From 728bebe5cfbcacfe290ca38c4777c371e5d0560e Mon Sep 17 00:00:00 2001 From: Reyk Floeter Date: Sun, 13 Oct 2013 10:10:05 +0000 Subject: Import vxlan(4), the virtual extensible local area network tunnel interface. VXLAN is a UDP-based tunnelling protocol for overlaying virtualized layer 2 networks over layer 3 networks. The implementation is based on draft-mahalingam-dutt-dcops-vxlan-04 and has been tested with other implementations in the wild. put it in deraadt@ --- sys/net/if.h | 4 +- sys/net/if_bridge.c | 121 +++++++++-- sys/net/if_bridge.h | 15 +- sys/net/if_vxlan.c | 590 ++++++++++++++++++++++++++++++++++++++++++++++++++++ sys/net/if_vxlan.h | 77 +++++++ 5 files changed, 791 insertions(+), 16 deletions(-) create mode 100644 sys/net/if_vxlan.c create mode 100644 sys/net/if_vxlan.h (limited to 'sys/net') diff --git a/sys/net/if.h b/sys/net/if.h index a95ef74c2b1..508407cd6bd 100644 --- a/sys/net/if.h +++ b/sys/net/if.h @@ -1,4 +1,4 @@ -/* $OpenBSD: if.h,v 1.147 2013/10/12 12:13:10 henning Exp $ */ +/* $OpenBSD: if.h,v 1.148 2013/10/13 10:10:02 reyk Exp $ */ /* $NetBSD: if.h,v 1.23 1996/05/07 02:40:27 thorpej Exp $ */ /* @@ -641,6 +641,8 @@ struct ifreq { #define ifr_hardmtu ifr_ifru.ifru_metric /* hardmtu (overload) */ #define ifr_media ifr_ifru.ifru_metric /* media options (overload) */ #define ifr_rdomainid ifr_ifru.ifru_metric /* VRF instance (overload) */ +#define ifr_vnetid ifr_ifru.ifru_metric /* Virtual Net Id (overload) */ +#define ifr_ttl ifr_ifru.ifru_metric /* tunnel TTL (overload) */ #define ifr_data ifr_ifru.ifru_data /* for use by interface */ }; diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c index 9ea29ba1a3f..c1798b0371b 100644 --- a/sys/net/if_bridge.c +++ b/sys/net/if_bridge.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bridge.c,v 1.215 2013/10/12 11:55:45 henning Exp $ */ +/* $OpenBSD: if_bridge.c,v 1.216 2013/10/13 10:10:02 reyk Exp $ */ /* * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net) @@ -131,9 +131,9 @@ int bridge_rtfind(struct bridge_softc *, struct ifbaconf *); void bridge_rtage(struct bridge_softc *); int bridge_rtdaddr(struct bridge_softc *, struct ether_addr *); void bridge_rtflush(struct bridge_softc *, int); -struct ifnet * bridge_rtupdate(struct bridge_softc *, - struct ether_addr *, struct ifnet *ifp, int, u_int8_t); -struct ifnet * bridge_rtlookup(struct bridge_softc *, +struct ifnet *bridge_rtupdate(struct bridge_softc *, + struct ether_addr *, struct ifnet *ifp, int, u_int8_t, struct mbuf *); +struct bridge_rtnode *bridge_rtlookup(struct bridge_softc *, struct ether_addr *); u_int32_t bridge_hash(struct bridge_softc *, struct ether_addr *); int bridge_blocknonip(struct ether_header *, struct mbuf *); @@ -161,6 +161,7 @@ int bridge_ipsec(struct bridge_softc *, struct ifnet *, int bridge_clone_create(struct if_clone *, int); int bridge_clone_destroy(struct ifnet *ifp); int bridge_delete(struct bridge_softc *, struct bridge_iflist *); +void bridge_tunnelupdate(struct sockaddr *, struct sockaddr *); #define ETHERADDR_IS_IP_MCAST(a) \ /* struct etheraddr *a; */ \ @@ -550,7 +551,7 @@ bridge_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data) } ifs = bridge_rtupdate(sc, &bareq->ifba_dst, ifs, 1, - bareq->ifba_flags); + bareq->ifba_flags, NULL); if (ifs == NULL) error = ENOMEM; break; @@ -728,7 +729,7 @@ bridge_update(struct ifnet *ifp, struct ether_addr *ea, int delete) if (!delete) { /* Update the bridge table */ - bridge_rtupdate(sc, ea, ifp, 0, IFBAF_DYNAMIC); + bridge_rtupdate(sc, ea, ifp, 0, IFBAF_DYNAMIC, NULL); } } } @@ -946,7 +947,8 @@ bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa, struct rtentry *rt) { struct ether_header *eh; - struct ifnet *dst_if; + struct ifnet *dst_if = NULL; + struct bridge_rtnode *dst_p = NULL; struct ether_addr *dst; struct bridge_softc *sc; int s, error, len; @@ -990,7 +992,8 @@ bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa, * If the packet is a broadcast or we don't know a better way to * get there, send to all interfaces. */ - dst_if = bridge_rtlookup(sc, dst); + if ((dst_p = bridge_rtlookup(sc, dst)) != NULL) + dst_if = dst_p->brt_if; if (dst_if == NULL || ETHER_IS_MULTICAST(eh->ether_dhost)) { struct bridge_iflist *p; struct mbuf *mc; @@ -1083,6 +1086,10 @@ bridge_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *sa, } sendunicast: + if (dst_p != NULL && dst_p->brt_tunnel.sa.sa_family != AF_UNSPEC && + (sa = bridge_tunneltag(m, dst_p->brt_tunnel.sa.sa_family)) != NULL) + memcpy(sa, &dst_p->brt_tunnel.sa, dst_p->brt_tunnel.sa.sa_len); + bridge_span(sc, NULL, m); if ((dst_if->if_flags & IFF_RUNNING) == 0) { m_freem(m); @@ -1133,6 +1140,7 @@ bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m) int s, len; struct ifnet *src_if, *dst_if; struct bridge_iflist *ifl; + struct bridge_rtnode *dst_p; struct ether_addr *dst, *src; struct ether_header eh; @@ -1175,7 +1183,7 @@ bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m) !(eh.ether_shost[0] == 0 && eh.ether_shost[1] == 0 && eh.ether_shost[2] == 0 && eh.ether_shost[3] == 0 && eh.ether_shost[4] == 0 && eh.ether_shost[5] == 0)) - bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC); + bridge_rtupdate(sc, src, src_if, 0, IFBAF_DYNAMIC, m); if ((ifl->bif_flags & IFBIF_STP) && (ifl->bif_state == BSTP_IFSTATE_LEARNING)) { @@ -1193,7 +1201,10 @@ bridgeintr_frame(struct bridge_softc *sc, struct mbuf *m) * side of the bridge, drop it. */ if ((m->m_flags & (M_BCAST | M_MCAST)) == 0) { - dst_if = bridge_rtlookup(sc, dst); + if ((dst_p = bridge_rtlookup(sc, dst)) != NULL) + dst_if = dst_p->brt_if; + else + dst_if = NULL; if (dst_if == src_if) { m_freem(m); return; @@ -1422,7 +1433,7 @@ bridge_input(struct ifnet *ifp, struct ether_header *eh, struct mbuf *m) if (srcifl->bif_flags & IFBIF_LEARNING) bridge_rtupdate(sc, (struct ether_addr *)&eh->ether_shost, - ifp, 0, IFBAF_DYNAMIC); + ifp, 0, IFBAF_DYNAMIC, m); if (bridge_filterrule(&srcifl->bif_brlin, eh, m) == BRL_ACTION_BLOCK) { m_freem(m); @@ -1685,12 +1696,18 @@ bridge_span(struct bridge_softc *sc, struct ether_header *eh, struct ifnet * bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea, - struct ifnet *ifp, int setflags, u_int8_t flags) + struct ifnet *ifp, int setflags, u_int8_t flags, struct mbuf *m) { struct bridge_rtnode *p, *q; + struct sockaddr *sa = NULL; u_int32_t h; int dir; + if (m != NULL) { + /* Check if the mbuf was tagged with a tunnel endpoint addr */ + sa = bridge_tunnel(m); + } + h = bridge_hash(sc, ea); p = LIST_FIRST(&sc->sc_rts[h]); if (p == NULL) { @@ -1703,6 +1720,7 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea, bcopy(ea, &p->brt_addr, sizeof(p->brt_addr)); p->brt_if = ifp; p->brt_age = 1; + bridge_tunnelupdate(sa, (struct sockaddr *)&p->brt_tunnel); if (setflags) p->brt_flags = flags; @@ -1729,6 +1747,9 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea, if (q->brt_if == ifp) q->brt_age = 1; ifp = q->brt_if; + bridge_tunnelupdate(sa, + (struct sockaddr *)&q->brt_tunnel); + goto want; } @@ -1742,6 +1763,8 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea, bcopy(ea, &p->brt_addr, sizeof(p->brt_addr)); p->brt_if = ifp; p->brt_age = 1; + bridge_tunnelupdate(sa, + (struct sockaddr *)&p->brt_tunnel); if (setflags) p->brt_flags = flags; @@ -1763,6 +1786,8 @@ bridge_rtupdate(struct bridge_softc *sc, struct ether_addr *ea, bcopy(ea, &p->brt_addr, sizeof(p->brt_addr)); p->brt_if = ifp; p->brt_age = 1; + bridge_tunnelupdate(sa, + (struct sockaddr *)&p->brt_tunnel); if (setflags) p->brt_flags = flags; @@ -1780,7 +1805,7 @@ want: return (ifp); } -struct ifnet * +struct bridge_rtnode * bridge_rtlookup(struct bridge_softc *sc, struct ether_addr *ea) { struct bridge_rtnode *p; @@ -1791,7 +1816,7 @@ bridge_rtlookup(struct bridge_softc *sc, struct ether_addr *ea) LIST_FOREACH(p, &sc->sc_rts[h], brt_next) { dir = memcmp(ea, &p->brt_addr, sizeof(p->brt_addr)); if (dir == 0) - return (p->brt_if); + return (p); if (dir > 0) goto fail; } @@ -2018,6 +2043,12 @@ bridge_rtfind(struct bridge_softc *sc, struct ifbaconf *baconf) sizeof(bareq.ifba_ifsname)); bcopy(&n->brt_addr, &bareq.ifba_dst, sizeof(bareq.ifba_dst)); + if (n->brt_tunnel.sa.sa_family != AF_UNSPEC) + bcopy(&n->brt_tunnel.sa, + &bareq.ifba_dstsa, + n->brt_tunnel.sa.sa_len); + else + bareq.ifba_dstsa.ss_family = AF_UNSPEC; bareq.ifba_age = n->brt_age; bareq.ifba_flags = n->brt_flags; error = copyout((caddr_t)&bareq, @@ -2823,3 +2854,65 @@ bridge_send_icmp_err(struct bridge_softc *sc, struct ifnet *ifp, m_freem(n); } #endif + +struct sockaddr * +bridge_tunnel(struct mbuf *m) +{ + struct m_tag *mtag; + + if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) == NULL) + return (NULL); + + return ((struct sockaddr *)(mtag + 1)); +} + +struct sockaddr * +bridge_tunneltag(struct mbuf *m, int af) +{ + struct m_tag *mtag; + size_t len; + struct sockaddr *sa; + + if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL) { + sa = (struct sockaddr *)(mtag + 1); + if (sa->sa_family != af) { + m_tag_delete(m, mtag); + mtag = NULL; + } + } + if (mtag == NULL) { + if (af == AF_INET) + len = sizeof(struct sockaddr_in); + else if (af == AF_INET6) + len = sizeof(struct sockaddr_in6); + else + return (NULL); + mtag = m_tag_get(PACKET_TAG_TUNNEL, len, M_NOWAIT); + if (mtag == NULL) + return (NULL); + bzero(mtag + 1, len); + sa = (struct sockaddr *)(mtag + 1); + sa->sa_family = af; + sa->sa_len = len; + m_tag_prepend(m, mtag); + } + + return ((struct sockaddr *)(mtag + 1)); +} + +void +bridge_tunneluntag(struct mbuf *m) +{ + struct m_tag *mtag; + if ((mtag = m_tag_find(m, PACKET_TAG_TUNNEL, NULL)) != NULL) + m_tag_delete(m, mtag); +} + +void +bridge_tunnelupdate(struct sockaddr *sa, struct sockaddr *tunnel) +{ + if (sa != NULL && sa->sa_family != AF_UNSPEC) + memcpy(tunnel, sa, sa->sa_len); + else + tunnel->sa_family = AF_UNSPEC; +} diff --git a/sys/net/if_bridge.h b/sys/net/if_bridge.h index 3fb604dba6e..db956d960cd 100644 --- a/sys/net/if_bridge.h +++ b/sys/net/if_bridge.h @@ -1,4 +1,4 @@ -/* $OpenBSD: if_bridge.h,v 1.37 2013/01/23 13:28:36 camield Exp $ */ +/* $OpenBSD: if_bridge.h,v 1.38 2013/10/13 10:10:03 reyk Exp $ */ /* * Copyright (c) 1999, 2000 Jason L. Wright (jason@thought.net) @@ -122,6 +122,7 @@ struct ifbareq { u_int8_t ifba_age; /* address age */ u_int8_t ifba_flags; /* address flags */ struct ether_addr ifba_dst; /* destination addr */ + struct sockaddr_storage ifba_dstsa; /* tunnel endpoint */ }; #define IFBAF_TYPEMASK 0x03 /* address type mask */ @@ -406,6 +407,15 @@ struct bridge_rtnode { u_int8_t brt_flags; /* address flags */ u_int8_t brt_age; /* age counter */ struct ether_addr brt_addr; /* dst addr */ + union { + struct sockaddr sa; +#ifdef INET + struct sockaddr_in sin; +#endif +#ifdef INET6 + struct sockaddr_in6 sin6; +#endif + } brt_tunnel; /* tunnel endpoint */ }; #ifndef BRIDGE_RTABLE_SIZE @@ -441,6 +451,9 @@ int bridge_output(struct ifnet *, struct mbuf *, struct sockaddr *, void bridge_update(struct ifnet *, struct ether_addr *, int); void bridge_rtdelete(struct bridge_softc *, struct ifnet *, int); void bridge_rtagenode(struct ifnet *, int); +struct sockaddr *bridge_tunnel(struct mbuf *); +struct sockaddr *bridge_tunneltag(struct mbuf *, int); +void bridge_tunneluntag(struct mbuf *); struct bstp_state *bstp_create(struct ifnet *); void bstp_destroy(struct bstp_state *); diff --git a/sys/net/if_vxlan.c b/sys/net/if_vxlan.c new file mode 100644 index 00000000000..69323992ccf --- /dev/null +++ b/sys/net/if_vxlan.c @@ -0,0 +1,590 @@ +/* $OpenBSD: if_vxlan.c,v 1.1 2013/10/13 10:10:03 reyk Exp $ */ + +/* + * Copyright (c) 2013 Reyk Floeter + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#include "bpfilter.h" +#include "vxlan.h" +#include "vlan.h" +#include "pf.h" +#include "bridge.h" + +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include + +#if NBPFILTER > 0 +#include +#endif + +#if NPF > 0 +#include +#endif + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#if NBRIDGE > 0 +#include +#endif + +#include + +void vxlanattach(int); +int vxlanioctl(struct ifnet *, u_long, caddr_t); +void vxlanstart(struct ifnet *); +int vxlan_clone_create(struct if_clone *, int); +int vxlan_clone_destroy(struct ifnet *); +int vxlan_media_change(struct ifnet *); +void vxlan_media_status(struct ifnet *, struct ifmediareq *); +int vxlan_config(struct ifnet *, struct sockaddr *, struct sockaddr *); +int vxlan_output(struct ifnet *, struct mbuf *); + +struct if_clone vxlan_cloner = + IF_CLONE_INITIALIZER("vxlan", vxlan_clone_create, vxlan_clone_destroy); + +int vxlan_enable = 0; +u_long vxlan_tagmask; + +#define VXLAN_TAGHASHSIZE 32 +#define VXLAN_TAGHASH(tag) (tag & vxlan_tagmask) +LIST_HEAD(vxlan_taghash, vxlan_softc) *vxlan_tagh; + +void +vxlanattach(int count) +{ + if ((vxlan_tagh = hashinit(VXLAN_TAGHASHSIZE, M_DEVBUF, M_NOWAIT, + &vxlan_tagmask)) == NULL) + panic("vxlanattach: hashinit"); + + if_clone_attach(&vxlan_cloner); +} + +int +vxlan_clone_create(struct if_clone *ifc, int unit) +{ + struct ifnet *ifp; + struct vxlan_softc *sc; + + if ((sc = malloc(sizeof(*sc), + M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL) + return (ENOMEM); + + sc->sc_imo.imo_membership = malloc( + (sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_IPMOPTS, + M_WAITOK|M_ZERO); + sc->sc_imo.imo_max_memberships = IP_MIN_MEMBERSHIPS; + sc->sc_dstport = htons(VXLAN_PORT); + sc->sc_vnetid = 0; + + ifp = &sc->sc_ac.ac_if; + snprintf(ifp->if_xname, sizeof ifp->if_xname, "vxlan%d", unit); + ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST; + ether_fakeaddr(ifp); + + ifp->if_softc = sc; + ifp->if_ioctl = vxlanioctl; + ifp->if_start = vxlanstart; + IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN); + IFQ_SET_READY(&ifp->if_snd); + + ifp->if_hardmtu = 0xffff; + ifp->if_capabilities = IFCAP_VLAN_MTU; + + ifmedia_init(&sc->sc_media, 0, vxlan_media_change, + vxlan_media_status); + ifmedia_add(&sc->sc_media, IFM_ETHER | IFM_AUTO, 0, NULL); + ifmedia_set(&sc->sc_media, IFM_ETHER | IFM_AUTO); + + if_attach(ifp); + ether_ifattach(ifp); + + /* XXX should we allow IP fragments? */ + ifp->if_mtu = ETHERMTU - sizeof(struct ether_header); +#ifdef INET + ifp->if_mtu -= sizeof(struct vxlanudpiphdr); +#endif + + LIST_INSERT_HEAD(&vxlan_tagh[VXLAN_TAGHASH(0)], sc, sc_entry); + vxlan_enable++; + + return (0); +} + +int +vxlan_clone_destroy(struct ifnet *ifp) +{ + struct vxlan_softc *sc = ifp->if_softc; + + vxlan_enable--; + LIST_REMOVE(sc, sc_entry); + + ifmedia_delete_instance(&sc->sc_media, IFM_INST_ANY); + ether_ifdetach(ifp); + if_detach(ifp); + free(sc->sc_imo.imo_membership, M_IPMOPTS); + free(sc, M_DEVBUF); + + return (0); +} + +void +vxlanstart(struct ifnet *ifp) +{ + struct mbuf *m; + int s; + + for (;;) { + s = splnet(); + IFQ_DEQUEUE(&ifp->if_snd, m); + splx(s); + + if (m == NULL) + return; + ifp->if_opackets++; + +#if NBPFILTER > 0 + if (ifp->if_bpf) + bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT); +#endif + + vxlan_output(ifp, m); + } +} + +int +vxlan_config(struct ifnet *ifp, struct sockaddr *src, struct sockaddr *dst) +{ + struct vxlan_softc *sc = (struct vxlan_softc *)ifp->if_softc; + struct ip_moptions *imo = &sc->sc_imo; +#ifdef INET + struct sockaddr_in *src4, *dst4; + struct ifaddr *ifa; +#endif + int reset = 0; + + if (src != NULL && dst != NULL) { + /* XXX inet6 is not supported */ + if (src->sa_family != AF_INET || dst->sa_family != AF_INET) + return (EAFNOSUPPORT); + } else { + /* Reset current configuration */ + src = (struct sockaddr *)&sc->sc_src; + dst = (struct sockaddr *)&sc->sc_dst; + reset = 1; + } + +#ifdef INET + src4 = (struct sockaddr_in *)src; + dst4 = (struct sockaddr_in *)dst; + + if (src4->sin_len != sizeof(*src4) || dst4->sin_len != sizeof(*dst4)) + return (EINVAL); + + if (IN_MULTICAST(dst4->sin_addr.s_addr)) { + if (src4->sin_addr.s_addr == INADDR_ANY || + IN_MULTICAST(src4->sin_addr.s_addr)) + return (EINVAL); + if ((ifa = ifa_ifwithaddr((struct sockaddr *)src4, + sc->sc_rtableid)) == NULL || + ifa->ifa_ifp == NULL || + (ifa->ifa_ifp->if_flags & IFF_MULTICAST) == 0) + return (EADDRNOTAVAIL); + } +#endif + + if (imo->imo_num_memberships > 0) { + in_delmulti(imo->imo_membership[ + --imo->imo_num_memberships]); + imo->imo_multicast_ifp = NULL; + } + +#ifdef INET + if (IN_MULTICAST(dst4->sin_addr.s_addr)) { + if ((imo->imo_membership[0] = + in_addmulti(&dst4->sin_addr, ifa->ifa_ifp)) == NULL) + return (ENOBUFS); + imo->imo_num_memberships++; + imo->imo_multicast_ifp = ifa->ifa_ifp; + if (sc->sc_ttl > 0) + imo->imo_multicast_ttl = sc->sc_ttl; + else + imo->imo_multicast_ttl = IP_DEFAULT_MULTICAST_TTL; + imo->imo_multicast_loop = 0; + } + if (dst4->sin_port) + sc->sc_dstport = dst4->sin_port; +#endif + + if (!reset) { + bzero(&sc->sc_src, sizeof(sc->sc_src)); + bzero(&sc->sc_dst, sizeof(sc->sc_dst)); + memcpy(&sc->sc_src, src, src->sa_len); + memcpy(&sc->sc_dst, dst, dst->sa_len); + } + + LIST_REMOVE(sc, sc_entry); + LIST_INSERT_HEAD(&vxlan_tagh[VXLAN_TAGHASH(sc->sc_vnetid)], + sc, sc_entry); + + return (0); +} + +/* ARGSUSED */ +int +vxlanioctl(struct ifnet *ifp, u_long cmd, caddr_t data) +{ + struct vxlan_softc *sc = (struct vxlan_softc *)ifp->if_softc; +#ifdef INET + struct ifaddr *ifa = (struct ifaddr *)data; +#endif + struct ifreq *ifr = (struct ifreq *)data; + struct if_laddrreq *lifr = (struct if_laddrreq *)data; + struct proc *p = curproc; + int error = 0, s; + struct ip_moptions *imo = &sc->sc_imo; + + switch (cmd) { + case SIOCSIFADDR: + ifp->if_flags |= IFF_UP; +#ifdef INET + if (ifa->ifa_addr->sa_family == AF_INET) + arp_ifinit(&sc->sc_ac, ifa); +#endif + /* FALLTHROUGH */ + + case SIOCSIFFLAGS: + if (ifp->if_flags & IFF_UP) { + ifp->if_flags |= IFF_RUNNING; + } else { + ifp->if_flags &= ~IFF_RUNNING; + } + break; + + case SIOCADDMULTI: + case SIOCDELMULTI: + if (ifr == 0) { + error = EAFNOSUPPORT; + break; + } + error = (cmd == SIOCADDMULTI) ? + ether_addmulti(ifr, &sc->sc_ac) : + ether_delmulti(ifr, &sc->sc_ac); + if (error == ENETRESET) + error = 0; + break; + + case SIOCGIFMEDIA: + case SIOCSIFMEDIA: + error = ifmedia_ioctl(ifp, ifr, &sc->sc_media, cmd); + break; + + case SIOCSLIFPHYADDR: + if ((error = suser(p, 0)) != 0) + break; + s = splnet(); + error = vxlan_config(ifp, + (struct sockaddr *)&lifr->addr, + (struct sockaddr *)&lifr->dstaddr); + splx(s); + break; + + case SIOCDIFPHYADDR: + if ((error = suser(p, 0)) != 0) + break; + s = splnet(); + if (imo->imo_num_memberships > 0) { + in_delmulti(imo->imo_membership[ + --imo->imo_num_memberships]); + imo->imo_multicast_ifp = NULL; + } + bzero(&sc->sc_src, sizeof(sc->sc_src)); + bzero(&sc->sc_dst, sizeof(sc->sc_dst)); + sc->sc_dstport = htons(VXLAN_PORT); + splx(s); + break; + + case SIOCGLIFPHYADDR: + if (sc->sc_dst.ss_family == AF_UNSPEC) { + error = EADDRNOTAVAIL; + break; + } + bzero(&lifr->addr, sizeof(lifr->addr)); + bzero(&lifr->dstaddr, sizeof(lifr->dstaddr)); + memcpy(&lifr->addr, &sc->sc_src, sc->sc_src.ss_len); + memcpy(&lifr->dstaddr, &sc->sc_dst, sc->sc_dst.ss_len); + break; + + case SIOCSLIFPHYRTABLE: + if ((error = suser(p, 0)) != 0) + break; + if (ifr->ifr_rdomainid < 0 || + ifr->ifr_rdomainid > RT_TABLEID_MAX || + !rtable_exists(ifr->ifr_rdomainid)) { + error = EINVAL; + break; + } + s = splnet(); + sc->sc_rtableid = ifr->ifr_rdomainid; + (void)vxlan_config(ifp, NULL, NULL); + splx(s); + break; + + case SIOCGLIFPHYRTABLE: + ifr->ifr_rdomainid = sc->sc_rtableid; + break; + + case SIOCSLIFPHYTTL: + if ((error = suser(p, 0)) != 0) + break; + if (ifr->ifr_ttl < 0 || ifr->ifr_ttl > 0xff) { + error = EINVAL; + break; + } + if (sc->sc_ttl == (u_int8_t)ifr->ifr_ttl) + break; + s = splnet(); + sc->sc_ttl = (u_int8_t)(ifr->ifr_ttl); + (void)vxlan_config(ifp, NULL, NULL); + splx(s); + break; + + case SIOCGLIFPHYTTL: + ifr->ifr_ttl = (int)sc->sc_ttl; + break; + + case SIOCSVNETID: + if ((error = suser(p, 0)) != 0) + break; + if (ifr->ifr_vnetid < 0 || + ifr->ifr_vnetid > 0x00ffffff) { + error = EINVAL; + break; + } + s = splnet(); + sc->sc_vnetid = (u_int32_t)ifr->ifr_vnetid; + (void)vxlan_config(ifp, NULL, NULL); + splx(s); + break; + + case SIOCGVNETID: + ifr->ifr_vnetid = (int)sc->sc_vnetid; + break; + + default: + error = ether_ioctl(ifp, &sc->sc_ac, cmd, data); + break; + } + + return (error); +} + +int +vxlan_media_change(struct ifnet *ifp) +{ + return (0); +} + +void +vxlan_media_status(struct ifnet *ifp, struct ifmediareq *imr) +{ + imr->ifm_active = IFM_ETHER | IFM_AUTO; + imr->ifm_status = IFM_AVALID | IFM_ACTIVE; +} + +int +vxlan_lookup(struct mbuf *m, struct udphdr *uh, int iphlen, + struct sockaddr *srcsa) +{ + struct vxlan_softc *sc = NULL; + struct vxlan_header v; + u_int32_t vni; + struct ifnet *ifp; + int skip; + struct ether_header *eh; +#if NBRIDGE > 0 + struct sockaddr *sa; +#endif + + /* XXX Should verify the UDP port first before copying the packet */ + skip = iphlen + sizeof(*uh); + if (m->m_pkthdr.len - skip < sizeof(v)) + return (0); + m_copydata(m, skip, sizeof(v), (caddr_t)&v); + skip += sizeof(v); + + vni = ntohl(v.vxlan_id); + + /* Validate header */ + if ((vni == 0) || (vni & VXLAN_RESERVED2) || + (ntohl(v.vxlan_flags) != VXLAN_FLAGS_VNI)) + return (0); + + vni >>= VXLAN_VNI_S; + LIST_FOREACH(sc, &vxlan_tagh[VXLAN_TAGHASH(vni)], + sc_entry) { + if ((uh->uh_dport == sc->sc_dstport) && + vni == sc->sc_vnetid && + sc->sc_rtableid == rtable_l2(m->m_pkthdr.rdomain)) + goto found; + } + + /* not found */ + return (0); + + found: + m_adj(m, skip); + ifp = &sc->sc_ac.ac_if; + m->m_pkthdr.rcvif = ifp; + + if ((eh = mtod(m, struct ether_header *)) == NULL) + return (EINVAL); + +#if NBRIDGE > 0 + /* Store the peer IP address for the bridge */ + if (ifp->if_bridgeport != NULL && + srcsa->sa_family != AF_UNSPEC && + (sa = bridge_tunneltag(m, srcsa->sa_family)) != NULL) + memcpy(sa, srcsa, sa->sa_len); +#endif + + /* Clear multicast flag from the outer packet */ + if (sc->sc_imo.imo_num_memberships > 0 && + m->m_flags & (M_MCAST) && + !ETHER_IS_MULTICAST(eh->ether_dhost)) + m->m_flags &= ~M_MCAST; + +#if NBPFILTER > 0 + if (ifp->if_bpf) + bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_IN); +#endif + + m_adj(m, ETHER_HDR_LEN); + +#if NPF > 0 + pf_pkt_addr_changed(m); +#endif + + ifp->if_ipackets++; + ether_input(ifp, eh, m); + + /* success */ + return (1); +} + +int +vxlan_output(struct ifnet *ifp, struct mbuf *m) +{ + struct vxlan_softc *sc = (struct vxlan_softc *)ifp->if_softc; +#ifdef INET + struct udpiphdr *ui; + struct vxlanudpiphdr *vi; + u_int16_t len = m->m_pkthdr.len; + struct ip *ip; +#if NBRIDGE > 0 + struct sockaddr_in *sin; +#endif +#endif + int error; + +#ifdef INET + /* VXLAN header */ + M_PREPEND(m, sizeof(*vi), M_DONTWAIT); + if (m == NULL) { + ifp->if_oerrors++; + return (ENOBUFS); + } + + len += sizeof(struct vxlan_header); + + ui = mtod(m, struct udpiphdr *); + ui->ui_pr = IPPROTO_UDP; + ui->ui_src = ((struct sockaddr_in *)&sc->sc_src)->sin_addr; + ui->ui_dst = ((struct sockaddr_in *)&sc->sc_dst)->sin_addr; + ui->ui_sport = sc->sc_dstport; + ui->ui_dport = sc->sc_dstport; + ui->ui_ulen = htons(sizeof(struct udphdr) + len); + + ip = (struct ip *)ui; + ip->ip_v = IPVERSION; + ip->ip_hl = sizeof(struct ip) >> 2; + ip->ip_id = htons(ip_randomid()); + ip->ip_off = 0; /* htons(IP_DF); XXX should we disallow IP fragments? */ + ip->ip_tos = IPTOS_LOWDELAY; + ip->ip_len = htons(sizeof(struct udpiphdr) + len); + if (sc->sc_ttl > 0) + ip->ip_ttl = sc->sc_ttl; + else + ip->ip_ttl = IPDEFTTL; + +#if NBRIDGE > 0 + if ((sin = (struct sockaddr_in *)bridge_tunnel(m)) != NULL && + sin->sin_family == AF_INET) { + ui->ui_dst = sin->sin_addr; + + /* + * If the LINK0 flag is set, send the packet back to + * the original source port of the endport, otherwise use + * the configured VXLAN port. + */ + if (ifp->if_flags & IFF_LINK0) + ui->ui_dport = sin->sin_port; + } + if (sin != NULL) + bridge_tunneluntag(m); +#endif + + vi = (struct vxlanudpiphdr *)ui; + vi->ui_v.vxlan_flags = htonl(VXLAN_FLAGS_VNI); + vi->ui_v.vxlan_id = htonl(sc->sc_vnetid << VXLAN_VNI_S); + + /* UDP checksum should be 0 */ + ui->ui_sum = 0; +#endif + + ifp->if_opackets++; + ifp->if_obytes += m->m_pkthdr.len; + + m->m_pkthdr.rdomain = sc->sc_rtableid; + +#if NPF > 0 + pf_pkt_addr_changed(m); +#endif + +#ifdef INET + if ((error = + ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL))) { + ifp->if_oerrors++; + } +#endif + + return (error); +} diff --git a/sys/net/if_vxlan.h b/sys/net/if_vxlan.h new file mode 100644 index 00000000000..47518e47e91 --- /dev/null +++ b/sys/net/if_vxlan.h @@ -0,0 +1,77 @@ +/* $OpenBSD: if_vxlan.h,v 1.1 2013/10/13 10:10:03 reyk Exp $ */ + +/* + * Copyright (c) 2013 Reyk Floeter + * + * Permission to use, copy, modify, and distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES + * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR + * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES + * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + +#ifndef _NET_VXLAN_H +#define _NET_VXLAN_H + +#define VXLANMTU 1492 +#define VXLAN_HDRLEN 8 +#define VXLAN_PORT 4789 + +struct vxlan_header { + u_int32_t vxlan_flags; +#define VXLAN_FLAGS_VNI 0x08000000 +#define VXLAN_RESERVED1 0xf7ffffff + u_int32_t vxlan_id; +#define VXLAN_VNI 0xffffff00 +#define VXLAN_VNI_S 8 +#define VXLAN_RESERVED2 0x000000ff +} __packed; + +#ifdef INET +struct vxlanudpiphdr { + struct ipovly ui_i; + struct udphdr ui_u; + struct vxlan_header ui_v; +} __packed; +#endif + +#define SIOCGETVXLAN SIOCGETPFLOW +#define SIOCSETVXLAN SIOCSETPFLOW + +/* from struct vxlanreq */ +struct vxlanreq { + u_int8_t vxlan_reserved; +}; + +#ifdef _KERNEL +struct vxlan_softc { + struct arpcom sc_ac; + struct ifmedia sc_media; + struct ip_moptions sc_imo; + struct sockaddr_storage sc_src; + struct sockaddr_storage sc_dst; + in_port_t sc_dstport; + u_int sc_rtableid; + u_int32_t sc_vnetid; + u_int8_t sc_ttl; + + LIST_ENTRY(vxlan_softc) sc_entry; +}; + +extern int vxlan_enable; + +int vxlan_lookup(struct mbuf *, struct udphdr *, int, + struct sockaddr *); +struct sockaddr *vxlan_tag_find(struct mbuf *); +struct sockaddr *vxlan_tag_get(struct mbuf *, int); +void vxlan_tag_delete(struct mbuf *); + +#endif /* _KERNEL */ + +#endif /* _NET_VXLAN_H */ -- cgit v1.2.3