net/ipv4/ip_gre.c

   1 /*
   2  *      Linux NET3:     GRE over IP protocol decoder.
   3  *
   4  *      Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
   5  *
   6  *      This program is free software; you can redistribute it and/or
   7  *      modify it under the terms of the GNU General Public License
   8  *      as published by the Free Software Foundation; either version
   9  *      2 of the License, or (at your option) any later version.
  10  *
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14
  15 #include <linux/capability.h>
  16 #include <linux/module.h>
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/slab.h>
  20 #include <linux/uaccess.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/in.h>
  24 #include <linux/tcp.h>
  25 #include <linux/udp.h>
  26 #include <linux/if_arp.h>
  27 #include <linux/if_vlan.h>
  28 #include <linux/init.h>
  29 #include <linux/in6.h>
  30 #include <linux/inetdevice.h>
  31 #include <linux/igmp.h>
  32 #include <linux/netfilter_ipv4.h>
  33 #include <linux/etherdevice.h>
  34 #include <linux/if_ether.h>
  35
  36 #include <net/sock.h>
  37 #include <net/ip.h>
  38 #include <net/icmp.h>
  39 #include <net/protocol.h>
  40 #include <net/ip_tunnels.h>
  41 #include <net/arp.h>
  42 #include <net/checksum.h>
  43 #include <net/dsfield.h>
  44 #include <net/inet_ecn.h>
  45 #include <net/xfrm.h>
  46 #include <net/net_namespace.h>
  47 #include <net/netns/generic.h>
  48 #include <net/rtnetlink.h>
  49 #include <net/gre.h>
  50 #include <net/dst_metadata.h>
  51 #include <net/erspan.h>
  52
  53 /*
  54    Problems & solutions
  55    --------------------
  56
  57    1. The most important issue is detecting local dead loops.
  58    They would cause complete host lockup in transmit, which
  59    would be "resolved" by stack overflow or, if queueing is enabled,
  60    with infinite looping in net_bh.
  61
  62    We cannot track such dead loops during route installation,
  63    it is infeasible task. The most general solutions would be
  64    to keep skb->encapsulation counter (sort of local ttl),
  65    and silently drop packet when it expires. It is a good
  66    solution, but it supposes maintaining new variable in ALL
  67    skb, even if no tunneling is used.
  68
  69    Current solution: xmit_recursion breaks dead loops. This is a percpu
  70    counter, since when we enter the first ndo_xmit(), cpu migration is
  71    forbidden. We force an exit if this counter reaches RECURSION_LIMIT
  72
  73    2. Networking dead loops would not kill routers, but would really
  74    kill network. IP hop limit plays role of "t->recursion" in this case,
  75    if we copy it from packet being encapsulated to upper header.
  76    It is very good solution, but it introduces two problems:
  77
  78    - Routing protocols, using packets with ttl=1 (OSPF, RIP2),
  79      do not work over tunnels.
  80    - traceroute does not work. I planned to relay ICMP from tunnel,
  81      so that this problem would be solved and traceroute output
  82      would even more informative. This idea appeared to be wrong:
  83      only Linux complies to rfc1812 now (yes, guys, Linux is the only
  84      true router now :-)), all routers (at least, in neighbourhood of mine)
  85      return only 8 bytes of payload. It is the end.
  86
  87    Hence, if we want that OSPF worked or traceroute said something reasonable,
  88    we should search for another solution.
  89
  90    One of them is to parse packet trying to detect inner encapsulation
  91    made by our node. It is difficult or even impossible, especially,
  92    taking into account fragmentation. TO be short, ttl is not solution at all.
  93
  94    Current solution: The solution was UNEXPECTEDLY SIMPLE.
  95    We force DF flag on tunnels with preconfigured hop limit,
  96    that is ALL. :-) Well, it does not remove the problem completely,
  97    but exponential growth of network traffic is changed to linear
  98    (branches, that exceed pmtu are pruned) and tunnel mtu
  99    rapidly degrades to value <68, where looping stops.
 100    Yes, it is not good if there exists a router in the loop,
 101    which does not force DF, even when encapsulating packets have DF set.
 102    But it is not our problem! Nobody could accuse us, we made
 103    all that we could make. Even if it is your gated who injected
 104    fatal route to network, even if it were you who configured
 105    fatal static route: you are innocent. :-)
 106
 107    Alexey Kuznetsov.
 108  */
 109
 110 static bool log_ecn_error = true;
 111 module_param(log_ecn_error, bool, 0644);
 112 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
 113
 114 static struct rtnl_link_ops ipgre_link_ops __read_mostly;
 115 static int ipgre_tunnel_init(struct net_device *dev);
 116 static void erspan_build_header(struct sk_buff *skb,
 117                                 u32 id, u32 index,
 118                                 bool truncate, bool is_ipv4);
 119
 120 static unsigned int ipgre_net_id __read_mostly;
 121 static unsigned int gre_tap_net_id __read_mostly;
 122 static unsigned int erspan_net_id __read_mostly;
 123
 124 static void ipgre_err(struct sk_buff *skb, u32 info,
 125                       const struct tnl_ptk_info *tpi)
 126 {
 127
 128         /* All the routers (except for Linux) return only
 129            8 bytes of packet payload. It means, that precise relaying of
 130            ICMP in the real Internet is absolutely infeasible.
 131
 132            Moreover, Cisco "wise men" put GRE key to the third word
 133            in GRE header. It makes impossible maintaining even soft
 134            state for keyed GRE tunnels with enabled checksum. Tell
 135            them "thank you".
 136
 137            Well, I wonder, rfc1812 was written by Cisco employee,
 138            what the hell these idiots break standards established
 139            by themselves???
 140            */
 141         struct net *net = dev_net(skb->dev);
 142         struct ip_tunnel_net *itn;
 143         const struct iphdr *iph;
 144         const int type = icmp_hdr(skb)->type;
 145         const int code = icmp_hdr(skb)->code;
 146         unsigned int data_len = 0;
 147         struct ip_tunnel *t;
 148
 149         switch (type) {
 150         default:
 151         case ICMP_PARAMETERPROB:
 152                 return;
 153
 154         case ICMP_DEST_UNREACH:
 155                 switch (code) {
 156                 case ICMP_SR_FAILED:
 157                 case ICMP_PORT_UNREACH:
 158                         /* Impossible event. */
 159                         return;
 160                 default:
 161                         /* All others are translated to HOST_UNREACH.
 162                            rfc2003 contains "deep thoughts" about NET_UNREACH,
 163                            I believe they are just ether pollution. --ANK
 164                          */
 165                         break;
 166                 }
 167                 break;
 168
 169         case ICMP_TIME_EXCEEDED:
 170                 if (code != ICMP_EXC_TTL)
 171                         return;
 172                 data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */
 173                 break;
 174
 175         case ICMP_REDIRECT:
 176                 break;
 177         }
 178
 179         if (tpi->proto == htons(ETH_P_TEB))
 180                 itn = net_generic(net, gre_tap_net_id);
 181         else if (tpi->proto == htons(ETH_P_ERSPAN) ||
 182                  tpi->proto == htons(ETH_P_ERSPAN2))
 183                 itn = net_generic(net, erspan_net_id);
 184         else
 185                 itn = net_generic(net, ipgre_net_id);
 186
 187         iph = (const struct iphdr *)(icmp_hdr(skb) + 1);
 188         t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
 189                              iph->daddr, iph->saddr, tpi->key);
 190
 191         if (!t)
 192                 return;
 193
 194 #if IS_ENABLED(CONFIG_IPV6)
 195        if (tpi->proto == htons(ETH_P_IPV6) &&
 196            !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4 + tpi->hdr_len,
 197                                        type, data_len))
 198                return;
 199 #endif
 200
 201         if (t->parms.iph.daddr == 0 ||
 202             ipv4_is_multicast(t->parms.iph.daddr))
 203                 return;
 204
 205         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 206                 return;
 207
 208         if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
 209                 t->err_count++;
 210         else
 211                 t->err_count = 1;
 212         t->err_time = jiffies;
 213 }
 214
 215 static void gre_err(struct sk_buff *skb, u32 info)
 216 {
 217         /* All the routers (except for Linux) return only
 218          * 8 bytes of packet payload. It means, that precise relaying of
 219          * ICMP in the real Internet is absolutely infeasible.
 220          *
 221          * Moreover, Cisco "wise men" put GRE key to the third word
 222          * in GRE header. It makes impossible maintaining even soft
 223          * state for keyed
 224          * GRE tunnels with enabled checksum. Tell them "thank you".
 225          *
 226          * Well, I wonder, rfc1812 was written by Cisco employee,
 227          * what the hell these idiots break standards established
 228          * by themselves???
 229          */
 230
 231         const struct iphdr *iph = (struct iphdr *)skb->data;
 232         const int type = icmp_hdr(skb)->type;
 233         const int code = icmp_hdr(skb)->code;
 234         struct tnl_ptk_info tpi;
 235         bool csum_err = false;
 236
 237         if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
 238                              iph->ihl * 4) < 0) {
 239                 if (!csum_err)          /* ignore csum errors. */
 240                         return;
 241         }
 242
 243         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
 244                 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
 245                                  skb->dev->ifindex, 0, IPPROTO_GRE, 0);
 246                 return;
 247         }
 248         if (type == ICMP_REDIRECT) {
 249                 ipv4_redirect(skb, dev_net(skb->dev), skb->dev->ifindex, 0,
 250                               IPPROTO_GRE, 0);
 251                 return;
 252         }
 253
 254         ipgre_err(skb, info, &tpi);
 255 }
 256
 257 static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi,
 258                       int gre_hdr_len)
 259 {
 260         struct net *net = dev_net(skb->dev);
 261         struct metadata_dst *tun_dst = NULL;
 262         struct erspan_base_hdr *ershdr;
 263         struct erspan_metadata *pkt_md;
 264         struct ip_tunnel_net *itn;
 265         struct ip_tunnel *tunnel;
 266         const struct iphdr *iph;
 267         struct erspan_md2 *md2;
 268         int ver;
 269         int len;
 270
 271         itn = net_generic(net, erspan_net_id);
 272         len = gre_hdr_len + sizeof(*ershdr);
 273
 274         /* Check based hdr len */
 275         if (unlikely(!pskb_may_pull(skb, len)))
 276                 return PACKET_REJECT;
 277
 278         iph = ip_hdr(skb);
 279         ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
 280         ver = ershdr->ver;
 281
 282         /* The original GRE header does not have key field,
 283          * Use ERSPAN 10-bit session ID as key.
 284          */
 285         tpi->key = cpu_to_be32(get_session_id(ershdr));
 286         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex,
 287                                   tpi->flags | TUNNEL_KEY,
 288                                   iph->saddr, iph->daddr, tpi->key);
 289
 290         if (tunnel) {
 291                 len = gre_hdr_len + erspan_hdr_len(ver);
 292                 if (unlikely(!pskb_may_pull(skb, len)))
 293                         return PACKET_REJECT;
 294
 295                 ershdr = (struct erspan_base_hdr *)(skb->data + gre_hdr_len);
 296                 pkt_md = (struct erspan_metadata *)(ershdr + 1);
 297
 298                 if (__iptunnel_pull_header(skb,
 299                                            len,
 300                                            htons(ETH_P_TEB),
 301                                            false, false) < 0)
 302                         goto drop;
 303
 304                 if (tunnel->collect_md) {
 305                         struct ip_tunnel_info *info;
 306                         struct erspan_metadata *md;
 307                         __be64 tun_id;
 308                         __be16 flags;
 309
 310                         tpi->flags |= TUNNEL_KEY;
 311                         flags = tpi->flags;
 312                         tun_id = key32_to_tunnel_id(tpi->key);
 313
 314                         tun_dst = ip_tun_rx_dst(skb, flags,
 315                                                 tun_id, sizeof(*md));
 316                         if (!tun_dst)
 317                                 return PACKET_REJECT;
 318
 319                         md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
 320                         md->version = ver;
 321                         md2 = &md->u.md2;
 322                         memcpy(md2, pkt_md, ver == 1 ? ERSPAN_V1_MDSIZE :
 323                                                        ERSPAN_V2_MDSIZE);
 324
 325                         info = &tun_dst->u.tun_info;
 326                         info->key.tun_flags |= TUNNEL_ERSPAN_OPT;
 327                         info->options_len = sizeof(*md);
 328                 }
 329
 330                 skb_reset_mac_header(skb);
 331                 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error);
 332                 return PACKET_RCVD;
 333         }
 334         return PACKET_REJECT;
 335
 336 drop:
 337         kfree_skb(skb);
 338         return PACKET_RCVD;
 339 }
 340
 341 static int __ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi,
 342                        struct ip_tunnel_net *itn, int hdr_len, bool raw_proto)
 343 {
 344         struct metadata_dst *tun_dst = NULL;
 345         const struct iphdr *iph;
 346         struct ip_tunnel *tunnel;
 347
 348         iph = ip_hdr(skb);
 349         tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
 350                                   iph->saddr, iph->daddr, tpi->key);
 351
 352         if (tunnel) {
 353                 if (__iptunnel_pull_header(skb, hdr_len, tpi->proto,
 354                                            raw_proto, false) < 0)
 355                         goto drop;
 356
 357                 if (tunnel->dev->type != ARPHRD_NONE)
 358                         skb_pop_mac_header(skb);
 359                 else
 360                         skb_reset_mac_header(skb);
 361                 if (tunnel->collect_md) {
 362                         __be16 flags;
 363                         __be64 tun_id;
 364
 365                         flags = tpi->flags & (TUNNEL_CSUM | TUNNEL_KEY);
 366                         tun_id = key32_to_tunnel_id(tpi->key);
 367                         tun_dst = ip_tun_rx_dst(skb, flags, tun_id, 0);
 368                         if (!tun_dst)
 369                                 return PACKET_REJECT;
 370                 }
 371
 372                 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error);
 373                 return PACKET_RCVD;
 374         }
 375         return PACKET_NEXT;
 376
 377 drop:
 378         kfree_skb(skb);
 379         return PACKET_RCVD;
 380 }
 381
 382 static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi,
 383                      int hdr_len)
 384 {
 385         struct net *net = dev_net(skb->dev);
 386         struct ip_tunnel_net *itn;
 387         int res;
 388
 389         if (tpi->proto == htons(ETH_P_TEB))
 390                 itn = net_generic(net, gre_tap_net_id);
 391         else
 392                 itn = net_generic(net, ipgre_net_id);
 393
 394         res = __ipgre_rcv(skb, tpi, itn, hdr_len, false);
 395         if (res == PACKET_NEXT && tpi->proto == htons(ETH_P_TEB)) {
 396                 /* ipgre tunnels in collect metadata mode should receive
 397                  * also ETH_P_TEB traffic.
 398                  */
 399                 itn = net_generic(net, ipgre_net_id);
 400                 res = __ipgre_rcv(skb, tpi, itn, hdr_len, true);
 401         }
 402         return res;
 403 }
 404
 405 static int gre_rcv(struct sk_buff *skb)
 406 {
 407         struct tnl_ptk_info tpi;
 408         bool csum_err = false;
 409         int hdr_len;
 410
 411 #ifdef CONFIG_NET_IPGRE_BROADCAST
 412         if (ipv4_is_multicast(ip_hdr(skb)->daddr)) {
 413                 /* Looped back packet, drop it! */
 414                 if (rt_is_output_route(skb_rtable(skb)))
 415                         goto drop;
 416         }
 417 #endif
 418
 419         hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 0);
 420         if (hdr_len < 0)
 421                 goto drop;
 422
 423         if (unlikely(tpi.proto == htons(ETH_P_ERSPAN) ||
 424                      tpi.proto == htons(ETH_P_ERSPAN2))) {
 425                 if (erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
 426                         return 0;
 427                 goto out;
 428         }
 429
 430         if (ipgre_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
 431                 return 0;
 432
 433 out:
 434         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 435 drop:
 436         kfree_skb(skb);
 437         return 0;
 438 }
 439
 440 static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
 441                        const struct iphdr *tnl_params,
 442                        __be16 proto)
 443 {
 444         struct ip_tunnel *tunnel = netdev_priv(dev);
 445
 446         if (tunnel->parms.o_flags & TUNNEL_SEQ)
 447                 tunnel->o_seqno++;
 448
 449         /* Push GRE header. */
 450         gre_build_header(skb, tunnel->tun_hlen,
 451                          tunnel->parms.o_flags, proto, tunnel->parms.o_key,
 452                          htonl(tunnel->o_seqno));
 453
 454         ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
 455 }
 456
 457 static int gre_handle_offloads(struct sk_buff *skb, bool csum)
 458 {
 459         return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
 460 }
 461
 462 static struct rtable *gre_get_rt(struct sk_buff *skb,
 463                                  struct net_device *dev,
 464                                  struct flowi4 *fl,
 465                                  const struct ip_tunnel_key *key)
 466 {
 467         struct net *net = dev_net(dev);
 468
 469         memset(fl, 0, sizeof(*fl));
 470         fl->daddr = key->u.ipv4.dst;
 471         fl->saddr = key->u.ipv4.src;
 472         fl->flowi4_tos = RT_TOS(key->tos);
 473         fl->flowi4_mark = skb->mark;
 474         fl->flowi4_proto = IPPROTO_GRE;
 475
 476         return ip_route_output_key(net, fl);
 477 }
 478
 479 static struct rtable *prepare_fb_xmit(struct sk_buff *skb,
 480                                       struct net_device *dev,
 481                                       struct flowi4 *fl,
 482                                       int tunnel_hlen)
 483 {
 484         struct ip_tunnel_info *tun_info;
 485         const struct ip_tunnel_key *key;
 486         struct rtable *rt = NULL;
 487         int min_headroom;
 488         bool use_cache;
 489         int err;
 490
 491         tun_info = skb_tunnel_info(skb);
 492         key = &tun_info->key;
 493         use_cache = ip_tunnel_dst_cache_usable(skb, tun_info);
 494
 495         if (use_cache)
 496                 rt = dst_cache_get_ip4(&tun_info->dst_cache, &fl->saddr);
 497         if (!rt) {
 498                 rt = gre_get_rt(skb, dev, fl, key);
 499                 if (IS_ERR(rt))
 500                         goto err_free_skb;
 501                 if (use_cache)
 502                         dst_cache_set_ip4(&tun_info->dst_cache, &rt->dst,
 503                                           fl->saddr);
 504         }
 505
 506         min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
 507                         + tunnel_hlen + sizeof(struct iphdr);
 508         if (skb_headroom(skb) < min_headroom || skb_header_cloned(skb)) {
 509                 int head_delta = SKB_DATA_ALIGN(min_headroom -
 510                                                 skb_headroom(skb) +
 511                                                 16);
 512                 err = pskb_expand_head(skb, max_t(int, head_delta, 0),
 513                                        0, GFP_ATOMIC);
 514                 if (unlikely(err))
 515                         goto err_free_rt;
 516         }
 517         return rt;
 518
 519 err_free_rt:
 520         ip_rt_put(rt);
 521 err_free_skb:
 522         kfree_skb(skb);
 523         dev->stats.tx_dropped++;
 524         return NULL;
 525 }
 526
 527 static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev,
 528                         __be16 proto)
 529 {
 530         struct ip_tunnel *tunnel = netdev_priv(dev);
 531         struct ip_tunnel_info *tun_info;
 532         const struct ip_tunnel_key *key;
 533         struct rtable *rt = NULL;
 534         struct flowi4 fl;
 535         int tunnel_hlen;
 536         __be16 df, flags;
 537
 538         tun_info = skb_tunnel_info(skb);
 539         if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
 540                      ip_tunnel_info_af(tun_info) != AF_INET))
 541                 goto err_free_skb;
 542
 543         key = &tun_info->key;
 544         tunnel_hlen = gre_calc_hlen(key->tun_flags);
 545
 546         rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen);
 547         if (!rt)
 548                 return;
 549
 550         /* Push Tunnel header. */
 551         if (gre_handle_offloads(skb, !!(tun_info->key.tun_flags & TUNNEL_CSUM)))
 552                 goto err_free_rt;
 553
 554         flags = tun_info->key.tun_flags &
 555                 (TUNNEL_CSUM | TUNNEL_KEY | TUNNEL_SEQ);
 556         gre_build_header(skb, tunnel_hlen, flags, proto,
 557                          tunnel_id_to_key32(tun_info->key.tun_id),
 558                          (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0);
 559
 560         df = key->tun_flags & TUNNEL_DONT_FRAGMENT ?  htons(IP_DF) : 0;
 561
 562         iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE,
 563                       key->tos, key->ttl, df, false);
 564         return;
 565
 566 err_free_rt:
 567         ip_rt_put(rt);
 568 err_free_skb:
 569         kfree_skb(skb);
 570         dev->stats.tx_dropped++;
 571 }
 572
 573 static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev,
 574                            __be16 proto)
 575 {
 576         struct ip_tunnel *tunnel = netdev_priv(dev);
 577         struct ip_tunnel_info *tun_info;
 578         const struct ip_tunnel_key *key;
 579         struct erspan_metadata *md;
 580         struct rtable *rt = NULL;
 581         bool truncate = false;
 582         struct flowi4 fl;
 583         int tunnel_hlen;
 584         int version;
 585         __be16 df;
 586         int nhoff;
 587         int thoff;
 588
 589         tun_info = skb_tunnel_info(skb);
 590         if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
 591                      ip_tunnel_info_af(tun_info) != AF_INET))
 592                 goto err_free_skb;
 593
 594         key = &tun_info->key;
 595         if (!(tun_info->key.tun_flags & TUNNEL_ERSPAN_OPT))
 596                 goto err_free_rt;
 597         md = ip_tunnel_info_opts(tun_info);
 598         if (!md)
 599                 goto err_free_rt;
 600
 601         /* ERSPAN has fixed 8 byte GRE header */
 602         version = md->version;
 603         tunnel_hlen = 8 + erspan_hdr_len(version);
 604
 605         rt = prepare_fb_xmit(skb, dev, &fl, tunnel_hlen);
 606         if (!rt)
 607                 return;
 608
 609         if (gre_handle_offloads(skb, false))
 610                 goto err_free_rt;
 611
 612         if (skb->len > dev->mtu + dev->hard_header_len) {
 613                 pskb_trim(skb, dev->mtu + dev->hard_header_len);
 614                 truncate = true;
 615         }
 616
 617         nhoff = skb_network_header(skb) - skb_mac_header(skb);
 618         if (skb->protocol == htons(ETH_P_IP) &&
 619             (ntohs(ip_hdr(skb)->tot_len) > skb->len - nhoff))
 620                 truncate = true;
 621
 622         thoff = skb_transport_header(skb) - skb_mac_header(skb);
 623         if (skb->protocol == htons(ETH_P_IPV6) &&
 624             (ntohs(ipv6_hdr(skb)->payload_len) > skb->len - thoff))
 625                 truncate = true;
 626
 627         if (version == 1) {
 628                 erspan_build_header(skb, ntohl(tunnel_id_to_key32(key->tun_id)),
 629                                     ntohl(md->u.index), truncate, true);
 630         } else if (version == 2) {
 631                 erspan_build_header_v2(skb,
 632                                        ntohl(tunnel_id_to_key32(key->tun_id)),
 633                                        md->u.md2.dir,
 634                                        get_hwid(&md->u.md2),
 635                                        truncate, true);
 636         } else {
 637                 goto err_free_rt;
 638         }
 639
 640         gre_build_header(skb, 8, TUNNEL_SEQ,
 641                          htons(ETH_P_ERSPAN), 0, htonl(tunnel->o_seqno++));
 642
 643         df = key->tun_flags & TUNNEL_DONT_FRAGMENT ?  htons(IP_DF) : 0;
 644
 645         iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE,
 646                       key->tos, key->ttl, df, false);
 647         return;
 648
 649 err_free_rt:
 650         ip_rt_put(rt);
 651 err_free_skb:
 652         kfree_skb(skb);
 653         dev->stats.tx_dropped++;
 654 }
 655
 656 static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 657 {
 658         struct ip_tunnel_info *info = skb_tunnel_info(skb);
 659         struct rtable *rt;
 660         struct flowi4 fl4;
 661
 662         if (ip_tunnel_info_af(info) != AF_INET)
 663                 return -EINVAL;
 664
 665         rt = gre_get_rt(skb, dev, &fl4, &info->key);
 666         if (IS_ERR(rt))
 667                 return PTR_ERR(rt);
 668
 669         ip_rt_put(rt);
 670         info->key.u.ipv4.src = fl4.saddr;
 671         return 0;
 672 }
 673
 674 static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
 675                               struct net_device *dev)
 676 {
 677         struct ip_tunnel *tunnel = netdev_priv(dev);
 678         const struct iphdr *tnl_params;
 679
 680         if (tunnel->collect_md) {
 681                 gre_fb_xmit(skb, dev, skb->protocol);
 682                 return NETDEV_TX_OK;
 683         }
 684
 685         if (dev->header_ops) {
 686                 /* Need space for new headers */
 687                 if (skb_cow_head(skb, dev->needed_headroom -
 688                                       (tunnel->hlen + sizeof(struct iphdr))))
 689                         goto free_skb;
 690
 691                 tnl_params = (const struct iphdr *)skb->data;
 692
 693                 /* Pull skb since ip_tunnel_xmit() needs skb->data pointing
 694                  * to gre header.
 695                  */
 696                 skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
 697                 skb_reset_mac_header(skb);
 698         } else {
 699                 if (skb_cow_head(skb, dev->needed_headroom))
 700                         goto free_skb;
 701
 702                 tnl_params = &tunnel->parms.iph;
 703         }
 704
 705         if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM)))
 706                 goto free_skb;
 707
 708         __gre_xmit(skb, dev, tnl_params, skb->protocol);
 709         return NETDEV_TX_OK;
 710
 711 free_skb:
 712         kfree_skb(skb);
 713         dev->stats.tx_dropped++;
 714         return NETDEV_TX_OK;
 715 }
 716
 717 static netdev_tx_t erspan_xmit(struct sk_buff *skb,
 718                                struct net_device *dev)
 719 {
 720         struct ip_tunnel *tunnel = netdev_priv(dev);
 721         bool truncate = false;
 722
 723         if (tunnel->collect_md) {
 724                 erspan_fb_xmit(skb, dev, skb->protocol);
 725                 return NETDEV_TX_OK;
 726         }
 727
 728         if (gre_handle_offloads(skb, false))
 729                 goto free_skb;
 730
 731         if (skb_cow_head(skb, dev->needed_headroom))
 732                 goto free_skb;
 733
 734         if (skb->len > dev->mtu + dev->hard_header_len) {
 735                 pskb_trim(skb, dev->mtu + dev->hard_header_len);
 736                 truncate = true;
 737         }
 738
 739         /* Push ERSPAN header */
 740         if (tunnel->erspan_ver == 1)
 741                 erspan_build_header(skb, ntohl(tunnel->parms.o_key),
 742                                     tunnel->index,
 743                                     truncate, true);
 744         else if (tunnel->erspan_ver == 2)
 745                 erspan_build_header_v2(skb, ntohl(tunnel->parms.o_key),
 746                                        tunnel->dir, tunnel->hwid,
 747                                        truncate, true);
 748         else
 749                 goto free_skb;
 750
 751         tunnel->parms.o_flags &= ~TUNNEL_KEY;
 752         __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_ERSPAN));
 753         return NETDEV_TX_OK;
 754
 755 free_skb:
 756         kfree_skb(skb);
 757         dev->stats.tx_dropped++;
 758         return NETDEV_TX_OK;
 759 }
 760
 761 static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
 762                                 struct net_device *dev)
 763 {
 764         struct ip_tunnel *tunnel = netdev_priv(dev);
 765
 766         if (tunnel->collect_md) {
 767                 gre_fb_xmit(skb, dev, htons(ETH_P_TEB));
 768                 return NETDEV_TX_OK;
 769         }
 770
 771         if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM)))
 772                 goto free_skb;
 773
 774         if (skb_cow_head(skb, dev->needed_headroom))
 775                 goto free_skb;
 776
 777         __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB));
 778         return NETDEV_TX_OK;
 779
 780 free_skb:
 781         kfree_skb(skb);
 782         dev->stats.tx_dropped++;
 783         return NETDEV_TX_OK;
 784 }
 785
 786 static void ipgre_link_update(struct net_device *dev, bool set_mtu)
 787 {
 788         struct ip_tunnel *tunnel = netdev_priv(dev);
 789         int len;
 790
 791         len = tunnel->tun_hlen;
 792         tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);
 793         len = tunnel->tun_hlen - len;
 794         tunnel->hlen = tunnel->hlen + len;
 795
 796         dev->needed_headroom = dev->needed_headroom + len;
 797         if (set_mtu)
 798                 dev->mtu = max_t(int, dev->mtu - len, 68);
 799
 800         if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) {
 801                 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) ||
 802                     tunnel->encap.type == TUNNEL_ENCAP_NONE) {
 803                         dev->features |= NETIF_F_GSO_SOFTWARE;
 804                         dev->hw_features |= NETIF_F_GSO_SOFTWARE;
 805                 } else {
 806                         dev->features &= ~NETIF_F_GSO_SOFTWARE;
 807                         dev->hw_features &= ~NETIF_F_GSO_SOFTWARE;
 808                 }
 809                 dev->features |= NETIF_F_LLTX;
 810         } else {
 811                 dev->hw_features &= ~NETIF_F_GSO_SOFTWARE;
 812                 dev->features &= ~(NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE);
 813         }
 814 }
 815
 816 static int ipgre_tunnel_ioctl(struct net_device *dev,
 817                               struct ifreq *ifr, int cmd)
 818 {
 819         struct ip_tunnel_parm p;
 820         int err;
 821
 822         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
 823                 return -EFAULT;
 824
 825         if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
 826                 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
 827                     p.iph.ihl != 5 || (p.iph.frag_off & htons(~IP_DF)) ||
 828                     ((p.i_flags | p.o_flags) & (GRE_VERSION | GRE_ROUTING)))
 829                         return -EINVAL;
 830         }
 831
 832         p.i_flags = gre_flags_to_tnl_flags(p.i_flags);
 833         p.o_flags = gre_flags_to_tnl_flags(p.o_flags);
 834
 835         err = ip_tunnel_ioctl(dev, &p, cmd);
 836         if (err)
 837                 return err;
 838
 839         if (cmd == SIOCCHGTUNNEL) {
 840                 struct ip_tunnel *t = netdev_priv(dev);
 841
 842                 t->parms.i_flags = p.i_flags;
 843                 t->parms.o_flags = p.o_flags;
 844
 845                 if (strcmp(dev->rtnl_link_ops->kind, "erspan"))
 846                         ipgre_link_update(dev, true);
 847         }
 848
 849         p.i_flags = gre_tnl_flags_to_gre_flags(p.i_flags);
 850         p.o_flags = gre_tnl_flags_to_gre_flags(p.o_flags);
 851
 852         if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
 853                 return -EFAULT;
 854
 855         return 0;
 856 }
 857
 858 /* Nice toy. Unfortunately, useless in real life :-)
 859    It allows to construct virtual multiprotocol broadcast "LAN"
 860    over the Internet, provided multicast routing is tuned.
 861
 862
 863    I have no idea was this bicycle invented before me,
 864    so that I had to set ARPHRD_IPGRE to a random value.
 865    I have an impression, that Cisco could make something similar,
 866    but this feature is apparently missing in IOS<=11.2(8).
 867
 868    I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks
 869    with broadcast 224.66.66.66. If you have access to mbone, play with me :-)
 870
 871    ping -t 255 224.66.66.66
 872
 873    If nobody answers, mbone does not work.
 874
 875    ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255
 876    ip addr add 10.66.66.<somewhat>/24 dev Universe
 877    ifconfig Universe up
 878    ifconfig Universe add fe80::<Your_real_addr>/10
 879    ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96
 880    ftp 10.66.66.66
 881    ...
 882    ftp fec0:6666:6666::193.233.7.65
 883    ...
 884  */
 885 static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
 886                         unsigned short type,
 887                         const void *daddr, const void *saddr, unsigned int len)
 888 {
 889         struct ip_tunnel *t = netdev_priv(dev);
 890         struct iphdr *iph;
 891         struct gre_base_hdr *greh;
 892
 893         iph = skb_push(skb, t->hlen + sizeof(*iph));
 894         greh = (struct gre_base_hdr *)(iph+1);
 895         greh->flags = gre_tnl_flags_to_gre_flags(t->parms.o_flags);
 896         greh->protocol = htons(type);
 897
 898         memcpy(iph, &t->parms.iph, sizeof(struct iphdr));
 899
 900         /* Set the source hardware address. */
 901         if (saddr)
 902                 memcpy(&iph->saddr, saddr, 4);
 903         if (daddr)
 904                 memcpy(&iph->daddr, daddr, 4);
 905         if (iph->daddr)
 906                 return t->hlen + sizeof(*iph);
 907
 908         return -(t->hlen + sizeof(*iph));
 909 }
 910
 911 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
 912 {
 913         const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
 914         memcpy(haddr, &iph->saddr, 4);
 915         return 4;
 916 }
 917
 918 static const struct header_ops ipgre_header_ops = {
 919         .create = ipgre_header,
 920         .parse  = ipgre_header_parse,
 921 };
 922
 923 #ifdef CONFIG_NET_IPGRE_BROADCAST
 924 static int ipgre_open(struct net_device *dev)
 925 {
 926         struct ip_tunnel *t = netdev_priv(dev);
 927
 928         if (ipv4_is_multicast(t->parms.iph.daddr)) {
 929                 struct flowi4 fl4;
 930                 struct rtable *rt;
 931
 932                 rt = ip_route_output_gre(t->net, &fl4,
 933                                          t->parms.iph.daddr,
 934                                          t->parms.iph.saddr,
 935                                          t->parms.o_key,
 936                                          RT_TOS(t->parms.iph.tos),
 937                                          t->parms.link);
 938                 if (IS_ERR(rt))
 939                         return -EADDRNOTAVAIL;
 940                 dev = rt->dst.dev;
 941                 ip_rt_put(rt);
 942                 if (!__in_dev_get_rtnl(dev))
 943                         return -EADDRNOTAVAIL;
 944                 t->mlink = dev->ifindex;
 945                 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
 946         }
 947         return 0;
 948 }
 949
 950 static int ipgre_close(struct net_device *dev)
 951 {
 952         struct ip_tunnel *t = netdev_priv(dev);
 953
 954         if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) {
 955                 struct in_device *in_dev;
 956                 in_dev = inetdev_by_index(t->net, t->mlink);
 957                 if (in_dev)
 958                         ip_mc_dec_group(in_dev, t->parms.iph.daddr);
 959         }
 960         return 0;
 961 }
 962 #endif
 963
 964 static const struct net_device_ops ipgre_netdev_ops = {
 965         .ndo_init               = ipgre_tunnel_init,
 966         .ndo_uninit             = ip_tunnel_uninit,
 967 #ifdef CONFIG_NET_IPGRE_BROADCAST
 968         .ndo_open               = ipgre_open,
 969         .ndo_stop               = ipgre_close,
 970 #endif
 971         .ndo_start_xmit         = ipgre_xmit,
 972         .ndo_do_ioctl           = ipgre_tunnel_ioctl,
 973         .ndo_change_mtu         = ip_tunnel_change_mtu,
 974         .ndo_get_stats64        = ip_tunnel_get_stats64,
 975         .ndo_get_iflink         = ip_tunnel_get_iflink,
 976 };
 977
 978 #define GRE_FEATURES (NETIF_F_SG |              \
 979                       NETIF_F_FRAGLIST |        \
 980                       NETIF_F_HIGHDMA |         \
 981                       NETIF_F_HW_CSUM)
 982
 983 static void ipgre_tunnel_setup(struct net_device *dev)
 984 {
 985         dev->netdev_ops         = &ipgre_netdev_ops;
 986         dev->type               = ARPHRD_IPGRE;
 987         ip_tunnel_setup(dev, ipgre_net_id);
 988 }
 989
 990 static void __gre_tunnel_init(struct net_device *dev)
 991 {
 992         struct ip_tunnel *tunnel;
 993
 994         tunnel = netdev_priv(dev);
 995         tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);
 996         tunnel->parms.iph.protocol = IPPROTO_GRE;
 997
 998         tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
 999
1000         dev->features           |= GRE_FEATURES;
1001         dev->hw_features        |= GRE_FEATURES;
1002
1003         if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) {
1004                 /* TCP offload with GRE SEQ is not supported, nor
1005                  * can we support 2 levels of outer headers requiring
1006                  * an update.
1007                  */
1008                 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) ||
1009                     (tunnel->encap.type == TUNNEL_ENCAP_NONE)) {
1010                         dev->features    |= NETIF_F_GSO_SOFTWARE;
1011                         dev->hw_features |= NETIF_F_GSO_SOFTWARE;
1012                 }
1013
1014                 /* Can use a lockless transmit, unless we generate
1015                  * output sequences
1016                  */
1017                 dev->features |= NETIF_F_LLTX;
1018         }
1019 }
1020
1021 static int ipgre_tunnel_init(struct net_device *dev)
1022 {
1023         struct ip_tunnel *tunnel = netdev_priv(dev);
1024         struct iphdr *iph = &tunnel->parms.iph;
1025
1026         __gre_tunnel_init(dev);
1027
1028         memcpy(dev->dev_addr, &iph->saddr, 4);
1029         memcpy(dev->broadcast, &iph->daddr, 4);
1030
1031         dev->flags              = IFF_NOARP;
1032         netif_keep_dst(dev);
1033         dev->addr_len           = 4;
1034
1035         if (iph->daddr && !tunnel->collect_md) {
1036 #ifdef CONFIG_NET_IPGRE_BROADCAST
1037                 if (ipv4_is_multicast(iph->daddr)) {
1038                         if (!iph->saddr)
1039                                 return -EINVAL;
1040                         dev->flags = IFF_BROADCAST;
1041                         dev->header_ops = &ipgre_header_ops;
1042                 }
1043 #endif
1044         } else if (!tunnel->collect_md) {
1045                 dev->header_ops = &ipgre_header_ops;
1046         }
1047
1048         return ip_tunnel_init(dev);
1049 }
1050
1051 static const struct gre_protocol ipgre_protocol = {
1052         .handler     = gre_rcv,
1053         .err_handler = gre_err,
1054 };
1055
1056 static int __net_init ipgre_init_net(struct net *net)
1057 {
1058         return ip_tunnel_init_net(net, ipgre_net_id, &ipgre_link_ops, NULL);
1059 }
1060
1061 static void __net_exit ipgre_exit_batch_net(struct list_head *list_net)
1062 {
1063         ip_tunnel_delete_nets(list_net, ipgre_net_id, &ipgre_link_ops);
1064 }
1065
1066 static struct pernet_operations ipgre_net_ops = {
1067         .init = ipgre_init_net,
1068         .exit_batch = ipgre_exit_batch_net,
1069         .id   = &ipgre_net_id,
1070         .size = sizeof(struct ip_tunnel_net),
1071 };
1072
1073 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[],
1074                                  struct netlink_ext_ack *extack)
1075 {
1076         __be16 flags;
1077
1078         if (!data)
1079                 return 0;
1080
1081         flags = 0;
1082         if (data[IFLA_GRE_IFLAGS])
1083                 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
1084         if (data[IFLA_GRE_OFLAGS])
1085                 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
1086         if (flags & (GRE_VERSION|GRE_ROUTING))
1087                 return -EINVAL;
1088
1089         if (data[IFLA_GRE_COLLECT_METADATA] &&
1090             data[IFLA_GRE_ENCAP_TYPE] &&
1091             nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE)
1092                 return -EINVAL;
1093
1094         return 0;
1095 }
1096
1097 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[],
1098                               struct netlink_ext_ack *extack)
1099 {
1100         __be32 daddr;
1101
1102         if (tb[IFLA_ADDRESS]) {
1103                 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
1104                         return -EINVAL;
1105                 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
1106                         return -EADDRNOTAVAIL;
1107         }
1108
1109         if (!data)
1110                 goto out;
1111
1112         if (data[IFLA_GRE_REMOTE]) {
1113                 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4);
1114                 if (!daddr)
1115                         return -EINVAL;
1116         }
1117
1118 out:
1119         return ipgre_tunnel_validate(tb, data, extack);
1120 }
1121
1122 static int erspan_validate(struct nlattr *tb[], struct nlattr *data[],
1123                            struct netlink_ext_ack *extack)
1124 {
1125         __be16 flags = 0;
1126         int ret;
1127
1128         if (!data)
1129                 return 0;
1130
1131         ret = ipgre_tap_validate(tb, data, extack);
1132         if (ret)
1133                 return ret;
1134
1135         /* ERSPAN should only have GRE sequence and key flag */
1136         if (data[IFLA_GRE_OFLAGS])
1137                 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
1138         if (data[IFLA_GRE_IFLAGS])
1139                 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
1140         if (!data[IFLA_GRE_COLLECT_METADATA] &&
1141             flags != (GRE_SEQ | GRE_KEY))
1142                 return -EINVAL;
1143
1144         /* ERSPAN Session ID only has 10-bit. Since we reuse
1145          * 32-bit key field as ID, check it's range.
1146          */
1147         if (data[IFLA_GRE_IKEY] &&
1148             (ntohl(nla_get_be32(data[IFLA_GRE_IKEY])) & ~ID_MASK))
1149                 return -EINVAL;
1150
1151         if (data[IFLA_GRE_OKEY] &&
1152             (ntohl(nla_get_be32(data[IFLA_GRE_OKEY])) & ~ID_MASK))
1153                 return -EINVAL;
1154
1155         return 0;
1156 }
1157
1158 static int ipgre_netlink_parms(struct net_device *dev,
1159                                 struct nlattr *data[],
1160                                 struct nlattr *tb[],
1161                                 struct ip_tunnel_parm *parms,
1162                                 __u32 *fwmark)
1163 {
1164         struct ip_tunnel *t = netdev_priv(dev);
1165
1166         memset(parms, 0, sizeof(*parms));
1167
1168         parms->iph.protocol = IPPROTO_GRE;
1169
1170         if (!data)
1171                 return 0;
1172
1173         if (data[IFLA_GRE_LINK])
1174                 parms->link = nla_get_u32(data[IFLA_GRE_LINK]);
1175
1176         if (data[IFLA_GRE_IFLAGS])
1177                 parms->i_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_IFLAGS]));
1178
1179         if (data[IFLA_GRE_OFLAGS])
1180                 parms->o_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_OFLAGS]));
1181
1182         if (data[IFLA_GRE_IKEY])
1183                 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]);
1184
1185         if (data[IFLA_GRE_OKEY])
1186                 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]);
1187
1188         if (data[IFLA_GRE_LOCAL])
1189                 parms->iph.saddr = nla_get_in_addr(data[IFLA_GRE_LOCAL]);
1190
1191         if (data[IFLA_GRE_REMOTE])
1192                 parms->iph.daddr = nla_get_in_addr(data[IFLA_GRE_REMOTE]);
1193
1194         if (data[IFLA_GRE_TTL])
1195                 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]);
1196
1197         if (data[IFLA_GRE_TOS])
1198                 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]);
1199
1200         if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC])) {
1201                 if (t->ignore_df)
1202                         return -EINVAL;
1203                 parms->iph.frag_off = htons(IP_DF);
1204         }
1205
1206         if (data[IFLA_GRE_COLLECT_METADATA]) {
1207                 t->collect_md = true;
1208                 if (dev->type == ARPHRD_IPGRE)
1209                         dev->type = ARPHRD_NONE;
1210         }
1211
1212         if (data[IFLA_GRE_IGNORE_DF]) {
1213                 if (nla_get_u8(data[IFLA_GRE_IGNORE_DF])
1214                   && (parms->iph.frag_off & htons(IP_DF)))
1215                         return -EINVAL;
1216                 t->ignore_df = !!nla_get_u8(data[IFLA_GRE_IGNORE_DF]);
1217         }
1218
1219         if (data[IFLA_GRE_FWMARK])
1220                 *fwmark = nla_get_u32(data[IFLA_GRE_FWMARK]);
1221
1222         if (data[IFLA_GRE_ERSPAN_VER]) {
1223                 t->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
1224
1225                 if (t->erspan_ver != 1 && t->erspan_ver != 2)
1226                         return -EINVAL;
1227         }
1228
1229         if (t->erspan_ver == 1) {
1230                 if (data[IFLA_GRE_ERSPAN_INDEX]) {
1231                         t->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
1232                         if (t->index & ~INDEX_MASK)
1233                                 return -EINVAL;
1234                 }
1235         } else if (t->erspan_ver == 2) {
1236                 if (data[IFLA_GRE_ERSPAN_DIR]) {
1237                         t->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
1238                         if (t->dir & ~(DIR_MASK >> DIR_OFFSET))
1239                                 return -EINVAL;
1240                 }
1241                 if (data[IFLA_GRE_ERSPAN_HWID]) {
1242                         t->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
1243                         if (t->hwid & ~(HWID_MASK >> HWID_OFFSET))
1244                                 return -EINVAL;
1245                 }
1246         }
1247
1248         return 0;
1249 }
1250
1251 /* This function returns true when ENCAP attributes are present in the nl msg */
1252 static bool ipgre_netlink_encap_parms(struct nlattr *data[],
1253                                       struct ip_tunnel_encap *ipencap)
1254 {
1255         bool ret = false;
1256
1257         memset(ipencap, 0, sizeof(*ipencap));
1258
1259         if (!data)
1260                 return ret;
1261
1262         if (data[IFLA_GRE_ENCAP_TYPE]) {
1263                 ret = true;
1264                 ipencap->type = nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]);
1265         }
1266
1267         if (data[IFLA_GRE_ENCAP_FLAGS]) {
1268                 ret = true;
1269                 ipencap->flags = nla_get_u16(data[IFLA_GRE_ENCAP_FLAGS]);
1270         }
1271
1272         if (data[IFLA_GRE_ENCAP_SPORT]) {
1273                 ret = true;
1274                 ipencap->sport = nla_get_be16(data[IFLA_GRE_ENCAP_SPORT]);
1275         }
1276
1277         if (data[IFLA_GRE_ENCAP_DPORT]) {
1278                 ret = true;
1279                 ipencap->dport = nla_get_be16(data[IFLA_GRE_ENCAP_DPORT]);
1280         }
1281
1282         return ret;
1283 }
1284
1285 static int gre_tap_init(struct net_device *dev)
1286 {
1287         __gre_tunnel_init(dev);
1288         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
1289         netif_keep_dst(dev);
1290
1291         return ip_tunnel_init(dev);
1292 }
1293
1294 static const struct net_device_ops gre_tap_netdev_ops = {
1295         .ndo_init               = gre_tap_init,
1296         .ndo_uninit             = ip_tunnel_uninit,
1297         .ndo_start_xmit         = gre_tap_xmit,
1298         .ndo_set_mac_address    = eth_mac_addr,
1299         .ndo_validate_addr      = eth_validate_addr,
1300         .ndo_change_mtu         = ip_tunnel_change_mtu,
1301         .ndo_get_stats64        = ip_tunnel_get_stats64,
1302         .ndo_get_iflink         = ip_tunnel_get_iflink,
1303         .ndo_fill_metadata_dst  = gre_fill_metadata_dst,
1304 };
1305
1306 static int erspan_tunnel_init(struct net_device *dev)
1307 {
1308         struct ip_tunnel *tunnel = netdev_priv(dev);
1309
1310         tunnel->tun_hlen = 8;
1311         tunnel->parms.iph.protocol = IPPROTO_GRE;
1312         tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen +
1313                        erspan_hdr_len(tunnel->erspan_ver);
1314
1315         dev->features           |= GRE_FEATURES;
1316         dev->hw_features        |= GRE_FEATURES;
1317         dev->priv_flags         |= IFF_LIVE_ADDR_CHANGE;
1318         netif_keep_dst(dev);
1319
1320         return ip_tunnel_init(dev);
1321 }
1322
1323 static const struct net_device_ops erspan_netdev_ops = {
1324         .ndo_init               = erspan_tunnel_init,
1325         .ndo_uninit             = ip_tunnel_uninit,
1326         .ndo_start_xmit         = erspan_xmit,
1327         .ndo_set_mac_address    = eth_mac_addr,
1328         .ndo_validate_addr      = eth_validate_addr,
1329         .ndo_change_mtu         = ip_tunnel_change_mtu,
1330         .ndo_get_stats64        = ip_tunnel_get_stats64,
1331         .ndo_get_iflink         = ip_tunnel_get_iflink,
1332         .ndo_fill_metadata_dst  = gre_fill_metadata_dst,
1333 };
1334
1335 static void ipgre_tap_setup(struct net_device *dev)
1336 {
1337         ether_setup(dev);
1338         dev->max_mtu = 0;
1339         dev->netdev_ops = &gre_tap_netdev_ops;
1340         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
1341         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
1342         ip_tunnel_setup(dev, gre_tap_net_id);
1343 }
1344
1345 bool is_gretap_dev(const struct net_device *dev)
1346 {
1347         return dev->netdev_ops == &gre_tap_netdev_ops;
1348 }
1349 EXPORT_SYMBOL_GPL(is_gretap_dev);
1350
1351 static int ipgre_newlink(struct net *src_net, struct net_device *dev,
1352                          struct nlattr *tb[], struct nlattr *data[],
1353                          struct netlink_ext_ack *extack)
1354 {
1355         struct ip_tunnel_parm p;
1356         struct ip_tunnel_encap ipencap;
1357         __u32 fwmark = 0;
1358         int err;
1359
1360         if (ipgre_netlink_encap_parms(data, &ipencap)) {
1361                 struct ip_tunnel *t = netdev_priv(dev);
1362                 err = ip_tunnel_encap_setup(t, &ipencap);
1363
1364                 if (err < 0)
1365                         return err;
1366         }
1367
1368         err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark);
1369         if (err < 0)
1370                 return err;
1371         return ip_tunnel_newlink(dev, tb, &p, fwmark);
1372 }
1373
1374 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
1375                             struct nlattr *data[],
1376                             struct netlink_ext_ack *extack)
1377 {
1378         struct ip_tunnel *t = netdev_priv(dev);
1379         struct ip_tunnel_encap ipencap;
1380         __u32 fwmark = t->fwmark;
1381         struct ip_tunnel_parm p;
1382         int err;
1383
1384         if (ipgre_netlink_encap_parms(data, &ipencap)) {
1385                 err = ip_tunnel_encap_setup(t, &ipencap);
1386
1387                 if (err < 0)
1388                         return err;
1389         }
1390
1391         err = ipgre_netlink_parms(dev, data, tb, &p, &fwmark);
1392         if (err < 0)
1393                 return err;
1394
1395         err = ip_tunnel_changelink(dev, tb, &p, fwmark);
1396         if (err < 0)
1397                 return err;
1398
1399         t->parms.i_flags = p.i_flags;
1400         t->parms.o_flags = p.o_flags;
1401
1402         if (strcmp(dev->rtnl_link_ops->kind, "erspan"))
1403                 ipgre_link_update(dev, !tb[IFLA_MTU]);
1404
1405         return 0;
1406 }
1407
1408 static size_t ipgre_get_size(const struct net_device *dev)
1409 {
1410         return
1411                 /* IFLA_GRE_LINK */
1412                 nla_total_size(4) +
1413                 /* IFLA_GRE_IFLAGS */
1414                 nla_total_size(2) +
1415                 /* IFLA_GRE_OFLAGS */
1416                 nla_total_size(2) +
1417                 /* IFLA_GRE_IKEY */
1418                 nla_total_size(4) +
1419                 /* IFLA_GRE_OKEY */
1420                 nla_total_size(4) +
1421                 /* IFLA_GRE_LOCAL */
1422                 nla_total_size(4) +
1423                 /* IFLA_GRE_REMOTE */
1424                 nla_total_size(4) +
1425                 /* IFLA_GRE_TTL */
1426                 nla_total_size(1) +
1427                 /* IFLA_GRE_TOS */
1428                 nla_total_size(1) +
1429                 /* IFLA_GRE_PMTUDISC */
1430                 nla_total_size(1) +
1431                 /* IFLA_GRE_ENCAP_TYPE */
1432                 nla_total_size(2) +
1433                 /* IFLA_GRE_ENCAP_FLAGS */
1434                 nla_total_size(2) +
1435                 /* IFLA_GRE_ENCAP_SPORT */
1436                 nla_total_size(2) +
1437                 /* IFLA_GRE_ENCAP_DPORT */
1438                 nla_total_size(2) +
1439                 /* IFLA_GRE_COLLECT_METADATA */
1440                 nla_total_size(0) +
1441                 /* IFLA_GRE_IGNORE_DF */
1442                 nla_total_size(1) +
1443                 /* IFLA_GRE_FWMARK */
1444                 nla_total_size(4) +
1445                 /* IFLA_GRE_ERSPAN_INDEX */
1446                 nla_total_size(4) +
1447                 /* IFLA_GRE_ERSPAN_VER */
1448                 nla_total_size(1) +
1449                 /* IFLA_GRE_ERSPAN_DIR */
1450                 nla_total_size(1) +
1451                 /* IFLA_GRE_ERSPAN_HWID */
1452                 nla_total_size(2) +
1453                 0;
1454 }
1455
1456 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
1457 {
1458         struct ip_tunnel *t = netdev_priv(dev);
1459         struct ip_tunnel_parm *p = &t->parms;
1460
1461         if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
1462             nla_put_be16(skb, IFLA_GRE_IFLAGS,
1463                          gre_tnl_flags_to_gre_flags(p->i_flags)) ||
1464             nla_put_be16(skb, IFLA_GRE_OFLAGS,
1465                          gre_tnl_flags_to_gre_flags(p->o_flags)) ||
1466             nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
1467             nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
1468             nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
1469             nla_put_in_addr(skb, IFLA_GRE_REMOTE, p->iph.daddr) ||
1470             nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) ||
1471             nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) ||
1472             nla_put_u8(skb, IFLA_GRE_PMTUDISC,
1473                        !!(p->iph.frag_off & htons(IP_DF))) ||
1474             nla_put_u32(skb, IFLA_GRE_FWMARK, t->fwmark))
1475                 goto nla_put_failure;
1476
1477         if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
1478                         t->encap.type) ||
1479             nla_put_be16(skb, IFLA_GRE_ENCAP_SPORT,
1480                          t->encap.sport) ||
1481             nla_put_be16(skb, IFLA_GRE_ENCAP_DPORT,
1482                          t->encap.dport) ||
1483             nla_put_u16(skb, IFLA_GRE_ENCAP_FLAGS,
1484                         t->encap.flags))
1485                 goto nla_put_failure;
1486
1487         if (nla_put_u8(skb, IFLA_GRE_IGNORE_DF, t->ignore_df))
1488                 goto nla_put_failure;
1489
1490         if (t->collect_md) {
1491                 if (nla_put_flag(skb, IFLA_GRE_COLLECT_METADATA))
1492                         goto nla_put_failure;
1493         }
1494
1495         if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, t->erspan_ver))
1496                 goto nla_put_failure;
1497
1498         if (t->erspan_ver == 1) {
1499                 if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, t->index))
1500                         goto nla_put_failure;
1501         } else if (t->erspan_ver == 2) {
1502                 if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, t->dir))
1503                         goto nla_put_failure;
1504                 if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, t->hwid))
1505                         goto nla_put_failure;
1506         }
1507
1508         return 0;
1509
1510 nla_put_failure:
1511         return -EMSGSIZE;
1512 }
1513
1514 static void erspan_setup(struct net_device *dev)
1515 {
1516         struct ip_tunnel *t = netdev_priv(dev);
1517
1518         ether_setup(dev);
1519         dev->netdev_ops = &erspan_netdev_ops;
1520         dev->priv_flags &= ~IFF_TX_SKB_SHARING;
1521         dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
1522         ip_tunnel_setup(dev, erspan_net_id);
1523         t->erspan_ver = 1;
1524 }
1525
1526 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
1527         [IFLA_GRE_LINK]         = { .type = NLA_U32 },
1528         [IFLA_GRE_IFLAGS]       = { .type = NLA_U16 },
1529         [IFLA_GRE_OFLAGS]       = { .type = NLA_U16 },
1530         [IFLA_GRE_IKEY]         = { .type = NLA_U32 },
1531         [IFLA_GRE_OKEY]         = { .type = NLA_U32 },
1532         [IFLA_GRE_LOCAL]        = { .len = FIELD_SIZEOF(struct iphdr, saddr) },
1533         [IFLA_GRE_REMOTE]       = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
1534         [IFLA_GRE_TTL]          = { .type = NLA_U8 },
1535         [IFLA_GRE_TOS]          = { .type = NLA_U8 },
1536         [IFLA_GRE_PMTUDISC]     = { .type = NLA_U8 },
1537         [IFLA_GRE_ENCAP_TYPE]   = { .type = NLA_U16 },
1538         [IFLA_GRE_ENCAP_FLAGS]  = { .type = NLA_U16 },
1539         [IFLA_GRE_ENCAP_SPORT]  = { .type = NLA_U16 },
1540         [IFLA_GRE_ENCAP_DPORT]  = { .type = NLA_U16 },
1541         [IFLA_GRE_COLLECT_METADATA]     = { .type = NLA_FLAG },
1542         [IFLA_GRE_IGNORE_DF]    = { .type = NLA_U8 },
1543         [IFLA_GRE_FWMARK]       = { .type = NLA_U32 },
1544         [IFLA_GRE_ERSPAN_INDEX] = { .type = NLA_U32 },
1545         [IFLA_GRE_ERSPAN_VER]   = { .type = NLA_U8 },
1546         [IFLA_GRE_ERSPAN_DIR]   = { .type = NLA_U8 },
1547         [IFLA_GRE_ERSPAN_HWID]  = { .type = NLA_U16 },
1548 };
1549
1550 static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
1551         .kind           = "gre",
1552         .maxtype        = IFLA_GRE_MAX,
1553         .policy         = ipgre_policy,
1554         .priv_size      = sizeof(struct ip_tunnel),
1555         .setup          = ipgre_tunnel_setup,
1556         .validate       = ipgre_tunnel_validate,
1557         .newlink        = ipgre_newlink,
1558         .changelink     = ipgre_changelink,
1559         .dellink        = ip_tunnel_dellink,
1560         .get_size       = ipgre_get_size,
1561         .fill_info      = ipgre_fill_info,
1562         .get_link_net   = ip_tunnel_get_link_net,
1563 };
1564
1565 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = {
1566         .kind           = "gretap",
1567         .maxtype        = IFLA_GRE_MAX,
1568         .policy         = ipgre_policy,
1569         .priv_size      = sizeof(struct ip_tunnel),
1570         .setup          = ipgre_tap_setup,
1571         .validate       = ipgre_tap_validate,
1572         .newlink        = ipgre_newlink,
1573         .changelink     = ipgre_changelink,
1574         .dellink        = ip_tunnel_dellink,
1575         .get_size       = ipgre_get_size,
1576         .fill_info      = ipgre_fill_info,
1577         .get_link_net   = ip_tunnel_get_link_net,
1578 };
1579
1580 static struct rtnl_link_ops erspan_link_ops __read_mostly = {
1581         .kind           = "erspan",
1582         .maxtype        = IFLA_GRE_MAX,
1583         .policy         = ipgre_policy,
1584         .priv_size      = sizeof(struct ip_tunnel),
1585         .setup          = erspan_setup,
1586         .validate       = erspan_validate,
1587         .newlink        = ipgre_newlink,
1588         .changelink     = ipgre_changelink,
1589         .dellink        = ip_tunnel_dellink,
1590         .get_size       = ipgre_get_size,
1591         .fill_info      = ipgre_fill_info,
1592         .get_link_net   = ip_tunnel_get_link_net,
1593 };
1594
1595 struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
1596                                         u8 name_assign_type)
1597 {
1598         struct nlattr *tb[IFLA_MAX + 1];
1599         struct net_device *dev;
1600         LIST_HEAD(list_kill);
1601         struct ip_tunnel *t;
1602         int err;
1603
1604         memset(&tb, 0, sizeof(tb));
1605
1606         dev = rtnl_create_link(net, name, name_assign_type,
1607                                &ipgre_tap_ops, tb);
1608         if (IS_ERR(dev))
1609                 return dev;
1610
1611         /* Configure flow based GRE device. */
1612         t = netdev_priv(dev);
1613         t->collect_md = true;
1614
1615         err = ipgre_newlink(net, dev, tb, NULL, NULL);
1616         if (err < 0) {
1617                 free_netdev(dev);
1618                 return ERR_PTR(err);
1619         }
1620
1621         /* openvswitch users expect packet sizes to be unrestricted,
1622          * so set the largest MTU we can.
1623          */
1624         err = __ip_tunnel_change_mtu(dev, IP_MAX_MTU, false);
1625         if (err)
1626                 goto out;
1627
1628         err = rtnl_configure_link(dev, NULL);
1629         if (err < 0)
1630                 goto out;
1631
1632         return dev;
1633 out:
1634         ip_tunnel_dellink(dev, &list_kill);
1635         unregister_netdevice_many(&list_kill);
1636         return ERR_PTR(err);
1637 }
1638 EXPORT_SYMBOL_GPL(gretap_fb_dev_create);
1639
1640 static int __net_init ipgre_tap_init_net(struct net *net)
1641 {
1642         return ip_tunnel_init_net(net, gre_tap_net_id, &ipgre_tap_ops, "gretap0");
1643 }
1644
1645 static void __net_exit ipgre_tap_exit_batch_net(struct list_head *list_net)
1646 {
1647         ip_tunnel_delete_nets(list_net, gre_tap_net_id, &ipgre_tap_ops);
1648 }
1649
1650 static struct pernet_operations ipgre_tap_net_ops = {
1651         .init = ipgre_tap_init_net,
1652         .exit_batch = ipgre_tap_exit_batch_net,
1653         .id   = &gre_tap_net_id,
1654         .size = sizeof(struct ip_tunnel_net),
1655 };
1656
1657 static int __net_init erspan_init_net(struct net *net)
1658 {
1659         return ip_tunnel_init_net(net, erspan_net_id,
1660                                   &erspan_link_ops, "erspan0");
1661 }
1662
1663 static void __net_exit erspan_exit_batch_net(struct list_head *net_list)
1664 {
1665         ip_tunnel_delete_nets(net_list, erspan_net_id, &erspan_link_ops);
1666 }
1667
1668 static struct pernet_operations erspan_net_ops = {
1669         .init = erspan_init_net,
1670         .exit_batch = erspan_exit_batch_net,
1671         .id   = &erspan_net_id,
1672         .size = sizeof(struct ip_tunnel_net),
1673 };
1674
1675 static int __init ipgre_init(void)
1676 {
1677         int err;
1678
1679         pr_info("GRE over IPv4 tunneling driver\n");
1680
1681         err = register_pernet_device(&ipgre_net_ops);
1682         if (err < 0)
1683                 return err;
1684
1685         err = register_pernet_device(&ipgre_tap_net_ops);
1686         if (err < 0)
1687                 goto pnet_tap_failed;
1688
1689         err = register_pernet_device(&erspan_net_ops);
1690         if (err < 0)
1691                 goto pnet_erspan_failed;
1692
1693         err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
1694         if (err < 0) {
1695                 pr_info("%s: can't add protocol\n", __func__);
1696                 goto add_proto_failed;
1697         }
1698
1699         err = rtnl_link_register(&ipgre_link_ops);
1700         if (err < 0)
1701                 goto rtnl_link_failed;
1702
1703         err = rtnl_link_register(&ipgre_tap_ops);
1704         if (err < 0)
1705                 goto tap_ops_failed;
1706
1707         err = rtnl_link_register(&erspan_link_ops);
1708         if (err < 0)
1709                 goto erspan_link_failed;
1710
1711         return 0;
1712
1713 erspan_link_failed:
1714         rtnl_link_unregister(&ipgre_tap_ops);
1715 tap_ops_failed:
1716         rtnl_link_unregister(&ipgre_link_ops);
1717 rtnl_link_failed:
1718         gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
1719 add_proto_failed:
1720         unregister_pernet_device(&erspan_net_ops);
1721 pnet_erspan_failed:
1722         unregister_pernet_device(&ipgre_tap_net_ops);
1723 pnet_tap_failed:
1724         unregister_pernet_device(&ipgre_net_ops);
1725         return err;
1726 }
1727
1728 static void __exit ipgre_fini(void)
1729 {
1730         rtnl_link_unregister(&ipgre_tap_ops);
1731         rtnl_link_unregister(&ipgre_link_ops);
1732         rtnl_link_unregister(&erspan_link_ops);
1733         gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
1734         unregister_pernet_device(&ipgre_tap_net_ops);
1735         unregister_pernet_device(&ipgre_net_ops);
1736         unregister_pernet_device(&erspan_net_ops);
1737 }
1738
1739 module_init(ipgre_init);
1740 module_exit(ipgre_fini);
1741 MODULE_LICENSE("GPL");
1742 MODULE_ALIAS_RTNL_LINK("gre");
1743 MODULE_ALIAS_RTNL_LINK("gretap");
1744 MODULE_ALIAS_RTNL_LINK("erspan");
1745 MODULE_ALIAS_NETDEV("gre0");
1746 MODULE_ALIAS_NETDEV("gretap0");
1747 MODULE_ALIAS_NETDEV("erspan0");