2 * Linux NET3: GRE over IP protocol decoder.
4 * Authors: Alexey Kuznetsov (kuznet@ms2.inr.ac.ru)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
13 #include <linux/config.h>
14 #include <linux/module.h>
15 #include <linux/types.h>
16 #include <linux/sched.h>
17 #include <linux/kernel.h>
18 #include <asm/uaccess.h>
19 #include <linux/skbuff.h>
20 #include <linux/netdevice.h>
22 #include <linux/tcp.h>
23 #include <linux/udp.h>
24 #include <linux/if_arp.h>
25 #include <linux/mroute.h>
26 #include <linux/init.h>
27 #include <linux/in6.h>
28 #include <linux/inetdevice.h>
29 #include <linux/igmp.h>
30 #include <linux/netfilter_ipv4.h>
35 #include <net/protocol.h>
38 #include <net/checksum.h>
39 #include <net/dsfield.h>
40 #include <net/inet_ecn.h>
45 #include <net/ip6_fib.h>
46 #include <net/ip6_route.h>
53 1. The most important issue is detecting local dead loops.
54 They would cause complete host lockup in transmit, which
55 would be "resolved" by stack overflow or, if queueing is enabled,
56 with infinite looping in net_bh.
58 We cannot track such dead loops during route installation,
59 it is infeasible task. The most general solutions would be
60 to keep skb->encapsulation counter (sort of local ttl),
61 and silently drop packet when it expires. It is the best
62 solution, but it supposes maintaing new variable in ALL
63 skb, even if no tunneling is used.
65 Current solution: t->recursion lock breaks dead loops. It looks
66 like dev->tbusy flag, but I preferred new variable, because
67 the semantics is different. One day, when hard_start_xmit
68 will be multithreaded we will have to use skb->encapsulation.
72 2. Networking dead loops would not kill routers, but would really
73 kill network. IP hop limit plays role of "t->recursion" in this case,
74 if we copy it from packet being encapsulated to upper header.
75 It is very good solution, but it introduces two problems:
77 - Routing protocols, using packets with ttl=1 (OSPF, RIP2),
78 do not work over tunnels.
79 - traceroute does not work. I planned to relay ICMP from tunnel,
80 so that this problem would be solved and traceroute output
81 would even more informative. This idea appeared to be wrong:
82 only Linux complies to rfc1812 now (yes, guys, Linux is the only
83 true router now :-)), all routers (at least, in neighbourhood of mine)
84 return only 8 bytes of payload. It is the end.
86 Hence, if we want that OSPF worked or traceroute said something reasonable,
87 we should search for another solution.
89 One of them is to parse packet trying to detect inner encapsulation
90 made by our node. It is difficult or even impossible, especially,
91 taking into account fragmentation. TO be short, tt is not solution at all.
93 Current solution: The solution was UNEXPECTEDLY SIMPLE.
94 We force DF flag on tunnels with preconfigured hop limit,
95 that is ALL. :-) Well, it does not remove the problem completely,
96 but exponential growth of network traffic is changed to linear
97 (branches, that exceed pmtu are pruned) and tunnel mtu
98 fastly degrades to value <68, where looping stops.
99 Yes, it is not good if there exists a router in the loop,
100 which does not force DF, even when encapsulating packets have DF set.
101 But it is not our problem! Nobody could accuse us, we made
102 all that we could make. Even if it is your gated who injected
103 fatal route to network, even if it were you who configured
104 fatal static route: you are innocent. :-)
108 3. Really, ipv4/ipip.c, ipv4/ip_gre.c and ipv6/sit.c contain
109 practically identical code. It would be good to glue them
110 together, but it is not very evident, how to make them modular.
111 sit is integral part of IPv6, ipip and gre are naturally modular.
112 We could extract common parts (hash table, ioctl etc)
113 to a separate module (ip_tunnel.c).
118 static int ipgre_tunnel_init(struct net_device *dev);
119 static void ipgre_tunnel_setup(struct net_device *dev);
121 /* Fallback tunnel: no source, no destination, no key, no options */
123 static int ipgre_fb_tunnel_init(struct net_device *dev);
125 static struct net_device *ipgre_fb_tunnel_dev;
127 /* Tunnel hash table */
137 We require exact key match i.e. if a key is present in packet
138 it will match only tunnel with the same key; if it is not present,
139 it will match only keyless tunnel.
141 All keysless packets, if not matched configured keyless tunnels
142 will match fallback tunnel.
146 #define HASH(addr) ((addr^(addr>>4))&0xF)
148 static struct ip_tunnel *tunnels[4][HASH_SIZE];
150 #define tunnels_r_l (tunnels[3])
151 #define tunnels_r (tunnels[2])
152 #define tunnels_l (tunnels[1])
153 #define tunnels_wc (tunnels[0])
155 static DEFINE_RWLOCK(ipgre_lock);
157 /* Given src, dst and key, find appropriate for input tunnel. */
159 static struct ip_tunnel * ipgre_tunnel_lookup(u32 remote, u32 local, u32 key)
161 unsigned h0 = HASH(remote);
162 unsigned h1 = HASH(key);
165 for (t = tunnels_r_l[h0^h1]; t; t = t->next) {
166 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr) {
167 if (t->parms.i_key == key && (t->dev->flags&IFF_UP))
171 for (t = tunnels_r[h0^h1]; t; t = t->next) {
172 if (remote == t->parms.iph.daddr) {
173 if (t->parms.i_key == key && (t->dev->flags&IFF_UP))
177 for (t = tunnels_l[h1]; t; t = t->next) {
178 if (local == t->parms.iph.saddr ||
179 (local == t->parms.iph.daddr && MULTICAST(local))) {
180 if (t->parms.i_key == key && (t->dev->flags&IFF_UP))
184 for (t = tunnels_wc[h1]; t; t = t->next) {
185 if (t->parms.i_key == key && (t->dev->flags&IFF_UP))
189 if (ipgre_fb_tunnel_dev->flags&IFF_UP)
190 return ipgre_fb_tunnel_dev->priv;
194 static struct ip_tunnel **ipgre_bucket(struct ip_tunnel *t)
196 u32 remote = t->parms.iph.daddr;
197 u32 local = t->parms.iph.saddr;
198 u32 key = t->parms.i_key;
199 unsigned h = HASH(key);
204 if (remote && !MULTICAST(remote)) {
209 return &tunnels[prio][h];
212 static void ipgre_tunnel_link(struct ip_tunnel *t)
214 struct ip_tunnel **tp = ipgre_bucket(t);
217 write_lock_bh(&ipgre_lock);
219 write_unlock_bh(&ipgre_lock);
222 static void ipgre_tunnel_unlink(struct ip_tunnel *t)
224 struct ip_tunnel **tp;
226 for (tp = ipgre_bucket(t); *tp; tp = &(*tp)->next) {
228 write_lock_bh(&ipgre_lock);
230 write_unlock_bh(&ipgre_lock);
236 static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int create)
238 u32 remote = parms->iph.daddr;
239 u32 local = parms->iph.saddr;
240 u32 key = parms->i_key;
241 struct ip_tunnel *t, **tp, *nt;
242 struct net_device *dev;
243 unsigned h = HASH(key);
249 if (remote && !MULTICAST(remote)) {
253 for (tp = &tunnels[prio][h]; (t = *tp) != NULL; tp = &t->next) {
254 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr) {
255 if (key == t->parms.i_key)
263 strlcpy(name, parms->name, IFNAMSIZ);
266 for (i=1; i<100; i++) {
267 sprintf(name, "gre%d", i);
268 if (__dev_get_by_name(name) == NULL)
275 dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
279 dev->init = ipgre_tunnel_init;
283 if (register_netdevice(dev) < 0) {
292 ipgre_tunnel_link(nt);
293 /* Do not decrement MOD_USE_COUNT here. */
300 static void ipgre_tunnel_uninit(struct net_device *dev)
302 ipgre_tunnel_unlink((struct ip_tunnel*)dev->priv);
307 static void ipgre_err(struct sk_buff *skb, u32 info)
309 #ifndef I_WISH_WORLD_WERE_PERFECT
311 /* It is not :-( All the routers (except for Linux) return only
312 8 bytes of packet payload. It means, that precise relaying of
313 ICMP in the real Internet is absolutely infeasible.
315 Moreover, Cisco "wise men" put GRE key to the third word
316 in GRE header. It makes impossible maintaining even soft state for keyed
317 GRE tunnels with enabled checksum. Tell them "thank you".
319 Well, I wonder, rfc1812 was written by Cisco employee,
320 what the hell these idiots break standrads established
324 struct iphdr *iph = (struct iphdr*)skb->data;
325 u16 *p = (u16*)(skb->data+(iph->ihl<<2));
326 int grehlen = (iph->ihl<<2) + 4;
327 int type = skb->h.icmph->type;
328 int code = skb->h.icmph->code;
333 if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
334 if (flags&(GRE_VERSION|GRE_ROUTING))
343 /* If only 8 bytes returned, keyed message will be dropped here */
344 if (skb_headlen(skb) < grehlen)
349 case ICMP_PARAMETERPROB:
352 case ICMP_DEST_UNREACH:
355 case ICMP_PORT_UNREACH:
356 /* Impossible event. */
358 case ICMP_FRAG_NEEDED:
359 /* Soft state for pmtu is maintained by IP core. */
362 /* All others are translated to HOST_UNREACH.
363 rfc2003 contains "deep thoughts" about NET_UNREACH,
364 I believe they are just ether pollution. --ANK
369 case ICMP_TIME_EXCEEDED:
370 if (code != ICMP_EXC_TTL)
375 read_lock(&ipgre_lock);
376 t = ipgre_tunnel_lookup(iph->daddr, iph->saddr, (flags&GRE_KEY) ? *(((u32*)p) + (grehlen>>2) - 1) : 0);
377 if (t == NULL || t->parms.iph.daddr == 0 || MULTICAST(t->parms.iph.daddr))
380 if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
383 if (jiffies - t->err_time < IPTUNNEL_ERR_TIMEO)
387 t->err_time = jiffies;
389 read_unlock(&ipgre_lock);
392 struct iphdr *iph = (struct iphdr*)dp;
394 u16 *p = (u16*)(dp+(iph->ihl<<2));
395 int type = skb->h.icmph->type;
396 int code = skb->h.icmph->code;
401 int grehlen = (iph->ihl<<2) + 4;
402 struct sk_buff *skb2;
406 if (p[1] != htons(ETH_P_IP))
410 if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) {
411 if (flags&(GRE_VERSION|GRE_ROUTING))
420 if (len < grehlen + sizeof(struct iphdr))
422 eiph = (struct iphdr*)(dp + grehlen);
427 case ICMP_PARAMETERPROB:
428 if (skb->h.icmph->un.gateway < (iph->ihl<<2))
431 /* So... This guy found something strange INSIDE encapsulated
432 packet. Well, he is fool, but what can we do ?
434 rel_type = ICMP_PARAMETERPROB;
435 rel_info = skb->h.icmph->un.gateway - grehlen;
438 case ICMP_DEST_UNREACH:
441 case ICMP_PORT_UNREACH:
442 /* Impossible event. */
444 case ICMP_FRAG_NEEDED:
445 /* And it is the only really necessary thing :-) */
446 rel_info = ntohs(skb->h.icmph->un.frag.mtu);
447 if (rel_info < grehlen+68)
450 /* BSD 4.2 MORE DOES NOT EXIST IN NATURE. */
451 if (rel_info > ntohs(eiph->tot_len))
455 /* All others are translated to HOST_UNREACH.
456 rfc2003 contains "deep thoughts" about NET_UNREACH,
457 I believe, it is just ether pollution. --ANK
459 rel_type = ICMP_DEST_UNREACH;
460 rel_code = ICMP_HOST_UNREACH;
464 case ICMP_TIME_EXCEEDED:
465 if (code != ICMP_EXC_TTL)
470 /* Prepare fake skb to feed it to icmp_send */
471 skb2 = skb_clone(skb, GFP_ATOMIC);
474 dst_release(skb2->dst);
476 skb_pull(skb2, skb->data - (u8*)eiph);
477 skb2->nh.raw = skb2->data;
479 /* Try to guess incoming interface */
480 memset(&fl, 0, sizeof(fl));
481 fl.fl4_dst = eiph->saddr;
482 fl.fl4_tos = RT_TOS(eiph->tos);
483 fl.proto = IPPROTO_GRE;
484 if (ip_route_output_key(&rt, &fl)) {
488 skb2->dev = rt->u.dst.dev;
490 /* route "incoming" packet */
491 if (rt->rt_flags&RTCF_LOCAL) {
494 fl.fl4_dst = eiph->daddr;
495 fl.fl4_src = eiph->saddr;
496 fl.fl4_tos = eiph->tos;
497 if (ip_route_output_key(&rt, &fl) ||
498 rt->u.dst.dev->type != ARPHRD_IPGRE) {
505 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos, skb2->dev) ||
506 skb2->dst->dev->type != ARPHRD_IPGRE) {
512 /* change mtu on this route */
513 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
514 if (rel_info > dst_pmtu(skb2->dst)) {
518 skb2->dst->ops->update_pmtu(skb2->dst, rel_info);
519 rel_info = htonl(rel_info);
520 } else if (type == ICMP_TIME_EXCEEDED) {
521 struct ip_tunnel *t = (struct ip_tunnel*)skb2->dev->priv;
522 if (t->parms.iph.ttl) {
523 rel_type = ICMP_DEST_UNREACH;
524 rel_code = ICMP_HOST_UNREACH;
528 icmp_send(skb2, rel_type, rel_code, rel_info);
533 static inline void ipgre_ecn_decapsulate(struct iphdr *iph, struct sk_buff *skb)
535 if (INET_ECN_is_ce(iph->tos)) {
536 if (skb->protocol == htons(ETH_P_IP)) {
537 IP_ECN_set_ce(skb->nh.iph);
538 } else if (skb->protocol == htons(ETH_P_IPV6)) {
539 IP6_ECN_set_ce(skb->nh.ipv6h);
545 ipgre_ecn_encapsulate(u8 tos, struct iphdr *old_iph, struct sk_buff *skb)
548 if (skb->protocol == htons(ETH_P_IP))
549 inner = old_iph->tos;
550 else if (skb->protocol == htons(ETH_P_IPV6))
551 inner = ipv6_get_dsfield((struct ipv6hdr *)old_iph);
552 return INET_ECN_encapsulate(tos, inner);
555 static int ipgre_rcv(struct sk_buff *skb)
563 struct ip_tunnel *tunnel;
566 if (!pskb_may_pull(skb, 16))
573 if (flags&(GRE_CSUM|GRE_KEY|GRE_ROUTING|GRE_SEQ|GRE_VERSION)) {
574 /* - Version must be 0.
575 - We do not support routing headers.
577 if (flags&(GRE_VERSION|GRE_ROUTING))
580 if (flags&GRE_CSUM) {
581 if (skb->ip_summed == CHECKSUM_HW) {
582 csum = (u16)csum_fold(skb->csum);
584 skb->ip_summed = CHECKSUM_NONE;
586 if (skb->ip_summed == CHECKSUM_NONE) {
587 skb->csum = skb_checksum(skb, 0, skb->len, 0);
588 skb->ip_summed = CHECKSUM_HW;
589 csum = (u16)csum_fold(skb->csum);
594 key = *(u32*)(h + offset);
598 seqno = ntohl(*(u32*)(h + offset));
603 read_lock(&ipgre_lock);
604 if ((tunnel = ipgre_tunnel_lookup(iph->saddr, iph->daddr, key)) != NULL) {
607 skb->protocol = *(u16*)(h + 2);
608 /* WCCP version 1 and 2 protocol decoding.
609 * - Change protocol to IP
610 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
613 skb->protocol == __constant_htons(ETH_P_WCCP)) {
614 skb->protocol = __constant_htons(ETH_P_IP);
615 if ((*(h + offset) & 0xF0) != 0x40)
619 skb->mac.raw = skb->nh.raw;
620 skb->nh.raw = __pskb_pull(skb, offset);
621 memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
622 if (skb->ip_summed == CHECKSUM_HW)
623 skb->csum = csum_sub(skb->csum,
624 csum_partial(skb->mac.raw, skb->nh.raw-skb->mac.raw, 0));
625 skb->pkt_type = PACKET_HOST;
626 #ifdef CONFIG_NET_IPGRE_BROADCAST
627 if (MULTICAST(iph->daddr)) {
628 /* Looped back packet, drop it! */
629 if (((struct rtable*)skb->dst)->fl.iif == 0)
631 tunnel->stat.multicast++;
632 skb->pkt_type = PACKET_BROADCAST;
636 if (((flags&GRE_CSUM) && csum) ||
637 (!(flags&GRE_CSUM) && tunnel->parms.i_flags&GRE_CSUM)) {
638 tunnel->stat.rx_crc_errors++;
639 tunnel->stat.rx_errors++;
642 if (tunnel->parms.i_flags&GRE_SEQ) {
643 if (!(flags&GRE_SEQ) ||
644 (tunnel->i_seqno && (s32)(seqno - tunnel->i_seqno) < 0)) {
645 tunnel->stat.rx_fifo_errors++;
646 tunnel->stat.rx_errors++;
649 tunnel->i_seqno = seqno + 1;
651 tunnel->stat.rx_packets++;
652 tunnel->stat.rx_bytes += skb->len;
653 skb->dev = tunnel->dev;
654 dst_release(skb->dst);
657 ipgre_ecn_decapsulate(iph, skb);
659 read_unlock(&ipgre_lock);
662 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PROT_UNREACH, 0);
665 read_unlock(&ipgre_lock);
671 static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
673 struct ip_tunnel *tunnel = (struct ip_tunnel*)dev->priv;
674 struct net_device_stats *stats = &tunnel->stat;
675 struct iphdr *old_iph = skb->nh.iph;
679 struct rtable *rt; /* Route to the other host */
680 struct net_device *tdev; /* Device to other host */
681 struct iphdr *iph; /* Our new IP header */
682 int max_headroom; /* The extra header space needed */
687 if (tunnel->recursion++) {
688 tunnel->stat.collisions++;
692 if (dev->hard_header) {
694 tiph = (struct iphdr*)skb->data;
696 gre_hlen = tunnel->hlen;
697 tiph = &tunnel->parms.iph;
700 if ((dst = tiph->daddr) == 0) {
703 if (skb->dst == NULL) {
704 tunnel->stat.tx_fifo_errors++;
708 if (skb->protocol == htons(ETH_P_IP)) {
709 rt = (struct rtable*)skb->dst;
710 if ((dst = rt->rt_gateway) == 0)
714 else if (skb->protocol == htons(ETH_P_IPV6)) {
715 struct in6_addr *addr6;
717 struct neighbour *neigh = skb->dst->neighbour;
722 addr6 = (struct in6_addr*)&neigh->primary_key;
723 addr_type = ipv6_addr_type(addr6);
725 if (addr_type == IPV6_ADDR_ANY) {
726 addr6 = &skb->nh.ipv6h->daddr;
727 addr_type = ipv6_addr_type(addr6);
730 if ((addr_type & IPV6_ADDR_COMPATv4) == 0)
733 dst = addr6->s6_addr32[3];
742 if (skb->protocol == htons(ETH_P_IP))
748 struct flowi fl = { .oif = tunnel->parms.link,
751 .saddr = tiph->saddr,
752 .tos = RT_TOS(tos) } },
753 .proto = IPPROTO_GRE };
754 if (ip_route_output_key(&rt, &fl)) {
755 tunnel->stat.tx_carrier_errors++;
759 tdev = rt->u.dst.dev;
763 tunnel->stat.collisions++;
769 mtu = dst_pmtu(&rt->u.dst) - tunnel->hlen;
771 mtu = skb->dst ? dst_pmtu(skb->dst) : dev->mtu;
774 skb->dst->ops->update_pmtu(skb->dst, mtu);
776 if (skb->protocol == htons(ETH_P_IP)) {
777 df |= (old_iph->frag_off&htons(IP_DF));
779 if ((old_iph->frag_off&htons(IP_DF)) &&
780 mtu < ntohs(old_iph->tot_len)) {
781 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
787 else if (skb->protocol == htons(ETH_P_IPV6)) {
788 struct rt6_info *rt6 = (struct rt6_info*)skb->dst;
790 if (rt6 && mtu < dst_pmtu(skb->dst) && mtu >= IPV6_MIN_MTU) {
791 if ((tunnel->parms.iph.daddr && !MULTICAST(tunnel->parms.iph.daddr)) ||
792 rt6->rt6i_dst.plen == 128) {
793 rt6->rt6i_flags |= RTF_MODIFIED;
794 skb->dst->metrics[RTAX_MTU-1] = mtu;
798 if (mtu >= IPV6_MIN_MTU && mtu < skb->len - tunnel->hlen + gre_hlen) {
799 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
806 if (tunnel->err_count > 0) {
807 if (jiffies - tunnel->err_time < IPTUNNEL_ERR_TIMEO) {
810 dst_link_failure(skb);
812 tunnel->err_count = 0;
815 max_headroom = LL_RESERVED_SPACE(tdev) + gre_hlen;
817 if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) {
818 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
827 skb_set_owner_w(new_skb, skb->sk);
830 old_iph = skb->nh.iph;
833 skb->h.raw = skb->nh.raw;
834 skb->nh.raw = skb_push(skb, gre_hlen);
835 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
836 dst_release(skb->dst);
837 skb->dst = &rt->u.dst;
840 * Push down and install the IPIP header.
845 iph->ihl = sizeof(struct iphdr) >> 2;
847 iph->protocol = IPPROTO_GRE;
848 iph->tos = ipgre_ecn_encapsulate(tos, old_iph, skb);
849 iph->daddr = rt->rt_dst;
850 iph->saddr = rt->rt_src;
852 if ((iph->ttl = tiph->ttl) == 0) {
853 if (skb->protocol == htons(ETH_P_IP))
854 iph->ttl = old_iph->ttl;
856 else if (skb->protocol == htons(ETH_P_IPV6))
857 iph->ttl = ((struct ipv6hdr*)old_iph)->hop_limit;
860 iph->ttl = dst_metric(&rt->u.dst, RTAX_HOPLIMIT);
863 ((u16*)(iph+1))[0] = tunnel->parms.o_flags;
864 ((u16*)(iph+1))[1] = skb->protocol;
866 if (tunnel->parms.o_flags&(GRE_KEY|GRE_CSUM|GRE_SEQ)) {
867 u32 *ptr = (u32*)(((u8*)iph) + tunnel->hlen - 4);
869 if (tunnel->parms.o_flags&GRE_SEQ) {
871 *ptr = htonl(tunnel->o_seqno);
874 if (tunnel->parms.o_flags&GRE_KEY) {
875 *ptr = tunnel->parms.o_key;
878 if (tunnel->parms.o_flags&GRE_CSUM) {
880 *(__u16*)ptr = ip_compute_csum((void*)(iph+1), skb->len - sizeof(struct iphdr));
891 dst_link_failure(skb);
901 ipgre_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
904 struct ip_tunnel_parm p;
910 if (dev == ipgre_fb_tunnel_dev) {
911 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
915 t = ipgre_tunnel_locate(&p, 0);
918 t = (struct ip_tunnel*)dev->priv;
919 memcpy(&p, &t->parms, sizeof(p));
920 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
927 if (!capable(CAP_NET_ADMIN))
931 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
935 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_GRE ||
936 p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)) ||
937 ((p.i_flags|p.o_flags)&(GRE_VERSION|GRE_ROUTING)))
940 p.iph.frag_off |= htons(IP_DF);
942 if (!(p.i_flags&GRE_KEY))
944 if (!(p.o_flags&GRE_KEY))
947 t = ipgre_tunnel_locate(&p, cmd == SIOCADDTUNNEL);
949 if (dev != ipgre_fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
958 t = (struct ip_tunnel*)dev->priv;
960 if (MULTICAST(p.iph.daddr))
961 nflags = IFF_BROADCAST;
962 else if (p.iph.daddr)
963 nflags = IFF_POINTOPOINT;
965 if ((dev->flags^nflags)&(IFF_POINTOPOINT|IFF_BROADCAST)) {
969 ipgre_tunnel_unlink(t);
970 t->parms.iph.saddr = p.iph.saddr;
971 t->parms.iph.daddr = p.iph.daddr;
972 t->parms.i_key = p.i_key;
973 t->parms.o_key = p.o_key;
974 memcpy(dev->dev_addr, &p.iph.saddr, 4);
975 memcpy(dev->broadcast, &p.iph.daddr, 4);
976 ipgre_tunnel_link(t);
977 netdev_state_change(dev);
983 if (cmd == SIOCCHGTUNNEL) {
984 t->parms.iph.ttl = p.iph.ttl;
985 t->parms.iph.tos = p.iph.tos;
986 t->parms.iph.frag_off = p.iph.frag_off;
988 if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
991 err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
996 if (!capable(CAP_NET_ADMIN))
999 if (dev == ipgre_fb_tunnel_dev) {
1001 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
1004 if ((t = ipgre_tunnel_locate(&p, 0)) == NULL)
1007 if (t == ipgre_fb_tunnel_dev->priv)
1011 err = unregister_netdevice(dev);
1022 static struct net_device_stats *ipgre_tunnel_get_stats(struct net_device *dev)
1024 return &(((struct ip_tunnel*)dev->priv)->stat);
1027 static int ipgre_tunnel_change_mtu(struct net_device *dev, int new_mtu)
1029 struct ip_tunnel *tunnel = (struct ip_tunnel*)dev->priv;
1030 if (new_mtu < 68 || new_mtu > 0xFFF8 - tunnel->hlen)
1036 #ifdef CONFIG_NET_IPGRE_BROADCAST
1037 /* Nice toy. Unfortunately, useless in real life :-)
1038 It allows to construct virtual multiprotocol broadcast "LAN"
1039 over the Internet, provided multicast routing is tuned.
1042 I have no idea was this bicycle invented before me,
1043 so that I had to set ARPHRD_IPGRE to a random value.
1044 I have an impression, that Cisco could make something similar,
1045 but this feature is apparently missing in IOS<=11.2(8).
1047 I set up 10.66.66/24 and fec0:6666:6666::0/96 as virtual networks
1048 with broadcast 224.66.66.66. If you have access to mbone, play with me :-)
1050 ping -t 255 224.66.66.66
1052 If nobody answers, mbone does not work.
1054 ip tunnel add Universe mode gre remote 224.66.66.66 local <Your_real_addr> ttl 255
1055 ip addr add 10.66.66.<somewhat>/24 dev Universe
1056 ifconfig Universe up
1057 ifconfig Universe add fe80::<Your_real_addr>/10
1058 ifconfig Universe add fec0:6666:6666::<Your_real_addr>/96
1061 ftp fec0:6666:6666::193.233.7.65
1066 static int ipgre_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
1067 void *daddr, void *saddr, unsigned len)
1069 struct ip_tunnel *t = (struct ip_tunnel*)dev->priv;
1070 struct iphdr *iph = (struct iphdr *)skb_push(skb, t->hlen);
1071 u16 *p = (u16*)(iph+1);
1073 memcpy(iph, &t->parms.iph, sizeof(struct iphdr));
1074 p[0] = t->parms.o_flags;
1078 * Set the source hardware address.
1082 memcpy(&iph->saddr, saddr, 4);
1085 memcpy(&iph->daddr, daddr, 4);
1088 if (iph->daddr && !MULTICAST(iph->daddr))
1094 static int ipgre_open(struct net_device *dev)
1096 struct ip_tunnel *t = (struct ip_tunnel*)dev->priv;
1098 if (MULTICAST(t->parms.iph.daddr)) {
1099 struct flowi fl = { .oif = t->parms.link,
1101 { .daddr = t->parms.iph.daddr,
1102 .saddr = t->parms.iph.saddr,
1103 .tos = RT_TOS(t->parms.iph.tos) } },
1104 .proto = IPPROTO_GRE };
1106 if (ip_route_output_key(&rt, &fl))
1107 return -EADDRNOTAVAIL;
1108 dev = rt->u.dst.dev;
1110 if (__in_dev_get(dev) == NULL)
1111 return -EADDRNOTAVAIL;
1112 t->mlink = dev->ifindex;
1113 ip_mc_inc_group(__in_dev_get(dev), t->parms.iph.daddr);
1118 static int ipgre_close(struct net_device *dev)
1120 struct ip_tunnel *t = (struct ip_tunnel*)dev->priv;
1121 if (MULTICAST(t->parms.iph.daddr) && t->mlink) {
1122 struct in_device *in_dev = inetdev_by_index(t->mlink);
1124 ip_mc_dec_group(in_dev, t->parms.iph.daddr);
1133 static void ipgre_tunnel_setup(struct net_device *dev)
1135 SET_MODULE_OWNER(dev);
1136 dev->uninit = ipgre_tunnel_uninit;
1137 dev->destructor = free_netdev;
1138 dev->hard_start_xmit = ipgre_tunnel_xmit;
1139 dev->get_stats = ipgre_tunnel_get_stats;
1140 dev->do_ioctl = ipgre_tunnel_ioctl;
1141 dev->change_mtu = ipgre_tunnel_change_mtu;
1143 dev->type = ARPHRD_IPGRE;
1144 dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr) + 4;
1145 dev->mtu = 1500 - sizeof(struct iphdr) - 4;
1146 dev->flags = IFF_NOARP;
1151 static int ipgre_tunnel_init(struct net_device *dev)
1153 struct net_device *tdev = NULL;
1154 struct ip_tunnel *tunnel;
1156 int hlen = LL_MAX_HEADER;
1158 int addend = sizeof(struct iphdr) + 4;
1160 tunnel = (struct ip_tunnel*)dev->priv;
1161 iph = &tunnel->parms.iph;
1164 strcpy(tunnel->parms.name, dev->name);
1166 memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
1167 memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
1169 /* Guess output device to choose reasonable mtu and hard_header_len */
1172 struct flowi fl = { .oif = tunnel->parms.link,
1174 { .daddr = iph->daddr,
1175 .saddr = iph->saddr,
1176 .tos = RT_TOS(iph->tos) } },
1177 .proto = IPPROTO_GRE };
1179 if (!ip_route_output_key(&rt, &fl)) {
1180 tdev = rt->u.dst.dev;
1184 dev->flags |= IFF_POINTOPOINT;
1186 #ifdef CONFIG_NET_IPGRE_BROADCAST
1187 if (MULTICAST(iph->daddr)) {
1190 dev->flags = IFF_BROADCAST;
1191 dev->hard_header = ipgre_header;
1192 dev->open = ipgre_open;
1193 dev->stop = ipgre_close;
1198 if (!tdev && tunnel->parms.link)
1199 tdev = __dev_get_by_index(tunnel->parms.link);
1202 hlen = tdev->hard_header_len;
1205 dev->iflink = tunnel->parms.link;
1207 /* Precalculate GRE options length */
1208 if (tunnel->parms.o_flags&(GRE_CSUM|GRE_KEY|GRE_SEQ)) {
1209 if (tunnel->parms.o_flags&GRE_CSUM)
1211 if (tunnel->parms.o_flags&GRE_KEY)
1213 if (tunnel->parms.o_flags&GRE_SEQ)
1216 dev->hard_header_len = hlen + addend;
1217 dev->mtu = mtu - addend;
1218 tunnel->hlen = addend;
1222 int __init ipgre_fb_tunnel_init(struct net_device *dev)
1224 struct ip_tunnel *tunnel = (struct ip_tunnel*)dev->priv;
1225 struct iphdr *iph = &tunnel->parms.iph;
1228 strcpy(tunnel->parms.name, dev->name);
1231 iph->protocol = IPPROTO_GRE;
1233 tunnel->hlen = sizeof(struct iphdr) + 4;
1236 tunnels_wc[0] = tunnel;
1241 static struct net_protocol ipgre_protocol = {
1242 .handler = ipgre_rcv,
1243 .err_handler = ipgre_err,
1248 * And now the modules code and kernel interface.
1251 static int __init ipgre_init(void)
1255 printk(KERN_INFO "GRE over IPv4 tunneling driver\n");
1257 if (inet_add_protocol(&ipgre_protocol, IPPROTO_GRE) < 0) {
1258 printk(KERN_INFO "ipgre init: can't add protocol\n");
1262 ipgre_fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel), "gre0",
1263 ipgre_tunnel_setup);
1264 if (!ipgre_fb_tunnel_dev) {
1269 ipgre_fb_tunnel_dev->init = ipgre_fb_tunnel_init;
1271 if ((err = register_netdev(ipgre_fb_tunnel_dev)))
1276 free_netdev(ipgre_fb_tunnel_dev);
1278 inet_del_protocol(&ipgre_protocol, IPPROTO_GRE);
1282 static void ipgre_fini(void)
1284 if (inet_del_protocol(&ipgre_protocol, IPPROTO_GRE) < 0)
1285 printk(KERN_INFO "ipgre close: can't remove protocol\n");
1287 unregister_netdev(ipgre_fb_tunnel_dev);
1290 module_init(ipgre_init);
1291 module_exit(ipgre_fini);
1292 MODULE_LICENSE("GPL");