123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327 |
- /*
- * 6in4 - tunnel client for automatic 6to4 or configured v6-in-v4 tunnels
- */
- #include <u.h>
- #include <libc.h>
- #include <ip.h>
- enum {
- IP_IPV6PROTO = 41,
- };
- int anysender;
- int gateway;
- uchar local6[IPaddrlen];
- uchar remote6[IPaddrlen];
- uchar remote4[IPaddrlen];
- uchar localmask[IPaddrlen];
- uchar localnet[IPaddrlen];
- uchar myip[IPaddrlen];
- /* magic anycast address from rfc3068 */
- uchar anycast6to4[IPv4addrlen] = { 192, 88, 99, 1 };
- static char *net = "/net";
- static int badipv4(uchar*);
- static int badipv6(uchar*);
- static void ip2tunnel(int, int);
- static void tunnel2ip(int, int);
- static void
- usage(void)
- {
- fprint(2, "Usage: %s [-ag] [-x mtpt] local6[/mask] [remote4 [remote6]]\n",
- argv0);
- exits("Usage");
- }
- void
- main(int argc, char **argv)
- {
- int n, tunnel, ifc, cfd;
- char *p, *cl, *ir;
- char buf[128], path[64];
- fmtinstall('I', eipfmt);
- fmtinstall('V', eipfmt);
- fmtinstall('M', eipfmt);
- ARGBEGIN {
- case 'a':
- anysender++;
- break;
- case 'g':
- gateway++;
- break;
- case 'x':
- net = EARGF(usage());
- break;
- default:
- usage();
- } ARGEND
- if (argc < 1)
- usage();
- /* local v6 address (mask defaults to /128) */
- memcpy(localmask, IPallbits, sizeof localmask);
- if ((p = strchr(argv[0], '/')) != nil) {
- parseipmask(localmask, p);
- *p = 0;
- }
- parseip(local6, argv[0]);
- if (isv4(local6))
- usage();
- argv++;
- argc--;
- if (argc >= 1 && argv[0][0] == '/') {
- parseipmask(localmask, argv[0]);
- argv++;
- argc--;
- }
- /* remote v4 address (defaults to anycast 6to4) */
- if (argc >= 1) {
- parseip(remote4, argv[0]);
- if (!isv4(remote4))
- usage();
- argv++;
- argc--;
- } else {
- v4tov6(remote4, anycast6to4);
- anysender++;
- }
- /* remote v6 address (defaults to link-local w/ v4 as interface part) */
- if (argc >= 1) {
- parseip(remote6, argv[0]);
- if (isv4(remote4))
- usage();
- argv++;
- argc--;
- } else {
- remote6[0] = 0xFE; /* link local */
- remote6[1] = 0x80;
- memcpy(remote6 + IPv4off, remote4 + IPv4off, IPv4addrlen);
- }
- USED(argv);
- if (argc != 0)
- usage();
- maskip(local6, localmask, localnet);
- if (myipaddr(myip, net) < 0)
- sysfatal("can't find my ipv4 address on %s", net);
- /*
- * open IPv6-in-IPv4 tunnel
- */
- p = seprint(buf, buf + sizeof buf, "ipmux!proto=%2.2x;dst=%V",
- IP_IPV6PROTO, myip + IPv4off);
- if (!anysender)
- seprint(p, buf + sizeof buf, ";src=%V", remote4 + IPv4off);
- tunnel = dial(buf, 0, 0, 0);
- if (tunnel < 0)
- sysfatal("can't make 6in4 tunnel with dial str %s: %r", buf);
- /*
- * open local IPv6 interface (as a packet interface)
- */
- cl = smprint("%s/ipifc/clone", net);
- cfd = open(cl, ORDWR); /* allocate a conversation */
- free(cl);
- n = 0;
- if (cfd < 0 || (n = read(cfd, buf, sizeof buf - 1)) <= 0)
- sysfatal("can't make packet interface: %r");
- buf[n] = 0;
- snprint(path, sizeof path, "%s/ipifc/%s/data", net, buf);
- ifc = open(path, ORDWR);
- if (ifc < 0 || fprint(cfd, "bind pkt") < 0)
- sysfatal("can't bind packet interface: %r");
- /* 1280 is MTU, apparently from rfc2460 */
- if (fprint(cfd, "add %I /128 %I 1280", local6, remote6) <= 0)
- sysfatal("can't set local ipv6 address: %r");
- close(cfd);
- if (gateway) {
- /* route global addresses through the tunnel to remote6 */
- ir = smprint("%s/iproute", net);
- cfd = open(ir, OWRITE);
- free(ir);
- if (cfd < 0 || fprint(cfd, "add 2000:: /3 %I", remote6) <= 0)
- sysfatal("can't set default global route: %r");
- }
- switch (rfork(RFPROC|RFNOWAIT|RFMEM)) {
- case -1:
- sysfatal("rfork");
- case 0:
- ip2tunnel(ifc, tunnel);
- break;
- default:
- tunnel2ip(tunnel, ifc);
- break;
- }
- exits("tunnel gone");
- }
- typedef struct Iphdr Iphdr;
- typedef struct Ip6hdr Ip6hdr;
- struct Iphdr
- {
- uchar vihl; /* Version and header length */
- uchar tos; /* Type of service */
- uchar length[2]; /* packet length */
- uchar id[2]; /* Identification */
- uchar frag[2]; /* Fragment information */
- uchar ttl; /* Time to live */
- uchar proto; /* Protocol */
- uchar cksum[2]; /* Header checksum */
- uchar src[4]; /* Ip source (uchar ordering unimportant) */
- uchar dst[4]; /* Ip destination (uchar ordering unimportant) */
- };
- struct Ip6hdr {
- uchar vcf[4]; /* version:4, traffic class:8, flow label:20 */
- uchar ploadlen[2]; /* payload length: packet length - 40 */
- uchar proto; /* next header type */
- uchar ttl; /* hop limit */
- uchar src[IPaddrlen];
- uchar dst[IPaddrlen];
- };
- #define STFHDR (sizeof(Iphdr))
- static void
- ip2tunnel(int in, int out)
- {
- int n, m;
- char buf[64*1024];
- Iphdr *op;
- Ip6hdr *ip;
- op = (Iphdr*)buf;
- op->vihl = 0x45; /* v4, hdr is 5 longs? */
- memcpy(op->src, myip + IPv4off, sizeof op->src);
- op->proto = IP_IPV6PROTO;
- op->ttl = 100;
- /* get a V6 packet destined for the tunnel */
- while ((n = read(in, buf + STFHDR, sizeof buf - STFHDR)) > 0) {
- /* if not IPV6, drop it */
- ip = (Ip6hdr*)(buf + STFHDR);
- if ((ip->vcf[0]&0xF0) != 0x60)
- continue;
- /* check length: drop if too short, trim if too long */
- m = nhgets(ip->ploadlen) + sizeof(Ip6hdr);
- if (m > n)
- continue;
- if (m < n)
- n = m;
- /* drop if v6 source or destination address is naughty */
- if (badipv6(ip->src) ||
- (!equivip6(ip->dst, remote6) && badipv6(ip->dst))) {
- syslog(0, "6in4", "egress filtered %I -> %I",
- ip->src, ip->dst);
- continue;
- }
- /* send 6to4 packets (2002::) directly to ipv4 target */
- if (ip->dst[0] == 0x20 && ip->dst[1] == 0x02)
- memcpy(op->dst, ip->dst+2, sizeof op->dst);
- else
- memcpy(op->dst, remote4+IPv4off, sizeof op->dst);
- n += STFHDR;
- /* pass packet to the other end of the tunnel */
- if (write(out, op, n) != n) {
- syslog(0, "6in4", "error writing to tunnel (%r), giving up");
- break;
- }
- }
- }
- static void
- tunnel2ip(int in, int out)
- {
- int n, m;
- char buf[64*1024];
- uchar a[IPaddrlen];
- Ip6hdr *op;
- Iphdr *ip;
- for (;;) {
- /* get a packet from the tunnel */
- n = read(in, buf, sizeof buf);
- ip = (Iphdr*)(buf + IPaddrlen);
- n -= IPaddrlen;
- if (n <= 0) {
- syslog(0, "6in4", "error reading from tunnel (%r), giving up");
- break;
- }
- /* if not IPv4 nor IP protocol IPv6, drop it */
- if ((ip->vihl&0xF0) != 0x40 || ip->proto != IP_IPV6PROTO)
- continue;
- /* check length: drop if too short, trim if too long */
- m = nhgets(ip->length);
- if (m > n)
- continue;
- if (m < n)
- n = m;
- op = (Ip6hdr*)(buf + IPaddrlen + STFHDR);
- n -= STFHDR;
- /* don't relay: just accept packets for local host/subnet */
- /* (this blocks link-local and multicast addresses as well) */
- maskip(op->dst, localmask, a);
- if (!equivip6(a, localnet)) {
- syslog(0, "6in4", "ingress filtered %I -> %I",
- op->src, op->dst);
- continue;
- }
- /* pass V6 packet to the interface */
- write(out, op, n);
- }
- }
- static int
- badipv4(uchar *a)
- {
- switch (a[0]) {
- case 0: /* unassigned */
- case 10: /* private */
- case 127: /* loopback */
- return 1;
- case 172:
- return a[1] >= 16; /* 172.16.0.0/12 private */
- case 192:
- return a[1] == 168; /* 192.168.0.0/16 private */
- case 169:
- return a[1] == 254; /* 169.254.0.0/16 DHCP link-local */
- }
- /* 224.0.0.0/4 multicast, 240.0.0.0/4 reserved, broadcast */
- return a[0] >= 240;
- }
- static int
- badipv6(uchar *a)
- {
- int h = a[0]<<8 | a[1];
- if (h == 0 || /* compatible, mapped, loopback, unspecified ... */
- h >= 0xFE80) /* multicast, link-local or site-local */
- return 1;
- if (h == 0x2002 && /* 6to4 address */
- badipv4(a+2))
- return 1;
- return 0;
- }
|