xref: /netbsd-src/sys/netinet/in_gif.c (revision b7b7574d3bf8eeb51a1fa3977b59142ec6434a55) 
1 /*	$NetBSD: in_gif.c,v 1.64 2014/05/18 14:46:16 rmind Exp $	*/
2 /*	$KAME: in_gif.c,v 1.66 2001/07/29 04:46:09 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: in_gif.c,v 1.64 2014/05/18 14:46:16 rmind Exp $");
35 
36 #include "opt_inet.h"
37 
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/mbuf.h>
43 #include <sys/errno.h>
44 #include <sys/ioctl.h>
45 #include <sys/syslog.h>
46 #include <sys/protosw.h>
47 #include <sys/kernel.h>
48 
49 #include <net/if.h>
50 #include <net/route.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/in_systm.h>
54 #include <netinet/ip.h>
55 #include <netinet/ip_var.h>
56 #include <netinet/in_gif.h>
57 #include <netinet/in_var.h>
58 #include <netinet/ip_encap.h>
59 #include <netinet/ip_ecn.h>
60 
61 #ifdef INET6
62 #include <netinet/ip6.h>
63 #endif
64 
65 #include <net/if_gif.h>
66 
67 #include "gif.h"
68 
69 #include <net/net_osdep.h>
70 
71 static int gif_validate4(const struct ip *, struct gif_softc *,
72 	struct ifnet *);
73 
74 #if NGIF > 0
75 int ip_gif_ttl = GIF_TTL;
76 #else
77 int ip_gif_ttl = 0;
78 #endif
79 
80 const struct protosw in_gif_protosw = {
81 	.pr_type	= SOCK_RAW,
82 	.pr_domain	= &inetdomain,
83 	.pr_protocol	= 0 /* IPPROTO_IPV[46] */,
84 	.pr_flags	= PR_ATOMIC|PR_ADDR,
85 	.pr_input	= in_gif_input,
86 	.pr_output	= rip_output,
87 	.pr_ctlinput	= NULL,
88 	.pr_ctloutput	= rip_ctloutput,
89 	.pr_usrreqs	= &rip_usrreqs,
90 };
91 
92 int
93 in_gif_output(struct ifnet *ifp, int family, struct mbuf *m)
94 {
95 	struct rtentry *rt;
96 	struct gif_softc *sc = ifp->if_softc;
97 	struct sockaddr_in *sin_src = (struct sockaddr_in *)sc->gif_psrc;
98 	struct sockaddr_in *sin_dst = (struct sockaddr_in *)sc->gif_pdst;
99 	struct ip iphdr;	/* capsule IP header, host byte ordered */
100 	int proto, error;
101 	u_int8_t tos;
102 	union {
103 		struct sockaddr		dst;
104 		struct sockaddr_in	dst4;
105 	} u;
106 
107 	if (sin_src == NULL || sin_dst == NULL ||
108 	    sin_src->sin_family != AF_INET ||
109 	    sin_dst->sin_family != AF_INET) {
110 		m_freem(m);
111 		return EAFNOSUPPORT;
112 	}
113 
114 	switch (family) {
115 #ifdef INET
116 	case AF_INET:
117 	    {
118 		const struct ip *ip;
119 
120 		proto = IPPROTO_IPV4;
121 		if (m->m_len < sizeof(*ip)) {
122 			m = m_pullup(m, sizeof(*ip));
123 			if (m == NULL)
124 				return ENOBUFS;
125 		}
126 		ip = mtod(m, const struct ip *);
127 		tos = ip->ip_tos;
128 		break;
129 	    }
130 #endif /* INET */
131 #ifdef INET6
132 	case AF_INET6:
133 	    {
134 		const struct ip6_hdr *ip6;
135 		proto = IPPROTO_IPV6;
136 		if (m->m_len < sizeof(*ip6)) {
137 			m = m_pullup(m, sizeof(*ip6));
138 			if (m == NULL)
139 				return ENOBUFS;
140 		}
141 		ip6 = mtod(m, const struct ip6_hdr *);
142 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
143 		break;
144 	    }
145 #endif /* INET6 */
146 	default:
147 #ifdef DEBUG
148 		printf("in_gif_output: warning: unknown family %d passed\n",
149 			family);
150 #endif
151 		m_freem(m);
152 		return EAFNOSUPPORT;
153 	}
154 
155 	memset(&iphdr, 0, sizeof(iphdr));
156 	iphdr.ip_src = sin_src->sin_addr;
157 	/* bidirectional configured tunnel mode */
158 	if (sin_dst->sin_addr.s_addr != INADDR_ANY)
159 		iphdr.ip_dst = sin_dst->sin_addr;
160 	else {
161 		m_freem(m);
162 		return ENETUNREACH;
163 	}
164 	iphdr.ip_p = proto;
165 	/* version will be set in ip_output() */
166 	iphdr.ip_ttl = ip_gif_ttl;
167 	iphdr.ip_len = htons(m->m_pkthdr.len + sizeof(struct ip));
168 	if (ifp->if_flags & IFF_LINK1)
169 		ip_ecn_ingress(ECN_ALLOWED, &iphdr.ip_tos, &tos);
170 	else
171 		ip_ecn_ingress(ECN_NOCARE, &iphdr.ip_tos, &tos);
172 
173 	/* prepend new IP header */
174 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
175 	/* XXX Is m_pullup really necessary after M_PREPEND? */
176 	if (m != NULL && M_UNWRITABLE(m, sizeof(struct ip)))
177 		m = m_pullup(m, sizeof(struct ip));
178 	if (m == NULL)
179 		return ENOBUFS;
180 	bcopy(&iphdr, mtod(m, struct ip *), sizeof(struct ip));
181 
182 	sockaddr_in_init(&u.dst4, &sin_dst->sin_addr, 0);
183 	if ((rt = rtcache_lookup(&sc->gif_ro, &u.dst)) == NULL) {
184 		m_freem(m);
185 		return ENETUNREACH;
186 	}
187 
188 	/* If the route constitutes infinite encapsulation, punt. */
189 	if (rt->rt_ifp == ifp) {
190 		rtcache_free(&sc->gif_ro);
191 		m_freem(m);
192 		return ENETUNREACH;	/*XXX*/
193 	}
194 
195 	error = ip_output(m, NULL, &sc->gif_ro, 0, NULL, NULL);
196 	return (error);
197 }
198 
199 void
200 in_gif_input(struct mbuf *m, ...)
201 {
202 	int off, proto;
203 	struct ifnet *gifp = NULL;
204 	const struct ip *ip;
205 	va_list ap;
206 	int af;
207 	u_int8_t otos;
208 
209 	va_start(ap, m);
210 	off = va_arg(ap, int);
211 	proto = va_arg(ap, int);
212 	va_end(ap);
213 
214 	ip = mtod(m, const struct ip *);
215 
216 	gifp = (struct ifnet *)encap_getarg(m);
217 
218 	if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) {
219 		m_freem(m);
220 		ip_statinc(IP_STAT_NOGIF);
221 		return;
222 	}
223 #ifndef GIF_ENCAPCHECK
224 	if (!gif_validate4(ip, gifp->if_softc, m->m_pkthdr.rcvif)) {
225 		m_freem(m);
226 		ip_statinc(IP_STAT_NOGIF);
227 		return;
228 	}
229 #endif
230 
231 	otos = ip->ip_tos;
232 	m_adj(m, off);
233 
234 	switch (proto) {
235 #ifdef INET
236 	case IPPROTO_IPV4:
237 	    {
238 		struct ip *xip;
239 		af = AF_INET;
240 		if (M_UNWRITABLE(m, sizeof(*xip))) {
241 			if ((m = m_pullup(m, sizeof(*xip))) == NULL)
242 				return;
243 		}
244 		xip = mtod(m, struct ip *);
245 		if (gifp->if_flags & IFF_LINK1)
246 			ip_ecn_egress(ECN_ALLOWED, &otos, &xip->ip_tos);
247 		else
248 			ip_ecn_egress(ECN_NOCARE, &otos, &xip->ip_tos);
249 		break;
250 	    }
251 #endif
252 #ifdef INET6
253 	case IPPROTO_IPV6:
254 	    {
255 		struct ip6_hdr *ip6;
256 		u_int8_t itos;
257 		af = AF_INET6;
258 		if (M_UNWRITABLE(m, sizeof(*ip6))) {
259 			if ((m = m_pullup(m, sizeof(*ip6))) == NULL)
260 				return;
261 		}
262 		ip6 = mtod(m, struct ip6_hdr *);
263 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
264 		if (gifp->if_flags & IFF_LINK1)
265 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
266 		else
267 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
268 		ip6->ip6_flow &= ~htonl(0xff << 20);
269 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
270 		break;
271 	    }
272 #endif /* INET6 */
273 	default:
274 		ip_statinc(IP_STAT_NOGIF);
275 		m_freem(m);
276 		return;
277 	}
278 	gif_input(m, af, gifp);
279 	return;
280 }
281 
282 /*
283  * validate outer address.
284  */
285 static int
286 gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp)
287 {
288 	struct sockaddr_in *src, *dst;
289 	struct in_ifaddr *ia4;
290 
291 	src = (struct sockaddr_in *)sc->gif_psrc;
292 	dst = (struct sockaddr_in *)sc->gif_pdst;
293 
294 	/* check for address match */
295 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
296 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
297 		return 0;
298 
299 	/* martian filters on outer source - NOT done in ip_input! */
300 	if (IN_MULTICAST(ip->ip_src.s_addr))
301 		return 0;
302 	switch ((ntohl(ip->ip_src.s_addr) & 0xff000000) >> 24) {
303 	case 0: case 127: case 255:
304 		return 0;
305 	}
306 	/* reject packets with broadcast on source */
307 	TAILQ_FOREACH(ia4, &in_ifaddrhead, ia_list) {
308 		if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0)
309 			continue;
310 		if (ip->ip_src.s_addr == ia4->ia_broadaddr.sin_addr.s_addr)
311 			return 0;
312 	}
313 
314 	/* ingress filters on outer source */
315 	if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) {
316 		union {
317 			struct sockaddr sa;
318 			struct sockaddr_in sin;
319 		} u;
320 		struct rtentry *rt;
321 
322 		sockaddr_in_init(&u.sin, &ip->ip_src, 0);
323 		rt = rtalloc1(&u.sa, 0);
324 		if (rt == NULL || rt->rt_ifp != ifp) {
325 #if 0
326 			log(LOG_WARNING, "%s: packet from 0x%x dropped "
327 			    "due to ingress filter\n", if_name(&sc->gif_if),
328 			    (u_int32_t)ntohl(u.sin.sin_addr.s_addr));
329 #endif
330 			if (rt != NULL)
331 				rtfree(rt);
332 			return 0;
333 		}
334 		rtfree(rt);
335 	}
336 
337 	return 32 * 2;
338 }
339 
340 #ifdef GIF_ENCAPCHECK
341 /*
342  * we know that we are in IFF_UP, outer address available, and outer family
343  * matched the physical addr family.  see gif_encapcheck().
344  */
345 int
346 gif_encapcheck4(struct mbuf *m, int off, int proto, void *arg)
347 {
348 	struct ip ip;
349 	struct gif_softc *sc;
350 	struct ifnet *ifp;
351 
352 	/* sanity check done in caller */
353 	sc = arg;
354 
355 	m_copydata(m, 0, sizeof(ip), &ip);
356 	ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
357 
358 	return gif_validate4(&ip, sc, ifp);
359 }
360 #endif
361 
362 int
363 in_gif_attach(struct gif_softc *sc)
364 {
365 #ifndef GIF_ENCAPCHECK
366 	struct sockaddr_in mask4;
367 
368 	memset(&mask4, 0, sizeof(mask4));
369 	mask4.sin_len = sizeof(struct sockaddr_in);
370 	mask4.sin_addr.s_addr = ~0;
371 
372 	if (!sc->gif_psrc || !sc->gif_pdst)
373 		return EINVAL;
374 	sc->encap_cookie4 = encap_attach(AF_INET, -1, sc->gif_psrc,
375 	    (struct sockaddr *)&mask4, sc->gif_pdst, (struct sockaddr *)&mask4,
376 	    (const struct protosw *)&in_gif_protosw, sc);
377 #else
378 	sc->encap_cookie4 = encap_attach_func(AF_INET, -1, gif_encapcheck,
379 	    &in_gif_protosw, sc);
380 #endif
381 	if (sc->encap_cookie4 == NULL)
382 		return EEXIST;
383 	return 0;
384 }
385 
386 int
387 in_gif_detach(struct gif_softc *sc)
388 {
389 	int error;
390 
391 	error = encap_detach(sc->encap_cookie4);
392 	if (error == 0)
393 		sc->encap_cookie4 = NULL;
394 
395 	rtcache_free(&sc->gif_ro);
396 
397 	return error;
398 }
399