2 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the project nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 #include "opt_ipsec.h"
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/malloc.h>
38 #include <sys/domain.h>
39 #include <sys/protosw.h>
40 #include <sys/socket.h>
41 #include <sys/errno.h>
43 #include <sys/kernel.h>
44 #include <sys/syslog.h>
47 #include <net/route.h>
49 #include <netinet/in.h>
50 #include <netinet/in_var.h>
51 #include <netinet6/ip6.h>
52 #include <netinet6/ip6_var.h>
53 #include <netinet6/icmp6.h>
54 #include <netinet6/nd6.h>
57 #include <netinet6/ipsec.h>
58 #include <netinet6/ipsec6.h>
59 #include <netkey/key.h>
61 #include <netkey/key_debug.h>
63 #define KEYDEBUG(lev,arg)
65 #endif /* IPSEC_IPV6FWD */
68 #include <netinet6/ip6_fw.h>
71 #include <net/net_osdep.h>
73 struct route_in6 ip6_forward_rt;
76 * Forward a packet. If some error occurs return the sender
77 * an icmp packet. Note we can't always generate a meaningful
78 * icmp message because icmp doesn't have a large enough repertoire
81 * If not forwarding, just drop the packet. This could be confusing
82 * if ipforwarding was zero but some routing protocol was advancing
83 * us as a gateway to somewhere. However, we must let the routing
84 * protocol deal with that.
93 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
94 register struct sockaddr_in6 *dst;
95 register struct rtentry *rt;
96 int error, type = 0, code = 0;
99 struct secpolicy *sp = NULL;
104 * Check AH/ESP integrity.
107 * Don't increment ip6s_cantforward because this is the check
108 * before forwarding packet actually.
110 if (ipsec6_in_reject(m, NULL)) {
111 ipsec6stat.in_polvio++;
115 #endif /*IPSEC_IPV6FWD*/
117 if (m->m_flags & (M_BCAST|M_MCAST) ||
118 in6_canforward(&ip6->ip6_src, &ip6->ip6_dst) == 0) {
119 ip6stat.ip6s_cantforward++;
120 ip6stat.ip6s_badscope++;
121 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
122 if (ip6_log_time + ip6_log_interval < time_second) {
123 char addr[INET6_ADDRSTRLEN];
124 ip6_log_time = time_second;
125 strncpy(addr, ip6_sprintf(&ip6->ip6_src), sizeof(addr));
128 "from %s to %s nxt %d received on %s\n",
129 addr, ip6_sprintf(&ip6->ip6_dst),
131 if_name(m->m_pkthdr.rcvif));
137 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
138 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
139 icmp6_error(m, ICMP6_TIME_EXCEEDED,
140 ICMP6_TIME_EXCEED_TRANSIT, 0);
143 ip6->ip6_hlim -= IPV6_HLIMDEC;
146 /* get a security policy for this packet */
147 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, 0, &error);
149 ipsec6stat.out_inval++;
150 ip6stat.ip6s_cantforward++;
151 /* XXX: any icmp ? */
159 switch (sp->policy) {
160 case IPSEC_POLICY_DISCARD:
162 * This packet is just discarded.
164 ipsec6stat.out_polvio++;
165 ip6stat.ip6s_cantforward++;
167 /* XXX: any icmp ? */
171 case IPSEC_POLICY_BYPASS:
172 case IPSEC_POLICY_NONE:
173 /* no need to do IPsec. */
177 case IPSEC_POLICY_IPSEC:
178 if (sp->req == NULL) {
179 /* XXX should be panic ? */
180 printf("ip6_forward: No IPsec request specified.\n");
181 ip6stat.ip6s_cantforward++;
183 /* XXX: any icmp ? */
190 case IPSEC_POLICY_ENTRUST:
192 /* should be panic ?? */
193 printf("ip6_forward: Invalid policy found. %d\n", sp->policy);
199 struct ipsec_output_state state;
202 * All the extension headers will become inaccessible
203 * (since they can be encrypted).
204 * Don't panic, we need no more updates to extension headers
205 * on inner IPv6 packet (since they are now encapsulated).
207 * IPv6 [ESP|AH] IPv6 [extension headers] payload
209 bzero(&state, sizeof(state));
211 state.ro = NULL; /* update at ipsec6_output_tunnel() */
212 state.dst = NULL; /* update at ipsec6_output_tunnel() */
214 error = ipsec6_output_tunnel(&state, sp, 0);
217 /* XXX allocate a route (ro, dst) again later */
221 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
230 printf("ip6_output (ipsec): error code %d\n", error);
233 /* don't show these error codes to the user */
236 ip6stat.ip6s_cantforward++;
237 /* XXX: any icmp ? */
243 #endif /* IPSEC_IPV6FWD */
245 dst = &ip6_forward_rt.ro_dst;
248 * ip6_forward_rt.ro_dst.sin6_addr is equal to ip6->ip6_dst
250 if (ip6_forward_rt.ro_rt == 0 ||
251 (ip6_forward_rt.ro_rt->rt_flags & RTF_UP) == 0) {
252 if (ip6_forward_rt.ro_rt) {
253 RTFREE(ip6_forward_rt.ro_rt);
254 ip6_forward_rt.ro_rt = 0;
256 /* this probably fails but give it a try again */
257 rtalloc_ign((struct route *)&ip6_forward_rt,
261 if (ip6_forward_rt.ro_rt == 0) {
262 ip6stat.ip6s_noroute++;
263 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_noroute) */
264 icmp6_error(m, ICMP6_DST_UNREACH,
265 ICMP6_DST_UNREACH_NOROUTE, 0);
268 } else if ((rt = ip6_forward_rt.ro_rt) == 0 ||
269 !IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst->sin6_addr)) {
270 if (ip6_forward_rt.ro_rt) {
271 RTFREE(ip6_forward_rt.ro_rt);
272 ip6_forward_rt.ro_rt = 0;
274 bzero(dst, sizeof(*dst));
275 dst->sin6_len = sizeof(struct sockaddr_in6);
276 dst->sin6_family = AF_INET6;
277 dst->sin6_addr = ip6->ip6_dst;
279 rtalloc_ign((struct route *)&ip6_forward_rt, RTF_PRCLONING);
280 if (ip6_forward_rt.ro_rt == 0) {
281 ip6stat.ip6s_noroute++;
282 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_noroute) */
283 icmp6_error(m, ICMP6_DST_UNREACH,
284 ICMP6_DST_UNREACH_NOROUTE, 0);
288 rt = ip6_forward_rt.ro_rt;
289 if (m->m_pkthdr.len > rt->rt_ifp->if_mtu){
290 in6_ifstat_inc(rt->rt_ifp, ifs6_in_toobig);
291 icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, rt->rt_ifp->if_mtu);
295 if (rt->rt_flags & RTF_GATEWAY)
296 dst = (struct sockaddr_in6 *)rt->rt_gateway;
298 * Save at most 528 bytes of the packet in case
299 * we need to generate an ICMP6 message to the src.
300 * Thanks to M_EXT, in most cases copy will not occur.
302 mcopy = m_copy(m, 0, imin(m->m_pkthdr.len, ICMPV6_PLD_MAXLEN));
305 * If we are to forward the packet using the same interface
306 * as one we got the packet from, perhaps we should send a redirect
307 * to sender to shortcut a hop.
308 * Only send redirect if source is sending directly to us,
309 * and if packet was not source routed (or has any options).
310 * Also, don't send redirect if forwarding using a route
311 * modified by a redirect.
313 if (rt->rt_ifp == m->m_pkthdr.rcvif && !srcrt &&
314 (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0)
319 * Check with the firewall...
321 if (ip6_fw_chk_ptr) {
323 /* If ipfw says divert, we have to just drop packet */
324 if ((*ip6_fw_chk_ptr)(&ip6, rt->rt_ifp, &port, &m)) {
333 error = nd6_output(rt->rt_ifp, m, dst, rt);
335 in6_ifstat_inc(rt->rt_ifp, ifs6_out_discard);
336 ip6stat.ip6s_cantforward++;
338 ip6stat.ip6s_forward++;
339 in6_ifstat_inc(rt->rt_ifp, ifs6_out_forward);
341 ip6stat.ip6s_redirectsent++;
352 if (type == ND_REDIRECT) {
353 icmp6_redirect_output(mcopy, rt);
359 /* xxx MTU is constant in PPP? */
363 /* Tell source to slow down like source quench in IP? */
366 case ENETUNREACH: /* shouldn't happen, checked above */
371 type = ICMP6_DST_UNREACH;
372 code = ICMP6_DST_UNREACH_ADDR;
375 icmp6_error(mcopy, type, code, 0);