2015-08-14 04:59:10 +08:00
|
|
|
/*
|
|
|
|
|
* vrf.c: device driver to encapsulate a VRF space
|
|
|
|
|
*
|
|
|
|
|
* Copyright (c) 2015 Cumulus Networks. All rights reserved.
|
|
|
|
|
* Copyright (c) 2015 Shrijeet Mukherjee <shm@cumulusnetworks.com>
|
|
|
|
|
* Copyright (c) 2015 David Ahern <dsa@cumulusnetworks.com>
|
|
|
|
|
*
|
|
|
|
|
* Based on dummy, team and ipvlan drivers
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
|
|
|
* (at your option) any later version.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
|
#include <linux/netdevice.h>
|
|
|
|
|
#include <linux/etherdevice.h>
|
|
|
|
|
#include <linux/ip.h>
|
|
|
|
|
#include <linux/init.h>
|
|
|
|
|
#include <linux/moduleparam.h>
|
|
|
|
|
#include <linux/netfilter.h>
|
|
|
|
|
#include <linux/rtnetlink.h>
|
|
|
|
|
#include <net/rtnetlink.h>
|
|
|
|
|
#include <linux/u64_stats_sync.h>
|
|
|
|
|
#include <linux/hashtable.h>
|
|
|
|
|
|
|
|
|
|
#include <linux/inetdevice.h>
|
net: Add ethernet header for pass through VRF device
The change to use a custom dst broke tcpdump captures on the VRF device:
$ tcpdump -n -i vrf10
...
05:32:29.009362 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 21989, seq 1, length 64
05:32:29.009855 00:00:40:01:8d:36 > 45:00:00:54:d6:6f, ethertype Unknown (0x0a02), length 84:
0x0000: 0102 0a02 01fe 0000 9181 55e5 0001 bd11 ..........U.....
0x0010: da55 0000 0000 bb5d 0700 0000 0000 1011 .U.....]........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
Local packets going through the VRF device are missing an ethernet header.
Fix by adding one and then stripping it off before pushing back to the IP
stack. With this patch you get the expected dumps:
...
05:36:15.713944 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 23795, seq 1, length 64
05:36:15.714160 IP 10.2.1.2 > 10.2.1.254: ICMP echo reply, id 23795, seq 1, length 64
...
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-28 01:10:50 +08:00
|
|
|
#include <net/arp.h>
|
2015-08-14 04:59:10 +08:00
|
|
|
#include <net/ip.h>
|
|
|
|
|
#include <net/ip_fib.h>
|
2015-10-13 02:47:09 +08:00
|
|
|
#include <net/ip6_fib.h>
|
2015-08-14 04:59:10 +08:00
|
|
|
#include <net/ip6_route.h>
|
|
|
|
|
#include <net/route.h>
|
|
|
|
|
#include <net/addrconf.h>
|
2015-09-30 11:07:12 +08:00
|
|
|
#include <net/l3mdev.h>
|
2016-06-09 01:55:40 +08:00
|
|
|
#include <net/fib_rules.h>
|
2017-06-09 01:31:11 +08:00
|
|
|
#include <net/netns/generic.h>
|
2015-08-14 04:59:10 +08:00
|
|
|
|
|
|
|
|
#define DRV_NAME "vrf"
|
|
|
|
|
#define DRV_VERSION "1.0"
|
|
|
|
|
|
2016-06-09 01:55:40 +08:00
|
|
|
#define FIB_RULE_PREF 1000 /* default preference for FIB rules */
|
2017-06-09 01:31:11 +08:00
|
|
|
|
|
|
|
|
static unsigned int vrf_net_id;
|
2016-06-09 01:55:40 +08:00
|
|
|
|
2015-09-30 11:07:17 +08:00
|
|
|
struct net_vrf {
|
2016-05-14 03:23:45 +08:00
|
|
|
struct rtable __rcu *rth;
|
|
|
|
|
struct rt6_info __rcu *rt6;
|
2015-09-30 11:07:17 +08:00
|
|
|
u32 tb_id;
|
|
|
|
|
};
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
struct pcpu_dstats {
|
|
|
|
|
u64 tx_pkts;
|
|
|
|
|
u64 tx_bytes;
|
|
|
|
|
u64 tx_drps;
|
|
|
|
|
u64 rx_pkts;
|
|
|
|
|
u64 rx_bytes;
|
2016-06-07 11:50:39 +08:00
|
|
|
u64 rx_drps;
|
2015-08-14 04:59:10 +08:00
|
|
|
struct u64_stats_sync syncp;
|
|
|
|
|
};
|
|
|
|
|
|
2016-06-07 11:50:39 +08:00
|
|
|
static void vrf_rx_stats(struct net_device *dev, int len)
|
|
|
|
|
{
|
|
|
|
|
struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
|
|
|
|
|
|
|
|
|
|
u64_stats_update_begin(&dstats->syncp);
|
|
|
|
|
dstats->rx_pkts++;
|
|
|
|
|
dstats->rx_bytes += len;
|
|
|
|
|
u64_stats_update_end(&dstats->syncp);
|
|
|
|
|
}
|
|
|
|
|
|
2015-08-19 11:12:29 +08:00
|
|
|
static void vrf_tx_error(struct net_device *vrf_dev, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
vrf_dev->stats.tx_errors++;
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
}
|
|
|
|
|
|
2017-01-07 11:12:52 +08:00
|
|
|
static void vrf_get_stats64(struct net_device *dev,
|
|
|
|
|
struct rtnl_link_stats64 *stats)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
|
|
for_each_possible_cpu(i) {
|
|
|
|
|
const struct pcpu_dstats *dstats;
|
|
|
|
|
u64 tbytes, tpkts, tdrops, rbytes, rpkts;
|
|
|
|
|
unsigned int start;
|
|
|
|
|
|
|
|
|
|
dstats = per_cpu_ptr(dev->dstats, i);
|
|
|
|
|
do {
|
|
|
|
|
start = u64_stats_fetch_begin_irq(&dstats->syncp);
|
|
|
|
|
tbytes = dstats->tx_bytes;
|
|
|
|
|
tpkts = dstats->tx_pkts;
|
|
|
|
|
tdrops = dstats->tx_drps;
|
|
|
|
|
rbytes = dstats->rx_bytes;
|
|
|
|
|
rpkts = dstats->rx_pkts;
|
|
|
|
|
} while (u64_stats_fetch_retry_irq(&dstats->syncp, start));
|
|
|
|
|
stats->tx_bytes += tbytes;
|
|
|
|
|
stats->tx_packets += tpkts;
|
|
|
|
|
stats->tx_dropped += tdrops;
|
|
|
|
|
stats->rx_bytes += rbytes;
|
|
|
|
|
stats->rx_packets += rpkts;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2017-03-21 02:19:44 +08:00
|
|
|
/* by default VRF devices do not have a qdisc and are expected
|
|
|
|
|
* to be created with only a single queue.
|
|
|
|
|
*/
|
|
|
|
|
static bool qdisc_tx_is_default(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct netdev_queue *txq;
|
|
|
|
|
struct Qdisc *qdisc;
|
|
|
|
|
|
|
|
|
|
if (dev->num_tx_queues > 1)
|
|
|
|
|
return false;
|
|
|
|
|
|
|
|
|
|
txq = netdev_get_tx_queue(dev, 0);
|
|
|
|
|
qdisc = rcu_access_pointer(txq->qdisc);
|
|
|
|
|
|
|
|
|
|
return !qdisc->enqueue;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-07 11:50:39 +08:00
|
|
|
/* Local traffic destined to local address. Reinsert the packet to rx
|
|
|
|
|
* path, similar to loopback handling.
|
|
|
|
|
*/
|
|
|
|
|
static int vrf_local_xmit(struct sk_buff *skb, struct net_device *dev,
|
|
|
|
|
struct dst_entry *dst)
|
|
|
|
|
{
|
|
|
|
|
int len = skb->len;
|
|
|
|
|
|
|
|
|
|
skb_orphan(skb);
|
|
|
|
|
|
|
|
|
|
skb_dst_set(skb, dst);
|
|
|
|
|
|
|
|
|
|
/* set pkt_type to avoid skb hitting packet taps twice -
|
|
|
|
|
* once on Tx and again in Rx processing
|
|
|
|
|
*/
|
|
|
|
|
skb->pkt_type = PACKET_LOOPBACK;
|
|
|
|
|
|
|
|
|
|
skb->protocol = eth_type_trans(skb, dev);
|
|
|
|
|
|
|
|
|
|
if (likely(netif_rx(skb) == NET_RX_SUCCESS))
|
|
|
|
|
vrf_rx_stats(dev, len);
|
|
|
|
|
else
|
|
|
|
|
this_cpu_inc(dev->dstats->rx_drps);
|
|
|
|
|
|
|
|
|
|
return NETDEV_TX_OK;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2016-09-11 03:09:56 +08:00
|
|
|
static int vrf_ip6_local_out(struct net *net, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net,
|
|
|
|
|
sk, skb, NULL, skb_dst(skb)->dev, dst_output);
|
|
|
|
|
|
|
|
|
|
if (likely(err == 1))
|
|
|
|
|
err = dst_output(net, sk, skb);
|
|
|
|
|
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
|
|
|
|
|
struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
|
|
|
|
struct net *net = dev_net(skb->dev);
|
|
|
|
|
struct flowi6 fl6 = {
|
|
|
|
|
/* needed to match OIF rule */
|
|
|
|
|
.flowi6_oif = dev->ifindex,
|
|
|
|
|
.flowi6_iif = LOOPBACK_IFINDEX,
|
|
|
|
|
.daddr = iph->daddr,
|
|
|
|
|
.saddr = iph->saddr,
|
|
|
|
|
.flowlabel = ip6_flowinfo(iph),
|
|
|
|
|
.flowi6_mark = skb->mark,
|
|
|
|
|
.flowi6_proto = iph->nexthdr,
|
2016-09-11 03:10:02 +08:00
|
|
|
.flowi6_flags = FLOWI_FLAG_SKIP_NH_OIF,
|
2015-10-13 02:47:09 +08:00
|
|
|
};
|
|
|
|
|
int ret = NET_XMIT_DROP;
|
|
|
|
|
struct dst_entry *dst;
|
|
|
|
|
struct dst_entry *dst_null = &net->ipv6.ip6_null_entry->dst;
|
|
|
|
|
|
|
|
|
|
dst = ip6_route_output(net, NULL, &fl6);
|
|
|
|
|
if (dst == dst_null)
|
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
|
|
skb_dst_drop(skb);
|
2016-06-07 11:50:40 +08:00
|
|
|
|
|
|
|
|
/* if dst.dev is loopback or the VRF device again this is locally
|
|
|
|
|
* originated traffic destined to a local address. Short circuit
|
2017-08-12 08:11:14 +08:00
|
|
|
* to Rx path
|
2016-06-07 11:50:40 +08:00
|
|
|
*/
|
2017-08-12 08:11:14 +08:00
|
|
|
if (dst->dev == dev)
|
|
|
|
|
return vrf_local_xmit(skb, dev, dst);
|
2016-06-07 11:50:40 +08:00
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
skb_dst_set(skb, dst);
|
|
|
|
|
|
2016-06-07 11:50:38 +08:00
|
|
|
/* strip the ethernet header added for pass through VRF device */
|
|
|
|
|
__skb_pull(skb, skb_network_offset(skb));
|
|
|
|
|
|
2016-09-11 03:09:56 +08:00
|
|
|
ret = vrf_ip6_local_out(net, skb->sk, skb);
|
2015-10-13 02:47:09 +08:00
|
|
|
if (unlikely(net_xmit_eval(ret)))
|
|
|
|
|
dev->stats.tx_errors++;
|
|
|
|
|
else
|
|
|
|
|
ret = NET_XMIT_SUCCESS;
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
err:
|
|
|
|
|
vrf_tx_error(dev, skb);
|
|
|
|
|
return NET_XMIT_DROP;
|
|
|
|
|
}
|
|
|
|
|
#else
|
2015-08-14 04:59:10 +08:00
|
|
|
static netdev_tx_t vrf_process_v6_outbound(struct sk_buff *skb,
|
|
|
|
|
struct net_device *dev)
|
|
|
|
|
{
|
2015-08-19 11:12:29 +08:00
|
|
|
vrf_tx_error(dev, skb);
|
|
|
|
|
return NET_XMIT_DROP;
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
2015-10-13 02:47:09 +08:00
|
|
|
#endif
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2016-09-11 03:09:55 +08:00
|
|
|
/* based on ip_local_out; can't use it b/c the dst is switched pointing to us */
|
|
|
|
|
static int vrf_ip_local_out(struct net *net, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk,
|
|
|
|
|
skb, NULL, skb_dst(skb)->dev, dst_output);
|
|
|
|
|
if (likely(err == 1))
|
|
|
|
|
err = dst_output(net, sk, skb);
|
|
|
|
|
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
|
|
|
|
|
struct net_device *vrf_dev)
|
|
|
|
|
{
|
|
|
|
|
struct iphdr *ip4h = ip_hdr(skb);
|
|
|
|
|
int ret = NET_XMIT_DROP;
|
|
|
|
|
struct flowi4 fl4 = {
|
|
|
|
|
/* needed to match OIF rule */
|
|
|
|
|
.flowi4_oif = vrf_dev->ifindex,
|
|
|
|
|
.flowi4_iif = LOOPBACK_IFINDEX,
|
|
|
|
|
.flowi4_tos = RT_TOS(ip4h->tos),
|
2016-09-11 03:10:02 +08:00
|
|
|
.flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_SKIP_NH_OIF,
|
2017-01-11 06:37:35 +08:00
|
|
|
.flowi4_proto = ip4h->protocol,
|
2015-08-14 04:59:10 +08:00
|
|
|
.daddr = ip4h->daddr,
|
2017-01-11 06:37:35 +08:00
|
|
|
.saddr = ip4h->saddr,
|
2015-08-14 04:59:10 +08:00
|
|
|
};
|
2016-06-07 11:50:38 +08:00
|
|
|
struct net *net = dev_net(vrf_dev);
|
|
|
|
|
struct rtable *rt;
|
|
|
|
|
|
|
|
|
|
rt = ip_route_output_flow(net, &fl4, NULL);
|
|
|
|
|
if (IS_ERR(rt))
|
|
|
|
|
goto err;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2016-06-07 11:50:38 +08:00
|
|
|
skb_dst_drop(skb);
|
2016-06-07 11:50:39 +08:00
|
|
|
|
|
|
|
|
/* if dst.dev is loopback or the VRF device again this is locally
|
|
|
|
|
* originated traffic destined to a local address. Short circuit
|
2017-08-12 08:11:14 +08:00
|
|
|
* to Rx path
|
2016-06-07 11:50:39 +08:00
|
|
|
*/
|
2017-08-12 08:11:14 +08:00
|
|
|
if (rt->dst.dev == vrf_dev)
|
|
|
|
|
return vrf_local_xmit(skb, vrf_dev, &rt->dst);
|
2016-06-07 11:50:39 +08:00
|
|
|
|
2016-06-07 11:50:38 +08:00
|
|
|
skb_dst_set(skb, &rt->dst);
|
|
|
|
|
|
|
|
|
|
/* strip the ethernet header added for pass through VRF device */
|
|
|
|
|
__skb_pull(skb, skb_network_offset(skb));
|
2015-08-14 04:59:10 +08:00
|
|
|
|
|
|
|
|
if (!ip4h->saddr) {
|
|
|
|
|
ip4h->saddr = inet_select_addr(skb_dst(skb)->dev, 0,
|
|
|
|
|
RT_SCOPE_LINK);
|
|
|
|
|
}
|
|
|
|
|
|
2016-09-11 03:09:55 +08:00
|
|
|
ret = vrf_ip_local_out(dev_net(skb_dst(skb)->dev), skb->sk, skb);
|
2015-08-14 04:59:10 +08:00
|
|
|
if (unlikely(net_xmit_eval(ret)))
|
|
|
|
|
vrf_dev->stats.tx_errors++;
|
|
|
|
|
else
|
|
|
|
|
ret = NET_XMIT_SUCCESS;
|
|
|
|
|
|
|
|
|
|
out:
|
|
|
|
|
return ret;
|
|
|
|
|
err:
|
2015-08-19 11:12:29 +08:00
|
|
|
vrf_tx_error(vrf_dev, skb);
|
2015-08-14 04:59:10 +08:00
|
|
|
goto out;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
switch (skb->protocol) {
|
|
|
|
|
case htons(ETH_P_IP):
|
|
|
|
|
return vrf_process_v4_outbound(skb, dev);
|
|
|
|
|
case htons(ETH_P_IPV6):
|
|
|
|
|
return vrf_process_v6_outbound(skb, dev);
|
|
|
|
|
default:
|
2015-08-19 11:12:29 +08:00
|
|
|
vrf_tx_error(dev, skb);
|
2015-08-14 04:59:10 +08:00
|
|
|
return NET_XMIT_DROP;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev)
|
|
|
|
|
{
|
2017-03-07 00:53:04 +08:00
|
|
|
int len = skb->len;
|
2015-08-14 04:59:10 +08:00
|
|
|
netdev_tx_t ret = is_ip_tx_frame(skb, dev);
|
|
|
|
|
|
|
|
|
|
if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
|
|
|
|
|
struct pcpu_dstats *dstats = this_cpu_ptr(dev->dstats);
|
|
|
|
|
|
|
|
|
|
u64_stats_update_begin(&dstats->syncp);
|
|
|
|
|
dstats->tx_pkts++;
|
2017-03-07 00:53:04 +08:00
|
|
|
dstats->tx_bytes += len;
|
2015-08-14 04:59:10 +08:00
|
|
|
u64_stats_update_end(&dstats->syncp);
|
|
|
|
|
} else {
|
|
|
|
|
this_cpu_inc(dev->dstats->tx_drps);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
2017-03-21 02:19:44 +08:00
|
|
|
static int vrf_finish_direct(struct net *net, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct net_device *vrf_dev = skb->dev;
|
|
|
|
|
|
|
|
|
|
if (!list_empty(&vrf_dev->ptype_all) &&
|
|
|
|
|
likely(skb_headroom(skb) >= ETH_HLEN)) {
|
networking: make skb_push & __skb_push return void pointers
It seems like a historic accident that these return unsigned char *,
and in many places that means casts are required, more often than not.
Make these functions return void * and remove all the casts across
the tree, adding a (u8 *) cast only where the unsigned char pointer
was used directly, all done with the following spatch:
@@
expression SKB, LEN;
typedef u8;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
@@
- *(fn(SKB, LEN))
+ *(u8 *)fn(SKB, LEN)
@@
expression E, SKB, LEN;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
type T;
@@
- E = ((T *)(fn(SKB, LEN)))
+ E = fn(SKB, LEN)
@@
expression SKB, LEN;
identifier fn = { skb_push, __skb_push, skb_push_rcsum };
@@
- fn(SKB, LEN)[0]
+ *(u8 *)fn(SKB, LEN)
Note that the last part there converts from push(...)[0] to the
more idiomatic *(u8 *)push(...).
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-06-16 20:29:23 +08:00
|
|
|
struct ethhdr *eth = skb_push(skb, ETH_HLEN);
|
2017-03-21 02:19:44 +08:00
|
|
|
|
|
|
|
|
ether_addr_copy(eth->h_source, vrf_dev->dev_addr);
|
|
|
|
|
eth_zero_addr(eth->h_dest);
|
|
|
|
|
eth->h_proto = skb->protocol;
|
|
|
|
|
|
|
|
|
|
rcu_read_lock_bh();
|
|
|
|
|
dev_queue_xmit_nit(skb, vrf_dev);
|
|
|
|
|
rcu_read_unlock_bh();
|
|
|
|
|
|
|
|
|
|
skb_pull(skb, ETH_HLEN);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
|
|
|
/* modelled after ip6_finish_output2 */
|
|
|
|
|
static int vrf_finish_output6(struct net *net, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct dst_entry *dst = skb_dst(skb);
|
|
|
|
|
struct net_device *dev = dst->dev;
|
|
|
|
|
struct neighbour *neigh;
|
|
|
|
|
struct in6_addr *nexthop;
|
|
|
|
|
int ret;
|
|
|
|
|
|
2016-12-15 06:31:11 +08:00
|
|
|
nf_reset(skb);
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
skb->protocol = htons(ETH_P_IPV6);
|
|
|
|
|
skb->dev = dev;
|
|
|
|
|
|
|
|
|
|
rcu_read_lock_bh();
|
|
|
|
|
nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
|
|
|
|
|
neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
|
|
|
|
|
if (unlikely(!neigh))
|
|
|
|
|
neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
|
|
|
|
|
if (!IS_ERR(neigh)) {
|
2017-02-07 05:14:12 +08:00
|
|
|
sock_confirm_neigh(skb, neigh);
|
2017-02-11 19:49:20 +08:00
|
|
|
ret = neigh_output(neigh, skb);
|
2015-10-13 02:47:09 +08:00
|
|
|
rcu_read_unlock_bh();
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
rcu_read_unlock_bh();
|
|
|
|
|
|
|
|
|
|
IP6_INC_STATS(dev_net(dst->dev),
|
|
|
|
|
ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* modelled after ip6_output */
|
|
|
|
|
static int vrf_output6(struct net *net, struct sock *sk, struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
|
|
|
|
|
net, sk, skb, NULL, skb_dst(skb)->dev,
|
|
|
|
|
vrf_finish_output6,
|
|
|
|
|
!(IP6CB(skb)->flags & IP6SKB_REROUTED));
|
|
|
|
|
}
|
|
|
|
|
|
2016-09-11 03:09:56 +08:00
|
|
|
/* set dst on skb to send packet to us via dev_xmit path. Allows
|
|
|
|
|
* packet to go through device based features such as qdisc, netfilter
|
|
|
|
|
* hooks and packet sockets with skb->dev set to vrf device.
|
|
|
|
|
*/
|
2017-03-21 02:19:45 +08:00
|
|
|
static struct sk_buff *vrf_ip6_out_redirect(struct net_device *vrf_dev,
|
|
|
|
|
struct sk_buff *skb)
|
2016-09-11 03:09:56 +08:00
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(vrf_dev);
|
|
|
|
|
struct dst_entry *dst = NULL;
|
|
|
|
|
struct rt6_info *rt6;
|
|
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
|
|
|
|
|
rt6 = rcu_dereference(vrf->rt6);
|
|
|
|
|
if (likely(rt6)) {
|
|
|
|
|
dst = &rt6->dst;
|
|
|
|
|
dst_hold(dst);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
|
|
|
|
|
if (unlikely(!dst)) {
|
|
|
|
|
vrf_tx_error(vrf_dev, skb);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
skb_dst_drop(skb);
|
|
|
|
|
skb_dst_set(skb, dst);
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2017-03-21 02:19:45 +08:00
|
|
|
static int vrf_output6_direct(struct net *net, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
skb->protocol = htons(ETH_P_IPV6);
|
|
|
|
|
|
|
|
|
|
return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING,
|
|
|
|
|
net, sk, skb, NULL, skb->dev,
|
|
|
|
|
vrf_finish_direct,
|
|
|
|
|
!(IPCB(skb)->flags & IPSKB_REROUTED));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev,
|
|
|
|
|
struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct net *net = dev_net(vrf_dev);
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
skb->dev = vrf_dev;
|
|
|
|
|
|
|
|
|
|
err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk,
|
|
|
|
|
skb, NULL, vrf_dev, vrf_output6_direct);
|
|
|
|
|
|
|
|
|
|
if (likely(err == 1))
|
|
|
|
|
err = vrf_output6_direct(net, sk, skb);
|
|
|
|
|
|
|
|
|
|
/* reset skb device */
|
|
|
|
|
if (likely(err == 1))
|
|
|
|
|
nf_reset(skb);
|
|
|
|
|
else
|
|
|
|
|
skb = NULL;
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev,
|
|
|
|
|
struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
/* don't divert link scope packets */
|
|
|
|
|
if (rt6_need_strict(&ipv6_hdr(skb)->daddr))
|
|
|
|
|
return skb;
|
|
|
|
|
|
|
|
|
|
if (qdisc_tx_is_default(vrf_dev))
|
|
|
|
|
return vrf_ip6_out_direct(vrf_dev, sk, skb);
|
|
|
|
|
|
|
|
|
|
return vrf_ip6_out_redirect(vrf_dev, skb);
|
|
|
|
|
}
|
|
|
|
|
|
2016-05-14 03:23:45 +08:00
|
|
|
/* holding rtnl */
|
2016-06-15 02:37:21 +08:00
|
|
|
static void vrf_rt6_release(struct net_device *dev, struct net_vrf *vrf)
|
2015-10-13 02:47:09 +08:00
|
|
|
{
|
2016-05-14 03:23:45 +08:00
|
|
|
struct rt6_info *rt6 = rtnl_dereference(vrf->rt6);
|
2016-06-15 02:37:21 +08:00
|
|
|
struct net *net = dev_net(dev);
|
|
|
|
|
struct dst_entry *dst;
|
2016-05-14 03:23:45 +08:00
|
|
|
|
2016-06-07 11:50:40 +08:00
|
|
|
RCU_INIT_POINTER(vrf->rt6, NULL);
|
|
|
|
|
synchronize_rcu();
|
2016-05-14 03:23:45 +08:00
|
|
|
|
2016-06-15 02:37:21 +08:00
|
|
|
/* move dev in dst's to loopback so this VRF device can be deleted
|
|
|
|
|
* - based on dst_ifdown
|
|
|
|
|
*/
|
|
|
|
|
if (rt6) {
|
|
|
|
|
dst = &rt6->dst;
|
|
|
|
|
dev_put(dst->dev);
|
|
|
|
|
dst->dev = net->loopback_dev;
|
|
|
|
|
dev_hold(dst->dev);
|
|
|
|
|
dst_release(dst);
|
|
|
|
|
}
|
2015-10-13 02:47:09 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_rt6_create(struct net_device *dev)
|
|
|
|
|
{
|
2017-06-18 01:42:42 +08:00
|
|
|
int flags = DST_HOST | DST_NOPOLICY | DST_NOXFRM;
|
2015-10-13 02:47:09 +08:00
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
2016-04-08 02:10:06 +08:00
|
|
|
struct net *net = dev_net(dev);
|
2016-05-05 12:46:12 +08:00
|
|
|
struct fib6_table *rt6i_table;
|
2017-08-12 08:11:14 +08:00
|
|
|
struct rt6_info *rt6;
|
2015-10-13 02:47:09 +08:00
|
|
|
int rc = -ENOMEM;
|
|
|
|
|
|
2016-06-10 01:21:00 +08:00
|
|
|
/* IPv6 can be CONFIG enabled and then disabled runtime */
|
|
|
|
|
if (!ipv6_mod_enabled())
|
|
|
|
|
return 0;
|
|
|
|
|
|
2016-05-05 12:46:12 +08:00
|
|
|
rt6i_table = fib6_new_table(net, vrf->tb_id);
|
|
|
|
|
if (!rt6i_table)
|
|
|
|
|
goto out;
|
|
|
|
|
|
2016-06-07 11:50:40 +08:00
|
|
|
/* create a dst for routing packets out a VRF device */
|
|
|
|
|
rt6 = ip6_dst_alloc(net, dev, flags);
|
2015-10-13 02:47:09 +08:00
|
|
|
if (!rt6)
|
|
|
|
|
goto out;
|
|
|
|
|
|
2016-05-05 12:46:12 +08:00
|
|
|
rt6->rt6i_table = rt6i_table;
|
|
|
|
|
rt6->dst.output = vrf_output6;
|
2016-06-07 11:50:40 +08:00
|
|
|
|
2016-05-14 03:23:45 +08:00
|
|
|
rcu_assign_pointer(vrf->rt6, rt6);
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
rc = 0;
|
|
|
|
|
out:
|
|
|
|
|
return rc;
|
|
|
|
|
}
|
|
|
|
|
#else
|
2016-09-11 03:09:56 +08:00
|
|
|
static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev,
|
|
|
|
|
struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-15 02:37:21 +08:00
|
|
|
static void vrf_rt6_release(struct net_device *dev, struct net_vrf *vrf)
|
2015-10-13 02:47:09 +08:00
|
|
|
{
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_rt6_create(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
net: Add ethernet header for pass through VRF device
The change to use a custom dst broke tcpdump captures on the VRF device:
$ tcpdump -n -i vrf10
...
05:32:29.009362 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 21989, seq 1, length 64
05:32:29.009855 00:00:40:01:8d:36 > 45:00:00:54:d6:6f, ethertype Unknown (0x0a02), length 84:
0x0000: 0102 0a02 01fe 0000 9181 55e5 0001 bd11 ..........U.....
0x0010: da55 0000 0000 bb5d 0700 0000 0000 1011 .U.....]........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
Local packets going through the VRF device are missing an ethernet header.
Fix by adding one and then stripping it off before pushing back to the IP
stack. With this patch you get the expected dumps:
...
05:36:15.713944 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 23795, seq 1, length 64
05:36:15.714160 IP 10.2.1.2 > 10.2.1.254: ICMP echo reply, id 23795, seq 1, length 64
...
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-28 01:10:50 +08:00
|
|
|
/* modelled after ip_finish_output2 */
|
2015-09-16 09:04:18 +08:00
|
|
|
static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
net: Add ethernet header for pass through VRF device
The change to use a custom dst broke tcpdump captures on the VRF device:
$ tcpdump -n -i vrf10
...
05:32:29.009362 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 21989, seq 1, length 64
05:32:29.009855 00:00:40:01:8d:36 > 45:00:00:54:d6:6f, ethertype Unknown (0x0a02), length 84:
0x0000: 0102 0a02 01fe 0000 9181 55e5 0001 bd11 ..........U.....
0x0010: da55 0000 0000 bb5d 0700 0000 0000 1011 .U.....]........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
Local packets going through the VRF device are missing an ethernet header.
Fix by adding one and then stripping it off before pushing back to the IP
stack. With this patch you get the expected dumps:
...
05:36:15.713944 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 23795, seq 1, length 64
05:36:15.714160 IP 10.2.1.2 > 10.2.1.254: ICMP echo reply, id 23795, seq 1, length 64
...
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-28 01:10:50 +08:00
|
|
|
struct dst_entry *dst = skb_dst(skb);
|
|
|
|
|
struct rtable *rt = (struct rtable *)dst;
|
|
|
|
|
struct net_device *dev = dst->dev;
|
|
|
|
|
unsigned int hh_len = LL_RESERVED_SPACE(dev);
|
|
|
|
|
struct neighbour *neigh;
|
|
|
|
|
u32 nexthop;
|
|
|
|
|
int ret = -EINVAL;
|
|
|
|
|
|
2016-12-15 06:31:11 +08:00
|
|
|
nf_reset(skb);
|
|
|
|
|
|
net: Add ethernet header for pass through VRF device
The change to use a custom dst broke tcpdump captures on the VRF device:
$ tcpdump -n -i vrf10
...
05:32:29.009362 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 21989, seq 1, length 64
05:32:29.009855 00:00:40:01:8d:36 > 45:00:00:54:d6:6f, ethertype Unknown (0x0a02), length 84:
0x0000: 0102 0a02 01fe 0000 9181 55e5 0001 bd11 ..........U.....
0x0010: da55 0000 0000 bb5d 0700 0000 0000 1011 .U.....]........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
Local packets going through the VRF device are missing an ethernet header.
Fix by adding one and then stripping it off before pushing back to the IP
stack. With this patch you get the expected dumps:
...
05:36:15.713944 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 23795, seq 1, length 64
05:36:15.714160 IP 10.2.1.2 > 10.2.1.254: ICMP echo reply, id 23795, seq 1, length 64
...
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-28 01:10:50 +08:00
|
|
|
/* Be paranoid, rather than too clever. */
|
|
|
|
|
if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
|
|
|
|
|
struct sk_buff *skb2;
|
|
|
|
|
|
|
|
|
|
skb2 = skb_realloc_headroom(skb, LL_RESERVED_SPACE(dev));
|
|
|
|
|
if (!skb2) {
|
|
|
|
|
ret = -ENOMEM;
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
if (skb->sk)
|
|
|
|
|
skb_set_owner_w(skb2, skb->sk);
|
|
|
|
|
|
|
|
|
|
consume_skb(skb);
|
|
|
|
|
skb = skb2;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
rcu_read_lock_bh();
|
|
|
|
|
|
|
|
|
|
nexthop = (__force u32)rt_nexthop(rt, ip_hdr(skb)->daddr);
|
|
|
|
|
neigh = __ipv4_neigh_lookup_noref(dev, nexthop);
|
|
|
|
|
if (unlikely(!neigh))
|
|
|
|
|
neigh = __neigh_create(&arp_tbl, &nexthop, dev, false);
|
2017-02-07 05:14:12 +08:00
|
|
|
if (!IS_ERR(neigh)) {
|
|
|
|
|
sock_confirm_neigh(skb, neigh);
|
2017-02-11 19:49:20 +08:00
|
|
|
ret = neigh_output(neigh, skb);
|
2017-02-07 05:14:12 +08:00
|
|
|
}
|
net: Add ethernet header for pass through VRF device
The change to use a custom dst broke tcpdump captures on the VRF device:
$ tcpdump -n -i vrf10
...
05:32:29.009362 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 21989, seq 1, length 64
05:32:29.009855 00:00:40:01:8d:36 > 45:00:00:54:d6:6f, ethertype Unknown (0x0a02), length 84:
0x0000: 0102 0a02 01fe 0000 9181 55e5 0001 bd11 ..........U.....
0x0010: da55 0000 0000 bb5d 0700 0000 0000 1011 .U.....]........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
Local packets going through the VRF device are missing an ethernet header.
Fix by adding one and then stripping it off before pushing back to the IP
stack. With this patch you get the expected dumps:
...
05:36:15.713944 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 23795, seq 1, length 64
05:36:15.714160 IP 10.2.1.2 > 10.2.1.254: ICMP echo reply, id 23795, seq 1, length 64
...
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-28 01:10:50 +08:00
|
|
|
|
|
|
|
|
rcu_read_unlock_bh();
|
|
|
|
|
err:
|
|
|
|
|
if (unlikely(ret < 0))
|
|
|
|
|
vrf_tx_error(skb->dev, skb);
|
|
|
|
|
return ret;
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
|
2015-10-08 05:48:47 +08:00
|
|
|
static int vrf_output(struct net *net, struct sock *sk, struct sk_buff *skb)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
|
|
|
|
struct net_device *dev = skb_dst(skb)->dev;
|
|
|
|
|
|
2015-09-16 09:04:16 +08:00
|
|
|
IP_UPD_PO_STATS(net, IPSTATS_MIB_OUT, skb->len);
|
2015-08-14 04:59:10 +08:00
|
|
|
|
|
|
|
|
skb->dev = dev;
|
|
|
|
|
skb->protocol = htons(ETH_P_IP);
|
|
|
|
|
|
2015-09-16 09:04:16 +08:00
|
|
|
return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
|
|
|
|
|
net, sk, skb, NULL, dev,
|
net: Add ethernet header for pass through VRF device
The change to use a custom dst broke tcpdump captures on the VRF device:
$ tcpdump -n -i vrf10
...
05:32:29.009362 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 21989, seq 1, length 64
05:32:29.009855 00:00:40:01:8d:36 > 45:00:00:54:d6:6f, ethertype Unknown (0x0a02), length 84:
0x0000: 0102 0a02 01fe 0000 9181 55e5 0001 bd11 ..........U.....
0x0010: da55 0000 0000 bb5d 0700 0000 0000 1011 .U.....]........
0x0020: 1213 1415 1617 1819 1a1b 1c1d 1e1f 2021 ...............!
0x0030: 2223 2425 2627 2829 2a2b 2c2d 2e2f 3031 "#$%&'()*+,-./01
0x0040: 3233 3435 3637 234567
Local packets going through the VRF device are missing an ethernet header.
Fix by adding one and then stripping it off before pushing back to the IP
stack. With this patch you get the expected dumps:
...
05:36:15.713944 IP 10.2.1.254 > 10.2.1.2: ICMP echo request, id 23795, seq 1, length 64
05:36:15.714160 IP 10.2.1.2 > 10.2.1.254: ICMP echo reply, id 23795, seq 1, length 64
...
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-08-28 01:10:50 +08:00
|
|
|
vrf_finish_output,
|
2015-08-14 04:59:10 +08:00
|
|
|
!(IPCB(skb)->flags & IPSKB_REROUTED));
|
|
|
|
|
}
|
|
|
|
|
|
2016-09-11 03:09:55 +08:00
|
|
|
/* set dst on skb to send packet to us via dev_xmit path. Allows
|
|
|
|
|
* packet to go through device based features such as qdisc, netfilter
|
|
|
|
|
* hooks and packet sockets with skb->dev set to vrf device.
|
|
|
|
|
*/
|
2017-03-21 02:19:44 +08:00
|
|
|
static struct sk_buff *vrf_ip_out_redirect(struct net_device *vrf_dev,
|
|
|
|
|
struct sk_buff *skb)
|
2016-09-11 03:09:55 +08:00
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(vrf_dev);
|
|
|
|
|
struct dst_entry *dst = NULL;
|
|
|
|
|
struct rtable *rth;
|
|
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
|
|
|
|
|
rth = rcu_dereference(vrf->rth);
|
|
|
|
|
if (likely(rth)) {
|
|
|
|
|
dst = &rth->dst;
|
|
|
|
|
dst_hold(dst);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
|
|
|
|
|
if (unlikely(!dst)) {
|
|
|
|
|
vrf_tx_error(vrf_dev, skb);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
skb_dst_drop(skb);
|
|
|
|
|
skb_dst_set(skb, dst);
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2017-03-21 02:19:44 +08:00
|
|
|
static int vrf_output_direct(struct net *net, struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
skb->protocol = htons(ETH_P_IP);
|
|
|
|
|
|
|
|
|
|
return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING,
|
|
|
|
|
net, sk, skb, NULL, skb->dev,
|
|
|
|
|
vrf_finish_direct,
|
|
|
|
|
!(IPCB(skb)->flags & IPSKB_REROUTED));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev,
|
|
|
|
|
struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
struct net *net = dev_net(vrf_dev);
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
skb->dev = vrf_dev;
|
|
|
|
|
|
|
|
|
|
err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk,
|
|
|
|
|
skb, NULL, vrf_dev, vrf_output_direct);
|
|
|
|
|
|
|
|
|
|
if (likely(err == 1))
|
|
|
|
|
err = vrf_output_direct(net, sk, skb);
|
|
|
|
|
|
|
|
|
|
/* reset skb device */
|
|
|
|
|
if (likely(err == 1))
|
|
|
|
|
nf_reset(skb);
|
|
|
|
|
else
|
|
|
|
|
skb = NULL;
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev,
|
|
|
|
|
struct sock *sk,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
/* don't divert multicast */
|
|
|
|
|
if (ipv4_is_multicast(ip_hdr(skb)->daddr))
|
|
|
|
|
return skb;
|
|
|
|
|
|
|
|
|
|
if (qdisc_tx_is_default(vrf_dev))
|
|
|
|
|
return vrf_ip_out_direct(vrf_dev, sk, skb);
|
|
|
|
|
|
|
|
|
|
return vrf_ip_out_redirect(vrf_dev, skb);
|
|
|
|
|
}
|
|
|
|
|
|
2016-09-11 03:09:55 +08:00
|
|
|
/* called with rcu lock held */
|
|
|
|
|
static struct sk_buff *vrf_l3_out(struct net_device *vrf_dev,
|
|
|
|
|
struct sock *sk,
|
|
|
|
|
struct sk_buff *skb,
|
|
|
|
|
u16 proto)
|
|
|
|
|
{
|
|
|
|
|
switch (proto) {
|
|
|
|
|
case AF_INET:
|
|
|
|
|
return vrf_ip_out(vrf_dev, sk, skb);
|
2016-09-11 03:09:56 +08:00
|
|
|
case AF_INET6:
|
|
|
|
|
return vrf_ip6_out(vrf_dev, sk, skb);
|
2016-09-11 03:09:55 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2016-05-14 03:23:45 +08:00
|
|
|
/* holding rtnl */
|
2016-06-15 02:37:21 +08:00
|
|
|
static void vrf_rtable_release(struct net_device *dev, struct net_vrf *vrf)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
2016-05-14 03:23:45 +08:00
|
|
|
struct rtable *rth = rtnl_dereference(vrf->rth);
|
2016-06-15 02:37:21 +08:00
|
|
|
struct net *net = dev_net(dev);
|
|
|
|
|
struct dst_entry *dst;
|
2016-05-14 03:23:45 +08:00
|
|
|
|
2016-06-07 11:50:39 +08:00
|
|
|
RCU_INIT_POINTER(vrf->rth, NULL);
|
|
|
|
|
synchronize_rcu();
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2016-06-15 02:37:21 +08:00
|
|
|
/* move dev in dst's to loopback so this VRF device can be deleted
|
|
|
|
|
* - based on dst_ifdown
|
|
|
|
|
*/
|
|
|
|
|
if (rth) {
|
|
|
|
|
dst = &rth->dst;
|
|
|
|
|
dev_put(dst->dev);
|
|
|
|
|
dst->dev = net->loopback_dev;
|
|
|
|
|
dev_hold(dst->dev);
|
|
|
|
|
dst_release(dst);
|
|
|
|
|
}
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
|
2016-05-14 03:23:45 +08:00
|
|
|
static int vrf_rtable_create(struct net_device *dev)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
2015-09-03 04:58:35 +08:00
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
2017-08-12 08:11:14 +08:00
|
|
|
struct rtable *rth;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2016-05-05 12:46:12 +08:00
|
|
|
if (!fib_new_table(dev_net(dev), vrf->tb_id))
|
2016-05-14 03:23:45 +08:00
|
|
|
return -ENOMEM;
|
2016-05-05 12:46:12 +08:00
|
|
|
|
2016-06-07 11:50:39 +08:00
|
|
|
/* create a dst for routing packets out through a VRF device */
|
2016-04-08 02:10:06 +08:00
|
|
|
rth = rt_dst_alloc(dev, 0, RTN_UNICAST, 1, 1, 0);
|
2016-05-14 03:23:45 +08:00
|
|
|
if (!rth)
|
|
|
|
|
return -ENOMEM;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2016-05-14 03:23:45 +08:00
|
|
|
rth->dst.output = vrf_output;
|
|
|
|
|
rth->rt_table_id = vrf->tb_id;
|
|
|
|
|
|
|
|
|
|
rcu_assign_pointer(vrf->rth, rth);
|
|
|
|
|
|
|
|
|
|
return 0;
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/**************************** device handling ********************/
|
|
|
|
|
|
|
|
|
|
/* cycle interface to flush neighbor cache and move routes across tables */
|
|
|
|
|
static void cycle_netdev(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
unsigned int flags = dev->flags;
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (!netif_running(dev))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
ret = dev_change_flags(dev, flags & ~IFF_UP);
|
|
|
|
|
if (ret >= 0)
|
|
|
|
|
ret = dev_change_flags(dev, flags);
|
|
|
|
|
|
|
|
|
|
if (ret < 0) {
|
|
|
|
|
netdev_err(dev,
|
|
|
|
|
"Failed to cycle device %s; route tables might be wrong!\n",
|
|
|
|
|
dev->name);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2017-10-05 08:48:47 +08:00
|
|
|
static int do_vrf_add_slave(struct net_device *dev, struct net_device *port_dev,
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
2015-11-24 21:29:16 +08:00
|
|
|
int ret;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2017-04-26 22:58:22 +08:00
|
|
|
/* do not allow loopback device to be enslaved to a VRF.
|
|
|
|
|
* The vrf device acts as the loopback for the vrf.
|
|
|
|
|
*/
|
2017-10-05 08:48:48 +08:00
|
|
|
if (port_dev == dev_net(dev)->loopback_dev) {
|
|
|
|
|
NL_SET_ERR_MSG(extack,
|
|
|
|
|
"Can not enslave loopback device to a VRF");
|
2017-04-26 22:58:22 +08:00
|
|
|
return -EOPNOTSUPP;
|
2017-10-05 08:48:48 +08:00
|
|
|
}
|
2017-04-26 22:58:22 +08:00
|
|
|
|
2017-03-16 16:08:15 +08:00
|
|
|
port_dev->priv_flags |= IFF_L3MDEV_SLAVE;
|
2017-10-05 08:48:47 +08:00
|
|
|
ret = netdev_master_upper_dev_link(port_dev, dev, NULL, NULL, extack);
|
2015-08-14 04:59:10 +08:00
|
|
|
if (ret < 0)
|
2017-03-16 16:08:15 +08:00
|
|
|
goto err;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
|
|
|
|
cycle_netdev(port_dev);
|
|
|
|
|
|
|
|
|
|
return 0;
|
2017-03-16 16:08:15 +08:00
|
|
|
|
|
|
|
|
err:
|
|
|
|
|
port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;
|
|
|
|
|
return ret;
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
|
2017-10-05 08:48:46 +08:00
|
|
|
static int vrf_add_slave(struct net_device *dev, struct net_device *port_dev,
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
2017-10-05 08:48:48 +08:00
|
|
|
if (netif_is_l3_master(port_dev)) {
|
|
|
|
|
NL_SET_ERR_MSG(extack,
|
|
|
|
|
"Can not enslave an L3 master device to a VRF");
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (netif_is_l3_slave(port_dev))
|
2015-08-14 04:59:10 +08:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
2017-10-05 08:48:47 +08:00
|
|
|
return do_vrf_add_slave(dev, port_dev, extack);
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* inverse of do_vrf_add_slave */
|
|
|
|
|
static int do_vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
|
|
|
|
|
{
|
|
|
|
|
netdev_upper_dev_unlink(port_dev, dev);
|
2015-10-05 23:51:24 +08:00
|
|
|
port_dev->priv_flags &= ~IFF_L3MDEV_SLAVE;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
|
|
|
|
cycle_netdev(port_dev);
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_del_slave(struct net_device *dev, struct net_device *port_dev)
|
|
|
|
|
{
|
|
|
|
|
return do_vrf_del_slave(dev, port_dev);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void vrf_dev_uninit(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
|
|
|
|
|
2016-06-15 02:37:21 +08:00
|
|
|
vrf_rtable_release(dev, vrf);
|
|
|
|
|
vrf_rt6_release(dev, vrf);
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2015-08-19 01:28:03 +08:00
|
|
|
free_percpu(dev->dstats);
|
2015-08-14 04:59:10 +08:00
|
|
|
dev->dstats = NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_dev_init(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
dev->dstats = netdev_alloc_pcpu_stats(struct pcpu_dstats);
|
|
|
|
|
if (!dev->dstats)
|
|
|
|
|
goto out_nomem;
|
|
|
|
|
|
|
|
|
|
/* create the default dst which points back to us */
|
2016-05-14 03:23:45 +08:00
|
|
|
if (vrf_rtable_create(dev) != 0)
|
2015-08-14 04:59:10 +08:00
|
|
|
goto out_stats;
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
if (vrf_rt6_create(dev) != 0)
|
|
|
|
|
goto out_rth;
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
dev->flags = IFF_MASTER | IFF_NOARP;
|
|
|
|
|
|
2016-06-02 12:16:39 +08:00
|
|
|
/* MTU is irrelevant for VRF device; set to 64k similar to lo */
|
|
|
|
|
dev->mtu = 64 * 1024;
|
|
|
|
|
|
|
|
|
|
/* similarly, oper state is irrelevant; set to up to avoid confusion */
|
|
|
|
|
dev->operstate = IF_OPER_UP;
|
2016-06-09 22:45:13 +08:00
|
|
|
netdev_lockdep_set_classes(dev);
|
2015-08-14 04:59:10 +08:00
|
|
|
return 0;
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
out_rth:
|
2016-06-15 02:37:21 +08:00
|
|
|
vrf_rtable_release(dev, vrf);
|
2015-08-14 04:59:10 +08:00
|
|
|
out_stats:
|
|
|
|
|
free_percpu(dev->dstats);
|
|
|
|
|
dev->dstats = NULL;
|
|
|
|
|
out_nomem:
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static const struct net_device_ops vrf_netdev_ops = {
|
|
|
|
|
.ndo_init = vrf_dev_init,
|
|
|
|
|
.ndo_uninit = vrf_dev_uninit,
|
|
|
|
|
.ndo_start_xmit = vrf_xmit,
|
|
|
|
|
.ndo_get_stats64 = vrf_get_stats64,
|
|
|
|
|
.ndo_add_slave = vrf_add_slave,
|
|
|
|
|
.ndo_del_slave = vrf_del_slave,
|
|
|
|
|
};
|
|
|
|
|
|
2015-09-30 11:07:12 +08:00
|
|
|
static u32 vrf_fib_table(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
return vrf->tb_id;
|
|
|
|
|
}
|
|
|
|
|
|
2016-07-05 09:47:41 +08:00
|
|
|
static int vrf_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
|
|
|
|
|
{
|
2017-05-09 18:27:33 +08:00
|
|
|
kfree_skb(skb);
|
2016-07-05 09:47:41 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *vrf_rcv_nfhook(u8 pf, unsigned int hook,
|
|
|
|
|
struct sk_buff *skb,
|
|
|
|
|
struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct net *net = dev_net(dev);
|
|
|
|
|
|
2017-05-09 18:27:33 +08:00
|
|
|
if (nf_hook(pf, hook, net, NULL, skb, dev, NULL, vrf_rcv_finish) != 1)
|
2016-07-05 09:47:41 +08:00
|
|
|
skb = NULL; /* kfree_skb(skb) handled by nf code */
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2016-05-11 02:19:50 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
|
|
|
/* neighbor handling is done with actual device; do not want
|
|
|
|
|
* to flip skb->dev for those ndisc packets. This really fails
|
|
|
|
|
* for multiple next protocols (e.g., NEXTHDR_HOP). But it is
|
|
|
|
|
* a start.
|
|
|
|
|
*/
|
|
|
|
|
static bool ipv6_ndisc_frame(const struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
|
|
|
|
bool rc = false;
|
|
|
|
|
|
|
|
|
|
if (iph->nexthdr == NEXTHDR_ICMP) {
|
|
|
|
|
const struct icmp6hdr *icmph;
|
|
|
|
|
struct icmp6hdr _icmph;
|
|
|
|
|
|
|
|
|
|
icmph = skb_header_pointer(skb, sizeof(*iph),
|
|
|
|
|
sizeof(_icmph), &_icmph);
|
|
|
|
|
if (!icmph)
|
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
|
|
switch (icmph->icmp6_type) {
|
|
|
|
|
case NDISC_ROUTER_SOLICITATION:
|
|
|
|
|
case NDISC_ROUTER_ADVERTISEMENT:
|
|
|
|
|
case NDISC_NEIGHBOUR_SOLICITATION:
|
|
|
|
|
case NDISC_NEIGHBOUR_ADVERTISEMENT:
|
|
|
|
|
case NDISC_REDIRECT:
|
|
|
|
|
rc = true;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
out:
|
|
|
|
|
return rc;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-14 04:44:19 +08:00
|
|
|
static struct rt6_info *vrf_ip6_route_lookup(struct net *net,
|
|
|
|
|
const struct net_device *dev,
|
|
|
|
|
struct flowi6 *fl6,
|
|
|
|
|
int ifindex,
|
|
|
|
|
int flags)
|
|
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
|
|
|
|
struct fib6_table *table = NULL;
|
|
|
|
|
struct rt6_info *rt6;
|
|
|
|
|
|
|
|
|
|
rcu_read_lock();
|
|
|
|
|
|
|
|
|
|
/* fib6_table does not have a refcnt and can not be freed */
|
|
|
|
|
rt6 = rcu_dereference(vrf->rt6);
|
|
|
|
|
if (likely(rt6))
|
|
|
|
|
table = rt6->rt6i_table;
|
|
|
|
|
|
|
|
|
|
rcu_read_unlock();
|
|
|
|
|
|
|
|
|
|
if (!table)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
return ip6_pol_route(net, table, ifindex, fl6, flags);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void vrf_ip6_input_dst(struct sk_buff *skb, struct net_device *vrf_dev,
|
|
|
|
|
int ifindex)
|
|
|
|
|
{
|
|
|
|
|
const struct ipv6hdr *iph = ipv6_hdr(skb);
|
|
|
|
|
struct flowi6 fl6 = {
|
2017-09-13 04:10:53 +08:00
|
|
|
.flowi6_iif = ifindex,
|
|
|
|
|
.flowi6_mark = skb->mark,
|
|
|
|
|
.flowi6_proto = iph->nexthdr,
|
2016-06-14 04:44:19 +08:00
|
|
|
.daddr = iph->daddr,
|
|
|
|
|
.saddr = iph->saddr,
|
|
|
|
|
.flowlabel = ip6_flowinfo(iph),
|
|
|
|
|
};
|
|
|
|
|
struct net *net = dev_net(vrf_dev);
|
|
|
|
|
struct rt6_info *rt6;
|
|
|
|
|
|
|
|
|
|
rt6 = vrf_ip6_route_lookup(net, vrf_dev, &fl6, ifindex,
|
|
|
|
|
RT6_LOOKUP_F_HAS_SADDR | RT6_LOOKUP_F_IFACE);
|
|
|
|
|
if (unlikely(!rt6))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
if (unlikely(&rt6->dst == &net->ipv6.ip6_null_entry->dst))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
skb_dst_set(skb, &rt6->dst);
|
|
|
|
|
}
|
|
|
|
|
|
2016-05-11 02:19:50 +08:00
|
|
|
static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
2016-06-14 04:44:19 +08:00
|
|
|
int orig_iif = skb->skb_iif;
|
|
|
|
|
bool need_strict;
|
|
|
|
|
|
2016-06-07 11:50:40 +08:00
|
|
|
/* loopback traffic; do not push through packet taps again.
|
|
|
|
|
* Reset pkt_type for upper layers to process skb
|
|
|
|
|
*/
|
|
|
|
|
if (skb->pkt_type == PACKET_LOOPBACK) {
|
|
|
|
|
skb->dev = vrf_dev;
|
|
|
|
|
skb->skb_iif = vrf_dev->ifindex;
|
2016-10-17 11:02:52 +08:00
|
|
|
IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
|
2016-06-07 11:50:40 +08:00
|
|
|
skb->pkt_type = PACKET_HOST;
|
|
|
|
|
goto out;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-14 04:44:19 +08:00
|
|
|
/* if packet is NDISC or addressed to multicast or link-local
|
|
|
|
|
* then keep the ingress interface
|
|
|
|
|
*/
|
|
|
|
|
need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
|
|
|
|
|
if (!ipv6_ndisc_frame(skb) && !need_strict) {
|
2017-01-04 01:37:55 +08:00
|
|
|
vrf_rx_stats(vrf_dev, skb->len);
|
2016-05-11 02:19:50 +08:00
|
|
|
skb->dev = vrf_dev;
|
|
|
|
|
skb->skb_iif = vrf_dev->ifindex;
|
|
|
|
|
|
2017-03-21 02:19:45 +08:00
|
|
|
if (!list_empty(&vrf_dev->ptype_all)) {
|
|
|
|
|
skb_push(skb, skb->mac_len);
|
|
|
|
|
dev_queue_xmit_nit(skb, vrf_dev);
|
|
|
|
|
skb_pull(skb, skb->mac_len);
|
|
|
|
|
}
|
2016-05-11 02:19:50 +08:00
|
|
|
|
|
|
|
|
IP6CB(skb)->flags |= IP6SKB_L3SLAVE;
|
|
|
|
|
}
|
|
|
|
|
|
2016-06-14 04:44:19 +08:00
|
|
|
if (need_strict)
|
|
|
|
|
vrf_ip6_input_dst(skb, vrf_dev, orig_iif);
|
|
|
|
|
|
2016-07-05 09:47:41 +08:00
|
|
|
skb = vrf_rcv_nfhook(NFPROTO_IPV6, NF_INET_PRE_ROUTING, skb, vrf_dev);
|
2016-06-07 11:50:40 +08:00
|
|
|
out:
|
2016-05-11 02:19:50 +08:00
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev,
|
|
|
|
|
struct sk_buff *skb)
|
|
|
|
|
{
|
|
|
|
|
skb->dev = vrf_dev;
|
|
|
|
|
skb->skb_iif = vrf_dev->ifindex;
|
2016-10-17 11:02:52 +08:00
|
|
|
IPCB(skb)->flags |= IPSKB_L3SLAVE;
|
2016-05-11 02:19:50 +08:00
|
|
|
|
2016-11-01 06:54:00 +08:00
|
|
|
if (ipv4_is_multicast(ip_hdr(skb)->daddr))
|
|
|
|
|
goto out;
|
|
|
|
|
|
2016-06-07 11:50:39 +08:00
|
|
|
/* loopback traffic; do not push through packet taps again.
|
|
|
|
|
* Reset pkt_type for upper layers to process skb
|
|
|
|
|
*/
|
|
|
|
|
if (skb->pkt_type == PACKET_LOOPBACK) {
|
|
|
|
|
skb->pkt_type = PACKET_HOST;
|
|
|
|
|
goto out;
|
|
|
|
|
}
|
|
|
|
|
|
2017-01-04 01:37:55 +08:00
|
|
|
vrf_rx_stats(vrf_dev, skb->len);
|
|
|
|
|
|
2017-03-21 02:19:44 +08:00
|
|
|
if (!list_empty(&vrf_dev->ptype_all)) {
|
|
|
|
|
skb_push(skb, skb->mac_len);
|
|
|
|
|
dev_queue_xmit_nit(skb, vrf_dev);
|
|
|
|
|
skb_pull(skb, skb->mac_len);
|
|
|
|
|
}
|
2016-05-11 02:19:50 +08:00
|
|
|
|
2016-07-05 09:47:41 +08:00
|
|
|
skb = vrf_rcv_nfhook(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, vrf_dev);
|
2016-06-07 11:50:39 +08:00
|
|
|
out:
|
2016-05-11 02:19:50 +08:00
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* called with rcu lock held */
|
|
|
|
|
static struct sk_buff *vrf_l3_rcv(struct net_device *vrf_dev,
|
|
|
|
|
struct sk_buff *skb,
|
|
|
|
|
u16 proto)
|
|
|
|
|
{
|
|
|
|
|
switch (proto) {
|
|
|
|
|
case AF_INET:
|
|
|
|
|
return vrf_ip_rcv(vrf_dev, skb);
|
|
|
|
|
case AF_INET6:
|
|
|
|
|
return vrf_ip6_rcv(vrf_dev, skb);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return skb;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-13 02:47:09 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2016-09-11 03:09:56 +08:00
|
|
|
/* send to link-local or multicast address via interface enslaved to
|
|
|
|
|
* VRF device. Force lookup to VRF table without changing flow struct
|
|
|
|
|
*/
|
|
|
|
|
static struct dst_entry *vrf_link_scope_lookup(const struct net_device *dev,
|
|
|
|
|
struct flowi6 *fl6)
|
2015-10-13 02:47:09 +08:00
|
|
|
{
|
2016-06-14 04:44:19 +08:00
|
|
|
struct net *net = dev_net(dev);
|
2016-09-11 03:09:56 +08:00
|
|
|
int flags = RT6_LOOKUP_F_IFACE;
|
2016-05-14 03:23:45 +08:00
|
|
|
struct dst_entry *dst = NULL;
|
2016-06-14 04:44:19 +08:00
|
|
|
struct rt6_info *rt;
|
2015-10-13 02:47:09 +08:00
|
|
|
|
2016-09-11 03:09:56 +08:00
|
|
|
/* VRF device does not have a link-local address and
|
|
|
|
|
* sending packets to link-local or mcast addresses over
|
|
|
|
|
* a VRF device does not make sense
|
|
|
|
|
*/
|
|
|
|
|
if (fl6->flowi6_oif == dev->ifindex) {
|
|
|
|
|
dst = &net->ipv6.ip6_null_entry->dst;
|
|
|
|
|
dst_hold(dst);
|
|
|
|
|
return dst;
|
2015-10-13 02:47:09 +08:00
|
|
|
}
|
|
|
|
|
|
2016-09-11 03:09:56 +08:00
|
|
|
if (!ipv6_addr_any(&fl6->saddr))
|
|
|
|
|
flags |= RT6_LOOKUP_F_HAS_SADDR;
|
|
|
|
|
|
|
|
|
|
rt = vrf_ip6_route_lookup(net, dev, fl6, fl6->flowi6_oif, flags);
|
|
|
|
|
if (rt)
|
|
|
|
|
dst = &rt->dst;
|
2016-06-14 04:44:19 +08:00
|
|
|
|
2016-05-14 03:23:45 +08:00
|
|
|
return dst;
|
2015-10-13 02:47:09 +08:00
|
|
|
}
|
|
|
|
|
#endif
|
|
|
|
|
|
2015-09-30 11:07:12 +08:00
|
|
|
static const struct l3mdev_ops vrf_l3mdev_ops = {
|
|
|
|
|
.l3mdev_fib_table = vrf_fib_table,
|
2016-05-11 02:19:50 +08:00
|
|
|
.l3mdev_l3_rcv = vrf_l3_rcv,
|
2016-09-11 03:09:55 +08:00
|
|
|
.l3mdev_l3_out = vrf_l3_out,
|
2015-10-13 02:47:09 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2016-09-11 03:09:56 +08:00
|
|
|
.l3mdev_link_scope_lookup = vrf_link_scope_lookup,
|
2015-10-13 02:47:09 +08:00
|
|
|
#endif
|
2015-09-30 11:07:12 +08:00
|
|
|
};
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
static void vrf_get_drvinfo(struct net_device *dev,
|
|
|
|
|
struct ethtool_drvinfo *info)
|
|
|
|
|
{
|
|
|
|
|
strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
|
|
|
|
|
strlcpy(info->version, DRV_VERSION, sizeof(info->version));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static const struct ethtool_ops vrf_ethtool_ops = {
|
|
|
|
|
.get_drvinfo = vrf_get_drvinfo,
|
|
|
|
|
};
|
|
|
|
|
|
2016-06-09 01:55:40 +08:00
|
|
|
static inline size_t vrf_fib_rule_nl_size(void)
|
|
|
|
|
{
|
|
|
|
|
size_t sz;
|
|
|
|
|
|
|
|
|
|
sz = NLMSG_ALIGN(sizeof(struct fib_rule_hdr));
|
|
|
|
|
sz += nla_total_size(sizeof(u8)); /* FRA_L3MDEV */
|
|
|
|
|
sz += nla_total_size(sizeof(u32)); /* FRA_PRIORITY */
|
|
|
|
|
|
|
|
|
|
return sz;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_fib_rule(const struct net_device *dev, __u8 family, bool add_it)
|
|
|
|
|
{
|
|
|
|
|
struct fib_rule_hdr *frh;
|
|
|
|
|
struct nlmsghdr *nlh;
|
|
|
|
|
struct sk_buff *skb;
|
|
|
|
|
int err;
|
|
|
|
|
|
2016-06-10 01:21:00 +08:00
|
|
|
if (family == AF_INET6 && !ipv6_mod_enabled())
|
|
|
|
|
return 0;
|
|
|
|
|
|
2016-06-09 01:55:40 +08:00
|
|
|
skb = nlmsg_new(vrf_fib_rule_nl_size(), GFP_KERNEL);
|
|
|
|
|
if (!skb)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
|
|
nlh = nlmsg_put(skb, 0, 0, 0, sizeof(*frh), 0);
|
|
|
|
|
if (!nlh)
|
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
|
|
/* rule only needs to appear once */
|
2017-04-14 00:57:15 +08:00
|
|
|
nlh->nlmsg_flags |= NLM_F_EXCL;
|
2016-06-09 01:55:40 +08:00
|
|
|
|
|
|
|
|
frh = nlmsg_data(nlh);
|
|
|
|
|
memset(frh, 0, sizeof(*frh));
|
|
|
|
|
frh->family = family;
|
|
|
|
|
frh->action = FR_ACT_TO_TBL;
|
|
|
|
|
|
2017-11-01 22:58:09 +08:00
|
|
|
if (nla_put_u8(skb, FRA_L3MDEV, 1))
|
2016-06-09 01:55:40 +08:00
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
|
|
if (nla_put_u32(skb, FRA_PRIORITY, FIB_RULE_PREF))
|
|
|
|
|
goto nla_put_failure;
|
|
|
|
|
|
|
|
|
|
nlmsg_end(skb, nlh);
|
|
|
|
|
|
|
|
|
|
/* fib_nl_{new,del}rule handling looks for net from skb->sk */
|
|
|
|
|
skb->sk = dev_net(dev)->rtnl;
|
|
|
|
|
if (add_it) {
|
2017-04-17 00:48:24 +08:00
|
|
|
err = fib_nl_newrule(skb, nlh, NULL);
|
2016-06-09 01:55:40 +08:00
|
|
|
if (err == -EEXIST)
|
|
|
|
|
err = 0;
|
|
|
|
|
} else {
|
2017-04-17 00:48:24 +08:00
|
|
|
err = fib_nl_delrule(skb, nlh, NULL);
|
2016-06-09 01:55:40 +08:00
|
|
|
if (err == -ENOENT)
|
|
|
|
|
err = 0;
|
|
|
|
|
}
|
|
|
|
|
nlmsg_free(skb);
|
|
|
|
|
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
nla_put_failure:
|
|
|
|
|
nlmsg_free(skb);
|
|
|
|
|
|
|
|
|
|
return -EMSGSIZE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_add_fib_rules(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
err = vrf_fib_rule(dev, AF_INET, true);
|
|
|
|
|
if (err < 0)
|
|
|
|
|
goto out_err;
|
|
|
|
|
|
|
|
|
|
err = vrf_fib_rule(dev, AF_INET6, true);
|
|
|
|
|
if (err < 0)
|
|
|
|
|
goto ipv6_err;
|
|
|
|
|
|
2016-11-01 06:54:00 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IP_MROUTE_MULTIPLE_TABLES)
|
|
|
|
|
err = vrf_fib_rule(dev, RTNL_FAMILY_IPMR, true);
|
|
|
|
|
if (err < 0)
|
|
|
|
|
goto ipmr_err;
|
|
|
|
|
#endif
|
|
|
|
|
|
2016-06-09 01:55:40 +08:00
|
|
|
return 0;
|
|
|
|
|
|
2016-11-01 06:54:00 +08:00
|
|
|
#if IS_ENABLED(CONFIG_IP_MROUTE_MULTIPLE_TABLES)
|
|
|
|
|
ipmr_err:
|
|
|
|
|
vrf_fib_rule(dev, AF_INET6, false);
|
|
|
|
|
#endif
|
|
|
|
|
|
2016-06-09 01:55:40 +08:00
|
|
|
ipv6_err:
|
|
|
|
|
vrf_fib_rule(dev, AF_INET, false);
|
|
|
|
|
|
|
|
|
|
out_err:
|
|
|
|
|
netdev_err(dev, "Failed to add FIB rules.\n");
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
static void vrf_setup(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
ether_setup(dev);
|
|
|
|
|
|
|
|
|
|
/* Initialize the device structure. */
|
|
|
|
|
dev->netdev_ops = &vrf_netdev_ops;
|
2015-09-30 11:07:12 +08:00
|
|
|
dev->l3mdev_ops = &vrf_l3mdev_ops;
|
2015-08-14 04:59:10 +08:00
|
|
|
dev->ethtool_ops = &vrf_ethtool_ops;
|
net: Fix inconsistent teardown and release of private netdev state.
Network devices can allocate reasources and private memory using
netdev_ops->ndo_init(). However, the release of these resources
can occur in one of two different places.
Either netdev_ops->ndo_uninit() or netdev->destructor().
The decision of which operation frees the resources depends upon
whether it is necessary for all netdev refs to be released before it
is safe to perform the freeing.
netdev_ops->ndo_uninit() presumably can occur right after the
NETDEV_UNREGISTER notifier completes and the unicast and multicast
address lists are flushed.
netdev->destructor(), on the other hand, does not run until the
netdev references all go away.
Further complicating the situation is that netdev->destructor()
almost universally does also a free_netdev().
This creates a problem for the logic in register_netdevice().
Because all callers of register_netdevice() manage the freeing
of the netdev, and invoke free_netdev(dev) if register_netdevice()
fails.
If netdev_ops->ndo_init() succeeds, but something else fails inside
of register_netdevice(), it does call ndo_ops->ndo_uninit(). But
it is not able to invoke netdev->destructor().
This is because netdev->destructor() will do a free_netdev() and
then the caller of register_netdevice() will do the same.
However, this means that the resources that would normally be released
by netdev->destructor() will not be.
Over the years drivers have added local hacks to deal with this, by
invoking their destructor parts by hand when register_netdevice()
fails.
Many drivers do not try to deal with this, and instead we have leaks.
Let's close this hole by formalizing the distinction between what
private things need to be freed up by netdev->destructor() and whether
the driver needs unregister_netdevice() to perform the free_netdev().
netdev->priv_destructor() performs all actions to free up the private
resources that used to be freed by netdev->destructor(), except for
free_netdev().
netdev->needs_free_netdev is a boolean that indicates whether
free_netdev() should be done at the end of unregister_netdevice().
Now, register_netdevice() can sanely release all resources after
ndo_ops->ndo_init() succeeds, by invoking both ndo_ops->ndo_uninit()
and netdev->priv_destructor().
And at the end of unregister_netdevice(), we invoke
netdev->priv_destructor() and optionally call free_netdev().
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-05-09 00:52:56 +08:00
|
|
|
dev->needs_free_netdev = true;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
|
|
|
|
/* Fill in device structure with ethernet-generic values. */
|
|
|
|
|
eth_hw_addr_random(dev);
|
|
|
|
|
|
|
|
|
|
/* don't acquire vrf device's netif_tx_lock when transmitting */
|
|
|
|
|
dev->features |= NETIF_F_LLTX;
|
|
|
|
|
|
|
|
|
|
/* don't allow vrf devices to change network namespaces. */
|
|
|
|
|
dev->features |= NETIF_F_NETNS_LOCAL;
|
2016-06-14 08:14:12 +08:00
|
|
|
|
|
|
|
|
/* does not make sense for a VLAN to be added to a vrf device */
|
|
|
|
|
dev->features |= NETIF_F_VLAN_CHALLENGED;
|
|
|
|
|
|
|
|
|
|
/* enable offload features */
|
|
|
|
|
dev->features |= NETIF_F_GSO_SOFTWARE;
|
|
|
|
|
dev->features |= NETIF_F_RXCSUM | NETIF_F_HW_CSUM;
|
|
|
|
|
dev->features |= NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA;
|
|
|
|
|
|
|
|
|
|
dev->hw_features = dev->features;
|
|
|
|
|
dev->hw_enc_features = dev->features;
|
|
|
|
|
|
|
|
|
|
/* default to no qdisc; user can add if desired */
|
|
|
|
|
dev->priv_flags |= IFF_NO_QUEUE;
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
|
2017-06-26 05:56:01 +08:00
|
|
|
static int vrf_validate(struct nlattr *tb[], struct nlattr *data[],
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
|
|
|
|
if (tb[IFLA_ADDRESS]) {
|
2017-08-08 01:08:10 +08:00
|
|
|
if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) {
|
|
|
|
|
NL_SET_ERR_MSG(extack, "Invalid hardware address");
|
2015-08-14 04:59:10 +08:00
|
|
|
return -EINVAL;
|
2017-08-08 01:08:10 +08:00
|
|
|
}
|
|
|
|
|
if (!is_valid_ether_addr(nla_data(tb[IFLA_ADDRESS]))) {
|
|
|
|
|
NL_SET_ERR_MSG(extack, "Invalid hardware address");
|
2015-08-14 04:59:10 +08:00
|
|
|
return -EADDRNOTAVAIL;
|
2017-08-08 01:08:10 +08:00
|
|
|
}
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void vrf_dellink(struct net_device *dev, struct list_head *head)
|
|
|
|
|
{
|
2017-07-06 20:24:40 +08:00
|
|
|
struct net_device *port_dev;
|
|
|
|
|
struct list_head *iter;
|
|
|
|
|
|
|
|
|
|
netdev_for_each_lower_dev(dev, port_dev, iter)
|
|
|
|
|
vrf_del_slave(dev, port_dev);
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
unregister_netdevice_queue(dev, head);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_newlink(struct net *src_net, struct net_device *dev,
|
2017-06-26 05:55:59 +08:00
|
|
|
struct nlattr *tb[], struct nlattr *data[],
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2015-08-14 04:59:10 +08:00
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
2017-06-09 01:31:11 +08:00
|
|
|
bool *add_fib_rules;
|
|
|
|
|
struct net *net;
|
2016-06-09 01:55:40 +08:00
|
|
|
int err;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2017-08-08 01:08:10 +08:00
|
|
|
if (!data || !data[IFLA_VRF_TABLE]) {
|
|
|
|
|
NL_SET_ERR_MSG(extack, "VRF table id is missing");
|
2015-08-14 04:59:10 +08:00
|
|
|
return -EINVAL;
|
2017-08-08 01:08:10 +08:00
|
|
|
}
|
2015-08-14 04:59:10 +08:00
|
|
|
|
|
|
|
|
vrf->tb_id = nla_get_u32(data[IFLA_VRF_TABLE]);
|
2017-08-08 01:08:10 +08:00
|
|
|
if (vrf->tb_id == RT_TABLE_UNSPEC) {
|
|
|
|
|
NL_SET_ERR_MSG_ATTR(extack, data[IFLA_VRF_TABLE],
|
|
|
|
|
"Invalid VRF table id");
|
2017-01-11 07:22:25 +08:00
|
|
|
return -EINVAL;
|
2017-08-08 01:08:10 +08:00
|
|
|
}
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2015-09-30 11:07:10 +08:00
|
|
|
dev->priv_flags |= IFF_L3MDEV_MASTER;
|
2015-08-14 04:59:10 +08:00
|
|
|
|
2016-06-09 01:55:40 +08:00
|
|
|
err = register_netdevice(dev);
|
|
|
|
|
if (err)
|
|
|
|
|
goto out;
|
|
|
|
|
|
2017-06-09 01:31:11 +08:00
|
|
|
net = dev_net(dev);
|
|
|
|
|
add_fib_rules = net_generic(net, vrf_net_id);
|
|
|
|
|
if (*add_fib_rules) {
|
2016-06-09 01:55:40 +08:00
|
|
|
err = vrf_add_fib_rules(dev);
|
|
|
|
|
if (err) {
|
|
|
|
|
unregister_netdevice(dev);
|
|
|
|
|
goto out;
|
|
|
|
|
}
|
2017-06-09 01:31:11 +08:00
|
|
|
*add_fib_rules = false;
|
2016-06-09 01:55:40 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
out:
|
|
|
|
|
return err;
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static size_t vrf_nl_getsize(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
return nla_total_size(sizeof(u32)); /* IFLA_VRF_TABLE */
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_fillinfo(struct sk_buff *skb,
|
|
|
|
|
const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
return nla_put_u32(skb, IFLA_VRF_TABLE, vrf->tb_id);
|
|
|
|
|
}
|
|
|
|
|
|
2016-02-02 23:43:45 +08:00
|
|
|
static size_t vrf_get_slave_size(const struct net_device *bond_dev,
|
|
|
|
|
const struct net_device *slave_dev)
|
|
|
|
|
{
|
|
|
|
|
return nla_total_size(sizeof(u32)); /* IFLA_VRF_PORT_TABLE */
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int vrf_fill_slave_info(struct sk_buff *skb,
|
|
|
|
|
const struct net_device *vrf_dev,
|
|
|
|
|
const struct net_device *slave_dev)
|
|
|
|
|
{
|
|
|
|
|
struct net_vrf *vrf = netdev_priv(vrf_dev);
|
|
|
|
|
|
|
|
|
|
if (nla_put_u32(skb, IFLA_VRF_PORT_TABLE, vrf->tb_id))
|
|
|
|
|
return -EMSGSIZE;
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
static const struct nla_policy vrf_nl_policy[IFLA_VRF_MAX + 1] = {
|
|
|
|
|
[IFLA_VRF_TABLE] = { .type = NLA_U32 },
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static struct rtnl_link_ops vrf_link_ops __read_mostly = {
|
|
|
|
|
.kind = DRV_NAME,
|
|
|
|
|
.priv_size = sizeof(struct net_vrf),
|
|
|
|
|
|
|
|
|
|
.get_size = vrf_nl_getsize,
|
|
|
|
|
.policy = vrf_nl_policy,
|
|
|
|
|
.validate = vrf_validate,
|
|
|
|
|
.fill_info = vrf_fillinfo,
|
|
|
|
|
|
2016-02-02 23:43:45 +08:00
|
|
|
.get_slave_size = vrf_get_slave_size,
|
|
|
|
|
.fill_slave_info = vrf_fill_slave_info,
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
.newlink = vrf_newlink,
|
|
|
|
|
.dellink = vrf_dellink,
|
|
|
|
|
.setup = vrf_setup,
|
|
|
|
|
.maxtype = IFLA_VRF_MAX,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static int vrf_device_event(struct notifier_block *unused,
|
|
|
|
|
unsigned long event, void *ptr)
|
|
|
|
|
{
|
|
|
|
|
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
|
|
|
|
|
|
|
|
|
|
/* only care about unregister events to drop slave references */
|
|
|
|
|
if (event == NETDEV_UNREGISTER) {
|
|
|
|
|
struct net_device *vrf_dev;
|
|
|
|
|
|
2015-10-05 23:51:24 +08:00
|
|
|
if (!netif_is_l3_slave(dev))
|
2015-08-14 04:59:10 +08:00
|
|
|
goto out;
|
|
|
|
|
|
2015-08-19 01:28:04 +08:00
|
|
|
vrf_dev = netdev_master_upper_dev_get(dev);
|
|
|
|
|
vrf_del_slave(vrf_dev, dev);
|
2015-08-14 04:59:10 +08:00
|
|
|
}
|
|
|
|
|
out:
|
|
|
|
|
return NOTIFY_DONE;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct notifier_block vrf_notifier_block __read_mostly = {
|
|
|
|
|
.notifier_call = vrf_device_event,
|
|
|
|
|
};
|
|
|
|
|
|
2017-06-09 01:31:11 +08:00
|
|
|
/* Initialize per network namespace state */
|
|
|
|
|
static int __net_init vrf_netns_init(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
bool *add_fib_rules = net_generic(net, vrf_net_id);
|
|
|
|
|
|
|
|
|
|
*add_fib_rules = true;
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct pernet_operations vrf_net_ops __net_initdata = {
|
|
|
|
|
.init = vrf_netns_init,
|
|
|
|
|
.id = &vrf_net_id,
|
|
|
|
|
.size = sizeof(bool),
|
|
|
|
|
};
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
static int __init vrf_init_module(void)
|
|
|
|
|
{
|
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
|
|
register_netdevice_notifier(&vrf_notifier_block);
|
|
|
|
|
|
2017-06-09 01:31:11 +08:00
|
|
|
rc = register_pernet_subsys(&vrf_net_ops);
|
2015-08-14 04:59:10 +08:00
|
|
|
if (rc < 0)
|
|
|
|
|
goto error;
|
|
|
|
|
|
2017-06-09 01:31:11 +08:00
|
|
|
rc = rtnl_link_register(&vrf_link_ops);
|
|
|
|
|
if (rc < 0) {
|
|
|
|
|
unregister_pernet_subsys(&vrf_net_ops);
|
|
|
|
|
goto error;
|
|
|
|
|
}
|
|
|
|
|
|
2015-08-14 04:59:10 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
error:
|
|
|
|
|
unregister_netdevice_notifier(&vrf_notifier_block);
|
|
|
|
|
return rc;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
module_init(vrf_init_module);
|
|
|
|
|
MODULE_AUTHOR("Shrijeet Mukherjee, David Ahern");
|
|
|
|
|
MODULE_DESCRIPTION("Device driver to instantiate VRF domains");
|
|
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
|
MODULE_ALIAS_RTNL_LINK(DRV_NAME);
|
|
|
|
|
MODULE_VERSION(DRV_VERSION);
|