ip_vti.c 13.9 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36
/*
 *	Linux NET3: IP/IP protocol decoder modified to support
 *		    virtual tunnel interface
 *
 *	Authors:
 *		Saurabh Mohan (saurabh.mohan@vyatta.com) 05/07/2012
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	as published by the Free Software Foundation; either version
 *	2 of the License, or (at your option) any later version.
 *
 */

/*
   This version of net/ipv4/ip_vti.c is cloned of net/ipv4/ipip.c

   For comments look at net/ipv4/ip_gre.c --ANK
 */


#include <linux/capability.h>
#include <linux/module.h>
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/uaccess.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/in.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/if_arp.h>
#include <linux/mroute.h>
#include <linux/init.h>
#include <linux/netfilter_ipv4.h>
#include <linux/if_ether.h>
37
#include <linux/icmpv6.h>
38 39 40 41

#include <net/sock.h>
#include <net/ip.h>
#include <net/icmp.h>
42
#include <net/ip_tunnels.h>
43 44 45 46 47 48 49 50 51 52
#include <net/inet_ecn.h>
#include <net/xfrm.h>
#include <net/net_namespace.h>
#include <net/netns/generic.h>

static struct rtnl_link_ops vti_link_ops __read_mostly;

static int vti_net_id __read_mostly;
static int vti_tunnel_init(struct net_device *dev);

53 54
static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
		     int encap_type)
55 56 57
{
	struct ip_tunnel *tunnel;
	const struct iphdr *iph = ip_hdr(skb);
A
Amerigo Wang 已提交
58 59
	struct net *net = dev_net(skb->dev);
	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
60

A
Amerigo Wang 已提交
61 62
	tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
				  iph->saddr, iph->daddr, 0);
63
	if (tunnel != NULL) {
64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95
		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
			goto drop;

		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
		skb->mark = be32_to_cpu(tunnel->parms.i_key);

		return xfrm_input(skb, nexthdr, spi, encap_type);
	}

	return -EINVAL;
drop:
	kfree_skb(skb);
	return 0;
}

static int vti_rcv(struct sk_buff *skb)
{
	XFRM_SPI_SKB_CB(skb)->family = AF_INET;
	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);

	return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
}

static int vti_rcv_cb(struct sk_buff *skb, int err)
{
	unsigned short family;
	struct net_device *dev;
	struct pcpu_sw_netstats *tstats;
	struct xfrm_state *x;
	struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;

	if (!tunnel)
96
		return 1;
97 98 99 100 101 102 103 104

	dev = tunnel->dev;

	if (err) {
		dev->stats.rx_errors++;
		dev->stats.rx_dropped++;

		return 0;
105 106
	}

107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123
	x = xfrm_input_state(skb);
	family = x->inner_mode->afinfo->family;

	if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
		return -EPERM;

	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
	skb->dev = dev;

	tstats = this_cpu_ptr(dev->tstats);

	u64_stats_update_begin(&tstats->syncp);
	tstats->rx_packets++;
	tstats->rx_bytes += skb->len;
	u64_stats_update_end(&tstats->syncp);

	return 0;
124 125
}

126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146
static bool vti_state_check(const struct xfrm_state *x, __be32 dst, __be32 src)
{
	xfrm_address_t *daddr = (xfrm_address_t *)&dst;
	xfrm_address_t *saddr = (xfrm_address_t *)&src;

	/* if there is no transform then this tunnel is not functional.
	 * Or if the xfrm is not mode tunnel.
	 */
	if (!x || x->props.mode != XFRM_MODE_TUNNEL ||
	    x->props.family != AF_INET)
		return false;

	if (!dst)
		return xfrm_addr_equal(saddr, &x->props.saddr, AF_INET);

	if (!xfrm_state_addr_check(x, daddr, saddr, AF_INET))
		return false;

	return true;
}

147 148
static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
			    struct flowi *fl)
149 150
{
	struct ip_tunnel *tunnel = netdev_priv(dev);
151
	struct ip_tunnel_parm *parms = &tunnel->parms;
152
	struct dst_entry *dst = skb_dst(skb);
153
	struct net_device *tdev;	/* Device to other host */
A
Amerigo Wang 已提交
154
	int err;
155

156
	if (!dst) {
157 158 159
		dev->stats.tx_carrier_errors++;
		goto tx_error_icmp;
	}
160

161
	dst_hold(dst);
162
	dst = xfrm_lookup(tunnel->net, dst, fl, NULL, 0);
163
	if (IS_ERR(dst)) {
164 165 166
		dev->stats.tx_carrier_errors++;
		goto tx_error_icmp;
	}
167

168
	if (!vti_state_check(dst->xfrm, parms->iph.daddr, parms->iph.saddr)) {
169
		dev->stats.tx_carrier_errors++;
170
		dst_release(dst);
171 172
		goto tx_error_icmp;
	}
173

174
	tdev = dst->dev;
175 176

	if (tdev == dev) {
177
		dst_release(dst);
178 179 180 181 182 183 184 185 186 187 188 189 190
		dev->stats.collisions++;
		goto tx_error;
	}

	if (tunnel->err_count > 0) {
		if (time_before(jiffies,
				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
			tunnel->err_count--;
			dst_link_failure(skb);
		} else
			tunnel->err_count = 0;
	}

191
	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
192
	skb_dst_set(skb, dst);
193 194
	skb->dev = skb_dst(skb)->dev;

A
Amerigo Wang 已提交
195 196 197 198
	err = dst_output(skb);
	if (net_xmit_eval(err) == 0)
		err = skb->len;
	iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
199 200 201 202 203 204
	return NETDEV_TX_OK;

tx_error_icmp:
	dst_link_failure(skb);
tx_error:
	dev->stats.tx_errors++;
E
Eric Dumazet 已提交
205
	kfree_skb(skb);
206 207 208
	return NETDEV_TX_OK;
}

209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238
/* This function assumes it is being called from dev_queue_xmit()
 * and that skb is filled properly by that function.
 */
static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip_tunnel *tunnel = netdev_priv(dev);
	struct flowi fl;

	memset(&fl, 0, sizeof(fl));

	skb->mark = be32_to_cpu(tunnel->parms.o_key);

	switch (skb->protocol) {
	case htons(ETH_P_IP):
		xfrm_decode_session(skb, &fl, AF_INET);
		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
		break;
	case htons(ETH_P_IPV6):
		xfrm_decode_session(skb, &fl, AF_INET6);
		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
		break;
	default:
		dev->stats.tx_errors++;
		dev_kfree_skb(skb);
		return NETDEV_TX_OK;
	}

	return vti_xmit(skb, dev, &fl);
}

239 240 241
static int vti4_err(struct sk_buff *skb, u32 info)
{
	__be32 spi;
242
	__u32 mark;
243 244 245 246 247 248 249 250 251 252 253 254 255 256 257
	struct xfrm_state *x;
	struct ip_tunnel *tunnel;
	struct ip_esp_hdr *esph;
	struct ip_auth_hdr *ah ;
	struct ip_comp_hdr *ipch;
	struct net *net = dev_net(skb->dev);
	const struct iphdr *iph = (const struct iphdr *)skb->data;
	int protocol = iph->protocol;
	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);

	tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
				  iph->daddr, iph->saddr, 0);
	if (!tunnel)
		return -1;

258 259
	mark = be32_to_cpu(tunnel->parms.o_key);

260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286
	switch (protocol) {
	case IPPROTO_ESP:
		esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
		spi = esph->spi;
		break;
	case IPPROTO_AH:
		ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
		spi = ah->spi;
		break;
	case IPPROTO_COMP:
		ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
		spi = htonl(ntohs(ipch->cpi));
		break;
	default:
		return 0;
	}

	switch (icmp_hdr(skb)->type) {
	case ICMP_DEST_UNREACH:
		if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
			return 0;
	case ICMP_REDIRECT:
		break;
	default:
		return 0;
	}

287
	x = xfrm_state_lookup(net, mark, (const xfrm_address_t *)&iph->daddr,
288 289 290 291 292 293 294 295 296 297 298 299 300
			      spi, protocol, AF_INET);
	if (!x)
		return 0;

	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
		ipv4_update_pmtu(skb, net, info, 0, 0, protocol, 0);
	else
		ipv4_redirect(skb, net, 0, 0, protocol, 0);
	xfrm_state_put(x);

	return 0;
}

301 302 303 304 305 306
static int
vti_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
{
	int err = 0;
	struct ip_tunnel_parm p;

A
Amerigo Wang 已提交
307 308
	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
		return -EFAULT;
309

A
Amerigo Wang 已提交
310
	if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
311 312
		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
		    p.iph.ihl != 5)
A
Amerigo Wang 已提交
313 314
			return -EINVAL;
	}
315

316 317 318 319 320 321 322
	if (!(p.i_flags & GRE_KEY))
		p.i_key = 0;
	if (!(p.o_flags & GRE_KEY))
		p.o_key = 0;

	p.i_flags = VTI_ISVTI;

A
Amerigo Wang 已提交
323 324 325
	err = ip_tunnel_ioctl(dev, &p, cmd);
	if (err)
		return err;
326

A
Amerigo Wang 已提交
327
	if (cmd != SIOCDELTUNNEL) {
328
		p.i_flags |= GRE_KEY;
A
Amerigo Wang 已提交
329
		p.o_flags |= GRE_KEY;
330 331
	}

A
Amerigo Wang 已提交
332 333
	if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
		return -EFAULT;
334 335 336 337 338
	return 0;
}

static const struct net_device_ops vti_netdev_ops = {
	.ndo_init	= vti_tunnel_init,
A
Amerigo Wang 已提交
339
	.ndo_uninit	= ip_tunnel_uninit,
340 341
	.ndo_start_xmit	= vti_tunnel_xmit,
	.ndo_do_ioctl	= vti_tunnel_ioctl,
A
Amerigo Wang 已提交
342
	.ndo_change_mtu	= ip_tunnel_change_mtu,
343
	.ndo_get_stats64 = ip_tunnel_get_stats64,
344 345
};

A
Amerigo Wang 已提交
346
static void vti_tunnel_setup(struct net_device *dev)
347
{
A
Amerigo Wang 已提交
348
	dev->netdev_ops		= &vti_netdev_ops;
349
	dev->type		= ARPHRD_TUNNEL;
A
Amerigo Wang 已提交
350
	ip_tunnel_setup(dev, vti_net_id);
351 352
}

A
Amerigo Wang 已提交
353
static int vti_tunnel_init(struct net_device *dev)
354
{
A
Amerigo Wang 已提交
355 356 357 358 359
	struct ip_tunnel *tunnel = netdev_priv(dev);
	struct iphdr *iph = &tunnel->parms.iph;

	memcpy(dev->dev_addr, &iph->saddr, 4);
	memcpy(dev->broadcast, &iph->daddr, 4);
360 361 362 363 364 365 366

	dev->hard_header_len	= LL_MAX_HEADER + sizeof(struct iphdr);
	dev->mtu		= ETH_DATA_LEN;
	dev->flags		= IFF_NOARP;
	dev->iflink		= 0;
	dev->addr_len		= 4;
	dev->features		|= NETIF_F_LLTX;
367
	netif_keep_dst(dev);
368

A
Amerigo Wang 已提交
369
	return ip_tunnel_init(dev);
370 371
}

A
Amerigo Wang 已提交
372
static void __net_init vti_fb_tunnel_init(struct net_device *dev)
373 374 375 376 377 378 379 380 381
{
	struct ip_tunnel *tunnel = netdev_priv(dev);
	struct iphdr *iph = &tunnel->parms.iph;

	iph->version		= 4;
	iph->protocol		= IPPROTO_IPIP;
	iph->ihl		= 5;
}

382
static struct xfrm4_protocol vti_esp4_protocol __read_mostly = {
383
	.handler	=	vti_rcv,
384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403
	.input_handler	=	vti_input,
	.cb_handler	=	vti_rcv_cb,
	.err_handler	=	vti4_err,
	.priority	=	100,
};

static struct xfrm4_protocol vti_ah4_protocol __read_mostly = {
	.handler	=	vti_rcv,
	.input_handler	=	vti_input,
	.cb_handler	=	vti_rcv_cb,
	.err_handler	=	vti4_err,
	.priority	=	100,
};

static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
	.handler	=	vti_rcv,
	.input_handler	=	vti_input,
	.cb_handler	=	vti_rcv_cb,
	.err_handler	=	vti4_err,
	.priority	=	100,
404 405 406 407 408
};

static int __net_init vti_init_net(struct net *net)
{
	int err;
A
Amerigo Wang 已提交
409
	struct ip_tunnel_net *itn;
410

A
Amerigo Wang 已提交
411
	err = ip_tunnel_init_net(net, vti_net_id, &vti_link_ops, "ip_vti0");
412
	if (err)
A
Amerigo Wang 已提交
413 414 415
		return err;
	itn = net_generic(net, vti_net_id);
	vti_fb_tunnel_init(itn->fb_tunnel_dev);
416 417 418 419 420
	return 0;
}

static void __net_exit vti_exit_net(struct net *net)
{
A
Amerigo Wang 已提交
421
	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
N
Nicolas Dichtel 已提交
422
	ip_tunnel_delete_net(itn, &vti_link_ops);
423 424 425 426 427 428
}

static struct pernet_operations vti_net_ops = {
	.init = vti_init_net,
	.exit = vti_exit_net,
	.id   = &vti_net_id,
A
Amerigo Wang 已提交
429
	.size = sizeof(struct ip_tunnel_net),
430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446
};

static int vti_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
{
	return 0;
}

static void vti_netlink_parms(struct nlattr *data[],
			      struct ip_tunnel_parm *parms)
{
	memset(parms, 0, sizeof(*parms));

	parms->iph.protocol = IPPROTO_IPIP;

	if (!data)
		return;

447 448
	parms->i_flags = VTI_ISVTI;

449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468
	if (data[IFLA_VTI_LINK])
		parms->link = nla_get_u32(data[IFLA_VTI_LINK]);

	if (data[IFLA_VTI_IKEY])
		parms->i_key = nla_get_be32(data[IFLA_VTI_IKEY]);

	if (data[IFLA_VTI_OKEY])
		parms->o_key = nla_get_be32(data[IFLA_VTI_OKEY]);

	if (data[IFLA_VTI_LOCAL])
		parms->iph.saddr = nla_get_be32(data[IFLA_VTI_LOCAL]);

	if (data[IFLA_VTI_REMOTE])
		parms->iph.daddr = nla_get_be32(data[IFLA_VTI_REMOTE]);

}

static int vti_newlink(struct net *src_net, struct net_device *dev,
		       struct nlattr *tb[], struct nlattr *data[])
{
A
Amerigo Wang 已提交
469
	struct ip_tunnel_parm parms;
470

A
Amerigo Wang 已提交
471 472
	vti_netlink_parms(data, &parms);
	return ip_tunnel_newlink(dev, tb, &parms);
473 474 475 476 477 478 479 480
}

static int vti_changelink(struct net_device *dev, struct nlattr *tb[],
			  struct nlattr *data[])
{
	struct ip_tunnel_parm p;

	vti_netlink_parms(data, &p);
A
Amerigo Wang 已提交
481
	return ip_tunnel_changelink(dev, tb, &p);
482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507
}

static size_t vti_get_size(const struct net_device *dev)
{
	return
		/* IFLA_VTI_LINK */
		nla_total_size(4) +
		/* IFLA_VTI_IKEY */
		nla_total_size(4) +
		/* IFLA_VTI_OKEY */
		nla_total_size(4) +
		/* IFLA_VTI_LOCAL */
		nla_total_size(4) +
		/* IFLA_VTI_REMOTE */
		nla_total_size(4) +
		0;
}

static int vti_fill_info(struct sk_buff *skb, const struct net_device *dev)
{
	struct ip_tunnel *t = netdev_priv(dev);
	struct ip_tunnel_parm *p = &t->parms;

	nla_put_u32(skb, IFLA_VTI_LINK, p->link);
	nla_put_be32(skb, IFLA_VTI_IKEY, p->i_key);
	nla_put_be32(skb, IFLA_VTI_OKEY, p->o_key);
508 509
	nla_put_in_addr(skb, IFLA_VTI_LOCAL, p->iph.saddr);
	nla_put_in_addr(skb, IFLA_VTI_REMOTE, p->iph.daddr);
510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530

	return 0;
}

static const struct nla_policy vti_policy[IFLA_VTI_MAX + 1] = {
	[IFLA_VTI_LINK]		= { .type = NLA_U32 },
	[IFLA_VTI_IKEY]		= { .type = NLA_U32 },
	[IFLA_VTI_OKEY]		= { .type = NLA_U32 },
	[IFLA_VTI_LOCAL]	= { .len = FIELD_SIZEOF(struct iphdr, saddr) },
	[IFLA_VTI_REMOTE]	= { .len = FIELD_SIZEOF(struct iphdr, daddr) },
};

static struct rtnl_link_ops vti_link_ops __read_mostly = {
	.kind		= "vti",
	.maxtype	= IFLA_VTI_MAX,
	.policy		= vti_policy,
	.priv_size	= sizeof(struct ip_tunnel),
	.setup		= vti_tunnel_setup,
	.validate	= vti_tunnel_validate,
	.newlink	= vti_newlink,
	.changelink	= vti_changelink,
531
	.dellink        = ip_tunnel_dellink,
532 533
	.get_size	= vti_get_size,
	.fill_info	= vti_fill_info,
534
	.get_link_net	= ip_tunnel_get_link_net,
535 536 537 538
};

static int __init vti_init(void)
{
539
	const char *msg;
540 541
	int err;

542
	pr_info("IPv4 over IPsec tunneling driver\n");
543

544
	msg = "tunnel device";
545 546
	err = register_pernet_device(&vti_net_ops);
	if (err < 0)
547
		goto pernet_dev_failed;
548

549 550 551 552
	msg = "tunnel protocols";
	err = xfrm4_protocol_register(&vti_esp4_protocol, IPPROTO_ESP);
	if (err < 0)
		goto xfrm_proto_esp_failed;
553
	err = xfrm4_protocol_register(&vti_ah4_protocol, IPPROTO_AH);
554 555
	if (err < 0)
		goto xfrm_proto_ah_failed;
556
	err = xfrm4_protocol_register(&vti_ipcomp4_protocol, IPPROTO_COMP);
557 558
	if (err < 0)
		goto xfrm_proto_comp_failed;
559

560
	msg = "netlink interface";
561 562 563 564 565 566 567
	err = rtnl_link_register(&vti_link_ops);
	if (err < 0)
		goto rtnl_link_failed;

	return err;

rtnl_link_failed:
568
	xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
569
xfrm_proto_comp_failed:
570
	xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
571
xfrm_proto_ah_failed:
572
	xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
573
xfrm_proto_esp_failed:
574
	unregister_pernet_device(&vti_net_ops);
575 576
pernet_dev_failed:
	pr_err("vti init: failed to register %s\n", msg);
577 578 579 580 581 582
	return err;
}

static void __exit vti_fini(void)
{
	rtnl_link_unregister(&vti_link_ops);
583 584 585
	xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
	xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
	xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
586 587 588 589 590 591 592 593
	unregister_pernet_device(&vti_net_ops);
}

module_init(vti_init);
module_exit(vti_fini);
MODULE_LICENSE("GPL");
MODULE_ALIAS_RTNL_LINK("vti");
MODULE_ALIAS_NETDEV("ip_vti0");