1 /* $NetBSD: in_l2tp.c,v 1.22 2023/09/01 11:23:39 andvar Exp $ */
2
3 /*
4 * Copyright (c) 2017 Internet Initiative Japan Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 #include <sys/cdefs.h>
30 __KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.22 2023/09/01 11:23:39 andvar Exp $");
31
32 #ifdef _KERNEL_OPT
33 #include "opt_l2tp.h"
34 #endif
35
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/socket.h>
39 #include <sys/sockio.h>
40 #include <sys/mbuf.h>
41 #include <sys/errno.h>
42 #include <sys/ioctl.h>
43 #include <sys/syslog.h>
44 #include <sys/kernel.h>
45 #include <sys/socketvar.h> /* For softnet_lock */
46
47 #include <net/if.h>
48 #include <net/route.h>
49 #include <net/if_ether.h>
50
51 #include <netinet/in.h>
52 #include <netinet/in_systm.h>
53 #include <netinet/ip.h>
54 #include <netinet/ip_var.h>
55 #include <netinet/ip_private.h>
56 #include <netinet/in_l2tp.h>
57 #include <netinet/in_var.h>
58 #include <netinet/ip_encap.h>
59
60 #ifdef ALTQ
61 #include <altq/altq.h>
62 #endif
63
64 /* TODO: IP_TCPMSS support */
65 #undef IP_TCPMSS
66 #ifdef IP_TCPMSS
67 #include <netinet/ip_tcpmss.h>
68 #endif
69
70 #include <net/if_l2tp.h>
71
72 int ip_l2tp_ttl = L2TP_TTL;
73
74 static void in_l2tp_input(struct mbuf *, int, int, void *);
75
76 static const struct encapsw in_l2tp_encapsw = {
77 .encapsw4 = {
78 .pr_input = in_l2tp_input,
79 .pr_ctlinput = NULL,
80 }
81 };
82
83 static int in_l2tp_match(struct mbuf *, int, int, void *);
84
85 int
in_l2tp_output(struct l2tp_variant * var,struct mbuf * m)86 in_l2tp_output(struct l2tp_variant *var, struct mbuf *m)
87 {
88 struct l2tp_softc *sc;
89 struct ifnet *ifp;
90 struct sockaddr_in *sin_src = satosin(var->lv_psrc);
91 struct sockaddr_in *sin_dst = satosin(var->lv_pdst);
92 struct ip iphdr; /* capsule IP header, host byte ordered */
93 struct rtentry *rt;
94 struct route *ro_pc;
95 kmutex_t *lock_pc;
96
97 int error;
98 uint32_t sess_id;
99
100 KASSERT(var != NULL);
101 KASSERT(l2tp_heldref_variant(var));
102 KASSERT(sin_src != NULL && sin_dst != NULL);
103 KASSERT(sin_src->sin_family == AF_INET
104 && sin_dst->sin_family == AF_INET);
105
106 sc = var->lv_softc;
107 ifp = &sc->l2tp_ec.ec_if;
108 error = l2tp_check_nesting(ifp, m);
109 if (error) {
110 m_freem(m);
111 goto looped;
112 }
113
114 /* bidirectional configured tunnel mode */
115 if (sin_dst->sin_addr.s_addr == INADDR_ANY) {
116 m_freem(m);
117 if ((ifp->if_flags & IFF_DEBUG) != 0)
118 log(LOG_DEBUG, "%s: ENETUNREACH\n", __func__);
119 error = ENETUNREACH;
120 goto out;
121 }
122
123 #ifdef NOTYET
124 /* TODO: support ALTQ for inner frame */
125 #ifdef ALTQ
126 ALTQ_SAVE_PAYLOAD(m, AF_ETHER);
127 #endif
128 #endif
129
130 memset(&iphdr, 0, sizeof(iphdr));
131 iphdr.ip_src = sin_src->sin_addr;
132 iphdr.ip_dst = sin_dst->sin_addr;
133 iphdr.ip_p = IPPROTO_L2TP;
134 /* version will be set in ip_output() */
135 iphdr.ip_ttl = ip_l2tp_ttl;
136 /* outer IP header length */
137 iphdr.ip_len = sizeof(struct ip);
138 /* session-id length */
139 iphdr.ip_len += sizeof(uint32_t);
140 if (var->lv_use_cookie == L2TP_COOKIE_ON) {
141 /* cookie length */
142 iphdr.ip_len += var->lv_peer_cookie_len;
143 }
144
145 /* TODO: IP_TCPMSS support */
146 #ifdef IP_TCPMSS
147 m = l2tp_tcpmss_clamp(ifp, m);
148 if (m == NULL) {
149 error = EINVAL;
150 goto out;
151 }
152 #endif
153
154 /*
155 * Payload length.
156 *
157 * NOTE: payload length may be changed in ip_tcpmss(). Typical case
158 * is missing of TCP mss option in original TCP header.
159 */
160 iphdr.ip_len += m->m_pkthdr.len;
161 HTONS(iphdr.ip_len);
162
163 if (var->lv_use_cookie == L2TP_COOKIE_ON) {
164 /* prepend session cookie */
165 uint32_t cookie_32;
166 uint64_t cookie_64;
167 M_PREPEND(m, var->lv_peer_cookie_len, M_DONTWAIT);
168 if (m && m->m_len < var->lv_peer_cookie_len)
169 m = m_pullup(m, var->lv_peer_cookie_len);
170 if (m == NULL) {
171 error = ENOBUFS;
172 goto out;
173 }
174 if (var->lv_peer_cookie_len == 4) {
175 cookie_32 = htonl((uint32_t)var->lv_peer_cookie);
176 memcpy(mtod(m, void *), &cookie_32, sizeof(uint32_t));
177 } else {
178 cookie_64 = htobe64(var->lv_peer_cookie);
179 memcpy(mtod(m, void *), &cookie_64, sizeof(uint64_t));
180 }
181 }
182
183 /* prepend session-ID */
184 sess_id = htonl(var->lv_peer_sess_id);
185 M_PREPEND(m, sizeof(uint32_t), M_DONTWAIT);
186 if (m && m->m_len < sizeof(uint32_t))
187 m = m_pullup(m, sizeof(uint32_t));
188 if (m == NULL) {
189 error = ENOBUFS;
190 goto out;
191 }
192 memcpy(mtod(m, uint32_t *), &sess_id, sizeof(uint32_t));
193
194 /* prepend new IP header */
195 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
196 if (m == NULL) {
197 error = ENOBUFS;
198 goto out;
199 }
200 if (M_GET_ALIGNED_HDR(&m, struct ip, false) != 0) {
201 error = ENOBUFS;
202 goto out;
203 }
204 memcpy(mtod(m, struct ip *), &iphdr, sizeof(struct ip));
205
206 if_tunnel_get_ro(sc->l2tp_ro_percpu, &ro_pc, &lock_pc);
207 if ((rt = rtcache_lookup(ro_pc, var->lv_pdst)) == NULL) {
208 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc);
209 m_freem(m);
210 error = ENETUNREACH;
211 goto out;
212 }
213
214 if (rt->rt_ifp == ifp) {
215 rtcache_unref(rt, ro_pc);
216 rtcache_free(ro_pc);
217 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc);
218 m_freem(m);
219 error = ENETUNREACH; /*XXX*/
220 goto out;
221 }
222 rtcache_unref(rt, ro_pc);
223
224 /*
225 * To avoid inappropriate rewrite of checksum,
226 * clear csum flags.
227 */
228 m->m_pkthdr.csum_flags = 0;
229
230 error = ip_output(m, NULL, ro_pc, 0, NULL, NULL);
231 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc);
232 return error;
233
234 looped:
235 if (error)
236 if_statinc(ifp, if_oerrors);
237
238 out:
239 return error;
240 }
241
242 static void
in_l2tp_input(struct mbuf * m,int off,int proto,void * eparg __unused)243 in_l2tp_input(struct mbuf *m, int off, int proto, void *eparg __unused)
244 {
245 struct ifnet *l2tpp = NULL;
246 struct l2tp_softc *sc;
247 uint32_t sess_id;
248 uint32_t cookie_32;
249 uint64_t cookie_64;
250 struct psref psref;
251 struct l2tp_variant *var;
252
253 KASSERT((m->m_flags & M_PKTHDR) != 0);
254
255 if (m->m_pkthdr.len < off + sizeof(uint32_t)) {
256 m_freem(m);
257 return;
258 }
259
260 /* get L2TP session ID */
261 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);
262 NTOHL(sess_id);
263 #ifdef L2TP_DEBUG
264 log(LOG_DEBUG, "%s: sess_id = %" PRIu32 "\n", __func__, sess_id);
265 #endif
266 if (sess_id == 0) {
267 /*
268 * L2TPv3 control packet received.
269 * userland daemon(l2tpd?) should process.
270 */
271 SOFTNET_LOCK_IF_NET_MPSAFE();
272 rip_input(m, off, proto);
273 SOFTNET_UNLOCK_IF_NET_MPSAFE();
274 return;
275 }
276
277 var = l2tp_lookup_session_ref(sess_id, &psref);
278 if (var == NULL) {
279 m_freem(m);
280 ip_statinc(IP_STAT_NOL2TP);
281 return;
282 }
283
284 sc = var->lv_softc;
285 l2tpp = &(sc->l2tp_ec.ec_if);
286
287 if (l2tpp == NULL || (l2tpp->if_flags & IFF_UP) == 0) {
288 #ifdef L2TP_DEBUG
289 if (l2tpp == NULL)
290 log(LOG_DEBUG, "%s: l2tpp is NULL\n", __func__);
291 else
292 log(LOG_DEBUG, "%s: l2tpp is down\n", __func__);
293 #endif
294 m_freem(m);
295 ip_statinc(IP_STAT_NOL2TP);
296 goto out;
297 }
298
299 /* other CPU did l2tp_delete_tunnel */
300 if (var->lv_psrc == NULL || var->lv_pdst == NULL) {
301 m_freem(m);
302 ip_statinc(IP_STAT_NOL2TP);
303 goto out;
304 }
305
306 if (var->lv_state != L2TP_STATE_UP) {
307 m_freem(m);
308 goto out;
309 }
310
311 m_adj(m, off + sizeof(uint32_t));
312
313 if (var->lv_use_cookie == L2TP_COOKIE_ON) {
314 if (m->m_pkthdr.len < var->lv_my_cookie_len) {
315 m_freem(m);
316 goto out;
317 }
318 if (var->lv_my_cookie_len == 4) {
319 m_copydata(m, 0, sizeof(uint32_t), (void *)&cookie_32);
320 NTOHL(cookie_32);
321 if (cookie_32 != var->lv_my_cookie) {
322 m_freem(m);
323 goto out;
324 }
325 m_adj(m, sizeof(uint32_t));
326 } else {
327 m_copydata(m, 0, sizeof(uint64_t), (void *)&cookie_64);
328 BE64TOH(cookie_64);
329 if (cookie_64 != var->lv_my_cookie) {
330 m_freem(m);
331 goto out;
332 }
333 m_adj(m, sizeof(uint64_t));
334 }
335 }
336
337 /* TODO: IP_TCPMSS support */
338 #ifdef IP_TCPMSS
339 m = l2tp_tcpmss_clamp(l2tpp, m);
340 if (m == NULL)
341 goto out;
342 #endif
343 l2tp_input(m, l2tpp);
344
345 out:
346 l2tp_putref_variant(var, &psref);
347 return;
348 }
349
350 /*
351 * This function is used by encap4_lookup() to decide priority of the encaptab.
352 * This priority is compared to the match length between mbuf's source/destination
353 * IPv4 address pair and encaptab's one.
354 * l2tp(4) does not use address pairs to search matched encaptab, so this
355 * function must return the length bigger than or equals to IPv4 address pair to
356 * avoid wrong encaptab.
357 */
358 static int
in_l2tp_match(struct mbuf * m,int off,int proto,void * arg)359 in_l2tp_match(struct mbuf *m, int off, int proto, void *arg)
360 {
361 struct l2tp_softc *sc = arg;
362 struct l2tp_variant *var;
363 struct psref psref;
364 uint32_t sess_id;
365 int rv = 0;
366
367 KASSERT(proto == IPPROTO_L2TP);
368
369 var = l2tp_getref_variant(sc, &psref);
370 if (__predict_false(var == NULL))
371 return rv;
372
373 /*
374 * If the packet contains no session ID it cannot match
375 */
376 if (m_length(m) < off + sizeof(uint32_t)) {
377 rv = 0;
378 goto out;
379 }
380
381 /* get L2TP session ID */
382 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);
383 NTOHL(sess_id);
384 if (sess_id == 0) {
385 /*
386 * L2TPv3 control packet received.
387 * userland daemon(l2tpd?) should process.
388 */
389 rv = 32 * 2;
390 } else if (sess_id == var->lv_my_sess_id)
391 rv = 32 * 2;
392 else
393 rv = 0;
394
395 out:
396 l2tp_putref_variant(var, &psref);
397 return rv;
398 }
399
400 int
in_l2tp_attach(struct l2tp_variant * var)401 in_l2tp_attach(struct l2tp_variant *var)
402 {
403 struct l2tp_softc *sc = var->lv_softc;
404
405 if (sc == NULL)
406 return EINVAL;
407
408 var->lv_encap_cookie = encap_attach_addr(AF_INET, IPPROTO_L2TP,
409 var->lv_psrc, var->lv_pdst, in_l2tp_match, &in_l2tp_encapsw, sc);
410 if (var->lv_encap_cookie == NULL)
411 return EEXIST;
412
413 return 0;
414 }
415
416 int
in_l2tp_detach(struct l2tp_variant * var)417 in_l2tp_detach(struct l2tp_variant *var)
418 {
419 int error;
420
421 error = encap_detach(var->lv_encap_cookie);
422 if (error == 0)
423 var->lv_encap_cookie = NULL;
424
425 return error;
426 }
427