FreeBSD/Linux Kernel Cross Reference
sys/netinet/in_gif.c
1 /* $NetBSD: in_gif.c,v 1.41.2.1 2006/01/08 15:48:46 riz Exp $ */
2 /* $KAME: in_gif.c,v 1.66 2001/07/29 04:46:09 itojun Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: in_gif.c,v 1.41.2.1 2006/01/08 15:48:46 riz Exp $");
35
36 #include "opt_inet.h"
37 #include "opt_iso.h"
38
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/socket.h>
42 #include <sys/sockio.h>
43 #include <sys/mbuf.h>
44 #include <sys/errno.h>
45 #include <sys/ioctl.h>
46 #include <sys/syslog.h>
47 #include <sys/protosw.h>
48 #include <sys/kernel.h>
49
50 #include <net/if.h>
51 #include <net/route.h>
52
53 #include <netinet/in.h>
54 #include <netinet/in_systm.h>
55 #include <netinet/ip.h>
56 #include <netinet/ip_var.h>
57 #include <netinet/in_gif.h>
58 #include <netinet/in_var.h>
59 #include <netinet/ip_encap.h>
60 #include <netinet/ip_ecn.h>
61
62 #ifdef INET6
63 #include <netinet/ip6.h>
64 #endif
65
66 #include <net/if_gif.h>
67
68 #include "gif.h"
69 #include "bridge.h"
70 #include <net/if_ether.h>
71
72 #include <machine/stdarg.h>
73
74 #include <net/net_osdep.h>
75
76 static int gif_validate4(const struct ip *, struct gif_softc *,
77 struct ifnet *);
78
79 #if NGIF > 0
80 int ip_gif_ttl = GIF_TTL;
81 #else
82 int ip_gif_ttl = 0;
83 #endif
84
85 const struct protosw in_gif_protosw =
86 { SOCK_RAW, &inetdomain, 0/* IPPROTO_IPV[46] */, PR_ATOMIC|PR_ADDR,
87 in_gif_input, rip_output, 0, rip_ctloutput,
88 rip_usrreq,
89 0, 0, 0, 0,
90 };
91
92 int
93 in_gif_output(struct ifnet *ifp, int family, struct mbuf *m)
94 {
95 struct gif_softc *sc = (struct gif_softc*)ifp;
96 struct sockaddr_in *dst = (struct sockaddr_in *)&sc->gif_ro.ro_dst;
97 struct sockaddr_in *sin_src = (struct sockaddr_in *)sc->gif_psrc;
98 struct sockaddr_in *sin_dst = (struct sockaddr_in *)sc->gif_pdst;
99 struct ip iphdr; /* capsule IP header, host byte ordered */
100 #if NBRIDGE > 0
101 struct etherip_header eiphdr;
102 #endif
103 int proto, error;
104 u_int8_t tos;
105
106 if (sin_src == NULL || sin_dst == NULL ||
107 sin_src->sin_family != AF_INET ||
108 sin_dst->sin_family != AF_INET) {
109 m_freem(m);
110 return EAFNOSUPPORT;
111 }
112
113 switch (family) {
114 #ifdef INET
115 case AF_INET:
116 {
117 struct ip *ip;
118
119 proto = IPPROTO_IPV4;
120 if (m->m_len < sizeof(*ip)) {
121 m = m_pullup(m, sizeof(*ip));
122 if (!m)
123 return ENOBUFS;
124 }
125 ip = mtod(m, struct ip *);
126 tos = ip->ip_tos;
127 break;
128 }
129 #endif /* INET */
130 #ifdef INET6
131 case AF_INET6:
132 {
133 struct ip6_hdr *ip6;
134 proto = IPPROTO_IPV6;
135 if (m->m_len < sizeof(*ip6)) {
136 m = m_pullup(m, sizeof(*ip6));
137 if (!m)
138 return ENOBUFS;
139 }
140 ip6 = mtod(m, struct ip6_hdr *);
141 tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
142 break;
143 }
144 #endif /* INET6 */
145 #ifdef ISO
146 case AF_ISO:
147 proto = IPPROTO_EON;
148 tos = 0;
149 break;
150 #endif
151 #if NBRIDGE > 0
152 case AF_LINK:
153 proto = IPPROTO_ETHERIP;
154 eiphdr.eip_ver = ETHERIP_VERSION & ETHERIP_VER_VERS_MASK;
155 eiphdr.eip_pad = 0;
156 /* prepend Ethernet-in-IP header */
157 M_PREPEND(m, sizeof(struct etherip_header), M_DONTWAIT);
158 if (m && m->m_len < sizeof(struct etherip_header))
159 m = m_pullup(m, sizeof(struct etherip_header));
160 if (m == NULL)
161 return ENOBUFS;
162 bcopy(&eiphdr, mtod(m, struct etherip_header *), sizeof(struct etherip_header));
163 break;
164 #endif
165 default:
166 #ifdef DEBUG
167 printf("in_gif_output: warning: unknown family %d passed\n",
168 family);
169 #endif
170 m_freem(m);
171 return EAFNOSUPPORT;
172 }
173
174 bzero(&iphdr, sizeof(iphdr));
175 iphdr.ip_src = sin_src->sin_addr;
176 /* bidirectional configured tunnel mode */
177 if (sin_dst->sin_addr.s_addr != INADDR_ANY)
178 iphdr.ip_dst = sin_dst->sin_addr;
179 else {
180 m_freem(m);
181 return ENETUNREACH;
182 }
183 iphdr.ip_p = proto;
184 /* version will be set in ip_output() */
185 iphdr.ip_ttl = ip_gif_ttl;
186 iphdr.ip_len = htons(m->m_pkthdr.len + sizeof(struct ip));
187 if (ifp->if_flags & IFF_LINK1)
188 ip_ecn_ingress(ECN_ALLOWED, &iphdr.ip_tos, &tos);
189 else
190 ip_ecn_ingress(ECN_NOCARE, &iphdr.ip_tos, &tos);
191
192 /* prepend new IP header */
193 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
194 if (m && m->m_len < sizeof(struct ip))
195 m = m_pullup(m, sizeof(struct ip));
196 if (m == NULL)
197 return ENOBUFS;
198 bcopy(&iphdr, mtod(m, struct ip *), sizeof(struct ip));
199
200 if (sc->gif_route_expire - time.tv_sec <= 0 ||
201 dst->sin_family != sin_dst->sin_family ||
202 !in_hosteq(dst->sin_addr, sin_dst->sin_addr)) {
203 /* cache route doesn't match */
204 bzero(dst, sizeof(*dst));
205 dst->sin_family = sin_dst->sin_family;
206 dst->sin_len = sizeof(struct sockaddr_in);
207 dst->sin_addr = sin_dst->sin_addr;
208 if (sc->gif_ro.ro_rt) {
209 RTFREE(sc->gif_ro.ro_rt);
210 sc->gif_ro.ro_rt = NULL;
211 }
212 }
213
214 if (sc->gif_ro.ro_rt == NULL) {
215 rtalloc(&sc->gif_ro);
216 if (sc->gif_ro.ro_rt == NULL) {
217 m_freem(m);
218 return ENETUNREACH;
219 }
220
221 /* if it constitutes infinite encapsulation, punt. */
222 if (sc->gif_ro.ro_rt->rt_ifp == ifp) {
223 m_freem(m);
224 return ENETUNREACH; /*XXX*/
225 }
226
227 sc->gif_route_expire = time.tv_sec + GIF_ROUTE_TTL;
228 }
229
230 error = ip_output(m, NULL, &sc->gif_ro, 0, NULL, NULL);
231 return (error);
232 }
233
234 void
235 in_gif_input(struct mbuf *m, ...)
236 {
237 int off, proto;
238 struct ifnet *gifp = NULL;
239 struct ip *ip;
240 va_list ap;
241 int af;
242 u_int8_t otos;
243
244 va_start(ap, m);
245 off = va_arg(ap, int);
246 proto = va_arg(ap, int);
247 va_end(ap);
248
249 ip = mtod(m, struct ip *);
250
251 gifp = (struct ifnet *)encap_getarg(m);
252
253 if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) {
254 m_freem(m);
255 ipstat.ips_nogif++;
256 return;
257 }
258 #ifndef GIF_ENCAPCHECK
259 if (!gif_validate4(ip, (struct gif_softc *)gifp, m->m_pkthdr.rcvif)) {
260 m_freem(m);
261 ipstat.ips_nogif++;
262 return;
263 }
264 #endif
265
266 otos = ip->ip_tos;
267 m_adj(m, off);
268
269 switch (proto) {
270 #ifdef INET
271 case IPPROTO_IPV4:
272 {
273 struct ip *ip;
274 af = AF_INET;
275 if (m->m_len < sizeof(*ip)) {
276 m = m_pullup(m, sizeof(*ip));
277 if (!m)
278 return;
279 }
280 ip = mtod(m, struct ip *);
281 if (gifp->if_flags & IFF_LINK1)
282 ip_ecn_egress(ECN_ALLOWED, &otos, &ip->ip_tos);
283 else
284 ip_ecn_egress(ECN_NOCARE, &otos, &ip->ip_tos);
285 break;
286 }
287 #endif
288 #ifdef INET6
289 case IPPROTO_IPV6:
290 {
291 struct ip6_hdr *ip6;
292 u_int8_t itos;
293 af = AF_INET6;
294 if (m->m_len < sizeof(*ip6)) {
295 m = m_pullup(m, sizeof(*ip6));
296 if (!m)
297 return;
298 }
299 ip6 = mtod(m, struct ip6_hdr *);
300 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
301 if (gifp->if_flags & IFF_LINK1)
302 ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
303 else
304 ip_ecn_egress(ECN_NOCARE, &otos, &itos);
305 ip6->ip6_flow &= ~htonl(0xff << 20);
306 ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
307 break;
308 }
309 #endif /* INET6 */
310 #ifdef ISO
311 case IPPROTO_EON:
312 af = AF_ISO;
313 break;
314 #endif
315 #if NBRIDGE > 0
316 case IPPROTO_ETHERIP:
317 af = AF_LINK;
318 break;
319 #endif
320 default:
321 ipstat.ips_nogif++;
322 m_freem(m);
323 return;
324 }
325 gif_input(m, af, gifp);
326 return;
327 }
328
329 /*
330 * validate outer address.
331 */
332 static int
333 gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp)
334 {
335 struct sockaddr_in *src, *dst;
336 struct in_ifaddr *ia4;
337
338 src = (struct sockaddr_in *)sc->gif_psrc;
339 dst = (struct sockaddr_in *)sc->gif_pdst;
340
341 /* check for address match */
342 if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
343 dst->sin_addr.s_addr != ip->ip_src.s_addr)
344 return 0;
345
346 /* martian filters on outer source - NOT done in ip_input! */
347 if (IN_MULTICAST(ip->ip_src.s_addr))
348 return 0;
349 switch ((ntohl(ip->ip_src.s_addr) & 0xff000000) >> 24) {
350 case 0: case 127: case 255:
351 return 0;
352 }
353 /* reject packets with broadcast on source */
354 TAILQ_FOREACH(ia4, &in_ifaddrhead, ia_list) {
355 if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0)
356 continue;
357 if (ip->ip_src.s_addr == ia4->ia_broadaddr.sin_addr.s_addr)
358 return 0;
359 }
360
361 /* ingress filters on outer source */
362 if ((sc->gif_if.if_flags & IFF_LINK2) == 0 && ifp) {
363 struct sockaddr_in sin;
364 struct rtentry *rt;
365
366 bzero(&sin, sizeof(sin));
367 sin.sin_family = AF_INET;
368 sin.sin_len = sizeof(struct sockaddr_in);
369 sin.sin_addr = ip->ip_src;
370 rt = rtalloc1((struct sockaddr *)&sin, 0);
371 if (!rt || rt->rt_ifp != ifp) {
372 #if 0
373 log(LOG_WARNING, "%s: packet from 0x%x dropped "
374 "due to ingress filter\n", if_name(&sc->gif_if),
375 (u_int32_t)ntohl(sin.sin_addr.s_addr));
376 #endif
377 if (rt)
378 rtfree(rt);
379 return 0;
380 }
381 rtfree(rt);
382 }
383
384 return 32 * 2;
385 }
386
387 #ifdef GIF_ENCAPCHECK
388 /*
389 * we know that we are in IFF_UP, outer address available, and outer family
390 * matched the physical addr family. see gif_encapcheck().
391 */
392 int
393 gif_encapcheck4(const struct mbuf *m, int off, int proto, void *arg)
394 {
395 struct ip ip;
396 struct gif_softc *sc;
397 struct ifnet *ifp;
398
399 /* sanity check done in caller */
400 sc = (struct gif_softc *)arg;
401
402 /* LINTED const cast */
403 m_copydata((struct mbuf *)m, 0, sizeof(ip), (caddr_t)&ip);
404 ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
405
406 return gif_validate4(&ip, sc, ifp);
407 }
408 #endif
409
410 int
411 in_gif_attach(struct gif_softc *sc)
412 {
413 #ifndef GIF_ENCAPCHECK
414 struct sockaddr_in mask4;
415
416 bzero(&mask4, sizeof(mask4));
417 mask4.sin_len = sizeof(struct sockaddr_in);
418 mask4.sin_addr.s_addr = ~0;
419
420 if (!sc->gif_psrc || !sc->gif_pdst)
421 return EINVAL;
422 sc->encap_cookie4 = encap_attach(AF_INET, -1, sc->gif_psrc,
423 (struct sockaddr *)&mask4, sc->gif_pdst, (struct sockaddr *)&mask4,
424 (struct protosw *)&in_gif_protosw, sc);
425 #else
426 sc->encap_cookie4 = encap_attach_func(AF_INET, -1, gif_encapcheck,
427 &in_gif_protosw, sc);
428 #endif
429 if (sc->encap_cookie4 == NULL)
430 return EEXIST;
431 return 0;
432 }
433
434 int
435 in_gif_detach(struct gif_softc *sc)
436 {
437 int error;
438
439 error = encap_detach(sc->encap_cookie4);
440 if (error == 0)
441 sc->encap_cookie4 = NULL;
442
443 if (sc->gif_ro.ro_rt) {
444 RTFREE(sc->gif_ro.ro_rt);
445 sc->gif_ro.ro_rt = NULL;
446 }
447
448 return error;
449 }
Cache object: 29512de82b3a48b21c2104d4d5ea4643
|