blob: 8bd8c7e1ee8724c56c670850c9ecc20590a68707 [file] [log] [blame]
David Ahern193125d2015-08-13 14:59:10 -06001/*
2 * vrf.c: device driver to encapsulate a VRF space
3 *
4 * Copyright (c) 2015 Cumulus Networks. All rights reserved.
5 * Copyright (c) 2015 Shrijeet Mukherjee <shm@cumulusnetworks.com>
6 * Copyright (c) 2015 David Ahern <dsa@cumulusnetworks.com>
7 *
8 * Based on dummy, team and ipvlan drivers
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
14 */
15
16#include <linux/module.h>
17#include <linux/kernel.h>
18#include <linux/netdevice.h>
19#include <linux/etherdevice.h>
20#include <linux/ip.h>
21#include <linux/init.h>
22#include <linux/moduleparam.h>
23#include <linux/netfilter.h>
24#include <linux/rtnetlink.h>
25#include <net/rtnetlink.h>
26#include <linux/u64_stats_sync.h>
27#include <linux/hashtable.h>
28
29#include <linux/inetdevice.h>
David Ahern8f583362015-08-27 10:10:50 -070030#include <net/arp.h>
David Ahern193125d2015-08-13 14:59:10 -060031#include <net/ip.h>
32#include <net/ip_fib.h>
David Ahern35402e32015-10-12 11:47:09 -070033#include <net/ip6_fib.h>
David Ahern193125d2015-08-13 14:59:10 -060034#include <net/ip6_route.h>
David Ahern193125d2015-08-13 14:59:10 -060035#include <net/route.h>
36#include <net/addrconf.h>
David Ahernee15ee52015-09-29 20:07:12 -070037#include <net/l3mdev.h>
David Ahern193125d2015-08-13 14:59:10 -060038
David Ahern8cbb512c2015-10-05 08:51:26 -070039#define RT_FL_TOS(oldflp4) \
40 ((oldflp4)->flowi4_tos & (IPTOS_RT_MASK | RTO_ONLINK))
41
David Ahern193125d2015-08-13 14:59:10 -060042#define DRV_NAME "vrf"
43#define DRV_VERSION "1.0"
44
David Ahernec539512015-09-29 20:07:17 -070045struct net_vrf {
David Ahernb0e95cc2016-05-13 12:23:45 -070046 struct rtable __rcu *rth;
47 struct rt6_info __rcu *rt6;
David Ahernec539512015-09-29 20:07:17 -070048 u32 tb_id;
49};
50
David Ahern193125d2015-08-13 14:59:10 -060051struct pcpu_dstats {
52 u64 tx_pkts;
53 u64 tx_bytes;
54 u64 tx_drps;
55 u64 rx_pkts;
56 u64 rx_bytes;
57 struct u64_stats_sync syncp;
58};
59
Nikolay Aleksandrov57b8efa2015-08-19 06:12:29 +030060static void vrf_tx_error(struct net_device *vrf_dev, struct sk_buff *skb)
61{
62 vrf_dev->stats.tx_errors++;
63 kfree_skb(skb);
64}
65
David Ahern193125d2015-08-13 14:59:10 -060066static struct rtnl_link_stats64 *vrf_get_stats64(struct net_device *dev,
67 struct rtnl_link_stats64 *stats)
68{
69 int i;
70
71 for_each_possible_cpu(i) {
72 const struct pcpu_dstats *dstats;
73 u64 tbytes, tpkts, tdrops, rbytes, rpkts;
74 unsigned int start;
75
76 dstats = per_cpu_ptr(dev->dstats, i);
77 do {
78 start = u64_stats_fetch_begin_irq(&dstats->syncp);
79 tbytes = dstats->tx_bytes;
80 tpkts = dstats->tx_pkts;
81 tdrops = dstats->tx_drps;
82 rbytes = dstats->rx_bytes;
83 rpkts = dstats->rx_pkts;
84 } while (u64_stats_fetch_retry_irq(&dstats->syncp, start));
85 stats->tx_bytes += tbytes;
86 stats->tx_packets += tpkts;
87 stats->tx_dropped += tdrops;
88 stats->rx_bytes += rbytes;
89 stats->rx_packets += rpkts;
90 }
91 return stats;
92}
93
David Ahern35402e32015-10-12 11:47:09 -070094#if IS_ENABLED(CONFIG_IPV6)
95static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
96 struct net_device *dev)
97{
98 const struct ipv6hdr *iph = ipv6_hdr(skb);
99 struct net *net = dev_net(skb->dev);
100 struct flowi6 fl6 = {
101 /* needed to match OIF rule */
102 .flowi6_oif = dev->ifindex,
103 .flowi6_iif = LOOPBACK_IFINDEX,
104 .daddr = iph->daddr,
105 .saddr = iph->saddr,
106 .flowlabel = ip6_flowinfo(iph),
107 .flowi6_mark = skb->mark,
108 .flowi6_proto = iph->nexthdr,
109 .flowi6_flags = FLOWI_FLAG_L3MDEV_SRC | FLOWI_FLAG_SKIP_NH_OIF,
110 };
111 int ret = NET_XMIT_DROP;
112 struct dst_entry *dst;
113 struct dst_entry *dst_null = &net->ipv6.ip6_null_entry->dst;
114
115 dst = ip6_route_output(net, NULL, &fl6);
116 if (dst == dst_null)
117 goto err;
118
119 skb_dst_drop(skb);
120 skb_dst_set(skb, dst);
121
122 ret = ip6_local_out(net, skb->sk, skb);
123 if (unlikely(net_xmit_eval(ret)))
124 dev->stats.tx_errors++;
125 else
126 ret = NET_XMIT_SUCCESS;
127
128 return ret;
129err:
130 vrf_tx_error(dev, skb);
131 return NET_XMIT_DROP;
132}
133#else
David Ahern193125d2015-08-13 14:59:10 -0600134static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
135 struct net_device *dev)
136{
Nikolay Aleksandrov57b8efa2015-08-19 06:12:29 +0300137 vrf_tx_error(dev, skb);
138 return NET_XMIT_DROP;
David Ahern193125d2015-08-13 14:59:10 -0600139}
David Ahern35402e32015-10-12 11:47:09 -0700140#endif
David Ahern193125d2015-08-13 14:59:10 -0600141
142static int vrf_send_v4_prep(struct sk_buff *skb, struct flowi4 *fl4,
143 struct net_device *vrf_dev)
144{
145 struct rtable *rt;
146 int err = 1;
147
148 rt = ip_route_output_flow(dev_net(vrf_dev), fl4, NULL);
149 if (IS_ERR(rt))
150 goto out;
151
152 /* TO-DO: what about broadcast ? */
153 if (rt->rt_type != RTN_UNICAST && rt->rt_type != RTN_LOCAL) {
154 ip_rt_put(rt);
155 goto out;
156 }
157
158 skb_dst_drop(skb);
159 skb_dst_set(skb, &rt->dst);
160 err = 0;
161out:
162 return err;
163}
164
165static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
166 struct net_device *vrf_dev)
167{
168 struct iphdr *ip4h = ip_hdr(skb);
169 int ret = NET_XMIT_DROP;
170 struct flowi4 fl4 = {
171 /* needed to match OIF rule */
172 .flowi4_oif = vrf_dev->ifindex,
173 .flowi4_iif = LOOPBACK_IFINDEX,
174 .flowi4_tos = RT_TOS(ip4h->tos),
David Ahern6e2895a2015-10-05 08:51:23 -0700175 .flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_L3MDEV_SRC |
David Ahern58189ca2015-09-15 15:10:50 -0700176 FLOWI_FLAG_SKIP_NH_OIF,
David Ahern193125d2015-08-13 14:59:10 -0600177 .daddr = ip4h->daddr,
178 };
179
180 if (vrf_send_v4_prep(skb, &fl4, vrf_dev))
181 goto err;
182
183 if (!ip4h->saddr) {
184 ip4h->saddr = inet_select_addr(skb_dst(skb)->dev, 0,
185 RT_SCOPE_LINK);
186 }
187
Eric W. Biederman33224b12015-10-07 16:48:46 -0500188 ret = ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
David Ahern193125d2015-08-13 14:59:10 -0600189 if (unlikely(net_xmit_eval(ret)))
190 vrf_dev->stats.tx_errors++;
191 else
192 ret = NET_XMIT_SUCCESS;
193
194out:
195 return ret;
196err:
Nikolay Aleksandrov57b8efa2015-08-19 06:12:29 +0300197 vrf_tx_error(vrf_dev, skb);
David Ahern193125d2015-08-13 14:59:10 -0600198 goto out;
199}
200
201static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
202{
David Ahern8f583362015-08-27 10:10:50 -0700203 /* strip the ethernet header added for pass through VRF device */
204 __skb_pull(skb, skb_network_offset(skb));
205
David Ahern193125d2015-08-13 14:59:10 -0600206 switch (skb->protocol) {
207 case htons(ETH_P_IP):
208 return vrf_process_v4_outbound(skb, dev);
209 case htons(ETH_P_IPV6):
210 return vrf_process_v6_outbound(skb, dev);
211 default:
Nikolay Aleksandrov57b8efa2015-08-19 06:12:29 +0300212 vrf_tx_error(dev, skb);
David Ahern193125d2015-08-13 14:59:10 -0600213 return NET_XMIT_DROP;
214 }
215}
216
217static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
218{
219 netdev_tx_t ret = is_ip_tx_frame(skb, dev);
220
221 if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
222 struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
223
224 u64_stats_update_begin(&dstats->syncp);
225 dstats->tx_pkts++;
226 dstats->tx_bytes += skb->len;
227 u64_stats_update_end(&dstats->syncp);
228 } else {
229 this_cpu_inc(dev->dstats->tx_drps);
230 }
231
232 return ret;
233}
234
David Ahern35402e32015-10-12 11:47:09 -0700235#if IS_ENABLED(CONFIG_IPV6)
David Ahern35402e32015-10-12 11:47:09 -0700236/* modelled after ip6_finish_output2 */
237static int vrf_finish_output6(struct net *net, struct sock *sk,
238 struct sk_buff *skb)
239{
240 struct dst_entry *dst = skb_dst(skb);
241 struct net_device *dev = dst->dev;
242 struct neighbour *neigh;
243 struct in6_addr *nexthop;
244 int ret;
245
246 skb->protocol = htons(ETH_P_IPV6);
247 skb->dev = dev;
248
249 rcu_read_lock_bh();
250 nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
251 neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
252 if (unlikely(!neigh))
253 neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
254 if (!IS_ERR(neigh)) {
255 ret = dst_neigh_output(dst, neigh, skb);
256 rcu_read_unlock_bh();
257 return ret;
258 }
259 rcu_read_unlock_bh();
260
261 IP6_INC_STATS(dev_net(dst->dev),
262 ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
263 kfree_skb(skb);
264 return -EINVAL;
265}
266
267/* modelled after ip6_output */
268static int vrf_output6(struct net *net, struct sock *sk, struct sk_buff *skb)
269{
270 return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
271 net, sk, skb, NULL, skb_dst(skb)->dev,
272 vrf_finish_output6,
273 !(IP6CB(skb)->flags & IP6SKB_REROUTED));
274}
275
David Ahernb0e95cc2016-05-13 12:23:45 -0700276/* holding rtnl */
David Ahern9ab179d2016-04-07 11:10:06 -0700277static void vrf_rt6_release(struct net_vrf *vrf)
David Ahern35402e32015-10-12 11:47:09 -0700278{
David Ahernb0e95cc2016-05-13 12:23:45 -0700279 struct rt6_info *rt6 = rtnl_dereference(vrf->rt6);
280
281 rcu_assign_pointer(vrf->rt6, NULL);
282
283 if (rt6)
284 dst_release(&rt6->dst);
David Ahern35402e32015-10-12 11:47:09 -0700285}
286
287static int vrf_rt6_create(struct net_device *dev)
288{
289 struct net_vrf *vrf = netdev_priv(dev);
David Ahern9ab179d2016-04-07 11:10:06 -0700290 struct net *net = dev_net(dev);
David Ahernb3b46632016-05-04 21:46:12 -0700291 struct fib6_table *rt6i_table;
David Ahern35402e32015-10-12 11:47:09 -0700292 struct rt6_info *rt6;
David Ahern35402e32015-10-12 11:47:09 -0700293 int rc = -ENOMEM;
294
David Ahernb3b46632016-05-04 21:46:12 -0700295 rt6i_table = fib6_new_table(net, vrf->tb_id);
296 if (!rt6i_table)
297 goto out;
298
David Ahern9ab179d2016-04-07 11:10:06 -0700299 rt6 = ip6_dst_alloc(net, dev,
300 DST_HOST | DST_NOPOLICY | DST_NOXFRM | DST_NOCACHE);
David Ahern35402e32015-10-12 11:47:09 -0700301 if (!rt6)
302 goto out;
303
David Ahern9ab179d2016-04-07 11:10:06 -0700304 dst_hold(&rt6->dst);
David Ahernb3b46632016-05-04 21:46:12 -0700305
306 rt6->rt6i_table = rt6i_table;
Chris Packham52fe7052016-06-21 15:39:43 +1200307 rt6->dst.output = vrf_output6;
David Ahernb0e95cc2016-05-13 12:23:45 -0700308 rcu_assign_pointer(vrf->rt6, rt6);
309
David Ahern35402e32015-10-12 11:47:09 -0700310 rc = 0;
311out:
312 return rc;
313}
314#else
David Ahern9ab179d2016-04-07 11:10:06 -0700315static void vrf_rt6_release(struct net_vrf *vrf)
David Ahern35402e32015-10-12 11:47:09 -0700316{
317}
318
319static int vrf_rt6_create(struct net_device *dev)
320{
321 return 0;
322}
323#endif
324
David Ahern8f583362015-08-27 10:10:50 -0700325/* modelled after ip_finish_output2 */
Eric W. Biederman0c4b51f2015-09-15 20:04:18 -0500326static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
David Ahern193125d2015-08-13 14:59:10 -0600327{
David Ahern8f583362015-08-27 10:10:50 -0700328 struct dst_entry *dst = skb_dst(skb);
329 struct rtable *rt = (struct rtable *)dst;
330 struct net_device *dev = dst->dev;
331 unsigned int hh_len = LL_RESERVED_SPACE(dev);
332 struct neighbour *neigh;
333 u32 nexthop;
334 int ret = -EINVAL;
335
336 /* Be paranoid, rather than too clever. */
337 if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
338 struct sk_buff *skb2;
339
340 skb2 = skb_realloc_headroom(skb, LL_RESERVED_SPACE(dev));
341 if (!skb2) {
342 ret = -ENOMEM;
343 goto err;
344 }
345 if (skb->sk)
346 skb_set_owner_w(skb2, skb->sk);
347
348 consume_skb(skb);
349 skb = skb2;
350 }
351
352 rcu_read_lock_bh();
353
354 nexthop = (__force u32)rt_nexthop(rt, ip_hdr(skb)->daddr);
355 neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
356 if (unlikely(!neigh))
357 neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
358 if (!IS_ERR(neigh))
359 ret = dst_neigh_output(dst, neigh, skb);
360
361 rcu_read_unlock_bh();
362err:
363 if (unlikely(ret < 0))
364 vrf_tx_error(skb->dev, skb);
365 return ret;
David Ahern193125d2015-08-13 14:59:10 -0600366}
367
Eric W. Biedermanede20592015-10-07 16:48:47 -0500368static int vrf_output(struct net *net, struct sock *sk, struct sk_buff *skb)
David Ahern193125d2015-08-13 14:59:10 -0600369{
370 struct net_device *dev = skb_dst(skb)->dev;
371
Eric W. Biederman29a26a52015-09-15 20:04:16 -0500372 IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len);
David Ahern193125d2015-08-13 14:59:10 -0600373
374 skb->dev = dev;
375 skb->protocol = htons(ETH_P_IP);
376
Eric W. Biederman29a26a52015-09-15 20:04:16 -0500377 return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
378 net, sk, skb, NULL, dev,
David Ahern8f583362015-08-27 10:10:50 -0700379 vrf_finish_output,
David Ahern193125d2015-08-13 14:59:10 -0600380 !(IPCB(skb)->flags & IPSKB_REROUTED));
381}
382
David Ahernb0e95cc2016-05-13 12:23:45 -0700383/* holding rtnl */
David Ahern9ab179d2016-04-07 11:10:06 -0700384static void vrf_rtable_release(struct net_vrf *vrf)
David Ahern193125d2015-08-13 14:59:10 -0600385{
David Ahernb0e95cc2016-05-13 12:23:45 -0700386 struct rtable *rth = rtnl_dereference(vrf->rth);
David Ahern193125d2015-08-13 14:59:10 -0600387
David Ahernb0e95cc2016-05-13 12:23:45 -0700388 rcu_assign_pointer(vrf->rth, NULL);
389
390 if (rth)
391 dst_release(&rth->dst);
David Ahern193125d2015-08-13 14:59:10 -0600392}
393
David Ahernb0e95cc2016-05-13 12:23:45 -0700394static int vrf_rtable_create(struct net_device *dev)
David Ahern193125d2015-08-13 14:59:10 -0600395{
David Ahernb7503e02015-09-02 13:58:35 -0700396 struct net_vrf *vrf = netdev_priv(dev);
David Ahern193125d2015-08-13 14:59:10 -0600397 struct rtable *rth;
398
David Ahernb3b46632016-05-04 21:46:12 -0700399 if (!fib_new_table(dev_net(dev), vrf->tb_id))
David Ahernb0e95cc2016-05-13 12:23:45 -0700400 return -ENOMEM;
David Ahernb3b46632016-05-04 21:46:12 -0700401
David Ahern9ab179d2016-04-07 11:10:06 -0700402 rth = rt_dst_alloc(dev, 0, RTN_UNICAST, 1, 1, 0);
David Ahernb0e95cc2016-05-13 12:23:45 -0700403 if (!rth)
404 return -ENOMEM;
David Ahern193125d2015-08-13 14:59:10 -0600405
Chris Packham52fe7052016-06-21 15:39:43 +1200406 rth->dst.output = vrf_output;
David Ahernb0e95cc2016-05-13 12:23:45 -0700407 rth->rt_table_id = vrf->tb_id;
408
409 rcu_assign_pointer(vrf->rth, rth);
410
411 return 0;
David Ahern193125d2015-08-13 14:59:10 -0600412}
413
414/**************************** device handling ********************/
415
416/* cycle interface to flush neighbor cache and move routes across tables */
417static void cycle_netdev(struct net_device *dev)
418{
419 unsigned int flags = dev->flags;
420 int ret;
421
422 if (!netif_running(dev))
423 return;
424
425 ret = dev_change_flags(dev, flags & ~IFF_UP);
426 if (ret >= 0)
427 ret = dev_change_flags(dev, flags);
428
429 if (ret < 0) {
430 netdev_err(dev,
431 "Failed to cycle device %s; route tables might be wrong!\n",
432 dev->name);
433 }
434}
435
David Ahern193125d2015-08-13 14:59:10 -0600436static int do_vrf_add_slave(struct net_device *dev, struct net_device *port_dev)
437{
Nikolay Aleksandrovbad53162015-11-24 14:29:16 +0100438 int ret;
David Ahern193125d2015-08-13 14:59:10 -0600439
Jiri Pirko29bf24a2015-12-03 12:12:11 +0100440 ret = netdev_master_upper_dev_link(port_dev, dev, NULL, NULL);
David Ahern193125d2015-08-13 14:59:10 -0600441 if (ret < 0)
David Ahern74b20582016-05-10 11:19:50 -0700442 return ret;
David Ahern193125d2015-08-13 14:59:10 -0600443
David Ahernfee6d4c2015-10-05 08:51:24 -0700444 port_dev->priv_flags |= IFF_L3MDEV_SLAVE;
David Ahern193125d2015-08-13 14:59:10 -0600445 cycle_netdev(port_dev);
446
447 return 0;
David Ahern193125d2015-08-13 14:59:10 -0600448}
449
450static int vrf_add_slave(struct net_device *dev, struct net_device *port_dev)
451{
David Ahernfee6d4c2015-10-05 08:51:24 -0700452 if (netif_is_l3_master(port_dev) || netif_is_l3_slave(port_dev))
David Ahern193125d2015-08-13 14:59:10 -0600453 return -EINVAL;
454
455 return do_vrf_add_slave(dev, port_dev);
456}
457
458/* inverse of do_vrf_add_slave */
459static int do_vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
460{
David Ahern193125d2015-08-13 14:59:10 -0600461 netdev_upper_dev_unlink(port_dev, dev);
David Ahernfee6d4c2015-10-05 08:51:24 -0700462 port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;
David Ahern193125d2015-08-13 14:59:10 -0600463
David Ahern193125d2015-08-13 14:59:10 -0600464 cycle_netdev(port_dev);
465
David Ahern193125d2015-08-13 14:59:10 -0600466 return 0;
467}
468
469static int vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
470{
David Ahern193125d2015-08-13 14:59:10 -0600471 return do_vrf_del_slave(dev, port_dev);
472}
473
474static void vrf_dev_uninit(struct net_device *dev)
475{
476 struct net_vrf *vrf = netdev_priv(dev);
Nikolay Aleksandrovbad53162015-11-24 14:29:16 +0100477 struct net_device *port_dev;
478 struct list_head *iter;
David Ahern193125d2015-08-13 14:59:10 -0600479
David Ahern9ab179d2016-04-07 11:10:06 -0700480 vrf_rtable_release(vrf);
481 vrf_rt6_release(vrf);
David Ahern193125d2015-08-13 14:59:10 -0600482
Nikolay Aleksandrovbad53162015-11-24 14:29:16 +0100483 netdev_for_each_lower_dev(dev, port_dev, iter)
484 vrf_del_slave(dev, port_dev);
David Ahern193125d2015-08-13 14:59:10 -0600485
Nikolay Aleksandrov3a4a27d2015-08-18 20:28:03 +0300486 free_percpu(dev->dstats);
David Ahern193125d2015-08-13 14:59:10 -0600487 dev->dstats = NULL;
488}
489
490static int vrf_dev_init(struct net_device *dev)
491{
492 struct net_vrf *vrf = netdev_priv(dev);
493
David Ahern193125d2015-08-13 14:59:10 -0600494 dev->dstats = netdev_alloc_pcpu_stats(struct pcpu_dstats);
495 if (!dev->dstats)
496 goto out_nomem;
497
498 /* create the default dst which points back to us */
David Ahernb0e95cc2016-05-13 12:23:45 -0700499 if (vrf_rtable_create(dev) != 0)
David Ahern193125d2015-08-13 14:59:10 -0600500 goto out_stats;
501
David Ahern35402e32015-10-12 11:47:09 -0700502 if (vrf_rt6_create(dev) != 0)
503 goto out_rth;
504
David Ahern193125d2015-08-13 14:59:10 -0600505 dev->flags = IFF_MASTER | IFF_NOARP;
506
507 return 0;
508
David Ahern35402e32015-10-12 11:47:09 -0700509out_rth:
David Ahern9ab179d2016-04-07 11:10:06 -0700510 vrf_rtable_release(vrf);
David Ahern193125d2015-08-13 14:59:10 -0600511out_stats:
512 free_percpu(dev->dstats);
513 dev->dstats = NULL;
514out_nomem:
515 return -ENOMEM;
516}
517
518static const struct net_device_ops vrf_netdev_ops = {
519 .ndo_init = vrf_dev_init,
520 .ndo_uninit = vrf_dev_uninit,
521 .ndo_start_xmit = vrf_xmit,
522 .ndo_get_stats64 = vrf_get_stats64,
523 .ndo_add_slave = vrf_add_slave,
524 .ndo_del_slave = vrf_del_slave,
525};
526
David Ahernee15ee52015-09-29 20:07:12 -0700527static u32 vrf_fib_table(const struct net_device *dev)
528{
529 struct net_vrf *vrf = netdev_priv(dev);
530
531 return vrf->tb_id;
532}
533
534static struct rtable *vrf_get_rtable(const struct net_device *dev,
535 const struct flowi4 *fl4)
536{
537 struct rtable *rth = NULL;
538
David Ahern6e2895a2015-10-05 08:51:23 -0700539 if (!(fl4->flowi4_flags & FLOWI_FLAG_L3MDEV_SRC)) {
David Ahernee15ee52015-09-29 20:07:12 -0700540 struct net_vrf *vrf = netdev_priv(dev);
541
David Ahernb0e95cc2016-05-13 12:23:45 -0700542 rcu_read_lock();
543
544 rth = rcu_dereference(vrf->rth);
545 if (likely(rth))
546 dst_hold(&rth->dst);
547
548 rcu_read_unlock();
David Ahernee15ee52015-09-29 20:07:12 -0700549 }
550
551 return rth;
552}
553
David Ahern8cbb512c2015-10-05 08:51:26 -0700554/* called under rcu_read_lock */
David Ahernb5bdacf2016-01-04 09:09:27 -0800555static int vrf_get_saddr(struct net_device *dev, struct flowi4 *fl4)
David Ahern8cbb512c2015-10-05 08:51:26 -0700556{
557 struct fib_result res = { .tclassid = 0 };
558 struct net *net = dev_net(dev);
559 u32 orig_tos = fl4->flowi4_tos;
560 u8 flags = fl4->flowi4_flags;
561 u8 scope = fl4->flowi4_scope;
562 u8 tos = RT_FL_TOS(fl4);
David Ahernb5bdacf2016-01-04 09:09:27 -0800563 int rc;
David Ahern8cbb512c2015-10-05 08:51:26 -0700564
565 if (unlikely(!fl4->daddr))
David Ahernb5bdacf2016-01-04 09:09:27 -0800566 return 0;
David Ahern8cbb512c2015-10-05 08:51:26 -0700567
568 fl4->flowi4_flags |= FLOWI_FLAG_SKIP_NH_OIF;
569 fl4->flowi4_iif = LOOPBACK_IFINDEX;
David Ahern1ff23be2016-05-07 16:49:00 -0700570 /* make sure oif is set to VRF device for lookup */
571 fl4->flowi4_oif = dev->ifindex;
David Ahern8cbb512c2015-10-05 08:51:26 -0700572 fl4->flowi4_tos = tos & IPTOS_RT_MASK;
573 fl4->flowi4_scope = ((tos & RTO_ONLINK) ?
574 RT_SCOPE_LINK : RT_SCOPE_UNIVERSE);
575
David Ahernb5bdacf2016-01-04 09:09:27 -0800576 rc = fib_lookup(net, fl4, &res, 0);
577 if (!rc) {
David Ahern8cbb512c2015-10-05 08:51:26 -0700578 if (res.type == RTN_LOCAL)
579 fl4->saddr = res.fi->fib_prefsrc ? : fl4->daddr;
580 else
581 fib_select_path(net, &res, fl4, -1);
582 }
583
584 fl4->flowi4_flags = flags;
585 fl4->flowi4_tos = orig_tos;
586 fl4->flowi4_scope = scope;
David Ahernb5bdacf2016-01-04 09:09:27 -0800587
588 return rc;
David Ahern8cbb512c2015-10-05 08:51:26 -0700589}
590
David Ahern35402e32015-10-12 11:47:09 -0700591#if IS_ENABLED(CONFIG_IPV6)
David Ahern74b20582016-05-10 11:19:50 -0700592/* neighbor handling is done with actual device; do not want
593 * to flip skb->dev for those ndisc packets. This really fails
594 * for multiple next protocols (e.g., NEXTHDR_HOP). But it is
595 * a start.
596 */
597static bool ipv6_ndisc_frame(const struct sk_buff *skb)
598{
599 const struct ipv6hdr *iph = ipv6_hdr(skb);
600 bool rc = false;
601
602 if (iph->nexthdr == NEXTHDR_ICMP) {
603 const struct icmp6hdr *icmph;
604 struct icmp6hdr _icmph;
605
606 icmph = skb_header_pointer(skb, sizeof(*iph),
607 sizeof(_icmph), &_icmph);
608 if (!icmph)
609 goto out;
610
611 switch (icmph->icmp6_type) {
612 case NDISC_ROUTER_SOLICITATION:
613 case NDISC_ROUTER_ADVERTISEMENT:
614 case NDISC_NEIGHBOUR_SOLICITATION:
615 case NDISC_NEIGHBOUR_ADVERTISEMENT:
616 case NDISC_REDIRECT:
617 rc = true;
618 break;
619 }
620 }
621
622out:
623 return rc;
624}
625
626static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
627 struct sk_buff *skb)
628{
629 /* if packet is NDISC keep the ingress interface */
630 if (!ipv6_ndisc_frame(skb)) {
631 skb->dev = vrf_dev;
632 skb->skb_iif = vrf_dev->ifindex;
633
634 skb_push(skb, skb->mac_len);
635 dev_queue_xmit_nit(skb, vrf_dev);
636 skb_pull(skb, skb->mac_len);
637
638 IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
639 }
640
641 return skb;
642}
643
644#else
645static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
646 struct sk_buff *skb)
647{
648 return skb;
649}
650#endif
651
652static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev,
653 struct sk_buff *skb)
654{
655 skb->dev = vrf_dev;
656 skb->skb_iif = vrf_dev->ifindex;
657
658 skb_push(skb, skb->mac_len);
659 dev_queue_xmit_nit(skb, vrf_dev);
660 skb_pull(skb, skb->mac_len);
661
662 return skb;
663}
664
665/* called with rcu lock held */
666static struct sk_buff *vrf_l3_rcv(struct net_device *vrf_dev,
667 struct sk_buff *skb,
668 u16 proto)
669{
670 switch (proto) {
671 case AF_INET:
672 return vrf_ip_rcv(vrf_dev, skb);
673 case AF_INET6:
674 return vrf_ip6_rcv(vrf_dev, skb);
675 }
676
677 return skb;
678}
679
680#if IS_ENABLED(CONFIG_IPV6)
David Ahern35402e32015-10-12 11:47:09 -0700681static struct dst_entry *vrf_get_rt6_dst(const struct net_device *dev,
682 const struct flowi6 *fl6)
683{
David Ahernb0e95cc2016-05-13 12:23:45 -0700684 struct dst_entry *dst = NULL;
David Ahern35402e32015-10-12 11:47:09 -0700685
686 if (!(fl6->flowi6_flags & FLOWI_FLAG_L3MDEV_SRC)) {
687 struct net_vrf *vrf = netdev_priv(dev);
David Ahernb0e95cc2016-05-13 12:23:45 -0700688 struct rt6_info *rt;
David Ahern35402e32015-10-12 11:47:09 -0700689
David Ahernb0e95cc2016-05-13 12:23:45 -0700690 rcu_read_lock();
691
692 rt = rcu_dereference(vrf->rt6);
693 if (likely(rt)) {
694 dst = &rt->dst;
695 dst_hold(dst);
696 }
697
698 rcu_read_unlock();
David Ahern35402e32015-10-12 11:47:09 -0700699 }
700
David Ahernb0e95cc2016-05-13 12:23:45 -0700701 return dst;
David Ahern35402e32015-10-12 11:47:09 -0700702}
703#endif
704
David Ahernee15ee52015-09-29 20:07:12 -0700705static const struct l3mdev_ops vrf_l3mdev_ops = {
706 .l3mdev_fib_table = vrf_fib_table,
707 .l3mdev_get_rtable = vrf_get_rtable,
David Ahern8cbb512c2015-10-05 08:51:26 -0700708 .l3mdev_get_saddr = vrf_get_saddr,
David Ahern74b20582016-05-10 11:19:50 -0700709 .l3mdev_l3_rcv = vrf_l3_rcv,
David Ahern35402e32015-10-12 11:47:09 -0700710#if IS_ENABLED(CONFIG_IPV6)
711 .l3mdev_get_rt6_dst = vrf_get_rt6_dst,
712#endif
David Ahernee15ee52015-09-29 20:07:12 -0700713};
714
David Ahern193125d2015-08-13 14:59:10 -0600715static void vrf_get_drvinfo(struct net_device *dev,
716 struct ethtool_drvinfo *info)
717{
718 strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
719 strlcpy(info->version, DRV_VERSION, sizeof(info->version));
720}
721
722static const struct ethtool_ops vrf_ethtool_ops = {
723 .get_drvinfo = vrf_get_drvinfo,
724};
725
726static void vrf_setup(struct net_device *dev)
727{
728 ether_setup(dev);
729
730 /* Initialize the device structure. */
731 dev->netdev_ops = &vrf_netdev_ops;
David Ahernee15ee52015-09-29 20:07:12 -0700732 dev->l3mdev_ops = &vrf_l3mdev_ops;
David Ahern193125d2015-08-13 14:59:10 -0600733 dev->ethtool_ops = &vrf_ethtool_ops;
734 dev->destructor = free_netdev;
735
736 /* Fill in device structure with ethernet-generic values. */
737 eth_hw_addr_random(dev);
738
739 /* don't acquire vrf device's netif_tx_lock when transmitting */
740 dev->features |= NETIF_F_LLTX;
741
742 /* don't allow vrf devices to change network namespaces. */
743 dev->features |= NETIF_F_NETNS_LOCAL;
744}
745
746static int vrf_validate(struct nlattr *tb[], struct nlattr *data[])
747{
748 if (tb[IFLA_ADDRESS]) {
749 if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN)
750 return -EINVAL;
751 if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS])))
752 return -EADDRNOTAVAIL;
753 }
754 return 0;
755}
756
757static void vrf_dellink(struct net_device *dev, struct list_head *head)
758{
David Ahern193125d2015-08-13 14:59:10 -0600759 unregister_netdevice_queue(dev, head);
760}
761
762static int vrf_newlink(struct net *src_net, struct net_device *dev,
763 struct nlattr *tb[], struct nlattr *data[])
764{
765 struct net_vrf *vrf = netdev_priv(dev);
David Ahern193125d2015-08-13 14:59:10 -0600766
767 if (!data || !data[IFLA_VRF_TABLE])
768 return -EINVAL;
769
770 vrf->tb_id = nla_get_u32(data[IFLA_VRF_TABLE]);
771
David Ahern007979e2015-09-29 20:07:10 -0700772 dev->priv_flags |= IFF_L3MDEV_MASTER;
David Ahern193125d2015-08-13 14:59:10 -0600773
Nikolay Aleksandrov7f109f72015-11-21 19:46:19 +0100774 return register_netdevice(dev);
David Ahern193125d2015-08-13 14:59:10 -0600775}
776
777static size_t vrf_nl_getsize(const struct net_device *dev)
778{
779 return nla_total_size(sizeof(u32)); /* IFLA_VRF_TABLE */
780}
781
782static int vrf_fillinfo(struct sk_buff *skb,
783 const struct net_device *dev)
784{
785 struct net_vrf *vrf = netdev_priv(dev);
786
787 return nla_put_u32(skb, IFLA_VRF_TABLE, vrf->tb_id);
788}
789
David Ahern67eb0332016-02-02 07:43:45 -0800790static size_t vrf_get_slave_size(const struct net_device *bond_dev,
791 const struct net_device *slave_dev)
792{
793 return nla_total_size(sizeof(u32)); /* IFLA_VRF_PORT_TABLE */
794}
795
796static int vrf_fill_slave_info(struct sk_buff *skb,
797 const struct net_device *vrf_dev,
798 const struct net_device *slave_dev)
799{
800 struct net_vrf *vrf = netdev_priv(vrf_dev);
801
802 if (nla_put_u32(skb, IFLA_VRF_PORT_TABLE, vrf->tb_id))
803 return -EMSGSIZE;
804
805 return 0;
806}
807
David Ahern193125d2015-08-13 14:59:10 -0600808static const struct nla_policy vrf_nl_policy[IFLA_VRF_MAX + 1] = {
809 [IFLA_VRF_TABLE] = { .type = NLA_U32 },
810};
811
812static struct rtnl_link_ops vrf_link_ops __read_mostly = {
813 .kind = DRV_NAME,
814 .priv_size = sizeof(struct net_vrf),
815
816 .get_size = vrf_nl_getsize,
817 .policy = vrf_nl_policy,
818 .validate = vrf_validate,
819 .fill_info = vrf_fillinfo,
820
David Ahern67eb0332016-02-02 07:43:45 -0800821 .get_slave_size = vrf_get_slave_size,
822 .fill_slave_info = vrf_fill_slave_info,
823
David Ahern193125d2015-08-13 14:59:10 -0600824 .newlink = vrf_newlink,
825 .dellink = vrf_dellink,
826 .setup = vrf_setup,
827 .maxtype = IFLA_VRF_MAX,
828};
829
830static int vrf_device_event(struct notifier_block *unused,
831 unsigned long event, void *ptr)
832{
833 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
834
835 /* only care about unregister events to drop slave references */
836 if (event == NETDEV_UNREGISTER) {
David Ahern193125d2015-08-13 14:59:10 -0600837 struct net_device *vrf_dev;
838
David Ahernfee6d4c2015-10-05 08:51:24 -0700839 if (!netif_is_l3_slave(dev))
David Ahern193125d2015-08-13 14:59:10 -0600840 goto out;
841
Nikolay Aleksandrov58aa9082015-08-18 20:28:04 +0300842 vrf_dev = netdev_master_upper_dev_get(dev);
843 vrf_del_slave(vrf_dev, dev);
David Ahern193125d2015-08-13 14:59:10 -0600844 }
845out:
846 return NOTIFY_DONE;
847}
848
849static struct notifier_block vrf_notifier_block __read_mostly = {
850 .notifier_call = vrf_device_event,
851};
852
853static int __init vrf_init_module(void)
854{
855 int rc;
856
David Ahern193125d2015-08-13 14:59:10 -0600857 register_netdevice_notifier(&vrf_notifier_block);
858
859 rc = rtnl_link_register(&vrf_link_ops);
860 if (rc < 0)
861 goto error;
862
863 return 0;
864
865error:
866 unregister_netdevice_notifier(&vrf_notifier_block);
David Ahern193125d2015-08-13 14:59:10 -0600867 return rc;
868}
869
David Ahern193125d2015-08-13 14:59:10 -0600870module_init(vrf_init_module);
David Ahern193125d2015-08-13 14:59:10 -0600871MODULE_AUTHOR("Shrijeet Mukherjee, David Ahern");
872MODULE_DESCRIPTION("Device driver to instantiate VRF domains");
873MODULE_LICENSE("GPL");
874MODULE_ALIAS_RTNL_LINK(DRV_NAME);
875MODULE_VERSION(DRV_VERSION);