1 /* $NetBSD: in6_l2tp.c,v 1.22 2022/12/07 08:30:15 knakahara Exp $ */
2
3 /*
4 * Copyright (c) 2017 Internet Initiative Japan Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 * POSSIBILITY OF SUCH DAMAGE.
27 */
28
29 #include <sys/cdefs.h>
30 __KERNEL_RCSID(0, "$NetBSD: in6_l2tp.c,v 1.22 2022/12/07 08:30:15 knakahara Exp $");
31
32 #ifdef _KERNEL_OPT
33 #include "opt_l2tp.h"
34 #endif
35
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/socket.h>
39 #include <sys/sockio.h>
40 #include <sys/mbuf.h>
41 #include <sys/errno.h>
42 #include <sys/ioctl.h>
43 #include <sys/syslog.h>
44 #include <sys/kernel.h>
45
46 #include <net/if.h>
47 #include <net/route.h>
48 #include <net/if_ether.h>
49
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/ip.h>
53 #include <netinet/ip_var.h>
54 #include <netinet/ip_private.h>
55 #include <netinet/in_l2tp.h>
56 #include <netinet/in_var.h>
57 #include <netinet/ip_encap.h>
58
59 #include <netinet/ip6.h>
60 #include <netinet6/ip6_var.h>
61 #include <netinet6/ip6_private.h>
62 #include <netinet6/in6_l2tp.h>
63
64 #ifdef ALTQ
65 #include <altq/altq.h>
66 #endif
67
68 /* TODO: IP_TCPMSS support */
69 #undef IP_TCPMSS
70 #ifdef IP_TCPMSS
71 #include <netinet/ip_tcpmss.h>
72 #endif
73
74 #include <net/if_l2tp.h>
75
76 #define L2TP_HLIM6 64
77 int ip6_l2tp_hlim = L2TP_HLIM6;
78
79 static int in6_l2tp_input(struct mbuf **, int *, int, void *);
80
81 static const struct encapsw in6_l2tp_encapsw = {
82 .encapsw6 = {
83 .pr_input = in6_l2tp_input,
84 .pr_ctlinput = NULL,
85 }
86 };
87
88 static int in6_l2tp_match(struct mbuf *, int, int, void *);
89
90 int
in6_l2tp_output(struct l2tp_variant * var,struct mbuf * m)91 in6_l2tp_output(struct l2tp_variant *var, struct mbuf *m)
92 {
93 struct rtentry *rt;
94 struct route *ro_pc;
95 kmutex_t *lock_pc;
96 struct l2tp_softc *sc;
97 struct ifnet *ifp;
98 struct sockaddr_in6 *sin6_src = satosin6(var->lv_psrc);
99 struct sockaddr_in6 *sin6_dst = satosin6(var->lv_pdst);
100 struct ip6_hdr ip6hdr; /* capsule IP header, host byte ordered */
101 int error;
102 uint32_t sess_id;
103
104 KASSERT(var != NULL);
105 KASSERT(l2tp_heldref_variant(var));
106 KASSERT(sin6_src != NULL && sin6_dst != NULL);
107 KASSERT(sin6_src->sin6_family == AF_INET6
108 && sin6_dst->sin6_family == AF_INET6);
109
110 sc = var->lv_softc;
111 ifp = &sc->l2tp_ec.ec_if;
112 error = l2tp_check_nesting(ifp, m);
113 if (error) {
114 m_freem(m);
115 goto looped;
116 }
117
118 /* bidirectional configured tunnel mode */
119 if (IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) {
120 m_freem(m);
121 if ((ifp->if_flags & IFF_DEBUG) != 0)
122 log(LOG_DEBUG, "%s: ENETUNREACH\n", __func__);
123 return ENETUNREACH;
124 }
125
126 #ifdef NOTYET
127 /* TODO: support ALTQ for innner frame */
128 #ifdef ALTQ
129 ALTQ_SAVE_PAYLOAD(m, AF_ETHER);
130 #endif
131 #endif
132
133 memset(&ip6hdr, 0, sizeof(ip6hdr));
134 ip6hdr.ip6_src = sin6_src->sin6_addr;
135 ip6hdr.ip6_dst = sin6_dst->sin6_addr;
136 /* unlike IPv4, IP version must be filled by caller of ip6_output() */
137 ip6hdr.ip6_vfc = 0x60;
138 ip6hdr.ip6_nxt = IPPROTO_L2TP;
139 ip6hdr.ip6_hlim = ip6_l2tp_hlim;
140 /* outer IP payload length */
141 ip6hdr.ip6_plen = 0;
142 /* session-id length */
143 ip6hdr.ip6_plen += sizeof(uint32_t);
144 if (var->lv_use_cookie == L2TP_COOKIE_ON) {
145 /* cookie length */
146 ip6hdr.ip6_plen += var->lv_peer_cookie_len;
147 }
148
149 /* TODO: IP_TCPMSS support */
150 #ifdef IP_TCPMSS
151 m = l2tp_tcpmss_clamp(ifp, m);
152 if (m == NULL)
153 return EINVAL;
154 #endif
155
156 /*
157 * Payload length.
158 *
159 * NOTE: payload length may be changed in ip_tcpmss(). Typical case
160 * is missing of TCP mss option in original TCP header.
161 */
162 ip6hdr.ip6_plen += m->m_pkthdr.len;
163 HTONS(ip6hdr.ip6_plen);
164
165 if (var->lv_use_cookie == L2TP_COOKIE_ON) {
166 /* prepend session cookie */
167 uint32_t cookie_32;
168 uint64_t cookie_64;
169 M_PREPEND(m, var->lv_peer_cookie_len, M_DONTWAIT);
170 if (m && m->m_len < var->lv_peer_cookie_len)
171 m = m_pullup(m, var->lv_peer_cookie_len);
172 if (m == NULL)
173 return ENOBUFS;
174 if (var->lv_peer_cookie_len == 4) {
175 cookie_32 = htonl((uint32_t)var->lv_peer_cookie);
176 memcpy(mtod(m, void *), &cookie_32, sizeof(uint32_t));
177 } else {
178 cookie_64 = htobe64(var->lv_peer_cookie);
179 memcpy(mtod(m, void *), &cookie_64, sizeof(uint64_t));
180 }
181 }
182
183 /* prepend session-ID */
184 sess_id = htonl(var->lv_peer_sess_id);
185 M_PREPEND(m, sizeof(uint32_t), M_DONTWAIT);
186 if (m && m->m_len < sizeof(uint32_t))
187 m = m_pullup(m, sizeof(uint32_t));
188 if (m == NULL)
189 return ENOBUFS;
190 memcpy(mtod(m, uint32_t *), &sess_id, sizeof(uint32_t));
191
192 /* prepend new IP header */
193 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
194 if (m == NULL)
195 return ENOBUFS;
196 if (M_GET_ALIGNED_HDR(&m, struct ip6_hdr, false) != 0)
197 return ENOBUFS;
198 memcpy(mtod(m, struct ip6_hdr *), &ip6hdr, sizeof(struct ip6_hdr));
199
200 if_tunnel_get_ro(sc->l2tp_ro_percpu, &ro_pc, &lock_pc);
201 if ((rt = rtcache_lookup(ro_pc, var->lv_pdst)) == NULL) {
202 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc);
203 m_freem(m);
204 return ENETUNREACH;
205 }
206
207 /* If the route constitutes infinite encapsulation, punt. */
208 if (rt->rt_ifp == ifp) {
209 rtcache_unref(rt, ro_pc);
210 rtcache_free(ro_pc);
211 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc);
212 m_freem(m);
213 return ENETUNREACH; /* XXX */
214 }
215 rtcache_unref(rt, ro_pc);
216
217 /*
218 * To avoid inappropriate rewrite of checksum,
219 * clear csum flags.
220 */
221 m->m_pkthdr.csum_flags = 0;
222
223 error = ip6_output(m, 0, ro_pc, 0, NULL, NULL, NULL);
224 if_tunnel_put_ro(sc->l2tp_ro_percpu, lock_pc);
225 return(error);
226
227 looped:
228 if (error)
229 if_statinc(ifp, if_oerrors);
230
231 return error;
232 }
233
234 static int
in6_l2tp_input(struct mbuf ** mp,int * offp,int proto,void * eparg __unused)235 in6_l2tp_input(struct mbuf **mp, int *offp, int proto, void *eparg __unused)
236 {
237 struct mbuf *m = *mp;
238 int off = *offp;
239
240 struct ifnet *l2tpp = NULL;
241 struct l2tp_softc *sc;
242 struct l2tp_variant *var;
243 uint32_t sess_id;
244 uint32_t cookie_32;
245 uint64_t cookie_64;
246 struct psref psref;
247
248 KASSERT((m->m_flags & M_PKTHDR) != 0);
249
250 if (m->m_pkthdr.len < off + sizeof(uint32_t)) {
251 m_freem(m);
252 return IPPROTO_DONE;
253 }
254
255 /* get L2TP session ID */
256 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);
257 NTOHL(sess_id);
258 #ifdef L2TP_DEBUG
259 log(LOG_DEBUG, "%s: sess_id = %" PRIu32 "\n", __func__, sess_id);
260 #endif
261 if (sess_id == 0) {
262 int rv;
263 /*
264 * L2TPv3 control packet received.
265 * userland daemon(l2tpd?) should process.
266 */
267 SOFTNET_LOCK_IF_NET_MPSAFE();
268 rv = rip6_input(mp, offp, proto);
269 SOFTNET_UNLOCK_IF_NET_MPSAFE();
270 return rv;
271 }
272
273 var = l2tp_lookup_session_ref(sess_id, &psref);
274 if (var == NULL) {
275 m_freem(m);
276 IP_STATINC(IP_STAT_NOL2TP);
277 return IPPROTO_DONE;
278 }
279
280 sc = var->lv_softc;
281 l2tpp = &(sc->l2tp_ec.ec_if);
282
283 if (l2tpp == NULL || (l2tpp->if_flags & IFF_UP) == 0) {
284 #ifdef L2TP_DEBUG
285 if (l2tpp == NULL)
286 log(LOG_DEBUG, "%s: l2tpp is NULL\n", __func__);
287 else
288 log(LOG_DEBUG, "%s: l2tpp is down\n", __func__);
289 #endif
290 m_freem(m);
291 IP_STATINC(IP_STAT_NOL2TP);
292 goto out;
293 }
294
295 /* other CPU did l2tp_delete_tunnel */
296 if (var->lv_psrc == NULL || var->lv_pdst == NULL) {
297 m_freem(m);
298 ip_statinc(IP_STAT_NOL2TP);
299 goto out;
300 }
301
302 if (var->lv_state != L2TP_STATE_UP) {
303 m_freem(m);
304 goto out;
305 }
306 m_adj(m, off + sizeof(uint32_t));
307
308 if (var->lv_use_cookie == L2TP_COOKIE_ON) {
309 if (m->m_pkthdr.len < var->lv_my_cookie_len) {
310 m_freem(m);
311 goto out;
312 }
313 if (var->lv_my_cookie_len == 4) {
314 m_copydata(m, 0, sizeof(uint32_t), (void *)&cookie_32);
315 NTOHL(cookie_32);
316 if (cookie_32 != var->lv_my_cookie) {
317 m_freem(m);
318 goto out;
319 }
320 m_adj(m, sizeof(uint32_t));
321 } else {
322 m_copydata(m, 0, sizeof(uint64_t), (void *)&cookie_64);
323 BE64TOH(cookie_64);
324 if (cookie_64 != var->lv_my_cookie) {
325 m_freem(m);
326 goto out;
327 }
328 m_adj(m, sizeof(uint64_t));
329 }
330 }
331
332 /* TODO: IP_TCPMSS support */
333 #ifdef IP_TCPMSS
334 m = l2tp_tcpmss_clamp(l2tpp, m);
335 if (m == NULL)
336 goto out;
337 #endif
338 l2tp_input(m, l2tpp);
339
340 out:
341 l2tp_putref_variant(var, &psref);
342 return IPPROTO_DONE;
343 }
344
345 /*
346 * This function is used by encap6_lookup() to decide priority of the encaptab.
347 * This priority is compared to the match length between mbuf's source/destination
348 * IPv6 address pair and encaptab's one.
349 * l2tp(4) does not use address pairs to search matched encaptab, so this
350 * function must return the length bigger than or equals to IPv6 address pair to
351 * avoid wrong encaptab.
352 */
353 static int
in6_l2tp_match(struct mbuf * m,int off,int proto,void * arg)354 in6_l2tp_match(struct mbuf *m, int off, int proto, void *arg)
355 {
356 struct l2tp_softc *sc = arg;
357 struct l2tp_variant *var;
358 struct psref psref;
359 uint32_t sess_id;
360 int rv = 0;
361
362 KASSERT(proto == IPPROTO_L2TP);
363
364 var = l2tp_getref_variant(sc, &psref);
365 if (__predict_false(var == NULL))
366 return rv;
367
368 /*
369 * If the packet contains no session ID it cannot match
370 */
371 if (m_length(m) < off + sizeof(uint32_t)) {
372 rv = 0 ;
373 goto out;
374 }
375
376 /* get L2TP session ID */
377 m_copydata(m, off, sizeof(uint32_t), (void *)&sess_id);
378 NTOHL(sess_id);
379 if (sess_id == 0) {
380 /*
381 * L2TPv3 control packet received.
382 * userland daemon(l2tpd?) should process.
383 */
384 rv = 128 * 2;
385 } else if (sess_id == var->lv_my_sess_id)
386 rv = 128 * 2;
387 else
388 rv = 0;
389
390 out:
391 l2tp_putref_variant(var, &psref);
392 return rv;
393 }
394
395 int
in6_l2tp_attach(struct l2tp_variant * var)396 in6_l2tp_attach(struct l2tp_variant *var)
397 {
398 struct l2tp_softc *sc = var->lv_softc;
399
400 if (sc == NULL)
401 return EINVAL;
402
403 var->lv_encap_cookie = encap_attach_addr(AF_INET6, IPPROTO_L2TP,
404 var->lv_psrc, var->lv_pdst, in6_l2tp_match, &in6_l2tp_encapsw, sc);
405 if (var->lv_encap_cookie == NULL)
406 return EEXIST;
407
408 return 0;
409 }
410
411 int
in6_l2tp_detach(struct l2tp_variant * var)412 in6_l2tp_detach(struct l2tp_variant *var)
413 {
414 int error;
415
416 error = encap_detach(var->lv_encap_cookie);
417 if (error == 0)
418 var->lv_encap_cookie = NULL;
419
420 return error;
421 }
422