1 /*-
2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD: releng/12.0/sys/netinet6/ip6_fastfwd.c 333186 2018-05-02 22:11:16Z tuexen $");
29
30 #include "opt_inet6.h"
31 #include "opt_ipstealth.h"
32
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/mbuf.h>
36 #include <sys/socket.h>
37 #include <sys/kernel.h>
38 #include <sys/sysctl.h>
39
40 #include <net/if.h>
41 #include <net/if_var.h>
42 #include <net/route.h>
43 #include <net/pfil.h>
44 #include <net/vnet.h>
45
46 #include <netinet/in.h>
47 #include <netinet/in_kdtrace.h>
48 #include <netinet/in_var.h>
49 #include <netinet/ip_var.h>
50 #include <netinet/ip6.h>
51 #include <netinet/icmp6.h>
52 #include <netinet6/in6_var.h>
53 #include <netinet6/in6_fib.h>
54 #include <netinet6/ip6_var.h>
55 #include <netinet6/nd6.h>
56
57 static int
58 ip6_findroute(struct nhop6_basic *pnh, const struct sockaddr_in6 *dst,
59 struct mbuf *m)
60 {
61
62 if (fib6_lookup_nh_basic(M_GETFIB(m), &dst->sin6_addr,
63 dst->sin6_scope_id, 0, dst->sin6_flowinfo, pnh) != 0) {
64 IP6STAT_INC(ip6s_noroute);
65 IP6STAT_INC(ip6s_cantforward);
66 icmp6_error(m, ICMP6_DST_UNREACH,
67 ICMP6_DST_UNREACH_NOROUTE, 0);
68 return (EHOSTUNREACH);
69 }
70 if (pnh->nh_flags & NHF_BLACKHOLE) {
71 IP6STAT_INC(ip6s_cantforward);
72 m_freem(m);
73 return (EHOSTUNREACH);
74 }
75
76 if (pnh->nh_flags & NHF_REJECT) {
77 IP6STAT_INC(ip6s_cantforward);
78 icmp6_error(m, ICMP6_DST_UNREACH,
79 ICMP6_DST_UNREACH_REJECT, 0);
80 return (EHOSTUNREACH);
81 }
82 return (0);
83 }
84
85 struct mbuf*
86 ip6_tryforward(struct mbuf *m)
87 {
88 struct sockaddr_in6 dst;
89 struct nhop6_basic nh;
90 struct m_tag *fwd_tag;
91 struct ip6_hdr *ip6;
92 struct ifnet *rcvif;
93 uint32_t plen;
94 int error;
95
96 /*
97 * Fallback conditions to ip6_input for slow path processing.
98 */
99 ip6 = mtod(m, struct ip6_hdr *);
100 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
101 ip6->ip6_nxt == IPPROTO_HOPOPTS ||
102 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
103 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
104 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
105 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
106 in6_localip(&ip6->ip6_dst))
107 return (m);
108 /*
109 * Check that the amount of data in the buffers
110 * is as at least much as the IPv6 header would have us expect.
111 * Trim mbufs if longer than we expect.
112 * Drop packet if shorter than we expect.
113 */
114 rcvif = m->m_pkthdr.rcvif;
115 plen = ntohs(ip6->ip6_plen);
116 if (plen == 0) {
117 /*
118 * Jumbograms must have hop-by-hop header and go via
119 * slow path.
120 */
121 IP6STAT_INC(ip6s_badoptions);
122 goto dropin;
123 }
124 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
125 IP6STAT_INC(ip6s_tooshort);
126 in6_ifstat_inc(rcvif, ifs6_in_truncated);
127 goto dropin;
128 }
129 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
130 if (m->m_len == m->m_pkthdr.len) {
131 m->m_len = sizeof(struct ip6_hdr) + plen;
132 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
133 } else
134 m_adj(m, sizeof(struct ip6_hdr) + plen -
135 m->m_pkthdr.len);
136 }
137
138 /*
139 * Hop limit.
140 */
141 #ifdef IPSTEALTH
142 if (!V_ip6stealth)
143 #endif
144 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
145 icmp6_error(m, ICMP6_TIME_EXCEEDED,
146 ICMP6_TIME_EXCEED_TRANSIT, 0);
147 m = NULL;
148 goto dropin;
149 }
150
151 bzero(&dst, sizeof(dst));
152 dst.sin6_family = AF_INET6;
153 dst.sin6_len = sizeof(dst);
154 dst.sin6_addr = ip6->ip6_dst;
155
156 /*
157 * Incoming packet firewall processing.
158 */
159 if (!PFIL_HOOKED(&V_inet6_pfil_hook))
160 goto passin;
161 if (pfil_run_hooks(&V_inet6_pfil_hook, &m, rcvif, PFIL_IN, 0,
162 NULL) != 0 || m == NULL)
163 goto dropin;
164 /*
165 * If packet filter sets the M_FASTFWD_OURS flag, this means
166 * that new destination or next hop is our local address.
167 * So, we can just go back to ip6_input.
168 * XXX: should we decrement ip6_hlim in such case?
169 *
170 * Also it can forward packet to another destination, e.g.
171 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
172 */
173 if (m->m_flags & M_FASTFWD_OURS)
174 return (m);
175
176 ip6 = mtod(m, struct ip6_hdr *);
177 if ((m->m_flags & M_IP6_NEXTHOP) &&
178 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
179 /*
180 * Now we will find route to forwarded by pfil destination.
181 */
182 bcopy((fwd_tag + 1), &dst, sizeof(dst));
183 m->m_flags &= ~M_IP6_NEXTHOP;
184 m_tag_delete(m, fwd_tag);
185 } else {
186 /* Update dst since pfil could change it */
187 dst.sin6_addr = ip6->ip6_dst;
188 }
189 passin:
190 /*
191 * Find route to destination.
192 */
193 if (ip6_findroute(&nh, &dst, m) != 0) {
194 m = NULL;
195 in6_ifstat_inc(rcvif, ifs6_in_noroute);
196 goto dropin;
197 }
198 if (!PFIL_HOOKED(&V_inet6_pfil_hook)) {
199 if (m->m_pkthdr.len > nh.nh_mtu) {
200 in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig);
201 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu);
202 m = NULL;
203 goto dropout;
204 }
205 goto passout;
206 }
207
208 /*
209 * Outgoing packet firewall processing.
210 */
211 if (pfil_run_hooks(&V_inet6_pfil_hook, &m, nh.nh_ifp, PFIL_OUT,
212 PFIL_FWD, NULL) != 0 || m == NULL)
213 goto dropout;
214
215 /*
216 * We used slow path processing for packets with scoped addresses.
217 * So, scope checks aren't needed here.
218 */
219 if (m->m_pkthdr.len > nh.nh_mtu) {
220 in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig);
221 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu);
222 m = NULL;
223 goto dropout;
224 }
225
226 /*
227 * If packet filter sets the M_FASTFWD_OURS flag, this means
228 * that new destination or next hop is our local address.
229 * So, we can just go back to ip6_input.
230 *
231 * Also it can forward packet to another destination, e.g.
232 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
233 */
234 if (m->m_flags & M_FASTFWD_OURS) {
235 /*
236 * XXX: we did one hop and should decrement hop limit. But
237 * now we are the destination and just don't pay attention.
238 */
239 return (m);
240 }
241 /*
242 * Again. A packet filter could change the destination address.
243 */
244 ip6 = mtod(m, struct ip6_hdr *);
245 if (m->m_flags & M_IP6_NEXTHOP)
246 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
247 else
248 fwd_tag = NULL;
249
250 if (fwd_tag != NULL ||
251 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
252 if (fwd_tag != NULL) {
253 bcopy((fwd_tag + 1), &dst, sizeof(dst));
254 m->m_flags &= ~M_IP6_NEXTHOP;
255 m_tag_delete(m, fwd_tag);
256 } else
257 dst.sin6_addr = ip6->ip6_dst;
258 /*
259 * Redo route lookup with new destination address
260 */
261 if (ip6_findroute(&nh, &dst, m) != 0) {
262 m = NULL;
263 goto dropout;
264 }
265 }
266 passout:
267 #ifdef IPSTEALTH
268 if (!V_ip6stealth)
269 #endif
270 {
271 ip6->ip6_hlim -= IPV6_HLIMDEC;
272 }
273
274 m_clrprotoflags(m); /* Avoid confusing lower layers. */
275 IP_PROBE(send, NULL, NULL, ip6, nh.nh_ifp, NULL, ip6);
276
277 /*
278 * XXX: we need to use destination address with embedded scope
279 * zone id, because LLTABLE uses such form of addresses for lookup.
280 */
281 dst.sin6_addr = nh.nh_addr;
282 if (IN6_IS_SCOPE_LINKLOCAL(&dst.sin6_addr))
283 dst.sin6_addr.s6_addr16[1] = htons(nh.nh_ifp->if_index & 0xffff);
284
285 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m,
286 (struct sockaddr *)&dst, NULL);
287 if (error != 0) {
288 in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
289 IP6STAT_INC(ip6s_cantforward);
290 } else {
291 in6_ifstat_inc(nh.nh_ifp, ifs6_out_forward);
292 IP6STAT_INC(ip6s_forward);
293 }
294 return (NULL);
295 dropin:
296 in6_ifstat_inc(rcvif, ifs6_in_discard);
297 goto drop;
298 dropout:
299 in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
300 drop:
301 if (m != NULL)
302 m_freem(m);
303 return (NULL);
304 }
305
Cache object: 1cb07a7cf14612bc1cf690b551f828c5
|