1/*-
2 * Copyright (c) 2014, 2018 Andrey V. Elsukov <ae@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28#include "opt_inet.h"
29#include "opt_inet6.h"
30
31#include <sys/param.h>
32#include <sys/jail.h>
33#include <sys/systm.h>
34#include <sys/socket.h>
35#include <sys/socketvar.h>
36#include <sys/sockio.h>
37#include <sys/mbuf.h>
38#include <sys/errno.h>
39#include <sys/kernel.h>
40#include <sys/sysctl.h>
41#include <sys/malloc.h>
42#include <sys/proc.h>
43
44#include <net/if.h>
45#include <net/if_var.h>
46#include <net/if_private.h>
47#include <net/vnet.h>
48
49#include <netinet/in.h>
50#ifdef INET
51#include <net/ethernet.h>
52#include <netinet/ip.h>
53#endif
54#include <netinet/in_pcb.h>
55#include <netinet/ip_encap.h>
56#include <netinet/ip_var.h>
57#include <netinet/ip6.h>
58#include <netinet/udp.h>
59#include <netinet/udp_var.h>
60#include <netinet6/ip6_var.h>
61#include <netinet6/in6_var.h>
62#include <netinet6/scope6_var.h>
63#include <net/if_gre.h>
64
65VNET_DEFINE(int, ip6_gre_hlim) = IPV6_DEFHLIM;
66#define	V_ip6_gre_hlim		VNET(ip6_gre_hlim)
67
68SYSCTL_DECL(_net_inet6_ip6);
69SYSCTL_INT(_net_inet6_ip6, OID_AUTO, grehlim, CTLFLAG_VNET | CTLFLAG_RW,
70    &VNET_NAME(ip6_gre_hlim), 0, "Default hop limit for encapsulated packets");
71
72struct in6_gre_socket {
73	struct gre_socket	base;
74	struct in6_addr		addr; /* scope zone id is embedded */
75};
76VNET_DEFINE_STATIC(struct gre_sockets *, ipv6_sockets) = NULL;
77VNET_DEFINE_STATIC(struct gre_list *, ipv6_hashtbl) = NULL;
78VNET_DEFINE_STATIC(struct gre_list *, ipv6_srchashtbl) = NULL;
79#define	V_ipv6_sockets		VNET(ipv6_sockets)
80#define	V_ipv6_hashtbl		VNET(ipv6_hashtbl)
81#define	V_ipv6_srchashtbl	VNET(ipv6_srchashtbl)
82#define	GRE_HASH(src, dst)	(V_ipv6_hashtbl[\
83    in6_gre_hashval((src), (dst)) & (GRE_HASH_SIZE - 1)])
84#define	GRE_SRCHASH(src)	(V_ipv6_srchashtbl[\
85    fnv_32_buf((src), sizeof(*src), FNV1_32_INIT) & (GRE_HASH_SIZE - 1)])
86#define	GRE_SOCKHASH(src)	(V_ipv6_sockets[\
87    fnv_32_buf((src), sizeof(*src), FNV1_32_INIT) & (GRE_HASH_SIZE - 1)])
88#define	GRE_HASH_SC(sc)		GRE_HASH(&(sc)->gre_oip6.ip6_src,\
89    &(sc)->gre_oip6.ip6_dst)
90
91static uint32_t
92in6_gre_hashval(const struct in6_addr *src, const struct in6_addr *dst)
93{
94	uint32_t ret;
95
96	ret = fnv_32_buf(src, sizeof(*src), FNV1_32_INIT);
97	return (fnv_32_buf(dst, sizeof(*dst), ret));
98}
99
100static struct gre_socket*
101in6_gre_lookup_socket(const struct in6_addr *addr)
102{
103	struct gre_socket *gs;
104	struct in6_gre_socket *s;
105
106	CK_LIST_FOREACH(gs, &GRE_SOCKHASH(addr), chain) {
107		s = __containerof(gs, struct in6_gre_socket, base);
108		if (IN6_ARE_ADDR_EQUAL(&s->addr, addr))
109			break;
110	}
111	return (gs);
112}
113
114static int
115in6_gre_checkdup(const struct gre_softc *sc, const struct in6_addr *src,
116    const struct in6_addr *dst, uint32_t opts)
117{
118	struct gre_list *head;
119	struct gre_softc *tmp;
120	struct gre_socket *gs;
121
122	if (sc->gre_family == AF_INET6 &&
123	    IN6_ARE_ADDR_EQUAL(&sc->gre_oip6.ip6_src, src) &&
124	    IN6_ARE_ADDR_EQUAL(&sc->gre_oip6.ip6_dst, dst) &&
125	    (sc->gre_options & GRE_UDPENCAP) == (opts & GRE_UDPENCAP))
126		return (EEXIST);
127
128	if (opts & GRE_UDPENCAP) {
129		gs = in6_gre_lookup_socket(src);
130		if (gs == NULL)
131			return (0);
132		head = &gs->list;
133	} else
134		head = &GRE_HASH(src, dst);
135
136	CK_LIST_FOREACH(tmp, head, chain) {
137		if (tmp == sc)
138			continue;
139		if (IN6_ARE_ADDR_EQUAL(&tmp->gre_oip6.ip6_src, src) &&
140		    IN6_ARE_ADDR_EQUAL(&tmp->gre_oip6.ip6_dst, dst))
141			return (EADDRNOTAVAIL);
142	}
143	return (0);
144}
145
146static int
147in6_gre_lookup(const struct mbuf *m, int off, int proto, void **arg)
148{
149	const struct ip6_hdr *ip6;
150	struct gre_softc *sc;
151
152	if (V_ipv6_hashtbl == NULL)
153		return (0);
154
155	NET_EPOCH_ASSERT();
156	ip6 = mtod(m, const struct ip6_hdr *);
157	CK_LIST_FOREACH(sc, &GRE_HASH(&ip6->ip6_dst, &ip6->ip6_src), chain) {
158		/*
159		 * This is an inbound packet, its ip6_dst is source address
160		 * in softc.
161		 */
162		if (IN6_ARE_ADDR_EQUAL(&sc->gre_oip6.ip6_src,
163		    &ip6->ip6_dst) &&
164		    IN6_ARE_ADDR_EQUAL(&sc->gre_oip6.ip6_dst,
165		    &ip6->ip6_src)) {
166			if ((GRE2IFP(sc)->if_flags & IFF_UP) == 0)
167				return (0);
168			*arg = sc;
169			return (ENCAP_DRV_LOOKUP);
170		}
171	}
172	return (0);
173}
174
175/*
176 * Check that ingress address belongs to local host.
177 */
178static void
179in6_gre_set_running(struct gre_softc *sc)
180{
181
182	if (in6_localip(&sc->gre_oip6.ip6_src))
183		GRE2IFP(sc)->if_drv_flags |= IFF_DRV_RUNNING;
184	else
185		GRE2IFP(sc)->if_drv_flags &= ~IFF_DRV_RUNNING;
186}
187
188/*
189 * ifaddr_event handler.
190 * Clear IFF_DRV_RUNNING flag when ingress address disappears to prevent
191 * source address spoofing.
192 */
193static void
194in6_gre_srcaddr(void *arg __unused, const struct sockaddr *sa,
195    int event __unused)
196{
197	const struct sockaddr_in6 *sin;
198	struct gre_softc *sc;
199
200	/* Check that VNET is ready */
201	if (V_ipv6_hashtbl == NULL)
202		return;
203
204	NET_EPOCH_ASSERT();
205	sin = (const struct sockaddr_in6 *)sa;
206	CK_LIST_FOREACH(sc, &GRE_SRCHASH(&sin->sin6_addr), srchash) {
207		if (IN6_ARE_ADDR_EQUAL(&sc->gre_oip6.ip6_src,
208		    &sin->sin6_addr) == 0)
209			continue;
210		in6_gre_set_running(sc);
211	}
212}
213
214static bool
215in6_gre_udp_input(struct mbuf *m, int off, struct inpcb *inp,
216    const struct sockaddr *sa, void *ctx)
217{
218	struct gre_socket *gs;
219	struct gre_softc *sc;
220	struct sockaddr_in6 dst;
221
222	NET_EPOCH_ASSERT();
223
224	gs = (struct gre_socket *)ctx;
225	dst = *(const struct sockaddr_in6 *)sa;
226	if (sa6_embedscope(&dst, 0)) {
227		m_freem(m);
228		return (true);
229	}
230	CK_LIST_FOREACH(sc, &gs->list, chain) {
231		if (IN6_ARE_ADDR_EQUAL(&sc->gre_oip6.ip6_dst, &dst.sin6_addr))
232			break;
233	}
234	if (sc != NULL && (GRE2IFP(sc)->if_flags & IFF_UP) != 0){
235		gre_input(m, off + sizeof(struct udphdr), IPPROTO_UDP, sc);
236		return (true);
237	}
238	m_freem(m);
239
240	return (true);
241}
242
243static int
244in6_gre_setup_socket(struct gre_softc *sc)
245{
246	struct sockopt sopt;
247	struct sockaddr_in6 sin6;
248	struct in6_gre_socket *s;
249	struct gre_socket *gs;
250	int error, value;
251
252	/*
253	 * NOTE: we are protected with gre_ioctl_sx lock.
254	 *
255	 * First check that socket is already configured.
256	 * If so, check that source address was not changed.
257	 * If address is different, check that there are no other tunnels
258	 * and close socket.
259	 */
260	gs = sc->gre_so;
261	if (gs != NULL) {
262		s = __containerof(gs, struct in6_gre_socket, base);
263		if (!IN6_ARE_ADDR_EQUAL(&s->addr, &sc->gre_oip6.ip6_src)) {
264			if (CK_LIST_EMPTY(&gs->list)) {
265				CK_LIST_REMOVE(gs, chain);
266				soclose(gs->so);
267				NET_EPOCH_CALL(gre_sofree, &gs->epoch_ctx);
268			}
269			gs = sc->gre_so = NULL;
270		}
271	}
272
273	if (gs == NULL) {
274		/*
275		 * Check that socket for given address is already
276		 * configured.
277		 */
278		gs = in6_gre_lookup_socket(&sc->gre_oip6.ip6_src);
279		if (gs == NULL) {
280			s = malloc(sizeof(*s), M_GRE, M_WAITOK | M_ZERO);
281			s->addr = sc->gre_oip6.ip6_src;
282			gs = &s->base;
283
284			error = socreate(sc->gre_family, &gs->so,
285			    SOCK_DGRAM, IPPROTO_UDP, curthread->td_ucred,
286			    curthread);
287			if (error != 0) {
288				if_printf(GRE2IFP(sc),
289				    "cannot create socket: %d\n", error);
290				free(s, M_GRE);
291				return (error);
292			}
293
294			error = udp_set_kernel_tunneling(gs->so,
295			    in6_gre_udp_input, NULL, gs);
296			if (error != 0) {
297				if_printf(GRE2IFP(sc),
298				    "cannot set UDP tunneling: %d\n", error);
299				goto fail;
300			}
301
302			memset(&sopt, 0, sizeof(sopt));
303			sopt.sopt_dir = SOPT_SET;
304			sopt.sopt_level = IPPROTO_IPV6;
305			sopt.sopt_name = IPV6_BINDANY;
306			sopt.sopt_val = &value;
307			sopt.sopt_valsize = sizeof(value);
308			value = 1;
309			error = sosetopt(gs->so, &sopt);
310			if (error != 0) {
311				if_printf(GRE2IFP(sc),
312				    "cannot set IPV6_BINDANY opt: %d\n",
313				    error);
314				goto fail;
315			}
316
317			memset(&sin6, 0, sizeof(sin6));
318			sin6.sin6_family = AF_INET6;
319			sin6.sin6_len = sizeof(sin6);
320			sin6.sin6_addr = sc->gre_oip6.ip6_src;
321			sin6.sin6_port = htons(GRE_UDPPORT);
322			error = sa6_recoverscope(&sin6);
323			if (error != 0) {
324				if_printf(GRE2IFP(sc),
325				    "cannot determine scope zone id: %d\n",
326				    error);
327				goto fail;
328			}
329			error = sobind(gs->so, (struct sockaddr *)&sin6,
330			    curthread);
331			if (error != 0) {
332				if_printf(GRE2IFP(sc),
333				    "cannot bind socket: %d\n", error);
334				goto fail;
335			}
336			/* Add socket to the chain */
337			CK_LIST_INSERT_HEAD(
338			    &GRE_SOCKHASH(&sc->gre_oip6.ip6_src), gs, chain);
339		}
340	}
341
342	/* Add softc to the socket's list */
343	CK_LIST_INSERT_HEAD(&gs->list, sc, chain);
344	sc->gre_so = gs;
345	return (0);
346fail:
347	soclose(gs->so);
348	free(s, M_GRE);
349	return (error);
350}
351
352static int
353in6_gre_attach(struct gre_softc *sc)
354{
355	struct grehdr *gh;
356	int error;
357
358	if (sc->gre_options & GRE_UDPENCAP) {
359		sc->gre_csumflags = CSUM_UDP_IPV6;
360		sc->gre_hlen = sizeof(struct greudp6);
361		sc->gre_oip6.ip6_nxt = IPPROTO_UDP;
362		gh = &sc->gre_udp6hdr->gi6_gre;
363		gre_update_udphdr(sc, &sc->gre_udp6,
364		    in6_cksum_pseudo(&sc->gre_oip6, 0, 0, 0));
365	} else {
366		sc->gre_hlen = sizeof(struct greip6);
367		sc->gre_oip6.ip6_nxt = IPPROTO_GRE;
368		gh = &sc->gre_ip6hdr->gi6_gre;
369	}
370	sc->gre_oip6.ip6_vfc = IPV6_VERSION;
371	gre_update_hdr(sc, gh);
372
373	/*
374	 * If we return error, this means that sc is not linked,
375	 * and caller should reset gre_family and free(sc->gre_hdr).
376	 */
377	if (sc->gre_options & GRE_UDPENCAP) {
378		error = in6_gre_setup_socket(sc);
379		if (error != 0)
380			return (error);
381	} else
382		CK_LIST_INSERT_HEAD(&GRE_HASH_SC(sc), sc, chain);
383	CK_LIST_INSERT_HEAD(&GRE_SRCHASH(&sc->gre_oip6.ip6_src), sc, srchash);
384
385	/* Set IFF_DRV_RUNNING if interface is ready */
386	in6_gre_set_running(sc);
387	return (0);
388}
389
390int
391in6_gre_setopts(struct gre_softc *sc, u_long cmd, uint32_t value)
392{
393	int error;
394
395	/* NOTE: we are protected with gre_ioctl_sx lock */
396	MPASS(cmd == GRESKEY || cmd == GRESOPTS || cmd == GRESPORT);
397	MPASS(sc->gre_family == AF_INET6);
398
399	/*
400	 * If we are going to change encapsulation protocol, do check
401	 * for duplicate tunnels. Return EEXIST here to do not confuse
402	 * user.
403	 */
404	if (cmd == GRESOPTS &&
405	    (sc->gre_options & GRE_UDPENCAP) != (value & GRE_UDPENCAP) &&
406	    in6_gre_checkdup(sc, &sc->gre_oip6.ip6_src,
407		&sc->gre_oip6.ip6_dst, value) == EADDRNOTAVAIL)
408		return (EEXIST);
409
410	CK_LIST_REMOVE(sc, chain);
411	CK_LIST_REMOVE(sc, srchash);
412	GRE_WAIT();
413	switch (cmd) {
414	case GRESKEY:
415		sc->gre_key = value;
416		break;
417	case GRESOPTS:
418		sc->gre_options = value;
419		break;
420	case GRESPORT:
421		sc->gre_port = value;
422		break;
423	}
424	error = in6_gre_attach(sc);
425	if (error != 0) {
426		sc->gre_family = 0;
427		free(sc->gre_hdr, M_GRE);
428	}
429	return (error);
430}
431
432int
433in6_gre_ioctl(struct gre_softc *sc, u_long cmd, caddr_t data)
434{
435	struct in6_ifreq *ifr = (struct in6_ifreq *)data;
436	struct sockaddr_in6 *dst, *src;
437	struct ip6_hdr *ip6;
438	int error;
439
440	/* NOTE: we are protected with gre_ioctl_sx lock */
441	error = EINVAL;
442	switch (cmd) {
443	case SIOCSIFPHYADDR_IN6:
444		src = &((struct in6_aliasreq *)data)->ifra_addr;
445		dst = &((struct in6_aliasreq *)data)->ifra_dstaddr;
446
447		/* sanity checks */
448		if (src->sin6_family != dst->sin6_family ||
449		    src->sin6_family != AF_INET6 ||
450		    src->sin6_len != dst->sin6_len ||
451		    src->sin6_len != sizeof(*src))
452			break;
453		if (IN6_IS_ADDR_UNSPECIFIED(&src->sin6_addr) ||
454		    IN6_IS_ADDR_UNSPECIFIED(&dst->sin6_addr)) {
455			error = EADDRNOTAVAIL;
456			break;
457		}
458		/*
459		 * Check validity of the scope zone ID of the
460		 * addresses, and convert it into the kernel
461		 * internal form if necessary.
462		 */
463		if ((error = sa6_embedscope(src, 0)) != 0 ||
464		    (error = sa6_embedscope(dst, 0)) != 0)
465			break;
466
467		if (V_ipv6_hashtbl == NULL) {
468			V_ipv6_hashtbl = gre_hashinit();
469			V_ipv6_srchashtbl = gre_hashinit();
470			V_ipv6_sockets = (struct gre_sockets *)gre_hashinit();
471		}
472		error = in6_gre_checkdup(sc, &src->sin6_addr,
473		    &dst->sin6_addr, sc->gre_options);
474		if (error == EADDRNOTAVAIL)
475			break;
476		if (error == EEXIST) {
477			/* Addresses are the same. Just return. */
478			error = 0;
479			break;
480		}
481		ip6 = malloc(sizeof(struct greudp6) + 3 * sizeof(uint32_t),
482		    M_GRE, M_WAITOK | M_ZERO);
483		ip6->ip6_src = src->sin6_addr;
484		ip6->ip6_dst = dst->sin6_addr;
485		if (sc->gre_family != 0) {
486			/* Detach existing tunnel first */
487			CK_LIST_REMOVE(sc, chain);
488			CK_LIST_REMOVE(sc, srchash);
489			GRE_WAIT();
490			free(sc->gre_hdr, M_GRE);
491			/* XXX: should we notify about link state change? */
492		}
493		sc->gre_family = AF_INET6;
494		sc->gre_hdr = ip6;
495		sc->gre_oseq = 0;
496		sc->gre_iseq = UINT32_MAX;
497		error = in6_gre_attach(sc);
498		if (error != 0) {
499			sc->gre_family = 0;
500			free(sc->gre_hdr, M_GRE);
501		}
502		break;
503	case SIOCGIFPSRCADDR_IN6:
504	case SIOCGIFPDSTADDR_IN6:
505		if (sc->gre_family != AF_INET6) {
506			error = EADDRNOTAVAIL;
507			break;
508		}
509		src = (struct sockaddr_in6 *)&ifr->ifr_addr;
510		memset(src, 0, sizeof(*src));
511		src->sin6_family = AF_INET6;
512		src->sin6_len = sizeof(*src);
513		src->sin6_addr = (cmd == SIOCGIFPSRCADDR_IN6) ?
514		    sc->gre_oip6.ip6_src: sc->gre_oip6.ip6_dst;
515		error = prison_if(curthread->td_ucred, (struct sockaddr *)src);
516		if (error == 0)
517			error = sa6_recoverscope(src);
518		if (error != 0)
519			memset(src, 0, sizeof(*src));
520		break;
521	}
522	return (error);
523}
524
525int
526in6_gre_output(struct mbuf *m, int af __unused, int hlen __unused,
527    uint32_t flowid)
528{
529	struct greip6 *gi6;
530
531	gi6 = mtod(m, struct greip6 *);
532	gi6->gi6_ip6.ip6_hlim = V_ip6_gre_hlim;
533	gi6->gi6_ip6.ip6_flow |= flowid & IPV6_FLOWLABEL_MASK;
534	return (ip6_output(m, NULL, NULL, IPV6_MINMTU, NULL, NULL, NULL));
535}
536
537static const struct srcaddrtab *ipv6_srcaddrtab = NULL;
538static const struct encaptab *ecookie = NULL;
539static const struct encap_config ipv6_encap_cfg = {
540	.proto = IPPROTO_GRE,
541	.min_length = sizeof(struct greip6) +
542#ifdef INET
543	    sizeof(struct ip),
544#else
545	    sizeof(struct ip6_hdr),
546#endif
547	.exact_match = ENCAP_DRV_LOOKUP,
548	.lookup = in6_gre_lookup,
549	.input = gre_input
550};
551
552void
553in6_gre_init(void)
554{
555
556	if (!IS_DEFAULT_VNET(curvnet))
557		return;
558	ipv6_srcaddrtab = ip6_encap_register_srcaddr(in6_gre_srcaddr,
559	    NULL, M_WAITOK);
560	ecookie = ip6_encap_attach(&ipv6_encap_cfg, NULL, M_WAITOK);
561}
562
563void
564in6_gre_uninit(void)
565{
566
567	if (IS_DEFAULT_VNET(curvnet)) {
568		ip6_encap_detach(ecookie);
569		ip6_encap_unregister_srcaddr(ipv6_srcaddrtab);
570	}
571	if (V_ipv6_hashtbl != NULL) {
572		gre_hashdestroy(V_ipv6_hashtbl);
573		V_ipv6_hashtbl = NULL;
574		GRE_WAIT();
575		gre_hashdestroy(V_ipv6_srchashtbl);
576		gre_hashdestroy((struct gre_list *)V_ipv6_sockets);
577	}
578}
579