xform_ipip.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*      $NetBSD: xform_ipip.c,v 1.24 2008/04/27 12:58:48 degroote Exp $ */
    2 /*      $FreeBSD: src/sys/netipsec/xform_ipip.c,v 1.3.2.1 2003/01/24 05:11:36 sam Exp $ */
    3 /*      $OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
    4 
    5 /*
    6  * The authors of this code are John Ioannidis (ji@tla.org),
    7  * Angelos D. Keromytis (kermit@csd.uch.gr) and
    8  * Niels Provos (provos@physnet.uni-hamburg.de).
    9  *
   10  * The original version of this code was written by John Ioannidis
   11  * for BSD/OS in Athens, Greece, in November 1995.
   12  *
   13  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
   14  * by Angelos D. Keromytis.
   15  *
   16  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
   17  * and Niels Provos.
   18  *
   19  * Additional features in 1999 by Angelos D. Keromytis.
   20  *
   21  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
   22  * Angelos D. Keromytis and Niels Provos.
   23  * Copyright (c) 2001, Angelos D. Keromytis.
   24  *
   25  * Permission to use, copy, and modify this software with or without fee
   26  * is hereby granted, provided that this entire notice is included in
   27  * all copies of any software which is or includes a copy or
   28  * modification of this software.
   29  * You may use this code under the GNU public license if you so wish. Please
   30  * contribute changes back to the authors under this freer than GPL license
   31  * so that we may further the use of strong encryption without limitations to
   32  * all.
   33  *
   34  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
   35  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
   36  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
   37  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
   38  * PURPOSE.
   39  */
   40 
   41 #include <sys/cdefs.h>
   42 __KERNEL_RCSID(0, "$NetBSD: xform_ipip.c,v 1.24 2008/04/27 12:58:48 degroote Exp $");
   43 
   44 /*
   45  * IP-inside-IP processing
   46  */
   47 #include "opt_inet.h"
   48 #ifdef __FreeBSD__
   49 #include "opt_inet6.h"
   50 #include "opt_random_ip_id.h"
   51 #endif /* __FreeBSD__ */
   52 
   53 
   54 #include <sys/param.h>
   55 #include <sys/systm.h>
   56 #include <sys/mbuf.h>
   57 #include <sys/socket.h>
   58 #include <sys/kernel.h>
   59 #include <sys/protosw.h>
   60 #include <sys/sysctl.h>
   61 
   62 #include <net/if.h>
   63 #include <net/route.h>
   64 #include <net/netisr.h>
   65 
   66 #include <netinet/in.h>
   67 #include <netinet/in_systm.h>
   68 #include <netinet/in_var.h>
   69 #include <netinet/ip.h>
   70 #include <netinet/ip_ecn.h>
   71 #include <netinet/ip_var.h>
   72 #include <netinet/ip_encap.h>
   73 #ifdef __FreeBSD__
   74 #include <netinet/ipprotosw.h>
   75 #endif
   76 
   77 #include <netipsec/ipsec.h>
   78 #include <netipsec/ipsec_private.h>
   79 #include <netipsec/xform.h>
   80 
   81 #include <netipsec/ipip_var.h>
   82 
   83 #ifdef MROUTING
   84 #include <netinet/ip_mroute.h>
   85 #endif
   86 
   87 #ifdef INET6
   88 #include <netinet/ip6.h>
   89 #include <netipsec/ipsec6.h>
   90 #  ifdef __FreeBSD__
   91 #  include <netinet6/ip6_ecn.h>
   92 #  endif
   93 #include <netinet6/in6_var.h>
   94 #include <netinet6/ip6protosw.h>
   95 #endif
   96 
   97 #include <netipsec/key.h>
   98 #include <netipsec/key_debug.h>
   99 #include <netipsec/ipsec_osdep.h>
  100 
  101 #include <machine/stdarg.h>
  102 
  103 #ifdef __FreeBSD__
  104 typedef void    pr_in_input_t (struct mbuf *, int, int); /* XXX FIX THIS */
  105 #else
  106 typedef void    pr_in_input_t (struct mbuf *m, ...);
  107 #endif
  108 
  109 /*
  110  * We can control the acceptance of IP4 packets by altering the sysctl
  111  * net.inet.ipip.allow value.  Zero means drop them, all else is acceptance.
  112  */
  113 int     ipip_allow = 0;
  114 
  115 percpu_t *ipipstat_percpu;
  116 
  117 #ifdef SYSCTL_DECL
  118 SYSCTL_DECL(_net_inet_ipip);
  119 
  120 SYSCTL_INT(_net_inet_ipip, OID_AUTO,
  121         ipip_allow,     CTLFLAG_RW,     &ipip_allow,    0, "");
  122 SYSCTL_STRUCT(_net_inet_ipip, IPSECCTL_STATS,
  123         stats,          CTLFLAG_RD,     &ipipstat,      ipipstat, "");
  124 
  125 #endif
  126 
  127 #ifdef __FreeBSD__
  128 static
  129 #endif
  130 void ipe4_attach(void);
  131 
  132 
  133 /* XXX IPCOMP */
  134 #define M_IPSEC (M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
  135 
  136 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp);
  137 
  138 #ifdef INET6
  139 /*
  140  * Really only a wrapper for ipip_input(), for use with IPv6.
  141  */
  142 int
  143 ip4_input6(struct mbuf **m, int *offp, int proto)
  144 {
  145 #if 0
  146         /* If we do not accept IP-in-IP explicitly, drop.  */
  147         if (!ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) {
  148                 DPRINTF(("ip4_input6: dropped due to policy\n"));
  149                 IPIP_STATINC(IPIP_STAT_PDROPS);
  150                 m_freem(*m);
  151                 return IPPROTO_DONE;
  152         }
  153 #endif
  154         _ipip_input(*m, *offp, NULL);
  155         return IPPROTO_DONE;
  156 }
  157 #endif /* INET6 */
  158 
  159 #ifdef INET
  160 /*
  161  * Really only a wrapper for ipip_input(), for use with IPv4.
  162  */
  163 void
  164 ip4_input(struct mbuf *m, ...)
  165 {
  166         va_list ap;
  167         int iphlen;
  168 
  169 #if 0
  170         /* If we do not accept IP-in-IP explicitly, drop.  */
  171         if (!ipip_allow && (m->m_flags & M_IPSEC) == 0) {
  172                 DPRINTF(("ip4_input: dropped due to policy\n"));
  173                 IPIP_STATINC(IPIP_STAT_PDROPS);
  174                 m_freem(m);
  175                 return;
  176         }
  177 #endif
  178         va_start(ap, m);
  179         iphlen = va_arg(ap, int);
  180         va_end(ap);
  181 
  182         _ipip_input(m, iphlen, NULL);
  183 }
  184 #endif /* INET */
  185 
  186 /*
  187  * ipip_input gets called when we receive an IP{46} encapsulated packet,
  188  * either because we got it at a real interface, or because AH or ESP
  189  * were being used in tunnel mode (in which case the rcvif element will
  190  * contain the address of the encX interface associated with the tunnel.
  191  */
  192 
  193 static void
  194 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
  195 {
  196         register struct sockaddr_in *sin;
  197         register struct ifnet *ifp;
  198         register struct ifaddr *ifa;
  199         struct ifqueue *ifq = NULL;
  200         struct ip *ipo;
  201 #ifdef INET6
  202         register struct sockaddr_in6 *sin6;
  203         struct ip6_hdr *ip6 = NULL;
  204         u_int8_t itos;
  205 #endif
  206         u_int8_t nxt;
  207         int isr;
  208         u_int8_t otos;
  209         u_int8_t v;
  210         int hlen;
  211 
  212         IPIP_STATINC(IPIP_STAT_IPACKETS);
  213 
  214         m_copydata(m, 0, 1, &v);
  215 
  216         switch (v >> 4) {
  217 #ifdef INET
  218         case 4:
  219                 hlen = sizeof(struct ip);
  220                 break;
  221 #endif /* INET */
  222 #ifdef INET6
  223         case 6:
  224                 hlen = sizeof(struct ip6_hdr);
  225                 break;
  226 #endif
  227         default:
  228                 DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) "
  229                         "for outer header\n", v, v>>4));
  230                 IPIP_STATINC(IPIP_STAT_FAMILY);
  231                 m_freem(m);
  232                 return /* EAFNOSUPPORT */;
  233         }
  234 
  235         /* Bring the IP header in the first mbuf, if not there already */
  236         if (m->m_len < hlen) {
  237                 if ((m = m_pullup(m, hlen)) == NULL) {
  238                         DPRINTF(("ipip_input: m_pullup (1) failed\n"));
  239                         IPIP_STATINC(IPIP_STAT_HDROPS);
  240                         return;
  241                 }
  242         }
  243 
  244         ipo = mtod(m, struct ip *);
  245 
  246 #ifdef MROUTING
  247         if (ipo->ip_v == IPVERSION && ipo->ip_p == IPPROTO_IPV4) {
  248                 if (IN_MULTICAST(((struct ip *)((char *) ipo + iphlen))->ip_dst.s_addr)) {
  249                         ipip_mroute_input (m, iphlen);
  250                         return;
  251                 }
  252         }
  253 #endif /* MROUTING */
  254 
  255         /* Keep outer ecn field. */
  256         switch (v >> 4) {
  257 #ifdef INET
  258         case 4:
  259                 otos = ipo->ip_tos;
  260                 break;
  261 #endif /* INET */
  262 #ifdef INET6
  263         case 6:
  264                 otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff;
  265                 break;
  266 #endif
  267         default:
  268                 panic("ipip_input: unknown ip version %u (outer)", v>>4);
  269         }
  270 
  271         /* Remove outer IP header */
  272         m_adj(m, iphlen);
  273 
  274         /* Sanity check */
  275         if (m->m_pkthdr.len < sizeof(struct ip))  {
  276                 IPIP_STATINC(IPIP_STAT_HDROPS);
  277                 m_freem(m);
  278                 return;
  279         }
  280 
  281         m_copydata(m, 0, 1, &v);
  282 
  283         switch (v >> 4) {
  284 #ifdef INET
  285         case 4:
  286                 hlen = sizeof(struct ip);
  287                 break;
  288 #endif /* INET */
  289 
  290 #ifdef INET6
  291         case 6:
  292                 hlen = sizeof(struct ip6_hdr);
  293                 break;
  294 #endif
  295         default:
  296                 DPRINTF(("_ipip_input: bad protocol version 0x%x (%u) "
  297                         "for inner header\n", v, v>>4));
  298                 IPIP_STATINC(IPIP_STAT_FAMILY);
  299                 m_freem(m);
  300                 return; /* EAFNOSUPPORT */
  301         }
  302 
  303         /*
  304          * Bring the inner IP header in the first mbuf, if not there already.
  305          */
  306         if (m->m_len < hlen) {
  307                 if ((m = m_pullup(m, hlen)) == NULL) {
  308                         DPRINTF(("ipip_input: m_pullup (2) failed\n"));
  309                         IPIP_STATINC(IPIP_STAT_HDROPS);
  310                         return;
  311                 }
  312         }
  313 
  314         /*
  315          * RFC 1853 specifies that the inner TTL should not be touched on
  316          * decapsulation. There's no reason this comment should be here, but
  317          * this is as good as any a position.
  318          */
  319 
  320         /* Some sanity checks in the inner IP header */
  321         switch (v >> 4) {
  322 #ifdef INET
  323         case 4:
  324                 ipo = mtod(m, struct ip *);
  325                 nxt = ipo->ip_p;
  326                 ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos);
  327                 break;
  328 #endif /* INET */
  329 #ifdef INET6
  330         case 6:
  331                 ip6 = (struct ip6_hdr *) ipo;
  332                 nxt = ip6->ip6_nxt;
  333                 itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
  334                 ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
  335                 ip6->ip6_flow &= ~htonl(0xff << 20);
  336                 ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
  337                 break;
  338 #endif
  339         default:
  340                 panic("ipip_input: unknown ip version %u (inner)", v>>4);
  341         }
  342 
  343         /* Check for local address spoofing. */
  344         if ((m->m_pkthdr.rcvif == NULL ||
  345             !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) &&
  346             ipip_allow != 2) {
  347                 IFNET_FOREACH(ifp) {
  348                         IFADDR_FOREACH(ifa, ifp) {
  349 #ifdef INET
  350                                 if (ipo) {
  351                                         if (ifa->ifa_addr->sa_family !=
  352                                             AF_INET)
  353                                                 continue;
  354 
  355                                         sin = (struct sockaddr_in *) ifa->ifa_addr;
  356 
  357                                         if (sin->sin_addr.s_addr ==
  358                                             ipo->ip_src.s_addr) {
  359                                                 IPIP_STATINC(IPIP_STAT_SPOOF);
  360                                                 m_freem(m);
  361                                                 return;
  362                                         }
  363                                 }
  364 #endif /* INET */
  365 
  366 #ifdef INET6
  367                                 if (ip6) {
  368                                         if (ifa->ifa_addr->sa_family !=
  369                                             AF_INET6)
  370                                                 continue;
  371 
  372                                         sin6 = (struct sockaddr_in6 *) ifa->ifa_addr;
  373 
  374                                         if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) {
  375                                                 IPIP_STATINC(IPIP_STAT_SPOOF);
  376                                                 m_freem(m);
  377                                                 return;
  378                                         }
  379 
  380                                 }
  381 #endif /* INET6 */
  382                         }
  383                 }
  384         }
  385 
  386         /* Statistics */
  387         IPIP_STATADD(IPIP_STAT_IBYTES, m->m_pkthdr.len - iphlen);
  388 
  389         /*
  390          * Interface pointer stays the same; if no IPsec processing has
  391          * been done (or will be done), this will point to a normal
  392          * interface. Otherwise, it'll point to an enc interface, which
  393          * will allow a packet filter to distinguish between secure and
  394          * untrusted packets.
  395          */
  396 
  397         switch (v >> 4) {
  398 #ifdef INET
  399         case 4:
  400                 ifq = &ipintrq;
  401                 isr = NETISR_IP;
  402                 break;
  403 #endif
  404 #ifdef INET6
  405         case 6:
  406                 ifq = &ip6intrq;
  407                 isr = NETISR_IPV6;
  408                 break;
  409 #endif
  410         default:
  411                 panic("ipip_input: should never reach here");
  412         }
  413 
  414         if (!IF_HANDOFF(ifq, m, NULL)) {
  415                 IPIP_STATINC(IPIP_STAT_QFULL);
  416 
  417                 DPRINTF(("ipip_input: packet dropped because of full queue\n"));
  418         } else {
  419                 schednetisr(isr);
  420         }
  421 }
  422 
  423 int
  424 ipip_output(
  425     struct mbuf *m,
  426     struct ipsecrequest *isr,
  427     struct mbuf **mp,
  428     int skip,
  429     int protoff
  430 )
  431 {
  432         struct secasvar *sav;
  433         u_int8_t tp, otos;
  434         struct secasindex *saidx;
  435         int error;
  436 #ifdef INET
  437         u_int8_t itos;
  438         struct ip *ipo;
  439 #endif /* INET */
  440 #ifdef INET6
  441         struct ip6_hdr *ip6, *ip6o;
  442 #endif /* INET6 */
  443 
  444         IPSEC_SPLASSERT_SOFTNET("ipip_output");
  445 
  446         sav = isr->sav;
  447         IPSEC_ASSERT(sav != NULL, ("ipip_output: null SA"));
  448         IPSEC_ASSERT(sav->sah != NULL, ("ipip_output: null SAH"));
  449 
  450         /* XXX Deal with empty TDB source/destination addresses. */
  451 
  452         m_copydata(m, 0, 1, &tp);
  453         tp = (tp >> 4) & 0xff;  /* Get the IP version number. */
  454 
  455         saidx = &sav->sah->saidx;
  456         switch (saidx->dst.sa.sa_family) {
  457 #ifdef INET
  458         case AF_INET:
  459                 if (saidx->src.sa.sa_family != AF_INET ||
  460                     saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
  461                     saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) {
  462                         DPRINTF(("ipip_output: unspecified tunnel endpoint "
  463                             "address in SA %s/%08lx\n",
  464                             ipsec_address(&saidx->dst),
  465                             (u_long) ntohl(sav->spi)));
  466                         IPIP_STATINC(IPIP_STAT_UNSPEC);
  467                         error = EINVAL;
  468                         goto bad;
  469                 }
  470 
  471                 M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
  472                 if (m == 0) {
  473                         DPRINTF(("ipip_output: M_PREPEND failed\n"));
  474                         IPIP_STATINC(IPIP_STAT_HDROPS);
  475                         error = ENOBUFS;
  476                         goto bad;
  477                 }
  478 
  479                 ipo = mtod(m, struct ip *);
  480 
  481                 ipo->ip_v = IPVERSION;
  482                 ipo->ip_hl = 5;
  483                 ipo->ip_len = htons(m->m_pkthdr.len);
  484                 ipo->ip_ttl = ip_defttl;
  485                 ipo->ip_sum = 0;
  486                 ipo->ip_src = saidx->src.sin.sin_addr;
  487                 ipo->ip_dst = saidx->dst.sin.sin_addr;
  488 
  489 #if defined(__NetBSD__)
  490                 ipo->ip_id = ip_newid(NULL);
  491 #elif defined(RANDOM_IP_ID)
  492                 ipo->ip_id = ip_randomid();
  493 #else
  494                 ipo->ip_id = htons(ip_id++);
  495 #endif
  496 
  497                 /* If the inner protocol is IP... */
  498                 if (tp == IPVERSION) {
  499                         /* Save ECN notification */
  500                         m_copydata(m, sizeof(struct ip) +
  501                             offsetof(struct ip, ip_tos),
  502                             sizeof(u_int8_t), &itos);
  503 
  504                         ipo->ip_p = IPPROTO_IPIP;
  505 
  506                         /*
  507                          * We should be keeping tunnel soft-state and
  508                          * send back ICMPs if needed.
  509                          */
  510                         m_copydata(m, sizeof(struct ip) +
  511                             offsetof(struct ip, ip_off),
  512                             sizeof(u_int16_t), &ipo->ip_off);
  513                         ipo->ip_off &= ~ IP_OFF_CONVERT(IP_DF | IP_MF | IP_OFFMASK);
  514                 }
  515 #ifdef INET6
  516                 else if (tp == (IPV6_VERSION >> 4)) {
  517                         u_int32_t itos32;
  518 
  519                         /* Save ECN notification. */
  520                         m_copydata(m, sizeof(struct ip) +
  521                             offsetof(struct ip6_hdr, ip6_flow),
  522                             sizeof(u_int32_t), &itos32);
  523                         itos = ntohl(itos32) >> 20;
  524                         ipo->ip_p = IPPROTO_IPV6;
  525                         ipo->ip_off = 0;
  526                 }
  527 #endif /* INET6 */
  528                 else {
  529                         goto nofamily;
  530                 }
  531 
  532                 otos = 0;
  533                 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
  534                 ipo->ip_tos = otos;
  535                 break;
  536 #endif /* INET */
  537 
  538 #ifdef INET6
  539         case AF_INET6:
  540                 if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) ||
  541                     saidx->src.sa.sa_family != AF_INET6 ||
  542                     IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) {
  543                         DPRINTF(("ipip_output: unspecified tunnel endpoint "
  544                             "address in SA %s/%08lx\n",
  545                             ipsec_address(&saidx->dst),
  546                             (u_long) ntohl(sav->spi)));
  547                         IPIP_STATINC(IPIP_STAT_UNSPEC);
  548                         error = ENOBUFS;
  549                         goto bad;
  550                 }
  551 
  552                 /* scoped address handling */
  553                 ip6 = mtod(m, struct ip6_hdr *);
  554                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
  555                         ip6->ip6_src.s6_addr16[1] = 0;
  556                 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
  557                         ip6->ip6_dst.s6_addr16[1] = 0;
  558 
  559                 M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
  560                 if (m == 0) {
  561                         DPRINTF(("ipip_output: M_PREPEND failed\n"));
  562                         IPIP_STATINC(IPIP_STAT_HDROPS);
  563                         error = ENOBUFS;
  564                         goto bad;
  565                 }
  566 
  567                 /* Initialize IPv6 header */
  568                 ip6o = mtod(m, struct ip6_hdr *);
  569                 ip6o->ip6_flow = 0;
  570                 ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
  571                 ip6o->ip6_vfc |= IPV6_VERSION;
  572                 ip6o->ip6_plen = htons(m->m_pkthdr.len);
  573                 ip6o->ip6_hlim = ip_defttl;
  574                 ip6o->ip6_dst = saidx->dst.sin6.sin6_addr;
  575                 ip6o->ip6_src = saidx->src.sin6.sin6_addr;
  576 
  577 #ifdef INET
  578                 if (tp == IPVERSION) {
  579                         /* Save ECN notification */
  580                         m_copydata(m, sizeof(struct ip6_hdr) +
  581                             offsetof(struct ip, ip_tos), sizeof(u_int8_t),
  582                             &itos);
  583 
  584                         /* This is really IPVERSION. */
  585                         ip6o->ip6_nxt = IPPROTO_IPIP;
  586                 } else
  587 #endif /* INET */
  588                         if (tp == (IPV6_VERSION >> 4)) {
  589                                 u_int32_t itos32;
  590 
  591                                 /* Save ECN notification. */
  592                                 m_copydata(m, sizeof(struct ip6_hdr) +
  593                                     offsetof(struct ip6_hdr, ip6_flow),
  594                                     sizeof(u_int32_t), &itos32);
  595                                 itos = ntohl(itos32) >> 20;
  596 
  597                                 ip6o->ip6_nxt = IPPROTO_IPV6;
  598                         } else {
  599                                 goto nofamily;
  600                         }
  601 
  602                 otos = 0;
  603                 ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
  604                 ip6o->ip6_flow |= htonl((u_int32_t) otos << 20);
  605                 break;
  606 #endif /* INET6 */
  607 
  608         default:
  609 nofamily:
  610                 DPRINTF(("ipip_output: unsupported protocol family %u\n",
  611                     saidx->dst.sa.sa_family));
  612                 IPIP_STATINC(IPIP_STAT_FAMILY);
  613                 error = EAFNOSUPPORT;           /* XXX diffs from openbsd */
  614                 goto bad;
  615         }
  616 
  617         IPIP_STATINC(IPIP_STAT_OPACKETS);
  618         *mp = m;
  619 
  620 #ifdef INET
  621         if (saidx->dst.sa.sa_family == AF_INET) {
  622 #if 0
  623                 if (sav->tdb_xform->xf_type == XF_IP4)
  624                         tdb->tdb_cur_bytes +=
  625                             m->m_pkthdr.len - sizeof(struct ip);
  626 #endif
  627                 IPIP_STATADD(IPIP_STAT_OBYTES,
  628                              m->m_pkthdr.len - sizeof(struct ip));
  629         }
  630 #endif /* INET */
  631 
  632 #ifdef INET6
  633         if (saidx->dst.sa.sa_family == AF_INET6) {
  634 #if 0
  635                 if (sav->tdb_xform->xf_type == XF_IP4)
  636                         tdb->tdb_cur_bytes +=
  637                             m->m_pkthdr.len - sizeof(struct ip6_hdr);
  638 #endif
  639                 IPIP_STATADD(IPIP_STAT_IBYTES,
  640                     m->m_pkthdr.len - sizeof(struct ip6_hdr));
  641         }
  642 #endif /* INET6 */
  643 
  644         return 0;
  645 bad:
  646         if (m)
  647                 m_freem(m);
  648         *mp = NULL;
  649         return (error);
  650 }
  651 
  652 #ifdef FAST_IPSEC
  653 static int
  654 ipe4_init(struct secasvar *sav, struct xformsw *xsp)
  655 {
  656         sav->tdb_xform = xsp;
  657         return 0;
  658 }
  659 
  660 static int
  661 ipe4_zeroize(struct secasvar *sav)
  662 {
  663         sav->tdb_xform = NULL;
  664         return 0;
  665 }
  666 
  667 static int
  668 ipe4_input(
  669     struct mbuf *m,
  670     struct secasvar *sav,
  671     int skip,
  672     int protoff
  673 )
  674 {
  675         /* This is a rather serious mistake, so no conditional printing. */
  676         printf("ipe4_input: should never be called\n");
  677         if (m)
  678                 m_freem(m);
  679         return EOPNOTSUPP;
  680 }
  681 
  682 static struct xformsw ipe4_xformsw = {
  683         XF_IP4,         0,              "IPv4 Simple Encapsulation",
  684         ipe4_init,      ipe4_zeroize,   ipe4_input,     ipip_output,
  685         NULL,
  686 };
  687 
  688 #ifdef INET
  689 PR_WRAP_CTLOUTPUT(rip_ctloutput)
  690 PR_WRAP_USRREQ(rip_usrreq)
  691 #define rip_ctloutput   rip_ctloutput_wrapper
  692 #define rip_usrreq      rip_usrreq_wrapper
  693 
  694 extern struct domain inetdomain;
  695 static struct ipprotosw ipe4_protosw = {
  696  .pr_type = SOCK_RAW,
  697  .pr_domain = &inetdomain,
  698  .pr_protocol = IPPROTO_IPV4,
  699  .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
  700  .pr_input = ip4_input,
  701  .pr_output = 0,
  702  .pr_ctlinput = 0,
  703  .pr_ctloutput = rip_ctloutput,
  704  .pr_usrreq = rip_usrreq,
  705  .pr_init = 0,
  706  .pr_fasttimo = 0,
  707  .pr_slowtimo = 0,
  708  .pr_drain = 0,
  709 };
  710 #endif
  711 #ifdef INET6
  712 PR_WRAP_CTLOUTPUT(rip6_ctloutput)
  713 PR_WRAP_USRREQ(rip6_usrreq)
  714 #define rip6_ctloutput  rip6_ctloutput_wrapper
  715 #define rip6_usrreq     rip6_usrreq_wrapper
  716 
  717 extern struct domain inet6domain;
  718 static struct ip6protosw ipe4_protosw6 = {
  719  .pr_type = SOCK_RAW,
  720  .pr_domain = &inet6domain,
  721  .pr_protocol = IPPROTO_IPV6,
  722  .pr_flags = PR_ATOMIC|PR_ADDR|PR_LASTHDR,
  723  .pr_input = ip4_input6,
  724  .pr_output = 0,
  725  .pr_ctlinput = 0,
  726  .pr_ctloutput = rip6_ctloutput,
  727  .pr_usrreq = rip6_usrreq,
  728  .pr_init = 0,
  729  .pr_fasttimo = 0,
  730  .pr_slowtimo = 0,
  731  .pr_drain = 0,
  732 };
  733 #endif
  734 
  735 #endif /* FAST_IPSEC */
  736 
  737 /*
  738  * Check the encapsulated packet to see if we want it
  739  */
  740 static int
  741 ipe4_encapcheck(struct mbuf *m,
  742     int off,
  743     int proto,
  744     void *arg
  745 )
  746 {
  747         /*
  748          * Only take packets coming from IPSEC tunnels; the rest
  749          * must be handled by the gif tunnel code.  Note that we
  750          * also return a minimum priority when we want the packet
  751          * so any explicit gif tunnels take precedence.
  752          */
  753         return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0);
  754 }
  755 
  756 INITFN void
  757 ipe4_attach(void)
  758 {
  759 
  760         ipipstat_percpu = percpu_alloc(sizeof(uint64_t) * IPIP_NSTATS);
  761 
  762         xform_register(&ipe4_xformsw);
  763         /* attach to encapsulation framework */
  764         /* XXX save return cookie for detach on module remove */
  765 #ifdef INET
  766         (void) encap_attach_func(AF_INET, -1,
  767                 ipe4_encapcheck, (struct protosw*) &ipe4_protosw, NULL);
  768 #endif
  769 #ifdef INET6
  770         (void) encap_attach_func(AF_INET6, -1,
  771                 ipe4_encapcheck, (struct protosw*) &ipe4_protosw6, NULL);
  772 #endif
  773 }
  774 
  775 #ifdef SYSINIT
  776 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL);
  777 #endif
  778
Cache object: a990a72500c636fcba7dd3ec185e2235
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netipsec/xform_ipip.c

FreeBSD/Linux Kernel Cross Reference
sys/netipsec/xform_ipip.c
