1 /* $KAME: ip_encap.c,v 1.73 2001/10/02 08:30:58 itojun Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 /* 32 * My grandfather said that there's a devil inside tunnelling technology... 33 * 34 * We have surprisingly many protocols that want packets with IP protocol 35 * #4 or #41. Here's a list of protocols that want protocol #41: 36 * RFC1933 configured tunnel 37 * RFC1933 automatic tunnel 38 * RFC2401 IPsec tunnel 39 * RFC2473 IPv6 generic packet tunnelling 40 * RFC2529 6over4 tunnel 41 * RFC3056 6to4 tunnel 42 * isatap tunnel 43 * mobile-ip6 (uses RFC2473) 44 * Here's a list of protocol that want protocol #4: 45 * RFC1853 IPv4-in-IPv4 tunnelling 46 * RFC2003 IPv4 encapsulation within IPv4 47 * RFC2344 reverse tunnelling for mobile-ip4 48 * RFC2401 IPsec tunnel 49 * Well, what can I say. They impose different en/decapsulation mechanism 50 * from each other, so they need separate protocol handler. The only one 51 * we can easily determine by protocol # is IPsec, which always has 52 * AH/ESP/IPComp header right after outer IP header. 53 * 54 * So, clearly good old protosw does not work for protocol #4 and #41. 55 * The code will let you match protocol via src/dst address pair. 56 */ 57 /* XXX is M_NETADDR correct? */ 58 59 /* 60 * With USE_RADIX the code will use radix table for tunnel lookup, for 61 * tunnels registered with encap_attach() with a addr/mask pair. 62 * Faster on machines with thousands of tunnel registerations (= interfaces). 63 * 64 * The code assumes that radix table code can handle non-continuous netmask, 65 * as it will pass radix table memory region with (src + dst) sockaddr pair. 66 * 67 * FreeBSD is excluded here as they make max_keylen a static variable, and 68 * thus forbid definition of radix table other than proper domains. 69 */ 70 #define USE_RADIX 71 72 #include <sys/cdefs.h> 73 __KERNEL_RCSID(0, "$NetBSD: ip_encap.c,v 1.7 2001/12/21 06:30:43 itojun Exp $"); 74 75 #include "opt_mrouting.h" 76 #include "opt_inet.h" 77 78 #include <sys/param.h> 79 #include <sys/systm.h> 80 #include <sys/socket.h> 81 #include <sys/sockio.h> 82 #include <sys/mbuf.h> 83 #include <sys/errno.h> 84 #include <sys/protosw.h> 85 #include <sys/queue.h> 86 87 #include <net/if.h> 88 #include <net/route.h> 89 90 #include <netinet/in.h> 91 #include <netinet/in_systm.h> 92 #include <netinet/ip.h> 93 #include <netinet/ip_var.h> 94 #include <netinet/ip_encap.h> 95 #ifdef MROUTING 96 #include <netinet/ip_mroute.h> 97 #endif /* MROUTING */ 98 99 #ifdef INET6 100 #include <netinet/ip6.h> 101 #include <netinet6/ip6_var.h> 102 #include <netinet6/ip6protosw.h> 103 #include <netinet6/in6_var.h> 104 #include <netinet6/in6_pcb.h> 105 #include <netinet/icmp6.h> 106 #endif 107 108 #include <machine/stdarg.h> 109 110 #include "ipip.h" 111 #if NIPIP > 0 112 # include <netinet/ip_ipip.h> 113 #else 114 # ifdef MROUTING 115 # include <netinet/ip_mroute.h> 116 # endif 117 #endif 118 119 #include <net/net_osdep.h> 120 121 /* to lookup a pair of address using radix tree */ 122 struct sockaddr_pack { 123 u_int8_t sp_len; 124 u_int8_t sp_family; /* not really used */ 125 /* followed by variable-length data */ 126 } __attribute__((__packed__)); 127 128 struct pack4 { 129 struct sockaddr_pack p; 130 struct sockaddr_in mine; 131 struct sockaddr_in yours; 132 } __attribute__((__packed__)); 133 struct pack6 { 134 struct sockaddr_pack p; 135 struct sockaddr_in6 mine; 136 struct sockaddr_in6 yours; 137 } __attribute__((__packed__)); 138 139 enum direction { INBOUND, OUTBOUND }; 140 141 #ifdef INET 142 static struct encaptab *encap4_lookup __P((struct mbuf *, int, int, 143 enum direction)); 144 #endif 145 #ifdef INET6 146 static struct encaptab *encap6_lookup __P((struct mbuf *, int, int, 147 enum direction)); 148 #endif 149 static int encap_add __P((struct encaptab *)); 150 static int encap_remove __P((struct encaptab *)); 151 static int encap_afcheck __P((int, const struct sockaddr *, const struct sockaddr *)); 152 #ifdef USE_RADIX 153 static struct radix_node_head *encap_rnh __P((int)); 154 static int mask_matchlen __P((const struct sockaddr *)); 155 #endif 156 #ifndef USE_RADIX 157 static int mask_match __P((const struct encaptab *, const struct sockaddr *, 158 const struct sockaddr *)); 159 #endif 160 static void encap_fillarg __P((struct mbuf *, const struct encaptab *)); 161 162 LIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(&encaptab); 163 164 #ifdef USE_RADIX 165 extern int max_keylen; /* radix.c */ 166 struct radix_node_head *encap_head[2]; /* 0 for AF_INET, 1 for AF_INET6 */ 167 #endif 168 169 void 170 encap_init() 171 { 172 static int initialized = 0; 173 174 if (initialized) 175 return; 176 initialized++; 177 #if 0 178 /* 179 * we cannot use LIST_INIT() here, since drivers may want to call 180 * encap_attach(), on driver attach. encap_init() will be called 181 * on AF_INET{,6} initialization, which happens after driver 182 * initialization - using LIST_INIT() here can nuke encap_attach() 183 * from drivers. 184 */ 185 LIST_INIT(&encaptab); 186 #endif 187 188 #ifdef USE_RADIX 189 /* 190 * initialize radix lookup table. 191 * max_keylen initialization should happen before the call to rn_init(). 192 */ 193 rn_inithead((void **)&encap_head[0], sizeof(struct sockaddr_pack) << 3); 194 if (sizeof(struct pack4) > max_keylen) 195 max_keylen = sizeof(struct pack4); 196 #ifdef INET6 197 rn_inithead((void **)&encap_head[1], sizeof(struct sockaddr_pack) << 3); 198 if (sizeof(struct pack6) > max_keylen) 199 max_keylen = sizeof(struct pack6); 200 #endif 201 #endif 202 } 203 204 #ifdef INET 205 static struct encaptab * 206 encap4_lookup(m, off, proto, dir) 207 struct mbuf *m; 208 int off; 209 int proto; 210 enum direction dir; 211 { 212 struct ip *ip; 213 struct pack4 pack; 214 struct encaptab *ep, *match; 215 int prio, matchprio; 216 #ifdef USE_RADIX 217 struct radix_node_head *rnh = encap_rnh(AF_INET); 218 struct radix_node *rn; 219 #endif 220 221 #ifdef DIAGNOSTIC 222 if (m->m_len < sizeof(*ip)) 223 panic("encap4_lookup"); 224 #endif 225 ip = mtod(m, struct ip *); 226 227 bzero(&pack, sizeof(pack)); 228 pack.p.sp_len = sizeof(pack); 229 pack.mine.sin_family = pack.yours.sin_family = AF_INET; 230 pack.mine.sin_len = pack.yours.sin_len = sizeof(struct sockaddr_in); 231 if (dir == INBOUND) { 232 pack.mine.sin_addr = ip->ip_dst; 233 pack.yours.sin_addr = ip->ip_src; 234 } else { 235 pack.mine.sin_addr = ip->ip_src; 236 pack.yours.sin_addr = ip->ip_dst; 237 } 238 239 match = NULL; 240 matchprio = 0; 241 242 #ifdef USE_RADIX 243 rn = rnh->rnh_matchaddr((caddr_t)&pack, rnh); 244 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 245 match = (struct encaptab *)rn; 246 matchprio = mask_matchlen(match->srcmask) + 247 mask_matchlen(match->dstmask); 248 } 249 #endif 250 251 for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) { 252 if (ep->af != AF_INET) 253 continue; 254 if (ep->proto >= 0 && ep->proto != proto) 255 continue; 256 if (ep->func) 257 prio = (*ep->func)(m, off, proto, ep->arg); 258 else { 259 #ifdef USE_RADIX 260 continue; 261 #else 262 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 263 (struct sockaddr *)&pack.yours); 264 #endif 265 } 266 267 /* 268 * We prioritize the matches by using bit length of the 269 * matches. mask_match() and user-supplied matching function 270 * should return the bit length of the matches (for example, 271 * if both src/dst are matched for IPv4, 64 should be returned). 272 * 0 or negative return value means "it did not match". 273 * 274 * The question is, since we have two "mask" portion, we 275 * cannot really define total order between entries. 276 * For example, which of these should be preferred? 277 * mask_match() returns 48 (32 + 16) for both of them. 278 * src=3ffe::/16, dst=3ffe:501::/32 279 * src=3ffe:501::/32, dst=3ffe::/16 280 * 281 * We need to loop through all the possible candidates 282 * to get the best match - the search takes O(n) for 283 * n attachments (i.e. interfaces). 284 * 285 * For radix-based lookup, I guess source takes precedence. 286 * See rn_{refines,lexobetter} for the correct answer. 287 */ 288 if (prio <= 0) 289 continue; 290 if (prio > matchprio) { 291 matchprio = prio; 292 match = ep; 293 } 294 } 295 296 return match; 297 #undef s 298 #undef d 299 } 300 301 void 302 #if __STDC__ 303 encap4_input(struct mbuf *m, ...) 304 #else 305 encap4_input(m, va_alist) 306 struct mbuf *m; 307 va_dcl 308 #endif 309 { 310 int off, proto; 311 va_list ap; 312 const struct protosw *psw; 313 struct encaptab *match; 314 315 va_start(ap, m); 316 off = va_arg(ap, int); 317 proto = va_arg(ap, int); 318 va_end(ap); 319 320 match = encap4_lookup(m, off, proto, INBOUND); 321 322 if (match) { 323 /* found a match, "match" has the best one */ 324 psw = match->psw; 325 if (psw && psw->pr_input) { 326 encap_fillarg(m, match); 327 (*psw->pr_input)(m, off, proto); 328 } else 329 m_freem(m); 330 return; 331 } 332 333 /* last resort: inject to raw socket */ 334 rip_input(m, off, proto); 335 } 336 #endif 337 338 #ifdef INET6 339 static struct encaptab * 340 encap6_lookup(m, off, proto, dir) 341 struct mbuf *m; 342 int off; 343 int proto; 344 enum direction dir; 345 { 346 struct ip6_hdr *ip6; 347 struct pack6 pack; 348 int prio, matchprio; 349 struct encaptab *ep, *match; 350 #ifdef USE_RADIX 351 struct radix_node_head *rnh = encap_rnh(AF_INET6); 352 struct radix_node *rn; 353 #endif 354 355 #ifdef DIAGNOSTIC 356 if (m->m_len < sizeof(*ip6)) 357 panic("encap6_lookup"); 358 #endif 359 ip6 = mtod(m, struct ip6_hdr *); 360 361 bzero(&pack, sizeof(pack)); 362 pack.p.sp_len = sizeof(pack); 363 pack.mine.sin6_family = pack.yours.sin6_family = AF_INET6; 364 pack.mine.sin6_len = pack.yours.sin6_len = sizeof(struct sockaddr_in6); 365 if (dir == INBOUND) { 366 pack.mine.sin6_addr = ip6->ip6_dst; 367 pack.yours.sin6_addr = ip6->ip6_src; 368 } else { 369 pack.mine.sin6_addr = ip6->ip6_src; 370 pack.yours.sin6_addr = ip6->ip6_dst; 371 } 372 373 match = NULL; 374 matchprio = 0; 375 376 #ifdef USE_RADIX 377 rn = rnh->rnh_matchaddr((caddr_t)&pack, rnh); 378 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 379 match = (struct encaptab *)rn; 380 matchprio = mask_matchlen(match->srcmask) + 381 mask_matchlen(match->dstmask); 382 } 383 #endif 384 385 for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) { 386 if (ep->af != AF_INET6) 387 continue; 388 if (ep->proto >= 0 && ep->proto != proto) 389 continue; 390 if (ep->func) 391 prio = (*ep->func)(m, off, proto, ep->arg); 392 else { 393 #ifdef USE_RADIX 394 continue; 395 #else 396 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 397 (struct sockaddr *)&pack.yours); 398 #endif 399 } 400 401 /* see encap4_lookup() for issues here */ 402 if (prio <= 0) 403 continue; 404 if (prio > matchprio) { 405 matchprio = prio; 406 match = ep; 407 } 408 } 409 410 return match; 411 #undef s 412 #undef d 413 } 414 415 int 416 encap6_input(mp, offp, proto) 417 struct mbuf **mp; 418 int *offp; 419 int proto; 420 { 421 struct mbuf *m = *mp; 422 const struct ip6protosw *psw; 423 struct encaptab *match; 424 425 match = encap6_lookup(m, *offp, proto, INBOUND); 426 427 if (match) { 428 /* found a match */ 429 psw = (const struct ip6protosw *)match->psw; 430 if (psw && psw->pr_input) { 431 encap_fillarg(m, match); 432 return (*psw->pr_input)(mp, offp, proto); 433 } else { 434 m_freem(m); 435 return IPPROTO_DONE; 436 } 437 } 438 439 /* last resort: inject to raw socket */ 440 return rip6_input(mp, offp, proto); 441 } 442 #endif 443 444 static int 445 encap_add(ep) 446 struct encaptab *ep; 447 { 448 #ifdef USE_RADIX 449 struct radix_node_head *rnh = encap_rnh(ep->af); 450 #endif 451 int error = 0; 452 453 LIST_INSERT_HEAD(&encaptab, ep, chain); 454 #ifdef USE_RADIX 455 if (!ep->func && rnh) { 456 if (!rnh->rnh_addaddr((caddr_t)ep->addrpack, 457 (caddr_t)ep->maskpack, rnh, ep->nodes)) { 458 error = EEXIST; 459 goto fail; 460 } 461 } 462 #endif 463 return error; 464 465 fail: 466 LIST_REMOVE(ep, chain); 467 return error; 468 } 469 470 static int 471 encap_remove(ep) 472 struct encaptab *ep; 473 { 474 #ifdef USE_RADIX 475 struct radix_node_head *rnh = encap_rnh(ep->af); 476 #endif 477 int error = 0; 478 479 LIST_REMOVE(ep, chain); 480 #ifdef USE_RADIX 481 if (!ep->func && rnh) { 482 if (!rnh->rnh_deladdr((caddr_t)ep->addrpack, 483 (caddr_t)ep->maskpack, rnh)) 484 error = ESRCH; 485 } 486 #endif 487 return error; 488 } 489 490 static int 491 encap_afcheck(af, sp, dp) 492 int af; 493 const struct sockaddr *sp; 494 const struct sockaddr *dp; 495 { 496 if (sp && dp) { 497 if (sp->sa_len != dp->sa_len) 498 return EINVAL; 499 if (af != sp->sa_family || af != dp->sa_family) 500 return EINVAL; 501 } else if (!sp && !dp) 502 ; 503 else 504 return EINVAL; 505 506 switch (af) { 507 case AF_INET: 508 if (sp && sp->sa_len != sizeof(struct sockaddr_in)) 509 return EINVAL; 510 if (dp && dp->sa_len != sizeof(struct sockaddr_in)) 511 return EINVAL; 512 break; 513 #ifdef INET6 514 case AF_INET6: 515 if (sp && sp->sa_len != sizeof(struct sockaddr_in6)) 516 return EINVAL; 517 if (dp && dp->sa_len != sizeof(struct sockaddr_in6)) 518 return EINVAL; 519 break; 520 #endif 521 default: 522 return EAFNOSUPPORT; 523 } 524 525 return 0; 526 } 527 528 /* 529 * sp (src ptr) is always my side, and dp (dst ptr) is always remote side. 530 * length of mask (sm and dm) is assumed to be same as sp/dp. 531 * Return value will be necessary as input (cookie) for encap_detach(). 532 */ 533 const struct encaptab * 534 encap_attach(af, proto, sp, sm, dp, dm, psw, arg) 535 int af; 536 int proto; 537 const struct sockaddr *sp, *sm; 538 const struct sockaddr *dp, *dm; 539 const struct protosw *psw; 540 void *arg; 541 { 542 struct encaptab *ep; 543 int error; 544 int s; 545 size_t l; 546 struct pack4 *pack4; 547 #ifdef INET6 548 struct pack6 *pack6; 549 #endif 550 551 s = splsoftnet(); 552 /* sanity check on args */ 553 error = encap_afcheck(af, sp, dp); 554 if (error) 555 goto fail; 556 557 /* check if anyone have already attached with exactly same config */ 558 for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) { 559 if (ep->af != af) 560 continue; 561 if (ep->proto != proto) 562 continue; 563 if (ep->func) 564 continue; 565 #ifdef DIAGNOSTIC 566 if (!ep->src || !ep->dst || !ep->srcmask || !ep->dstmask) 567 panic("null pointers in encaptab"); 568 #endif 569 if (ep->src->sa_len != sp->sa_len || 570 bcmp(ep->src, sp, sp->sa_len) != 0 || 571 bcmp(ep->srcmask, sm, sp->sa_len) != 0) 572 continue; 573 if (ep->dst->sa_len != dp->sa_len || 574 bcmp(ep->dst, dp, dp->sa_len) != 0 || 575 bcmp(ep->dstmask, dm, dp->sa_len) != 0) 576 continue; 577 578 error = EEXIST; 579 goto fail; 580 } 581 582 switch (af) { 583 case AF_INET: 584 l = sizeof(*pack4); 585 break; 586 #ifdef INET6 587 case AF_INET6: 588 l = sizeof(*pack6); 589 break; 590 #endif 591 default: 592 goto fail; 593 } 594 595 #ifdef DIAGNOSTIC 596 /* if l exceeds the value sa_len can possibly express, it's wrong. */ 597 if (l > (1 << (8 * sizeof(ep->addrpack->sa_len)))) { 598 error = EINVAL; 599 goto fail; 600 } 601 #endif 602 603 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /* M_NETADDR ok? */ 604 if (ep == NULL) { 605 error = ENOBUFS; 606 goto fail; 607 } 608 bzero(ep, sizeof(*ep)); 609 ep->addrpack = malloc(l, M_NETADDR, M_NOWAIT); 610 if (ep->addrpack == NULL) { 611 error = ENOBUFS; 612 goto gc; 613 } 614 ep->maskpack = malloc(l, M_NETADDR, M_NOWAIT); 615 if (ep->maskpack == NULL) { 616 error = ENOBUFS; 617 goto gc; 618 } 619 620 ep->af = af; 621 ep->proto = proto; 622 ep->addrpack->sa_len = l & 0xff; 623 ep->maskpack->sa_len = l & 0xff; 624 switch (af) { 625 case AF_INET: 626 pack4 = (struct pack4 *)ep->addrpack; 627 ep->src = (struct sockaddr *)&pack4->mine; 628 ep->dst = (struct sockaddr *)&pack4->yours; 629 pack4 = (struct pack4 *)ep->maskpack; 630 ep->srcmask = (struct sockaddr *)&pack4->mine; 631 ep->dstmask = (struct sockaddr *)&pack4->yours; 632 break; 633 #ifdef INET6 634 case AF_INET6: 635 pack6 = (struct pack6 *)ep->addrpack; 636 ep->src = (struct sockaddr *)&pack6->mine; 637 ep->dst = (struct sockaddr *)&pack6->yours; 638 pack6 = (struct pack6 *)ep->maskpack; 639 ep->srcmask = (struct sockaddr *)&pack6->mine; 640 ep->dstmask = (struct sockaddr *)&pack6->yours; 641 break; 642 #endif 643 } 644 645 bcopy(sp, ep->src, sp->sa_len); 646 bcopy(sm, ep->srcmask, sp->sa_len); 647 bcopy(dp, ep->dst, dp->sa_len); 648 bcopy(dm, ep->dstmask, dp->sa_len); 649 ep->psw = psw; 650 ep->arg = arg; 651 652 error = encap_add(ep); 653 if (error) 654 goto gc; 655 656 error = 0; 657 splx(s); 658 return ep; 659 660 gc: 661 if (ep->addrpack) 662 free(ep->addrpack, M_NETADDR); 663 if (ep->maskpack) 664 free(ep->maskpack, M_NETADDR); 665 if (ep) 666 free(ep, M_NETADDR); 667 fail: 668 splx(s); 669 return NULL; 670 } 671 672 const struct encaptab * 673 encap_attach_func(af, proto, func, psw, arg) 674 int af; 675 int proto; 676 int (*func) __P((const struct mbuf *, int, int, void *)); 677 const struct protosw *psw; 678 void *arg; 679 { 680 struct encaptab *ep; 681 int error; 682 int s; 683 684 s = splsoftnet(); 685 /* sanity check on args */ 686 if (!func) { 687 error = EINVAL; 688 goto fail; 689 } 690 691 error = encap_afcheck(af, NULL, NULL); 692 if (error) 693 goto fail; 694 695 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /*XXX*/ 696 if (ep == NULL) { 697 error = ENOBUFS; 698 goto fail; 699 } 700 bzero(ep, sizeof(*ep)); 701 702 ep->af = af; 703 ep->proto = proto; 704 ep->func = func; 705 ep->psw = psw; 706 ep->arg = arg; 707 708 error = encap_add(ep); 709 if (error) 710 goto fail; 711 712 error = 0; 713 splx(s); 714 return ep; 715 716 fail: 717 splx(s); 718 return NULL; 719 } 720 721 /* XXX encap4_ctlinput() is necessary if we set DF=1 on outer IPv4 header */ 722 723 #ifdef INET6 724 void 725 encap6_ctlinput(cmd, sa, d0) 726 int cmd; 727 struct sockaddr *sa; 728 void *d0; 729 { 730 void *d = d0; 731 struct ip6_hdr *ip6; 732 struct mbuf *m; 733 int off; 734 struct ip6ctlparam *ip6cp = NULL; 735 const struct sockaddr_in6 *sa6_src = NULL; 736 void *cmdarg; 737 int nxt; 738 struct encaptab *ep; 739 const struct ip6protosw *psw; 740 741 if (sa->sa_family != AF_INET6 || 742 sa->sa_len != sizeof(struct sockaddr_in6)) 743 return; 744 745 if ((unsigned)cmd >= PRC_NCMDS) 746 return; 747 if (cmd == PRC_HOSTDEAD) 748 d = NULL; 749 else if (cmd == PRC_MSGSIZE) 750 ; /* special code is present, see below */ 751 else if (inet6ctlerrmap[cmd] == 0) 752 return; 753 754 /* if the parameter is from icmp6, decode it. */ 755 if (d != NULL) { 756 ip6cp = (struct ip6ctlparam *)d; 757 m = ip6cp->ip6c_m; 758 ip6 = ip6cp->ip6c_ip6; 759 off = ip6cp->ip6c_off; 760 cmdarg = ip6cp->ip6c_cmdarg; 761 sa6_src = ip6cp->ip6c_src; 762 nxt = ip6cp->ip6c_nxt; 763 } else { 764 m = NULL; 765 ip6 = NULL; 766 cmdarg = NULL; 767 sa6_src = &sa6_any; 768 nxt = -1; 769 } 770 771 if (ip6 && cmd == PRC_MSGSIZE) { 772 int valid = 0; 773 struct encaptab *match; 774 775 /* 776 * Check to see if we have a valid encap configuration. 777 */ 778 match = encap6_lookup(m, off, nxt, OUTBOUND); 779 780 if (match) 781 valid++; 782 783 /* 784 * Depending on the value of "valid" and routing table 785 * size (mtudisc_{hi,lo}wat), we will: 786 * - recalcurate the new MTU and create the 787 * corresponding routing entry, or 788 * - ignore the MTU change notification. 789 */ 790 icmp6_mtudisc_update((struct ip6ctlparam *)d, valid); 791 } 792 793 /* inform all listeners */ 794 for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) { 795 if (ep->af != AF_INET6) 796 continue; 797 if (ep->proto >= 0 && ep->proto != nxt) 798 continue; 799 800 /* should optimize by looking at address pairs */ 801 802 /* XXX need to pass ep->arg or ep itself to listeners */ 803 psw = (const struct ip6protosw *)ep->psw; 804 if (psw && psw->pr_ctlinput) 805 (*psw->pr_ctlinput)(cmd, sa, d); 806 } 807 808 rip6_ctlinput(cmd, sa, d0); 809 } 810 #endif 811 812 int 813 encap_detach(cookie) 814 const struct encaptab *cookie; 815 { 816 const struct encaptab *ep = cookie; 817 struct encaptab *p; 818 int error; 819 820 for (p = LIST_FIRST(&encaptab); p; p = LIST_NEXT(p, chain)) { 821 if (p == ep) { 822 error = encap_remove(p); 823 if (error) 824 return error; 825 if (!ep->func) { 826 free(p->addrpack, M_NETADDR); 827 free(p->maskpack, M_NETADDR); 828 } 829 free(p, M_NETADDR); /*XXX*/ 830 return 0; 831 } 832 } 833 834 return ENOENT; 835 } 836 837 #ifdef USE_RADIX 838 static struct radix_node_head * 839 encap_rnh(af) 840 int af; 841 { 842 843 switch (af) { 844 case AF_INET: 845 return encap_head[0]; 846 #ifdef INET6 847 case AF_INET6: 848 return encap_head[1]; 849 #endif 850 default: 851 return NULL; 852 } 853 } 854 855 static int 856 mask_matchlen(sa) 857 const struct sockaddr *sa; 858 { 859 const char *p, *ep; 860 int l; 861 862 p = (const char *)sa; 863 ep = p + sa->sa_len; 864 p += 2; /* sa_len + sa_family */ 865 866 l = 0; 867 while (p < ep) { 868 l += (*p ? 8 : 0); /* estimate */ 869 p++; 870 } 871 return l; 872 } 873 #endif 874 875 #ifndef USE_RADIX 876 static int 877 mask_match(ep, sp, dp) 878 const struct encaptab *ep; 879 const struct sockaddr *sp; 880 const struct sockaddr *dp; 881 { 882 struct sockaddr_storage s; 883 struct sockaddr_storage d; 884 int i; 885 const u_int8_t *p, *q; 886 u_int8_t *r; 887 int matchlen; 888 889 #ifdef DIAGNOSTIC 890 if (ep->func) 891 panic("wrong encaptab passed to mask_match"); 892 #endif 893 if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) 894 return 0; 895 if (sp->sa_family != ep->af || dp->sa_family != ep->af) 896 return 0; 897 if (sp->sa_len != ep->src->sa_len || dp->sa_len != ep->dst->sa_len) 898 return 0; 899 900 matchlen = 0; 901 902 p = (const u_int8_t *)sp; 903 q = (const u_int8_t *)ep->srcmask; 904 r = (u_int8_t *)&s; 905 for (i = 0 ; i < sp->sa_len; i++) { 906 r[i] = p[i] & q[i]; 907 /* XXX estimate */ 908 matchlen += (q[i] ? 8 : 0); 909 } 910 911 p = (const u_int8_t *)dp; 912 q = (const u_int8_t *)ep->dstmask; 913 r = (u_int8_t *)&d; 914 for (i = 0 ; i < dp->sa_len; i++) { 915 r[i] = p[i] & q[i]; 916 /* XXX rough estimate */ 917 matchlen += (q[i] ? 8 : 0); 918 } 919 920 /* need to overwrite len/family portion as we don't compare them */ 921 s.ss_len = sp->sa_len; 922 s.ss_family = sp->sa_family; 923 d.ss_len = dp->sa_len; 924 d.ss_family = dp->sa_family; 925 926 if (bcmp(&s, ep->src, ep->src->sa_len) == 0 && 927 bcmp(&d, ep->dst, ep->dst->sa_len) == 0) { 928 return matchlen; 929 } else 930 return 0; 931 } 932 #endif 933 934 static void 935 encap_fillarg(m, ep) 936 struct mbuf *m; 937 const struct encaptab *ep; 938 { 939 struct mbuf *n; 940 941 n = m_aux_add(m, AF_INET, IPPROTO_IPV4); 942 if (n) { 943 *mtod(n, void **) = ep->arg; 944 n->m_len = sizeof(void *); 945 } 946 } 947 948 void * 949 encap_getarg(m) 950 struct mbuf *m; 951 { 952 void *p; 953 struct mbuf *n; 954 955 p = NULL; 956 n = m_aux_find(m, AF_INET, IPPROTO_IPV4); 957 if (n) { 958 if (n->m_len == sizeof(void *)) 959 p = *mtod(n, void **); 960 m_aux_delete(m, n); 961 } 962 return p; 963 } 964