1 | /* |
2 | * Copyright (c) 2009-2016 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | /* $FreeBSD: src/sys/netinet6/in6_gif.c,v 1.2.2.3 2001/07/03 11:01:52 ume Exp $ */ |
30 | /* $KAME: in6_gif.c,v 1.49 2001/05/14 14:02:17 itojun Exp $ */ |
31 | |
32 | /* |
33 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
34 | * All rights reserved. |
35 | * |
36 | * Redistribution and use in source and binary forms, with or without |
37 | * modification, are permitted provided that the following conditions |
38 | * are met: |
39 | * 1. Redistributions of source code must retain the above copyright |
40 | * notice, this list of conditions and the following disclaimer. |
41 | * 2. Redistributions in binary form must reproduce the above copyright |
42 | * notice, this list of conditions and the following disclaimer in the |
43 | * documentation and/or other materials provided with the distribution. |
44 | * 3. Neither the name of the project nor the names of its contributors |
45 | * may be used to endorse or promote products derived from this software |
46 | * without specific prior written permission. |
47 | * |
48 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
49 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
50 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
51 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
52 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
53 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
54 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
55 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
56 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
57 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
58 | * SUCH DAMAGE. |
59 | */ |
60 | |
61 | |
62 | #include <sys/param.h> |
63 | #include <sys/systm.h> |
64 | #include <sys/socket.h> |
65 | #include <sys/sockio.h> |
66 | #include <sys/mbuf.h> |
67 | #include <sys/errno.h> |
68 | #include <sys/queue.h> |
69 | #include <sys/syslog.h> |
70 | |
71 | #include <sys/malloc.h> |
72 | #include <sys/protosw.h> |
73 | |
74 | #include <net/if.h> |
75 | #include <net/route.h> |
76 | |
77 | #include <netinet/in.h> |
78 | #include <netinet/in_systm.h> |
79 | #if INET |
80 | #include <netinet/ip.h> |
81 | #endif |
82 | #include <netinet/ip_encap.h> |
83 | #include <netinet/ip6.h> |
84 | #include <netinet6/ip6_var.h> |
85 | #include <netinet6/in6_gif.h> |
86 | #include <netinet6/in6_var.h> |
87 | #include <netinet/ip_ecn.h> |
88 | #include <netinet6/ip6_ecn.h> |
89 | |
90 | #include <net/if_gif.h> |
91 | |
92 | #include <net/net_osdep.h> |
93 | |
94 | #include <net/sockaddr_utils.h> |
95 | |
96 | int |
97 | in6_gif_output( |
98 | struct ifnet *ifp, |
99 | int family, /* family of the packet to be encapsulate. */ |
100 | struct mbuf *m, |
101 | __unused struct rtentry *rt) |
102 | { |
103 | struct gif_softc *sc = ifnet_softc(interface: ifp); |
104 | struct sockaddr_in6 *dst = SIN6(&sc->gif_ro6.ro_dst); |
105 | struct sockaddr_in6 *sin6_src = SIN6(sc->gif_psrc); |
106 | struct sockaddr_in6 *sin6_dst = SIN6(sc->gif_pdst); |
107 | struct ip6_hdr *ip6; |
108 | int proto; |
109 | u_int8_t itos, otos; |
110 | |
111 | GIF_LOCK_ASSERT(sc); |
112 | |
113 | if (sin6_src == NULL || sin6_dst == NULL || |
114 | sin6_src->sin6_family != AF_INET6 || |
115 | sin6_dst->sin6_family != AF_INET6) { |
116 | m_freem(m); |
117 | return EAFNOSUPPORT; |
118 | } |
119 | |
120 | switch (family) { |
121 | #if INET |
122 | case AF_INET: |
123 | { |
124 | struct ip *ip; |
125 | |
126 | proto = IPPROTO_IPV4; |
127 | if (mbuf_len(mbuf: m) < sizeof(*ip)) { |
128 | m = m_pullup(m, sizeof(*ip)); |
129 | if (!m) { |
130 | return ENOBUFS; |
131 | } |
132 | } |
133 | ip = mtod(m, struct ip *); |
134 | itos = ip->ip_tos; |
135 | break; |
136 | } |
137 | #endif |
138 | case AF_INET6: |
139 | { |
140 | proto = IPPROTO_IPV6; |
141 | if (mbuf_len(mbuf: m) < sizeof(*ip6)) { |
142 | m = m_pullup(m, sizeof(*ip6)); |
143 | if (!m) { |
144 | return ENOBUFS; |
145 | } |
146 | } |
147 | ip6 = mtod(m, struct ip6_hdr *); |
148 | itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; |
149 | break; |
150 | } |
151 | default: |
152 | #if DEBUG |
153 | printf("in6_gif_output: warning: unknown family %d passed\n" , |
154 | family); |
155 | #endif |
156 | m_freem(m); |
157 | return EAFNOSUPPORT; |
158 | } |
159 | |
160 | /* prepend new IP header */ |
161 | M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT, 1); |
162 | if (m && mbuf_len(mbuf: m) < sizeof(struct ip6_hdr)) { |
163 | m = m_pullup(m, sizeof(struct ip6_hdr)); |
164 | } |
165 | if (m == NULL) { |
166 | printf("ENOBUFS in in6_gif_output %d\n" , __LINE__); |
167 | return ENOBUFS; |
168 | } |
169 | |
170 | ip6 = mtod(m, struct ip6_hdr *); |
171 | ip6->ip6_flow = 0; |
172 | ip6->ip6_vfc &= ~IPV6_VERSION_MASK; |
173 | ip6->ip6_vfc |= IPV6_VERSION; |
174 | ip6->ip6_plen = htons((u_short)m->m_pkthdr.len); |
175 | ip6->ip6_nxt = proto; |
176 | ip6->ip6_hlim = ip6_gif_hlim; |
177 | ip6->ip6_src = sin6_src->sin6_addr; |
178 | ip6_output_setsrcifscope(m, sin6_src->sin6_scope_id, NULL); |
179 | ip6_output_setdstifscope(m, sin6_dst->sin6_scope_id, NULL); |
180 | /* bidirectional configured tunnel mode */ |
181 | if (!IN6_IS_ADDR_UNSPECIFIED(&sin6_dst->sin6_addr)) { |
182 | ip6->ip6_dst = sin6_dst->sin6_addr; |
183 | } else { |
184 | m_freem(m); |
185 | return ENETUNREACH; |
186 | } |
187 | ip_ecn_ingress((ifp->if_flags & IFF_LINK1) ? ECN_NORMAL : ECN_NOCARE, |
188 | &otos, &itos); |
189 | ip6->ip6_flow &= ~htonl(0xff << 20); |
190 | ip6->ip6_flow |= htonl((u_int32_t)otos << 20); |
191 | |
192 | if (ROUTE_UNUSABLE(&sc->gif_ro6) || |
193 | dst->sin6_family != sin6_dst->sin6_family || |
194 | !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &sin6_dst->sin6_addr) || |
195 | (sc->gif_ro6.ro_rt != NULL && sc->gif_ro6.ro_rt->rt_ifp == ifp)) { |
196 | /* cache route doesn't match or recursive route */ |
197 | SOCKADDR_ZERO(dst, sizeof(*dst)); |
198 | dst->sin6_family = sin6_dst->sin6_family; |
199 | dst->sin6_len = sizeof(struct sockaddr_in6); |
200 | dst->sin6_addr = sin6_dst->sin6_addr; |
201 | ROUTE_RELEASE(&sc->gif_ro6); |
202 | #if 0 |
203 | sc->gif_if.if_mtu = GIF_MTU; |
204 | #endif |
205 | } |
206 | |
207 | if (sc->gif_ro6.ro_rt == NULL) { |
208 | rtalloc((struct route *)&sc->gif_ro6); |
209 | if (sc->gif_ro6.ro_rt == NULL) { |
210 | m_freem(m); |
211 | return ENETUNREACH; |
212 | } |
213 | RT_LOCK(sc->gif_ro6.ro_rt); |
214 | /* if it constitutes infinite encapsulation, punt. */ |
215 | if (sc->gif_ro6.ro_rt->rt_ifp == ifp) { |
216 | RT_UNLOCK(sc->gif_ro6.ro_rt); |
217 | m_freem(m); |
218 | return ENETUNREACH; /* XXX */ |
219 | } |
220 | #if 0 |
221 | ifp->if_mtu = sc->gif_ro6.ro_rt->rt_ifp->if_mtu |
222 | - sizeof(struct ip6_hdr); |
223 | #endif |
224 | RT_UNLOCK(sc->gif_ro6.ro_rt); |
225 | } |
226 | |
227 | #if IPV6_MINMTU |
228 | /* |
229 | * force fragmentation to minimum MTU, to avoid path MTU discovery. |
230 | * it is too painful to ask for resend of inner packet, to achieve |
231 | * path MTU discovery for encapsulated packets. |
232 | */ |
233 | return ip6_output(m, 0, &sc->gif_ro6, IPV6_MINMTU, 0, NULL, NULL); |
234 | #else |
235 | return ip6_output(m, 0, &sc->gif_ro6, 0, 0, NULL, NULL); |
236 | #endif |
237 | } |
238 | |
239 | int |
240 | in6_gif_input(struct mbuf **mp, int *offp, int proto) |
241 | { |
242 | struct mbuf *m = *mp; |
243 | struct ifnet *gifp = NULL; |
244 | struct ip6_hdr *ip6; |
245 | int af = 0; |
246 | u_int32_t otos; |
247 | int egress_success = 0; |
248 | |
249 | ip6 = mtod(m, struct ip6_hdr *); |
250 | |
251 | gifp = ((struct gif_softc *)encap_getarg(m))->gif_if; |
252 | |
253 | if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) { |
254 | m_freem(m); |
255 | ip6stat.ip6s_nogif++; |
256 | return IPPROTO_DONE; |
257 | } |
258 | |
259 | otos = ip6->ip6_flow; |
260 | m_adj(m, *offp); |
261 | |
262 | switch (proto) { |
263 | case IPPROTO_IPV4: |
264 | { |
265 | struct ip *ip; |
266 | u_int8_t otos8, old_tos; |
267 | int sum; |
268 | |
269 | af = AF_INET; |
270 | otos8 = (ntohl(otos) >> 20) & 0xff; |
271 | if (mbuf_len(mbuf: m) < sizeof(*ip)) { |
272 | m = m_pullup(m, sizeof(*ip)); |
273 | if (!m) { |
274 | return IPPROTO_DONE; |
275 | } |
276 | } |
277 | ip = mtod(m, struct ip *); |
278 | if (gifp->if_flags & IFF_LINK1) { |
279 | old_tos = ip->ip_tos; |
280 | egress_success = ip_ecn_egress(ECN_NORMAL, &otos8, &ip->ip_tos); |
281 | if (old_tos != ip->ip_tos) { |
282 | sum = ~ntohs(ip->ip_sum) & 0xffff; |
283 | sum += (~old_tos & 0xffff) + ip->ip_tos; |
284 | sum = (sum >> 16) + (sum & 0xffff); |
285 | sum += (sum >> 16); /* add carry */ |
286 | ip->ip_sum = htons(~sum & 0xffff); |
287 | } |
288 | } else { |
289 | egress_success = ip_ecn_egress(ECN_NOCARE, &otos8, &ip->ip_tos); |
290 | } |
291 | break; |
292 | } |
293 | case IPPROTO_IPV6: |
294 | { |
295 | af = AF_INET6; |
296 | if (mbuf_len(mbuf: m) < sizeof(*ip6)) { |
297 | m = m_pullup(m, sizeof(*ip6)); |
298 | if (!m) { |
299 | return IPPROTO_DONE; |
300 | } |
301 | } |
302 | ip6 = mtod(m, struct ip6_hdr *); |
303 | if (gifp->if_flags & IFF_LINK1) { |
304 | egress_success = ip6_ecn_egress(ECN_NORMAL, &otos, &ip6->ip6_flow); |
305 | } else { |
306 | egress_success = ip6_ecn_egress(ECN_NOCARE, &otos, &ip6->ip6_flow); |
307 | } |
308 | break; |
309 | } |
310 | default: |
311 | ip6stat.ip6s_nogif++; |
312 | m_freem(m); |
313 | return IPPROTO_DONE; |
314 | } |
315 | |
316 | if (egress_success == 0) { |
317 | ip6stat.ip6s_nogif++; |
318 | m_freem(m); |
319 | return IPPROTO_DONE; |
320 | } |
321 | |
322 | /* Replace the rcvif by gifp for ifnet_input to route it correctly */ |
323 | if (m->m_pkthdr.rcvif) { |
324 | m->m_pkthdr.rcvif = gifp; |
325 | } |
326 | |
327 | ifnet_input(interface: gifp, first_packet: m, NULL); |
328 | return IPPROTO_DONE; |
329 | } |
330 | |
331 | /* |
332 | * validate outer address. |
333 | */ |
334 | static int |
335 | gif_validate6( |
336 | const struct ip6_hdr *ip6, |
337 | struct gif_softc *sc, |
338 | struct ifnet *ifp) |
339 | { |
340 | struct sockaddr_in6 *src, *dst; |
341 | |
342 | src = SIN6(sc->gif_psrc); |
343 | dst = SIN6(sc->gif_pdst); |
344 | |
345 | /* |
346 | * Check for address match. Note that the check is for an incoming |
347 | * packet. We should compare the *source* address in our configuration |
348 | * and the *destination* address of the packet, and vice versa. |
349 | */ |
350 | if (!IN6_ARE_ADDR_EQUAL(&src->sin6_addr, &ip6->ip6_dst) || |
351 | !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_src)) { |
352 | return 0; |
353 | } |
354 | |
355 | /* martian filters on outer source - done in ip6_input */ |
356 | |
357 | /* ingress filters on outer source */ |
358 | if ((ifnet_flags(interface: sc->gif_if) & IFF_LINK2) == 0 && ifp) { |
359 | struct sockaddr_in6 sin6; |
360 | struct rtentry *rt; |
361 | |
362 | SOCKADDR_ZERO(&sin6, sizeof(sin6)); |
363 | sin6.sin6_family = AF_INET6; |
364 | sin6.sin6_len = sizeof(struct sockaddr_in6); |
365 | sin6.sin6_addr = ip6->ip6_src; |
366 | |
367 | rt = rtalloc1(SA(&sin6), 0, 0); |
368 | if (rt != NULL) { |
369 | RT_LOCK(rt); |
370 | } |
371 | if (!rt || rt->rt_ifp != ifp) { |
372 | #if 0 |
373 | log(LOG_WARNING, "%s: packet from %s dropped " |
374 | "due to ingress filter\n" , if_name(&sc->gif_if), |
375 | ip6_sprintf(&sin6.sin6_addr)); |
376 | #endif |
377 | if (rt != NULL) { |
378 | RT_UNLOCK(rt); |
379 | rtfree(rt); |
380 | } |
381 | return 0; |
382 | } |
383 | RT_UNLOCK(rt); |
384 | rtfree(rt); |
385 | } |
386 | |
387 | return 128 * 2; |
388 | } |
389 | |
390 | /* |
391 | * we know that we are in IFF_UP, outer address available, and outer family |
392 | * matched the physical addr family. see gif_encapcheck(). |
393 | * sanity check for arg should have been done in the caller. |
394 | */ |
395 | int |
396 | gif_encapcheck6( |
397 | const struct mbuf *m, |
398 | __unused int off, |
399 | __unused int proto, |
400 | void *arg) |
401 | { |
402 | struct ip6_hdr ip6; |
403 | struct gif_softc *sc; |
404 | struct ifnet *ifp; |
405 | |
406 | /* sanity check done in caller */ |
407 | sc = (struct gif_softc *)arg; |
408 | |
409 | GIF_LOCK_ASSERT(sc); |
410 | |
411 | mbuf_copydata(mbuf: (struct mbuf *)(size_t)m, offset: 0, length: sizeof(ip6), out_data: &ip6); |
412 | ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL; |
413 | |
414 | return gif_validate6(ip6: &ip6, sc, ifp); |
415 | } |
416 | |