dev == ip6n->fb_tnl_dev)
L
Linus Torvalds 已提交
1329
				break;
1330
			dev = t->dev;
L
Linus Torvalds 已提交
1331
		}
1332 1333
		err = 0;
		unregister_netdevice(dev);
L
Linus Torvalds 已提交
1334 1335 1336 1337 1338 1339 1340 1341
		break;
	default:
		err = -EINVAL;
	}
	return err;
}

/**
1342
 * ip6_tnl_change_mtu - change mtu manually for tunnel device
L
Linus Torvalds 已提交
1343 1344 1345 1346 1347 1348 1349 1350 1351
 *   @dev: virtual device associated with tunnel
 *   @new_mtu: the new mtu
 *
 * Return:
 *   0 on success,
 *   %-EINVAL if mtu too small
 **/

static int
1352
ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
L
Linus Torvalds 已提交
1353 1354 1355 1356 1357 1358 1359 1360
{
	if (new_mtu < IPV6_MIN_MTU) {
		return -EINVAL;
	}
	dev->mtu = new_mtu;
	return 0;
}

1361 1362

static const struct net_device_ops ip6_tnl_netdev_ops = {
E
Eric Dumazet 已提交
1363
	.ndo_uninit	= ip6_tnl_dev_uninit,
1364
	.ndo_start_xmit = ip6_tnl_xmit,
E
Eric Dumazet 已提交
1365
	.ndo_do_ioctl	= ip6_tnl_ioctl,
1366
	.ndo_change_mtu = ip6_tnl_change_mtu,
E
Eric Dumazet 已提交
1367
	.ndo_get_stats	= ip6_get_stats,
1368 1369
};

E
Eric Dumazet 已提交
1370

L
Linus Torvalds 已提交
1371
/**
1372
 * ip6_tnl_dev_setup - setup virtual tunnel device
L
Linus Torvalds 已提交
1373 1374 1375 1376 1377 1378
 *   @dev: virtual device associated with tunnel
 *
 * Description:
 *   Initialize function pointers and device parameters
 **/

1379
static void ip6_tnl_dev_setup(struct net_device *dev)
L
Linus Torvalds 已提交
1380
{
1381 1382
	struct ip6_tnl *t;

1383
	dev->netdev_ops = &ip6_tnl_netdev_ops;
E
Eric Dumazet 已提交
1384
	dev->destructor = ip6_dev_free;
L
Linus Torvalds 已提交
1385 1386 1387 1388

	dev->type = ARPHRD_TUNNEL6;
	dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
	dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
1389 1390 1391
	t = netdev_priv(dev);
	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		dev->mtu-=8;
L
Linus Torvalds 已提交
1392 1393
	dev->flags |= IFF_NOARP;
	dev->addr_len = sizeof(struct in6_addr);
1394
	dev->features |= NETIF_F_NETNS_LOCAL;
1395
	dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
L
Linus Torvalds 已提交
1396 1397 1398 1399
}


/**
1400
 * ip6_tnl_dev_init_gen - general initializer for all tunnel devices
L
Linus Torvalds 已提交
1401 1402 1403
 *   @dev: virtual device associated with tunnel
 **/

E
Eric Dumazet 已提交
1404
static inline int
1405
ip6_tnl_dev_init_gen(struct net_device *dev)
L
Linus Torvalds 已提交
1406
{
1407
	struct ip6_tnl *t = netdev_priv(dev);
E
Eric Dumazet 已提交
1408

L
Linus Torvalds 已提交
1409 1410
	t->dev = dev;
	strcpy(t->parms.name, dev->name);
E
Eric Dumazet 已提交
1411 1412 1413 1414
	dev->tstats = alloc_percpu(struct pcpu_tstats);
	if (!dev->tstats)
		return -ENOMEM;
	return 0;
L
Linus Torvalds 已提交
1415 1416 1417
}

/**
1418
 * ip6_tnl_dev_init - initializer for all non fallback tunnel devices
L
Linus Torvalds 已提交
1419 1420 1421
 *   @dev: virtual device associated with tunnel
 **/

E
Eric Dumazet 已提交
1422
static int ip6_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1423
{
1424
	struct ip6_tnl *t = netdev_priv(dev);
E
Eric Dumazet 已提交
1425 1426 1427 1428
	int err = ip6_tnl_dev_init_gen(dev);

	if (err)
		return err;
1429
	ip6_tnl_link_config(t);
E
Eric Dumazet 已提交
1430
	return 0;
L
Linus Torvalds 已提交
1431 1432 1433
}

/**
1434
 * ip6_fb_tnl_dev_init - initializer for fallback tunnel device
L
Linus Torvalds 已提交
1435 1436 1437 1438 1439
 *   @dev: fallback device
 *
 * Return: 0
 **/

E
Eric Dumazet 已提交
1440
static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1441
{
1442
	struct ip6_tnl *t = netdev_priv(dev);
1443 1444
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
E
Eric Dumazet 已提交
1445 1446 1447 1448
	int err = ip6_tnl_dev_init_gen(dev);

	if (err)
		return err;
1449

1450
	t->parms.proto = IPPROTO_IPV6;
L
Linus Torvalds 已提交
1451
	dev_hold(dev);
1452
	RCU_INIT_POINTER(ip6n->tnls_wc[0], t);
E
Eric Dumazet 已提交
1453
	return 0;
L
Linus Torvalds 已提交
1454 1455
}

1456
static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
1457 1458 1459 1460 1461
	.handler	= ip4ip6_rcv,
	.err_handler	= ip4ip6_err,
	.priority	=	1,
};

1462
static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
1463 1464
	.handler	= ip6ip6_rcv,
	.err_handler	= ip6ip6_err,
H
Herbert Xu 已提交
1465
	.priority	=	1,
L
Linus Torvalds 已提交
1466 1467
};

1468
static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
1469 1470 1471
{
	int h;
	struct ip6_tnl *t;
1472
	LIST_HEAD(list);
1473 1474

	for (h = 0; h < HASH_SIZE; h++) {
E
Eric Dumazet 已提交
1475
		t = rtnl_dereference(ip6n->tnls_r_l[h]);
1476 1477
		while (t != NULL) {
			unregister_netdevice_queue(t->dev, &list);
E
Eric Dumazet 已提交
1478
			t = rtnl_dereference(t->next);
1479
		}
1480 1481
	}

E
Eric Dumazet 已提交
1482
	t = rtnl_dereference(ip6n->tnls_wc[0]);
1483 1484
	unregister_netdevice_queue(t->dev, &list);
	unregister_netdevice_many(&list);
1485 1486
}

1487
static int __net_init ip6_tnl_init_net(struct net *net)
1488
{
1489
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1490 1491
	int err;

1492 1493 1494
	ip6n->tnls[0] = ip6n->tnls_wc;
	ip6n->tnls[1] = ip6n->tnls_r_l;

1495 1496 1497 1498 1499 1500
	err = -ENOMEM;
	ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0",
				      ip6_tnl_dev_setup);

	if (!ip6n->fb_tnl_dev)
		goto err_alloc_dev;
1501
	dev_net_set(ip6n->fb_tnl_dev, net);
1502

E
Eric Dumazet 已提交
1503 1504 1505
	err = ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
	if (err < 0)
		goto err_register;
1506 1507 1508 1509

	err = register_netdev(ip6n->fb_tnl_dev);
	if (err < 0)
		goto err_register;
1510 1511
	return 0;

1512
err_register:
E
Eric Dumazet 已提交
1513
	ip6_dev_free(ip6n->fb_tnl_dev);
1514
err_alloc_dev:
1515 1516 1517
	return err;
}

1518
static void __net_exit ip6_tnl_exit_net(struct net *net)
1519
{
1520
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1521

1522 1523 1524
	rtnl_lock();
	ip6_tnl_destroy_tunnels(ip6n);
	rtnl_unlock();
1525 1526 1527 1528 1529
}

static struct pernet_operations ip6_tnl_net_ops = {
	.init = ip6_tnl_init_net,
	.exit = ip6_tnl_exit_net,
1530 1531
	.id   = &ip6_tnl_net_id,
	.size = sizeof(struct ip6_tnl_net),
1532 1533
};

L
Linus Torvalds 已提交
1534 1535 1536 1537 1538 1539 1540 1541 1542 1543
/**
 * ip6_tunnel_init - register protocol and reserve needed resources
 *
 * Return: 0 on success
 **/

static int __init ip6_tunnel_init(void)
{
	int  err;

1544 1545 1546 1547 1548 1549
	err = register_pernet_device(&ip6_tnl_net_ops);
	if (err < 0)
		goto out_pernet;

	err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
	if (err < 0) {
1550
		printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
1551
		goto out_ip4ip6;
1552 1553
	}

1554 1555
	err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
	if (err < 0) {
1556
		printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
1557
		goto out_ip6ip6;
L
Linus Torvalds 已提交
1558
	}
1559

L
Linus Torvalds 已提交
1560
	return 0;
1561 1562

out_ip6ip6:
1563
	xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
1564 1565 1566
out_ip4ip6:
	unregister_pernet_device(&ip6_tnl_net_ops);
out_pernet:
L
Linus Torvalds 已提交
1567 1568 1569 1570 1571 1572 1573 1574 1575
	return err;
}

/**
 * ip6_tunnel_cleanup - free resources and unregister protocol
 **/

static void __exit ip6_tunnel_cleanup(void)
{
1576
	if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
1577
		printk(KERN_INFO "ip6_tunnel close: can't deregister ip4ip6\n");
1578

1579
	if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
1580
		printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
L
Linus Torvalds 已提交
1581

1582
	unregister_pernet_device(&ip6_tnl_net_ops);
L
Linus Torvalds 已提交
1583 1584 1585 1586
}

module_init(ip6_tunnel_init);
module_exit(ip6_tunnel_cleanup);