sys/netinet6/ip6_forward.c

   1 /*      $FreeBSD: src/sys/netinet6/ip6_forward.c,v 1.4.2.7 2003/01/24 05:11:35 sam Exp $        */
   2 /*      $DragonFly: src/sys/netinet6/ip6_forward.c,v 1.5 2003/08/23 11:02:45 rob Exp $  */
   3 /*      $KAME: ip6_forward.c,v 1.69 2001/05/17 03:48:30 itojun Exp $    */
   4
   5 /*
   6  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the project nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 #include "opt_ip6fw.h"
  35 #include "opt_inet.h"
  36 #include "opt_inet6.h"
  37 #include "opt_ipsec.h"
  38
  39 #include <sys/param.h>
  40 #include <sys/systm.h>
  41 #include <sys/malloc.h>
  42 #include <sys/mbuf.h>
  43 #include <sys/domain.h>
  44 #include <sys/protosw.h>
  45 #include <sys/socket.h>
  46 #include <sys/errno.h>
  47 #include <sys/time.h>
  48 #include <sys/kernel.h>
  49 #include <sys/syslog.h>
  50
  51 #include <net/if.h>
  52 #include <net/route.h>
  53
  54 #include <netinet/in.h>
  55 #include <netinet/in_var.h>
  56 #include <netinet/in_systm.h>
  57 #include <netinet/ip.h>
  58 #include <netinet/ip_var.h>
  59 #include <netinet6/in6_var.h>
  60 #include <netinet/ip6.h>
  61 #include <netinet6/ip6_var.h>
  62 #include <netinet/icmp6.h>
  63 #include <netinet6/nd6.h>
  64
  65 #include <netinet/in_pcb.h>
  66
  67 #ifdef IPSEC
  68 #include <netinet6/ipsec.h>
  69 #ifdef INET6
  70 #include <netinet6/ipsec6.h>
  71 #endif
  72 #include <netproto/key/key.h>
  73 #endif /* IPSEC */
  74
  75 #ifdef FAST_IPSEC
  76 #include "ipsec.h"
  77 #include "ipsec6.h"
  78 #include <netipsec/key.h>
  79 #define IPSEC
  80 #endif /* FAST_IPSEC */
  81
  82 #include <net/ip6fw/ip6_fw.h>
  83
  84 #include <net/net_osdep.h>
  85
  86 extern int (*fr_checkp) (struct ip *, int, struct ifnet *, int, struct mbuf **);
  87
  88 struct  route_in6 ip6_forward_rt;
  89
  90 /*
  91  * Forward a packet.  If some error occurs return the sender
  92  * an icmp packet.  Note we can't always generate a meaningful
  93  * icmp message because icmp doesn't have a large enough repertoire
  94  * of codes and types.
  95  *
  96  * If not forwarding, just drop the packet.  This could be confusing
  97  * if ipforwarding was zero but some routing protocol was advancing
  98  * us as a gateway to somewhere.  However, we must let the routing
  99  * protocol deal with that.
 100  *
 101  */
 102
 103 void
 104 ip6_forward(m, srcrt)
 105         struct mbuf *m;
 106         int srcrt;
 107 {
 108         struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 109         struct sockaddr_in6 *dst;
 110         struct rtentry *rt;
 111         int error, type = 0, code = 0;
 112         struct mbuf *mcopy = NULL;
 113         struct ifnet *origifp;  /* maybe unnecessary */
 114 #ifdef IPSEC
 115         struct secpolicy *sp = NULL;
 116 #endif
 117
 118 #ifdef IPSEC
 119         /*
 120          * Check AH/ESP integrity.
 121          */
 122         /*
 123          * Don't increment ip6s_cantforward because this is the check
 124          * before forwarding packet actually.
 125          */
 126         if (ipsec6_in_reject(m, NULL)) {
 127 #if !defined(FAST_IPSEC)
 128                 ipsec6stat.in_polvio++;
 129 #endif
 130                 m_freem(m);
 131                 return;
 132         }
 133 #endif /* IPSEC */
 134
 135         /*
 136          * Do not forward packets to multicast destination (should be handled
 137          * by ip6_mforward().
 138          * Do not forward packets with unspecified source.  It was discussed
 139          * in July 2000, on ipngwg mailing list.
 140          */
 141         if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 ||
 142             IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
 143             IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
 144                 ip6stat.ip6s_cantforward++;
 145                 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
 146                 if (ip6_log_time + ip6_log_interval < time_second) {
 147                         ip6_log_time = time_second;
 148                         log(LOG_DEBUG,
 149                             "cannot forward "
 150                             "from %s to %s nxt %d received on %s\n",
 151                             ip6_sprintf(&ip6->ip6_src),
 152                             ip6_sprintf(&ip6->ip6_dst),
 153                             ip6->ip6_nxt,
 154                             if_name(m->m_pkthdr.rcvif));
 155                 }
 156                 m_freem(m);
 157                 return;
 158         }
 159
 160         if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
 161                 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
 162                 icmp6_error(m, ICMP6_TIME_EXCEEDED,
 163                                 ICMP6_TIME_EXCEED_TRANSIT, 0);
 164                 return;
 165         }
 166         ip6->ip6_hlim -= IPV6_HLIMDEC;
 167
 168         /*
 169          * Save at most ICMPV6_PLD_MAXLEN (= the min IPv6 MTU -
 170          * size of IPv6 + ICMPv6 headers) bytes of the packet in case
 171          * we need to generate an ICMP6 message to the src.
 172          * Thanks to M_EXT, in most cases copy will not occur.
 173          *
 174          * It is important to save it before IPsec processing as IPsec
 175          * processing may modify the mbuf.
 176          */
 177         mcopy = m_copy(m, 0, imin(m->m_pkthdr.len, ICMPV6_PLD_MAXLEN));
 178
 179 #ifdef IPSEC
 180         /* get a security policy for this packet */
 181         sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, IP_FORWARDING,
 182             &error);
 183         if (sp == NULL) {
 184                 ipsec6stat.out_inval++;
 185                 ip6stat.ip6s_cantforward++;
 186                 if (mcopy) {
 187 #if 0
 188                         /* XXX: what icmp ? */
 189 #else
 190                         m_freem(mcopy);
 191 #endif
 192                 }
 193                 m_freem(m);
 194                 return;
 195         }
 196
 197         error = 0;
 198
 199         /* check policy */
 200         switch (sp->policy) {
 201         case IPSEC_POLICY_DISCARD:
 202                 /*
 203                  * This packet is just discarded.
 204                  */
 205                 ipsec6stat.out_polvio++;
 206                 ip6stat.ip6s_cantforward++;
 207                 key_freesp(sp);
 208                 if (mcopy) {
 209 #if 0
 210                         /* XXX: what icmp ? */
 211 #else
 212                         m_freem(mcopy);
 213 #endif
 214                 }
 215                 m_freem(m);
 216                 return;
 217
 218         case IPSEC_POLICY_BYPASS:
 219         case IPSEC_POLICY_NONE:
 220                 /* no need to do IPsec. */
 221                 key_freesp(sp);
 222                 goto skip_ipsec;
 223
 224         case IPSEC_POLICY_IPSEC:
 225                 if (sp->req == NULL) {
 226                         /* XXX should be panic ? */
 227                         printf("ip6_forward: No IPsec request specified.\n");
 228                         ip6stat.ip6s_cantforward++;
 229                         key_freesp(sp);
 230                         if (mcopy) {
 231 #if 0
 232                                 /* XXX: what icmp ? */
 233 #else
 234                                 m_freem(mcopy);
 235 #endif
 236                         }
 237                         m_freem(m);
 238                         return;
 239                 }
 240                 /* do IPsec */
 241                 break;
 242
 243         case IPSEC_POLICY_ENTRUST:
 244         default:
 245                 /* should be panic ?? */
 246                 printf("ip6_forward: Invalid policy found. %d\n", sp->policy);
 247                 key_freesp(sp);
 248                 goto skip_ipsec;
 249         }
 250
 251     {
 252         struct ipsec_output_state state;
 253
 254         /*
 255          * All the extension headers will become inaccessible
 256          * (since they can be encrypted).
 257          * Don't panic, we need no more updates to extension headers
 258          * on inner IPv6 packet (since they are now encapsulated).
 259          *
 260          * IPv6 [ESP|AH] IPv6 [extension headers] payload
 261          */
 262         bzero(&state, sizeof(state));
 263         state.m = m;
 264         state.ro = NULL;        /* update at ipsec6_output_tunnel() */
 265         state.dst = NULL;       /* update at ipsec6_output_tunnel() */
 266
 267         error = ipsec6_output_tunnel(&state, sp, 0);
 268
 269         m = state.m;
 270         key_freesp(sp);
 271
 272         if (error) {
 273                 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
 274                 switch (error) {
 275                 case EHOSTUNREACH:
 276                 case ENETUNREACH:
 277                 case EMSGSIZE:
 278                 case ENOBUFS:
 279                 case ENOMEM:
 280                         break;
 281                 default:
 282                         printf("ip6_output (ipsec): error code %d\n", error);
 283                         /* fall through */
 284                 case ENOENT:
 285                         /* don't show these error codes to the user */
 286                         break;
 287                 }
 288                 ip6stat.ip6s_cantforward++;
 289                 if (mcopy) {
 290 #if 0
 291                         /* XXX: what icmp ? */
 292 #else
 293                         m_freem(mcopy);
 294 #endif
 295                 }
 296                 m_freem(m);
 297                 return;
 298         }
 299     }
 300     skip_ipsec:
 301 #endif /* IPSEC */
 302
 303         dst = (struct sockaddr_in6 *)&ip6_forward_rt.ro_dst;
 304         if (!srcrt) {
 305                 /*
 306                  * ip6_forward_rt.ro_dst.sin6_addr is equal to ip6->ip6_dst
 307                  */
 308                 if (ip6_forward_rt.ro_rt == 0 ||
 309                     (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) == 0) {
 310                         if (ip6_forward_rt.ro_rt) {
 311                                 RTFREE(ip6_forward_rt.ro_rt);
 312                                 ip6_forward_rt.ro_rt = 0;
 313                         }
 314                         /* this probably fails but give it a try again */
 315                         rtalloc_ign((struct route *)&ip6_forward_rt,
 316                                     RTF_PRCLONING);
 317                 }
 318
 319                 if (ip6_forward_rt.ro_rt == 0) {
 320                         ip6stat.ip6s_noroute++;
 321                         in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_noroute);
 322                         if (mcopy) {
 323                                 icmp6_error(mcopy, ICMP6_DST_UNREACH,
 324                                             ICMP6_DST_UNREACH_NOROUTE, 0);
 325                         }
 326                         m_freem(m);
 327                         return;
 328                 }
 329         } else if ((rt = ip6_forward_rt.ro_rt) == 0 ||
 330                  !IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst->sin6_addr)) {
 331                 if (ip6_forward_rt.ro_rt) {
 332                         RTFREE(ip6_forward_rt.ro_rt);
 333                         ip6_forward_rt.ro_rt = 0;
 334                 }
 335                 bzero(dst, sizeof(*dst));
 336                 dst->sin6_len = sizeof(struct sockaddr_in6);
 337                 dst->sin6_family = AF_INET6;
 338                 dst->sin6_addr = ip6->ip6_dst;
 339
 340                 rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING);
 341                 if (ip6_forward_rt.ro_rt == 0) {
 342                         ip6stat.ip6s_noroute++;
 343                         in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_noroute);
 344                         if (mcopy) {
 345                                 icmp6_error(mcopy, ICMP6_DST_UNREACH,
 346                                             ICMP6_DST_UNREACH_NOROUTE, 0);
 347                         }
 348                         m_freem(m);
 349                         return;
 350                 }
 351         }
 352         rt = ip6_forward_rt.ro_rt;
 353
 354         /*
 355          * Scope check: if a packet can't be delivered to its destination
 356          * for the reason that the destination is beyond the scope of the
 357          * source address, discard the packet and return an icmp6 destination
 358          * unreachable error with Code 2 (beyond scope of source address).
 359          * [draft-ietf-ipngwg-icmp-v3-02.txt, Section 3.1]
 360          */
 361         if (in6_addr2scopeid(m->m_pkthdr.rcvif, &ip6->ip6_src) !=
 362             in6_addr2scopeid(rt->rt_ifp, &ip6->ip6_src)) {
 363                 ip6stat.ip6s_cantforward++;
 364                 ip6stat.ip6s_badscope++;
 365                 in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard);
 366
 367                 if (ip6_log_time + ip6_log_interval < time_second) {
 368                         ip6_log_time = time_second;
 369                         log(LOG_DEBUG,
 370                             "cannot forward "
 371                             "src %s, dst %s, nxt %d, rcvif %s, outif %s\n",
 372                             ip6_sprintf(&ip6->ip6_src),
 373                             ip6_sprintf(&ip6->ip6_dst),
 374                             ip6->ip6_nxt,
 375                             if_name(m->m_pkthdr.rcvif), if_name(rt->rt_ifp));
 376                 }
 377                 if (mcopy)
 378                         icmp6_error(mcopy, ICMP6_DST_UNREACH,
 379                                     ICMP6_DST_UNREACH_BEYONDSCOPE, 0);
 380                 m_freem(m);
 381                 return;
 382         }
 383
 384         if (m->m_pkthdr.len > rt->rt_ifp->if_mtu) {
 385                 in6_ifstat_inc(rt->rt_ifp, ifs6_in_toobig);
 386                 if (mcopy) {
 387                         u_long mtu;
 388 #ifdef IPSEC
 389                         struct secpolicy *sp;
 390                         int ipsecerror;
 391                         size_t ipsechdrsiz;
 392 #endif
 393
 394                         mtu = rt->rt_ifp->if_mtu;
 395 #ifdef IPSEC
 396                         /*
 397                          * When we do IPsec tunnel ingress, we need to play
 398                          * with if_mtu value (decrement IPsec header size
 399                          * from mtu value).  The code is much simpler than v4
 400                          * case, as we have the outgoing interface for
 401                          * encapsulated packet as "rt->rt_ifp".
 402                          */
 403                         sp = ipsec6_getpolicybyaddr(mcopy, IPSEC_DIR_OUTBOUND,
 404                                 IP_FORWARDING, &ipsecerror);
 405                         if (sp) {
 406                                 ipsechdrsiz = ipsec6_hdrsiz(mcopy,
 407                                         IPSEC_DIR_OUTBOUND, NULL);
 408                                 if (ipsechdrsiz < mtu)
 409                                         mtu -= ipsechdrsiz;
 410                         }
 411
 412                         /*
 413                          * if mtu becomes less than minimum MTU,
 414                          * tell minimum MTU (and I'll need to fragment it).
 415                          */
 416                         if (mtu < IPV6_MMTU)
 417                                 mtu = IPV6_MMTU;
 418 #endif
 419                         icmp6_error(mcopy, ICMP6_PACKET_TOO_BIG, 0, mtu);
 420                 }
 421                 m_freem(m);
 422                 return;
 423         }
 424
 425         if (rt->rt_flags & RTF_GATEWAY)
 426                 dst = (struct sockaddr_in6 *)rt->rt_gateway;
 427
 428         /*
 429          * If we are to forward the packet using the same interface
 430          * as one we got the packet from, perhaps we should send a redirect
 431          * to sender to shortcut a hop.
 432          * Only send redirect if source is sending directly to us,
 433          * and if packet was not source routed (or has any options).
 434          * Also, don't send redirect if forwarding using a route
 435          * modified by a redirect.
 436          */
 437         if (rt->rt_ifp == m->m_pkthdr.rcvif && !srcrt &&
 438             (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0) {
 439                 if ((rt->rt_ifp->if_flags & IFF_POINTOPOINT) != 0) {
 440                         /*
 441                          * If the incoming interface is equal to the outgoing
 442                          * one, and the link attached to the interface is
 443                          * point-to-point, then it will be highly probable
 444                          * that a routing loop occurs. Thus, we immediately
 445                          * drop the packet and send an ICMPv6 error message.
 446                          *
 447                          * type/code is based on suggestion by Rich Draves.
 448                          * not sure if it is the best pick.
 449                          */
 450                         icmp6_error(mcopy, ICMP6_DST_UNREACH,
 451                                     ICMP6_DST_UNREACH_ADDR, 0);
 452                         m_freem(m);
 453                         return;
 454                 }
 455                 type = ND_REDIRECT;
 456         }
 457
 458         /*
 459          * Check with the firewall...
 460          */
 461         if (ip6_fw_enable && ip6_fw_chk_ptr) {
 462                 u_short port = 0;
 463                 /* If ipfw says divert, we have to just drop packet */
 464                 if ((*ip6_fw_chk_ptr)(&ip6, rt->rt_ifp, &port, &m)) {
 465                         m_freem(m);
 466                         goto freecopy;
 467                 }
 468                 if (!m)
 469                         goto freecopy;
 470         }
 471
 472         /*
 473          * Fake scoped addresses. Note that even link-local source or
 474          * destinaion can appear, if the originating node just sends the
 475          * packet to us (without address resolution for the destination).
 476          * Since both icmp6_error and icmp6_redirect_output fill the embedded
 477          * link identifiers, we can do this stuff after making a copy for
 478          * returning an error.
 479          */
 480         if ((rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) {
 481                 /*
 482                  * See corresponding comments in ip6_output.
 483                  * XXX: but is it possible that ip6_forward() sends a packet
 484                  *      to a loopback interface? I don't think so, and thus
 485                  *      I bark here. (jinmei@kame.net)
 486                  * XXX: it is common to route invalid packets to loopback.
 487                  *      also, the codepath will be visited on use of ::1 in
 488                  *      rthdr. (itojun)
 489                  */
 490 #if 1
 491                 if (0)
 492 #else
 493                 if ((rt->rt_flags & (RTF_BLACKHOLE|RTF_REJECT)) == 0)
 494 #endif
 495                 {
 496                         printf("ip6_forward: outgoing interface is loopback. "
 497                                 "src %s, dst %s, nxt %d, rcvif %s, outif %s\n",
 498                                 ip6_sprintf(&ip6->ip6_src),
 499                                 ip6_sprintf(&ip6->ip6_dst),
 500                                 ip6->ip6_nxt, if_name(m->m_pkthdr.rcvif),
 501                                 if_name(rt->rt_ifp));
 502                 }
 503
 504                 /* we can just use rcvif in forwarding. */
 505                 origifp = m->m_pkthdr.rcvif;
 506         }
 507         else
 508                 origifp = rt->rt_ifp;
 509 #ifndef SCOPEDROUTING
 510         /*
 511          * clear embedded scope identifiers if necessary.
 512          * in6_clearscope will touch the addresses only when necessary.
 513          */
 514         in6_clearscope(&ip6->ip6_src);
 515         in6_clearscope(&ip6->ip6_dst);
 516 #endif
 517
 518         /*
 519          * Check if we want to allow this packet to be processed.
 520          * Consider it to be bad if not.
 521          */
 522         if (fr_checkp) {
 523                 struct  mbuf    *m1 = m;
 524
 525                 if ((*fr_checkp)((struct ip *)ip6, sizeof(*ip6),
 526                                  rt->rt_ifp, 1, &m1) != 0)
 527                         goto freecopy;
 528                 m = m1;
 529                 if (m == NULL)
 530                         goto freecopy;
 531                 ip6 = mtod(m, struct ip6_hdr *);
 532         }
 533
 534         error = nd6_output(rt->rt_ifp, origifp, m, dst, rt);
 535         if (error) {
 536                 in6_ifstat_inc(rt->rt_ifp, ifs6_out_discard);
 537                 ip6stat.ip6s_cantforward++;
 538         } else {
 539                 ip6stat.ip6s_forward++;
 540                 in6_ifstat_inc(rt->rt_ifp, ifs6_out_forward);
 541                 if (type)
 542                         ip6stat.ip6s_redirectsent++;
 543                 else {
 544                         if (mcopy)
 545                                 goto freecopy;
 546                 }
 547         }
 548         if (mcopy == NULL)
 549                 return;
 550         switch (error) {
 551         case 0:
 552 #if 1
 553                 if (type == ND_REDIRECT) {
 554                         icmp6_redirect_output(mcopy, rt);
 555                         return;
 556                 }
 557 #endif
 558                 goto freecopy;
 559
 560         case EMSGSIZE:
 561                 /* xxx MTU is constant in PPP? */
 562                 goto freecopy;
 563
 564         case ENOBUFS:
 565                 /* Tell source to slow down like source quench in IP? */
 566                 goto freecopy;
 567
 568         case ENETUNREACH:       /* shouldn't happen, checked above */
 569         case EHOSTUNREACH:
 570         case ENETDOWN:
 571         case EHOSTDOWN:
 572         default:
 573                 type = ICMP6_DST_UNREACH;
 574                 code = ICMP6_DST_UNREACH_ADDR;
 575                 break;
 576         }
 577         icmp6_error(mcopy, type, code, 0);
 578         return;
 579
 580  freecopy:
 581         m_freem(mcopy);
 582         return;
 583 }