xref: /netbsd-src/sys/netinet/in_l2tp.c (revision 796c32c94f6e154afc9de0f63da35c91bb739b45) 
1 /*	$NetBSD: in_l2tp.c,v 1.4 2017/11/15 10:42:41 knakahara Exp $	*/
2 
3 /*
4  * Copyright (c) 2017 Internet Initiative Japan Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 __KERNEL_RCSID(0, "$NetBSD: in_l2tp.c,v 1.4 2017/11/15 10:42:41 knakahara Exp $");
31 
32 #ifdef _KERNEL_OPT
33 #include "opt_l2tp.h"
34 #endif
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/socket.h>
39 #include <sys/sockio.h>
40 #include <sys/mbuf.h>
41 #include <sys/errno.h>
42 #include <sys/ioctl.h>
43 #include <sys/syslog.h>
44 #include <sys/kernel.h>
45 
46 #include <net/if.h>
47 #include <net/route.h>
48 #include <net/if_ether.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #include <netinet/ip_private.h>
55 #include <netinet/in_l2tp.h>
56 #include <netinet/in_var.h>
57 #include <netinet/ip_encap.h>
58 
59 #ifdef ALTQ
60 #include <altq/altq.h>
61 #endif
62 
63 /* TODO: IP_TCPMSS support */
64 #undef IP_TCPMSS
65 #ifdef IP_TCPMSS
66 #include <netinet/ip_tcpmss.h>
67 #endif
68 
69 #include <net/if_l2tp.h>
70 
71 #include <net/net_osdep.h>
72 
73 int ip_l2tp_ttl = L2TP_TTL;
74 
75 static void in_l2tp_input(struct mbuf *, int, int, void *);
76 
77 static const struct encapsw in_l2tp_encapsw = {
78 	.encapsw4 = {
79 		.pr_input	= in_l2tp_input,
80 		.pr_ctlinput	= NULL,
81 	}
82 };
83 
84 static int in_l2tp_match(struct mbuf *, int, int, void *);
85 
86 int
87 in_l2tp_output(struct l2tp_variant *var, struct mbuf *m)
88 {
89 	struct l2tp_softc *sc;
90 	struct ifnet *ifp;
91 	struct sockaddr_in *sin_src = satosin(var->lv_psrc);
92 	struct sockaddr_in *sin_dst = satosin(var->lv_pdst);
93 	struct ip iphdr;	/* capsule IP header, host byte ordered */
94 	struct rtentry *rt;
95 	struct l2tp_ro *lro;
96 	int error;
97 	uint32_t sess_id;
98 
99 	KASSERT(var != NULL);
100 	KASSERT(l2tp_heldref_variant(var));
101 	KASSERT(sin_src != NULL && sin_dst != NULL);
102 	KASSERT(sin_src->sin_family == AF_INET
103 	    && sin_dst->sin_family == AF_INET);
104 
105 	sc = var->lv_softc;
106 	if (sc == NULL)
107 		return ENETUNREACH;
108 
109 	ifp = &sc->l2tp_ec.ec_if;
110 	error = l2tp_check_nesting(ifp, m);
111 	if (error) {
112 		m_freem(m);
113 		goto looped;
114 	}
115 
116 #ifdef NETYET
117 /* TODO: support ALTQ for innner frame */
118 #ifdef ALTQ
119 	ALTQ_SAVE_PAYLOAD(m, AF_ETHER);
120 #endif
121 #endif
122 
123 	memset(&iphdr, 0, sizeof(iphdr));
124 	iphdr.ip_src = sin_src->sin_addr;
125 	/* bidirectional configured tunnel mode */
126 	if (sin_dst->sin_addr.s_addr != INADDR_ANY)
127 		iphdr.ip_dst = sin_dst->sin_addr;
128 	else {
129 		m_freem(m);
130 		if ((ifp->if_flags & IFF_DEBUG) != 0)
131 			log(LOG_DEBUG, "%s: ENETUNREACH\n", __func__);
132 		error = ENETUNREACH;
133 		goto out;
134 	}
135 	iphdr.ip_p = IPPROTO_L2TP;
136 	/* version will be set in ip_output() */
137 	iphdr.ip_ttl = ip_l2tp_ttl;
138 	/* outer IP header length */
139 	iphdr.ip_len = sizeof(struct ip);
140 	/* session-id length */
141 	iphdr.ip_len += sizeof(uint32_t);
142 	if (var->lv_use_cookie == L2TP_COOKIE_ON) {
143 		/* cookie length */
144 		iphdr.ip_len += var->lv_peer_cookie_len;
145 	}
146 
147 /* TODO: IP_TCPMSS support */
148 #ifdef IP_TCPMSS
149 	m = l2tp_tcpmss_clamp(ifp, m);
150 	if (m == NULL) {
151 		error = EINVAL;
152 		goto out;
153 	}
154 #endif
155 	/*
156 	 * payload length
157 	 *  NOTE: Payload length may be changed in ip_tcpmss().
158 	 *        Typical case is missing of TCP mss option in original
159 	 *        TCP header.
160 	 */
161 	iphdr.ip_len += m->m_pkthdr.len;
162 	HTONS(iphdr.ip_len);
163 
164 	if (var->lv_use_cookie == L2TP_COOKIE_ON) {
165 		/* prepend session cookie */
166 		uint32_t cookie_32;
167 		uint64_t cookie_64;
168 		M_PREPEND(m, var->lv_peer_cookie_len, M_DONTWAIT);
169 		if (m && m->m_len < var->lv_peer_cookie_len)
170 			m = m_pullup(m, var->lv_peer_cookie_len);
171 		if (m == NULL) {
172 			error = ENOBUFS;
173 			goto out;
174 		}
175 		if (var->lv_peer_cookie_len == 4) {
176 			cookie_32 = htonl((uint32_t)var->lv_peer_cookie);
177 			memcpy(mtod(m, void *), &cookie_32,
178 			    sizeof(uint32_t));
179 		} else {
180 			cookie_64 = htobe64(var->lv_peer_cookie);
181 			memcpy(mtod(m, void *), &cookie_64,
182 			    sizeof(uint64_t));
183 		}
184 	}
185 
186 	/* prepend session-ID */
187 	sess_id = htonl(var->lv_peer_sess_id);
188 	M_PREPEND(m, sizeof(uint32_t), M_DONTWAIT);
189 	if (m && m->m_len < sizeof(uint32_t))
190 		m = m_pullup(m, sizeof(uint32_t));
191 	if (m == NULL) {
192 		error = ENOBUFS;
193 		goto out;
194 	}
195 	memcpy(mtod(m, uint32_t *), &sess_id, sizeof(uint32_t));
196 
197 	/* prepend new IP header */
198 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
199 	if (IP_HDR_ALIGNED_P(mtod(m, void *)) == 0) {
200 		if (m)
201 			m = m_copyup(m, sizeof(struct ip), 0);
202 	} else {
203 		if (m && m->m_len < sizeof(struct ip))
204 			m = m_pullup(m, sizeof(struct ip));
205 	}
206 	if (m == NULL) {
207 		error = ENOBUFS;
208 		goto out;
209 	}
210 	memcpy(mtod(m, struct ip *), &iphdr, sizeof(struct ip));
211 
212 	lro = percpu_getref(sc->l2tp_ro_percpu);
213 	mutex_enter(&lro->lr_lock);
214 	if ((rt = rtcache_lookup(&lro->lr_ro, var->lv_pdst)) == NULL) {
215 		mutex_exit(&lro->lr_lock);
216 		percpu_putref(sc->l2tp_ro_percpu);
217 		m_freem(m);
218 		error = ENETUNREACH;
219 		goto out;
220 	}
221 
222 	if (rt->rt_ifp == ifp) {
223 		rtcache_unref(rt, &lro->lr_ro);
224 		rtcache_free(&lro->lr_ro);
225 		mutex_exit(&lro->lr_lock);
226 		percpu_putref(sc->l2tp_ro_percpu);
227 		m_freem(m);
228 		error = ENETUNREACH;	/*XXX*/
229 		goto out;
230 	}
231 	rtcache_unref(rt, &lro->lr_ro);
232 
233 	/*
234 	 * To avoid inappropriate rewrite of checksum,
235 	 * clear csum flags.
236 	 */
237 	m->m_pkthdr.csum_flags  = 0;
238 
239 	error = ip_output(m, NULL, &lro->lr_ro, 0, NULL, NULL);
240 	mutex_exit(&lro->lr_lock);
241 	percpu_putref(sc->l2tp_ro_percpu);
242 	return error;
243 
244 looped:
245 	if (error)
246 		ifp->if_oerrors++;
247 
248 out:
249 	return error;
250 }
251 
252 static void
253 in_l2tp_input(struct mbuf *m, int off, int proto, void *eparg __unused)
254 {
255 	struct ifnet *l2tpp = NULL;
256 	struct l2tp_softc *sc;
257 	uint32_t sess_id;
258 	uint32_t cookie_32;
259 	uint64_t cookie_64;
260 	struct psref psref;
261 	struct l2tp_variant *var;
262 
263 	if (m->m_len < off + sizeof(uint32_t)) {
264 		m = m_pullup(m, off + sizeof(uint32_t));
265 		if (!m) {
266 			/* if payload length < 4 octets */
267 			return;
268 		}
269         }
270 
271 	/* get L2TP session ID */
272 	m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);
273 	NTOHL(sess_id);
274 #ifdef L2TP_DEBUG
275 	log(LOG_DEBUG, "%s: sess_id = %" PRIu32 "\n", __func__, sess_id);
276 #endif
277 	if (sess_id == 0) {
278 		/*
279 		 * L2TPv3 control packet received.
280 		 * userland daemon(l2tpd?) should process.
281 		 */
282 		rip_input(m, off, proto);
283 		return;
284 	}
285 
286 	var = l2tp_lookup_session_ref(sess_id, &psref);
287 	if (var == NULL) {
288 		m_freem(m);
289 		ip_statinc(IP_STAT_NOL2TP);
290 		return;
291 	} else {
292 		sc = var->lv_softc;
293 		l2tpp = &(sc->l2tp_ec.ec_if);
294 
295 		if (l2tpp == NULL || (l2tpp->if_flags & IFF_UP) == 0) {
296 #ifdef L2TP_DEBUG
297 			if (l2tpp == NULL)
298 				log(LOG_DEBUG, "%s: l2tpp is NULL\n", __func__);
299 			else
300 				log(LOG_DEBUG, "%s: l2tpp is down\n", __func__);
301 #endif
302 			m_freem(m);
303 			ip_statinc(IP_STAT_NOL2TP);
304 			goto out;
305 		}
306 
307 		/* other CPU do l2tp_delete_tunnel */
308 		if (var->lv_psrc == NULL || var->lv_pdst == NULL) {
309 			m_freem(m);
310 			ip_statinc(IP_STAT_NOL2TP);
311 			goto out;
312 		}
313 	}
314 
315 	if (var->lv_state != L2TP_STATE_UP) {
316 		m_freem(m);
317 		goto out;
318 	}
319 
320 	m_adj(m, off + sizeof(uint32_t));
321 
322 	if (var->lv_use_cookie == L2TP_COOKIE_ON) {
323 		if (var->lv_my_cookie_len == 4) {
324 			m_copydata(m, 0, sizeof(uint32_t), (void *)&cookie_32);
325 			NTOHL(cookie_32);
326 			if (cookie_32 != var->lv_my_cookie) {
327 				m_freem(m);
328 				goto out;
329 			}
330 			m_adj(m, sizeof(uint32_t));
331 		} else {
332 			m_copydata(m, 0, sizeof(uint64_t), (void *)&cookie_64);
333 			BE64TOH(cookie_64);
334 			if (cookie_64 != var->lv_my_cookie) {
335 				m_freem(m);
336 				goto out;
337 			}
338 			m_adj(m, sizeof(uint64_t));
339 		}
340 	}
341 
342 /* TODO: IP_TCPMSS support */
343 #ifdef IP_TCPMSS
344 	m = l2tp_tcpmss_clamp(l2tpp, m);
345 	if (m == NULL)
346 		goto out;
347 #endif
348 	l2tp_input(m, l2tpp);
349 
350 out:
351 	l2tp_putref_variant(var, &psref);
352 	return;
353 }
354 
355 /*
356  * This function is used by encap4_lookup() to decide priority of the encaptab.
357  * This priority is compared to the match length between mbuf's source/destination
358  * IPv4 address pair and encaptab's one.
359  * l2tp(4) does not use address pairs to search matched encaptab, so this
360  * function must return the length bigger than or equals to IPv4 address pair to
361  * avoid wrong encaptab.
362  */
363 static int
364 in_l2tp_match(struct mbuf *m, int off, int proto, void *arg)
365 {
366 	struct l2tp_variant *var = arg;
367 	uint32_t sess_id;
368 
369 	KASSERT(proto == IPPROTO_L2TP);
370 
371 	if (m->m_len < off + sizeof(uint32_t)) {
372 		m = m_pullup(m, off + sizeof(uint32_t));
373 		if (!m) {
374 			/* if payload length < 4 octets */
375 			return 0;
376 		}
377         }
378 
379 	/* get L2TP session ID */
380 	m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);
381 	NTOHL(sess_id);
382 	if (sess_id == 0) {
383 		/*
384 		 * L2TPv3 control packet received.
385 		 * userland daemon(l2tpd?) should process.
386 		 */
387 		return 32 * 2;
388 	} else if (sess_id == var->lv_my_sess_id)
389 		return 32 * 2;
390 	else
391 		return 0;
392 }
393 
394 int
395 in_l2tp_attach(struct l2tp_variant *var)
396 {
397 
398 	var->lv_encap_cookie = encap_attach_func(AF_INET, IPPROTO_L2TP,
399 	    in_l2tp_match, &in_l2tp_encapsw, var);
400 	if (var->lv_encap_cookie == NULL)
401 		return EEXIST;
402 
403 	return 0;
404 }
405 
406 int
407 in_l2tp_detach(struct l2tp_variant *var)
408 {
409 	int error;
410 
411 	error = encap_detach(var->lv_encap_cookie);
412 	if (error == 0)
413 		var->lv_encap_cookie = NULL;
414 
415 	return error;
416 }
417