1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * vrf.c: device driver to encapsulate a VRF space
5 * Copyright (c) 2015 Cumulus Networks. All rights reserved.
6 * Copyright (c) 2015 Shrijeet Mukherjee <shm@cumulusnetworks.com>
7 * Copyright (c) 2015 David Ahern <dsa@cumulusnetworks.com>
9 * Based on dummy, team and ipvlan drivers
12 #include <linux/module.h>
13 #include <linux/kernel.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
17 #include <linux/init.h>
18 #include <linux/moduleparam.h>
19 #include <linux/netfilter.h>
20 #include <linux/rtnetlink.h>
21 #include <net/rtnetlink.h>
22 #include <linux/u64_stats_sync.h>
23 #include <linux/hashtable.h>
24 #include <linux/spinlock_types.h>
26 #include <linux/inetdevice.h>
29 #include <net/ip_fib.h>
30 #include <net/ip6_fib.h>
31 #include <net/ip6_route.h>
32 #include <net/route.h>
33 #include <net/addrconf.h>
34 #include <net/l3mdev.h>
35 #include <net/fib_rules.h>
36 #include <net/netns/generic.h>
38 #define DRV_NAME "vrf"
39 #define DRV_VERSION "1.1"
41 #define FIB_RULE_PREF 1000 /* default preference for FIB rules */
44 #define HASH_INITVAL ((u32)0xcafef00d)
47 DECLARE_HASHTABLE(ht
, HT_MAP_BITS
);
51 * count how many distinct tables do not comply with the strict mode
53 * shared_tables value must be 0 in order to enable the strict mode.
55 * example of the evolution of shared_tables:
57 * add vrf0 --> table 100 shared_tables = 0 | t0
58 * add vrf1 --> table 101 shared_tables = 0 | t1
59 * add vrf2 --> table 100 shared_tables = 1 | t2
60 * add vrf3 --> table 100 shared_tables = 1 | t3
61 * add vrf4 --> table 101 shared_tables = 2 v t4
63 * shared_tables is a "step function" (or "staircase function")
64 * and it is increased by one when the second vrf is associated to a
67 * at t2, vrf0 and vrf2 are bound to table 100: shared_tables = 1.
69 * at t3, another dev (vrf3) is bound to the same table 100 but the
70 * value of shared_tables is still 1.
71 * This means that no matter how many new vrfs will register on the
72 * table 100, the shared_tables will not increase (considering only
75 * at t4, vrf4 is bound to table 101, and shared_tables = 2.
77 * Looking at the value of shared_tables we can immediately know if
78 * the strict_mode can or cannot be enforced. Indeed, strict_mode
79 * can be enforced iff shared_tables = 0.
81 * Conversely, shared_tables is decreased when a vrf is de-associated
82 * from a table with exactly two associated vrfs.
90 struct hlist_node hnode
;
91 struct list_head vrf_list
; /* VRFs registered to this table */
98 static unsigned int vrf_net_id
;
100 /* per netns vrf data */
102 /* protected by rtnl lock */
106 struct ctl_table_header
*ctl_hdr
;
110 struct rtable __rcu
*rth
;
111 struct rt6_info __rcu
*rt6
;
112 #if IS_ENABLED(CONFIG_IPV6)
113 struct fib6_table
*fib6_table
;
117 struct list_head me_list
; /* entry in vrf_map_elem */
128 struct u64_stats_sync syncp
;
131 static void vrf_rx_stats(struct net_device
*dev
, int len
)
133 struct pcpu_dstats
*dstats
= this_cpu_ptr(dev
->dstats
);
135 u64_stats_update_begin(&dstats
->syncp
);
137 dstats
->rx_bytes
+= len
;
138 u64_stats_update_end(&dstats
->syncp
);
141 static void vrf_tx_error(struct net_device
*vrf_dev
, struct sk_buff
*skb
)
143 vrf_dev
->stats
.tx_errors
++;
147 static void vrf_get_stats64(struct net_device
*dev
,
148 struct rtnl_link_stats64
*stats
)
152 for_each_possible_cpu(i
) {
153 const struct pcpu_dstats
*dstats
;
154 u64 tbytes
, tpkts
, tdrops
, rbytes
, rpkts
;
157 dstats
= per_cpu_ptr(dev
->dstats
, i
);
159 start
= u64_stats_fetch_begin_irq(&dstats
->syncp
);
160 tbytes
= dstats
->tx_bytes
;
161 tpkts
= dstats
->tx_pkts
;
162 tdrops
= dstats
->tx_drps
;
163 rbytes
= dstats
->rx_bytes
;
164 rpkts
= dstats
->rx_pkts
;
165 } while (u64_stats_fetch_retry_irq(&dstats
->syncp
, start
));
166 stats
->tx_bytes
+= tbytes
;
167 stats
->tx_packets
+= tpkts
;
168 stats
->tx_dropped
+= tdrops
;
169 stats
->rx_bytes
+= rbytes
;
170 stats
->rx_packets
+= rpkts
;
174 static struct vrf_map
*netns_vrf_map(struct net
*net
)
176 struct netns_vrf
*nn_vrf
= net_generic(net
, vrf_net_id
);
178 return &nn_vrf
->vmap
;
181 static struct vrf_map
*netns_vrf_map_by_dev(struct net_device
*dev
)
183 return netns_vrf_map(dev_net(dev
));
186 static int vrf_map_elem_get_vrf_ifindex(struct vrf_map_elem
*me
)
188 struct list_head
*me_head
= &me
->vrf_list
;
191 if (list_empty(me_head
))
194 vrf
= list_first_entry(me_head
, struct net_vrf
, me_list
);
199 static struct vrf_map_elem
*vrf_map_elem_alloc(gfp_t flags
)
201 struct vrf_map_elem
*me
;
203 me
= kmalloc(sizeof(*me
), flags
);
210 static void vrf_map_elem_free(struct vrf_map_elem
*me
)
215 static void vrf_map_elem_init(struct vrf_map_elem
*me
, int table_id
,
216 int ifindex
, int users
)
218 me
->table_id
= table_id
;
219 me
->ifindex
= ifindex
;
221 INIT_LIST_HEAD(&me
->vrf_list
);
224 static struct vrf_map_elem
*vrf_map_lookup_elem(struct vrf_map
*vmap
,
227 struct vrf_map_elem
*me
;
230 key
= jhash_1word(table_id
, HASH_INITVAL
);
231 hash_for_each_possible(vmap
->ht
, me
, hnode
, key
) {
232 if (me
->table_id
== table_id
)
239 static void vrf_map_add_elem(struct vrf_map
*vmap
, struct vrf_map_elem
*me
)
241 u32 table_id
= me
->table_id
;
244 key
= jhash_1word(table_id
, HASH_INITVAL
);
245 hash_add(vmap
->ht
, &me
->hnode
, key
);
248 static void vrf_map_del_elem(struct vrf_map_elem
*me
)
250 hash_del(&me
->hnode
);
253 static void vrf_map_lock(struct vrf_map
*vmap
) __acquires(&vmap
->vmap_lock
)
255 spin_lock(&vmap
->vmap_lock
);
258 static void vrf_map_unlock(struct vrf_map
*vmap
) __releases(&vmap
->vmap_lock
)
260 spin_unlock(&vmap
->vmap_lock
);
263 static bool vrf_strict_mode(struct vrf_map
*vmap
)
268 strict_mode
= vmap
->strict_mode
;
269 vrf_map_unlock(vmap
);
274 static int vrf_strict_mode_change(struct vrf_map
*vmap
, bool new_mode
)
281 cur_mode
= &vmap
->strict_mode
;
282 if (*cur_mode
== new_mode
)
286 /* disable strict mode */
289 if (vmap
->shared_tables
) {
290 /* we cannot allow strict_mode because there are some
291 * vrfs that share one or more tables.
297 /* no tables are shared among vrfs, so we can go back
298 * to 1:1 association between a vrf with its table.
304 vrf_map_unlock(vmap
);
309 /* called with rtnl lock held */
311 vrf_map_register_dev(struct net_device
*dev
, struct netlink_ext_ack
*extack
)
313 struct vrf_map
*vmap
= netns_vrf_map_by_dev(dev
);
314 struct net_vrf
*vrf
= netdev_priv(dev
);
315 struct vrf_map_elem
*new_me
, *me
;
316 u32 table_id
= vrf
->tb_id
;
317 bool free_new_me
= false;
321 /* we pre-allocate elements used in the spin-locked section (so that we
322 * keep the spinlock as short as possibile).
324 new_me
= vrf_map_elem_alloc(GFP_KERNEL
);
328 vrf_map_elem_init(new_me
, table_id
, dev
->ifindex
, 0);
332 me
= vrf_map_lookup_elem(vmap
, table_id
);
335 vrf_map_add_elem(vmap
, me
);
339 /* we already have an entry in the vrf_map, so it means there is (at
340 * least) a vrf registered on the specific table.
343 if (vmap
->strict_mode
) {
344 /* vrfs cannot share the same table */
345 NL_SET_ERR_MSG(extack
, "Table is used by another VRF");
353 ++vmap
->shared_tables
;
355 list_add(&vrf
->me_list
, &me
->vrf_list
);
360 vrf_map_unlock(vmap
);
362 /* clean-up, if needed */
364 vrf_map_elem_free(new_me
);
369 /* called with rtnl lock held */
370 static void vrf_map_unregister_dev(struct net_device
*dev
)
372 struct vrf_map
*vmap
= netns_vrf_map_by_dev(dev
);
373 struct net_vrf
*vrf
= netdev_priv(dev
);
374 u32 table_id
= vrf
->tb_id
;
375 struct vrf_map_elem
*me
;
380 me
= vrf_map_lookup_elem(vmap
, table_id
);
384 list_del(&vrf
->me_list
);
388 --vmap
->shared_tables
;
389 } else if (users
== 0) {
390 vrf_map_del_elem(me
);
392 /* no one will refer to this element anymore */
393 vrf_map_elem_free(me
);
397 vrf_map_unlock(vmap
);
400 /* return the vrf device index associated with the table_id */
401 static int vrf_ifindex_lookup_by_table_id(struct net
*net
, u32 table_id
)
403 struct vrf_map
*vmap
= netns_vrf_map(net
);
404 struct vrf_map_elem
*me
;
409 if (!vmap
->strict_mode
) {
414 me
= vrf_map_lookup_elem(vmap
, table_id
);
420 ifindex
= vrf_map_elem_get_vrf_ifindex(me
);
423 vrf_map_unlock(vmap
);
428 /* by default VRF devices do not have a qdisc and are expected
429 * to be created with only a single queue.
431 static bool qdisc_tx_is_default(const struct net_device
*dev
)
433 struct netdev_queue
*txq
;
436 if (dev
->num_tx_queues
> 1)
439 txq
= netdev_get_tx_queue(dev
, 0);
440 qdisc
= rcu_access_pointer(txq
->qdisc
);
442 return !qdisc
->enqueue
;
445 /* Local traffic destined to local address. Reinsert the packet to rx
446 * path, similar to loopback handling.
448 static int vrf_local_xmit(struct sk_buff
*skb
, struct net_device
*dev
,
449 struct dst_entry
*dst
)
455 skb_dst_set(skb
, dst
);
457 /* set pkt_type to avoid skb hitting packet taps twice -
458 * once on Tx and again in Rx processing
460 skb
->pkt_type
= PACKET_LOOPBACK
;
462 skb
->protocol
= eth_type_trans(skb
, dev
);
464 if (likely(netif_rx(skb
) == NET_RX_SUCCESS
))
465 vrf_rx_stats(dev
, len
);
467 this_cpu_inc(dev
->dstats
->rx_drps
);
472 #if IS_ENABLED(CONFIG_IPV6)
473 static int vrf_ip6_local_out(struct net
*net
, struct sock
*sk
,
478 err
= nf_hook(NFPROTO_IPV6
, NF_INET_LOCAL_OUT
, net
,
479 sk
, skb
, NULL
, skb_dst(skb
)->dev
, dst_output
);
481 if (likely(err
== 1))
482 err
= dst_output(net
, sk
, skb
);
487 static netdev_tx_t
vrf_process_v6_outbound(struct sk_buff
*skb
,
488 struct net_device
*dev
)
490 const struct ipv6hdr
*iph
;
491 struct net
*net
= dev_net(skb
->dev
);
493 int ret
= NET_XMIT_DROP
;
494 struct dst_entry
*dst
;
495 struct dst_entry
*dst_null
= &net
->ipv6
.ip6_null_entry
->dst
;
497 if (!pskb_may_pull(skb
, ETH_HLEN
+ sizeof(struct ipv6hdr
)))
502 memset(&fl6
, 0, sizeof(fl6
));
503 /* needed to match OIF rule */
504 fl6
.flowi6_oif
= dev
->ifindex
;
505 fl6
.flowi6_iif
= LOOPBACK_IFINDEX
;
506 fl6
.daddr
= iph
->daddr
;
507 fl6
.saddr
= iph
->saddr
;
508 fl6
.flowlabel
= ip6_flowinfo(iph
);
509 fl6
.flowi6_mark
= skb
->mark
;
510 fl6
.flowi6_proto
= iph
->nexthdr
;
511 fl6
.flowi6_flags
= FLOWI_FLAG_SKIP_NH_OIF
;
513 dst
= ip6_dst_lookup_flow(net
, NULL
, &fl6
, NULL
);
514 if (IS_ERR(dst
) || dst
== dst_null
)
519 /* if dst.dev is loopback or the VRF device again this is locally
520 * originated traffic destined to a local address. Short circuit
524 return vrf_local_xmit(skb
, dev
, dst
);
526 skb_dst_set(skb
, dst
);
528 /* strip the ethernet header added for pass through VRF device */
529 __skb_pull(skb
, skb_network_offset(skb
));
531 ret
= vrf_ip6_local_out(net
, skb
->sk
, skb
);
532 if (unlikely(net_xmit_eval(ret
)))
533 dev
->stats
.tx_errors
++;
535 ret
= NET_XMIT_SUCCESS
;
539 vrf_tx_error(dev
, skb
);
540 return NET_XMIT_DROP
;
543 static netdev_tx_t
vrf_process_v6_outbound(struct sk_buff
*skb
,
544 struct net_device
*dev
)
546 vrf_tx_error(dev
, skb
);
547 return NET_XMIT_DROP
;
551 /* based on ip_local_out; can't use it b/c the dst is switched pointing to us */
552 static int vrf_ip_local_out(struct net
*net
, struct sock
*sk
,
557 err
= nf_hook(NFPROTO_IPV4
, NF_INET_LOCAL_OUT
, net
, sk
,
558 skb
, NULL
, skb_dst(skb
)->dev
, dst_output
);
559 if (likely(err
== 1))
560 err
= dst_output(net
, sk
, skb
);
565 static netdev_tx_t
vrf_process_v4_outbound(struct sk_buff
*skb
,
566 struct net_device
*vrf_dev
)
569 int ret
= NET_XMIT_DROP
;
571 struct net
*net
= dev_net(vrf_dev
);
574 if (!pskb_may_pull(skb
, ETH_HLEN
+ sizeof(struct iphdr
)))
579 memset(&fl4
, 0, sizeof(fl4
));
580 /* needed to match OIF rule */
581 fl4
.flowi4_oif
= vrf_dev
->ifindex
;
582 fl4
.flowi4_iif
= LOOPBACK_IFINDEX
;
583 fl4
.flowi4_tos
= RT_TOS(ip4h
->tos
);
584 fl4
.flowi4_flags
= FLOWI_FLAG_ANYSRC
| FLOWI_FLAG_SKIP_NH_OIF
;
585 fl4
.flowi4_proto
= ip4h
->protocol
;
586 fl4
.daddr
= ip4h
->daddr
;
587 fl4
.saddr
= ip4h
->saddr
;
589 rt
= ip_route_output_flow(net
, &fl4
, NULL
);
595 /* if dst.dev is loopback or the VRF device again this is locally
596 * originated traffic destined to a local address. Short circuit
599 if (rt
->dst
.dev
== vrf_dev
)
600 return vrf_local_xmit(skb
, vrf_dev
, &rt
->dst
);
602 skb_dst_set(skb
, &rt
->dst
);
604 /* strip the ethernet header added for pass through VRF device */
605 __skb_pull(skb
, skb_network_offset(skb
));
608 ip4h
->saddr
= inet_select_addr(skb_dst(skb
)->dev
, 0,
612 ret
= vrf_ip_local_out(dev_net(skb_dst(skb
)->dev
), skb
->sk
, skb
);
613 if (unlikely(net_xmit_eval(ret
)))
614 vrf_dev
->stats
.tx_errors
++;
616 ret
= NET_XMIT_SUCCESS
;
621 vrf_tx_error(vrf_dev
, skb
);
625 static netdev_tx_t
is_ip_tx_frame(struct sk_buff
*skb
, struct net_device
*dev
)
627 switch (skb
->protocol
) {
628 case htons(ETH_P_IP
):
629 return vrf_process_v4_outbound(skb
, dev
);
630 case htons(ETH_P_IPV6
):
631 return vrf_process_v6_outbound(skb
, dev
);
633 vrf_tx_error(dev
, skb
);
634 return NET_XMIT_DROP
;
638 static netdev_tx_t
vrf_xmit(struct sk_buff
*skb
, struct net_device
*dev
)
641 netdev_tx_t ret
= is_ip_tx_frame(skb
, dev
);
643 if (likely(ret
== NET_XMIT_SUCCESS
|| ret
== NET_XMIT_CN
)) {
644 struct pcpu_dstats
*dstats
= this_cpu_ptr(dev
->dstats
);
646 u64_stats_update_begin(&dstats
->syncp
);
648 dstats
->tx_bytes
+= len
;
649 u64_stats_update_end(&dstats
->syncp
);
651 this_cpu_inc(dev
->dstats
->tx_drps
);
657 static int vrf_finish_direct(struct net
*net
, struct sock
*sk
,
660 struct net_device
*vrf_dev
= skb
->dev
;
662 if (!list_empty(&vrf_dev
->ptype_all
) &&
663 likely(skb_headroom(skb
) >= ETH_HLEN
)) {
664 struct ethhdr
*eth
= skb_push(skb
, ETH_HLEN
);
666 ether_addr_copy(eth
->h_source
, vrf_dev
->dev_addr
);
667 eth_zero_addr(eth
->h_dest
);
668 eth
->h_proto
= skb
->protocol
;
671 dev_queue_xmit_nit(skb
, vrf_dev
);
672 rcu_read_unlock_bh();
674 skb_pull(skb
, ETH_HLEN
);
680 #if IS_ENABLED(CONFIG_IPV6)
681 /* modelled after ip6_finish_output2 */
682 static int vrf_finish_output6(struct net
*net
, struct sock
*sk
,
685 struct dst_entry
*dst
= skb_dst(skb
);
686 struct net_device
*dev
= dst
->dev
;
687 const struct in6_addr
*nexthop
;
688 struct neighbour
*neigh
;
693 skb
->protocol
= htons(ETH_P_IPV6
);
697 nexthop
= rt6_nexthop((struct rt6_info
*)dst
, &ipv6_hdr(skb
)->daddr
);
698 neigh
= __ipv6_neigh_lookup_noref(dst
->dev
, nexthop
);
699 if (unlikely(!neigh
))
700 neigh
= __neigh_create(&nd_tbl
, nexthop
, dst
->dev
, false);
701 if (!IS_ERR(neigh
)) {
702 sock_confirm_neigh(skb
, neigh
);
703 ret
= neigh_output(neigh
, skb
, false);
704 rcu_read_unlock_bh();
707 rcu_read_unlock_bh();
709 IP6_INC_STATS(dev_net(dst
->dev
),
710 ip6_dst_idev(dst
), IPSTATS_MIB_OUTNOROUTES
);
715 /* modelled after ip6_output */
716 static int vrf_output6(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
718 return NF_HOOK_COND(NFPROTO_IPV6
, NF_INET_POST_ROUTING
,
719 net
, sk
, skb
, NULL
, skb_dst(skb
)->dev
,
721 !(IP6CB(skb
)->flags
& IP6SKB_REROUTED
));
724 /* set dst on skb to send packet to us via dev_xmit path. Allows
725 * packet to go through device based features such as qdisc, netfilter
726 * hooks and packet sockets with skb->dev set to vrf device.
728 static struct sk_buff
*vrf_ip6_out_redirect(struct net_device
*vrf_dev
,
731 struct net_vrf
*vrf
= netdev_priv(vrf_dev
);
732 struct dst_entry
*dst
= NULL
;
733 struct rt6_info
*rt6
;
737 rt6
= rcu_dereference(vrf
->rt6
);
745 if (unlikely(!dst
)) {
746 vrf_tx_error(vrf_dev
, skb
);
751 skb_dst_set(skb
, dst
);
756 static int vrf_output6_direct(struct net
*net
, struct sock
*sk
,
759 skb
->protocol
= htons(ETH_P_IPV6
);
761 return NF_HOOK_COND(NFPROTO_IPV6
, NF_INET_POST_ROUTING
,
762 net
, sk
, skb
, NULL
, skb
->dev
,
764 !(IPCB(skb
)->flags
& IPSKB_REROUTED
));
767 static struct sk_buff
*vrf_ip6_out_direct(struct net_device
*vrf_dev
,
771 struct net
*net
= dev_net(vrf_dev
);
776 err
= nf_hook(NFPROTO_IPV6
, NF_INET_LOCAL_OUT
, net
, sk
,
777 skb
, NULL
, vrf_dev
, vrf_output6_direct
);
779 if (likely(err
== 1))
780 err
= vrf_output6_direct(net
, sk
, skb
);
782 /* reset skb device */
783 if (likely(err
== 1))
791 static struct sk_buff
*vrf_ip6_out(struct net_device
*vrf_dev
,
795 /* don't divert link scope packets */
796 if (rt6_need_strict(&ipv6_hdr(skb
)->daddr
))
799 if (qdisc_tx_is_default(vrf_dev
) ||
800 IP6CB(skb
)->flags
& IP6SKB_XFRM_TRANSFORMED
)
801 return vrf_ip6_out_direct(vrf_dev
, sk
, skb
);
803 return vrf_ip6_out_redirect(vrf_dev
, skb
);
807 static void vrf_rt6_release(struct net_device
*dev
, struct net_vrf
*vrf
)
809 struct rt6_info
*rt6
= rtnl_dereference(vrf
->rt6
);
810 struct net
*net
= dev_net(dev
);
811 struct dst_entry
*dst
;
813 RCU_INIT_POINTER(vrf
->rt6
, NULL
);
816 /* move dev in dst's to loopback so this VRF device can be deleted
817 * - based on dst_ifdown
822 dst
->dev
= net
->loopback_dev
;
828 static int vrf_rt6_create(struct net_device
*dev
)
830 int flags
= DST_NOPOLICY
| DST_NOXFRM
;
831 struct net_vrf
*vrf
= netdev_priv(dev
);
832 struct net
*net
= dev_net(dev
);
833 struct rt6_info
*rt6
;
836 /* IPv6 can be CONFIG enabled and then disabled runtime */
837 if (!ipv6_mod_enabled())
840 vrf
->fib6_table
= fib6_new_table(net
, vrf
->tb_id
);
841 if (!vrf
->fib6_table
)
844 /* create a dst for routing packets out a VRF device */
845 rt6
= ip6_dst_alloc(net
, dev
, flags
);
849 rt6
->dst
.output
= vrf_output6
;
851 rcu_assign_pointer(vrf
->rt6
, rt6
);
858 static struct sk_buff
*vrf_ip6_out(struct net_device
*vrf_dev
,
865 static void vrf_rt6_release(struct net_device
*dev
, struct net_vrf
*vrf
)
869 static int vrf_rt6_create(struct net_device
*dev
)
875 /* modelled after ip_finish_output2 */
876 static int vrf_finish_output(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
878 struct dst_entry
*dst
= skb_dst(skb
);
879 struct rtable
*rt
= (struct rtable
*)dst
;
880 struct net_device
*dev
= dst
->dev
;
881 unsigned int hh_len
= LL_RESERVED_SPACE(dev
);
882 struct neighbour
*neigh
;
883 bool is_v6gw
= false;
888 /* Be paranoid, rather than too clever. */
889 if (unlikely(skb_headroom(skb
) < hh_len
&& dev
->header_ops
)) {
890 struct sk_buff
*skb2
;
892 skb2
= skb_realloc_headroom(skb
, LL_RESERVED_SPACE(dev
));
898 skb_set_owner_w(skb2
, skb
->sk
);
906 neigh
= ip_neigh_for_gw(rt
, skb
, &is_v6gw
);
907 if (!IS_ERR(neigh
)) {
908 sock_confirm_neigh(skb
, neigh
);
909 /* if crossing protocols, can not use the cached header */
910 ret
= neigh_output(neigh
, skb
, is_v6gw
);
911 rcu_read_unlock_bh();
915 rcu_read_unlock_bh();
917 vrf_tx_error(skb
->dev
, skb
);
921 static int vrf_output(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
923 struct net_device
*dev
= skb_dst(skb
)->dev
;
925 IP_UPD_PO_STATS(net
, IPSTATS_MIB_OUT
, skb
->len
);
928 skb
->protocol
= htons(ETH_P_IP
);
930 return NF_HOOK_COND(NFPROTO_IPV4
, NF_INET_POST_ROUTING
,
931 net
, sk
, skb
, NULL
, dev
,
933 !(IPCB(skb
)->flags
& IPSKB_REROUTED
));
936 /* set dst on skb to send packet to us via dev_xmit path. Allows
937 * packet to go through device based features such as qdisc, netfilter
938 * hooks and packet sockets with skb->dev set to vrf device.
940 static struct sk_buff
*vrf_ip_out_redirect(struct net_device
*vrf_dev
,
943 struct net_vrf
*vrf
= netdev_priv(vrf_dev
);
944 struct dst_entry
*dst
= NULL
;
949 rth
= rcu_dereference(vrf
->rth
);
957 if (unlikely(!dst
)) {
958 vrf_tx_error(vrf_dev
, skb
);
963 skb_dst_set(skb
, dst
);
968 static int vrf_output_direct(struct net
*net
, struct sock
*sk
,
971 skb
->protocol
= htons(ETH_P_IP
);
973 return NF_HOOK_COND(NFPROTO_IPV4
, NF_INET_POST_ROUTING
,
974 net
, sk
, skb
, NULL
, skb
->dev
,
976 !(IPCB(skb
)->flags
& IPSKB_REROUTED
));
979 static struct sk_buff
*vrf_ip_out_direct(struct net_device
*vrf_dev
,
983 struct net
*net
= dev_net(vrf_dev
);
988 err
= nf_hook(NFPROTO_IPV4
, NF_INET_LOCAL_OUT
, net
, sk
,
989 skb
, NULL
, vrf_dev
, vrf_output_direct
);
991 if (likely(err
== 1))
992 err
= vrf_output_direct(net
, sk
, skb
);
994 /* reset skb device */
995 if (likely(err
== 1))
1003 static struct sk_buff
*vrf_ip_out(struct net_device
*vrf_dev
,
1005 struct sk_buff
*skb
)
1007 /* don't divert multicast or local broadcast */
1008 if (ipv4_is_multicast(ip_hdr(skb
)->daddr
) ||
1009 ipv4_is_lbcast(ip_hdr(skb
)->daddr
))
1012 if (qdisc_tx_is_default(vrf_dev
) ||
1013 IPCB(skb
)->flags
& IPSKB_XFRM_TRANSFORMED
)
1014 return vrf_ip_out_direct(vrf_dev
, sk
, skb
);
1016 return vrf_ip_out_redirect(vrf_dev
, skb
);
1019 /* called with rcu lock held */
1020 static struct sk_buff
*vrf_l3_out(struct net_device
*vrf_dev
,
1022 struct sk_buff
*skb
,
1027 return vrf_ip_out(vrf_dev
, sk
, skb
);
1029 return vrf_ip6_out(vrf_dev
, sk
, skb
);
1036 static void vrf_rtable_release(struct net_device
*dev
, struct net_vrf
*vrf
)
1038 struct rtable
*rth
= rtnl_dereference(vrf
->rth
);
1039 struct net
*net
= dev_net(dev
);
1040 struct dst_entry
*dst
;
1042 RCU_INIT_POINTER(vrf
->rth
, NULL
);
1045 /* move dev in dst's to loopback so this VRF device can be deleted
1046 * - based on dst_ifdown
1051 dst
->dev
= net
->loopback_dev
;
1057 static int vrf_rtable_create(struct net_device
*dev
)
1059 struct net_vrf
*vrf
= netdev_priv(dev
);
1062 if (!fib_new_table(dev_net(dev
), vrf
->tb_id
))
1065 /* create a dst for routing packets out through a VRF device */
1066 rth
= rt_dst_alloc(dev
, 0, RTN_UNICAST
, 1, 1);
1070 rth
->dst
.output
= vrf_output
;
1072 rcu_assign_pointer(vrf
->rth
, rth
);
1077 /**************************** device handling ********************/
1079 /* cycle interface to flush neighbor cache and move routes across tables */
1080 static void cycle_netdev(struct net_device
*dev
,
1081 struct netlink_ext_ack
*extack
)
1083 unsigned int flags
= dev
->flags
;
1086 if (!netif_running(dev
))
1089 ret
= dev_change_flags(dev
, flags
& ~IFF_UP
, extack
);
1091 ret
= dev_change_flags(dev
, flags
, extack
);
1095 "Failed to cycle device %s; route tables might be wrong!\n",
1100 static int do_vrf_add_slave(struct net_device
*dev
, struct net_device
*port_dev
,
1101 struct netlink_ext_ack
*extack
)
1105 /* do not allow loopback device to be enslaved to a VRF.
1106 * The vrf device acts as the loopback for the vrf.
1108 if (port_dev
== dev_net(dev
)->loopback_dev
) {
1109 NL_SET_ERR_MSG(extack
,
1110 "Can not enslave loopback device to a VRF");
1114 port_dev
->priv_flags
|= IFF_L3MDEV_SLAVE
;
1115 ret
= netdev_master_upper_dev_link(port_dev
, dev
, NULL
, NULL
, extack
);
1119 cycle_netdev(port_dev
, extack
);
1124 port_dev
->priv_flags
&= ~IFF_L3MDEV_SLAVE
;
1128 static int vrf_add_slave(struct net_device
*dev
, struct net_device
*port_dev
,
1129 struct netlink_ext_ack
*extack
)
1131 if (netif_is_l3_master(port_dev
)) {
1132 NL_SET_ERR_MSG(extack
,
1133 "Can not enslave an L3 master device to a VRF");
1137 if (netif_is_l3_slave(port_dev
))
1140 return do_vrf_add_slave(dev
, port_dev
, extack
);
1143 /* inverse of do_vrf_add_slave */
1144 static int do_vrf_del_slave(struct net_device
*dev
, struct net_device
*port_dev
)
1146 netdev_upper_dev_unlink(port_dev
, dev
);
1147 port_dev
->priv_flags
&= ~IFF_L3MDEV_SLAVE
;
1149 cycle_netdev(port_dev
, NULL
);
1154 static int vrf_del_slave(struct net_device
*dev
, struct net_device
*port_dev
)
1156 return do_vrf_del_slave(dev
, port_dev
);
1159 static void vrf_dev_uninit(struct net_device
*dev
)
1161 struct net_vrf
*vrf
= netdev_priv(dev
);
1163 vrf_rtable_release(dev
, vrf
);
1164 vrf_rt6_release(dev
, vrf
);
1166 free_percpu(dev
->dstats
);
1170 static int vrf_dev_init(struct net_device
*dev
)
1172 struct net_vrf
*vrf
= netdev_priv(dev
);
1174 dev
->dstats
= netdev_alloc_pcpu_stats(struct pcpu_dstats
);
1178 /* create the default dst which points back to us */
1179 if (vrf_rtable_create(dev
) != 0)
1182 if (vrf_rt6_create(dev
) != 0)
1185 dev
->flags
= IFF_MASTER
| IFF_NOARP
;
1187 /* MTU is irrelevant for VRF device; set to 64k similar to lo */
1188 dev
->mtu
= 64 * 1024;
1190 /* similarly, oper state is irrelevant; set to up to avoid confusion */
1191 dev
->operstate
= IF_OPER_UP
;
1192 netdev_lockdep_set_classes(dev
);
1196 vrf_rtable_release(dev
, vrf
);
1198 free_percpu(dev
->dstats
);
1204 static const struct net_device_ops vrf_netdev_ops
= {
1205 .ndo_init
= vrf_dev_init
,
1206 .ndo_uninit
= vrf_dev_uninit
,
1207 .ndo_start_xmit
= vrf_xmit
,
1208 .ndo_set_mac_address
= eth_mac_addr
,
1209 .ndo_get_stats64
= vrf_get_stats64
,
1210 .ndo_add_slave
= vrf_add_slave
,
1211 .ndo_del_slave
= vrf_del_slave
,
1214 static u32
vrf_fib_table(const struct net_device
*dev
)
1216 struct net_vrf
*vrf
= netdev_priv(dev
);
1221 static int vrf_rcv_finish(struct net
*net
, struct sock
*sk
, struct sk_buff
*skb
)
1227 static struct sk_buff
*vrf_rcv_nfhook(u8 pf
, unsigned int hook
,
1228 struct sk_buff
*skb
,
1229 struct net_device
*dev
)
1231 struct net
*net
= dev_net(dev
);
1233 if (nf_hook(pf
, hook
, net
, NULL
, skb
, dev
, NULL
, vrf_rcv_finish
) != 1)
1234 skb
= NULL
; /* kfree_skb(skb) handled by nf code */
1239 #if IS_ENABLED(CONFIG_IPV6)
1240 /* neighbor handling is done with actual device; do not want
1241 * to flip skb->dev for those ndisc packets. This really fails
1242 * for multiple next protocols (e.g., NEXTHDR_HOP). But it is
1245 static bool ipv6_ndisc_frame(const struct sk_buff
*skb
)
1247 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
1250 if (iph
->nexthdr
== NEXTHDR_ICMP
) {
1251 const struct icmp6hdr
*icmph
;
1252 struct icmp6hdr _icmph
;
1254 icmph
= skb_header_pointer(skb
, sizeof(*iph
),
1255 sizeof(_icmph
), &_icmph
);
1259 switch (icmph
->icmp6_type
) {
1260 case NDISC_ROUTER_SOLICITATION
:
1261 case NDISC_ROUTER_ADVERTISEMENT
:
1262 case NDISC_NEIGHBOUR_SOLICITATION
:
1263 case NDISC_NEIGHBOUR_ADVERTISEMENT
:
1264 case NDISC_REDIRECT
:
1274 static struct rt6_info
*vrf_ip6_route_lookup(struct net
*net
,
1275 const struct net_device
*dev
,
1278 const struct sk_buff
*skb
,
1281 struct net_vrf
*vrf
= netdev_priv(dev
);
1283 return ip6_pol_route(net
, vrf
->fib6_table
, ifindex
, fl6
, skb
, flags
);
1286 static void vrf_ip6_input_dst(struct sk_buff
*skb
, struct net_device
*vrf_dev
,
1289 const struct ipv6hdr
*iph
= ipv6_hdr(skb
);
1290 struct flowi6 fl6
= {
1291 .flowi6_iif
= ifindex
,
1292 .flowi6_mark
= skb
->mark
,
1293 .flowi6_proto
= iph
->nexthdr
,
1294 .daddr
= iph
->daddr
,
1295 .saddr
= iph
->saddr
,
1296 .flowlabel
= ip6_flowinfo(iph
),
1298 struct net
*net
= dev_net(vrf_dev
);
1299 struct rt6_info
*rt6
;
1301 rt6
= vrf_ip6_route_lookup(net
, vrf_dev
, &fl6
, ifindex
, skb
,
1302 RT6_LOOKUP_F_HAS_SADDR
| RT6_LOOKUP_F_IFACE
);
1306 if (unlikely(&rt6
->dst
== &net
->ipv6
.ip6_null_entry
->dst
))
1309 skb_dst_set(skb
, &rt6
->dst
);
1312 static struct sk_buff
*vrf_ip6_rcv(struct net_device
*vrf_dev
,
1313 struct sk_buff
*skb
)
1315 int orig_iif
= skb
->skb_iif
;
1316 bool need_strict
= rt6_need_strict(&ipv6_hdr(skb
)->daddr
);
1317 bool is_ndisc
= ipv6_ndisc_frame(skb
);
1319 /* loopback, multicast & non-ND link-local traffic; do not push through
1320 * packet taps again. Reset pkt_type for upper layers to process skb
1322 if (skb
->pkt_type
== PACKET_LOOPBACK
|| (need_strict
&& !is_ndisc
)) {
1324 skb
->skb_iif
= vrf_dev
->ifindex
;
1325 IP6CB(skb
)->flags
|= IP6SKB_L3SLAVE
;
1326 if (skb
->pkt_type
== PACKET_LOOPBACK
)
1327 skb
->pkt_type
= PACKET_HOST
;
1331 /* if packet is NDISC then keep the ingress interface */
1333 vrf_rx_stats(vrf_dev
, skb
->len
);
1335 skb
->skb_iif
= vrf_dev
->ifindex
;
1337 if (!list_empty(&vrf_dev
->ptype_all
)) {
1338 skb_push(skb
, skb
->mac_len
);
1339 dev_queue_xmit_nit(skb
, vrf_dev
);
1340 skb_pull(skb
, skb
->mac_len
);
1343 IP6CB(skb
)->flags
|= IP6SKB_L3SLAVE
;
1347 vrf_ip6_input_dst(skb
, vrf_dev
, orig_iif
);
1349 skb
= vrf_rcv_nfhook(NFPROTO_IPV6
, NF_INET_PRE_ROUTING
, skb
, vrf_dev
);
1355 static struct sk_buff
*vrf_ip6_rcv(struct net_device
*vrf_dev
,
1356 struct sk_buff
*skb
)
1362 static struct sk_buff
*vrf_ip_rcv(struct net_device
*vrf_dev
,
1363 struct sk_buff
*skb
)
1366 skb
->skb_iif
= vrf_dev
->ifindex
;
1367 IPCB(skb
)->flags
|= IPSKB_L3SLAVE
;
1369 if (ipv4_is_multicast(ip_hdr(skb
)->daddr
))
1372 /* loopback traffic; do not push through packet taps again.
1373 * Reset pkt_type for upper layers to process skb
1375 if (skb
->pkt_type
== PACKET_LOOPBACK
) {
1376 skb
->pkt_type
= PACKET_HOST
;
1380 vrf_rx_stats(vrf_dev
, skb
->len
);
1382 if (!list_empty(&vrf_dev
->ptype_all
)) {
1383 skb_push(skb
, skb
->mac_len
);
1384 dev_queue_xmit_nit(skb
, vrf_dev
);
1385 skb_pull(skb
, skb
->mac_len
);
1388 skb
= vrf_rcv_nfhook(NFPROTO_IPV4
, NF_INET_PRE_ROUTING
, skb
, vrf_dev
);
1393 /* called with rcu lock held */
1394 static struct sk_buff
*vrf_l3_rcv(struct net_device
*vrf_dev
,
1395 struct sk_buff
*skb
,
1400 return vrf_ip_rcv(vrf_dev
, skb
);
1402 return vrf_ip6_rcv(vrf_dev
, skb
);
1408 #if IS_ENABLED(CONFIG_IPV6)
1409 /* send to link-local or multicast address via interface enslaved to
1410 * VRF device. Force lookup to VRF table without changing flow struct
1411 * Note: Caller to this function must hold rcu_read_lock() and no refcnt
1412 * is taken on the dst by this function.
1414 static struct dst_entry
*vrf_link_scope_lookup(const struct net_device
*dev
,
1417 struct net
*net
= dev_net(dev
);
1418 int flags
= RT6_LOOKUP_F_IFACE
| RT6_LOOKUP_F_DST_NOREF
;
1419 struct dst_entry
*dst
= NULL
;
1420 struct rt6_info
*rt
;
1422 /* VRF device does not have a link-local address and
1423 * sending packets to link-local or mcast addresses over
1424 * a VRF device does not make sense
1426 if (fl6
->flowi6_oif
== dev
->ifindex
) {
1427 dst
= &net
->ipv6
.ip6_null_entry
->dst
;
1431 if (!ipv6_addr_any(&fl6
->saddr
))
1432 flags
|= RT6_LOOKUP_F_HAS_SADDR
;
1434 rt
= vrf_ip6_route_lookup(net
, dev
, fl6
, fl6
->flowi6_oif
, NULL
, flags
);
1442 static const struct l3mdev_ops vrf_l3mdev_ops
= {
1443 .l3mdev_fib_table
= vrf_fib_table
,
1444 .l3mdev_l3_rcv
= vrf_l3_rcv
,
1445 .l3mdev_l3_out
= vrf_l3_out
,
1446 #if IS_ENABLED(CONFIG_IPV6)
1447 .l3mdev_link_scope_lookup
= vrf_link_scope_lookup
,
1451 static void vrf_get_drvinfo(struct net_device
*dev
,
1452 struct ethtool_drvinfo
*info
)
1454 strlcpy(info
->driver
, DRV_NAME
, sizeof(info
->driver
));
1455 strlcpy(info
->version
, DRV_VERSION
, sizeof(info
->version
));
1458 static const struct ethtool_ops vrf_ethtool_ops
= {
1459 .get_drvinfo
= vrf_get_drvinfo
,
1462 static inline size_t vrf_fib_rule_nl_size(void)
1466 sz
= NLMSG_ALIGN(sizeof(struct fib_rule_hdr
));
1467 sz
+= nla_total_size(sizeof(u8
)); /* FRA_L3MDEV */
1468 sz
+= nla_total_size(sizeof(u32
)); /* FRA_PRIORITY */
1469 sz
+= nla_total_size(sizeof(u8
)); /* FRA_PROTOCOL */
1474 static int vrf_fib_rule(const struct net_device
*dev
, __u8 family
, bool add_it
)
1476 struct fib_rule_hdr
*frh
;
1477 struct nlmsghdr
*nlh
;
1478 struct sk_buff
*skb
;
1481 if ((family
== AF_INET6
|| family
== RTNL_FAMILY_IP6MR
) &&
1482 !ipv6_mod_enabled())
1485 skb
= nlmsg_new(vrf_fib_rule_nl_size(), GFP_KERNEL
);
1489 nlh
= nlmsg_put(skb
, 0, 0, 0, sizeof(*frh
), 0);
1491 goto nla_put_failure
;
1493 /* rule only needs to appear once */
1494 nlh
->nlmsg_flags
|= NLM_F_EXCL
;
1496 frh
= nlmsg_data(nlh
);
1497 memset(frh
, 0, sizeof(*frh
));
1498 frh
->family
= family
;
1499 frh
->action
= FR_ACT_TO_TBL
;
1501 if (nla_put_u8(skb
, FRA_PROTOCOL
, RTPROT_KERNEL
))
1502 goto nla_put_failure
;
1504 if (nla_put_u8(skb
, FRA_L3MDEV
, 1))
1505 goto nla_put_failure
;
1507 if (nla_put_u32(skb
, FRA_PRIORITY
, FIB_RULE_PREF
))
1508 goto nla_put_failure
;
1510 nlmsg_end(skb
, nlh
);
1512 /* fib_nl_{new,del}rule handling looks for net from skb->sk */
1513 skb
->sk
= dev_net(dev
)->rtnl
;
1515 err
= fib_nl_newrule(skb
, nlh
, NULL
);
1519 err
= fib_nl_delrule(skb
, nlh
, NULL
);
1533 static int vrf_add_fib_rules(const struct net_device
*dev
)
1537 err
= vrf_fib_rule(dev
, AF_INET
, true);
1541 err
= vrf_fib_rule(dev
, AF_INET6
, true);
1545 #if IS_ENABLED(CONFIG_IP_MROUTE_MULTIPLE_TABLES)
1546 err
= vrf_fib_rule(dev
, RTNL_FAMILY_IPMR
, true);
1551 #if IS_ENABLED(CONFIG_IPV6_MROUTE_MULTIPLE_TABLES)
1552 err
= vrf_fib_rule(dev
, RTNL_FAMILY_IP6MR
, true);
1559 #if IS_ENABLED(CONFIG_IPV6_MROUTE_MULTIPLE_TABLES)
1561 vrf_fib_rule(dev
, RTNL_FAMILY_IPMR
, false);
1564 #if IS_ENABLED(CONFIG_IP_MROUTE_MULTIPLE_TABLES)
1566 vrf_fib_rule(dev
, AF_INET6
, false);
1570 vrf_fib_rule(dev
, AF_INET
, false);
1573 netdev_err(dev
, "Failed to add FIB rules.\n");
1577 static void vrf_setup(struct net_device
*dev
)
1581 /* Initialize the device structure. */
1582 dev
->netdev_ops
= &vrf_netdev_ops
;
1583 dev
->l3mdev_ops
= &vrf_l3mdev_ops
;
1584 dev
->ethtool_ops
= &vrf_ethtool_ops
;
1585 dev
->needs_free_netdev
= true;
1587 /* Fill in device structure with ethernet-generic values. */
1588 eth_hw_addr_random(dev
);
1590 /* don't acquire vrf device's netif_tx_lock when transmitting */
1591 dev
->features
|= NETIF_F_LLTX
;
1593 /* don't allow vrf devices to change network namespaces. */
1594 dev
->features
|= NETIF_F_NETNS_LOCAL
;
1596 /* does not make sense for a VLAN to be added to a vrf device */
1597 dev
->features
|= NETIF_F_VLAN_CHALLENGED
;
1599 /* enable offload features */
1600 dev
->features
|= NETIF_F_GSO_SOFTWARE
;
1601 dev
->features
|= NETIF_F_RXCSUM
| NETIF_F_HW_CSUM
| NETIF_F_SCTP_CRC
;
1602 dev
->features
|= NETIF_F_SG
| NETIF_F_FRAGLIST
| NETIF_F_HIGHDMA
;
1604 dev
->hw_features
= dev
->features
;
1605 dev
->hw_enc_features
= dev
->features
;
1607 /* default to no qdisc; user can add if desired */
1608 dev
->priv_flags
|= IFF_NO_QUEUE
;
1609 dev
->priv_flags
|= IFF_NO_RX_HANDLER
;
1610 dev
->priv_flags
|= IFF_LIVE_ADDR_CHANGE
;
1612 /* VRF devices do not care about MTU, but if the MTU is set
1613 * too low then the ipv4 and ipv6 protocols are disabled
1614 * which breaks networking.
1616 dev
->min_mtu
= IPV6_MIN_MTU
;
1617 dev
->max_mtu
= ETH_MAX_MTU
;
1620 static int vrf_validate(struct nlattr
*tb
[], struct nlattr
*data
[],
1621 struct netlink_ext_ack
*extack
)
1623 if (tb
[IFLA_ADDRESS
]) {
1624 if (nla_len(tb
[IFLA_ADDRESS
]) != ETH_ALEN
) {
1625 NL_SET_ERR_MSG(extack
, "Invalid hardware address");
1628 if (!is_valid_ether_addr(nla_data(tb
[IFLA_ADDRESS
]))) {
1629 NL_SET_ERR_MSG(extack
, "Invalid hardware address");
1630 return -EADDRNOTAVAIL
;
1636 static void vrf_dellink(struct net_device
*dev
, struct list_head
*head
)
1638 struct net_device
*port_dev
;
1639 struct list_head
*iter
;
1641 netdev_for_each_lower_dev(dev
, port_dev
, iter
)
1642 vrf_del_slave(dev
, port_dev
);
1644 vrf_map_unregister_dev(dev
);
1646 unregister_netdevice_queue(dev
, head
);
1649 static int vrf_newlink(struct net
*src_net
, struct net_device
*dev
,
1650 struct nlattr
*tb
[], struct nlattr
*data
[],
1651 struct netlink_ext_ack
*extack
)
1653 struct net_vrf
*vrf
= netdev_priv(dev
);
1654 struct netns_vrf
*nn_vrf
;
1655 bool *add_fib_rules
;
1659 if (!data
|| !data
[IFLA_VRF_TABLE
]) {
1660 NL_SET_ERR_MSG(extack
, "VRF table id is missing");
1664 vrf
->tb_id
= nla_get_u32(data
[IFLA_VRF_TABLE
]);
1665 if (vrf
->tb_id
== RT_TABLE_UNSPEC
) {
1666 NL_SET_ERR_MSG_ATTR(extack
, data
[IFLA_VRF_TABLE
],
1667 "Invalid VRF table id");
1671 dev
->priv_flags
|= IFF_L3MDEV_MASTER
;
1673 err
= register_netdevice(dev
);
1677 /* mapping between table_id and vrf;
1678 * note: such binding could not be done in the dev init function
1679 * because dev->ifindex id is not available yet.
1681 vrf
->ifindex
= dev
->ifindex
;
1683 err
= vrf_map_register_dev(dev
, extack
);
1685 unregister_netdevice(dev
);
1690 nn_vrf
= net_generic(net
, vrf_net_id
);
1692 add_fib_rules
= &nn_vrf
->add_fib_rules
;
1693 if (*add_fib_rules
) {
1694 err
= vrf_add_fib_rules(dev
);
1696 vrf_map_unregister_dev(dev
);
1697 unregister_netdevice(dev
);
1700 *add_fib_rules
= false;
1707 static size_t vrf_nl_getsize(const struct net_device
*dev
)
1709 return nla_total_size(sizeof(u32
)); /* IFLA_VRF_TABLE */
1712 static int vrf_fillinfo(struct sk_buff
*skb
,
1713 const struct net_device
*dev
)
1715 struct net_vrf
*vrf
= netdev_priv(dev
);
1717 return nla_put_u32(skb
, IFLA_VRF_TABLE
, vrf
->tb_id
);
1720 static size_t vrf_get_slave_size(const struct net_device
*bond_dev
,
1721 const struct net_device
*slave_dev
)
1723 return nla_total_size(sizeof(u32
)); /* IFLA_VRF_PORT_TABLE */
1726 static int vrf_fill_slave_info(struct sk_buff
*skb
,
1727 const struct net_device
*vrf_dev
,
1728 const struct net_device
*slave_dev
)
1730 struct net_vrf
*vrf
= netdev_priv(vrf_dev
);
1732 if (nla_put_u32(skb
, IFLA_VRF_PORT_TABLE
, vrf
->tb_id
))
1738 static const struct nla_policy vrf_nl_policy
[IFLA_VRF_MAX
+ 1] = {
1739 [IFLA_VRF_TABLE
] = { .type
= NLA_U32
},
1742 static struct rtnl_link_ops vrf_link_ops __read_mostly
= {
1744 .priv_size
= sizeof(struct net_vrf
),
1746 .get_size
= vrf_nl_getsize
,
1747 .policy
= vrf_nl_policy
,
1748 .validate
= vrf_validate
,
1749 .fill_info
= vrf_fillinfo
,
1751 .get_slave_size
= vrf_get_slave_size
,
1752 .fill_slave_info
= vrf_fill_slave_info
,
1754 .newlink
= vrf_newlink
,
1755 .dellink
= vrf_dellink
,
1757 .maxtype
= IFLA_VRF_MAX
,
1760 static int vrf_device_event(struct notifier_block
*unused
,
1761 unsigned long event
, void *ptr
)
1763 struct net_device
*dev
= netdev_notifier_info_to_dev(ptr
);
1765 /* only care about unregister events to drop slave references */
1766 if (event
== NETDEV_UNREGISTER
) {
1767 struct net_device
*vrf_dev
;
1769 if (!netif_is_l3_slave(dev
))
1772 vrf_dev
= netdev_master_upper_dev_get(dev
);
1773 vrf_del_slave(vrf_dev
, dev
);
1779 static struct notifier_block vrf_notifier_block __read_mostly
= {
1780 .notifier_call
= vrf_device_event
,
1783 static int vrf_map_init(struct vrf_map
*vmap
)
1785 spin_lock_init(&vmap
->vmap_lock
);
1786 hash_init(vmap
->ht
);
1788 vmap
->strict_mode
= false;
1793 static int vrf_shared_table_handler(struct ctl_table
*table
, int write
,
1794 void *buffer
, size_t *lenp
, loff_t
*ppos
)
1796 struct net
*net
= (struct net
*)table
->extra1
;
1797 struct vrf_map
*vmap
= netns_vrf_map(net
);
1798 int proc_strict_mode
= 0;
1799 struct ctl_table tmp
= {
1800 .procname
= table
->procname
,
1801 .data
= &proc_strict_mode
,
1802 .maxlen
= sizeof(int),
1803 .mode
= table
->mode
,
1804 .extra1
= SYSCTL_ZERO
,
1805 .extra2
= SYSCTL_ONE
,
1810 proc_strict_mode
= vrf_strict_mode(vmap
);
1812 ret
= proc_dointvec_minmax(&tmp
, write
, buffer
, lenp
, ppos
);
1814 if (write
&& ret
== 0)
1815 ret
= vrf_strict_mode_change(vmap
, (bool)proc_strict_mode
);
1820 static const struct ctl_table vrf_table
[] = {
1822 .procname
= "strict_mode",
1824 .maxlen
= sizeof(int),
1826 .proc_handler
= vrf_shared_table_handler
,
1827 /* set by the vrf_netns_init */
1833 /* Initialize per network namespace state */
1834 static int __net_init
vrf_netns_init(struct net
*net
)
1836 struct netns_vrf
*nn_vrf
= net_generic(net
, vrf_net_id
);
1837 struct ctl_table
*table
;
1840 nn_vrf
->add_fib_rules
= true;
1841 vrf_map_init(&nn_vrf
->vmap
);
1843 table
= kmemdup(vrf_table
, sizeof(vrf_table
), GFP_KERNEL
);
1847 /* init the extra1 parameter with the reference to current netns */
1848 table
[0].extra1
= net
;
1850 nn_vrf
->ctl_hdr
= register_net_sysctl(net
, "net/vrf", table
);
1851 if (!nn_vrf
->ctl_hdr
) {
1864 static void __net_exit
vrf_netns_exit(struct net
*net
)
1866 struct netns_vrf
*nn_vrf
= net_generic(net
, vrf_net_id
);
1867 struct ctl_table
*table
;
1869 table
= nn_vrf
->ctl_hdr
->ctl_table_arg
;
1870 unregister_net_sysctl_table(nn_vrf
->ctl_hdr
);
1874 static struct pernet_operations vrf_net_ops __net_initdata
= {
1875 .init
= vrf_netns_init
,
1876 .exit
= vrf_netns_exit
,
1878 .size
= sizeof(struct netns_vrf
),
1881 static int __init
vrf_init_module(void)
1885 register_netdevice_notifier(&vrf_notifier_block
);
1887 rc
= register_pernet_subsys(&vrf_net_ops
);
1891 rc
= l3mdev_table_lookup_register(L3MDEV_TYPE_VRF
,
1892 vrf_ifindex_lookup_by_table_id
);
1896 rc
= rtnl_link_register(&vrf_link_ops
);
1898 goto table_lookup_unreg
;
1903 l3mdev_table_lookup_unregister(L3MDEV_TYPE_VRF
,
1904 vrf_ifindex_lookup_by_table_id
);
1907 unregister_pernet_subsys(&vrf_net_ops
);
1910 unregister_netdevice_notifier(&vrf_notifier_block
);
1914 module_init(vrf_init_module
);
1915 MODULE_AUTHOR("Shrijeet Mukherjee, David Ahern");
1916 MODULE_DESCRIPTION("Device driver to instantiate VRF domains");
1917 MODULE_LICENSE("GPL");
1918 MODULE_ALIAS_RTNL_LINK(DRV_NAME
);
1919 MODULE_VERSION(DRV_VERSION
);