1/*-
2 * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 *    notice, this list of conditions and the following disclaimer in the
13 *    documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD$");
29
30#include "opt_inet6.h"
31#include "opt_ipstealth.h"
32
33#include <sys/param.h>
34#include <sys/systm.h>
35#include <sys/mbuf.h>
36#include <sys/socket.h>
37#include <sys/kernel.h>
38#include <sys/sysctl.h>
39
40#include <net/if.h>
41#include <net/if_var.h>
42#include <net/route.h>
43#include <net/pfil.h>
44#include <net/vnet.h>
45
46#include <netinet/in.h>
47#include <netinet/in_kdtrace.h>
48#include <netinet/in_var.h>
49#include <netinet/ip_var.h>
50#include <netinet/ip6.h>
51#include <netinet/icmp6.h>
52#include <netinet6/in6_var.h>
53#include <netinet6/in6_fib.h>
54#include <netinet6/ip6_var.h>
55#include <netinet6/nd6.h>
56
57static int
58ip6_findroute(struct nhop6_basic *pnh, const struct sockaddr_in6 *dst,
59    struct mbuf *m)
60{
61
62	if (fib6_lookup_nh_basic(M_GETFIB(m), &dst->sin6_addr,
63	    dst->sin6_scope_id, 0, dst->sin6_flowinfo, pnh) != 0) {
64		IP6STAT_INC(ip6s_noroute);
65		IP6STAT_INC(ip6s_cantforward);
66		icmp6_error(m, ICMP6_DST_UNREACH,
67		    ICMP6_DST_UNREACH_NOROUTE, 0);
68		return (EHOSTUNREACH);
69	}
70	if (pnh->nh_flags & NHF_BLACKHOLE) {
71		IP6STAT_INC(ip6s_cantforward);
72		m_freem(m);
73		return (EHOSTUNREACH);
74	}
75
76	if (pnh->nh_flags & NHF_REJECT) {
77		IP6STAT_INC(ip6s_cantforward);
78		icmp6_error(m, ICMP6_DST_UNREACH,
79		    ICMP6_DST_UNREACH_REJECT, 0);
80		return (EHOSTUNREACH);
81	}
82	return (0);
83}
84
85struct mbuf*
86ip6_tryforward(struct mbuf *m)
87{
88	struct sockaddr_in6 dst;
89	struct nhop6_basic nh;
90	struct m_tag *fwd_tag;
91	struct ip6_hdr *ip6;
92	struct ifnet *rcvif;
93	uint32_t plen;
94	int error;
95
96	/*
97	 * Fallback conditions to ip6_input for slow path processing.
98	 */
99	ip6 = mtod(m, struct ip6_hdr *);
100	if ((m->m_flags & (M_BCAST | M_MCAST)) != 0 ||
101	    ip6->ip6_nxt == IPPROTO_HOPOPTS ||
102	    IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
103	    IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
104	    IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
105	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
106	    in6_localip(&ip6->ip6_dst))
107		return (m);
108	/*
109	 * Check that the amount of data in the buffers
110	 * is as at least much as the IPv6 header would have us expect.
111	 * Trim mbufs if longer than we expect.
112	 * Drop packet if shorter than we expect.
113	 */
114	rcvif = m->m_pkthdr.rcvif;
115	plen = ntohs(ip6->ip6_plen);
116	if (plen == 0) {
117		/*
118		 * Jumbograms must have hop-by-hop header and go via
119		 * slow path.
120		 */
121		IP6STAT_INC(ip6s_badoptions);
122		goto dropin;
123	}
124	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
125		IP6STAT_INC(ip6s_tooshort);
126		in6_ifstat_inc(rcvif, ifs6_in_truncated);
127		goto dropin;
128	}
129	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
130		if (m->m_len == m->m_pkthdr.len) {
131			m->m_len = sizeof(struct ip6_hdr) + plen;
132			m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
133		} else
134			m_adj(m, sizeof(struct ip6_hdr) + plen -
135			    m->m_pkthdr.len);
136	}
137
138	/*
139	 * Hop limit.
140	 */
141#ifdef IPSTEALTH
142	if (!V_ip6stealth)
143#endif
144	if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
145		icmp6_error(m, ICMP6_TIME_EXCEEDED,
146		    ICMP6_TIME_EXCEED_TRANSIT, 0);
147		m = NULL;
148		goto dropin;
149	}
150
151	bzero(&dst, sizeof(dst));
152	dst.sin6_family = AF_INET6;
153	dst.sin6_len = sizeof(dst);
154	dst.sin6_addr = ip6->ip6_dst;
155
156	/*
157	 * Incoming packet firewall processing.
158	 */
159	if (!PFIL_HOOKED_IN(V_inet6_pfil_head))
160		goto passin;
161	if (pfil_run_hooks(V_inet6_pfil_head, &m, rcvif, PFIL_IN, NULL) !=
162	    PFIL_PASS)
163		goto dropin;
164	/*
165	 * If packet filter sets the M_FASTFWD_OURS flag, this means
166	 * that new destination or next hop is our local address.
167	 * So, we can just go back to ip6_input.
168	 * XXX: should we decrement ip6_hlim in such case?
169	 *
170	 * Also it can forward packet to another destination, e.g.
171	 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
172	 */
173	if (m->m_flags & M_FASTFWD_OURS)
174		return (m);
175
176	ip6 = mtod(m, struct ip6_hdr *);
177	if ((m->m_flags & M_IP6_NEXTHOP) &&
178	    (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
179		/*
180		 * Now we will find route to forwarded by pfil destination.
181		 */
182		bcopy((fwd_tag + 1), &dst, sizeof(dst));
183		m->m_flags &= ~M_IP6_NEXTHOP;
184		m_tag_delete(m, fwd_tag);
185	} else {
186		/* Update dst since pfil could change it */
187		dst.sin6_addr = ip6->ip6_dst;
188	}
189passin:
190	/*
191	 * Find route to destination.
192	 */
193	if (ip6_findroute(&nh, &dst, m) != 0) {
194		m = NULL;
195		in6_ifstat_inc(rcvif, ifs6_in_noroute);
196		goto dropin;
197	}
198	if (!PFIL_HOOKED_OUT(V_inet6_pfil_head)) {
199		if (m->m_pkthdr.len > nh.nh_mtu) {
200			in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig);
201			icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu);
202			m = NULL;
203			goto dropout;
204		}
205		goto passout;
206	}
207
208	/*
209	 * Outgoing packet firewall processing.
210	 */
211	if (pfil_run_hooks(V_inet6_pfil_head, &m, nh.nh_ifp, PFIL_OUT |
212	    PFIL_FWD, NULL) != PFIL_PASS)
213		goto dropout;
214
215	/*
216	 * We used slow path processing for packets with scoped addresses.
217	 * So, scope checks aren't needed here.
218	 */
219	if (m->m_pkthdr.len > nh.nh_mtu) {
220		in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig);
221		icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu);
222		m = NULL;
223		goto dropout;
224	}
225
226	/*
227	 * If packet filter sets the M_FASTFWD_OURS flag, this means
228	 * that new destination or next hop is our local address.
229	 * So, we can just go back to ip6_input.
230	 *
231	 * Also it can forward packet to another destination, e.g.
232	 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
233	 */
234	if (m->m_flags & M_FASTFWD_OURS) {
235		/*
236		 * XXX: we did one hop and should decrement hop limit. But
237		 * now we are the destination and just don't pay attention.
238		 */
239		return (m);
240	}
241	/*
242	 * Again. A packet filter could change the destination address.
243	 */
244	ip6 = mtod(m, struct ip6_hdr *);
245	if (m->m_flags & M_IP6_NEXTHOP)
246		fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
247	else
248		fwd_tag = NULL;
249
250	if (fwd_tag != NULL ||
251	    !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
252		if (fwd_tag != NULL) {
253			bcopy((fwd_tag + 1), &dst, sizeof(dst));
254			m->m_flags &= ~M_IP6_NEXTHOP;
255			m_tag_delete(m, fwd_tag);
256		} else
257			dst.sin6_addr = ip6->ip6_dst;
258		/*
259		 * Redo route lookup with new destination address
260		 */
261		if (ip6_findroute(&nh, &dst, m) != 0) {
262			m = NULL;
263			goto dropout;
264		}
265	}
266passout:
267#ifdef IPSTEALTH
268	if (!V_ip6stealth)
269#endif
270	{
271		ip6->ip6_hlim -= IPV6_HLIMDEC;
272	}
273
274	m_clrprotoflags(m);	/* Avoid confusing lower layers. */
275	IP_PROBE(send, NULL, NULL, ip6, nh.nh_ifp, NULL, ip6);
276
277	/*
278	 * XXX: we need to use destination address with embedded scope
279	 * zone id, because LLTABLE uses such form of addresses for lookup.
280	 */
281	dst.sin6_addr = nh.nh_addr;
282	if (IN6_IS_SCOPE_LINKLOCAL(&dst.sin6_addr))
283		dst.sin6_addr.s6_addr16[1] = htons(nh.nh_ifp->if_index & 0xffff);
284
285	error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m,
286	    (struct sockaddr *)&dst, NULL);
287	if (error != 0) {
288		in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
289		IP6STAT_INC(ip6s_cantforward);
290	} else {
291		in6_ifstat_inc(nh.nh_ifp, ifs6_out_forward);
292		IP6STAT_INC(ip6s_forward);
293	}
294	return (NULL);
295dropin:
296	in6_ifstat_inc(rcvif, ifs6_in_discard);
297	goto drop;
298dropout:
299	in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
300drop:
301	if (m != NULL)
302		m_freem(m);
303	return (NULL);
304}
305
306