1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * VXLAN: Virtual eXtensible Local Area Network
4 *
5 * Copyright (c) 2012-2013 Vyatta Inc.
6 */
7
8 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9
10 #include <linux/kernel.h>
11 #include <linux/module.h>
12 #include <linux/errno.h>
13 #include <linux/slab.h>
14 #include <linux/udp.h>
15 #include <linux/igmp.h>
16 #include <linux/if_ether.h>
17 #include <linux/ethtool.h>
18 #include <linux/rhashtable.h>
19 #include <net/arp.h>
20 #include <net/ndisc.h>
21 #include <net/gro.h>
22 #include <net/ip.h>
23 #include <net/icmp.h>
24 #include <net/rtnetlink.h>
25 #include <net/inet_ecn.h>
26 #include <net/net_namespace.h>
27 #include <net/netns/generic.h>
28 #include <net/netdev_lock.h>
29 #include <net/tun_proto.h>
30 #include <net/vxlan.h>
31 #include <net/nexthop.h>
32
33 #if IS_ENABLED(CONFIG_IPV6)
34 #include <net/ip6_tunnel.h>
35 #include <net/ip6_checksum.h>
36 #endif
37
38 #include "vxlan_private.h"
39
40 #define VXLAN_VERSION "0.1"
41
42 #define FDB_AGE_DEFAULT 300 /* 5 min */
43 #define FDB_AGE_INTERVAL (10 * HZ) /* rescan interval */
44
45 /* UDP port for VXLAN traffic.
46 * The IANA assigned port is 4789, but the Linux default is 8472
47 * for compatibility with early adopters.
48 */
49 static unsigned short vxlan_port __read_mostly = 8472;
50 module_param_named(udp_port, vxlan_port, ushort, 0444);
51 MODULE_PARM_DESC(udp_port, "Destination UDP port");
52
53 static bool log_ecn_error = true;
54 module_param(log_ecn_error, bool, 0644);
55 MODULE_PARM_DESC(log_ecn_error, "Log packets received with corrupted ECN");
56
57 unsigned int vxlan_net_id;
58
59 const u8 all_zeros_mac[ETH_ALEN + 2];
60 static struct rtnl_link_ops vxlan_link_ops;
61
62 static int vxlan_sock_add(struct vxlan_dev *vxlan);
63
64 static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
65
66 static const struct rhashtable_params vxlan_fdb_rht_params = {
67 .head_offset = offsetof(struct vxlan_fdb, rhnode),
68 .key_offset = offsetof(struct vxlan_fdb, key),
69 .key_len = sizeof(struct vxlan_fdb_key),
70 .automatic_shrinking = true,
71 };
72
vxlan_collect_metadata(struct vxlan_sock * vs)73 static inline bool vxlan_collect_metadata(struct vxlan_sock *vs)
74 {
75 return vs->flags & VXLAN_F_COLLECT_METADATA ||
76 ip_tunnel_collect_metadata();
77 }
78
79 /* Find VXLAN socket based on network namespace, address family, UDP port,
80 * enabled unshareable flags and socket device binding (see l3mdev with
81 * non-default VRF).
82 */
vxlan_find_sock(struct net * net,sa_family_t family,__be16 port,u32 flags,int ifindex)83 static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family,
84 __be16 port, u32 flags, int ifindex)
85 {
86 struct vxlan_sock *vs;
87
88 flags &= VXLAN_F_RCV_FLAGS;
89
90 hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) {
91 if (inet_sk(vs->sock->sk)->inet_sport == port &&
92 vxlan_get_sk_family(vs) == family &&
93 vs->flags == flags &&
94 vs->sock->sk->sk_bound_dev_if == ifindex)
95 return vs;
96 }
97 return NULL;
98 }
99
vxlan_vs_find_vni(struct vxlan_sock * vs,int ifindex,__be32 vni,struct vxlan_vni_node ** vninode)100 static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs,
101 int ifindex, __be32 vni,
102 struct vxlan_vni_node **vninode)
103 {
104 struct vxlan_vni_node *vnode;
105 struct vxlan_dev_node *node;
106
107 /* For flow based devices, map all packets to VNI 0 */
108 if (vs->flags & VXLAN_F_COLLECT_METADATA &&
109 !(vs->flags & VXLAN_F_VNIFILTER))
110 vni = 0;
111
112 hlist_for_each_entry_rcu(node, vni_head(vs, vni), hlist) {
113 if (!node->vxlan)
114 continue;
115 vnode = NULL;
116 if (node->vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
117 vnode = vxlan_vnifilter_lookup(node->vxlan, vni);
118 if (!vnode)
119 continue;
120 } else if (node->vxlan->default_dst.remote_vni != vni) {
121 continue;
122 }
123
124 if (IS_ENABLED(CONFIG_IPV6)) {
125 const struct vxlan_config *cfg = &node->vxlan->cfg;
126
127 if ((cfg->flags & VXLAN_F_IPV6_LINKLOCAL) &&
128 cfg->remote_ifindex != ifindex)
129 continue;
130 }
131
132 if (vninode)
133 *vninode = vnode;
134 return node->vxlan;
135 }
136
137 return NULL;
138 }
139
140 /* Look up VNI in a per net namespace table */
vxlan_find_vni(struct net * net,int ifindex,__be32 vni,sa_family_t family,__be16 port,u32 flags)141 static struct vxlan_dev *vxlan_find_vni(struct net *net, int ifindex,
142 __be32 vni, sa_family_t family,
143 __be16 port, u32 flags)
144 {
145 struct vxlan_sock *vs;
146
147 vs = vxlan_find_sock(net, family, port, flags, ifindex);
148 if (!vs)
149 return NULL;
150
151 return vxlan_vs_find_vni(vs, ifindex, vni, NULL);
152 }
153
154 /* Fill in neighbour message in skbuff. */
vxlan_fdb_info(struct sk_buff * skb,struct vxlan_dev * vxlan,const struct vxlan_fdb * fdb,u32 portid,u32 seq,int type,unsigned int flags,const struct vxlan_rdst * rdst)155 static int vxlan_fdb_info(struct sk_buff *skb, struct vxlan_dev *vxlan,
156 const struct vxlan_fdb *fdb,
157 u32 portid, u32 seq, int type, unsigned int flags,
158 const struct vxlan_rdst *rdst)
159 {
160 unsigned long now = jiffies;
161 struct nda_cacheinfo ci;
162 bool send_ip, send_eth;
163 struct nlmsghdr *nlh;
164 struct nexthop *nh;
165 struct ndmsg *ndm;
166 int nh_family;
167 u32 nh_id;
168
169 nlh = nlmsg_put(skb, portid, seq, type, sizeof(*ndm), flags);
170 if (nlh == NULL)
171 return -EMSGSIZE;
172
173 ndm = nlmsg_data(nlh);
174 memset(ndm, 0, sizeof(*ndm));
175
176 send_eth = send_ip = true;
177
178 rcu_read_lock();
179 nh = rcu_dereference(fdb->nh);
180 if (nh) {
181 nh_family = nexthop_get_family(nh);
182 nh_id = nh->id;
183 }
184 rcu_read_unlock();
185
186 if (type == RTM_GETNEIGH) {
187 if (rdst) {
188 send_ip = !vxlan_addr_any(&rdst->remote_ip);
189 ndm->ndm_family = send_ip ? rdst->remote_ip.sa.sa_family : AF_INET;
190 } else if (nh) {
191 ndm->ndm_family = nh_family;
192 }
193 send_eth = !is_zero_ether_addr(fdb->key.eth_addr);
194 } else
195 ndm->ndm_family = AF_BRIDGE;
196 ndm->ndm_state = fdb->state;
197 ndm->ndm_ifindex = vxlan->dev->ifindex;
198 ndm->ndm_flags = fdb->flags;
199 if (rdst && rdst->offloaded)
200 ndm->ndm_flags |= NTF_OFFLOADED;
201 ndm->ndm_type = RTN_UNICAST;
202
203 if (!net_eq(dev_net(vxlan->dev), vxlan->net) &&
204 nla_put_s32(skb, NDA_LINK_NETNSID,
205 peernet2id(dev_net(vxlan->dev), vxlan->net)))
206 goto nla_put_failure;
207
208 if (send_eth && nla_put(skb, NDA_LLADDR, ETH_ALEN, &fdb->key.eth_addr))
209 goto nla_put_failure;
210 if (nh) {
211 if (nla_put_u32(skb, NDA_NH_ID, nh_id))
212 goto nla_put_failure;
213 } else if (rdst) {
214 if (send_ip && vxlan_nla_put_addr(skb, NDA_DST,
215 &rdst->remote_ip))
216 goto nla_put_failure;
217
218 if (rdst->remote_port &&
219 rdst->remote_port != vxlan->cfg.dst_port &&
220 nla_put_be16(skb, NDA_PORT, rdst->remote_port))
221 goto nla_put_failure;
222 if (rdst->remote_vni != vxlan->default_dst.remote_vni &&
223 nla_put_u32(skb, NDA_VNI, be32_to_cpu(rdst->remote_vni)))
224 goto nla_put_failure;
225 if (rdst->remote_ifindex &&
226 nla_put_u32(skb, NDA_IFINDEX, rdst->remote_ifindex))
227 goto nla_put_failure;
228 }
229
230 if ((vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA) && fdb->key.vni &&
231 nla_put_u32(skb, NDA_SRC_VNI,
232 be32_to_cpu(fdb->key.vni)))
233 goto nla_put_failure;
234
235 ci.ndm_used = jiffies_to_clock_t(now - READ_ONCE(fdb->used));
236 ci.ndm_confirmed = 0;
237 ci.ndm_updated = jiffies_to_clock_t(now - READ_ONCE(fdb->updated));
238 ci.ndm_refcnt = 0;
239
240 if (nla_put(skb, NDA_CACHEINFO, sizeof(ci), &ci))
241 goto nla_put_failure;
242
243 nlmsg_end(skb, nlh);
244 return 0;
245
246 nla_put_failure:
247 nlmsg_cancel(skb, nlh);
248 return -EMSGSIZE;
249 }
250
vxlan_nlmsg_size(void)251 static inline size_t vxlan_nlmsg_size(void)
252 {
253 return NLMSG_ALIGN(sizeof(struct ndmsg))
254 + nla_total_size(ETH_ALEN) /* NDA_LLADDR */
255 + nla_total_size(sizeof(struct in6_addr)) /* NDA_DST */
256 + nla_total_size(sizeof(__be16)) /* NDA_PORT */
257 + nla_total_size(sizeof(__be32)) /* NDA_VNI */
258 + nla_total_size(sizeof(__u32)) /* NDA_IFINDEX */
259 + nla_total_size(sizeof(__s32)) /* NDA_LINK_NETNSID */
260 + nla_total_size(sizeof(struct nda_cacheinfo));
261 }
262
__vxlan_fdb_notify(struct vxlan_dev * vxlan,struct vxlan_fdb * fdb,struct vxlan_rdst * rd,int type)263 static void __vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
264 struct vxlan_rdst *rd, int type)
265 {
266 struct net *net = dev_net(vxlan->dev);
267 struct sk_buff *skb;
268 int err = -ENOBUFS;
269
270 skb = nlmsg_new(vxlan_nlmsg_size(), GFP_ATOMIC);
271 if (skb == NULL)
272 goto errout;
273
274 err = vxlan_fdb_info(skb, vxlan, fdb, 0, 0, type, 0, rd);
275 if (err < 0) {
276 /* -EMSGSIZE implies BUG in vxlan_nlmsg_size() */
277 WARN_ON(err == -EMSGSIZE);
278 kfree_skb(skb);
279 goto errout;
280 }
281
282 rtnl_notify(skb, net, 0, RTNLGRP_NEIGH, NULL, GFP_ATOMIC);
283 return;
284 errout:
285 rtnl_set_sk_err(net, RTNLGRP_NEIGH, err);
286 }
287
vxlan_fdb_switchdev_notifier_info(const struct vxlan_dev * vxlan,const struct vxlan_fdb * fdb,const struct vxlan_rdst * rd,struct netlink_ext_ack * extack,struct switchdev_notifier_vxlan_fdb_info * fdb_info)288 static void vxlan_fdb_switchdev_notifier_info(const struct vxlan_dev *vxlan,
289 const struct vxlan_fdb *fdb,
290 const struct vxlan_rdst *rd,
291 struct netlink_ext_ack *extack,
292 struct switchdev_notifier_vxlan_fdb_info *fdb_info)
293 {
294 fdb_info->info.dev = vxlan->dev;
295 fdb_info->info.extack = extack;
296 fdb_info->remote_ip = rd->remote_ip;
297 fdb_info->remote_port = rd->remote_port;
298 fdb_info->remote_vni = rd->remote_vni;
299 fdb_info->remote_ifindex = rd->remote_ifindex;
300 memcpy(fdb_info->eth_addr, fdb->key.eth_addr, ETH_ALEN);
301 fdb_info->vni = fdb->key.vni;
302 fdb_info->offloaded = rd->offloaded;
303 fdb_info->added_by_user = fdb->flags & NTF_VXLAN_ADDED_BY_USER;
304 }
305
vxlan_fdb_switchdev_call_notifiers(struct vxlan_dev * vxlan,struct vxlan_fdb * fdb,struct vxlan_rdst * rd,bool adding,struct netlink_ext_ack * extack)306 static int vxlan_fdb_switchdev_call_notifiers(struct vxlan_dev *vxlan,
307 struct vxlan_fdb *fdb,
308 struct vxlan_rdst *rd,
309 bool adding,
310 struct netlink_ext_ack *extack)
311 {
312 struct switchdev_notifier_vxlan_fdb_info info;
313 enum switchdev_notifier_type notifier_type;
314 int ret;
315
316 if (WARN_ON(!rd))
317 return 0;
318
319 notifier_type = adding ? SWITCHDEV_VXLAN_FDB_ADD_TO_DEVICE
320 : SWITCHDEV_VXLAN_FDB_DEL_TO_DEVICE;
321 vxlan_fdb_switchdev_notifier_info(vxlan, fdb, rd, NULL, &info);
322 ret = call_switchdev_notifiers(notifier_type, vxlan->dev,
323 &info.info, extack);
324 return notifier_to_errno(ret);
325 }
326
vxlan_fdb_notify(struct vxlan_dev * vxlan,struct vxlan_fdb * fdb,struct vxlan_rdst * rd,int type,bool swdev_notify,struct netlink_ext_ack * extack)327 static int vxlan_fdb_notify(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
328 struct vxlan_rdst *rd, int type, bool swdev_notify,
329 struct netlink_ext_ack *extack)
330 {
331 int err;
332
333 if (swdev_notify && rd) {
334 switch (type) {
335 case RTM_NEWNEIGH:
336 err = vxlan_fdb_switchdev_call_notifiers(vxlan, fdb, rd,
337 true, extack);
338 if (err)
339 return err;
340 break;
341 case RTM_DELNEIGH:
342 vxlan_fdb_switchdev_call_notifiers(vxlan, fdb, rd,
343 false, extack);
344 break;
345 }
346 }
347
348 __vxlan_fdb_notify(vxlan, fdb, rd, type);
349 return 0;
350 }
351
vxlan_ip_miss(struct net_device * dev,union vxlan_addr * ipa)352 static void vxlan_ip_miss(struct net_device *dev, union vxlan_addr *ipa)
353 {
354 struct vxlan_dev *vxlan = netdev_priv(dev);
355 struct vxlan_fdb f = {
356 .state = NUD_STALE,
357 };
358 struct vxlan_rdst remote = {
359 .remote_ip = *ipa, /* goes to NDA_DST */
360 .remote_vni = cpu_to_be32(VXLAN_N_VID),
361 };
362
363 vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH, true, NULL);
364 }
365
vxlan_fdb_miss(struct vxlan_dev * vxlan,const u8 eth_addr[ETH_ALEN])366 static void vxlan_fdb_miss(struct vxlan_dev *vxlan, const u8 eth_addr[ETH_ALEN])
367 {
368 struct vxlan_fdb f = {
369 .state = NUD_STALE,
370 };
371 struct vxlan_rdst remote = { };
372
373 memcpy(f.key.eth_addr, eth_addr, ETH_ALEN);
374
375 vxlan_fdb_notify(vxlan, &f, &remote, RTM_GETNEIGH, true, NULL);
376 }
377
378 /* Look up Ethernet address in forwarding table */
vxlan_find_mac_rcu(struct vxlan_dev * vxlan,const u8 * mac,__be32 vni)379 static struct vxlan_fdb *vxlan_find_mac_rcu(struct vxlan_dev *vxlan,
380 const u8 *mac, __be32 vni)
381 {
382 struct vxlan_fdb_key key;
383
384 memset(&key, 0, sizeof(key));
385 memcpy(key.eth_addr, mac, sizeof(key.eth_addr));
386 if (!(vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA))
387 key.vni = vxlan->default_dst.remote_vni;
388 else
389 key.vni = vni;
390
391 return rhashtable_lookup(&vxlan->fdb_hash_tbl, &key,
392 vxlan_fdb_rht_params);
393 }
394
vxlan_find_mac_tx(struct vxlan_dev * vxlan,const u8 * mac,__be32 vni)395 static struct vxlan_fdb *vxlan_find_mac_tx(struct vxlan_dev *vxlan,
396 const u8 *mac, __be32 vni)
397 {
398 struct vxlan_fdb *f;
399
400 f = vxlan_find_mac_rcu(vxlan, mac, vni);
401 if (f) {
402 unsigned long now = jiffies;
403
404 if (READ_ONCE(f->used) != now)
405 WRITE_ONCE(f->used, now);
406 }
407
408 return f;
409 }
410
vxlan_find_mac(struct vxlan_dev * vxlan,const u8 * mac,__be32 vni)411 static struct vxlan_fdb *vxlan_find_mac(struct vxlan_dev *vxlan,
412 const u8 *mac, __be32 vni)
413 {
414 struct vxlan_fdb *f;
415
416 lockdep_assert_held_once(&vxlan->hash_lock);
417
418 rcu_read_lock();
419 f = vxlan_find_mac_rcu(vxlan, mac, vni);
420 rcu_read_unlock();
421
422 return f;
423 }
424
425 /* caller should hold vxlan->hash_lock */
vxlan_fdb_find_rdst(struct vxlan_fdb * f,union vxlan_addr * ip,__be16 port,__be32 vni,__u32 ifindex)426 static struct vxlan_rdst *vxlan_fdb_find_rdst(struct vxlan_fdb *f,
427 union vxlan_addr *ip, __be16 port,
428 __be32 vni, __u32 ifindex)
429 {
430 struct vxlan_rdst *rd;
431
432 list_for_each_entry(rd, &f->remotes, list) {
433 if (vxlan_addr_equal(&rd->remote_ip, ip) &&
434 rd->remote_port == port &&
435 rd->remote_vni == vni &&
436 rd->remote_ifindex == ifindex)
437 return rd;
438 }
439
440 return NULL;
441 }
442
vxlan_fdb_find_uc(struct net_device * dev,const u8 * mac,__be32 vni,struct switchdev_notifier_vxlan_fdb_info * fdb_info)443 int vxlan_fdb_find_uc(struct net_device *dev, const u8 *mac, __be32 vni,
444 struct switchdev_notifier_vxlan_fdb_info *fdb_info)
445 {
446 struct vxlan_dev *vxlan = netdev_priv(dev);
447 u8 eth_addr[ETH_ALEN + 2] = { 0 };
448 struct vxlan_rdst *rdst = NULL;
449 struct vxlan_fdb *f;
450 int rc = 0;
451
452 if (is_multicast_ether_addr(mac) ||
453 is_zero_ether_addr(mac))
454 return -EINVAL;
455
456 ether_addr_copy(eth_addr, mac);
457
458 rcu_read_lock();
459
460 f = vxlan_find_mac_rcu(vxlan, eth_addr, vni);
461 if (f)
462 rdst = first_remote_rcu(f);
463 if (!rdst) {
464 rc = -ENOENT;
465 goto out;
466 }
467
468 vxlan_fdb_switchdev_notifier_info(vxlan, f, rdst, NULL, fdb_info);
469
470 out:
471 rcu_read_unlock();
472 return rc;
473 }
474 EXPORT_SYMBOL_GPL(vxlan_fdb_find_uc);
475
vxlan_fdb_notify_one(struct notifier_block * nb,const struct vxlan_dev * vxlan,const struct vxlan_fdb * f,const struct vxlan_rdst * rdst,struct netlink_ext_ack * extack)476 static int vxlan_fdb_notify_one(struct notifier_block *nb,
477 const struct vxlan_dev *vxlan,
478 const struct vxlan_fdb *f,
479 const struct vxlan_rdst *rdst,
480 struct netlink_ext_ack *extack)
481 {
482 struct switchdev_notifier_vxlan_fdb_info fdb_info;
483 int rc;
484
485 vxlan_fdb_switchdev_notifier_info(vxlan, f, rdst, extack, &fdb_info);
486 rc = nb->notifier_call(nb, SWITCHDEV_VXLAN_FDB_ADD_TO_DEVICE,
487 &fdb_info);
488 return notifier_to_errno(rc);
489 }
490
vxlan_fdb_replay(const struct net_device * dev,__be32 vni,struct notifier_block * nb,struct netlink_ext_ack * extack)491 int vxlan_fdb_replay(const struct net_device *dev, __be32 vni,
492 struct notifier_block *nb,
493 struct netlink_ext_ack *extack)
494 {
495 struct vxlan_dev *vxlan;
496 struct vxlan_rdst *rdst;
497 struct vxlan_fdb *f;
498 int rc = 0;
499
500 if (!netif_is_vxlan(dev))
501 return -EINVAL;
502 vxlan = netdev_priv(dev);
503
504 spin_lock_bh(&vxlan->hash_lock);
505 hlist_for_each_entry(f, &vxlan->fdb_list, fdb_node) {
506 if (f->key.vni == vni) {
507 list_for_each_entry(rdst, &f->remotes, list) {
508 rc = vxlan_fdb_notify_one(nb, vxlan, f, rdst,
509 extack);
510 if (rc)
511 goto unlock;
512 }
513 }
514 }
515 spin_unlock_bh(&vxlan->hash_lock);
516 return 0;
517
518 unlock:
519 spin_unlock_bh(&vxlan->hash_lock);
520 return rc;
521 }
522 EXPORT_SYMBOL_GPL(vxlan_fdb_replay);
523
vxlan_fdb_clear_offload(const struct net_device * dev,__be32 vni)524 void vxlan_fdb_clear_offload(const struct net_device *dev, __be32 vni)
525 {
526 struct vxlan_dev *vxlan;
527 struct vxlan_rdst *rdst;
528 struct vxlan_fdb *f;
529
530 if (!netif_is_vxlan(dev))
531 return;
532 vxlan = netdev_priv(dev);
533
534 spin_lock_bh(&vxlan->hash_lock);
535 hlist_for_each_entry(f, &vxlan->fdb_list, fdb_node) {
536 if (f->key.vni == vni) {
537 list_for_each_entry(rdst, &f->remotes, list)
538 rdst->offloaded = false;
539 }
540 }
541 spin_unlock_bh(&vxlan->hash_lock);
542
543 }
544 EXPORT_SYMBOL_GPL(vxlan_fdb_clear_offload);
545
546 /* Replace destination of unicast mac */
vxlan_fdb_replace(struct vxlan_fdb * f,union vxlan_addr * ip,__be16 port,__be32 vni,__u32 ifindex,struct vxlan_rdst * oldrd)547 static int vxlan_fdb_replace(struct vxlan_fdb *f,
548 union vxlan_addr *ip, __be16 port, __be32 vni,
549 __u32 ifindex, struct vxlan_rdst *oldrd)
550 {
551 struct vxlan_rdst *rd;
552
553 rd = vxlan_fdb_find_rdst(f, ip, port, vni, ifindex);
554 if (rd)
555 return 0;
556
557 rd = list_first_entry_or_null(&f->remotes, struct vxlan_rdst, list);
558 if (!rd)
559 return 0;
560
561 *oldrd = *rd;
562 dst_cache_reset(&rd->dst_cache);
563 rd->remote_ip = *ip;
564 rd->remote_port = port;
565 rd->remote_vni = vni;
566 rd->remote_ifindex = ifindex;
567 rd->offloaded = false;
568 return 1;
569 }
570
571 /* Add/update destinations for multicast */
vxlan_fdb_append(struct vxlan_fdb * f,union vxlan_addr * ip,__be16 port,__be32 vni,__u32 ifindex,struct vxlan_rdst ** rdp)572 static int vxlan_fdb_append(struct vxlan_fdb *f,
573 union vxlan_addr *ip, __be16 port, __be32 vni,
574 __u32 ifindex, struct vxlan_rdst **rdp)
575 {
576 struct vxlan_rdst *rd;
577
578 rd = vxlan_fdb_find_rdst(f, ip, port, vni, ifindex);
579 if (rd)
580 return 0;
581
582 rd = kmalloc_obj(*rd, GFP_ATOMIC);
583 if (rd == NULL)
584 return -ENOMEM;
585
586 /* The driver can work correctly without a dst cache, so do not treat
587 * dst cache initialization errors as fatal.
588 */
589 dst_cache_init(&rd->dst_cache, GFP_ATOMIC | __GFP_NOWARN);
590
591 rd->remote_ip = *ip;
592 rd->remote_port = port;
593 rd->offloaded = false;
594 rd->remote_vni = vni;
595 rd->remote_ifindex = ifindex;
596
597 list_add_tail_rcu(&rd->list, &f->remotes);
598
599 *rdp = rd;
600 return 1;
601 }
602
vxlan_parse_gpe_proto(const struct vxlanhdr * hdr,__be16 * protocol)603 static bool vxlan_parse_gpe_proto(const struct vxlanhdr *hdr, __be16 *protocol)
604 {
605 const struct vxlanhdr_gpe *gpe = (const struct vxlanhdr_gpe *)hdr;
606
607 /* Need to have Next Protocol set for interfaces in GPE mode. */
608 if (!gpe->np_applied)
609 return false;
610 /* "The initial version is 0. If a receiver does not support the
611 * version indicated it MUST drop the packet.
612 */
613 if (gpe->version != 0)
614 return false;
615 /* "When the O bit is set to 1, the packet is an OAM packet and OAM
616 * processing MUST occur." However, we don't implement OAM
617 * processing, thus drop the packet.
618 */
619 if (gpe->oam_flag)
620 return false;
621
622 *protocol = tun_p_to_eth_p(gpe->next_protocol);
623 if (!*protocol)
624 return false;
625
626 return true;
627 }
628
vxlan_gro_remcsum(struct sk_buff * skb,unsigned int off,struct vxlanhdr * vh,size_t hdrlen,__be32 vni_field,struct gro_remcsum * grc,bool nopartial)629 static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb,
630 unsigned int off,
631 struct vxlanhdr *vh, size_t hdrlen,
632 __be32 vni_field,
633 struct gro_remcsum *grc,
634 bool nopartial)
635 {
636 size_t start, offset;
637
638 if (skb->remcsum_offload)
639 return vh;
640
641 if (!NAPI_GRO_CB(skb)->csum_valid)
642 return NULL;
643
644 start = vxlan_rco_start(vni_field);
645 offset = start + vxlan_rco_offset(vni_field);
646
647 vh = skb_gro_remcsum_process(skb, (void *)vh, off, hdrlen,
648 start, offset, grc, nopartial);
649
650 skb->remcsum_offload = 1;
651
652 return vh;
653 }
654
vxlan_gro_prepare_receive(struct sock * sk,struct list_head * head,struct sk_buff * skb,struct gro_remcsum * grc)655 static struct vxlanhdr *vxlan_gro_prepare_receive(struct sock *sk,
656 struct list_head *head,
657 struct sk_buff *skb,
658 struct gro_remcsum *grc)
659 {
660 struct sk_buff *p;
661 struct vxlanhdr *vh, *vh2;
662 unsigned int hlen, off_vx;
663 struct vxlan_sock *vs = rcu_dereference_sk_user_data(sk);
664 __be32 flags;
665
666 skb_gro_remcsum_init(grc);
667
668 off_vx = skb_gro_offset(skb);
669 hlen = off_vx + sizeof(*vh);
670 vh = skb_gro_header(skb, hlen, off_vx);
671 if (unlikely(!vh))
672 return NULL;
673
674 skb_gro_postpull_rcsum(skb, vh, sizeof(struct vxlanhdr));
675
676 flags = vh->vx_flags;
677
678 if ((flags & VXLAN_HF_RCO) && (vs->flags & VXLAN_F_REMCSUM_RX)) {
679 vh = vxlan_gro_remcsum(skb, off_vx, vh, sizeof(struct vxlanhdr),
680 vh->vx_vni, grc,
681 !!(vs->flags &
682 VXLAN_F_REMCSUM_NOPARTIAL));
683
684 if (!vh)
685 return NULL;
686 }
687
688 skb_gro_pull(skb, sizeof(struct vxlanhdr)); /* pull vxlan header */
689
690 list_for_each_entry(p, head, list) {
691 if (!NAPI_GRO_CB(p)->same_flow)
692 continue;
693
694 vh2 = (struct vxlanhdr *)(p->data + off_vx);
695 if (vh->vx_flags != vh2->vx_flags ||
696 vh->vx_vni != vh2->vx_vni) {
697 NAPI_GRO_CB(p)->same_flow = 0;
698 continue;
699 }
700 }
701
702 return vh;
703 }
704
vxlan_gro_receive(struct sock * sk,struct list_head * head,struct sk_buff * skb)705 static struct sk_buff *vxlan_gro_receive(struct sock *sk,
706 struct list_head *head,
707 struct sk_buff *skb)
708 {
709 struct sk_buff *pp = NULL;
710 struct gro_remcsum grc;
711 int flush = 1;
712
713 if (vxlan_gro_prepare_receive(sk, head, skb, &grc)) {
714 pp = call_gro_receive(eth_gro_receive, head, skb);
715 flush = 0;
716 }
717 skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
718 return pp;
719 }
720
vxlan_gpe_gro_receive(struct sock * sk,struct list_head * head,struct sk_buff * skb)721 static struct sk_buff *vxlan_gpe_gro_receive(struct sock *sk,
722 struct list_head *head,
723 struct sk_buff *skb)
724 {
725 const struct packet_offload *ptype;
726 struct sk_buff *pp = NULL;
727 struct gro_remcsum grc;
728 struct vxlanhdr *vh;
729 __be16 protocol;
730 int flush = 1;
731
732 vh = vxlan_gro_prepare_receive(sk, head, skb, &grc);
733 if (vh) {
734 if (!vxlan_parse_gpe_proto(vh, &protocol))
735 goto out;
736 ptype = gro_find_receive_by_type(protocol);
737 if (!ptype)
738 goto out;
739 pp = call_gro_receive(ptype->callbacks.gro_receive, head, skb);
740 flush = 0;
741 }
742 out:
743 skb_gro_flush_final_remcsum(skb, pp, flush, &grc);
744 return pp;
745 }
746
vxlan_gro_complete(struct sock * sk,struct sk_buff * skb,int nhoff)747 static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
748 {
749 /* Sets 'skb->inner_mac_header' since we are always called with
750 * 'skb->encapsulation' set.
751 */
752 return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
753 }
754
vxlan_gpe_gro_complete(struct sock * sk,struct sk_buff * skb,int nhoff)755 static int vxlan_gpe_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
756 {
757 struct vxlanhdr *vh = (struct vxlanhdr *)(skb->data + nhoff);
758 const struct packet_offload *ptype;
759 int err = -ENOSYS;
760 __be16 protocol;
761
762 if (!vxlan_parse_gpe_proto(vh, &protocol))
763 return err;
764 ptype = gro_find_complete_by_type(protocol);
765 if (ptype)
766 err = ptype->callbacks.gro_complete(skb, nhoff + sizeof(struct vxlanhdr));
767 return err;
768 }
769
vxlan_fdb_alloc(struct vxlan_dev * vxlan,const u8 * mac,__u16 state,__be32 src_vni,__u16 ndm_flags)770 static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan, const u8 *mac,
771 __u16 state, __be32 src_vni,
772 __u16 ndm_flags)
773 {
774 struct vxlan_fdb *f;
775
776 f = kmalloc_obj(*f, GFP_ATOMIC);
777 if (!f)
778 return NULL;
779 memset(&f->key, 0, sizeof(f->key));
780 f->state = state;
781 f->flags = ndm_flags;
782 f->updated = f->used = jiffies;
783 f->key.vni = src_vni;
784 f->nh = NULL;
785 RCU_INIT_POINTER(f->vdev, vxlan);
786 INIT_LIST_HEAD(&f->nh_list);
787 INIT_LIST_HEAD(&f->remotes);
788 memcpy(f->key.eth_addr, mac, ETH_ALEN);
789
790 return f;
791 }
792
vxlan_fdb_nh_update(struct vxlan_dev * vxlan,struct vxlan_fdb * fdb,u32 nhid,struct netlink_ext_ack * extack)793 static int vxlan_fdb_nh_update(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
794 u32 nhid, struct netlink_ext_ack *extack)
795 {
796 struct nexthop *old_nh = rtnl_dereference(fdb->nh);
797 struct nexthop *nh;
798 int err = -EINVAL;
799
800 if (old_nh && old_nh->id == nhid)
801 return 0;
802
803 nh = nexthop_find_by_id(vxlan->net, nhid);
804 if (!nh) {
805 NL_SET_ERR_MSG(extack, "Nexthop id does not exist");
806 goto err_inval;
807 }
808
809 if (!nexthop_get(nh)) {
810 NL_SET_ERR_MSG(extack, "Nexthop has been deleted");
811 nh = NULL;
812 goto err_inval;
813 }
814 if (!nexthop_is_fdb(nh)) {
815 NL_SET_ERR_MSG(extack, "Nexthop is not a fdb nexthop");
816 goto err_inval;
817 }
818
819 if (!nexthop_is_multipath(nh)) {
820 NL_SET_ERR_MSG(extack, "Nexthop is not a multipath group");
821 goto err_inval;
822 }
823
824 /* check nexthop group family */
825 switch (vxlan->default_dst.remote_ip.sa.sa_family) {
826 case AF_INET:
827 if (!nexthop_has_v4(nh)) {
828 err = -EAFNOSUPPORT;
829 NL_SET_ERR_MSG(extack, "Nexthop group family not supported");
830 goto err_inval;
831 }
832 break;
833 case AF_INET6:
834 if (nexthop_has_v4(nh)) {
835 err = -EAFNOSUPPORT;
836 NL_SET_ERR_MSG(extack, "Nexthop group family not supported");
837 goto err_inval;
838 }
839 }
840
841 if (old_nh) {
842 list_del_rcu(&fdb->nh_list);
843 nexthop_put(old_nh);
844 }
845 rcu_assign_pointer(fdb->nh, nh);
846 list_add_tail_rcu(&fdb->nh_list, &nh->fdb_list);
847 return 1;
848
849 err_inval:
850 if (nh)
851 nexthop_put(nh);
852 return err;
853 }
854
vxlan_fdb_create(struct vxlan_dev * vxlan,const u8 * mac,union vxlan_addr * ip,__u16 state,__be16 port,__be32 src_vni,__be32 vni,__u32 ifindex,__u16 ndm_flags,u32 nhid,struct vxlan_fdb ** fdb,struct netlink_ext_ack * extack)855 int vxlan_fdb_create(struct vxlan_dev *vxlan,
856 const u8 *mac, union vxlan_addr *ip,
857 __u16 state, __be16 port, __be32 src_vni,
858 __be32 vni, __u32 ifindex, __u16 ndm_flags,
859 u32 nhid, struct vxlan_fdb **fdb,
860 struct netlink_ext_ack *extack)
861 {
862 struct vxlan_rdst *rd = NULL;
863 struct vxlan_fdb *f;
864 int rc;
865
866 if (vxlan->cfg.addrmax &&
867 vxlan->addrcnt >= vxlan->cfg.addrmax)
868 return -ENOSPC;
869
870 netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
871 f = vxlan_fdb_alloc(vxlan, mac, state, src_vni, ndm_flags);
872 if (!f)
873 return -ENOMEM;
874
875 if (nhid)
876 rc = vxlan_fdb_nh_update(vxlan, f, nhid, extack);
877 else
878 rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
879 if (rc < 0)
880 goto errout;
881
882 rc = rhashtable_lookup_insert_fast(&vxlan->fdb_hash_tbl, &f->rhnode,
883 vxlan_fdb_rht_params);
884 if (rc)
885 goto destroy_remote;
886
887 ++vxlan->addrcnt;
888 hlist_add_head_rcu(&f->fdb_node, &vxlan->fdb_list);
889
890 *fdb = f;
891
892 return 0;
893
894 destroy_remote:
895 if (rcu_access_pointer(f->nh)) {
896 list_del_rcu(&f->nh_list);
897 nexthop_put(rtnl_dereference(f->nh));
898 } else {
899 list_del(&rd->list);
900 dst_cache_destroy(&rd->dst_cache);
901 kfree(rd);
902 }
903 errout:
904 kfree(f);
905 return rc;
906 }
907
__vxlan_fdb_free(struct vxlan_fdb * f)908 static void __vxlan_fdb_free(struct vxlan_fdb *f)
909 {
910 struct vxlan_rdst *rd, *nd;
911 struct nexthop *nh;
912
913 nh = rcu_dereference_raw(f->nh);
914 if (nh) {
915 rcu_assign_pointer(f->nh, NULL);
916 rcu_assign_pointer(f->vdev, NULL);
917 nexthop_put(nh);
918 }
919
920 list_for_each_entry_safe(rd, nd, &f->remotes, list) {
921 dst_cache_destroy(&rd->dst_cache);
922 kfree(rd);
923 }
924 kfree(f);
925 }
926
vxlan_fdb_free(struct rcu_head * head)927 static void vxlan_fdb_free(struct rcu_head *head)
928 {
929 struct vxlan_fdb *f = container_of(head, struct vxlan_fdb, rcu);
930
931 __vxlan_fdb_free(f);
932 }
933
vxlan_fdb_destroy(struct vxlan_dev * vxlan,struct vxlan_fdb * f,bool do_notify,bool swdev_notify)934 static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
935 bool do_notify, bool swdev_notify)
936 {
937 struct vxlan_rdst *rd;
938
939 netdev_dbg(vxlan->dev, "delete %pM\n", f->key.eth_addr);
940
941 --vxlan->addrcnt;
942 if (do_notify) {
943 if (rcu_access_pointer(f->nh))
944 vxlan_fdb_notify(vxlan, f, NULL, RTM_DELNEIGH,
945 swdev_notify, NULL);
946 else
947 list_for_each_entry(rd, &f->remotes, list)
948 vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH,
949 swdev_notify, NULL);
950 }
951
952 hlist_del_init_rcu(&f->fdb_node);
953 rhashtable_remove_fast(&vxlan->fdb_hash_tbl, &f->rhnode,
954 vxlan_fdb_rht_params);
955 list_del_rcu(&f->nh_list);
956 call_rcu(&f->rcu, vxlan_fdb_free);
957 }
958
vxlan_dst_free(struct rcu_head * head)959 static void vxlan_dst_free(struct rcu_head *head)
960 {
961 struct vxlan_rdst *rd = container_of(head, struct vxlan_rdst, rcu);
962
963 dst_cache_destroy(&rd->dst_cache);
964 kfree(rd);
965 }
966
vxlan_fdb_update_existing(struct vxlan_dev * vxlan,union vxlan_addr * ip,__u16 state,__u16 flags,__be16 port,__be32 vni,__u32 ifindex,__u16 ndm_flags,struct vxlan_fdb * f,u32 nhid,bool swdev_notify,struct netlink_ext_ack * extack)967 static int vxlan_fdb_update_existing(struct vxlan_dev *vxlan,
968 union vxlan_addr *ip,
969 __u16 state, __u16 flags,
970 __be16 port, __be32 vni,
971 __u32 ifindex, __u16 ndm_flags,
972 struct vxlan_fdb *f, u32 nhid,
973 bool swdev_notify,
974 struct netlink_ext_ack *extack)
975 {
976 __u16 fdb_flags = (ndm_flags & ~NTF_USE);
977 struct vxlan_rdst *rd = NULL;
978 struct vxlan_rdst oldrd;
979 int notify = 0;
980 int rc = 0;
981 int err;
982
983 if (nhid && !rcu_access_pointer(f->nh)) {
984 NL_SET_ERR_MSG(extack,
985 "Cannot replace an existing non nexthop fdb with a nexthop");
986 return -EOPNOTSUPP;
987 }
988
989 if (nhid && (flags & NLM_F_APPEND)) {
990 NL_SET_ERR_MSG(extack,
991 "Cannot append to a nexthop fdb");
992 return -EOPNOTSUPP;
993 }
994
995 /* Do not allow an externally learned entry to take over an entry added
996 * by the user.
997 */
998 if (!(fdb_flags & NTF_EXT_LEARNED) ||
999 !(f->flags & NTF_VXLAN_ADDED_BY_USER)) {
1000 if (f->state != state) {
1001 f->state = state;
1002 notify = 1;
1003 }
1004 if (f->flags != fdb_flags) {
1005 f->flags = fdb_flags;
1006 notify = 1;
1007 }
1008 }
1009
1010 if ((flags & NLM_F_REPLACE)) {
1011 /* Only change unicasts */
1012 if (!(is_multicast_ether_addr(f->key.eth_addr) ||
1013 is_zero_ether_addr(f->key.eth_addr))) {
1014 if (nhid) {
1015 rc = vxlan_fdb_nh_update(vxlan, f, nhid, extack);
1016 if (rc < 0)
1017 return rc;
1018 } else {
1019 rc = vxlan_fdb_replace(f, ip, port, vni,
1020 ifindex, &oldrd);
1021 }
1022 notify |= rc;
1023 } else {
1024 NL_SET_ERR_MSG(extack, "Cannot replace non-unicast fdb entries");
1025 return -EOPNOTSUPP;
1026 }
1027 }
1028 if ((flags & NLM_F_APPEND) &&
1029 (is_multicast_ether_addr(f->key.eth_addr) ||
1030 is_zero_ether_addr(f->key.eth_addr))) {
1031 rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd);
1032
1033 if (rc < 0)
1034 return rc;
1035 notify |= rc;
1036 }
1037
1038 if (ndm_flags & NTF_USE)
1039 WRITE_ONCE(f->updated, jiffies);
1040
1041 if (notify) {
1042 if (rd == NULL)
1043 rd = first_remote_rtnl(f);
1044
1045 WRITE_ONCE(f->updated, jiffies);
1046 err = vxlan_fdb_notify(vxlan, f, rd, RTM_NEWNEIGH,
1047 swdev_notify, extack);
1048 if (err)
1049 goto err_notify;
1050 }
1051
1052 return 0;
1053
1054 err_notify:
1055 if (nhid)
1056 return err;
1057 if ((flags & NLM_F_REPLACE) && rc)
1058 *rd = oldrd;
1059 else if ((flags & NLM_F_APPEND) && rc) {
1060 list_del_rcu(&rd->list);
1061 call_rcu(&rd->rcu, vxlan_dst_free);
1062 }
1063 return err;
1064 }
1065
vxlan_fdb_update_create(struct vxlan_dev * vxlan,const u8 * mac,union vxlan_addr * ip,__u16 state,__u16 flags,__be16 port,__be32 src_vni,__be32 vni,__u32 ifindex,__u16 ndm_flags,u32 nhid,bool swdev_notify,struct netlink_ext_ack * extack)1066 static int vxlan_fdb_update_create(struct vxlan_dev *vxlan,
1067 const u8 *mac, union vxlan_addr *ip,
1068 __u16 state, __u16 flags,
1069 __be16 port, __be32 src_vni, __be32 vni,
1070 __u32 ifindex, __u16 ndm_flags, u32 nhid,
1071 bool swdev_notify,
1072 struct netlink_ext_ack *extack)
1073 {
1074 __u16 fdb_flags = (ndm_flags & ~NTF_USE);
1075 struct vxlan_fdb *f;
1076 int rc;
1077
1078 /* Disallow replace to add a multicast entry */
1079 if ((flags & NLM_F_REPLACE) &&
1080 (is_multicast_ether_addr(mac) || is_zero_ether_addr(mac)))
1081 return -EOPNOTSUPP;
1082
1083 netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip);
1084 rc = vxlan_fdb_create(vxlan, mac, ip, state, port, src_vni,
1085 vni, ifindex, fdb_flags, nhid, &f, extack);
1086 if (rc < 0)
1087 return rc;
1088
1089 rc = vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH,
1090 swdev_notify, extack);
1091 if (rc)
1092 goto err_notify;
1093
1094 return 0;
1095
1096 err_notify:
1097 vxlan_fdb_destroy(vxlan, f, false, false);
1098 return rc;
1099 }
1100
1101 /* Add new entry to forwarding table -- assumes lock held */
vxlan_fdb_update(struct vxlan_dev * vxlan,const u8 * mac,union vxlan_addr * ip,__u16 state,__u16 flags,__be16 port,__be32 src_vni,__be32 vni,__u32 ifindex,__u16 ndm_flags,u32 nhid,bool swdev_notify,struct netlink_ext_ack * extack)1102 int vxlan_fdb_update(struct vxlan_dev *vxlan,
1103 const u8 *mac, union vxlan_addr *ip,
1104 __u16 state, __u16 flags,
1105 __be16 port, __be32 src_vni, __be32 vni,
1106 __u32 ifindex, __u16 ndm_flags, u32 nhid,
1107 bool swdev_notify,
1108 struct netlink_ext_ack *extack)
1109 {
1110 struct vxlan_fdb *f;
1111
1112 f = vxlan_find_mac(vxlan, mac, src_vni);
1113 if (f) {
1114 if (flags & NLM_F_EXCL) {
1115 netdev_dbg(vxlan->dev,
1116 "lost race to create %pM\n", mac);
1117 return -EEXIST;
1118 }
1119
1120 return vxlan_fdb_update_existing(vxlan, ip, state, flags, port,
1121 vni, ifindex, ndm_flags, f,
1122 nhid, swdev_notify, extack);
1123 } else {
1124 if (!(flags & NLM_F_CREATE))
1125 return -ENOENT;
1126
1127 return vxlan_fdb_update_create(vxlan, mac, ip, state, flags,
1128 port, src_vni, vni, ifindex,
1129 ndm_flags, nhid, swdev_notify,
1130 extack);
1131 }
1132 }
1133
vxlan_fdb_dst_destroy(struct vxlan_dev * vxlan,struct vxlan_fdb * f,struct vxlan_rdst * rd,bool swdev_notify)1134 static void vxlan_fdb_dst_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
1135 struct vxlan_rdst *rd, bool swdev_notify)
1136 {
1137 list_del_rcu(&rd->list);
1138 vxlan_fdb_notify(vxlan, f, rd, RTM_DELNEIGH, swdev_notify, NULL);
1139 call_rcu(&rd->rcu, vxlan_dst_free);
1140 }
1141
vxlan_fdb_parse(struct nlattr * tb[],struct vxlan_dev * vxlan,union vxlan_addr * ip,__be16 * port,__be32 * src_vni,__be32 * vni,u32 * ifindex,u32 * nhid,struct netlink_ext_ack * extack)1142 static int vxlan_fdb_parse(struct nlattr *tb[], struct vxlan_dev *vxlan,
1143 union vxlan_addr *ip, __be16 *port, __be32 *src_vni,
1144 __be32 *vni, u32 *ifindex, u32 *nhid,
1145 struct netlink_ext_ack *extack)
1146 {
1147 struct net *net = dev_net(vxlan->dev);
1148 int err;
1149
1150 if (tb[NDA_NH_ID] &&
1151 (tb[NDA_DST] || tb[NDA_VNI] || tb[NDA_IFINDEX] || tb[NDA_PORT])) {
1152 NL_SET_ERR_MSG(extack, "DST, VNI, ifindex and port are mutually exclusive with NH_ID");
1153 return -EINVAL;
1154 }
1155
1156 if (tb[NDA_DST]) {
1157 err = vxlan_nla_get_addr(ip, tb[NDA_DST]);
1158 if (err) {
1159 NL_SET_ERR_MSG(extack, "Unsupported address family");
1160 return err;
1161 }
1162 } else {
1163 union vxlan_addr *remote = &vxlan->default_dst.remote_ip;
1164
1165 if (remote->sa.sa_family == AF_INET) {
1166 ip->sin.sin_addr.s_addr = htonl(INADDR_ANY);
1167 ip->sa.sa_family = AF_INET;
1168 #if IS_ENABLED(CONFIG_IPV6)
1169 } else {
1170 ip->sin6.sin6_addr = in6addr_any;
1171 ip->sa.sa_family = AF_INET6;
1172 #endif
1173 }
1174 }
1175
1176 if (tb[NDA_PORT]) {
1177 if (nla_len(tb[NDA_PORT]) != sizeof(__be16)) {
1178 NL_SET_ERR_MSG(extack, "Invalid vxlan port");
1179 return -EINVAL;
1180 }
1181 *port = nla_get_be16(tb[NDA_PORT]);
1182 } else {
1183 *port = vxlan->cfg.dst_port;
1184 }
1185
1186 if (tb[NDA_VNI]) {
1187 if (nla_len(tb[NDA_VNI]) != sizeof(u32)) {
1188 NL_SET_ERR_MSG(extack, "Invalid vni");
1189 return -EINVAL;
1190 }
1191 *vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI]));
1192 } else {
1193 *vni = vxlan->default_dst.remote_vni;
1194 }
1195
1196 if (tb[NDA_SRC_VNI]) {
1197 if (nla_len(tb[NDA_SRC_VNI]) != sizeof(u32)) {
1198 NL_SET_ERR_MSG(extack, "Invalid src vni");
1199 return -EINVAL;
1200 }
1201 *src_vni = cpu_to_be32(nla_get_u32(tb[NDA_SRC_VNI]));
1202 } else {
1203 *src_vni = vxlan->default_dst.remote_vni;
1204 }
1205
1206 if (tb[NDA_IFINDEX]) {
1207 struct net_device *tdev;
1208
1209 if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32)) {
1210 NL_SET_ERR_MSG(extack, "Invalid ifindex");
1211 return -EINVAL;
1212 }
1213 *ifindex = nla_get_u32(tb[NDA_IFINDEX]);
1214 tdev = __dev_get_by_index(net, *ifindex);
1215 if (!tdev) {
1216 NL_SET_ERR_MSG(extack, "Device not found");
1217 return -EADDRNOTAVAIL;
1218 }
1219 } else {
1220 *ifindex = 0;
1221 }
1222
1223 *nhid = nla_get_u32_default(tb[NDA_NH_ID], 0);
1224
1225 return 0;
1226 }
1227
1228 /* Add static entry (via netlink) */
vxlan_fdb_add(struct ndmsg * ndm,struct nlattr * tb[],struct net_device * dev,const unsigned char * addr,u16 vid,u16 flags,bool * notified,struct netlink_ext_ack * extack)1229 static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
1230 struct net_device *dev,
1231 const unsigned char *addr, u16 vid, u16 flags,
1232 bool *notified, struct netlink_ext_ack *extack)
1233 {
1234 struct vxlan_dev *vxlan = netdev_priv(dev);
1235 /* struct net *net = dev_net(vxlan->dev); */
1236 union vxlan_addr ip;
1237 __be16 port;
1238 __be32 src_vni, vni;
1239 u32 ifindex, nhid;
1240 int err;
1241
1242 if (!(ndm->ndm_state & (NUD_PERMANENT|NUD_REACHABLE))) {
1243 pr_info("RTM_NEWNEIGH with invalid state %#x\n",
1244 ndm->ndm_state);
1245 return -EINVAL;
1246 }
1247
1248 if (!tb || (!tb[NDA_DST] && !tb[NDA_NH_ID]))
1249 return -EINVAL;
1250
1251 err = vxlan_fdb_parse(tb, vxlan, &ip, &port, &src_vni, &vni, &ifindex,
1252 &nhid, extack);
1253 if (err)
1254 return err;
1255
1256 if (vxlan->default_dst.remote_ip.sa.sa_family != ip.sa.sa_family)
1257 return -EAFNOSUPPORT;
1258
1259 spin_lock_bh(&vxlan->hash_lock);
1260 err = vxlan_fdb_update(vxlan, addr, &ip, ndm->ndm_state, flags,
1261 port, src_vni, vni, ifindex,
1262 ndm->ndm_flags | NTF_VXLAN_ADDED_BY_USER,
1263 nhid, true, extack);
1264 spin_unlock_bh(&vxlan->hash_lock);
1265
1266 if (!err)
1267 *notified = true;
1268
1269 return err;
1270 }
1271
__vxlan_fdb_delete(struct vxlan_dev * vxlan,const unsigned char * addr,union vxlan_addr ip,__be16 port,__be32 src_vni,__be32 vni,u32 ifindex,bool swdev_notify)1272 int __vxlan_fdb_delete(struct vxlan_dev *vxlan,
1273 const unsigned char *addr, union vxlan_addr ip,
1274 __be16 port, __be32 src_vni, __be32 vni,
1275 u32 ifindex, bool swdev_notify)
1276 {
1277 struct vxlan_rdst *rd = NULL;
1278 struct vxlan_fdb *f;
1279 int err = -ENOENT;
1280
1281 f = vxlan_find_mac(vxlan, addr, src_vni);
1282 if (!f)
1283 return err;
1284
1285 if (!vxlan_addr_any(&ip)) {
1286 rd = vxlan_fdb_find_rdst(f, &ip, port, vni, ifindex);
1287 if (!rd)
1288 goto out;
1289 }
1290
1291 /* remove a destination if it's not the only one on the list,
1292 * otherwise destroy the fdb entry
1293 */
1294 if (rd && !list_is_singular(&f->remotes)) {
1295 vxlan_fdb_dst_destroy(vxlan, f, rd, swdev_notify);
1296 goto out;
1297 }
1298
1299 vxlan_fdb_destroy(vxlan, f, true, swdev_notify);
1300
1301 out:
1302 return 0;
1303 }
1304
1305 /* Delete entry (via netlink) */
vxlan_fdb_delete(struct ndmsg * ndm,struct nlattr * tb[],struct net_device * dev,const unsigned char * addr,u16 vid,bool * notified,struct netlink_ext_ack * extack)1306 static int vxlan_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
1307 struct net_device *dev,
1308 const unsigned char *addr, u16 vid, bool *notified,
1309 struct netlink_ext_ack *extack)
1310 {
1311 struct vxlan_dev *vxlan = netdev_priv(dev);
1312 union vxlan_addr ip;
1313 __be32 src_vni, vni;
1314 u32 ifindex, nhid;
1315 __be16 port;
1316 int err;
1317
1318 err = vxlan_fdb_parse(tb, vxlan, &ip, &port, &src_vni, &vni, &ifindex,
1319 &nhid, extack);
1320 if (err)
1321 return err;
1322
1323 spin_lock_bh(&vxlan->hash_lock);
1324 err = __vxlan_fdb_delete(vxlan, addr, ip, port, src_vni, vni, ifindex,
1325 true);
1326 spin_unlock_bh(&vxlan->hash_lock);
1327
1328 if (!err)
1329 *notified = true;
1330
1331 return err;
1332 }
1333
1334 /* Dump forwarding table */
vxlan_fdb_dump(struct sk_buff * skb,struct netlink_callback * cb,struct net_device * dev,struct net_device * filter_dev,int * idx)1335 static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
1336 struct net_device *dev,
1337 struct net_device *filter_dev, int *idx)
1338 {
1339 struct ndo_fdb_dump_context *ctx = (void *)cb->ctx;
1340 struct vxlan_dev *vxlan = netdev_priv(dev);
1341 struct vxlan_fdb *f;
1342 int err = 0;
1343
1344 rcu_read_lock();
1345 hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) {
1346 struct vxlan_rdst *rd;
1347
1348 if (rcu_access_pointer(f->nh)) {
1349 if (*idx < ctx->fdb_idx)
1350 goto skip_nh;
1351 err = vxlan_fdb_info(skb, vxlan, f,
1352 NETLINK_CB(cb->skb).portid,
1353 cb->nlh->nlmsg_seq,
1354 RTM_NEWNEIGH, NLM_F_MULTI, NULL);
1355 if (err < 0) {
1356 rcu_read_unlock();
1357 goto out;
1358 }
1359 skip_nh:
1360 *idx += 1;
1361 continue;
1362 }
1363
1364 list_for_each_entry_rcu(rd, &f->remotes, list) {
1365 if (*idx < ctx->fdb_idx)
1366 goto skip;
1367
1368 err = vxlan_fdb_info(skb, vxlan, f,
1369 NETLINK_CB(cb->skb).portid,
1370 cb->nlh->nlmsg_seq,
1371 RTM_NEWNEIGH, NLM_F_MULTI, rd);
1372 if (err < 0) {
1373 rcu_read_unlock();
1374 goto out;
1375 }
1376 skip:
1377 *idx += 1;
1378 }
1379 }
1380 rcu_read_unlock();
1381 out:
1382 return err;
1383 }
1384
vxlan_fdb_get(struct sk_buff * skb,struct nlattr * tb[],struct net_device * dev,const unsigned char * addr,u16 vid,u32 portid,u32 seq,struct netlink_ext_ack * extack)1385 static int vxlan_fdb_get(struct sk_buff *skb,
1386 struct nlattr *tb[],
1387 struct net_device *dev,
1388 const unsigned char *addr,
1389 u16 vid, u32 portid, u32 seq,
1390 struct netlink_ext_ack *extack)
1391 {
1392 struct vxlan_dev *vxlan = netdev_priv(dev);
1393 struct vxlan_fdb *f;
1394 __be32 vni;
1395 int err;
1396
1397 if (tb[NDA_VNI])
1398 vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI]));
1399 else
1400 vni = vxlan->default_dst.remote_vni;
1401
1402 rcu_read_lock();
1403
1404 f = vxlan_find_mac_rcu(vxlan, addr, vni);
1405 if (!f) {
1406 NL_SET_ERR_MSG(extack, "Fdb entry not found");
1407 err = -ENOENT;
1408 goto errout;
1409 }
1410
1411 err = vxlan_fdb_info(skb, vxlan, f, portid, seq,
1412 RTM_NEWNEIGH, 0, first_remote_rcu(f));
1413 errout:
1414 rcu_read_unlock();
1415 return err;
1416 }
1417
1418 /* Watch incoming packets to learn mapping between Ethernet address
1419 * and Tunnel endpoint.
1420 */
vxlan_snoop(struct net_device * dev,union vxlan_addr * src_ip,const u8 * src_mac,u32 src_ifindex,__be32 vni)1421 static enum skb_drop_reason vxlan_snoop(struct net_device *dev,
1422 union vxlan_addr *src_ip,
1423 const u8 *src_mac, u32 src_ifindex,
1424 __be32 vni)
1425 {
1426 struct vxlan_dev *vxlan = netdev_priv(dev);
1427 struct vxlan_fdb *f;
1428 u32 ifindex = 0;
1429
1430 /* Ignore packets from invalid src-address */
1431 if (!is_valid_ether_addr(src_mac))
1432 return SKB_DROP_REASON_MAC_INVALID_SOURCE;
1433
1434 #if IS_ENABLED(CONFIG_IPV6)
1435 if (src_ip->sa.sa_family == AF_INET6 &&
1436 (ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL))
1437 ifindex = src_ifindex;
1438 #endif
1439
1440 f = vxlan_find_mac_rcu(vxlan, src_mac, vni);
1441 if (likely(f)) {
1442 struct vxlan_rdst *rdst = first_remote_rcu(f);
1443 unsigned long now = jiffies;
1444
1445 if (READ_ONCE(f->updated) != now)
1446 WRITE_ONCE(f->updated, now);
1447
1448 /* Don't override an fdb with nexthop with a learnt entry */
1449 if (rcu_access_pointer(f->nh))
1450 return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS;
1451
1452 if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip) &&
1453 rdst->remote_ifindex == ifindex))
1454 return SKB_NOT_DROPPED_YET;
1455
1456 /* Don't migrate static entries, drop packets */
1457 if (f->state & (NUD_PERMANENT | NUD_NOARP))
1458 return SKB_DROP_REASON_VXLAN_ENTRY_EXISTS;
1459
1460 if (net_ratelimit())
1461 netdev_info(dev,
1462 "%pM migrated from %pIS to %pIS\n",
1463 src_mac, &rdst->remote_ip.sa, &src_ip->sa);
1464
1465 rdst->remote_ip = *src_ip;
1466 vxlan_fdb_notify(vxlan, f, rdst, RTM_NEWNEIGH, true, NULL);
1467 } else {
1468 /* learned new entry */
1469 spin_lock(&vxlan->hash_lock);
1470
1471 /* close off race between vxlan_flush and incoming packets */
1472 if (netif_running(dev))
1473 vxlan_fdb_update(vxlan, src_mac, src_ip,
1474 NUD_REACHABLE,
1475 NLM_F_EXCL|NLM_F_CREATE,
1476 vxlan->cfg.dst_port,
1477 vni,
1478 vxlan->default_dst.remote_vni,
1479 ifindex, NTF_SELF, 0, true, NULL);
1480 spin_unlock(&vxlan->hash_lock);
1481 }
1482
1483 return SKB_NOT_DROPPED_YET;
1484 }
1485
__vxlan_sock_release_prep(struct vxlan_sock * vs)1486 static bool __vxlan_sock_release_prep(struct vxlan_sock *vs)
1487 {
1488 ASSERT_RTNL();
1489
1490 if (!vs)
1491 return false;
1492 if (!refcount_dec_and_test(&vs->refcnt))
1493 return false;
1494
1495 hlist_del_rcu(&vs->hlist);
1496 udp_tunnel_notify_del_rx_port(vs->sock,
1497 (vs->flags & VXLAN_F_GPE) ?
1498 UDP_TUNNEL_TYPE_VXLAN_GPE :
1499 UDP_TUNNEL_TYPE_VXLAN);
1500
1501 return true;
1502 }
1503
vxlan_sock_release(struct vxlan_dev * vxlan)1504 static void vxlan_sock_release(struct vxlan_dev *vxlan)
1505 {
1506 struct vxlan_sock *sock4 = rtnl_dereference(vxlan->vn4_sock);
1507 #if IS_ENABLED(CONFIG_IPV6)
1508 struct vxlan_sock *sock6 = rtnl_dereference(vxlan->vn6_sock);
1509
1510 RCU_INIT_POINTER(vxlan->vn6_sock, NULL);
1511 #endif
1512
1513 RCU_INIT_POINTER(vxlan->vn4_sock, NULL);
1514 synchronize_net();
1515
1516 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
1517 vxlan_vs_del_vnigrp(vxlan);
1518 else
1519 vxlan_vs_del_dev(vxlan);
1520
1521 if (__vxlan_sock_release_prep(sock4)) {
1522 udp_tunnel_sock_release(sock4->sock);
1523 kfree(sock4);
1524 }
1525
1526 #if IS_ENABLED(CONFIG_IPV6)
1527 if (__vxlan_sock_release_prep(sock6)) {
1528 udp_tunnel_sock_release(sock6->sock);
1529 kfree(sock6);
1530 }
1531 #endif
1532 }
1533
vxlan_remcsum(struct sk_buff * skb,u32 vxflags)1534 static enum skb_drop_reason vxlan_remcsum(struct sk_buff *skb, u32 vxflags)
1535 {
1536 const struct vxlanhdr *vh = vxlan_hdr(skb);
1537 enum skb_drop_reason reason;
1538 size_t start, offset;
1539
1540 if (!(vh->vx_flags & VXLAN_HF_RCO) || skb->remcsum_offload)
1541 return SKB_NOT_DROPPED_YET;
1542
1543 start = vxlan_rco_start(vh->vx_vni);
1544 offset = start + vxlan_rco_offset(vh->vx_vni);
1545
1546 reason = pskb_may_pull_reason(skb, offset + sizeof(u16));
1547 if (reason)
1548 return reason;
1549
1550 skb_remcsum_process(skb, (void *)(vxlan_hdr(skb) + 1), start, offset,
1551 !!(vxflags & VXLAN_F_REMCSUM_NOPARTIAL));
1552 return SKB_NOT_DROPPED_YET;
1553 }
1554
vxlan_parse_gbp_hdr(struct sk_buff * skb,u32 vxflags,struct vxlan_metadata * md)1555 static void vxlan_parse_gbp_hdr(struct sk_buff *skb, u32 vxflags,
1556 struct vxlan_metadata *md)
1557 {
1558 const struct vxlanhdr *vh = vxlan_hdr(skb);
1559 const struct vxlanhdr_gbp *gbp;
1560 struct metadata_dst *tun_dst;
1561
1562 gbp = (const struct vxlanhdr_gbp *)vh;
1563
1564 if (!(vh->vx_flags & VXLAN_HF_GBP))
1565 return;
1566
1567 md->gbp = ntohs(gbp->policy_id);
1568
1569 tun_dst = (struct metadata_dst *)skb_dst(skb);
1570 if (tun_dst) {
1571 __set_bit(IP_TUNNEL_VXLAN_OPT_BIT,
1572 tun_dst->u.tun_info.key.tun_flags);
1573 tun_dst->u.tun_info.options_len = sizeof(*md);
1574 }
1575 if (gbp->dont_learn)
1576 md->gbp |= VXLAN_GBP_DONT_LEARN;
1577
1578 if (gbp->policy_applied)
1579 md->gbp |= VXLAN_GBP_POLICY_APPLIED;
1580
1581 /* In flow-based mode, GBP is carried in dst_metadata */
1582 if (!(vxflags & VXLAN_F_COLLECT_METADATA))
1583 skb->mark = md->gbp;
1584 }
1585
vxlan_set_mac(struct vxlan_dev * vxlan,struct vxlan_sock * vs,struct sk_buff * skb,__be32 vni)1586 static enum skb_drop_reason vxlan_set_mac(struct vxlan_dev *vxlan,
1587 struct vxlan_sock *vs,
1588 struct sk_buff *skb, __be32 vni)
1589 {
1590 union vxlan_addr saddr;
1591 u32 ifindex = skb->dev->ifindex;
1592
1593 skb_reset_mac_header(skb);
1594 skb->protocol = eth_type_trans(skb, vxlan->dev);
1595 skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN);
1596
1597 /* Ignore packet loops (and multicast echo) */
1598 if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr))
1599 return SKB_DROP_REASON_LOCAL_MAC;
1600
1601 /* Get address from the outer IP header */
1602 if (vxlan_get_sk_family(vs) == AF_INET) {
1603 saddr.sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
1604 saddr.sa.sa_family = AF_INET;
1605 #if IS_ENABLED(CONFIG_IPV6)
1606 } else {
1607 saddr.sin6.sin6_addr = ipv6_hdr(skb)->saddr;
1608 saddr.sa.sa_family = AF_INET6;
1609 #endif
1610 }
1611
1612 if (!(vxlan->cfg.flags & VXLAN_F_LEARN))
1613 return SKB_NOT_DROPPED_YET;
1614
1615 return vxlan_snoop(skb->dev, &saddr, eth_hdr(skb)->h_source,
1616 ifindex, vni);
1617 }
1618
vxlan_ecn_decapsulate(struct vxlan_sock * vs,void * oiph,struct sk_buff * skb)1619 static bool vxlan_ecn_decapsulate(struct vxlan_sock *vs, void *oiph,
1620 struct sk_buff *skb)
1621 {
1622 int err = 0;
1623
1624 if (vxlan_get_sk_family(vs) == AF_INET)
1625 err = IP_ECN_decapsulate(oiph, skb);
1626 #if IS_ENABLED(CONFIG_IPV6)
1627 else
1628 err = IP6_ECN_decapsulate(oiph, skb);
1629 #endif
1630
1631 if (unlikely(err) && log_ecn_error) {
1632 if (vxlan_get_sk_family(vs) == AF_INET)
1633 net_info_ratelimited("non-ECT from %pI4 with TOS=%#x\n",
1634 &((struct iphdr *)oiph)->saddr,
1635 ((struct iphdr *)oiph)->tos);
1636 else
1637 net_info_ratelimited("non-ECT from %pI6\n",
1638 &((struct ipv6hdr *)oiph)->saddr);
1639 }
1640 return err <= 1;
1641 }
1642
vxlan_rcv(struct sock * sk,struct sk_buff * skb)1643 static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
1644 {
1645 struct vxlan_vni_node *vninode = NULL;
1646 const struct vxlanhdr *vh;
1647 struct vxlan_dev *vxlan;
1648 struct vxlan_sock *vs;
1649 struct vxlan_metadata _md;
1650 struct vxlan_metadata *md = &_md;
1651 __be16 protocol = htons(ETH_P_TEB);
1652 enum skb_drop_reason reason;
1653 bool raw_proto = false;
1654 void *oiph;
1655 __be32 vni = 0;
1656 int nh;
1657
1658 /* Need UDP and VXLAN header to be present */
1659 reason = pskb_may_pull_reason(skb, VXLAN_HLEN);
1660 if (reason)
1661 goto drop;
1662
1663 vh = vxlan_hdr(skb);
1664 /* VNI flag always required to be set */
1665 if (!(vh->vx_flags & VXLAN_HF_VNI)) {
1666 netdev_dbg(skb->dev, "invalid vxlan flags=%#x vni=%#x\n",
1667 ntohl(vh->vx_flags), ntohl(vh->vx_vni));
1668 reason = SKB_DROP_REASON_VXLAN_INVALID_HDR;
1669 /* Return non vxlan pkt */
1670 goto drop;
1671 }
1672
1673 vs = rcu_dereference_sk_user_data(sk);
1674 if (!vs)
1675 goto drop;
1676
1677 vni = vxlan_vni(vh->vx_vni);
1678
1679 vxlan = vxlan_vs_find_vni(vs, skb->dev->ifindex, vni, &vninode);
1680 if (!vxlan) {
1681 reason = SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND;
1682 goto drop;
1683 }
1684
1685 if (vh->vx_flags & vxlan->cfg.reserved_bits.vx_flags ||
1686 vh->vx_vni & vxlan->cfg.reserved_bits.vx_vni) {
1687 /* If the header uses bits besides those enabled by the
1688 * netdevice configuration, treat this as a malformed packet.
1689 * This behavior diverges from VXLAN RFC (RFC7348) which
1690 * stipulates that bits in reserved in reserved fields are to be
1691 * ignored. The approach here maintains compatibility with
1692 * previous stack code, and also is more robust and provides a
1693 * little more security in adding extensions to VXLAN.
1694 */
1695 reason = SKB_DROP_REASON_VXLAN_INVALID_HDR;
1696 DEV_STATS_INC(vxlan->dev, rx_frame_errors);
1697 DEV_STATS_INC(vxlan->dev, rx_errors);
1698 vxlan_vnifilter_count(vxlan, vni, vninode,
1699 VXLAN_VNI_STATS_RX_ERRORS, 0);
1700 goto drop;
1701 }
1702
1703 if (vxlan->cfg.flags & VXLAN_F_GPE) {
1704 if (!vxlan_parse_gpe_proto(vh, &protocol))
1705 goto drop;
1706 raw_proto = true;
1707 }
1708
1709 if (__iptunnel_pull_header(skb, VXLAN_HLEN, protocol, raw_proto,
1710 !net_eq(vxlan->net, dev_net(vxlan->dev)))) {
1711 reason = SKB_DROP_REASON_NOMEM;
1712 goto drop;
1713 }
1714
1715 if (vxlan->cfg.flags & VXLAN_F_REMCSUM_RX) {
1716 reason = vxlan_remcsum(skb, vxlan->cfg.flags);
1717 if (unlikely(reason))
1718 goto drop;
1719 }
1720
1721 if (vxlan_collect_metadata(vs)) {
1722 IP_TUNNEL_DECLARE_FLAGS(flags) = { };
1723 struct metadata_dst *tun_dst;
1724
1725 __set_bit(IP_TUNNEL_KEY_BIT, flags);
1726 tun_dst = udp_tun_rx_dst(skb, vxlan_get_sk_family(vs), flags,
1727 key32_to_tunnel_id(vni), sizeof(*md));
1728
1729 if (!tun_dst) {
1730 reason = SKB_DROP_REASON_NOMEM;
1731 goto drop;
1732 }
1733
1734 md = ip_tunnel_info_opts(&tun_dst->u.tun_info);
1735
1736 skb_dst_set(skb, (struct dst_entry *)tun_dst);
1737 } else {
1738 memset(md, 0, sizeof(*md));
1739 }
1740
1741 if (vxlan->cfg.flags & VXLAN_F_GBP)
1742 vxlan_parse_gbp_hdr(skb, vxlan->cfg.flags, md);
1743 /* Note that GBP and GPE can never be active together. This is
1744 * ensured in vxlan_dev_configure.
1745 */
1746
1747 if (!raw_proto) {
1748 reason = vxlan_set_mac(vxlan, vs, skb, vni);
1749 if (reason)
1750 goto drop;
1751 } else {
1752 skb_reset_mac_header(skb);
1753 skb->dev = vxlan->dev;
1754 skb->pkt_type = PACKET_HOST;
1755 }
1756
1757 /* Save offset of outer header relative to skb->head,
1758 * because we are going to reset the network header to the inner header
1759 * and might change skb->head.
1760 */
1761 nh = skb_network_header(skb) - skb->head;
1762
1763 skb_reset_network_header(skb);
1764
1765 reason = pskb_inet_may_pull_reason(skb);
1766 if (reason) {
1767 DEV_STATS_INC(vxlan->dev, rx_length_errors);
1768 DEV_STATS_INC(vxlan->dev, rx_errors);
1769 vxlan_vnifilter_count(vxlan, vni, vninode,
1770 VXLAN_VNI_STATS_RX_ERRORS, 0);
1771 goto drop;
1772 }
1773
1774 /* Get the outer header. */
1775 oiph = skb->head + nh;
1776
1777 if (!vxlan_ecn_decapsulate(vs, oiph, skb)) {
1778 reason = SKB_DROP_REASON_IP_TUNNEL_ECN;
1779 DEV_STATS_INC(vxlan->dev, rx_frame_errors);
1780 DEV_STATS_INC(vxlan->dev, rx_errors);
1781 vxlan_vnifilter_count(vxlan, vni, vninode,
1782 VXLAN_VNI_STATS_RX_ERRORS, 0);
1783 goto drop;
1784 }
1785
1786 rcu_read_lock();
1787
1788 if (unlikely(!(vxlan->dev->flags & IFF_UP))) {
1789 rcu_read_unlock();
1790 dev_dstats_rx_dropped(vxlan->dev);
1791 vxlan_vnifilter_count(vxlan, vni, vninode,
1792 VXLAN_VNI_STATS_RX_DROPS, 0);
1793 reason = SKB_DROP_REASON_DEV_READY;
1794 goto drop;
1795 }
1796
1797 dev_dstats_rx_add(vxlan->dev, skb->len);
1798 vxlan_vnifilter_count(vxlan, vni, vninode, VXLAN_VNI_STATS_RX, skb->len);
1799 gro_cells_receive(&vxlan->gro_cells, skb);
1800
1801 rcu_read_unlock();
1802
1803 return 0;
1804
1805 drop:
1806 reason = reason ?: SKB_DROP_REASON_NOT_SPECIFIED;
1807 /* Consume bad packet */
1808 kfree_skb_reason(skb, reason);
1809 return 0;
1810 }
1811
vxlan_err_lookup(struct sock * sk,struct sk_buff * skb)1812 static int vxlan_err_lookup(struct sock *sk, struct sk_buff *skb)
1813 {
1814 struct vxlan_dev *vxlan;
1815 struct vxlan_sock *vs;
1816 struct vxlanhdr *hdr;
1817 __be32 vni;
1818
1819 if (!pskb_may_pull(skb, skb_transport_offset(skb) + VXLAN_HLEN))
1820 return -EINVAL;
1821
1822 hdr = vxlan_hdr(skb);
1823
1824 if (!(hdr->vx_flags & VXLAN_HF_VNI))
1825 return -EINVAL;
1826
1827 vs = rcu_dereference_sk_user_data(sk);
1828 if (!vs)
1829 return -ENOENT;
1830
1831 vni = vxlan_vni(hdr->vx_vni);
1832 vxlan = vxlan_vs_find_vni(vs, skb->dev->ifindex, vni, NULL);
1833 if (!vxlan)
1834 return -ENOENT;
1835
1836 return 0;
1837 }
1838
arp_reduce(struct net_device * dev,struct sk_buff * skb,__be32 vni)1839 static int arp_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)
1840 {
1841 struct vxlan_dev *vxlan = netdev_priv(dev);
1842 struct arphdr *parp;
1843 u8 *arpptr, *sha;
1844 __be32 sip, tip;
1845 struct neighbour *n;
1846
1847 if (dev->flags & IFF_NOARP)
1848 goto out;
1849
1850 if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
1851 dev_dstats_tx_dropped(dev);
1852 vxlan_vnifilter_count(vxlan, vni, NULL,
1853 VXLAN_VNI_STATS_TX_DROPS, 0);
1854 goto out;
1855 }
1856 parp = arp_hdr(skb);
1857
1858 if ((parp->ar_hrd != htons(ARPHRD_ETHER) &&
1859 parp->ar_hrd != htons(ARPHRD_IEEE802)) ||
1860 parp->ar_pro != htons(ETH_P_IP) ||
1861 parp->ar_op != htons(ARPOP_REQUEST) ||
1862 parp->ar_hln != dev->addr_len ||
1863 parp->ar_pln != 4)
1864 goto out;
1865 arpptr = (u8 *)parp + sizeof(struct arphdr);
1866 sha = arpptr;
1867 arpptr += dev->addr_len; /* sha */
1868 memcpy(&sip, arpptr, sizeof(sip));
1869 arpptr += sizeof(sip);
1870 arpptr += dev->addr_len; /* tha */
1871 memcpy(&tip, arpptr, sizeof(tip));
1872
1873 if (ipv4_is_loopback(tip) ||
1874 ipv4_is_multicast(tip))
1875 goto out;
1876
1877 n = neigh_lookup(&arp_tbl, &tip, dev);
1878
1879 if (n) {
1880 struct vxlan_rdst *rdst = NULL;
1881 struct vxlan_fdb *f;
1882 struct sk_buff *reply;
1883
1884 if (!(READ_ONCE(n->nud_state) & NUD_CONNECTED)) {
1885 neigh_release(n);
1886 goto out;
1887 }
1888
1889 rcu_read_lock();
1890 f = vxlan_find_mac_tx(vxlan, n->ha, vni);
1891 if (f)
1892 rdst = first_remote_rcu(f);
1893 if (rdst && vxlan_addr_any(&rdst->remote_ip)) {
1894 /* bridge-local neighbor */
1895 neigh_release(n);
1896 rcu_read_unlock();
1897 goto out;
1898 }
1899 rcu_read_unlock();
1900
1901 reply = arp_create(ARPOP_REPLY, ETH_P_ARP, sip, dev, tip, sha,
1902 n->ha, sha);
1903
1904 neigh_release(n);
1905
1906 if (reply == NULL)
1907 goto out;
1908
1909 skb_reset_mac_header(reply);
1910 __skb_pull(reply, skb_network_offset(reply));
1911 reply->ip_summed = CHECKSUM_UNNECESSARY;
1912 reply->pkt_type = PACKET_HOST;
1913
1914 if (netif_rx(reply) == NET_RX_DROP) {
1915 dev_dstats_rx_dropped(dev);
1916 vxlan_vnifilter_count(vxlan, vni, NULL,
1917 VXLAN_VNI_STATS_RX_DROPS, 0);
1918 }
1919
1920 } else if (vxlan->cfg.flags & VXLAN_F_L3MISS) {
1921 union vxlan_addr ipa = {
1922 .sin.sin_addr.s_addr = tip,
1923 .sin.sin_family = AF_INET,
1924 };
1925
1926 vxlan_ip_miss(dev, &ipa);
1927 }
1928 out:
1929 consume_skb(skb);
1930 return NETDEV_TX_OK;
1931 }
1932
1933 #if IS_ENABLED(CONFIG_IPV6)
vxlan_na_create(struct sk_buff * request,struct neighbour * n,bool isrouter)1934 static struct sk_buff *vxlan_na_create(struct sk_buff *request,
1935 struct neighbour *n, bool isrouter)
1936 {
1937 struct net_device *dev = request->dev;
1938 struct sk_buff *reply;
1939 struct nd_msg *ns, *na;
1940 struct ipv6hdr *pip6;
1941 u8 *daddr;
1942 int na_olen = 8; /* opt hdr + ETH_ALEN for target */
1943 int ns_olen;
1944 int i, len;
1945
1946 if (dev == NULL || !pskb_may_pull(request, request->len))
1947 return NULL;
1948
1949 len = LL_RESERVED_SPACE(dev) + sizeof(struct ipv6hdr) +
1950 sizeof(*na) + na_olen + dev->needed_tailroom;
1951 reply = alloc_skb(len, GFP_ATOMIC);
1952 if (reply == NULL)
1953 return NULL;
1954
1955 reply->protocol = htons(ETH_P_IPV6);
1956 reply->dev = dev;
1957 skb_reserve(reply, LL_RESERVED_SPACE(request->dev));
1958 skb_push(reply, sizeof(struct ethhdr));
1959 skb_reset_mac_header(reply);
1960
1961 ns = (struct nd_msg *)(ipv6_hdr(request) + 1);
1962
1963 daddr = eth_hdr(request)->h_source;
1964 ns_olen = request->len - skb_network_offset(request) -
1965 sizeof(struct ipv6hdr) - sizeof(*ns);
1966 for (i = 0; i < ns_olen-1; i += (ns->opt[i+1]<<3)) {
1967 if (!ns->opt[i + 1] || i + (ns->opt[i + 1] << 3) > ns_olen) {
1968 kfree_skb(reply);
1969 return NULL;
1970 }
1971 if (ns->opt[i] == ND_OPT_SOURCE_LL_ADDR) {
1972 if ((ns->opt[i + 1] << 3) >=
1973 sizeof(struct nd_opt_hdr) + ETH_ALEN)
1974 daddr = ns->opt + i + sizeof(struct nd_opt_hdr);
1975 break;
1976 }
1977 }
1978
1979 /* Ethernet header */
1980 ether_addr_copy(eth_hdr(reply)->h_dest, daddr);
1981 ether_addr_copy(eth_hdr(reply)->h_source, n->ha);
1982 eth_hdr(reply)->h_proto = htons(ETH_P_IPV6);
1983 reply->protocol = htons(ETH_P_IPV6);
1984
1985 skb_pull(reply, sizeof(struct ethhdr));
1986 skb_reset_network_header(reply);
1987 skb_put(reply, sizeof(struct ipv6hdr));
1988
1989 /* IPv6 header */
1990
1991 pip6 = ipv6_hdr(reply);
1992 memset(pip6, 0, sizeof(struct ipv6hdr));
1993 pip6->version = 6;
1994 pip6->priority = ipv6_hdr(request)->priority;
1995 pip6->nexthdr = IPPROTO_ICMPV6;
1996 pip6->hop_limit = 255;
1997 pip6->daddr = ipv6_hdr(request)->saddr;
1998 pip6->saddr = *(struct in6_addr *)n->primary_key;
1999
2000 skb_pull(reply, sizeof(struct ipv6hdr));
2001 skb_reset_transport_header(reply);
2002
2003 /* Neighbor Advertisement */
2004 na = skb_put_zero(reply, sizeof(*na) + na_olen);
2005 na->icmph.icmp6_type = NDISC_NEIGHBOUR_ADVERTISEMENT;
2006 na->icmph.icmp6_router = isrouter;
2007 na->icmph.icmp6_override = 1;
2008 na->icmph.icmp6_solicited = 1;
2009 na->target = ns->target;
2010 ether_addr_copy(&na->opt[2], n->ha);
2011 na->opt[0] = ND_OPT_TARGET_LL_ADDR;
2012 na->opt[1] = na_olen >> 3;
2013
2014 na->icmph.icmp6_cksum = csum_ipv6_magic(&pip6->saddr,
2015 &pip6->daddr, sizeof(*na)+na_olen, IPPROTO_ICMPV6,
2016 csum_partial(na, sizeof(*na)+na_olen, 0));
2017
2018 pip6->payload_len = htons(sizeof(*na)+na_olen);
2019
2020 skb_push(reply, sizeof(struct ipv6hdr));
2021
2022 reply->ip_summed = CHECKSUM_UNNECESSARY;
2023
2024 return reply;
2025 }
2026
neigh_reduce(struct net_device * dev,struct sk_buff * skb,__be32 vni)2027 static int neigh_reduce(struct net_device *dev, struct sk_buff *skb, __be32 vni)
2028 {
2029 struct vxlan_dev *vxlan = netdev_priv(dev);
2030 const struct in6_addr *daddr;
2031 const struct ipv6hdr *iphdr;
2032 struct neighbour *n;
2033 struct nd_msg *msg;
2034
2035 rcu_read_lock();
2036 if (unlikely(!ipv6_mod_enabled()))
2037 goto out;
2038
2039 iphdr = ipv6_hdr(skb);
2040 daddr = &iphdr->daddr;
2041 msg = (struct nd_msg *)(iphdr + 1);
2042
2043 if (ipv6_addr_loopback(daddr) ||
2044 ipv6_addr_is_multicast(&msg->target))
2045 goto out;
2046
2047 n = neigh_lookup(&nd_tbl, &msg->target, dev);
2048
2049 if (n) {
2050 struct vxlan_rdst *rdst = NULL;
2051 struct vxlan_fdb *f;
2052 struct sk_buff *reply;
2053
2054 if (!(READ_ONCE(n->nud_state) & NUD_CONNECTED)) {
2055 neigh_release(n);
2056 goto out;
2057 }
2058
2059 f = vxlan_find_mac_tx(vxlan, n->ha, vni);
2060 if (f)
2061 rdst = first_remote_rcu(f);
2062 if (rdst && vxlan_addr_any(&rdst->remote_ip)) {
2063 /* bridge-local neighbor */
2064 neigh_release(n);
2065 goto out;
2066 }
2067
2068 reply = vxlan_na_create(skb, n,
2069 !!(f ? f->flags & NTF_ROUTER : 0));
2070
2071 neigh_release(n);
2072
2073 if (reply == NULL)
2074 goto out;
2075
2076 if (netif_rx(reply) == NET_RX_DROP) {
2077 dev_dstats_rx_dropped(dev);
2078 vxlan_vnifilter_count(vxlan, vni, NULL,
2079 VXLAN_VNI_STATS_RX_DROPS, 0);
2080 }
2081 } else if (vxlan->cfg.flags & VXLAN_F_L3MISS) {
2082 union vxlan_addr ipa = {
2083 .sin6.sin6_addr = msg->target,
2084 .sin6.sin6_family = AF_INET6,
2085 };
2086
2087 vxlan_ip_miss(dev, &ipa);
2088 }
2089
2090 out:
2091 rcu_read_unlock();
2092 consume_skb(skb);
2093 return NETDEV_TX_OK;
2094 }
2095 #endif
2096
route_shortcircuit(struct net_device * dev,struct sk_buff * skb)2097 static bool route_shortcircuit(struct net_device *dev, struct sk_buff *skb)
2098 {
2099 struct vxlan_dev *vxlan = netdev_priv(dev);
2100 struct neighbour *n;
2101
2102 if (is_multicast_ether_addr(eth_hdr(skb)->h_dest))
2103 return false;
2104
2105 n = NULL;
2106 switch (ntohs(eth_hdr(skb)->h_proto)) {
2107 case ETH_P_IP:
2108 {
2109 struct iphdr *pip;
2110
2111 if (!pskb_may_pull(skb, sizeof(struct iphdr)))
2112 return false;
2113 pip = ip_hdr(skb);
2114 n = neigh_lookup(&arp_tbl, &pip->daddr, dev);
2115 if (!n && (vxlan->cfg.flags & VXLAN_F_L3MISS)) {
2116 union vxlan_addr ipa = {
2117 .sin.sin_addr.s_addr = pip->daddr,
2118 .sin.sin_family = AF_INET,
2119 };
2120
2121 vxlan_ip_miss(dev, &ipa);
2122 return false;
2123 }
2124
2125 break;
2126 }
2127 #if IS_ENABLED(CONFIG_IPV6)
2128 case ETH_P_IPV6:
2129 {
2130 struct ipv6hdr *pip6;
2131
2132 /* check if ipv6.disable=1 set during boot was set
2133 * during booting so nd_tbl is not initialized
2134 */
2135 if (!ipv6_mod_enabled())
2136 return false;
2137 if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
2138 return false;
2139 pip6 = ipv6_hdr(skb);
2140 n = neigh_lookup(&nd_tbl, &pip6->daddr, dev);
2141 if (!n && (vxlan->cfg.flags & VXLAN_F_L3MISS)) {
2142 union vxlan_addr ipa = {
2143 .sin6.sin6_addr = pip6->daddr,
2144 .sin6.sin6_family = AF_INET6,
2145 };
2146
2147 vxlan_ip_miss(dev, &ipa);
2148 return false;
2149 }
2150
2151 break;
2152 }
2153 #endif
2154 default:
2155 return false;
2156 }
2157
2158 if (n) {
2159 bool diff;
2160
2161 diff = !ether_addr_equal(eth_hdr(skb)->h_dest, n->ha);
2162 if (diff) {
2163 memcpy(eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
2164 dev->addr_len);
2165 memcpy(eth_hdr(skb)->h_dest, n->ha, dev->addr_len);
2166 }
2167 neigh_release(n);
2168 return diff;
2169 }
2170
2171 return false;
2172 }
2173
vxlan_build_gpe_hdr(struct vxlanhdr * vxh,__be16 protocol)2174 static int vxlan_build_gpe_hdr(struct vxlanhdr *vxh, __be16 protocol)
2175 {
2176 struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)vxh;
2177
2178 gpe->np_applied = 1;
2179 gpe->next_protocol = tun_p_from_eth_p(protocol);
2180 if (!gpe->next_protocol)
2181 return -EPFNOSUPPORT;
2182 return 0;
2183 }
2184
vxlan_build_skb(struct sk_buff * skb,struct dst_entry * dst,int iphdr_len,__be32 vni,struct vxlan_metadata * md,u32 vxflags,bool udp_sum)2185 static int vxlan_build_skb(struct sk_buff *skb, struct dst_entry *dst,
2186 int iphdr_len, __be32 vni,
2187 struct vxlan_metadata *md, u32 vxflags,
2188 bool udp_sum)
2189 {
2190 int type = udp_sum ? SKB_GSO_UDP_TUNNEL_CSUM : SKB_GSO_UDP_TUNNEL;
2191 __be16 inner_protocol = htons(ETH_P_TEB);
2192 struct vxlanhdr *vxh;
2193 bool double_encap;
2194 int min_headroom;
2195 int err;
2196
2197 if ((vxflags & VXLAN_F_REMCSUM_TX) &&
2198 skb->ip_summed == CHECKSUM_PARTIAL) {
2199 int csum_start = skb_checksum_start_offset(skb);
2200
2201 if (csum_start <= VXLAN_MAX_REMCSUM_START &&
2202 !(csum_start & VXLAN_RCO_SHIFT_MASK) &&
2203 (skb->csum_offset == offsetof(struct udphdr, check) ||
2204 skb->csum_offset == offsetof(struct tcphdr, check)))
2205 type |= SKB_GSO_TUNNEL_REMCSUM;
2206 }
2207
2208 min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len
2209 + VXLAN_HLEN + iphdr_len;
2210
2211 /* Need space for new headers (invalidates iph ptr) */
2212 err = skb_cow_head(skb, min_headroom);
2213 if (unlikely(err))
2214 return err;
2215
2216 double_encap = udp_tunnel_handle_partial(skb);
2217 err = iptunnel_handle_offloads(skb, type);
2218 if (err)
2219 return err;
2220
2221 vxh = __skb_push(skb, sizeof(*vxh));
2222 vxh->vx_flags = VXLAN_HF_VNI;
2223 vxh->vx_vni = vxlan_vni_field(vni);
2224
2225 if (type & SKB_GSO_TUNNEL_REMCSUM) {
2226 unsigned int start;
2227
2228 start = skb_checksum_start_offset(skb) - sizeof(struct vxlanhdr);
2229 vxh->vx_vni |= vxlan_compute_rco(start, skb->csum_offset);
2230 vxh->vx_flags |= VXLAN_HF_RCO;
2231
2232 if (!skb_is_gso(skb)) {
2233 skb->ip_summed = CHECKSUM_NONE;
2234 skb->encapsulation = 0;
2235 }
2236 }
2237
2238 if (vxflags & VXLAN_F_GBP)
2239 vxlan_build_gbp_hdr(vxh, md);
2240 if (vxflags & VXLAN_F_GPE) {
2241 err = vxlan_build_gpe_hdr(vxh, skb->protocol);
2242 if (err < 0)
2243 return err;
2244 inner_protocol = skb->protocol;
2245 }
2246
2247 udp_tunnel_set_inner_protocol(skb, double_encap, inner_protocol);
2248 return 0;
2249 }
2250
2251 /* Bypass encapsulation if the destination is local */
vxlan_encap_bypass(struct sk_buff * skb,struct vxlan_dev * src_vxlan,struct vxlan_dev * dst_vxlan,__be32 vni,bool snoop)2252 static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
2253 struct vxlan_dev *dst_vxlan, __be32 vni,
2254 bool snoop)
2255 {
2256 union vxlan_addr loopback;
2257 union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
2258 unsigned int len = skb->len;
2259 struct net_device *dev;
2260
2261 skb->pkt_type = PACKET_HOST;
2262 skb->encapsulation = 0;
2263 skb->dev = dst_vxlan->dev;
2264 __skb_pull(skb, skb_network_offset(skb));
2265
2266 if (remote_ip->sa.sa_family == AF_INET) {
2267 loopback.sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
2268 loopback.sa.sa_family = AF_INET;
2269 #if IS_ENABLED(CONFIG_IPV6)
2270 } else {
2271 loopback.sin6.sin6_addr = in6addr_loopback;
2272 loopback.sa.sa_family = AF_INET6;
2273 #endif
2274 }
2275
2276 rcu_read_lock();
2277 dev = skb->dev;
2278 if (unlikely(!(dev->flags & IFF_UP))) {
2279 kfree_skb_reason(skb, SKB_DROP_REASON_DEV_READY);
2280 goto drop;
2281 }
2282
2283 if ((dst_vxlan->cfg.flags & VXLAN_F_LEARN) && snoop)
2284 vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni);
2285
2286 dev_dstats_tx_add(src_vxlan->dev, len);
2287 vxlan_vnifilter_count(src_vxlan, vni, NULL, VXLAN_VNI_STATS_TX, len);
2288
2289 if (__netif_rx(skb) == NET_RX_SUCCESS) {
2290 dev_dstats_rx_add(dst_vxlan->dev, len);
2291 vxlan_vnifilter_count(dst_vxlan, vni, NULL, VXLAN_VNI_STATS_RX,
2292 len);
2293 } else {
2294 drop:
2295 dev_dstats_rx_dropped(dev);
2296 vxlan_vnifilter_count(dst_vxlan, vni, NULL,
2297 VXLAN_VNI_STATS_RX_DROPS, 0);
2298 }
2299 rcu_read_unlock();
2300 }
2301
encap_bypass_if_local(struct sk_buff * skb,struct net_device * dev,struct vxlan_dev * vxlan,int addr_family,__be16 dst_port,int dst_ifindex,__be32 vni,struct dst_entry * dst,u32 rt_flags)2302 static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev,
2303 struct vxlan_dev *vxlan,
2304 int addr_family,
2305 __be16 dst_port, int dst_ifindex, __be32 vni,
2306 struct dst_entry *dst,
2307 u32 rt_flags)
2308 {
2309 #if IS_ENABLED(CONFIG_IPV6)
2310 /* IPv6 rt-flags are checked against RTF_LOCAL, but the value of
2311 * RTF_LOCAL is equal to RTCF_LOCAL. So to keep code simple
2312 * we can use RTCF_LOCAL which works for ipv4 and ipv6 route entry.
2313 */
2314 BUILD_BUG_ON(RTCF_LOCAL != RTF_LOCAL);
2315 #endif
2316 /* Bypass encapsulation if the destination is local */
2317 if (rt_flags & RTCF_LOCAL &&
2318 !(rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST)) &&
2319 vxlan->cfg.flags & VXLAN_F_LOCALBYPASS) {
2320 struct vxlan_dev *dst_vxlan;
2321
2322 dst_release(dst);
2323 dst_vxlan = vxlan_find_vni(vxlan->net, dst_ifindex, vni,
2324 addr_family, dst_port,
2325 vxlan->cfg.flags);
2326 if (!dst_vxlan) {
2327 DEV_STATS_INC(dev, tx_errors);
2328 vxlan_vnifilter_count(vxlan, vni, NULL,
2329 VXLAN_VNI_STATS_TX_ERRORS, 0);
2330 kfree_skb_reason(skb, SKB_DROP_REASON_VXLAN_VNI_NOT_FOUND);
2331
2332 return -ENOENT;
2333 }
2334 vxlan_encap_bypass(skb, vxlan, dst_vxlan, vni, true);
2335 return 1;
2336 }
2337
2338 return 0;
2339 }
2340
vxlan_xmit_one(struct sk_buff * skb,struct net_device * dev,__be32 default_vni,struct vxlan_rdst * rdst,bool did_rsc)2341 void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
2342 __be32 default_vni, struct vxlan_rdst *rdst, bool did_rsc)
2343 {
2344 struct dst_cache *dst_cache;
2345 struct ip_tunnel_info *info;
2346 struct ip_tunnel_key *pkey;
2347 struct ip_tunnel_key key;
2348 struct vxlan_dev *vxlan = netdev_priv(dev);
2349 const struct iphdr *old_iph;
2350 struct vxlan_metadata _md;
2351 struct vxlan_metadata *md = &_md;
2352 unsigned int pkt_len = skb->len;
2353 __be16 src_port = 0, dst_port;
2354 struct dst_entry *ndst = NULL;
2355 int addr_family;
2356 __u8 tos, ttl;
2357 int ifindex;
2358 int err = 0;
2359 u32 flags = vxlan->cfg.flags;
2360 bool use_cache;
2361 bool udp_sum = false;
2362 bool xnet = !net_eq(vxlan->net, dev_net(vxlan->dev));
2363 enum skb_drop_reason reason;
2364 bool no_eth_encap;
2365 __be32 vni = 0;
2366
2367 no_eth_encap = flags & VXLAN_F_GPE && skb->protocol != htons(ETH_P_TEB);
2368 reason = skb_vlan_inet_prepare(skb, no_eth_encap);
2369 if (reason)
2370 goto drop;
2371
2372 reason = SKB_DROP_REASON_NOT_SPECIFIED;
2373 old_iph = ip_hdr(skb);
2374
2375 info = skb_tunnel_info(skb);
2376 use_cache = ip_tunnel_dst_cache_usable(skb, info);
2377
2378 if (rdst) {
2379 memset(&key, 0, sizeof(key));
2380 pkey = &key;
2381
2382 if (vxlan_addr_any(&rdst->remote_ip)) {
2383 if (did_rsc) {
2384 /* short-circuited back to local bridge */
2385 vxlan_encap_bypass(skb, vxlan, vxlan,
2386 default_vni, true);
2387 return;
2388 }
2389 goto drop;
2390 }
2391
2392 addr_family = vxlan->cfg.saddr.sa.sa_family;
2393 dst_port = rdst->remote_port ? rdst->remote_port : vxlan->cfg.dst_port;
2394 vni = (rdst->remote_vni) ? : default_vni;
2395 ifindex = rdst->remote_ifindex;
2396
2397 if (addr_family == AF_INET) {
2398 key.u.ipv4.src = vxlan->cfg.saddr.sin.sin_addr.s_addr;
2399 key.u.ipv4.dst = rdst->remote_ip.sin.sin_addr.s_addr;
2400 } else {
2401 key.u.ipv6.src = vxlan->cfg.saddr.sin6.sin6_addr;
2402 key.u.ipv6.dst = rdst->remote_ip.sin6.sin6_addr;
2403 }
2404
2405 dst_cache = &rdst->dst_cache;
2406 md->gbp = skb->mark;
2407 if (flags & VXLAN_F_TTL_INHERIT) {
2408 ttl = ip_tunnel_get_ttl(old_iph, skb);
2409 } else {
2410 ttl = vxlan->cfg.ttl;
2411 if (!ttl && vxlan_addr_multicast(&rdst->remote_ip))
2412 ttl = 1;
2413 }
2414 tos = vxlan->cfg.tos;
2415 if (tos == 1)
2416 tos = ip_tunnel_get_dsfield(old_iph, skb);
2417 if (tos && !info)
2418 use_cache = false;
2419
2420 if (addr_family == AF_INET)
2421 udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM_TX);
2422 else
2423 udp_sum = !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
2424 #if IS_ENABLED(CONFIG_IPV6)
2425 switch (vxlan->cfg.label_policy) {
2426 case VXLAN_LABEL_FIXED:
2427 key.label = vxlan->cfg.label;
2428 break;
2429 case VXLAN_LABEL_INHERIT:
2430 key.label = ip_tunnel_get_flowlabel(old_iph, skb);
2431 break;
2432 default:
2433 DEBUG_NET_WARN_ON_ONCE(1);
2434 goto drop;
2435 }
2436 #endif
2437 } else {
2438 if (!info) {
2439 WARN_ONCE(1, "%s: Missing encapsulation instructions\n",
2440 dev->name);
2441 goto drop;
2442 }
2443 pkey = &info->key;
2444 addr_family = ip_tunnel_info_af(info);
2445 dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port;
2446 vni = tunnel_id_to_key32(info->key.tun_id);
2447 ifindex = 0;
2448 dst_cache = &info->dst_cache;
2449 if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info->key.tun_flags)) {
2450 if (info->options_len < sizeof(*md))
2451 goto drop;
2452 md = ip_tunnel_info_opts(info);
2453 }
2454 ttl = info->key.ttl;
2455 tos = info->key.tos;
2456 udp_sum = test_bit(IP_TUNNEL_CSUM_BIT, info->key.tun_flags);
2457 }
2458 src_port = udp_flow_src_port(dev_net(dev), skb, vxlan->cfg.port_min,
2459 vxlan->cfg.port_max, true);
2460
2461 rcu_read_lock();
2462 if (addr_family == AF_INET) {
2463 struct vxlan_sock *sock4;
2464 u16 ipcb_flags = 0;
2465 struct rtable *rt;
2466 __be16 df = 0;
2467 __be32 saddr;
2468
2469 sock4 = rcu_dereference(vxlan->vn4_sock);
2470 if (unlikely(!sock4)) {
2471 reason = SKB_DROP_REASON_DEV_READY;
2472 goto tx_error;
2473 }
2474
2475 if (!ifindex)
2476 ifindex = sock4->sock->sk->sk_bound_dev_if;
2477
2478 rt = udp_tunnel_dst_lookup(skb, dev, vxlan->net, ifindex,
2479 &saddr, pkey, src_port, dst_port,
2480 tos, use_cache ? dst_cache : NULL);
2481 if (IS_ERR(rt)) {
2482 err = PTR_ERR(rt);
2483 reason = SKB_DROP_REASON_IP_OUTNOROUTES;
2484 goto tx_error;
2485 }
2486
2487 if (flags & VXLAN_F_MC_ROUTE)
2488 ipcb_flags |= IPSKB_MCROUTE;
2489
2490 if (!info) {
2491 /* Bypass encapsulation if the destination is local */
2492 err = encap_bypass_if_local(skb, dev, vxlan, AF_INET,
2493 dst_port, ifindex, vni,
2494 &rt->dst, rt->rt_flags);
2495 if (err)
2496 goto out_unlock;
2497
2498 if (vxlan->cfg.df == VXLAN_DF_SET) {
2499 df = htons(IP_DF);
2500 } else if (vxlan->cfg.df == VXLAN_DF_INHERIT) {
2501 struct ethhdr *eth = eth_hdr(skb);
2502
2503 if (ntohs(eth->h_proto) == ETH_P_IPV6 ||
2504 (ntohs(eth->h_proto) == ETH_P_IP &&
2505 old_iph->frag_off & htons(IP_DF)))
2506 df = htons(IP_DF);
2507 }
2508 } else if (test_bit(IP_TUNNEL_DONT_FRAGMENT_BIT,
2509 info->key.tun_flags)) {
2510 df = htons(IP_DF);
2511 }
2512
2513 ndst = &rt->dst;
2514 err = skb_tunnel_check_pmtu(skb, ndst, vxlan_headroom(flags & VXLAN_F_GPE),
2515 netif_is_any_bridge_port(dev));
2516 if (err < 0) {
2517 goto tx_error;
2518 } else if (err) {
2519 if (info) {
2520 struct ip_tunnel_info *unclone;
2521
2522 unclone = skb_tunnel_info_unclone(skb);
2523 if (unlikely(!unclone))
2524 goto tx_error;
2525
2526 unclone->key.u.ipv4.src = pkey->u.ipv4.dst;
2527 unclone->key.u.ipv4.dst = saddr;
2528 }
2529 vxlan_encap_bypass(skb, vxlan, vxlan, vni, false);
2530 dst_release(ndst);
2531 goto out_unlock;
2532 }
2533
2534 tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
2535 ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
2536 err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
2537 vni, md, flags, udp_sum);
2538 if (err < 0) {
2539 reason = SKB_DROP_REASON_NOMEM;
2540 goto tx_error;
2541 }
2542
2543 udp_tunnel_xmit_skb(rt, sock4->sock->sk, skb, saddr,
2544 pkey->u.ipv4.dst, tos, ttl, df,
2545 src_port, dst_port, xnet, !udp_sum,
2546 ipcb_flags);
2547 #if IS_ENABLED(CONFIG_IPV6)
2548 } else {
2549 struct vxlan_sock *sock6;
2550 struct in6_addr saddr;
2551 u16 ip6cb_flags = 0;
2552
2553 sock6 = rcu_dereference(vxlan->vn6_sock);
2554 if (unlikely(!sock6)) {
2555 reason = SKB_DROP_REASON_DEV_READY;
2556 goto tx_error;
2557 }
2558
2559 if (!ifindex)
2560 ifindex = sock6->sock->sk->sk_bound_dev_if;
2561
2562 ndst = udp_tunnel6_dst_lookup(skb, dev, vxlan->net, sock6->sock,
2563 ifindex, &saddr, pkey,
2564 src_port, dst_port, tos,
2565 use_cache ? dst_cache : NULL);
2566 if (IS_ERR(ndst)) {
2567 err = PTR_ERR(ndst);
2568 ndst = NULL;
2569 reason = SKB_DROP_REASON_IP_OUTNOROUTES;
2570 goto tx_error;
2571 }
2572
2573 if (flags & VXLAN_F_MC_ROUTE)
2574 ip6cb_flags |= IP6SKB_MCROUTE;
2575
2576 if (!info) {
2577 u32 rt6i_flags = dst_rt6_info(ndst)->rt6i_flags;
2578
2579 err = encap_bypass_if_local(skb, dev, vxlan, AF_INET6,
2580 dst_port, ifindex, vni,
2581 ndst, rt6i_flags);
2582 if (err)
2583 goto out_unlock;
2584 }
2585
2586 err = skb_tunnel_check_pmtu(skb, ndst,
2587 vxlan_headroom((flags & VXLAN_F_GPE) | VXLAN_F_IPV6),
2588 netif_is_any_bridge_port(dev));
2589 if (err < 0) {
2590 goto tx_error;
2591 } else if (err) {
2592 if (info) {
2593 struct ip_tunnel_info *unclone;
2594
2595 unclone = skb_tunnel_info_unclone(skb);
2596 if (unlikely(!unclone))
2597 goto tx_error;
2598
2599 unclone->key.u.ipv6.src = pkey->u.ipv6.dst;
2600 unclone->key.u.ipv6.dst = saddr;
2601 }
2602
2603 vxlan_encap_bypass(skb, vxlan, vxlan, vni, false);
2604 dst_release(ndst);
2605 goto out_unlock;
2606 }
2607
2608 tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
2609 ttl = ttl ? : ip6_dst_hoplimit(ndst);
2610 skb_scrub_packet(skb, xnet);
2611 err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
2612 vni, md, flags, udp_sum);
2613 if (err < 0) {
2614 reason = SKB_DROP_REASON_NOMEM;
2615 goto tx_error;
2616 }
2617
2618 udp_tunnel6_xmit_skb(ndst, sock6->sock->sk, skb, dev,
2619 &saddr, &pkey->u.ipv6.dst, tos, ttl,
2620 pkey->label, src_port, dst_port, !udp_sum,
2621 ip6cb_flags);
2622 #endif
2623 }
2624 vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX, pkt_len);
2625 out_unlock:
2626 rcu_read_unlock();
2627 return;
2628
2629 drop:
2630 dev_dstats_tx_dropped(dev);
2631 vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_DROPS, 0);
2632 kfree_skb_reason(skb, reason);
2633 return;
2634
2635 tx_error:
2636 rcu_read_unlock();
2637 if (err == -ELOOP)
2638 DEV_STATS_INC(dev, collisions);
2639 else if (err == -ENETUNREACH)
2640 DEV_STATS_INC(dev, tx_carrier_errors);
2641 dst_release(ndst);
2642 DEV_STATS_INC(dev, tx_errors);
2643 vxlan_vnifilter_count(vxlan, vni, NULL, VXLAN_VNI_STATS_TX_ERRORS, 0);
2644 kfree_skb_reason(skb, reason);
2645 }
2646
vxlan_xmit_nh(struct sk_buff * skb,struct net_device * dev,struct vxlan_fdb * f,__be32 vni,bool did_rsc)2647 static void vxlan_xmit_nh(struct sk_buff *skb, struct net_device *dev,
2648 struct vxlan_fdb *f, __be32 vni, bool did_rsc)
2649 {
2650 struct vxlan_rdst nh_rdst;
2651 struct nexthop *nh;
2652 bool do_xmit;
2653 u32 hash;
2654
2655 memset(&nh_rdst, 0, sizeof(struct vxlan_rdst));
2656 hash = skb_get_hash(skb);
2657
2658 nh = rcu_dereference(f->nh);
2659 if (!nh)
2660 goto drop;
2661 do_xmit = vxlan_fdb_nh_path_select(nh, hash, &nh_rdst);
2662
2663 if (likely(do_xmit))
2664 vxlan_xmit_one(skb, dev, vni, &nh_rdst, did_rsc);
2665 else
2666 goto drop;
2667
2668 return;
2669
2670 drop:
2671 dev_dstats_tx_dropped(dev);
2672 vxlan_vnifilter_count(netdev_priv(dev), vni, NULL,
2673 VXLAN_VNI_STATS_TX_DROPS, 0);
2674 dev_kfree_skb(skb);
2675 }
2676
vxlan_xmit_nhid(struct sk_buff * skb,struct net_device * dev,u32 nhid,__be32 vni)2677 static netdev_tx_t vxlan_xmit_nhid(struct sk_buff *skb, struct net_device *dev,
2678 u32 nhid, __be32 vni)
2679 {
2680 struct vxlan_dev *vxlan = netdev_priv(dev);
2681 struct vxlan_rdst nh_rdst;
2682 struct nexthop *nh;
2683 bool do_xmit;
2684 u32 hash;
2685
2686 memset(&nh_rdst, 0, sizeof(struct vxlan_rdst));
2687 hash = skb_get_hash(skb);
2688
2689 rcu_read_lock();
2690 nh = nexthop_find_by_id(dev_net(dev), nhid);
2691 if (unlikely(!nh || !nexthop_is_fdb(nh) || !nexthop_is_multipath(nh))) {
2692 rcu_read_unlock();
2693 goto drop;
2694 }
2695 do_xmit = vxlan_fdb_nh_path_select(nh, hash, &nh_rdst);
2696 rcu_read_unlock();
2697
2698 if (vxlan->cfg.saddr.sa.sa_family != nh_rdst.remote_ip.sa.sa_family)
2699 goto drop;
2700
2701 if (likely(do_xmit))
2702 vxlan_xmit_one(skb, dev, vni, &nh_rdst, false);
2703 else
2704 goto drop;
2705
2706 return NETDEV_TX_OK;
2707
2708 drop:
2709 dev_dstats_tx_dropped(dev);
2710 vxlan_vnifilter_count(netdev_priv(dev), vni, NULL,
2711 VXLAN_VNI_STATS_TX_DROPS, 0);
2712 dev_kfree_skb(skb);
2713 return NETDEV_TX_OK;
2714 }
2715
2716 /* Transmit local packets over Vxlan
2717 *
2718 * Outer IP header inherits ECN and DF from inner header.
2719 * Outer UDP destination is the VXLAN assigned port.
2720 * source port is based on hash of flow
2721 */
vxlan_xmit(struct sk_buff * skb,struct net_device * dev)2722 static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
2723 {
2724 struct vxlan_dev *vxlan = netdev_priv(dev);
2725 struct vxlan_rdst *rdst, *fdst = NULL;
2726 const struct ip_tunnel_info *info;
2727 struct vxlan_fdb *f;
2728 struct ethhdr *eth;
2729 __be32 vni = 0;
2730 u32 nhid = 0;
2731 bool did_rsc;
2732
2733 info = skb_tunnel_info(skb);
2734
2735 skb_reset_mac_header(skb);
2736
2737 if (vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA) {
2738 if (info && info->mode & IP_TUNNEL_INFO_BRIDGE &&
2739 info->mode & IP_TUNNEL_INFO_TX) {
2740 vni = tunnel_id_to_key32(info->key.tun_id);
2741 nhid = info->key.nhid;
2742 } else {
2743 if (info && info->mode & IP_TUNNEL_INFO_TX)
2744 vxlan_xmit_one(skb, dev, vni, NULL, false);
2745 else
2746 kfree_skb_reason(skb, SKB_DROP_REASON_TUNNEL_TXINFO);
2747 return NETDEV_TX_OK;
2748 }
2749 }
2750
2751 if (vxlan->cfg.flags & VXLAN_F_PROXY) {
2752 eth = eth_hdr(skb);
2753 if (ntohs(eth->h_proto) == ETH_P_ARP)
2754 return arp_reduce(dev, skb, vni);
2755 #if IS_ENABLED(CONFIG_IPV6)
2756 else if (ntohs(eth->h_proto) == ETH_P_IPV6 &&
2757 pskb_may_pull(skb, sizeof(struct ipv6hdr) +
2758 sizeof(struct nd_msg)) &&
2759 ipv6_hdr(skb)->nexthdr == IPPROTO_ICMPV6) {
2760 struct nd_msg *m = (struct nd_msg *)(ipv6_hdr(skb) + 1);
2761
2762 if (m->icmph.icmp6_code == 0 &&
2763 m->icmph.icmp6_type == NDISC_NEIGHBOUR_SOLICITATION)
2764 return neigh_reduce(dev, skb, vni);
2765 }
2766 #endif
2767 }
2768
2769 if (nhid)
2770 return vxlan_xmit_nhid(skb, dev, nhid, vni);
2771
2772 if (vxlan->cfg.flags & VXLAN_F_MDB) {
2773 struct vxlan_mdb_entry *mdb_entry;
2774
2775 rcu_read_lock();
2776 mdb_entry = vxlan_mdb_entry_skb_get(vxlan, skb, vni);
2777 if (mdb_entry) {
2778 netdev_tx_t ret;
2779
2780 ret = vxlan_mdb_xmit(vxlan, mdb_entry, skb);
2781 rcu_read_unlock();
2782 return ret;
2783 }
2784 rcu_read_unlock();
2785 }
2786
2787 eth = eth_hdr(skb);
2788 rcu_read_lock();
2789 f = vxlan_find_mac_tx(vxlan, eth->h_dest, vni);
2790 did_rsc = false;
2791
2792 if (f && (f->flags & NTF_ROUTER) && (vxlan->cfg.flags & VXLAN_F_RSC) &&
2793 (ntohs(eth->h_proto) == ETH_P_IP ||
2794 ntohs(eth->h_proto) == ETH_P_IPV6)) {
2795 did_rsc = route_shortcircuit(dev, skb);
2796 if (did_rsc)
2797 f = vxlan_find_mac_tx(vxlan, eth->h_dest, vni);
2798 }
2799
2800 if (f == NULL) {
2801 f = vxlan_find_mac_tx(vxlan, all_zeros_mac, vni);
2802 if (f == NULL) {
2803 if ((vxlan->cfg.flags & VXLAN_F_L2MISS) &&
2804 !is_multicast_ether_addr(eth->h_dest))
2805 vxlan_fdb_miss(vxlan, eth->h_dest);
2806
2807 dev_dstats_tx_dropped(dev);
2808 vxlan_vnifilter_count(vxlan, vni, NULL,
2809 VXLAN_VNI_STATS_TX_DROPS, 0);
2810 kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET);
2811 goto out;
2812 }
2813 }
2814
2815 if (rcu_access_pointer(f->nh)) {
2816 vxlan_xmit_nh(skb, dev, f,
2817 (vni ? : vxlan->default_dst.remote_vni), did_rsc);
2818 } else {
2819 list_for_each_entry_rcu(rdst, &f->remotes, list) {
2820 struct sk_buff *skb1;
2821
2822 if (!fdst) {
2823 fdst = rdst;
2824 continue;
2825 }
2826 skb1 = skb_clone(skb, GFP_ATOMIC);
2827 if (skb1)
2828 vxlan_xmit_one(skb1, dev, vni, rdst, did_rsc);
2829 }
2830 if (fdst)
2831 vxlan_xmit_one(skb, dev, vni, fdst, did_rsc);
2832 else
2833 kfree_skb_reason(skb, SKB_DROP_REASON_NO_TX_TARGET);
2834 }
2835
2836 out:
2837 rcu_read_unlock();
2838 return NETDEV_TX_OK;
2839 }
2840
2841 /* Walk the forwarding table and purge stale entries */
vxlan_cleanup(struct timer_list * t)2842 static void vxlan_cleanup(struct timer_list *t)
2843 {
2844 struct vxlan_dev *vxlan = timer_container_of(vxlan, t, age_timer);
2845 unsigned long next_timer = jiffies + FDB_AGE_INTERVAL;
2846 struct vxlan_fdb *f;
2847
2848 if (!netif_running(vxlan->dev))
2849 return;
2850
2851 rcu_read_lock();
2852 hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) {
2853 unsigned long timeout;
2854
2855 if (f->state & (NUD_PERMANENT | NUD_NOARP))
2856 continue;
2857
2858 if (f->flags & NTF_EXT_LEARNED)
2859 continue;
2860
2861 timeout = READ_ONCE(f->updated) + vxlan->cfg.age_interval * HZ;
2862 if (time_before_eq(timeout, jiffies)) {
2863 spin_lock(&vxlan->hash_lock);
2864 if (!hlist_unhashed(&f->fdb_node)) {
2865 netdev_dbg(vxlan->dev, "garbage collect %pM\n",
2866 f->key.eth_addr);
2867 f->state = NUD_STALE;
2868 vxlan_fdb_destroy(vxlan, f, true, true);
2869 }
2870 spin_unlock(&vxlan->hash_lock);
2871 } else if (time_before(timeout, next_timer)) {
2872 next_timer = timeout;
2873 }
2874 }
2875 rcu_read_unlock();
2876
2877 mod_timer(&vxlan->age_timer, next_timer);
2878 }
2879
vxlan_vs_del_dev(struct vxlan_dev * vxlan)2880 static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
2881 {
2882 ASSERT_RTNL();
2883
2884 hlist_del_init_rcu(&vxlan->hlist4.hlist);
2885 #if IS_ENABLED(CONFIG_IPV6)
2886 hlist_del_init_rcu(&vxlan->hlist6.hlist);
2887 #endif
2888 }
2889
vxlan_vs_add_dev(struct vxlan_sock * vs,struct vxlan_dev * vxlan,struct vxlan_dev_node * node)2890 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan,
2891 struct vxlan_dev_node *node)
2892 {
2893 __be32 vni = vxlan->default_dst.remote_vni;
2894
2895 ASSERT_RTNL();
2896
2897 node->vxlan = vxlan;
2898 hlist_add_head_rcu(&node->hlist, vni_head(vs, vni));
2899 }
2900
2901 /* Setup stats when device is created */
vxlan_init(struct net_device * dev)2902 static int vxlan_init(struct net_device *dev)
2903 {
2904 struct vxlan_dev *vxlan = netdev_priv(dev);
2905 int err;
2906
2907 err = rhashtable_init(&vxlan->fdb_hash_tbl, &vxlan_fdb_rht_params);
2908 if (err)
2909 return err;
2910
2911 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
2912 err = vxlan_vnigroup_init(vxlan);
2913 if (err)
2914 goto err_rhashtable_destroy;
2915 }
2916
2917 err = gro_cells_init(&vxlan->gro_cells, dev);
2918 if (err)
2919 goto err_vnigroup_uninit;
2920
2921 err = vxlan_mdb_init(vxlan);
2922 if (err)
2923 goto err_gro_cells_destroy;
2924
2925 netdev_lockdep_set_classes(dev);
2926 return 0;
2927
2928 err_gro_cells_destroy:
2929 gro_cells_destroy(&vxlan->gro_cells);
2930 err_vnigroup_uninit:
2931 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
2932 vxlan_vnigroup_uninit(vxlan);
2933 err_rhashtable_destroy:
2934 rhashtable_destroy(&vxlan->fdb_hash_tbl);
2935 return err;
2936 }
2937
vxlan_uninit(struct net_device * dev)2938 static void vxlan_uninit(struct net_device *dev)
2939 {
2940 struct vxlan_dev *vxlan = netdev_priv(dev);
2941
2942 vxlan_mdb_fini(vxlan);
2943
2944 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER)
2945 vxlan_vnigroup_uninit(vxlan);
2946
2947 gro_cells_destroy(&vxlan->gro_cells);
2948
2949 rhashtable_destroy(&vxlan->fdb_hash_tbl);
2950 }
2951
2952 /* Start ageing timer and join group when device is brought up */
vxlan_open(struct net_device * dev)2953 static int vxlan_open(struct net_device *dev)
2954 {
2955 struct vxlan_dev *vxlan = netdev_priv(dev);
2956 int ret;
2957
2958 ret = vxlan_sock_add(vxlan);
2959 if (ret < 0)
2960 return ret;
2961
2962 ret = vxlan_multicast_join(vxlan);
2963 if (ret) {
2964 vxlan_sock_release(vxlan);
2965 return ret;
2966 }
2967
2968 if (vxlan->cfg.age_interval)
2969 mod_timer(&vxlan->age_timer, jiffies + FDB_AGE_INTERVAL);
2970
2971 return ret;
2972 }
2973
2974 struct vxlan_fdb_flush_desc {
2975 bool ignore_default_entry;
2976 unsigned long state;
2977 unsigned long state_mask;
2978 unsigned long flags;
2979 unsigned long flags_mask;
2980 __be32 src_vni;
2981 u32 nhid;
2982 __be32 vni;
2983 __be16 port;
2984 union vxlan_addr dst_ip;
2985 };
2986
vxlan_fdb_is_default_entry(const struct vxlan_fdb * f,const struct vxlan_dev * vxlan)2987 static bool vxlan_fdb_is_default_entry(const struct vxlan_fdb *f,
2988 const struct vxlan_dev *vxlan)
2989 {
2990 return is_zero_ether_addr(f->key.eth_addr) &&
2991 f->key.vni == vxlan->cfg.vni;
2992 }
2993
vxlan_fdb_nhid_matches(const struct vxlan_fdb * f,u32 nhid)2994 static bool vxlan_fdb_nhid_matches(const struct vxlan_fdb *f, u32 nhid)
2995 {
2996 struct nexthop *nh = rtnl_dereference(f->nh);
2997
2998 return nh && nh->id == nhid;
2999 }
3000
vxlan_fdb_flush_matches(const struct vxlan_fdb * f,const struct vxlan_dev * vxlan,const struct vxlan_fdb_flush_desc * desc)3001 static bool vxlan_fdb_flush_matches(const struct vxlan_fdb *f,
3002 const struct vxlan_dev *vxlan,
3003 const struct vxlan_fdb_flush_desc *desc)
3004 {
3005 if (desc->state_mask && (f->state & desc->state_mask) != desc->state)
3006 return false;
3007
3008 if (desc->flags_mask && (f->flags & desc->flags_mask) != desc->flags)
3009 return false;
3010
3011 if (desc->ignore_default_entry && vxlan_fdb_is_default_entry(f, vxlan))
3012 return false;
3013
3014 if (desc->src_vni && f->key.vni != desc->src_vni)
3015 return false;
3016
3017 if (desc->nhid && !vxlan_fdb_nhid_matches(f, desc->nhid))
3018 return false;
3019
3020 return true;
3021 }
3022
3023 static bool
vxlan_fdb_flush_should_match_remotes(const struct vxlan_fdb_flush_desc * desc)3024 vxlan_fdb_flush_should_match_remotes(const struct vxlan_fdb_flush_desc *desc)
3025 {
3026 return desc->vni || desc->port || desc->dst_ip.sa.sa_family;
3027 }
3028
3029 static bool
vxlan_fdb_flush_remote_matches(const struct vxlan_fdb_flush_desc * desc,const struct vxlan_rdst * rd)3030 vxlan_fdb_flush_remote_matches(const struct vxlan_fdb_flush_desc *desc,
3031 const struct vxlan_rdst *rd)
3032 {
3033 if (desc->vni && rd->remote_vni != desc->vni)
3034 return false;
3035
3036 if (desc->port && rd->remote_port != desc->port)
3037 return false;
3038
3039 if (desc->dst_ip.sa.sa_family &&
3040 !vxlan_addr_equal(&rd->remote_ip, &desc->dst_ip))
3041 return false;
3042
3043 return true;
3044 }
3045
3046 static void
vxlan_fdb_flush_match_remotes(struct vxlan_fdb * f,struct vxlan_dev * vxlan,const struct vxlan_fdb_flush_desc * desc,bool * p_destroy_fdb)3047 vxlan_fdb_flush_match_remotes(struct vxlan_fdb *f, struct vxlan_dev *vxlan,
3048 const struct vxlan_fdb_flush_desc *desc,
3049 bool *p_destroy_fdb)
3050 {
3051 bool remotes_flushed = false;
3052 struct vxlan_rdst *rd, *tmp;
3053
3054 list_for_each_entry_safe(rd, tmp, &f->remotes, list) {
3055 if (!vxlan_fdb_flush_remote_matches(desc, rd))
3056 continue;
3057
3058 vxlan_fdb_dst_destroy(vxlan, f, rd, true);
3059 remotes_flushed = true;
3060 }
3061
3062 *p_destroy_fdb = remotes_flushed && list_empty(&f->remotes);
3063 }
3064
3065 /* Purge the forwarding table */
vxlan_flush(struct vxlan_dev * vxlan,const struct vxlan_fdb_flush_desc * desc)3066 static void vxlan_flush(struct vxlan_dev *vxlan,
3067 const struct vxlan_fdb_flush_desc *desc)
3068 {
3069 bool match_remotes = vxlan_fdb_flush_should_match_remotes(desc);
3070 struct vxlan_fdb *f;
3071
3072 rcu_read_lock();
3073 hlist_for_each_entry_rcu(f, &vxlan->fdb_list, fdb_node) {
3074 if (!vxlan_fdb_flush_matches(f, vxlan, desc))
3075 continue;
3076
3077 spin_lock_bh(&vxlan->hash_lock);
3078 if (hlist_unhashed(&f->fdb_node))
3079 goto unlock;
3080
3081 if (match_remotes) {
3082 bool destroy_fdb = false;
3083
3084 vxlan_fdb_flush_match_remotes(f, vxlan, desc,
3085 &destroy_fdb);
3086
3087 if (!destroy_fdb)
3088 goto unlock;
3089 }
3090
3091 vxlan_fdb_destroy(vxlan, f, true, true);
3092 unlock:
3093 spin_unlock_bh(&vxlan->hash_lock);
3094 }
3095 rcu_read_unlock();
3096 }
3097
3098 static const struct nla_policy vxlan_del_bulk_policy[NDA_MAX + 1] = {
3099 [NDA_SRC_VNI] = { .type = NLA_U32 },
3100 [NDA_NH_ID] = { .type = NLA_U32 },
3101 [NDA_VNI] = { .type = NLA_U32 },
3102 [NDA_PORT] = { .type = NLA_U16 },
3103 [NDA_DST] = NLA_POLICY_RANGE(NLA_BINARY, sizeof(struct in_addr),
3104 sizeof(struct in6_addr)),
3105 [NDA_NDM_STATE_MASK] = { .type = NLA_U16 },
3106 [NDA_NDM_FLAGS_MASK] = { .type = NLA_U8 },
3107 };
3108
3109 #define VXLAN_FDB_FLUSH_IGNORED_NDM_FLAGS (NTF_MASTER | NTF_SELF)
3110 #define VXLAN_FDB_FLUSH_ALLOWED_NDM_STATES (NUD_PERMANENT | NUD_NOARP)
3111 #define VXLAN_FDB_FLUSH_ALLOWED_NDM_FLAGS (NTF_EXT_LEARNED | NTF_OFFLOADED | \
3112 NTF_ROUTER)
3113
vxlan_fdb_delete_bulk(struct nlmsghdr * nlh,struct net_device * dev,struct netlink_ext_ack * extack)3114 static int vxlan_fdb_delete_bulk(struct nlmsghdr *nlh, struct net_device *dev,
3115 struct netlink_ext_ack *extack)
3116 {
3117 struct vxlan_dev *vxlan = netdev_priv(dev);
3118 struct vxlan_fdb_flush_desc desc = {};
3119 struct ndmsg *ndm = nlmsg_data(nlh);
3120 struct nlattr *tb[NDA_MAX + 1];
3121 u8 ndm_flags;
3122 int err;
3123
3124 ndm_flags = ndm->ndm_flags & ~VXLAN_FDB_FLUSH_IGNORED_NDM_FLAGS;
3125
3126 err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, vxlan_del_bulk_policy,
3127 extack);
3128 if (err)
3129 return err;
3130
3131 if (ndm_flags & ~VXLAN_FDB_FLUSH_ALLOWED_NDM_FLAGS) {
3132 NL_SET_ERR_MSG(extack, "Unsupported fdb flush ndm flag bits set");
3133 return -EINVAL;
3134 }
3135 if (ndm->ndm_state & ~VXLAN_FDB_FLUSH_ALLOWED_NDM_STATES) {
3136 NL_SET_ERR_MSG(extack, "Unsupported fdb flush ndm state bits set");
3137 return -EINVAL;
3138 }
3139
3140 desc.state = ndm->ndm_state;
3141 desc.flags = ndm_flags;
3142
3143 if (tb[NDA_NDM_STATE_MASK])
3144 desc.state_mask = nla_get_u16(tb[NDA_NDM_STATE_MASK]);
3145
3146 if (tb[NDA_NDM_FLAGS_MASK])
3147 desc.flags_mask = nla_get_u8(tb[NDA_NDM_FLAGS_MASK]);
3148
3149 if (tb[NDA_SRC_VNI])
3150 desc.src_vni = cpu_to_be32(nla_get_u32(tb[NDA_SRC_VNI]));
3151
3152 if (tb[NDA_NH_ID])
3153 desc.nhid = nla_get_u32(tb[NDA_NH_ID]);
3154
3155 if (tb[NDA_VNI])
3156 desc.vni = cpu_to_be32(nla_get_u32(tb[NDA_VNI]));
3157
3158 if (tb[NDA_PORT])
3159 desc.port = nla_get_be16(tb[NDA_PORT]);
3160
3161 if (tb[NDA_DST]) {
3162 union vxlan_addr ip;
3163
3164 err = vxlan_nla_get_addr(&ip, tb[NDA_DST]);
3165 if (err) {
3166 NL_SET_ERR_MSG_ATTR(extack, tb[NDA_DST],
3167 "Unsupported address family");
3168 return err;
3169 }
3170 desc.dst_ip = ip;
3171 }
3172
3173 vxlan_flush(vxlan, &desc);
3174
3175 return 0;
3176 }
3177
3178 /* Cleanup timer and forwarding table on shutdown */
vxlan_stop(struct net_device * dev)3179 static int vxlan_stop(struct net_device *dev)
3180 {
3181 struct vxlan_dev *vxlan = netdev_priv(dev);
3182 struct vxlan_fdb_flush_desc desc = {
3183 /* Default entry is deleted at vxlan_dellink. */
3184 .ignore_default_entry = true,
3185 .state = 0,
3186 .state_mask = NUD_PERMANENT | NUD_NOARP,
3187 };
3188
3189 vxlan_multicast_leave(vxlan);
3190
3191 timer_delete_sync(&vxlan->age_timer);
3192
3193 vxlan_flush(vxlan, &desc);
3194 vxlan_sock_release(vxlan);
3195
3196 return 0;
3197 }
3198
3199 /* Stub, nothing needs to be done. */
vxlan_set_multicast_list(struct net_device * dev)3200 static void vxlan_set_multicast_list(struct net_device *dev)
3201 {
3202 }
3203
vxlan_change_mtu(struct net_device * dev,int new_mtu)3204 static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
3205 {
3206 struct vxlan_dev *vxlan = netdev_priv(dev);
3207 struct vxlan_rdst *dst = &vxlan->default_dst;
3208 struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
3209 dst->remote_ifindex);
3210
3211 /* This check is different than dev->max_mtu, because it looks at
3212 * the lowerdev->mtu, rather than the static dev->max_mtu
3213 */
3214 if (lowerdev) {
3215 int max_mtu = lowerdev->mtu - vxlan_headroom(vxlan->cfg.flags);
3216 if (new_mtu > max_mtu)
3217 return -EINVAL;
3218 }
3219
3220 WRITE_ONCE(dev->mtu, new_mtu);
3221 return 0;
3222 }
3223
vxlan_fill_metadata_dst(struct net_device * dev,struct sk_buff * skb)3224 static int vxlan_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
3225 {
3226 struct vxlan_dev *vxlan = netdev_priv(dev);
3227 struct ip_tunnel_info *info = skb_tunnel_info(skb);
3228 __be16 sport, dport;
3229
3230 sport = udp_flow_src_port(dev_net(dev), skb, vxlan->cfg.port_min,
3231 vxlan->cfg.port_max, true);
3232 dport = info->key.tp_dst ? : vxlan->cfg.dst_port;
3233
3234 if (ip_tunnel_info_af(info) == AF_INET) {
3235 struct vxlan_sock *sock4 = rcu_dereference(vxlan->vn4_sock);
3236 struct rtable *rt;
3237
3238 if (!sock4)
3239 return -EIO;
3240
3241 rt = udp_tunnel_dst_lookup(skb, dev, vxlan->net, 0,
3242 &info->key.u.ipv4.src,
3243 &info->key,
3244 sport, dport, info->key.tos,
3245 &info->dst_cache);
3246 if (IS_ERR(rt))
3247 return PTR_ERR(rt);
3248 ip_rt_put(rt);
3249 } else {
3250 #if IS_ENABLED(CONFIG_IPV6)
3251 struct vxlan_sock *sock6 = rcu_dereference(vxlan->vn6_sock);
3252 struct dst_entry *ndst;
3253
3254 if (!sock6)
3255 return -EIO;
3256
3257 ndst = udp_tunnel6_dst_lookup(skb, dev, vxlan->net, sock6->sock,
3258 0, &info->key.u.ipv6.src,
3259 &info->key,
3260 sport, dport, info->key.tos,
3261 &info->dst_cache);
3262 if (IS_ERR(ndst))
3263 return PTR_ERR(ndst);
3264 dst_release(ndst);
3265 #else /* !CONFIG_IPV6 */
3266 return -EPFNOSUPPORT;
3267 #endif
3268 }
3269 info->key.tp_src = sport;
3270 info->key.tp_dst = dport;
3271 return 0;
3272 }
3273
3274 static const struct net_device_ops vxlan_netdev_ether_ops = {
3275 .ndo_init = vxlan_init,
3276 .ndo_uninit = vxlan_uninit,
3277 .ndo_open = vxlan_open,
3278 .ndo_stop = vxlan_stop,
3279 .ndo_start_xmit = vxlan_xmit,
3280 .ndo_set_rx_mode = vxlan_set_multicast_list,
3281 .ndo_change_mtu = vxlan_change_mtu,
3282 .ndo_validate_addr = eth_validate_addr,
3283 .ndo_set_mac_address = eth_mac_addr,
3284 .ndo_fdb_add = vxlan_fdb_add,
3285 .ndo_fdb_del = vxlan_fdb_delete,
3286 .ndo_fdb_del_bulk = vxlan_fdb_delete_bulk,
3287 .ndo_fdb_dump = vxlan_fdb_dump,
3288 .ndo_fdb_get = vxlan_fdb_get,
3289 .ndo_mdb_add = vxlan_mdb_add,
3290 .ndo_mdb_del = vxlan_mdb_del,
3291 .ndo_mdb_del_bulk = vxlan_mdb_del_bulk,
3292 .ndo_mdb_dump = vxlan_mdb_dump,
3293 .ndo_mdb_get = vxlan_mdb_get,
3294 .ndo_fill_metadata_dst = vxlan_fill_metadata_dst,
3295 };
3296
3297 static const struct net_device_ops vxlan_netdev_raw_ops = {
3298 .ndo_init = vxlan_init,
3299 .ndo_uninit = vxlan_uninit,
3300 .ndo_open = vxlan_open,
3301 .ndo_stop = vxlan_stop,
3302 .ndo_start_xmit = vxlan_xmit,
3303 .ndo_change_mtu = vxlan_change_mtu,
3304 .ndo_fill_metadata_dst = vxlan_fill_metadata_dst,
3305 };
3306
3307 /* Info for udev, that this is a virtual tunnel endpoint */
3308 static const struct device_type vxlan_type = {
3309 .name = "vxlan",
3310 };
3311
3312 /* Calls the ndo_udp_tunnel_add of the caller in order to
3313 * supply the listening VXLAN udp ports. Callers are expected
3314 * to implement the ndo_udp_tunnel_add.
3315 */
vxlan_offload_rx_ports(struct net_device * dev,bool push)3316 static void vxlan_offload_rx_ports(struct net_device *dev, bool push)
3317 {
3318 struct vxlan_sock *vs;
3319 struct net *net = dev_net(dev);
3320 struct vxlan_net *vn = net_generic(net, vxlan_net_id);
3321 unsigned int i;
3322
3323 ASSERT_RTNL();
3324
3325 for (i = 0; i < PORT_HASH_SIZE; ++i) {
3326 hlist_for_each_entry(vs, &vn->sock_list[i], hlist) {
3327 unsigned short type;
3328
3329 if (vs->flags & VXLAN_F_GPE)
3330 type = UDP_TUNNEL_TYPE_VXLAN_GPE;
3331 else
3332 type = UDP_TUNNEL_TYPE_VXLAN;
3333
3334 if (push)
3335 udp_tunnel_push_rx_port(dev, vs->sock, type);
3336 else
3337 udp_tunnel_drop_rx_port(dev, vs->sock, type);
3338 }
3339 }
3340 }
3341
3342 /* Initialize the device structure. */
vxlan_setup(struct net_device * dev)3343 static void vxlan_setup(struct net_device *dev)
3344 {
3345 struct vxlan_dev *vxlan = netdev_priv(dev);
3346
3347 eth_hw_addr_random(dev);
3348 ether_setup(dev);
3349
3350 dev->needs_free_netdev = true;
3351 SET_NETDEV_DEVTYPE(dev, &vxlan_type);
3352
3353 dev->features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_FRAGLIST;
3354 dev->features |= NETIF_F_RXCSUM;
3355 dev->features |= NETIF_F_GSO_SOFTWARE;
3356
3357 /* Partial features are disabled by default. */
3358 dev->vlan_features = dev->features;
3359 dev->hw_features |= NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_FRAGLIST;
3360 dev->hw_features |= NETIF_F_RXCSUM;
3361 dev->hw_features |= NETIF_F_GSO_SOFTWARE;
3362 dev->hw_features |= UDP_TUNNEL_PARTIAL_FEATURES;
3363 dev->hw_features |= NETIF_F_GSO_PARTIAL;
3364
3365 dev->hw_enc_features = dev->hw_features;
3366 dev->gso_partial_features = UDP_TUNNEL_PARTIAL_FEATURES;
3367 dev->mangleid_features = NETIF_F_GSO_PARTIAL;
3368
3369 netif_keep_dst(dev);
3370 dev->priv_flags |= IFF_NO_QUEUE;
3371 dev->change_proto_down = true;
3372 dev->lltx = true;
3373
3374 /* MTU range: 68 - 65535 */
3375 dev->min_mtu = ETH_MIN_MTU;
3376 dev->max_mtu = ETH_MAX_MTU;
3377
3378 dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS;
3379 INIT_LIST_HEAD(&vxlan->next);
3380 spin_lock_init(&vxlan->hash_lock);
3381
3382 timer_setup(&vxlan->age_timer, vxlan_cleanup, TIMER_DEFERRABLE);
3383
3384 vxlan->dev = dev;
3385
3386 INIT_HLIST_HEAD(&vxlan->fdb_list);
3387 }
3388
vxlan_ether_setup(struct net_device * dev)3389 static void vxlan_ether_setup(struct net_device *dev)
3390 {
3391 dev->priv_flags &= ~IFF_TX_SKB_SHARING;
3392 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
3393 dev->netdev_ops = &vxlan_netdev_ether_ops;
3394 }
3395
vxlan_raw_setup(struct net_device * dev)3396 static void vxlan_raw_setup(struct net_device *dev)
3397 {
3398 dev->header_ops = NULL;
3399 dev->type = ARPHRD_NONE;
3400 dev->hard_header_len = 0;
3401 dev->addr_len = 0;
3402 dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
3403 dev->netdev_ops = &vxlan_netdev_raw_ops;
3404 }
3405
3406 static const struct nla_policy vxlan_policy[IFLA_VXLAN_MAX + 1] = {
3407 [IFLA_VXLAN_UNSPEC] = { .strict_start_type = IFLA_VXLAN_LOCALBYPASS },
3408 [IFLA_VXLAN_ID] = { .type = NLA_U32 },
3409 [IFLA_VXLAN_GROUP] = { .len = sizeof_field(struct iphdr, daddr) },
3410 [IFLA_VXLAN_GROUP6] = { .len = sizeof(struct in6_addr) },
3411 [IFLA_VXLAN_LINK] = { .type = NLA_U32 },
3412 [IFLA_VXLAN_LOCAL] = { .len = sizeof_field(struct iphdr, saddr) },
3413 [IFLA_VXLAN_LOCAL6] = { .len = sizeof(struct in6_addr) },
3414 [IFLA_VXLAN_TOS] = { .type = NLA_U8 },
3415 [IFLA_VXLAN_TTL] = { .type = NLA_U8 },
3416 [IFLA_VXLAN_LABEL] = { .type = NLA_U32 },
3417 [IFLA_VXLAN_LEARNING] = { .type = NLA_U8 },
3418 [IFLA_VXLAN_AGEING] = { .type = NLA_U32 },
3419 [IFLA_VXLAN_LIMIT] = { .type = NLA_U32 },
3420 [IFLA_VXLAN_PORT_RANGE] = { .len = sizeof(struct ifla_vxlan_port_range) },
3421 [IFLA_VXLAN_PROXY] = { .type = NLA_U8 },
3422 [IFLA_VXLAN_RSC] = { .type = NLA_U8 },
3423 [IFLA_VXLAN_L2MISS] = { .type = NLA_U8 },
3424 [IFLA_VXLAN_L3MISS] = { .type = NLA_U8 },
3425 [IFLA_VXLAN_COLLECT_METADATA] = { .type = NLA_U8 },
3426 [IFLA_VXLAN_PORT] = { .type = NLA_U16 },
3427 [IFLA_VXLAN_UDP_CSUM] = { .type = NLA_U8 },
3428 [IFLA_VXLAN_UDP_ZERO_CSUM6_TX] = { .type = NLA_U8 },
3429 [IFLA_VXLAN_UDP_ZERO_CSUM6_RX] = { .type = NLA_U8 },
3430 [IFLA_VXLAN_REMCSUM_TX] = { .type = NLA_U8 },
3431 [IFLA_VXLAN_REMCSUM_RX] = { .type = NLA_U8 },
3432 [IFLA_VXLAN_GBP] = { .type = NLA_FLAG, },
3433 [IFLA_VXLAN_GPE] = { .type = NLA_FLAG, },
3434 [IFLA_VXLAN_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG },
3435 [IFLA_VXLAN_TTL_INHERIT] = { .type = NLA_FLAG },
3436 [IFLA_VXLAN_DF] = { .type = NLA_U8 },
3437 [IFLA_VXLAN_VNIFILTER] = { .type = NLA_U8 },
3438 [IFLA_VXLAN_LOCALBYPASS] = NLA_POLICY_MAX(NLA_U8, 1),
3439 [IFLA_VXLAN_LABEL_POLICY] = NLA_POLICY_MAX(NLA_U32, VXLAN_LABEL_MAX),
3440 [IFLA_VXLAN_RESERVED_BITS] = NLA_POLICY_EXACT_LEN(sizeof(struct vxlanhdr)),
3441 [IFLA_VXLAN_MC_ROUTE] = NLA_POLICY_MAX(NLA_U8, 1),
3442 };
3443
vxlan_validate(struct nlattr * tb[],struct nlattr * data[],struct netlink_ext_ack * extack)3444 static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[],
3445 struct netlink_ext_ack *extack)
3446 {
3447 if (tb[IFLA_ADDRESS]) {
3448 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) {
3449 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_ADDRESS],
3450 "Provided link layer address is not Ethernet");
3451 return -EINVAL;
3452 }
3453
3454 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) {
3455 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_ADDRESS],
3456 "Provided Ethernet address is not unicast");
3457 return -EADDRNOTAVAIL;
3458 }
3459 }
3460
3461 if (tb[IFLA_MTU]) {
3462 u32 mtu = nla_get_u32(tb[IFLA_MTU]);
3463
3464 if (mtu < ETH_MIN_MTU || mtu > ETH_MAX_MTU) {
3465 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_MTU],
3466 "MTU must be between 68 and 65535");
3467 return -EINVAL;
3468 }
3469 }
3470
3471 if (!data) {
3472 NL_SET_ERR_MSG(extack,
3473 "Required attributes not provided to perform the operation");
3474 return -EINVAL;
3475 }
3476
3477 if (data[IFLA_VXLAN_ID]) {
3478 u32 id = nla_get_u32(data[IFLA_VXLAN_ID]);
3479
3480 if (id >= VXLAN_N_VID) {
3481 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_ID],
3482 "VXLAN ID must be lower than 16777216");
3483 return -ERANGE;
3484 }
3485 }
3486
3487 if (data[IFLA_VXLAN_PORT_RANGE]) {
3488 const struct ifla_vxlan_port_range *p
3489 = nla_data(data[IFLA_VXLAN_PORT_RANGE]);
3490
3491 if (ntohs(p->high) < ntohs(p->low)) {
3492 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_PORT_RANGE],
3493 "Invalid source port range");
3494 return -EINVAL;
3495 }
3496 }
3497
3498 if (data[IFLA_VXLAN_DF]) {
3499 enum ifla_vxlan_df df = nla_get_u8(data[IFLA_VXLAN_DF]);
3500
3501 if (df < 0 || df > VXLAN_DF_MAX) {
3502 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_DF],
3503 "Invalid DF attribute");
3504 return -EINVAL;
3505 }
3506 }
3507
3508 return 0;
3509 }
3510
vxlan_get_drvinfo(struct net_device * netdev,struct ethtool_drvinfo * drvinfo)3511 static void vxlan_get_drvinfo(struct net_device *netdev,
3512 struct ethtool_drvinfo *drvinfo)
3513 {
3514 strscpy(drvinfo->version, VXLAN_VERSION, sizeof(drvinfo->version));
3515 strscpy(drvinfo->driver, "vxlan", sizeof(drvinfo->driver));
3516 }
3517
vxlan_get_link_ksettings(struct net_device * dev,struct ethtool_link_ksettings * cmd)3518 static int vxlan_get_link_ksettings(struct net_device *dev,
3519 struct ethtool_link_ksettings *cmd)
3520 {
3521 struct vxlan_dev *vxlan = netdev_priv(dev);
3522 struct vxlan_rdst *dst = &vxlan->default_dst;
3523 struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
3524 dst->remote_ifindex);
3525
3526 if (!lowerdev) {
3527 cmd->base.duplex = DUPLEX_UNKNOWN;
3528 cmd->base.port = PORT_OTHER;
3529 cmd->base.speed = SPEED_UNKNOWN;
3530
3531 return 0;
3532 }
3533
3534 return __ethtool_get_link_ksettings(lowerdev, cmd);
3535 }
3536
3537 static const struct ethtool_ops vxlan_ethtool_ops = {
3538 .get_drvinfo = vxlan_get_drvinfo,
3539 .get_link = ethtool_op_get_link,
3540 .get_link_ksettings = vxlan_get_link_ksettings,
3541 };
3542
vxlan_create_sock(struct net * net,bool ipv6,__be16 port,u32 flags,int ifindex)3543 static struct socket *vxlan_create_sock(struct net *net, bool ipv6,
3544 __be16 port, u32 flags, int ifindex)
3545 {
3546 struct socket *sock;
3547 struct udp_port_cfg udp_conf;
3548 int err;
3549
3550 memset(&udp_conf, 0, sizeof(udp_conf));
3551
3552 if (ipv6) {
3553 udp_conf.family = AF_INET6;
3554 udp_conf.use_udp6_rx_checksums =
3555 !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
3556 udp_conf.ipv6_v6only = 1;
3557 } else {
3558 udp_conf.family = AF_INET;
3559 }
3560
3561 udp_conf.local_udp_port = port;
3562 udp_conf.bind_ifindex = ifindex;
3563
3564 /* Open UDP socket */
3565 err = udp_sock_create(net, &udp_conf, &sock);
3566 if (err < 0)
3567 return ERR_PTR(err);
3568
3569 udp_allow_gso(sock->sk);
3570 return sock;
3571 }
3572
3573 /* Create new listen socket if needed */
vxlan_socket_create(struct net * net,bool ipv6,__be16 port,u32 flags,int ifindex)3574 static struct vxlan_sock *vxlan_socket_create(struct net *net, bool ipv6,
3575 __be16 port, u32 flags,
3576 int ifindex)
3577 {
3578 struct vxlan_sock *vs;
3579 struct socket *sock;
3580 unsigned int h;
3581 struct udp_tunnel_sock_cfg tunnel_cfg;
3582
3583 ASSERT_RTNL();
3584
3585 vs = kzalloc_obj(*vs);
3586 if (!vs)
3587 return ERR_PTR(-ENOMEM);
3588
3589 for (h = 0; h < VNI_HASH_SIZE; ++h)
3590 INIT_HLIST_HEAD(&vs->vni_list[h]);
3591
3592 sock = vxlan_create_sock(net, ipv6, port, flags, ifindex);
3593 if (IS_ERR(sock)) {
3594 kfree(vs);
3595 return ERR_CAST(sock);
3596 }
3597
3598 vs->sock = sock;
3599 refcount_set(&vs->refcnt, 1);
3600 vs->flags = (flags & VXLAN_F_RCV_FLAGS);
3601
3602 hlist_add_head_rcu(&vs->hlist, vs_head(net, port));
3603 udp_tunnel_notify_add_rx_port(sock,
3604 (vs->flags & VXLAN_F_GPE) ?
3605 UDP_TUNNEL_TYPE_VXLAN_GPE :
3606 UDP_TUNNEL_TYPE_VXLAN);
3607
3608 /* Mark socket as an encapsulation socket. */
3609 memset(&tunnel_cfg, 0, sizeof(tunnel_cfg));
3610 tunnel_cfg.sk_user_data = vs;
3611 tunnel_cfg.encap_type = 1;
3612 tunnel_cfg.encap_rcv = vxlan_rcv;
3613 tunnel_cfg.encap_err_lookup = vxlan_err_lookup;
3614 tunnel_cfg.encap_destroy = NULL;
3615 if (vs->flags & VXLAN_F_GPE) {
3616 tunnel_cfg.gro_receive = vxlan_gpe_gro_receive;
3617 tunnel_cfg.gro_complete = vxlan_gpe_gro_complete;
3618 } else {
3619 tunnel_cfg.gro_receive = vxlan_gro_receive;
3620 tunnel_cfg.gro_complete = vxlan_gro_complete;
3621 }
3622
3623 setup_udp_tunnel_sock(net, sock, &tunnel_cfg);
3624
3625 return vs;
3626 }
3627
__vxlan_sock_add(struct vxlan_dev * vxlan,bool ipv6)3628 static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
3629 {
3630 bool metadata = vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA;
3631 struct vxlan_sock *vs = NULL;
3632 struct vxlan_dev_node *node;
3633 int l3mdev_index = 0;
3634
3635 ASSERT_RTNL();
3636
3637 if (vxlan->cfg.remote_ifindex)
3638 l3mdev_index = l3mdev_master_upper_ifindex_by_index(
3639 vxlan->net, vxlan->cfg.remote_ifindex);
3640
3641 if (!vxlan->cfg.no_share) {
3642 rcu_read_lock();
3643 vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
3644 vxlan->cfg.dst_port, vxlan->cfg.flags,
3645 l3mdev_index);
3646 if (vs && !refcount_inc_not_zero(&vs->refcnt)) {
3647 rcu_read_unlock();
3648 return -EBUSY;
3649 }
3650 rcu_read_unlock();
3651 }
3652 if (!vs)
3653 vs = vxlan_socket_create(vxlan->net, ipv6,
3654 vxlan->cfg.dst_port, vxlan->cfg.flags,
3655 l3mdev_index);
3656 if (IS_ERR(vs))
3657 return PTR_ERR(vs);
3658 #if IS_ENABLED(CONFIG_IPV6)
3659 if (ipv6) {
3660 rcu_assign_pointer(vxlan->vn6_sock, vs);
3661 node = &vxlan->hlist6;
3662 } else
3663 #endif
3664 {
3665 rcu_assign_pointer(vxlan->vn4_sock, vs);
3666 node = &vxlan->hlist4;
3667 }
3668
3669 if (metadata && (vxlan->cfg.flags & VXLAN_F_VNIFILTER))
3670 vxlan_vs_add_vnigrp(vxlan, vs, ipv6);
3671 else
3672 vxlan_vs_add_dev(vs, vxlan, node);
3673
3674 return 0;
3675 }
3676
vxlan_sock_add(struct vxlan_dev * vxlan)3677 static int vxlan_sock_add(struct vxlan_dev *vxlan)
3678 {
3679 bool metadata = vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA;
3680 bool ipv6 = vxlan->cfg.flags & VXLAN_F_IPV6 || metadata;
3681 bool ipv4 = !ipv6 || metadata;
3682 int ret = 0;
3683
3684 RCU_INIT_POINTER(vxlan->vn4_sock, NULL);
3685 #if IS_ENABLED(CONFIG_IPV6)
3686 RCU_INIT_POINTER(vxlan->vn6_sock, NULL);
3687 if (ipv6) {
3688 ret = __vxlan_sock_add(vxlan, true);
3689 if (ret < 0 && ret != -EAFNOSUPPORT)
3690 ipv4 = false;
3691 }
3692 #endif
3693 if (ipv4)
3694 ret = __vxlan_sock_add(vxlan, false);
3695 if (ret < 0)
3696 vxlan_sock_release(vxlan);
3697 return ret;
3698 }
3699
vxlan_vni_in_use(struct net * src_net,struct vxlan_dev * vxlan,struct vxlan_config * conf,__be32 vni)3700 int vxlan_vni_in_use(struct net *src_net, struct vxlan_dev *vxlan,
3701 struct vxlan_config *conf, __be32 vni)
3702 {
3703 struct vxlan_net *vn = net_generic(src_net, vxlan_net_id);
3704 struct vxlan_dev *tmp;
3705
3706 list_for_each_entry(tmp, &vn->vxlan_list, next) {
3707 if (tmp == vxlan)
3708 continue;
3709 if (tmp->cfg.flags & VXLAN_F_VNIFILTER) {
3710 if (!vxlan_vnifilter_lookup(tmp, vni))
3711 continue;
3712 } else if (tmp->cfg.vni != vni) {
3713 continue;
3714 }
3715 if (tmp->cfg.dst_port != conf->dst_port)
3716 continue;
3717 if ((tmp->cfg.flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)) !=
3718 (conf->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)))
3719 continue;
3720
3721 if ((conf->flags & VXLAN_F_IPV6_LINKLOCAL) &&
3722 tmp->cfg.remote_ifindex != conf->remote_ifindex)
3723 continue;
3724
3725 return -EEXIST;
3726 }
3727
3728 return 0;
3729 }
3730
vxlan_config_validate(struct net * src_net,struct vxlan_config * conf,struct net_device ** lower,struct vxlan_dev * old,struct netlink_ext_ack * extack)3731 static int vxlan_config_validate(struct net *src_net, struct vxlan_config *conf,
3732 struct net_device **lower,
3733 struct vxlan_dev *old,
3734 struct netlink_ext_ack *extack)
3735 {
3736 bool use_ipv6 = false;
3737
3738 if (conf->flags & VXLAN_F_GPE) {
3739 /* For now, allow GPE only together with
3740 * COLLECT_METADATA. This can be relaxed later; in such
3741 * case, the other side of the PtP link will have to be
3742 * provided.
3743 */
3744 if ((conf->flags & ~VXLAN_F_ALLOWED_GPE) ||
3745 !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
3746 NL_SET_ERR_MSG(extack,
3747 "VXLAN GPE does not support this combination of attributes");
3748 return -EINVAL;
3749 }
3750 }
3751
3752 if (!conf->remote_ip.sa.sa_family && !conf->saddr.sa.sa_family) {
3753 /* Unless IPv6 is explicitly requested, assume IPv4 */
3754 conf->remote_ip.sa.sa_family = AF_INET;
3755 conf->saddr.sa.sa_family = AF_INET;
3756 } else if (!conf->remote_ip.sa.sa_family) {
3757 conf->remote_ip.sa.sa_family = conf->saddr.sa.sa_family;
3758 } else if (!conf->saddr.sa.sa_family) {
3759 conf->saddr.sa.sa_family = conf->remote_ip.sa.sa_family;
3760 }
3761
3762 if (conf->saddr.sa.sa_family != conf->remote_ip.sa.sa_family) {
3763 NL_SET_ERR_MSG(extack,
3764 "Local and remote address must be from the same family");
3765 return -EINVAL;
3766 }
3767
3768 if (vxlan_addr_multicast(&conf->saddr)) {
3769 NL_SET_ERR_MSG(extack, "Local address cannot be multicast");
3770 return -EINVAL;
3771 }
3772
3773 if (conf->saddr.sa.sa_family == AF_INET6) {
3774 if (!IS_ENABLED(CONFIG_IPV6)) {
3775 NL_SET_ERR_MSG(extack,
3776 "IPv6 support not enabled in the kernel");
3777 return -EPFNOSUPPORT;
3778 }
3779 use_ipv6 = true;
3780 conf->flags |= VXLAN_F_IPV6;
3781
3782 if (!(conf->flags & VXLAN_F_COLLECT_METADATA)) {
3783 int local_type =
3784 ipv6_addr_type(&conf->saddr.sin6.sin6_addr);
3785 int remote_type =
3786 ipv6_addr_type(&conf->remote_ip.sin6.sin6_addr);
3787
3788 if (local_type & IPV6_ADDR_LINKLOCAL) {
3789 if (!(remote_type & IPV6_ADDR_LINKLOCAL) &&
3790 (remote_type != IPV6_ADDR_ANY)) {
3791 NL_SET_ERR_MSG(extack,
3792 "Invalid combination of local and remote address scopes");
3793 return -EINVAL;
3794 }
3795
3796 conf->flags |= VXLAN_F_IPV6_LINKLOCAL;
3797 } else {
3798 if (remote_type ==
3799 (IPV6_ADDR_UNICAST | IPV6_ADDR_LINKLOCAL)) {
3800 NL_SET_ERR_MSG(extack,
3801 "Invalid combination of local and remote address scopes");
3802 return -EINVAL;
3803 }
3804
3805 conf->flags &= ~VXLAN_F_IPV6_LINKLOCAL;
3806 }
3807 }
3808 }
3809
3810 if (conf->label && !use_ipv6) {
3811 NL_SET_ERR_MSG(extack,
3812 "Label attribute only applies to IPv6 VXLAN devices");
3813 return -EINVAL;
3814 }
3815
3816 if (conf->label_policy && !use_ipv6) {
3817 NL_SET_ERR_MSG(extack,
3818 "Label policy only applies to IPv6 VXLAN devices");
3819 return -EINVAL;
3820 }
3821
3822 if (conf->remote_ifindex) {
3823 struct net_device *lowerdev;
3824
3825 lowerdev = __dev_get_by_index(src_net, conf->remote_ifindex);
3826 if (!lowerdev) {
3827 NL_SET_ERR_MSG(extack,
3828 "Invalid local interface, device not found");
3829 return -ENODEV;
3830 }
3831
3832 #if IS_ENABLED(CONFIG_IPV6)
3833 if (use_ipv6) {
3834 struct inet6_dev *idev = __in6_dev_get(lowerdev);
3835
3836 if (idev && idev->cnf.disable_ipv6) {
3837 NL_SET_ERR_MSG(extack,
3838 "IPv6 support disabled by administrator");
3839 return -EPERM;
3840 }
3841 }
3842 #endif
3843
3844 *lower = lowerdev;
3845 } else {
3846 if (vxlan_addr_multicast(&conf->remote_ip)) {
3847 NL_SET_ERR_MSG(extack,
3848 "Local interface required for multicast remote destination");
3849
3850 return -EINVAL;
3851 }
3852
3853 #if IS_ENABLED(CONFIG_IPV6)
3854 if (conf->flags & VXLAN_F_IPV6_LINKLOCAL) {
3855 NL_SET_ERR_MSG(extack,
3856 "Local interface required for link-local local/remote addresses");
3857 return -EINVAL;
3858 }
3859 #endif
3860
3861 *lower = NULL;
3862 }
3863
3864 if (!conf->dst_port) {
3865 if (conf->flags & VXLAN_F_GPE)
3866 conf->dst_port = htons(IANA_VXLAN_GPE_UDP_PORT);
3867 else
3868 conf->dst_port = htons(vxlan_port);
3869 }
3870
3871 if (!conf->age_interval)
3872 conf->age_interval = FDB_AGE_DEFAULT;
3873
3874 if (vxlan_vni_in_use(src_net, old, conf, conf->vni)) {
3875 NL_SET_ERR_MSG(extack,
3876 "A VXLAN device with the specified VNI already exists");
3877 return -EEXIST;
3878 }
3879
3880 return 0;
3881 }
3882
vxlan_config_apply(struct net_device * dev,struct vxlan_config * conf,struct net_device * lowerdev,struct net * src_net,bool changelink)3883 static void vxlan_config_apply(struct net_device *dev,
3884 struct vxlan_config *conf,
3885 struct net_device *lowerdev,
3886 struct net *src_net,
3887 bool changelink)
3888 {
3889 struct vxlan_dev *vxlan = netdev_priv(dev);
3890 struct vxlan_rdst *dst = &vxlan->default_dst;
3891 unsigned short needed_headroom = ETH_HLEN;
3892 int max_mtu = ETH_MAX_MTU;
3893 u32 flags = conf->flags;
3894
3895 if (!changelink) {
3896 if (flags & VXLAN_F_GPE)
3897 vxlan_raw_setup(dev);
3898 else
3899 vxlan_ether_setup(dev);
3900
3901 if (conf->mtu)
3902 dev->mtu = conf->mtu;
3903
3904 vxlan->net = src_net;
3905 }
3906
3907 dst->remote_vni = conf->vni;
3908
3909 memcpy(&dst->remote_ip, &conf->remote_ip, sizeof(conf->remote_ip));
3910
3911 if (lowerdev) {
3912 dst->remote_ifindex = conf->remote_ifindex;
3913
3914 netif_inherit_tso_max(dev, lowerdev);
3915
3916 needed_headroom = lowerdev->hard_header_len;
3917 needed_headroom += lowerdev->needed_headroom;
3918
3919 dev->needed_tailroom = lowerdev->needed_tailroom;
3920
3921 max_mtu = lowerdev->mtu - vxlan_headroom(flags);
3922 if (max_mtu < ETH_MIN_MTU)
3923 max_mtu = ETH_MIN_MTU;
3924
3925 if (!changelink && !conf->mtu)
3926 dev->mtu = max_mtu;
3927 }
3928
3929 if (dev->mtu > max_mtu)
3930 dev->mtu = max_mtu;
3931
3932 if (flags & VXLAN_F_COLLECT_METADATA)
3933 flags |= VXLAN_F_IPV6;
3934 needed_headroom += vxlan_headroom(flags);
3935 dev->needed_headroom = needed_headroom;
3936
3937 memcpy(&vxlan->cfg, conf, sizeof(*conf));
3938 }
3939
vxlan_dev_configure(struct net * src_net,struct net_device * dev,struct vxlan_config * conf,struct netlink_ext_ack * extack)3940 static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
3941 struct vxlan_config *conf,
3942 struct netlink_ext_ack *extack)
3943 {
3944 struct vxlan_dev *vxlan = netdev_priv(dev);
3945 struct net_device *lowerdev;
3946 int ret;
3947
3948 ret = vxlan_config_validate(src_net, conf, &lowerdev, vxlan, extack);
3949 if (ret)
3950 return ret;
3951
3952 vxlan_config_apply(dev, conf, lowerdev, src_net, false);
3953
3954 return 0;
3955 }
3956
__vxlan_dev_create(struct net * net,struct net_device * dev,struct vxlan_config * conf,struct netlink_ext_ack * extack)3957 static int __vxlan_dev_create(struct net *net, struct net_device *dev,
3958 struct vxlan_config *conf,
3959 struct netlink_ext_ack *extack)
3960 {
3961 struct vxlan_net *vn = net_generic(net, vxlan_net_id);
3962 struct vxlan_dev *vxlan = netdev_priv(dev);
3963 struct net_device *remote_dev = NULL;
3964 struct vxlan_rdst *dst;
3965 int err;
3966
3967 dst = &vxlan->default_dst;
3968 err = vxlan_dev_configure(net, dev, conf, extack);
3969 if (err)
3970 return err;
3971
3972 dev->ethtool_ops = &vxlan_ethtool_ops;
3973
3974 err = register_netdevice(dev);
3975 if (err)
3976 return err;
3977
3978 if (dst->remote_ifindex) {
3979 remote_dev = __dev_get_by_index(net, dst->remote_ifindex);
3980 if (!remote_dev) {
3981 err = -ENODEV;
3982 goto unregister;
3983 }
3984
3985 err = netdev_upper_dev_link(remote_dev, dev, extack);
3986 if (err)
3987 goto unregister;
3988
3989 dst->remote_dev = remote_dev;
3990 }
3991
3992 err = rtnl_configure_link(dev, NULL, 0, NULL);
3993 if (err < 0)
3994 goto unlink;
3995
3996 /* create an fdb entry for a valid default destination */
3997 if (!vxlan_addr_any(&dst->remote_ip)) {
3998 spin_lock_bh(&vxlan->hash_lock);
3999 err = vxlan_fdb_update(vxlan, all_zeros_mac,
4000 &dst->remote_ip,
4001 NUD_REACHABLE | NUD_PERMANENT,
4002 NLM_F_EXCL | NLM_F_CREATE,
4003 vxlan->cfg.dst_port,
4004 dst->remote_vni,
4005 dst->remote_vni,
4006 dst->remote_ifindex,
4007 NTF_SELF, 0, true, extack);
4008 spin_unlock_bh(&vxlan->hash_lock);
4009 if (err)
4010 goto unlink;
4011 }
4012
4013 list_add(&vxlan->next, &vn->vxlan_list);
4014
4015 return 0;
4016
4017 unlink:
4018 if (remote_dev)
4019 netdev_upper_dev_unlink(remote_dev, dev);
4020 unregister:
4021 unregister_netdevice(dev);
4022 return err;
4023 }
4024
4025 /* Set/clear flags based on attribute */
vxlan_nl2flag(struct vxlan_config * conf,struct nlattr * tb[],int attrtype,unsigned long mask,bool changelink,bool changelink_supported,struct netlink_ext_ack * extack)4026 static int vxlan_nl2flag(struct vxlan_config *conf, struct nlattr *tb[],
4027 int attrtype, unsigned long mask, bool changelink,
4028 bool changelink_supported,
4029 struct netlink_ext_ack *extack)
4030 {
4031 unsigned long flags;
4032
4033 if (!tb[attrtype])
4034 return 0;
4035
4036 if (changelink && !changelink_supported) {
4037 vxlan_flag_attr_error(attrtype, extack);
4038 return -EOPNOTSUPP;
4039 }
4040
4041 if (vxlan_policy[attrtype].type == NLA_FLAG)
4042 flags = conf->flags | mask;
4043 else if (nla_get_u8(tb[attrtype]))
4044 flags = conf->flags | mask;
4045 else
4046 flags = conf->flags & ~mask;
4047
4048 conf->flags = flags;
4049
4050 return 0;
4051 }
4052
vxlan_nl2conf(struct nlattr * tb[],struct nlattr * data[],struct net_device * dev,struct vxlan_config * conf,bool changelink,struct netlink_ext_ack * extack)4053 static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[],
4054 struct net_device *dev, struct vxlan_config *conf,
4055 bool changelink, struct netlink_ext_ack *extack)
4056 {
4057 struct vxlanhdr used_bits = {
4058 .vx_flags = VXLAN_HF_VNI,
4059 .vx_vni = VXLAN_VNI_MASK,
4060 };
4061 struct vxlan_dev *vxlan = netdev_priv(dev);
4062 int err = 0;
4063
4064 memset(conf, 0, sizeof(*conf));
4065
4066 /* if changelink operation, start with old existing cfg */
4067 if (changelink)
4068 memcpy(conf, &vxlan->cfg, sizeof(*conf));
4069
4070 if (data[IFLA_VXLAN_ID]) {
4071 __be32 vni = cpu_to_be32(nla_get_u32(data[IFLA_VXLAN_ID]));
4072
4073 if (changelink && (vni != conf->vni)) {
4074 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_ID], "Cannot change VNI");
4075 return -EOPNOTSUPP;
4076 }
4077 conf->vni = vni;
4078 }
4079
4080 if (data[IFLA_VXLAN_GROUP]) {
4081 if (changelink && (conf->remote_ip.sa.sa_family != AF_INET)) {
4082 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP], "New group address family does not match old group");
4083 return -EOPNOTSUPP;
4084 }
4085
4086 conf->remote_ip.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_GROUP]);
4087 conf->remote_ip.sa.sa_family = AF_INET;
4088 } else if (data[IFLA_VXLAN_GROUP6]) {
4089 if (!IS_ENABLED(CONFIG_IPV6)) {
4090 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP6], "IPv6 support not enabled in the kernel");
4091 return -EPFNOSUPPORT;
4092 }
4093
4094 if (changelink && (conf->remote_ip.sa.sa_family != AF_INET6)) {
4095 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_GROUP6], "New group address family does not match old group");
4096 return -EOPNOTSUPP;
4097 }
4098
4099 conf->remote_ip.sin6.sin6_addr = nla_get_in6_addr(data[IFLA_VXLAN_GROUP6]);
4100 conf->remote_ip.sa.sa_family = AF_INET6;
4101 }
4102
4103 if (data[IFLA_VXLAN_LOCAL]) {
4104 if (changelink && (conf->saddr.sa.sa_family != AF_INET)) {
4105 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL], "New local address family does not match old");
4106 return -EOPNOTSUPP;
4107 }
4108
4109 conf->saddr.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_LOCAL]);
4110 conf->saddr.sa.sa_family = AF_INET;
4111 } else if (data[IFLA_VXLAN_LOCAL6]) {
4112 if (!IS_ENABLED(CONFIG_IPV6)) {
4113 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL6], "IPv6 support not enabled in the kernel");
4114 return -EPFNOSUPPORT;
4115 }
4116
4117 if (changelink && (conf->saddr.sa.sa_family != AF_INET6)) {
4118 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LOCAL6], "New local address family does not match old");
4119 return -EOPNOTSUPP;
4120 }
4121
4122 /* TODO: respect scope id */
4123 conf->saddr.sin6.sin6_addr = nla_get_in6_addr(data[IFLA_VXLAN_LOCAL6]);
4124 conf->saddr.sa.sa_family = AF_INET6;
4125 }
4126
4127 if (data[IFLA_VXLAN_LINK])
4128 conf->remote_ifindex = nla_get_u32(data[IFLA_VXLAN_LINK]);
4129
4130 if (data[IFLA_VXLAN_TOS])
4131 conf->tos = nla_get_u8(data[IFLA_VXLAN_TOS]);
4132
4133 if (data[IFLA_VXLAN_TTL])
4134 conf->ttl = nla_get_u8(data[IFLA_VXLAN_TTL]);
4135
4136 if (data[IFLA_VXLAN_TTL_INHERIT]) {
4137 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_TTL_INHERIT,
4138 VXLAN_F_TTL_INHERIT, changelink, false,
4139 extack);
4140 if (err)
4141 return err;
4142
4143 }
4144
4145 if (data[IFLA_VXLAN_LABEL])
4146 conf->label = nla_get_be32(data[IFLA_VXLAN_LABEL]) &
4147 IPV6_FLOWLABEL_MASK;
4148 if (data[IFLA_VXLAN_LABEL_POLICY])
4149 conf->label_policy = nla_get_u32(data[IFLA_VXLAN_LABEL_POLICY]);
4150
4151 if (data[IFLA_VXLAN_LEARNING]) {
4152 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_LEARNING,
4153 VXLAN_F_LEARN, changelink, true,
4154 extack);
4155 if (err)
4156 return err;
4157 } else if (!changelink) {
4158 /* default to learn on a new device */
4159 conf->flags |= VXLAN_F_LEARN;
4160 }
4161
4162 if (data[IFLA_VXLAN_AGEING])
4163 conf->age_interval = nla_get_u32(data[IFLA_VXLAN_AGEING]);
4164
4165 if (data[IFLA_VXLAN_PROXY]) {
4166 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_PROXY,
4167 VXLAN_F_PROXY, changelink, false,
4168 extack);
4169 if (err)
4170 return err;
4171 }
4172
4173 if (data[IFLA_VXLAN_RSC]) {
4174 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_RSC,
4175 VXLAN_F_RSC, changelink, false,
4176 extack);
4177 if (err)
4178 return err;
4179 }
4180
4181 if (data[IFLA_VXLAN_L2MISS]) {
4182 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_L2MISS,
4183 VXLAN_F_L2MISS, changelink, false,
4184 extack);
4185 if (err)
4186 return err;
4187 }
4188
4189 if (data[IFLA_VXLAN_L3MISS]) {
4190 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_L3MISS,
4191 VXLAN_F_L3MISS, changelink, false,
4192 extack);
4193 if (err)
4194 return err;
4195 }
4196
4197 if (data[IFLA_VXLAN_LIMIT]) {
4198 if (changelink) {
4199 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_LIMIT],
4200 "Cannot change limit");
4201 return -EOPNOTSUPP;
4202 }
4203 conf->addrmax = nla_get_u32(data[IFLA_VXLAN_LIMIT]);
4204 }
4205
4206 if (data[IFLA_VXLAN_COLLECT_METADATA]) {
4207 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_COLLECT_METADATA,
4208 VXLAN_F_COLLECT_METADATA, changelink, false,
4209 extack);
4210 if (err)
4211 return err;
4212 }
4213
4214 if (data[IFLA_VXLAN_PORT_RANGE]) {
4215 if (!changelink) {
4216 const struct ifla_vxlan_port_range *p
4217 = nla_data(data[IFLA_VXLAN_PORT_RANGE]);
4218 conf->port_min = ntohs(p->low);
4219 conf->port_max = ntohs(p->high);
4220 } else {
4221 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_PORT_RANGE],
4222 "Cannot change port range");
4223 return -EOPNOTSUPP;
4224 }
4225 }
4226
4227 if (data[IFLA_VXLAN_PORT]) {
4228 if (changelink) {
4229 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_PORT],
4230 "Cannot change port");
4231 return -EOPNOTSUPP;
4232 }
4233 conf->dst_port = nla_get_be16(data[IFLA_VXLAN_PORT]);
4234 }
4235
4236 if (data[IFLA_VXLAN_UDP_CSUM]) {
4237 if (changelink) {
4238 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_VXLAN_UDP_CSUM],
4239 "Cannot change UDP_CSUM flag");
4240 return -EOPNOTSUPP;
4241 }
4242 if (!nla_get_u8(data[IFLA_VXLAN_UDP_CSUM]))
4243 conf->flags |= VXLAN_F_UDP_ZERO_CSUM_TX;
4244 }
4245
4246 if (data[IFLA_VXLAN_LOCALBYPASS]) {
4247 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_LOCALBYPASS,
4248 VXLAN_F_LOCALBYPASS, changelink,
4249 true, extack);
4250 if (err)
4251 return err;
4252 } else if (!changelink) {
4253 /* default to local bypass on a new device */
4254 conf->flags |= VXLAN_F_LOCALBYPASS;
4255 }
4256
4257 if (data[IFLA_VXLAN_UDP_ZERO_CSUM6_TX]) {
4258 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_UDP_ZERO_CSUM6_TX,
4259 VXLAN_F_UDP_ZERO_CSUM6_TX, changelink,
4260 false, extack);
4261 if (err)
4262 return err;
4263 }
4264
4265 if (data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]) {
4266 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_UDP_ZERO_CSUM6_RX,
4267 VXLAN_F_UDP_ZERO_CSUM6_RX, changelink,
4268 false, extack);
4269 if (err)
4270 return err;
4271 }
4272
4273 if (data[IFLA_VXLAN_REMCSUM_TX]) {
4274 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_TX,
4275 VXLAN_F_REMCSUM_TX, changelink, false,
4276 extack);
4277 if (err)
4278 return err;
4279 }
4280
4281 if (data[IFLA_VXLAN_REMCSUM_RX]) {
4282 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_RX,
4283 VXLAN_F_REMCSUM_RX, changelink, false,
4284 extack);
4285 if (err)
4286 return err;
4287 used_bits.vx_flags |= VXLAN_HF_RCO;
4288 used_bits.vx_vni |= ~VXLAN_VNI_MASK;
4289 }
4290
4291 if (data[IFLA_VXLAN_GBP]) {
4292 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_GBP,
4293 VXLAN_F_GBP, changelink, false, extack);
4294 if (err)
4295 return err;
4296 used_bits.vx_flags |= VXLAN_GBP_USED_BITS;
4297 }
4298
4299 if (data[IFLA_VXLAN_GPE]) {
4300 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_GPE,
4301 VXLAN_F_GPE, changelink, false,
4302 extack);
4303 if (err)
4304 return err;
4305
4306 used_bits.vx_flags |= VXLAN_GPE_USED_BITS;
4307 }
4308
4309 if (data[IFLA_VXLAN_RESERVED_BITS]) {
4310 struct vxlanhdr reserved_bits;
4311
4312 if (changelink) {
4313 NL_SET_ERR_MSG_ATTR(extack,
4314 data[IFLA_VXLAN_RESERVED_BITS],
4315 "Cannot change reserved_bits");
4316 return -EOPNOTSUPP;
4317 }
4318
4319 nla_memcpy(&reserved_bits, data[IFLA_VXLAN_RESERVED_BITS],
4320 sizeof(reserved_bits));
4321 if (used_bits.vx_flags & reserved_bits.vx_flags ||
4322 used_bits.vx_vni & reserved_bits.vx_vni) {
4323 __be64 ub_be64, rb_be64;
4324
4325 memcpy(&ub_be64, &used_bits, sizeof(ub_be64));
4326 memcpy(&rb_be64, &reserved_bits, sizeof(rb_be64));
4327
4328 NL_SET_ERR_MSG_ATTR_FMT(extack,
4329 data[IFLA_VXLAN_RESERVED_BITS],
4330 "Used bits %#018llx cannot overlap reserved bits %#018llx",
4331 be64_to_cpu(ub_be64),
4332 be64_to_cpu(rb_be64));
4333 return -EINVAL;
4334 }
4335
4336 conf->reserved_bits = reserved_bits;
4337 } else {
4338 /* For backwards compatibility, only allow reserved fields to be
4339 * used by VXLAN extensions if explicitly requested.
4340 */
4341 conf->reserved_bits = (struct vxlanhdr) {
4342 .vx_flags = ~used_bits.vx_flags,
4343 .vx_vni = ~used_bits.vx_vni,
4344 };
4345 }
4346
4347 if (data[IFLA_VXLAN_REMCSUM_NOPARTIAL]) {
4348 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_REMCSUM_NOPARTIAL,
4349 VXLAN_F_REMCSUM_NOPARTIAL, changelink,
4350 false, extack);
4351 if (err)
4352 return err;
4353 }
4354
4355 if (data[IFLA_VXLAN_MC_ROUTE]) {
4356 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_MC_ROUTE,
4357 VXLAN_F_MC_ROUTE, changelink,
4358 true, extack);
4359 if (err)
4360 return err;
4361 }
4362
4363 if (tb[IFLA_MTU]) {
4364 if (changelink) {
4365 NL_SET_ERR_MSG_ATTR(extack, tb[IFLA_MTU],
4366 "Cannot change mtu");
4367 return -EOPNOTSUPP;
4368 }
4369 conf->mtu = nla_get_u32(tb[IFLA_MTU]);
4370 }
4371
4372 if (data[IFLA_VXLAN_DF])
4373 conf->df = nla_get_u8(data[IFLA_VXLAN_DF]);
4374
4375 if (data[IFLA_VXLAN_VNIFILTER]) {
4376 err = vxlan_nl2flag(conf, data, IFLA_VXLAN_VNIFILTER,
4377 VXLAN_F_VNIFILTER, changelink, false,
4378 extack);
4379 if (err)
4380 return err;
4381
4382 if ((conf->flags & VXLAN_F_VNIFILTER) &&
4383 !(conf->flags & VXLAN_F_COLLECT_METADATA)) {
4384 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VXLAN_VNIFILTER],
4385 "vxlan vnifilter only valid in collect metadata mode");
4386 return -EINVAL;
4387 }
4388 }
4389
4390 return 0;
4391 }
4392
vxlan_newlink(struct net_device * dev,struct rtnl_newlink_params * params,struct netlink_ext_ack * extack)4393 static int vxlan_newlink(struct net_device *dev,
4394 struct rtnl_newlink_params *params,
4395 struct netlink_ext_ack *extack)
4396 {
4397 struct net *link_net = rtnl_newlink_link_net(params);
4398 struct nlattr **data = params->data;
4399 struct nlattr **tb = params->tb;
4400 struct vxlan_config conf;
4401 int err;
4402
4403 err = vxlan_nl2conf(tb, data, dev, &conf, false, extack);
4404 if (err)
4405 return err;
4406
4407 return __vxlan_dev_create(link_net, dev, &conf, extack);
4408 }
4409
vxlan_changelink(struct net_device * dev,struct nlattr * tb[],struct nlattr * data[],struct netlink_ext_ack * extack)4410 static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[],
4411 struct nlattr *data[],
4412 struct netlink_ext_ack *extack)
4413 {
4414 struct vxlan_dev *vxlan = netdev_priv(dev);
4415 bool rem_ip_changed, change_igmp;
4416 struct net_device *lowerdev;
4417 struct vxlan_config conf;
4418 struct vxlan_rdst *dst;
4419 int err;
4420
4421 dst = &vxlan->default_dst;
4422 err = vxlan_nl2conf(tb, data, dev, &conf, true, extack);
4423 if (err)
4424 return err;
4425
4426 err = vxlan_config_validate(vxlan->net, &conf, &lowerdev,
4427 vxlan, extack);
4428 if (err)
4429 return err;
4430
4431 if (dst->remote_dev == lowerdev)
4432 lowerdev = NULL;
4433
4434 err = netdev_adjacent_change_prepare(dst->remote_dev, lowerdev, dev,
4435 extack);
4436 if (err)
4437 return err;
4438
4439 rem_ip_changed = !vxlan_addr_equal(&conf.remote_ip, &dst->remote_ip);
4440 change_igmp = vxlan->dev->flags & IFF_UP &&
4441 (rem_ip_changed ||
4442 dst->remote_ifindex != conf.remote_ifindex);
4443
4444 /* handle default dst entry */
4445 if (rem_ip_changed) {
4446 spin_lock_bh(&vxlan->hash_lock);
4447 if (!vxlan_addr_any(&conf.remote_ip)) {
4448 err = vxlan_fdb_update(vxlan, all_zeros_mac,
4449 &conf.remote_ip,
4450 NUD_REACHABLE | NUD_PERMANENT,
4451 NLM_F_APPEND | NLM_F_CREATE,
4452 vxlan->cfg.dst_port,
4453 conf.vni, conf.vni,
4454 conf.remote_ifindex,
4455 NTF_SELF, 0, true, extack);
4456 if (err) {
4457 spin_unlock_bh(&vxlan->hash_lock);
4458 netdev_adjacent_change_abort(dst->remote_dev,
4459 lowerdev, dev);
4460 return err;
4461 }
4462 }
4463 if (!vxlan_addr_any(&dst->remote_ip))
4464 __vxlan_fdb_delete(vxlan, all_zeros_mac,
4465 dst->remote_ip,
4466 vxlan->cfg.dst_port,
4467 dst->remote_vni,
4468 dst->remote_vni,
4469 dst->remote_ifindex,
4470 true);
4471 spin_unlock_bh(&vxlan->hash_lock);
4472
4473 /* If vni filtering device, also update fdb entries of
4474 * all vnis that were using default remote ip
4475 */
4476 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER) {
4477 err = vxlan_vnilist_update_group(vxlan, &dst->remote_ip,
4478 &conf.remote_ip, extack);
4479 if (err) {
4480 netdev_adjacent_change_abort(dst->remote_dev,
4481 lowerdev, dev);
4482 return err;
4483 }
4484 }
4485 }
4486
4487 if (change_igmp && vxlan_addr_multicast(&dst->remote_ip))
4488 err = vxlan_multicast_leave(vxlan);
4489
4490 if (conf.age_interval != vxlan->cfg.age_interval)
4491 mod_timer(&vxlan->age_timer, jiffies);
4492
4493 netdev_adjacent_change_commit(dst->remote_dev, lowerdev, dev);
4494 if (lowerdev && lowerdev != dst->remote_dev)
4495 dst->remote_dev = lowerdev;
4496 vxlan_config_apply(dev, &conf, lowerdev, vxlan->net, true);
4497
4498 if (!err && change_igmp &&
4499 vxlan_addr_multicast(&dst->remote_ip))
4500 err = vxlan_multicast_join(vxlan);
4501
4502 return err;
4503 }
4504
vxlan_dellink(struct net_device * dev,struct list_head * head)4505 static void vxlan_dellink(struct net_device *dev, struct list_head *head)
4506 {
4507 struct vxlan_dev *vxlan = netdev_priv(dev);
4508 struct vxlan_fdb_flush_desc desc = {};
4509
4510 vxlan_flush(vxlan, &desc);
4511
4512 list_del(&vxlan->next);
4513 unregister_netdevice_queue(dev, head);
4514 if (vxlan->default_dst.remote_dev)
4515 netdev_upper_dev_unlink(vxlan->default_dst.remote_dev, dev);
4516 }
4517
vxlan_get_size(const struct net_device * dev)4518 static size_t vxlan_get_size(const struct net_device *dev)
4519 {
4520 return nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_ID */
4521 nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_GROUP{6} */
4522 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_LINK */
4523 nla_total_size(sizeof(struct in6_addr)) + /* IFLA_VXLAN_LOCAL{6} */
4524 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_TTL */
4525 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_TTL_INHERIT */
4526 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_TOS */
4527 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_DF */
4528 nla_total_size(sizeof(__be32)) + /* IFLA_VXLAN_LABEL */
4529 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_LABEL_POLICY */
4530 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_LEARNING */
4531 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_PROXY */
4532 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_RSC */
4533 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_L2MISS */
4534 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_L3MISS */
4535 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_COLLECT_METADATA */
4536 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_AGEING */
4537 nla_total_size(sizeof(__u32)) + /* IFLA_VXLAN_LIMIT */
4538 nla_total_size(sizeof(__be16)) + /* IFLA_VXLAN_PORT */
4539 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_CSUM */
4540 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_ZERO_CSUM6_TX */
4541 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_UDP_ZERO_CSUM6_RX */
4542 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_REMCSUM_TX */
4543 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_REMCSUM_RX */
4544 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_LOCALBYPASS */
4545 /* IFLA_VXLAN_PORT_RANGE */
4546 nla_total_size(sizeof(struct ifla_vxlan_port_range)) +
4547 nla_total_size(0) + /* IFLA_VXLAN_GBP */
4548 nla_total_size(0) + /* IFLA_VXLAN_GPE */
4549 nla_total_size(0) + /* IFLA_VXLAN_REMCSUM_NOPARTIAL */
4550 nla_total_size(sizeof(__u8)) + /* IFLA_VXLAN_VNIFILTER */
4551 /* IFLA_VXLAN_RESERVED_BITS */
4552 nla_total_size(sizeof(struct vxlanhdr)) +
4553 0;
4554 }
4555
vxlan_fill_info(struct sk_buff * skb,const struct net_device * dev)4556 static int vxlan_fill_info(struct sk_buff *skb, const struct net_device *dev)
4557 {
4558 const struct vxlan_dev *vxlan = netdev_priv(dev);
4559 const struct vxlan_rdst *dst = &vxlan->default_dst;
4560 struct ifla_vxlan_port_range ports = {
4561 .low = htons(vxlan->cfg.port_min),
4562 .high = htons(vxlan->cfg.port_max),
4563 };
4564
4565 if (nla_put_u32(skb, IFLA_VXLAN_ID, be32_to_cpu(dst->remote_vni)))
4566 goto nla_put_failure;
4567
4568 if (!vxlan_addr_any(&dst->remote_ip)) {
4569 if (dst->remote_ip.sa.sa_family == AF_INET) {
4570 if (nla_put_in_addr(skb, IFLA_VXLAN_GROUP,
4571 dst->remote_ip.sin.sin_addr.s_addr))
4572 goto nla_put_failure;
4573 #if IS_ENABLED(CONFIG_IPV6)
4574 } else {
4575 if (nla_put_in6_addr(skb, IFLA_VXLAN_GROUP6,
4576 &dst->remote_ip.sin6.sin6_addr))
4577 goto nla_put_failure;
4578 #endif
4579 }
4580 }
4581
4582 if (dst->remote_ifindex && nla_put_u32(skb, IFLA_VXLAN_LINK, dst->remote_ifindex))
4583 goto nla_put_failure;
4584
4585 if (!vxlan_addr_any(&vxlan->cfg.saddr)) {
4586 if (vxlan->cfg.saddr.sa.sa_family == AF_INET) {
4587 if (nla_put_in_addr(skb, IFLA_VXLAN_LOCAL,
4588 vxlan->cfg.saddr.sin.sin_addr.s_addr))
4589 goto nla_put_failure;
4590 #if IS_ENABLED(CONFIG_IPV6)
4591 } else {
4592 if (nla_put_in6_addr(skb, IFLA_VXLAN_LOCAL6,
4593 &vxlan->cfg.saddr.sin6.sin6_addr))
4594 goto nla_put_failure;
4595 #endif
4596 }
4597 }
4598
4599 if (nla_put_u8(skb, IFLA_VXLAN_TTL, vxlan->cfg.ttl) ||
4600 nla_put_u8(skb, IFLA_VXLAN_TTL_INHERIT,
4601 !!(vxlan->cfg.flags & VXLAN_F_TTL_INHERIT)) ||
4602 nla_put_u8(skb, IFLA_VXLAN_TOS, vxlan->cfg.tos) ||
4603 nla_put_u8(skb, IFLA_VXLAN_DF, vxlan->cfg.df) ||
4604 nla_put_be32(skb, IFLA_VXLAN_LABEL, vxlan->cfg.label) ||
4605 nla_put_u32(skb, IFLA_VXLAN_LABEL_POLICY, vxlan->cfg.label_policy) ||
4606 nla_put_u8(skb, IFLA_VXLAN_LEARNING,
4607 !!(vxlan->cfg.flags & VXLAN_F_LEARN)) ||
4608 nla_put_u8(skb, IFLA_VXLAN_PROXY,
4609 !!(vxlan->cfg.flags & VXLAN_F_PROXY)) ||
4610 nla_put_u8(skb, IFLA_VXLAN_RSC,
4611 !!(vxlan->cfg.flags & VXLAN_F_RSC)) ||
4612 nla_put_u8(skb, IFLA_VXLAN_L2MISS,
4613 !!(vxlan->cfg.flags & VXLAN_F_L2MISS)) ||
4614 nla_put_u8(skb, IFLA_VXLAN_L3MISS,
4615 !!(vxlan->cfg.flags & VXLAN_F_L3MISS)) ||
4616 nla_put_u8(skb, IFLA_VXLAN_COLLECT_METADATA,
4617 !!(vxlan->cfg.flags & VXLAN_F_COLLECT_METADATA)) ||
4618 nla_put_u32(skb, IFLA_VXLAN_AGEING, vxlan->cfg.age_interval) ||
4619 nla_put_u32(skb, IFLA_VXLAN_LIMIT, vxlan->cfg.addrmax) ||
4620 nla_put_be16(skb, IFLA_VXLAN_PORT, vxlan->cfg.dst_port) ||
4621 nla_put_u8(skb, IFLA_VXLAN_UDP_CSUM,
4622 !(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM_TX)) ||
4623 nla_put_u8(skb, IFLA_VXLAN_UDP_ZERO_CSUM6_TX,
4624 !!(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM6_TX)) ||
4625 nla_put_u8(skb, IFLA_VXLAN_UDP_ZERO_CSUM6_RX,
4626 !!(vxlan->cfg.flags & VXLAN_F_UDP_ZERO_CSUM6_RX)) ||
4627 nla_put_u8(skb, IFLA_VXLAN_REMCSUM_TX,
4628 !!(vxlan->cfg.flags & VXLAN_F_REMCSUM_TX)) ||
4629 nla_put_u8(skb, IFLA_VXLAN_REMCSUM_RX,
4630 !!(vxlan->cfg.flags & VXLAN_F_REMCSUM_RX)) ||
4631 nla_put_u8(skb, IFLA_VXLAN_LOCALBYPASS,
4632 !!(vxlan->cfg.flags & VXLAN_F_LOCALBYPASS)))
4633 goto nla_put_failure;
4634
4635 if (nla_put(skb, IFLA_VXLAN_PORT_RANGE, sizeof(ports), &ports))
4636 goto nla_put_failure;
4637
4638 if (vxlan->cfg.flags & VXLAN_F_GBP &&
4639 nla_put_flag(skb, IFLA_VXLAN_GBP))
4640 goto nla_put_failure;
4641
4642 if (vxlan->cfg.flags & VXLAN_F_GPE &&
4643 nla_put_flag(skb, IFLA_VXLAN_GPE))
4644 goto nla_put_failure;
4645
4646 if (vxlan->cfg.flags & VXLAN_F_REMCSUM_NOPARTIAL &&
4647 nla_put_flag(skb, IFLA_VXLAN_REMCSUM_NOPARTIAL))
4648 goto nla_put_failure;
4649
4650 if (vxlan->cfg.flags & VXLAN_F_VNIFILTER &&
4651 nla_put_u8(skb, IFLA_VXLAN_VNIFILTER,
4652 !!(vxlan->cfg.flags & VXLAN_F_VNIFILTER)))
4653 goto nla_put_failure;
4654
4655 if (nla_put(skb, IFLA_VXLAN_RESERVED_BITS,
4656 sizeof(vxlan->cfg.reserved_bits),
4657 &vxlan->cfg.reserved_bits))
4658 goto nla_put_failure;
4659
4660 return 0;
4661
4662 nla_put_failure:
4663 return -EMSGSIZE;
4664 }
4665
vxlan_get_link_net(const struct net_device * dev)4666 static struct net *vxlan_get_link_net(const struct net_device *dev)
4667 {
4668 struct vxlan_dev *vxlan = netdev_priv(dev);
4669
4670 return READ_ONCE(vxlan->net);
4671 }
4672
4673 static struct rtnl_link_ops vxlan_link_ops __read_mostly = {
4674 .kind = "vxlan",
4675 .maxtype = IFLA_VXLAN_MAX,
4676 .policy = vxlan_policy,
4677 .priv_size = sizeof(struct vxlan_dev),
4678 .setup = vxlan_setup,
4679 .validate = vxlan_validate,
4680 .newlink = vxlan_newlink,
4681 .changelink = vxlan_changelink,
4682 .dellink = vxlan_dellink,
4683 .get_size = vxlan_get_size,
4684 .fill_info = vxlan_fill_info,
4685 .get_link_net = vxlan_get_link_net,
4686 };
4687
vxlan_dev_create(struct net * net,const char * name,u8 name_assign_type,struct vxlan_config * conf)4688 struct net_device *vxlan_dev_create(struct net *net, const char *name,
4689 u8 name_assign_type,
4690 struct vxlan_config *conf)
4691 {
4692 struct nlattr *tb[IFLA_MAX + 1];
4693 struct net_device *dev;
4694 int err;
4695
4696 memset(&tb, 0, sizeof(tb));
4697
4698 dev = rtnl_create_link(net, name, name_assign_type,
4699 &vxlan_link_ops, tb, NULL);
4700 if (IS_ERR(dev))
4701 return dev;
4702
4703 err = __vxlan_dev_create(net, dev, conf, NULL);
4704 if (err < 0) {
4705 free_netdev(dev);
4706 return ERR_PTR(err);
4707 }
4708
4709 err = rtnl_configure_link(dev, NULL, 0, NULL);
4710 if (err < 0) {
4711 LIST_HEAD(list_kill);
4712
4713 vxlan_dellink(dev, &list_kill);
4714 unregister_netdevice_many(&list_kill);
4715 return ERR_PTR(err);
4716 }
4717
4718 return dev;
4719 }
4720 EXPORT_SYMBOL_GPL(vxlan_dev_create);
4721
vxlan_handle_lowerdev_unregister(struct vxlan_net * vn,struct net_device * dev)4722 static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn,
4723 struct net_device *dev)
4724 {
4725 struct vxlan_dev *vxlan, *next;
4726 LIST_HEAD(list_kill);
4727
4728 list_for_each_entry_safe(vxlan, next, &vn->vxlan_list, next) {
4729 struct vxlan_rdst *dst = &vxlan->default_dst;
4730
4731 /* In case we created vxlan device with carrier
4732 * and we loose the carrier due to module unload
4733 * we also need to remove vxlan device. In other
4734 * cases, it's not necessary and remote_ifindex
4735 * is 0 here, so no matches.
4736 */
4737 if (dst->remote_ifindex == dev->ifindex)
4738 vxlan_dellink(vxlan->dev, &list_kill);
4739 }
4740
4741 unregister_netdevice_many(&list_kill);
4742 }
4743
vxlan_netdevice_event(struct notifier_block * unused,unsigned long event,void * ptr)4744 static int vxlan_netdevice_event(struct notifier_block *unused,
4745 unsigned long event, void *ptr)
4746 {
4747 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
4748 struct vxlan_net *vn = net_generic(dev_net(dev), vxlan_net_id);
4749
4750 if (event == NETDEV_UNREGISTER)
4751 vxlan_handle_lowerdev_unregister(vn, dev);
4752 else if (event == NETDEV_UDP_TUNNEL_PUSH_INFO)
4753 vxlan_offload_rx_ports(dev, true);
4754 else if (event == NETDEV_UDP_TUNNEL_DROP_INFO)
4755 vxlan_offload_rx_ports(dev, false);
4756
4757 return NOTIFY_DONE;
4758 }
4759
4760 static struct notifier_block vxlan_notifier_block __read_mostly = {
4761 .notifier_call = vxlan_netdevice_event,
4762 };
4763
4764 static void
vxlan_fdb_offloaded_set(struct net_device * dev,struct switchdev_notifier_vxlan_fdb_info * fdb_info)4765 vxlan_fdb_offloaded_set(struct net_device *dev,
4766 struct switchdev_notifier_vxlan_fdb_info *fdb_info)
4767 {
4768 struct vxlan_dev *vxlan = netdev_priv(dev);
4769 struct vxlan_rdst *rdst;
4770 struct vxlan_fdb *f;
4771
4772 spin_lock_bh(&vxlan->hash_lock);
4773
4774 f = vxlan_find_mac(vxlan, fdb_info->eth_addr, fdb_info->vni);
4775 if (!f)
4776 goto out;
4777
4778 rdst = vxlan_fdb_find_rdst(f, &fdb_info->remote_ip,
4779 fdb_info->remote_port,
4780 fdb_info->remote_vni,
4781 fdb_info->remote_ifindex);
4782 if (!rdst)
4783 goto out;
4784
4785 rdst->offloaded = fdb_info->offloaded;
4786
4787 out:
4788 spin_unlock_bh(&vxlan->hash_lock);
4789 }
4790
4791 static int
vxlan_fdb_external_learn_add(struct net_device * dev,struct switchdev_notifier_vxlan_fdb_info * fdb_info)4792 vxlan_fdb_external_learn_add(struct net_device *dev,
4793 struct switchdev_notifier_vxlan_fdb_info *fdb_info)
4794 {
4795 struct vxlan_dev *vxlan = netdev_priv(dev);
4796 struct netlink_ext_ack *extack;
4797 int err;
4798
4799 extack = switchdev_notifier_info_to_extack(&fdb_info->info);
4800
4801 spin_lock_bh(&vxlan->hash_lock);
4802 err = vxlan_fdb_update(vxlan, fdb_info->eth_addr, &fdb_info->remote_ip,
4803 NUD_REACHABLE,
4804 NLM_F_CREATE | NLM_F_REPLACE,
4805 fdb_info->remote_port,
4806 fdb_info->vni,
4807 fdb_info->remote_vni,
4808 fdb_info->remote_ifindex,
4809 NTF_USE | NTF_SELF | NTF_EXT_LEARNED,
4810 0, false, extack);
4811 spin_unlock_bh(&vxlan->hash_lock);
4812
4813 return err;
4814 }
4815
4816 static int
vxlan_fdb_external_learn_del(struct net_device * dev,struct switchdev_notifier_vxlan_fdb_info * fdb_info)4817 vxlan_fdb_external_learn_del(struct net_device *dev,
4818 struct switchdev_notifier_vxlan_fdb_info *fdb_info)
4819 {
4820 struct vxlan_dev *vxlan = netdev_priv(dev);
4821 struct vxlan_fdb *f;
4822 int err = 0;
4823
4824 spin_lock_bh(&vxlan->hash_lock);
4825
4826 f = vxlan_find_mac(vxlan, fdb_info->eth_addr, fdb_info->vni);
4827 if (!f)
4828 err = -ENOENT;
4829 else if (f->flags & NTF_EXT_LEARNED)
4830 err = __vxlan_fdb_delete(vxlan, fdb_info->eth_addr,
4831 fdb_info->remote_ip,
4832 fdb_info->remote_port,
4833 fdb_info->vni,
4834 fdb_info->remote_vni,
4835 fdb_info->remote_ifindex,
4836 false);
4837
4838 spin_unlock_bh(&vxlan->hash_lock);
4839
4840 return err;
4841 }
4842
vxlan_switchdev_event(struct notifier_block * unused,unsigned long event,void * ptr)4843 static int vxlan_switchdev_event(struct notifier_block *unused,
4844 unsigned long event, void *ptr)
4845 {
4846 struct net_device *dev = switchdev_notifier_info_to_dev(ptr);
4847 struct switchdev_notifier_vxlan_fdb_info *fdb_info;
4848 int err = 0;
4849
4850 switch (event) {
4851 case SWITCHDEV_VXLAN_FDB_OFFLOADED:
4852 vxlan_fdb_offloaded_set(dev, ptr);
4853 break;
4854 case SWITCHDEV_VXLAN_FDB_ADD_TO_BRIDGE:
4855 fdb_info = ptr;
4856 err = vxlan_fdb_external_learn_add(dev, fdb_info);
4857 if (err) {
4858 err = notifier_from_errno(err);
4859 break;
4860 }
4861 fdb_info->offloaded = true;
4862 vxlan_fdb_offloaded_set(dev, fdb_info);
4863 break;
4864 case SWITCHDEV_VXLAN_FDB_DEL_TO_BRIDGE:
4865 fdb_info = ptr;
4866 err = vxlan_fdb_external_learn_del(dev, fdb_info);
4867 if (err) {
4868 err = notifier_from_errno(err);
4869 break;
4870 }
4871 fdb_info->offloaded = false;
4872 vxlan_fdb_offloaded_set(dev, fdb_info);
4873 break;
4874 }
4875
4876 return err;
4877 }
4878
4879 static struct notifier_block vxlan_switchdev_notifier_block __read_mostly = {
4880 .notifier_call = vxlan_switchdev_event,
4881 };
4882
vxlan_fdb_nh_flush(struct nexthop * nh)4883 static void vxlan_fdb_nh_flush(struct nexthop *nh)
4884 {
4885 struct vxlan_fdb *fdb;
4886 struct vxlan_dev *vxlan;
4887
4888 rcu_read_lock();
4889 list_for_each_entry_rcu(fdb, &nh->fdb_list, nh_list) {
4890 vxlan = rcu_dereference(fdb->vdev);
4891 WARN_ON(!vxlan);
4892 spin_lock_bh(&vxlan->hash_lock);
4893 if (!hlist_unhashed(&fdb->fdb_node))
4894 vxlan_fdb_destroy(vxlan, fdb, false, false);
4895 spin_unlock_bh(&vxlan->hash_lock);
4896 }
4897 rcu_read_unlock();
4898 }
4899
vxlan_nexthop_event(struct notifier_block * nb,unsigned long event,void * ptr)4900 static int vxlan_nexthop_event(struct notifier_block *nb,
4901 unsigned long event, void *ptr)
4902 {
4903 struct nh_notifier_info *info = ptr;
4904 struct nexthop *nh;
4905
4906 if (event != NEXTHOP_EVENT_DEL)
4907 return NOTIFY_DONE;
4908
4909 nh = nexthop_find_by_id(info->net, info->id);
4910 if (!nh)
4911 return NOTIFY_DONE;
4912
4913 vxlan_fdb_nh_flush(nh);
4914
4915 return NOTIFY_DONE;
4916 }
4917
vxlan_init_net(struct net * net)4918 static __net_init int vxlan_init_net(struct net *net)
4919 {
4920 struct vxlan_net *vn = net_generic(net, vxlan_net_id);
4921 unsigned int h;
4922
4923 INIT_LIST_HEAD(&vn->vxlan_list);
4924 vn->nexthop_notifier_block.notifier_call = vxlan_nexthop_event;
4925
4926 for (h = 0; h < PORT_HASH_SIZE; ++h)
4927 INIT_HLIST_HEAD(&vn->sock_list[h]);
4928
4929 return register_nexthop_notifier(net, &vn->nexthop_notifier_block,
4930 NULL);
4931 }
4932
vxlan_destroy_tunnels(struct vxlan_net * vn,struct list_head * dev_to_kill)4933 static void __net_exit vxlan_destroy_tunnels(struct vxlan_net *vn,
4934 struct list_head *dev_to_kill)
4935 {
4936 struct vxlan_dev *vxlan, *next;
4937
4938 list_for_each_entry_safe(vxlan, next, &vn->vxlan_list, next)
4939 vxlan_dellink(vxlan->dev, dev_to_kill);
4940 }
4941
vxlan_exit_rtnl(struct net * net,struct list_head * dev_to_kill)4942 static void __net_exit vxlan_exit_rtnl(struct net *net,
4943 struct list_head *dev_to_kill)
4944 {
4945 struct vxlan_net *vn = net_generic(net, vxlan_net_id);
4946
4947 ASSERT_RTNL_NET(net);
4948
4949 __unregister_nexthop_notifier(net, &vn->nexthop_notifier_block);
4950 vxlan_destroy_tunnels(vn, dev_to_kill);
4951 }
4952
vxlan_exit_net(struct net * net)4953 static void __net_exit vxlan_exit_net(struct net *net)
4954 {
4955 struct vxlan_net *vn = net_generic(net, vxlan_net_id);
4956 unsigned int h;
4957
4958 for (h = 0; h < PORT_HASH_SIZE; ++h)
4959 WARN_ON_ONCE(!hlist_empty(&vn->sock_list[h]));
4960 }
4961
4962 static struct pernet_operations vxlan_net_ops = {
4963 .init = vxlan_init_net,
4964 .exit_rtnl = vxlan_exit_rtnl,
4965 .exit = vxlan_exit_net,
4966 .id = &vxlan_net_id,
4967 .size = sizeof(struct vxlan_net),
4968 };
4969
vxlan_init_module(void)4970 static int __init vxlan_init_module(void)
4971 {
4972 int rc;
4973
4974 rc = register_pernet_subsys(&vxlan_net_ops);
4975 if (rc)
4976 goto out1;
4977
4978 rc = register_netdevice_notifier(&vxlan_notifier_block);
4979 if (rc)
4980 goto out2;
4981
4982 rc = register_switchdev_notifier(&vxlan_switchdev_notifier_block);
4983 if (rc)
4984 goto out3;
4985
4986 rc = rtnl_link_register(&vxlan_link_ops);
4987 if (rc)
4988 goto out4;
4989
4990 rc = vxlan_vnifilter_init();
4991 if (rc)
4992 goto out5;
4993
4994 return 0;
4995 out5:
4996 rtnl_link_unregister(&vxlan_link_ops);
4997 out4:
4998 unregister_switchdev_notifier(&vxlan_switchdev_notifier_block);
4999 out3:
5000 unregister_netdevice_notifier(&vxlan_notifier_block);
5001 out2:
5002 unregister_pernet_subsys(&vxlan_net_ops);
5003 out1:
5004 return rc;
5005 }
5006 late_initcall(vxlan_init_module);
5007
vxlan_cleanup_module(void)5008 static void __exit vxlan_cleanup_module(void)
5009 {
5010 vxlan_vnifilter_uninit();
5011 rtnl_link_unregister(&vxlan_link_ops);
5012 unregister_switchdev_notifier(&vxlan_switchdev_notifier_block);
5013 unregister_netdevice_notifier(&vxlan_notifier_block);
5014 unregister_pernet_subsys(&vxlan_net_ops);
5015 /* rcu_barrier() is called by netns */
5016 }
5017 module_exit(vxlan_cleanup_module);
5018
5019 MODULE_LICENSE("GPL");
5020 MODULE_VERSION(VXLAN_VERSION);
5021 MODULE_AUTHOR("Stephen Hemminger <stephen@networkplumber.org>");
5022 MODULE_DESCRIPTION("Driver for VXLAN encapsulated traffic");
5023 MODULE_ALIAS_RTNL_LINK("vxlan");
5024