2 * Linux NET3: GRE over IP protocol decoder.
4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
15 #include <linux/capability.h>
16 #include <linux/module.h>
17 #include <linux/types.h>
18 #include <linux/kernel.h>
19 #include <linux/slab.h>
20 #include <asm/uaccess.h>
21 #include <linux/skbuff.h>
22 #include <linux/netdevice.h>
24 #include <linux/tcp.h>
25 #include <linux/udp.h>
26 #include <linux/if_arp.h>
27 #include <linux/if_vlan.h>
28 #include <linux/init.h>
29 #include <linux/in6.h>
30 #include <linux/inetdevice.h>
31 #include <linux/igmp.h>
32 #include <linux/netfilter_ipv4.h>
33 #include <linux/etherdevice.h>
34 #include <linux/if_ether.h>
39 #include <net/protocol.h>
40 #include <net/ip_tunnels.h>
42 #include <net/checksum.h>
43 #include <net/dsfield.h>
44 #include <net/inet_ecn.h>
46 #include <net/net_namespace.h>
47 #include <net/netns/generic.h>
48 #include <net/rtnetlink.h>
50 #include <net/dst_metadata.h>
56 1. The most important issue is detecting local dead loops.
57 They would cause complete host lockup in transmit, which
58 would be "resolved" by stack overflow or, if queueing is enabled,
59 with infinite looping in net_bh.
61 We cannot track such dead loops during route installation,
62 it is infeasible task. The most general solutions would be
63 to keep skb->encapsulation counter (sort of local ttl),
64 and silently drop packet when it expires. It is a good
65 solution, but it supposes maintaining new variable in ALL
66 skb, even if no tunneling is used.
68 Current solution: xmit_recursion breaks dead loops. This is a percpu
69 counter, since when we enter the first ndo_xmit(), cpu migration is
70 forbidden. We force an exit if this counter reaches RECURSION_LIMIT
72 2. Networking dead loops would not kill routers, but would really
73 kill network. IP hop limit plays role of "t->recursion" in this case,
74 if we copy it from packet being encapsulated to upper header.
75 It is very good solution, but it introduces two problems:
77 - Routing protocols, using packets with ttl=1 (OSPF, RIP2),
78 do not work over tunnels.
79 - traceroute does not work. I planned to relay ICMP from tunnel,
80 so that this problem would be solved and traceroute output
81 would even more informative. This idea appeared to be wrong:
82 only Linux complies to rfc1812 now (yes, guys, Linux is the only
83 true router now :-)), all routers (at least, in neighbourhood of mine)
84 return only 8 bytes of payload. It is the end.
86 Hence, if we want that OSPF worked or traceroute said something reasonable,
87 we should search for another solution.
89 One of them is to parse packet trying to detect inner encapsulation
90 made by our node. It is difficult or even impossible, especially,
91 taking into account fragmentation. TO be short, ttl is not solution at all.
93 Current solution: The solution was UNEXPECTEDLY SIMPLE.
94 We force DF flag on tunnels with preconfigured hop limit,
95 that is ALL. :-) Well, it does not remove the problem completely,
96 but exponential growth of network traffic is changed to linear
97 (branches, that exceed pmtu are pruned) and tunnel mtu
98 rapidly degrades to value <68, where looping stops.
99 Yes, it is not good if there exists a router in the loop,
100 which does not force DF, even when encapsulating packets have DF set.
101 But it is not our problem! Nobody could accuse us, we made
102 all that we could make. Even if it is your gated who injected
103 fatal route to network, even if it were you who configured
104 fatal static route: you are innocent. :-)
109 static bool log_ecn_error = true;
110 module_param(log_ecn_error, bool, 0644);
111 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
113 static struct rtnl_link_ops ipgre_link_ops __read_mostly;
114 static int ipgre_tunnel_init(struct net_device *dev);
116 static int ipgre_net_id __read_mostly;
117 static int gre_tap_net_id __read_mostly;
119 static void ipgre_err(struct sk_buff *skb, u32 info,
120 const struct tnl_ptk_info *tpi)
123 /* All the routers (except for Linux) return only
124 8 bytes of packet payload. It means, that precise relaying of
125 ICMP in the real Internet is absolutely infeasible.
127 Moreover, Cisco "wise men" put GRE key to the third word
128 in GRE header. It makes impossible maintaining even soft
129 state for keyed GRE tunnels with enabled checksum. Tell
132 Well, I wonder, rfc1812 was written by Cisco employee,
133 what the hell these idiots break standards established
136 struct net *net = dev_net(skb->dev);
137 struct ip_tunnel_net *itn;
138 const struct iphdr *iph;
139 const int type = icmp_hdr(skb)->type;
140 const int code = icmp_hdr(skb)->code;
145 case ICMP_PARAMETERPROB:
148 case ICMP_DEST_UNREACH:
151 case ICMP_PORT_UNREACH:
152 /* Impossible event. */
155 /* All others are translated to HOST_UNREACH.
156 rfc2003 contains "deep thoughts" about NET_UNREACH,
157 I believe they are just ether pollution. --ANK
163 case ICMP_TIME_EXCEEDED:
164 if (code != ICMP_EXC_TTL)
172 if (tpi->proto == htons(ETH_P_TEB))
173 itn = net_generic(net, gre_tap_net_id);
175 itn = net_generic(net, ipgre_net_id);
177 iph = (const struct iphdr *)(icmp_hdr(skb) + 1);
178 t = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
179 iph->daddr, iph->saddr, tpi->key);
184 if (t->parms.iph.daddr == 0 ||
185 ipv4_is_multicast(t->parms.iph.daddr))
188 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
191 if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
195 t->err_time = jiffies;
198 static void gre_err(struct sk_buff *skb, u32 info)
200 /* All the routers (except for Linux) return only
201 * 8 bytes of packet payload. It means, that precise relaying of
202 * ICMP in the real Internet is absolutely infeasible.
204 * Moreover, Cisco "wise men" put GRE key to the third word
205 * in GRE header. It makes impossible maintaining even soft
207 * GRE tunnels with enabled checksum. Tell them "thank you".
209 * Well, I wonder, rfc1812 was written by Cisco employee,
210 * what the hell these idiots break standards established
214 const struct iphdr *iph = (struct iphdr *)skb->data;
215 const int type = icmp_hdr(skb)->type;
216 const int code = icmp_hdr(skb)->code;
217 struct tnl_ptk_info tpi;
218 bool csum_err = false;
220 if (gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP),
222 if (!csum_err) /* ignore csum errors. */
226 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
227 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
228 skb->dev->ifindex, 0, IPPROTO_GRE, 0);
231 if (type == ICMP_REDIRECT) {
232 ipv4_redirect(skb, dev_net(skb->dev), skb->dev->ifindex, 0,
237 ipgre_err(skb, info, &tpi);
240 static __be64 key_to_tunnel_id(__be32 key)
243 return (__force __be64)((__force u32)key);
245 return (__force __be64)((__force u64)key << 32);
249 /* Returns the least-significant 32 bits of a __be64. */
250 static __be32 tunnel_id_to_key(__be64 x)
253 return (__force __be32)x;
255 return (__force __be32)((__force u64)x >> 32);
259 static int __ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi,
260 struct ip_tunnel_net *itn, int hdr_len, bool raw_proto)
262 struct metadata_dst *tun_dst = NULL;
263 const struct iphdr *iph;
264 struct ip_tunnel *tunnel;
267 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, tpi->flags,
268 iph->saddr, iph->daddr, tpi->key);
271 if (__iptunnel_pull_header(skb, hdr_len, tpi->proto,
272 raw_proto, false) < 0)
275 if (tunnel->dev->type != ARPHRD_NONE)
276 skb_pop_mac_header(skb);
278 skb_reset_mac_header(skb);
279 if (tunnel->collect_md) {
283 flags = tpi->flags & (TUNNEL_CSUM | TUNNEL_KEY);
284 tun_id = key_to_tunnel_id(tpi->key);
285 tun_dst = ip_tun_rx_dst(skb, flags, tun_id, 0);
287 return PACKET_REJECT;
290 ip_tunnel_rcv(tunnel, skb, tpi, tun_dst, log_ecn_error);
300 static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi,
303 struct net *net = dev_net(skb->dev);
304 struct ip_tunnel_net *itn;
307 if (tpi->proto == htons(ETH_P_TEB))
308 itn = net_generic(net, gre_tap_net_id);
310 itn = net_generic(net, ipgre_net_id);
312 res = __ipgre_rcv(skb, tpi, itn, hdr_len, false);
313 if (res == PACKET_NEXT && tpi->proto == htons(ETH_P_TEB)) {
314 /* ipgre tunnels in collect metadata mode should receive
315 * also ETH_P_TEB traffic.
317 itn = net_generic(net, ipgre_net_id);
318 res = __ipgre_rcv(skb, tpi, itn, hdr_len, true);
323 static int gre_rcv(struct sk_buff *skb)
325 struct tnl_ptk_info tpi;
326 bool csum_err = false;
329 #ifdef CONFIG_NET_IPGRE_BROADCAST
330 if (ipv4_is_multicast(ip_hdr(skb)->daddr)) {
331 /* Looped back packet, drop it! */
332 if (rt_is_output_route(skb_rtable(skb)))
337 hdr_len = gre_parse_header(skb, &tpi, &csum_err, htons(ETH_P_IP), 0);
341 if (ipgre_rcv(skb, &tpi, hdr_len) == PACKET_RCVD)
344 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
350 static void __gre_xmit(struct sk_buff *skb, struct net_device *dev,
351 const struct iphdr *tnl_params,
354 struct ip_tunnel *tunnel = netdev_priv(dev);
356 if (tunnel->parms.o_flags & TUNNEL_SEQ)
359 /* Push GRE header. */
360 gre_build_header(skb, tunnel->tun_hlen,
361 tunnel->parms.o_flags, proto, tunnel->parms.o_key,
362 htonl(tunnel->o_seqno));
364 skb_set_inner_protocol(skb, proto);
365 ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol);
368 static int gre_handle_offloads(struct sk_buff *skb, bool csum)
370 return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE);
373 static struct rtable *gre_get_rt(struct sk_buff *skb,
374 struct net_device *dev,
376 const struct ip_tunnel_key *key)
378 struct net *net = dev_net(dev);
380 memset(fl, 0, sizeof(*fl));
381 fl->daddr = key->u.ipv4.dst;
382 fl->saddr = key->u.ipv4.src;
383 fl->flowi4_tos = RT_TOS(key->tos);
384 fl->flowi4_mark = skb->mark;
385 fl->flowi4_proto = IPPROTO_GRE;
387 return ip_route_output_key(net, fl);
390 static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev,
393 struct ip_tunnel_info *tun_info;
394 const struct ip_tunnel_key *key;
395 struct rtable *rt = NULL;
403 tun_info = skb_tunnel_info(skb);
404 if (unlikely(!tun_info || !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
405 ip_tunnel_info_af(tun_info) != AF_INET))
408 key = &tun_info->key;
409 use_cache = ip_tunnel_dst_cache_usable(skb, tun_info);
411 rt = dst_cache_get_ip4(&tun_info->dst_cache, &fl.saddr);
413 rt = gre_get_rt(skb, dev, &fl, key);
417 dst_cache_set_ip4(&tun_info->dst_cache, &rt->dst,
421 tunnel_hlen = gre_calc_hlen(key->tun_flags);
423 min_headroom = LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len
424 + tunnel_hlen + sizeof(struct iphdr);
425 if (skb_headroom(skb) < min_headroom || skb_header_cloned(skb)) {
426 int head_delta = SKB_DATA_ALIGN(min_headroom -
429 err = pskb_expand_head(skb, max_t(int, head_delta, 0),
435 /* Push Tunnel header. */
436 if (gre_handle_offloads(skb, !!(tun_info->key.tun_flags & TUNNEL_CSUM)))
439 flags = tun_info->key.tun_flags & (TUNNEL_CSUM | TUNNEL_KEY);
440 gre_build_header(skb, tunnel_hlen, flags, proto,
441 tunnel_id_to_key(tun_info->key.tun_id), 0);
443 df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
445 iptunnel_xmit(skb->sk, rt, skb, fl.saddr, key->u.ipv4.dst, IPPROTO_GRE,
446 key->tos, key->ttl, df, false);
453 dev->stats.tx_dropped++;
456 static int gre_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
458 struct ip_tunnel_info *info = skb_tunnel_info(skb);
462 if (ip_tunnel_info_af(info) != AF_INET)
465 rt = gre_get_rt(skb, dev, &fl4, &info->key);
470 info->key.u.ipv4.src = fl4.saddr;
474 static netdev_tx_t ipgre_xmit(struct sk_buff *skb,
475 struct net_device *dev)
477 struct ip_tunnel *tunnel = netdev_priv(dev);
478 const struct iphdr *tnl_params;
480 if (tunnel->collect_md) {
481 gre_fb_xmit(skb, dev, skb->protocol);
485 if (dev->header_ops) {
486 /* Need space for new headers */
487 if (skb_cow_head(skb, dev->needed_headroom -
488 (tunnel->hlen + sizeof(struct iphdr))))
491 tnl_params = (const struct iphdr *)skb->data;
493 /* Pull skb since ip_tunnel_xmit() needs skb->data pointing
496 skb_pull(skb, tunnel->hlen + sizeof(struct iphdr));
497 skb_reset_mac_header(skb);
499 if (skb_cow_head(skb, dev->needed_headroom))
502 tnl_params = &tunnel->parms.iph;
505 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM)))
508 __gre_xmit(skb, dev, tnl_params, skb->protocol);
513 dev->stats.tx_dropped++;
517 static netdev_tx_t gre_tap_xmit(struct sk_buff *skb,
518 struct net_device *dev)
520 struct ip_tunnel *tunnel = netdev_priv(dev);
522 if (tunnel->collect_md) {
523 gre_fb_xmit(skb, dev, htons(ETH_P_TEB));
527 if (gre_handle_offloads(skb, !!(tunnel->parms.o_flags & TUNNEL_CSUM)))
530 if (skb_cow_head(skb, dev->needed_headroom))
533 __gre_xmit(skb, dev, &tunnel->parms.iph, htons(ETH_P_TEB));
538 dev->stats.tx_dropped++;
542 static int ipgre_tunnel_ioctl(struct net_device *dev,
543 struct ifreq *ifr, int cmd)
546 struct ip_tunnel_parm p;
548 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
550 if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
551 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
552 p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
553 ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
556 p.i_flags = gre_flags_to_tnl_flags(p.i_flags);
557 p.o_flags = gre_flags_to_tnl_flags(p.o_flags);
559 err = ip_tunnel_ioctl(dev, &p, cmd);
563 p.i_flags = gre_tnl_flags_to_gre_flags(p.i_flags);
564 p.o_flags = gre_tnl_flags_to_gre_flags(p.o_flags);
566 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
571 /* Nice toy. Unfortunately, useless in real life :-)
572 It allows to construct virtual multiprotocol broadcast "LAN"
573 over the Internet, provided multicast routing is tuned.
576 I have no idea was this bicycle invented before me,
577 so that I had to set ARPHRD_IPGRE to a random value.
578 I have an impression, that Cisco could make something similar,
579 but this feature is apparently missing in IOS<=11.2(8).
581 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks
582 with broadcast 224.66.66.66. If you have access to mbone, play with me :-)
584 ping -t 255 224.66.66.66
586 If nobody answers, mbone does not work.
588 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255
589 ip addr add 10.66.66.<somewhat>/24 dev Universe
591 ifconfig Universe add fe80::<Your_real_addr>/10
592 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96
595 ftp fec0:6666:6666::193.233.7.65
598 static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
600 const void *daddr, const void *saddr, unsigned int len)
602 struct ip_tunnel *t = netdev_priv(dev);
604 struct gre_base_hdr *greh;
606 iph = (struct iphdr *)skb_push(skb, t->hlen + sizeof(*iph));
607 greh = (struct gre_base_hdr *)(iph+1);
608 greh->flags = gre_tnl_flags_to_gre_flags(t->parms.o_flags);
609 greh->protocol = htons(type);
611 memcpy(iph, &t->parms.iph, sizeof(struct iphdr));
613 /* Set the source hardware address. */
615 memcpy(&iph->saddr, saddr, 4);
617 memcpy(&iph->daddr, daddr, 4);
619 return t->hlen + sizeof(*iph);
621 return -(t->hlen + sizeof(*iph));
624 static int ipgre_header_parse(const struct sk_buff *skb, unsigned char *haddr)
626 const struct iphdr *iph = (const struct iphdr *) skb_mac_header(skb);
627 memcpy(haddr, &iph->saddr, 4);
631 static const struct header_ops ipgre_header_ops = {
632 .create = ipgre_header,
633 .parse = ipgre_header_parse,
636 #ifdef CONFIG_NET_IPGRE_BROADCAST
637 static int ipgre_open(struct net_device *dev)
639 struct ip_tunnel *t = netdev_priv(dev);
641 if (ipv4_is_multicast(t->parms.iph.daddr)) {
645 rt = ip_route_output_gre(t->net, &fl4,
649 RT_TOS(t->parms.iph.tos),
652 return -EADDRNOTAVAIL;
655 if (!__in_dev_get_rtnl(dev))
656 return -EADDRNOTAVAIL;
657 t->mlink = dev->ifindex;
658 ip_mc_inc_group(__in_dev_get_rtnl(dev), t->parms.iph.daddr);
663 static int ipgre_close(struct net_device *dev)
665 struct ip_tunnel *t = netdev_priv(dev);
667 if (ipv4_is_multicast(t->parms.iph.daddr) && t->mlink) {
668 struct in_device *in_dev;
669 in_dev = inetdev_by_index(t->net, t->mlink);
671 ip_mc_dec_group(in_dev, t->parms.iph.daddr);
677 static const struct net_device_ops ipgre_netdev_ops = {
678 .ndo_init = ipgre_tunnel_init,
679 .ndo_uninit = ip_tunnel_uninit,
680 #ifdef CONFIG_NET_IPGRE_BROADCAST
681 .ndo_open = ipgre_open,
682 .ndo_stop = ipgre_close,
684 .ndo_start_xmit = ipgre_xmit,
685 .ndo_do_ioctl = ipgre_tunnel_ioctl,
686 .ndo_change_mtu = ip_tunnel_change_mtu,
687 .ndo_get_stats64 = ip_tunnel_get_stats64,
688 .ndo_get_iflink = ip_tunnel_get_iflink,
691 #define GRE_FEATURES (NETIF_F_SG | \
696 static void ipgre_tunnel_setup(struct net_device *dev)
698 dev->netdev_ops = &ipgre_netdev_ops;
699 dev->type = ARPHRD_IPGRE;
700 ip_tunnel_setup(dev, ipgre_net_id);
703 static void __gre_tunnel_init(struct net_device *dev)
705 struct ip_tunnel *tunnel;
708 tunnel = netdev_priv(dev);
709 tunnel->tun_hlen = gre_calc_hlen(tunnel->parms.o_flags);
710 tunnel->parms.iph.protocol = IPPROTO_GRE;
712 tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
714 t_hlen = tunnel->hlen + sizeof(struct iphdr);
716 dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4;
717 dev->mtu = ETH_DATA_LEN - t_hlen - 4;
719 dev->features |= GRE_FEATURES;
720 dev->hw_features |= GRE_FEATURES;
722 if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) {
723 /* TCP offload with GRE SEQ is not supported, nor
724 * can we support 2 levels of outer headers requiring
727 if (!(tunnel->parms.o_flags & TUNNEL_CSUM) ||
728 (tunnel->encap.type == TUNNEL_ENCAP_NONE)) {
729 dev->features |= NETIF_F_GSO_SOFTWARE;
730 dev->hw_features |= NETIF_F_GSO_SOFTWARE;
733 /* Can use a lockless transmit, unless we generate
736 dev->features |= NETIF_F_LLTX;
740 static int ipgre_tunnel_init(struct net_device *dev)
742 struct ip_tunnel *tunnel = netdev_priv(dev);
743 struct iphdr *iph = &tunnel->parms.iph;
745 __gre_tunnel_init(dev);
747 memcpy(dev->dev_addr, &iph->saddr, 4);
748 memcpy(dev->broadcast, &iph->daddr, 4);
750 dev->flags = IFF_NOARP;
754 if (iph->daddr && !tunnel->collect_md) {
755 #ifdef CONFIG_NET_IPGRE_BROADCAST
756 if (ipv4_is_multicast(iph->daddr)) {
759 dev->flags = IFF_BROADCAST;
760 dev->header_ops = &ipgre_header_ops;
763 } else if (!tunnel->collect_md) {
764 dev->header_ops = &ipgre_header_ops;
767 return ip_tunnel_init(dev);
770 static const struct gre_protocol ipgre_protocol = {
772 .err_handler = gre_err,
775 static int __net_init ipgre_init_net(struct net *net)
777 return ip_tunnel_init_net(net, ipgre_net_id, &ipgre_link_ops, NULL);
780 static void __net_exit ipgre_exit_net(struct net *net)
782 struct ip_tunnel_net *itn = net_generic(net, ipgre_net_id);
783 ip_tunnel_delete_net(itn, &ipgre_link_ops);
786 static struct pernet_operations ipgre_net_ops = {
787 .init = ipgre_init_net,
788 .exit = ipgre_exit_net,
790 .size = sizeof(struct ip_tunnel_net),
793 static int ipgre_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
801 if (data[IFLA_GRE_IFLAGS])
802 flags |= nla_get_be16(data[IFLA_GRE_IFLAGS]);
803 if (data[IFLA_GRE_OFLAGS])
804 flags |= nla_get_be16(data[IFLA_GRE_OFLAGS]);
805 if (flags & (GRE_VERSION|GRE_ROUTING))
808 if (data[IFLA_GRE_COLLECT_METADATA] &&
809 data[IFLA_GRE_ENCAP_TYPE] &&
810 nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE)
816 static int ipgre_tap_validate(struct nlattr *tb[], struct nlattr *data[])
820 if (tb[IFLA_ADDRESS]) {
821 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
823 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
824 return -EADDRNOTAVAIL;
830 if (data[IFLA_GRE_REMOTE]) {
831 memcpy(&daddr, nla_data(data[IFLA_GRE_REMOTE]), 4);
837 return ipgre_tunnel_validate(tb, data);
840 static void ipgre_netlink_parms(struct net_device *dev,
841 struct nlattr *data[],
843 struct ip_tunnel_parm *parms)
845 memset(parms, 0, sizeof(*parms));
847 parms->iph.protocol = IPPROTO_GRE;
852 if (data[IFLA_GRE_LINK])
853 parms->link = nla_get_u32(data[IFLA_GRE_LINK]);
855 if (data[IFLA_GRE_IFLAGS])
856 parms->i_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_IFLAGS]));
858 if (data[IFLA_GRE_OFLAGS])
859 parms->o_flags = gre_flags_to_tnl_flags(nla_get_be16(data[IFLA_GRE_OFLAGS]));
861 if (data[IFLA_GRE_IKEY])
862 parms->i_key = nla_get_be32(data[IFLA_GRE_IKEY]);
864 if (data[IFLA_GRE_OKEY])
865 parms->o_key = nla_get_be32(data[IFLA_GRE_OKEY]);
867 if (data[IFLA_GRE_LOCAL])
868 parms->iph.saddr = nla_get_in_addr(data[IFLA_GRE_LOCAL]);
870 if (data[IFLA_GRE_REMOTE])
871 parms->iph.daddr = nla_get_in_addr(data[IFLA_GRE_REMOTE]);
873 if (data[IFLA_GRE_TTL])
874 parms->iph.ttl = nla_get_u8(data[IFLA_GRE_TTL]);
876 if (data[IFLA_GRE_TOS])
877 parms->iph.tos = nla_get_u8(data[IFLA_GRE_TOS]);
879 if (!data[IFLA_GRE_PMTUDISC] || nla_get_u8(data[IFLA_GRE_PMTUDISC]))
880 parms->iph.frag_off = htons(IP_DF);
882 if (data[IFLA_GRE_COLLECT_METADATA]) {
883 struct ip_tunnel *t = netdev_priv(dev);
885 t->collect_md = true;
886 if (dev->type == ARPHRD_IPGRE)
887 dev->type = ARPHRD_NONE;
891 /* This function returns true when ENCAP attributes are present in the nl msg */
892 static bool ipgre_netlink_encap_parms(struct nlattr *data[],
893 struct ip_tunnel_encap *ipencap)
897 memset(ipencap, 0, sizeof(*ipencap));
902 if (data[IFLA_GRE_ENCAP_TYPE]) {
904 ipencap->type = nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]);
907 if (data[IFLA_GRE_ENCAP_FLAGS]) {
909 ipencap->flags = nla_get_u16(data[IFLA_GRE_ENCAP_FLAGS]);
912 if (data[IFLA_GRE_ENCAP_SPORT]) {
914 ipencap->sport = nla_get_be16(data[IFLA_GRE_ENCAP_SPORT]);
917 if (data[IFLA_GRE_ENCAP_DPORT]) {
919 ipencap->dport = nla_get_be16(data[IFLA_GRE_ENCAP_DPORT]);
925 static int gre_tap_init(struct net_device *dev)
927 __gre_tunnel_init(dev);
928 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
930 return ip_tunnel_init(dev);
933 static const struct net_device_ops gre_tap_netdev_ops = {
934 .ndo_init = gre_tap_init,
935 .ndo_uninit = ip_tunnel_uninit,
936 .ndo_start_xmit = gre_tap_xmit,
937 .ndo_set_mac_address = eth_mac_addr,
938 .ndo_validate_addr = eth_validate_addr,
939 .ndo_change_mtu = ip_tunnel_change_mtu,
940 .ndo_get_stats64 = ip_tunnel_get_stats64,
941 .ndo_get_iflink = ip_tunnel_get_iflink,
942 .ndo_fill_metadata_dst = gre_fill_metadata_dst,
945 static void ipgre_tap_setup(struct net_device *dev)
948 dev->netdev_ops = &gre_tap_netdev_ops;
949 dev->priv_flags &= ~IFF_TX_SKB_SHARING;
950 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
951 ip_tunnel_setup(dev, gre_tap_net_id);
954 static int ipgre_newlink(struct net *src_net, struct net_device *dev,
955 struct nlattr *tb[], struct nlattr *data[])
957 struct ip_tunnel_parm p;
958 struct ip_tunnel_encap ipencap;
960 if (ipgre_netlink_encap_parms(data, &ipencap)) {
961 struct ip_tunnel *t = netdev_priv(dev);
962 int err = ip_tunnel_encap_setup(t, &ipencap);
968 ipgre_netlink_parms(dev, data, tb, &p);
969 return ip_tunnel_newlink(dev, tb, &p);
972 static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
973 struct nlattr *data[])
975 struct ip_tunnel_parm p;
976 struct ip_tunnel_encap ipencap;
978 if (ipgre_netlink_encap_parms(data, &ipencap)) {
979 struct ip_tunnel *t = netdev_priv(dev);
980 int err = ip_tunnel_encap_setup(t, &ipencap);
986 ipgre_netlink_parms(dev, data, tb, &p);
987 return ip_tunnel_changelink(dev, tb, &p);
990 static size_t ipgre_get_size(const struct net_device *dev)
995 /* IFLA_GRE_IFLAGS */
997 /* IFLA_GRE_OFLAGS */
1003 /* IFLA_GRE_LOCAL */
1005 /* IFLA_GRE_REMOTE */
1011 /* IFLA_GRE_PMTUDISC */
1013 /* IFLA_GRE_ENCAP_TYPE */
1015 /* IFLA_GRE_ENCAP_FLAGS */
1017 /* IFLA_GRE_ENCAP_SPORT */
1019 /* IFLA_GRE_ENCAP_DPORT */
1021 /* IFLA_GRE_COLLECT_METADATA */
1026 static int ipgre_fill_info(struct sk_buff *skb, const struct net_device *dev)
1028 struct ip_tunnel *t = netdev_priv(dev);
1029 struct ip_tunnel_parm *p = &t->parms;
1031 if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
1032 nla_put_be16(skb, IFLA_GRE_IFLAGS,
1033 gre_tnl_flags_to_gre_flags(p->i_flags)) ||
1034 nla_put_be16(skb, IFLA_GRE_OFLAGS,
1035 gre_tnl_flags_to_gre_flags(p->o_flags)) ||
1036 nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
1037 nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
1038 nla_put_in_addr(skb, IFLA_GRE_LOCAL, p->iph.saddr) ||
1039 nla_put_in_addr(skb, IFLA_GRE_REMOTE, p->iph.daddr) ||
1040 nla_put_u8(skb, IFLA_GRE_TTL, p->iph.ttl) ||
1041 nla_put_u8(skb, IFLA_GRE_TOS, p->iph.tos) ||
1042 nla_put_u8(skb, IFLA_GRE_PMTUDISC,
1043 !!(p->iph.frag_off & htons(IP_DF))))
1044 goto nla_put_failure;
1046 if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
1048 nla_put_be16(skb, IFLA_GRE_ENCAP_SPORT,
1050 nla_put_be16(skb, IFLA_GRE_ENCAP_DPORT,
1052 nla_put_u16(skb, IFLA_GRE_ENCAP_FLAGS,
1054 goto nla_put_failure;
1056 if (t->collect_md) {
1057 if (nla_put_flag(skb, IFLA_GRE_COLLECT_METADATA))
1058 goto nla_put_failure;
1067 static const struct nla_policy ipgre_policy[IFLA_GRE_MAX + 1] = {
1068 [IFLA_GRE_LINK] = { .type = NLA_U32 },
1069 [IFLA_GRE_IFLAGS] = { .type = NLA_U16 },
1070 [IFLA_GRE_OFLAGS] = { .type = NLA_U16 },
1071 [IFLA_GRE_IKEY] = { .type = NLA_U32 },
1072 [IFLA_GRE_OKEY] = { .type = NLA_U32 },
1073 [IFLA_GRE_LOCAL] = { .len = FIELD_SIZEOF(struct iphdr, saddr) },
1074 [IFLA_GRE_REMOTE] = { .len = FIELD_SIZEOF(struct iphdr, daddr) },
1075 [IFLA_GRE_TTL] = { .type = NLA_U8 },
1076 [IFLA_GRE_TOS] = { .type = NLA_U8 },
1077 [IFLA_GRE_PMTUDISC] = { .type = NLA_U8 },
1078 [IFLA_GRE_ENCAP_TYPE] = { .type = NLA_U16 },
1079 [IFLA_GRE_ENCAP_FLAGS] = { .type = NLA_U16 },
1080 [IFLA_GRE_ENCAP_SPORT] = { .type = NLA_U16 },
1081 [IFLA_GRE_ENCAP_DPORT] = { .type = NLA_U16 },
1082 [IFLA_GRE_COLLECT_METADATA] = { .type = NLA_FLAG },
1085 static struct rtnl_link_ops ipgre_link_ops __read_mostly = {
1087 .maxtype = IFLA_GRE_MAX,
1088 .policy = ipgre_policy,
1089 .priv_size = sizeof(struct ip_tunnel),
1090 .setup = ipgre_tunnel_setup,
1091 .validate = ipgre_tunnel_validate,
1092 .newlink = ipgre_newlink,
1093 .changelink = ipgre_changelink,
1094 .dellink = ip_tunnel_dellink,
1095 .get_size = ipgre_get_size,
1096 .fill_info = ipgre_fill_info,
1097 .get_link_net = ip_tunnel_get_link_net,
1100 static struct rtnl_link_ops ipgre_tap_ops __read_mostly = {
1102 .maxtype = IFLA_GRE_MAX,
1103 .policy = ipgre_policy,
1104 .priv_size = sizeof(struct ip_tunnel),
1105 .setup = ipgre_tap_setup,
1106 .validate = ipgre_tap_validate,
1107 .newlink = ipgre_newlink,
1108 .changelink = ipgre_changelink,
1109 .dellink = ip_tunnel_dellink,
1110 .get_size = ipgre_get_size,
1111 .fill_info = ipgre_fill_info,
1112 .get_link_net = ip_tunnel_get_link_net,
1115 struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
1116 u8 name_assign_type)
1118 struct nlattr *tb[IFLA_MAX + 1];
1119 struct net_device *dev;
1120 LIST_HEAD(list_kill);
1121 struct ip_tunnel *t;
1124 memset(&tb, 0, sizeof(tb));
1126 dev = rtnl_create_link(net, name, name_assign_type,
1127 &ipgre_tap_ops, tb);
1131 /* Configure flow based GRE device. */
1132 t = netdev_priv(dev);
1133 t->collect_md = true;
1135 err = ipgre_newlink(net, dev, tb, NULL);
1138 return ERR_PTR(err);
1141 /* openvswitch users expect packet sizes to be unrestricted,
1142 * so set the largest MTU we can.
1144 err = __ip_tunnel_change_mtu(dev, IP_MAX_MTU, false);
1148 err = rtnl_configure_link(dev, NULL);
1154 ip_tunnel_dellink(dev, &list_kill);
1155 unregister_netdevice_many(&list_kill);
1156 return ERR_PTR(err);
1158 EXPORT_SYMBOL_GPL(gretap_fb_dev_create);
1160 static int __net_init ipgre_tap_init_net(struct net *net)
1162 return ip_tunnel_init_net(net, gre_tap_net_id, &ipgre_tap_ops, "gretap0");
1165 static void __net_exit ipgre_tap_exit_net(struct net *net)
1167 struct ip_tunnel_net *itn = net_generic(net, gre_tap_net_id);
1168 ip_tunnel_delete_net(itn, &ipgre_tap_ops);
1171 static struct pernet_operations ipgre_tap_net_ops = {
1172 .init = ipgre_tap_init_net,
1173 .exit = ipgre_tap_exit_net,
1174 .id = &gre_tap_net_id,
1175 .size = sizeof(struct ip_tunnel_net),
1178 static int __init ipgre_init(void)
1182 pr_info("GRE over IPv4 tunneling driver\n");
1184 err = register_pernet_device(&ipgre_net_ops);
1188 err = register_pernet_device(&ipgre_tap_net_ops);
1190 goto pnet_tap_faied;
1192 err = gre_add_protocol(&ipgre_protocol, GREPROTO_CISCO);
1194 pr_info("%s: can't add protocol\n", __func__);
1195 goto add_proto_failed;
1198 err = rtnl_link_register(&ipgre_link_ops);
1200 goto rtnl_link_failed;
1202 err = rtnl_link_register(&ipgre_tap_ops);
1204 goto tap_ops_failed;
1209 rtnl_link_unregister(&ipgre_link_ops);
1211 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
1213 unregister_pernet_device(&ipgre_tap_net_ops);
1215 unregister_pernet_device(&ipgre_net_ops);
1219 static void __exit ipgre_fini(void)
1221 rtnl_link_unregister(&ipgre_tap_ops);
1222 rtnl_link_unregister(&ipgre_link_ops);
1223 gre_del_protocol(&ipgre_protocol, GREPROTO_CISCO);
1224 unregister_pernet_device(&ipgre_tap_net_ops);
1225 unregister_pernet_device(&ipgre_net_ops);
1228 module_init(ipgre_init);
1229 module_exit(ipgre_fini);
1230 MODULE_LICENSE("GPL");
1231 MODULE_ALIAS_RTNL_LINK("gre");
1232 MODULE_ALIAS_RTNL_LINK("gretap");
1233 MODULE_ALIAS_NETDEV("gre0");
1234 MODULE_ALIAS_NETDEV("gretap0");