1/* 2 * Copyright (c) 2000-2013 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/* $KAME: in_gif.c,v 1.54 2001/05/14 14:02:16 itojun Exp $ */ 29 30/* 31 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 32 * All rights reserved. 33 * 34 * Redistribution and use in source and binary forms, with or without 35 * modification, are permitted provided that the following conditions 36 * are met: 37 * 1. Redistributions of source code must retain the above copyright 38 * notice, this list of conditions and the following disclaimer. 39 * 2. Redistributions in binary form must reproduce the above copyright 40 * notice, this list of conditions and the following disclaimer in the 41 * documentation and/or other materials provided with the distribution. 42 * 3. Neither the name of the project nor the names of its contributors 43 * may be used to endorse or promote products derived from this software 44 * without specific prior written permission. 45 * 46 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 49 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 56 * SUCH DAMAGE. 57 */ 58 59 60#include <sys/param.h> 61#include <sys/systm.h> 62#include <sys/socket.h> 63#include <sys/sockio.h> 64#include <sys/mbuf.h> 65#include <sys/errno.h> 66#include <sys/kernel.h> 67#include <sys/sysctl.h> 68 69#include <sys/malloc.h> 70#include <libkern/OSAtomic.h> 71 72#include <net/if.h> 73#include <net/route.h> 74 75#include <netinet/in.h> 76#include <netinet/in_systm.h> 77#include <netinet/ip.h> 78#include <netinet/ip_var.h> 79#include <netinet/in_gif.h> 80#include <netinet/in_var.h> 81#include <netinet/ip_encap.h> 82#include <netinet/ip_ecn.h> 83 84#if INET6 85#include <netinet/ip6.h> 86#endif 87 88#if MROUTING 89#include <netinet/ip_mroute.h> 90#endif /* MROUTING */ 91 92#include <net/if_gif.h> 93 94#include <net/net_osdep.h> 95 96int ip_gif_ttl = GIF_TTL; 97SYSCTL_INT(_net_inet_ip, IPCTL_GIF_TTL, gifttl, CTLFLAG_RW | CTLFLAG_LOCKED, 98 &ip_gif_ttl, 0, ""); 99 100int 101in_gif_output( 102 struct ifnet *ifp, 103 int family, 104 struct mbuf *m, 105 __unused struct rtentry *rt) 106{ 107 struct gif_softc *sc = ifnet_softc(ifp); 108 struct sockaddr_in *dst = (struct sockaddr_in *) 109 (void *)&sc->gif_ro.ro_dst; 110 struct sockaddr_in *sin_src = (struct sockaddr_in *) 111 (void *)sc->gif_psrc; 112 struct sockaddr_in *sin_dst = (struct sockaddr_in *) 113 (void *)sc->gif_pdst; 114 struct ip iphdr; /* capsule IP header, host byte ordered */ 115 int proto, error; 116 u_int8_t tos; 117 struct ip_out_args ipoa = 118 { IFSCOPE_NONE, { 0 }, IPOAF_SELECT_SRCIF, 0 }; 119 120 GIF_LOCK_ASSERT(sc); 121 122 if (sin_src == NULL || sin_dst == NULL || 123 sin_src->sin_family != AF_INET || 124 sin_dst->sin_family != AF_INET) { 125 m_freem(m); 126 return (EAFNOSUPPORT); 127 } 128 129 switch (family) { 130#if INET 131 case AF_INET: 132 { 133 struct ip *ip; 134 135 proto = IPPROTO_IPV4; 136 if (mbuf_len(m) < sizeof (*ip)) { 137 m = m_pullup(m, sizeof (*ip)); 138 if (!m) 139 return (ENOBUFS); 140 } 141 ip = mtod(m, struct ip *); 142 tos = ip->ip_tos; 143 break; 144 } 145#endif /* INET */ 146#if INET6 147 case AF_INET6: 148 { 149 struct ip6_hdr *ip6; 150 proto = IPPROTO_IPV6; 151 if (mbuf_len(m) < sizeof (*ip6)) { 152 m = m_pullup(m, sizeof (*ip6)); 153 if (!m) 154 return (ENOBUFS); 155 } 156 ip6 = mtod(m, struct ip6_hdr *); 157 tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 158 break; 159 } 160#endif /* INET6 */ 161 default: 162#if DEBUG 163 printf("in_gif_output: warning: unknown family %d passed\n", 164 family); 165#endif 166 m_freem(m); 167 return (EAFNOSUPPORT); 168 } 169 170 bzero(&iphdr, sizeof (iphdr)); 171 iphdr.ip_src = sin_src->sin_addr; 172 /* bidirectional configured tunnel mode */ 173 if (sin_dst->sin_addr.s_addr != INADDR_ANY) 174 iphdr.ip_dst = sin_dst->sin_addr; 175 else { 176 m_freem(m); 177 return (ENETUNREACH); 178 } 179 iphdr.ip_p = proto; 180 /* version will be set in ip_output() */ 181 iphdr.ip_ttl = ip_gif_ttl; 182 iphdr.ip_len = m->m_pkthdr.len + sizeof (struct ip); 183 if (ifp->if_flags & IFF_LINK1) 184 ip_ecn_ingress(ECN_ALLOWED, &iphdr.ip_tos, &tos); 185 else 186 ip_ecn_ingress(ECN_NOCARE, &iphdr.ip_tos, &tos); 187 188 /* prepend new IP header */ 189 M_PREPEND(m, sizeof (struct ip), M_DONTWAIT); 190 if (m && mbuf_len(m) < sizeof (struct ip)) 191 m = m_pullup(m, sizeof (struct ip)); 192 if (m == NULL) { 193 printf("ENOBUFS in in_gif_output %d\n", __LINE__); 194 return (ENOBUFS); 195 } 196 bcopy(&iphdr, mtod(m, struct ip *), sizeof (struct ip)); 197 198 if (ROUTE_UNUSABLE(&sc->gif_ro) || 199 dst->sin_family != sin_dst->sin_family || 200 dst->sin_addr.s_addr != sin_dst->sin_addr.s_addr || 201 (sc->gif_ro.ro_rt != NULL && sc->gif_ro.ro_rt->rt_ifp == ifp)) { 202 /* cache route doesn't match or recursive route */ 203 dst->sin_family = sin_dst->sin_family; 204 dst->sin_len = sizeof (struct sockaddr_in); 205 dst->sin_addr = sin_dst->sin_addr; 206 ROUTE_RELEASE(&sc->gif_ro); 207#if 0 208 sc->gif_if.if_mtu = GIF_MTU; 209#endif 210 } 211 212 if (sc->gif_ro.ro_rt == NULL) { 213 rtalloc(&sc->gif_ro); 214 if (sc->gif_ro.ro_rt == NULL) { 215 m_freem(m); 216 return (ENETUNREACH); 217 } 218 219 /* if it constitutes infinite encapsulation, punt. */ 220 RT_LOCK(sc->gif_ro.ro_rt); 221 if (sc->gif_ro.ro_rt->rt_ifp == ifp) { 222 RT_UNLOCK(sc->gif_ro.ro_rt); 223 m_freem(m); 224 return (ENETUNREACH); /* XXX */ 225 } 226#if 0 227 ifp->if_mtu = sc->gif_ro.ro_rt->rt_ifp->if_mtu 228 - sizeof (struct ip); 229#endif 230 RT_UNLOCK(sc->gif_ro.ro_rt); 231 } 232 233 error = ip_output(m, NULL, &sc->gif_ro, IP_OUTARGS, NULL, &ipoa); 234 235 return (error); 236} 237 238void 239in_gif_input(m, off) 240 struct mbuf *m; 241 int off; 242{ 243 struct ifnet *gifp = NULL; 244 struct ip *ip; 245 int af, proto; 246 u_int8_t otos; 247 248 ip = mtod(m, struct ip *); 249 proto = ip->ip_p; 250 251 252 gifp = ((struct gif_softc *)encap_getarg(m))->gif_if; 253 254 if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) { 255 m_freem(m); 256 OSAddAtomic(1, &ipstat.ips_nogif); 257 return; 258 } 259 260 otos = ip->ip_tos; 261 m_adj(m, off); 262 263 switch (proto) { 264#if INET 265 case IPPROTO_IPV4: 266 { 267 af = AF_INET; 268 if (mbuf_len(m) < sizeof (*ip)) { 269 m = m_pullup(m, sizeof (*ip)); 270 if (!m) 271 return; 272 } 273 ip = mtod(m, struct ip *); 274 if (gifp->if_flags & IFF_LINK1) 275 ip_ecn_egress(ECN_ALLOWED, &otos, &ip->ip_tos); 276 else 277 ip_ecn_egress(ECN_NOCARE, &otos, &ip->ip_tos); 278 break; 279 } 280#endif 281#if INET6 282 case IPPROTO_IPV6: 283 { 284 struct ip6_hdr *ip6; 285 u_int8_t itos; 286 af = AF_INET6; 287 if (mbuf_len(m) < sizeof (*ip6)) { 288 m = m_pullup(m, sizeof (*ip6)); 289 if (!m) 290 return; 291 } 292 ip6 = mtod(m, struct ip6_hdr *); 293 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 294 if (gifp->if_flags & IFF_LINK1) 295 ip_ecn_egress(ECN_ALLOWED, &otos, &itos); 296 else 297 ip_ecn_egress(ECN_NOCARE, &otos, &itos); 298 ip6->ip6_flow &= ~htonl(0xff << 20); 299 ip6->ip6_flow |= htonl((u_int32_t)itos << 20); 300 break; 301 } 302#endif /* INET6 */ 303 default: 304 OSAddAtomic(1, &ipstat.ips_nogif); 305 m_freem(m); 306 return; 307 } 308#ifdef __APPLE__ 309 /* Replace the rcvif by gifp for dlil to route it correctly */ 310 if (m->m_pkthdr.rcvif) 311 m->m_pkthdr.rcvif = gifp; 312 ifnet_input(gifp, m, NULL); 313#else 314 gif_input(m, af, gifp); 315#endif 316} 317 318/* 319 * We know that we are in IFF_UP, outer address available, and outer family 320 * matched the physical addr family. see gif_encapcheck(). 321 */ 322int 323gif_encapcheck4( 324 const struct mbuf *m, 325 __unused int off, 326 __unused int proto, 327 void *arg) 328{ 329 struct ip ip; 330 struct gif_softc *sc; 331 struct sockaddr_in *src, *dst; 332 int addrmatch; 333 struct in_ifaddr *ia4; 334 335 /* sanity check done in caller */ 336 sc = (struct gif_softc *)arg; 337 src = (struct sockaddr_in *)(void *)sc->gif_psrc; 338 dst = (struct sockaddr_in *)(void *)sc->gif_pdst; 339 340 GIF_LOCK_ASSERT(sc); 341 342 mbuf_copydata((struct mbuf *)(size_t)m, 0, sizeof (ip), &ip); 343 344 /* check for address match */ 345 addrmatch = 0; 346 if (src->sin_addr.s_addr == ip.ip_dst.s_addr) 347 addrmatch |= 1; 348 if (dst->sin_addr.s_addr == ip.ip_src.s_addr) 349 addrmatch |= 2; 350 if (addrmatch != 3) 351 return (0); 352 353 /* martian filters on outer source - NOT done in ip_input! */ 354 if (IN_MULTICAST(ntohl(ip.ip_src.s_addr))) 355 return (0); 356 switch ((ntohl(ip.ip_src.s_addr) & 0xff000000) >> 24) { 357 case 0: case 127: case 255: 358 return (0); 359 } 360 /* reject packets with broadcast on source */ 361 lck_rw_lock_shared(in_ifaddr_rwlock); 362 for (ia4 = TAILQ_FIRST(&in_ifaddrhead); ia4; 363 ia4 = TAILQ_NEXT(ia4, ia_link)) { 364 if ((ifnet_flags(ia4->ia_ifa.ifa_ifp) & IFF_BROADCAST) == 0) 365 continue; 366 IFA_LOCK(&ia4->ia_ifa); 367 if (ip.ip_src.s_addr == ia4->ia_broadaddr.sin_addr.s_addr) { 368 IFA_UNLOCK(&ia4->ia_ifa); 369 lck_rw_done(in_ifaddr_rwlock); 370 return (0); 371 } 372 IFA_UNLOCK(&ia4->ia_ifa); 373 } 374 lck_rw_done(in_ifaddr_rwlock); 375 376 /* ingress filters on outer source */ 377 if ((ifnet_flags(sc->gif_if) & IFF_LINK2) == 0 && 378 (m->m_flags & M_PKTHDR) != 0 && m->m_pkthdr.rcvif) { 379 struct sockaddr_in sin; 380 struct rtentry *rt; 381 382 bzero(&sin, sizeof (sin)); 383 sin.sin_family = AF_INET; 384 sin.sin_len = sizeof (struct sockaddr_in); 385 sin.sin_addr = ip.ip_src; 386 rt = rtalloc1_scoped((struct sockaddr *)&sin, 0, 0, 387 m->m_pkthdr.rcvif->if_index); 388 if (rt != NULL) 389 RT_LOCK(rt); 390 if (rt == NULL || rt->rt_ifp != m->m_pkthdr.rcvif) { 391 if (rt != NULL) { 392 RT_UNLOCK(rt); 393 rtfree(rt); 394 } 395 return (0); 396 } 397 RT_UNLOCK(rt); 398 rtfree(rt); 399 } 400 401 return (32 * 2); 402} 403