• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 #include <linux/module.h>
2 #include <linux/errno.h>
3 #include <linux/socket.h>
4 #include <linux/skbuff.h>
5 #include <linux/ip.h>
6 #include <linux/udp.h>
7 #include <linux/types.h>
8 #include <linux/kernel.h>
9 #include <net/genetlink.h>
10 #include <net/gue.h>
11 #include <net/ip.h>
12 #include <net/protocol.h>
13 #include <net/udp.h>
14 #include <net/udp_tunnel.h>
15 #include <net/xfrm.h>
16 #include <uapi/linux/fou.h>
17 #include <uapi/linux/genetlink.h>
18 
19 struct fou {
20 	struct socket *sock;
21 	u8 protocol;
22 	u8 flags;
23 	__be16 port;
24 	u8 family;
25 	u16 type;
26 	struct list_head list;
27 	struct rcu_head rcu;
28 };
29 
30 #define FOU_F_REMCSUM_NOPARTIAL BIT(0)
31 
32 struct fou_cfg {
33 	u16 type;
34 	u8 protocol;
35 	u8 flags;
36 	struct udp_port_cfg udp_config;
37 };
38 
39 static unsigned int fou_net_id;
40 
41 struct fou_net {
42 	struct list_head fou_list;
43 	struct mutex fou_lock;
44 };
45 
fou_from_sock(struct sock * sk)46 static inline struct fou *fou_from_sock(struct sock *sk)
47 {
48 	return sk->sk_user_data;
49 }
50 
fou_recv_pull(struct sk_buff * skb,struct fou * fou,size_t len)51 static int fou_recv_pull(struct sk_buff *skb, struct fou *fou, size_t len)
52 {
53 	/* Remove 'len' bytes from the packet (UDP header and
54 	 * FOU header if present).
55 	 */
56 	if (fou->family == AF_INET)
57 		ip_hdr(skb)->tot_len = htons(ntohs(ip_hdr(skb)->tot_len) - len);
58 	else
59 		ipv6_hdr(skb)->payload_len =
60 		    htons(ntohs(ipv6_hdr(skb)->payload_len) - len);
61 
62 	__skb_pull(skb, len);
63 	skb_postpull_rcsum(skb, udp_hdr(skb), len);
64 	skb_reset_transport_header(skb);
65 	return iptunnel_pull_offloads(skb);
66 }
67 
fou_udp_recv(struct sock * sk,struct sk_buff * skb)68 static int fou_udp_recv(struct sock *sk, struct sk_buff *skb)
69 {
70 	struct fou *fou = fou_from_sock(sk);
71 
72 	if (!fou)
73 		return 1;
74 
75 	if (fou_recv_pull(skb, fou, sizeof(struct udphdr)))
76 		goto drop;
77 
78 	return -fou->protocol;
79 
80 drop:
81 	kfree_skb(skb);
82 	return 0;
83 }
84 
gue_remcsum(struct sk_buff * skb,struct guehdr * guehdr,void * data,size_t hdrlen,u8 ipproto,bool nopartial)85 static struct guehdr *gue_remcsum(struct sk_buff *skb, struct guehdr *guehdr,
86 				  void *data, size_t hdrlen, u8 ipproto,
87 				  bool nopartial)
88 {
89 	__be16 *pd = data;
90 	size_t start = ntohs(pd[0]);
91 	size_t offset = ntohs(pd[1]);
92 	size_t plen = sizeof(struct udphdr) + hdrlen +
93 	    max_t(size_t, offset + sizeof(u16), start);
94 
95 	if (skb->remcsum_offload)
96 		return guehdr;
97 
98 	if (!pskb_may_pull(skb, plen))
99 		return NULL;
100 	guehdr = (struct guehdr *)&udp_hdr(skb)[1];
101 
102 	skb_remcsum_process(skb, (void *)guehdr + hdrlen,
103 			    start, offset, nopartial);
104 
105 	return guehdr;
106 }
107 
gue_control_message(struct sk_buff * skb,struct guehdr * guehdr)108 static int gue_control_message(struct sk_buff *skb, struct guehdr *guehdr)
109 {
110 	/* No support yet */
111 	kfree_skb(skb);
112 	return 0;
113 }
114 
gue_udp_recv(struct sock * sk,struct sk_buff * skb)115 static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
116 {
117 	struct fou *fou = fou_from_sock(sk);
118 	size_t len, optlen, hdrlen;
119 	struct guehdr *guehdr;
120 	void *data;
121 	u16 doffset = 0;
122 
123 	if (!fou)
124 		return 1;
125 
126 	len = sizeof(struct udphdr) + sizeof(struct guehdr);
127 	if (!pskb_may_pull(skb, len))
128 		goto drop;
129 
130 	guehdr = (struct guehdr *)&udp_hdr(skb)[1];
131 
132 	switch (guehdr->version) {
133 	case 0: /* Full GUE header present */
134 		break;
135 
136 	case 1: {
137 		/* Direct encasulation of IPv4 or IPv6 */
138 
139 		int prot;
140 
141 		switch (((struct iphdr *)guehdr)->version) {
142 		case 4:
143 			prot = IPPROTO_IPIP;
144 			break;
145 		case 6:
146 			prot = IPPROTO_IPV6;
147 			break;
148 		default:
149 			goto drop;
150 		}
151 
152 		if (fou_recv_pull(skb, fou, sizeof(struct udphdr)))
153 			goto drop;
154 
155 		return -prot;
156 	}
157 
158 	default: /* Undefined version */
159 		goto drop;
160 	}
161 
162 	optlen = guehdr->hlen << 2;
163 	len += optlen;
164 
165 	if (!pskb_may_pull(skb, len))
166 		goto drop;
167 
168 	/* guehdr may change after pull */
169 	guehdr = (struct guehdr *)&udp_hdr(skb)[1];
170 
171 	hdrlen = sizeof(struct guehdr) + optlen;
172 
173 	if (guehdr->version != 0 || validate_gue_flags(guehdr, optlen))
174 		goto drop;
175 
176 	hdrlen = sizeof(struct guehdr) + optlen;
177 
178 	if (fou->family == AF_INET)
179 		ip_hdr(skb)->tot_len = htons(ntohs(ip_hdr(skb)->tot_len) - len);
180 	else
181 		ipv6_hdr(skb)->payload_len =
182 		    htons(ntohs(ipv6_hdr(skb)->payload_len) - len);
183 
184 	/* Pull csum through the guehdr now . This can be used if
185 	 * there is a remote checksum offload.
186 	 */
187 	skb_postpull_rcsum(skb, udp_hdr(skb), len);
188 
189 	data = &guehdr[1];
190 
191 	if (guehdr->flags & GUE_FLAG_PRIV) {
192 		__be32 flags = *(__be32 *)(data + doffset);
193 
194 		doffset += GUE_LEN_PRIV;
195 
196 		if (flags & GUE_PFLAG_REMCSUM) {
197 			guehdr = gue_remcsum(skb, guehdr, data + doffset,
198 					     hdrlen, guehdr->proto_ctype,
199 					     !!(fou->flags &
200 						FOU_F_REMCSUM_NOPARTIAL));
201 			if (!guehdr)
202 				goto drop;
203 
204 			data = &guehdr[1];
205 
206 			doffset += GUE_PLEN_REMCSUM;
207 		}
208 	}
209 
210 	if (unlikely(guehdr->control))
211 		return gue_control_message(skb, guehdr);
212 
213 	__skb_pull(skb, sizeof(struct udphdr) + hdrlen);
214 	skb_reset_transport_header(skb);
215 
216 	if (iptunnel_pull_offloads(skb))
217 		goto drop;
218 
219 	return -guehdr->proto_ctype;
220 
221 drop:
222 	kfree_skb(skb);
223 	return 0;
224 }
225 
fou_gro_receive(struct sock * sk,struct sk_buff ** head,struct sk_buff * skb)226 static struct sk_buff **fou_gro_receive(struct sock *sk,
227 					struct sk_buff **head,
228 					struct sk_buff *skb)
229 {
230 	const struct net_offload *ops;
231 	struct sk_buff **pp = NULL;
232 	u8 proto = fou_from_sock(sk)->protocol;
233 	const struct net_offload **offloads;
234 
235 	/* We can clear the encap_mark for FOU as we are essentially doing
236 	 * one of two possible things.  We are either adding an L4 tunnel
237 	 * header to the outer L3 tunnel header, or we are are simply
238 	 * treating the GRE tunnel header as though it is a UDP protocol
239 	 * specific header such as VXLAN or GENEVE.
240 	 */
241 	NAPI_GRO_CB(skb)->encap_mark = 0;
242 
243 	/* Flag this frame as already having an outer encap header */
244 	NAPI_GRO_CB(skb)->is_fou = 1;
245 
246 	rcu_read_lock();
247 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
248 	ops = rcu_dereference(offloads[proto]);
249 	if (!ops || !ops->callbacks.gro_receive)
250 		goto out_unlock;
251 
252 	pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
253 
254 out_unlock:
255 	rcu_read_unlock();
256 
257 	return pp;
258 }
259 
fou_gro_complete(struct sock * sk,struct sk_buff * skb,int nhoff)260 static int fou_gro_complete(struct sock *sk, struct sk_buff *skb,
261 			    int nhoff)
262 {
263 	const struct net_offload *ops;
264 	u8 proto = fou_from_sock(sk)->protocol;
265 	int err = -ENOSYS;
266 	const struct net_offload **offloads;
267 
268 	rcu_read_lock();
269 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
270 	ops = rcu_dereference(offloads[proto]);
271 	if (WARN_ON(!ops || !ops->callbacks.gro_complete))
272 		goto out_unlock;
273 
274 	err = ops->callbacks.gro_complete(skb, nhoff);
275 
276 	skb_set_inner_mac_header(skb, nhoff);
277 
278 out_unlock:
279 	rcu_read_unlock();
280 
281 	return err;
282 }
283 
gue_gro_remcsum(struct sk_buff * skb,unsigned int off,struct guehdr * guehdr,void * data,size_t hdrlen,struct gro_remcsum * grc,bool nopartial)284 static struct guehdr *gue_gro_remcsum(struct sk_buff *skb, unsigned int off,
285 				      struct guehdr *guehdr, void *data,
286 				      size_t hdrlen, struct gro_remcsum *grc,
287 				      bool nopartial)
288 {
289 	__be16 *pd = data;
290 	size_t start = ntohs(pd[0]);
291 	size_t offset = ntohs(pd[1]);
292 
293 	if (skb->remcsum_offload)
294 		return guehdr;
295 
296 	if (!NAPI_GRO_CB(skb)->csum_valid)
297 		return NULL;
298 
299 	guehdr = skb_gro_remcsum_process(skb, (void *)guehdr, off, hdrlen,
300 					 start, offset, grc, nopartial);
301 
302 	skb->remcsum_offload = 1;
303 
304 	return guehdr;
305 }
306 
gue_gro_receive(struct sock * sk,struct sk_buff ** head,struct sk_buff * skb)307 static struct sk_buff **gue_gro_receive(struct sock *sk,
308 					struct sk_buff **head,
309 					struct sk_buff *skb)
310 {
311 	const struct net_offload **offloads;
312 	const struct net_offload *ops;
313 	struct sk_buff **pp = NULL;
314 	struct sk_buff *p;
315 	struct guehdr *guehdr;
316 	size_t len, optlen, hdrlen, off;
317 	void *data;
318 	u16 doffset = 0;
319 	int flush = 1;
320 	struct fou *fou = fou_from_sock(sk);
321 	struct gro_remcsum grc;
322 	u8 proto;
323 
324 	skb_gro_remcsum_init(&grc);
325 
326 	off = skb_gro_offset(skb);
327 	len = off + sizeof(*guehdr);
328 
329 	guehdr = skb_gro_header_fast(skb, off);
330 	if (skb_gro_header_hard(skb, len)) {
331 		guehdr = skb_gro_header_slow(skb, len, off);
332 		if (unlikely(!guehdr))
333 			goto out;
334 	}
335 
336 	switch (guehdr->version) {
337 	case 0:
338 		break;
339 	case 1:
340 		switch (((struct iphdr *)guehdr)->version) {
341 		case 4:
342 			proto = IPPROTO_IPIP;
343 			break;
344 		case 6:
345 			proto = IPPROTO_IPV6;
346 			break;
347 		default:
348 			goto out;
349 		}
350 		goto next_proto;
351 	default:
352 		goto out;
353 	}
354 
355 	optlen = guehdr->hlen << 2;
356 	len += optlen;
357 
358 	if (skb_gro_header_hard(skb, len)) {
359 		guehdr = skb_gro_header_slow(skb, len, off);
360 		if (unlikely(!guehdr))
361 			goto out;
362 	}
363 
364 	if (unlikely(guehdr->control) || guehdr->version != 0 ||
365 	    validate_gue_flags(guehdr, optlen))
366 		goto out;
367 
368 	hdrlen = sizeof(*guehdr) + optlen;
369 
370 	/* Adjust NAPI_GRO_CB(skb)->csum to account for guehdr,
371 	 * this is needed if there is a remote checkcsum offload.
372 	 */
373 	skb_gro_postpull_rcsum(skb, guehdr, hdrlen);
374 
375 	data = &guehdr[1];
376 
377 	if (guehdr->flags & GUE_FLAG_PRIV) {
378 		__be32 flags = *(__be32 *)(data + doffset);
379 
380 		doffset += GUE_LEN_PRIV;
381 
382 		if (flags & GUE_PFLAG_REMCSUM) {
383 			guehdr = gue_gro_remcsum(skb, off, guehdr,
384 						 data + doffset, hdrlen, &grc,
385 						 !!(fou->flags &
386 						    FOU_F_REMCSUM_NOPARTIAL));
387 
388 			if (!guehdr)
389 				goto out;
390 
391 			data = &guehdr[1];
392 
393 			doffset += GUE_PLEN_REMCSUM;
394 		}
395 	}
396 
397 	skb_gro_pull(skb, hdrlen);
398 
399 	for (p = *head; p; p = p->next) {
400 		const struct guehdr *guehdr2;
401 
402 		if (!NAPI_GRO_CB(p)->same_flow)
403 			continue;
404 
405 		guehdr2 = (struct guehdr *)(p->data + off);
406 
407 		/* Compare base GUE header to be equal (covers
408 		 * hlen, version, proto_ctype, and flags.
409 		 */
410 		if (guehdr->word != guehdr2->word) {
411 			NAPI_GRO_CB(p)->same_flow = 0;
412 			continue;
413 		}
414 
415 		/* Compare optional fields are the same. */
416 		if (guehdr->hlen && memcmp(&guehdr[1], &guehdr2[1],
417 					   guehdr->hlen << 2)) {
418 			NAPI_GRO_CB(p)->same_flow = 0;
419 			continue;
420 		}
421 	}
422 
423 	proto = guehdr->proto_ctype;
424 
425 next_proto:
426 
427 	/* We can clear the encap_mark for GUE as we are essentially doing
428 	 * one of two possible things.  We are either adding an L4 tunnel
429 	 * header to the outer L3 tunnel header, or we are are simply
430 	 * treating the GRE tunnel header as though it is a UDP protocol
431 	 * specific header such as VXLAN or GENEVE.
432 	 */
433 	NAPI_GRO_CB(skb)->encap_mark = 0;
434 
435 	/* Flag this frame as already having an outer encap header */
436 	NAPI_GRO_CB(skb)->is_fou = 1;
437 
438 	rcu_read_lock();
439 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
440 	ops = rcu_dereference(offloads[proto]);
441 	if (WARN_ON_ONCE(!ops || !ops->callbacks.gro_receive))
442 		goto out_unlock;
443 
444 	pp = call_gro_receive(ops->callbacks.gro_receive, head, skb);
445 	flush = 0;
446 
447 out_unlock:
448 	rcu_read_unlock();
449 out:
450 	NAPI_GRO_CB(skb)->flush |= flush;
451 	skb_gro_remcsum_cleanup(skb, &grc);
452 
453 	return pp;
454 }
455 
gue_gro_complete(struct sock * sk,struct sk_buff * skb,int nhoff)456 static int gue_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff)
457 {
458 	const struct net_offload **offloads;
459 	struct guehdr *guehdr = (struct guehdr *)(skb->data + nhoff);
460 	const struct net_offload *ops;
461 	unsigned int guehlen = 0;
462 	u8 proto;
463 	int err = -ENOENT;
464 
465 	switch (guehdr->version) {
466 	case 0:
467 		proto = guehdr->proto_ctype;
468 		guehlen = sizeof(*guehdr) + (guehdr->hlen << 2);
469 		break;
470 	case 1:
471 		switch (((struct iphdr *)guehdr)->version) {
472 		case 4:
473 			proto = IPPROTO_IPIP;
474 			break;
475 		case 6:
476 			proto = IPPROTO_IPV6;
477 			break;
478 		default:
479 			return err;
480 		}
481 		break;
482 	default:
483 		return err;
484 	}
485 
486 	rcu_read_lock();
487 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
488 	ops = rcu_dereference(offloads[proto]);
489 	if (WARN_ON(!ops || !ops->callbacks.gro_complete))
490 		goto out_unlock;
491 
492 	err = ops->callbacks.gro_complete(skb, nhoff + guehlen);
493 
494 	skb_set_inner_mac_header(skb, nhoff + guehlen);
495 
496 out_unlock:
497 	rcu_read_unlock();
498 	return err;
499 }
500 
fou_add_to_port_list(struct net * net,struct fou * fou)501 static int fou_add_to_port_list(struct net *net, struct fou *fou)
502 {
503 	struct fou_net *fn = net_generic(net, fou_net_id);
504 	struct fou *fout;
505 
506 	mutex_lock(&fn->fou_lock);
507 	list_for_each_entry(fout, &fn->fou_list, list) {
508 		if (fou->port == fout->port &&
509 		    fou->family == fout->family) {
510 			mutex_unlock(&fn->fou_lock);
511 			return -EALREADY;
512 		}
513 	}
514 
515 	list_add(&fou->list, &fn->fou_list);
516 	mutex_unlock(&fn->fou_lock);
517 
518 	return 0;
519 }
520 
fou_release(struct fou * fou)521 static void fou_release(struct fou *fou)
522 {
523 	struct socket *sock = fou->sock;
524 
525 	list_del(&fou->list);
526 	udp_tunnel_sock_release(sock);
527 
528 	kfree_rcu(fou, rcu);
529 }
530 
fou_create(struct net * net,struct fou_cfg * cfg,struct socket ** sockp)531 static int fou_create(struct net *net, struct fou_cfg *cfg,
532 		      struct socket **sockp)
533 {
534 	struct socket *sock = NULL;
535 	struct fou *fou = NULL;
536 	struct sock *sk;
537 	struct udp_tunnel_sock_cfg tunnel_cfg;
538 	int err;
539 
540 	/* Open UDP socket */
541 	err = udp_sock_create(net, &cfg->udp_config, &sock);
542 	if (err < 0)
543 		goto error;
544 
545 	/* Allocate FOU port structure */
546 	fou = kzalloc(sizeof(*fou), GFP_KERNEL);
547 	if (!fou) {
548 		err = -ENOMEM;
549 		goto error;
550 	}
551 
552 	sk = sock->sk;
553 
554 	fou->port = cfg->udp_config.local_udp_port;
555 	fou->family = cfg->udp_config.family;
556 	fou->flags = cfg->flags;
557 	fou->type = cfg->type;
558 	fou->sock = sock;
559 
560 	memset(&tunnel_cfg, 0, sizeof(tunnel_cfg));
561 	tunnel_cfg.encap_type = 1;
562 	tunnel_cfg.sk_user_data = fou;
563 	tunnel_cfg.encap_destroy = NULL;
564 
565 	/* Initial for fou type */
566 	switch (cfg->type) {
567 	case FOU_ENCAP_DIRECT:
568 		tunnel_cfg.encap_rcv = fou_udp_recv;
569 		tunnel_cfg.gro_receive = fou_gro_receive;
570 		tunnel_cfg.gro_complete = fou_gro_complete;
571 		fou->protocol = cfg->protocol;
572 		break;
573 	case FOU_ENCAP_GUE:
574 		tunnel_cfg.encap_rcv = gue_udp_recv;
575 		tunnel_cfg.gro_receive = gue_gro_receive;
576 		tunnel_cfg.gro_complete = gue_gro_complete;
577 		break;
578 	default:
579 		err = -EINVAL;
580 		goto error;
581 	}
582 
583 	setup_udp_tunnel_sock(net, sock, &tunnel_cfg);
584 
585 	sk->sk_allocation = GFP_ATOMIC;
586 
587 	err = fou_add_to_port_list(net, fou);
588 	if (err)
589 		goto error;
590 
591 	if (sockp)
592 		*sockp = sock;
593 
594 	return 0;
595 
596 error:
597 	kfree(fou);
598 	if (sock)
599 		udp_tunnel_sock_release(sock);
600 
601 	return err;
602 }
603 
fou_destroy(struct net * net,struct fou_cfg * cfg)604 static int fou_destroy(struct net *net, struct fou_cfg *cfg)
605 {
606 	struct fou_net *fn = net_generic(net, fou_net_id);
607 	__be16 port = cfg->udp_config.local_udp_port;
608 	u8 family = cfg->udp_config.family;
609 	int err = -EINVAL;
610 	struct fou *fou;
611 
612 	mutex_lock(&fn->fou_lock);
613 	list_for_each_entry(fou, &fn->fou_list, list) {
614 		if (fou->port == port && fou->family == family) {
615 			fou_release(fou);
616 			err = 0;
617 			break;
618 		}
619 	}
620 	mutex_unlock(&fn->fou_lock);
621 
622 	return err;
623 }
624 
625 static struct genl_family fou_nl_family = {
626 	.id		= GENL_ID_GENERATE,
627 	.hdrsize	= 0,
628 	.name		= FOU_GENL_NAME,
629 	.version	= FOU_GENL_VERSION,
630 	.maxattr	= FOU_ATTR_MAX,
631 	.netnsok	= true,
632 };
633 
634 static const struct nla_policy fou_nl_policy[FOU_ATTR_MAX + 1] = {
635 	[FOU_ATTR_PORT] = { .type = NLA_U16, },
636 	[FOU_ATTR_AF] = { .type = NLA_U8, },
637 	[FOU_ATTR_IPPROTO] = { .type = NLA_U8, },
638 	[FOU_ATTR_TYPE] = { .type = NLA_U8, },
639 	[FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, },
640 };
641 
parse_nl_config(struct genl_info * info,struct fou_cfg * cfg)642 static int parse_nl_config(struct genl_info *info,
643 			   struct fou_cfg *cfg)
644 {
645 	memset(cfg, 0, sizeof(*cfg));
646 
647 	cfg->udp_config.family = AF_INET;
648 
649 	if (info->attrs[FOU_ATTR_AF]) {
650 		u8 family = nla_get_u8(info->attrs[FOU_ATTR_AF]);
651 
652 		switch (family) {
653 		case AF_INET:
654 			break;
655 		case AF_INET6:
656 			cfg->udp_config.ipv6_v6only = 1;
657 			break;
658 		default:
659 			return -EAFNOSUPPORT;
660 		}
661 
662 		cfg->udp_config.family = family;
663 	}
664 
665 	if (info->attrs[FOU_ATTR_PORT]) {
666 		__be16 port = nla_get_be16(info->attrs[FOU_ATTR_PORT]);
667 
668 		cfg->udp_config.local_udp_port = port;
669 	}
670 
671 	if (info->attrs[FOU_ATTR_IPPROTO])
672 		cfg->protocol = nla_get_u8(info->attrs[FOU_ATTR_IPPROTO]);
673 
674 	if (info->attrs[FOU_ATTR_TYPE])
675 		cfg->type = nla_get_u8(info->attrs[FOU_ATTR_TYPE]);
676 
677 	if (info->attrs[FOU_ATTR_REMCSUM_NOPARTIAL])
678 		cfg->flags |= FOU_F_REMCSUM_NOPARTIAL;
679 
680 	return 0;
681 }
682 
fou_nl_cmd_add_port(struct sk_buff * skb,struct genl_info * info)683 static int fou_nl_cmd_add_port(struct sk_buff *skb, struct genl_info *info)
684 {
685 	struct net *net = genl_info_net(info);
686 	struct fou_cfg cfg;
687 	int err;
688 
689 	err = parse_nl_config(info, &cfg);
690 	if (err)
691 		return err;
692 
693 	return fou_create(net, &cfg, NULL);
694 }
695 
fou_nl_cmd_rm_port(struct sk_buff * skb,struct genl_info * info)696 static int fou_nl_cmd_rm_port(struct sk_buff *skb, struct genl_info *info)
697 {
698 	struct net *net = genl_info_net(info);
699 	struct fou_cfg cfg;
700 	int err;
701 
702 	err = parse_nl_config(info, &cfg);
703 	if (err)
704 		return err;
705 
706 	return fou_destroy(net, &cfg);
707 }
708 
fou_fill_info(struct fou * fou,struct sk_buff * msg)709 static int fou_fill_info(struct fou *fou, struct sk_buff *msg)
710 {
711 	if (nla_put_u8(msg, FOU_ATTR_AF, fou->sock->sk->sk_family) ||
712 	    nla_put_be16(msg, FOU_ATTR_PORT, fou->port) ||
713 	    nla_put_u8(msg, FOU_ATTR_IPPROTO, fou->protocol) ||
714 	    nla_put_u8(msg, FOU_ATTR_TYPE, fou->type))
715 		return -1;
716 
717 	if (fou->flags & FOU_F_REMCSUM_NOPARTIAL)
718 		if (nla_put_flag(msg, FOU_ATTR_REMCSUM_NOPARTIAL))
719 			return -1;
720 	return 0;
721 }
722 
fou_dump_info(struct fou * fou,u32 portid,u32 seq,u32 flags,struct sk_buff * skb,u8 cmd)723 static int fou_dump_info(struct fou *fou, u32 portid, u32 seq,
724 			 u32 flags, struct sk_buff *skb, u8 cmd)
725 {
726 	void *hdr;
727 
728 	hdr = genlmsg_put(skb, portid, seq, &fou_nl_family, flags, cmd);
729 	if (!hdr)
730 		return -ENOMEM;
731 
732 	if (fou_fill_info(fou, skb) < 0)
733 		goto nla_put_failure;
734 
735 	genlmsg_end(skb, hdr);
736 	return 0;
737 
738 nla_put_failure:
739 	genlmsg_cancel(skb, hdr);
740 	return -EMSGSIZE;
741 }
742 
fou_nl_cmd_get_port(struct sk_buff * skb,struct genl_info * info)743 static int fou_nl_cmd_get_port(struct sk_buff *skb, struct genl_info *info)
744 {
745 	struct net *net = genl_info_net(info);
746 	struct fou_net *fn = net_generic(net, fou_net_id);
747 	struct sk_buff *msg;
748 	struct fou_cfg cfg;
749 	struct fou *fout;
750 	__be16 port;
751 	u8 family;
752 	int ret;
753 
754 	ret = parse_nl_config(info, &cfg);
755 	if (ret)
756 		return ret;
757 	port = cfg.udp_config.local_udp_port;
758 	if (port == 0)
759 		return -EINVAL;
760 
761 	family = cfg.udp_config.family;
762 	if (family != AF_INET && family != AF_INET6)
763 		return -EINVAL;
764 
765 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
766 	if (!msg)
767 		return -ENOMEM;
768 
769 	ret = -ESRCH;
770 	mutex_lock(&fn->fou_lock);
771 	list_for_each_entry(fout, &fn->fou_list, list) {
772 		if (port == fout->port && family == fout->family) {
773 			ret = fou_dump_info(fout, info->snd_portid,
774 					    info->snd_seq, 0, msg,
775 					    info->genlhdr->cmd);
776 			break;
777 		}
778 	}
779 	mutex_unlock(&fn->fou_lock);
780 	if (ret < 0)
781 		goto out_free;
782 
783 	return genlmsg_reply(msg, info);
784 
785 out_free:
786 	nlmsg_free(msg);
787 	return ret;
788 }
789 
fou_nl_dump(struct sk_buff * skb,struct netlink_callback * cb)790 static int fou_nl_dump(struct sk_buff *skb, struct netlink_callback *cb)
791 {
792 	struct net *net = sock_net(skb->sk);
793 	struct fou_net *fn = net_generic(net, fou_net_id);
794 	struct fou *fout;
795 	int idx = 0, ret;
796 
797 	mutex_lock(&fn->fou_lock);
798 	list_for_each_entry(fout, &fn->fou_list, list) {
799 		if (idx++ < cb->args[0])
800 			continue;
801 		ret = fou_dump_info(fout, NETLINK_CB(cb->skb).portid,
802 				    cb->nlh->nlmsg_seq, NLM_F_MULTI,
803 				    skb, FOU_CMD_GET);
804 		if (ret)
805 			break;
806 	}
807 	mutex_unlock(&fn->fou_lock);
808 
809 	cb->args[0] = idx;
810 	return skb->len;
811 }
812 
813 static const struct genl_ops fou_nl_ops[] = {
814 	{
815 		.cmd = FOU_CMD_ADD,
816 		.doit = fou_nl_cmd_add_port,
817 		.policy = fou_nl_policy,
818 		.flags = GENL_ADMIN_PERM,
819 	},
820 	{
821 		.cmd = FOU_CMD_DEL,
822 		.doit = fou_nl_cmd_rm_port,
823 		.policy = fou_nl_policy,
824 		.flags = GENL_ADMIN_PERM,
825 	},
826 	{
827 		.cmd = FOU_CMD_GET,
828 		.doit = fou_nl_cmd_get_port,
829 		.dumpit = fou_nl_dump,
830 		.policy = fou_nl_policy,
831 	},
832 };
833 
fou_encap_hlen(struct ip_tunnel_encap * e)834 size_t fou_encap_hlen(struct ip_tunnel_encap *e)
835 {
836 	return sizeof(struct udphdr);
837 }
838 EXPORT_SYMBOL(fou_encap_hlen);
839 
gue_encap_hlen(struct ip_tunnel_encap * e)840 size_t gue_encap_hlen(struct ip_tunnel_encap *e)
841 {
842 	size_t len;
843 	bool need_priv = false;
844 
845 	len = sizeof(struct udphdr) + sizeof(struct guehdr);
846 
847 	if (e->flags & TUNNEL_ENCAP_FLAG_REMCSUM) {
848 		len += GUE_PLEN_REMCSUM;
849 		need_priv = true;
850 	}
851 
852 	len += need_priv ? GUE_LEN_PRIV : 0;
853 
854 	return len;
855 }
856 EXPORT_SYMBOL(gue_encap_hlen);
857 
fou_build_udp(struct sk_buff * skb,struct ip_tunnel_encap * e,struct flowi4 * fl4,u8 * protocol,__be16 sport)858 static void fou_build_udp(struct sk_buff *skb, struct ip_tunnel_encap *e,
859 			  struct flowi4 *fl4, u8 *protocol, __be16 sport)
860 {
861 	struct udphdr *uh;
862 
863 	skb_push(skb, sizeof(struct udphdr));
864 	skb_reset_transport_header(skb);
865 
866 	uh = udp_hdr(skb);
867 
868 	uh->dest = e->dport;
869 	uh->source = sport;
870 	uh->len = htons(skb->len);
871 	udp_set_csum(!(e->flags & TUNNEL_ENCAP_FLAG_CSUM), skb,
872 		     fl4->saddr, fl4->daddr, skb->len);
873 
874 	*protocol = IPPROTO_UDP;
875 }
876 
__fou_build_header(struct sk_buff * skb,struct ip_tunnel_encap * e,u8 * protocol,__be16 * sport,int type)877 int __fou_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
878 		       u8 *protocol, __be16 *sport, int type)
879 {
880 	int err;
881 
882 	err = iptunnel_handle_offloads(skb, type);
883 	if (err)
884 		return err;
885 
886 	*sport = e->sport ? : udp_flow_src_port(dev_net(skb->dev),
887 						skb, 0, 0, false);
888 
889 	return 0;
890 }
891 EXPORT_SYMBOL(__fou_build_header);
892 
fou_build_header(struct sk_buff * skb,struct ip_tunnel_encap * e,u8 * protocol,struct flowi4 * fl4)893 int fou_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
894 		     u8 *protocol, struct flowi4 *fl4)
895 {
896 	int type = e->flags & TUNNEL_ENCAP_FLAG_CSUM ? SKB_GSO_UDP_TUNNEL_CSUM :
897 						       SKB_GSO_UDP_TUNNEL;
898 	__be16 sport;
899 	int err;
900 
901 	err = __fou_build_header(skb, e, protocol, &sport, type);
902 	if (err)
903 		return err;
904 
905 	fou_build_udp(skb, e, fl4, protocol, sport);
906 
907 	return 0;
908 }
909 EXPORT_SYMBOL(fou_build_header);
910 
__gue_build_header(struct sk_buff * skb,struct ip_tunnel_encap * e,u8 * protocol,__be16 * sport,int type)911 int __gue_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
912 		       u8 *protocol, __be16 *sport, int type)
913 {
914 	struct guehdr *guehdr;
915 	size_t hdrlen, optlen = 0;
916 	void *data;
917 	bool need_priv = false;
918 	int err;
919 
920 	if ((e->flags & TUNNEL_ENCAP_FLAG_REMCSUM) &&
921 	    skb->ip_summed == CHECKSUM_PARTIAL) {
922 		optlen += GUE_PLEN_REMCSUM;
923 		type |= SKB_GSO_TUNNEL_REMCSUM;
924 		need_priv = true;
925 	}
926 
927 	optlen += need_priv ? GUE_LEN_PRIV : 0;
928 
929 	err = iptunnel_handle_offloads(skb, type);
930 	if (err)
931 		return err;
932 
933 	/* Get source port (based on flow hash) before skb_push */
934 	*sport = e->sport ? : udp_flow_src_port(dev_net(skb->dev),
935 						skb, 0, 0, false);
936 
937 	hdrlen = sizeof(struct guehdr) + optlen;
938 
939 	skb_push(skb, hdrlen);
940 
941 	guehdr = (struct guehdr *)skb->data;
942 
943 	guehdr->control = 0;
944 	guehdr->version = 0;
945 	guehdr->hlen = optlen >> 2;
946 	guehdr->flags = 0;
947 	guehdr->proto_ctype = *protocol;
948 
949 	data = &guehdr[1];
950 
951 	if (need_priv) {
952 		__be32 *flags = data;
953 
954 		guehdr->flags |= GUE_FLAG_PRIV;
955 		*flags = 0;
956 		data += GUE_LEN_PRIV;
957 
958 		if (type & SKB_GSO_TUNNEL_REMCSUM) {
959 			u16 csum_start = skb_checksum_start_offset(skb);
960 			__be16 *pd = data;
961 
962 			if (csum_start < hdrlen)
963 				return -EINVAL;
964 
965 			csum_start -= hdrlen;
966 			pd[0] = htons(csum_start);
967 			pd[1] = htons(csum_start + skb->csum_offset);
968 
969 			if (!skb_is_gso(skb)) {
970 				skb->ip_summed = CHECKSUM_NONE;
971 				skb->encapsulation = 0;
972 			}
973 
974 			*flags |= GUE_PFLAG_REMCSUM;
975 			data += GUE_PLEN_REMCSUM;
976 		}
977 
978 	}
979 
980 	return 0;
981 }
982 EXPORT_SYMBOL(__gue_build_header);
983 
gue_build_header(struct sk_buff * skb,struct ip_tunnel_encap * e,u8 * protocol,struct flowi4 * fl4)984 int gue_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
985 		     u8 *protocol, struct flowi4 *fl4)
986 {
987 	int type = e->flags & TUNNEL_ENCAP_FLAG_CSUM ? SKB_GSO_UDP_TUNNEL_CSUM :
988 						       SKB_GSO_UDP_TUNNEL;
989 	__be16 sport;
990 	int err;
991 
992 	err = __gue_build_header(skb, e, protocol, &sport, type);
993 	if (err)
994 		return err;
995 
996 	fou_build_udp(skb, e, fl4, protocol, sport);
997 
998 	return 0;
999 }
1000 EXPORT_SYMBOL(gue_build_header);
1001 
1002 #ifdef CONFIG_NET_FOU_IP_TUNNELS
1003 
1004 static const struct ip_tunnel_encap_ops fou_iptun_ops = {
1005 	.encap_hlen = fou_encap_hlen,
1006 	.build_header = fou_build_header,
1007 };
1008 
1009 static const struct ip_tunnel_encap_ops gue_iptun_ops = {
1010 	.encap_hlen = gue_encap_hlen,
1011 	.build_header = gue_build_header,
1012 };
1013 
ip_tunnel_encap_add_fou_ops(void)1014 static int ip_tunnel_encap_add_fou_ops(void)
1015 {
1016 	int ret;
1017 
1018 	ret = ip_tunnel_encap_add_ops(&fou_iptun_ops, TUNNEL_ENCAP_FOU);
1019 	if (ret < 0) {
1020 		pr_err("can't add fou ops\n");
1021 		return ret;
1022 	}
1023 
1024 	ret = ip_tunnel_encap_add_ops(&gue_iptun_ops, TUNNEL_ENCAP_GUE);
1025 	if (ret < 0) {
1026 		pr_err("can't add gue ops\n");
1027 		ip_tunnel_encap_del_ops(&fou_iptun_ops, TUNNEL_ENCAP_FOU);
1028 		return ret;
1029 	}
1030 
1031 	return 0;
1032 }
1033 
ip_tunnel_encap_del_fou_ops(void)1034 static void ip_tunnel_encap_del_fou_ops(void)
1035 {
1036 	ip_tunnel_encap_del_ops(&fou_iptun_ops, TUNNEL_ENCAP_FOU);
1037 	ip_tunnel_encap_del_ops(&gue_iptun_ops, TUNNEL_ENCAP_GUE);
1038 }
1039 
1040 #else
1041 
ip_tunnel_encap_add_fou_ops(void)1042 static int ip_tunnel_encap_add_fou_ops(void)
1043 {
1044 	return 0;
1045 }
1046 
ip_tunnel_encap_del_fou_ops(void)1047 static void ip_tunnel_encap_del_fou_ops(void)
1048 {
1049 }
1050 
1051 #endif
1052 
fou_init_net(struct net * net)1053 static __net_init int fou_init_net(struct net *net)
1054 {
1055 	struct fou_net *fn = net_generic(net, fou_net_id);
1056 
1057 	INIT_LIST_HEAD(&fn->fou_list);
1058 	mutex_init(&fn->fou_lock);
1059 	return 0;
1060 }
1061 
fou_exit_net(struct net * net)1062 static __net_exit void fou_exit_net(struct net *net)
1063 {
1064 	struct fou_net *fn = net_generic(net, fou_net_id);
1065 	struct fou *fou, *next;
1066 
1067 	/* Close all the FOU sockets */
1068 	mutex_lock(&fn->fou_lock);
1069 	list_for_each_entry_safe(fou, next, &fn->fou_list, list)
1070 		fou_release(fou);
1071 	mutex_unlock(&fn->fou_lock);
1072 }
1073 
1074 static struct pernet_operations fou_net_ops = {
1075 	.init = fou_init_net,
1076 	.exit = fou_exit_net,
1077 	.id   = &fou_net_id,
1078 	.size = sizeof(struct fou_net),
1079 };
1080 
fou_init(void)1081 static int __init fou_init(void)
1082 {
1083 	int ret;
1084 
1085 	ret = register_pernet_device(&fou_net_ops);
1086 	if (ret)
1087 		goto exit;
1088 
1089 	ret = genl_register_family_with_ops(&fou_nl_family,
1090 					    fou_nl_ops);
1091 	if (ret < 0)
1092 		goto unregister;
1093 
1094 	ret = ip_tunnel_encap_add_fou_ops();
1095 	if (ret == 0)
1096 		return 0;
1097 
1098 	genl_unregister_family(&fou_nl_family);
1099 unregister:
1100 	unregister_pernet_device(&fou_net_ops);
1101 exit:
1102 	return ret;
1103 }
1104 
fou_fini(void)1105 static void __exit fou_fini(void)
1106 {
1107 	ip_tunnel_encap_del_fou_ops();
1108 	genl_unregister_family(&fou_nl_family);
1109 	unregister_pernet_device(&fou_net_ops);
1110 }
1111 
1112 module_init(fou_init);
1113 module_exit(fou_fini);
1114 MODULE_AUTHOR("Tom Herbert <therbert@google.com>");
1115 MODULE_LICENSE("GPL");
1116