projects/linux·blob assoc-array-fixes · refs

1969 lines · 44.6 KiB

1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * vrf.c: device driver to encapsulate a VRF space
4 *
5 * Copyright (c) 2015 Cumulus Networks. All rights reserved.
6 * Copyright (c) 2015 Shrijeet Mukherjee <[email protected]>
7 * Copyright (c) 2015 David Ahern <[email protected]>
8 *
9 * Based on dummy, team and ipvlan drivers
10 */
11
12#include <linux/ethtool.h>
13#include <linux/module.h>
14#include <linux/kernel.h>
15#include <linux/netdevice.h>
16#include <linux/etherdevice.h>
17#include <linux/ip.h>
18#include <linux/init.h>
19#include <linux/moduleparam.h>
20#include <linux/netfilter.h>
21#include <linux/rtnetlink.h>
22#include <net/rtnetlink.h>
23#include <linux/u64_stats_sync.h>
24#include <linux/hashtable.h>
25#include <linux/spinlock_types.h>
26
27#include <linux/inetdevice.h>
28#include <net/arp.h>
29#include <net/flow.h>
30#include <net/ip.h>
31#include <net/ip_fib.h>
32#include <net/ip6_fib.h>
33#include <net/ip6_route.h>
34#include <net/route.h>
35#include <net/addrconf.h>
36#include <net/l3mdev.h>
37#include <net/fib_rules.h>
38#include <net/netdev_lock.h>
39#include <net/sch_generic.h>
40#include <net/netns/generic.h>
41#include <net/netfilter/nf_conntrack.h>
42
43#define DRV_NAME "vrf"
44#define DRV_VERSION "1.1"
45
46#define FIB_RULE_PREF 1000 /* default preference for FIB rules */
47
48#define HT_MAP_BITS 4
49#define HASH_INITVAL ((u32)0xcafef00d)
50
51struct vrf_map {
52 DECLARE_HASHTABLE(ht, HT_MAP_BITS);
53 spinlock_t vmap_lock;
54
55 /* shared_tables:
56 * count how many distinct tables do not comply with the strict mode
57 * requirement.
58 * shared_tables value must be 0 in order to enable the strict mode.
59 *
60 * example of the evolution of shared_tables:
61 * | time
62 * add vrf0 --> table 100 shared_tables = 0 | t0
63 * add vrf1 --> table 101 shared_tables = 0 | t1
64 * add vrf2 --> table 100 shared_tables = 1 | t2
65 * add vrf3 --> table 100 shared_tables = 1 | t3
66 * add vrf4 --> table 101 shared_tables = 2 v t4
67 *
68 * shared_tables is a "step function" (or "staircase function")
69 * and it is increased by one when the second vrf is associated to a
70 * table.
71 *
72 * at t2, vrf0 and vrf2 are bound to table 100: shared_tables = 1.
73 *
74 * at t3, another dev (vrf3) is bound to the same table 100 but the
75 * value of shared_tables is still 1.
76 * This means that no matter how many new vrfs will register on the
77 * table 100, the shared_tables will not increase (considering only
78 * table 100).
79 *
80 * at t4, vrf4 is bound to table 101, and shared_tables = 2.
81 *
82 * Looking at the value of shared_tables we can immediately know if
83 * the strict_mode can or cannot be enforced. Indeed, strict_mode
84 * can be enforced iff shared_tables = 0.
85 *
86 * Conversely, shared_tables is decreased when a vrf is de-associated
87 * from a table with exactly two associated vrfs.
88 */
89 u32 shared_tables;
90
91 bool strict_mode;
92};
93
94struct vrf_map_elem {
95 struct hlist_node hnode;
96 struct list_head vrf_list; /* VRFs registered to this table */
97
98 u32 table_id;
99 int users;
100 int ifindex;
101};
102
103static unsigned int vrf_net_id;
104
105/* per netns vrf data */
106struct netns_vrf {
107 /* protected by rtnl lock */
108 bool add_fib_rules;
109
110 struct vrf_map vmap;
111 struct ctl_table_header *ctl_hdr;
112};
113
114struct net_vrf {
115 struct rtable *rth;
116 struct rt6_info *rt6;
117#if IS_ENABLED(CONFIG_IPV6)
118 struct fib6_table *fib6_table;
119#endif
120 u32 tb_id;
121
122 struct list_head me_list; /* entry in vrf_map_elem */
123 int ifindex;
124};
125
126static void vrf_tx_error(struct net_device *vrf_dev, struct sk_buff *skb)
127{
128 vrf_dev->stats.tx_errors++;
129 kfree_skb(skb);
130}
131
132static struct vrf_map *netns_vrf_map(struct net *net)
133{
134 struct netns_vrf *nn_vrf = net_generic(net, vrf_net_id);
135
136 return &nn_vrf->vmap;
137}
138
139static struct vrf_map *netns_vrf_map_by_dev(struct net_device *dev)
140{
141 return netns_vrf_map(dev_net(dev));
142}
143
144static int vrf_map_elem_get_vrf_ifindex(struct vrf_map_elem *me)
145{
146 struct list_head *me_head = &me->vrf_list;
147 struct net_vrf *vrf;
148
149 if (list_empty(me_head))
150 return -ENODEV;
151
152 vrf = list_first_entry(me_head, struct net_vrf, me_list);
153
154 return vrf->ifindex;
155}
156
157static struct vrf_map_elem *vrf_map_elem_alloc(gfp_t flags)
158{
159 struct vrf_map_elem *me;
160
161 me = kmalloc_obj(*me, flags);
162 if (!me)
163 return NULL;
164
165 return me;
166}
167
168static void vrf_map_elem_free(struct vrf_map_elem *me)
169{
170 kfree(me);
171}
172
173static void vrf_map_elem_init(struct vrf_map_elem *me, int table_id,
174 int ifindex, int users)
175{
176 me->table_id = table_id;
177 me->ifindex = ifindex;
178 me->users = users;
179 INIT_LIST_HEAD(&me->vrf_list);
180}
181
182static struct vrf_map_elem *vrf_map_lookup_elem(struct vrf_map *vmap,
183 u32 table_id)
184{
185 struct vrf_map_elem *me;
186 u32 key;
187
188 key = jhash_1word(table_id, HASH_INITVAL);
189 hash_for_each_possible(vmap->ht, me, hnode, key) {
190 if (me->table_id == table_id)
191 return me;
192 }
193
194 return NULL;
195}
196
197static void vrf_map_add_elem(struct vrf_map *vmap, struct vrf_map_elem *me)
198{
199 u32 table_id = me->table_id;
200 u32 key;
201
202 key = jhash_1word(table_id, HASH_INITVAL);
203 hash_add(vmap->ht, &me->hnode, key);
204}
205
206static void vrf_map_del_elem(struct vrf_map_elem *me)
207{
208 hash_del(&me->hnode);
209}
210
211static void vrf_map_lock(struct vrf_map *vmap) __acquires(&vmap->vmap_lock)
212{
213 spin_lock(&vmap->vmap_lock);
214}
215
216static void vrf_map_unlock(struct vrf_map *vmap) __releases(&vmap->vmap_lock)
217{
218 spin_unlock(&vmap->vmap_lock);
219}
220
221/* called with rtnl lock held */
222static int
223vrf_map_register_dev(struct net_device *dev, struct netlink_ext_ack *extack)
224{
225 struct vrf_map *vmap = netns_vrf_map_by_dev(dev);
226 struct net_vrf *vrf = netdev_priv(dev);
227 struct vrf_map_elem *new_me, *me;
228 u32 table_id = vrf->tb_id;
229 bool free_new_me = false;
230 int users;
231 int res;
232
233 /* we pre-allocate elements used in the spin-locked section (so that we
234 * keep the spinlock as short as possible).
235 */
236 new_me = vrf_map_elem_alloc(GFP_KERNEL);
237 if (!new_me)
238 return -ENOMEM;
239
240 vrf_map_elem_init(new_me, table_id, dev->ifindex, 0);
241
242 vrf_map_lock(vmap);
243
244 me = vrf_map_lookup_elem(vmap, table_id);
245 if (!me) {
246 me = new_me;
247 vrf_map_add_elem(vmap, me);
248 goto link_vrf;
249 }
250
251 /* we already have an entry in the vrf_map, so it means there is (at
252 * least) a vrf registered on the specific table.
253 */
254 free_new_me = true;
255 if (vmap->strict_mode) {
256 /* vrfs cannot share the same table */
257 NL_SET_ERR_MSG(extack, "Table is used by another VRF");
258 res = -EBUSY;
259 goto unlock;
260 }
261
262link_vrf:
263 users = ++me->users;
264 if (users == 2)
265 ++vmap->shared_tables;
266
267 list_add(&vrf->me_list, &me->vrf_list);
268
269 res = 0;
270
271unlock:
272 vrf_map_unlock(vmap);
273
274 /* clean-up, if needed */
275 if (free_new_me)
276 vrf_map_elem_free(new_me);
277
278 return res;
279}
280
281/* called with rtnl lock held */
282static void vrf_map_unregister_dev(struct net_device *dev)
283{
284 struct vrf_map *vmap = netns_vrf_map_by_dev(dev);
285 struct net_vrf *vrf = netdev_priv(dev);
286 u32 table_id = vrf->tb_id;
287 struct vrf_map_elem *me;
288 int users;
289
290 vrf_map_lock(vmap);
291
292 me = vrf_map_lookup_elem(vmap, table_id);
293 if (!me)
294 goto unlock;
295
296 list_del(&vrf->me_list);
297
298 users = --me->users;
299 if (users == 1) {
300 --vmap->shared_tables;
301 } else if (users == 0) {
302 vrf_map_del_elem(me);
303
304 /* no one will refer to this element anymore */
305 vrf_map_elem_free(me);
306 }
307
308unlock:
309 vrf_map_unlock(vmap);
310}
311
312/* return the vrf device index associated with the table_id */
313static int vrf_ifindex_lookup_by_table_id(struct net *net, u32 table_id)
314{
315 struct vrf_map *vmap = netns_vrf_map(net);
316 struct vrf_map_elem *me;
317 int ifindex;
318
319 vrf_map_lock(vmap);
320
321 if (!vmap->strict_mode) {
322 ifindex = -EPERM;
323 goto unlock;
324 }
325
326 me = vrf_map_lookup_elem(vmap, table_id);
327 if (!me) {
328 ifindex = -ENODEV;
329 goto unlock;
330 }
331
332 ifindex = vrf_map_elem_get_vrf_ifindex(me);
333
334unlock:
335 vrf_map_unlock(vmap);
336
337 return ifindex;
338}
339
340/* by default VRF devices do not have a qdisc and are expected
341 * to be created with only a single queue.
342 */
343static bool qdisc_tx_is_default(const struct net_device *dev)
344{
345 struct netdev_queue *txq;
346
347 if (dev->num_tx_queues > 1)
348 return false;
349
350 txq = netdev_get_tx_queue(dev, 0);
351
352 return qdisc_txq_has_no_queue(txq);
353}
354
355/* Local traffic destined to local address. Reinsert the packet to rx
356 * path, similar to loopback handling.
357 */
358static int vrf_local_xmit(struct sk_buff *skb, struct net_device *dev,
359 struct dst_entry *dst)
360{
361 unsigned int len = skb->len;
362
363 skb_orphan(skb);
364
365 skb_dst_set(skb, dst);
366
367 /* set pkt_type to avoid skb hitting packet taps twice -
368 * once on Tx and again in Rx processing
369 */
370 skb->pkt_type = PACKET_LOOPBACK;
371
372 skb->protocol = eth_type_trans(skb, dev);
373
374 if (likely(__netif_rx(skb) == NET_RX_SUCCESS))
375 dev_dstats_rx_add(dev, len);
376 else
377 dev_dstats_rx_dropped(dev);
378
379 return NETDEV_TX_OK;
380}
381
382static void vrf_nf_set_untracked(struct sk_buff *skb)
383{
384 if (skb_get_nfct(skb) == 0)
385 nf_ct_set(skb, NULL, IP_CT_UNTRACKED);
386}
387
388static void vrf_nf_reset_ct(struct sk_buff *skb)
389{
390 if (skb_get_nfct(skb) == IP_CT_UNTRACKED)
391 nf_reset_ct(skb);
392}
393
394#if IS_ENABLED(CONFIG_IPV6)
395static int vrf_ip6_local_out(struct net *net, struct sock *sk,
396 struct sk_buff *skb)
397{
398 int err;
399
400 vrf_nf_reset_ct(skb);
401
402 err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net,
403 sk, skb, NULL, skb_dst(skb)->dev, dst_output);
404
405 if (likely(err == 1))
406 err = dst_output(net, sk, skb);
407
408 return err;
409}
410
411static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
412 struct net_device *dev)
413{
414 const struct ipv6hdr *iph;
415 struct net *net = dev_net(skb->dev);
416 struct flowi6 fl6;
417 int ret = NET_XMIT_DROP;
418 struct dst_entry *dst;
419 struct dst_entry *dst_null = &net->ipv6.ip6_null_entry->dst;
420
421 if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct ipv6hdr)))
422 goto err;
423
424 iph = ipv6_hdr(skb);
425
426 memset(&fl6, 0, sizeof(fl6));
427 /* needed to match OIF rule */
428 fl6.flowi6_l3mdev = dev->ifindex;
429 fl6.flowi6_iif = LOOPBACK_IFINDEX;
430 fl6.daddr = iph->daddr;
431 fl6.saddr = iph->saddr;
432 fl6.flowlabel = ip6_flowinfo(iph);
433 fl6.flowi6_mark = skb->mark;
434 fl6.flowi6_proto = iph->nexthdr;
435
436 dst = ip6_dst_lookup_flow(net, NULL, &fl6, NULL);
437 if (IS_ERR(dst) || dst == dst_null)
438 goto err;
439
440 skb_dst_drop(skb);
441
442 /* if dst.dev is the VRF device again this is locally originated traffic
443 * destined to a local address. Short circuit to Rx path.
444 */
445 if (dst->dev == dev)
446 return vrf_local_xmit(skb, dev, dst);
447
448 skb_dst_set(skb, dst);
449
450 /* strip the ethernet header added for pass through VRF device */
451 __skb_pull(skb, skb_network_offset(skb));
452
453 memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
454 ret = vrf_ip6_local_out(net, skb->sk, skb);
455 if (unlikely(net_xmit_eval(ret)))
456 dev->stats.tx_errors++;
457 else
458 ret = NET_XMIT_SUCCESS;
459
460 return ret;
461err:
462 vrf_tx_error(dev, skb);
463 return NET_XMIT_DROP;
464}
465#else
466static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
467 struct net_device *dev)
468{
469 vrf_tx_error(dev, skb);
470 return NET_XMIT_DROP;
471}
472#endif
473
474/* based on ip_local_out; can't use it b/c the dst is switched pointing to us */
475static int vrf_ip_local_out(struct net *net, struct sock *sk,
476 struct sk_buff *skb)
477{
478 int err;
479
480 vrf_nf_reset_ct(skb);
481
482 err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk,
483 skb, NULL, skb_dst(skb)->dev, dst_output);
484 if (likely(err == 1))
485 err = dst_output(net, sk, skb);
486
487 return err;
488}
489
490static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
491 struct net_device *vrf_dev)
492{
493 struct iphdr *ip4h;
494 int ret = NET_XMIT_DROP;
495 struct flowi4 fl4;
496 struct net *net = dev_net(vrf_dev);
497 struct rtable *rt;
498
499 if (!pskb_may_pull(skb, ETH_HLEN + sizeof(struct iphdr)))
500 goto err;
501
502 ip4h = ip_hdr(skb);
503
504 memset(&fl4, 0, sizeof(fl4));
505 /* needed to match OIF rule */
506 fl4.flowi4_l3mdev = vrf_dev->ifindex;
507 fl4.flowi4_iif = LOOPBACK_IFINDEX;
508 fl4.flowi4_dscp = ip4h_dscp(ip4h);
509 fl4.flowi4_flags = FLOWI_FLAG_ANYSRC;
510 fl4.flowi4_proto = ip4h->protocol;
511 fl4.daddr = ip4h->daddr;
512 fl4.saddr = ip4h->saddr;
513
514 rt = ip_route_output_flow(net, &fl4, NULL);
515 if (IS_ERR(rt))
516 goto err;
517
518 skb_dst_drop(skb);
519
520 /* if dst.dev is the VRF device again this is locally originated traffic
521 * destined to a local address. Short circuit to Rx path.
522 */
523 if (rt->dst.dev == vrf_dev)
524 return vrf_local_xmit(skb, vrf_dev, &rt->dst);
525
526 skb_dst_set(skb, &rt->dst);
527
528 /* strip the ethernet header added for pass through VRF device */
529 __skb_pull(skb, skb_network_offset(skb));
530
531 if (!ip4h->saddr) {
532 ip4h->saddr = inet_select_addr(skb_dst(skb)->dev, 0,
533 RT_SCOPE_LINK);
534 }
535
536 memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
537 ret = vrf_ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
538 if (unlikely(net_xmit_eval(ret)))
539 vrf_dev->stats.tx_errors++;
540 else
541 ret = NET_XMIT_SUCCESS;
542
543out:
544 return ret;
545err:
546 vrf_tx_error(vrf_dev, skb);
547 goto out;
548}
549
550static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
551{
552 switch (skb->protocol) {
553 case htons(ETH_P_IP):
554 return vrf_process_v4_outbound(skb, dev);
555 case htons(ETH_P_IPV6):
556 return vrf_process_v6_outbound(skb, dev);
557 default:
558 vrf_tx_error(dev, skb);
559 return NET_XMIT_DROP;
560 }
561}
562
563static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
564{
565 unsigned int len = skb->len;
566 netdev_tx_t ret;
567
568 ret = is_ip_tx_frame(skb, dev);
569 if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN))
570 dev_dstats_tx_add(dev, len);
571 else
572 dev_dstats_tx_dropped(dev);
573
574 return ret;
575}
576
577static void vrf_finish_direct(struct sk_buff *skb)
578{
579 struct net_device *vrf_dev = skb->dev;
580
581 if (!list_empty(&vrf_dev->ptype_all) &&
582 likely(skb_headroom(skb) >= ETH_HLEN)) {
583 struct ethhdr *eth = skb_push(skb, ETH_HLEN);
584
585 ether_addr_copy(eth->h_source, vrf_dev->dev_addr);
586 eth_zero_addr(eth->h_dest);
587 eth->h_proto = skb->protocol;
588
589 rcu_read_lock_bh();
590 dev_queue_xmit_nit(skb, vrf_dev);
591 rcu_read_unlock_bh();
592
593 skb_pull(skb, ETH_HLEN);
594 }
595
596 vrf_nf_reset_ct(skb);
597}
598
599#if IS_ENABLED(CONFIG_IPV6)
600/* modelled after ip6_finish_output2 */
601static int vrf_finish_output6(struct net *net, struct sock *sk,
602 struct sk_buff *skb)
603{
604 struct dst_entry *dst = skb_dst(skb);
605 struct net_device *dev = dst->dev;
606 const struct in6_addr *nexthop;
607 struct neighbour *neigh;
608 int ret;
609
610 vrf_nf_reset_ct(skb);
611
612 skb->protocol = htons(ETH_P_IPV6);
613 skb->dev = dev;
614
615 rcu_read_lock();
616 nexthop = rt6_nexthop(dst_rt6_info(dst), &ipv6_hdr(skb)->daddr);
617 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
618 if (unlikely(!neigh))
619 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
620 if (!IS_ERR(neigh)) {
621 sock_confirm_neigh(skb, neigh);
622 ret = neigh_output(neigh, skb, false);
623 rcu_read_unlock();
624 return ret;
625 }
626 rcu_read_unlock();
627
628 IP6_INC_STATS(dev_net(dst->dev),
629 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
630 kfree_skb(skb);
631 return -EINVAL;
632}
633
634/* modelled after ip6_output */
635static int vrf_output6(struct net *net, struct sock *sk, struct sk_buff *skb)
636{
637 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
638 net, sk, skb, NULL, skb_dst(skb)->dev,
639 vrf_finish_output6,
640 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
641}
642
643/* set dst on skb to send packet to us via dev_xmit path. Allows
644 * packet to go through device based features such as qdisc, netfilter
645 * hooks and packet sockets with skb->dev set to vrf device.
646 */
647static struct sk_buff *vrf_ip6_out_redirect(struct net_device *vrf_dev,
648 struct sk_buff *skb)
649{
650 struct net_vrf *vrf = netdev_priv(vrf_dev);
651 struct rt6_info *rt6;
652
653 rt6 = vrf->rt6;
654 dst_hold(&rt6->dst);
655
656 skb_dst_drop(skb);
657 skb_dst_set(skb, &rt6->dst);
658
659 return skb;
660}
661
662static int vrf_output6_direct_finish(struct net *net, struct sock *sk,
663 struct sk_buff *skb)
664{
665 vrf_finish_direct(skb);
666
667 return vrf_ip6_local_out(net, sk, skb);
668}
669
670static int vrf_output6_direct(struct net *net, struct sock *sk,
671 struct sk_buff *skb)
672{
673 int err = 1;
674
675 skb->protocol = htons(ETH_P_IPV6);
676
677 if (!(IPCB(skb)->flags & IPSKB_REROUTED))
678 err = nf_hook(NFPROTO_IPV6, NF_INET_POST_ROUTING, net, sk, skb,
679 NULL, skb->dev, vrf_output6_direct_finish);
680
681 if (likely(err == 1))
682 vrf_finish_direct(skb);
683
684 return err;
685}
686
687static int vrf_ip6_out_direct_finish(struct net *net, struct sock *sk,
688 struct sk_buff *skb)
689{
690 int err;
691
692 err = vrf_output6_direct(net, sk, skb);
693 if (likely(err == 1))
694 err = vrf_ip6_local_out(net, sk, skb);
695
696 return err;
697}
698
699static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev,
700 struct sock *sk,
701 struct sk_buff *skb)
702{
703 struct net *net = dev_net(vrf_dev);
704 int err;
705
706 skb->dev = vrf_dev;
707
708 err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk,
709 skb, NULL, vrf_dev, vrf_ip6_out_direct_finish);
710
711 if (likely(err == 1))
712 err = vrf_output6_direct(net, sk, skb);
713
714 if (likely(err == 1))
715 return skb;
716
717 return NULL;
718}
719
720static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev,
721 struct sock *sk,
722 struct sk_buff *skb)
723{
724 /* don't divert link scope packets */
725 if (rt6_need_strict(&ipv6_hdr(skb)->daddr))
726 return skb;
727
728 vrf_nf_set_untracked(skb);
729
730 if (qdisc_tx_is_default(vrf_dev) ||
731 IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
732 return vrf_ip6_out_direct(vrf_dev, sk, skb);
733
734 return vrf_ip6_out_redirect(vrf_dev, skb);
735}
736
737/* holding rtnl */
738static void vrf_rt6_release(struct net_device *dev, struct net_vrf *vrf)
739{
740 struct rt6_info *rt6 = vrf->rt6;
741
742 if (rt6) {
743 dst_dev_put(&rt6->dst);
744 dst_release(&rt6->dst);
745 }
746}
747
748static int vrf_rt6_create(struct net_device *dev)
749{
750 int flags = DST_NOPOLICY | DST_NOXFRM;
751 struct net_vrf *vrf = netdev_priv(dev);
752 struct net *net = dev_net(dev);
753 struct rt6_info *rt6;
754 int rc = -ENOMEM;
755
756 /* IPv6 can be CONFIG enabled and then disabled runtime */
757 if (!ipv6_mod_enabled())
758 return 0;
759
760 vrf->fib6_table = fib6_new_table(net, vrf->tb_id);
761 if (!vrf->fib6_table)
762 goto out;
763
764 /* create a dst for routing packets out a VRF device */
765 rt6 = ip6_dst_alloc(net, dev, flags);
766 if (!rt6)
767 goto out;
768
769 rt6->dst.output = vrf_output6;
770
771 vrf->rt6 = rt6;
772
773 rc = 0;
774out:
775 return rc;
776}
777#else
778static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev,
779 struct sock *sk,
780 struct sk_buff *skb)
781{
782 return skb;
783}
784
785static void vrf_rt6_release(struct net_device *dev, struct net_vrf *vrf)
786{
787}
788
789static int vrf_rt6_create(struct net_device *dev)
790{
791 return 0;
792}
793#endif
794
795/* modelled after ip_finish_output2 */
796static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
797{
798 struct dst_entry *dst = skb_dst(skb);
799 struct rtable *rt = dst_rtable(dst);
800 struct net_device *dev = dst->dev;
801 unsigned int hh_len = LL_RESERVED_SPACE(dev);
802 struct neighbour *neigh;
803 bool is_v6gw = false;
804
805 vrf_nf_reset_ct(skb);
806
807 /* Be paranoid, rather than too clever. */
808 if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
809 skb = skb_expand_head(skb, hh_len);
810 if (!skb) {
811 dev->stats.tx_errors++;
812 return -ENOMEM;
813 }
814 }
815
816 rcu_read_lock();
817
818 neigh = ip_neigh_for_gw(rt, skb, &is_v6gw);
819 if (!IS_ERR(neigh)) {
820 int ret;
821
822 sock_confirm_neigh(skb, neigh);
823 /* if crossing protocols, can not use the cached header */
824 ret = neigh_output(neigh, skb, is_v6gw);
825 rcu_read_unlock();
826 return ret;
827 }
828
829 rcu_read_unlock();
830 vrf_tx_error(skb->dev, skb);
831 return -EINVAL;
832}
833
834static int vrf_output(struct net *net, struct sock *sk, struct sk_buff *skb)
835{
836 struct net_device *dev = skb_dst(skb)->dev;
837
838 IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len);
839
840 skb->dev = dev;
841 skb->protocol = htons(ETH_P_IP);
842
843 return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
844 net, sk, skb, NULL, dev,
845 vrf_finish_output,
846 !(IPCB(skb)->flags & IPSKB_REROUTED));
847}
848
849/* set dst on skb to send packet to us via dev_xmit path. Allows
850 * packet to go through device based features such as qdisc, netfilter
851 * hooks and packet sockets with skb->dev set to vrf device.
852 */
853static struct sk_buff *vrf_ip_out_redirect(struct net_device *vrf_dev,
854 struct sk_buff *skb)
855{
856 struct net_vrf *vrf = netdev_priv(vrf_dev);
857 struct rtable *rth;
858
859 rth = vrf->rth;
860 dst_hold(&rth->dst);
861
862 skb_dst_drop(skb);
863 skb_dst_set(skb, &rth->dst);
864
865 return skb;
866}
867
868static int vrf_output_direct_finish(struct net *net, struct sock *sk,
869 struct sk_buff *skb)
870{
871 vrf_finish_direct(skb);
872
873 return vrf_ip_local_out(net, sk, skb);
874}
875
876static int vrf_output_direct(struct net *net, struct sock *sk,
877 struct sk_buff *skb)
878{
879 int err = 1;
880
881 skb->protocol = htons(ETH_P_IP);
882
883 if (!(IPCB(skb)->flags & IPSKB_REROUTED))
884 err = nf_hook(NFPROTO_IPV4, NF_INET_POST_ROUTING, net, sk, skb,
885 NULL, skb->dev, vrf_output_direct_finish);
886
887 if (likely(err == 1))
888 vrf_finish_direct(skb);
889
890 return err;
891}
892
893static int vrf_ip_out_direct_finish(struct net *net, struct sock *sk,
894 struct sk_buff *skb)
895{
896 int err;
897
898 err = vrf_output_direct(net, sk, skb);
899 if (likely(err == 1))
900 err = vrf_ip_local_out(net, sk, skb);
901
902 return err;
903}
904
905static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev,
906 struct sock *sk,
907 struct sk_buff *skb)
908{
909 struct net *net = dev_net(vrf_dev);
910 int err;
911
912 skb->dev = vrf_dev;
913
914 err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk,
915 skb, NULL, vrf_dev, vrf_ip_out_direct_finish);
916
917 if (likely(err == 1))
918 err = vrf_output_direct(net, sk, skb);
919
920 if (likely(err == 1))
921 return skb;
922
923 return NULL;
924}
925
926static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev,
927 struct sock *sk,
928 struct sk_buff *skb)
929{
930 /* don't divert multicast or local broadcast */
931 if (ipv4_is_multicast(ip_hdr(skb)->daddr) ||
932 ipv4_is_lbcast(ip_hdr(skb)->daddr))
933 return skb;
934
935 vrf_nf_set_untracked(skb);
936
937 if (qdisc_tx_is_default(vrf_dev) ||
938 IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
939 return vrf_ip_out_direct(vrf_dev, sk, skb);
940
941 return vrf_ip_out_redirect(vrf_dev, skb);
942}
943
944/* called with rcu lock held */
945static struct sk_buff *vrf_l3_out(struct net_device *vrf_dev,
946 struct sock *sk,
947 struct sk_buff *skb,
948 u16 proto)
949{
950 switch (proto) {
951 case AF_INET:
952 return vrf_ip_out(vrf_dev, sk, skb);
953 case AF_INET6:
954 return vrf_ip6_out(vrf_dev, sk, skb);
955 }
956
957 return skb;
958}
959
960/* holding rtnl */
961static void vrf_rtable_release(struct net_device *dev, struct net_vrf *vrf)
962{
963 struct rtable *rth = vrf->rth;
964
965 dst_dev_put(&rth->dst);
966 dst_release(&rth->dst);
967}
968
969static int vrf_rtable_create(struct net_device *dev)
970{
971 struct net_vrf *vrf = netdev_priv(dev);
972 struct rtable *rth;
973
974 if (!fib_new_table(dev_net(dev), vrf->tb_id))
975 return -ENOMEM;
976
977 /* create a dst for routing packets out through a VRF device */
978 rth = rt_dst_alloc(dev, 0, RTN_UNICAST, 1);
979 if (!rth)
980 return -ENOMEM;
981
982 rth->dst.output = vrf_output;
983
984 vrf->rth = rth;
985
986 return 0;
987}
988
989/**************************** device handling ********************/
990
991/* cycle interface to flush neighbor cache and move routes across tables */
992static void cycle_netdev(struct net_device *dev,
993 struct netlink_ext_ack *extack)
994{
995 unsigned int flags = dev->flags;
996 int ret;
997
998 if (!netif_running(dev))
999 return;
1000
1001 ret = dev_change_flags(dev, flags & ~IFF_UP, extack);
1002 if (ret >= 0)
1003 ret = dev_change_flags(dev, flags, extack);
1004
1005 if (ret < 0) {
1006 netdev_err(dev,
1007 "Failed to cycle device %s; route tables might be wrong!\n",
1008 dev->name);
1009 }
1010}
1011
1012static int do_vrf_add_slave(struct net_device *dev, struct net_device *port_dev,
1013 struct netlink_ext_ack *extack)
1014{
1015 int ret;
1016
1017 /* do not allow loopback device to be enslaved to a VRF.
1018 * The vrf device acts as the loopback for the vrf.
1019 */
1020 if (port_dev == dev_net(dev)->loopback_dev) {
1021 NL_SET_ERR_MSG(extack,
1022 "Can not enslave loopback device to a VRF");
1023 return -EOPNOTSUPP;
1024 }
1025
1026 port_dev->priv_flags |= IFF_L3MDEV_SLAVE;
1027 ret = netdev_master_upper_dev_link(port_dev, dev, NULL, NULL, extack);
1028 if (ret < 0)
1029 goto err;
1030
1031 cycle_netdev(port_dev, extack);
1032
1033 return 0;
1034
1035err:
1036 port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;
1037 synchronize_net();
1038 return ret;
1039}
1040
1041static int vrf_add_slave(struct net_device *dev, struct net_device *port_dev,
1042 struct netlink_ext_ack *extack)
1043{
1044 if (netif_is_l3_master(port_dev)) {
1045 NL_SET_ERR_MSG(extack,
1046 "Can not enslave an L3 master device to a VRF");
1047 return -EINVAL;
1048 }
1049
1050 if (netif_is_l3_slave(port_dev))
1051 return -EINVAL;
1052
1053 return do_vrf_add_slave(dev, port_dev, extack);
1054}
1055
1056/* inverse of do_vrf_add_slave */
1057static int do_vrf_del_slave(struct net_device *dev, struct net_device *port_dev,
1058 bool needs_sync)
1059{
1060 netdev_upper_dev_unlink(port_dev, dev);
1061 port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;
1062 /* Make sure that concurrent RCU readers that identified the device
1063 * as a VRF port see a VRF master or no master at all.
1064 */
1065 if (needs_sync)
1066 synchronize_net();
1067
1068 cycle_netdev(port_dev, NULL);
1069
1070 return 0;
1071}
1072
1073static int vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
1074{
1075 return do_vrf_del_slave(dev, port_dev, true);
1076}
1077
1078static void vrf_dev_uninit(struct net_device *dev)
1079{
1080 struct net_vrf *vrf = netdev_priv(dev);
1081
1082 vrf_rtable_release(dev, vrf);
1083 vrf_rt6_release(dev, vrf);
1084}
1085
1086static int vrf_dev_init(struct net_device *dev)
1087{
1088 struct net_vrf *vrf = netdev_priv(dev);
1089
1090 /* create the default dst which points back to us */
1091 if (vrf_rtable_create(dev) != 0)
1092 goto out_nomem;
1093
1094 if (vrf_rt6_create(dev) != 0)
1095 goto out_rth;
1096
1097 dev->flags = IFF_MASTER | IFF_NOARP;
1098
1099 /* similarly, oper state is irrelevant; set to up to avoid confusion */
1100 dev->operstate = IF_OPER_UP;
1101 netdev_lockdep_set_classes(dev);
1102 return 0;
1103
1104out_rth:
1105 vrf_rtable_release(dev, vrf);
1106out_nomem:
1107 return -ENOMEM;
1108}
1109
1110static const struct net_device_ops vrf_netdev_ops = {
1111 .ndo_init = vrf_dev_init,
1112 .ndo_uninit = vrf_dev_uninit,
1113 .ndo_start_xmit = vrf_xmit,
1114 .ndo_set_mac_address = eth_mac_addr,
1115 .ndo_add_slave = vrf_add_slave,
1116 .ndo_del_slave = vrf_del_slave,
1117};
1118
1119static u32 vrf_fib_table(const struct net_device *dev)
1120{
1121 struct net_vrf *vrf = netdev_priv(dev);
1122
1123 return vrf->tb_id;
1124}
1125
1126static int vrf_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
1127{
1128 kfree_skb(skb);
1129 return 0;
1130}
1131
1132static struct sk_buff *vrf_rcv_nfhook(u8 pf, unsigned int hook,
1133 struct sk_buff *skb,
1134 struct net_device *dev)
1135{
1136 struct net *net = dev_net(dev);
1137
1138 if (nf_hook(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) != 1)
1139 skb = NULL; /* kfree_skb(skb) handled by nf code */
1140
1141 return skb;
1142}
1143
1144static int vrf_prepare_mac_header(struct sk_buff *skb,
1145 struct net_device *vrf_dev, u16 proto)
1146{
1147 struct ethhdr *eth;
1148 int err;
1149
1150 /* in general, we do not know if there is enough space in the head of
1151 * the packet for hosting the mac header.
1152 */
1153 err = skb_cow_head(skb, LL_RESERVED_SPACE(vrf_dev));
1154 if (unlikely(err))
1155 /* no space in the skb head */
1156 return -ENOBUFS;
1157
1158 __skb_push(skb, ETH_HLEN);
1159 eth = (struct ethhdr *)skb->data;
1160
1161 skb_reset_mac_header(skb);
1162 skb_reset_mac_len(skb);
1163
1164 /* we set the ethernet destination and the source addresses to the
1165 * address of the VRF device.
1166 */
1167 ether_addr_copy(eth->h_dest, vrf_dev->dev_addr);
1168 ether_addr_copy(eth->h_source, vrf_dev->dev_addr);
1169 eth->h_proto = htons(proto);
1170
1171 /* the destination address of the Ethernet frame corresponds to the
1172 * address set on the VRF interface; therefore, the packet is intended
1173 * to be processed locally.
1174 */
1175 skb->protocol = eth->h_proto;
1176 skb->pkt_type = PACKET_HOST;
1177
1178 skb_pull_inline(skb, ETH_HLEN);
1179
1180 return 0;
1181}
1182
1183/* prepare and add the mac header to the packet if it was not set previously.
1184 * In this way, packet sniffers such as tcpdump can parse the packet correctly.
1185 * If the mac header was already set, the original mac header is left
1186 * untouched and the function returns immediately.
1187 */
1188static int vrf_add_mac_header_if_unset(struct sk_buff *skb,
1189 struct net_device *vrf_dev,
1190 u16 proto, struct net_device *orig_dev)
1191{
1192 if (skb_mac_header_was_set(skb) && dev_has_header(orig_dev))
1193 return 0;
1194
1195 return vrf_prepare_mac_header(skb, vrf_dev, proto);
1196}
1197
1198#if IS_ENABLED(CONFIG_IPV6)
1199/* neighbor handling is done with actual device; do not want
1200 * to flip skb->dev for those ndisc packets. This really fails
1201 * for multiple next protocols (e.g., NEXTHDR_HOP). But it is
1202 * a start.
1203 */
1204static bool ipv6_ndisc_frame(const struct sk_buff *skb)
1205{
1206 const struct ipv6hdr *iph = ipv6_hdr(skb);
1207 bool rc = false;
1208
1209 if (iph->nexthdr == NEXTHDR_ICMP) {
1210 const struct icmp6hdr *icmph;
1211 struct icmp6hdr _icmph;
1212
1213 icmph = skb_header_pointer(skb, sizeof(*iph),
1214 sizeof(_icmph), &_icmph);
1215 if (!icmph)
1216 goto out;
1217
1218 switch (icmph->icmp6_type) {
1219 case NDISC_ROUTER_SOLICITATION:
1220 case NDISC_ROUTER_ADVERTISEMENT:
1221 case NDISC_NEIGHBOUR_SOLICITATION:
1222 case NDISC_NEIGHBOUR_ADVERTISEMENT:
1223 case NDISC_REDIRECT:
1224 rc = true;
1225 break;
1226 }
1227 }
1228
1229out:
1230 return rc;
1231}
1232
1233static struct rt6_info *vrf_ip6_route_lookup(struct net *net,
1234 const struct net_device *dev,
1235 struct flowi6 *fl6,
1236 int ifindex,
1237 const struct sk_buff *skb,
1238 int flags)
1239{
1240 struct net_vrf *vrf = netdev_priv(dev);
1241
1242 return ip6_pol_route(net, vrf->fib6_table, ifindex, fl6, skb, flags);
1243}
1244
1245static void vrf_ip6_input_dst(struct sk_buff *skb, struct net_device *vrf_dev,
1246 int ifindex)
1247{
1248 const struct ipv6hdr *iph = ipv6_hdr(skb);
1249 struct flowi6 fl6 = {
1250 .flowi6_iif = ifindex,
1251 .flowi6_mark = skb->mark,
1252 .flowi6_proto = iph->nexthdr,
1253 .daddr = iph->daddr,
1254 .saddr = iph->saddr,
1255 .flowlabel = ip6_flowinfo(iph),
1256 };
1257 struct net *net = dev_net(vrf_dev);
1258 struct rt6_info *rt6;
1259
1260 skb_dst_drop(skb);
1261
1262 rt6 = vrf_ip6_route_lookup(net, vrf_dev, &fl6, ifindex, skb,
1263 RT6_LOOKUP_F_HAS_SADDR | RT6_LOOKUP_F_IFACE);
1264 if (unlikely(!rt6))
1265 return;
1266
1267 if (unlikely(&rt6->dst == &net->ipv6.ip6_null_entry->dst))
1268 return;
1269
1270 skb_dst_set(skb, &rt6->dst);
1271}
1272
1273static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
1274 struct sk_buff *skb)
1275{
1276 int orig_iif = skb->skb_iif;
1277 bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
1278 bool is_ndisc = ipv6_ndisc_frame(skb);
1279
1280 /* loopback, multicast & non-ND link-local traffic; do not push through
1281 * packet taps again. Reset pkt_type for upper layers to process skb.
1282 * For non-loopback strict packets, determine the dst using the original
1283 * ifindex.
1284 */
1285 if (skb->pkt_type == PACKET_LOOPBACK || (need_strict && !is_ndisc)) {
1286 skb->dev = vrf_dev;
1287 skb->skb_iif = vrf_dev->ifindex;
1288 IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
1289
1290 if (skb->pkt_type == PACKET_LOOPBACK)
1291 skb->pkt_type = PACKET_HOST;
1292 else
1293 vrf_ip6_input_dst(skb, vrf_dev, orig_iif);
1294
1295 goto out;
1296 }
1297
1298 /* if packet is NDISC then keep the ingress interface */
1299 if (!is_ndisc) {
1300 struct net_device *orig_dev = skb->dev;
1301
1302 dev_dstats_rx_add(vrf_dev, skb->len);
1303 skb->dev = vrf_dev;
1304 skb->skb_iif = vrf_dev->ifindex;
1305
1306 if (!list_empty(&vrf_dev->ptype_all)) {
1307 int err;
1308
1309 err = vrf_add_mac_header_if_unset(skb, vrf_dev,
1310 ETH_P_IPV6,
1311 orig_dev);
1312 if (likely(!err)) {
1313 skb_push(skb, skb->mac_len);
1314 dev_queue_xmit_nit(skb, vrf_dev);
1315 skb_pull(skb, skb->mac_len);
1316 }
1317 }
1318
1319 IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
1320 }
1321
1322 if (need_strict)
1323 vrf_ip6_input_dst(skb, vrf_dev, orig_iif);
1324
1325 skb = vrf_rcv_nfhook(NFPROTO_IPV6, NF_INET_PRE_ROUTING, skb, vrf_dev);
1326out:
1327 return skb;
1328}
1329
1330#else
1331static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
1332 struct sk_buff *skb)
1333{
1334 return skb;
1335}
1336#endif
1337
1338static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev,
1339 struct sk_buff *skb)
1340{
1341 struct net_device *orig_dev = skb->dev;
1342
1343 skb->dev = vrf_dev;
1344 skb->skb_iif = vrf_dev->ifindex;
1345 IPCB(skb)->flags |= IPSKB_L3SLAVE;
1346
1347 if (ipv4_is_multicast(ip_hdr(skb)->daddr))
1348 goto out;
1349
1350 /* loopback traffic; do not push through packet taps again.
1351 * Reset pkt_type for upper layers to process skb
1352 */
1353 if (skb->pkt_type == PACKET_LOOPBACK) {
1354 skb->pkt_type = PACKET_HOST;
1355 goto out;
1356 }
1357
1358 dev_dstats_rx_add(vrf_dev, skb->len);
1359
1360 if (!list_empty(&vrf_dev->ptype_all)) {
1361 int err;
1362
1363 err = vrf_add_mac_header_if_unset(skb, vrf_dev, ETH_P_IP,
1364 orig_dev);
1365 if (likely(!err)) {
1366 skb_push(skb, skb->mac_len);
1367 dev_queue_xmit_nit(skb, vrf_dev);
1368 skb_pull(skb, skb->mac_len);
1369 }
1370 }
1371
1372 skb = vrf_rcv_nfhook(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, vrf_dev);
1373out:
1374 return skb;
1375}
1376
1377/* called with rcu lock held */
1378static struct sk_buff *vrf_l3_rcv(struct net_device *vrf_dev,
1379 struct sk_buff *skb,
1380 u16 proto)
1381{
1382 switch (proto) {
1383 case AF_INET:
1384 return vrf_ip_rcv(vrf_dev, skb);
1385 case AF_INET6:
1386 return vrf_ip6_rcv(vrf_dev, skb);
1387 }
1388
1389 return skb;
1390}
1391
1392#if IS_ENABLED(CONFIG_IPV6)
1393/* send to link-local or multicast address via interface enslaved to
1394 * VRF device. Force lookup to VRF table without changing flow struct
1395 * Note: Caller to this function must hold rcu_read_lock() and no refcnt
1396 * is taken on the dst by this function.
1397 */
1398static struct dst_entry *vrf_link_scope_lookup(const struct net_device *dev,
1399 struct flowi6 *fl6)
1400{
1401 struct net *net = dev_net(dev);
1402 int flags = RT6_LOOKUP_F_IFACE | RT6_LOOKUP_F_DST_NOREF;
1403 struct dst_entry *dst = NULL;
1404 struct rt6_info *rt;
1405
1406 /* VRF device does not have a link-local address and
1407 * sending packets to link-local or mcast addresses over
1408 * a VRF device does not make sense
1409 */
1410 if (fl6->flowi6_oif == dev->ifindex) {
1411 dst = &net->ipv6.ip6_null_entry->dst;
1412 return dst;
1413 }
1414
1415 if (!ipv6_addr_any(&fl6->saddr))
1416 flags |= RT6_LOOKUP_F_HAS_SADDR;
1417
1418 rt = vrf_ip6_route_lookup(net, dev, fl6, fl6->flowi6_oif, NULL, flags);
1419 if (rt)
1420 dst = &rt->dst;
1421
1422 return dst;
1423}
1424#endif
1425
1426static const struct l3mdev_ops vrf_l3mdev_ops = {
1427 .l3mdev_fib_table = vrf_fib_table,
1428 .l3mdev_l3_rcv = vrf_l3_rcv,
1429 .l3mdev_l3_out = vrf_l3_out,
1430#if IS_ENABLED(CONFIG_IPV6)
1431 .l3mdev_link_scope_lookup = vrf_link_scope_lookup,
1432#endif
1433};
1434
1435static void vrf_get_drvinfo(struct net_device *dev,
1436 struct ethtool_drvinfo *info)
1437{
1438 strscpy(info->driver, DRV_NAME, sizeof(info->driver));
1439 strscpy(info->version, DRV_VERSION, sizeof(info->version));
1440}
1441
1442static const struct ethtool_ops vrf_ethtool_ops = {
1443 .get_drvinfo = vrf_get_drvinfo,
1444};
1445
1446static inline size_t vrf_fib_rule_nl_size(void)
1447{
1448 size_t sz;
1449
1450 sz = NLMSG_ALIGN(sizeof(struct fib_rule_hdr));
1451 sz += nla_total_size(sizeof(u8)); /* FRA_L3MDEV */
1452 sz += nla_total_size(sizeof(u32)); /* FRA_PRIORITY */
1453 sz += nla_total_size(sizeof(u8)); /* FRA_PROTOCOL */
1454
1455 return sz;
1456}
1457
1458static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
1459{
1460 struct fib_rule_hdr *frh;
1461 struct nlmsghdr *nlh;
1462 struct sk_buff *skb;
1463 int err;
1464
1465 if ((family == AF_INET6 || family == RTNL_FAMILY_IP6MR) &&
1466 !ipv6_mod_enabled())
1467 return 0;
1468
1469 skb = nlmsg_new(vrf_fib_rule_nl_size(), GFP_KERNEL);
1470 if (!skb)
1471 return -ENOMEM;
1472
1473 nlh = nlmsg_put(skb, 0, 0, 0, sizeof(*frh), 0);
1474 if (!nlh)
1475 goto nla_put_failure;
1476
1477 /* rule only needs to appear once */
1478 nlh->nlmsg_flags |= NLM_F_EXCL;
1479
1480 frh = nlmsg_data(nlh);
1481 memset(frh, 0, sizeof(*frh));
1482 frh->family = family;
1483 frh->action = FR_ACT_TO_TBL;
1484
1485 if (nla_put_u8(skb, FRA_PROTOCOL, RTPROT_KERNEL))
1486 goto nla_put_failure;
1487
1488 if (nla_put_u8(skb, FRA_L3MDEV, 1))
1489 goto nla_put_failure;
1490
1491 if (nla_put_u32(skb, FRA_PRIORITY, FIB_RULE_PREF))
1492 goto nla_put_failure;
1493
1494 nlmsg_end(skb, nlh);
1495
1496 if (add_it) {
1497 err = fib_newrule(dev_net(dev), skb, nlh, NULL, true);
1498 if (err == -EEXIST)
1499 err = 0;
1500 } else {
1501 err = fib_delrule(dev_net(dev), skb, nlh, NULL, true);
1502 if (err == -ENOENT)
1503 err = 0;
1504 }
1505 nlmsg_free(skb);
1506
1507 return err;
1508
1509nla_put_failure:
1510 nlmsg_free(skb);
1511
1512 return -EMSGSIZE;
1513}
1514
1515static int vrf_add_fib_rules(const struct net_device *dev)
1516{
1517 int err;
1518
1519 err = vrf_fib_rule(dev, AF_INET, true);
1520 if (err < 0)
1521 goto out_err;
1522
1523 err = vrf_fib_rule(dev, AF_INET6, true);
1524 if (err < 0)
1525 goto ipv6_err;
1526
1527#if IS_ENABLED(CONFIG_IP_MROUTE_MULTIPLE_TABLES)
1528 err = vrf_fib_rule(dev, RTNL_FAMILY_IPMR, true);
1529 if (err < 0)
1530 goto ipmr_err;
1531#endif
1532
1533#if IS_ENABLED(CONFIG_IPV6_MROUTE_MULTIPLE_TABLES)
1534 err = vrf_fib_rule(dev, RTNL_FAMILY_IP6MR, true);
1535 if (err < 0)
1536 goto ip6mr_err;
1537#endif
1538
1539 return 0;
1540
1541#if IS_ENABLED(CONFIG_IPV6_MROUTE_MULTIPLE_TABLES)
1542ip6mr_err:
1543 vrf_fib_rule(dev, RTNL_FAMILY_IPMR, false);
1544#endif
1545
1546#if IS_ENABLED(CONFIG_IP_MROUTE_MULTIPLE_TABLES)
1547ipmr_err:
1548 vrf_fib_rule(dev, AF_INET6, false);
1549#endif
1550
1551ipv6_err:
1552 vrf_fib_rule(dev, AF_INET, false);
1553
1554out_err:
1555 netdev_err(dev, "Failed to add FIB rules.\n");
1556 return err;
1557}
1558
1559static void vrf_setup(struct net_device *dev)
1560{
1561 ether_setup(dev);
1562
1563 /* Initialize the device structure. */
1564 dev->netdev_ops = &vrf_netdev_ops;
1565 dev->l3mdev_ops = &vrf_l3mdev_ops;
1566 dev->ethtool_ops = &vrf_ethtool_ops;
1567 dev->needs_free_netdev = true;
1568
1569 /* Fill in device structure with ethernet-generic values. */
1570 eth_hw_addr_random(dev);
1571
1572 /* don't acquire vrf device's netif_tx_lock when transmitting */
1573 dev->lltx = true;
1574
1575 /* don't allow vrf devices to change network namespaces. */
1576 dev->netns_immutable = true;
1577
1578 /* does not make sense for a VLAN to be added to a vrf device */
1579 dev->features |= NETIF_F_VLAN_CHALLENGED;
1580
1581 /* enable offload features */
1582 dev->features |= NETIF_F_GSO_SOFTWARE;
1583 dev->features |= NETIF_F_RXCSUM | NETIF_F_HW_CSUM | NETIF_F_SCTP_CRC;
1584 dev->features |= NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA;
1585
1586 dev->hw_features = dev->features;
1587 dev->hw_enc_features = dev->features;
1588
1589 /* default to no qdisc; user can add if desired */
1590 dev->priv_flags |= IFF_NO_QUEUE;
1591 dev->priv_flags |= IFF_NO_RX_HANDLER;
1592 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
1593
1594 /* VRF devices do not care about MTU, but if the MTU is set
1595 * too low then the ipv4 and ipv6 protocols are disabled
1596 * which breaks networking.
1597 */
1598 dev->min_mtu = IPV6_MIN_MTU;
1599 dev->max_mtu = IP6_MAX_MTU;
1600 dev->mtu = dev->max_mtu;
1601
1602 dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS;
1603}
1604
1605static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],
1606 struct netlink_ext_ack *extack)
1607{
1608 if (tb[IFLA_ADDRESS]) {
1609 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) {
1610 NL_SET_ERR_MSG(extack, "Invalid hardware address");
1611 return -EINVAL;
1612 }
1613 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) {
1614 NL_SET_ERR_MSG(extack, "Invalid hardware address");
1615 return -EADDRNOTAVAIL;
1616 }
1617 }
1618 return 0;
1619}
1620
1621static void vrf_dellink(struct net_device *dev, struct list_head *head)
1622{
1623 struct net_device *port_dev;
1624 struct list_head *iter;
1625
1626 netdev_for_each_lower_dev(dev, port_dev, iter)
1627 do_vrf_del_slave(dev, port_dev, false);
1628
1629 vrf_map_unregister_dev(dev);
1630
1631 unregister_netdevice_queue(dev, head);
1632}
1633
1634static int vrf_newlink(struct net_device *dev,
1635 struct rtnl_newlink_params *params,
1636 struct netlink_ext_ack *extack)
1637{
1638 struct net_vrf *vrf = netdev_priv(dev);
1639 struct nlattr **data = params->data;
1640 struct netns_vrf *nn_vrf;
1641 bool *add_fib_rules;
1642 struct net *net;
1643 int err;
1644
1645 if (!data || !data[IFLA_VRF_TABLE]) {
1646 NL_SET_ERR_MSG(extack, "VRF table id is missing");
1647 return -EINVAL;
1648 }
1649
1650 vrf->tb_id = nla_get_u32(data[IFLA_VRF_TABLE]);
1651 if (vrf->tb_id == RT_TABLE_UNSPEC) {
1652 NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VRF_TABLE],
1653 "Invalid VRF table id");
1654 return -EINVAL;
1655 }
1656
1657 dev->priv_flags |= IFF_L3MDEV_MASTER;
1658
1659 err = register_netdevice(dev);
1660 if (err)
1661 goto out;
1662
1663 /* mapping between table_id and vrf;
1664 * note: such binding could not be done in the dev init function
1665 * because dev->ifindex id is not available yet.
1666 */
1667 vrf->ifindex = dev->ifindex;
1668
1669 err = vrf_map_register_dev(dev, extack);
1670 if (err) {
1671 unregister_netdevice(dev);
1672 goto out;
1673 }
1674
1675 net = dev_net(dev);
1676 nn_vrf = net_generic(net, vrf_net_id);
1677
1678 add_fib_rules = &nn_vrf->add_fib_rules;
1679 if (*add_fib_rules) {
1680 err = vrf_add_fib_rules(dev);
1681 if (err) {
1682 vrf_map_unregister_dev(dev);
1683 unregister_netdevice(dev);
1684 goto out;
1685 }
1686 *add_fib_rules = false;
1687 }
1688
1689out:
1690 return err;
1691}
1692
1693static size_t vrf_nl_getsize(const struct net_device *dev)
1694{
1695 return nla_total_size(sizeof(u32)); /* IFLA_VRF_TABLE */
1696}
1697
1698static int vrf_fillinfo(struct sk_buff *skb,
1699 const struct net_device *dev)
1700{
1701 struct net_vrf *vrf = netdev_priv(dev);
1702
1703 return nla_put_u32(skb, IFLA_VRF_TABLE, vrf->tb_id);
1704}
1705
1706static size_t vrf_get_slave_size(const struct net_device *bond_dev,
1707 const struct net_device *slave_dev)
1708{
1709 return nla_total_size(sizeof(u32)); /* IFLA_VRF_PORT_TABLE */
1710}
1711
1712static int vrf_fill_slave_info(struct sk_buff *skb,
1713 const struct net_device *vrf_dev,
1714 const struct net_device *slave_dev)
1715{
1716 struct net_vrf *vrf = netdev_priv(vrf_dev);
1717
1718 if (nla_put_u32(skb, IFLA_VRF_PORT_TABLE, vrf->tb_id))
1719 return -EMSGSIZE;
1720
1721 return 0;
1722}
1723
1724static const struct nla_policy vrf_nl_policy[IFLA_VRF_MAX + 1] = {
1725 [IFLA_VRF_TABLE] = { .type = NLA_U32 },
1726};
1727
1728static struct rtnl_link_ops vrf_link_ops __read_mostly = {
1729 .kind = DRV_NAME,
1730 .priv_size = sizeof(struct net_vrf),
1731
1732 .get_size = vrf_nl_getsize,
1733 .policy = vrf_nl_policy,
1734 .validate = vrf_validate,
1735 .fill_info = vrf_fillinfo,
1736
1737 .get_slave_size = vrf_get_slave_size,
1738 .fill_slave_info = vrf_fill_slave_info,
1739
1740 .newlink = vrf_newlink,
1741 .dellink = vrf_dellink,
1742 .setup = vrf_setup,
1743 .maxtype = IFLA_VRF_MAX,
1744};
1745
1746static int vrf_device_event(struct notifier_block *unused,
1747 unsigned long event, void *ptr)
1748{
1749 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
1750
1751 /* only care about unregister events to drop slave references */
1752 if (event == NETDEV_UNREGISTER) {
1753 struct net_device *vrf_dev;
1754
1755 if (!netif_is_l3_slave(dev))
1756 goto out;
1757
1758 vrf_dev = netdev_master_upper_dev_get(dev);
1759 do_vrf_del_slave(vrf_dev, dev, false);
1760 }
1761out:
1762 return NOTIFY_DONE;
1763}
1764
1765static struct notifier_block vrf_notifier_block __read_mostly = {
1766 .notifier_call = vrf_device_event,
1767};
1768
1769static int vrf_map_init(struct vrf_map *vmap)
1770{
1771 spin_lock_init(&vmap->vmap_lock);
1772 hash_init(vmap->ht);
1773
1774 vmap->strict_mode = false;
1775
1776 return 0;
1777}
1778
1779#ifdef CONFIG_SYSCTL
1780static bool vrf_strict_mode(struct vrf_map *vmap)
1781{
1782 bool strict_mode;
1783
1784 vrf_map_lock(vmap);
1785 strict_mode = vmap->strict_mode;
1786 vrf_map_unlock(vmap);
1787
1788 return strict_mode;
1789}
1790
1791static int vrf_strict_mode_change(struct vrf_map *vmap, bool new_mode)
1792{
1793 bool *cur_mode;
1794 int res = 0;
1795
1796 vrf_map_lock(vmap);
1797
1798 cur_mode = &vmap->strict_mode;
1799 if (*cur_mode == new_mode)
1800 goto unlock;
1801
1802 if (*cur_mode) {
1803 /* disable strict mode */
1804 *cur_mode = false;
1805 } else {
1806 if (vmap->shared_tables) {
1807 /* we cannot allow strict_mode because there are some
1808 * vrfs that share one or more tables.
1809 */
1810 res = -EBUSY;
1811 goto unlock;
1812 }
1813
1814 /* no tables are shared among vrfs, so we can go back
1815 * to 1:1 association between a vrf with its table.
1816 */
1817 *cur_mode = true;
1818 }
1819
1820unlock:
1821 vrf_map_unlock(vmap);
1822
1823 return res;
1824}
1825
1826static int vrf_shared_table_handler(const struct ctl_table *table, int write,
1827 void *buffer, size_t *lenp, loff_t *ppos)
1828{
1829 struct net *net = (struct net *)table->extra1;
1830 struct vrf_map *vmap = netns_vrf_map(net);
1831 int proc_strict_mode = 0;
1832 struct ctl_table tmp = {
1833 .procname = table->procname,
1834 .data = &proc_strict_mode,
1835 .maxlen = sizeof(int),
1836 .mode = table->mode,
1837 .extra1 = SYSCTL_ZERO,
1838 .extra2 = SYSCTL_ONE,
1839 };
1840 int ret;
1841
1842 if (!write)
1843 proc_strict_mode = vrf_strict_mode(vmap);
1844
1845 ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos);
1846
1847 if (write && ret == 0)
1848 ret = vrf_strict_mode_change(vmap, (bool)proc_strict_mode);
1849
1850 return ret;
1851}
1852
1853static const struct ctl_table vrf_table[] = {
1854 {
1855 .procname = "strict_mode",
1856 .data = NULL,
1857 .maxlen = sizeof(int),
1858 .mode = 0644,
1859 .proc_handler = vrf_shared_table_handler,
1860 /* set by the vrf_netns_init */
1861 .extra1 = NULL,
1862 },
1863};
1864
1865static int vrf_netns_init_sysctl(struct net *net, struct netns_vrf *nn_vrf)
1866{
1867 struct ctl_table *table;
1868
1869 table = kmemdup(vrf_table, sizeof(vrf_table), GFP_KERNEL);
1870 if (!table)
1871 return -ENOMEM;
1872
1873 /* init the extra1 parameter with the reference to current netns */
1874 table[0].extra1 = net;
1875
1876 nn_vrf->ctl_hdr = register_net_sysctl_sz(net, "net/vrf", table,
1877 ARRAY_SIZE(vrf_table));
1878 if (!nn_vrf->ctl_hdr) {
1879 kfree(table);
1880 return -ENOMEM;
1881 }
1882
1883 return 0;
1884}
1885
1886static void vrf_netns_exit_sysctl(struct net *net)
1887{
1888 struct netns_vrf *nn_vrf = net_generic(net, vrf_net_id);
1889 const struct ctl_table *table;
1890
1891 table = nn_vrf->ctl_hdr->ctl_table_arg;
1892 unregister_net_sysctl_table(nn_vrf->ctl_hdr);
1893 kfree(table);
1894}
1895#else
1896static int vrf_netns_init_sysctl(struct net *net, struct netns_vrf *nn_vrf)
1897{
1898 return 0;
1899}
1900
1901static void vrf_netns_exit_sysctl(struct net *net)
1902{
1903}
1904#endif
1905
1906/* Initialize per network namespace state */
1907static int __net_init vrf_netns_init(struct net *net)
1908{
1909 struct netns_vrf *nn_vrf = net_generic(net, vrf_net_id);
1910
1911 nn_vrf->add_fib_rules = true;
1912 vrf_map_init(&nn_vrf->vmap);
1913
1914 return vrf_netns_init_sysctl(net, nn_vrf);
1915}
1916
1917static void __net_exit vrf_netns_exit(struct net *net)
1918{
1919 vrf_netns_exit_sysctl(net);
1920}
1921
1922static struct pernet_operations vrf_net_ops __net_initdata = {
1923 .init = vrf_netns_init,
1924 .exit = vrf_netns_exit,
1925 .id = &vrf_net_id,
1926 .size = sizeof(struct netns_vrf),
1927};
1928
1929static int __init vrf_init_module(void)
1930{
1931 int rc;
1932
1933 rc = register_netdevice_notifier(&vrf_notifier_block);
1934 if (rc < 0)
1935 return rc;
1936
1937 rc = register_pernet_subsys(&vrf_net_ops);
1938 if (rc < 0)
1939 goto error;
1940
1941 rc = l3mdev_table_lookup_register(L3MDEV_TYPE_VRF,
1942 vrf_ifindex_lookup_by_table_id);
1943 if (rc < 0)
1944 goto unreg_pernet;
1945
1946 rc = rtnl_link_register(&vrf_link_ops);
1947 if (rc < 0)
1948 goto table_lookup_unreg;
1949
1950 return 0;
1951
1952table_lookup_unreg:
1953 l3mdev_table_lookup_unregister(L3MDEV_TYPE_VRF,
1954 vrf_ifindex_lookup_by_table_id);
1955
1956unreg_pernet:
1957 unregister_pernet_subsys(&vrf_net_ops);
1958
1959error:
1960 unregister_netdevice_notifier(&vrf_notifier_block);
1961 return rc;
1962}
1963
1964module_init(vrf_init_module);
1965MODULE_AUTHOR("Shrijeet Mukherjee, David Ahern");
1966MODULE_DESCRIPTION("Device driver to instantiate VRF domains");
1967MODULE_LICENSE("GPL");
1968MODULE_ALIAS_RTNL_LINK(DRV_NAME);
1969MODULE_VERSION(DRV_VERSION);