xref: /freebsd/sys/net/if_stf.c (revision 058ac3e8063366dafa634d9107642e12b038bf09)
1 /*	$FreeBSD$	*/
2 /*	$KAME: if_stf.c,v 1.73 2001/12/03 11:08:30 keiichi Exp $	*/
3 
4 /*-
5  * SPDX-License-Identifier: BSD-3-Clause
6  *
7  * Copyright (C) 2000 WIDE Project.
8  * Copyright (c) 2010 Hiroki Sato <hrs@FreeBSD.org>
9  * Copyright (c) 2013 Ermal Luci <eri@FreeBSD.org>
10  * Copyright (c) 2017-2021 Rubicon Communications, LLC (Netgate)
11  * All rights reserved.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the project nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 /*
39  * 6to4 interface, based on RFC3056.
40  *
41  * 6to4 interface is NOT capable of link-layer (I mean, IPv4) multicasting.
42  * There is no address mapping defined from IPv6 multicast address to IPv4
43  * address.  Therefore, we do not have IFF_MULTICAST on the interface.
44  *
45  * Due to the lack of address mapping for link-local addresses, we cannot
46  * throw packets toward link-local addresses (fe80::x).  Also, we cannot throw
47  * packets to link-local multicast addresses (ff02::x).
48  *
49  * Here are interesting symptoms due to the lack of link-local address:
50  *
51  * Unicast routing exchange:
52  * - RIPng: Impossible.  Uses link-local multicast packet toward ff02::9,
53  *   and link-local addresses as nexthop.
54  * - OSPFv6: Impossible.  OSPFv6 assumes that there's link-local address
55  *   assigned to the link, and makes use of them.  Also, HELLO packets use
56  *   link-local multicast addresses (ff02::5 and ff02::6).
57  * - BGP4+: Maybe.  You can only use global address as nexthop, and global
58  *   address as TCP endpoint address.
59  *
60  * Multicast routing protocols:
61  * - PIM: Hello packet cannot be used to discover adjacent PIM routers.
62  *   Adjacent PIM routers must be configured manually (is it really spec-wise
63  *   correct thing to do?).
64  *
65  * ICMPv6:
66  * - Redirects cannot be used due to the lack of link-local address.
67  *
68  * stf interface does not have, and will not need, a link-local address.
69  * It seems to have no real benefit and does not help the above symptoms much.
70  * Even if we assign link-locals to interface, we cannot really
71  * use link-local unicast/multicast on top of 6to4 cloud (since there's no
72  * encapsulation defined for link-local address), and the above analysis does
73  * not change.  RFC3056 does not mandate the assignment of link-local address
74  * either.
75  *
76  * 6to4 interface has security issues.  Refer to
77  * http://playground.iijlab.net/i-d/draft-itojun-ipv6-transition-abuse-00.txt
78  * for details.  The code tries to filter out some of malicious packets.
79  * Note that there is no way to be 100% secure.
80  */
81 
82 #include <sys/param.h>
83 #include <sys/systm.h>
84 #include <sys/socket.h>
85 #include <sys/sockio.h>
86 #include <sys/mbuf.h>
87 #include <sys/endian.h>
88 #include <sys/errno.h>
89 #include <sys/kernel.h>
90 #include <sys/lock.h>
91 #include <sys/module.h>
92 #include <sys/priv.h>
93 #include <sys/proc.h>
94 #include <sys/queue.h>
95 #include <sys/sdt.h>
96 #include <sys/sysctl.h>
97 #include <machine/cpu.h>
98 
99 #include <sys/malloc.h>
100 
101 #include <net/if.h>
102 #include <net/if_var.h>
103 #include <net/if_clone.h>
104 #include <net/route.h>
105 #include <net/route/nhop.h>
106 #include <net/netisr.h>
107 #include <net/if_stf.h>
108 #include <net/if_types.h>
109 #include <net/vnet.h>
110 
111 #include <netinet/in.h>
112 #include <netinet/in_fib.h>
113 #include <netinet/in_systm.h>
114 #include <netinet/ip.h>
115 #include <netinet/ip_var.h>
116 #include <netinet/in_var.h>
117 
118 #include <netinet/ip6.h>
119 #include <netinet6/in6_fib.h>
120 #include <netinet6/ip6_var.h>
121 #include <netinet6/in6_var.h>
122 #include <netinet/ip_ecn.h>
123 
124 #include <netinet/ip_encap.h>
125 
126 #include <machine/stdarg.h>
127 
128 #include <net/bpf.h>
129 
130 #include <security/mac/mac_framework.h>
131 
132 SDT_PROVIDER_DEFINE(if_stf);
133 SDT_PROBE_DEFINE3(if_stf, , encapcheck, in, "struct mbuf *", "int", "int");
134 SDT_PROBE_DEFINE0(if_stf, , encapcheck, accept);
135 SDT_PROBE_DEFINE3(if_stf, , getsrcifa6, in, "struct ifnet *",
136     "struct in6_addr *", "struct in6_addr *");
137 SDT_PROBE_DEFINE2(if_stf, , getsrcifa6, found, "struct in6_addr *",
138     "struct in6_addr *");
139 SDT_PROBE_DEFINE0(if_stf, , getsrcifa6, notfound);
140 
141 SDT_PROBE_DEFINE4(if_stf, , stf_output, in, "struct ifnet *", "struct mbuf *",
142     "struct sockaddr *", "struct route *");
143 SDT_PROBE_DEFINE2(if_stf, , stf_output, error, "int", "int");
144 SDT_PROBE_DEFINE1(if_stf, , stf_output, out, "int");
145 
146 SDT_PROBE_DEFINE3(if_stf, , checkaddr6, in, "struct stf_softc *",
147     "struct in6_addr *", "struct ifnet *");
148 SDT_PROBE_DEFINE2(if_stf, , checkaddr6, out, "int", "int");
149 
150 SDT_PROBE_DEFINE3(if_stf, , stf_input, in, "struct mbuf *", "int", "int");
151 SDT_PROBE_DEFINE2(if_stf, , stf_input, out, "int", "int");
152 
153 SDT_PROBE_DEFINE3(if_stf, , ioctl, sv4net, "struct in_addr *",
154     "struct in_addr *", "int");
155 SDT_PROBE_DEFINE1(if_stf, , ioctl, sdstv4, "struct in_addr *");
156 SDT_PROBE_DEFINE1(if_stf, , ioctl, ifaddr, "struct ifaddr *");
157 
158 SDT_PROBE_DEFINE4(if_stf, , getin4addr_in6, out, "struct in6_addr *",
159     "struct in6_addr *", "struct in6_addr *", "struct sockaddr_in *");
160 
161 SDT_PROBE_DEFINE2(if_stf, , getin4addr, in, "struct in6_addr *", "struct in6_addr *");
162 SDT_PROBE_DEFINE1(if_stf, , getin4addr, out, "struct sockaddr_in *");
163 
164 SYSCTL_DECL(_net_link);
165 static SYSCTL_NODE(_net_link, IFT_STF, stf, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
166     "6to4 Interface");
167 
168 static int stf_permit_rfc1918 = 0;
169 SYSCTL_INT(_net_link_stf, OID_AUTO, permit_rfc1918, CTLFLAG_RWTUN,
170     &stf_permit_rfc1918, 0, "Permit the use of private IPv4 addresses");
171 
172 #define STFUNIT		0
173 
174 #define IN6_IS_ADDR_6TO4(x)	(ntohs((x)->s6_addr16[0]) == 0x2002)
175 
176 /*
177  * XXX: Return a pointer with 16-bit aligned.  Don't cast it to
178  * struct in_addr *; use bcopy() instead.
179  */
180 #define GET_V4(x)	(&(x)->s6_addr16[1])
181 
182 struct stf_softc {
183 	struct ifnet	*sc_ifp;
184 	in_addr_t	braddr;		/* Border relay IPv4 address */
185 	in_addr_t	srcv4_addr;	/* Our IPv4 WAN address */
186 	u_int		v4prefixlen;	/* How much of the v4 address to include in our address. */
187 	u_int		sc_fibnum;
188 	const struct encaptab *encap_cookie;
189 };
190 #define STF2IFP(sc)	((sc)->sc_ifp)
191 
192 static const char stfname[] = "stf";
193 
194 static MALLOC_DEFINE(M_STF, stfname, "6to4 Tunnel Interface");
195 static const int ip_stf_ttl = 40;
196 
197 static int in_stf_input(struct mbuf *, int, int, void *);
198 static char *stfnames[] = {"stf0", "stf", "6to4", NULL};
199 
200 static int stfmodevent(module_t, int, void *);
201 static int stf_encapcheck(const struct mbuf *, int, int, void *);
202 static int stf_getsrcifa6(struct ifnet *, struct in6_addr *, struct in6_addr *);
203 static int stf_output(struct ifnet *, struct mbuf *, const struct sockaddr *,
204 	struct route *);
205 static int isrfc1918addr(struct in_addr *);
206 static int stf_checkaddr4(struct stf_softc *, struct in_addr *,
207 	struct ifnet *);
208 static int stf_checkaddr6(struct stf_softc *, struct in6_addr *,
209 	struct ifnet *);
210 static struct sockaddr_in *stf_getin4addr_in6(struct stf_softc *,
211 	struct sockaddr_in *, struct in6_addr, struct in6_addr,
212 	struct in6_addr);
213 static struct sockaddr_in *stf_getin4addr(struct stf_softc *,
214 	struct sockaddr_in *, struct in6_addr, struct in6_addr);
215 static int stf_ioctl(struct ifnet *, u_long, caddr_t);
216 
217 VNET_DEFINE_STATIC(struct if_clone *, stf_cloner);
218 #define V_stf_cloner	VNET(stf_cloner)
219 
220 static const struct encap_config ipv4_encap_cfg = {
221 	.proto = IPPROTO_IPV6,
222 	.min_length = sizeof(struct ip),
223 	.exact_match = (sizeof(in_addr_t) << 3) + 8,
224 	.check = stf_encapcheck,
225 	.input = in_stf_input
226 };
227 
228 static int
229 stf_clone_match(struct if_clone *ifc, const char *name)
230 {
231 	int i;
232 
233 	for(i = 0; stfnames[i] != NULL; i++) {
234 		if (strcmp(stfnames[i], name) == 0)
235 			return (1);
236 	}
237 
238 	return (0);
239 }
240 
241 static int
242 stf_clone_create(struct if_clone *ifc, char *name, size_t len,
243     struct ifc_data *ifd, struct ifnet **ifpp)
244 {
245 	char *dp;
246 	int err, unit, wildcard;
247 	struct stf_softc *sc;
248 	struct ifnet *ifp;
249 
250 	err = ifc_name2unit(name, &unit);
251 	if (err != 0)
252 		return (err);
253 	wildcard = (unit < 0);
254 
255 	/*
256 	 * We can only have one unit, but since unit allocation is
257 	 * already locked, we use it to keep from allocating extra
258 	 * interfaces.
259 	 */
260 	unit = STFUNIT;
261 	err = ifc_alloc_unit(ifc, &unit);
262 	if (err != 0)
263 		return (err);
264 
265 	sc = malloc(sizeof(struct stf_softc), M_STF, M_WAITOK | M_ZERO);
266 	ifp = STF2IFP(sc) = if_alloc(IFT_STF);
267 	if (ifp == NULL) {
268 		free(sc, M_STF);
269 		ifc_free_unit(ifc, unit);
270 		return (ENOSPC);
271 	}
272 	ifp->if_softc = sc;
273 	sc->sc_fibnum = curthread->td_proc->p_fibnum;
274 
275 	/*
276 	 * Set the name manually rather then using if_initname because
277 	 * we don't conform to the default naming convention for interfaces.
278 	 * In the wildcard case, we need to update the name.
279 	 */
280 	if (wildcard) {
281 		for (dp = name; *dp != '\0'; dp++);
282 		if (snprintf(dp, len - (dp-name), "%d", unit) >
283 		    len - (dp-name) - 1) {
284 			/*
285 			 * This can only be a programmer error and
286 			 * there's no straightforward way to recover if
287 			 * it happens.
288 			 */
289 			panic("if_clone_create(): interface name too long");
290 		}
291 	}
292 	strlcpy(ifp->if_xname, name, IFNAMSIZ);
293 	ifp->if_dname = stfname;
294 	ifp->if_dunit = IF_DUNIT_NONE;
295 
296 	sc->encap_cookie = ip_encap_attach(&ipv4_encap_cfg, sc, M_WAITOK);
297 	if (sc->encap_cookie == NULL) {
298 		if_printf(ifp, "attach failed\n");
299 		free(sc, M_STF);
300 		ifc_free_unit(ifc, unit);
301 		return (ENOMEM);
302 	}
303 
304 	ifp->if_mtu    = IPV6_MMTU;
305 	ifp->if_ioctl  = stf_ioctl;
306 	ifp->if_output = stf_output;
307 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
308 	if_attach(ifp);
309 	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
310 	*ifpp = ifp;
311 
312 	return (0);
313 }
314 
315 static int
316 stf_clone_destroy(struct if_clone *ifc, struct ifnet *ifp, uint32_t flags)
317 {
318 	struct stf_softc *sc = ifp->if_softc;
319 	int err __unused;
320 
321 	err = ip_encap_detach(sc->encap_cookie);
322 	KASSERT(err == 0, ("Unexpected error detaching encap_cookie"));
323 	bpfdetach(ifp);
324 	if_detach(ifp);
325 	if_free(ifp);
326 
327 	free(sc, M_STF);
328 	ifc_free_unit(ifc, STFUNIT);
329 
330 	return (0);
331 }
332 
333 static void
334 vnet_stf_init(const void *unused __unused)
335 {
336 	struct if_clone_addreq req = {
337 		.match_f = stf_clone_match,
338 		.create_f = stf_clone_create,
339 		.destroy_f = stf_clone_destroy,
340 	};
341 	V_stf_cloner = ifc_attach_cloner(stfname, &req);
342 }
343 VNET_SYSINIT(vnet_stf_init, SI_SUB_PSEUDO, SI_ORDER_ANY, vnet_stf_init, NULL);
344 
345 static void
346 vnet_stf_uninit(const void *unused __unused)
347 {
348 	if_clone_detach(V_stf_cloner);
349 	V_stf_cloner = NULL;
350 }
351 VNET_SYSUNINIT(vnet_stf_uninit, SI_SUB_PSEUDO, SI_ORDER_ANY, vnet_stf_uninit,
352     NULL);
353 
354 static int
355 stfmodevent(module_t mod, int type, void *data)
356 {
357 
358 	switch (type) {
359 	case MOD_LOAD:
360 		/* Done in vnet_stf_init() */
361 		break;
362 	case MOD_UNLOAD:
363 		/* Done in vnet_stf_uninit() */
364 		break;
365 	default:
366 		return (EOPNOTSUPP);
367 	}
368 
369 	return (0);
370 }
371 
372 static moduledata_t stf_mod = {
373 	"if_stf",
374 	stfmodevent,
375 	0
376 };
377 
378 DECLARE_MODULE(if_stf, stf_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
379 MODULE_VERSION(if_stf, 2);
380 
381 static int
382 stf_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
383 {
384 	struct ip ip;
385 	struct stf_softc *sc;
386 	struct in6_addr addr6, mask6;
387 	struct sockaddr_in sin4addr, sin4mask;
388 
389 	SDT_PROBE3(if_stf, , encapcheck, in, m, off, proto);
390 
391 	sc = (struct stf_softc *)arg;
392 	if (sc == NULL)
393 		return (0);
394 
395 	if ((STF2IFP(sc)->if_flags & IFF_UP) == 0)
396 		return (0);
397 
398 	/* IFF_LINK0 means "no decapsulation" */
399 	if ((STF2IFP(sc)->if_flags & IFF_LINK0) != 0)
400 		return (0);
401 
402 	if (proto != IPPROTO_IPV6)
403 		return (0);
404 
405 	m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
406 
407 	if (ip.ip_v != 4)
408 		return (0);
409 
410 	if (stf_getsrcifa6(STF2IFP(sc), &addr6, &mask6) != 0)
411 		return (0);
412 
413 	if (sc->srcv4_addr != INADDR_ANY) {
414 		sin4addr.sin_addr.s_addr = sc->srcv4_addr;
415 		sin4addr.sin_family = AF_INET;
416 	} else
417 		if (stf_getin4addr(sc, &sin4addr, addr6, mask6) == NULL)
418 			return (0);
419 
420 	if (sin4addr.sin_addr.s_addr != ip.ip_dst.s_addr)
421 		return (0);
422 
423 	if (IN6_IS_ADDR_6TO4(&addr6)) {
424 		/*
425 		 * 6to4 (RFC 3056).
426 		 * Check if IPv4 src matches the IPv4 address derived
427 		 * from the local 6to4 address masked by prefixmask.
428 		 * success on: src = 10.1.1.1, ia6->ia_addr = 2002:0a00:.../24
429 		 * fail on: src = 10.1.1.1, ia6->ia_addr = 2002:0b00:.../24
430 		 */
431 		memcpy(&sin4mask.sin_addr, GET_V4(&mask6),
432 		    sizeof(sin4mask.sin_addr));
433 		if ((sin4addr.sin_addr.s_addr & sin4mask.sin_addr.s_addr) !=
434 		    (ip.ip_src.s_addr & sin4mask.sin_addr.s_addr))
435 			return (0);
436 	} else {
437 		/* 6rd (RFC 5569) */
438 		/*
439 		 * No restriction on the src address in the case of
440 		 * 6rd because the stf(4) interface always has a
441 		 * prefix which covers whole of IPv4 src address
442 		 * range.  So, stf_output() will catch all of
443 		 * 6rd-capsuled IPv4 traffic with suspicious inner dst
444 		 * IPv4 address (i.e. the IPv6 destination address is
445 		 * one the admin does not like to route to outside),
446 		 * and then it discard them silently.
447 		 */
448 	}
449 
450 	SDT_PROBE0(if_stf, , encapcheck, accept);
451 
452 	/* stf interface makes single side match only */
453 	return (32);
454 }
455 
456 static int
457 stf_getsrcifa6(struct ifnet *ifp, struct in6_addr *addr, struct in6_addr *mask)
458 {
459 	struct ifaddr *ia;
460 	struct in_ifaddr *ia4;
461 	struct in6_addr addr6, mask6;
462 	struct sockaddr_in sin4;
463 	struct stf_softc *sc;
464 	struct in_addr in;
465 
466 	NET_EPOCH_ASSERT();
467 
468 	sc = ifp->if_softc;
469 
470 	SDT_PROBE3(if_stf, , getsrcifa6, in, ifp, addr, mask);
471 
472 	CK_STAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) {
473 		if (ia->ifa_addr->sa_family != AF_INET6)
474 			continue;
475 
476 		addr6 = *IFA_IN6(ia);
477 		mask6 = *IFA_MASKIN6(ia);
478 		if (sc->srcv4_addr != INADDR_ANY)
479 			bcopy(&sc->srcv4_addr, &in, sizeof(in));
480 		else {
481 			if (stf_getin4addr(sc, &sin4, addr6, mask6) == NULL)
482 				continue;
483 			bcopy(&sin4.sin_addr, &in, sizeof(in));
484 		}
485 
486 		CK_LIST_FOREACH(ia4, INADDR_HASH(in.s_addr), ia_hash)
487 			if (ia4->ia_addr.sin_addr.s_addr == in.s_addr)
488 				break;
489 		if (ia4 == NULL)
490 			continue;
491 
492 		*addr = addr6;
493 		*mask = mask6;
494 
495 		SDT_PROBE2(if_stf, , getsrcifa6, found, addr, mask);
496 
497 		return (0);
498 	}
499 
500 	SDT_PROBE0(if_stf, , getsrcifa6, notfound);
501 
502 	return (ENOENT);
503 }
504 
505 static int
506 stf_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
507     struct route *ro)
508 {
509 	struct stf_softc *sc;
510 	const struct sockaddr_in6 *dst6;
511 	struct sockaddr_in dst4, src4;
512 	u_int8_t tos;
513 	struct ip *ip;
514 	struct ip6_hdr *ip6;
515 	struct in6_addr addr6, mask6;
516 	int error;
517 
518 	SDT_PROBE4(if_stf, , stf_output, in, ifp, m, dst, ro);
519 
520 #ifdef MAC
521 	error = mac_ifnet_check_transmit(ifp, m);
522 	if (error) {
523 		m_freem(m);
524 		SDT_PROBE2(if_stf, , stf_output, error, error, __LINE__);
525 		return (error);
526 	}
527 #endif
528 
529 	sc = ifp->if_softc;
530 	dst6 = (const struct sockaddr_in6 *)dst;
531 
532 	/* just in case */
533 	if ((ifp->if_flags & IFF_UP) == 0) {
534 		m_freem(m);
535 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
536 		SDT_PROBE2(if_stf, , stf_output, error, ENETDOWN, __LINE__);
537 		return (ENETDOWN);
538 	}
539 
540 	/*
541 	 * If we don't have an ip4 address that match my inner ip6 address,
542 	 * we shouldn't generate output.  Without this check, we'll end up
543 	 * using wrong IPv4 source.
544 	 */
545 	if (stf_getsrcifa6(ifp, &addr6, &mask6) != 0) {
546 		m_freem(m);
547 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
548 		SDT_PROBE2(if_stf, , stf_output, error, ENETDOWN, __LINE__);
549 		return (ENETDOWN);
550 	}
551 
552 	if (m->m_len < sizeof(*ip6)) {
553 		m = m_pullup(m, sizeof(*ip6));
554 		if (!m) {
555 			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
556 			SDT_PROBE2(if_stf, , stf_output, error, ENOBUFS,
557 			    __LINE__);
558 			return (ENOBUFS);
559 		}
560 	}
561 	ip6 = mtod(m, struct ip6_hdr *);
562 	tos = IPV6_TRAFFIC_CLASS(ip6);
563 
564 	/*
565 	 * Pickup the right outer dst addr from the list of candidates.
566 	 * ip6_dst has priority as it may be able to give us shorter IPv4 hops.
567 	 */
568 	if (stf_getin4addr_in6(sc, &dst4, addr6, mask6,
569 	    ip6->ip6_dst) == NULL) {
570 		if (sc->braddr != INADDR_ANY)
571 			dst4.sin_addr.s_addr = sc->braddr;
572 		else if (stf_getin4addr_in6(sc, &dst4, addr6, mask6,
573 		    dst6->sin6_addr) == NULL) {
574 			m_freem(m);
575 			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
576 			SDT_PROBE2(if_stf, , stf_output, error, ENETUNREACH,
577 			    __LINE__);
578 			return (ENETUNREACH);
579 		}
580 	}
581 
582 	if (bpf_peers_present(ifp->if_bpf)) {
583 		/*
584 		 * We need to prepend the address family as
585 		 * a four byte field.  Cons up a dummy header
586 		 * to pacify bpf.  This is safe because bpf
587 		 * will only read from the mbuf (i.e., it won't
588 		 * try to free it or keep a pointer a to it).
589 		 */
590 		u_int af = AF_INET6;
591 		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m);
592 	}
593 
594 	M_PREPEND(m, sizeof(struct ip), M_NOWAIT);
595 	if (m == NULL) {
596 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
597 		SDT_PROBE2(if_stf, , stf_output, error, ENOBUFS, __LINE__);
598 		return (ENOBUFS);
599 	}
600 	ip = mtod(m, struct ip *);
601 
602 	bzero(ip, sizeof(*ip));
603 
604 	if (sc->srcv4_addr != INADDR_ANY)
605 		src4.sin_addr.s_addr = sc->srcv4_addr;
606 	else if (stf_getin4addr(sc, &src4, addr6, mask6) == NULL) {
607 		m_freem(m);
608 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
609 		SDT_PROBE2(if_stf, , stf_output, error, ENETUNREACH, __LINE__);
610 		return (ENETUNREACH);
611 	}
612 	bcopy(&src4.sin_addr, &ip->ip_src, sizeof(ip->ip_src));
613 	bcopy(&dst4.sin_addr, &ip->ip_dst, sizeof(ip->ip_dst));
614 
615 	ip->ip_p = IPPROTO_IPV6;
616 	ip->ip_ttl = ip_stf_ttl;
617 	ip->ip_len = htons(m->m_pkthdr.len);
618 	if (ifp->if_flags & IFF_LINK1)
619 		ip_ecn_ingress(ECN_ALLOWED, &ip->ip_tos, &tos);
620 	else
621 		ip_ecn_ingress(ECN_NOCARE, &ip->ip_tos, &tos);
622 
623 	M_SETFIB(m, sc->sc_fibnum);
624 	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
625 	error = ip_output(m, NULL, NULL, 0, NULL, NULL);
626 
627 	SDT_PROBE1(if_stf, , stf_output, out, error);
628 	return (error);
629 }
630 
631 static int
632 isrfc1918addr(struct in_addr *in)
633 {
634 	/*
635 	 * returns 1 if private address range:
636 	 * 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
637 	 */
638 	if (stf_permit_rfc1918 == 0 && (
639 	    (ntohl(in->s_addr) & 0xff000000) >> 24 == 10 ||
640 	    (ntohl(in->s_addr) & 0xfff00000) >> 16 == 172 * 256 + 16 ||
641 	    (ntohl(in->s_addr) & 0xffff0000) >> 16 == 192 * 256 + 168))
642 		return (1);
643 
644 	return (0);
645 }
646 
647 static int
648 stf_checkaddr4(struct stf_softc *sc, struct in_addr *in, struct ifnet *inifp)
649 {
650 	struct in_ifaddr *ia4;
651 
652 	/*
653 	 * reject packets with the following address:
654 	 * 224.0.0.0/4 0.0.0.0/8 127.0.0.0/8 255.0.0.0/8
655 	 */
656 	if (IN_MULTICAST(ntohl(in->s_addr)))
657 		return (-1);
658 	switch ((ntohl(in->s_addr) & 0xff000000) >> 24) {
659 	case 0: case 127: case 255:
660 		return (-1);
661 	}
662 
663 	/*
664 	 * reject packets with broadcast
665 	 */
666 	CK_STAILQ_FOREACH(ia4, &V_in_ifaddrhead, ia_link) {
667 		if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0)
668 			continue;
669 		if (in->s_addr == ia4->ia_broadaddr.sin_addr.s_addr) {
670 			return (-1);
671 		}
672 	}
673 
674 	/*
675 	 * perform ingress filter
676 	 */
677 	if (sc && (STF2IFP(sc)->if_flags & IFF_LINK2) == 0 && inifp) {
678 		struct nhop_object *nh;
679 
680 		NET_EPOCH_ASSERT();
681 		nh = fib4_lookup(sc->sc_fibnum, *in, 0, 0, 0);
682 		if (nh == NULL)
683 			return (-1);
684 
685 		if (nh->nh_ifp != inifp)
686 			return (-1);
687 	}
688 
689 	return (0);
690 }
691 
692 static int
693 stf_checkaddr6(struct stf_softc *sc, struct in6_addr *in6, struct ifnet *inifp)
694 {
695 	SDT_PROBE3(if_stf, , checkaddr6, in, sc, in6, inifp);
696 
697 	/*
698 	 * check 6to4 addresses
699 	 */
700 	if (IN6_IS_ADDR_6TO4(in6)) {
701 		struct in_addr in4;
702 		int ret;
703 
704 		bcopy(GET_V4(in6), &in4, sizeof(in4));
705 		ret = stf_checkaddr4(sc, &in4, inifp);
706 		SDT_PROBE2(if_stf, , checkaddr6, out, ret, __LINE__);
707 		return (ret);
708 	}
709 
710 	/*
711 	 * reject anything that look suspicious.  the test is implemented
712 	 * in ip6_input too, but we check here as well to
713 	 * (1) reject bad packets earlier, and
714 	 * (2) to be safe against future ip6_input change.
715 	 */
716 	if (IN6_IS_ADDR_V4COMPAT(in6)) {
717 		SDT_PROBE2(if_stf, , checkaddr6, out, -1, __LINE__);
718 		return (-1);
719 	}
720 
721 	if (IN6_IS_ADDR_V4MAPPED(in6)) {
722 		SDT_PROBE2(if_stf, , checkaddr6, out, -1, __LINE__);
723 		return (-1);
724 	}
725 
726 	SDT_PROBE2(if_stf, , checkaddr6, out, 0, __LINE__);
727 	return (0);
728 }
729 
730 static int
731 in_stf_input(struct mbuf *m, int off, int proto, void *arg)
732 {
733 	struct stf_softc *sc = arg;
734 	struct ip ip;
735 	struct ip6_hdr *ip6;
736 	u_int8_t otos, itos;
737 	struct ifnet *ifp;
738 	struct nhop_object *nh;
739 
740 	NET_EPOCH_ASSERT();
741 
742 	SDT_PROBE3(if_stf, , stf_input, in, m, off, proto);
743 
744 	if (proto != IPPROTO_IPV6) {
745 		m_freem(m);
746 		SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
747 		return (IPPROTO_DONE);
748 	}
749 
750 	m_copydata(m, 0, sizeof(struct ip), (caddr_t)&ip);
751 	if (sc == NULL || (STF2IFP(sc)->if_flags & IFF_UP) == 0) {
752 		m_freem(m);
753 		SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
754 		return (IPPROTO_DONE);
755 	}
756 
757 	ifp = STF2IFP(sc);
758 
759 #ifdef MAC
760 	mac_ifnet_create_mbuf(ifp, m);
761 #endif
762 
763 	/*
764 	 * perform sanity check against outer src/dst.
765 	 * for source, perform ingress filter as well.
766 	 */
767 	if (stf_checkaddr4(sc, &ip.ip_dst, NULL) < 0 ||
768 	    stf_checkaddr4(sc, &ip.ip_src, m->m_pkthdr.rcvif) < 0) {
769 		m_freem(m);
770 		SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
771 		return (IPPROTO_DONE);
772 	}
773 
774 	otos = ip.ip_tos;
775 	m_adj(m, off);
776 
777 	if (m->m_len < sizeof(*ip6)) {
778 		m = m_pullup(m, sizeof(*ip6));
779 		if (!m) {
780 			SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE,
781 			    __LINE__);
782 			return (IPPROTO_DONE);
783 		}
784 	}
785 	ip6 = mtod(m, struct ip6_hdr *);
786 
787 	/*
788 	 * perform sanity check against inner src/dst.
789 	 * for source, perform ingress filter as well.
790 	 */
791 	if (stf_checkaddr6(sc, &ip6->ip6_dst, NULL) < 0 ||
792 	    stf_checkaddr6(sc, &ip6->ip6_src, m->m_pkthdr.rcvif) < 0) {
793 		m_freem(m);
794 		SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
795 		return (IPPROTO_DONE);
796 	}
797 
798 	/*
799 	 * reject packets with private address range.
800 	 * (requirement from RFC3056 section 2 1st paragraph)
801 	 */
802 	if ((IN6_IS_ADDR_6TO4(&ip6->ip6_src) && isrfc1918addr(&ip.ip_src)) ||
803 	    (IN6_IS_ADDR_6TO4(&ip6->ip6_dst) && isrfc1918addr(&ip.ip_dst))) {
804 		m_freem(m);
805 		SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
806 		return (IPPROTO_DONE);
807 	}
808 
809 	/*
810 	 * Ignore if the destination is the same stf interface because
811 	 * all of valid IPv6 outgoing traffic should go interfaces
812 	 * except for it.
813 	 */
814 	nh = fib6_lookup(sc->sc_fibnum, &ip6->ip6_dst, 0, 0, 0);
815 	if (nh == NULL) {
816 		m_free(m);
817 		SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
818 		return (IPPROTO_DONE);
819 	}
820 	if ((nh->nh_ifp == ifp) &&
821 	    (!IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &nh->gw6_sa.sin6_addr))) {
822 		m_free(m);
823 		SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
824 		return (IPPROTO_DONE);
825 	}
826 
827 	itos = IPV6_TRAFFIC_CLASS(ip6);
828 	if ((ifp->if_flags & IFF_LINK1) != 0)
829 		ip_ecn_egress(ECN_ALLOWED, &otos, &itos);
830 	else
831 		ip_ecn_egress(ECN_NOCARE, &otos, &itos);
832 	ip6->ip6_flow &= ~htonl(0xff << 20);
833 	ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
834 
835 	m->m_pkthdr.rcvif = ifp;
836 
837 	if (bpf_peers_present(ifp->if_bpf)) {
838 		/*
839 		 * We need to prepend the address family as
840 		 * a four byte field.  Cons up a dummy header
841 		 * to pacify bpf.  This is safe because bpf
842 		 * will only read from the mbuf (i.e., it won't
843 		 * try to free it or keep a pointer a to it).
844 		 */
845 		u_int32_t af = AF_INET6;
846 		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m);
847 	}
848 
849 	/*
850 	 * Put the packet to the network layer input queue according to the
851 	 * specified address family.
852 	 * See net/if_gif.c for possible issues with packet processing
853 	 * reorder due to extra queueing.
854 	 */
855 	if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
856 	if_inc_counter(ifp, IFCOUNTER_IBYTES, m->m_pkthdr.len);
857 	M_SETFIB(m, ifp->if_fib);
858 	netisr_dispatch(NETISR_IPV6, m);
859 	SDT_PROBE2(if_stf, , stf_input, out, IPPROTO_DONE, __LINE__);
860 	return (IPPROTO_DONE);
861 }
862 
863 static struct sockaddr_in *
864 stf_getin4addr_in6(struct stf_softc *sc, struct sockaddr_in *sin,
865     struct in6_addr addr6, struct in6_addr mask6, struct in6_addr in6)
866 {
867        int i;
868        struct sockaddr_in *out;
869 
870 	/*
871 	* When (src addr & src mask) != (in6 & src mask),
872 	* the dst is not in the 6rd domain.  The IPv4 address must
873 	* not be used.
874 	*/
875 	for (i = 0; i < sizeof(addr6); i++) {
876 		if ((((u_char *)&addr6)[i] & ((u_char *)&mask6)[i]) !=
877 		    (((u_char *)&in6)[i] & ((u_char *)&mask6)[i])) {
878 			SDT_PROBE4(if_stf, , getin4addr_in6, out, &addr6,
879 			    &mask6, &in6, NULL);
880 			return (NULL);
881 		}
882 	}
883 
884 	/* After the mask check, use in6 instead of addr6. */
885 	out = stf_getin4addr(sc, sin, in6, mask6);
886 	SDT_PROBE4(if_stf, , getin4addr_in6, out, &addr6, &mask6, &in6, out);
887 	return (out);
888 }
889 
890 static struct sockaddr_in *
891 stf_getin4addr(struct stf_softc *sc, struct sockaddr_in *sin,
892     struct in6_addr addr6, struct in6_addr mask6)
893 {
894 	struct in_addr *in;
895 
896 	SDT_PROBE2(if_stf, , getin4addr, in, &addr6, &mask6);
897 
898 	memset(sin, 0, sizeof(*sin));
899 	in = &sin->sin_addr;
900 	if (IN6_IS_ADDR_6TO4(&addr6)) {
901 		/* 6to4 (RFC 3056) */
902 		bcopy(GET_V4(&addr6), in, sizeof(*in));
903 		if (isrfc1918addr(in))
904 			return (NULL);
905 	} else {
906 		/* 6rd (RFC 5569) */
907 		in_addr_t v4prefix;
908 		uint8_t *v6 = (uint8_t*)&addr6;
909 		uint64_t v6prefix;
910 		u_int plen;
911 		u_int v4suffixlen;
912 
913 		v4prefix = 0;
914 		if (sc->v4prefixlen < 32) {
915 			v4suffixlen = 32 - sc->v4prefixlen;
916 			v4prefix = ntohl(sc->srcv4_addr) &
917 			    (0xffffffffU << v4suffixlen);
918 		} else {
919 			MPASS(sc->v4prefixlen == 32);
920 			v4suffixlen = 32;
921 		}
922 
923 		plen = in6_mask2len(&mask6, NULL);
924 		if (plen > 64)
925 			return (NULL);
926 
927 		/* To make this simple we do not support prefixes longer than
928 		 * 64 bits. RFC5969 says "a 6rd delegated prefix SHOULD be /64
929 		 * or shorter." so this is a moderately safe assumption. */
930 		v6prefix = be64toh(*(uint64_t *)v6);
931 
932 		/* Shift away the v6 prefix itself. */
933 		v6prefix <<= plen;
934 		v6prefix >>= plen;
935 
936 		/* Now shift away everything after the v4 address. */
937 		v6prefix >>= 64 - plen - v4suffixlen;
938 
939 		sin->sin_addr.s_addr = htonl(v4prefix | (uint32_t)v6prefix);
940 	}
941 
942 	SDT_PROBE1(if_stf, , getin4addr, out, sin);
943 
944 	return (sin);
945 }
946 
947 static int
948 stf_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
949 {
950 	struct ifaddr *ifa;
951 	struct ifdrv *ifd;
952 	struct ifreq *ifr;
953 	struct sockaddr_in sin4;
954 	struct stf_softc *sc_cur;
955 	struct stfv4args args;
956 	int error, mtu;
957 
958 	error = 0;
959 	sc_cur = ifp->if_softc;
960 
961 	switch (cmd) {
962 	case SIOCSDRVSPEC:
963 		ifd = (struct ifdrv *)data;
964 		error = priv_check(curthread, PRIV_NET_ADDIFADDR);
965 		if (error)
966 			break;
967 		if (ifd->ifd_cmd == STF6RD_SV4NET) {
968 			if (ifd->ifd_len != sizeof(args)) {
969 				error = EINVAL;
970 				break;
971 			}
972 			bzero(&args, sizeof(args));
973 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
974 			if (error)
975 				break;
976 
977 			if (args.v4_prefixlen < 1 || args.v4_prefixlen > 32) {
978 				error = EINVAL;
979 				break;
980 			}
981 
982 			bcopy(&args.srcv4_addr, &sc_cur->srcv4_addr,
983 			    sizeof(sc_cur->srcv4_addr));
984 			sc_cur->v4prefixlen = args.v4_prefixlen;
985 			SDT_PROBE3(if_stf, , ioctl, sv4net, sc_cur->srcv4_addr,
986 			    sc_cur->srcv4_addr, sc_cur->v4prefixlen);
987 		} else if (ifd->ifd_cmd == STF6RD_SBR) {
988 			if (ifd->ifd_len != sizeof(args)) {
989 				error = EINVAL;
990 				break;
991 			}
992 			bzero(&args, sizeof(args));
993 			error = copyin(ifd->ifd_data, &args, ifd->ifd_len);
994 			if (error)
995 				break;
996 			sc_cur->braddr = args.braddr.s_addr;
997 			SDT_PROBE1(if_stf, , ioctl, sdstv4,
998 			    sc_cur->braddr);
999 		} else
1000 			error = EINVAL;
1001 		break;
1002 	case SIOCGDRVSPEC:
1003 		ifd = (struct ifdrv *)data;
1004 		if (ifd->ifd_cmd != STF6RD_GV4NET) {
1005 			error = EINVAL;
1006 			break;
1007 		}
1008 		if (ifd->ifd_len != sizeof(args)) {
1009 			error = EINVAL;
1010 			break;
1011 		}
1012 		bzero(&args, sizeof(args));
1013 		args.srcv4_addr.s_addr = sc_cur->srcv4_addr;
1014 		args.braddr.s_addr = sc_cur->braddr;
1015 		args.v4_prefixlen = sc_cur->v4prefixlen;
1016 		error = copyout(&args, ifd->ifd_data, ifd->ifd_len);
1017 		break;
1018 	case SIOCSIFADDR:
1019 		ifa = (struct ifaddr *)data;
1020 		SDT_PROBE1(if_stf, , ioctl, ifaddr, ifa);
1021 		if (ifa == NULL || ifa->ifa_addr->sa_family != AF_INET6) {
1022 			error = EAFNOSUPPORT;
1023 			break;
1024 		}
1025 		if (stf_getin4addr(sc_cur, &sin4,
1026 		    satosin6(ifa->ifa_addr)->sin6_addr,
1027 		    satosin6(ifa->ifa_netmask)->sin6_addr) == NULL) {
1028 			error = EINVAL;
1029 			break;
1030 		}
1031 		ifp->if_flags |= IFF_UP;
1032 		ifp->if_drv_flags |= IFF_DRV_RUNNING;
1033 		break;
1034 
1035 	case SIOCADDMULTI:
1036 	case SIOCDELMULTI:
1037 		ifr = (struct ifreq *)data;
1038 		if (ifr && ifr->ifr_addr.sa_family == AF_INET6)
1039 			;
1040 		else
1041 			error = EAFNOSUPPORT;
1042 		break;
1043 
1044 	case SIOCGIFMTU:
1045 		break;
1046 
1047 	case SIOCSIFMTU:
1048 		ifr = (struct ifreq *)data;
1049 		mtu = ifr->ifr_mtu;
1050 		/* RFC 4213 3.2 ideal world MTU */
1051 		if (mtu < IPV6_MINMTU || mtu > IF_MAXMTU - 20)
1052 			return (EINVAL);
1053 		ifp->if_mtu = mtu;
1054 		break;
1055 
1056 	default:
1057 		error = EINVAL;
1058 		break;
1059 	}
1060 
1061 	return (error);
1062 }
1063