ip6_tunnel.c 34.9 KB
Newer Older
L
Linus Torvalds 已提交
1
/*
2
 *	IPv6 tunneling device
L
Linus Torvalds 已提交
3 4 5
 *	Linux INET6 implementation
 *
 *	Authors:
6
 *	Ville Nuorvala		<vnuorval@tcs.hut.fi>
7
 *	Yasuyuki Kozakai	<kozakai@linux-ipv6.org>
L
Linus Torvalds 已提交
8 9
 *
 *      Based on:
10
 *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
L
Linus Torvalds 已提交
11 12 13 14 15 16 17 18 19 20 21
 *
 *      RFC 2473
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 */

#include <linux/module.h>
22
#include <linux/capability.h>
L
Linus Torvalds 已提交
23 24 25
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/sockios.h>
26
#include <linux/icmp.h>
L
Linus Torvalds 已提交
27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43
#include <linux/if.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/if_tunnel.h>
#include <linux/net.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/icmpv6.h>
#include <linux/init.h>
#include <linux/route.h>
#include <linux/rtnetlink.h>
#include <linux/netfilter_ipv6.h>

#include <asm/uaccess.h>
#include <asm/atomic.h>

44
#include <net/icmp.h>
L
Linus Torvalds 已提交
45 46 47 48 49 50 51 52
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/ip6_tunnel.h>
#include <net/xfrm.h>
#include <net/dsfield.h>
#include <net/inet_ecn.h>
53 54
#include <net/net_namespace.h>
#include <net/netns/generic.h>
L
Linus Torvalds 已提交
55 56

MODULE_AUTHOR("Ville Nuorvala");
57
MODULE_DESCRIPTION("IPv6 tunneling device");
L
Linus Torvalds 已提交
58 59 60 61 62
MODULE_LICENSE("GPL");

#define IPV6_TLV_TEL_DST_SIZE 8

#ifdef IP6_TNL_DEBUG
63
#define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
L
Linus Torvalds 已提交
64 65 66 67 68
#else
#define IP6_TNL_TRACE(x...) do {;} while(0)
#endif

#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
69
#define IPV6_TCLASS_SHIFT 20
L
Linus Torvalds 已提交
70 71 72

#define HASH_SIZE  32

A
Al Viro 已提交
73
#define HASH(addr) ((__force u32)((addr)->s6_addr32[0] ^ (addr)->s6_addr32[1] ^ \
74 75
		     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
		    (HASH_SIZE - 1))
L
Linus Torvalds 已提交
76

77 78
static void ip6_fb_tnl_dev_init(struct net_device *dev);
static void ip6_tnl_dev_init(struct net_device *dev);
79
static void ip6_tnl_dev_setup(struct net_device *dev);
L
Linus Torvalds 已提交
80

81
static int ip6_tnl_net_id __read_mostly;
82
struct ip6_tnl_net {
83 84
	/* the IPv6 tunnel fallback device */
	struct net_device *fb_tnl_dev;
85 86 87 88
	/* lists for storing tunnels in use */
	struct ip6_tnl *tnls_r_l[HASH_SIZE];
	struct ip6_tnl *tnls_wc[1];
	struct ip6_tnl **tnls[2];
89 90
};

91 92 93 94
/*
 * Locking : hash tables are protected by RCU and a spinlock
 */
static DEFINE_SPINLOCK(ip6_tnl_lock);
L
Linus Torvalds 已提交
95 96 97 98 99

static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
{
	struct dst_entry *dst = t->dst_cache;

100
	if (dst && dst->obsolete &&
L
Linus Torvalds 已提交
101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124
	    dst->ops->check(dst, t->dst_cookie) == NULL) {
		t->dst_cache = NULL;
		dst_release(dst);
		return NULL;
	}

	return dst;
}

static inline void ip6_tnl_dst_reset(struct ip6_tnl *t)
{
	dst_release(t->dst_cache);
	t->dst_cache = NULL;
}

static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
{
	struct rt6_info *rt = (struct rt6_info *) dst;
	t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
	dst_release(t->dst_cache);
	t->dst_cache = dst;
}

/**
125
 * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
126 127
 *   @remote: the address of the tunnel exit-point
 *   @local: the address of the tunnel entry-point
L
Linus Torvalds 已提交
128
 *
129
 * Return:
L
Linus Torvalds 已提交
130
 *   tunnel matching given end-points if found,
131
 *   else fallback tunnel if its device is up,
L
Linus Torvalds 已提交
132 133 134
 *   else %NULL
 **/

135 136 137
#define for_each_ip6_tunnel_rcu(start) \
	for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))

L
Linus Torvalds 已提交
138
static struct ip6_tnl *
139
ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
L
Linus Torvalds 已提交
140 141 142 143
{
	unsigned h0 = HASH(remote);
	unsigned h1 = HASH(local);
	struct ip6_tnl *t;
144
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
145

146
	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[h0 ^ h1]) {
L
Linus Torvalds 已提交
147 148 149 150 151
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
		    ipv6_addr_equal(remote, &t->parms.raddr) &&
		    (t->dev->flags & IFF_UP))
			return t;
	}
152 153
	t = rcu_dereference(ip6n->tnls_wc[0]);
	if (t && (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
154 155 156 157 158 159
		return t;

	return NULL;
}

/**
160
 * ip6_tnl_bucket - get head of list matching given tunnel parameters
161
 *   @p: parameters containing tunnel end-points
L
Linus Torvalds 已提交
162 163
 *
 * Description:
164
 *   ip6_tnl_bucket() returns the head of the list matching the
L
Linus Torvalds 已提交
165 166
 *   &struct in6_addr entries laddr and raddr in @p.
 *
167
 * Return: head of IPv6 tunnel list
L
Linus Torvalds 已提交
168 169 170
 **/

static struct ip6_tnl **
171
ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
172 173 174 175 176 177 178 179 180 181
{
	struct in6_addr *remote = &p->raddr;
	struct in6_addr *local = &p->laddr;
	unsigned h = 0;
	int prio = 0;

	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
		prio = 1;
		h = HASH(remote) ^ HASH(local);
	}
182
	return &ip6n->tnls[prio][h];
L
Linus Torvalds 已提交
183 184 185
}

/**
186
 * ip6_tnl_link - add tunnel to hash table
L
Linus Torvalds 已提交
187 188 189 190
 *   @t: tunnel to be added
 **/

static void
191
ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
192
{
193
	struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
L
Linus Torvalds 已提交
194

195
	spin_lock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
196
	t->next = *tp;
197 198
	rcu_assign_pointer(*tp, t);
	spin_unlock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
199 200 201
}

/**
202
 * ip6_tnl_unlink - remove tunnel from hash table
L
Linus Torvalds 已提交
203 204 205 206
 *   @t: tunnel to be removed
 **/

static void
207
ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
208 209 210
{
	struct ip6_tnl **tp;

211
	for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
L
Linus Torvalds 已提交
212
		if (t == *tp) {
213
			spin_lock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
214
			*tp = t->next;
215
			spin_unlock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
216 217 218 219 220 221 222 223 224 225 226 227
			break;
		}
	}
}

/**
 * ip6_tnl_create() - create a new tunnel
 *   @p: tunnel parameters
 *   @pt: pointer to new tunnel
 *
 * Description:
 *   Create tunnel matching given parameters.
228 229
 *
 * Return:
230
 *   created tunnel or NULL
L
Linus Torvalds 已提交
231 232
 **/

233
static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
234 235 236 237 238
{
	struct net_device *dev;
	struct ip6_tnl *t;
	char name[IFNAMSIZ];
	int err;
239
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
240

241
	if (p->name[0])
L
Linus Torvalds 已提交
242
		strlcpy(name, p->name, IFNAMSIZ);
243 244 245
	else
		sprintf(name, "ip6tnl%%d");

246
	dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup);
L
Linus Torvalds 已提交
247
	if (dev == NULL)
248
		goto failed;
L
Linus Torvalds 已提交
249

250 251
	dev_net_set(dev, net);

252 253 254 255 256
	if (strchr(name, '%')) {
		if (dev_alloc_name(dev, name) < 0)
			goto failed_free;
	}

257
	t = netdev_priv(dev);
L
Linus Torvalds 已提交
258
	t->parms = *p;
259
	ip6_tnl_dev_init(dev);
L
Linus Torvalds 已提交
260

261 262 263
	if ((err = register_netdevice(dev)) < 0)
		goto failed_free;

L
Linus Torvalds 已提交
264
	dev_hold(dev);
265
	ip6_tnl_link(ip6n, t);
266
	return t;
267 268 269

failed_free:
	free_netdev(dev);
270 271
failed:
	return NULL;
L
Linus Torvalds 已提交
272 273 274
}

/**
275
 * ip6_tnl_locate - find or create tunnel matching given parameters
276
 *   @p: tunnel parameters
L
Linus Torvalds 已提交
277 278 279
 *   @create: != 0 if allowed to create new tunnel if no match found
 *
 * Description:
280
 *   ip6_tnl_locate() first tries to locate an existing tunnel
L
Linus Torvalds 已提交
281 282 283 284
 *   based on @parms. If this is unsuccessful, but @create is set a new
 *   tunnel device is created and registered for use.
 *
 * Return:
285
 *   matching tunnel or NULL
L
Linus Torvalds 已提交
286 287
 **/

288 289
static struct ip6_tnl *ip6_tnl_locate(struct net *net,
		struct ip6_tnl_parm *p, int create)
L
Linus Torvalds 已提交
290 291 292 293
{
	struct in6_addr *remote = &p->raddr;
	struct in6_addr *local = &p->laddr;
	struct ip6_tnl *t;
294
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
295

296
	for (t = *ip6_tnl_bucket(ip6n, p); t; t = t->next) {
L
Linus Torvalds 已提交
297
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
298 299
		    ipv6_addr_equal(remote, &t->parms.raddr))
			return t;
L
Linus Torvalds 已提交
300 301
	}
	if (!create)
302
		return NULL;
303
	return ip6_tnl_create(net, p);
L
Linus Torvalds 已提交
304 305 306
}

/**
307
 * ip6_tnl_dev_uninit - tunnel device uninitializer
L
Linus Torvalds 已提交
308
 *   @dev: the device to be destroyed
309
 *
L
Linus Torvalds 已提交
310
 * Description:
311
 *   ip6_tnl_dev_uninit() removes tunnel from its list
L
Linus Torvalds 已提交
312 313 314
 **/

static void
315
ip6_tnl_dev_uninit(struct net_device *dev)
L
Linus Torvalds 已提交
316
{
317
	struct ip6_tnl *t = netdev_priv(dev);
318 319
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
320

321
	if (dev == ip6n->fb_tnl_dev) {
322
		spin_lock_bh(&ip6_tnl_lock);
323
		ip6n->tnls_wc[0] = NULL;
324
		spin_unlock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
325
	} else {
326
		ip6_tnl_unlink(ip6n, t);
L
Linus Torvalds 已提交
327 328 329 330 331 332 333 334 335
	}
	ip6_tnl_dst_reset(t);
	dev_put(dev);
}

/**
 * parse_tvl_tnl_enc_lim - handle encapsulation limit option
 *   @skb: received socket buffer
 *
336 337
 * Return:
 *   0 if none was found,
L
Linus Torvalds 已提交
338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393
 *   else index to encapsulation limit
 **/

static __u16
parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
{
	struct ipv6hdr *ipv6h = (struct ipv6hdr *) raw;
	__u8 nexthdr = ipv6h->nexthdr;
	__u16 off = sizeof (*ipv6h);

	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
		__u16 optlen = 0;
		struct ipv6_opt_hdr *hdr;
		if (raw + off + sizeof (*hdr) > skb->data &&
		    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
			break;

		hdr = (struct ipv6_opt_hdr *) (raw + off);
		if (nexthdr == NEXTHDR_FRAGMENT) {
			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
			if (frag_hdr->frag_off)
				break;
			optlen = 8;
		} else if (nexthdr == NEXTHDR_AUTH) {
			optlen = (hdr->hdrlen + 2) << 2;
		} else {
			optlen = ipv6_optlen(hdr);
		}
		if (nexthdr == NEXTHDR_DEST) {
			__u16 i = off + 2;
			while (1) {
				struct ipv6_tlv_tnl_enc_lim *tel;

				/* No more room for encapsulation limit */
				if (i + sizeof (*tel) > off + optlen)
					break;

				tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
				/* return index of option if found and valid */
				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
				    tel->length == 1)
					return i;
				/* else jump to next option */
				if (tel->type)
					i += tel->length + 2;
				else
					i++;
			}
		}
		nexthdr = hdr->nexthdr;
		off += optlen;
	}
	return 0;
}

/**
394
 * ip6_tnl_err - tunnel error handler
L
Linus Torvalds 已提交
395 396
 *
 * Description:
397
 *   ip6_tnl_err() should handle errors in the tunnel according
L
Linus Torvalds 已提交
398 399 400
 *   to the specifications in RFC 2473.
 **/

H
Herbert Xu 已提交
401
static int
402
ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
403
	    u8 *type, u8 *code, int *msg, __u32 *info, int offset)
L
Linus Torvalds 已提交
404 405 406 407
{
	struct ipv6hdr *ipv6h = (struct ipv6hdr *) skb->data;
	struct ip6_tnl *t;
	int rel_msg = 0;
408 409
	u8 rel_type = ICMPV6_DEST_UNREACH;
	u8 rel_code = ICMPV6_ADDR_UNREACH;
L
Linus Torvalds 已提交
410 411
	__u32 rel_info = 0;
	__u16 len;
H
Herbert Xu 已提交
412
	int err = -ENOENT;
L
Linus Torvalds 已提交
413

414 415
	/* If the packet doesn't contain the original IPv6 header we are
	   in trouble since we might need the source address for further
L
Linus Torvalds 已提交
416 417
	   processing of the error. */

418
	rcu_read_lock();
419
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
420
					&ipv6h->saddr)) == NULL)
L
Linus Torvalds 已提交
421 422
		goto out;

423 424 425
	if (t->parms.proto != ipproto && t->parms.proto != 0)
		goto out;

H
Herbert Xu 已提交
426 427
	err = 0;

428
	switch (*type) {
L
Linus Torvalds 已提交
429 430 431 432 433 434 435 436 437 438 439
		__u32 teli;
		struct ipv6_tlv_tnl_enc_lim *tel;
		__u32 mtu;
	case ICMPV6_DEST_UNREACH:
		if (net_ratelimit())
			printk(KERN_WARNING
			       "%s: Path to destination invalid "
			       "or inactive!\n", t->parms.name);
		rel_msg = 1;
		break;
	case ICMPV6_TIME_EXCEED:
440
		if ((*code) == ICMPV6_EXC_HOPLIMIT) {
L
Linus Torvalds 已提交
441 442 443
			if (net_ratelimit())
				printk(KERN_WARNING
				       "%s: Too small hop limit or "
444
				       "routing loop in tunnel!\n",
L
Linus Torvalds 已提交
445 446 447 448 449
				       t->parms.name);
			rel_msg = 1;
		}
		break;
	case ICMPV6_PARAMPROB:
450
		teli = 0;
451
		if ((*code) == ICMPV6_HDR_FIELD)
452
			teli = parse_tlv_tnl_enc_lim(skb, skb->data);
L
Linus Torvalds 已提交
453

A
Al Viro 已提交
454
		if (teli && teli == *info - 2) {
L
Linus Torvalds 已提交
455 456 457 458 459 460 461 462 463
			tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
			if (tel->encap_limit == 0) {
				if (net_ratelimit())
					printk(KERN_WARNING
					       "%s: Too small encapsulation "
					       "limit or routing loop in "
					       "tunnel!\n", t->parms.name);
				rel_msg = 1;
			}
464 465 466 467
		} else if (net_ratelimit()) {
			printk(KERN_WARNING
			       "%s: Recipient unable to parse tunneled "
			       "packet!\n ", t->parms.name);
L
Linus Torvalds 已提交
468 469 470
		}
		break;
	case ICMPV6_PKT_TOOBIG:
A
Al Viro 已提交
471
		mtu = *info - offset;
L
Linus Torvalds 已提交
472 473 474 475
		if (mtu < IPV6_MIN_MTU)
			mtu = IPV6_MIN_MTU;
		t->dev->mtu = mtu;

A
Al Viro 已提交
476
		if ((len = sizeof (*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
L
Linus Torvalds 已提交
477 478 479 480 481 482 483
			rel_type = ICMPV6_PKT_TOOBIG;
			rel_code = 0;
			rel_info = mtu;
			rel_msg = 1;
		}
		break;
	}
484 485 486 487 488 489 490

	*type = rel_type;
	*code = rel_code;
	*info = rel_info;
	*msg = rel_msg;

out:
491
	rcu_read_unlock();
492 493 494
	return err;
}

495 496
static int
ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
497
	   u8 type, u8 code, int offset, __be32 info)
498 499
{
	int rel_msg = 0;
500 501
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
502
	__u32 rel_info = ntohl(info);
503 504 505 506 507 508
	int err;
	struct sk_buff *skb2;
	struct iphdr *eiph;
	struct flowi fl;
	struct rtable *rt;

509 510
	err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540
	if (err < 0)
		return err;

	if (rel_msg == 0)
		return 0;

	switch (rel_type) {
	case ICMPV6_DEST_UNREACH:
		if (rel_code != ICMPV6_ADDR_UNREACH)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_HOST_UNREACH;
		break;
	case ICMPV6_PKT_TOOBIG:
		if (rel_code != 0)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_FRAG_NEEDED;
		break;
	default:
		return 0;
	}

	if (!pskb_may_pull(skb, offset + sizeof(struct iphdr)))
		return 0;

	skb2 = skb_clone(skb, GFP_ATOMIC);
	if (!skb2)
		return 0;

E
Eric Dumazet 已提交
541 542
	skb_dst_drop(skb2);

543
	skb_pull(skb2, offset);
544
	skb_reset_network_header(skb2);
545
	eiph = ip_hdr(skb2);
546 547 548 549 550 551

	/* Try to guess incoming interface */
	memset(&fl, 0, sizeof(fl));
	fl.fl4_dst = eiph->saddr;
	fl.fl4_tos = RT_TOS(eiph->tos);
	fl.proto = IPPROTO_IPIP;
552
	if (ip_route_output_key(dev_net(skb->dev), &rt, &fl))
553 554 555 556 557 558 559 560 561 562 563
		goto out;

	skb2->dev = rt->u.dst.dev;

	/* route "incoming" packet */
	if (rt->rt_flags & RTCF_LOCAL) {
		ip_rt_put(rt);
		rt = NULL;
		fl.fl4_dst = eiph->daddr;
		fl.fl4_src = eiph->saddr;
		fl.fl4_tos = eiph->tos;
564
		if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
565 566 567 568
		    rt->u.dst.dev->type != ARPHRD_TUNNEL) {
			ip_rt_put(rt);
			goto out;
		}
E
Eric Dumazet 已提交
569
		skb_dst_set(skb2, (struct dst_entry *)rt);
570 571 572 573
	} else {
		ip_rt_put(rt);
		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
				   skb2->dev) ||
E
Eric Dumazet 已提交
574
		    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
575 576 577 578 579
			goto out;
	}

	/* change mtu on this route */
	if (rel_type == ICMP_DEST_UNREACH && rel_code == ICMP_FRAG_NEEDED) {
E
Eric Dumazet 已提交
580
		if (rel_info > dst_mtu(skb_dst(skb2)))
581 582
			goto out;

E
Eric Dumazet 已提交
583
		skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), rel_info);
584 585
	}

A
Al Viro 已提交
586
	icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
587 588 589 590 591 592

out:
	kfree_skb(skb2);
	return 0;
}

593 594
static int
ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
595
	   u8 type, u8 code, int offset, __be32 info)
596 597
{
	int rel_msg = 0;
598 599
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
600
	__u32 rel_info = ntohl(info);
601 602
	int err;

603 604
	err = ip6_tnl_err(skb, IPPROTO_IPV6, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
605 606 607 608
	if (err < 0)
		return err;

	if (rel_msg && pskb_may_pull(skb, offset + sizeof(struct ipv6hdr))) {
L
Linus Torvalds 已提交
609 610
		struct rt6_info *rt;
		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
611

L
Linus Torvalds 已提交
612
		if (!skb2)
613
			return 0;
L
Linus Torvalds 已提交
614

E
Eric Dumazet 已提交
615
		skb_dst_drop(skb2);
L
Linus Torvalds 已提交
616
		skb_pull(skb2, offset);
617
		skb_reset_network_header(skb2);
L
Linus Torvalds 已提交
618 619

		/* Try to guess incoming interface */
620 621
		rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr,
				NULL, 0, 0);
L
Linus Torvalds 已提交
622 623 624 625 626 627 628 629 630 631 632

		if (rt && rt->rt6i_dev)
			skb2->dev = rt->rt6i_dev;

		icmpv6_send(skb2, rel_type, rel_code, rel_info, skb2->dev);

		if (rt)
			dst_release(&rt->u.dst);

		kfree_skb(skb2);
	}
633 634

	return 0;
L
Linus Torvalds 已提交
635 636
}

637 638 639 640 641 642 643
static void ip4ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
					struct ipv6hdr *ipv6h,
					struct sk_buff *skb)
{
	__u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;

	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
644
		ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
645 646

	if (INET_ECN_is_ce(dsfield))
647
		IP_ECN_set_ce(ip_hdr(skb));
648 649
}

650 651 652
static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
					struct ipv6hdr *ipv6h,
					struct sk_buff *skb)
L
Linus Torvalds 已提交
653
{
654
	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
655
		ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
L
Linus Torvalds 已提交
656

657
	if (INET_ECN_is_ce(ipv6_get_dsfield(ipv6h)))
658
		IP6_ECN_set_ce(ipv6_hdr(skb));
L
Linus Torvalds 已提交
659
}
660

E
Eric Dumazet 已提交
661
/* called with rcu_read_lock() */
662 663 664 665
static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
	int ret = 0;
666
	struct net *net = dev_net(t->dev);
667 668

	if (p->flags & IP6_TNL_F_CAP_RCV) {
669
		struct net_device *ldev = NULL;
670 671

		if (p->link)
E
Eric Dumazet 已提交
672
			ldev = dev_get_by_index_rcu(net, p->link);
673 674

		if ((ipv6_addr_is_multicast(&p->laddr) ||
675 676
		     likely(ipv6_chk_addr(net, &p->laddr, ldev, 0))) &&
		    likely(!ipv6_chk_addr(net, &p->raddr, NULL, 0)))
677 678 679 680 681
			ret = 1;

	}
	return ret;
}
L
Linus Torvalds 已提交
682 683

/**
684
 * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
L
Linus Torvalds 已提交
685
 *   @skb: received socket buffer
686 687
 *   @protocol: ethernet protocol ID
 *   @dscp_ecn_decapsulate: the function to decapsulate DSCP code and ECN
L
Linus Torvalds 已提交
688 689 690 691
 *
 * Return: 0
 **/

692
static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
693
		       __u8 ipproto,
694 695 696
		       void (*dscp_ecn_decapsulate)(struct ip6_tnl *t,
						    struct ipv6hdr *ipv6h,
						    struct sk_buff *skb))
L
Linus Torvalds 已提交
697 698
{
	struct ip6_tnl *t;
699
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
L
Linus Torvalds 已提交
700

701
	rcu_read_lock();
L
Linus Torvalds 已提交
702

703
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
704
					&ipv6h->daddr)) != NULL) {
705
		if (t->parms.proto != ipproto && t->parms.proto != 0) {
706
			rcu_read_unlock();
707 708 709
			goto discard;
		}

L
Linus Torvalds 已提交
710
		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
711
			rcu_read_unlock();
712
			goto discard;
L
Linus Torvalds 已提交
713 714
		}

715
		if (!ip6_tnl_rcv_ctl(t)) {
716
			t->dev->stats.rx_dropped++;
717
			rcu_read_unlock();
L
Linus Torvalds 已提交
718 719 720
			goto discard;
		}
		secpath_reset(skb);
721
		skb->mac_header = skb->network_header;
722
		skb_reset_network_header(skb);
723
		skb->protocol = htons(protocol);
L
Linus Torvalds 已提交
724 725 726
		skb->pkt_type = PACKET_HOST;
		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
		skb->dev = t->dev;
E
Eric Dumazet 已提交
727
		skb_dst_drop(skb);
728
		nf_reset(skb);
729 730 731

		dscp_ecn_decapsulate(t, ipv6h, skb);

732 733
		t->dev->stats.rx_packets++;
		t->dev->stats.rx_bytes += skb->len;
L
Linus Torvalds 已提交
734
		netif_rx(skb);
735
		rcu_read_unlock();
L
Linus Torvalds 已提交
736 737
		return 0;
	}
738
	rcu_read_unlock();
L
Linus Torvalds 已提交
739
	return 1;
740 741 742 743

discard:
	kfree_skb(skb);
	return 0;
L
Linus Torvalds 已提交
744 745
}

746 747
static int ip4ip6_rcv(struct sk_buff *skb)
{
748 749
	return ip6_tnl_rcv(skb, ETH_P_IP, IPPROTO_IPIP,
			   ip4ip6_dscp_ecn_decapsulate);
750 751
}

752 753
static int ip6ip6_rcv(struct sk_buff *skb)
{
754 755
	return ip6_tnl_rcv(skb, ETH_P_IPV6, IPPROTO_IPV6,
			   ip6ip6_dscp_ecn_decapsulate);
756 757
}

758 759 760 761
struct ipv6_tel_txoption {
	struct ipv6_txoptions ops;
	__u8 dst_opt[8];
};
L
Linus Torvalds 已提交
762

763 764 765
static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
{
	memset(opt, 0, sizeof(struct ipv6_tel_txoption));
L
Linus Torvalds 已提交
766

767 768 769 770 771
	opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
	opt->dst_opt[3] = 1;
	opt->dst_opt[4] = encap_limit;
	opt->dst_opt[5] = IPV6_TLV_PADN;
	opt->dst_opt[6] = 1;
L
Linus Torvalds 已提交
772

773 774
	opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
	opt->ops.opt_nflen = 8;
L
Linus Torvalds 已提交
775 776 777
}

/**
778
 * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
L
Linus Torvalds 已提交
779
 *   @t: the outgoing tunnel device
780
 *   @hdr: IPv6 header from the incoming packet
L
Linus Torvalds 已提交
781 782
 *
 * Description:
783
 *   Avoid trivial tunneling loop by checking that tunnel exit-point
L
Linus Torvalds 已提交
784 785
 *   doesn't match source of incoming packet.
 *
786
 * Return:
L
Linus Torvalds 已提交
787 788 789 790 791
 *   1 if conflict,
 *   0 else
 **/

static inline int
792
ip6_tnl_addr_conflict(struct ip6_tnl *t, struct ipv6hdr *hdr)
L
Linus Torvalds 已提交
793 794 795 796
{
	return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
}

797 798 799 800
static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
	int ret = 0;
801
	struct net *net = dev_net(t->dev);
802

803
	if (p->flags & IP6_TNL_F_CAP_XMIT) {
804 805
		struct net_device *ldev = NULL;

E
Eric Dumazet 已提交
806
		rcu_read_lock();
807
		if (p->link)
E
Eric Dumazet 已提交
808
			ldev = dev_get_by_index_rcu(net, p->link);
809

810
		if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
811 812 813 814
			printk(KERN_WARNING
			       "%s xmit: Local address not yet configured!\n",
			       p->name);
		else if (!ipv6_addr_is_multicast(&p->raddr) &&
815
			 unlikely(ipv6_chk_addr(net, &p->raddr, NULL, 0)))
816 817 818 819 820 821
			printk(KERN_WARNING
			       "%s xmit: Routing loop! "
			       "Remote address found on this node!\n",
			       p->name);
		else
			ret = 1;
E
Eric Dumazet 已提交
822
		rcu_read_unlock();
823 824 825
	}
	return ret;
}
L
Linus Torvalds 已提交
826
/**
827
 * ip6_tnl_xmit2 - encapsulate packet and send
L
Linus Torvalds 已提交
828
 *   @skb: the outgoing socket buffer
829
 *   @dev: the outgoing tunnel device
830 831 832 833
 *   @dsfield: dscp code for outer header
 *   @fl: flow of tunneled packet
 *   @encap_limit: encapsulation limit
 *   @pmtu: Path MTU is stored if packet is too big
L
Linus Torvalds 已提交
834 835 836 837 838
 *
 * Description:
 *   Build new header and do some sanity checks on the packet before sending
 *   it.
 *
839
 * Return:
840
 *   0 on success
841 842
 *   -1 fail
 *   %-EMSGSIZE message too big. return mtu in this case.
L
Linus Torvalds 已提交
843 844
 **/

845 846 847 848 849 850
static int ip6_tnl_xmit2(struct sk_buff *skb,
			 struct net_device *dev,
			 __u8 dsfield,
			 struct flowi *fl,
			 int encap_limit,
			 __u32 *pmtu)
L
Linus Torvalds 已提交
851
{
A
Alexey Dobriyan 已提交
852
	struct net *net = dev_net(dev);
853
	struct ip6_tnl *t = netdev_priv(dev);
854
	struct net_device_stats *stats = &t->dev->stats;
855
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
856
	struct ipv6_tel_txoption opt;
L
Linus Torvalds 已提交
857 858 859
	struct dst_entry *dst;
	struct net_device *tdev;
	int mtu;
860
	unsigned int max_headroom = sizeof(struct ipv6hdr);
L
Linus Torvalds 已提交
861
	u8 proto;
862
	int err = -1;
L
Linus Torvalds 已提交
863 864 865 866
	int pkt_len;

	if ((dst = ip6_tnl_dst_check(t)) != NULL)
		dst_hold(dst);
867
	else {
A
Alexey Dobriyan 已提交
868
		dst = ip6_route_output(net, NULL, fl);
L
Linus Torvalds 已提交
869

A
Alexey Dobriyan 已提交
870
		if (dst->error || xfrm_lookup(net, &dst, fl, NULL, 0) < 0)
871 872
			goto tx_err_link_failure;
	}
L
Linus Torvalds 已提交
873 874 875 876 877 878

	tdev = dst->dev;

	if (tdev == dev) {
		stats->collisions++;
		if (net_ratelimit())
879
			printk(KERN_WARNING
L
Linus Torvalds 已提交
880 881 882 883 884
			       "%s: Local routing loop detected!\n",
			       t->parms.name);
		goto tx_err_dst_release;
	}
	mtu = dst_mtu(dst) - sizeof (*ipv6h);
885
	if (encap_limit >= 0) {
L
Linus Torvalds 已提交
886 887 888 889 890
		max_headroom += 8;
		mtu -= 8;
	}
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;
E
Eric Dumazet 已提交
891 892
	if (skb_dst(skb))
		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
L
Linus Torvalds 已提交
893
	if (skb->len > mtu) {
894 895
		*pmtu = mtu;
		err = -EMSGSIZE;
L
Linus Torvalds 已提交
896 897 898 899 900 901 902
		goto tx_err_dst_release;
	}

	/*
	 * Okay, now see if we can stuff it in the buffer as-is.
	 */
	max_headroom += LL_RESERVED_SPACE(tdev);
903

904 905
	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
L
Linus Torvalds 已提交
906
		struct sk_buff *new_skb;
907

L
Linus Torvalds 已提交
908 909 910 911 912 913 914 915
		if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
			goto tx_err_dst_release;

		if (skb->sk)
			skb_set_owner_w(new_skb, skb->sk);
		kfree_skb(skb);
		skb = new_skb;
	}
E
Eric Dumazet 已提交
916 917
	skb_dst_drop(skb);
	skb_dst_set(skb, dst_clone(dst));
L
Linus Torvalds 已提交
918

919
	skb->transport_header = skb->network_header;
L
Linus Torvalds 已提交
920

921
	proto = fl->proto;
922 923 924 925
	if (encap_limit >= 0) {
		init_tel_txopt(&opt, encap_limit);
		ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
	}
926 927
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
928
	ipv6h = ipv6_hdr(skb);
929
	*(__be32*)ipv6h = fl->fl6_flowlabel | htonl(0x60000000);
L
Linus Torvalds 已提交
930 931 932 933
	dsfield = INET_ECN_encapsulate(0, dsfield);
	ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
	ipv6h->hop_limit = t->parms.hop_limit;
	ipv6h->nexthdr = proto;
934 935
	ipv6_addr_copy(&ipv6h->saddr, &fl->fl6_src);
	ipv6_addr_copy(&ipv6h->daddr, &fl->fl6_dst);
L
Linus Torvalds 已提交
936 937
	nf_reset(skb);
	pkt_len = skb->len;
H
Herbert Xu 已提交
938
	err = ip6_local_out(skb);
L
Linus Torvalds 已提交
939

940
	if (net_xmit_eval(err) == 0) {
L
Linus Torvalds 已提交
941 942 943 944 945 946 947 948 949 950 951 952 953
		stats->tx_bytes += pkt_len;
		stats->tx_packets++;
	} else {
		stats->tx_errors++;
		stats->tx_aborted_errors++;
	}
	ip6_tnl_dst_store(t, dst);
	return 0;
tx_err_link_failure:
	stats->tx_carrier_errors++;
	dst_link_failure(skb);
tx_err_dst_release:
	dst_release(dst);
954 955 956
	return err;
}

957 958 959 960
static inline int
ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
961
	struct iphdr  *iph = ip_hdr(skb);
962 963 964 965 966 967
	int encap_limit = -1;
	struct flowi fl;
	__u8 dsfield;
	__u32 mtu;
	int err;

968 969
	if ((t->parms.proto != IPPROTO_IPIP && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t))
970 971 972 973 974 975 976 977 978 979 980
		return -1;

	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

	memcpy(&fl, &t->fl, sizeof (fl));
	fl.proto = IPPROTO_IPIP;

	dsfield = ipv4_get_dsfield(iph);

	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
A
Al Viro 已提交
981 982
		fl.fl6_flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
					  & IPV6_TCLASS_MASK;
983 984 985 986 987 988 989 990 991 992 993 994 995

	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
	if (err != 0) {
		/* XXX: send ICMP error even if DF is not set. */
		if (err == -EMSGSIZE)
			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
				  htonl(mtu));
		return -1;
	}

	return 0;
}

996 997 998 999
static inline int
ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1000
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
1001 1002 1003 1004 1005 1006 1007
	int encap_limit = -1;
	__u16 offset;
	struct flowi fl;
	__u8 dsfield;
	__u32 mtu;
	int err;

1008 1009
	if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
1010 1011
		return -1;

1012 1013
	offset = parse_tlv_tnl_enc_lim(skb, skb_network_header(skb));
	if (offset > 0) {
1014
		struct ipv6_tlv_tnl_enc_lim *tel;
1015
		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043
		if (tel->encap_limit == 0) {
			icmpv6_send(skb, ICMPV6_PARAMPROB,
				    ICMPV6_HDR_FIELD, offset + 2, skb->dev);
			return -1;
		}
		encap_limit = tel->encap_limit - 1;
	} else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

	memcpy(&fl, &t->fl, sizeof (fl));
	fl.proto = IPPROTO_IPV6;

	dsfield = ipv6_get_dsfield(ipv6h);
	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
		fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
		fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);

	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
	if (err != 0) {
		if (err == -EMSGSIZE)
			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
		return -1;
	}

	return 0;
}

1044
static netdev_tx_t
1045 1046 1047
ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1048
	struct net_device_stats *stats = &t->dev->stats;
1049 1050 1051
	int ret;

	switch (skb->protocol) {
1052
	case htons(ETH_P_IP):
1053 1054
		ret = ip4ip6_tnl_xmit(skb, dev);
		break;
1055
	case htons(ETH_P_IPV6):
1056 1057 1058 1059 1060 1061 1062 1063 1064
		ret = ip6ip6_tnl_xmit(skb, dev);
		break;
	default:
		goto tx_err;
	}

	if (ret < 0)
		goto tx_err;

1065
	return NETDEV_TX_OK;
1066

L
Linus Torvalds 已提交
1067 1068 1069 1070
tx_err:
	stats->tx_errors++;
	stats->tx_dropped++;
	kfree_skb(skb);
1071
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
1072 1073 1074 1075 1076
}

static void ip6_tnl_set_cap(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
1077 1078
	int ltype = ipv6_addr_type(&p->laddr);
	int rtype = ipv6_addr_type(&p->raddr);
L
Linus Torvalds 已提交
1079 1080 1081

	p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV);

1082 1083 1084
	if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
	    rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
	    !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
1085
	    (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
1086 1087 1088 1089
		if (ltype&IPV6_ADDR_UNICAST)
			p->flags |= IP6_TNL_F_CAP_XMIT;
		if (rtype&IPV6_ADDR_UNICAST)
			p->flags |= IP6_TNL_F_CAP_RCV;
L
Linus Torvalds 已提交
1090 1091 1092
	}
}

1093
static void ip6_tnl_link_config(struct ip6_tnl *t)
L
Linus Torvalds 已提交
1094 1095 1096 1097 1098
{
	struct net_device *dev = t->dev;
	struct ip6_tnl_parm *p = &t->parms;
	struct flowi *fl = &t->fl;

1099 1100
	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
	memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
L
Linus Torvalds 已提交
1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122

	/* Set up flowi template */
	ipv6_addr_copy(&fl->fl6_src, &p->laddr);
	ipv6_addr_copy(&fl->fl6_dst, &p->raddr);
	fl->oif = p->link;
	fl->fl6_flowlabel = 0;

	if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
		fl->fl6_flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
	if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
		fl->fl6_flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;

	ip6_tnl_set_cap(t);

	if (p->flags&IP6_TNL_F_CAP_XMIT && p->flags&IP6_TNL_F_CAP_RCV)
		dev->flags |= IFF_POINTOPOINT;
	else
		dev->flags &= ~IFF_POINTOPOINT;

	dev->iflink = p->link;

	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1123 1124 1125
		int strict = (ipv6_addr_type(&p->raddr) &
			      (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));

1126 1127
		struct rt6_info *rt = rt6_lookup(dev_net(dev),
						 &p->raddr, &p->laddr,
1128
						 p->link, strict);
L
Linus Torvalds 已提交
1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146

		if (rt == NULL)
			return;

		if (rt->rt6i_dev) {
			dev->hard_header_len = rt->rt6i_dev->hard_header_len +
				sizeof (struct ipv6hdr);

			dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);

			if (dev->mtu < IPV6_MIN_MTU)
				dev->mtu = IPV6_MIN_MTU;
		}
		dst_release(&rt->u.dst);
	}
}

/**
1147
 * ip6_tnl_change - update the tunnel parameters
L
Linus Torvalds 已提交
1148 1149 1150 1151
 *   @t: tunnel to be changed
 *   @p: tunnel configuration parameters
 *
 * Description:
1152
 *   ip6_tnl_change() updates the tunnel parameters
L
Linus Torvalds 已提交
1153 1154 1155
 **/

static int
1156
ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
1157 1158 1159 1160 1161 1162 1163
{
	ipv6_addr_copy(&t->parms.laddr, &p->laddr);
	ipv6_addr_copy(&t->parms.raddr, &p->raddr);
	t->parms.flags = p->flags;
	t->parms.hop_limit = p->hop_limit;
	t->parms.encap_limit = p->encap_limit;
	t->parms.flowinfo = p->flowinfo;
1164
	t->parms.link = p->link;
1165
	t->parms.proto = p->proto;
1166
	ip6_tnl_dst_reset(t);
1167
	ip6_tnl_link_config(t);
L
Linus Torvalds 已提交
1168 1169 1170 1171
	return 0;
}

/**
1172
 * ip6_tnl_ioctl - configure ipv6 tunnels from userspace
L
Linus Torvalds 已提交
1173 1174 1175 1176 1177
 *   @dev: virtual device associated with tunnel
 *   @ifr: parameters passed from userspace
 *   @cmd: command to be performed
 *
 * Description:
1178
 *   ip6_tnl_ioctl() is used for managing IPv6 tunnels
1179
 *   from userspace.
L
Linus Torvalds 已提交
1180 1181 1182 1183 1184 1185 1186
 *
 *   The possible commands are the following:
 *     %SIOCGETTUNNEL: get tunnel parameters for device
 *     %SIOCADDTUNNEL: add tunnel matching given tunnel parameters
 *     %SIOCCHGTUNNEL: change tunnel parameters to those given
 *     %SIOCDELTUNNEL: delete tunnel
 *
1187
 *   The fallback device "ip6tnl0", created during module
L
Linus Torvalds 已提交
1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199
 *   initialization, can be used for creating other tunnel devices.
 *
 * Return:
 *   0 on success,
 *   %-EFAULT if unable to copy data to or from userspace,
 *   %-EPERM if current process hasn't %CAP_NET_ADMIN set
 *   %-EINVAL if passed tunnel parameters are invalid,
 *   %-EEXIST if changing a tunnel's parameters would cause a conflict
 *   %-ENODEV if attempting to change or delete a nonexisting device
 **/

static int
1200
ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
L
Linus Torvalds 已提交
1201 1202 1203 1204
{
	int err = 0;
	struct ip6_tnl_parm p;
	struct ip6_tnl *t = NULL;
1205 1206
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
1207 1208 1209

	switch (cmd) {
	case SIOCGETTUNNEL:
1210
		if (dev == ip6n->fb_tnl_dev) {
1211
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p))) {
L
Linus Torvalds 已提交
1212 1213 1214
				err = -EFAULT;
				break;
			}
1215
			t = ip6_tnl_locate(net, &p, 0);
1216 1217
		}
		if (t == NULL)
1218
			t = netdev_priv(dev);
L
Linus Torvalds 已提交
1219 1220 1221 1222 1223 1224 1225 1226 1227 1228
		memcpy(&p, &t->parms, sizeof (p));
		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
			err = -EFAULT;
		}
		break;
	case SIOCADDTUNNEL:
	case SIOCCHGTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
			break;
1229 1230
		err = -EFAULT;
		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1231
			break;
1232
		err = -EINVAL;
1233 1234
		if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
		    p.proto != 0)
L
Linus Torvalds 已提交
1235
			break;
1236
		t = ip6_tnl_locate(net, &p, cmd == SIOCADDTUNNEL);
1237
		if (dev != ip6n->fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
1238 1239 1240 1241 1242 1243 1244 1245
			if (t != NULL) {
				if (t->dev != dev) {
					err = -EEXIST;
					break;
				}
			} else
				t = netdev_priv(dev);

1246
			ip6_tnl_unlink(ip6n, t);
1247
			err = ip6_tnl_change(t, &p);
1248
			ip6_tnl_link(ip6n, t);
L
Linus Torvalds 已提交
1249 1250
			netdev_state_change(dev);
		}
1251
		if (t) {
L
Linus Torvalds 已提交
1252
			err = 0;
1253 1254 1255 1256 1257
			if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof (p)))
				err = -EFAULT;

		} else
			err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
L
Linus Torvalds 已提交
1258 1259 1260 1261 1262 1263
		break;
	case SIOCDELTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
			break;

1264
		if (dev == ip6n->fb_tnl_dev) {
1265 1266
			err = -EFAULT;
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1267
				break;
1268
			err = -ENOENT;
1269
			if ((t = ip6_tnl_locate(net, &p, 0)) == NULL)
L
Linus Torvalds 已提交
1270
				break;
1271
			err = -EPERM;
1272
			if (t->dev == ip6n->fb_tnl_dev)
L
Linus Torvalds 已提交
1273
				break;
1274
			dev = t->dev;
L
Linus Torvalds 已提交
1275
		}
1276 1277
		err = 0;
		unregister_netdevice(dev);
L
Linus Torvalds 已提交
1278 1279 1280 1281 1282 1283 1284 1285
		break;
	default:
		err = -EINVAL;
	}
	return err;
}

/**
1286
 * ip6_tnl_change_mtu - change mtu manually for tunnel device
L
Linus Torvalds 已提交
1287 1288 1289 1290 1291 1292 1293 1294 1295
 *   @dev: virtual device associated with tunnel
 *   @new_mtu: the new mtu
 *
 * Return:
 *   0 on success,
 *   %-EINVAL if mtu too small
 **/

static int
1296
ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
L
Linus Torvalds 已提交
1297 1298 1299 1300 1301 1302 1303 1304
{
	if (new_mtu < IPV6_MIN_MTU) {
		return -EINVAL;
	}
	dev->mtu = new_mtu;
	return 0;
}

1305 1306 1307 1308 1309 1310 1311 1312

static const struct net_device_ops ip6_tnl_netdev_ops = {
	.ndo_uninit = ip6_tnl_dev_uninit,
	.ndo_start_xmit = ip6_tnl_xmit,
	.ndo_do_ioctl = ip6_tnl_ioctl,
	.ndo_change_mtu = ip6_tnl_change_mtu,
};

L
Linus Torvalds 已提交
1313
/**
1314
 * ip6_tnl_dev_setup - setup virtual tunnel device
L
Linus Torvalds 已提交
1315 1316 1317 1318 1319 1320
 *   @dev: virtual device associated with tunnel
 *
 * Description:
 *   Initialize function pointers and device parameters
 **/

1321
static void ip6_tnl_dev_setup(struct net_device *dev)
L
Linus Torvalds 已提交
1322
{
1323
	dev->netdev_ops = &ip6_tnl_netdev_ops;
L
Linus Torvalds 已提交
1324 1325 1326 1327 1328 1329 1330
	dev->destructor = free_netdev;

	dev->type = ARPHRD_TUNNEL6;
	dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
	dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
	dev->flags |= IFF_NOARP;
	dev->addr_len = sizeof(struct in6_addr);
1331
	dev->features |= NETIF_F_NETNS_LOCAL;
L
Linus Torvalds 已提交
1332 1333 1334 1335
}


/**
1336
 * ip6_tnl_dev_init_gen - general initializer for all tunnel devices
L
Linus Torvalds 已提交
1337 1338 1339 1340
 *   @dev: virtual device associated with tunnel
 **/

static inline void
1341
ip6_tnl_dev_init_gen(struct net_device *dev)
L
Linus Torvalds 已提交
1342
{
1343
	struct ip6_tnl *t = netdev_priv(dev);
L
Linus Torvalds 已提交
1344 1345 1346 1347 1348
	t->dev = dev;
	strcpy(t->parms.name, dev->name);
}

/**
1349
 * ip6_tnl_dev_init - initializer for all non fallback tunnel devices
L
Linus Torvalds 已提交
1350 1351 1352
 *   @dev: virtual device associated with tunnel
 **/

1353
static void ip6_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1354
{
1355
	struct ip6_tnl *t = netdev_priv(dev);
1356 1357
	ip6_tnl_dev_init_gen(dev);
	ip6_tnl_link_config(t);
L
Linus Torvalds 已提交
1358 1359 1360
}

/**
1361
 * ip6_fb_tnl_dev_init - initializer for fallback tunnel device
L
Linus Torvalds 已提交
1362 1363 1364 1365 1366
 *   @dev: fallback device
 *
 * Return: 0
 **/

1367
static void ip6_fb_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1368
{
1369
	struct ip6_tnl *t = netdev_priv(dev);
1370 1371 1372
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);

1373
	ip6_tnl_dev_init_gen(dev);
1374
	t->parms.proto = IPPROTO_IPV6;
L
Linus Torvalds 已提交
1375
	dev_hold(dev);
1376
	ip6n->tnls_wc[0] = t;
L
Linus Torvalds 已提交
1377 1378
}

1379 1380 1381 1382 1383 1384
static struct xfrm6_tunnel ip4ip6_handler = {
	.handler	= ip4ip6_rcv,
	.err_handler	= ip4ip6_err,
	.priority	=	1,
};

L
Linus Torvalds 已提交
1385
static struct xfrm6_tunnel ip6ip6_handler = {
1386 1387
	.handler	= ip6ip6_rcv,
	.err_handler	= ip6ip6_err,
H
Herbert Xu 已提交
1388
	.priority	=	1,
L
Linus Torvalds 已提交
1389 1390
};

1391 1392 1393 1394
static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
{
	int h;
	struct ip6_tnl *t;
1395
	LIST_HEAD(list);
1396 1397

	for (h = 0; h < HASH_SIZE; h++) {
1398 1399 1400 1401 1402
		t = ip6n->tnls_r_l[h];
		while (t != NULL) {
			unregister_netdevice_queue(t->dev, &list);
			t = t->next;
		}
1403 1404 1405
	}

	t = ip6n->tnls_wc[0];
1406 1407
	unregister_netdevice_queue(t->dev, &list);
	unregister_netdevice_many(&list);
1408 1409
}

1410 1411
static int ip6_tnl_init_net(struct net *net)
{
1412
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1413 1414
	int err;

1415 1416 1417
	ip6n->tnls[0] = ip6n->tnls_wc;
	ip6n->tnls[1] = ip6n->tnls_r_l;

1418 1419 1420 1421 1422 1423
	err = -ENOMEM;
	ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0",
				      ip6_tnl_dev_setup);

	if (!ip6n->fb_tnl_dev)
		goto err_alloc_dev;
1424
	dev_net_set(ip6n->fb_tnl_dev, net);
1425

1426
	ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
1427 1428 1429 1430

	err = register_netdev(ip6n->fb_tnl_dev);
	if (err < 0)
		goto err_register;
1431 1432
	return 0;

1433 1434 1435
err_register:
	free_netdev(ip6n->fb_tnl_dev);
err_alloc_dev:
1436 1437 1438 1439 1440
	return err;
}

static void ip6_tnl_exit_net(struct net *net)
{
1441
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1442

1443 1444 1445
	rtnl_lock();
	ip6_tnl_destroy_tunnels(ip6n);
	rtnl_unlock();
1446 1447 1448 1449 1450
}

static struct pernet_operations ip6_tnl_net_ops = {
	.init = ip6_tnl_init_net,
	.exit = ip6_tnl_exit_net,
1451 1452
	.id   = &ip6_tnl_net_id,
	.size = sizeof(struct ip6_tnl_net),
1453 1454
};

L
Linus Torvalds 已提交
1455 1456 1457 1458 1459 1460 1461 1462 1463 1464
/**
 * ip6_tunnel_init - register protocol and reserve needed resources
 *
 * Return: 0 on success
 **/

static int __init ip6_tunnel_init(void)
{
	int  err;

1465
	if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) {
1466
		printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
1467 1468 1469 1470
		err = -EAGAIN;
		goto out;
	}

1471
	if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) {
1472
		printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
1473 1474
		err = -EAGAIN;
		goto unreg_ip4ip6;
L
Linus Torvalds 已提交
1475
	}
1476

1477
	err = register_pernet_device(&ip6_tnl_net_ops);
1478 1479
	if (err < 0)
		goto err_pernet;
L
Linus Torvalds 已提交
1480
	return 0;
1481
err_pernet:
1482
	xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
1483 1484 1485
unreg_ip4ip6:
	xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
out:
L
Linus Torvalds 已提交
1486 1487 1488 1489 1490 1491 1492 1493 1494
	return err;
}

/**
 * ip6_tunnel_cleanup - free resources and unregister protocol
 **/

static void __exit ip6_tunnel_cleanup(void)
{
1495
	if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
1496
		printk(KERN_INFO "ip6_tunnel close: can't deregister ip4ip6\n");
1497

1498
	if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
1499
		printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
L
Linus Torvalds 已提交
1500

1501
	unregister_pernet_device(&ip6_tnl_net_ops);
L
Linus Torvalds 已提交
1502 1503 1504 1505
}

module_init(ip6_tunnel_init);
module_exit(ip6_tunnel_cleanup);