sys/netinet6/in6_gif.c

   1 /*      $NetBSD: in6_gif.c,v 1.57 2008/11/07 00:20:18 dyoung Exp $      */
   2 /*      $KAME: in6_gif.c,v 1.62 2001/07/29 04:27:25 itojun Exp $        */
   3
   4 /*
   5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the name of the project nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __KERNEL_RCSID(0, "$NetBSD: in6_gif.c,v 1.57 2008/11/07 00:20:18 dyoung Exp $");
  35
  36 #include "opt_inet.h"
  37 #include "opt_iso.h"
  38
  39 #include <sys/param.h>
  40 #include <sys/systm.h>
  41 #include <sys/socket.h>
  42 #include <sys/sockio.h>
  43 #include <sys/mbuf.h>
  44 #include <sys/errno.h>
  45 #include <sys/ioctl.h>
  46 #include <sys/queue.h>
  47 #include <sys/syslog.h>
  48 #include <sys/protosw.h>
  49 #include <sys/kernel.h>
  50
  51 #include <net/if.h>
  52 #include <net/route.h>
  53
  54 #include <netinet/in.h>
  55 #include <netinet/in_systm.h>
  56 #ifdef INET
  57 #include <netinet/ip.h>
  58 #endif
  59 #include <netinet/ip_encap.h>
  60 #ifdef INET6
  61 #include <netinet/ip6.h>
  62 #include <netinet6/ip6_var.h>
  63 #include <netinet6/ip6_private.h>
  64 #include <netinet6/in6_gif.h>
  65 #include <netinet6/in6_var.h>
  66 #endif
  67 #include <netinet6/ip6protosw.h>
  68 #include <netinet/ip_ecn.h>
  69
  70 #include <net/if_gif.h>
  71
  72 #include <net/net_osdep.h>
  73
  74 static int gif_validate6(const struct ip6_hdr *, struct gif_softc *,
  75         struct ifnet *);
  76
  77 int     ip6_gif_hlim = GIF_HLIM;
  78
  79 extern LIST_HEAD(, gif_softc) gif_softc_list;
  80
  81 extern const struct ip6protosw in6_gif_protosw;
  82
  83 /*
  84  * family - family of the packet to be encapsulate.
  85  */
  86
  87 int
  88 in6_gif_output(struct ifnet *ifp, int family, struct mbuf *m)
  89 {
  90         struct rtentry *rt;
  91         struct gif_softc *sc = ifp->if_softc;
  92         struct sockaddr_in6 *sin6_src = (struct sockaddr_in6 *)sc->gif_psrc;
  93         struct sockaddr_in6 *sin6_dst = (struct sockaddr_in6 *)sc->gif_pdst;
  94         struct ip6_hdr *ip6;
  95         int proto, error;
  96         u_int8_t itos, otos;
  97         union {
  98                 struct sockaddr         dst;
  99                 struct sockaddr_in6     dst6;
 100         } u;
 101
 102         if (sin6_src == NULL || sin6_dst == NULL ||
 103             sin6_src->sin6_family != AF_INET6 ||
 104             sin6_dst->sin6_family != AF_INET6) {
 105                 m_freem(m);
 106                 return EAFNOSUPPORT;
 107         }
 108
 109         switch (family) {
 110 #ifdef INET
 111         case AF_INET:
 112             {
 113                 struct ip *ip;
 114
 115                 proto = IPPROTO_IPV4;
 116                 if (m->m_len < sizeof(*ip)) {
 117                         m = m_pullup(m, sizeof(*ip));
 118                         if (!m)
 119                                 return ENOBUFS;
 120                 }
 121                 ip = mtod(m, struct ip *);
 122                 itos = ip->ip_tos;
 123                 break;
 124             }
 125 #endif
 126 #ifdef INET6
 127         case AF_INET6:
 128             {
 129                 proto = IPPROTO_IPV6;
 130                 if (m->m_len < sizeof(*ip6)) {
 131                         m = m_pullup(m, sizeof(*ip6));
 132                         if (!m)
 133                                 return ENOBUFS;
 134                 }
 135                 ip6 = mtod(m, struct ip6_hdr *);
 136                 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 137                 break;
 138             }
 139 #endif
 140 #ifdef ISO
 141         case AF_ISO:
 142                 proto = IPPROTO_EON;
 143                 itos = 0;
 144                 break;
 145 #endif
 146         default:
 147 #ifdef DEBUG
 148                 printf("in6_gif_output: warning: unknown family %d passed\n",
 149                         family);
 150 #endif
 151                 m_freem(m);
 152                 return EAFNOSUPPORT;
 153         }
 154
 155         /* prepend new IP header */
 156         M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
 157         if (m && m->m_len < sizeof(struct ip6_hdr))
 158                 m = m_pullup(m, sizeof(struct ip6_hdr));
 159         if (m == NULL)
 160                 return ENOBUFS;
 161
 162         ip6 = mtod(m, struct ip6_hdr *);
 163         ip6->ip6_flow   = 0;
 164         ip6->ip6_vfc    &= ~IPV6_VERSION_MASK;
 165         ip6->ip6_vfc    |= IPV6_VERSION;
 166 #if 0   /* ip6->ip6_plen will be filled by ip6_output */
 167         ip6->ip6_plen   = htons((u_int16_t)m->m_pkthdr.len);
 168 #endif
 169         ip6->ip6_nxt    = proto;
 170         ip6->ip6_hlim   = ip6_gif_hlim;
 171         ip6->ip6_src    = sin6_src->sin6_addr;
 172         /* bidirectional configured tunnel mode */
 173         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr))
 174                 ip6->ip6_dst = sin6_dst->sin6_addr;
 175         else  {
 176                 m_freem(m);
 177                 return ENETUNREACH;
 178         }
 179         if (ifp->if_flags & IFF_LINK1)
 180                 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
 181         else
 182                 ip_ecn_ingress(ECN_NOCARE, &otos, &itos);
 183         ip6->ip6_flow &= ~ntohl(0xff00000);
 184         ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
 185
 186         sockaddr_in6_init(&u.dst6, &sin6_dst->sin6_addr, 0, 0, 0);
 187         if ((rt = rtcache_lookup(&sc->gif_ro, &u.dst)) == NULL) {
 188                 m_freem(m);
 189                 return ENETUNREACH;
 190         }
 191
 192         /* If the route constitutes infinite encapsulation, punt. */
 193         if (rt->rt_ifp == ifp) {
 194                 m_freem(m);
 195                 return ENETUNREACH;     /* XXX */
 196         }
 197
 198 #ifdef IPV6_MINMTU
 199         /*
 200          * force fragmentation to minimum MTU, to avoid path MTU discovery.
 201          * it is too painful to ask for resend of inner packet, to achieve
 202          * path MTU discovery for encapsulated packets.
 203          */
 204         error = ip6_output(m, 0, &sc->gif_ro, IPV6_MINMTU, NULL, NULL, NULL);
 205 #else
 206         error = ip6_output(m, 0, &sc->gif_ro, 0, NULL, NULL, NULL);
 207 #endif
 208
 209         return (error);
 210 }
 211
 212 int
 213 in6_gif_input(struct mbuf **mp, int *offp, int proto)
 214 {
 215         struct mbuf *m = *mp;
 216         struct ifnet *gifp = NULL;
 217         struct ip6_hdr *ip6;
 218         int af = 0;
 219         u_int32_t otos;
 220
 221         ip6 = mtod(m, struct ip6_hdr *);
 222
 223         gifp = (struct ifnet *)encap_getarg(m);
 224
 225         if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) {
 226                 m_freem(m);
 227                 IP6_STATINC(IP6_STAT_NOGIF);
 228                 return IPPROTO_DONE;
 229         }
 230 #ifndef GIF_ENCAPCHECK
 231         if (!gif_validate6(ip6, gifp->if_softc, m->m_pkthdr.rcvif)) {
 232                 m_freem(m);
 233                 IP6_STATINC(IP6_STAT_NOGIF);
 234                 return IPPROTO_DONE;
 235         }
 236 #endif
 237
 238         otos = ip6->ip6_flow;
 239         m_adj(m, *offp);
 240
 241         switch (proto) {
 242 #ifdef INET
 243         case IPPROTO_IPV4:
 244             {
 245                 struct ip *ip;
 246                 u_int8_t otos8;
 247                 af = AF_INET;
 248                 otos8 = (ntohl(otos) >> 20) & 0xff;
 249                 if (m->m_len < sizeof(*ip)) {
 250                         m = m_pullup(m, sizeof(*ip));
 251                         if (!m)
 252                                 return IPPROTO_DONE;
 253                 }
 254                 ip = mtod(m, struct ip *);
 255                 if (gifp->if_flags & IFF_LINK1)
 256                         ip_ecn_egress(ECN_ALLOWED, &otos8, &ip->ip_tos);
 257                 else
 258                         ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos);
 259                 break;
 260             }
 261 #endif /* INET */
 262 #ifdef INET6
 263         case IPPROTO_IPV6:
 264             {
 265                 struct ip6_hdr *ip6x;
 266                 af = AF_INET6;
 267                 if (m->m_len < sizeof(*ip6x)) {
 268                         m = m_pullup(m, sizeof(*ip6x));
 269                         if (!m)
 270                                 return IPPROTO_DONE;
 271                 }
 272                 ip6x = mtod(m, struct ip6_hdr *);
 273                 if (gifp->if_flags & IFF_LINK1)
 274                         ip6_ecn_egress(ECN_ALLOWED, &otos, &ip6x->ip6_flow);
 275                 else
 276                         ip6_ecn_egress(ECN_NOCARE, &otos, &ip6x->ip6_flow);
 277                 break;
 278             }
 279 #endif
 280 #ifdef ISO
 281         case IPPROTO_EON:
 282                 af = AF_ISO;
 283                 break;
 284 #endif
 285         default:
 286                 IP6_STATINC(IP6_STAT_NOGIF);
 287                 m_freem(m);
 288                 return IPPROTO_DONE;
 289         }
 290
 291         gif_input(m, af, gifp);
 292         return IPPROTO_DONE;
 293 }
 294
 295 /*
 296  * validate outer address.
 297  */
 298 static int
 299 gif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
 300         struct ifnet *ifp)
 301 {
 302         const struct sockaddr_in6 *src, *dst;
 303
 304         src = (struct sockaddr_in6 *)sc->gif_psrc;
 305         dst = (struct sockaddr_in6 *)sc->gif_pdst;
 306
 307         /* check for address match */
 308         if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
 309             !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
 310                 return 0;
 311
 312         /* martian filters on outer source - done in ip6_input */
 313
 314         /* ingress filters on outer source */
 315         if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) {
 316                 union {
 317                         struct sockaddr sa;
 318                         struct sockaddr_in6 sin6;
 319                 } u;
 320                 struct rtentry *rt;
 321
 322                 /* XXX scopeid */
 323                 sockaddr_in6_init(&u.sin6, &ip6->ip6_src, 0, 0, 0);
 324                 rt = rtalloc1(&u.sa, 0);
 325                 if (rt == NULL || rt->rt_ifp != ifp) {
 326 #if 0
 327                         log(LOG_WARNING, "%s: packet from %s dropped "
 328                             "due to ingress filter\n", if_name(&sc->gif_if),
 329                             ip6_sprintf(&u.sin6.sin6_addr));
 330 #endif
 331                         if (rt != NULL)
 332                                 rtfree(rt);
 333                         return 0;
 334                 }
 335                 rtfree(rt);
 336         }
 337
 338         return 128 * 2;
 339 }
 340
 341 #ifdef GIF_ENCAPCHECK
 342 /*
 343  * we know that we are in IFF_UP, outer address available, and outer family
 344  * matched the physical addr family.  see gif_encapcheck().
 345  */
 346 int
 347 gif_encapcheck6(struct mbuf *m, int off, int proto, void *arg)
 348 {
 349         struct ip6_hdr ip6;
 350         struct gif_softc *sc;
 351         struct ifnet *ifp;
 352
 353         /* sanity check done in caller */
 354         sc = arg;
 355
 356         m_copydata(m, 0, sizeof(ip6), (void *)&ip6);
 357         ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
 358
 359         return gif_validate6(&ip6, sc, ifp);
 360 }
 361 #endif
 362
 363 int
 364 in6_gif_attach(struct gif_softc *sc)
 365 {
 366 #ifndef GIF_ENCAPCHECK
 367         struct sockaddr_in6 mask6;
 368
 369         memset(&mask6, 0, sizeof(mask6));
 370         mask6.sin6_len = sizeof(struct sockaddr_in6);
 371         mask6.sin6_addr.s6_addr32[0] = mask6.sin6_addr.s6_addr32[1] =
 372             mask6.sin6_addr.s6_addr32[2] = mask6.sin6_addr.s6_addr32[3] = ~0;
 373
 374         if (!sc->gif_psrc || !sc->gif_pdst)
 375                 return EINVAL;
 376         sc->encap_cookie6 = encap_attach(AF_INET6, -1, sc->gif_psrc,
 377             (struct sockaddr *)&mask6, sc->gif_pdst, (struct sockaddr *)&mask6,
 378             (const void *)&in6_gif_protosw, sc);
 379 #else
 380         sc->encap_cookie6 = encap_attach_func(AF_INET6, -1, gif_encapcheck,
 381             (struct protosw *)&in6_gif_protosw, sc);
 382 #endif
 383         if (sc->encap_cookie6 == NULL)
 384                 return EEXIST;
 385         return 0;
 386 }
 387
 388 int
 389 in6_gif_detach(struct gif_softc *sc)
 390 {
 391         int error;
 392
 393         error = encap_detach(sc->encap_cookie6);
 394         if (error == 0)
 395                 sc->encap_cookie6 = NULL;
 396
 397         rtcache_free(&sc->gif_ro);
 398
 399         return error;
 400 }
 401
 402 void *
 403 in6_gif_ctlinput(int cmd, const struct sockaddr *sa, void *d)
 404 {
 405         struct gif_softc *sc;
 406         struct ip6ctlparam *ip6cp = NULL;
 407         struct ip6_hdr *ip6;
 408         const struct sockaddr_in6 *dst6;
 409
 410         if (sa->sa_family != AF_INET6 ||
 411             sa->sa_len != sizeof(struct sockaddr_in6))
 412                 return NULL;
 413
 414         if ((unsigned)cmd >= PRC_NCMDS)
 415                 return NULL;
 416         if (cmd == PRC_HOSTDEAD)
 417                 d = NULL;
 418         else if (inet6ctlerrmap[cmd] == 0)
 419                 return NULL;
 420
 421         /* if the parameter is from icmp6, decode it. */
 422         if (d != NULL) {
 423                 ip6cp = (struct ip6ctlparam *)d;
 424                 ip6 = ip6cp->ip6c_ip6;
 425         } else {
 426                 ip6 = NULL;
 427         }
 428
 429         if (!ip6)
 430                 return NULL;
 431
 432         /*
 433          * for now we don't care which type it was, just flush the route cache.
 434          * XXX slow.  sc (or sc->encap_cookie6) should be passed from
 435          * ip_encap.c.
 436          */
 437         LIST_FOREACH(sc, &gif_softc_list, gif_list) {
 438                 if ((sc->gif_if.if_flags & IFF_RUNNING) == 0)
 439                         continue;
 440                 if (sc->gif_psrc->sa_family != AF_INET6)
 441                         continue;
 442
 443                 dst6 = satocsin6(rtcache_getdst(&sc->gif_ro));
 444                 /* XXX scope */
 445                 if (dst6 == NULL)
 446                         ;
 447                 else if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst6->sin6_addr))
 448                         rtcache_free(&sc->gif_ro);
 449         }
 450
 451         return NULL;
 452 }
 453
 454 PR_WRAP_CTLINPUT(in6_gif_ctlinput)
 455 PR_WRAP_CTLOUTPUT(rip6_ctloutput)
 456 PR_WRAP_USRREQ(rip6_usrreq)
 457
 458 #define in6_gif_ctlinput        in6_gif_ctlinput_wrapper
 459 #define rip6_ctloutput          rip6_ctloutput_wrapper
 460 #define rip6_usrreq             rip6_usrreq_wrapper
 461
 462 extern struct domain inet6domain;
 463 const struct ip6protosw in6_gif_protosw =
 464 { SOCK_RAW,     &inet6domain,   0/* IPPROTO_IPV[46] */, PR_ATOMIC|PR_ADDR,
 465   in6_gif_input, rip6_output,   in6_gif_ctlinput, rip6_ctloutput,
 466   rip6_usrreq,
 467   0,            0,              0,              0,
 468 };