[mirror_ubuntu-zesty-kernel.git] / net / ipv4 / ipip.c

/*
 *	Linux NET3:	IP/IP protocol decoder.
 *
 *	Authors:
 *		Sam Lantinga (slouken@cs.ucdavis.edu)  02/01/95
 *
 *	Fixes:
 *		Alan Cox	:	Merged and made usable non modular (its so tiny its silly as
 *					a module taking up 2 pages).
 *		Alan Cox	: 	Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
 *					to keep ip_forward happy.
 *		Alan Cox	:	More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
 *		Kai Schulte	:	Fixed #defines for IP_FIREWALL->FIREWALL
 *              David Woodhouse :       Perform some basic ICMP handling.
 *                                      IPIP Routing without decapsulation.
 *              Carlos Picoto   :       GRE over IP support
 *		Alexey Kuznetsov:	Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
 *					I do not want to merge them together.
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License
 *	as published by the Free Software Foundation; either version
 *	2 of the License, or (at your option) any later version.
 *
 */

/* tunnel.c: an IP tunnel driver

	The purpose of this driver is to provide an IP tunnel through
	which you can tunnel network traffic transparently across subnets.

	This was written by looking at Nick Holloway's dummy driver
	Thanks for the great code!

		-Sam Lantinga	(slouken@cs.ucdavis.edu)  02/01/95

	Minor tweaks:
		Cleaned up the code a little and added some pre-1.3.0 tweaks.
		dev->hard_header/hard_header_len changed to use no headers.
		Comments/bracketing tweaked.
		Made the tunnels use dev->name not tunnel: when error reporting.
		Added tx_dropped stat

		-Alan Cox	(alan@lxorguk.ukuu.org.uk) 21 March 95

	Reworked:
		Changed to tunnel to destination gateway in addition to the
			tunnel's pointopoint address
		Almost completely rewritten
		Note:  There is currently no firewall or ICMP handling done.

		-Sam Lantinga	(slouken@cs.ucdavis.edu) 02/13/96

*/

/* Things I wish I had known when writing the tunnel driver:

	When the tunnel_xmit() function is called, the skb contains the
	packet to be sent (plus a great deal of extra info), and dev
	contains the tunnel device that _we_ are.

	When we are passed a packet, we are expected to fill in the
	source address with our source IP address.

	What is the proper way to allocate, copy and free a buffer?
	After you allocate it, it is a "0 length" chunk of memory
	starting at zero.  If you want to add headers to the buffer
	later, you'll have to call "skb_reserve(skb, amount)" with
	the amount of memory you want reserved.  Then, you call
	"skb_put(skb, amount)" with the amount of space you want in
	the buffer.  skb_put() returns a pointer to the top (#0) of
	that buffer.  skb->len is set to the amount of space you have
	"allocated" with skb_put().  You can then write up to skb->len
	bytes to that buffer.  If you need more, you can call skb_put()
	again with the additional amount of space you need.  You can
	find out how much more space you can allocate by calling
	"skb_tailroom(skb)".
	Now, to add header space, call "skb_push(skb, header_len)".
	This creates space at the beginning of the buffer and returns
	a pointer to this new space.  If later you need to strip a
	header from a buffer, call "skb_pull(skb, header_len)".
	skb_headroom() will return how much space is left at the top
	of the buffer (before the main data).  Remember, this headroom
	space must be reserved before the skb_put() function is called.
	*/

/*
   This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c

   For comments look at net/ipv4/ip_gre.c --ANK
 */


#include <linux/capability.h>
#include <linux/module.h>
#include <linux/types.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <asm/uaccess.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/in.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/if_arp.h>
#include <linux/mroute.h>
#include <linux/init.h>
#include <linux/netfilter_ipv4.h>
#include <linux/if_ether.h>

#include <net/sock.h>
#include <net/ip.h>
#include <net/icmp.h>
#include <net/ip_tunnels.h>
#include <net/inet_ecn.h>
#include <net/xfrm.h>
#include <net/net_namespace.h>
#include <net/netns/generic.h>

static bool log_ecn_error = true;
module_param(log_ecn_error, bool, 0644);
MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");

static int ipip_net_id __read_mostly;

static int ipip_tunnel_init(struct net_device *dev);
static struct rtnl_link_ops ipip_link_ops __read_mostly;

static int ipip_err(struct sk_buff *skb, u32 info)
{

/* All the routers (except for Linux) return only
   8 bytes of packet payload. It means, that precise relaying of
   ICMP in the real Internet is absolutely infeasible.
 */
	struct net *net = dev_net(skb->dev);
	struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
	const struct iphdr *iph = (const struct iphdr *)skb->data;
	struct ip_tunnel *t;
	int err;
	const int type = icmp_hdr(skb)->type;
	const int code = icmp_hdr(skb)->code;

	err = -ENOENT;
	t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
			     iph->daddr, iph->saddr, 0);
	if (!t)
		goto out;

	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
		ipv4_update_pmtu(skb, dev_net(skb->dev), info,
				 t->parms.link, 0, IPPROTO_IPIP, 0);
		err = 0;
		goto out;
	}

	if (type == ICMP_REDIRECT) {
		ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
			      IPPROTO_IPIP, 0);
		err = 0;
		goto out;
	}

	if (t->parms.iph.daddr == 0)
		goto out;

	err = 0;
	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
		goto out;

	if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
		t->err_count++;
	else
		t->err_count = 1;
	t->err_time = jiffies;

out:
	return err;
}

static const struct tnl_ptk_info tpi = {
	/* no tunnel info required for ipip. */
	.proto = htons(ETH_P_IP),
};

static int ipip_rcv(struct sk_buff *skb)
{
	struct net *net = dev_net(skb->dev);
	struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
	struct ip_tunnel *tunnel;
	const struct iphdr *iph;

	iph = ip_hdr(skb);
	tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
			iph->saddr, iph->daddr, 0);
	if (tunnel) {
		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
			goto drop;
		if (iptunnel_pull_header(skb, 0, tpi.proto))
			goto drop;
		return ip_tunnel_rcv(tunnel, skb, &tpi, NULL, log_ecn_error);
	}

	return -1;

drop:
	kfree_skb(skb);
	return 0;
}

/*
 *	This function assumes it is being called from dev_queue_xmit()
 *	and that skb is filled properly by that function.
 */
static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
{
	struct ip_tunnel *tunnel = netdev_priv(dev);
	const struct iphdr  *tiph = &tunnel->parms.iph;

	if (unlikely(skb->protocol != htons(ETH_P_IP)))
		goto tx_error;

	skb = iptunnel_handle_offloads(skb, false, SKB_GSO_IPIP);
	if (IS_ERR(skb))
		goto out;

	skb_set_inner_ipproto(skb, IPPROTO_IPIP);

	ip_tunnel_xmit(skb, dev, tiph, tiph->protocol);
	return NETDEV_TX_OK;

tx_error:
	kfree_skb(skb);
out:
	dev->stats.tx_errors++;
	return NETDEV_TX_OK;
}

static int
ipip_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
{
	int err = 0;
	struct ip_tunnel_parm p;

	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
		return -EFAULT;

	if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
		    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
			return -EINVAL;
	}

	p.i_key = p.o_key = 0;
	p.i_flags = p.o_flags = 0;
	err = ip_tunnel_ioctl(dev, &p, cmd);
	if (err)
		return err;

	if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
		return -EFAULT;

	return 0;
}

static const struct net_device_ops ipip_netdev_ops = {
	.ndo_init       = ipip_tunnel_init,
	.ndo_uninit     = ip_tunnel_uninit,
	.ndo_start_xmit	= ipip_tunnel_xmit,
	.ndo_do_ioctl	= ipip_tunnel_ioctl,
	.ndo_change_mtu = ip_tunnel_change_mtu,
	.ndo_get_stats64 = ip_tunnel_get_stats64,
	.ndo_get_iflink = ip_tunnel_get_iflink,
};

#define IPIP_FEATURES (NETIF_F_SG |		\
		       NETIF_F_FRAGLIST |	\
		       NETIF_F_HIGHDMA |	\
		       NETIF_F_GSO_SOFTWARE |	\
		       NETIF_F_HW_CSUM)

static void ipip_tunnel_setup(struct net_device *dev)
{
	dev->netdev_ops		= &ipip_netdev_ops;

	dev->type		= ARPHRD_TUNNEL;
	dev->flags		= IFF_NOARP;
	dev->addr_len		= 4;
	dev->features		|= NETIF_F_LLTX;
	netif_keep_dst(dev);

	dev->features		|= IPIP_FEATURES;
	dev->hw_features	|= IPIP_FEATURES;
	ip_tunnel_setup(dev, ipip_net_id);
}

static int ipip_tunnel_init(struct net_device *dev)
{
	struct ip_tunnel *tunnel = netdev_priv(dev);

	memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
	memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);

	tunnel->tun_hlen = 0;
	tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
	tunnel->parms.iph.protocol = IPPROTO_IPIP;
	return ip_tunnel_init(dev);
}

static void ipip_netlink_parms(struct nlattr *data[],
			       struct ip_tunnel_parm *parms)
{
	memset(parms, 0, sizeof(*parms));

	parms->iph.version = 4;
	parms->iph.protocol = IPPROTO_IPIP;
	parms->iph.ihl = 5;

	if (!data)
		return;

	if (data[IFLA_IPTUN_LINK])
		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);

	if (data[IFLA_IPTUN_LOCAL])
		parms->iph.saddr = nla_get_in_addr(data[IFLA_IPTUN_LOCAL]);

	if (data[IFLA_IPTUN_REMOTE])
		parms->iph.daddr = nla_get_in_addr(data[IFLA_IPTUN_REMOTE]);

	if (data[IFLA_IPTUN_TTL]) {
		parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
		if (parms->iph.ttl)
			parms->iph.frag_off = htons(IP_DF);
	}

	if (data[IFLA_IPTUN_TOS])
		parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);

	if (!data[IFLA_IPTUN_PMTUDISC] || nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
		parms->iph.frag_off = htons(IP_DF);
}

/* This function returns true when ENCAP attributes are present in the nl msg */
static bool ipip_netlink_encap_parms(struct nlattr *data[],
				     struct ip_tunnel_encap *ipencap)
{
	bool ret = false;

	memset(ipencap, 0, sizeof(*ipencap));

	if (!data)
		return ret;

	if (data[IFLA_IPTUN_ENCAP_TYPE]) {
		ret = true;
		ipencap->type = nla_get_u16(data[IFLA_IPTUN_ENCAP_TYPE]);
	}

	if (data[IFLA_IPTUN_ENCAP_FLAGS]) {
		ret = true;
		ipencap->flags = nla_get_u16(data[IFLA_IPTUN_ENCAP_FLAGS]);
	}

	if (data[IFLA_IPTUN_ENCAP_SPORT]) {
		ret = true;
		ipencap->sport = nla_get_be16(data[IFLA_IPTUN_ENCAP_SPORT]);
	}

	if (data[IFLA_IPTUN_ENCAP_DPORT]) {
		ret = true;
		ipencap->dport = nla_get_be16(data[IFLA_IPTUN_ENCAP_DPORT]);
	}

	return ret;
}

static int ipip_newlink(struct net *src_net, struct net_device *dev,
			struct nlattr *tb[], struct nlattr *data[])
{
	struct ip_tunnel_parm p;
	struct ip_tunnel_encap ipencap;

	if (ipip_netlink_encap_parms(data, &ipencap)) {
		struct ip_tunnel *t = netdev_priv(dev);
		int err = ip_tunnel_encap_setup(t, &ipencap);

		if (err < 0)
			return err;
	}

	ipip_netlink_parms(data, &p);
	return ip_tunnel_newlink(dev, tb, &p);
}

static int ipip_changelink(struct net_device *dev, struct nlattr *tb[],
			   struct nlattr *data[])
{
	struct ip_tunnel_parm p;
	struct ip_tunnel_encap ipencap;

	if (ipip_netlink_encap_parms(data, &ipencap)) {
		struct ip_tunnel *t = netdev_priv(dev);
		int err = ip_tunnel_encap_setup(t, &ipencap);

		if (err < 0)
			return err;
	}

	ipip_netlink_parms(data, &p);

	if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) ||
	    (!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
		return -EINVAL;

	return ip_tunnel_changelink(dev, tb, &p);
}

static size_t ipip_get_size(const struct net_device *dev)
{
	return
		/* IFLA_IPTUN_LINK */
		nla_total_size(4) +
		/* IFLA_IPTUN_LOCAL */
		nla_total_size(4) +
		/* IFLA_IPTUN_REMOTE */
		nla_total_size(4) +
		/* IFLA_IPTUN_TTL */
		nla_total_size(1) +
		/* IFLA_IPTUN_TOS */
		nla_total_size(1) +
		/* IFLA_IPTUN_PMTUDISC */
		nla_total_size(1) +
		/* IFLA_IPTUN_ENCAP_TYPE */
		nla_total_size(2) +
		/* IFLA_IPTUN_ENCAP_FLAGS */
		nla_total_size(2) +
		/* IFLA_IPTUN_ENCAP_SPORT */
		nla_total_size(2) +
		/* IFLA_IPTUN_ENCAP_DPORT */
		nla_total_size(2) +
		0;
}

static int ipip_fill_info(struct sk_buff *skb, const struct net_device *dev)
{
	struct ip_tunnel *tunnel = netdev_priv(dev);
	struct ip_tunnel_parm *parm = &tunnel->parms;

	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
	    nla_put_in_addr(skb, IFLA_IPTUN_LOCAL, parm->iph.saddr) ||
	    nla_put_in_addr(skb, IFLA_IPTUN_REMOTE, parm->iph.daddr) ||
	    nla_put_u8(skb, IFLA_IPTUN_TTL, parm->iph.ttl) ||
	    nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
	    nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
		       !!(parm->iph.frag_off & htons(IP_DF))))
		goto nla_put_failure;

	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE,
			tunnel->encap.type) ||
	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT,
			 tunnel->encap.sport) ||
	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT,
			 tunnel->encap.dport) ||
	    nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS,
			tunnel->encap.flags))
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -EMSGSIZE;
}

static const struct nla_policy ipip_policy[IFLA_IPTUN_MAX + 1] = {
	[IFLA_IPTUN_LINK]		= { .type = NLA_U32 },
	[IFLA_IPTUN_LOCAL]		= { .type = NLA_U32 },
	[IFLA_IPTUN_REMOTE]		= { .type = NLA_U32 },
	[IFLA_IPTUN_TTL]		= { .type = NLA_U8 },
	[IFLA_IPTUN_TOS]		= { .type = NLA_U8 },
	[IFLA_IPTUN_PMTUDISC]		= { .type = NLA_U8 },
	[IFLA_IPTUN_ENCAP_TYPE]		= { .type = NLA_U16 },
	[IFLA_IPTUN_ENCAP_FLAGS]	= { .type = NLA_U16 },
	[IFLA_IPTUN_ENCAP_SPORT]	= { .type = NLA_U16 },
	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
};

static struct rtnl_link_ops ipip_link_ops __read_mostly = {
	.kind		= "ipip",
	.maxtype	= IFLA_IPTUN_MAX,
	.policy		= ipip_policy,
	.priv_size	= sizeof(struct ip_tunnel),
	.setup		= ipip_tunnel_setup,
	.newlink	= ipip_newlink,
	.changelink	= ipip_changelink,
	.dellink	= ip_tunnel_dellink,
	.get_size	= ipip_get_size,
	.fill_info	= ipip_fill_info,
	.get_link_net	= ip_tunnel_get_link_net,
};

static struct xfrm_tunnel ipip_handler __read_mostly = {
	.handler	=	ipip_rcv,
	.err_handler	=	ipip_err,
	.priority	=	1,
};

static int __net_init ipip_init_net(struct net *net)
{
	return ip_tunnel_init_net(net, ipip_net_id, &ipip_link_ops, "tunl0");
}

static void __net_exit ipip_exit_net(struct net *net)
{
	struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
	ip_tunnel_delete_net(itn, &ipip_link_ops);
}

static struct pernet_operations ipip_net_ops = {
	.init = ipip_init_net,
	.exit = ipip_exit_net,
	.id   = &ipip_net_id,
	.size = sizeof(struct ip_tunnel_net),
};

static int __init ipip_init(void)
{
	int err;

	pr_info("ipip: IPv4 over IPv4 tunneling driver\n");

	err = register_pernet_device(&ipip_net_ops);
	if (err < 0)
		return err;
	err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
	if (err < 0) {
		pr_info("%s: can't register tunnel\n", __func__);
		goto xfrm_tunnel_failed;
	}
	err = rtnl_link_register(&ipip_link_ops);
	if (err < 0)
		goto rtnl_link_failed;

out:
	return err;

rtnl_link_failed:
	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
xfrm_tunnel_failed:
	unregister_pernet_device(&ipip_net_ops);
	goto out;
}

static void __exit ipip_fini(void)
{
	rtnl_link_unregister(&ipip_link_ops);
	if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
		pr_info("%s: can't deregister tunnel\n", __func__);

	unregister_pernet_device(&ipip_net_ops);
}

module_init(ipip_init);
module_exit(ipip_fini);
MODULE_LICENSE("GPL");
MODULE_ALIAS_RTNL_LINK("ipip");
MODULE_ALIAS_NETDEV("tunl0");
Commit	Line	Data
1da177e4	1	/*
e905a9ed	2	* Linux NET3: IP/IP protocol decoder.
1da177e4	3	*
1da177e4 LT	4	* Authors:
	5	* Sam Lantinga (slouken@cs.ucdavis.edu) 02/01/95
	6	*
	7	* Fixes:
	8	* Alan Cox : Merged and made usable non modular (its so tiny its silly as
	9	* a module taking up 2 pages).
	10	* Alan Cox : Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
	11	* to keep ip_forward happy.
	12	* Alan Cox : More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
	13	* Kai Schulte : Fixed #defines for IP_FIREWALL->FIREWALL
	14	* David Woodhouse : Perform some basic ICMP handling.
	15	* IPIP Routing without decapsulation.
	16	* Carlos Picoto : GRE over IP support
	17	* Alexey Kuznetsov: Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
	18	* I do not want to merge them together.
	19	*
	20	* This program is free software; you can redistribute it and/or
	21	* modify it under the terms of the GNU General Public License
	22	* as published by the Free Software Foundation; either version
	23	* 2 of the License, or (at your option) any later version.
	24	*
	25	*/
	26
	27	/* tunnel.c: an IP tunnel driver
	28
	29	The purpose of this driver is to provide an IP tunnel through
	30	which you can tunnel network traffic transparently across subnets.
	31
	32	This was written by looking at Nick Holloway's dummy driver
	33	Thanks for the great code!
	34
	35	-Sam Lantinga (slouken@cs.ucdavis.edu) 02/01/95
e905a9ed	36
1da177e4 LT	37	Minor tweaks:
	38	Cleaned up the code a little and added some pre-1.3.0 tweaks.
	39	dev->hard_header/hard_header_len changed to use no headers.
	40	Comments/bracketing tweaked.
	41	Made the tunnels use dev->name not tunnel: when error reporting.
	42	Added tx_dropped stat
e905a9ed	43
113aa838	44	-Alan Cox (alan@lxorguk.ukuu.org.uk) 21 March 95
1da177e4 LT	45
	46	Reworked:
	47	Changed to tunnel to destination gateway in addition to the
	48	tunnel's pointopoint address
	49	Almost completely rewritten
	50	Note: There is currently no firewall or ICMP handling done.
	51
	52	-Sam Lantinga (slouken@cs.ucdavis.edu) 02/13/96
e905a9ed	53
1da177e4 LT	54	*/
	55
	56	/* Things I wish I had known when writing the tunnel driver:
	57
	58	When the tunnel_xmit() function is called, the skb contains the
	59	packet to be sent (plus a great deal of extra info), and dev
	60	contains the tunnel device that _we_ are.
	61
	62	When we are passed a packet, we are expected to fill in the
	63	source address with our source IP address.
	64
	65	What is the proper way to allocate, copy and free a buffer?
	66	After you allocate it, it is a "0 length" chunk of memory
	67	starting at zero. If you want to add headers to the buffer
	68	later, you'll have to call "skb_reserve(skb, amount)" with
	69	the amount of memory you want reserved. Then, you call
	70	"skb_put(skb, amount)" with the amount of space you want in
	71	the buffer. skb_put() returns a pointer to the top (#0) of
	72	that buffer. skb->len is set to the amount of space you have
	73	"allocated" with skb_put(). You can then write up to skb->len
	74	bytes to that buffer. If you need more, you can call skb_put()
	75	again with the additional amount of space you need. You can
e905a9ed	76	find out how much more space you can allocate by calling
1da177e4 LT	77	"skb_tailroom(skb)".
	78	Now, to add header space, call "skb_push(skb, header_len)".
	79	This creates space at the beginning of the buffer and returns
	80	a pointer to this new space. If later you need to strip a
	81	header from a buffer, call "skb_pull(skb, header_len)".
	82	skb_headroom() will return how much space is left at the top
	83	of the buffer (before the main data). Remember, this headroom
	84	space must be reserved before the skb_put() function is called.
	85	*/
	86
	87	/*
	88	This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c
	89
	90	For comments look at net/ipv4/ip_gre.c --ANK
	91	*/
	92
e905a9ed	93
4fc268d2	94	#include <linux/capability.h>
1da177e4 LT	95	#include <linux/module.h>
1da177e4 LT	96	#include <linux/types.h>
1da177e4	97	#include <linux/kernel.h>
5a0e3ad6	98	#include <linux/slab.h>
1da177e4 LT	99	#include <asm/uaccess.h>
	100	#include <linux/skbuff.h>
	101	#include <linux/netdevice.h>
	102	#include <linux/in.h>
	103	#include <linux/tcp.h>
	104	#include <linux/udp.h>
	105	#include <linux/if_arp.h>
	106	#include <linux/mroute.h>
	107	#include <linux/init.h>
	108	#include <linux/netfilter_ipv4.h>
46f25dff	109	#include <linux/if_ether.h>
1da177e4 LT	110
	111	#include <net/sock.h>
	112	#include <net/ip.h>
	113	#include <net/icmp.h>
c5441932	114	#include <net/ip_tunnels.h>
1da177e4 LT	115	#include <net/inet_ecn.h>
1da177e4 LT	116	#include <net/xfrm.h>
10dc4c7b PE	117	#include <net/net_namespace.h>
10dc4c7b PE	118	#include <net/netns/generic.h>
1da177e4	119
eccc1bb8	120	static bool log_ecn_error = true;
	121	module_param(log_ecn_error, bool, 0644);
	122	MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
	123
f99189b1	124	static int ipip_net_id __read_mostly;
10dc4c7b	125
3c97af99	126	static int ipip_tunnel_init(struct net_device *dev);
0974658d	127	static struct rtnl_link_ops ipip_link_ops __read_mostly;
1da177e4	128
d2acc347	129	static int ipip_err(struct sk_buff *skb, u32 info)
1da177e4	130	{
1da177e4	131
071f92d0	132	/* All the routers (except for Linux) return only
1da177e4 LT	133	8 bytes of packet payload. It means, that precise relaying of
	134	ICMP in the real Internet is absolutely infeasible.
	135	*/
fd58156e PS	136	struct net *net = dev_net(skb->dev);
fd58156e PS	137	struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
b71d1d42	138	const struct iphdr iph = (const struct iphdr )skb->data;
1da177e4	139	struct ip_tunnel *t;
d2acc347	140	int err;
fd58156e PS	141	const int type = icmp_hdr(skb)->type;
fd58156e PS	142	const int code = icmp_hdr(skb)->code;
1da177e4	143
d2acc347	144	err = -ENOENT;
fd58156e PS	145	t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
fd58156e PS	146	iph->daddr, iph->saddr, 0);
51456b29	147	if (!t)
36393395 DM	148	goto out;
	149
	150	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
	151	ipv4_update_pmtu(skb, dev_net(skb->dev), info,
2346829e	152	t->parms.link, 0, IPPROTO_IPIP, 0);
36393395 DM	153	err = 0;
	154	goto out;
	155	}
	156
55be7a9c	157	if (type == ICMP_REDIRECT) {
2346829e	158	ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
55be7a9c DM	159	IPPROTO_IPIP, 0);
	160	err = 0;
	161	goto out;
	162	}
	163
36393395	164	if (t->parms.iph.daddr == 0)
1da177e4	165	goto out;
d2acc347 HX	166
d2acc347 HX	167	err = 0;
1da177e4 LT	168	if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
	169	goto out;
	170
26d94b46	171	if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
1da177e4 LT	172	t->err_count++;
	173	else
	174	t->err_count = 1;
	175	t->err_time = jiffies;
b0558ef2	176
fd58156e	177	out:
d2acc347	178	return err;
1da177e4 LT	179	}
1da177e4 LT	180
fd58156e PS	181	static const struct tnl_ptk_info tpi = {
	182	/* no tunnel info required for ipip. */
	183	.proto = htons(ETH_P_IP),
	184	};
	185
1da177e4 LT	186	static int ipip_rcv(struct sk_buff *skb)
1da177e4 LT	187	{
fd58156e PS	188	struct net *net = dev_net(skb->dev);
fd58156e PS	189	struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
1da177e4	190	struct ip_tunnel *tunnel;
3d7b46cd	191	const struct iphdr *iph;
3c97af99	192
3d7b46cd	193	iph = ip_hdr(skb);
fd58156e PS	194	tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
	195	iph->saddr, iph->daddr, 0);
	196	if (tunnel) {
eccc1bb8	197	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
eccc1bb8	198	goto drop;
737e828b LH	199	if (iptunnel_pull_header(skb, 0, tpi.proto))
737e828b LH	200	goto drop;
2e15ea39	201	return ip_tunnel_rcv(tunnel, skb, &tpi, NULL, log_ecn_error);
1da177e4	202	}
1da177e4	203
1da177e4	204	return -1;
eccc1bb8	205
	206	drop:
	207	kfree_skb(skb);
	208	return 0;
1da177e4 LT	209	}
	210
	211	/*
	212	* This function assumes it is being called from dev_queue_xmit()
	213	* and that skb is filled properly by that function.
	214	*/
6fef4c0c	215	static netdev_tx_t ipip_tunnel_xmit(struct sk_buff skb, struct net_device dev)
1da177e4	216	{
2941a486	217	struct ip_tunnel *tunnel = netdev_priv(dev);
b71d1d42	218	const struct iphdr *tiph = &tunnel->parms.iph;
1da177e4	219
fd58156e	220	if (unlikely(skb->protocol != htons(ETH_P_IP)))
1da177e4	221	goto tx_error;
1da177e4	222
cb32f511 ED	223	skb = iptunnel_handle_offloads(skb, false, SKB_GSO_IPIP);
	224	if (IS_ERR(skb))
	225	goto out;
8344bfc6	226
077c5a09 TH	227	skb_set_inner_ipproto(skb, IPPROTO_IPIP);
077c5a09 TH	228
bf3d6a8f	229	ip_tunnel_xmit(skb, dev, tiph, tiph->protocol);
6ed10654	230	return NETDEV_TX_OK;
1da177e4	231
1da177e4	232	tx_error:
3acfa1e7	233	kfree_skb(skb);
cb32f511 ED	234	out:
cb32f511 ED	235	dev->stats.tx_errors++;
6ed10654	236	return NETDEV_TX_OK;
1da177e4 LT	237	}
	238
	239	static int
fd58156e	240	ipip_tunnel_ioctl(struct net_device dev, struct ifreq ifr, int cmd)
1da177e4 LT	241	{
	242	int err = 0;
	243	struct ip_tunnel_parm p;
1da177e4	244
fd58156e PS	245	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
fd58156e PS	246	return -EFAULT;
1da177e4	247
3b7b514f CW	248	if (cmd == SIOCADDTUNNEL \|\| cmd == SIOCCHGTUNNEL) {
	249	if (p.iph.version != 4 \|\| p.iph.protocol != IPPROTO_IPIP \|\|
	250	p.iph.ihl != 5 \|\| (p.iph.frag_off&htons(~IP_DF)))
	251	return -EINVAL;
	252	}
	253
252a8fbe ED	254	p.i_key = p.o_key = 0;
252a8fbe ED	255	p.i_flags = p.o_flags = 0;
fd58156e PS	256	err = ip_tunnel_ioctl(dev, &p, cmd);
	257	if (err)
	258	return err;
	259
	260	if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
	261	return -EFAULT;
	262
1da177e4 LT	263	return 0;
	264	}
	265
23a12b14	266	static const struct net_device_ops ipip_netdev_ops = {
fd58156e PS	267	.ndo_init = ipip_tunnel_init,
fd58156e PS	268	.ndo_uninit = ip_tunnel_uninit,
23a12b14 SH	269	.ndo_start_xmit = ipip_tunnel_xmit,
23a12b14 SH	270	.ndo_do_ioctl = ipip_tunnel_ioctl,
fd58156e PS	271	.ndo_change_mtu = ip_tunnel_change_mtu,
fd58156e PS	272	.ndo_get_stats64 = ip_tunnel_get_stats64,
1e99584b	273	.ndo_get_iflink = ip_tunnel_get_iflink,
23a12b14 SH	274	};
23a12b14 SH	275
c3b89fbb ED	276	#define IPIP_FEATURES (NETIF_F_SG \| \
	277	NETIF_F_FRAGLIST \| \
	278	NETIF_F_HIGHDMA \| \
cb32f511	279	NETIF_F_GSO_SOFTWARE \| \
c3b89fbb ED	280	NETIF_F_HW_CSUM)
c3b89fbb ED	281
1da177e4 LT	282	static void ipip_tunnel_setup(struct net_device *dev)
1da177e4 LT	283	{
23a12b14	284	dev->netdev_ops = &ipip_netdev_ops;
1da177e4 LT	285
1da177e4 LT	286	dev->type = ARPHRD_TUNNEL;
1da177e4	287	dev->flags = IFF_NOARP;
1da177e4	288	dev->addr_len = 4;
153f0943	289	dev->features \|= NETIF_F_LLTX;
02875878	290	netif_keep_dst(dev);
c3b89fbb ED	291
	292	dev->features \|= IPIP_FEATURES;
	293	dev->hw_features \|= IPIP_FEATURES;
fd58156e	294	ip_tunnel_setup(dev, ipip_net_id);
1da177e4 LT	295	}
1da177e4 LT	296
3c97af99	297	static int ipip_tunnel_init(struct net_device *dev)
1da177e4	298	{
23a12b14	299	struct ip_tunnel *tunnel = netdev_priv(dev);
1da177e4	300
1da177e4 LT	301	memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
	302	memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
	303
473ab820 TH	304	tunnel->tun_hlen = 0;
473ab820 TH	305	tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen;
fd58156e PS	306	tunnel->parms.iph.protocol = IPPROTO_IPIP;
fd58156e PS	307	return ip_tunnel_init(dev);
1da177e4 LT	308	}
1da177e4 LT	309
be42da0e ND	310	static void ipip_netlink_parms(struct nlattr *data[],
	311	struct ip_tunnel_parm *parms)
	312	{
	313	memset(parms, 0, sizeof(*parms));
	314
	315	parms->iph.version = 4;
	316	parms->iph.protocol = IPPROTO_IPIP;
	317	parms->iph.ihl = 5;
	318
	319	if (!data)
	320	return;
	321
	322	if (data[IFLA_IPTUN_LINK])
	323	parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
	324
	325	if (data[IFLA_IPTUN_LOCAL])
67b61f6c	326	parms->iph.saddr = nla_get_in_addr(data[IFLA_IPTUN_LOCAL]);
be42da0e ND	327
be42da0e ND	328	if (data[IFLA_IPTUN_REMOTE])
67b61f6c	329	parms->iph.daddr = nla_get_in_addr(data[IFLA_IPTUN_REMOTE]);
be42da0e ND	330
	331	if (data[IFLA_IPTUN_TTL]) {
	332	parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
	333	if (parms->iph.ttl)
	334	parms->iph.frag_off = htons(IP_DF);
	335	}
	336
	337	if (data[IFLA_IPTUN_TOS])
	338	parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);
	339
	340	if (!data[IFLA_IPTUN_PMTUDISC] \|\| nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
	341	parms->iph.frag_off = htons(IP_DF);
	342	}
	343
473ab820 TH	344	/* This function returns true when ENCAP attributes are present in the nl msg */
	345	static bool ipip_netlink_encap_parms(struct nlattr *data[],
	346	struct ip_tunnel_encap *ipencap)
	347	{
	348	bool ret = false;
	349
	350	memset(ipencap, 0, sizeof(*ipencap));
	351
	352	if (!data)
	353	return ret;
	354
	355	if (data[IFLA_IPTUN_ENCAP_TYPE]) {
	356	ret = true;
	357	ipencap->type = nla_get_u16(data[IFLA_IPTUN_ENCAP_TYPE]);
	358	}
	359
	360	if (data[IFLA_IPTUN_ENCAP_FLAGS]) {
	361	ret = true;
	362	ipencap->flags = nla_get_u16(data[IFLA_IPTUN_ENCAP_FLAGS]);
	363	}
	364
	365	if (data[IFLA_IPTUN_ENCAP_SPORT]) {
	366	ret = true;
3e97fa70	367	ipencap->sport = nla_get_be16(data[IFLA_IPTUN_ENCAP_SPORT]);
473ab820 TH	368	}
	369
	370	if (data[IFLA_IPTUN_ENCAP_DPORT]) {
	371	ret = true;
3e97fa70	372	ipencap->dport = nla_get_be16(data[IFLA_IPTUN_ENCAP_DPORT]);
473ab820 TH	373	}
	374
	375	return ret;
	376	}
	377
be42da0e ND	378	static int ipip_newlink(struct net src_net, struct net_device dev,
	379	struct nlattr tb[], struct nlattr data[])
	380	{
fd58156e	381	struct ip_tunnel_parm p;
473ab820 TH	382	struct ip_tunnel_encap ipencap;
	383
	384	if (ipip_netlink_encap_parms(data, &ipencap)) {
	385	struct ip_tunnel *t = netdev_priv(dev);
	386	int err = ip_tunnel_encap_setup(t, &ipencap);
	387
	388	if (err < 0)
	389	return err;
	390	}
be42da0e	391
fd58156e PS	392	ipip_netlink_parms(data, &p);
fd58156e PS	393	return ip_tunnel_newlink(dev, tb, &p);
be42da0e ND	394	}
	395
	396	static int ipip_changelink(struct net_device dev, struct nlattr tb[],
	397	struct nlattr *data[])
	398	{
be42da0e	399	struct ip_tunnel_parm p;
473ab820 TH	400	struct ip_tunnel_encap ipencap;
	401
	402	if (ipip_netlink_encap_parms(data, &ipencap)) {
	403	struct ip_tunnel *t = netdev_priv(dev);
	404	int err = ip_tunnel_encap_setup(t, &ipencap);
	405
	406	if (err < 0)
	407	return err;
	408	}
be42da0e ND	409
	410	ipip_netlink_parms(data, &p);
	411
	412	if (((dev->flags & IFF_POINTOPOINT) && !p.iph.daddr) \|\|
	413	(!(dev->flags & IFF_POINTOPOINT) && p.iph.daddr))
	414	return -EINVAL;
	415
fd58156e	416	return ip_tunnel_changelink(dev, tb, &p);
be42da0e ND	417	}
be42da0e ND	418
0974658d ND	419	static size_t ipip_get_size(const struct net_device *dev)
	420	{
	421	return
	422	/* IFLA_IPTUN_LINK */
	423	nla_total_size(4) +
	424	/* IFLA_IPTUN_LOCAL */
	425	nla_total_size(4) +
	426	/* IFLA_IPTUN_REMOTE */
	427	nla_total_size(4) +
	428	/* IFLA_IPTUN_TTL */
	429	nla_total_size(1) +
	430	/* IFLA_IPTUN_TOS */
	431	nla_total_size(1) +
befe2aa1 ND	432	/* IFLA_IPTUN_PMTUDISC */
befe2aa1 ND	433	nla_total_size(1) +
473ab820 TH	434	/* IFLA_IPTUN_ENCAP_TYPE */
	435	nla_total_size(2) +
	436	/* IFLA_IPTUN_ENCAP_FLAGS */
	437	nla_total_size(2) +
	438	/* IFLA_IPTUN_ENCAP_SPORT */
	439	nla_total_size(2) +
	440	/* IFLA_IPTUN_ENCAP_DPORT */
	441	nla_total_size(2) +
0974658d ND	442	0;
	443	}
	444
	445	static int ipip_fill_info(struct sk_buff skb, const struct net_device dev)
	446	{
	447	struct ip_tunnel *tunnel = netdev_priv(dev);
	448	struct ip_tunnel_parm *parm = &tunnel->parms;
	449
	450	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) \|\|
930345ea JB	451	nla_put_in_addr(skb, IFLA_IPTUN_LOCAL, parm->iph.saddr) \|\|
930345ea JB	452	nla_put_in_addr(skb, IFLA_IPTUN_REMOTE, parm->iph.daddr) \|\|
0974658d	453	nla_put_u8(skb, IFLA_IPTUN_TTL, parm->iph.ttl) \|\|
befe2aa1 ND	454	nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) \|\|
	455	nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
	456	!!(parm->iph.frag_off & htons(IP_DF))))
0974658d	457	goto nla_put_failure;
473ab820 TH	458
	459	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE,
	460	tunnel->encap.type) \|\|
3e97fa70 SD	461	nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT,
	462	tunnel->encap.sport) \|\|
	463	nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT,
	464	tunnel->encap.dport) \|\|
473ab820	465	nla_put_u16(skb, IFLA_IPTUN_ENCAP_FLAGS,
e1b2cb65	466	tunnel->encap.flags))
473ab820 TH	467	goto nla_put_failure;
473ab820 TH	468
0974658d ND	469	return 0;
	470
	471	nla_put_failure:
	472	return -EMSGSIZE;
	473	}
	474
be42da0e ND	475	static const struct nla_policy ipip_policy[IFLA_IPTUN_MAX + 1] = {
	476	[IFLA_IPTUN_LINK] = { .type = NLA_U32 },
	477	[IFLA_IPTUN_LOCAL] = { .type = NLA_U32 },
	478	[IFLA_IPTUN_REMOTE] = { .type = NLA_U32 },
	479	[IFLA_IPTUN_TTL] = { .type = NLA_U8 },
	480	[IFLA_IPTUN_TOS] = { .type = NLA_U8 },
	481	[IFLA_IPTUN_PMTUDISC] = { .type = NLA_U8 },
473ab820 TH	482	[IFLA_IPTUN_ENCAP_TYPE] = { .type = NLA_U16 },
	483	[IFLA_IPTUN_ENCAP_FLAGS] = { .type = NLA_U16 },
	484	[IFLA_IPTUN_ENCAP_SPORT] = { .type = NLA_U16 },
	485	[IFLA_IPTUN_ENCAP_DPORT] = { .type = NLA_U16 },
be42da0e ND	486	};
be42da0e ND	487
0974658d ND	488	static struct rtnl_link_ops ipip_link_ops __read_mostly = {
	489	.kind = "ipip",
	490	.maxtype = IFLA_IPTUN_MAX,
be42da0e	491	.policy = ipip_policy,
0974658d	492	.priv_size = sizeof(struct ip_tunnel),
be42da0e ND	493	.setup = ipip_tunnel_setup,
	494	.newlink = ipip_newlink,
	495	.changelink = ipip_changelink,
fd58156e	496	.dellink = ip_tunnel_dellink,
0974658d ND	497	.get_size = ipip_get_size,
0974658d ND	498	.fill_info = ipip_fill_info,
1728d4fa	499	.get_link_net = ip_tunnel_get_link_net,
0974658d ND	500	};
0974658d ND	501
6dcd814b	502	static struct xfrm_tunnel ipip_handler __read_mostly = {
1da177e4 LT	503	.handler = ipip_rcv,
1da177e4 LT	504	.err_handler = ipip_err,
d2acc347	505	.priority = 1,
1da177e4 LT	506	};
1da177e4 LT	507
2c8c1e72	508	static int __net_init ipip_init_net(struct net *net)
10dc4c7b	509	{
fd58156e	510	return ip_tunnel_init_net(net, ipip_net_id, &ipip_link_ops, "tunl0");
10dc4c7b PE	511	}
10dc4c7b PE	512
2c8c1e72	513	static void __net_exit ipip_exit_net(struct net *net)
10dc4c7b	514	{
fd58156e	515	struct ip_tunnel_net *itn = net_generic(net, ipip_net_id);
6c742e71	516	ip_tunnel_delete_net(itn, &ipip_link_ops);
10dc4c7b PE	517	}
	518
	519	static struct pernet_operations ipip_net_ops = {
	520	.init = ipip_init_net,
	521	.exit = ipip_exit_net,
86de8a63	522	.id = &ipip_net_id,
fd58156e	523	.size = sizeof(struct ip_tunnel_net),
10dc4c7b PE	524	};
10dc4c7b PE	525
1da177e4 LT	526	static int __init ipip_init(void)
	527	{
	528	int err;
	529
fd58156e	530	pr_info("ipip: IPv4 over IPv4 tunneling driver\n");
1da177e4	531
d5aa407f AD	532	err = register_pernet_device(&ipip_net_ops);
	533	if (err < 0)
	534	return err;
	535	err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
	536	if (err < 0) {
058bd4d2	537	pr_info("%s: can't register tunnel\n", __func__);
0974658d	538	goto xfrm_tunnel_failed;
1da177e4	539	}
0974658d ND	540	err = rtnl_link_register(&ipip_link_ops);
	541	if (err < 0)
	542	goto rtnl_link_failed;
	543
	544	out:
1da177e4	545	return err;
0974658d ND	546
	547	rtnl_link_failed:
	548	xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
	549	xfrm_tunnel_failed:
	550	unregister_pernet_device(&ipip_net_ops);
	551	goto out;
1da177e4 LT	552	}
	553
	554	static void __exit ipip_fini(void)
	555	{
0974658d	556	rtnl_link_unregister(&ipip_link_ops);
c0d56408	557	if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
058bd4d2	558	pr_info("%s: can't deregister tunnel\n", __func__);
1da177e4	559
86de8a63	560	unregister_pernet_device(&ipip_net_ops);
1da177e4 LT	561	}
	562
	563	module_init(ipip_init);
	564	module_exit(ipip_fini);
	565	MODULE_LICENSE("GPL");
f98f89a0	566	MODULE_ALIAS_RTNL_LINK("ipip");
8909c9ad	567	MODULE_ALIAS_NETDEV("tunl0");