ip_fastfwd.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * SPDX-License-Identifier: BSD-3-Clause
    3  *
    4  * Copyright (c) 2003 Andre Oppermann, Internet Business Solutions AG
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  * 3. The name of the author may not be used to endorse or promote
   16  *    products derived from this software without specific prior written
   17  *    permission.
   18  *
   19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   29  * SUCH DAMAGE.
   30  */
   31 
   32 /*
   33  * ip_fastforward gets its speed from processing the forwarded packet to
   34  * completion (if_output on the other side) without any queues or netisr's.
   35  * The receiving interface DMAs the packet into memory, the upper half of
   36  * driver calls ip_fastforward, we do our routing table lookup and directly
   37  * send it off to the outgoing interface, which DMAs the packet to the
   38  * network card. The only part of the packet we touch with the CPU is the
   39  * IP header (unless there are complex firewall rules touching other parts
   40  * of the packet, but that is up to you). We are essentially limited by bus
   41  * bandwidth and how fast the network card/driver can set up receives and
   42  * transmits.
   43  *
   44  * We handle basic errors, IP header errors, checksum errors,
   45  * destination unreachable, fragmentation and fragmentation needed and
   46  * report them via ICMP to the sender.
   47  *
   48  * Else if something is not pure IPv4 unicast forwarding we fall back to
   49  * the normal ip_input processing path. We should only be called from
   50  * interfaces connected to the outside world.
   51  *
   52  * Firewalling is fully supported including divert, ipfw fwd and ipfilter
   53  * ipnat and address rewrite.
   54  *
   55  * IPSEC is not supported if this host is a tunnel broker. IPSEC is
   56  * supported for connections to/from local host.
   57  *
   58  * We try to do the least expensive (in CPU ops) checks and operations
   59  * first to catch junk with as little overhead as possible.
   60  * 
   61  * We take full advantage of hardware support for IP checksum and
   62  * fragmentation offloading.
   63  *
   64  * We don't do ICMP redirect in the fast forwarding path. I have had my own
   65  * cases where two core routers with Zebra routing suite would send millions
   66  * ICMP redirects to connected hosts if the destination router was not the
   67  * default gateway. In one case it was filling the routing table of a host
   68  * with approximately 300.000 cloned redirect entries until it ran out of
   69  * kernel memory. However the networking code proved very robust and it didn't
   70  * crash or fail in other ways.
   71  */
   72 
   73 /*
   74  * Many thanks to Matt Thomas of NetBSD for basic structure of ip_flow.c which
   75  * is being followed here.
   76  */
   77 
   78 #include <sys/cdefs.h>
   79 __FBSDID("$FreeBSD: releng/12.0/sys/netinet/ip_fastfwd.c 338468 2018-09-05 13:59:36Z eugen $");
   80 
   81 #include "opt_ipstealth.h"
   82 
   83 #include <sys/param.h>
   84 #include <sys/systm.h>
   85 #include <sys/kernel.h>
   86 #include <sys/malloc.h>
   87 #include <sys/mbuf.h>
   88 #include <sys/protosw.h>
   89 #include <sys/sdt.h>
   90 #include <sys/socket.h>
   91 #include <sys/sysctl.h>
   92 
   93 #include <net/pfil.h>
   94 #include <net/if.h>
   95 #include <net/if_types.h>
   96 #include <net/if_var.h>
   97 #include <net/if_dl.h>
   98 #include <net/route.h>
   99 #include <net/vnet.h>
  100 
  101 #include <netinet/in.h>
  102 #include <netinet/in_fib.h>
  103 #include <netinet/in_kdtrace.h>
  104 #include <netinet/in_systm.h>
  105 #include <netinet/in_var.h>
  106 #include <netinet/ip.h>
  107 #include <netinet/ip_var.h>
  108 #include <netinet/ip_icmp.h>
  109 #include <netinet/ip_options.h>
  110 
  111 #include <machine/in_cksum.h>
  112 
  113 static int
  114 ip_findroute(struct nhop4_basic *pnh, struct in_addr dest, struct mbuf *m)
  115 {
  116 
  117         bzero(pnh, sizeof(*pnh));
  118         if (fib4_lookup_nh_basic(M_GETFIB(m), dest, 0, 0, pnh) != 0) {
  119                 IPSTAT_INC(ips_noroute);
  120                 IPSTAT_INC(ips_cantforward);
  121                 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
  122                 return (EHOSTUNREACH);
  123         }
  124         /*
  125          * Drop blackholed traffic and directed broadcasts.
  126          */
  127         if ((pnh->nh_flags & (NHF_BLACKHOLE | NHF_BROADCAST)) != 0) {
  128                 IPSTAT_INC(ips_cantforward);
  129                 m_freem(m);
  130                 return (EHOSTUNREACH);
  131         }
  132 
  133         if (pnh->nh_flags & NHF_REJECT) {
  134                 IPSTAT_INC(ips_cantforward);
  135                 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0);
  136                 return (EHOSTUNREACH);
  137         }
  138 
  139         return (0);
  140 }
  141 
  142 /*
  143  * Try to forward a packet based on the destination address.
  144  * This is a fast path optimized for the plain forwarding case.
  145  * If the packet is handled (and consumed) here then we return NULL;
  146  * otherwise mbuf is returned and the packet should be delivered
  147  * to ip_input for full processing.
  148  */
  149 struct mbuf *
  150 ip_tryforward(struct mbuf *m)
  151 {
  152         struct ip *ip;
  153         struct mbuf *m0 = NULL;
  154         struct nhop4_basic nh;
  155         struct sockaddr_in dst;
  156         struct in_addr dest, odest, rtdest;
  157         uint16_t ip_len, ip_off;
  158         int error = 0;
  159         struct m_tag *fwd_tag = NULL;
  160 
  161         /*
  162          * Are we active and forwarding packets?
  163          */
  164 
  165         M_ASSERTVALID(m);
  166         M_ASSERTPKTHDR(m);
  167 
  168 #ifdef ALTQ
  169         /*
  170          * Is packet dropped by traffic conditioner?
  171          */
  172         if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0)
  173                 goto drop;
  174 #endif
  175 
  176         /*
  177          * Only IP packets without options
  178          */
  179         ip = mtod(m, struct ip *);
  180 
  181         if (ip->ip_hl != (sizeof(struct ip) >> 2)) {
  182                 if (V_ip_doopts == 1)
  183                         return m;
  184                 else if (V_ip_doopts == 2) {
  185                         icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB,
  186                                 0, 0);
  187                         return NULL;    /* mbuf already free'd */
  188                 }
  189                 /* else ignore IP options and continue */
  190         }
  191 
  192         /*
  193          * Only unicast IP, not from loopback, no L2 or IP broadcast,
  194          * no multicast, no INADDR_ANY
  195          *
  196          * XXX: Probably some of these checks could be direct drop
  197          * conditions.  However it is not clear whether there are some
  198          * hacks or obscure behaviours which make it necessary to
  199          * let ip_input handle it.  We play safe here and let ip_input
  200          * deal with it until it is proven that we can directly drop it.
  201          */
  202         if ((m->m_flags & (M_BCAST|M_MCAST)) ||
  203             (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) ||
  204             ntohl(ip->ip_src.s_addr) == (u_long)INADDR_BROADCAST ||
  205             ntohl(ip->ip_dst.s_addr) == (u_long)INADDR_BROADCAST ||
  206             IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
  207             IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
  208             IN_LINKLOCAL(ntohl(ip->ip_src.s_addr)) ||
  209             IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr)) ||
  210             ip->ip_src.s_addr == INADDR_ANY ||
  211             ip->ip_dst.s_addr == INADDR_ANY )
  212                 return m;
  213 
  214         /*
  215          * Is it for a local address on this host?
  216          */
  217         if (in_localip(ip->ip_dst))
  218                 return m;
  219 
  220         IPSTAT_INC(ips_total);
  221 
  222         /*
  223          * Step 3: incoming packet firewall processing
  224          */
  225 
  226         odest.s_addr = dest.s_addr = ip->ip_dst.s_addr;
  227 
  228         /*
  229          * Run through list of ipfilter hooks for input packets
  230          */
  231         if (!PFIL_HOOKED(&V_inet_pfil_hook))
  232                 goto passin;
  233 
  234         if (pfil_run_hooks(
  235             &V_inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN, 0, NULL) ||
  236             m == NULL)
  237                 goto drop;
  238 
  239         M_ASSERTVALID(m);
  240         M_ASSERTPKTHDR(m);
  241 
  242         ip = mtod(m, struct ip *);      /* m may have changed by pfil hook */
  243         dest.s_addr = ip->ip_dst.s_addr;
  244 
  245         /*
  246          * Destination address changed?
  247          */
  248         if (odest.s_addr != dest.s_addr) {
  249                 /*
  250                  * Is it now for a local address on this host?
  251                  */
  252                 if (in_localip(dest))
  253                         goto forwardlocal;
  254                 /*
  255                  * Go on with new destination address
  256                  */
  257         }
  258 
  259         if (m->m_flags & M_FASTFWD_OURS) {
  260                 /*
  261                  * ipfw changed it for a local address on this host.
  262                  */
  263                 goto forwardlocal;
  264         }
  265 
  266 passin:
  267         /*
  268          * Step 4: decrement TTL and look up route
  269          */
  270 
  271         /*
  272          * Check TTL
  273          */
  274 #ifdef IPSTEALTH
  275         if (!V_ipstealth) {
  276 #endif
  277         if (ip->ip_ttl <= IPTTLDEC) {
  278                 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, 0);
  279                 return NULL;    /* mbuf already free'd */
  280         }
  281 
  282         /*
  283          * Decrement the TTL and incrementally change the IP header checksum.
  284          * Don't bother doing this with hw checksum offloading, it's faster
  285          * doing it right here.
  286          */
  287         ip->ip_ttl -= IPTTLDEC;
  288         if (ip->ip_sum >= (u_int16_t) ~htons(IPTTLDEC << 8))
  289                 ip->ip_sum -= ~htons(IPTTLDEC << 8);
  290         else
  291                 ip->ip_sum += htons(IPTTLDEC << 8);
  292 #ifdef IPSTEALTH
  293         }
  294 #endif
  295 
  296         /*
  297          * Next hop forced by pfil(9) hook?
  298          */
  299         if ((m->m_flags & M_IP_NEXTHOP) &&
  300             ((fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL)) {
  301                 /*
  302                  * Now we will find route to forced destination.
  303                  */
  304                 dest.s_addr = ((struct sockaddr_in *)
  305                             (fwd_tag + 1))->sin_addr.s_addr;
  306                 m_tag_delete(m, fwd_tag);
  307                 m->m_flags &= ~M_IP_NEXTHOP;
  308         }
  309 
  310         /*
  311          * Find route to destination.
  312          */
  313         if (ip_findroute(&nh, dest, m) != 0)
  314                 return (NULL);  /* icmp unreach already sent */
  315 
  316         /*
  317          * Avoid second route lookup by caching destination.
  318          */
  319         rtdest.s_addr = dest.s_addr;
  320 
  321         /*
  322          * Step 5: outgoing firewall packet processing
  323          */
  324         if (!PFIL_HOOKED(&V_inet_pfil_hook))
  325                 goto passout;
  326 
  327         if (pfil_run_hooks(&V_inet_pfil_hook, &m, nh.nh_ifp, PFIL_OUT, PFIL_FWD,
  328             NULL) || m == NULL) {
  329                 goto drop;
  330         }
  331 
  332         M_ASSERTVALID(m);
  333         M_ASSERTPKTHDR(m);
  334 
  335         ip = mtod(m, struct ip *);
  336         dest.s_addr = ip->ip_dst.s_addr;
  337 
  338         /*
  339          * Destination address changed?
  340          */
  341         if (m->m_flags & M_IP_NEXTHOP)
  342                 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
  343         else
  344                 fwd_tag = NULL;
  345         if (odest.s_addr != dest.s_addr || fwd_tag != NULL) {
  346                 /*
  347                  * Is it now for a local address on this host?
  348                  */
  349                 if (m->m_flags & M_FASTFWD_OURS || in_localip(dest)) {
  350 forwardlocal:
  351                         /*
  352                          * Return packet for processing by ip_input().
  353                          */
  354                         m->m_flags |= M_FASTFWD_OURS;
  355                         return (m);
  356                 }
  357                 /*
  358                  * Redo route lookup with new destination address
  359                  */
  360                 if (fwd_tag) {
  361                         dest.s_addr = ((struct sockaddr_in *)
  362                                     (fwd_tag + 1))->sin_addr.s_addr;
  363                         m_tag_delete(m, fwd_tag);
  364                         m->m_flags &= ~M_IP_NEXTHOP;
  365                 }
  366                 if (dest.s_addr != rtdest.s_addr &&
  367                     ip_findroute(&nh, dest, m) != 0)
  368                         return (NULL);  /* icmp unreach already sent */
  369         }
  370 
  371 passout:
  372         /*
  373          * Step 6: send off the packet
  374          */
  375         ip_len = ntohs(ip->ip_len);
  376         ip_off = ntohs(ip->ip_off);
  377 
  378         bzero(&dst, sizeof(dst));
  379         dst.sin_family = AF_INET;
  380         dst.sin_len = sizeof(dst);
  381         dst.sin_addr = nh.nh_addr;
  382 
  383         /*
  384          * Check if packet fits MTU or if hardware will fragment for us
  385          */
  386         if (ip_len <= nh.nh_mtu) {
  387                 /*
  388                  * Avoid confusing lower layers.
  389                  */
  390                 m_clrprotoflags(m);
  391                 /*
  392                  * Send off the packet via outgoing interface
  393                  */
  394                 IP_PROBE(send, NULL, NULL, ip, nh.nh_ifp, ip, NULL);
  395                 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m,
  396                     (struct sockaddr *)&dst, NULL);
  397         } else {
  398                 /*
  399                  * Handle EMSGSIZE with icmp reply needfrag for TCP MTU discovery
  400                  */
  401                 if (ip_off & IP_DF) {
  402                         IPSTAT_INC(ips_cantfrag);
  403                         icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG,
  404                                 0, nh.nh_mtu);
  405                         goto consumed;
  406                 } else {
  407                         /*
  408                          * We have to fragment the packet
  409                          */
  410                         m->m_pkthdr.csum_flags |= CSUM_IP;
  411                         if (ip_fragment(ip, &m, nh.nh_mtu,
  412                             nh.nh_ifp->if_hwassist) != 0)
  413                                 goto drop;
  414                         KASSERT(m != NULL, ("null mbuf and no error"));
  415                         /*
  416                          * Send off the fragments via outgoing interface
  417                          */
  418                         error = 0;
  419                         do {
  420                                 m0 = m->m_nextpkt;
  421                                 m->m_nextpkt = NULL;
  422                                 /*
  423                                  * Avoid confusing lower layers.
  424                                  */
  425                                 m_clrprotoflags(m);
  426 
  427                                 IP_PROBE(send, NULL, NULL,
  428                                     mtod(m, struct ip *), nh.nh_ifp,
  429                                     mtod(m, struct ip *), NULL);
  430                                 /* XXX: we can use cached route here */
  431                                 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m,
  432                                     (struct sockaddr *)&dst, NULL);
  433                                 if (error)
  434                                         break;
  435                         } while ((m = m0) != NULL);
  436                         if (error) {
  437                                 /* Reclaim remaining fragments */
  438                                 for (m = m0; m; m = m0) {
  439                                         m0 = m->m_nextpkt;
  440                                         m_freem(m);
  441                                 }
  442                         } else
  443                                 IPSTAT_INC(ips_fragmented);
  444                 }
  445         }
  446 
  447         if (error != 0)
  448                 IPSTAT_INC(ips_odropped);
  449         else {
  450                 IPSTAT_INC(ips_forward);
  451                 IPSTAT_INC(ips_fastforward);
  452         }
  453 consumed:
  454         return NULL;
  455 drop:
  456         if (m)
  457                 m_freem(m);
  458         return NULL;
  459 }
Cache object: f93c85ce92e560667994359561cff4b9
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netinet/ip_fastfwd.c

FreeBSD/Linux Kernel Cross Reference
sys/netinet/ip_fastfwd.c
