ip6_tunnel.c 35.0 KB
Newer Older
L
Linus Torvalds 已提交
1
/*
2
 *	IPv6 tunneling device
L
Linus Torvalds 已提交
3 4 5
 *	Linux INET6 implementation
 *
 *	Authors:
6
 *	Ville Nuorvala		<vnuorval@tcs.hut.fi>
7
 *	Yasuyuki Kozakai	<kozakai@linux-ipv6.org>
L
Linus Torvalds 已提交
8 9
 *
 *      Based on:
10
 *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
L
Linus Torvalds 已提交
11 12 13 14 15 16 17 18 19 20 21
 *
 *      RFC 2473
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 */

#include <linux/module.h>
22
#include <linux/capability.h>
L
Linus Torvalds 已提交
23 24 25
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/sockios.h>
26
#include <linux/icmp.h>
L
Linus Torvalds 已提交
27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43
#include <linux/if.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/if_tunnel.h>
#include <linux/net.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/icmpv6.h>
#include <linux/init.h>
#include <linux/route.h>
#include <linux/rtnetlink.h>
#include <linux/netfilter_ipv6.h>

#include <asm/uaccess.h>
#include <asm/atomic.h>

44
#include <net/icmp.h>
L
Linus Torvalds 已提交
45 46 47 48 49 50 51 52
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/ip6_tunnel.h>
#include <net/xfrm.h>
#include <net/dsfield.h>
#include <net/inet_ecn.h>
53 54
#include <net/net_namespace.h>
#include <net/netns/generic.h>
L
Linus Torvalds 已提交
55 56

MODULE_AUTHOR("Ville Nuorvala");
57
MODULE_DESCRIPTION("IPv6 tunneling device");
L
Linus Torvalds 已提交
58 59 60 61 62
MODULE_LICENSE("GPL");

#define IPV6_TLV_TEL_DST_SIZE 8

#ifdef IP6_TNL_DEBUG
63
#define IP6_TNL_TRACE(x...) printk(KERN_DEBUG "%s:" x "\n", __func__)
L
Linus Torvalds 已提交
64 65 66 67 68
#else
#define IP6_TNL_TRACE(x...) do {;} while(0)
#endif

#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
69
#define IPV6_TCLASS_SHIFT 20
L
Linus Torvalds 已提交
70 71 72

#define HASH_SIZE  32

A
Al Viro 已提交
73
#define HASH(addr) ((__force u32)((addr)->s6_addr32[0] ^ (addr)->s6_addr32[1] ^ \
74 75
		     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
		    (HASH_SIZE - 1))
L
Linus Torvalds 已提交
76

77 78
static void ip6_fb_tnl_dev_init(struct net_device *dev);
static void ip6_tnl_dev_init(struct net_device *dev);
79
static void ip6_tnl_dev_setup(struct net_device *dev);
L
Linus Torvalds 已提交
80

81 82
static int ip6_tnl_net_id;
struct ip6_tnl_net {
83 84
	/* the IPv6 tunnel fallback device */
	struct net_device *fb_tnl_dev;
85 86 87 88
	/* lists for storing tunnels in use */
	struct ip6_tnl *tnls_r_l[HASH_SIZE];
	struct ip6_tnl *tnls_wc[1];
	struct ip6_tnl **tnls[2];
89 90
};

L
Linus Torvalds 已提交
91
/* lock for the tunnel lists */
92
static DEFINE_RWLOCK(ip6_tnl_lock);
L
Linus Torvalds 已提交
93 94 95 96 97

static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
{
	struct dst_entry *dst = t->dst_cache;

98
	if (dst && dst->obsolete &&
L
Linus Torvalds 已提交
99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122
	    dst->ops->check(dst, t->dst_cookie) == NULL) {
		t->dst_cache = NULL;
		dst_release(dst);
		return NULL;
	}

	return dst;
}

static inline void ip6_tnl_dst_reset(struct ip6_tnl *t)
{
	dst_release(t->dst_cache);
	t->dst_cache = NULL;
}

static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
{
	struct rt6_info *rt = (struct rt6_info *) dst;
	t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
	dst_release(t->dst_cache);
	t->dst_cache = dst;
}

/**
123
 * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
124 125
 *   @remote: the address of the tunnel exit-point
 *   @local: the address of the tunnel entry-point
L
Linus Torvalds 已提交
126
 *
127
 * Return:
L
Linus Torvalds 已提交
128
 *   tunnel matching given end-points if found,
129
 *   else fallback tunnel if its device is up,
L
Linus Torvalds 已提交
130 131 132 133
 *   else %NULL
 **/

static struct ip6_tnl *
134
ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
L
Linus Torvalds 已提交
135 136 137 138
{
	unsigned h0 = HASH(remote);
	unsigned h1 = HASH(local);
	struct ip6_tnl *t;
139
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
140

141
	for (t = ip6n->tnls_r_l[h0 ^ h1]; t; t = t->next) {
L
Linus Torvalds 已提交
142 143 144 145 146
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
		    ipv6_addr_equal(remote, &t->parms.raddr) &&
		    (t->dev->flags & IFF_UP))
			return t;
	}
147
	if ((t = ip6n->tnls_wc[0]) != NULL && (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
148 149 150 151 152 153
		return t;

	return NULL;
}

/**
154
 * ip6_tnl_bucket - get head of list matching given tunnel parameters
155
 *   @p: parameters containing tunnel end-points
L
Linus Torvalds 已提交
156 157
 *
 * Description:
158
 *   ip6_tnl_bucket() returns the head of the list matching the
L
Linus Torvalds 已提交
159 160
 *   &struct in6_addr entries laddr and raddr in @p.
 *
161
 * Return: head of IPv6 tunnel list
L
Linus Torvalds 已提交
162 163 164
 **/

static struct ip6_tnl **
165
ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
166 167 168 169 170 171 172 173 174 175
{
	struct in6_addr *remote = &p->raddr;
	struct in6_addr *local = &p->laddr;
	unsigned h = 0;
	int prio = 0;

	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
		prio = 1;
		h = HASH(remote) ^ HASH(local);
	}
176
	return &ip6n->tnls[prio][h];
L
Linus Torvalds 已提交
177 178 179
}

/**
180
 * ip6_tnl_link - add tunnel to hash table
L
Linus Torvalds 已提交
181 182 183 184
 *   @t: tunnel to be added
 **/

static void
185
ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
186
{
187
	struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
L
Linus Torvalds 已提交
188 189

	t->next = *tp;
190
	write_lock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
191
	*tp = t;
192
	write_unlock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
193 194 195
}

/**
196
 * ip6_tnl_unlink - remove tunnel from hash table
L
Linus Torvalds 已提交
197 198 199 200
 *   @t: tunnel to be removed
 **/

static void
201
ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
202 203 204
{
	struct ip6_tnl **tp;

205
	for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
L
Linus Torvalds 已提交
206
		if (t == *tp) {
207
			write_lock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
208
			*tp = t->next;
209
			write_unlock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
210 211 212 213 214 215 216 217 218 219 220 221
			break;
		}
	}
}

/**
 * ip6_tnl_create() - create a new tunnel
 *   @p: tunnel parameters
 *   @pt: pointer to new tunnel
 *
 * Description:
 *   Create tunnel matching given parameters.
222 223
 *
 * Return:
224
 *   created tunnel or NULL
L
Linus Torvalds 已提交
225 226
 **/

227
static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
228 229 230 231 232
{
	struct net_device *dev;
	struct ip6_tnl *t;
	char name[IFNAMSIZ];
	int err;
233
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
234

235
	if (p->name[0])
L
Linus Torvalds 已提交
236
		strlcpy(name, p->name, IFNAMSIZ);
237 238 239
	else
		sprintf(name, "ip6tnl%%d");

240
	dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup);
L
Linus Torvalds 已提交
241
	if (dev == NULL)
242
		goto failed;
L
Linus Torvalds 已提交
243

244 245
	dev_net_set(dev, net);

246 247 248 249 250
	if (strchr(name, '%')) {
		if (dev_alloc_name(dev, name) < 0)
			goto failed_free;
	}

251
	t = netdev_priv(dev);
L
Linus Torvalds 已提交
252
	t->parms = *p;
253
	ip6_tnl_dev_init(dev);
L
Linus Torvalds 已提交
254

255 256 257
	if ((err = register_netdevice(dev)) < 0)
		goto failed_free;

L
Linus Torvalds 已提交
258
	dev_hold(dev);
259
	ip6_tnl_link(ip6n, t);
260
	return t;
261 262 263

failed_free:
	free_netdev(dev);
264 265
failed:
	return NULL;
L
Linus Torvalds 已提交
266 267 268
}

/**
269
 * ip6_tnl_locate - find or create tunnel matching given parameters
270
 *   @p: tunnel parameters
L
Linus Torvalds 已提交
271 272 273
 *   @create: != 0 if allowed to create new tunnel if no match found
 *
 * Description:
274
 *   ip6_tnl_locate() first tries to locate an existing tunnel
L
Linus Torvalds 已提交
275 276 277 278
 *   based on @parms. If this is unsuccessful, but @create is set a new
 *   tunnel device is created and registered for use.
 *
 * Return:
279
 *   matching tunnel or NULL
L
Linus Torvalds 已提交
280 281
 **/

282 283
static struct ip6_tnl *ip6_tnl_locate(struct net *net,
		struct ip6_tnl_parm *p, int create)
L
Linus Torvalds 已提交
284 285 286 287
{
	struct in6_addr *remote = &p->raddr;
	struct in6_addr *local = &p->laddr;
	struct ip6_tnl *t;
288
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
289

290
	for (t = *ip6_tnl_bucket(ip6n, p); t; t = t->next) {
L
Linus Torvalds 已提交
291
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
292 293
		    ipv6_addr_equal(remote, &t->parms.raddr))
			return t;
L
Linus Torvalds 已提交
294 295
	}
	if (!create)
296
		return NULL;
297
	return ip6_tnl_create(net, p);
L
Linus Torvalds 已提交
298 299 300
}

/**
301
 * ip6_tnl_dev_uninit - tunnel device uninitializer
L
Linus Torvalds 已提交
302
 *   @dev: the device to be destroyed
303
 *
L
Linus Torvalds 已提交
304
 * Description:
305
 *   ip6_tnl_dev_uninit() removes tunnel from its list
L
Linus Torvalds 已提交
306 307 308
 **/

static void
309
ip6_tnl_dev_uninit(struct net_device *dev)
L
Linus Torvalds 已提交
310
{
311
	struct ip6_tnl *t = netdev_priv(dev);
312 313
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
314

315
	if (dev == ip6n->fb_tnl_dev) {
316
		write_lock_bh(&ip6_tnl_lock);
317
		ip6n->tnls_wc[0] = NULL;
318
		write_unlock_bh(&ip6_tnl_lock);
L
Linus Torvalds 已提交
319
	} else {
320
		ip6_tnl_unlink(ip6n, t);
L
Linus Torvalds 已提交
321 322 323 324 325 326 327 328 329
	}
	ip6_tnl_dst_reset(t);
	dev_put(dev);
}

/**
 * parse_tvl_tnl_enc_lim - handle encapsulation limit option
 *   @skb: received socket buffer
 *
330 331
 * Return:
 *   0 if none was found,
L
Linus Torvalds 已提交
332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387
 *   else index to encapsulation limit
 **/

static __u16
parse_tlv_tnl_enc_lim(struct sk_buff *skb, __u8 * raw)
{
	struct ipv6hdr *ipv6h = (struct ipv6hdr *) raw;
	__u8 nexthdr = ipv6h->nexthdr;
	__u16 off = sizeof (*ipv6h);

	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
		__u16 optlen = 0;
		struct ipv6_opt_hdr *hdr;
		if (raw + off + sizeof (*hdr) > skb->data &&
		    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
			break;

		hdr = (struct ipv6_opt_hdr *) (raw + off);
		if (nexthdr == NEXTHDR_FRAGMENT) {
			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
			if (frag_hdr->frag_off)
				break;
			optlen = 8;
		} else if (nexthdr == NEXTHDR_AUTH) {
			optlen = (hdr->hdrlen + 2) << 2;
		} else {
			optlen = ipv6_optlen(hdr);
		}
		if (nexthdr == NEXTHDR_DEST) {
			__u16 i = off + 2;
			while (1) {
				struct ipv6_tlv_tnl_enc_lim *tel;

				/* No more room for encapsulation limit */
				if (i + sizeof (*tel) > off + optlen)
					break;

				tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
				/* return index of option if found and valid */
				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
				    tel->length == 1)
					return i;
				/* else jump to next option */
				if (tel->type)
					i += tel->length + 2;
				else
					i++;
			}
		}
		nexthdr = hdr->nexthdr;
		off += optlen;
	}
	return 0;
}

/**
388
 * ip6_tnl_err - tunnel error handler
L
Linus Torvalds 已提交
389 390
 *
 * Description:
391
 *   ip6_tnl_err() should handle errors in the tunnel according
L
Linus Torvalds 已提交
392 393 394
 *   to the specifications in RFC 2473.
 **/

H
Herbert Xu 已提交
395
static int
396
ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
397
	    u8 *type, u8 *code, int *msg, __u32 *info, int offset)
L
Linus Torvalds 已提交
398 399 400 401
{
	struct ipv6hdr *ipv6h = (struct ipv6hdr *) skb->data;
	struct ip6_tnl *t;
	int rel_msg = 0;
402 403
	u8 rel_type = ICMPV6_DEST_UNREACH;
	u8 rel_code = ICMPV6_ADDR_UNREACH;
L
Linus Torvalds 已提交
404 405
	__u32 rel_info = 0;
	__u16 len;
H
Herbert Xu 已提交
406
	int err = -ENOENT;
L
Linus Torvalds 已提交
407

408 409
	/* If the packet doesn't contain the original IPv6 header we are
	   in trouble since we might need the source address for further
L
Linus Torvalds 已提交
410 411
	   processing of the error. */

412
	read_lock(&ip6_tnl_lock);
413
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
414
					&ipv6h->saddr)) == NULL)
L
Linus Torvalds 已提交
415 416
		goto out;

417 418 419
	if (t->parms.proto != ipproto && t->parms.proto != 0)
		goto out;

H
Herbert Xu 已提交
420 421
	err = 0;

422
	switch (*type) {
L
Linus Torvalds 已提交
423 424 425 426 427 428 429 430 431 432 433
		__u32 teli;
		struct ipv6_tlv_tnl_enc_lim *tel;
		__u32 mtu;
	case ICMPV6_DEST_UNREACH:
		if (net_ratelimit())
			printk(KERN_WARNING
			       "%s: Path to destination invalid "
			       "or inactive!\n", t->parms.name);
		rel_msg = 1;
		break;
	case ICMPV6_TIME_EXCEED:
434
		if ((*code) == ICMPV6_EXC_HOPLIMIT) {
L
Linus Torvalds 已提交
435 436 437
			if (net_ratelimit())
				printk(KERN_WARNING
				       "%s: Too small hop limit or "
438
				       "routing loop in tunnel!\n",
L
Linus Torvalds 已提交
439 440 441 442 443
				       t->parms.name);
			rel_msg = 1;
		}
		break;
	case ICMPV6_PARAMPROB:
444
		teli = 0;
445
		if ((*code) == ICMPV6_HDR_FIELD)
446
			teli = parse_tlv_tnl_enc_lim(skb, skb->data);
L
Linus Torvalds 已提交
447

A
Al Viro 已提交
448
		if (teli && teli == *info - 2) {
L
Linus Torvalds 已提交
449 450 451 452 453 454 455 456 457
			tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
			if (tel->encap_limit == 0) {
				if (net_ratelimit())
					printk(KERN_WARNING
					       "%s: Too small encapsulation "
					       "limit or routing loop in "
					       "tunnel!\n", t->parms.name);
				rel_msg = 1;
			}
458 459 460 461
		} else if (net_ratelimit()) {
			printk(KERN_WARNING
			       "%s: Recipient unable to parse tunneled "
			       "packet!\n ", t->parms.name);
L
Linus Torvalds 已提交
462 463 464
		}
		break;
	case ICMPV6_PKT_TOOBIG:
A
Al Viro 已提交
465
		mtu = *info - offset;
L
Linus Torvalds 已提交
466 467 468 469
		if (mtu < IPV6_MIN_MTU)
			mtu = IPV6_MIN_MTU;
		t->dev->mtu = mtu;

A
Al Viro 已提交
470
		if ((len = sizeof (*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
L
Linus Torvalds 已提交
471 472 473 474 475 476 477
			rel_type = ICMPV6_PKT_TOOBIG;
			rel_code = 0;
			rel_info = mtu;
			rel_msg = 1;
		}
		break;
	}
478 479 480 481 482 483 484

	*type = rel_type;
	*code = rel_code;
	*info = rel_info;
	*msg = rel_msg;

out:
485
	read_unlock(&ip6_tnl_lock);
486 487 488
	return err;
}

489 490
static int
ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
491
	   u8 type, u8 code, int offset, __be32 info)
492 493
{
	int rel_msg = 0;
494 495
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
496
	__u32 rel_info = ntohl(info);
497 498 499 500 501 502
	int err;
	struct sk_buff *skb2;
	struct iphdr *eiph;
	struct flowi fl;
	struct rtable *rt;

503 504
	err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534
	if (err < 0)
		return err;

	if (rel_msg == 0)
		return 0;

	switch (rel_type) {
	case ICMPV6_DEST_UNREACH:
		if (rel_code != ICMPV6_ADDR_UNREACH)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_HOST_UNREACH;
		break;
	case ICMPV6_PKT_TOOBIG:
		if (rel_code != 0)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_FRAG_NEEDED;
		break;
	default:
		return 0;
	}

	if (!pskb_may_pull(skb, offset + sizeof(struct iphdr)))
		return 0;

	skb2 = skb_clone(skb, GFP_ATOMIC);
	if (!skb2)
		return 0;

E
Eric Dumazet 已提交
535 536
	skb_dst_drop(skb2);

537
	skb_pull(skb2, offset);
538
	skb_reset_network_header(skb2);
539
	eiph = ip_hdr(skb2);
540 541 542 543 544 545

	/* Try to guess incoming interface */
	memset(&fl, 0, sizeof(fl));
	fl.fl4_dst = eiph->saddr;
	fl.fl4_tos = RT_TOS(eiph->tos);
	fl.proto = IPPROTO_IPIP;
546
	if (ip_route_output_key(dev_net(skb->dev), &rt, &fl))
547 548 549 550 551 552 553 554 555 556 557
		goto out;

	skb2->dev = rt->u.dst.dev;

	/* route "incoming" packet */
	if (rt->rt_flags & RTCF_LOCAL) {
		ip_rt_put(rt);
		rt = NULL;
		fl.fl4_dst = eiph->daddr;
		fl.fl4_src = eiph->saddr;
		fl.fl4_tos = eiph->tos;
558
		if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
559 560 561 562
		    rt->u.dst.dev->type != ARPHRD_TUNNEL) {
			ip_rt_put(rt);
			goto out;
		}
E
Eric Dumazet 已提交
563
		skb_dst_set(skb2, (struct dst_entry *)rt);
564 565 566 567
	} else {
		ip_rt_put(rt);
		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
				   skb2->dev) ||
E
Eric Dumazet 已提交
568
		    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
569 570 571 572 573
			goto out;
	}

	/* change mtu on this route */
	if (rel_type == ICMP_DEST_UNREACH && rel_code == ICMP_FRAG_NEEDED) {
E
Eric Dumazet 已提交
574
		if (rel_info > dst_mtu(skb_dst(skb2)))
575 576
			goto out;

E
Eric Dumazet 已提交
577
		skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), rel_info);
578 579
	}

A
Al Viro 已提交
580
	icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
581 582 583 584 585 586

out:
	kfree_skb(skb2);
	return 0;
}

587 588
static int
ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
589
	   u8 type, u8 code, int offset, __be32 info)
590 591
{
	int rel_msg = 0;
592 593
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
594
	__u32 rel_info = ntohl(info);
595 596
	int err;

597 598
	err = ip6_tnl_err(skb, IPPROTO_IPV6, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
599 600 601 602
	if (err < 0)
		return err;

	if (rel_msg && pskb_may_pull(skb, offset + sizeof(struct ipv6hdr))) {
L
Linus Torvalds 已提交
603 604
		struct rt6_info *rt;
		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
605

L
Linus Torvalds 已提交
606
		if (!skb2)
607
			return 0;
L
Linus Torvalds 已提交
608

E
Eric Dumazet 已提交
609
		skb_dst_drop(skb2);
L
Linus Torvalds 已提交
610
		skb_pull(skb2, offset);
611
		skb_reset_network_header(skb2);
L
Linus Torvalds 已提交
612 613

		/* Try to guess incoming interface */
614 615
		rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr,
				NULL, 0, 0);
L
Linus Torvalds 已提交
616 617 618 619 620 621 622 623 624 625 626

		if (rt && rt->rt6i_dev)
			skb2->dev = rt->rt6i_dev;

		icmpv6_send(skb2, rel_type, rel_code, rel_info, skb2->dev);

		if (rt)
			dst_release(&rt->u.dst);

		kfree_skb(skb2);
	}
627 628

	return 0;
L
Linus Torvalds 已提交
629 630
}

631 632 633 634 635 636 637
static void ip4ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
					struct ipv6hdr *ipv6h,
					struct sk_buff *skb)
{
	__u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;

	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
638
		ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
639 640

	if (INET_ECN_is_ce(dsfield))
641
		IP_ECN_set_ce(ip_hdr(skb));
642 643
}

644 645 646
static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
					struct ipv6hdr *ipv6h,
					struct sk_buff *skb)
L
Linus Torvalds 已提交
647
{
648
	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
649
		ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
L
Linus Torvalds 已提交
650

651
	if (INET_ECN_is_ce(ipv6_get_dsfield(ipv6h)))
652
		IP6_ECN_set_ce(ipv6_hdr(skb));
L
Linus Torvalds 已提交
653
}
654

655 656 657 658
static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
	int ret = 0;
659
	struct net *net = dev_net(t->dev);
660 661

	if (p->flags & IP6_TNL_F_CAP_RCV) {
662
		struct net_device *ldev = NULL;
663 664

		if (p->link)
665
			ldev = dev_get_by_index(net, p->link);
666 667

		if ((ipv6_addr_is_multicast(&p->laddr) ||
668 669
		     likely(ipv6_chk_addr(net, &p->laddr, ldev, 0))) &&
		    likely(!ipv6_chk_addr(net, &p->raddr, NULL, 0)))
670 671 672 673 674 675 676
			ret = 1;

		if (ldev)
			dev_put(ldev);
	}
	return ret;
}
L
Linus Torvalds 已提交
677 678

/**
679
 * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
L
Linus Torvalds 已提交
680
 *   @skb: received socket buffer
681 682
 *   @protocol: ethernet protocol ID
 *   @dscp_ecn_decapsulate: the function to decapsulate DSCP code and ECN
L
Linus Torvalds 已提交
683 684 685 686
 *
 * Return: 0
 **/

687
static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
688
		       __u8 ipproto,
689 690 691
		       void (*dscp_ecn_decapsulate)(struct ip6_tnl *t,
						    struct ipv6hdr *ipv6h,
						    struct sk_buff *skb))
L
Linus Torvalds 已提交
692 693
{
	struct ip6_tnl *t;
694
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
L
Linus Torvalds 已提交
695

696
	read_lock(&ip6_tnl_lock);
L
Linus Torvalds 已提交
697

698
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
699
					&ipv6h->daddr)) != NULL) {
700 701 702 703 704
		if (t->parms.proto != ipproto && t->parms.proto != 0) {
			read_unlock(&ip6_tnl_lock);
			goto discard;
		}

L
Linus Torvalds 已提交
705
		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
706
			read_unlock(&ip6_tnl_lock);
707
			goto discard;
L
Linus Torvalds 已提交
708 709
		}

710
		if (!ip6_tnl_rcv_ctl(t)) {
711
			t->dev->stats.rx_dropped++;
712
			read_unlock(&ip6_tnl_lock);
L
Linus Torvalds 已提交
713 714 715
			goto discard;
		}
		secpath_reset(skb);
716
		skb->mac_header = skb->network_header;
717
		skb_reset_network_header(skb);
718
		skb->protocol = htons(protocol);
L
Linus Torvalds 已提交
719 720 721
		skb->pkt_type = PACKET_HOST;
		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
		skb->dev = t->dev;
E
Eric Dumazet 已提交
722
		skb_dst_drop(skb);
723
		nf_reset(skb);
724 725 726

		dscp_ecn_decapsulate(t, ipv6h, skb);

727 728
		t->dev->stats.rx_packets++;
		t->dev->stats.rx_bytes += skb->len;
L
Linus Torvalds 已提交
729
		netif_rx(skb);
730
		read_unlock(&ip6_tnl_lock);
L
Linus Torvalds 已提交
731 732
		return 0;
	}
733
	read_unlock(&ip6_tnl_lock);
L
Linus Torvalds 已提交
734
	return 1;
735 736 737 738

discard:
	kfree_skb(skb);
	return 0;
L
Linus Torvalds 已提交
739 740
}

741 742
static int ip4ip6_rcv(struct sk_buff *skb)
{
743 744
	return ip6_tnl_rcv(skb, ETH_P_IP, IPPROTO_IPIP,
			   ip4ip6_dscp_ecn_decapsulate);
745 746
}

747 748
static int ip6ip6_rcv(struct sk_buff *skb)
{
749 750
	return ip6_tnl_rcv(skb, ETH_P_IPV6, IPPROTO_IPV6,
			   ip6ip6_dscp_ecn_decapsulate);
751 752
}

753 754 755 756
struct ipv6_tel_txoption {
	struct ipv6_txoptions ops;
	__u8 dst_opt[8];
};
L
Linus Torvalds 已提交
757

758 759 760
static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
{
	memset(opt, 0, sizeof(struct ipv6_tel_txoption));
L
Linus Torvalds 已提交
761

762 763 764 765 766
	opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
	opt->dst_opt[3] = 1;
	opt->dst_opt[4] = encap_limit;
	opt->dst_opt[5] = IPV6_TLV_PADN;
	opt->dst_opt[6] = 1;
L
Linus Torvalds 已提交
767

768 769
	opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
	opt->ops.opt_nflen = 8;
L
Linus Torvalds 已提交
770 771 772
}

/**
773
 * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
L
Linus Torvalds 已提交
774
 *   @t: the outgoing tunnel device
775
 *   @hdr: IPv6 header from the incoming packet
L
Linus Torvalds 已提交
776 777
 *
 * Description:
778
 *   Avoid trivial tunneling loop by checking that tunnel exit-point
L
Linus Torvalds 已提交
779 780
 *   doesn't match source of incoming packet.
 *
781
 * Return:
L
Linus Torvalds 已提交
782 783 784 785 786
 *   1 if conflict,
 *   0 else
 **/

static inline int
787
ip6_tnl_addr_conflict(struct ip6_tnl *t, struct ipv6hdr *hdr)
L
Linus Torvalds 已提交
788 789 790 791
{
	return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
}

792 793 794 795
static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
	int ret = 0;
796
	struct net *net = dev_net(t->dev);
797

798
	if (p->flags & IP6_TNL_F_CAP_XMIT) {
799 800 801
		struct net_device *ldev = NULL;

		if (p->link)
802
			ldev = dev_get_by_index(net, p->link);
803

804
		if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
805 806 807 808
			printk(KERN_WARNING
			       "%s xmit: Local address not yet configured!\n",
			       p->name);
		else if (!ipv6_addr_is_multicast(&p->raddr) &&
809
			 unlikely(ipv6_chk_addr(net, &p->raddr, NULL, 0)))
810 811 812 813 814 815 816 817 818 819 820
			printk(KERN_WARNING
			       "%s xmit: Routing loop! "
			       "Remote address found on this node!\n",
			       p->name);
		else
			ret = 1;
		if (ldev)
			dev_put(ldev);
	}
	return ret;
}
L
Linus Torvalds 已提交
821
/**
822
 * ip6_tnl_xmit2 - encapsulate packet and send
L
Linus Torvalds 已提交
823
 *   @skb: the outgoing socket buffer
824
 *   @dev: the outgoing tunnel device
825 826 827 828
 *   @dsfield: dscp code for outer header
 *   @fl: flow of tunneled packet
 *   @encap_limit: encapsulation limit
 *   @pmtu: Path MTU is stored if packet is too big
L
Linus Torvalds 已提交
829 830 831 832 833
 *
 * Description:
 *   Build new header and do some sanity checks on the packet before sending
 *   it.
 *
834
 * Return:
835
 *   0 on success
836 837
 *   -1 fail
 *   %-EMSGSIZE message too big. return mtu in this case.
L
Linus Torvalds 已提交
838 839
 **/

840 841 842 843 844 845
static int ip6_tnl_xmit2(struct sk_buff *skb,
			 struct net_device *dev,
			 __u8 dsfield,
			 struct flowi *fl,
			 int encap_limit,
			 __u32 *pmtu)
L
Linus Torvalds 已提交
846
{
A
Alexey Dobriyan 已提交
847
	struct net *net = dev_net(dev);
848
	struct ip6_tnl *t = netdev_priv(dev);
849
	struct net_device_stats *stats = &t->dev->stats;
850
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
851
	struct ipv6_tel_txoption opt;
L
Linus Torvalds 已提交
852 853 854
	struct dst_entry *dst;
	struct net_device *tdev;
	int mtu;
855
	unsigned int max_headroom = sizeof(struct ipv6hdr);
L
Linus Torvalds 已提交
856
	u8 proto;
857
	int err = -1;
L
Linus Torvalds 已提交
858 859 860 861
	int pkt_len;

	if ((dst = ip6_tnl_dst_check(t)) != NULL)
		dst_hold(dst);
862
	else {
A
Alexey Dobriyan 已提交
863
		dst = ip6_route_output(net, NULL, fl);
L
Linus Torvalds 已提交
864

A
Alexey Dobriyan 已提交
865
		if (dst->error || xfrm_lookup(net, &dst, fl, NULL, 0) < 0)
866 867
			goto tx_err_link_failure;
	}
L
Linus Torvalds 已提交
868 869 870 871 872 873

	tdev = dst->dev;

	if (tdev == dev) {
		stats->collisions++;
		if (net_ratelimit())
874
			printk(KERN_WARNING
L
Linus Torvalds 已提交
875 876 877 878 879
			       "%s: Local routing loop detected!\n",
			       t->parms.name);
		goto tx_err_dst_release;
	}
	mtu = dst_mtu(dst) - sizeof (*ipv6h);
880
	if (encap_limit >= 0) {
L
Linus Torvalds 已提交
881 882 883 884 885
		max_headroom += 8;
		mtu -= 8;
	}
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;
E
Eric Dumazet 已提交
886 887
	if (skb_dst(skb))
		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
L
Linus Torvalds 已提交
888
	if (skb->len > mtu) {
889 890
		*pmtu = mtu;
		err = -EMSGSIZE;
L
Linus Torvalds 已提交
891 892 893 894 895 896 897
		goto tx_err_dst_release;
	}

	/*
	 * Okay, now see if we can stuff it in the buffer as-is.
	 */
	max_headroom += LL_RESERVED_SPACE(tdev);
898

899 900
	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
L
Linus Torvalds 已提交
901
		struct sk_buff *new_skb;
902

L
Linus Torvalds 已提交
903 904 905 906 907 908 909 910
		if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
			goto tx_err_dst_release;

		if (skb->sk)
			skb_set_owner_w(new_skb, skb->sk);
		kfree_skb(skb);
		skb = new_skb;
	}
E
Eric Dumazet 已提交
911 912
	skb_dst_drop(skb);
	skb_dst_set(skb, dst_clone(dst));
L
Linus Torvalds 已提交
913

914
	skb->transport_header = skb->network_header;
L
Linus Torvalds 已提交
915

916
	proto = fl->proto;
917 918 919 920
	if (encap_limit >= 0) {
		init_tel_txopt(&opt, encap_limit);
		ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
	}
921 922
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
923
	ipv6h = ipv6_hdr(skb);
924
	*(__be32*)ipv6h = fl->fl6_flowlabel | htonl(0x60000000);
L
Linus Torvalds 已提交
925 926 927 928
	dsfield = INET_ECN_encapsulate(0, dsfield);
	ipv6_change_dsfield(ipv6h, ~INET_ECN_MASK, dsfield);
	ipv6h->hop_limit = t->parms.hop_limit;
	ipv6h->nexthdr = proto;
929 930
	ipv6_addr_copy(&ipv6h->saddr, &fl->fl6_src);
	ipv6_addr_copy(&ipv6h->daddr, &fl->fl6_dst);
L
Linus Torvalds 已提交
931 932
	nf_reset(skb);
	pkt_len = skb->len;
H
Herbert Xu 已提交
933
	err = ip6_local_out(skb);
L
Linus Torvalds 已提交
934

935
	if (net_xmit_eval(err) == 0) {
L
Linus Torvalds 已提交
936 937 938 939 940 941 942 943 944 945 946 947 948
		stats->tx_bytes += pkt_len;
		stats->tx_packets++;
	} else {
		stats->tx_errors++;
		stats->tx_aborted_errors++;
	}
	ip6_tnl_dst_store(t, dst);
	return 0;
tx_err_link_failure:
	stats->tx_carrier_errors++;
	dst_link_failure(skb);
tx_err_dst_release:
	dst_release(dst);
949 950 951
	return err;
}

952 953 954 955
static inline int
ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
956
	struct iphdr  *iph = ip_hdr(skb);
957 958 959 960 961 962
	int encap_limit = -1;
	struct flowi fl;
	__u8 dsfield;
	__u32 mtu;
	int err;

963 964
	if ((t->parms.proto != IPPROTO_IPIP && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t))
965 966 967 968 969 970 971 972 973 974 975
		return -1;

	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

	memcpy(&fl, &t->fl, sizeof (fl));
	fl.proto = IPPROTO_IPIP;

	dsfield = ipv4_get_dsfield(iph);

	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
A
Al Viro 已提交
976 977
		fl.fl6_flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
					  & IPV6_TCLASS_MASK;
978 979 980 981 982 983 984 985 986 987 988 989 990

	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
	if (err != 0) {
		/* XXX: send ICMP error even if DF is not set. */
		if (err == -EMSGSIZE)
			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
				  htonl(mtu));
		return -1;
	}

	return 0;
}

991 992 993 994
static inline int
ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
995
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
996 997 998 999 1000 1001 1002
	int encap_limit = -1;
	__u16 offset;
	struct flowi fl;
	__u8 dsfield;
	__u32 mtu;
	int err;

1003 1004
	if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
1005 1006
		return -1;

1007 1008
	offset = parse_tlv_tnl_enc_lim(skb, skb_network_header(skb));
	if (offset > 0) {
1009
		struct ipv6_tlv_tnl_enc_lim *tel;
1010
		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042
		if (tel->encap_limit == 0) {
			icmpv6_send(skb, ICMPV6_PARAMPROB,
				    ICMPV6_HDR_FIELD, offset + 2, skb->dev);
			return -1;
		}
		encap_limit = tel->encap_limit - 1;
	} else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

	memcpy(&fl, &t->fl, sizeof (fl));
	fl.proto = IPPROTO_IPV6;

	dsfield = ipv6_get_dsfield(ipv6h);
	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
		fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
	if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
		fl.fl6_flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);

	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
	if (err != 0) {
		if (err == -EMSGSIZE)
			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
		return -1;
	}

	return 0;
}

static int
ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1043
	struct net_device_stats *stats = &t->dev->stats;
1044 1045 1046
	int ret;

	if (t->recursion++) {
1047
		stats->collisions++;
1048 1049 1050 1051
		goto tx_err;
	}

	switch (skb->protocol) {
1052
	case htons(ETH_P_IP):
1053 1054
		ret = ip4ip6_tnl_xmit(skb, dev);
		break;
1055
	case htons(ETH_P_IPV6):
1056 1057 1058 1059 1060 1061 1062 1063 1064 1065
		ret = ip6ip6_tnl_xmit(skb, dev);
		break;
	default:
		goto tx_err;
	}

	if (ret < 0)
		goto tx_err;

	t->recursion--;
1066
	return NETDEV_TX_OK;
1067

L
Linus Torvalds 已提交
1068 1069 1070 1071 1072
tx_err:
	stats->tx_errors++;
	stats->tx_dropped++;
	kfree_skb(skb);
	t->recursion--;
1073
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
1074 1075 1076 1077 1078
}

static void ip6_tnl_set_cap(struct ip6_tnl *t)
{
	struct ip6_tnl_parm *p = &t->parms;
1079 1080
	int ltype = ipv6_addr_type(&p->laddr);
	int rtype = ipv6_addr_type(&p->raddr);
L
Linus Torvalds 已提交
1081 1082 1083

	p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV);

1084 1085 1086
	if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
	    rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
	    !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
1087
	    (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
1088 1089 1090 1091
		if (ltype&IPV6_ADDR_UNICAST)
			p->flags |= IP6_TNL_F_CAP_XMIT;
		if (rtype&IPV6_ADDR_UNICAST)
			p->flags |= IP6_TNL_F_CAP_RCV;
L
Linus Torvalds 已提交
1092 1093 1094
	}
}

1095
static void ip6_tnl_link_config(struct ip6_tnl *t)
L
Linus Torvalds 已提交
1096 1097 1098 1099 1100
{
	struct net_device *dev = t->dev;
	struct ip6_tnl_parm *p = &t->parms;
	struct flowi *fl = &t->fl;

1101 1102
	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
	memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
L
Linus Torvalds 已提交
1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124

	/* Set up flowi template */
	ipv6_addr_copy(&fl->fl6_src, &p->laddr);
	ipv6_addr_copy(&fl->fl6_dst, &p->raddr);
	fl->oif = p->link;
	fl->fl6_flowlabel = 0;

	if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
		fl->fl6_flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
	if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
		fl->fl6_flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;

	ip6_tnl_set_cap(t);

	if (p->flags&IP6_TNL_F_CAP_XMIT && p->flags&IP6_TNL_F_CAP_RCV)
		dev->flags |= IFF_POINTOPOINT;
	else
		dev->flags &= ~IFF_POINTOPOINT;

	dev->iflink = p->link;

	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1125 1126 1127
		int strict = (ipv6_addr_type(&p->raddr) &
			      (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));

1128 1129
		struct rt6_info *rt = rt6_lookup(dev_net(dev),
						 &p->raddr, &p->laddr,
1130
						 p->link, strict);
L
Linus Torvalds 已提交
1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148

		if (rt == NULL)
			return;

		if (rt->rt6i_dev) {
			dev->hard_header_len = rt->rt6i_dev->hard_header_len +
				sizeof (struct ipv6hdr);

			dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);

			if (dev->mtu < IPV6_MIN_MTU)
				dev->mtu = IPV6_MIN_MTU;
		}
		dst_release(&rt->u.dst);
	}
}

/**
1149
 * ip6_tnl_change - update the tunnel parameters
L
Linus Torvalds 已提交
1150 1151 1152 1153
 *   @t: tunnel to be changed
 *   @p: tunnel configuration parameters
 *
 * Description:
1154
 *   ip6_tnl_change() updates the tunnel parameters
L
Linus Torvalds 已提交
1155 1156 1157
 **/

static int
1158
ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
L
Linus Torvalds 已提交
1159 1160 1161 1162 1163 1164 1165
{
	ipv6_addr_copy(&t->parms.laddr, &p->laddr);
	ipv6_addr_copy(&t->parms.raddr, &p->raddr);
	t->parms.flags = p->flags;
	t->parms.hop_limit = p->hop_limit;
	t->parms.encap_limit = p->encap_limit;
	t->parms.flowinfo = p->flowinfo;
1166
	t->parms.link = p->link;
1167
	t->parms.proto = p->proto;
1168
	ip6_tnl_dst_reset(t);
1169
	ip6_tnl_link_config(t);
L
Linus Torvalds 已提交
1170 1171 1172 1173
	return 0;
}

/**
1174
 * ip6_tnl_ioctl - configure ipv6 tunnels from userspace
L
Linus Torvalds 已提交
1175 1176 1177 1178 1179
 *   @dev: virtual device associated with tunnel
 *   @ifr: parameters passed from userspace
 *   @cmd: command to be performed
 *
 * Description:
1180
 *   ip6_tnl_ioctl() is used for managing IPv6 tunnels
1181
 *   from userspace.
L
Linus Torvalds 已提交
1182 1183 1184 1185 1186 1187 1188
 *
 *   The possible commands are the following:
 *     %SIOCGETTUNNEL: get tunnel parameters for device
 *     %SIOCADDTUNNEL: add tunnel matching given tunnel parameters
 *     %SIOCCHGTUNNEL: change tunnel parameters to those given
 *     %SIOCDELTUNNEL: delete tunnel
 *
1189
 *   The fallback device "ip6tnl0", created during module
L
Linus Torvalds 已提交
1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201
 *   initialization, can be used for creating other tunnel devices.
 *
 * Return:
 *   0 on success,
 *   %-EFAULT if unable to copy data to or from userspace,
 *   %-EPERM if current process hasn't %CAP_NET_ADMIN set
 *   %-EINVAL if passed tunnel parameters are invalid,
 *   %-EEXIST if changing a tunnel's parameters would cause a conflict
 *   %-ENODEV if attempting to change or delete a nonexisting device
 **/

static int
1202
ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
L
Linus Torvalds 已提交
1203 1204 1205 1206
{
	int err = 0;
	struct ip6_tnl_parm p;
	struct ip6_tnl *t = NULL;
1207 1208
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
1209 1210 1211

	switch (cmd) {
	case SIOCGETTUNNEL:
1212
		if (dev == ip6n->fb_tnl_dev) {
1213
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p))) {
L
Linus Torvalds 已提交
1214 1215 1216
				err = -EFAULT;
				break;
			}
1217
			t = ip6_tnl_locate(net, &p, 0);
1218 1219
		}
		if (t == NULL)
1220
			t = netdev_priv(dev);
L
Linus Torvalds 已提交
1221 1222 1223 1224 1225 1226 1227 1228 1229 1230
		memcpy(&p, &t->parms, sizeof (p));
		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
			err = -EFAULT;
		}
		break;
	case SIOCADDTUNNEL:
	case SIOCCHGTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
			break;
1231 1232
		err = -EFAULT;
		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1233
			break;
1234
		err = -EINVAL;
1235 1236
		if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
		    p.proto != 0)
L
Linus Torvalds 已提交
1237
			break;
1238
		t = ip6_tnl_locate(net, &p, cmd == SIOCADDTUNNEL);
1239
		if (dev != ip6n->fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
1240 1241 1242 1243 1244 1245 1246 1247
			if (t != NULL) {
				if (t->dev != dev) {
					err = -EEXIST;
					break;
				}
			} else
				t = netdev_priv(dev);

1248
			ip6_tnl_unlink(ip6n, t);
1249
			err = ip6_tnl_change(t, &p);
1250
			ip6_tnl_link(ip6n, t);
L
Linus Torvalds 已提交
1251 1252
			netdev_state_change(dev);
		}
1253
		if (t) {
L
Linus Torvalds 已提交
1254
			err = 0;
1255 1256 1257 1258 1259
			if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof (p)))
				err = -EFAULT;

		} else
			err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
L
Linus Torvalds 已提交
1260 1261 1262 1263 1264 1265
		break;
	case SIOCDELTUNNEL:
		err = -EPERM;
		if (!capable(CAP_NET_ADMIN))
			break;

1266
		if (dev == ip6n->fb_tnl_dev) {
1267 1268
			err = -EFAULT;
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1269
				break;
1270
			err = -ENOENT;
1271
			if ((t = ip6_tnl_locate(net, &p, 0)) == NULL)
L
Linus Torvalds 已提交
1272
				break;
1273
			err = -EPERM;
1274
			if (t->dev == ip6n->fb_tnl_dev)
L
Linus Torvalds 已提交
1275
				break;
1276
			dev = t->dev;
L
Linus Torvalds 已提交
1277
		}
1278 1279
		err = 0;
		unregister_netdevice(dev);
L
Linus Torvalds 已提交
1280 1281 1282 1283 1284 1285 1286 1287
		break;
	default:
		err = -EINVAL;
	}
	return err;
}

/**
1288
 * ip6_tnl_change_mtu - change mtu manually for tunnel device
L
Linus Torvalds 已提交
1289 1290 1291 1292 1293 1294 1295 1296 1297
 *   @dev: virtual device associated with tunnel
 *   @new_mtu: the new mtu
 *
 * Return:
 *   0 on success,
 *   %-EINVAL if mtu too small
 **/

static int
1298
ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
L
Linus Torvalds 已提交
1299 1300 1301 1302 1303 1304 1305 1306
{
	if (new_mtu < IPV6_MIN_MTU) {
		return -EINVAL;
	}
	dev->mtu = new_mtu;
	return 0;
}

1307 1308 1309 1310 1311 1312 1313 1314

static const struct net_device_ops ip6_tnl_netdev_ops = {
	.ndo_uninit = ip6_tnl_dev_uninit,
	.ndo_start_xmit = ip6_tnl_xmit,
	.ndo_do_ioctl = ip6_tnl_ioctl,
	.ndo_change_mtu = ip6_tnl_change_mtu,
};

L
Linus Torvalds 已提交
1315
/**
1316
 * ip6_tnl_dev_setup - setup virtual tunnel device
L
Linus Torvalds 已提交
1317 1318 1319 1320 1321 1322
 *   @dev: virtual device associated with tunnel
 *
 * Description:
 *   Initialize function pointers and device parameters
 **/

1323
static void ip6_tnl_dev_setup(struct net_device *dev)
L
Linus Torvalds 已提交
1324
{
1325
	dev->netdev_ops = &ip6_tnl_netdev_ops;
L
Linus Torvalds 已提交
1326 1327 1328 1329 1330 1331 1332
	dev->destructor = free_netdev;

	dev->type = ARPHRD_TUNNEL6;
	dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
	dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
	dev->flags |= IFF_NOARP;
	dev->addr_len = sizeof(struct in6_addr);
1333
	dev->features |= NETIF_F_NETNS_LOCAL;
L
Linus Torvalds 已提交
1334 1335 1336 1337
}


/**
1338
 * ip6_tnl_dev_init_gen - general initializer for all tunnel devices
L
Linus Torvalds 已提交
1339 1340 1341 1342
 *   @dev: virtual device associated with tunnel
 **/

static inline void
1343
ip6_tnl_dev_init_gen(struct net_device *dev)
L
Linus Torvalds 已提交
1344
{
1345
	struct ip6_tnl *t = netdev_priv(dev);
L
Linus Torvalds 已提交
1346 1347 1348 1349 1350
	t->dev = dev;
	strcpy(t->parms.name, dev->name);
}

/**
1351
 * ip6_tnl_dev_init - initializer for all non fallback tunnel devices
L
Linus Torvalds 已提交
1352 1353 1354
 *   @dev: virtual device associated with tunnel
 **/

1355
static void ip6_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1356
{
1357
	struct ip6_tnl *t = netdev_priv(dev);
1358 1359
	ip6_tnl_dev_init_gen(dev);
	ip6_tnl_link_config(t);
L
Linus Torvalds 已提交
1360 1361 1362
}

/**
1363
 * ip6_fb_tnl_dev_init - initializer for fallback tunnel device
L
Linus Torvalds 已提交
1364 1365 1366 1367 1368
 *   @dev: fallback device
 *
 * Return: 0
 **/

1369
static void ip6_fb_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1370
{
1371
	struct ip6_tnl *t = netdev_priv(dev);
1372 1373 1374
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);

1375
	ip6_tnl_dev_init_gen(dev);
1376
	t->parms.proto = IPPROTO_IPV6;
L
Linus Torvalds 已提交
1377
	dev_hold(dev);
1378
	ip6n->tnls_wc[0] = t;
L
Linus Torvalds 已提交
1379 1380
}

1381 1382 1383 1384 1385 1386
static struct xfrm6_tunnel ip4ip6_handler = {
	.handler	= ip4ip6_rcv,
	.err_handler	= ip4ip6_err,
	.priority	=	1,
};

L
Linus Torvalds 已提交
1387
static struct xfrm6_tunnel ip6ip6_handler = {
1388 1389
	.handler	= ip6ip6_rcv,
	.err_handler	= ip6ip6_err,
H
Herbert Xu 已提交
1390
	.priority	=	1,
L
Linus Torvalds 已提交
1391 1392
};

1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406
static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
{
	int h;
	struct ip6_tnl *t;

	for (h = 0; h < HASH_SIZE; h++) {
		while ((t = ip6n->tnls_r_l[h]) != NULL)
			unregister_netdevice(t->dev);
	}

	t = ip6n->tnls_wc[0];
	unregister_netdevice(t->dev);
}

1407 1408 1409 1410 1411 1412
static int ip6_tnl_init_net(struct net *net)
{
	int err;
	struct ip6_tnl_net *ip6n;

	err = -ENOMEM;
1413
	ip6n = kzalloc(sizeof(struct ip6_tnl_net), GFP_KERNEL);
1414 1415 1416 1417 1418 1419 1420
	if (ip6n == NULL)
		goto err_alloc;

	err = net_assign_generic(net, ip6_tnl_net_id, ip6n);
	if (err < 0)
		goto err_assign;

1421 1422 1423
	ip6n->tnls[0] = ip6n->tnls_wc;
	ip6n->tnls[1] = ip6n->tnls_r_l;

1424 1425 1426 1427 1428 1429
	err = -ENOMEM;
	ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0",
				      ip6_tnl_dev_setup);

	if (!ip6n->fb_tnl_dev)
		goto err_alloc_dev;
1430
	dev_net_set(ip6n->fb_tnl_dev, net);
1431

1432
	ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
1433 1434 1435 1436

	err = register_netdev(ip6n->fb_tnl_dev);
	if (err < 0)
		goto err_register;
1437 1438
	return 0;

1439 1440 1441 1442
err_register:
	free_netdev(ip6n->fb_tnl_dev);
err_alloc_dev:
	/* nothing */
1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453
err_assign:
	kfree(ip6n);
err_alloc:
	return err;
}

static void ip6_tnl_exit_net(struct net *net)
{
	struct ip6_tnl_net *ip6n;

	ip6n = net_generic(net, ip6_tnl_net_id);
1454 1455 1456
	rtnl_lock();
	ip6_tnl_destroy_tunnels(ip6n);
	rtnl_unlock();
1457 1458 1459 1460 1461 1462 1463 1464
	kfree(ip6n);
}

static struct pernet_operations ip6_tnl_net_ops = {
	.init = ip6_tnl_init_net,
	.exit = ip6_tnl_exit_net,
};

L
Linus Torvalds 已提交
1465 1466 1467 1468 1469 1470 1471 1472 1473 1474
/**
 * ip6_tunnel_init - register protocol and reserve needed resources
 *
 * Return: 0 on success
 **/

static int __init ip6_tunnel_init(void)
{
	int  err;

1475
	if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) {
1476
		printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
1477 1478 1479 1480
		err = -EAGAIN;
		goto out;
	}

1481
	if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) {
1482
		printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
1483 1484
		err = -EAGAIN;
		goto unreg_ip4ip6;
L
Linus Torvalds 已提交
1485
	}
1486 1487 1488 1489

	err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
	if (err < 0)
		goto err_pernet;
L
Linus Torvalds 已提交
1490
	return 0;
1491
err_pernet:
1492
	xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
1493 1494 1495
unreg_ip4ip6:
	xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
out:
L
Linus Torvalds 已提交
1496 1497 1498 1499 1500 1501 1502 1503 1504
	return err;
}

/**
 * ip6_tunnel_cleanup - free resources and unregister protocol
 **/

static void __exit ip6_tunnel_cleanup(void)
{
1505
	if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
1506
		printk(KERN_INFO "ip6_tunnel close: can't deregister ip4ip6\n");
1507

1508
	if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
1509
		printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
L
Linus Torvalds 已提交
1510

1511
	unregister_pernet_gen_device(ip6_tnl_net_id, &ip6_tnl_net_ops);
L
Linus Torvalds 已提交
1512 1513 1514 1515
}

module_init(ip6_tunnel_init);
module_exit(ip6_tunnel_cleanup);