178064Sume/* $KAME: ip_encap.c,v 1.41 2001/03/15 08:35:08 itojun Exp $ */ 262587Sitojun 3139823Simp/*- 462587Sitojun * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. 562587Sitojun * All rights reserved. 662587Sitojun * 762587Sitojun * Redistribution and use in source and binary forms, with or without 862587Sitojun * modification, are permitted provided that the following conditions 962587Sitojun * are met: 1062587Sitojun * 1. Redistributions of source code must retain the above copyright 1162587Sitojun * notice, this list of conditions and the following disclaimer. 1262587Sitojun * 2. Redistributions in binary form must reproduce the above copyright 1362587Sitojun * notice, this list of conditions and the following disclaimer in the 1462587Sitojun * documentation and/or other materials provided with the distribution. 1562587Sitojun * 3. Neither the name of the project nor the names of its contributors 1662587Sitojun * may be used to endorse or promote products derived from this software 1762587Sitojun * without specific prior written permission. 1862587Sitojun * 1962587Sitojun * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND 2062587Sitojun * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2162587Sitojun * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2262587Sitojun * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE 2362587Sitojun * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2462587Sitojun * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2562587Sitojun * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2662587Sitojun * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2762587Sitojun * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2862587Sitojun * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2962587Sitojun * SUCH DAMAGE. 3062587Sitojun */ 3162587Sitojun/* 3262587Sitojun * My grandfather said that there's a devil inside tunnelling technology... 3362587Sitojun * 3462587Sitojun * We have surprisingly many protocols that want packets with IP protocol 3562587Sitojun * #4 or #41. Here's a list of protocols that want protocol #41: 3662587Sitojun * RFC1933 configured tunnel 3762587Sitojun * RFC1933 automatic tunnel 3862587Sitojun * RFC2401 IPsec tunnel 3962587Sitojun * RFC2473 IPv6 generic packet tunnelling 4062587Sitojun * RFC2529 6over4 tunnel 4162587Sitojun * mobile-ip6 (uses RFC2473) 4295023Ssuz * RFC3056 6to4 tunnel 4395023Ssuz * isatap tunnel 4462587Sitojun * Here's a list of protocol that want protocol #4: 4562587Sitojun * RFC1853 IPv4-in-IPv4 tunnelling 4662587Sitojun * RFC2003 IPv4 encapsulation within IPv4 4762587Sitojun * RFC2344 reverse tunnelling for mobile-ip4 4862587Sitojun * RFC2401 IPsec tunnel 4962587Sitojun * Well, what can I say. They impose different en/decapsulation mechanism 5062587Sitojun * from each other, so they need separate protocol handler. The only one 5162587Sitojun * we can easily determine by protocol # is IPsec, which always has 5262587Sitojun * AH/ESP/IPComp header right after outer IP header. 5362587Sitojun * 5462587Sitojun * So, clearly good old protosw does not work for protocol #4 and #41. 5562587Sitojun * The code will let you match protocol via src/dst address pair. 5662587Sitojun */ 5762587Sitojun/* XXX is M_NETADDR correct? */ 5862587Sitojun 59172467Ssilby#include <sys/cdefs.h> 60172467Ssilby__FBSDID("$FreeBSD$"); 61172467Ssilby 6262587Sitojun#include "opt_mrouting.h" 6362587Sitojun#include "opt_inet.h" 6462587Sitojun#include "opt_inet6.h" 6562587Sitojun 6662587Sitojun#include <sys/param.h> 6762587Sitojun#include <sys/systm.h> 6862587Sitojun#include <sys/socket.h> 6962587Sitojun#include <sys/sockio.h> 7062587Sitojun#include <sys/mbuf.h> 7162587Sitojun#include <sys/errno.h> 7262587Sitojun#include <sys/protosw.h> 7378064Sume#include <sys/queue.h> 7462587Sitojun 7562587Sitojun#include <net/if.h> 7662587Sitojun#include <net/route.h> 7762587Sitojun 7862587Sitojun#include <netinet/in.h> 7962587Sitojun#include <netinet/in_systm.h> 8062587Sitojun#include <netinet/ip.h> 8162587Sitojun#include <netinet/ip_var.h> 8262587Sitojun#include <netinet/ip_encap.h> 8362587Sitojun 8462587Sitojun#ifdef INET6 8562587Sitojun#include <netinet/ip6.h> 8662587Sitojun#include <netinet6/ip6_var.h> 8762587Sitojun#include <netinet6/ip6protosw.h> 8862587Sitojun#endif 8962587Sitojun 9062587Sitojun#include <machine/stdarg.h> 9162587Sitojun 9262587Sitojun#include <sys/kernel.h> 9362587Sitojun#include <sys/malloc.h> 94151897Srwatsonstatic MALLOC_DEFINE(M_NETADDR, "encap_export_host", "Export host address structure"); 9562587Sitojun 9692723Salfredstatic void encap_add(struct encaptab *); 9792723Salfredstatic int mask_match(const struct encaptab *, const struct sockaddr *, 9892723Salfred const struct sockaddr *); 9992723Salfredstatic void encap_fillarg(struct mbuf *, const struct encaptab *); 10062587Sitojun 101126792Srwatson/* 102126792Srwatson * All global variables in ip_encap.c are locked using encapmtx. 103126792Srwatson */ 104126792Srwatsonstatic struct mtx encapmtx; 105126792SrwatsonMTX_SYSINIT(encapmtx, &encapmtx, "encapmtx", MTX_DEF); 106201145SantoineLIST_HEAD(, encaptab) encaptab = LIST_HEAD_INITIALIZER(encaptab); 10762587Sitojun 108126792Srwatson/* 109126792Srwatson * We currently keey encap_init() for source code compatibility reasons -- 110126792Srwatson * it's referenced by KAME pieces in netinet6. 111126792Srwatson */ 11262587Sitojunvoid 113169454Srwatsonencap_init(void) 11462587Sitojun{ 11562587Sitojun} 11662587Sitojun 11778064Sume#ifdef INET 11862587Sitojunvoid 119169454Srwatsonencap4_input(struct mbuf *m, int off) 12062587Sitojun{ 12162587Sitojun struct ip *ip; 12283187Sjulian int proto; 12362587Sitojun struct sockaddr_in s, d; 12482884Sjulian const struct protosw *psw; 12562587Sitojun struct encaptab *ep, *match; 12662587Sitojun int prio, matchprio; 12762587Sitojun 12862587Sitojun ip = mtod(m, struct ip *); 12982884Sjulian proto = ip->ip_p; 13062587Sitojun 13162587Sitojun bzero(&s, sizeof(s)); 13262587Sitojun s.sin_family = AF_INET; 13362587Sitojun s.sin_len = sizeof(struct sockaddr_in); 13462587Sitojun s.sin_addr = ip->ip_src; 13562587Sitojun bzero(&d, sizeof(d)); 13662587Sitojun d.sin_family = AF_INET; 13762587Sitojun d.sin_len = sizeof(struct sockaddr_in); 13862587Sitojun d.sin_addr = ip->ip_dst; 13962587Sitojun 14062587Sitojun match = NULL; 14162587Sitojun matchprio = 0; 142126792Srwatson mtx_lock(&encapmtx); 14371999Sphk LIST_FOREACH(ep, &encaptab, chain) { 14462587Sitojun if (ep->af != AF_INET) 14562587Sitojun continue; 14662587Sitojun if (ep->proto >= 0 && ep->proto != proto) 14762587Sitojun continue; 14862587Sitojun if (ep->func) 14962587Sitojun prio = (*ep->func)(m, off, proto, ep->arg); 15062587Sitojun else { 15162587Sitojun /* 15262587Sitojun * it's inbound traffic, we need to match in reverse 15362587Sitojun * order 15462587Sitojun */ 15562587Sitojun prio = mask_match(ep, (struct sockaddr *)&d, 15662587Sitojun (struct sockaddr *)&s); 15762587Sitojun } 15862587Sitojun 15962587Sitojun /* 16062587Sitojun * We prioritize the matches by using bit length of the 16162587Sitojun * matches. mask_match() and user-supplied matching function 16262587Sitojun * should return the bit length of the matches (for example, 16362587Sitojun * if both src/dst are matched for IPv4, 64 should be returned). 16462587Sitojun * 0 or negative return value means "it did not match". 16562587Sitojun * 16662587Sitojun * The question is, since we have two "mask" portion, we 16762587Sitojun * cannot really define total order between entries. 16862587Sitojun * For example, which of these should be preferred? 16962587Sitojun * mask_match() returns 48 (32 + 16) for both of them. 17062587Sitojun * src=3ffe::/16, dst=3ffe:501::/32 17162587Sitojun * src=3ffe:501::/32, dst=3ffe::/16 17262587Sitojun * 17362587Sitojun * We need to loop through all the possible candidates 17462587Sitojun * to get the best match - the search takes O(n) for 17562587Sitojun * n attachments (i.e. interfaces). 17662587Sitojun */ 17762587Sitojun if (prio <= 0) 17862587Sitojun continue; 17962587Sitojun if (prio > matchprio) { 18062587Sitojun matchprio = prio; 18162587Sitojun match = ep; 18262587Sitojun } 18362587Sitojun } 184126792Srwatson mtx_unlock(&encapmtx); 18562587Sitojun 18662587Sitojun if (match) { 18762587Sitojun /* found a match, "match" has the best one */ 18882884Sjulian psw = match->psw; 18962587Sitojun if (psw && psw->pr_input) { 19062587Sitojun encap_fillarg(m, match); 19182884Sjulian (*psw->pr_input)(m, off); 19262587Sitojun } else 19362587Sitojun m_freem(m); 19462587Sitojun return; 19562587Sitojun } 19662587Sitojun 19762587Sitojun /* last resort: inject to raw socket */ 19882884Sjulian rip_input(m, off); 19962587Sitojun} 20078064Sume#endif 20162587Sitojun 20262587Sitojun#ifdef INET6 20362587Sitojunint 204169454Srwatsonencap6_input(struct mbuf **mp, int *offp, int proto) 20562587Sitojun{ 20662587Sitojun struct mbuf *m = *mp; 20762587Sitojun struct ip6_hdr *ip6; 20862587Sitojun struct sockaddr_in6 s, d; 20962587Sitojun const struct ip6protosw *psw; 21062587Sitojun struct encaptab *ep, *match; 21162587Sitojun int prio, matchprio; 21262587Sitojun 21362587Sitojun ip6 = mtod(m, struct ip6_hdr *); 21462587Sitojun 21562587Sitojun bzero(&s, sizeof(s)); 21662587Sitojun s.sin6_family = AF_INET6; 21762587Sitojun s.sin6_len = sizeof(struct sockaddr_in6); 21862587Sitojun s.sin6_addr = ip6->ip6_src; 21962587Sitojun bzero(&d, sizeof(d)); 22062587Sitojun d.sin6_family = AF_INET6; 22162587Sitojun d.sin6_len = sizeof(struct sockaddr_in6); 22262587Sitojun d.sin6_addr = ip6->ip6_dst; 22362587Sitojun 22462587Sitojun match = NULL; 22562587Sitojun matchprio = 0; 226126792Srwatson mtx_lock(&encapmtx); 22771999Sphk LIST_FOREACH(ep, &encaptab, chain) { 22862587Sitojun if (ep->af != AF_INET6) 22962587Sitojun continue; 23062587Sitojun if (ep->proto >= 0 && ep->proto != proto) 23162587Sitojun continue; 23262587Sitojun if (ep->func) 23362587Sitojun prio = (*ep->func)(m, *offp, proto, ep->arg); 23462587Sitojun else { 23562587Sitojun /* 23662587Sitojun * it's inbound traffic, we need to match in reverse 23762587Sitojun * order 23862587Sitojun */ 23962587Sitojun prio = mask_match(ep, (struct sockaddr *)&d, 24062587Sitojun (struct sockaddr *)&s); 24162587Sitojun } 24262587Sitojun 24362587Sitojun /* see encap4_input() for issues here */ 24462587Sitojun if (prio <= 0) 24562587Sitojun continue; 24662587Sitojun if (prio > matchprio) { 24762587Sitojun matchprio = prio; 24862587Sitojun match = ep; 24962587Sitojun } 25062587Sitojun } 251126792Srwatson mtx_unlock(&encapmtx); 25262587Sitojun 25362587Sitojun if (match) { 25462587Sitojun /* found a match */ 25562587Sitojun psw = (const struct ip6protosw *)match->psw; 25662587Sitojun if (psw && psw->pr_input) { 25762587Sitojun encap_fillarg(m, match); 25862587Sitojun return (*psw->pr_input)(mp, offp, proto); 25962587Sitojun } else { 26062587Sitojun m_freem(m); 26162587Sitojun return IPPROTO_DONE; 26262587Sitojun } 26362587Sitojun } 26462587Sitojun 26562587Sitojun /* last resort: inject to raw socket */ 26662587Sitojun return rip6_input(mp, offp, proto); 26762587Sitojun} 26862587Sitojun#endif 26962587Sitojun 270115612Sphk/*lint -sem(encap_add, custodial(1)) */ 27162587Sitojunstatic void 272169454Srwatsonencap_add(struct encaptab *ep) 27362587Sitojun{ 27462587Sitojun 275126792Srwatson mtx_assert(&encapmtx, MA_OWNED); 27662587Sitojun LIST_INSERT_HEAD(&encaptab, ep, chain); 27762587Sitojun} 27862587Sitojun 27962587Sitojun/* 28062587Sitojun * sp (src ptr) is always my side, and dp (dst ptr) is always remote side. 28162587Sitojun * length of mask (sm and dm) is assumed to be same as sp/dp. 28262587Sitojun * Return value will be necessary as input (cookie) for encap_detach(). 28362587Sitojun */ 28462587Sitojunconst struct encaptab * 285169454Srwatsonencap_attach(int af, int proto, const struct sockaddr *sp, 286169454Srwatson const struct sockaddr *sm, const struct sockaddr *dp, 287169454Srwatson const struct sockaddr *dm, const struct protosw *psw, void *arg) 28862587Sitojun{ 28962587Sitojun struct encaptab *ep; 29062587Sitojun 29162587Sitojun /* sanity check on args */ 292126792Srwatson if (sp->sa_len > sizeof(ep->src) || dp->sa_len > sizeof(ep->dst)) 293126792Srwatson return (NULL); 294126792Srwatson if (sp->sa_len != dp->sa_len) 295126792Srwatson return (NULL); 296126792Srwatson if (af != sp->sa_family || af != dp->sa_family) 297126792Srwatson return (NULL); 29862587Sitojun 29962587Sitojun /* check if anyone have already attached with exactly same config */ 300126792Srwatson mtx_lock(&encapmtx); 30171999Sphk LIST_FOREACH(ep, &encaptab, chain) { 30262587Sitojun if (ep->af != af) 30362587Sitojun continue; 30462587Sitojun if (ep->proto != proto) 30562587Sitojun continue; 30662587Sitojun if (ep->src.ss_len != sp->sa_len || 30762587Sitojun bcmp(&ep->src, sp, sp->sa_len) != 0 || 30862587Sitojun bcmp(&ep->srcmask, sm, sp->sa_len) != 0) 30962587Sitojun continue; 31062587Sitojun if (ep->dst.ss_len != dp->sa_len || 31162587Sitojun bcmp(&ep->dst, dp, dp->sa_len) != 0 || 31262587Sitojun bcmp(&ep->dstmask, dm, dp->sa_len) != 0) 31362587Sitojun continue; 31462587Sitojun 315126792Srwatson mtx_unlock(&encapmtx); 316126792Srwatson return (NULL); 31762587Sitojun } 31862587Sitojun 31962587Sitojun ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /*XXX*/ 32062587Sitojun if (ep == NULL) { 321126792Srwatson mtx_unlock(&encapmtx); 322126792Srwatson return (NULL); 32362587Sitojun } 32462587Sitojun bzero(ep, sizeof(*ep)); 32562587Sitojun 32662587Sitojun ep->af = af; 32762587Sitojun ep->proto = proto; 32862587Sitojun bcopy(sp, &ep->src, sp->sa_len); 32962587Sitojun bcopy(sm, &ep->srcmask, sp->sa_len); 33062587Sitojun bcopy(dp, &ep->dst, dp->sa_len); 33162587Sitojun bcopy(dm, &ep->dstmask, dp->sa_len); 33262587Sitojun ep->psw = psw; 33362587Sitojun ep->arg = arg; 33462587Sitojun 33562587Sitojun encap_add(ep); 336126792Srwatson mtx_unlock(&encapmtx); 337126792Srwatson return (ep); 33862587Sitojun} 33962587Sitojun 34062587Sitojunconst struct encaptab * 341169454Srwatsonencap_attach_func(int af, int proto, 342169454Srwatson int (*func)(const struct mbuf *, int, int, void *), 343169454Srwatson const struct protosw *psw, void *arg) 34462587Sitojun{ 34562587Sitojun struct encaptab *ep; 34662587Sitojun 34762587Sitojun /* sanity check on args */ 348115612Sphk if (!func) 349126792Srwatson return (NULL); 35062587Sitojun 35162587Sitojun ep = malloc(sizeof(*ep), M_NETADDR, M_NOWAIT); /*XXX*/ 352115612Sphk if (ep == NULL) 353126792Srwatson return (NULL); 35462587Sitojun bzero(ep, sizeof(*ep)); 35562587Sitojun 35662587Sitojun ep->af = af; 35762587Sitojun ep->proto = proto; 35862587Sitojun ep->func = func; 35962587Sitojun ep->psw = psw; 36062587Sitojun ep->arg = arg; 36162587Sitojun 362126792Srwatson mtx_lock(&encapmtx); 36362587Sitojun encap_add(ep); 364126792Srwatson mtx_unlock(&encapmtx); 365126792Srwatson return (ep); 36662587Sitojun} 36762587Sitojun 36862587Sitojunint 369169454Srwatsonencap_detach(const struct encaptab *cookie) 37062587Sitojun{ 37162587Sitojun const struct encaptab *ep = cookie; 37262587Sitojun struct encaptab *p; 37362587Sitojun 374126792Srwatson mtx_lock(&encapmtx); 37571999Sphk LIST_FOREACH(p, &encaptab, chain) { 37662587Sitojun if (p == ep) { 37762587Sitojun LIST_REMOVE(p, chain); 378126792Srwatson mtx_unlock(&encapmtx); 37962587Sitojun free(p, M_NETADDR); /*XXX*/ 38062587Sitojun return 0; 38162587Sitojun } 38262587Sitojun } 383126792Srwatson mtx_unlock(&encapmtx); 38462587Sitojun 38562587Sitojun return EINVAL; 38662587Sitojun} 38762587Sitojun 38862587Sitojunstatic int 389169454Srwatsonmask_match(const struct encaptab *ep, const struct sockaddr *sp, 390169454Srwatson const struct sockaddr *dp) 39162587Sitojun{ 39262587Sitojun struct sockaddr_storage s; 39362587Sitojun struct sockaddr_storage d; 39462587Sitojun int i; 39562587Sitojun const u_int8_t *p, *q; 39662587Sitojun u_int8_t *r; 39762587Sitojun int matchlen; 39862587Sitojun 39962587Sitojun if (sp->sa_len > sizeof(s) || dp->sa_len > sizeof(d)) 40062587Sitojun return 0; 40162587Sitojun if (sp->sa_family != ep->af || dp->sa_family != ep->af) 40262587Sitojun return 0; 40362587Sitojun if (sp->sa_len != ep->src.ss_len || dp->sa_len != ep->dst.ss_len) 40462587Sitojun return 0; 40562587Sitojun 40662587Sitojun matchlen = 0; 40762587Sitojun 40862587Sitojun p = (const u_int8_t *)sp; 40962587Sitojun q = (const u_int8_t *)&ep->srcmask; 41062587Sitojun r = (u_int8_t *)&s; 41162587Sitojun for (i = 0 ; i < sp->sa_len; i++) { 41262587Sitojun r[i] = p[i] & q[i]; 41362587Sitojun /* XXX estimate */ 41462587Sitojun matchlen += (q[i] ? 8 : 0); 41562587Sitojun } 41662587Sitojun 41762587Sitojun p = (const u_int8_t *)dp; 41862587Sitojun q = (const u_int8_t *)&ep->dstmask; 41962587Sitojun r = (u_int8_t *)&d; 42062587Sitojun for (i = 0 ; i < dp->sa_len; i++) { 42162587Sitojun r[i] = p[i] & q[i]; 42262587Sitojun /* XXX rough estimate */ 42362587Sitojun matchlen += (q[i] ? 8 : 0); 42462587Sitojun } 42562587Sitojun 42662587Sitojun /* need to overwrite len/family portion as we don't compare them */ 42762587Sitojun s.ss_len = sp->sa_len; 42862587Sitojun s.ss_family = sp->sa_family; 42962587Sitojun d.ss_len = dp->sa_len; 43062587Sitojun d.ss_family = dp->sa_family; 43162587Sitojun 43262587Sitojun if (bcmp(&s, &ep->src, ep->src.ss_len) == 0 && 43362587Sitojun bcmp(&d, &ep->dst, ep->dst.ss_len) == 0) { 43462587Sitojun return matchlen; 43562587Sitojun } else 43662587Sitojun return 0; 43762587Sitojun} 43862587Sitojun 43962587Sitojunstatic void 440169454Srwatsonencap_fillarg(struct mbuf *m, const struct encaptab *ep) 44162587Sitojun{ 442105194Ssam struct m_tag *tag; 44362587Sitojun 444112148Ssam tag = m_tag_get(PACKET_TAG_ENCAP, sizeof (void*), M_NOWAIT); 445105194Ssam if (tag) { 446105194Ssam *(void**)(tag+1) = ep->arg; 447105194Ssam m_tag_prepend(m, tag); 44862587Sitojun } 44962587Sitojun} 45062587Sitojun 45162587Sitojunvoid * 452169454Srwatsonencap_getarg(struct mbuf *m) 45362587Sitojun{ 454105194Ssam void *p = NULL; 455105194Ssam struct m_tag *tag; 45662587Sitojun 457105194Ssam tag = m_tag_find(m, PACKET_TAG_ENCAP, NULL); 458105194Ssam if (tag) { 459105194Ssam p = *(void**)(tag+1); 460105194Ssam m_tag_delete(m, tag); 46162587Sitojun } 46262587Sitojun return p; 46362587Sitojun} 464