xref: /openbsd-src/sys/netinet/ip_ipip.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2)
1 /*	$OpenBSD: ip_ipip.c,v 1.42 2008/11/26 16:08:17 henning Exp $ */
2 /*
3  * The authors of this code are John Ioannidis (ji@tla.org),
4  * Angelos D. Keromytis (kermit@csd.uch.gr) and
5  * Niels Provos (provos@physnet.uni-hamburg.de).
6  *
7  * The original version of this code was written by John Ioannidis
8  * for BSD/OS in Athens, Greece, in November 1995.
9  *
10  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
11  * by Angelos D. Keromytis.
12  *
13  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
14  * and Niels Provos.
15  *
16  * Additional features in 1999 by Angelos D. Keromytis.
17  *
18  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
19  * Angelos D. Keromytis and Niels Provos.
20  * Copyright (c) 2001, Angelos D. Keromytis.
21  *
22  * Permission to use, copy, and modify this software with or without fee
23  * is hereby granted, provided that this entire notice is included in
24  * all copies of any software which is or includes a copy or
25  * modification of this software.
26  * You may use this code under the GNU public license if you so wish. Please
27  * contribute changes back to the authors under this freer than GPL license
28  * so that we may further the use of strong encryption without limitations to
29  * all.
30  *
31  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
32  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
33  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
34  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
35  * PURPOSE.
36  */
37 
38 /*
39  * IP-inside-IP processing
40  */
41 
42 #include "pf.h"
43 
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/mbuf.h>
47 #include <sys/socket.h>
48 #include <sys/sysctl.h>
49 
50 #include <net/if.h>
51 #include <net/route.h>
52 #include <net/netisr.h>
53 #include <net/bpf.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/ip.h>
58 #include <netinet/in_pcb.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip_var.h>
61 #include <netinet/ip_ecn.h>
62 
63 #ifdef MROUTING
64 #include <netinet/ip_mroute.h>
65 #endif
66 
67 #include <netinet/ip_ipsp.h>
68 #include <netinet/ip_ipip.h>
69 
70 #include "bpfilter.h"
71 
72 #if NPF > 0
73 #include <net/pfvar.h>
74 #endif
75 
76 #ifdef ENCDEBUG
77 #define DPRINTF(x)	if (encdebug) printf x
78 #else
79 #define DPRINTF(x)
80 #endif
81 
82 /*
83  * We can control the acceptance of IP4 packets by altering the sysctl
84  * net.inet.ipip.allow value.  Zero means drop them, all else is acceptance.
85  */
86 int ipip_allow = 0;
87 
88 struct ipipstat ipipstat;
89 
90 #ifdef INET6
91 /*
92  * Really only a wrapper for ipip_input(), for use with IPv6.
93  */
94 int
95 ip4_input6(struct mbuf **m, int *offp, int proto)
96 {
97 	/* If we do not accept IP-in-IP explicitly, drop.  */
98 	if (!ipip_allow && ((*m)->m_flags & (M_AUTH|M_CONF)) == 0) {
99 		DPRINTF(("ip4_input6(): dropped due to policy\n"));
100 		ipipstat.ipips_pdrops++;
101 		m_freem(*m);
102 		return IPPROTO_DONE;
103 	}
104 
105 	ipip_input(*m, *offp, NULL);
106 	return IPPROTO_DONE;
107 }
108 #endif /* INET6 */
109 
110 #ifdef INET
111 /*
112  * Really only a wrapper for ipip_input(), for use with IPv4.
113  */
114 void
115 ip4_input(struct mbuf *m, ...)
116 {
117 	va_list ap;
118 	int iphlen;
119 
120 	/* If we do not accept IP-in-IP explicitly, drop.  */
121 	if (!ipip_allow && (m->m_flags & (M_AUTH|M_CONF)) == 0) {
122 		DPRINTF(("ip4_input(): dropped due to policy\n"));
123 		ipipstat.ipips_pdrops++;
124 		m_freem(m);
125 		return;
126 	}
127 
128 	va_start(ap, m);
129 	iphlen = va_arg(ap, int);
130 	va_end(ap);
131 
132 	ipip_input(m, iphlen, NULL);
133 }
134 #endif /* INET */
135 
136 /*
137  * ipip_input gets called when we receive an IP{46} encapsulated packet,
138  * either because we got it at a real interface, or because AH or ESP
139  * were being used in tunnel mode (in which case the rcvif element will
140  * contain the address of the encX interface associated with the tunnel.
141  */
142 
143 void
144 ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
145 {
146 	struct sockaddr_in *sin;
147 	struct ifnet *ifp;
148 	struct ifaddr *ifa;
149 	struct ifqueue *ifq = NULL;
150 	struct ip *ipo;
151 #ifdef INET6
152 	struct sockaddr_in6 *sin6;
153 	struct ip6_hdr *ip6 = NULL;
154 	u_int8_t itos;
155 #endif
156 	u_int8_t nxt;
157 	int isr;
158 	u_int8_t otos;
159 	u_int8_t v;
160 	int hlen, s;
161 
162 	ipipstat.ipips_ipackets++;
163 
164 	m_copydata(m, 0, 1, &v);
165 
166 	switch (v >> 4) {
167 #ifdef INET
168         case 4:
169 		hlen = sizeof(struct ip);
170 		break;
171 #endif /* INET */
172 #ifdef INET6
173         case 6:
174 		hlen = sizeof(struct ip6_hdr);
175 		break;
176 #endif
177         default:
178 		ipipstat.ipips_family++;
179 		m_freem(m);
180 		return /* EAFNOSUPPORT */;
181 	}
182 
183 	/* Bring the IP header in the first mbuf, if not there already */
184 	if (m->m_len < hlen) {
185 		if ((m = m_pullup(m, hlen)) == NULL) {
186 			DPRINTF(("ipip_input(): m_pullup() failed\n"));
187 			ipipstat.ipips_hdrops++;
188 			return;
189 		}
190 	}
191 
192 	ipo = mtod(m, struct ip *);
193 
194 	/* Keep outer ecn field. */
195 	switch (v >> 4) {
196 #ifdef INET
197 	case 4:
198 		otos = ipo->ip_tos;
199 		break;
200 #endif /* INET */
201 #ifdef INET6
202 	case 6:
203 		otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff;
204 		break;
205 #endif
206 	default:
207 		panic("ipip_input: should never reach here");
208 	}
209 
210 	/* Remove outer IP header */
211 	m_adj(m, iphlen);
212 
213 	/* Sanity check */
214 	if (m->m_pkthdr.len < sizeof(struct ip)) {
215 		ipipstat.ipips_hdrops++;
216 		m_freem(m);
217 		return;
218 	}
219 
220 	m_copydata(m, 0, 1, &v);
221 
222 	switch (v >> 4) {
223 #ifdef INET
224         case 4:
225 		hlen = sizeof(struct ip);
226 		break;
227 #endif /* INET */
228 
229 #ifdef INET6
230         case 6:
231 		hlen = sizeof(struct ip6_hdr);
232 		break;
233 #endif
234 	default:
235 		ipipstat.ipips_family++;
236 		m_freem(m);
237 		return; /* EAFNOSUPPORT */
238 	}
239 
240 	/*
241 	 * Bring the inner IP header in the first mbuf, if not there already.
242 	 */
243 	if (m->m_len < hlen) {
244 		if ((m = m_pullup(m, hlen)) == NULL) {
245 			DPRINTF(("ipip_input(): m_pullup() failed\n"));
246 			ipipstat.ipips_hdrops++;
247 			return;
248 		}
249 	}
250 
251 	/*
252 	 * RFC 1853 specifies that the inner TTL should not be touched on
253 	 * decapsulation. There's no reason this comment should be here, but
254 	 * this is as good as any a position.
255 	 */
256 
257 	/* Some sanity checks in the inner IP header */
258 	switch (v >> 4) {
259 #ifdef INET
260     	case 4:
261                 ipo = mtod(m, struct ip *);
262                 nxt = ipo->ip_p;
263 		if (!ip_ecn_egress(ECN_ALLOWED, &otos, &ipo->ip_tos)) {
264 			m_freem(m);
265 			return;
266 		}
267                 break;
268 #endif /* INET */
269 #ifdef INET6
270     	case 6:
271                 ip6 = (struct ip6_hdr *) ipo;
272                 nxt = ip6->ip6_nxt;
273 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
274 		if (!ip_ecn_egress(ECN_ALLOWED, &otos, &itos)) {
275 			m_freem(m);
276 			return;
277 		}
278 		ip6->ip6_flow &= ~htonl(0xff << 20);
279 		ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
280                 break;
281 #endif
282 	default:
283 		panic("ipip_input: should never reach here");
284 	}
285 
286 	/* Check for local address spoofing. */
287 	if ((m->m_pkthdr.rcvif == NULL ||
288 	    !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) &&
289 	    ipip_allow != 2) {
290 		TAILQ_FOREACH(ifp, &ifnet, if_list) {
291 			TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
292 #ifdef INET
293 				if (ipo) {
294 					if (ifa->ifa_addr->sa_family !=
295 					    AF_INET)
296 						continue;
297 
298 					sin = (struct sockaddr_in *) ifa->ifa_addr;
299 
300 					if (sin->sin_addr.s_addr ==
301 					    ipo->ip_src.s_addr)	{
302 						ipipstat.ipips_spoof++;
303 						m_freem(m);
304 						return;
305 					}
306 				}
307 #endif /* INET */
308 
309 #ifdef INET6
310 				if (ip6) {
311 					if (ifa->ifa_addr->sa_family !=
312 					    AF_INET6)
313 						continue;
314 
315 					sin6 = (struct sockaddr_in6 *) ifa->ifa_addr;
316 
317 					if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) {
318 						ipipstat.ipips_spoof++;
319 						m_freem(m);
320 						return;
321 					}
322 
323 				}
324 #endif /* INET6 */
325 			}
326 		}
327 	}
328 
329 	/* Statistics */
330 	ipipstat.ipips_ibytes += m->m_pkthdr.len - iphlen;
331 
332 	/*
333 	 * Interface pointer stays the same; if no IPsec processing has
334 	 * been done (or will be done), this will point to a normal
335 	 * interface. Otherwise, it'll point to an enc interface, which
336 	 * will allow a packet filter to distinguish between secure and
337 	 * untrusted packets.
338 	 */
339 
340 	switch (v >> 4) {
341 #ifdef INET
342 	case 4:
343 		ifq = &ipintrq;
344 		isr = NETISR_IP;
345 		break;
346 #endif
347 #ifdef INET6
348 	case 6:
349 		ifq = &ip6intrq;
350 		isr = NETISR_IPV6;
351 		break;
352 #endif
353 	default:
354 		panic("ipip_input: should never reach here");
355 	}
356 
357 #if NBPFILTER > 0
358 	if (gifp && gifp->if_bpf)
359 		bpf_mtap_af(gifp->if_bpf, ifq == &ipintrq ? AF_INET : AF_INET6,
360 		    m, BPF_DIRECTION_IN);
361 #endif
362 #if NPF > 0
363 	pf_pkt_addr_changed(m);
364 #endif
365 
366 	s = splnet();			/* isn't it already? */
367 	if (IF_QFULL(ifq)) {
368 		IF_DROP(ifq);
369 		m_freem(m);
370 		ipipstat.ipips_qfull++;
371 
372 		splx(s);
373 
374 		DPRINTF(("ipip_input(): packet dropped because of full "
375 		    "queue\n"));
376 		return;
377 	}
378 
379 	IF_ENQUEUE(ifq, m);
380 	schednetisr(isr);
381 	splx(s);
382 	return;
383 }
384 
385 int
386 ipip_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int dummy,
387     int dummy2)
388 {
389 	u_int8_t tp, otos;
390 
391 #ifdef INET
392 	u_int8_t itos;
393 	struct ip *ipo;
394 #endif /* INET */
395 
396 #ifdef INET6
397 	struct ip6_hdr *ip6, *ip6o;
398 #endif /* INET6 */
399 
400 	/* XXX Deal with empty TDB source/destination addresses. */
401 
402 	m_copydata(m, 0, 1, &tp);
403 	tp = (tp >> 4) & 0xff;  /* Get the IP version number. */
404 
405 	switch (tdb->tdb_dst.sa.sa_family) {
406 #ifdef INET
407 	case AF_INET:
408 		if (tdb->tdb_src.sa.sa_family != AF_INET ||
409 		    tdb->tdb_src.sin.sin_addr.s_addr == INADDR_ANY ||
410 		    tdb->tdb_dst.sin.sin_addr.s_addr == INADDR_ANY) {
411 
412 			DPRINTF(("ipip_output(): unspecified tunnel endpoind "
413 			    "address in SA %s/%08x\n",
414 			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
415 
416 			ipipstat.ipips_unspec++;
417 			m_freem(m);
418 			*mp = NULL;
419 			return EINVAL;
420 		}
421 
422 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
423 		if (m == 0) {
424 			DPRINTF(("ipip_output(): M_PREPEND failed\n"));
425 			ipipstat.ipips_hdrops++;
426 			*mp = NULL;
427 			return ENOBUFS;
428 		}
429 
430 		ipo = mtod(m, struct ip *);
431 
432 		ipo->ip_v = IPVERSION;
433 		ipo->ip_hl = 5;
434 		ipo->ip_len = htons(m->m_pkthdr.len);
435 		ipo->ip_ttl = ip_defttl;
436 		ipo->ip_sum = 0;
437 		ipo->ip_src = tdb->tdb_src.sin.sin_addr;
438 		ipo->ip_dst = tdb->tdb_dst.sin.sin_addr;
439 
440 		/*
441 		 * We do the htons() to prevent snoopers from determining our
442 		 * endianness.
443 		 */
444 		ipo->ip_id = htons(ip_randomid());
445 
446 		/* If the inner protocol is IP... */
447 		if (tp == IPVERSION) {
448 			/* Save ECN notification */
449 			m_copydata(m, sizeof(struct ip) +
450 			    offsetof(struct ip, ip_tos),
451 			    sizeof(u_int8_t), (caddr_t) &itos);
452 
453 			ipo->ip_p = IPPROTO_IPIP;
454 
455 			/*
456 			 * We should be keeping tunnel soft-state and
457 			 * send back ICMPs if needed.
458 			 */
459 			m_copydata(m, sizeof(struct ip) +
460 			    offsetof(struct ip, ip_off),
461 			    sizeof(u_int16_t), (caddr_t) &ipo->ip_off);
462 			NTOHS(ipo->ip_off);
463 			ipo->ip_off &= ~(IP_DF | IP_MF | IP_OFFMASK);
464 			HTONS(ipo->ip_off);
465 		}
466 #ifdef INET6
467 		else if (tp == (IPV6_VERSION >> 4)) {
468 			u_int32_t itos32;
469 
470 			/* Save ECN notification. */
471 			m_copydata(m, sizeof(struct ip) +
472 			    offsetof(struct ip6_hdr, ip6_flow),
473 			    sizeof(u_int32_t), (caddr_t) &itos32);
474 			itos = ntohl(itos32) >> 20;
475 			ipo->ip_p = IPPROTO_IPV6;
476 			ipo->ip_off = 0;
477 		}
478 #endif /* INET6 */
479 		else {
480 			m_freem(m);
481 			*mp = NULL;
482 			ipipstat.ipips_family++;
483 			return EAFNOSUPPORT;
484 		}
485 
486 		otos = 0;
487 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
488 		ipo->ip_tos = otos;
489 		break;
490 #endif /* INET */
491 
492 #ifdef INET6
493 	case AF_INET6:
494 		if (IN6_IS_ADDR_UNSPECIFIED(&tdb->tdb_dst.sin6.sin6_addr) ||
495 		    tdb->tdb_src.sa.sa_family != AF_INET6 ||
496 		    IN6_IS_ADDR_UNSPECIFIED(&tdb->tdb_src.sin6.sin6_addr)) {
497 
498 			DPRINTF(("ipip_output(): unspecified tunnel endpoind "
499 			    "address in SA %s/%08x\n",
500 			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
501 
502 			ipipstat.ipips_unspec++;
503 			m_freem(m);
504 			*mp = NULL;
505 			return ENOBUFS;
506 		}
507 
508 		/* If the inner protocol is IPv6, clear link local scope */
509 		if (tp == (IPV6_VERSION >> 4)) {
510 			/* scoped address handling */
511 			ip6 = mtod(m, struct ip6_hdr *);
512 			if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src))
513 				ip6->ip6_src.s6_addr16[1] = 0;
514 			if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst))
515 				ip6->ip6_dst.s6_addr16[1] = 0;
516 		}
517 
518 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
519 		if (m == 0) {
520 			DPRINTF(("ipip_output(): M_PREPEND failed\n"));
521 			ipipstat.ipips_hdrops++;
522 			*mp = NULL;
523 			return ENOBUFS;
524 		}
525 
526 		/* Initialize IPv6 header */
527 		ip6o = mtod(m, struct ip6_hdr *);
528 		ip6o->ip6_flow = 0;
529 		ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
530 		ip6o->ip6_vfc |= IPV6_VERSION;
531 		ip6o->ip6_plen = htons(m->m_pkthdr.len - sizeof(*ip6o));
532 		ip6o->ip6_hlim = ip_defttl;
533 		in6_embedscope(&ip6o->ip6_src, &tdb->tdb_src.sin6, NULL, NULL);
534 		in6_embedscope(&ip6o->ip6_dst, &tdb->tdb_dst.sin6, NULL, NULL);
535 
536 #ifdef INET
537 		if (tp == IPVERSION) {
538 			/* Save ECN notification */
539 			m_copydata(m, sizeof(struct ip6_hdr) +
540 			    offsetof(struct ip, ip_tos), sizeof(u_int8_t),
541 			    (caddr_t) &itos);
542 
543 			/* This is really IPVERSION. */
544 			ip6o->ip6_nxt = IPPROTO_IPIP;
545 		}
546 		else
547 #endif /* INET */
548 			if (tp == (IPV6_VERSION >> 4)) {
549 				u_int32_t itos32;
550 
551 				/* Save ECN notification. */
552 				m_copydata(m, sizeof(struct ip6_hdr) +
553 				    offsetof(struct ip6_hdr, ip6_flow),
554 				    sizeof(u_int32_t), (caddr_t) &itos32);
555 				itos = ntohl(itos32) >> 20;
556 
557 				ip6o->ip6_nxt = IPPROTO_IPV6;
558 			} else {
559 				m_freem(m);
560 				*mp = NULL;
561 				ipipstat.ipips_family++;
562 				return EAFNOSUPPORT;
563 			}
564 
565 		otos = 0;
566 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
567 		ip6o->ip6_flow |= htonl((u_int32_t) otos << 20);
568 		break;
569 #endif /* INET6 */
570 
571 	default:
572 		DPRINTF(("ipip_output(): unsupported protocol family %d\n",
573 		    tdb->tdb_dst.sa.sa_family));
574 		m_freem(m);
575 		*mp = NULL;
576 		ipipstat.ipips_family++;
577 		return EAFNOSUPPORT;
578 	}
579 
580 	ipipstat.ipips_opackets++;
581 	*mp = m;
582 
583 #ifdef INET
584 	if (tdb->tdb_dst.sa.sa_family == AF_INET) {
585 		if (tdb->tdb_xform->xf_type == XF_IP4)
586 			tdb->tdb_cur_bytes +=
587 			    m->m_pkthdr.len - sizeof(struct ip);
588 
589 		ipipstat.ipips_obytes += m->m_pkthdr.len - sizeof(struct ip);
590 	}
591 #endif /* INET */
592 
593 #ifdef INET6
594 	if (tdb->tdb_dst.sa.sa_family == AF_INET6) {
595 		if (tdb->tdb_xform->xf_type == XF_IP4)
596 			tdb->tdb_cur_bytes +=
597 			    m->m_pkthdr.len - sizeof(struct ip6_hdr);
598 
599 		ipipstat.ipips_obytes +=
600 		    m->m_pkthdr.len - sizeof(struct ip6_hdr);
601 	}
602 #endif /* INET6 */
603 
604 	return 0;
605 }
606 
607 #ifdef IPSEC
608 int
609 ipe4_attach()
610 {
611 	return 0;
612 }
613 
614 int
615 ipe4_init(struct tdb *tdbp, struct xformsw *xsp, struct ipsecinit *ii)
616 {
617 	tdbp->tdb_xform = xsp;
618 	return 0;
619 }
620 
621 int
622 ipe4_zeroize(struct tdb *tdbp)
623 {
624 	return 0;
625 }
626 
627 void
628 ipe4_input(struct mbuf *m, ...)
629 {
630 	/* This is a rather serious mistake, so no conditional printing. */
631 	printf("ipe4_input(): should never be called\n");
632 	if (m)
633 		m_freem(m);
634 }
635 #endif	/* IPSEC */
636 
637 int
638 ipip_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
639     size_t newlen)
640 {
641 	/* All sysctl names at this level are terminal. */
642 	if (namelen != 1)
643 		return (ENOTDIR);
644 
645 	switch (name[0]) {
646 	case IPIPCTL_ALLOW:
647 		return (sysctl_int(oldp, oldlenp, newp, newlen, &ipip_allow));
648 	case IPIPCTL_STATS:
649 		if (newp != NULL)
650 			return (EPERM);
651 		return (sysctl_struct(oldp, oldlenp, newp, newlen,
652 		    &ipipstat, sizeof(ipipstat)));
653 	default:
654 		return (ENOPROTOOPT);
655 	}
656 	/* NOTREACHED */
657 }
658