1 /*-
2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include "opt_inet6.h"
28 #include "opt_ipstealth.h"
29 #include "opt_sctp.h"
30
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/mbuf.h>
34 #include <sys/socket.h>
35 #include <sys/kernel.h>
36 #include <sys/sysctl.h>
37
38 #include <net/if.h>
39 #include <net/if_var.h>
40 #include <net/if_private.h>
41 #include <net/route.h>
42 #include <net/route/nhop.h>
43 #include <net/pfil.h>
44 #include <net/vnet.h>
45
46 #include <netinet/in.h>
47 #include <netinet/in_kdtrace.h>
48 #include <netinet/in_var.h>
49 #include <netinet/ip_var.h>
50 #include <netinet/ip6.h>
51 #include <netinet/icmp6.h>
52 #include <netinet6/in6_var.h>
53 #include <netinet6/in6_fib.h>
54 #include <netinet6/ip6_var.h>
55 #include <netinet6/nd6.h>
56
57 #if defined(SCTP) || defined(SCTP_SUPPORT)
58 #include <netinet/sctp_crc32.h>
59 #endif
60
61 static int
ip6_findroute(struct nhop_object ** pnh,const struct sockaddr_in6 * dst,struct mbuf * m)62 ip6_findroute(struct nhop_object **pnh, const struct sockaddr_in6 *dst,
63 struct mbuf *m)
64 {
65 struct nhop_object *nh;
66
67 nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr,
68 dst->sin6_scope_id, NHR_NONE, m->m_pkthdr.flowid);
69 if (nh == NULL) {
70 IP6STAT_INC(ip6s_noroute);
71 IP6STAT_INC(ip6s_cantforward);
72 icmp6_error(m, ICMP6_DST_UNREACH,
73 ICMP6_DST_UNREACH_NOROUTE, 0);
74 return (EHOSTUNREACH);
75 }
76 if (nh->nh_flags & NHF_BLACKHOLE) {
77 IP6STAT_INC(ip6s_cantforward);
78 m_freem(m);
79 return (EHOSTUNREACH);
80 }
81
82 if (nh->nh_flags & NHF_REJECT) {
83 IP6STAT_INC(ip6s_cantforward);
84 icmp6_error(m, ICMP6_DST_UNREACH,
85 ICMP6_DST_UNREACH_REJECT, 0);
86 return (EHOSTUNREACH);
87 }
88
89 *pnh = nh;
90
91 return (0);
92 }
93
94 struct mbuf*
ip6_tryforward(struct mbuf * m)95 ip6_tryforward(struct mbuf *m)
96 {
97 struct sockaddr_in6 dst;
98 struct nhop_object *nh;
99 struct m_tag *fwd_tag;
100 struct ip6_hdr *ip6;
101 struct ifnet *rcvif;
102 uint32_t plen;
103 int error;
104
105 /*
106 * Fallback conditions to ip6_input for slow path processing.
107 */
108 ip6 = mtod(m, struct ip6_hdr *);
109 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
110 ip6->ip6_nxt == IPPROTO_HOPOPTS ||
111 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
112 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
113 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
114 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) ||
115 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
116 in6_localip(&ip6->ip6_dst))
117 return (m);
118 /*
119 * Check that the amount of data in the buffers
120 * is as at least much as the IPv6 header would have us expect.
121 * Trim mbufs if longer than we expect.
122 * Drop packet if shorter than we expect.
123 */
124 rcvif = m->m_pkthdr.rcvif;
125 plen = ntohs(ip6->ip6_plen);
126 if (plen == 0) {
127 /*
128 * Jumbograms must have hop-by-hop header and go via
129 * slow path.
130 */
131 IP6STAT_INC(ip6s_badoptions);
132 goto dropin;
133 }
134 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
135 IP6STAT_INC(ip6s_tooshort);
136 in6_ifstat_inc(rcvif, ifs6_in_truncated);
137 goto dropin;
138 }
139 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
140 if (m->m_len == m->m_pkthdr.len) {
141 m->m_len = sizeof(struct ip6_hdr) + plen;
142 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
143 } else
144 m_adj(m, sizeof(struct ip6_hdr) + plen -
145 m->m_pkthdr.len);
146 }
147
148 /*
149 * Hop limit.
150 */
151 #ifdef IPSTEALTH
152 if (!V_ip6stealth)
153 #endif
154 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
155 icmp6_error(m, ICMP6_TIME_EXCEEDED,
156 ICMP6_TIME_EXCEED_TRANSIT, 0);
157 m = NULL;
158 goto dropin;
159 }
160
161 bzero(&dst, sizeof(dst));
162 dst.sin6_family = AF_INET6;
163 dst.sin6_len = sizeof(dst);
164 dst.sin6_addr = ip6->ip6_dst;
165
166 /*
167 * Incoming packet firewall processing.
168 */
169 if (!PFIL_HOOKED_IN(V_inet6_pfil_head))
170 goto passin;
171 if (pfil_mbuf_in(V_inet6_pfil_head, &m, rcvif, NULL) !=
172 PFIL_PASS)
173 goto dropin;
174 /*
175 * If packet filter sets the M_FASTFWD_OURS flag, this means
176 * that new destination or next hop is our local address.
177 * So, we can just go back to ip6_input.
178 * XXX: should we decrement ip6_hlim in such case?
179 *
180 * Also it can forward packet to another destination, e.g.
181 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
182 */
183 if (m->m_flags & M_FASTFWD_OURS)
184 return (m);
185
186 ip6 = mtod(m, struct ip6_hdr *);
187 if ((m->m_flags & M_IP6_NEXTHOP) &&
188 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
189 /*
190 * Now we will find route to forwarded by pfil destination.
191 */
192 bcopy((fwd_tag + 1), &dst, sizeof(dst));
193 m->m_flags &= ~M_IP6_NEXTHOP;
194 m_tag_delete(m, fwd_tag);
195 } else {
196 /* Update dst since pfil could change it */
197 dst.sin6_addr = ip6->ip6_dst;
198 }
199 passin:
200 /*
201 * Find route to destination.
202 */
203 if (ip6_findroute(&nh, &dst, m) != 0) {
204 m = NULL;
205 in6_ifstat_inc(rcvif, ifs6_in_noroute);
206 goto dropin;
207 }
208 if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) {
209 if (m->m_pkthdr.len > nh->nh_mtu) {
210 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
211 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
212 m = NULL;
213 goto dropout;
214 }
215 goto passout;
216 }
217
218 /*
219 * Outgoing packet firewall processing.
220 */
221 if (pfil_mbuf_out(V_inet6_pfil_head, &m, nh->nh_ifp,
222 NULL) != PFIL_PASS)
223 goto dropout;
224
225 /*
226 * We used slow path processing for packets with scoped addresses.
227 * So, scope checks aren't needed here.
228 */
229 if (m->m_pkthdr.len > nh->nh_mtu) {
230 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
231 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
232 m = NULL;
233 goto dropout;
234 }
235
236 /*
237 * If packet filter sets the M_FASTFWD_OURS flag, this means
238 * that new destination or next hop is our local address.
239 * So, we can just go back to ip6_input.
240 *
241 * Also it can forward packet to another destination, e.g.
242 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
243 */
244 if (m->m_flags & M_FASTFWD_OURS) {
245 /*
246 * XXX: we did one hop and should decrement hop limit. But
247 * now we are the destination and just don't pay attention.
248 */
249 return (m);
250 }
251 /*
252 * Again. A packet filter could change the destination address.
253 */
254 ip6 = mtod(m, struct ip6_hdr *);
255 if (m->m_flags & M_IP6_NEXTHOP)
256 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
257 else
258 fwd_tag = NULL;
259
260 if (fwd_tag != NULL ||
261 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
262 if (fwd_tag != NULL) {
263 bcopy((fwd_tag + 1), &dst, sizeof(dst));
264 m->m_flags &= ~M_IP6_NEXTHOP;
265 m_tag_delete(m, fwd_tag);
266 } else
267 dst.sin6_addr = ip6->ip6_dst;
268 /*
269 * Redo route lookup with new destination address
270 */
271 if (ip6_findroute(&nh, &dst, m) != 0) {
272 m = NULL;
273 goto dropout;
274 }
275 }
276 passout:
277 #ifdef IPSTEALTH
278 if (!V_ip6stealth)
279 #endif
280 {
281 ip6->ip6_hlim -= IPV6_HLIMDEC;
282 }
283
284 /*
285 * If TCP/UDP header still needs a valid checksum and interface will not
286 * calculate it for us, do it here.
287 */
288 if (__predict_false(m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 &
289 ~nh->nh_ifp->if_hwassist)) {
290 int offset = ip6_lasthdr(m, 0, IPPROTO_IPV6, NULL);
291
292 if (offset < sizeof(struct ip6_hdr) || offset > m->m_pkthdr.len)
293 goto drop;
294 in6_delayed_cksum(m, m->m_pkthdr.len - offset, offset);
295 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
296 }
297 #if defined(SCTP) || defined(SCTP_SUPPORT)
298 if (__predict_false(m->m_pkthdr.csum_flags & CSUM_IP6_SCTP &
299 ~nh->nh_ifp->if_hwassist)) {
300 int offset = ip6_lasthdr(m, 0, IPPROTO_IPV6, NULL);
301
302 sctp_delayed_cksum(m, offset);
303 m->m_pkthdr.csum_flags &= ~CSUM_IP6_SCTP;
304 }
305 #endif
306
307 m_clrprotoflags(m); /* Avoid confusing lower layers. */
308 IP_PROBE(send, NULL, NULL, ip6, nh->nh_ifp, NULL, ip6);
309
310 if (nh->nh_flags & NHF_GATEWAY)
311 dst.sin6_addr = nh->gw6_sa.sin6_addr;
312 error = (*nh->nh_ifp->if_output)(nh->nh_ifp, m,
313 (struct sockaddr *)&dst, NULL);
314 if (error != 0) {
315 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
316 IP6STAT_INC(ip6s_cantforward);
317 } else {
318 in6_ifstat_inc(nh->nh_ifp, ifs6_out_forward);
319 IP6STAT_INC(ip6s_forward);
320 }
321 return (NULL);
322 dropin:
323 in6_ifstat_inc(rcvif, ifs6_in_discard);
324 goto drop;
325 dropout:
326 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
327 drop:
328 if (m != NULL)
329 m_freem(m);
330 return (NULL);
331 }
332