vxlan_core.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * VXLAN: Virtual eXtensible Local Area Network
   4 *
   5 * Copyright (c) 2012-2013 Vyatta Inc.
   6 */
   7
   8#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   9
  10#include <linux/kernel.h>
  11#include <linux/module.h>
  12#include <linux/errno.h>
  13#include <linux/slab.h>
  14#include <linux/udp.h>
  15#include <linux/igmp.h>
  16#include <linux/if_ether.h>
  17#include <linux/ethtool.h>
  18#include <linux/rhashtable.h>
  19#include <net/arp.h>
  20#include <net/ndisc.h>
  21#include <net/gro.h>
  22#include <net/ipv6_stubs.h>
  23#include <net/ip.h>
  24#include <net/icmp.h>
  25#include <net/rtnetlink.h>
  26#include <net/inet_ecn.h>
  27#include <net/net_namespace.h>
  28#include <net/netns/generic.h>
  29#include <net/netdev_lock.h>
  30#include <net/tun_proto.h>
  31#include <net/vxlan.h>
  32#include <net/nexthop.h>
  33
  34#if IS_ENABLED(CONFIG_IPV6)
  35#include <net/ip6_tunnel.h>
  36#include <net/ip6_checksum.h>
  37#endif
  38
  39#include "vxlan_private.h"
  40
  41#define VXLAN_VERSION	"0.1"
  42
  43#define FDB_AGE_DEFAULT 300 /* 5 min */
  44#define FDB_AGE_INTERVAL (10 * HZ)	/* rescan interval */
  45
  46/* UDP port for VXLAN traffic.
  47 * The IANA assigned port is 4789, but the Linux default is 8472
  48 * for compatibility with early adopters.
  49 */
  50static unsigned short vxlan_port __read_mostly = 8472;
  51module_param_named(udp_port, vxlan_port, ushort, 0444);
  52MODULE_PARM_DESC(udp_port, "Destination UDP port");
  53
  54static bool log_ecn_error = true;
  55module_param(log_ecn_error, bool, 0644);
  56MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
  57
  58unsigned int vxlan_net_id;
  59
  60const u8 all_zeros_mac[ETH_ALEN + 2];
  61static struct rtnl_link_ops vxlan_link_ops;
  62
  63static int vxlan_sock_add(struct vxlan_dev *vxlan);
  64
  65static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
  66
  67static const struct rhashtable_params vxlan_fdb_rht_params = {
  68	.head_offset = offsetof(struct vxlan_fdb, rhnode),
  69	.key_offset = offsetof(struct vxlan_fdb, key),
  70	.key_len = sizeof(struct vxlan_fdb_key),
  71	.automatic_shrinking = true,
  72};
  73
  74static inline bool vxlan_collect_metadata(struct vxlan_sock *vs)
  75{
  76	return vs->flags & VXLAN_F_COLLECT_METADATA ||
  77	       ip_tunnel_collect_metadata();
  78}
  79
  80/* Find VXLAN socket based on network namespace, address family, UDP port,
  81 * enabled unshareable flags and socket device binding (see l3mdev with
  82 * non-default VRF).
  83 */
  84static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family,
  85					  __be16 port, u32 flags, int ifindex)
  86{
  87	struct vxlan_sock *vs;
  88
  89	flags &= VXLAN_F_RCV_FLAGS;
  90
  91	hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) {
  92		if (inet_sk(vs->sock->sk)->inet_sport == port &&
  93		    vxlan_get_sk_family(vs) == family &&
  94		    vs->flags == flags &&
  95		    vs->sock->sk->sk_bound_dev_if == ifindex)
  96			return vs;
  97	}
  98	return NULL;
  99}
 100
 101static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs,
 102					   int ifindex, __be32 vni,
 103					   struct vxlan_vni_node **vninode)
 104{
 105	struct vxlan_vni_node *vnode;
 106	struct vxlan_dev_node *node;
 107
 108	/* For flow based devices, map all packets to VNI 0 */
 109	if (vs->flags & VXLAN_F_COLLECT_METADATA &&
 110	    !(vs->flags & VXLAN_F_VNIFILTER))
 111		vni = 0;
 112
 113	hlist_for_each_entry_rcu(node, vni_head(vs, vni), hlist) {
 114		if (!node->vxlan)
 115			continue;
 116		vnode = NULL;
 117		if (node->vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
 118			vnode = vxlan_vnifilter_lookup(node->vxlan, vni);
 119			if (!vnode)
 120				continue;
 121		} else if (node->vxlan->default_dst.remote_vni != vni) {
 122			continue;
 123		}
 124
 125		if (IS_ENABLED(CONFIG_IPV6)) {
 126			const struct vxlan_config *cfg = &node->vxlan->cfg;
 127
 128			if ((cfg->flags & VXLAN_F_IPV6_LINKLOCAL) &&
 129			    cfg->remote_ifindex != ifindex)
 130				continue;
 131		}
 132
 133		if (vninode)
 134			*vninode = vnode;
 135		return node->vxlan;
 136	}
 137
 138	return NULL;
 139}
 140
 141/* Look up VNI in a per net namespace table */
 142static struct vxlan_dev *vxlan_find_vni(struct net *net, int ifindex,
 143					__be32 vni, sa_family_t family,
 144					__be16 port, u32 flags)
 145{
 146	struct vxlan_sock *vs;
 147
 148	vs = vxlan_find_sock(net, family, port, flags, ifindex);
 149	if (!vs)
 150		return NULL;
 151
 152	return vxlan_vs_find_vni(vs, ifindex, vni, NULL);
 153}
 154
 155/* Fill in neighbour message in skbuff. */
 156static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan,
 157			  const struct vxlan_fdb *fdb,
 158			  u32 portid, u32 seq, int type, unsigned int flags,
 159			  const struct vxlan_rdst *rdst)
 160{
 161	unsigned long now = jiffies;
 162	struct nda_cacheinfo ci;
 163	bool send_ip, send_eth;
 164	struct nlmsghdr *nlh;
 165	struct nexthop *nh;
 166	struct ndmsg *ndm;
 167	int nh_family;
 168	u32 nh_id;
 169
 170	nlh = nlmsg_put(skb, portid, seq, type, sizeof(*ndm), flags);
 171	if (nlh == NULL)
 172		return -EMSGSIZE;
 173
 174	ndm = nlmsg_data(nlh);
 175	memset(ndm, 0, sizeof(*ndm));
 176
 177	send_eth = send_ip = true;
 178
 179	rcu_read_lock();
 180	nh = rcu_dereference(fdb->nh);
 181	if (nh) {
 182		nh_family = nexthop_get_family(nh);
 183		nh_id = nh->id;
 184	}
 185	rcu_read_unlock();
 186
 187	if (type == RTM_GETNEIGH) {
 188		if (rdst) {
 189			send_ip = !vxlan_addr_any(&rdst->remote_ip);
 190			ndm->ndm_family = send_ip ? rdst->remote_ip.sa.sa_family : AF_INET;
 191		} else if (nh) {
 192			ndm->ndm_family = nh_family;
 193		}
 194		send_eth = !is_zero_ether_addr(fdb->key.eth_addr);
 195	} else
 196		ndm->ndm_family	= AF_BRIDGE;
 197	ndm->ndm_state = fdb->state;
 198	ndm->ndm_ifindex = vxlan->dev->ifindex;
 199	ndm->ndm_flags = fdb->flags;
 200	if (rdst && rdst->offloaded)
 201		ndm->ndm_flags |= NTF_OFFLOADED;
 202	ndm->ndm_type = RTN_UNICAST;
 203
 204	if (!net_eq(dev_net(vxlan->dev), vxlan->net) &&
 205	    nla_put_s32(skb, NDA_LINK_NETNSID,
 206			peernet2id(dev_net(vxlan->dev), vxlan->net)))
 207		goto nla_put_failure;
 208
 209	if (send_eth && nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->key.eth_addr))
 210		goto nla_put_failure;
 211	if (nh) {
 212		if (nla_put_u32(skb, NDA_NH_ID, nh_id))
 213			goto nla_put_failure;
 214	} else if (rdst) {
 215		if (send_ip && vxlan_nla_put_addr(skb, NDA_DST,
 216						  &rdst->remote_ip))
 217			goto nla_put_failure;
 218
 219		if (rdst->remote_port &&
 220		    rdst->remote_port != vxlan->cfg.dst_port &&
 221		    nla_put_be16(skb, NDA_PORT, rdst->remote_port))
 222			goto nla_put_failure;
 223		if (rdst->remote_vni != vxlan->default_dst.remote_vni &&
 224		    nla_put_u32(skb, NDA_VNI, be32_to_cpu(rdst->remote_vni)))
 225			goto nla_put_failure;
 226		if (rdst->remote_ifindex &&
 227		    nla_put_u32(skb, NDA_IFINDEX, rdst->remote_ifindex))
 228			goto nla_put_failure;
 229	}
 230
 231	if ((vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA) && fdb->key.vni &&
 232	    nla_put_u32(skb, NDA_SRC_VNI,
 233			be32_to_cpu(fdb->key.vni)))
 234		goto nla_put_failure;
 235
 236	ci.ndm_used	 = jiffies_to_clock_t(now - READ_ONCE(fdb->used));
 237	ci.ndm_confirmed = 0;
 238	ci.ndm_updated	 = jiffies_to_clock_t(now - READ_ONCE(fdb->updated));
 239	ci.ndm_refcnt	 = 0;
 240
 241	if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
 242		goto nla_put_failure;
 243
 244	nlmsg_end(skb, nlh);
 245	return 0;
 246
 247nla_put_failure:
 248	nlmsg_cancel(skb, nlh);
 249	return -EMSGSIZE;
 250}
 251
 252static inline size_t vxlan_nlmsg_size(void)
 253{
 254	return NLMSG_ALIGN(sizeof(struct ndmsg))
 255		+ nla_total_size(ETH_ALEN) /* NDA_LLADDR */
 256		+ nla_total_size(sizeof(struct in6_addr)) /* NDA_DST */
 257		+ nla_total_size(sizeof(__be16)) /* NDA_PORT */
 258		+ nla_total_size(sizeof(__be32)) /* NDA_VNI */
 259		+ nla_total_size(sizeof(__u32)) /* NDA_IFINDEX */
 260		+ nla_total_size(sizeof(__s32)) /* NDA_LINK_NETNSID */
 261		+ nla_total_size(sizeof(struct nda_cacheinfo));
 262}
 263
 264static void __vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
 265			       struct vxlan_rdst *rd, int type)
 266{
 267	struct net *net = dev_net(vxlan->dev);
 268	struct sk_buff *skb;
 269	int err = -ENOBUFS;
 270
 271	skb = nlmsg_new(vxlan_nlmsg_size(), GFP_ATOMIC);
 272	if (skb == NULL)
 273		goto errout;
 274
 275	err = vxlan_fdb_info(skb, vxlan, fdb, 0, 0, type, 0, rd);
 276	if (err < 0) {
 277		/* -EMSGSIZE implies BUG in vxlan_nlmsg_size() */
 278		WARN_ON(err == -EMSGSIZE);
 279		kfree_skb(skb);
 280		goto errout;
 281	}
 282
 283	rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
 284	return;
 285errout:
 286	rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
 287}
 288
 289static void vxlan_fdb_switchdev_notifier_info(const struct vxlan_dev *vxlan,
 290			    const struct vxlan_fdb *fdb,
 291			    const struct vxlan_rdst *rd,
 292			    struct netlink_ext_ack *extack,
 293			    struct switchdev_notifier_vxlan_fdb_info *fdb_info)
 294{
 295	fdb_info->info.dev = vxlan->dev;
 296	fdb_info->info.extack = extack;
 297	fdb_info->remote_ip = rd->remote_ip;
 298	fdb_info->remote_port = rd->remote_port;
 299	fdb_info->remote_vni = rd->remote_vni;
 300	fdb_info->remote_ifindex = rd->remote_ifindex;
 301	memcpy(fdb_info->eth_addr, fdb->key.eth_addr, ETH_ALEN);
 302	fdb_info->vni = fdb->key.vni;
 303	fdb_info->offloaded = rd->offloaded;
 304	fdb_info->added_by_user = fdb->flags & NTF_VXLAN_ADDED_BY_USER;
 305}
 306
 307static int vxlan_fdb_switchdev_call_notifiers(struct vxlan_dev *vxlan,
 308					      struct vxlan_fdb *fdb,
 309					      struct vxlan_rdst *rd,
 310					      bool adding,
 311					      struct netlink_ext_ack *extack)
 312{
 313	struct switchdev_notifier_vxlan_fdb_info info;
 314	enum switchdev_notifier_type notifier_type;
 315	int ret;
 316
 317	if (WARN_ON(!rd))
 318		return 0;
 319
 320	notifier_type = adding ? SWITCHDEV_VXLAN_FDB_ADD_TO_DEVICE
 321			       : SWITCHDEV_VXLAN_FDB_DEL_TO_DEVICE;
 322	vxlan_fdb_switchdev_notifier_info(vxlan, fdb, rd, NULL, &info);
 323	ret = call_switchdev_notifiers(notifier_type, vxlan->dev,
 324				       &info.info, extack);
 325	return notifier_to_errno(ret);
 326}
 327
 328static int vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
 329			    struct vxlan_rdst *rd, int type, bool swdev_notify,
 330			    struct netlink_ext_ack *extack)
 331{
 332	int err;
 333
 334	if (swdev_notify && rd) {
 335		switch (type) {
 336		case RTM_NEWNEIGH:
 337			err = vxlan_fdb_switchdev_call_notifiers(vxlan, fdb, rd,
 338								 true, extack);
 339			if (err)
 340				return err;
 341			break;
 342		case RTM_DELNEIGH:
 343			vxlan_fdb_switchdev_call_notifiers(vxlan, fdb, rd,
 344							   false, extack);
 345			break;
 346		}
 347	}
 348
 349	__vxlan_fdb_notify(vxlan, fdb, rd, type);
 350	return 0;
 351}
 352
 353static void vxlan_ip_miss(struct net_device *dev, union vxlan_addr *ipa)
 354{
 355	struct vxlan_dev *vxlan = netdev_priv(dev);
 356	struct vxlan_fdb f = {
 357		.state = NUD_STALE,
 358	};
 359	struct vxlan_rdst remote = {
 360		.remote_ip = *ipa, /* goes to NDA_DST */
 361		.remote_vni = cpu_to_be32(VXLAN_N_VID),
 362	};
 363
 364	vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH, true, NULL);
 365}
 366
 367static void vxlan_fdb_miss(struct vxlan_dev *vxlan, const u8 eth_addr[ETH_ALEN])
 368{
 369	struct vxlan_fdb f = {
 370		.state = NUD_STALE,
 371	};
 372	struct vxlan_rdst remote = { };
 373
 374	memcpy(f.key.eth_addr, eth_addr, ETH_ALEN);
 375
 376	vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH, true, NULL);
 377}
 378
 379/* Look up Ethernet address in forwarding table */
 380static struct vxlan_fdb *vxlan_find_mac_rcu(struct vxlan_dev *vxlan,
 381					    const u8 *mac, __be32 vni)
 382{
 383	struct vxlan_fdb_key key;
 384
 385	memset(&key, 0, sizeof(key));
 386	memcpy(key.eth_addr, mac, sizeof(key.eth_addr));
 387	if (!(vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA))
 388		key.vni = vxlan->default_dst.remote_vni;
 389	else
 390		key.vni = vni;
 391
 392	return rhashtable_lookup(&vxlan->fdb_hash_tbl, &key,
 393				 vxlan_fdb_rht_params);
 394}
 395
 396static struct vxlan_fdb *vxlan_find_mac_tx(struct vxlan_dev *vxlan,
 397					   const u8 *mac, __be32 vni)
 398{
 399	struct vxlan_fdb *f;
 400
 401	f = vxlan_find_mac_rcu(vxlan, mac, vni);
 402	if (f) {
 403		unsigned long now = jiffies;
 404
 405		if (READ_ONCE(f->used) != now)
 406			WRITE_ONCE(f->used, now);
 407	}
 408
 409	return f;
 410}
 411
 412static struct vxlan_fdb *vxlan_find_mac(struct vxlan_dev *vxlan,
 413					const u8 *mac, __be32 vni)
 414{
 415	struct vxlan_fdb *f;
 416
 417	lockdep_assert_held_once(&vxlan->hash_lock);
 418
 419	rcu_read_lock();
 420	f = vxlan_find_mac_rcu(vxlan, mac, vni);
 421	rcu_read_unlock();
 422
 423	return f;
 424}
 425
 426/* caller should hold vxlan->hash_lock */
 427static struct vxlan_rdst *vxlan_fdb_find_rdst(struct vxlan_fdb *f,
 428					      union vxlan_addr *ip, __be16 port,
 429					      __be32 vni, __u32 ifindex)
 430{
 431	struct vxlan_rdst *rd;
 432
 433	list_for_each_entry(rd, &f->remotes, list) {
 434		if (vxlan_addr_equal(&rd->remote_ip, ip) &&
 435		    rd->remote_port == port &&
 436		    rd->remote_vni == vni &&
 437		    rd->remote_ifindex == ifindex)
 438			return rd;
 439	}
 440
 441	return NULL;
 442}
 443
 444int vxlan_fdb_find_uc(struct net_device *dev, const u8 *mac, __be32 vni,
 445		      struct switchdev_notifier_vxlan_fdb_info *fdb_info)
 446{
 447	struct vxlan_dev *vxlan = netdev_priv(dev);
 448	u8 eth_addr[ETH_ALEN + 2] = { 0 };
 449	struct vxlan_rdst *rdst = NULL;
 450	struct vxlan_fdb *f;
 451	int rc = 0;
 452
 453	if (is_multicast_ether_addr(mac) ||
 454	    is_zero_ether_addr(mac))
 455		return -EINVAL;
 456
 457	ether_addr_copy(eth_addr, mac);
 458
 459	rcu_read_lock();
 460
 461	f = vxlan_find_mac_rcu(vxlan, eth_addr, vni);
 462	if (f)
 463		rdst = first_remote_rcu(f);
 464	if (!rdst) {
 465		rc = -ENOENT;
 466		goto out;
 467	}
 468
 469	vxlan_fdb_switchdev_notifier_info(vxlan, f, rdst, NULL, fdb_info);
 470
 471out:
 472	rcu_read_unlock();
 473	return rc;
 474}
 475EXPORT_SYMBOL_GPL(vxlan_fdb_find_uc);
 476
 477static int vxlan_fdb_notify_one(struct notifier_block *nb,
 478				const struct vxlan_dev *vxlan,
 479				const struct vxlan_fdb *f,
 480				const struct vxlan_rdst *rdst,
 481				struct netlink_ext_ack *extack)
 482{
 483	struct switchdev_notifier_vxlan_fdb_info fdb_info;
 484	int rc;
 485
 486	vxlan_fdb_switchdev_notifier_info(vxlan, f, rdst, extack, &fdb_info);
 487	rc = nb->notifier_call(nb, SWITCHDEV_VXLAN_FDB_ADD_TO_DEVICE,
 488			       &fdb_info);
 489	return notifier_to_errno(rc);
 490}
 491
 492int vxlan_fdb_replay(const struct net_device *dev, __be32 vni,
 493		     struct notifier_block *nb,
 494		     struct netlink_ext_ack *extack)
 495{
 496	struct vxlan_dev *vxlan;
 497	struct vxlan_rdst *rdst;
 498	struct vxlan_fdb *f;
 499	int rc = 0;
 500
 501	if (!netif_is_vxlan(dev))
 502		return -EINVAL;
 503	vxlan = netdev_priv(dev);
 504
 505	spin_lock_bh(&vxlan->hash_lock);
 506	hlist_for_each_entry(f, &vxlan->fdb_list, fdb_node) {
 507		if (f->key.vni == vni) {
 508			list_for_each_entry(rdst, &f->remotes, list) {
 509				rc = vxlan_fdb_notify_one(nb, vxlan, f, rdst,
 510							  extack);
 511				if (rc)
 512					goto unlock;
 513			}
 514		}
 515	}
 516	spin_unlock_bh(&vxlan->hash_lock);
 517	return 0;
 518
 519unlock:
 520	spin_unlock_bh(&vxlan->hash_lock);
 521	return rc;
 522}
 523EXPORT_SYMBOL_GPL(vxlan_fdb_replay);
 524
 525void vxlan_fdb_clear_offload(const struct net_device *dev, __be32 vni)
 526{
 527	struct vxlan_dev *vxlan;
 528	struct vxlan_rdst *rdst;
 529	struct vxlan_fdb *f;
 530
 531	if (!netif_is_vxlan(dev))
 532		return;
 533	vxlan = netdev_priv(dev);
 534
 535	spin_lock_bh(&vxlan->hash_lock);
 536	hlist_for_each_entry(f, &vxlan->fdb_list, fdb_node) {
 537		if (f->key.vni == vni) {
 538			list_for_each_entry(rdst, &f->remotes, list)
 539				rdst->offloaded = false;
 540		}
 541	}
 542	spin_unlock_bh(&vxlan->hash_lock);
 543
 544}
 545EXPORT_SYMBOL_GPL(vxlan_fdb_clear_offload);
 546
 547/* Replace destination of unicast mac */
 548static int vxlan_fdb_replace(struct vxlan_fdb *f,
 549			     union vxlan_addr *ip, __be16 port, __be32 vni,
 550			     __u32 ifindex, struct vxlan_rdst *oldrd)
 551{
 552	struct vxlan_rdst *rd;
 553
 554	rd = vxlan_fdb_find_rdst(f, ip, port, vni, ifindex);
 555	if (rd)
 556		return 0;
 557
 558	rd = list_first_entry_or_null(&f->remotes, struct vxlan_rdst, list);
 559	if (!rd)
 560		return 0;
 561
 562	*oldrd = *rd;
 563	dst_cache_reset(&rd->dst_cache);
 564	rd->remote_ip = *ip;
 565	rd->remote_port = port;
 566	rd->remote_vni = vni;
 567	rd->remote_ifindex = ifindex;
 568	rd->offloaded = false;
 569	return 1;
 570}
 571
 572/* Add/update destinations for multicast */
 573static int vxlan_fdb_append(struct vxlan_fdb *f,
 574			    union vxlan_addr *ip, __be16 port, __be32 vni,
 575			    __u32 ifindex, struct vxlan_rdst **rdp)
 576{
 577	struct vxlan_rdst *rd;
 578
 579	rd = vxlan_fdb_find_rdst(f, ip, port, vni, ifindex);
 580	if (rd)
 581		return 0;
 582
 583	rd = kmalloc(sizeof(*rd), GFP_ATOMIC);
 584	if (rd == NULL)
 585		return -ENOMEM;
 586
 587	/* The driver can work correctly without a dst cache, so do not treat
 588	 * dst cache initialization errors as fatal.
 589	 */
 590	dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN);
 591
 592	rd->remote_ip = *ip;
 593	rd->remote_port = port;
 594	rd->offloaded = false;
 595	rd->remote_vni = vni;
 596	rd->remote_ifindex = ifindex;
 597
 598	list_add_tail_rcu(&rd->list, &f->remotes);
 599
 600	*rdp = rd;
 601	return 1;
 602}
 603
 604static bool vxlan_parse_gpe_proto(const struct vxlanhdr *hdr, __be16 *protocol)
 605{
 606	const struct vxlanhdr_gpe *gpe = (const struct vxlanhdr_gpe *)hdr;
 607
 608	/* Need to have Next Protocol set for interfaces in GPE mode. */
 609	if (!gpe->np_applied)
 610		return false;
 611	/* "The initial version is 0. If a receiver does not support the
 612	 * version indicated it MUST drop the packet.
 613	 */
 614	if (gpe->version != 0)
 615		return false;
 616	/* "When the O bit is set to 1, the packet is an OAM packet and OAM
 617	 * processing MUST occur." However, we don't implement OAM
 618	 * processing, thus drop the packet.
 619	 */
 620	if (gpe->oam_flag)
 621		return false;
 622
 623	*protocol = tun_p_to_eth_p(gpe->next_protocol);
 624	if (!*protocol)
 625		return false;
 626
 627	return true;
 628}
 629
 630static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb,
 631					  unsigned int off,
 632					  struct vxlanhdr *vh, size_t hdrlen,
 633					  __be32 vni_field,
 634					  struct gro_remcsum *grc,
 635					  bool nopartial)
 636{
 637	size_t start, offset;
 638
 639	if (skb->remcsum_offload)
 640		return vh;
 641
 642	if (!NAPI_GRO_CB(skb)->csum_valid)
 643		return NULL;
 644
 645	start = vxlan_rco_start(vni_field);
 646	offset = start + vxlan_rco_offset(vni_field);
 647
 648	vh = skb_gro_remcsum_process(skb, (void *)vh, off, hdrlen,
 649				     start, offset, grc, nopartial);
 650
 651	skb->remcsum_offload = 1;
 652
 653	return vh;
 654}
 655
 656static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk,
 657						  struct list_head *head,
 658						  struct sk_buff *skb,
 659						  struct gro_remcsum *grc)
 660{
 661	struct sk_buff *p;
 662	struct vxlanhdr *vh, *vh2;
 663	unsigned int hlen, off_vx;
 664	struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk);
 665	__be32 flags;
 666
 667	skb_gro_remcsum_init(grc);
 668
 669	off_vx = skb_gro_offset(skb);
 670	hlen = off_vx + sizeof(*vh);
 671	vh = skb_gro_header(skb, hlen, off_vx);
 672	if (unlikely(!vh))
 673		return NULL;
 674
 675	skb_gro_postpull_rcsum(skb, vh, sizeof(struct vxlanhdr));
 676
 677	flags = vh->vx_flags;
 678
 679	if ((flags & VXLAN_HF_RCO) && (vs->flags & VXLAN_F_REMCSUM_RX)) {
 680		vh = vxlan_gro_remcsum(skb, off_vx, vh, sizeof(struct vxlanhdr),
 681				       vh->vx_vni, grc,
 682				       !!(vs->flags &
 683					  VXLAN_F_REMCSUM_NOPARTIAL));
 684
 685		if (!vh)
 686			return NULL;
 687	}
 688
 689	skb_gro_pull(skb, sizeof(struct vxlanhdr)); /* pull vxlan header */
 690
 691	list_for_each_entry(p, head, list) {
 692		if (!NAPI_GRO_CB(p)->same_flow)
 693			continue;
 694
 695		vh2 = (struct vxlanhdr *)(p->data + off_vx);
 696		if (vh->vx_flags != vh2->vx_flags ||
 697		    vh->vx_vni != vh2->vx_vni) {
 698			NAPI_GRO_CB(p)->same_flow = 0;
 699			continue;
 700		}
 701	}
 702
 703	return vh;
 704}
 705
 706static struct sk_buff *vxlan_gro_receive(struct sock *sk,
 707					 struct list_head *head,
 708					 struct sk_buff *skb)
 709{
 710	struct sk_buff *pp = NULL;
 711	struct gro_remcsum grc;
 712	int flush = 1;
 713
 714	if (vxlan_gro_prepare_receive(sk, head, skb, &grc)) {
 715		pp = call_gro_receive(eth_gro_receive, head, skb);
 716		flush = 0;
 717	}
 718	skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
 719	return pp;
 720}
 721
 722static struct sk_buff *vxlan_gpe_gro_receive(struct sock *sk,
 723					     struct list_head *head,
 724					     struct sk_buff *skb)
 725{
 726	const struct packet_offload *ptype;
 727	struct sk_buff *pp = NULL;
 728	struct gro_remcsum grc;
 729	struct vxlanhdr *vh;
 730	__be16 protocol;
 731	int flush = 1;
 732
 733	vh = vxlan_gro_prepare_receive(sk, head, skb, &grc);
 734	if (vh) {
 735		if (!vxlan_parse_gpe_proto(vh, &protocol))
 736			goto out;
 737		ptype = gro_find_receive_by_type(protocol);
 738		if (!ptype)
 739			goto out;
 740		pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
 741		flush = 0;
 742	}
 743out:
 744	skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
 745	return pp;
 746}
 747
 748static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
 749{
 750	/* Sets 'skb->inner_mac_header' since we are always called with
 751	 * 'skb->encapsulation' set.
 752	 */
 753	return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
 754}
 755
 756static int vxlan_gpe_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
 757{
 758	struct vxlanhdr *vh = (struct vxlanhdr *)(skb->data + nhoff);
 759	const struct packet_offload *ptype;
 760	int err = -ENOSYS;
 761	__be16 protocol;
 762
 763	if (!vxlan_parse_gpe_proto(vh, &protocol))
 764		return err;
 765	ptype = gro_find_complete_by_type(protocol);
 766	if (ptype)
 767		err = ptype->callbacks.gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
 768	return err;
 769}
 770
 771static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan, const u8 *mac,
 772					 __u16 state, __be32 src_vni,
 773					 __u16 ndm_flags)
 774{
 775	struct vxlan_fdb *f;
 776
 777	f = kmalloc(sizeof(*f), GFP_ATOMIC);
 778	if (!f)
 779		return NULL;
 780	memset(&f->key, 0, sizeof(f->key));
 781	f->state = state;
 782	f->flags = ndm_flags;
 783	f->updated = f->used = jiffies;
 784	f->key.vni = src_vni;
 785	f->nh = NULL;
 786	RCU_INIT_POINTER(f->vdev, vxlan);
 787	INIT_LIST_HEAD(&f->nh_list);
 788	INIT_LIST_HEAD(&f->remotes);
 789	memcpy(f->key.eth_addr, mac, ETH_ALEN);
 790
 791	return f;
 792}
 793
 794static int vxlan_fdb_nh_update(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
 795			       u32 nhid, struct netlink_ext_ack *extack)
 796{
 797	struct nexthop *old_nh = rtnl_dereference(fdb->nh);
 798	struct nexthop *nh;
 799	int err = -EINVAL;
 800
 801	if (old_nh && old_nh->id == nhid)
 802		return 0;
 803
 804	nh = nexthop_find_by_id(vxlan->net, nhid);
 805	if (!nh) {
 806		NL_SET_ERR_MSG(extack, "Nexthop id does not exist");
 807		goto err_inval;
 808	}
 809
 810	if (!nexthop_get(nh)) {
 811		NL_SET_ERR_MSG(extack, "Nexthop has been deleted");
 812		nh = NULL;
 813		goto err_inval;
 814	}
 815	if (!nexthop_is_fdb(nh)) {
 816		NL_SET_ERR_MSG(extack, "Nexthop is not a fdb nexthop");
 817		goto err_inval;
 818	}
 819
 820	if (!nexthop_is_multipath(nh)) {
 821		NL_SET_ERR_MSG(extack, "Nexthop is not a multipath group");
 822		goto err_inval;
 823	}
 824
 825	/* check nexthop group family */
 826	switch (vxlan->default_dst.remote_ip.sa.sa_family) {
 827	case AF_INET:
 828		if (!nexthop_has_v4(nh)) {
 829			err = -EAFNOSUPPORT;
 830			NL_SET_ERR_MSG(extack, "Nexthop group family not supported");
 831			goto err_inval;
 832		}
 833		break;
 834	case AF_INET6:
 835		if (nexthop_has_v4(nh)) {
 836			err = -EAFNOSUPPORT;
 837			NL_SET_ERR_MSG(extack, "Nexthop group family not supported");
 838			goto err_inval;
 839		}
 840	}
 841
 842	if (old_nh) {
 843		list_del_rcu(&fdb->nh_list);
 844		nexthop_put(old_nh);
 845	}
 846	rcu_assign_pointer(fdb->nh, nh);
 847	list_add_tail_rcu(&fdb->nh_list, &nh->fdb_list);
 848	return 1;
 849
 850err_inval:
 851	if (nh)
 852		nexthop_put(nh);
 853	return err;
 854}
 855
 856int vxlan_fdb_create(struct vxlan_dev *vxlan,
 857		     const u8 *mac, union vxlan_addr *ip,
 858		     __u16 state, __be16 port, __be32 src_vni,
 859		     __be32 vni, __u32 ifindex, __u16 ndm_flags,
 860		     u32 nhid, struct vxlan_fdb **fdb,
 861		     struct netlink_ext_ack *extack)
 862{
 863	struct vxlan_rdst *rd = NULL;
 864	struct vxlan_fdb *f;
 865	int rc;
 866
 867	if (vxlan->cfg.addrmax &&
 868	    vxlan->addrcnt >= vxlan->cfg.addrmax)
 869		return -ENOSPC;
 870
 871	netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
 872	f = vxlan_fdb_alloc(vxlan, mac, state, src_vni, ndm_flags);
 873	if (!f)
 874		return -ENOMEM;
 875
 876	if (nhid)
 877		rc = vxlan_fdb_nh_update(vxlan, f, nhid, extack);
 878	else
 879		rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
 880	if (rc < 0)
 881		goto errout;
 882
 883	rc = rhashtable_lookup_insert_fast(&vxlan->fdb_hash_tbl, &f->rhnode,
 884					   vxlan_fdb_rht_params);
 885	if (rc)
 886		goto destroy_remote;
 887
 888	++vxlan->addrcnt;
 889	hlist_add_head_rcu(&f->fdb_node, &vxlan->fdb_list);
 890
 891	*fdb = f;
 892
 893	return 0;
 894
 895destroy_remote:
 896	if (rcu_access_pointer(f->nh)) {
 897		list_del_rcu(&f->nh_list);
 898		nexthop_put(rtnl_dereference(f->nh));
 899	} else {
 900		list_del(&rd->list);
 901		dst_cache_destroy(&rd->dst_cache);
 902		kfree(rd);
 903	}
 904errout:
 905	kfree(f);
 906	return rc;
 907}
 908
 909static void __vxlan_fdb_free(struct vxlan_fdb *f)
 910{
 911	struct vxlan_rdst *rd, *nd;
 912	struct nexthop *nh;
 913
 914	nh = rcu_dereference_raw(f->nh);
 915	if (nh) {
 916		rcu_assign_pointer(f->nh, NULL);
 917		rcu_assign_pointer(f->vdev, NULL);
 918		nexthop_put(nh);
 919	}
 920
 921	list_for_each_entry_safe(rd, nd, &f->remotes, list) {
 922		dst_cache_destroy(&rd->dst_cache);
 923		kfree(rd);
 924	}
 925	kfree(f);
 926}
 927
 928static void vxlan_fdb_free(struct rcu_head *head)
 929{
 930	struct vxlan_fdb *f = container_of(head, struct vxlan_fdb, rcu);
 931
 932	__vxlan_fdb_free(f);
 933}
 934
 935static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
 936			      bool do_notify, bool swdev_notify)
 937{
 938	struct vxlan_rdst *rd;
 939
 940	netdev_dbg(vxlan->dev, "delete %pM\n", f->key.eth_addr);
 941
 942	--vxlan->addrcnt;
 943	if (do_notify) {
 944		if (rcu_access_pointer(f->nh))
 945			vxlan_fdb_notify(vxlan, f, NULL, RTM_DELNEIGH,
 946					 swdev_notify, NULL);
 947		else
 948			list_for_each_entry(rd, &f->remotes, list)
 949				vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH,
 950						 swdev_notify, NULL);
 951	}
 952
 953	hlist_del_init_rcu(&f->fdb_node);
 954	rhashtable_remove_fast(&vxlan->fdb_hash_tbl, &f->rhnode,
 955			       vxlan_fdb_rht_params);
 956	list_del_rcu(&f->nh_list);
 957	call_rcu(&f->rcu, vxlan_fdb_free);
 958}
 959
 960static void vxlan_dst_free(struct rcu_head *head)
 961{
 962	struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu);
 963
 964	dst_cache_destroy(&rd->dst_cache);
 965	kfree(rd);
 966}
 967
 968static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan,
 969				     union vxlan_addr *ip,
 970				     __u16 state, __u16 flags,
 971				     __be16 port, __be32 vni,
 972				     __u32 ifindex, __u16 ndm_flags,
 973				     struct vxlan_fdb *f, u32 nhid,
 974				     bool swdev_notify,
 975				     struct netlink_ext_ack *extack)
 976{
 977	__u16 fdb_flags = (ndm_flags & ~NTF_USE);
 978	struct vxlan_rdst *rd = NULL;
 979	struct vxlan_rdst oldrd;
 980	int notify = 0;
 981	int rc = 0;
 982	int err;
 983
 984	if (nhid && !rcu_access_pointer(f->nh)) {
 985		NL_SET_ERR_MSG(extack,
 986			       "Cannot replace an existing non nexthop fdb with a nexthop");
 987		return -EOPNOTSUPP;
 988	}
 989
 990	if (nhid && (flags & NLM_F_APPEND)) {
 991		NL_SET_ERR_MSG(extack,
 992			       "Cannot append to a nexthop fdb");
 993		return -EOPNOTSUPP;
 994	}
 995
 996	/* Do not allow an externally learned entry to take over an entry added
 997	 * by the user.
 998	 */
 999	if (!(fdb_flags & NTF_EXT_LEARNED) ||
1000	    !(f->flags & NTF_VXLAN_ADDED_BY_USER)) {
1001		if (f->state != state) {
1002			f->state = state;
1003			notify = 1;
1004		}
1005		if (f->flags != fdb_flags) {
1006			f->flags = fdb_flags;
1007			notify = 1;
1008		}
1009	}
1010
1011	if ((flags & NLM_F_REPLACE)) {
1012		/* Only change unicasts */
1013		if (!(is_multicast_ether_addr(f->key.eth_addr) ||
1014		      is_zero_ether_addr(f->key.eth_addr))) {
1015			if (nhid) {
1016				rc = vxlan_fdb_nh_update(vxlan, f, nhid, extack);
1017				if (rc < 0)
1018					return rc;
1019			} else {
1020				rc = vxlan_fdb_replace(f, ip, port, vni,
1021						       ifindex, &oldrd);
1022			}
1023			notify |= rc;
1024		} else {
1025			NL_SET_ERR_MSG(extack, "Cannot replace non-unicast fdb entries");
1026			return -EOPNOTSUPP;
1027		}
1028	}
1029	if ((flags & NLM_F_APPEND) &&
1030	    (is_multicast_ether_addr(f->key.eth_addr) ||
1031	     is_zero_ether_addr(f->key.eth_addr))) {
1032		rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
1033
1034		if (rc < 0)
1035			return rc;
1036		notify |= rc;
1037	}
1038
1039	if (ndm_flags & NTF_USE)
1040		WRITE_ONCE(f->updated, jiffies);
1041
1042	if (notify) {
1043		if (rd == NULL)
1044			rd = first_remote_rtnl(f);
1045
1046		WRITE_ONCE(f->updated, jiffies);
1047		err = vxlan_fdb_notify(vxlan, f, rd, RTM_NEWNEIGH,
1048				       swdev_notify, extack);
1049		if (err)
1050			goto err_notify;
1051	}
1052
1053	return 0;
1054
1055err_notify:
1056	if (nhid)
1057		return err;
1058	if ((flags & NLM_F_REPLACE) && rc)
1059		*rd = oldrd;
1060	else if ((flags & NLM_F_APPEND) && rc) {
1061		list_del_rcu(&rd->list);
1062		call_rcu(&rd->rcu, vxlan_dst_free);
1063	}
1064	return err;
1065}
1066
1067static int vxlan_fdb_update_create(struct vxlan_dev *vxlan,
1068				   const u8 *mac, union vxlan_addr *ip,
1069				   __u16 state, __u16 flags,
1070				   __be16 port, __be32 src_vni, __be32 vni,
1071				   __u32 ifindex, __u16 ndm_flags, u32 nhid,
1072				   bool swdev_notify,
1073				   struct netlink_ext_ack *extack)
1074{
1075	__u16 fdb_flags = (ndm_flags & ~NTF_USE);
1076	struct vxlan_fdb *f;
1077	int rc;
1078
1079	/* Disallow replace to add a multicast entry */
1080	if ((flags & NLM_F_REPLACE) &&
1081	    (is_multicast_ether_addr(mac) || is_zero_ether_addr(mac)))
1082		return -EOPNOTSUPP;
1083
1084	netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
1085	rc = vxlan_fdb_create(vxlan, mac, ip, state, port, src_vni,
1086			      vni, ifindex, fdb_flags, nhid, &f, extack);
1087	if (rc < 0)
1088		return rc;
1089
1090	rc = vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH,
1091			      swdev_notify, extack);
1092	if (rc)
1093		goto err_notify;
1094
1095	return 0;
1096
1097err_notify:
1098	vxlan_fdb_destroy(vxlan, f, false, false);
1099	return rc;
1100}
1101
1102/* Add new entry to forwarding table -- assumes lock held */
1103int vxlan_fdb_update(struct vxlan_dev *vxlan,
1104		     const u8 *mac, union vxlan_addr *ip,
1105		     __u16 state, __u16 flags,
1106		     __be16 port, __be32 src_vni, __be32 vni,
1107		     __u32 ifindex, __u16 ndm_flags, u32 nhid,
1108		     bool swdev_notify,
1109		     struct netlink_ext_ack *extack)
1110{
1111	struct vxlan_fdb *f;
1112
1113	f = vxlan_find_mac(vxlan, mac, src_vni);
1114	if (f) {
1115		if (flags & NLM_F_EXCL) {
1116			netdev_dbg(vxlan->dev,
1117				   "lost race to create %pM\n", mac);
1118			return -EEXIST;
1119		}
1120
1121		return vxlan_fdb_update_existing(vxlan, ip, state, flags, port,
1122						 vni, ifindex, ndm_flags, f,
1123						 nhid, swdev_notify, extack);
1124	} else {
1125		if (!(flags & NLM_F_CREATE))
1126			return -ENOENT;
1127
1128		return vxlan_fdb_update_create(vxlan, mac, ip, state, flags,
1129					       port, src_vni, vni, ifindex,
1130					       ndm_flags, nhid, swdev_notify,
1131					       extack);
1132	}
1133}
1134
1135static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
1136				  struct vxlan_rdst *rd, bool swdev_notify)
1137{
1138	list_del_rcu(&rd->list);
1139	vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH, swdev_notify, NULL);
1140	call_rcu(&rd->rcu, vxlan_dst_free);
1141}
1142
1143static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan,
1144			   union vxlan_addr *ip, __be16 *port, __be32 *src_vni,
1145			   __be32 *vni, u32 *ifindex, u32 *nhid,
1146			   struct netlink_ext_ack *extack)
1147{
1148	struct net *net = dev_net(vxlan->dev);
1149	int err;
1150
1151	if (tb[NDA_NH_ID] &&
1152	    (tb[NDA_DST] || tb[NDA_VNI] || tb[NDA_IFINDEX] || tb[NDA_PORT])) {
1153		NL_SET_ERR_MSG(extack, "DST, VNI, ifindex and port are mutually exclusive with NH_ID");
1154		return -EINVAL;
1155	}
1156
1157	if (tb[NDA_DST]) {
1158		err = vxlan_nla_get_addr(ip, tb[NDA_DST]);
1159		if (err) {
1160			NL_SET_ERR_MSG(extack, "Unsupported address family");
1161			return err;
1162		}
1163	} else {
1164		union vxlan_addr *remote = &vxlan->default_dst.remote_ip;
1165
1166		if (remote->sa.sa_family == AF_INET) {
1167			ip->sin.sin_addr.s_addr = htonl(INADDR_ANY);
1168			ip->sa.sa_family = AF_INET;
1169#if IS_ENABLED(CONFIG_IPV6)
1170		} else {
1171			ip->sin6.sin6_addr = in6addr_any;
1172			ip->sa.sa_family = AF_INET6;
1173#endif
1174		}
1175	}
1176
1177	if (tb[NDA_PORT]) {
1178		if (nla_len(tb[NDA_PORT]) != sizeof(__be16)) {
1179			NL_SET_ERR_MSG(extack, "Invalid vxlan port");
1180			return -EINVAL;
1181		}
1182		*port = nla_get_be16(tb[NDA_PORT]);
1183	} else {
1184		*port = vxlan->cfg.dst_port;
1185	}
1186
1187	if (tb[NDA_VNI]) {
1188		if (nla_len(tb[NDA_VNI]) != sizeof(u32)) {
1189			NL_SET_ERR_MSG(extack, "Invalid vni");
1190			return -EINVAL;
1191		}
1192		*vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI]));
1193	} else {
1194		*vni = vxlan->default_dst.remote_vni;
1195	}
1196
1197	if (tb[NDA_SRC_VNI]) {
1198		if (nla_len(tb[NDA_SRC_VNI]) != sizeof(u32)) {
1199			NL_SET_ERR_MSG(extack, "Invalid src vni");
1200			return -EINVAL;
1201		}
1202		*src_vni = cpu_to_be32(nla_get_u32(tb[NDA_SRC_VNI]));
1203	} else {
1204		*src_vni = vxlan->default_dst.remote_vni;
1205	}
1206
1207	if (tb[NDA_IFINDEX]) {
1208		struct net_device *tdev;
1209
1210		if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32)) {
1211			NL_SET_ERR_MSG(extack, "Invalid ifindex");
1212			return -EINVAL;
1213		}
1214		*ifindex = nla_get_u32(tb[NDA_IFINDEX]);
1215		tdev = __dev_get_by_index(net, *ifindex);
1216		if (!tdev) {
1217			NL_SET_ERR_MSG(extack, "Device not found");
1218			return -EADDRNOTAVAIL;
1219		}
1220	} else {
1221		*ifindex = 0;
1222	}
1223
1224	*nhid = nla_get_u32_default(tb[NDA_NH_ID], 0);
1225
1226	return 0;
1227}
1228
1229/* Add static entry (via netlink) */
1230static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
1231			 struct net_device *dev,
1232			 const unsigned char *addr, u16 vid, u16 flags,
1233			 bool *notified, struct netlink_ext_ack *extack)
1234{
1235	struct vxlan_dev *vxlan = netdev_priv(dev);
1236	/* struct net *net = dev_net(vxlan->dev); */
1237	union vxlan_addr ip;
1238	__be16 port;
1239	__be32 src_vni, vni;
1240	u32 ifindex, nhid;
1241	int err;
1242
1243	if (!(ndm->ndm_state & (NUD_PERMANENT|NUD_REACHABLE))) {
1244		pr_info("RTM_NEWNEIGH with invalid state %#x\n",
1245			ndm->ndm_state);
1246		return -EINVAL;
1247	}
1248
1249	if (!tb || (!tb[NDA_DST] && !tb[NDA_NH_ID]))
1250		return -EINVAL;
1251
1252	err = vxlan_fdb_parse(tb, vxlan, &ip, &port, &src_vni, &vni, &ifindex,
1253			      &nhid, extack);
1254	if (err)
1255		return err;
1256
1257	if (vxlan->default_dst.remote_ip.sa.sa_family != ip.sa.sa_family)
1258		return -EAFNOSUPPORT;
1259
1260	spin_lock_bh(&vxlan->hash_lock);
1261	err = vxlan_fdb_update(vxlan, addr, &ip, ndm->ndm_state, flags,
1262			       port, src_vni, vni, ifindex,
1263			       ndm->ndm_flags | NTF_VXLAN_ADDED_BY_USER,
1264			       nhid, true, extack);
1265	spin_unlock_bh(&vxlan->hash_lock);
1266
1267	if (!err)
1268		*notified = true;
1269
1270	return err;
1271}
1272
1273int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
1274		       const unsigned char *addr, union vxlan_addr ip,
1275		       __be16 port, __be32 src_vni, __be32 vni,
1276		       u32 ifindex, bool swdev_notify)
1277{
1278	struct vxlan_rdst *rd = NULL;
1279	struct vxlan_fdb *f;
1280	int err = -ENOENT;
1281
1282	f = vxlan_find_mac(vxlan, addr, src_vni);
1283	if (!f)
1284		return err;
1285
1286	if (!vxlan_addr_any(&ip)) {
1287		rd = vxlan_fdb_find_rdst(f, &ip, port, vni, ifindex);
1288		if (!rd)
1289			goto out;
1290	}
1291
1292	/* remove a destination if it's not the only one on the list,
1293	 * otherwise destroy the fdb entry
1294	 */
1295	if (rd && !list_is_singular(&f->remotes)) {
1296		vxlan_fdb_dst_destroy(vxlan, f, rd, swdev_notify);
1297		goto out;
1298	}
1299
1300	vxlan_fdb_destroy(vxlan, f, true, swdev_notify);
1301
1302out:
1303	return 0;
1304}
1305
1306/* Delete entry (via netlink) */
1307static int vxlan_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
1308			    struct net_device *dev,
1309			    const unsigned char *addr, u16 vid, bool *notified,
1310			    struct netlink_ext_ack *extack)
1311{
1312	struct vxlan_dev *vxlan = netdev_priv(dev);
1313	union vxlan_addr ip;
1314	__be32 src_vni, vni;
1315	u32 ifindex, nhid;
1316	__be16 port;
1317	int err;
1318
1319	err = vxlan_fdb_parse(tb, vxlan, &ip, &port, &src_vni, &vni, &ifindex,
1320			      &nhid, extack);
1321	if (err)
1322		return err;
1323
1324	spin_lock_bh(&vxlan->hash_lock);
1325	err = __vxlan_fdb_delete(vxlan, addr, ip, port, src_vni, vni, ifindex,
1326				 true);
1327	spin_unlock_bh(&vxlan->hash_lock);
1328
1329	if (!err)
1330		*notified = true;
1331
1332	return err;
1333}
1334
1335/* Dump forwarding table */
1336static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
1337			  struct net_device *dev,
1338			  struct net_device *filter_dev, int *idx)
1339{
1340	struct ndo_fdb_dump_context *ctx = (void *)cb->ctx;
1341	struct vxlan_dev *vxlan = netdev_priv(dev);
1342	struct vxlan_fdb *f;
1343	int err = 0;
1344
1345	rcu_read_lock();
1346	hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) {
1347		struct vxlan_rdst *rd;
1348
1349		if (rcu_access_pointer(f->nh)) {
1350			if (*idx < ctx->fdb_idx)
1351				goto skip_nh;
1352			err = vxlan_fdb_info(skb, vxlan, f,
1353					     NETLINK_CB(cb->skb).portid,
1354					     cb->nlh->nlmsg_seq,
1355					     RTM_NEWNEIGH, NLM_F_MULTI, NULL);
1356			if (err < 0) {
1357				rcu_read_unlock();
1358				goto out;
1359			}
1360skip_nh:
1361			*idx += 1;
1362			continue;
1363		}
1364
1365		list_for_each_entry_rcu(rd, &f->remotes, list) {
1366			if (*idx < ctx->fdb_idx)
1367				goto skip;
1368
1369			err = vxlan_fdb_info(skb, vxlan, f,
1370					     NETLINK_CB(cb->skb).portid,
1371					     cb->nlh->nlmsg_seq,
1372					     RTM_NEWNEIGH, NLM_F_MULTI, rd);
1373			if (err < 0) {
1374				rcu_read_unlock();
1375				goto out;
1376			}
1377skip:
1378			*idx += 1;
1379		}
1380	}
1381	rcu_read_unlock();
1382out:
1383	return err;
1384}
1385
1386static int vxlan_fdb_get(struct sk_buff *skb,
1387			 struct nlattr *tb[],
1388			 struct net_device *dev,
1389			 const unsigned char *addr,
1390			 u16 vid, u32 portid, u32 seq,
1391			 struct netlink_ext_ack *extack)
1392{
1393	struct vxlan_dev *vxlan = netdev_priv(dev);
1394	struct vxlan_fdb *f;
1395	__be32 vni;
1396	int err;
1397
1398	if (tb[NDA_VNI])
1399		vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI]));
1400	else
1401		vni = vxlan->default_dst.remote_vni;
1402
1403	rcu_read_lock();
1404
1405	f = vxlan_find_mac_rcu(vxlan, addr, vni);
1406	if (!f) {
1407		NL_SET_ERR_MSG(extack, "Fdb entry not found");
1408		err = -ENOENT;
1409		goto errout;
1410	}
1411
1412	err = vxlan_fdb_info(skb, vxlan, f, portid, seq,
1413			     RTM_NEWNEIGH, 0, first_remote_rcu(f));
1414errout:
1415	rcu_read_unlock();
1416	return err;
1417}
1418
1419/* Watch incoming packets to learn mapping between Ethernet address
1420 * and Tunnel endpoint.
1421 */
1422static enum skb_drop_reason vxlan_snoop(struct net_device *dev,
1423					union vxlan_addr *src_ip,
1424					const u8 *src_mac, u32 src_ifindex,
1425					__be32 vni)
1426{
1427	struct vxlan_dev *vxlan = netdev_priv(dev);
1428	struct vxlan_fdb *f;
1429	u32 ifindex = 0;
1430
1431	/* Ignore packets from invalid src-address */
1432	if (!is_valid_ether_addr(src_mac))
1433		return SKB_DROP_REASON_MAC_INVALID_SOURCE;
1434
1435#if IS_ENABLED(CONFIG_IPV6)
1436	if (src_ip->sa.sa_family == AF_INET6 &&
1437	    (ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL))
1438		ifindex = src_ifindex;
1439#endif
1440
1441	f = vxlan_find_mac_rcu(vxlan, src_mac, vni);
1442	if (likely(f)) {
1443		struct vxlan_rdst *rdst = first_remote_rcu(f);
1444		unsigned long now = jiffies;
1445
1446		if (READ_ONCE(f->updated) != now)
1447			WRITE_ONCE(f->updated, now);
1448
1449		/* Don't override an fdb with nexthop with a learnt entry */
1450		if (rcu_access_pointer(f->nh))
1451			return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS;
1452
1453		if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip) &&
1454			   rdst->remote_ifindex == ifindex))
1455			return SKB_NOT_DROPPED_YET;
1456
1457		/* Don't migrate static entries, drop packets */
1458		if (f->state & (NUD_PERMANENT | NUD_NOARP))
1459			return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS;
1460
1461		if (net_ratelimit())
1462			netdev_info(dev,
1463				    "%pM migrated from %pIS to %pIS\n",
1464				    src_mac, &rdst->remote_ip.sa, &src_ip->sa);
1465
1466		rdst->remote_ip = *src_ip;
1467		vxlan_fdb_notify(vxlan, f, rdst, RTM_NEWNEIGH, true, NULL);
1468	} else {
1469		/* learned new entry */
1470		spin_lock(&vxlan->hash_lock);
1471
1472		/* close off race between vxlan_flush and incoming packets */
1473		if (netif_running(dev))
1474			vxlan_fdb_update(vxlan, src_mac, src_ip,
1475					 NUD_REACHABLE,
1476					 NLM_F_EXCL|NLM_F_CREATE,
1477					 vxlan->cfg.dst_port,
1478					 vni,
1479					 vxlan->default_dst.remote_vni,
1480					 ifindex, NTF_SELF, 0, true, NULL);
1481		spin_unlock(&vxlan->hash_lock);
1482	}
1483
1484	return SKB_NOT_DROPPED_YET;
1485}
1486
1487static bool __vxlan_sock_release_prep(struct vxlan_sock *vs)
1488{
1489	ASSERT_RTNL();
1490
1491	if (!vs)
1492		return false;
1493	if (!refcount_dec_and_test(&vs->refcnt))
1494		return false;
1495
1496	hlist_del_rcu(&vs->hlist);
1497	udp_tunnel_notify_del_rx_port(vs->sock,
1498				      (vs->flags & VXLAN_F_GPE) ?
1499				      UDP_TUNNEL_TYPE_VXLAN_GPE :
1500				      UDP_TUNNEL_TYPE_VXLAN);
1501
1502	return true;
1503}
1504
1505static void vxlan_sock_release(struct vxlan_dev *vxlan)
1506{
1507	struct vxlan_sock *sock4 = rtnl_dereference(vxlan->vn4_sock);
1508#if IS_ENABLED(CONFIG_IPV6)
1509	struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
1510
1511	RCU_INIT_POINTER(vxlan->vn6_sock, NULL);
1512#endif
1513
1514	RCU_INIT_POINTER(vxlan->vn4_sock, NULL);
1515	synchronize_net();
1516
1517	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
1518		vxlan_vs_del_vnigrp(vxlan);
1519	else
1520		vxlan_vs_del_dev(vxlan);
1521
1522	if (__vxlan_sock_release_prep(sock4)) {
1523		udp_tunnel_sock_release(sock4->sock);
1524		kfree(sock4);
1525	}
1526
1527#if IS_ENABLED(CONFIG_IPV6)
1528	if (__vxlan_sock_release_prep(sock6)) {
1529		udp_tunnel_sock_release(sock6->sock);
1530		kfree(sock6);
1531	}
1532#endif
1533}
1534
1535static enum skb_drop_reason vxlan_remcsum(struct sk_buff *skb, u32 vxflags)
1536{
1537	const struct vxlanhdr *vh = vxlan_hdr(skb);
1538	enum skb_drop_reason reason;
1539	size_t start, offset;
1540
1541	if (!(vh->vx_flags & VXLAN_HF_RCO) || skb->remcsum_offload)
1542		return SKB_NOT_DROPPED_YET;
1543
1544	start = vxlan_rco_start(vh->vx_vni);
1545	offset = start + vxlan_rco_offset(vh->vx_vni);
1546
1547	reason = pskb_may_pull_reason(skb, offset + sizeof(u16));
1548	if (reason)
1549		return reason;
1550
1551	skb_remcsum_process(skb, (void *)(vxlan_hdr(skb) + 1), start, offset,
1552			    !!(vxflags & VXLAN_F_REMCSUM_NOPARTIAL));
1553	return SKB_NOT_DROPPED_YET;
1554}
1555
1556static void vxlan_parse_gbp_hdr(struct sk_buff *skb, u32 vxflags,
1557				struct vxlan_metadata *md)
1558{
1559	const struct vxlanhdr *vh = vxlan_hdr(skb);
1560	const struct vxlanhdr_gbp *gbp;
1561	struct metadata_dst *tun_dst;
1562
1563	gbp = (const struct vxlanhdr_gbp *)vh;
1564
1565	if (!(vh->vx_flags & VXLAN_HF_GBP))
1566		return;
1567
1568	md->gbp = ntohs(gbp->policy_id);
1569
1570	tun_dst = (struct metadata_dst *)skb_dst(skb);
1571	if (tun_dst) {
1572		__set_bit(IP_TUNNEL_VXLAN_OPT_BIT,
1573			  tun_dst->u.tun_info.key.tun_flags);
1574		tun_dst->u.tun_info.options_len = sizeof(*md);
1575	}
1576	if (gbp->dont_learn)
1577		md->gbp |= VXLAN_GBP_DONT_LEARN;
1578
1579	if (gbp->policy_applied)
1580		md->gbp |= VXLAN_GBP_POLICY_APPLIED;
1581
1582	/* In flow-based mode, GBP is carried in dst_metadata */
1583	if (!(vxflags & VXLAN_F_COLLECT_METADATA))
1584		skb->mark = md->gbp;
1585}
1586
1587static enum skb_drop_reason vxlan_set_mac(struct vxlan_dev *vxlan,
1588					  struct vxlan_sock *vs,
1589					  struct sk_buff *skb, __be32 vni)
1590{
1591	union vxlan_addr saddr;
1592	u32 ifindex = skb->dev->ifindex;
1593
1594	skb_reset_mac_header(skb);
1595	skb->protocol = eth_type_trans(skb, vxlan->dev);
1596	skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
1597
1598	/* Ignore packet loops (and multicast echo) */
1599	if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr))
1600		return SKB_DROP_REASON_LOCAL_MAC;
1601
1602	/* Get address from the outer IP header */
1603	if (vxlan_get_sk_family(vs) == AF_INET) {
1604		saddr.sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
1605		saddr.sa.sa_family = AF_INET;
1606#if IS_ENABLED(CONFIG_IPV6)
1607	} else {
1608		saddr.sin6.sin6_addr = ipv6_hdr(skb)->saddr;
1609		saddr.sa.sa_family = AF_INET6;
1610#endif
1611	}
1612
1613	if (!(vxlan->cfg.flags & VXLAN_F_LEARN))
1614		return SKB_NOT_DROPPED_YET;
1615
1616	return vxlan_snoop(skb->dev, &saddr, eth_hdr(skb)->h_source,
1617			   ifindex, vni);
1618}
1619
1620static bool vxlan_ecn_decapsulate(struct vxlan_sock *vs, void *oiph,
1621				  struct sk_buff *skb)
1622{
1623	int err = 0;
1624
1625	if (vxlan_get_sk_family(vs) == AF_INET)
1626		err = IP_ECN_decapsulate(oiph, skb);
1627#if IS_ENABLED(CONFIG_IPV6)
1628	else
1629		err = IP6_ECN_decapsulate(oiph, skb);
1630#endif
1631
1632	if (unlikely(err) && log_ecn_error) {
1633		if (vxlan_get_sk_family(vs) == AF_INET)
1634			net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
1635					     &((struct iphdr *)oiph)->saddr,
1636					     ((struct iphdr *)oiph)->tos);
1637		else
1638			net_info_ratelimited("non-ECT from %pI6\n",
1639					     &((struct ipv6hdr *)oiph)->saddr);
1640	}
1641	return err <= 1;
1642}
1643
1644static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
1645{
1646	struct vxlan_vni_node *vninode = NULL;
1647	const struct vxlanhdr *vh;
1648	struct vxlan_dev *vxlan;
1649	struct vxlan_sock *vs;
1650	struct vxlan_metadata _md;
1651	struct vxlan_metadata *md = &_md;
1652	__be16 protocol = htons(ETH_P_TEB);
1653	enum skb_drop_reason reason;
1654	bool raw_proto = false;
1655	void *oiph;
1656	__be32 vni = 0;
1657	int nh;
1658
1659	/* Need UDP and VXLAN header to be present */
1660	reason = pskb_may_pull_reason(skb, VXLAN_HLEN);
1661	if (reason)
1662		goto drop;
1663
1664	vh = vxlan_hdr(skb);
1665	/* VNI flag always required to be set */
1666	if (!(vh->vx_flags & VXLAN_HF_VNI)) {
1667		netdev_dbg(skb->dev, "invalid vxlan flags=%#x vni=%#x\n",
1668			   ntohl(vh->vx_flags), ntohl(vh->vx_vni));
1669		reason = SKB_DROP_REASON_VXLAN_INVALID_HDR;
1670		/* Return non vxlan pkt */
1671		goto drop;
1672	}
1673
1674	vs = rcu_dereference_sk_user_data(sk);
1675	if (!vs)
1676		goto drop;
1677
1678	vni = vxlan_vni(vh->vx_vni);
1679
1680	vxlan = vxlan_vs_find_vni(vs, skb->dev->ifindex, vni, &vninode);
1681	if (!vxlan) {
1682		reason = SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND;
1683		goto drop;
1684	}
1685
1686	if (vh->vx_flags & vxlan->cfg.reserved_bits.vx_flags ||
1687	    vh->vx_vni & vxlan->cfg.reserved_bits.vx_vni) {
1688		/* If the header uses bits besides those enabled by the
1689		 * netdevice configuration, treat this as a malformed packet.
1690		 * This behavior diverges from VXLAN RFC (RFC7348) which
1691		 * stipulates that bits in reserved in reserved fields are to be
1692		 * ignored. The approach here maintains compatibility with
1693		 * previous stack code, and also is more robust and provides a
1694		 * little more security in adding extensions to VXLAN.
1695		 */
1696		reason = SKB_DROP_REASON_VXLAN_INVALID_HDR;
1697		DEV_STATS_INC(vxlan->dev, rx_frame_errors);
1698		DEV_STATS_INC(vxlan->dev, rx_errors);
1699		vxlan_vnifilter_count(vxlan, vni, vninode,
1700				      VXLAN_VNI_STATS_RX_ERRORS, 0);
1701		goto drop;
1702	}
1703
1704	if (vxlan->cfg.flags & VXLAN_F_GPE) {
1705		if (!vxlan_parse_gpe_proto(vh, &protocol))
1706			goto drop;
1707		raw_proto = true;
1708	}
1709
1710	if (__iptunnel_pull_header(skb, VXLAN_HLEN, protocol, raw_proto,
1711				   !net_eq(vxlan->net, dev_net(vxlan->dev)))) {
1712		reason = SKB_DROP_REASON_NOMEM;
1713		goto drop;
1714	}
1715
1716	if (vxlan->cfg.flags & VXLAN_F_REMCSUM_RX) {
1717		reason = vxlan_remcsum(skb, vxlan->cfg.flags);
1718		if (unlikely(reason))
1719			goto drop;
1720	}
1721
1722	if (vxlan_collect_metadata(vs)) {
1723		IP_TUNNEL_DECLARE_FLAGS(flags) = { };
1724		struct metadata_dst *tun_dst;
1725
1726		__set_bit(IP_TUNNEL_KEY_BIT, flags);
1727		tun_dst = udp_tun_rx_dst(skb, vxlan_get_sk_family(vs), flags,
1728					 key32_to_tunnel_id(vni), sizeof(*md));
1729
1730		if (!tun_dst) {
1731			reason = SKB_DROP_REASON_NOMEM;
1732			goto drop;
1733		}
1734
1735		md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
1736
1737		skb_dst_set(skb, (struct dst_entry *)tun_dst);
1738	} else {
1739		memset(md, 0, sizeof(*md));
1740	}
1741
1742	if (vxlan->cfg.flags & VXLAN_F_GBP)
1743		vxlan_parse_gbp_hdr(skb, vxlan->cfg.flags, md);
1744	/* Note that GBP and GPE can never be active together. This is
1745	 * ensured in vxlan_dev_configure.
1746	 */
1747
1748	if (!raw_proto) {
1749		reason = vxlan_set_mac(vxlan, vs, skb, vni);
1750		if (reason)
1751			goto drop;
1752	} else {
1753		skb_reset_mac_header(skb);
1754		skb->dev = vxlan->dev;
1755		skb->pkt_type = PACKET_HOST;
1756	}
1757
1758	/* Save offset of outer header relative to skb->head,
1759	 * because we are going to reset the network header to the inner header
1760	 * and might change skb->head.
1761	 */
1762	nh = skb_network_header(skb) - skb->head;
1763
1764	skb_reset_network_header(skb);
1765
1766	reason = pskb_inet_may_pull_reason(skb);
1767	if (reason) {
1768		DEV_STATS_INC(vxlan->dev, rx_length_errors);
1769		DEV_STATS_INC(vxlan->dev, rx_errors);
1770		vxlan_vnifilter_count(vxlan, vni, vninode,
1771				      VXLAN_VNI_STATS_RX_ERRORS, 0);
1772		goto drop;
1773	}
1774
1775	/* Get the outer header. */
1776	oiph = skb->head + nh;
1777
1778	if (!vxlan_ecn_decapsulate(vs, oiph, skb)) {
1779		reason = SKB_DROP_REASON_IP_TUNNEL_ECN;
1780		DEV_STATS_INC(vxlan->dev, rx_frame_errors);
1781		DEV_STATS_INC(vxlan->dev, rx_errors);
1782		vxlan_vnifilter_count(vxlan, vni, vninode,
1783				      VXLAN_VNI_STATS_RX_ERRORS, 0);
1784		goto drop;
1785	}
1786
1787	rcu_read_lock();
1788
1789	if (unlikely(!(vxlan->dev->flags & IFF_UP))) {
1790		rcu_read_unlock();
1791		dev_dstats_rx_dropped(vxlan->dev);
1792		vxlan_vnifilter_count(vxlan, vni, vninode,
1793				      VXLAN_VNI_STATS_RX_DROPS, 0);
1794		reason = SKB_DROP_REASON_DEV_READY;
1795		goto drop;
1796	}
1797
1798	dev_dstats_rx_add(vxlan->dev, skb->len);
1799	vxlan_vnifilter_count(vxlan, vni, vninode, VXLAN_VNI_STATS_RX, skb->len);
1800	gro_cells_receive(&vxlan->gro_cells, skb);
1801
1802	rcu_read_unlock();
1803
1804	return 0;
1805
1806drop:
1807	reason = reason ?: SKB_DROP_REASON_NOT_SPECIFIED;
1808	/* Consume bad packet */
1809	kfree_skb_reason(skb, reason);
1810	return 0;
1811}
1812
1813static int vxlan_err_lookup(struct sock *sk, struct sk_buff *skb)
1814{
1815	struct vxlan_dev *vxlan;
1816	struct vxlan_sock *vs;
1817	struct vxlanhdr *hdr;
1818	__be32 vni;
1819
1820	if (!pskb_may_pull(skb, skb_transport_offset(skb) + VXLAN_HLEN))
1821		return -EINVAL;
1822
1823	hdr = vxlan_hdr(skb);
1824
1825	if (!(hdr->vx_flags & VXLAN_HF_VNI))
1826		return -EINVAL;
1827
1828	vs = rcu_dereference_sk_user_data(sk);
1829	if (!vs)
1830		return -ENOENT;
1831
1832	vni = vxlan_vni(hdr->vx_vni);
1833	vxlan = vxlan_vs_find_vni(vs, skb->dev->ifindex, vni, NULL);
1834	if (!vxlan)
1835		return -ENOENT;
1836
1837	return 0;
1838}
1839
1840static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)
1841{
1842	struct vxlan_dev *vxlan = netdev_priv(dev);
1843	struct arphdr *parp;
1844	u8 *arpptr, *sha;
1845	__be32 sip, tip;
1846	struct neighbour *n;
1847
1848	if (dev->flags & IFF_NOARP)
1849		goto out;
1850
1851	if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
1852		dev_dstats_tx_dropped(dev);
1853		vxlan_vnifilter_count(vxlan, vni, NULL,
1854				      VXLAN_VNI_STATS_TX_DROPS, 0);
1855		goto out;
1856	}
1857	parp = arp_hdr(skb);
1858
1859	if ((parp->ar_hrd != htons(ARPHRD_ETHER) &&
1860	     parp->ar_hrd != htons(ARPHRD_IEEE802)) ||
1861	    parp->ar_pro != htons(ETH_P_IP) ||
1862	    parp->ar_op != htons(ARPOP_REQUEST) ||
1863	    parp->ar_hln != dev->addr_len ||
1864	    parp->ar_pln != 4)
1865		goto out;
1866	arpptr = (u8 *)parp + sizeof(struct arphdr);
1867	sha = arpptr;
1868	arpptr += dev->addr_len;	/* sha */
1869	memcpy(&sip, arpptr, sizeof(sip));
1870	arpptr += sizeof(sip);
1871	arpptr += dev->addr_len;	/* tha */
1872	memcpy(&tip, arpptr, sizeof(tip));
1873
1874	if (ipv4_is_loopback(tip) ||
1875	    ipv4_is_multicast(tip))
1876		goto out;
1877
1878	n = neigh_lookup(&arp_tbl, &tip, dev);
1879
1880	if (n) {
1881		struct vxlan_rdst *rdst = NULL;
1882		struct vxlan_fdb *f;
1883		struct sk_buff	*reply;
1884
1885		if (!(READ_ONCE(n->nud_state) & NUD_CONNECTED)) {
1886			neigh_release(n);
1887			goto out;
1888		}
1889
1890		rcu_read_lock();
1891		f = vxlan_find_mac_tx(vxlan, n->ha, vni);
1892		if (f)
1893			rdst = first_remote_rcu(f);
1894		if (rdst && vxlan_addr_any(&rdst->remote_ip)) {
1895			/* bridge-local neighbor */
1896			neigh_release(n);
1897			rcu_read_unlock();
1898			goto out;
1899		}
1900		rcu_read_unlock();
1901
1902		reply = arp_create(ARPOP_REPLY, ETH_P_ARP, sip, dev, tip, sha,
1903				n->ha, sha);
1904
1905		neigh_release(n);
1906
1907		if (reply == NULL)
1908			goto out;
1909
1910		skb_reset_mac_header(reply);
1911		__skb_pull(reply, skb_network_offset(reply));
1912		reply->ip_summed = CHECKSUM_UNNECESSARY;
1913		reply->pkt_type = PACKET_HOST;
1914
1915		if (netif_rx(reply) == NET_RX_DROP) {
1916			dev_dstats_rx_dropped(dev);
1917			vxlan_vnifilter_count(vxlan, vni, NULL,
1918					      VXLAN_VNI_STATS_RX_DROPS, 0);
1919		}
1920
1921	} else if (vxlan->cfg.flags & VXLAN_F_L3MISS) {
1922		union vxlan_addr ipa = {
1923			.sin.sin_addr.s_addr = tip,
1924			.sin.sin_family = AF_INET,
1925		};
1926
1927		vxlan_ip_miss(dev, &ipa);
1928	}
1929out:
1930	consume_skb(skb);
1931	return NETDEV_TX_OK;
1932}
1933
1934#if IS_ENABLED(CONFIG_IPV6)
1935static struct sk_buff *vxlan_na_create(struct sk_buff *request,
1936	struct neighbour *n, bool isrouter)
1937{
1938	struct net_device *dev = request->dev;
1939	struct sk_buff *reply;
1940	struct nd_msg *ns, *na;
1941	struct ipv6hdr *pip6;
1942	u8 *daddr;
1943	int na_olen = 8; /* opt hdr + ETH_ALEN for target */
1944	int ns_olen;
1945	int i, len;
1946
1947	if (dev == NULL || !pskb_may_pull(request, request->len))
1948		return NULL;
1949
1950	len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
1951		sizeof(*na) + na_olen + dev->needed_tailroom;
1952	reply = alloc_skb(len, GFP_ATOMIC);
1953	if (reply == NULL)
1954		return NULL;
1955
1956	reply->protocol = htons(ETH_P_IPV6);
1957	reply->dev = dev;
1958	skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
1959	skb_push(reply, sizeof(struct ethhdr));
1960	skb_reset_mac_header(reply);
1961
1962	ns = (struct nd_msg *)(ipv6_hdr(request) + 1);
1963
1964	daddr = eth_hdr(request)->h_source;
1965	ns_olen = request->len - skb_network_offset(request) -
1966		sizeof(struct ipv6hdr) - sizeof(*ns);
1967	for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
1968		if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) {
1969			kfree_skb(reply);
1970			return NULL;
1971		}
1972		if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
1973			if ((ns->opt[i + 1] << 3) >=
1974			    sizeof(struct nd_opt_hdr) + ETH_ALEN)
1975				daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
1976			break;
1977		}
1978	}
1979
1980	/* Ethernet header */
1981	ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
1982	ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
1983	eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
1984	reply->protocol = htons(ETH_P_IPV6);
1985
1986	skb_pull(reply, sizeof(struct ethhdr));
1987	skb_reset_network_header(reply);
1988	skb_put(reply, sizeof(struct ipv6hdr));
1989
1990	/* IPv6 header */
1991
1992	pip6 = ipv6_hdr(reply);
1993	memset(pip6, 0, sizeof(struct ipv6hdr));
1994	pip6->version = 6;
1995	pip6->priority = ipv6_hdr(request)->priority;
1996	pip6->nexthdr = IPPROTO_ICMPV6;
1997	pip6->hop_limit = 255;
1998	pip6->daddr = ipv6_hdr(request)->saddr;
1999	pip6->saddr = *(struct in6_addr *)n->primary_key;
2000
2001	skb_pull(reply, sizeof(struct ipv6hdr));
2002	skb_reset_transport_header(reply);
2003
2004	/* Neighbor Advertisement */
2005	na = skb_put_zero(reply, sizeof(*na) + na_olen);
2006	na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
2007	na->icmph.icmp6_router = isrouter;
2008	na->icmph.icmp6_override = 1;
2009	na->icmph.icmp6_solicited = 1;
2010	na->target = ns->target;
2011	ether_addr_copy(&na->opt[2], n->ha);
2012	na->opt[0] = ND_OPT_TARGET_LL_ADDR;
2013	na->opt[1] = na_olen >> 3;
2014
2015	na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
2016		&pip6->daddr, sizeof(*na)+na_olen, IPPROTO_ICMPV6,
2017		csum_partial(na, sizeof(*na)+na_olen, 0));
2018
2019	pip6->payload_len = htons(sizeof(*na)+na_olen);
2020
2021	skb_push(reply, sizeof(struct ipv6hdr));
2022
2023	reply->ip_summed = CHECKSUM_UNNECESSARY;
2024
2025	return reply;
2026}
2027
2028static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)
2029{
2030	struct vxlan_dev *vxlan = netdev_priv(dev);
2031	const struct in6_addr *daddr;
2032	const struct ipv6hdr *iphdr;
2033	struct inet6_dev *in6_dev;
2034	struct neighbour *n;
2035	struct nd_msg *msg;
2036
2037	rcu_read_lock();
2038	in6_dev = __in6_dev_get(dev);
2039	if (!in6_dev)
2040		goto out;
2041
2042	iphdr = ipv6_hdr(skb);
2043	daddr = &iphdr->daddr;
2044	msg = (struct nd_msg *)(iphdr + 1);
2045
2046	if (ipv6_addr_loopback(daddr) ||
2047	    ipv6_addr_is_multicast(&msg->target))
2048		goto out;
2049
2050	n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, dev);
2051
2052	if (n) {
2053		struct vxlan_rdst *rdst = NULL;
2054		struct vxlan_fdb *f;
2055		struct sk_buff *reply;
2056
2057		if (!(READ_ONCE(n->nud_state) & NUD_CONNECTED)) {
2058			neigh_release(n);
2059			goto out;
2060		}
2061
2062		f = vxlan_find_mac_tx(vxlan, n->ha, vni);
2063		if (f)
2064			rdst = first_remote_rcu(f);
2065		if (rdst && vxlan_addr_any(&rdst->remote_ip)) {
2066			/* bridge-local neighbor */
2067			neigh_release(n);
2068			goto out;
2069		}
2070
2071		reply = vxlan_na_create(skb, n,
2072					!!(f ? f->flags & NTF_ROUTER : 0));
2073
2074		neigh_release(n);
2075
2076		if (reply == NULL)
2077			goto out;
2078
2079		if (netif_rx(reply) == NET_RX_DROP) {
2080			dev_dstats_rx_dropped(dev);
2081			vxlan_vnifilter_count(vxlan, vni, NULL,
2082					      VXLAN_VNI_STATS_RX_DROPS, 0);
2083		}
2084	} else if (vxlan->cfg.flags & VXLAN_F_L3MISS) {
2085		union vxlan_addr ipa = {
2086			.sin6.sin6_addr = msg->target,
2087			.sin6.sin6_family = AF_INET6,
2088		};
2089
2090		vxlan_ip_miss(dev, &ipa);
2091	}
2092
2093out:
2094	rcu_read_unlock();
2095	consume_skb(skb);
2096	return NETDEV_TX_OK;
2097}
2098#endif
2099
2100static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
2101{
2102	struct vxlan_dev *vxlan = netdev_priv(dev);
2103	struct neighbour *n;
2104
2105	if (is_multicast_ether_addr(eth_hdr(skb)->h_dest))
2106		return false;
2107
2108	n = NULL;
2109	switch (ntohs(eth_hdr(skb)->h_proto)) {
2110	case ETH_P_IP:
2111	{
2112		struct iphdr *pip;
2113
2114		if (!pskb_may_pull(skb, sizeof(struct iphdr)))
2115			return false;
2116		pip = ip_hdr(skb);
2117		n = neigh_lookup(&arp_tbl, &pip->daddr, dev);
2118		if (!n && (vxlan->cfg.flags & VXLAN_F_L3MISS)) {
2119			union vxlan_addr ipa = {
2120				.sin.sin_addr.s_addr = pip->daddr,
2121				.sin.sin_family = AF_INET,
2122			};
2123
2124			vxlan_ip_miss(dev, &ipa);
2125			return false;
2126		}
2127
2128		break;
2129	}
2130#if IS_ENABLED(CONFIG_IPV6)
2131	case ETH_P_IPV6:
2132	{
2133		struct ipv6hdr *pip6;
2134
2135		/* check if nd_tbl is not initiliazed due to
2136		 * ipv6.disable=1 set during boot
2137		 */
2138		if (!ipv6_stub->nd_tbl)
2139			return false;
2140		if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
2141			return false;
2142		pip6 = ipv6_hdr(skb);
2143		n = neigh_lookup(ipv6_stub->nd_tbl, &pip6->daddr, dev);
2144		if (!n && (vxlan->cfg.flags & VXLAN_F_L3MISS)) {
2145			union vxlan_addr ipa = {
2146				.sin6.sin6_addr = pip6->daddr,
2147				.sin6.sin6_family = AF_INET6,
2148			};
2149
2150			vxlan_ip_miss(dev, &ipa);
2151			return false;
2152		}
2153
2154		break;
2155	}
2156#endif
2157	default:
2158		return false;
2159	}
2160
2161	if (n) {
2162		bool diff;
2163
2164		diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha);
2165		if (diff) {
2166			memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
2167				dev->addr_len);
2168			memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len);
2169		}
2170		neigh_release(n);
2171		return diff;
2172	}
2173
2174	return false;
2175}
2176
2177static int vxlan_build_gpe_hdr(struct vxlanhdr *vxh, __be16 protocol)
2178{
2179	struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)vxh;
2180
2181	gpe->np_applied = 1;
2182	gpe->next_protocol = tun_p_from_eth_p(protocol);
2183	if (!gpe->next_protocol)
2184		return -EPFNOSUPPORT;
2185	return 0;
2186}
2187
2188static int vxlan_build_skb(struct sk_buff *skb, struct dst_entry *dst,
2189			   int iphdr_len, __be32 vni,
2190			   struct vxlan_metadata *md, u32 vxflags,
2191			   bool udp_sum)
2192{
2193	struct vxlanhdr *vxh;
2194	int min_headroom;
2195	int err;
2196	int type = udp_sum ? SKB_GSO_UDP_TUNNEL_CSUM : SKB_GSO_UDP_TUNNEL;
2197	__be16 inner_protocol = htons(ETH_P_TEB);
2198
2199	if ((vxflags & VXLAN_F_REMCSUM_TX) &&
2200	    skb->ip_summed == CHECKSUM_PARTIAL) {
2201		int csum_start = skb_checksum_start_offset(skb);
2202
2203		if (csum_start <= VXLAN_MAX_REMCSUM_START &&
2204		    !(csum_start & VXLAN_RCO_SHIFT_MASK) &&
2205		    (skb->csum_offset == offsetof(struct udphdr, check) ||
2206		     skb->csum_offset == offsetof(struct tcphdr, check)))
2207			type |= SKB_GSO_TUNNEL_REMCSUM;
2208	}
2209
2210	min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
2211			+ VXLAN_HLEN + iphdr_len;
2212
2213	/* Need space for new headers (invalidates iph ptr) */
2214	err = skb_cow_head(skb, min_headroom);
2215	if (unlikely(err))
2216		return err;
2217
2218	err = iptunnel_handle_offloads(skb, type);
2219	if (err)
2220		return err;
2221
2222	vxh = __skb_push(skb, sizeof(*vxh));
2223	vxh->vx_flags = VXLAN_HF_VNI;
2224	vxh->vx_vni = vxlan_vni_field(vni);
2225
2226	if (type & SKB_GSO_TUNNEL_REMCSUM) {
2227		unsigned int start;
2228
2229		start = skb_checksum_start_offset(skb) - sizeof(struct vxlanhdr);
2230		vxh->vx_vni |= vxlan_compute_rco(start, skb->csum_offset);
2231		vxh->vx_flags |= VXLAN_HF_RCO;
2232
2233		if (!skb_is_gso(skb)) {
2234			skb->ip_summed = CHECKSUM_NONE;
2235			skb->encapsulation = 0;
2236		}
2237	}
2238
2239	if (vxflags & VXLAN_F_GBP)
2240		vxlan_build_gbp_hdr(vxh, md);
2241	if (vxflags & VXLAN_F_GPE) {
2242		err = vxlan_build_gpe_hdr(vxh, skb->protocol);
2243		if (err < 0)
2244			return err;
2245		inner_protocol = skb->protocol;
2246	}
2247
2248	skb_set_inner_protocol(skb, inner_protocol);
2249	return 0;
2250}
2251
2252/* Bypass encapsulation if the destination is local */
2253static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
2254			       struct vxlan_dev *dst_vxlan, __be32 vni,
2255			       bool snoop)
2256{
2257	union vxlan_addr loopback;
2258	union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
2259	unsigned int len = skb->len;
2260	struct net_device *dev;
2261
2262	skb->pkt_type = PACKET_HOST;
2263	skb->encapsulation = 0;
2264	skb->dev = dst_vxlan->dev;
2265	__skb_pull(skb, skb_network_offset(skb));
2266
2267	if (remote_ip->sa.sa_family == AF_INET) {
2268		loopback.sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
2269		loopback.sa.sa_family =  AF_INET;
2270#if IS_ENABLED(CONFIG_IPV6)
2271	} else {
2272		loopback.sin6.sin6_addr = in6addr_loopback;
2273		loopback.sa.sa_family =  AF_INET6;
2274#endif
2275	}
2276
2277	rcu_read_lock();
2278	dev = skb->dev;
2279	if (unlikely(!(dev->flags & IFF_UP))) {
2280		kfree_skb_reason(skb, SKB_DROP_REASON_DEV_READY);
2281		goto drop;
2282	}
2283
2284	if ((dst_vxlan->cfg.flags & VXLAN_F_LEARN) && snoop)
2285		vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni);
2286
2287	dev_dstats_tx_add(src_vxlan->dev, len);
2288	vxlan_vnifilter_count(src_vxlan, vni, NULL, VXLAN_VNI_STATS_TX, len);
2289
2290	if (__netif_rx(skb) == NET_RX_SUCCESS) {
2291		dev_dstats_rx_add(dst_vxlan->dev, len);
2292		vxlan_vnifilter_count(dst_vxlan, vni, NULL, VXLAN_VNI_STATS_RX,
2293				      len);
2294	} else {
2295drop:
2296		dev_dstats_rx_dropped(dev);
2297		vxlan_vnifilter_count(dst_vxlan, vni, NULL,
2298				      VXLAN_VNI_STATS_RX_DROPS, 0);
2299	}
2300	rcu_read_unlock();
2301}
2302
2303static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev,
2304				 struct vxlan_dev *vxlan,
2305				 int addr_family,
2306				 __be16 dst_port, int dst_ifindex, __be32 vni,
2307				 struct dst_entry *dst,
2308				 u32 rt_flags)
2309{
2310#if IS_ENABLED(CONFIG_IPV6)
2311	/* IPv6 rt-flags are checked against RTF_LOCAL, but the value of
2312	 * RTF_LOCAL is equal to RTCF_LOCAL. So to keep code simple
2313	 * we can use RTCF_LOCAL which works for ipv4 and ipv6 route entry.
2314	 */
2315	BUILD_BUG_ON(RTCF_LOCAL != RTF_LOCAL);
2316#endif
2317	/* Bypass encapsulation if the destination is local */
2318	if (rt_flags & RTCF_LOCAL &&
2319	    !(rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) &&
2320	    vxlan->cfg.flags & VXLAN_F_LOCALBYPASS) {
2321		struct vxlan_dev *dst_vxlan;
2322
2323		dst_release(dst);
2324		dst_vxlan = vxlan_find_vni(vxlan->net, dst_ifindex, vni,
2325					   addr_family, dst_port,
2326					   vxlan->cfg.flags);
2327		if (!dst_vxlan) {
2328			DEV_STATS_INC(dev, tx_errors);
2329			vxlan_vnifilter_count(vxlan, vni, NULL,
2330					      VXLAN_VNI_STATS_TX_ERRORS, 0);
2331			kfree_skb_reason(skb, SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND);
2332
2333			return -ENOENT;
2334		}
2335		vxlan_encap_bypass(skb, vxlan, dst_vxlan, vni, true);
2336		return 1;
2337	}
2338
2339	return 0;
2340}
2341
2342void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
2343		    __be32 default_vni, struct vxlan_rdst *rdst, bool did_rsc)
2344{
2345	struct dst_cache *dst_cache;
2346	struct ip_tunnel_info *info;
2347	struct ip_tunnel_key *pkey;
2348	struct ip_tunnel_key key;
2349	struct vxlan_dev *vxlan = netdev_priv(dev);
2350	const struct iphdr *old_iph;
2351	struct vxlan_metadata _md;
2352	struct vxlan_metadata *md = &_md;
2353	unsigned int pkt_len = skb->len;
2354	__be16 src_port = 0, dst_port;
2355	struct dst_entry *ndst = NULL;
2356	int addr_family;
2357	__u8 tos, ttl;
2358	int ifindex;
2359	int err = 0;
2360	u32 flags = vxlan->cfg.flags;
2361	bool use_cache;
2362	bool udp_sum = false;
2363	bool xnet = !net_eq(vxlan->net, dev_net(vxlan->dev));
2364	enum skb_drop_reason reason;
2365	bool no_eth_encap;
2366	__be32 vni = 0;
2367
2368	no_eth_encap = flags & VXLAN_F_GPE && skb->protocol != htons(ETH_P_TEB);
2369	reason = skb_vlan_inet_prepare(skb, no_eth_encap);
2370	if (reason)
2371		goto drop;
2372
2373	reason = SKB_DROP_REASON_NOT_SPECIFIED;
2374	old_iph = ip_hdr(skb);
2375
2376	info = skb_tunnel_info(skb);
2377	use_cache = ip_tunnel_dst_cache_usable(skb, info);
2378
2379	if (rdst) {
2380		memset(&key, 0, sizeof(key));
2381		pkey = &key;
2382
2383		if (vxlan_addr_any(&rdst->remote_ip)) {
2384			if (did_rsc) {
2385				/* short-circuited back to local bridge */
2386				vxlan_encap_bypass(skb, vxlan, vxlan,
2387						   default_vni, true);
2388				return;
2389			}
2390			goto drop;
2391		}
2392
2393		addr_family = vxlan->cfg.saddr.sa.sa_family;
2394		dst_port = rdst->remote_port ? rdst->remote_port : vxlan->cfg.dst_port;
2395		vni = (rdst->remote_vni) ? : default_vni;
2396		ifindex = rdst->remote_ifindex;
2397
2398		if (addr_family == AF_INET) {
2399			key.u.ipv4.src = vxlan->cfg.saddr.sin.sin_addr.s_addr;
2400			key.u.ipv4.dst = rdst->remote_ip.sin.sin_addr.s_addr;
2401		} else {
2402			key.u.ipv6.src = vxlan->cfg.saddr.sin6.sin6_addr;
2403			key.u.ipv6.dst = rdst->remote_ip.sin6.sin6_addr;
2404		}
2405
2406		dst_cache = &rdst->dst_cache;
2407		md->gbp = skb->mark;
2408		if (flags & VXLAN_F_TTL_INHERIT) {
2409			ttl = ip_tunnel_get_ttl(old_iph, skb);
2410		} else {
2411			ttl = vxlan->cfg.ttl;
2412			if (!ttl && vxlan_addr_multicast(&rdst->remote_ip))
2413				ttl = 1;
2414		}
2415		tos = vxlan->cfg.tos;
2416		if (tos == 1)
2417			tos = ip_tunnel_get_dsfield(old_iph, skb);
2418		if (tos && !info)
2419			use_cache = false;
2420
2421		if (addr_family == AF_INET)
2422			udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM_TX);
2423		else
2424			udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
2425#if IS_ENABLED(CONFIG_IPV6)
2426		switch (vxlan->cfg.label_policy) {
2427		case VXLAN_LABEL_FIXED:
2428			key.label = vxlan->cfg.label;
2429			break;
2430		case VXLAN_LABEL_INHERIT:
2431			key.label = ip_tunnel_get_flowlabel(old_iph, skb);
2432			break;
2433		default:
2434			DEBUG_NET_WARN_ON_ONCE(1);
2435			goto drop;
2436		}
2437#endif
2438	} else {
2439		if (!info) {
2440			WARN_ONCE(1, "%s: Missing encapsulation instructions\n",
2441				  dev->name);
2442			goto drop;
2443		}
2444		pkey = &info->key;
2445		addr_family = ip_tunnel_info_af(info);
2446		dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port;
2447		vni = tunnel_id_to_key32(info->key.tun_id);
2448		ifindex = 0;
2449		dst_cache = &info->dst_cache;
2450		if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {
2451			if (info->options_len < sizeof(*md))
2452				goto drop;
2453			md = ip_tunnel_info_opts(info);
2454		}
2455		ttl = info->key.ttl;
2456		tos = info->key.tos;
2457		udp_sum = test_bit(IP_TUNNEL_CSUM_BIT, info->key.tun_flags);
2458	}
2459	src_port = udp_flow_src_port(dev_net(dev), skb, vxlan->cfg.port_min,
2460				     vxlan->cfg.port_max, true);
2461
2462	rcu_read_lock();
2463	if (addr_family == AF_INET) {
2464		struct vxlan_sock *sock4;
2465		u16 ipcb_flags = 0;
2466		struct rtable *rt;
2467		__be16 df = 0;
2468		__be32 saddr;
2469
2470		sock4 = rcu_dereference(vxlan->vn4_sock);
2471		if (unlikely(!sock4)) {
2472			reason = SKB_DROP_REASON_DEV_READY;
2473			goto tx_error;
2474		}
2475
2476		if (!ifindex)
2477			ifindex = sock4->sock->sk->sk_bound_dev_if;
2478
2479		rt = udp_tunnel_dst_lookup(skb, dev, vxlan->net, ifindex,
2480					   &saddr, pkey, src_port, dst_port,
2481					   tos, use_cache ? dst_cache : NULL);
2482		if (IS_ERR(rt)) {
2483			err = PTR_ERR(rt);
2484			reason = SKB_DROP_REASON_IP_OUTNOROUTES;
2485			goto tx_error;
2486		}
2487
2488		if (flags & VXLAN_F_MC_ROUTE)
2489			ipcb_flags |= IPSKB_MCROUTE;
2490
2491		if (!info) {
2492			/* Bypass encapsulation if the destination is local */
2493			err = encap_bypass_if_local(skb, dev, vxlan, AF_INET,
2494						    dst_port, ifindex, vni,
2495						    &rt->dst, rt->rt_flags);
2496			if (err)
2497				goto out_unlock;
2498
2499			if (vxlan->cfg.df == VXLAN_DF_SET) {
2500				df = htons(IP_DF);
2501			} else if (vxlan->cfg.df == VXLAN_DF_INHERIT) {
2502				struct ethhdr *eth = eth_hdr(skb);
2503
2504				if (ntohs(eth->h_proto) == ETH_P_IPV6 ||
2505				    (ntohs(eth->h_proto) == ETH_P_IP &&
2506				     old_iph->frag_off & htons(IP_DF)))
2507					df = htons(IP_DF);
2508			}
2509		} else if (test_bit(IP_TUNNEL_DONT_FRAGMENT_BIT,
2510				    info->key.tun_flags)) {
2511			df = htons(IP_DF);
2512		}
2513
2514		ndst = &rt->dst;
2515		err = skb_tunnel_check_pmtu(skb, ndst, vxlan_headroom(flags & VXLAN_F_GPE),
2516					    netif_is_any_bridge_port(dev));
2517		if (err < 0) {
2518			goto tx_error;
2519		} else if (err) {
2520			if (info) {
2521				struct ip_tunnel_info *unclone;
2522
2523				unclone = skb_tunnel_info_unclone(skb);
2524				if (unlikely(!unclone))
2525					goto tx_error;
2526
2527				unclone->key.u.ipv4.src = pkey->u.ipv4.dst;
2528				unclone->key.u.ipv4.dst = saddr;
2529			}
2530			vxlan_encap_bypass(skb, vxlan, vxlan, vni, false);
2531			dst_release(ndst);
2532			goto out_unlock;
2533		}
2534
2535		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
2536		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
2537		err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
2538				      vni, md, flags, udp_sum);
2539		if (err < 0) {
2540			reason = SKB_DROP_REASON_NOMEM;
2541			goto tx_error;
2542		}
2543
2544		udp_tunnel_xmit_skb(rt, sock4->sock->sk, skb, saddr,
2545				    pkey->u.ipv4.dst, tos, ttl, df,
2546				    src_port, dst_port, xnet, !udp_sum,
2547				    ipcb_flags);
2548#if IS_ENABLED(CONFIG_IPV6)
2549	} else {
2550		struct vxlan_sock *sock6;
2551		struct in6_addr saddr;
2552		u16 ip6cb_flags = 0;
2553
2554		sock6 = rcu_dereference(vxlan->vn6_sock);
2555		if (unlikely(!sock6)) {
2556			reason = SKB_DROP_REASON_DEV_READY;
2557			goto tx_error;
2558		}
2559
2560		if (!ifindex)
2561			ifindex = sock6->sock->sk->sk_bound_dev_if;
2562
2563		ndst = udp_tunnel6_dst_lookup(skb, dev, vxlan->net, sock6->sock,
2564					      ifindex, &saddr, pkey,
2565					      src_port, dst_port, tos,
2566					      use_cache ? dst_cache : NULL);
2567		if (IS_ERR(ndst)) {
2568			err = PTR_ERR(ndst);
2569			ndst = NULL;
2570			reason = SKB_DROP_REASON_IP_OUTNOROUTES;
2571			goto tx_error;
2572		}
2573
2574		if (flags & VXLAN_F_MC_ROUTE)
2575			ip6cb_flags |= IP6SKB_MCROUTE;
2576
2577		if (!info) {
2578			u32 rt6i_flags = dst_rt6_info(ndst)->rt6i_flags;
2579
2580			err = encap_bypass_if_local(skb, dev, vxlan, AF_INET6,
2581						    dst_port, ifindex, vni,
2582						    ndst, rt6i_flags);
2583			if (err)
2584				goto out_unlock;
2585		}
2586
2587		err = skb_tunnel_check_pmtu(skb, ndst,
2588					    vxlan_headroom((flags & VXLAN_F_GPE) | VXLAN_F_IPV6),
2589					    netif_is_any_bridge_port(dev));
2590		if (err < 0) {
2591			goto tx_error;
2592		} else if (err) {
2593			if (info) {
2594				struct ip_tunnel_info *unclone;
2595
2596				unclone = skb_tunnel_info_unclone(skb);
2597				if (unlikely(!unclone))
2598					goto tx_error;
2599
2600				unclone->key.u.ipv6.src = pkey->u.ipv6.dst;
2601				unclone->key.u.ipv6.dst = saddr;
2602			}
2603
2604			vxlan_encap_bypass(skb, vxlan, vxlan, vni, false);
2605			dst_release(ndst);
2606			goto out_unlock;
2607		}
2608
2609		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
2610		ttl = ttl ? : ip6_dst_hoplimit(ndst);
2611		skb_scrub_packet(skb, xnet);
2612		err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
2613				      vni, md, flags, udp_sum);
2614		if (err < 0) {
2615			reason = SKB_DROP_REASON_NOMEM;
2616			goto tx_error;
2617		}
2618
2619		udp_tunnel6_xmit_skb(ndst, sock6->sock->sk, skb, dev,
2620				     &saddr, &pkey->u.ipv6.dst, tos, ttl,
2621				     pkey->label, src_port, dst_port, !udp_sum,
2622				     ip6cb_flags);
2623#endif
2624	}
2625	vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX, pkt_len);
2626out_unlock:
2627	rcu_read_unlock();
2628	return;
2629
2630drop:
2631	dev_dstats_tx_dropped(dev);
2632	vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_DROPS, 0);
2633	kfree_skb_reason(skb, reason);
2634	return;
2635
2636tx_error:
2637	rcu_read_unlock();
2638	if (err == -ELOOP)
2639		DEV_STATS_INC(dev, collisions);
2640	else if (err == -ENETUNREACH)
2641		DEV_STATS_INC(dev, tx_carrier_errors);
2642	dst_release(ndst);
2643	DEV_STATS_INC(dev, tx_errors);
2644	vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_ERRORS, 0);
2645	kfree_skb_reason(skb, reason);
2646}
2647
2648static void vxlan_xmit_nh(struct sk_buff *skb, struct net_device *dev,
2649			  struct vxlan_fdb *f, __be32 vni, bool did_rsc)
2650{
2651	struct vxlan_rdst nh_rdst;
2652	struct nexthop *nh;
2653	bool do_xmit;
2654	u32 hash;
2655
2656	memset(&nh_rdst, 0, sizeof(struct vxlan_rdst));
2657	hash = skb_get_hash(skb);
2658
2659	nh = rcu_dereference(f->nh);
2660	if (!nh)
2661		goto drop;
2662	do_xmit = vxlan_fdb_nh_path_select(nh, hash, &nh_rdst);
2663
2664	if (likely(do_xmit))
2665		vxlan_xmit_one(skb, dev, vni, &nh_rdst, did_rsc);
2666	else
2667		goto drop;
2668
2669	return;
2670
2671drop:
2672	dev_dstats_tx_dropped(dev);
2673	vxlan_vnifilter_count(netdev_priv(dev), vni, NULL,
2674			      VXLAN_VNI_STATS_TX_DROPS, 0);
2675	dev_kfree_skb(skb);
2676}
2677
2678static netdev_tx_t vxlan_xmit_nhid(struct sk_buff *skb, struct net_device *dev,
2679				   u32 nhid, __be32 vni)
2680{
2681	struct vxlan_dev *vxlan = netdev_priv(dev);
2682	struct vxlan_rdst nh_rdst;
2683	struct nexthop *nh;
2684	bool do_xmit;
2685	u32 hash;
2686
2687	memset(&nh_rdst, 0, sizeof(struct vxlan_rdst));
2688	hash = skb_get_hash(skb);
2689
2690	rcu_read_lock();
2691	nh = nexthop_find_by_id(dev_net(dev), nhid);
2692	if (unlikely(!nh || !nexthop_is_fdb(nh) || !nexthop_is_multipath(nh))) {
2693		rcu_read_unlock();
2694		goto drop;
2695	}
2696	do_xmit = vxlan_fdb_nh_path_select(nh, hash, &nh_rdst);
2697	rcu_read_unlock();
2698
2699	if (vxlan->cfg.saddr.sa.sa_family != nh_rdst.remote_ip.sa.sa_family)
2700		goto drop;
2701
2702	if (likely(do_xmit))
2703		vxlan_xmit_one(skb, dev, vni, &nh_rdst, false);
2704	else
2705		goto drop;
2706
2707	return NETDEV_TX_OK;
2708
2709drop:
2710	dev_dstats_tx_dropped(dev);
2711	vxlan_vnifilter_count(netdev_priv(dev), vni, NULL,
2712			      VXLAN_VNI_STATS_TX_DROPS, 0);
2713	dev_kfree_skb(skb);
2714	return NETDEV_TX_OK;
2715}
2716
2717/* Transmit local packets over Vxlan
2718 *
2719 * Outer IP header inherits ECN and DF from inner header.
2720 * Outer UDP destination is the VXLAN assigned port.
2721 *           source port is based on hash of flow
2722 */
2723static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
2724{
2725	struct vxlan_dev *vxlan = netdev_priv(dev);
2726	struct vxlan_rdst *rdst, *fdst = NULL;
2727	const struct ip_tunnel_info *info;
2728	struct vxlan_fdb *f;
2729	struct ethhdr *eth;
2730	__be32 vni = 0;
2731	u32 nhid = 0;
2732	bool did_rsc;
2733
2734	info = skb_tunnel_info(skb);
2735
2736	skb_reset_mac_header(skb);
2737
2738	if (vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA) {
2739		if (info && info->mode & IP_TUNNEL_INFO_BRIDGE &&
2740		    info->mode & IP_TUNNEL_INFO_TX) {
2741			vni = tunnel_id_to_key32(info->key.tun_id);
2742			nhid = info->key.nhid;
2743		} else {
2744			if (info && info->mode & IP_TUNNEL_INFO_TX)
2745				vxlan_xmit_one(skb, dev, vni, NULL, false);
2746			else
2747				kfree_skb_reason(skb, SKB_DROP_REASON_TUNNEL_TXINFO);
2748			return NETDEV_TX_OK;
2749		}
2750	}
2751
2752	if (vxlan->cfg.flags & VXLAN_F_PROXY) {
2753		eth = eth_hdr(skb);
2754		if (ntohs(eth->h_proto) == ETH_P_ARP)
2755			return arp_reduce(dev, skb, vni);
2756#if IS_ENABLED(CONFIG_IPV6)
2757		else if (ntohs(eth->h_proto) == ETH_P_IPV6 &&
2758			 pskb_may_pull(skb, sizeof(struct ipv6hdr) +
2759					    sizeof(struct nd_msg)) &&
2760			 ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
2761			struct nd_msg *m = (struct nd_msg *)(ipv6_hdr(skb) + 1);
2762
2763			if (m->icmph.icmp6_code == 0 &&
2764			    m->icmph.icmp6_type == NDISC_NEIGHBOUR_SOLICITATION)
2765				return neigh_reduce(dev, skb, vni);
2766		}
2767#endif
2768	}
2769
2770	if (nhid)
2771		return vxlan_xmit_nhid(skb, dev, nhid, vni);
2772
2773	if (vxlan->cfg.flags & VXLAN_F_MDB) {
2774		struct vxlan_mdb_entry *mdb_entry;
2775
2776		rcu_read_lock();
2777		mdb_entry = vxlan_mdb_entry_skb_get(vxlan, skb, vni);
2778		if (mdb_entry) {
2779			netdev_tx_t ret;
2780
2781			ret = vxlan_mdb_xmit(vxlan, mdb_entry, skb);
2782			rcu_read_unlock();
2783			return ret;
2784		}
2785		rcu_read_unlock();
2786	}
2787
2788	eth = eth_hdr(skb);
2789	rcu_read_lock();
2790	f = vxlan_find_mac_tx(vxlan, eth->h_dest, vni);
2791	did_rsc = false;
2792
2793	if (f && (f->flags & NTF_ROUTER) && (vxlan->cfg.flags & VXLAN_F_RSC) &&
2794	    (ntohs(eth->h_proto) == ETH_P_IP ||
2795	     ntohs(eth->h_proto) == ETH_P_IPV6)) {
2796		did_rsc = route_shortcircuit(dev, skb);
2797		if (did_rsc)
2798			f = vxlan_find_mac_tx(vxlan, eth->h_dest, vni);
2799	}
2800
2801	if (f == NULL) {
2802		f = vxlan_find_mac_tx(vxlan, all_zeros_mac, vni);
2803		if (f == NULL) {
2804			if ((vxlan->cfg.flags & VXLAN_F_L2MISS) &&
2805			    !is_multicast_ether_addr(eth->h_dest))
2806				vxlan_fdb_miss(vxlan, eth->h_dest);
2807
2808			dev_dstats_tx_dropped(dev);
2809			vxlan_vnifilter_count(vxlan, vni, NULL,
2810					      VXLAN_VNI_STATS_TX_DROPS, 0);
2811			kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET);
2812			goto out;
2813		}
2814	}
2815
2816	if (rcu_access_pointer(f->nh)) {
2817		vxlan_xmit_nh(skb, dev, f,
2818			      (vni ? : vxlan->default_dst.remote_vni), did_rsc);
2819	} else {
2820		list_for_each_entry_rcu(rdst, &f->remotes, list) {
2821			struct sk_buff *skb1;
2822
2823			if (!fdst) {
2824				fdst = rdst;
2825				continue;
2826			}
2827			skb1 = skb_clone(skb, GFP_ATOMIC);
2828			if (skb1)
2829				vxlan_xmit_one(skb1, dev, vni, rdst, did_rsc);
2830		}
2831		if (fdst)
2832			vxlan_xmit_one(skb, dev, vni, fdst, did_rsc);
2833		else
2834			kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET);
2835	}
2836
2837out:
2838	rcu_read_unlock();
2839	return NETDEV_TX_OK;
2840}
2841
2842/* Walk the forwarding table and purge stale entries */
2843static void vxlan_cleanup(struct timer_list *t)
2844{
2845	struct vxlan_dev *vxlan = timer_container_of(vxlan, t, age_timer);
2846	unsigned long next_timer = jiffies + FDB_AGE_INTERVAL;
2847	struct vxlan_fdb *f;
2848
2849	if (!netif_running(vxlan->dev))
2850		return;
2851
2852	rcu_read_lock();
2853	hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) {
2854		unsigned long timeout;
2855
2856		if (f->state & (NUD_PERMANENT | NUD_NOARP))
2857			continue;
2858
2859		if (f->flags & NTF_EXT_LEARNED)
2860			continue;
2861
2862		timeout = READ_ONCE(f->updated) + vxlan->cfg.age_interval * HZ;
2863		if (time_before_eq(timeout, jiffies)) {
2864			spin_lock(&vxlan->hash_lock);
2865			if (!hlist_unhashed(&f->fdb_node)) {
2866				netdev_dbg(vxlan->dev, "garbage collect %pM\n",
2867					   f->key.eth_addr);
2868				f->state = NUD_STALE;
2869				vxlan_fdb_destroy(vxlan, f, true, true);
2870			}
2871			spin_unlock(&vxlan->hash_lock);
2872		} else if (time_before(timeout, next_timer)) {
2873			next_timer = timeout;
2874		}
2875	}
2876	rcu_read_unlock();
2877
2878	mod_timer(&vxlan->age_timer, next_timer);
2879}
2880
2881static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
2882{
2883	ASSERT_RTNL();
2884
2885	hlist_del_init_rcu(&vxlan->hlist4.hlist);
2886#if IS_ENABLED(CONFIG_IPV6)
2887	hlist_del_init_rcu(&vxlan->hlist6.hlist);
2888#endif
2889}
2890
2891static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan,
2892			     struct vxlan_dev_node *node)
2893{
2894	__be32 vni = vxlan->default_dst.remote_vni;
2895
2896	ASSERT_RTNL();
2897
2898	node->vxlan = vxlan;
2899	hlist_add_head_rcu(&node->hlist, vni_head(vs, vni));
2900}
2901
2902/* Setup stats when device is created */
2903static int vxlan_init(struct net_device *dev)
2904{
2905	struct vxlan_dev *vxlan = netdev_priv(dev);
2906	int err;
2907
2908	err = rhashtable_init(&vxlan->fdb_hash_tbl, &vxlan_fdb_rht_params);
2909	if (err)
2910		return err;
2911
2912	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
2913		err = vxlan_vnigroup_init(vxlan);
2914		if (err)
2915			goto err_rhashtable_destroy;
2916	}
2917
2918	err = gro_cells_init(&vxlan->gro_cells, dev);
2919	if (err)
2920		goto err_vnigroup_uninit;
2921
2922	err = vxlan_mdb_init(vxlan);
2923	if (err)
2924		goto err_gro_cells_destroy;
2925
2926	netdev_lockdep_set_classes(dev);
2927	return 0;
2928
2929err_gro_cells_destroy:
2930	gro_cells_destroy(&vxlan->gro_cells);
2931err_vnigroup_uninit:
2932	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
2933		vxlan_vnigroup_uninit(vxlan);
2934err_rhashtable_destroy:
2935	rhashtable_destroy(&vxlan->fdb_hash_tbl);
2936	return err;
2937}
2938
2939static void vxlan_uninit(struct net_device *dev)
2940{
2941	struct vxlan_dev *vxlan = netdev_priv(dev);
2942
2943	vxlan_mdb_fini(vxlan);
2944
2945	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
2946		vxlan_vnigroup_uninit(vxlan);
2947
2948	gro_cells_destroy(&vxlan->gro_cells);
2949
2950	rhashtable_destroy(&vxlan->fdb_hash_tbl);
2951}
2952
2953/* Start ageing timer and join group when device is brought up */
2954static int vxlan_open(struct net_device *dev)
2955{
2956	struct vxlan_dev *vxlan = netdev_priv(dev);
2957	int ret;
2958
2959	ret = vxlan_sock_add(vxlan);
2960	if (ret < 0)
2961		return ret;
2962
2963	ret = vxlan_multicast_join(vxlan);
2964	if (ret) {
2965		vxlan_sock_release(vxlan);
2966		return ret;
2967	}
2968
2969	if (vxlan->cfg.age_interval)
2970		mod_timer(&vxlan->age_timer, jiffies + FDB_AGE_INTERVAL);
2971
2972	return ret;
2973}
2974
2975struct vxlan_fdb_flush_desc {
2976	bool				ignore_default_entry;
2977	unsigned long                   state;
2978	unsigned long			state_mask;
2979	unsigned long                   flags;
2980	unsigned long			flags_mask;
2981	__be32				src_vni;
2982	u32				nhid;
2983	__be32				vni;
2984	__be16				port;
2985	union vxlan_addr		dst_ip;
2986};
2987
2988static bool vxlan_fdb_is_default_entry(const struct vxlan_fdb *f,
2989				       const struct vxlan_dev *vxlan)
2990{
2991	return is_zero_ether_addr(f->key.eth_addr) &&
2992	       f->key.vni == vxlan->cfg.vni;
2993}
2994
2995static bool vxlan_fdb_nhid_matches(const struct vxlan_fdb *f, u32 nhid)
2996{
2997	struct nexthop *nh = rtnl_dereference(f->nh);
2998
2999	return nh && nh->id == nhid;
3000}
3001
3002static bool vxlan_fdb_flush_matches(const struct vxlan_fdb *f,
3003				    const struct vxlan_dev *vxlan,
3004				    const struct vxlan_fdb_flush_desc *desc)
3005{
3006	if (desc->state_mask && (f->state & desc->state_mask) != desc->state)
3007		return false;
3008
3009	if (desc->flags_mask && (f->flags & desc->flags_mask) != desc->flags)
3010		return false;
3011
3012	if (desc->ignore_default_entry && vxlan_fdb_is_default_entry(f, vxlan))
3013		return false;
3014
3015	if (desc->src_vni && f->key.vni != desc->src_vni)
3016		return false;
3017
3018	if (desc->nhid && !vxlan_fdb_nhid_matches(f, desc->nhid))
3019		return false;
3020
3021	return true;
3022}
3023
3024static bool
3025vxlan_fdb_flush_should_match_remotes(const struct vxlan_fdb_flush_desc *desc)
3026{
3027	return desc->vni || desc->port || desc->dst_ip.sa.sa_family;
3028}
3029
3030static bool
3031vxlan_fdb_flush_remote_matches(const struct vxlan_fdb_flush_desc *desc,
3032			       const struct vxlan_rdst *rd)
3033{
3034	if (desc->vni && rd->remote_vni != desc->vni)
3035		return false;
3036
3037	if (desc->port && rd->remote_port != desc->port)
3038		return false;
3039
3040	if (desc->dst_ip.sa.sa_family &&
3041	    !vxlan_addr_equal(&rd->remote_ip, &desc->dst_ip))
3042		return false;
3043
3044	return true;
3045}
3046
3047static void
3048vxlan_fdb_flush_match_remotes(struct vxlan_fdb *f, struct vxlan_dev *vxlan,
3049			      const struct vxlan_fdb_flush_desc *desc,
3050			      bool *p_destroy_fdb)
3051{
3052	bool remotes_flushed = false;
3053	struct vxlan_rdst *rd, *tmp;
3054
3055	list_for_each_entry_safe(rd, tmp, &f->remotes, list) {
3056		if (!vxlan_fdb_flush_remote_matches(desc, rd))
3057			continue;
3058
3059		vxlan_fdb_dst_destroy(vxlan, f, rd, true);
3060		remotes_flushed = true;
3061	}
3062
3063	*p_destroy_fdb = remotes_flushed && list_empty(&f->remotes);
3064}
3065
3066/* Purge the forwarding table */
3067static void vxlan_flush(struct vxlan_dev *vxlan,
3068			const struct vxlan_fdb_flush_desc *desc)
3069{
3070	bool match_remotes = vxlan_fdb_flush_should_match_remotes(desc);
3071	struct vxlan_fdb *f;
3072
3073	rcu_read_lock();
3074	hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) {
3075		if (!vxlan_fdb_flush_matches(f, vxlan, desc))
3076			continue;
3077
3078		spin_lock_bh(&vxlan->hash_lock);
3079		if (hlist_unhashed(&f->fdb_node))
3080			goto unlock;
3081
3082		if (match_remotes) {
3083			bool destroy_fdb = false;
3084
3085			vxlan_fdb_flush_match_remotes(f, vxlan, desc,
3086						      &destroy_fdb);
3087
3088			if (!destroy_fdb)
3089				goto unlock;
3090		}
3091
3092		vxlan_fdb_destroy(vxlan, f, true, true);
3093unlock:
3094		spin_unlock_bh(&vxlan->hash_lock);
3095	}
3096	rcu_read_unlock();
3097}
3098
3099static const struct nla_policy vxlan_del_bulk_policy[NDA_MAX + 1] = {
3100	[NDA_SRC_VNI]   = { .type = NLA_U32 },
3101	[NDA_NH_ID]	= { .type = NLA_U32 },
3102	[NDA_VNI]	= { .type = NLA_U32 },
3103	[NDA_PORT]	= { .type = NLA_U16 },
3104	[NDA_DST]	= NLA_POLICY_RANGE(NLA_BINARY, sizeof(struct in_addr),
3105					   sizeof(struct in6_addr)),
3106	[NDA_NDM_STATE_MASK]	= { .type = NLA_U16 },
3107	[NDA_NDM_FLAGS_MASK]	= { .type = NLA_U8 },
3108};
3109
3110#define VXLAN_FDB_FLUSH_IGNORED_NDM_FLAGS (NTF_MASTER | NTF_SELF)
3111#define VXLAN_FDB_FLUSH_ALLOWED_NDM_STATES (NUD_PERMANENT | NUD_NOARP)
3112#define VXLAN_FDB_FLUSH_ALLOWED_NDM_FLAGS (NTF_EXT_LEARNED | NTF_OFFLOADED | \
3113					   NTF_ROUTER)
3114
3115static int vxlan_fdb_delete_bulk(struct nlmsghdr *nlh, struct net_device *dev,
3116				 struct netlink_ext_ack *extack)
3117{
3118	struct vxlan_dev *vxlan = netdev_priv(dev);
3119	struct vxlan_fdb_flush_desc desc = {};
3120	struct ndmsg *ndm = nlmsg_data(nlh);
3121	struct nlattr *tb[NDA_MAX + 1];
3122	u8 ndm_flags;
3123	int err;
3124
3125	ndm_flags = ndm->ndm_flags & ~VXLAN_FDB_FLUSH_IGNORED_NDM_FLAGS;
3126
3127	err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, vxlan_del_bulk_policy,
3128			  extack);
3129	if (err)
3130		return err;
3131
3132	if (ndm_flags & ~VXLAN_FDB_FLUSH_ALLOWED_NDM_FLAGS) {
3133		NL_SET_ERR_MSG(extack, "Unsupported fdb flush ndm flag bits set");
3134		return -EINVAL;
3135	}
3136	if (ndm->ndm_state & ~VXLAN_FDB_FLUSH_ALLOWED_NDM_STATES) {
3137		NL_SET_ERR_MSG(extack, "Unsupported fdb flush ndm state bits set");
3138		return -EINVAL;
3139	}
3140
3141	desc.state = ndm->ndm_state;
3142	desc.flags = ndm_flags;
3143
3144	if (tb[NDA_NDM_STATE_MASK])
3145		desc.state_mask = nla_get_u16(tb[NDA_NDM_STATE_MASK]);
3146
3147	if (tb[NDA_NDM_FLAGS_MASK])
3148		desc.flags_mask = nla_get_u8(tb[NDA_NDM_FLAGS_MASK]);
3149
3150	if (tb[NDA_SRC_VNI])
3151		desc.src_vni = cpu_to_be32(nla_get_u32(tb[NDA_SRC_VNI]));
3152
3153	if (tb[NDA_NH_ID])
3154		desc.nhid = nla_get_u32(tb[NDA_NH_ID]);
3155
3156	if (tb[NDA_VNI])
3157		desc.vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI]));
3158
3159	if (tb[NDA_PORT])
3160		desc.port = nla_get_be16(tb[NDA_PORT]);
3161
3162	if (tb[NDA_DST]) {
3163		union vxlan_addr ip;
3164
3165		err = vxlan_nla_get_addr(&ip, tb[NDA_DST]);
3166		if (err) {
3167			NL_SET_ERR_MSG_ATTR(extack, tb[NDA_DST],
3168					    "Unsupported address family");
3169			return err;
3170		}
3171		desc.dst_ip = ip;
3172	}
3173
3174	vxlan_flush(vxlan, &desc);
3175
3176	return 0;
3177}
3178
3179/* Cleanup timer and forwarding table on shutdown */
3180static int vxlan_stop(struct net_device *dev)
3181{
3182	struct vxlan_dev *vxlan = netdev_priv(dev);
3183	struct vxlan_fdb_flush_desc desc = {
3184		/* Default entry is deleted at vxlan_dellink. */
3185		.ignore_default_entry = true,
3186		.state = 0,
3187		.state_mask = NUD_PERMANENT | NUD_NOARP,
3188	};
3189
3190	vxlan_multicast_leave(vxlan);
3191
3192	timer_delete_sync(&vxlan->age_timer);
3193
3194	vxlan_flush(vxlan, &desc);
3195	vxlan_sock_release(vxlan);
3196
3197	return 0;
3198}
3199
3200/* Stub, nothing needs to be done. */
3201static void vxlan_set_multicast_list(struct net_device *dev)
3202{
3203}
3204
3205static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
3206{
3207	struct vxlan_dev *vxlan = netdev_priv(dev);
3208	struct vxlan_rdst *dst = &vxlan->default_dst;
3209	struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
3210							 dst->remote_ifindex);
3211
3212	/* This check is different than dev->max_mtu, because it looks at
3213	 * the lowerdev->mtu, rather than the static dev->max_mtu
3214	 */
3215	if (lowerdev) {
3216		int max_mtu = lowerdev->mtu - vxlan_headroom(vxlan->cfg.flags);
3217		if (new_mtu > max_mtu)
3218			return -EINVAL;
3219	}
3220
3221	WRITE_ONCE(dev->mtu, new_mtu);
3222	return 0;
3223}
3224
3225static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
3226{
3227	struct vxlan_dev *vxlan = netdev_priv(dev);
3228	struct ip_tunnel_info *info = skb_tunnel_info(skb);
3229	__be16 sport, dport;
3230
3231	sport = udp_flow_src_port(dev_net(dev), skb, vxlan->cfg.port_min,
3232				  vxlan->cfg.port_max, true);
3233	dport = info->key.tp_dst ? : vxlan->cfg.dst_port;
3234
3235	if (ip_tunnel_info_af(info) == AF_INET) {
3236		struct vxlan_sock *sock4 = rcu_dereference(vxlan->vn4_sock);
3237		struct rtable *rt;
3238
3239		if (!sock4)
3240			return -EIO;
3241
3242		rt = udp_tunnel_dst_lookup(skb, dev, vxlan->net, 0,
3243					   &info->key.u.ipv4.src,
3244					   &info->key,
3245					   sport, dport, info->key.tos,
3246					   &info->dst_cache);
3247		if (IS_ERR(rt))
3248			return PTR_ERR(rt);
3249		ip_rt_put(rt);
3250	} else {
3251#if IS_ENABLED(CONFIG_IPV6)
3252		struct vxlan_sock *sock6 = rcu_dereference(vxlan->vn6_sock);
3253		struct dst_entry *ndst;
3254
3255		if (!sock6)
3256			return -EIO;
3257
3258		ndst = udp_tunnel6_dst_lookup(skb, dev, vxlan->net, sock6->sock,
3259					      0, &info->key.u.ipv6.src,
3260					      &info->key,
3261					      sport, dport, info->key.tos,
3262					      &info->dst_cache);
3263		if (IS_ERR(ndst))
3264			return PTR_ERR(ndst);
3265		dst_release(ndst);
3266#else /* !CONFIG_IPV6 */
3267		return -EPFNOSUPPORT;
3268#endif
3269	}
3270	info->key.tp_src = sport;
3271	info->key.tp_dst = dport;
3272	return 0;
3273}
3274
3275static const struct net_device_ops vxlan_netdev_ether_ops = {
3276	.ndo_init		= vxlan_init,
3277	.ndo_uninit		= vxlan_uninit,
3278	.ndo_open		= vxlan_open,
3279	.ndo_stop		= vxlan_stop,
3280	.ndo_start_xmit		= vxlan_xmit,
3281	.ndo_set_rx_mode	= vxlan_set_multicast_list,
3282	.ndo_change_mtu		= vxlan_change_mtu,
3283	.ndo_validate_addr	= eth_validate_addr,
3284	.ndo_set_mac_address	= eth_mac_addr,
3285	.ndo_fdb_add		= vxlan_fdb_add,
3286	.ndo_fdb_del		= vxlan_fdb_delete,
3287	.ndo_fdb_del_bulk	= vxlan_fdb_delete_bulk,
3288	.ndo_fdb_dump		= vxlan_fdb_dump,
3289	.ndo_fdb_get		= vxlan_fdb_get,
3290	.ndo_mdb_add		= vxlan_mdb_add,
3291	.ndo_mdb_del		= vxlan_mdb_del,
3292	.ndo_mdb_del_bulk	= vxlan_mdb_del_bulk,
3293	.ndo_mdb_dump		= vxlan_mdb_dump,
3294	.ndo_mdb_get		= vxlan_mdb_get,
3295	.ndo_fill_metadata_dst	= vxlan_fill_metadata_dst,
3296};
3297
3298static const struct net_device_ops vxlan_netdev_raw_ops = {
3299	.ndo_init		= vxlan_init,
3300	.ndo_uninit		= vxlan_uninit,
3301	.ndo_open		= vxlan_open,
3302	.ndo_stop		= vxlan_stop,
3303	.ndo_start_xmit		= vxlan_xmit,
3304	.ndo_change_mtu		= vxlan_change_mtu,
3305	.ndo_fill_metadata_dst	= vxlan_fill_metadata_dst,
3306};
3307
3308/* Info for udev, that this is a virtual tunnel endpoint */
3309static const struct device_type vxlan_type = {
3310	.name = "vxlan",
3311};
3312
3313/* Calls the ndo_udp_tunnel_add of the caller in order to
3314 * supply the listening VXLAN udp ports. Callers are expected
3315 * to implement the ndo_udp_tunnel_add.
3316 */
3317static void vxlan_offload_rx_ports(struct net_device *dev, bool push)
3318{
3319	struct vxlan_sock *vs;
3320	struct net *net = dev_net(dev);
3321	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
3322	unsigned int i;
3323
3324	ASSERT_RTNL();
3325
3326	for (i = 0; i < PORT_HASH_SIZE; ++i) {
3327		hlist_for_each_entry(vs, &vn->sock_list[i], hlist) {
3328			unsigned short type;
3329
3330			if (vs->flags & VXLAN_F_GPE)
3331				type = UDP_TUNNEL_TYPE_VXLAN_GPE;
3332			else
3333				type = UDP_TUNNEL_TYPE_VXLAN;
3334
3335			if (push)
3336				udp_tunnel_push_rx_port(dev, vs->sock, type);
3337			else
3338				udp_tunnel_drop_rx_port(dev, vs->sock, type);
3339		}
3340	}
3341}
3342
3343/* Initialize the device structure. */
3344static void vxlan_setup(struct net_device *dev)
3345{
3346	struct vxlan_dev *vxlan = netdev_priv(dev);
3347
3348	eth_hw_addr_random(dev);
3349	ether_setup(dev);
3350
3351	dev->needs_free_netdev = true;
3352	SET_NETDEV_DEVTYPE(dev, &vxlan_type);
3353
3354	dev->features	|= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_FRAGLIST;
3355	dev->features   |= NETIF_F_RXCSUM;
3356	dev->features   |= NETIF_F_GSO_SOFTWARE;
3357
3358	dev->vlan_features = dev->features;
3359	dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_FRAGLIST;
3360	dev->hw_features |= NETIF_F_RXCSUM;
3361	dev->hw_features |= NETIF_F_GSO_SOFTWARE;
3362	netif_keep_dst(dev);
3363	dev->priv_flags |= IFF_NO_QUEUE;
3364	dev->change_proto_down = true;
3365	dev->lltx = true;
3366
3367	/* MTU range: 68 - 65535 */
3368	dev->min_mtu = ETH_MIN_MTU;
3369	dev->max_mtu = ETH_MAX_MTU;
3370
3371	dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS;
3372	INIT_LIST_HEAD(&vxlan->next);
3373	spin_lock_init(&vxlan->hash_lock);
3374
3375	timer_setup(&vxlan->age_timer, vxlan_cleanup, TIMER_DEFERRABLE);
3376
3377	vxlan->dev = dev;
3378
3379	INIT_HLIST_HEAD(&vxlan->fdb_list);
3380}
3381
3382static void vxlan_ether_setup(struct net_device *dev)
3383{
3384	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
3385	dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
3386	dev->netdev_ops = &vxlan_netdev_ether_ops;
3387}
3388
3389static void vxlan_raw_setup(struct net_device *dev)
3390{
3391	dev->header_ops = NULL;
3392	dev->type = ARPHRD_NONE;
3393	dev->hard_header_len = 0;
3394	dev->addr_len = 0;
3395	dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
3396	dev->netdev_ops = &vxlan_netdev_raw_ops;
3397}
3398
3399static const struct nla_policy vxlan_policy[IFLA_VXLAN_MAX + 1] = {
3400	[IFLA_VXLAN_UNSPEC]     = { .strict_start_type = IFLA_VXLAN_LOCALBYPASS },
3401	[IFLA_VXLAN_ID]		= { .type = NLA_U32 },
3402	[IFLA_VXLAN_GROUP]	= { .len = sizeof_field(struct iphdr, daddr) },
3403	[IFLA_VXLAN_GROUP6]	= { .len = sizeof(struct in6_addr) },
3404	[IFLA_VXLAN_LINK]	= { .type = NLA_U32 },
3405	[IFLA_VXLAN_LOCAL]	= { .len = sizeof_field(struct iphdr, saddr) },
3406	[IFLA_VXLAN_LOCAL6]	= { .len = sizeof(struct in6_addr) },
3407	[IFLA_VXLAN_TOS]	= { .type = NLA_U8 },
3408	[IFLA_VXLAN_TTL]	= { .type = NLA_U8 },
3409	[IFLA_VXLAN_LABEL]	= { .type = NLA_U32 },
3410	[IFLA_VXLAN_LEARNING]	= { .type = NLA_U8 },
3411	[IFLA_VXLAN_AGEING]	= { .type = NLA_U32 },
3412	[IFLA_VXLAN_LIMIT]	= { .type = NLA_U32 },
3413	[IFLA_VXLAN_PORT_RANGE] = { .len  = sizeof(struct ifla_vxlan_port_range) },
3414	[IFLA_VXLAN_PROXY]	= { .type = NLA_U8 },
3415	[IFLA_VXLAN_RSC]	= { .type = NLA_U8 },
3416	[IFLA_VXLAN_L2MISS]	= { .type = NLA_U8 },
3417	[IFLA_VXLAN_L3MISS]	= { .type = NLA_U8 },
3418	[IFLA_VXLAN_COLLECT_METADATA]	= { .type = NLA_U8 },
3419	[IFLA_VXLAN_PORT]	= { .type = NLA_U16 },
3420	[IFLA_VXLAN_UDP_CSUM]	= { .type = NLA_U8 },
3421	[IFLA_VXLAN_UDP_ZERO_CSUM6_TX]	= { .type = NLA_U8 },
3422	[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]	= { .type = NLA_U8 },
3423	[IFLA_VXLAN_REMCSUM_TX]	= { .type = NLA_U8 },
3424	[IFLA_VXLAN_REMCSUM_RX]	= { .type = NLA_U8 },
3425	[IFLA_VXLAN_GBP]	= { .type = NLA_FLAG, },
3426	[IFLA_VXLAN_GPE]	= { .type = NLA_FLAG, },
3427	[IFLA_VXLAN_REMCSUM_NOPARTIAL]	= { .type = NLA_FLAG },
3428	[IFLA_VXLAN_TTL_INHERIT]	= { .type = NLA_FLAG },
3429	[IFLA_VXLAN_DF]		= { .type = NLA_U8 },
3430	[IFLA_VXLAN_VNIFILTER]	= { .type = NLA_U8 },
3431	[IFLA_VXLAN_LOCALBYPASS]	= NLA_POLICY_MAX(NLA_U8, 1),
3432	[IFLA_VXLAN_LABEL_POLICY]       = NLA_POLICY_MAX(NLA_U32, VXLAN_LABEL_MAX),
3433	[IFLA_VXLAN_RESERVED_BITS] = NLA_POLICY_EXACT_LEN(sizeof(struct vxlanhdr)),
3434	[IFLA_VXLAN_MC_ROUTE]		= NLA_POLICY_MAX(NLA_U8, 1),
3435};
3436
3437static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[],
3438			  struct netlink_ext_ack *extack)
3439{
3440	if (tb[IFLA_ADDRESS]) {
3441		if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) {
3442			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_ADDRESS],
3443					    "Provided link layer address is not Ethernet");
3444			return -EINVAL;
3445		}
3446
3447		if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) {
3448			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_ADDRESS],
3449					    "Provided Ethernet address is not unicast");
3450			return -EADDRNOTAVAIL;
3451		}
3452	}
3453
3454	if (tb[IFLA_MTU]) {
3455		u32 mtu = nla_get_u32(tb[IFLA_MTU]);
3456
3457		if (mtu < ETH_MIN_MTU || mtu > ETH_MAX_MTU) {
3458			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_MTU],
3459					    "MTU must be between 68 and 65535");
3460			return -EINVAL;
3461		}
3462	}
3463
3464	if (!data) {
3465		NL_SET_ERR_MSG(extack,
3466			       "Required attributes not provided to perform the operation");
3467		return -EINVAL;
3468	}
3469
3470	if (data[IFLA_VXLAN_ID]) {
3471		u32 id = nla_get_u32(data[IFLA_VXLAN_ID]);
3472
3473		if (id >= VXLAN_N_VID) {
3474			NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_ID],
3475					    "VXLAN ID must be lower than 16777216");
3476			return -ERANGE;
3477		}
3478	}
3479
3480	if (data[IFLA_VXLAN_PORT_RANGE]) {
3481		const struct ifla_vxlan_port_range *p
3482			= nla_data(data[IFLA_VXLAN_PORT_RANGE]);
3483
3484		if (ntohs(p->high) < ntohs(p->low)) {
3485			NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_PORT_RANGE],
3486					    "Invalid source port range");
3487			return -EINVAL;
3488		}
3489	}
3490
3491	if (data[IFLA_VXLAN_DF]) {
3492		enum ifla_vxlan_df df = nla_get_u8(data[IFLA_VXLAN_DF]);
3493
3494		if (df < 0 || df > VXLAN_DF_MAX) {
3495			NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_DF],
3496					    "Invalid DF attribute");
3497			return -EINVAL;
3498		}
3499	}
3500
3501	return 0;
3502}
3503
3504static void vxlan_get_drvinfo(struct net_device *netdev,
3505			      struct ethtool_drvinfo *drvinfo)
3506{
3507	strscpy(drvinfo->version, VXLAN_VERSION, sizeof(drvinfo->version));
3508	strscpy(drvinfo->driver, "vxlan", sizeof(drvinfo->driver));
3509}
3510
3511static int vxlan_get_link_ksettings(struct net_device *dev,
3512				    struct ethtool_link_ksettings *cmd)
3513{
3514	struct vxlan_dev *vxlan = netdev_priv(dev);
3515	struct vxlan_rdst *dst = &vxlan->default_dst;
3516	struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
3517							 dst->remote_ifindex);
3518
3519	if (!lowerdev) {
3520		cmd->base.duplex = DUPLEX_UNKNOWN;
3521		cmd->base.port = PORT_OTHER;
3522		cmd->base.speed = SPEED_UNKNOWN;
3523
3524		return 0;
3525	}
3526
3527	return __ethtool_get_link_ksettings(lowerdev, cmd);
3528}
3529
3530static const struct ethtool_ops vxlan_ethtool_ops = {
3531	.get_drvinfo		= vxlan_get_drvinfo,
3532	.get_link		= ethtool_op_get_link,
3533	.get_link_ksettings	= vxlan_get_link_ksettings,
3534};
3535
3536static struct socket *vxlan_create_sock(struct net *net, bool ipv6,
3537					__be16 port, u32 flags, int ifindex)
3538{
3539	struct socket *sock;
3540	struct udp_port_cfg udp_conf;
3541	int err;
3542
3543	memset(&udp_conf, 0, sizeof(udp_conf));
3544
3545	if (ipv6) {
3546		udp_conf.family = AF_INET6;
3547		udp_conf.use_udp6_rx_checksums =
3548		    !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
3549		udp_conf.ipv6_v6only = 1;
3550	} else {
3551		udp_conf.family = AF_INET;
3552	}
3553
3554	udp_conf.local_udp_port = port;
3555	udp_conf.bind_ifindex = ifindex;
3556
3557	/* Open UDP socket */
3558	err = udp_sock_create(net, &udp_conf, &sock);
3559	if (err < 0)
3560		return ERR_PTR(err);
3561
3562	udp_allow_gso(sock->sk);
3563	return sock;
3564}
3565
3566/* Create new listen socket if needed */
3567static struct vxlan_sock *vxlan_socket_create(struct net *net, bool ipv6,
3568					      __be16 port, u32 flags,
3569					      int ifindex)
3570{
3571	struct vxlan_sock *vs;
3572	struct socket *sock;
3573	unsigned int h;
3574	struct udp_tunnel_sock_cfg tunnel_cfg;
3575
3576	ASSERT_RTNL();
3577
3578	vs = kzalloc(sizeof(*vs), GFP_KERNEL);
3579	if (!vs)
3580		return ERR_PTR(-ENOMEM);
3581
3582	for (h = 0; h < VNI_HASH_SIZE; ++h)
3583		INIT_HLIST_HEAD(&vs->vni_list[h]);
3584
3585	sock = vxlan_create_sock(net, ipv6, port, flags, ifindex);
3586	if (IS_ERR(sock)) {
3587		kfree(vs);
3588		return ERR_CAST(sock);
3589	}
3590
3591	vs->sock = sock;
3592	refcount_set(&vs->refcnt, 1);
3593	vs->flags = (flags & VXLAN_F_RCV_FLAGS);
3594
3595	hlist_add_head_rcu(&vs->hlist, vs_head(net, port));
3596	udp_tunnel_notify_add_rx_port(sock,
3597				      (vs->flags & VXLAN_F_GPE) ?
3598				      UDP_TUNNEL_TYPE_VXLAN_GPE :
3599				      UDP_TUNNEL_TYPE_VXLAN);
3600
3601	/* Mark socket as an encapsulation socket. */
3602	memset(&tunnel_cfg, 0, sizeof(tunnel_cfg));
3603	tunnel_cfg.sk_user_data = vs;
3604	tunnel_cfg.encap_type = 1;
3605	tunnel_cfg.encap_rcv = vxlan_rcv;
3606	tunnel_cfg.encap_err_lookup = vxlan_err_lookup;
3607	tunnel_cfg.encap_destroy = NULL;
3608	if (vs->flags & VXLAN_F_GPE) {
3609		tunnel_cfg.gro_receive = vxlan_gpe_gro_receive;
3610		tunnel_cfg.gro_complete = vxlan_gpe_gro_complete;
3611	} else {
3612		tunnel_cfg.gro_receive = vxlan_gro_receive;
3613		tunnel_cfg.gro_complete = vxlan_gro_complete;
3614	}
3615
3616	setup_udp_tunnel_sock(net, sock, &tunnel_cfg);
3617
3618	return vs;
3619}
3620
3621static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
3622{
3623	bool metadata = vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA;
3624	struct vxlan_sock *vs = NULL;
3625	struct vxlan_dev_node *node;
3626	int l3mdev_index = 0;
3627
3628	ASSERT_RTNL();
3629
3630	if (vxlan->cfg.remote_ifindex)
3631		l3mdev_index = l3mdev_master_upper_ifindex_by_index(
3632			vxlan->net, vxlan->cfg.remote_ifindex);
3633
3634	if (!vxlan->cfg.no_share) {
3635		rcu_read_lock();
3636		vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
3637				     vxlan->cfg.dst_port, vxlan->cfg.flags,
3638				     l3mdev_index);
3639		if (vs && !refcount_inc_not_zero(&vs->refcnt)) {
3640			rcu_read_unlock();
3641			return -EBUSY;
3642		}
3643		rcu_read_unlock();
3644	}
3645	if (!vs)
3646		vs = vxlan_socket_create(vxlan->net, ipv6,
3647					 vxlan->cfg.dst_port, vxlan->cfg.flags,
3648					 l3mdev_index);
3649	if (IS_ERR(vs))
3650		return PTR_ERR(vs);
3651#if IS_ENABLED(CONFIG_IPV6)
3652	if (ipv6) {
3653		rcu_assign_pointer(vxlan->vn6_sock, vs);
3654		node = &vxlan->hlist6;
3655	} else
3656#endif
3657	{
3658		rcu_assign_pointer(vxlan->vn4_sock, vs);
3659		node = &vxlan->hlist4;
3660	}
3661
3662	if (metadata && (vxlan->cfg.flags & VXLAN_F_VNIFILTER))
3663		vxlan_vs_add_vnigrp(vxlan, vs, ipv6);
3664	else
3665		vxlan_vs_add_dev(vs, vxlan, node);
3666
3667	return 0;
3668}
3669
3670static int vxlan_sock_add(struct vxlan_dev *vxlan)
3671{
3672	bool metadata = vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA;
3673	bool ipv6 = vxlan->cfg.flags & VXLAN_F_IPV6 || metadata;
3674	bool ipv4 = !ipv6 || metadata;
3675	int ret = 0;
3676
3677	RCU_INIT_POINTER(vxlan->vn4_sock, NULL);
3678#if IS_ENABLED(CONFIG_IPV6)
3679	RCU_INIT_POINTER(vxlan->vn6_sock, NULL);
3680	if (ipv6) {
3681		ret = __vxlan_sock_add(vxlan, true);
3682		if (ret < 0 && ret != -EAFNOSUPPORT)
3683			ipv4 = false;
3684	}
3685#endif
3686	if (ipv4)
3687		ret = __vxlan_sock_add(vxlan, false);
3688	if (ret < 0)
3689		vxlan_sock_release(vxlan);
3690	return ret;
3691}
3692
3693int vxlan_vni_in_use(struct net *src_net, struct vxlan_dev *vxlan,
3694		     struct vxlan_config *conf, __be32 vni)
3695{
3696	struct vxlan_net *vn = net_generic(src_net, vxlan_net_id);
3697	struct vxlan_dev *tmp;
3698
3699	list_for_each_entry(tmp, &vn->vxlan_list, next) {
3700		if (tmp == vxlan)
3701			continue;
3702		if (tmp->cfg.flags & VXLAN_F_VNIFILTER) {
3703			if (!vxlan_vnifilter_lookup(tmp, vni))
3704				continue;
3705		} else if (tmp->cfg.vni != vni) {
3706			continue;
3707		}
3708		if (tmp->cfg.dst_port != conf->dst_port)
3709			continue;
3710		if ((tmp->cfg.flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)) !=
3711		    (conf->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)))
3712			continue;
3713
3714		if ((conf->flags & VXLAN_F_IPV6_LINKLOCAL) &&
3715		    tmp->cfg.remote_ifindex != conf->remote_ifindex)
3716			continue;
3717
3718		return -EEXIST;
3719	}
3720
3721	return 0;
3722}
3723
3724static int vxlan_config_validate(struct net *src_net, struct vxlan_config *conf,
3725				 struct net_device **lower,
3726				 struct vxlan_dev *old,
3727				 struct netlink_ext_ack *extack)
3728{
3729	bool use_ipv6 = false;
3730
3731	if (conf->flags & VXLAN_F_GPE) {
3732		/* For now, allow GPE only together with
3733		 * COLLECT_METADATA. This can be relaxed later; in such
3734		 * case, the other side of the PtP link will have to be
3735		 * provided.
3736		 */
3737		if ((conf->flags & ~VXLAN_F_ALLOWED_GPE) ||
3738		    !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
3739			NL_SET_ERR_MSG(extack,
3740				       "VXLAN GPE does not support this combination of attributes");
3741			return -EINVAL;
3742		}
3743	}
3744
3745	if (!conf->remote_ip.sa.sa_family && !conf->saddr.sa.sa_family) {
3746		/* Unless IPv6 is explicitly requested, assume IPv4 */
3747		conf->remote_ip.sa.sa_family = AF_INET;
3748		conf->saddr.sa.sa_family = AF_INET;
3749	} else if (!conf->remote_ip.sa.sa_family) {
3750		conf->remote_ip.sa.sa_family = conf->saddr.sa.sa_family;
3751	} else if (!conf->saddr.sa.sa_family) {
3752		conf->saddr.sa.sa_family = conf->remote_ip.sa.sa_family;
3753	}
3754
3755	if (conf->saddr.sa.sa_family != conf->remote_ip.sa.sa_family) {
3756		NL_SET_ERR_MSG(extack,
3757			       "Local and remote address must be from the same family");
3758		return -EINVAL;
3759	}
3760
3761	if (vxlan_addr_multicast(&conf->saddr)) {
3762		NL_SET_ERR_MSG(extack, "Local address cannot be multicast");
3763		return -EINVAL;
3764	}
3765
3766	if (conf->saddr.sa.sa_family == AF_INET6) {
3767		if (!IS_ENABLED(CONFIG_IPV6)) {
3768			NL_SET_ERR_MSG(extack,
3769				       "IPv6 support not enabled in the kernel");
3770			return -EPFNOSUPPORT;
3771		}
3772		use_ipv6 = true;
3773		conf->flags |= VXLAN_F_IPV6;
3774
3775		if (!(conf->flags & VXLAN_F_COLLECT_METADATA)) {
3776			int local_type =
3777				ipv6_addr_type(&conf->saddr.sin6.sin6_addr);
3778			int remote_type =
3779				ipv6_addr_type(&conf->remote_ip.sin6.sin6_addr);
3780
3781			if (local_type & IPV6_ADDR_LINKLOCAL) {
3782				if (!(remote_type & IPV6_ADDR_LINKLOCAL) &&
3783				    (remote_type != IPV6_ADDR_ANY)) {
3784					NL_SET_ERR_MSG(extack,
3785						       "Invalid combination of local and remote address scopes");
3786					return -EINVAL;
3787				}
3788
3789				conf->flags |= VXLAN_F_IPV6_LINKLOCAL;
3790			} else {
3791				if (remote_type ==
3792				    (IPV6_ADDR_UNICAST | IPV6_ADDR_LINKLOCAL)) {
3793					NL_SET_ERR_MSG(extack,
3794						       "Invalid combination of local and remote address scopes");
3795					return -EINVAL;
3796				}
3797
3798				conf->flags &= ~VXLAN_F_IPV6_LINKLOCAL;
3799			}
3800		}
3801	}
3802
3803	if (conf->label && !use_ipv6) {
3804		NL_SET_ERR_MSG(extack,
3805			       "Label attribute only applies to IPv6 VXLAN devices");
3806		return -EINVAL;
3807	}
3808
3809	if (conf->label_policy && !use_ipv6) {
3810		NL_SET_ERR_MSG(extack,
3811			       "Label policy only applies to IPv6 VXLAN devices");
3812		return -EINVAL;
3813	}
3814
3815	if (conf->remote_ifindex) {
3816		struct net_device *lowerdev;
3817
3818		lowerdev = __dev_get_by_index(src_net, conf->remote_ifindex);
3819		if (!lowerdev) {
3820			NL_SET_ERR_MSG(extack,
3821				       "Invalid local interface, device not found");
3822			return -ENODEV;
3823		}
3824
3825#if IS_ENABLED(CONFIG_IPV6)
3826		if (use_ipv6) {
3827			struct inet6_dev *idev = __in6_dev_get(lowerdev);
3828
3829			if (idev && idev->cnf.disable_ipv6) {
3830				NL_SET_ERR_MSG(extack,
3831					       "IPv6 support disabled by administrator");
3832				return -EPERM;
3833			}
3834		}
3835#endif
3836
3837		*lower = lowerdev;
3838	} else {
3839		if (vxlan_addr_multicast(&conf->remote_ip)) {
3840			NL_SET_ERR_MSG(extack,
3841				       "Local interface required for multicast remote destination");
3842
3843			return -EINVAL;
3844		}
3845
3846#if IS_ENABLED(CONFIG_IPV6)
3847		if (conf->flags & VXLAN_F_IPV6_LINKLOCAL) {
3848			NL_SET_ERR_MSG(extack,
3849				       "Local interface required for link-local local/remote addresses");
3850			return -EINVAL;
3851		}
3852#endif
3853
3854		*lower = NULL;
3855	}
3856
3857	if (!conf->dst_port) {
3858		if (conf->flags & VXLAN_F_GPE)
3859			conf->dst_port = htons(IANA_VXLAN_GPE_UDP_PORT);
3860		else
3861			conf->dst_port = htons(vxlan_port);
3862	}
3863
3864	if (!conf->age_interval)
3865		conf->age_interval = FDB_AGE_DEFAULT;
3866
3867	if (vxlan_vni_in_use(src_net, old, conf, conf->vni)) {
3868		NL_SET_ERR_MSG(extack,
3869			       "A VXLAN device with the specified VNI already exists");
3870		return -EEXIST;
3871	}
3872
3873	return 0;
3874}
3875
3876static void vxlan_config_apply(struct net_device *dev,
3877			       struct vxlan_config *conf,
3878			       struct net_device *lowerdev,
3879			       struct net *src_net,
3880			       bool changelink)
3881{
3882	struct vxlan_dev *vxlan = netdev_priv(dev);
3883	struct vxlan_rdst *dst = &vxlan->default_dst;
3884	unsigned short needed_headroom = ETH_HLEN;
3885	int max_mtu = ETH_MAX_MTU;
3886	u32 flags = conf->flags;
3887
3888	if (!changelink) {
3889		if (flags & VXLAN_F_GPE)
3890			vxlan_raw_setup(dev);
3891		else
3892			vxlan_ether_setup(dev);
3893
3894		if (conf->mtu)
3895			dev->mtu = conf->mtu;
3896
3897		vxlan->net = src_net;
3898	}
3899
3900	dst->remote_vni = conf->vni;
3901
3902	memcpy(&dst->remote_ip, &conf->remote_ip, sizeof(conf->remote_ip));
3903
3904	if (lowerdev) {
3905		dst->remote_ifindex = conf->remote_ifindex;
3906
3907		netif_inherit_tso_max(dev, lowerdev);
3908
3909		needed_headroom = lowerdev->hard_header_len;
3910		needed_headroom += lowerdev->needed_headroom;
3911
3912		dev->needed_tailroom = lowerdev->needed_tailroom;
3913
3914		max_mtu = lowerdev->mtu - vxlan_headroom(flags);
3915		if (max_mtu < ETH_MIN_MTU)
3916			max_mtu = ETH_MIN_MTU;
3917
3918		if (!changelink && !conf->mtu)
3919			dev->mtu = max_mtu;
3920	}
3921
3922	if (dev->mtu > max_mtu)
3923		dev->mtu = max_mtu;
3924
3925	if (flags & VXLAN_F_COLLECT_METADATA)
3926		flags |= VXLAN_F_IPV6;
3927	needed_headroom += vxlan_headroom(flags);
3928	dev->needed_headroom = needed_headroom;
3929
3930	memcpy(&vxlan->cfg, conf, sizeof(*conf));
3931}
3932
3933static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
3934			       struct vxlan_config *conf,
3935			       struct netlink_ext_ack *extack)
3936{
3937	struct vxlan_dev *vxlan = netdev_priv(dev);
3938	struct net_device *lowerdev;
3939	int ret;
3940
3941	ret = vxlan_config_validate(src_net, conf, &lowerdev, vxlan, extack);
3942	if (ret)
3943		return ret;
3944
3945	vxlan_config_apply(dev, conf, lowerdev, src_net, false);
3946
3947	return 0;
3948}
3949
3950static int __vxlan_dev_create(struct net *net, struct net_device *dev,
3951			      struct vxlan_config *conf,
3952			      struct netlink_ext_ack *extack)
3953{
3954	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
3955	struct vxlan_dev *vxlan = netdev_priv(dev);
3956	struct net_device *remote_dev = NULL;
3957	struct vxlan_rdst *dst;
3958	int err;
3959
3960	dst = &vxlan->default_dst;
3961	err = vxlan_dev_configure(net, dev, conf, extack);
3962	if (err)
3963		return err;
3964
3965	dev->ethtool_ops = &vxlan_ethtool_ops;
3966
3967	err = register_netdevice(dev);
3968	if (err)
3969		return err;
3970
3971	if (dst->remote_ifindex) {
3972		remote_dev = __dev_get_by_index(net, dst->remote_ifindex);
3973		if (!remote_dev) {
3974			err = -ENODEV;
3975			goto unregister;
3976		}
3977
3978		err = netdev_upper_dev_link(remote_dev, dev, extack);
3979		if (err)
3980			goto unregister;
3981
3982		dst->remote_dev = remote_dev;
3983	}
3984
3985	err = rtnl_configure_link(dev, NULL, 0, NULL);
3986	if (err < 0)
3987		goto unlink;
3988
3989	/* create an fdb entry for a valid default destination */
3990	if (!vxlan_addr_any(&dst->remote_ip)) {
3991		spin_lock_bh(&vxlan->hash_lock);
3992		err = vxlan_fdb_update(vxlan, all_zeros_mac,
3993				       &dst->remote_ip,
3994				       NUD_REACHABLE | NUD_PERMANENT,
3995				       NLM_F_EXCL | NLM_F_CREATE,
3996				       vxlan->cfg.dst_port,
3997				       dst->remote_vni,
3998				       dst->remote_vni,
3999				       dst->remote_ifindex,
4000				       NTF_SELF, 0, true, extack);
4001		spin_unlock_bh(&vxlan->hash_lock);
4002		if (err)
4003			goto unlink;
4004	}
4005
4006	list_add(&vxlan->next, &vn->vxlan_list);
4007
4008	return 0;
4009
4010unlink:
4011	if (remote_dev)
4012		netdev_upper_dev_unlink(remote_dev, dev);
4013unregister:
4014	unregister_netdevice(dev);
4015	return err;
4016}
4017
4018/* Set/clear flags based on attribute */
4019static int vxlan_nl2flag(struct vxlan_config *conf, struct nlattr *tb[],
4020			  int attrtype, unsigned long mask, bool changelink,
4021			  bool changelink_supported,
4022			  struct netlink_ext_ack *extack)
4023{
4024	unsigned long flags;
4025
4026	if (!tb[attrtype])
4027		return 0;
4028
4029	if (changelink && !changelink_supported) {
4030		vxlan_flag_attr_error(attrtype, extack);
4031		return -EOPNOTSUPP;
4032	}
4033
4034	if (vxlan_policy[attrtype].type == NLA_FLAG)
4035		flags = conf->flags | mask;
4036	else if (nla_get_u8(tb[attrtype]))
4037		flags = conf->flags | mask;
4038	else
4039		flags = conf->flags & ~mask;
4040
4041	conf->flags = flags;
4042
4043	return 0;
4044}
4045
4046static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
4047			 struct net_device *dev, struct vxlan_config *conf,
4048			 bool changelink, struct netlink_ext_ack *extack)
4049{
4050	struct vxlanhdr used_bits = {
4051		.vx_flags = VXLAN_HF_VNI,
4052		.vx_vni = VXLAN_VNI_MASK,
4053	};
4054	struct vxlan_dev *vxlan = netdev_priv(dev);
4055	int err = 0;
4056
4057	memset(conf, 0, sizeof(*conf));
4058
4059	/* if changelink operation, start with old existing cfg */
4060	if (changelink)
4061		memcpy(conf, &vxlan->cfg, sizeof(*conf));
4062
4063	if (data[IFLA_VXLAN_ID]) {
4064		__be32 vni = cpu_to_be32(nla_get_u32(data[IFLA_VXLAN_ID]));
4065
4066		if (changelink && (vni != conf->vni)) {
4067			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_ID], "Cannot change VNI");
4068			return -EOPNOTSUPP;
4069		}
4070		conf->vni = vni;
4071	}
4072
4073	if (data[IFLA_VXLAN_GROUP]) {
4074		if (changelink && (conf->remote_ip.sa.sa_family != AF_INET)) {
4075			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP], "New group address family does not match old group");
4076			return -EOPNOTSUPP;
4077		}
4078
4079		conf->remote_ip.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_GROUP]);
4080		conf->remote_ip.sa.sa_family = AF_INET;
4081	} else if (data[IFLA_VXLAN_GROUP6]) {
4082		if (!IS_ENABLED(CONFIG_IPV6)) {
4083			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP6], "IPv6 support not enabled in the kernel");
4084			return -EPFNOSUPPORT;
4085		}
4086
4087		if (changelink && (conf->remote_ip.sa.sa_family != AF_INET6)) {
4088			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP6], "New group address family does not match old group");
4089			return -EOPNOTSUPP;
4090		}
4091
4092		conf->remote_ip.sin6.sin6_addr = nla_get_in6_addr(data[IFLA_VXLAN_GROUP6]);
4093		conf->remote_ip.sa.sa_family = AF_INET6;
4094	}
4095
4096	if (data[IFLA_VXLAN_LOCAL]) {
4097		if (changelink && (conf->saddr.sa.sa_family != AF_INET)) {
4098			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL], "New local address family does not match old");
4099			return -EOPNOTSUPP;
4100		}
4101
4102		conf->saddr.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_LOCAL]);
4103		conf->saddr.sa.sa_family = AF_INET;
4104	} else if (data[IFLA_VXLAN_LOCAL6]) {
4105		if (!IS_ENABLED(CONFIG_IPV6)) {
4106			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL6], "IPv6 support not enabled in the kernel");
4107			return -EPFNOSUPPORT;
4108		}
4109
4110		if (changelink && (conf->saddr.sa.sa_family != AF_INET6)) {
4111			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL6], "New local address family does not match old");
4112			return -EOPNOTSUPP;
4113		}
4114
4115		/* TODO: respect scope id */
4116		conf->saddr.sin6.sin6_addr = nla_get_in6_addr(data[IFLA_VXLAN_LOCAL6]);
4117		conf->saddr.sa.sa_family = AF_INET6;
4118	}
4119
4120	if (data[IFLA_VXLAN_LINK])
4121		conf->remote_ifindex = nla_get_u32(data[IFLA_VXLAN_LINK]);
4122
4123	if (data[IFLA_VXLAN_TOS])
4124		conf->tos  = nla_get_u8(data[IFLA_VXLAN_TOS]);
4125
4126	if (data[IFLA_VXLAN_TTL])
4127		conf->ttl = nla_get_u8(data[IFLA_VXLAN_TTL]);
4128
4129	if (data[IFLA_VXLAN_TTL_INHERIT]) {
4130		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_TTL_INHERIT,
4131				    VXLAN_F_TTL_INHERIT, changelink, false,
4132				    extack);
4133		if (err)
4134			return err;
4135
4136	}
4137
4138	if (data[IFLA_VXLAN_LABEL])
4139		conf->label = nla_get_be32(data[IFLA_VXLAN_LABEL]) &
4140			     IPV6_FLOWLABEL_MASK;
4141	if (data[IFLA_VXLAN_LABEL_POLICY])
4142		conf->label_policy = nla_get_u32(data[IFLA_VXLAN_LABEL_POLICY]);
4143
4144	if (data[IFLA_VXLAN_LEARNING]) {
4145		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_LEARNING,
4146				    VXLAN_F_LEARN, changelink, true,
4147				    extack);
4148		if (err)
4149			return err;
4150	} else if (!changelink) {
4151		/* default to learn on a new device */
4152		conf->flags |= VXLAN_F_LEARN;
4153	}
4154
4155	if (data[IFLA_VXLAN_AGEING])
4156		conf->age_interval = nla_get_u32(data[IFLA_VXLAN_AGEING]);
4157
4158	if (data[IFLA_VXLAN_PROXY]) {
4159		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_PROXY,
4160				    VXLAN_F_PROXY, changelink, false,
4161				    extack);
4162		if (err)
4163			return err;
4164	}
4165
4166	if (data[IFLA_VXLAN_RSC]) {
4167		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_RSC,
4168				    VXLAN_F_RSC, changelink, false,
4169				    extack);
4170		if (err)
4171			return err;
4172	}
4173
4174	if (data[IFLA_VXLAN_L2MISS]) {
4175		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_L2MISS,
4176				    VXLAN_F_L2MISS, changelink, false,
4177				    extack);
4178		if (err)
4179			return err;
4180	}
4181
4182	if (data[IFLA_VXLAN_L3MISS]) {
4183		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_L3MISS,
4184				    VXLAN_F_L3MISS, changelink, false,
4185				    extack);
4186		if (err)
4187			return err;
4188	}
4189
4190	if (data[IFLA_VXLAN_LIMIT]) {
4191		if (changelink) {
4192			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LIMIT],
4193					    "Cannot change limit");
4194			return -EOPNOTSUPP;
4195		}
4196		conf->addrmax = nla_get_u32(data[IFLA_VXLAN_LIMIT]);
4197	}
4198
4199	if (data[IFLA_VXLAN_COLLECT_METADATA]) {
4200		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_COLLECT_METADATA,
4201				    VXLAN_F_COLLECT_METADATA, changelink, false,
4202				    extack);
4203		if (err)
4204			return err;
4205	}
4206
4207	if (data[IFLA_VXLAN_PORT_RANGE]) {
4208		if (!changelink) {
4209			const struct ifla_vxlan_port_range *p
4210				= nla_data(data[IFLA_VXLAN_PORT_RANGE]);
4211			conf->port_min = ntohs(p->low);
4212			conf->port_max = ntohs(p->high);
4213		} else {
4214			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_PORT_RANGE],
4215					    "Cannot change port range");
4216			return -EOPNOTSUPP;
4217		}
4218	}
4219
4220	if (data[IFLA_VXLAN_PORT]) {
4221		if (changelink) {
4222			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_PORT],
4223					    "Cannot change port");
4224			return -EOPNOTSUPP;
4225		}
4226		conf->dst_port = nla_get_be16(data[IFLA_VXLAN_PORT]);
4227	}
4228
4229	if (data[IFLA_VXLAN_UDP_CSUM]) {
4230		if (changelink) {
4231			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_UDP_CSUM],
4232					    "Cannot change UDP_CSUM flag");
4233			return -EOPNOTSUPP;
4234		}
4235		if (!nla_get_u8(data[IFLA_VXLAN_UDP_CSUM]))
4236			conf->flags |= VXLAN_F_UDP_ZERO_CSUM_TX;
4237	}
4238
4239	if (data[IFLA_VXLAN_LOCALBYPASS]) {
4240		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_LOCALBYPASS,
4241				    VXLAN_F_LOCALBYPASS, changelink,
4242				    true, extack);
4243		if (err)
4244			return err;
4245	} else if (!changelink) {
4246		/* default to local bypass on a new device */
4247		conf->flags |= VXLAN_F_LOCALBYPASS;
4248	}
4249
4250	if (data[IFLA_VXLAN_UDP_ZERO_CSUM6_TX]) {
4251		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_UDP_ZERO_CSUM6_TX,
4252				    VXLAN_F_UDP_ZERO_CSUM6_TX, changelink,
4253				    false, extack);
4254		if (err)
4255			return err;
4256	}
4257
4258	if (data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]) {
4259		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_UDP_ZERO_CSUM6_RX,
4260				    VXLAN_F_UDP_ZERO_CSUM6_RX, changelink,
4261				    false, extack);
4262		if (err)
4263			return err;
4264	}
4265
4266	if (data[IFLA_VXLAN_REMCSUM_TX]) {
4267		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_TX,
4268				    VXLAN_F_REMCSUM_TX, changelink, false,
4269				    extack);
4270		if (err)
4271			return err;
4272	}
4273
4274	if (data[IFLA_VXLAN_REMCSUM_RX]) {
4275		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_RX,
4276				    VXLAN_F_REMCSUM_RX, changelink, false,
4277				    extack);
4278		if (err)
4279			return err;
4280		used_bits.vx_flags |= VXLAN_HF_RCO;
4281		used_bits.vx_vni |= ~VXLAN_VNI_MASK;
4282	}
4283
4284	if (data[IFLA_VXLAN_GBP]) {
4285		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_GBP,
4286				    VXLAN_F_GBP, changelink, false, extack);
4287		if (err)
4288			return err;
4289		used_bits.vx_flags |= VXLAN_GBP_USED_BITS;
4290	}
4291
4292	if (data[IFLA_VXLAN_GPE]) {
4293		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_GPE,
4294				    VXLAN_F_GPE, changelink, false,
4295				    extack);
4296		if (err)
4297			return err;
4298
4299		used_bits.vx_flags |= VXLAN_GPE_USED_BITS;
4300	}
4301
4302	if (data[IFLA_VXLAN_RESERVED_BITS]) {
4303		struct vxlanhdr reserved_bits;
4304
4305		if (changelink) {
4306			NL_SET_ERR_MSG_ATTR(extack,
4307					    data[IFLA_VXLAN_RESERVED_BITS],
4308					    "Cannot change reserved_bits");
4309			return -EOPNOTSUPP;
4310		}
4311
4312		nla_memcpy(&reserved_bits, data[IFLA_VXLAN_RESERVED_BITS],
4313			   sizeof(reserved_bits));
4314		if (used_bits.vx_flags & reserved_bits.vx_flags ||
4315		    used_bits.vx_vni & reserved_bits.vx_vni) {
4316			__be64 ub_be64, rb_be64;
4317
4318			memcpy(&ub_be64, &used_bits, sizeof(ub_be64));
4319			memcpy(&rb_be64, &reserved_bits, sizeof(rb_be64));
4320
4321			NL_SET_ERR_MSG_ATTR_FMT(extack,
4322						data[IFLA_VXLAN_RESERVED_BITS],
4323						"Used bits %#018llx cannot overlap reserved bits %#018llx",
4324						be64_to_cpu(ub_be64),
4325						be64_to_cpu(rb_be64));
4326			return -EINVAL;
4327		}
4328
4329		conf->reserved_bits = reserved_bits;
4330	} else {
4331		/* For backwards compatibility, only allow reserved fields to be
4332		 * used by VXLAN extensions if explicitly requested.
4333		 */
4334		conf->reserved_bits = (struct vxlanhdr) {
4335			.vx_flags = ~used_bits.vx_flags,
4336			.vx_vni = ~used_bits.vx_vni,
4337		};
4338	}
4339
4340	if (data[IFLA_VXLAN_REMCSUM_NOPARTIAL]) {
4341		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_NOPARTIAL,
4342				    VXLAN_F_REMCSUM_NOPARTIAL, changelink,
4343				    false, extack);
4344		if (err)
4345			return err;
4346	}
4347
4348	if (data[IFLA_VXLAN_MC_ROUTE]) {
4349		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_MC_ROUTE,
4350				    VXLAN_F_MC_ROUTE, changelink,
4351				    true, extack);
4352		if (err)
4353			return err;
4354	}
4355
4356	if (tb[IFLA_MTU]) {
4357		if (changelink) {
4358			NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_MTU],
4359					    "Cannot change mtu");
4360			return -EOPNOTSUPP;
4361		}
4362		conf->mtu = nla_get_u32(tb[IFLA_MTU]);
4363	}
4364
4365	if (data[IFLA_VXLAN_DF])
4366		conf->df = nla_get_u8(data[IFLA_VXLAN_DF]);
4367
4368	if (data[IFLA_VXLAN_VNIFILTER]) {
4369		err = vxlan_nl2flag(conf, data, IFLA_VXLAN_VNIFILTER,
4370				    VXLAN_F_VNIFILTER, changelink, false,
4371				    extack);
4372		if (err)
4373			return err;
4374
4375		if ((conf->flags & VXLAN_F_VNIFILTER) &&
4376		    !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
4377			NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_VNIFILTER],
4378					    "vxlan vnifilter only valid in collect metadata mode");
4379			return -EINVAL;
4380		}
4381	}
4382
4383	return 0;
4384}
4385
4386static int vxlan_newlink(struct net_device *dev,
4387			 struct rtnl_newlink_params *params,
4388			 struct netlink_ext_ack *extack)
4389{
4390	struct net *link_net = rtnl_newlink_link_net(params);
4391	struct nlattr **data = params->data;
4392	struct nlattr **tb = params->tb;
4393	struct vxlan_config conf;
4394	int err;
4395
4396	err = vxlan_nl2conf(tb, data, dev, &conf, false, extack);
4397	if (err)
4398		return err;
4399
4400	return __vxlan_dev_create(link_net, dev, &conf, extack);
4401}
4402
4403static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
4404			    struct nlattr *data[],
4405			    struct netlink_ext_ack *extack)
4406{
4407	struct vxlan_dev *vxlan = netdev_priv(dev);
4408	bool rem_ip_changed, change_igmp;
4409	struct net_device *lowerdev;
4410	struct vxlan_config conf;
4411	struct vxlan_rdst *dst;
4412	int err;
4413
4414	dst = &vxlan->default_dst;
4415	err = vxlan_nl2conf(tb, data, dev, &conf, true, extack);
4416	if (err)
4417		return err;
4418
4419	err = vxlan_config_validate(vxlan->net, &conf, &lowerdev,
4420				    vxlan, extack);
4421	if (err)
4422		return err;
4423
4424	if (dst->remote_dev == lowerdev)
4425		lowerdev = NULL;
4426
4427	err = netdev_adjacent_change_prepare(dst->remote_dev, lowerdev, dev,
4428					     extack);
4429	if (err)
4430		return err;
4431
4432	rem_ip_changed = !vxlan_addr_equal(&conf.remote_ip, &dst->remote_ip);
4433	change_igmp = vxlan->dev->flags & IFF_UP &&
4434		      (rem_ip_changed ||
4435		       dst->remote_ifindex != conf.remote_ifindex);
4436
4437	/* handle default dst entry */
4438	if (rem_ip_changed) {
4439		spin_lock_bh(&vxlan->hash_lock);
4440		if (!vxlan_addr_any(&conf.remote_ip)) {
4441			err = vxlan_fdb_update(vxlan, all_zeros_mac,
4442					       &conf.remote_ip,
4443					       NUD_REACHABLE | NUD_PERMANENT,
4444					       NLM_F_APPEND | NLM_F_CREATE,
4445					       vxlan->cfg.dst_port,
4446					       conf.vni, conf.vni,
4447					       conf.remote_ifindex,
4448					       NTF_SELF, 0, true, extack);
4449			if (err) {
4450				spin_unlock_bh(&vxlan->hash_lock);
4451				netdev_adjacent_change_abort(dst->remote_dev,
4452							     lowerdev, dev);
4453				return err;
4454			}
4455		}
4456		if (!vxlan_addr_any(&dst->remote_ip))
4457			__vxlan_fdb_delete(vxlan, all_zeros_mac,
4458					   dst->remote_ip,
4459					   vxlan->cfg.dst_port,
4460					   dst->remote_vni,
4461					   dst->remote_vni,
4462					   dst->remote_ifindex,
4463					   true);
4464		spin_unlock_bh(&vxlan->hash_lock);
4465
4466		/* If vni filtering device, also update fdb entries of
4467		 * all vnis that were using default remote ip
4468		 */
4469		if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
4470			err = vxlan_vnilist_update_group(vxlan, &dst->remote_ip,
4471							 &conf.remote_ip, extack);
4472			if (err) {
4473				netdev_adjacent_change_abort(dst->remote_dev,
4474							     lowerdev, dev);
4475				return err;
4476			}
4477		}
4478	}
4479
4480	if (change_igmp && vxlan_addr_multicast(&dst->remote_ip))
4481		err = vxlan_multicast_leave(vxlan);
4482
4483	if (conf.age_interval != vxlan->cfg.age_interval)
4484		mod_timer(&vxlan->age_timer, jiffies);
4485
4486	netdev_adjacent_change_commit(dst->remote_dev, lowerdev, dev);
4487	if (lowerdev && lowerdev != dst->remote_dev)
4488		dst->remote_dev = lowerdev;
4489	vxlan_config_apply(dev, &conf, lowerdev, vxlan->net, true);
4490
4491	if (!err && change_igmp &&
4492	    vxlan_addr_multicast(&dst->remote_ip))
4493		err = vxlan_multicast_join(vxlan);
4494
4495	return err;
4496}
4497
4498static void vxlan_dellink(struct net_device *dev, struct list_head *head)
4499{
4500	struct vxlan_dev *vxlan = netdev_priv(dev);
4501	struct vxlan_fdb_flush_desc desc = {};
4502
4503	vxlan_flush(vxlan, &desc);
4504
4505	list_del(&vxlan->next);
4506	unregister_netdevice_queue(dev, head);
4507	if (vxlan->default_dst.remote_dev)
4508		netdev_upper_dev_unlink(vxlan->default_dst.remote_dev, dev);
4509}
4510
4511static size_t vxlan_get_size(const struct net_device *dev)
4512{
4513	return nla_total_size(sizeof(__u32)) +	/* IFLA_VXLAN_ID */
4514		nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_GROUP{6} */
4515		nla_total_size(sizeof(__u32)) +	/* IFLA_VXLAN_LINK */
4516		nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_LOCAL{6} */
4517		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_TTL */
4518		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_TTL_INHERIT */
4519		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_TOS */
4520		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_DF */
4521		nla_total_size(sizeof(__be32)) + /* IFLA_VXLAN_LABEL */
4522		nla_total_size(sizeof(__u32)) +  /* IFLA_VXLAN_LABEL_POLICY */
4523		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_LEARNING */
4524		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_PROXY */
4525		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_RSC */
4526		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_L2MISS */
4527		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_L3MISS */
4528		nla_total_size(sizeof(__u8)) +	/* IFLA_VXLAN_COLLECT_METADATA */
4529		nla_total_size(sizeof(__u32)) +	/* IFLA_VXLAN_AGEING */
4530		nla_total_size(sizeof(__u32)) +	/* IFLA_VXLAN_LIMIT */
4531		nla_total_size(sizeof(__be16)) + /* IFLA_VXLAN_PORT */
4532		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_CSUM */
4533		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_ZERO_CSUM6_TX */
4534		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_ZERO_CSUM6_RX */
4535		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_REMCSUM_TX */
4536		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_REMCSUM_RX */
4537		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_LOCALBYPASS */
4538		/* IFLA_VXLAN_PORT_RANGE */
4539		nla_total_size(sizeof(struct ifla_vxlan_port_range)) +
4540		nla_total_size(0) + /* IFLA_VXLAN_GBP */
4541		nla_total_size(0) + /* IFLA_VXLAN_GPE */
4542		nla_total_size(0) + /* IFLA_VXLAN_REMCSUM_NOPARTIAL */
4543		nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_VNIFILTER */
4544		/* IFLA_VXLAN_RESERVED_BITS */
4545		nla_total_size(sizeof(struct vxlanhdr)) +
4546		0;
4547}
4548
4549static int vxlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
4550{
4551	const struct vxlan_dev *vxlan = netdev_priv(dev);
4552	const struct vxlan_rdst *dst = &vxlan->default_dst;
4553	struct ifla_vxlan_port_range ports = {
4554		.low =  htons(vxlan->cfg.port_min),
4555		.high = htons(vxlan->cfg.port_max),
4556	};
4557
4558	if (nla_put_u32(skb, IFLA_VXLAN_ID, be32_to_cpu(dst->remote_vni)))
4559		goto nla_put_failure;
4560
4561	if (!vxlan_addr_any(&dst->remote_ip)) {
4562		if (dst->remote_ip.sa.sa_family == AF_INET) {
4563			if (nla_put_in_addr(skb, IFLA_VXLAN_GROUP,
4564					    dst->remote_ip.sin.sin_addr.s_addr))
4565				goto nla_put_failure;
4566#if IS_ENABLED(CONFIG_IPV6)
4567		} else {
4568			if (nla_put_in6_addr(skb, IFLA_VXLAN_GROUP6,
4569					     &dst->remote_ip.sin6.sin6_addr))
4570				goto nla_put_failure;
4571#endif
4572		}
4573	}
4574
4575	if (dst->remote_ifindex && nla_put_u32(skb, IFLA_VXLAN_LINK, dst->remote_ifindex))
4576		goto nla_put_failure;
4577
4578	if (!vxlan_addr_any(&vxlan->cfg.saddr)) {
4579		if (vxlan->cfg.saddr.sa.sa_family == AF_INET) {
4580			if (nla_put_in_addr(skb, IFLA_VXLAN_LOCAL,
4581					    vxlan->cfg.saddr.sin.sin_addr.s_addr))
4582				goto nla_put_failure;
4583#if IS_ENABLED(CONFIG_IPV6)
4584		} else {
4585			if (nla_put_in6_addr(skb, IFLA_VXLAN_LOCAL6,
4586					     &vxlan->cfg.saddr.sin6.sin6_addr))
4587				goto nla_put_failure;
4588#endif
4589		}
4590	}
4591
4592	if (nla_put_u8(skb, IFLA_VXLAN_TTL, vxlan->cfg.ttl) ||
4593	    nla_put_u8(skb, IFLA_VXLAN_TTL_INHERIT,
4594		       !!(vxlan->cfg.flags & VXLAN_F_TTL_INHERIT)) ||
4595	    nla_put_u8(skb, IFLA_VXLAN_TOS, vxlan->cfg.tos) ||
4596	    nla_put_u8(skb, IFLA_VXLAN_DF, vxlan->cfg.df) ||
4597	    nla_put_be32(skb, IFLA_VXLAN_LABEL, vxlan->cfg.label) ||
4598	    nla_put_u32(skb, IFLA_VXLAN_LABEL_POLICY, vxlan->cfg.label_policy) ||
4599	    nla_put_u8(skb, IFLA_VXLAN_LEARNING,
4600		       !!(vxlan->cfg.flags & VXLAN_F_LEARN)) ||
4601	    nla_put_u8(skb, IFLA_VXLAN_PROXY,
4602		       !!(vxlan->cfg.flags & VXLAN_F_PROXY)) ||
4603	    nla_put_u8(skb, IFLA_VXLAN_RSC,
4604		       !!(vxlan->cfg.flags & VXLAN_F_RSC)) ||
4605	    nla_put_u8(skb, IFLA_VXLAN_L2MISS,
4606		       !!(vxlan->cfg.flags & VXLAN_F_L2MISS)) ||
4607	    nla_put_u8(skb, IFLA_VXLAN_L3MISS,
4608		       !!(vxlan->cfg.flags & VXLAN_F_L3MISS)) ||
4609	    nla_put_u8(skb, IFLA_VXLAN_COLLECT_METADATA,
4610		       !!(vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA)) ||
4611	    nla_put_u32(skb, IFLA_VXLAN_AGEING, vxlan->cfg.age_interval) ||
4612	    nla_put_u32(skb, IFLA_VXLAN_LIMIT, vxlan->cfg.addrmax) ||
4613	    nla_put_be16(skb, IFLA_VXLAN_PORT, vxlan->cfg.dst_port) ||
4614	    nla_put_u8(skb, IFLA_VXLAN_UDP_CSUM,
4615		       !(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM_TX)) ||
4616	    nla_put_u8(skb, IFLA_VXLAN_UDP_ZERO_CSUM6_TX,
4617		       !!(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM6_TX)) ||
4618	    nla_put_u8(skb, IFLA_VXLAN_UDP_ZERO_CSUM6_RX,
4619		       !!(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM6_RX)) ||
4620	    nla_put_u8(skb, IFLA_VXLAN_REMCSUM_TX,
4621		       !!(vxlan->cfg.flags & VXLAN_F_REMCSUM_TX)) ||
4622	    nla_put_u8(skb, IFLA_VXLAN_REMCSUM_RX,
4623		       !!(vxlan->cfg.flags & VXLAN_F_REMCSUM_RX)) ||
4624	    nla_put_u8(skb, IFLA_VXLAN_LOCALBYPASS,
4625		       !!(vxlan->cfg.flags & VXLAN_F_LOCALBYPASS)))
4626		goto nla_put_failure;
4627
4628	if (nla_put(skb, IFLA_VXLAN_PORT_RANGE, sizeof(ports), &ports))
4629		goto nla_put_failure;
4630
4631	if (vxlan->cfg.flags & VXLAN_F_GBP &&
4632	    nla_put_flag(skb, IFLA_VXLAN_GBP))
4633		goto nla_put_failure;
4634
4635	if (vxlan->cfg.flags & VXLAN_F_GPE &&
4636	    nla_put_flag(skb, IFLA_VXLAN_GPE))
4637		goto nla_put_failure;
4638
4639	if (vxlan->cfg.flags & VXLAN_F_REMCSUM_NOPARTIAL &&
4640	    nla_put_flag(skb, IFLA_VXLAN_REMCSUM_NOPARTIAL))
4641		goto nla_put_failure;
4642
4643	if (vxlan->cfg.flags & VXLAN_F_VNIFILTER &&
4644	    nla_put_u8(skb, IFLA_VXLAN_VNIFILTER,
4645		       !!(vxlan->cfg.flags & VXLAN_F_VNIFILTER)))
4646		goto nla_put_failure;
4647
4648	if (nla_put(skb, IFLA_VXLAN_RESERVED_BITS,
4649		    sizeof(vxlan->cfg.reserved_bits),
4650		    &vxlan->cfg.reserved_bits))
4651		goto nla_put_failure;
4652
4653	return 0;
4654
4655nla_put_failure:
4656	return -EMSGSIZE;
4657}
4658
4659static struct net *vxlan_get_link_net(const struct net_device *dev)
4660{
4661	struct vxlan_dev *vxlan = netdev_priv(dev);
4662
4663	return READ_ONCE(vxlan->net);
4664}
4665
4666static struct rtnl_link_ops vxlan_link_ops __read_mostly = {
4667	.kind		= "vxlan",
4668	.maxtype	= IFLA_VXLAN_MAX,
4669	.policy		= vxlan_policy,
4670	.priv_size	= sizeof(struct vxlan_dev),
4671	.setup		= vxlan_setup,
4672	.validate	= vxlan_validate,
4673	.newlink	= vxlan_newlink,
4674	.changelink	= vxlan_changelink,
4675	.dellink	= vxlan_dellink,
4676	.get_size	= vxlan_get_size,
4677	.fill_info	= vxlan_fill_info,
4678	.get_link_net	= vxlan_get_link_net,
4679};
4680
4681struct net_device *vxlan_dev_create(struct net *net, const char *name,
4682				    u8 name_assign_type,
4683				    struct vxlan_config *conf)
4684{
4685	struct nlattr *tb[IFLA_MAX + 1];
4686	struct net_device *dev;
4687	int err;
4688
4689	memset(&tb, 0, sizeof(tb));
4690
4691	dev = rtnl_create_link(net, name, name_assign_type,
4692			       &vxlan_link_ops, tb, NULL);
4693	if (IS_ERR(dev))
4694		return dev;
4695
4696	err = __vxlan_dev_create(net, dev, conf, NULL);
4697	if (err < 0) {
4698		free_netdev(dev);
4699		return ERR_PTR(err);
4700	}
4701
4702	err = rtnl_configure_link(dev, NULL, 0, NULL);
4703	if (err < 0) {
4704		LIST_HEAD(list_kill);
4705
4706		vxlan_dellink(dev, &list_kill);
4707		unregister_netdevice_many(&list_kill);
4708		return ERR_PTR(err);
4709	}
4710
4711	return dev;
4712}
4713EXPORT_SYMBOL_GPL(vxlan_dev_create);
4714
4715static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn,
4716					     struct net_device *dev)
4717{
4718	struct vxlan_dev *vxlan, *next;
4719	LIST_HEAD(list_kill);
4720
4721	list_for_each_entry_safe(vxlan, next, &vn->vxlan_list, next) {
4722		struct vxlan_rdst *dst = &vxlan->default_dst;
4723
4724		/* In case we created vxlan device with carrier
4725		 * and we loose the carrier due to module unload
4726		 * we also need to remove vxlan device. In other
4727		 * cases, it's not necessary and remote_ifindex
4728		 * is 0 here, so no matches.
4729		 */
4730		if (dst->remote_ifindex == dev->ifindex)
4731			vxlan_dellink(vxlan->dev, &list_kill);
4732	}
4733
4734	unregister_netdevice_many(&list_kill);
4735}
4736
4737static int vxlan_netdevice_event(struct notifier_block *unused,
4738				 unsigned long event, void *ptr)
4739{
4740	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
4741	struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
4742
4743	if (event == NETDEV_UNREGISTER)
4744		vxlan_handle_lowerdev_unregister(vn, dev);
4745	else if (event == NETDEV_UDP_TUNNEL_PUSH_INFO)
4746		vxlan_offload_rx_ports(dev, true);
4747	else if (event == NETDEV_UDP_TUNNEL_DROP_INFO)
4748		vxlan_offload_rx_ports(dev, false);
4749
4750	return NOTIFY_DONE;
4751}
4752
4753static struct notifier_block vxlan_notifier_block __read_mostly = {
4754	.notifier_call = vxlan_netdevice_event,
4755};
4756
4757static void
4758vxlan_fdb_offloaded_set(struct net_device *dev,
4759			struct switchdev_notifier_vxlan_fdb_info *fdb_info)
4760{
4761	struct vxlan_dev *vxlan = netdev_priv(dev);
4762	struct vxlan_rdst *rdst;
4763	struct vxlan_fdb *f;
4764
4765	spin_lock_bh(&vxlan->hash_lock);
4766
4767	f = vxlan_find_mac(vxlan, fdb_info->eth_addr, fdb_info->vni);
4768	if (!f)
4769		goto out;
4770
4771	rdst = vxlan_fdb_find_rdst(f, &fdb_info->remote_ip,
4772				   fdb_info->remote_port,
4773				   fdb_info->remote_vni,
4774				   fdb_info->remote_ifindex);
4775	if (!rdst)
4776		goto out;
4777
4778	rdst->offloaded = fdb_info->offloaded;
4779
4780out:
4781	spin_unlock_bh(&vxlan->hash_lock);
4782}
4783
4784static int
4785vxlan_fdb_external_learn_add(struct net_device *dev,
4786			     struct switchdev_notifier_vxlan_fdb_info *fdb_info)
4787{
4788	struct vxlan_dev *vxlan = netdev_priv(dev);
4789	struct netlink_ext_ack *extack;
4790	int err;
4791
4792	extack = switchdev_notifier_info_to_extack(&fdb_info->info);
4793
4794	spin_lock_bh(&vxlan->hash_lock);
4795	err = vxlan_fdb_update(vxlan, fdb_info->eth_addr, &fdb_info->remote_ip,
4796			       NUD_REACHABLE,
4797			       NLM_F_CREATE | NLM_F_REPLACE,
4798			       fdb_info->remote_port,
4799			       fdb_info->vni,
4800			       fdb_info->remote_vni,
4801			       fdb_info->remote_ifindex,
4802			       NTF_USE | NTF_SELF | NTF_EXT_LEARNED,
4803			       0, false, extack);
4804	spin_unlock_bh(&vxlan->hash_lock);
4805
4806	return err;
4807}
4808
4809static int
4810vxlan_fdb_external_learn_del(struct net_device *dev,
4811			     struct switchdev_notifier_vxlan_fdb_info *fdb_info)
4812{
4813	struct vxlan_dev *vxlan = netdev_priv(dev);
4814	struct vxlan_fdb *f;
4815	int err = 0;
4816
4817	spin_lock_bh(&vxlan->hash_lock);
4818
4819	f = vxlan_find_mac(vxlan, fdb_info->eth_addr, fdb_info->vni);
4820	if (!f)
4821		err = -ENOENT;
4822	else if (f->flags & NTF_EXT_LEARNED)
4823		err = __vxlan_fdb_delete(vxlan, fdb_info->eth_addr,
4824					 fdb_info->remote_ip,
4825					 fdb_info->remote_port,
4826					 fdb_info->vni,
4827					 fdb_info->remote_vni,
4828					 fdb_info->remote_ifindex,
4829					 false);
4830
4831	spin_unlock_bh(&vxlan->hash_lock);
4832
4833	return err;
4834}
4835
4836static int vxlan_switchdev_event(struct notifier_block *unused,
4837				 unsigned long event, void *ptr)
4838{
4839	struct net_device *dev = switchdev_notifier_info_to_dev(ptr);
4840	struct switchdev_notifier_vxlan_fdb_info *fdb_info;
4841	int err = 0;
4842
4843	switch (event) {
4844	case SWITCHDEV_VXLAN_FDB_OFFLOADED:
4845		vxlan_fdb_offloaded_set(dev, ptr);
4846		break;
4847	case SWITCHDEV_VXLAN_FDB_ADD_TO_BRIDGE:
4848		fdb_info = ptr;
4849		err = vxlan_fdb_external_learn_add(dev, fdb_info);
4850		if (err) {
4851			err = notifier_from_errno(err);
4852			break;
4853		}
4854		fdb_info->offloaded = true;
4855		vxlan_fdb_offloaded_set(dev, fdb_info);
4856		break;
4857	case SWITCHDEV_VXLAN_FDB_DEL_TO_BRIDGE:
4858		fdb_info = ptr;
4859		err = vxlan_fdb_external_learn_del(dev, fdb_info);
4860		if (err) {
4861			err = notifier_from_errno(err);
4862			break;
4863		}
4864		fdb_info->offloaded = false;
4865		vxlan_fdb_offloaded_set(dev, fdb_info);
4866		break;
4867	}
4868
4869	return err;
4870}
4871
4872static struct notifier_block vxlan_switchdev_notifier_block __read_mostly = {
4873	.notifier_call = vxlan_switchdev_event,
4874};
4875
4876static void vxlan_fdb_nh_flush(struct nexthop *nh)
4877{
4878	struct vxlan_fdb *fdb;
4879	struct vxlan_dev *vxlan;
4880
4881	rcu_read_lock();
4882	list_for_each_entry_rcu(fdb, &nh->fdb_list, nh_list) {
4883		vxlan = rcu_dereference(fdb->vdev);
4884		WARN_ON(!vxlan);
4885		spin_lock_bh(&vxlan->hash_lock);
4886		if (!hlist_unhashed(&fdb->fdb_node))
4887			vxlan_fdb_destroy(vxlan, fdb, false, false);
4888		spin_unlock_bh(&vxlan->hash_lock);
4889	}
4890	rcu_read_unlock();
4891}
4892
4893static int vxlan_nexthop_event(struct notifier_block *nb,
4894			       unsigned long event, void *ptr)
4895{
4896	struct nh_notifier_info *info = ptr;
4897	struct nexthop *nh;
4898
4899	if (event != NEXTHOP_EVENT_DEL)
4900		return NOTIFY_DONE;
4901
4902	nh = nexthop_find_by_id(info->net, info->id);
4903	if (!nh)
4904		return NOTIFY_DONE;
4905
4906	vxlan_fdb_nh_flush(nh);
4907
4908	return NOTIFY_DONE;
4909}
4910
4911static __net_init int vxlan_init_net(struct net *net)
4912{
4913	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
4914	unsigned int h;
4915
4916	INIT_LIST_HEAD(&vn->vxlan_list);
4917	vn->nexthop_notifier_block.notifier_call = vxlan_nexthop_event;
4918
4919	for (h = 0; h < PORT_HASH_SIZE; ++h)
4920		INIT_HLIST_HEAD(&vn->sock_list[h]);
4921
4922	return register_nexthop_notifier(net, &vn->nexthop_notifier_block,
4923					 NULL);
4924}
4925
4926static void __net_exit vxlan_destroy_tunnels(struct vxlan_net *vn,
4927					     struct list_head *dev_to_kill)
4928{
4929	struct vxlan_dev *vxlan, *next;
4930
4931	list_for_each_entry_safe(vxlan, next, &vn->vxlan_list, next)
4932		vxlan_dellink(vxlan->dev, dev_to_kill);
4933}
4934
4935static void __net_exit vxlan_exit_rtnl(struct net *net,
4936				       struct list_head *dev_to_kill)
4937{
4938	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
4939
4940	ASSERT_RTNL_NET(net);
4941
4942	__unregister_nexthop_notifier(net, &vn->nexthop_notifier_block);
4943	vxlan_destroy_tunnels(vn, dev_to_kill);
4944}
4945
4946static void __net_exit vxlan_exit_net(struct net *net)
4947{
4948	struct vxlan_net *vn = net_generic(net, vxlan_net_id);
4949	unsigned int h;
4950
4951	for (h = 0; h < PORT_HASH_SIZE; ++h)
4952		WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
4953}
4954
4955static struct pernet_operations vxlan_net_ops = {
4956	.init = vxlan_init_net,
4957	.exit_rtnl = vxlan_exit_rtnl,
4958	.exit = vxlan_exit_net,
4959	.id   = &vxlan_net_id,
4960	.size = sizeof(struct vxlan_net),
4961};
4962
4963static int __init vxlan_init_module(void)
4964{
4965	int rc;
4966
4967	rc = register_pernet_subsys(&vxlan_net_ops);
4968	if (rc)
4969		goto out1;
4970
4971	rc = register_netdevice_notifier(&vxlan_notifier_block);
4972	if (rc)
4973		goto out2;
4974
4975	rc = register_switchdev_notifier(&vxlan_switchdev_notifier_block);
4976	if (rc)
4977		goto out3;
4978
4979	rc = rtnl_link_register(&vxlan_link_ops);
4980	if (rc)
4981		goto out4;
4982
4983	rc = vxlan_vnifilter_init();
4984	if (rc)
4985		goto out5;
4986
4987	return 0;
4988out5:
4989	rtnl_link_unregister(&vxlan_link_ops);
4990out4:
4991	unregister_switchdev_notifier(&vxlan_switchdev_notifier_block);
4992out3:
4993	unregister_netdevice_notifier(&vxlan_notifier_block);
4994out2:
4995	unregister_pernet_subsys(&vxlan_net_ops);
4996out1:
4997	return rc;
4998}
4999late_initcall(vxlan_init_module);
5000
5001static void __exit vxlan_cleanup_module(void)
5002{
5003	vxlan_vnifilter_uninit();
5004	rtnl_link_unregister(&vxlan_link_ops);
5005	unregister_switchdev_notifier(&vxlan_switchdev_notifier_block);
5006	unregister_netdevice_notifier(&vxlan_notifier_block);
5007	unregister_pernet_subsys(&vxlan_net_ops);
5008	/* rcu_barrier() is called by netns */
5009}
5010module_exit(vxlan_cleanup_module);
5011
5012MODULE_LICENSE("GPL");
5013MODULE_VERSION(VXLAN_VERSION);
5014MODULE_AUTHOR("Stephen Hemminger <stephen@networkplumber.org>");
5015MODULE_DESCRIPTION("Driver for VXLAN encapsulated traffic");
5016MODULE_ALIAS_RTNL_LINK("vxlan");