133841545SHajimu UMEMOTO /* $KAME: in_gif.c,v 1.54 2001/05/14 14:02:16 itojun Exp $ */ 2686cdd19SJun-ichiro itojun Hagino 3c398230bSWarner Losh /*- 4cfa1ca9dSYoshinobu Inoue * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 5cfa1ca9dSYoshinobu Inoue * All rights reserved. 6cfa1ca9dSYoshinobu Inoue * 7cfa1ca9dSYoshinobu Inoue * Redistribution and use in source and binary forms, with or without 8cfa1ca9dSYoshinobu Inoue * modification, are permitted provided that the following conditions 9cfa1ca9dSYoshinobu Inoue * are met: 10cfa1ca9dSYoshinobu Inoue * 1. Redistributions of source code must retain the above copyright 11cfa1ca9dSYoshinobu Inoue * notice, this list of conditions and the following disclaimer. 12cfa1ca9dSYoshinobu Inoue * 2. Redistributions in binary form must reproduce the above copyright 13cfa1ca9dSYoshinobu Inoue * notice, this list of conditions and the following disclaimer in the 14cfa1ca9dSYoshinobu Inoue * documentation and/or other materials provided with the distribution. 15cfa1ca9dSYoshinobu Inoue * 3. Neither the name of the project nor the names of its contributors 16cfa1ca9dSYoshinobu Inoue * may be used to endorse or promote products derived from this software 17cfa1ca9dSYoshinobu Inoue * without specific prior written permission. 18cfa1ca9dSYoshinobu Inoue * 19cfa1ca9dSYoshinobu Inoue * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 20cfa1ca9dSYoshinobu Inoue * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21cfa1ca9dSYoshinobu Inoue * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22cfa1ca9dSYoshinobu Inoue * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 23cfa1ca9dSYoshinobu Inoue * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24cfa1ca9dSYoshinobu Inoue * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25cfa1ca9dSYoshinobu Inoue * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26cfa1ca9dSYoshinobu Inoue * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27cfa1ca9dSYoshinobu Inoue * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28cfa1ca9dSYoshinobu Inoue * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29cfa1ca9dSYoshinobu Inoue * SUCH DAMAGE. 30cfa1ca9dSYoshinobu Inoue */ 31cfa1ca9dSYoshinobu Inoue 324b421e2dSMike Silbersack #include <sys/cdefs.h> 334b421e2dSMike Silbersack __FBSDID("$FreeBSD$"); 344b421e2dSMike Silbersack 35cfa1ca9dSYoshinobu Inoue #include "opt_mrouting.h" 36686cdd19SJun-ichiro itojun Hagino #include "opt_inet.h" 37cfa1ca9dSYoshinobu Inoue #include "opt_inet6.h" 38cfa1ca9dSYoshinobu Inoue 39cfa1ca9dSYoshinobu Inoue #include <sys/param.h> 40cfa1ca9dSYoshinobu Inoue #include <sys/systm.h> 41cfa1ca9dSYoshinobu Inoue #include <sys/socket.h> 42cfa1ca9dSYoshinobu Inoue #include <sys/sockio.h> 43cfa1ca9dSYoshinobu Inoue #include <sys/mbuf.h> 44cfa1ca9dSYoshinobu Inoue #include <sys/errno.h> 45cfa1ca9dSYoshinobu Inoue #include <sys/kernel.h> 46cfa1ca9dSYoshinobu Inoue #include <sys/sysctl.h> 479426aedfSHajimu UMEMOTO #include <sys/protosw.h> 48686cdd19SJun-ichiro itojun Hagino 49686cdd19SJun-ichiro itojun Hagino #include <sys/malloc.h> 50cfa1ca9dSYoshinobu Inoue 51cfa1ca9dSYoshinobu Inoue #include <net/if.h> 52cfa1ca9dSYoshinobu Inoue #include <net/route.h> 53cfa1ca9dSYoshinobu Inoue 54cfa1ca9dSYoshinobu Inoue #include <netinet/in.h> 55cfa1ca9dSYoshinobu Inoue #include <netinet/in_systm.h> 56cfa1ca9dSYoshinobu Inoue #include <netinet/ip.h> 576a800098SYoshinobu Inoue #include <netinet/ip_var.h> 586a800098SYoshinobu Inoue #include <netinet/in_gif.h> 59686cdd19SJun-ichiro itojun Hagino #include <netinet/in_var.h> 60686cdd19SJun-ichiro itojun Hagino #include <netinet/ip_encap.h> 616a800098SYoshinobu Inoue #include <netinet/ip_ecn.h> 62686cdd19SJun-ichiro itojun Hagino 636a800098SYoshinobu Inoue #ifdef INET6 64686cdd19SJun-ichiro itojun Hagino #include <netinet/ip6.h> 656a800098SYoshinobu Inoue #endif 66cfa1ca9dSYoshinobu Inoue 67cfa1ca9dSYoshinobu Inoue #ifdef MROUTING 68cfa1ca9dSYoshinobu Inoue #include <netinet/ip_mroute.h> 69cfa1ca9dSYoshinobu Inoue #endif /* MROUTING */ 70cfa1ca9dSYoshinobu Inoue 71cfa1ca9dSYoshinobu Inoue #include <net/if_gif.h> 72cfa1ca9dSYoshinobu Inoue 739426aedfSHajimu UMEMOTO static int gif_validate4(const struct ip *, struct gif_softc *, 749426aedfSHajimu UMEMOTO struct ifnet *); 759426aedfSHajimu UMEMOTO 769426aedfSHajimu UMEMOTO extern struct domain inetdomain; 77303989a2SRuslan Ermilov struct protosw in_gif_protosw = { 78303989a2SRuslan Ermilov .pr_type = SOCK_RAW, 79303989a2SRuslan Ermilov .pr_domain = &inetdomain, 80303989a2SRuslan Ermilov .pr_protocol = 0/* IPPROTO_IPV[46] */, 81303989a2SRuslan Ermilov .pr_flags = PR_ATOMIC|PR_ADDR, 82303989a2SRuslan Ermilov .pr_input = in_gif_input, 83303989a2SRuslan Ermilov .pr_output = (pr_output_t*)rip_output, 84303989a2SRuslan Ermilov .pr_ctloutput = rip_ctloutput, 85303989a2SRuslan Ermilov .pr_usrreqs = &rip_usrreqs 869426aedfSHajimu UMEMOTO }; 879426aedfSHajimu UMEMOTO 88673623b3SBrooks Davis static int ip_gif_ttl = GIF_TTL; 89cfa1ca9dSYoshinobu Inoue SYSCTL_INT(_net_inet_ip, IPCTL_GIF_TTL, gifttl, CTLFLAG_RW, 90cfa1ca9dSYoshinobu Inoue &ip_gif_ttl, 0, ""); 91cfa1ca9dSYoshinobu Inoue 92cfa1ca9dSYoshinobu Inoue int 93f2565d68SRobert Watson in_gif_output(struct ifnet *ifp, int family, struct mbuf *m) 94cfa1ca9dSYoshinobu Inoue { 95fc74a9f9SBrooks Davis struct gif_softc *sc = ifp->if_softc; 96cfa1ca9dSYoshinobu Inoue struct sockaddr_in *dst = (struct sockaddr_in *)&sc->gif_ro.ro_dst; 97cfa1ca9dSYoshinobu Inoue struct sockaddr_in *sin_src = (struct sockaddr_in *)sc->gif_psrc; 98cfa1ca9dSYoshinobu Inoue struct sockaddr_in *sin_dst = (struct sockaddr_in *)sc->gif_pdst; 99cfa1ca9dSYoshinobu Inoue struct ip iphdr; /* capsule IP header, host byte ordered */ 10073ff045cSAndrew Thompson struct etherip_header eiphdr; 101cfa1ca9dSYoshinobu Inoue int proto, error; 102cfa1ca9dSYoshinobu Inoue u_int8_t tos; 103cfa1ca9dSYoshinobu Inoue 10425af0bb5SGleb Smirnoff GIF_LOCK_ASSERT(sc); 10525af0bb5SGleb Smirnoff 106cfa1ca9dSYoshinobu Inoue if (sin_src == NULL || sin_dst == NULL || 107cfa1ca9dSYoshinobu Inoue sin_src->sin_family != AF_INET || 108cfa1ca9dSYoshinobu Inoue sin_dst->sin_family != AF_INET) { 109cfa1ca9dSYoshinobu Inoue m_freem(m); 110cfa1ca9dSYoshinobu Inoue return EAFNOSUPPORT; 111cfa1ca9dSYoshinobu Inoue } 112cfa1ca9dSYoshinobu Inoue 113cfa1ca9dSYoshinobu Inoue switch (family) { 114686cdd19SJun-ichiro itojun Hagino #ifdef INET 115cfa1ca9dSYoshinobu Inoue case AF_INET: 116cfa1ca9dSYoshinobu Inoue { 117cfa1ca9dSYoshinobu Inoue struct ip *ip; 118cfa1ca9dSYoshinobu Inoue 119cfa1ca9dSYoshinobu Inoue proto = IPPROTO_IPV4; 120cfa1ca9dSYoshinobu Inoue if (m->m_len < sizeof(*ip)) { 121cfa1ca9dSYoshinobu Inoue m = m_pullup(m, sizeof(*ip)); 122cfa1ca9dSYoshinobu Inoue if (!m) 123cfa1ca9dSYoshinobu Inoue return ENOBUFS; 124cfa1ca9dSYoshinobu Inoue } 125cfa1ca9dSYoshinobu Inoue ip = mtod(m, struct ip *); 126cfa1ca9dSYoshinobu Inoue tos = ip->ip_tos; 127cfa1ca9dSYoshinobu Inoue break; 128cfa1ca9dSYoshinobu Inoue } 129686cdd19SJun-ichiro itojun Hagino #endif /* INET */ 130cfa1ca9dSYoshinobu Inoue #ifdef INET6 131cfa1ca9dSYoshinobu Inoue case AF_INET6: 132cfa1ca9dSYoshinobu Inoue { 133686cdd19SJun-ichiro itojun Hagino struct ip6_hdr *ip6; 134cfa1ca9dSYoshinobu Inoue proto = IPPROTO_IPV6; 135cfa1ca9dSYoshinobu Inoue if (m->m_len < sizeof(*ip6)) { 136cfa1ca9dSYoshinobu Inoue m = m_pullup(m, sizeof(*ip6)); 137cfa1ca9dSYoshinobu Inoue if (!m) 138cfa1ca9dSYoshinobu Inoue return ENOBUFS; 139cfa1ca9dSYoshinobu Inoue } 140cfa1ca9dSYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 141cfa1ca9dSYoshinobu Inoue tos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 142cfa1ca9dSYoshinobu Inoue break; 143cfa1ca9dSYoshinobu Inoue } 144cfa1ca9dSYoshinobu Inoue #endif /* INET6 */ 14573ff045cSAndrew Thompson case AF_LINK: 14673ff045cSAndrew Thompson proto = IPPROTO_ETHERIP; 14773ff045cSAndrew Thompson eiphdr.eip_ver = ETHERIP_VERSION & ETHERIP_VER_VERS_MASK; 14873ff045cSAndrew Thompson eiphdr.eip_pad = 0; 14973ff045cSAndrew Thompson /* prepend Ethernet-in-IP header */ 15073ff045cSAndrew Thompson M_PREPEND(m, sizeof(struct etherip_header), M_DONTWAIT); 15173ff045cSAndrew Thompson if (m && m->m_len < sizeof(struct etherip_header)) 15273ff045cSAndrew Thompson m = m_pullup(m, sizeof(struct etherip_header)); 15373ff045cSAndrew Thompson if (m == NULL) 15473ff045cSAndrew Thompson return ENOBUFS; 15573ff045cSAndrew Thompson bcopy(&eiphdr, mtod(m, struct etherip_header *), 15673ff045cSAndrew Thompson sizeof(struct etherip_header)); 15773ff045cSAndrew Thompson break; 15873ff045cSAndrew Thompson 159cfa1ca9dSYoshinobu Inoue default: 160686cdd19SJun-ichiro itojun Hagino #ifdef DEBUG 161cfa1ca9dSYoshinobu Inoue printf("in_gif_output: warning: unknown family %d passed\n", 162cfa1ca9dSYoshinobu Inoue family); 163cfa1ca9dSYoshinobu Inoue #endif 164cfa1ca9dSYoshinobu Inoue m_freem(m); 165cfa1ca9dSYoshinobu Inoue return EAFNOSUPPORT; 166cfa1ca9dSYoshinobu Inoue } 167cfa1ca9dSYoshinobu Inoue 168cfa1ca9dSYoshinobu Inoue bzero(&iphdr, sizeof(iphdr)); 169cfa1ca9dSYoshinobu Inoue iphdr.ip_src = sin_src->sin_addr; 170cfa1ca9dSYoshinobu Inoue /* bidirectional configured tunnel mode */ 171cfa1ca9dSYoshinobu Inoue if (sin_dst->sin_addr.s_addr != INADDR_ANY) 172cfa1ca9dSYoshinobu Inoue iphdr.ip_dst = sin_dst->sin_addr; 173cfa1ca9dSYoshinobu Inoue else { 174cfa1ca9dSYoshinobu Inoue m_freem(m); 175cfa1ca9dSYoshinobu Inoue return ENETUNREACH; 176cfa1ca9dSYoshinobu Inoue } 177cfa1ca9dSYoshinobu Inoue iphdr.ip_p = proto; 178cfa1ca9dSYoshinobu Inoue /* version will be set in ip_output() */ 179cfa1ca9dSYoshinobu Inoue iphdr.ip_ttl = ip_gif_ttl; 180cfa1ca9dSYoshinobu Inoue iphdr.ip_len = m->m_pkthdr.len + sizeof(struct ip); 18159dfcba4SHajimu UMEMOTO ip_ecn_ingress((ifp->if_flags & IFF_LINK1) ? ECN_ALLOWED : ECN_NOCARE, 18259dfcba4SHajimu UMEMOTO &iphdr.ip_tos, &tos); 183cfa1ca9dSYoshinobu Inoue 184cfa1ca9dSYoshinobu Inoue /* prepend new IP header */ 185a163d034SWarner Losh M_PREPEND(m, sizeof(struct ip), M_DONTWAIT); 186cfa1ca9dSYoshinobu Inoue if (m && m->m_len < sizeof(struct ip)) 187cfa1ca9dSYoshinobu Inoue m = m_pullup(m, sizeof(struct ip)); 188cfa1ca9dSYoshinobu Inoue if (m == NULL) { 189cfa1ca9dSYoshinobu Inoue printf("ENOBUFS in in_gif_output %d\n", __LINE__); 190cfa1ca9dSYoshinobu Inoue return ENOBUFS; 191cfa1ca9dSYoshinobu Inoue } 192686cdd19SJun-ichiro itojun Hagino bcopy(&iphdr, mtod(m, struct ip *), sizeof(struct ip)); 193cfa1ca9dSYoshinobu Inoue 194cfa1ca9dSYoshinobu Inoue if (dst->sin_family != sin_dst->sin_family || 195cfa1ca9dSYoshinobu Inoue dst->sin_addr.s_addr != sin_dst->sin_addr.s_addr) { 196cfa1ca9dSYoshinobu Inoue /* cache route doesn't match */ 19727de0135SBruce M Simpson bzero(dst, sizeof(*dst)); 198cfa1ca9dSYoshinobu Inoue dst->sin_family = sin_dst->sin_family; 199cfa1ca9dSYoshinobu Inoue dst->sin_len = sizeof(struct sockaddr_in); 200cfa1ca9dSYoshinobu Inoue dst->sin_addr = sin_dst->sin_addr; 201cfa1ca9dSYoshinobu Inoue if (sc->gif_ro.ro_rt) { 202cfa1ca9dSYoshinobu Inoue RTFREE(sc->gif_ro.ro_rt); 203cfa1ca9dSYoshinobu Inoue sc->gif_ro.ro_rt = NULL; 204cfa1ca9dSYoshinobu Inoue } 205686cdd19SJun-ichiro itojun Hagino #if 0 206fc74a9f9SBrooks Davis GIF2IFP(sc)->if_mtu = GIF_MTU; 207686cdd19SJun-ichiro itojun Hagino #endif 208cfa1ca9dSYoshinobu Inoue } 209cfa1ca9dSYoshinobu Inoue 210cfa1ca9dSYoshinobu Inoue if (sc->gif_ro.ro_rt == NULL) { 211e6e51f05SLuigi Rizzo rtalloc_ign(&sc->gif_ro, 0); 212cfa1ca9dSYoshinobu Inoue if (sc->gif_ro.ro_rt == NULL) { 213cfa1ca9dSYoshinobu Inoue m_freem(m); 214cfa1ca9dSYoshinobu Inoue return ENETUNREACH; 215cfa1ca9dSYoshinobu Inoue } 216686cdd19SJun-ichiro itojun Hagino 217686cdd19SJun-ichiro itojun Hagino /* if it constitutes infinite encapsulation, punt. */ 218686cdd19SJun-ichiro itojun Hagino if (sc->gif_ro.ro_rt->rt_ifp == ifp) { 219686cdd19SJun-ichiro itojun Hagino m_freem(m); 220686cdd19SJun-ichiro itojun Hagino return ENETUNREACH; /* XXX */ 221686cdd19SJun-ichiro itojun Hagino } 222686cdd19SJun-ichiro itojun Hagino #if 0 223686cdd19SJun-ichiro itojun Hagino ifp->if_mtu = sc->gif_ro.ro_rt->rt_ifp->if_mtu 224686cdd19SJun-ichiro itojun Hagino - sizeof(struct ip); 225686cdd19SJun-ichiro itojun Hagino #endif 226cfa1ca9dSYoshinobu Inoue } 227cfa1ca9dSYoshinobu Inoue 2285d846453SSam Leffler error = ip_output(m, NULL, &sc->gif_ro, 0, NULL, NULL); 22998335aa9SGleb Smirnoff 230fc74a9f9SBrooks Davis if (!(GIF2IFP(sc)->if_flags & IFF_LINK0) && 2315e5da865SGleb Smirnoff sc->gif_ro.ro_rt != NULL) { 23298335aa9SGleb Smirnoff RTFREE(sc->gif_ro.ro_rt); 23398335aa9SGleb Smirnoff sc->gif_ro.ro_rt = NULL; 23498335aa9SGleb Smirnoff } 23598335aa9SGleb Smirnoff 236cfa1ca9dSYoshinobu Inoue return (error); 237cfa1ca9dSYoshinobu Inoue } 238cfa1ca9dSYoshinobu Inoue 239cfa1ca9dSYoshinobu Inoue void 240f2565d68SRobert Watson in_gif_input(struct mbuf *m, int off) 241cfa1ca9dSYoshinobu Inoue { 242cfa1ca9dSYoshinobu Inoue struct ifnet *gifp = NULL; 24367df9f38SBjoern A. Zeeb struct gif_softc *sc; 244cfa1ca9dSYoshinobu Inoue struct ip *ip; 245686cdd19SJun-ichiro itojun Hagino int af; 2466a800098SYoshinobu Inoue u_int8_t otos; 247f0ffb944SJulian Elischer int proto; 248cfa1ca9dSYoshinobu Inoue 249cfa1ca9dSYoshinobu Inoue ip = mtod(m, struct ip *); 250f0ffb944SJulian Elischer proto = ip->ip_p; 251cfa1ca9dSYoshinobu Inoue 25267df9f38SBjoern A. Zeeb sc = (struct gif_softc *)encap_getarg(m); 25367df9f38SBjoern A. Zeeb if (sc == NULL) { 25467df9f38SBjoern A. Zeeb m_freem(m); 25567df9f38SBjoern A. Zeeb ipstat.ips_nogif++; 25667df9f38SBjoern A. Zeeb return; 25767df9f38SBjoern A. Zeeb } 258cfa1ca9dSYoshinobu Inoue 25967df9f38SBjoern A. Zeeb gifp = GIF2IFP(sc); 260686cdd19SJun-ichiro itojun Hagino if (gifp == NULL || (gifp->if_flags & IFF_UP) == 0) { 261cfa1ca9dSYoshinobu Inoue m_freem(m); 262cfa1ca9dSYoshinobu Inoue ipstat.ips_nogif++; 263cfa1ca9dSYoshinobu Inoue return; 264cfa1ca9dSYoshinobu Inoue } 265cfa1ca9dSYoshinobu Inoue 2666a800098SYoshinobu Inoue otos = ip->ip_tos; 267cfa1ca9dSYoshinobu Inoue m_adj(m, off); 268cfa1ca9dSYoshinobu Inoue 269cfa1ca9dSYoshinobu Inoue switch (proto) { 270686cdd19SJun-ichiro itojun Hagino #ifdef INET 271cfa1ca9dSYoshinobu Inoue case IPPROTO_IPV4: 272cfa1ca9dSYoshinobu Inoue { 273cfa1ca9dSYoshinobu Inoue struct ip *ip; 274cfa1ca9dSYoshinobu Inoue af = AF_INET; 275cfa1ca9dSYoshinobu Inoue if (m->m_len < sizeof(*ip)) { 276cfa1ca9dSYoshinobu Inoue m = m_pullup(m, sizeof(*ip)); 277cfa1ca9dSYoshinobu Inoue if (!m) 278cfa1ca9dSYoshinobu Inoue return; 279cfa1ca9dSYoshinobu Inoue } 280cfa1ca9dSYoshinobu Inoue ip = mtod(m, struct ip *); 28159dfcba4SHajimu UMEMOTO if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ? 28259dfcba4SHajimu UMEMOTO ECN_ALLOWED : ECN_NOCARE, 28359dfcba4SHajimu UMEMOTO &otos, &ip->ip_tos) == 0) { 28459dfcba4SHajimu UMEMOTO m_freem(m); 28559dfcba4SHajimu UMEMOTO return; 28659dfcba4SHajimu UMEMOTO } 287cfa1ca9dSYoshinobu Inoue break; 288cfa1ca9dSYoshinobu Inoue } 289686cdd19SJun-ichiro itojun Hagino #endif 290cfa1ca9dSYoshinobu Inoue #ifdef INET6 291cfa1ca9dSYoshinobu Inoue case IPPROTO_IPV6: 292cfa1ca9dSYoshinobu Inoue { 293cfa1ca9dSYoshinobu Inoue struct ip6_hdr *ip6; 29459dfcba4SHajimu UMEMOTO u_int8_t itos, oitos; 29559dfcba4SHajimu UMEMOTO 296cfa1ca9dSYoshinobu Inoue af = AF_INET6; 297cfa1ca9dSYoshinobu Inoue if (m->m_len < sizeof(*ip6)) { 298cfa1ca9dSYoshinobu Inoue m = m_pullup(m, sizeof(*ip6)); 299cfa1ca9dSYoshinobu Inoue if (!m) 300cfa1ca9dSYoshinobu Inoue return; 301cfa1ca9dSYoshinobu Inoue } 302cfa1ca9dSYoshinobu Inoue ip6 = mtod(m, struct ip6_hdr *); 30359dfcba4SHajimu UMEMOTO itos = oitos = (ntohl(ip6->ip6_flow) >> 20) & 0xff; 30459dfcba4SHajimu UMEMOTO if (ip_ecn_egress((gifp->if_flags & IFF_LINK1) ? 30559dfcba4SHajimu UMEMOTO ECN_ALLOWED : ECN_NOCARE, 30659dfcba4SHajimu UMEMOTO &otos, &itos) == 0) { 30759dfcba4SHajimu UMEMOTO m_freem(m); 30859dfcba4SHajimu UMEMOTO return; 30959dfcba4SHajimu UMEMOTO } 31059dfcba4SHajimu UMEMOTO if (itos != oitos) { 311cfa1ca9dSYoshinobu Inoue ip6->ip6_flow &= ~htonl(0xff << 20); 3126a800098SYoshinobu Inoue ip6->ip6_flow |= htonl((u_int32_t)itos << 20); 31359dfcba4SHajimu UMEMOTO } 314cfa1ca9dSYoshinobu Inoue break; 315cfa1ca9dSYoshinobu Inoue } 316cfa1ca9dSYoshinobu Inoue #endif /* INET6 */ 31773ff045cSAndrew Thompson case IPPROTO_ETHERIP: 31873ff045cSAndrew Thompson af = AF_LINK; 31973ff045cSAndrew Thompson break; 32073ff045cSAndrew Thompson 321cfa1ca9dSYoshinobu Inoue default: 322cfa1ca9dSYoshinobu Inoue ipstat.ips_nogif++; 323cfa1ca9dSYoshinobu Inoue m_freem(m); 324cfa1ca9dSYoshinobu Inoue return; 325cfa1ca9dSYoshinobu Inoue } 326cfa1ca9dSYoshinobu Inoue gif_input(m, af, gifp); 327cfa1ca9dSYoshinobu Inoue return; 328cfa1ca9dSYoshinobu Inoue } 329686cdd19SJun-ichiro itojun Hagino 330686cdd19SJun-ichiro itojun Hagino /* 3319426aedfSHajimu UMEMOTO * validate outer address. 332686cdd19SJun-ichiro itojun Hagino */ 3339426aedfSHajimu UMEMOTO static int 334f2565d68SRobert Watson gif_validate4(const struct ip *ip, struct gif_softc *sc, struct ifnet *ifp) 3359426aedfSHajimu UMEMOTO { 336686cdd19SJun-ichiro itojun Hagino struct sockaddr_in *src, *dst; 337686cdd19SJun-ichiro itojun Hagino struct in_ifaddr *ia4; 338686cdd19SJun-ichiro itojun Hagino 339686cdd19SJun-ichiro itojun Hagino src = (struct sockaddr_in *)sc->gif_psrc; 340686cdd19SJun-ichiro itojun Hagino dst = (struct sockaddr_in *)sc->gif_pdst; 341686cdd19SJun-ichiro itojun Hagino 342686cdd19SJun-ichiro itojun Hagino /* check for address match */ 3439426aedfSHajimu UMEMOTO if (src->sin_addr.s_addr != ip->ip_dst.s_addr || 3449426aedfSHajimu UMEMOTO dst->sin_addr.s_addr != ip->ip_src.s_addr) 345686cdd19SJun-ichiro itojun Hagino return 0; 346686cdd19SJun-ichiro itojun Hagino 347686cdd19SJun-ichiro itojun Hagino /* martian filters on outer source - NOT done in ip_input! */ 3489426aedfSHajimu UMEMOTO if (IN_MULTICAST(ntohl(ip->ip_src.s_addr))) 349686cdd19SJun-ichiro itojun Hagino return 0; 3509426aedfSHajimu UMEMOTO switch ((ntohl(ip->ip_src.s_addr) & 0xff000000) >> 24) { 351686cdd19SJun-ichiro itojun Hagino case 0: case 127: case 255: 352686cdd19SJun-ichiro itojun Hagino return 0; 353686cdd19SJun-ichiro itojun Hagino } 354686cdd19SJun-ichiro itojun Hagino /* reject packets with broadcast on source */ 35506cd0a3fSHajimu UMEMOTO TAILQ_FOREACH(ia4, &in_ifaddrhead, ia_link) { 356686cdd19SJun-ichiro itojun Hagino if ((ia4->ia_ifa.ifa_ifp->if_flags & IFF_BROADCAST) == 0) 357686cdd19SJun-ichiro itojun Hagino continue; 3589426aedfSHajimu UMEMOTO if (ip->ip_src.s_addr == ia4->ia_broadaddr.sin_addr.s_addr) 359686cdd19SJun-ichiro itojun Hagino return 0; 360686cdd19SJun-ichiro itojun Hagino } 361686cdd19SJun-ichiro itojun Hagino 362686cdd19SJun-ichiro itojun Hagino /* ingress filters on outer source */ 363fc74a9f9SBrooks Davis if ((GIF2IFP(sc)->if_flags & IFF_LINK2) == 0 && ifp) { 364686cdd19SJun-ichiro itojun Hagino struct sockaddr_in sin; 365686cdd19SJun-ichiro itojun Hagino struct rtentry *rt; 366686cdd19SJun-ichiro itojun Hagino 367686cdd19SJun-ichiro itojun Hagino bzero(&sin, sizeof(sin)); 368686cdd19SJun-ichiro itojun Hagino sin.sin_family = AF_INET; 369686cdd19SJun-ichiro itojun Hagino sin.sin_len = sizeof(struct sockaddr_in); 3709426aedfSHajimu UMEMOTO sin.sin_addr = ip->ip_src; 371686cdd19SJun-ichiro itojun Hagino rt = rtalloc1((struct sockaddr *)&sin, 0, 0UL); 3729426aedfSHajimu UMEMOTO if (!rt || rt->rt_ifp != ifp) { 37333841545SHajimu UMEMOTO #if 0 37433841545SHajimu UMEMOTO log(LOG_WARNING, "%s: packet from 0x%x dropped " 375fc74a9f9SBrooks Davis "due to ingress filter\n", if_name(GIF2IFP(sc)), 37633841545SHajimu UMEMOTO (u_int32_t)ntohl(sin.sin_addr.s_addr)); 37733841545SHajimu UMEMOTO #endif 37833841545SHajimu UMEMOTO if (rt) 379bc60490aSChristian S.J. Peron RTFREE_LOCKED(rt); 380686cdd19SJun-ichiro itojun Hagino return 0; 381686cdd19SJun-ichiro itojun Hagino } 382bc60490aSChristian S.J. Peron RTFREE_LOCKED(rt); 383686cdd19SJun-ichiro itojun Hagino } 384686cdd19SJun-ichiro itojun Hagino 38533841545SHajimu UMEMOTO return 32 * 2; 386686cdd19SJun-ichiro itojun Hagino } 3879426aedfSHajimu UMEMOTO 3889426aedfSHajimu UMEMOTO /* 3899426aedfSHajimu UMEMOTO * we know that we are in IFF_UP, outer address available, and outer family 3909426aedfSHajimu UMEMOTO * matched the physical addr family. see gif_encapcheck(). 3919426aedfSHajimu UMEMOTO */ 3929426aedfSHajimu UMEMOTO int 393f2565d68SRobert Watson gif_encapcheck4(const struct mbuf *m, int off, int proto, void *arg) 3949426aedfSHajimu UMEMOTO { 3959426aedfSHajimu UMEMOTO struct ip ip; 3969426aedfSHajimu UMEMOTO struct gif_softc *sc; 3979426aedfSHajimu UMEMOTO struct ifnet *ifp; 3989426aedfSHajimu UMEMOTO 3999426aedfSHajimu UMEMOTO /* sanity check done in caller */ 4009426aedfSHajimu UMEMOTO sc = (struct gif_softc *)arg; 4019426aedfSHajimu UMEMOTO 4029426aedfSHajimu UMEMOTO /* LINTED const cast */ 4039426aedfSHajimu UMEMOTO m_copydata(m, 0, sizeof(ip), (caddr_t)&ip); 4049426aedfSHajimu UMEMOTO ifp = ((m->m_flags & M_PKTHDR) != 0) ? m->m_pkthdr.rcvif : NULL; 4059426aedfSHajimu UMEMOTO 4069426aedfSHajimu UMEMOTO return gif_validate4(&ip, sc, ifp); 4079426aedfSHajimu UMEMOTO } 4089426aedfSHajimu UMEMOTO 4099426aedfSHajimu UMEMOTO int 410f2565d68SRobert Watson in_gif_attach(struct gif_softc *sc) 4119426aedfSHajimu UMEMOTO { 4129426aedfSHajimu UMEMOTO sc->encap_cookie4 = encap_attach_func(AF_INET, -1, gif_encapcheck, 4139426aedfSHajimu UMEMOTO &in_gif_protosw, sc); 4149426aedfSHajimu UMEMOTO if (sc->encap_cookie4 == NULL) 4159426aedfSHajimu UMEMOTO return EEXIST; 4169426aedfSHajimu UMEMOTO return 0; 4179426aedfSHajimu UMEMOTO } 4189426aedfSHajimu UMEMOTO 4199426aedfSHajimu UMEMOTO int 420f2565d68SRobert Watson in_gif_detach(struct gif_softc *sc) 4219426aedfSHajimu UMEMOTO { 4229426aedfSHajimu UMEMOTO int error; 4239426aedfSHajimu UMEMOTO 4249426aedfSHajimu UMEMOTO error = encap_detach(sc->encap_cookie4); 4259426aedfSHajimu UMEMOTO if (error == 0) 4269426aedfSHajimu UMEMOTO sc->encap_cookie4 = NULL; 4279426aedfSHajimu UMEMOTO return error; 4289426aedfSHajimu UMEMOTO } 429