net/ipv4/ipip.c

   1 /*
   2  *      Linux NET3:     IP/IP protocol decoder.
   3  *
   4  *      Version: $Id: ipip.c,v 1.50 2001/10/02 02:22:36 davem Exp $
   5  *
   6  *      Authors:
   7  *              Sam Lantinga (slouken@cs.ucdavis.edu)  02/01/95
   8  *
   9  *      Fixes:
  10  *              Alan Cox        :       Merged and made usable non modular (its so tiny its silly as
  11  *                                      a module taking up 2 pages).
  12  *              Alan Cox        :       Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
  13  *                                      to keep ip_forward happy.
  14  *              Alan Cox        :       More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
  15  *              Kai Schulte     :       Fixed #defines for IP_FIREWALL->FIREWALL
  16  *              David Woodhouse :       Perform some basic ICMP handling.
  17  *                                      IPIP Routing without decapsulation.
  18  *              Carlos Picoto   :       GRE over IP support
  19  *              Alexey Kuznetsov:       Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
  20  *                                      I do not want to merge them together.
  21  *
  22  *      This program is free software; you can redistribute it and/or
  23  *      modify it under the terms of the GNU General Public License
  24  *      as published by the Free Software Foundation; either version
  25  *      2 of the License, or (at your option) any later version.
  26  *
  27  */
  28
  29 /* tunnel.c: an IP tunnel driver
  30
  31         The purpose of this driver is to provide an IP tunnel through
  32         which you can tunnel network traffic transparently across subnets.
  33
  34         This was written by looking at Nick Holloway's dummy driver
  35         Thanks for the great code!
  36
  37                 -Sam Lantinga   (slouken@cs.ucdavis.edu)  02/01/95
  38
  39         Minor tweaks:
  40                 Cleaned up the code a little and added some pre-1.3.0 tweaks.
  41                 dev->hard_header/hard_header_len changed to use no headers.
  42                 Comments/bracketing tweaked.
  43                 Made the tunnels use dev->name not tunnel: when error reporting.
  44                 Added tx_dropped stat
  45
  46                 -Alan Cox       (Alan.Cox@linux.org) 21 March 95
  47
  48         Reworked:
  49                 Changed to tunnel to destination gateway in addition to the
  50                         tunnel's pointopoint address
  51                 Almost completely rewritten
  52                 Note:  There is currently no firewall or ICMP handling done.
  53
  54                 -Sam Lantinga   (slouken@cs.ucdavis.edu) 02/13/96
  55
  56 */
  57
  58 /* Things I wish I had known when writing the tunnel driver:
  59
  60         When the tunnel_xmit() function is called, the skb contains the
  61         packet to be sent (plus a great deal of extra info), and dev
  62         contains the tunnel device that _we_ are.
  63
  64         When we are passed a packet, we are expected to fill in the
  65         source address with our source IP address.
  66
  67         What is the proper way to allocate, copy and free a buffer?
  68         After you allocate it, it is a "0 length" chunk of memory
  69         starting at zero.  If you want to add headers to the buffer
  70         later, you'll have to call "skb_reserve(skb, amount)" with
  71         the amount of memory you want reserved.  Then, you call
  72         "skb_put(skb, amount)" with the amount of space you want in
  73         the buffer.  skb_put() returns a pointer to the top (#0) of
  74         that buffer.  skb->len is set to the amount of space you have
  75         "allocated" with skb_put().  You can then write up to skb->len
  76         bytes to that buffer.  If you need more, you can call skb_put()
  77         again with the additional amount of space you need.  You can
  78         find out how much more space you can allocate by calling
  79         "skb_tailroom(skb)".
  80         Now, to add header space, call "skb_push(skb, header_len)".
  81         This creates space at the beginning of the buffer and returns
  82         a pointer to this new space.  If later you need to strip a
  83         header from a buffer, call "skb_pull(skb, header_len)".
  84         skb_headroom() will return how much space is left at the top
  85         of the buffer (before the main data).  Remember, this headroom
  86         space must be reserved before the skb_put() function is called.
  87         */
  88
  89 /*
  90    This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c
  91
  92    For comments look at net/ipv4/ip_gre.c --ANK
  93  */
  94
  95
  96 #include <linux/capability.h>
  97 #include <linux/module.h>
  98 #include <linux/types.h>
  99 #include <linux/kernel.h>
 100 #include <asm/uaccess.h>
 101 #include <linux/skbuff.h>
 102 #include <linux/netdevice.h>
 103 #include <linux/in.h>
 104 #include <linux/tcp.h>
 105 #include <linux/udp.h>
 106 #include <linux/if_arp.h>
 107 #include <linux/mroute.h>
 108 #include <linux/init.h>
 109 #include <linux/netfilter_ipv4.h>
 110 #include <linux/if_ether.h>
 111
 112 #include <net/sock.h>
 113 #include <net/ip.h>
 114 #include <net/icmp.h>
 115 #include <net/ipip.h>
 116 #include <net/inet_ecn.h>
 117 #include <net/xfrm.h>
 118 #include <net/net_namespace.h>
 119 #include <net/netns/generic.h>
 120
 121 #define HASH_SIZE  16
 122 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 123
 124 static int ipip_net_id;
 125 struct ipip_net {
 126         struct ip_tunnel *tunnels_r_l[HASH_SIZE];
 127         struct ip_tunnel *tunnels_r[HASH_SIZE];
 128         struct ip_tunnel *tunnels_l[HASH_SIZE];
 129         struct ip_tunnel *tunnels_wc[1];
 130         struct ip_tunnel **tunnels[4];
 131
 132         struct net_device *fb_tunnel_dev;
 133 };
 134
 135 static int ipip_fb_tunnel_init(struct net_device *dev);
 136 static int ipip_tunnel_init(struct net_device *dev);
 137 static void ipip_tunnel_setup(struct net_device *dev);
 138
 139 static DEFINE_RWLOCK(ipip_lock);
 140
 141 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
 142                 __be32 remote, __be32 local)
 143 {
 144         unsigned h0 = HASH(remote);
 145         unsigned h1 = HASH(local);
 146         struct ip_tunnel *t;
 147         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 148
 149         for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
 150                 if (local == t->parms.iph.saddr &&
 151                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
 152                         return t;
 153         }
 154         for (t = ipn->tunnels_r[h0]; t; t = t->next) {
 155                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
 156                         return t;
 157         }
 158         for (t = ipn->tunnels_l[h1]; t; t = t->next) {
 159                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
 160                         return t;
 161         }
 162         if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
 163                 return t;
 164         return NULL;
 165 }
 166
 167 static struct ip_tunnel **__ipip_bucket(struct ipip_net *ipn,
 168                 struct ip_tunnel_parm *parms)
 169 {
 170         __be32 remote = parms->iph.daddr;
 171         __be32 local = parms->iph.saddr;
 172         unsigned h = 0;
 173         int prio = 0;
 174
 175         if (remote) {
 176                 prio |= 2;
 177                 h ^= HASH(remote);
 178         }
 179         if (local) {
 180                 prio |= 1;
 181                 h ^= HASH(local);
 182         }
 183         return &ipn->tunnels[prio][h];
 184 }
 185
 186 static inline struct ip_tunnel **ipip_bucket(struct ipip_net *ipn,
 187                 struct ip_tunnel *t)
 188 {
 189         return __ipip_bucket(ipn, &t->parms);
 190 }
 191
 192 static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
 193 {
 194         struct ip_tunnel **tp;
 195
 196         for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
 197                 if (t == *tp) {
 198                         write_lock_bh(&ipip_lock);
 199                         *tp = t->next;
 200                         write_unlock_bh(&ipip_lock);
 201                         break;
 202                 }
 203         }
 204 }
 205
 206 static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
 207 {
 208         struct ip_tunnel **tp = ipip_bucket(ipn, t);
 209
 210         t->next = *tp;
 211         write_lock_bh(&ipip_lock);
 212         *tp = t;
 213         write_unlock_bh(&ipip_lock);
 214 }
 215
 216 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
 217                 struct ip_tunnel_parm *parms, int create)
 218 {
 219         __be32 remote = parms->iph.daddr;
 220         __be32 local = parms->iph.saddr;
 221         struct ip_tunnel *t, **tp, *nt;
 222         struct net_device *dev;
 223         char name[IFNAMSIZ];
 224         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 225
 226         for (tp = __ipip_bucket(ipn, parms); (t = *tp) != NULL; tp = &t->next) {
 227                 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
 228                         return t;
 229         }
 230         if (!create)
 231                 return NULL;
 232
 233         if (parms->name[0])
 234                 strlcpy(name, parms->name, IFNAMSIZ);
 235         else
 236                 sprintf(name, "tunl%%d");
 237
 238         dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
 239         if (dev == NULL)
 240                 return NULL;
 241
 242         if (strchr(name, '%')) {
 243                 if (dev_alloc_name(dev, name) < 0)
 244                         goto failed_free;
 245         }
 246
 247         nt = netdev_priv(dev);
 248         dev->init = ipip_tunnel_init;
 249         nt->parms = *parms;
 250
 251         if (register_netdevice(dev) < 0)
 252                 goto failed_free;
 253
 254         dev_hold(dev);
 255         ipip_tunnel_link(ipn, nt);
 256         return nt;
 257
 258 failed_free:
 259         free_netdev(dev);
 260         return NULL;
 261 }
 262
 263 static void ipip_tunnel_uninit(struct net_device *dev)
 264 {
 265         struct net *net = dev_net(dev);
 266         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 267
 268         if (dev == ipn->fb_tunnel_dev) {
 269                 write_lock_bh(&ipip_lock);
 270                 ipn->tunnels_wc[0] = NULL;
 271                 write_unlock_bh(&ipip_lock);
 272         } else
 273                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
 274         dev_put(dev);
 275 }
 276
 277 static int ipip_err(struct sk_buff *skb, u32 info)
 278 {
 279 #ifndef I_WISH_WORLD_WERE_PERFECT
 280
 281 /* It is not :-( All the routers (except for Linux) return only
 282    8 bytes of packet payload. It means, that precise relaying of
 283    ICMP in the real Internet is absolutely infeasible.
 284  */
 285         struct iphdr *iph = (struct iphdr*)skb->data;
 286         const int type = icmp_hdr(skb)->type;
 287         const int code = icmp_hdr(skb)->code;
 288         struct ip_tunnel *t;
 289         int err;
 290
 291         switch (type) {
 292         default:
 293         case ICMP_PARAMETERPROB:
 294                 return 0;
 295
 296         case ICMP_DEST_UNREACH:
 297                 switch (code) {
 298                 case ICMP_SR_FAILED:
 299                 case ICMP_PORT_UNREACH:
 300                         /* Impossible event. */
 301                         return 0;
 302                 case ICMP_FRAG_NEEDED:
 303                         /* Soft state for pmtu is maintained by IP core. */
 304                         return 0;
 305                 default:
 306                         /* All others are translated to HOST_UNREACH.
 307                            rfc2003 contains "deep thoughts" about NET_UNREACH,
 308                            I believe they are just ether pollution. --ANK
 309                          */
 310                         break;
 311                 }
 312                 break;
 313         case ICMP_TIME_EXCEEDED:
 314                 if (code != ICMP_EXC_TTL)
 315                         return 0;
 316                 break;
 317         }
 318
 319         err = -ENOENT;
 320
 321         read_lock(&ipip_lock);
 322         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
 323         if (t == NULL || t->parms.iph.daddr == 0)
 324                 goto out;
 325
 326         err = 0;
 327         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
 328                 goto out;
 329
 330         if (jiffies - t->err_time < IPTUNNEL_ERR_TIMEO)
 331                 t->err_count++;
 332         else
 333                 t->err_count = 1;
 334         t->err_time = jiffies;
 335 out:
 336         read_unlock(&ipip_lock);
 337         return err;
 338 #else
 339         struct iphdr *iph = (struct iphdr*)dp;
 340         int hlen = iph->ihl<<2;
 341         struct iphdr *eiph;
 342         const int type = icmp_hdr(skb)->type;
 343         const int code = icmp_hdr(skb)->code;
 344         int rel_type = 0;
 345         int rel_code = 0;
 346         __be32 rel_info = 0;
 347         __u32 n = 0;
 348         struct sk_buff *skb2;
 349         struct flowi fl;
 350         struct rtable *rt;
 351
 352         if (len < hlen + sizeof(struct iphdr))
 353                 return 0;
 354         eiph = (struct iphdr*)(dp + hlen);
 355
 356         switch (type) {
 357         default:
 358                 return 0;
 359         case ICMP_PARAMETERPROB:
 360                 n = ntohl(icmp_hdr(skb)->un.gateway) >> 24;
 361                 if (n < hlen)
 362                         return 0;
 363
 364                 /* So... This guy found something strange INSIDE encapsulated
 365                    packet. Well, he is fool, but what can we do ?
 366                  */
 367                 rel_type = ICMP_PARAMETERPROB;
 368                 rel_info = htonl((n - hlen) << 24);
 369                 break;
 370
 371         case ICMP_DEST_UNREACH:
 372                 switch (code) {
 373                 case ICMP_SR_FAILED:
 374                 case ICMP_PORT_UNREACH:
 375                         /* Impossible event. */
 376                         return 0;
 377                 case ICMP_FRAG_NEEDED:
 378                         /* And it is the only really necessary thing :-) */
 379                         n = ntohs(icmp_hdr(skb)->un.frag.mtu);
 380                         if (n < hlen+68)
 381                                 return 0;
 382                         n -= hlen;
 383                         /* BSD 4.2 MORE DOES NOT EXIST IN NATURE. */
 384                         if (n > ntohs(eiph->tot_len))
 385                                 return 0;
 386                         rel_info = htonl(n);
 387                         break;
 388                 default:
 389                         /* All others are translated to HOST_UNREACH.
 390                            rfc2003 contains "deep thoughts" about NET_UNREACH,
 391                            I believe, it is just ether pollution. --ANK
 392                          */
 393                         rel_type = ICMP_DEST_UNREACH;
 394                         rel_code = ICMP_HOST_UNREACH;
 395                         break;
 396                 }
 397                 break;
 398         case ICMP_TIME_EXCEEDED:
 399                 if (code != ICMP_EXC_TTL)
 400                         return 0;
 401                 break;
 402         }
 403
 404         /* Prepare fake skb to feed it to icmp_send */
 405         skb2 = skb_clone(skb, GFP_ATOMIC);
 406         if (skb2 == NULL)
 407                 return 0;
 408         dst_release(skb2->dst);
 409         skb2->dst = NULL;
 410         skb_pull(skb2, skb->data - (u8*)eiph);
 411         skb_reset_network_header(skb2);
 412
 413         /* Try to guess incoming interface */
 414         memset(&fl, 0, sizeof(fl));
 415         fl.fl4_daddr = eiph->saddr;
 416         fl.fl4_tos = RT_TOS(eiph->tos);
 417         fl.proto = IPPROTO_IPIP;
 418         if (ip_route_output_key(dev_net(skb->dev), &rt, &key)) {
 419                 kfree_skb(skb2);
 420                 return 0;
 421         }
 422         skb2->dev = rt->u.dst.dev;
 423
 424         /* route "incoming" packet */
 425         if (rt->rt_flags&RTCF_LOCAL) {
 426                 ip_rt_put(rt);
 427                 rt = NULL;
 428                 fl.fl4_daddr = eiph->daddr;
 429                 fl.fl4_src = eiph->saddr;
 430                 fl.fl4_tos = eiph->tos;
 431                 if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
 432                     rt->u.dst.dev->type != ARPHRD_TUNNEL) {
 433                         ip_rt_put(rt);
 434                         kfree_skb(skb2);
 435                         return 0;
 436                 }
 437         } else {
 438                 ip_rt_put(rt);
 439                 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev) ||
 440                     skb2->dst->dev->type != ARPHRD_TUNNEL) {
 441                         kfree_skb(skb2);
 442                         return 0;
 443                 }
 444         }
 445
 446         /* change mtu on this route */
 447         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
 448                 if (n > dst_mtu(skb2->dst)) {
 449                         kfree_skb(skb2);
 450                         return 0;
 451                 }
 452                 skb2->dst->ops->update_pmtu(skb2->dst, n);
 453         } else if (type == ICMP_TIME_EXCEEDED) {
 454                 struct ip_tunnel *t = netdev_priv(skb2->dev);
 455                 if (t->parms.iph.ttl) {
 456                         rel_type = ICMP_DEST_UNREACH;
 457                         rel_code = ICMP_HOST_UNREACH;
 458                 }
 459         }
 460
 461         icmp_send(skb2, rel_type, rel_code, rel_info);
 462         kfree_skb(skb2);
 463         return 0;
 464 #endif
 465 }
 466
 467 static inline void ipip_ecn_decapsulate(const struct iphdr *outer_iph,
 468                                         struct sk_buff *skb)
 469 {
 470         struct iphdr *inner_iph = ip_hdr(skb);
 471
 472         if (INET_ECN_is_ce(outer_iph->tos))
 473                 IP_ECN_set_ce(inner_iph);
 474 }
 475
 476 static int ipip_rcv(struct sk_buff *skb)
 477 {
 478         struct ip_tunnel *tunnel;
 479         const struct iphdr *iph = ip_hdr(skb);
 480
 481         read_lock(&ipip_lock);
 482         if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
 483                                         iph->saddr, iph->daddr)) != NULL) {
 484                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
 485                         read_unlock(&ipip_lock);
 486                         kfree_skb(skb);
 487                         return 0;
 488                 }
 489
 490                 secpath_reset(skb);
 491
 492                 skb->mac_header = skb->network_header;
 493                 skb_reset_network_header(skb);
 494                 skb->protocol = htons(ETH_P_IP);
 495                 skb->pkt_type = PACKET_HOST;
 496
 497                 tunnel->stat.rx_packets++;
 498                 tunnel->stat.rx_bytes += skb->len;
 499                 skb->dev = tunnel->dev;
 500                 dst_release(skb->dst);
 501                 skb->dst = NULL;
 502                 nf_reset(skb);
 503                 ipip_ecn_decapsulate(iph, skb);
 504                 netif_rx(skb);
 505                 read_unlock(&ipip_lock);
 506                 return 0;
 507         }
 508         read_unlock(&ipip_lock);
 509
 510         return -1;
 511 }
 512
 513 /*
 514  *      This function assumes it is being called from dev_queue_xmit()
 515  *      and that skb is filled properly by that function.
 516  */
 517
 518 static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 519 {
 520         struct ip_tunnel *tunnel = netdev_priv(dev);
 521         struct net_device_stats *stats = &tunnel->stat;
 522         struct iphdr  *tiph = &tunnel->parms.iph;
 523         u8     tos = tunnel->parms.iph.tos;
 524         __be16 df = tiph->frag_off;
 525         struct rtable *rt;                      /* Route to the other host */
 526         struct net_device *tdev;                        /* Device to other host */
 527         struct iphdr  *old_iph = ip_hdr(skb);
 528         struct iphdr  *iph;                     /* Our new IP header */
 529         unsigned int max_headroom;              /* The extra header space needed */
 530         __be32 dst = tiph->daddr;
 531         int    mtu;
 532
 533         if (tunnel->recursion++) {
 534                 tunnel->stat.collisions++;
 535                 goto tx_error;
 536         }
 537
 538         if (skb->protocol != htons(ETH_P_IP))
 539                 goto tx_error;
 540
 541         if (tos&1)
 542                 tos = old_iph->tos;
 543
 544         if (!dst) {
 545                 /* NBMA tunnel */
 546                 if ((rt = skb->rtable) == NULL) {
 547                         tunnel->stat.tx_fifo_errors++;
 548                         goto tx_error;
 549                 }
 550                 if ((dst = rt->rt_gateway) == 0)
 551                         goto tx_error_icmp;
 552         }
 553
 554         {
 555                 struct flowi fl = { .oif = tunnel->parms.link,
 556                                     .nl_u = { .ip4_u =
 557                                               { .daddr = dst,
 558                                                 .saddr = tiph->saddr,
 559                                                 .tos = RT_TOS(tos) } },
 560                                     .proto = IPPROTO_IPIP };
 561                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
 562                         tunnel->stat.tx_carrier_errors++;
 563                         goto tx_error_icmp;
 564                 }
 565         }
 566         tdev = rt->u.dst.dev;
 567
 568         if (tdev == dev) {
 569                 ip_rt_put(rt);
 570                 tunnel->stat.collisions++;
 571                 goto tx_error;
 572         }
 573
 574         if (tiph->frag_off)
 575                 mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
 576         else
 577                 mtu = skb->dst ? dst_mtu(skb->dst) : dev->mtu;
 578
 579         if (mtu < 68) {
 580                 tunnel->stat.collisions++;
 581                 ip_rt_put(rt);
 582                 goto tx_error;
 583         }
 584         if (skb->dst)
 585                 skb->dst->ops->update_pmtu(skb->dst, mtu);
 586
 587         df |= (old_iph->frag_off&htons(IP_DF));
 588
 589         if ((old_iph->frag_off&htons(IP_DF)) && mtu < ntohs(old_iph->tot_len)) {
 590                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
 591                 ip_rt_put(rt);
 592                 goto tx_error;
 593         }
 594
 595         if (tunnel->err_count > 0) {
 596                 if (jiffies - tunnel->err_time < IPTUNNEL_ERR_TIMEO) {
 597                         tunnel->err_count--;
 598                         dst_link_failure(skb);
 599                 } else
 600                         tunnel->err_count = 0;
 601         }
 602
 603         /*
 604          * Okay, now see if we can stuff it in the buffer as-is.
 605          */
 606         max_headroom = (LL_RESERVED_SPACE(tdev)+sizeof(struct iphdr));
 607
 608         if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
 609             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
 610                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
 611                 if (!new_skb) {
 612                         ip_rt_put(rt);
 613                         stats->tx_dropped++;
 614                         dev_kfree_skb(skb);
 615                         tunnel->recursion--;
 616                         return 0;
 617                 }
 618                 if (skb->sk)
 619                         skb_set_owner_w(new_skb, skb->sk);
 620                 dev_kfree_skb(skb);
 621                 skb = new_skb;
 622                 old_iph = ip_hdr(skb);
 623         }
 624
 625         skb->transport_header = skb->network_header;
 626         skb_push(skb, sizeof(struct iphdr));
 627         skb_reset_network_header(skb);
 628         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
 629         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
 630                               IPSKB_REROUTED);
 631         dst_release(skb->dst);
 632         skb->dst = &rt->u.dst;
 633
 634         /*
 635          *      Push down and install the IPIP header.
 636          */
 637
 638         iph                     =       ip_hdr(skb);
 639         iph->version            =       4;
 640         iph->ihl                =       sizeof(struct iphdr)>>2;
 641         iph->frag_off           =       df;
 642         iph->protocol           =       IPPROTO_IPIP;
 643         iph->tos                =       INET_ECN_encapsulate(tos, old_iph->tos);
 644         iph->daddr              =       rt->rt_dst;
 645         iph->saddr              =       rt->rt_src;
 646
 647         if ((iph->ttl = tiph->ttl) == 0)
 648                 iph->ttl        =       old_iph->ttl;
 649
 650         nf_reset(skb);
 651
 652         IPTUNNEL_XMIT();
 653         tunnel->recursion--;
 654         return 0;
 655
 656 tx_error_icmp:
 657         dst_link_failure(skb);
 658 tx_error:
 659         stats->tx_errors++;
 660         dev_kfree_skb(skb);
 661         tunnel->recursion--;
 662         return 0;
 663 }
 664
 665 static void ipip_tunnel_bind_dev(struct net_device *dev)
 666 {
 667         struct net_device *tdev = NULL;
 668         struct ip_tunnel *tunnel;
 669         struct iphdr *iph;
 670
 671         tunnel = netdev_priv(dev);
 672         iph = &tunnel->parms.iph;
 673
 674         if (iph->daddr) {
 675                 struct flowi fl = { .oif = tunnel->parms.link,
 676                                     .nl_u = { .ip4_u =
 677                                               { .daddr = iph->daddr,
 678                                                 .saddr = iph->saddr,
 679                                                 .tos = RT_TOS(iph->tos) } },
 680                                     .proto = IPPROTO_IPIP };
 681                 struct rtable *rt;
 682                 if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
 683                         tdev = rt->u.dst.dev;
 684                         ip_rt_put(rt);
 685                 }
 686                 dev->flags |= IFF_POINTOPOINT;
 687         }
 688
 689         if (!tdev && tunnel->parms.link)
 690                 tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
 691
 692         if (tdev) {
 693                 dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
 694                 dev->mtu = tdev->mtu - sizeof(struct iphdr);
 695         }
 696         dev->iflink = tunnel->parms.link;
 697 }
 698
 699 static int
 700 ipip_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
 701 {
 702         int err = 0;
 703         struct ip_tunnel_parm p;
 704         struct ip_tunnel *t;
 705         struct net *net = dev_net(dev);
 706         struct ipip_net *ipn = net_generic(net, ipip_net_id);
 707
 708         switch (cmd) {
 709         case SIOCGETTUNNEL:
 710                 t = NULL;
 711                 if (dev == ipn->fb_tunnel_dev) {
 712                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
 713                                 err = -EFAULT;
 714                                 break;
 715                         }
 716                         t = ipip_tunnel_locate(net, &p, 0);
 717                 }
 718                 if (t == NULL)
 719                         t = netdev_priv(dev);
 720                 memcpy(&p, &t->parms, sizeof(p));
 721                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
 722                         err = -EFAULT;
 723                 break;
 724
 725         case SIOCADDTUNNEL:
 726         case SIOCCHGTUNNEL:
 727                 err = -EPERM;
 728                 if (!capable(CAP_NET_ADMIN))
 729                         goto done;
 730
 731                 err = -EFAULT;
 732                 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
 733                         goto done;
 734
 735                 err = -EINVAL;
 736                 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
 737                     p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
 738                         goto done;
 739                 if (p.iph.ttl)
 740                         p.iph.frag_off |= htons(IP_DF);
 741
 742                 t = ipip_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
 743
 744                 if (dev != ipn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
 745                         if (t != NULL) {
 746                                 if (t->dev != dev) {
 747                                         err = -EEXIST;
 748                                         break;
 749                                 }
 750                         } else {
 751                                 if (((dev->flags&IFF_POINTOPOINT) && !p.iph.daddr) ||
 752                                     (!(dev->flags&IFF_POINTOPOINT) && p.iph.daddr)) {
 753                                         err = -EINVAL;
 754                                         break;
 755                                 }
 756                                 t = netdev_priv(dev);
 757                                 ipip_tunnel_unlink(ipn, t);
 758                                 t->parms.iph.saddr = p.iph.saddr;
 759                                 t->parms.iph.daddr = p.iph.daddr;
 760                                 memcpy(dev->dev_addr, &p.iph.saddr, 4);
 761                                 memcpy(dev->broadcast, &p.iph.daddr, 4);
 762                                 ipip_tunnel_link(ipn, t);
 763                                 netdev_state_change(dev);
 764                         }
 765                 }
 766
 767                 if (t) {
 768                         err = 0;
 769                         if (cmd == SIOCCHGTUNNEL) {
 770                                 t->parms.iph.ttl = p.iph.ttl;
 771                                 t->parms.iph.tos = p.iph.tos;
 772                                 t->parms.iph.frag_off = p.iph.frag_off;
 773                                 if (t->parms.link != p.link) {
 774                                         t->parms.link = p.link;
 775                                         ipip_tunnel_bind_dev(dev);
 776                                         netdev_state_change(dev);
 777                                 }
 778                         }
 779                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
 780                                 err = -EFAULT;
 781                 } else
 782                         err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
 783                 break;
 784
 785         case SIOCDELTUNNEL:
 786                 err = -EPERM;
 787                 if (!capable(CAP_NET_ADMIN))
 788                         goto done;
 789
 790                 if (dev == ipn->fb_tunnel_dev) {
 791                         err = -EFAULT;
 792                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
 793                                 goto done;
 794                         err = -ENOENT;
 795                         if ((t = ipip_tunnel_locate(net, &p, 0)) == NULL)
 796                                 goto done;
 797                         err = -EPERM;
 798                         if (t->dev == ipn->fb_tunnel_dev)
 799                                 goto done;
 800                         dev = t->dev;
 801                 }
 802                 unregister_netdevice(dev);
 803                 err = 0;
 804                 break;
 805
 806         default:
 807                 err = -EINVAL;
 808         }
 809
 810 done:
 811         return err;
 812 }
 813
 814 static struct net_device_stats *ipip_tunnel_get_stats(struct net_device *dev)
 815 {
 816         return &(((struct ip_tunnel*)netdev_priv(dev))->stat);
 817 }
 818
 819 static int ipip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 820 {
 821         if (new_mtu < 68 || new_mtu > 0xFFF8 - sizeof(struct iphdr))
 822                 return -EINVAL;
 823         dev->mtu = new_mtu;
 824         return 0;
 825 }
 826
 827 static void ipip_tunnel_setup(struct net_device *dev)
 828 {
 829         dev->uninit             = ipip_tunnel_uninit;
 830         dev->hard_start_xmit    = ipip_tunnel_xmit;
 831         dev->get_stats          = ipip_tunnel_get_stats;
 832         dev->do_ioctl           = ipip_tunnel_ioctl;
 833         dev->change_mtu         = ipip_tunnel_change_mtu;
 834         dev->destructor         = free_netdev;
 835
 836         dev->type               = ARPHRD_TUNNEL;
 837         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
 838         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr);
 839         dev->flags              = IFF_NOARP;
 840         dev->iflink             = 0;
 841         dev->addr_len           = 4;
 842 }
 843
 844 static int ipip_tunnel_init(struct net_device *dev)
 845 {
 846         struct ip_tunnel *tunnel;
 847
 848         tunnel = netdev_priv(dev);
 849
 850         tunnel->dev = dev;
 851         strcpy(tunnel->parms.name, dev->name);
 852
 853         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
 854         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
 855
 856         ipip_tunnel_bind_dev(dev);
 857
 858         return 0;
 859 }
 860
 861 static int ipip_fb_tunnel_init(struct net_device *dev)
 862 {
 863         struct ip_tunnel *tunnel = netdev_priv(dev);
 864         struct iphdr *iph = &tunnel->parms.iph;
 865         struct ipip_net *ipn = net_generic(dev_net(dev), ipip_net_id);
 866
 867         tunnel->dev = dev;
 868         strcpy(tunnel->parms.name, dev->name);
 869
 870         iph->version            = 4;
 871         iph->protocol           = IPPROTO_IPIP;
 872         iph->ihl                = 5;
 873
 874         dev_hold(dev);
 875         ipn->tunnels_wc[0]      = tunnel;
 876         return 0;
 877 }
 878
 879 static struct xfrm_tunnel ipip_handler = {
 880         .handler        =       ipip_rcv,
 881         .err_handler    =       ipip_err,
 882         .priority       =       1,
 883 };
 884
 885 static char banner[] __initdata =
 886         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
 887
 888 static void ipip_destroy_tunnels(struct ipip_net *ipn)
 889 {
 890         int prio;
 891
 892         for (prio = 1; prio < 4; prio++) {
 893                 int h;
 894                 for (h = 0; h < HASH_SIZE; h++) {
 895                         struct ip_tunnel *t;
 896                         while ((t = ipn->tunnels[prio][h]) != NULL)
 897                                 unregister_netdevice(t->dev);
 898                 }
 899         }
 900 }
 901
 902 static int ipip_init_net(struct net *net)
 903 {
 904         int err;
 905         struct ipip_net *ipn;
 906
 907         err = -ENOMEM;
 908         ipn = kzalloc(sizeof(struct ipip_net), GFP_KERNEL);
 909         if (ipn == NULL)
 910                 goto err_alloc;
 911
 912         err = net_assign_generic(net, ipip_net_id, ipn);
 913         if (err < 0)
 914                 goto err_assign;
 915
 916         ipn->tunnels[0] = ipn->tunnels_wc;
 917         ipn->tunnels[1] = ipn->tunnels_l;
 918         ipn->tunnels[2] = ipn->tunnels_r;
 919         ipn->tunnels[3] = ipn->tunnels_r_l;
 920
 921         ipn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel),
 922                                            "tunl0",
 923                                            ipip_tunnel_setup);
 924         if (!ipn->fb_tunnel_dev) {
 925                 err = -ENOMEM;
 926                 goto err_alloc_dev;
 927         }
 928
 929         ipn->fb_tunnel_dev->init = ipip_fb_tunnel_init;
 930         dev_net_set(ipn->fb_tunnel_dev, net);
 931
 932         if ((err = register_netdev(ipn->fb_tunnel_dev)))
 933                 goto err_reg_dev;
 934
 935         return 0;
 936
 937 err_reg_dev:
 938         free_netdev(ipn->fb_tunnel_dev);
 939 err_alloc_dev:
 940         /* nothing */
 941 err_assign:
 942         kfree(ipn);
 943 err_alloc:
 944         return err;
 945 }
 946
 947 static void ipip_exit_net(struct net *net)
 948 {
 949         struct ipip_net *ipn;
 950
 951         ipn = net_generic(net, ipip_net_id);
 952         rtnl_lock();
 953         ipip_destroy_tunnels(ipn);
 954         unregister_netdevice(ipn->fb_tunnel_dev);
 955         rtnl_unlock();
 956         kfree(ipn);
 957 }
 958
 959 static struct pernet_operations ipip_net_ops = {
 960         .init = ipip_init_net,
 961         .exit = ipip_exit_net,
 962 };
 963
 964 static int __init ipip_init(void)
 965 {
 966         int err;
 967
 968         printk(banner);
 969
 970         if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) {
 971                 printk(KERN_INFO "ipip init: can't register tunnel\n");
 972                 return -EAGAIN;
 973         }
 974
 975         err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
 976         if (err)
 977                 xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
 978
 979         return err;
 980 }
 981
 982 static void __exit ipip_fini(void)
 983 {
 984         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
 985                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
 986
 987         unregister_pernet_gen_device(ipip_net_id, &ipip_net_ops);
 988 }
 989
 990 module_init(ipip_init);
 991 module_exit(ipip_fini);
 992 MODULE_LICENSE("GPL");