2019-05-27 00:55:01 -06:00
|
|
|
// SPDX-License-Identifier: GPL-2.0-or-later
|
2014-11-24 00:07:46 -07:00
|
|
|
/* Copyright (c) 2014 Mahesh Bandewar <maheshb@google.com>
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include "ipvlan.h"
|
|
|
|
|
|
2018-12-06 10:05:40 -07:00
|
|
|
static int ipvlan_set_port_mode(struct ipvl_port *port, u16 nval,
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan;
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
unsigned int flags;
|
|
|
|
|
int err;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2016-09-16 13:59:19 -06:00
|
|
|
ASSERT_RTNL();
|
2014-11-24 00:07:46 -07:00
|
|
|
if (port->mode != nval) {
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
|
|
|
|
|
flags = ipvlan->dev->flags;
|
|
|
|
|
if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) {
|
|
|
|
|
err = dev_change_flags(ipvlan->dev,
|
2018-12-06 10:05:42 -07:00
|
|
|
flags | IFF_NOARP,
|
|
|
|
|
extack);
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
} else {
|
|
|
|
|
err = dev_change_flags(ipvlan->dev,
|
2018-12-06 10:05:42 -07:00
|
|
|
flags & ~IFF_NOARP,
|
|
|
|
|
extack);
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
}
|
|
|
|
|
if (unlikely(err))
|
|
|
|
|
goto fail;
|
|
|
|
|
}
|
2016-09-16 13:59:19 -06:00
|
|
|
if (nval == IPVLAN_MODE_L3S) {
|
|
|
|
|
/* New mode is L3S */
|
2019-02-08 05:55:31 -07:00
|
|
|
err = ipvlan_l3s_register(port);
|
|
|
|
|
if (err)
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
goto fail;
|
2016-09-16 13:59:19 -06:00
|
|
|
} else if (port->mode == IPVLAN_MODE_L3S) {
|
|
|
|
|
/* Old mode was L3S */
|
2019-02-08 05:55:31 -07:00
|
|
|
ipvlan_l3s_unregister(port);
|
2016-09-16 13:59:19 -06:00
|
|
|
}
|
2014-11-24 00:07:46 -07:00
|
|
|
port->mode = nval;
|
|
|
|
|
}
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
fail:
|
|
|
|
|
/* Undo the flags changes that have been done so far. */
|
|
|
|
|
list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) {
|
|
|
|
|
flags = ipvlan->dev->flags;
|
|
|
|
|
if (port->mode == IPVLAN_MODE_L3 ||
|
|
|
|
|
port->mode == IPVLAN_MODE_L3S)
|
2018-12-06 10:05:42 -07:00
|
|
|
dev_change_flags(ipvlan->dev, flags | IFF_NOARP,
|
|
|
|
|
NULL);
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
else
|
2018-12-06 10:05:42 -07:00
|
|
|
dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP,
|
|
|
|
|
NULL);
|
ipvlan: call dev_change_flags when ipvlan mode is reset
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-07-01 02:21:21 -06:00
|
|
|
}
|
|
|
|
|
|
2016-09-16 13:59:19 -06:00
|
|
|
return err;
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int ipvlan_port_create(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_port *port;
|
|
|
|
|
int err, idx;
|
|
|
|
|
|
|
|
|
|
port = kzalloc(sizeof(struct ipvl_port), GFP_KERNEL);
|
|
|
|
|
if (!port)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
2017-04-20 10:08:15 -06:00
|
|
|
write_pnet(&port->pnet, dev_net(dev));
|
2014-11-24 00:07:46 -07:00
|
|
|
port->dev = dev;
|
|
|
|
|
port->mode = IPVLAN_MODE_L3;
|
|
|
|
|
INIT_LIST_HEAD(&port->ipvlans);
|
|
|
|
|
for (idx = 0; idx < IPVLAN_HASH_SIZE; idx++)
|
|
|
|
|
INIT_HLIST_HEAD(&port->hlhead[idx]);
|
|
|
|
|
|
2015-05-04 18:06:03 -06:00
|
|
|
skb_queue_head_init(&port->backlog);
|
|
|
|
|
INIT_WORK(&port->wq, ipvlan_process_multicast);
|
2017-01-03 13:47:16 -07:00
|
|
|
ida_init(&port->ida);
|
2017-01-09 16:05:54 -07:00
|
|
|
port->dev_id_start = 1;
|
2015-05-04 18:06:03 -06:00
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
err = netdev_rx_handler_register(dev, ipvlan_handle_frame, port);
|
|
|
|
|
if (err)
|
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
err:
|
2016-12-06 17:44:47 -07:00
|
|
|
kfree(port);
|
2014-11-24 00:07:46 -07:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_port_destroy(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_port *port = ipvlan_port_get_rtnl(dev);
|
2016-12-21 19:00:24 -07:00
|
|
|
struct sk_buff *skb;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2019-02-08 05:55:31 -07:00
|
|
|
if (port->mode == IPVLAN_MODE_L3S)
|
|
|
|
|
ipvlan_l3s_unregister(port);
|
2014-11-24 00:07:46 -07:00
|
|
|
netdev_rx_handler_unregister(dev);
|
2015-05-04 18:06:03 -06:00
|
|
|
cancel_work_sync(&port->wq);
|
2016-12-21 19:00:24 -07:00
|
|
|
while ((skb = __skb_dequeue(&port->backlog)) != NULL) {
|
|
|
|
|
if (skb->dev)
|
|
|
|
|
dev_put(skb->dev);
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
}
|
2017-01-03 13:47:16 -07:00
|
|
|
ida_destroy(&port->ida);
|
2016-12-06 17:44:47 -07:00
|
|
|
kfree(port);
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#define IPVLAN_FEATURES \
|
2019-06-04 00:07:34 -06:00
|
|
|
(NETIF_F_SG | NETIF_F_CSUM_MASK | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
|
2017-07-03 07:32:14 -06:00
|
|
|
NETIF_F_GSO | NETIF_F_TSO | NETIF_F_GSO_ROBUST | \
|
2014-11-24 00:07:46 -07:00
|
|
|
NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
|
|
|
|
|
NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
|
|
|
|
|
|
|
|
|
|
#define IPVLAN_STATE_MASK \
|
|
|
|
|
((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
|
|
|
|
|
|
|
|
|
|
static int ipvlan_init(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
2017-11-17 00:16:17 -07:00
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
struct ipvl_port *port;
|
|
|
|
|
int err;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
dev->state = (dev->state & ~IPVLAN_STATE_MASK) |
|
|
|
|
|
(phy_dev->state & IPVLAN_STATE_MASK);
|
|
|
|
|
dev->features = phy_dev->features & IPVLAN_FEATURES;
|
2018-03-02 08:03:32 -07:00
|
|
|
dev->features |= NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED;
|
2019-08-14 18:10:43 -06:00
|
|
|
dev->hw_enc_features |= dev->features;
|
2014-11-24 00:07:46 -07:00
|
|
|
dev->gso_max_size = phy_dev->gso_max_size;
|
2016-03-16 22:59:49 -06:00
|
|
|
dev->gso_max_segs = phy_dev->gso_max_segs;
|
2014-11-24 00:07:46 -07:00
|
|
|
dev->hard_header_len = phy_dev->hard_header_len;
|
|
|
|
|
|
2017-08-01 13:11:13 -06:00
|
|
|
ipvlan->pcpu_stats = netdev_alloc_pcpu_stats(struct ipvl_pcpu_stats);
|
2014-11-24 00:07:46 -07:00
|
|
|
if (!ipvlan->pcpu_stats)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
if (!netif_is_ipvlan_port(phy_dev)) {
|
|
|
|
|
err = ipvlan_port_create(phy_dev);
|
|
|
|
|
if (err < 0) {
|
|
|
|
|
free_percpu(ipvlan->pcpu_stats);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
port = ipvlan_port_get_rtnl(phy_dev);
|
2016-04-27 15:59:27 -06:00
|
|
|
port->count += 1;
|
2014-11-24 00:07:46 -07:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_uninit(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
2017-11-17 00:16:17 -07:00
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
struct ipvl_port *port;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2014-11-29 08:23:20 -07:00
|
|
|
free_percpu(ipvlan->pcpu_stats);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
port = ipvlan_port_get_rtnl(phy_dev);
|
2014-11-24 00:07:46 -07:00
|
|
|
port->count -= 1;
|
|
|
|
|
if (!port->count)
|
|
|
|
|
ipvlan_port_destroy(port->dev);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int ipvlan_open(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
struct ipvl_addr *addr;
|
|
|
|
|
|
2016-09-16 13:59:19 -06:00
|
|
|
if (ipvlan->port->mode == IPVLAN_MODE_L3 ||
|
|
|
|
|
ipvlan->port->mode == IPVLAN_MODE_L3S)
|
2014-11-24 00:07:46 -07:00
|
|
|
dev->flags |= IFF_NOARP;
|
|
|
|
|
else
|
|
|
|
|
dev->flags &= ~IFF_NOARP;
|
|
|
|
|
|
2018-02-28 02:59:27 -07:00
|
|
|
rcu_read_lock();
|
|
|
|
|
list_for_each_entry_rcu(addr, &ipvlan->addrs, anode)
|
2015-07-14 07:35:50 -06:00
|
|
|
ipvlan_ht_addr_add(ipvlan, addr);
|
2018-02-28 02:59:27 -07:00
|
|
|
rcu_read_unlock();
|
2015-07-14 07:35:50 -06:00
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
return dev_uc_add(phy_dev, phy_dev->dev_addr);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int ipvlan_stop(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
struct ipvl_addr *addr;
|
|
|
|
|
|
|
|
|
|
dev_uc_unsync(phy_dev, dev);
|
|
|
|
|
dev_mc_unsync(phy_dev, dev);
|
|
|
|
|
|
|
|
|
|
dev_uc_del(phy_dev, phy_dev->dev_addr);
|
|
|
|
|
|
2018-02-28 02:59:27 -07:00
|
|
|
rcu_read_lock();
|
|
|
|
|
list_for_each_entry_rcu(addr, &ipvlan->addrs, anode)
|
2015-07-14 07:35:53 -06:00
|
|
|
ipvlan_ht_addr_del(addr);
|
2018-02-28 02:59:27 -07:00
|
|
|
rcu_read_unlock();
|
2015-07-14 07:35:50 -06:00
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-25 22:24:43 -07:00
|
|
|
static netdev_tx_t ipvlan_start_xmit(struct sk_buff *skb,
|
|
|
|
|
struct net_device *dev)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
const struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
int skblen = skb->len;
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
ret = ipvlan_queue_xmit(skb, dev);
|
|
|
|
|
if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
|
|
|
|
|
struct ipvl_pcpu_stats *pcptr;
|
|
|
|
|
|
|
|
|
|
pcptr = this_cpu_ptr(ipvlan->pcpu_stats);
|
|
|
|
|
|
|
|
|
|
u64_stats_update_begin(&pcptr->syncp);
|
|
|
|
|
pcptr->tx_pkts++;
|
|
|
|
|
pcptr->tx_bytes += skblen;
|
|
|
|
|
u64_stats_update_end(&pcptr->syncp);
|
|
|
|
|
} else {
|
|
|
|
|
this_cpu_inc(ipvlan->pcpu_stats->tx_drps);
|
|
|
|
|
}
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static netdev_features_t ipvlan_fix_features(struct net_device *dev,
|
|
|
|
|
netdev_features_t features)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_change_rx_flags(struct net_device *dev, int change)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
|
|
|
|
|
if (change & IFF_ALLMULTI)
|
|
|
|
|
dev_set_allmulti(phy_dev, dev->flags & IFF_ALLMULTI? 1 : -1);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_set_multicast_mac_filter(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
if (dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) {
|
|
|
|
|
bitmap_fill(ipvlan->mac_filters, IPVLAN_MAC_FILTER_SIZE);
|
|
|
|
|
} else {
|
|
|
|
|
struct netdev_hw_addr *ha;
|
|
|
|
|
DECLARE_BITMAP(mc_filters, IPVLAN_MAC_FILTER_SIZE);
|
|
|
|
|
|
|
|
|
|
bitmap_zero(mc_filters, IPVLAN_MAC_FILTER_SIZE);
|
|
|
|
|
netdev_for_each_mc_addr(ha, dev)
|
|
|
|
|
__set_bit(ipvlan_mac_hash(ha->addr), mc_filters);
|
|
|
|
|
|
2015-05-04 18:06:11 -06:00
|
|
|
/* Turn-on broadcast bit irrespective of address family,
|
|
|
|
|
* since broadcast is deferred to a work-queue, hence no
|
|
|
|
|
* impact on fast-path processing.
|
|
|
|
|
*/
|
|
|
|
|
__set_bit(ipvlan_mac_hash(dev->broadcast), mc_filters);
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
bitmap_copy(ipvlan->mac_filters, mc_filters,
|
|
|
|
|
IPVLAN_MAC_FILTER_SIZE);
|
|
|
|
|
}
|
|
|
|
|
dev_uc_sync(ipvlan->phy_dev, dev);
|
|
|
|
|
dev_mc_sync(ipvlan->phy_dev, dev);
|
|
|
|
|
}
|
|
|
|
|
|
2017-01-06 20:12:52 -07:00
|
|
|
static void ipvlan_get_stats64(struct net_device *dev,
|
|
|
|
|
struct rtnl_link_stats64 *s)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
if (ipvlan->pcpu_stats) {
|
|
|
|
|
struct ipvl_pcpu_stats *pcptr;
|
|
|
|
|
u64 rx_pkts, rx_bytes, rx_mcast, tx_pkts, tx_bytes;
|
|
|
|
|
u32 rx_errs = 0, tx_drps = 0;
|
|
|
|
|
u32 strt;
|
|
|
|
|
int idx;
|
|
|
|
|
|
|
|
|
|
for_each_possible_cpu(idx) {
|
|
|
|
|
pcptr = per_cpu_ptr(ipvlan->pcpu_stats, idx);
|
|
|
|
|
do {
|
|
|
|
|
strt= u64_stats_fetch_begin_irq(&pcptr->syncp);
|
|
|
|
|
rx_pkts = pcptr->rx_pkts;
|
|
|
|
|
rx_bytes = pcptr->rx_bytes;
|
|
|
|
|
rx_mcast = pcptr->rx_mcast;
|
|
|
|
|
tx_pkts = pcptr->tx_pkts;
|
|
|
|
|
tx_bytes = pcptr->tx_bytes;
|
|
|
|
|
} while (u64_stats_fetch_retry_irq(&pcptr->syncp,
|
|
|
|
|
strt));
|
|
|
|
|
|
|
|
|
|
s->rx_packets += rx_pkts;
|
|
|
|
|
s->rx_bytes += rx_bytes;
|
|
|
|
|
s->multicast += rx_mcast;
|
|
|
|
|
s->tx_packets += tx_pkts;
|
|
|
|
|
s->tx_bytes += tx_bytes;
|
|
|
|
|
|
|
|
|
|
/* u32 values are updated without syncp protection. */
|
|
|
|
|
rx_errs += pcptr->rx_errs;
|
|
|
|
|
tx_drps += pcptr->tx_drps;
|
|
|
|
|
}
|
|
|
|
|
s->rx_errors = rx_errs;
|
|
|
|
|
s->rx_dropped = rx_errs;
|
|
|
|
|
s->tx_dropped = tx_drps;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int ipvlan_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
|
|
|
|
|
return vlan_vid_add(phy_dev, proto, vid);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int ipvlan_vlan_rx_kill_vid(struct net_device *dev, __be16 proto,
|
|
|
|
|
u16 vid)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
|
|
|
|
|
vlan_vid_del(phy_dev, proto, vid);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2015-04-02 09:07:06 -06:00
|
|
|
static int ipvlan_get_iflink(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
return ipvlan->phy_dev->ifindex;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
static const struct net_device_ops ipvlan_netdev_ops = {
|
|
|
|
|
.ndo_init = ipvlan_init,
|
|
|
|
|
.ndo_uninit = ipvlan_uninit,
|
|
|
|
|
.ndo_open = ipvlan_open,
|
|
|
|
|
.ndo_stop = ipvlan_stop,
|
|
|
|
|
.ndo_start_xmit = ipvlan_start_xmit,
|
|
|
|
|
.ndo_fix_features = ipvlan_fix_features,
|
|
|
|
|
.ndo_change_rx_flags = ipvlan_change_rx_flags,
|
|
|
|
|
.ndo_set_rx_mode = ipvlan_set_multicast_mac_filter,
|
|
|
|
|
.ndo_get_stats64 = ipvlan_get_stats64,
|
|
|
|
|
.ndo_vlan_rx_add_vid = ipvlan_vlan_rx_add_vid,
|
|
|
|
|
.ndo_vlan_rx_kill_vid = ipvlan_vlan_rx_kill_vid,
|
2015-04-02 09:07:06 -06:00
|
|
|
.ndo_get_iflink = ipvlan_get_iflink,
|
2014-11-24 00:07:46 -07:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static int ipvlan_hard_header(struct sk_buff *skb, struct net_device *dev,
|
|
|
|
|
unsigned short type, const void *daddr,
|
|
|
|
|
const void *saddr, unsigned len)
|
|
|
|
|
{
|
|
|
|
|
const struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct net_device *phy_dev = ipvlan->phy_dev;
|
|
|
|
|
|
|
|
|
|
/* TODO Probably use a different field than dev_addr so that the
|
|
|
|
|
* mac-address on the virtual device is portable and can be carried
|
|
|
|
|
* while the packets use the mac-addr on the physical device.
|
|
|
|
|
*/
|
|
|
|
|
return dev_hard_header(skb, phy_dev, type, daddr,
|
2017-10-11 18:16:26 -06:00
|
|
|
saddr ? : phy_dev->dev_addr, len);
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static const struct header_ops ipvlan_header_ops = {
|
|
|
|
|
.create = ipvlan_hard_header,
|
|
|
|
|
.parse = eth_header_parse,
|
|
|
|
|
.cache = eth_header_cache,
|
|
|
|
|
.cache_update = eth_header_cache_update,
|
|
|
|
|
};
|
|
|
|
|
|
2019-02-08 05:55:31 -07:00
|
|
|
static void ipvlan_adjust_mtu(struct ipvl_dev *ipvlan, struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
ipvlan->dev->mtu = dev->mtu;
|
|
|
|
|
}
|
|
|
|
|
|
2018-03-06 02:56:31 -07:00
|
|
|
static bool netif_is_ipvlan(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
/* both ipvlan and ipvtap devices use the same netdev_ops */
|
|
|
|
|
return dev->netdev_ops == &ipvlan_netdev_ops;
|
|
|
|
|
}
|
|
|
|
|
|
2016-02-24 11:58:03 -07:00
|
|
|
static int ipvlan_ethtool_get_link_ksettings(struct net_device *dev,
|
|
|
|
|
struct ethtool_link_ksettings *cmd)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
const struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
2016-02-24 11:58:03 -07:00
|
|
|
return __ethtool_get_link_ksettings(ipvlan->phy_dev, cmd);
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_ethtool_get_drvinfo(struct net_device *dev,
|
|
|
|
|
struct ethtool_drvinfo *drvinfo)
|
|
|
|
|
{
|
|
|
|
|
strlcpy(drvinfo->driver, IPVLAN_DRV, sizeof(drvinfo->driver));
|
|
|
|
|
strlcpy(drvinfo->version, IPV_DRV_VER, sizeof(drvinfo->version));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static u32 ipvlan_ethtool_get_msglevel(struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
const struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
return ipvlan->msg_enable;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_ethtool_set_msglevel(struct net_device *dev, u32 value)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
ipvlan->msg_enable = value;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static const struct ethtool_ops ipvlan_ethtool_ops = {
|
|
|
|
|
.get_link = ethtool_op_get_link,
|
2016-02-24 11:58:03 -07:00
|
|
|
.get_link_ksettings = ipvlan_ethtool_get_link_ksettings,
|
2014-11-24 00:07:46 -07:00
|
|
|
.get_drvinfo = ipvlan_ethtool_get_drvinfo,
|
|
|
|
|
.get_msglevel = ipvlan_ethtool_get_msglevel,
|
|
|
|
|
.set_msglevel = ipvlan_ethtool_set_msglevel,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static int ipvlan_nl_changelink(struct net_device *dev,
|
2017-06-25 15:56:00 -06:00
|
|
|
struct nlattr *tb[], struct nlattr *data[],
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct ipvl_port *port = ipvlan_port_get_rtnl(ipvlan->phy_dev);
|
2016-09-16 13:59:19 -06:00
|
|
|
int err = 0;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-10-26 16:09:21 -06:00
|
|
|
if (!data)
|
|
|
|
|
return 0;
|
ipvlan: disallow userns cap_net_admin to change global mode/flags
When running Docker with userns isolation e.g. --userns-remap="default"
and spawning up some containers with CAP_NET_ADMIN under this realm, I
noticed that link changes on ipvlan slave device inside that container
can affect all devices from this ipvlan group which are in other net
namespaces where the container should have no permission to make changes
to, such as the init netns, for example.
This effectively allows to undo ipvlan private mode and switch globally to
bridge mode where slaves can communicate directly without going through
hostns, or it allows to switch between global operation mode (l2/l3/l3s)
for everyone bound to the given ipvlan master device. libnetwork plugin
here is creating an ipvlan master and ipvlan slave in hostns and a slave
each that is moved into the container's netns upon creation event.
* In hostns:
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]
* Spawn container & change ipvlan mode setting inside of it:
# docker run -dt --cap-add=NET_ADMIN --network cilium-net --name client -l app=test cilium/netperf
9fff485d69dcb5ce37c9e33ca20a11ccafc236d690105aadbfb77e4f4170879c
# docker exec -ti client ip -d a
[...]
10: cilium0@if4: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever
# docker exec -ti client ip link change link cilium0 name cilium0 type ipvlan mode l2
# docker exec -ti client ip -d a
[...]
10: cilium0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever
* In hostns (mode switched to l2):
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]
Same l3 -> l2 switch would also happen by creating another slave inside
the container's network namespace when specifying the existing cilium0
link to derive the actual (bond0) master:
# docker exec -ti client ip link add link cilium0 name cilium1 type ipvlan mode l2
# docker exec -ti client ip -d a
[...]
2: cilium1@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
10: cilium0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever
* In hostns:
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]
One way to mitigate it is to check CAP_NET_ADMIN permissions of
the ipvlan master device's ns, and only then allow to change
mode or flags for all devices bound to it. Above two cases are
then disallowed after the patch.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-19 16:15:30 -07:00
|
|
|
if (!ns_capable(dev_net(ipvlan->phy_dev)->user_ns, CAP_NET_ADMIN))
|
|
|
|
|
return -EPERM;
|
2017-10-26 16:09:21 -06:00
|
|
|
|
|
|
|
|
if (data[IFLA_IPVLAN_MODE]) {
|
2014-11-24 00:07:46 -07:00
|
|
|
u16 nmode = nla_get_u16(data[IFLA_IPVLAN_MODE]);
|
|
|
|
|
|
2018-12-06 10:05:40 -07:00
|
|
|
err = ipvlan_set_port_mode(port, nmode, extack);
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
2017-10-26 16:09:21 -06:00
|
|
|
|
|
|
|
|
if (!err && data[IFLA_IPVLAN_FLAGS]) {
|
|
|
|
|
u16 flags = nla_get_u16(data[IFLA_IPVLAN_FLAGS]);
|
|
|
|
|
|
|
|
|
|
if (flags & IPVLAN_F_PRIVATE)
|
|
|
|
|
ipvlan_mark_private(port);
|
|
|
|
|
else
|
|
|
|
|
ipvlan_clear_private(port);
|
2017-10-26 16:09:25 -06:00
|
|
|
|
|
|
|
|
if (flags & IPVLAN_F_VEPA)
|
|
|
|
|
ipvlan_mark_vepa(port);
|
|
|
|
|
else
|
|
|
|
|
ipvlan_clear_vepa(port);
|
2017-10-26 16:09:21 -06:00
|
|
|
}
|
|
|
|
|
|
2016-09-16 13:59:19 -06:00
|
|
|
return err;
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static size_t ipvlan_nl_getsize(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
return (0
|
|
|
|
|
+ nla_total_size(2) /* IFLA_IPVLAN_MODE */
|
2017-10-26 16:09:21 -06:00
|
|
|
+ nla_total_size(2) /* IFLA_IPVLAN_FLAGS */
|
2014-11-24 00:07:46 -07:00
|
|
|
);
|
|
|
|
|
}
|
|
|
|
|
|
2017-06-25 15:56:01 -06:00
|
|
|
static int ipvlan_nl_validate(struct nlattr *tb[], struct nlattr *data[],
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
2017-10-26 16:09:21 -06:00
|
|
|
if (!data)
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
if (data[IFLA_IPVLAN_MODE]) {
|
2014-11-24 00:07:46 -07:00
|
|
|
u16 mode = nla_get_u16(data[IFLA_IPVLAN_MODE]);
|
|
|
|
|
|
2018-12-10 04:25:38 -07:00
|
|
|
if (mode >= IPVLAN_MODE_MAX)
|
2014-11-24 00:07:46 -07:00
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
2017-10-26 16:09:21 -06:00
|
|
|
if (data[IFLA_IPVLAN_FLAGS]) {
|
|
|
|
|
u16 flags = nla_get_u16(data[IFLA_IPVLAN_FLAGS]);
|
|
|
|
|
|
2017-10-26 16:09:25 -06:00
|
|
|
/* Only two bits are used at this moment. */
|
|
|
|
|
if (flags & ~(IPVLAN_F_PRIVATE | IPVLAN_F_VEPA))
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
/* Also both flags can't be active at the same time. */
|
|
|
|
|
if ((flags & (IPVLAN_F_PRIVATE | IPVLAN_F_VEPA)) ==
|
|
|
|
|
(IPVLAN_F_PRIVATE | IPVLAN_F_VEPA))
|
2017-10-26 16:09:21 -06:00
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int ipvlan_nl_fillinfo(struct sk_buff *skb,
|
|
|
|
|
const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct ipvl_port *port = ipvlan_port_get_rtnl(ipvlan->phy_dev);
|
|
|
|
|
int ret = -EINVAL;
|
|
|
|
|
|
|
|
|
|
if (!port)
|
|
|
|
|
goto err;
|
|
|
|
|
|
|
|
|
|
ret = -EMSGSIZE;
|
|
|
|
|
if (nla_put_u16(skb, IFLA_IPVLAN_MODE, port->mode))
|
|
|
|
|
goto err;
|
2017-10-26 16:09:21 -06:00
|
|
|
if (nla_put_u16(skb, IFLA_IPVLAN_FLAGS, port->flags))
|
|
|
|
|
goto err;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
err:
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
2017-02-10 17:03:52 -07:00
|
|
|
int ipvlan_link_new(struct net *src_net, struct net_device *dev,
|
2017-06-25 15:55:59 -06:00
|
|
|
struct nlattr *tb[], struct nlattr *data[],
|
|
|
|
|
struct netlink_ext_ack *extack)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct ipvl_port *port;
|
|
|
|
|
struct net_device *phy_dev;
|
|
|
|
|
int err;
|
2016-02-20 20:31:36 -07:00
|
|
|
u16 mode = IPVLAN_MODE_L3;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
if (!tb[IFLA_LINK])
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
phy_dev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
|
|
|
|
|
if (!phy_dev)
|
|
|
|
|
return -ENODEV;
|
|
|
|
|
|
2014-12-06 16:53:33 -07:00
|
|
|
if (netif_is_ipvlan(phy_dev)) {
|
2014-11-24 00:07:46 -07:00
|
|
|
struct ipvl_dev *tmp = netdev_priv(phy_dev);
|
|
|
|
|
|
|
|
|
|
phy_dev = tmp->phy_dev;
|
ipvlan: disallow userns cap_net_admin to change global mode/flags
When running Docker with userns isolation e.g. --userns-remap="default"
and spawning up some containers with CAP_NET_ADMIN under this realm, I
noticed that link changes on ipvlan slave device inside that container
can affect all devices from this ipvlan group which are in other net
namespaces where the container should have no permission to make changes
to, such as the init netns, for example.
This effectively allows to undo ipvlan private mode and switch globally to
bridge mode where slaves can communicate directly without going through
hostns, or it allows to switch between global operation mode (l2/l3/l3s)
for everyone bound to the given ipvlan master device. libnetwork plugin
here is creating an ipvlan master and ipvlan slave in hostns and a slave
each that is moved into the container's netns upon creation event.
* In hostns:
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]
* Spawn container & change ipvlan mode setting inside of it:
# docker run -dt --cap-add=NET_ADMIN --network cilium-net --name client -l app=test cilium/netperf
9fff485d69dcb5ce37c9e33ca20a11ccafc236d690105aadbfb77e4f4170879c
# docker exec -ti client ip -d a
[...]
10: cilium0@if4: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever
# docker exec -ti client ip link change link cilium0 name cilium0 type ipvlan mode l2
# docker exec -ti client ip -d a
[...]
10: cilium0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever
* In hostns (mode switched to l2):
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]
Same l3 -> l2 switch would also happen by creating another slave inside
the container's network namespace when specifying the existing cilium0
link to derive the actual (bond0) master:
# docker exec -ti client ip link add link cilium0 name cilium1 type ipvlan mode l2
# docker exec -ti client ip -d a
[...]
2: cilium1@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
10: cilium0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever
* In hostns:
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]
One way to mitigate it is to check CAP_NET_ADMIN permissions of
the ipvlan master device's ns, and only then allow to change
mode or flags for all devices bound to it. Above two cases are
then disallowed after the patch.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-02-19 16:15:30 -07:00
|
|
|
if (!ns_capable(dev_net(phy_dev)->user_ns, CAP_NET_ADMIN))
|
|
|
|
|
return -EPERM;
|
2014-12-06 16:53:33 -07:00
|
|
|
} else if (!netif_is_ipvlan_port(phy_dev)) {
|
2017-11-17 00:16:17 -07:00
|
|
|
/* Exit early if the underlying link is invalid or busy */
|
|
|
|
|
if (phy_dev->type != ARPHRD_ETHER ||
|
|
|
|
|
phy_dev->flags & IFF_LOOPBACK) {
|
|
|
|
|
netdev_err(phy_dev,
|
|
|
|
|
"Master is either lo or non-ether device\n");
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
if (netdev_is_rx_handler_busy(phy_dev)) {
|
|
|
|
|
netdev_err(phy_dev, "Device is already in use.\n");
|
|
|
|
|
return -EBUSY;
|
|
|
|
|
}
|
|
|
|
|
}
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
ipvlan->phy_dev = phy_dev;
|
|
|
|
|
ipvlan->dev = dev;
|
|
|
|
|
ipvlan->sfeatures = IPVLAN_FEATURES;
|
2018-06-20 22:56:04 -06:00
|
|
|
if (!tb[IFLA_MTU])
|
|
|
|
|
ipvlan_adjust_mtu(ipvlan, phy_dev);
|
2014-11-24 00:07:46 -07:00
|
|
|
INIT_LIST_HEAD(&ipvlan->addrs);
|
2018-02-28 02:59:27 -07:00
|
|
|
spin_lock_init(&ipvlan->addrs_lock);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
/* TODO Probably put random address here to be presented to the
|
|
|
|
|
* world but keep using the physical-dev address for the outgoing
|
|
|
|
|
* packets.
|
2017-10-26 16:09:21 -06:00
|
|
|
*/
|
2017-11-17 00:16:17 -07:00
|
|
|
memcpy(dev->dev_addr, phy_dev->dev_addr, ETH_ALEN);
|
|
|
|
|
|
2018-03-09 02:39:24 -07:00
|
|
|
dev->priv_flags |= IFF_NO_RX_HANDLER;
|
|
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
err = register_netdevice(dev);
|
|
|
|
|
if (err < 0)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
/* ipvlan_init() would have created the port, if required */
|
|
|
|
|
port = ipvlan_port_get_rtnl(phy_dev);
|
|
|
|
|
ipvlan->port = port;
|
2017-10-26 16:09:21 -06:00
|
|
|
|
2017-01-09 16:05:54 -07:00
|
|
|
/* If the port-id base is at the MAX value, then wrap it around and
|
|
|
|
|
* begin from 0x1 again. This may be due to a busy system where lots
|
|
|
|
|
* of slaves are getting created and deleted.
|
|
|
|
|
*/
|
|
|
|
|
if (port->dev_id_start == 0xFFFE)
|
|
|
|
|
port->dev_id_start = 0x1;
|
|
|
|
|
|
2017-01-03 13:47:16 -07:00
|
|
|
/* Since L2 address is shared among all IPvlan slaves including
|
|
|
|
|
* master, use unique 16 bit dev-ids to diffentiate among them.
|
|
|
|
|
* Assign IDs between 0x1 and 0xFFFE (used by the master) to each
|
|
|
|
|
* slave link [see addrconf_ifid_eui48()].
|
|
|
|
|
*/
|
2017-01-09 16:05:54 -07:00
|
|
|
err = ida_simple_get(&port->ida, port->dev_id_start, 0xFFFE,
|
|
|
|
|
GFP_KERNEL);
|
2017-01-13 16:48:30 -07:00
|
|
|
if (err < 0)
|
|
|
|
|
err = ida_simple_get(&port->ida, 0x1, port->dev_id_start,
|
|
|
|
|
GFP_KERNEL);
|
2017-01-03 13:47:16 -07:00
|
|
|
if (err < 0)
|
2017-11-17 00:16:17 -07:00
|
|
|
goto unregister_netdev;
|
2017-01-03 13:47:16 -07:00
|
|
|
dev->dev_id = err;
|
2017-11-17 00:16:17 -07:00
|
|
|
|
2017-01-09 16:05:54 -07:00
|
|
|
/* Increment id-base to the next slot for the future assignment */
|
|
|
|
|
port->dev_id_start = err + 1;
|
2017-01-03 13:47:16 -07:00
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
err = netdev_upper_dev_link(phy_dev, dev, extack);
|
|
|
|
|
if (err)
|
|
|
|
|
goto remove_ida;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
/* Flags are per port and latest update overrides. User has
|
|
|
|
|
* to be consistent in setting it just like the mode attribute.
|
|
|
|
|
*/
|
|
|
|
|
if (data && data[IFLA_IPVLAN_FLAGS])
|
|
|
|
|
port->flags = nla_get_u16(data[IFLA_IPVLAN_FLAGS]);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-11-17 00:16:17 -07:00
|
|
|
if (data && data[IFLA_IPVLAN_MODE])
|
|
|
|
|
mode = nla_get_u16(data[IFLA_IPVLAN_MODE]);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2018-12-06 10:05:40 -07:00
|
|
|
err = ipvlan_set_port_mode(port, mode, extack);
|
2017-11-17 00:16:17 -07:00
|
|
|
if (err)
|
2016-12-07 20:16:58 -07:00
|
|
|
goto unlink_netdev;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
list_add_tail_rcu(&ipvlan->pnode, &port->ipvlans);
|
|
|
|
|
netif_stacked_transfer_operstate(phy_dev, dev);
|
|
|
|
|
return 0;
|
2016-11-24 08:39:59 -07:00
|
|
|
|
2016-12-07 20:16:58 -07:00
|
|
|
unlink_netdev:
|
|
|
|
|
netdev_upper_dev_unlink(phy_dev, dev);
|
2017-01-03 13:47:16 -07:00
|
|
|
remove_ida:
|
|
|
|
|
ida_simple_remove(&port->ida, dev->dev_id);
|
2017-11-17 00:16:17 -07:00
|
|
|
unregister_netdev:
|
|
|
|
|
unregister_netdevice(dev);
|
2016-11-24 08:39:59 -07:00
|
|
|
return err;
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
2017-02-10 17:03:52 -07:00
|
|
|
EXPORT_SYMBOL_GPL(ipvlan_link_new);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-02-10 17:03:52 -07:00
|
|
|
void ipvlan_link_delete(struct net_device *dev, struct list_head *head)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct ipvl_addr *addr, *next;
|
|
|
|
|
|
2018-02-28 02:59:27 -07:00
|
|
|
spin_lock_bh(&ipvlan->addrs_lock);
|
2015-07-14 07:35:50 -06:00
|
|
|
list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) {
|
2015-07-14 07:35:53 -06:00
|
|
|
ipvlan_ht_addr_del(addr);
|
2018-02-28 02:59:27 -07:00
|
|
|
list_del_rcu(&addr->anode);
|
2015-07-14 07:35:51 -06:00
|
|
|
kfree_rcu(addr, rcu);
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
2018-02-28 02:59:27 -07:00
|
|
|
spin_unlock_bh(&ipvlan->addrs_lock);
|
2015-07-14 07:35:50 -06:00
|
|
|
|
2017-01-03 13:47:16 -07:00
|
|
|
ida_simple_remove(&ipvlan->port->ida, dev->dev_id);
|
2014-11-24 00:07:46 -07:00
|
|
|
list_del_rcu(&ipvlan->pnode);
|
|
|
|
|
unregister_netdevice_queue(dev, head);
|
|
|
|
|
netdev_upper_dev_unlink(ipvlan->phy_dev, dev);
|
|
|
|
|
}
|
2017-02-10 17:03:52 -07:00
|
|
|
EXPORT_SYMBOL_GPL(ipvlan_link_delete);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2017-02-10 17:03:52 -07:00
|
|
|
void ipvlan_link_setup(struct net_device *dev)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
ether_setup(dev);
|
|
|
|
|
|
2018-06-18 02:15:57 -06:00
|
|
|
dev->max_mtu = ETH_MAX_MTU;
|
2014-11-24 00:07:46 -07:00
|
|
|
dev->priv_flags &= ~(IFF_XMIT_DST_RELEASE | IFF_TX_SKB_SHARING);
|
2015-08-18 02:30:40 -06:00
|
|
|
dev->priv_flags |= IFF_UNICAST_FLT | IFF_NO_QUEUE;
|
2014-11-24 00:07:46 -07:00
|
|
|
dev->netdev_ops = &ipvlan_netdev_ops;
|
net: Fix inconsistent teardown and release of private netdev state.
Network devices can allocate reasources and private memory using
netdev_ops->ndo_init(). However, the release of these resources
can occur in one of two different places.
Either netdev_ops->ndo_uninit() or netdev->destructor().
The decision of which operation frees the resources depends upon
whether it is necessary for all netdev refs to be released before it
is safe to perform the freeing.
netdev_ops->ndo_uninit() presumably can occur right after the
NETDEV_UNREGISTER notifier completes and the unicast and multicast
address lists are flushed.
netdev->destructor(), on the other hand, does not run until the
netdev references all go away.
Further complicating the situation is that netdev->destructor()
almost universally does also a free_netdev().
This creates a problem for the logic in register_netdevice().
Because all callers of register_netdevice() manage the freeing
of the netdev, and invoke free_netdev(dev) if register_netdevice()
fails.
If netdev_ops->ndo_init() succeeds, but something else fails inside
of register_netdevice(), it does call ndo_ops->ndo_uninit(). But
it is not able to invoke netdev->destructor().
This is because netdev->destructor() will do a free_netdev() and
then the caller of register_netdevice() will do the same.
However, this means that the resources that would normally be released
by netdev->destructor() will not be.
Over the years drivers have added local hacks to deal with this, by
invoking their destructor parts by hand when register_netdevice()
fails.
Many drivers do not try to deal with this, and instead we have leaks.
Let's close this hole by formalizing the distinction between what
private things need to be freed up by netdev->destructor() and whether
the driver needs unregister_netdevice() to perform the free_netdev().
netdev->priv_destructor() performs all actions to free up the private
resources that used to be freed by netdev->destructor(), except for
free_netdev().
netdev->needs_free_netdev is a boolean that indicates whether
free_netdev() should be done at the end of unregister_netdevice().
Now, register_netdevice() can sanely release all resources after
ndo_ops->ndo_init() succeeds, by invoking both ndo_ops->ndo_uninit()
and netdev->priv_destructor().
And at the end of unregister_netdevice(), we invoke
netdev->priv_destructor() and optionally call free_netdev().
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-05-08 10:52:56 -06:00
|
|
|
dev->needs_free_netdev = true;
|
2014-11-24 00:07:46 -07:00
|
|
|
dev->header_ops = &ipvlan_header_ops;
|
|
|
|
|
dev->ethtool_ops = &ipvlan_ethtool_ops;
|
|
|
|
|
}
|
2017-02-10 17:03:52 -07:00
|
|
|
EXPORT_SYMBOL_GPL(ipvlan_link_setup);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
static const struct nla_policy ipvlan_nl_policy[IFLA_IPVLAN_MAX + 1] =
|
|
|
|
|
{
|
|
|
|
|
[IFLA_IPVLAN_MODE] = { .type = NLA_U16 },
|
2017-10-26 16:09:21 -06:00
|
|
|
[IFLA_IPVLAN_FLAGS] = { .type = NLA_U16 },
|
2014-11-24 00:07:46 -07:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static struct rtnl_link_ops ipvlan_link_ops = {
|
|
|
|
|
.kind = "ipvlan",
|
|
|
|
|
.priv_size = sizeof(struct ipvl_dev),
|
|
|
|
|
|
|
|
|
|
.setup = ipvlan_link_setup,
|
|
|
|
|
.newlink = ipvlan_link_new,
|
|
|
|
|
.dellink = ipvlan_link_delete,
|
|
|
|
|
};
|
|
|
|
|
|
2017-02-10 17:03:52 -07:00
|
|
|
int ipvlan_link_register(struct rtnl_link_ops *ops)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
2017-02-10 17:03:52 -07:00
|
|
|
ops->get_size = ipvlan_nl_getsize;
|
|
|
|
|
ops->policy = ipvlan_nl_policy;
|
|
|
|
|
ops->validate = ipvlan_nl_validate;
|
|
|
|
|
ops->fill_info = ipvlan_nl_fillinfo;
|
|
|
|
|
ops->changelink = ipvlan_nl_changelink;
|
|
|
|
|
ops->maxtype = IFLA_IPVLAN_MAX;
|
2014-11-24 00:07:46 -07:00
|
|
|
return rtnl_link_register(ops);
|
|
|
|
|
}
|
2017-02-10 17:03:52 -07:00
|
|
|
EXPORT_SYMBOL_GPL(ipvlan_link_register);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
static int ipvlan_device_event(struct notifier_block *unused,
|
|
|
|
|
unsigned long event, void *ptr)
|
|
|
|
|
{
|
2018-12-13 04:54:41 -07:00
|
|
|
struct netlink_ext_ack *extack = netdev_notifier_info_to_extack(ptr);
|
|
|
|
|
struct netdev_notifier_pre_changeaddr_info *prechaddr_info;
|
2014-11-24 00:07:46 -07:00
|
|
|
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
|
|
|
|
|
struct ipvl_dev *ipvlan, *next;
|
|
|
|
|
struct ipvl_port *port;
|
|
|
|
|
LIST_HEAD(lst_kill);
|
2018-12-13 04:54:41 -07:00
|
|
|
int err;
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2014-12-06 16:53:33 -07:00
|
|
|
if (!netif_is_ipvlan_port(dev))
|
2014-11-24 00:07:46 -07:00
|
|
|
return NOTIFY_DONE;
|
|
|
|
|
|
|
|
|
|
port = ipvlan_port_get_rtnl(dev);
|
|
|
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
|
case NETDEV_CHANGE:
|
|
|
|
|
list_for_each_entry(ipvlan, &port->ipvlans, pnode)
|
|
|
|
|
netif_stacked_transfer_operstate(ipvlan->phy_dev,
|
|
|
|
|
ipvlan->dev);
|
|
|
|
|
break;
|
|
|
|
|
|
2017-04-20 10:08:15 -06:00
|
|
|
case NETDEV_REGISTER: {
|
|
|
|
|
struct net *oldnet, *newnet = dev_net(dev);
|
|
|
|
|
|
|
|
|
|
oldnet = read_pnet(&port->pnet);
|
|
|
|
|
if (net_eq(newnet, oldnet))
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
write_pnet(&port->pnet, newnet);
|
|
|
|
|
|
2019-02-08 05:55:31 -07:00
|
|
|
ipvlan_migrate_l3s_hook(oldnet, newnet);
|
2017-04-20 10:08:15 -06:00
|
|
|
break;
|
|
|
|
|
}
|
2014-11-24 00:07:46 -07:00
|
|
|
case NETDEV_UNREGISTER:
|
|
|
|
|
if (dev->reg_state != NETREG_UNREGISTERING)
|
|
|
|
|
break;
|
|
|
|
|
|
2018-02-28 02:59:27 -07:00
|
|
|
list_for_each_entry_safe(ipvlan, next, &port->ipvlans, pnode)
|
2014-11-24 00:07:46 -07:00
|
|
|
ipvlan->dev->rtnl_link_ops->dellink(ipvlan->dev,
|
|
|
|
|
&lst_kill);
|
|
|
|
|
unregister_netdevice_many(&lst_kill);
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case NETDEV_FEAT_CHANGE:
|
|
|
|
|
list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
|
|
|
|
|
ipvlan->dev->features = dev->features & IPVLAN_FEATURES;
|
|
|
|
|
ipvlan->dev->gso_max_size = dev->gso_max_size;
|
2016-03-16 22:59:49 -06:00
|
|
|
ipvlan->dev->gso_max_segs = dev->gso_max_segs;
|
2014-11-24 00:07:46 -07:00
|
|
|
netdev_features_change(ipvlan->dev);
|
|
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case NETDEV_CHANGEMTU:
|
|
|
|
|
list_for_each_entry(ipvlan, &port->ipvlans, pnode)
|
|
|
|
|
ipvlan_adjust_mtu(ipvlan, dev);
|
|
|
|
|
break;
|
|
|
|
|
|
2018-12-13 04:54:41 -07:00
|
|
|
case NETDEV_PRE_CHANGEADDR:
|
|
|
|
|
prechaddr_info = ptr;
|
|
|
|
|
list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
|
|
|
|
|
err = dev_pre_changeaddr_notify(ipvlan->dev,
|
|
|
|
|
prechaddr_info->dev_addr,
|
|
|
|
|
extack);
|
|
|
|
|
if (err)
|
|
|
|
|
return notifier_from_errno(err);
|
|
|
|
|
}
|
|
|
|
|
break;
|
|
|
|
|
|
2017-10-11 18:16:26 -06:00
|
|
|
case NETDEV_CHANGEADDR:
|
2018-05-14 05:38:09 -06:00
|
|
|
list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
|
2017-10-11 18:16:26 -06:00
|
|
|
ether_addr_copy(ipvlan->dev->dev_addr, dev->dev_addr);
|
2018-05-14 05:38:09 -06:00
|
|
|
call_netdevice_notifiers(NETDEV_CHANGEADDR, ipvlan->dev);
|
|
|
|
|
}
|
2017-10-11 18:16:26 -06:00
|
|
|
break;
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
case NETDEV_PRE_TYPE_CHANGE:
|
|
|
|
|
/* Forbid underlying device to change its type. */
|
|
|
|
|
return NOTIFY_BAD;
|
|
|
|
|
}
|
|
|
|
|
return NOTIFY_DONE;
|
|
|
|
|
}
|
|
|
|
|
|
2018-02-28 02:59:27 -07:00
|
|
|
/* the caller must held the addrs lock */
|
2016-12-28 01:46:51 -07:00
|
|
|
static int ipvlan_add_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
struct ipvl_addr *addr;
|
|
|
|
|
|
|
|
|
|
addr = kzalloc(sizeof(struct ipvl_addr), GFP_ATOMIC);
|
|
|
|
|
if (!addr)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
|
|
addr->master = ipvlan;
|
2018-02-20 17:31:13 -07:00
|
|
|
if (!is_v6) {
|
2016-12-28 01:46:51 -07:00
|
|
|
memcpy(&addr->ip4addr, iaddr, sizeof(struct in_addr));
|
|
|
|
|
addr->atype = IPVL_IPV4;
|
2018-02-20 17:31:13 -07:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
|
|
|
} else {
|
|
|
|
|
memcpy(&addr->ip6addr, iaddr, sizeof(struct in6_addr));
|
|
|
|
|
addr->atype = IPVL_IPV6;
|
|
|
|
|
#endif
|
2016-12-28 01:46:51 -07:00
|
|
|
}
|
2018-02-28 02:59:27 -07:00
|
|
|
|
|
|
|
|
list_add_tail_rcu(&addr->anode, &ipvlan->addrs);
|
2015-07-14 07:35:50 -06:00
|
|
|
|
2015-03-28 12:13:22 -06:00
|
|
|
/* If the interface is not up, the address will be added to the hash
|
|
|
|
|
* list by ipvlan_open.
|
|
|
|
|
*/
|
|
|
|
|
if (netif_running(ipvlan->dev))
|
|
|
|
|
ipvlan_ht_addr_add(ipvlan, addr);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2016-12-28 01:46:51 -07:00
|
|
|
static void ipvlan_del_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6)
|
2014-11-24 00:07:46 -07:00
|
|
|
{
|
|
|
|
|
struct ipvl_addr *addr;
|
|
|
|
|
|
2018-02-28 02:59:27 -07:00
|
|
|
spin_lock_bh(&ipvlan->addrs_lock);
|
2016-12-28 01:46:51 -07:00
|
|
|
addr = ipvlan_find_addr(ipvlan, iaddr, is_v6);
|
2018-02-28 02:59:27 -07:00
|
|
|
if (!addr) {
|
|
|
|
|
spin_unlock_bh(&ipvlan->addrs_lock);
|
2014-11-24 00:07:46 -07:00
|
|
|
return;
|
2018-02-28 02:59:27 -07:00
|
|
|
}
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2015-07-14 07:35:53 -06:00
|
|
|
ipvlan_ht_addr_del(addr);
|
2018-02-28 02:59:27 -07:00
|
|
|
list_del_rcu(&addr->anode);
|
|
|
|
|
spin_unlock_bh(&ipvlan->addrs_lock);
|
2014-11-24 00:07:46 -07:00
|
|
|
kfree_rcu(addr, rcu);
|
|
|
|
|
}
|
|
|
|
|
|
2018-02-20 17:31:13 -07:00
|
|
|
static bool ipvlan_is_valid_dev(const struct net_device *dev)
|
|
|
|
|
{
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
|
|
|
|
if (!netif_is_ipvlan(dev))
|
|
|
|
|
return false;
|
|
|
|
|
|
|
|
|
|
if (!ipvlan || !ipvlan->port)
|
|
|
|
|
return false;
|
|
|
|
|
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2016-12-28 01:46:51 -07:00
|
|
|
static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
|
|
|
|
|
{
|
2018-02-28 02:59:27 -07:00
|
|
|
int ret = -EINVAL;
|
|
|
|
|
|
|
|
|
|
spin_lock_bh(&ipvlan->addrs_lock);
|
|
|
|
|
if (ipvlan_addr_busy(ipvlan->port, ip6_addr, true))
|
2016-12-28 01:46:51 -07:00
|
|
|
netif_err(ipvlan, ifup, ipvlan->dev,
|
|
|
|
|
"Failed to add IPv6=%pI6c addr for %s intf\n",
|
|
|
|
|
ip6_addr, ipvlan->dev->name);
|
2018-02-28 02:59:27 -07:00
|
|
|
else
|
|
|
|
|
ret = ipvlan_add_addr(ipvlan, ip6_addr, true);
|
|
|
|
|
spin_unlock_bh(&ipvlan->addrs_lock);
|
|
|
|
|
return ret;
|
2016-12-28 01:46:51 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_del_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr)
|
|
|
|
|
{
|
|
|
|
|
return ipvlan_del_addr(ipvlan, ip6_addr, true);
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
static int ipvlan_addr6_event(struct notifier_block *unused,
|
|
|
|
|
unsigned long event, void *ptr)
|
|
|
|
|
{
|
|
|
|
|
struct inet6_ifaddr *if6 = (struct inet6_ifaddr *)ptr;
|
|
|
|
|
struct net_device *dev = (struct net_device *)if6->idev->dev;
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
2017-12-01 01:33:03 -07:00
|
|
|
if (!ipvlan_is_valid_dev(dev))
|
2014-11-24 00:07:46 -07:00
|
|
|
return NOTIFY_DONE;
|
|
|
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
|
case NETDEV_UP:
|
|
|
|
|
if (ipvlan_add_addr6(ipvlan, &if6->addr))
|
|
|
|
|
return NOTIFY_BAD;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case NETDEV_DOWN:
|
|
|
|
|
ipvlan_del_addr6(ipvlan, &if6->addr);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return NOTIFY_OK;
|
|
|
|
|
}
|
|
|
|
|
|
2017-06-08 14:12:14 -06:00
|
|
|
static int ipvlan_addr6_validator_event(struct notifier_block *unused,
|
|
|
|
|
unsigned long event, void *ptr)
|
|
|
|
|
{
|
|
|
|
|
struct in6_validator_info *i6vi = (struct in6_validator_info *)ptr;
|
|
|
|
|
struct net_device *dev = (struct net_device *)i6vi->i6vi_dev->dev;
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
2017-12-01 01:33:03 -07:00
|
|
|
if (!ipvlan_is_valid_dev(dev))
|
2017-06-08 14:12:14 -06:00
|
|
|
return NOTIFY_DONE;
|
|
|
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
|
case NETDEV_UP:
|
2017-10-18 10:56:54 -06:00
|
|
|
if (ipvlan_addr_busy(ipvlan->port, &i6vi->i6vi_addr, true)) {
|
|
|
|
|
NL_SET_ERR_MSG(i6vi->extack,
|
|
|
|
|
"Address already assigned to an ipvlan device");
|
2017-06-08 14:12:14 -06:00
|
|
|
return notifier_from_errno(-EADDRINUSE);
|
2017-10-18 10:56:54 -06:00
|
|
|
}
|
2017-06-08 14:12:14 -06:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return NOTIFY_OK;
|
|
|
|
|
}
|
2018-02-20 17:31:13 -07:00
|
|
|
#endif
|
2017-06-08 14:12:14 -06:00
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
|
|
|
|
|
{
|
2018-02-28 02:59:27 -07:00
|
|
|
int ret = -EINVAL;
|
|
|
|
|
|
|
|
|
|
spin_lock_bh(&ipvlan->addrs_lock);
|
|
|
|
|
if (ipvlan_addr_busy(ipvlan->port, ip4_addr, false))
|
2014-11-24 00:07:46 -07:00
|
|
|
netif_err(ipvlan, ifup, ipvlan->dev,
|
|
|
|
|
"Failed to add IPv4=%pI4 on %s intf.\n",
|
|
|
|
|
ip4_addr, ipvlan->dev->name);
|
2018-02-28 02:59:27 -07:00
|
|
|
else
|
|
|
|
|
ret = ipvlan_add_addr(ipvlan, ip4_addr, false);
|
|
|
|
|
spin_unlock_bh(&ipvlan->addrs_lock);
|
|
|
|
|
return ret;
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void ipvlan_del_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr)
|
|
|
|
|
{
|
2016-12-28 01:46:51 -07:00
|
|
|
return ipvlan_del_addr(ipvlan, ip4_addr, false);
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int ipvlan_addr4_event(struct notifier_block *unused,
|
|
|
|
|
unsigned long event, void *ptr)
|
|
|
|
|
{
|
|
|
|
|
struct in_ifaddr *if4 = (struct in_ifaddr *)ptr;
|
|
|
|
|
struct net_device *dev = (struct net_device *)if4->ifa_dev->dev;
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
struct in_addr ip4_addr;
|
|
|
|
|
|
2017-12-01 01:33:03 -07:00
|
|
|
if (!ipvlan_is_valid_dev(dev))
|
2014-11-24 00:07:46 -07:00
|
|
|
return NOTIFY_DONE;
|
|
|
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
|
case NETDEV_UP:
|
|
|
|
|
ip4_addr.s_addr = if4->ifa_address;
|
|
|
|
|
if (ipvlan_add_addr4(ipvlan, &ip4_addr))
|
|
|
|
|
return NOTIFY_BAD;
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case NETDEV_DOWN:
|
|
|
|
|
ip4_addr.s_addr = if4->ifa_address;
|
|
|
|
|
ipvlan_del_addr4(ipvlan, &ip4_addr);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return NOTIFY_OK;
|
|
|
|
|
}
|
|
|
|
|
|
2017-06-08 14:12:14 -06:00
|
|
|
static int ipvlan_addr4_validator_event(struct notifier_block *unused,
|
|
|
|
|
unsigned long event, void *ptr)
|
|
|
|
|
{
|
|
|
|
|
struct in_validator_info *ivi = (struct in_validator_info *)ptr;
|
|
|
|
|
struct net_device *dev = (struct net_device *)ivi->ivi_dev->dev;
|
|
|
|
|
struct ipvl_dev *ipvlan = netdev_priv(dev);
|
|
|
|
|
|
2017-12-01 01:33:03 -07:00
|
|
|
if (!ipvlan_is_valid_dev(dev))
|
2017-06-08 14:12:14 -06:00
|
|
|
return NOTIFY_DONE;
|
|
|
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
|
case NETDEV_UP:
|
2017-10-18 10:56:54 -06:00
|
|
|
if (ipvlan_addr_busy(ipvlan->port, &ivi->ivi_addr, false)) {
|
|
|
|
|
NL_SET_ERR_MSG(ivi->extack,
|
|
|
|
|
"Address already assigned to an ipvlan device");
|
2017-06-08 14:12:14 -06:00
|
|
|
return notifier_from_errno(-EADDRINUSE);
|
2017-10-18 10:56:54 -06:00
|
|
|
}
|
2017-06-08 14:12:14 -06:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return NOTIFY_OK;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
static struct notifier_block ipvlan_addr4_notifier_block __read_mostly = {
|
|
|
|
|
.notifier_call = ipvlan_addr4_event,
|
|
|
|
|
};
|
|
|
|
|
|
2017-06-08 14:12:14 -06:00
|
|
|
static struct notifier_block ipvlan_addr4_vtor_notifier_block __read_mostly = {
|
|
|
|
|
.notifier_call = ipvlan_addr4_validator_event,
|
|
|
|
|
};
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
static struct notifier_block ipvlan_notifier_block __read_mostly = {
|
|
|
|
|
.notifier_call = ipvlan_device_event,
|
|
|
|
|
};
|
|
|
|
|
|
2018-02-20 17:31:13 -07:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2014-11-24 00:07:46 -07:00
|
|
|
static struct notifier_block ipvlan_addr6_notifier_block __read_mostly = {
|
|
|
|
|
.notifier_call = ipvlan_addr6_event,
|
|
|
|
|
};
|
|
|
|
|
|
2017-06-08 14:12:14 -06:00
|
|
|
static struct notifier_block ipvlan_addr6_vtor_notifier_block __read_mostly = {
|
|
|
|
|
.notifier_call = ipvlan_addr6_validator_event,
|
|
|
|
|
};
|
2018-02-20 17:31:13 -07:00
|
|
|
#endif
|
2017-06-08 14:12:14 -06:00
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
static int __init ipvlan_init_module(void)
|
|
|
|
|
{
|
|
|
|
|
int err;
|
|
|
|
|
|
|
|
|
|
ipvlan_init_secret();
|
|
|
|
|
register_netdevice_notifier(&ipvlan_notifier_block);
|
2018-02-20 17:31:13 -07:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2014-11-24 00:07:46 -07:00
|
|
|
register_inet6addr_notifier(&ipvlan_addr6_notifier_block);
|
2017-06-08 14:12:14 -06:00
|
|
|
register_inet6addr_validator_notifier(
|
|
|
|
|
&ipvlan_addr6_vtor_notifier_block);
|
2018-02-20 17:31:13 -07:00
|
|
|
#endif
|
2014-11-24 00:07:46 -07:00
|
|
|
register_inetaddr_notifier(&ipvlan_addr4_notifier_block);
|
2017-06-08 14:12:14 -06:00
|
|
|
register_inetaddr_validator_notifier(&ipvlan_addr4_vtor_notifier_block);
|
2014-11-24 00:07:46 -07:00
|
|
|
|
2019-02-08 05:55:31 -07:00
|
|
|
err = ipvlan_l3s_init();
|
2014-11-24 00:07:46 -07:00
|
|
|
if (err < 0)
|
|
|
|
|
goto error;
|
|
|
|
|
|
2017-04-20 10:08:15 -06:00
|
|
|
err = ipvlan_link_register(&ipvlan_link_ops);
|
|
|
|
|
if (err < 0) {
|
2019-02-08 05:55:31 -07:00
|
|
|
ipvlan_l3s_cleanup();
|
2017-04-20 10:08:15 -06:00
|
|
|
goto error;
|
|
|
|
|
}
|
|
|
|
|
|
2014-11-24 00:07:46 -07:00
|
|
|
return 0;
|
|
|
|
|
error:
|
|
|
|
|
unregister_inetaddr_notifier(&ipvlan_addr4_notifier_block);
|
2017-06-08 14:12:14 -06:00
|
|
|
unregister_inetaddr_validator_notifier(
|
|
|
|
|
&ipvlan_addr4_vtor_notifier_block);
|
2018-02-20 17:31:13 -07:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2014-11-24 00:07:46 -07:00
|
|
|
unregister_inet6addr_notifier(&ipvlan_addr6_notifier_block);
|
2017-06-08 14:12:14 -06:00
|
|
|
unregister_inet6addr_validator_notifier(
|
|
|
|
|
&ipvlan_addr6_vtor_notifier_block);
|
2018-02-20 17:31:13 -07:00
|
|
|
#endif
|
2014-11-24 00:07:46 -07:00
|
|
|
unregister_netdevice_notifier(&ipvlan_notifier_block);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void __exit ipvlan_cleanup_module(void)
|
|
|
|
|
{
|
|
|
|
|
rtnl_link_unregister(&ipvlan_link_ops);
|
2019-02-08 05:55:31 -07:00
|
|
|
ipvlan_l3s_cleanup();
|
2014-11-24 00:07:46 -07:00
|
|
|
unregister_netdevice_notifier(&ipvlan_notifier_block);
|
|
|
|
|
unregister_inetaddr_notifier(&ipvlan_addr4_notifier_block);
|
2017-06-08 14:12:14 -06:00
|
|
|
unregister_inetaddr_validator_notifier(
|
|
|
|
|
&ipvlan_addr4_vtor_notifier_block);
|
2018-02-20 17:31:13 -07:00
|
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
2014-11-24 00:07:46 -07:00
|
|
|
unregister_inet6addr_notifier(&ipvlan_addr6_notifier_block);
|
2017-06-08 14:12:14 -06:00
|
|
|
unregister_inet6addr_validator_notifier(
|
|
|
|
|
&ipvlan_addr6_vtor_notifier_block);
|
2018-02-20 17:31:13 -07:00
|
|
|
#endif
|
2014-11-24 00:07:46 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
module_init(ipvlan_init_module);
|
|
|
|
|
module_exit(ipvlan_cleanup_module);
|
|
|
|
|
|
|
|
|
|
MODULE_LICENSE("GPL");
|
|
|
|
|
MODULE_AUTHOR("Mahesh Bandewar <maheshb@google.com>");
|
|
|
|
|
MODULE_DESCRIPTION("Driver for L3 (IPv6/IPv4) based VLANs");
|
|
|
|
|
MODULE_ALIAS_RTNL_LINK("ipvlan");
|