1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2003 Andre Oppermann, Internet Business Solutions AG 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * ip_fastforward gets its speed from processing the forwarded packet to 34 * completion (if_output on the other side) without any queues or netisr's. 35 * The receiving interface DMAs the packet into memory, the upper half of 36 * driver calls ip_fastforward, we do our routing table lookup and directly 37 * send it off to the outgoing interface, which DMAs the packet to the 38 * network card. The only part of the packet we touch with the CPU is the 39 * IP header (unless there are complex firewall rules touching other parts 40 * of the packet, but that is up to you). We are essentially limited by bus 41 * bandwidth and how fast the network card/driver can set up receives and 42 * transmits. 43 * 44 * We handle basic errors, IP header errors, checksum errors, 45 * destination unreachable, fragmentation and fragmentation needed and 46 * report them via ICMP to the sender. 47 * 48 * Else if something is not pure IPv4 unicast forwarding we fall back to 49 * the normal ip_input processing path. We should only be called from 50 * interfaces connected to the outside world. 51 * 52 * Firewalling is fully supported including divert, ipfw fwd and ipfilter 53 * ipnat and address rewrite. 54 * 55 * IPSEC is not supported if this host is a tunnel broker. IPSEC is 56 * supported for connections to/from local host. 57 * 58 * We try to do the least expensive (in CPU ops) checks and operations 59 * first to catch junk with as little overhead as possible. 60 * 61 * We take full advantage of hardware support for IP checksum and 62 * fragmentation offloading. 63 * 64 * We don't do ICMP redirect in the fast forwarding path. I have had my own 65 * cases where two core routers with Zebra routing suite would send millions 66 * ICMP redirects to connected hosts if the destination router was not the 67 * default gateway. In one case it was filling the routing table of a host 68 * with approximately 300.000 cloned redirect entries until it ran out of 69 * kernel memory. However the networking code proved very robust and it didn't 70 * crash or fail in other ways. 71 */ 72 73 /* 74 * Many thanks to Matt Thomas of NetBSD for basic structure of ip_flow.c which 75 * is being followed here. 76 */ 77 78 #include <sys/cdefs.h> 79 __FBSDID("$FreeBSD$"); 80 81 #include "opt_ipstealth.h" 82 83 #include <sys/param.h> 84 #include <sys/systm.h> 85 #include <sys/kernel.h> 86 #include <sys/malloc.h> 87 #include <sys/mbuf.h> 88 #include <sys/protosw.h> 89 #include <sys/sdt.h> 90 #include <sys/socket.h> 91 #include <sys/sysctl.h> 92 93 #include <net/if.h> 94 #include <net/if_types.h> 95 #include <net/if_var.h> 96 #include <net/if_dl.h> 97 #include <net/pfil.h> 98 #include <net/route.h> 99 #include <net/vnet.h> 100 101 #include <netinet/in.h> 102 #include <netinet/in_fib.h> 103 #include <netinet/in_kdtrace.h> 104 #include <netinet/in_systm.h> 105 #include <netinet/in_var.h> 106 #include <netinet/ip.h> 107 #include <netinet/ip_var.h> 108 #include <netinet/ip_icmp.h> 109 #include <netinet/ip_options.h> 110 111 #include <machine/in_cksum.h> 112 113 static int 114 ip_findroute(struct nhop4_basic *pnh, struct in_addr dest, struct mbuf *m) 115 { 116 117 bzero(pnh, sizeof(*pnh)); 118 if (fib4_lookup_nh_basic(M_GETFIB(m), dest, 0, 0, pnh) != 0) { 119 IPSTAT_INC(ips_noroute); 120 IPSTAT_INC(ips_cantforward); 121 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 122 return (EHOSTUNREACH); 123 } 124 /* 125 * Drop blackholed traffic and directed broadcasts. 126 */ 127 if ((pnh->nh_flags & (NHF_BLACKHOLE | NHF_BROADCAST)) != 0) { 128 IPSTAT_INC(ips_cantforward); 129 m_freem(m); 130 return (EHOSTUNREACH); 131 } 132 133 if (pnh->nh_flags & NHF_REJECT) { 134 IPSTAT_INC(ips_cantforward); 135 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 136 return (EHOSTUNREACH); 137 } 138 139 return (0); 140 } 141 142 /* 143 * Try to forward a packet based on the destination address. 144 * This is a fast path optimized for the plain forwarding case. 145 * If the packet is handled (and consumed) here then we return NULL; 146 * otherwise mbuf is returned and the packet should be delivered 147 * to ip_input for full processing. 148 */ 149 struct mbuf * 150 ip_tryforward(struct mbuf *m) 151 { 152 struct ip *ip; 153 struct mbuf *m0 = NULL; 154 struct nhop4_basic nh; 155 struct sockaddr_in dst; 156 struct in_addr dest, odest, rtdest; 157 uint16_t ip_len, ip_off; 158 int error = 0; 159 struct m_tag *fwd_tag = NULL; 160 161 /* 162 * Are we active and forwarding packets? 163 */ 164 165 M_ASSERTVALID(m); 166 M_ASSERTPKTHDR(m); 167 168 #ifdef ALTQ 169 /* 170 * Is packet dropped by traffic conditioner? 171 */ 172 if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) 173 goto drop; 174 #endif 175 176 /* 177 * Only IP packets without options 178 */ 179 ip = mtod(m, struct ip *); 180 181 if (ip->ip_hl != (sizeof(struct ip) >> 2)) { 182 if (V_ip_doopts == 1) 183 return m; 184 else if (V_ip_doopts == 2) { 185 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB, 186 0, 0); 187 return NULL; /* mbuf already free'd */ 188 } 189 /* else ignore IP options and continue */ 190 } 191 192 /* 193 * Only unicast IP, not from loopback, no L2 or IP broadcast, 194 * no multicast, no INADDR_ANY 195 * 196 * XXX: Probably some of these checks could be direct drop 197 * conditions. However it is not clear whether there are some 198 * hacks or obscure behaviours which make it necessary to 199 * let ip_input handle it. We play safe here and let ip_input 200 * deal with it until it is proven that we can directly drop it. 201 */ 202 if ((m->m_flags & (M_BCAST|M_MCAST)) || 203 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) || 204 ntohl(ip->ip_src.s_addr) == (u_long)INADDR_BROADCAST || 205 ntohl(ip->ip_dst.s_addr) == (u_long)INADDR_BROADCAST || 206 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 207 IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 208 IN_LINKLOCAL(ntohl(ip->ip_src.s_addr)) || 209 IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr)) || 210 ip->ip_src.s_addr == INADDR_ANY || 211 ip->ip_dst.s_addr == INADDR_ANY ) 212 return m; 213 214 /* 215 * Is it for a local address on this host? 216 */ 217 if (in_localip(ip->ip_dst)) 218 return m; 219 220 IPSTAT_INC(ips_total); 221 222 /* 223 * Step 3: incoming packet firewall processing 224 */ 225 226 odest.s_addr = dest.s_addr = ip->ip_dst.s_addr; 227 228 /* 229 * Run through list of ipfilter hooks for input packets 230 */ 231 if (!PFIL_HOOKED_IN(V_inet_pfil_head)) 232 goto passin; 233 234 if (pfil_run_hooks(V_inet_pfil_head, &m, m->m_pkthdr.rcvif, PFIL_IN, 235 NULL) != PFIL_PASS) 236 goto drop; 237 238 M_ASSERTVALID(m); 239 M_ASSERTPKTHDR(m); 240 241 ip = mtod(m, struct ip *); /* m may have changed by pfil hook */ 242 dest.s_addr = ip->ip_dst.s_addr; 243 244 /* 245 * Destination address changed? 246 */ 247 if (odest.s_addr != dest.s_addr) { 248 /* 249 * Is it now for a local address on this host? 250 */ 251 if (in_localip(dest)) 252 goto forwardlocal; 253 /* 254 * Go on with new destination address 255 */ 256 } 257 258 if (m->m_flags & M_FASTFWD_OURS) { 259 /* 260 * ipfw changed it for a local address on this host. 261 */ 262 goto forwardlocal; 263 } 264 265 passin: 266 /* 267 * Step 4: decrement TTL and look up route 268 */ 269 270 /* 271 * Check TTL 272 */ 273 #ifdef IPSTEALTH 274 if (!V_ipstealth) { 275 #endif 276 if (ip->ip_ttl <= IPTTLDEC) { 277 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, 0); 278 return NULL; /* mbuf already free'd */ 279 } 280 281 /* 282 * Decrement the TTL and incrementally change the IP header checksum. 283 * Don't bother doing this with hw checksum offloading, it's faster 284 * doing it right here. 285 */ 286 ip->ip_ttl -= IPTTLDEC; 287 if (ip->ip_sum >= (u_int16_t) ~htons(IPTTLDEC << 8)) 288 ip->ip_sum -= ~htons(IPTTLDEC << 8); 289 else 290 ip->ip_sum += htons(IPTTLDEC << 8); 291 #ifdef IPSTEALTH 292 } 293 #endif 294 295 /* 296 * Next hop forced by pfil(9) hook? 297 */ 298 if ((m->m_flags & M_IP_NEXTHOP) && 299 ((fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL)) { 300 /* 301 * Now we will find route to forced destination. 302 */ 303 dest.s_addr = ((struct sockaddr_in *) 304 (fwd_tag + 1))->sin_addr.s_addr; 305 m_tag_delete(m, fwd_tag); 306 m->m_flags &= ~M_IP_NEXTHOP; 307 } 308 309 /* 310 * Find route to destination. 311 */ 312 if (ip_findroute(&nh, dest, m) != 0) 313 return (NULL); /* icmp unreach already sent */ 314 315 /* 316 * Avoid second route lookup by caching destination. 317 */ 318 rtdest.s_addr = dest.s_addr; 319 320 /* 321 * Step 5: outgoing firewall packet processing 322 */ 323 if (!PFIL_HOOKED_OUT(V_inet_pfil_head)) 324 goto passout; 325 326 if (pfil_run_hooks(V_inet_pfil_head, &m, nh.nh_ifp, 327 PFIL_OUT | PFIL_FWD, NULL) != PFIL_PASS) 328 goto drop; 329 330 M_ASSERTVALID(m); 331 M_ASSERTPKTHDR(m); 332 333 ip = mtod(m, struct ip *); 334 dest.s_addr = ip->ip_dst.s_addr; 335 336 /* 337 * Destination address changed? 338 */ 339 if (m->m_flags & M_IP_NEXTHOP) 340 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); 341 else 342 fwd_tag = NULL; 343 if (odest.s_addr != dest.s_addr || fwd_tag != NULL) { 344 /* 345 * Is it now for a local address on this host? 346 */ 347 if (m->m_flags & M_FASTFWD_OURS || in_localip(dest)) { 348 forwardlocal: 349 /* 350 * Return packet for processing by ip_input(). 351 */ 352 m->m_flags |= M_FASTFWD_OURS; 353 return (m); 354 } 355 /* 356 * Redo route lookup with new destination address 357 */ 358 if (fwd_tag) { 359 dest.s_addr = ((struct sockaddr_in *) 360 (fwd_tag + 1))->sin_addr.s_addr; 361 m_tag_delete(m, fwd_tag); 362 m->m_flags &= ~M_IP_NEXTHOP; 363 } 364 if (dest.s_addr != rtdest.s_addr && 365 ip_findroute(&nh, dest, m) != 0) 366 return (NULL); /* icmp unreach already sent */ 367 } 368 369 passout: 370 /* 371 * Step 6: send off the packet 372 */ 373 ip_len = ntohs(ip->ip_len); 374 ip_off = ntohs(ip->ip_off); 375 376 bzero(&dst, sizeof(dst)); 377 dst.sin_family = AF_INET; 378 dst.sin_len = sizeof(dst); 379 dst.sin_addr = nh.nh_addr; 380 381 /* 382 * Check if packet fits MTU or if hardware will fragment for us 383 */ 384 if (ip_len <= nh.nh_mtu) { 385 /* 386 * Avoid confusing lower layers. 387 */ 388 m_clrprotoflags(m); 389 /* 390 * Send off the packet via outgoing interface 391 */ 392 IP_PROBE(send, NULL, NULL, ip, nh.nh_ifp, ip, NULL); 393 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m, 394 (struct sockaddr *)&dst, NULL); 395 } else { 396 /* 397 * Handle EMSGSIZE with icmp reply needfrag for TCP MTU discovery 398 */ 399 if (ip_off & IP_DF) { 400 IPSTAT_INC(ips_cantfrag); 401 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 402 0, nh.nh_mtu); 403 goto consumed; 404 } else { 405 /* 406 * We have to fragment the packet 407 */ 408 m->m_pkthdr.csum_flags |= CSUM_IP; 409 if (ip_fragment(ip, &m, nh.nh_mtu, 410 nh.nh_ifp->if_hwassist) != 0) 411 goto drop; 412 KASSERT(m != NULL, ("null mbuf and no error")); 413 /* 414 * Send off the fragments via outgoing interface 415 */ 416 error = 0; 417 do { 418 m0 = m->m_nextpkt; 419 m->m_nextpkt = NULL; 420 /* 421 * Avoid confusing lower layers. 422 */ 423 m_clrprotoflags(m); 424 425 IP_PROBE(send, NULL, NULL, 426 mtod(m, struct ip *), nh.nh_ifp, 427 mtod(m, struct ip *), NULL); 428 /* XXX: we can use cached route here */ 429 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m, 430 (struct sockaddr *)&dst, NULL); 431 if (error) 432 break; 433 } while ((m = m0) != NULL); 434 if (error) { 435 /* Reclaim remaining fragments */ 436 for (m = m0; m; m = m0) { 437 m0 = m->m_nextpkt; 438 m_freem(m); 439 } 440 } else 441 IPSTAT_INC(ips_fragmented); 442 } 443 } 444 445 if (error != 0) 446 IPSTAT_INC(ips_odropped); 447 else { 448 IPSTAT_INC(ips_forward); 449 IPSTAT_INC(ips_fastforward); 450 } 451 consumed: 452 return NULL; 453 drop: 454 if (m) 455 m_freem(m); 456 return NULL; 457 } 458