The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net/if_stf.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD$       */
    2 /*      $KAME: if_stf.c,v 1.73 2001/12/03 11:08:30 keiichi Exp $        */
    3 
    4 /*
    5  * Copyright (C) 2000 WIDE Project.
    6  * All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the project nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  */
   32 
   33 /*
   34  * 6to4 interface, based on RFC3056.
   35  *
   36  * 6to4 interface is NOT capable of link-layer (I mean, IPv4) multicasting.
   37  * There is no address mapping defined from IPv6 multicast address to IPv4
   38  * address.  Therefore, we do not have IFF_MULTICAST on the interface.
   39  *
   40  * Due to the lack of address mapping for link-local addresses, we cannot
   41  * throw packets toward link-local addresses (fe80::x).  Also, we cannot throw
   42  * packets to link-local multicast addresses (ff02::x).
   43  *
   44  * Here are interesting symptoms due to the lack of link-local address:
   45  *
   46  * Unicast routing exchange:
   47  * - RIPng: Impossible.  Uses link-local multicast packet toward ff02::9,
   48  *   and link-local addresses as nexthop.
   49  * - OSPFv6: Impossible.  OSPFv6 assumes that there's link-local address
   50  *   assigned to the link, and makes use of them.  Also, HELLO packets use
   51  *   link-local multicast addresses (ff02::5 and ff02::6).
   52  * - BGP4+: Maybe.  You can only use global address as nexthop, and global
   53  *   address as TCP endpoint address.
   54  *
   55  * Multicast routing protocols:
   56  * - PIM: Hello packet cannot be used to discover adjacent PIM routers.
   57  *   Adjacent PIM routers must be configured manually (is it really spec-wise
   58  *   correct thing to do?).
   59  *
   60  * ICMPv6:
   61  * - Redirects cannot be used due to the lack of link-local address.
   62  *
   63  * stf interface does not have, and will not need, a link-local address.  
   64  * It seems to have no real benefit and does not help the above symptoms much.
   65  * Even if we assign link-locals to interface, we cannot really
   66  * use link-local unicast/multicast on top of 6to4 cloud (since there's no
   67  * encapsulation defined for link-local address), and the above analysis does
   68  * not change.  RFC3056 does not mandate the assignment of link-local address
   69  * either.
   70  *
   71  * 6to4 interface has security issues.  Refer to
   72  * http://playground.iijlab.net/i-d/draft-itojun-ipv6-transition-abuse-00.txt
   73  * for details.  The code tries to filter out some of malicious packets.
   74  * Note that there is no way to be 100% secure.
   75  */
   76 
   77 #include "opt_inet.h"
   78 #include "opt_inet6.h"
   79 
   80 #include <sys/param.h>
   81 #include <sys/systm.h>
   82 #include <sys/socket.h>
   83 #include <sys/sockio.h>
   84 #include <sys/mbuf.h>
   85 #include <sys/errno.h>
   86 #include <sys/protosw.h>
   87 #include <sys/kernel.h>
   88 #include <machine/cpu.h>
   89 
   90 #include <sys/malloc.h>
   91 
   92 #include <net/if.h>
   93 #include <net/route.h>
   94 #include <net/netisr.h>
   95 #include <net/if_types.h>
   96 #include <net/if_stf.h>
   97 
   98 #include <netinet/in.h>
   99 #include <netinet/in_systm.h>
  100 #include <netinet/ip.h>
  101 #include <netinet/ipprotosw.h>
  102 #include <netinet/ip_var.h>
  103 #include <netinet/in_var.h>
  104 
  105 #include <netinet/ip6.h>
  106 #include <netinet6/ip6_var.h>
  107 #include <netinet6/in6_var.h>
  108 #include <netinet/ip_ecn.h>
  109 
  110 #include <netinet/ip_encap.h>
  111 
  112 #include <machine/stdarg.h>
  113 
  114 #include <net/net_osdep.h>
  115 
  116 #include <net/bpf.h>
  117 
  118 #define IN6_IS_ADDR_6TO4(x)     (ntohs((x)->s6_addr16[0]) == 0x2002)
  119 #define GET_V4(x)       ((struct in_addr *)(&(x)->s6_addr16[1]))
  120 
  121 struct stf_softc {
  122         struct ifnet    sc_if;     /* common area */
  123         union {
  124                 struct route  __sc_ro4;
  125                 struct route_in6 __sc_ro6; /* just for safety */
  126         } __sc_ro46;
  127 #define sc_ro   __sc_ro46.__sc_ro4
  128         const struct encaptab *encap_cookie;
  129 };
  130 
  131 static struct stf_softc *stf;
  132 
  133 static MALLOC_DEFINE(M_STF, "stf", "6to4 Tunnel Interface");
  134 static int ip_stf_ttl = 40;
  135 
  136 extern  struct domain inetdomain;
  137 struct ipprotosw in_stf_protosw =
  138 { SOCK_RAW,     &inetdomain,    IPPROTO_IPV6,   PR_ATOMIC|PR_ADDR,
  139   in_stf_input, rip_output,     0,              rip_ctloutput,
  140   0,
  141   0,            0,              0,              0,
  142   &rip_usrreqs
  143 };
  144 
  145 static int stfmodevent __P((module_t, int, void *));
  146 static int stf_encapcheck __P((const struct mbuf *, int, int, void *));
  147 static struct in6_ifaddr *stf_getsrcifa6 __P((struct ifnet *));
  148 static int stf_output __P((struct ifnet *, struct mbuf *, struct sockaddr *,
  149         struct rtentry *));
  150 static int stf_checkaddr4 __P((struct stf_softc *, struct in_addr *,
  151         struct ifnet *));
  152 static int stf_checkaddr6 __P((struct stf_softc *, struct in6_addr *,
  153         struct ifnet *));
  154 static void stf_rtrequest __P((int, struct rtentry *, struct rt_addrinfo *));
  155 static int stf_ioctl __P((struct ifnet *, u_long, caddr_t));
  156 
  157 static int
  158 stfmodevent(mod, type, data)
  159         module_t mod;
  160         int type;
  161         void *data;
  162 {
  163         struct stf_softc *sc;
  164         int err;
  165         const struct encaptab *p;
  166 
  167         switch (type) {
  168         case MOD_LOAD:
  169                 stf = malloc(sizeof(struct stf_softc), M_STF, M_WAITOK);
  170                 bzero(stf, sizeof(struct stf_softc));
  171                 sc = stf;
  172 
  173                 bzero(sc, sizeof(*sc));
  174                 sc->sc_if.if_name = "stf";
  175                 sc->sc_if.if_unit = 0;
  176 
  177                 p = encap_attach_func(AF_INET, IPPROTO_IPV6, stf_encapcheck,
  178                     &in_stf_protosw, sc);
  179                 if (p == NULL) {
  180                         printf("%s: attach failed\n", if_name(&sc->sc_if));
  181                         return (ENOMEM);
  182                 }
  183                 sc->encap_cookie = p;
  184 
  185                 sc->sc_if.if_mtu    = IPV6_MMTU;
  186                 sc->sc_if.if_flags  = 0;
  187                 sc->sc_if.if_ioctl  = stf_ioctl;
  188                 sc->sc_if.if_output = stf_output;
  189                 sc->sc_if.if_type   = IFT_STF;
  190 #if 0
  191                 /* turn off ingress filter */
  192                 sc->sc_if.if_flags  |= IFF_LINK2;
  193 #endif
  194                 sc->sc_if.if_snd.ifq_maxlen = IFQ_MAXLEN;
  195                 if_attach(&sc->sc_if);
  196 #ifdef HAVE_OLD_BPF
  197                 bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int));
  198 #else
  199                 bpfattach(&sc->sc_if.if_bpf, &sc->sc_if, DLT_NULL, sizeof(u_int));
  200 #endif
  201                 break;
  202         case MOD_UNLOAD:
  203                 sc = stf;
  204                 bpfdetach(&sc->sc_if);
  205                 if_detach(&sc->sc_if);
  206                 err = encap_detach(sc->encap_cookie);
  207                 KASSERT(err == 0, ("Unexpected error detaching encap_cookie"));
  208                 free(sc, M_STF);
  209                 break;
  210         }
  211 
  212         return (0);
  213 }
  214 
  215 static moduledata_t stf_mod = {
  216         "if_stf",
  217         stfmodevent,
  218         0
  219 };
  220 
  221 DECLARE_MODULE(if_stf, stf_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
  222 
  223 static int
  224 stf_encapcheck(m, off, proto, arg)
  225         const struct mbuf *m;
  226         int off;
  227         int proto;
  228         void *arg;
  229 {
  230         struct ip ip;
  231         struct in6_ifaddr *ia6;
  232         struct stf_softc *sc;
  233         struct in_addr a, b;
  234 
  235         sc = (struct stf_softc *)arg;
  236         if (sc == NULL)
  237                 return 0;
  238 
  239         if ((sc->sc_if.if_flags & IFF_UP) == 0)
  240                 return 0;
  241 
  242         /* IFF_LINK0 means "no decapsulation" */
  243         if ((sc->sc_if.if_flags & IFF_LINK0) != 0)
  244                 return 0;
  245 
  246         if (proto != IPPROTO_IPV6)
  247                 return 0;
  248 
  249         /* LINTED const cast */
  250         m_copydata((struct mbuf *)m, 0, sizeof(ip), (caddr_t)&ip);
  251 
  252         if (ip.ip_v != 4)
  253                 return 0;
  254 
  255         ia6 = stf_getsrcifa6(&sc->sc_if);
  256         if (ia6 == NULL)
  257                 return 0;
  258 
  259         /*
  260          * check if IPv4 dst matches the IPv4 address derived from the
  261          * local 6to4 address.
  262          * success on: dst = 10.1.1.1, ia6->ia_addr = 2002:0a01:0101:...
  263          */
  264         if (bcmp(GET_V4(&ia6->ia_addr.sin6_addr), &ip.ip_dst,
  265             sizeof(ip.ip_dst)) != 0)
  266                 return 0;
  267 
  268         /*
  269          * check if IPv4 src matches the IPv4 address derived from the
  270          * local 6to4 address masked by prefixmask.
  271          * success on: src = 10.1.1.1, ia6->ia_addr = 2002:0a00:.../24
  272          * fail on: src = 10.1.1.1, ia6->ia_addr = 2002:0b00:.../24
  273          */
  274         bzero(&a, sizeof(a));
  275         a.s_addr = GET_V4(&ia6->ia_addr.sin6_addr)->s_addr;
  276         a.s_addr &= GET_V4(&ia6->ia_prefixmask.sin6_addr)->s_addr;
  277         b = ip.ip_src;
  278         b.s_addr &= GET_V4(&ia6->ia_prefixmask.sin6_addr)->s_addr;
  279         if (a.s_addr != b.s_addr)
  280                 return 0;
  281 
  282         /* stf interface makes single side match only */
  283         return 32;
  284 }
  285 
  286 static struct in6_ifaddr *
  287 stf_getsrcifa6(ifp)
  288         struct ifnet *ifp;
  289 {
  290         struct ifaddr *ia;
  291         struct in_ifaddr *ia4;
  292         struct sockaddr_in6 *sin6;
  293         struct in_addr in;
  294 
  295         TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) {
  296                 if (ia->ifa_addr == NULL)
  297                         continue;
  298                 if (ia->ifa_addr->sa_family != AF_INET6)
  299                         continue;
  300                 sin6 = (struct sockaddr_in6 *)ia->ifa_addr;
  301                 if (!IN6_IS_ADDR_6TO4(&sin6->sin6_addr))
  302                         continue;
  303 
  304                 bcopy(GET_V4(&sin6->sin6_addr), &in, sizeof(in));
  305                 LIST_FOREACH(ia4, INADDR_HASH(in.s_addr), ia_hash)
  306                         if (ia4->ia_addr.sin_addr.s_addr == in.s_addr)
  307                                 break;
  308                 if (ia4 == NULL)
  309                         continue;
  310 
  311                 return (struct in6_ifaddr *)ia;
  312         }
  313 
  314         return NULL;
  315 }
  316 
  317 static int
  318 stf_output(ifp, m, dst, rt)
  319         struct ifnet *ifp;
  320         struct mbuf *m;
  321         struct sockaddr *dst;
  322         struct rtentry *rt;
  323 {
  324         struct stf_softc *sc;
  325         struct sockaddr_in6 *dst6;
  326         struct in_addr *in4;
  327         struct sockaddr_in *dst4;
  328         u_int8_t tos;
  329         struct ip *ip;
  330         struct ip6_hdr *ip6;
  331         struct in6_ifaddr *ia6;
  332 
  333         sc = (struct stf_softc*)ifp;
  334         dst6 = (struct sockaddr_in6 *)dst;
  335 
  336         /* just in case */
  337         if ((ifp->if_flags & IFF_UP) == 0) {
  338                 m_freem(m);
  339                 return ENETDOWN;
  340         }
  341 
  342         /*
  343          * If we don't have an ip4 address that match my inner ip6 address,
  344          * we shouldn't generate output.  Without this check, we'll end up
  345          * using wrong IPv4 source.
  346          */
  347         ia6 = stf_getsrcifa6(ifp);
  348         if (ia6 == NULL) {
  349                 m_freem(m);
  350                 return ENETDOWN;
  351         }
  352 
  353         if (m->m_len < sizeof(*ip6)) {
  354                 m = m_pullup(m, sizeof(*ip6));
  355                 if (!m)
  356                         return ENOBUFS;
  357         }
  358         ip6 = mtod(m, struct ip6_hdr *);
  359         tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
  360 
  361         /*
  362          * Pickup the right outer dst addr from the list of candidates.
  363          * ip6_dst has priority as it may be able to give us shorter IPv4 hops.
  364          */
  365         if (IN6_IS_ADDR_6TO4(&ip6->ip6_dst))
  366                 in4 = GET_V4(&ip6->ip6_dst);
  367         else if (IN6_IS_ADDR_6TO4(&dst6->sin6_addr))
  368                 in4 = GET_V4(&dst6->sin6_addr);
  369         else {
  370                 m_freem(m);
  371                 return ENETUNREACH;
  372         }
  373 
  374 #if NBPFILTER > 0
  375         if (ifp->if_bpf) {
  376                 /*
  377                  * We need to prepend the address family as
  378                  * a four byte field.  Cons up a dummy header
  379                  * to pacify bpf.  This is safe because bpf
  380                  * will only read from the mbuf (i.e., it won't
  381                  * try to free it or keep a pointer a to it).
  382                  */
  383                 struct mbuf m0;
  384                 u_int32_t af = AF_INET6;
  385                 
  386                 m0.m_next = m;
  387                 m0.m_len = 4;
  388                 m0.m_data = (char *)&af;
  389                 
  390 #ifdef HAVE_OLD_BPF
  391                 bpf_mtap(ifp, &m0);
  392 #else
  393                 bpf_mtap(ifp->if_bpf, &m0);
  394 #endif
  395         }
  396 #endif /*NBPFILTER > 0*/
  397 
  398         M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
  399         if (m && m->m_len < sizeof(struct ip))
  400                 m = m_pullup(m, sizeof(struct ip));
  401         if (m == NULL)
  402                 return ENOBUFS;
  403         ip = mtod(m, struct ip *);
  404 
  405         bzero(ip, sizeof(*ip));
  406 
  407         bcopy(GET_V4(&((struct sockaddr_in6 *)&ia6->ia_addr)->sin6_addr),
  408             &ip->ip_src, sizeof(ip->ip_src));
  409         bcopy(in4, &ip->ip_dst, sizeof(ip->ip_dst));
  410         ip->ip_p = IPPROTO_IPV6;
  411         ip->ip_ttl = ip_stf_ttl;
  412         ip->ip_len = m->m_pkthdr.len;   /*host order*/
  413         if (ifp->if_flags & IFF_LINK1)
  414                 ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
  415         else
  416                 ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
  417 
  418         dst4 = (struct sockaddr_in *)&sc->sc_ro.ro_dst;
  419         if (dst4->sin_family != AF_INET ||
  420             bcmp(&dst4->sin_addr, &ip->ip_dst, sizeof(ip->ip_dst)) != 0) {
  421                 /* cache route doesn't match */
  422                 dst4->sin_family = AF_INET;
  423                 dst4->sin_len = sizeof(struct sockaddr_in);
  424                 bcopy(&ip->ip_dst, &dst4->sin_addr, sizeof(dst4->sin_addr));
  425                 if (sc->sc_ro.ro_rt) {
  426                         RTFREE(sc->sc_ro.ro_rt);
  427                         sc->sc_ro.ro_rt = NULL;
  428                 }
  429         }
  430 
  431         if (sc->sc_ro.ro_rt == NULL) {
  432                 rtalloc(&sc->sc_ro);
  433                 if (sc->sc_ro.ro_rt == NULL) {
  434                         m_freem(m);
  435                         return ENETUNREACH;
  436                 }
  437         }
  438 
  439         return ip_output(m, NULL, &sc->sc_ro, 0, NULL, NULL);
  440 }
  441 
  442 static int
  443 stf_checkaddr4(sc, in, inifp)
  444         struct stf_softc *sc;
  445         struct in_addr *in;
  446         struct ifnet *inifp;    /* incoming interface */
  447 {
  448         struct in_ifaddr *ia4;
  449 
  450         /*
  451          * reject packets with the following address:
  452          * 224.0.0.0/4 0.0.0.0/8 127.0.0.0/8 255.0.0.0/8
  453          */
  454         if (IN_MULTICAST(ntohl(in->s_addr)))
  455                 return -1;
  456         switch ((ntohl(in->s_addr) & 0xff000000) >> 24) {
  457         case 0: case 127: case 255:
  458                 return -1;
  459         }
  460 
  461         /*
  462          * reject packets with broadcast
  463          */
  464         for (ia4 = TAILQ_FIRST(&in_ifaddrhead);
  465              ia4;
  466              ia4 = TAILQ_NEXT(ia4, ia_link))
  467         {
  468                 if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0)
  469                         continue;
  470                 if (in->s_addr == ia4->ia_broadaddr.sin_addr.s_addr)
  471                         return -1;
  472         }
  473 
  474         /*
  475          * perform ingress filter
  476          */
  477         if (sc && (sc->sc_if.if_flags & IFF_LINK2) == 0 && inifp) {
  478                 struct sockaddr_in sin;
  479                 struct rtentry *rt;
  480 
  481                 bzero(&sin, sizeof(sin));
  482                 sin.sin_family = AF_INET;
  483                 sin.sin_len = sizeof(struct sockaddr_in);
  484                 sin.sin_addr = *in;
  485                 rt = rtalloc1((struct sockaddr *)&sin, 0, 0UL);
  486                 if (!rt || rt->rt_ifp != inifp) {
  487 #if 0
  488                         log(LOG_WARNING, "%s: packet from 0x%x dropped "
  489                             "due to ingress filter\n", if_name(&sc->sc_if),
  490                             (u_int32_t)ntohl(sin.sin_addr.s_addr));
  491 #endif
  492                         if (rt)
  493                                 rtfree(rt);
  494                         return -1;
  495                 }
  496                 rtfree(rt);
  497         }
  498 
  499         return 0;
  500 }
  501 
  502 static int
  503 stf_checkaddr6(sc, in6, inifp)
  504         struct stf_softc *sc;
  505         struct in6_addr *in6;
  506         struct ifnet *inifp;    /* incoming interface */
  507 {
  508         /*
  509          * check 6to4 addresses
  510          */
  511         if (IN6_IS_ADDR_6TO4(in6))
  512                 return stf_checkaddr4(sc, GET_V4(in6), inifp);
  513 
  514         /*
  515          * reject anything that look suspicious.  the test is implemented
  516          * in ip6_input too, but we check here as well to
  517          * (1) reject bad packets earlier, and
  518          * (2) to be safe against future ip6_input change.
  519          */
  520         if (IN6_IS_ADDR_V4COMPAT(in6) || IN6_IS_ADDR_V4MAPPED(in6))
  521                 return -1;
  522 
  523         return 0;
  524 }
  525 
  526 void
  527 #if __STDC__
  528 in_stf_input(struct mbuf *m, ...)
  529 #else
  530 in_stf_input(m, va_alist)
  531         struct mbuf *m;
  532 #endif
  533 {
  534         int off, proto;
  535         struct stf_softc *sc;
  536         struct ip *ip;
  537         struct ip6_hdr *ip6;
  538         u_int8_t otos, itos;
  539         int s, isr;
  540         struct ifqueue *ifq = NULL;
  541         struct ifnet *ifp;
  542         va_list ap;
  543 
  544         va_start(ap, m);
  545         off = va_arg(ap, int);
  546         proto = va_arg(ap, int);
  547         va_end(ap);
  548 
  549         if (proto != IPPROTO_IPV6) {
  550                 m_freem(m);
  551                 return;
  552         }
  553 
  554         ip = mtod(m, struct ip *);
  555 
  556         sc = (struct stf_softc *)encap_getarg(m);
  557 
  558         if (sc == NULL || (sc->sc_if.if_flags & IFF_UP) == 0) {
  559                 m_freem(m);
  560                 return;
  561         }
  562 
  563         ifp = &sc->sc_if;
  564 
  565         /*
  566          * perform sanity check against outer src/dst.
  567          * for source, perform ingress filter as well.
  568          */
  569         if (stf_checkaddr4(sc, &ip->ip_dst, NULL) < 0 ||
  570             stf_checkaddr4(sc, &ip->ip_src, m->m_pkthdr.rcvif) < 0) {
  571                 m_freem(m);
  572                 return;
  573         }
  574 
  575         otos = ip->ip_tos;
  576         m_adj(m, off);
  577 
  578         if (m->m_len < sizeof(*ip6)) {
  579                 m = m_pullup(m, sizeof(*ip6));
  580                 if (!m)
  581                         return;
  582         }
  583         ip6 = mtod(m, struct ip6_hdr *);
  584 
  585         /*
  586          * perform sanity check against inner src/dst.
  587          * for source, perform ingress filter as well.
  588          */
  589         if (stf_checkaddr6(sc, &ip6->ip6_dst, NULL) < 0 ||
  590             stf_checkaddr6(sc, &ip6->ip6_src, m->m_pkthdr.rcvif) < 0) {
  591                 m_freem(m);
  592                 return;
  593         }
  594 
  595         itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
  596         if ((ifp->if_flags & IFF_LINK1) != 0)
  597                 ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
  598         else
  599                 ip_ecn_egress(ECN_NOCARE, &otos, &itos);
  600         ip6->ip6_flow &= ~htonl(0xff << 20);
  601         ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
  602 
  603         m->m_pkthdr.rcvif = ifp;
  604         
  605         if (ifp->if_bpf) {
  606                 /*
  607                  * We need to prepend the address family as
  608                  * a four byte field.  Cons up a dummy header
  609                  * to pacify bpf.  This is safe because bpf
  610                  * will only read from the mbuf (i.e., it won't
  611                  * try to free it or keep a pointer a to it).
  612                  */
  613                 struct mbuf m0;
  614                 u_int32_t af = AF_INET6;
  615                 
  616                 m0.m_next = m;
  617                 m0.m_len = 4;
  618                 m0.m_data = (char *)&af;
  619                 
  620 #ifdef HAVE_OLD_BPF
  621                 bpf_mtap(ifp, &m0);
  622 #else
  623                 bpf_mtap(ifp->if_bpf, &m0);
  624 #endif
  625         }
  626 
  627         /*
  628          * Put the packet to the network layer input queue according to the
  629          * specified address family.
  630          * See net/if_gif.c for possible issues with packet processing
  631          * reorder due to extra queueing.
  632          */
  633         ifq = &ip6intrq;
  634         isr = NETISR_IPV6;
  635 
  636         s = splimp();
  637         if (IF_QFULL(ifq)) {
  638                 IF_DROP(ifq);   /* update statistics */
  639                 m_freem(m);
  640                 splx(s);
  641                 return;
  642         }
  643         IF_ENQUEUE(ifq, m);
  644         schednetisr(isr);
  645         ifp->if_ipackets++;
  646         ifp->if_ibytes += m->m_pkthdr.len;
  647         splx(s);
  648 }
  649 
  650 /* ARGSUSED */
  651 static void
  652 stf_rtrequest(cmd, rt, info)
  653         int cmd;
  654         struct rtentry *rt;
  655         struct rt_addrinfo *info;
  656 {
  657 
  658         if (rt)
  659                 rt->rt_rmx.rmx_mtu = IPV6_MMTU;
  660 }
  661 
  662 static int
  663 stf_ioctl(ifp, cmd, data)
  664         struct ifnet *ifp;
  665         u_long cmd;
  666         caddr_t data;
  667 {
  668         struct ifaddr *ifa;
  669         struct ifreq *ifr;
  670         struct sockaddr_in6 *sin6;
  671         int error;
  672 
  673         error = 0;
  674         switch (cmd) {
  675         case SIOCSIFADDR:
  676                 ifa = (struct ifaddr *)data;
  677                 if (ifa == NULL || ifa->ifa_addr->sa_family != AF_INET6) {
  678                         error = EAFNOSUPPORT;
  679                         break;
  680                 }
  681                 sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
  682                 if (IN6_IS_ADDR_6TO4(&sin6->sin6_addr)) {
  683                         ifa->ifa_rtrequest = stf_rtrequest;
  684                         ifp->if_flags |= IFF_UP;
  685                 } else
  686                         error = EINVAL;
  687                 break;
  688 
  689         case SIOCADDMULTI:
  690         case SIOCDELMULTI:
  691                 ifr = (struct ifreq *)data;
  692                 if (ifr && ifr->ifr_addr.sa_family == AF_INET6)
  693                         ;
  694                 else
  695                         error = EAFNOSUPPORT;
  696                 break;
  697 
  698         default:
  699                 error = EINVAL;
  700                 break;
  701         }
  702 
  703         return error;
  704 }

Cache object: ab4646a12d7e0ca8c0d77d06caba866f


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.