1 /*-
2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 #include "opt_inet6.h"
29 #include "opt_ipstealth.h"
30
31 #include <sys/param.h>
32 #include <sys/systm.h>
33 #include <sys/mbuf.h>
34 #include <sys/socket.h>
35 #include <sys/kernel.h>
36 #include <sys/sysctl.h>
37
38 #include <net/if.h>
39 #include <net/if_var.h>
40 #include <net/if_private.h>
41 #include <net/route.h>
42 #include <net/route/nhop.h>
43 #include <net/pfil.h>
44 #include <net/vnet.h>
45
46 #include <netinet/in.h>
47 #include <netinet/in_kdtrace.h>
48 #include <netinet/in_var.h>
49 #include <netinet/ip_var.h>
50 #include <netinet/ip6.h>
51 #include <netinet/icmp6.h>
52 #include <netinet6/in6_var.h>
53 #include <netinet6/in6_fib.h>
54 #include <netinet6/ip6_var.h>
55 #include <netinet6/nd6.h>
56
57 static int
ip6_findroute(struct nhop_object ** pnh,const struct sockaddr_in6 * dst,struct mbuf * m)58 ip6_findroute(struct nhop_object **pnh, const struct sockaddr_in6 *dst,
59 struct mbuf *m)
60 {
61 struct nhop_object *nh;
62
63 nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr,
64 dst->sin6_scope_id, NHR_NONE, m->m_pkthdr.flowid);
65 if (nh == NULL) {
66 IP6STAT_INC(ip6s_noroute);
67 IP6STAT_INC(ip6s_cantforward);
68 icmp6_error(m, ICMP6_DST_UNREACH,
69 ICMP6_DST_UNREACH_NOROUTE, 0);
70 return (EHOSTUNREACH);
71 }
72 if (nh->nh_flags & NHF_BLACKHOLE) {
73 IP6STAT_INC(ip6s_cantforward);
74 m_freem(m);
75 return (EHOSTUNREACH);
76 }
77
78 if (nh->nh_flags & NHF_REJECT) {
79 IP6STAT_INC(ip6s_cantforward);
80 icmp6_error(m, ICMP6_DST_UNREACH,
81 ICMP6_DST_UNREACH_REJECT, 0);
82 return (EHOSTUNREACH);
83 }
84
85 *pnh = nh;
86
87 return (0);
88 }
89
90 struct mbuf*
ip6_tryforward(struct mbuf * m)91 ip6_tryforward(struct mbuf *m)
92 {
93 struct sockaddr_in6 dst;
94 struct nhop_object *nh;
95 struct m_tag *fwd_tag;
96 struct ip6_hdr *ip6;
97 struct ifnet *rcvif;
98 uint32_t plen;
99 int error;
100
101 /*
102 * Fallback conditions to ip6_input for slow path processing.
103 */
104 ip6 = mtod(m, struct ip6_hdr *);
105 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
106 ip6->ip6_nxt == IPPROTO_HOPOPTS ||
107 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
108 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
109 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
110 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
111 in6_localip(&ip6->ip6_dst))
112 return (m);
113 /*
114 * Check that the amount of data in the buffers
115 * is as at least much as the IPv6 header would have us expect.
116 * Trim mbufs if longer than we expect.
117 * Drop packet if shorter than we expect.
118 */
119 rcvif = m->m_pkthdr.rcvif;
120 plen = ntohs(ip6->ip6_plen);
121 if (plen == 0) {
122 /*
123 * Jumbograms must have hop-by-hop header and go via
124 * slow path.
125 */
126 IP6STAT_INC(ip6s_badoptions);
127 goto dropin;
128 }
129 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
130 IP6STAT_INC(ip6s_tooshort);
131 in6_ifstat_inc(rcvif, ifs6_in_truncated);
132 goto dropin;
133 }
134 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
135 if (m->m_len == m->m_pkthdr.len) {
136 m->m_len = sizeof(struct ip6_hdr) + plen;
137 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
138 } else
139 m_adj(m, sizeof(struct ip6_hdr) + plen -
140 m->m_pkthdr.len);
141 }
142
143 /*
144 * Hop limit.
145 */
146 #ifdef IPSTEALTH
147 if (!V_ip6stealth)
148 #endif
149 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
150 icmp6_error(m, ICMP6_TIME_EXCEEDED,
151 ICMP6_TIME_EXCEED_TRANSIT, 0);
152 m = NULL;
153 goto dropin;
154 }
155
156 bzero(&dst, sizeof(dst));
157 dst.sin6_family = AF_INET6;
158 dst.sin6_len = sizeof(dst);
159 dst.sin6_addr = ip6->ip6_dst;
160
161 /*
162 * Incoming packet firewall processing.
163 */
164 if (!PFIL_HOOKED_IN(V_inet6_pfil_head))
165 goto passin;
166 if (pfil_mbuf_in(V_inet6_pfil_head, &m, rcvif, NULL) !=
167 PFIL_PASS)
168 goto dropin;
169 /*
170 * If packet filter sets the M_FASTFWD_OURS flag, this means
171 * that new destination or next hop is our local address.
172 * So, we can just go back to ip6_input.
173 * XXX: should we decrement ip6_hlim in such case?
174 *
175 * Also it can forward packet to another destination, e.g.
176 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
177 */
178 if (m->m_flags & M_FASTFWD_OURS)
179 return (m);
180
181 ip6 = mtod(m, struct ip6_hdr *);
182 if ((m->m_flags & M_IP6_NEXTHOP) &&
183 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
184 /*
185 * Now we will find route to forwarded by pfil destination.
186 */
187 bcopy((fwd_tag + 1), &dst, sizeof(dst));
188 m->m_flags &= ~M_IP6_NEXTHOP;
189 m_tag_delete(m, fwd_tag);
190 } else {
191 /* Update dst since pfil could change it */
192 dst.sin6_addr = ip6->ip6_dst;
193 }
194 passin:
195 /*
196 * Find route to destination.
197 */
198 if (ip6_findroute(&nh, &dst, m) != 0) {
199 m = NULL;
200 in6_ifstat_inc(rcvif, ifs6_in_noroute);
201 goto dropin;
202 }
203 if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) {
204 if (m->m_pkthdr.len > nh->nh_mtu) {
205 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
206 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
207 m = NULL;
208 goto dropout;
209 }
210 goto passout;
211 }
212
213 /*
214 * Outgoing packet firewall processing.
215 */
216 if (pfil_mbuf_out(V_inet6_pfil_head, &m, nh->nh_ifp,
217 NULL) != PFIL_PASS)
218 goto dropout;
219
220 /*
221 * We used slow path processing for packets with scoped addresses.
222 * So, scope checks aren't needed here.
223 */
224 if (m->m_pkthdr.len > nh->nh_mtu) {
225 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
226 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
227 m = NULL;
228 goto dropout;
229 }
230
231 /*
232 * If packet filter sets the M_FASTFWD_OURS flag, this means
233 * that new destination or next hop is our local address.
234 * So, we can just go back to ip6_input.
235 *
236 * Also it can forward packet to another destination, e.g.
237 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
238 */
239 if (m->m_flags & M_FASTFWD_OURS) {
240 /*
241 * XXX: we did one hop and should decrement hop limit. But
242 * now we are the destination and just don't pay attention.
243 */
244 return (m);
245 }
246 /*
247 * Again. A packet filter could change the destination address.
248 */
249 ip6 = mtod(m, struct ip6_hdr *);
250 if (m->m_flags & M_IP6_NEXTHOP)
251 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
252 else
253 fwd_tag = NULL;
254
255 if (fwd_tag != NULL ||
256 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
257 if (fwd_tag != NULL) {
258 bcopy((fwd_tag + 1), &dst, sizeof(dst));
259 m->m_flags &= ~M_IP6_NEXTHOP;
260 m_tag_delete(m, fwd_tag);
261 } else
262 dst.sin6_addr = ip6->ip6_dst;
263 /*
264 * Redo route lookup with new destination address
265 */
266 if (ip6_findroute(&nh, &dst, m) != 0) {
267 m = NULL;
268 goto dropout;
269 }
270 }
271 passout:
272 #ifdef IPSTEALTH
273 if (!V_ip6stealth)
274 #endif
275 {
276 ip6->ip6_hlim -= IPV6_HLIMDEC;
277 }
278
279 m_clrprotoflags(m); /* Avoid confusing lower layers. */
280 IP_PROBE(send, NULL, NULL, ip6, nh->nh_ifp, NULL, ip6);
281
282 if (nh->nh_flags & NHF_GATEWAY)
283 dst.sin6_addr = nh->gw6_sa.sin6_addr;
284 error = (*nh->nh_ifp->if_output)(nh->nh_ifp, m,
285 (struct sockaddr *)&dst, NULL);
286 if (error != 0) {
287 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
288 IP6STAT_INC(ip6s_cantforward);
289 } else {
290 in6_ifstat_inc(nh->nh_ifp, ifs6_out_forward);
291 IP6STAT_INC(ip6s_forward);
292 }
293 return (NULL);
294 dropin:
295 in6_ifstat_inc(rcvif, ifs6_in_discard);
296 goto drop;
297 dropout:
298 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
299 drop:
300 if (m != NULL)
301 m_freem(m);
302 return (NULL);
303 }
304