Merge branch 'linus' into x86/memtest
[linux-2.6] / net / ipv4 / ipip.c
1 /*
2  *      Linux NET3:     IP/IP protocol decoder.
3  *
4  *      Version: $Id: ipip.c,v 1.50 2001/10/02 02:22:36 davem Exp $
5  *
6  *      Authors:
7  *              Sam Lantinga (slouken@cs.ucdavis.edu)  02/01/95
8  *
9  *      Fixes:
10  *              Alan Cox        :       Merged and made usable non modular (its so tiny its silly as
11  *                                      a module taking up 2 pages).
12  *              Alan Cox        :       Fixed bug with 1.3.18 and IPIP not working (now needs to set skb->h.iph)
13  *                                      to keep ip_forward happy.
14  *              Alan Cox        :       More fixes for 1.3.21, and firewall fix. Maybe this will work soon 8).
15  *              Kai Schulte     :       Fixed #defines for IP_FIREWALL->FIREWALL
16  *              David Woodhouse :       Perform some basic ICMP handling.
17  *                                      IPIP Routing without decapsulation.
18  *              Carlos Picoto   :       GRE over IP support
19  *              Alexey Kuznetsov:       Reworked. Really, now it is truncated version of ipv4/ip_gre.c.
20  *                                      I do not want to merge them together.
21  *
22  *      This program is free software; you can redistribute it and/or
23  *      modify it under the terms of the GNU General Public License
24  *      as published by the Free Software Foundation; either version
25  *      2 of the License, or (at your option) any later version.
26  *
27  */
28
29 /* tunnel.c: an IP tunnel driver
30
31         The purpose of this driver is to provide an IP tunnel through
32         which you can tunnel network traffic transparently across subnets.
33
34         This was written by looking at Nick Holloway's dummy driver
35         Thanks for the great code!
36
37                 -Sam Lantinga   (slouken@cs.ucdavis.edu)  02/01/95
38
39         Minor tweaks:
40                 Cleaned up the code a little and added some pre-1.3.0 tweaks.
41                 dev->hard_header/hard_header_len changed to use no headers.
42                 Comments/bracketing tweaked.
43                 Made the tunnels use dev->name not tunnel: when error reporting.
44                 Added tx_dropped stat
45
46                 -Alan Cox       (Alan.Cox@linux.org) 21 March 95
47
48         Reworked:
49                 Changed to tunnel to destination gateway in addition to the
50                         tunnel's pointopoint address
51                 Almost completely rewritten
52                 Note:  There is currently no firewall or ICMP handling done.
53
54                 -Sam Lantinga   (slouken@cs.ucdavis.edu) 02/13/96
55
56 */
57
58 /* Things I wish I had known when writing the tunnel driver:
59
60         When the tunnel_xmit() function is called, the skb contains the
61         packet to be sent (plus a great deal of extra info), and dev
62         contains the tunnel device that _we_ are.
63
64         When we are passed a packet, we are expected to fill in the
65         source address with our source IP address.
66
67         What is the proper way to allocate, copy and free a buffer?
68         After you allocate it, it is a "0 length" chunk of memory
69         starting at zero.  If you want to add headers to the buffer
70         later, you'll have to call "skb_reserve(skb, amount)" with
71         the amount of memory you want reserved.  Then, you call
72         "skb_put(skb, amount)" with the amount of space you want in
73         the buffer.  skb_put() returns a pointer to the top (#0) of
74         that buffer.  skb->len is set to the amount of space you have
75         "allocated" with skb_put().  You can then write up to skb->len
76         bytes to that buffer.  If you need more, you can call skb_put()
77         again with the additional amount of space you need.  You can
78         find out how much more space you can allocate by calling
79         "skb_tailroom(skb)".
80         Now, to add header space, call "skb_push(skb, header_len)".
81         This creates space at the beginning of the buffer and returns
82         a pointer to this new space.  If later you need to strip a
83         header from a buffer, call "skb_pull(skb, header_len)".
84         skb_headroom() will return how much space is left at the top
85         of the buffer (before the main data).  Remember, this headroom
86         space must be reserved before the skb_put() function is called.
87         */
88
89 /*
90    This version of net/ipv4/ipip.c is cloned of net/ipv4/ip_gre.c
91
92    For comments look at net/ipv4/ip_gre.c --ANK
93  */
94
95
96 #include <linux/capability.h>
97 #include <linux/module.h>
98 #include <linux/types.h>
99 #include <linux/kernel.h>
100 #include <asm/uaccess.h>
101 #include <linux/skbuff.h>
102 #include <linux/netdevice.h>
103 #include <linux/in.h>
104 #include <linux/tcp.h>
105 #include <linux/udp.h>
106 #include <linux/if_arp.h>
107 #include <linux/mroute.h>
108 #include <linux/init.h>
109 #include <linux/netfilter_ipv4.h>
110 #include <linux/if_ether.h>
111
112 #include <net/sock.h>
113 #include <net/ip.h>
114 #include <net/icmp.h>
115 #include <net/ipip.h>
116 #include <net/inet_ecn.h>
117 #include <net/xfrm.h>
118 #include <net/net_namespace.h>
119 #include <net/netns/generic.h>
120
121 #define HASH_SIZE  16
122 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
123
124 static int ipip_net_id;
125 struct ipip_net {
126         struct ip_tunnel *tunnels_r_l[HASH_SIZE];
127         struct ip_tunnel *tunnels_r[HASH_SIZE];
128         struct ip_tunnel *tunnels_l[HASH_SIZE];
129         struct ip_tunnel *tunnels_wc[1];
130         struct ip_tunnel **tunnels[4];
131
132         struct net_device *fb_tunnel_dev;
133 };
134
135 static int ipip_fb_tunnel_init(struct net_device *dev);
136 static int ipip_tunnel_init(struct net_device *dev);
137 static void ipip_tunnel_setup(struct net_device *dev);
138
139 static DEFINE_RWLOCK(ipip_lock);
140
141 static struct ip_tunnel * ipip_tunnel_lookup(struct net *net,
142                 __be32 remote, __be32 local)
143 {
144         unsigned h0 = HASH(remote);
145         unsigned h1 = HASH(local);
146         struct ip_tunnel *t;
147         struct ipip_net *ipn = net_generic(net, ipip_net_id);
148
149         for (t = ipn->tunnels_r_l[h0^h1]; t; t = t->next) {
150                 if (local == t->parms.iph.saddr &&
151                     remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
152                         return t;
153         }
154         for (t = ipn->tunnels_r[h0]; t; t = t->next) {
155                 if (remote == t->parms.iph.daddr && (t->dev->flags&IFF_UP))
156                         return t;
157         }
158         for (t = ipn->tunnels_l[h1]; t; t = t->next) {
159                 if (local == t->parms.iph.saddr && (t->dev->flags&IFF_UP))
160                         return t;
161         }
162         if ((t = ipn->tunnels_wc[0]) != NULL && (t->dev->flags&IFF_UP))
163                 return t;
164         return NULL;
165 }
166
167 static struct ip_tunnel **__ipip_bucket(struct ipip_net *ipn,
168                 struct ip_tunnel_parm *parms)
169 {
170         __be32 remote = parms->iph.daddr;
171         __be32 local = parms->iph.saddr;
172         unsigned h = 0;
173         int prio = 0;
174
175         if (remote) {
176                 prio |= 2;
177                 h ^= HASH(remote);
178         }
179         if (local) {
180                 prio |= 1;
181                 h ^= HASH(local);
182         }
183         return &ipn->tunnels[prio][h];
184 }
185
186 static inline struct ip_tunnel **ipip_bucket(struct ipip_net *ipn,
187                 struct ip_tunnel *t)
188 {
189         return __ipip_bucket(ipn, &t->parms);
190 }
191
192 static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
193 {
194         struct ip_tunnel **tp;
195
196         for (tp = ipip_bucket(ipn, t); *tp; tp = &(*tp)->next) {
197                 if (t == *tp) {
198                         write_lock_bh(&ipip_lock);
199                         *tp = t->next;
200                         write_unlock_bh(&ipip_lock);
201                         break;
202                 }
203         }
204 }
205
206 static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
207 {
208         struct ip_tunnel **tp = ipip_bucket(ipn, t);
209
210         t->next = *tp;
211         write_lock_bh(&ipip_lock);
212         *tp = t;
213         write_unlock_bh(&ipip_lock);
214 }
215
216 static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
217                 struct ip_tunnel_parm *parms, int create)
218 {
219         __be32 remote = parms->iph.daddr;
220         __be32 local = parms->iph.saddr;
221         struct ip_tunnel *t, **tp, *nt;
222         struct net_device *dev;
223         char name[IFNAMSIZ];
224         struct ipip_net *ipn = net_generic(net, ipip_net_id);
225
226         for (tp = __ipip_bucket(ipn, parms); (t = *tp) != NULL; tp = &t->next) {
227                 if (local == t->parms.iph.saddr && remote == t->parms.iph.daddr)
228                         return t;
229         }
230         if (!create)
231                 return NULL;
232
233         if (parms->name[0])
234                 strlcpy(name, parms->name, IFNAMSIZ);
235         else
236                 sprintf(name, "tunl%%d");
237
238         dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
239         if (dev == NULL)
240                 return NULL;
241
242         dev_net_set(dev, net);
243
244         if (strchr(name, '%')) {
245                 if (dev_alloc_name(dev, name) < 0)
246                         goto failed_free;
247         }
248
249         nt = netdev_priv(dev);
250         dev->init = ipip_tunnel_init;
251         nt->parms = *parms;
252
253         if (register_netdevice(dev) < 0)
254                 goto failed_free;
255
256         dev_hold(dev);
257         ipip_tunnel_link(ipn, nt);
258         return nt;
259
260 failed_free:
261         free_netdev(dev);
262         return NULL;
263 }
264
265 static void ipip_tunnel_uninit(struct net_device *dev)
266 {
267         struct net *net = dev_net(dev);
268         struct ipip_net *ipn = net_generic(net, ipip_net_id);
269
270         if (dev == ipn->fb_tunnel_dev) {
271                 write_lock_bh(&ipip_lock);
272                 ipn->tunnels_wc[0] = NULL;
273                 write_unlock_bh(&ipip_lock);
274         } else
275                 ipip_tunnel_unlink(ipn, netdev_priv(dev));
276         dev_put(dev);
277 }
278
279 static int ipip_err(struct sk_buff *skb, u32 info)
280 {
281
282 /* All the routers (except for Linux) return only
283    8 bytes of packet payload. It means, that precise relaying of
284    ICMP in the real Internet is absolutely infeasible.
285  */
286         struct iphdr *iph = (struct iphdr*)skb->data;
287         const int type = icmp_hdr(skb)->type;
288         const int code = icmp_hdr(skb)->code;
289         struct ip_tunnel *t;
290         int err;
291
292         switch (type) {
293         default:
294         case ICMP_PARAMETERPROB:
295                 return 0;
296
297         case ICMP_DEST_UNREACH:
298                 switch (code) {
299                 case ICMP_SR_FAILED:
300                 case ICMP_PORT_UNREACH:
301                         /* Impossible event. */
302                         return 0;
303                 case ICMP_FRAG_NEEDED:
304                         /* Soft state for pmtu is maintained by IP core. */
305                         return 0;
306                 default:
307                         /* All others are translated to HOST_UNREACH.
308                            rfc2003 contains "deep thoughts" about NET_UNREACH,
309                            I believe they are just ether pollution. --ANK
310                          */
311                         break;
312                 }
313                 break;
314         case ICMP_TIME_EXCEEDED:
315                 if (code != ICMP_EXC_TTL)
316                         return 0;
317                 break;
318         }
319
320         err = -ENOENT;
321
322         read_lock(&ipip_lock);
323         t = ipip_tunnel_lookup(dev_net(skb->dev), iph->daddr, iph->saddr);
324         if (t == NULL || t->parms.iph.daddr == 0)
325                 goto out;
326
327         err = 0;
328         if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED)
329                 goto out;
330
331         if (jiffies - t->err_time < IPTUNNEL_ERR_TIMEO)
332                 t->err_count++;
333         else
334                 t->err_count = 1;
335         t->err_time = jiffies;
336 out:
337         read_unlock(&ipip_lock);
338         return err;
339 }
340
341 static inline void ipip_ecn_decapsulate(const struct iphdr *outer_iph,
342                                         struct sk_buff *skb)
343 {
344         struct iphdr *inner_iph = ip_hdr(skb);
345
346         if (INET_ECN_is_ce(outer_iph->tos))
347                 IP_ECN_set_ce(inner_iph);
348 }
349
350 static int ipip_rcv(struct sk_buff *skb)
351 {
352         struct ip_tunnel *tunnel;
353         const struct iphdr *iph = ip_hdr(skb);
354
355         read_lock(&ipip_lock);
356         if ((tunnel = ipip_tunnel_lookup(dev_net(skb->dev),
357                                         iph->saddr, iph->daddr)) != NULL) {
358                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
359                         read_unlock(&ipip_lock);
360                         kfree_skb(skb);
361                         return 0;
362                 }
363
364                 secpath_reset(skb);
365
366                 skb->mac_header = skb->network_header;
367                 skb_reset_network_header(skb);
368                 skb->protocol = htons(ETH_P_IP);
369                 skb->pkt_type = PACKET_HOST;
370
371                 tunnel->stat.rx_packets++;
372                 tunnel->stat.rx_bytes += skb->len;
373                 skb->dev = tunnel->dev;
374                 dst_release(skb->dst);
375                 skb->dst = NULL;
376                 nf_reset(skb);
377                 ipip_ecn_decapsulate(iph, skb);
378                 netif_rx(skb);
379                 read_unlock(&ipip_lock);
380                 return 0;
381         }
382         read_unlock(&ipip_lock);
383
384         return -1;
385 }
386
387 /*
388  *      This function assumes it is being called from dev_queue_xmit()
389  *      and that skb is filled properly by that function.
390  */
391
392 static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
393 {
394         struct ip_tunnel *tunnel = netdev_priv(dev);
395         struct net_device_stats *stats = &tunnel->stat;
396         struct iphdr  *tiph = &tunnel->parms.iph;
397         u8     tos = tunnel->parms.iph.tos;
398         __be16 df = tiph->frag_off;
399         struct rtable *rt;                      /* Route to the other host */
400         struct net_device *tdev;                        /* Device to other host */
401         struct iphdr  *old_iph = ip_hdr(skb);
402         struct iphdr  *iph;                     /* Our new IP header */
403         unsigned int max_headroom;              /* The extra header space needed */
404         __be32 dst = tiph->daddr;
405         int    mtu;
406
407         if (tunnel->recursion++) {
408                 tunnel->stat.collisions++;
409                 goto tx_error;
410         }
411
412         if (skb->protocol != htons(ETH_P_IP))
413                 goto tx_error;
414
415         if (tos&1)
416                 tos = old_iph->tos;
417
418         if (!dst) {
419                 /* NBMA tunnel */
420                 if ((rt = skb->rtable) == NULL) {
421                         tunnel->stat.tx_fifo_errors++;
422                         goto tx_error;
423                 }
424                 if ((dst = rt->rt_gateway) == 0)
425                         goto tx_error_icmp;
426         }
427
428         {
429                 struct flowi fl = { .oif = tunnel->parms.link,
430                                     .nl_u = { .ip4_u =
431                                               { .daddr = dst,
432                                                 .saddr = tiph->saddr,
433                                                 .tos = RT_TOS(tos) } },
434                                     .proto = IPPROTO_IPIP };
435                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
436                         tunnel->stat.tx_carrier_errors++;
437                         goto tx_error_icmp;
438                 }
439         }
440         tdev = rt->u.dst.dev;
441
442         if (tdev == dev) {
443                 ip_rt_put(rt);
444                 tunnel->stat.collisions++;
445                 goto tx_error;
446         }
447
448         if (tiph->frag_off)
449                 mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
450         else
451                 mtu = skb->dst ? dst_mtu(skb->dst) : dev->mtu;
452
453         if (mtu < 68) {
454                 tunnel->stat.collisions++;
455                 ip_rt_put(rt);
456                 goto tx_error;
457         }
458         if (skb->dst)
459                 skb->dst->ops->update_pmtu(skb->dst, mtu);
460
461         df |= (old_iph->frag_off&htons(IP_DF));
462
463         if ((old_iph->frag_off&htons(IP_DF)) && mtu < ntohs(old_iph->tot_len)) {
464                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
465                 ip_rt_put(rt);
466                 goto tx_error;
467         }
468
469         if (tunnel->err_count > 0) {
470                 if (jiffies - tunnel->err_time < IPTUNNEL_ERR_TIMEO) {
471                         tunnel->err_count--;
472                         dst_link_failure(skb);
473                 } else
474                         tunnel->err_count = 0;
475         }
476
477         /*
478          * Okay, now see if we can stuff it in the buffer as-is.
479          */
480         max_headroom = (LL_RESERVED_SPACE(tdev)+sizeof(struct iphdr));
481
482         if (skb_headroom(skb) < max_headroom || skb_shared(skb) ||
483             (skb_cloned(skb) && !skb_clone_writable(skb, 0))) {
484                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
485                 if (!new_skb) {
486                         ip_rt_put(rt);
487                         stats->tx_dropped++;
488                         dev_kfree_skb(skb);
489                         tunnel->recursion--;
490                         return 0;
491                 }
492                 if (skb->sk)
493                         skb_set_owner_w(new_skb, skb->sk);
494                 dev_kfree_skb(skb);
495                 skb = new_skb;
496                 old_iph = ip_hdr(skb);
497         }
498
499         skb->transport_header = skb->network_header;
500         skb_push(skb, sizeof(struct iphdr));
501         skb_reset_network_header(skb);
502         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
503         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
504                               IPSKB_REROUTED);
505         dst_release(skb->dst);
506         skb->dst = &rt->u.dst;
507
508         /*
509          *      Push down and install the IPIP header.
510          */
511
512         iph                     =       ip_hdr(skb);
513         iph->version            =       4;
514         iph->ihl                =       sizeof(struct iphdr)>>2;
515         iph->frag_off           =       df;
516         iph->protocol           =       IPPROTO_IPIP;
517         iph->tos                =       INET_ECN_encapsulate(tos, old_iph->tos);
518         iph->daddr              =       rt->rt_dst;
519         iph->saddr              =       rt->rt_src;
520
521         if ((iph->ttl = tiph->ttl) == 0)
522                 iph->ttl        =       old_iph->ttl;
523
524         nf_reset(skb);
525
526         IPTUNNEL_XMIT();
527         tunnel->recursion--;
528         return 0;
529
530 tx_error_icmp:
531         dst_link_failure(skb);
532 tx_error:
533         stats->tx_errors++;
534         dev_kfree_skb(skb);
535         tunnel->recursion--;
536         return 0;
537 }
538
539 static void ipip_tunnel_bind_dev(struct net_device *dev)
540 {
541         struct net_device *tdev = NULL;
542         struct ip_tunnel *tunnel;
543         struct iphdr *iph;
544
545         tunnel = netdev_priv(dev);
546         iph = &tunnel->parms.iph;
547
548         if (iph->daddr) {
549                 struct flowi fl = { .oif = tunnel->parms.link,
550                                     .nl_u = { .ip4_u =
551                                               { .daddr = iph->daddr,
552                                                 .saddr = iph->saddr,
553                                                 .tos = RT_TOS(iph->tos) } },
554                                     .proto = IPPROTO_IPIP };
555                 struct rtable *rt;
556                 if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
557                         tdev = rt->u.dst.dev;
558                         ip_rt_put(rt);
559                 }
560                 dev->flags |= IFF_POINTOPOINT;
561         }
562
563         if (!tdev && tunnel->parms.link)
564                 tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
565
566         if (tdev) {
567                 dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
568                 dev->mtu = tdev->mtu - sizeof(struct iphdr);
569         }
570         dev->iflink = tunnel->parms.link;
571 }
572
573 static int
574 ipip_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
575 {
576         int err = 0;
577         struct ip_tunnel_parm p;
578         struct ip_tunnel *t;
579         struct net *net = dev_net(dev);
580         struct ipip_net *ipn = net_generic(net, ipip_net_id);
581
582         switch (cmd) {
583         case SIOCGETTUNNEL:
584                 t = NULL;
585                 if (dev == ipn->fb_tunnel_dev) {
586                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
587                                 err = -EFAULT;
588                                 break;
589                         }
590                         t = ipip_tunnel_locate(net, &p, 0);
591                 }
592                 if (t == NULL)
593                         t = netdev_priv(dev);
594                 memcpy(&p, &t->parms, sizeof(p));
595                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
596                         err = -EFAULT;
597                 break;
598
599         case SIOCADDTUNNEL:
600         case SIOCCHGTUNNEL:
601                 err = -EPERM;
602                 if (!capable(CAP_NET_ADMIN))
603                         goto done;
604
605                 err = -EFAULT;
606                 if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
607                         goto done;
608
609                 err = -EINVAL;
610                 if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPIP ||
611                     p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
612                         goto done;
613                 if (p.iph.ttl)
614                         p.iph.frag_off |= htons(IP_DF);
615
616                 t = ipip_tunnel_locate(net, &p, cmd == SIOCADDTUNNEL);
617
618                 if (dev != ipn->fb_tunnel_dev && cmd == SIOCCHGTUNNEL) {
619                         if (t != NULL) {
620                                 if (t->dev != dev) {
621                                         err = -EEXIST;
622                                         break;
623                                 }
624                         } else {
625                                 if (((dev->flags&IFF_POINTOPOINT) && !p.iph.daddr) ||
626                                     (!(dev->flags&IFF_POINTOPOINT) && p.iph.daddr)) {
627                                         err = -EINVAL;
628                                         break;
629                                 }
630                                 t = netdev_priv(dev);
631                                 ipip_tunnel_unlink(ipn, t);
632                                 t->parms.iph.saddr = p.iph.saddr;
633                                 t->parms.iph.daddr = p.iph.daddr;
634                                 memcpy(dev->dev_addr, &p.iph.saddr, 4);
635                                 memcpy(dev->broadcast, &p.iph.daddr, 4);
636                                 ipip_tunnel_link(ipn, t);
637                                 netdev_state_change(dev);
638                         }
639                 }
640
641                 if (t) {
642                         err = 0;
643                         if (cmd == SIOCCHGTUNNEL) {
644                                 t->parms.iph.ttl = p.iph.ttl;
645                                 t->parms.iph.tos = p.iph.tos;
646                                 t->parms.iph.frag_off = p.iph.frag_off;
647                                 if (t->parms.link != p.link) {
648                                         t->parms.link = p.link;
649                                         ipip_tunnel_bind_dev(dev);
650                                         netdev_state_change(dev);
651                                 }
652                         }
653                         if (copy_to_user(ifr->ifr_ifru.ifru_data, &t->parms, sizeof(p)))
654                                 err = -EFAULT;
655                 } else
656                         err = (cmd == SIOCADDTUNNEL ? -ENOBUFS : -ENOENT);
657                 break;
658
659         case SIOCDELTUNNEL:
660                 err = -EPERM;
661                 if (!capable(CAP_NET_ADMIN))
662                         goto done;
663
664                 if (dev == ipn->fb_tunnel_dev) {
665                         err = -EFAULT;
666                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p)))
667                                 goto done;
668                         err = -ENOENT;
669                         if ((t = ipip_tunnel_locate(net, &p, 0)) == NULL)
670                                 goto done;
671                         err = -EPERM;
672                         if (t->dev == ipn->fb_tunnel_dev)
673                                 goto done;
674                         dev = t->dev;
675                 }
676                 unregister_netdevice(dev);
677                 err = 0;
678                 break;
679
680         default:
681                 err = -EINVAL;
682         }
683
684 done:
685         return err;
686 }
687
688 static struct net_device_stats *ipip_tunnel_get_stats(struct net_device *dev)
689 {
690         return &(((struct ip_tunnel*)netdev_priv(dev))->stat);
691 }
692
693 static int ipip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
694 {
695         if (new_mtu < 68 || new_mtu > 0xFFF8 - sizeof(struct iphdr))
696                 return -EINVAL;
697         dev->mtu = new_mtu;
698         return 0;
699 }
700
701 static void ipip_tunnel_setup(struct net_device *dev)
702 {
703         dev->uninit             = ipip_tunnel_uninit;
704         dev->hard_start_xmit    = ipip_tunnel_xmit;
705         dev->get_stats          = ipip_tunnel_get_stats;
706         dev->do_ioctl           = ipip_tunnel_ioctl;
707         dev->change_mtu         = ipip_tunnel_change_mtu;
708         dev->destructor         = free_netdev;
709
710         dev->type               = ARPHRD_TUNNEL;
711         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
712         dev->mtu                = ETH_DATA_LEN - sizeof(struct iphdr);
713         dev->flags              = IFF_NOARP;
714         dev->iflink             = 0;
715         dev->addr_len           = 4;
716         dev->features           |= NETIF_F_NETNS_LOCAL;
717 }
718
719 static int ipip_tunnel_init(struct net_device *dev)
720 {
721         struct ip_tunnel *tunnel;
722
723         tunnel = netdev_priv(dev);
724
725         tunnel->dev = dev;
726         strcpy(tunnel->parms.name, dev->name);
727
728         memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
729         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
730
731         ipip_tunnel_bind_dev(dev);
732
733         return 0;
734 }
735
736 static int ipip_fb_tunnel_init(struct net_device *dev)
737 {
738         struct ip_tunnel *tunnel = netdev_priv(dev);
739         struct iphdr *iph = &tunnel->parms.iph;
740         struct ipip_net *ipn = net_generic(dev_net(dev), ipip_net_id);
741
742         tunnel->dev = dev;
743         strcpy(tunnel->parms.name, dev->name);
744
745         iph->version            = 4;
746         iph->protocol           = IPPROTO_IPIP;
747         iph->ihl                = 5;
748
749         dev_hold(dev);
750         ipn->tunnels_wc[0]      = tunnel;
751         return 0;
752 }
753
754 static struct xfrm_tunnel ipip_handler = {
755         .handler        =       ipip_rcv,
756         .err_handler    =       ipip_err,
757         .priority       =       1,
758 };
759
760 static char banner[] __initdata =
761         KERN_INFO "IPv4 over IPv4 tunneling driver\n";
762
763 static void ipip_destroy_tunnels(struct ipip_net *ipn)
764 {
765         int prio;
766
767         for (prio = 1; prio < 4; prio++) {
768                 int h;
769                 for (h = 0; h < HASH_SIZE; h++) {
770                         struct ip_tunnel *t;
771                         while ((t = ipn->tunnels[prio][h]) != NULL)
772                                 unregister_netdevice(t->dev);
773                 }
774         }
775 }
776
777 static int ipip_init_net(struct net *net)
778 {
779         int err;
780         struct ipip_net *ipn;
781
782         err = -ENOMEM;
783         ipn = kzalloc(sizeof(struct ipip_net), GFP_KERNEL);
784         if (ipn == NULL)
785                 goto err_alloc;
786
787         err = net_assign_generic(net, ipip_net_id, ipn);
788         if (err < 0)
789                 goto err_assign;
790
791         ipn->tunnels[0] = ipn->tunnels_wc;
792         ipn->tunnels[1] = ipn->tunnels_l;
793         ipn->tunnels[2] = ipn->tunnels_r;
794         ipn->tunnels[3] = ipn->tunnels_r_l;
795
796         ipn->fb_tunnel_dev = alloc_netdev(sizeof(struct ip_tunnel),
797                                            "tunl0",
798                                            ipip_tunnel_setup);
799         if (!ipn->fb_tunnel_dev) {
800                 err = -ENOMEM;
801                 goto err_alloc_dev;
802         }
803
804         ipn->fb_tunnel_dev->init = ipip_fb_tunnel_init;
805         dev_net_set(ipn->fb_tunnel_dev, net);
806
807         if ((err = register_netdev(ipn->fb_tunnel_dev)))
808                 goto err_reg_dev;
809
810         return 0;
811
812 err_reg_dev:
813         free_netdev(ipn->fb_tunnel_dev);
814 err_alloc_dev:
815         /* nothing */
816 err_assign:
817         kfree(ipn);
818 err_alloc:
819         return err;
820 }
821
822 static void ipip_exit_net(struct net *net)
823 {
824         struct ipip_net *ipn;
825
826         ipn = net_generic(net, ipip_net_id);
827         rtnl_lock();
828         ipip_destroy_tunnels(ipn);
829         unregister_netdevice(ipn->fb_tunnel_dev);
830         rtnl_unlock();
831         kfree(ipn);
832 }
833
834 static struct pernet_operations ipip_net_ops = {
835         .init = ipip_init_net,
836         .exit = ipip_exit_net,
837 };
838
839 static int __init ipip_init(void)
840 {
841         int err;
842
843         printk(banner);
844
845         if (xfrm4_tunnel_register(&ipip_handler, AF_INET)) {
846                 printk(KERN_INFO "ipip init: can't register tunnel\n");
847                 return -EAGAIN;
848         }
849
850         err = register_pernet_gen_device(&ipip_net_id, &ipip_net_ops);
851         if (err)
852                 xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
853
854         return err;
855 }
856
857 static void __exit ipip_fini(void)
858 {
859         if (xfrm4_tunnel_deregister(&ipip_handler, AF_INET))
860                 printk(KERN_INFO "ipip close: can't deregister tunnel\n");
861
862         unregister_pernet_gen_device(ipip_net_id, &ipip_net_ops);
863 }
864
865 module_init(ipip_init);
866 module_exit(ipip_fini);
867 MODULE_LICENSE("GPL");