The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet6/ip6_fastfwd.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  *
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer.
   11  * 2. Redistributions in binary form must reproduce the above copyright
   12  *    notice, this list of conditions and the following disclaimer in the
   13  *    documentation and/or other materials provided with the distribution.
   14  *
   15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   25  */
   26 
   27 #include <sys/cdefs.h>
   28 __FBSDID("$FreeBSD$");
   29 
   30 #include "opt_inet6.h"
   31 #include "opt_ipstealth.h"
   32 
   33 #include <sys/param.h>
   34 #include <sys/systm.h>
   35 #include <sys/mbuf.h>
   36 #include <sys/socket.h>
   37 #include <sys/kernel.h>
   38 #include <sys/sysctl.h>
   39 
   40 #include <net/if.h>
   41 #include <net/if_var.h>
   42 #include <net/route.h>
   43 #include <net/route/nhop.h>
   44 #include <net/pfil.h>
   45 #include <net/vnet.h>
   46 
   47 #include <netinet/in.h>
   48 #include <netinet/in_kdtrace.h>
   49 #include <netinet/in_var.h>
   50 #include <netinet/ip_var.h>
   51 #include <netinet/ip6.h>
   52 #include <netinet/icmp6.h>
   53 #include <netinet6/in6_var.h>
   54 #include <netinet6/in6_fib.h>
   55 #include <netinet6/ip6_var.h>
   56 #include <netinet6/nd6.h>
   57 
   58 static int
   59 ip6_findroute(struct nhop_object **pnh, const struct sockaddr_in6 *dst,
   60     struct mbuf *m)
   61 {
   62         struct nhop_object *nh;
   63 
   64         nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr,
   65             dst->sin6_scope_id, NHR_NONE, m->m_pkthdr.flowid);
   66        if (nh == NULL) {
   67                 IP6STAT_INC(ip6s_noroute);
   68                 IP6STAT_INC(ip6s_cantforward);
   69                 icmp6_error(m, ICMP6_DST_UNREACH,
   70                     ICMP6_DST_UNREACH_NOROUTE, 0);
   71                 return (EHOSTUNREACH);
   72         }
   73         if (nh->nh_flags & NHF_BLACKHOLE) {
   74                 IP6STAT_INC(ip6s_cantforward);
   75                 m_freem(m);
   76                 return (EHOSTUNREACH);
   77         }
   78 
   79         if (nh->nh_flags & NHF_REJECT) {
   80                 IP6STAT_INC(ip6s_cantforward);
   81                 icmp6_error(m, ICMP6_DST_UNREACH,
   82                     ICMP6_DST_UNREACH_REJECT, 0);
   83                 return (EHOSTUNREACH);
   84         }
   85 
   86         *pnh = nh;
   87 
   88         return (0);
   89 }
   90 
   91 struct mbuf*
   92 ip6_tryforward(struct mbuf *m)
   93 {
   94         struct sockaddr_in6 dst;
   95         struct nhop_object *nh;
   96         struct m_tag *fwd_tag;
   97         struct ip6_hdr *ip6;
   98         struct ifnet *rcvif;
   99         uint32_t plen;
  100         int error;
  101 
  102         /*
  103          * Fallback conditions to ip6_input for slow path processing.
  104          */
  105         ip6 = mtod(m, struct ip6_hdr *);
  106         if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
  107             ip6->ip6_nxt == IPPROTO_HOPOPTS ||
  108             IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
  109             IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
  110             IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
  111             IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
  112             in6_localip(&ip6->ip6_dst))
  113                 return (m);
  114         /*
  115          * Check that the amount of data in the buffers
  116          * is as at least much as the IPv6 header would have us expect.
  117          * Trim mbufs if longer than we expect.
  118          * Drop packet if shorter than we expect.
  119          */
  120         rcvif = m->m_pkthdr.rcvif;
  121         plen = ntohs(ip6->ip6_plen);
  122         if (plen == 0) {
  123                 /*
  124                  * Jumbograms must have hop-by-hop header and go via
  125                  * slow path.
  126                  */
  127                 IP6STAT_INC(ip6s_badoptions);
  128                 goto dropin;
  129         }
  130         if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
  131                 IP6STAT_INC(ip6s_tooshort);
  132                 in6_ifstat_inc(rcvif, ifs6_in_truncated);
  133                 goto dropin;
  134         }
  135         if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
  136                 if (m->m_len == m->m_pkthdr.len) {
  137                         m->m_len = sizeof(struct ip6_hdr) + plen;
  138                         m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
  139                 } else
  140                         m_adj(m, sizeof(struct ip6_hdr) + plen -
  141                             m->m_pkthdr.len);
  142         }
  143 
  144         /*
  145          * Hop limit.
  146          */
  147 #ifdef IPSTEALTH
  148         if (!V_ip6stealth)
  149 #endif
  150         if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
  151                 icmp6_error(m, ICMP6_TIME_EXCEEDED,
  152                     ICMP6_TIME_EXCEED_TRANSIT, 0);
  153                 m = NULL;
  154                 goto dropin;
  155         }
  156 
  157         bzero(&dst, sizeof(dst));
  158         dst.sin6_family = AF_INET6;
  159         dst.sin6_len = sizeof(dst);
  160         dst.sin6_addr = ip6->ip6_dst;
  161 
  162         /*
  163          * Incoming packet firewall processing.
  164          */
  165         if (!PFIL_HOOKED_IN(V_inet6_pfil_head))
  166                 goto passin;
  167         if (pfil_run_hooks(V_inet6_pfil_head, &m, rcvif, PFIL_IN, NULL) !=
  168             PFIL_PASS)
  169                 goto dropin;
  170         /*
  171          * If packet filter sets the M_FASTFWD_OURS flag, this means
  172          * that new destination or next hop is our local address.
  173          * So, we can just go back to ip6_input.
  174          * XXX: should we decrement ip6_hlim in such case?
  175          *
  176          * Also it can forward packet to another destination, e.g.
  177          * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
  178          */
  179         if (m->m_flags & M_FASTFWD_OURS)
  180                 return (m);
  181 
  182         ip6 = mtod(m, struct ip6_hdr *);
  183         if ((m->m_flags & M_IP6_NEXTHOP) &&
  184             (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
  185                 /*
  186                  * Now we will find route to forwarded by pfil destination.
  187                  */
  188                 bcopy((fwd_tag + 1), &dst, sizeof(dst));
  189                 m->m_flags &= ~M_IP6_NEXTHOP;
  190                 m_tag_delete(m, fwd_tag);
  191         } else {
  192                 /* Update dst since pfil could change it */
  193                 dst.sin6_addr = ip6->ip6_dst;
  194         }
  195 passin:
  196         /*
  197          * Find route to destination.
  198          */
  199         if (ip6_findroute(&nh, &dst, m) != 0) {
  200                 m = NULL;
  201                 in6_ifstat_inc(rcvif, ifs6_in_noroute);
  202                 goto dropin;
  203         }
  204         if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) {
  205                 if (m->m_pkthdr.len > nh->nh_mtu) {
  206                         in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
  207                         icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
  208                         m = NULL;
  209                         goto dropout;
  210                 }
  211                 goto passout;
  212         }
  213 
  214         /*
  215          * Outgoing packet firewall processing.
  216          */
  217         if (pfil_run_hooks(V_inet6_pfil_head, &m, nh->nh_ifp, PFIL_OUT |
  218             PFIL_FWD, NULL) != PFIL_PASS)
  219                 goto dropout;
  220 
  221         /*
  222          * We used slow path processing for packets with scoped addresses.
  223          * So, scope checks aren't needed here.
  224          */
  225         if (m->m_pkthdr.len > nh->nh_mtu) {
  226                 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
  227                 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
  228                 m = NULL;
  229                 goto dropout;
  230         }
  231 
  232         /*
  233          * If packet filter sets the M_FASTFWD_OURS flag, this means
  234          * that new destination or next hop is our local address.
  235          * So, we can just go back to ip6_input.
  236          *
  237          * Also it can forward packet to another destination, e.g.
  238          * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
  239          */
  240         if (m->m_flags & M_FASTFWD_OURS) {
  241                 /*
  242                  * XXX: we did one hop and should decrement hop limit. But
  243                  * now we are the destination and just don't pay attention.
  244                  */
  245                 return (m);
  246         }
  247         /*
  248          * Again. A packet filter could change the destination address.
  249          */
  250         ip6 = mtod(m, struct ip6_hdr *);
  251         if (m->m_flags & M_IP6_NEXTHOP)
  252                 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
  253         else
  254                 fwd_tag = NULL;
  255 
  256         if (fwd_tag != NULL ||
  257             !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
  258                 if (fwd_tag != NULL) {
  259                         bcopy((fwd_tag + 1), &dst, sizeof(dst));
  260                         m->m_flags &= ~M_IP6_NEXTHOP;
  261                         m_tag_delete(m, fwd_tag);
  262                 } else
  263                         dst.sin6_addr = ip6->ip6_dst;
  264                 /*
  265                  * Redo route lookup with new destination address
  266                  */
  267                 if (ip6_findroute(&nh, &dst, m) != 0) {
  268                         m = NULL;
  269                         goto dropout;
  270                 }
  271         }
  272 passout:
  273 #ifdef IPSTEALTH
  274         if (!V_ip6stealth)
  275 #endif
  276         {
  277                 ip6->ip6_hlim -= IPV6_HLIMDEC;
  278         }
  279 
  280         m_clrprotoflags(m);     /* Avoid confusing lower layers. */
  281         IP_PROBE(send, NULL, NULL, ip6, nh->nh_ifp, NULL, ip6);
  282 
  283         if (nh->nh_flags & NHF_GATEWAY)
  284                 dst.sin6_addr = nh->gw6_sa.sin6_addr;
  285         error = (*nh->nh_ifp->if_output)(nh->nh_ifp, m,
  286             (struct sockaddr *)&dst, NULL);
  287         if (error != 0) {
  288                 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
  289                 IP6STAT_INC(ip6s_cantforward);
  290         } else {
  291                 in6_ifstat_inc(nh->nh_ifp, ifs6_out_forward);
  292                 IP6STAT_INC(ip6s_forward);
  293         }
  294         return (NULL);
  295 dropin:
  296         in6_ifstat_inc(rcvif, ifs6_in_discard);
  297         goto drop;
  298 dropout:
  299         in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
  300 drop:
  301         if (m != NULL)
  302                 m_freem(m);
  303         return (NULL);
  304 }

Cache object: 4e4722143c893f626ed65b088d37e3b1


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.