ip_tunnel_core.c

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2013 Nicira, Inc.
   4 */
   5
   6#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
   7
   8#include <linux/types.h>
   9#include <linux/kernel.h>
  10#include <linux/skbuff.h>
  11#include <linux/netdevice.h>
  12#include <linux/in.h>
  13#include <linux/if_arp.h>
  14#include <linux/init.h>
  15#include <linux/in6.h>
  16#include <linux/inetdevice.h>
  17#include <linux/netfilter_ipv4.h>
  18#include <linux/etherdevice.h>
  19#include <linux/if_ether.h>
  20#include <linux/if_vlan.h>
  21#include <linux/static_key.h>
  22
  23#include <net/ip.h>
  24#include <net/icmp.h>
  25#include <net/protocol.h>
  26#include <net/ip_tunnels.h>
  27#include <net/ip6_tunnel.h>
  28#include <net/ip6_checksum.h>
  29#include <net/arp.h>
  30#include <net/checksum.h>
  31#include <net/dsfield.h>
  32#include <net/inet_ecn.h>
  33#include <net/xfrm.h>
  34#include <net/net_namespace.h>
  35#include <net/netns/generic.h>
  36#include <net/rtnetlink.h>
  37#include <net/dst_metadata.h>
  38#include <net/geneve.h>
  39#include <net/vxlan.h>
  40#include <net/erspan.h>
  41
  42const struct ip_tunnel_encap_ops __rcu *
  43		iptun_encaps[MAX_IPTUN_ENCAP_OPS] __read_mostly;
  44EXPORT_SYMBOL(iptun_encaps);
  45
  46const struct ip6_tnl_encap_ops __rcu *
  47		ip6tun_encaps[MAX_IPTUN_ENCAP_OPS] __read_mostly;
  48EXPORT_SYMBOL(ip6tun_encaps);
  49
  50void iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
  51		   __be32 src, __be32 dst, __u8 proto,
  52		   __u8 tos, __u8 ttl, __be16 df, bool xnet,
  53		   u16 ipcb_flags)
  54{
  55	int pkt_len = skb->len - skb_inner_network_offset(skb);
  56	struct net *net = dev_net(rt->dst.dev);
  57	struct net_device *dev = skb->dev;
  58	struct iphdr *iph;
  59	int err;
  60
  61	if (unlikely(dev_recursion_level() > IP_TUNNEL_RECURSION_LIMIT)) {
  62		if (dev) {
  63			net_crit_ratelimited("Dead loop on virtual device %s, fix it urgently!\n",
  64					     dev->name);
  65			DEV_STATS_INC(dev, tx_errors);
  66		}
  67		ip_rt_put(rt);
  68		kfree_skb(skb);
  69		return;
  70	}
  71
  72	dev_xmit_recursion_inc();
  73
  74	skb_scrub_packet(skb, xnet);
  75
  76	skb_clear_hash_if_not_l4(skb);
  77	skb_dst_set(skb, &rt->dst);
  78	memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
  79	IPCB(skb)->flags = ipcb_flags;
  80
  81	/* Push down and install the IP header. */
  82	skb_push(skb, sizeof(struct iphdr));
  83	skb_reset_network_header(skb);
  84
  85	iph = ip_hdr(skb);
  86
  87	iph->version	=	4;
  88	iph->ihl	=	sizeof(struct iphdr) >> 2;
  89	iph->frag_off	=	ip_mtu_locked(&rt->dst) ? 0 : df;
  90	iph->protocol	=	proto;
  91	iph->tos	=	tos;
  92	iph->daddr	=	dst;
  93	iph->saddr	=	src;
  94	iph->ttl	=	ttl;
  95	__ip_select_ident(net, iph, skb_shinfo(skb)->gso_segs ?: 1);
  96
  97	err = ip_local_out(net, sk, skb);
  98
  99	if (dev) {
 100		if (unlikely(net_xmit_eval(err)))
 101			pkt_len = 0;
 102		iptunnel_xmit_stats(dev, pkt_len);
 103	}
 104
 105	dev_xmit_recursion_dec();
 106}
 107EXPORT_SYMBOL_GPL(iptunnel_xmit);
 108
 109int __iptunnel_pull_header(struct sk_buff *skb, int hdr_len,
 110			   __be16 inner_proto, bool raw_proto, bool xnet)
 111{
 112	if (unlikely(!pskb_may_pull(skb, hdr_len)))
 113		return -ENOMEM;
 114
 115	skb_pull_rcsum(skb, hdr_len);
 116
 117	if (!raw_proto && inner_proto == htons(ETH_P_TEB)) {
 118		struct ethhdr *eh;
 119
 120		if (unlikely(!pskb_may_pull(skb, ETH_HLEN)))
 121			return -ENOMEM;
 122
 123		eh = (struct ethhdr *)skb->data;
 124		if (likely(eth_proto_is_802_3(eh->h_proto)))
 125			skb->protocol = eh->h_proto;
 126		else
 127			skb->protocol = htons(ETH_P_802_2);
 128
 129	} else {
 130		skb->protocol = inner_proto;
 131	}
 132
 133	skb_clear_hash_if_not_l4(skb);
 134	__vlan_hwaccel_clear_tag(skb);
 135	skb_set_queue_mapping(skb, 0);
 136	skb_scrub_packet(skb, xnet);
 137
 138	return iptunnel_pull_offloads(skb);
 139}
 140EXPORT_SYMBOL_GPL(__iptunnel_pull_header);
 141
 142struct metadata_dst *iptunnel_metadata_reply(struct metadata_dst *md,
 143					     gfp_t flags)
 144{
 145	IP_TUNNEL_DECLARE_FLAGS(tun_flags) = { };
 146	struct metadata_dst *res;
 147	struct ip_tunnel_info *dst, *src;
 148
 149	if (!md || md->type != METADATA_IP_TUNNEL ||
 150	    md->u.tun_info.mode & IP_TUNNEL_INFO_TX)
 151		return NULL;
 152
 153	src = &md->u.tun_info;
 154	res = metadata_dst_alloc(src->options_len, METADATA_IP_TUNNEL, flags);
 155	if (!res)
 156		return NULL;
 157
 158	dst = &res->u.tun_info;
 159	dst->key.tun_id = src->key.tun_id;
 160	if (src->mode & IP_TUNNEL_INFO_IPV6)
 161		memcpy(&dst->key.u.ipv6.dst, &src->key.u.ipv6.src,
 162		       sizeof(struct in6_addr));
 163	else
 164		dst->key.u.ipv4.dst = src->key.u.ipv4.src;
 165	ip_tunnel_flags_copy(dst->key.tun_flags, src->key.tun_flags);
 166	dst->mode = src->mode | IP_TUNNEL_INFO_TX;
 167	ip_tunnel_info_opts_set(dst, ip_tunnel_info_opts(src),
 168				src->options_len, tun_flags);
 169
 170	return res;
 171}
 172EXPORT_SYMBOL_GPL(iptunnel_metadata_reply);
 173
 174int iptunnel_handle_offloads(struct sk_buff *skb,
 175			     int gso_type_mask)
 176{
 177	int err;
 178
 179	if (likely(!skb->encapsulation)) {
 180		skb_reset_inner_headers(skb);
 181		skb->encapsulation = 1;
 182	}
 183
 184	if (skb_is_gso(skb)) {
 185		err = skb_header_unclone(skb, GFP_ATOMIC);
 186		if (unlikely(err))
 187			return err;
 188		skb_shinfo(skb)->gso_type |= gso_type_mask;
 189		return 0;
 190	}
 191
 192	if (skb->ip_summed != CHECKSUM_PARTIAL) {
 193		skb->ip_summed = CHECKSUM_NONE;
 194		/* We clear encapsulation here to prevent badly-written
 195		 * drivers potentially deciding to offload an inner checksum
 196		 * if we set CHECKSUM_PARTIAL on the outer header.
 197		 * This should go away when the drivers are all fixed.
 198		 */
 199		skb->encapsulation = 0;
 200	}
 201
 202	return 0;
 203}
 204EXPORT_SYMBOL_GPL(iptunnel_handle_offloads);
 205
 206/**
 207 * iptunnel_pmtud_build_icmp() - Build ICMP error message for PMTUD
 208 * @skb:	Original packet with L2 header
 209 * @mtu:	MTU value for ICMP error
 210 *
 211 * Return: length on success, negative error code if message couldn't be built.
 212 */
 213static int iptunnel_pmtud_build_icmp(struct sk_buff *skb, int mtu)
 214{
 215	const struct iphdr *iph = ip_hdr(skb);
 216	struct icmphdr *icmph;
 217	struct iphdr *niph;
 218	struct ethhdr eh;
 219	int len, err;
 220
 221	if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))
 222		return -EINVAL;
 223
 224	if (skb_is_gso(skb))
 225		skb_gso_reset(skb);
 226
 227	skb_copy_bits(skb, skb_mac_offset(skb), &eh, ETH_HLEN);
 228	pskb_pull(skb, ETH_HLEN);
 229	skb_reset_network_header(skb);
 230
 231	err = pskb_trim(skb, 576 - sizeof(*niph) - sizeof(*icmph));
 232	if (err)
 233		return err;
 234
 235	len = skb->len + sizeof(*icmph);
 236	err = skb_cow(skb, sizeof(*niph) + sizeof(*icmph) + ETH_HLEN);
 237	if (err)
 238		return err;
 239
 240	icmph = skb_push(skb, sizeof(*icmph));
 241	*icmph = (struct icmphdr) {
 242		.type			= ICMP_DEST_UNREACH,
 243		.code			= ICMP_FRAG_NEEDED,
 244		.checksum		= 0,
 245		.un.frag.__unused	= 0,
 246		.un.frag.mtu		= htons(mtu),
 247	};
 248	icmph->checksum = csum_fold(skb_checksum(skb, 0, len, 0));
 249	skb_reset_transport_header(skb);
 250
 251	niph = skb_push(skb, sizeof(*niph));
 252	*niph = (struct iphdr) {
 253		.ihl			= sizeof(*niph) / 4u,
 254		.version 		= 4,
 255		.tos 			= 0,
 256		.tot_len		= htons(len + sizeof(*niph)),
 257		.id			= 0,
 258		.frag_off		= htons(IP_DF),
 259		.ttl			= iph->ttl,
 260		.protocol		= IPPROTO_ICMP,
 261		.saddr			= iph->daddr,
 262		.daddr			= iph->saddr,
 263	};
 264	ip_send_check(niph);
 265	skb_reset_network_header(skb);
 266
 267	skb->ip_summed = CHECKSUM_NONE;
 268
 269	eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0);
 270	skb_reset_mac_header(skb);
 271
 272	return skb->len;
 273}
 274
 275/**
 276 * iptunnel_pmtud_check_icmp() - Trigger ICMP reply if needed and allowed
 277 * @skb:	Buffer being sent by encapsulation, L2 headers expected
 278 * @mtu:	Network MTU for path
 279 *
 280 * Return: 0 for no ICMP reply, length if built, negative value on error.
 281 */
 282static int iptunnel_pmtud_check_icmp(struct sk_buff *skb, int mtu)
 283{
 284	const struct icmphdr *icmph = icmp_hdr(skb);
 285	const struct iphdr *iph = ip_hdr(skb);
 286
 287	if (mtu < 576 || iph->frag_off != htons(IP_DF))
 288		return 0;
 289
 290	if (ipv4_is_lbcast(iph->daddr)  || ipv4_is_multicast(iph->daddr) ||
 291	    ipv4_is_zeronet(iph->saddr) || ipv4_is_loopback(iph->saddr)  ||
 292	    ipv4_is_lbcast(iph->saddr)  || ipv4_is_multicast(iph->saddr))
 293		return 0;
 294
 295	if (iph->protocol == IPPROTO_ICMP && icmp_is_err(icmph->type))
 296		return 0;
 297
 298	return iptunnel_pmtud_build_icmp(skb, mtu);
 299}
 300
 301#if IS_ENABLED(CONFIG_IPV6)
 302/**
 303 * iptunnel_pmtud_build_icmpv6() - Build ICMPv6 error message for PMTUD
 304 * @skb:	Original packet with L2 header
 305 * @mtu:	MTU value for ICMPv6 error
 306 *
 307 * Return: length on success, negative error code if message couldn't be built.
 308 */
 309static int iptunnel_pmtud_build_icmpv6(struct sk_buff *skb, int mtu)
 310{
 311	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 312	struct icmp6hdr *icmp6h;
 313	struct ipv6hdr *nip6h;
 314	struct ethhdr eh;
 315	int len, err;
 316	__wsum csum;
 317
 318	if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr)))
 319		return -EINVAL;
 320
 321	if (skb_is_gso(skb))
 322		skb_gso_reset(skb);
 323
 324	skb_copy_bits(skb, skb_mac_offset(skb), &eh, ETH_HLEN);
 325	pskb_pull(skb, ETH_HLEN);
 326	skb_reset_network_header(skb);
 327
 328	err = pskb_trim(skb, IPV6_MIN_MTU - sizeof(*nip6h) - sizeof(*icmp6h));
 329	if (err)
 330		return err;
 331
 332	len = skb->len + sizeof(*icmp6h);
 333	err = skb_cow(skb, sizeof(*nip6h) + sizeof(*icmp6h) + ETH_HLEN);
 334	if (err)
 335		return err;
 336
 337	icmp6h = skb_push(skb, sizeof(*icmp6h));
 338	*icmp6h = (struct icmp6hdr) {
 339		.icmp6_type		= ICMPV6_PKT_TOOBIG,
 340		.icmp6_code		= 0,
 341		.icmp6_cksum		= 0,
 342		.icmp6_mtu		= htonl(mtu),
 343	};
 344	skb_reset_transport_header(skb);
 345
 346	nip6h = skb_push(skb, sizeof(*nip6h));
 347	*nip6h = (struct ipv6hdr) {
 348		.priority		= 0,
 349		.version		= 6,
 350		.flow_lbl		= { 0 },
 351		.payload_len		= htons(len),
 352		.nexthdr		= IPPROTO_ICMPV6,
 353		.hop_limit		= ip6h->hop_limit,
 354		.saddr			= ip6h->daddr,
 355		.daddr			= ip6h->saddr,
 356	};
 357	skb_reset_network_header(skb);
 358
 359	csum = skb_checksum(skb, skb_transport_offset(skb), len, 0);
 360	icmp6h->icmp6_cksum = csum_ipv6_magic(&nip6h->saddr, &nip6h->daddr, len,
 361					      IPPROTO_ICMPV6, csum);
 362
 363	skb->ip_summed = CHECKSUM_NONE;
 364
 365	eth_header(skb, skb->dev, ntohs(eh.h_proto), eh.h_source, eh.h_dest, 0);
 366	skb_reset_mac_header(skb);
 367
 368	return skb->len;
 369}
 370
 371/**
 372 * iptunnel_pmtud_check_icmpv6() - Trigger ICMPv6 reply if needed and allowed
 373 * @skb:	Buffer being sent by encapsulation, L2 headers expected
 374 * @mtu:	Network MTU for path
 375 *
 376 * Return: 0 for no ICMPv6 reply, length if built, negative value on error.
 377 */
 378static int iptunnel_pmtud_check_icmpv6(struct sk_buff *skb, int mtu)
 379{
 380	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
 381	int stype = ipv6_addr_type(&ip6h->saddr);
 382	u8 proto = ip6h->nexthdr;
 383	__be16 frag_off;
 384	int offset;
 385
 386	if (mtu < IPV6_MIN_MTU)
 387		return 0;
 388
 389	if (stype == IPV6_ADDR_ANY || stype == IPV6_ADDR_MULTICAST ||
 390	    stype == IPV6_ADDR_LOOPBACK)
 391		return 0;
 392
 393	offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &proto,
 394				  &frag_off);
 395	if (offset < 0 || (frag_off & htons(~0x7)))
 396		return 0;
 397
 398	if (proto == IPPROTO_ICMPV6) {
 399		struct icmp6hdr *icmp6h;
 400
 401		if (!pskb_may_pull(skb, skb_network_header(skb) +
 402					offset + 1 - skb->data))
 403			return 0;
 404
 405		icmp6h = (struct icmp6hdr *)(skb_network_header(skb) + offset);
 406		if (icmpv6_is_err(icmp6h->icmp6_type) ||
 407		    icmp6h->icmp6_type == NDISC_REDIRECT)
 408			return 0;
 409	}
 410
 411	return iptunnel_pmtud_build_icmpv6(skb, mtu);
 412}
 413#endif /* IS_ENABLED(CONFIG_IPV6) */
 414
 415/**
 416 * skb_tunnel_check_pmtu() - Check, update PMTU and trigger ICMP reply as needed
 417 * @skb:	Buffer being sent by encapsulation, L2 headers expected
 418 * @encap_dst:	Destination for tunnel encapsulation (outer IP)
 419 * @headroom:	Encapsulation header size, bytes
 420 * @reply:	Build matching ICMP or ICMPv6 message as a result
 421 *
 422 * L2 tunnel implementations that can carry IP and can be directly bridged
 423 * (currently UDP tunnels) can't always rely on IP forwarding paths to handle
 424 * PMTU discovery. In the bridged case, ICMP or ICMPv6 messages need to be built
 425 * based on payload and sent back by the encapsulation itself.
 426 *
 427 * For routable interfaces, we just need to update the PMTU for the destination.
 428 *
 429 * Return: 0 if ICMP error not needed, length if built, negative value on error
 430 */
 431int skb_tunnel_check_pmtu(struct sk_buff *skb, struct dst_entry *encap_dst,
 432			  int headroom, bool reply)
 433{
 434	u32 mtu = dst_mtu(encap_dst) - headroom;
 435
 436	if ((skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu)) ||
 437	    (!skb_is_gso(skb) && (skb->len - skb_network_offset(skb)) <= mtu))
 438		return 0;
 439
 440	skb_dst_update_pmtu_no_confirm(skb, mtu);
 441
 442	if (!reply)
 443		return 0;
 444
 445	if (skb->protocol == htons(ETH_P_IP))
 446		return iptunnel_pmtud_check_icmp(skb, mtu);
 447
 448#if IS_ENABLED(CONFIG_IPV6)
 449	if (skb->protocol == htons(ETH_P_IPV6))
 450		return iptunnel_pmtud_check_icmpv6(skb, mtu);
 451#endif
 452	return 0;
 453}
 454EXPORT_SYMBOL(skb_tunnel_check_pmtu);
 455
 456static const struct nla_policy ip_tun_policy[LWTUNNEL_IP_MAX + 1] = {
 457	[LWTUNNEL_IP_UNSPEC]	= { .strict_start_type = LWTUNNEL_IP_OPTS },
 458	[LWTUNNEL_IP_ID]	= { .type = NLA_U64 },
 459	[LWTUNNEL_IP_DST]	= { .type = NLA_U32 },
 460	[LWTUNNEL_IP_SRC]	= { .type = NLA_U32 },
 461	[LWTUNNEL_IP_TTL]	= { .type = NLA_U8 },
 462	[LWTUNNEL_IP_TOS]	= { .type = NLA_U8 },
 463	[LWTUNNEL_IP_FLAGS]	= { .type = NLA_U16 },
 464	[LWTUNNEL_IP_OPTS]	= { .type = NLA_NESTED },
 465};
 466
 467static const struct nla_policy ip_opts_policy[LWTUNNEL_IP_OPTS_MAX + 1] = {
 468	[LWTUNNEL_IP_OPTS_GENEVE]	= { .type = NLA_NESTED },
 469	[LWTUNNEL_IP_OPTS_VXLAN]	= { .type = NLA_NESTED },
 470	[LWTUNNEL_IP_OPTS_ERSPAN]	= { .type = NLA_NESTED },
 471};
 472
 473static const struct nla_policy
 474geneve_opt_policy[LWTUNNEL_IP_OPT_GENEVE_MAX + 1] = {
 475	[LWTUNNEL_IP_OPT_GENEVE_CLASS]	= { .type = NLA_U16 },
 476	[LWTUNNEL_IP_OPT_GENEVE_TYPE]	= { .type = NLA_U8 },
 477	[LWTUNNEL_IP_OPT_GENEVE_DATA]	= { .type = NLA_BINARY, .len = 127 },
 478};
 479
 480static const struct nla_policy
 481vxlan_opt_policy[LWTUNNEL_IP_OPT_VXLAN_MAX + 1] = {
 482	[LWTUNNEL_IP_OPT_VXLAN_GBP]	= { .type = NLA_U32 },
 483};
 484
 485static const struct nla_policy
 486erspan_opt_policy[LWTUNNEL_IP_OPT_ERSPAN_MAX + 1] = {
 487	[LWTUNNEL_IP_OPT_ERSPAN_VER]	= { .type = NLA_U8 },
 488	[LWTUNNEL_IP_OPT_ERSPAN_INDEX]	= { .type = NLA_U32 },
 489	[LWTUNNEL_IP_OPT_ERSPAN_DIR]	= { .type = NLA_U8 },
 490	[LWTUNNEL_IP_OPT_ERSPAN_HWID]	= { .type = NLA_U8 },
 491};
 492
 493static int ip_tun_parse_opts_geneve(struct nlattr *attr,
 494				    struct ip_tunnel_info *info, int opts_len,
 495				    struct netlink_ext_ack *extack)
 496{
 497	struct nlattr *tb[LWTUNNEL_IP_OPT_GENEVE_MAX + 1];
 498	int data_len, err;
 499
 500	err = nla_parse_nested(tb, LWTUNNEL_IP_OPT_GENEVE_MAX, attr,
 501			       geneve_opt_policy, extack);
 502	if (err)
 503		return err;
 504
 505	if (!tb[LWTUNNEL_IP_OPT_GENEVE_CLASS] ||
 506	    !tb[LWTUNNEL_IP_OPT_GENEVE_TYPE] ||
 507	    !tb[LWTUNNEL_IP_OPT_GENEVE_DATA])
 508		return -EINVAL;
 509
 510	attr = tb[LWTUNNEL_IP_OPT_GENEVE_DATA];
 511	data_len = nla_len(attr);
 512	if (data_len % 4)
 513		return -EINVAL;
 514
 515	if (info) {
 516		struct geneve_opt *opt = ip_tunnel_info_opts(info) + opts_len;
 517
 518		memcpy(opt->opt_data, nla_data(attr), data_len);
 519		opt->length = data_len / 4;
 520		attr = tb[LWTUNNEL_IP_OPT_GENEVE_CLASS];
 521		opt->opt_class = nla_get_be16(attr);
 522		attr = tb[LWTUNNEL_IP_OPT_GENEVE_TYPE];
 523		opt->type = nla_get_u8(attr);
 524		__set_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags);
 525	}
 526
 527	return sizeof(struct geneve_opt) + data_len;
 528}
 529
 530static int ip_tun_parse_opts_vxlan(struct nlattr *attr,
 531				   struct ip_tunnel_info *info, int opts_len,
 532				   struct netlink_ext_ack *extack)
 533{
 534	struct nlattr *tb[LWTUNNEL_IP_OPT_VXLAN_MAX + 1];
 535	int err;
 536
 537	err = nla_parse_nested(tb, LWTUNNEL_IP_OPT_VXLAN_MAX, attr,
 538			       vxlan_opt_policy, extack);
 539	if (err)
 540		return err;
 541
 542	if (!tb[LWTUNNEL_IP_OPT_VXLAN_GBP])
 543		return -EINVAL;
 544
 545	if (info) {
 546		struct vxlan_metadata *md =
 547			ip_tunnel_info_opts(info) + opts_len;
 548
 549		attr = tb[LWTUNNEL_IP_OPT_VXLAN_GBP];
 550		md->gbp = nla_get_u32(attr);
 551		md->gbp &= VXLAN_GBP_MASK;
 552		__set_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags);
 553	}
 554
 555	return sizeof(struct vxlan_metadata);
 556}
 557
 558static int ip_tun_parse_opts_erspan(struct nlattr *attr,
 559				    struct ip_tunnel_info *info, int opts_len,
 560				    struct netlink_ext_ack *extack)
 561{
 562	struct nlattr *tb[LWTUNNEL_IP_OPT_ERSPAN_MAX + 1];
 563	int err;
 564	u8 ver;
 565
 566	err = nla_parse_nested(tb, LWTUNNEL_IP_OPT_ERSPAN_MAX, attr,
 567			       erspan_opt_policy, extack);
 568	if (err)
 569		return err;
 570
 571	if (!tb[LWTUNNEL_IP_OPT_ERSPAN_VER])
 572		return -EINVAL;
 573
 574	ver = nla_get_u8(tb[LWTUNNEL_IP_OPT_ERSPAN_VER]);
 575	if (ver == 1) {
 576		if (!tb[LWTUNNEL_IP_OPT_ERSPAN_INDEX])
 577			return -EINVAL;
 578	} else if (ver == 2) {
 579		if (!tb[LWTUNNEL_IP_OPT_ERSPAN_DIR] ||
 580		    !tb[LWTUNNEL_IP_OPT_ERSPAN_HWID])
 581			return -EINVAL;
 582	} else {
 583		return -EINVAL;
 584	}
 585
 586	if (info) {
 587		struct erspan_metadata *md =
 588			ip_tunnel_info_opts(info) + opts_len;
 589
 590		md->version = ver;
 591		if (ver == 1) {
 592			attr = tb[LWTUNNEL_IP_OPT_ERSPAN_INDEX];
 593			md->u.index = nla_get_be32(attr);
 594		} else {
 595			attr = tb[LWTUNNEL_IP_OPT_ERSPAN_DIR];
 596			md->u.md2.dir = nla_get_u8(attr);
 597			attr = tb[LWTUNNEL_IP_OPT_ERSPAN_HWID];
 598			set_hwid(&md->u.md2, nla_get_u8(attr));
 599		}
 600
 601		__set_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags);
 602	}
 603
 604	return sizeof(struct erspan_metadata);
 605}
 606
 607static int ip_tun_parse_opts(struct nlattr *attr, struct ip_tunnel_info *info,
 608			     struct netlink_ext_ack *extack)
 609{
 610	int err, rem, opt_len, opts_len = 0;
 611	struct nlattr *nla;
 612	u32 type = 0;
 613
 614	if (!attr)
 615		return 0;
 616
 617	err = nla_validate(nla_data(attr), nla_len(attr), LWTUNNEL_IP_OPTS_MAX,
 618			   ip_opts_policy, extack);
 619	if (err)
 620		return err;
 621
 622	nla_for_each_attr(nla, nla_data(attr), nla_len(attr), rem) {
 623		switch (nla_type(nla)) {
 624		case LWTUNNEL_IP_OPTS_GENEVE:
 625			if (type && type != IP_TUNNEL_GENEVE_OPT_BIT)
 626				return -EINVAL;
 627			opt_len = ip_tun_parse_opts_geneve(nla, info, opts_len,
 628							   extack);
 629			if (opt_len < 0)
 630				return opt_len;
 631			opts_len += opt_len;
 632			if (opts_len > IP_TUNNEL_OPTS_MAX)
 633				return -EINVAL;
 634			type = IP_TUNNEL_GENEVE_OPT_BIT;
 635			break;
 636		case LWTUNNEL_IP_OPTS_VXLAN:
 637			if (type)
 638				return -EINVAL;
 639			opt_len = ip_tun_parse_opts_vxlan(nla, info, opts_len,
 640							  extack);
 641			if (opt_len < 0)
 642				return opt_len;
 643			opts_len += opt_len;
 644			type = IP_TUNNEL_VXLAN_OPT_BIT;
 645			break;
 646		case LWTUNNEL_IP_OPTS_ERSPAN:
 647			if (type)
 648				return -EINVAL;
 649			opt_len = ip_tun_parse_opts_erspan(nla, info, opts_len,
 650							   extack);
 651			if (opt_len < 0)
 652				return opt_len;
 653			opts_len += opt_len;
 654			type = IP_TUNNEL_ERSPAN_OPT_BIT;
 655			break;
 656		default:
 657			return -EINVAL;
 658		}
 659	}
 660
 661	return opts_len;
 662}
 663
 664static int ip_tun_get_optlen(struct nlattr *attr,
 665			     struct netlink_ext_ack *extack)
 666{
 667	return ip_tun_parse_opts(attr, NULL, extack);
 668}
 669
 670static int ip_tun_set_opts(struct nlattr *attr, struct ip_tunnel_info *info,
 671			   struct netlink_ext_ack *extack)
 672{
 673	return ip_tun_parse_opts(attr, info, extack);
 674}
 675
 676static int ip_tun_build_state(struct net *net, struct nlattr *attr,
 677			      unsigned int family, const void *cfg,
 678			      struct lwtunnel_state **ts,
 679			      struct netlink_ext_ack *extack)
 680{
 681	struct nlattr *tb[LWTUNNEL_IP_MAX + 1];
 682	struct lwtunnel_state *new_state;
 683	struct ip_tunnel_info *tun_info;
 684	int err, opt_len;
 685
 686	err = nla_parse_nested_deprecated(tb, LWTUNNEL_IP_MAX, attr,
 687					  ip_tun_policy, extack);
 688	if (err < 0)
 689		return err;
 690
 691	opt_len = ip_tun_get_optlen(tb[LWTUNNEL_IP_OPTS], extack);
 692	if (opt_len < 0)
 693		return opt_len;
 694
 695	new_state = lwtunnel_state_alloc(sizeof(*tun_info) + opt_len);
 696	if (!new_state)
 697		return -ENOMEM;
 698
 699	new_state->type = LWTUNNEL_ENCAP_IP;
 700
 701	tun_info = lwt_tun_info(new_state);
 702
 703	err = ip_tun_set_opts(tb[LWTUNNEL_IP_OPTS], tun_info, extack);
 704	if (err < 0) {
 705		lwtstate_free(new_state);
 706		return err;
 707	}
 708
 709#ifdef CONFIG_DST_CACHE
 710	err = dst_cache_init(&tun_info->dst_cache, GFP_KERNEL);
 711	if (err) {
 712		lwtstate_free(new_state);
 713		return err;
 714	}
 715#endif
 716
 717	if (tb[LWTUNNEL_IP_ID])
 718		tun_info->key.tun_id = nla_get_be64(tb[LWTUNNEL_IP_ID]);
 719
 720	if (tb[LWTUNNEL_IP_DST])
 721		tun_info->key.u.ipv4.dst = nla_get_in_addr(tb[LWTUNNEL_IP_DST]);
 722
 723	if (tb[LWTUNNEL_IP_SRC])
 724		tun_info->key.u.ipv4.src = nla_get_in_addr(tb[LWTUNNEL_IP_SRC]);
 725
 726	if (tb[LWTUNNEL_IP_TTL])
 727		tun_info->key.ttl = nla_get_u8(tb[LWTUNNEL_IP_TTL]);
 728
 729	if (tb[LWTUNNEL_IP_TOS])
 730		tun_info->key.tos = nla_get_u8(tb[LWTUNNEL_IP_TOS]);
 731
 732	if (tb[LWTUNNEL_IP_FLAGS]) {
 733		IP_TUNNEL_DECLARE_FLAGS(flags);
 734
 735		ip_tunnel_flags_from_be16(flags,
 736					  nla_get_be16(tb[LWTUNNEL_IP_FLAGS]));
 737		ip_tunnel_clear_options_present(flags);
 738
 739		ip_tunnel_flags_or(tun_info->key.tun_flags,
 740				   tun_info->key.tun_flags, flags);
 741	}
 742
 743	tun_info->mode = IP_TUNNEL_INFO_TX;
 744	tun_info->options_len = opt_len;
 745
 746	*ts = new_state;
 747
 748	return 0;
 749}
 750
 751static void ip_tun_destroy_state(struct lwtunnel_state *lwtstate)
 752{
 753#ifdef CONFIG_DST_CACHE
 754	struct ip_tunnel_info *tun_info = lwt_tun_info(lwtstate);
 755
 756	dst_cache_destroy(&tun_info->dst_cache);
 757#endif
 758}
 759
 760static int ip_tun_fill_encap_opts_geneve(struct sk_buff *skb,
 761					 struct ip_tunnel_info *tun_info)
 762{
 763	struct geneve_opt *opt;
 764	struct nlattr *nest;
 765	int offset = 0;
 766
 767	nest = nla_nest_start_noflag(skb, LWTUNNEL_IP_OPTS_GENEVE);
 768	if (!nest)
 769		return -ENOMEM;
 770
 771	while (tun_info->options_len > offset) {
 772		opt = ip_tunnel_info_opts(tun_info) + offset;
 773		if (nla_put_be16(skb, LWTUNNEL_IP_OPT_GENEVE_CLASS,
 774				 opt->opt_class) ||
 775		    nla_put_u8(skb, LWTUNNEL_IP_OPT_GENEVE_TYPE, opt->type) ||
 776		    nla_put(skb, LWTUNNEL_IP_OPT_GENEVE_DATA, opt->length * 4,
 777			    opt->opt_data)) {
 778			nla_nest_cancel(skb, nest);
 779			return -ENOMEM;
 780		}
 781		offset += sizeof(*opt) + opt->length * 4;
 782	}
 783
 784	nla_nest_end(skb, nest);
 785	return 0;
 786}
 787
 788static int ip_tun_fill_encap_opts_vxlan(struct sk_buff *skb,
 789					struct ip_tunnel_info *tun_info)
 790{
 791	struct vxlan_metadata *md;
 792	struct nlattr *nest;
 793
 794	nest = nla_nest_start_noflag(skb, LWTUNNEL_IP_OPTS_VXLAN);
 795	if (!nest)
 796		return -ENOMEM;
 797
 798	md = ip_tunnel_info_opts(tun_info);
 799	if (nla_put_u32(skb, LWTUNNEL_IP_OPT_VXLAN_GBP, md->gbp)) {
 800		nla_nest_cancel(skb, nest);
 801		return -ENOMEM;
 802	}
 803
 804	nla_nest_end(skb, nest);
 805	return 0;
 806}
 807
 808static int ip_tun_fill_encap_opts_erspan(struct sk_buff *skb,
 809					 struct ip_tunnel_info *tun_info)
 810{
 811	struct erspan_metadata *md;
 812	struct nlattr *nest;
 813
 814	nest = nla_nest_start_noflag(skb, LWTUNNEL_IP_OPTS_ERSPAN);
 815	if (!nest)
 816		return -ENOMEM;
 817
 818	md = ip_tunnel_info_opts(tun_info);
 819	if (nla_put_u8(skb, LWTUNNEL_IP_OPT_ERSPAN_VER, md->version))
 820		goto err;
 821
 822	if (md->version == 1 &&
 823	    nla_put_be32(skb, LWTUNNEL_IP_OPT_ERSPAN_INDEX, md->u.index))
 824		goto err;
 825
 826	if (md->version == 2 &&
 827	    (nla_put_u8(skb, LWTUNNEL_IP_OPT_ERSPAN_DIR, md->u.md2.dir) ||
 828	     nla_put_u8(skb, LWTUNNEL_IP_OPT_ERSPAN_HWID,
 829			get_hwid(&md->u.md2))))
 830		goto err;
 831
 832	nla_nest_end(skb, nest);
 833	return 0;
 834err:
 835	nla_nest_cancel(skb, nest);
 836	return -ENOMEM;
 837}
 838
 839static int ip_tun_fill_encap_opts(struct sk_buff *skb, int type,
 840				  struct ip_tunnel_info *tun_info)
 841{
 842	struct nlattr *nest;
 843	int err = 0;
 844
 845	if (!ip_tunnel_is_options_present(tun_info->key.tun_flags))
 846		return 0;
 847
 848	nest = nla_nest_start_noflag(skb, type);
 849	if (!nest)
 850		return -ENOMEM;
 851
 852	if (test_bit(IP_TUNNEL_GENEVE_OPT_BIT, tun_info->key.tun_flags))
 853		err = ip_tun_fill_encap_opts_geneve(skb, tun_info);
 854	else if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, tun_info->key.tun_flags))
 855		err = ip_tun_fill_encap_opts_vxlan(skb, tun_info);
 856	else if (test_bit(IP_TUNNEL_ERSPAN_OPT_BIT, tun_info->key.tun_flags))
 857		err = ip_tun_fill_encap_opts_erspan(skb, tun_info);
 858
 859	if (err) {
 860		nla_nest_cancel(skb, nest);
 861		return err;
 862	}
 863
 864	nla_nest_end(skb, nest);
 865	return 0;
 866}
 867
 868static int ip_tun_fill_encap_info(struct sk_buff *skb,
 869				  struct lwtunnel_state *lwtstate)
 870{
 871	struct ip_tunnel_info *tun_info = lwt_tun_info(lwtstate);
 872
 873	if (nla_put_be64(skb, LWTUNNEL_IP_ID, tun_info->key.tun_id,
 874			 LWTUNNEL_IP_PAD) ||
 875	    nla_put_in_addr(skb, LWTUNNEL_IP_DST, tun_info->key.u.ipv4.dst) ||
 876	    nla_put_in_addr(skb, LWTUNNEL_IP_SRC, tun_info->key.u.ipv4.src) ||
 877	    nla_put_u8(skb, LWTUNNEL_IP_TOS, tun_info->key.tos) ||
 878	    nla_put_u8(skb, LWTUNNEL_IP_TTL, tun_info->key.ttl) ||
 879	    nla_put_be16(skb, LWTUNNEL_IP_FLAGS,
 880			 ip_tunnel_flags_to_be16(tun_info->key.tun_flags)) ||
 881	    ip_tun_fill_encap_opts(skb, LWTUNNEL_IP_OPTS, tun_info))
 882		return -ENOMEM;
 883
 884	return 0;
 885}
 886
 887static int ip_tun_opts_nlsize(struct ip_tunnel_info *info)
 888{
 889	int opt_len;
 890
 891	if (!ip_tunnel_is_options_present(info->key.tun_flags))
 892		return 0;
 893
 894	opt_len = nla_total_size(0);		/* LWTUNNEL_IP_OPTS */
 895	if (test_bit(IP_TUNNEL_GENEVE_OPT_BIT, info->key.tun_flags)) {
 896		struct geneve_opt *opt;
 897		int offset = 0;
 898
 899		opt_len += nla_total_size(0);	/* LWTUNNEL_IP_OPTS_GENEVE */
 900		while (info->options_len > offset) {
 901			opt = ip_tunnel_info_opts(info) + offset;
 902			opt_len += nla_total_size(2)	/* OPT_GENEVE_CLASS */
 903				   + nla_total_size(1)	/* OPT_GENEVE_TYPE */
 904				   + nla_total_size(opt->length * 4);
 905							/* OPT_GENEVE_DATA */
 906			offset += sizeof(*opt) + opt->length * 4;
 907		}
 908	} else if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {
 909		opt_len += nla_total_size(0)	/* LWTUNNEL_IP_OPTS_VXLAN */
 910			   + nla_total_size(4);	/* OPT_VXLAN_GBP */
 911	} else if (test_bit(IP_TUNNEL_ERSPAN_OPT_BIT, info->key.tun_flags)) {
 912		struct erspan_metadata *md = ip_tunnel_info_opts(info);
 913
 914		opt_len += nla_total_size(0)	/* LWTUNNEL_IP_OPTS_ERSPAN */
 915			   + nla_total_size(1)	/* OPT_ERSPAN_VER */
 916			   + (md->version == 1 ? nla_total_size(4)
 917						/* OPT_ERSPAN_INDEX (v1) */
 918					       : nla_total_size(1) +
 919						 nla_total_size(1));
 920						/* OPT_ERSPAN_DIR + HWID (v2) */
 921	}
 922
 923	return opt_len;
 924}
 925
 926static int ip_tun_encap_nlsize(struct lwtunnel_state *lwtstate)
 927{
 928	return nla_total_size_64bit(8)	/* LWTUNNEL_IP_ID */
 929		+ nla_total_size(4)	/* LWTUNNEL_IP_DST */
 930		+ nla_total_size(4)	/* LWTUNNEL_IP_SRC */
 931		+ nla_total_size(1)	/* LWTUNNEL_IP_TOS */
 932		+ nla_total_size(1)	/* LWTUNNEL_IP_TTL */
 933		+ nla_total_size(2)	/* LWTUNNEL_IP_FLAGS */
 934		+ ip_tun_opts_nlsize(lwt_tun_info(lwtstate));
 935					/* LWTUNNEL_IP_OPTS */
 936}
 937
 938static int ip_tun_cmp_encap(struct lwtunnel_state *a, struct lwtunnel_state *b)
 939{
 940	struct ip_tunnel_info *info_a = lwt_tun_info(a);
 941	struct ip_tunnel_info *info_b = lwt_tun_info(b);
 942
 943	return memcmp(info_a, info_b, sizeof(info_a->key)) ||
 944	       info_a->mode != info_b->mode ||
 945	       info_a->options_len != info_b->options_len ||
 946	       memcmp(ip_tunnel_info_opts(info_a),
 947		      ip_tunnel_info_opts(info_b), info_a->options_len);
 948}
 949
 950static const struct lwtunnel_encap_ops ip_tun_lwt_ops = {
 951	.build_state = ip_tun_build_state,
 952	.destroy_state = ip_tun_destroy_state,
 953	.fill_encap = ip_tun_fill_encap_info,
 954	.get_encap_size = ip_tun_encap_nlsize,
 955	.cmp_encap = ip_tun_cmp_encap,
 956	.owner = THIS_MODULE,
 957};
 958
 959static const struct nla_policy ip6_tun_policy[LWTUNNEL_IP6_MAX + 1] = {
 960	[LWTUNNEL_IP6_UNSPEC]	= { .strict_start_type = LWTUNNEL_IP6_OPTS },
 961	[LWTUNNEL_IP6_ID]		= { .type = NLA_U64 },
 962	[LWTUNNEL_IP6_DST]		= { .len = sizeof(struct in6_addr) },
 963	[LWTUNNEL_IP6_SRC]		= { .len = sizeof(struct in6_addr) },
 964	[LWTUNNEL_IP6_HOPLIMIT]		= { .type = NLA_U8 },
 965	[LWTUNNEL_IP6_TC]		= { .type = NLA_U8 },
 966	[LWTUNNEL_IP6_FLAGS]		= { .type = NLA_U16 },
 967	[LWTUNNEL_IP6_OPTS]		= { .type = NLA_NESTED },
 968};
 969
 970static int ip6_tun_build_state(struct net *net, struct nlattr *attr,
 971			       unsigned int family, const void *cfg,
 972			       struct lwtunnel_state **ts,
 973			       struct netlink_ext_ack *extack)
 974{
 975	struct nlattr *tb[LWTUNNEL_IP6_MAX + 1];
 976	struct lwtunnel_state *new_state;
 977	struct ip_tunnel_info *tun_info;
 978	int err, opt_len;
 979
 980	err = nla_parse_nested_deprecated(tb, LWTUNNEL_IP6_MAX, attr,
 981					  ip6_tun_policy, extack);
 982	if (err < 0)
 983		return err;
 984
 985	opt_len = ip_tun_get_optlen(tb[LWTUNNEL_IP6_OPTS], extack);
 986	if (opt_len < 0)
 987		return opt_len;
 988
 989	new_state = lwtunnel_state_alloc(sizeof(*tun_info) + opt_len);
 990	if (!new_state)
 991		return -ENOMEM;
 992
 993	new_state->type = LWTUNNEL_ENCAP_IP6;
 994
 995	tun_info = lwt_tun_info(new_state);
 996
 997	err = ip_tun_set_opts(tb[LWTUNNEL_IP6_OPTS], tun_info, extack);
 998	if (err < 0) {
 999		lwtstate_free(new_state);
1000		return err;
1001	}
1002
1003	if (tb[LWTUNNEL_IP6_ID])
1004		tun_info->key.tun_id = nla_get_be64(tb[LWTUNNEL_IP6_ID]);
1005
1006	if (tb[LWTUNNEL_IP6_DST])
1007		tun_info->key.u.ipv6.dst = nla_get_in6_addr(tb[LWTUNNEL_IP6_DST]);
1008
1009	if (tb[LWTUNNEL_IP6_SRC])
1010		tun_info->key.u.ipv6.src = nla_get_in6_addr(tb[LWTUNNEL_IP6_SRC]);
1011
1012	if (tb[LWTUNNEL_IP6_HOPLIMIT])
1013		tun_info->key.ttl = nla_get_u8(tb[LWTUNNEL_IP6_HOPLIMIT]);
1014
1015	if (tb[LWTUNNEL_IP6_TC])
1016		tun_info->key.tos = nla_get_u8(tb[LWTUNNEL_IP6_TC]);
1017
1018	if (tb[LWTUNNEL_IP6_FLAGS]) {
1019		IP_TUNNEL_DECLARE_FLAGS(flags);
1020		__be16 data;
1021
1022		data = nla_get_be16(tb[LWTUNNEL_IP6_FLAGS]);
1023		ip_tunnel_flags_from_be16(flags, data);
1024		ip_tunnel_clear_options_present(flags);
1025
1026		ip_tunnel_flags_or(tun_info->key.tun_flags,
1027				   tun_info->key.tun_flags, flags);
1028	}
1029
1030	tun_info->mode = IP_TUNNEL_INFO_TX | IP_TUNNEL_INFO_IPV6;
1031	tun_info->options_len = opt_len;
1032
1033	*ts = new_state;
1034
1035	return 0;
1036}
1037
1038static int ip6_tun_fill_encap_info(struct sk_buff *skb,
1039				   struct lwtunnel_state *lwtstate)
1040{
1041	struct ip_tunnel_info *tun_info = lwt_tun_info(lwtstate);
1042
1043	if (nla_put_be64(skb, LWTUNNEL_IP6_ID, tun_info->key.tun_id,
1044			 LWTUNNEL_IP6_PAD) ||
1045	    nla_put_in6_addr(skb, LWTUNNEL_IP6_DST, &tun_info->key.u.ipv6.dst) ||
1046	    nla_put_in6_addr(skb, LWTUNNEL_IP6_SRC, &tun_info->key.u.ipv6.src) ||
1047	    nla_put_u8(skb, LWTUNNEL_IP6_TC, tun_info->key.tos) ||
1048	    nla_put_u8(skb, LWTUNNEL_IP6_HOPLIMIT, tun_info->key.ttl) ||
1049	    nla_put_be16(skb, LWTUNNEL_IP6_FLAGS,
1050			 ip_tunnel_flags_to_be16(tun_info->key.tun_flags)) ||
1051	    ip_tun_fill_encap_opts(skb, LWTUNNEL_IP6_OPTS, tun_info))
1052		return -ENOMEM;
1053
1054	return 0;
1055}
1056
1057static int ip6_tun_encap_nlsize(struct lwtunnel_state *lwtstate)
1058{
1059	return nla_total_size_64bit(8)	/* LWTUNNEL_IP6_ID */
1060		+ nla_total_size(16)	/* LWTUNNEL_IP6_DST */
1061		+ nla_total_size(16)	/* LWTUNNEL_IP6_SRC */
1062		+ nla_total_size(1)	/* LWTUNNEL_IP6_HOPLIMIT */
1063		+ nla_total_size(1)	/* LWTUNNEL_IP6_TC */
1064		+ nla_total_size(2)	/* LWTUNNEL_IP6_FLAGS */
1065		+ ip_tun_opts_nlsize(lwt_tun_info(lwtstate));
1066					/* LWTUNNEL_IP6_OPTS */
1067}
1068
1069static const struct lwtunnel_encap_ops ip6_tun_lwt_ops = {
1070	.build_state = ip6_tun_build_state,
1071	.fill_encap = ip6_tun_fill_encap_info,
1072	.get_encap_size = ip6_tun_encap_nlsize,
1073	.cmp_encap = ip_tun_cmp_encap,
1074	.owner = THIS_MODULE,
1075};
1076
1077void __init ip_tunnel_core_init(void)
1078{
1079	/* If you land here, make sure whether increasing ip_tunnel_info's
1080	 * options_len is a reasonable choice with its usage in front ends
1081	 * (f.e., it's part of flow keys, etc).
1082	 */
1083	BUILD_BUG_ON(IP_TUNNEL_OPTS_MAX != 255);
1084
1085	lwtunnel_encap_add_ops(&ip_tun_lwt_ops, LWTUNNEL_ENCAP_IP);
1086	lwtunnel_encap_add_ops(&ip6_tun_lwt_ops, LWTUNNEL_ENCAP_IP6);
1087}
1088
1089DEFINE_STATIC_KEY_FALSE(ip_tunnel_metadata_cnt);
1090EXPORT_SYMBOL(ip_tunnel_metadata_cnt);
1091
1092void ip_tunnel_need_metadata(void)
1093{
1094	static_branch_inc(&ip_tunnel_metadata_cnt);
1095}
1096EXPORT_SYMBOL_GPL(ip_tunnel_need_metadata);
1097
1098void ip_tunnel_unneed_metadata(void)
1099{
1100	static_branch_dec(&ip_tunnel_metadata_cnt);
1101}
1102EXPORT_SYMBOL_GPL(ip_tunnel_unneed_metadata);
1103
1104/* Returns either the correct skb->protocol value, or 0 if invalid. */
1105__be16 ip_tunnel_parse_protocol(const struct sk_buff *skb)
1106{
1107	if (skb_network_header(skb) >= skb->head &&
1108	    (skb_network_header(skb) + sizeof(struct iphdr)) <= skb_tail_pointer(skb) &&
1109	    ip_hdr(skb)->version == 4)
1110		return htons(ETH_P_IP);
1111	if (skb_network_header(skb) >= skb->head &&
1112	    (skb_network_header(skb) + sizeof(struct ipv6hdr)) <= skb_tail_pointer(skb) &&
1113	    ipv6_hdr(skb)->version == 6)
1114		return htons(ETH_P_IPV6);
1115	return 0;
1116}
1117EXPORT_SYMBOL(ip_tunnel_parse_protocol);
1118
1119const struct header_ops ip_tunnel_header_ops = { .parse_protocol = ip_tunnel_parse_protocol };
1120EXPORT_SYMBOL(ip_tunnel_header_ops);
1121
1122/* This function returns true when ENCAP attributes are present in the nl msg */
1123bool ip_tunnel_netlink_encap_parms(struct nlattr *data[],
1124				   struct ip_tunnel_encap *encap)
1125{
1126	bool ret = false;
1127
1128	memset(encap, 0, sizeof(*encap));
1129
1130	if (!data)
1131		return ret;
1132
1133	if (data[IFLA_IPTUN_ENCAP_TYPE]) {
1134		ret = true;
1135		encap->type = nla_get_u16(data[IFLA_IPTUN_ENCAP_TYPE]);
1136	}
1137
1138	if (data[IFLA_IPTUN_ENCAP_FLAGS]) {
1139		ret = true;
1140		encap->flags = nla_get_u16(data[IFLA_IPTUN_ENCAP_FLAGS]);
1141	}
1142
1143	if (data[IFLA_IPTUN_ENCAP_SPORT]) {
1144		ret = true;
1145		encap->sport = nla_get_be16(data[IFLA_IPTUN_ENCAP_SPORT]);
1146	}
1147
1148	if (data[IFLA_IPTUN_ENCAP_DPORT]) {
1149		ret = true;
1150		encap->dport = nla_get_be16(data[IFLA_IPTUN_ENCAP_DPORT]);
1151	}
1152
1153	return ret;
1154}
1155EXPORT_SYMBOL_GPL(ip_tunnel_netlink_encap_parms);
1156
1157void ip_tunnel_netlink_parms(struct nlattr *data[],
1158			     struct ip_tunnel_parm_kern *parms)
1159{
1160	if (data[IFLA_IPTUN_LINK])
1161		parms->link = nla_get_u32(data[IFLA_IPTUN_LINK]);
1162
1163	if (data[IFLA_IPTUN_LOCAL])
1164		parms->iph.saddr = nla_get_be32(data[IFLA_IPTUN_LOCAL]);
1165
1166	if (data[IFLA_IPTUN_REMOTE])
1167		parms->iph.daddr = nla_get_be32(data[IFLA_IPTUN_REMOTE]);
1168
1169	if (data[IFLA_IPTUN_TTL]) {
1170		parms->iph.ttl = nla_get_u8(data[IFLA_IPTUN_TTL]);
1171		if (parms->iph.ttl)
1172			parms->iph.frag_off = htons(IP_DF);
1173	}
1174
1175	if (data[IFLA_IPTUN_TOS])
1176		parms->iph.tos = nla_get_u8(data[IFLA_IPTUN_TOS]);
1177
1178	if (!data[IFLA_IPTUN_PMTUDISC] || nla_get_u8(data[IFLA_IPTUN_PMTUDISC]))
1179		parms->iph.frag_off = htons(IP_DF);
1180
1181	if (data[IFLA_IPTUN_FLAGS]) {
1182		__be16 flags;
1183
1184		flags = nla_get_be16(data[IFLA_IPTUN_FLAGS]);
1185		ip_tunnel_flags_from_be16(parms->i_flags, flags);
1186	}
1187
1188	if (data[IFLA_IPTUN_PROTO])
1189		parms->iph.protocol = nla_get_u8(data[IFLA_IPTUN_PROTO]);
1190}
1191EXPORT_SYMBOL_GPL(ip_tunnel_netlink_parms);