ip6_tunnel.c 44.1 KB
Newer Older
L
Linus Torvalds 已提交
1
/*
2
 *	IPv6 tunneling device
L
Linus Torvalds 已提交
3 4 5
 *	Linux INET6 implementation
 *
 *	Authors:
6
 *	Ville Nuorvala		<vnuorval@tcs.hut.fi>
7
 *	Yasuyuki Kozakai	<kozakai@linux-ipv6.org>
L
Linus Torvalds 已提交
8 9
 *
 *      Based on:
10
 *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
L
Linus Torvalds 已提交
11 12 13 14 15 16 17 18 19 20
 *
 *      RFC 2473
 *
 *	This program is free software; you can redistribute it and/or
 *      modify it under the terms of the GNU General Public License
 *      as published by the Free Software Foundation; either version
 *      2 of the License, or (at your option) any later version.
 *
 */

21 22
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
23
#include <linux/module.h>
24
#include <linux/capability.h>
L
Linus Torvalds 已提交
25 26 27
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/sockios.h>
28
#include <linux/icmp.h>
L
Linus Torvalds 已提交
29 30 31 32 33 34 35 36 37 38 39 40 41
#include <linux/if.h>
#include <linux/in.h>
#include <linux/ip.h>
#include <linux/if_tunnel.h>
#include <linux/net.h>
#include <linux/in6.h>
#include <linux/netdevice.h>
#include <linux/if_arp.h>
#include <linux/icmpv6.h>
#include <linux/init.h>
#include <linux/route.h>
#include <linux/rtnetlink.h>
#include <linux/netfilter_ipv6.h>
42
#include <linux/slab.h>
E
Eric Dumazet 已提交
43
#include <linux/hash.h>
44
#include <linux/etherdevice.h>
L
Linus Torvalds 已提交
45 46

#include <asm/uaccess.h>
A
Arun Sharma 已提交
47
#include <linux/atomic.h>
L
Linus Torvalds 已提交
48

49
#include <net/icmp.h>
L
Linus Torvalds 已提交
50
#include <net/ip.h>
51
#include <net/ip_tunnels.h>
L
Linus Torvalds 已提交
52 53 54 55 56 57 58
#include <net/ipv6.h>
#include <net/ip6_route.h>
#include <net/addrconf.h>
#include <net/ip6_tunnel.h>
#include <net/xfrm.h>
#include <net/dsfield.h>
#include <net/inet_ecn.h>
59 60
#include <net/net_namespace.h>
#include <net/netns/generic.h>
L
Linus Torvalds 已提交
61 62

MODULE_AUTHOR("Ville Nuorvala");
63
MODULE_DESCRIPTION("IPv6 tunneling device");
L
Linus Torvalds 已提交
64
MODULE_LICENSE("GPL");
S
stephen hemminger 已提交
65
MODULE_ALIAS_NETDEV("ip6tnl0");
L
Linus Torvalds 已提交
66 67

#ifdef IP6_TNL_DEBUG
68
#define IP6_TNL_TRACE(x...) pr_debug("%s:" x "\n", __func__)
L
Linus Torvalds 已提交
69 70 71 72 73
#else
#define IP6_TNL_TRACE(x...) do {;} while(0)
#endif

#define IPV6_TCLASS_MASK (IPV6_FLOWINFO_MASK & ~IPV6_FLOWLABEL_MASK)
74
#define IPV6_TCLASS_SHIFT 20
L
Linus Torvalds 已提交
75

E
Eric Dumazet 已提交
76 77
#define HASH_SIZE_SHIFT  5
#define HASH_SIZE (1 << HASH_SIZE_SHIFT)
L
Linus Torvalds 已提交
78

79 80 81 82
static bool log_ecn_error = true;
module_param(log_ecn_error, bool, 0644);
MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");

E
Eric Dumazet 已提交
83 84 85 86 87 88
static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
{
	u32 hash = ipv6_addr_hash(addr1) ^ ipv6_addr_hash(addr2);

	return hash_32(hash, HASH_SIZE_SHIFT);
}
L
Linus Torvalds 已提交
89

E
Eric Dumazet 已提交
90
static int ip6_tnl_dev_init(struct net_device *dev);
91
static void ip6_tnl_dev_setup(struct net_device *dev);
92
static struct rtnl_link_ops ip6_link_ops __read_mostly;
L
Linus Torvalds 已提交
93

94
static int ip6_tnl_net_id __read_mostly;
95
struct ip6_tnl_net {
96 97
	/* the IPv6 tunnel fallback device */
	struct net_device *fb_tnl_dev;
98
	/* lists for storing tunnels in use */
E
Eric Dumazet 已提交
99 100 101
	struct ip6_tnl __rcu *tnls_r_l[HASH_SIZE];
	struct ip6_tnl __rcu *tnls_wc[1];
	struct ip6_tnl __rcu **tnls[2];
102 103
};

E
Eric Dumazet 已提交
104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123
static struct net_device_stats *ip6_get_stats(struct net_device *dev)
{
	struct pcpu_tstats sum = { 0 };
	int i;

	for_each_possible_cpu(i) {
		const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);

		sum.rx_packets += tstats->rx_packets;
		sum.rx_bytes   += tstats->rx_bytes;
		sum.tx_packets += tstats->tx_packets;
		sum.tx_bytes   += tstats->tx_bytes;
	}
	dev->stats.rx_packets = sum.rx_packets;
	dev->stats.rx_bytes   = sum.rx_bytes;
	dev->stats.tx_packets = sum.tx_packets;
	dev->stats.tx_bytes   = sum.tx_bytes;
	return &dev->stats;
}

124
/*
E
Eric Dumazet 已提交
125
 * Locking : hash tables are protected by RCU and RTNL
126
 */
L
Linus Torvalds 已提交
127

X
xeb@mail.ru 已提交
128
struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
L
Linus Torvalds 已提交
129 130 131
{
	struct dst_entry *dst = t->dst_cache;

132
	if (dst && dst->obsolete &&
L
Linus Torvalds 已提交
133 134 135 136 137 138 139 140
	    dst->ops->check(dst, t->dst_cookie) == NULL) {
		t->dst_cache = NULL;
		dst_release(dst);
		return NULL;
	}

	return dst;
}
X
xeb@mail.ru 已提交
141
EXPORT_SYMBOL_GPL(ip6_tnl_dst_check);
L
Linus Torvalds 已提交
142

X
xeb@mail.ru 已提交
143
void ip6_tnl_dst_reset(struct ip6_tnl *t)
L
Linus Torvalds 已提交
144 145 146 147
{
	dst_release(t->dst_cache);
	t->dst_cache = NULL;
}
X
xeb@mail.ru 已提交
148
EXPORT_SYMBOL_GPL(ip6_tnl_dst_reset);
L
Linus Torvalds 已提交
149

X
xeb@mail.ru 已提交
150
void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
L
Linus Torvalds 已提交
151 152 153 154 155 156
{
	struct rt6_info *rt = (struct rt6_info *) dst;
	t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
	dst_release(t->dst_cache);
	t->dst_cache = dst;
}
X
xeb@mail.ru 已提交
157
EXPORT_SYMBOL_GPL(ip6_tnl_dst_store);
L
Linus Torvalds 已提交
158 159

/**
160
 * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
161 162
 *   @remote: the address of the tunnel exit-point
 *   @local: the address of the tunnel entry-point
L
Linus Torvalds 已提交
163
 *
164
 * Return:
L
Linus Torvalds 已提交
165
 *   tunnel matching given end-points if found,
166
 *   else fallback tunnel if its device is up,
L
Linus Torvalds 已提交
167 168 169
 *   else %NULL
 **/

170 171 172
#define for_each_ip6_tunnel_rcu(start) \
	for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))

L
Linus Torvalds 已提交
173
static struct ip6_tnl *
174
ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
L
Linus Torvalds 已提交
175
{
E
Eric Dumazet 已提交
176
	unsigned int hash = HASH(remote, local);
L
Linus Torvalds 已提交
177
	struct ip6_tnl *t;
178
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
179

E
Eric Dumazet 已提交
180
	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
L
Linus Torvalds 已提交
181 182 183 184 185
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
		    ipv6_addr_equal(remote, &t->parms.raddr) &&
		    (t->dev->flags & IFF_UP))
			return t;
	}
186 187
	t = rcu_dereference(ip6n->tnls_wc[0]);
	if (t && (t->dev->flags & IFF_UP))
L
Linus Torvalds 已提交
188 189 190 191 192 193
		return t;

	return NULL;
}

/**
194
 * ip6_tnl_bucket - get head of list matching given tunnel parameters
195
 *   @p: parameters containing tunnel end-points
L
Linus Torvalds 已提交
196 197
 *
 * Description:
198
 *   ip6_tnl_bucket() returns the head of the list matching the
L
Linus Torvalds 已提交
199 200
 *   &struct in6_addr entries laddr and raddr in @p.
 *
201
 * Return: head of IPv6 tunnel list
L
Linus Torvalds 已提交
202 203
 **/

E
Eric Dumazet 已提交
204
static struct ip6_tnl __rcu **
X
xeb@mail.ru 已提交
205
ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct __ip6_tnl_parm *p)
L
Linus Torvalds 已提交
206
{
207 208
	const struct in6_addr *remote = &p->raddr;
	const struct in6_addr *local = &p->laddr;
209
	unsigned int h = 0;
L
Linus Torvalds 已提交
210 211 212 213
	int prio = 0;

	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
		prio = 1;
E
Eric Dumazet 已提交
214
		h = HASH(remote, local);
L
Linus Torvalds 已提交
215
	}
216
	return &ip6n->tnls[prio][h];
L
Linus Torvalds 已提交
217 218 219
}

/**
220
 * ip6_tnl_link - add tunnel to hash table
L
Linus Torvalds 已提交
221 222 223 224
 *   @t: tunnel to be added
 **/

static void
225
ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
226
{
E
Eric Dumazet 已提交
227
	struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
L
Linus Torvalds 已提交
228

229 230
	rcu_assign_pointer(t->next , rtnl_dereference(*tp));
	rcu_assign_pointer(*tp, t);
L
Linus Torvalds 已提交
231 232 233
}

/**
234
 * ip6_tnl_unlink - remove tunnel from hash table
L
Linus Torvalds 已提交
235 236 237 238
 *   @t: tunnel to be removed
 **/

static void
239
ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
L
Linus Torvalds 已提交
240
{
E
Eric Dumazet 已提交
241 242 243 244 245 246 247
	struct ip6_tnl __rcu **tp;
	struct ip6_tnl *iter;

	for (tp = ip6_tnl_bucket(ip6n, &t->parms);
	     (iter = rtnl_dereference(*tp)) != NULL;
	     tp = &iter->next) {
		if (t == iter) {
248
			rcu_assign_pointer(*tp, t->next);
L
Linus Torvalds 已提交
249 250 251 252 253
			break;
		}
	}
}

E
Eric Dumazet 已提交
254 255 256 257 258 259
static void ip6_dev_free(struct net_device *dev)
{
	free_percpu(dev->tstats);
	free_netdev(dev);
}

260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286
static int ip6_tnl_create2(struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
	int err;

	t = netdev_priv(dev);
	err = ip6_tnl_dev_init(dev);
	if (err < 0)
		goto out;

	err = register_netdevice(dev);
	if (err < 0)
		goto out;

	strcpy(t->parms.name, dev->name);
	dev->rtnl_link_ops = &ip6_link_ops;

	dev_hold(dev);
	ip6_tnl_link(ip6n, t);
	return 0;

out:
	return err;
}

L
Linus Torvalds 已提交
287
/**
288
 * ip6_tnl_create - create a new tunnel
L
Linus Torvalds 已提交
289 290 291 292 293
 *   @p: tunnel parameters
 *   @pt: pointer to new tunnel
 *
 * Description:
 *   Create tunnel matching given parameters.
294 295
 *
 * Return:
296
 *   created tunnel or NULL
L
Linus Torvalds 已提交
297 298
 **/

X
xeb@mail.ru 已提交
299
static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
L
Linus Torvalds 已提交
300 301 302 303 304 305
{
	struct net_device *dev;
	struct ip6_tnl *t;
	char name[IFNAMSIZ];
	int err;

306
	if (p->name[0])
L
Linus Torvalds 已提交
307
		strlcpy(name, p->name, IFNAMSIZ);
308 309 310
	else
		sprintf(name, "ip6tnl%%d");

311
	dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup);
L
Linus Torvalds 已提交
312
	if (dev == NULL)
313
		goto failed;
L
Linus Torvalds 已提交
314

315 316
	dev_net_set(dev, net);

317
	t = netdev_priv(dev);
L
Linus Torvalds 已提交
318
	t->parms = *p;
N
Nicolas Dichtel 已提交
319
	t->net = dev_net(dev);
320
	err = ip6_tnl_create2(dev);
E
Eric Dumazet 已提交
321 322
	if (err < 0)
		goto failed_free;
L
Linus Torvalds 已提交
323

324
	return t;
325 326

failed_free:
E
Eric Dumazet 已提交
327
	ip6_dev_free(dev);
328 329
failed:
	return NULL;
L
Linus Torvalds 已提交
330 331 332
}

/**
333
 * ip6_tnl_locate - find or create tunnel matching given parameters
334
 *   @p: tunnel parameters
L
Linus Torvalds 已提交
335 336 337
 *   @create: != 0 if allowed to create new tunnel if no match found
 *
 * Description:
338
 *   ip6_tnl_locate() first tries to locate an existing tunnel
L
Linus Torvalds 已提交
339 340 341 342
 *   based on @parms. If this is unsuccessful, but @create is set a new
 *   tunnel device is created and registered for use.
 *
 * Return:
343
 *   matching tunnel or NULL
L
Linus Torvalds 已提交
344 345
 **/

346
static struct ip6_tnl *ip6_tnl_locate(struct net *net,
X
xeb@mail.ru 已提交
347
		struct __ip6_tnl_parm *p, int create)
L
Linus Torvalds 已提交
348
{
349 350
	const struct in6_addr *remote = &p->raddr;
	const struct in6_addr *local = &p->laddr;
E
Eric Dumazet 已提交
351
	struct ip6_tnl __rcu **tp;
L
Linus Torvalds 已提交
352
	struct ip6_tnl *t;
353
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
354

E
Eric Dumazet 已提交
355 356 357
	for (tp = ip6_tnl_bucket(ip6n, p);
	     (t = rtnl_dereference(*tp)) != NULL;
	     tp = &t->next) {
L
Linus Torvalds 已提交
358
		if (ipv6_addr_equal(local, &t->parms.laddr) &&
359 360
		    ipv6_addr_equal(remote, &t->parms.raddr))
			return t;
L
Linus Torvalds 已提交
361 362
	}
	if (!create)
363
		return NULL;
364
	return ip6_tnl_create(net, p);
L
Linus Torvalds 已提交
365 366 367
}

/**
368
 * ip6_tnl_dev_uninit - tunnel device uninitializer
L
Linus Torvalds 已提交
369
 *   @dev: the device to be destroyed
370
 *
L
Linus Torvalds 已提交
371
 * Description:
372
 *   ip6_tnl_dev_uninit() removes tunnel from its list
L
Linus Torvalds 已提交
373 374 375
 **/

static void
376
ip6_tnl_dev_uninit(struct net_device *dev)
L
Linus Torvalds 已提交
377
{
378
	struct ip6_tnl *t = netdev_priv(dev);
N
Nicolas Dichtel 已提交
379
	struct net *net = t->net;
380
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
381

E
Eric Dumazet 已提交
382
	if (dev == ip6n->fb_tnl_dev)
383
		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
E
Eric Dumazet 已提交
384
	else
385
		ip6_tnl_unlink(ip6n, t);
L
Linus Torvalds 已提交
386 387 388 389 390 391 392 393
	ip6_tnl_dst_reset(t);
	dev_put(dev);
}

/**
 * parse_tvl_tnl_enc_lim - handle encapsulation limit option
 *   @skb: received socket buffer
 *
394 395
 * Return:
 *   0 if none was found,
L
Linus Torvalds 已提交
396 397 398
 *   else index to encapsulation limit
 **/

X
xeb@mail.ru 已提交
399
__u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
L
Linus Torvalds 已提交
400
{
401
	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw;
L
Linus Torvalds 已提交
402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448
	__u8 nexthdr = ipv6h->nexthdr;
	__u16 off = sizeof (*ipv6h);

	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
		__u16 optlen = 0;
		struct ipv6_opt_hdr *hdr;
		if (raw + off + sizeof (*hdr) > skb->data &&
		    !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr)))
			break;

		hdr = (struct ipv6_opt_hdr *) (raw + off);
		if (nexthdr == NEXTHDR_FRAGMENT) {
			struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
			if (frag_hdr->frag_off)
				break;
			optlen = 8;
		} else if (nexthdr == NEXTHDR_AUTH) {
			optlen = (hdr->hdrlen + 2) << 2;
		} else {
			optlen = ipv6_optlen(hdr);
		}
		if (nexthdr == NEXTHDR_DEST) {
			__u16 i = off + 2;
			while (1) {
				struct ipv6_tlv_tnl_enc_lim *tel;

				/* No more room for encapsulation limit */
				if (i + sizeof (*tel) > off + optlen)
					break;

				tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i];
				/* return index of option if found and valid */
				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
				    tel->length == 1)
					return i;
				/* else jump to next option */
				if (tel->type)
					i += tel->length + 2;
				else
					i++;
			}
		}
		nexthdr = hdr->nexthdr;
		off += optlen;
	}
	return 0;
}
X
xeb@mail.ru 已提交
449
EXPORT_SYMBOL(ip6_tnl_parse_tlv_enc_lim);
L
Linus Torvalds 已提交
450 451

/**
452
 * ip6_tnl_err - tunnel error handler
L
Linus Torvalds 已提交
453 454
 *
 * Description:
455
 *   ip6_tnl_err() should handle errors in the tunnel according
L
Linus Torvalds 已提交
456 457 458
 *   to the specifications in RFC 2473.
 **/

H
Herbert Xu 已提交
459
static int
460
ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
461
	    u8 *type, u8 *code, int *msg, __u32 *info, int offset)
L
Linus Torvalds 已提交
462
{
463
	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) skb->data;
L
Linus Torvalds 已提交
464 465
	struct ip6_tnl *t;
	int rel_msg = 0;
466 467
	u8 rel_type = ICMPV6_DEST_UNREACH;
	u8 rel_code = ICMPV6_ADDR_UNREACH;
L
Linus Torvalds 已提交
468 469
	__u32 rel_info = 0;
	__u16 len;
H
Herbert Xu 已提交
470
	int err = -ENOENT;
L
Linus Torvalds 已提交
471

472 473
	/* If the packet doesn't contain the original IPv6 header we are
	   in trouble since we might need the source address for further
L
Linus Torvalds 已提交
474 475
	   processing of the error. */

476
	rcu_read_lock();
477
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
478
					&ipv6h->saddr)) == NULL)
L
Linus Torvalds 已提交
479 480
		goto out;

481 482 483
	if (t->parms.proto != ipproto && t->parms.proto != 0)
		goto out;

H
Herbert Xu 已提交
484 485
	err = 0;

486
	switch (*type) {
L
Linus Torvalds 已提交
487 488 489 490
		__u32 teli;
		struct ipv6_tlv_tnl_enc_lim *tel;
		__u32 mtu;
	case ICMPV6_DEST_UNREACH:
491 492
		net_warn_ratelimited("%s: Path to destination invalid or inactive!\n",
				     t->parms.name);
L
Linus Torvalds 已提交
493 494 495
		rel_msg = 1;
		break;
	case ICMPV6_TIME_EXCEED:
496
		if ((*code) == ICMPV6_EXC_HOPLIMIT) {
497 498
			net_warn_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
					     t->parms.name);
L
Linus Torvalds 已提交
499 500 501 502
			rel_msg = 1;
		}
		break;
	case ICMPV6_PARAMPROB:
503
		teli = 0;
504
		if ((*code) == ICMPV6_HDR_FIELD)
X
xeb@mail.ru 已提交
505
			teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
L
Linus Torvalds 已提交
506

A
Al Viro 已提交
507
		if (teli && teli == *info - 2) {
L
Linus Torvalds 已提交
508 509
			tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
			if (tel->encap_limit == 0) {
510 511
				net_warn_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
						     t->parms.name);
L
Linus Torvalds 已提交
512 513
				rel_msg = 1;
			}
514 515 516
		} else {
			net_warn_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
					     t->parms.name);
L
Linus Torvalds 已提交
517 518 519
		}
		break;
	case ICMPV6_PKT_TOOBIG:
A
Al Viro 已提交
520
		mtu = *info - offset;
L
Linus Torvalds 已提交
521 522 523 524
		if (mtu < IPV6_MIN_MTU)
			mtu = IPV6_MIN_MTU;
		t->dev->mtu = mtu;

A
Al Viro 已提交
525
		if ((len = sizeof (*ipv6h) + ntohs(ipv6h->payload_len)) > mtu) {
L
Linus Torvalds 已提交
526 527 528 529 530 531 532
			rel_type = ICMPV6_PKT_TOOBIG;
			rel_code = 0;
			rel_info = mtu;
			rel_msg = 1;
		}
		break;
	}
533 534 535 536 537 538 539

	*type = rel_type;
	*code = rel_code;
	*info = rel_info;
	*msg = rel_msg;

out:
540
	rcu_read_unlock();
541 542 543
	return err;
}

544 545
static int
ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
546
	   u8 type, u8 code, int offset, __be32 info)
547 548
{
	int rel_msg = 0;
549 550
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
551
	__u32 rel_info = ntohl(info);
552 553
	int err;
	struct sk_buff *skb2;
554
	const struct iphdr *eiph;
555
	struct rtable *rt;
556
	struct flowi4 fl4;
557

558 559
	err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578
	if (err < 0)
		return err;

	if (rel_msg == 0)
		return 0;

	switch (rel_type) {
	case ICMPV6_DEST_UNREACH:
		if (rel_code != ICMPV6_ADDR_UNREACH)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_HOST_UNREACH;
		break;
	case ICMPV6_PKT_TOOBIG:
		if (rel_code != 0)
			return 0;
		rel_type = ICMP_DEST_UNREACH;
		rel_code = ICMP_FRAG_NEEDED;
		break;
579 580 581
	case NDISC_REDIRECT:
		rel_type = ICMP_REDIRECT;
		rel_code = ICMP_REDIR_HOST;
582 583 584 585 586 587 588 589 590 591 592
	default:
		return 0;
	}

	if (!pskb_may_pull(skb, offset + sizeof(struct iphdr)))
		return 0;

	skb2 = skb_clone(skb, GFP_ATOMIC);
	if (!skb2)
		return 0;

E
Eric Dumazet 已提交
593 594
	skb_dst_drop(skb2);

595
	skb_pull(skb2, offset);
596
	skb_reset_network_header(skb2);
597
	eiph = ip_hdr(skb2);
598 599

	/* Try to guess incoming interface */
600
	rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
601 602 603
				   eiph->saddr, 0,
				   0, 0,
				   IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
604
	if (IS_ERR(rt))
605 606
		goto out;

607
	skb2->dev = rt->dst.dev;
608 609 610 611 612

	/* route "incoming" packet */
	if (rt->rt_flags & RTCF_LOCAL) {
		ip_rt_put(rt);
		rt = NULL;
613
		rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
614 615 616 617
					   eiph->daddr, eiph->saddr,
					   0, 0,
					   IPPROTO_IPIP,
					   RT_TOS(eiph->tos), 0);
618
		if (IS_ERR(rt) ||
619
		    rt->dst.dev->type != ARPHRD_TUNNEL) {
620 621
			if (!IS_ERR(rt))
				ip_rt_put(rt);
622 623
			goto out;
		}
624
		skb_dst_set(skb2, &rt->dst);
625 626 627 628
	} else {
		ip_rt_put(rt);
		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
				   skb2->dev) ||
E
Eric Dumazet 已提交
629
		    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
630 631 632 633 634
			goto out;
	}

	/* change mtu on this route */
	if (rel_type == ICMP_DEST_UNREACH && rel_code == ICMP_FRAG_NEEDED) {
E
Eric Dumazet 已提交
635
		if (rel_info > dst_mtu(skb_dst(skb2)))
636 637
			goto out;

638
		skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), NULL, skb2, rel_info);
639
	}
640
	if (rel_type == ICMP_REDIRECT)
641
		skb_dst(skb2)->ops->redirect(skb_dst(skb2), NULL, skb2);
642

A
Al Viro 已提交
643
	icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
644 645 646 647 648 649

out:
	kfree_skb(skb2);
	return 0;
}

650 651
static int
ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
652
	   u8 type, u8 code, int offset, __be32 info)
653 654
{
	int rel_msg = 0;
655 656
	u8 rel_type = type;
	u8 rel_code = code;
A
Al Viro 已提交
657
	__u32 rel_info = ntohl(info);
658 659
	int err;

660 661
	err = ip6_tnl_err(skb, IPPROTO_IPV6, opt, &rel_type, &rel_code,
			  &rel_msg, &rel_info, offset);
662 663 664 665
	if (err < 0)
		return err;

	if (rel_msg && pskb_may_pull(skb, offset + sizeof(struct ipv6hdr))) {
L
Linus Torvalds 已提交
666 667
		struct rt6_info *rt;
		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
668

L
Linus Torvalds 已提交
669
		if (!skb2)
670
			return 0;
L
Linus Torvalds 已提交
671

E
Eric Dumazet 已提交
672
		skb_dst_drop(skb2);
L
Linus Torvalds 已提交
673
		skb_pull(skb2, offset);
674
		skb_reset_network_header(skb2);
L
Linus Torvalds 已提交
675 676

		/* Try to guess incoming interface */
677 678
		rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr,
				NULL, 0, 0);
L
Linus Torvalds 已提交
679

680 681
		if (rt && rt->dst.dev)
			skb2->dev = rt->dst.dev;
L
Linus Torvalds 已提交
682

683
		icmpv6_send(skb2, rel_type, rel_code, rel_info);
L
Linus Torvalds 已提交
684

A
Amerigo Wang 已提交
685
		ip6_rt_put(rt);
L
Linus Torvalds 已提交
686 687 688

		kfree_skb(skb2);
	}
689 690

	return 0;
L
Linus Torvalds 已提交
691 692
}

693 694 695
static int ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
				       const struct ipv6hdr *ipv6h,
				       struct sk_buff *skb)
696 697 698 699
{
	__u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;

	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
700
		ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
701

702
	return IP6_ECN_decapsulate(ipv6h, skb);
703 704
}

705 706 707
static int ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
				       const struct ipv6hdr *ipv6h,
				       struct sk_buff *skb)
L
Linus Torvalds 已提交
708
{
709
	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
710
		ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
L
Linus Torvalds 已提交
711

712
	return IP6_ECN_decapsulate(ipv6h, skb);
L
Linus Torvalds 已提交
713
}
714

X
xeb@mail.ru 已提交
715
__u32 ip6_tnl_get_cap(struct ip6_tnl *t,
716 717 718
			     const struct in6_addr *laddr,
			     const struct in6_addr *raddr)
{
X
xeb@mail.ru 已提交
719
	struct __ip6_tnl_parm *p = &t->parms;
720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736
	int ltype = ipv6_addr_type(laddr);
	int rtype = ipv6_addr_type(raddr);
	__u32 flags = 0;

	if (ltype == IPV6_ADDR_ANY || rtype == IPV6_ADDR_ANY) {
		flags = IP6_TNL_F_CAP_PER_PACKET;
	} else if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
		   rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
		   !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
		   (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
		if (ltype&IPV6_ADDR_UNICAST)
			flags |= IP6_TNL_F_CAP_XMIT;
		if (rtype&IPV6_ADDR_UNICAST)
			flags |= IP6_TNL_F_CAP_RCV;
	}
	return flags;
}
X
xeb@mail.ru 已提交
737
EXPORT_SYMBOL(ip6_tnl_get_cap);
738

E
Eric Dumazet 已提交
739
/* called with rcu_read_lock() */
X
xeb@mail.ru 已提交
740
int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
741 742
				  const struct in6_addr *laddr,
				  const struct in6_addr *raddr)
743
{
X
xeb@mail.ru 已提交
744
	struct __ip6_tnl_parm *p = &t->parms;
745
	int ret = 0;
N
Nicolas Dichtel 已提交
746
	struct net *net = t->net;
747

748 749 750
	if ((p->flags & IP6_TNL_F_CAP_RCV) ||
	    ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
	     (ip6_tnl_get_cap(t, laddr, raddr) & IP6_TNL_F_CAP_RCV))) {
751
		struct net_device *ldev = NULL;
752 753

		if (p->link)
E
Eric Dumazet 已提交
754
			ldev = dev_get_by_index_rcu(net, p->link);
755

756 757 758
		if ((ipv6_addr_is_multicast(laddr) ||
		     likely(ipv6_chk_addr(net, laddr, ldev, 0))) &&
		    likely(!ipv6_chk_addr(net, raddr, NULL, 0)))
759 760 761 762
			ret = 1;
	}
	return ret;
}
X
xeb@mail.ru 已提交
763
EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
L
Linus Torvalds 已提交
764 765

/**
766
 * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
L
Linus Torvalds 已提交
767
 *   @skb: received socket buffer
768 769
 *   @protocol: ethernet protocol ID
 *   @dscp_ecn_decapsulate: the function to decapsulate DSCP code and ECN
L
Linus Torvalds 已提交
770 771 772 773
 *
 * Return: 0
 **/

774
static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
775
		       __u8 ipproto,
776 777 778
		       int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
						   const struct ipv6hdr *ipv6h,
						   struct sk_buff *skb))
L
Linus Torvalds 已提交
779 780
{
	struct ip6_tnl *t;
781
	const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
782
	int err;
L
Linus Torvalds 已提交
783

784
	rcu_read_lock();
L
Linus Torvalds 已提交
785

786
	if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
787
					&ipv6h->daddr)) != NULL) {
E
Eric Dumazet 已提交
788 789
		struct pcpu_tstats *tstats;

790
		if (t->parms.proto != ipproto && t->parms.proto != 0) {
791
			rcu_read_unlock();
792 793 794
			goto discard;
		}

L
Linus Torvalds 已提交
795
		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
796
			rcu_read_unlock();
797
			goto discard;
L
Linus Torvalds 已提交
798 799
		}

800
		if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr)) {
801
			t->dev->stats.rx_dropped++;
802
			rcu_read_unlock();
L
Linus Torvalds 已提交
803 804
			goto discard;
		}
805
		skb->mac_header = skb->network_header;
806
		skb_reset_network_header(skb);
807
		skb->protocol = htons(protocol);
L
Linus Torvalds 已提交
808
		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
809

810
		__skb_tunnel_rx(skb, t->dev, t->net);
811 812 813 814 815 816 817 818 819 820 821 822 823 824 825

		err = dscp_ecn_decapsulate(t, ipv6h, skb);
		if (unlikely(err)) {
			if (log_ecn_error)
				net_info_ratelimited("non-ECT from %pI6 with dsfield=%#x\n",
						     &ipv6h->saddr,
						     ipv6_get_dsfield(ipv6h));
			if (err > 1) {
				++t->dev->stats.rx_frame_errors;
				++t->dev->stats.rx_errors;
				rcu_read_unlock();
				goto discard;
			}
		}

E
Eric Dumazet 已提交
826 827 828 829
		tstats = this_cpu_ptr(t->dev->tstats);
		tstats->rx_packets++;
		tstats->rx_bytes += skb->len;

830
		netif_rx(skb);
E
Eric Dumazet 已提交
831

832
		rcu_read_unlock();
L
Linus Torvalds 已提交
833 834
		return 0;
	}
835
	rcu_read_unlock();
L
Linus Torvalds 已提交
836
	return 1;
837 838 839 840

discard:
	kfree_skb(skb);
	return 0;
L
Linus Torvalds 已提交
841 842
}

843 844
static int ip4ip6_rcv(struct sk_buff *skb)
{
845 846
	return ip6_tnl_rcv(skb, ETH_P_IP, IPPROTO_IPIP,
			   ip4ip6_dscp_ecn_decapsulate);
847 848
}

849 850
static int ip6ip6_rcv(struct sk_buff *skb)
{
851 852
	return ip6_tnl_rcv(skb, ETH_P_IPV6, IPPROTO_IPV6,
			   ip6ip6_dscp_ecn_decapsulate);
853 854
}

855 856 857 858
struct ipv6_tel_txoption {
	struct ipv6_txoptions ops;
	__u8 dst_opt[8];
};
L
Linus Torvalds 已提交
859

860 861 862
static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
{
	memset(opt, 0, sizeof(struct ipv6_tel_txoption));
L
Linus Torvalds 已提交
863

864 865 866 867 868
	opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
	opt->dst_opt[3] = 1;
	opt->dst_opt[4] = encap_limit;
	opt->dst_opt[5] = IPV6_TLV_PADN;
	opt->dst_opt[6] = 1;
L
Linus Torvalds 已提交
869

870 871
	opt->ops.dst0opt = (struct ipv6_opt_hdr *) opt->dst_opt;
	opt->ops.opt_nflen = 8;
L
Linus Torvalds 已提交
872 873 874
}

/**
875
 * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
L
Linus Torvalds 已提交
876
 *   @t: the outgoing tunnel device
877
 *   @hdr: IPv6 header from the incoming packet
L
Linus Torvalds 已提交
878 879
 *
 * Description:
880
 *   Avoid trivial tunneling loop by checking that tunnel exit-point
L
Linus Torvalds 已提交
881 882
 *   doesn't match source of incoming packet.
 *
883
 * Return:
L
Linus Torvalds 已提交
884 885 886 887
 *   1 if conflict,
 *   0 else
 **/

E
Eric Dumazet 已提交
888
static inline bool
889
ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
L
Linus Torvalds 已提交
890 891 892 893
{
	return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
}

X
xeb@mail.ru 已提交
894
int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
895
{
X
xeb@mail.ru 已提交
896
	struct __ip6_tnl_parm *p = &t->parms;
897
	int ret = 0;
N
Nicolas Dichtel 已提交
898
	struct net *net = t->net;
899

900
	if (p->flags & IP6_TNL_F_CAP_XMIT) {
901 902
		struct net_device *ldev = NULL;

E
Eric Dumazet 已提交
903
		rcu_read_lock();
904
		if (p->link)
E
Eric Dumazet 已提交
905
			ldev = dev_get_by_index_rcu(net, p->link);
906

907
		if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
908 909
			pr_warn("%s xmit: Local address not yet configured!\n",
				p->name);
910
		else if (!ipv6_addr_is_multicast(&p->raddr) &&
911
			 unlikely(ipv6_chk_addr(net, &p->raddr, NULL, 0)))
912 913
			pr_warn("%s xmit: Routing loop! Remote address found on this node!\n",
				p->name);
914 915
		else
			ret = 1;
E
Eric Dumazet 已提交
916
		rcu_read_unlock();
917 918 919
	}
	return ret;
}
X
xeb@mail.ru 已提交
920 921
EXPORT_SYMBOL_GPL(ip6_tnl_xmit_ctl);

L
Linus Torvalds 已提交
922
/**
923
 * ip6_tnl_xmit2 - encapsulate packet and send
L
Linus Torvalds 已提交
924
 *   @skb: the outgoing socket buffer
925
 *   @dev: the outgoing tunnel device
926 927 928 929
 *   @dsfield: dscp code for outer header
 *   @fl: flow of tunneled packet
 *   @encap_limit: encapsulation limit
 *   @pmtu: Path MTU is stored if packet is too big
L
Linus Torvalds 已提交
930 931 932 933 934
 *
 * Description:
 *   Build new header and do some sanity checks on the packet before sending
 *   it.
 *
935
 * Return:
936
 *   0 on success
937 938
 *   -1 fail
 *   %-EMSGSIZE message too big. return mtu in this case.
L
Linus Torvalds 已提交
939 940
 **/

941 942 943
static int ip6_tnl_xmit2(struct sk_buff *skb,
			 struct net_device *dev,
			 __u8 dsfield,
944
			 struct flowi6 *fl6,
945 946
			 int encap_limit,
			 __u32 *pmtu)
L
Linus Torvalds 已提交
947
{
948
	struct ip6_tnl *t = netdev_priv(dev);
N
Nicolas Dichtel 已提交
949
	struct net *net = t->net;
950
	struct net_device_stats *stats = &t->dev->stats;
951
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
952
	struct ipv6_tel_txoption opt;
953
	struct dst_entry *dst = NULL, *ndst = NULL;
L
Linus Torvalds 已提交
954 955
	struct net_device *tdev;
	int mtu;
956
	unsigned int max_headroom = sizeof(struct ipv6hdr);
L
Linus Torvalds 已提交
957
	u8 proto;
958
	int err = -1;
L
Linus Torvalds 已提交
959

960 961
	if (!fl6->flowi6_mark)
		dst = ip6_tnl_dst_check(t);
962 963
	if (!dst) {
		ndst = ip6_route_output(net, NULL, fl6);
L
Linus Torvalds 已提交
964

965
		if (ndst->error)
966
			goto tx_err_link_failure;
967 968 969 970
		ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
		if (IS_ERR(ndst)) {
			err = PTR_ERR(ndst);
			ndst = NULL;
971 972
			goto tx_err_link_failure;
		}
973
		dst = ndst;
974
	}
L
Linus Torvalds 已提交
975 976 977 978 979

	tdev = dst->dev;

	if (tdev == dev) {
		stats->collisions++;
980 981
		net_warn_ratelimited("%s: Local routing loop detected!\n",
				     t->parms.name);
L
Linus Torvalds 已提交
982 983 984
		goto tx_err_dst_release;
	}
	mtu = dst_mtu(dst) - sizeof (*ipv6h);
985
	if (encap_limit >= 0) {
L
Linus Torvalds 已提交
986 987 988 989 990
		max_headroom += 8;
		mtu -= 8;
	}
	if (mtu < IPV6_MIN_MTU)
		mtu = IPV6_MIN_MTU;
E
Eric Dumazet 已提交
991
	if (skb_dst(skb))
992
		skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
L
Linus Torvalds 已提交
993
	if (skb->len > mtu) {
994 995
		*pmtu = mtu;
		err = -EMSGSIZE;
L
Linus Torvalds 已提交
996 997 998
		goto tx_err_dst_release;
	}

999
	skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
N
Nicolas Dichtel 已提交
1000

L
Linus Torvalds 已提交
1001 1002 1003 1004
	/*
	 * Okay, now see if we can stuff it in the buffer as-is.
	 */
	max_headroom += LL_RESERVED_SPACE(tdev);
1005

1006 1007
	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
L
Linus Torvalds 已提交
1008
		struct sk_buff *new_skb;
1009

L
Linus Torvalds 已提交
1010 1011 1012 1013 1014
		if (!(new_skb = skb_realloc_headroom(skb, max_headroom)))
			goto tx_err_dst_release;

		if (skb->sk)
			skb_set_owner_w(new_skb, skb->sk);
1015
		consume_skb(skb);
L
Linus Torvalds 已提交
1016 1017
		skb = new_skb;
	}
1018 1019 1020 1021 1022 1023
	if (fl6->flowi6_mark) {
		skb_dst_set(skb, dst);
		ndst = NULL;
	} else {
		skb_dst_set_noref(skb, dst);
	}
1024
	skb->transport_header = skb->network_header;
L
Linus Torvalds 已提交
1025

1026
	proto = fl6->flowi6_proto;
1027 1028 1029 1030
	if (encap_limit >= 0) {
		init_tel_txopt(&opt, encap_limit);
		ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
	}
1031 1032 1033 1034 1035 1036

	if (likely(!skb->encapsulation)) {
		skb_reset_inner_headers(skb);
		skb->encapsulation = 1;
	}

1037 1038
	skb_push(skb, sizeof(struct ipv6hdr));
	skb_reset_network_header(skb);
1039
	ipv6h = ipv6_hdr(skb);
1040
	ip6_flow_hdr(ipv6h, INET_ECN_encapsulate(0, dsfield), fl6->flowlabel);
L
Linus Torvalds 已提交
1041 1042
	ipv6h->hop_limit = t->parms.hop_limit;
	ipv6h->nexthdr = proto;
A
Alexey Dobriyan 已提交
1043 1044
	ipv6h->saddr = fl6->saddr;
	ipv6h->daddr = fl6->daddr;
1045
	ip6tunnel_xmit(skb, dev);
1046 1047
	if (ndst)
		ip6_tnl_dst_store(t, ndst);
L
Linus Torvalds 已提交
1048 1049 1050 1051 1052
	return 0;
tx_err_link_failure:
	stats->tx_carrier_errors++;
	dst_link_failure(skb);
tx_err_dst_release:
1053
	dst_release(ndst);
1054 1055 1056
	return err;
}

1057 1058 1059 1060
static inline int
ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1061
	const struct iphdr  *iph = ip_hdr(skb);
1062
	int encap_limit = -1;
1063
	struct flowi6 fl6;
1064 1065 1066 1067
	__u8 dsfield;
	__u32 mtu;
	int err;

1068 1069
	if ((t->parms.proto != IPPROTO_IPIP && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t))
1070 1071 1072 1073 1074
		return -1;

	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

1075 1076
	memcpy(&fl6, &t->fl.u.ip6, sizeof (fl6));
	fl6.flowi6_proto = IPPROTO_IPIP;
1077 1078 1079

	dsfield = ipv4_get_dsfield(iph);

1080
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1081
		fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
A
Al Viro 已提交
1082
					  & IPV6_TCLASS_MASK;
1083 1084
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
		fl6.flowi6_mark = skb->mark;
1085

1086
	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097
	if (err != 0) {
		/* XXX: send ICMP error even if DF is not set. */
		if (err == -EMSGSIZE)
			icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
				  htonl(mtu));
		return -1;
	}

	return 0;
}

1098 1099 1100 1101
static inline int
ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1102
	struct ipv6hdr *ipv6h = ipv6_hdr(skb);
1103 1104
	int encap_limit = -1;
	__u16 offset;
1105
	struct flowi6 fl6;
1106 1107 1108 1109
	__u8 dsfield;
	__u32 mtu;
	int err;

1110 1111
	if ((t->parms.proto != IPPROTO_IPV6 && t->parms.proto != 0) ||
	    !ip6_tnl_xmit_ctl(t) || ip6_tnl_addr_conflict(t, ipv6h))
1112 1113
		return -1;

X
xeb@mail.ru 已提交
1114
	offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb));
1115
	if (offset > 0) {
1116
		struct ipv6_tlv_tnl_enc_lim *tel;
1117
		tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
1118 1119
		if (tel->encap_limit == 0) {
			icmpv6_send(skb, ICMPV6_PARAMPROB,
1120
				    ICMPV6_HDR_FIELD, offset + 2);
1121 1122 1123 1124 1125 1126
			return -1;
		}
		encap_limit = tel->encap_limit - 1;
	} else if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		encap_limit = t->parms.encap_limit;

1127 1128
	memcpy(&fl6, &t->fl.u.ip6, sizeof (fl6));
	fl6.flowi6_proto = IPPROTO_IPV6;
1129 1130

	dsfield = ipv6_get_dsfield(ipv6h);
1131
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1132
		fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
1133
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
1134
		fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
1135 1136
	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
		fl6.flowi6_mark = skb->mark;
1137

1138
	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
1139 1140
	if (err != 0) {
		if (err == -EMSGSIZE)
1141
			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1142 1143 1144 1145 1146 1147
		return -1;
	}

	return 0;
}

1148
static netdev_tx_t
1149 1150 1151
ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip6_tnl *t = netdev_priv(dev);
1152
	struct net_device_stats *stats = &t->dev->stats;
1153 1154 1155
	int ret;

	switch (skb->protocol) {
1156
	case htons(ETH_P_IP):
1157 1158
		ret = ip4ip6_tnl_xmit(skb, dev);
		break;
1159
	case htons(ETH_P_IPV6):
1160 1161 1162 1163 1164 1165 1166 1167 1168
		ret = ip6ip6_tnl_xmit(skb, dev);
		break;
	default:
		goto tx_err;
	}

	if (ret < 0)
		goto tx_err;

1169
	return NETDEV_TX_OK;
1170

L
Linus Torvalds 已提交
1171 1172 1173 1174
tx_err:
	stats->tx_errors++;
	stats->tx_dropped++;
	kfree_skb(skb);
1175
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
1176 1177
}

1178
static void ip6_tnl_link_config(struct ip6_tnl *t)
L
Linus Torvalds 已提交
1179 1180
{
	struct net_device *dev = t->dev;
X
xeb@mail.ru 已提交
1181
	struct __ip6_tnl_parm *p = &t->parms;
1182
	struct flowi6 *fl6 = &t->fl.u.ip6;
L
Linus Torvalds 已提交
1183

1184 1185
	memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr));
	memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
L
Linus Torvalds 已提交
1186 1187

	/* Set up flowi template */
A
Alexey Dobriyan 已提交
1188 1189
	fl6->saddr = p->laddr;
	fl6->daddr = p->raddr;
1190 1191
	fl6->flowi6_oif = p->link;
	fl6->flowlabel = 0;
L
Linus Torvalds 已提交
1192 1193

	if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
1194
		fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
L
Linus Torvalds 已提交
1195
	if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
1196
		fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
L
Linus Torvalds 已提交
1197

1198 1199
	p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV|IP6_TNL_F_CAP_PER_PACKET);
	p->flags |= ip6_tnl_get_cap(t, &p->laddr, &p->raddr);
L
Linus Torvalds 已提交
1200 1201 1202 1203 1204 1205 1206 1207 1208

	if (p->flags&IP6_TNL_F_CAP_XMIT && p->flags&IP6_TNL_F_CAP_RCV)
		dev->flags |= IFF_POINTOPOINT;
	else
		dev->flags &= ~IFF_POINTOPOINT;

	dev->iflink = p->link;

	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1209 1210 1211
		int strict = (ipv6_addr_type(&p->raddr) &
			      (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));

N
Nicolas Dichtel 已提交
1212
		struct rt6_info *rt = rt6_lookup(t->net,
1213
						 &p->raddr, &p->laddr,
1214
						 p->link, strict);
L
Linus Torvalds 已提交
1215 1216 1217 1218

		if (rt == NULL)
			return;

1219 1220
		if (rt->dst.dev) {
			dev->hard_header_len = rt->dst.dev->hard_header_len +
L
Linus Torvalds 已提交
1221 1222
				sizeof (struct ipv6hdr);

1223
			dev->mtu = rt->dst.dev->mtu - sizeof (struct ipv6hdr);
1224 1225
			if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
				dev->mtu-=8;
L
Linus Torvalds 已提交
1226 1227 1228 1229

			if (dev->mtu < IPV6_MIN_MTU)
				dev->mtu = IPV6_MIN_MTU;
		}
A
Amerigo Wang 已提交
1230
		ip6_rt_put(rt);
L
Linus Torvalds 已提交
1231 1232 1233 1234
	}
}

/**
1235
 * ip6_tnl_change - update the tunnel parameters
L
Linus Torvalds 已提交
1236 1237 1238 1239
 *   @t: tunnel to be changed
 *   @p: tunnel configuration parameters
 *
 * Description:
1240
 *   ip6_tnl_change() updates the tunnel parameters
L
Linus Torvalds 已提交
1241 1242 1243
 **/

static int
X
xeb@mail.ru 已提交
1244
ip6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
L
Linus Torvalds 已提交
1245
{
A
Alexey Dobriyan 已提交
1246 1247
	t->parms.laddr = p->laddr;
	t->parms.raddr = p->raddr;
L
Linus Torvalds 已提交
1248 1249 1250 1251
	t->parms.flags = p->flags;
	t->parms.hop_limit = p->hop_limit;
	t->parms.encap_limit = p->encap_limit;
	t->parms.flowinfo = p->flowinfo;
1252
	t->parms.link = p->link;
1253
	t->parms.proto = p->proto;
1254
	ip6_tnl_dst_reset(t);
1255
	ip6_tnl_link_config(t);
L
Linus Torvalds 已提交
1256 1257 1258
	return 0;
}

1259 1260
static int ip6_tnl_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
{
N
Nicolas Dichtel 已提交
1261
	struct net *net = t->net;
1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
	int err;

	ip6_tnl_unlink(ip6n, t);
	synchronize_net();
	err = ip6_tnl_change(t, p);
	ip6_tnl_link(ip6n, t);
	netdev_state_change(t->dev);
	return err;
}

X
xeb@mail.ru 已提交
1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300
static void
ip6_tnl_parm_from_user(struct __ip6_tnl_parm *p, const struct ip6_tnl_parm *u)
{
	p->laddr = u->laddr;
	p->raddr = u->raddr;
	p->flags = u->flags;
	p->hop_limit = u->hop_limit;
	p->encap_limit = u->encap_limit;
	p->flowinfo = u->flowinfo;
	p->link = u->link;
	p->proto = u->proto;
	memcpy(p->name, u->name, sizeof(u->name));
}

static void
ip6_tnl_parm_to_user(struct ip6_tnl_parm *u, const struct __ip6_tnl_parm *p)
{
	u->laddr = p->laddr;
	u->raddr = p->raddr;
	u->flags = p->flags;
	u->hop_limit = p->hop_limit;
	u->encap_limit = p->encap_limit;
	u->flowinfo = p->flowinfo;
	u->link = p->link;
	u->proto = p->proto;
	memcpy(u->name, p->name, sizeof(u->name));
}

L
Linus Torvalds 已提交
1301
/**
1302
 * ip6_tnl_ioctl - configure ipv6 tunnels from userspace
L
Linus Torvalds 已提交
1303 1304 1305 1306 1307
 *   @dev: virtual device associated with tunnel
 *   @ifr: parameters passed from userspace
 *   @cmd: command to be performed
 *
 * Description:
1308
 *   ip6_tnl_ioctl() is used for managing IPv6 tunnels
1309
 *   from userspace.
L
Linus Torvalds 已提交
1310 1311 1312 1313 1314 1315 1316
 *
 *   The possible commands are the following:
 *     %SIOCGETTUNNEL: get tunnel parameters for device
 *     %SIOCADDTUNNEL: add tunnel matching given tunnel parameters
 *     %SIOCCHGTUNNEL: change tunnel parameters to those given
 *     %SIOCDELTUNNEL: delete tunnel
 *
1317
 *   The fallback device "ip6tnl0", created during module
L
Linus Torvalds 已提交
1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329
 *   initialization, can be used for creating other tunnel devices.
 *
 * Return:
 *   0 on success,
 *   %-EFAULT if unable to copy data to or from userspace,
 *   %-EPERM if current process hasn't %CAP_NET_ADMIN set
 *   %-EINVAL if passed tunnel parameters are invalid,
 *   %-EEXIST if changing a tunnel's parameters would cause a conflict
 *   %-ENODEV if attempting to change or delete a nonexisting device
 **/

static int
1330
ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
L
Linus Torvalds 已提交
1331 1332 1333
{
	int err = 0;
	struct ip6_tnl_parm p;
X
xeb@mail.ru 已提交
1334
	struct __ip6_tnl_parm p1;
L
Linus Torvalds 已提交
1335
	struct ip6_tnl *t = NULL;
1336 1337
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
L
Linus Torvalds 已提交
1338 1339 1340

	switch (cmd) {
	case SIOCGETTUNNEL:
1341
		if (dev == ip6n->fb_tnl_dev) {
1342
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p))) {
L
Linus Torvalds 已提交
1343 1344 1345
				err = -EFAULT;
				break;
			}
X
xeb@mail.ru 已提交
1346 1347
			ip6_tnl_parm_from_user(&p1, &p);
			t = ip6_tnl_locate(net, &p1, 0);
1348 1349
		} else {
			memset(&p, 0, sizeof(p));
1350 1351
		}
		if (t == NULL)
1352
			t = netdev_priv(dev);
X
xeb@mail.ru 已提交
1353
		ip6_tnl_parm_to_user(&p, &t->parms);
L
Linus Torvalds 已提交
1354 1355 1356 1357 1358 1359 1360
		if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
			err = -EFAULT;
		}
		break;
	case SIOCADDTUNNEL:
	case SIOCCHGTUNNEL:
		err = -EPERM;
1361
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
L
Linus Torvalds 已提交
1362
			break;
1363 1364
		err = -EFAULT;
		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1365
			break;
1366
		err = -EINVAL;
1367 1368
		if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
		    p.proto != 0)
L
Linus Torvalds 已提交
1369
			break;
X
xeb@mail.ru 已提交
1370 1371
		ip6_tnl_parm_from_user(&p1, &p);
		t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
1372
		if (dev != ip6n->fb_tnl_dev && cmd == SIOCCHGTUNNEL) {
1373 1374 1375 1376 1377 1378 1379 1380
			if (t != NULL) {
				if (t->dev != dev) {
					err = -EEXIST;
					break;
				}
			} else
				t = netdev_priv(dev);

1381
			err = ip6_tnl_update(t, &p1);
L
Linus Torvalds 已提交
1382
		}
1383
		if (t) {
L
Linus Torvalds 已提交
1384
			err = 0;
X
xeb@mail.ru 已提交
1385 1386
			ip6_tnl_parm_to_user(&p, &t->parms);
			if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
1387 1388 1389 1390
				err = -EFAULT;

		} else
			err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
L
Linus Torvalds 已提交
1391 1392 1393
		break;
	case SIOCDELTUNNEL:
		err = -EPERM;
1394
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
L
Linus Torvalds 已提交
1395 1396
			break;

1397
		if (dev == ip6n->fb_tnl_dev) {
1398 1399
			err = -EFAULT;
			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof (p)))
L
Linus Torvalds 已提交
1400
				break;
1401
			err = -ENOENT;
X
xeb@mail.ru 已提交
1402 1403 1404
			ip6_tnl_parm_from_user(&p1, &p);
			t = ip6_tnl_locate(net, &p1, 0);
			if (t == NULL)
L
Linus Torvalds 已提交
1405
				break;
1406
			err = -EPERM;
1407
			if (t->dev == ip6n->fb_tnl_dev)
L
Linus Torvalds 已提交
1408
				break;
1409
			dev = t->dev;
L
Linus Torvalds 已提交
1410
		}
1411 1412
		err = 0;
		unregister_netdevice(dev);
L
Linus Torvalds 已提交
1413 1414 1415 1416 1417 1418 1419 1420
		break;
	default:
		err = -EINVAL;
	}
	return err;
}

/**
1421
 * ip6_tnl_change_mtu - change mtu manually for tunnel device
L
Linus Torvalds 已提交
1422 1423 1424 1425 1426 1427 1428 1429 1430
 *   @dev: virtual device associated with tunnel
 *   @new_mtu: the new mtu
 *
 * Return:
 *   0 on success,
 *   %-EINVAL if mtu too small
 **/

static int
1431
ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
L
Linus Torvalds 已提交
1432
{
1433 1434 1435 1436 1437 1438 1439 1440
	struct ip6_tnl *tnl = netdev_priv(dev);

	if (tnl->parms.proto == IPPROTO_IPIP) {
		if (new_mtu < 68)
			return -EINVAL;
	} else {
		if (new_mtu < IPV6_MIN_MTU)
			return -EINVAL;
L
Linus Torvalds 已提交
1441
	}
1442 1443
	if (new_mtu > 0xFFF8 - dev->hard_header_len)
		return -EINVAL;
L
Linus Torvalds 已提交
1444 1445 1446 1447
	dev->mtu = new_mtu;
	return 0;
}

1448 1449

static const struct net_device_ops ip6_tnl_netdev_ops = {
E
Eric Dumazet 已提交
1450
	.ndo_uninit	= ip6_tnl_dev_uninit,
1451
	.ndo_start_xmit = ip6_tnl_xmit,
E
Eric Dumazet 已提交
1452
	.ndo_do_ioctl	= ip6_tnl_ioctl,
1453
	.ndo_change_mtu = ip6_tnl_change_mtu,
E
Eric Dumazet 已提交
1454
	.ndo_get_stats	= ip6_get_stats,
1455 1456
};

E
Eric Dumazet 已提交
1457

L
Linus Torvalds 已提交
1458
/**
1459
 * ip6_tnl_dev_setup - setup virtual tunnel device
L
Linus Torvalds 已提交
1460 1461 1462 1463 1464 1465
 *   @dev: virtual device associated with tunnel
 *
 * Description:
 *   Initialize function pointers and device parameters
 **/

1466
static void ip6_tnl_dev_setup(struct net_device *dev)
L
Linus Torvalds 已提交
1467
{
1468 1469
	struct ip6_tnl *t;

1470
	dev->netdev_ops = &ip6_tnl_netdev_ops;
E
Eric Dumazet 已提交
1471
	dev->destructor = ip6_dev_free;
L
Linus Torvalds 已提交
1472 1473 1474 1475

	dev->type = ARPHRD_TUNNEL6;
	dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
	dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
1476 1477 1478
	t = netdev_priv(dev);
	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
		dev->mtu-=8;
L
Linus Torvalds 已提交
1479 1480
	dev->flags |= IFF_NOARP;
	dev->addr_len = sizeof(struct in6_addr);
1481
	dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
1482 1483 1484
	/* This perm addr will be used as interface identifier by IPv6 */
	dev->addr_assign_type = NET_ADDR_RANDOM;
	eth_random_addr(dev->perm_addr);
L
Linus Torvalds 已提交
1485 1486 1487 1488
}


/**
1489
 * ip6_tnl_dev_init_gen - general initializer for all tunnel devices
L
Linus Torvalds 已提交
1490 1491 1492
 *   @dev: virtual device associated with tunnel
 **/

E
Eric Dumazet 已提交
1493
static inline int
1494
ip6_tnl_dev_init_gen(struct net_device *dev)
L
Linus Torvalds 已提交
1495
{
1496
	struct ip6_tnl *t = netdev_priv(dev);
E
Eric Dumazet 已提交
1497

L
Linus Torvalds 已提交
1498
	t->dev = dev;
N
Nicolas Dichtel 已提交
1499
	t->net = dev_net(dev);
E
Eric Dumazet 已提交
1500 1501 1502 1503
	dev->tstats = alloc_percpu(struct pcpu_tstats);
	if (!dev->tstats)
		return -ENOMEM;
	return 0;
L
Linus Torvalds 已提交
1504 1505 1506
}

/**
1507
 * ip6_tnl_dev_init - initializer for all non fallback tunnel devices
L
Linus Torvalds 已提交
1508 1509 1510
 *   @dev: virtual device associated with tunnel
 **/

E
Eric Dumazet 已提交
1511
static int ip6_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1512
{
1513
	struct ip6_tnl *t = netdev_priv(dev);
E
Eric Dumazet 已提交
1514 1515 1516 1517
	int err = ip6_tnl_dev_init_gen(dev);

	if (err)
		return err;
1518
	ip6_tnl_link_config(t);
E
Eric Dumazet 已提交
1519
	return 0;
L
Linus Torvalds 已提交
1520 1521 1522
}

/**
1523
 * ip6_fb_tnl_dev_init - initializer for fallback tunnel device
L
Linus Torvalds 已提交
1524 1525 1526 1527 1528
 *   @dev: fallback device
 *
 * Return: 0
 **/

E
Eric Dumazet 已提交
1529
static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
L
Linus Torvalds 已提交
1530
{
1531
	struct ip6_tnl *t = netdev_priv(dev);
1532 1533
	struct net *net = dev_net(dev);
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
E
Eric Dumazet 已提交
1534 1535 1536 1537
	int err = ip6_tnl_dev_init_gen(dev);

	if (err)
		return err;
1538

1539
	t->parms.proto = IPPROTO_IPV6;
L
Linus Torvalds 已提交
1540
	dev_hold(dev);
1541 1542 1543

	ip6_tnl_link_config(t);

1544
	rcu_assign_pointer(ip6n->tnls_wc[0], t);
E
Eric Dumazet 已提交
1545
	return 0;
L
Linus Torvalds 已提交
1546 1547
}

1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589
static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[])
{
	u8 proto;

	if (!data)
		return 0;

	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
	if (proto != IPPROTO_IPV6 &&
	    proto != IPPROTO_IPIP &&
	    proto != 0)
		return -EINVAL;

	return 0;
}

static void ip6_tnl_netlink_parms(struct nlattr *data[],
				  struct __ip6_tnl_parm *parms)
{
	memset(parms, 0, sizeof(*parms));

	if (!data)
		return;

	if (data[IFLA_IPTUN_LINK])
		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);

	if (data[IFLA_IPTUN_LOCAL])
		nla_memcpy(&parms->laddr, data[IFLA_IPTUN_LOCAL],
			   sizeof(struct in6_addr));

	if (data[IFLA_IPTUN_REMOTE])
		nla_memcpy(&parms->raddr, data[IFLA_IPTUN_REMOTE],
			   sizeof(struct in6_addr));

	if (data[IFLA_IPTUN_TTL])
		parms->hop_limit = nla_get_u8(data[IFLA_IPTUN_TTL]);

	if (data[IFLA_IPTUN_ENCAP_LIMIT])
		parms->encap_limit = nla_get_u8(data[IFLA_IPTUN_ENCAP_LIMIT]);

	if (data[IFLA_IPTUN_FLOWINFO])
1590
		parms->flowinfo = nla_get_be32(data[IFLA_IPTUN_FLOWINFO]);
1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616

	if (data[IFLA_IPTUN_FLAGS])
		parms->flags = nla_get_u32(data[IFLA_IPTUN_FLAGS]);

	if (data[IFLA_IPTUN_PROTO])
		parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
}

static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
			   struct nlattr *tb[], struct nlattr *data[])
{
	struct net *net = dev_net(dev);
	struct ip6_tnl *nt;

	nt = netdev_priv(dev);
	ip6_tnl_netlink_parms(data, &nt->parms);

	if (ip6_tnl_locate(net, &nt->parms, 0))
		return -EEXIST;

	return ip6_tnl_create2(dev);
}

static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
			      struct nlattr *data[])
{
N
Nicolas Dichtel 已提交
1617
	struct ip6_tnl *t = netdev_priv(dev);
1618
	struct __ip6_tnl_parm p;
N
Nicolas Dichtel 已提交
1619
	struct net *net = t->net;
1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);

	if (dev == ip6n->fb_tnl_dev)
		return -EINVAL;

	ip6_tnl_netlink_parms(data, &p);

	t = ip6_tnl_locate(net, &p, 0);

	if (t) {
		if (t->dev != dev)
			return -EEXIST;
	} else
		t = netdev_priv(dev);

	return ip6_tnl_update(t, &p);
}

1638
static size_t ip6_tnl_get_size(const struct net_device *dev)
1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654
{
	return
		/* IFLA_IPTUN_LINK */
		nla_total_size(4) +
		/* IFLA_IPTUN_LOCAL */
		nla_total_size(sizeof(struct in6_addr)) +
		/* IFLA_IPTUN_REMOTE */
		nla_total_size(sizeof(struct in6_addr)) +
		/* IFLA_IPTUN_TTL */
		nla_total_size(1) +
		/* IFLA_IPTUN_ENCAP_LIMIT */
		nla_total_size(1) +
		/* IFLA_IPTUN_FLOWINFO */
		nla_total_size(4) +
		/* IFLA_IPTUN_FLAGS */
		nla_total_size(4) +
1655 1656
		/* IFLA_IPTUN_PROTO */
		nla_total_size(1) +
1657 1658 1659
		0;
}

1660
static int ip6_tnl_fill_info(struct sk_buff *skb, const struct net_device *dev)
1661 1662 1663 1664 1665 1666 1667
{
	struct ip6_tnl *tunnel = netdev_priv(dev);
	struct __ip6_tnl_parm *parm = &tunnel->parms;

	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
	    nla_put(skb, IFLA_IPTUN_LOCAL, sizeof(struct in6_addr),
		    &parm->laddr) ||
1668 1669
	    nla_put(skb, IFLA_IPTUN_REMOTE, sizeof(struct in6_addr),
		    &parm->raddr) ||
1670 1671 1672
	    nla_put_u8(skb, IFLA_IPTUN_TTL, parm->hop_limit) ||
	    nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
1673 1674
	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto))
1675 1676 1677 1678 1679 1680 1681
		goto nla_put_failure;
	return 0;

nla_put_failure:
	return -EMSGSIZE;
}

1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692
static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
	[IFLA_IPTUN_LOCAL]		= { .len = sizeof(struct in6_addr) },
	[IFLA_IPTUN_REMOTE]		= { .len = sizeof(struct in6_addr) },
	[IFLA_IPTUN_TTL]		= { .type = NLA_U8 },
	[IFLA_IPTUN_ENCAP_LIMIT]	= { .type = NLA_U8 },
	[IFLA_IPTUN_FLOWINFO]		= { .type = NLA_U32 },
	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U32 },
	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
};

1693 1694 1695
static struct rtnl_link_ops ip6_link_ops __read_mostly = {
	.kind		= "ip6tnl",
	.maxtype	= IFLA_IPTUN_MAX,
1696
	.policy		= ip6_tnl_policy,
1697
	.priv_size	= sizeof(struct ip6_tnl),
1698 1699 1700 1701
	.setup		= ip6_tnl_dev_setup,
	.validate	= ip6_tnl_validate,
	.newlink	= ip6_tnl_newlink,
	.changelink	= ip6_tnl_changelink,
1702 1703
	.get_size	= ip6_tnl_get_size,
	.fill_info	= ip6_tnl_fill_info,
1704 1705
};

1706
static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
1707 1708 1709 1710 1711
	.handler	= ip4ip6_rcv,
	.err_handler	= ip4ip6_err,
	.priority	=	1,
};

1712
static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
1713 1714
	.handler	= ip6ip6_rcv,
	.err_handler	= ip6ip6_err,
H
Herbert Xu 已提交
1715
	.priority	=	1,
L
Linus Torvalds 已提交
1716 1717
};

1718
static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
1719
{
N
Nicolas Dichtel 已提交
1720 1721
	struct net *net = dev_net(ip6n->fb_tnl_dev);
	struct net_device *dev, *aux;
1722 1723
	int h;
	struct ip6_tnl *t;
1724
	LIST_HEAD(list);
1725

N
Nicolas Dichtel 已提交
1726 1727 1728 1729
	for_each_netdev_safe(net, dev, aux)
		if (dev->rtnl_link_ops == &ip6_link_ops)
			unregister_netdevice_queue(dev, &list);

1730
	for (h = 0; h < HASH_SIZE; h++) {
E
Eric Dumazet 已提交
1731
		t = rtnl_dereference(ip6n->tnls_r_l[h]);
1732
		while (t != NULL) {
N
Nicolas Dichtel 已提交
1733 1734 1735 1736 1737
			/* If dev is in the same netns, it has already
			 * been added to the list by the previous loop.
			 */
			if (!net_eq(dev_net(t->dev), net))
				unregister_netdevice_queue(t->dev, &list);
E
Eric Dumazet 已提交
1738
			t = rtnl_dereference(t->next);
1739
		}
1740 1741
	}

1742
	unregister_netdevice_many(&list);
1743 1744
}

1745
static int __net_init ip6_tnl_init_net(struct net *net)
1746
{
1747
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1748
	struct ip6_tnl *t = NULL;
1749 1750
	int err;

1751 1752 1753
	ip6n->tnls[0] = ip6n->tnls_wc;
	ip6n->tnls[1] = ip6n->tnls_r_l;

1754 1755 1756 1757 1758 1759
	err = -ENOMEM;
	ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0",
				      ip6_tnl_dev_setup);

	if (!ip6n->fb_tnl_dev)
		goto err_alloc_dev;
1760
	dev_net_set(ip6n->fb_tnl_dev, net);
1761
	ip6n->fb_tnl_dev->rtnl_link_ops = &ip6_link_ops;
N
Nicolas Dichtel 已提交
1762 1763 1764 1765
	/* FB netdevice is special: we have one, and only one per netns.
	 * Allowing to move it to another netns is clearly unsafe.
	 */
	ip6n->fb_tnl_dev->features |= NETIF_F_NETNS_LOCAL;
1766

E
Eric Dumazet 已提交
1767 1768 1769
	err = ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
	if (err < 0)
		goto err_register;
1770 1771 1772 1773

	err = register_netdev(ip6n->fb_tnl_dev);
	if (err < 0)
		goto err_register;
1774 1775 1776 1777

	t = netdev_priv(ip6n->fb_tnl_dev);

	strcpy(t->parms.name, ip6n->fb_tnl_dev->name);
1778 1779
	return 0;

1780
err_register:
E
Eric Dumazet 已提交
1781
	ip6_dev_free(ip6n->fb_tnl_dev);
1782
err_alloc_dev:
1783 1784 1785
	return err;
}

1786
static void __net_exit ip6_tnl_exit_net(struct net *net)
1787
{
1788
	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1789

1790 1791 1792
	rtnl_lock();
	ip6_tnl_destroy_tunnels(ip6n);
	rtnl_unlock();
1793 1794 1795 1796 1797
}

static struct pernet_operations ip6_tnl_net_ops = {
	.init = ip6_tnl_init_net,
	.exit = ip6_tnl_exit_net,
1798 1799
	.id   = &ip6_tnl_net_id,
	.size = sizeof(struct ip6_tnl_net),
1800 1801
};

L
Linus Torvalds 已提交
1802 1803 1804 1805 1806 1807 1808 1809 1810 1811
/**
 * ip6_tunnel_init - register protocol and reserve needed resources
 *
 * Return: 0 on success
 **/

static int __init ip6_tunnel_init(void)
{
	int  err;

1812 1813 1814 1815 1816 1817
	err = register_pernet_device(&ip6_tnl_net_ops);
	if (err < 0)
		goto out_pernet;

	err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
	if (err < 0) {
1818
		pr_err("%s: can't register ip4ip6\n", __func__);
1819
		goto out_ip4ip6;
1820 1821
	}

1822 1823
	err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
	if (err < 0) {
1824
		pr_err("%s: can't register ip6ip6\n", __func__);
1825
		goto out_ip6ip6;
L
Linus Torvalds 已提交
1826
	}
1827 1828 1829
	err = rtnl_link_register(&ip6_link_ops);
	if (err < 0)
		goto rtnl_link_failed;
1830

L
Linus Torvalds 已提交
1831
	return 0;
1832

1833 1834
rtnl_link_failed:
	xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
1835
out_ip6ip6:
1836
	xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
1837 1838 1839
out_ip4ip6:
	unregister_pernet_device(&ip6_tnl_net_ops);
out_pernet:
L
Linus Torvalds 已提交
1840 1841 1842 1843 1844 1845 1846 1847 1848
	return err;
}

/**
 * ip6_tunnel_cleanup - free resources and unregister protocol
 **/

static void __exit ip6_tunnel_cleanup(void)
{
1849
	rtnl_link_unregister(&ip6_link_ops);
1850
	if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
1851
		pr_info("%s: can't deregister ip4ip6\n", __func__);
1852

1853
	if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
1854
		pr_info("%s: can't deregister ip6ip6\n", __func__);
L
Linus Torvalds 已提交
1855

1856
	unregister_pernet_device(&ip6_tnl_net_ops);
L
Linus Torvalds 已提交
1857 1858 1859 1860
}

module_init(ip6_tunnel_init);
module_exit(ip6_tunnel_cleanup);