ip6_fastfwd.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  *
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer.
   11  * 2. Redistributions in binary form must reproduce the above copyright
   12  *    notice, this list of conditions and the following disclaimer in the
   13  *    documentation and/or other materials provided with the distribution.
   14  *
   15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   25  */
   26 
   27 #include <sys/cdefs.h>
   28 __FBSDID("$FreeBSD$");
   29 
   30 #include "opt_inet6.h"
   31 #include "opt_ipstealth.h"
   32 
   33 #include <sys/param.h>
   34 #include <sys/systm.h>
   35 #include <sys/mbuf.h>
   36 #include <sys/socket.h>
   37 #include <sys/kernel.h>
   38 #include <sys/sysctl.h>
   39 
   40 #include <net/if.h>
   41 #include <net/if_var.h>
   42 #include <net/route.h>
   43 #include <net/pfil.h>
   44 #include <net/vnet.h>
   45 
   46 #include <netinet/in.h>
   47 #include <netinet/in_kdtrace.h>
   48 #include <netinet/in_var.h>
   49 #include <netinet/ip_var.h>
   50 #include <netinet/ip6.h>
   51 #include <netinet/icmp6.h>
   52 #include <netinet6/in6_var.h>
   53 #include <netinet6/in6_fib.h>
   54 #include <netinet6/ip6_var.h>
   55 #include <netinet6/nd6.h>
   56 
   57 static int
   58 ip6_findroute(struct nhop6_basic *pnh, const struct sockaddr_in6 *dst,
   59     struct mbuf *m)
   60 {
   61 
   62         if (fib6_lookup_nh_basic(M_GETFIB(m), &dst->sin6_addr,
   63             dst->sin6_scope_id, 0, dst->sin6_flowinfo, pnh) != 0) {
   64                 IP6STAT_INC(ip6s_noroute);
   65                 IP6STAT_INC(ip6s_cantforward);
   66                 icmp6_error(m, ICMP6_DST_UNREACH,
   67                     ICMP6_DST_UNREACH_NOROUTE, 0);
   68                 return (EHOSTUNREACH);
   69         }
   70         if (pnh->nh_flags & NHF_BLACKHOLE) {
   71                 IP6STAT_INC(ip6s_cantforward);
   72                 m_freem(m);
   73                 return (EHOSTUNREACH);
   74         }
   75 
   76         if (pnh->nh_flags & NHF_REJECT) {
   77                 IP6STAT_INC(ip6s_cantforward);
   78                 icmp6_error(m, ICMP6_DST_UNREACH,
   79                     ICMP6_DST_UNREACH_REJECT, 0);
   80                 return (EHOSTUNREACH);
   81         }
   82         return (0);
   83 }
   84 
   85 struct mbuf*
   86 ip6_tryforward(struct mbuf *m)
   87 {
   88         struct sockaddr_in6 dst;
   89         struct nhop6_basic nh;
   90         struct m_tag *fwd_tag;
   91         struct ip6_hdr *ip6;
   92         struct ifnet *rcvif;
   93         uint32_t plen;
   94         int error;
   95 
   96         /*
   97          * Fallback conditions to ip6_input for slow path processing.
   98          */
   99         ip6 = mtod(m, struct ip6_hdr *);
  100         if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
  101             ip6->ip6_nxt == IPPROTO_HOPOPTS ||
  102             IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
  103             IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
  104             IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
  105             IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
  106             in6_localip(&ip6->ip6_dst))
  107                 return (m);
  108         /*
  109          * Check that the amount of data in the buffers
  110          * is as at least much as the IPv6 header would have us expect.
  111          * Trim mbufs if longer than we expect.
  112          * Drop packet if shorter than we expect.
  113          */
  114         rcvif = m->m_pkthdr.rcvif;
  115         plen = ntohs(ip6->ip6_plen);
  116         if (plen == 0) {
  117                 /*
  118                  * Jumbograms must have hop-by-hop header and go via
  119                  * slow path.
  120                  */
  121                 IP6STAT_INC(ip6s_badoptions);
  122                 goto dropin;
  123         }
  124         if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
  125                 IP6STAT_INC(ip6s_tooshort);
  126                 in6_ifstat_inc(rcvif, ifs6_in_truncated);
  127                 goto dropin;
  128         }
  129         if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
  130                 if (m->m_len == m->m_pkthdr.len) {
  131                         m->m_len = sizeof(struct ip6_hdr) + plen;
  132                         m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
  133                 } else
  134                         m_adj(m, sizeof(struct ip6_hdr) + plen -
  135                             m->m_pkthdr.len);
  136         }
  137 
  138         /*
  139          * Hop limit.
  140          */
  141 #ifdef IPSTEALTH
  142         if (!V_ip6stealth)
  143 #endif
  144         if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
  145                 icmp6_error(m, ICMP6_TIME_EXCEEDED,
  146                     ICMP6_TIME_EXCEED_TRANSIT, 0);
  147                 m = NULL;
  148                 goto dropin;
  149         }
  150 
  151         bzero(&dst, sizeof(dst));
  152         dst.sin6_family = AF_INET6;
  153         dst.sin6_len = sizeof(dst);
  154         dst.sin6_addr = ip6->ip6_dst;
  155 
  156         /*
  157          * Incoming packet firewall processing.
  158          */
  159         if (!PFIL_HOOKED(&V_inet6_pfil_hook))
  160                 goto passin;
  161         if (pfil_run_hooks(&V_inet6_pfil_hook, &m, rcvif, PFIL_IN, 0,
  162             NULL) != 0 || m == NULL)
  163                 goto dropin;
  164         /*
  165          * If packet filter sets the M_FASTFWD_OURS flag, this means
  166          * that new destination or next hop is our local address.
  167          * So, we can just go back to ip6_input.
  168          * XXX: should we decrement ip6_hlim in such case?
  169          *
  170          * Also it can forward packet to another destination, e.g.
  171          * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
  172          */
  173         if (m->m_flags & M_FASTFWD_OURS)
  174                 return (m);
  175 
  176         ip6 = mtod(m, struct ip6_hdr *);
  177         if ((m->m_flags & M_IP6_NEXTHOP) &&
  178             (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
  179                 /*
  180                  * Now we will find route to forwarded by pfil destination.
  181                  */
  182                 bcopy((fwd_tag + 1), &dst, sizeof(dst));
  183                 m->m_flags &= ~M_IP6_NEXTHOP;
  184                 m_tag_delete(m, fwd_tag);
  185         } else {
  186                 /* Update dst since pfil could change it */
  187                 dst.sin6_addr = ip6->ip6_dst;
  188         }
  189 passin:
  190         /*
  191          * Find route to destination.
  192          */
  193         if (ip6_findroute(&nh, &dst, m) != 0) {
  194                 m = NULL;
  195                 in6_ifstat_inc(rcvif, ifs6_in_noroute);
  196                 goto dropin;
  197         }
  198         if (!PFIL_HOOKED(&V_inet6_pfil_hook)) {
  199                 if (m->m_pkthdr.len > nh.nh_mtu) {
  200                         in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig);
  201                         icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu);
  202                         m = NULL;
  203                         goto dropout;
  204                 }
  205                 goto passout;
  206         }
  207 
  208         /*
  209          * Outgoing packet firewall processing.
  210          */
  211         if (pfil_run_hooks(&V_inet6_pfil_hook, &m, nh.nh_ifp, PFIL_OUT,
  212             PFIL_FWD, NULL) != 0 || m == NULL)
  213                 goto dropout;
  214 
  215         /*
  216          * We used slow path processing for packets with scoped addresses.
  217          * So, scope checks aren't needed here.
  218          */
  219         if (m->m_pkthdr.len > nh.nh_mtu) {
  220                 in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig);
  221                 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu);
  222                 m = NULL;
  223                 goto dropout;
  224         }
  225 
  226         /*
  227          * If packet filter sets the M_FASTFWD_OURS flag, this means
  228          * that new destination or next hop is our local address.
  229          * So, we can just go back to ip6_input.
  230          *
  231          * Also it can forward packet to another destination, e.g.
  232          * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
  233          */
  234         if (m->m_flags & M_FASTFWD_OURS) {
  235                 /*
  236                  * XXX: we did one hop and should decrement hop limit. But
  237                  * now we are the destination and just don't pay attention.
  238                  */
  239                 return (m);
  240         }
  241         /*
  242          * Again. A packet filter could change the destination address.
  243          */
  244         ip6 = mtod(m, struct ip6_hdr *);
  245         if (m->m_flags & M_IP6_NEXTHOP)
  246                 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
  247         else
  248                 fwd_tag = NULL;
  249 
  250         if (fwd_tag != NULL ||
  251             !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
  252                 if (fwd_tag != NULL) {
  253                         bcopy((fwd_tag + 1), &dst, sizeof(dst));
  254                         m->m_flags &= ~M_IP6_NEXTHOP;
  255                         m_tag_delete(m, fwd_tag);
  256                 } else
  257                         dst.sin6_addr = ip6->ip6_dst;
  258                 /*
  259                  * Redo route lookup with new destination address
  260                  */
  261                 if (ip6_findroute(&nh, &dst, m) != 0) {
  262                         m = NULL;
  263                         goto dropout;
  264                 }
  265         }
  266 passout:
  267 #ifdef IPSTEALTH
  268         if (!V_ip6stealth)
  269 #endif
  270         {
  271                 ip6->ip6_hlim -= IPV6_HLIMDEC;
  272         }
  273 
  274         m_clrprotoflags(m);     /* Avoid confusing lower layers. */
  275         IP_PROBE(send, NULL, NULL, ip6, nh.nh_ifp, NULL, ip6);
  276 
  277         /*
  278          * XXX: we need to use destination address with embedded scope
  279          * zone id, because LLTABLE uses such form of addresses for lookup.
  280          */
  281         dst.sin6_addr = nh.nh_addr;
  282         if (IN6_IS_SCOPE_LINKLOCAL(&dst.sin6_addr))
  283                 dst.sin6_addr.s6_addr16[1] = htons(nh.nh_ifp->if_index & 0xffff);
  284 
  285         error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m,
  286             (struct sockaddr *)&dst, NULL);
  287         if (error != 0) {
  288                 in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
  289                 IP6STAT_INC(ip6s_cantforward);
  290         } else {
  291                 in6_ifstat_inc(nh.nh_ifp, ifs6_out_forward);
  292                 IP6STAT_INC(ip6s_forward);
  293         }
  294         return (NULL);
  295 dropin:
  296         in6_ifstat_inc(rcvif, ifs6_in_discard);
  297         goto drop;
  298 dropout:
  299         in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
  300 drop:
  301         if (m != NULL)
  302                 m_freem(m);
  303         return (NULL);
  304 }
  305
Cache object: 729bc3b996be5a712221a6242a69f5cc
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netinet6/ip6_fastfwd.c

FreeBSD/Linux Kernel Cross Reference
sys/netinet6/ip6_fastfwd.c
