| 1 | /* $NetBSD: ip6_forward.c,v 1.81 2016/08/31 09:14:47 ozaki-r Exp $ */ |
| 2 | /* $KAME: ip6_forward.c,v 1.109 2002/09/11 08:10:17 sakane Exp $ */ |
| 3 | |
| 4 | /* |
| 5 | * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project. |
| 6 | * All rights reserved. |
| 7 | * |
| 8 | * Redistribution and use in source and binary forms, with or without |
| 9 | * modification, are permitted provided that the following conditions |
| 10 | * are met: |
| 11 | * 1. Redistributions of source code must retain the above copyright |
| 12 | * notice, this list of conditions and the following disclaimer. |
| 13 | * 2. Redistributions in binary form must reproduce the above copyright |
| 14 | * notice, this list of conditions and the following disclaimer in the |
| 15 | * documentation and/or other materials provided with the distribution. |
| 16 | * 3. Neither the name of the project nor the names of its contributors |
| 17 | * may be used to endorse or promote products derived from this software |
| 18 | * without specific prior written permission. |
| 19 | * |
| 20 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
| 21 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 22 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 23 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
| 24 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 25 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 26 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 27 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 28 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 29 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 30 | * SUCH DAMAGE. |
| 31 | */ |
| 32 | |
| 33 | #include <sys/cdefs.h> |
| 34 | __KERNEL_RCSID(0, "$NetBSD: ip6_forward.c,v 1.81 2016/08/31 09:14:47 ozaki-r Exp $" ); |
| 35 | |
| 36 | #ifdef _KERNEL_OPT |
| 37 | #include "opt_gateway.h" |
| 38 | #include "opt_ipsec.h" |
| 39 | #endif |
| 40 | |
| 41 | #include <sys/param.h> |
| 42 | #include <sys/systm.h> |
| 43 | #include <sys/mbuf.h> |
| 44 | #include <sys/domain.h> |
| 45 | #include <sys/protosw.h> |
| 46 | #include <sys/socket.h> |
| 47 | #include <sys/errno.h> |
| 48 | #include <sys/time.h> |
| 49 | #include <sys/kernel.h> |
| 50 | #include <sys/syslog.h> |
| 51 | #include <sys/percpu.h> |
| 52 | |
| 53 | #include <net/if.h> |
| 54 | #include <net/route.h> |
| 55 | #include <net/pfil.h> |
| 56 | |
| 57 | #include <netinet/in.h> |
| 58 | #include <netinet/in_var.h> |
| 59 | #include <netinet/ip_var.h> |
| 60 | #include <netinet/ip6.h> |
| 61 | #include <netinet6/ip6_var.h> |
| 62 | #include <netinet6/ip6_private.h> |
| 63 | #include <netinet6/scope6_var.h> |
| 64 | #include <netinet/icmp6.h> |
| 65 | #include <netinet6/nd6.h> |
| 66 | |
| 67 | #ifdef IPSEC |
| 68 | #include <netipsec/ipsec.h> |
| 69 | #include <netipsec/ipsec6.h> |
| 70 | #include <netipsec/key.h> |
| 71 | #include <netipsec/xform.h> |
| 72 | #endif /* IPSEC */ |
| 73 | |
| 74 | #include <net/net_osdep.h> |
| 75 | |
| 76 | extern percpu_t *ip6_forward_rt_percpu; |
| 77 | |
| 78 | extern pfil_head_t *inet6_pfil_hook; /* XXX */ |
| 79 | |
| 80 | static void __printflike(4, 5) |
| 81 | ip6_cantforward(const struct ip6_hdr *ip6, const struct ifnet *srcifp, |
| 82 | const struct ifnet *dstifp, const char *fmt, ...) |
| 83 | { |
| 84 | char sbuf[INET6_ADDRSTRLEN], dbuf[INET6_ADDRSTRLEN]; |
| 85 | char reason[256]; |
| 86 | va_list ap; |
| 87 | uint64_t *ip6s; |
| 88 | |
| 89 | /* update statistics */ |
| 90 | ip6s = IP6_STAT_GETREF(); |
| 91 | ip6s[IP6_STAT_CANTFORWARD]++; |
| 92 | if (dstifp) |
| 93 | ip6s[IP6_STAT_BADSCOPE]++; |
| 94 | IP6_STAT_PUTREF(); |
| 95 | |
| 96 | if (dstifp) |
| 97 | in6_ifstat_inc(dstifp, ifs6_in_discard); |
| 98 | |
| 99 | if (ip6_log_time + ip6_log_interval >= time_uptime) |
| 100 | return; |
| 101 | ip6_log_time = time_uptime; |
| 102 | |
| 103 | va_start(ap, fmt); |
| 104 | vsnprintf(reason, sizeof(reason), fmt, ap); |
| 105 | va_end(ap); |
| 106 | |
| 107 | log(LOG_DEBUG, "Cannot forward from %s@%s to %s@%s nxt %d (%s)\n" , |
| 108 | IN6_PRINT(sbuf, &ip6->ip6_src), srcifp ? if_name(srcifp) : "?" , |
| 109 | IN6_PRINT(dbuf, &ip6->ip6_dst), dstifp ? if_name(dstifp) : "?" , |
| 110 | ip6->ip6_nxt, reason); |
| 111 | } |
| 112 | |
| 113 | /* |
| 114 | * Forward a packet. If some error occurs return the sender |
| 115 | * an icmp packet. Note we can't always generate a meaningful |
| 116 | * icmp message because icmp doesn't have a large enough repertoire |
| 117 | * of codes and types. |
| 118 | * |
| 119 | * If not forwarding, just drop the packet. This could be confusing |
| 120 | * if ipforwarding was zero but some routing protocol was advancing |
| 121 | * us as a gateway to somewhere. However, we must let the routing |
| 122 | * protocol deal with that. |
| 123 | * |
| 124 | */ |
| 125 | |
| 126 | void |
| 127 | ip6_forward(struct mbuf *m, int srcrt) |
| 128 | { |
| 129 | struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); |
| 130 | const struct sockaddr_in6 *dst; |
| 131 | struct rtentry *rt; |
| 132 | int error = 0, type = 0, code = 0; |
| 133 | struct mbuf *mcopy = NULL; |
| 134 | struct ifnet *origifp; /* maybe unnecessary */ |
| 135 | uint32_t inzone, outzone; |
| 136 | struct in6_addr src_in6, dst_in6; |
| 137 | struct ifnet *rcvif = NULL; |
| 138 | struct psref psref; |
| 139 | struct route *ro; |
| 140 | #ifdef IPSEC |
| 141 | int needipsec = 0; |
| 142 | struct secpolicy *sp = NULL; |
| 143 | #endif |
| 144 | |
| 145 | /* |
| 146 | * Clear any in-bound checksum flags for this packet. |
| 147 | */ |
| 148 | m->m_pkthdr.csum_flags = 0; |
| 149 | |
| 150 | rcvif = m_get_rcvif_psref(m, &psref); |
| 151 | if (__predict_false(rcvif == NULL)) |
| 152 | goto drop; |
| 153 | |
| 154 | /* |
| 155 | * Do not forward packets to multicast destination (should be handled |
| 156 | * by ip6_mforward(). |
| 157 | * Do not forward packets with unspecified source. It was discussed |
| 158 | * in July 2000, on ipngwg mailing list. |
| 159 | */ |
| 160 | if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 || |
| 161 | IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || |
| 162 | IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { |
| 163 | ip6_cantforward(ip6, rcvif, NULL, |
| 164 | ((m->m_flags & (M_BCAST|M_MCAST)) != 0) ? "bcast/mcast" : |
| 165 | IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ? "mcast/dst" : |
| 166 | "unspec/src" ); |
| 167 | goto drop; |
| 168 | } |
| 169 | |
| 170 | if (ip6->ip6_hlim <= IPV6_HLIMDEC) { |
| 171 | /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */ |
| 172 | icmp6_error(m, ICMP6_TIME_EXCEEDED, |
| 173 | ICMP6_TIME_EXCEED_TRANSIT, 0); |
| 174 | goto out; |
| 175 | } |
| 176 | ip6->ip6_hlim -= IPV6_HLIMDEC; |
| 177 | |
| 178 | /* |
| 179 | * Save at most ICMPV6_PLD_MAXLEN (= the min IPv6 MTU - |
| 180 | * size of IPv6 + ICMPv6 headers) bytes of the packet in case |
| 181 | * we need to generate an ICMP6 message to the src. |
| 182 | * Thanks to M_EXT, in most cases copy will not occur. |
| 183 | * |
| 184 | * It is important to save it before IPsec processing as IPsec |
| 185 | * processing may modify the mbuf. |
| 186 | */ |
| 187 | mcopy = m_copy(m, 0, imin(m->m_pkthdr.len, ICMPV6_PLD_MAXLEN)); |
| 188 | |
| 189 | #ifdef IPSEC |
| 190 | if (ipsec_used) { |
| 191 | /* Check the security policy (SP) for the packet */ |
| 192 | |
| 193 | sp = ipsec6_check_policy(m, NULL, 0, &needipsec, &error); |
| 194 | if (error != 0) { |
| 195 | /* |
| 196 | * Hack: -EINVAL is used to signal that a packet |
| 197 | * should be silently discarded. This is typically |
| 198 | * because we asked key management for an SA and |
| 199 | * it was delayed (e.g. kicked up to IKE). |
| 200 | */ |
| 201 | if (error == -EINVAL) |
| 202 | error = 0; |
| 203 | goto freecopy; |
| 204 | } |
| 205 | } |
| 206 | #endif /* IPSEC */ |
| 207 | |
| 208 | ro = percpu_getref(ip6_forward_rt_percpu); |
| 209 | if (srcrt) { |
| 210 | union { |
| 211 | struct sockaddr dst; |
| 212 | struct sockaddr_in6 dst6; |
| 213 | } u; |
| 214 | |
| 215 | sockaddr_in6_init(&u.dst6, &ip6->ip6_dst, 0, 0, 0); |
| 216 | if ((rt = rtcache_lookup(ro, &u.dst)) == NULL) { |
| 217 | IP6_STATINC(IP6_STAT_NOROUTE); |
| 218 | /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_noroute) */ |
| 219 | if (mcopy) { |
| 220 | icmp6_error(mcopy, ICMP6_DST_UNREACH, |
| 221 | ICMP6_DST_UNREACH_NOROUTE, 0); |
| 222 | } |
| 223 | percpu_putref(ip6_forward_rt_percpu); |
| 224 | goto drop; |
| 225 | } |
| 226 | } else if ((rt = rtcache_validate(ro)) == NULL && |
| 227 | (rt = rtcache_update(ro, 1)) == NULL) { |
| 228 | /* |
| 229 | * rtcache_getdst(ip6_forward_rt)->sin6_addr was equal to |
| 230 | * ip6->ip6_dst |
| 231 | */ |
| 232 | IP6_STATINC(IP6_STAT_NOROUTE); |
| 233 | /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_noroute) */ |
| 234 | if (mcopy) { |
| 235 | icmp6_error(mcopy, ICMP6_DST_UNREACH, |
| 236 | ICMP6_DST_UNREACH_NOROUTE, 0); |
| 237 | } |
| 238 | percpu_putref(ip6_forward_rt_percpu); |
| 239 | goto drop; |
| 240 | } |
| 241 | dst = satocsin6(rtcache_getdst(ro)); |
| 242 | percpu_putref(ip6_forward_rt_percpu); |
| 243 | |
| 244 | /* |
| 245 | * Source scope check: if a packet can't be delivered to its |
| 246 | * destination for the reason that the destination is beyond the scope |
| 247 | * of the source address, discard the packet and return an icmp6 |
| 248 | * destination unreachable error with Code 2 (beyond scope of source |
| 249 | * address). We use a local copy of ip6_src, since in6_setscope() |
| 250 | * will possibly modify its first argument. |
| 251 | * [draft-ietf-ipngwg-icmp-v3-07, Section 3.1] |
| 252 | */ |
| 253 | src_in6 = ip6->ip6_src; |
| 254 | inzone = outzone = ~0; |
| 255 | if (in6_setscope(&src_in6, rt->rt_ifp, &outzone) != 0 || |
| 256 | in6_setscope(&src_in6, rcvif, &inzone) != 0 || |
| 257 | inzone != outzone) { |
| 258 | ip6_cantforward(ip6, rcvif, rt->rt_ifp, |
| 259 | "src[%s] inzone %d outzone %d" , |
| 260 | in6_getscopename(&ip6->ip6_src), inzone, outzone); |
| 261 | if (mcopy) |
| 262 | icmp6_error(mcopy, ICMP6_DST_UNREACH, |
| 263 | ICMP6_DST_UNREACH_BEYONDSCOPE, 0); |
| 264 | goto drop; |
| 265 | } |
| 266 | |
| 267 | #ifdef IPSEC |
| 268 | /* |
| 269 | * If we need to encapsulate the packet, do it here |
| 270 | * ipsec6_proces_packet will send the packet using ip6_output |
| 271 | */ |
| 272 | if (needipsec) { |
| 273 | int s = splsoftnet(); |
| 274 | error = ipsec6_process_packet(m, sp->req); |
| 275 | splx(s); |
| 276 | if (mcopy) |
| 277 | goto freecopy; |
| 278 | } |
| 279 | #endif |
| 280 | |
| 281 | /* |
| 282 | * Destination scope check: if a packet is going to break the scope |
| 283 | * zone of packet's destination address, discard it. This case should |
| 284 | * usually be prevented by appropriately-configured routing table, but |
| 285 | * we need an explicit check because we may mistakenly forward the |
| 286 | * packet to a different zone by (e.g.) a default route. |
| 287 | */ |
| 288 | dst_in6 = ip6->ip6_dst; |
| 289 | inzone = outzone = ~0; |
| 290 | if (in6_setscope(&dst_in6, rcvif, &inzone) != 0 || |
| 291 | in6_setscope(&dst_in6, rt->rt_ifp, &outzone) != 0 || |
| 292 | inzone != outzone) { |
| 293 | ip6_cantforward(ip6, rcvif, rt->rt_ifp, |
| 294 | "dst[%s] inzone %d outzone %d" , |
| 295 | in6_getscopename(&ip6->ip6_dst), inzone, outzone); |
| 296 | if (mcopy) |
| 297 | icmp6_error(mcopy, ICMP6_DST_UNREACH, |
| 298 | ICMP6_DST_UNREACH_BEYONDSCOPE, 0); |
| 299 | goto drop; |
| 300 | } |
| 301 | |
| 302 | if (m->m_pkthdr.len > IN6_LINKMTU(rt->rt_ifp)) { |
| 303 | in6_ifstat_inc(rt->rt_ifp, ifs6_in_toobig); |
| 304 | if (mcopy) { |
| 305 | u_long mtu; |
| 306 | |
| 307 | mtu = IN6_LINKMTU(rt->rt_ifp); |
| 308 | icmp6_error(mcopy, ICMP6_PACKET_TOO_BIG, 0, mtu); |
| 309 | } |
| 310 | goto drop; |
| 311 | } |
| 312 | |
| 313 | if (rt->rt_flags & RTF_GATEWAY) |
| 314 | dst = (struct sockaddr_in6 *)rt->rt_gateway; |
| 315 | |
| 316 | /* |
| 317 | * If we are to forward the packet using the same interface |
| 318 | * as one we got the packet from, perhaps we should send a redirect |
| 319 | * to sender to shortcut a hop. |
| 320 | * Only send redirect if source is sending directly to us, |
| 321 | * and if packet was not source routed (or has any options). |
| 322 | * Also, don't send redirect if forwarding using a route |
| 323 | * modified by a redirect. |
| 324 | */ |
| 325 | if (rt->rt_ifp == rcvif && !srcrt && ip6_sendredirects && |
| 326 | (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0) { |
| 327 | ro = percpu_getref(ip6_forward_rt_percpu); |
| 328 | if ((rt->rt_ifp->if_flags & IFF_POINTOPOINT) && |
| 329 | nd6_is_addr_neighbor(satocsin6(rtcache_getdst(ro)), |
| 330 | rt->rt_ifp)) { |
| 331 | percpu_putref(ip6_forward_rt_percpu); |
| 332 | /* |
| 333 | * If the incoming interface is equal to the outgoing |
| 334 | * one, the link attached to the interface is |
| 335 | * point-to-point, and the IPv6 destination is |
| 336 | * regarded as on-link on the link, then it will be |
| 337 | * highly probable that the destination address does |
| 338 | * not exist on the link and that the packet is going |
| 339 | * to loop. Thus, we immediately drop the packet and |
| 340 | * send an ICMPv6 error message. |
| 341 | * For other routing loops, we dare to let the packet |
| 342 | * go to the loop, so that a remote diagnosing host |
| 343 | * can detect the loop by traceroute. |
| 344 | * type/code is based on suggestion by Rich Draves. |
| 345 | * not sure if it is the best pick. |
| 346 | */ |
| 347 | icmp6_error(mcopy, ICMP6_DST_UNREACH, |
| 348 | ICMP6_DST_UNREACH_ADDR, 0); |
| 349 | goto drop; |
| 350 | } |
| 351 | percpu_putref(ip6_forward_rt_percpu); |
| 352 | type = ND_REDIRECT; |
| 353 | } |
| 354 | |
| 355 | /* |
| 356 | * Fake scoped addresses. Note that even link-local source or |
| 357 | * destinaion can appear, if the originating node just sends the |
| 358 | * packet to us (without address resolution for the destination). |
| 359 | * Since both icmp6_error and icmp6_redirect_output fill the embedded |
| 360 | * link identifiers, we can do this stuff after making a copy for |
| 361 | * returning an error. |
| 362 | */ |
| 363 | if ((rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) { |
| 364 | /* |
| 365 | * See corresponding comments in ip6_output. |
| 366 | * XXX: but is it possible that ip6_forward() sends a packet |
| 367 | * to a loopback interface? I don't think so, and thus |
| 368 | * I bark here. (jinmei@kame.net) |
| 369 | * XXX: it is common to route invalid packets to loopback. |
| 370 | * also, the codepath will be visited on use of ::1 in |
| 371 | * rthdr. (itojun) |
| 372 | */ |
| 373 | #if 1 |
| 374 | if (0) |
| 375 | #else |
| 376 | if ((rt->rt_flags & (RTF_BLACKHOLE|RTF_REJECT)) == 0) |
| 377 | #endif |
| 378 | { |
| 379 | printf("ip6_forward: outgoing interface is loopback. " |
| 380 | "src %s, dst %s, nxt %d, rcvif %s, outif %s\n" , |
| 381 | ip6_sprintf(&ip6->ip6_src), |
| 382 | ip6_sprintf(&ip6->ip6_dst), |
| 383 | ip6->ip6_nxt, if_name(rcvif), |
| 384 | if_name(rt->rt_ifp)); |
| 385 | } |
| 386 | |
| 387 | /* we can just use rcvif in forwarding. */ |
| 388 | origifp = rcvif; |
| 389 | } |
| 390 | else |
| 391 | origifp = rt->rt_ifp; |
| 392 | /* |
| 393 | * clear embedded scope identifiers if necessary. |
| 394 | * in6_clearscope will touch the addresses only when necessary. |
| 395 | */ |
| 396 | in6_clearscope(&ip6->ip6_src); |
| 397 | in6_clearscope(&ip6->ip6_dst); |
| 398 | |
| 399 | /* |
| 400 | * Run through list of hooks for output packets. |
| 401 | */ |
| 402 | if ((error = pfil_run_hooks(inet6_pfil_hook, &m, rt->rt_ifp, |
| 403 | PFIL_OUT)) != 0) |
| 404 | goto senderr; |
| 405 | if (m == NULL) |
| 406 | goto freecopy; |
| 407 | ip6 = mtod(m, struct ip6_hdr *); |
| 408 | |
| 409 | error = nd6_output(rt->rt_ifp, origifp, m, dst, rt); |
| 410 | if (error) { |
| 411 | in6_ifstat_inc(rt->rt_ifp, ifs6_out_discard); |
| 412 | IP6_STATINC(IP6_STAT_CANTFORWARD); |
| 413 | } else { |
| 414 | IP6_STATINC(IP6_STAT_FORWARD); |
| 415 | in6_ifstat_inc(rt->rt_ifp, ifs6_out_forward); |
| 416 | if (type) |
| 417 | IP6_STATINC(IP6_STAT_REDIRECTSENT); |
| 418 | else { |
| 419 | #ifdef GATEWAY |
| 420 | ro = percpu_getref(ip6_forward_rt_percpu); |
| 421 | if (m->m_flags & M_CANFASTFWD) |
| 422 | ip6flow_create(ro, m); |
| 423 | percpu_putref(ip6_forward_rt_percpu); |
| 424 | #endif |
| 425 | if (mcopy) |
| 426 | goto freecopy; |
| 427 | } |
| 428 | } |
| 429 | |
| 430 | senderr: |
| 431 | if (mcopy == NULL) |
| 432 | goto out; |
| 433 | switch (error) { |
| 434 | case 0: |
| 435 | if (type == ND_REDIRECT) { |
| 436 | icmp6_redirect_output(mcopy, rt); |
| 437 | goto out; |
| 438 | } |
| 439 | goto freecopy; |
| 440 | |
| 441 | case EMSGSIZE: |
| 442 | /* xxx MTU is constant in PPP? */ |
| 443 | goto freecopy; |
| 444 | |
| 445 | case ENOBUFS: |
| 446 | /* Tell source to slow down like source quench in IP? */ |
| 447 | goto freecopy; |
| 448 | |
| 449 | case ENETUNREACH: /* shouldn't happen, checked above */ |
| 450 | case EHOSTUNREACH: |
| 451 | case ENETDOWN: |
| 452 | case EHOSTDOWN: |
| 453 | default: |
| 454 | type = ICMP6_DST_UNREACH; |
| 455 | code = ICMP6_DST_UNREACH_ADDR; |
| 456 | break; |
| 457 | } |
| 458 | icmp6_error(mcopy, type, code, 0); |
| 459 | goto out; |
| 460 | |
| 461 | freecopy: |
| 462 | m_freem(mcopy); |
| 463 | goto out; |
| 464 | drop: |
| 465 | m_freem(m); |
| 466 | out: |
| 467 | if (rcvif != NULL) |
| 468 | m_put_rcvif_psref(rcvif, &psref); |
| 469 | return; |
| 470 | } |
| 471 | |