ip_vti.c 9.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407
  1. /*
  2. * Linux NET3: IP/IP protocol decoder modified to support
  3. * virtual tunnel interface
  4. *
  5. * Authors:
  6. * Saurabh Mohan (saurabh.mohan@vyatta.com) 05/07/2012
  7. *
  8. * This program is free software; you can redistribute it and/or
  9. * modify it under the terms of the GNU General Public License
  10. * as published by the Free Software Foundation; either version
  11. * 2 of the License, or (at your option) any later version.
  12. *
  13. */
  14. /*
  15. This version of net/ipv4/ip_vti.c is cloned of net/ipv4/ipip.c
  16. For comments look at net/ipv4/ip_gre.c --ANK
  17. */
  18. #include <linux/capability.h>
  19. #include <linux/module.h>
  20. #include <linux/types.h>
  21. #include <linux/kernel.h>
  22. #include <linux/uaccess.h>
  23. #include <linux/skbuff.h>
  24. #include <linux/netdevice.h>
  25. #include <linux/in.h>
  26. #include <linux/tcp.h>
  27. #include <linux/udp.h>
  28. #include <linux/if_arp.h>
  29. #include <linux/mroute.h>
  30. #include <linux/init.h>
  31. #include <linux/netfilter_ipv4.h>
  32. #include <linux/if_ether.h>
  33. #include <net/sock.h>
  34. #include <net/ip.h>
  35. #include <net/icmp.h>
  36. #include <net/ip_tunnels.h>
  37. #include <net/inet_ecn.h>
  38. #include <net/xfrm.h>
  39. #include <net/net_namespace.h>
  40. #include <net/netns/generic.h>
  41. static struct rtnl_link_ops vti_link_ops __read_mostly;
  42. static int vti_net_id __read_mostly;
  43. static int vti_tunnel_init(struct net_device *dev);
  44. /* We dont digest the packet therefore let the packet pass */
  45. static int vti_rcv(struct sk_buff *skb)
  46. {
  47. struct ip_tunnel *tunnel;
  48. const struct iphdr *iph = ip_hdr(skb);
  49. struct net *net = dev_net(skb->dev);
  50. struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
  51. tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
  52. iph->saddr, iph->daddr, 0);
  53. if (tunnel != NULL) {
  54. struct pcpu_tstats *tstats;
  55. if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
  56. return -1;
  57. tstats = this_cpu_ptr(tunnel->dev->tstats);
  58. u64_stats_update_begin(&tstats->syncp);
  59. tstats->rx_packets++;
  60. tstats->rx_bytes += skb->len;
  61. u64_stats_update_end(&tstats->syncp);
  62. skb->mark = 0;
  63. secpath_reset(skb);
  64. skb->dev = tunnel->dev;
  65. return 1;
  66. }
  67. return -1;
  68. }
  69. /* This function assumes it is being called from dev_queue_xmit()
  70. * and that skb is filled properly by that function.
  71. */
  72. static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
  73. {
  74. struct ip_tunnel *tunnel = netdev_priv(dev);
  75. struct iphdr *tiph = &tunnel->parms.iph;
  76. u8 tos;
  77. struct rtable *rt; /* Route to the other host */
  78. struct net_device *tdev; /* Device to other host */
  79. struct iphdr *old_iph = ip_hdr(skb);
  80. __be32 dst = tiph->daddr;
  81. struct flowi4 fl4;
  82. int err;
  83. if (skb->protocol != htons(ETH_P_IP))
  84. goto tx_error;
  85. tos = old_iph->tos;
  86. memset(&fl4, 0, sizeof(fl4));
  87. flowi4_init_output(&fl4, tunnel->parms.link,
  88. be32_to_cpu(tunnel->parms.i_key), RT_TOS(tos),
  89. RT_SCOPE_UNIVERSE,
  90. IPPROTO_IPIP, 0,
  91. dst, tiph->saddr, 0, 0);
  92. rt = ip_route_output_key(dev_net(dev), &fl4);
  93. if (IS_ERR(rt)) {
  94. dev->stats.tx_carrier_errors++;
  95. goto tx_error_icmp;
  96. }
  97. /* if there is no transform then this tunnel is not functional.
  98. * Or if the xfrm is not mode tunnel.
  99. */
  100. if (!rt->dst.xfrm ||
  101. rt->dst.xfrm->props.mode != XFRM_MODE_TUNNEL) {
  102. dev->stats.tx_carrier_errors++;
  103. goto tx_error_icmp;
  104. }
  105. tdev = rt->dst.dev;
  106. if (tdev == dev) {
  107. ip_rt_put(rt);
  108. dev->stats.collisions++;
  109. goto tx_error;
  110. }
  111. if (tunnel->err_count > 0) {
  112. if (time_before(jiffies,
  113. tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
  114. tunnel->err_count--;
  115. dst_link_failure(skb);
  116. } else
  117. tunnel->err_count = 0;
  118. }
  119. memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
  120. skb_dst_drop(skb);
  121. skb_dst_set(skb, &rt->dst);
  122. nf_reset(skb);
  123. skb->dev = skb_dst(skb)->dev;
  124. err = dst_output(skb);
  125. if (net_xmit_eval(err) == 0)
  126. err = skb->len;
  127. iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
  128. return NETDEV_TX_OK;
  129. tx_error_icmp:
  130. dst_link_failure(skb);
  131. tx_error:
  132. dev->stats.tx_errors++;
  133. dev_kfree_skb(skb);
  134. return NETDEV_TX_OK;
  135. }
  136. static int
  137. vti_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  138. {
  139. int err = 0;
  140. struct ip_tunnel_parm p;
  141. if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
  142. return -EFAULT;
  143. if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
  144. if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
  145. p.iph.ihl != 5)
  146. return -EINVAL;
  147. }
  148. err = ip_tunnel_ioctl(dev, &p, cmd);
  149. if (err)
  150. return err;
  151. if (cmd != SIOCDELTUNNEL) {
  152. p.i_flags |= GRE_KEY | VTI_ISVTI;
  153. p.o_flags |= GRE_KEY;
  154. }
  155. if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
  156. return -EFAULT;
  157. return 0;
  158. }
  159. static const struct net_device_ops vti_netdev_ops = {
  160. .ndo_init = vti_tunnel_init,
  161. .ndo_uninit = ip_tunnel_uninit,
  162. .ndo_start_xmit = vti_tunnel_xmit,
  163. .ndo_do_ioctl = vti_tunnel_ioctl,
  164. .ndo_change_mtu = ip_tunnel_change_mtu,
  165. .ndo_get_stats64 = ip_tunnel_get_stats64,
  166. };
  167. static void vti_tunnel_setup(struct net_device *dev)
  168. {
  169. dev->netdev_ops = &vti_netdev_ops;
  170. ip_tunnel_setup(dev, vti_net_id);
  171. }
  172. static int vti_tunnel_init(struct net_device *dev)
  173. {
  174. struct ip_tunnel *tunnel = netdev_priv(dev);
  175. struct iphdr *iph = &tunnel->parms.iph;
  176. memcpy(dev->dev_addr, &iph->saddr, 4);
  177. memcpy(dev->broadcast, &iph->daddr, 4);
  178. dev->type = ARPHRD_TUNNEL;
  179. dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr);
  180. dev->mtu = ETH_DATA_LEN;
  181. dev->flags = IFF_NOARP;
  182. dev->iflink = 0;
  183. dev->addr_len = 4;
  184. dev->features |= NETIF_F_NETNS_LOCAL;
  185. dev->features |= NETIF_F_LLTX;
  186. dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
  187. return ip_tunnel_init(dev);
  188. }
  189. static void __net_init vti_fb_tunnel_init(struct net_device *dev)
  190. {
  191. struct ip_tunnel *tunnel = netdev_priv(dev);
  192. struct iphdr *iph = &tunnel->parms.iph;
  193. iph->version = 4;
  194. iph->protocol = IPPROTO_IPIP;
  195. iph->ihl = 5;
  196. }
  197. static struct xfrm_tunnel_notifier vti_handler __read_mostly = {
  198. .handler = vti_rcv,
  199. .priority = 1,
  200. };
  201. static int __net_init vti_init_net(struct net *net)
  202. {
  203. int err;
  204. struct ip_tunnel_net *itn;
  205. err = ip_tunnel_init_net(net, vti_net_id, &vti_link_ops, "ip_vti0");
  206. if (err)
  207. return err;
  208. itn = net_generic(net, vti_net_id);
  209. vti_fb_tunnel_init(itn->fb_tunnel_dev);
  210. return 0;
  211. }
  212. static void __net_exit vti_exit_net(struct net *net)
  213. {
  214. struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
  215. ip_tunnel_delete_net(itn, &vti_link_ops);
  216. }
  217. static struct pernet_operations vti_net_ops = {
  218. .init = vti_init_net,
  219. .exit = vti_exit_net,
  220. .id = &vti_net_id,
  221. .size = sizeof(struct ip_tunnel_net),
  222. };
  223. static int vti_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
  224. {
  225. return 0;
  226. }
  227. static void vti_netlink_parms(struct nlattr *data[],
  228. struct ip_tunnel_parm *parms)
  229. {
  230. memset(parms, 0, sizeof(*parms));
  231. parms->iph.protocol = IPPROTO_IPIP;
  232. if (!data)
  233. return;
  234. if (data[IFLA_VTI_LINK])
  235. parms->link = nla_get_u32(data[IFLA_VTI_LINK]);
  236. if (data[IFLA_VTI_IKEY])
  237. parms->i_key = nla_get_be32(data[IFLA_VTI_IKEY]);
  238. if (data[IFLA_VTI_OKEY])
  239. parms->o_key = nla_get_be32(data[IFLA_VTI_OKEY]);
  240. if (data[IFLA_VTI_LOCAL])
  241. parms->iph.saddr = nla_get_be32(data[IFLA_VTI_LOCAL]);
  242. if (data[IFLA_VTI_REMOTE])
  243. parms->iph.daddr = nla_get_be32(data[IFLA_VTI_REMOTE]);
  244. }
  245. static int vti_newlink(struct net *src_net, struct net_device *dev,
  246. struct nlattr *tb[], struct nlattr *data[])
  247. {
  248. struct ip_tunnel_parm parms;
  249. vti_netlink_parms(data, &parms);
  250. return ip_tunnel_newlink(dev, tb, &parms);
  251. }
  252. static int vti_changelink(struct net_device *dev, struct nlattr *tb[],
  253. struct nlattr *data[])
  254. {
  255. struct ip_tunnel_parm p;
  256. vti_netlink_parms(data, &p);
  257. return ip_tunnel_changelink(dev, tb, &p);
  258. }
  259. static size_t vti_get_size(const struct net_device *dev)
  260. {
  261. return
  262. /* IFLA_VTI_LINK */
  263. nla_total_size(4) +
  264. /* IFLA_VTI_IKEY */
  265. nla_total_size(4) +
  266. /* IFLA_VTI_OKEY */
  267. nla_total_size(4) +
  268. /* IFLA_VTI_LOCAL */
  269. nla_total_size(4) +
  270. /* IFLA_VTI_REMOTE */
  271. nla_total_size(4) +
  272. 0;
  273. }
  274. static int vti_fill_info(struct sk_buff *skb, const struct net_device *dev)
  275. {
  276. struct ip_tunnel *t = netdev_priv(dev);
  277. struct ip_tunnel_parm *p = &t->parms;
  278. nla_put_u32(skb, IFLA_VTI_LINK, p->link);
  279. nla_put_be32(skb, IFLA_VTI_IKEY, p->i_key);
  280. nla_put_be32(skb, IFLA_VTI_OKEY, p->o_key);
  281. nla_put_be32(skb, IFLA_VTI_LOCAL, p->iph.saddr);
  282. nla_put_be32(skb, IFLA_VTI_REMOTE, p->iph.daddr);
  283. return 0;
  284. }
  285. static const struct nla_policy vti_policy[IFLA_VTI_MAX + 1] = {
  286. [IFLA_VTI_LINK] = { .type = NLA_U32 },
  287. [IFLA_VTI_IKEY] = { .type = NLA_U32 },
  288. [IFLA_VTI_OKEY] = { .type = NLA_U32 },
  289. [IFLA_VTI_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) },
  290. [IFLA_VTI_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
  291. };
  292. static struct rtnl_link_ops vti_link_ops __read_mostly = {
  293. .kind = "vti",
  294. .maxtype = IFLA_VTI_MAX,
  295. .policy = vti_policy,
  296. .priv_size = sizeof(struct ip_tunnel),
  297. .setup = vti_tunnel_setup,
  298. .validate = vti_tunnel_validate,
  299. .newlink = vti_newlink,
  300. .changelink = vti_changelink,
  301. .get_size = vti_get_size,
  302. .fill_info = vti_fill_info,
  303. };
  304. static int __init vti_init(void)
  305. {
  306. int err;
  307. pr_info("IPv4 over IPSec tunneling driver\n");
  308. err = register_pernet_device(&vti_net_ops);
  309. if (err < 0)
  310. return err;
  311. err = xfrm4_mode_tunnel_input_register(&vti_handler);
  312. if (err < 0) {
  313. unregister_pernet_device(&vti_net_ops);
  314. pr_info("vti init: can't register tunnel\n");
  315. }
  316. err = rtnl_link_register(&vti_link_ops);
  317. if (err < 0)
  318. goto rtnl_link_failed;
  319. return err;
  320. rtnl_link_failed:
  321. xfrm4_mode_tunnel_input_deregister(&vti_handler);
  322. unregister_pernet_device(&vti_net_ops);
  323. return err;
  324. }
  325. static void __exit vti_fini(void)
  326. {
  327. rtnl_link_unregister(&vti_link_ops);
  328. if (xfrm4_mode_tunnel_input_deregister(&vti_handler))
  329. pr_info("vti close: can't deregister tunnel\n");
  330. unregister_pernet_device(&vti_net_ops);
  331. }
  332. module_init(vti_init);
  333. module_exit(vti_fini);
  334. MODULE_LICENSE("GPL");
  335. MODULE_ALIAS_RTNL_LINK("vti");
  336. MODULE_ALIAS_NETDEV("ip_vti0");