src/network/netdev/tunnel.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <arpa/inet.h>
   4 #include <net/if.h>
   5 #include <linux/ip.h>
   6 #include <linux/if_tunnel.h>
   7 #include <linux/ip6_tunnel.h>
   8
   9 #if HAVE_LINUX_FOU_H
  10 #include <linux/fou.h>
  11 #endif
  12
  13 #include "sd-netlink.h"
  14
  15 #include "conf-parser.h"
  16 #include "missing.h"
  17 #include "netlink-util.h"
  18 #include "networkd-link.h"
  19 #include "netdev/tunnel.h"
  20 #include "parse-util.h"
  21 #include "string-table.h"
  22 #include "string-util.h"
  23 #include "util.h"
  24
  25 #define DEFAULT_TNL_HOP_LIMIT   64
  26 #define IP6_FLOWINFO_FLOWLABEL  htobe32(0x000FFFFF)
  27 #define IP6_TNL_F_ALLOW_LOCAL_REMOTE 0x40
  28
  29 static const char* const ip6tnl_mode_table[_NETDEV_IP6_TNL_MODE_MAX] = {
  30         [NETDEV_IP6_TNL_MODE_IP6IP6] = "ip6ip6",
  31         [NETDEV_IP6_TNL_MODE_IPIP6] = "ipip6",
  32         [NETDEV_IP6_TNL_MODE_ANYIP6] = "any",
  33 };
  34
  35 DEFINE_STRING_TABLE_LOOKUP(ip6tnl_mode, Ip6TnlMode);
  36 DEFINE_CONFIG_PARSE_ENUM(config_parse_ip6tnl_mode, ip6tnl_mode, Ip6TnlMode, "Failed to parse ip6 tunnel Mode");
  37
  38 static int netdev_ipip_sit_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
  39         Tunnel *t;
  40         int r;
  41
  42         assert(netdev);
  43
  44         if (netdev->kind == NETDEV_KIND_IPIP)
  45                 t = IPIP(netdev);
  46         else
  47                 t = SIT(netdev);
  48
  49         assert(m);
  50         assert(t);
  51         assert(t->family == AF_INET);
  52
  53         if (link) {
  54                 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_LINK, link->ifindex);
  55                 if (r < 0)
  56                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
  57         }
  58
  59         r = sd_netlink_message_append_in_addr(m, IFLA_IPTUN_LOCAL, &t->local.in);
  60         if (r < 0)
  61                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
  62
  63         r = sd_netlink_message_append_in_addr(m, IFLA_IPTUN_REMOTE, &t->remote.in);
  64         if (r < 0)
  65                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_REMOTE attribute: %m");
  66
  67         r = sd_netlink_message_append_u8(m, IFLA_IPTUN_TTL, t->ttl);
  68         if (r < 0)
  69                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_TTL attribute: %m");
  70
  71         r = sd_netlink_message_append_u8(m, IFLA_IPTUN_PMTUDISC, t->pmtudisc);
  72         if (r < 0)
  73                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_PMTUDISC attribute: %m");
  74
  75         if (netdev->kind == NETDEV_KIND_IPIP && t->fou_tunnel) {
  76                 r = sd_netlink_message_append_u16(m, IFLA_IPTUN_ENCAP_TYPE, t->fou_encap_type);
  77                 if (r < 0)
  78                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_ENCAP_TYPE attribute: %m");
  79
  80                 r = sd_netlink_message_append_u16(m, IFLA_IPTUN_ENCAP_SPORT, htobe16(t->encap_src_port));
  81                 if (r < 0)
  82                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_ENCAP_SPORT attribute: %m");
  83
  84                 r = sd_netlink_message_append_u16(m, IFLA_IPTUN_ENCAP_DPORT, htobe16(t->fou_destination_port));
  85                 if (r < 0)
  86                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_ENCAP_DPORT attribute: %m");
  87         }
  88
  89         if (netdev->kind == NETDEV_KIND_SIT) {
  90                 if (t->sixrd_prefixlen > 0) {
  91                         r = sd_netlink_message_append_in6_addr(m, IFLA_IPTUN_6RD_PREFIX, &t->sixrd_prefix);
  92                         if (r < 0)
  93                                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_6RD_PREFIX attribute: %m");
  94
  95                         /* u16 is deliberate here, even though we're passing a netmask that can never be >128. The kernel is
  96                          * expecting to receive the prefixlen as a u16.
  97                          */
  98                         r = sd_netlink_message_append_u16(m, IFLA_IPTUN_6RD_PREFIXLEN, t->sixrd_prefixlen);
  99                         if (r < 0)
 100                                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_6RD_PREFIXLEN attribute: %m");
 101                 }
 102
 103                 if (t->isatap >= 0) {
 104                         uint16_t flags = 0;
 105
 106                         SET_FLAG(flags, SIT_ISATAP, t->isatap);
 107
 108                         r = sd_netlink_message_append_u16(m, IFLA_IPTUN_FLAGS, flags);
 109                         if (r < 0)
 110                                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_FLAGS attribute: %m");
 111                 }
 112         }
 113
 114         return r;
 115 }
 116
 117 static int netdev_gre_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
 118         Tunnel *t;
 119         int r;
 120
 121         assert(netdev);
 122
 123         if (netdev->kind == NETDEV_KIND_GRE)
 124                 t = GRE(netdev);
 125         else
 126                 t = GRETAP(netdev);
 127
 128         assert(t);
 129         assert(t->family == AF_INET);
 130         assert(m);
 131
 132         if (link) {
 133                 r = sd_netlink_message_append_u32(m, IFLA_GRE_LINK, link->ifindex);
 134                 if (r < 0)
 135                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LINK attribute: %m");
 136         }
 137
 138         r = sd_netlink_message_append_in_addr(m, IFLA_GRE_LOCAL, &t->local.in);
 139         if (r < 0)
 140                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LOCAL attribute: %m");
 141
 142         r = sd_netlink_message_append_in_addr(m, IFLA_GRE_REMOTE, &t->remote.in);
 143         if (r < 0)
 144                 log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_REMOTE attribute: %m");
 145
 146         r = sd_netlink_message_append_u8(m, IFLA_GRE_TTL, t->ttl);
 147         if (r < 0)
 148                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_TTL attribute: %m");
 149
 150         r = sd_netlink_message_append_u8(m, IFLA_GRE_TOS, t->tos);
 151         if (r < 0)
 152                 log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_TOS attribute: %m");
 153
 154         r = sd_netlink_message_append_u8(m, IFLA_GRE_PMTUDISC, t->pmtudisc);
 155         if (r < 0)
 156                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_PMTUDISC attribute: %m");
 157
 158         return r;
 159 }
 160
 161 static int netdev_erspan_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
 162         uint32_t ikey = 0;
 163         uint32_t okey = 0;
 164         uint16_t iflags = 0;
 165         uint16_t oflags = 0;
 166         Tunnel *t;
 167         int r;
 168
 169         assert(netdev);
 170
 171         t = ERSPAN(netdev);
 172
 173         assert(t);
 174         assert(t->family == AF_INET);
 175         assert(m);
 176
 177         r = sd_netlink_message_append_u32(m, IFLA_GRE_ERSPAN_INDEX, t->erspan_index);
 178         if (r < 0)
 179                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_ERSPAN_INDEX attribute: %m");
 180
 181         if (t->key != 0) {
 182                 ikey = okey = htobe32(t->key);
 183                 iflags |= GRE_KEY;
 184                 oflags |= GRE_KEY;
 185         }
 186
 187         if (t->ikey != 0) {
 188                 ikey = htobe32(t->ikey);
 189                 iflags |= GRE_KEY;
 190         }
 191
 192         if (t->okey != 0) {
 193                 okey = htobe32(t->okey);
 194                 oflags |= GRE_KEY;
 195         }
 196
 197         if (t->erspan_sequence > 0) {
 198                 iflags |= GRE_SEQ;
 199                 oflags |= GRE_SEQ;
 200         } else if (t->erspan_sequence == 0) {
 201                 iflags &= ~GRE_SEQ;
 202                 oflags &= ~GRE_SEQ;
 203         }
 204
 205         r = sd_netlink_message_append_u32(m, IFLA_GRE_IKEY, ikey);
 206         if (r < 0)
 207                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_IKEY attribute: %m");
 208
 209         r = sd_netlink_message_append_u32(m, IFLA_GRE_OKEY, okey);
 210         if (r < 0)
 211                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_OKEY attribute: %m");
 212
 213         r = sd_netlink_message_append_u16(m, IFLA_GRE_IFLAGS, iflags);
 214         if (r < 0)
 215                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_IFLAGS attribute: %m");
 216
 217         r = sd_netlink_message_append_u16(m, IFLA_GRE_OFLAGS, oflags);
 218         if (r < 0)
 219                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_OFLAGS, attribute: %m");
 220
 221         r = sd_netlink_message_append_in_addr(m, IFLA_GRE_LOCAL, &t->local.in);
 222         if (r < 0)
 223                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LOCAL attribute: %m");
 224
 225         r = sd_netlink_message_append_in_addr(m, IFLA_GRE_REMOTE, &t->remote.in);
 226         if (r < 0)
 227                 log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_REMOTE attribute: %m");
 228
 229         return r;
 230 }
 231
 232 static int netdev_ip6gre_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
 233         Tunnel *t;
 234         int r;
 235
 236         assert(netdev);
 237
 238         if (netdev->kind == NETDEV_KIND_IP6GRE)
 239                 t = IP6GRE(netdev);
 240         else
 241                 t = IP6GRETAP(netdev);
 242
 243         assert(t);
 244         assert(t->family == AF_INET6);
 245         assert(m);
 246
 247         if (link) {
 248                 r = sd_netlink_message_append_u32(m, IFLA_GRE_LINK, link->ifindex);
 249                 if (r < 0)
 250                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LINK attribute: %m");
 251         }
 252
 253         r = sd_netlink_message_append_in6_addr(m, IFLA_GRE_LOCAL, &t->local.in6);
 254         if (r < 0)
 255                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_LOCAL attribute: %m");
 256
 257         r = sd_netlink_message_append_in6_addr(m, IFLA_GRE_REMOTE, &t->remote.in6);
 258         if (r < 0)
 259                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_REMOTE attribute: %m");
 260
 261         r = sd_netlink_message_append_u8(m, IFLA_GRE_TTL, t->ttl);
 262         if (r < 0)
 263                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_TTL attribute: %m");
 264
 265         if (t->ipv6_flowlabel != _NETDEV_IPV6_FLOWLABEL_INVALID) {
 266                 r = sd_netlink_message_append_u32(m, IFLA_GRE_FLOWINFO, t->ipv6_flowlabel);
 267                 if (r < 0)
 268                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_FLOWINFO attribute: %m");
 269         }
 270
 271         r = sd_netlink_message_append_u32(m, IFLA_GRE_FLAGS, t->flags);
 272         if (r < 0)
 273                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_GRE_FLAGS attribute: %m");
 274
 275         return r;
 276 }
 277
 278 static int netdev_vti_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
 279         uint32_t ikey, okey;
 280         Tunnel *t;
 281         int r;
 282
 283         assert(netdev);
 284         assert(m);
 285
 286         if (netdev->kind == NETDEV_KIND_VTI)
 287                 t = VTI(netdev);
 288         else
 289                 t = VTI6(netdev);
 290
 291         assert(t);
 292         assert((netdev->kind == NETDEV_KIND_VTI && t->family == AF_INET) ||
 293                (netdev->kind == NETDEV_KIND_VTI6 && t->family == AF_INET6));
 294
 295         if (link) {
 296                 r = sd_netlink_message_append_u32(m, IFLA_VTI_LINK, link->ifindex);
 297                 if (r < 0)
 298                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_VTI_LINK attribute: %m");
 299         }
 300
 301         if (t->key != 0)
 302                 ikey = okey = htobe32(t->key);
 303         else {
 304                 ikey = htobe32(t->ikey);
 305                 okey = htobe32(t->okey);
 306         }
 307
 308         r = sd_netlink_message_append_u32(m, IFLA_VTI_IKEY, ikey);
 309         if (r < 0)
 310                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_VTI_IKEY attribute: %m");
 311
 312         r = sd_netlink_message_append_u32(m, IFLA_VTI_OKEY, okey);
 313         if (r < 0)
 314                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_VTI_OKEY attribute: %m");
 315
 316         r = netlink_message_append_in_addr_union(m, IFLA_VTI_LOCAL, t->family, &t->local);
 317         if (r < 0)
 318                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_VTI_LOCAL attribute: %m");
 319
 320         r = netlink_message_append_in_addr_union(m, IFLA_VTI_REMOTE, t->family, &t->remote);
 321         if (r < 0)
 322                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_VTI_REMOTE attribute: %m");
 323
 324         return r;
 325 }
 326
 327 static int netdev_ip6tnl_fill_message_create(NetDev *netdev, Link *link, sd_netlink_message *m) {
 328         Tunnel *t = IP6TNL(netdev);
 329         uint8_t proto;
 330         int r;
 331
 332         assert(netdev);
 333         assert(m);
 334         assert(t);
 335         assert(t->family == AF_INET6);
 336
 337         if (link) {
 338                 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_LINK, link->ifindex);
 339                 if (r < 0)
 340                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LINK attribute: %m");
 341         }
 342
 343         r = sd_netlink_message_append_in6_addr(m, IFLA_IPTUN_LOCAL, &t->local.in6);
 344         if (r < 0)
 345                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_LOCAL attribute: %m");
 346
 347         r = sd_netlink_message_append_in6_addr(m, IFLA_IPTUN_REMOTE, &t->remote.in6);
 348         if (r < 0)
 349                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_REMOTE attribute: %m");
 350
 351         r = sd_netlink_message_append_u8(m, IFLA_IPTUN_TTL, t->ttl);
 352         if (r < 0)
 353                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_TTL attribute: %m");
 354
 355         if (t->ipv6_flowlabel != _NETDEV_IPV6_FLOWLABEL_INVALID) {
 356                 r = sd_netlink_message_append_u32(m, IFLA_IPTUN_FLOWINFO, t->ipv6_flowlabel);
 357                 if (r < 0)
 358                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_FLOWINFO attribute: %m");
 359         }
 360
 361         if (t->copy_dscp)
 362                 t->flags |= IP6_TNL_F_RCV_DSCP_COPY;
 363
 364         if (t->allow_localremote >= 0)
 365                 SET_FLAG(t->flags, IP6_TNL_F_ALLOW_LOCAL_REMOTE, t->allow_localremote);
 366
 367         if (t->encap_limit != IPV6_DEFAULT_TNL_ENCAP_LIMIT) {
 368                 r = sd_netlink_message_append_u8(m, IFLA_IPTUN_ENCAP_LIMIT, t->encap_limit);
 369                 if (r < 0)
 370                         return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_ENCAP_LIMIT attribute: %m");
 371         }
 372
 373         r = sd_netlink_message_append_u32(m, IFLA_IPTUN_FLAGS, t->flags);
 374         if (r < 0)
 375                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_FLAGS attribute: %m");
 376
 377         switch (t->ip6tnl_mode) {
 378         case NETDEV_IP6_TNL_MODE_IP6IP6:
 379                 proto = IPPROTO_IPV6;
 380                 break;
 381         case NETDEV_IP6_TNL_MODE_IPIP6:
 382                 proto = IPPROTO_IPIP;
 383                 break;
 384         case NETDEV_IP6_TNL_MODE_ANYIP6:
 385         default:
 386                 proto = 0;
 387                 break;
 388         }
 389
 390         r = sd_netlink_message_append_u8(m, IFLA_IPTUN_PROTO, proto);
 391         if (r < 0)
 392                 return log_netdev_error_errno(netdev, r, "Could not append IFLA_IPTUN_PROTO attribute: %m");
 393
 394         return r;
 395 }
 396
 397 static int netdev_tunnel_verify(NetDev *netdev, const char *filename) {
 398         Tunnel *t = NULL;
 399
 400         assert(netdev);
 401         assert(filename);
 402
 403         switch (netdev->kind) {
 404         case NETDEV_KIND_IPIP:
 405                 t = IPIP(netdev);
 406                 break;
 407         case NETDEV_KIND_SIT:
 408                 t = SIT(netdev);
 409                 break;
 410         case NETDEV_KIND_GRE:
 411                 t = GRE(netdev);
 412                 break;
 413         case NETDEV_KIND_GRETAP:
 414                 t = GRETAP(netdev);
 415                 break;
 416         case NETDEV_KIND_IP6GRE:
 417                 t = IP6GRE(netdev);
 418                 break;
 419         case NETDEV_KIND_IP6GRETAP:
 420                 t = IP6GRETAP(netdev);
 421                 break;
 422         case NETDEV_KIND_VTI:
 423                 t = VTI(netdev);
 424                 break;
 425         case NETDEV_KIND_VTI6:
 426                 t = VTI6(netdev);
 427                 break;
 428         case NETDEV_KIND_IP6TNL:
 429                 t = IP6TNL(netdev);
 430                 break;
 431         case NETDEV_KIND_ERSPAN:
 432                 t = ERSPAN(netdev);
 433                 break;
 434         default:
 435                 assert_not_reached("Invalid tunnel kind");
 436         }
 437
 438         assert(t);
 439
 440         if (IN_SET(netdev->kind, NETDEV_KIND_VTI, NETDEV_KIND_IPIP, NETDEV_KIND_SIT, NETDEV_KIND_GRE, NETDEV_KIND_GRETAP, NETDEV_KIND_ERSPAN) &&
 441             (t->family != AF_INET || in_addr_is_null(t->family, &t->local)))
 442                 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
 443                                               "vti/ipip/sit/gre/gretap/erspan tunnel without a local IPv4 address configured in %s. Ignoring", filename);
 444
 445         if (IN_SET(netdev->kind, NETDEV_KIND_VTI6, NETDEV_KIND_IP6TNL, NETDEV_KIND_IP6GRE, NETDEV_KIND_IP6GRETAP) &&
 446             (t->family != AF_INET6 || in_addr_is_null(t->family, &t->local)))
 447                 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
 448                                               "vti6/ip6tnl/ip6gre/ip6gretap tunnel without a local IPv6 address configured in %s. Ignoring", filename);
 449
 450         if (netdev->kind == NETDEV_KIND_IP6TNL &&
 451             t->ip6tnl_mode == _NETDEV_IP6_TNL_MODE_INVALID)
 452                 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
 453                                               "ip6tnl without mode configured in %s. Ignoring", filename);
 454
 455         if (t->fou_tunnel && t->fou_destination_port <= 0)
 456                 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL),
 457                                               "FooOverUDP missing port configured in %s. Ignoring", filename);
 458
 459         if (netdev->kind == NETDEV_KIND_ERSPAN && (t->erspan_index >= (1 << 20) || t->erspan_index == 0))
 460                 return log_netdev_error_errno(netdev, SYNTHETIC_ERRNO(EINVAL), "Invalid erspan index %d. Ignoring", t->erspan_index);
 461
 462         return 0;
 463 }
 464
 465 int config_parse_tunnel_address(const char *unit,
 466                                 const char *filename,
 467                                 unsigned line,
 468                                 const char *section,
 469                                 unsigned section_line,
 470                                 const char *lvalue,
 471                                 int ltype,
 472                                 const char *rvalue,
 473                                 void *data,
 474                                 void *userdata) {
 475         Tunnel *t = userdata;
 476         union in_addr_union *addr = data, buffer;
 477         int r, f;
 478
 479         assert(filename);
 480         assert(lvalue);
 481         assert(rvalue);
 482         assert(data);
 483
 484         /* This is used to parse addresses on both local and remote ends of the tunnel.
 485          * Address families must match.
 486          *
 487          * "any" is a special value which means that the address is unspecified.
 488          */
 489
 490         if (streq(rvalue, "any")) {
 491                 *addr = IN_ADDR_NULL;
 492
 493                 /* As a special case, if both the local and remote addresses are
 494                  * unspecified, also clear the address family.
 495                  */
 496                 if (t->family != AF_UNSPEC &&
 497                     in_addr_is_null(t->family, &t->local) != 0 &&
 498                     in_addr_is_null(t->family, &t->remote) != 0)
 499                         t->family = AF_UNSPEC;
 500                 return 0;
 501         }
 502
 503         r = in_addr_from_string_auto(rvalue, &f, &buffer);
 504         if (r < 0) {
 505                 log_syntax(unit, LOG_ERR, filename, line, r,
 506                            "Tunnel address \"%s\" invalid, ignoring assignment: %m", rvalue);
 507                 return 0;
 508         }
 509
 510         if (t->family != AF_UNSPEC && t->family != f) {
 511                 log_syntax(unit, LOG_ERR, filename, line, 0,
 512                            "Tunnel addresses incompatible, ignoring assignment: %s", rvalue);
 513                 return 0;
 514         }
 515
 516         t->family = f;
 517         *addr = buffer;
 518         return 0;
 519 }
 520
 521 int config_parse_tunnel_key(const char *unit,
 522                             const char *filename,
 523                             unsigned line,
 524                             const char *section,
 525                             unsigned section_line,
 526                             const char *lvalue,
 527                             int ltype,
 528                             const char *rvalue,
 529                             void *data,
 530                             void *userdata) {
 531         union in_addr_union buffer;
 532         Tunnel *t = userdata;
 533         uint32_t k;
 534         int r;
 535
 536         assert(filename);
 537         assert(lvalue);
 538         assert(rvalue);
 539         assert(data);
 540
 541         r = in_addr_from_string(AF_INET, rvalue, &buffer);
 542         if (r < 0) {
 543                 r = safe_atou32(rvalue, &k);
 544                 if (r < 0) {
 545                         log_syntax(unit, LOG_ERR, filename, line, 0, "Failed to parse tunnel key ignoring assignment: %s", rvalue);
 546                         return 0;
 547                 }
 548         } else
 549                 k = be32toh(buffer.in.s_addr);
 550
 551         if (streq(lvalue, "Key"))
 552                 t->key = k;
 553         else if (streq(lvalue, "InputKey"))
 554                 t->ikey = k;
 555         else
 556                 t->okey = k;
 557
 558         return 0;
 559 }
 560
 561 int config_parse_ipv6_flowlabel(const char* unit,
 562                                 const char *filename,
 563                                 unsigned line,
 564                                 const char *section,
 565                                 unsigned section_line,
 566                                 const char *lvalue,
 567                                 int ltype,
 568                                 const char *rvalue,
 569                                 void *data,
 570                                 void *userdata) {
 571         IPv6FlowLabel *ipv6_flowlabel = data;
 572         Tunnel *t = userdata;
 573         int k = 0;
 574         int r;
 575
 576         assert(filename);
 577         assert(lvalue);
 578         assert(rvalue);
 579         assert(ipv6_flowlabel);
 580
 581         if (streq(rvalue, "inherit")) {
 582                 *ipv6_flowlabel = IP6_FLOWINFO_FLOWLABEL;
 583                 t->flags |= IP6_TNL_F_USE_ORIG_FLOWLABEL;
 584         } else {
 585                 r = config_parse_int(unit, filename, line, section, section_line, lvalue, ltype, rvalue, &k, userdata);
 586                 if (r < 0)
 587                         return r;
 588
 589                 if (k > 0xFFFFF)
 590                         log_syntax(unit, LOG_ERR, filename, line, 0, "Failed to parse IPv6 flowlabel option, ignoring: %s", rvalue);
 591                 else {
 592                         *ipv6_flowlabel = htobe32(k) & IP6_FLOWINFO_FLOWLABEL;
 593                         t->flags &= ~IP6_TNL_F_USE_ORIG_FLOWLABEL;
 594                 }
 595         }
 596
 597         return 0;
 598 }
 599
 600 int config_parse_encap_limit(const char* unit,
 601                              const char *filename,
 602                              unsigned line,
 603                              const char *section,
 604                              unsigned section_line,
 605                              const char *lvalue,
 606                              int ltype,
 607                              const char *rvalue,
 608                              void *data,
 609                              void *userdata) {
 610         Tunnel *t = userdata;
 611         int k = 0;
 612         int r;
 613
 614         assert(filename);
 615         assert(lvalue);
 616         assert(rvalue);
 617
 618         if (streq(rvalue, "none"))
 619                 t->flags |= IP6_TNL_F_IGN_ENCAP_LIMIT;
 620         else {
 621                 r = safe_atoi(rvalue, &k);
 622                 if (r < 0) {
 623                         log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse Tunnel Encapsulation Limit option, ignoring: %s", rvalue);
 624                         return 0;
 625                 }
 626
 627                 if (k > 255 || k < 0)
 628                         log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid Tunnel Encapsulation value, ignoring: %d", k);
 629                 else {
 630                         t->encap_limit = k;
 631                         t->flags &= ~IP6_TNL_F_IGN_ENCAP_LIMIT;
 632                 }
 633         }
 634
 635         return 0;
 636 }
 637
 638 int config_parse_6rd_prefix(const char* unit,
 639                             const char *filename,
 640                             unsigned line,
 641                             const char *section,
 642                             unsigned section_line,
 643                             const char *lvalue,
 644                             int ltype,
 645                             const char *rvalue,
 646                             void *data,
 647                             void *userdata) {
 648         Tunnel *t = userdata;
 649
 650         assert(filename);
 651         assert(lvalue);
 652         assert(rvalue);
 653
 654         union in_addr_union p;
 655         uint8_t l;
 656         int r;
 657
 658         r = in_addr_prefix_from_string(rvalue, AF_INET6, &p, &l);
 659         if (r < 0) {
 660                 log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse 6rd prefix \"%s\", ignoring: %m", rvalue);
 661                 return 0;
 662         }
 663         if (l == 0) {
 664                 log_syntax(unit, LOG_ERR, filename, line, 0, "6rd prefix length of \"%s\" must be greater than zero, ignoring", rvalue);
 665                 return 0;
 666         }
 667
 668         t->sixrd_prefix = p.in6;
 669         t->sixrd_prefixlen = l;
 670
 671         return 0;
 672 }
 673
 674 static void ipip_init(NetDev *n) {
 675         Tunnel *t = IPIP(n);
 676
 677         assert(n);
 678         assert(t);
 679
 680         t->pmtudisc = true;
 681         t->fou_encap_type = FOU_ENCAP_DIRECT;
 682 }
 683
 684 static void sit_init(NetDev *n) {
 685         Tunnel *t = SIT(n);
 686
 687         assert(n);
 688         assert(t);
 689
 690         t->pmtudisc = true;
 691         t->isatap = -1;
 692 }
 693
 694 static void vti_init(NetDev *n) {
 695         Tunnel *t;
 696
 697         assert(n);
 698
 699         if (n->kind == NETDEV_KIND_VTI)
 700                 t = VTI(n);
 701         else
 702                 t = VTI6(n);
 703
 704         assert(t);
 705
 706         t->pmtudisc = true;
 707 }
 708
 709 static void gre_init(NetDev *n) {
 710         Tunnel *t;
 711
 712         assert(n);
 713
 714         if (n->kind == NETDEV_KIND_GRE)
 715                 t = GRE(n);
 716         else
 717                 t = GRETAP(n);
 718
 719         assert(t);
 720
 721         t->pmtudisc = true;
 722 }
 723
 724 static void ip6gre_init(NetDev *n) {
 725         Tunnel *t;
 726
 727         assert(n);
 728
 729         if (n->kind == NETDEV_KIND_IP6GRE)
 730                 t = IP6GRE(n);
 731         else
 732                 t = IP6GRETAP(n);
 733
 734         assert(t);
 735
 736         t->ttl = DEFAULT_TNL_HOP_LIMIT;
 737 }
 738
 739 static void erspan_init(NetDev *n) {
 740         Tunnel *t;
 741
 742         assert(n);
 743
 744         t = ERSPAN(n);
 745
 746         assert(t);
 747
 748         t->erspan_sequence = -1;
 749 }
 750
 751 static void ip6tnl_init(NetDev *n) {
 752         Tunnel *t = IP6TNL(n);
 753
 754         assert(n);
 755         assert(t);
 756
 757         t->ttl = DEFAULT_TNL_HOP_LIMIT;
 758         t->encap_limit = IPV6_DEFAULT_TNL_ENCAP_LIMIT;
 759         t->ip6tnl_mode = _NETDEV_IP6_TNL_MODE_INVALID;
 760         t->ipv6_flowlabel = _NETDEV_IPV6_FLOWLABEL_INVALID;
 761         t->allow_localremote = -1;
 762 }
 763
 764 const NetDevVTable ipip_vtable = {
 765         .object_size = sizeof(Tunnel),
 766         .init = ipip_init,
 767         .sections = "Match\0NetDev\0Tunnel\0",
 768         .fill_message_create = netdev_ipip_sit_fill_message_create,
 769         .create_type = NETDEV_CREATE_STACKED,
 770         .config_verify = netdev_tunnel_verify,
 771 };
 772
 773 const NetDevVTable sit_vtable = {
 774         .object_size = sizeof(Tunnel),
 775         .init = sit_init,
 776         .sections = "Match\0NetDev\0Tunnel\0",
 777         .fill_message_create = netdev_ipip_sit_fill_message_create,
 778         .create_type = NETDEV_CREATE_STACKED,
 779         .config_verify = netdev_tunnel_verify,
 780 };
 781
 782 const NetDevVTable vti_vtable = {
 783         .object_size = sizeof(Tunnel),
 784         .init = vti_init,
 785         .sections = "Match\0NetDev\0Tunnel\0",
 786         .fill_message_create = netdev_vti_fill_message_create,
 787         .create_type = NETDEV_CREATE_STACKED,
 788         .config_verify = netdev_tunnel_verify,
 789 };
 790
 791 const NetDevVTable vti6_vtable = {
 792         .object_size = sizeof(Tunnel),
 793         .init = vti_init,
 794         .sections = "Match\0NetDev\0Tunnel\0",
 795         .fill_message_create = netdev_vti_fill_message_create,
 796         .create_type = NETDEV_CREATE_STACKED,
 797         .config_verify = netdev_tunnel_verify,
 798 };
 799
 800 const NetDevVTable gre_vtable = {
 801         .object_size = sizeof(Tunnel),
 802         .init = gre_init,
 803         .sections = "Match\0NetDev\0Tunnel\0",
 804         .fill_message_create = netdev_gre_fill_message_create,
 805         .create_type = NETDEV_CREATE_STACKED,
 806         .config_verify = netdev_tunnel_verify,
 807 };
 808
 809 const NetDevVTable gretap_vtable = {
 810         .object_size = sizeof(Tunnel),
 811         .init = gre_init,
 812         .sections = "Match\0NetDev\0Tunnel\0",
 813         .fill_message_create = netdev_gre_fill_message_create,
 814         .create_type = NETDEV_CREATE_STACKED,
 815         .config_verify = netdev_tunnel_verify,
 816 };
 817
 818 const NetDevVTable ip6gre_vtable = {
 819         .object_size = sizeof(Tunnel),
 820         .init = ip6gre_init,
 821         .sections = "Match\0NetDev\0Tunnel\0",
 822         .fill_message_create = netdev_ip6gre_fill_message_create,
 823         .create_type = NETDEV_CREATE_STACKED,
 824         .config_verify = netdev_tunnel_verify,
 825 };
 826
 827 const NetDevVTable ip6gretap_vtable = {
 828         .object_size = sizeof(Tunnel),
 829         .init = ip6gre_init,
 830         .sections = "Match\0NetDev\0Tunnel\0",
 831         .fill_message_create = netdev_ip6gre_fill_message_create,
 832         .create_type = NETDEV_CREATE_STACKED,
 833         .config_verify = netdev_tunnel_verify,
 834 };
 835
 836 const NetDevVTable ip6tnl_vtable = {
 837         .object_size = sizeof(Tunnel),
 838         .init = ip6tnl_init,
 839         .sections = "Match\0NetDev\0Tunnel\0",
 840         .fill_message_create = netdev_ip6tnl_fill_message_create,
 841         .create_type = NETDEV_CREATE_STACKED,
 842         .config_verify = netdev_tunnel_verify,
 843 };
 844
 845 const NetDevVTable erspan_vtable = {
 846         .object_size = sizeof(Tunnel),
 847         .init = erspan_init,
 848         .sections = "Match\0NetDev\0Tunnel\0",
 849         .fill_message_create = netdev_erspan_fill_message_create,
 850         .create_type = NETDEV_CREATE_INDEPENDENT,
 851         .config_verify = netdev_tunnel_verify,
 852 };