1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 2003 Andre Oppermann, Internet Business Solutions AG 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote 16 * products derived from this software without specific prior written 17 * permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 /* 33 * ip_fastforward gets its speed from processing the forwarded packet to 34 * completion (if_output on the other side) without any queues or netisr's. 35 * The receiving interface DMAs the packet into memory, the upper half of 36 * driver calls ip_fastforward, we do our routing table lookup and directly 37 * send it off to the outgoing interface, which DMAs the packet to the 38 * network card. The only part of the packet we touch with the CPU is the 39 * IP header (unless there are complex firewall rules touching other parts 40 * of the packet, but that is up to you). We are essentially limited by bus 41 * bandwidth and how fast the network card/driver can set up receives and 42 * transmits. 43 * 44 * We handle basic errors, IP header errors, checksum errors, 45 * destination unreachable, fragmentation and fragmentation needed and 46 * report them via ICMP to the sender. 47 * 48 * Else if something is not pure IPv4 unicast forwarding we fall back to 49 * the normal ip_input processing path. We should only be called from 50 * interfaces connected to the outside world. 51 * 52 * Firewalling is fully supported including divert, ipfw fwd and ipfilter 53 * ipnat and address rewrite. 54 * 55 * IPSEC is not supported if this host is a tunnel broker. IPSEC is 56 * supported for connections to/from local host. 57 * 58 * We try to do the least expensive (in CPU ops) checks and operations 59 * first to catch junk with as little overhead as possible. 60 * 61 * We take full advantage of hardware support for IP checksum and 62 * fragmentation offloading. 63 * 64 * We don't do ICMP redirect in the fast forwarding path. I have had my own 65 * cases where two core routers with Zebra routing suite would send millions 66 * ICMP redirects to connected hosts if the destination router was not the 67 * default gateway. In one case it was filling the routing table of a host 68 * with approximately 300.000 cloned redirect entries until it ran out of 69 * kernel memory. However the networking code proved very robust and it didn't 70 * crash or fail in other ways. 71 */ 72 73 /* 74 * Many thanks to Matt Thomas of NetBSD for basic structure of ip_flow.c which 75 * is being followed here. 76 */ 77 78 #include <sys/cdefs.h> 79 __FBSDID("$FreeBSD$"); 80 81 #include "opt_ipstealth.h" 82 83 #include <sys/param.h> 84 #include <sys/systm.h> 85 #include <sys/kernel.h> 86 #include <sys/malloc.h> 87 #include <sys/mbuf.h> 88 #include <sys/protosw.h> 89 #include <sys/sdt.h> 90 #include <sys/socket.h> 91 #include <sys/sysctl.h> 92 93 #include <net/pfil.h> 94 #include <net/if.h> 95 #include <net/if_types.h> 96 #include <net/if_var.h> 97 #include <net/if_dl.h> 98 #include <net/route.h> 99 #include <net/vnet.h> 100 101 #include <netinet/in.h> 102 #include <netinet/in_fib.h> 103 #include <netinet/in_kdtrace.h> 104 #include <netinet/in_systm.h> 105 #include <netinet/in_var.h> 106 #include <netinet/ip.h> 107 #include <netinet/ip_var.h> 108 #include <netinet/ip_icmp.h> 109 #include <netinet/ip_options.h> 110 111 #include <machine/in_cksum.h> 112 113 static int 114 ip_findroute(struct nhop4_basic *pnh, struct in_addr dest, struct mbuf *m) 115 { 116 117 bzero(pnh, sizeof(*pnh)); 118 if (fib4_lookup_nh_basic(M_GETFIB(m), dest, 0, 0, pnh) != 0) { 119 IPSTAT_INC(ips_noroute); 120 IPSTAT_INC(ips_cantforward); 121 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 122 return (EHOSTUNREACH); 123 } 124 /* 125 * Drop blackholed traffic and directed broadcasts. 126 */ 127 if ((pnh->nh_flags & (NHF_BLACKHOLE | NHF_BROADCAST)) != 0) { 128 IPSTAT_INC(ips_cantforward); 129 m_freem(m); 130 return (EHOSTUNREACH); 131 } 132 133 if (pnh->nh_flags & NHF_REJECT) { 134 IPSTAT_INC(ips_cantforward); 135 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_HOST, 0, 0); 136 return (EHOSTUNREACH); 137 } 138 139 return (0); 140 } 141 142 /* 143 * Try to forward a packet based on the destination address. 144 * This is a fast path optimized for the plain forwarding case. 145 * If the packet is handled (and consumed) here then we return NULL; 146 * otherwise mbuf is returned and the packet should be delivered 147 * to ip_input for full processing. 148 */ 149 struct mbuf * 150 ip_tryforward(struct mbuf *m) 151 { 152 struct ip *ip; 153 struct mbuf *m0 = NULL; 154 struct nhop4_basic nh; 155 struct sockaddr_in dst; 156 struct in_addr dest, odest, rtdest; 157 uint16_t ip_len, ip_off; 158 int error = 0; 159 struct m_tag *fwd_tag = NULL; 160 161 /* 162 * Are we active and forwarding packets? 163 */ 164 165 M_ASSERTVALID(m); 166 M_ASSERTPKTHDR(m); 167 168 #ifdef ALTQ 169 /* 170 * Is packet dropped by traffic conditioner? 171 */ 172 if (altq_input != NULL && (*altq_input)(m, AF_INET) == 0) 173 goto drop; 174 #endif 175 176 /* 177 * Only IP packets without options 178 */ 179 ip = mtod(m, struct ip *); 180 181 if (ip->ip_hl != (sizeof(struct ip) >> 2)) { 182 if (V_ip_doopts == 1) 183 return m; 184 else if (V_ip_doopts == 2) { 185 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_FILTER_PROHIB, 186 0, 0); 187 return NULL; /* mbuf already free'd */ 188 } 189 /* else ignore IP options and continue */ 190 } 191 192 /* 193 * Only unicast IP, not from loopback, no L2 or IP broadcast, 194 * no multicast, no INADDR_ANY 195 * 196 * XXX: Probably some of these checks could be direct drop 197 * conditions. However it is not clear whether there are some 198 * hacks or obscure behaviours which make it necessary to 199 * let ip_input handle it. We play safe here and let ip_input 200 * deal with it until it is proven that we can directly drop it. 201 */ 202 if ((m->m_flags & (M_BCAST|M_MCAST)) || 203 (m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK) || 204 ntohl(ip->ip_src.s_addr) == (u_long)INADDR_BROADCAST || 205 ntohl(ip->ip_dst.s_addr) == (u_long)INADDR_BROADCAST || 206 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || 207 IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || 208 IN_LINKLOCAL(ntohl(ip->ip_src.s_addr)) || 209 IN_LINKLOCAL(ntohl(ip->ip_dst.s_addr)) || 210 ip->ip_src.s_addr == INADDR_ANY || 211 ip->ip_dst.s_addr == INADDR_ANY ) 212 return m; 213 214 /* 215 * Is it for a local address on this host? 216 */ 217 if (in_localip(ip->ip_dst)) 218 return m; 219 220 IPSTAT_INC(ips_total); 221 222 /* 223 * Step 3: incoming packet firewall processing 224 */ 225 226 odest.s_addr = dest.s_addr = ip->ip_dst.s_addr; 227 228 /* 229 * Run through list of ipfilter hooks for input packets 230 */ 231 if (!PFIL_HOOKED(&V_inet_pfil_hook)) 232 goto passin; 233 234 if (pfil_run_hooks( 235 &V_inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN, 0, NULL) || 236 m == NULL) 237 goto drop; 238 239 M_ASSERTVALID(m); 240 M_ASSERTPKTHDR(m); 241 242 ip = mtod(m, struct ip *); /* m may have changed by pfil hook */ 243 dest.s_addr = ip->ip_dst.s_addr; 244 245 /* 246 * Destination address changed? 247 */ 248 if (odest.s_addr != dest.s_addr) { 249 /* 250 * Is it now for a local address on this host? 251 */ 252 if (in_localip(dest)) 253 goto forwardlocal; 254 /* 255 * Go on with new destination address 256 */ 257 } 258 259 if (m->m_flags & M_FASTFWD_OURS) { 260 /* 261 * ipfw changed it for a local address on this host. 262 */ 263 goto forwardlocal; 264 } 265 266 passin: 267 /* 268 * Step 4: decrement TTL and look up route 269 */ 270 271 /* 272 * Check TTL 273 */ 274 #ifdef IPSTEALTH 275 if (!V_ipstealth) { 276 #endif 277 if (ip->ip_ttl <= IPTTLDEC) { 278 icmp_error(m, ICMP_TIMXCEED, ICMP_TIMXCEED_INTRANS, 0, 0); 279 return NULL; /* mbuf already free'd */ 280 } 281 282 /* 283 * Decrement the TTL and incrementally change the IP header checksum. 284 * Don't bother doing this with hw checksum offloading, it's faster 285 * doing it right here. 286 */ 287 ip->ip_ttl -= IPTTLDEC; 288 if (ip->ip_sum >= (u_int16_t) ~htons(IPTTLDEC << 8)) 289 ip->ip_sum -= ~htons(IPTTLDEC << 8); 290 else 291 ip->ip_sum += htons(IPTTLDEC << 8); 292 #ifdef IPSTEALTH 293 } 294 #endif 295 296 /* 297 * Next hop forced by pfil(9) hook? 298 */ 299 if ((m->m_flags & M_IP_NEXTHOP) && 300 ((fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL)) { 301 /* 302 * Now we will find route to forced destination. 303 */ 304 dest.s_addr = ((struct sockaddr_in *) 305 (fwd_tag + 1))->sin_addr.s_addr; 306 m_tag_delete(m, fwd_tag); 307 m->m_flags &= ~M_IP_NEXTHOP; 308 } 309 310 /* 311 * Find route to destination. 312 */ 313 if (ip_findroute(&nh, dest, m) != 0) 314 return (NULL); /* icmp unreach already sent */ 315 316 /* 317 * Avoid second route lookup by caching destination. 318 */ 319 rtdest.s_addr = dest.s_addr; 320 321 /* 322 * Step 5: outgoing firewall packet processing 323 */ 324 if (!PFIL_HOOKED(&V_inet_pfil_hook)) 325 goto passout; 326 327 if (pfil_run_hooks(&V_inet_pfil_hook, &m, nh.nh_ifp, PFIL_OUT, PFIL_FWD, 328 NULL) || m == NULL) { 329 goto drop; 330 } 331 332 M_ASSERTVALID(m); 333 M_ASSERTPKTHDR(m); 334 335 ip = mtod(m, struct ip *); 336 dest.s_addr = ip->ip_dst.s_addr; 337 338 /* 339 * Destination address changed? 340 */ 341 if (m->m_flags & M_IP_NEXTHOP) 342 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); 343 else 344 fwd_tag = NULL; 345 if (odest.s_addr != dest.s_addr || fwd_tag != NULL) { 346 /* 347 * Is it now for a local address on this host? 348 */ 349 if (m->m_flags & M_FASTFWD_OURS || in_localip(dest)) { 350 forwardlocal: 351 /* 352 * Return packet for processing by ip_input(). 353 */ 354 m->m_flags |= M_FASTFWD_OURS; 355 return (m); 356 } 357 /* 358 * Redo route lookup with new destination address 359 */ 360 if (fwd_tag) { 361 dest.s_addr = ((struct sockaddr_in *) 362 (fwd_tag + 1))->sin_addr.s_addr; 363 m_tag_delete(m, fwd_tag); 364 m->m_flags &= ~M_IP_NEXTHOP; 365 } 366 if (dest.s_addr != rtdest.s_addr && 367 ip_findroute(&nh, dest, m) != 0) 368 return (NULL); /* icmp unreach already sent */ 369 } 370 371 passout: 372 /* 373 * Step 6: send off the packet 374 */ 375 ip_len = ntohs(ip->ip_len); 376 ip_off = ntohs(ip->ip_off); 377 378 bzero(&dst, sizeof(dst)); 379 dst.sin_family = AF_INET; 380 dst.sin_len = sizeof(dst); 381 dst.sin_addr = nh.nh_addr; 382 383 /* 384 * Check if packet fits MTU or if hardware will fragment for us 385 */ 386 if (ip_len <= nh.nh_mtu) { 387 /* 388 * Avoid confusing lower layers. 389 */ 390 m_clrprotoflags(m); 391 /* 392 * Send off the packet via outgoing interface 393 */ 394 IP_PROBE(send, NULL, NULL, ip, nh.nh_ifp, ip, NULL); 395 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m, 396 (struct sockaddr *)&dst, NULL); 397 } else { 398 /* 399 * Handle EMSGSIZE with icmp reply needfrag for TCP MTU discovery 400 */ 401 if (ip_off & IP_DF) { 402 IPSTAT_INC(ips_cantfrag); 403 icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 404 0, nh.nh_mtu); 405 goto consumed; 406 } else { 407 /* 408 * We have to fragment the packet 409 */ 410 m->m_pkthdr.csum_flags |= CSUM_IP; 411 if (ip_fragment(ip, &m, nh.nh_mtu, 412 nh.nh_ifp->if_hwassist) != 0) 413 goto drop; 414 KASSERT(m != NULL, ("null mbuf and no error")); 415 /* 416 * Send off the fragments via outgoing interface 417 */ 418 error = 0; 419 do { 420 m0 = m->m_nextpkt; 421 m->m_nextpkt = NULL; 422 /* 423 * Avoid confusing lower layers. 424 */ 425 m_clrprotoflags(m); 426 427 IP_PROBE(send, NULL, NULL, 428 mtod(m, struct ip *), nh.nh_ifp, 429 mtod(m, struct ip *), NULL); 430 /* XXX: we can use cached route here */ 431 error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m, 432 (struct sockaddr *)&dst, NULL); 433 if (error) 434 break; 435 } while ((m = m0) != NULL); 436 if (error) { 437 /* Reclaim remaining fragments */ 438 for (m = m0; m; m = m0) { 439 m0 = m->m_nextpkt; 440 m_freem(m); 441 } 442 } else 443 IPSTAT_INC(ips_fragmented); 444 } 445 } 446 447 if (error != 0) 448 IPSTAT_INC(ips_odropped); 449 else { 450 IPSTAT_INC(ips_forward); 451 IPSTAT_INC(ips_fastforward); 452 } 453 consumed: 454 return NULL; 455 drop: 456 if (m) 457 m_freem(m); 458 return NULL; 459 } 460