1 /* $NetBSD: in6_l2tp.c,v 1.23 2023/09/01 11:23:39 andvar Exp $ */ 2 3 /* 4 * Copyright (c) 2017 Internet Initiative Japan Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 #include <sys/cdefs.h> 30 __KERNEL_RCSID(0, "$NetBSD: in6_l2tp.c,v 1.23 2023/09/01 11:23:39 andvar Exp $"); 31 32 #ifdef _KERNEL_OPT 33 #include "opt_l2tp.h" 34 #endif 35 36 #include <sys/param.h> 37 #include <sys/systm.h> 38 #include <sys/socket.h> 39 #include <sys/sockio.h> 40 #include <sys/mbuf.h> 41 #include <sys/errno.h> 42 #include <sys/ioctl.h> 43 #include <sys/syslog.h> 44 #include <sys/kernel.h> 45 46 #include <net/if.h> 47 #include <net/route.h> 48 #include <net/if_ether.h> 49 50 #include <netinet/in.h> 51 #include <netinet/in_systm.h> 52 #include <netinet/ip.h> 53 #include <netinet/ip_var.h> 54 #include <netinet/ip_private.h> 55 #include <netinet/in_l2tp.h> 56 #include <netinet/in_var.h> 57 #include <netinet/ip_encap.h> 58 59 #include <netinet/ip6.h> 60 #include <netinet6/ip6_var.h> 61 #include <netinet6/ip6_private.h> 62 #include <netinet6/in6_l2tp.h> 63 64 #ifdef ALTQ 65 #include <altq/altq.h> 66 #endif 67 68 /* TODO: IP_TCPMSS support */ 69 #undef IP_TCPMSS 70 #ifdef IP_TCPMSS 71 #include <netinet/ip_tcpmss.h> 72 #endif 73 74 #include <net/if_l2tp.h> 75 76 #define L2TP_HLIM6 64 77 int ip6_l2tp_hlim = L2TP_HLIM6; 78 79 static int in6_l2tp_input(struct mbuf **, int *, int, void *); 80 81 static const struct encapsw in6_l2tp_encapsw = { 82 .encapsw6 = { 83 .pr_input = in6_l2tp_input, 84 .pr_ctlinput = NULL, 85 } 86 }; 87 88 static int in6_l2tp_match(struct mbuf *, int, int, void *); 89 90 int 91 in6_l2tp_output(struct l2tp_variant *var, struct mbuf *m) 92 { 93 struct rtentry *rt; 94 struct route *ro_pc; 95 kmutex_t *lock_pc; 96 struct l2tp_softc *sc; 97 struct ifnet *ifp; 98 struct sockaddr_in6 *sin6_src = satosin6(var->lv_psrc); 99 struct sockaddr_in6 *sin6_dst = satosin6(var->lv_pdst); 100 struct ip6_hdr ip6hdr; /* capsule IP header, host byte ordered */ 101 int error; 102 uint32_t sess_id; 103 104 KASSERT(var != NULL); 105 KASSERT(l2tp_heldref_variant(var)); 106 KASSERT(sin6_src != NULL && sin6_dst != NULL); 107 KASSERT(sin6_src->sin6_family == AF_INET6 108 && sin6_dst->sin6_family == AF_INET6); 109 110 sc = var->lv_softc; 111 ifp = &sc->l2tp_ec.ec_if; 112 error = l2tp_check_nesting(ifp, m); 113 if (error) { 114 m_freem(m); 115 goto looped; 116 } 117 118 /* bidirectional configured tunnel mode */ 119 if (IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) { 120 m_freem(m); 121 if ((ifp->if_flags & IFF_DEBUG) != 0) 122 log(LOG_DEBUG, "%s: ENETUNREACH\n", __func__); 123 return ENETUNREACH; 124 } 125 126 #ifdef NOTYET 127 /* TODO: support ALTQ for inner frame */ 128 #ifdef ALTQ 129 ALTQ_SAVE_PAYLOAD(m, AF_ETHER); 130 #endif 131 #endif 132 133 memset(&ip6hdr, 0, sizeof(ip6hdr)); 134 ip6hdr.ip6_src = sin6_src->sin6_addr; 135 ip6hdr.ip6_dst = sin6_dst->sin6_addr; 136 /* unlike IPv4, IP version must be filled by caller of ip6_output() */ 137 ip6hdr.ip6_vfc = 0x60; 138 ip6hdr.ip6_nxt = IPPROTO_L2TP; 139 ip6hdr.ip6_hlim = ip6_l2tp_hlim; 140 /* outer IP payload length */ 141 ip6hdr.ip6_plen = 0; 142 /* session-id length */ 143 ip6hdr.ip6_plen += sizeof(uint32_t); 144 if (var->lv_use_cookie == L2TP_COOKIE_ON) { 145 /* cookie length */ 146 ip6hdr.ip6_plen += var->lv_peer_cookie_len; 147 } 148 149 /* TODO: IP_TCPMSS support */ 150 #ifdef IP_TCPMSS 151 m = l2tp_tcpmss_clamp(ifp, m); 152 if (m == NULL) 153 return EINVAL; 154 #endif 155 156 /* 157 * Payload length. 158 * 159 * NOTE: payload length may be changed in ip_tcpmss(). Typical case 160 * is missing of TCP mss option in original TCP header. 161 */ 162 ip6hdr.ip6_plen += m->m_pkthdr.len; 163 HTONS(ip6hdr.ip6_plen); 164 165 if (var->lv_use_cookie == L2TP_COOKIE_ON) { 166 /* prepend session cookie */ 167 uint32_t cookie_32; 168 uint64_t cookie_64; 169 M_PREPEND(m, var->lv_peer_cookie_len, M_DONTWAIT); 170 if (m && m->m_len < var->lv_peer_cookie_len) 171 m = m_pullup(m, var->lv_peer_cookie_len); 172 if (m == NULL) 173 return ENOBUFS; 174 if (var->lv_peer_cookie_len == 4) { 175 cookie_32 = htonl((uint32_t)var->lv_peer_cookie); 176 memcpy(mtod(m, void *), &cookie_32, sizeof(uint32_t)); 177 } else { 178 cookie_64 = htobe64(var->lv_peer_cookie); 179 memcpy(mtod(m, void *), &cookie_64, sizeof(uint64_t)); 180 } 181 } 182 183 /* prepend session-ID */ 184 sess_id = htonl(var->lv_peer_sess_id); 185 M_PREPEND(m, sizeof(uint32_t), M_DONTWAIT); 186 if (m && m->m_len < sizeof(uint32_t)) 187 m = m_pullup(m, sizeof(uint32_t)); 188 if (m == NULL) 189 return ENOBUFS; 190 memcpy(mtod(m, uint32_t *), &sess_id, sizeof(uint32_t)); 191 192 /* prepend new IP header */ 193 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 194 if (m == NULL) 195 return ENOBUFS; 196 if (M_GET_ALIGNED_HDR(&m, struct ip6_hdr, false) != 0) 197 return ENOBUFS; 198 memcpy(mtod(m, struct ip6_hdr *), &ip6hdr, sizeof(struct ip6_hdr)); 199 200 if_tunnel_get_ro(sc->l2tp_ro_percpu, &ro_pc, &lock_pc); 201 if ((rt = rtcache_lookup(ro_pc, var->lv_pdst)) == NULL) { 202 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc); 203 m_freem(m); 204 return ENETUNREACH; 205 } 206 207 /* If the route constitutes infinite encapsulation, punt. */ 208 if (rt->rt_ifp == ifp) { 209 rtcache_unref(rt, ro_pc); 210 rtcache_free(ro_pc); 211 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc); 212 m_freem(m); 213 return ENETUNREACH; /* XXX */ 214 } 215 rtcache_unref(rt, ro_pc); 216 217 /* 218 * To avoid inappropriate rewrite of checksum, 219 * clear csum flags. 220 */ 221 m->m_pkthdr.csum_flags = 0; 222 223 error = ip6_output(m, 0, ro_pc, 0, NULL, NULL, NULL); 224 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc); 225 return(error); 226 227 looped: 228 if (error) 229 if_statinc(ifp, if_oerrors); 230 231 return error; 232 } 233 234 static int 235 in6_l2tp_input(struct mbuf **mp, int *offp, int proto, void *eparg __unused) 236 { 237 struct mbuf *m = *mp; 238 int off = *offp; 239 240 struct ifnet *l2tpp = NULL; 241 struct l2tp_softc *sc; 242 struct l2tp_variant *var; 243 uint32_t sess_id; 244 uint32_t cookie_32; 245 uint64_t cookie_64; 246 struct psref psref; 247 248 KASSERT((m->m_flags & M_PKTHDR) != 0); 249 250 if (m->m_pkthdr.len < off + sizeof(uint32_t)) { 251 m_freem(m); 252 return IPPROTO_DONE; 253 } 254 255 /* get L2TP session ID */ 256 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id); 257 NTOHL(sess_id); 258 #ifdef L2TP_DEBUG 259 log(LOG_DEBUG, "%s: sess_id = %" PRIu32 "\n", __func__, sess_id); 260 #endif 261 if (sess_id == 0) { 262 int rv; 263 /* 264 * L2TPv3 control packet received. 265 * userland daemon(l2tpd?) should process. 266 */ 267 SOFTNET_LOCK_IF_NET_MPSAFE(); 268 rv = rip6_input(mp, offp, proto); 269 SOFTNET_UNLOCK_IF_NET_MPSAFE(); 270 return rv; 271 } 272 273 var = l2tp_lookup_session_ref(sess_id, &psref); 274 if (var == NULL) { 275 m_freem(m); 276 IP_STATINC(IP_STAT_NOL2TP); 277 return IPPROTO_DONE; 278 } 279 280 sc = var->lv_softc; 281 l2tpp = &(sc->l2tp_ec.ec_if); 282 283 if (l2tpp == NULL || (l2tpp->if_flags & IFF_UP) == 0) { 284 #ifdef L2TP_DEBUG 285 if (l2tpp == NULL) 286 log(LOG_DEBUG, "%s: l2tpp is NULL\n", __func__); 287 else 288 log(LOG_DEBUG, "%s: l2tpp is down\n", __func__); 289 #endif 290 m_freem(m); 291 IP_STATINC(IP_STAT_NOL2TP); 292 goto out; 293 } 294 295 /* other CPU did l2tp_delete_tunnel */ 296 if (var->lv_psrc == NULL || var->lv_pdst == NULL) { 297 m_freem(m); 298 ip_statinc(IP_STAT_NOL2TP); 299 goto out; 300 } 301 302 if (var->lv_state != L2TP_STATE_UP) { 303 m_freem(m); 304 goto out; 305 } 306 m_adj(m, off + sizeof(uint32_t)); 307 308 if (var->lv_use_cookie == L2TP_COOKIE_ON) { 309 if (m->m_pkthdr.len < var->lv_my_cookie_len) { 310 m_freem(m); 311 goto out; 312 } 313 if (var->lv_my_cookie_len == 4) { 314 m_copydata(m, 0, sizeof(uint32_t), (void *)&cookie_32); 315 NTOHL(cookie_32); 316 if (cookie_32 != var->lv_my_cookie) { 317 m_freem(m); 318 goto out; 319 } 320 m_adj(m, sizeof(uint32_t)); 321 } else { 322 m_copydata(m, 0, sizeof(uint64_t), (void *)&cookie_64); 323 BE64TOH(cookie_64); 324 if (cookie_64 != var->lv_my_cookie) { 325 m_freem(m); 326 goto out; 327 } 328 m_adj(m, sizeof(uint64_t)); 329 } 330 } 331 332 /* TODO: IP_TCPMSS support */ 333 #ifdef IP_TCPMSS 334 m = l2tp_tcpmss_clamp(l2tpp, m); 335 if (m == NULL) 336 goto out; 337 #endif 338 l2tp_input(m, l2tpp); 339 340 out: 341 l2tp_putref_variant(var, &psref); 342 return IPPROTO_DONE; 343 } 344 345 /* 346 * This function is used by encap6_lookup() to decide priority of the encaptab. 347 * This priority is compared to the match length between mbuf's source/destination 348 * IPv6 address pair and encaptab's one. 349 * l2tp(4) does not use address pairs to search matched encaptab, so this 350 * function must return the length bigger than or equals to IPv6 address pair to 351 * avoid wrong encaptab. 352 */ 353 static int 354 in6_l2tp_match(struct mbuf *m, int off, int proto, void *arg) 355 { 356 struct l2tp_softc *sc = arg; 357 struct l2tp_variant *var; 358 struct psref psref; 359 uint32_t sess_id; 360 int rv = 0; 361 362 KASSERT(proto == IPPROTO_L2TP); 363 364 var = l2tp_getref_variant(sc, &psref); 365 if (__predict_false(var == NULL)) 366 return rv; 367 368 /* 369 * If the packet contains no session ID it cannot match 370 */ 371 if (m_length(m) < off + sizeof(uint32_t)) { 372 rv = 0 ; 373 goto out; 374 } 375 376 /* get L2TP session ID */ 377 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id); 378 NTOHL(sess_id); 379 if (sess_id == 0) { 380 /* 381 * L2TPv3 control packet received. 382 * userland daemon(l2tpd?) should process. 383 */ 384 rv = 128 * 2; 385 } else if (sess_id == var->lv_my_sess_id) 386 rv = 128 * 2; 387 else 388 rv = 0; 389 390 out: 391 l2tp_putref_variant(var, &psref); 392 return rv; 393 } 394 395 int 396 in6_l2tp_attach(struct l2tp_variant *var) 397 { 398 struct l2tp_softc *sc = var->lv_softc; 399 400 if (sc == NULL) 401 return EINVAL; 402 403 var->lv_encap_cookie = encap_attach_addr(AF_INET6, IPPROTO_L2TP, 404 var->lv_psrc, var->lv_pdst, in6_l2tp_match, &in6_l2tp_encapsw, sc); 405 if (var->lv_encap_cookie == NULL) 406 return EEXIST; 407 408 return 0; 409 } 410 411 int 412 in6_l2tp_detach(struct l2tp_variant *var) 413 { 414 int error; 415 416 error = encap_detach(var->lv_encap_cookie); 417 if (error == 0) 418 var->lv_encap_cookie = NULL; 419 420 return error; 421 } 422
Indexes created Wed Sep 24 05:09:52 GMT 2025