1/*	$KAME: ip_ecn.c,v 1.12 2002/01/07 11:34:47 kjc Exp $	*/
2
3/*-
4 * Copyright (C) 1999 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 *    may be used to endorse or promote products derived from this software
17 *    without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 */
32/*
33 * ECN consideration on tunnel ingress/egress operation.
34 * http://www.aciri.org/floyd/papers/draft-ipsec-ecn-00.txt
35 */
36
37#include <sys/cdefs.h>
38__FBSDID("$FreeBSD$");
39
40#include "opt_inet.h"
41#include "opt_inet6.h"
42
43#include <sys/param.h>
44#include <sys/systm.h>
45#include <sys/mbuf.h>
46#include <sys/errno.h>
47
48#include <netinet/in.h>
49#include <netinet/in_systm.h>
50#include <netinet/ip.h>
51#ifdef INET6
52#include <netinet/ip6.h>
53#endif
54
55#include <netinet/ip_ecn.h>
56#ifdef INET6
57#include <netinet6/ip6_ecn.h>
58#endif
59
60/*
61 * ECN and TOS (or TCLASS) processing rules at tunnel encapsulation and
62 * decapsulation from RFC3168:
63 *
64 *                      Outer Hdr at                 Inner Hdr at
65 *                      Encapsulator                 Decapsulator
66 *   Header fields:     --------------------         ------------
67 *     DS Field         copied from inner hdr        no change
68 *     ECN Field        constructed by (I)           constructed by (E)
69 *
70 * ECN_ALLOWED (full functionality):
71 *    (I) if the ECN field in the inner header is set to CE, then set the
72 *    ECN field in the outer header to ECT(0).
73 *    otherwise, copy the ECN field to the outer header.
74 *
75 *    (E) if the ECN field in the outer header is set to CE and the ECN
76 *    field of the inner header is not-ECT, drop the packet.
77 *    if the ECN field in the inner header is set to ECT(0) or ECT(1)
78 *    and the ECN field in the outer header is set to CE, then copy CE to
79 *    the inner header.  otherwise, make no change to the inner header.
80 *
81 * ECN_FORBIDDEN (limited functionality):
82 *    (I) set the ECN field to not-ECT in the outer header.
83 *
84 *    (E) if the ECN field in the outer header is set to CE, drop the packet.
85 *    otherwise, make no change to the ECN field in the inner header.
86 *
87 * the drop rule is for backward compatibility and protection against
88 * erasure of CE.
89 */
90
91/*
92 * modify outer ECN (TOS) field on ingress operation (tunnel encapsulation).
93 */
94void
95ip_ecn_ingress(int mode, u_int8_t *outer, const u_int8_t *inner)
96{
97
98	if (!outer || !inner)
99		panic("NULL pointer passed to ip_ecn_ingress");
100
101	*outer = *inner;
102	switch (mode) {
103	case ECN_ALLOWED:		/* ECN allowed */
104		/*
105		 * full-functionality: if the inner is CE, set ECT(0)
106		 * to the outer.  otherwise, copy the ECN field.
107		 */
108		if ((*inner & IPTOS_ECN_MASK) == IPTOS_ECN_CE)
109			*outer &= ~IPTOS_ECN_ECT1;
110		break;
111	case ECN_FORBIDDEN:		/* ECN forbidden */
112		/*
113		 * limited-functionality: set not-ECT to the outer
114		 */
115		*outer &= ~IPTOS_ECN_MASK;
116		break;
117	case ECN_NOCARE:	/* no consideration to ECN */
118		break;
119	}
120}
121
122/*
123 * modify inner ECN (TOS) field on egress operation (tunnel decapsulation).
124 * the caller should drop the packet if the return value is 0.
125 */
126int
127ip_ecn_egress(int mode, const u_int8_t *outer, u_int8_t *inner)
128{
129
130	if (!outer || !inner)
131		panic("NULL pointer passed to ip_ecn_egress");
132
133	switch (mode) {
134	case ECN_ALLOWED:
135		/*
136		 * full-functionality: if the outer is CE and the inner is
137		 * not-ECT, should drop it.  otherwise, copy CE.
138		 */
139		if ((*outer & IPTOS_ECN_MASK) == IPTOS_ECN_CE) {
140			if ((*inner & IPTOS_ECN_MASK) == IPTOS_ECN_NOTECT)
141				return (0);
142			*inner |= IPTOS_ECN_CE;
143		}
144		break;
145	case ECN_FORBIDDEN:		/* ECN forbidden */
146		/*
147		 * limited-functionality: if the outer is CE, should drop it.
148		 * otherwise, leave the inner.
149		 */
150		if ((*outer & IPTOS_ECN_MASK) == IPTOS_ECN_CE)
151			return (0);
152		break;
153	case ECN_NOCARE:	/* no consideration to ECN */
154		break;
155	}
156	return (1);
157}
158
159#ifdef INET6
160void
161ip6_ecn_ingress(int mode, u_int32_t *outer, const u_int32_t *inner)
162{
163	u_int8_t outer8, inner8;
164
165	if (!outer || !inner)
166		panic("NULL pointer passed to ip6_ecn_ingress");
167
168	inner8 = (ntohl(*inner) >> 20) & 0xff;
169	ip_ecn_ingress(mode, &outer8, &inner8);
170	*outer &= ~htonl(0xff << 20);
171	*outer |= htonl((u_int32_t)outer8 << 20);
172}
173
174int
175ip6_ecn_egress(int mode, const u_int32_t *outer, u_int32_t *inner)
176{
177	u_int8_t outer8, inner8, oinner8;
178
179	if (!outer || !inner)
180		panic("NULL pointer passed to ip6_ecn_egress");
181
182	outer8 = (ntohl(*outer) >> 20) & 0xff;
183	inner8 = oinner8 = (ntohl(*inner) >> 20) & 0xff;
184	if (ip_ecn_egress(mode, &outer8, &inner8) == 0)
185		return (0);
186	if (inner8 != oinner8) {
187		*inner &= ~htonl(0xff << 20);
188		*inner |= htonl((u_int32_t)inner8 << 20);
189	}
190	return (1);
191}
192#endif
193