|
| 1 | +/* |
| 2 | +* Copyright 2019 Comcast Cable Communications Management, LLC |
| 3 | +* |
| 4 | +* Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +* you may not use this file except in compliance with the License. |
| 6 | +* You may obtain a copy of the License at |
| 7 | +* |
| 8 | +* http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +* |
| 10 | +* Unless required by applicable law or agreed to in writing, software |
| 11 | +* distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +* See the License for the specific language governing permissions and |
| 14 | +* limitations under the License. |
| 15 | +* |
| 16 | +* SPDX-License-Identifier: Apache-2.0 |
| 17 | +*/ |
| 18 | + |
| 19 | +//! IPv4 in IPv4 tunnel. |
| 20 | +
|
| 21 | +use crate::ensure; |
| 22 | +use crate::packets::ethernet::Ethernet; |
| 23 | +use crate::packets::ip::v4::Ipv4; |
| 24 | +use crate::packets::ip::ProtocolNumbers; |
| 25 | +use crate::packets::{Datalink, Packet, Tunnel}; |
| 26 | +use anyhow::{anyhow, Result}; |
| 27 | +use std::marker::PhantomData; |
| 28 | + |
| 29 | +/// [IPv4] encapsulation within IPv4 based on [IETF RFC 2003]. |
| 30 | +/// |
| 31 | +/// IP in IP tunnel connects two separate IPv4 networks. an outer IP header |
| 32 | +/// is inserted before the datagram's existing IP header, as follows: |
| 33 | +/// |
| 34 | +/// +---------------------------+ |
| 35 | +/// | | |
| 36 | +/// | Outer IP Header | |
| 37 | +/// | | |
| 38 | +/// +---------------------------+ +---------------------------+ |
| 39 | +/// | | | | |
| 40 | +/// | IP Header | | IP Header | |
| 41 | +/// | | | | |
| 42 | +/// +---------------------------+ ====> +---------------------------+ |
| 43 | +/// | | | | |
| 44 | +/// | | | | |
| 45 | +/// | IP Payload | | IP Payload | |
| 46 | +/// | | | | |
| 47 | +/// | | | | |
| 48 | +/// +---------------------------+ +---------------------------+ |
| 49 | +/// |
| 50 | +/// This tunnel only supports unicast packets. |
| 51 | +/// |
| 52 | +/// [IPv4]: Ipv4 |
| 53 | +/// [IETF RFC 2003]: https://datatracker.ietf.org/doc/html/rfc2003 |
| 54 | +#[derive(Debug)] |
| 55 | +pub struct IpIp<E: Datalink = Ethernet> { |
| 56 | + _phantom: PhantomData<E>, |
| 57 | +} |
| 58 | + |
| 59 | +impl<E: Datalink> Tunnel for IpIp<E> { |
| 60 | + type Payload = Ipv4<E>; |
| 61 | + type Delivery = Ipv4<E>; |
| 62 | + |
| 63 | + /// Encapsulates the existing IPv4 packet by prepending an outer IPv4 |
| 64 | + /// packet. |
| 65 | + /// |
| 66 | + /// The DSCP and ECN options are copied from existing header to the new |
| 67 | + /// outer header. |
| 68 | + /// |
| 69 | + /// # Remarks |
| 70 | + /// |
| 71 | + /// If the 'don't fragment' flag is set to true on the outer header, it |
| 72 | + /// must not be unset. Otherwise, it may be set after tunnel encapsulation. |
| 73 | + /// |
| 74 | + /// # Errors |
| 75 | + /// |
| 76 | + /// Returns an error if the payload's time-to-live is `0`. The packet |
| 77 | + /// should be discarded. |
| 78 | + fn encap(payload: Self::Payload) -> Result<Self::Delivery> { |
| 79 | + ensure!(payload.ttl() != 0, anyhow!("payload's TTL is 0.")); |
| 80 | + |
| 81 | + let dscp = payload.dscp(); |
| 82 | + let ecn = payload.ecn(); |
| 83 | + let dont_fragment = payload.dont_fragment(); |
| 84 | + |
| 85 | + let envelope = payload.deparse(); |
| 86 | + let mut delivery = envelope.push::<Self::Delivery>()?; |
| 87 | + delivery.set_dscp(dscp); |
| 88 | + delivery.set_ecn(ecn); |
| 89 | + if dont_fragment { |
| 90 | + delivery.set_dont_fragment(); |
| 91 | + } |
| 92 | + delivery.set_protocol(ProtocolNumbers::Ipv4); |
| 93 | + delivery.reconcile_all(); |
| 94 | + |
| 95 | + Ok(delivery) |
| 96 | + } |
| 97 | + |
| 98 | + /// Decapsulates the outer IPv4 packet and returns the original payload |
| 99 | + /// IPv4 packet. |
| 100 | + /// |
| 101 | + /// # Errors |
| 102 | + /// |
| 103 | + /// Returns an error if the protocol is not set to `ProtocolNumbers::Ipv4`, |
| 104 | + /// indicating the packet is not from an IpIp tunnel. |
| 105 | + fn decap(delivery: Self::Delivery) -> Result<Self::Payload> { |
| 106 | + ensure!( |
| 107 | + delivery.protocol() == ProtocolNumbers::Ipv4, |
| 108 | + anyhow!("not an IPIP tunnel.") |
| 109 | + ); |
| 110 | + |
| 111 | + let envelope = delivery.remove()?; |
| 112 | + envelope.parse::<Self::Payload>() |
| 113 | + } |
| 114 | +} |
| 115 | + |
| 116 | +#[cfg(test)] |
| 117 | +mod tests { |
| 118 | + use super::*; |
| 119 | + use crate::packets::ethernet::Ethernet; |
| 120 | + use crate::packets::icmp::v4::EchoRequest; |
| 121 | + use crate::packets::Mbuf; |
| 122 | + use crate::testils::byte_arrays::IPIP_PACKET; |
| 123 | + |
| 124 | + #[capsule::test] |
| 125 | + fn encap_ipip_payload() { |
| 126 | + let packet = Mbuf::new().unwrap(); |
| 127 | + let ethernet = packet.push::<Ethernet>().unwrap(); |
| 128 | + let ip4 = ethernet.push::<Ipv4>().unwrap(); |
| 129 | + let mut ip4 = ip4.push::<EchoRequest>().unwrap().deparse(); |
| 130 | + ip4.set_dscp(5); |
| 131 | + ip4.set_ecn(1); |
| 132 | + ip4.set_dont_fragment(); |
| 133 | + ip4.reconcile(); |
| 134 | + let payload_len = ip4.len(); |
| 135 | + |
| 136 | + let delivery = ip4.encap::<IpIp>().unwrap(); |
| 137 | + assert_eq!(5, delivery.dscp()); |
| 138 | + assert_eq!(1, delivery.ecn()); |
| 139 | + assert!(delivery.dont_fragment()); |
| 140 | + assert_eq!(payload_len + 20, delivery.len()); |
| 141 | + } |
| 142 | + |
| 143 | + #[capsule::test] |
| 144 | + fn encap_0ttl_payload() { |
| 145 | + let packet = Mbuf::new().unwrap(); |
| 146 | + let ethernet = packet.push::<Ethernet>().unwrap(); |
| 147 | + let ip4 = ethernet.push::<Ipv4>().unwrap(); |
| 148 | + let mut ip4 = ip4.push::<EchoRequest>().unwrap().deparse(); |
| 149 | + ip4.set_ttl(0); |
| 150 | + ip4.reconcile(); |
| 151 | + |
| 152 | + assert!(ip4.encap::<IpIp>().is_err()); |
| 153 | + } |
| 154 | + |
| 155 | + #[capsule::test] |
| 156 | + fn decap_ipip_delivery() { |
| 157 | + let packet = Mbuf::from_bytes(&IPIP_PACKET).unwrap(); |
| 158 | + let ethernet = packet.parse::<Ethernet>().unwrap(); |
| 159 | + let delivery = ethernet.parse::<Ipv4>().unwrap(); |
| 160 | + let payload = delivery.decap::<IpIp>().unwrap(); |
| 161 | + |
| 162 | + assert_eq!("1.1.1.1", payload.src().to_string()); |
| 163 | + assert_eq!("2.2.2.2", payload.dst().to_string()); |
| 164 | + |
| 165 | + // parse the payload's payload to verify packet integrity |
| 166 | + assert!(payload.parse::<EchoRequest>().is_ok()); |
| 167 | + } |
| 168 | + |
| 169 | + #[capsule::test] |
| 170 | + fn decap_not_ipip() { |
| 171 | + let packet = Mbuf::new().unwrap(); |
| 172 | + let ethernet = packet.push::<Ethernet>().unwrap(); |
| 173 | + let ip4 = ethernet.push::<Ipv4>().unwrap(); |
| 174 | + let notipip = ip4.push::<EchoRequest>().unwrap().deparse(); |
| 175 | + |
| 176 | + // the protocol is icmpv4 not ipv4, not an ipip tunnel |
| 177 | + assert!(notipip.decap::<IpIp>().is_err()); |
| 178 | + } |
| 179 | +} |
0 commit comments