1 /* $FreeBSD$ */ 2 /* $KAME: ip_encap.c,v 1.41 2001/03/15 08:35:08 itojun Exp $ */ 3 4 /*- 5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. Neither the name of the project nor the names of its contributors 17 * may be used to endorse or promote products derived from this software 18 * without specific prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30 * SUCH DAMAGE. 31 */ 32 /* 33 * My grandfather said that there's a devil inside tunnelling technology... 34 * 35 * We have surprisingly many protocols that want packets with IP protocol 36 * #4 or #41. Here's a list of protocols that want protocol #41: 37 * RFC1933 configured tunnel 38 * RFC1933 automatic tunnel 39 * RFC2401 IPsec tunnel 40 * RFC2473 IPv6 generic packet tunnelling 41 * RFC2529 6over4 tunnel 42 * mobile-ip6 (uses RFC2473) 43 * RFC3056 6to4 tunnel 44 * isatap tunnel 45 * Here's a list of protocol that want protocol #4: 46 * RFC1853 IPv4-in-IPv4 tunnelling 47 * RFC2003 IPv4 encapsulation within IPv4 48 * RFC2344 reverse tunnelling for mobile-ip4 49 * RFC2401 IPsec tunnel 50 * Well, what can I say. They impose different en/decapsulation mechanism 51 * from each other, so they need separate protocol handler. The only one 52 * we can easily determine by protocol # is IPsec, which always has 53 * AH/ESP/IPComp header right after outer IP header. 54 * 55 * So, clearly good old protosw does not work for protocol #4 and #41. 56 * The code will let you match protocol via src/dst address pair. 57 */ 58 /* XXX is M_NETADDR correct? */ 59 60 #include "opt_mrouting.h" 61 #include "opt_inet.h" 62 #include "opt_inet6.h" 63 64 #include <sys/param.h> 65 #include <sys/systm.h> 66 #include <sys/socket.h> 67 #include <sys/sockio.h> 68 #include <sys/mbuf.h> 69 #include <sys/errno.h> 70 #include <sys/protosw.h> 71 #include <sys/queue.h> 72 73 #include <net/if.h> 74 #include <net/route.h> 75 76 #include <netinet/in.h> 77 #include <netinet/in_systm.h> 78 #include <netinet/ip.h> 79 #include <netinet/ip_var.h> 80 #include <netinet/ip_encap.h> 81 82 #ifdef INET6 83 #include <netinet/ip6.h> 84 #include <netinet6/ip6_var.h> 85 #include <netinet6/ip6protosw.h> 86 #endif 87 88 #include <machine/stdarg.h> 89 90 #include <sys/kernel.h> 91 #include <sys/malloc.h> 92 static MALLOC_DEFINE(M_NETADDR, "encap_export_host", "Export host address structure"); 93 94 static void encap_add(struct encaptab *); 95 static int mask_match(const struct encaptab *, const struct sockaddr *, 96 const struct sockaddr *); 97 static void encap_fillarg(struct mbuf *, const struct encaptab *); 98 99 /* 100 * All global variables in ip_encap.c are locked using encapmtx. 101 */ 102 static struct mtx encapmtx; 103 MTX_SYSINIT(encapmtx, &encapmtx, "encapmtx", MTX_DEF); 104 LIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(&encaptab); 105 106 /* 107 * We currently keey encap_init() for source code compatibility reasons -- 108 * it's referenced by KAME pieces in netinet6. 109 */ 110 void 111 encap_init(void) 112 { 113 } 114 115 #ifdef INET 116 void 117 encap4_input(struct mbuf *m, int off) 118 { 119 struct ip *ip; 120 int proto; 121 struct sockaddr_in s, d; 122 const struct protosw *psw; 123 struct encaptab *ep, *match; 124 int prio, matchprio; 125 126 ip = mtod(m, struct ip *); 127 proto = ip->ip_p; 128 129 bzero(&s, sizeof(s)); 130 s.sin_family = AF_INET; 131 s.sin_len = sizeof(struct sockaddr_in); 132 s.sin_addr = ip->ip_src; 133 bzero(&d, sizeof(d)); 134 d.sin_family = AF_INET; 135 d.sin_len = sizeof(struct sockaddr_in); 136 d.sin_addr = ip->ip_dst; 137 138 match = NULL; 139 matchprio = 0; 140 mtx_lock(&encapmtx); 141 LIST_FOREACH(ep, &encaptab, chain) { 142 if (ep->af != AF_INET) 143 continue; 144 if (ep->proto >= 0 && ep->proto != proto) 145 continue; 146 if (ep->func) 147 prio = (*ep->func)(m, off, proto, ep->arg); 148 else { 149 /* 150 * it's inbound traffic, we need to match in reverse 151 * order 152 */ 153 prio = mask_match(ep, (struct sockaddr *)&d, 154 (struct sockaddr *)&s); 155 } 156 157 /* 158 * We prioritize the matches by using bit length of the 159 * matches. mask_match() and user-supplied matching function 160 * should return the bit length of the matches (for example, 161 * if both src/dst are matched for IPv4, 64 should be returned). 162 * 0 or negative return value means "it did not match". 163 * 164 * The question is, since we have two "mask" portion, we 165 * cannot really define total order between entries. 166 * For example, which of these should be preferred? 167 * mask_match() returns 48 (32 + 16) for both of them. 168 * src=3ffe::/16, dst=3ffe:501::/32 169 * src=3ffe:501::/32, dst=3ffe::/16 170 * 171 * We need to loop through all the possible candidates 172 * to get the best match - the search takes O(n) for 173 * n attachments (i.e. interfaces). 174 */ 175 if (prio <= 0) 176 continue; 177 if (prio > matchprio) { 178 matchprio = prio; 179 match = ep; 180 } 181 } 182 mtx_unlock(&encapmtx); 183 184 if (match) { 185 /* found a match, "match" has the best one */ 186 psw = match->psw; 187 if (psw && psw->pr_input) { 188 encap_fillarg(m, match); 189 (*psw->pr_input)(m, off); 190 } else 191 m_freem(m); 192 return; 193 } 194 195 /* last resort: inject to raw socket */ 196 rip_input(m, off); 197 } 198 #endif 199 200 #ifdef INET6 201 int 202 encap6_input(struct mbuf **mp, int *offp, int proto) 203 { 204 struct mbuf *m = *mp; 205 struct ip6_hdr *ip6; 206 struct sockaddr_in6 s, d; 207 const struct ip6protosw *psw; 208 struct encaptab *ep, *match; 209 int prio, matchprio; 210 211 ip6 = mtod(m, struct ip6_hdr *); 212 213 bzero(&s, sizeof(s)); 214 s.sin6_family = AF_INET6; 215 s.sin6_len = sizeof(struct sockaddr_in6); 216 s.sin6_addr = ip6->ip6_src; 217 bzero(&d, sizeof(d)); 218 d.sin6_family = AF_INET6; 219 d.sin6_len = sizeof(struct sockaddr_in6); 220 d.sin6_addr = ip6->ip6_dst; 221 222 match = NULL; 223 matchprio = 0; 224 mtx_lock(&encapmtx); 225 LIST_FOREACH(ep, &encaptab, chain) { 226 if (ep->af != AF_INET6) 227 continue; 228 if (ep->proto >= 0 && ep->proto != proto) 229 continue; 230 if (ep->func) 231 prio = (*ep->func)(m, *offp, proto, ep->arg); 232 else { 233 /* 234 * it's inbound traffic, we need to match in reverse 235 * order 236 */ 237 prio = mask_match(ep, (struct sockaddr *)&d, 238 (struct sockaddr *)&s); 239 } 240 241 /* see encap4_input() for issues here */ 242 if (prio <= 0) 243 continue; 244 if (prio > matchprio) { 245 matchprio = prio; 246 match = ep; 247 } 248 } 249 mtx_unlock(&encapmtx); 250 251 if (match) { 252 /* found a match */ 253 psw = (const struct ip6protosw *)match->psw; 254 if (psw && psw->pr_input) { 255 encap_fillarg(m, match); 256 return (*psw->pr_input)(mp, offp, proto); 257 } else { 258 m_freem(m); 259 return IPPROTO_DONE; 260 } 261 } 262 263 /* last resort: inject to raw socket */ 264 return rip6_input(mp, offp, proto); 265 } 266 #endif 267 268 /*lint -sem(encap_add, custodial(1)) */ 269 static void 270 encap_add(struct encaptab *ep) 271 { 272 273 mtx_assert(&encapmtx, MA_OWNED); 274 LIST_INSERT_HEAD(&encaptab, ep, chain); 275 } 276 277 /* 278 * sp (src ptr) is always my side, and dp (dst ptr) is always remote side. 279 * length of mask (sm and dm) is assumed to be same as sp/dp. 280 * Return value will be necessary as input (cookie) for encap_detach(). 281 */ 282 const struct encaptab * 283 encap_attach(int af, int proto, const struct sockaddr *sp, 284 const struct sockaddr *sm, const struct sockaddr *dp, 285 const struct sockaddr *dm, const struct protosw *psw, void *arg) 286 { 287 struct encaptab *ep; 288 289 /* sanity check on args */ 290 if (sp->sa_len > sizeof(ep->src) || dp->sa_len > sizeof(ep->dst)) 291 return (NULL); 292 if (sp->sa_len != dp->sa_len) 293 return (NULL); 294 if (af != sp->sa_family || af != dp->sa_family) 295 return (NULL); 296 297 /* check if anyone have already attached with exactly same config */ 298 mtx_lock(&encapmtx); 299 LIST_FOREACH(ep, &encaptab, chain) { 300 if (ep->af != af) 301 continue; 302 if (ep->proto != proto) 303 continue; 304 if (ep->src.ss_len != sp->sa_len || 305 bcmp(&ep->src, sp, sp->sa_len) != 0 || 306 bcmp(&ep->srcmask, sm, sp->sa_len) != 0) 307 continue; 308 if (ep->dst.ss_len != dp->sa_len || 309 bcmp(&ep->dst, dp, dp->sa_len) != 0 || 310 bcmp(&ep->dstmask, dm, dp->sa_len) != 0) 311 continue; 312 313 mtx_unlock(&encapmtx); 314 return (NULL); 315 } 316 317 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /*XXX*/ 318 if (ep == NULL) { 319 mtx_unlock(&encapmtx); 320 return (NULL); 321 } 322 bzero(ep, sizeof(*ep)); 323 324 ep->af = af; 325 ep->proto = proto; 326 bcopy(sp, &ep->src, sp->sa_len); 327 bcopy(sm, &ep->srcmask, sp->sa_len); 328 bcopy(dp, &ep->dst, dp->sa_len); 329 bcopy(dm, &ep->dstmask, dp->sa_len); 330 ep->psw = psw; 331 ep->arg = arg; 332 333 encap_add(ep); 334 mtx_unlock(&encapmtx); 335 return (ep); 336 } 337 338 const struct encaptab * 339 encap_attach_func(int af, int proto, 340 int (*func)(const struct mbuf *, int, int, void *), 341 const struct protosw *psw, void *arg) 342 { 343 struct encaptab *ep; 344 345 /* sanity check on args */ 346 if (!func) 347 return (NULL); 348 349 ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /*XXX*/ 350 if (ep == NULL) 351 return (NULL); 352 bzero(ep, sizeof(*ep)); 353 354 ep->af = af; 355 ep->proto = proto; 356 ep->func = func; 357 ep->psw = psw; 358 ep->arg = arg; 359 360 mtx_lock(&encapmtx); 361 encap_add(ep); 362 mtx_unlock(&encapmtx); 363 return (ep); 364 } 365 366 int 367 encap_detach(const struct encaptab *cookie) 368 { 369 const struct encaptab *ep = cookie; 370 struct encaptab *p; 371 372 mtx_lock(&encapmtx); 373 LIST_FOREACH(p, &encaptab, chain) { 374 if (p == ep) { 375 LIST_REMOVE(p, chain); 376 mtx_unlock(&encapmtx); 377 free(p, M_NETADDR); /*XXX*/ 378 return 0; 379 } 380 } 381 mtx_unlock(&encapmtx); 382 383 return EINVAL; 384 } 385 386 static int 387 mask_match(const struct encaptab *ep, const struct sockaddr *sp, 388 const struct sockaddr *dp) 389 { 390 struct sockaddr_storage s; 391 struct sockaddr_storage d; 392 int i; 393 const u_int8_t *p, *q; 394 u_int8_t *r; 395 int matchlen; 396 397 if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) 398 return 0; 399 if (sp->sa_family != ep->af || dp->sa_family != ep->af) 400 return 0; 401 if (sp->sa_len != ep->src.ss_len || dp->sa_len != ep->dst.ss_len) 402 return 0; 403 404 matchlen = 0; 405 406 p = (const u_int8_t *)sp; 407 q = (const u_int8_t *)&ep->srcmask; 408 r = (u_int8_t *)&s; 409 for (i = 0 ; i < sp->sa_len; i++) { 410 r[i] = p[i] & q[i]; 411 /* XXX estimate */ 412 matchlen += (q[i] ? 8 : 0); 413 } 414 415 p = (const u_int8_t *)dp; 416 q = (const u_int8_t *)&ep->dstmask; 417 r = (u_int8_t *)&d; 418 for (i = 0 ; i < dp->sa_len; i++) { 419 r[i] = p[i] & q[i]; 420 /* XXX rough estimate */ 421 matchlen += (q[i] ? 8 : 0); 422 } 423 424 /* need to overwrite len/family portion as we don't compare them */ 425 s.ss_len = sp->sa_len; 426 s.ss_family = sp->sa_family; 427 d.ss_len = dp->sa_len; 428 d.ss_family = dp->sa_family; 429 430 if (bcmp(&s, &ep->src, ep->src.ss_len) == 0 && 431 bcmp(&d, &ep->dst, ep->dst.ss_len) == 0) { 432 return matchlen; 433 } else 434 return 0; 435 } 436 437 static void 438 encap_fillarg(struct mbuf *m, const struct encaptab *ep) 439 { 440 struct m_tag *tag; 441 442 tag = m_tag_get(PACKET_TAG_ENCAP, sizeof (void*), M_NOWAIT); 443 if (tag) { 444 *(void**)(tag+1) = ep->arg; 445 m_tag_prepend(m, tag); 446 } 447 } 448 449 void * 450 encap_getarg(struct mbuf *m) 451 { 452 void *p = NULL; 453 struct m_tag *tag; 454 455 tag = m_tag_find(m, PACKET_TAG_ENCAP, NULL); 456 if (tag) { 457 p = *(void**)(tag+1); 458 m_tag_delete(m, tag); 459 } 460 return p; 461 } 462