2 * $FreeBSD: src/sys/netinet/in_gif.c,v 1.5.2.11 2003/01/23 21:06:45 sam Exp $
3 * $KAME: in_gif.c,v 1.54 2001/05/14 14:02:16 itojun Exp $
6 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 #include "opt_inet6.h"
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/socket.h>
40 #include <sys/sockio.h>
42 #include <sys/errno.h>
43 #include <sys/kernel.h>
44 #include <sys/sysctl.h>
45 #include <sys/protosw.h>
47 #include <sys/malloc.h>
49 #include <machine/stdarg.h>
52 #include <net/route.h>
54 #include <netinet/in.h>
55 #include <netinet/in_systm.h>
56 #include <netinet/ip.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/in_gif.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip_encap.h>
61 #include <netinet/ip_ecn.h>
64 #include <netinet/ip6.h>
67 #include <net/gif/if_gif.h>
68 #include <net/net_osdep.h>
71 static int gif_validate4 (const struct ip
*, struct gif_softc
*,
74 extern struct domain inetdomain
;
75 const struct protosw in_gif_protosw
=
78 .pr_domain
= &inetdomain
,
79 .pr_protocol
= 0 /*IPPROTO_IPV[46]*/,
80 .pr_flags
= PR_ATOMIC
|PR_ADDR
,
82 .pr_input
= in_gif_input
,
83 .pr_output
= rip_output
,
85 .pr_ctloutput
= rip_ctloutput
,
88 .pr_usrreqs
= &rip_usrreqs
91 int ip_gif_ttl
= GIF_TTL
;
92 SYSCTL_INT(_net_inet_ip
, IPCTL_GIF_TTL
, gifttl
, CTLFLAG_RW
,
93 &ip_gif_ttl
, 0, "TTL of GIF packet");
96 in_gif_output(struct ifnet
*ifp
, int family
, struct mbuf
*m
)
98 struct gif_softc
*sc
= (struct gif_softc
*)ifp
;
99 struct route
*ro
= &sc
->gif_ro
[mycpu
->gd_cpuid
];
100 struct sockaddr_in
*dst
= (struct sockaddr_in
*)&ro
->ro_dst
;
101 struct sockaddr_in
*sin_src
= (struct sockaddr_in
*)sc
->gif_psrc
;
102 struct sockaddr_in
*sin_dst
= (struct sockaddr_in
*)sc
->gif_pdst
;
103 struct ip iphdr
; /* capsule IP header, host byte ordered */
107 if (sin_src
== NULL
|| sin_dst
== NULL
||
108 sin_src
->sin_family
!= AF_INET
||
109 sin_dst
->sin_family
!= AF_INET
) {
120 proto
= IPPROTO_IPV4
;
121 if (m
->m_len
< sizeof *ip
) {
122 m
= m_pullup(m
, sizeof *ip
);
126 ip
= mtod(m
, struct ip
*);
135 proto
= IPPROTO_IPV6
;
136 if (m
->m_len
< sizeof *ip6
) {
137 m
= m_pullup(m
, sizeof *ip6
);
141 ip6
= mtod(m
, struct ip6_hdr
*);
142 tos
= (ntohl(ip6
->ip6_flow
) >> 20) & 0xff;
148 kprintf("in_gif_output: warning: unknown family %d passed\n",
155 bzero(&iphdr
, sizeof iphdr
);
156 iphdr
.ip_src
= sin_src
->sin_addr
;
157 /* bidirectional configured tunnel mode */
158 if (sin_dst
->sin_addr
.s_addr
!= INADDR_ANY
)
159 iphdr
.ip_dst
= sin_dst
->sin_addr
;
165 /* version will be set in ip_output() */
166 iphdr
.ip_ttl
= ip_gif_ttl
;
167 iphdr
.ip_len
= htons(m
->m_pkthdr
.len
+ sizeof(struct ip
));
168 if (ifp
->if_flags
& IFF_LINK1
)
169 ip_ecn_ingress(ECN_ALLOWED
, &iphdr
.ip_tos
, &tos
);
171 ip_ecn_ingress(ECN_NOCARE
, &iphdr
.ip_tos
, &tos
);
173 /* prepend new IP header */
174 M_PREPEND(m
, sizeof(struct ip
), M_NOWAIT
);
175 if (m
&& m
->m_len
< sizeof(struct ip
))
176 m
= m_pullup(m
, sizeof(struct ip
));
178 kprintf("ENOBUFS in in_gif_output %d\n", __LINE__
);
181 bcopy(&iphdr
, mtod(m
, struct ip
*), sizeof(struct ip
));
183 if (dst
->sin_family
!= sin_dst
->sin_family
||
184 dst
->sin_addr
.s_addr
!= sin_dst
->sin_addr
.s_addr
) {
185 /* cache route doesn't match */
186 dst
->sin_family
= sin_dst
->sin_family
;
187 dst
->sin_len
= sizeof(struct sockaddr_in
);
188 dst
->sin_addr
= sin_dst
->sin_addr
;
189 if (ro
->ro_rt
!= NULL
) {
194 sc
->gif_if
.if_mtu
= GIF_MTU
;
198 if (ro
->ro_rt
== NULL
) {
200 if (ro
->ro_rt
== NULL
) {
205 /* if it constitutes infinite encapsulation, punt. */
206 if (ro
->ro_rt
->rt_ifp
== ifp
) {
208 return ENETUNREACH
; /* XXX */
211 ifp
->if_mtu
= ro
->ro_rt
->rt_ifp
->if_mtu
- sizeof(struct ip
);
215 error
= ip_output(m
, NULL
, ro
, 0, NULL
, NULL
);
220 in_gif_input(struct mbuf
**mp
, int *offp
, int proto
)
222 struct mbuf
*m
= *mp
;
223 struct ifnet
*gifp
= NULL
;
232 ip
= mtod(m
, struct ip
*);
234 gifp
= (struct ifnet
*)encap_getarg(m
);
236 if (gifp
== NULL
|| (gifp
->if_flags
& IFF_UP
) == 0) {
239 return(IPPROTO_DONE
);
251 if (m
->m_len
< sizeof *ip
) {
252 m
= m_pullup(m
, sizeof *ip
);
254 return(IPPROTO_DONE
);
256 ip
= mtod(m
, struct ip
*);
257 if (gifp
->if_flags
& IFF_LINK1
)
258 ip_ecn_egress(ECN_ALLOWED
, &otos
, &ip
->ip_tos
);
260 ip_ecn_egress(ECN_NOCARE
, &otos
, &ip
->ip_tos
);
270 if (m
->m_len
< sizeof *ip6
) {
271 m
= m_pullup(m
, sizeof *ip6
);
273 return(IPPROTO_DONE
);
275 ip6
= mtod(m
, struct ip6_hdr
*);
276 itos
= (ntohl(ip6
->ip6_flow
) >> 20) & 0xff;
277 if (gifp
->if_flags
& IFF_LINK1
)
278 ip_ecn_egress(ECN_ALLOWED
, &otos
, &itos
);
280 ip_ecn_egress(ECN_NOCARE
, &otos
, &itos
);
281 ip6
->ip6_flow
&= ~htonl(0xff << 20);
282 ip6
->ip6_flow
|= htonl((u_int32_t
)itos
<< 20);
289 return(IPPROTO_DONE
);
291 gif_input(m
, af
, gifp
);
292 return(IPPROTO_DONE
);
296 * validate outer address.
299 gif_validate4(const struct ip
*ip
, struct gif_softc
*sc
, struct ifnet
*ifp
)
301 struct sockaddr_in
*src
, *dst
;
302 struct in_ifaddr_container
*iac
;
304 src
= (struct sockaddr_in
*)sc
->gif_psrc
;
305 dst
= (struct sockaddr_in
*)sc
->gif_pdst
;
307 /* check for address match */
308 if (src
->sin_addr
.s_addr
!= ip
->ip_dst
.s_addr
||
309 dst
->sin_addr
.s_addr
!= ip
->ip_src
.s_addr
)
312 /* martian filters on outer source - NOT done in ip_input! */
313 if (IN_MULTICAST(ntohl(ip
->ip_src
.s_addr
)))
315 switch ((ntohl(ip
->ip_src
.s_addr
) & 0xff000000) >> 24) {
316 case 0: case 127: case 255:
319 /* reject packets with broadcast on source */
320 TAILQ_FOREACH(iac
, &in_ifaddrheads
[mycpuid
], ia_link
) {
321 struct in_ifaddr
*ia4
= iac
->ia
;
323 if (!(ia4
->ia_ifa
.ifa_ifp
->if_flags
& IFF_BROADCAST
))
325 if (ip
->ip_src
.s_addr
== ia4
->ia_broadaddr
.sin_addr
.s_addr
)
329 /* ingress filters on outer source */
330 if (!(sc
->gif_if
.if_flags
& IFF_LINK2
) && ifp
!= NULL
) {
331 struct sockaddr_in sin
;
334 bzero(&sin
, sizeof sin
);
335 sin
.sin_family
= AF_INET
;
336 sin
.sin_len
= sizeof(struct sockaddr_in
);
337 sin
.sin_addr
= ip
->ip_src
;
338 rt
= rtpurelookup((struct sockaddr
*)&sin
);
341 if (rt
== NULL
|| rt
->rt_ifp
!= ifp
) {
343 log(LOG_WARNING
, "%s: packet from 0x%x dropped "
344 "due to ingress filter\n", if_name(&sc
->gif_if
),
345 (u_int32_t
)ntohl(sin
.sin_addr
.s_addr
));
355 * we know that we are in IFF_UP, outer address available, and outer family
356 * matched the physical addr family. see gif_encapcheck().
359 gif_encapcheck4(const struct mbuf
*m
, int off
, int proto
, void *arg
)
362 struct gif_softc
*sc
;
365 /* sanity check done in caller */
366 sc
= (struct gif_softc
*)arg
;
368 /* LINTED const cast */
369 m_copydata(__DECONST(struct mbuf
*, m
), 0, sizeof ip
, &ip
);
370 ifp
= ((m
->m_flags
& M_PKTHDR
) != 0) ? m
->m_pkthdr
.rcvif
: NULL
;
372 return gif_validate4(&ip
, sc
, ifp
);
376 in_gif_attach(struct gif_softc
*sc
)
378 sc
->encap_cookie4
= encap_attach_func(AF_INET
, -1, gif_encapcheck
,
379 &in_gif_protosw
, sc
);
380 if (sc
->encap_cookie4
== NULL
)
386 in_gif_detach(struct gif_softc
*sc
)
390 error
= encap_detach(sc
->encap_cookie4
);
392 sc
->encap_cookie4
= NULL
;