ip_encap.c revision 1.43
1 /* $NetBSD: ip_encap.c,v 1.43 2015/04/15 13:02:16 riastradh Exp $ */ 2 /* $KAME: ip_encap.c,v 1.73 2001/10/02 08:30:58 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 /* 33 * My grandfather said that there's a devil inside tunnelling technology... 34 * 35 * We have surprisingly many protocols that want packets with IP protocol 36 * #4 or #41. Here's a list of protocols that want protocol #41: 37 * RFC1933 configured tunnel 38 * RFC1933 automatic tunnel 39 * RFC2401 IPsec tunnel 40 * RFC2473 IPv6 generic packet tunnelling 41 * RFC2529 6over4 tunnel 42 * RFC3056 6to4 tunnel 43 * isatap tunnel 44 * mobile-ip6 (uses RFC2473) 45 * Here's a list of protocol that want protocol #4: 46 * RFC1853 IPv4-in-IPv4 tunnelling 47 * RFC2003 IPv4 encapsulation within IPv4 48 * RFC2344 reverse tunnelling for mobile-ip4 49 * RFC2401 IPsec tunnel 50 * Well, what can I say. They impose different en/decapsulation mechanism 51 * from each other, so they need separate protocol handler. The only one 52 * we can easily determine by protocol # is IPsec, which always has 53 * AH/ESP/IPComp header right after outer IP header. 54 * 55 * So, clearly good old protosw does not work for protocol #4 and #41. 56 * The code will let you match protocol via src/dst address pair. 57 */ 58 /* XXX is M_NETADDR correct? */ 59 60 /* 61 * With USE_RADIX the code will use radix table for tunnel lookup, for 62 * tunnels registered with encap_attach() with a addr/mask pair. 63 * Faster on machines with thousands of tunnel registerations (= interfaces). 64 * 65 * The code assumes that radix table code can handle non-continuous netmask, 66 * as it will pass radix table memory region with (src + dst) sockaddr pair. 67 * 68 * FreeBSD is excluded here as they make max_keylen a static variable, and 69 * thus forbid definition of radix table other than proper domains. 70 * 71 * !!!!!!! 72 * !!NOTE: dom_maxrtkey assumes USE_RADIX is defined. 73 * !!!!!!! 74 */ 75 #define USE_RADIX 76 77 #include <sys/cdefs.h> 78 __KERNEL_RCSID(0, "$NetBSD: ip_encap.c,v 1.43 2015/04/15 13:02:16 riastradh Exp $"); 79 80 #include "opt_mrouting.h" 81 #include "opt_inet.h" 82 83 #include <sys/param.h> 84 #include <sys/systm.h> 85 #include <sys/socket.h> 86 #include <sys/sockio.h> 87 #include <sys/mbuf.h> 88 #include <sys/errno.h> 89 #include <sys/protosw.h> 90 #include <sys/queue.h> 91 92 #include <net/if.h> 93 #include <net/route.h> 94 95 #include <netinet/in.h> 96 #include <netinet/in_systm.h> 97 #include <netinet/ip.h> 98 #include <netinet/ip_var.h> 99 #include <netinet/ip_encap.h> 100 #ifdef MROUTING 101 #include <netinet/ip_mroute.h> 102 #endif /* MROUTING */ 103 104 #ifdef INET6 105 #include <netinet/ip6.h> 106 #include <netinet6/ip6_var.h> 107 #include <netinet6/ip6protosw.h> 108 #include <netinet6/in6_var.h> 109 #include <netinet6/in6_pcb.h> 110 #include <netinet/icmp6.h> 111 #endif 112 113 #include <net/net_osdep.h> 114 115 enum direction { INBOUND, OUTBOUND }; 116 117 #ifdef INET 118 static struct encaptab *encap4_lookup(struct mbuf *, int, int, enum direction); 119 #endif 120 #ifdef INET6 121 static struct encaptab *encap6_lookup(struct mbuf *, int, int, enum direction); 122 #endif 123 static int encap_add(struct encaptab *); 124 static int encap_remove(struct encaptab *); 125 static int encap_afcheck(int, const struct sockaddr *, const struct sockaddr *); 126 #ifdef USE_RADIX 127 static struct radix_node_head *encap_rnh(int); 128 static int mask_matchlen(const struct sockaddr *); 129 #endif 130 #ifndef USE_RADIX 131 static int mask_match(const struct encaptab *, const struct sockaddr *, 132 const struct sockaddr *); 133 #endif 134 static void encap_fillarg(struct mbuf *, const struct encaptab *); 135 136 LIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(&encaptab); 137 138 #ifdef USE_RADIX 139 extern int max_keylen; /* radix.c */ 140 struct radix_node_head *encap_head[2]; /* 0 for AF_INET, 1 for AF_INET6 */ 141 #endif 142 143 void 144 encap_init(void) 145 { 146 static int initialized = 0; 147 148 if (initialized) 149 return; 150 initialized++; 151 #if 0 152 /* 153 * we cannot use LIST_INIT() here, since drivers may want to call 154 * encap_attach(), on driver attach. encap_init() will be called 155 * on AF_INET{,6} initialization, which happens after driver 156 * initialization - using LIST_INIT() here can nuke encap_attach() 157 * from drivers. 158 */ 159 LIST_INIT(&encaptab); 160 #endif 161 162 #ifdef USE_RADIX 163 /* 164 * initialize radix lookup table when the radix subsystem is inited. 165 */ 166 rn_delayedinit((void *)&encap_head[0], 167 sizeof(struct sockaddr_pack) << 3); 168 #ifdef INET6 169 rn_delayedinit((void *)&encap_head[1], 170 sizeof(struct sockaddr_pack) << 3); 171 #endif 172 #endif 173 } 174 175 #ifdef INET 176 static struct encaptab * 177 encap4_lookup(struct mbuf *m, int off, int proto, enum direction dir) 178 { 179 struct ip *ip; 180 struct ip_pack4 pack; 181 struct encaptab *ep, *match; 182 int prio, matchprio; 183 #ifdef USE_RADIX 184 struct radix_node_head *rnh = encap_rnh(AF_INET); 185 struct radix_node *rn; 186 #endif 187 188 KASSERT(m->m_len >= sizeof(*ip)); 189 190 ip = mtod(m, struct ip *); 191 192 memset(&pack, 0, sizeof(pack)); 193 pack.p.sp_len = sizeof(pack); 194 pack.mine.sin_family = pack.yours.sin_family = AF_INET; 195 pack.mine.sin_len = pack.yours.sin_len = sizeof(struct sockaddr_in); 196 if (dir == INBOUND) { 197 pack.mine.sin_addr = ip->ip_dst; 198 pack.yours.sin_addr = ip->ip_src; 199 } else { 200 pack.mine.sin_addr = ip->ip_src; 201 pack.yours.sin_addr = ip->ip_dst; 202 } 203 204 match = NULL; 205 matchprio = 0; 206 207 #ifdef USE_RADIX 208 rn = rnh->rnh_matchaddr((void *)&pack, rnh); 209 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 210 match = (struct encaptab *)rn; 211 matchprio = mask_matchlen(match->srcmask) + 212 mask_matchlen(match->dstmask); 213 } 214 #endif 215 216 LIST_FOREACH(ep, &encaptab, chain) { 217 if (ep->af != AF_INET) 218 continue; 219 if (ep->proto >= 0 && ep->proto != proto) 220 continue; 221 if (ep->func) 222 prio = (*ep->func)(m, off, proto, ep->arg); 223 else { 224 #ifdef USE_RADIX 225 continue; 226 #else 227 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 228 (struct sockaddr *)&pack.yours); 229 #endif 230 } 231 232 /* 233 * We prioritize the matches by using bit length of the 234 * matches. mask_match() and user-supplied matching function 235 * should return the bit length of the matches (for example, 236 * if both src/dst are matched for IPv4, 64 should be returned). 237 * 0 or negative return value means "it did not match". 238 * 239 * The question is, since we have two "mask" portion, we 240 * cannot really define total order between entries. 241 * For example, which of these should be preferred? 242 * mask_match() returns 48 (32 + 16) for both of them. 243 * src=3ffe::/16, dst=3ffe:501::/32 244 * src=3ffe:501::/32, dst=3ffe::/16 245 * 246 * We need to loop through all the possible candidates 247 * to get the best match - the search takes O(n) for 248 * n attachments (i.e. interfaces). 249 * 250 * For radix-based lookup, I guess source takes precedence. 251 * See rn_{refines,lexobetter} for the correct answer. 252 */ 253 if (prio <= 0) 254 continue; 255 if (prio > matchprio) { 256 matchprio = prio; 257 match = ep; 258 } 259 } 260 261 return match; 262 #undef s 263 #undef d 264 } 265 266 void 267 encap4_input(struct mbuf *m, ...) 268 { 269 int off, proto; 270 va_list ap; 271 const struct protosw *psw; 272 struct encaptab *match; 273 274 va_start(ap, m); 275 off = va_arg(ap, int); 276 proto = va_arg(ap, int); 277 va_end(ap); 278 279 match = encap4_lookup(m, off, proto, INBOUND); 280 281 if (match) { 282 /* found a match, "match" has the best one */ 283 psw = match->psw; 284 if (psw && psw->pr_input) { 285 encap_fillarg(m, match); 286 (*psw->pr_input)(m, off, proto); 287 } else 288 m_freem(m); 289 return; 290 } 291 292 /* last resort: inject to raw socket */ 293 rip_input(m, off, proto); 294 } 295 #endif 296 297 #ifdef INET6 298 static struct encaptab * 299 encap6_lookup(struct mbuf *m, int off, int proto, enum direction dir) 300 { 301 struct ip6_hdr *ip6; 302 struct ip_pack6 pack; 303 int prio, matchprio; 304 struct encaptab *ep, *match; 305 #ifdef USE_RADIX 306 struct radix_node_head *rnh = encap_rnh(AF_INET6); 307 struct radix_node *rn; 308 #endif 309 310 KASSERT(m->m_len >= sizeof(*ip6)); 311 312 ip6 = mtod(m, struct ip6_hdr *); 313 314 memset(&pack, 0, sizeof(pack)); 315 pack.p.sp_len = sizeof(pack); 316 pack.mine.sin6_family = pack.yours.sin6_family = AF_INET6; 317 pack.mine.sin6_len = pack.yours.sin6_len = sizeof(struct sockaddr_in6); 318 if (dir == INBOUND) { 319 pack.mine.sin6_addr = ip6->ip6_dst; 320 pack.yours.sin6_addr = ip6->ip6_src; 321 } else { 322 pack.mine.sin6_addr = ip6->ip6_src; 323 pack.yours.sin6_addr = ip6->ip6_dst; 324 } 325 326 match = NULL; 327 matchprio = 0; 328 329 #ifdef USE_RADIX 330 rn = rnh->rnh_matchaddr((void *)&pack, rnh); 331 if (rn && (rn->rn_flags & RNF_ROOT) == 0) { 332 match = (struct encaptab *)rn; 333 matchprio = mask_matchlen(match->srcmask) + 334 mask_matchlen(match->dstmask); 335 } 336 #endif 337 338 LIST_FOREACH(ep, &encaptab, chain) { 339 if (ep->af != AF_INET6) 340 continue; 341 if (ep->proto >= 0 && ep->proto != proto) 342 continue; 343 if (ep->func) 344 prio = (*ep->func)(m, off, proto, ep->arg); 345 else { 346 #ifdef USE_RADIX 347 continue; 348 #else 349 prio = mask_match(ep, (struct sockaddr *)&pack.mine, 350 (struct sockaddr *)&pack.yours); 351 #endif 352 } 353 354 /* see encap4_lookup() for issues here */ 355 if (prio <= 0) 356 continue; 357 if (prio > matchprio) { 358 matchprio = prio; 359 match = ep; 360 } 361 } 362 363 return match; 364 #undef s 365 #undef d 366 } 367 368 int 369 encap6_input(struct mbuf **mp, int *offp, int proto) 370 { 371 struct mbuf *m = *mp; 372 const struct ip6protosw *psw; 373 struct encaptab *match; 374 375 match = encap6_lookup(m, *offp, proto, INBOUND); 376 377 if (match) { 378 /* found a match */ 379 psw = (const struct ip6protosw *)match->psw; 380 if (psw && psw->pr_input) { 381 encap_fillarg(m, match); 382 return (*psw->pr_input)(mp, offp, proto); 383 } else { 384 m_freem(m); 385 return IPPROTO_DONE; 386 } 387 } 388 389 /* last resort: inject to raw socket */ 390 return rip6_input(mp, offp, proto); 391 } 392 #endif 393 394 static int 395 encap_add(struct encaptab *ep) 396 { 397 #ifdef USE_RADIX 398 struct radix_node_head *rnh = encap_rnh(ep->af); 399 #endif 400 int error = 0; 401 402 LIST_INSERT_HEAD(&encaptab, ep, chain); 403 #ifdef USE_RADIX 404 if (!ep->func && rnh) { 405 if (!rnh->rnh_addaddr((void *)ep->addrpack, 406 (void *)ep->maskpack, rnh, ep->nodes)) { 407 error = EEXIST; 408 goto fail; 409 } 410 } 411 #endif 412 return error; 413 414 fail: 415 LIST_REMOVE(ep, chain); 416 return error; 417 } 418 419 static int 420 encap_remove(struct encaptab *ep) 421 { 422 #ifdef USE_RADIX 423 struct radix_node_head *rnh = encap_rnh(ep->af); 424 #endif 425 int error = 0; 426 427 LIST_REMOVE(ep, chain); 428 #ifdef USE_RADIX 429 if (!ep->func && rnh) { 430 if (!rnh->rnh_deladdr((void *)ep->addrpack, 431 (void *)ep->maskpack, rnh)) 432 error = ESRCH; 433 } 434 #endif 435 return error; 436 } 437 438 static int 439 encap_afcheck(int af, const struct sockaddr *sp, const struct sockaddr *dp) 440 { 441 if (sp && dp) { 442 if (sp->sa_len != dp->sa_len) 443 return EINVAL; 444 if (af != sp->sa_family || af != dp->sa_family) 445 return EINVAL; 446 } else if (!sp && !dp) 447 ; 448 else 449 return EINVAL; 450 451 switch (af) { 452 case AF_INET: 453 if (sp && sp->sa_len != sizeof(struct sockaddr_in)) 454 return EINVAL; 455 if (dp && dp->sa_len != sizeof(struct sockaddr_in)) 456 return EINVAL; 457 break; 458 #ifdef INET6 459 case AF_INET6: 460 if (sp && sp->sa_len != sizeof(struct sockaddr_in6)) 461 return EINVAL; 462 if (dp && dp->sa_len != sizeof(struct sockaddr_in6)) 463 return EINVAL; 464 break; 465 #endif 466 default: 467 return EAFNOSUPPORT; 468 } 469 470 return 0; 471 } 472 473 /* 474 * sp (src ptr) is always my side, and dp (dst ptr) is always remote side. 475 * length of mask (sm and dm) is assumed to be same as sp/dp. 476 * Return value will be necessary as input (cookie) for encap_detach(). 477 */ 478 const struct encaptab * 479 encap_attach(int af, int proto, 480 const struct sockaddr *sp, const struct sockaddr *sm, 481 const struct sockaddr *dp, const struct sockaddr *dm, 482 const struct protosw *psw, void *arg) 483 { 484 struct encaptab *ep; 485 int error; 486 int s; 487 size_t l; 488 struct ip_pack4 *pack4; 489 #ifdef INET6 490 struct ip_pack6 *pack6; 491 #endif 492 493 s = splsoftnet(); 494 /* sanity check on args */ 495 error = encap_afcheck(af, sp, dp); 496 if (error) 497 goto fail; 498 499 /* check if anyone have already attached with exactly same config */ 500 LIST_FOREACH(ep, &encaptab, chain) { 501 if (ep->af != af) 502 continue; 503 if (ep->proto != proto) 504 continue; 505 if (ep->func) 506 continue; 507 508 KASSERT(ep->src != NULL); 509 KASSERT(ep->dst != NULL); 510 KASSERT(ep->srcmask != NULL); 511 KASSERT(ep->dstmask != NULL); 512 513 if (ep->src->sa_len != sp->sa_len || 514 memcmp(ep->src, sp, sp->sa_len) != 0 || 515 memcmp(ep->srcmask, sm, sp->sa_len) != 0) 516 continue; 517 if (ep->dst->sa_len != dp->sa_len || 518 memcmp(ep->dst, dp, dp->sa_len) != 0 || 519 memcmp(ep->dstmask, dm, dp->sa_len) != 0) 520 continue; 521 522 error = EEXIST; 523 goto fail; 524 } 525 526 switch (af) { 527 case AF_INET: 528 l = sizeof(*pack4); 529 break; 530 #ifdef INET6 531 case AF_INET6: 532 l = sizeof(*pack6); 533 break; 534 #endif 535 default: 536 goto fail; 537 } 538 539 /* M_NETADDR ok? */ 540 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT|M_ZERO); 541 if (ep == NULL) { 542 error = ENOBUFS; 543 goto fail; 544 } 545 ep->addrpack = malloc(l, M_NETADDR, M_NOWAIT|M_ZERO); 546 if (ep->addrpack == NULL) { 547 error = ENOBUFS; 548 goto gc; 549 } 550 ep->maskpack = malloc(l, M_NETADDR, M_NOWAIT|M_ZERO); 551 if (ep->maskpack == NULL) { 552 error = ENOBUFS; 553 goto gc; 554 } 555 556 ep->af = af; 557 ep->proto = proto; 558 ep->addrpack->sa_len = l & 0xff; 559 ep->maskpack->sa_len = l & 0xff; 560 switch (af) { 561 case AF_INET: 562 pack4 = (struct ip_pack4 *)ep->addrpack; 563 ep->src = (struct sockaddr *)&pack4->mine; 564 ep->dst = (struct sockaddr *)&pack4->yours; 565 pack4 = (struct ip_pack4 *)ep->maskpack; 566 ep->srcmask = (struct sockaddr *)&pack4->mine; 567 ep->dstmask = (struct sockaddr *)&pack4->yours; 568 break; 569 #ifdef INET6 570 case AF_INET6: 571 pack6 = (struct ip_pack6 *)ep->addrpack; 572 ep->src = (struct sockaddr *)&pack6->mine; 573 ep->dst = (struct sockaddr *)&pack6->yours; 574 pack6 = (struct ip_pack6 *)ep->maskpack; 575 ep->srcmask = (struct sockaddr *)&pack6->mine; 576 ep->dstmask = (struct sockaddr *)&pack6->yours; 577 break; 578 #endif 579 } 580 581 memcpy(ep->src, sp, sp->sa_len); 582 memcpy(ep->srcmask, sm, sp->sa_len); 583 memcpy(ep->dst, dp, dp->sa_len); 584 memcpy(ep->dstmask, dm, dp->sa_len); 585 ep->psw = psw; 586 ep->arg = arg; 587 588 error = encap_add(ep); 589 if (error) 590 goto gc; 591 592 error = 0; 593 splx(s); 594 return ep; 595 596 gc: 597 if (ep->addrpack) 598 free(ep->addrpack, M_NETADDR); 599 if (ep->maskpack) 600 free(ep->maskpack, M_NETADDR); 601 if (ep) 602 free(ep, M_NETADDR); 603 fail: 604 splx(s); 605 return NULL; 606 } 607 608 const struct encaptab * 609 encap_attach_func(int af, int proto, 610 int (*func)(struct mbuf *, int, int, void *), 611 const struct protosw *psw, void *arg) 612 { 613 struct encaptab *ep; 614 int error; 615 int s; 616 617 s = splsoftnet(); 618 /* sanity check on args */ 619 if (!func) { 620 error = EINVAL; 621 goto fail; 622 } 623 624 error = encap_afcheck(af, NULL, NULL); 625 if (error) 626 goto fail; 627 628 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /*XXX*/ 629 if (ep == NULL) { 630 error = ENOBUFS; 631 goto fail; 632 } 633 memset(ep, 0, sizeof(*ep)); 634 635 ep->af = af; 636 ep->proto = proto; 637 ep->func = func; 638 ep->psw = psw; 639 ep->arg = arg; 640 641 error = encap_add(ep); 642 if (error) 643 goto fail; 644 645 error = 0; 646 splx(s); 647 return ep; 648 649 fail: 650 splx(s); 651 return NULL; 652 } 653 654 /* XXX encap4_ctlinput() is necessary if we set DF=1 on outer IPv4 header */ 655 656 #ifdef INET6 657 void * 658 encap6_ctlinput(int cmd, const struct sockaddr *sa, void *d0) 659 { 660 void *d = d0; 661 struct ip6_hdr *ip6; 662 struct mbuf *m; 663 int off; 664 struct ip6ctlparam *ip6cp = NULL; 665 int nxt; 666 struct encaptab *ep; 667 const struct ip6protosw *psw; 668 669 if (sa->sa_family != AF_INET6 || 670 sa->sa_len != sizeof(struct sockaddr_in6)) 671 return NULL; 672 673 if ((unsigned)cmd >= PRC_NCMDS) 674 return NULL; 675 if (cmd == PRC_HOSTDEAD) 676 d = NULL; 677 else if (cmd == PRC_MSGSIZE) 678 ; /* special code is present, see below */ 679 else if (inet6ctlerrmap[cmd] == 0) 680 return NULL; 681 682 /* if the parameter is from icmp6, decode it. */ 683 if (d != NULL) { 684 ip6cp = (struct ip6ctlparam *)d; 685 m = ip6cp->ip6c_m; 686 ip6 = ip6cp->ip6c_ip6; 687 off = ip6cp->ip6c_off; 688 nxt = ip6cp->ip6c_nxt; 689 690 if (ip6 && cmd == PRC_MSGSIZE) { 691 int valid = 0; 692 struct encaptab *match; 693 694 /* 695 * Check to see if we have a valid encap configuration. 696 */ 697 match = encap6_lookup(m, off, nxt, OUTBOUND); 698 if (match) 699 valid++; 700 701 /* 702 * Depending on the value of "valid" and routing table 703 * size (mtudisc_{hi,lo}wat), we will: 704 * - recalcurate the new MTU and create the 705 * corresponding routing entry, or 706 * - ignore the MTU change notification. 707 */ 708 icmp6_mtudisc_update((struct ip6ctlparam *)d, valid); 709 } 710 } else { 711 m = NULL; 712 ip6 = NULL; 713 nxt = -1; 714 } 715 716 /* inform all listeners */ 717 LIST_FOREACH(ep, &encaptab, chain) { 718 if (ep->af != AF_INET6) 719 continue; 720 if (ep->proto >= 0 && ep->proto != nxt) 721 continue; 722 723 /* should optimize by looking at address pairs */ 724 725 /* XXX need to pass ep->arg or ep itself to listeners */ 726 psw = (const struct ip6protosw *)ep->psw; 727 if (psw && psw->pr_ctlinput) 728 (*psw->pr_ctlinput)(cmd, sa, d); 729 } 730 731 rip6_ctlinput(cmd, sa, d0); 732 return NULL; 733 } 734 #endif 735 736 int 737 encap_detach(const struct encaptab *cookie) 738 { 739 const struct encaptab *ep = cookie; 740 struct encaptab *p, *np; 741 int error; 742 743 LIST_FOREACH_SAFE(p, &encaptab, chain, np) { 744 if (p == ep) { 745 error = encap_remove(p); 746 if (error) 747 return error; 748 if (!ep->func) { 749 free(p->addrpack, M_NETADDR); 750 free(p->maskpack, M_NETADDR); 751 } 752 free(p, M_NETADDR); /*XXX*/ 753 return 0; 754 } 755 } 756 757 return ENOENT; 758 } 759 760 #ifdef USE_RADIX 761 static struct radix_node_head * 762 encap_rnh(int af) 763 { 764 765 switch (af) { 766 case AF_INET: 767 return encap_head[0]; 768 #ifdef INET6 769 case AF_INET6: 770 return encap_head[1]; 771 #endif 772 default: 773 return NULL; 774 } 775 } 776 777 static int 778 mask_matchlen(const struct sockaddr *sa) 779 { 780 const char *p, *ep; 781 int l; 782 783 p = (const char *)sa; 784 ep = p + sa->sa_len; 785 p += 2; /* sa_len + sa_family */ 786 787 l = 0; 788 while (p < ep) { 789 l += (*p ? 8 : 0); /* estimate */ 790 p++; 791 } 792 return l; 793 } 794 #endif 795 796 #ifndef USE_RADIX 797 static int 798 mask_match(const struct encaptab *ep, 799 const struct sockaddr *sp, 800 const struct sockaddr *dp) 801 { 802 struct sockaddr_storage s; 803 struct sockaddr_storage d; 804 int i; 805 const u_int8_t *p, *q; 806 u_int8_t *r; 807 int matchlen; 808 809 KASSERTMSG(ep->func == NULL, "wrong encaptab passed to mask_match"); 810 811 if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) 812 return 0; 813 if (sp->sa_family != ep->af || dp->sa_family != ep->af) 814 return 0; 815 if (sp->sa_len != ep->src->sa_len || dp->sa_len != ep->dst->sa_len) 816 return 0; 817 818 matchlen = 0; 819 820 p = (const u_int8_t *)sp; 821 q = (const u_int8_t *)ep->srcmask; 822 r = (u_int8_t *)&s; 823 for (i = 0 ; i < sp->sa_len; i++) { 824 r[i] = p[i] & q[i]; 825 /* XXX estimate */ 826 matchlen += (q[i] ? 8 : 0); 827 } 828 829 p = (const u_int8_t *)dp; 830 q = (const u_int8_t *)ep->dstmask; 831 r = (u_int8_t *)&d; 832 for (i = 0 ; i < dp->sa_len; i++) { 833 r[i] = p[i] & q[i]; 834 /* XXX rough estimate */ 835 matchlen += (q[i] ? 8 : 0); 836 } 837 838 /* need to overwrite len/family portion as we don't compare them */ 839 s.ss_len = sp->sa_len; 840 s.ss_family = sp->sa_family; 841 d.ss_len = dp->sa_len; 842 d.ss_family = dp->sa_family; 843 844 if (memcmp(&s, ep->src, ep->src->sa_len) == 0 && 845 memcmp(&d, ep->dst, ep->dst->sa_len) == 0) { 846 return matchlen; 847 } else 848 return 0; 849 } 850 #endif 851 852 static void 853 encap_fillarg(struct mbuf *m, const struct encaptab *ep) 854 { 855 struct m_tag *mtag; 856 857 mtag = m_tag_get(PACKET_TAG_ENCAP, sizeof(void *), M_NOWAIT); 858 if (mtag) { 859 *(void **)(mtag + 1) = ep->arg; 860 m_tag_prepend(m, mtag); 861 } 862 } 863 864 void * 865 encap_getarg(struct mbuf *m) 866 { 867 void *p; 868 struct m_tag *mtag; 869 870 p = NULL; 871 mtag = m_tag_find(m, PACKET_TAG_ENCAP, NULL); 872 if (mtag != NULL) { 873 p = *(void **)(mtag + 1); 874 m_tag_delete(m, mtag); 875 } 876 return p; 877 } 878
Indexes created Thu Sep 25 16:09:42 GMT 2025