1/* 2 * Copyright (c) 2000-2012 Apple Inc. All rights reserved. 3 * 4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. The rights granted to you under the License 10 * may not be used to create, or enable the creation or redistribution of, 11 * unlawful or unlicensed copies of an Apple operating system, or to 12 * circumvent, violate, or enable the circumvention or violation of, any 13 * terms of an Apple operating system software license agreement. 14 * 15 * Please obtain a copy of the License at 16 * http://www.opensource.apple.com/apsl/ and read it before using this file. 17 * 18 * The Original Code and all software distributed under the License are 19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 23 * Please see the License for the specific language governing rights and 24 * limitations under the License. 25 * 26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ 27 */ 28/* $FreeBSD: src/sys/netinet/ip_encap.c,v 1.1.2.2 2001/07/03 11:01:46 ume Exp $ */ 29/* $KAME: ip_encap.c,v 1.41 2001/03/15 08:35:08 itojun Exp $ */ 30 31/* 32 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 33 * All rights reserved. 34 * 35 * Redistribution and use in source and binary forms, with or without 36 * modification, are permitted provided that the following conditions 37 * are met: 38 * 1. Redistributions of source code must retain the above copyright 39 * notice, this list of conditions and the following disclaimer. 40 * 2. Redistributions in binary form must reproduce the above copyright 41 * notice, this list of conditions and the following disclaimer in the 42 * documentation and/or other materials provided with the distribution. 43 * 3. Neither the name of the project nor the names of its contributors 44 * may be used to endorse or promote products derived from this software 45 * without specific prior written permission. 46 * 47 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 48 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 49 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 50 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 51 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 52 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 53 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 54 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 55 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 56 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 57 * SUCH DAMAGE. 58 */ 59/* 60 * My grandfather said that there's a devil inside tunnelling technology... 61 * 62 * We have surprisingly many protocols that want packets with IP protocol 63 * #4 or #41. Here's a list of protocols that want protocol #41: 64 * RFC1933 configured tunnel 65 * RFC1933 automatic tunnel 66 * RFC2401 IPsec tunnel 67 * RFC2473 IPv6 generic packet tunnelling 68 * RFC2529 6over4 tunnel 69 * mobile-ip6 (uses RFC2473) 70 * 6to4 tunnel 71 * Here's a list of protocol that want protocol #4: 72 * RFC1853 IPv4-in-IPv4 tunnelling 73 * RFC2003 IPv4 encapsulation within IPv4 74 * RFC2344 reverse tunnelling for mobile-ip4 75 * RFC2401 IPsec tunnel 76 * Well, what can I say. They impose different en/decapsulation mechanism 77 * from each other, so they need separate protocol handler. The only one 78 * we can easily determine by protocol # is IPsec, which always has 79 * AH/ESP/IPComp header right after outer IP header. 80 * 81 * So, clearly good old protosw does not work for protocol #4 and #41. 82 * The code will let you match protocol via src/dst address pair. 83 */ 84/* XXX is M_NETADDR correct? */ 85 86#include <sys/param.h> 87#include <sys/systm.h> 88#include <sys/socket.h> 89#include <sys/sockio.h> 90#include <sys/mbuf.h> 91#include <sys/mcache.h> 92#include <sys/errno.h> 93#include <sys/domain.h> 94#include <sys/protosw.h> 95#include <sys/queue.h> 96 97#include <net/if.h> 98#include <net/route.h> 99 100#include <netinet/in.h> 101#include <netinet/in_systm.h> 102#include <netinet/ip.h> 103#include <netinet/ip_var.h> 104#include <netinet/ip_encap.h> 105 106#if INET6 107#include <netinet/ip6.h> 108#include <netinet6/ip6_var.h> 109#include <netinet6/ip6protosw.h> 110#endif 111 112 113#include <net/net_osdep.h> 114 115#ifndef __APPLE__ 116#include <sys/kernel.h> 117#include <sys/malloc.h> 118MALLOC_DEFINE(M_NETADDR, "Export Host", "Export host address structure"); 119#endif 120 121static void encap_init(struct protosw *, struct domain *); 122static void encap_add(struct encaptab *); 123static int mask_match(const struct encaptab *, const struct sockaddr *, 124 const struct sockaddr *); 125static void encap_fillarg(struct mbuf *, const struct encaptab *); 126 127#ifndef LIST_HEAD_INITIALIZER 128/* rely upon BSS initialization */ 129LIST_HEAD(, encaptab) encaptab; 130#else 131LIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(&encaptab); 132#endif 133 134static void 135encap_init(struct protosw *pp, struct domain *dp) 136{ 137#pragma unused(dp) 138 static int encap_initialized = 0; 139 140 VERIFY((pp->pr_flags & (PR_INITIALIZED|PR_ATTACHED)) == PR_ATTACHED); 141 142 /* This gets called by more than one protocols, so initialize once */ 143 if (encap_initialized) 144 return; 145 encap_initialized = 1; 146#if 0 147 /* 148 * we cannot use LIST_INIT() here, since drivers may want to call 149 * encap_attach(), on driver attach. encap_init() will be called 150 * on AF_INET{,6} initialization, which happens after driver 151 * initialization - using LIST_INIT() here can nuke encap_attach() 152 * from drivers. 153 */ 154 LIST_INIT(&encaptab); 155#endif 156} 157 158void 159encap4_init(struct protosw *pp, struct domain *dp) 160{ 161 encap_init(pp, dp); 162} 163 164void 165encap6_init(struct ip6protosw *pp, struct domain *dp) 166{ 167 encap_init((struct protosw *)pp, dp); 168} 169 170#if INET 171void 172encap4_input(m, off) 173 struct mbuf *m; 174 int off; 175{ 176 int proto; 177 struct ip *ip; 178 struct sockaddr_in s, d; 179 const struct protosw *psw; 180 struct encaptab *ep, *match; 181 int prio, matchprio; 182 183#ifndef __APPLE__ 184 va_start(ap, m); 185 off = va_arg(ap, int); 186 proto = va_arg(ap, int); 187 va_end(ap); 188#endif 189 190 /* Expect 32-bit aligned data pointer on strict-align platforms */ 191 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); 192 193 ip = mtod(m, struct ip *); 194#ifdef __APPLE__ 195 proto = ip->ip_p; 196#endif 197 198 bzero(&s, sizeof(s)); 199 s.sin_family = AF_INET; 200 s.sin_len = sizeof(struct sockaddr_in); 201 s.sin_addr = ip->ip_src; 202 bzero(&d, sizeof(d)); 203 d.sin_family = AF_INET; 204 d.sin_len = sizeof(struct sockaddr_in); 205 d.sin_addr = ip->ip_dst; 206 207 match = NULL; 208 matchprio = 0; 209 for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) { 210 if (ep->af != AF_INET) 211 continue; 212 if (ep->proto >= 0 && ep->proto != proto) 213 continue; 214 if (ep->func) 215 prio = (*ep->func)(m, off, proto, ep->arg); 216 else { 217 /* 218 * it's inbound traffic, we need to match in reverse 219 * order 220 */ 221 prio = mask_match(ep, (struct sockaddr *)&d, 222 (struct sockaddr *)&s); 223 } 224 225 /* 226 * We prioritize the matches by using bit length of the 227 * matches. mask_match() and user-supplied matching function 228 * should return the bit length of the matches (for example, 229 * if both src/dst are matched for IPv4, 64 should be returned). 230 * 0 or negative return value means "it did not match". 231 * 232 * The question is, since we have two "mask" portion, we 233 * cannot really define total order between entries. 234 * For example, which of these should be preferred? 235 * mask_match() returns 48 (32 + 16) for both of them. 236 * src=3ffe::/16, dst=3ffe:501::/32 237 * src=3ffe:501::/32, dst=3ffe::/16 238 * 239 * We need to loop through all the possible candidates 240 * to get the best match - the search takes O(n) for 241 * n attachments (i.e. interfaces). 242 */ 243 if (prio <= 0) 244 continue; 245 if (prio > matchprio) { 246 matchprio = prio; 247 match = ep; 248 } 249 } 250 251 if (match) { 252 /* found a match, "match" has the best one */ 253 psw = (const struct protosw *)match->psw; 254 if (psw && psw->pr_input) { 255 encap_fillarg(m, match); 256 (*psw->pr_input)(m, off); 257 } else 258 m_freem(m); 259 return; 260 } 261 262 /* last resort: inject to raw socket */ 263 rip_input(m, off); 264} 265#endif 266 267#if INET6 268int 269encap6_input(struct mbuf **mp, int *offp, int proto) 270{ 271 struct mbuf *m = *mp; 272 struct ip6_hdr *ip6; 273 struct sockaddr_in6 s, d; 274 const struct ip6protosw *psw; 275 struct encaptab *ep, *match; 276 int prio, matchprio; 277 278 /* Expect 32-bit aligned data pointer on strict-align platforms */ 279 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); 280 281 ip6 = mtod(m, struct ip6_hdr *); 282 bzero(&s, sizeof(s)); 283 s.sin6_family = AF_INET6; 284 s.sin6_len = sizeof(struct sockaddr_in6); 285 s.sin6_addr = ip6->ip6_src; 286 bzero(&d, sizeof(d)); 287 d.sin6_family = AF_INET6; 288 d.sin6_len = sizeof(struct sockaddr_in6); 289 d.sin6_addr = ip6->ip6_dst; 290 291 match = NULL; 292 matchprio = 0; 293 for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) { 294 if (ep->af != AF_INET6) 295 continue; 296 if (ep->proto >= 0 && ep->proto != proto) 297 continue; 298 if (ep->func) 299 prio = (*ep->func)(m, *offp, proto, ep->arg); 300 else { 301 /* 302 * it's inbound traffic, we need to match in reverse 303 * order 304 */ 305 prio = mask_match(ep, (struct sockaddr *)&d, 306 (struct sockaddr *)&s); 307 } 308 309 /* see encap4_input() for issues here */ 310 if (prio <= 0) 311 continue; 312 if (prio > matchprio) { 313 matchprio = prio; 314 match = ep; 315 } 316 } 317 318 if (match) { 319 /* found a match */ 320 psw = (const struct ip6protosw *)match->psw; 321 if (psw && psw->pr_input) { 322 encap_fillarg(m, match); 323 return (*psw->pr_input)(mp, offp, proto); 324 } else { 325 m_freem(m); 326 return IPPROTO_DONE; 327 } 328 } 329 330 /* last resort: inject to raw socket */ 331 return rip6_input(mp, offp, proto); 332} 333#endif 334 335static void 336encap_add(ep) 337 struct encaptab *ep; 338{ 339 340 LIST_INSERT_HEAD(&encaptab, ep, chain); 341} 342 343/* 344 * sp (src ptr) is always my side, and dp (dst ptr) is always remote side. 345 * length of mask (sm and dm) is assumed to be same as sp/dp. 346 * Return value will be necessary as input (cookie) for encap_detach(). 347 */ 348const struct encaptab * 349encap_attach(af, proto, sp, sm, dp, dm, psw, arg) 350 int af; 351 int proto; 352 const struct sockaddr *sp, *sm; 353 const struct sockaddr *dp, *dm; 354 const struct protosw *psw; 355 void *arg; 356{ 357 struct encaptab *ep; 358 int error; 359 360 /* sanity check on args */ 361 if (sp->sa_len > sizeof(ep->src) || dp->sa_len > sizeof(ep->dst)) { 362 error = EINVAL; 363 goto fail; 364 } 365 if (sp->sa_len != dp->sa_len) { 366 error = EINVAL; 367 goto fail; 368 } 369 if (af != sp->sa_family || af != dp->sa_family) { 370 error = EINVAL; 371 goto fail; 372 } 373 374 /* check if anyone have already attached with exactly same config */ 375 for (ep = LIST_FIRST(&encaptab); ep; ep = LIST_NEXT(ep, chain)) { 376 if (ep->af != af) 377 continue; 378 if (ep->proto != proto) 379 continue; 380 if (ep->src.ss_len != sp->sa_len || 381 bcmp(&ep->src, sp, sp->sa_len) != 0 || 382 bcmp(&ep->srcmask, sm, sp->sa_len) != 0) 383 continue; 384 if (ep->dst.ss_len != dp->sa_len || 385 bcmp(&ep->dst, dp, dp->sa_len) != 0 || 386 bcmp(&ep->dstmask, dm, dp->sa_len) != 0) 387 continue; 388 389 error = EEXIST; 390 goto fail; 391 } 392 393 ep = _MALLOC(sizeof(*ep), M_NETADDR, M_WAITOK); /*XXX*/ 394 if (ep == NULL) { 395 error = ENOBUFS; 396 goto fail; 397 } 398 bzero(ep, sizeof(*ep)); 399 400 ep->af = af; 401 ep->proto = proto; 402 bcopy(sp, &ep->src, sp->sa_len); 403 bcopy(sm, &ep->srcmask, sp->sa_len); 404 bcopy(dp, &ep->dst, dp->sa_len); 405 bcopy(dm, &ep->dstmask, dp->sa_len); 406 ep->psw = psw; 407 ep->arg = arg; 408 409 encap_add(ep); 410 411 error = 0; 412 return ep; 413 414fail: 415 return NULL; 416} 417 418const struct encaptab * 419encap_attach_func(af, proto, func, psw, arg) 420 int af; 421 int proto; 422 int (*func)(const struct mbuf *, int, int, void *); 423 const struct protosw *psw; 424 void *arg; 425{ 426 struct encaptab *ep; 427 int error; 428 429 /* sanity check on args */ 430 if (!func) { 431 error = EINVAL; 432 goto fail; 433 } 434 435 ep = _MALLOC(sizeof(*ep), M_NETADDR, M_WAITOK); /*XXX*/ 436 if (ep == NULL) { 437 error = ENOBUFS; 438 goto fail; 439 } 440 bzero(ep, sizeof(*ep)); 441 442 ep->af = af; 443 ep->proto = proto; 444 ep->func = func; 445 ep->psw = psw; 446 ep->arg = arg; 447 448 encap_add(ep); 449 450 error = 0; 451 return ep; 452 453fail: 454 return NULL; 455} 456 457int 458encap_detach(cookie) 459 const struct encaptab *cookie; 460{ 461 const struct encaptab *ep = cookie; 462 struct encaptab *p; 463 464 for (p = LIST_FIRST(&encaptab); p; p = LIST_NEXT(p, chain)) { 465 if (p == ep) { 466 LIST_REMOVE(p, chain); 467 _FREE(p, M_NETADDR); /*XXX*/ 468 return 0; 469 } 470 } 471 472 return EINVAL; 473} 474 475static int 476mask_match(ep, sp, dp) 477 const struct encaptab *ep; 478 const struct sockaddr *sp; 479 const struct sockaddr *dp; 480{ 481 struct sockaddr_storage s; 482 struct sockaddr_storage d; 483 int i; 484 const u_int8_t *p, *q; 485 u_int8_t *r; 486 int matchlen; 487 488 if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) 489 return 0; 490 if (sp->sa_family != ep->af || dp->sa_family != ep->af) 491 return 0; 492 if (sp->sa_len != ep->src.ss_len || dp->sa_len != ep->dst.ss_len) 493 return 0; 494 495 matchlen = 0; 496 497 p = (const u_int8_t *)sp; 498 q = (const u_int8_t *)&ep->srcmask; 499 r = (u_int8_t *)&s; 500 for (i = 0 ; i < sp->sa_len; i++) { 501 r[i] = p[i] & q[i]; 502 /* XXX estimate */ 503 matchlen += (q[i] ? 8 : 0); 504 } 505 506 p = (const u_int8_t *)dp; 507 q = (const u_int8_t *)&ep->dstmask; 508 r = (u_int8_t *)&d; 509 for (i = 0 ; i < dp->sa_len; i++) { 510 r[i] = p[i] & q[i]; 511 /* XXX rough estimate */ 512 matchlen += (q[i] ? 8 : 0); 513 } 514 515 /* need to overwrite len/family portion as we don't compare them */ 516 s.ss_len = sp->sa_len; 517 s.ss_family = sp->sa_family; 518 d.ss_len = dp->sa_len; 519 d.ss_family = dp->sa_family; 520 521 if (bcmp(&s, &ep->src, ep->src.ss_len) == 0 && 522 bcmp(&d, &ep->dst, ep->dst.ss_len) == 0) { 523 return matchlen; 524 } else 525 return 0; 526} 527 528struct encaptabtag { 529 void* *arg; 530}; 531 532static void 533encap_fillarg( 534 struct mbuf *m, 535 const struct encaptab *ep) 536{ 537 struct m_tag *tag; 538 struct encaptabtag *et; 539 540 tag = m_tag_create(KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_ENCAP, 541 sizeof(struct encaptabtag), M_WAITOK, m); 542 543 if (tag != NULL) { 544 et = (struct encaptabtag*)(tag + 1); 545 et->arg = ep->arg; 546 m_tag_prepend(m, tag); 547 } 548} 549 550void * 551encap_getarg(m) 552 struct mbuf *m; 553{ 554 struct m_tag *tag; 555 struct encaptabtag *et; 556 void *p = NULL; 557 558 tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, KERNEL_TAG_TYPE_ENCAP, NULL); 559 if (tag) { 560 et = (struct encaptabtag*)(tag + 1); 561 p = et->arg; 562 m_tag_delete(m, tag); 563 } 564 565 return p; 566} 567