1 /*-
2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 #include "opt_inet6.h"
29 #include "opt_ipstealth.h"
30 #include "opt_sctp.h"
31
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/mbuf.h>
35 #include <sys/socket.h>
36 #include <sys/kernel.h>
37 #include <sys/sysctl.h>
38
39 #include <net/if.h>
40 #include <net/if_var.h>
41 #include <net/if_private.h>
42 #include <net/route.h>
43 #include <net/route/nhop.h>
44 #include <net/pfil.h>
45 #include <net/vnet.h>
46
47 #include <netinet/in.h>
48 #include <netinet/in_kdtrace.h>
49 #include <netinet/in_var.h>
50 #include <netinet/ip_var.h>
51 #include <netinet/ip6.h>
52 #include <netinet/icmp6.h>
53 #include <netinet6/in6_var.h>
54 #include <netinet6/in6_fib.h>
55 #include <netinet6/ip6_var.h>
56 #include <netinet6/nd6.h>
57
58 #if defined(SCTP) || defined(SCTP_SUPPORT)
59 #include <netinet/sctp_crc32.h>
60 #endif
61
62 static int
ip6_findroute(struct nhop_object ** pnh,const struct sockaddr_in6 * dst,struct mbuf * m)63 ip6_findroute(struct nhop_object **pnh, const struct sockaddr_in6 *dst,
64 struct mbuf *m)
65 {
66 struct nhop_object *nh;
67
68 nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr,
69 dst->sin6_scope_id, NHR_NONE, m->m_pkthdr.flowid);
70 if (nh == NULL) {
71 IP6STAT_INC(ip6s_noroute);
72 IP6STAT_INC(ip6s_cantforward);
73 icmp6_error(m, ICMP6_DST_UNREACH,
74 ICMP6_DST_UNREACH_NOROUTE, 0);
75 return (EHOSTUNREACH);
76 }
77 if (nh->nh_flags & NHF_BLACKHOLE) {
78 IP6STAT_INC(ip6s_cantforward);
79 m_freem(m);
80 return (EHOSTUNREACH);
81 }
82
83 if (nh->nh_flags & NHF_REJECT) {
84 IP6STAT_INC(ip6s_cantforward);
85 icmp6_error(m, ICMP6_DST_UNREACH,
86 ICMP6_DST_UNREACH_REJECT, 0);
87 return (EHOSTUNREACH);
88 }
89
90 *pnh = nh;
91
92 return (0);
93 }
94
95 struct mbuf*
ip6_tryforward(struct mbuf * m)96 ip6_tryforward(struct mbuf *m)
97 {
98 struct sockaddr_in6 dst;
99 struct nhop_object *nh;
100 struct m_tag *fwd_tag;
101 struct ip6_hdr *ip6;
102 struct ifnet *rcvif;
103 uint32_t plen;
104 int error;
105
106 /*
107 * Fallback conditions to ip6_input for slow path processing.
108 */
109 ip6 = mtod(m, struct ip6_hdr *);
110 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
111 ip6->ip6_nxt == IPPROTO_HOPOPTS ||
112 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
113 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
114 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
115 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) ||
116 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
117 in6_localip(&ip6->ip6_dst))
118 return (m);
119 /*
120 * Check that the amount of data in the buffers
121 * is as at least much as the IPv6 header would have us expect.
122 * Trim mbufs if longer than we expect.
123 * Drop packet if shorter than we expect.
124 */
125 rcvif = m->m_pkthdr.rcvif;
126 plen = ntohs(ip6->ip6_plen);
127 if (plen == 0) {
128 /*
129 * Jumbograms must have hop-by-hop header and go via
130 * slow path.
131 */
132 IP6STAT_INC(ip6s_badoptions);
133 goto dropin;
134 }
135 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
136 IP6STAT_INC(ip6s_tooshort);
137 in6_ifstat_inc(rcvif, ifs6_in_truncated);
138 goto dropin;
139 }
140 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
141 if (m->m_len == m->m_pkthdr.len) {
142 m->m_len = sizeof(struct ip6_hdr) + plen;
143 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
144 } else
145 m_adj(m, sizeof(struct ip6_hdr) + plen -
146 m->m_pkthdr.len);
147 }
148
149 /*
150 * Hop limit.
151 */
152 #ifdef IPSTEALTH
153 if (!V_ip6stealth)
154 #endif
155 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
156 icmp6_error(m, ICMP6_TIME_EXCEEDED,
157 ICMP6_TIME_EXCEED_TRANSIT, 0);
158 m = NULL;
159 goto dropin;
160 }
161
162 bzero(&dst, sizeof(dst));
163 dst.sin6_family = AF_INET6;
164 dst.sin6_len = sizeof(dst);
165 dst.sin6_addr = ip6->ip6_dst;
166
167 /*
168 * Incoming packet firewall processing.
169 */
170 if (!PFIL_HOOKED_IN(V_inet6_pfil_head))
171 goto passin;
172 if (pfil_mbuf_in(V_inet6_pfil_head, &m, rcvif, NULL) !=
173 PFIL_PASS)
174 goto dropin;
175 /*
176 * If packet filter sets the M_FASTFWD_OURS flag, this means
177 * that new destination or next hop is our local address.
178 * So, we can just go back to ip6_input.
179 * XXX: should we decrement ip6_hlim in such case?
180 *
181 * Also it can forward packet to another destination, e.g.
182 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
183 */
184 if (m->m_flags & M_FASTFWD_OURS)
185 return (m);
186
187 ip6 = mtod(m, struct ip6_hdr *);
188 if ((m->m_flags & M_IP6_NEXTHOP) &&
189 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
190 /*
191 * Now we will find route to forwarded by pfil destination.
192 */
193 bcopy((fwd_tag + 1), &dst, sizeof(dst));
194 m->m_flags &= ~M_IP6_NEXTHOP;
195 m_tag_delete(m, fwd_tag);
196 } else {
197 /* Update dst since pfil could change it */
198 dst.sin6_addr = ip6->ip6_dst;
199 }
200 passin:
201 /*
202 * Find route to destination.
203 */
204 if (ip6_findroute(&nh, &dst, m) != 0) {
205 m = NULL;
206 in6_ifstat_inc(rcvif, ifs6_in_noroute);
207 goto dropin;
208 }
209 if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) {
210 if (m->m_pkthdr.len > nh->nh_mtu) {
211 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
212 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
213 m = NULL;
214 goto dropout;
215 }
216 goto passout;
217 }
218
219 /*
220 * Outgoing packet firewall processing.
221 */
222 if (pfil_mbuf_out(V_inet6_pfil_head, &m, nh->nh_ifp,
223 NULL) != PFIL_PASS)
224 goto dropout;
225
226 /*
227 * We used slow path processing for packets with scoped addresses.
228 * So, scope checks aren't needed here.
229 */
230 if (m->m_pkthdr.len > nh->nh_mtu) {
231 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig);
232 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu);
233 m = NULL;
234 goto dropout;
235 }
236
237 /*
238 * If packet filter sets the M_FASTFWD_OURS flag, this means
239 * that new destination or next hop is our local address.
240 * So, we can just go back to ip6_input.
241 *
242 * Also it can forward packet to another destination, e.g.
243 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
244 */
245 if (m->m_flags & M_FASTFWD_OURS) {
246 /*
247 * XXX: we did one hop and should decrement hop limit. But
248 * now we are the destination and just don't pay attention.
249 */
250 return (m);
251 }
252 /*
253 * Again. A packet filter could change the destination address.
254 */
255 ip6 = mtod(m, struct ip6_hdr *);
256 if (m->m_flags & M_IP6_NEXTHOP)
257 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
258 else
259 fwd_tag = NULL;
260
261 if (fwd_tag != NULL ||
262 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
263 if (fwd_tag != NULL) {
264 bcopy((fwd_tag + 1), &dst, sizeof(dst));
265 m->m_flags &= ~M_IP6_NEXTHOP;
266 m_tag_delete(m, fwd_tag);
267 } else
268 dst.sin6_addr = ip6->ip6_dst;
269 /*
270 * Redo route lookup with new destination address
271 */
272 if (ip6_findroute(&nh, &dst, m) != 0) {
273 m = NULL;
274 goto dropout;
275 }
276 }
277 passout:
278 #ifdef IPSTEALTH
279 if (!V_ip6stealth)
280 #endif
281 {
282 ip6->ip6_hlim -= IPV6_HLIMDEC;
283 }
284
285 /*
286 * If TCP/UDP header still needs a valid checksum and interface will not
287 * calculate it for us, do it here.
288 */
289 if (__predict_false(m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 &
290 ~nh->nh_ifp->if_hwassist)) {
291 int offset = ip6_lasthdr(m, 0, IPPROTO_IPV6, NULL);
292
293 if (offset < sizeof(struct ip6_hdr) || offset > m->m_pkthdr.len)
294 goto drop;
295 in6_delayed_cksum(m, m->m_pkthdr.len - offset, offset);
296 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
297 }
298 #if defined(SCTP) || defined(SCTP_SUPPORT)
299 if (__predict_false(m->m_pkthdr.csum_flags & CSUM_IP6_SCTP &
300 ~nh->nh_ifp->if_hwassist)) {
301 int offset = ip6_lasthdr(m, 0, IPPROTO_IPV6, NULL);
302
303 sctp_delayed_cksum(m, offset);
304 m->m_pkthdr.csum_flags &= ~CSUM_IP6_SCTP;
305 }
306 #endif
307
308 m_clrprotoflags(m); /* Avoid confusing lower layers. */
309 IP_PROBE(send, NULL, NULL, ip6, nh->nh_ifp, NULL, ip6);
310
311 if (nh->nh_flags & NHF_GATEWAY)
312 dst.sin6_addr = nh->gw6_sa.sin6_addr;
313 error = (*nh->nh_ifp->if_output)(nh->nh_ifp, m,
314 (struct sockaddr *)&dst, NULL);
315 if (error != 0) {
316 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
317 IP6STAT_INC(ip6s_cantforward);
318 } else {
319 in6_ifstat_inc(nh->nh_ifp, ifs6_out_forward);
320 IP6STAT_INC(ip6s_forward);
321 }
322 return (NULL);
323 dropin:
324 in6_ifstat_inc(rcvif, ifs6_in_discard);
325 goto drop;
326 dropout:
327 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard);
328 drop:
329 if (m != NULL)
330 m_freem(m);
331 return (NULL);
332 }
333