1 /* $NetBSD: ip_encap.c,v 1.68 2018/05/01 07:21:39 maxv Exp $ */ 2 /* $KAME: ip_encap.c,v 1.73 2001/10/02 08:30:58 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 /* 33 * My grandfather said that there's a devil inside tunnelling technology... 34 * 35 * We have surprisingly many protocols that want packets with IP protocol 36 * #4 or #41. Here's a list of protocols that want protocol #41: 37 * RFC1933 configured tunnel 38 * RFC1933 automatic tunnel 39 * RFC2401 IPsec tunnel 40 * RFC2473 IPv6 generic packet tunnelling 41 * RFC2529 6over4 tunnel 42 * RFC3056 6to4 tunnel 43 * isatap tunnel 44 * mobile-ip6 (uses RFC2473) 45 * Here's a list of protocol that want protocol #4: 46 * RFC1853 IPv4-in-IPv4 tunnelling 47 * RFC2003 IPv4 encapsulation within IPv4 48 * RFC2344 reverse tunnelling for mobile-ip4 49 * RFC2401 IPsec tunnel 50 * Well, what can I say. They impose different en/decapsulation mechanism 51 * from each other, so they need separate protocol handler. The only one 52 * we can easily determine by protocol # is IPsec, which always has 53 * AH/ESP/IPComp header right after outer IP header. 54 * 55 * So, clearly good old protosw does not work for protocol #4 and #41. 56 * The code will let you match protocol via src/dst address pair. 57 */ 58 /* XXX is M_NETADDR correct? */ 59 60 /* 61 * With USE_RADIX the code will use radix table for tunnel lookup, for 62 * tunnels registered with encap_attach() with a addr/mask pair. 63 * Faster on machines with thousands of tunnel registerations (= interfaces). 64 * 65 * The code assumes that radix table code can handle non-continuous netmask, 66 * as it will pass radix table memory region with (src + dst) sockaddr pair. 67 */ 68 #define USE_RADIX 69 70 #include <sys/cdefs.h> 71 __KERNEL_RCSID(0, "$NetBSD: ip_encap.c,v 1.68 2018/05/01 07:21:39 maxv Exp $"); 72 73 #ifdef _KERNEL_OPT 74 #include "opt_mrouting.h" 75 #include "opt_inet.h" 76 #include "opt_net_mpsafe.h" 77 #endif 78 79 #include <sys/param.h> 80 #include <sys/systm.h> 81 #include <sys/socket.h> 82 #include <sys/sockio.h> 83 #include <sys/mbuf.h> 84 #include <sys/errno.h> 85 #include <sys/queue.h> 86 #include <sys/kmem.h> 87 #include <sys/mutex.h> 88 #include <sys/condvar.h> 89 #include <sys/psref.h> 90 #include <sys/pslist.h> 91 92 #include <net/if.h> 93 94 #include <netinet/in.h> 95 #include <netinet/in_systm.h> 96 #include <netinet/ip.h> 97 #include <netinet/ip_var.h> 98 #include <netinet/ip_encap.h> 99 #ifdef MROUTING 100 #include <netinet/ip_mroute.h> 101 #endif /* MROUTING */ 102 103 #ifdef INET6 104 #include <netinet/ip6.h> 105 #include <netinet6/ip6_var.h> 106 #include <netinet6/ip6protosw.h> /* for struct ip6ctlparam */ 107 #include <netinet6/in6_var.h> 108 #include <netinet6/in6_pcb.h> 109 #include <netinet/icmp6.h> 110 #endif 111 112 #ifdef NET_MPSAFE 113 #define ENCAP_MPSAFE 1 114 #endif 115 116 enum direction { INBOUND, OUTBOUND }; 117 118 #ifdef INET 119 static struct encaptab *encap4_lookup(struct mbuf *, int, int, enum direction, 120 struct psref *); 121 #endif 122 #ifdef INET6 123 static struct encaptab *encap6_lookup(struct mbuf *, int, int, enum direction, 124 struct psref *); 125 #endif 126 static int encap_add(struct encaptab *); 127 static int encap_remove(struct encaptab *); 128 static int encap_afcheck(int, const struct sockaddr *, const struct sockaddr *); 129 #ifdef USE_RADIX 130 static struct radix_node_head *encap_rnh(int); 131 static int mask_matchlen(const struct sockaddr *); 132 #else 133 static int mask_match(const struct encaptab *, const struct sockaddr *, 134 const struct sockaddr *); 135 #endif 136 137 /* 138 * In encap[46]_lookup(), ep->func can sleep(e.g. rtalloc1) while walking 139 * encap_table. So, it cannot use pserialize_read_enter() 140 */ 141 static struct { 142 struct pslist_head list; 143 pserialize_t psz; 144 struct psref_class *elem_class; /* for the element of et_list */ 145 } encaptab __cacheline_aligned = { 146 .list = PSLIST_INITIALIZER, 147 }; 148 #define encap_table encaptab.list 149 150 static struct { 151 kmutex_t lock; 152 kcondvar_t cv; 153 struct lwp *busy; 154 } encap_whole __cacheline_aligned; 155 156 #ifdef USE_RADIX 157 struct radix_node_head *encap_head[2]; /* 0 for AF_INET, 1 for AF_INET6 */ 158 static bool encap_head_updating = false; 159 #endif 160 161 static bool encap_initialized = false; 162 /* 163 * must be done before other encap interfaces initialization. 164 */ 165 void 166 encapinit(void) 167 { 168 169 if (encap_initialized) 170 return; 171 172 encaptab.psz = pserialize_create(); 173 encaptab.elem_class = psref_class_create("encapelem", IPL_SOFTNET); 174 175 mutex_init(&encap_whole.lock, MUTEX_DEFAULT, IPL_NONE); 176 cv_init(&encap_whole.cv, "ip_encap cv"); 177 encap_whole.busy = NULL; 178 179 encap_initialized = true; 180 } 181 182 void 183 encap_init(void) 184 { 185 static int initialized = 0; 186 187 if (initialized) 188 return; 189 initialized++; 190 #if 0 191 /* 192 * we cannot use LIST_INIT() here, since drivers may want to call 193 * encap_attach(), on driver attach. encap_init() will be called 194 * on AF_INET{,6} initialization, which happens after driver 195 * initialization - using LIST_INIT() here can nuke encap_attach() 196 * from drivers. 197 */ 198 PSLIST_INIT(&encap_table); 199 #endif 200 201 #ifdef USE_RADIX 202 /* 203 * initialize radix lookup table when the radix subsystem is inited. 204 */ 205 rn_delayedinit((void *)&encap_head[0], 206 sizeof(struct sockaddr_pack) << 3); 207 #ifdef INET6 208 rn_delayedinit((void *)&encap_head[1], 209 sizeof(struct sockaddr_pack) << 3); 210 #endif 211 #endif 212 } 213 214 #ifdef INET 215 static struct encaptab * 216 encap4_lookup(struct mbuf *m, int off, int proto, enum direction dir, 217 struct psref *match_psref) 218 { 219 struct ip *ip; 220 struct ip_pack4 pack; 221 struct encaptab *ep, *match; 222 int prio, matchprio; 223 int s; 224 #ifdef USE_RADIX 225 struct radix_node_head *rnh = encap_rnh(AF_INET); 226 struct radix_node *rn; 227 #endif 228 229 KASSERT(m->m_len >= sizeof(*ip)); 230 231 ip = mtod(m, struct ip *); 232 233 memset(&pack, 0, sizeof(pack)); 234 pack.p.sp_len = sizeof(pack); 235 pack.mine.sin_family = pack.yours.sin_family = AF_INET; 236 pack.mine.sin_len = pack.yours.sin_len = sizeof(struct sockaddr_in); 237 if (dir == INBOUND) { 238 pack.mine.sin_addr = ip->ip_dst; 239 pack.yours.sin_addr = ip->ip_src; 240 } else { 241 pack.mine.sin_addr = ip->ip_src; 242 pack.yours.sin_addr = ip->ip_dst; 243 } 244 245 match = NULL; 246 matchprio = 0; 247 248 s = pserialize_read_enter(); 249 #ifdef USE_RADIX 250 if (encap_head_updating) { 251 /* 252 * Update in progress. Do nothing. 253 */ 254 pserialize_read_exit(s); 255 return NULL; 256 } 257 258 rn = rnh->rnh_matchaddr((void *)&pack, rnh); 259 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 260 struct encaptab *encapp = (struct encaptab *)rn; 261 262 psref_acquire(match_psref, &encapp->psref, 263 encaptab.elem_class); 264 match = encapp; 265 matchprio = mask_matchlen(match->srcmask) + 266 mask_matchlen(match->dstmask); 267 } 268 #endif 269 PSLIST_READER_FOREACH(ep, &encap_table, struct encaptab, chain) { 270 struct psref elem_psref; 271 272 if (ep->af != AF_INET) 273 continue; 274 if (ep->proto >= 0 && ep->proto != proto) 275 continue; 276 277 psref_acquire(&elem_psref, &ep->psref, 278 encaptab.elem_class); 279 if (ep->func) { 280 pserialize_read_exit(s); 281 /* ep->func is sleepable. e.g. rtalloc1 */ 282 prio = (*ep->func)(m, off, proto, ep->arg); 283 s = pserialize_read_enter(); 284 } else { 285 #ifdef USE_RADIX 286 psref_release(&elem_psref, &ep->psref, 287 encaptab.elem_class); 288 continue; 289 #else 290 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 291 (struct sockaddr *)&pack.yours); 292 #endif 293 } 294 295 /* 296 * We prioritize the matches by using bit length of the 297 * matches. mask_match() and user-supplied matching function 298 * should return the bit length of the matches (for example, 299 * if both src/dst are matched for IPv4, 64 should be returned). 300 * 0 or negative return value means "it did not match". 301 * 302 * The question is, since we have two "mask" portion, we 303 * cannot really define total order between entries. 304 * For example, which of these should be preferred? 305 * mask_match() returns 48 (32 + 16) for both of them. 306 * src=3ffe::/16, dst=3ffe:501::/32 307 * src=3ffe:501::/32, dst=3ffe::/16 308 * 309 * We need to loop through all the possible candidates 310 * to get the best match - the search takes O(n) for 311 * n attachments (i.e. interfaces). 312 * 313 * For radix-based lookup, I guess source takes precedence. 314 * See rn_{refines,lexobetter} for the correct answer. 315 */ 316 if (prio <= 0) { 317 psref_release(&elem_psref, &ep->psref, 318 encaptab.elem_class); 319 continue; 320 } 321 if (prio > matchprio) { 322 /* release last matched ep */ 323 if (match != NULL) 324 psref_release(match_psref, &match->psref, 325 encaptab.elem_class); 326 327 psref_copy(match_psref, &elem_psref, 328 encaptab.elem_class); 329 matchprio = prio; 330 match = ep; 331 } 332 KASSERTMSG((match == NULL) || psref_held(&match->psref, 333 encaptab.elem_class), 334 "current match = %p, but not hold its psref", match); 335 336 psref_release(&elem_psref, &ep->psref, 337 encaptab.elem_class); 338 } 339 pserialize_read_exit(s); 340 341 return match; 342 } 343 344 void 345 encap4_input(struct mbuf *m, ...) 346 { 347 int off, proto; 348 va_list ap; 349 const struct encapsw *esw; 350 struct encaptab *match; 351 struct psref match_psref; 352 353 va_start(ap, m); 354 off = va_arg(ap, int); 355 proto = va_arg(ap, int); 356 va_end(ap); 357 358 match = encap4_lookup(m, off, proto, INBOUND, &match_psref); 359 if (match) { 360 /* found a match, "match" has the best one */ 361 esw = match->esw; 362 if (esw && esw->encapsw4.pr_input) { 363 (*esw->encapsw4.pr_input)(m, off, proto, match->arg); 364 psref_release(&match_psref, &match->psref, 365 encaptab.elem_class); 366 } else { 367 psref_release(&match_psref, &match->psref, 368 encaptab.elem_class); 369 m_freem(m); 370 } 371 return; 372 } 373 374 /* last resort: inject to raw socket */ 375 rip_input(m, off, proto); 376 } 377 #endif 378 379 #ifdef INET6 380 static struct encaptab * 381 encap6_lookup(struct mbuf *m, int off, int proto, enum direction dir, 382 struct psref *match_psref) 383 { 384 struct ip6_hdr *ip6; 385 struct ip_pack6 pack; 386 int prio, matchprio; 387 int s; 388 struct encaptab *ep, *match; 389 #ifdef USE_RADIX 390 struct radix_node_head *rnh = encap_rnh(AF_INET6); 391 struct radix_node *rn; 392 #endif 393 394 KASSERT(m->m_len >= sizeof(*ip6)); 395 396 ip6 = mtod(m, struct ip6_hdr *); 397 398 memset(&pack, 0, sizeof(pack)); 399 pack.p.sp_len = sizeof(pack); 400 pack.mine.sin6_family = pack.yours.sin6_family = AF_INET6; 401 pack.mine.sin6_len = pack.yours.sin6_len = sizeof(struct sockaddr_in6); 402 if (dir == INBOUND) { 403 pack.mine.sin6_addr = ip6->ip6_dst; 404 pack.yours.sin6_addr = ip6->ip6_src; 405 } else { 406 pack.mine.sin6_addr = ip6->ip6_src; 407 pack.yours.sin6_addr = ip6->ip6_dst; 408 } 409 410 match = NULL; 411 matchprio = 0; 412 413 s = pserialize_read_enter(); 414 #ifdef USE_RADIX 415 if (encap_head_updating) { 416 /* 417 * Update in progress. Do nothing. 418 */ 419 pserialize_read_exit(s); 420 return NULL; 421 } 422 423 rn = rnh->rnh_matchaddr((void *)&pack, rnh); 424 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 425 struct encaptab *encapp = (struct encaptab *)rn; 426 427 psref_acquire(match_psref, &encapp->psref, 428 encaptab.elem_class); 429 match = encapp; 430 matchprio = mask_matchlen(match->srcmask) + 431 mask_matchlen(match->dstmask); 432 } 433 #endif 434 PSLIST_READER_FOREACH(ep, &encap_table, struct encaptab, chain) { 435 struct psref elem_psref; 436 437 if (ep->af != AF_INET6) 438 continue; 439 if (ep->proto >= 0 && ep->proto != proto) 440 continue; 441 442 psref_acquire(&elem_psref, &ep->psref, 443 encaptab.elem_class); 444 445 if (ep->func) { 446 pserialize_read_exit(s); 447 /* ep->func is sleepable. e.g. rtalloc1 */ 448 prio = (*ep->func)(m, off, proto, ep->arg); 449 s = pserialize_read_enter(); 450 } else { 451 #ifdef USE_RADIX 452 psref_release(&elem_psref, &ep->psref, 453 encaptab.elem_class); 454 continue; 455 #else 456 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 457 (struct sockaddr *)&pack.yours); 458 #endif 459 } 460 461 /* see encap4_lookup() for issues here */ 462 if (prio <= 0) { 463 psref_release(&elem_psref, &ep->psref, 464 encaptab.elem_class); 465 continue; 466 } 467 if (prio > matchprio) { 468 /* release last matched ep */ 469 if (match != NULL) 470 psref_release(match_psref, &match->psref, 471 encaptab.elem_class); 472 473 psref_copy(match_psref, &elem_psref, 474 encaptab.elem_class); 475 matchprio = prio; 476 match = ep; 477 } 478 KASSERTMSG((match == NULL) || psref_held(&match->psref, 479 encaptab.elem_class), 480 "current match = %p, but not hold its psref", match); 481 482 psref_release(&elem_psref, &ep->psref, 483 encaptab.elem_class); 484 } 485 pserialize_read_exit(s); 486 487 return match; 488 } 489 490 int 491 encap6_input(struct mbuf **mp, int *offp, int proto) 492 { 493 struct mbuf *m = *mp; 494 const struct encapsw *esw; 495 struct encaptab *match; 496 struct psref match_psref; 497 498 match = encap6_lookup(m, *offp, proto, INBOUND, &match_psref); 499 500 if (match) { 501 /* found a match */ 502 esw = match->esw; 503 if (esw && esw->encapsw6.pr_input) { 504 int ret; 505 ret = (*esw->encapsw6.pr_input)(mp, offp, proto, 506 match->arg); 507 psref_release(&match_psref, &match->psref, 508 encaptab.elem_class); 509 return ret; 510 } else { 511 psref_release(&match_psref, &match->psref, 512 encaptab.elem_class); 513 m_freem(m); 514 return IPPROTO_DONE; 515 } 516 } 517 518 /* last resort: inject to raw socket */ 519 return rip6_input(mp, offp, proto); 520 } 521 #endif 522 523 /* 524 * XXX 525 * The encaptab list and the rnh radix tree must be manipulated atomically. 526 */ 527 static int 528 encap_add(struct encaptab *ep) 529 { 530 #ifdef USE_RADIX 531 struct radix_node_head *rnh = encap_rnh(ep->af); 532 #endif 533 534 KASSERT(encap_lock_held()); 535 536 #ifdef USE_RADIX 537 if (!ep->func && rnh) { 538 /* Disable access to the radix tree for reader. */ 539 encap_head_updating = true; 540 /* Wait for all readers to drain. */ 541 pserialize_perform(encaptab.psz); 542 543 if (!rnh->rnh_addaddr((void *)ep->addrpack, 544 (void *)ep->maskpack, rnh, ep->nodes)) { 545 encap_head_updating = false; 546 return EEXIST; 547 } 548 549 /* 550 * The ep added to the radix tree must be skipped while 551 * encap[46]_lookup walks encaptab list. In other words, 552 * encap_add() does not need to care whether the ep has 553 * been added encaptab list or not yet. 554 * So, we can re-enable access to the radix tree for now. 555 */ 556 encap_head_updating = false; 557 } 558 #endif 559 PSLIST_WRITER_INSERT_HEAD(&encap_table, ep, chain); 560 561 return 0; 562 } 563 564 /* 565 * XXX 566 * The encaptab list and the rnh radix tree must be manipulated atomically. 567 */ 568 static int 569 encap_remove(struct encaptab *ep) 570 { 571 #ifdef USE_RADIX 572 struct radix_node_head *rnh = encap_rnh(ep->af); 573 #endif 574 int error = 0; 575 576 KASSERT(encap_lock_held()); 577 578 #ifdef USE_RADIX 579 if (!ep->func && rnh) { 580 /* Disable access to the radix tree for reader. */ 581 encap_head_updating = true; 582 /* Wait for all readers to drain. */ 583 pserialize_perform(encaptab.psz); 584 585 if (!rnh->rnh_deladdr((void *)ep->addrpack, 586 (void *)ep->maskpack, rnh)) 587 error = ESRCH; 588 589 /* 590 * The ep added to the radix tree must be skipped while 591 * encap[46]_lookup walks encaptab list. In other words, 592 * encap_add() does not need to care whether the ep has 593 * been added encaptab list or not yet. 594 * So, we can re-enable access to the radix tree for now. 595 */ 596 encap_head_updating = false; 597 } 598 #endif 599 PSLIST_WRITER_REMOVE(ep, chain); 600 601 return error; 602 } 603 604 static int 605 encap_afcheck(int af, const struct sockaddr *sp, const struct sockaddr *dp) 606 { 607 if (sp && dp) { 608 if (sp->sa_len != dp->sa_len) 609 return EINVAL; 610 if (af != sp->sa_family || af != dp->sa_family) 611 return EINVAL; 612 } else if (!sp && !dp) 613 ; 614 else 615 return EINVAL; 616 617 switch (af) { 618 case AF_INET: 619 if (sp && sp->sa_len != sizeof(struct sockaddr_in)) 620 return EINVAL; 621 if (dp && dp->sa_len != sizeof(struct sockaddr_in)) 622 return EINVAL; 623 break; 624 #ifdef INET6 625 case AF_INET6: 626 if (sp && sp->sa_len != sizeof(struct sockaddr_in6)) 627 return EINVAL; 628 if (dp && dp->sa_len != sizeof(struct sockaddr_in6)) 629 return EINVAL; 630 break; 631 #endif 632 default: 633 return EAFNOSUPPORT; 634 } 635 636 return 0; 637 } 638 639 /* 640 * sp (src ptr) is always my side, and dp (dst ptr) is always remote side. 641 * length of mask (sm and dm) is assumed to be same as sp/dp. 642 * Return value will be necessary as input (cookie) for encap_detach(). 643 */ 644 const struct encaptab * 645 encap_attach(int af, int proto, 646 const struct sockaddr *sp, const struct sockaddr *sm, 647 const struct sockaddr *dp, const struct sockaddr *dm, 648 const struct encapsw *esw, void *arg) 649 { 650 struct encaptab *ep; 651 int error; 652 int pss; 653 size_t l; 654 struct ip_pack4 *pack4; 655 #ifdef INET6 656 struct ip_pack6 *pack6; 657 #endif 658 #ifndef ENCAP_MPSAFE 659 int s; 660 661 s = splsoftnet(); 662 #endif 663 /* sanity check on args */ 664 error = encap_afcheck(af, sp, dp); 665 if (error) 666 goto fail; 667 668 /* check if anyone have already attached with exactly same config */ 669 pss = pserialize_read_enter(); 670 PSLIST_READER_FOREACH(ep, &encap_table, struct encaptab, chain) { 671 if (ep->af != af) 672 continue; 673 if (ep->proto != proto) 674 continue; 675 if (ep->func) 676 continue; 677 678 KASSERT(ep->src != NULL); 679 KASSERT(ep->dst != NULL); 680 KASSERT(ep->srcmask != NULL); 681 KASSERT(ep->dstmask != NULL); 682 683 if (ep->src->sa_len != sp->sa_len || 684 memcmp(ep->src, sp, sp->sa_len) != 0 || 685 memcmp(ep->srcmask, sm, sp->sa_len) != 0) 686 continue; 687 if (ep->dst->sa_len != dp->sa_len || 688 memcmp(ep->dst, dp, dp->sa_len) != 0 || 689 memcmp(ep->dstmask, dm, dp->sa_len) != 0) 690 continue; 691 692 error = EEXIST; 693 pserialize_read_exit(pss); 694 goto fail; 695 } 696 pserialize_read_exit(pss); 697 698 switch (af) { 699 case AF_INET: 700 l = sizeof(*pack4); 701 break; 702 #ifdef INET6 703 case AF_INET6: 704 l = sizeof(*pack6); 705 break; 706 #endif 707 default: 708 goto fail; 709 } 710 711 /* M_NETADDR ok? */ 712 ep = kmem_zalloc(sizeof(*ep), KM_NOSLEEP); 713 if (ep == NULL) { 714 error = ENOBUFS; 715 goto fail; 716 } 717 ep->addrpack = kmem_zalloc(l, KM_NOSLEEP); 718 if (ep->addrpack == NULL) { 719 error = ENOBUFS; 720 goto gc; 721 } 722 ep->maskpack = kmem_zalloc(l, KM_NOSLEEP); 723 if (ep->maskpack == NULL) { 724 error = ENOBUFS; 725 goto gc; 726 } 727 728 ep->af = af; 729 ep->proto = proto; 730 ep->addrpack->sa_len = l & 0xff; 731 ep->maskpack->sa_len = l & 0xff; 732 switch (af) { 733 case AF_INET: 734 pack4 = (struct ip_pack4 *)ep->addrpack; 735 ep->src = (struct sockaddr *)&pack4->mine; 736 ep->dst = (struct sockaddr *)&pack4->yours; 737 pack4 = (struct ip_pack4 *)ep->maskpack; 738 ep->srcmask = (struct sockaddr *)&pack4->mine; 739 ep->dstmask = (struct sockaddr *)&pack4->yours; 740 break; 741 #ifdef INET6 742 case AF_INET6: 743 pack6 = (struct ip_pack6 *)ep->addrpack; 744 ep->src = (struct sockaddr *)&pack6->mine; 745 ep->dst = (struct sockaddr *)&pack6->yours; 746 pack6 = (struct ip_pack6 *)ep->maskpack; 747 ep->srcmask = (struct sockaddr *)&pack6->mine; 748 ep->dstmask = (struct sockaddr *)&pack6->yours; 749 break; 750 #endif 751 } 752 753 memcpy(ep->src, sp, sp->sa_len); 754 memcpy(ep->srcmask, sm, sp->sa_len); 755 memcpy(ep->dst, dp, dp->sa_len); 756 memcpy(ep->dstmask, dm, dp->sa_len); 757 ep->esw = esw; 758 ep->arg = arg; 759 psref_target_init(&ep->psref, encaptab.elem_class); 760 761 error = encap_add(ep); 762 if (error) 763 goto gc; 764 765 error = 0; 766 #ifndef ENCAP_MPSAFE 767 splx(s); 768 #endif 769 return ep; 770 771 gc: 772 if (ep->addrpack) 773 kmem_free(ep->addrpack, l); 774 if (ep->maskpack) 775 kmem_free(ep->maskpack, l); 776 if (ep) 777 kmem_free(ep, sizeof(*ep)); 778 fail: 779 #ifndef ENCAP_MPSAFE 780 splx(s); 781 #endif 782 return NULL; 783 } 784 785 const struct encaptab * 786 encap_attach_func(int af, int proto, 787 int (*func)(struct mbuf *, int, int, void *), 788 const struct encapsw *esw, void *arg) 789 { 790 struct encaptab *ep; 791 int error; 792 #ifndef ENCAP_MPSAFE 793 int s; 794 795 s = splsoftnet(); 796 #endif 797 /* sanity check on args */ 798 if (!func) { 799 error = EINVAL; 800 goto fail; 801 } 802 803 error = encap_afcheck(af, NULL, NULL); 804 if (error) 805 goto fail; 806 807 ep = kmem_alloc(sizeof(*ep), KM_NOSLEEP); /*XXX*/ 808 if (ep == NULL) { 809 error = ENOBUFS; 810 goto fail; 811 } 812 memset(ep, 0, sizeof(*ep)); 813 814 ep->af = af; 815 ep->proto = proto; 816 ep->func = func; 817 ep->esw = esw; 818 ep->arg = arg; 819 psref_target_init(&ep->psref, encaptab.elem_class); 820 821 error = encap_add(ep); 822 if (error) 823 goto gc; 824 825 error = 0; 826 #ifndef ENCAP_MPSAFE 827 splx(s); 828 #endif 829 return ep; 830 831 gc: 832 kmem_free(ep, sizeof(*ep)); 833 fail: 834 #ifndef ENCAP_MPSAFE 835 splx(s); 836 #endif 837 return NULL; 838 } 839 840 /* XXX encap4_ctlinput() is necessary if we set DF=1 on outer IPv4 header */ 841 842 #ifdef INET6 843 void * 844 encap6_ctlinput(int cmd, const struct sockaddr *sa, void *d0) 845 { 846 void *d = d0; 847 struct ip6_hdr *ip6; 848 struct mbuf *m; 849 int off; 850 struct ip6ctlparam *ip6cp = NULL; 851 int nxt; 852 int s; 853 struct encaptab *ep; 854 const struct encapsw *esw; 855 856 if (sa->sa_family != AF_INET6 || 857 sa->sa_len != sizeof(struct sockaddr_in6)) 858 return NULL; 859 860 if ((unsigned)cmd >= PRC_NCMDS) 861 return NULL; 862 if (cmd == PRC_HOSTDEAD) 863 d = NULL; 864 else if (cmd == PRC_MSGSIZE) 865 ; /* special code is present, see below */ 866 else if (inet6ctlerrmap[cmd] == 0) 867 return NULL; 868 869 /* if the parameter is from icmp6, decode it. */ 870 if (d != NULL) { 871 ip6cp = (struct ip6ctlparam *)d; 872 m = ip6cp->ip6c_m; 873 ip6 = ip6cp->ip6c_ip6; 874 off = ip6cp->ip6c_off; 875 nxt = ip6cp->ip6c_nxt; 876 877 if (ip6 && cmd == PRC_MSGSIZE) { 878 int valid = 0; 879 struct encaptab *match; 880 struct psref elem_psref; 881 882 /* 883 * Check to see if we have a valid encap configuration. 884 */ 885 match = encap6_lookup(m, off, nxt, OUTBOUND, 886 &elem_psref); 887 if (match) 888 valid++; 889 psref_release(&elem_psref, &match->psref, 890 encaptab.elem_class); 891 892 /* 893 * Depending on the value of "valid" and routing table 894 * size (mtudisc_{hi,lo}wat), we will: 895 * - recalcurate the new MTU and create the 896 * corresponding routing entry, or 897 * - ignore the MTU change notification. 898 */ 899 icmp6_mtudisc_update((struct ip6ctlparam *)d, valid); 900 } 901 } else { 902 m = NULL; 903 ip6 = NULL; 904 nxt = -1; 905 } 906 907 /* inform all listeners */ 908 909 s = pserialize_read_enter(); 910 PSLIST_READER_FOREACH(ep, &encap_table, struct encaptab, chain) { 911 struct psref elem_psref; 912 913 if (ep->af != AF_INET6) 914 continue; 915 if (ep->proto >= 0 && ep->proto != nxt) 916 continue; 917 918 /* should optimize by looking at address pairs */ 919 920 /* XXX need to pass ep->arg or ep itself to listeners */ 921 psref_acquire(&elem_psref, &ep->psref, 922 encaptab.elem_class); 923 esw = ep->esw; 924 if (esw && esw->encapsw6.pr_ctlinput) { 925 pserialize_read_exit(s); 926 /* pr_ctlinput is sleepable. e.g. rtcache_free */ 927 (*esw->encapsw6.pr_ctlinput)(cmd, sa, d, ep->arg); 928 s = pserialize_read_enter(); 929 } 930 psref_release(&elem_psref, &ep->psref, 931 encaptab.elem_class); 932 } 933 pserialize_read_exit(s); 934 935 rip6_ctlinput(cmd, sa, d0); 936 return NULL; 937 } 938 #endif 939 940 int 941 encap_detach(const struct encaptab *cookie) 942 { 943 const struct encaptab *ep = cookie; 944 struct encaptab *p; 945 int error; 946 947 KASSERT(encap_lock_held()); 948 949 PSLIST_WRITER_FOREACH(p, &encap_table, struct encaptab, chain) { 950 if (p == ep) { 951 error = encap_remove(p); 952 if (error) 953 return error; 954 else 955 break; 956 } 957 } 958 if (p == NULL) 959 return ENOENT; 960 961 pserialize_perform(encaptab.psz); 962 psref_target_destroy(&p->psref, 963 encaptab.elem_class); 964 if (!ep->func) { 965 kmem_free(p->addrpack, ep->addrpack->sa_len); 966 kmem_free(p->maskpack, ep->maskpack->sa_len); 967 } 968 kmem_free(p, sizeof(*p)); 969 970 return 0; 971 } 972 973 #ifdef USE_RADIX 974 static struct radix_node_head * 975 encap_rnh(int af) 976 { 977 978 switch (af) { 979 case AF_INET: 980 return encap_head[0]; 981 #ifdef INET6 982 case AF_INET6: 983 return encap_head[1]; 984 #endif 985 default: 986 return NULL; 987 } 988 } 989 990 static int 991 mask_matchlen(const struct sockaddr *sa) 992 { 993 const char *p, *ep; 994 int l; 995 996 p = (const char *)sa; 997 ep = p + sa->sa_len; 998 p += 2; /* sa_len + sa_family */ 999 1000 l = 0; 1001 while (p < ep) { 1002 l += (*p ? 8 : 0); /* estimate */ 1003 p++; 1004 } 1005 return l; 1006 } 1007 #endif 1008 1009 #ifndef USE_RADIX 1010 static int 1011 mask_match(const struct encaptab *ep, 1012 const struct sockaddr *sp, 1013 const struct sockaddr *dp) 1014 { 1015 struct sockaddr_storage s; 1016 struct sockaddr_storage d; 1017 int i; 1018 const u_int8_t *p, *q; 1019 u_int8_t *r; 1020 int matchlen; 1021 1022 KASSERTMSG(ep->func == NULL, "wrong encaptab passed to mask_match"); 1023 1024 if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) 1025 return 0; 1026 if (sp->sa_family != ep->af || dp->sa_family != ep->af) 1027 return 0; 1028 if (sp->sa_len != ep->src->sa_len || dp->sa_len != ep->dst->sa_len) 1029 return 0; 1030 1031 matchlen = 0; 1032 1033 p = (const u_int8_t *)sp; 1034 q = (const u_int8_t *)ep->srcmask; 1035 r = (u_int8_t *)&s; 1036 for (i = 0 ; i < sp->sa_len; i++) { 1037 r[i] = p[i] & q[i]; 1038 /* XXX estimate */ 1039 matchlen += (q[i] ? 8 : 0); 1040 } 1041 1042 p = (const u_int8_t *)dp; 1043 q = (const u_int8_t *)ep->dstmask; 1044 r = (u_int8_t *)&d; 1045 for (i = 0 ; i < dp->sa_len; i++) { 1046 r[i] = p[i] & q[i]; 1047 /* XXX rough estimate */ 1048 matchlen += (q[i] ? 8 : 0); 1049 } 1050 1051 /* need to overwrite len/family portion as we don't compare them */ 1052 s.ss_len = sp->sa_len; 1053 s.ss_family = sp->sa_family; 1054 d.ss_len = dp->sa_len; 1055 d.ss_family = dp->sa_family; 1056 1057 if (memcmp(&s, ep->src, ep->src->sa_len) == 0 && 1058 memcmp(&d, ep->dst, ep->dst->sa_len) == 0) { 1059 return matchlen; 1060 } else 1061 return 0; 1062 } 1063 #endif 1064 1065 int 1066 encap_lock_enter(void) 1067 { 1068 int error; 1069 1070 mutex_enter(&encap_whole.lock); 1071 while (encap_whole.busy != NULL) { 1072 error = cv_wait_sig(&encap_whole.cv, &encap_whole.lock); 1073 if (error) { 1074 mutex_exit(&encap_whole.lock); 1075 return error; 1076 } 1077 } 1078 KASSERT(encap_whole.busy == NULL); 1079 encap_whole.busy = curlwp; 1080 mutex_exit(&encap_whole.lock); 1081 1082 return 0; 1083 } 1084 1085 void 1086 encap_lock_exit(void) 1087 { 1088 1089 mutex_enter(&encap_whole.lock); 1090 KASSERT(encap_whole.busy == curlwp); 1091 encap_whole.busy = NULL; 1092 cv_broadcast(&encap_whole.cv); 1093 mutex_exit(&encap_whole.lock); 1094 } 1095 1096 bool 1097 encap_lock_held(void) 1098 { 1099 1100 return (encap_whole.busy == curlwp); 1101 } 1102