Home | History | Annotate | Line # | Download | only in netinet
ip_encap.c revision 1.4.2.2 
      1 /*	$NetBSD: ip_encap.c,v 1.4.2.2 2000/11/20 18:10:25 bouyer Exp $	*/
      2 /*	$KAME: ip_encap.c,v 1.39 2000/10/01 12:37:18 itojun Exp $	*/
      3 
      4 /*
      5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. Neither the name of the project nor the names of its contributors
     17  *    may be used to endorse or promote products derived from this software
     18  *    without specific prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     30  * SUCH DAMAGE.
     31  */
     32 /*
     33  * My grandfather said that there's a devil inside tunnelling technology...
     34  *
     35  * We have surprisingly many protocols that want packets with IP protocol
     36  * #4 or #41.  Here's a list of protocols that want protocol #41:
     37  *	RFC1933 configured tunnel
     38  *	RFC1933 automatic tunnel
     39  *	RFC2401 IPsec tunnel
     40  *	RFC2473 IPv6 generic packet tunnelling
     41  *	RFC2529 6over4 tunnel
     42  *	mobile-ip6 (uses RFC2473)
     43  *	6to4 tunnel
     44  * Here's a list of protocol that want protocol #4:
     45  *	RFC1853 IPv4-in-IPv4 tunnelling
     46  *	RFC2003 IPv4 encapsulation within IPv4
     47  *	RFC2344 reverse tunnelling for mobile-ip4
     48  *	RFC2401 IPsec tunnel
     49  * Well, what can I say.  They impose different en/decapsulation mechanism
     50  * from each other, so they need separate protocol handler.  The only one
     51  * we can easily determine by protocol # is IPsec, which always has
     52  * AH/ESP/IPComp header right after outer IP header.
     53  *
     54  * So, clearly good old protosw does not work for protocol #4 and #41.
     55  * The code will let you match protocol via src/dst address pair.
     56  */
     57 /* XXX is M_NETADDR correct? */
     58 
     59 #include "opt_mrouting.h"
     60 #include "opt_inet.h"
     61 
     62 #include <sys/param.h>
     63 #include <sys/systm.h>
     64 #include <sys/socket.h>
     65 #include <sys/sockio.h>
     66 #include <sys/mbuf.h>
     67 #include <sys/errno.h>
     68 #include <sys/protosw.h>
     69 #include <sys/queue.h>
     70 
     71 #include <net/if.h>
     72 #include <net/route.h>
     73 
     74 #include <netinet/in.h>
     75 #include <netinet/in_systm.h>
     76 #include <netinet/ip.h>
     77 #include <netinet/ip_var.h>
     78 #include <netinet/ip_encap.h>
     79 #ifdef MROUTING
     80 #include <netinet/ip_mroute.h>
     81 #endif /* MROUTING */
     82 
     83 #ifdef INET6
     84 #include <netinet/ip6.h>
     85 #include <netinet6/ip6_var.h>
     86 #include <netinet6/ip6protosw.h>
     87 #endif
     88 
     89 #include <machine/stdarg.h>
     90 
     91 #include "ipip.h"
     92 #if NIPIP > 0
     93 # include <netinet/ip_ipip.h>
     94 #else
     95 # ifdef MROUTING
     96 #  include <netinet/ip_mroute.h>
     97 # endif
     98 #endif
     99 
    100 #include <net/net_osdep.h>
    101 
    102 static void encap_add __P((struct encaptab *));
    103 static int mask_match __P((const struct encaptab *, const struct sockaddr *,
    104 		const struct sockaddr *));
    105 static void encap_fillarg __P((struct mbuf *, const struct encaptab *));
    106 
    107 /* rely upon BSS initialization */
    108 LIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(&encaptab);
    109 
    110 void
    111 encap_init()
    112 {
    113 #if 0
    114 	/*
    115 	 * we cannot use LIST_INIT() here, since drivers may want to call
    116 	 * encap_attach(), on driver attach.  encap_init() will be called
    117 	 * on AF_INET{,6} initialization, which happens after driver
    118 	 * initialization - using LIST_INIT() here can nuke encap_attach()
    119 	 * from drivers.
    120 	 */
    121 	LIST_INIT(&encaptab);
    122 #endif
    123 }
    124 
    125 #ifdef INET
    126 void
    127 #if __STDC__
    128 encap4_input(struct mbuf *m, ...)
    129 #else
    130 encap4_input(m, va_alist)
    131 	struct mbuf *m;
    132 	va_dcl
    133 #endif
    134 {
    135 	int off, proto;
    136 	struct ip *ip;
    137 	struct sockaddr_in s, d;
    138 	const struct protosw *psw;
    139 	struct encaptab *ep, *match;
    140 	va_list ap;
    141 	int prio, matchprio;
    142 
    143 	va_start(ap, m);
    144 	off = va_arg(ap, int);
    145 	proto = va_arg(ap, int);
    146 	va_end(ap);
    147 
    148 	ip = mtod(m, struct ip *);
    149 
    150 	bzero(&s, sizeof(s));
    151 	s.sin_family = AF_INET;
    152 	s.sin_len = sizeof(struct sockaddr_in);
    153 	s.sin_addr = ip->ip_src;
    154 	bzero(&d, sizeof(d));
    155 	d.sin_family = AF_INET;
    156 	d.sin_len = sizeof(struct sockaddr_in);
    157 	d.sin_addr = ip->ip_dst;
    158 
    159 	match = NULL;
    160 	matchprio = 0;
    161 	for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) {
    162 		if (ep->af != AF_INET)
    163 			continue;
    164 		if (ep->proto >= 0 && ep->proto != proto)
    165 			continue;
    166 		if (ep->func)
    167 			prio = (*ep->func)(m, off, proto, ep->arg);
    168 		else {
    169 			/*
    170 			 * it's inbound traffic, we need to match in reverse
    171 			 * order
    172 			 */
    173 			prio = mask_match(ep, (struct sockaddr *)&d,
    174 			    (struct sockaddr *)&s);
    175 		}
    176 
    177 		/*
    178 		 * We prioritize the matches by using bit length of the
    179 		 * matches.  mask_match() and user-supplied matching function
    180 		 * should return the bit length of the matches (for example,
    181 		 * if both src/dst are matched for IPv4, 64 should be returned).
    182 		 * 0 or negative return value means "it did not match".
    183 		 *
    184 		 * The question is, since we have two "mask" portion, we
    185 		 * cannot really define total order between entries.
    186 		 * For example, which of these should be preferred?
    187 		 * mask_match() returns 48 (32 + 16) for both of them.
    188 		 *	src=3ffe::/16, dst=3ffe:501::/32
    189 		 *	src=3ffe:501::/32, dst=3ffe::/16
    190 		 *
    191 		 * We need to loop through all the possible candidates
    192 		 * to get the best match - the search takes O(n) for
    193 		 * n attachments (i.e. interfaces).
    194 		 */
    195 		if (prio <= 0)
    196 			continue;
    197 		if (prio > matchprio) {
    198 			matchprio = prio;
    199 			match = ep;
    200 		}
    201 	}
    202 
    203 	if (match) {
    204 		/* found a match, "match" has the best one */
    205 		psw = match->psw;
    206 		if (psw && psw->pr_input) {
    207 			encap_fillarg(m, match);
    208 			(*psw->pr_input)(m, off, proto);
    209 		} else
    210 			m_freem(m);
    211 		return;
    212 	}
    213 
    214 	/* for backward compatibility */
    215 #ifdef MROUTING
    216 	if (proto == IPPROTO_IPV4 && mrt_ipip_input(m, off)) {
    217 		/*
    218 		 * Multicast routing code claimed this one.  No
    219 		 * more processing at this level.
    220 		 */
    221   		return;
    222 	}
    223 #endif
    224 
    225 	/* last resort: inject to raw socket */
    226 	rip_input(m, off, proto);
    227 }
    228 #endif
    229 
    230 #ifdef INET6
    231 int
    232 encap6_input(mp, offp, proto)
    233 	struct mbuf **mp;
    234 	int *offp;
    235 	int proto;
    236 {
    237 	struct mbuf *m = *mp;
    238 	struct ip6_hdr *ip6;
    239 	struct sockaddr_in6 s, d;
    240 	const struct ip6protosw *psw;
    241 	struct encaptab *ep, *match;
    242 	int prio, matchprio;
    243 
    244 	ip6 = mtod(m, struct ip6_hdr *);
    245 
    246 	bzero(&s, sizeof(s));
    247 	s.sin6_family = AF_INET6;
    248 	s.sin6_len = sizeof(struct sockaddr_in6);
    249 	s.sin6_addr = ip6->ip6_src;
    250 	bzero(&d, sizeof(d));
    251 	d.sin6_family = AF_INET6;
    252 	d.sin6_len = sizeof(struct sockaddr_in6);
    253 	d.sin6_addr = ip6->ip6_dst;
    254 
    255 	match = NULL;
    256 	matchprio = 0;
    257 	for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) {
    258 		if (ep->af != AF_INET6)
    259 			continue;
    260 		if (ep->proto >= 0 && ep->proto != proto)
    261 			continue;
    262 		if (ep->func)
    263 			prio = (*ep->func)(m, *offp, proto, ep->arg);
    264 		else {
    265 			/*
    266 			 * it's inbound traffic, we need to match in reverse
    267 			 * order
    268 			 */
    269 			prio = mask_match(ep, (struct sockaddr *)&d,
    270 			    (struct sockaddr *)&s);
    271 		}
    272 
    273 		/* see encap4_input() for issues here */
    274 		if (prio <= 0)
    275 			continue;
    276 		if (prio > matchprio) {
    277 			matchprio = prio;
    278 			match = ep;
    279 		}
    280 	}
    281 
    282 	if (match) {
    283 		/* found a match */
    284 		psw = (const struct ip6protosw *)match->psw;
    285 		if (psw && psw->pr_input) {
    286 			encap_fillarg(m, match);
    287 			return (*psw->pr_input)(mp, offp, proto);
    288 		} else {
    289 			m_freem(m);
    290 			return IPPROTO_DONE;
    291 		}
    292 	}
    293 
    294 	/* last resort: inject to raw socket */
    295 	return rip6_input(mp, offp, proto);
    296 }
    297 #endif
    298 
    299 static void
    300 encap_add(ep)
    301 	struct encaptab *ep;
    302 {
    303 
    304 	LIST_INSERT_HEAD(&encaptab, ep, chain);
    305 }
    306 
    307 /*
    308  * sp (src ptr) is always my side, and dp (dst ptr) is always remote side.
    309  * length of mask (sm and dm) is assumed to be same as sp/dp.
    310  * Return value will be necessary as input (cookie) for encap_detach().
    311  */
    312 const struct encaptab *
    313 encap_attach(af, proto, sp, sm, dp, dm, psw, arg)
    314 	int af;
    315 	int proto;
    316 	const struct sockaddr *sp, *sm;
    317 	const struct sockaddr *dp, *dm;
    318 	const struct protosw *psw;
    319 	void *arg;
    320 {
    321 	struct encaptab *ep;
    322 	int error;
    323 	int s;
    324 
    325 	s = splsoftnet();
    326 	/* sanity check on args */
    327 	if (sp->sa_len > sizeof(ep->src) || dp->sa_len > sizeof(ep->dst)) {
    328 		error = EINVAL;
    329 		goto fail;
    330 	}
    331 	if (sp->sa_len != dp->sa_len) {
    332 		error = EINVAL;
    333 		goto fail;
    334 	}
    335 	if (af != sp->sa_family || af != dp->sa_family) {
    336 		error = EINVAL;
    337 		goto fail;
    338 	}
    339 
    340 	/* check if anyone have already attached with exactly same config */
    341 	for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) {
    342 		if (ep->af != af)
    343 			continue;
    344 		if (ep->proto != proto)
    345 			continue;
    346 		if (ep->src.ss_len != sp->sa_len ||
    347 		    bcmp(&ep->src, sp, sp->sa_len) != 0 ||
    348 		    bcmp(&ep->srcmask, sm, sp->sa_len) != 0)
    349 			continue;
    350 		if (ep->dst.ss_len != dp->sa_len ||
    351 		    bcmp(&ep->dst, dp, dp->sa_len) != 0 ||
    352 		    bcmp(&ep->dstmask, dm, dp->sa_len) != 0)
    353 			continue;
    354 
    355 		error = EEXIST;
    356 		goto fail;
    357 	}
    358 
    359 	/*
    360 	 * XXX NEED TO CHECK viftable IN THE ip_mroute CODE!!!
    361 	 * XXX Actually, that code needs to be replaced with
    362 	 * XXX new code that uses `gif' tunnels.
    363 	 */
    364 
    365 	ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT);	/*XXX*/
    366 	if (ep == NULL) {
    367 		error = ENOBUFS;
    368 		goto fail;
    369 	}
    370 	bzero(ep, sizeof(*ep));
    371 
    372 	ep->af = af;
    373 	ep->proto = proto;
    374 	bcopy(sp, &ep->src, sp->sa_len);
    375 	bcopy(sm, &ep->srcmask, sp->sa_len);
    376 	bcopy(dp, &ep->dst, dp->sa_len);
    377 	bcopy(dm, &ep->dstmask, dp->sa_len);
    378 	ep->psw = psw;
    379 	ep->arg = arg;
    380 
    381 	encap_add(ep);
    382 
    383 	error = 0;
    384 	splx(s);
    385 	return ep;
    386 
    387 fail:
    388 	splx(s);
    389 	return NULL;
    390 }
    391 
    392 const struct encaptab *
    393 encap_attach_func(af, proto, func, psw, arg)
    394 	int af;
    395 	int proto;
    396 	int (*func) __P((const struct mbuf *, int, int, void *));
    397 	const struct protosw *psw;
    398 	void *arg;
    399 {
    400 	struct encaptab *ep;
    401 	int error;
    402 	int s;
    403 
    404 	s = splsoftnet();
    405 	/* sanity check on args */
    406 	if (!func) {
    407 		error = EINVAL;
    408 		goto fail;
    409 	}
    410 
    411 	ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT);	/*XXX*/
    412 	if (ep == NULL) {
    413 		error = ENOBUFS;
    414 		goto fail;
    415 	}
    416 	bzero(ep, sizeof(*ep));
    417 
    418 	ep->af = af;
    419 	ep->proto = proto;
    420 	ep->func = func;
    421 	ep->psw = psw;
    422 	ep->arg = arg;
    423 
    424 	encap_add(ep);
    425 
    426 	error = 0;
    427 	splx(s);
    428 	return ep;
    429 
    430 fail:
    431 	splx(s);
    432 	return NULL;
    433 }
    434 
    435 int
    436 encap_detach(cookie)
    437 	const struct encaptab *cookie;
    438 {
    439 	const struct encaptab *ep = cookie;
    440 	struct encaptab *p;
    441 
    442 	for (p = LIST_FIRST(&encaptab); p; p = LIST_NEXT(p, chain)) {
    443 		if (p == ep) {
    444 			LIST_REMOVE(p, chain);
    445 			free(p, M_NETADDR);	/*XXX*/
    446 			return 0;
    447 		}
    448 	}
    449 
    450 	return EINVAL;
    451 }
    452 
    453 static int
    454 mask_match(ep, sp, dp)
    455 	const struct encaptab *ep;
    456 	const struct sockaddr *sp;
    457 	const struct sockaddr *dp;
    458 {
    459 	struct sockaddr_storage s;
    460 	struct sockaddr_storage d;
    461 	int i;
    462 	const u_int8_t *p, *q;
    463 	u_int8_t *r;
    464 	int matchlen;
    465 
    466 	if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d))
    467 		return 0;
    468 	if (sp->sa_family != ep->af || dp->sa_family != ep->af)
    469 		return 0;
    470 	if (sp->sa_len != ep->src.ss_len || dp->sa_len != ep->dst.ss_len)
    471 		return 0;
    472 
    473 	matchlen = 0;
    474 
    475 	p = (const u_int8_t *)sp;
    476 	q = (const u_int8_t *)&ep->srcmask;
    477 	r = (u_int8_t *)&s;
    478 	for (i = 0 ; i < sp->sa_len; i++) {
    479 		r[i] = p[i] & q[i];
    480 		/* XXX estimate */
    481 		matchlen += (q[i] ? 8 : 0);
    482 	}
    483 
    484 	p = (const u_int8_t *)dp;
    485 	q = (const u_int8_t *)&ep->dstmask;
    486 	r = (u_int8_t *)&d;
    487 	for (i = 0 ; i < dp->sa_len; i++) {
    488 		r[i] = p[i] & q[i];
    489 		/* XXX rough estimate */
    490 		matchlen += (q[i] ? 8 : 0);
    491 	}
    492 
    493 	/* need to overwrite len/family portion as we don't compare them */
    494 	s.ss_len = sp->sa_len;
    495 	s.ss_family = sp->sa_family;
    496 	d.ss_len = dp->sa_len;
    497 	d.ss_family = dp->sa_family;
    498 
    499 	if (bcmp(&s, &ep->src, ep->src.ss_len) == 0 &&
    500 	    bcmp(&d, &ep->dst, ep->dst.ss_len) == 0) {
    501 		return matchlen;
    502 	} else
    503 		return 0;
    504 }
    505 
    506 static void
    507 encap_fillarg(m, ep)
    508 	struct mbuf *m;
    509 	const struct encaptab *ep;
    510 {
    511 #if 0
    512 	m->m_pkthdr.aux = ep->arg;
    513 #else
    514 	struct mbuf *n;
    515 
    516 	n = m_aux_add(m, AF_INET, IPPROTO_IPV4);
    517 	if (n) {
    518 		*mtod(n, void **) = ep->arg;
    519 		n->m_len = sizeof(void *);
    520 	}
    521 #endif
    522 }
    523 
    524 void *
    525 encap_getarg(m)
    526 	struct mbuf *m;
    527 {
    528 	void *p;
    529 #if 0
    530 	p = m->m_pkthdr.aux;
    531 	m->m_pkthdr.aux = NULL;
    532 	return p;
    533 #else
    534 	struct mbuf *n;
    535 
    536 	p = NULL;
    537 	n = m_aux_find(m, AF_INET, IPPROTO_IPV4);
    538 	if (n) {
    539 		if (n->m_len == sizeof(void *))
    540 			p = *mtod(n, void **);
    541 		m_aux_delete(m, n);
    542 	}
    543 	return p;
    544 #endif
    545 }
    546