1 /* $NetBSD: in6_gif.c,v 1.27 2001/12/21 06:30:44 itojun Exp $ */ 2 /* $KAME: in6_gif.c,v 1.62 2001/07/29 04:27:25 itojun Exp $ */ 3 4 /* 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: in6_gif.c,v 1.27 2001/12/21 06:30:44 itojun Exp $"); 35 36 #include "opt_inet.h" 37 #include "opt_iso.h" 38 39 /* define it if you want to use encap_attach_func (it helps *BSD merge) */ 40 #define USE_ENCAPCHECK 41 42 #include <sys/param.h> 43 #include <sys/systm.h> 44 #include <sys/socket.h> 45 #include <sys/sockio.h> 46 #include <sys/mbuf.h> 47 #include <sys/errno.h> 48 #include <sys/ioctl.h> 49 #include <sys/queue.h> 50 #include <sys/syslog.h> 51 #include <sys/protosw.h> 52 53 #include <net/if.h> 54 #include <net/route.h> 55 56 #include <netinet/in.h> 57 #include <netinet/in_systm.h> 58 #ifdef INET 59 #include <netinet/ip.h> 60 #endif 61 #include <netinet/ip_encap.h> 62 #ifdef INET6 63 #include <netinet/ip6.h> 64 #include <netinet6/ip6_var.h> 65 #include <netinet6/in6_gif.h> 66 #include <netinet6/in6_var.h> 67 #endif 68 #include <netinet6/ip6protosw.h> 69 #include <netinet/ip_ecn.h> 70 71 #include <net/if_gif.h> 72 73 #include <net/net_osdep.h> 74 75 static int gif_validate6 __P((const struct ip6_hdr *, struct gif_softc *, 76 struct ifnet *)); 77 78 int ip6_gif_hlim = GIF_HLIM; 79 80 extern struct domain inet6domain; 81 struct ip6protosw in6_gif_protosw = 82 { SOCK_RAW, &inet6domain, 0/* IPPROTO_IPV[46] */, PR_ATOMIC|PR_ADDR, 83 in6_gif_input, rip6_output, in6_gif_ctlinput, rip6_ctloutput, 84 rip6_usrreq, 85 0, 0, 0, 0, 86 }; 87 88 extern LIST_HEAD(, gif_softc) gif_softc_list; 89 90 int 91 in6_gif_output(ifp, family, m) 92 struct ifnet *ifp; 93 int family; /* family of the packet to be encapsulate. */ 94 struct mbuf *m; 95 { 96 struct gif_softc *sc = (struct gif_softc*)ifp; 97 struct sockaddr_in6 *dst = (struct sockaddr_in6 *)&sc->gif_ro6.ro_dst; 98 struct sockaddr_in6 *sin6_src = (struct sockaddr_in6 *)sc->gif_psrc; 99 struct sockaddr_in6 *sin6_dst = (struct sockaddr_in6 *)sc->gif_pdst; 100 struct ip6_hdr *ip6; 101 int proto, error; 102 u_int8_t itos, otos; 103 104 if (sin6_src == NULL || sin6_dst == NULL || 105 sin6_src->sin6_family != AF_INET6 || 106 sin6_dst->sin6_family != AF_INET6) { 107 m_freem(m); 108 return EAFNOSUPPORT; 109 } 110 111 switch (family) { 112 #ifdef INET 113 case AF_INET: 114 { 115 struct ip *ip; 116 117 proto = IPPROTO_IPV4; 118 if (m->m_len < sizeof(*ip)) { 119 m = m_pullup(m, sizeof(*ip)); 120 if (!m) 121 return ENOBUFS; 122 } 123 ip = mtod(m, struct ip *); 124 itos = ip->ip_tos; 125 break; 126 } 127 #endif 128 #ifdef INET6 129 case AF_INET6: 130 { 131 struct ip6_hdr *ip6; 132 proto = IPPROTO_IPV6; 133 if (m->m_len < sizeof(*ip6)) { 134 m = m_pullup(m, sizeof(*ip6)); 135 if (!m) 136 return ENOBUFS; 137 } 138 ip6 = mtod(m, struct ip6_hdr *); 139 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 140 break; 141 } 142 #endif 143 #ifdef ISO 144 case AF_ISO: 145 proto = IPPROTO_EON; 146 itos = 0; 147 break; 148 #endif 149 default: 150 #ifdef DEBUG 151 printf("in6_gif_output: warning: unknown family %d passed\n", 152 family); 153 #endif 154 m_freem(m); 155 return EAFNOSUPPORT; 156 } 157 158 /* prepend new IP header */ 159 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT); 160 if (m && m->m_len < sizeof(struct ip6_hdr)) 161 m = m_pullup(m, sizeof(struct ip6_hdr)); 162 if (m == NULL) 163 return ENOBUFS; 164 165 ip6 = mtod(m, struct ip6_hdr *); 166 ip6->ip6_flow = 0; 167 ip6->ip6_vfc &= ~IPV6_VERSION_MASK; 168 ip6->ip6_vfc |= IPV6_VERSION; 169 ip6->ip6_plen = htons((u_short)m->m_pkthdr.len); 170 ip6->ip6_nxt = proto; 171 ip6->ip6_hlim = ip6_gif_hlim; 172 ip6->ip6_src = sin6_src->sin6_addr; 173 /* bidirectional configured tunnel mode */ 174 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) 175 ip6->ip6_dst = sin6_dst->sin6_addr; 176 else { 177 m_freem(m); 178 return ENETUNREACH; 179 } 180 if (ifp->if_flags & IFF_LINK1) 181 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos); 182 else 183 ip_ecn_ingress(ECN_NOCARE, &otos, &itos); 184 ip6->ip6_flow &= ~ntohl(0xff00000); 185 ip6->ip6_flow |= htonl((u_int32_t)otos << 20); 186 187 if (dst->sin6_family != sin6_dst->sin6_family || 188 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &sin6_dst->sin6_addr)) { 189 /* cache route doesn't match */ 190 bzero(dst, sizeof(*dst)); 191 dst->sin6_family = sin6_dst->sin6_family; 192 dst->sin6_len = sizeof(struct sockaddr_in6); 193 dst->sin6_addr = sin6_dst->sin6_addr; 194 if (sc->gif_ro6.ro_rt) { 195 RTFREE(sc->gif_ro6.ro_rt); 196 sc->gif_ro6.ro_rt = NULL; 197 } 198 } 199 200 if (sc->gif_ro6.ro_rt == NULL) { 201 rtalloc((struct route *)&sc->gif_ro6); 202 if (sc->gif_ro6.ro_rt == NULL) { 203 m_freem(m); 204 return ENETUNREACH; 205 } 206 207 /* if it constitutes infinite encapsulation, punt. */ 208 if (sc->gif_ro.ro_rt->rt_ifp == ifp) { 209 m_freem(m); 210 return ENETUNREACH; /* XXX */ 211 } 212 } 213 214 #ifdef IPV6_MINMTU 215 /* 216 * force fragmentation to minimum MTU, to avoid path MTU discovery. 217 * it is too painful to ask for resend of inner packet, to achieve 218 * path MTU discovery for encapsulated packets. 219 */ 220 error = ip6_output(m, 0, &sc->gif_ro6, IPV6_MINMTU, 0, NULL); 221 #else 222 error = ip6_output(m, 0, &sc->gif_ro6, 0, 0, NULL); 223 #endif 224 225 return(error); 226 } 227 228 int in6_gif_input(mp, offp, proto) 229 struct mbuf **mp; 230 int *offp, proto; 231 { 232 struct mbuf *m = *mp; 233 struct ifnet *gifp = NULL; 234 struct ip6_hdr *ip6; 235 int af = 0; 236 u_int32_t otos; 237 238 ip6 = mtod(m, struct ip6_hdr *); 239 240 gifp = (struct ifnet *)encap_getarg(m); 241 242 if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) { 243 m_freem(m); 244 ip6stat.ip6s_nogif++; 245 return IPPROTO_DONE; 246 } 247 #ifndef USE_ENCAPCHECK 248 if (!gif_validate6(ip6, (struct gif_softc *)gifp, m->m_pkthdr.rcvif)) { 249 m_freem(m); 250 ip6stat.ip6s_nogif++; 251 return IPPROTO_DONE; 252 } 253 #endif 254 255 otos = ip6->ip6_flow; 256 m_adj(m, *offp); 257 258 switch (proto) { 259 #ifdef INET 260 case IPPROTO_IPV4: 261 { 262 struct ip *ip; 263 u_int8_t otos8; 264 af = AF_INET; 265 otos8 = (ntohl(otos) >> 20) & 0xff; 266 if (m->m_len < sizeof(*ip)) { 267 m = m_pullup(m, sizeof(*ip)); 268 if (!m) 269 return IPPROTO_DONE; 270 } 271 ip = mtod(m, struct ip *); 272 if (gifp->if_flags & IFF_LINK1) 273 ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos); 274 else 275 ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos); 276 break; 277 } 278 #endif /* INET */ 279 #ifdef INET6 280 case IPPROTO_IPV6: 281 { 282 struct ip6_hdr *ip6; 283 af = AF_INET6; 284 if (m->m_len < sizeof(*ip6)) { 285 m = m_pullup(m, sizeof(*ip6)); 286 if (!m) 287 return IPPROTO_DONE; 288 } 289 ip6 = mtod(m, struct ip6_hdr *); 290 if (gifp->if_flags & IFF_LINK1) 291 ip6_ecn_egress(ECN_ALLOWED, &otos, &ip6->ip6_flow); 292 else 293 ip6_ecn_egress(ECN_NOCARE, &otos, &ip6->ip6_flow); 294 break; 295 } 296 #endif 297 #ifdef ISO 298 case IPPROTO_EON: 299 af = AF_ISO; 300 break; 301 #endif 302 default: 303 ip6stat.ip6s_nogif++; 304 m_freem(m); 305 return IPPROTO_DONE; 306 } 307 308 gif_input(m, af, gifp); 309 return IPPROTO_DONE; 310 } 311 312 /* 313 * validate outer address. 314 */ 315 static int 316 gif_validate6(ip6, sc, ifp) 317 const struct ip6_hdr *ip6; 318 struct gif_softc *sc; 319 struct ifnet *ifp; 320 { 321 struct sockaddr_in6 *src, *dst; 322 323 src = (struct sockaddr_in6 *)sc->gif_psrc; 324 dst = (struct sockaddr_in6 *)sc->gif_pdst; 325 326 /* check for address match */ 327 if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) || 328 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src)) 329 return 0; 330 331 /* martian filters on outer source - done in ip6_input */ 332 333 /* ingress filters on outer source */ 334 if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) { 335 struct sockaddr_in6 sin6; 336 struct rtentry *rt; 337 338 bzero(&sin6, sizeof(sin6)); 339 sin6.sin6_family = AF_INET6; 340 sin6.sin6_len = sizeof(struct sockaddr_in6); 341 sin6.sin6_addr = ip6->ip6_src; 342 /* XXX scopeid */ 343 rt = rtalloc1((struct sockaddr *)&sin6, 0); 344 if (!rt || rt->rt_ifp != ifp) { 345 #if 0 346 log(LOG_WARNING, "%s: packet from %s dropped " 347 "due to ingress filter\n", if_name(&sc->gif_if), 348 ip6_sprintf(&sin6.sin6_addr)); 349 #endif 350 if (rt) 351 rtfree(rt); 352 return 0; 353 } 354 rtfree(rt); 355 } 356 357 return 128 * 2; 358 } 359 360 /* 361 * we know that we are in IFF_UP, outer address available, and outer family 362 * matched the physical addr family. see gif_encapcheck(). 363 */ 364 int 365 gif_encapcheck6(m, off, proto, arg) 366 const struct mbuf *m; 367 int off; 368 int proto; 369 void *arg; 370 { 371 struct ip6_hdr ip6; 372 struct gif_softc *sc; 373 struct ifnet *ifp; 374 375 /* sanity check done in caller */ 376 sc = (struct gif_softc *)arg; 377 378 /* LINTED const cast */ 379 m_copydata((struct mbuf *)m, 0, sizeof(ip6), (caddr_t)&ip6); 380 ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL; 381 382 return gif_validate6(&ip6, sc, ifp); 383 } 384 385 int 386 in6_gif_attach(sc) 387 struct gif_softc *sc; 388 { 389 #ifndef USE_ENCAPCHECK 390 struct sockaddr_in6 mask6; 391 392 bzero(&mask6, sizeof(mask6)); 393 mask6.sin6_len = sizeof(struct sockaddr_in6); 394 mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] = 395 mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0; 396 397 if (!sc->gif_psrc || !sc->gif_pdst) 398 return EINVAL; 399 sc->encap_cookie6 = encap_attach(AF_INET6, -1, sc->gif_psrc, 400 (struct sockaddr *)&mask6, sc->gif_pdst, (struct sockaddr *)&mask6, 401 (struct protosw *)&in6_gif_protosw, sc); 402 #else 403 sc->encap_cookie6 = encap_attach_func(AF_INET6, -1, gif_encapcheck, 404 (struct protosw *)&in6_gif_protosw, sc); 405 #endif 406 if (sc->encap_cookie6 == NULL) 407 return EEXIST; 408 return 0; 409 } 410 411 int 412 in6_gif_detach(sc) 413 struct gif_softc *sc; 414 { 415 int error; 416 417 error = encap_detach(sc->encap_cookie6); 418 if (error == 0) 419 sc->encap_cookie6 = NULL; 420 return error; 421 } 422 423 void 424 in6_gif_ctlinput(cmd, sa, d) 425 int cmd; 426 struct sockaddr *sa; 427 void *d; 428 { 429 struct gif_softc *sc; 430 struct ip6ctlparam *ip6cp = NULL; 431 struct mbuf *m; 432 struct ip6_hdr *ip6; 433 int off; 434 void *cmdarg; 435 const struct sockaddr_in6 *sa6_src = NULL; 436 struct sockaddr_in6 *dst6; 437 438 if (sa->sa_family != AF_INET6 || 439 sa->sa_len != sizeof(struct sockaddr_in6)) 440 return; 441 442 if ((unsigned)cmd >= PRC_NCMDS) 443 return; 444 if (cmd == PRC_HOSTDEAD) 445 d = NULL; 446 else if (inet6ctlerrmap[cmd] == 0) 447 return; 448 449 /* if the parameter is from icmp6, decode it. */ 450 if (d != NULL) { 451 ip6cp = (struct ip6ctlparam *)d; 452 m = ip6cp->ip6c_m; 453 ip6 = ip6cp->ip6c_ip6; 454 off = ip6cp->ip6c_off; 455 cmdarg = ip6cp->ip6c_cmdarg; 456 sa6_src = ip6cp->ip6c_src; 457 } else { 458 m = NULL; 459 ip6 = NULL; 460 cmdarg = NULL; 461 sa6_src = &sa6_any; 462 } 463 464 if (!ip6) 465 return; 466 467 /* 468 * for now we don't care which type it was, just flush the route cache. 469 * XXX slow. sc (or sc->encap_cookie6) should be passed from 470 * ip_encap.c. 471 */ 472 for (sc = LIST_FIRST(&gif_softc_list); sc; 473 sc = LIST_NEXT(sc, gif_list)) { 474 if ((sc->gif_if.if_flags & IFF_RUNNING) == 0) 475 continue; 476 if (sc->gif_psrc->sa_family != AF_INET6) 477 continue; 478 if (!sc->gif_ro6.ro_rt) 479 continue; 480 481 dst6 = (struct sockaddr_in6 *)&sc->gif_ro6.ro_dst; 482 /* XXX scope */ 483 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr)) { 484 /* flush route cache */ 485 RTFREE(sc->gif_ro6.ro_rt); 486 sc->gif_ro6.ro_rt = NULL; 487 } 488 } 489 } 490