1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 *	IPv6 tunneling device
   4 *	Linux INET6 implementation
   5 *
   6 *	Authors:
   7 *	Ville Nuorvala		<vnuorval@tcs.hut.fi>
   8 *	Yasuyuki Kozakai	<kozakai@linux-ipv6.org>
   9 *
  10 *      Based on:
  11 *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
  12 *
  13 *      RFC 2473
  14 */
  15
  16#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  17
  18#include <linux/module.h>
  19#include <linux/capability.h>
  20#include <linux/errno.h>
  21#include <linux/types.h>
  22#include <linux/sockios.h>
  23#include <linux/icmp.h>
  24#include <linux/if.h>
  25#include <linux/in.h>
  26#include <linux/ip.h>
  27#include <linux/net.h>
  28#include <linux/in6.h>
  29#include <linux/netdevice.h>
  30#include <linux/if_arp.h>
  31#include <linux/icmpv6.h>
  32#include <linux/init.h>
  33#include <linux/route.h>
  34#include <linux/rtnetlink.h>
  35#include <linux/netfilter_ipv6.h>
  36#include <linux/slab.h>
  37#include <linux/hash.h>
  38#include <linux/etherdevice.h>
  39
  40#include <linux/uaccess.h>
  41#include <linux/atomic.h>
  42
  43#include <net/icmp.h>
  44#include <net/ip.h>
  45#include <net/ip_tunnels.h>
  46#include <net/ipv6.h>
  47#include <net/ip6_route.h>
  48#include <net/addrconf.h>
  49#include <net/ip6_tunnel.h>
  50#include <net/xfrm.h>
  51#include <net/dsfield.h>
  52#include <net/inet_ecn.h>
  53#include <net/net_namespace.h>
  54#include <net/netns/generic.h>
  55#include <net/dst_metadata.h>
  56
  57MODULE_AUTHOR("Ville Nuorvala");
  58MODULE_DESCRIPTION("IPv6 tunneling device");
  59MODULE_LICENSE("GPL");
  60MODULE_ALIAS_RTNL_LINK("ip6tnl");
  61MODULE_ALIAS_NETDEV("ip6tnl0");
  62
  63#define IP6_TUNNEL_HASH_SIZE_SHIFT  5
  64#define IP6_TUNNEL_HASH_SIZE (1 << IP6_TUNNEL_HASH_SIZE_SHIFT)
  65
  66static bool log_ecn_error = true;
  67module_param(log_ecn_error, bool, 0644);
  68MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
  69
  70static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
  71{
  72	u32 hash = ipv6_addr_hash(addr1) ^ ipv6_addr_hash(addr2);
  73
  74	return hash_32(hash, IP6_TUNNEL_HASH_SIZE_SHIFT);
  75}
  76
  77static int ip6_tnl_dev_init(struct net_device *dev);
  78static void ip6_tnl_dev_setup(struct net_device *dev);
  79static struct rtnl_link_ops ip6_link_ops __read_mostly;
  80
  81static unsigned int ip6_tnl_net_id __read_mostly;
  82struct ip6_tnl_net {
  83	/* the IPv6 tunnel fallback device */
  84	struct net_device *fb_tnl_dev;
  85	/* lists for storing tunnels in use */
  86	struct ip6_tnl __rcu *tnls_r_l[IP6_TUNNEL_HASH_SIZE];
  87	struct ip6_tnl __rcu *tnls_wc[1];
  88	struct ip6_tnl __rcu **tnls[2];
  89	struct ip6_tnl __rcu *collect_md_tun;
  90};
  91
  92static inline int ip6_tnl_mpls_supported(void)
  93{
  94	return IS_ENABLED(CONFIG_MPLS);
  95}
  96
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  97#define for_each_ip6_tunnel_rcu(start) \
  98	for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
  99
 100/**
 101 * ip6_tnl_lookup - fetch tunnel matching the end-point addresses
 102 *   @net: network namespace
 103 *   @link: ifindex of underlying interface
 104 *   @remote: the address of the tunnel exit-point
 105 *   @local: the address of the tunnel entry-point
 106 *
 107 * Return:
 108 *   tunnel matching given end-points if found,
 109 *   else fallback tunnel if its device is up,
 110 *   else %NULL
 111 **/
 112
 113static struct ip6_tnl *
 114ip6_tnl_lookup(struct net *net, int link,
 115	       const struct in6_addr *remote, const struct in6_addr *local)
 116{
 117	unsigned int hash = HASH(remote, local);
 118	struct ip6_tnl *t, *cand = NULL;
 119	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 120	struct in6_addr any;
 121
 122	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 123		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
 124		    !ipv6_addr_equal(remote, &t->parms.raddr) ||
 125		    !(t->dev->flags & IFF_UP))
 126			continue;
 127
 128		if (link == t->parms.link)
 129			return t;
 130		else
 131			cand = t;
 132	}
 133
 134	memset(&any, 0, sizeof(any));
 135	hash = HASH(&any, local);
 136	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 137		if (!ipv6_addr_equal(local, &t->parms.laddr) ||
 138		    !ipv6_addr_any(&t->parms.raddr) ||
 139		    !(t->dev->flags & IFF_UP))
 140			continue;
 141
 142		if (link == t->parms.link)
 143			return t;
 144		else if (!cand)
 145			cand = t;
 146	}
 147
 148	hash = HASH(remote, &any);
 149	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
 150		if (!ipv6_addr_equal(remote, &t->parms.raddr) ||
 151		    !ipv6_addr_any(&t->parms.laddr) ||
 152		    !(t->dev->flags & IFF_UP))
 153			continue;
 154
 155		if (link == t->parms.link)
 156			return t;
 157		else if (!cand)
 158			cand = t;
 159	}
 160
 161	if (cand)
 162		return cand;
 163
 164	t = rcu_dereference(ip6n->collect_md_tun);
 165	if (t && t->dev->flags & IFF_UP)
 166		return t;
 167
 168	t = rcu_dereference(ip6n->tnls_wc[0]);
 169	if (t && (t->dev->flags & IFF_UP))
 170		return t;
 171
 172	return NULL;
 173}
 174
 175/**
 176 * ip6_tnl_bucket - get head of list matching given tunnel parameters
 177 *   @ip6n: the private data for ip6_vti in the netns
 178 *   @p: parameters containing tunnel end-points
 179 *
 180 * Description:
 181 *   ip6_tnl_bucket() returns the head of the list matching the
 182 *   &struct in6_addr entries laddr and raddr in @p.
 183 *
 184 * Return: head of IPv6 tunnel list
 185 **/
 186
 187static struct ip6_tnl __rcu **
 188ip6_tnl_bucket(struct ip6_tnl_net *ip6n, const struct __ip6_tnl_parm *p)
 189{
 190	const struct in6_addr *remote = &p->raddr;
 191	const struct in6_addr *local = &p->laddr;
 192	unsigned int h = 0;
 193	int prio = 0;
 194
 195	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
 196		prio = 1;
 197		h = HASH(remote, local);
 198	}
 199	return &ip6n->tnls[prio][h];
 200}
 201
 202/**
 203 * ip6_tnl_link - add tunnel to hash table
 204 *   @ip6n: the private data for ip6_vti in the netns
 205 *   @t: tunnel to be added
 206 **/
 207
 208static void
 209ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 210{
 211	struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
 212
 213	if (t->parms.collect_md)
 214		rcu_assign_pointer(ip6n->collect_md_tun, t);
 215	rcu_assign_pointer(t->next , rtnl_dereference(*tp));
 216	rcu_assign_pointer(*tp, t);
 217}
 218
 219/**
 220 * ip6_tnl_unlink - remove tunnel from hash table
 221 *   @ip6n: the private data for ip6_vti in the netns
 222 *   @t: tunnel to be removed
 223 **/
 224
 225static void
 226ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 227{
 228	struct ip6_tnl __rcu **tp;
 229	struct ip6_tnl *iter;
 230
 231	if (t->parms.collect_md)
 232		rcu_assign_pointer(ip6n->collect_md_tun, NULL);
 233
 234	for (tp = ip6_tnl_bucket(ip6n, &t->parms);
 235	     (iter = rtnl_dereference(*tp)) != NULL;
 236	     tp = &iter->next) {
 237		if (t == iter) {
 238			rcu_assign_pointer(*tp, t->next);
 239			break;
 240		}
 241	}
 242}
 243
 244static void ip6_dev_free(struct net_device *dev)
 245{
 246	struct ip6_tnl *t = netdev_priv(dev);
 247
 248	gro_cells_destroy(&t->gro_cells);
 249	dst_cache_destroy(&t->dst_cache);
 
 250}
 251
 252static int ip6_tnl_create2(struct net_device *dev)
 253{
 254	struct ip6_tnl *t = netdev_priv(dev);
 255	struct net *net = dev_net(dev);
 256	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 257	int err;
 258
 
 
 259	dev->rtnl_link_ops = &ip6_link_ops;
 260	err = register_netdevice(dev);
 261	if (err < 0)
 262		goto out;
 263
 264	strcpy(t->parms.name, dev->name);
 265
 
 266	ip6_tnl_link(ip6n, t);
 267	return 0;
 268
 269out:
 270	return err;
 271}
 272
 273/**
 274 * ip6_tnl_create - create a new tunnel
 275 *   @net: network namespace
 276 *   @p: tunnel parameters
 277 *
 278 * Description:
 279 *   Create tunnel matching given parameters.
 280 *
 281 * Return:
 282 *   created tunnel or error pointer
 283 **/
 284
 285static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p)
 286{
 287	struct net_device *dev;
 288	struct ip6_tnl *t;
 289	char name[IFNAMSIZ];
 290	int err = -E2BIG;
 291
 292	if (p->name[0]) {
 293		if (!dev_valid_name(p->name))
 294			goto failed;
 295		strscpy(name, p->name, IFNAMSIZ);
 296	} else {
 297		sprintf(name, "ip6tnl%%d");
 298	}
 299	err = -ENOMEM;
 300	dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
 301			   ip6_tnl_dev_setup);
 302	if (!dev)
 303		goto failed;
 304
 305	dev_net_set(dev, net);
 306
 307	t = netdev_priv(dev);
 308	t->parms = *p;
 309	t->net = dev_net(dev);
 310	err = ip6_tnl_create2(dev);
 311	if (err < 0)
 312		goto failed_free;
 313
 314	return t;
 315
 316failed_free:
 317	free_netdev(dev);
 318failed:
 319	return ERR_PTR(err);
 320}
 321
 322/**
 323 * ip6_tnl_locate - find or create tunnel matching given parameters
 324 *   @net: network namespace
 325 *   @p: tunnel parameters
 326 *   @create: != 0 if allowed to create new tunnel if no match found
 327 *
 328 * Description:
 329 *   ip6_tnl_locate() first tries to locate an existing tunnel
 330 *   based on @parms. If this is unsuccessful, but @create is set a new
 331 *   tunnel device is created and registered for use.
 332 *
 333 * Return:
 334 *   matching tunnel or error pointer
 335 **/
 336
 337static struct ip6_tnl *ip6_tnl_locate(struct net *net,
 338		struct __ip6_tnl_parm *p, int create)
 339{
 340	const struct in6_addr *remote = &p->raddr;
 341	const struct in6_addr *local = &p->laddr;
 342	struct ip6_tnl __rcu **tp;
 343	struct ip6_tnl *t;
 344	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 345
 346	for (tp = ip6_tnl_bucket(ip6n, p);
 347	     (t = rtnl_dereference(*tp)) != NULL;
 348	     tp = &t->next) {
 349		if (ipv6_addr_equal(local, &t->parms.laddr) &&
 350		    ipv6_addr_equal(remote, &t->parms.raddr) &&
 351		    p->link == t->parms.link) {
 352			if (create)
 353				return ERR_PTR(-EEXIST);
 354
 355			return t;
 356		}
 357	}
 358	if (!create)
 359		return ERR_PTR(-ENODEV);
 360	return ip6_tnl_create(net, p);
 361}
 362
 363/**
 364 * ip6_tnl_dev_uninit - tunnel device uninitializer
 365 *   @dev: the device to be destroyed
 366 *
 367 * Description:
 368 *   ip6_tnl_dev_uninit() removes tunnel from its list
 369 **/
 370
 371static void
 372ip6_tnl_dev_uninit(struct net_device *dev)
 373{
 374	struct ip6_tnl *t = netdev_priv(dev);
 375	struct net *net = t->net;
 376	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 377
 378	if (dev == ip6n->fb_tnl_dev)
 379		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
 380	else
 381		ip6_tnl_unlink(ip6n, t);
 382	dst_cache_reset(&t->dst_cache);
 383	netdev_put(dev, &t->dev_tracker);
 384}
 385
 386/**
 387 * ip6_tnl_parse_tlv_enc_lim - handle encapsulation limit option
 388 *   @skb: received socket buffer
 389 *   @raw: the ICMPv6 error message data
 390 *
 391 * Return:
 392 *   0 if none was found,
 393 *   else index to encapsulation limit
 394 **/
 395
 396__u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
 397{
 398	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
 399	unsigned int nhoff = raw - skb->data;
 400	unsigned int off = nhoff + sizeof(*ipv6h);
 401	u8 nexthdr = ipv6h->nexthdr;
 402
 403	while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
 404		struct ipv6_opt_hdr *hdr;
 405		u16 optlen;
 406
 407		if (!pskb_may_pull(skb, off + sizeof(*hdr)))
 408			break;
 409
 410		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
 411		if (nexthdr == NEXTHDR_FRAGMENT) {
 
 
 
 412			optlen = 8;
 413		} else if (nexthdr == NEXTHDR_AUTH) {
 414			optlen = ipv6_authlen(hdr);
 415		} else {
 416			optlen = ipv6_optlen(hdr);
 417		}
 418
 419		if (!pskb_may_pull(skb, off + optlen))
 420			break;
 421
 422		hdr = (struct ipv6_opt_hdr *)(skb->data + off);
 423		if (nexthdr == NEXTHDR_FRAGMENT) {
 424			struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;
 425
 426			if (frag_hdr->frag_off)
 427				break;
 428		}
 429		if (nexthdr == NEXTHDR_DEST) {
 430			u16 i = 2;
 431
 
 
 
 
 432			while (1) {
 433				struct ipv6_tlv_tnl_enc_lim *tel;
 434
 435				/* No more room for encapsulation limit */
 436				if (i + sizeof(*tel) > optlen)
 437					break;
 438
 439				tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i);
 440				/* return index of option if found and valid */
 441				if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT &&
 442				    tel->length == 1)
 443					return i + off - nhoff;
 444				/* else jump to next option */
 445				if (tel->type)
 446					i += tel->length + 2;
 447				else
 448					i++;
 449			}
 450		}
 451		nexthdr = hdr->nexthdr;
 452		off += optlen;
 453	}
 454	return 0;
 455}
 456EXPORT_SYMBOL(ip6_tnl_parse_tlv_enc_lim);
 457
 458/* ip6_tnl_err() should handle errors in the tunnel according to the
 459 * specifications in RFC 2473.
 460 */
 
 
 
 
 
 461static int
 462ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
 463	    u8 *type, u8 *code, int *msg, __u32 *info, int offset)
 464{
 465	const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data;
 466	struct net *net = dev_net(skb->dev);
 467	u8 rel_type = ICMPV6_DEST_UNREACH;
 468	u8 rel_code = ICMPV6_ADDR_UNREACH;
 469	__u32 rel_info = 0;
 470	struct ip6_tnl *t;
 471	int err = -ENOENT;
 472	int rel_msg = 0;
 473	u8 tproto;
 474	__u16 len;
 475
 476	/* If the packet doesn't contain the original IPv6 header we are
 477	   in trouble since we might need the source address for further
 478	   processing of the error. */
 479
 480	rcu_read_lock();
 481	t = ip6_tnl_lookup(dev_net(skb->dev), skb->dev->ifindex, &ipv6h->daddr, &ipv6h->saddr);
 482	if (!t)
 483		goto out;
 484
 485	tproto = READ_ONCE(t->parms.proto);
 486	if (tproto != ipproto && tproto != 0)
 487		goto out;
 488
 489	err = 0;
 490
 491	switch (*type) {
 492	case ICMPV6_DEST_UNREACH:
 493		net_dbg_ratelimited("%s: Path to destination invalid or inactive!\n",
 494				    t->parms.name);
 495		rel_msg = 1;
 496		break;
 497	case ICMPV6_TIME_EXCEED:
 498		if ((*code) == ICMPV6_EXC_HOPLIMIT) {
 499			net_dbg_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n",
 500					    t->parms.name);
 501			rel_msg = 1;
 502		}
 503		break;
 504	case ICMPV6_PARAMPROB: {
 505		struct ipv6_tlv_tnl_enc_lim *tel;
 506		__u32 teli;
 507
 508		teli = 0;
 509		if ((*code) == ICMPV6_HDR_FIELD)
 510			teli = ip6_tnl_parse_tlv_enc_lim(skb, skb->data);
 511
 512		if (teli && teli == *info - 2) {
 513			tel = (struct ipv6_tlv_tnl_enc_lim *) &skb->data[teli];
 514			if (tel->encap_limit == 0) {
 515				net_dbg_ratelimited("%s: Too small encapsulation limit or routing loop in tunnel!\n",
 516						    t->parms.name);
 517				rel_msg = 1;
 518			}
 519		} else {
 520			net_dbg_ratelimited("%s: Recipient unable to parse tunneled packet!\n",
 521					    t->parms.name);
 522		}
 523		break;
 524	}
 525	case ICMPV6_PKT_TOOBIG: {
 526		__u32 mtu;
 527
 528		ip6_update_pmtu(skb, net, htonl(*info), 0, 0,
 529				sock_net_uid(net, NULL));
 530		mtu = *info - offset;
 531		if (mtu < IPV6_MIN_MTU)
 532			mtu = IPV6_MIN_MTU;
 533		len = sizeof(*ipv6h) + ntohs(ipv6h->payload_len);
 534		if (len > mtu) {
 535			rel_type = ICMPV6_PKT_TOOBIG;
 536			rel_code = 0;
 537			rel_info = mtu;
 538			rel_msg = 1;
 539		}
 540		break;
 541	}
 542	case NDISC_REDIRECT:
 543		ip6_redirect(skb, net, skb->dev->ifindex, 0,
 544			     sock_net_uid(net, NULL));
 545		break;
 546	}
 547
 548	*type = rel_type;
 549	*code = rel_code;
 550	*info = rel_info;
 551	*msg = rel_msg;
 552
 553out:
 554	rcu_read_unlock();
 555	return err;
 556}
 557
 558static int
 559ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 560	   u8 type, u8 code, int offset, __be32 info)
 561{
 562	__u32 rel_info = ntohl(info);
 563	const struct iphdr *eiph;
 564	struct sk_buff *skb2;
 565	int err, rel_msg = 0;
 566	u8 rel_type = type;
 567	u8 rel_code = code;
 568	struct rtable *rt;
 569	struct flowi4 fl4;
 570
 571	err = ip6_tnl_err(skb, IPPROTO_IPIP, opt, &rel_type, &rel_code,
 572			  &rel_msg, &rel_info, offset);
 573	if (err < 0)
 574		return err;
 575
 576	if (rel_msg == 0)
 577		return 0;
 578
 579	switch (rel_type) {
 580	case ICMPV6_DEST_UNREACH:
 581		if (rel_code != ICMPV6_ADDR_UNREACH)
 582			return 0;
 583		rel_type = ICMP_DEST_UNREACH;
 584		rel_code = ICMP_HOST_UNREACH;
 585		break;
 586	case ICMPV6_PKT_TOOBIG:
 587		if (rel_code != 0)
 588			return 0;
 589		rel_type = ICMP_DEST_UNREACH;
 590		rel_code = ICMP_FRAG_NEEDED;
 591		break;
 592	default:
 593		return 0;
 594	}
 595
 596	if (!pskb_may_pull(skb, offset + sizeof(struct iphdr)))
 597		return 0;
 598
 599	skb2 = skb_clone(skb, GFP_ATOMIC);
 600	if (!skb2)
 601		return 0;
 602
 603	skb_dst_drop(skb2);
 604
 605	skb_pull(skb2, offset);
 606	skb_reset_network_header(skb2);
 607	eiph = ip_hdr(skb2);
 608
 609	/* Try to guess incoming interface */
 610	rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr,
 611				   0, 0, 0, IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
 612	if (IS_ERR(rt))
 613		goto out;
 614
 615	skb2->dev = rt->dst.dev;
 616	ip_rt_put(rt);
 617
 618	/* route "incoming" packet */
 619	if (rt->rt_flags & RTCF_LOCAL) {
 620		rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL,
 621					   eiph->daddr, eiph->saddr, 0, 0,
 622					   IPPROTO_IPIP, RT_TOS(eiph->tos), 0);
 623		if (IS_ERR(rt) || rt->dst.dev->type != ARPHRD_TUNNEL6) {
 624			if (!IS_ERR(rt))
 625				ip_rt_put(rt);
 626			goto out;
 627		}
 628		skb_dst_set(skb2, &rt->dst);
 629	} else {
 630		if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
 631				   skb2->dev) ||
 632		    skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6)
 633			goto out;
 634	}
 635
 636	/* change mtu on this route */
 637	if (rel_type == ICMP_DEST_UNREACH && rel_code == ICMP_FRAG_NEEDED) {
 638		if (rel_info > dst_mtu(skb_dst(skb2)))
 639			goto out;
 640
 641		skb_dst_update_pmtu_no_confirm(skb2, rel_info);
 642	}
 643
 644	icmp_send(skb2, rel_type, rel_code, htonl(rel_info));
 645
 646out:
 647	kfree_skb(skb2);
 648	return 0;
 649}
 650
 651static int
 652ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 653	   u8 type, u8 code, int offset, __be32 info)
 654{
 655	__u32 rel_info = ntohl(info);
 656	int err, rel_msg = 0;
 657	u8 rel_type = type;
 658	u8 rel_code = code;
 659
 660	err = ip6_tnl_err(skb, IPPROTO_IPV6, opt, &rel_type, &rel_code,
 661			  &rel_msg, &rel_info, offset);
 662	if (err < 0)
 663		return err;
 664
 665	if (rel_msg && pskb_may_pull(skb, offset + sizeof(struct ipv6hdr))) {
 666		struct rt6_info *rt;
 667		struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
 668
 669		if (!skb2)
 670			return 0;
 671
 672		skb_dst_drop(skb2);
 673		skb_pull(skb2, offset);
 674		skb_reset_network_header(skb2);
 675
 676		/* Try to guess incoming interface */
 677		rt = rt6_lookup(dev_net(skb->dev), &ipv6_hdr(skb2)->saddr,
 678				NULL, 0, skb2, 0);
 679
 680		if (rt && rt->dst.dev)
 681			skb2->dev = rt->dst.dev;
 682
 683		icmpv6_send(skb2, rel_type, rel_code, rel_info);
 684
 685		ip6_rt_put(rt);
 686
 687		kfree_skb(skb2);
 688	}
 689
 690	return 0;
 691}
 692
 693static int
 694mplsip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 695	    u8 type, u8 code, int offset, __be32 info)
 696{
 697	__u32 rel_info = ntohl(info);
 698	int err, rel_msg = 0;
 699	u8 rel_type = type;
 700	u8 rel_code = code;
 701
 702	err = ip6_tnl_err(skb, IPPROTO_MPLS, opt, &rel_type, &rel_code,
 703			  &rel_msg, &rel_info, offset);
 704	return err;
 705}
 706
 707static int ip4ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
 708				       const struct ipv6hdr *ipv6h,
 709				       struct sk_buff *skb)
 710{
 711	__u8 dsfield = ipv6_get_dsfield(ipv6h) & ~INET_ECN_MASK;
 712
 713	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
 714		ipv4_change_dsfield(ip_hdr(skb), INET_ECN_MASK, dsfield);
 715
 716	return IP6_ECN_decapsulate(ipv6h, skb);
 717}
 718
 719static int ip6ip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
 720				       const struct ipv6hdr *ipv6h,
 721				       struct sk_buff *skb)
 722{
 723	if (t->parms.flags & IP6_TNL_F_RCV_DSCP_COPY)
 724		ipv6_copy_dscp(ipv6_get_dsfield(ipv6h), ipv6_hdr(skb));
 725
 726	return IP6_ECN_decapsulate(ipv6h, skb);
 727}
 728
 729static inline int mplsip6_dscp_ecn_decapsulate(const struct ip6_tnl *t,
 730					       const struct ipv6hdr *ipv6h,
 731					       struct sk_buff *skb)
 732{
 733	/* ECN is not supported in AF_MPLS */
 734	return 0;
 735}
 736
 737__u32 ip6_tnl_get_cap(struct ip6_tnl *t,
 738			     const struct in6_addr *laddr,
 739			     const struct in6_addr *raddr)
 740{
 741	struct __ip6_tnl_parm *p = &t->parms;
 742	int ltype = ipv6_addr_type(laddr);
 743	int rtype = ipv6_addr_type(raddr);
 744	__u32 flags = 0;
 745
 746	if (ltype == IPV6_ADDR_ANY || rtype == IPV6_ADDR_ANY) {
 747		flags = IP6_TNL_F_CAP_PER_PACKET;
 748	} else if (ltype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
 749		   rtype & (IPV6_ADDR_UNICAST|IPV6_ADDR_MULTICAST) &&
 750		   !((ltype|rtype) & IPV6_ADDR_LOOPBACK) &&
 751		   (!((ltype|rtype) & IPV6_ADDR_LINKLOCAL) || p->link)) {
 752		if (ltype&IPV6_ADDR_UNICAST)
 753			flags |= IP6_TNL_F_CAP_XMIT;
 754		if (rtype&IPV6_ADDR_UNICAST)
 755			flags |= IP6_TNL_F_CAP_RCV;
 756	}
 757	return flags;
 758}
 759EXPORT_SYMBOL(ip6_tnl_get_cap);
 760
 761/* called with rcu_read_lock() */
 762int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
 763				  const struct in6_addr *laddr,
 764				  const struct in6_addr *raddr)
 765{
 766	struct __ip6_tnl_parm *p = &t->parms;
 767	int ret = 0;
 768	struct net *net = t->net;
 769
 770	if ((p->flags & IP6_TNL_F_CAP_RCV) ||
 771	    ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
 772	     (ip6_tnl_get_cap(t, laddr, raddr) & IP6_TNL_F_CAP_RCV))) {
 773		struct net_device *ldev = NULL;
 774
 775		if (p->link)
 776			ldev = dev_get_by_index_rcu(net, p->link);
 777
 778		if ((ipv6_addr_is_multicast(laddr) ||
 779		     likely(ipv6_chk_addr_and_flags(net, laddr, ldev, false,
 780						    0, IFA_F_TENTATIVE))) &&
 781		    ((p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) ||
 782		     likely(!ipv6_chk_addr_and_flags(net, raddr, ldev, true,
 783						     0, IFA_F_TENTATIVE))))
 784			ret = 1;
 785	}
 786	return ret;
 787}
 788EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
 789
 790static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb,
 791			 const struct tnl_ptk_info *tpi,
 792			 struct metadata_dst *tun_dst,
 793			 int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
 794						const struct ipv6hdr *ipv6h,
 795						struct sk_buff *skb),
 796			 bool log_ecn_err)
 797{
 798	const struct ipv6hdr *ipv6h;
 799	int nh, err;
 
 800
 801	if ((!(tpi->flags & TUNNEL_CSUM) &&
 802	     (tunnel->parms.i_flags & TUNNEL_CSUM)) ||
 803	    ((tpi->flags & TUNNEL_CSUM) &&
 804	     !(tunnel->parms.i_flags & TUNNEL_CSUM))) {
 805		DEV_STATS_INC(tunnel->dev, rx_crc_errors);
 806		DEV_STATS_INC(tunnel->dev, rx_errors);
 807		goto drop;
 808	}
 809
 810	if (tunnel->parms.i_flags & TUNNEL_SEQ) {
 811		if (!(tpi->flags & TUNNEL_SEQ) ||
 812		    (tunnel->i_seqno &&
 813		     (s32)(ntohl(tpi->seq) - tunnel->i_seqno) < 0)) {
 814			DEV_STATS_INC(tunnel->dev, rx_fifo_errors);
 815			DEV_STATS_INC(tunnel->dev, rx_errors);
 816			goto drop;
 817		}
 818		tunnel->i_seqno = ntohl(tpi->seq) + 1;
 819	}
 820
 821	skb->protocol = tpi->proto;
 822
 823	/* Warning: All skb pointers will be invalidated! */
 824	if (tunnel->dev->type == ARPHRD_ETHER) {
 825		if (!pskb_may_pull(skb, ETH_HLEN)) {
 826			DEV_STATS_INC(tunnel->dev, rx_length_errors);
 827			DEV_STATS_INC(tunnel->dev, rx_errors);
 828			goto drop;
 829		}
 830
 
 831		skb->protocol = eth_type_trans(skb, tunnel->dev);
 832		skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 833	} else {
 834		skb->dev = tunnel->dev;
 835		skb_reset_mac_header(skb);
 836	}
 837
 838	/* Save offset of outer header relative to skb->head,
 839	 * because we are going to reset the network header to the inner header
 840	 * and might change skb->head.
 841	 */
 842	nh = skb_network_header(skb) - skb->head;
 843
 844	skb_reset_network_header(skb);
 845
 846	if (!pskb_inet_may_pull(skb)) {
 847		DEV_STATS_INC(tunnel->dev, rx_length_errors);
 848		DEV_STATS_INC(tunnel->dev, rx_errors);
 849		goto drop;
 850	}
 851
 852	/* Get the outer header. */
 853	ipv6h = (struct ipv6hdr *)(skb->head + nh);
 854
 855	memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
 856
 857	__skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
 858
 859	err = dscp_ecn_decapsulate(tunnel, ipv6h, skb);
 860	if (unlikely(err)) {
 861		if (log_ecn_err)
 862			net_info_ratelimited("non-ECT from %pI6 with DS=%#x\n",
 863					     &ipv6h->saddr,
 864					     ipv6_get_dsfield(ipv6h));
 865		if (err > 1) {
 866			DEV_STATS_INC(tunnel->dev, rx_frame_errors);
 867			DEV_STATS_INC(tunnel->dev, rx_errors);
 868			goto drop;
 869		}
 870	}
 871
 872	dev_sw_netstats_rx_add(tunnel->dev, skb->len);
 
 
 
 
 873
 874	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(tunnel->dev)));
 875
 876	if (tun_dst)
 877		skb_dst_set(skb, (struct dst_entry *)tun_dst);
 878
 879	gro_cells_receive(&tunnel->gro_cells, skb);
 880	return 0;
 881
 882drop:
 883	if (tun_dst)
 884		dst_release((struct dst_entry *)tun_dst);
 885	kfree_skb(skb);
 886	return 0;
 887}
 888
 889int ip6_tnl_rcv(struct ip6_tnl *t, struct sk_buff *skb,
 890		const struct tnl_ptk_info *tpi,
 891		struct metadata_dst *tun_dst,
 892		bool log_ecn_err)
 893{
 894	int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
 895				    const struct ipv6hdr *ipv6h,
 896				    struct sk_buff *skb);
 897
 898	dscp_ecn_decapsulate = ip6ip6_dscp_ecn_decapsulate;
 899	if (tpi->proto == htons(ETH_P_IP))
 900		dscp_ecn_decapsulate = ip4ip6_dscp_ecn_decapsulate;
 901
 902	return __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate,
 903			     log_ecn_err);
 904}
 905EXPORT_SYMBOL(ip6_tnl_rcv);
 906
 907static const struct tnl_ptk_info tpi_v6 = {
 908	/* no tunnel info required for ipxip6. */
 909	.proto = htons(ETH_P_IPV6),
 910};
 911
 912static const struct tnl_ptk_info tpi_v4 = {
 913	/* no tunnel info required for ipxip6. */
 914	.proto = htons(ETH_P_IP),
 915};
 916
 917static const struct tnl_ptk_info tpi_mpls = {
 918	/* no tunnel info required for mplsip6. */
 919	.proto = htons(ETH_P_MPLS_UC),
 920};
 921
 922static int ipxip6_rcv(struct sk_buff *skb, u8 ipproto,
 923		      const struct tnl_ptk_info *tpi,
 924		      int (*dscp_ecn_decapsulate)(const struct ip6_tnl *t,
 925						  const struct ipv6hdr *ipv6h,
 926						  struct sk_buff *skb))
 927{
 928	struct ip6_tnl *t;
 929	const struct ipv6hdr *ipv6h = ipv6_hdr(skb);
 930	struct metadata_dst *tun_dst = NULL;
 931	int ret = -1;
 932
 933	rcu_read_lock();
 934	t = ip6_tnl_lookup(dev_net(skb->dev), skb->dev->ifindex, &ipv6h->saddr, &ipv6h->daddr);
 935
 936	if (t) {
 937		u8 tproto = READ_ONCE(t->parms.proto);
 938
 939		if (tproto != ipproto && tproto != 0)
 940			goto drop;
 941		if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
 942			goto drop;
 943		ipv6h = ipv6_hdr(skb);
 944		if (!ip6_tnl_rcv_ctl(t, &ipv6h->daddr, &ipv6h->saddr))
 945			goto drop;
 946		if (iptunnel_pull_header(skb, 0, tpi->proto, false))
 947			goto drop;
 948		if (t->parms.collect_md) {
 949			tun_dst = ipv6_tun_rx_dst(skb, 0, 0, 0);
 950			if (!tun_dst)
 951				goto drop;
 952		}
 953		ret = __ip6_tnl_rcv(t, skb, tpi, tun_dst, dscp_ecn_decapsulate,
 954				    log_ecn_error);
 955	}
 956
 957	rcu_read_unlock();
 958
 959	return ret;
 960
 961drop:
 962	rcu_read_unlock();
 963	kfree_skb(skb);
 964	return 0;
 965}
 966
 967static int ip4ip6_rcv(struct sk_buff *skb)
 968{
 969	return ipxip6_rcv(skb, IPPROTO_IPIP, &tpi_v4,
 970			  ip4ip6_dscp_ecn_decapsulate);
 971}
 972
 973static int ip6ip6_rcv(struct sk_buff *skb)
 974{
 975	return ipxip6_rcv(skb, IPPROTO_IPV6, &tpi_v6,
 976			  ip6ip6_dscp_ecn_decapsulate);
 977}
 978
 979static int mplsip6_rcv(struct sk_buff *skb)
 980{
 981	return ipxip6_rcv(skb, IPPROTO_MPLS, &tpi_mpls,
 982			  mplsip6_dscp_ecn_decapsulate);
 983}
 984
 985struct ipv6_tel_txoption {
 986	struct ipv6_txoptions ops;
 987	__u8 dst_opt[8];
 988};
 989
 990static void init_tel_txopt(struct ipv6_tel_txoption *opt, __u8 encap_limit)
 991{
 992	memset(opt, 0, sizeof(struct ipv6_tel_txoption));
 993
 994	opt->dst_opt[2] = IPV6_TLV_TNL_ENCAP_LIMIT;
 995	opt->dst_opt[3] = 1;
 996	opt->dst_opt[4] = encap_limit;
 997	opt->dst_opt[5] = IPV6_TLV_PADN;
 998	opt->dst_opt[6] = 1;
 999
1000	opt->ops.dst1opt = (struct ipv6_opt_hdr *) opt->dst_opt;
1001	opt->ops.opt_nflen = 8;
1002}
1003
1004/**
1005 * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
1006 *   @t: the outgoing tunnel device
1007 *   @hdr: IPv6 header from the incoming packet
1008 *
1009 * Description:
1010 *   Avoid trivial tunneling loop by checking that tunnel exit-point
1011 *   doesn't match source of incoming packet.
1012 *
1013 * Return:
1014 *   1 if conflict,
1015 *   0 else
1016 **/
1017
1018static inline bool
1019ip6_tnl_addr_conflict(const struct ip6_tnl *t, const struct ipv6hdr *hdr)
1020{
1021	return ipv6_addr_equal(&t->parms.raddr, &hdr->saddr);
1022}
1023
1024int ip6_tnl_xmit_ctl(struct ip6_tnl *t,
1025		     const struct in6_addr *laddr,
1026		     const struct in6_addr *raddr)
1027{
1028	struct __ip6_tnl_parm *p = &t->parms;
1029	int ret = 0;
1030	struct net *net = t->net;
1031
1032	if (t->parms.collect_md)
1033		return 1;
1034
1035	if ((p->flags & IP6_TNL_F_CAP_XMIT) ||
1036	    ((p->flags & IP6_TNL_F_CAP_PER_PACKET) &&
1037	     (ip6_tnl_get_cap(t, laddr, raddr) & IP6_TNL_F_CAP_XMIT))) {
1038		struct net_device *ldev = NULL;
1039
1040		rcu_read_lock();
1041		if (p->link)
1042			ldev = dev_get_by_index_rcu(net, p->link);
1043
1044		if (unlikely(!ipv6_chk_addr_and_flags(net, laddr, ldev, false,
1045						      0, IFA_F_TENTATIVE)))
1046			pr_warn_ratelimited("%s xmit: Local address not yet configured!\n",
1047					    p->name);
1048		else if (!(p->flags & IP6_TNL_F_ALLOW_LOCAL_REMOTE) &&
1049			 !ipv6_addr_is_multicast(raddr) &&
1050			 unlikely(ipv6_chk_addr_and_flags(net, raddr, ldev,
1051							  true, 0, IFA_F_TENTATIVE)))
1052			pr_warn_ratelimited("%s xmit: Routing loop! Remote address found on this node!\n",
1053					    p->name);
1054		else
1055			ret = 1;
1056		rcu_read_unlock();
1057	}
1058	return ret;
1059}
1060EXPORT_SYMBOL_GPL(ip6_tnl_xmit_ctl);
1061
1062/**
1063 * ip6_tnl_xmit - encapsulate packet and send
1064 *   @skb: the outgoing socket buffer
1065 *   @dev: the outgoing tunnel device
1066 *   @dsfield: dscp code for outer header
1067 *   @fl6: flow of tunneled packet
1068 *   @encap_limit: encapsulation limit
1069 *   @pmtu: Path MTU is stored if packet is too big
1070 *   @proto: next header value
1071 *
1072 * Description:
1073 *   Build new header and do some sanity checks on the packet before sending
1074 *   it.
1075 *
1076 * Return:
1077 *   0 on success
1078 *   -1 fail
1079 *   %-EMSGSIZE message too big. return mtu in this case.
1080 **/
1081
1082int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,
1083		 struct flowi6 *fl6, int encap_limit, __u32 *pmtu,
1084		 __u8 proto)
1085{
1086	struct ip6_tnl *t = netdev_priv(dev);
1087	struct net *net = t->net;
 
1088	struct ipv6hdr *ipv6h;
1089	struct ipv6_tel_txoption opt;
1090	struct dst_entry *dst = NULL, *ndst = NULL;
1091	struct net_device *tdev;
1092	int mtu;
1093	unsigned int eth_hlen = t->dev->type == ARPHRD_ETHER ? ETH_HLEN : 0;
1094	unsigned int psh_hlen = sizeof(struct ipv6hdr) + t->encap_hlen;
1095	unsigned int max_headroom = psh_hlen;
1096	__be16 payload_protocol;
1097	bool use_cache = false;
1098	u8 hop_limit;
1099	int err = -1;
1100
1101	payload_protocol = skb_protocol(skb, true);
1102
1103	if (t->parms.collect_md) {
1104		hop_limit = skb_tunnel_info(skb)->key.ttl;
1105		goto route_lookup;
1106	} else {
1107		hop_limit = t->parms.hop_limit;
1108	}
1109
1110	/* NBMA tunnel */
1111	if (ipv6_addr_any(&t->parms.raddr)) {
1112		if (payload_protocol == htons(ETH_P_IPV6)) {
1113			struct in6_addr *addr6;
1114			struct neighbour *neigh;
1115			int addr_type;
1116
1117			if (!skb_dst(skb))
1118				goto tx_err_link_failure;
1119
1120			neigh = dst_neigh_lookup(skb_dst(skb),
1121						 &ipv6_hdr(skb)->daddr);
1122			if (!neigh)
1123				goto tx_err_link_failure;
1124
1125			addr6 = (struct in6_addr *)&neigh->primary_key;
1126			addr_type = ipv6_addr_type(addr6);
1127
1128			if (addr_type == IPV6_ADDR_ANY)
1129				addr6 = &ipv6_hdr(skb)->daddr;
1130
1131			memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr));
1132			neigh_release(neigh);
1133		} else if (payload_protocol == htons(ETH_P_IP)) {
1134			const struct rtable *rt = skb_rtable(skb);
1135
1136			if (!rt)
1137				goto tx_err_link_failure;
1138
1139			if (rt->rt_gw_family == AF_INET6)
1140				memcpy(&fl6->daddr, &rt->rt_gw6, sizeof(fl6->daddr));
1141		}
1142	} else if (t->parms.proto != 0 && !(t->parms.flags &
1143					    (IP6_TNL_F_USE_ORIG_TCLASS |
1144					     IP6_TNL_F_USE_ORIG_FWMARK))) {
1145		/* enable the cache only if neither the outer protocol nor the
1146		 * routing decision depends on the current inner header value
1147		 */
1148		use_cache = true;
1149	}
1150
1151	if (use_cache)
1152		dst = dst_cache_get(&t->dst_cache);
1153
1154	if (!ip6_tnl_xmit_ctl(t, &fl6->saddr, &fl6->daddr))
1155		goto tx_err_link_failure;
1156
1157	if (!dst) {
1158route_lookup:
1159		/* add dsfield to flowlabel for route lookup */
1160		fl6->flowlabel = ip6_make_flowinfo(dsfield, fl6->flowlabel);
1161
1162		dst = ip6_route_output(net, NULL, fl6);
1163
1164		if (dst->error)
1165			goto tx_err_link_failure;
1166		dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), NULL, 0);
1167		if (IS_ERR(dst)) {
1168			err = PTR_ERR(dst);
1169			dst = NULL;
1170			goto tx_err_link_failure;
1171		}
1172		if (t->parms.collect_md && ipv6_addr_any(&fl6->saddr) &&
1173		    ipv6_dev_get_saddr(net, ip6_dst_idev(dst)->dev,
1174				       &fl6->daddr, 0, &fl6->saddr))
1175			goto tx_err_link_failure;
1176		ndst = dst;
1177	}
1178
1179	tdev = dst->dev;
1180
1181	if (tdev == dev) {
1182		DEV_STATS_INC(dev, collisions);
1183		net_warn_ratelimited("%s: Local routing loop detected!\n",
1184				     t->parms.name);
1185		goto tx_err_dst_release;
1186	}
1187	mtu = dst_mtu(dst) - eth_hlen - psh_hlen - t->tun_hlen;
1188	if (encap_limit >= 0) {
1189		max_headroom += 8;
1190		mtu -= 8;
1191	}
1192	mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ?
1193		       IPV6_MIN_MTU : IPV4_MIN_MTU);
1194
1195	skb_dst_update_pmtu_no_confirm(skb, mtu);
1196	if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) {
1197		*pmtu = mtu;
1198		err = -EMSGSIZE;
1199		goto tx_err_dst_release;
1200	}
1201
1202	if (t->err_count > 0) {
1203		if (time_before(jiffies,
1204				t->err_time + IP6TUNNEL_ERR_TIMEO)) {
1205			t->err_count--;
1206
1207			dst_link_failure(skb);
1208		} else {
1209			t->err_count = 0;
1210		}
1211	}
1212
1213	skb_scrub_packet(skb, !net_eq(t->net, dev_net(dev)));
1214
1215	/*
1216	 * Okay, now see if we can stuff it in the buffer as-is.
1217	 */
1218	max_headroom += LL_RESERVED_SPACE(tdev);
1219
1220	if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
1221	    (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
1222		struct sk_buff *new_skb;
1223
1224		new_skb = skb_realloc_headroom(skb, max_headroom);
1225		if (!new_skb)
1226			goto tx_err_dst_release;
1227
1228		if (skb->sk)
1229			skb_set_owner_w(new_skb, skb->sk);
1230		consume_skb(skb);
1231		skb = new_skb;
1232	}
1233
1234	if (t->parms.collect_md) {
1235		if (t->encap.type != TUNNEL_ENCAP_NONE)
1236			goto tx_err_dst_release;
1237	} else {
1238		if (use_cache && ndst)
1239			dst_cache_set_ip6(&t->dst_cache, ndst, &fl6->saddr);
1240	}
1241	skb_dst_set(skb, dst);
1242
1243	if (hop_limit == 0) {
1244		if (payload_protocol == htons(ETH_P_IP))
1245			hop_limit = ip_hdr(skb)->ttl;
1246		else if (payload_protocol == htons(ETH_P_IPV6))
1247			hop_limit = ipv6_hdr(skb)->hop_limit;
1248		else
1249			hop_limit = ip6_dst_hoplimit(dst);
1250	}
1251
1252	/* Calculate max headroom for all the headers and adjust
1253	 * needed_headroom if necessary.
1254	 */
1255	max_headroom = LL_RESERVED_SPACE(dst->dev) + sizeof(struct ipv6hdr)
1256			+ dst->header_len + t->hlen;
1257	if (max_headroom > READ_ONCE(dev->needed_headroom))
1258		WRITE_ONCE(dev->needed_headroom, max_headroom);
1259
1260	err = ip6_tnl_encap(skb, t, &proto, fl6);
1261	if (err)
1262		return err;
1263
1264	if (encap_limit >= 0) {
1265		init_tel_txopt(&opt, encap_limit);
1266		ipv6_push_frag_opts(skb, &opt.ops, &proto);
1267	}
1268
 
 
1269	skb_push(skb, sizeof(struct ipv6hdr));
1270	skb_reset_network_header(skb);
1271	ipv6h = ipv6_hdr(skb);
1272	ip6_flow_hdr(ipv6h, dsfield,
1273		     ip6_make_flowlabel(net, skb, fl6->flowlabel, true, fl6));
1274	ipv6h->hop_limit = hop_limit;
1275	ipv6h->nexthdr = proto;
1276	ipv6h->saddr = fl6->saddr;
1277	ipv6h->daddr = fl6->daddr;
1278	ip6tunnel_xmit(NULL, skb, dev);
1279	return 0;
1280tx_err_link_failure:
1281	DEV_STATS_INC(dev, tx_carrier_errors);
1282	dst_link_failure(skb);
1283tx_err_dst_release:
1284	dst_release(dst);
1285	return err;
1286}
1287EXPORT_SYMBOL(ip6_tnl_xmit);
1288
1289static inline int
1290ipxip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev,
1291		u8 protocol)
1292{
1293	struct ip6_tnl *t = netdev_priv(dev);
1294	struct ipv6hdr *ipv6h;
1295	const struct iphdr  *iph;
1296	int encap_limit = -1;
1297	__u16 offset;
1298	struct flowi6 fl6;
1299	__u8 dsfield, orig_dsfield;
1300	__u32 mtu;
1301	u8 tproto;
1302	int err;
1303
1304	tproto = READ_ONCE(t->parms.proto);
1305	if (tproto != protocol && tproto != 0)
1306		return -1;
1307
1308	if (t->parms.collect_md) {
1309		struct ip_tunnel_info *tun_info;
1310		const struct ip_tunnel_key *key;
1311
1312		tun_info = skb_tunnel_info(skb);
1313		if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
1314			     ip_tunnel_info_af(tun_info) != AF_INET6))
1315			return -1;
1316		key = &tun_info->key;
1317		memset(&fl6, 0, sizeof(fl6));
1318		fl6.flowi6_proto = protocol;
1319		fl6.saddr = key->u.ipv6.src;
1320		fl6.daddr = key->u.ipv6.dst;
1321		fl6.flowlabel = key->label;
1322		dsfield =  key->tos;
1323		switch (protocol) {
1324		case IPPROTO_IPIP:
1325			iph = ip_hdr(skb);
1326			orig_dsfield = ipv4_get_dsfield(iph);
1327			break;
1328		case IPPROTO_IPV6:
1329			ipv6h = ipv6_hdr(skb);
1330			orig_dsfield = ipv6_get_dsfield(ipv6h);
1331			break;
1332		default:
1333			orig_dsfield = dsfield;
1334			break;
1335		}
1336	} else {
1337		if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1338			encap_limit = t->parms.encap_limit;
1339		if (protocol == IPPROTO_IPV6) {
1340			offset = ip6_tnl_parse_tlv_enc_lim(skb,
1341						skb_network_header(skb));
1342			/* ip6_tnl_parse_tlv_enc_lim() might have
1343			 * reallocated skb->head
1344			 */
1345			if (offset > 0) {
1346				struct ipv6_tlv_tnl_enc_lim *tel;
1347
1348				tel = (void *)&skb_network_header(skb)[offset];
1349				if (tel->encap_limit == 0) {
1350					icmpv6_ndo_send(skb, ICMPV6_PARAMPROB,
1351							ICMPV6_HDR_FIELD, offset + 2);
1352					return -1;
1353				}
1354				encap_limit = tel->encap_limit - 1;
1355			}
1356		}
1357
1358		memcpy(&fl6, &t->fl.u.ip6, sizeof(fl6));
1359		fl6.flowi6_proto = protocol;
1360
1361		if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
1362			fl6.flowi6_mark = skb->mark;
1363		else
1364			fl6.flowi6_mark = t->parms.fwmark;
1365		switch (protocol) {
1366		case IPPROTO_IPIP:
1367			iph = ip_hdr(skb);
1368			orig_dsfield = ipv4_get_dsfield(iph);
1369			if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1370				dsfield = orig_dsfield;
1371			else
1372				dsfield = ip6_tclass(t->parms.flowinfo);
1373			break;
1374		case IPPROTO_IPV6:
1375			ipv6h = ipv6_hdr(skb);
1376			orig_dsfield = ipv6_get_dsfield(ipv6h);
1377			if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
1378				dsfield = orig_dsfield;
1379			else
1380				dsfield = ip6_tclass(t->parms.flowinfo);
1381			if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
1382				fl6.flowlabel |= ip6_flowlabel(ipv6h);
1383			break;
1384		default:
1385			orig_dsfield = dsfield = ip6_tclass(t->parms.flowinfo);
1386			break;
1387		}
1388	}
1389
1390	fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
1391	dsfield = INET_ECN_encapsulate(dsfield, orig_dsfield);
1392
1393	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
1394		return -1;
1395
1396	skb_set_inner_ipproto(skb, protocol);
1397
1398	err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu,
1399			   protocol);
1400	if (err != 0) {
1401		/* XXX: send ICMP error even if DF is not set. */
1402		if (err == -EMSGSIZE)
1403			switch (protocol) {
1404			case IPPROTO_IPIP:
1405				icmp_ndo_send(skb, ICMP_DEST_UNREACH,
1406					      ICMP_FRAG_NEEDED, htonl(mtu));
1407				break;
1408			case IPPROTO_IPV6:
1409				icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
1410				break;
1411			default:
1412				break;
1413			}
1414		return -1;
1415	}
1416
1417	return 0;
1418}
1419
1420static netdev_tx_t
1421ip6_tnl_start_xmit(struct sk_buff *skb, struct net_device *dev)
1422{
1423	struct ip6_tnl *t = netdev_priv(dev);
 
1424	u8 ipproto;
1425	int ret;
1426
1427	if (!pskb_inet_may_pull(skb))
1428		goto tx_err;
1429
1430	switch (skb->protocol) {
1431	case htons(ETH_P_IP):
1432		ipproto = IPPROTO_IPIP;
1433		break;
1434	case htons(ETH_P_IPV6):
1435		if (ip6_tnl_addr_conflict(t, ipv6_hdr(skb)))
1436			goto tx_err;
1437		ipproto = IPPROTO_IPV6;
1438		break;
1439	case htons(ETH_P_MPLS_UC):
1440		ipproto = IPPROTO_MPLS;
1441		break;
1442	default:
1443		goto tx_err;
1444	}
1445
1446	ret = ipxip6_tnl_xmit(skb, dev, ipproto);
1447	if (ret < 0)
1448		goto tx_err;
1449
1450	return NETDEV_TX_OK;
1451
1452tx_err:
1453	DEV_STATS_INC(dev, tx_errors);
1454	DEV_STATS_INC(dev, tx_dropped);
1455	kfree_skb(skb);
1456	return NETDEV_TX_OK;
1457}
1458
1459static void ip6_tnl_link_config(struct ip6_tnl *t)
1460{
1461	struct net_device *dev = t->dev;
1462	struct net_device *tdev = NULL;
1463	struct __ip6_tnl_parm *p = &t->parms;
1464	struct flowi6 *fl6 = &t->fl.u.ip6;
 
1465	int t_hlen;
1466	int mtu;
1467
1468	__dev_addr_set(dev, &p->laddr, sizeof(struct in6_addr));
1469	memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr));
1470
1471	/* Set up flowi template */
1472	fl6->saddr = p->laddr;
1473	fl6->daddr = p->raddr;
1474	fl6->flowi6_oif = p->link;
1475	fl6->flowlabel = 0;
1476
1477	if (!(p->flags&IP6_TNL_F_USE_ORIG_TCLASS))
1478		fl6->flowlabel |= IPV6_TCLASS_MASK & p->flowinfo;
1479	if (!(p->flags&IP6_TNL_F_USE_ORIG_FLOWLABEL))
1480		fl6->flowlabel |= IPV6_FLOWLABEL_MASK & p->flowinfo;
1481
1482	p->flags &= ~(IP6_TNL_F_CAP_XMIT|IP6_TNL_F_CAP_RCV|IP6_TNL_F_CAP_PER_PACKET);
1483	p->flags |= ip6_tnl_get_cap(t, &p->laddr, &p->raddr);
1484
1485	if (p->flags&IP6_TNL_F_CAP_XMIT && p->flags&IP6_TNL_F_CAP_RCV)
1486		dev->flags |= IFF_POINTOPOINT;
1487	else
1488		dev->flags &= ~IFF_POINTOPOINT;
1489
1490	t->tun_hlen = 0;
1491	t->hlen = t->encap_hlen + t->tun_hlen;
1492	t_hlen = t->hlen + sizeof(struct ipv6hdr);
1493
1494	if (p->flags & IP6_TNL_F_CAP_XMIT) {
1495		int strict = (ipv6_addr_type(&p->raddr) &
1496			      (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
1497
1498		struct rt6_info *rt = rt6_lookup(t->net,
1499						 &p->raddr, &p->laddr,
1500						 p->link, NULL, strict);
1501		if (rt) {
1502			tdev = rt->dst.dev;
1503			ip6_rt_put(rt);
1504		}
1505
1506		if (!tdev && p->link)
1507			tdev = __dev_get_by_index(t->net, p->link);
1508
1509		if (tdev) {
1510			dev->hard_header_len = tdev->hard_header_len + t_hlen;
1511			mtu = min_t(unsigned int, tdev->mtu, IP6_MAX_MTU);
1512
1513			mtu = mtu - t_hlen;
1514			if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1515				mtu -= 8;
1516
1517			if (mtu < IPV6_MIN_MTU)
1518				mtu = IPV6_MIN_MTU;
1519			WRITE_ONCE(dev->mtu, mtu);
1520		}
1521	}
1522}
1523
1524/**
1525 * ip6_tnl_change - update the tunnel parameters
1526 *   @t: tunnel to be changed
1527 *   @p: tunnel configuration parameters
1528 *
1529 * Description:
1530 *   ip6_tnl_change() updates the tunnel parameters
1531 **/
1532
1533static void
1534ip6_tnl_change(struct ip6_tnl *t, const struct __ip6_tnl_parm *p)
1535{
1536	t->parms.laddr = p->laddr;
1537	t->parms.raddr = p->raddr;
1538	t->parms.flags = p->flags;
1539	t->parms.hop_limit = p->hop_limit;
1540	t->parms.encap_limit = p->encap_limit;
1541	t->parms.flowinfo = p->flowinfo;
1542	t->parms.link = p->link;
1543	t->parms.proto = p->proto;
1544	t->parms.fwmark = p->fwmark;
1545	dst_cache_reset(&t->dst_cache);
1546	ip6_tnl_link_config(t);
 
1547}
1548
1549static void ip6_tnl_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
1550{
1551	struct net *net = t->net;
1552	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
1553
1554	ip6_tnl_unlink(ip6n, t);
1555	synchronize_net();
1556	ip6_tnl_change(t, p);
1557	ip6_tnl_link(ip6n, t);
1558	netdev_state_change(t->dev);
 
1559}
1560
1561static void ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
1562{
1563	/* for default tnl0 device allow to change only the proto */
1564	t->parms.proto = p->proto;
1565	netdev_state_change(t->dev);
 
1566}
1567
1568static void
1569ip6_tnl_parm_from_user(struct __ip6_tnl_parm *p, const struct ip6_tnl_parm *u)
1570{
1571	p->laddr = u->laddr;
1572	p->raddr = u->raddr;
1573	p->flags = u->flags;
1574	p->hop_limit = u->hop_limit;
1575	p->encap_limit = u->encap_limit;
1576	p->flowinfo = u->flowinfo;
1577	p->link = u->link;
1578	p->proto = u->proto;
1579	memcpy(p->name, u->name, sizeof(u->name));
1580}
1581
1582static void
1583ip6_tnl_parm_to_user(struct ip6_tnl_parm *u, const struct __ip6_tnl_parm *p)
1584{
1585	u->laddr = p->laddr;
1586	u->raddr = p->raddr;
1587	u->flags = p->flags;
1588	u->hop_limit = p->hop_limit;
1589	u->encap_limit = p->encap_limit;
1590	u->flowinfo = p->flowinfo;
1591	u->link = p->link;
1592	u->proto = p->proto;
1593	memcpy(u->name, p->name, sizeof(u->name));
1594}
1595
1596/**
1597 * ip6_tnl_siocdevprivate - configure ipv6 tunnels from userspace
1598 *   @dev: virtual device associated with tunnel
1599 *   @ifr: unused
1600 *   @data: parameters passed from userspace
1601 *   @cmd: command to be performed
1602 *
1603 * Description:
1604 *   ip6_tnl_ioctl() is used for managing IPv6 tunnels
1605 *   from userspace.
1606 *
1607 *   The possible commands are the following:
1608 *     %SIOCGETTUNNEL: get tunnel parameters for device
1609 *     %SIOCADDTUNNEL: add tunnel matching given tunnel parameters
1610 *     %SIOCCHGTUNNEL: change tunnel parameters to those given
1611 *     %SIOCDELTUNNEL: delete tunnel
1612 *
1613 *   The fallback device "ip6tnl0", created during module
1614 *   initialization, can be used for creating other tunnel devices.
1615 *
1616 * Return:
1617 *   0 on success,
1618 *   %-EFAULT if unable to copy data to or from userspace,
1619 *   %-EPERM if current process hasn't %CAP_NET_ADMIN set
1620 *   %-EINVAL if passed tunnel parameters are invalid,
1621 *   %-EEXIST if changing a tunnel's parameters would cause a conflict
1622 *   %-ENODEV if attempting to change or delete a nonexisting device
1623 **/
1624
1625static int
1626ip6_tnl_siocdevprivate(struct net_device *dev, struct ifreq *ifr,
1627		       void __user *data, int cmd)
1628{
1629	int err = 0;
1630	struct ip6_tnl_parm p;
1631	struct __ip6_tnl_parm p1;
1632	struct ip6_tnl *t = netdev_priv(dev);
1633	struct net *net = t->net;
1634	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1635
1636	memset(&p1, 0, sizeof(p1));
1637
1638	switch (cmd) {
1639	case SIOCGETTUNNEL:
1640		if (dev == ip6n->fb_tnl_dev) {
1641			if (copy_from_user(&p, data, sizeof(p))) {
1642				err = -EFAULT;
1643				break;
1644			}
1645			ip6_tnl_parm_from_user(&p1, &p);
1646			t = ip6_tnl_locate(net, &p1, 0);
1647			if (IS_ERR(t))
1648				t = netdev_priv(dev);
1649		} else {
1650			memset(&p, 0, sizeof(p));
1651		}
1652		ip6_tnl_parm_to_user(&p, &t->parms);
1653		if (copy_to_user(data, &p, sizeof(p)))
1654			err = -EFAULT;
 
1655		break;
1656	case SIOCADDTUNNEL:
1657	case SIOCCHGTUNNEL:
1658		err = -EPERM;
1659		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1660			break;
1661		err = -EFAULT;
1662		if (copy_from_user(&p, data, sizeof(p)))
1663			break;
1664		err = -EINVAL;
1665		if (p.proto != IPPROTO_IPV6 && p.proto != IPPROTO_IPIP &&
1666		    p.proto != 0)
1667			break;
1668		ip6_tnl_parm_from_user(&p1, &p);
1669		t = ip6_tnl_locate(net, &p1, cmd == SIOCADDTUNNEL);
1670		if (cmd == SIOCCHGTUNNEL) {
1671			if (!IS_ERR(t)) {
1672				if (t->dev != dev) {
1673					err = -EEXIST;
1674					break;
1675				}
1676			} else
1677				t = netdev_priv(dev);
1678			if (dev == ip6n->fb_tnl_dev)
1679				ip6_tnl0_update(t, &p1);
1680			else
1681				ip6_tnl_update(t, &p1);
1682		}
1683		if (!IS_ERR(t)) {
1684			err = 0;
1685			ip6_tnl_parm_to_user(&p, &t->parms);
1686			if (copy_to_user(data, &p, sizeof(p)))
1687				err = -EFAULT;
1688
1689		} else {
1690			err = PTR_ERR(t);
1691		}
1692		break;
1693	case SIOCDELTUNNEL:
1694		err = -EPERM;
1695		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1696			break;
1697
1698		if (dev == ip6n->fb_tnl_dev) {
1699			err = -EFAULT;
1700			if (copy_from_user(&p, data, sizeof(p)))
1701				break;
1702			err = -ENOENT;
1703			ip6_tnl_parm_from_user(&p1, &p);
1704			t = ip6_tnl_locate(net, &p1, 0);
1705			if (IS_ERR(t))
1706				break;
1707			err = -EPERM;
1708			if (t->dev == ip6n->fb_tnl_dev)
1709				break;
1710			dev = t->dev;
1711		}
1712		err = 0;
1713		unregister_netdevice(dev);
1714		break;
1715	default:
1716		err = -EINVAL;
1717	}
1718	return err;
1719}
1720
1721/**
1722 * ip6_tnl_change_mtu - change mtu manually for tunnel device
1723 *   @dev: virtual device associated with tunnel
1724 *   @new_mtu: the new mtu
1725 *
1726 * Return:
1727 *   0 on success,
1728 *   %-EINVAL if mtu too small
1729 **/
1730
1731int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
1732{
1733	struct ip6_tnl *tnl = netdev_priv(dev);
1734
1735	if (tnl->parms.proto == IPPROTO_IPV6) {
1736		if (new_mtu < IPV6_MIN_MTU)
1737			return -EINVAL;
1738	} else {
1739		if (new_mtu < ETH_MIN_MTU)
1740			return -EINVAL;
1741	}
1742	if (tnl->parms.proto == IPPROTO_IPV6 || tnl->parms.proto == 0) {
1743		if (new_mtu > IP6_MAX_MTU - dev->hard_header_len)
1744			return -EINVAL;
1745	} else {
1746		if (new_mtu > IP_MAX_MTU - dev->hard_header_len)
1747			return -EINVAL;
1748	}
1749	dev->mtu = new_mtu;
1750	return 0;
1751}
1752EXPORT_SYMBOL(ip6_tnl_change_mtu);
1753
1754int ip6_tnl_get_iflink(const struct net_device *dev)
1755{
1756	struct ip6_tnl *t = netdev_priv(dev);
1757
1758	return READ_ONCE(t->parms.link);
1759}
1760EXPORT_SYMBOL(ip6_tnl_get_iflink);
1761
1762int ip6_tnl_encap_add_ops(const struct ip6_tnl_encap_ops *ops,
1763			  unsigned int num)
1764{
1765	if (num >= MAX_IPTUN_ENCAP_OPS)
1766		return -ERANGE;
1767
1768	return !cmpxchg((const struct ip6_tnl_encap_ops **)
1769			&ip6tun_encaps[num],
1770			NULL, ops) ? 0 : -1;
1771}
1772EXPORT_SYMBOL(ip6_tnl_encap_add_ops);
1773
1774int ip6_tnl_encap_del_ops(const struct ip6_tnl_encap_ops *ops,
1775			  unsigned int num)
1776{
1777	int ret;
1778
1779	if (num >= MAX_IPTUN_ENCAP_OPS)
1780		return -ERANGE;
1781
1782	ret = (cmpxchg((const struct ip6_tnl_encap_ops **)
1783		       &ip6tun_encaps[num],
1784		       ops, NULL) == ops) ? 0 : -1;
1785
1786	synchronize_net();
1787
1788	return ret;
1789}
1790EXPORT_SYMBOL(ip6_tnl_encap_del_ops);
1791
1792int ip6_tnl_encap_setup(struct ip6_tnl *t,
1793			struct ip_tunnel_encap *ipencap)
1794{
1795	int hlen;
1796
1797	memset(&t->encap, 0, sizeof(t->encap));
1798
1799	hlen = ip6_encap_hlen(ipencap);
1800	if (hlen < 0)
1801		return hlen;
1802
1803	t->encap.type = ipencap->type;
1804	t->encap.sport = ipencap->sport;
1805	t->encap.dport = ipencap->dport;
1806	t->encap.flags = ipencap->flags;
1807
1808	t->encap_hlen = hlen;
1809	t->hlen = t->encap_hlen + t->tun_hlen;
1810
1811	return 0;
1812}
1813EXPORT_SYMBOL_GPL(ip6_tnl_encap_setup);
1814
1815static const struct net_device_ops ip6_tnl_netdev_ops = {
1816	.ndo_init	= ip6_tnl_dev_init,
1817	.ndo_uninit	= ip6_tnl_dev_uninit,
1818	.ndo_start_xmit = ip6_tnl_start_xmit,
1819	.ndo_siocdevprivate = ip6_tnl_siocdevprivate,
1820	.ndo_change_mtu = ip6_tnl_change_mtu,
1821	.ndo_get_stats64 = dev_get_tstats64,
1822	.ndo_get_iflink = ip6_tnl_get_iflink,
1823};
1824
1825#define IPXIPX_FEATURES (NETIF_F_SG |		\
1826			 NETIF_F_FRAGLIST |	\
1827			 NETIF_F_HIGHDMA |	\
1828			 NETIF_F_GSO_SOFTWARE |	\
1829			 NETIF_F_HW_CSUM)
1830
1831/**
1832 * ip6_tnl_dev_setup - setup virtual tunnel device
1833 *   @dev: virtual device associated with tunnel
1834 *
1835 * Description:
1836 *   Initialize function pointers and device parameters
1837 **/
1838
1839static void ip6_tnl_dev_setup(struct net_device *dev)
1840{
1841	dev->netdev_ops = &ip6_tnl_netdev_ops;
1842	dev->header_ops = &ip_tunnel_header_ops;
1843	dev->needs_free_netdev = true;
1844	dev->priv_destructor = ip6_dev_free;
1845
1846	dev->type = ARPHRD_TUNNEL6;
1847	dev->flags |= IFF_NOARP;
1848	dev->addr_len = sizeof(struct in6_addr);
1849	dev->features |= NETIF_F_LLTX;
1850	dev->pcpu_stat_type = NETDEV_PCPU_STAT_TSTATS;
1851	netif_keep_dst(dev);
1852
1853	dev->features		|= IPXIPX_FEATURES;
1854	dev->hw_features	|= IPXIPX_FEATURES;
1855
1856	/* This perm addr will be used as interface identifier by IPv6 */
1857	dev->addr_assign_type = NET_ADDR_RANDOM;
1858	eth_random_addr(dev->perm_addr);
1859}
1860
1861
1862/**
1863 * ip6_tnl_dev_init_gen - general initializer for all tunnel devices
1864 *   @dev: virtual device associated with tunnel
1865 **/
1866
1867static inline int
1868ip6_tnl_dev_init_gen(struct net_device *dev)
1869{
1870	struct ip6_tnl *t = netdev_priv(dev);
1871	int ret;
1872	int t_hlen;
1873
1874	t->dev = dev;
1875	t->net = dev_net(dev);
 
 
 
1876
1877	ret = dst_cache_init(&t->dst_cache, GFP_KERNEL);
1878	if (ret)
1879		return ret;
1880
1881	ret = gro_cells_init(&t->gro_cells, dev);
1882	if (ret)
1883		goto destroy_dst;
1884
1885	t->tun_hlen = 0;
1886	t->hlen = t->encap_hlen + t->tun_hlen;
1887	t_hlen = t->hlen + sizeof(struct ipv6hdr);
1888
1889	dev->type = ARPHRD_TUNNEL6;
1890	dev->hard_header_len = LL_MAX_HEADER + t_hlen;
1891	dev->mtu = ETH_DATA_LEN - t_hlen;
1892	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1893		dev->mtu -= 8;
1894	dev->min_mtu = ETH_MIN_MTU;
1895	dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len;
1896
1897	netdev_hold(dev, &t->dev_tracker, GFP_KERNEL);
1898	netdev_lockdep_set_classes(dev);
1899	return 0;
1900
1901destroy_dst:
1902	dst_cache_destroy(&t->dst_cache);
 
 
 
1903
1904	return ret;
1905}
1906
1907/**
1908 * ip6_tnl_dev_init - initializer for all non fallback tunnel devices
1909 *   @dev: virtual device associated with tunnel
1910 **/
1911
1912static int ip6_tnl_dev_init(struct net_device *dev)
1913{
1914	struct ip6_tnl *t = netdev_priv(dev);
1915	int err = ip6_tnl_dev_init_gen(dev);
1916
1917	if (err)
1918		return err;
1919	ip6_tnl_link_config(t);
1920	if (t->parms.collect_md)
1921		netif_keep_dst(dev);
1922	return 0;
1923}
1924
1925/**
1926 * ip6_fb_tnl_dev_init - initializer for fallback tunnel device
1927 *   @dev: fallback device
1928 *
1929 * Return: 0
1930 **/
1931
1932static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
1933{
1934	struct ip6_tnl *t = netdev_priv(dev);
1935	struct net *net = dev_net(dev);
1936	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
1937
1938	t->parms.proto = IPPROTO_IPV6;
 
1939
1940	rcu_assign_pointer(ip6n->tnls_wc[0], t);
1941	return 0;
1942}
1943
1944static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[],
1945			    struct netlink_ext_ack *extack)
1946{
1947	u8 proto;
1948
1949	if (!data || !data[IFLA_IPTUN_PROTO])
1950		return 0;
1951
1952	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1953	if (proto != IPPROTO_IPV6 &&
1954	    proto != IPPROTO_IPIP &&
1955	    proto != 0)
1956		return -EINVAL;
1957
1958	return 0;
1959}
1960
1961static void ip6_tnl_netlink_parms(struct nlattr *data[],
1962				  struct __ip6_tnl_parm *parms)
1963{
1964	memset(parms, 0, sizeof(*parms));
1965
1966	if (!data)
1967		return;
1968
1969	if (data[IFLA_IPTUN_LINK])
1970		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
1971
1972	if (data[IFLA_IPTUN_LOCAL])
1973		parms->laddr = nla_get_in6_addr(data[IFLA_IPTUN_LOCAL]);
1974
1975	if (data[IFLA_IPTUN_REMOTE])
1976		parms->raddr = nla_get_in6_addr(data[IFLA_IPTUN_REMOTE]);
1977
1978	if (data[IFLA_IPTUN_TTL])
1979		parms->hop_limit = nla_get_u8(data[IFLA_IPTUN_TTL]);
1980
1981	if (data[IFLA_IPTUN_ENCAP_LIMIT])
1982		parms->encap_limit = nla_get_u8(data[IFLA_IPTUN_ENCAP_LIMIT]);
1983
1984	if (data[IFLA_IPTUN_FLOWINFO])
1985		parms->flowinfo = nla_get_be32(data[IFLA_IPTUN_FLOWINFO]);
1986
1987	if (data[IFLA_IPTUN_FLAGS])
1988		parms->flags = nla_get_u32(data[IFLA_IPTUN_FLAGS]);
1989
1990	if (data[IFLA_IPTUN_PROTO])
1991		parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1992
1993	if (data[IFLA_IPTUN_COLLECT_METADATA])
1994		parms->collect_md = true;
1995
1996	if (data[IFLA_IPTUN_FWMARK])
1997		parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
1998}
1999
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2000static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
2001			   struct nlattr *tb[], struct nlattr *data[],
2002			   struct netlink_ext_ack *extack)
2003{
2004	struct net *net = dev_net(dev);
2005	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
2006	struct ip_tunnel_encap ipencap;
2007	struct ip6_tnl *nt, *t;
2008	int err;
2009
2010	nt = netdev_priv(dev);
2011
2012	if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
2013		err = ip6_tnl_encap_setup(nt, &ipencap);
2014		if (err < 0)
2015			return err;
2016	}
2017
2018	ip6_tnl_netlink_parms(data, &nt->parms);
2019
2020	if (nt->parms.collect_md) {
2021		if (rtnl_dereference(ip6n->collect_md_tun))
2022			return -EEXIST;
2023	} else {
2024		t = ip6_tnl_locate(net, &nt->parms, 0);
2025		if (!IS_ERR(t))
2026			return -EEXIST;
2027	}
2028
2029	err = ip6_tnl_create2(dev);
2030	if (!err && tb[IFLA_MTU])
2031		ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU]));
2032
2033	return err;
2034}
2035
2036static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
2037			      struct nlattr *data[],
2038			      struct netlink_ext_ack *extack)
2039{
2040	struct ip6_tnl *t = netdev_priv(dev);
2041	struct __ip6_tnl_parm p;
2042	struct net *net = t->net;
2043	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
2044	struct ip_tunnel_encap ipencap;
2045
2046	if (dev == ip6n->fb_tnl_dev)
2047		return -EINVAL;
2048
2049	if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
2050		int err = ip6_tnl_encap_setup(t, &ipencap);
2051
2052		if (err < 0)
2053			return err;
2054	}
2055	ip6_tnl_netlink_parms(data, &p);
2056	if (p.collect_md)
2057		return -EINVAL;
2058
2059	t = ip6_tnl_locate(net, &p, 0);
2060	if (!IS_ERR(t)) {
2061		if (t->dev != dev)
2062			return -EEXIST;
2063	} else
2064		t = netdev_priv(dev);
2065
2066	ip6_tnl_update(t, &p);
2067	return 0;
2068}
2069
2070static void ip6_tnl_dellink(struct net_device *dev, struct list_head *head)
2071{
2072	struct net *net = dev_net(dev);
2073	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
2074
2075	if (dev != ip6n->fb_tnl_dev)
2076		unregister_netdevice_queue(dev, head);
2077}
2078
2079static size_t ip6_tnl_get_size(const struct net_device *dev)
2080{
2081	return
2082		/* IFLA_IPTUN_LINK */
2083		nla_total_size(4) +
2084		/* IFLA_IPTUN_LOCAL */
2085		nla_total_size(sizeof(struct in6_addr)) +
2086		/* IFLA_IPTUN_REMOTE */
2087		nla_total_size(sizeof(struct in6_addr)) +
2088		/* IFLA_IPTUN_TTL */
2089		nla_total_size(1) +
2090		/* IFLA_IPTUN_ENCAP_LIMIT */
2091		nla_total_size(1) +
2092		/* IFLA_IPTUN_FLOWINFO */
2093		nla_total_size(4) +
2094		/* IFLA_IPTUN_FLAGS */
2095		nla_total_size(4) +
2096		/* IFLA_IPTUN_PROTO */
2097		nla_total_size(1) +
2098		/* IFLA_IPTUN_ENCAP_TYPE */
2099		nla_total_size(2) +
2100		/* IFLA_IPTUN_ENCAP_FLAGS */
2101		nla_total_size(2) +
2102		/* IFLA_IPTUN_ENCAP_SPORT */
2103		nla_total_size(2) +
2104		/* IFLA_IPTUN_ENCAP_DPORT */
2105		nla_total_size(2) +
2106		/* IFLA_IPTUN_COLLECT_METADATA */
2107		nla_total_size(0) +
2108		/* IFLA_IPTUN_FWMARK */
2109		nla_total_size(4) +
2110		0;
2111}
2112
2113static int ip6_tnl_fill_info(struct sk_buff *skb, const struct net_device *dev)
2114{
2115	struct ip6_tnl *tunnel = netdev_priv(dev);
2116	struct __ip6_tnl_parm *parm = &tunnel->parms;
2117
2118	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
2119	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
2120	    nla_put_in6_addr(skb, IFLA_IPTUN_REMOTE, &parm->raddr) ||
2121	    nla_put_u8(skb, IFLA_IPTUN_TTL, parm->hop_limit) ||
2122	    nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
2123	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
2124	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
2125	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
2126	    nla_put_u32(skb, IFLA_IPTUN_FWMARK, parm->fwmark))
2127		goto nla_put_failure;
2128
2129	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
2130	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
2131	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
2132	    nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS, tunnel->encap.flags))
2133		goto nla_put_failure;
2134
2135	if (parm->collect_md)
2136		if (nla_put_flag(skb, IFLA_IPTUN_COLLECT_METADATA))
2137			goto nla_put_failure;
2138
2139	return 0;
2140
2141nla_put_failure:
2142	return -EMSGSIZE;
2143}
2144
2145struct net *ip6_tnl_get_link_net(const struct net_device *dev)
2146{
2147	struct ip6_tnl *tunnel = netdev_priv(dev);
2148
2149	return tunnel->net;
2150}
2151EXPORT_SYMBOL(ip6_tnl_get_link_net);
2152
2153static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
2154	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
2155	[IFLA_IPTUN_LOCAL]		= { .len = sizeof(struct in6_addr) },
2156	[IFLA_IPTUN_REMOTE]		= { .len = sizeof(struct in6_addr) },
2157	[IFLA_IPTUN_TTL]		= { .type = NLA_U8 },
2158	[IFLA_IPTUN_ENCAP_LIMIT]	= { .type = NLA_U8 },
2159	[IFLA_IPTUN_FLOWINFO]		= { .type = NLA_U32 },
2160	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U32 },
2161	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
2162	[IFLA_IPTUN_ENCAP_TYPE]		= { .type = NLA_U16 },
2163	[IFLA_IPTUN_ENCAP_FLAGS]	= { .type = NLA_U16 },
2164	[IFLA_IPTUN_ENCAP_SPORT]	= { .type = NLA_U16 },
2165	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
2166	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
2167	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
2168};
2169
2170static struct rtnl_link_ops ip6_link_ops __read_mostly = {
2171	.kind		= "ip6tnl",
2172	.maxtype	= IFLA_IPTUN_MAX,
2173	.policy		= ip6_tnl_policy,
2174	.priv_size	= sizeof(struct ip6_tnl),
2175	.setup		= ip6_tnl_dev_setup,
2176	.validate	= ip6_tnl_validate,
2177	.newlink	= ip6_tnl_newlink,
2178	.changelink	= ip6_tnl_changelink,
2179	.dellink	= ip6_tnl_dellink,
2180	.get_size	= ip6_tnl_get_size,
2181	.fill_info	= ip6_tnl_fill_info,
2182	.get_link_net	= ip6_tnl_get_link_net,
2183};
2184
2185static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
2186	.handler	= ip4ip6_rcv,
2187	.err_handler	= ip4ip6_err,
2188	.priority	=	1,
2189};
2190
2191static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
2192	.handler	= ip6ip6_rcv,
2193	.err_handler	= ip6ip6_err,
2194	.priority	=	1,
2195};
2196
2197static struct xfrm6_tunnel mplsip6_handler __read_mostly = {
2198	.handler	= mplsip6_rcv,
2199	.err_handler	= mplsip6_err,
2200	.priority	=	1,
2201};
2202
2203static void __net_exit ip6_tnl_destroy_tunnels(struct net *net, struct list_head *list)
2204{
2205	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
2206	struct net_device *dev, *aux;
2207	int h;
2208	struct ip6_tnl *t;
2209
2210	for_each_netdev_safe(net, dev, aux)
2211		if (dev->rtnl_link_ops == &ip6_link_ops)
2212			unregister_netdevice_queue(dev, list);
2213
2214	for (h = 0; h < IP6_TUNNEL_HASH_SIZE; h++) {
2215		t = rtnl_dereference(ip6n->tnls_r_l[h]);
2216		while (t) {
2217			/* If dev is in the same netns, it has already
2218			 * been added to the list by the previous loop.
2219			 */
2220			if (!net_eq(dev_net(t->dev), net))
2221				unregister_netdevice_queue(t->dev, list);
2222			t = rtnl_dereference(t->next);
2223		}
2224	}
2225
2226	t = rtnl_dereference(ip6n->tnls_wc[0]);
2227	while (t) {
2228		/* If dev is in the same netns, it has already
2229		 * been added to the list by the previous loop.
2230		 */
2231		if (!net_eq(dev_net(t->dev), net))
2232			unregister_netdevice_queue(t->dev, list);
2233		t = rtnl_dereference(t->next);
2234	}
2235}
2236
2237static int __net_init ip6_tnl_init_net(struct net *net)
2238{
2239	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
2240	struct ip6_tnl *t = NULL;
2241	int err;
2242
2243	ip6n->tnls[0] = ip6n->tnls_wc;
2244	ip6n->tnls[1] = ip6n->tnls_r_l;
2245
2246	if (!net_has_fallback_tunnels(net))
2247		return 0;
2248	err = -ENOMEM;
2249	ip6n->fb_tnl_dev = alloc_netdev(sizeof(struct ip6_tnl), "ip6tnl0",
2250					NET_NAME_UNKNOWN, ip6_tnl_dev_setup);
2251
2252	if (!ip6n->fb_tnl_dev)
2253		goto err_alloc_dev;
2254	dev_net_set(ip6n->fb_tnl_dev, net);
2255	ip6n->fb_tnl_dev->rtnl_link_ops = &ip6_link_ops;
2256	/* FB netdevice is special: we have one, and only one per netns.
2257	 * Allowing to move it to another netns is clearly unsafe.
2258	 */
2259	ip6n->fb_tnl_dev->features |= NETIF_F_NETNS_LOCAL;
2260
2261	err = ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
2262	if (err < 0)
2263		goto err_register;
2264
2265	err = register_netdev(ip6n->fb_tnl_dev);
2266	if (err < 0)
2267		goto err_register;
2268
2269	t = netdev_priv(ip6n->fb_tnl_dev);
2270
2271	strcpy(t->parms.name, ip6n->fb_tnl_dev->name);
2272	return 0;
2273
2274err_register:
2275	free_netdev(ip6n->fb_tnl_dev);
2276err_alloc_dev:
2277	return err;
2278}
2279
2280static void __net_exit ip6_tnl_exit_batch_rtnl(struct list_head *net_list,
2281					       struct list_head *dev_to_kill)
2282{
2283	struct net *net;
 
2284
2285	ASSERT_RTNL();
2286	list_for_each_entry(net, net_list, exit_list)
2287		ip6_tnl_destroy_tunnels(net, dev_to_kill);
 
 
2288}
2289
2290static struct pernet_operations ip6_tnl_net_ops = {
2291	.init = ip6_tnl_init_net,
2292	.exit_batch_rtnl = ip6_tnl_exit_batch_rtnl,
2293	.id   = &ip6_tnl_net_id,
2294	.size = sizeof(struct ip6_tnl_net),
2295};
2296
2297/**
2298 * ip6_tunnel_init - register protocol and reserve needed resources
2299 *
2300 * Return: 0 on success
2301 **/
2302
2303static int __init ip6_tunnel_init(void)
2304{
2305	int  err;
2306
2307	if (!ipv6_mod_enabled())
2308		return -EOPNOTSUPP;
2309
2310	err = register_pernet_device(&ip6_tnl_net_ops);
2311	if (err < 0)
2312		goto out_pernet;
2313
2314	err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
2315	if (err < 0) {
2316		pr_err("%s: can't register ip4ip6\n", __func__);
2317		goto out_ip4ip6;
2318	}
2319
2320	err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
2321	if (err < 0) {
2322		pr_err("%s: can't register ip6ip6\n", __func__);
2323		goto out_ip6ip6;
2324	}
2325
2326	if (ip6_tnl_mpls_supported()) {
2327		err = xfrm6_tunnel_register(&mplsip6_handler, AF_MPLS);
2328		if (err < 0) {
2329			pr_err("%s: can't register mplsip6\n", __func__);
2330			goto out_mplsip6;
2331		}
2332	}
2333
2334	err = rtnl_link_register(&ip6_link_ops);
2335	if (err < 0)
2336		goto rtnl_link_failed;
2337
2338	return 0;
2339
2340rtnl_link_failed:
2341	if (ip6_tnl_mpls_supported())
2342		xfrm6_tunnel_deregister(&mplsip6_handler, AF_MPLS);
2343out_mplsip6:
2344	xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
2345out_ip6ip6:
2346	xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
2347out_ip4ip6:
2348	unregister_pernet_device(&ip6_tnl_net_ops);
2349out_pernet:
2350	return err;
2351}
2352
2353/**
2354 * ip6_tunnel_cleanup - free resources and unregister protocol
2355 **/
2356
2357static void __exit ip6_tunnel_cleanup(void)
2358{
2359	rtnl_link_unregister(&ip6_link_ops);
2360	if (xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET))
2361		pr_info("%s: can't deregister ip4ip6\n", __func__);
2362
2363	if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
2364		pr_info("%s: can't deregister ip6ip6\n", __func__);
2365
2366	if (ip6_tnl_mpls_supported() &&
2367	    xfrm6_tunnel_deregister(&mplsip6_handler, AF_MPLS))
2368		pr_info("%s: can't deregister mplsip6\n", __func__);
2369	unregister_pernet_device(&ip6_tnl_net_ops);
2370}
2371
2372module_init(ip6_tunnel_init);
2373module_exit(ip6_tunnel_cleanup);