sit.c 44.3 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5
/*
 *	IPv6 over IPv4 tunnel device - Simple Internet Transition (SIT)
 *	Linux INET6 implementation
 *
 *	Authors:
6
 *	Pedro Roque		<roque@di.fc.ul.pt>
L
Linus Torvalds 已提交
7 8 9 10 11 12 13 14 15 16
 *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 *	Changes:
 * Roger Venning <r.venning@telstra.com>:	6to4 support
 * Nate Thompson <nate@thebog.net>:		6to4 support
17
 * Fred Templin <fred.l.templin@boeing.com>:	isatap support
L
Linus Torvalds 已提交
18 19
 */

20 21
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
22
#include <linux/module.h>
23
#include <linux/capability.h>
L
Linus Torvalds 已提交
24 25 26 27 28 29 30 31 32
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/socket.h>
#include <linux/sockios.h>
#include <linux/net.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/icmp.h>
33
#include <linux/slab.h>
L
Linus Torvalds 已提交
34 35 36
#include <asm/uaccess.h>
#include <linux/init.h>
#include <linux/netfilter_ipv4.h>
37
#include <linux/if_ether.h>
L
Linus Torvalds 已提交
38 39 40 41 42 43 44 45 46 47 48 49 50 51

#include <net/sock.h>
#include <net/snmp.h>

#include <net/ipv6.h>
#include <net/protocol.h>
#include <net/transp_v6.h>
#include <net/ip6_fib.h>
#include <net/ip6_route.h>
#include <net/ndisc.h>
#include <net/addrconf.h>
#include <net/ip.h>
#include <net/udp.h>
#include <net/icmp.h>
52
#include <net/ip_tunnels.h>
L
Linus Torvalds 已提交
53 54 55
#include <net/inet_ecn.h>
#include <net/xfrm.h>
#include <net/dsfield.h>
56 57
#include <net/net_namespace.h>
#include <net/netns/generic.h>
L
Linus Torvalds 已提交
58 59 60 61 62 63 64

/*
   This version of net/ipv6/sit.c is cloned of net/ipv4/ip_gre.c

   For comments look at net/ipv4/ip_gre.c --ANK
 */

65
#define IP6_SIT_HASH_SIZE  16
A
Al Viro 已提交
66
#define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
L
Linus Torvalds 已提交
67

68 69 70 71
static bool log_ecn_error = true;
module_param(log_ecn_error, bool, 0644);
MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");

E
Eric Dumazet 已提交
72
static int ipip6_tunnel_init(struct net_device *dev);
L
Linus Torvalds 已提交
73
static void ipip6_tunnel_setup(struct net_device *dev);
E
Eric Dumazet 已提交
74
static void ipip6_dev_free(struct net_device *dev);
75 76
static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
		      __be32 *v4dst);
77
static struct rtnl_link_ops sit_link_ops __read_mostly;
L
Linus Torvalds 已提交
78

79
static int sit_net_id __read_mostly;
80
struct sit_net {
81 82 83
	struct ip_tunnel __rcu *tunnels_r_l[IP6_SIT_HASH_SIZE];
	struct ip_tunnel __rcu *tunnels_r[IP6_SIT_HASH_SIZE];
	struct ip_tunnel __rcu *tunnels_l[IP6_SIT_HASH_SIZE];
E
Eric Dumazet 已提交
84 85
	struct ip_tunnel __rcu *tunnels_wc[1];
	struct ip_tunnel __rcu **tunnels[4];
86

87
	struct net_device *fb_tunnel_dev;
88 89
};

E
Eric Dumazet 已提交
90 91 92
/*
 * Must be invoked with rcu_read_lock
 */
E
Eldad Zack 已提交
93
static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
94
		struct net_device *dev, __be32 remote, __be32 local)
L
Linus Torvalds 已提交
95
{
E
Eric Dumazet 已提交
96 97
	unsigned int h0 = HASH(remote);
	unsigned int h1 = HASH(local);
L
Linus Torvalds 已提交
98
	struct ip_tunnel *t;
99
	struct sit_net *sitn = net_generic(net, sit_net_id);
L
Linus Torvalds 已提交
100

A
Amerigo Wang 已提交
101
	for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
L
Linus Torvalds 已提交
102
		if (local == t->parms.iph.saddr &&
103
		    remote == t->parms.iph.daddr &&
104
		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
105
		    (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
106 107
			return t;
	}
A
Amerigo Wang 已提交
108
	for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
109
		if (remote == t->parms.iph.daddr &&
110
		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
111
		    (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
112 113
			return t;
	}
A
Amerigo Wang 已提交
114
	for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
115
		if (local == t->parms.iph.saddr &&
116
		    (!dev || !t->parms.link || dev->ifindex == t->parms.link) &&
117
		    (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
118 119
			return t;
	}
E
Eric Dumazet 已提交
120
	t = rcu_dereference(sitn->tunnels_wc[0]);
121
	if (t && (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
122 123 124 125
		return t;
	return NULL;
}

E
Eric Dumazet 已提交
126
static struct ip_tunnel __rcu **__ipip6_bucket(struct sit_net *sitn,
127
		struct ip_tunnel_parm *parms)
L
Linus Torvalds 已提交
128
{
129 130
	__be32 remote = parms->iph.daddr;
	__be32 local = parms->iph.saddr;
E
Eric Dumazet 已提交
131
	unsigned int h = 0;
L
Linus Torvalds 已提交
132 133 134 135 136 137 138 139 140 141
	int prio = 0;

	if (remote) {
		prio |= 2;
		h ^= HASH(remote);
	}
	if (local) {
		prio |= 1;
		h ^= HASH(local);
	}
142
	return &sitn->tunnels[prio][h];
L
Linus Torvalds 已提交
143 144
}

E
Eric Dumazet 已提交
145
static inline struct ip_tunnel __rcu **ipip6_bucket(struct sit_net *sitn,
146
		struct ip_tunnel *t)
147
{
148
	return __ipip6_bucket(sitn, &t->parms);
149 150
}

151
static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
L
Linus Torvalds 已提交
152
{
E
Eric Dumazet 已提交
153 154 155 156 157 158 159
	struct ip_tunnel __rcu **tp;
	struct ip_tunnel *iter;

	for (tp = ipip6_bucket(sitn, t);
	     (iter = rtnl_dereference(*tp)) != NULL;
	     tp = &iter->next) {
		if (t == iter) {
160
			rcu_assign_pointer(*tp, t->next);
L
Linus Torvalds 已提交
161 162 163 164 165
			break;
		}
	}
}

166
static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
L
Linus Torvalds 已提交
167
{
E
Eric Dumazet 已提交
168
	struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
L
Linus Torvalds 已提交
169

170 171
	rcu_assign_pointer(t->next, rtnl_dereference(*tp));
	rcu_assign_pointer(*tp, t);
L
Linus Torvalds 已提交
172 173
}

174
static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
175 176
{
#ifdef CONFIG_IPV6_SIT_6RD
177 178
	struct ip_tunnel *t = netdev_priv(dev);

179 180 181 182 183 184 185 186 187 188 189 190
	if (t->dev == sitn->fb_tunnel_dev) {
		ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
		t->ip6rd.relay_prefix = 0;
		t->ip6rd.prefixlen = 16;
		t->ip6rd.relay_prefixlen = 0;
	} else {
		struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
		memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
	}
#endif
}

191 192 193 194 195 196 197
static int ipip6_tunnel_create(struct net_device *dev)
{
	struct ip_tunnel *t = netdev_priv(dev);
	struct net *net = dev_net(dev);
	struct sit_net *sitn = net_generic(net, sit_net_id);
	int err;

198 199
	memcpy(dev->dev_addr, &t->parms.iph.saddr, 4);
	memcpy(dev->broadcast, &t->parms.iph.daddr, 4);
200

N
Nicolas Dichtel 已提交
201
	if ((__force u16)t->parms.i_flags & SIT_ISATAP)
202 203
		dev->priv_flags |= IFF_ISATAP;

204 205
	dev->rtnl_link_ops = &sit_link_ops;

206 207 208 209
	err = register_netdevice(dev);
	if (err < 0)
		goto out;

210 211
	ipip6_tunnel_clone_6rd(dev, sitn);

212 213 214 215 216 217 218 219 220
	dev_hold(dev);

	ipip6_tunnel_link(sitn, t);
	return 0;

out:
	return err;
}

E
Eric Dumazet 已提交
221
static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
222
		struct ip_tunnel_parm *parms, int create)
L
Linus Torvalds 已提交
223
{
A
Al Viro 已提交
224 225
	__be32 remote = parms->iph.daddr;
	__be32 local = parms->iph.saddr;
E
Eric Dumazet 已提交
226 227
	struct ip_tunnel *t, *nt;
	struct ip_tunnel __rcu **tp;
L
Linus Torvalds 已提交
228 229
	struct net_device *dev;
	char name[IFNAMSIZ];
230
	struct sit_net *sitn = net_generic(net, sit_net_id);
L
Linus Torvalds 已提交
231

E
Eric Dumazet 已提交
232 233 234
	for (tp = __ipip6_bucket(sitn, parms);
	    (t = rtnl_dereference(*tp)) != NULL;
	     tp = &t->next) {
235
		if (local == t->parms.iph.saddr &&
236 237
		    remote == t->parms.iph.daddr &&
		    parms->link == t->parms.link) {
238 239 240 241 242
			if (create)
				return NULL;
			else
				return t;
		}
L
Linus Torvalds 已提交
243 244 245 246 247 248
	}
	if (!create)
		goto failed;

	if (parms->name[0])
		strlcpy(name, parms->name, IFNAMSIZ);
249
	else
E
Eric Dumazet 已提交
250
		strcpy(name, "sit%d");
L
Linus Torvalds 已提交
251

252 253
	dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
			   ipip6_tunnel_setup);
254
	if (!dev)
L
Linus Torvalds 已提交
255 256
		return NULL;

257 258
	dev_net_set(dev, net);

259
	nt = netdev_priv(dev);
260

L
Linus Torvalds 已提交
261
	nt->parms = *parms;
262
	if (ipip6_tunnel_create(dev) < 0)
263
		goto failed_free;
L
Linus Torvalds 已提交
264 265 266

	return nt;

267
failed_free:
E
Eric Dumazet 已提交
268
	ipip6_dev_free(dev);
L
Linus Torvalds 已提交
269 270 271 272
failed:
	return NULL;
}

E
Eric Dumazet 已提交
273 274 275 276 277
#define for_each_prl_rcu(start)			\
	for (prl = rcu_dereference(start);	\
	     prl;				\
	     prl = rcu_dereference(prl->next))

278
static struct ip_tunnel_prl_entry *
279
__ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
280
{
E
Eric Dumazet 已提交
281
	struct ip_tunnel_prl_entry *prl;
282

E
Eric Dumazet 已提交
283 284
	for_each_prl_rcu(t->prl)
		if (prl->addr == addr)
285
			break;
E
Eric Dumazet 已提交
286
	return prl;
287 288 289

}

290 291
static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
				struct ip_tunnel_prl __user *a)
292
{
293
	struct ip_tunnel_prl kprl, *kp;
294 295 296 297
	struct ip_tunnel_prl_entry *prl;
	unsigned int cmax, c = 0, ca, len;
	int ret = 0;

298 299 300 301
	if (copy_from_user(&kprl, a, sizeof(kprl)))
		return -EFAULT;
	cmax = kprl.datalen / sizeof(kprl);
	if (cmax > 1 && kprl.addr != htonl(INADDR_ANY))
302 303 304 305 306 307 308 309 310
		cmax = 1;

	/* For simple GET or for root users,
	 * we try harder to allocate.
	 */
	kp = (cmax <= 1 || capable(CAP_NET_ADMIN)) ?
		kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
		NULL;

E
Eric Dumazet 已提交
311
	rcu_read_lock();
312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328

	ca = t->prl_count < cmax ? t->prl_count : cmax;

	if (!kp) {
		/* We don't try hard to allocate much memory for
		 * non-root users.
		 * For root users, retry allocating enough memory for
		 * the answer.
		 */
		kp = kcalloc(ca, sizeof(*kp), GFP_ATOMIC);
		if (!kp) {
			ret = -ENOMEM;
			goto out;
		}
	}

	c = 0;
E
Eric Dumazet 已提交
329
	for_each_prl_rcu(t->prl) {
330
		if (c >= cmax)
331
			break;
332
		if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
333 334 335 336
			continue;
		kp[c].addr = prl->addr;
		kp[c].flags = prl->flags;
		c++;
337
		if (kprl.addr != htonl(INADDR_ANY))
338 339 340
			break;
	}
out:
E
Eric Dumazet 已提交
341
	rcu_read_unlock();
342 343

	len = sizeof(*kp) * c;
344 345 346
	ret = 0;
	if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
		ret = -EFAULT;
347 348 349

	kfree(kp);

350
	return ret;
351 352
}

353 354 355 356
static int
ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
{
	struct ip_tunnel_prl_entry *p;
357 358
	int err = 0;

359 360 361
	if (a->addr == htonl(INADDR_ANY))
		return -EINVAL;

E
Eric Dumazet 已提交
362
	ASSERT_RTNL();
363

E
Eric Dumazet 已提交
364
	for (p = rtnl_dereference(t->prl); p; p = rtnl_dereference(p->next)) {
365
		if (p->addr == a->addr) {
E
Eric Dumazet 已提交
366 367 368 369
			if (chg) {
				p->flags = a->flags;
				goto out;
			}
370 371
			err = -EEXIST;
			goto out;
372 373 374
		}
	}

375 376 377 378
	if (chg) {
		err = -ENXIO;
		goto out;
	}
379 380

	p = kzalloc(sizeof(struct ip_tunnel_prl_entry), GFP_KERNEL);
381 382 383 384
	if (!p) {
		err = -ENOBUFS;
		goto out;
	}
385 386

	p->next = t->prl;
387 388
	p->addr = a->addr;
	p->flags = a->flags;
E
Eric Dumazet 已提交
389
	t->prl_count++;
390
	rcu_assign_pointer(t->prl, p);
391 392
out:
	return err;
393 394
}

E
Eric Dumazet 已提交
395 396 397 398 399 400
static void prl_list_destroy_rcu(struct rcu_head *head)
{
	struct ip_tunnel_prl_entry *p, *n;

	p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
	do {
401
		n = rcu_dereference_protected(p->next, 1);
E
Eric Dumazet 已提交
402 403 404 405 406
		kfree(p);
		p = n;
	} while (p);
}

407 408 409
static int
ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
{
410 411
	struct ip_tunnel_prl_entry *x;
	struct ip_tunnel_prl_entry __rcu **p;
412 413
	int err = 0;

E
Eric Dumazet 已提交
414
	ASSERT_RTNL();
415

416
	if (a && a->addr != htonl(INADDR_ANY)) {
417 418 419 420
		for (p = &t->prl;
		     (x = rtnl_dereference(*p)) != NULL;
		     p = &x->next) {
			if (x->addr == a->addr) {
421
				*p = x->next;
422
				kfree_rcu(x, rcu_head);
423
				t->prl_count--;
424
				goto out;
425 426
			}
		}
427
		err = -ENXIO;
428
	} else {
429 430
		x = rtnl_dereference(t->prl);
		if (x) {
E
Eric Dumazet 已提交
431 432 433
			t->prl_count = 0;
			call_rcu(&x->rcu_head, prl_list_destroy_rcu);
			t->prl = NULL;
434 435
		}
	}
436
out:
437
	return err;
438 439 440
}

static int
441
isatap_chksrc(struct sk_buff *skb, const struct iphdr *iph, struct ip_tunnel *t)
442
{
443
	struct ip_tunnel_prl_entry *p;
444 445
	int ok = 1;

E
Eric Dumazet 已提交
446
	rcu_read_lock();
447
	p = __ipip6_tunnel_locate_prl(t, iph->saddr);
448
	if (p) {
449
		if (p->flags & PRL_DEFAULT)
450 451 452 453
			skb->ndisc_nodetype = NDISC_NODETYPE_DEFAULT;
		else
			skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT;
	} else {
454 455
		const struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;

456 457
		if (ipv6_addr_is_isatap(addr6) &&
		    (addr6->s6_addr32[3] == iph->saddr) &&
458
		    ipv6_chk_prefix(addr6, t->dev))
459 460 461 462
			skb->ndisc_nodetype = NDISC_NODETYPE_HOST;
		else
			ok = 0;
	}
E
Eric Dumazet 已提交
463
	rcu_read_unlock();
464 465 466
	return ok;
}

L
Linus Torvalds 已提交
467 468
static void ipip6_tunnel_uninit(struct net_device *dev)
{
N
Nicolas Dichtel 已提交
469 470
	struct ip_tunnel *tunnel = netdev_priv(dev);
	struct sit_net *sitn = net_generic(tunnel->net, sit_net_id);
471

472
	if (dev == sitn->fb_tunnel_dev) {
473
		RCU_INIT_POINTER(sitn->tunnels_wc[0], NULL);
L
Linus Torvalds 已提交
474
	} else {
N
Nicolas Dichtel 已提交
475 476
		ipip6_tunnel_unlink(sitn, tunnel);
		ipip6_tunnel_del_prl(tunnel, NULL);
L
Linus Torvalds 已提交
477
	}
478
	dst_cache_reset(&tunnel->dst_cache);
E
Eric Dumazet 已提交
479
	dev_put(dev);
L
Linus Torvalds 已提交
480 481
}

482
static int ipip6_err(struct sk_buff *skb, u32 info)
L
Linus Torvalds 已提交
483
{
484
	const struct iphdr *iph = (const struct iphdr *)skb->data;
485 486
	const int type = icmp_hdr(skb)->type;
	const int code = icmp_hdr(skb)->code;
487
	unsigned int data_len = 0;
L
Linus Torvalds 已提交
488
	struct ip_tunnel *t;
489
	int err;
L
Linus Torvalds 已提交
490 491 492 493

	switch (type) {
	default:
	case ICMP_PARAMETERPROB:
494
		return 0;
L
Linus Torvalds 已提交
495 496 497 498 499

	case ICMP_DEST_UNREACH:
		switch (code) {
		case ICMP_SR_FAILED:
			/* Impossible event. */
500
			return 0;
L
Linus Torvalds 已提交
501 502 503 504 505 506 507 508 509 510
		default:
			/* All others are translated to HOST_UNREACH.
			   rfc2003 contains "deep thoughts" about NET_UNREACH,
			   I believe they are just ether pollution. --ANK
			 */
			break;
		}
		break;
	case ICMP_TIME_EXCEEDED:
		if (code != ICMP_EXC_TTL)
511
			return 0;
512
		data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */
L
Linus Torvalds 已提交
513
		break;
514 515
	case ICMP_REDIRECT:
		break;
L
Linus Torvalds 已提交
516 517
	}

518 519
	err = -ENOENT;

520 521 522 523
	t = ipip6_tunnel_lookup(dev_net(skb->dev),
				skb->dev,
				iph->daddr,
				iph->saddr);
524
	if (!t)
525 526 527 528
		goto out;

	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
		ipv4_update_pmtu(skb, dev_net(skb->dev), info,
529
				 t->parms.link, 0, iph->protocol, 0);
530 531 532
		err = 0;
		goto out;
	}
533
	if (type == ICMP_REDIRECT) {
534
		ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
535
			      iph->protocol, 0);
536 537 538
		err = 0;
		goto out;
	}
539

540
	err = 0;
541
	if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
L
Linus Torvalds 已提交
542
		goto out;
543

544
	if (t->parms.iph.daddr == 0)
545 546
		goto out;

L
Linus Torvalds 已提交
547 548 549
	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
		goto out;

550
	if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
L
Linus Torvalds 已提交
551 552 553 554 555
		t->err_count++;
	else
		t->err_count = 1;
	t->err_time = jiffies;
out:
556
	return err;
L
Linus Torvalds 已提交
557 558
}

559 560 561 562 563 564 565 566 567
static inline bool is_spoofed_6rd(struct ip_tunnel *tunnel, const __be32 v4addr,
				  const struct in6_addr *v6addr)
{
	__be32 v4embed = 0;
	if (check_6rd(tunnel, v6addr, &v4embed) && v4addr != v4embed)
		return true;
	return false;
}

568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631
/* Checks if an address matches an address on the tunnel interface.
 * Used to detect the NAT of proto 41 packets and let them pass spoofing test.
 * Long story:
 * This function is called after we considered the packet as spoofed
 * in is_spoofed_6rd.
 * We may have a router that is doing NAT for proto 41 packets
 * for an internal station. Destination a.a.a.a/PREFIX:bbbb:bbbb
 * will be translated to n.n.n.n/PREFIX:bbbb:bbbb. And is_spoofed_6rd
 * function will return true, dropping the packet.
 * But, we can still check if is spoofed against the IP
 * addresses associated with the interface.
 */
static bool only_dnatted(const struct ip_tunnel *tunnel,
	const struct in6_addr *v6dst)
{
	int prefix_len;

#ifdef CONFIG_IPV6_SIT_6RD
	prefix_len = tunnel->ip6rd.prefixlen + 32
		- tunnel->ip6rd.relay_prefixlen;
#else
	prefix_len = 48;
#endif
	return ipv6_chk_custom_prefix(v6dst, prefix_len, tunnel->dev);
}

/* Returns true if a packet is spoofed */
static bool packet_is_spoofed(struct sk_buff *skb,
			      const struct iphdr *iph,
			      struct ip_tunnel *tunnel)
{
	const struct ipv6hdr *ipv6h;

	if (tunnel->dev->priv_flags & IFF_ISATAP) {
		if (!isatap_chksrc(skb, iph, tunnel))
			return true;

		return false;
	}

	if (tunnel->dev->flags & IFF_POINTOPOINT)
		return false;

	ipv6h = ipv6_hdr(skb);

	if (unlikely(is_spoofed_6rd(tunnel, iph->saddr, &ipv6h->saddr))) {
		net_warn_ratelimited("Src spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
				     &iph->saddr, &ipv6h->saddr,
				     &iph->daddr, &ipv6h->daddr);
		return true;
	}

	if (likely(!is_spoofed_6rd(tunnel, iph->daddr, &ipv6h->daddr)))
		return false;

	if (only_dnatted(tunnel, &ipv6h->daddr))
		return false;

	net_warn_ratelimited("Dst spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
			     &iph->saddr, &ipv6h->saddr,
			     &iph->daddr, &ipv6h->daddr);
	return true;
}

L
Linus Torvalds 已提交
632 633
static int ipip6_rcv(struct sk_buff *skb)
{
634
	const struct iphdr *iph = ip_hdr(skb);
L
Linus Torvalds 已提交
635
	struct ip_tunnel *tunnel;
636
	int err;
L
Linus Torvalds 已提交
637

638 639
	tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
				     iph->saddr, iph->daddr);
640
	if (tunnel) {
641
		struct pcpu_sw_netstats *tstats;
E
Eric Dumazet 已提交
642

643 644 645 646
		if (tunnel->parms.iph.protocol != IPPROTO_IPV6 &&
		    tunnel->parms.iph.protocol != 0)
			goto out;

647
		skb->mac_header = skb->network_header;
648
		skb_reset_network_header(skb);
649
		IPCB(skb)->flags = 0;
650
		skb->dev = tunnel->dev;
F
Fred L. Templin 已提交
651

652 653 654
		if (packet_is_spoofed(skb, iph, tunnel)) {
			tunnel->dev->stats.rx_errors++;
			goto out;
655 656
		}

657 658 659
		if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6),
		    !net_eq(tunnel->net, dev_net(tunnel->dev))))
			goto out;
660 661 662 663 664 665 666 667 668 669 670

		err = IP_ECN_decapsulate(iph, skb);
		if (unlikely(err)) {
			if (log_ecn_error)
				net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
						     &iph->saddr, iph->tos);
			if (err > 1) {
				++tunnel->dev->stats.rx_frame_errors;
				++tunnel->dev->stats.rx_errors;
				goto out;
			}
F
Fred L. Templin 已提交
671
		}
672

E
Eric Dumazet 已提交
673
		tstats = this_cpu_ptr(tunnel->dev->tstats);
674
		u64_stats_update_begin(&tstats->syncp);
E
Eric Dumazet 已提交
675 676
		tstats->rx_packets++;
		tstats->rx_bytes += skb->len;
677
		u64_stats_update_end(&tstats->syncp);
E
Eric Dumazet 已提交
678

679
		netif_rx(skb);
E
Eric Dumazet 已提交
680

L
Linus Torvalds 已提交
681 682 683
		return 0;
	}

684 685
	/* no tunnel matched,  let upstream know, ipsec may handle it */
	return 1;
L
Linus Torvalds 已提交
686
out:
687
	kfree_skb(skb);
L
Linus Torvalds 已提交
688 689 690
	return 0;
}

S
Simon Horman 已提交
691
static const struct tnl_ptk_info ipip_tpi = {
692 693 694 695
	/* no tunnel info required for ipip. */
	.proto = htons(ETH_P_IP),
};

S
Simon Horman 已提交
696 697 698 699 700 701 702 703
#if IS_ENABLED(CONFIG_MPLS)
static const struct tnl_ptk_info mplsip_tpi = {
	/* no tunnel info required for mplsip. */
	.proto = htons(ETH_P_MPLS_UC),
};
#endif

static int sit_tunnel_rcv(struct sk_buff *skb, u8 ipproto)
704
{
705
	const struct iphdr *iph;
706 707
	struct ip_tunnel *tunnel;

708
	iph = ip_hdr(skb);
709 710
	tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
				     iph->saddr, iph->daddr);
711
	if (tunnel) {
S
Simon Horman 已提交
712 713 714
		const struct tnl_ptk_info *tpi;

		if (tunnel->parms.iph.protocol != ipproto &&
715 716 717 718 719
		    tunnel->parms.iph.protocol != 0)
			goto drop;

		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
			goto drop;
S
Simon Horman 已提交
720 721 722 723 724 725 726
#if IS_ENABLED(CONFIG_MPLS)
		if (ipproto == IPPROTO_MPLS)
			tpi = &mplsip_tpi;
		else
#endif
			tpi = &ipip_tpi;
		if (iptunnel_pull_header(skb, 0, tpi->proto, false))
727
			goto drop;
S
Simon Horman 已提交
728
		return ip_tunnel_rcv(tunnel, skb, tpi, NULL, log_ecn_error);
729 730 731 732 733 734 735 736 737
	}

	return 1;

drop:
	kfree_skb(skb);
	return 0;
}

S
Simon Horman 已提交
738 739 740 741 742 743 744 745 746 747 748 749
static int ipip_rcv(struct sk_buff *skb)
{
	return sit_tunnel_rcv(skb, IPPROTO_IPIP);
}

#if IS_ENABLED(CONFIG_MPLS)
static int mplsip_rcv(struct sk_buff *skb)
{
	return sit_tunnel_rcv(skb, IPPROTO_MPLS);
}
#endif

750
/*
751 752
 * If the IPv6 address comes from 6rd / 6to4 (RFC 3056) addr space this function
 * stores the embedded IPv4 address in v4dst and returns true.
753
 */
754 755
static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
		      __be32 *v4dst)
L
Linus Torvalds 已提交
756
{
757 758 759
#ifdef CONFIG_IPV6_SIT_6RD
	if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
			      tunnel->ip6rd.prefixlen)) {
E
Eric Dumazet 已提交
760
		unsigned int pbw0, pbi0;
761 762 763 764 765 766
		int pbi1;
		u32 d;

		pbw0 = tunnel->ip6rd.prefixlen >> 5;
		pbi0 = tunnel->ip6rd.prefixlen & 0x1f;

767
		d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
768 769 770 771
		    tunnel->ip6rd.relay_prefixlen;

		pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
		if (pbi1 > 0)
772
			d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
773 774
			     (32 - pbi1);

775 776
		*v4dst = tunnel->ip6rd.relay_prefix | htonl(d);
		return true;
777 778
	}
#else
L
Linus Torvalds 已提交
779
	if (v6dst->s6_addr16[0] == htons(0x2002)) {
780
		/* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
781 782
		memcpy(v4dst, &v6dst->s6_addr16[1], 4);
		return true;
L
Linus Torvalds 已提交
783
	}
784
#endif
785 786 787 788 789 790 791 792
	return false;
}

static inline __be32 try_6rd(struct ip_tunnel *tunnel,
			     const struct in6_addr *v6dst)
{
	__be32 dst = 0;
	check_6rd(tunnel, v6dst, &dst);
L
Linus Torvalds 已提交
793 794 795 796 797 798 799 800
	return dst;
}

/*
 *	This function assumes it is being called from dev_queue_xmit()
 *	and that skb is filled properly by that function.
 */

801 802
static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
				     struct net_device *dev)
L
Linus Torvalds 已提交
803
{
804
	struct ip_tunnel *tunnel = netdev_priv(dev);
805 806
	const struct iphdr  *tiph = &tunnel->parms.iph;
	const struct ipv6hdr *iph6 = ipv6_hdr(skb);
L
Linus Torvalds 已提交
807
	u8     tos = tunnel->parms.iph.tos;
808
	__be16 df = tiph->frag_off;
809 810 811
	struct rtable *rt;		/* Route to the other host */
	struct net_device *tdev;	/* Device to other host */
	unsigned int max_headroom;	/* The extra header space needed */
A
Al Viro 已提交
812
	__be32 dst = tiph->daddr;
813
	struct flowi4 fl4;
L
Linus Torvalds 已提交
814
	int    mtu;
815
	const struct in6_addr *addr6;
L
Linus Torvalds 已提交
816
	int addr_type;
817
	u8 ttl;
818 819
	u8 protocol = IPPROTO_IPV6;
	int t_hlen = tunnel->hlen + sizeof(struct iphdr);
L
Linus Torvalds 已提交
820

821 822 823
	if (tos == 1)
		tos = ipv6_get_dsfield(iph6);

F
Fred L. Templin 已提交
824 825 826
	/* ISATAP (RFC4214) - must come before 6to4 */
	if (dev->priv_flags & IFF_ISATAP) {
		struct neighbour *neigh = NULL;
827
		bool do_tx_error = false;
F
Fred L. Templin 已提交
828

E
Eric Dumazet 已提交
829
		if (skb_dst(skb))
830
			neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
F
Fred L. Templin 已提交
831

832
		if (!neigh) {
833
			net_dbg_ratelimited("nexthop == NULL\n");
F
Fred L. Templin 已提交
834 835 836
			goto tx_error;
		}

E
Eldad Zack 已提交
837
		addr6 = (const struct in6_addr *)&neigh->primary_key;
F
Fred L. Templin 已提交
838 839 840 841 842 843
		addr_type = ipv6_addr_type(addr6);

		if ((addr_type & IPV6_ADDR_UNICAST) &&
		     ipv6_addr_is_isatap(addr6))
			dst = addr6->s6_addr32[3];
		else
844 845 846 847
			do_tx_error = true;

		neigh_release(neigh);
		if (do_tx_error)
F
Fred L. Templin 已提交
848 849 850
			goto tx_error;
	}

L
Linus Torvalds 已提交
851
	if (!dst)
852
		dst = try_6rd(tunnel, &iph6->daddr);
L
Linus Torvalds 已提交
853 854 855

	if (!dst) {
		struct neighbour *neigh = NULL;
856
		bool do_tx_error = false;
L
Linus Torvalds 已提交
857

E
Eric Dumazet 已提交
858
		if (skb_dst(skb))
859
			neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
L
Linus Torvalds 已提交
860

861
		if (!neigh) {
862
			net_dbg_ratelimited("nexthop == NULL\n");
L
Linus Torvalds 已提交
863 864 865
			goto tx_error;
		}

E
Eldad Zack 已提交
866
		addr6 = (const struct in6_addr *)&neigh->primary_key;
L
Linus Torvalds 已提交
867 868 869
		addr_type = ipv6_addr_type(addr6);

		if (addr_type == IPV6_ADDR_ANY) {
870
			addr6 = &ipv6_hdr(skb)->daddr;
L
Linus Torvalds 已提交
871 872 873
			addr_type = ipv6_addr_type(addr6);
		}

874 875 876 877
		if ((addr_type & IPV6_ADDR_COMPATv4) != 0)
			dst = addr6->s6_addr32[3];
		else
			do_tx_error = true;
L
Linus Torvalds 已提交
878

879 880 881
		neigh_release(neigh);
		if (do_tx_error)
			goto tx_error;
L
Linus Torvalds 已提交
882 883
	}

N
Nicolas Dichtel 已提交
884
	rt = ip_route_output_ports(tunnel->net, &fl4, NULL,
885 886 887 888 889 890 891
				   dst, tiph->saddr,
				   0, 0,
				   IPPROTO_IPV6, RT_TOS(tos),
				   tunnel->parms.link);
	if (IS_ERR(rt)) {
		dev->stats.tx_carrier_errors++;
		goto tx_error_icmp;
L
Linus Torvalds 已提交
892 893 894
	}
	if (rt->rt_type != RTN_UNICAST) {
		ip_rt_put(rt);
E
Eric Dumazet 已提交
895
		dev->stats.tx_carrier_errors++;
L
Linus Torvalds 已提交
896 897
		goto tx_error_icmp;
	}
898
	tdev = rt->dst.dev;
L
Linus Torvalds 已提交
899 900 901

	if (tdev == dev) {
		ip_rt_put(rt);
E
Eric Dumazet 已提交
902
		dev->stats.collisions++;
L
Linus Torvalds 已提交
903 904 905
		goto tx_error;
	}

906
	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4)) {
907
		ip_rt_put(rt);
908
		goto tx_error;
909 910
	}

911
	if (df) {
912
		mtu = dst_mtu(&rt->dst) - t_hlen;
L
Linus Torvalds 已提交
913

914
		if (mtu < 68) {
E
Eric Dumazet 已提交
915
			dev->stats.collisions++;
916 917 918
			ip_rt_put(rt);
			goto tx_error;
		}
L
Linus Torvalds 已提交
919

920 921 922 923 924 925
		if (mtu < IPV6_MIN_MTU) {
			mtu = IPV6_MIN_MTU;
			df = 0;
		}

		if (tunnel->parms.iph.daddr && skb_dst(skb))
926
			skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
927

928
		if (skb->len > mtu && !skb_is_gso(skb)) {
929
			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
930 931 932
			ip_rt_put(rt);
			goto tx_error;
		}
L
Linus Torvalds 已提交
933 934 935
	}

	if (tunnel->err_count > 0) {
936 937
		if (time_before(jiffies,
				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
L
Linus Torvalds 已提交
938 939 940 941 942 943 944 945 946
			tunnel->err_count--;
			dst_link_failure(skb);
		} else
			tunnel->err_count = 0;
	}

	/*
	 * Okay, now see if we can stuff it in the buffer as-is.
	 */
947
	max_headroom = LL_RESERVED_SPACE(tdev) + t_hlen;
L
Linus Torvalds 已提交
948

949 950
	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
L
Linus Torvalds 已提交
951 952 953
		struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
		if (!new_skb) {
			ip_rt_put(rt);
E
Eric Dumazet 已提交
954
			dev->stats.tx_dropped++;
955
			kfree_skb(skb);
956
			return NETDEV_TX_OK;
L
Linus Torvalds 已提交
957 958 959 960 961
		}
		if (skb->sk)
			skb_set_owner_w(new_skb, skb->sk);
		dev_kfree_skb(skb);
		skb = new_skb;
962
		iph6 = ipv6_hdr(skb);
L
Linus Torvalds 已提交
963
	}
964 965 966 967
	ttl = tiph->ttl;
	if (ttl == 0)
		ttl = iph6->hop_limit;
	tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
L
Linus Torvalds 已提交
968

969
	if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0) {
970
		ip_rt_put(rt);
971
		goto tx_error;
972
	}
973

T
Tom Herbert 已提交
974 975
	skb_set_inner_ipproto(skb, IPPROTO_IPV6);

976 977
	iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl,
		      df, !net_eq(tunnel->net, dev_net(dev)));
978
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
979 980 981 982

tx_error_icmp:
	dst_link_failure(skb);
tx_error:
983
	kfree_skb(skb);
E
Eric Dumazet 已提交
984
	dev->stats.tx_errors++;
985
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
986 987
}

S
Simon Horman 已提交
988 989
static netdev_tx_t sit_tunnel_xmit__(struct sk_buff *skb,
				     struct net_device *dev, u8 ipproto)
990 991 992 993
{
	struct ip_tunnel *tunnel = netdev_priv(dev);
	const struct iphdr  *tiph = &tunnel->parms.iph;

994
	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4))
995
		goto tx_error;
996

S
Simon Horman 已提交
997
	skb_set_inner_ipproto(skb, ipproto);
T
Tom Herbert 已提交
998

S
Simon Horman 已提交
999
	ip_tunnel_xmit(skb, dev, tiph, ipproto);
1000
	return NETDEV_TX_OK;
1001 1002
tx_error:
	kfree_skb(skb);
E
Eric Dumazet 已提交
1003 1004
	dev->stats.tx_errors++;
	return NETDEV_TX_OK;
1005 1006 1007 1008 1009 1010 1011
}

static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
				   struct net_device *dev)
{
	switch (skb->protocol) {
	case htons(ETH_P_IP):
S
Simon Horman 已提交
1012
		sit_tunnel_xmit__(skb, dev, IPPROTO_IPIP);
1013 1014 1015 1016
		break;
	case htons(ETH_P_IPV6):
		ipip6_tunnel_xmit(skb, dev);
		break;
S
Simon Horman 已提交
1017 1018 1019 1020 1021
#if IS_ENABLED(CONFIG_MPLS)
	case htons(ETH_P_MPLS_UC):
		sit_tunnel_xmit__(skb, dev, IPPROTO_MPLS);
		break;
#endif
1022 1023 1024 1025 1026 1027 1028 1029
	default:
		goto tx_err;
	}

	return NETDEV_TX_OK;

tx_err:
	dev->stats.tx_errors++;
1030
	kfree_skb(skb);
1031 1032 1033 1034
	return NETDEV_TX_OK;

}

1035 1036 1037 1038
static void ipip6_tunnel_bind_dev(struct net_device *dev)
{
	struct net_device *tdev = NULL;
	struct ip_tunnel *tunnel;
1039
	const struct iphdr *iph;
1040
	struct flowi4 fl4;
1041 1042 1043 1044 1045

	tunnel = netdev_priv(dev);
	iph = &tunnel->parms.iph;

	if (iph->daddr) {
N
Nicolas Dichtel 已提交
1046 1047
		struct rtable *rt = ip_route_output_ports(tunnel->net, &fl4,
							  NULL,
1048 1049 1050 1051 1052
							  iph->daddr, iph->saddr,
							  0, 0,
							  IPPROTO_IPV6,
							  RT_TOS(iph->tos),
							  tunnel->parms.link);
1053 1054

		if (!IS_ERR(rt)) {
1055
			tdev = rt->dst.dev;
1056 1057 1058 1059 1060 1061
			ip_rt_put(rt);
		}
		dev->flags |= IFF_POINTOPOINT;
	}

	if (!tdev && tunnel->parms.link)
N
Nicolas Dichtel 已提交
1062
		tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
1063 1064

	if (tdev) {
1065 1066
		int t_hlen = tunnel->hlen + sizeof(struct iphdr);

1067
		dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
1068
		dev->mtu = tdev->mtu - t_hlen;
1069 1070 1071 1072 1073
		if (dev->mtu < IPV6_MIN_MTU)
			dev->mtu = IPV6_MIN_MTU;
	}
}

1074 1075
static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
{
N
Nicolas Dichtel 已提交
1076
	struct net *net = t->net;
1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091
	struct sit_net *sitn = net_generic(net, sit_net_id);

	ipip6_tunnel_unlink(sitn, t);
	synchronize_net();
	t->parms.iph.saddr = p->iph.saddr;
	t->parms.iph.daddr = p->iph.daddr;
	memcpy(t->dev->dev_addr, &p->iph.saddr, 4);
	memcpy(t->dev->broadcast, &p->iph.daddr, 4);
	ipip6_tunnel_link(sitn, t);
	t->parms.iph.ttl = p->iph.ttl;
	t->parms.iph.tos = p->iph.tos;
	if (t->parms.link != p->link) {
		t->parms.link = p->link;
		ipip6_tunnel_bind_dev(t->dev);
	}
1092
	dst_cache_reset(&t->dst_cache);
1093 1094 1095
	netdev_state_change(t->dev);
}

1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122
#ifdef CONFIG_IPV6_SIT_6RD
static int ipip6_tunnel_update_6rd(struct ip_tunnel *t,
				   struct ip_tunnel_6rd *ip6rd)
{
	struct in6_addr prefix;
	__be32 relay_prefix;

	if (ip6rd->relay_prefixlen > 32 ||
	    ip6rd->prefixlen + (32 - ip6rd->relay_prefixlen) > 64)
		return -EINVAL;

	ipv6_addr_prefix(&prefix, &ip6rd->prefix, ip6rd->prefixlen);
	if (!ipv6_addr_equal(&prefix, &ip6rd->prefix))
		return -EINVAL;
	if (ip6rd->relay_prefixlen)
		relay_prefix = ip6rd->relay_prefix &
			       htonl(0xffffffffUL <<
				     (32 - ip6rd->relay_prefixlen));
	else
		relay_prefix = 0;
	if (relay_prefix != ip6rd->relay_prefix)
		return -EINVAL;

	t->ip6rd.prefix = prefix;
	t->ip6rd.relay_prefix = relay_prefix;
	t->ip6rd.prefixlen = ip6rd->prefixlen;
	t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;
1123
	dst_cache_reset(&t->dst_cache);
1124 1125 1126 1127 1128
	netdev_state_change(t->dev);
	return 0;
}
#endif

S
Simon Horman 已提交
1129 1130 1131 1132 1133 1134 1135 1136 1137 1138
bool ipip6_valid_ip_proto(u8 ipproto)
{
	return ipproto == IPPROTO_IPV6 ||
		ipproto == IPPROTO_IPIP ||
#if IS_ENABLED(CONFIG_MPLS)
		ipproto == IPPROTO_MPLS ||
#endif
		ipproto == 0;
}

L
Linus Torvalds 已提交
1139
static int
1140
ipip6_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
L
Linus Torvalds 已提交
1141 1142 1143
{
	int err = 0;
	struct ip_tunnel_parm p;
1144
	struct ip_tunnel_prl prl;
1145 1146
	struct ip_tunnel *t = netdev_priv(dev);
	struct net *net = t->net;
1147
	struct sit_net *sitn = net_generic(net, sit_net_id);
1148 1149 1150
#ifdef CONFIG_IPV6_SIT_6RD
	struct ip_tunnel_6rd ip6rd;
#endif
L
Linus Torvalds 已提交
1151 1152 1153

	switch (cmd) {
	case SIOCGETTUNNEL:
1154 1155 1156
#ifdef CONFIG_IPV6_SIT_6RD
	case SIOCGET6RD:
#endif
1157
		if (dev == sitn->fb_tunnel_dev) {
L
Linus Torvalds 已提交
1158 1159 1160 1161
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
				err = -EFAULT;
				break;
			}
1162
			t = ipip6_tunnel_locate(net, &p, 0);
1163
			if (!t)
1164
				t = netdev_priv(dev);
L
Linus Torvalds 已提交
1165
		}
1166 1167 1168 1169 1170 1171 1172 1173 1174

		err = -EFAULT;
		if (cmd == SIOCGETTUNNEL) {
			memcpy(&p, &t->parms, sizeof(p));
			if (copy_to_user(ifr->ifr_ifru.ifru_data, &p,
					 sizeof(p)))
				goto done;
#ifdef CONFIG_IPV6_SIT_6RD
		} else {
A
Alexey Dobriyan 已提交
1175
			ip6rd.prefix = t->ip6rd.prefix;
1176 1177 1178 1179 1180 1181 1182 1183 1184
			ip6rd.relay_prefix = t->ip6rd.relay_prefix;
			ip6rd.prefixlen = t->ip6rd.prefixlen;
			ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
			if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd,
					 sizeof(ip6rd)))
				goto done;
#endif
		}
		err = 0;
L
Linus Torvalds 已提交
1185 1186 1187 1188 1189
		break;

	case SIOCADDTUNNEL:
	case SIOCCHGTUNNEL:
		err = -EPERM;
1190
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
L
Linus Torvalds 已提交
1191 1192 1193 1194 1195 1196 1197
			goto done;

		err = -EFAULT;
		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
			goto done;

		err = -EINVAL;
S
Simon Horman 已提交
1198
		if (!ipip6_valid_ip_proto(p.iph.protocol))
1199 1200
			goto done;
		if (p.iph.version != 4 ||
L
Linus Torvalds 已提交
1201 1202 1203 1204 1205
		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
			goto done;
		if (p.iph.ttl)
			p.iph.frag_off |= htons(IP_DF);

1206
		t = ipip6_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
L
Linus Torvalds 已提交
1207

1208
		if (dev != sitn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
1209
			if (t) {
L
Linus Torvalds 已提交
1210 1211 1212 1213 1214 1215 1216 1217 1218 1219
				if (t->dev != dev) {
					err = -EEXIST;
					break;
				}
			} else {
				if (((dev->flags&IFF_POINTOPOINT) && !p.iph.daddr) ||
				    (!(dev->flags&IFF_POINTOPOINT) && p.iph.daddr)) {
					err = -EINVAL;
					break;
				}
1220
				t = netdev_priv(dev);
L
Linus Torvalds 已提交
1221
			}
1222

1223
			ipip6_tunnel_update(t, &p);
L
Linus Torvalds 已提交
1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235
		}

		if (t) {
			err = 0;
			if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
				err = -EFAULT;
		} else
			err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
		break;

	case SIOCDELTUNNEL:
		err = -EPERM;
1236
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
L
Linus Torvalds 已提交
1237 1238
			goto done;

1239
		if (dev == sitn->fb_tunnel_dev) {
L
Linus Torvalds 已提交
1240 1241 1242 1243
			err = -EFAULT;
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
				goto done;
			err = -ENOENT;
1244
			t = ipip6_tunnel_locate(net, &p, 0);
1245
			if (!t)
L
Linus Torvalds 已提交
1246 1247
				goto done;
			err = -EPERM;
1248
			if (t == netdev_priv(sitn->fb_tunnel_dev))
L
Linus Torvalds 已提交
1249 1250 1251
				goto done;
			dev = t->dev;
		}
1252 1253
		unregister_netdevice(dev);
		err = 0;
L
Linus Torvalds 已提交
1254 1255
		break;

1256
	case SIOCGETPRL:
1257 1258 1259 1260 1261 1262
		err = -EINVAL;
		if (dev == sitn->fb_tunnel_dev)
			goto done;
		err = ipip6_tunnel_get_prl(t, ifr->ifr_ifru.ifru_data);
		break;

1263 1264 1265 1266
	case SIOCADDPRL:
	case SIOCDELPRL:
	case SIOCCHGPRL:
		err = -EPERM;
1267
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1268 1269
			goto done;
		err = -EINVAL;
1270
		if (dev == sitn->fb_tunnel_dev)
1271 1272 1273 1274 1275
			goto done;
		err = -EFAULT;
		if (copy_from_user(&prl, ifr->ifr_ifru.ifru_data, sizeof(prl)))
			goto done;

1276 1277
		switch (cmd) {
		case SIOCDELPRL:
1278
			err = ipip6_tunnel_del_prl(t, &prl);
1279 1280 1281
			break;
		case SIOCADDPRL:
		case SIOCCHGPRL:
1282
			err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
1283 1284
			break;
		}
1285
		dst_cache_reset(&t->dst_cache);
1286
		netdev_state_change(dev);
1287 1288
		break;

1289 1290 1291 1292 1293
#ifdef CONFIG_IPV6_SIT_6RD
	case SIOCADD6RD:
	case SIOCCHG6RD:
	case SIOCDEL6RD:
		err = -EPERM;
1294
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1295 1296 1297 1298 1299 1300 1301 1302
			goto done;

		err = -EFAULT;
		if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data,
				   sizeof(ip6rd)))
			goto done;

		if (cmd != SIOCDEL6RD) {
1303 1304
			err = ipip6_tunnel_update_6rd(t, &ip6rd);
			if (err < 0)
1305 1306
				goto done;
		} else
1307
			ipip6_tunnel_clone_6rd(dev, sitn);
1308 1309 1310 1311 1312

		err = 0;
		break;
#endif

L
Linus Torvalds 已提交
1313 1314 1315 1316 1317 1318 1319 1320 1321 1322
	default:
		err = -EINVAL;
	}

done:
	return err;
}

static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
{
1323 1324 1325 1326
	struct ip_tunnel *tunnel = netdev_priv(dev);
	int t_hlen = tunnel->hlen + sizeof(struct iphdr);

	if (new_mtu < IPV6_MIN_MTU || new_mtu > 0xFFF8 - t_hlen)
L
Linus Torvalds 已提交
1327 1328 1329 1330 1331
		return -EINVAL;
	dev->mtu = new_mtu;
	return 0;
}

1332
static const struct net_device_ops ipip6_netdev_ops = {
1333
	.ndo_init	= ipip6_tunnel_init,
1334
	.ndo_uninit	= ipip6_tunnel_uninit,
1335
	.ndo_start_xmit	= sit_tunnel_xmit,
1336 1337
	.ndo_do_ioctl	= ipip6_tunnel_ioctl,
	.ndo_change_mtu	= ipip6_tunnel_change_mtu,
1338
	.ndo_get_stats64 = ip_tunnel_get_stats64,
1339
	.ndo_get_iflink = ip_tunnel_get_iflink,
1340 1341
};

E
Eric Dumazet 已提交
1342 1343
static void ipip6_dev_free(struct net_device *dev)
{
1344 1345
	struct ip_tunnel *tunnel = netdev_priv(dev);

1346
	dst_cache_destroy(&tunnel->dst_cache);
E
Eric Dumazet 已提交
1347 1348 1349 1350
	free_percpu(dev->tstats);
	free_netdev(dev);
}

E
Eric Dumazet 已提交
1351 1352 1353 1354 1355 1356
#define SIT_FEATURES (NETIF_F_SG	   | \
		      NETIF_F_FRAGLIST	   | \
		      NETIF_F_HIGHDMA	   | \
		      NETIF_F_GSO_SOFTWARE | \
		      NETIF_F_HW_CSUM)

L
Linus Torvalds 已提交
1357 1358
static void ipip6_tunnel_setup(struct net_device *dev)
{
1359 1360 1361
	struct ip_tunnel *tunnel = netdev_priv(dev);
	int t_hlen = tunnel->hlen + sizeof(struct iphdr);

1362
	dev->netdev_ops		= &ipip6_netdev_ops;
1363
	dev->destructor		= ipip6_dev_free;
L
Linus Torvalds 已提交
1364 1365

	dev->type		= ARPHRD_SIT;
1366 1367
	dev->hard_header_len	= LL_MAX_HEADER + t_hlen;
	dev->mtu		= ETH_DATA_LEN - t_hlen;
L
Linus Torvalds 已提交
1368
	dev->flags		= IFF_NOARP;
1369
	netif_keep_dst(dev);
L
Linus Torvalds 已提交
1370
	dev->addr_len		= 4;
E
Eric Dumazet 已提交
1371
	dev->features		|= NETIF_F_LLTX;
E
Eric Dumazet 已提交
1372 1373
	dev->features		|= SIT_FEATURES;
	dev->hw_features	|= SIT_FEATURES;
L
Linus Torvalds 已提交
1374 1375
}

E
Eric Dumazet 已提交
1376
static int ipip6_tunnel_init(struct net_device *dev)
L
Linus Torvalds 已提交
1377
{
1378
	struct ip_tunnel *tunnel = netdev_priv(dev);
1379
	int err;
L
Linus Torvalds 已提交
1380 1381

	tunnel->dev = dev;
N
Nicolas Dichtel 已提交
1382
	tunnel->net = dev_net(dev);
1383
	strcpy(tunnel->parms.name, dev->name);
L
Linus Torvalds 已提交
1384

1385
	ipip6_tunnel_bind_dev(dev);
1386
	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
E
Eric Dumazet 已提交
1387 1388 1389
	if (!dev->tstats)
		return -ENOMEM;

1390 1391
	err = dst_cache_init(&tunnel->dst_cache, GFP_KERNEL);
	if (err) {
1392
		free_percpu(dev->tstats);
1393
		return err;
1394 1395
	}

E
Eric Dumazet 已提交
1396
	return 0;
L
Linus Torvalds 已提交
1397 1398
}

1399
static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
L
Linus Torvalds 已提交
1400
{
1401
	struct ip_tunnel *tunnel = netdev_priv(dev);
L
Linus Torvalds 已提交
1402
	struct iphdr *iph = &tunnel->parms.iph;
1403 1404
	struct net *net = dev_net(dev);
	struct sit_net *sitn = net_generic(net, sit_net_id);
L
Linus Torvalds 已提交
1405 1406 1407 1408 1409 1410 1411

	iph->version		= 4;
	iph->protocol		= IPPROTO_IPV6;
	iph->ihl		= 5;
	iph->ttl		= 64;

	dev_hold(dev);
1412
	rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
L
Linus Torvalds 已提交
1413 1414
}

1415 1416 1417 1418
static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[])
{
	u8 proto;

1419
	if (!data || !data[IFLA_IPTUN_PROTO])
1420 1421 1422
		return 0;

	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
S
Simon Horman 已提交
1423
	if (!ipip6_valid_ip_proto(proto))
1424 1425 1426 1427 1428
		return -EINVAL;

	return 0;
}

1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445
static void ipip6_netlink_parms(struct nlattr *data[],
				struct ip_tunnel_parm *parms)
{
	memset(parms, 0, sizeof(*parms));

	parms->iph.version = 4;
	parms->iph.protocol = IPPROTO_IPV6;
	parms->iph.ihl = 5;
	parms->iph.ttl = 64;

	if (!data)
		return;

	if (data[IFLA_IPTUN_LINK])
		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);

	if (data[IFLA_IPTUN_LOCAL])
N
Nicolas Dichtel 已提交
1446
		parms->iph.saddr = nla_get_be32(data[IFLA_IPTUN_LOCAL]);
1447 1448

	if (data[IFLA_IPTUN_REMOTE])
N
Nicolas Dichtel 已提交
1449
		parms->iph.daddr = nla_get_be32(data[IFLA_IPTUN_REMOTE]);
1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463

	if (data[IFLA_IPTUN_TTL]) {
		parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
		if (parms->iph.ttl)
			parms->iph.frag_off = htons(IP_DF);
	}

	if (data[IFLA_IPTUN_TOS])
		parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);

	if (!data[IFLA_IPTUN_PMTUDISC] || nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
		parms->iph.frag_off = htons(IP_DF);

	if (data[IFLA_IPTUN_FLAGS])
N
Nicolas Dichtel 已提交
1464
		parms->i_flags = nla_get_be16(data[IFLA_IPTUN_FLAGS]);
1465 1466 1467 1468

	if (data[IFLA_IPTUN_PROTO])
		parms->iph.protocol = nla_get_u8(data[IFLA_IPTUN_PROTO]);

1469 1470
}

1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493
/* This function returns true when ENCAP attributes are present in the nl msg */
static bool ipip6_netlink_encap_parms(struct nlattr *data[],
				      struct ip_tunnel_encap *ipencap)
{
	bool ret = false;

	memset(ipencap, 0, sizeof(*ipencap));

	if (!data)
		return ret;

	if (data[IFLA_IPTUN_ENCAP_TYPE]) {
		ret = true;
		ipencap->type = nla_get_u16(data[IFLA_IPTUN_ENCAP_TYPE]);
	}

	if (data[IFLA_IPTUN_ENCAP_FLAGS]) {
		ret = true;
		ipencap->flags = nla_get_u16(data[IFLA_IPTUN_ENCAP_FLAGS]);
	}

	if (data[IFLA_IPTUN_ENCAP_SPORT]) {
		ret = true;
1494
		ipencap->sport = nla_get_be16(data[IFLA_IPTUN_ENCAP_SPORT]);
1495 1496 1497 1498
	}

	if (data[IFLA_IPTUN_ENCAP_DPORT]) {
		ret = true;
1499
		ipencap->dport = nla_get_be16(data[IFLA_IPTUN_ENCAP_DPORT]);
1500 1501 1502 1503 1504
	}

	return ret;
}

1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517
#ifdef CONFIG_IPV6_SIT_6RD
/* This function returns true when 6RD attributes are present in the nl msg */
static bool ipip6_netlink_6rd_parms(struct nlattr *data[],
				    struct ip_tunnel_6rd *ip6rd)
{
	bool ret = false;
	memset(ip6rd, 0, sizeof(*ip6rd));

	if (!data)
		return ret;

	if (data[IFLA_IPTUN_6RD_PREFIX]) {
		ret = true;
1518
		ip6rd->prefix = nla_get_in6_addr(data[IFLA_IPTUN_6RD_PREFIX]);
1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541
	}

	if (data[IFLA_IPTUN_6RD_RELAY_PREFIX]) {
		ret = true;
		ip6rd->relay_prefix =
			nla_get_be32(data[IFLA_IPTUN_6RD_RELAY_PREFIX]);
	}

	if (data[IFLA_IPTUN_6RD_PREFIXLEN]) {
		ret = true;
		ip6rd->prefixlen = nla_get_u16(data[IFLA_IPTUN_6RD_PREFIXLEN]);
	}

	if (data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]) {
		ret = true;
		ip6rd->relay_prefixlen =
			nla_get_u16(data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]);
	}

	return ret;
}
#endif

1542 1543 1544 1545 1546
static int ipip6_newlink(struct net *src_net, struct net_device *dev,
			 struct nlattr *tb[], struct nlattr *data[])
{
	struct net *net = dev_net(dev);
	struct ip_tunnel *nt;
1547
	struct ip_tunnel_encap ipencap;
1548 1549 1550 1551
#ifdef CONFIG_IPV6_SIT_6RD
	struct ip_tunnel_6rd ip6rd;
#endif
	int err;
1552 1553

	nt = netdev_priv(dev);
1554 1555 1556 1557 1558 1559 1560

	if (ipip6_netlink_encap_parms(data, &ipencap)) {
		err = ip_tunnel_encap_setup(nt, &ipencap);
		if (err < 0)
			return err;
	}

1561 1562 1563 1564 1565
	ipip6_netlink_parms(data, &nt->parms);

	if (ipip6_tunnel_locate(net, &nt->parms, 0))
		return -EEXIST;

1566 1567 1568 1569 1570 1571 1572 1573 1574 1575
	err = ipip6_tunnel_create(dev);
	if (err < 0)
		return err;

#ifdef CONFIG_IPV6_SIT_6RD
	if (ipip6_netlink_6rd_parms(data, &ip6rd))
		err = ipip6_tunnel_update_6rd(nt, &ip6rd);
#endif

	return err;
1576 1577 1578 1579 1580
}

static int ipip6_changelink(struct net_device *dev, struct nlattr *tb[],
			  struct nlattr *data[])
{
1581
	struct ip_tunnel *t = netdev_priv(dev);
1582
	struct ip_tunnel_parm p;
1583
	struct ip_tunnel_encap ipencap;
1584
	struct net *net = t->net;
1585
	struct sit_net *sitn = net_generic(net, sit_net_id);
1586 1587 1588
#ifdef CONFIG_IPV6_SIT_6RD
	struct ip_tunnel_6rd ip6rd;
#endif
1589
	int err;
1590 1591 1592 1593

	if (dev == sitn->fb_tunnel_dev)
		return -EINVAL;

1594 1595 1596 1597 1598 1599
	if (ipip6_netlink_encap_parms(data, &ipencap)) {
		err = ip_tunnel_encap_setup(t, &ipencap);
		if (err < 0)
			return err;
	}

1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614
	ipip6_netlink_parms(data, &p);

	if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) ||
	    (!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
		return -EINVAL;

	t = ipip6_tunnel_locate(net, &p, 0);

	if (t) {
		if (t->dev != dev)
			return -EEXIST;
	} else
		t = netdev_priv(dev);

	ipip6_tunnel_update(t, &p);
1615 1616 1617 1618 1619 1620

#ifdef CONFIG_IPV6_SIT_6RD
	if (ipip6_netlink_6rd_parms(data, &ip6rd))
		return ipip6_tunnel_update_6rd(t, &ip6rd);
#endif

1621 1622 1623
	return 0;
}

1624
static size_t ipip6_get_size(const struct net_device *dev)
1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636
{
	return
		/* IFLA_IPTUN_LINK */
		nla_total_size(4) +
		/* IFLA_IPTUN_LOCAL */
		nla_total_size(4) +
		/* IFLA_IPTUN_REMOTE */
		nla_total_size(4) +
		/* IFLA_IPTUN_TTL */
		nla_total_size(1) +
		/* IFLA_IPTUN_TOS */
		nla_total_size(1) +
1637 1638 1639 1640
		/* IFLA_IPTUN_PMTUDISC */
		nla_total_size(1) +
		/* IFLA_IPTUN_FLAGS */
		nla_total_size(2) +
1641 1642
		/* IFLA_IPTUN_PROTO */
		nla_total_size(1) +
1643 1644 1645 1646 1647 1648 1649 1650 1651 1652
#ifdef CONFIG_IPV6_SIT_6RD
		/* IFLA_IPTUN_6RD_PREFIX */
		nla_total_size(sizeof(struct in6_addr)) +
		/* IFLA_IPTUN_6RD_RELAY_PREFIX */
		nla_total_size(4) +
		/* IFLA_IPTUN_6RD_PREFIXLEN */
		nla_total_size(2) +
		/* IFLA_IPTUN_6RD_RELAY_PREFIXLEN */
		nla_total_size(2) +
#endif
1653 1654 1655 1656 1657 1658 1659 1660
		/* IFLA_IPTUN_ENCAP_TYPE */
		nla_total_size(2) +
		/* IFLA_IPTUN_ENCAP_FLAGS */
		nla_total_size(2) +
		/* IFLA_IPTUN_ENCAP_SPORT */
		nla_total_size(2) +
		/* IFLA_IPTUN_ENCAP_DPORT */
		nla_total_size(2) +
1661 1662 1663
		0;
}

1664
static int ipip6_fill_info(struct sk_buff *skb, const struct net_device *dev)
1665 1666 1667 1668 1669
{
	struct ip_tunnel *tunnel = netdev_priv(dev);
	struct ip_tunnel_parm *parm = &tunnel->parms;

	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
1670 1671
	    nla_put_in_addr(skb, IFLA_IPTUN_LOCAL, parm->iph.saddr) ||
	    nla_put_in_addr(skb, IFLA_IPTUN_REMOTE, parm->iph.daddr) ||
1672
	    nla_put_u8(skb, IFLA_IPTUN_TTL, parm->iph.ttl) ||
1673 1674 1675
	    nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
	    nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
		       !!(parm->iph.frag_off & htons(IP_DF))) ||
1676
	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->iph.protocol) ||
N
Nicolas Dichtel 已提交
1677
	    nla_put_be16(skb, IFLA_IPTUN_FLAGS, parm->i_flags))
1678
		goto nla_put_failure;
1679 1680

#ifdef CONFIG_IPV6_SIT_6RD
1681 1682 1683 1684
	if (nla_put_in6_addr(skb, IFLA_IPTUN_6RD_PREFIX,
			     &tunnel->ip6rd.prefix) ||
	    nla_put_in_addr(skb, IFLA_IPTUN_6RD_RELAY_PREFIX,
			    tunnel->ip6rd.relay_prefix) ||
1685 1686 1687 1688 1689 1690 1691
	    nla_put_u16(skb, IFLA_IPTUN_6RD_PREFIXLEN,
			tunnel->ip6rd.prefixlen) ||
	    nla_put_u16(skb, IFLA_IPTUN_6RD_RELAY_PREFIXLEN,
			tunnel->ip6rd.relay_prefixlen))
		goto nla_put_failure;
#endif

1692 1693
	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE,
			tunnel->encap.type) ||
1694
	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT,
1695
			tunnel->encap.sport) ||
1696
	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT,
1697 1698
			tunnel->encap.dport) ||
	    nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS,
1699
			tunnel->encap.flags))
1700 1701
		goto nla_put_failure;

1702 1703 1704 1705 1706 1707
	return 0;

nla_put_failure:
	return -EMSGSIZE;
}

1708 1709 1710 1711 1712 1713 1714 1715
static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
	[IFLA_IPTUN_LOCAL]		= { .type = NLA_U32 },
	[IFLA_IPTUN_REMOTE]		= { .type = NLA_U32 },
	[IFLA_IPTUN_TTL]		= { .type = NLA_U8 },
	[IFLA_IPTUN_TOS]		= { .type = NLA_U8 },
	[IFLA_IPTUN_PMTUDISC]		= { .type = NLA_U8 },
	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U16 },
1716
	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
1717 1718 1719 1720 1721 1722
#ifdef CONFIG_IPV6_SIT_6RD
	[IFLA_IPTUN_6RD_PREFIX]		= { .len = sizeof(struct in6_addr) },
	[IFLA_IPTUN_6RD_RELAY_PREFIX]	= { .type = NLA_U32 },
	[IFLA_IPTUN_6RD_PREFIXLEN]	= { .type = NLA_U16 },
	[IFLA_IPTUN_6RD_RELAY_PREFIXLEN] = { .type = NLA_U16 },
#endif
1723 1724 1725 1726
	[IFLA_IPTUN_ENCAP_TYPE]		= { .type = NLA_U16 },
	[IFLA_IPTUN_ENCAP_FLAGS]	= { .type = NLA_U16 },
	[IFLA_IPTUN_ENCAP_SPORT]	= { .type = NLA_U16 },
	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
1727 1728
};

1729 1730 1731 1732 1733 1734 1735 1736 1737
static void ipip6_dellink(struct net_device *dev, struct list_head *head)
{
	struct net *net = dev_net(dev);
	struct sit_net *sitn = net_generic(net, sit_net_id);

	if (dev != sitn->fb_tunnel_dev)
		unregister_netdevice_queue(dev, head);
}

1738 1739 1740
static struct rtnl_link_ops sit_link_ops __read_mostly = {
	.kind		= "sit",
	.maxtype	= IFLA_IPTUN_MAX,
1741
	.policy		= ipip6_policy,
1742
	.priv_size	= sizeof(struct ip_tunnel),
1743
	.setup		= ipip6_tunnel_setup,
1744
	.validate	= ipip6_validate,
1745 1746
	.newlink	= ipip6_newlink,
	.changelink	= ipip6_changelink,
1747 1748
	.get_size	= ipip6_get_size,
	.fill_info	= ipip6_fill_info,
1749
	.dellink	= ipip6_dellink,
1750
	.get_link_net	= ip_tunnel_get_link_net,
1751 1752
};

1753
static struct xfrm_tunnel sit_handler __read_mostly = {
L
Linus Torvalds 已提交
1754 1755
	.handler	=	ipip6_rcv,
	.err_handler	=	ipip6_err,
1756
	.priority	=	1,
L
Linus Torvalds 已提交
1757 1758
};

1759 1760 1761 1762 1763 1764
static struct xfrm_tunnel ipip_handler __read_mostly = {
	.handler	=	ipip_rcv,
	.err_handler	=	ipip6_err,
	.priority	=	2,
};

S
Simon Horman 已提交
1765 1766 1767 1768 1769 1770 1771 1772
#if IS_ENABLED(CONFIG_MPLS)
static struct xfrm_tunnel mplsip_handler __read_mostly = {
	.handler	=	mplsip_rcv,
	.err_handler	=	ipip6_err,
	.priority	=	2,
};
#endif

1773 1774
static void __net_exit sit_destroy_tunnels(struct net *net,
					   struct list_head *head)
1775
{
1776
	struct sit_net *sitn = net_generic(net, sit_net_id);
N
Nicolas Dichtel 已提交
1777
	struct net_device *dev, *aux;
1778 1779
	int prio;

N
Nicolas Dichtel 已提交
1780 1781 1782 1783
	for_each_netdev_safe(net, dev, aux)
		if (dev->rtnl_link_ops == &sit_link_ops)
			unregister_netdevice_queue(dev, head);

1784 1785
	for (prio = 1; prio < 4; prio++) {
		int h;
1786
		for (h = 0; h < IP6_SIT_HASH_SIZE; h++) {
1787
			struct ip_tunnel *t;
1788

1789
			t = rtnl_dereference(sitn->tunnels[prio][h]);
1790
			while (t) {
N
Nicolas Dichtel 已提交
1791 1792 1793
				/* If dev is in the same netns, it has already
				 * been added to the list by the previous loop.
				 */
1794
				if (!net_eq(dev_net(t->dev), net))
N
Nicolas Dichtel 已提交
1795 1796
					unregister_netdevice_queue(t->dev,
								   head);
1797
				t = rtnl_dereference(t->next);
1798
			}
1799 1800 1801 1802
		}
	}
}

1803
static int __net_init sit_init_net(struct net *net)
1804
{
1805
	struct sit_net *sitn = net_generic(net, sit_net_id);
1806
	struct ip_tunnel *t;
1807 1808
	int err;

1809 1810 1811 1812 1813
	sitn->tunnels[0] = sitn->tunnels_wc;
	sitn->tunnels[1] = sitn->tunnels_l;
	sitn->tunnels[2] = sitn->tunnels_r;
	sitn->tunnels[3] = sitn->tunnels_r_l;

1814
	sitn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "sit0",
1815
					   NET_NAME_UNKNOWN,
1816 1817 1818 1819 1820
					   ipip6_tunnel_setup);
	if (!sitn->fb_tunnel_dev) {
		err = -ENOMEM;
		goto err_alloc_dev;
	}
1821
	dev_net_set(sitn->fb_tunnel_dev, net);
1822
	sitn->fb_tunnel_dev->rtnl_link_ops = &sit_link_ops;
N
Nicolas Dichtel 已提交
1823 1824 1825 1826
	/* FB netdevice is special: we have one, and only one per netns.
	 * Allowing to move it to another netns is clearly unsafe.
	 */
	sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
1827

1828 1829
	err = register_netdev(sitn->fb_tunnel_dev);
	if (err)
1830 1831
		goto err_reg_dev;

1832 1833 1834
	ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
	ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);

1835 1836 1837
	t = netdev_priv(sitn->fb_tunnel_dev);

	strcpy(t->parms.name, sitn->fb_tunnel_dev->name);
1838 1839
	return 0;

1840
err_reg_dev:
E
Eric Dumazet 已提交
1841
	ipip6_dev_free(sitn->fb_tunnel_dev);
1842
err_alloc_dev:
1843 1844 1845
	return err;
}

1846
static void __net_exit sit_exit_net(struct net *net)
1847
{
1848
	LIST_HEAD(list);
1849

1850
	rtnl_lock();
1851
	sit_destroy_tunnels(net, &list);
1852
	unregister_netdevice_many(&list);
1853
	rtnl_unlock();
1854 1855 1856 1857 1858
}

static struct pernet_operations sit_net_ops = {
	.init = sit_init_net,
	.exit = sit_exit_net,
1859 1860
	.id   = &sit_net_id,
	.size = sizeof(struct sit_net),
1861 1862
};

1863
static void __exit sit_cleanup(void)
L
Linus Torvalds 已提交
1864
{
1865
	rtnl_link_unregister(&sit_link_ops);
1866
	xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
1867
	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
S
Simon Horman 已提交
1868 1869 1870
#if IS_ENABLED(CONFIG_MPLS)
	xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
#endif
1871

1872
	unregister_pernet_device(&sit_net_ops);
E
Eric Dumazet 已提交
1873
	rcu_barrier(); /* Wait for completion of call_rcu()'s */
L
Linus Torvalds 已提交
1874 1875
}

1876
static int __init sit_init(void)
L
Linus Torvalds 已提交
1877 1878 1879
{
	int err;

S
Simon Horman 已提交
1880
	pr_info("IPv6, IPv4 and MPLS over IPv4 tunneling driver\n");
L
Linus Torvalds 已提交
1881

1882
	err = register_pernet_device(&sit_net_ops);
1883
	if (err < 0)
1884 1885 1886
		return err;
	err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
	if (err < 0) {
1887
		pr_info("%s: can't register ip6ip4\n", __func__);
1888
		goto xfrm_tunnel_failed;
1889
	}
1890 1891 1892 1893 1894
	err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
	if (err < 0) {
		pr_info("%s: can't register ip4ip4\n", __func__);
		goto xfrm_tunnel4_failed;
	}
S
Simon Horman 已提交
1895 1896 1897 1898 1899 1900 1901
#if IS_ENABLED(CONFIG_MPLS)
	err = xfrm4_tunnel_register(&mplsip_handler, AF_MPLS);
	if (err < 0) {
		pr_info("%s: can't register mplsip\n", __func__);
		goto xfrm_tunnel_mpls_failed;
	}
#endif
1902 1903 1904 1905 1906
	err = rtnl_link_register(&sit_link_ops);
	if (err < 0)
		goto rtnl_link_failed;

out:
L
Linus Torvalds 已提交
1907
	return err;
1908 1909

rtnl_link_failed:
S
Simon Horman 已提交
1910 1911 1912 1913
#if IS_ENABLED(CONFIG_MPLS)
	xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
xfrm_tunnel_mpls_failed:
#endif
1914 1915
	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
xfrm_tunnel4_failed:
1916 1917 1918 1919
	xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
xfrm_tunnel_failed:
	unregister_pernet_device(&sit_net_ops);
	goto out;
L
Linus Torvalds 已提交
1920
}
1921 1922 1923

module_init(sit_init);
module_exit(sit_cleanup);
1924
MODULE_LICENSE("GPL");
1925
MODULE_ALIAS_RTNL_LINK("sit");
1926
MODULE_ALIAS_NETDEV("sit0");