in_gif.c revision 172467
1174195Srwatson/* $KAME: in_gif.c,v 1.54 2001/05/14 14:02:16 itojun Exp $ */ 2174195Srwatson 3174195Srwatson/*- 4174195Srwatson * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5174195Srwatson * All rights reserved. 6174195Srwatson * 7174195Srwatson * Redistribution and use in source and binary forms, with or without 8174195Srwatson * modification, are permitted provided that the following conditions 9174195Srwatson * are met: 10174195Srwatson * 1. Redistributions of source code must retain the above copyright 11174195Srwatson * notice, this list of conditions and the following disclaimer. 12174195Srwatson * 2. Redistributions in binary form must reproduce the above copyright 13174195Srwatson * notice, this list of conditions and the following disclaimer in the 14174195Srwatson * documentation and/or other materials provided with the distribution. 15174195Srwatson * 3. Neither the name of the project nor the names of its contributors 16174195Srwatson * may be used to endorse or promote products derived from this software 17174195Srwatson * without specific prior written permission. 18174195Srwatson * 19174195Srwatson * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20174195Srwatson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21174195Srwatson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22174195Srwatson * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23174195Srwatson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24174195Srwatson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25174195Srwatson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26174195Srwatson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27174195Srwatson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28174195Srwatson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29174195Srwatson * SUCH DAMAGE. 30174195Srwatson */ 31174195Srwatson 32174195Srwatson#include <sys/cdefs.h> 33174195Srwatson__FBSDID("$FreeBSD: head/sys/netinet/in_gif.c 172467 2007-10-07 20:44:24Z silby $"); 34174195Srwatson 35174195Srwatson#include "opt_mrouting.h" 36174195Srwatson#include "opt_inet.h" 37174195Srwatson#include "opt_inet6.h" 38174195Srwatson 39174195Srwatson#include <sys/param.h> 40174195Srwatson#include <sys/systm.h> 41174195Srwatson#include <sys/socket.h> 42174195Srwatson#include <sys/sockio.h> 43#include <sys/mbuf.h> 44#include <sys/errno.h> 45#include <sys/kernel.h> 46#include <sys/sysctl.h> 47#include <sys/protosw.h> 48 49#include <sys/malloc.h> 50 51#include <net/if.h> 52#include <net/route.h> 53 54#include <netinet/in.h> 55#include <netinet/in_systm.h> 56#include <netinet/ip.h> 57#include <netinet/ip_var.h> 58#include <netinet/in_gif.h> 59#include <netinet/in_var.h> 60#include <netinet/ip_encap.h> 61#include <netinet/ip_ecn.h> 62 63#ifdef INET6 64#include <netinet/ip6.h> 65#endif 66 67#ifdef MROUTING 68#include <netinet/ip_mroute.h> 69#endif /* MROUTING */ 70 71#include <net/if_gif.h> 72 73static int gif_validate4(const struct ip *, struct gif_softc *, 74 struct ifnet *); 75 76extern struct domain inetdomain; 77struct protosw in_gif_protosw = { 78 .pr_type = SOCK_RAW, 79 .pr_domain = &inetdomain, 80 .pr_protocol = 0/* IPPROTO_IPV[46] */, 81 .pr_flags = PR_ATOMIC|PR_ADDR, 82 .pr_input = in_gif_input, 83 .pr_output = (pr_output_t*)rip_output, 84 .pr_ctloutput = rip_ctloutput, 85 .pr_usrreqs = &rip_usrreqs 86}; 87 88static int ip_gif_ttl = GIF_TTL; 89SYSCTL_INT(_net_inet_ip, IPCTL_GIF_TTL, gifttl, CTLFLAG_RW, 90 &ip_gif_ttl, 0, ""); 91 92int 93in_gif_output(struct ifnet *ifp, int family, struct mbuf *m) 94{ 95 struct gif_softc *sc = ifp->if_softc; 96 struct sockaddr_in *dst = (struct sockaddr_in *)&sc->gif_ro.ro_dst; 97 struct sockaddr_in *sin_src = (struct sockaddr_in *)sc->gif_psrc; 98 struct sockaddr_in *sin_dst = (struct sockaddr_in *)sc->gif_pdst; 99 struct ip iphdr; /* capsule IP header, host byte ordered */ 100 struct etherip_header eiphdr; 101 int proto, error; 102 u_int8_t tos; 103 104 GIF_LOCK_ASSERT(sc); 105 106 if (sin_src == NULL || sin_dst == NULL || 107 sin_src->sin_family != AF_INET || 108 sin_dst->sin_family != AF_INET) { 109 m_freem(m); 110 return EAFNOSUPPORT; 111 } 112 113 switch (family) { 114#ifdef INET 115 case AF_INET: 116 { 117 struct ip *ip; 118 119 proto = IPPROTO_IPV4; 120 if (m->m_len < sizeof(*ip)) { 121 m = m_pullup(m, sizeof(*ip)); 122 if (!m) 123 return ENOBUFS; 124 } 125 ip = mtod(m, struct ip *); 126 tos = ip->ip_tos; 127 break; 128 } 129#endif /* INET */ 130#ifdef INET6 131 case AF_INET6: 132 { 133 struct ip6_hdr *ip6; 134 proto = IPPROTO_IPV6; 135 if (m->m_len < sizeof(*ip6)) { 136 m = m_pullup(m, sizeof(*ip6)); 137 if (!m) 138 return ENOBUFS; 139 } 140 ip6 = mtod(m, struct ip6_hdr *); 141 tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 142 break; 143 } 144#endif /* INET6 */ 145 case AF_LINK: 146 proto = IPPROTO_ETHERIP; 147 eiphdr.eip_ver = ETHERIP_VERSION & ETHERIP_VER_VERS_MASK; 148 eiphdr.eip_pad = 0; 149 /* prepend Ethernet-in-IP header */ 150 M_PREPEND(m, sizeof(struct etherip_header), M_DONTWAIT); 151 if (m && m->m_len < sizeof(struct etherip_header)) 152 m = m_pullup(m, sizeof(struct etherip_header)); 153 if (m == NULL) 154 return ENOBUFS; 155 bcopy(&eiphdr, mtod(m, struct etherip_header *), 156 sizeof(struct etherip_header)); 157 break; 158 159 default: 160#ifdef DEBUG 161 printf("in_gif_output: warning: unknown family %d passed\n", 162 family); 163#endif 164 m_freem(m); 165 return EAFNOSUPPORT; 166 } 167 168 bzero(&iphdr, sizeof(iphdr)); 169 iphdr.ip_src = sin_src->sin_addr; 170 /* bidirectional configured tunnel mode */ 171 if (sin_dst->sin_addr.s_addr != INADDR_ANY) 172 iphdr.ip_dst = sin_dst->sin_addr; 173 else { 174 m_freem(m); 175 return ENETUNREACH; 176 } 177 iphdr.ip_p = proto; 178 /* version will be set in ip_output() */ 179 iphdr.ip_ttl = ip_gif_ttl; 180 iphdr.ip_len = m->m_pkthdr.len + sizeof(struct ip); 181 ip_ecn_ingress((ifp->if_flags & IFF_LINK1) ? ECN_ALLOWED : ECN_NOCARE, 182 &iphdr.ip_tos, &tos); 183 184 /* prepend new IP header */ 185 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 186 if (m && m->m_len < sizeof(struct ip)) 187 m = m_pullup(m, sizeof(struct ip)); 188 if (m == NULL) { 189 printf("ENOBUFS in in_gif_output %d\n", __LINE__); 190 return ENOBUFS; 191 } 192 bcopy(&iphdr, mtod(m, struct ip *), sizeof(struct ip)); 193 194 if (dst->sin_family != sin_dst->sin_family || 195 dst->sin_addr.s_addr != sin_dst->sin_addr.s_addr) { 196 /* cache route doesn't match */ 197 bzero(dst, sizeof(*dst)); 198 dst->sin_family = sin_dst->sin_family; 199 dst->sin_len = sizeof(struct sockaddr_in); 200 dst->sin_addr = sin_dst->sin_addr; 201 if (sc->gif_ro.ro_rt) { 202 RTFREE(sc->gif_ro.ro_rt); 203 sc->gif_ro.ro_rt = NULL; 204 } 205#if 0 206 GIF2IFP(sc)->if_mtu = GIF_MTU; 207#endif 208 } 209 210 if (sc->gif_ro.ro_rt == NULL) { 211 rtalloc_ign(&sc->gif_ro, 0); 212 if (sc->gif_ro.ro_rt == NULL) { 213 m_freem(m); 214 return ENETUNREACH; 215 } 216 217 /* if it constitutes infinite encapsulation, punt. */ 218 if (sc->gif_ro.ro_rt->rt_ifp == ifp) { 219 m_freem(m); 220 return ENETUNREACH; /* XXX */ 221 } 222#if 0 223 ifp->if_mtu = sc->gif_ro.ro_rt->rt_ifp->if_mtu 224 - sizeof(struct ip); 225#endif 226 } 227 228 error = ip_output(m, NULL, &sc->gif_ro, 0, NULL, NULL); 229 230 if (!(GIF2IFP(sc)->if_flags & IFF_LINK0) && 231 sc->gif_ro.ro_rt != NULL) { 232 RTFREE(sc->gif_ro.ro_rt); 233 sc->gif_ro.ro_rt = NULL; 234 } 235 236 return (error); 237} 238 239void 240in_gif_input(struct mbuf *m, int off) 241{ 242 struct ifnet *gifp = NULL; 243 struct gif_softc *sc; 244 struct ip *ip; 245 int af; 246 u_int8_t otos; 247 int proto; 248 249 ip = mtod(m, struct ip *); 250 proto = ip->ip_p; 251 252 sc = (struct gif_softc *)encap_getarg(m); 253 if (sc == NULL) { 254 m_freem(m); 255 ipstat.ips_nogif++; 256 return; 257 } 258 259 gifp = GIF2IFP(sc); 260 if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) { 261 m_freem(m); 262 ipstat.ips_nogif++; 263 return; 264 } 265 266 otos = ip->ip_tos; 267 m_adj(m, off); 268 269 switch (proto) { 270#ifdef INET 271 case IPPROTO_IPV4: 272 { 273 struct ip *ip; 274 af = AF_INET; 275 if (m->m_len < sizeof(*ip)) { 276 m = m_pullup(m, sizeof(*ip)); 277 if (!m) 278 return; 279 } 280 ip = mtod(m, struct ip *); 281 if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ? 282 ECN_ALLOWED : ECN_NOCARE, 283 &otos, &ip->ip_tos) == 0) { 284 m_freem(m); 285 return; 286 } 287 break; 288 } 289#endif 290#ifdef INET6 291 case IPPROTO_IPV6: 292 { 293 struct ip6_hdr *ip6; 294 u_int8_t itos, oitos; 295 296 af = AF_INET6; 297 if (m->m_len < sizeof(*ip6)) { 298 m = m_pullup(m, sizeof(*ip6)); 299 if (!m) 300 return; 301 } 302 ip6 = mtod(m, struct ip6_hdr *); 303 itos = oitos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 304 if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ? 305 ECN_ALLOWED : ECN_NOCARE, 306 &otos, &itos) == 0) { 307 m_freem(m); 308 return; 309 } 310 if (itos != oitos) { 311 ip6->ip6_flow &= ~htonl(0xff << 20); 312 ip6->ip6_flow |= htonl((u_int32_t)itos << 20); 313 } 314 break; 315 } 316#endif /* INET6 */ 317 case IPPROTO_ETHERIP: 318 af = AF_LINK; 319 break; 320 321 default: 322 ipstat.ips_nogif++; 323 m_freem(m); 324 return; 325 } 326 gif_input(m, af, gifp); 327 return; 328} 329 330/* 331 * validate outer address. 332 */ 333static int 334gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp) 335{ 336 struct sockaddr_in *src, *dst; 337 struct in_ifaddr *ia4; 338 339 src = (struct sockaddr_in *)sc->gif_psrc; 340 dst = (struct sockaddr_in *)sc->gif_pdst; 341 342 /* check for address match */ 343 if (src->sin_addr.s_addr != ip->ip_dst.s_addr || 344 dst->sin_addr.s_addr != ip->ip_src.s_addr) 345 return 0; 346 347 /* martian filters on outer source - NOT done in ip_input! */ 348 if (IN_MULTICAST(ntohl(ip->ip_src.s_addr))) 349 return 0; 350 switch ((ntohl(ip->ip_src.s_addr) & 0xff000000) >> 24) { 351 case 0: case 127: case 255: 352 return 0; 353 } 354 /* reject packets with broadcast on source */ 355 TAILQ_FOREACH(ia4, &in_ifaddrhead, ia_link) { 356 if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0) 357 continue; 358 if (ip->ip_src.s_addr == ia4->ia_broadaddr.sin_addr.s_addr) 359 return 0; 360 } 361 362 /* ingress filters on outer source */ 363 if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0 && ifp) { 364 struct sockaddr_in sin; 365 struct rtentry *rt; 366 367 bzero(&sin, sizeof(sin)); 368 sin.sin_family = AF_INET; 369 sin.sin_len = sizeof(struct sockaddr_in); 370 sin.sin_addr = ip->ip_src; 371 rt = rtalloc1((struct sockaddr *)&sin, 0, 0UL); 372 if (!rt || rt->rt_ifp != ifp) { 373#if 0 374 log(LOG_WARNING, "%s: packet from 0x%x dropped " 375 "due to ingress filter\n", if_name(GIF2IFP(sc)), 376 (u_int32_t)ntohl(sin.sin_addr.s_addr)); 377#endif 378 if (rt) 379 RTFREE_LOCKED(rt); 380 return 0; 381 } 382 RTFREE_LOCKED(rt); 383 } 384 385 return 32 * 2; 386} 387 388/* 389 * we know that we are in IFF_UP, outer address available, and outer family 390 * matched the physical addr family. see gif_encapcheck(). 391 */ 392int 393gif_encapcheck4(const struct mbuf *m, int off, int proto, void *arg) 394{ 395 struct ip ip; 396 struct gif_softc *sc; 397 struct ifnet *ifp; 398 399 /* sanity check done in caller */ 400 sc = (struct gif_softc *)arg; 401 402 /* LINTED const cast */ 403 m_copydata(m, 0, sizeof(ip), (caddr_t)&ip); 404 ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL; 405 406 return gif_validate4(&ip, sc, ifp); 407} 408 409int 410in_gif_attach(struct gif_softc *sc) 411{ 412 sc->encap_cookie4 = encap_attach_func(AF_INET, -1, gif_encapcheck, 413 &in_gif_protosw, sc); 414 if (sc->encap_cookie4 == NULL) 415 return EEXIST; 416 return 0; 417} 418 419int 420in_gif_detach(struct gif_softc *sc) 421{ 422 int error; 423 424 error = encap_detach(sc->encap_cookie4); 425 if (error == 0) 426 sc->encap_cookie4 = NULL; 427 return error; 428} 429