2 * Linux NET3: IP/IP protocol decoder.
5 * Sam Lantinga (slouken@cs.ucdavis.edu) 02/01/95
8 * Alan Cox : Merged and made usable non modular (its so tiny its silly as
9 * a module taking up 2 pages).
10 * Alan Cox : Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
11 * to keep ip_forward happy.
12 * Alan Cox : More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
13 * Kai Schulte : Fixed #defines for IP_FIREWALL->FIREWALL
14 * David Woodhouse : Perform some basic ICMP handling.
15 * IPIP Routing without decapsulation.
16 * Carlos Picoto : GRE over IP support
17 * Alexey Kuznetsov: Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
18 * I do not want to merge them together.
20 * This program is free software; you can redistribute it and/or
21 * modify it under the terms of the GNU General Public License
22 * as published by the Free Software Foundation; either version
23 * 2 of the License, or (at your option) any later version.
27 /* tunnel.c: an IP tunnel driver
29 The purpose of this driver is to provide an IP tunnel through
30 which you can tunnel network traffic transparently across subnets.
32 This was written by looking at Nick Holloway's dummy driver
33 Thanks for the great code!
35 -Sam Lantinga (slouken@cs.ucdavis.edu) 02/01/95
38 Cleaned up the code a little and added some pre-1.3.0 tweaks.
39 dev->hard_header/hard_header_len changed to use no headers.
40 Comments/bracketing tweaked.
41 Made the tunnels use dev->name not tunnel: when error reporting.
44 -Alan Cox (alan@lxorguk.ukuu.org.uk) 21 March 95
47 Changed to tunnel to destination gateway in addition to the
48 tunnel's pointopoint address
49 Almost completely rewritten
50 Note: There is currently no firewall or ICMP handling done.
52 -Sam Lantinga (slouken@cs.ucdavis.edu) 02/13/96
56 /* Things I wish I had known when writing the tunnel driver:
58 When the tunnel_xmit() function is called, the skb contains the
59 packet to be sent (plus a great deal of extra info), and dev
60 contains the tunnel device that _we_ are.
62 When we are passed a packet, we are expected to fill in the
63 source address with our source IP address.
65 What is the proper way to allocate, copy and free a buffer?
66 After you allocate it, it is a "0 length" chunk of memory
67 starting at zero. If you want to add headers to the buffer
68 later, you'll have to call "skb_reserve(skb, amount)" with
69 the amount of memory you want reserved. Then, you call
70 "skb_put(skb, amount)" with the amount of space you want in
71 the buffer. skb_put() returns a pointer to the top (#0) of
72 that buffer. skb->len is set to the amount of space you have
73 "allocated" with skb_put(). You can then write up to skb->len
74 bytes to that buffer. If you need more, you can call skb_put()
75 again with the additional amount of space you need. You can
76 find out how much more space you can allocate by calling
78 Now, to add header space, call "skb_push(skb, header_len)".
79 This creates space at the beginning of the buffer and returns
80 a pointer to this new space. If later you need to strip a
81 header from a buffer, call "skb_pull(skb, header_len)".
82 skb_headroom() will return how much space is left at the top
83 of the buffer (before the main data). Remember, this headroom
84 space must be reserved before the skb_put() function is called.
88 This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c
90 For comments look at net/ipv4/ip_gre.c --ANK
94 #include <linux/capability.h>
95 #include <linux/module.h>
96 #include <linux/types.h>
97 #include <linux/kernel.h>
98 #include <linux/slab.h>
99 #include <asm/uaccess.h>
100 #include <linux/skbuff.h>
101 #include <linux/netdevice.h>
102 #include <linux/in.h>
103 #include <linux/tcp.h>
104 #include <linux/udp.h>
105 #include <linux/if_arp.h>
106 #include <linux/mroute.h>
107 #include <linux/init.h>
108 #include <linux/netfilter_ipv4.h>
109 #include <linux/if_ether.h>
111 #include <net/sock.h>
113 #include <net/icmp.h>
114 #include <net/ipip.h>
115 #include <net/inet_ecn.h>
116 #include <net/xfrm.h>
117 #include <net/net_namespace.h>
118 #include <net/netns/generic.h>
121 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
123 static int ipip_net_id __read_mostly;
125 struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
126 struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
127 struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
128 struct ip_tunnel __rcu *tunnels_wc[1];
129 struct ip_tunnel __rcu **tunnels[4];
131 struct net_device *fb_tunnel_dev;
134 static int ipip_tunnel_init(struct net_device *dev);
135 static void ipip_tunnel_setup(struct net_device *dev);
136 static void ipip_dev_free(struct net_device *dev);
139 * Locking : hash tables are protected by RCU and RTNL
142 #define for_each_ip_tunnel_rcu(start) \
143 for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
145 /* often modified stats are per cpu, other are shared (netdev->stats) */
147 unsigned long rx_packets;
148 unsigned long rx_bytes;
149 unsigned long tx_packets;
150 unsigned long tx_bytes;
153 static struct net_device_stats *ipip_get_stats(struct net_device *dev)
155 struct pcpu_tstats sum = { 0 };
158 for_each_possible_cpu(i) {
159 const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
161 sum.rx_packets += tstats->rx_packets;
162 sum.rx_bytes += tstats->rx_bytes;
163 sum.tx_packets += tstats->tx_packets;
164 sum.tx_bytes += tstats->tx_bytes;
166 dev->stats.rx_packets = sum.rx_packets;
167 dev->stats.rx_bytes = sum.rx_bytes;
168 dev->stats.tx_packets = sum.tx_packets;
169 dev->stats.tx_bytes = sum.tx_bytes;
173 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
174 __be32 remote, __be32 local)
176 unsigned int h0 = HASH(remote);
177 unsigned int h1 = HASH(local);
179 struct ipip_net *ipn = net_generic(net, ipip_net_id);
181 for_each_ip_tunnel_rcu(ipn->tunnels_r_l[h0 ^ h1])
182 if (local == t->parms.iph.saddr &&
183 remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
186 for_each_ip_tunnel_rcu(ipn->tunnels_r[h0])
187 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
190 for_each_ip_tunnel_rcu(ipn->tunnels_l[h1])
191 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
194 t = rcu_dereference(ipn->tunnels_wc[0]);
195 if (t && (t->dev->flags&IFF_UP))
200 static struct ip_tunnel __rcu **__ipip_bucket(struct ipip_net *ipn,
201 struct ip_tunnel_parm *parms)
203 __be32 remote = parms->iph.daddr;
204 __be32 local = parms->iph.saddr;
216 return &ipn->tunnels[prio][h];
219 static inline struct ip_tunnel __rcu **ipip_bucket(struct ipip_net *ipn,
222 return __ipip_bucket(ipn, &t->parms);
225 static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
227 struct ip_tunnel __rcu **tp;
228 struct ip_tunnel *iter;
230 for (tp = ipip_bucket(ipn, t);
231 (iter = rtnl_dereference(*tp)) != NULL;
234 rcu_assign_pointer(*tp, t->next);
240 static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
242 struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
244 rcu_assign_pointer(t->next, rtnl_dereference(*tp));
245 rcu_assign_pointer(*tp, t);
248 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
249 struct ip_tunnel_parm *parms, int create)
251 __be32 remote = parms->iph.daddr;
252 __be32 local = parms->iph.saddr;
253 struct ip_tunnel *t, *nt;
254 struct ip_tunnel __rcu **tp;
255 struct net_device *dev;
257 struct ipip_net *ipn = net_generic(net, ipip_net_id);
259 for (tp = __ipip_bucket(ipn, parms);
260 (t = rtnl_dereference(*tp)) != NULL;
262 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
269 strlcpy(name, parms->name, IFNAMSIZ);
271 strcpy(name, "tunl%d");
273 dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
277 dev_net_set(dev, net);
279 if (strchr(name, '%')) {
280 if (dev_alloc_name(dev, name) < 0)
284 nt = netdev_priv(dev);
287 if (ipip_tunnel_init(dev) < 0)
290 if (register_netdevice(dev) < 0)
294 ipip_tunnel_link(ipn, nt);
302 /* called with RTNL */
303 static void ipip_tunnel_uninit(struct net_device *dev)
305 struct net *net = dev_net(dev);
306 struct ipip_net *ipn = net_generic(net, ipip_net_id);
308 if (dev == ipn->fb_tunnel_dev)
309 rcu_assign_pointer(ipn->tunnels_wc[0], NULL);
311 ipip_tunnel_unlink(ipn, netdev_priv(dev));
315 static int ipip_err(struct sk_buff *skb, u32 info)
318 /* All the routers (except for Linux) return only
319 8 bytes of packet payload. It means, that precise relaying of
320 ICMP in the real Internet is absolutely infeasible.
322 struct iphdr *iph = (struct iphdr *)skb->data;
323 const int type = icmp_hdr(skb)->type;
324 const int code = icmp_hdr(skb)->code;
330 case ICMP_PARAMETERPROB:
333 case ICMP_DEST_UNREACH:
336 case ICMP_PORT_UNREACH:
337 /* Impossible event. */
339 case ICMP_FRAG_NEEDED:
340 /* Soft state for pmtu is maintained by IP core. */
343 /* All others are translated to HOST_UNREACH.
344 rfc2003 contains "deep thoughts" about NET_UNREACH,
345 I believe they are just ether pollution. --ANK
350 case ICMP_TIME_EXCEEDED:
351 if (code != ICMP_EXC_TTL)
359 t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
360 if (t == NULL || t->parms.iph.daddr == 0)
364 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
367 if (time_before(jiffies, t->err_time + IPTUNNEL_ERR_TIMEO))
371 t->err_time = jiffies;
377 static inline void ipip_ecn_decapsulate(const struct iphdr *outer_iph,
380 struct iphdr *inner_iph = ip_hdr(skb);
382 if (INET_ECN_is_ce(outer_iph->tos))
383 IP_ECN_set_ce(inner_iph);
386 static int ipip_rcv(struct sk_buff *skb)
388 struct ip_tunnel *tunnel;
389 const struct iphdr *iph = ip_hdr(skb);
392 tunnel = ipip_tunnel_lookup(dev_net(skb->dev), iph->saddr, iph->daddr);
393 if (tunnel != NULL) {
394 struct pcpu_tstats *tstats;
396 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
404 skb->mac_header = skb->network_header;
405 skb_reset_network_header(skb);
406 skb->protocol = htons(ETH_P_IP);
407 skb->pkt_type = PACKET_HOST;
409 tstats = this_cpu_ptr(tunnel->dev->tstats);
410 tstats->rx_packets++;
411 tstats->rx_bytes += skb->len;
413 __skb_tunnel_rx(skb, tunnel->dev);
415 ipip_ecn_decapsulate(iph, skb);
417 if (netif_rx(skb) == NET_RX_DROP)
418 tunnel->dev->stats.rx_dropped++;
429 * This function assumes it is being called from dev_queue_xmit()
430 * and that skb is filled properly by that function.
433 static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
435 struct ip_tunnel *tunnel = netdev_priv(dev);
436 struct pcpu_tstats *tstats;
437 struct iphdr *tiph = &tunnel->parms.iph;
438 u8 tos = tunnel->parms.iph.tos;
439 __be16 df = tiph->frag_off;
440 struct rtable *rt; /* Route to the other host */
441 struct net_device *tdev; /* Device to other host */
442 struct iphdr *old_iph = ip_hdr(skb);
443 struct iphdr *iph; /* Our new IP header */
444 unsigned int max_headroom; /* The extra header space needed */
445 __be32 dst = tiph->daddr;
448 if (skb->protocol != htons(ETH_P_IP))
456 if ((rt = skb_rtable(skb)) == NULL) {
457 dev->stats.tx_fifo_errors++;
460 if ((dst = rt->rt_gateway) == 0)
466 .oif = tunnel->parms.link,
470 .saddr = tiph->saddr,
474 .proto = IPPROTO_IPIP
477 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
478 dev->stats.tx_carrier_errors++;
486 dev->stats.collisions++;
490 df |= old_iph->frag_off & htons(IP_DF);
493 mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr);
496 dev->stats.collisions++;
502 skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
504 if ((old_iph->frag_off & htons(IP_DF)) &&
505 mtu < ntohs(old_iph->tot_len)) {
506 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
513 if (tunnel->err_count > 0) {
514 if (time_before(jiffies,
515 tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
517 dst_link_failure(skb);
519 tunnel->err_count = 0;
523 * Okay, now see if we can stuff it in the buffer as-is.
525 max_headroom = (LL_RESERVED_SPACE(tdev)+sizeof(struct iphdr));
527 if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
528 (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
529 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
532 dev->stats.tx_dropped++;
537 skb_set_owner_w(new_skb, skb->sk);
540 old_iph = ip_hdr(skb);
543 skb->transport_header = skb->network_header;
544 skb_push(skb, sizeof(struct iphdr));
545 skb_reset_network_header(skb);
546 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
547 IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
550 skb_dst_set(skb, &rt->dst);
553 * Push down and install the IPIP header.
558 iph->ihl = sizeof(struct iphdr)>>2;
560 iph->protocol = IPPROTO_IPIP;
561 iph->tos = INET_ECN_encapsulate(tos, old_iph->tos);
562 iph->daddr = rt->rt_dst;
563 iph->saddr = rt->rt_src;
565 if ((iph->ttl = tiph->ttl) == 0)
566 iph->ttl = old_iph->ttl;
569 tstats = this_cpu_ptr(dev->tstats);
570 __IPTUNNEL_XMIT(tstats, &dev->stats);
574 dst_link_failure(skb);
576 dev->stats.tx_errors++;
581 static void ipip_tunnel_bind_dev(struct net_device *dev)
583 struct net_device *tdev = NULL;
584 struct ip_tunnel *tunnel;
587 tunnel = netdev_priv(dev);
588 iph = &tunnel->parms.iph;
592 .oif = tunnel->parms.link,
597 .tos = RT_TOS(iph->tos)
600 .proto = IPPROTO_IPIP
604 if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
608 dev->flags |= IFF_POINTOPOINT;
611 if (!tdev && tunnel->parms.link)
612 tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
615 dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
616 dev->mtu = tdev->mtu - sizeof(struct iphdr);
618 dev->iflink = tunnel->parms.link;
622 ipip_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
625 struct ip_tunnel_parm p;
627 struct net *net = dev_net(dev);
628 struct ipip_net *ipn = net_generic(net, ipip_net_id);
633 if (dev == ipn->fb_tunnel_dev) {
634 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
638 t = ipip_tunnel_locate(net, &p, 0);
641 t = netdev_priv(dev);
642 memcpy(&p, &t->parms, sizeof(p));
643 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
650 if (!capable(CAP_NET_ADMIN))
654 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
658 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
659 p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
662 p.iph.frag_off |= htons(IP_DF);
664 t = ipip_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
666 if (dev != ipn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
673 if (((dev->flags&IFF_POINTOPOINT) && !p.iph.daddr) ||
674 (!(dev->flags&IFF_POINTOPOINT) && p.iph.daddr)) {
678 t = netdev_priv(dev);
679 ipip_tunnel_unlink(ipn, t);
680 t->parms.iph.saddr = p.iph.saddr;
681 t->parms.iph.daddr = p.iph.daddr;
682 memcpy(dev->dev_addr, &p.iph.saddr, 4);
683 memcpy(dev->broadcast, &p.iph.daddr, 4);
684 ipip_tunnel_link(ipn, t);
685 netdev_state_change(dev);
691 if (cmd == SIOCCHGTUNNEL) {
692 t->parms.iph.ttl = p.iph.ttl;
693 t->parms.iph.tos = p.iph.tos;
694 t->parms.iph.frag_off = p.iph.frag_off;
695 if (t->parms.link != p.link) {
696 t->parms.link = p.link;
697 ipip_tunnel_bind_dev(dev);
698 netdev_state_change(dev);
701 if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
704 err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
709 if (!capable(CAP_NET_ADMIN))
712 if (dev == ipn->fb_tunnel_dev) {
714 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
717 if ((t = ipip_tunnel_locate(net, &p, 0)) == NULL)
720 if (t->dev == ipn->fb_tunnel_dev)
724 unregister_netdevice(dev);
736 static int ipip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
738 if (new_mtu < 68 || new_mtu > 0xFFF8 - sizeof(struct iphdr))
744 static const struct net_device_ops ipip_netdev_ops = {
745 .ndo_uninit = ipip_tunnel_uninit,
746 .ndo_start_xmit = ipip_tunnel_xmit,
747 .ndo_do_ioctl = ipip_tunnel_ioctl,
748 .ndo_change_mtu = ipip_tunnel_change_mtu,
749 .ndo_get_stats = ipip_get_stats,
752 static void ipip_dev_free(struct net_device *dev)
754 free_percpu(dev->tstats);
758 static void ipip_tunnel_setup(struct net_device *dev)
760 dev->netdev_ops = &ipip_netdev_ops;
761 dev->destructor = ipip_dev_free;
763 dev->type = ARPHRD_TUNNEL;
764 dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr);
765 dev->mtu = ETH_DATA_LEN - sizeof(struct iphdr);
766 dev->flags = IFF_NOARP;
769 dev->features |= NETIF_F_NETNS_LOCAL;
770 dev->features |= NETIF_F_LLTX;
771 dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
774 static int ipip_tunnel_init(struct net_device *dev)
776 struct ip_tunnel *tunnel = netdev_priv(dev);
779 strcpy(tunnel->parms.name, dev->name);
781 memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
782 memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
784 ipip_tunnel_bind_dev(dev);
786 dev->tstats = alloc_percpu(struct pcpu_tstats);
793 static int __net_init ipip_fb_tunnel_init(struct net_device *dev)
795 struct ip_tunnel *tunnel = netdev_priv(dev);
796 struct iphdr *iph = &tunnel->parms.iph;
797 struct ipip_net *ipn = net_generic(dev_net(dev), ipip_net_id);
800 strcpy(tunnel->parms.name, dev->name);
803 iph->protocol = IPPROTO_IPIP;
806 dev->tstats = alloc_percpu(struct pcpu_tstats);
811 rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
815 static struct xfrm_tunnel ipip_handler __read_mostly = {
817 .err_handler = ipip_err,
821 static const char banner[] __initconst =
822 KERN_INFO "IPv4 over IPv4 tunneling driver\n";
824 static void ipip_destroy_tunnels(struct ipip_net *ipn, struct list_head *head)
828 for (prio = 1; prio < 4; prio++) {
830 for (h = 0; h < HASH_SIZE; h++) {
833 t = rtnl_dereference(ipn->tunnels[prio][h]);
835 unregister_netdevice_queue(t->dev, head);
836 t = rtnl_dereference(t->next);
842 static int __net_init ipip_init_net(struct net *net)
844 struct ipip_net *ipn = net_generic(net, ipip_net_id);
847 ipn->tunnels[0] = ipn->tunnels_wc;
848 ipn->tunnels[1] = ipn->tunnels_l;
849 ipn->tunnels[2] = ipn->tunnels_r;
850 ipn->tunnels[3] = ipn->tunnels_r_l;
852 ipn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel),
855 if (!ipn->fb_tunnel_dev) {
859 dev_net_set(ipn->fb_tunnel_dev, net);
861 err = ipip_fb_tunnel_init(ipn->fb_tunnel_dev);
865 if ((err = register_netdev(ipn->fb_tunnel_dev)))
871 ipip_dev_free(ipn->fb_tunnel_dev);
877 static void __net_exit ipip_exit_net(struct net *net)
879 struct ipip_net *ipn = net_generic(net, ipip_net_id);
883 ipip_destroy_tunnels(ipn, &list);
884 unregister_netdevice_queue(ipn->fb_tunnel_dev, &list);
885 unregister_netdevice_many(&list);
889 static struct pernet_operations ipip_net_ops = {
890 .init = ipip_init_net,
891 .exit = ipip_exit_net,
893 .size = sizeof(struct ipip_net),
896 static int __init ipip_init(void)
902 err = register_pernet_device(&ipip_net_ops);
905 err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
907 unregister_pernet_device(&ipip_net_ops);
908 printk(KERN_INFO "ipip init: can't register tunnel\n");
913 static void __exit ipip_fini(void)
915 if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
916 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
918 unregister_pernet_device(&ipip_net_ops);
921 module_init(ipip_init);
922 module_exit(ipip_fini);
923 MODULE_LICENSE("GPL");