1 // SPDX-License-Identifier: GPL-2.0
3 * XFRM virtual interface
5 * Copyright (C) 2018 secunet Security Networks AG
8 * Steffen Klassert <steffen.klassert@secunet.com>
11 #include <linux/module.h>
12 #include <linux/capability.h>
13 #include <linux/errno.h>
14 #include <linux/types.h>
15 #include <linux/sockios.h>
16 #include <linux/icmp.h>
20 #include <linux/net.h>
21 #include <linux/in6.h>
22 #include <linux/netdevice.h>
23 #include <linux/if_link.h>
24 #include <linux/if_arp.h>
25 #include <linux/icmpv6.h>
26 #include <linux/init.h>
27 #include <linux/route.h>
28 #include <linux/rtnetlink.h>
29 #include <linux/netfilter_ipv6.h>
30 #include <linux/slab.h>
31 #include <linux/hash.h>
33 #include <linux/uaccess.h>
34 #include <linux/atomic.h>
40 #include <net/ip6_route.h>
41 #include <net/ip_tunnels.h>
42 #include <net/addrconf.h>
44 #include <net/net_namespace.h>
45 #include <net/dst_metadata.h>
46 #include <net/netns/generic.h>
47 #include <linux/etherdevice.h>
49 static int xfrmi_dev_init(struct net_device
*dev
);
50 static void xfrmi_dev_setup(struct net_device
*dev
);
51 static struct rtnl_link_ops xfrmi_link_ops __read_mostly
;
52 static unsigned int xfrmi_net_id __read_mostly
;
53 static const struct net_device_ops xfrmi_netdev_ops
;
55 #define XFRMI_HASH_BITS 8
56 #define XFRMI_HASH_SIZE BIT(XFRMI_HASH_BITS)
59 /* lists for storing interfaces in use */
60 struct xfrm_if __rcu
*xfrmi
[XFRMI_HASH_SIZE
];
61 struct xfrm_if __rcu
*collect_md_xfrmi
;
64 static const struct nla_policy xfrm_lwt_policy
[LWT_XFRM_MAX
+ 1] = {
65 [LWT_XFRM_IF_ID
] = NLA_POLICY_MIN(NLA_U32
, 1),
66 [LWT_XFRM_LINK
] = NLA_POLICY_MIN(NLA_U32
, 1),
69 static void xfrmi_destroy_state(struct lwtunnel_state
*lwt
)
73 static int xfrmi_build_state(struct net
*net
, struct nlattr
*nla
,
74 unsigned int family
, const void *cfg
,
75 struct lwtunnel_state
**ts
,
76 struct netlink_ext_ack
*extack
)
78 struct nlattr
*tb
[LWT_XFRM_MAX
+ 1];
79 struct lwtunnel_state
*new_state
;
80 struct xfrm_md_info
*info
;
83 ret
= nla_parse_nested(tb
, LWT_XFRM_MAX
, nla
, xfrm_lwt_policy
, extack
);
87 if (!tb
[LWT_XFRM_IF_ID
]) {
88 NL_SET_ERR_MSG(extack
, "if_id must be set");
92 new_state
= lwtunnel_state_alloc(sizeof(*info
));
94 NL_SET_ERR_MSG(extack
, "failed to create encap info");
98 new_state
->type
= LWTUNNEL_ENCAP_XFRM
;
100 info
= lwt_xfrm_info(new_state
);
102 info
->if_id
= nla_get_u32(tb
[LWT_XFRM_IF_ID
]);
104 if (tb
[LWT_XFRM_LINK
])
105 info
->link
= nla_get_u32(tb
[LWT_XFRM_LINK
]);
111 static int xfrmi_fill_encap_info(struct sk_buff
*skb
,
112 struct lwtunnel_state
*lwt
)
114 struct xfrm_md_info
*info
= lwt_xfrm_info(lwt
);
116 if (nla_put_u32(skb
, LWT_XFRM_IF_ID
, info
->if_id
) ||
117 (info
->link
&& nla_put_u32(skb
, LWT_XFRM_LINK
, info
->link
)))
123 static int xfrmi_encap_nlsize(struct lwtunnel_state
*lwtstate
)
125 return nla_total_size(sizeof(u32
)) + /* LWT_XFRM_IF_ID */
126 nla_total_size(sizeof(u32
)); /* LWT_XFRM_LINK */
129 static int xfrmi_encap_cmp(struct lwtunnel_state
*a
, struct lwtunnel_state
*b
)
131 struct xfrm_md_info
*a_info
= lwt_xfrm_info(a
);
132 struct xfrm_md_info
*b_info
= lwt_xfrm_info(b
);
134 return memcmp(a_info
, b_info
, sizeof(*a_info
));
137 static const struct lwtunnel_encap_ops xfrmi_encap_ops
= {
138 .build_state
= xfrmi_build_state
,
139 .destroy_state
= xfrmi_destroy_state
,
140 .fill_encap
= xfrmi_fill_encap_info
,
141 .get_encap_size
= xfrmi_encap_nlsize
,
142 .cmp_encap
= xfrmi_encap_cmp
,
143 .owner
= THIS_MODULE
,
146 #define for_each_xfrmi_rcu(start, xi) \
147 for (xi = rcu_dereference(start); xi; xi = rcu_dereference(xi->next))
149 static u32
xfrmi_hash(u32 if_id
)
151 return hash_32(if_id
, XFRMI_HASH_BITS
);
154 static struct xfrm_if
*xfrmi_lookup(struct net
*net
, struct xfrm_state
*x
)
156 struct xfrmi_net
*xfrmn
= net_generic(net
, xfrmi_net_id
);
159 for_each_xfrmi_rcu(xfrmn
->xfrmi
[xfrmi_hash(x
->if_id
)], xi
) {
160 if (x
->if_id
== xi
->p
.if_id
&&
161 (xi
->dev
->flags
& IFF_UP
))
165 xi
= rcu_dereference(xfrmn
->collect_md_xfrmi
);
166 if (xi
&& (xi
->dev
->flags
& IFF_UP
))
172 static bool xfrmi_decode_session(struct sk_buff
*skb
,
173 unsigned short family
,
174 struct xfrm_if_decode_session_result
*res
)
176 struct net_device
*dev
;
180 if (!secpath_exists(skb
) || !skb
->dev
)
185 ifindex
= inet6_sdif(skb
);
188 ifindex
= inet_sdif(skb
);
193 struct net
*net
= xs_net(xfrm_input_state(skb
));
195 dev
= dev_get_by_index_rcu(net
, ifindex
);
200 if (!dev
|| !(dev
->flags
& IFF_UP
))
202 if (dev
->netdev_ops
!= &xfrmi_netdev_ops
)
205 xi
= netdev_priv(dev
);
208 if (xi
->p
.collect_md
)
209 res
->if_id
= xfrm_input_state(skb
)->if_id
;
211 res
->if_id
= xi
->p
.if_id
;
215 static void xfrmi_link(struct xfrmi_net
*xfrmn
, struct xfrm_if
*xi
)
217 struct xfrm_if __rcu
**xip
= &xfrmn
->xfrmi
[xfrmi_hash(xi
->p
.if_id
)];
219 rcu_assign_pointer(xi
->next
, rtnl_dereference(*xip
));
220 rcu_assign_pointer(*xip
, xi
);
223 static void xfrmi_unlink(struct xfrmi_net
*xfrmn
, struct xfrm_if
*xi
)
225 struct xfrm_if __rcu
**xip
;
226 struct xfrm_if
*iter
;
228 for (xip
= &xfrmn
->xfrmi
[xfrmi_hash(xi
->p
.if_id
)];
229 (iter
= rtnl_dereference(*xip
)) != NULL
;
232 rcu_assign_pointer(*xip
, xi
->next
);
238 static void xfrmi_dev_free(struct net_device
*dev
)
240 struct xfrm_if
*xi
= netdev_priv(dev
);
242 gro_cells_destroy(&xi
->gro_cells
);
243 free_percpu(dev
->tstats
);
246 static int xfrmi_create(struct net_device
*dev
)
248 struct xfrm_if
*xi
= netdev_priv(dev
);
249 struct net
*net
= dev_net(dev
);
250 struct xfrmi_net
*xfrmn
= net_generic(net
, xfrmi_net_id
);
253 dev
->rtnl_link_ops
= &xfrmi_link_ops
;
254 err
= register_netdevice(dev
);
258 if (xi
->p
.collect_md
)
259 rcu_assign_pointer(xfrmn
->collect_md_xfrmi
, xi
);
261 xfrmi_link(xfrmn
, xi
);
269 static struct xfrm_if
*xfrmi_locate(struct net
*net
, struct xfrm_if_parms
*p
)
271 struct xfrm_if __rcu
**xip
;
273 struct xfrmi_net
*xfrmn
= net_generic(net
, xfrmi_net_id
);
275 for (xip
= &xfrmn
->xfrmi
[xfrmi_hash(p
->if_id
)];
276 (xi
= rtnl_dereference(*xip
)) != NULL
;
278 if (xi
->p
.if_id
== p
->if_id
)
284 static void xfrmi_dev_uninit(struct net_device
*dev
)
286 struct xfrm_if
*xi
= netdev_priv(dev
);
287 struct xfrmi_net
*xfrmn
= net_generic(xi
->net
, xfrmi_net_id
);
289 if (xi
->p
.collect_md
)
290 RCU_INIT_POINTER(xfrmn
->collect_md_xfrmi
, NULL
);
292 xfrmi_unlink(xfrmn
, xi
);
295 static void xfrmi_scrub_packet(struct sk_buff
*skb
, bool xnet
)
297 skb_clear_tstamp(skb
);
298 skb
->pkt_type
= PACKET_HOST
;
314 static int xfrmi_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
,
315 int encap_type
, unsigned short family
)
319 sp
= skb_sec_path(skb
);
320 if (sp
&& (sp
->len
|| sp
->olen
) &&
321 !xfrm_policy_check(NULL
, XFRM_POLICY_IN
, skb
, family
))
324 XFRM_SPI_SKB_CB(skb
)->family
= family
;
325 if (family
== AF_INET
) {
326 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct iphdr
, daddr
);
327 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip4
= NULL
;
329 XFRM_SPI_SKB_CB(skb
)->daddroff
= offsetof(struct ipv6hdr
, daddr
);
330 XFRM_TUNNEL_SKB_CB(skb
)->tunnel
.ip6
= NULL
;
333 return xfrm_input(skb
, nexthdr
, spi
, encap_type
);
339 static int xfrmi4_rcv(struct sk_buff
*skb
)
341 return xfrmi_input(skb
, ip_hdr(skb
)->protocol
, 0, 0, AF_INET
);
344 static int xfrmi6_rcv(struct sk_buff
*skb
)
346 return xfrmi_input(skb
, skb_network_header(skb
)[IP6CB(skb
)->nhoff
],
350 static int xfrmi4_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
, int encap_type
)
352 return xfrmi_input(skb
, nexthdr
, spi
, encap_type
, AF_INET
);
355 static int xfrmi6_input(struct sk_buff
*skb
, int nexthdr
, __be32 spi
, int encap_type
)
357 return xfrmi_input(skb
, nexthdr
, spi
, encap_type
, AF_INET6
);
360 static int xfrmi_rcv_cb(struct sk_buff
*skb
, int err
)
362 const struct xfrm_mode
*inner_mode
;
363 struct net_device
*dev
;
364 struct xfrm_state
*x
;
369 if (err
&& !secpath_exists(skb
))
372 x
= xfrm_input_state(skb
);
374 xi
= xfrmi_lookup(xs_net(x
), x
);
378 link
= skb
->dev
->ifindex
;
383 dev
->stats
.rx_errors
++;
384 dev
->stats
.rx_dropped
++;
389 xnet
= !net_eq(xi
->net
, dev_net(skb
->dev
));
392 inner_mode
= &x
->inner_mode
;
394 if (x
->sel
.family
== AF_UNSPEC
) {
395 inner_mode
= xfrm_ip2inner_mode(x
, XFRM_MODE_SKB_CB(skb
)->protocol
);
396 if (inner_mode
== NULL
) {
397 XFRM_INC_STATS(dev_net(skb
->dev
),
398 LINUX_MIB_XFRMINSTATEMODEERROR
);
403 if (!xfrm_policy_check(NULL
, XFRM_POLICY_IN
, skb
,
408 xfrmi_scrub_packet(skb
, xnet
);
409 if (xi
->p
.collect_md
) {
410 struct metadata_dst
*md_dst
;
412 md_dst
= metadata_dst_alloc(0, METADATA_XFRM
, GFP_ATOMIC
);
416 md_dst
->u
.xfrm_info
.if_id
= x
->if_id
;
417 md_dst
->u
.xfrm_info
.link
= link
;
418 skb_dst_set(skb
, (struct dst_entry
*)md_dst
);
420 dev_sw_netstats_rx_add(dev
, skb
->len
);
426 xfrmi_xmit2(struct sk_buff
*skb
, struct net_device
*dev
, struct flowi
*fl
)
428 struct xfrm_if
*xi
= netdev_priv(dev
);
429 struct net_device_stats
*stats
= &xi
->dev
->stats
;
430 struct dst_entry
*dst
= skb_dst(skb
);
431 unsigned int length
= skb
->len
;
432 struct net_device
*tdev
;
433 struct xfrm_state
*x
;
438 if (xi
->p
.collect_md
) {
439 struct xfrm_md_info
*md_info
= skb_xfrm_md_info(skb
);
441 if (unlikely(!md_info
))
444 if_id
= md_info
->if_id
;
445 fl
->flowi_oif
= md_info
->link
;
446 if (md_info
->dst_orig
) {
447 struct dst_entry
*tmp_dst
= dst
;
449 dst
= md_info
->dst_orig
;
450 skb_dst_set(skb
, dst
);
451 md_info
->dst_orig
= NULL
;
452 dst_release(tmp_dst
);
459 dst
= xfrm_lookup_with_ifid(xi
->net
, dst
, fl
, NULL
, 0, if_id
);
463 goto tx_err_link_failure
;
468 goto tx_err_link_failure
;
470 if (x
->if_id
!= if_id
)
471 goto tx_err_link_failure
;
477 net_warn_ratelimited("%s: Local routing loop detected!\n",
479 goto tx_err_dst_release
;
483 if ((!skb_is_gso(skb
) && skb
->len
> mtu
) ||
484 (skb_is_gso(skb
) && !skb_gso_validate_network_len(skb
, mtu
))) {
485 skb_dst_update_pmtu_no_confirm(skb
, mtu
);
487 if (skb
->protocol
== htons(ETH_P_IPV6
)) {
488 if (mtu
< IPV6_MIN_MTU
)
492 icmpv6_ndo_send(skb
, ICMPV6_PKT_TOOBIG
, 0, mtu
);
496 if (!(ip_hdr(skb
)->frag_off
& htons(IP_DF
)))
498 icmp_ndo_send(skb
, ICMP_DEST_UNREACH
, ICMP_FRAG_NEEDED
,
507 xfrmi_scrub_packet(skb
, !net_eq(xi
->net
, dev_net(dev
)));
508 skb_dst_set(skb
, dst
);
511 err
= dst_output(xi
->net
, skb
->sk
, skb
);
512 if (net_xmit_eval(err
) == 0) {
513 dev_sw_netstats_tx_add(dev
, 1, length
);
516 stats
->tx_aborted_errors
++;
521 stats
->tx_carrier_errors
++;
522 dst_link_failure(skb
);
528 static netdev_tx_t
xfrmi_xmit(struct sk_buff
*skb
, struct net_device
*dev
)
530 struct xfrm_if
*xi
= netdev_priv(dev
);
531 struct net_device_stats
*stats
= &xi
->dev
->stats
;
532 struct dst_entry
*dst
= skb_dst(skb
);
536 memset(&fl
, 0, sizeof(fl
));
538 switch (skb
->protocol
) {
539 case htons(ETH_P_IPV6
):
540 memset(IP6CB(skb
), 0, sizeof(*IP6CB(skb
)));
541 xfrm_decode_session(skb
, &fl
, AF_INET6
);
543 fl
.u
.ip6
.flowi6_oif
= dev
->ifindex
;
544 fl
.u
.ip6
.flowi6_flags
|= FLOWI_FLAG_ANYSRC
;
545 dst
= ip6_route_output(dev_net(dev
), NULL
, &fl
.u
.ip6
);
548 stats
->tx_carrier_errors
++;
551 skb_dst_set(skb
, dst
);
554 case htons(ETH_P_IP
):
555 memset(IPCB(skb
), 0, sizeof(*IPCB(skb
)));
556 xfrm_decode_session(skb
, &fl
, AF_INET
);
560 fl
.u
.ip4
.flowi4_oif
= dev
->ifindex
;
561 fl
.u
.ip4
.flowi4_flags
|= FLOWI_FLAG_ANYSRC
;
562 rt
= __ip_route_output_key(dev_net(dev
), &fl
.u
.ip4
);
564 stats
->tx_carrier_errors
++;
567 skb_dst_set(skb
, &rt
->dst
);
574 fl
.flowi_oif
= xi
->p
.link
;
576 ret
= xfrmi_xmit2(skb
, dev
, &fl
);
589 static int xfrmi4_err(struct sk_buff
*skb
, u32 info
)
591 const struct iphdr
*iph
= (const struct iphdr
*)skb
->data
;
592 struct net
*net
= dev_net(skb
->dev
);
593 int protocol
= iph
->protocol
;
594 struct ip_comp_hdr
*ipch
;
595 struct ip_esp_hdr
*esph
;
596 struct ip_auth_hdr
*ah
;
597 struct xfrm_state
*x
;
603 esph
= (struct ip_esp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
607 ah
= (struct ip_auth_hdr
*)(skb
->data
+(iph
->ihl
<<2));
611 ipch
= (struct ip_comp_hdr
*)(skb
->data
+(iph
->ihl
<<2));
612 spi
= htonl(ntohs(ipch
->cpi
));
618 switch (icmp_hdr(skb
)->type
) {
619 case ICMP_DEST_UNREACH
:
620 if (icmp_hdr(skb
)->code
!= ICMP_FRAG_NEEDED
)
629 x
= xfrm_state_lookup(net
, skb
->mark
, (const xfrm_address_t
*)&iph
->daddr
,
630 spi
, protocol
, AF_INET
);
634 xi
= xfrmi_lookup(net
, x
);
640 if (icmp_hdr(skb
)->type
== ICMP_DEST_UNREACH
)
641 ipv4_update_pmtu(skb
, net
, info
, 0, protocol
);
643 ipv4_redirect(skb
, net
, 0, protocol
);
649 static int xfrmi6_err(struct sk_buff
*skb
, struct inet6_skb_parm
*opt
,
650 u8 type
, u8 code
, int offset
, __be32 info
)
652 const struct ipv6hdr
*iph
= (const struct ipv6hdr
*)skb
->data
;
653 struct net
*net
= dev_net(skb
->dev
);
654 int protocol
= iph
->nexthdr
;
655 struct ip_comp_hdr
*ipch
;
656 struct ip_esp_hdr
*esph
;
657 struct ip_auth_hdr
*ah
;
658 struct xfrm_state
*x
;
664 esph
= (struct ip_esp_hdr
*)(skb
->data
+ offset
);
668 ah
= (struct ip_auth_hdr
*)(skb
->data
+ offset
);
672 ipch
= (struct ip_comp_hdr
*)(skb
->data
+ offset
);
673 spi
= htonl(ntohs(ipch
->cpi
));
679 if (type
!= ICMPV6_PKT_TOOBIG
&&
680 type
!= NDISC_REDIRECT
)
683 x
= xfrm_state_lookup(net
, skb
->mark
, (const xfrm_address_t
*)&iph
->daddr
,
684 spi
, protocol
, AF_INET6
);
688 xi
= xfrmi_lookup(net
, x
);
694 if (type
== NDISC_REDIRECT
)
695 ip6_redirect(skb
, net
, skb
->dev
->ifindex
, 0,
696 sock_net_uid(net
, NULL
));
698 ip6_update_pmtu(skb
, net
, info
, 0, 0, sock_net_uid(net
, NULL
));
704 static int xfrmi_change(struct xfrm_if
*xi
, const struct xfrm_if_parms
*p
)
706 if (xi
->p
.link
!= p
->link
)
709 xi
->p
.if_id
= p
->if_id
;
714 static int xfrmi_update(struct xfrm_if
*xi
, struct xfrm_if_parms
*p
)
716 struct net
*net
= xi
->net
;
717 struct xfrmi_net
*xfrmn
= net_generic(net
, xfrmi_net_id
);
720 xfrmi_unlink(xfrmn
, xi
);
722 err
= xfrmi_change(xi
, p
);
723 xfrmi_link(xfrmn
, xi
);
724 netdev_state_change(xi
->dev
);
728 static int xfrmi_get_iflink(const struct net_device
*dev
)
730 struct xfrm_if
*xi
= netdev_priv(dev
);
735 static const struct net_device_ops xfrmi_netdev_ops
= {
736 .ndo_init
= xfrmi_dev_init
,
737 .ndo_uninit
= xfrmi_dev_uninit
,
738 .ndo_start_xmit
= xfrmi_xmit
,
739 .ndo_get_stats64
= dev_get_tstats64
,
740 .ndo_get_iflink
= xfrmi_get_iflink
,
743 static void xfrmi_dev_setup(struct net_device
*dev
)
745 dev
->netdev_ops
= &xfrmi_netdev_ops
;
746 dev
->header_ops
= &ip_tunnel_header_ops
;
747 dev
->type
= ARPHRD_NONE
;
748 dev
->mtu
= ETH_DATA_LEN
;
749 dev
->min_mtu
= ETH_MIN_MTU
;
750 dev
->max_mtu
= IP_MAX_MTU
;
751 dev
->flags
= IFF_NOARP
;
752 dev
->needs_free_netdev
= true;
753 dev
->priv_destructor
= xfrmi_dev_free
;
756 eth_broadcast_addr(dev
->broadcast
);
759 #define XFRMI_FEATURES (NETIF_F_SG | \
761 NETIF_F_GSO_SOFTWARE | \
764 static int xfrmi_dev_init(struct net_device
*dev
)
766 struct xfrm_if
*xi
= netdev_priv(dev
);
767 struct net_device
*phydev
= __dev_get_by_index(xi
->net
, xi
->p
.link
);
770 dev
->tstats
= netdev_alloc_pcpu_stats(struct pcpu_sw_netstats
);
774 err
= gro_cells_init(&xi
->gro_cells
, dev
);
776 free_percpu(dev
->tstats
);
780 dev
->features
|= NETIF_F_LLTX
;
781 dev
->features
|= XFRMI_FEATURES
;
782 dev
->hw_features
|= XFRMI_FEATURES
;
785 dev
->needed_headroom
= phydev
->needed_headroom
;
786 dev
->needed_tailroom
= phydev
->needed_tailroom
;
788 if (is_zero_ether_addr(dev
->dev_addr
))
789 eth_hw_addr_inherit(dev
, phydev
);
790 if (is_zero_ether_addr(dev
->broadcast
))
791 memcpy(dev
->broadcast
, phydev
->broadcast
,
794 eth_hw_addr_random(dev
);
795 eth_broadcast_addr(dev
->broadcast
);
801 static int xfrmi_validate(struct nlattr
*tb
[], struct nlattr
*data
[],
802 struct netlink_ext_ack
*extack
)
807 static void xfrmi_netlink_parms(struct nlattr
*data
[],
808 struct xfrm_if_parms
*parms
)
810 memset(parms
, 0, sizeof(*parms
));
815 if (data
[IFLA_XFRM_LINK
])
816 parms
->link
= nla_get_u32(data
[IFLA_XFRM_LINK
]);
818 if (data
[IFLA_XFRM_IF_ID
])
819 parms
->if_id
= nla_get_u32(data
[IFLA_XFRM_IF_ID
]);
821 if (data
[IFLA_XFRM_COLLECT_METADATA
])
822 parms
->collect_md
= true;
825 static int xfrmi_newlink(struct net
*src_net
, struct net_device
*dev
,
826 struct nlattr
*tb
[], struct nlattr
*data
[],
827 struct netlink_ext_ack
*extack
)
829 struct net
*net
= dev_net(dev
);
830 struct xfrm_if_parms p
= {};
834 xfrmi_netlink_parms(data
, &p
);
836 struct xfrmi_net
*xfrmn
= net_generic(net
, xfrmi_net_id
);
838 if (p
.link
|| p
.if_id
) {
839 NL_SET_ERR_MSG(extack
, "link and if_id must be zero");
843 if (rtnl_dereference(xfrmn
->collect_md_xfrmi
))
848 NL_SET_ERR_MSG(extack
, "if_id must be non zero");
852 xi
= xfrmi_locate(net
, &p
);
857 xi
= netdev_priv(dev
);
862 err
= xfrmi_create(dev
);
866 static void xfrmi_dellink(struct net_device
*dev
, struct list_head
*head
)
868 unregister_netdevice_queue(dev
, head
);
871 static int xfrmi_changelink(struct net_device
*dev
, struct nlattr
*tb
[],
872 struct nlattr
*data
[],
873 struct netlink_ext_ack
*extack
)
875 struct xfrm_if
*xi
= netdev_priv(dev
);
876 struct net
*net
= xi
->net
;
877 struct xfrm_if_parms p
= {};
879 xfrmi_netlink_parms(data
, &p
);
881 NL_SET_ERR_MSG(extack
, "if_id must be non zero");
886 NL_SET_ERR_MSG(extack
, "collect_md can't be changed");
890 xi
= xfrmi_locate(net
, &p
);
892 xi
= netdev_priv(dev
);
896 if (xi
->p
.collect_md
) {
897 NL_SET_ERR_MSG(extack
,
898 "device can't be changed to collect_md");
903 return xfrmi_update(xi
, &p
);
906 static size_t xfrmi_get_size(const struct net_device
*dev
)
911 /* IFLA_XFRM_IF_ID */
913 /* IFLA_XFRM_COLLECT_METADATA */
918 static int xfrmi_fill_info(struct sk_buff
*skb
, const struct net_device
*dev
)
920 struct xfrm_if
*xi
= netdev_priv(dev
);
921 struct xfrm_if_parms
*parm
= &xi
->p
;
923 if (nla_put_u32(skb
, IFLA_XFRM_LINK
, parm
->link
) ||
924 nla_put_u32(skb
, IFLA_XFRM_IF_ID
, parm
->if_id
) ||
925 (xi
->p
.collect_md
&& nla_put_flag(skb
, IFLA_XFRM_COLLECT_METADATA
)))
926 goto nla_put_failure
;
933 static struct net
*xfrmi_get_link_net(const struct net_device
*dev
)
935 struct xfrm_if
*xi
= netdev_priv(dev
);
940 static const struct nla_policy xfrmi_policy
[IFLA_XFRM_MAX
+ 1] = {
941 [IFLA_XFRM_UNSPEC
] = { .strict_start_type
= IFLA_XFRM_COLLECT_METADATA
},
942 [IFLA_XFRM_LINK
] = { .type
= NLA_U32
},
943 [IFLA_XFRM_IF_ID
] = { .type
= NLA_U32
},
944 [IFLA_XFRM_COLLECT_METADATA
] = { .type
= NLA_FLAG
},
947 static struct rtnl_link_ops xfrmi_link_ops __read_mostly
= {
949 .maxtype
= IFLA_XFRM_MAX
,
950 .policy
= xfrmi_policy
,
951 .priv_size
= sizeof(struct xfrm_if
),
952 .setup
= xfrmi_dev_setup
,
953 .validate
= xfrmi_validate
,
954 .newlink
= xfrmi_newlink
,
955 .dellink
= xfrmi_dellink
,
956 .changelink
= xfrmi_changelink
,
957 .get_size
= xfrmi_get_size
,
958 .fill_info
= xfrmi_fill_info
,
959 .get_link_net
= xfrmi_get_link_net
,
962 static void __net_exit
xfrmi_exit_batch_net(struct list_head
*net_exit_list
)
968 list_for_each_entry(net
, net_exit_list
, exit_list
) {
969 struct xfrmi_net
*xfrmn
= net_generic(net
, xfrmi_net_id
);
970 struct xfrm_if __rcu
**xip
;
974 for (i
= 0; i
< XFRMI_HASH_SIZE
; i
++) {
975 for (xip
= &xfrmn
->xfrmi
[i
];
976 (xi
= rtnl_dereference(*xip
)) != NULL
;
978 unregister_netdevice_queue(xi
->dev
, &list
);
980 xi
= rtnl_dereference(xfrmn
->collect_md_xfrmi
);
982 unregister_netdevice_queue(xi
->dev
, &list
);
984 unregister_netdevice_many(&list
);
988 static struct pernet_operations xfrmi_net_ops
= {
989 .exit_batch
= xfrmi_exit_batch_net
,
991 .size
= sizeof(struct xfrmi_net
),
994 static struct xfrm6_protocol xfrmi_esp6_protocol __read_mostly
= {
995 .handler
= xfrmi6_rcv
,
996 .input_handler
= xfrmi6_input
,
997 .cb_handler
= xfrmi_rcv_cb
,
998 .err_handler
= xfrmi6_err
,
1002 static struct xfrm6_protocol xfrmi_ah6_protocol __read_mostly
= {
1003 .handler
= xfrm6_rcv
,
1004 .input_handler
= xfrm_input
,
1005 .cb_handler
= xfrmi_rcv_cb
,
1006 .err_handler
= xfrmi6_err
,
1010 static struct xfrm6_protocol xfrmi_ipcomp6_protocol __read_mostly
= {
1011 .handler
= xfrm6_rcv
,
1012 .input_handler
= xfrm_input
,
1013 .cb_handler
= xfrmi_rcv_cb
,
1014 .err_handler
= xfrmi6_err
,
1018 #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
1019 static int xfrmi6_rcv_tunnel(struct sk_buff
*skb
)
1021 const xfrm_address_t
*saddr
;
1024 saddr
= (const xfrm_address_t
*)&ipv6_hdr(skb
)->saddr
;
1025 spi
= xfrm6_tunnel_spi_lookup(dev_net(skb
->dev
), saddr
);
1027 return xfrm6_rcv_spi(skb
, IPPROTO_IPV6
, spi
, NULL
);
1030 static struct xfrm6_tunnel xfrmi_ipv6_handler __read_mostly
= {
1031 .handler
= xfrmi6_rcv_tunnel
,
1032 .cb_handler
= xfrmi_rcv_cb
,
1033 .err_handler
= xfrmi6_err
,
1037 static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly
= {
1038 .handler
= xfrmi6_rcv_tunnel
,
1039 .cb_handler
= xfrmi_rcv_cb
,
1040 .err_handler
= xfrmi6_err
,
1045 static struct xfrm4_protocol xfrmi_esp4_protocol __read_mostly
= {
1046 .handler
= xfrmi4_rcv
,
1047 .input_handler
= xfrmi4_input
,
1048 .cb_handler
= xfrmi_rcv_cb
,
1049 .err_handler
= xfrmi4_err
,
1053 static struct xfrm4_protocol xfrmi_ah4_protocol __read_mostly
= {
1054 .handler
= xfrm4_rcv
,
1055 .input_handler
= xfrm_input
,
1056 .cb_handler
= xfrmi_rcv_cb
,
1057 .err_handler
= xfrmi4_err
,
1061 static struct xfrm4_protocol xfrmi_ipcomp4_protocol __read_mostly
= {
1062 .handler
= xfrm4_rcv
,
1063 .input_handler
= xfrm_input
,
1064 .cb_handler
= xfrmi_rcv_cb
,
1065 .err_handler
= xfrmi4_err
,
1069 #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
1070 static int xfrmi4_rcv_tunnel(struct sk_buff
*skb
)
1072 return xfrm4_rcv_spi(skb
, IPPROTO_IPIP
, ip_hdr(skb
)->saddr
);
1075 static struct xfrm_tunnel xfrmi_ipip_handler __read_mostly
= {
1076 .handler
= xfrmi4_rcv_tunnel
,
1077 .cb_handler
= xfrmi_rcv_cb
,
1078 .err_handler
= xfrmi4_err
,
1082 static struct xfrm_tunnel xfrmi_ipip6_handler __read_mostly
= {
1083 .handler
= xfrmi4_rcv_tunnel
,
1084 .cb_handler
= xfrmi_rcv_cb
,
1085 .err_handler
= xfrmi4_err
,
1090 static int __init
xfrmi4_init(void)
1094 err
= xfrm4_protocol_register(&xfrmi_esp4_protocol
, IPPROTO_ESP
);
1096 goto xfrm_proto_esp_failed
;
1097 err
= xfrm4_protocol_register(&xfrmi_ah4_protocol
, IPPROTO_AH
);
1099 goto xfrm_proto_ah_failed
;
1100 err
= xfrm4_protocol_register(&xfrmi_ipcomp4_protocol
, IPPROTO_COMP
);
1102 goto xfrm_proto_comp_failed
;
1103 #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
1104 err
= xfrm4_tunnel_register(&xfrmi_ipip_handler
, AF_INET
);
1106 goto xfrm_tunnel_ipip_failed
;
1107 err
= xfrm4_tunnel_register(&xfrmi_ipip6_handler
, AF_INET6
);
1109 goto xfrm_tunnel_ipip6_failed
;
1114 #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
1115 xfrm_tunnel_ipip6_failed
:
1116 xfrm4_tunnel_deregister(&xfrmi_ipip_handler
, AF_INET
);
1117 xfrm_tunnel_ipip_failed
:
1118 xfrm4_protocol_deregister(&xfrmi_ipcomp4_protocol
, IPPROTO_COMP
);
1120 xfrm_proto_comp_failed
:
1121 xfrm4_protocol_deregister(&xfrmi_ah4_protocol
, IPPROTO_AH
);
1122 xfrm_proto_ah_failed
:
1123 xfrm4_protocol_deregister(&xfrmi_esp4_protocol
, IPPROTO_ESP
);
1124 xfrm_proto_esp_failed
:
1128 static void xfrmi4_fini(void)
1130 #if IS_REACHABLE(CONFIG_INET_XFRM_TUNNEL)
1131 xfrm4_tunnel_deregister(&xfrmi_ipip6_handler
, AF_INET6
);
1132 xfrm4_tunnel_deregister(&xfrmi_ipip_handler
, AF_INET
);
1134 xfrm4_protocol_deregister(&xfrmi_ipcomp4_protocol
, IPPROTO_COMP
);
1135 xfrm4_protocol_deregister(&xfrmi_ah4_protocol
, IPPROTO_AH
);
1136 xfrm4_protocol_deregister(&xfrmi_esp4_protocol
, IPPROTO_ESP
);
1139 static int __init
xfrmi6_init(void)
1143 err
= xfrm6_protocol_register(&xfrmi_esp6_protocol
, IPPROTO_ESP
);
1145 goto xfrm_proto_esp_failed
;
1146 err
= xfrm6_protocol_register(&xfrmi_ah6_protocol
, IPPROTO_AH
);
1148 goto xfrm_proto_ah_failed
;
1149 err
= xfrm6_protocol_register(&xfrmi_ipcomp6_protocol
, IPPROTO_COMP
);
1151 goto xfrm_proto_comp_failed
;
1152 #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
1153 err
= xfrm6_tunnel_register(&xfrmi_ipv6_handler
, AF_INET6
);
1155 goto xfrm_tunnel_ipv6_failed
;
1156 err
= xfrm6_tunnel_register(&xfrmi_ip6ip_handler
, AF_INET
);
1158 goto xfrm_tunnel_ip6ip_failed
;
1163 #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
1164 xfrm_tunnel_ip6ip_failed
:
1165 xfrm6_tunnel_deregister(&xfrmi_ipv6_handler
, AF_INET6
);
1166 xfrm_tunnel_ipv6_failed
:
1167 xfrm6_protocol_deregister(&xfrmi_ipcomp6_protocol
, IPPROTO_COMP
);
1169 xfrm_proto_comp_failed
:
1170 xfrm6_protocol_deregister(&xfrmi_ah6_protocol
, IPPROTO_AH
);
1171 xfrm_proto_ah_failed
:
1172 xfrm6_protocol_deregister(&xfrmi_esp6_protocol
, IPPROTO_ESP
);
1173 xfrm_proto_esp_failed
:
1177 static void xfrmi6_fini(void)
1179 #if IS_REACHABLE(CONFIG_INET6_XFRM_TUNNEL)
1180 xfrm6_tunnel_deregister(&xfrmi_ip6ip_handler
, AF_INET
);
1181 xfrm6_tunnel_deregister(&xfrmi_ipv6_handler
, AF_INET6
);
1183 xfrm6_protocol_deregister(&xfrmi_ipcomp6_protocol
, IPPROTO_COMP
);
1184 xfrm6_protocol_deregister(&xfrmi_ah6_protocol
, IPPROTO_AH
);
1185 xfrm6_protocol_deregister(&xfrmi_esp6_protocol
, IPPROTO_ESP
);
1188 static const struct xfrm_if_cb xfrm_if_cb
= {
1189 .decode_session
= xfrmi_decode_session
,
1192 static int __init
xfrmi_init(void)
1197 pr_info("IPsec XFRM device driver\n");
1199 msg
= "tunnel device";
1200 err
= register_pernet_device(&xfrmi_net_ops
);
1202 goto pernet_dev_failed
;
1204 msg
= "xfrm4 protocols";
1205 err
= xfrmi4_init();
1209 msg
= "xfrm6 protocols";
1210 err
= xfrmi6_init();
1215 msg
= "netlink interface";
1216 err
= rtnl_link_register(&xfrmi_link_ops
);
1218 goto rtnl_link_failed
;
1220 err
= register_xfrm_interface_bpf();
1224 lwtunnel_encap_add_ops(&xfrmi_encap_ops
, LWTUNNEL_ENCAP_XFRM
);
1226 xfrm_if_register_cb(&xfrm_if_cb
);
1231 rtnl_link_unregister(&xfrmi_link_ops
);
1237 unregister_pernet_device(&xfrmi_net_ops
);
1239 pr_err("xfrmi init: failed to register %s\n", msg
);
1243 static void __exit
xfrmi_fini(void)
1245 xfrm_if_unregister_cb();
1246 lwtunnel_encap_del_ops(&xfrmi_encap_ops
, LWTUNNEL_ENCAP_XFRM
);
1247 rtnl_link_unregister(&xfrmi_link_ops
);
1250 unregister_pernet_device(&xfrmi_net_ops
);
1253 module_init(xfrmi_init
);
1254 module_exit(xfrmi_fini
);
1255 MODULE_LICENSE("GPL");
1256 MODULE_ALIAS_RTNL_LINK("xfrm");
1257 MODULE_ALIAS_NETDEV("xfrm0");
1258 MODULE_AUTHOR("Steffen Klassert");
1259 MODULE_DESCRIPTION("XFRM virtual interface");