Home | History | Annotate | Line # | Download | only in netinet
in_gif.c revision 1.24 
      1 /*	$NetBSD: in_gif.c,v 1.24 2001/11/04 20:55:26 matt Exp $	*/
      2 /*	$KAME: in_gif.c,v 1.66 2001/07/29 04:46:09 itojun Exp $	*/
      3 
      4 /*
      5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. Neither the name of the project nor the names of its contributors
     17  *    may be used to endorse or promote products derived from this software
     18  *    without specific prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     30  * SUCH DAMAGE.
     31  */
     32 
     33 #include "opt_inet.h"
     34 #include "opt_iso.h"
     35 
     36 /* define it if you want to use encap_attach_func (it helps *BSD merge) */
     37 #define USE_ENCAPCHECK
     38 
     39 #include <sys/param.h>
     40 #include <sys/systm.h>
     41 #include <sys/socket.h>
     42 #include <sys/sockio.h>
     43 #include <sys/mbuf.h>
     44 #include <sys/errno.h>
     45 #include <sys/ioctl.h>
     46 #include <sys/syslog.h>
     47 
     48 #include <net/if.h>
     49 #include <net/route.h>
     50 
     51 #include <netinet/in.h>
     52 #include <netinet/in_systm.h>
     53 #include <netinet/ip.h>
     54 #include <netinet/ip_var.h>
     55 #include <netinet/in_gif.h>
     56 #include <netinet/in_var.h>
     57 #include <netinet/ip_encap.h>
     58 #include <netinet/ip_ecn.h>
     59 
     60 #ifdef INET6
     61 #include <netinet/ip6.h>
     62 #endif
     63 
     64 #include <net/if_gif.h>
     65 
     66 #include "gif.h"
     67 
     68 #include <machine/stdarg.h>
     69 
     70 #include <net/net_osdep.h>
     71 
     72 static int gif_validate4 __P((const struct ip *, struct gif_softc *,
     73 	struct ifnet *));
     74 
     75 #if NGIF > 0
     76 int ip_gif_ttl = GIF_TTL;
     77 #else
     78 int ip_gif_ttl = 0;
     79 #endif
     80 
     81 extern struct protosw in_gif_protosw;
     82 
     83 int
     84 in_gif_output(ifp, family, m)
     85 	struct ifnet	*ifp;
     86 	int		family;
     87 	struct mbuf	*m;
     88 {
     89 	struct gif_softc *sc = (struct gif_softc*)ifp;
     90 	struct sockaddr_in *dst = (struct sockaddr_in *)&sc->gif_ro.ro_dst;
     91 	struct sockaddr_in *sin_src = (struct sockaddr_in *)sc->gif_psrc;
     92 	struct sockaddr_in *sin_dst = (struct sockaddr_in *)sc->gif_pdst;
     93 	struct ip iphdr;	/* capsule IP header, host byte ordered */
     94 	int proto, error;
     95 	u_int8_t tos;
     96 
     97 	if (sin_src == NULL || sin_dst == NULL ||
     98 	    sin_src->sin_family != AF_INET ||
     99 	    sin_dst->sin_family != AF_INET) {
    100 		m_freem(m);
    101 		return EAFNOSUPPORT;
    102 	}
    103 
    104 	switch (family) {
    105 #ifdef INET
    106 	case AF_INET:
    107 	    {
    108 		struct ip *ip;
    109 
    110 		proto = IPPROTO_IPV4;
    111 		if (m->m_len < sizeof(*ip)) {
    112 			m = m_pullup(m, sizeof(*ip));
    113 			if (!m)
    114 				return ENOBUFS;
    115 		}
    116 		ip = mtod(m, struct ip *);
    117 		tos = ip->ip_tos;
    118 		break;
    119 	    }
    120 #endif /*INET*/
    121 #ifdef INET6
    122 	case AF_INET6:
    123 	    {
    124 		struct ip6_hdr *ip6;
    125 		proto = IPPROTO_IPV6;
    126 		if (m->m_len < sizeof(*ip6)) {
    127 			m = m_pullup(m, sizeof(*ip6));
    128 			if (!m)
    129 				return ENOBUFS;
    130 		}
    131 		ip6 = mtod(m, struct ip6_hdr *);
    132 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    133 		break;
    134 	    }
    135 #endif /*INET6*/
    136 #ifdef ISO
    137 	case AF_ISO:
    138 		proto = IPPROTO_EON;
    139 		tos = 0;
    140 		break;
    141 #endif
    142 	default:
    143 #ifdef DEBUG
    144 		printf("in_gif_output: warning: unknown family %d passed\n",
    145 			family);
    146 #endif
    147 		m_freem(m);
    148 		return EAFNOSUPPORT;
    149 	}
    150 
    151 	bzero(&iphdr, sizeof(iphdr));
    152 	iphdr.ip_src = sin_src->sin_addr;
    153 	/* bidirectional configured tunnel mode */
    154 	if (sin_dst->sin_addr.s_addr != INADDR_ANY)
    155 		iphdr.ip_dst = sin_dst->sin_addr;
    156 	else {
    157 		m_freem(m);
    158 		return ENETUNREACH;
    159 	}
    160 	iphdr.ip_p = proto;
    161 	/* version will be set in ip_output() */
    162 	iphdr.ip_ttl = ip_gif_ttl;
    163 	iphdr.ip_len = m->m_pkthdr.len + sizeof(struct ip);
    164 	if (ifp->if_flags & IFF_LINK1)
    165 		ip_ecn_ingress(ECN_ALLOWED, &iphdr.ip_tos, &tos);
    166 	else
    167 		ip_ecn_ingress(ECN_NOCARE, &iphdr.ip_tos, &tos);
    168 
    169 	/* prepend new IP header */
    170 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
    171 	if (m && m->m_len < sizeof(struct ip))
    172 		m = m_pullup(m, sizeof(struct ip));
    173 	if (m == NULL)
    174 		return ENOBUFS;
    175 	bcopy(&iphdr, mtod(m, struct ip *), sizeof(struct ip));
    176 
    177 	if (dst->sin_family != sin_dst->sin_family ||
    178 	    dst->sin_addr.s_addr != sin_dst->sin_addr.s_addr) {
    179 		/* cache route doesn't match */
    180 		dst->sin_family = sin_dst->sin_family;
    181 		dst->sin_len = sizeof(struct sockaddr_in);
    182 		dst->sin_addr = sin_dst->sin_addr;
    183 		if (sc->gif_ro.ro_rt) {
    184 			RTFREE(sc->gif_ro.ro_rt);
    185 			sc->gif_ro.ro_rt = NULL;
    186 		}
    187 	}
    188 
    189 	if (sc->gif_ro.ro_rt == NULL) {
    190 		rtalloc(&sc->gif_ro);
    191 		if (sc->gif_ro.ro_rt == NULL) {
    192 			m_freem(m);
    193 			return ENETUNREACH;
    194 		}
    195 
    196 		/* if it constitutes infinite encapsulation, punt. */
    197 		if (sc->gif_ro.ro_rt->rt_ifp == ifp) {
    198 			m_freem(m);
    199 			return ENETUNREACH;	/*XXX*/
    200 		}
    201 	}
    202 
    203 	error = ip_output(m, NULL, &sc->gif_ro, 0, NULL);
    204 	return(error);
    205 }
    206 
    207 void
    208 #if __STDC__
    209 in_gif_input(struct mbuf *m, ...)
    210 #else
    211 in_gif_input(m, va_alist)
    212 	struct mbuf *m;
    213 	va_dcl
    214 #endif
    215 {
    216 	int off, proto;
    217 	struct ifnet *gifp = NULL;
    218 	struct ip *ip;
    219 	va_list ap;
    220 	int af;
    221 	u_int8_t otos;
    222 
    223 	va_start(ap, m);
    224 	off = va_arg(ap, int);
    225 	proto = va_arg(ap, int);
    226 	va_end(ap);
    227 
    228 	ip = mtod(m, struct ip *);
    229 
    230 	gifp = (struct ifnet *)encap_getarg(m);
    231 
    232 	if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) {
    233 		m_freem(m);
    234 		ipstat.ips_nogif++;
    235 		return;
    236 	}
    237 #ifndef USE_ENCAPCHECK
    238 	if (!gif_validate4(ip, (struct gif_softc *)gifp, m->m_pkthdr.rcvif)) {
    239 		m_freem(m);
    240 		ipstat.ips_nogif++;
    241 		return;
    242 	}
    243 #endif
    244 
    245 	otos = ip->ip_tos;
    246 	m_adj(m, off);
    247 
    248 	switch (proto) {
    249 #ifdef INET
    250 	case IPPROTO_IPV4:
    251 	    {
    252 		struct ip *ip;
    253 		af = AF_INET;
    254 		if (m->m_len < sizeof(*ip)) {
    255 			m = m_pullup(m, sizeof(*ip));
    256 			if (!m)
    257 				return;
    258 		}
    259 		ip = mtod(m, struct ip *);
    260 		if (gifp->if_flags & IFF_LINK1)
    261 			ip_ecn_egress(ECN_ALLOWED, &otos, &ip->ip_tos);
    262 		else
    263 			ip_ecn_egress(ECN_NOCARE, &otos, &ip->ip_tos);
    264 		break;
    265 	    }
    266 #endif
    267 #ifdef INET6
    268 	case IPPROTO_IPV6:
    269 	    {
    270 		struct ip6_hdr *ip6;
    271 		u_int8_t itos;
    272 		af = AF_INET6;
    273 		if (m->m_len < sizeof(*ip6)) {
    274 			m = m_pullup(m, sizeof(*ip6));
    275 			if (!m)
    276 				return;
    277 		}
    278 		ip6 = mtod(m, struct ip6_hdr *);
    279 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
    280 		if (gifp->if_flags & IFF_LINK1)
    281 			ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
    282 		else
    283 			ip_ecn_egress(ECN_NOCARE, &otos, &itos);
    284 		ip6->ip6_flow &= ~htonl(0xff << 20);
    285 		ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
    286 		break;
    287 	    }
    288 #endif /* INET6 */
    289 #ifdef ISO
    290 	case IPPROTO_EON:
    291 		af = AF_ISO;
    292 		break;
    293 #endif
    294 	default:
    295 		ipstat.ips_nogif++;
    296 		m_freem(m);
    297 		return;
    298 	}
    299 	gif_input(m, af, gifp);
    300 	return;
    301 }
    302 
    303 /*
    304  * validate outer address.
    305  */
    306 static int
    307 gif_validate4(ip, sc, ifp)
    308 	const struct ip *ip;
    309 	struct gif_softc *sc;
    310 	struct ifnet *ifp;
    311 {
    312 	struct sockaddr_in *src, *dst;
    313 	struct in_ifaddr *ia4;
    314 
    315 	src = (struct sockaddr_in *)sc->gif_psrc;
    316 	dst = (struct sockaddr_in *)sc->gif_pdst;
    317 
    318 	/* check for address match */
    319 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
    320 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
    321 		return 0;
    322 
    323 	/* martian filters on outer source - NOT done in ip_input! */
    324 	if (IN_MULTICAST(ip->ip_src.s_addr))
    325 		return 0;
    326 	switch ((ntohl(ip->ip_src.s_addr) & 0xff000000) >> 24) {
    327 	case 0: case 127: case 255:
    328 		return 0;
    329 	}
    330 	/* reject packets with broadcast on source */
    331 	TAILQ_FOREACH(ia4, &in_ifaddr, ia_list) {
    332 		if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0)
    333 			continue;
    334 		if (ip->ip_src.s_addr == ia4->ia_broadaddr.sin_addr.s_addr)
    335 			return 0;
    336 	}
    337 
    338 	/* ingress filters on outer source */
    339 	if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) {
    340 		struct sockaddr_in sin;
    341 		struct rtentry *rt;
    342 
    343 		bzero(&sin, sizeof(sin));
    344 		sin.sin_family = AF_INET;
    345 		sin.sin_len = sizeof(struct sockaddr_in);
    346 		sin.sin_addr = ip->ip_src;
    347 		rt = rtalloc1((struct sockaddr *)&sin, 0);
    348 		if (!rt || rt->rt_ifp != ifp) {
    349 #if 0
    350 			log(LOG_WARNING, "%s: packet from 0x%x dropped "
    351 			    "due to ingress filter\n", if_name(&sc->gif_if),
    352 			    (u_int32_t)ntohl(sin.sin_addr.s_addr));
    353 #endif
    354 			if (rt)
    355 				rtfree(rt);
    356 			return 0;
    357 		}
    358 		rtfree(rt);
    359 	}
    360 
    361 	return 32 * 2;
    362 }
    363 
    364 /*
    365  * we know that we are in IFF_UP, outer address available, and outer family
    366  * matched the physical addr family.  see gif_encapcheck().
    367  */
    368 int
    369 gif_encapcheck4(m, off, proto, arg)
    370 	const struct mbuf *m;
    371 	int off;
    372 	int proto;
    373 	void *arg;
    374 {
    375 	struct ip ip;
    376 	struct gif_softc *sc;
    377 	struct ifnet *ifp;
    378 
    379 	/* sanity check done in caller */
    380 	sc = (struct gif_softc *)arg;
    381 
    382 	/* LINTED const cast */
    383 	m_copydata((struct mbuf *)m, 0, sizeof(ip), (caddr_t)&ip);
    384 	ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
    385 
    386 	return gif_validate4(&ip, sc, ifp);
    387 }
    388 
    389 int
    390 in_gif_attach(sc)
    391 	struct gif_softc *sc;
    392 {
    393 #ifndef USE_ENCAPCHECK
    394 	struct sockaddr_in mask4;
    395 
    396 	bzero(&mask4, sizeof(mask4));
    397 	mask4.sin_len = sizeof(struct sockaddr_in);
    398 	mask4.sin_addr.s_addr = ~0;
    399 
    400 	if (!sc->gif_psrc || !sc->gif_pdst)
    401 		return EINVAL;
    402 	sc->encap_cookie4 = encap_attach(AF_INET, -1, sc->gif_psrc,
    403 	    (struct sockaddr *)&mask4, sc->gif_pdst, (struct sockaddr *)&mask4,
    404 	    (struct protosw *)&in_gif_protosw, sc);
    405 #else
    406 	sc->encap_cookie4 = encap_attach_func(AF_INET, -1, gif_encapcheck,
    407 	    &in_gif_protosw, sc);
    408 #endif
    409 	if (sc->encap_cookie4 == NULL)
    410 		return EEXIST;
    411 	return 0;
    412 }
    413 
    414 int
    415 in_gif_detach(sc)
    416 	struct gif_softc *sc;
    417 {
    418 	int error;
    419 
    420 	error = encap_detach(sc->encap_cookie4);
    421 	if (error == 0)
    422 		sc->encap_cookie4 = NULL;
    423 	return error;
    424 }
    425