2 * Linux NET3: GRE over IP protocol decoder.
4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
13 #include <linux/capability.h>
14 #include <linux/module.h>
15 #include <linux/types.h>
16 #include <linux/kernel.h>
17 #include <asm/uaccess.h>
18 #include <linux/skbuff.h>
19 #include <linux/netdevice.h>
21 #include <linux/tcp.h>
22 #include <linux/udp.h>
23 #include <linux/if_arp.h>
24 #include <linux/mroute.h>
25 #include <linux/init.h>
26 #include <linux/in6.h>
27 #include <linux/inetdevice.h>
28 #include <linux/igmp.h>
29 #include <linux/netfilter_ipv4.h>
30 #include <linux/if_ether.h>
35 #include <net/protocol.h>
38 #include <net/checksum.h>
39 #include <net/dsfield.h>
40 #include <net/inet_ecn.h>
45 #include <net/ip6_fib.h>
46 #include <net/ip6_route.h>
53 1. The most important issue is detecting local dead loops.
54 They would cause complete host lockup in transmit, which
55 would be "resolved" by stack overflow or, if queueing is enabled,
56 with infinite looping in net_bh.
58 We cannot track such dead loops during route installation,
59 it is infeasible task. The most general solutions would be
60 to keep skb->encapsulation counter (sort of local ttl),
61 and silently drop packet when it expires. It is the best
62 solution, but it supposes maintaing new variable in ALL
63 skb, even if no tunneling is used.
65 Current solution: t->recursion lock breaks dead loops. It looks
66 like dev->tbusy flag, but I preferred new variable, because
67 the semantics is different. One day, when hard_start_xmit
68 will be multithreaded we will have to use skb->encapsulation.
72 2. Networking dead loops would not kill routers, but would really
73 kill network. IP hop limit plays role of "t->recursion" in this case,
74 if we copy it from packet being encapsulated to upper header.
75 It is very good solution, but it introduces two problems:
77 - Routing protocols, using packets with ttl=1 (OSPF, RIP2),
78 do not work over tunnels.
79 - traceroute does not work. I planned to relay ICMP from tunnel,
80 so that this problem would be solved and traceroute output
81 would even more informative. This idea appeared to be wrong:
82 only Linux complies to rfc1812 now (yes, guys, Linux is the only
83 true router now :-)), all routers (at least, in neighbourhood of mine)
84 return only 8 bytes of payload. It is the end.
86 Hence, if we want that OSPF worked or traceroute said something reasonable,
87 we should search for another solution.
89 One of them is to parse packet trying to detect inner encapsulation
90 made by our node. It is difficult or even impossible, especially,
91 taking into account fragmentation. TO be short, tt is not solution at all.
93 Current solution: The solution was UNEXPECTEDLY SIMPLE.
94 We force DF flag on tunnels with preconfigured hop limit,
95 that is ALL. :-) Well, it does not remove the problem completely,
96 but exponential growth of network traffic is changed to linear
97 (branches, that exceed pmtu are pruned) and tunnel mtu
98 fastly degrades to value <68, where looping stops.
99 Yes, it is not good if there exists a router in the loop,
100 which does not force DF, even when encapsulating packets have DF set.
101 But it is not our problem! Nobody could accuse us, we made
102 all that we could make. Even if it is your gated who injected
103 fatal route to network, even if it were you who configured
104 fatal static route: you are innocent. :-)
108 3. Really, ipv4/ipip.c, ipv4/ip_gre.c and ipv6/sit.c contain
109 practically identical code. It would be good to glue them
110 together, but it is not very evident, how to make them modular.
111 sit is integral part of IPv6, ipip and gre are naturally modular.
112 We could extract common parts (hash table, ioctl etc)
113 to a separate module (ip_tunnel.c).
118 static int ipgre_tunnel_init(struct net_device
*dev
);
119 static void ipgre_tunnel_setup(struct net_device
*dev
);
121 /* Fallback tunnel: no source, no destination, no key, no options */
123 static int ipgre_fb_tunnel_init(struct net_device
*dev
);
125 static struct net_device
*ipgre_fb_tunnel_dev
;
127 /* Tunnel hash table */
137 We require exact key match i.e. if a key is present in packet
138 it will match only tunnel with the same key; if it is not present,
139 it will match only keyless tunnel.
141 All keysless packets, if not matched configured keyless tunnels
142 will match fallback tunnel.
146 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
148 static struct ip_tunnel
*tunnels
[4][HASH_SIZE
];
150 #define tunnels_r_l (tunnels[3])
151 #define tunnels_r (tunnels[2])
152 #define tunnels_l (tunnels[1])
153 #define tunnels_wc (tunnels[0])
155 static DEFINE_RWLOCK(ipgre_lock
);
157 /* Given src, dst and key, find appropriate for input tunnel. */
159 static struct ip_tunnel
* ipgre_tunnel_lookup(__be32 remote
, __be32 local
, __be32 key
)
161 unsigned h0
= HASH(remote
);
162 unsigned h1
= HASH(key
);
165 for (t
= tunnels_r_l
[h0
^h1
]; t
; t
= t
->next
) {
166 if (local
== t
->parms
.iph
.saddr
&& remote
== t
->parms
.iph
.daddr
) {
167 if (t
->parms
.i_key
== key
&& (t
->dev
->flags
&IFF_UP
))
171 for (t
= tunnels_r
[h0
^h1
]; t
; t
= t
->next
) {
172 if (remote
== t
->parms
.iph
.daddr
) {
173 if (t
->parms
.i_key
== key
&& (t
->dev
->flags
&IFF_UP
))
177 for (t
= tunnels_l
[h1
]; t
; t
= t
->next
) {
178 if (local
== t
->parms
.iph
.saddr
||
179 (local
== t
->parms
.iph
.daddr
&& MULTICAST(local
))) {
180 if (t
->parms
.i_key
== key
&& (t
->dev
->flags
&IFF_UP
))
184 for (t
= tunnels_wc
[h1
]; t
; t
= t
->next
) {
185 if (t
->parms
.i_key
== key
&& (t
->dev
->flags
&IFF_UP
))
189 if (ipgre_fb_tunnel_dev
->flags
&IFF_UP
)
190 return netdev_priv(ipgre_fb_tunnel_dev
);
194 static struct ip_tunnel
**ipgre_bucket(struct ip_tunnel
*t
)
196 __be32 remote
= t
->parms
.iph
.daddr
;
197 __be32 local
= t
->parms
.iph
.saddr
;
198 __be32 key
= t
->parms
.i_key
;
199 unsigned h
= HASH(key
);
204 if (remote
&& !MULTICAST(remote
)) {
209 return &tunnels
[prio
][h
];
212 static void ipgre_tunnel_link(struct ip_tunnel
*t
)
214 struct ip_tunnel
**tp
= ipgre_bucket(t
);
217 write_lock_bh(&ipgre_lock
);
219 write_unlock_bh(&ipgre_lock
);
222 static void ipgre_tunnel_unlink(struct ip_tunnel
*t
)
224 struct ip_tunnel
**tp
;
226 for (tp
= ipgre_bucket(t
); *tp
; tp
= &(*tp
)->next
) {
228 write_lock_bh(&ipgre_lock
);
230 write_unlock_bh(&ipgre_lock
);
236 static struct ip_tunnel
* ipgre_tunnel_locate(struct ip_tunnel_parm
*parms
, int create
)
238 __be32 remote
= parms
->iph
.daddr
;
239 __be32 local
= parms
->iph
.saddr
;
240 __be32 key
= parms
->i_key
;
241 struct ip_tunnel
*t
, **tp
, *nt
;
242 struct net_device
*dev
;
243 unsigned h
= HASH(key
);
249 if (remote
&& !MULTICAST(remote
)) {
253 for (tp
= &tunnels
[prio
][h
]; (t
= *tp
) != NULL
; tp
= &t
->next
) {
254 if (local
== t
->parms
.iph
.saddr
&& remote
== t
->parms
.iph
.daddr
) {
255 if (key
== t
->parms
.i_key
)
263 strlcpy(name
, parms
->name
, IFNAMSIZ
);
266 for (i
=1; i
<100; i
++) {
267 sprintf(name
, "gre%d", i
);
268 if (__dev_get_by_name(name
) == NULL
)
275 dev
= alloc_netdev(sizeof(*t
), name
, ipgre_tunnel_setup
);
279 dev
->init
= ipgre_tunnel_init
;
280 nt
= netdev_priv(dev
);
283 if (register_netdevice(dev
) < 0) {
289 ipgre_tunnel_link(nt
);
296 static void ipgre_tunnel_uninit(struct net_device
*dev
)
298 ipgre_tunnel_unlink(netdev_priv(dev
));
303 static void ipgre_err(struct sk_buff
*skb
, u32 info
)
305 #ifndef I_WISH_WORLD_WERE_PERFECT
307 /* It is not :-( All the routers (except for Linux) return only
308 8 bytes of packet payload. It means, that precise relaying of
309 ICMP in the real Internet is absolutely infeasible.
311 Moreover, Cisco "wise men" put GRE key to the third word
312 in GRE header. It makes impossible maintaining even soft state for keyed
313 GRE tunnels with enabled checksum. Tell them "thank you".
315 Well, I wonder, rfc1812 was written by Cisco employee,
316 what the hell these idiots break standrads established
320 struct iphdr
*iph
= (struct iphdr
*)skb
->data
;
321 __be16
*p
= (__be16
*)(skb
->data
+(iph
->ihl
<<2));
322 int grehlen
= (iph
->ihl
<<2) + 4;
323 const int type
= icmp_hdr(skb
)->type
;
324 const int code
= icmp_hdr(skb
)->code
;
329 if (flags
&(GRE_CSUM
|GRE_KEY
|GRE_SEQ
|GRE_ROUTING
|GRE_VERSION
)) {
330 if (flags
&(GRE_VERSION
|GRE_ROUTING
))
339 /* If only 8 bytes returned, keyed message will be dropped here */
340 if (skb_headlen(skb
) < grehlen
)
345 case ICMP_PARAMETERPROB
:
348 case ICMP_DEST_UNREACH
:
351 case ICMP_PORT_UNREACH
:
352 /* Impossible event. */
354 case ICMP_FRAG_NEEDED
:
355 /* Soft state for pmtu is maintained by IP core. */
358 /* All others are translated to HOST_UNREACH.
359 rfc2003 contains "deep thoughts" about NET_UNREACH,
360 I believe they are just ether pollution. --ANK
365 case ICMP_TIME_EXCEEDED
:
366 if (code
!= ICMP_EXC_TTL
)
371 read_lock(&ipgre_lock
);
372 t
= ipgre_tunnel_lookup(iph
->daddr
, iph
->saddr
, (flags
&GRE_KEY
) ? *(((__be32
*)p
) + (grehlen
>>2) - 1) : 0);
373 if (t
== NULL
|| t
->parms
.iph
.daddr
== 0 || MULTICAST(t
->parms
.iph
.daddr
))
376 if (t
->parms
.iph
.ttl
== 0 && type
== ICMP_TIME_EXCEEDED
)
379 if (jiffies
- t
->err_time
< IPTUNNEL_ERR_TIMEO
)
383 t
->err_time
= jiffies
;
385 read_unlock(&ipgre_lock
);
388 struct iphdr
*iph
= (struct iphdr
*)dp
;
390 __be16
*p
= (__be16
*)(dp
+(iph
->ihl
<<2));
391 const int type
= icmp_hdr(skb
)->type
;
392 const int code
= icmp_hdr(skb
)->code
;
398 int grehlen
= (iph
->ihl
<<2) + 4;
399 struct sk_buff
*skb2
;
403 if (p
[1] != htons(ETH_P_IP
))
407 if (flags
&(GRE_CSUM
|GRE_KEY
|GRE_SEQ
|GRE_ROUTING
|GRE_VERSION
)) {
408 if (flags
&(GRE_VERSION
|GRE_ROUTING
))
417 if (len
< grehlen
+ sizeof(struct iphdr
))
419 eiph
= (struct iphdr
*)(dp
+ grehlen
);
424 case ICMP_PARAMETERPROB
:
425 n
= ntohl(icmp_hdr(skb
)->un
.gateway
) >> 24;
426 if (n
< (iph
->ihl
<<2))
429 /* So... This guy found something strange INSIDE encapsulated
430 packet. Well, he is fool, but what can we do ?
432 rel_type
= ICMP_PARAMETERPROB
;
434 rel_info
= htonl(n
<< 24);
437 case ICMP_DEST_UNREACH
:
440 case ICMP_PORT_UNREACH
:
441 /* Impossible event. */
443 case ICMP_FRAG_NEEDED
:
444 /* And it is the only really necessary thing :-) */
445 n
= ntohs(icmp_hdr(skb
)->un
.frag
.mtu
);
449 /* BSD 4.2 MORE DOES NOT EXIST IN NATURE. */
450 if (n
> ntohs(eiph
->tot_len
))
455 /* All others are translated to HOST_UNREACH.
456 rfc2003 contains "deep thoughts" about NET_UNREACH,
457 I believe, it is just ether pollution. --ANK
459 rel_type
= ICMP_DEST_UNREACH
;
460 rel_code
= ICMP_HOST_UNREACH
;
464 case ICMP_TIME_EXCEEDED
:
465 if (code
!= ICMP_EXC_TTL
)
470 /* Prepare fake skb to feed it to icmp_send */
471 skb2
= skb_clone(skb
, GFP_ATOMIC
);
474 dst_release(skb2
->dst
);
476 skb_pull(skb2
, skb
->data
- (u8
*)eiph
);
477 skb_reset_network_header(skb2
);
479 /* Try to guess incoming interface */
480 memset(&fl
, 0, sizeof(fl
));
481 fl
.fl4_dst
= eiph
->saddr
;
482 fl
.fl4_tos
= RT_TOS(eiph
->tos
);
483 fl
.proto
= IPPROTO_GRE
;
484 if (ip_route_output_key(&rt
, &fl
)) {
488 skb2
->dev
= rt
->u
.dst
.dev
;
490 /* route "incoming" packet */
491 if (rt
->rt_flags
&RTCF_LOCAL
) {
494 fl
.fl4_dst
= eiph
->daddr
;
495 fl
.fl4_src
= eiph
->saddr
;
496 fl
.fl4_tos
= eiph
->tos
;
497 if (ip_route_output_key(&rt
, &fl
) ||
498 rt
->u
.dst
.dev
->type
!= ARPHRD_IPGRE
) {
505 if (ip_route_input(skb2
, eiph
->daddr
, eiph
->saddr
, eiph
->tos
, skb2
->dev
) ||
506 skb2
->dst
->dev
->type
!= ARPHRD_IPGRE
) {
512 /* change mtu on this route */
513 if (type
== ICMP_DEST_UNREACH
&& code
== ICMP_FRAG_NEEDED
) {
514 if (n
> dst_mtu(skb2
->dst
)) {
518 skb2
->dst
->ops
->update_pmtu(skb2
->dst
, n
);
519 } else if (type
== ICMP_TIME_EXCEEDED
) {
520 struct ip_tunnel
*t
= netdev_priv(skb2
->dev
);
521 if (t
->parms
.iph
.ttl
) {
522 rel_type
= ICMP_DEST_UNREACH
;
523 rel_code
= ICMP_HOST_UNREACH
;
527 icmp_send(skb2
, rel_type
, rel_code
, rel_info
);
532 static inline void ipgre_ecn_decapsulate(struct iphdr
*iph
, struct sk_buff
*skb
)
534 if (INET_ECN_is_ce(iph
->tos
)) {
535 if (skb
->protocol
== htons(ETH_P_IP
)) {
536 IP_ECN_set_ce(ip_hdr(skb
));
537 } else if (skb
->protocol
== htons(ETH_P_IPV6
)) {
538 IP6_ECN_set_ce(ipv6_hdr(skb
));
544 ipgre_ecn_encapsulate(u8 tos
, struct iphdr
*old_iph
, struct sk_buff
*skb
)
547 if (skb
->protocol
== htons(ETH_P_IP
))
548 inner
= old_iph
->tos
;
549 else if (skb
->protocol
== htons(ETH_P_IPV6
))
550 inner
= ipv6_get_dsfield((struct ipv6hdr
*)old_iph
);
551 return INET_ECN_encapsulate(tos
, inner
);
554 static int ipgre_rcv(struct sk_buff
*skb
)
562 struct ip_tunnel
*tunnel
;
565 if (!pskb_may_pull(skb
, 16))
572 if (flags
&(GRE_CSUM
|GRE_KEY
|GRE_ROUTING
|GRE_SEQ
|GRE_VERSION
)) {
573 /* - Version must be 0.
574 - We do not support routing headers.
576 if (flags
&(GRE_VERSION
|GRE_ROUTING
))
579 if (flags
&GRE_CSUM
) {
580 switch (skb
->ip_summed
) {
581 case CHECKSUM_COMPLETE
:
582 csum
= csum_fold(skb
->csum
);
588 csum
= __skb_checksum_complete(skb
);
589 skb
->ip_summed
= CHECKSUM_COMPLETE
;
594 key
= *(__be32
*)(h
+ offset
);
598 seqno
= ntohl(*(__be32
*)(h
+ offset
));
603 read_lock(&ipgre_lock
);
604 if ((tunnel
= ipgre_tunnel_lookup(iph
->saddr
, iph
->daddr
, key
)) != NULL
) {
607 skb
->protocol
= *(__be16
*)(h
+ 2);
608 /* WCCP version 1 and 2 protocol decoding.
609 * - Change protocol to IP
610 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
613 skb
->protocol
== htons(ETH_P_WCCP
)) {
614 skb
->protocol
= htons(ETH_P_IP
);
615 if ((*(h
+ offset
) & 0xF0) != 0x40)
619 skb_reset_mac_header(skb
);
620 __pskb_pull(skb
, offset
);
621 skb_reset_network_header(skb
);
622 skb_postpull_rcsum(skb
, skb_transport_header(skb
), offset
);
623 skb
->pkt_type
= PACKET_HOST
;
624 #ifdef CONFIG_NET_IPGRE_BROADCAST
625 if (MULTICAST(iph
->daddr
)) {
626 /* Looped back packet, drop it! */
627 if (((struct rtable
*)skb
->dst
)->fl
.iif
== 0)
629 tunnel
->stat
.multicast
++;
630 skb
->pkt_type
= PACKET_BROADCAST
;
634 if (((flags
&GRE_CSUM
) && csum
) ||
635 (!(flags
&GRE_CSUM
) && tunnel
->parms
.i_flags
&GRE_CSUM
)) {
636 tunnel
->stat
.rx_crc_errors
++;
637 tunnel
->stat
.rx_errors
++;
640 if (tunnel
->parms
.i_flags
&GRE_SEQ
) {
641 if (!(flags
&GRE_SEQ
) ||
642 (tunnel
->i_seqno
&& (s32
)(seqno
- tunnel
->i_seqno
) < 0)) {
643 tunnel
->stat
.rx_fifo_errors
++;
644 tunnel
->stat
.rx_errors
++;
647 tunnel
->i_seqno
= seqno
+ 1;
649 tunnel
->stat
.rx_packets
++;
650 tunnel
->stat
.rx_bytes
+= skb
->len
;
651 skb
->dev
= tunnel
->dev
;
652 dst_release(skb
->dst
);
655 ipgre_ecn_decapsulate(iph
, skb
);
657 read_unlock(&ipgre_lock
);
660 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_PORT_UNREACH
, 0);
663 read_unlock(&ipgre_lock
);
669 static int ipgre_tunnel_xmit(struct sk_buff
*skb
, struct net_device
*dev
)
671 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
672 struct net_device_stats
*stats
= &tunnel
->stat
;
673 struct iphdr
*old_iph
= ip_hdr(skb
);
677 struct rtable
*rt
; /* Route to the other host */
678 struct net_device
*tdev
; /* Device to other host */
679 struct iphdr
*iph
; /* Our new IP header */
680 int max_headroom
; /* The extra header space needed */
685 if (tunnel
->recursion
++) {
686 tunnel
->stat
.collisions
++;
690 if (dev
->hard_header
) {
692 tiph
= (struct iphdr
*)skb
->data
;
694 gre_hlen
= tunnel
->hlen
;
695 tiph
= &tunnel
->parms
.iph
;
698 if ((dst
= tiph
->daddr
) == 0) {
701 if (skb
->dst
== NULL
) {
702 tunnel
->stat
.tx_fifo_errors
++;
706 if (skb
->protocol
== htons(ETH_P_IP
)) {
707 rt
= (struct rtable
*)skb
->dst
;
708 if ((dst
= rt
->rt_gateway
) == 0)
712 else if (skb
->protocol
== htons(ETH_P_IPV6
)) {
713 struct in6_addr
*addr6
;
715 struct neighbour
*neigh
= skb
->dst
->neighbour
;
720 addr6
= (struct in6_addr
*)&neigh
->primary_key
;
721 addr_type
= ipv6_addr_type(addr6
);
723 if (addr_type
== IPV6_ADDR_ANY
) {
724 addr6
= &ipv6_hdr(skb
)->daddr
;
725 addr_type
= ipv6_addr_type(addr6
);
728 if ((addr_type
& IPV6_ADDR_COMPATv4
) == 0)
731 dst
= addr6
->s6_addr32
[3];
740 if (skb
->protocol
== htons(ETH_P_IP
))
746 struct flowi fl
= { .oif
= tunnel
->parms
.link
,
749 .saddr
= tiph
->saddr
,
750 .tos
= RT_TOS(tos
) } },
751 .proto
= IPPROTO_GRE
};
752 if (ip_route_output_key(&rt
, &fl
)) {
753 tunnel
->stat
.tx_carrier_errors
++;
757 tdev
= rt
->u
.dst
.dev
;
761 tunnel
->stat
.collisions
++;
767 mtu
= dst_mtu(&rt
->u
.dst
) - tunnel
->hlen
;
769 mtu
= skb
->dst
? dst_mtu(skb
->dst
) : dev
->mtu
;
772 skb
->dst
->ops
->update_pmtu(skb
->dst
, mtu
);
774 if (skb
->protocol
== htons(ETH_P_IP
)) {
775 df
|= (old_iph
->frag_off
&htons(IP_DF
));
777 if ((old_iph
->frag_off
&htons(IP_DF
)) &&
778 mtu
< ntohs(old_iph
->tot_len
)) {
779 icmp_send(skb
, ICMP_DEST_UNREACH
, ICMP_FRAG_NEEDED
, htonl(mtu
));
785 else if (skb
->protocol
== htons(ETH_P_IPV6
)) {
786 struct rt6_info
*rt6
= (struct rt6_info
*)skb
->dst
;
788 if (rt6
&& mtu
< dst_mtu(skb
->dst
) && mtu
>= IPV6_MIN_MTU
) {
789 if ((tunnel
->parms
.iph
.daddr
&& !MULTICAST(tunnel
->parms
.iph
.daddr
)) ||
790 rt6
->rt6i_dst
.plen
== 128) {
791 rt6
->rt6i_flags
|= RTF_MODIFIED
;
792 skb
->dst
->metrics
[RTAX_MTU
-1] = mtu
;
796 if (mtu
>= IPV6_MIN_MTU
&& mtu
< skb
->len
- tunnel
->hlen
+ gre_hlen
) {
797 icmpv6_send(skb
, ICMPV6_PKT_TOOBIG
, 0, mtu
, dev
);
804 if (tunnel
->err_count
> 0) {
805 if (jiffies
- tunnel
->err_time
< IPTUNNEL_ERR_TIMEO
) {
808 dst_link_failure(skb
);
810 tunnel
->err_count
= 0;
813 max_headroom
= LL_RESERVED_SPACE(tdev
) + gre_hlen
;
815 if (skb_headroom(skb
) < max_headroom
|| skb_cloned(skb
) || skb_shared(skb
)) {
816 struct sk_buff
*new_skb
= skb_realloc_headroom(skb
, max_headroom
);
825 skb_set_owner_w(new_skb
, skb
->sk
);
828 old_iph
= ip_hdr(skb
);
831 skb
->transport_header
= skb
->network_header
;
832 skb_push(skb
, gre_hlen
);
833 skb_reset_network_header(skb
);
834 memset(&(IPCB(skb
)->opt
), 0, sizeof(IPCB(skb
)->opt
));
835 IPCB(skb
)->flags
&= ~(IPSKB_XFRM_TUNNEL_SIZE
| IPSKB_XFRM_TRANSFORMED
|
837 dst_release(skb
->dst
);
838 skb
->dst
= &rt
->u
.dst
;
841 * Push down and install the IPIP header.
846 iph
->ihl
= sizeof(struct iphdr
) >> 2;
848 iph
->protocol
= IPPROTO_GRE
;
849 iph
->tos
= ipgre_ecn_encapsulate(tos
, old_iph
, skb
);
850 iph
->daddr
= rt
->rt_dst
;
851 iph
->saddr
= rt
->rt_src
;
853 if ((iph
->ttl
= tiph
->ttl
) == 0) {
854 if (skb
->protocol
== htons(ETH_P_IP
))
855 iph
->ttl
= old_iph
->ttl
;
857 else if (skb
->protocol
== htons(ETH_P_IPV6
))
858 iph
->ttl
= ((struct ipv6hdr
*)old_iph
)->hop_limit
;
861 iph
->ttl
= dst_metric(&rt
->u
.dst
, RTAX_HOPLIMIT
);
864 ((__be16
*)(iph
+1))[0] = tunnel
->parms
.o_flags
;
865 ((__be16
*)(iph
+1))[1] = skb
->protocol
;
867 if (tunnel
->parms
.o_flags
&(GRE_KEY
|GRE_CSUM
|GRE_SEQ
)) {
868 __be32
*ptr
= (__be32
*)(((u8
*)iph
) + tunnel
->hlen
- 4);
870 if (tunnel
->parms
.o_flags
&GRE_SEQ
) {
872 *ptr
= htonl(tunnel
->o_seqno
);
875 if (tunnel
->parms
.o_flags
&GRE_KEY
) {
876 *ptr
= tunnel
->parms
.o_key
;
879 if (tunnel
->parms
.o_flags
&GRE_CSUM
) {
881 *(__sum16
*)ptr
= ip_compute_csum((void*)(iph
+1), skb
->len
- sizeof(struct iphdr
));
892 dst_link_failure(skb
);
902 ipgre_tunnel_ioctl (struct net_device
*dev
, struct ifreq
*ifr
, int cmd
)
905 struct ip_tunnel_parm p
;
911 if (dev
== ipgre_fb_tunnel_dev
) {
912 if (copy_from_user(&p
, ifr
->ifr_ifru
.ifru_data
, sizeof(p
))) {
916 t
= ipgre_tunnel_locate(&p
, 0);
919 t
= netdev_priv(dev
);
920 memcpy(&p
, &t
->parms
, sizeof(p
));
921 if (copy_to_user(ifr
->ifr_ifru
.ifru_data
, &p
, sizeof(p
)))
928 if (!capable(CAP_NET_ADMIN
))
932 if (copy_from_user(&p
, ifr
->ifr_ifru
.ifru_data
, sizeof(p
)))
936 if (p
.iph
.version
!= 4 || p
.iph
.protocol
!= IPPROTO_GRE
||
937 p
.iph
.ihl
!= 5 || (p
.iph
.frag_off
&htons(~IP_DF
)) ||
938 ((p
.i_flags
|p
.o_flags
)&(GRE_VERSION
|GRE_ROUTING
)))
941 p
.iph
.frag_off
|= htons(IP_DF
);
943 if (!(p
.i_flags
&GRE_KEY
))
945 if (!(p
.o_flags
&GRE_KEY
))
948 t
= ipgre_tunnel_locate(&p
, cmd
== SIOCADDTUNNEL
);
950 if (dev
!= ipgre_fb_tunnel_dev
&& cmd
== SIOCCHGTUNNEL
) {
959 t
= netdev_priv(dev
);
961 if (MULTICAST(p
.iph
.daddr
))
962 nflags
= IFF_BROADCAST
;
963 else if (p
.iph
.daddr
)
964 nflags
= IFF_POINTOPOINT
;
966 if ((dev
->flags
^nflags
)&(IFF_POINTOPOINT
|IFF_BROADCAST
)) {
970 ipgre_tunnel_unlink(t
);
971 t
->parms
.iph
.saddr
= p
.iph
.saddr
;
972 t
->parms
.iph
.daddr
= p
.iph
.daddr
;
973 t
->parms
.i_key
= p
.i_key
;
974 t
->parms
.o_key
= p
.o_key
;
975 memcpy(dev
->dev_addr
, &p
.iph
.saddr
, 4);
976 memcpy(dev
->broadcast
, &p
.iph
.daddr
, 4);
977 ipgre_tunnel_link(t
);
978 netdev_state_change(dev
);
984 if (cmd
== SIOCCHGTUNNEL
) {
985 t
->parms
.iph
.ttl
= p
.iph
.ttl
;
986 t
->parms
.iph
.tos
= p
.iph
.tos
;
987 t
->parms
.iph
.frag_off
= p
.iph
.frag_off
;
989 if (copy_to_user(ifr
->ifr_ifru
.ifru_data
, &t
->parms
, sizeof(p
)))
992 err
= (cmd
== SIOCADDTUNNEL
? -ENOBUFS
: -ENOENT
);
997 if (!capable(CAP_NET_ADMIN
))
1000 if (dev
== ipgre_fb_tunnel_dev
) {
1002 if (copy_from_user(&p
, ifr
->ifr_ifru
.ifru_data
, sizeof(p
)))
1005 if ((t
= ipgre_tunnel_locate(&p
, 0)) == NULL
)
1008 if (t
== netdev_priv(ipgre_fb_tunnel_dev
))
1012 unregister_netdevice(dev
);
1024 static struct net_device_stats
*ipgre_tunnel_get_stats(struct net_device
*dev
)
1026 return &(((struct ip_tunnel
*)netdev_priv(dev
))->stat
);
1029 static int ipgre_tunnel_change_mtu(struct net_device
*dev
, int new_mtu
)
1031 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
1032 if (new_mtu
< 68 || new_mtu
> 0xFFF8 - tunnel
->hlen
)
1038 #ifdef CONFIG_NET_IPGRE_BROADCAST
1039 /* Nice toy. Unfortunately, useless in real life :-)
1040 It allows to construct virtual multiprotocol broadcast "LAN"
1041 over the Internet, provided multicast routing is tuned.
1044 I have no idea was this bicycle invented before me,
1045 so that I had to set ARPHRD_IPGRE to a random value.
1046 I have an impression, that Cisco could make something similar,
1047 but this feature is apparently missing in IOS<=11.2(8).
1049 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks
1050 with broadcast 224.66.66.66. If you have access to mbone, play with me :-)
1052 ping -t 255 224.66.66.66
1054 If nobody answers, mbone does not work.
1056 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255
1057 ip addr add 10.66.66.<somewhat>/24 dev Universe
1058 ifconfig Universe up
1059 ifconfig Universe add fe80::<Your_real_addr>/10
1060 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96
1063 ftp fec0:6666:6666::193.233.7.65
1068 static int ipgre_header(struct sk_buff
*skb
, struct net_device
*dev
, unsigned short type
,
1069 void *daddr
, void *saddr
, unsigned len
)
1071 struct ip_tunnel
*t
= netdev_priv(dev
);
1072 struct iphdr
*iph
= (struct iphdr
*)skb_push(skb
, t
->hlen
);
1073 __be16
*p
= (__be16
*)(iph
+1);
1075 memcpy(iph
, &t
->parms
.iph
, sizeof(struct iphdr
));
1076 p
[0] = t
->parms
.o_flags
;
1080 * Set the source hardware address.
1084 memcpy(&iph
->saddr
, saddr
, 4);
1087 memcpy(&iph
->daddr
, daddr
, 4);
1090 if (iph
->daddr
&& !MULTICAST(iph
->daddr
))
1096 static int ipgre_open(struct net_device
*dev
)
1098 struct ip_tunnel
*t
= netdev_priv(dev
);
1100 if (MULTICAST(t
->parms
.iph
.daddr
)) {
1101 struct flowi fl
= { .oif
= t
->parms
.link
,
1103 { .daddr
= t
->parms
.iph
.daddr
,
1104 .saddr
= t
->parms
.iph
.saddr
,
1105 .tos
= RT_TOS(t
->parms
.iph
.tos
) } },
1106 .proto
= IPPROTO_GRE
};
1108 if (ip_route_output_key(&rt
, &fl
))
1109 return -EADDRNOTAVAIL
;
1110 dev
= rt
->u
.dst
.dev
;
1112 if (__in_dev_get_rtnl(dev
) == NULL
)
1113 return -EADDRNOTAVAIL
;
1114 t
->mlink
= dev
->ifindex
;
1115 ip_mc_inc_group(__in_dev_get_rtnl(dev
), t
->parms
.iph
.daddr
);
1120 static int ipgre_close(struct net_device
*dev
)
1122 struct ip_tunnel
*t
= netdev_priv(dev
);
1123 if (MULTICAST(t
->parms
.iph
.daddr
) && t
->mlink
) {
1124 struct in_device
*in_dev
= inetdev_by_index(t
->mlink
);
1126 ip_mc_dec_group(in_dev
, t
->parms
.iph
.daddr
);
1135 static void ipgre_tunnel_setup(struct net_device
*dev
)
1137 SET_MODULE_OWNER(dev
);
1138 dev
->uninit
= ipgre_tunnel_uninit
;
1139 dev
->destructor
= free_netdev
;
1140 dev
->hard_start_xmit
= ipgre_tunnel_xmit
;
1141 dev
->get_stats
= ipgre_tunnel_get_stats
;
1142 dev
->do_ioctl
= ipgre_tunnel_ioctl
;
1143 dev
->change_mtu
= ipgre_tunnel_change_mtu
;
1145 dev
->type
= ARPHRD_IPGRE
;
1146 dev
->hard_header_len
= LL_MAX_HEADER
+ sizeof(struct iphdr
) + 4;
1147 dev
->mtu
= ETH_DATA_LEN
- sizeof(struct iphdr
) - 4;
1148 dev
->flags
= IFF_NOARP
;
1153 static int ipgre_tunnel_init(struct net_device
*dev
)
1155 struct net_device
*tdev
= NULL
;
1156 struct ip_tunnel
*tunnel
;
1158 int hlen
= LL_MAX_HEADER
;
1159 int mtu
= ETH_DATA_LEN
;
1160 int addend
= sizeof(struct iphdr
) + 4;
1162 tunnel
= netdev_priv(dev
);
1163 iph
= &tunnel
->parms
.iph
;
1166 strcpy(tunnel
->parms
.name
, dev
->name
);
1168 memcpy(dev
->dev_addr
, &tunnel
->parms
.iph
.saddr
, 4);
1169 memcpy(dev
->broadcast
, &tunnel
->parms
.iph
.daddr
, 4);
1171 /* Guess output device to choose reasonable mtu and hard_header_len */
1174 struct flowi fl
= { .oif
= tunnel
->parms
.link
,
1176 { .daddr
= iph
->daddr
,
1177 .saddr
= iph
->saddr
,
1178 .tos
= RT_TOS(iph
->tos
) } },
1179 .proto
= IPPROTO_GRE
};
1181 if (!ip_route_output_key(&rt
, &fl
)) {
1182 tdev
= rt
->u
.dst
.dev
;
1186 dev
->flags
|= IFF_POINTOPOINT
;
1188 #ifdef CONFIG_NET_IPGRE_BROADCAST
1189 if (MULTICAST(iph
->daddr
)) {
1192 dev
->flags
= IFF_BROADCAST
;
1193 dev
->hard_header
= ipgre_header
;
1194 dev
->open
= ipgre_open
;
1195 dev
->stop
= ipgre_close
;
1200 if (!tdev
&& tunnel
->parms
.link
)
1201 tdev
= __dev_get_by_index(tunnel
->parms
.link
);
1204 hlen
= tdev
->hard_header_len
;
1207 dev
->iflink
= tunnel
->parms
.link
;
1209 /* Precalculate GRE options length */
1210 if (tunnel
->parms
.o_flags
&(GRE_CSUM
|GRE_KEY
|GRE_SEQ
)) {
1211 if (tunnel
->parms
.o_flags
&GRE_CSUM
)
1213 if (tunnel
->parms
.o_flags
&GRE_KEY
)
1215 if (tunnel
->parms
.o_flags
&GRE_SEQ
)
1218 dev
->hard_header_len
= hlen
+ addend
;
1219 dev
->mtu
= mtu
- addend
;
1220 tunnel
->hlen
= addend
;
1224 static int __init
ipgre_fb_tunnel_init(struct net_device
*dev
)
1226 struct ip_tunnel
*tunnel
= netdev_priv(dev
);
1227 struct iphdr
*iph
= &tunnel
->parms
.iph
;
1230 strcpy(tunnel
->parms
.name
, dev
->name
);
1233 iph
->protocol
= IPPROTO_GRE
;
1235 tunnel
->hlen
= sizeof(struct iphdr
) + 4;
1238 tunnels_wc
[0] = tunnel
;
1243 static struct net_protocol ipgre_protocol
= {
1244 .handler
= ipgre_rcv
,
1245 .err_handler
= ipgre_err
,
1250 * And now the modules code and kernel interface.
1253 static int __init
ipgre_init(void)
1257 printk(KERN_INFO
"GRE over IPv4 tunneling driver\n");
1259 if (inet_add_protocol(&ipgre_protocol
, IPPROTO_GRE
) < 0) {
1260 printk(KERN_INFO
"ipgre init: can't add protocol\n");
1264 ipgre_fb_tunnel_dev
= alloc_netdev(sizeof(struct ip_tunnel
), "gre0",
1265 ipgre_tunnel_setup
);
1266 if (!ipgre_fb_tunnel_dev
) {
1271 ipgre_fb_tunnel_dev
->init
= ipgre_fb_tunnel_init
;
1273 if ((err
= register_netdev(ipgre_fb_tunnel_dev
)))
1278 free_netdev(ipgre_fb_tunnel_dev
);
1280 inet_del_protocol(&ipgre_protocol
, IPPROTO_GRE
);
1284 static void __exit
ipgre_destroy_tunnels(void)
1288 for (prio
= 0; prio
< 4; prio
++) {
1290 for (h
= 0; h
< HASH_SIZE
; h
++) {
1291 struct ip_tunnel
*t
;
1292 while ((t
= tunnels
[prio
][h
]) != NULL
)
1293 unregister_netdevice(t
->dev
);
1298 static void __exit
ipgre_fini(void)
1300 if (inet_del_protocol(&ipgre_protocol
, IPPROTO_GRE
) < 0)
1301 printk(KERN_INFO
"ipgre close: can't remove protocol\n");
1304 ipgre_destroy_tunnels();
1308 module_init(ipgre_init
);
1309 module_exit(ipgre_fini
);
1310 MODULE_LICENSE("GPL");