1 /* $FreeBSD: src/sys/net/if_stf.c,v 1.1.2.11 2003/01/23 21:06:44 sam Exp $ */
2 /* $DragonFly: src/sys/net/stf/if_stf.c,v 1.21 2008/03/07 11:34:20 sephe Exp $ */
3 /* $KAME: if_stf.c,v 1.73 2001/12/03 11:08:30 keiichi Exp $ */
6 * Copyright (C) 2000 WIDE Project.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the project nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * 6to4 interface, based on RFC3056.
37 * 6to4 interface is NOT capable of link-layer (I mean, IPv4) multicasting.
38 * There is no address mapping defined from IPv6 multicast address to IPv4
39 * address. Therefore, we do not have IFF_MULTICAST on the interface.
41 * Due to the lack of address mapping for link-local addresses, we cannot
42 * throw packets toward link-local addresses (fe80::x). Also, we cannot throw
43 * packets to link-local multicast addresses (ff02::x).
45 * Here are interesting symptoms due to the lack of link-local address:
47 * Unicast routing exchange:
48 * - RIPng: Impossible. Uses link-local multicast packet toward ff02::9,
49 * and link-local addresses as nexthop.
50 * - OSPFv6: Impossible. OSPFv6 assumes that there's link-local address
51 * assigned to the link, and makes use of them. Also, HELLO packets use
52 * link-local multicast addresses (ff02::5 and ff02::6).
53 * - BGP4+: Maybe. You can only use global address as nexthop, and global
54 * address as TCP endpoint address.
56 * Multicast routing protocols:
57 * - PIM: Hello packet cannot be used to discover adjacent PIM routers.
58 * Adjacent PIM routers must be configured manually (is it really spec-wise
59 * correct thing to do?).
62 * - Redirects cannot be used due to the lack of link-local address.
64 * stf interface does not have, and will not need, a link-local address.
65 * It seems to have no real benefit and does not help the above symptoms much.
66 * Even if we assign link-locals to interface, we cannot really
67 * use link-local unicast/multicast on top of 6to4 cloud (since there's no
68 * encapsulation defined for link-local address), and the above analysis does
69 * not change. RFC3056 does not mandate the assignment of link-local address
72 * 6to4 interface has security issues. Refer to
73 * http://playground.iijlab.net/i-d/draft-itojun-ipv6-transition-abuse-00.txt
74 * for details. The code tries to filter out some of malicious packets.
75 * Note that there is no way to be 100% secure.
79 #include "opt_inet6.h"
81 #include <sys/param.h>
82 #include <sys/systm.h>
83 #include <sys/socket.h>
84 #include <sys/sockio.h>
86 #include <sys/errno.h>
87 #include <sys/protosw.h>
88 #include <sys/kernel.h>
89 #include <machine/cpu.h>
91 #include <sys/malloc.h>
94 #include <net/route.h>
95 #include <net/netisr.h>
96 #include <net/if_types.h>
99 #include <netinet/in.h>
100 #include <netinet/in_systm.h>
101 #include <netinet/ip.h>
102 #include <netinet/ip_var.h>
103 #include <netinet/in_var.h>
105 #include <netinet/ip6.h>
106 #include <netinet6/ip6_var.h>
107 #include <netinet6/in6_var.h>
108 #include <netinet/ip_ecn.h>
110 #include <netinet/ip_encap.h>
112 #include <machine/stdarg.h>
114 #include <net/net_osdep.h>
118 #define IN6_IS_ADDR_6TO4(x) (ntohs((x)->s6_addr16[0]) == 0x2002)
119 #define GET_V4(x) ((struct in_addr *)(&(x)->s6_addr16[1]))
122 struct ifnet sc_if
; /* common area */
124 struct route __sc_ro4
;
125 struct route_in6 __sc_ro6
; /* just for safety */
127 #define sc_ro __sc_ro46.__sc_ro4
128 const struct encaptab
*encap_cookie
;
131 static struct stf_softc
*stf
;
133 static MALLOC_DEFINE(M_STF
, "stf", "6to4 Tunnel Interface");
134 static int ip_stf_ttl
= 40;
136 extern struct domain inetdomain
;
137 struct protosw in_stf_protosw
=
138 { SOCK_RAW
, &inetdomain
, IPPROTO_IPV6
, PR_ATOMIC
|PR_ADDR
,
139 in_stf_input
, rip_output
, 0, rip_ctloutput
,
145 static int stfmodevent (module_t
, int, void *);
146 static int stf_encapcheck (const struct mbuf
*, int, int, void *);
147 static struct in6_ifaddr
*stf_getsrcifa6 (struct ifnet
*);
148 static int stf_output (struct ifnet
*, struct mbuf
*, struct sockaddr
*,
150 static int stf_checkaddr4 (struct stf_softc
*, struct in_addr
*,
152 static int stf_checkaddr6 (struct stf_softc
*, struct in6_addr
*,
154 static void stf_rtrequest (int, struct rtentry
*, struct rt_addrinfo
*);
155 static int stf_ioctl (struct ifnet
*, u_long
, caddr_t
, struct ucred
*);
158 stfmodevent(module_t mod
, int type
, void *data
)
160 struct stf_softc
*sc
;
162 const struct encaptab
*p
;
166 stf
= kmalloc(sizeof(struct stf_softc
), M_STF
,
170 bzero(sc
, sizeof(*sc
));
171 if_initname(&(sc
->sc_if
), "stf", 0);
173 p
= encap_attach_func(AF_INET
, IPPROTO_IPV6
, stf_encapcheck
,
174 (void *)&in_stf_protosw
, sc
);
176 kprintf("%s: attach failed\n", if_name(&sc
->sc_if
));
179 sc
->encap_cookie
= p
;
181 sc
->sc_if
.if_mtu
= IPV6_MMTU
;
182 sc
->sc_if
.if_flags
= 0;
183 sc
->sc_if
.if_ioctl
= stf_ioctl
;
184 sc
->sc_if
.if_output
= stf_output
;
185 sc
->sc_if
.if_type
= IFT_STF
;
187 /* turn off ingress filter */
188 sc
->sc_if
.if_flags
|= IFF_LINK2
;
190 sc
->sc_if
.if_snd
.ifq_maxlen
= IFQ_MAXLEN
;
191 if_attach(&sc
->sc_if
, NULL
);
192 bpfattach(&sc
->sc_if
, DLT_NULL
, sizeof(u_int
));
196 bpfdetach(&sc
->sc_if
);
197 if_detach(&sc
->sc_if
);
198 err
= encap_detach(sc
->encap_cookie
);
199 KASSERT(err
== 0, ("Unexpected error detaching encap_cookie"));
207 static moduledata_t stf_mod
= {
213 DECLARE_MODULE(if_stf
, stf_mod
, SI_SUB_PSEUDO
, SI_ORDER_ANY
);
216 stf_encapcheck(const struct mbuf
*m
, int off
, int proto
, void *arg
)
219 struct in6_ifaddr
*ia6
;
220 struct stf_softc
*sc
;
223 sc
= (struct stf_softc
*)arg
;
227 if ((sc
->sc_if
.if_flags
& IFF_UP
) == 0)
230 /* IFF_LINK0 means "no decapsulation" */
231 if ((sc
->sc_if
.if_flags
& IFF_LINK0
) != 0)
234 if (proto
!= IPPROTO_IPV6
)
237 m_copydata(m
, 0, sizeof(ip
), (caddr_t
)&ip
);
242 ia6
= stf_getsrcifa6(&sc
->sc_if
);
247 * check if IPv4 dst matches the IPv4 address derived from the
248 * local 6to4 address.
249 * success on: dst = 10.1.1.1, ia6->ia_addr = 2002:0a01:0101:...
251 if (bcmp(GET_V4(&ia6
->ia_addr
.sin6_addr
), &ip
.ip_dst
,
252 sizeof(ip
.ip_dst
)) != 0)
256 * check if IPv4 src matches the IPv4 address derived from the
257 * local 6to4 address masked by prefixmask.
258 * success on: src = 10.1.1.1, ia6->ia_addr = 2002:0a00:.../24
259 * fail on: src = 10.1.1.1, ia6->ia_addr = 2002:0b00:.../24
261 bzero(&a
, sizeof(a
));
262 a
.s_addr
= GET_V4(&ia6
->ia_addr
.sin6_addr
)->s_addr
;
263 a
.s_addr
&= GET_V4(&ia6
->ia_prefixmask
.sin6_addr
)->s_addr
;
265 b
.s_addr
&= GET_V4(&ia6
->ia_prefixmask
.sin6_addr
)->s_addr
;
266 if (a
.s_addr
!= b
.s_addr
)
269 /* stf interface makes single side match only */
273 static struct in6_ifaddr
*
274 stf_getsrcifa6(struct ifnet
*ifp
)
276 struct ifaddr_container
*ifac
;
277 struct in_ifaddr
*ia4
;
278 struct sockaddr_in6
*sin6
;
281 TAILQ_FOREACH(ifac
, &ifp
->if_addrheads
[mycpuid
], ifa_link
) {
282 struct ifaddr
*ia
= ifac
->ifa
;
284 if (ia
->ifa_addr
== NULL
)
286 if (ia
->ifa_addr
->sa_family
!= AF_INET6
)
288 sin6
= (struct sockaddr_in6
*)ia
->ifa_addr
;
289 if (!IN6_IS_ADDR_6TO4(&sin6
->sin6_addr
))
292 bcopy(GET_V4(&sin6
->sin6_addr
), &in
, sizeof(in
));
293 LIST_FOREACH(ia4
, INADDR_HASH(in
.s_addr
), ia_hash
)
294 if (ia4
->ia_addr
.sin_addr
.s_addr
== in
.s_addr
)
299 return (struct in6_ifaddr
*)ia
;
306 stf_output(struct ifnet
*ifp
, struct mbuf
*m
, struct sockaddr
*dst
,
309 struct stf_softc
*sc
;
310 struct sockaddr_in6
*dst6
;
312 struct sockaddr_in
*dst4
;
316 struct in6_ifaddr
*ia6
;
317 static const uint32_t af
= AF_INET6
;
319 sc
= (struct stf_softc
*)ifp
;
320 dst6
= (struct sockaddr_in6
*)dst
;
323 if ((ifp
->if_flags
& IFF_UP
) == 0) {
329 * If we don't have an ip4 address that match my inner ip6 address,
330 * we shouldn't generate output. Without this check, we'll end up
331 * using wrong IPv4 source.
333 ia6
= stf_getsrcifa6(ifp
);
339 if (m
->m_len
< sizeof(*ip6
)) {
340 m
= m_pullup(m
, sizeof(*ip6
));
344 ip6
= mtod(m
, struct ip6_hdr
*);
345 tos
= (ntohl(ip6
->ip6_flow
) >> 20) & 0xff;
348 * Pickup the right outer dst addr from the list of candidates.
349 * ip6_dst has priority as it may be able to give us shorter IPv4 hops.
351 if (IN6_IS_ADDR_6TO4(&ip6
->ip6_dst
))
352 in4
= GET_V4(&ip6
->ip6_dst
);
353 else if (IN6_IS_ADDR_6TO4(&dst6
->sin6_addr
))
354 in4
= GET_V4(&dst6
->sin6_addr
);
361 bpf_ptap(ifp
->if_bpf
, m
, &af
, sizeof(af
));
363 M_PREPEND(m
, sizeof(struct ip
), MB_DONTWAIT
);
364 if (m
&& m
->m_len
< sizeof(struct ip
))
365 m
= m_pullup(m
, sizeof(struct ip
));
368 ip
= mtod(m
, struct ip
*);
370 bzero(ip
, sizeof(*ip
));
372 bcopy(GET_V4(&((struct sockaddr_in6
*)&ia6
->ia_addr
)->sin6_addr
),
373 &ip
->ip_src
, sizeof(ip
->ip_src
));
374 bcopy(in4
, &ip
->ip_dst
, sizeof(ip
->ip_dst
));
375 ip
->ip_p
= IPPROTO_IPV6
;
376 ip
->ip_ttl
= ip_stf_ttl
;
377 ip
->ip_len
= m
->m_pkthdr
.len
; /*host order*/
378 if (ifp
->if_flags
& IFF_LINK1
)
379 ip_ecn_ingress(ECN_ALLOWED
, &ip
->ip_tos
, &tos
);
381 ip_ecn_ingress(ECN_NOCARE
, &ip
->ip_tos
, &tos
);
383 dst4
= (struct sockaddr_in
*)&sc
->sc_ro
.ro_dst
;
384 if (dst4
->sin_family
!= AF_INET
||
385 bcmp(&dst4
->sin_addr
, &ip
->ip_dst
, sizeof(ip
->ip_dst
)) != 0) {
386 /* cache route doesn't match */
387 dst4
->sin_family
= AF_INET
;
388 dst4
->sin_len
= sizeof(struct sockaddr_in
);
389 bcopy(&ip
->ip_dst
, &dst4
->sin_addr
, sizeof(dst4
->sin_addr
));
390 if (sc
->sc_ro
.ro_rt
) {
391 RTFREE(sc
->sc_ro
.ro_rt
);
392 sc
->sc_ro
.ro_rt
= NULL
;
396 if (sc
->sc_ro
.ro_rt
== NULL
) {
398 if (sc
->sc_ro
.ro_rt
== NULL
) {
404 return ip_output(m
, NULL
, &sc
->sc_ro
, 0, NULL
, NULL
);
409 * inifp: incoming interface
412 stf_checkaddr4(struct stf_softc
*sc
, struct in_addr
*in
, struct ifnet
*inifp
)
414 struct in_ifaddr
*ia4
;
417 * reject packets with the following address:
418 * 224.0.0.0/4 0.0.0.0/8 127.0.0.0/8 255.0.0.0/8
420 if (IN_MULTICAST(ntohl(in
->s_addr
)))
422 switch ((ntohl(in
->s_addr
) & 0xff000000) >> 24) {
423 case 0: case 127: case 255:
428 * reject packets with broadcast
430 TAILQ_FOREACH(ia4
, &in_ifaddrhead
, ia_link
)
432 if ((ia4
->ia_ifa
.ifa_ifp
->if_flags
& IFF_BROADCAST
) == 0)
434 if (in
->s_addr
== ia4
->ia_broadaddr
.sin_addr
.s_addr
)
439 * perform ingress filter
441 if (sc
&& (sc
->sc_if
.if_flags
& IFF_LINK2
) == 0 && inifp
) {
442 struct sockaddr_in sin
;
445 bzero(&sin
, sizeof(sin
));
446 sin
.sin_family
= AF_INET
;
447 sin
.sin_len
= sizeof(struct sockaddr_in
);
449 rt
= rtpurelookup((struct sockaddr
*)&sin
);
450 if (!rt
|| rt
->rt_ifp
!= inifp
) {
452 log(LOG_WARNING
, "%s: packet from 0x%x dropped "
453 "due to ingress filter\n", if_name(&sc
->sc_if
),
454 (u_int32_t
)ntohl(sin
.sin_addr
.s_addr
));
468 * inifp: incoming interface
471 stf_checkaddr6(struct stf_softc
*sc
, struct in6_addr
*in6
, struct ifnet
*inifp
)
474 * check 6to4 addresses
476 if (IN6_IS_ADDR_6TO4(in6
))
477 return stf_checkaddr4(sc
, GET_V4(in6
), inifp
);
480 * reject anything that look suspicious. the test is implemented
481 * in ip6_input too, but we check here as well to
482 * (1) reject bad packets earlier, and
483 * (2) to be safe against future ip6_input change.
485 if (IN6_IS_ADDR_V4COMPAT(in6
) || IN6_IS_ADDR_V4MAPPED(in6
))
492 in_stf_input(struct mbuf
*m
, ...)
494 struct stf_softc
*sc
;
500 static const uint32_t af
= AF_INET6
;
504 off
= __va_arg(ap
, int);
505 proto
= __va_arg(ap
, int);
508 if (proto
!= IPPROTO_IPV6
) {
513 ip
= mtod(m
, struct ip
*);
515 sc
= (struct stf_softc
*)encap_getarg(m
);
517 if (sc
== NULL
|| (sc
->sc_if
.if_flags
& IFF_UP
) == 0) {
525 * perform sanity check against outer src/dst.
526 * for source, perform ingress filter as well.
528 if (stf_checkaddr4(sc
, &ip
->ip_dst
, NULL
) < 0 ||
529 stf_checkaddr4(sc
, &ip
->ip_src
, m
->m_pkthdr
.rcvif
) < 0) {
537 if (m
->m_len
< sizeof(*ip6
)) {
538 m
= m_pullup(m
, sizeof(*ip6
));
542 ip6
= mtod(m
, struct ip6_hdr
*);
545 * perform sanity check against inner src/dst.
546 * for source, perform ingress filter as well.
548 if (stf_checkaddr6(sc
, &ip6
->ip6_dst
, NULL
) < 0 ||
549 stf_checkaddr6(sc
, &ip6
->ip6_src
, m
->m_pkthdr
.rcvif
) < 0) {
554 itos
= (ntohl(ip6
->ip6_flow
) >> 20) & 0xff;
555 if ((ifp
->if_flags
& IFF_LINK1
) != 0)
556 ip_ecn_egress(ECN_ALLOWED
, &otos
, &itos
);
558 ip_ecn_egress(ECN_NOCARE
, &otos
, &itos
);
559 ip6
->ip6_flow
&= ~htonl(0xff << 20);
560 ip6
->ip6_flow
|= htonl((u_int32_t
)itos
<< 20);
562 m
->m_pkthdr
.rcvif
= ifp
;
565 bpf_ptap(ifp
->if_bpf
, m
, &af
, sizeof(af
));
568 * Put the packet to the network layer input queue according to the
569 * specified address family.
570 * See net/if_gif.c for possible issues with packet processing
571 * reorder due to extra queueing.
574 ifp
->if_ibytes
+= m
->m_pkthdr
.len
;
575 netisr_dispatch(NETISR_IPV6
, m
);
580 stf_rtrequest(int cmd
, struct rtentry
*rt
, struct rt_addrinfo
*info
)
584 rt
->rt_rmx
.rmx_mtu
= IPV6_MMTU
;
588 stf_ioctl(struct ifnet
*ifp
, u_long cmd
, caddr_t data
, struct ucred
*cr
)
592 struct sockaddr_in6
*sin6
;
598 ifa
= (struct ifaddr
*)data
;
599 if (ifa
== NULL
|| ifa
->ifa_addr
->sa_family
!= AF_INET6
) {
600 error
= EAFNOSUPPORT
;
603 sin6
= (struct sockaddr_in6
*)ifa
->ifa_addr
;
604 if (IN6_IS_ADDR_6TO4(&sin6
->sin6_addr
)) {
605 ifa
->ifa_rtrequest
= stf_rtrequest
;
606 ifp
->if_flags
|= IFF_UP
;
613 ifr
= (struct ifreq
*)data
;
614 if (ifr
&& ifr
->ifr_addr
.sa_family
== AF_INET6
)
617 error
= EAFNOSUPPORT
;