1 /*- 2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25 */ 26 27 #include <sys/cdefs.h> 28 #include "opt_inet6.h" 29 #include "opt_ipstealth.h" 30 #include "opt_sctp.h" 31 32 #include <sys/param.h> 33 #include <sys/systm.h> 34 #include <sys/mbuf.h> 35 #include <sys/socket.h> 36 #include <sys/kernel.h> 37 #include <sys/sysctl.h> 38 39 #include <net/if.h> 40 #include <net/if_var.h> 41 #include <net/if_private.h> 42 #include <net/route.h> 43 #include <net/route/nhop.h> 44 #include <net/pfil.h> 45 #include <net/vnet.h> 46 47 #include <netinet/in.h> 48 #include <netinet/in_kdtrace.h> 49 #include <netinet/in_var.h> 50 #include <netinet/ip_var.h> 51 #include <netinet/ip6.h> 52 #include <netinet/icmp6.h> 53 #include <netinet6/in6_var.h> 54 #include <netinet6/in6_fib.h> 55 #include <netinet6/ip6_var.h> 56 #include <netinet6/nd6.h> 57 58 #if defined(SCTP) || defined(SCTP_SUPPORT) 59 #include <netinet/sctp_crc32.h> 60 #endif 61 62 static int 63 ip6_findroute(struct nhop_object **pnh, const struct sockaddr_in6 *dst, 64 struct mbuf *m) 65 { 66 struct nhop_object *nh; 67 68 nh = fib6_lookup(M_GETFIB(m), &dst->sin6_addr, 69 dst->sin6_scope_id, NHR_NONE, m->m_pkthdr.flowid); 70 if (nh == NULL) { 71 IP6STAT_INC(ip6s_noroute); 72 IP6STAT_INC(ip6s_cantforward); 73 icmp6_error(m, ICMP6_DST_UNREACH, 74 ICMP6_DST_UNREACH_NOROUTE, 0); 75 return (EHOSTUNREACH); 76 } 77 if (nh->nh_flags & NHF_BLACKHOLE) { 78 IP6STAT_INC(ip6s_cantforward); 79 m_freem(m); 80 return (EHOSTUNREACH); 81 } 82 83 if (nh->nh_flags & NHF_REJECT) { 84 IP6STAT_INC(ip6s_cantforward); 85 icmp6_error(m, ICMP6_DST_UNREACH, 86 ICMP6_DST_UNREACH_REJECT, 0); 87 return (EHOSTUNREACH); 88 } 89 90 *pnh = nh; 91 92 return (0); 93 } 94 95 struct mbuf* 96 ip6_tryforward(struct mbuf *m) 97 { 98 struct sockaddr_in6 dst; 99 struct nhop_object *nh; 100 struct m_tag *fwd_tag; 101 struct ip6_hdr *ip6; 102 struct ifnet *rcvif; 103 uint32_t plen; 104 int error; 105 106 /* 107 * Fallback conditions to ip6_input for slow path processing. 108 */ 109 ip6 = mtod(m, struct ip6_hdr *); 110 if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 || 111 ip6->ip6_nxt == IPPROTO_HOPOPTS || 112 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || 113 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) || 114 IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) || 115 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_dst) || 116 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) || 117 in6_localip(&ip6->ip6_dst)) 118 return (m); 119 /* 120 * Check that the amount of data in the buffers 121 * is as at least much as the IPv6 header would have us expect. 122 * Trim mbufs if longer than we expect. 123 * Drop packet if shorter than we expect. 124 */ 125 rcvif = m->m_pkthdr.rcvif; 126 plen = ntohs(ip6->ip6_plen); 127 if (plen == 0) { 128 /* 129 * Jumbograms must have hop-by-hop header and go via 130 * slow path. 131 */ 132 IP6STAT_INC(ip6s_badoptions); 133 goto dropin; 134 } 135 if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) { 136 IP6STAT_INC(ip6s_tooshort); 137 in6_ifstat_inc(rcvif, ifs6_in_truncated); 138 goto dropin; 139 } 140 if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) { 141 if (m->m_len == m->m_pkthdr.len) { 142 m->m_len = sizeof(struct ip6_hdr) + plen; 143 m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen; 144 } else 145 m_adj(m, sizeof(struct ip6_hdr) + plen - 146 m->m_pkthdr.len); 147 } 148 149 /* 150 * Hop limit. 151 */ 152 #ifdef IPSTEALTH 153 if (!V_ip6stealth) 154 #endif 155 if (ip6->ip6_hlim <= IPV6_HLIMDEC) { 156 icmp6_error(m, ICMP6_TIME_EXCEEDED, 157 ICMP6_TIME_EXCEED_TRANSIT, 0); 158 m = NULL; 159 goto dropin; 160 } 161 162 bzero(&dst, sizeof(dst)); 163 dst.sin6_family = AF_INET6; 164 dst.sin6_len = sizeof(dst); 165 dst.sin6_addr = ip6->ip6_dst; 166 167 /* 168 * Incoming packet firewall processing. 169 */ 170 if (!PFIL_HOOKED_IN(V_inet6_pfil_head)) 171 goto passin; 172 if (pfil_mbuf_in(V_inet6_pfil_head, &m, rcvif, NULL) != 173 PFIL_PASS) 174 goto dropin; 175 /* 176 * If packet filter sets the M_FASTFWD_OURS flag, this means 177 * that new destination or next hop is our local address. 178 * So, we can just go back to ip6_input. 179 * XXX: should we decrement ip6_hlim in such case? 180 * 181 * Also it can forward packet to another destination, e.g. 182 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf. 183 */ 184 if (m->m_flags & M_FASTFWD_OURS) 185 return (m); 186 187 ip6 = mtod(m, struct ip6_hdr *); 188 if ((m->m_flags & M_IP6_NEXTHOP) && 189 (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) { 190 /* 191 * Now we will find route to forwarded by pfil destination. 192 */ 193 bcopy((fwd_tag + 1), &dst, sizeof(dst)); 194 m->m_flags &= ~M_IP6_NEXTHOP; 195 m_tag_delete(m, fwd_tag); 196 } else { 197 /* Update dst since pfil could change it */ 198 dst.sin6_addr = ip6->ip6_dst; 199 } 200 passin: 201 /* 202 * Find route to destination. 203 */ 204 if (ip6_findroute(&nh, &dst, m) != 0) { 205 m = NULL; 206 in6_ifstat_inc(rcvif, ifs6_in_noroute); 207 goto dropin; 208 } 209 if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) { 210 if (m->m_pkthdr.len > nh->nh_mtu) { 211 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig); 212 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu); 213 m = NULL; 214 goto dropout; 215 } 216 goto passout; 217 } 218 219 /* 220 * Outgoing packet firewall processing. 221 */ 222 if (pfil_mbuf_out(V_inet6_pfil_head, &m, nh->nh_ifp, 223 NULL) != PFIL_PASS) 224 goto dropout; 225 226 /* 227 * We used slow path processing for packets with scoped addresses. 228 * So, scope checks aren't needed here. 229 */ 230 if (m->m_pkthdr.len > nh->nh_mtu) { 231 in6_ifstat_inc(nh->nh_ifp, ifs6_in_toobig); 232 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh->nh_mtu); 233 m = NULL; 234 goto dropout; 235 } 236 237 /* 238 * If packet filter sets the M_FASTFWD_OURS flag, this means 239 * that new destination or next hop is our local address. 240 * So, we can just go back to ip6_input. 241 * 242 * Also it can forward packet to another destination, e.g. 243 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf. 244 */ 245 if (m->m_flags & M_FASTFWD_OURS) { 246 /* 247 * XXX: we did one hop and should decrement hop limit. But 248 * now we are the destination and just don't pay attention. 249 */ 250 return (m); 251 } 252 /* 253 * Again. A packet filter could change the destination address. 254 */ 255 ip6 = mtod(m, struct ip6_hdr *); 256 if (m->m_flags & M_IP6_NEXTHOP) 257 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); 258 else 259 fwd_tag = NULL; 260 261 if (fwd_tag != NULL || 262 !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) { 263 if (fwd_tag != NULL) { 264 bcopy((fwd_tag + 1), &dst, sizeof(dst)); 265 m->m_flags &= ~M_IP6_NEXTHOP; 266 m_tag_delete(m, fwd_tag); 267 } else 268 dst.sin6_addr = ip6->ip6_dst; 269 /* 270 * Redo route lookup with new destination address 271 */ 272 if (ip6_findroute(&nh, &dst, m) != 0) { 273 m = NULL; 274 goto dropout; 275 } 276 } 277 passout: 278 #ifdef IPSTEALTH 279 if (!V_ip6stealth) 280 #endif 281 { 282 ip6->ip6_hlim -= IPV6_HLIMDEC; 283 } 284 285 /* 286 * If TCP/UDP header still needs a valid checksum and interface will not 287 * calculate it for us, do it here. 288 */ 289 if (__predict_false(m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6 & 290 ~nh->nh_ifp->if_hwassist)) { 291 int offset = ip6_lasthdr(m, 0, IPPROTO_IPV6, NULL); 292 293 if (offset < sizeof(struct ip6_hdr) || offset > m->m_pkthdr.len) 294 goto drop; 295 in6_delayed_cksum(m, m->m_pkthdr.len - offset, offset); 296 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6; 297 } 298 #if defined(SCTP) || defined(SCTP_SUPPORT) 299 if (__predict_false(m->m_pkthdr.csum_flags & CSUM_IP6_SCTP & 300 ~nh->nh_ifp->if_hwassist)) { 301 int offset = ip6_lasthdr(m, 0, IPPROTO_IPV6, NULL); 302 303 sctp_delayed_cksum(m, offset); 304 m->m_pkthdr.csum_flags &= ~CSUM_IP6_SCTP; 305 } 306 #endif 307 308 m_clrprotoflags(m); /* Avoid confusing lower layers. */ 309 IP_PROBE(send, NULL, NULL, ip6, nh->nh_ifp, NULL, ip6); 310 311 if (nh->nh_flags & NHF_GATEWAY) 312 dst.sin6_addr = nh->gw6_sa.sin6_addr; 313 error = (*nh->nh_ifp->if_output)(nh->nh_ifp, m, 314 (struct sockaddr *)&dst, NULL); 315 if (error != 0) { 316 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard); 317 IP6STAT_INC(ip6s_cantforward); 318 } else { 319 in6_ifstat_inc(nh->nh_ifp, ifs6_out_forward); 320 IP6STAT_INC(ip6s_forward); 321 } 322 return (NULL); 323 dropin: 324 in6_ifstat_inc(rcvif, ifs6_in_discard); 325 goto drop; 326 dropout: 327 in6_ifstat_inc(nh->nh_ifp, ifs6_out_discard); 328 drop: 329 if (m != NULL) 330 m_freem(m); 331 return (NULL); 332 } 333