1 /*- 2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25 */ 26 27 #include <sys/cdefs.h> 28 __FBSDID("$FreeBSD$"); 29 30 #include "opt_inet6.h" 31 #include "opt_ipstealth.h" 32 33 #include <sys/param.h> 34 #include <sys/systm.h> 35 #include <sys/mbuf.h> 36 #include <sys/socket.h> 37 #include <sys/kernel.h> 38 #include <sys/sysctl.h> 39 40 #include <net/if.h> 41 #include <net/if_var.h> 42 #include <net/route.h> 43 #include <net/pfil.h> 44 #include <net/vnet.h> 45 46 #include <netinet/in.h> 47 #include <netinet/in_kdtrace.h> 48 #include <netinet/in_var.h> 49 #include <netinet/ip_var.h> 50 #include <netinet/ip6.h> 51 #include <netinet/icmp6.h> 52 #include <netinet6/in6_var.h> 53 #include <netinet6/in6_fib.h> 54 #include <netinet6/ip6_var.h> 55 #include <netinet6/nd6.h> 56 57 static int 58 ip6_findroute(struct nhop6_basic *pnh, const struct sockaddr_in6 *dst, 59 struct mbuf *m) 60 { 61 62 if (fib6_lookup_nh_basic(M_GETFIB(m), &dst->sin6_addr, 63 dst->sin6_scope_id, 0, dst->sin6_flowinfo, pnh) != 0) { 64 IP6STAT_INC(ip6s_noroute); 65 IP6STAT_INC(ip6s_cantforward); 66 icmp6_error(m, ICMP6_DST_UNREACH, 67 ICMP6_DST_UNREACH_NOROUTE, 0); 68 return (EHOSTUNREACH); 69 } 70 if (pnh->nh_flags & NHF_BLACKHOLE) { 71 IP6STAT_INC(ip6s_cantforward); 72 m_freem(m); 73 return (EHOSTUNREACH); 74 } 75 76 if (pnh->nh_flags & NHF_REJECT) { 77 IP6STAT_INC(ip6s_cantforward); 78 icmp6_error(m, ICMP6_DST_UNREACH, 79 ICMP6_DST_UNREACH_REJECT, 0); 80 return (EHOSTUNREACH); 81 } 82 return (0); 83 } 84 85 struct mbuf* 86 ip6_tryforward(struct mbuf *m) 87 { 88 struct sockaddr_in6 dst; 89 struct nhop6_basic nh; 90 struct m_tag *fwd_tag; 91 struct ip6_hdr *ip6; 92 struct ifnet *rcvif; 93 uint32_t plen; 94 int error; 95 96 /* 97 * Fallback conditions to ip6_input for slow path processing. 98 */ 99 ip6 = mtod(m, struct ip6_hdr *); 100 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 || 101 ip6->ip6_nxt == IPPROTO_HOPOPTS || 102 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 103 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) || 104 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) || 105 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || 106 in6_localip(&ip6->ip6_dst)) 107 return (m); 108 /* 109 * Check that the amount of data in the buffers 110 * is as at least much as the IPv6 header would have us expect. 111 * Trim mbufs if longer than we expect. 112 * Drop packet if shorter than we expect. 113 */ 114 rcvif = m->m_pkthdr.rcvif; 115 plen = ntohs(ip6->ip6_plen); 116 if (plen == 0) { 117 /* 118 * Jumbograms must have hop-by-hop header and go via 119 * slow path. 120 */ 121 IP6STAT_INC(ip6s_badoptions); 122 goto dropin; 123 } 124 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 125 IP6STAT_INC(ip6s_tooshort); 126 in6_ifstat_inc(rcvif, ifs6_in_truncated); 127 goto dropin; 128 } 129 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 130 if (m->m_len == m->m_pkthdr.len) { 131 m->m_len = sizeof(struct ip6_hdr) + plen; 132 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 133 } else 134 m_adj(m, sizeof(struct ip6_hdr) + plen - 135 m->m_pkthdr.len); 136 } 137 138 /* 139 * Hop limit. 140 */ 141 #ifdef IPSTEALTH 142 if (!V_ip6stealth) 143 #endif 144 if (ip6->ip6_hlim <= IPV6_HLIMDEC) { 145 icmp6_error(m, ICMP6_TIME_EXCEEDED, 146 ICMP6_TIME_EXCEED_TRANSIT, 0); 147 m = NULL; 148 goto dropin; 149 } 150 151 bzero(&dst, sizeof(dst)); 152 dst.sin6_family = AF_INET6; 153 dst.sin6_len = sizeof(dst); 154 dst.sin6_addr = ip6->ip6_dst; 155 156 /* 157 * Incoming packet firewall processing. 158 */ 159 if (!PFIL_HOOKED(&V_inet6_pfil_hook)) 160 goto passin; 161 if (pfil_run_hooks(&V_inet6_pfil_hook, &m, rcvif, PFIL_IN, 0, 162 NULL) != 0 || m == NULL) 163 goto dropin; 164 /* 165 * If packet filter sets the M_FASTFWD_OURS flag, this means 166 * that new destination or next hop is our local address. 167 * So, we can just go back to ip6_input. 168 * XXX: should we decrement ip6_hlim in such case? 169 * 170 * Also it can forward packet to another destination, e.g. 171 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf. 172 */ 173 if (m->m_flags & M_FASTFWD_OURS) 174 return (m); 175 176 ip6 = mtod(m, struct ip6_hdr *); 177 if ((m->m_flags & M_IP6_NEXTHOP) && 178 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) { 179 /* 180 * Now we will find route to forwarded by pfil destination. 181 */ 182 bcopy((fwd_tag + 1), &dst, sizeof(dst)); 183 m->m_flags &= ~M_IP6_NEXTHOP; 184 m_tag_delete(m, fwd_tag); 185 } else { 186 /* Update dst since pfil could change it */ 187 dst.sin6_addr = ip6->ip6_dst; 188 } 189 passin: 190 /* 191 * Find route to destination. 192 */ 193 if (ip6_findroute(&nh, &dst, m) != 0) { 194 m = NULL; 195 in6_ifstat_inc(rcvif, ifs6_in_noroute); 196 goto dropin; 197 } 198 199 /* 200 * Outgoing packet firewall processing. 201 */ 202 if (!PFIL_HOOKED(&V_inet6_pfil_hook)) 203 goto passout; 204 if (pfil_run_hooks(&V_inet6_pfil_hook, &m, nh.nh_ifp, PFIL_OUT, 205 PFIL_FWD, NULL) != 0 || m == NULL) 206 goto dropout; 207 208 /* 209 * We used slow path processing for packets with scoped addresses. 210 * So, scope checks aren't needed here. 211 */ 212 if (m->m_pkthdr.len > nh.nh_mtu) { 213 in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig); 214 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu); 215 m = NULL; 216 goto dropout; 217 } 218 219 /* 220 * If packet filter sets the M_FASTFWD_OURS flag, this means 221 * that new destination or next hop is our local address. 222 * So, we can just go back to ip6_input. 223 * 224 * Also it can forward packet to another destination, e.g. 225 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf. 226 */ 227 if (m->m_flags & M_FASTFWD_OURS) { 228 /* 229 * XXX: we did one hop and should decrement hop limit. But 230 * now we are the destination and just don't pay attention. 231 */ 232 return (m); 233 } 234 /* 235 * Again. A packet filter could change the destination address. 236 */ 237 ip6 = mtod(m, struct ip6_hdr *); 238 if (m->m_flags & M_IP6_NEXTHOP) 239 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); 240 else 241 fwd_tag = NULL; 242 243 if (fwd_tag != NULL || 244 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) { 245 if (fwd_tag != NULL) { 246 bcopy((fwd_tag + 1), &dst, sizeof(dst)); 247 m->m_flags &= ~M_IP6_NEXTHOP; 248 m_tag_delete(m, fwd_tag); 249 } else 250 dst.sin6_addr = ip6->ip6_dst; 251 /* 252 * Redo route lookup with new destination address 253 */ 254 if (ip6_findroute(&nh, &dst, m) != 0) { 255 m = NULL; 256 goto dropout; 257 } 258 } 259 passout: 260 #ifdef IPSTEALTH 261 if (!V_ip6stealth) 262 #endif 263 { 264 ip6->ip6_hlim -= IPV6_HLIMDEC; 265 } 266 267 m_clrprotoflags(m); /* Avoid confusing lower layers. */ 268 IP_PROBE(send, NULL, NULL, ip6, nh.nh_ifp, NULL, ip6); 269 270 /* 271 * XXX: we need to use destination address with embedded scope 272 * zone id, because LLTABLE uses such form of addresses for lookup. 273 */ 274 dst.sin6_addr = nh.nh_addr; 275 if (IN6_IS_SCOPE_LINKLOCAL(&dst.sin6_addr)) 276 dst.sin6_addr.s6_addr16[1] = htons(nh.nh_ifp->if_index & 0xffff); 277 278 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m, 279 (struct sockaddr *)&dst, NULL); 280 if (error != 0) { 281 in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard); 282 IP6STAT_INC(ip6s_cantforward); 283 } else { 284 in6_ifstat_inc(nh.nh_ifp, ifs6_out_forward); 285 IP6STAT_INC(ip6s_forward); 286 } 287 return (NULL); 288 dropin: 289 in6_ifstat_inc(rcvif, ifs6_in_discard); 290 goto drop; 291 dropout: 292 in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard); 293 drop: 294 if (m != NULL) 295 m_freem(m); 296 return (NULL); 297 } 298 299