xref: /freebsd/sys/netinet/in_gif.c (revision 4b421e2daaa3e23db6b5a51f8ca5b2da0d894a56)
133841545SHajimu UMEMOTO /*	$KAME: in_gif.c,v 1.54 2001/05/14 14:02:16 itojun Exp $	*/
2686cdd19SJun-ichiro itojun Hagino 
3c398230bSWarner Losh /*-
4cfa1ca9dSYoshinobu Inoue  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5cfa1ca9dSYoshinobu Inoue  * All rights reserved.
6cfa1ca9dSYoshinobu Inoue  *
7cfa1ca9dSYoshinobu Inoue  * Redistribution and use in source and binary forms, with or without
8cfa1ca9dSYoshinobu Inoue  * modification, are permitted provided that the following conditions
9cfa1ca9dSYoshinobu Inoue  * are met:
10cfa1ca9dSYoshinobu Inoue  * 1. Redistributions of source code must retain the above copyright
11cfa1ca9dSYoshinobu Inoue  *    notice, this list of conditions and the following disclaimer.
12cfa1ca9dSYoshinobu Inoue  * 2. Redistributions in binary form must reproduce the above copyright
13cfa1ca9dSYoshinobu Inoue  *    notice, this list of conditions and the following disclaimer in the
14cfa1ca9dSYoshinobu Inoue  *    documentation and/or other materials provided with the distribution.
15cfa1ca9dSYoshinobu Inoue  * 3. Neither the name of the project nor the names of its contributors
16cfa1ca9dSYoshinobu Inoue  *    may be used to endorse or promote products derived from this software
17cfa1ca9dSYoshinobu Inoue  *    without specific prior written permission.
18cfa1ca9dSYoshinobu Inoue  *
19cfa1ca9dSYoshinobu Inoue  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20cfa1ca9dSYoshinobu Inoue  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21cfa1ca9dSYoshinobu Inoue  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22cfa1ca9dSYoshinobu Inoue  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23cfa1ca9dSYoshinobu Inoue  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24cfa1ca9dSYoshinobu Inoue  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25cfa1ca9dSYoshinobu Inoue  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26cfa1ca9dSYoshinobu Inoue  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27cfa1ca9dSYoshinobu Inoue  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28cfa1ca9dSYoshinobu Inoue  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29cfa1ca9dSYoshinobu Inoue  * SUCH DAMAGE.
30cfa1ca9dSYoshinobu Inoue  */
31cfa1ca9dSYoshinobu Inoue 
324b421e2dSMike Silbersack #include <sys/cdefs.h>
334b421e2dSMike Silbersack __FBSDID("$FreeBSD$");
344b421e2dSMike Silbersack 
35cfa1ca9dSYoshinobu Inoue #include "opt_mrouting.h"
36686cdd19SJun-ichiro itojun Hagino #include "opt_inet.h"
37cfa1ca9dSYoshinobu Inoue #include "opt_inet6.h"
38cfa1ca9dSYoshinobu Inoue 
39cfa1ca9dSYoshinobu Inoue #include <sys/param.h>
40cfa1ca9dSYoshinobu Inoue #include <sys/systm.h>
41cfa1ca9dSYoshinobu Inoue #include <sys/socket.h>
42cfa1ca9dSYoshinobu Inoue #include <sys/sockio.h>
43cfa1ca9dSYoshinobu Inoue #include <sys/mbuf.h>
44cfa1ca9dSYoshinobu Inoue #include <sys/errno.h>
45cfa1ca9dSYoshinobu Inoue #include <sys/kernel.h>
46cfa1ca9dSYoshinobu Inoue #include <sys/sysctl.h>
479426aedfSHajimu UMEMOTO #include <sys/protosw.h>
48686cdd19SJun-ichiro itojun Hagino 
49686cdd19SJun-ichiro itojun Hagino #include <sys/malloc.h>
50cfa1ca9dSYoshinobu Inoue 
51cfa1ca9dSYoshinobu Inoue #include <net/if.h>
52cfa1ca9dSYoshinobu Inoue #include <net/route.h>
53cfa1ca9dSYoshinobu Inoue 
54cfa1ca9dSYoshinobu Inoue #include <netinet/in.h>
55cfa1ca9dSYoshinobu Inoue #include <netinet/in_systm.h>
56cfa1ca9dSYoshinobu Inoue #include <netinet/ip.h>
576a800098SYoshinobu Inoue #include <netinet/ip_var.h>
586a800098SYoshinobu Inoue #include <netinet/in_gif.h>
59686cdd19SJun-ichiro itojun Hagino #include <netinet/in_var.h>
60686cdd19SJun-ichiro itojun Hagino #include <netinet/ip_encap.h>
616a800098SYoshinobu Inoue #include <netinet/ip_ecn.h>
62686cdd19SJun-ichiro itojun Hagino 
636a800098SYoshinobu Inoue #ifdef INET6
64686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h>
656a800098SYoshinobu Inoue #endif
66cfa1ca9dSYoshinobu Inoue 
67cfa1ca9dSYoshinobu Inoue #ifdef MROUTING
68cfa1ca9dSYoshinobu Inoue #include <netinet/ip_mroute.h>
69cfa1ca9dSYoshinobu Inoue #endif /* MROUTING */
70cfa1ca9dSYoshinobu Inoue 
71cfa1ca9dSYoshinobu Inoue #include <net/if_gif.h>
72cfa1ca9dSYoshinobu Inoue 
739426aedfSHajimu UMEMOTO static int gif_validate4(const struct ip *, struct gif_softc *,
749426aedfSHajimu UMEMOTO 	struct ifnet *);
759426aedfSHajimu UMEMOTO 
769426aedfSHajimu UMEMOTO extern  struct domain inetdomain;
77303989a2SRuslan Ermilov struct protosw in_gif_protosw = {
78303989a2SRuslan Ermilov 	.pr_type =		SOCK_RAW,
79303989a2SRuslan Ermilov 	.pr_domain =		&inetdomain,
80303989a2SRuslan Ermilov 	.pr_protocol =		0/* IPPROTO_IPV[46] */,
81303989a2SRuslan Ermilov 	.pr_flags =		PR_ATOMIC|PR_ADDR,
82303989a2SRuslan Ermilov 	.pr_input =		in_gif_input,
83303989a2SRuslan Ermilov 	.pr_output =		(pr_output_t*)rip_output,
84303989a2SRuslan Ermilov 	.pr_ctloutput =		rip_ctloutput,
85303989a2SRuslan Ermilov 	.pr_usrreqs =		&rip_usrreqs
869426aedfSHajimu UMEMOTO };
879426aedfSHajimu UMEMOTO 
88673623b3SBrooks Davis static int ip_gif_ttl = GIF_TTL;
89cfa1ca9dSYoshinobu Inoue SYSCTL_INT(_net_inet_ip, IPCTL_GIF_TTL, gifttl, CTLFLAG_RW,
90cfa1ca9dSYoshinobu Inoue 	&ip_gif_ttl,	0, "");
91cfa1ca9dSYoshinobu Inoue 
92cfa1ca9dSYoshinobu Inoue int
93f2565d68SRobert Watson in_gif_output(struct ifnet *ifp, int family, struct mbuf *m)
94cfa1ca9dSYoshinobu Inoue {
95fc74a9f9SBrooks Davis 	struct gif_softc *sc = ifp->if_softc;
96cfa1ca9dSYoshinobu Inoue 	struct sockaddr_in *dst = (struct sockaddr_in *)&sc->gif_ro.ro_dst;
97cfa1ca9dSYoshinobu Inoue 	struct sockaddr_in *sin_src = (struct sockaddr_in *)sc->gif_psrc;
98cfa1ca9dSYoshinobu Inoue 	struct sockaddr_in *sin_dst = (struct sockaddr_in *)sc->gif_pdst;
99cfa1ca9dSYoshinobu Inoue 	struct ip iphdr;	/* capsule IP header, host byte ordered */
10073ff045cSAndrew Thompson 	struct etherip_header eiphdr;
101cfa1ca9dSYoshinobu Inoue 	int proto, error;
102cfa1ca9dSYoshinobu Inoue 	u_int8_t tos;
103cfa1ca9dSYoshinobu Inoue 
10425af0bb5SGleb Smirnoff 	GIF_LOCK_ASSERT(sc);
10525af0bb5SGleb Smirnoff 
106cfa1ca9dSYoshinobu Inoue 	if (sin_src == NULL || sin_dst == NULL ||
107cfa1ca9dSYoshinobu Inoue 	    sin_src->sin_family != AF_INET ||
108cfa1ca9dSYoshinobu Inoue 	    sin_dst->sin_family != AF_INET) {
109cfa1ca9dSYoshinobu Inoue 		m_freem(m);
110cfa1ca9dSYoshinobu Inoue 		return EAFNOSUPPORT;
111cfa1ca9dSYoshinobu Inoue 	}
112cfa1ca9dSYoshinobu Inoue 
113cfa1ca9dSYoshinobu Inoue 	switch (family) {
114686cdd19SJun-ichiro itojun Hagino #ifdef INET
115cfa1ca9dSYoshinobu Inoue 	case AF_INET:
116cfa1ca9dSYoshinobu Inoue 	    {
117cfa1ca9dSYoshinobu Inoue 		struct ip *ip;
118cfa1ca9dSYoshinobu Inoue 
119cfa1ca9dSYoshinobu Inoue 		proto = IPPROTO_IPV4;
120cfa1ca9dSYoshinobu Inoue 		if (m->m_len < sizeof(*ip)) {
121cfa1ca9dSYoshinobu Inoue 			m = m_pullup(m, sizeof(*ip));
122cfa1ca9dSYoshinobu Inoue 			if (!m)
123cfa1ca9dSYoshinobu Inoue 				return ENOBUFS;
124cfa1ca9dSYoshinobu Inoue 		}
125cfa1ca9dSYoshinobu Inoue 		ip = mtod(m, struct ip *);
126cfa1ca9dSYoshinobu Inoue 		tos = ip->ip_tos;
127cfa1ca9dSYoshinobu Inoue 		break;
128cfa1ca9dSYoshinobu Inoue 	    }
129686cdd19SJun-ichiro itojun Hagino #endif /* INET */
130cfa1ca9dSYoshinobu Inoue #ifdef INET6
131cfa1ca9dSYoshinobu Inoue 	case AF_INET6:
132cfa1ca9dSYoshinobu Inoue 	    {
133686cdd19SJun-ichiro itojun Hagino 		struct ip6_hdr *ip6;
134cfa1ca9dSYoshinobu Inoue 		proto = IPPROTO_IPV6;
135cfa1ca9dSYoshinobu Inoue 		if (m->m_len < sizeof(*ip6)) {
136cfa1ca9dSYoshinobu Inoue 			m = m_pullup(m, sizeof(*ip6));
137cfa1ca9dSYoshinobu Inoue 			if (!m)
138cfa1ca9dSYoshinobu Inoue 				return ENOBUFS;
139cfa1ca9dSYoshinobu Inoue 		}
140cfa1ca9dSYoshinobu Inoue 		ip6 = mtod(m, struct ip6_hdr *);
141cfa1ca9dSYoshinobu Inoue 		tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
142cfa1ca9dSYoshinobu Inoue 		break;
143cfa1ca9dSYoshinobu Inoue 	    }
144cfa1ca9dSYoshinobu Inoue #endif /* INET6 */
14573ff045cSAndrew Thompson 	case AF_LINK:
14673ff045cSAndrew Thompson  		proto = IPPROTO_ETHERIP;
14773ff045cSAndrew Thompson  		eiphdr.eip_ver = ETHERIP_VERSION & ETHERIP_VER_VERS_MASK;
14873ff045cSAndrew Thompson  		eiphdr.eip_pad = 0;
14973ff045cSAndrew Thompson  		/* prepend Ethernet-in-IP header */
15073ff045cSAndrew Thompson  		M_PREPEND(m, sizeof(struct etherip_header), M_DONTWAIT);
15173ff045cSAndrew Thompson  		if (m && m->m_len < sizeof(struct etherip_header))
15273ff045cSAndrew Thompson  			m = m_pullup(m, sizeof(struct etherip_header));
15373ff045cSAndrew Thompson  		if (m == NULL)
15473ff045cSAndrew Thompson  			return ENOBUFS;
15573ff045cSAndrew Thompson  		bcopy(&eiphdr, mtod(m, struct etherip_header *),
15673ff045cSAndrew Thompson 		    sizeof(struct etherip_header));
15773ff045cSAndrew Thompson 		break;
15873ff045cSAndrew Thompson 
159cfa1ca9dSYoshinobu Inoue 	default:
160686cdd19SJun-ichiro itojun Hagino #ifdef DEBUG
161cfa1ca9dSYoshinobu Inoue 		printf("in_gif_output: warning: unknown family %d passed\n",
162cfa1ca9dSYoshinobu Inoue 			family);
163cfa1ca9dSYoshinobu Inoue #endif
164cfa1ca9dSYoshinobu Inoue 		m_freem(m);
165cfa1ca9dSYoshinobu Inoue 		return EAFNOSUPPORT;
166cfa1ca9dSYoshinobu Inoue 	}
167cfa1ca9dSYoshinobu Inoue 
168cfa1ca9dSYoshinobu Inoue 	bzero(&iphdr, sizeof(iphdr));
169cfa1ca9dSYoshinobu Inoue 	iphdr.ip_src = sin_src->sin_addr;
170cfa1ca9dSYoshinobu Inoue 	/* bidirectional configured tunnel mode */
171cfa1ca9dSYoshinobu Inoue 	if (sin_dst->sin_addr.s_addr != INADDR_ANY)
172cfa1ca9dSYoshinobu Inoue 		iphdr.ip_dst = sin_dst->sin_addr;
173cfa1ca9dSYoshinobu Inoue 	else {
174cfa1ca9dSYoshinobu Inoue 		m_freem(m);
175cfa1ca9dSYoshinobu Inoue 		return ENETUNREACH;
176cfa1ca9dSYoshinobu Inoue 	}
177cfa1ca9dSYoshinobu Inoue 	iphdr.ip_p = proto;
178cfa1ca9dSYoshinobu Inoue 	/* version will be set in ip_output() */
179cfa1ca9dSYoshinobu Inoue 	iphdr.ip_ttl = ip_gif_ttl;
180cfa1ca9dSYoshinobu Inoue 	iphdr.ip_len = m->m_pkthdr.len + sizeof(struct ip);
18159dfcba4SHajimu UMEMOTO 	ip_ecn_ingress((ifp->if_flags & IFF_LINK1) ? ECN_ALLOWED : ECN_NOCARE,
18259dfcba4SHajimu UMEMOTO 		       &iphdr.ip_tos, &tos);
183cfa1ca9dSYoshinobu Inoue 
184cfa1ca9dSYoshinobu Inoue 	/* prepend new IP header */
185a163d034SWarner Losh 	M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
186cfa1ca9dSYoshinobu Inoue 	if (m && m->m_len < sizeof(struct ip))
187cfa1ca9dSYoshinobu Inoue 		m = m_pullup(m, sizeof(struct ip));
188cfa1ca9dSYoshinobu Inoue 	if (m == NULL) {
189cfa1ca9dSYoshinobu Inoue 		printf("ENOBUFS in in_gif_output %d\n", __LINE__);
190cfa1ca9dSYoshinobu Inoue 		return ENOBUFS;
191cfa1ca9dSYoshinobu Inoue 	}
192686cdd19SJun-ichiro itojun Hagino 	bcopy(&iphdr, mtod(m, struct ip *), sizeof(struct ip));
193cfa1ca9dSYoshinobu Inoue 
194cfa1ca9dSYoshinobu Inoue 	if (dst->sin_family != sin_dst->sin_family ||
195cfa1ca9dSYoshinobu Inoue 	    dst->sin_addr.s_addr != sin_dst->sin_addr.s_addr) {
196cfa1ca9dSYoshinobu Inoue 		/* cache route doesn't match */
19727de0135SBruce M Simpson 		bzero(dst, sizeof(*dst));
198cfa1ca9dSYoshinobu Inoue 		dst->sin_family = sin_dst->sin_family;
199cfa1ca9dSYoshinobu Inoue 		dst->sin_len = sizeof(struct sockaddr_in);
200cfa1ca9dSYoshinobu Inoue 		dst->sin_addr = sin_dst->sin_addr;
201cfa1ca9dSYoshinobu Inoue 		if (sc->gif_ro.ro_rt) {
202cfa1ca9dSYoshinobu Inoue 			RTFREE(sc->gif_ro.ro_rt);
203cfa1ca9dSYoshinobu Inoue 			sc->gif_ro.ro_rt = NULL;
204cfa1ca9dSYoshinobu Inoue 		}
205686cdd19SJun-ichiro itojun Hagino #if 0
206fc74a9f9SBrooks Davis 		GIF2IFP(sc)->if_mtu = GIF_MTU;
207686cdd19SJun-ichiro itojun Hagino #endif
208cfa1ca9dSYoshinobu Inoue 	}
209cfa1ca9dSYoshinobu Inoue 
210cfa1ca9dSYoshinobu Inoue 	if (sc->gif_ro.ro_rt == NULL) {
211e6e51f05SLuigi Rizzo 		rtalloc_ign(&sc->gif_ro, 0);
212cfa1ca9dSYoshinobu Inoue 		if (sc->gif_ro.ro_rt == NULL) {
213cfa1ca9dSYoshinobu Inoue 			m_freem(m);
214cfa1ca9dSYoshinobu Inoue 			return ENETUNREACH;
215cfa1ca9dSYoshinobu Inoue 		}
216686cdd19SJun-ichiro itojun Hagino 
217686cdd19SJun-ichiro itojun Hagino 		/* if it constitutes infinite encapsulation, punt. */
218686cdd19SJun-ichiro itojun Hagino 		if (sc->gif_ro.ro_rt->rt_ifp == ifp) {
219686cdd19SJun-ichiro itojun Hagino 			m_freem(m);
220686cdd19SJun-ichiro itojun Hagino 			return ENETUNREACH;	/* XXX */
221686cdd19SJun-ichiro itojun Hagino 		}
222686cdd19SJun-ichiro itojun Hagino #if 0
223686cdd19SJun-ichiro itojun Hagino 		ifp->if_mtu = sc->gif_ro.ro_rt->rt_ifp->if_mtu
224686cdd19SJun-ichiro itojun Hagino 			- sizeof(struct ip);
225686cdd19SJun-ichiro itojun Hagino #endif
226cfa1ca9dSYoshinobu Inoue 	}
227cfa1ca9dSYoshinobu Inoue 
2285d846453SSam Leffler 	error = ip_output(m, NULL, &sc->gif_ro, 0, NULL, NULL);
22998335aa9SGleb Smirnoff 
230fc74a9f9SBrooks Davis 	if (!(GIF2IFP(sc)->if_flags & IFF_LINK0) &&
2315e5da865SGleb Smirnoff 	    sc->gif_ro.ro_rt != NULL) {
23298335aa9SGleb Smirnoff 		RTFREE(sc->gif_ro.ro_rt);
23398335aa9SGleb Smirnoff 		sc->gif_ro.ro_rt = NULL;
23498335aa9SGleb Smirnoff 	}
23598335aa9SGleb Smirnoff 
236cfa1ca9dSYoshinobu Inoue 	return (error);
237cfa1ca9dSYoshinobu Inoue }
238cfa1ca9dSYoshinobu Inoue 
239cfa1ca9dSYoshinobu Inoue void
240f2565d68SRobert Watson in_gif_input(struct mbuf *m, int off)
241cfa1ca9dSYoshinobu Inoue {
242cfa1ca9dSYoshinobu Inoue 	struct ifnet *gifp = NULL;
24367df9f38SBjoern A. Zeeb 	struct gif_softc *sc;
244cfa1ca9dSYoshinobu Inoue 	struct ip *ip;
245686cdd19SJun-ichiro itojun Hagino 	int af;
2466a800098SYoshinobu Inoue 	u_int8_t otos;
247f0ffb944SJulian Elischer 	int proto;
248cfa1ca9dSYoshinobu Inoue 
249cfa1ca9dSYoshinobu Inoue 	ip = mtod(m, struct ip *);
250f0ffb944SJulian Elischer 	proto = ip->ip_p;
251cfa1ca9dSYoshinobu Inoue 
25267df9f38SBjoern A. Zeeb 	sc = (struct gif_softc *)encap_getarg(m);
25367df9f38SBjoern A. Zeeb 	if (sc == NULL) {
25467df9f38SBjoern A. Zeeb 		m_freem(m);
25567df9f38SBjoern A. Zeeb 		ipstat.ips_nogif++;
25667df9f38SBjoern A. Zeeb 		return;
25767df9f38SBjoern A. Zeeb 	}
258cfa1ca9dSYoshinobu Inoue 
25967df9f38SBjoern A. Zeeb 	gifp = GIF2IFP(sc);
260686cdd19SJun-ichiro itojun Hagino 	if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) {
261cfa1ca9dSYoshinobu Inoue 		m_freem(m);
262cfa1ca9dSYoshinobu Inoue 		ipstat.ips_nogif++;
263cfa1ca9dSYoshinobu Inoue 		return;
264cfa1ca9dSYoshinobu Inoue 	}
265cfa1ca9dSYoshinobu Inoue 
2666a800098SYoshinobu Inoue 	otos = ip->ip_tos;
267cfa1ca9dSYoshinobu Inoue 	m_adj(m, off);
268cfa1ca9dSYoshinobu Inoue 
269cfa1ca9dSYoshinobu Inoue 	switch (proto) {
270686cdd19SJun-ichiro itojun Hagino #ifdef INET
271cfa1ca9dSYoshinobu Inoue 	case IPPROTO_IPV4:
272cfa1ca9dSYoshinobu Inoue 	    {
273cfa1ca9dSYoshinobu Inoue 		struct ip *ip;
274cfa1ca9dSYoshinobu Inoue 		af = AF_INET;
275cfa1ca9dSYoshinobu Inoue 		if (m->m_len < sizeof(*ip)) {
276cfa1ca9dSYoshinobu Inoue 			m = m_pullup(m, sizeof(*ip));
277cfa1ca9dSYoshinobu Inoue 			if (!m)
278cfa1ca9dSYoshinobu Inoue 				return;
279cfa1ca9dSYoshinobu Inoue 		}
280cfa1ca9dSYoshinobu Inoue 		ip = mtod(m, struct ip *);
28159dfcba4SHajimu UMEMOTO 		if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ?
28259dfcba4SHajimu UMEMOTO 				  ECN_ALLOWED : ECN_NOCARE,
28359dfcba4SHajimu UMEMOTO 				  &otos, &ip->ip_tos) == 0) {
28459dfcba4SHajimu UMEMOTO 			m_freem(m);
28559dfcba4SHajimu UMEMOTO 			return;
28659dfcba4SHajimu UMEMOTO 		}
287cfa1ca9dSYoshinobu Inoue 		break;
288cfa1ca9dSYoshinobu Inoue 	    }
289686cdd19SJun-ichiro itojun Hagino #endif
290cfa1ca9dSYoshinobu Inoue #ifdef INET6
291cfa1ca9dSYoshinobu Inoue 	case IPPROTO_IPV6:
292cfa1ca9dSYoshinobu Inoue 	    {
293cfa1ca9dSYoshinobu Inoue 		struct ip6_hdr *ip6;
29459dfcba4SHajimu UMEMOTO 		u_int8_t itos, oitos;
29559dfcba4SHajimu UMEMOTO 
296cfa1ca9dSYoshinobu Inoue 		af = AF_INET6;
297cfa1ca9dSYoshinobu Inoue 		if (m->m_len < sizeof(*ip6)) {
298cfa1ca9dSYoshinobu Inoue 			m = m_pullup(m, sizeof(*ip6));
299cfa1ca9dSYoshinobu Inoue 			if (!m)
300cfa1ca9dSYoshinobu Inoue 				return;
301cfa1ca9dSYoshinobu Inoue 		}
302cfa1ca9dSYoshinobu Inoue 		ip6 = mtod(m, struct ip6_hdr *);
30359dfcba4SHajimu UMEMOTO 		itos = oitos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
30459dfcba4SHajimu UMEMOTO 		if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ?
30559dfcba4SHajimu UMEMOTO 				  ECN_ALLOWED : ECN_NOCARE,
30659dfcba4SHajimu UMEMOTO 				  &otos, &itos) == 0) {
30759dfcba4SHajimu UMEMOTO 			m_freem(m);
30859dfcba4SHajimu UMEMOTO 			return;
30959dfcba4SHajimu UMEMOTO 		}
31059dfcba4SHajimu UMEMOTO 		if (itos != oitos) {
311cfa1ca9dSYoshinobu Inoue 			ip6->ip6_flow &= ~htonl(0xff << 20);
3126a800098SYoshinobu Inoue 			ip6->ip6_flow |= htonl((u_int32_t)itos << 20);
31359dfcba4SHajimu UMEMOTO 		}
314cfa1ca9dSYoshinobu Inoue 		break;
315cfa1ca9dSYoshinobu Inoue 	    }
316cfa1ca9dSYoshinobu Inoue #endif /* INET6 */
31773ff045cSAndrew Thompson  	case IPPROTO_ETHERIP:
31873ff045cSAndrew Thompson  		af = AF_LINK;
31973ff045cSAndrew Thompson  		break;
32073ff045cSAndrew Thompson 
321cfa1ca9dSYoshinobu Inoue 	default:
322cfa1ca9dSYoshinobu Inoue 		ipstat.ips_nogif++;
323cfa1ca9dSYoshinobu Inoue 		m_freem(m);
324cfa1ca9dSYoshinobu Inoue 		return;
325cfa1ca9dSYoshinobu Inoue 	}
326cfa1ca9dSYoshinobu Inoue 	gif_input(m, af, gifp);
327cfa1ca9dSYoshinobu Inoue 	return;
328cfa1ca9dSYoshinobu Inoue }
329686cdd19SJun-ichiro itojun Hagino 
330686cdd19SJun-ichiro itojun Hagino /*
3319426aedfSHajimu UMEMOTO  * validate outer address.
332686cdd19SJun-ichiro itojun Hagino  */
3339426aedfSHajimu UMEMOTO static int
334f2565d68SRobert Watson gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp)
3359426aedfSHajimu UMEMOTO {
336686cdd19SJun-ichiro itojun Hagino 	struct sockaddr_in *src, *dst;
337686cdd19SJun-ichiro itojun Hagino 	struct in_ifaddr *ia4;
338686cdd19SJun-ichiro itojun Hagino 
339686cdd19SJun-ichiro itojun Hagino 	src = (struct sockaddr_in *)sc->gif_psrc;
340686cdd19SJun-ichiro itojun Hagino 	dst = (struct sockaddr_in *)sc->gif_pdst;
341686cdd19SJun-ichiro itojun Hagino 
342686cdd19SJun-ichiro itojun Hagino 	/* check for address match */
3439426aedfSHajimu UMEMOTO 	if (src->sin_addr.s_addr != ip->ip_dst.s_addr ||
3449426aedfSHajimu UMEMOTO 	    dst->sin_addr.s_addr != ip->ip_src.s_addr)
345686cdd19SJun-ichiro itojun Hagino 		return 0;
346686cdd19SJun-ichiro itojun Hagino 
347686cdd19SJun-ichiro itojun Hagino 	/* martian filters on outer source - NOT done in ip_input! */
3489426aedfSHajimu UMEMOTO 	if (IN_MULTICAST(ntohl(ip->ip_src.s_addr)))
349686cdd19SJun-ichiro itojun Hagino 		return 0;
3509426aedfSHajimu UMEMOTO 	switch ((ntohl(ip->ip_src.s_addr) & 0xff000000) >> 24) {
351686cdd19SJun-ichiro itojun Hagino 	case 0: case 127: case 255:
352686cdd19SJun-ichiro itojun Hagino 		return 0;
353686cdd19SJun-ichiro itojun Hagino 	}
354686cdd19SJun-ichiro itojun Hagino 	/* reject packets with broadcast on source */
35506cd0a3fSHajimu UMEMOTO 	TAILQ_FOREACH(ia4, &in_ifaddrhead, ia_link) {
356686cdd19SJun-ichiro itojun Hagino 		if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0)
357686cdd19SJun-ichiro itojun Hagino 			continue;
3589426aedfSHajimu UMEMOTO 		if (ip->ip_src.s_addr == ia4->ia_broadaddr.sin_addr.s_addr)
359686cdd19SJun-ichiro itojun Hagino 			return 0;
360686cdd19SJun-ichiro itojun Hagino 	}
361686cdd19SJun-ichiro itojun Hagino 
362686cdd19SJun-ichiro itojun Hagino 	/* ingress filters on outer source */
363fc74a9f9SBrooks Davis 	if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0 && ifp) {
364686cdd19SJun-ichiro itojun Hagino 		struct sockaddr_in sin;
365686cdd19SJun-ichiro itojun Hagino 		struct rtentry *rt;
366686cdd19SJun-ichiro itojun Hagino 
367686cdd19SJun-ichiro itojun Hagino 		bzero(&sin, sizeof(sin));
368686cdd19SJun-ichiro itojun Hagino 		sin.sin_family = AF_INET;
369686cdd19SJun-ichiro itojun Hagino 		sin.sin_len = sizeof(struct sockaddr_in);
3709426aedfSHajimu UMEMOTO 		sin.sin_addr = ip->ip_src;
371686cdd19SJun-ichiro itojun Hagino 		rt = rtalloc1((struct sockaddr *)&sin, 0, 0UL);
3729426aedfSHajimu UMEMOTO 		if (!rt || rt->rt_ifp != ifp) {
37333841545SHajimu UMEMOTO #if 0
37433841545SHajimu UMEMOTO 			log(LOG_WARNING, "%s: packet from 0x%x dropped "
375fc74a9f9SBrooks Davis 			    "due to ingress filter\n", if_name(GIF2IFP(sc)),
37633841545SHajimu UMEMOTO 			    (u_int32_t)ntohl(sin.sin_addr.s_addr));
37733841545SHajimu UMEMOTO #endif
37833841545SHajimu UMEMOTO 			if (rt)
379bc60490aSChristian S.J. Peron 				RTFREE_LOCKED(rt);
380686cdd19SJun-ichiro itojun Hagino 			return 0;
381686cdd19SJun-ichiro itojun Hagino 		}
382bc60490aSChristian S.J. Peron 		RTFREE_LOCKED(rt);
383686cdd19SJun-ichiro itojun Hagino 	}
384686cdd19SJun-ichiro itojun Hagino 
38533841545SHajimu UMEMOTO 	return 32 * 2;
386686cdd19SJun-ichiro itojun Hagino }
3879426aedfSHajimu UMEMOTO 
3889426aedfSHajimu UMEMOTO /*
3899426aedfSHajimu UMEMOTO  * we know that we are in IFF_UP, outer address available, and outer family
3909426aedfSHajimu UMEMOTO  * matched the physical addr family.  see gif_encapcheck().
3919426aedfSHajimu UMEMOTO  */
3929426aedfSHajimu UMEMOTO int
393f2565d68SRobert Watson gif_encapcheck4(const struct mbuf *m, int off, int proto, void *arg)
3949426aedfSHajimu UMEMOTO {
3959426aedfSHajimu UMEMOTO 	struct ip ip;
3969426aedfSHajimu UMEMOTO 	struct gif_softc *sc;
3979426aedfSHajimu UMEMOTO 	struct ifnet *ifp;
3989426aedfSHajimu UMEMOTO 
3999426aedfSHajimu UMEMOTO 	/* sanity check done in caller */
4009426aedfSHajimu UMEMOTO 	sc = (struct gif_softc *)arg;
4019426aedfSHajimu UMEMOTO 
4029426aedfSHajimu UMEMOTO 	/* LINTED const cast */
4039426aedfSHajimu UMEMOTO 	m_copydata(m, 0, sizeof(ip), (caddr_t)&ip);
4049426aedfSHajimu UMEMOTO 	ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL;
4059426aedfSHajimu UMEMOTO 
4069426aedfSHajimu UMEMOTO 	return gif_validate4(&ip, sc, ifp);
4079426aedfSHajimu UMEMOTO }
4089426aedfSHajimu UMEMOTO 
4099426aedfSHajimu UMEMOTO int
410f2565d68SRobert Watson in_gif_attach(struct gif_softc *sc)
4119426aedfSHajimu UMEMOTO {
4129426aedfSHajimu UMEMOTO 	sc->encap_cookie4 = encap_attach_func(AF_INET, -1, gif_encapcheck,
4139426aedfSHajimu UMEMOTO 	    &in_gif_protosw, sc);
4149426aedfSHajimu UMEMOTO 	if (sc->encap_cookie4 == NULL)
4159426aedfSHajimu UMEMOTO 		return EEXIST;
4169426aedfSHajimu UMEMOTO 	return 0;
4179426aedfSHajimu UMEMOTO }
4189426aedfSHajimu UMEMOTO 
4199426aedfSHajimu UMEMOTO int
420f2565d68SRobert Watson in_gif_detach(struct gif_softc *sc)
4219426aedfSHajimu UMEMOTO {
4229426aedfSHajimu UMEMOTO 	int error;
4239426aedfSHajimu UMEMOTO 
4249426aedfSHajimu UMEMOTO 	error = encap_detach(sc->encap_cookie4);
4259426aedfSHajimu UMEMOTO 	if (error == 0)
4269426aedfSHajimu UMEMOTO 		sc->encap_cookie4 = NULL;
4279426aedfSHajimu UMEMOTO 	return error;
4289426aedfSHajimu UMEMOTO }
429