[PATCH net-next v2] ip6_tunnel: enable to change proto of fb tunnels

[PATCH net-next v2] ip6_tunnel: enable to change proto of fb tunnels

[Nicolas Dichtel]

This is possible via the ioctl API:
> ip -6 tunnel change ip6tnl0 mode any

Let's align the netlink API:
> ip link set ip6tnl0 type ip6tnl mode any

Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
---

I finally checked  all params, let's do this properly (:

v1 -> v2:
 - returns an error if the user attempts to change anything other than the proto

 net/ipv6/ip6_tunnel.c | 44 ++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 5 deletions(-)

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index a885bb5c98ea..8dcad289b8c5 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1562,11 +1562,22 @@ static void ip6_tnl_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
 	netdev_state_change(t->dev);
 }
 
-static void ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
+static int ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p,
+			   bool strict)
 {
-	/* for default tnl0 device allow to change only the proto */
+	/* For the default ip6tnl0 device, allow changing only the protocol (the
+	 * IP6_TNL_F_CAP_PER_PACKET flag is set on ip6tnl0, and all other
+	 * parameters are 0).
+	 */
+	if (strict &&
+	    (!ipv6_addr_any(&p->laddr) || !ipv6_addr_any(&p->raddr) ||
+	     p->flags != t->parms.flags || p->hop_limit || p->encap_limit ||
+	     p->flowinfo || p->link || p->fwmark || p->collect_md))
+		return -EINVAL;
+
 	t->parms.proto = p->proto;
 	netdev_state_change(t->dev);
+	return 0;
 }
 
 static void
@@ -1680,7 +1691,7 @@ ip6_tnl_siocdevprivate(struct net_device *dev, struct ifreq *ifr,
 			} else
 				t = netdev_priv(dev);
 			if (dev == ip6n->fb_tnl_dev)
-				ip6_tnl0_update(t, &p1);
+				ip6_tnl0_update(t, &p1, false);
 			else
 				ip6_tnl_update(t, &p1);
 		}
@@ -2053,8 +2064,31 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
 	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 	struct ip_tunnel_encap ipencap;
 
-	if (dev == ip6n->fb_tnl_dev)
-		return -EINVAL;
+	if (dev == ip6n->fb_tnl_dev) {
+		struct ip6_tnl *t = netdev_priv(ip6n->fb_tnl_dev);
+
+		if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
+			/* iproute2 always sets TUNNEL_ENCAP_FLAG_CSUM6, so
+			 * let's ignore this flag.
+			 */
+			ipencap.flags &= ~TUNNEL_ENCAP_FLAG_CSUM6;
+			if (memchr_inv(&ipencap, 0, sizeof(ipencap))) {
+				NL_SET_ERR_MSG(extack,
+					       "Only protocol can be changed for fallback tunnel, not encap params");
+				return -EINVAL;
+			}
+		}
+
+		ip6_tnl_netlink_parms(data, &p);
+		if (ip6_tnl0_update(netdev_priv(ip6n->fb_tnl_dev), &p,
+				    true) < 0) {
+			NL_SET_ERR_MSG(extack,
+				       "Only protocol can be changed for fallback tunnel");
+			return -EINVAL;
+		}
+
+		return 0;
+	}
 
 	if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
 		int err = ip6_tnl_encap_setup(t, &ipencap);
-- 
2.47.1

Re: [PATCH net-next v2] ip6_tunnel: enable to change proto of fb tunnels

[Jakub Kicinski]

On Thu, 26 Jun 2025 23:55:09 +0200 Nicolas Dichtel wrote:
> I finally checked  all params, let's do this properly (:

Nice :)

> -static void ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
> +static int ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p,
> +			   bool strict)
>  {
> -	/* for default tnl0 device allow to change only the proto */
> +	/* For the default ip6tnl0 device, allow changing only the protocol (the

nit: the "(the" may look better on the next line?

> +	 * IP6_TNL_F_CAP_PER_PACKET flag is set on ip6tnl0, and all other
> +	 * parameters are 0).
> +	 */
> +	if (strict &&
> +	    (!ipv6_addr_any(&p->laddr) || !ipv6_addr_any(&p->raddr) ||
> +	     p->flags != t->parms.flags || p->hop_limit || p->encap_limit ||
> +	     p->flowinfo || p->link || p->fwmark || p->collect_md))
> +		return -EINVAL;
> +
>  	t->parms.proto = p->proto;
>  	netdev_state_change(t->dev);
> +	return 0;
>  }
>  
>  static void
> @@ -1680,7 +1691,7 @@ ip6_tnl_siocdevprivate(struct net_device *dev, struct ifreq *ifr,
>  			} else
>  				t = netdev_priv(dev);
>  			if (dev == ip6n->fb_tnl_dev)
> -				ip6_tnl0_update(t, &p1);
> +				ip6_tnl0_update(t, &p1, false);
>  			else
>  				ip6_tnl_update(t, &p1);
>  		}
> @@ -2053,8 +2064,31 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
>  	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
>  	struct ip_tunnel_encap ipencap;
>  
> -	if (dev == ip6n->fb_tnl_dev)
> -		return -EINVAL;
> +	if (dev == ip6n->fb_tnl_dev) {
> +		struct ip6_tnl *t = netdev_priv(ip6n->fb_tnl_dev);

the compiler complains that t is declared here but not used..

> +
> +		if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
> +			/* iproute2 always sets TUNNEL_ENCAP_FLAG_CSUM6, so
> +			 * let's ignore this flag.
> +			 */
> +			ipencap.flags &= ~TUNNEL_ENCAP_FLAG_CSUM6;
> +			if (memchr_inv(&ipencap, 0, sizeof(ipencap))) {
> +				NL_SET_ERR_MSG(extack,
> +					       "Only protocol can be changed for fallback tunnel, not encap params");
> +				return -EINVAL;
> +			}
> +		}
> +
> +		ip6_tnl_netlink_parms(data, &p);
> +		if (ip6_tnl0_update(netdev_priv(ip6n->fb_tnl_dev), &p,

.. you probably meant to use it here?
-- 
pw-bot: cr

Re: [PATCH net-next v2] ip6_tunnel: enable to change proto of fb tunnels

[Nicolas Dichtel]

Le 28/06/2025 à 00:29, Jakub Kicinski a écrit :
> On Thu, 26 Jun 2025 23:55:09 +0200 Nicolas Dichtel wrote:
>> I finally checked  all params, let's do this properly (:
> 
> Nice :)
> 
>> -static void ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p)
>> +static int ip6_tnl0_update(struct ip6_tnl *t, struct __ip6_tnl_parm *p,
>> +			   bool strict)
>>  {
>> -	/* for default tnl0 device allow to change only the proto */
>> +	/* For the default ip6tnl0 device, allow changing only the protocol (the
> 
> nit: the "(the" may look better on the next line?
Ok.

> 
>> +	 * IP6_TNL_F_CAP_PER_PACKET flag is set on ip6tnl0, and all other
>> +	 * parameters are 0).
>> +	 */
>> +	if (strict &&
>> +	    (!ipv6_addr_any(&p->laddr) || !ipv6_addr_any(&p->raddr) ||
>> +	     p->flags != t->parms.flags || p->hop_limit || p->encap_limit ||
>> +	     p->flowinfo || p->link || p->fwmark || p->collect_md))
>> +		return -EINVAL;
>> +
>>  	t->parms.proto = p->proto;
>>  	netdev_state_change(t->dev);
>> +	return 0;
>>  }
>>  
>>  static void
>> @@ -1680,7 +1691,7 @@ ip6_tnl_siocdevprivate(struct net_device *dev, struct ifreq *ifr,
>>  			} else
>>  				t = netdev_priv(dev);
>>  			if (dev == ip6n->fb_tnl_dev)
>> -				ip6_tnl0_update(t, &p1);
>> +				ip6_tnl0_update(t, &p1, false);
>>  			else
>>  				ip6_tnl_update(t, &p1);
>>  		}
>> @@ -2053,8 +2064,31 @@ static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
>>  	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
>>  	struct ip_tunnel_encap ipencap;
>>  
>> -	if (dev == ip6n->fb_tnl_dev)
>> -		return -EINVAL;
>> +	if (dev == ip6n->fb_tnl_dev) {
>> +		struct ip6_tnl *t = netdev_priv(ip6n->fb_tnl_dev);
> 
> the compiler complains that t is declared here but not used..
Oops

> 
>> +
>> +		if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
>> +			/* iproute2 always sets TUNNEL_ENCAP_FLAG_CSUM6, so
>> +			 * let's ignore this flag.
>> +			 */
>> +			ipencap.flags &= ~TUNNEL_ENCAP_FLAG_CSUM6;
>> +			if (memchr_inv(&ipencap, 0, sizeof(ipencap))) {
>> +				NL_SET_ERR_MSG(extack,
>> +					       "Only protocol can be changed for fallback tunnel, not encap params");
>> +				return -EINVAL;
>> +			}
>> +		}
>> +
>> +		ip6_tnl_netlink_parms(data, &p);
>> +		if (ip6_tnl0_update(netdev_priv(ip6n->fb_tnl_dev), &p,
> 
> .. you probably meant to use it here?
Yes. It was used by the v1.1 :)


Regards,
Nicolas

Re: [PATCH net-next v2] ip6_tunnel: enable to change proto of fb tunnels

[kernel test robot]

Hi Nicolas,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]

url:    https://github.com/intel-lab-lkp/linux/commits/Nicolas-Dichtel/ip6_tunnel-enable-to-change-proto-of-fb-tunnels/20250627-060113
base:   net-next/main
patch link:    https://lore.kernel.org/r/20250626215919.2825347-1-nicolas.dichtel%406wind.com
patch subject: [PATCH net-next v2] ip6_tunnel: enable to change proto of fb tunnels
config: x86_64-rhel-9.4 (https://download.01.org/0day-ci/archive/20250628/202506280734.J8kwhuua-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14+deb12u1) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250628/202506280734.J8kwhuua-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202506280734.J8kwhuua-lkp@intel.com/

All warnings (new ones prefixed by >>):

   net/ipv6/ip6_tunnel.c: In function 'ip6_tnl_changelink':
>> net/ipv6/ip6_tunnel.c:2068:33: warning: unused variable 't' [-Wunused-variable]
    2068 |                 struct ip6_tnl *t = netdev_priv(ip6n->fb_tnl_dev);
         |                                 ^


vim +/t +2068 net/ipv6/ip6_tunnel.c

  2056	
  2057	static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[],
  2058				      struct nlattr *data[],
  2059				      struct netlink_ext_ack *extack)
  2060	{
  2061		struct ip6_tnl *t = netdev_priv(dev);
  2062		struct __ip6_tnl_parm p;
  2063		struct net *net = t->net;
  2064		struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
  2065		struct ip_tunnel_encap ipencap;
  2066	
  2067		if (dev == ip6n->fb_tnl_dev) {
> 2068			struct ip6_tnl *t = netdev_priv(ip6n->fb_tnl_dev);
  2069	
  2070			if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
  2071				/* iproute2 always sets TUNNEL_ENCAP_FLAG_CSUM6, so
  2072				 * let's ignore this flag.
  2073				 */
  2074				ipencap.flags &= ~TUNNEL_ENCAP_FLAG_CSUM6;
  2075				if (memchr_inv(&ipencap, 0, sizeof(ipencap))) {
  2076					NL_SET_ERR_MSG(extack,
  2077						       "Only protocol can be changed for fallback tunnel, not encap params");
  2078					return -EINVAL;
  2079				}
  2080			}
  2081	
  2082			ip6_tnl_netlink_parms(data, &p);
  2083			if (ip6_tnl0_update(netdev_priv(ip6n->fb_tnl_dev), &p,
  2084					    true) < 0) {
  2085				NL_SET_ERR_MSG(extack,
  2086					       "Only protocol can be changed for fallback tunnel");
  2087				return -EINVAL;
  2088			}
  2089	
  2090			return 0;
  2091		}
  2092	
  2093		if (ip_tunnel_netlink_encap_parms(data, &ipencap)) {
  2094			int err = ip6_tnl_encap_setup(t, &ipencap);
  2095	
  2096			if (err < 0)
  2097				return err;
  2098		}
  2099		ip6_tnl_netlink_parms(data, &p);
  2100		if (p.collect_md)
  2101			return -EINVAL;
  2102	
  2103		t = ip6_tnl_locate(net, &p, 0);
  2104		if (!IS_ERR(t)) {
  2105			if (t->dev != dev)
  2106				return -EEXIST;
  2107		} else
  2108			t = netdev_priv(dev);
  2109	
  2110		ip6_tnl_update(t, &p);
  2111		return 0;
  2112	}
  2113	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki