net/ipv4/ipip.c

   1 /*
   2  *      Linux NET3:     IP/IP protocol decoder.
   3  *
   4  *      Authors:
   5  *              Sam Lantinga (slouken@cs.ucdavis.edu)  02/01/95
   6  *
   7  *      Fixes:
   8  *              Alan Cox        :       Merged and made usable non modular (its so tiny its silly as
   9  *                                      a module taking up 2 pages).
  10  *              Alan Cox        :       Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
  11  *                                      to keep ip_forward happy.
  12  *              Alan Cox        :       More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
  13  *              Kai Schulte     :       Fixed #defines for IP_FIREWALL->FIREWALL
  14  *              David Woodhouse :       Perform some basic ICMP handling.
  15  *                                      IPIP Routing without decapsulation.
  16  *              Carlos Picoto   :       GRE over IP support
  17  *              Alexey Kuznetsov:       Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
  18  *                                      I do not want to merge them together.
  19  *
  20  *      This program is free software; you can redistribute it and/or
  21  *      modify it under the terms of the GNU General Public License
  22  *      as published by the Free Software Foundation; either version
  23  *      2 of the License, or (at your option) any later version.
  24  *
  25  */
  26
  27 /* tunnel.c: an IP tunnel driver
  28
  29         The purpose of this driver is to provide an IP tunnel through
  30         which you can tunnel network traffic transparently across subnets.
  31
  32         This was written by looking at Nick Holloway's dummy driver
  33         Thanks for the great code!
  34
  35                 -Sam Lantinga   (slouken@cs.ucdavis.edu)  02/01/95
  36
  37         Minor tweaks:
  38                 Cleaned up the code a little and added some pre-1.3.0 tweaks.
  39                 dev->hard_header/hard_header_len changed to use no headers.
  40                 Comments/bracketing tweaked.
  41                 Made the tunnels use dev->name not tunnel: when error reporting.
  42                 Added tx_dropped stat
  43
  44                 -Alan Cox       (alan@lxorguk.ukuu.org.uk) 21 March 95
  45
  46         Reworked:
  47                 Changed to tunnel to destination gateway in addition to the
  48                         tunnel's pointopoint address
  49                 Almost completely rewritten
  50                 Note:  There is currently no firewall or ICMP handling done.
  51
  52                 -Sam Lantinga   (slouken@cs.ucdavis.edu) 02/13/96
  53
  54 */
  55
  56 /* Things I wish I had known when writing the tunnel driver:
  57
  58         When the tunnel_xmit() function is called, the skb contains the
  59         packet to be sent (plus a great deal of extra info), and dev
  60         contains the tunnel device that _we_ are.
  61
  62         When we are passed a packet, we are expected to fill in the
  63         source address with our source IP address.
  64
  65         What is the proper way to allocate, copy and free a buffer?
  66         After you allocate it, it is a "0 length" chunk of memory
  67         starting at zero.  If you want to add headers to the buffer
  68         later, you'll have to call "skb_reserve(skb, amount)" with
  69         the amount of memory you want reserved.  Then, you call
  70         "skb_put(skb, amount)" with the amount of space you want in
  71         the buffer.  skb_put() returns a pointer to the top (#0) of
  72         that buffer.  skb->len is set to the amount of space you have
  73         "allocated" with skb_put().  You can then write up to skb->len
  74         bytes to that buffer.  If you need more, you can call skb_put()
  75         again with the additional amount of space you need.  You can
  76         find out how much more space you can allocate by calling
  77         "skb_tailroom(skb)".
  78         Now, to add header space, call "skb_push(skb, header_len)".
  79         This creates space at the beginning of the buffer and returns
  80         a pointer to this new space.  If later you need to strip a
  81         header from a buffer, call "skb_pull(skb, header_len)".
  82         skb_headroom() will return how much space is left at the top
  83         of the buffer (before the main data).  Remember, this headroom
  84         space must be reserved before the skb_put() function is called.
  85         */
  86
  87 /*
  88    This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c
  89
  90    For comments look at net/ipv4/ip_gre.c --ANK
  91  */
  92
  93
  94 #include <linux/capability.h>
  95 #include <linux/module.h>
  96 #include <linux/types.h>
  97 #include <linux/kernel.h>
  98 #include <linux/slab.h>
  99 #include <asm/uaccess.h>
 100 #include <linux/skbuff.h>
 101 #include <linux/netdevice.h>
 102 #include <linux/in.h>
 103 #include <linux/tcp.h>
 104 #include <linux/udp.h>
 105 #include <linux/if_arp.h>
 106 #include <linux/mroute.h>
 107 #include <linux/init.h>
 108 #include <linux/netfilter_ipv4.h>
 109 #include <linux/if_ether.h>
 110
 111 #include <net/sock.h>
 112 #include <net/ip.h>
 113 #include <net/icmp.h>
 114 #include <net/ipip.h>
 115 #include <net/inet_ecn.h>
 116 #include <net/xfrm.h>
 117 #include <net/net_namespace.h>
 118 #include <net/netns/generic.h>
 119
 120 #define HASH_SIZE  16
 121 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 122
 123 static int ipip_net_id __read_mostly;
 124 struct ipip_net {
 125         struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
 126         struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
 127         struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
 128         struct ip_tunnel __rcu *tunnels_wc[1];
 129         struct ip_tunnel __rcu **tunnels[4];
 130
 131         struct net_device *fb_tunnel_dev;
 132 };
 133
 134 static int ipip_tunnel_init(struct net_device *dev);
 135 static void ipip_tunnel_setup(struct net_device *dev);
 136 static void ipip_dev_free(struct net_device *dev);
 137
 138 /*
 139  * Locking : hash tables are protected by RCU and RTNL
 140  */
 141
 142 #define for_each_ip_tunnel_rcu(start) \
 143         for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 144
 145 /* often modified stats are per cpu, other are shared (netdev->stats) */
 146 struct pcpu_tstats {
 147         unsigned long   rx_packets;
 148         unsigned long   rx_bytes;
 149         unsigned long   tx_packets;
 150         unsigned long   tx_bytes;
 151 };
 152
 153 static struct net_device_stats *ipip_get_stats(struct net_device *dev)
 154 {
 155         struct pcpu_tstats sum = { 0 };
 156         int i;
 157
 158         for_each_possible_cpu(i) {
 159                 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
 160
 161                 sum.rx_packets += tstats->rx_packets;
 162                 sum.rx_bytes   += tstats->rx_bytes;
 163                 sum.tx_packets += tstats->tx_packets;
 164                 sum.tx_bytes   += tstats->tx_bytes;
 165         }
 166         dev->stats.rx_packets = sum.rx_packets;
 167         dev->stats.rx_bytes   = sum.rx_bytes;
 168         dev->stats.tx_packets = sum.tx_packets;
 169         dev->stats.tx_bytes   = sum.tx_bytes;
 170         return &dev->stats;
 171 }
 172
 173 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
 174                 __be32 remote, __be32 local)
 175 {
 176         unsigned int h0 = HASH(remote);
 177         unsigned int h1 = HASH(local);
 178         struct ip_tunnel *t;
 179         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 180
 181         for_each_ip_tunnel_rcu(ipn->tunnels_r_l[h0 ^ h1])
 182                 if (local == t->parms.iph.saddr &&
 183                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
 184                         return t;
 185
 186         for_each_ip_tunnel_rcu(ipn->tunnels_r[h0])
 187                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
 188                         return t;
 189
 190         for_each_ip_tunnel_rcu(ipn->tunnels_l[h1])
 191                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
 192                         return t;
 193
 194         t = rcu_dereference(ipn->tunnels_wc[0]);
 195         if (t && (t->dev->flags&IFF_UP))
 196                 return t;
 197         return NULL;
 198 }
 199
 200 static struct ip_tunnel __rcu **__ipip_bucket(struct ipip_net *ipn,
 201                 struct ip_tunnel_parm *parms)
 202 {
 203         __be32 remote = parms->iph.daddr;
 204         __be32 local = parms->iph.saddr;
 205         unsigned int h = 0;
 206         int prio = 0;
 207
 208         if (remote) {
 209                 prio |= 2;
 210                 h ^= HASH(remote);
 211         }
 212         if (local) {
 213                 prio |= 1;
 214                 h ^= HASH(local);
 215         }
 216         return &ipn->tunnels[prio][h];
 217 }
 218
 219 static inline struct ip_tunnel __rcu **ipip_bucket(struct ipip_net *ipn,
 220                 struct ip_tunnel *t)
 221 {
 222         return __ipip_bucket(ipn, &t->parms);
 223 }
 224
 225 static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 226 {
 227         struct ip_tunnel __rcu **tp;
 228         struct ip_tunnel *iter;
 229
 230         for (tp = ipip_bucket(ipn, t);
 231              (iter = rtnl_dereference(*tp)) != NULL;
 232              tp = &iter->next) {
 233                 if (t == iter) {
 234                         rcu_assign_pointer(*tp, t->next);
 235                         break;
 236                 }
 237         }
 238 }
 239
 240 static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 241 {
 242         struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
 243
 244         rcu_assign_pointer(t->next, rtnl_dereference(*tp));
 245         rcu_assign_pointer(*tp, t);
 246 }
 247
 248 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
 249                 struct ip_tunnel_parm *parms, int create)
 250 {
 251         __be32 remote = parms->iph.daddr;
 252         __be32 local = parms->iph.saddr;
 253         struct ip_tunnel *t, *nt;
 254         struct ip_tunnel __rcu **tp;
 255         struct net_device *dev;
 256         char name[IFNAMSIZ];
 257         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 258
 259         for (tp = __ipip_bucket(ipn, parms);
 260                  (t = rtnl_dereference(*tp)) != NULL;
 261                  tp = &t->next) {
 262                 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
 263                         return t;
 264         }
 265         if (!create)
 266                 return NULL;
 267
 268         if (parms->name[0])
 269                 strlcpy(name, parms->name, IFNAMSIZ);
 270         else
 271                 strcpy(name, "tunl%d");
 272
 273         dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
 274         if (dev == NULL)
 275                 return NULL;
 276
 277         dev_net_set(dev, net);
 278
 279         if (strchr(name, '%')) {
 280                 if (dev_alloc_name(dev, name) < 0)
 281                         goto failed_free;
 282         }
 283
 284         nt = netdev_priv(dev);
 285         nt->parms = *parms;
 286
 287         if (ipip_tunnel_init(dev) < 0)
 288                 goto failed_free;
 289
 290         if (register_netdevice(dev) < 0)
 291                 goto failed_free;
 292
 293         dev_hold(dev);
 294         ipip_tunnel_link(ipn, nt);
 295         return nt;
 296
 297 failed_free:
 298         ipip_dev_free(dev);
 299         return NULL;
 300 }
 301
 302 /* called with RTNL */
 303 static void ipip_tunnel_uninit(struct net_device *dev)
 304 {
 305         struct net *net = dev_net(dev);
 306         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 307
 308         if (dev == ipn->fb_tunnel_dev)
 309                 rcu_assign_pointer(ipn->tunnels_wc[0], NULL);
 310         else
 311                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
 312         dev_put(dev);
 313 }
 314
 315 static int ipip_err(struct sk_buff *skb, u32 info)
 316 {
 317
 318 /* All the routers (except for Linux) return only
 319    8 bytes of packet payload. It means, that precise relaying of
 320    ICMP in the real Internet is absolutely infeasible.
 321  */
 322         struct iphdr *iph = (struct iphdr *)skb->data;
 323         const int type = icmp_hdr(skb)->type;
 324         const int code = icmp_hdr(skb)->code;
 325         struct ip_tunnel *t;
 326         int err;
 327
 328         switch (type) {
 329         default:
 330         case ICMP_PARAMETERPROB:
 331                 return 0;
 332
 333         case ICMP_DEST_UNREACH:
 334                 switch (code) {
 335                 case ICMP_SR_FAILED:
 336                 case ICMP_PORT_UNREACH:
 337                         /* Impossible event. */
 338                         return 0;
 339                 case ICMP_FRAG_NEEDED:
 340                         /* Soft state for pmtu is maintained by IP core. */
 341                         return 0;
 342                 default:
 343                         /* All others are translated to HOST_UNREACH.
 344                            rfc2003 contains "deep thoughts" about NET_UNREACH,
 345                            I believe they are just ether pollution. --ANK
 346                          */
 347                         break;
 348                 }
 349                 break;
 350         case ICMP_TIME_EXCEEDED:
 351                 if (code != ICMP_EXC_TTL)
 352                         return 0;
 353                 break;
 354         }
 355
 356         err = -ENOENT;
 357
 358         rcu_read_lock();
 359         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
 360         if (t == NULL || t->parms.iph.daddr == 0)
 361                 goto out;
 362
 363         err = 0;
 364         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 365                 goto out;
 366
 367         if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
 368                 t->err_count++;
 369         else
 370                 t->err_count = 1;
 371         t->err_time = jiffies;
 372 out:
 373         rcu_read_unlock();
 374         return err;
 375 }
 376
 377 static inline void ipip_ecn_decapsulate(const struct iphdr *outer_iph,
 378                                         struct sk_buff *skb)
 379 {
 380         struct iphdr *inner_iph = ip_hdr(skb);
 381
 382         if (INET_ECN_is_ce(outer_iph->tos))
 383                 IP_ECN_set_ce(inner_iph);
 384 }
 385
 386 static int ipip_rcv(struct sk_buff *skb)
 387 {
 388         struct ip_tunnel *tunnel;
 389         const struct iphdr *iph = ip_hdr(skb);
 390
 391         rcu_read_lock();
 392         tunnel = ipip_tunnel_lookup(dev_net(skb->dev), iph->saddr, iph->daddr);
 393         if (tunnel != NULL) {
 394                 struct pcpu_tstats *tstats;
 395
 396                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 397                         rcu_read_unlock();
 398                         kfree_skb(skb);
 399                         return 0;
 400                 }
 401
 402                 secpath_reset(skb);
 403
 404                 skb->mac_header = skb->network_header;
 405                 skb_reset_network_header(skb);
 406                 skb->protocol = htons(ETH_P_IP);
 407                 skb->pkt_type = PACKET_HOST;
 408
 409                 tstats = this_cpu_ptr(tunnel->dev->tstats);
 410                 tstats->rx_packets++;
 411                 tstats->rx_bytes += skb->len;
 412
 413                 __skb_tunnel_rx(skb, tunnel->dev);
 414
 415                 ipip_ecn_decapsulate(iph, skb);
 416
 417                 netif_rx(skb);
 418
 419                 rcu_read_unlock();
 420                 return 0;
 421         }
 422         rcu_read_unlock();
 423
 424         return -1;
 425 }
 426
 427 /*
 428  *      This function assumes it is being called from dev_queue_xmit()
 429  *      and that skb is filled properly by that function.
 430  */
 431
 432 static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 433 {
 434         struct ip_tunnel *tunnel = netdev_priv(dev);
 435         struct pcpu_tstats *tstats;
 436         struct iphdr  *tiph = &tunnel->parms.iph;
 437         u8     tos = tunnel->parms.iph.tos;
 438         __be16 df = tiph->frag_off;
 439         struct rtable *rt;                      /* Route to the other host */
 440         struct net_device *tdev;                /* Device to other host */
 441         struct iphdr  *old_iph = ip_hdr(skb);
 442         struct iphdr  *iph;                     /* Our new IP header */
 443         unsigned int max_headroom;              /* The extra header space needed */
 444         __be32 dst = tiph->daddr;
 445         int    mtu;
 446
 447         if (skb->protocol != htons(ETH_P_IP))
 448                 goto tx_error;
 449
 450         if (tos & 1)
 451                 tos = old_iph->tos;
 452
 453         if (!dst) {
 454                 /* NBMA tunnel */
 455                 if ((rt = skb_rtable(skb)) == NULL) {
 456                         dev->stats.tx_fifo_errors++;
 457                         goto tx_error;
 458                 }
 459                 if ((dst = rt->rt_gateway) == 0)
 460                         goto tx_error_icmp;
 461         }
 462
 463         {
 464                 struct flowi fl = {
 465                         .oif = tunnel->parms.link,
 466                         .fl4_dst = dst,
 467                         .fl4_src= tiph->saddr,
 468                         .fl4_tos = RT_TOS(tos),
 469                         .proto = IPPROTO_IPIP
 470                 };
 471
 472                 rt = ip_route_output_key(dev_net(dev), &fl);
 473                 if (IS_ERR(rt)) {
 474                         dev->stats.tx_carrier_errors++;
 475                         goto tx_error_icmp;
 476                 }
 477         }
 478         tdev = rt->dst.dev;
 479
 480         if (tdev == dev) {
 481                 ip_rt_put(rt);
 482                 dev->stats.collisions++;
 483                 goto tx_error;
 484         }
 485
 486         df |= old_iph->frag_off & htons(IP_DF);
 487
 488         if (df) {
 489                 mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr);
 490
 491                 if (mtu < 68) {
 492                         dev->stats.collisions++;
 493                         ip_rt_put(rt);
 494                         goto tx_error;
 495                 }
 496
 497                 if (skb_dst(skb))
 498                         skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
 499
 500                 if ((old_iph->frag_off & htons(IP_DF)) &&
 501                     mtu < ntohs(old_iph->tot_len)) {
 502                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
 503                                   htonl(mtu));
 504                         ip_rt_put(rt);
 505                         goto tx_error;
 506                 }
 507         }
 508
 509         if (tunnel->err_count > 0) {
 510                 if (time_before(jiffies,
 511                                 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
 512                         tunnel->err_count--;
 513                         dst_link_failure(skb);
 514                 } else
 515                         tunnel->err_count = 0;
 516         }
 517
 518         /*
 519          * Okay, now see if we can stuff it in the buffer as-is.
 520          */
 521         max_headroom = (LL_RESERVED_SPACE(tdev)+sizeof(struct iphdr));
 522
 523         if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
 524             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
 525                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
 526                 if (!new_skb) {
 527                         ip_rt_put(rt);
 528                         dev->stats.tx_dropped++;
 529                         dev_kfree_skb(skb);
 530                         return NETDEV_TX_OK;
 531                 }
 532                 if (skb->sk)
 533                         skb_set_owner_w(new_skb, skb->sk);
 534                 dev_kfree_skb(skb);
 535                 skb = new_skb;
 536                 old_iph = ip_hdr(skb);
 537         }
 538
 539         skb->transport_header = skb->network_header;
 540         skb_push(skb, sizeof(struct iphdr));
 541         skb_reset_network_header(skb);
 542         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 543         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
 544                               IPSKB_REROUTED);
 545         skb_dst_drop(skb);
 546         skb_dst_set(skb, &rt->dst);
 547
 548         /*
 549          *      Push down and install the IPIP header.
 550          */
 551
 552         iph                     =       ip_hdr(skb);
 553         iph->version            =       4;
 554         iph->ihl                =       sizeof(struct iphdr)>>2;
 555         iph->frag_off           =       df;
 556         iph->protocol           =       IPPROTO_IPIP;
 557         iph->tos                =       INET_ECN_encapsulate(tos, old_iph->tos);
 558         iph->daddr              =       rt->rt_dst;
 559         iph->saddr              =       rt->rt_src;
 560
 561         if ((iph->ttl = tiph->ttl) == 0)
 562                 iph->ttl        =       old_iph->ttl;
 563
 564         nf_reset(skb);
 565         tstats = this_cpu_ptr(dev->tstats);
 566         __IPTUNNEL_XMIT(tstats, &dev->stats);
 567         return NETDEV_TX_OK;
 568
 569 tx_error_icmp:
 570         dst_link_failure(skb);
 571 tx_error:
 572         dev->stats.tx_errors++;
 573         dev_kfree_skb(skb);
 574         return NETDEV_TX_OK;
 575 }
 576
 577 static void ipip_tunnel_bind_dev(struct net_device *dev)
 578 {
 579         struct net_device *tdev = NULL;
 580         struct ip_tunnel *tunnel;
 581         struct iphdr *iph;
 582
 583         tunnel = netdev_priv(dev);
 584         iph = &tunnel->parms.iph;
 585
 586         if (iph->daddr) {
 587                 struct flowi fl = {
 588                         .oif = tunnel->parms.link,
 589                         .fl4_dst = iph->daddr,
 590                         .fl4_src = iph->saddr,
 591                         .fl4_tos = RT_TOS(iph->tos),
 592                         .proto = IPPROTO_IPIP
 593                 };
 594                 struct rtable *rt = ip_route_output_key(dev_net(dev), &fl);
 595
 596                 if (!IS_ERR(rt)) {
 597                         tdev = rt->dst.dev;
 598                         ip_rt_put(rt);
 599                 }
 600                 dev->flags |= IFF_POINTOPOINT;
 601         }
 602
 603         if (!tdev && tunnel->parms.link)
 604                 tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
 605
 606         if (tdev) {
 607                 dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
 608                 dev->mtu = tdev->mtu - sizeof(struct iphdr);
 609         }
 610         dev->iflink = tunnel->parms.link;
 611 }
 612
 613 static int
 614 ipip_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
 615 {
 616         int err = 0;
 617         struct ip_tunnel_parm p;
 618         struct ip_tunnel *t;
 619         struct net *net = dev_net(dev);
 620         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 621
 622         switch (cmd) {
 623         case SIOCGETTUNNEL:
 624                 t = NULL;
 625                 if (dev == ipn->fb_tunnel_dev) {
 626                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
 627                                 err = -EFAULT;
 628                                 break;
 629                         }
 630                         t = ipip_tunnel_locate(net, &p, 0);
 631                 }
 632                 if (t == NULL)
 633                         t = netdev_priv(dev);
 634                 memcpy(&p, &t->parms, sizeof(p));
 635                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
 636                         err = -EFAULT;
 637                 break;
 638
 639         case SIOCADDTUNNEL:
 640         case SIOCCHGTUNNEL:
 641                 err = -EPERM;
 642                 if (!capable(CAP_NET_ADMIN))
 643                         goto done;
 644
 645                 err = -EFAULT;
 646                 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
 647                         goto done;
 648
 649                 err = -EINVAL;
 650                 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
 651                     p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
 652                         goto done;
 653                 if (p.iph.ttl)
 654                         p.iph.frag_off |= htons(IP_DF);
 655
 656                 t = ipip_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
 657
 658                 if (dev != ipn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
 659                         if (t != NULL) {
 660                                 if (t->dev != dev) {
 661                                         err = -EEXIST;
 662                                         break;
 663                                 }
 664                         } else {
 665                                 if (((dev->flags&IFF_POINTOPOINT) && !p.iph.daddr) ||
 666                                     (!(dev->flags&IFF_POINTOPOINT) && p.iph.daddr)) {
 667                                         err = -EINVAL;
 668                                         break;
 669                                 }
 670                                 t = netdev_priv(dev);
 671                                 ipip_tunnel_unlink(ipn, t);
 672                                 synchronize_net();
 673                                 t->parms.iph.saddr = p.iph.saddr;
 674                                 t->parms.iph.daddr = p.iph.daddr;
 675                                 memcpy(dev->dev_addr, &p.iph.saddr, 4);
 676                                 memcpy(dev->broadcast, &p.iph.daddr, 4);
 677                                 ipip_tunnel_link(ipn, t);
 678                                 netdev_state_change(dev);
 679                         }
 680                 }
 681
 682                 if (t) {
 683                         err = 0;
 684                         if (cmd == SIOCCHGTUNNEL) {
 685                                 t->parms.iph.ttl = p.iph.ttl;
 686                                 t->parms.iph.tos = p.iph.tos;
 687                                 t->parms.iph.frag_off = p.iph.frag_off;
 688                                 if (t->parms.link != p.link) {
 689                                         t->parms.link = p.link;
 690                                         ipip_tunnel_bind_dev(dev);
 691                                         netdev_state_change(dev);
 692                                 }
 693                         }
 694                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
 695                                 err = -EFAULT;
 696                 } else
 697                         err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
 698                 break;
 699
 700         case SIOCDELTUNNEL:
 701                 err = -EPERM;
 702                 if (!capable(CAP_NET_ADMIN))
 703                         goto done;
 704
 705                 if (dev == ipn->fb_tunnel_dev) {
 706                         err = -EFAULT;
 707                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
 708                                 goto done;
 709                         err = -ENOENT;
 710                         if ((t = ipip_tunnel_locate(net, &p, 0)) == NULL)
 711                                 goto done;
 712                         err = -EPERM;
 713                         if (t->dev == ipn->fb_tunnel_dev)
 714                                 goto done;
 715                         dev = t->dev;
 716                 }
 717                 unregister_netdevice(dev);
 718                 err = 0;
 719                 break;
 720
 721         default:
 722                 err = -EINVAL;
 723         }
 724
 725 done:
 726         return err;
 727 }
 728
 729 static int ipip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 730 {
 731         if (new_mtu < 68 || new_mtu > 0xFFF8 - sizeof(struct iphdr))
 732                 return -EINVAL;
 733         dev->mtu = new_mtu;
 734         return 0;
 735 }
 736
 737 static const struct net_device_ops ipip_netdev_ops = {
 738         .ndo_uninit     = ipip_tunnel_uninit,
 739         .ndo_start_xmit = ipip_tunnel_xmit,
 740         .ndo_do_ioctl   = ipip_tunnel_ioctl,
 741         .ndo_change_mtu = ipip_tunnel_change_mtu,
 742         .ndo_get_stats  = ipip_get_stats,
 743 };
 744
 745 static void ipip_dev_free(struct net_device *dev)
 746 {
 747         free_percpu(dev->tstats);
 748         free_netdev(dev);
 749 }
 750
 751 static void ipip_tunnel_setup(struct net_device *dev)
 752 {
 753         dev->netdev_ops         = &ipip_netdev_ops;
 754         dev->destructor         = ipip_dev_free;
 755
 756         dev->type               = ARPHRD_TUNNEL;
 757         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
 758         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr);
 759         dev->flags              = IFF_NOARP;
 760         dev->iflink             = 0;
 761         dev->addr_len           = 4;
 762         dev->features           |= NETIF_F_NETNS_LOCAL;
 763         dev->features           |= NETIF_F_LLTX;
 764         dev->priv_flags         &= ~IFF_XMIT_DST_RELEASE;
 765 }
 766
 767 static int ipip_tunnel_init(struct net_device *dev)
 768 {
 769         struct ip_tunnel *tunnel = netdev_priv(dev);
 770
 771         tunnel->dev = dev;
 772         strcpy(tunnel->parms.name, dev->name);
 773
 774         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
 775         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
 776
 777         ipip_tunnel_bind_dev(dev);
 778
 779         dev->tstats = alloc_percpu(struct pcpu_tstats);
 780         if (!dev->tstats)
 781                 return -ENOMEM;
 782
 783         return 0;
 784 }
 785
 786 static int __net_init ipip_fb_tunnel_init(struct net_device *dev)
 787 {
 788         struct ip_tunnel *tunnel = netdev_priv(dev);
 789         struct iphdr *iph = &tunnel->parms.iph;
 790         struct ipip_net *ipn = net_generic(dev_net(dev), ipip_net_id);
 791
 792         tunnel->dev = dev;
 793         strcpy(tunnel->parms.name, dev->name);
 794
 795         iph->version            = 4;
 796         iph->protocol           = IPPROTO_IPIP;
 797         iph->ihl                = 5;
 798
 799         dev->tstats = alloc_percpu(struct pcpu_tstats);
 800         if (!dev->tstats)
 801                 return -ENOMEM;
 802
 803         dev_hold(dev);
 804         rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
 805         return 0;
 806 }
 807
 808 static struct xfrm_tunnel ipip_handler __read_mostly = {
 809         .handler        =       ipip_rcv,
 810         .err_handler    =       ipip_err,
 811         .priority       =       1,
 812 };
 813
 814 static const char banner[] __initconst =
 815         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 816
 817 static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
 818 {
 819         int prio;
 820
 821         for (prio = 1; prio < 4; prio++) {
 822                 int h;
 823                 for (h = 0; h < HASH_SIZE; h++) {
 824                         struct ip_tunnel *t;
 825
 826                         t = rtnl_dereference(ipn->tunnels[prio][h]);
 827                         while (t != NULL) {
 828                                 unregister_netdevice_queue(t->dev, head);
 829                                 t = rtnl_dereference(t->next);
 830                         }
 831                 }
 832         }
 833 }
 834
 835 static int __net_init ipip_init_net(struct net *net)
 836 {
 837         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 838         int err;
 839
 840         ipn->tunnels[0] = ipn->tunnels_wc;
 841         ipn->tunnels[1] = ipn->tunnels_l;
 842         ipn->tunnels[2] = ipn->tunnels_r;
 843         ipn->tunnels[3] = ipn->tunnels_r_l;
 844
 845         ipn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel),
 846                                            "tunl0",
 847                                            ipip_tunnel_setup);
 848         if (!ipn->fb_tunnel_dev) {
 849                 err = -ENOMEM;
 850                 goto err_alloc_dev;
 851         }
 852         dev_net_set(ipn->fb_tunnel_dev, net);
 853
 854         err = ipip_fb_tunnel_init(ipn->fb_tunnel_dev);
 855         if (err)
 856                 goto err_reg_dev;
 857
 858         if ((err = register_netdev(ipn->fb_tunnel_dev)))
 859                 goto err_reg_dev;
 860
 861         return 0;
 862
 863 err_reg_dev:
 864         ipip_dev_free(ipn->fb_tunnel_dev);
 865 err_alloc_dev:
 866         /* nothing */
 867         return err;
 868 }
 869
 870 static void __net_exit ipip_exit_net(struct net *net)
 871 {
 872         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 873         LIST_HEAD(list);
 874
 875         rtnl_lock();
 876         ipip_destroy_tunnels(ipn, &list);
 877         unregister_netdevice_queue(ipn->fb_tunnel_dev, &list);
 878         unregister_netdevice_many(&list);
 879         rtnl_unlock();
 880 }
 881
 882 static struct pernet_operations ipip_net_ops = {
 883         .init = ipip_init_net,
 884         .exit = ipip_exit_net,
 885         .id   = &ipip_net_id,
 886         .size = sizeof(struct ipip_net),
 887 };
 888
 889 static int __init ipip_init(void)
 890 {
 891         int err;
 892
 893         printk(banner);
 894
 895         err = register_pernet_device(&ipip_net_ops);
 896         if (err < 0)
 897                 return err;
 898         err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
 899         if (err < 0) {
 900                 unregister_pernet_device(&ipip_net_ops);
 901                 printk(KERN_INFO "ipip init: can't register tunnel\n");
 902         }
 903         return err;
 904 }
 905
 906 static void __exit ipip_fini(void)
 907 {
 908         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
 909                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
 910
 911         unregister_pernet_device(&ipip_net_ops);
 912 }
 913
 914 module_init(ipip_init);
 915 module_exit(ipip_fini);
 916 MODULE_LICENSE("GPL");
 917 MODULE_ALIAS("tunl0");