1 /* $NetBSD: in_l2tp.c,v 1.12 2018/01/26 07:49:15 maxv Exp $ */ 2 3 /* 4 * Copyright (c) 2017 Internet Initiative Japan Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.12 2018/01/26 07:49:15 maxv Exp $"); 31 32 #ifdef _KERNEL_OPT 33 #include "opt_l2tp.h" 34 #endif 35 36 #include <sys/param.h> 37 #include <sys/systm.h> 38 #include <sys/socket.h> 39 #include <sys/sockio.h> 40 #include <sys/mbuf.h> 41 #include <sys/errno.h> 42 #include <sys/ioctl.h> 43 #include <sys/syslog.h> 44 #include <sys/kernel.h> 45 46 #include <net/if.h> 47 #include <net/route.h> 48 #include <net/if_ether.h> 49 50 #include <netinet/in.h> 51 #include <netinet/in_systm.h> 52 #include <netinet/ip.h> 53 #include <netinet/ip_var.h> 54 #include <netinet/ip_private.h> 55 #include <netinet/in_l2tp.h> 56 #include <netinet/in_var.h> 57 #include <netinet/ip_encap.h> 58 59 #ifdef ALTQ 60 #include <altq/altq.h> 61 #endif 62 63 /* TODO: IP_TCPMSS support */ 64 #undef IP_TCPMSS 65 #ifdef IP_TCPMSS 66 #include <netinet/ip_tcpmss.h> 67 #endif 68 69 #include <net/if_l2tp.h> 70 71 #include <net/net_osdep.h> 72 73 int ip_l2tp_ttl = L2TP_TTL; 74 75 static void in_l2tp_input(struct mbuf *, int, int, void *); 76 77 static const struct encapsw in_l2tp_encapsw = { 78 .encapsw4 = { 79 .pr_input = in_l2tp_input, 80 .pr_ctlinput = NULL, 81 } 82 }; 83 84 static int in_l2tp_match(struct mbuf *, int, int, void *); 85 86 int 87 in_l2tp_output(struct l2tp_variant *var, struct mbuf *m) 88 { 89 struct l2tp_softc *sc; 90 struct ifnet *ifp; 91 struct sockaddr_in *sin_src = satosin(var->lv_psrc); 92 struct sockaddr_in *sin_dst = satosin(var->lv_pdst); 93 struct ip iphdr; /* capsule IP header, host byte ordered */ 94 struct rtentry *rt; 95 struct l2tp_ro *lro; 96 int error; 97 uint32_t sess_id; 98 99 KASSERT(var != NULL); 100 KASSERT(l2tp_heldref_variant(var)); 101 KASSERT(sin_src != NULL && sin_dst != NULL); 102 KASSERT(sin_src->sin_family == AF_INET 103 && sin_dst->sin_family == AF_INET); 104 105 sc = var->lv_softc; 106 ifp = &sc->l2tp_ec.ec_if; 107 error = l2tp_check_nesting(ifp, m); 108 if (error) { 109 m_freem(m); 110 goto looped; 111 } 112 113 /* bidirectional configured tunnel mode */ 114 if (sin_dst->sin_addr.s_addr == INADDR_ANY) { 115 m_freem(m); 116 if ((ifp->if_flags & IFF_DEBUG) != 0) 117 log(LOG_DEBUG, "%s: ENETUNREACH\n", __func__); 118 error = ENETUNREACH; 119 goto out; 120 } 121 122 #ifdef NOTYET 123 /* TODO: support ALTQ for innner frame */ 124 #ifdef ALTQ 125 ALTQ_SAVE_PAYLOAD(m, AF_ETHER); 126 #endif 127 #endif 128 129 memset(&iphdr, 0, sizeof(iphdr)); 130 iphdr.ip_src = sin_src->sin_addr; 131 iphdr.ip_dst = sin_dst->sin_addr; 132 iphdr.ip_p = IPPROTO_L2TP; 133 /* version will be set in ip_output() */ 134 iphdr.ip_ttl = ip_l2tp_ttl; 135 /* outer IP header length */ 136 iphdr.ip_len = sizeof(struct ip); 137 /* session-id length */ 138 iphdr.ip_len += sizeof(uint32_t); 139 if (var->lv_use_cookie == L2TP_COOKIE_ON) { 140 /* cookie length */ 141 iphdr.ip_len += var->lv_peer_cookie_len; 142 } 143 144 /* TODO: IP_TCPMSS support */ 145 #ifdef IP_TCPMSS 146 m = l2tp_tcpmss_clamp(ifp, m); 147 if (m == NULL) { 148 error = EINVAL; 149 goto out; 150 } 151 #endif 152 153 /* 154 * Payload length. 155 * 156 * NOTE: payload length may be changed in ip_tcpmss(). Typical case 157 * is missing of TCP mss option in original TCP header. 158 */ 159 iphdr.ip_len += m->m_pkthdr.len; 160 HTONS(iphdr.ip_len); 161 162 if (var->lv_use_cookie == L2TP_COOKIE_ON) { 163 /* prepend session cookie */ 164 uint32_t cookie_32; 165 uint64_t cookie_64; 166 M_PREPEND(m, var->lv_peer_cookie_len, M_DONTWAIT); 167 if (m && m->m_len < var->lv_peer_cookie_len) 168 m = m_pullup(m, var->lv_peer_cookie_len); 169 if (m == NULL) { 170 error = ENOBUFS; 171 goto out; 172 } 173 if (var->lv_peer_cookie_len == 4) { 174 cookie_32 = htonl((uint32_t)var->lv_peer_cookie); 175 memcpy(mtod(m, void *), &cookie_32, sizeof(uint32_t)); 176 } else { 177 cookie_64 = htobe64(var->lv_peer_cookie); 178 memcpy(mtod(m, void *), &cookie_64, sizeof(uint64_t)); 179 } 180 } 181 182 /* prepend session-ID */ 183 sess_id = htonl(var->lv_peer_sess_id); 184 M_PREPEND(m, sizeof(uint32_t), M_DONTWAIT); 185 if (m && m->m_len < sizeof(uint32_t)) 186 m = m_pullup(m, sizeof(uint32_t)); 187 if (m == NULL) { 188 error = ENOBUFS; 189 goto out; 190 } 191 memcpy(mtod(m, uint32_t *), &sess_id, sizeof(uint32_t)); 192 193 /* prepend new IP header */ 194 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 195 if (m == NULL) { 196 error = ENOBUFS; 197 goto out; 198 } 199 if (IP_HDR_ALIGNED_P(mtod(m, void *)) == 0) { 200 m = m_copyup(m, sizeof(struct ip), 0); 201 } else { 202 if (m->m_len < sizeof(struct ip)) 203 m = m_pullup(m, sizeof(struct ip)); 204 } 205 if (m == NULL) { 206 error = ENOBUFS; 207 goto out; 208 } 209 memcpy(mtod(m, struct ip *), &iphdr, sizeof(struct ip)); 210 211 lro = percpu_getref(sc->l2tp_ro_percpu); 212 mutex_enter(&lro->lr_lock); 213 if ((rt = rtcache_lookup(&lro->lr_ro, var->lv_pdst)) == NULL) { 214 mutex_exit(&lro->lr_lock); 215 percpu_putref(sc->l2tp_ro_percpu); 216 m_freem(m); 217 error = ENETUNREACH; 218 goto out; 219 } 220 221 if (rt->rt_ifp == ifp) { 222 rtcache_unref(rt, &lro->lr_ro); 223 rtcache_free(&lro->lr_ro); 224 mutex_exit(&lro->lr_lock); 225 percpu_putref(sc->l2tp_ro_percpu); 226 m_freem(m); 227 error = ENETUNREACH; /*XXX*/ 228 goto out; 229 } 230 rtcache_unref(rt, &lro->lr_ro); 231 232 /* 233 * To avoid inappropriate rewrite of checksum, 234 * clear csum flags. 235 */ 236 m->m_pkthdr.csum_flags = 0; 237 238 error = ip_output(m, NULL, &lro->lr_ro, 0, NULL, NULL); 239 mutex_exit(&lro->lr_lock); 240 percpu_putref(sc->l2tp_ro_percpu); 241 return error; 242 243 looped: 244 if (error) 245 ifp->if_oerrors++; 246 247 out: 248 return error; 249 } 250 251 static void 252 in_l2tp_input(struct mbuf *m, int off, int proto, void *eparg __unused) 253 { 254 struct ifnet *l2tpp = NULL; 255 struct l2tp_softc *sc; 256 uint32_t sess_id; 257 uint32_t cookie_32; 258 uint64_t cookie_64; 259 struct psref psref; 260 struct l2tp_variant *var; 261 262 KASSERT((m->m_flags & M_PKTHDR) != 0); 263 264 if (m->m_pkthdr.len < off + sizeof(uint32_t)) { 265 m_freem(m); 266 return; 267 } 268 269 /* get L2TP session ID */ 270 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id); 271 NTOHL(sess_id); 272 #ifdef L2TP_DEBUG 273 log(LOG_DEBUG, "%s: sess_id = %" PRIu32 "\n", __func__, sess_id); 274 #endif 275 if (sess_id == 0) { 276 /* 277 * L2TPv3 control packet received. 278 * userland daemon(l2tpd?) should process. 279 */ 280 rip_input(m, off, proto); 281 return; 282 } 283 284 var = l2tp_lookup_session_ref(sess_id, &psref); 285 if (var == NULL) { 286 m_freem(m); 287 ip_statinc(IP_STAT_NOL2TP); 288 return; 289 } 290 291 sc = var->lv_softc; 292 l2tpp = &(sc->l2tp_ec.ec_if); 293 294 if (l2tpp == NULL || (l2tpp->if_flags & IFF_UP) == 0) { 295 #ifdef L2TP_DEBUG 296 if (l2tpp == NULL) 297 log(LOG_DEBUG, "%s: l2tpp is NULL\n", __func__); 298 else 299 log(LOG_DEBUG, "%s: l2tpp is down\n", __func__); 300 #endif 301 m_freem(m); 302 ip_statinc(IP_STAT_NOL2TP); 303 goto out; 304 } 305 306 /* other CPU did l2tp_delete_tunnel */ 307 if (var->lv_psrc == NULL || var->lv_pdst == NULL) { 308 m_freem(m); 309 ip_statinc(IP_STAT_NOL2TP); 310 goto out; 311 } 312 313 if (var->lv_state != L2TP_STATE_UP) { 314 m_freem(m); 315 goto out; 316 } 317 318 m_adj(m, off + sizeof(uint32_t)); 319 320 if (var->lv_use_cookie == L2TP_COOKIE_ON) { 321 if (m->m_pkthdr.len < var->lv_my_cookie_len) { 322 m_freem(m); 323 goto out; 324 } 325 if (var->lv_my_cookie_len == 4) { 326 m_copydata(m, 0, sizeof(uint32_t), (void *)&cookie_32); 327 NTOHL(cookie_32); 328 if (cookie_32 != var->lv_my_cookie) { 329 m_freem(m); 330 goto out; 331 } 332 m_adj(m, sizeof(uint32_t)); 333 } else { 334 m_copydata(m, 0, sizeof(uint64_t), (void *)&cookie_64); 335 BE64TOH(cookie_64); 336 if (cookie_64 != var->lv_my_cookie) { 337 m_freem(m); 338 goto out; 339 } 340 m_adj(m, sizeof(uint64_t)); 341 } 342 } 343 344 /* TODO: IP_TCPMSS support */ 345 #ifdef IP_TCPMSS 346 m = l2tp_tcpmss_clamp(l2tpp, m); 347 if (m == NULL) 348 goto out; 349 #endif 350 l2tp_input(m, l2tpp); 351 352 out: 353 l2tp_putref_variant(var, &psref); 354 return; 355 } 356 357 /* 358 * This function is used by encap4_lookup() to decide priority of the encaptab. 359 * This priority is compared to the match length between mbuf's source/destination 360 * IPv4 address pair and encaptab's one. 361 * l2tp(4) does not use address pairs to search matched encaptab, so this 362 * function must return the length bigger than or equals to IPv4 address pair to 363 * avoid wrong encaptab. 364 */ 365 static int 366 in_l2tp_match(struct mbuf *m, int off, int proto, void *arg) 367 { 368 struct l2tp_variant *var = arg; 369 uint32_t sess_id; 370 371 KASSERT(proto == IPPROTO_L2TP); 372 373 /* 374 * If the packet contains no session ID it cannot match 375 */ 376 if (m_length(m) < off + sizeof(uint32_t)) 377 return 0; 378 379 /* get L2TP session ID */ 380 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id); 381 NTOHL(sess_id); 382 if (sess_id == 0) { 383 /* 384 * L2TPv3 control packet received. 385 * userland daemon(l2tpd?) should process. 386 */ 387 return 32 * 2; 388 } else if (sess_id == var->lv_my_sess_id) 389 return 32 * 2; 390 else 391 return 0; 392 } 393 394 int 395 in_l2tp_attach(struct l2tp_variant *var) 396 { 397 398 var->lv_encap_cookie = encap_attach_func(AF_INET, IPPROTO_L2TP, 399 in_l2tp_match, &in_l2tp_encapsw, var); 400 if (var->lv_encap_cookie == NULL) 401 return EEXIST; 402 403 return 0; 404 } 405 406 int 407 in_l2tp_detach(struct l2tp_variant *var) 408 { 409 int error; 410 411 error = encap_detach(var->lv_encap_cookie); 412 if (error == 0) 413 var->lv_encap_cookie = NULL; 414 415 return error; 416 } 417