1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2003 Andre Oppermann, Internet Business Solutions AG 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * ip_fastforward gets its speed from processing the forwarded packet to 34 * completion (if_output on the other side) without any queues or netisr's. 35 * The receiving interface DMAs the packet into memory, the upper half of 36 * driver calls ip_fastforward, we do our routing table lookup and directly 37 * send it off to the outgoing interface, which DMAs the packet to the 38 * network card. The only part of the packet we touch with the CPU is the 39 * IP header (unless there are complex firewall rules touching other parts 40 * of the packet, but that is up to you). We are essentially limited by bus 41 * bandwidth and how fast the network card/driver can set up receives and 42 * transmits. 43 * 44 * We handle basic errors, IP header errors, checksum errors, 45 * destination unreachable, fragmentation and fragmentation needed and 46 * report them via ICMP to the sender. 47 * 48 * Else if something is not pure IPv4 unicast forwarding we fall back to 49 * the normal ip_input processing path. We should only be called from 50 * interfaces connected to the outside world. 51 * 52 * Firewalling is fully supported including divert, ipfw fwd and ipfilter 53 * ipnat and address rewrite. 54 * 55 * IPSEC is not supported if this host is a tunnel broker. IPSEC is 56 * supported for connections to/from local host. 57 * 58 * We try to do the least expensive (in CPU ops) checks and operations 59 * first to catch junk with as little overhead as possible. 60 * 61 * We take full advantage of hardware support for IP checksum and 62 * fragmentation offloading. 63 * 64 * We don't do ICMP redirect in the fast forwarding path. I have had my own 65 * cases where two core routers with Zebra routing suite would send millions 66 * ICMP redirects to connected hosts if the destination router was not the 67 * default gateway. In one case it was filling the routing table of a host 68 * with approximately 300.000 cloned redirect entries until it ran out of 69 * kernel memory. However the networking code proved very robust and it didn't 70 * crash or fail in other ways. 71 */ 72 73 /* 74 * Many thanks to Matt Thomas of NetBSD for basic structure of ip_flow.c which 75 * is being followed here. 76 */ 77 78 #include <sys/cdefs.h> 79 __FBSDID("$FreeBSD$"); 80 81 #include "opt_ipstealth.h" 82 83 #include <sys/param.h> 84 #include <sys/systm.h> 85 #include <sys/kernel.h> 86 #include <sys/malloc.h> 87 #include <sys/mbuf.h> 88 #include <sys/protosw.h> 89 #include <sys/sdt.h> 90 #include <sys/socket.h> 91 #include <sys/sysctl.h> 92 93 #include <net/pfil.h> 94 #include <net/if.h> 95 #include <net/if_types.h> 96 #include <net/if_var.h> 97 #include <net/if_dl.h> 98 #include <net/route.h> 99 #include <net/vnet.h> 100 101 #include <netinet/in.h> 102 #include <netinet/in_fib.h> 103 #include <netinet/in_kdtrace.h> 104 #include <netinet/in_systm.h> 105 #include <netinet/in_var.h> 106 #include <netinet/ip.h> 107 #include <netinet/ip_var.h> 108 #include <netinet/ip_icmp.h> 109 #include <netinet/ip_options.h> 110 111 #include <machine/in_cksum.h> 112 113 static int 114 ip_findroute(struct nhop4_basic *pnh, struct in_addr dest, struct mbuf *m) 115 { 116 117 bzero(pnh, sizeof(*pnh)); 118 if (fib4_lookup_nh_basic(M_GETFIB(m), dest, 0, 0, pnh) != 0) { 119 IPSTAT_INC(ips_noroute); 120 IPSTAT_INC(ips_cantforward); 121 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 122 return (EHOSTUNREACH); 123 } 124 /* 125 * Drop blackholed traffic and directed broadcasts. 126 */ 127 if ((pnh->nh_flags & (NHF_BLACKHOLE | NHF_BROADCAST)) != 0) { 128 IPSTAT_INC(ips_cantforward); 129 m_freem(m); 130 return (EHOSTUNREACH); 131 } 132 133 if (pnh->nh_flags & NHF_REJECT) { 134 IPSTAT_INC(ips_cantforward); 135 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 136 return (EHOSTUNREACH); 137 } 138 139 return (0); 140 } 141 142 /* 143 * Try to forward a packet based on the destination address. 144 * This is a fast path optimized for the plain forwarding case. 145 * If the packet is handled (and consumed) here then we return NULL; 146 * otherwise mbuf is returned and the packet should be delivered 147 * to ip_input for full processing. 148 */ 149 struct mbuf * 150 ip_tryforward(struct mbuf *m) 151 { 152 struct ip *ip; 153 struct mbuf *m0 = NULL; 154 struct nhop4_basic nh; 155 struct sockaddr_in dst; 156 struct in_addr odest, dest; 157 uint16_t ip_len, ip_off; 158 int error = 0; 159 struct m_tag *fwd_tag = NULL; 160 161 /* 162 * Are we active and forwarding packets? 163 */ 164 165 M_ASSERTVALID(m); 166 M_ASSERTPKTHDR(m); 167 168 #ifdef ALTQ 169 /* 170 * Is packet dropped by traffic conditioner? 171 */ 172 if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) 173 goto drop; 174 #endif 175 176 /* 177 * Only IP packets without options 178 */ 179 ip = mtod(m, struct ip *); 180 181 if (ip->ip_hl != (sizeof(struct ip) >> 2)) { 182 if (V_ip_doopts == 1) 183 return m; 184 else if (V_ip_doopts == 2) { 185 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB, 186 0, 0); 187 return NULL; /* mbuf already free'd */ 188 } 189 /* else ignore IP options and continue */ 190 } 191 192 /* 193 * Only unicast IP, not from loopback, no L2 or IP broadcast, 194 * no multicast, no INADDR_ANY 195 * 196 * XXX: Probably some of these checks could be direct drop 197 * conditions. However it is not clear whether there are some 198 * hacks or obscure behaviours which make it necessary to 199 * let ip_input handle it. We play safe here and let ip_input 200 * deal with it until it is proven that we can directly drop it. 201 */ 202 if ((m->m_flags & (M_BCAST|M_MCAST)) || 203 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) || 204 ntohl(ip->ip_src.s_addr) == (u_long)INADDR_BROADCAST || 205 ntohl(ip->ip_dst.s_addr) == (u_long)INADDR_BROADCAST || 206 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 207 IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 208 IN_LINKLOCAL(ntohl(ip->ip_src.s_addr)) || 209 IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr)) || 210 ip->ip_src.s_addr == INADDR_ANY || 211 ip->ip_dst.s_addr == INADDR_ANY ) 212 return m; 213 214 /* 215 * Is it for a local address on this host? 216 */ 217 if (in_localip(ip->ip_dst)) 218 return m; 219 220 IPSTAT_INC(ips_total); 221 222 /* 223 * Step 3: incoming packet firewall processing 224 */ 225 226 odest.s_addr = dest.s_addr = ip->ip_dst.s_addr; 227 228 /* 229 * Run through list of ipfilter hooks for input packets 230 */ 231 if (!PFIL_HOOKED(&V_inet_pfil_hook)) 232 goto passin; 233 234 if (pfil_run_hooks( 235 &V_inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN, 0, NULL) || 236 m == NULL) 237 goto drop; 238 239 M_ASSERTVALID(m); 240 M_ASSERTPKTHDR(m); 241 242 ip = mtod(m, struct ip *); /* m may have changed by pfil hook */ 243 dest.s_addr = ip->ip_dst.s_addr; 244 245 /* 246 * Destination address changed? 247 */ 248 if (odest.s_addr != dest.s_addr) { 249 /* 250 * Is it now for a local address on this host? 251 */ 252 if (in_localip(dest)) 253 goto forwardlocal; 254 /* 255 * Go on with new destination address 256 */ 257 } 258 259 if (m->m_flags & M_FASTFWD_OURS) { 260 /* 261 * ipfw changed it for a local address on this host. 262 */ 263 goto forwardlocal; 264 } 265 266 passin: 267 /* 268 * Step 4: decrement TTL and look up route 269 */ 270 271 /* 272 * Check TTL 273 */ 274 #ifdef IPSTEALTH 275 if (!V_ipstealth) { 276 #endif 277 if (ip->ip_ttl <= IPTTLDEC) { 278 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, 0); 279 return NULL; /* mbuf already free'd */ 280 } 281 282 /* 283 * Decrement the TTL and incrementally change the IP header checksum. 284 * Don't bother doing this with hw checksum offloading, it's faster 285 * doing it right here. 286 */ 287 ip->ip_ttl -= IPTTLDEC; 288 if (ip->ip_sum >= (u_int16_t) ~htons(IPTTLDEC << 8)) 289 ip->ip_sum -= ~htons(IPTTLDEC << 8); 290 else 291 ip->ip_sum += htons(IPTTLDEC << 8); 292 #ifdef IPSTEALTH 293 } 294 #endif 295 296 /* 297 * Find route to destination. 298 */ 299 if (ip_findroute(&nh, dest, m) != 0) 300 return (NULL); /* icmp unreach already sent */ 301 302 /* 303 * Step 5: outgoing firewall packet processing 304 */ 305 if (!PFIL_HOOKED(&V_inet_pfil_hook)) 306 goto passout; 307 308 if (pfil_run_hooks(&V_inet_pfil_hook, &m, nh.nh_ifp, PFIL_OUT, PFIL_FWD, 309 NULL) || m == NULL) { 310 goto drop; 311 } 312 313 M_ASSERTVALID(m); 314 M_ASSERTPKTHDR(m); 315 316 ip = mtod(m, struct ip *); 317 dest.s_addr = ip->ip_dst.s_addr; 318 319 /* 320 * Destination address changed? 321 */ 322 if (m->m_flags & M_IP_NEXTHOP) 323 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); 324 if (odest.s_addr != dest.s_addr || fwd_tag != NULL) { 325 /* 326 * Is it now for a local address on this host? 327 */ 328 if (m->m_flags & M_FASTFWD_OURS || in_localip(dest)) { 329 forwardlocal: 330 /* 331 * Return packet for processing by ip_input(). 332 */ 333 m->m_flags |= M_FASTFWD_OURS; 334 return (m); 335 } 336 /* 337 * Redo route lookup with new destination address 338 */ 339 if (fwd_tag) { 340 dest.s_addr = ((struct sockaddr_in *) 341 (fwd_tag + 1))->sin_addr.s_addr; 342 m_tag_delete(m, fwd_tag); 343 m->m_flags &= ~M_IP_NEXTHOP; 344 } 345 if (ip_findroute(&nh, dest, m) != 0) 346 return (NULL); /* icmp unreach already sent */ 347 } 348 349 passout: 350 /* 351 * Step 6: send off the packet 352 */ 353 ip_len = ntohs(ip->ip_len); 354 ip_off = ntohs(ip->ip_off); 355 356 bzero(&dst, sizeof(dst)); 357 dst.sin_family = AF_INET; 358 dst.sin_len = sizeof(dst); 359 dst.sin_addr = nh.nh_addr; 360 361 /* 362 * Check if packet fits MTU or if hardware will fragment for us 363 */ 364 if (ip_len <= nh.nh_mtu) { 365 /* 366 * Avoid confusing lower layers. 367 */ 368 m_clrprotoflags(m); 369 /* 370 * Send off the packet via outgoing interface 371 */ 372 IP_PROBE(send, NULL, NULL, ip, nh.nh_ifp, ip, NULL); 373 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m, 374 (struct sockaddr *)&dst, NULL); 375 } else { 376 /* 377 * Handle EMSGSIZE with icmp reply needfrag for TCP MTU discovery 378 */ 379 if (ip_off & IP_DF) { 380 IPSTAT_INC(ips_cantfrag); 381 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 382 0, nh.nh_mtu); 383 goto consumed; 384 } else { 385 /* 386 * We have to fragment the packet 387 */ 388 m->m_pkthdr.csum_flags |= CSUM_IP; 389 if (ip_fragment(ip, &m, nh.nh_mtu, 390 nh.nh_ifp->if_hwassist) != 0) 391 goto drop; 392 KASSERT(m != NULL, ("null mbuf and no error")); 393 /* 394 * Send off the fragments via outgoing interface 395 */ 396 error = 0; 397 do { 398 m0 = m->m_nextpkt; 399 m->m_nextpkt = NULL; 400 /* 401 * Avoid confusing lower layers. 402 */ 403 m_clrprotoflags(m); 404 405 IP_PROBE(send, NULL, NULL, 406 mtod(m, struct ip *), nh.nh_ifp, 407 mtod(m, struct ip *), NULL); 408 /* XXX: we can use cached route here */ 409 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m, 410 (struct sockaddr *)&dst, NULL); 411 if (error) 412 break; 413 } while ((m = m0) != NULL); 414 if (error) { 415 /* Reclaim remaining fragments */ 416 for (m = m0; m; m = m0) { 417 m0 = m->m_nextpkt; 418 m_freem(m); 419 } 420 } else 421 IPSTAT_INC(ips_fragmented); 422 } 423 } 424 425 if (error != 0) 426 IPSTAT_INC(ips_odropped); 427 else { 428 IPSTAT_INC(ips_forward); 429 IPSTAT_INC(ips_fastforward); 430 } 431 consumed: 432 return NULL; 433 drop: 434 if (m) 435 m_freem(m); 436 return NULL; 437 } 438