Linux Audio

Check our new training course

Loading...
v4.17
 
   1/*
   2 *	IPv6 over IPv4 tunnel device - Simple Internet Transition (SIT)
   3 *	Linux INET6 implementation
   4 *
   5 *	Authors:
   6 *	Pedro Roque		<roque@di.fc.ul.pt>
   7 *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
   8 *
   9 *	This program is free software; you can redistribute it and/or
  10 *      modify it under the terms of the GNU General Public License
  11 *      as published by the Free Software Foundation; either version
  12 *      2 of the License, or (at your option) any later version.
  13 *
  14 *	Changes:
  15 * Roger Venning <r.venning@telstra.com>:	6to4 support
  16 * Nate Thompson <nate@thebog.net>:		6to4 support
  17 * Fred Templin <fred.l.templin@boeing.com>:	isatap support
  18 */
  19
  20#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  21
  22#include <linux/module.h>
  23#include <linux/capability.h>
  24#include <linux/errno.h>
  25#include <linux/types.h>
  26#include <linux/socket.h>
  27#include <linux/sockios.h>
  28#include <linux/net.h>
  29#include <linux/in6.h>
  30#include <linux/netdevice.h>
  31#include <linux/if_arp.h>
  32#include <linux/icmp.h>
  33#include <linux/slab.h>
  34#include <linux/uaccess.h>
  35#include <linux/init.h>
  36#include <linux/netfilter_ipv4.h>
  37#include <linux/if_ether.h>
  38
  39#include <net/sock.h>
  40#include <net/snmp.h>
  41
  42#include <net/ipv6.h>
  43#include <net/protocol.h>
  44#include <net/transp_v6.h>
  45#include <net/ip6_fib.h>
  46#include <net/ip6_route.h>
  47#include <net/ndisc.h>
  48#include <net/addrconf.h>
  49#include <net/ip.h>
  50#include <net/udp.h>
  51#include <net/icmp.h>
  52#include <net/ip_tunnels.h>
  53#include <net/inet_ecn.h>
  54#include <net/xfrm.h>
  55#include <net/dsfield.h>
  56#include <net/net_namespace.h>
  57#include <net/netns/generic.h>
  58
  59/*
  60   This version of net/ipv6/sit.c is cloned of net/ipv4/ip_gre.c
  61
  62   For comments look at net/ipv4/ip_gre.c --ANK
  63 */
  64
  65#define IP6_SIT_HASH_SIZE  16
  66#define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
  67
  68static bool log_ecn_error = true;
  69module_param(log_ecn_error, bool, 0644);
  70MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
  71
  72static int ipip6_tunnel_init(struct net_device *dev);
  73static void ipip6_tunnel_setup(struct net_device *dev);
  74static void ipip6_dev_free(struct net_device *dev);
  75static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
  76		      __be32 *v4dst);
  77static struct rtnl_link_ops sit_link_ops __read_mostly;
  78
  79static unsigned int sit_net_id __read_mostly;
  80struct sit_net {
  81	struct ip_tunnel __rcu *tunnels_r_l[IP6_SIT_HASH_SIZE];
  82	struct ip_tunnel __rcu *tunnels_r[IP6_SIT_HASH_SIZE];
  83	struct ip_tunnel __rcu *tunnels_l[IP6_SIT_HASH_SIZE];
  84	struct ip_tunnel __rcu *tunnels_wc[1];
  85	struct ip_tunnel __rcu **tunnels[4];
  86
  87	struct net_device *fb_tunnel_dev;
  88};
  89
 
 
 
 
 
 
 
  90/*
  91 * Must be invoked with rcu_read_lock
  92 */
  93static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
  94					     struct net_device *dev,
  95					     __be32 remote, __be32 local,
  96					     int sifindex)
  97{
  98	unsigned int h0 = HASH(remote);
  99	unsigned int h1 = HASH(local);
 100	struct ip_tunnel *t;
 101	struct sit_net *sitn = net_generic(net, sit_net_id);
 102	int ifindex = dev ? dev->ifindex : 0;
 103
 104	for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
 105		if (local == t->parms.iph.saddr &&
 106		    remote == t->parms.iph.daddr &&
 107		    (!dev || !t->parms.link || ifindex == t->parms.link ||
 108		     sifindex == t->parms.link) &&
 109		    (t->dev->flags & IFF_UP))
 110			return t;
 111	}
 112	for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
 113		if (remote == t->parms.iph.daddr &&
 114		    (!dev || !t->parms.link || ifindex == t->parms.link ||
 115		     sifindex == t->parms.link) &&
 116		    (t->dev->flags & IFF_UP))
 117			return t;
 118	}
 119	for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
 120		if (local == t->parms.iph.saddr &&
 121		    (!dev || !t->parms.link || ifindex == t->parms.link ||
 122		     sifindex == t->parms.link) &&
 123		    (t->dev->flags & IFF_UP))
 124			return t;
 125	}
 126	t = rcu_dereference(sitn->tunnels_wc[0]);
 127	if (t && (t->dev->flags & IFF_UP))
 128		return t;
 129	return NULL;
 130}
 131
 132static struct ip_tunnel __rcu **__ipip6_bucket(struct sit_net *sitn,
 133		struct ip_tunnel_parm *parms)
 134{
 135	__be32 remote = parms->iph.daddr;
 136	__be32 local = parms->iph.saddr;
 137	unsigned int h = 0;
 138	int prio = 0;
 139
 140	if (remote) {
 141		prio |= 2;
 142		h ^= HASH(remote);
 143	}
 144	if (local) {
 145		prio |= 1;
 146		h ^= HASH(local);
 147	}
 148	return &sitn->tunnels[prio][h];
 149}
 150
 151static inline struct ip_tunnel __rcu **ipip6_bucket(struct sit_net *sitn,
 152		struct ip_tunnel *t)
 153{
 154	return __ipip6_bucket(sitn, &t->parms);
 155}
 156
 157static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 158{
 159	struct ip_tunnel __rcu **tp;
 160	struct ip_tunnel *iter;
 161
 162	for (tp = ipip6_bucket(sitn, t);
 163	     (iter = rtnl_dereference(*tp)) != NULL;
 164	     tp = &iter->next) {
 165		if (t == iter) {
 166			rcu_assign_pointer(*tp, t->next);
 167			break;
 168		}
 169	}
 170}
 171
 172static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 173{
 174	struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
 175
 176	rcu_assign_pointer(t->next, rtnl_dereference(*tp));
 177	rcu_assign_pointer(*tp, t);
 178}
 179
 180static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
 181{
 182#ifdef CONFIG_IPV6_SIT_6RD
 183	struct ip_tunnel *t = netdev_priv(dev);
 184
 185	if (dev == sitn->fb_tunnel_dev || !sitn->fb_tunnel_dev) {
 186		ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
 187		t->ip6rd.relay_prefix = 0;
 188		t->ip6rd.prefixlen = 16;
 189		t->ip6rd.relay_prefixlen = 0;
 190	} else {
 191		struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
 192		memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
 193	}
 194#endif
 195}
 196
 197static int ipip6_tunnel_create(struct net_device *dev)
 198{
 199	struct ip_tunnel *t = netdev_priv(dev);
 200	struct net *net = dev_net(dev);
 201	struct sit_net *sitn = net_generic(net, sit_net_id);
 202	int err;
 203
 204	memcpy(dev->dev_addr, &t->parms.iph.saddr, 4);
 205	memcpy(dev->broadcast, &t->parms.iph.daddr, 4);
 206
 207	if ((__force u16)t->parms.i_flags & SIT_ISATAP)
 208		dev->priv_flags |= IFF_ISATAP;
 209
 210	dev->rtnl_link_ops = &sit_link_ops;
 211
 212	err = register_netdevice(dev);
 213	if (err < 0)
 214		goto out;
 215
 216	ipip6_tunnel_clone_6rd(dev, sitn);
 217
 218	dev_hold(dev);
 219
 220	ipip6_tunnel_link(sitn, t);
 221	return 0;
 222
 223out:
 224	return err;
 225}
 226
 227static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
 228		struct ip_tunnel_parm *parms, int create)
 229{
 230	__be32 remote = parms->iph.daddr;
 231	__be32 local = parms->iph.saddr;
 232	struct ip_tunnel *t, *nt;
 233	struct ip_tunnel __rcu **tp;
 234	struct net_device *dev;
 235	char name[IFNAMSIZ];
 236	struct sit_net *sitn = net_generic(net, sit_net_id);
 237
 238	for (tp = __ipip6_bucket(sitn, parms);
 239	    (t = rtnl_dereference(*tp)) != NULL;
 240	     tp = &t->next) {
 241		if (local == t->parms.iph.saddr &&
 242		    remote == t->parms.iph.daddr &&
 243		    parms->link == t->parms.link) {
 244			if (create)
 245				return NULL;
 246			else
 247				return t;
 248		}
 249	}
 250	if (!create)
 251		goto failed;
 252
 253	if (parms->name[0]) {
 254		if (!dev_valid_name(parms->name))
 255			goto failed;
 256		strlcpy(name, parms->name, IFNAMSIZ);
 257	} else {
 258		strcpy(name, "sit%d");
 259	}
 260	dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
 261			   ipip6_tunnel_setup);
 262	if (!dev)
 263		return NULL;
 264
 265	dev_net_set(dev, net);
 266
 267	nt = netdev_priv(dev);
 268
 269	nt->parms = *parms;
 270	if (ipip6_tunnel_create(dev) < 0)
 271		goto failed_free;
 272
 273	return nt;
 274
 275failed_free:
 276	free_netdev(dev);
 277failed:
 278	return NULL;
 279}
 280
 281#define for_each_prl_rcu(start)			\
 282	for (prl = rcu_dereference(start);	\
 283	     prl;				\
 284	     prl = rcu_dereference(prl->next))
 285
 286static struct ip_tunnel_prl_entry *
 287__ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 288{
 289	struct ip_tunnel_prl_entry *prl;
 290
 291	for_each_prl_rcu(t->prl)
 292		if (prl->addr == addr)
 293			break;
 294	return prl;
 295
 296}
 297
 298static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
 299				struct ip_tunnel_prl __user *a)
 300{
 
 
 301	struct ip_tunnel_prl kprl, *kp;
 302	struct ip_tunnel_prl_entry *prl;
 303	unsigned int cmax, c = 0, ca, len;
 304	int ret = 0;
 305
 
 
 
 306	if (copy_from_user(&kprl, a, sizeof(kprl)))
 307		return -EFAULT;
 308	cmax = kprl.datalen / sizeof(kprl);
 309	if (cmax > 1 && kprl.addr != htonl(INADDR_ANY))
 310		cmax = 1;
 311
 312	/* For simple GET or for root users,
 313	 * we try harder to allocate.
 314	 */
 315	kp = (cmax <= 1 || capable(CAP_NET_ADMIN)) ?
 316		kcalloc(cmax, sizeof(*kp), GFP_KERNEL | __GFP_NOWARN) :
 317		NULL;
 318
 319	rcu_read_lock();
 320
 321	ca = t->prl_count < cmax ? t->prl_count : cmax;
 322
 323	if (!kp) {
 324		/* We don't try hard to allocate much memory for
 325		 * non-root users.
 326		 * For root users, retry allocating enough memory for
 327		 * the answer.
 328		 */
 329		kp = kcalloc(ca, sizeof(*kp), GFP_ATOMIC);
 330		if (!kp) {
 331			ret = -ENOMEM;
 332			goto out;
 333		}
 334	}
 335
 336	c = 0;
 337	for_each_prl_rcu(t->prl) {
 338		if (c >= cmax)
 339			break;
 340		if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
 341			continue;
 342		kp[c].addr = prl->addr;
 343		kp[c].flags = prl->flags;
 344		c++;
 345		if (kprl.addr != htonl(INADDR_ANY))
 346			break;
 347	}
 348out:
 349	rcu_read_unlock();
 350
 351	len = sizeof(*kp) * c;
 352	ret = 0;
 353	if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
 354		ret = -EFAULT;
 355
 356	kfree(kp);
 357
 358	return ret;
 359}
 360
 361static int
 362ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
 363{
 364	struct ip_tunnel_prl_entry *p;
 365	int err = 0;
 366
 367	if (a->addr == htonl(INADDR_ANY))
 368		return -EINVAL;
 369
 370	ASSERT_RTNL();
 371
 372	for (p = rtnl_dereference(t->prl); p; p = rtnl_dereference(p->next)) {
 373		if (p->addr == a->addr) {
 374			if (chg) {
 375				p->flags = a->flags;
 376				goto out;
 377			}
 378			err = -EEXIST;
 379			goto out;
 380		}
 381	}
 382
 383	if (chg) {
 384		err = -ENXIO;
 385		goto out;
 386	}
 387
 388	p = kzalloc(sizeof(struct ip_tunnel_prl_entry), GFP_KERNEL);
 389	if (!p) {
 390		err = -ENOBUFS;
 391		goto out;
 392	}
 393
 394	p->next = t->prl;
 395	p->addr = a->addr;
 396	p->flags = a->flags;
 397	t->prl_count++;
 398	rcu_assign_pointer(t->prl, p);
 399out:
 400	return err;
 401}
 402
 403static void prl_list_destroy_rcu(struct rcu_head *head)
 404{
 405	struct ip_tunnel_prl_entry *p, *n;
 406
 407	p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
 408	do {
 409		n = rcu_dereference_protected(p->next, 1);
 410		kfree(p);
 411		p = n;
 412	} while (p);
 413}
 414
 415static int
 416ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 417{
 418	struct ip_tunnel_prl_entry *x;
 419	struct ip_tunnel_prl_entry __rcu **p;
 420	int err = 0;
 421
 422	ASSERT_RTNL();
 423
 424	if (a && a->addr != htonl(INADDR_ANY)) {
 425		for (p = &t->prl;
 426		     (x = rtnl_dereference(*p)) != NULL;
 427		     p = &x->next) {
 428			if (x->addr == a->addr) {
 429				*p = x->next;
 430				kfree_rcu(x, rcu_head);
 431				t->prl_count--;
 432				goto out;
 433			}
 434		}
 435		err = -ENXIO;
 436	} else {
 437		x = rtnl_dereference(t->prl);
 438		if (x) {
 439			t->prl_count = 0;
 440			call_rcu(&x->rcu_head, prl_list_destroy_rcu);
 441			t->prl = NULL;
 442		}
 443	}
 444out:
 445	return err;
 446}
 447
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 448static int
 449isatap_chksrc(struct sk_buff *skb, const struct iphdr *iph, struct ip_tunnel *t)
 450{
 451	struct ip_tunnel_prl_entry *p;
 452	int ok = 1;
 453
 454	rcu_read_lock();
 455	p = __ipip6_tunnel_locate_prl(t, iph->saddr);
 456	if (p) {
 457		if (p->flags & PRL_DEFAULT)
 458			skb->ndisc_nodetype = NDISC_NODETYPE_DEFAULT;
 459		else
 460			skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT;
 461	} else {
 462		const struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
 463
 464		if (ipv6_addr_is_isatap(addr6) &&
 465		    (addr6->s6_addr32[3] == iph->saddr) &&
 466		    ipv6_chk_prefix(addr6, t->dev))
 467			skb->ndisc_nodetype = NDISC_NODETYPE_HOST;
 468		else
 469			ok = 0;
 470	}
 471	rcu_read_unlock();
 472	return ok;
 473}
 474
 475static void ipip6_tunnel_uninit(struct net_device *dev)
 476{
 477	struct ip_tunnel *tunnel = netdev_priv(dev);
 478	struct sit_net *sitn = net_generic(tunnel->net, sit_net_id);
 479
 480	if (dev == sitn->fb_tunnel_dev) {
 481		RCU_INIT_POINTER(sitn->tunnels_wc[0], NULL);
 482	} else {
 483		ipip6_tunnel_unlink(sitn, tunnel);
 484		ipip6_tunnel_del_prl(tunnel, NULL);
 485	}
 486	dst_cache_reset(&tunnel->dst_cache);
 487	dev_put(dev);
 488}
 489
 490static int ipip6_err(struct sk_buff *skb, u32 info)
 491{
 492	const struct iphdr *iph = (const struct iphdr *)skb->data;
 493	const int type = icmp_hdr(skb)->type;
 494	const int code = icmp_hdr(skb)->code;
 495	unsigned int data_len = 0;
 496	struct ip_tunnel *t;
 497	int sifindex;
 498	int err;
 499
 500	switch (type) {
 501	default:
 502	case ICMP_PARAMETERPROB:
 503		return 0;
 504
 505	case ICMP_DEST_UNREACH:
 506		switch (code) {
 507		case ICMP_SR_FAILED:
 508			/* Impossible event. */
 509			return 0;
 510		default:
 511			/* All others are translated to HOST_UNREACH.
 512			   rfc2003 contains "deep thoughts" about NET_UNREACH,
 513			   I believe they are just ether pollution. --ANK
 514			 */
 515			break;
 516		}
 517		break;
 518	case ICMP_TIME_EXCEEDED:
 519		if (code != ICMP_EXC_TTL)
 520			return 0;
 521		data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */
 522		break;
 523	case ICMP_REDIRECT:
 524		break;
 525	}
 526
 527	err = -ENOENT;
 528
 529	sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
 530	t = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
 531				iph->daddr, iph->saddr, sifindex);
 532	if (!t)
 533		goto out;
 534
 535	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
 536		ipv4_update_pmtu(skb, dev_net(skb->dev), info,
 537				 t->parms.link, 0, iph->protocol, 0);
 538		err = 0;
 539		goto out;
 540	}
 541	if (type == ICMP_REDIRECT) {
 542		ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
 543			      iph->protocol, 0);
 544		err = 0;
 545		goto out;
 546	}
 547
 548	err = 0;
 549	if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
 
 550		goto out;
 551
 552	if (t->parms.iph.daddr == 0)
 553		goto out;
 554
 555	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 556		goto out;
 557
 558	if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
 559		t->err_count++;
 560	else
 561		t->err_count = 1;
 562	t->err_time = jiffies;
 563out:
 564	return err;
 565}
 566
 567static inline bool is_spoofed_6rd(struct ip_tunnel *tunnel, const __be32 v4addr,
 568				  const struct in6_addr *v6addr)
 569{
 570	__be32 v4embed = 0;
 571	if (check_6rd(tunnel, v6addr, &v4embed) && v4addr != v4embed)
 572		return true;
 573	return false;
 574}
 575
 576/* Checks if an address matches an address on the tunnel interface.
 577 * Used to detect the NAT of proto 41 packets and let them pass spoofing test.
 578 * Long story:
 579 * This function is called after we considered the packet as spoofed
 580 * in is_spoofed_6rd.
 581 * We may have a router that is doing NAT for proto 41 packets
 582 * for an internal station. Destination a.a.a.a/PREFIX:bbbb:bbbb
 583 * will be translated to n.n.n.n/PREFIX:bbbb:bbbb. And is_spoofed_6rd
 584 * function will return true, dropping the packet.
 585 * But, we can still check if is spoofed against the IP
 586 * addresses associated with the interface.
 587 */
 588static bool only_dnatted(const struct ip_tunnel *tunnel,
 589	const struct in6_addr *v6dst)
 590{
 591	int prefix_len;
 592
 593#ifdef CONFIG_IPV6_SIT_6RD
 594	prefix_len = tunnel->ip6rd.prefixlen + 32
 595		- tunnel->ip6rd.relay_prefixlen;
 596#else
 597	prefix_len = 48;
 598#endif
 599	return ipv6_chk_custom_prefix(v6dst, prefix_len, tunnel->dev);
 600}
 601
 602/* Returns true if a packet is spoofed */
 603static bool packet_is_spoofed(struct sk_buff *skb,
 604			      const struct iphdr *iph,
 605			      struct ip_tunnel *tunnel)
 606{
 607	const struct ipv6hdr *ipv6h;
 608
 609	if (tunnel->dev->priv_flags & IFF_ISATAP) {
 610		if (!isatap_chksrc(skb, iph, tunnel))
 611			return true;
 612
 613		return false;
 614	}
 615
 616	if (tunnel->dev->flags & IFF_POINTOPOINT)
 617		return false;
 618
 619	ipv6h = ipv6_hdr(skb);
 620
 621	if (unlikely(is_spoofed_6rd(tunnel, iph->saddr, &ipv6h->saddr))) {
 622		net_warn_ratelimited("Src spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
 623				     &iph->saddr, &ipv6h->saddr,
 624				     &iph->daddr, &ipv6h->daddr);
 625		return true;
 626	}
 627
 628	if (likely(!is_spoofed_6rd(tunnel, iph->daddr, &ipv6h->daddr)))
 629		return false;
 630
 631	if (only_dnatted(tunnel, &ipv6h->daddr))
 632		return false;
 633
 634	net_warn_ratelimited("Dst spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
 635			     &iph->saddr, &ipv6h->saddr,
 636			     &iph->daddr, &ipv6h->daddr);
 637	return true;
 638}
 639
 640static int ipip6_rcv(struct sk_buff *skb)
 641{
 642	const struct iphdr *iph = ip_hdr(skb);
 643	struct ip_tunnel *tunnel;
 644	int sifindex;
 645	int err;
 646
 647	sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
 648	tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
 649				     iph->saddr, iph->daddr, sifindex);
 650	if (tunnel) {
 651		struct pcpu_sw_netstats *tstats;
 652
 653		if (tunnel->parms.iph.protocol != IPPROTO_IPV6 &&
 654		    tunnel->parms.iph.protocol != 0)
 655			goto out;
 656
 657		skb->mac_header = skb->network_header;
 658		skb_reset_network_header(skb);
 659		IPCB(skb)->flags = 0;
 660		skb->dev = tunnel->dev;
 661
 662		if (packet_is_spoofed(skb, iph, tunnel)) {
 663			tunnel->dev->stats.rx_errors++;
 664			goto out;
 665		}
 666
 667		if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6),
 668		    !net_eq(tunnel->net, dev_net(tunnel->dev))))
 669			goto out;
 670
 
 
 
 
 671		err = IP_ECN_decapsulate(iph, skb);
 672		if (unlikely(err)) {
 673			if (log_ecn_error)
 674				net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
 675						     &iph->saddr, iph->tos);
 676			if (err > 1) {
 677				++tunnel->dev->stats.rx_frame_errors;
 678				++tunnel->dev->stats.rx_errors;
 679				goto out;
 680			}
 681		}
 682
 683		tstats = this_cpu_ptr(tunnel->dev->tstats);
 684		u64_stats_update_begin(&tstats->syncp);
 685		tstats->rx_packets++;
 686		tstats->rx_bytes += skb->len;
 687		u64_stats_update_end(&tstats->syncp);
 688
 689		netif_rx(skb);
 690
 691		return 0;
 692	}
 693
 694	/* no tunnel matched,  let upstream know, ipsec may handle it */
 695	return 1;
 696out:
 697	kfree_skb(skb);
 698	return 0;
 699}
 700
 701static const struct tnl_ptk_info ipip_tpi = {
 702	/* no tunnel info required for ipip. */
 703	.proto = htons(ETH_P_IP),
 704};
 705
 706#if IS_ENABLED(CONFIG_MPLS)
 707static const struct tnl_ptk_info mplsip_tpi = {
 708	/* no tunnel info required for mplsip. */
 709	.proto = htons(ETH_P_MPLS_UC),
 710};
 711#endif
 712
 713static int sit_tunnel_rcv(struct sk_buff *skb, u8 ipproto)
 714{
 715	const struct iphdr *iph;
 716	struct ip_tunnel *tunnel;
 717	int sifindex;
 718
 719	sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
 720
 721	iph = ip_hdr(skb);
 722	tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
 723				     iph->saddr, iph->daddr, sifindex);
 724	if (tunnel) {
 725		const struct tnl_ptk_info *tpi;
 726
 727		if (tunnel->parms.iph.protocol != ipproto &&
 728		    tunnel->parms.iph.protocol != 0)
 729			goto drop;
 730
 731		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
 732			goto drop;
 733#if IS_ENABLED(CONFIG_MPLS)
 734		if (ipproto == IPPROTO_MPLS)
 735			tpi = &mplsip_tpi;
 736		else
 737#endif
 738			tpi = &ipip_tpi;
 739		if (iptunnel_pull_header(skb, 0, tpi->proto, false))
 740			goto drop;
 741		return ip_tunnel_rcv(tunnel, skb, tpi, NULL, log_ecn_error);
 742	}
 743
 744	return 1;
 745
 746drop:
 747	kfree_skb(skb);
 748	return 0;
 749}
 750
 751static int ipip_rcv(struct sk_buff *skb)
 752{
 753	return sit_tunnel_rcv(skb, IPPROTO_IPIP);
 754}
 755
 756#if IS_ENABLED(CONFIG_MPLS)
 757static int mplsip_rcv(struct sk_buff *skb)
 758{
 759	return sit_tunnel_rcv(skb, IPPROTO_MPLS);
 760}
 761#endif
 762
 763/*
 764 * If the IPv6 address comes from 6rd / 6to4 (RFC 3056) addr space this function
 765 * stores the embedded IPv4 address in v4dst and returns true.
 766 */
 767static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
 768		      __be32 *v4dst)
 769{
 770#ifdef CONFIG_IPV6_SIT_6RD
 771	if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
 772			      tunnel->ip6rd.prefixlen)) {
 773		unsigned int pbw0, pbi0;
 774		int pbi1;
 775		u32 d;
 776
 777		pbw0 = tunnel->ip6rd.prefixlen >> 5;
 778		pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
 779
 780		d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
 781		    tunnel->ip6rd.relay_prefixlen;
 
 782
 783		pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
 784		if (pbi1 > 0)
 785			d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
 786			     (32 - pbi1);
 787
 788		*v4dst = tunnel->ip6rd.relay_prefix | htonl(d);
 789		return true;
 790	}
 791#else
 792	if (v6dst->s6_addr16[0] == htons(0x2002)) {
 793		/* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
 794		memcpy(v4dst, &v6dst->s6_addr16[1], 4);
 795		return true;
 796	}
 797#endif
 798	return false;
 799}
 800
 801static inline __be32 try_6rd(struct ip_tunnel *tunnel,
 802			     const struct in6_addr *v6dst)
 803{
 804	__be32 dst = 0;
 805	check_6rd(tunnel, v6dst, &dst);
 806	return dst;
 807}
 808
 809/*
 810 *	This function assumes it is being called from dev_queue_xmit()
 811 *	and that skb is filled properly by that function.
 812 */
 813
 814static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 815				     struct net_device *dev)
 816{
 817	struct ip_tunnel *tunnel = netdev_priv(dev);
 818	const struct iphdr  *tiph = &tunnel->parms.iph;
 819	const struct ipv6hdr *iph6 = ipv6_hdr(skb);
 820	u8     tos = tunnel->parms.iph.tos;
 821	__be16 df = tiph->frag_off;
 822	struct rtable *rt;		/* Route to the other host */
 823	struct net_device *tdev;	/* Device to other host */
 824	unsigned int max_headroom;	/* The extra header space needed */
 825	__be32 dst = tiph->daddr;
 826	struct flowi4 fl4;
 827	int    mtu;
 828	const struct in6_addr *addr6;
 829	int addr_type;
 830	u8 ttl;
 831	u8 protocol = IPPROTO_IPV6;
 832	int t_hlen = tunnel->hlen + sizeof(struct iphdr);
 833
 834	if (tos == 1)
 835		tos = ipv6_get_dsfield(iph6);
 836
 837	/* ISATAP (RFC4214) - must come before 6to4 */
 838	if (dev->priv_flags & IFF_ISATAP) {
 839		struct neighbour *neigh = NULL;
 840		bool do_tx_error = false;
 841
 842		if (skb_dst(skb))
 843			neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 844
 845		if (!neigh) {
 846			net_dbg_ratelimited("nexthop == NULL\n");
 847			goto tx_error;
 848		}
 849
 850		addr6 = (const struct in6_addr *)&neigh->primary_key;
 851		addr_type = ipv6_addr_type(addr6);
 852
 853		if ((addr_type & IPV6_ADDR_UNICAST) &&
 854		     ipv6_addr_is_isatap(addr6))
 855			dst = addr6->s6_addr32[3];
 856		else
 857			do_tx_error = true;
 858
 859		neigh_release(neigh);
 860		if (do_tx_error)
 861			goto tx_error;
 862	}
 863
 864	if (!dst)
 865		dst = try_6rd(tunnel, &iph6->daddr);
 866
 867	if (!dst) {
 868		struct neighbour *neigh = NULL;
 869		bool do_tx_error = false;
 870
 871		if (skb_dst(skb))
 872			neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 873
 874		if (!neigh) {
 875			net_dbg_ratelimited("nexthop == NULL\n");
 876			goto tx_error;
 877		}
 878
 879		addr6 = (const struct in6_addr *)&neigh->primary_key;
 880		addr_type = ipv6_addr_type(addr6);
 881
 882		if (addr_type == IPV6_ADDR_ANY) {
 883			addr6 = &ipv6_hdr(skb)->daddr;
 884			addr_type = ipv6_addr_type(addr6);
 885		}
 886
 887		if ((addr_type & IPV6_ADDR_COMPATv4) != 0)
 888			dst = addr6->s6_addr32[3];
 889		else
 890			do_tx_error = true;
 891
 892		neigh_release(neigh);
 893		if (do_tx_error)
 894			goto tx_error;
 895	}
 896
 897	flowi4_init_output(&fl4, tunnel->parms.link, tunnel->fwmark,
 898			   RT_TOS(tos), RT_SCOPE_UNIVERSE, IPPROTO_IPV6,
 899			   0, dst, tiph->saddr, 0, 0,
 900			   sock_net_uid(tunnel->net, NULL));
 901	rt = ip_route_output_flow(tunnel->net, &fl4, NULL);
 902
 903	if (IS_ERR(rt)) {
 904		dev->stats.tx_carrier_errors++;
 905		goto tx_error_icmp;
 
 
 
 
 
 906	}
 
 907	if (rt->rt_type != RTN_UNICAST) {
 908		ip_rt_put(rt);
 909		dev->stats.tx_carrier_errors++;
 910		goto tx_error_icmp;
 911	}
 912	tdev = rt->dst.dev;
 913
 914	if (tdev == dev) {
 915		ip_rt_put(rt);
 916		dev->stats.collisions++;
 917		goto tx_error;
 918	}
 919
 920	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4)) {
 921		ip_rt_put(rt);
 922		goto tx_error;
 923	}
 924
 925	if (df) {
 926		mtu = dst_mtu(&rt->dst) - t_hlen;
 927
 928		if (mtu < 68) {
 929			dev->stats.collisions++;
 930			ip_rt_put(rt);
 931			goto tx_error;
 932		}
 933
 934		if (mtu < IPV6_MIN_MTU) {
 935			mtu = IPV6_MIN_MTU;
 936			df = 0;
 937		}
 938
 939		if (tunnel->parms.iph.daddr)
 940			skb_dst_update_pmtu(skb, mtu);
 941
 942		if (skb->len > mtu && !skb_is_gso(skb)) {
 943			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 944			ip_rt_put(rt);
 945			goto tx_error;
 946		}
 947	}
 948
 949	if (tunnel->err_count > 0) {
 950		if (time_before(jiffies,
 951				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
 952			tunnel->err_count--;
 953			dst_link_failure(skb);
 954		} else
 955			tunnel->err_count = 0;
 956	}
 957
 958	/*
 959	 * Okay, now see if we can stuff it in the buffer as-is.
 960	 */
 961	max_headroom = LL_RESERVED_SPACE(tdev) + t_hlen;
 962
 963	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
 964	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
 965		struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
 966		if (!new_skb) {
 967			ip_rt_put(rt);
 968			dev->stats.tx_dropped++;
 969			kfree_skb(skb);
 970			return NETDEV_TX_OK;
 971		}
 972		if (skb->sk)
 973			skb_set_owner_w(new_skb, skb->sk);
 974		dev_kfree_skb(skb);
 975		skb = new_skb;
 976		iph6 = ipv6_hdr(skb);
 977	}
 978	ttl = tiph->ttl;
 979	if (ttl == 0)
 980		ttl = iph6->hop_limit;
 981	tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
 982
 983	if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0) {
 984		ip_rt_put(rt);
 985		goto tx_error;
 986	}
 987
 988	skb_set_inner_ipproto(skb, IPPROTO_IPV6);
 989
 990	iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl,
 991		      df, !net_eq(tunnel->net, dev_net(dev)));
 992	return NETDEV_TX_OK;
 993
 994tx_error_icmp:
 995	dst_link_failure(skb);
 996tx_error:
 997	kfree_skb(skb);
 998	dev->stats.tx_errors++;
 999	return NETDEV_TX_OK;
1000}
1001
1002static netdev_tx_t sit_tunnel_xmit__(struct sk_buff *skb,
1003				     struct net_device *dev, u8 ipproto)
1004{
1005	struct ip_tunnel *tunnel = netdev_priv(dev);
1006	const struct iphdr  *tiph = &tunnel->parms.iph;
1007
1008	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4))
1009		goto tx_error;
1010
1011	skb_set_inner_ipproto(skb, ipproto);
1012
1013	ip_tunnel_xmit(skb, dev, tiph, ipproto);
1014	return NETDEV_TX_OK;
1015tx_error:
1016	kfree_skb(skb);
1017	dev->stats.tx_errors++;
1018	return NETDEV_TX_OK;
1019}
1020
1021static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
1022				   struct net_device *dev)
1023{
 
 
 
1024	switch (skb->protocol) {
1025	case htons(ETH_P_IP):
1026		sit_tunnel_xmit__(skb, dev, IPPROTO_IPIP);
1027		break;
1028	case htons(ETH_P_IPV6):
1029		ipip6_tunnel_xmit(skb, dev);
1030		break;
1031#if IS_ENABLED(CONFIG_MPLS)
1032	case htons(ETH_P_MPLS_UC):
1033		sit_tunnel_xmit__(skb, dev, IPPROTO_MPLS);
1034		break;
1035#endif
1036	default:
1037		goto tx_err;
1038	}
1039
1040	return NETDEV_TX_OK;
1041
1042tx_err:
1043	dev->stats.tx_errors++;
1044	kfree_skb(skb);
1045	return NETDEV_TX_OK;
1046
1047}
1048
1049static void ipip6_tunnel_bind_dev(struct net_device *dev)
1050{
1051	struct net_device *tdev = NULL;
1052	struct ip_tunnel *tunnel;
1053	const struct iphdr *iph;
1054	struct flowi4 fl4;
1055
1056	tunnel = netdev_priv(dev);
1057	iph = &tunnel->parms.iph;
1058
1059	if (iph->daddr) {
1060		struct rtable *rt = ip_route_output_ports(tunnel->net, &fl4,
1061							  NULL,
1062							  iph->daddr, iph->saddr,
1063							  0, 0,
1064							  IPPROTO_IPV6,
1065							  RT_TOS(iph->tos),
1066							  tunnel->parms.link);
1067
1068		if (!IS_ERR(rt)) {
1069			tdev = rt->dst.dev;
1070			ip_rt_put(rt);
1071		}
1072		dev->flags |= IFF_POINTOPOINT;
1073	}
1074
1075	if (!tdev && tunnel->parms.link)
1076		tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
1077
1078	if (tdev) {
1079		int t_hlen = tunnel->hlen + sizeof(struct iphdr);
1080
1081		dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
1082		dev->mtu = tdev->mtu - t_hlen;
1083		if (dev->mtu < IPV6_MIN_MTU)
1084			dev->mtu = IPV6_MIN_MTU;
1085	}
1086}
1087
1088static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p,
1089				__u32 fwmark)
1090{
1091	struct net *net = t->net;
1092	struct sit_net *sitn = net_generic(net, sit_net_id);
1093
1094	ipip6_tunnel_unlink(sitn, t);
1095	synchronize_net();
1096	t->parms.iph.saddr = p->iph.saddr;
1097	t->parms.iph.daddr = p->iph.daddr;
1098	memcpy(t->dev->dev_addr, &p->iph.saddr, 4);
1099	memcpy(t->dev->broadcast, &p->iph.daddr, 4);
1100	ipip6_tunnel_link(sitn, t);
1101	t->parms.iph.ttl = p->iph.ttl;
1102	t->parms.iph.tos = p->iph.tos;
1103	t->parms.iph.frag_off = p->iph.frag_off;
1104	if (t->parms.link != p->link || t->fwmark != fwmark) {
1105		t->parms.link = p->link;
1106		t->fwmark = fwmark;
1107		ipip6_tunnel_bind_dev(t->dev);
1108	}
1109	dst_cache_reset(&t->dst_cache);
1110	netdev_state_change(t->dev);
1111}
1112
1113#ifdef CONFIG_IPV6_SIT_6RD
1114static int ipip6_tunnel_update_6rd(struct ip_tunnel *t,
1115				   struct ip_tunnel_6rd *ip6rd)
1116{
1117	struct in6_addr prefix;
1118	__be32 relay_prefix;
1119
1120	if (ip6rd->relay_prefixlen > 32 ||
1121	    ip6rd->prefixlen + (32 - ip6rd->relay_prefixlen) > 64)
1122		return -EINVAL;
1123
1124	ipv6_addr_prefix(&prefix, &ip6rd->prefix, ip6rd->prefixlen);
1125	if (!ipv6_addr_equal(&prefix, &ip6rd->prefix))
1126		return -EINVAL;
1127	if (ip6rd->relay_prefixlen)
1128		relay_prefix = ip6rd->relay_prefix &
1129			       htonl(0xffffffffUL <<
1130				     (32 - ip6rd->relay_prefixlen));
1131	else
1132		relay_prefix = 0;
1133	if (relay_prefix != ip6rd->relay_prefix)
1134		return -EINVAL;
1135
1136	t->ip6rd.prefix = prefix;
1137	t->ip6rd.relay_prefix = relay_prefix;
1138	t->ip6rd.prefixlen = ip6rd->prefixlen;
1139	t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;
1140	dst_cache_reset(&t->dst_cache);
1141	netdev_state_change(t->dev);
1142	return 0;
1143}
1144#endif
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1145
1146static bool ipip6_valid_ip_proto(u8 ipproto)
1147{
1148	return ipproto == IPPROTO_IPV6 ||
1149		ipproto == IPPROTO_IPIP ||
1150#if IS_ENABLED(CONFIG_MPLS)
1151		ipproto == IPPROTO_MPLS ||
1152#endif
1153		ipproto == 0;
1154}
1155
1156static int
1157ipip6_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1158{
1159	int err = 0;
1160	struct ip_tunnel_parm p;
1161	struct ip_tunnel_prl prl;
1162	struct ip_tunnel *t = netdev_priv(dev);
1163	struct net *net = t->net;
1164	struct sit_net *sitn = net_generic(net, sit_net_id);
1165#ifdef CONFIG_IPV6_SIT_6RD
1166	struct ip_tunnel_6rd ip6rd;
1167#endif
1168
1169	switch (cmd) {
1170	case SIOCGETTUNNEL:
1171#ifdef CONFIG_IPV6_SIT_6RD
1172	case SIOCGET6RD:
1173#endif
1174		if (dev == sitn->fb_tunnel_dev) {
1175			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
1176				err = -EFAULT;
1177				break;
1178			}
1179			t = ipip6_tunnel_locate(net, &p, 0);
1180			if (!t)
1181				t = netdev_priv(dev);
1182		}
1183
1184		err = -EFAULT;
1185		if (cmd == SIOCGETTUNNEL) {
1186			memcpy(&p, &t->parms, sizeof(p));
1187			if (copy_to_user(ifr->ifr_ifru.ifru_data, &p,
1188					 sizeof(p)))
1189				goto done;
1190#ifdef CONFIG_IPV6_SIT_6RD
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1191		} else {
1192			ip6rd.prefix = t->ip6rd.prefix;
1193			ip6rd.relay_prefix = t->ip6rd.relay_prefix;
1194			ip6rd.prefixlen = t->ip6rd.prefixlen;
1195			ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
1196			if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd,
1197					 sizeof(ip6rd)))
1198				goto done;
1199#endif
1200		}
1201		err = 0;
1202		break;
1203
1204	case SIOCADDTUNNEL:
1205	case SIOCCHGTUNNEL:
1206		err = -EPERM;
1207		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1208			goto done;
1209
1210		err = -EFAULT;
1211		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1212			goto done;
1213
1214		err = -EINVAL;
1215		if (!ipip6_valid_ip_proto(p.iph.protocol))
1216			goto done;
1217		if (p.iph.version != 4 ||
1218		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
1219			goto done;
1220		if (p.iph.ttl)
1221			p.iph.frag_off |= htons(IP_DF);
1222
1223		t = ipip6_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
1224
1225		if (dev != sitn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
1226			if (t) {
1227				if (t->dev != dev) {
1228					err = -EEXIST;
1229					break;
1230				}
1231			} else {
1232				if (((dev->flags&IFF_POINTOPOINT) && !p.iph.daddr) ||
1233				    (!(dev->flags&IFF_POINTOPOINT) && p.iph.daddr)) {
1234					err = -EINVAL;
1235					break;
1236				}
1237				t = netdev_priv(dev);
1238			}
1239
1240			ipip6_tunnel_update(t, &p, t->fwmark);
1241		}
1242
1243		if (t) {
1244			err = 0;
1245			if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
1246				err = -EFAULT;
1247		} else
1248			err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
1249		break;
 
 
 
 
1250
 
 
 
 
 
 
 
 
 
 
1251	case SIOCDELTUNNEL:
1252		err = -EPERM;
1253		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1254			goto done;
1255
1256		if (dev == sitn->fb_tunnel_dev) {
1257			err = -EFAULT;
1258			if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1259				goto done;
1260			err = -ENOENT;
1261			t = ipip6_tunnel_locate(net, &p, 0);
1262			if (!t)
1263				goto done;
1264			err = -EPERM;
1265			if (t == netdev_priv(sitn->fb_tunnel_dev))
1266				goto done;
1267			dev = t->dev;
1268		}
1269		unregister_netdevice(dev);
1270		err = 0;
1271		break;
1272
 
 
 
 
 
 
 
 
 
1273	case SIOCGETPRL:
1274		err = -EINVAL;
1275		if (dev == sitn->fb_tunnel_dev)
1276			goto done;
1277		err = ipip6_tunnel_get_prl(t, ifr->ifr_ifru.ifru_data);
1278		break;
1279
1280	case SIOCADDPRL:
1281	case SIOCDELPRL:
1282	case SIOCCHGPRL:
1283		err = -EPERM;
1284		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1285			goto done;
1286		err = -EINVAL;
1287		if (dev == sitn->fb_tunnel_dev)
1288			goto done;
1289		err = -EFAULT;
1290		if (copy_from_user(&prl, ifr->ifr_ifru.ifru_data, sizeof(prl)))
1291			goto done;
1292
1293		switch (cmd) {
1294		case SIOCDELPRL:
1295			err = ipip6_tunnel_del_prl(t, &prl);
1296			break;
1297		case SIOCADDPRL:
1298		case SIOCCHGPRL:
1299			err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
1300			break;
1301		}
1302		dst_cache_reset(&t->dst_cache);
1303		netdev_state_change(dev);
1304		break;
1305
1306#ifdef CONFIG_IPV6_SIT_6RD
 
 
1307	case SIOCADD6RD:
1308	case SIOCCHG6RD:
1309	case SIOCDEL6RD:
1310		err = -EPERM;
1311		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1312			goto done;
1313
1314		err = -EFAULT;
1315		if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data,
1316				   sizeof(ip6rd)))
1317			goto done;
1318
1319		if (cmd != SIOCDEL6RD) {
1320			err = ipip6_tunnel_update_6rd(t, &ip6rd);
1321			if (err < 0)
1322				goto done;
1323		} else
1324			ipip6_tunnel_clone_6rd(dev, sitn);
1325
1326		err = 0;
1327		break;
1328#endif
1329
1330	default:
1331		err = -EINVAL;
1332	}
1333
1334done:
1335	return err;
1336}
1337
1338static const struct net_device_ops ipip6_netdev_ops = {
1339	.ndo_init	= ipip6_tunnel_init,
1340	.ndo_uninit	= ipip6_tunnel_uninit,
1341	.ndo_start_xmit	= sit_tunnel_xmit,
1342	.ndo_do_ioctl	= ipip6_tunnel_ioctl,
1343	.ndo_get_stats64 = ip_tunnel_get_stats64,
1344	.ndo_get_iflink = ip_tunnel_get_iflink,
 
1345};
1346
1347static void ipip6_dev_free(struct net_device *dev)
1348{
1349	struct ip_tunnel *tunnel = netdev_priv(dev);
1350
1351	dst_cache_destroy(&tunnel->dst_cache);
1352	free_percpu(dev->tstats);
1353}
1354
1355#define SIT_FEATURES (NETIF_F_SG	   | \
1356		      NETIF_F_FRAGLIST	   | \
1357		      NETIF_F_HIGHDMA	   | \
1358		      NETIF_F_GSO_SOFTWARE | \
1359		      NETIF_F_HW_CSUM)
1360
1361static void ipip6_tunnel_setup(struct net_device *dev)
1362{
1363	struct ip_tunnel *tunnel = netdev_priv(dev);
1364	int t_hlen = tunnel->hlen + sizeof(struct iphdr);
1365
1366	dev->netdev_ops		= &ipip6_netdev_ops;
 
1367	dev->needs_free_netdev	= true;
1368	dev->priv_destructor	= ipip6_dev_free;
1369
1370	dev->type		= ARPHRD_SIT;
1371	dev->hard_header_len	= LL_MAX_HEADER + t_hlen;
1372	dev->mtu		= ETH_DATA_LEN - t_hlen;
1373	dev->min_mtu		= IPV6_MIN_MTU;
1374	dev->max_mtu		= IP6_MAX_MTU - t_hlen;
1375	dev->flags		= IFF_NOARP;
1376	netif_keep_dst(dev);
1377	dev->addr_len		= 4;
1378	dev->features		|= NETIF_F_LLTX;
1379	dev->features		|= SIT_FEATURES;
1380	dev->hw_features	|= SIT_FEATURES;
1381}
1382
1383static int ipip6_tunnel_init(struct net_device *dev)
1384{
1385	struct ip_tunnel *tunnel = netdev_priv(dev);
1386	int err;
1387
1388	tunnel->dev = dev;
1389	tunnel->net = dev_net(dev);
1390	strcpy(tunnel->parms.name, dev->name);
1391
1392	ipip6_tunnel_bind_dev(dev);
1393	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
1394	if (!dev->tstats)
1395		return -ENOMEM;
1396
1397	err = dst_cache_init(&tunnel->dst_cache, GFP_KERNEL);
1398	if (err) {
1399		free_percpu(dev->tstats);
1400		dev->tstats = NULL;
1401		return err;
1402	}
1403
1404	return 0;
1405}
1406
1407static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
1408{
1409	struct ip_tunnel *tunnel = netdev_priv(dev);
1410	struct iphdr *iph = &tunnel->parms.iph;
1411	struct net *net = dev_net(dev);
1412	struct sit_net *sitn = net_generic(net, sit_net_id);
1413
1414	iph->version		= 4;
1415	iph->protocol		= IPPROTO_IPV6;
1416	iph->ihl		= 5;
1417	iph->ttl		= 64;
1418
1419	dev_hold(dev);
1420	rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
1421}
1422
1423static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[],
1424			  struct netlink_ext_ack *extack)
1425{
1426	u8 proto;
1427
1428	if (!data || !data[IFLA_IPTUN_PROTO])
1429		return 0;
1430
1431	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1432	if (!ipip6_valid_ip_proto(proto))
1433		return -EINVAL;
1434
1435	return 0;
1436}
1437
1438static void ipip6_netlink_parms(struct nlattr *data[],
1439				struct ip_tunnel_parm *parms,
1440				__u32 *fwmark)
1441{
1442	memset(parms, 0, sizeof(*parms));
1443
1444	parms->iph.version = 4;
1445	parms->iph.protocol = IPPROTO_IPV6;
1446	parms->iph.ihl = 5;
1447	parms->iph.ttl = 64;
1448
1449	if (!data)
1450		return;
1451
1452	if (data[IFLA_IPTUN_LINK])
1453		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
1454
1455	if (data[IFLA_IPTUN_LOCAL])
1456		parms->iph.saddr = nla_get_be32(data[IFLA_IPTUN_LOCAL]);
1457
1458	if (data[IFLA_IPTUN_REMOTE])
1459		parms->iph.daddr = nla_get_be32(data[IFLA_IPTUN_REMOTE]);
1460
1461	if (data[IFLA_IPTUN_TTL]) {
1462		parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
1463		if (parms->iph.ttl)
1464			parms->iph.frag_off = htons(IP_DF);
1465	}
1466
1467	if (data[IFLA_IPTUN_TOS])
1468		parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);
1469
1470	if (!data[IFLA_IPTUN_PMTUDISC] || nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
1471		parms->iph.frag_off = htons(IP_DF);
1472
1473	if (data[IFLA_IPTUN_FLAGS])
1474		parms->i_flags = nla_get_be16(data[IFLA_IPTUN_FLAGS]);
1475
1476	if (data[IFLA_IPTUN_PROTO])
1477		parms->iph.protocol = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1478
1479	if (data[IFLA_IPTUN_FWMARK])
1480		*fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
1481}
1482
1483/* This function returns true when ENCAP attributes are present in the nl msg */
1484static bool ipip6_netlink_encap_parms(struct nlattr *data[],
1485				      struct ip_tunnel_encap *ipencap)
1486{
1487	bool ret = false;
1488
1489	memset(ipencap, 0, sizeof(*ipencap));
1490
1491	if (!data)
1492		return ret;
1493
1494	if (data[IFLA_IPTUN_ENCAP_TYPE]) {
1495		ret = true;
1496		ipencap->type = nla_get_u16(data[IFLA_IPTUN_ENCAP_TYPE]);
1497	}
1498
1499	if (data[IFLA_IPTUN_ENCAP_FLAGS]) {
1500		ret = true;
1501		ipencap->flags = nla_get_u16(data[IFLA_IPTUN_ENCAP_FLAGS]);
1502	}
1503
1504	if (data[IFLA_IPTUN_ENCAP_SPORT]) {
1505		ret = true;
1506		ipencap->sport = nla_get_be16(data[IFLA_IPTUN_ENCAP_SPORT]);
1507	}
1508
1509	if (data[IFLA_IPTUN_ENCAP_DPORT]) {
1510		ret = true;
1511		ipencap->dport = nla_get_be16(data[IFLA_IPTUN_ENCAP_DPORT]);
1512	}
1513
1514	return ret;
1515}
1516
1517#ifdef CONFIG_IPV6_SIT_6RD
1518/* This function returns true when 6RD attributes are present in the nl msg */
1519static bool ipip6_netlink_6rd_parms(struct nlattr *data[],
1520				    struct ip_tunnel_6rd *ip6rd)
1521{
1522	bool ret = false;
1523	memset(ip6rd, 0, sizeof(*ip6rd));
1524
1525	if (!data)
1526		return ret;
1527
1528	if (data[IFLA_IPTUN_6RD_PREFIX]) {
1529		ret = true;
1530		ip6rd->prefix = nla_get_in6_addr(data[IFLA_IPTUN_6RD_PREFIX]);
1531	}
1532
1533	if (data[IFLA_IPTUN_6RD_RELAY_PREFIX]) {
1534		ret = true;
1535		ip6rd->relay_prefix =
1536			nla_get_be32(data[IFLA_IPTUN_6RD_RELAY_PREFIX]);
1537	}
1538
1539	if (data[IFLA_IPTUN_6RD_PREFIXLEN]) {
1540		ret = true;
1541		ip6rd->prefixlen = nla_get_u16(data[IFLA_IPTUN_6RD_PREFIXLEN]);
1542	}
1543
1544	if (data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]) {
1545		ret = true;
1546		ip6rd->relay_prefixlen =
1547			nla_get_u16(data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]);
1548	}
1549
1550	return ret;
1551}
1552#endif
1553
1554static int ipip6_newlink(struct net *src_net, struct net_device *dev,
1555			 struct nlattr *tb[], struct nlattr *data[],
1556			 struct netlink_ext_ack *extack)
1557{
1558	struct net *net = dev_net(dev);
1559	struct ip_tunnel *nt;
1560	struct ip_tunnel_encap ipencap;
1561#ifdef CONFIG_IPV6_SIT_6RD
1562	struct ip_tunnel_6rd ip6rd;
1563#endif
1564	int err;
1565
1566	nt = netdev_priv(dev);
1567
1568	if (ipip6_netlink_encap_parms(data, &ipencap)) {
1569		err = ip_tunnel_encap_setup(nt, &ipencap);
1570		if (err < 0)
1571			return err;
1572	}
1573
1574	ipip6_netlink_parms(data, &nt->parms, &nt->fwmark);
1575
1576	if (ipip6_tunnel_locate(net, &nt->parms, 0))
1577		return -EEXIST;
1578
1579	err = ipip6_tunnel_create(dev);
1580	if (err < 0)
1581		return err;
1582
1583	if (tb[IFLA_MTU]) {
1584		u32 mtu = nla_get_u32(tb[IFLA_MTU]);
1585
1586		if (mtu >= IPV6_MIN_MTU &&
1587		    mtu <= IP6_MAX_MTU - dev->hard_header_len)
1588			dev->mtu = mtu;
1589	}
1590
1591#ifdef CONFIG_IPV6_SIT_6RD
1592	if (ipip6_netlink_6rd_parms(data, &ip6rd))
1593		err = ipip6_tunnel_update_6rd(nt, &ip6rd);
1594#endif
1595
1596	return err;
1597}
1598
1599static int ipip6_changelink(struct net_device *dev, struct nlattr *tb[],
1600			    struct nlattr *data[],
1601			    struct netlink_ext_ack *extack)
1602{
1603	struct ip_tunnel *t = netdev_priv(dev);
1604	struct ip_tunnel_parm p;
1605	struct ip_tunnel_encap ipencap;
1606	struct net *net = t->net;
1607	struct sit_net *sitn = net_generic(net, sit_net_id);
1608#ifdef CONFIG_IPV6_SIT_6RD
1609	struct ip_tunnel_6rd ip6rd;
1610#endif
1611	__u32 fwmark = t->fwmark;
1612	int err;
1613
1614	if (dev == sitn->fb_tunnel_dev)
1615		return -EINVAL;
1616
1617	if (ipip6_netlink_encap_parms(data, &ipencap)) {
1618		err = ip_tunnel_encap_setup(t, &ipencap);
1619		if (err < 0)
1620			return err;
1621	}
1622
1623	ipip6_netlink_parms(data, &p, &fwmark);
1624
1625	if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) ||
1626	    (!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
1627		return -EINVAL;
1628
1629	t = ipip6_tunnel_locate(net, &p, 0);
1630
1631	if (t) {
1632		if (t->dev != dev)
1633			return -EEXIST;
1634	} else
1635		t = netdev_priv(dev);
1636
1637	ipip6_tunnel_update(t, &p, fwmark);
1638
1639#ifdef CONFIG_IPV6_SIT_6RD
1640	if (ipip6_netlink_6rd_parms(data, &ip6rd))
1641		return ipip6_tunnel_update_6rd(t, &ip6rd);
1642#endif
1643
1644	return 0;
1645}
1646
1647static size_t ipip6_get_size(const struct net_device *dev)
1648{
1649	return
1650		/* IFLA_IPTUN_LINK */
1651		nla_total_size(4) +
1652		/* IFLA_IPTUN_LOCAL */
1653		nla_total_size(4) +
1654		/* IFLA_IPTUN_REMOTE */
1655		nla_total_size(4) +
1656		/* IFLA_IPTUN_TTL */
1657		nla_total_size(1) +
1658		/* IFLA_IPTUN_TOS */
1659		nla_total_size(1) +
1660		/* IFLA_IPTUN_PMTUDISC */
1661		nla_total_size(1) +
1662		/* IFLA_IPTUN_FLAGS */
1663		nla_total_size(2) +
1664		/* IFLA_IPTUN_PROTO */
1665		nla_total_size(1) +
1666#ifdef CONFIG_IPV6_SIT_6RD
1667		/* IFLA_IPTUN_6RD_PREFIX */
1668		nla_total_size(sizeof(struct in6_addr)) +
1669		/* IFLA_IPTUN_6RD_RELAY_PREFIX */
1670		nla_total_size(4) +
1671		/* IFLA_IPTUN_6RD_PREFIXLEN */
1672		nla_total_size(2) +
1673		/* IFLA_IPTUN_6RD_RELAY_PREFIXLEN */
1674		nla_total_size(2) +
1675#endif
1676		/* IFLA_IPTUN_ENCAP_TYPE */
1677		nla_total_size(2) +
1678		/* IFLA_IPTUN_ENCAP_FLAGS */
1679		nla_total_size(2) +
1680		/* IFLA_IPTUN_ENCAP_SPORT */
1681		nla_total_size(2) +
1682		/* IFLA_IPTUN_ENCAP_DPORT */
1683		nla_total_size(2) +
1684		/* IFLA_IPTUN_FWMARK */
1685		nla_total_size(4) +
1686		0;
1687}
1688
1689static int ipip6_fill_info(struct sk_buff *skb, const struct net_device *dev)
1690{
1691	struct ip_tunnel *tunnel = netdev_priv(dev);
1692	struct ip_tunnel_parm *parm = &tunnel->parms;
1693
1694	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
1695	    nla_put_in_addr(skb, IFLA_IPTUN_LOCAL, parm->iph.saddr) ||
1696	    nla_put_in_addr(skb, IFLA_IPTUN_REMOTE, parm->iph.daddr) ||
1697	    nla_put_u8(skb, IFLA_IPTUN_TTL, parm->iph.ttl) ||
1698	    nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
1699	    nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
1700		       !!(parm->iph.frag_off & htons(IP_DF))) ||
1701	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->iph.protocol) ||
1702	    nla_put_be16(skb, IFLA_IPTUN_FLAGS, parm->i_flags) ||
1703	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, tunnel->fwmark))
1704		goto nla_put_failure;
1705
1706#ifdef CONFIG_IPV6_SIT_6RD
1707	if (nla_put_in6_addr(skb, IFLA_IPTUN_6RD_PREFIX,
1708			     &tunnel->ip6rd.prefix) ||
1709	    nla_put_in_addr(skb, IFLA_IPTUN_6RD_RELAY_PREFIX,
1710			    tunnel->ip6rd.relay_prefix) ||
1711	    nla_put_u16(skb, IFLA_IPTUN_6RD_PREFIXLEN,
1712			tunnel->ip6rd.prefixlen) ||
1713	    nla_put_u16(skb, IFLA_IPTUN_6RD_RELAY_PREFIXLEN,
1714			tunnel->ip6rd.relay_prefixlen))
1715		goto nla_put_failure;
1716#endif
1717
1718	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE,
1719			tunnel->encap.type) ||
1720	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT,
1721			tunnel->encap.sport) ||
1722	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT,
1723			tunnel->encap.dport) ||
1724	    nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS,
1725			tunnel->encap.flags))
1726		goto nla_put_failure;
1727
1728	return 0;
1729
1730nla_put_failure:
1731	return -EMSGSIZE;
1732}
1733
1734static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
1735	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
1736	[IFLA_IPTUN_LOCAL]		= { .type = NLA_U32 },
1737	[IFLA_IPTUN_REMOTE]		= { .type = NLA_U32 },
1738	[IFLA_IPTUN_TTL]		= { .type = NLA_U8 },
1739	[IFLA_IPTUN_TOS]		= { .type = NLA_U8 },
1740	[IFLA_IPTUN_PMTUDISC]		= { .type = NLA_U8 },
1741	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U16 },
1742	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
1743#ifdef CONFIG_IPV6_SIT_6RD
1744	[IFLA_IPTUN_6RD_PREFIX]		= { .len = sizeof(struct in6_addr) },
1745	[IFLA_IPTUN_6RD_RELAY_PREFIX]	= { .type = NLA_U32 },
1746	[IFLA_IPTUN_6RD_PREFIXLEN]	= { .type = NLA_U16 },
1747	[IFLA_IPTUN_6RD_RELAY_PREFIXLEN] = { .type = NLA_U16 },
1748#endif
1749	[IFLA_IPTUN_ENCAP_TYPE]		= { .type = NLA_U16 },
1750	[IFLA_IPTUN_ENCAP_FLAGS]	= { .type = NLA_U16 },
1751	[IFLA_IPTUN_ENCAP_SPORT]	= { .type = NLA_U16 },
1752	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
1753	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
1754};
1755
1756static void ipip6_dellink(struct net_device *dev, struct list_head *head)
1757{
1758	struct net *net = dev_net(dev);
1759	struct sit_net *sitn = net_generic(net, sit_net_id);
1760
1761	if (dev != sitn->fb_tunnel_dev)
1762		unregister_netdevice_queue(dev, head);
1763}
1764
1765static struct rtnl_link_ops sit_link_ops __read_mostly = {
1766	.kind		= "sit",
1767	.maxtype	= IFLA_IPTUN_MAX,
1768	.policy		= ipip6_policy,
1769	.priv_size	= sizeof(struct ip_tunnel),
1770	.setup		= ipip6_tunnel_setup,
1771	.validate	= ipip6_validate,
1772	.newlink	= ipip6_newlink,
1773	.changelink	= ipip6_changelink,
1774	.get_size	= ipip6_get_size,
1775	.fill_info	= ipip6_fill_info,
1776	.dellink	= ipip6_dellink,
1777	.get_link_net	= ip_tunnel_get_link_net,
1778};
1779
1780static struct xfrm_tunnel sit_handler __read_mostly = {
1781	.handler	=	ipip6_rcv,
1782	.err_handler	=	ipip6_err,
1783	.priority	=	1,
1784};
1785
1786static struct xfrm_tunnel ipip_handler __read_mostly = {
1787	.handler	=	ipip_rcv,
1788	.err_handler	=	ipip6_err,
1789	.priority	=	2,
1790};
1791
1792#if IS_ENABLED(CONFIG_MPLS)
1793static struct xfrm_tunnel mplsip_handler __read_mostly = {
1794	.handler	=	mplsip_rcv,
1795	.err_handler	=	ipip6_err,
1796	.priority	=	2,
1797};
1798#endif
1799
1800static void __net_exit sit_destroy_tunnels(struct net *net,
1801					   struct list_head *head)
1802{
1803	struct sit_net *sitn = net_generic(net, sit_net_id);
1804	struct net_device *dev, *aux;
1805	int prio;
1806
1807	for_each_netdev_safe(net, dev, aux)
1808		if (dev->rtnl_link_ops == &sit_link_ops)
1809			unregister_netdevice_queue(dev, head);
1810
1811	for (prio = 1; prio < 4; prio++) {
1812		int h;
1813		for (h = 0; h < IP6_SIT_HASH_SIZE; h++) {
1814			struct ip_tunnel *t;
1815
1816			t = rtnl_dereference(sitn->tunnels[prio][h]);
1817			while (t) {
1818				/* If dev is in the same netns, it has already
1819				 * been added to the list by the previous loop.
1820				 */
1821				if (!net_eq(dev_net(t->dev), net))
1822					unregister_netdevice_queue(t->dev,
1823								   head);
1824				t = rtnl_dereference(t->next);
1825			}
1826		}
1827	}
1828}
1829
1830static int __net_init sit_init_net(struct net *net)
1831{
1832	struct sit_net *sitn = net_generic(net, sit_net_id);
1833	struct ip_tunnel *t;
1834	int err;
1835
1836	sitn->tunnels[0] = sitn->tunnels_wc;
1837	sitn->tunnels[1] = sitn->tunnels_l;
1838	sitn->tunnels[2] = sitn->tunnels_r;
1839	sitn->tunnels[3] = sitn->tunnels_r_l;
1840
1841	if (!net_has_fallback_tunnels(net))
1842		return 0;
1843
1844	sitn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "sit0",
1845					   NET_NAME_UNKNOWN,
1846					   ipip6_tunnel_setup);
1847	if (!sitn->fb_tunnel_dev) {
1848		err = -ENOMEM;
1849		goto err_alloc_dev;
1850	}
1851	dev_net_set(sitn->fb_tunnel_dev, net);
1852	sitn->fb_tunnel_dev->rtnl_link_ops = &sit_link_ops;
1853	/* FB netdevice is special: we have one, and only one per netns.
1854	 * Allowing to move it to another netns is clearly unsafe.
1855	 */
1856	sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
1857
1858	err = register_netdev(sitn->fb_tunnel_dev);
1859	if (err)
1860		goto err_reg_dev;
1861
1862	ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
1863	ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
1864
1865	t = netdev_priv(sitn->fb_tunnel_dev);
1866
1867	strcpy(t->parms.name, sitn->fb_tunnel_dev->name);
1868	return 0;
1869
1870err_reg_dev:
1871	ipip6_dev_free(sitn->fb_tunnel_dev);
 
1872err_alloc_dev:
1873	return err;
1874}
1875
1876static void __net_exit sit_exit_batch_net(struct list_head *net_list)
1877{
1878	LIST_HEAD(list);
1879	struct net *net;
1880
1881	rtnl_lock();
1882	list_for_each_entry(net, net_list, exit_list)
1883		sit_destroy_tunnels(net, &list);
1884
1885	unregister_netdevice_many(&list);
1886	rtnl_unlock();
1887}
1888
1889static struct pernet_operations sit_net_ops = {
1890	.init = sit_init_net,
1891	.exit_batch = sit_exit_batch_net,
1892	.id   = &sit_net_id,
1893	.size = sizeof(struct sit_net),
1894};
1895
1896static void __exit sit_cleanup(void)
1897{
1898	rtnl_link_unregister(&sit_link_ops);
1899	xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
1900	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
1901#if IS_ENABLED(CONFIG_MPLS)
1902	xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
1903#endif
1904
1905	unregister_pernet_device(&sit_net_ops);
1906	rcu_barrier(); /* Wait for completion of call_rcu()'s */
1907}
1908
1909static int __init sit_init(void)
1910{
1911	int err;
1912
1913	pr_info("IPv6, IPv4 and MPLS over IPv4 tunneling driver\n");
1914
1915	err = register_pernet_device(&sit_net_ops);
1916	if (err < 0)
1917		return err;
1918	err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
1919	if (err < 0) {
1920		pr_info("%s: can't register ip6ip4\n", __func__);
1921		goto xfrm_tunnel_failed;
1922	}
1923	err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
1924	if (err < 0) {
1925		pr_info("%s: can't register ip4ip4\n", __func__);
1926		goto xfrm_tunnel4_failed;
1927	}
1928#if IS_ENABLED(CONFIG_MPLS)
1929	err = xfrm4_tunnel_register(&mplsip_handler, AF_MPLS);
1930	if (err < 0) {
1931		pr_info("%s: can't register mplsip\n", __func__);
1932		goto xfrm_tunnel_mpls_failed;
1933	}
1934#endif
1935	err = rtnl_link_register(&sit_link_ops);
1936	if (err < 0)
1937		goto rtnl_link_failed;
1938
1939out:
1940	return err;
1941
1942rtnl_link_failed:
1943#if IS_ENABLED(CONFIG_MPLS)
1944	xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
1945xfrm_tunnel_mpls_failed:
1946#endif
1947	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
1948xfrm_tunnel4_failed:
1949	xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
1950xfrm_tunnel_failed:
1951	unregister_pernet_device(&sit_net_ops);
1952	goto out;
1953}
1954
1955module_init(sit_init);
1956module_exit(sit_cleanup);
1957MODULE_LICENSE("GPL");
1958MODULE_ALIAS_RTNL_LINK("sit");
1959MODULE_ALIAS_NETDEV("sit0");
v5.9
   1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	IPv6 over IPv4 tunnel device - Simple Internet Transition (SIT)
   4 *	Linux INET6 implementation
   5 *
   6 *	Authors:
   7 *	Pedro Roque		<roque@di.fc.ul.pt>
   8 *	Alexey Kuznetsov	<kuznet@ms2.inr.ac.ru>
   9 *
 
 
 
 
 
  10 *	Changes:
  11 * Roger Venning <r.venning@telstra.com>:	6to4 support
  12 * Nate Thompson <nate@thebog.net>:		6to4 support
  13 * Fred Templin <fred.l.templin@boeing.com>:	isatap support
  14 */
  15
  16#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  17
  18#include <linux/module.h>
  19#include <linux/capability.h>
  20#include <linux/errno.h>
  21#include <linux/types.h>
  22#include <linux/socket.h>
  23#include <linux/sockios.h>
  24#include <linux/net.h>
  25#include <linux/in6.h>
  26#include <linux/netdevice.h>
  27#include <linux/if_arp.h>
  28#include <linux/icmp.h>
  29#include <linux/slab.h>
  30#include <linux/uaccess.h>
  31#include <linux/init.h>
  32#include <linux/netfilter_ipv4.h>
  33#include <linux/if_ether.h>
  34
  35#include <net/sock.h>
  36#include <net/snmp.h>
  37
  38#include <net/ipv6.h>
  39#include <net/protocol.h>
  40#include <net/transp_v6.h>
  41#include <net/ip6_fib.h>
  42#include <net/ip6_route.h>
  43#include <net/ndisc.h>
  44#include <net/addrconf.h>
  45#include <net/ip.h>
  46#include <net/udp.h>
  47#include <net/icmp.h>
  48#include <net/ip_tunnels.h>
  49#include <net/inet_ecn.h>
  50#include <net/xfrm.h>
  51#include <net/dsfield.h>
  52#include <net/net_namespace.h>
  53#include <net/netns/generic.h>
  54
  55/*
  56   This version of net/ipv6/sit.c is cloned of net/ipv4/ip_gre.c
  57
  58   For comments look at net/ipv4/ip_gre.c --ANK
  59 */
  60
  61#define IP6_SIT_HASH_SIZE  16
  62#define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
  63
  64static bool log_ecn_error = true;
  65module_param(log_ecn_error, bool, 0644);
  66MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
  67
  68static int ipip6_tunnel_init(struct net_device *dev);
  69static void ipip6_tunnel_setup(struct net_device *dev);
  70static void ipip6_dev_free(struct net_device *dev);
  71static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
  72		      __be32 *v4dst);
  73static struct rtnl_link_ops sit_link_ops __read_mostly;
  74
  75static unsigned int sit_net_id __read_mostly;
  76struct sit_net {
  77	struct ip_tunnel __rcu *tunnels_r_l[IP6_SIT_HASH_SIZE];
  78	struct ip_tunnel __rcu *tunnels_r[IP6_SIT_HASH_SIZE];
  79	struct ip_tunnel __rcu *tunnels_l[IP6_SIT_HASH_SIZE];
  80	struct ip_tunnel __rcu *tunnels_wc[1];
  81	struct ip_tunnel __rcu **tunnels[4];
  82
  83	struct net_device *fb_tunnel_dev;
  84};
  85
  86static inline struct sit_net *dev_to_sit_net(struct net_device *dev)
  87{
  88	struct ip_tunnel *t = netdev_priv(dev);
  89
  90	return net_generic(t->net, sit_net_id);
  91}
  92
  93/*
  94 * Must be invoked with rcu_read_lock
  95 */
  96static struct ip_tunnel *ipip6_tunnel_lookup(struct net *net,
  97					     struct net_device *dev,
  98					     __be32 remote, __be32 local,
  99					     int sifindex)
 100{
 101	unsigned int h0 = HASH(remote);
 102	unsigned int h1 = HASH(local);
 103	struct ip_tunnel *t;
 104	struct sit_net *sitn = net_generic(net, sit_net_id);
 105	int ifindex = dev ? dev->ifindex : 0;
 106
 107	for_each_ip_tunnel_rcu(t, sitn->tunnels_r_l[h0 ^ h1]) {
 108		if (local == t->parms.iph.saddr &&
 109		    remote == t->parms.iph.daddr &&
 110		    (!dev || !t->parms.link || ifindex == t->parms.link ||
 111		     sifindex == t->parms.link) &&
 112		    (t->dev->flags & IFF_UP))
 113			return t;
 114	}
 115	for_each_ip_tunnel_rcu(t, sitn->tunnels_r[h0]) {
 116		if (remote == t->parms.iph.daddr &&
 117		    (!dev || !t->parms.link || ifindex == t->parms.link ||
 118		     sifindex == t->parms.link) &&
 119		    (t->dev->flags & IFF_UP))
 120			return t;
 121	}
 122	for_each_ip_tunnel_rcu(t, sitn->tunnels_l[h1]) {
 123		if (local == t->parms.iph.saddr &&
 124		    (!dev || !t->parms.link || ifindex == t->parms.link ||
 125		     sifindex == t->parms.link) &&
 126		    (t->dev->flags & IFF_UP))
 127			return t;
 128	}
 129	t = rcu_dereference(sitn->tunnels_wc[0]);
 130	if (t && (t->dev->flags & IFF_UP))
 131		return t;
 132	return NULL;
 133}
 134
 135static struct ip_tunnel __rcu **__ipip6_bucket(struct sit_net *sitn,
 136		struct ip_tunnel_parm *parms)
 137{
 138	__be32 remote = parms->iph.daddr;
 139	__be32 local = parms->iph.saddr;
 140	unsigned int h = 0;
 141	int prio = 0;
 142
 143	if (remote) {
 144		prio |= 2;
 145		h ^= HASH(remote);
 146	}
 147	if (local) {
 148		prio |= 1;
 149		h ^= HASH(local);
 150	}
 151	return &sitn->tunnels[prio][h];
 152}
 153
 154static inline struct ip_tunnel __rcu **ipip6_bucket(struct sit_net *sitn,
 155		struct ip_tunnel *t)
 156{
 157	return __ipip6_bucket(sitn, &t->parms);
 158}
 159
 160static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 161{
 162	struct ip_tunnel __rcu **tp;
 163	struct ip_tunnel *iter;
 164
 165	for (tp = ipip6_bucket(sitn, t);
 166	     (iter = rtnl_dereference(*tp)) != NULL;
 167	     tp = &iter->next) {
 168		if (t == iter) {
 169			rcu_assign_pointer(*tp, t->next);
 170			break;
 171		}
 172	}
 173}
 174
 175static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 176{
 177	struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
 178
 179	rcu_assign_pointer(t->next, rtnl_dereference(*tp));
 180	rcu_assign_pointer(*tp, t);
 181}
 182
 183static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
 184{
 185#ifdef CONFIG_IPV6_SIT_6RD
 186	struct ip_tunnel *t = netdev_priv(dev);
 187
 188	if (dev == sitn->fb_tunnel_dev || !sitn->fb_tunnel_dev) {
 189		ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
 190		t->ip6rd.relay_prefix = 0;
 191		t->ip6rd.prefixlen = 16;
 192		t->ip6rd.relay_prefixlen = 0;
 193	} else {
 194		struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
 195		memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
 196	}
 197#endif
 198}
 199
 200static int ipip6_tunnel_create(struct net_device *dev)
 201{
 202	struct ip_tunnel *t = netdev_priv(dev);
 203	struct net *net = dev_net(dev);
 204	struct sit_net *sitn = net_generic(net, sit_net_id);
 205	int err;
 206
 207	memcpy(dev->dev_addr, &t->parms.iph.saddr, 4);
 208	memcpy(dev->broadcast, &t->parms.iph.daddr, 4);
 209
 210	if ((__force u16)t->parms.i_flags & SIT_ISATAP)
 211		dev->priv_flags |= IFF_ISATAP;
 212
 213	dev->rtnl_link_ops = &sit_link_ops;
 214
 215	err = register_netdevice(dev);
 216	if (err < 0)
 217		goto out;
 218
 219	ipip6_tunnel_clone_6rd(dev, sitn);
 220
 221	dev_hold(dev);
 222
 223	ipip6_tunnel_link(sitn, t);
 224	return 0;
 225
 226out:
 227	return err;
 228}
 229
 230static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
 231		struct ip_tunnel_parm *parms, int create)
 232{
 233	__be32 remote = parms->iph.daddr;
 234	__be32 local = parms->iph.saddr;
 235	struct ip_tunnel *t, *nt;
 236	struct ip_tunnel __rcu **tp;
 237	struct net_device *dev;
 238	char name[IFNAMSIZ];
 239	struct sit_net *sitn = net_generic(net, sit_net_id);
 240
 241	for (tp = __ipip6_bucket(sitn, parms);
 242	    (t = rtnl_dereference(*tp)) != NULL;
 243	     tp = &t->next) {
 244		if (local == t->parms.iph.saddr &&
 245		    remote == t->parms.iph.daddr &&
 246		    parms->link == t->parms.link) {
 247			if (create)
 248				return NULL;
 249			else
 250				return t;
 251		}
 252	}
 253	if (!create)
 254		goto failed;
 255
 256	if (parms->name[0]) {
 257		if (!dev_valid_name(parms->name))
 258			goto failed;
 259		strlcpy(name, parms->name, IFNAMSIZ);
 260	} else {
 261		strcpy(name, "sit%d");
 262	}
 263	dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
 264			   ipip6_tunnel_setup);
 265	if (!dev)
 266		return NULL;
 267
 268	dev_net_set(dev, net);
 269
 270	nt = netdev_priv(dev);
 271
 272	nt->parms = *parms;
 273	if (ipip6_tunnel_create(dev) < 0)
 274		goto failed_free;
 275
 276	return nt;
 277
 278failed_free:
 279	free_netdev(dev);
 280failed:
 281	return NULL;
 282}
 283
 284#define for_each_prl_rcu(start)			\
 285	for (prl = rcu_dereference(start);	\
 286	     prl;				\
 287	     prl = rcu_dereference(prl->next))
 288
 289static struct ip_tunnel_prl_entry *
 290__ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 291{
 292	struct ip_tunnel_prl_entry *prl;
 293
 294	for_each_prl_rcu(t->prl)
 295		if (prl->addr == addr)
 296			break;
 297	return prl;
 298
 299}
 300
 301static int ipip6_tunnel_get_prl(struct net_device *dev, struct ifreq *ifr)
 
 302{
 303	struct ip_tunnel_prl __user *a = ifr->ifr_ifru.ifru_data;
 304	struct ip_tunnel *t = netdev_priv(dev);
 305	struct ip_tunnel_prl kprl, *kp;
 306	struct ip_tunnel_prl_entry *prl;
 307	unsigned int cmax, c = 0, ca, len;
 308	int ret = 0;
 309
 310	if (dev == dev_to_sit_net(dev)->fb_tunnel_dev)
 311		return -EINVAL;
 312
 313	if (copy_from_user(&kprl, a, sizeof(kprl)))
 314		return -EFAULT;
 315	cmax = kprl.datalen / sizeof(kprl);
 316	if (cmax > 1 && kprl.addr != htonl(INADDR_ANY))
 317		cmax = 1;
 318
 319	/* For simple GET or for root users,
 320	 * we try harder to allocate.
 321	 */
 322	kp = (cmax <= 1 || capable(CAP_NET_ADMIN)) ?
 323		kcalloc(cmax, sizeof(*kp), GFP_KERNEL | __GFP_NOWARN) :
 324		NULL;
 325
 326	rcu_read_lock();
 327
 328	ca = t->prl_count < cmax ? t->prl_count : cmax;
 329
 330	if (!kp) {
 331		/* We don't try hard to allocate much memory for
 332		 * non-root users.
 333		 * For root users, retry allocating enough memory for
 334		 * the answer.
 335		 */
 336		kp = kcalloc(ca, sizeof(*kp), GFP_ATOMIC);
 337		if (!kp) {
 338			ret = -ENOMEM;
 339			goto out;
 340		}
 341	}
 342
 343	c = 0;
 344	for_each_prl_rcu(t->prl) {
 345		if (c >= cmax)
 346			break;
 347		if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
 348			continue;
 349		kp[c].addr = prl->addr;
 350		kp[c].flags = prl->flags;
 351		c++;
 352		if (kprl.addr != htonl(INADDR_ANY))
 353			break;
 354	}
 355out:
 356	rcu_read_unlock();
 357
 358	len = sizeof(*kp) * c;
 359	ret = 0;
 360	if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
 361		ret = -EFAULT;
 362
 363	kfree(kp);
 364
 365	return ret;
 366}
 367
 368static int
 369ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
 370{
 371	struct ip_tunnel_prl_entry *p;
 372	int err = 0;
 373
 374	if (a->addr == htonl(INADDR_ANY))
 375		return -EINVAL;
 376
 377	ASSERT_RTNL();
 378
 379	for (p = rtnl_dereference(t->prl); p; p = rtnl_dereference(p->next)) {
 380		if (p->addr == a->addr) {
 381			if (chg) {
 382				p->flags = a->flags;
 383				goto out;
 384			}
 385			err = -EEXIST;
 386			goto out;
 387		}
 388	}
 389
 390	if (chg) {
 391		err = -ENXIO;
 392		goto out;
 393	}
 394
 395	p = kzalloc(sizeof(struct ip_tunnel_prl_entry), GFP_KERNEL);
 396	if (!p) {
 397		err = -ENOBUFS;
 398		goto out;
 399	}
 400
 401	p->next = t->prl;
 402	p->addr = a->addr;
 403	p->flags = a->flags;
 404	t->prl_count++;
 405	rcu_assign_pointer(t->prl, p);
 406out:
 407	return err;
 408}
 409
 410static void prl_list_destroy_rcu(struct rcu_head *head)
 411{
 412	struct ip_tunnel_prl_entry *p, *n;
 413
 414	p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
 415	do {
 416		n = rcu_dereference_protected(p->next, 1);
 417		kfree(p);
 418		p = n;
 419	} while (p);
 420}
 421
 422static int
 423ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 424{
 425	struct ip_tunnel_prl_entry *x;
 426	struct ip_tunnel_prl_entry __rcu **p;
 427	int err = 0;
 428
 429	ASSERT_RTNL();
 430
 431	if (a && a->addr != htonl(INADDR_ANY)) {
 432		for (p = &t->prl;
 433		     (x = rtnl_dereference(*p)) != NULL;
 434		     p = &x->next) {
 435			if (x->addr == a->addr) {
 436				*p = x->next;
 437				kfree_rcu(x, rcu_head);
 438				t->prl_count--;
 439				goto out;
 440			}
 441		}
 442		err = -ENXIO;
 443	} else {
 444		x = rtnl_dereference(t->prl);
 445		if (x) {
 446			t->prl_count = 0;
 447			call_rcu(&x->rcu_head, prl_list_destroy_rcu);
 448			t->prl = NULL;
 449		}
 450	}
 451out:
 452	return err;
 453}
 454
 455static int ipip6_tunnel_prl_ctl(struct net_device *dev, struct ifreq *ifr,
 456		int cmd)
 457{
 458	struct ip_tunnel *t = netdev_priv(dev);
 459	struct ip_tunnel_prl prl;
 460	int err;
 461
 462	if (!ns_capable(t->net->user_ns, CAP_NET_ADMIN))
 463		return -EPERM;
 464	if (dev == dev_to_sit_net(dev)->fb_tunnel_dev)
 465		return -EINVAL;
 466
 467	if (copy_from_user(&prl, ifr->ifr_ifru.ifru_data, sizeof(prl)))
 468		return -EFAULT;
 469
 470	switch (cmd) {
 471	case SIOCDELPRL:
 472		err = ipip6_tunnel_del_prl(t, &prl);
 473		break;
 474	case SIOCADDPRL:
 475	case SIOCCHGPRL:
 476		err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
 477		break;
 478	}
 479	dst_cache_reset(&t->dst_cache);
 480	netdev_state_change(dev);
 481	return err;
 482}
 483
 484static int
 485isatap_chksrc(struct sk_buff *skb, const struct iphdr *iph, struct ip_tunnel *t)
 486{
 487	struct ip_tunnel_prl_entry *p;
 488	int ok = 1;
 489
 490	rcu_read_lock();
 491	p = __ipip6_tunnel_locate_prl(t, iph->saddr);
 492	if (p) {
 493		if (p->flags & PRL_DEFAULT)
 494			skb->ndisc_nodetype = NDISC_NODETYPE_DEFAULT;
 495		else
 496			skb->ndisc_nodetype = NDISC_NODETYPE_NODEFAULT;
 497	} else {
 498		const struct in6_addr *addr6 = &ipv6_hdr(skb)->saddr;
 499
 500		if (ipv6_addr_is_isatap(addr6) &&
 501		    (addr6->s6_addr32[3] == iph->saddr) &&
 502		    ipv6_chk_prefix(addr6, t->dev))
 503			skb->ndisc_nodetype = NDISC_NODETYPE_HOST;
 504		else
 505			ok = 0;
 506	}
 507	rcu_read_unlock();
 508	return ok;
 509}
 510
 511static void ipip6_tunnel_uninit(struct net_device *dev)
 512{
 513	struct ip_tunnel *tunnel = netdev_priv(dev);
 514	struct sit_net *sitn = net_generic(tunnel->net, sit_net_id);
 515
 516	if (dev == sitn->fb_tunnel_dev) {
 517		RCU_INIT_POINTER(sitn->tunnels_wc[0], NULL);
 518	} else {
 519		ipip6_tunnel_unlink(sitn, tunnel);
 520		ipip6_tunnel_del_prl(tunnel, NULL);
 521	}
 522	dst_cache_reset(&tunnel->dst_cache);
 523	dev_put(dev);
 524}
 525
 526static int ipip6_err(struct sk_buff *skb, u32 info)
 527{
 528	const struct iphdr *iph = (const struct iphdr *)skb->data;
 529	const int type = icmp_hdr(skb)->type;
 530	const int code = icmp_hdr(skb)->code;
 531	unsigned int data_len = 0;
 532	struct ip_tunnel *t;
 533	int sifindex;
 534	int err;
 535
 536	switch (type) {
 537	default:
 538	case ICMP_PARAMETERPROB:
 539		return 0;
 540
 541	case ICMP_DEST_UNREACH:
 542		switch (code) {
 543		case ICMP_SR_FAILED:
 544			/* Impossible event. */
 545			return 0;
 546		default:
 547			/* All others are translated to HOST_UNREACH.
 548			   rfc2003 contains "deep thoughts" about NET_UNREACH,
 549			   I believe they are just ether pollution. --ANK
 550			 */
 551			break;
 552		}
 553		break;
 554	case ICMP_TIME_EXCEEDED:
 555		if (code != ICMP_EXC_TTL)
 556			return 0;
 557		data_len = icmp_hdr(skb)->un.reserved[1] * 4; /* RFC 4884 4.1 */
 558		break;
 559	case ICMP_REDIRECT:
 560		break;
 561	}
 562
 563	err = -ENOENT;
 564
 565	sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
 566	t = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
 567				iph->daddr, iph->saddr, sifindex);
 568	if (!t)
 569		goto out;
 570
 571	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
 572		ipv4_update_pmtu(skb, dev_net(skb->dev), info,
 573				 t->parms.link, iph->protocol);
 574		err = 0;
 575		goto out;
 576	}
 577	if (type == ICMP_REDIRECT) {
 578		ipv4_redirect(skb, dev_net(skb->dev), t->parms.link,
 579			      iph->protocol);
 580		err = 0;
 581		goto out;
 582	}
 583
 584	err = 0;
 585	if (__in6_dev_get(skb->dev) &&
 586	    !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
 587		goto out;
 588
 589	if (t->parms.iph.daddr == 0)
 590		goto out;
 591
 592	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 593		goto out;
 594
 595	if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
 596		t->err_count++;
 597	else
 598		t->err_count = 1;
 599	t->err_time = jiffies;
 600out:
 601	return err;
 602}
 603
 604static inline bool is_spoofed_6rd(struct ip_tunnel *tunnel, const __be32 v4addr,
 605				  const struct in6_addr *v6addr)
 606{
 607	__be32 v4embed = 0;
 608	if (check_6rd(tunnel, v6addr, &v4embed) && v4addr != v4embed)
 609		return true;
 610	return false;
 611}
 612
 613/* Checks if an address matches an address on the tunnel interface.
 614 * Used to detect the NAT of proto 41 packets and let them pass spoofing test.
 615 * Long story:
 616 * This function is called after we considered the packet as spoofed
 617 * in is_spoofed_6rd.
 618 * We may have a router that is doing NAT for proto 41 packets
 619 * for an internal station. Destination a.a.a.a/PREFIX:bbbb:bbbb
 620 * will be translated to n.n.n.n/PREFIX:bbbb:bbbb. And is_spoofed_6rd
 621 * function will return true, dropping the packet.
 622 * But, we can still check if is spoofed against the IP
 623 * addresses associated with the interface.
 624 */
 625static bool only_dnatted(const struct ip_tunnel *tunnel,
 626	const struct in6_addr *v6dst)
 627{
 628	int prefix_len;
 629
 630#ifdef CONFIG_IPV6_SIT_6RD
 631	prefix_len = tunnel->ip6rd.prefixlen + 32
 632		- tunnel->ip6rd.relay_prefixlen;
 633#else
 634	prefix_len = 48;
 635#endif
 636	return ipv6_chk_custom_prefix(v6dst, prefix_len, tunnel->dev);
 637}
 638
 639/* Returns true if a packet is spoofed */
 640static bool packet_is_spoofed(struct sk_buff *skb,
 641			      const struct iphdr *iph,
 642			      struct ip_tunnel *tunnel)
 643{
 644	const struct ipv6hdr *ipv6h;
 645
 646	if (tunnel->dev->priv_flags & IFF_ISATAP) {
 647		if (!isatap_chksrc(skb, iph, tunnel))
 648			return true;
 649
 650		return false;
 651	}
 652
 653	if (tunnel->dev->flags & IFF_POINTOPOINT)
 654		return false;
 655
 656	ipv6h = ipv6_hdr(skb);
 657
 658	if (unlikely(is_spoofed_6rd(tunnel, iph->saddr, &ipv6h->saddr))) {
 659		net_warn_ratelimited("Src spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
 660				     &iph->saddr, &ipv6h->saddr,
 661				     &iph->daddr, &ipv6h->daddr);
 662		return true;
 663	}
 664
 665	if (likely(!is_spoofed_6rd(tunnel, iph->daddr, &ipv6h->daddr)))
 666		return false;
 667
 668	if (only_dnatted(tunnel, &ipv6h->daddr))
 669		return false;
 670
 671	net_warn_ratelimited("Dst spoofed %pI4/%pI6c -> %pI4/%pI6c\n",
 672			     &iph->saddr, &ipv6h->saddr,
 673			     &iph->daddr, &ipv6h->daddr);
 674	return true;
 675}
 676
 677static int ipip6_rcv(struct sk_buff *skb)
 678{
 679	const struct iphdr *iph = ip_hdr(skb);
 680	struct ip_tunnel *tunnel;
 681	int sifindex;
 682	int err;
 683
 684	sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
 685	tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
 686				     iph->saddr, iph->daddr, sifindex);
 687	if (tunnel) {
 688		struct pcpu_sw_netstats *tstats;
 689
 690		if (tunnel->parms.iph.protocol != IPPROTO_IPV6 &&
 691		    tunnel->parms.iph.protocol != 0)
 692			goto out;
 693
 694		skb->mac_header = skb->network_header;
 695		skb_reset_network_header(skb);
 696		IPCB(skb)->flags = 0;
 697		skb->dev = tunnel->dev;
 698
 699		if (packet_is_spoofed(skb, iph, tunnel)) {
 700			tunnel->dev->stats.rx_errors++;
 701			goto out;
 702		}
 703
 704		if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6),
 705		    !net_eq(tunnel->net, dev_net(tunnel->dev))))
 706			goto out;
 707
 708		/* skb can be uncloned in iptunnel_pull_header, so
 709		 * old iph is no longer valid
 710		 */
 711		iph = (const struct iphdr *)skb_mac_header(skb);
 712		err = IP_ECN_decapsulate(iph, skb);
 713		if (unlikely(err)) {
 714			if (log_ecn_error)
 715				net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
 716						     &iph->saddr, iph->tos);
 717			if (err > 1) {
 718				++tunnel->dev->stats.rx_frame_errors;
 719				++tunnel->dev->stats.rx_errors;
 720				goto out;
 721			}
 722		}
 723
 724		tstats = this_cpu_ptr(tunnel->dev->tstats);
 725		u64_stats_update_begin(&tstats->syncp);
 726		tstats->rx_packets++;
 727		tstats->rx_bytes += skb->len;
 728		u64_stats_update_end(&tstats->syncp);
 729
 730		netif_rx(skb);
 731
 732		return 0;
 733	}
 734
 735	/* no tunnel matched,  let upstream know, ipsec may handle it */
 736	return 1;
 737out:
 738	kfree_skb(skb);
 739	return 0;
 740}
 741
 742static const struct tnl_ptk_info ipip_tpi = {
 743	/* no tunnel info required for ipip. */
 744	.proto = htons(ETH_P_IP),
 745};
 746
 747#if IS_ENABLED(CONFIG_MPLS)
 748static const struct tnl_ptk_info mplsip_tpi = {
 749	/* no tunnel info required for mplsip. */
 750	.proto = htons(ETH_P_MPLS_UC),
 751};
 752#endif
 753
 754static int sit_tunnel_rcv(struct sk_buff *skb, u8 ipproto)
 755{
 756	const struct iphdr *iph;
 757	struct ip_tunnel *tunnel;
 758	int sifindex;
 759
 760	sifindex = netif_is_l3_master(skb->dev) ? IPCB(skb)->iif : 0;
 761
 762	iph = ip_hdr(skb);
 763	tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
 764				     iph->saddr, iph->daddr, sifindex);
 765	if (tunnel) {
 766		const struct tnl_ptk_info *tpi;
 767
 768		if (tunnel->parms.iph.protocol != ipproto &&
 769		    tunnel->parms.iph.protocol != 0)
 770			goto drop;
 771
 772		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
 773			goto drop;
 774#if IS_ENABLED(CONFIG_MPLS)
 775		if (ipproto == IPPROTO_MPLS)
 776			tpi = &mplsip_tpi;
 777		else
 778#endif
 779			tpi = &ipip_tpi;
 780		if (iptunnel_pull_header(skb, 0, tpi->proto, false))
 781			goto drop;
 782		return ip_tunnel_rcv(tunnel, skb, tpi, NULL, log_ecn_error);
 783	}
 784
 785	return 1;
 786
 787drop:
 788	kfree_skb(skb);
 789	return 0;
 790}
 791
 792static int ipip_rcv(struct sk_buff *skb)
 793{
 794	return sit_tunnel_rcv(skb, IPPROTO_IPIP);
 795}
 796
 797#if IS_ENABLED(CONFIG_MPLS)
 798static int mplsip_rcv(struct sk_buff *skb)
 799{
 800	return sit_tunnel_rcv(skb, IPPROTO_MPLS);
 801}
 802#endif
 803
 804/*
 805 * If the IPv6 address comes from 6rd / 6to4 (RFC 3056) addr space this function
 806 * stores the embedded IPv4 address in v4dst and returns true.
 807 */
 808static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
 809		      __be32 *v4dst)
 810{
 811#ifdef CONFIG_IPV6_SIT_6RD
 812	if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
 813			      tunnel->ip6rd.prefixlen)) {
 814		unsigned int pbw0, pbi0;
 815		int pbi1;
 816		u32 d;
 817
 818		pbw0 = tunnel->ip6rd.prefixlen >> 5;
 819		pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
 820
 821		d = tunnel->ip6rd.relay_prefixlen < 32 ?
 822			(ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
 823		    tunnel->ip6rd.relay_prefixlen : 0;
 824
 825		pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
 826		if (pbi1 > 0)
 827			d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
 828			     (32 - pbi1);
 829
 830		*v4dst = tunnel->ip6rd.relay_prefix | htonl(d);
 831		return true;
 832	}
 833#else
 834	if (v6dst->s6_addr16[0] == htons(0x2002)) {
 835		/* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
 836		memcpy(v4dst, &v6dst->s6_addr16[1], 4);
 837		return true;
 838	}
 839#endif
 840	return false;
 841}
 842
 843static inline __be32 try_6rd(struct ip_tunnel *tunnel,
 844			     const struct in6_addr *v6dst)
 845{
 846	__be32 dst = 0;
 847	check_6rd(tunnel, v6dst, &dst);
 848	return dst;
 849}
 850
 851/*
 852 *	This function assumes it is being called from dev_queue_xmit()
 853 *	and that skb is filled properly by that function.
 854 */
 855
 856static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
 857				     struct net_device *dev)
 858{
 859	struct ip_tunnel *tunnel = netdev_priv(dev);
 860	const struct iphdr  *tiph = &tunnel->parms.iph;
 861	const struct ipv6hdr *iph6 = ipv6_hdr(skb);
 862	u8     tos = tunnel->parms.iph.tos;
 863	__be16 df = tiph->frag_off;
 864	struct rtable *rt;		/* Route to the other host */
 865	struct net_device *tdev;	/* Device to other host */
 866	unsigned int max_headroom;	/* The extra header space needed */
 867	__be32 dst = tiph->daddr;
 868	struct flowi4 fl4;
 869	int    mtu;
 870	const struct in6_addr *addr6;
 871	int addr_type;
 872	u8 ttl;
 873	u8 protocol = IPPROTO_IPV6;
 874	int t_hlen = tunnel->hlen + sizeof(struct iphdr);
 875
 876	if (tos == 1)
 877		tos = ipv6_get_dsfield(iph6);
 878
 879	/* ISATAP (RFC4214) - must come before 6to4 */
 880	if (dev->priv_flags & IFF_ISATAP) {
 881		struct neighbour *neigh = NULL;
 882		bool do_tx_error = false;
 883
 884		if (skb_dst(skb))
 885			neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 886
 887		if (!neigh) {
 888			net_dbg_ratelimited("nexthop == NULL\n");
 889			goto tx_error;
 890		}
 891
 892		addr6 = (const struct in6_addr *)&neigh->primary_key;
 893		addr_type = ipv6_addr_type(addr6);
 894
 895		if ((addr_type & IPV6_ADDR_UNICAST) &&
 896		     ipv6_addr_is_isatap(addr6))
 897			dst = addr6->s6_addr32[3];
 898		else
 899			do_tx_error = true;
 900
 901		neigh_release(neigh);
 902		if (do_tx_error)
 903			goto tx_error;
 904	}
 905
 906	if (!dst)
 907		dst = try_6rd(tunnel, &iph6->daddr);
 908
 909	if (!dst) {
 910		struct neighbour *neigh = NULL;
 911		bool do_tx_error = false;
 912
 913		if (skb_dst(skb))
 914			neigh = dst_neigh_lookup(skb_dst(skb), &iph6->daddr);
 915
 916		if (!neigh) {
 917			net_dbg_ratelimited("nexthop == NULL\n");
 918			goto tx_error;
 919		}
 920
 921		addr6 = (const struct in6_addr *)&neigh->primary_key;
 922		addr_type = ipv6_addr_type(addr6);
 923
 924		if (addr_type == IPV6_ADDR_ANY) {
 925			addr6 = &ipv6_hdr(skb)->daddr;
 926			addr_type = ipv6_addr_type(addr6);
 927		}
 928
 929		if ((addr_type & IPV6_ADDR_COMPATv4) != 0)
 930			dst = addr6->s6_addr32[3];
 931		else
 932			do_tx_error = true;
 933
 934		neigh_release(neigh);
 935		if (do_tx_error)
 936			goto tx_error;
 937	}
 938
 939	flowi4_init_output(&fl4, tunnel->parms.link, tunnel->fwmark,
 940			   RT_TOS(tos), RT_SCOPE_UNIVERSE, IPPROTO_IPV6,
 941			   0, dst, tiph->saddr, 0, 0,
 942			   sock_net_uid(tunnel->net, NULL));
 
 943
 944	rt = dst_cache_get_ip4(&tunnel->dst_cache, &fl4.saddr);
 945	if (!rt) {
 946		rt = ip_route_output_flow(tunnel->net, &fl4, NULL);
 947		if (IS_ERR(rt)) {
 948			dev->stats.tx_carrier_errors++;
 949			goto tx_error_icmp;
 950		}
 951		dst_cache_set_ip4(&tunnel->dst_cache, &rt->dst, fl4.saddr);
 952	}
 953
 954	if (rt->rt_type != RTN_UNICAST) {
 955		ip_rt_put(rt);
 956		dev->stats.tx_carrier_errors++;
 957		goto tx_error_icmp;
 958	}
 959	tdev = rt->dst.dev;
 960
 961	if (tdev == dev) {
 962		ip_rt_put(rt);
 963		dev->stats.collisions++;
 964		goto tx_error;
 965	}
 966
 967	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4)) {
 968		ip_rt_put(rt);
 969		goto tx_error;
 970	}
 971
 972	if (df) {
 973		mtu = dst_mtu(&rt->dst) - t_hlen;
 974
 975		if (mtu < 68) {
 976			dev->stats.collisions++;
 977			ip_rt_put(rt);
 978			goto tx_error;
 979		}
 980
 981		if (mtu < IPV6_MIN_MTU) {
 982			mtu = IPV6_MIN_MTU;
 983			df = 0;
 984		}
 985
 986		if (tunnel->parms.iph.daddr)
 987			skb_dst_update_pmtu_no_confirm(skb, mtu);
 988
 989		if (skb->len > mtu && !skb_is_gso(skb)) {
 990			icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 991			ip_rt_put(rt);
 992			goto tx_error;
 993		}
 994	}
 995
 996	if (tunnel->err_count > 0) {
 997		if (time_before(jiffies,
 998				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
 999			tunnel->err_count--;
1000			dst_link_failure(skb);
1001		} else
1002			tunnel->err_count = 0;
1003	}
1004
1005	/*
1006	 * Okay, now see if we can stuff it in the buffer as-is.
1007	 */
1008	max_headroom = LL_RESERVED_SPACE(tdev) + t_hlen;
1009
1010	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
1011	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
1012		struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
1013		if (!new_skb) {
1014			ip_rt_put(rt);
1015			dev->stats.tx_dropped++;
1016			kfree_skb(skb);
1017			return NETDEV_TX_OK;
1018		}
1019		if (skb->sk)
1020			skb_set_owner_w(new_skb, skb->sk);
1021		dev_kfree_skb(skb);
1022		skb = new_skb;
1023		iph6 = ipv6_hdr(skb);
1024	}
1025	ttl = tiph->ttl;
1026	if (ttl == 0)
1027		ttl = iph6->hop_limit;
1028	tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
1029
1030	if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0) {
1031		ip_rt_put(rt);
1032		goto tx_error;
1033	}
1034
1035	skb_set_inner_ipproto(skb, IPPROTO_IPV6);
1036
1037	iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl,
1038		      df, !net_eq(tunnel->net, dev_net(dev)));
1039	return NETDEV_TX_OK;
1040
1041tx_error_icmp:
1042	dst_link_failure(skb);
1043tx_error:
1044	kfree_skb(skb);
1045	dev->stats.tx_errors++;
1046	return NETDEV_TX_OK;
1047}
1048
1049static netdev_tx_t sit_tunnel_xmit__(struct sk_buff *skb,
1050				     struct net_device *dev, u8 ipproto)
1051{
1052	struct ip_tunnel *tunnel = netdev_priv(dev);
1053	const struct iphdr  *tiph = &tunnel->parms.iph;
1054
1055	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP4))
1056		goto tx_error;
1057
1058	skb_set_inner_ipproto(skb, ipproto);
1059
1060	ip_tunnel_xmit(skb, dev, tiph, ipproto);
1061	return NETDEV_TX_OK;
1062tx_error:
1063	kfree_skb(skb);
1064	dev->stats.tx_errors++;
1065	return NETDEV_TX_OK;
1066}
1067
1068static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
1069				   struct net_device *dev)
1070{
1071	if (!pskb_inet_may_pull(skb))
1072		goto tx_err;
1073
1074	switch (skb->protocol) {
1075	case htons(ETH_P_IP):
1076		sit_tunnel_xmit__(skb, dev, IPPROTO_IPIP);
1077		break;
1078	case htons(ETH_P_IPV6):
1079		ipip6_tunnel_xmit(skb, dev);
1080		break;
1081#if IS_ENABLED(CONFIG_MPLS)
1082	case htons(ETH_P_MPLS_UC):
1083		sit_tunnel_xmit__(skb, dev, IPPROTO_MPLS);
1084		break;
1085#endif
1086	default:
1087		goto tx_err;
1088	}
1089
1090	return NETDEV_TX_OK;
1091
1092tx_err:
1093	dev->stats.tx_errors++;
1094	kfree_skb(skb);
1095	return NETDEV_TX_OK;
1096
1097}
1098
1099static void ipip6_tunnel_bind_dev(struct net_device *dev)
1100{
1101	struct net_device *tdev = NULL;
1102	struct ip_tunnel *tunnel;
1103	const struct iphdr *iph;
1104	struct flowi4 fl4;
1105
1106	tunnel = netdev_priv(dev);
1107	iph = &tunnel->parms.iph;
1108
1109	if (iph->daddr) {
1110		struct rtable *rt = ip_route_output_ports(tunnel->net, &fl4,
1111							  NULL,
1112							  iph->daddr, iph->saddr,
1113							  0, 0,
1114							  IPPROTO_IPV6,
1115							  RT_TOS(iph->tos),
1116							  tunnel->parms.link);
1117
1118		if (!IS_ERR(rt)) {
1119			tdev = rt->dst.dev;
1120			ip_rt_put(rt);
1121		}
1122		dev->flags |= IFF_POINTOPOINT;
1123	}
1124
1125	if (!tdev && tunnel->parms.link)
1126		tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
1127
1128	if (tdev && !netif_is_l3_master(tdev)) {
1129		int t_hlen = tunnel->hlen + sizeof(struct iphdr);
1130
1131		dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
1132		dev->mtu = tdev->mtu - t_hlen;
1133		if (dev->mtu < IPV6_MIN_MTU)
1134			dev->mtu = IPV6_MIN_MTU;
1135	}
1136}
1137
1138static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p,
1139				__u32 fwmark)
1140{
1141	struct net *net = t->net;
1142	struct sit_net *sitn = net_generic(net, sit_net_id);
1143
1144	ipip6_tunnel_unlink(sitn, t);
1145	synchronize_net();
1146	t->parms.iph.saddr = p->iph.saddr;
1147	t->parms.iph.daddr = p->iph.daddr;
1148	memcpy(t->dev->dev_addr, &p->iph.saddr, 4);
1149	memcpy(t->dev->broadcast, &p->iph.daddr, 4);
1150	ipip6_tunnel_link(sitn, t);
1151	t->parms.iph.ttl = p->iph.ttl;
1152	t->parms.iph.tos = p->iph.tos;
1153	t->parms.iph.frag_off = p->iph.frag_off;
1154	if (t->parms.link != p->link || t->fwmark != fwmark) {
1155		t->parms.link = p->link;
1156		t->fwmark = fwmark;
1157		ipip6_tunnel_bind_dev(t->dev);
1158	}
1159	dst_cache_reset(&t->dst_cache);
1160	netdev_state_change(t->dev);
1161}
1162
1163#ifdef CONFIG_IPV6_SIT_6RD
1164static int ipip6_tunnel_update_6rd(struct ip_tunnel *t,
1165				   struct ip_tunnel_6rd *ip6rd)
1166{
1167	struct in6_addr prefix;
1168	__be32 relay_prefix;
1169
1170	if (ip6rd->relay_prefixlen > 32 ||
1171	    ip6rd->prefixlen + (32 - ip6rd->relay_prefixlen) > 64)
1172		return -EINVAL;
1173
1174	ipv6_addr_prefix(&prefix, &ip6rd->prefix, ip6rd->prefixlen);
1175	if (!ipv6_addr_equal(&prefix, &ip6rd->prefix))
1176		return -EINVAL;
1177	if (ip6rd->relay_prefixlen)
1178		relay_prefix = ip6rd->relay_prefix &
1179			       htonl(0xffffffffUL <<
1180				     (32 - ip6rd->relay_prefixlen));
1181	else
1182		relay_prefix = 0;
1183	if (relay_prefix != ip6rd->relay_prefix)
1184		return -EINVAL;
1185
1186	t->ip6rd.prefix = prefix;
1187	t->ip6rd.relay_prefix = relay_prefix;
1188	t->ip6rd.prefixlen = ip6rd->prefixlen;
1189	t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;
1190	dst_cache_reset(&t->dst_cache);
1191	netdev_state_change(t->dev);
1192	return 0;
1193}
1194
1195static int
1196ipip6_tunnel_get6rd(struct net_device *dev, struct ifreq *ifr)
1197{
1198	struct ip_tunnel *t = netdev_priv(dev);
1199	struct ip_tunnel_6rd ip6rd;
1200	struct ip_tunnel_parm p;
1201
1202	if (dev == dev_to_sit_net(dev)->fb_tunnel_dev) {
1203		if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1204			return -EFAULT;
1205		t = ipip6_tunnel_locate(t->net, &p, 0);
1206	}
1207	if (!t)
1208		t = netdev_priv(dev);
1209
1210	ip6rd.prefix = t->ip6rd.prefix;
1211	ip6rd.relay_prefix = t->ip6rd.relay_prefix;
1212	ip6rd.prefixlen = t->ip6rd.prefixlen;
1213	ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
1214	if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd, sizeof(ip6rd)))
1215		return -EFAULT;
1216	return 0;
1217}
1218
1219static int
1220ipip6_tunnel_6rdctl(struct net_device *dev, struct ifreq *ifr, int cmd)
1221{
1222	struct ip_tunnel *t = netdev_priv(dev);
1223	struct ip_tunnel_6rd ip6rd;
1224	int err;
1225
1226	if (!ns_capable(t->net->user_ns, CAP_NET_ADMIN))
1227		return -EPERM;
1228	if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data, sizeof(ip6rd)))
1229		return -EFAULT;
1230
1231	if (cmd != SIOCDEL6RD) {
1232		err = ipip6_tunnel_update_6rd(t, &ip6rd);
1233		if (err < 0)
1234			return err;
1235	} else
1236		ipip6_tunnel_clone_6rd(dev, dev_to_sit_net(dev));
1237	return 0;
1238}
1239
1240#endif /* CONFIG_IPV6_SIT_6RD */
1241
1242static bool ipip6_valid_ip_proto(u8 ipproto)
1243{
1244	return ipproto == IPPROTO_IPV6 ||
1245		ipproto == IPPROTO_IPIP ||
1246#if IS_ENABLED(CONFIG_MPLS)
1247		ipproto == IPPROTO_MPLS ||
1248#endif
1249		ipproto == 0;
1250}
1251
1252static int
1253__ipip6_tunnel_ioctl_validate(struct net *net, struct ip_tunnel_parm *p)
1254{
1255	if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1256		return -EPERM;
1257
1258	if (!ipip6_valid_ip_proto(p->iph.protocol))
1259		return -EINVAL;
1260	if (p->iph.version != 4 ||
1261	    p->iph.ihl != 5 || (p->iph.frag_off & htons(~IP_DF)))
1262		return -EINVAL;
1263
1264	if (p->iph.ttl)
1265		p->iph.frag_off |= htons(IP_DF);
1266	return 0;
1267}
1268
1269static int
1270ipip6_tunnel_get(struct net_device *dev, struct ip_tunnel_parm *p)
1271{
 
 
 
1272	struct ip_tunnel *t = netdev_priv(dev);
 
 
 
 
 
1273
1274	if (dev == dev_to_sit_net(dev)->fb_tunnel_dev)
1275		t = ipip6_tunnel_locate(t->net, p, 0);
1276	if (!t)
1277		t = netdev_priv(dev);
1278	memcpy(p, &t->parms, sizeof(*p));
1279	return 0;
1280}
 
 
 
 
 
 
 
1281
1282static int
1283ipip6_tunnel_add(struct net_device *dev, struct ip_tunnel_parm *p)
1284{
1285	struct ip_tunnel *t = netdev_priv(dev);
1286	int err;
1287
1288	err = __ipip6_tunnel_ioctl_validate(t->net, p);
1289	if (err)
1290		return err;
1291
1292	t = ipip6_tunnel_locate(t->net, p, 1);
1293	if (!t)
1294		return -ENOBUFS;
1295	return 0;
1296}
1297
1298static int
1299ipip6_tunnel_change(struct net_device *dev, struct ip_tunnel_parm *p)
1300{
1301	struct ip_tunnel *t = netdev_priv(dev);
1302	int err;
1303
1304	err = __ipip6_tunnel_ioctl_validate(t->net, p);
1305	if (err)
1306		return err;
1307
1308	t = ipip6_tunnel_locate(t->net, p, 0);
1309	if (dev == dev_to_sit_net(dev)->fb_tunnel_dev) {
1310		if (!t)
1311			return -ENOENT;
1312	} else {
1313		if (t) {
1314			if (t->dev != dev)
1315				return -EEXIST;
1316		} else {
1317			if (((dev->flags & IFF_POINTOPOINT) && !p->iph.daddr) ||
1318			    (!(dev->flags & IFF_POINTOPOINT) && p->iph.daddr))
1319				return -EINVAL;
1320			t = netdev_priv(dev);
 
 
 
 
1321		}
 
 
1322
1323		ipip6_tunnel_update(t, p, t->fwmark);
1324	}
 
 
 
1325
1326	return 0;
1327}
 
1328
1329static int
1330ipip6_tunnel_del(struct net_device *dev, struct ip_tunnel_parm *p)
1331{
1332	struct ip_tunnel *t = netdev_priv(dev);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1333
1334	if (!ns_capable(t->net->user_ns, CAP_NET_ADMIN))
1335		return -EPERM;
1336
1337	if (dev == dev_to_sit_net(dev)->fb_tunnel_dev) {
1338		t = ipip6_tunnel_locate(t->net, p, 0);
1339		if (!t)
1340			return -ENOENT;
1341		if (t == netdev_priv(dev_to_sit_net(dev)->fb_tunnel_dev))
1342			return -EPERM;
1343		dev = t->dev;
1344	}
1345	unregister_netdevice(dev);
1346	return 0;
1347}
1348
1349static int
1350ipip6_tunnel_ctl(struct net_device *dev, struct ip_tunnel_parm *p, int cmd)
1351{
1352	switch (cmd) {
1353	case SIOCGETTUNNEL:
1354		return ipip6_tunnel_get(dev, p);
1355	case SIOCADDTUNNEL:
1356		return ipip6_tunnel_add(dev, p);
1357	case SIOCCHGTUNNEL:
1358		return ipip6_tunnel_change(dev, p);
1359	case SIOCDELTUNNEL:
1360		return ipip6_tunnel_del(dev, p);
1361	default:
1362		return -EINVAL;
1363	}
1364}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1365
1366static int
1367ipip6_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
1368{
1369	switch (cmd) {
1370	case SIOCGETTUNNEL:
1371	case SIOCADDTUNNEL:
1372	case SIOCCHGTUNNEL:
1373	case SIOCDELTUNNEL:
1374		return ip_tunnel_ioctl(dev, ifr, cmd);
1375	case SIOCGETPRL:
1376		return ipip6_tunnel_get_prl(dev, ifr);
 
 
 
 
 
1377	case SIOCADDPRL:
1378	case SIOCDELPRL:
1379	case SIOCCHGPRL:
1380		return ipip6_tunnel_prl_ctl(dev, ifr, cmd);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1381#ifdef CONFIG_IPV6_SIT_6RD
1382	case SIOCGET6RD:
1383		return ipip6_tunnel_get6rd(dev, ifr);
1384	case SIOCADD6RD:
1385	case SIOCCHG6RD:
1386	case SIOCDEL6RD:
1387		return ipip6_tunnel_6rdctl(dev, ifr, cmd);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1388#endif
 
1389	default:
1390		return -EINVAL;
1391	}
 
 
 
1392}
1393
1394static const struct net_device_ops ipip6_netdev_ops = {
1395	.ndo_init	= ipip6_tunnel_init,
1396	.ndo_uninit	= ipip6_tunnel_uninit,
1397	.ndo_start_xmit	= sit_tunnel_xmit,
1398	.ndo_do_ioctl	= ipip6_tunnel_ioctl,
1399	.ndo_get_stats64 = ip_tunnel_get_stats64,
1400	.ndo_get_iflink = ip_tunnel_get_iflink,
1401	.ndo_tunnel_ctl = ipip6_tunnel_ctl,
1402};
1403
1404static void ipip6_dev_free(struct net_device *dev)
1405{
1406	struct ip_tunnel *tunnel = netdev_priv(dev);
1407
1408	dst_cache_destroy(&tunnel->dst_cache);
1409	free_percpu(dev->tstats);
1410}
1411
1412#define SIT_FEATURES (NETIF_F_SG	   | \
1413		      NETIF_F_FRAGLIST	   | \
1414		      NETIF_F_HIGHDMA	   | \
1415		      NETIF_F_GSO_SOFTWARE | \
1416		      NETIF_F_HW_CSUM)
1417
1418static void ipip6_tunnel_setup(struct net_device *dev)
1419{
1420	struct ip_tunnel *tunnel = netdev_priv(dev);
1421	int t_hlen = tunnel->hlen + sizeof(struct iphdr);
1422
1423	dev->netdev_ops		= &ipip6_netdev_ops;
1424	dev->header_ops		= &ip_tunnel_header_ops;
1425	dev->needs_free_netdev	= true;
1426	dev->priv_destructor	= ipip6_dev_free;
1427
1428	dev->type		= ARPHRD_SIT;
1429	dev->hard_header_len	= LL_MAX_HEADER + t_hlen;
1430	dev->mtu		= ETH_DATA_LEN - t_hlen;
1431	dev->min_mtu		= IPV6_MIN_MTU;
1432	dev->max_mtu		= IP6_MAX_MTU - t_hlen;
1433	dev->flags		= IFF_NOARP;
1434	netif_keep_dst(dev);
1435	dev->addr_len		= 4;
1436	dev->features		|= NETIF_F_LLTX;
1437	dev->features		|= SIT_FEATURES;
1438	dev->hw_features	|= SIT_FEATURES;
1439}
1440
1441static int ipip6_tunnel_init(struct net_device *dev)
1442{
1443	struct ip_tunnel *tunnel = netdev_priv(dev);
1444	int err;
1445
1446	tunnel->dev = dev;
1447	tunnel->net = dev_net(dev);
1448	strcpy(tunnel->parms.name, dev->name);
1449
1450	ipip6_tunnel_bind_dev(dev);
1451	dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
1452	if (!dev->tstats)
1453		return -ENOMEM;
1454
1455	err = dst_cache_init(&tunnel->dst_cache, GFP_KERNEL);
1456	if (err) {
1457		free_percpu(dev->tstats);
1458		dev->tstats = NULL;
1459		return err;
1460	}
1461
1462	return 0;
1463}
1464
1465static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
1466{
1467	struct ip_tunnel *tunnel = netdev_priv(dev);
1468	struct iphdr *iph = &tunnel->parms.iph;
1469	struct net *net = dev_net(dev);
1470	struct sit_net *sitn = net_generic(net, sit_net_id);
1471
1472	iph->version		= 4;
1473	iph->protocol		= IPPROTO_IPV6;
1474	iph->ihl		= 5;
1475	iph->ttl		= 64;
1476
1477	dev_hold(dev);
1478	rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
1479}
1480
1481static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[],
1482			  struct netlink_ext_ack *extack)
1483{
1484	u8 proto;
1485
1486	if (!data || !data[IFLA_IPTUN_PROTO])
1487		return 0;
1488
1489	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1490	if (!ipip6_valid_ip_proto(proto))
1491		return -EINVAL;
1492
1493	return 0;
1494}
1495
1496static void ipip6_netlink_parms(struct nlattr *data[],
1497				struct ip_tunnel_parm *parms,
1498				__u32 *fwmark)
1499{
1500	memset(parms, 0, sizeof(*parms));
1501
1502	parms->iph.version = 4;
1503	parms->iph.protocol = IPPROTO_IPV6;
1504	parms->iph.ihl = 5;
1505	parms->iph.ttl = 64;
1506
1507	if (!data)
1508		return;
1509
1510	if (data[IFLA_IPTUN_LINK])
1511		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
1512
1513	if (data[IFLA_IPTUN_LOCAL])
1514		parms->iph.saddr = nla_get_be32(data[IFLA_IPTUN_LOCAL]);
1515
1516	if (data[IFLA_IPTUN_REMOTE])
1517		parms->iph.daddr = nla_get_be32(data[IFLA_IPTUN_REMOTE]);
1518
1519	if (data[IFLA_IPTUN_TTL]) {
1520		parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
1521		if (parms->iph.ttl)
1522			parms->iph.frag_off = htons(IP_DF);
1523	}
1524
1525	if (data[IFLA_IPTUN_TOS])
1526		parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);
1527
1528	if (!data[IFLA_IPTUN_PMTUDISC] || nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
1529		parms->iph.frag_off = htons(IP_DF);
1530
1531	if (data[IFLA_IPTUN_FLAGS])
1532		parms->i_flags = nla_get_be16(data[IFLA_IPTUN_FLAGS]);
1533
1534	if (data[IFLA_IPTUN_PROTO])
1535		parms->iph.protocol = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1536
1537	if (data[IFLA_IPTUN_FWMARK])
1538		*fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
1539}
1540
1541/* This function returns true when ENCAP attributes are present in the nl msg */
1542static bool ipip6_netlink_encap_parms(struct nlattr *data[],
1543				      struct ip_tunnel_encap *ipencap)
1544{
1545	bool ret = false;
1546
1547	memset(ipencap, 0, sizeof(*ipencap));
1548
1549	if (!data)
1550		return ret;
1551
1552	if (data[IFLA_IPTUN_ENCAP_TYPE]) {
1553		ret = true;
1554		ipencap->type = nla_get_u16(data[IFLA_IPTUN_ENCAP_TYPE]);
1555	}
1556
1557	if (data[IFLA_IPTUN_ENCAP_FLAGS]) {
1558		ret = true;
1559		ipencap->flags = nla_get_u16(data[IFLA_IPTUN_ENCAP_FLAGS]);
1560	}
1561
1562	if (data[IFLA_IPTUN_ENCAP_SPORT]) {
1563		ret = true;
1564		ipencap->sport = nla_get_be16(data[IFLA_IPTUN_ENCAP_SPORT]);
1565	}
1566
1567	if (data[IFLA_IPTUN_ENCAP_DPORT]) {
1568		ret = true;
1569		ipencap->dport = nla_get_be16(data[IFLA_IPTUN_ENCAP_DPORT]);
1570	}
1571
1572	return ret;
1573}
1574
1575#ifdef CONFIG_IPV6_SIT_6RD
1576/* This function returns true when 6RD attributes are present in the nl msg */
1577static bool ipip6_netlink_6rd_parms(struct nlattr *data[],
1578				    struct ip_tunnel_6rd *ip6rd)
1579{
1580	bool ret = false;
1581	memset(ip6rd, 0, sizeof(*ip6rd));
1582
1583	if (!data)
1584		return ret;
1585
1586	if (data[IFLA_IPTUN_6RD_PREFIX]) {
1587		ret = true;
1588		ip6rd->prefix = nla_get_in6_addr(data[IFLA_IPTUN_6RD_PREFIX]);
1589	}
1590
1591	if (data[IFLA_IPTUN_6RD_RELAY_PREFIX]) {
1592		ret = true;
1593		ip6rd->relay_prefix =
1594			nla_get_be32(data[IFLA_IPTUN_6RD_RELAY_PREFIX]);
1595	}
1596
1597	if (data[IFLA_IPTUN_6RD_PREFIXLEN]) {
1598		ret = true;
1599		ip6rd->prefixlen = nla_get_u16(data[IFLA_IPTUN_6RD_PREFIXLEN]);
1600	}
1601
1602	if (data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]) {
1603		ret = true;
1604		ip6rd->relay_prefixlen =
1605			nla_get_u16(data[IFLA_IPTUN_6RD_RELAY_PREFIXLEN]);
1606	}
1607
1608	return ret;
1609}
1610#endif
1611
1612static int ipip6_newlink(struct net *src_net, struct net_device *dev,
1613			 struct nlattr *tb[], struct nlattr *data[],
1614			 struct netlink_ext_ack *extack)
1615{
1616	struct net *net = dev_net(dev);
1617	struct ip_tunnel *nt;
1618	struct ip_tunnel_encap ipencap;
1619#ifdef CONFIG_IPV6_SIT_6RD
1620	struct ip_tunnel_6rd ip6rd;
1621#endif
1622	int err;
1623
1624	nt = netdev_priv(dev);
1625
1626	if (ipip6_netlink_encap_parms(data, &ipencap)) {
1627		err = ip_tunnel_encap_setup(nt, &ipencap);
1628		if (err < 0)
1629			return err;
1630	}
1631
1632	ipip6_netlink_parms(data, &nt->parms, &nt->fwmark);
1633
1634	if (ipip6_tunnel_locate(net, &nt->parms, 0))
1635		return -EEXIST;
1636
1637	err = ipip6_tunnel_create(dev);
1638	if (err < 0)
1639		return err;
1640
1641	if (tb[IFLA_MTU]) {
1642		u32 mtu = nla_get_u32(tb[IFLA_MTU]);
1643
1644		if (mtu >= IPV6_MIN_MTU &&
1645		    mtu <= IP6_MAX_MTU - dev->hard_header_len)
1646			dev->mtu = mtu;
1647	}
1648
1649#ifdef CONFIG_IPV6_SIT_6RD
1650	if (ipip6_netlink_6rd_parms(data, &ip6rd))
1651		err = ipip6_tunnel_update_6rd(nt, &ip6rd);
1652#endif
1653
1654	return err;
1655}
1656
1657static int ipip6_changelink(struct net_device *dev, struct nlattr *tb[],
1658			    struct nlattr *data[],
1659			    struct netlink_ext_ack *extack)
1660{
1661	struct ip_tunnel *t = netdev_priv(dev);
1662	struct ip_tunnel_parm p;
1663	struct ip_tunnel_encap ipencap;
1664	struct net *net = t->net;
1665	struct sit_net *sitn = net_generic(net, sit_net_id);
1666#ifdef CONFIG_IPV6_SIT_6RD
1667	struct ip_tunnel_6rd ip6rd;
1668#endif
1669	__u32 fwmark = t->fwmark;
1670	int err;
1671
1672	if (dev == sitn->fb_tunnel_dev)
1673		return -EINVAL;
1674
1675	if (ipip6_netlink_encap_parms(data, &ipencap)) {
1676		err = ip_tunnel_encap_setup(t, &ipencap);
1677		if (err < 0)
1678			return err;
1679	}
1680
1681	ipip6_netlink_parms(data, &p, &fwmark);
1682
1683	if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) ||
1684	    (!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
1685		return -EINVAL;
1686
1687	t = ipip6_tunnel_locate(net, &p, 0);
1688
1689	if (t) {
1690		if (t->dev != dev)
1691			return -EEXIST;
1692	} else
1693		t = netdev_priv(dev);
1694
1695	ipip6_tunnel_update(t, &p, fwmark);
1696
1697#ifdef CONFIG_IPV6_SIT_6RD
1698	if (ipip6_netlink_6rd_parms(data, &ip6rd))
1699		return ipip6_tunnel_update_6rd(t, &ip6rd);
1700#endif
1701
1702	return 0;
1703}
1704
1705static size_t ipip6_get_size(const struct net_device *dev)
1706{
1707	return
1708		/* IFLA_IPTUN_LINK */
1709		nla_total_size(4) +
1710		/* IFLA_IPTUN_LOCAL */
1711		nla_total_size(4) +
1712		/* IFLA_IPTUN_REMOTE */
1713		nla_total_size(4) +
1714		/* IFLA_IPTUN_TTL */
1715		nla_total_size(1) +
1716		/* IFLA_IPTUN_TOS */
1717		nla_total_size(1) +
1718		/* IFLA_IPTUN_PMTUDISC */
1719		nla_total_size(1) +
1720		/* IFLA_IPTUN_FLAGS */
1721		nla_total_size(2) +
1722		/* IFLA_IPTUN_PROTO */
1723		nla_total_size(1) +
1724#ifdef CONFIG_IPV6_SIT_6RD
1725		/* IFLA_IPTUN_6RD_PREFIX */
1726		nla_total_size(sizeof(struct in6_addr)) +
1727		/* IFLA_IPTUN_6RD_RELAY_PREFIX */
1728		nla_total_size(4) +
1729		/* IFLA_IPTUN_6RD_PREFIXLEN */
1730		nla_total_size(2) +
1731		/* IFLA_IPTUN_6RD_RELAY_PREFIXLEN */
1732		nla_total_size(2) +
1733#endif
1734		/* IFLA_IPTUN_ENCAP_TYPE */
1735		nla_total_size(2) +
1736		/* IFLA_IPTUN_ENCAP_FLAGS */
1737		nla_total_size(2) +
1738		/* IFLA_IPTUN_ENCAP_SPORT */
1739		nla_total_size(2) +
1740		/* IFLA_IPTUN_ENCAP_DPORT */
1741		nla_total_size(2) +
1742		/* IFLA_IPTUN_FWMARK */
1743		nla_total_size(4) +
1744		0;
1745}
1746
1747static int ipip6_fill_info(struct sk_buff *skb, const struct net_device *dev)
1748{
1749	struct ip_tunnel *tunnel = netdev_priv(dev);
1750	struct ip_tunnel_parm *parm = &tunnel->parms;
1751
1752	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
1753	    nla_put_in_addr(skb, IFLA_IPTUN_LOCAL, parm->iph.saddr) ||
1754	    nla_put_in_addr(skb, IFLA_IPTUN_REMOTE, parm->iph.daddr) ||
1755	    nla_put_u8(skb, IFLA_IPTUN_TTL, parm->iph.ttl) ||
1756	    nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
1757	    nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
1758		       !!(parm->iph.frag_off & htons(IP_DF))) ||
1759	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->iph.protocol) ||
1760	    nla_put_be16(skb, IFLA_IPTUN_FLAGS, parm->i_flags) ||
1761	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, tunnel->fwmark))
1762		goto nla_put_failure;
1763
1764#ifdef CONFIG_IPV6_SIT_6RD
1765	if (nla_put_in6_addr(skb, IFLA_IPTUN_6RD_PREFIX,
1766			     &tunnel->ip6rd.prefix) ||
1767	    nla_put_in_addr(skb, IFLA_IPTUN_6RD_RELAY_PREFIX,
1768			    tunnel->ip6rd.relay_prefix) ||
1769	    nla_put_u16(skb, IFLA_IPTUN_6RD_PREFIXLEN,
1770			tunnel->ip6rd.prefixlen) ||
1771	    nla_put_u16(skb, IFLA_IPTUN_6RD_RELAY_PREFIXLEN,
1772			tunnel->ip6rd.relay_prefixlen))
1773		goto nla_put_failure;
1774#endif
1775
1776	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE,
1777			tunnel->encap.type) ||
1778	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT,
1779			tunnel->encap.sport) ||
1780	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT,
1781			tunnel->encap.dport) ||
1782	    nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS,
1783			tunnel->encap.flags))
1784		goto nla_put_failure;
1785
1786	return 0;
1787
1788nla_put_failure:
1789	return -EMSGSIZE;
1790}
1791
1792static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
1793	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
1794	[IFLA_IPTUN_LOCAL]		= { .type = NLA_U32 },
1795	[IFLA_IPTUN_REMOTE]		= { .type = NLA_U32 },
1796	[IFLA_IPTUN_TTL]		= { .type = NLA_U8 },
1797	[IFLA_IPTUN_TOS]		= { .type = NLA_U8 },
1798	[IFLA_IPTUN_PMTUDISC]		= { .type = NLA_U8 },
1799	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U16 },
1800	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
1801#ifdef CONFIG_IPV6_SIT_6RD
1802	[IFLA_IPTUN_6RD_PREFIX]		= { .len = sizeof(struct in6_addr) },
1803	[IFLA_IPTUN_6RD_RELAY_PREFIX]	= { .type = NLA_U32 },
1804	[IFLA_IPTUN_6RD_PREFIXLEN]	= { .type = NLA_U16 },
1805	[IFLA_IPTUN_6RD_RELAY_PREFIXLEN] = { .type = NLA_U16 },
1806#endif
1807	[IFLA_IPTUN_ENCAP_TYPE]		= { .type = NLA_U16 },
1808	[IFLA_IPTUN_ENCAP_FLAGS]	= { .type = NLA_U16 },
1809	[IFLA_IPTUN_ENCAP_SPORT]	= { .type = NLA_U16 },
1810	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
1811	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
1812};
1813
1814static void ipip6_dellink(struct net_device *dev, struct list_head *head)
1815{
1816	struct net *net = dev_net(dev);
1817	struct sit_net *sitn = net_generic(net, sit_net_id);
1818
1819	if (dev != sitn->fb_tunnel_dev)
1820		unregister_netdevice_queue(dev, head);
1821}
1822
1823static struct rtnl_link_ops sit_link_ops __read_mostly = {
1824	.kind		= "sit",
1825	.maxtype	= IFLA_IPTUN_MAX,
1826	.policy		= ipip6_policy,
1827	.priv_size	= sizeof(struct ip_tunnel),
1828	.setup		= ipip6_tunnel_setup,
1829	.validate	= ipip6_validate,
1830	.newlink	= ipip6_newlink,
1831	.changelink	= ipip6_changelink,
1832	.get_size	= ipip6_get_size,
1833	.fill_info	= ipip6_fill_info,
1834	.dellink	= ipip6_dellink,
1835	.get_link_net	= ip_tunnel_get_link_net,
1836};
1837
1838static struct xfrm_tunnel sit_handler __read_mostly = {
1839	.handler	=	ipip6_rcv,
1840	.err_handler	=	ipip6_err,
1841	.priority	=	1,
1842};
1843
1844static struct xfrm_tunnel ipip_handler __read_mostly = {
1845	.handler	=	ipip_rcv,
1846	.err_handler	=	ipip6_err,
1847	.priority	=	2,
1848};
1849
1850#if IS_ENABLED(CONFIG_MPLS)
1851static struct xfrm_tunnel mplsip_handler __read_mostly = {
1852	.handler	=	mplsip_rcv,
1853	.err_handler	=	ipip6_err,
1854	.priority	=	2,
1855};
1856#endif
1857
1858static void __net_exit sit_destroy_tunnels(struct net *net,
1859					   struct list_head *head)
1860{
1861	struct sit_net *sitn = net_generic(net, sit_net_id);
1862	struct net_device *dev, *aux;
1863	int prio;
1864
1865	for_each_netdev_safe(net, dev, aux)
1866		if (dev->rtnl_link_ops == &sit_link_ops)
1867			unregister_netdevice_queue(dev, head);
1868
1869	for (prio = 1; prio < 4; prio++) {
1870		int h;
1871		for (h = 0; h < IP6_SIT_HASH_SIZE; h++) {
1872			struct ip_tunnel *t;
1873
1874			t = rtnl_dereference(sitn->tunnels[prio][h]);
1875			while (t) {
1876				/* If dev is in the same netns, it has already
1877				 * been added to the list by the previous loop.
1878				 */
1879				if (!net_eq(dev_net(t->dev), net))
1880					unregister_netdevice_queue(t->dev,
1881								   head);
1882				t = rtnl_dereference(t->next);
1883			}
1884		}
1885	}
1886}
1887
1888static int __net_init sit_init_net(struct net *net)
1889{
1890	struct sit_net *sitn = net_generic(net, sit_net_id);
1891	struct ip_tunnel *t;
1892	int err;
1893
1894	sitn->tunnels[0] = sitn->tunnels_wc;
1895	sitn->tunnels[1] = sitn->tunnels_l;
1896	sitn->tunnels[2] = sitn->tunnels_r;
1897	sitn->tunnels[3] = sitn->tunnels_r_l;
1898
1899	if (!net_has_fallback_tunnels(net))
1900		return 0;
1901
1902	sitn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "sit0",
1903					   NET_NAME_UNKNOWN,
1904					   ipip6_tunnel_setup);
1905	if (!sitn->fb_tunnel_dev) {
1906		err = -ENOMEM;
1907		goto err_alloc_dev;
1908	}
1909	dev_net_set(sitn->fb_tunnel_dev, net);
1910	sitn->fb_tunnel_dev->rtnl_link_ops = &sit_link_ops;
1911	/* FB netdevice is special: we have one, and only one per netns.
1912	 * Allowing to move it to another netns is clearly unsafe.
1913	 */
1914	sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
1915
1916	err = register_netdev(sitn->fb_tunnel_dev);
1917	if (err)
1918		goto err_reg_dev;
1919
1920	ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
1921	ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
1922
1923	t = netdev_priv(sitn->fb_tunnel_dev);
1924
1925	strcpy(t->parms.name, sitn->fb_tunnel_dev->name);
1926	return 0;
1927
1928err_reg_dev:
1929	ipip6_dev_free(sitn->fb_tunnel_dev);
1930	free_netdev(sitn->fb_tunnel_dev);
1931err_alloc_dev:
1932	return err;
1933}
1934
1935static void __net_exit sit_exit_batch_net(struct list_head *net_list)
1936{
1937	LIST_HEAD(list);
1938	struct net *net;
1939
1940	rtnl_lock();
1941	list_for_each_entry(net, net_list, exit_list)
1942		sit_destroy_tunnels(net, &list);
1943
1944	unregister_netdevice_many(&list);
1945	rtnl_unlock();
1946}
1947
1948static struct pernet_operations sit_net_ops = {
1949	.init = sit_init_net,
1950	.exit_batch = sit_exit_batch_net,
1951	.id   = &sit_net_id,
1952	.size = sizeof(struct sit_net),
1953};
1954
1955static void __exit sit_cleanup(void)
1956{
1957	rtnl_link_unregister(&sit_link_ops);
1958	xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
1959	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
1960#if IS_ENABLED(CONFIG_MPLS)
1961	xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
1962#endif
1963
1964	unregister_pernet_device(&sit_net_ops);
1965	rcu_barrier(); /* Wait for completion of call_rcu()'s */
1966}
1967
1968static int __init sit_init(void)
1969{
1970	int err;
1971
1972	pr_info("IPv6, IPv4 and MPLS over IPv4 tunneling driver\n");
1973
1974	err = register_pernet_device(&sit_net_ops);
1975	if (err < 0)
1976		return err;
1977	err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
1978	if (err < 0) {
1979		pr_info("%s: can't register ip6ip4\n", __func__);
1980		goto xfrm_tunnel_failed;
1981	}
1982	err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
1983	if (err < 0) {
1984		pr_info("%s: can't register ip4ip4\n", __func__);
1985		goto xfrm_tunnel4_failed;
1986	}
1987#if IS_ENABLED(CONFIG_MPLS)
1988	err = xfrm4_tunnel_register(&mplsip_handler, AF_MPLS);
1989	if (err < 0) {
1990		pr_info("%s: can't register mplsip\n", __func__);
1991		goto xfrm_tunnel_mpls_failed;
1992	}
1993#endif
1994	err = rtnl_link_register(&sit_link_ops);
1995	if (err < 0)
1996		goto rtnl_link_failed;
1997
1998out:
1999	return err;
2000
2001rtnl_link_failed:
2002#if IS_ENABLED(CONFIG_MPLS)
2003	xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
2004xfrm_tunnel_mpls_failed:
2005#endif
2006	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
2007xfrm_tunnel4_failed:
2008	xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
2009xfrm_tunnel_failed:
2010	unregister_pernet_device(&sit_net_ops);
2011	goto out;
2012}
2013
2014module_init(sit_init);
2015module_exit(sit_cleanup);
2016MODULE_LICENSE("GPL");
2017MODULE_ALIAS_RTNL_LINK("sit");
2018MODULE_ALIAS_NETDEV("sit0");