ip_encap.c revision 1.39
1 /* $KAME: ip_encap.c,v 1.73 2001/10/02 08:30:58 itojun Exp $ */ 2 3 /* 4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the project nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 /* 32 * My grandfather said that there's a devil inside tunnelling technology... 33 * 34 * We have surprisingly many protocols that want packets with IP protocol 35 * #4 or #41. Here's a list of protocols that want protocol #41: 36 * RFC1933 configured tunnel 37 * RFC1933 automatic tunnel 38 * RFC2401 IPsec tunnel 39 * RFC2473 IPv6 generic packet tunnelling 40 * RFC2529 6over4 tunnel 41 * RFC3056 6to4 tunnel 42 * isatap tunnel 43 * mobile-ip6 (uses RFC2473) 44 * Here's a list of protocol that want protocol #4: 45 * RFC1853 IPv4-in-IPv4 tunnelling 46 * RFC2003 IPv4 encapsulation within IPv4 47 * RFC2344 reverse tunnelling for mobile-ip4 48 * RFC2401 IPsec tunnel 49 * Well, what can I say. They impose different en/decapsulation mechanism 50 * from each other, so they need separate protocol handler. The only one 51 * we can easily determine by protocol # is IPsec, which always has 52 * AH/ESP/IPComp header right after outer IP header. 53 * 54 * So, clearly good old protosw does not work for protocol #4 and #41. 55 * The code will let you match protocol via src/dst address pair. 56 */ 57 /* XXX is M_NETADDR correct? */ 58 59 /* 60 * With USE_RADIX the code will use radix table for tunnel lookup, for 61 * tunnels registered with encap_attach() with a addr/mask pair. 62 * Faster on machines with thousands of tunnel registerations (= interfaces). 63 * 64 * The code assumes that radix table code can handle non-continuous netmask, 65 * as it will pass radix table memory region with (src + dst) sockaddr pair. 66 * 67 * FreeBSD is excluded here as they make max_keylen a static variable, and 68 * thus forbid definition of radix table other than proper domains. 69 * 70 * !!!!!!! 71 * !!NOTE: dom_maxrtkey assumes USE_RADIX is defined. 72 * !!!!!!! 73 */ 74 #define USE_RADIX 75 76 #include <sys/cdefs.h> 77 __KERNEL_RCSID(0, "$NetBSD: ip_encap.c,v 1.39 2011/07/17 20:54:53 joerg Exp $"); 78 79 #include "opt_mrouting.h" 80 #include "opt_inet.h" 81 82 #include <sys/param.h> 83 #include <sys/systm.h> 84 #include <sys/socket.h> 85 #include <sys/sockio.h> 86 #include <sys/mbuf.h> 87 #include <sys/errno.h> 88 #include <sys/protosw.h> 89 #include <sys/queue.h> 90 91 #include <net/if.h> 92 #include <net/route.h> 93 94 #include <netinet/in.h> 95 #include <netinet/in_systm.h> 96 #include <netinet/ip.h> 97 #include <netinet/ip_var.h> 98 #include <netinet/ip_encap.h> 99 #ifdef MROUTING 100 #include <netinet/ip_mroute.h> 101 #endif /* MROUTING */ 102 103 #ifdef INET6 104 #include <netinet/ip6.h> 105 #include <netinet6/ip6_var.h> 106 #include <netinet6/ip6protosw.h> 107 #include <netinet6/in6_var.h> 108 #include <netinet6/in6_pcb.h> 109 #include <netinet/icmp6.h> 110 #endif 111 112 #include <net/net_osdep.h> 113 114 enum direction { INBOUND, OUTBOUND }; 115 116 #ifdef INET 117 static struct encaptab *encap4_lookup(struct mbuf *, int, int, enum direction); 118 #endif 119 #ifdef INET6 120 static struct encaptab *encap6_lookup(struct mbuf *, int, int, enum direction); 121 #endif 122 static int encap_add(struct encaptab *); 123 static int encap_remove(struct encaptab *); 124 static int encap_afcheck(int, const struct sockaddr *, const struct sockaddr *); 125 #ifdef USE_RADIX 126 static struct radix_node_head *encap_rnh(int); 127 static int mask_matchlen(const struct sockaddr *); 128 #endif 129 #ifndef USE_RADIX 130 static int mask_match(const struct encaptab *, const struct sockaddr *, 131 const struct sockaddr *); 132 #endif 133 static void encap_fillarg(struct mbuf *, const struct encaptab *); 134 135 LIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(&encaptab); 136 137 #ifdef USE_RADIX 138 extern int max_keylen; /* radix.c */ 139 struct radix_node_head *encap_head[2]; /* 0 for AF_INET, 1 for AF_INET6 */ 140 #endif 141 142 void 143 encap_init(void) 144 { 145 static int initialized = 0; 146 147 if (initialized) 148 return; 149 initialized++; 150 #if 0 151 /* 152 * we cannot use LIST_INIT() here, since drivers may want to call 153 * encap_attach(), on driver attach. encap_init() will be called 154 * on AF_INET{,6} initialization, which happens after driver 155 * initialization - using LIST_INIT() here can nuke encap_attach() 156 * from drivers. 157 */ 158 LIST_INIT(&encaptab); 159 #endif 160 161 #ifdef USE_RADIX 162 /* 163 * initialize radix lookup table when the radix subsystem is inited. 164 */ 165 rn_delayedinit((void *)&encap_head[0], 166 sizeof(struct sockaddr_pack) << 3); 167 #ifdef INET6 168 rn_delayedinit((void *)&encap_head[1], 169 sizeof(struct sockaddr_pack) << 3); 170 #endif 171 #endif 172 } 173 174 #ifdef INET 175 static struct encaptab * 176 encap4_lookup(struct mbuf *m, int off, int proto, enum direction dir) 177 { 178 struct ip *ip; 179 struct ip_pack4 pack; 180 struct encaptab *ep, *match; 181 int prio, matchprio; 182 #ifdef USE_RADIX 183 struct radix_node_head *rnh = encap_rnh(AF_INET); 184 struct radix_node *rn; 185 #endif 186 187 #ifdef DIAGNOSTIC 188 if (m->m_len < sizeof(*ip)) 189 panic("encap4_lookup"); 190 #endif 191 ip = mtod(m, struct ip *); 192 193 memset(&pack, 0, sizeof(pack)); 194 pack.p.sp_len = sizeof(pack); 195 pack.mine.sin_family = pack.yours.sin_family = AF_INET; 196 pack.mine.sin_len = pack.yours.sin_len = sizeof(struct sockaddr_in); 197 if (dir == INBOUND) { 198 pack.mine.sin_addr = ip->ip_dst; 199 pack.yours.sin_addr = ip->ip_src; 200 } else { 201 pack.mine.sin_addr = ip->ip_src; 202 pack.yours.sin_addr = ip->ip_dst; 203 } 204 205 match = NULL; 206 matchprio = 0; 207 208 #ifdef USE_RADIX 209 rn = rnh->rnh_matchaddr((void *)&pack, rnh); 210 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 211 match = (struct encaptab *)rn; 212 matchprio = mask_matchlen(match->srcmask) + 213 mask_matchlen(match->dstmask); 214 } 215 #endif 216 217 LIST_FOREACH(ep, &encaptab, chain) { 218 if (ep->af != AF_INET) 219 continue; 220 if (ep->proto >= 0 && ep->proto != proto) 221 continue; 222 if (ep->func) 223 prio = (*ep->func)(m, off, proto, ep->arg); 224 else { 225 #ifdef USE_RADIX 226 continue; 227 #else 228 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 229 (struct sockaddr *)&pack.yours); 230 #endif 231 } 232 233 /* 234 * We prioritize the matches by using bit length of the 235 * matches. mask_match() and user-supplied matching function 236 * should return the bit length of the matches (for example, 237 * if both src/dst are matched for IPv4, 64 should be returned). 238 * 0 or negative return value means "it did not match". 239 * 240 * The question is, since we have two "mask" portion, we 241 * cannot really define total order between entries. 242 * For example, which of these should be preferred? 243 * mask_match() returns 48 (32 + 16) for both of them. 244 * src=3ffe::/16, dst=3ffe:501::/32 245 * src=3ffe:501::/32, dst=3ffe::/16 246 * 247 * We need to loop through all the possible candidates 248 * to get the best match - the search takes O(n) for 249 * n attachments (i.e. interfaces). 250 * 251 * For radix-based lookup, I guess source takes precedence. 252 * See rn_{refines,lexobetter} for the correct answer. 253 */ 254 if (prio <= 0) 255 continue; 256 if (prio > matchprio) { 257 matchprio = prio; 258 match = ep; 259 } 260 } 261 262 return match; 263 #undef s 264 #undef d 265 } 266 267 void 268 encap4_input(struct mbuf *m, ...) 269 { 270 int off, proto; 271 va_list ap; 272 const struct protosw *psw; 273 struct encaptab *match; 274 275 va_start(ap, m); 276 off = va_arg(ap, int); 277 proto = va_arg(ap, int); 278 va_end(ap); 279 280 match = encap4_lookup(m, off, proto, INBOUND); 281 282 if (match) { 283 /* found a match, "match" has the best one */ 284 psw = match->psw; 285 if (psw && psw->pr_input) { 286 encap_fillarg(m, match); 287 (*psw->pr_input)(m, off, proto); 288 } else 289 m_freem(m); 290 return; 291 } 292 293 /* last resort: inject to raw socket */ 294 rip_input(m, off, proto); 295 } 296 #endif 297 298 #ifdef INET6 299 static struct encaptab * 300 encap6_lookup(struct mbuf *m, int off, int proto, enum direction dir) 301 { 302 struct ip6_hdr *ip6; 303 struct ip_pack6 pack; 304 int prio, matchprio; 305 struct encaptab *ep, *match; 306 #ifdef USE_RADIX 307 struct radix_node_head *rnh = encap_rnh(AF_INET6); 308 struct radix_node *rn; 309 #endif 310 311 #ifdef DIAGNOSTIC 312 if (m->m_len < sizeof(*ip6)) 313 panic("encap6_lookup"); 314 #endif 315 ip6 = mtod(m, struct ip6_hdr *); 316 317 memset(&pack, 0, sizeof(pack)); 318 pack.p.sp_len = sizeof(pack); 319 pack.mine.sin6_family = pack.yours.sin6_family = AF_INET6; 320 pack.mine.sin6_len = pack.yours.sin6_len = sizeof(struct sockaddr_in6); 321 if (dir == INBOUND) { 322 pack.mine.sin6_addr = ip6->ip6_dst; 323 pack.yours.sin6_addr = ip6->ip6_src; 324 } else { 325 pack.mine.sin6_addr = ip6->ip6_src; 326 pack.yours.sin6_addr = ip6->ip6_dst; 327 } 328 329 match = NULL; 330 matchprio = 0; 331 332 #ifdef USE_RADIX 333 rn = rnh->rnh_matchaddr((void *)&pack, rnh); 334 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 335 match = (struct encaptab *)rn; 336 matchprio = mask_matchlen(match->srcmask) + 337 mask_matchlen(match->dstmask); 338 } 339 #endif 340 341 LIST_FOREACH(ep, &encaptab, chain) { 342 if (ep->af != AF_INET6) 343 continue; 344 if (ep->proto >= 0 && ep->proto != proto) 345 continue; 346 if (ep->func) 347 prio = (*ep->func)(m, off, proto, ep->arg); 348 else { 349 #ifdef USE_RADIX 350 continue; 351 #else 352 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 353 (struct sockaddr *)&pack.yours); 354 #endif 355 } 356 357 /* see encap4_lookup() for issues here */ 358 if (prio <= 0) 359 continue; 360 if (prio > matchprio) { 361 matchprio = prio; 362 match = ep; 363 } 364 } 365 366 return match; 367 #undef s 368 #undef d 369 } 370 371 int 372 encap6_input(struct mbuf **mp, int *offp, int proto) 373 { 374 struct mbuf *m = *mp; 375 const struct ip6protosw *psw; 376 struct encaptab *match; 377 378 match = encap6_lookup(m, *offp, proto, INBOUND); 379 380 if (match) { 381 /* found a match */ 382 psw = (const struct ip6protosw *)match->psw; 383 if (psw && psw->pr_input) { 384 encap_fillarg(m, match); 385 return (*psw->pr_input)(mp, offp, proto); 386 } else { 387 m_freem(m); 388 return IPPROTO_DONE; 389 } 390 } 391 392 /* last resort: inject to raw socket */ 393 return rip6_input(mp, offp, proto); 394 } 395 #endif 396 397 static int 398 encap_add(struct encaptab *ep) 399 { 400 #ifdef USE_RADIX 401 struct radix_node_head *rnh = encap_rnh(ep->af); 402 #endif 403 int error = 0; 404 405 LIST_INSERT_HEAD(&encaptab, ep, chain); 406 #ifdef USE_RADIX 407 if (!ep->func && rnh) { 408 if (!rnh->rnh_addaddr((void *)ep->addrpack, 409 (void *)ep->maskpack, rnh, ep->nodes)) { 410 error = EEXIST; 411 goto fail; 412 } 413 } 414 #endif 415 return error; 416 417 fail: 418 LIST_REMOVE(ep, chain); 419 return error; 420 } 421 422 static int 423 encap_remove(struct encaptab *ep) 424 { 425 #ifdef USE_RADIX 426 struct radix_node_head *rnh = encap_rnh(ep->af); 427 #endif 428 int error = 0; 429 430 LIST_REMOVE(ep, chain); 431 #ifdef USE_RADIX 432 if (!ep->func && rnh) { 433 if (!rnh->rnh_deladdr((void *)ep->addrpack, 434 (void *)ep->maskpack, rnh)) 435 error = ESRCH; 436 } 437 #endif 438 return error; 439 } 440 441 static int 442 encap_afcheck(int af, const struct sockaddr *sp, const struct sockaddr *dp) 443 { 444 if (sp && dp) { 445 if (sp->sa_len != dp->sa_len) 446 return EINVAL; 447 if (af != sp->sa_family || af != dp->sa_family) 448 return EINVAL; 449 } else if (!sp && !dp) 450 ; 451 else 452 return EINVAL; 453 454 switch (af) { 455 case AF_INET: 456 if (sp && sp->sa_len != sizeof(struct sockaddr_in)) 457 return EINVAL; 458 if (dp && dp->sa_len != sizeof(struct sockaddr_in)) 459 return EINVAL; 460 break; 461 #ifdef INET6 462 case AF_INET6: 463 if (sp && sp->sa_len != sizeof(struct sockaddr_in6)) 464 return EINVAL; 465 if (dp && dp->sa_len != sizeof(struct sockaddr_in6)) 466 return EINVAL; 467 break; 468 #endif 469 default: 470 return EAFNOSUPPORT; 471 } 472 473 return 0; 474 } 475 476 /* 477 * sp (src ptr) is always my side, and dp (dst ptr) is always remote side. 478 * length of mask (sm and dm) is assumed to be same as sp/dp. 479 * Return value will be necessary as input (cookie) for encap_detach(). 480 */ 481 const struct encaptab * 482 encap_attach(int af, int proto, 483 const struct sockaddr *sp, const struct sockaddr *sm, 484 const struct sockaddr *dp, const struct sockaddr *dm, 485 const struct protosw *psw, void *arg) 486 { 487 struct encaptab *ep; 488 int error; 489 int s; 490 size_t l; 491 struct ip_pack4 *pack4; 492 #ifdef INET6 493 struct ip_pack6 *pack6; 494 #endif 495 496 s = splsoftnet(); 497 /* sanity check on args */ 498 error = encap_afcheck(af, sp, dp); 499 if (error) 500 goto fail; 501 502 /* check if anyone have already attached with exactly same config */ 503 LIST_FOREACH(ep, &encaptab, chain) { 504 if (ep->af != af) 505 continue; 506 if (ep->proto != proto) 507 continue; 508 if (ep->func) 509 continue; 510 #ifdef DIAGNOSTIC 511 if (!ep->src || !ep->dst || !ep->srcmask || !ep->dstmask) 512 panic("null pointers in encaptab"); 513 #endif 514 if (ep->src->sa_len != sp->sa_len || 515 memcmp(ep->src, sp, sp->sa_len) != 0 || 516 memcmp(ep->srcmask, sm, sp->sa_len) != 0) 517 continue; 518 if (ep->dst->sa_len != dp->sa_len || 519 memcmp(ep->dst, dp, dp->sa_len) != 0 || 520 memcmp(ep->dstmask, dm, dp->sa_len) != 0) 521 continue; 522 523 error = EEXIST; 524 goto fail; 525 } 526 527 switch (af) { 528 case AF_INET: 529 l = sizeof(*pack4); 530 break; 531 #ifdef INET6 532 case AF_INET6: 533 l = sizeof(*pack6); 534 break; 535 #endif 536 default: 537 goto fail; 538 } 539 540 /* M_NETADDR ok? */ 541 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT|M_ZERO); 542 if (ep == NULL) { 543 error = ENOBUFS; 544 goto fail; 545 } 546 ep->addrpack = malloc(l, M_NETADDR, M_NOWAIT|M_ZERO); 547 if (ep->addrpack == NULL) { 548 error = ENOBUFS; 549 goto gc; 550 } 551 ep->maskpack = malloc(l, M_NETADDR, M_NOWAIT|M_ZERO); 552 if (ep->maskpack == NULL) { 553 error = ENOBUFS; 554 goto gc; 555 } 556 557 ep->af = af; 558 ep->proto = proto; 559 ep->addrpack->sa_len = l & 0xff; 560 ep->maskpack->sa_len = l & 0xff; 561 switch (af) { 562 case AF_INET: 563 pack4 = (struct ip_pack4 *)ep->addrpack; 564 ep->src = (struct sockaddr *)&pack4->mine; 565 ep->dst = (struct sockaddr *)&pack4->yours; 566 pack4 = (struct ip_pack4 *)ep->maskpack; 567 ep->srcmask = (struct sockaddr *)&pack4->mine; 568 ep->dstmask = (struct sockaddr *)&pack4->yours; 569 break; 570 #ifdef INET6 571 case AF_INET6: 572 pack6 = (struct ip_pack6 *)ep->addrpack; 573 ep->src = (struct sockaddr *)&pack6->mine; 574 ep->dst = (struct sockaddr *)&pack6->yours; 575 pack6 = (struct ip_pack6 *)ep->maskpack; 576 ep->srcmask = (struct sockaddr *)&pack6->mine; 577 ep->dstmask = (struct sockaddr *)&pack6->yours; 578 break; 579 #endif 580 } 581 582 memcpy(ep->src, sp, sp->sa_len); 583 memcpy(ep->srcmask, sm, sp->sa_len); 584 memcpy(ep->dst, dp, dp->sa_len); 585 memcpy(ep->dstmask, dm, dp->sa_len); 586 ep->psw = psw; 587 ep->arg = arg; 588 589 error = encap_add(ep); 590 if (error) 591 goto gc; 592 593 error = 0; 594 splx(s); 595 return ep; 596 597 gc: 598 if (ep->addrpack) 599 free(ep->addrpack, M_NETADDR); 600 if (ep->maskpack) 601 free(ep->maskpack, M_NETADDR); 602 if (ep) 603 free(ep, M_NETADDR); 604 fail: 605 splx(s); 606 return NULL; 607 } 608 609 const struct encaptab * 610 encap_attach_func(int af, int proto, 611 int (*func)(struct mbuf *, int, int, void *), 612 const struct protosw *psw, void *arg) 613 { 614 struct encaptab *ep; 615 int error; 616 int s; 617 618 s = splsoftnet(); 619 /* sanity check on args */ 620 if (!func) { 621 error = EINVAL; 622 goto fail; 623 } 624 625 error = encap_afcheck(af, NULL, NULL); 626 if (error) 627 goto fail; 628 629 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /*XXX*/ 630 if (ep == NULL) { 631 error = ENOBUFS; 632 goto fail; 633 } 634 memset(ep, 0, sizeof(*ep)); 635 636 ep->af = af; 637 ep->proto = proto; 638 ep->func = func; 639 ep->psw = psw; 640 ep->arg = arg; 641 642 error = encap_add(ep); 643 if (error) 644 goto fail; 645 646 error = 0; 647 splx(s); 648 return ep; 649 650 fail: 651 splx(s); 652 return NULL; 653 } 654 655 /* XXX encap4_ctlinput() is necessary if we set DF=1 on outer IPv4 header */ 656 657 #ifdef INET6 658 void * 659 encap6_ctlinput(int cmd, const struct sockaddr *sa, void *d0) 660 { 661 void *d = d0; 662 struct ip6_hdr *ip6; 663 struct mbuf *m; 664 int off; 665 struct ip6ctlparam *ip6cp = NULL; 666 int nxt; 667 struct encaptab *ep; 668 const struct ip6protosw *psw; 669 670 if (sa->sa_family != AF_INET6 || 671 sa->sa_len != sizeof(struct sockaddr_in6)) 672 return NULL; 673 674 if ((unsigned)cmd >= PRC_NCMDS) 675 return NULL; 676 if (cmd == PRC_HOSTDEAD) 677 d = NULL; 678 else if (cmd == PRC_MSGSIZE) 679 ; /* special code is present, see below */ 680 else if (inet6ctlerrmap[cmd] == 0) 681 return NULL; 682 683 /* if the parameter is from icmp6, decode it. */ 684 if (d != NULL) { 685 ip6cp = (struct ip6ctlparam *)d; 686 m = ip6cp->ip6c_m; 687 ip6 = ip6cp->ip6c_ip6; 688 off = ip6cp->ip6c_off; 689 nxt = ip6cp->ip6c_nxt; 690 691 if (ip6 && cmd == PRC_MSGSIZE) { 692 int valid = 0; 693 struct encaptab *match; 694 695 /* 696 * Check to see if we have a valid encap configuration. 697 */ 698 match = encap6_lookup(m, off, nxt, OUTBOUND); 699 if (match) 700 valid++; 701 702 /* 703 * Depending on the value of "valid" and routing table 704 * size (mtudisc_{hi,lo}wat), we will: 705 * - recalcurate the new MTU and create the 706 * corresponding routing entry, or 707 * - ignore the MTU change notification. 708 */ 709 icmp6_mtudisc_update((struct ip6ctlparam *)d, valid); 710 } 711 } else { 712 m = NULL; 713 ip6 = NULL; 714 nxt = -1; 715 } 716 717 /* inform all listeners */ 718 LIST_FOREACH(ep, &encaptab, chain) { 719 if (ep->af != AF_INET6) 720 continue; 721 if (ep->proto >= 0 && ep->proto != nxt) 722 continue; 723 724 /* should optimize by looking at address pairs */ 725 726 /* XXX need to pass ep->arg or ep itself to listeners */ 727 psw = (const struct ip6protosw *)ep->psw; 728 if (psw && psw->pr_ctlinput) 729 (*psw->pr_ctlinput)(cmd, sa, d); 730 } 731 732 rip6_ctlinput(cmd, sa, d0); 733 return NULL; 734 } 735 #endif 736 737 int 738 encap_detach(const struct encaptab *cookie) 739 { 740 const struct encaptab *ep = cookie; 741 struct encaptab *p; 742 int error; 743 744 LIST_FOREACH(p, &encaptab, chain) { 745 if (p == ep) { 746 error = encap_remove(p); 747 if (error) 748 return error; 749 if (!ep->func) { 750 free(p->addrpack, M_NETADDR); 751 free(p->maskpack, M_NETADDR); 752 } 753 free(p, M_NETADDR); /*XXX*/ 754 return 0; 755 } 756 } 757 758 return ENOENT; 759 } 760 761 #ifdef USE_RADIX 762 static struct radix_node_head * 763 encap_rnh(int af) 764 { 765 766 switch (af) { 767 case AF_INET: 768 return encap_head[0]; 769 #ifdef INET6 770 case AF_INET6: 771 return encap_head[1]; 772 #endif 773 default: 774 return NULL; 775 } 776 } 777 778 static int 779 mask_matchlen(const struct sockaddr *sa) 780 { 781 const char *p, *ep; 782 int l; 783 784 p = (const char *)sa; 785 ep = p + sa->sa_len; 786 p += 2; /* sa_len + sa_family */ 787 788 l = 0; 789 while (p < ep) { 790 l += (*p ? 8 : 0); /* estimate */ 791 p++; 792 } 793 return l; 794 } 795 #endif 796 797 #ifndef USE_RADIX 798 static int 799 mask_match(const struct encaptab *ep, 800 const struct sockaddr *sp, 801 const struct sockaddr *dp) 802 { 803 struct sockaddr_storage s; 804 struct sockaddr_storage d; 805 int i; 806 const u_int8_t *p, *q; 807 u_int8_t *r; 808 int matchlen; 809 810 #ifdef DIAGNOSTIC 811 if (ep->func) 812 panic("wrong encaptab passed to mask_match"); 813 #endif 814 if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) 815 return 0; 816 if (sp->sa_family != ep->af || dp->sa_family != ep->af) 817 return 0; 818 if (sp->sa_len != ep->src->sa_len || dp->sa_len != ep->dst->sa_len) 819 return 0; 820 821 matchlen = 0; 822 823 p = (const u_int8_t *)sp; 824 q = (const u_int8_t *)ep->srcmask; 825 r = (u_int8_t *)&s; 826 for (i = 0 ; i < sp->sa_len; i++) { 827 r[i] = p[i] & q[i]; 828 /* XXX estimate */ 829 matchlen += (q[i] ? 8 : 0); 830 } 831 832 p = (const u_int8_t *)dp; 833 q = (const u_int8_t *)ep->dstmask; 834 r = (u_int8_t *)&d; 835 for (i = 0 ; i < dp->sa_len; i++) { 836 r[i] = p[i] & q[i]; 837 /* XXX rough estimate */ 838 matchlen += (q[i] ? 8 : 0); 839 } 840 841 /* need to overwrite len/family portion as we don't compare them */ 842 s.ss_len = sp->sa_len; 843 s.ss_family = sp->sa_family; 844 d.ss_len = dp->sa_len; 845 d.ss_family = dp->sa_family; 846 847 if (memcmp(&s, ep->src, ep->src->sa_len) == 0 && 848 memcmp(&d, ep->dst, ep->dst->sa_len) == 0) { 849 return matchlen; 850 } else 851 return 0; 852 } 853 #endif 854 855 static void 856 encap_fillarg(struct mbuf *m, const struct encaptab *ep) 857 { 858 struct m_tag *mtag; 859 860 mtag = m_tag_get(PACKET_TAG_ENCAP, sizeof(void *), M_NOWAIT); 861 if (mtag) { 862 *(void **)(mtag + 1) = ep->arg; 863 m_tag_prepend(m, mtag); 864 } 865 } 866 867 void * 868 encap_getarg(struct mbuf *m) 869 { 870 void *p; 871 struct m_tag *mtag; 872 873 p = NULL; 874 mtag = m_tag_find(m, PACKET_TAG_ENCAP, NULL); 875 if (mtag != NULL) { 876 p = *(void **)(mtag + 1); 877 m_tag_delete(m, mtag); 878 } 879 return p; 880 } 881
Indexes created Tue Oct 07 21:09:53 GMT 2025