]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/network/networkd-netdev-tunnel.c
Merge pull request #695 from poettering/journal-fixes
[thirdparty/systemd.git] / src / network / networkd-netdev-tunnel.c
1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
2
3 /***
4 This file is part of systemd.
5
6 Copyright 2014 Susant Sahani
7
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
12
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
17
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20 ***/
21
22 #include <arpa/inet.h>
23 #include <net/if.h>
24 #include <linux/ip.h>
25 #include <linux/if_tunnel.h>
26 #include <linux/ip6_tunnel.h>
27
28 #include "sd-netlink.h"
29 #include "networkd-netdev-tunnel.h"
30 #include "networkd-link.h"
31 #include "util.h"
32 #include "missing.h"
33 #include "conf-parser.h"
34
35 #define DEFAULT_TNL_HOP_LIMIT 64
36 #define IP6_FLOWINFO_FLOWLABEL htonl(0x000FFFFF)
37
38 static const char* const ip6tnl_mode_table[_NETDEV_IP6_TNL_MODE_MAX] = {
39 [NETDEV_IP6_TNL_MODE_IP6IP6] = "ip6ip6",
40 [NETDEV_IP6_TNL_MODE_IPIP6] = "ipip6",
41 [NETDEV_IP6_TNL_MODE_ANYIP6] = "any",
42 };
43
44 DEFINE_STRING_TABLE_LOOKUP(ip6tnl_mode, Ip6TnlMode);
45 DEFINE_CONFIG_PARSE_ENUM(config_parse_ip6tnl_mode, ip6tnl_mode, Ip6TnlMode, "Failed to parse ip6 tunnel Mode");
46
47 static int netdev_ipip_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
48 Tunnel *t = IPIP(netdev);
49 int r;
50
51 assert(netdev);
52 assert(link);
53 assert(m);
54 assert(t);
55 assert(t->family == AF_INET);
56
57 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_LINK, link->ifindex);
58 if (r < 0)
59 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
60
61 r = sd_netlink_message_append_in_addr(m, IFLA_IPTUN_LOCAL, &t->local.in);
62 if (r < 0)
63 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
64
65 r = sd_netlink_message_append_in_addr(m, IFLA_IPTUN_REMOTE, &t->remote.in);
66 if (r < 0)
67 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_REMOTE attribute: %m");
68
69 r = sd_netlink_message_append_u8(m, IFLA_IPTUN_TTL, t->ttl);
70 if (r < 0)
71 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_TTL attribute: %m");
72
73 r = sd_netlink_message_append_u8(m, IFLA_IPTUN_PMTUDISC, t->pmtudisc);
74 if (r < 0)
75 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_PMTUDISC attribute: %m");
76
77 return r;
78 }
79
80 static int netdev_sit_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
81 Tunnel *t = SIT(netdev);
82 int r;
83
84 assert(netdev);
85 assert(link);
86 assert(m);
87 assert(t);
88 assert(t->family == AF_INET);
89
90 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_LINK, link->ifindex);
91 if (r < 0)
92 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
93
94 r = sd_netlink_message_append_in_addr(m, IFLA_IPTUN_LOCAL, &t->local.in);
95 if (r < 0)
96 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
97
98 r = sd_netlink_message_append_in_addr(m, IFLA_IPTUN_REMOTE, &t->remote.in);
99 if (r < 0)
100 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_REMOTE attribute: %m");
101
102 r = sd_netlink_message_append_u8(m, IFLA_IPTUN_TTL, t->ttl);
103 if (r < 0)
104 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_TTL attribute: %m");
105
106 r = sd_netlink_message_append_u8(m, IFLA_IPTUN_PMTUDISC, t->pmtudisc);
107 if (r < 0)
108 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_PMTUDISC attribute: %m");
109
110 return r;
111 }
112
113 static int netdev_gre_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
114 Tunnel *t;
115 int r;
116
117 assert(netdev);
118
119 if (netdev->kind == NETDEV_KIND_GRE)
120 t = GRE(netdev);
121 else
122 t = GRETAP(netdev);
123
124 assert(t);
125 assert(t->family == AF_INET);
126 assert(link);
127 assert(m);
128
129 r = sd_netlink_message_append_u32(m, IFLA_GRE_LINK, link->ifindex);
130 if (r < 0)
131 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LINK attribute: %m");
132
133 r = sd_netlink_message_append_in_addr(m, IFLA_GRE_LOCAL, &t->local.in);
134 if (r < 0)
135 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LOCAL attribute: %m");
136
137 r = sd_netlink_message_append_in_addr(m, IFLA_GRE_REMOTE, &t->remote.in);
138 if (r < 0)
139 log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_REMOTE attribute: %m");
140
141 r = sd_netlink_message_append_u8(m, IFLA_GRE_TTL, t->ttl);
142 if (r < 0)
143 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_TTL attribute: %m");
144
145 r = sd_netlink_message_append_u8(m, IFLA_GRE_TOS, t->tos);
146 if (r < 0)
147 log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_TOS attribute: %m");
148
149 r = sd_netlink_message_append_u8(m, IFLA_GRE_PMTUDISC, t->pmtudisc);
150 if (r < 0)
151 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_PMTUDISC attribute: %m");
152
153 return r;
154 }
155
156 static int netdev_ip6gre_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
157 Tunnel *t;
158 int r;
159
160 assert(netdev);
161
162 if (netdev->kind == NETDEV_KIND_IP6GRE)
163 t = IP6GRE(netdev);
164 else
165 t = IP6GRETAP(netdev);
166
167 assert(t);
168 assert(t->family == AF_INET6);
169 assert(link);
170 assert(m);
171
172 r = sd_netlink_message_append_u32(m, IFLA_GRE_LINK, link->ifindex);
173 if (r < 0)
174 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LINK attribute: %m");
175
176 r = sd_netlink_message_append_in6_addr(m, IFLA_GRE_LOCAL, &t->local.in6);
177 if (r < 0)
178 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LOCAL attribute: %m");
179
180 r = sd_netlink_message_append_in6_addr(m, IFLA_GRE_REMOTE, &t->remote.in6);
181 if (r < 0)
182 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_REMOTE attribute: %m");
183
184 r = sd_netlink_message_append_u8(m, IFLA_GRE_TTL, t->ttl);
185 if (r < 0)
186 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_TTL attribute: %m");
187
188 if (t->ipv6_flowlabel != _NETDEV_IPV6_FLOWLABEL_INVALID) {
189 r = sd_netlink_message_append_u32(m, IFLA_GRE_FLOWINFO, t->ipv6_flowlabel);
190 if (r < 0)
191 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_FLOWINFO attribute: %m");
192 }
193
194 r = sd_netlink_message_append_u32(m, IFLA_GRE_FLAGS, t->flags);
195 if (r < 0)
196 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_FLAGS attribute: %m");
197
198 return r;
199 }
200
201 static int netdev_vti_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
202 Tunnel *t = VTI(netdev);
203 int r;
204
205 assert(netdev);
206 assert(link);
207 assert(m);
208 assert(t);
209 assert(t->family == AF_INET);
210
211 r = sd_netlink_message_append_u32(m, IFLA_VTI_LINK, link->ifindex);
212 if (r < 0)
213 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
214
215 r = sd_netlink_message_append_in_addr(m, IFLA_VTI_LOCAL, &t->local.in);
216 if (r < 0)
217 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
218
219 r = sd_netlink_message_append_in_addr(m, IFLA_VTI_REMOTE, &t->remote.in);
220 if (r < 0)
221 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_REMOTE attribute: %m");
222
223 return r;
224 }
225
226 static int netdev_vti6_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
227 Tunnel *t = VTI6(netdev);
228 int r;
229
230 assert(netdev);
231 assert(link);
232 assert(m);
233 assert(t);
234 assert(t->family == AF_INET6);
235
236 r = sd_netlink_message_append_u32(m, IFLA_VTI_LINK, link->ifindex);
237 if (r < 0)
238 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
239
240 r = sd_netlink_message_append_in6_addr(m, IFLA_VTI_LOCAL, &t->local.in6);
241 if (r < 0)
242 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
243
244 r = sd_netlink_message_append_in6_addr(m, IFLA_VTI_REMOTE, &t->remote.in6);
245 if (r < 0)
246 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_REMOTE attribute: %m");
247
248 return r;
249 }
250
251 static int netdev_ip6tnl_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
252 Tunnel *t = IP6TNL(netdev);
253 uint8_t proto;
254 int r;
255
256 assert(netdev);
257 assert(link);
258 assert(m);
259 assert(t);
260 assert(t->family == AF_INET6);
261
262 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_LINK, link->ifindex);
263 if (r < 0)
264 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
265
266 r = sd_netlink_message_append_in6_addr(m, IFLA_IPTUN_LOCAL, &t->local.in6);
267 if (r < 0)
268 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
269
270 r = sd_netlink_message_append_in6_addr(m, IFLA_IPTUN_REMOTE, &t->remote.in6);
271 if (r < 0)
272 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_REMOTE attribute: %m");
273
274 r = sd_netlink_message_append_u8(m, IFLA_IPTUN_TTL, t->ttl);
275 if (r < 0)
276 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_TTL attribute: %m");
277
278 if (t->ipv6_flowlabel != _NETDEV_IPV6_FLOWLABEL_INVALID) {
279 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_FLOWINFO, t->ipv6_flowlabel);
280 if (r < 0)
281 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_FLOWINFO attribute: %m");
282 }
283
284 if (t->dscp)
285 t->flags |= IP6_TNL_F_RCV_DSCP_COPY;
286
287 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_FLAGS, t->flags);
288 if (r < 0)
289 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_FLAGS attribute: %m");
290
291 switch (t->ip6tnl_mode) {
292 case NETDEV_IP6_TNL_MODE_IP6IP6:
293 proto = IPPROTO_IPV6;
294 break;
295 case NETDEV_IP6_TNL_MODE_IPIP6:
296 proto = IPPROTO_IPIP;
297 break;
298 case NETDEV_IP6_TNL_MODE_ANYIP6:
299 default:
300 proto = 0;
301 break;
302 }
303
304 r = sd_netlink_message_append_u8(m, IFLA_IPTUN_PROTO, proto);
305 if (r < 0)
306 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_MODE attribute: %m");
307
308 return r;
309 }
310
311 static int netdev_tunnel_verify(NetDev *netdev, const char *filename) {
312 Tunnel *t = NULL;
313
314 assert(netdev);
315 assert(filename);
316
317 switch (netdev->kind) {
318 case NETDEV_KIND_IPIP:
319 t = IPIP(netdev);
320 break;
321 case NETDEV_KIND_SIT:
322 t = SIT(netdev);
323 break;
324 case NETDEV_KIND_GRE:
325 t = GRE(netdev);
326 break;
327 case NETDEV_KIND_GRETAP:
328 t = GRETAP(netdev);
329 break;
330 case NETDEV_KIND_IP6GRE:
331 t = IP6GRE(netdev);
332 break;
333 case NETDEV_KIND_IP6GRETAP:
334 t = IP6GRETAP(netdev);
335 break;
336 case NETDEV_KIND_VTI:
337 t = VTI(netdev);
338 break;
339 case NETDEV_KIND_VTI6:
340 t = VTI6(netdev);
341 break;
342 case NETDEV_KIND_IP6TNL:
343 t = IP6TNL(netdev);
344 break;
345 default:
346 assert_not_reached("Invalid tunnel kind");
347 }
348
349 assert(t);
350
351 if (t->remote.in.s_addr == INADDR_ANY) {
352 log_warning("Tunnel without remote address configured in %s. Ignoring", filename);
353 return -EINVAL;
354 }
355
356 if (t->family != AF_INET && t->family != AF_INET6) {
357 log_warning("Tunnel with invalid address family configured in %s. Ignoring", filename);
358 return -EINVAL;
359 }
360
361 if (netdev->kind == NETDEV_KIND_IP6TNL) {
362 if (t->ip6tnl_mode == _NETDEV_IP6_TNL_MODE_INVALID) {
363 log_warning("IP6 Tunnel without mode configured in %s. Ignoring", filename);
364 return -EINVAL;
365 }
366 }
367
368 return 0;
369 }
370
371 int config_parse_tunnel_address(const char *unit,
372 const char *filename,
373 unsigned line,
374 const char *section,
375 unsigned section_line,
376 const char *lvalue,
377 int ltype,
378 const char *rvalue,
379 void *data,
380 void *userdata) {
381 Tunnel *t = userdata;
382 union in_addr_union *addr = data, buffer;
383 int r, f;
384
385 assert(filename);
386 assert(lvalue);
387 assert(rvalue);
388 assert(data);
389
390 r = in_addr_from_string_auto(rvalue, &f, &buffer);
391 if (r < 0) {
392 log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Tunnel address is invalid, ignoring assignment: %s", rvalue);
393 return 0;
394 }
395
396 if (t->family != AF_UNSPEC && t->family != f) {
397 log_syntax(unit, LOG_ERR, filename, line, EINVAL, "Tunnel addresses incompatible, ignoring assignment: %s", rvalue);
398 return 0;
399 }
400
401 t->family = f;
402 *addr = buffer;
403
404 return 0;
405 }
406
407 static const char* const ipv6_flowlabel_table[_NETDEV_IPV6_FLOWLABEL_MAX] = {
408 [NETDEV_IPV6_FLOWLABEL_INHERIT] = "inherit",
409 };
410
411 DEFINE_STRING_TABLE_LOOKUP(ipv6_flowlabel, IPv6FlowLabel);
412
413 int config_parse_ipv6_flowlabel(const char* unit,
414 const char *filename,
415 unsigned line,
416 const char *section,
417 unsigned section_line,
418 const char *lvalue,
419 int ltype,
420 const char *rvalue,
421 void *data,
422 void *userdata) {
423 IPv6FlowLabel *ipv6_flowlabel = data;
424 Tunnel *t = userdata;
425 IPv6FlowLabel s;
426 int k = 0;
427 int r;
428
429 assert(filename);
430 assert(lvalue);
431 assert(rvalue);
432 assert(ipv6_flowlabel);
433
434 s = ipv6_flowlabel_from_string(rvalue);
435 if (s != _NETDEV_IPV6_FLOWLABEL_INVALID) {
436 *ipv6_flowlabel = IP6_FLOWINFO_FLOWLABEL;
437 t->flags |= IP6_TNL_F_USE_ORIG_FLOWLABEL;
438 } else {
439 r = config_parse_unsigned(unit, filename, line, section, section_line, lvalue, ltype, rvalue, &k, userdata);
440 if (r >= 0) {
441 if (k > 0xFFFFF)
442 log_syntax(unit, LOG_ERR, filename, line, k, "Failed to parse IPv6 flowlabel option, ignoring: %s", rvalue);
443 else {
444 *ipv6_flowlabel = htonl(k) & IP6_FLOWINFO_FLOWLABEL;
445 t->flags &= ~IP6_TNL_F_USE_ORIG_FLOWLABEL;
446 }
447 }
448 }
449
450 return 0;
451 }
452
453 static void ipip_init(NetDev *n) {
454 Tunnel *t = IPIP(n);
455
456 assert(n);
457 assert(t);
458
459 t->pmtudisc = true;
460 }
461
462 static void sit_init(NetDev *n) {
463 Tunnel *t = SIT(n);
464
465 assert(n);
466 assert(t);
467
468 t->pmtudisc = true;
469 }
470
471 static void vti_init(NetDev *n) {
472 Tunnel *t;
473
474 assert(n);
475
476 if (n->kind == NETDEV_KIND_VTI)
477 t = VTI(n);
478 else
479 t = VTI6(n);
480
481 assert(t);
482
483 t->pmtudisc = true;
484 }
485
486 static void gre_init(NetDev *n) {
487 Tunnel *t;
488
489 assert(n);
490
491 if (n->kind == NETDEV_KIND_GRE)
492 t = GRE(n);
493 else
494 t = GRETAP(n);
495
496 assert(t);
497
498 t->pmtudisc = true;
499 }
500
501 static void ip6gre_init(NetDev *n) {
502 Tunnel *t;
503
504 assert(n);
505
506 if (n->kind == NETDEV_KIND_IP6GRE)
507 t = IP6GRE(n);
508 else
509 t = IP6GRETAP(n);
510
511 assert(t);
512
513 t->ttl = DEFAULT_TNL_HOP_LIMIT;
514 }
515
516 static void ip6tnl_init(NetDev *n) {
517 Tunnel *t = IP6TNL(n);
518
519 assert(n);
520 assert(t);
521
522 t->ttl = DEFAULT_TNL_HOP_LIMIT;
523 t->encap_limit = IPV6_DEFAULT_TNL_ENCAP_LIMIT;
524 t->ip6tnl_mode = _NETDEV_IP6_TNL_MODE_INVALID;
525 t->ipv6_flowlabel = _NETDEV_IPV6_FLOWLABEL_INVALID;
526 }
527
528 const NetDevVTable ipip_vtable = {
529 .object_size = sizeof(Tunnel),
530 .init = ipip_init,
531 .sections = "Match\0NetDev\0Tunnel\0",
532 .fill_message_create = netdev_ipip_fill_message_create,
533 .create_type = NETDEV_CREATE_STACKED,
534 .config_verify = netdev_tunnel_verify,
535 };
536
537 const NetDevVTable sit_vtable = {
538 .object_size = sizeof(Tunnel),
539 .init = sit_init,
540 .sections = "Match\0NetDev\0Tunnel\0",
541 .fill_message_create = netdev_sit_fill_message_create,
542 .create_type = NETDEV_CREATE_STACKED,
543 .config_verify = netdev_tunnel_verify,
544 };
545
546 const NetDevVTable vti_vtable = {
547 .object_size = sizeof(Tunnel),
548 .init = vti_init,
549 .sections = "Match\0NetDev\0Tunnel\0",
550 .fill_message_create = netdev_vti_fill_message_create,
551 .create_type = NETDEV_CREATE_STACKED,
552 .config_verify = netdev_tunnel_verify,
553 };
554
555 const NetDevVTable vti6_vtable = {
556 .object_size = sizeof(Tunnel),
557 .init = vti_init,
558 .sections = "Match\0NetDev\0Tunnel\0",
559 .fill_message_create = netdev_vti6_fill_message_create,
560 .create_type = NETDEV_CREATE_STACKED,
561 .config_verify = netdev_tunnel_verify,
562 };
563
564 const NetDevVTable gre_vtable = {
565 .object_size = sizeof(Tunnel),
566 .init = gre_init,
567 .sections = "Match\0NetDev\0Tunnel\0",
568 .fill_message_create = netdev_gre_fill_message_create,
569 .create_type = NETDEV_CREATE_STACKED,
570 .config_verify = netdev_tunnel_verify,
571 };
572
573 const NetDevVTable gretap_vtable = {
574 .object_size = sizeof(Tunnel),
575 .init = gre_init,
576 .sections = "Match\0NetDev\0Tunnel\0",
577 .fill_message_create = netdev_gre_fill_message_create,
578 .create_type = NETDEV_CREATE_STACKED,
579 .config_verify = netdev_tunnel_verify,
580 };
581
582 const NetDevVTable ip6gre_vtable = {
583 .object_size = sizeof(Tunnel),
584 .init = ip6gre_init,
585 .sections = "Match\0NetDev\0Tunnel\0",
586 .fill_message_create = netdev_ip6gre_fill_message_create,
587 .create_type = NETDEV_CREATE_STACKED,
588 .config_verify = netdev_tunnel_verify,
589 };
590
591 const NetDevVTable ip6gretap_vtable = {
592 .object_size = sizeof(Tunnel),
593 .init = ip6gre_init,
594 .sections = "Match\0NetDev\0Tunnel\0",
595 .fill_message_create = netdev_ip6gre_fill_message_create,
596 .create_type = NETDEV_CREATE_STACKED,
597 .config_verify = netdev_tunnel_verify,
598 };
599
600 const NetDevVTable ip6tnl_vtable = {
601 .object_size = sizeof(Tunnel),
602 .init = ip6tnl_init,
603 .sections = "Match\0NetDev\0Tunnel\0",
604 .fill_message_create = netdev_ip6tnl_fill_message_create,
605 .create_type = NETDEV_CREATE_STACKED,
606 .config_verify = netdev_tunnel_verify,
607 };