1 /*-
2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29
30 #include "opt_inet6.h"
31 #include "opt_ipstealth.h"
32
33 #include <sys/param.h>
34 #include <sys/systm.h>
35 #include <sys/mbuf.h>
36 #include <sys/socket.h>
37 #include <sys/kernel.h>
38 #include <sys/sysctl.h>
39
40 #include <net/if.h>
41 #include <net/if_var.h>
42 #include <net/route.h>
43 #include <net/route/nhop.h>
44 #include <net/pfil.h>
45 #include <net/vnet.h>
46
47 #include <netinet/in.h>
48 #include <netinet/in_kdtrace.h>
49 #include <netinet/in_var.h>
50 #include <netinet/ip_var.h>
51 #include <netinet/ip6.h>
52 #include <netinet/icmp6.h>
53 #include <netinet6/in6_var.h>
54 #include <netinet6/in6_fib.h>
55 #include <netinet6/ip6_var.h>
56 #include <netinet6/nd6.h>
57
58 static int
59 ip6_findroute(struct nhop_object **pnh, const struct sockaddr_in6 *dst,
60 struct mbuf *m)
61 {
62 struct nhop_object *nh;
63
64 nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr,
65 dst->sin6_scope_id, NHR_NONE, m->m_pkthdr.flowid);
66 if (nh == NULL) {
67 IP6STAT_INC(ip6s_noroute);
68 IP6STAT_INC(ip6s_cantforward);
69 icmp6_error(m, ICMP6_DST_UNREACH,
70 ICMP6_DST_UNREACH_NOROUTE, 0);
71 return (EHOSTUNREACH);
72 }
73 if (nh->nh_flags & NHF_BLACKHOLE) {
74 IP6STAT_INC(ip6s_cantforward);
75 m_freem(m);
76 return (EHOSTUNREACH);
77 }
78
79 if (nh->nh_flags & NHF_REJECT) {
80 IP6STAT_INC(ip6s_cantforward);
81 icmp6_error(m, ICMP6_DST_UNREACH,
82 ICMP6_DST_UNREACH_REJECT, 0);
83 return (EHOSTUNREACH);
84 }
85
86 *pnh = nh;
87
88 return (0);
89 }
90
91 struct mbuf*
92 ip6_tryforward(struct mbuf *m)
93 {
94 struct sockaddr_in6 dst;
95 struct nhop_object *nh;
96 struct m_tag *fwd_tag;
97 struct ip6_hdr *ip6;
98 struct ifnet *rcvif;
99 uint32_t plen;
100 int error;
101
102 /*
103 * Fallback conditions to ip6_input for slow path processing.
104 */
105 ip6 = mtod(m, struct ip6_hdr *);
106 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
107 ip6->ip6_nxt == IPPROTO_HOPOPTS ||
108 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
109 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
110 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
111 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
112 in6_localip(&ip6->ip6_dst))
113 return (m);
114 /*
115 * Check that the amount of data in the buffers
116 * is as at least much as the IPv6 header would have us expect.
117 * Trim mbufs if longer than we expect.
118 * Drop packet if shorter than we expect.
119 */
120 rcvif = m->m_pkthdr.rcvif;
121 plen = ntohs(ip6->ip6_plen);
122 if (plen == 0) {
123 /*
124 * Jumbograms must have hop-by-hop header and go via
125 * slow path.
126 */
127 IP6STAT_INC(ip6s_badoptions);
128 goto dropin;
129 }
130 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
131 IP6STAT_INC(ip6s_tooshort);
132 in6_ifstat_inc(rcvif, ifs6_in_truncated);
133 goto dropin;
134 }
135 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
136 if (m->m_len == m->m_pkthdr.len) {
137 m->m_len = sizeof(struct ip6_hdr) + plen;
138 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
139 } else
140 m_adj(m, sizeof(struct ip6_hdr) + plen -
141 m->m_pkthdr.len);
142 }
143
144 /*
145 * Hop limit.
146 */
147 #ifdef IPSTEALTH
148 if (!V_ip6stealth)
149 #endif
150 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
151 icmp6_error(m, ICMP6_TIME_EXCEEDED,
152 ICMP6_TIME_EXCEED_TRANSIT, 0);
153 m = NULL;
154 goto dropin;
155 }
156
157 bzero(&dst, sizeof(dst));
158 dst.sin6_family = AF_INET6;
159 dst.sin6_len = sizeof(dst);
160 dst.sin6_addr = ip6->ip6_dst;
161
162 /*
163 * Incoming packet firewall processing.
164 */
165 if (!PFIL_HOOKED_IN(V_inet6_pfil_head))
166 goto passin;
167 if (pfil_run_hooks(V_inet6_pfil_head, &m, rcvif, PFIL_IN, NULL) !=
168 PFIL_PASS)
169 goto dropin;
170 /*
171 * If packet filter sets the M_FASTFWD_OURS flag, this means
172 * that new destination or next hop is our local address.
173 * So, we can just go back to ip6_input.
174 * XXX: should we decrement ip6_hlim in such case?
175 *
176 * Also it can forward packet to another destination, e.g.
177 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
178 */
179 if (m->m_flags & M_FASTFWD_OURS)
180 return (m);
181
182 ip6 = mtod(m, struct ip6_hdr *);
183 if ((m->m_flags & M_IP6_NEXTHOP) &&
184 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
185 /*
186 * Now we will find route to forwarded by pfil destination.
187 */
188 bcopy((fwd_tag + 1), &dst, sizeof(dst));
189 m->m_flags &= ~M_IP6_NEXTHOP;
190 m_tag_delete(m, fwd_tag);
191 } else {
192 /* Update dst since pfil could change it */
193 dst.sin6_addr = ip6->ip6_dst;
194 }
195 passin:
196 /*
197 * Find route to destination.
198 */
199 if (ip6_findroute(&nh, &dst, m) != 0) {
200 m = NULL;
201 in6_ifstat_inc(rcvif, ifs6_in_noroute);
202 goto dropin;
203 }
204 if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) {
205 if (m->m_pkthdr.len > nh->nh_mtu) {
206 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
207 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
208 m = NULL;
209 goto dropout;
210 }
211 goto passout;
212 }
213
214 /*
215 * Outgoing packet firewall processing.
216 */
217 if (pfil_run_hooks(V_inet6_pfil_head, &m, nh->nh_ifp, PFIL_OUT |
218 PFIL_FWD, NULL) != PFIL_PASS)
219 goto dropout;
220
221 /*
222 * We used slow path processing for packets with scoped addresses.
223 * So, scope checks aren't needed here.
224 */
225 if (m->m_pkthdr.len > nh->nh_mtu) {
226 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
227 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
228 m = NULL;
229 goto dropout;
230 }
231
232 /*
233 * If packet filter sets the M_FASTFWD_OURS flag, this means
234 * that new destination or next hop is our local address.
235 * So, we can just go back to ip6_input.
236 *
237 * Also it can forward packet to another destination, e.g.
238 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
239 */
240 if (m->m_flags & M_FASTFWD_OURS) {
241 /*
242 * XXX: we did one hop and should decrement hop limit. But
243 * now we are the destination and just don't pay attention.
244 */
245 return (m);
246 }
247 /*
248 * Again. A packet filter could change the destination address.
249 */
250 ip6 = mtod(m, struct ip6_hdr *);
251 if (m->m_flags & M_IP6_NEXTHOP)
252 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
253 else
254 fwd_tag = NULL;
255
256 if (fwd_tag != NULL ||
257 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
258 if (fwd_tag != NULL) {
259 bcopy((fwd_tag + 1), &dst, sizeof(dst));
260 m->m_flags &= ~M_IP6_NEXTHOP;
261 m_tag_delete(m, fwd_tag);
262 } else
263 dst.sin6_addr = ip6->ip6_dst;
264 /*
265 * Redo route lookup with new destination address
266 */
267 if (ip6_findroute(&nh, &dst, m) != 0) {
268 m = NULL;
269 goto dropout;
270 }
271 }
272 passout:
273 #ifdef IPSTEALTH
274 if (!V_ip6stealth)
275 #endif
276 {
277 ip6->ip6_hlim -= IPV6_HLIMDEC;
278 }
279
280 m_clrprotoflags(m); /* Avoid confusing lower layers. */
281 IP_PROBE(send, NULL, NULL, ip6, nh->nh_ifp, NULL, ip6);
282
283 if (nh->nh_flags & NHF_GATEWAY)
284 dst.sin6_addr = nh->gw6_sa.sin6_addr;
285 error = (*nh->nh_ifp->if_output)(nh->nh_ifp, m,
286 (struct sockaddr *)&dst, NULL);
287 if (error != 0) {
288 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
289 IP6STAT_INC(ip6s_cantforward);
290 } else {
291 in6_ifstat_inc(nh->nh_ifp, ifs6_out_forward);
292 IP6STAT_INC(ip6s_forward);
293 }
294 return (NULL);
295 dropin:
296 in6_ifstat_inc(rcvif, ifs6_in_discard);
297 goto drop;
298 dropout:
299 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
300 drop:
301 if (m != NULL)
302 m_freem(m);
303 return (NULL);
304 }
Cache object: 4e4722143c893f626ed65b088d37e3b1
|