1/*
2 *	Linux NET3: IP/IP protocol decoder modified to support
3 *		    virtual tunnel interface
4 *
5 *	Authors:
6 *		Saurabh Mohan (saurabh.mohan@vyatta.com) 05/07/2012
7 *
8 *	This program is free software; you can redistribute it and/or
9 *	modify it under the terms of the GNU General Public License
10 *	as published by the Free Software Foundation; either version
11 *	2 of the License, or (at your option) any later version.
12 *
13 */
14
15/*
16   This version of net/ipv4/ip_vti.c is cloned of net/ipv4/ipip.c
17
18   For comments look at net/ipv4/ip_gre.c --ANK
19 */
20
21
22#include <linux/capability.h>
23#include <linux/module.h>
24#include <linux/types.h>
25#include <linux/kernel.h>
26#include <linux/uaccess.h>
27#include <linux/skbuff.h>
28#include <linux/netdevice.h>
29#include <linux/in.h>
30#include <linux/tcp.h>
31#include <linux/udp.h>
32#include <linux/if_arp.h>
33#include <linux/mroute.h>
34#include <linux/init.h>
35#include <linux/netfilter_ipv4.h>
36#include <linux/if_ether.h>
37#include <linux/icmpv6.h>
38
39#include <net/sock.h>
40#include <net/ip.h>
41#include <net/icmp.h>
42#include <net/ip_tunnels.h>
43#include <net/inet_ecn.h>
44#include <net/xfrm.h>
45#include <net/net_namespace.h>
46#include <net/netns/generic.h>
47
48static struct rtnl_link_ops vti_link_ops __read_mostly;
49
50static int vti_net_id __read_mostly;
51static int vti_tunnel_init(struct net_device *dev);
52
53static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
54		     int encap_type)
55{
56	struct ip_tunnel *tunnel;
57	const struct iphdr *iph = ip_hdr(skb);
58	struct net *net = dev_net(skb->dev);
59	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
60
61	tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
62				  iph->saddr, iph->daddr, 0);
63	if (tunnel != NULL) {
64		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
65			goto drop;
66
67		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
68		skb->mark = be32_to_cpu(tunnel->parms.i_key);
69
70		return xfrm_input(skb, nexthdr, spi, encap_type);
71	}
72
73	return -EINVAL;
74drop:
75	kfree_skb(skb);
76	return 0;
77}
78
79static int vti_rcv(struct sk_buff *skb)
80{
81	XFRM_SPI_SKB_CB(skb)->family = AF_INET;
82	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
83
84	return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
85}
86
87static int vti_rcv_cb(struct sk_buff *skb, int err)
88{
89	unsigned short family;
90	struct net_device *dev;
91	struct pcpu_sw_netstats *tstats;
92	struct xfrm_state *x;
93	struct ip_tunnel *tunnel = XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4;
94
95	if (!tunnel)
96		return 1;
97
98	dev = tunnel->dev;
99
100	if (err) {
101		dev->stats.rx_errors++;
102		dev->stats.rx_dropped++;
103
104		return 0;
105	}
106
107	x = xfrm_input_state(skb);
108	family = x->inner_mode->afinfo->family;
109
110	if (!xfrm_policy_check(NULL, XFRM_POLICY_IN, skb, family))
111		return -EPERM;
112
113	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(skb->dev)));
114	skb->dev = dev;
115
116	tstats = this_cpu_ptr(dev->tstats);
117
118	u64_stats_update_begin(&tstats->syncp);
119	tstats->rx_packets++;
120	tstats->rx_bytes += skb->len;
121	u64_stats_update_end(&tstats->syncp);
122
123	return 0;
124}
125
126static bool vti_state_check(const struct xfrm_state *x, __be32 dst, __be32 src)
127{
128	xfrm_address_t *daddr = (xfrm_address_t *)&dst;
129	xfrm_address_t *saddr = (xfrm_address_t *)&src;
130
131	/* if there is no transform then this tunnel is not functional.
132	 * Or if the xfrm is not mode tunnel.
133	 */
134	if (!x || x->props.mode != XFRM_MODE_TUNNEL ||
135	    x->props.family != AF_INET)
136		return false;
137
138	if (!dst)
139		return xfrm_addr_equal(saddr, &x->props.saddr, AF_INET);
140
141	if (!xfrm_state_addr_check(x, daddr, saddr, AF_INET))
142		return false;
143
144	return true;
145}
146
147static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
148			    struct flowi *fl)
149{
150	struct ip_tunnel *tunnel = netdev_priv(dev);
151	struct ip_tunnel_parm *parms = &tunnel->parms;
152	struct dst_entry *dst = skb_dst(skb);
153	struct net_device *tdev;	/* Device to other host */
154	int err;
155
156	if (!dst) {
157		dev->stats.tx_carrier_errors++;
158		goto tx_error_icmp;
159	}
160
161	dst_hold(dst);
162	dst = xfrm_lookup(tunnel->net, dst, fl, NULL, 0);
163	if (IS_ERR(dst)) {
164		dev->stats.tx_carrier_errors++;
165		goto tx_error_icmp;
166	}
167
168	if (!vti_state_check(dst->xfrm, parms->iph.daddr, parms->iph.saddr)) {
169		dev->stats.tx_carrier_errors++;
170		dst_release(dst);
171		goto tx_error_icmp;
172	}
173
174	tdev = dst->dev;
175
176	if (tdev == dev) {
177		dst_release(dst);
178		dev->stats.collisions++;
179		goto tx_error;
180	}
181
182	if (tunnel->err_count > 0) {
183		if (time_before(jiffies,
184				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
185			tunnel->err_count--;
186			dst_link_failure(skb);
187		} else
188			tunnel->err_count = 0;
189	}
190
191	skb_scrub_packet(skb, !net_eq(tunnel->net, dev_net(dev)));
192	skb_dst_set(skb, dst);
193	skb->dev = skb_dst(skb)->dev;
194
195	err = dst_output(skb);
196	if (net_xmit_eval(err) == 0)
197		err = skb->len;
198	iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
199	return NETDEV_TX_OK;
200
201tx_error_icmp:
202	dst_link_failure(skb);
203tx_error:
204	dev->stats.tx_errors++;
205	kfree_skb(skb);
206	return NETDEV_TX_OK;
207}
208
209/* This function assumes it is being called from dev_queue_xmit()
210 * and that skb is filled properly by that function.
211 */
212static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
213{
214	struct ip_tunnel *tunnel = netdev_priv(dev);
215	struct flowi fl;
216
217	memset(&fl, 0, sizeof(fl));
218
219	skb->mark = be32_to_cpu(tunnel->parms.o_key);
220
221	switch (skb->protocol) {
222	case htons(ETH_P_IP):
223		xfrm_decode_session(skb, &fl, AF_INET);
224		memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
225		break;
226	case htons(ETH_P_IPV6):
227		xfrm_decode_session(skb, &fl, AF_INET6);
228		memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
229		break;
230	default:
231		dev->stats.tx_errors++;
232		dev_kfree_skb(skb);
233		return NETDEV_TX_OK;
234	}
235
236	return vti_xmit(skb, dev, &fl);
237}
238
239static int vti4_err(struct sk_buff *skb, u32 info)
240{
241	__be32 spi;
242	__u32 mark;
243	struct xfrm_state *x;
244	struct ip_tunnel *tunnel;
245	struct ip_esp_hdr *esph;
246	struct ip_auth_hdr *ah ;
247	struct ip_comp_hdr *ipch;
248	struct net *net = dev_net(skb->dev);
249	const struct iphdr *iph = (const struct iphdr *)skb->data;
250	int protocol = iph->protocol;
251	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
252
253	tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
254				  iph->daddr, iph->saddr, 0);
255	if (!tunnel)
256		return -1;
257
258	mark = be32_to_cpu(tunnel->parms.o_key);
259
260	switch (protocol) {
261	case IPPROTO_ESP:
262		esph = (struct ip_esp_hdr *)(skb->data+(iph->ihl<<2));
263		spi = esph->spi;
264		break;
265	case IPPROTO_AH:
266		ah = (struct ip_auth_hdr *)(skb->data+(iph->ihl<<2));
267		spi = ah->spi;
268		break;
269	case IPPROTO_COMP:
270		ipch = (struct ip_comp_hdr *)(skb->data+(iph->ihl<<2));
271		spi = htonl(ntohs(ipch->cpi));
272		break;
273	default:
274		return 0;
275	}
276
277	switch (icmp_hdr(skb)->type) {
278	case ICMP_DEST_UNREACH:
279		if (icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
280			return 0;
281	case ICMP_REDIRECT:
282		break;
283	default:
284		return 0;
285	}
286
287	x = xfrm_state_lookup(net, mark, (const xfrm_address_t *)&iph->daddr,
288			      spi, protocol, AF_INET);
289	if (!x)
290		return 0;
291
292	if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH)
293		ipv4_update_pmtu(skb, net, info, 0, 0, protocol, 0);
294	else
295		ipv4_redirect(skb, net, 0, 0, protocol, 0);
296	xfrm_state_put(x);
297
298	return 0;
299}
300
301static int
302vti_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
303{
304	int err = 0;
305	struct ip_tunnel_parm p;
306
307	if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
308		return -EFAULT;
309
310	if (cmd == SIOCADDTUNNEL || cmd == SIOCCHGTUNNEL) {
311		if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
312		    p.iph.ihl != 5)
313			return -EINVAL;
314	}
315
316	if (!(p.i_flags & GRE_KEY))
317		p.i_key = 0;
318	if (!(p.o_flags & GRE_KEY))
319		p.o_key = 0;
320
321	p.i_flags = VTI_ISVTI;
322
323	err = ip_tunnel_ioctl(dev, &p, cmd);
324	if (err)
325		return err;
326
327	if (cmd != SIOCDELTUNNEL) {
328		p.i_flags |= GRE_KEY;
329		p.o_flags |= GRE_KEY;
330	}
331
332	if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
333		return -EFAULT;
334	return 0;
335}
336
337static const struct net_device_ops vti_netdev_ops = {
338	.ndo_init	= vti_tunnel_init,
339	.ndo_uninit	= ip_tunnel_uninit,
340	.ndo_start_xmit	= vti_tunnel_xmit,
341	.ndo_do_ioctl	= vti_tunnel_ioctl,
342	.ndo_change_mtu	= ip_tunnel_change_mtu,
343	.ndo_get_stats64 = ip_tunnel_get_stats64,
344};
345
346static void vti_tunnel_setup(struct net_device *dev)
347{
348	dev->netdev_ops		= &vti_netdev_ops;
349	dev->type		= ARPHRD_TUNNEL;
350	ip_tunnel_setup(dev, vti_net_id);
351}
352
353static int vti_tunnel_init(struct net_device *dev)
354{
355	struct ip_tunnel *tunnel = netdev_priv(dev);
356	struct iphdr *iph = &tunnel->parms.iph;
357
358	memcpy(dev->dev_addr, &iph->saddr, 4);
359	memcpy(dev->broadcast, &iph->daddr, 4);
360
361	dev->hard_header_len	= LL_MAX_HEADER + sizeof(struct iphdr);
362	dev->mtu		= ETH_DATA_LEN;
363	dev->flags		= IFF_NOARP;
364	dev->iflink		= 0;
365	dev->addr_len		= 4;
366	dev->features		|= NETIF_F_LLTX;
367	netif_keep_dst(dev);
368
369	return ip_tunnel_init(dev);
370}
371
372static void __net_init vti_fb_tunnel_init(struct net_device *dev)
373{
374	struct ip_tunnel *tunnel = netdev_priv(dev);
375	struct iphdr *iph = &tunnel->parms.iph;
376
377	iph->version		= 4;
378	iph->protocol		= IPPROTO_IPIP;
379	iph->ihl		= 5;
380}
381
382static struct xfrm4_protocol vti_esp4_protocol __read_mostly = {
383	.handler	=	vti_rcv,
384	.input_handler	=	vti_input,
385	.cb_handler	=	vti_rcv_cb,
386	.err_handler	=	vti4_err,
387	.priority	=	100,
388};
389
390static struct xfrm4_protocol vti_ah4_protocol __read_mostly = {
391	.handler	=	vti_rcv,
392	.input_handler	=	vti_input,
393	.cb_handler	=	vti_rcv_cb,
394	.err_handler	=	vti4_err,
395	.priority	=	100,
396};
397
398static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
399	.handler	=	vti_rcv,
400	.input_handler	=	vti_input,
401	.cb_handler	=	vti_rcv_cb,
402	.err_handler	=	vti4_err,
403	.priority	=	100,
404};
405
406static int __net_init vti_init_net(struct net *net)
407{
408	int err;
409	struct ip_tunnel_net *itn;
410
411	err = ip_tunnel_init_net(net, vti_net_id, &vti_link_ops, "ip_vti0");
412	if (err)
413		return err;
414	itn = net_generic(net, vti_net_id);
415	vti_fb_tunnel_init(itn->fb_tunnel_dev);
416	return 0;
417}
418
419static void __net_exit vti_exit_net(struct net *net)
420{
421	struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
422	ip_tunnel_delete_net(itn, &vti_link_ops);
423}
424
425static struct pernet_operations vti_net_ops = {
426	.init = vti_init_net,
427	.exit = vti_exit_net,
428	.id   = &vti_net_id,
429	.size = sizeof(struct ip_tunnel_net),
430};
431
432static int vti_tunnel_validate(struct nlattr *tb[], struct nlattr *data[])
433{
434	return 0;
435}
436
437static void vti_netlink_parms(struct nlattr *data[],
438			      struct ip_tunnel_parm *parms)
439{
440	memset(parms, 0, sizeof(*parms));
441
442	parms->iph.protocol = IPPROTO_IPIP;
443
444	if (!data)
445		return;
446
447	parms->i_flags = VTI_ISVTI;
448
449	if (data[IFLA_VTI_LINK])
450		parms->link = nla_get_u32(data[IFLA_VTI_LINK]);
451
452	if (data[IFLA_VTI_IKEY])
453		parms->i_key = nla_get_be32(data[IFLA_VTI_IKEY]);
454
455	if (data[IFLA_VTI_OKEY])
456		parms->o_key = nla_get_be32(data[IFLA_VTI_OKEY]);
457
458	if (data[IFLA_VTI_LOCAL])
459		parms->iph.saddr = nla_get_be32(data[IFLA_VTI_LOCAL]);
460
461	if (data[IFLA_VTI_REMOTE])
462		parms->iph.daddr = nla_get_be32(data[IFLA_VTI_REMOTE]);
463
464}
465
466static int vti_newlink(struct net *src_net, struct net_device *dev,
467		       struct nlattr *tb[], struct nlattr *data[])
468{
469	struct ip_tunnel_parm parms;
470
471	vti_netlink_parms(data, &parms);
472	return ip_tunnel_newlink(dev, tb, &parms);
473}
474
475static int vti_changelink(struct net_device *dev, struct nlattr *tb[],
476			  struct nlattr *data[])
477{
478	struct ip_tunnel_parm p;
479
480	vti_netlink_parms(data, &p);
481	return ip_tunnel_changelink(dev, tb, &p);
482}
483
484static size_t vti_get_size(const struct net_device *dev)
485{
486	return
487		/* IFLA_VTI_LINK */
488		nla_total_size(4) +
489		/* IFLA_VTI_IKEY */
490		nla_total_size(4) +
491		/* IFLA_VTI_OKEY */
492		nla_total_size(4) +
493		/* IFLA_VTI_LOCAL */
494		nla_total_size(4) +
495		/* IFLA_VTI_REMOTE */
496		nla_total_size(4) +
497		0;
498}
499
500static int vti_fill_info(struct sk_buff *skb, const struct net_device *dev)
501{
502	struct ip_tunnel *t = netdev_priv(dev);
503	struct ip_tunnel_parm *p = &t->parms;
504
505	nla_put_u32(skb, IFLA_VTI_LINK, p->link);
506	nla_put_be32(skb, IFLA_VTI_IKEY, p->i_key);
507	nla_put_be32(skb, IFLA_VTI_OKEY, p->o_key);
508	nla_put_be32(skb, IFLA_VTI_LOCAL, p->iph.saddr);
509	nla_put_be32(skb, IFLA_VTI_REMOTE, p->iph.daddr);
510
511	return 0;
512}
513
514static const struct nla_policy vti_policy[IFLA_VTI_MAX + 1] = {
515	[IFLA_VTI_LINK]		= { .type = NLA_U32 },
516	[IFLA_VTI_IKEY]		= { .type = NLA_U32 },
517	[IFLA_VTI_OKEY]		= { .type = NLA_U32 },
518	[IFLA_VTI_LOCAL]	= { .len = FIELD_SIZEOF(struct iphdr, saddr) },
519	[IFLA_VTI_REMOTE]	= { .len = FIELD_SIZEOF(struct iphdr, daddr) },
520};
521
522static struct rtnl_link_ops vti_link_ops __read_mostly = {
523	.kind		= "vti",
524	.maxtype	= IFLA_VTI_MAX,
525	.policy		= vti_policy,
526	.priv_size	= sizeof(struct ip_tunnel),
527	.setup		= vti_tunnel_setup,
528	.validate	= vti_tunnel_validate,
529	.newlink	= vti_newlink,
530	.changelink	= vti_changelink,
531	.dellink        = ip_tunnel_dellink,
532	.get_size	= vti_get_size,
533	.fill_info	= vti_fill_info,
534};
535
536static int __init vti_init(void)
537{
538	const char *msg;
539	int err;
540
541	pr_info("IPv4 over IPsec tunneling driver\n");
542
543	msg = "tunnel device";
544	err = register_pernet_device(&vti_net_ops);
545	if (err < 0)
546		goto pernet_dev_failed;
547
548	msg = "tunnel protocols";
549	err = xfrm4_protocol_register(&vti_esp4_protocol, IPPROTO_ESP);
550	if (err < 0)
551		goto xfrm_proto_esp_failed;
552	err = xfrm4_protocol_register(&vti_ah4_protocol, IPPROTO_AH);
553	if (err < 0)
554		goto xfrm_proto_ah_failed;
555	err = xfrm4_protocol_register(&vti_ipcomp4_protocol, IPPROTO_COMP);
556	if (err < 0)
557		goto xfrm_proto_comp_failed;
558
559	msg = "netlink interface";
560	err = rtnl_link_register(&vti_link_ops);
561	if (err < 0)
562		goto rtnl_link_failed;
563
564	return err;
565
566rtnl_link_failed:
567	xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
568xfrm_proto_comp_failed:
569	xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
570xfrm_proto_ah_failed:
571	xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
572xfrm_proto_esp_failed:
573	unregister_pernet_device(&vti_net_ops);
574pernet_dev_failed:
575	pr_err("vti init: failed to register %s\n", msg);
576	return err;
577}
578
579static void __exit vti_fini(void)
580{
581	rtnl_link_unregister(&vti_link_ops);
582	xfrm4_protocol_deregister(&vti_ipcomp4_protocol, IPPROTO_COMP);
583	xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
584	xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
585	unregister_pernet_device(&vti_net_ops);
586}
587
588module_init(vti_init);
589module_exit(vti_fini);
590MODULE_LICENSE("GPL");
591MODULE_ALIAS_RTNL_LINK("vti");
592MODULE_ALIAS_NETDEV("ip_vti0");
593