net/ipv4/ip_gre.c

   1 /*
   2  *      Linux NET3:     GRE over IP protocol decoder.
   3  *
   4  *      Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
   5  *
   6  *      This program is free software; you can redistribute it and/or
   7  *      modify it under the terms of the GNU General Public License
   8  *      as published by the Free Software Foundation; either version
   9  *      2 of the License, or (at your option) any later version.
  10  *
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14
  15 #include <linux/capability.h>
  16 #include <linux/module.h>
  17 #include <linux/types.h>
  18 #include <linux/kernel.h>
  19 #include <linux/slab.h>
  20 #include <asm/uaccess.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netdevice.h>
  23 #include <linux/in.h>
  24 #include <linux/tcp.h>
  25 #include <linux/udp.h>
  26 #include <linux/if_arp.h>
  27 #include <linux/mroute.h>
  28 #include <linux/init.h>
  29 #include <linux/in6.h>
  30 #include <linux/inetdevice.h>
  31 #include <linux/igmp.h>
  32 #include <linux/netfilter_ipv4.h>
  33 #include <linux/etherdevice.h>
  34 #include <linux/if_ether.h>
  35
  36 #include <net/sock.h>
  37 #include <net/ip.h>
  38 #include <net/icmp.h>
  39 #include <net/protocol.h>
  40 #include <net/ipip.h>
  41 #include <net/arp.h>
  42 #include <net/checksum.h>
  43 #include <net/dsfield.h>
  44 #include <net/inet_ecn.h>
  45 #include <net/xfrm.h>
  46 #include <net/net_namespace.h>
  47 #include <net/netns/generic.h>
  48 #include <net/rtnetlink.h>
  49 #include <net/gre.h>
  50
  51 #if IS_ENABLED(CONFIG_IPV6)
  52 #include <net/ipv6.h>
  53 #include <net/ip6_fib.h>
  54 #include <net/ip6_route.h>
  55 #endif
  56
  57 /*
  58    Problems & solutions
  59    --------------------
  60
  61    1. The most important issue is detecting local dead loops.
  62    They would cause complete host lockup in transmit, which
  63    would be "resolved" by stack overflow or, if queueing is enabled,
  64    with infinite looping in net_bh.
  65
  66    We cannot track such dead loops during route installation,
  67    it is infeasible task. The most general solutions would be
  68    to keep skb->encapsulation counter (sort of local ttl),
  69    and silently drop packet when it expires. It is a good
  70    solution, but it supposes maintaining new variable in ALL
  71    skb, even if no tunneling is used.
  72
  73    Current solution: xmit_recursion breaks dead loops. This is a percpu
  74    counter, since when we enter the first ndo_xmit(), cpu migration is
  75    forbidden. We force an exit if this counter reaches RECURSION_LIMIT
  76
  77    2. Networking dead loops would not kill routers, but would really
  78    kill network. IP hop limit plays role of "t->recursion" in this case,
  79    if we copy it from packet being encapsulated to upper header.
  80    It is very good solution, but it introduces two problems:
  81
  82    - Routing protocols, using packets with ttl=1 (OSPF, RIP2),
  83      do not work over tunnels.
  84    - traceroute does not work. I planned to relay ICMP from tunnel,
  85      so that this problem would be solved and traceroute output
  86      would even more informative. This idea appeared to be wrong:
  87      only Linux complies to rfc1812 now (yes, guys, Linux is the only
  88      true router now :-)), all routers (at least, in neighbourhood of mine)
  89      return only 8 bytes of payload. It is the end.
  90
  91    Hence, if we want that OSPF worked or traceroute said something reasonable,
  92    we should search for another solution.
  93
  94    One of them is to parse packet trying to detect inner encapsulation
  95    made by our node. It is difficult or even impossible, especially,
  96    taking into account fragmentation. TO be short, ttl is not solution at all.
  97
  98    Current solution: The solution was UNEXPECTEDLY SIMPLE.
  99    We force DF flag on tunnels with preconfigured hop limit,
 100    that is ALL. :-) Well, it does not remove the problem completely,
 101    but exponential growth of network traffic is changed to linear
 102    (branches, that exceed pmtu are pruned) and tunnel mtu
 103    rapidly degrades to value <68, where looping stops.
 104    Yes, it is not good if there exists a router in the loop,
 105    which does not force DF, even when encapsulating packets have DF set.
 106    But it is not our problem! Nobody could accuse us, we made
 107    all that we could make. Even if it is your gated who injected
 108    fatal route to network, even if it were you who configured
 109    fatal static route: you are innocent. :-)
 110
 111
 112
 113    3. Really, ipv4/ipip.c, ipv4/ip_gre.c and ipv6/sit.c contain
 114    practically identical code. It would be good to glue them
 115    together, but it is not very evident, how to make them modular.
 116    sit is integral part of IPv6, ipip and gre are naturally modular.
 117    We could extract common parts (hash table, ioctl etc)
 118    to a separate module (ip_tunnel.c).
 119
 120    Alexey Kuznetsov.
 121  */
 122
 123 static bool log_ecn_error = true;
 124 module_param(log_ecn_error, bool, 0644);
 125 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
 126
 127 static struct rtnl_link_ops ipgre_link_ops __read_mostly;
 128 static int ipgre_tunnel_init(struct net_device *dev);
 129 static void ipgre_tunnel_setup(struct net_device *dev);
 130 static int ipgre_tunnel_bind_dev(struct net_device *dev);
 131
 132 /* Fallback tunnel: no source, no destination, no key, no options */
 133
 134 #define HASH_SIZE  16
 135
 136 static int ipgre_net_id __read_mostly;
 137 struct ipgre_net {
 138         struct ip_tunnel __rcu *tunnels[4][HASH_SIZE];
 139
 140         struct net_device *fb_tunnel_dev;
 141 };
 142
 143 /* Tunnel hash table */
 144
 145 /*
 146    4 hash tables:
 147
 148    3: (remote,local)
 149    2: (remote,*)
 150    1: (*,local)
 151    0: (*,*)
 152
 153    We require exact key match i.e. if a key is present in packet
 154    it will match only tunnel with the same key; if it is not present,
 155    it will match only keyless tunnel.
 156
 157    All keysless packets, if not matched configured keyless tunnels
 158    will match fallback tunnel.
 159  */
 160
 161 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 162
 163 #define tunnels_r_l     tunnels[3]
 164 #define tunnels_r       tunnels[2]
 165 #define tunnels_l       tunnels[1]
 166 #define tunnels_wc      tunnels[0]
 167
 168 static struct rtnl_link_stats64 *ipgre_get_stats64(struct net_device *dev,
 169                                                    struct rtnl_link_stats64 *tot)
 170 {
 171         int i;
 172
 173         for_each_possible_cpu(i) {
 174                 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
 175                 u64 rx_packets, rx_bytes, tx_packets, tx_bytes;
 176                 unsigned int start;
 177
 178                 do {
 179                         start = u64_stats_fetch_begin_bh(&tstats->syncp);
 180                         rx_packets = tstats->rx_packets;
 181                         tx_packets = tstats->tx_packets;
 182                         rx_bytes = tstats->rx_bytes;
 183                         tx_bytes = tstats->tx_bytes;
 184                 } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
 185
 186                 tot->rx_packets += rx_packets;
 187                 tot->tx_packets += tx_packets;
 188                 tot->rx_bytes   += rx_bytes;
 189                 tot->tx_bytes   += tx_bytes;
 190         }
 191
 192         tot->multicast = dev->stats.multicast;
 193         tot->rx_crc_errors = dev->stats.rx_crc_errors;
 194         tot->rx_fifo_errors = dev->stats.rx_fifo_errors;
 195         tot->rx_length_errors = dev->stats.rx_length_errors;
 196         tot->rx_frame_errors = dev->stats.rx_frame_errors;
 197         tot->rx_errors = dev->stats.rx_errors;
 198
 199         tot->tx_fifo_errors = dev->stats.tx_fifo_errors;
 200         tot->tx_carrier_errors = dev->stats.tx_carrier_errors;
 201         tot->tx_dropped = dev->stats.tx_dropped;
 202         tot->tx_aborted_errors = dev->stats.tx_aborted_errors;
 203         tot->tx_errors = dev->stats.tx_errors;
 204
 205         return tot;
 206 }
 207
 208 /* Does key in tunnel parameters match packet */
 209 static bool ipgre_key_match(const struct ip_tunnel_parm *p,
 210                             __be16 flags, __be32 key)
 211 {
 212         if (p->i_flags & GRE_KEY) {
 213                 if (flags & GRE_KEY)
 214                         return key == p->i_key;
 215                 else
 216                         return false;   /* key expected, none present */
 217         } else
 218                 return !(flags & GRE_KEY);
 219 }
 220
 221 /* Given src, dst and key, find appropriate for input tunnel. */
 222
 223 static struct ip_tunnel *ipgre_tunnel_lookup(struct net_device *dev,
 224                                              __be32 remote, __be32 local,
 225                                              __be16 flags, __be32 key,
 226                                              __be16 gre_proto)
 227 {
 228         struct net *net = dev_net(dev);
 229         int link = dev->ifindex;
 230         unsigned int h0 = HASH(remote);
 231         unsigned int h1 = HASH(key);
 232         struct ip_tunnel *t, *cand = NULL;
 233         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
 234         int dev_type = (gre_proto == htons(ETH_P_TEB)) ?
 235                        ARPHRD_ETHER : ARPHRD_IPGRE;
 236         int score, cand_score = 4;
 237
 238         for_each_ip_tunnel_rcu(t, ign->tunnels_r_l[h0 ^ h1]) {
 239                 if (local != t->parms.iph.saddr ||
 240                     remote != t->parms.iph.daddr ||
 241                     !(t->dev->flags & IFF_UP))
 242                         continue;
 243
 244                 if (!ipgre_key_match(&t->parms, flags, key))
 245                         continue;
 246
 247                 if (t->dev->type != ARPHRD_IPGRE &&
 248                     t->dev->type != dev_type)
 249                         continue;
 250
 251                 score = 0;
 252                 if (t->parms.link != link)
 253                         score |= 1;
 254                 if (t->dev->type != dev_type)
 255                         score |= 2;
 256                 if (score == 0)
 257                         return t;
 258
 259                 if (score < cand_score) {
 260                         cand = t;
 261                         cand_score = score;
 262                 }
 263         }
 264
 265         for_each_ip_tunnel_rcu(t, ign->tunnels_r[h0 ^ h1]) {
 266                 if (remote != t->parms.iph.daddr ||
 267                     !(t->dev->flags & IFF_UP))
 268                         continue;
 269
 270                 if (!ipgre_key_match(&t->parms, flags, key))
 271                         continue;
 272
 273                 if (t->dev->type != ARPHRD_IPGRE &&
 274                     t->dev->type != dev_type)
 275                         continue;
 276
 277                 score = 0;
 278                 if (t->parms.link != link)
 279                         score |= 1;
 280                 if (t->dev->type != dev_type)
 281                         score |= 2;
 282                 if (score == 0)
 283                         return t;
 284
 285                 if (score < cand_score) {
 286                         cand = t;
 287                         cand_score = score;
 288                 }
 289         }
 290
 291         for_each_ip_tunnel_rcu(t, ign->tunnels_l[h1]) {
 292                 if ((local != t->parms.iph.saddr &&
 293                      (local != t->parms.iph.daddr ||
 294                       !ipv4_is_multicast(local))) ||
 295                     !(t->dev->flags & IFF_UP))
 296                         continue;
 297
 298                 if (!ipgre_key_match(&t->parms, flags, key))
 299                         continue;
 300
 301                 if (t->dev->type != ARPHRD_IPGRE &&
 302                     t->dev->type != dev_type)
 303                         continue;
 304
 305                 score = 0;
 306                 if (t->parms.link != link)
 307                         score |= 1;
 308                 if (t->dev->type != dev_type)
 309                         score |= 2;
 310                 if (score == 0)
 311                         return t;
 312
 313                 if (score < cand_score) {
 314                         cand = t;
 315                         cand_score = score;
 316                 }
 317         }
 318
 319         for_each_ip_tunnel_rcu(t, ign->tunnels_wc[h1]) {
 320                 if (t->parms.i_key != key ||
 321                     !(t->dev->flags & IFF_UP))
 322                         continue;
 323
 324                 if (t->dev->type != ARPHRD_IPGRE &&
 325                     t->dev->type != dev_type)
 326                         continue;
 327
 328                 score = 0;
 329                 if (t->parms.link != link)
 330                         score |= 1;
 331                 if (t->dev->type != dev_type)
 332                         score |= 2;
 333                 if (score == 0)
 334                         return t;
 335
 336                 if (score < cand_score) {
 337                         cand = t;
 338                         cand_score = score;
 339                 }
 340         }
 341
 342         if (cand != NULL)
 343                 return cand;
 344
 345         dev = ign->fb_tunnel_dev;
 346         if (dev->flags & IFF_UP)
 347                 return netdev_priv(dev);
 348
 349         return NULL;
 350 }
 351
 352 static struct ip_tunnel __rcu **__ipgre_bucket(struct ipgre_net *ign,
 353                 struct ip_tunnel_parm *parms)
 354 {
 355         __be32 remote = parms->iph.daddr;
 356         __be32 local = parms->iph.saddr;
 357         __be32 key = parms->i_key;
 358         unsigned int h = HASH(key);
 359         int prio = 0;
 360
 361         if (local)
 362                 prio |= 1;
 363         if (remote && !ipv4_is_multicast(remote)) {
 364                 prio |= 2;
 365                 h ^= HASH(remote);
 366         }
 367
 368         return &ign->tunnels[prio][h];
 369 }
 370
 371 static inline struct ip_tunnel __rcu **ipgre_bucket(struct ipgre_net *ign,
 372                 struct ip_tunnel *t)
 373 {
 374         return __ipgre_bucket(ign, &t->parms);
 375 }
 376
 377 static void ipgre_tunnel_link(struct ipgre_net *ign, struct ip_tunnel *t)
 378 {
 379         struct ip_tunnel __rcu **tp = ipgre_bucket(ign, t);
 380
 381         rcu_assign_pointer(t->next, rtnl_dereference(*tp));
 382         rcu_assign_pointer(*tp, t);
 383 }
 384
 385 static void ipgre_tunnel_unlink(struct ipgre_net *ign, struct ip_tunnel *t)
 386 {
 387         struct ip_tunnel __rcu **tp;
 388         struct ip_tunnel *iter;
 389
 390         for (tp = ipgre_bucket(ign, t);
 391              (iter = rtnl_dereference(*tp)) != NULL;
 392              tp = &iter->next) {
 393                 if (t == iter) {
 394                         rcu_assign_pointer(*tp, t->next);
 395                         break;
 396                 }
 397         }
 398 }
 399
 400 static struct ip_tunnel *ipgre_tunnel_find(struct net *net,
 401                                            struct ip_tunnel_parm *parms,
 402                                            int type)
 403 {
 404         __be32 remote = parms->iph.daddr;
 405         __be32 local = parms->iph.saddr;
 406         __be32 key = parms->i_key;
 407         int link = parms->link;
 408         struct ip_tunnel *t;
 409         struct ip_tunnel __rcu **tp;
 410         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
 411
 412         for (tp = __ipgre_bucket(ign, parms);
 413              (t = rtnl_dereference(*tp)) != NULL;
 414              tp = &t->next)
 415                 if (local == t->parms.iph.saddr &&
 416                     remote == t->parms.iph.daddr &&
 417                     key == t->parms.i_key &&
 418                     link == t->parms.link &&
 419                     type == t->dev->type)
 420                         break;
 421
 422         return t;
 423 }
 424
 425 static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
 426                 struct ip_tunnel_parm *parms, int create)
 427 {
 428         struct ip_tunnel *t, *nt;
 429         struct net_device *dev;
 430         char name[IFNAMSIZ];
 431         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
 432
 433         t = ipgre_tunnel_find(net, parms, ARPHRD_IPGRE);
 434         if (t || !create)
 435                 return t;
 436
 437         if (parms->name[0])
 438                 strlcpy(name, parms->name, IFNAMSIZ);
 439         else
 440                 strcpy(name, "gre%d");
 441
 442         dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
 443         if (!dev)
 444                 return NULL;
 445
 446         dev_net_set(dev, net);
 447
 448         nt = netdev_priv(dev);
 449         nt->parms = *parms;
 450         dev->rtnl_link_ops = &ipgre_link_ops;
 451
 452         dev->mtu = ipgre_tunnel_bind_dev(dev);
 453
 454         if (register_netdevice(dev) < 0)
 455                 goto failed_free;
 456
 457         /* Can use a lockless transmit, unless we generate output sequences */
 458         if (!(nt->parms.o_flags & GRE_SEQ))
 459                 dev->features |= NETIF_F_LLTX;
 460
 461         dev_hold(dev);
 462         ipgre_tunnel_link(ign, nt);
 463         return nt;
 464
 465 failed_free:
 466         free_netdev(dev);
 467         return NULL;
 468 }
 469
 470 static void ipgre_tunnel_uninit(struct net_device *dev)
 471 {
 472         struct net *net = dev_net(dev);
 473         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
 474
 475         ipgre_tunnel_unlink(ign, netdev_priv(dev));
 476         dev_put(dev);
 477 }
 478
 479
 480 static void ipgre_err(struct sk_buff *skb, u32 info)
 481 {
 482
 483 /* All the routers (except for Linux) return only
 484    8 bytes of packet payload. It means, that precise relaying of
 485    ICMP in the real Internet is absolutely infeasible.
 486
 487    Moreover, Cisco "wise men" put GRE key to the third word
 488    in GRE header. It makes impossible maintaining even soft state for keyed
 489    GRE tunnels with enabled checksum. Tell them "thank you".
 490
 491    Well, I wonder, rfc1812 was written by Cisco employee,
 492    what the hell these idiots break standards established
 493    by themselves???
 494  */
 495
 496         const struct iphdr *iph = (const struct iphdr *)skb->data;
 497         __be16       *p = (__be16 *)(skb->data+(iph->ihl<<2));
 498         int grehlen = (iph->ihl<<2) + 4;
 499         const int type = icmp_hdr(skb)->type;
 500         const int code = icmp_hdr(skb)->code;
 501         struct ip_tunnel *t;
 502         __be16 flags;
 503         __be32 key = 0;
 504
 505         flags = p[0];
 506         if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
 507                 if (flags&(GRE_VERSION|GRE_ROUTING))
 508                         return;
 509                 if (flags&GRE_KEY) {
 510                         grehlen += 4;
 511                         if (flags&GRE_CSUM)
 512                                 grehlen += 4;
 513                 }
 514         }
 515
 516         /* If only 8 bytes returned, keyed message will be dropped here */
 517         if (skb_headlen(skb) < grehlen)
 518                 return;
 519
 520         if (flags & GRE_KEY)
 521                 key = *(((__be32 *)p) + (grehlen / 4) - 1);
 522
 523         switch (type) {
 524         default:
 525         case ICMP_PARAMETERPROB:
 526                 return;
 527
 528         case ICMP_DEST_UNREACH:
 529                 switch (code) {
 530                 case ICMP_SR_FAILED:
 531                 case ICMP_PORT_UNREACH:
 532                         /* Impossible event. */
 533                         return;
 534                 default:
 535                         /* All others are translated to HOST_UNREACH.
 536                            rfc2003 contains "deep thoughts" about NET_UNREACH,
 537                            I believe they are just ether pollution. --ANK
 538                          */
 539                         break;
 540                 }
 541                 break;
 542         case ICMP_TIME_EXCEEDED:
 543                 if (code != ICMP_EXC_TTL)
 544                         return;
 545                 break;
 546
 547         case ICMP_REDIRECT:
 548                 break;
 549         }
 550
 551         t = ipgre_tunnel_lookup(skb->dev, iph->daddr, iph->saddr,
 552                                 flags, key, p[1]);
 553
 554         if (t == NULL)
 555                 return;
 556
 557         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
 558                 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
 559                                  t->parms.link, 0, IPPROTO_GRE, 0);
 560                 return;
 561         }
 562         if (type == ICMP_REDIRECT) {
 563                 ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
 564                               IPPROTO_GRE, 0);
 565                 return;
 566         }
 567         if (t->parms.iph.daddr == 0 ||
 568             ipv4_is_multicast(t->parms.iph.daddr))
 569                 return;
 570
 571         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 572                 return;
 573
 574         if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
 575                 t->err_count++;
 576         else
 577                 t->err_count = 1;
 578         t->err_time = jiffies;
 579 }
 580
 581 static inline u8
 582 ipgre_ecn_encapsulate(u8 tos, const struct iphdr *old_iph, struct sk_buff *skb)
 583 {
 584         u8 inner = 0;
 585         if (skb->protocol == htons(ETH_P_IP))
 586                 inner = old_iph->tos;
 587         else if (skb->protocol == htons(ETH_P_IPV6))
 588                 inner = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
 589         return INET_ECN_encapsulate(tos, inner);
 590 }
 591
 592 static int ipgre_rcv(struct sk_buff *skb)
 593 {
 594         const struct iphdr *iph;
 595         u8     *h;
 596         __be16    flags;
 597         __sum16   csum = 0;
 598         __be32 key = 0;
 599         u32    seqno = 0;
 600         struct ip_tunnel *tunnel;
 601         int    offset = 4;
 602         __be16 gre_proto;
 603         int    err;
 604
 605         if (!pskb_may_pull(skb, 16))
 606                 goto drop;
 607
 608         iph = ip_hdr(skb);
 609         h = skb->data;
 610         flags = *(__be16 *)h;
 611
 612         if (flags&(GRE_CSUM|GRE_KEY|GRE_ROUTING|GRE_SEQ|GRE_VERSION)) {
 613                 /* - Version must be 0.
 614                    - We do not support routing headers.
 615                  */
 616                 if (flags&(GRE_VERSION|GRE_ROUTING))
 617                         goto drop;
 618
 619                 if (flags&GRE_CSUM) {
 620                         switch (skb->ip_summed) {
 621                         case CHECKSUM_COMPLETE:
 622                                 csum = csum_fold(skb->csum);
 623                                 if (!csum)
 624                                         break;
 625                                 /* fall through */
 626                         case CHECKSUM_NONE:
 627                                 skb->csum = 0;
 628                                 csum = __skb_checksum_complete(skb);
 629                                 skb->ip_summed = CHECKSUM_COMPLETE;
 630                         }
 631                         offset += 4;
 632                 }
 633                 if (flags&GRE_KEY) {
 634                         key = *(__be32 *)(h + offset);
 635                         offset += 4;
 636                 }
 637                 if (flags&GRE_SEQ) {
 638                         seqno = ntohl(*(__be32 *)(h + offset));
 639                         offset += 4;
 640                 }
 641         }
 642
 643         gre_proto = *(__be16 *)(h + 2);
 644
 645         tunnel = ipgre_tunnel_lookup(skb->dev,
 646                                      iph->saddr, iph->daddr, flags, key,
 647                                      gre_proto);
 648         if (tunnel) {
 649                 struct pcpu_tstats *tstats;
 650
 651                 secpath_reset(skb);
 652
 653                 skb->protocol = gre_proto;
 654                 /* WCCP version 1 and 2 protocol decoding.
 655                  * - Change protocol to IP
 656                  * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
 657                  */
 658                 if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
 659                         skb->protocol = htons(ETH_P_IP);
 660                         if ((*(h + offset) & 0xF0) != 0x40)
 661                                 offset += 4;
 662                 }
 663
 664                 skb->mac_header = skb->network_header;
 665                 __pskb_pull(skb, offset);
 666                 skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
 667                 skb->pkt_type = PACKET_HOST;
 668 #ifdef CONFIG_NET_IPGRE_BROADCAST
 669                 if (ipv4_is_multicast(iph->daddr)) {
 670                         /* Looped back packet, drop it! */
 671                         if (rt_is_output_route(skb_rtable(skb)))
 672                                 goto drop;
 673                         tunnel->dev->stats.multicast++;
 674                         skb->pkt_type = PACKET_BROADCAST;
 675                 }
 676 #endif
 677
 678                 if (((flags&GRE_CSUM) && csum) ||
 679                     (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
 680                         tunnel->dev->stats.rx_crc_errors++;
 681                         tunnel->dev->stats.rx_errors++;
 682                         goto drop;
 683                 }
 684                 if (tunnel->parms.i_flags&GRE_SEQ) {
 685                         if (!(flags&GRE_SEQ) ||
 686                             (tunnel->i_seqno && (s32)(seqno - tunnel->i_seqno) < 0)) {
 687                                 tunnel->dev->stats.rx_fifo_errors++;
 688                                 tunnel->dev->stats.rx_errors++;
 689                                 goto drop;
 690                         }
 691                         tunnel->i_seqno = seqno + 1;
 692                 }
 693
 694                 /* Warning: All skb pointers will be invalidated! */
 695                 if (tunnel->dev->type == ARPHRD_ETHER) {
 696                         if (!pskb_may_pull(skb, ETH_HLEN)) {
 697                                 tunnel->dev->stats.rx_length_errors++;
 698                                 tunnel->dev->stats.rx_errors++;
 699                                 goto drop;
 700                         }
 701
 702                         iph = ip_hdr(skb);
 703                         skb->protocol = eth_type_trans(skb, tunnel->dev);
 704                         skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
 705                 }
 706
 707                 __skb_tunnel_rx(skb, tunnel->dev);
 708
 709                 skb_reset_network_header(skb);
 710                 err = IP_ECN_decapsulate(iph, skb);
 711                 if (unlikely(err)) {
 712                         if (log_ecn_error)
 713                                 net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
 714                                                      &iph->saddr, iph->tos);
 715                         if (err > 1) {
 716                                 ++tunnel->dev->stats.rx_frame_errors;
 717                                 ++tunnel->dev->stats.rx_errors;
 718                                 goto drop;
 719                         }
 720                 }
 721
 722                 tstats = this_cpu_ptr(tunnel->dev->tstats);
 723                 u64_stats_update_begin(&tstats->syncp);
 724                 tstats->rx_packets++;
 725                 tstats->rx_bytes += skb->len;
 726                 u64_stats_update_end(&tstats->syncp);
 727
 728                 gro_cells_receive(&tunnel->gro_cells, skb);
 729                 return 0;
 730         }
 731         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 732
 733 drop:
 734         kfree_skb(skb);
 735         return 0;
 736 }
 737
 738 static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 739 {
 740         struct ip_tunnel *tunnel = netdev_priv(dev);
 741         const struct iphdr  *old_iph;
 742         const struct iphdr  *tiph;
 743         struct flowi4 fl4;
 744         u8     tos;
 745         __be16 df;
 746         struct rtable *rt;                      /* Route to the other host */
 747         struct net_device *tdev;                /* Device to other host */
 748         struct iphdr  *iph;                     /* Our new IP header */
 749         unsigned int max_headroom;              /* The extra header space needed */
 750         int    gre_hlen;
 751         __be32 dst;
 752         int    mtu;
 753         u8     ttl;
 754
 755         if (skb->ip_summed == CHECKSUM_PARTIAL &&
 756             skb_checksum_help(skb))
 757                 goto tx_error;
 758
 759         old_iph = ip_hdr(skb);
 760
 761         if (dev->type == ARPHRD_ETHER)
 762                 IPCB(skb)->flags = 0;
 763
 764         if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
 765                 gre_hlen = 0;
 766                 if (skb->protocol == htons(ETH_P_IP))
 767                         tiph = (const struct iphdr *)skb->data;
 768                 else
 769                         tiph = &tunnel->parms.iph;
 770         } else {
 771                 gre_hlen = tunnel->hlen;
 772                 tiph = &tunnel->parms.iph;
 773         }
 774
 775         if ((dst = tiph->daddr) == 0) {
 776                 /* NBMA tunnel */
 777
 778                 if (skb_dst(skb) == NULL) {
 779                         dev->stats.tx_fifo_errors++;
 780                         goto tx_error;
 781                 }
 782
 783                 if (skb->protocol == htons(ETH_P_IP)) {
 784                         rt = skb_rtable(skb);
 785                         dst = rt_nexthop(rt, old_iph->daddr);
 786                 }
 787 #if IS_ENABLED(CONFIG_IPV6)
 788                 else if (skb->protocol == htons(ETH_P_IPV6)) {
 789                         const struct in6_addr *addr6;
 790                         struct neighbour *neigh;
 791                         bool do_tx_error_icmp;
 792                         int addr_type;
 793
 794                         neigh = dst_neigh_lookup(skb_dst(skb), &ipv6_hdr(skb)->daddr);
 795                         if (neigh == NULL)
 796                                 goto tx_error;
 797
 798                         addr6 = (const struct in6_addr *)&neigh->primary_key;
 799                         addr_type = ipv6_addr_type(addr6);
 800
 801                         if (addr_type == IPV6_ADDR_ANY) {
 802                                 addr6 = &ipv6_hdr(skb)->daddr;
 803                                 addr_type = ipv6_addr_type(addr6);
 804                         }
 805
 806                         if ((addr_type & IPV6_ADDR_COMPATv4) == 0)
 807                                 do_tx_error_icmp = true;
 808                         else {
 809                                 do_tx_error_icmp = false;
 810                                 dst = addr6->s6_addr32[3];
 811                         }
 812                         neigh_release(neigh);
 813                         if (do_tx_error_icmp)
 814                                 goto tx_error_icmp;
 815                 }
 816 #endif
 817                 else
 818                         goto tx_error;
 819         }
 820
 821         ttl = tiph->ttl;
 822         tos = tiph->tos;
 823         if (tos == 1) {
 824                 tos = 0;
 825                 if (skb->protocol == htons(ETH_P_IP))
 826                         tos = old_iph->tos;
 827                 else if (skb->protocol == htons(ETH_P_IPV6))
 828                         tos = ipv6_get_dsfield((const struct ipv6hdr *)old_iph);
 829         }
 830
 831         rt = ip_route_output_gre(dev_net(dev), &fl4, dst, tiph->saddr,
 832                                  tunnel->parms.o_key, RT_TOS(tos),
 833                                  tunnel->parms.link);
 834         if (IS_ERR(rt)) {
 835                 dev->stats.tx_carrier_errors++;
 836                 goto tx_error;
 837         }
 838         tdev = rt->dst.dev;
 839
 840         if (tdev == dev) {
 841                 ip_rt_put(rt);
 842                 dev->stats.collisions++;
 843                 goto tx_error;
 844         }
 845
 846         df = tiph->frag_off;
 847         if (df)
 848                 mtu = dst_mtu(&rt->dst) - dev->hard_header_len - tunnel->hlen;
 849         else
 850                 mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
 851
 852         if (skb_dst(skb))
 853                 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
 854
 855         if (skb->protocol == htons(ETH_P_IP)) {
 856                 df |= (old_iph->frag_off&htons(IP_DF));
 857
 858                 if ((old_iph->frag_off&htons(IP_DF)) &&
 859                     mtu < ntohs(old_iph->tot_len)) {
 860                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
 861                         ip_rt_put(rt);
 862                         goto tx_error;
 863                 }
 864         }
 865 #if IS_ENABLED(CONFIG_IPV6)
 866         else if (skb->protocol == htons(ETH_P_IPV6)) {
 867                 struct rt6_info *rt6 = (struct rt6_info *)skb_dst(skb);
 868
 869                 if (rt6 && mtu < dst_mtu(skb_dst(skb)) && mtu >= IPV6_MIN_MTU) {
 870                         if ((tunnel->parms.iph.daddr &&
 871                              !ipv4_is_multicast(tunnel->parms.iph.daddr)) ||
 872                             rt6->rt6i_dst.plen == 128) {
 873                                 rt6->rt6i_flags |= RTF_MODIFIED;
 874                                 dst_metric_set(skb_dst(skb), RTAX_MTU, mtu);
 875                         }
 876                 }
 877
 878                 if (mtu >= IPV6_MIN_MTU && mtu < skb->len - tunnel->hlen + gre_hlen) {
 879                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
 880                         ip_rt_put(rt);
 881                         goto tx_error;
 882                 }
 883         }
 884 #endif
 885
 886         if (tunnel->err_count > 0) {
 887                 if (time_before(jiffies,
 888                                 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
 889                         tunnel->err_count--;
 890
 891                         dst_link_failure(skb);
 892                 } else
 893                         tunnel->err_count = 0;
 894         }
 895
 896         max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen + rt->dst.header_len;
 897
 898         if (skb_headroom(skb) < max_headroom || skb_shared(skb)||
 899             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
 900                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
 901                 if (max_headroom > dev->needed_headroom)
 902                         dev->needed_headroom = max_headroom;
 903                 if (!new_skb) {
 904                         ip_rt_put(rt);
 905                         dev->stats.tx_dropped++;
 906                         dev_kfree_skb(skb);
 907                         return NETDEV_TX_OK;
 908                 }
 909                 if (skb->sk)
 910                         skb_set_owner_w(new_skb, skb->sk);
 911                 dev_kfree_skb(skb);
 912                 skb = new_skb;
 913                 old_iph = ip_hdr(skb);
 914                 /* Warning : tiph value might point to freed memory */
 915         }
 916
 917         skb_push(skb, gre_hlen);
 918         skb_reset_network_header(skb);
 919         skb_set_transport_header(skb, sizeof(*iph));
 920         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 921         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
 922                               IPSKB_REROUTED);
 923         skb_dst_drop(skb);
 924         skb_dst_set(skb, &rt->dst);
 925
 926         /*
 927          *      Push down and install the IPIP header.
 928          */
 929
 930         iph                     =       ip_hdr(skb);
 931         iph->version            =       4;
 932         iph->ihl                =       sizeof(struct iphdr) >> 2;
 933         iph->frag_off           =       df;
 934         iph->protocol           =       IPPROTO_GRE;
 935         iph->tos                =       ipgre_ecn_encapsulate(tos, old_iph, skb);
 936         iph->daddr              =       fl4.daddr;
 937         iph->saddr              =       fl4.saddr;
 938         iph->ttl                =       ttl;
 939
 940         if (ttl == 0) {
 941                 if (skb->protocol == htons(ETH_P_IP))
 942                         iph->ttl = old_iph->ttl;
 943 #if IS_ENABLED(CONFIG_IPV6)
 944                 else if (skb->protocol == htons(ETH_P_IPV6))
 945                         iph->ttl = ((const struct ipv6hdr *)old_iph)->hop_limit;
 946 #endif
 947                 else
 948                         iph->ttl = ip4_dst_hoplimit(&rt->dst);
 949         }
 950
 951         ((__be16 *)(iph + 1))[0] = tunnel->parms.o_flags;
 952         ((__be16 *)(iph + 1))[1] = (dev->type == ARPHRD_ETHER) ?
 953                                    htons(ETH_P_TEB) : skb->protocol;
 954
 955         if (tunnel->parms.o_flags&(GRE_KEY|GRE_CSUM|GRE_SEQ)) {
 956                 __be32 *ptr = (__be32 *)(((u8 *)iph) + tunnel->hlen - 4);
 957
 958                 if (tunnel->parms.o_flags&GRE_SEQ) {
 959                         ++tunnel->o_seqno;
 960                         *ptr = htonl(tunnel->o_seqno);
 961                         ptr--;
 962                 }
 963                 if (tunnel->parms.o_flags&GRE_KEY) {
 964                         *ptr = tunnel->parms.o_key;
 965                         ptr--;
 966                 }
 967                 if (tunnel->parms.o_flags&GRE_CSUM) {
 968                         *ptr = 0;
 969                         *(__sum16 *)ptr = ip_compute_csum((void *)(iph+1), skb->len - sizeof(struct iphdr));
 970                 }
 971         }
 972
 973         iptunnel_xmit(skb, dev);
 974         return NETDEV_TX_OK;
 975
 976 #if IS_ENABLED(CONFIG_IPV6)
 977 tx_error_icmp:
 978         dst_link_failure(skb);
 979 #endif
 980 tx_error:
 981         dev->stats.tx_errors++;
 982         dev_kfree_skb(skb);
 983         return NETDEV_TX_OK;
 984 }
 985
 986 static int ipgre_tunnel_bind_dev(struct net_device *dev)
 987 {
 988         struct net_device *tdev = NULL;
 989         struct ip_tunnel *tunnel;
 990         const struct iphdr *iph;
 991         int hlen = LL_MAX_HEADER;
 992         int mtu = ETH_DATA_LEN;
 993         int addend = sizeof(struct iphdr) + 4;
 994
 995         tunnel = netdev_priv(dev);
 996         iph = &tunnel->parms.iph;
 997
 998         /* Guess output device to choose reasonable mtu and needed_headroom */
 999
1000         if (iph->daddr) {
1001                 struct flowi4 fl4;
1002                 struct rtable *rt;
1003
1004                 rt = ip_route_output_gre(dev_net(dev), &fl4,
1005                                          iph->daddr, iph->saddr,
1006                                          tunnel->parms.o_key,
1007                                          RT_TOS(iph->tos),
1008                                          tunnel->parms.link);
1009                 if (!IS_ERR(rt)) {
1010                         tdev = rt->dst.dev;
1011                         ip_rt_put(rt);
1012                 }
1013
1014                 if (dev->type != ARPHRD_ETHER)
1015                         dev->flags |= IFF_POINTOPOINT;
1016         }
1017
1018         if (!tdev && tunnel->parms.link)
1019                 tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
1020
1021         if (tdev) {
1022                 hlen = tdev->hard_header_len + tdev->needed_headroom;
1023                 mtu = tdev->mtu;
1024         }
1025         dev->iflink = tunnel->parms.link;
1026
1027         /* Precalculate GRE options length */
1028         if (tunnel->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
1029                 if (tunnel->parms.o_flags&GRE_CSUM)
1030                         addend += 4;
1031                 if (tunnel->parms.o_flags&GRE_KEY)
1032                         addend += 4;
1033                 if (tunnel->parms.o_flags&GRE_SEQ)
1034                         addend += 4;
1035         }
1036         dev->needed_headroom = addend + hlen;
1037         mtu -= dev->hard_header_len + addend;
1038
1039         if (mtu < 68)
1040                 mtu = 68;
1041
1042         tunnel->hlen = addend;
1043
1044         return mtu;
1045 }
1046
1047 static int
1048 ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
1049 {
1050         int err = 0;
1051         struct ip_tunnel_parm p;
1052         struct ip_tunnel *t;
1053         struct net *net = dev_net(dev);
1054         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1055
1056         switch (cmd) {
1057         case SIOCGETTUNNEL:
1058                 t = NULL;
1059                 if (dev == ign->fb_tunnel_dev) {
1060                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
1061                                 err = -EFAULT;
1062                                 break;
1063                         }
1064                         t = ipgre_tunnel_locate(net, &p, 0);
1065                 }
1066                 if (t == NULL)
1067                         t = netdev_priv(dev);
1068                 memcpy(&p, &t->parms, sizeof(p));
1069                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
1070                         err = -EFAULT;
1071                 break;
1072
1073         case SIOCADDTUNNEL:
1074         case SIOCCHGTUNNEL:
1075                 err = -EPERM;
1076                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1077                         goto done;
1078
1079                 err = -EFAULT;
1080                 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1081                         goto done;
1082
1083                 err = -EINVAL;
1084                 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
1085                     p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
1086                     ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
1087                         goto done;
1088                 if (p.iph.ttl)
1089                         p.iph.frag_off |= htons(IP_DF);
1090
1091                 if (!(p.i_flags&GRE_KEY))
1092                         p.i_key = 0;
1093                 if (!(p.o_flags&GRE_KEY))
1094                         p.o_key = 0;
1095
1096                 t = ipgre_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
1097
1098                 if (dev != ign->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
1099                         if (t != NULL) {
1100                                 if (t->dev != dev) {
1101                                         err = -EEXIST;
1102                                         break;
1103                                 }
1104                         } else {
1105                                 unsigned int nflags = 0;
1106
1107                                 t = netdev_priv(dev);
1108
1109                                 if (ipv4_is_multicast(p.iph.daddr))
1110                                         nflags = IFF_BROADCAST;
1111                                 else if (p.iph.daddr)
1112                                         nflags = IFF_POINTOPOINT;
1113
1114                                 if ((dev->flags^nflags)&(IFF_POINTOPOINT|IFF_BROADCAST)) {
1115                                         err = -EINVAL;
1116                                         break;
1117                                 }
1118                                 ipgre_tunnel_unlink(ign, t);
1119                                 synchronize_net();
1120                                 t->parms.iph.saddr = p.iph.saddr;
1121                                 t->parms.iph.daddr = p.iph.daddr;
1122                                 t->parms.i_key = p.i_key;
1123                                 t->parms.o_key = p.o_key;
1124                                 memcpy(dev->dev_addr, &p.iph.saddr, 4);
1125                                 memcpy(dev->broadcast, &p.iph.daddr, 4);
1126                                 ipgre_tunnel_link(ign, t);
1127                                 netdev_state_change(dev);
1128                         }
1129                 }
1130
1131                 if (t) {
1132                         err = 0;
1133                         if (cmd == SIOCCHGTUNNEL) {
1134                                 t->parms.iph.ttl = p.iph.ttl;
1135                                 t->parms.iph.tos = p.iph.tos;
1136                                 t->parms.iph.frag_off = p.iph.frag_off;
1137                                 if (t->parms.link != p.link) {
1138                                         t->parms.link = p.link;
1139                                         dev->mtu = ipgre_tunnel_bind_dev(dev);
1140                                         netdev_state_change(dev);
1141                                 }
1142                         }
1143                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
1144                                 err = -EFAULT;
1145                 } else
1146                         err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
1147                 break;
1148
1149         case SIOCDELTUNNEL:
1150                 err = -EPERM;
1151                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1152                         goto done;
1153
1154                 if (dev == ign->fb_tunnel_dev) {
1155                         err = -EFAULT;
1156                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1157                                 goto done;
1158                         err = -ENOENT;
1159                         if ((t = ipgre_tunnel_locate(net, &p, 0)) == NULL)
1160                                 goto done;
1161                         err = -EPERM;
1162                         if (t == netdev_priv(ign->fb_tunnel_dev))
1163                                 goto done;
1164                         dev = t->dev;
1165                 }
1166                 unregister_netdevice(dev);
1167                 err = 0;
1168                 break;
1169
1170         default:
1171                 err = -EINVAL;
1172         }
1173
1174 done:
1175         return err;
1176 }
1177
1178 static int ipgre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
1179 {
1180         struct ip_tunnel *tunnel = netdev_priv(dev);
1181         if (new_mtu < 68 ||
1182             new_mtu > 0xFFF8 - dev->hard_header_len - tunnel->hlen)
1183                 return -EINVAL;
1184         dev->mtu = new_mtu;
1185         return 0;
1186 }
1187
1188 /* Nice toy. Unfortunately, useless in real life :-)
1189    It allows to construct virtual multiprotocol broadcast "LAN"
1190    over the Internet, provided multicast routing is tuned.
1191
1192
1193    I have no idea was this bicycle invented before me,
1194    so that I had to set ARPHRD_IPGRE to a random value.
1195    I have an impression, that Cisco could make something similar,
1196    but this feature is apparently missing in IOS<=11.2(8).
1197
1198    I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks
1199    with broadcast 224.66.66.66. If you have access to mbone, play with me :-)
1200
1201    ping -t 255 224.66.66.66
1202
1203    If nobody answers, mbone does not work.
1204
1205    ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255
1206    ip addr add 10.66.66.<somewhat>/24 dev Universe
1207    ifconfig Universe up
1208    ifconfig Universe add fe80::<Your_real_addr>/10
1209    ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96
1210    ftp 10.66.66.66
1211    ...
1212    ftp fec0:6666:6666::193.233.7.65
1213    ...
1214
1215  */
1216
1217 static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
1218                         unsigned short type,
1219                         const void *daddr, const void *saddr, unsigned int len)
1220 {
1221         struct ip_tunnel *t = netdev_priv(dev);
1222         struct iphdr *iph = (struct iphdr *)skb_push(skb, t->hlen);
1223         __be16 *p = (__be16 *)(iph+1);
1224
1225         memcpy(iph, &t->parms.iph, sizeof(struct iphdr));
1226         p[0]            = t->parms.o_flags;
1227         p[1]            = htons(type);
1228
1229         /*
1230          *      Set the source hardware address.
1231          */
1232
1233         if (saddr)
1234                 memcpy(&iph->saddr, saddr, 4);
1235         if (daddr)
1236                 memcpy(&iph->daddr, daddr, 4);
1237         if (iph->daddr)
1238                 return t->hlen;
1239
1240         return -t->hlen;
1241 }
1242
1243 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
1244 {
1245         const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
1246         memcpy(haddr, &iph->saddr, 4);
1247         return 4;
1248 }
1249
1250 static const struct header_ops ipgre_header_ops = {
1251         .create = ipgre_header,
1252         .parse  = ipgre_header_parse,
1253 };
1254
1255 #ifdef CONFIG_NET_IPGRE_BROADCAST
1256 static int ipgre_open(struct net_device *dev)
1257 {
1258         struct ip_tunnel *t = netdev_priv(dev);
1259
1260         if (ipv4_is_multicast(t->parms.iph.daddr)) {
1261                 struct flowi4 fl4;
1262                 struct rtable *rt;
1263
1264                 rt = ip_route_output_gre(dev_net(dev), &fl4,
1265                                          t->parms.iph.daddr,
1266                                          t->parms.iph.saddr,
1267                                          t->parms.o_key,
1268                                          RT_TOS(t->parms.iph.tos),
1269                                          t->parms.link);
1270                 if (IS_ERR(rt))
1271                         return -EADDRNOTAVAIL;
1272                 dev = rt->dst.dev;
1273                 ip_rt_put(rt);
1274                 if (__in_dev_get_rtnl(dev) == NULL)
1275                         return -EADDRNOTAVAIL;
1276                 t->mlink = dev->ifindex;
1277                 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
1278         }
1279         return 0;
1280 }
1281
1282 static int ipgre_close(struct net_device *dev)
1283 {
1284         struct ip_tunnel *t = netdev_priv(dev);
1285
1286         if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) {
1287                 struct in_device *in_dev;
1288                 in_dev = inetdev_by_index(dev_net(dev), t->mlink);
1289                 if (in_dev)
1290                         ip_mc_dec_group(in_dev, t->parms.iph.daddr);
1291         }
1292         return 0;
1293 }
1294
1295 #endif
1296
1297 static const struct net_device_ops ipgre_netdev_ops = {
1298         .ndo_init               = ipgre_tunnel_init,
1299         .ndo_uninit             = ipgre_tunnel_uninit,
1300 #ifdef CONFIG_NET_IPGRE_BROADCAST
1301         .ndo_open               = ipgre_open,
1302         .ndo_stop               = ipgre_close,
1303 #endif
1304         .ndo_start_xmit         = ipgre_tunnel_xmit,
1305         .ndo_do_ioctl           = ipgre_tunnel_ioctl,
1306         .ndo_change_mtu         = ipgre_tunnel_change_mtu,
1307         .ndo_get_stats64        = ipgre_get_stats64,
1308 };
1309
1310 static void ipgre_dev_free(struct net_device *dev)
1311 {
1312         struct ip_tunnel *tunnel = netdev_priv(dev);
1313
1314         gro_cells_destroy(&tunnel->gro_cells);
1315         free_percpu(dev->tstats);
1316         free_netdev(dev);
1317 }
1318
1319 #define GRE_FEATURES (NETIF_F_SG |              \
1320                       NETIF_F_FRAGLIST |        \
1321                       NETIF_F_HIGHDMA |         \
1322                       NETIF_F_HW_CSUM)
1323
1324 static void ipgre_tunnel_setup(struct net_device *dev)
1325 {
1326         dev->netdev_ops         = &ipgre_netdev_ops;
1327         dev->destructor         = ipgre_dev_free;
1328
1329         dev->type               = ARPHRD_IPGRE;
1330         dev->needed_headroom    = LL_MAX_HEADER + sizeof(struct iphdr) + 4;
1331         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr) - 4;
1332         dev->flags              = IFF_NOARP;
1333         dev->iflink             = 0;
1334         dev->addr_len           = 4;
1335         dev->features           |= NETIF_F_NETNS_LOCAL;
1336         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
1337
1338         dev->features           |= GRE_FEATURES;
1339         dev->hw_features        |= GRE_FEATURES;
1340 }
1341
1342 static int ipgre_tunnel_init(struct net_device *dev)
1343 {
1344         struct ip_tunnel *tunnel;
1345         struct iphdr *iph;
1346         int err;
1347
1348         tunnel = netdev_priv(dev);
1349         iph = &tunnel->parms.iph;
1350
1351         tunnel->dev = dev;
1352         strcpy(tunnel->parms.name, dev->name);
1353
1354         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
1355         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
1356
1357         if (iph->daddr) {
1358 #ifdef CONFIG_NET_IPGRE_BROADCAST
1359                 if (ipv4_is_multicast(iph->daddr)) {
1360                         if (!iph->saddr)
1361                                 return -EINVAL;
1362                         dev->flags = IFF_BROADCAST;
1363                         dev->header_ops = &ipgre_header_ops;
1364                 }
1365 #endif
1366         } else
1367                 dev->header_ops = &ipgre_header_ops;
1368
1369         dev->tstats = alloc_percpu(struct pcpu_tstats);
1370         if (!dev->tstats)
1371                 return -ENOMEM;
1372
1373         err = gro_cells_init(&tunnel->gro_cells, dev);
1374         if (err) {
1375                 free_percpu(dev->tstats);
1376                 return err;
1377         }
1378
1379         return 0;
1380 }
1381
1382 static void ipgre_fb_tunnel_init(struct net_device *dev)
1383 {
1384         struct ip_tunnel *tunnel = netdev_priv(dev);
1385         struct iphdr *iph = &tunnel->parms.iph;
1386
1387         tunnel->dev = dev;
1388         strcpy(tunnel->parms.name, dev->name);
1389
1390         iph->version            = 4;
1391         iph->protocol           = IPPROTO_GRE;
1392         iph->ihl                = 5;
1393         tunnel->hlen            = sizeof(struct iphdr) + 4;
1394
1395         dev_hold(dev);
1396 }
1397
1398
1399 static const struct gre_protocol ipgre_protocol = {
1400         .handler     = ipgre_rcv,
1401         .err_handler = ipgre_err,
1402 };
1403
1404 static void ipgre_destroy_tunnels(struct ipgre_net *ign, struct list_head *head)
1405 {
1406         int prio;
1407
1408         for (prio = 0; prio < 4; prio++) {
1409                 int h;
1410                 for (h = 0; h < HASH_SIZE; h++) {
1411                         struct ip_tunnel *t;
1412
1413                         t = rtnl_dereference(ign->tunnels[prio][h]);
1414
1415                         while (t != NULL) {
1416                                 unregister_netdevice_queue(t->dev, head);
1417                                 t = rtnl_dereference(t->next);
1418                         }
1419                 }
1420         }
1421 }
1422
1423 static int __net_init ipgre_init_net(struct net *net)
1424 {
1425         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1426         int err;
1427
1428         ign->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0",
1429                                            ipgre_tunnel_setup);
1430         if (!ign->fb_tunnel_dev) {
1431                 err = -ENOMEM;
1432                 goto err_alloc_dev;
1433         }
1434         dev_net_set(ign->fb_tunnel_dev, net);
1435
1436         ipgre_fb_tunnel_init(ign->fb_tunnel_dev);
1437         ign->fb_tunnel_dev->rtnl_link_ops = &ipgre_link_ops;
1438
1439         if ((err = register_netdev(ign->fb_tunnel_dev)))
1440                 goto err_reg_dev;
1441
1442         rcu_assign_pointer(ign->tunnels_wc[0],
1443                            netdev_priv(ign->fb_tunnel_dev));
1444         return 0;
1445
1446 err_reg_dev:
1447         ipgre_dev_free(ign->fb_tunnel_dev);
1448 err_alloc_dev:
1449         return err;
1450 }
1451
1452 static void __net_exit ipgre_exit_net(struct net *net)
1453 {
1454         struct ipgre_net *ign;
1455         LIST_HEAD(list);
1456
1457         ign = net_generic(net, ipgre_net_id);
1458         rtnl_lock();
1459         ipgre_destroy_tunnels(ign, &list);
1460         unregister_netdevice_many(&list);
1461         rtnl_unlock();
1462 }
1463
1464 static struct pernet_operations ipgre_net_ops = {
1465         .init = ipgre_init_net,
1466         .exit = ipgre_exit_net,
1467         .id   = &ipgre_net_id,
1468         .size = sizeof(struct ipgre_net),
1469 };
1470
1471 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
1472 {
1473         __be16 flags;
1474
1475         if (!data)
1476                 return 0;
1477
1478         flags = 0;
1479         if (data[IFLA_GRE_IFLAGS])
1480                 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
1481         if (data[IFLA_GRE_OFLAGS])
1482                 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
1483         if (flags & (GRE_VERSION|GRE_ROUTING))
1484                 return -EINVAL;
1485
1486         return 0;
1487 }
1488
1489 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[])
1490 {
1491         __be32 daddr;
1492
1493         if (tb[IFLA_ADDRESS]) {
1494                 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
1495                         return -EINVAL;
1496                 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
1497                         return -EADDRNOTAVAIL;
1498         }
1499
1500         if (!data)
1501                 goto out;
1502
1503         if (data[IFLA_GRE_REMOTE]) {
1504                 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4);
1505                 if (!daddr)
1506                         return -EINVAL;
1507         }
1508
1509 out:
1510         return ipgre_tunnel_validate(tb, data);
1511 }
1512
1513 static void ipgre_netlink_parms(struct nlattr *data[],
1514                                 struct ip_tunnel_parm *parms)
1515 {
1516         memset(parms, 0, sizeof(*parms));
1517
1518         parms->iph.protocol = IPPROTO_GRE;
1519
1520         if (!data)
1521                 return;
1522
1523         if (data[IFLA_GRE_LINK])
1524                 parms->link = nla_get_u32(data[IFLA_GRE_LINK]);
1525
1526         if (data[IFLA_GRE_IFLAGS])
1527                 parms->i_flags = nla_get_be16(data[IFLA_GRE_IFLAGS]);
1528
1529         if (data[IFLA_GRE_OFLAGS])
1530                 parms->o_flags = nla_get_be16(data[IFLA_GRE_OFLAGS]);
1531
1532         if (data[IFLA_GRE_IKEY])
1533                 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]);
1534
1535         if (data[IFLA_GRE_OKEY])
1536                 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]);
1537
1538         if (data[IFLA_GRE_LOCAL])
1539                 parms->iph.saddr = nla_get_be32(data[IFLA_GRE_LOCAL]);
1540
1541         if (data[IFLA_GRE_REMOTE])
1542                 parms->iph.daddr = nla_get_be32(data[IFLA_GRE_REMOTE]);
1543
1544         if (data[IFLA_GRE_TTL])
1545                 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]);
1546
1547         if (data[IFLA_GRE_TOS])
1548                 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]);
1549
1550         if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC]))
1551                 parms->iph.frag_off = htons(IP_DF);
1552 }
1553
1554 static int ipgre_tap_init(struct net_device *dev)
1555 {
1556         struct ip_tunnel *tunnel;
1557
1558         tunnel = netdev_priv(dev);
1559
1560         tunnel->dev = dev;
1561         strcpy(tunnel->parms.name, dev->name);
1562
1563         ipgre_tunnel_bind_dev(dev);
1564
1565         dev->tstats = alloc_percpu(struct pcpu_tstats);
1566         if (!dev->tstats)
1567                 return -ENOMEM;
1568
1569         return 0;
1570 }
1571
1572 static const struct net_device_ops ipgre_tap_netdev_ops = {
1573         .ndo_init               = ipgre_tap_init,
1574         .ndo_uninit             = ipgre_tunnel_uninit,
1575         .ndo_start_xmit         = ipgre_tunnel_xmit,
1576         .ndo_set_mac_address    = eth_mac_addr,
1577         .ndo_validate_addr      = eth_validate_addr,
1578         .ndo_change_mtu         = ipgre_tunnel_change_mtu,
1579         .ndo_get_stats64        = ipgre_get_stats64,
1580 };
1581
1582 static void ipgre_tap_setup(struct net_device *dev)
1583 {
1584
1585         ether_setup(dev);
1586
1587         dev->netdev_ops         = &ipgre_tap_netdev_ops;
1588         dev->destructor         = ipgre_dev_free;
1589
1590         dev->iflink             = 0;
1591         dev->features           |= NETIF_F_NETNS_LOCAL;
1592 }
1593
1594 static int ipgre_newlink(struct net *src_net, struct net_device *dev, struct nlattr *tb[],
1595                          struct nlattr *data[])
1596 {
1597         struct ip_tunnel *nt;
1598         struct net *net = dev_net(dev);
1599         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1600         int mtu;
1601         int err;
1602
1603         nt = netdev_priv(dev);
1604         ipgre_netlink_parms(data, &nt->parms);
1605
1606         if (ipgre_tunnel_find(net, &nt->parms, dev->type))
1607                 return -EEXIST;
1608
1609         if (dev->type == ARPHRD_ETHER && !tb[IFLA_ADDRESS])
1610                 eth_hw_addr_random(dev);
1611
1612         mtu = ipgre_tunnel_bind_dev(dev);
1613         if (!tb[IFLA_MTU])
1614                 dev->mtu = mtu;
1615
1616         /* Can use a lockless transmit, unless we generate output sequences */
1617         if (!(nt->parms.o_flags & GRE_SEQ))
1618                 dev->features |= NETIF_F_LLTX;
1619
1620         err = register_netdevice(dev);
1621         if (err)
1622                 goto out;
1623
1624         dev_hold(dev);
1625         ipgre_tunnel_link(ign, nt);
1626
1627 out:
1628         return err;
1629 }
1630
1631 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
1632                             struct nlattr *data[])
1633 {
1634         struct ip_tunnel *t, *nt;
1635         struct net *net = dev_net(dev);
1636         struct ipgre_net *ign = net_generic(net, ipgre_net_id);
1637         struct ip_tunnel_parm p;
1638         int mtu;
1639
1640         if (dev == ign->fb_tunnel_dev)
1641                 return -EINVAL;
1642
1643         nt = netdev_priv(dev);
1644         ipgre_netlink_parms(data, &p);
1645
1646         t = ipgre_tunnel_locate(net, &p, 0);
1647
1648         if (t) {
1649                 if (t->dev != dev)
1650                         return -EEXIST;
1651         } else {
1652                 t = nt;
1653
1654                 if (dev->type != ARPHRD_ETHER) {
1655                         unsigned int nflags = 0;
1656
1657                         if (ipv4_is_multicast(p.iph.daddr))
1658                                 nflags = IFF_BROADCAST;
1659                         else if (p.iph.daddr)
1660                                 nflags = IFF_POINTOPOINT;
1661
1662                         if ((dev->flags ^ nflags) &
1663                             (IFF_POINTOPOINT | IFF_BROADCAST))
1664                                 return -EINVAL;
1665                 }
1666
1667                 ipgre_tunnel_unlink(ign, t);
1668                 t->parms.iph.saddr = p.iph.saddr;
1669                 t->parms.iph.daddr = p.iph.daddr;
1670                 t->parms.i_key = p.i_key;
1671                 if (dev->type != ARPHRD_ETHER) {
1672                         memcpy(dev->dev_addr, &p.iph.saddr, 4);
1673                         memcpy(dev->broadcast, &p.iph.daddr, 4);
1674                 }
1675                 ipgre_tunnel_link(ign, t);
1676                 netdev_state_change(dev);
1677         }
1678
1679         t->parms.o_key = p.o_key;
1680         t->parms.iph.ttl = p.iph.ttl;
1681         t->parms.iph.tos = p.iph.tos;
1682         t->parms.iph.frag_off = p.iph.frag_off;
1683
1684         if (t->parms.link != p.link) {
1685                 t->parms.link = p.link;
1686                 mtu = ipgre_tunnel_bind_dev(dev);
1687                 if (!tb[IFLA_MTU])
1688                         dev->mtu = mtu;
1689                 netdev_state_change(dev);
1690         }
1691
1692         return 0;
1693 }
1694
1695 static size_t ipgre_get_size(const struct net_device *dev)
1696 {
1697         return
1698                 /* IFLA_GRE_LINK */
1699                 nla_total_size(4) +
1700                 /* IFLA_GRE_IFLAGS */
1701                 nla_total_size(2) +
1702                 /* IFLA_GRE_OFLAGS */
1703                 nla_total_size(2) +
1704                 /* IFLA_GRE_IKEY */
1705                 nla_total_size(4) +
1706                 /* IFLA_GRE_OKEY */
1707                 nla_total_size(4) +
1708                 /* IFLA_GRE_LOCAL */
1709                 nla_total_size(4) +
1710                 /* IFLA_GRE_REMOTE */
1711                 nla_total_size(4) +
1712                 /* IFLA_GRE_TTL */
1713                 nla_total_size(1) +
1714                 /* IFLA_GRE_TOS */
1715                 nla_total_size(1) +
1716                 /* IFLA_GRE_PMTUDISC */
1717                 nla_total_size(1) +
1718                 0;
1719 }
1720
1721 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
1722 {
1723         struct ip_tunnel *t = netdev_priv(dev);
1724         struct ip_tunnel_parm *p = &t->parms;
1725
1726         if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
1727             nla_put_be16(skb, IFLA_GRE_IFLAGS, p->i_flags) ||
1728             nla_put_be16(skb, IFLA_GRE_OFLAGS, p->o_flags) ||
1729             nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
1730             nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
1731             nla_put_be32(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
1732             nla_put_be32(skb, IFLA_GRE_REMOTE, p->iph.daddr) ||
1733             nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) ||
1734             nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) ||
1735             nla_put_u8(skb, IFLA_GRE_PMTUDISC,
1736                        !!(p->iph.frag_off & htons(IP_DF))))
1737                 goto nla_put_failure;
1738         return 0;
1739
1740 nla_put_failure:
1741         return -EMSGSIZE;
1742 }
1743
1744 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
1745         [IFLA_GRE_LINK]         = { .type = NLA_U32 },
1746         [IFLA_GRE_IFLAGS]       = { .type = NLA_U16 },
1747         [IFLA_GRE_OFLAGS]       = { .type = NLA_U16 },
1748         [IFLA_GRE_IKEY]         = { .type = NLA_U32 },
1749         [IFLA_GRE_OKEY]         = { .type = NLA_U32 },
1750         [IFLA_GRE_LOCAL]        = { .len = FIELD_SIZEOF(struct iphdr, saddr) },
1751         [IFLA_GRE_REMOTE]       = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
1752         [IFLA_GRE_TTL]          = { .type = NLA_U8 },
1753         [IFLA_GRE_TOS]          = { .type = NLA_U8 },
1754         [IFLA_GRE_PMTUDISC]     = { .type = NLA_U8 },
1755 };
1756
1757 static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
1758         .kind           = "gre",
1759         .maxtype        = IFLA_GRE_MAX,
1760         .policy         = ipgre_policy,
1761         .priv_size      = sizeof(struct ip_tunnel),
1762         .setup          = ipgre_tunnel_setup,
1763         .validate       = ipgre_tunnel_validate,
1764         .newlink        = ipgre_newlink,
1765         .changelink     = ipgre_changelink,
1766         .get_size       = ipgre_get_size,
1767         .fill_info      = ipgre_fill_info,
1768 };
1769
1770 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = {
1771         .kind           = "gretap",
1772         .maxtype        = IFLA_GRE_MAX,
1773         .policy         = ipgre_policy,
1774         .priv_size      = sizeof(struct ip_tunnel),
1775         .setup          = ipgre_tap_setup,
1776         .validate       = ipgre_tap_validate,
1777         .newlink        = ipgre_newlink,
1778         .changelink     = ipgre_changelink,
1779         .get_size       = ipgre_get_size,
1780         .fill_info      = ipgre_fill_info,
1781 };
1782
1783 /*
1784  *      And now the modules code and kernel interface.
1785  */
1786
1787 static int __init ipgre_init(void)
1788 {
1789         int err;
1790
1791         pr_info("GRE over IPv4 tunneling driver\n");
1792
1793         err = register_pernet_device(&ipgre_net_ops);
1794         if (err < 0)
1795                 return err;
1796
1797         err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
1798         if (err < 0) {
1799                 pr_info("%s: can't add protocol\n", __func__);
1800                 goto add_proto_failed;
1801         }
1802
1803         err = rtnl_link_register(&ipgre_link_ops);
1804         if (err < 0)
1805                 goto rtnl_link_failed;
1806
1807         err = rtnl_link_register(&ipgre_tap_ops);
1808         if (err < 0)
1809                 goto tap_ops_failed;
1810
1811 out:
1812         return err;
1813
1814 tap_ops_failed:
1815         rtnl_link_unregister(&ipgre_link_ops);
1816 rtnl_link_failed:
1817         gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
1818 add_proto_failed:
1819         unregister_pernet_device(&ipgre_net_ops);
1820         goto out;
1821 }
1822
1823 static void __exit ipgre_fini(void)
1824 {
1825         rtnl_link_unregister(&ipgre_tap_ops);
1826         rtnl_link_unregister(&ipgre_link_ops);
1827         if (gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO) < 0)
1828                 pr_info("%s: can't remove protocol\n", __func__);
1829         unregister_pernet_device(&ipgre_net_ops);
1830 }
1831
1832 module_init(ipgre_init);
1833 module_exit(ipgre_fini);
1834 MODULE_LICENSE("GPL");
1835 MODULE_ALIAS_RTNL_LINK("gre");
1836 MODULE_ALIAS_RTNL_LINK("gretap");
1837 MODULE_ALIAS_NETDEV("gre0");