in6_gif.c revision 171259
162587Sitojun/*	$FreeBSD: head/sys/netinet6/in6_gif.c 171259 2007-07-05 16:23:49Z delphij $	*/
278064Sume/*	$KAME: in6_gif.c,v 1.49 2001/05/14 14:02:17 itojun Exp $	*/
362587Sitojun
4139826Simp/*-
554263Sshin * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
654263Sshin * All rights reserved.
754263Sshin *
854263Sshin * Redistribution and use in source and binary forms, with or without
954263Sshin * modification, are permitted provided that the following conditions
1054263Sshin * are met:
1154263Sshin * 1. Redistributions of source code must retain the above copyright
1254263Sshin *    notice, this list of conditions and the following disclaimer.
1354263Sshin * 2. Redistributions in binary form must reproduce the above copyright
1454263Sshin *    notice, this list of conditions and the following disclaimer in the
1554263Sshin *    documentation and/or other materials provided with the distribution.
1654263Sshin * 3. Neither the name of the project nor the names of its contributors
1754263Sshin *    may be used to endorse or promote products derived from this software
1854263Sshin *    without specific prior written permission.
1954263Sshin *
2054263Sshin * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
2154263Sshin * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
2254263Sshin * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
2354263Sshin * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
2454263Sshin * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
2554263Sshin * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
2654263Sshin * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2754263Sshin * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2854263Sshin * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2954263Sshin * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
3054263Sshin * SUCH DAMAGE.
3154263Sshin */
3254263Sshin
3354263Sshin#include "opt_inet.h"
3462587Sitojun#include "opt_inet6.h"
3554263Sshin
3654263Sshin#include <sys/param.h>
3754263Sshin#include <sys/systm.h>
3854263Sshin#include <sys/socket.h>
3954263Sshin#include <sys/sockio.h>
4054263Sshin#include <sys/mbuf.h>
4154263Sshin#include <sys/errno.h>
4278064Sume#include <sys/queue.h>
4378064Sume#include <sys/syslog.h>
44105293Sume#include <sys/protosw.h>
4554263Sshin
4678064Sume#include <sys/malloc.h>
4778064Sume
4854263Sshin#include <net/if.h>
4954263Sshin#include <net/route.h>
5054263Sshin
5154263Sshin#include <netinet/in.h>
5254263Sshin#include <netinet/in_systm.h>
5354263Sshin#ifdef INET
5454263Sshin#include <netinet/ip.h>
5554263Sshin#endif
5662587Sitojun#include <netinet/ip_encap.h>
5762587Sitojun#ifdef INET6
5862587Sitojun#include <netinet/ip6.h>
5954263Sshin#include <netinet6/ip6_var.h>
6054263Sshin#include <netinet6/in6_gif.h>
6162587Sitojun#include <netinet6/in6_var.h>
6262587Sitojun#endif
63105293Sume#include <netinet6/ip6protosw.h>
6455009Sshin#include <netinet/ip_ecn.h>
6562587Sitojun#ifdef INET6
6655009Sshin#include <netinet6/ip6_ecn.h>
6762587Sitojun#endif
6854263Sshin
6954263Sshin#include <net/if_gif.h>
7054263Sshin
71105293Sumestatic int gif_validate6(const struct ip6_hdr *, struct gif_softc *,
72105293Sume			 struct ifnet *);
73105293Sume
74105293Sumeextern  struct domain inet6domain;
75105293Sumestruct ip6protosw in6_gif_protosw =
76120913Sume{ SOCK_RAW,	&inet6domain,	0/* IPPROTO_IPV[46] */,	PR_ATOMIC|PR_ADDR,
77105293Sume  in6_gif_input, rip6_output,	0,		rip6_ctloutput,
78105293Sume  0,
79105293Sume  0,		0,		0,		0,
80105293Sume  &rip6_usrreqs
81105293Sume};
82105293Sume
8354263Sshinint
84171259Sdelphijin6_gif_output(struct ifnet *ifp,
85171259Sdelphij    int family,			/* family of the packet to be encapsulate */
86171259Sdelphij    struct mbuf *m)
8754263Sshin{
88147256Sbrooks	struct gif_softc *sc = ifp->if_softc;
8954263Sshin	struct sockaddr_in6 *dst = (struct sockaddr_in6 *)&sc->gif_ro6.ro_dst;
9054263Sshin	struct sockaddr_in6 *sin6_src = (struct sockaddr_in6 *)sc->gif_psrc;
9154263Sshin	struct sockaddr_in6 *sin6_dst = (struct sockaddr_in6 *)sc->gif_pdst;
9254263Sshin	struct ip6_hdr *ip6;
93153621Sthompsa	struct etherip_header eiphdr;
94138619Sglebius	int proto, error;
9555009Sshin	u_int8_t itos, otos;
9654263Sshin
97155037Sglebius	GIF_LOCK_ASSERT(sc);
98155037Sglebius
9954263Sshin	if (sin6_src == NULL || sin6_dst == NULL ||
10054263Sshin	    sin6_src->sin6_family != AF_INET6 ||
10154263Sshin	    sin6_dst->sin6_family != AF_INET6) {
10254263Sshin		m_freem(m);
10354263Sshin		return EAFNOSUPPORT;
10454263Sshin	}
10554263Sshin
10654263Sshin	switch (family) {
10754263Sshin#ifdef INET
10854263Sshin	case AF_INET:
10954263Sshin	    {
11054263Sshin		struct ip *ip;
11154263Sshin
11254263Sshin		proto = IPPROTO_IPV4;
11354263Sshin		if (m->m_len < sizeof(*ip)) {
11454263Sshin			m = m_pullup(m, sizeof(*ip));
11554263Sshin			if (!m)
11654263Sshin				return ENOBUFS;
11754263Sshin		}
11854263Sshin		ip = mtod(m, struct ip *);
11955009Sshin		itos = ip->ip_tos;
12054263Sshin		break;
12154263Sshin	    }
12254263Sshin#endif
12362587Sitojun#ifdef INET6
12454263Sshin	case AF_INET6:
12554263Sshin	    {
12654263Sshin		struct ip6_hdr *ip6;
12754263Sshin		proto = IPPROTO_IPV6;
12854263Sshin		if (m->m_len < sizeof(*ip6)) {
12954263Sshin			m = m_pullup(m, sizeof(*ip6));
13054263Sshin			if (!m)
13154263Sshin				return ENOBUFS;
13254263Sshin		}
13354263Sshin		ip6 = mtod(m, struct ip6_hdr *);
13455009Sshin		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
13554263Sshin		break;
13654263Sshin	    }
13762587Sitojun#endif
138153621Sthompsa	case AF_LINK:
139153621Sthompsa 		proto = IPPROTO_ETHERIP;
140153621Sthompsa 		eiphdr.eip_ver = ETHERIP_VERSION & ETHERIP_VER_VERS_MASK;
141153621Sthompsa 		eiphdr.eip_pad = 0;
142153621Sthompsa 		/* prepend Ethernet-in-IP header */
143153621Sthompsa 		M_PREPEND(m, sizeof(struct etherip_header), M_DONTWAIT);
144153621Sthompsa 		if (m && m->m_len < sizeof(struct etherip_header))
145153621Sthompsa 			m = m_pullup(m, sizeof(struct etherip_header));
146153621Sthompsa 		if (m == NULL)
147153621Sthompsa 			return ENOBUFS;
148153621Sthompsa 		bcopy(&eiphdr, mtod(m, struct etherip_header *),
149153621Sthompsa		    sizeof(struct etherip_header));
150153621Sthompsa		break;
151153621Sthompsa
15254263Sshin	default:
15362587Sitojun#ifdef DEBUG
15454263Sshin		printf("in6_gif_output: warning: unknown family %d passed\n",
15554263Sshin			family);
15654263Sshin#endif
15754263Sshin		m_freem(m);
15854263Sshin		return EAFNOSUPPORT;
15954263Sshin	}
160120913Sume
16154263Sshin	/* prepend new IP header */
162111119Simp	M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
16354263Sshin	if (m && m->m_len < sizeof(struct ip6_hdr))
16454263Sshin		m = m_pullup(m, sizeof(struct ip6_hdr));
16554263Sshin	if (m == NULL) {
16654263Sshin		printf("ENOBUFS in in6_gif_output %d\n", __LINE__);
16754263Sshin		return ENOBUFS;
16854263Sshin	}
16954263Sshin
17054263Sshin	ip6 = mtod(m, struct ip6_hdr *);
17154263Sshin	ip6->ip6_flow	= 0;
17262587Sitojun	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
17362587Sitojun	ip6->ip6_vfc	|= IPV6_VERSION;
17454263Sshin	ip6->ip6_plen	= htons((u_short)m->m_pkthdr.len);
17554263Sshin	ip6->ip6_nxt	= proto;
17654263Sshin	ip6->ip6_hlim	= ip6_gif_hlim;
17754263Sshin	ip6->ip6_src	= sin6_src->sin6_addr;
17878064Sume	/* bidirectional configured tunnel mode */
17978064Sume	if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr))
18078064Sume		ip6->ip6_dst = sin6_dst->sin6_addr;
18178064Sume	else  {
18278064Sume		m_freem(m);
18378064Sume		return ENETUNREACH;
18454263Sshin	}
185121684Sume	ip_ecn_ingress((ifp->if_flags & IFF_LINK1) ? ECN_ALLOWED : ECN_NOCARE,
186121684Sume		       &otos, &itos);
187121684Sume	ip6->ip6_flow &= ~htonl(0xff << 20);
18878064Sume	ip6->ip6_flow |= htonl((u_int32_t)otos << 20);
18954263Sshin
19054263Sshin	if (dst->sin6_family != sin6_dst->sin6_family ||
19154263Sshin	     !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &sin6_dst->sin6_addr)) {
19254263Sshin		/* cache route doesn't match */
19354263Sshin		bzero(dst, sizeof(*dst));
19454263Sshin		dst->sin6_family = sin6_dst->sin6_family;
19554263Sshin		dst->sin6_len = sizeof(struct sockaddr_in6);
19654263Sshin		dst->sin6_addr = sin6_dst->sin6_addr;
19754263Sshin		if (sc->gif_ro6.ro_rt) {
19854263Sshin			RTFREE(sc->gif_ro6.ro_rt);
19954263Sshin			sc->gif_ro6.ro_rt = NULL;
20054263Sshin		}
20162587Sitojun#if 0
202147256Sbrooks		GIF2IFP(sc)->if_mtu = GIF_MTU;
20362587Sitojun#endif
20454263Sshin	}
20554263Sshin
20654263Sshin	if (sc->gif_ro6.ro_rt == NULL) {
20754263Sshin		rtalloc((struct route *)&sc->gif_ro6);
20854263Sshin		if (sc->gif_ro6.ro_rt == NULL) {
20954263Sshin			m_freem(m);
21054263Sshin			return ENETUNREACH;
21154263Sshin		}
21262587Sitojun
21362587Sitojun		/* if it constitutes infinite encapsulation, punt. */
21462587Sitojun		if (sc->gif_ro.ro_rt->rt_ifp == ifp) {
21562587Sitojun			m_freem(m);
21662587Sitojun			return ENETUNREACH;	/*XXX*/
21762587Sitojun		}
21862587Sitojun#if 0
21962587Sitojun		ifp->if_mtu = sc->gif_ro6.ro_rt->rt_ifp->if_mtu
22062587Sitojun			- sizeof(struct ip6_hdr);
22162587Sitojun#endif
22254263Sshin	}
223120913Sume
22462587Sitojun#ifdef IPV6_MINMTU
22562587Sitojun	/*
22662587Sitojun	 * force fragmentation to minimum MTU, to avoid path MTU discovery.
22762587Sitojun	 * it is too painful to ask for resend of inner packet, to achieve
22862587Sitojun	 * path MTU discovery for encapsulated packets.
22962587Sitojun	 */
230138620Sglebius	error = ip6_output(m, 0, &sc->gif_ro6, IPV6_MINMTU, 0, NULL, NULL);
23162587Sitojun#else
232138620Sglebius	error = ip6_output(m, 0, &sc->gif_ro6, 0, 0, NULL, NULL);
23362587Sitojun#endif
234138619Sglebius
235147256Sbrooks	if (!(GIF2IFP(sc)->if_flags & IFF_LINK0) &&
236138653Sglebius	    sc->gif_ro6.ro_rt != NULL) {
237138619Sglebius		RTFREE(sc->gif_ro6.ro_rt);
238138619Sglebius		sc->gif_ro6.ro_rt = NULL;
239138619Sglebius	}
240138619Sglebius
241138619Sglebius	return (error);
24254263Sshin}
24354263Sshin
244120913Sumeint
245171259Sdelphijin6_gif_input(struct mbuf **mp, int *offp, int proto)
24654263Sshin{
24754263Sshin	struct mbuf *m = *mp;
24854263Sshin	struct ifnet *gifp = NULL;
249147507Sume	struct gif_softc *sc;
25054263Sshin	struct ip6_hdr *ip6;
25154263Sshin	int af = 0;
25255009Sshin	u_int32_t otos;
25354263Sshin
25454263Sshin	ip6 = mtod(m, struct ip6_hdr *);
25554263Sshin
256147507Sume	sc = (struct gif_softc *)encap_getarg(m);
257147507Sume	if (sc == NULL) {
258147507Sume		m_freem(m);
259147507Sume		ip6stat.ip6s_nogif++;
260147507Sume		return IPPROTO_DONE;
261147507Sume	}
26254263Sshin
263147507Sume	gifp = GIF2IFP(sc);
26462587Sitojun	if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) {
26554263Sshin		m_freem(m);
26654263Sshin		ip6stat.ip6s_nogif++;
26754263Sshin		return IPPROTO_DONE;
26854263Sshin	}
26962587Sitojun
27055009Sshin	otos = ip6->ip6_flow;
27154263Sshin	m_adj(m, *offp);
27254263Sshin
27354263Sshin	switch (proto) {
27454263Sshin#ifdef INET
27554263Sshin	case IPPROTO_IPV4:
27654263Sshin	    {
27754263Sshin		struct ip *ip;
27855009Sshin		u_int8_t otos8;
27954263Sshin		af = AF_INET;
28055009Sshin		otos8 = (ntohl(otos) >> 20) & 0xff;
28154263Sshin		if (m->m_len < sizeof(*ip)) {
28254263Sshin			m = m_pullup(m, sizeof(*ip));
28354263Sshin			if (!m)
28454263Sshin				return IPPROTO_DONE;
28554263Sshin		}
28654263Sshin		ip = mtod(m, struct ip *);
287121684Sume		if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ?
288121684Sume				  ECN_ALLOWED : ECN_NOCARE,
289121684Sume				  &otos8, &ip->ip_tos) == 0) {
290121684Sume			m_freem(m);
291121684Sume			return IPPROTO_DONE;
292121684Sume		}
29354263Sshin		break;
29454263Sshin	    }
29554263Sshin#endif /* INET */
29662587Sitojun#ifdef INET6
29754263Sshin	case IPPROTO_IPV6:
29854263Sshin	    {
29954263Sshin		struct ip6_hdr *ip6;
30054263Sshin		af = AF_INET6;
30154263Sshin		if (m->m_len < sizeof(*ip6)) {
30254263Sshin			m = m_pullup(m, sizeof(*ip6));
30354263Sshin			if (!m)
30454263Sshin				return IPPROTO_DONE;
30554263Sshin		}
30654263Sshin		ip6 = mtod(m, struct ip6_hdr *);
307121684Sume		if (ip6_ecn_egress((gifp->if_flags & IFF_LINK1) ?
308121684Sume				   ECN_ALLOWED : ECN_NOCARE,
309121684Sume				   &otos, &ip6->ip6_flow) == 0) {
310121684Sume			m_freem(m);
311121684Sume			return IPPROTO_DONE;
312121684Sume		}
31354263Sshin		break;
31454263Sshin	    }
31562587Sitojun#endif
316153621Sthompsa 	case IPPROTO_ETHERIP:
317153621Sthompsa 		af = AF_LINK;
318153621Sthompsa 		break;
319153621Sthompsa
32054263Sshin	default:
32154263Sshin		ip6stat.ip6s_nogif++;
32254263Sshin		m_freem(m);
32354263Sshin		return IPPROTO_DONE;
32454263Sshin	}
325120913Sume
32654263Sshin	gif_input(m, af, gifp);
32754263Sshin	return IPPROTO_DONE;
32854263Sshin}
32962587Sitojun
33062587Sitojun/*
331105293Sume * validate outer address.
33262587Sitojun */
333105293Sumestatic int
334171259Sdelphijgif_validate6(const struct ip6_hdr *ip6, struct gif_softc *sc,
335171259Sdelphij    struct ifnet *ifp)
33662587Sitojun{
33762587Sitojun	struct sockaddr_in6 *src, *dst;
33862587Sitojun
33962587Sitojun	src = (struct sockaddr_in6 *)sc->gif_psrc;
34062587Sitojun	dst = (struct sockaddr_in6 *)sc->gif_pdst;
34162587Sitojun
342105293Sume	/*
343105293Sume	 * Check for address match.  Note that the check is for an incoming
344105293Sume	 * packet.  We should compare the *source* address in our configuration
345105293Sume	 * and the *destination* address of the packet, and vice versa.
346105293Sume	 */
347105293Sume	if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) ||
348105293Sume	    !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src))
34962587Sitojun		return 0;
35062587Sitojun
35162587Sitojun	/* martian filters on outer source - done in ip6_input */
35262587Sitojun
35362587Sitojun	/* ingress filters on outer source */
354147256Sbrooks	if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0 && ifp) {
35562587Sitojun		struct sockaddr_in6 sin6;
35662587Sitojun		struct rtentry *rt;
35762587Sitojun
35862587Sitojun		bzero(&sin6, sizeof(sin6));
35962587Sitojun		sin6.sin6_family = AF_INET6;
36062587Sitojun		sin6.sin6_len = sizeof(struct sockaddr_in6);
361105293Sume		sin6.sin6_addr = ip6->ip6_src;
362105293Sume		sin6.sin6_scope_id = 0; /* XXX */
363105293Sume
36462587Sitojun		rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
365105293Sume		if (!rt || rt->rt_ifp != ifp) {
36678064Sume#if 0
367165118Sbz			char ip6buf[INET6_ADDRSTRLEN];
36878064Sume			log(LOG_WARNING, "%s: packet from %s dropped "
369147256Sbrooks			    "due to ingress filter\n", if_name(GIF2IFP(sc)),
370165118Sbz			    ip6_sprintf(ip6buf, &sin6.sin6_addr));
37178064Sume#endif
37278064Sume			if (rt)
37378064Sume				rtfree(rt);
37462587Sitojun			return 0;
37562587Sitojun		}
37662587Sitojun		rtfree(rt);
37762587Sitojun	}
37862587Sitojun
37978064Sume	return 128 * 2;
38062587Sitojun}
381105293Sume
382105293Sume/*
383105293Sume * we know that we are in IFF_UP, outer address available, and outer family
384105293Sume * matched the physical addr family.  see gif_encapcheck().
385105293Sume * sanity check for arg should have been done in the caller.
386105293Sume */
387105293Sumeint
388171259Sdelphijgif_encapcheck6(const struct mbuf *m, int off, int proto, void *arg)
389105293Sume{
390105293Sume	struct ip6_hdr ip6;
391105293Sume	struct gif_softc *sc;
392105293Sume	struct ifnet *ifp;
393105293Sume
394105293Sume	/* sanity check done in caller */
395105293Sume	sc = (struct gif_softc *)arg;
396105293Sume
397105293Sume	/* LINTED const cast */
398105293Sume	m_copydata(m, 0, sizeof(ip6), (caddr_t)&ip6);
399105293Sume	ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
400105293Sume
401105293Sume	return gif_validate6(&ip6, sc, ifp);
402105293Sume}
403105293Sume
404105293Sumeint
405171259Sdelphijin6_gif_attach(struct gif_softc *sc)
406105293Sume{
407105293Sume	sc->encap_cookie6 = encap_attach_func(AF_INET6, -1, gif_encapcheck,
408155333Sume	    (void *)&in6_gif_protosw, sc);
409105293Sume	if (sc->encap_cookie6 == NULL)
410105293Sume		return EEXIST;
411105293Sume	return 0;
412105293Sume}
413105293Sume
414105293Sumeint
415171259Sdelphijin6_gif_detach(struct gif_softc *sc)
416105293Sume{
417105293Sume	int error;
418105293Sume
419105293Sume	error = encap_detach(sc->encap_cookie6);
420105293Sume	if (error == 0)
421105293Sume		sc->encap_cookie6 = NULL;
422105293Sume	return error;
423105293Sume}
424