1/*
2 * Copyright (c) 2009-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/* $FreeBSD: src/sys/netinet6/ip6_forward.c,v 1.16 2002/10/16 02:25:05 sam Exp $ */
30/* $KAME: ip6_forward.c,v 1.69 2001/05/17 03:48:30 itojun Exp $ */
31
32/*
33 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
34 * All rights reserved.
35 *
36 * Redistribution and use in source and binary forms, with or without
37 * modification, are permitted provided that the following conditions
38 * are met:
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. Neither the name of the project nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 */
60
61
62#include <sys/param.h>
63#include <sys/systm.h>
64#include <sys/malloc.h>
65#include <sys/mbuf.h>
66#include <sys/domain.h>
67#include <sys/protosw.h>
68#include <sys/socket.h>
69#include <sys/errno.h>
70#include <sys/time.h>
71#include <sys/kernel.h>
72#include <sys/syslog.h>
73
74#include <net/if.h>
75#include <net/route.h>
76
77#include <netinet/in.h>
78#include <netinet/in_var.h>
79#include <netinet/in_systm.h>
80#include <netinet/ip.h>
81#include <netinet/ip_var.h>
82#include <netinet6/in6_var.h>
83#include <netinet/ip6.h>
84#include <netinet6/ip6_var.h>
85#include <netinet/icmp6.h>
86#include <netinet6/nd6.h>
87#include <netinet6/scope6_var.h>
88
89#include <netinet/in_pcb.h>
90
91#if IPSEC
92#include <netinet6/ipsec.h>
93#if INET6
94#include <netinet6/ipsec6.h>
95#endif
96#include <netkey/key.h>
97extern int ipsec_bypass;
98#endif /* IPSEC */
99
100#include <net/net_osdep.h>
101
102#if DUMMYNET
103#include <netinet/ip_fw.h>
104#include <netinet/ip_dummynet.h>
105#endif /* DUMMYNET */
106
107#if PF
108#include <net/pfvar.h>
109#endif /* PF */
110
111/*
112 * Forward a packet. If some error occurs return the sender
113 * an icmp packet. Note we can't always generate a meaningful
114 * icmp message because icmp doesn't have a large enough repertoire
115 * of codes and types.
116 *
117 * If not forwarding, just drop the packet. This could be confusing
118 * if ipforwarding was zero but some routing protocol was advancing
119 * us as a gateway to somewhere. However, we must let the routing
120 * protocol deal with that.
121 *
122 */
123
124struct mbuf *
125ip6_forward(struct mbuf *m, struct route_in6 *ip6forward_rt,
126 int srcrt)
127{
128 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
129 struct sockaddr_in6 *dst;
130 struct rtentry *rt;
131 int error, type = 0, code = 0;
132 boolean_t proxy = FALSE;
133 struct mbuf *mcopy = NULL;
134 struct ifnet *ifp, *rcvifp, *origifp; /* maybe unnecessary */
135 u_int32_t inzone, outzone, len;
136 struct in6_addr src_in6, dst_in6;
137 uint64_t curtime = net_uptime();
138#if IPSEC
139 struct secpolicy *sp = NULL;
140#endif
141 unsigned int ifscope = IFSCOPE_NONE;
142#if PF
143 struct pf_mtag *pf_mtag;
144#endif /* PF */
145
146 /*
147 * In the prefix proxying case, the route to the proxied node normally
148 * gets created by nd6_prproxy_ns_output(), as part of forwarding a
149 * NS (NUD/AR) packet to the proxied node. In the event that such
150 * packet did not arrive in time before the correct route gets created,
151 * ip6_input() would have performed a rtalloc() which most likely will
152 * create the wrong cloned route; this route points back to the same
153 * interface as the inbound interface, since the parent non-scoped
154 * prefix route points there. Therefore we check if that is the case
155 * and perform the necessary fixup to get the correct route installed.
156 */
157 if (!srcrt && nd6_prproxy &&
158 (rt = ip6forward_rt->ro_rt) != NULL && (rt->rt_flags & RTF_PROXY)) {
159 nd6_proxy_find_fwdroute(m->m_pkthdr.rcvif, ip6forward_rt);
160 if ((rt = ip6forward_rt->ro_rt) != NULL)
161 ifscope = rt->rt_ifp->if_index;
162 }
163
164#if PF
165 pf_mtag = pf_find_mtag(m);
166 if (pf_mtag != NULL && pf_mtag->pftag_rtableid != IFSCOPE_NONE)
167 ifscope = pf_mtag->pftag_rtableid;
168
169 /*
170 * If the caller provides a route which is on a different interface
171 * than the one specified for scoped forwarding, discard the route
172 * and do a lookup below.
173 */
174 if (ifscope != IFSCOPE_NONE && (rt = ip6forward_rt->ro_rt) != NULL) {
175 RT_LOCK(rt);
176 if (rt->rt_ifp->if_index != ifscope) {
177 RT_UNLOCK(rt);
178 ROUTE_RELEASE(ip6forward_rt);
179 rt = NULL;
180 } else {
181 RT_UNLOCK(rt);
182 }
183 }
184#endif /* PF */
185
186#if IPSEC
187 /*
188 * Check AH/ESP integrity.
189 */
190 /*
191 * Don't increment ip6s_cantforward because this is the check
192 * before forwarding packet actually.
193 */
194 if (ipsec_bypass == 0) {
195 if (ipsec6_in_reject(m, NULL)) {
196 IPSEC_STAT_INCREMENT(ipsec6stat.in_polvio);
197 m_freem(m);
198 return (NULL);
199 }
200 }
201#endif /*IPSEC*/
202
203 /*
204 * Do not forward packets to multicast destination.
205 * Do not forward packets with unspecified source. It was discussed
206 * in July 2000, on ipngwg mailing list.
207 */
208 if ((m->m_flags & (M_BCAST|M_MCAST)) != 0 ||
209 IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
210 IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
211 ip6stat.ip6s_cantforward++;
212 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
213 if (ip6_log_time + ip6_log_interval < curtime) {
214 ip6_log_time = curtime;
215 log(LOG_DEBUG,
216 "cannot forward "
217 "from %s to %s nxt %d received on %s\n",
218 ip6_sprintf(&ip6->ip6_src),
219 ip6_sprintf(&ip6->ip6_dst),
220 ip6->ip6_nxt,
221 if_name(m->m_pkthdr.rcvif));
222 }
223 m_freem(m);
224 return (NULL);
225 }
226
227 if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
228 /* XXX in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard) */
229 icmp6_error_flag(m, ICMP6_TIME_EXCEEDED,
230 ICMP6_TIME_EXCEED_TRANSIT, 0, 0);
231 return (NULL);
232 }
233
234 /*
235 * See if the destination is a proxied address, and if so pretend
236 * that it's for us. This is mostly to handle NUD probes against
237 * the proxied addresses. We filter for ICMPv6 here and will let
238 * icmp6_input handle the rest.
239 */
240 if (!srcrt && nd6_prproxy) {
241 VERIFY(!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst));
242 proxy = nd6_prproxy_isours(m, ip6, ip6forward_rt, ifscope);
243 /*
244 * Don't update hop limit while proxying; RFC 4389 4.1.
245 * Also skip IPsec forwarding path processing as this
246 * packet is not to be forwarded.
247 */
248 if (proxy)
249 goto skip_ipsec;
250 }
251
252 ip6->ip6_hlim -= IPV6_HLIMDEC;
253
254 /*
255 * Save at most ICMPV6_PLD_MAXLEN (= the min IPv6 MTU -
256 * size of IPv6 + ICMPv6 headers) bytes of the packet in case
257 * we need to generate an ICMP6 message to the src.
258 * Thanks to M_EXT, in most cases copy will not occur.
259 *
260 * It is important to save it before IPsec processing as IPsec
261 * processing may modify the mbuf.
262 */
263 mcopy = m_copy(m, 0, imin(m->m_pkthdr.len, ICMPV6_PLD_MAXLEN));
264
265#if IPSEC
266 if (ipsec_bypass != 0)
267 goto skip_ipsec;
268 /* get a security policy for this packet */
269 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND, IP_FORWARDING,
270 &error);
271 if (sp == NULL) {
272 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
273 ip6stat.ip6s_cantforward++;
274 if (mcopy) {
275#if 0
276 /* XXX: what icmp ? */
277#else
278 m_freem(mcopy);
279#endif
280 }
281 m_freem(m);
282 return (NULL);
283 }
284
285 error = 0;
286
287 /* check policy */
288 switch (sp->policy) {
289 case IPSEC_POLICY_DISCARD:
290 case IPSEC_POLICY_GENERATE:
291 /*
292 * This packet is just discarded.
293 */
294 IPSEC_STAT_INCREMENT(ipsec6stat.out_polvio);
295 ip6stat.ip6s_cantforward++;
296 key_freesp(sp, KEY_SADB_UNLOCKED);
297 if (mcopy) {
298#if 0
299 /* XXX: what icmp ? */
300#else
301 m_freem(mcopy);
302#endif
303 }
304 m_freem(m);
305 return (NULL);
306
307 case IPSEC_POLICY_BYPASS:
308 case IPSEC_POLICY_NONE:
309 /* no need to do IPsec. */
310 key_freesp(sp, KEY_SADB_UNLOCKED);
311 goto skip_ipsec;
312
313 case IPSEC_POLICY_IPSEC:
314 if (sp->req == NULL) {
315 /* XXX should be panic ? */
316 printf("ip6_forward: No IPsec request specified.\n");
317 ip6stat.ip6s_cantforward++;
318 key_freesp(sp, KEY_SADB_UNLOCKED);
319 if (mcopy) {
320#if 0
321 /* XXX: what icmp ? */
322#else
323 m_freem(mcopy);
324#endif
325 }
326 m_freem(m);
327 return (NULL);
328 }
329 /* do IPsec */
330 break;
331
332 case IPSEC_POLICY_ENTRUST:
333 default:
334 /* should be panic ?? */
335 printf("ip6_forward: Invalid policy found. %d\n", sp->policy);
336 key_freesp(sp, KEY_SADB_UNLOCKED);
337 goto skip_ipsec;
338 }
339
340 {
341 struct ipsec_output_state state;
342
343 /*
344 * All the extension headers will become inaccessible
345 * (since they can be encrypted).
346 * Don't panic, we need no more updates to extension headers
347 * on inner IPv6 packet (since they are now encapsulated).
348 *
349 * IPv6 [ESP|AH] IPv6 [extension headers] payload
350 */
351 bzero(&state, sizeof(state));
352 state.m = m;
353 state.dst = NULL; /* update at ipsec6_output_tunnel() */
354
355 error = ipsec6_output_tunnel(&state, sp, 0);
356 key_freesp(sp, KEY_SADB_UNLOCKED);
357 if (state.tunneled == 4) {
358 ROUTE_RELEASE(&state.ro);
359 return (NULL); /* packet is gone - sent over IPv4 */
360 }
361
362 m = state.m;
363 ROUTE_RELEASE(&state.ro);
364
365 if (error) {
366 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
367 switch (error) {
368 case EHOSTUNREACH:
369 case ENETUNREACH:
370 case EMSGSIZE:
371 case ENOBUFS:
372 case ENOMEM:
373 break;
374 default:
375 printf("ip6_output (ipsec): error code %d\n", error);
376 /* fall through */
377 case ENOENT:
378 /* don't show these error codes to the user */
379 break;
380 }
381 ip6stat.ip6s_cantforward++;
382 if (mcopy) {
383#if 0
384 /* XXX: what icmp ? */
385#else
386 m_freem(mcopy);
387#endif
388 }
389 m_freem(m);
390 return (NULL);
391 }
392 }
393#endif /* IPSEC */
394 skip_ipsec:
395
396 dst = (struct sockaddr_in6 *)&ip6forward_rt->ro_dst;
397 if ((rt = ip6forward_rt->ro_rt) != NULL) {
398 RT_LOCK(rt);
399 /* Take an extra ref for ourselves */
400 RT_ADDREF_LOCKED(rt);
401 }
402
403 VERIFY(rt == NULL || rt == ip6forward_rt->ro_rt);
404 if (!srcrt) {
405 /*
406 * ip6forward_rt->ro_dst.sin6_addr is equal to ip6->ip6_dst
407 */
408 if (ROUTE_UNUSABLE(ip6forward_rt)) {
409 if (rt != NULL) {
410 /* Release extra ref */
411 RT_REMREF_LOCKED(rt);
412 RT_UNLOCK(rt);
413 }
414 ROUTE_RELEASE(ip6forward_rt);
415
416 /* this probably fails but give it a try again */
417 rtalloc_scoped_ign((struct route *)ip6forward_rt,
418 RTF_PRCLONING, ifscope);
419 if ((rt = ip6forward_rt->ro_rt) != NULL) {
420 RT_LOCK(rt);
421 /* Take an extra ref for ourselves */
422 RT_ADDREF_LOCKED(rt);
423 }
424 }
425
426 if (rt == NULL) {
427 ip6stat.ip6s_noroute++;
428 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_noroute);
429 if (mcopy)
430 icmp6_error(mcopy, ICMP6_DST_UNREACH,
431 ICMP6_DST_UNREACH_NOROUTE, 0);
432 m_freem(m);
433 return (NULL);
434 }
435 RT_LOCK_ASSERT_HELD(rt);
436 } else if (ROUTE_UNUSABLE(ip6forward_rt) ||
437 !IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &dst->sin6_addr)) {
438 if (rt != NULL) {
439 /* Release extra ref */
440 RT_REMREF_LOCKED(rt);
441 RT_UNLOCK(rt);
442 }
443 ROUTE_RELEASE(ip6forward_rt);
444
445 bzero(dst, sizeof(*dst));
446 dst->sin6_len = sizeof(struct sockaddr_in6);
447 dst->sin6_family = AF_INET6;
448 dst->sin6_addr = ip6->ip6_dst;
449
450 rtalloc_scoped_ign((struct route *)ip6forward_rt,
451 RTF_PRCLONING, ifscope);
452 if ((rt = ip6forward_rt->ro_rt) == NULL) {
453 ip6stat.ip6s_noroute++;
454 in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_noroute);
455 if (mcopy)
456 icmp6_error(mcopy, ICMP6_DST_UNREACH,
457 ICMP6_DST_UNREACH_NOROUTE, 0);
458 m_freem(m);
459 return (NULL);
460 }
461 RT_LOCK(rt);
462 /* Take an extra ref for ourselves */
463 RT_ADDREF_LOCKED(rt);
464 }
465
466 /*
467 * Source scope check: if a packet can't be delivered to its
468 * destination for the reason that the destination is beyond the scope
469 * of the source address, discard the packet and return an icmp6
470 * destination unreachable error with Code 2 (beyond scope of source
471 * address) unless we are proxying (source address is link local
472 * for NUDs.) We use a local copy of ip6_src, since in6_setscope()
473 * will possibly modify its first argument.
474 * [draft-ietf-ipngwg-icmp-v3-04.txt, Section 3.1]
475 */
476 src_in6 = ip6->ip6_src;
477 if (in6_setscope(&src_in6, rt->rt_ifp, &outzone)) {
478 RT_REMREF_LOCKED(rt);
479 RT_UNLOCK(rt);
480 /* XXX: this should not happen */
481 ip6stat.ip6s_cantforward++;
482 ip6stat.ip6s_badscope++;
483 m_freem(m);
484 return (NULL);
485 }
486 if (in6_setscope(&src_in6, m->m_pkthdr.rcvif, &inzone)) {
487 RT_REMREF_LOCKED(rt);
488 RT_UNLOCK(rt);
489 ip6stat.ip6s_cantforward++;
490 ip6stat.ip6s_badscope++;
491 m_freem(m);
492 return (NULL);
493 }
494
495 if (inzone != outzone && !proxy) {
496 ip6stat.ip6s_cantforward++;
497 ip6stat.ip6s_badscope++;
498 in6_ifstat_inc(rt->rt_ifp, ifs6_in_discard);
499
500 if (ip6_log_time + ip6_log_interval < curtime) {
501 ip6_log_time = curtime;
502 log(LOG_DEBUG,
503 "cannot forward "
504 "src %s, dst %s, nxt %d, rcvif %s, outif %s\n",
505 ip6_sprintf(&ip6->ip6_src),
506 ip6_sprintf(&ip6->ip6_dst),
507 ip6->ip6_nxt,
508 if_name(m->m_pkthdr.rcvif), if_name(rt->rt_ifp));
509 }
510 /* Release extra ref */
511 RT_REMREF_LOCKED(rt);
512 RT_UNLOCK(rt);
513 if (mcopy) {
514 icmp6_error(mcopy, ICMP6_DST_UNREACH,
515 ICMP6_DST_UNREACH_BEYONDSCOPE, 0);
516 }
517 m_freem(m);
518 return (NULL);
519 }
520
521 /*
522 * Destination scope check: if a packet is going to break the scope
523 * zone of packet's destination address, discard it. This case should
524 * usually be prevented by appropriately-configured routing table, but
525 * we need an explicit check because we may mistakenly forward the
526 * packet to a different zone by (e.g.) a default route.
527 */
528 dst_in6 = ip6->ip6_dst;
529 if (in6_setscope(&dst_in6, m->m_pkthdr.rcvif, &inzone) != 0 ||
530 in6_setscope(&dst_in6, rt->rt_ifp, &outzone) != 0 ||
531 inzone != outzone) {
532 RT_REMREF_LOCKED(rt);
533 RT_UNLOCK(rt);
534 ip6stat.ip6s_cantforward++;
535 ip6stat.ip6s_badscope++;
536 m_freem(m);
537 return (NULL);
538 }
539
540 if (m->m_pkthdr.len > rt->rt_ifp->if_mtu) {
541 in6_ifstat_inc(rt->rt_ifp, ifs6_in_toobig);
542 if (mcopy) {
543 uint32_t mtu;
544#if IPSEC
545 struct secpolicy *sp2;
546 int ipsecerror;
547 size_t ipsechdrsiz;
548#endif
549
550 mtu = rt->rt_ifp->if_mtu;
551#if IPSEC
552 /*
553 * When we do IPsec tunnel ingress, we need to play
554 * with the link value (decrement IPsec header size
555 * from mtu value). The code is much simpler than v4
556 * case, as we have the outgoing interface for
557 * encapsulated packet as "rt->rt_ifp".
558 */
559 sp2 = ipsec6_getpolicybyaddr(mcopy, IPSEC_DIR_OUTBOUND,
560 IP_FORWARDING, &ipsecerror);
561 if (sp2) {
562 ipsechdrsiz = ipsec6_hdrsiz(mcopy,
563 IPSEC_DIR_OUTBOUND, NULL);
564 if (ipsechdrsiz < mtu)
565 mtu -= ipsechdrsiz;
566 key_freesp(sp2, KEY_SADB_UNLOCKED);
567 }
568 /*
569 * if mtu becomes less than minimum MTU,
570 * tell minimum MTU (and I'll need to fragment it).
571 */
572 if (mtu < IPV6_MMTU)
573 mtu = IPV6_MMTU;
574#endif
575 /* Release extra ref */
576 RT_REMREF_LOCKED(rt);
577 RT_UNLOCK(rt);
578 icmp6_error(mcopy, ICMP6_PACKET_TOO_BIG, 0, mtu);
579 } else {
580 /* Release extra ref */
581 RT_REMREF_LOCKED(rt);
582 RT_UNLOCK(rt);
583 }
584 m_freem(m);
585 return (NULL);
586 }
587
588 if (rt->rt_flags & RTF_GATEWAY)
589 dst = (struct sockaddr_in6 *)(void *)rt->rt_gateway;
590
591 /*
592 * If we are to forward the packet using the same interface
593 * as one we got the packet from, perhaps we should send a redirect
594 * to sender to shortcut a hop.
595 * Only send redirect if source is sending directly to us,
596 * and if packet was not source routed (or has any options).
597 * Also, don't send redirect if forwarding using a route
598 * modified by a redirect.
599 */
600 if (!proxy &&
601 ip6_sendredirects && rt->rt_ifp == m->m_pkthdr.rcvif && !srcrt &&
602 (rt->rt_flags & (RTF_DYNAMIC|RTF_MODIFIED)) == 0) {
603 if ((rt->rt_ifp->if_flags & IFF_POINTOPOINT) != 0) {
604 /*
605 * If the incoming interface is equal to the outgoing
606 * one, and the link attached to the interface is
607 * point-to-point, then it will be highly probable
608 * that a routing loop occurs. Thus, we immediately
609 * drop the packet and send an ICMPv6 error message.
610 *
611 * type/code is based on suggestion by Rich Draves.
612 * not sure if it is the best pick.
613 */
614 RT_REMREF_LOCKED(rt); /* Release extra ref */
615 RT_UNLOCK(rt);
616 icmp6_error(mcopy, ICMP6_DST_UNREACH,
617 ICMP6_DST_UNREACH_ADDR, 0);
618 m_freem(m);
619 return (NULL);
620 }
621 type = ND_REDIRECT;
622 }
623 /*
624 * Fake scoped addresses. Note that even link-local source or
625 * destinaion can appear, if the originating node just sends the
626 * packet to us (without address resolution for the destination).
627 * Since both icmp6_error and icmp6_redirect_output fill the embedded
628 * link identifiers, we can do this stuff after making a copy for
629 * returning an error.
630 */
631 if ((rt->rt_ifp->if_flags & IFF_LOOPBACK) != 0) {
632 /*
633 * See corresponding comments in ip6_output.
634 * XXX: but is it possible that ip6_forward() sends a packet
635 * to a loopback interface? I don't think so, and thus
636 * I bark here. (jinmei@kame.net)
637 * XXX: it is common to route invalid packets to loopback.
638 * also, the codepath will be visited on use of ::1 in
639 * rthdr. (itojun)
640 */
641#if 1
642 if ((0))
643#else
644 if ((rt->rt_flags & (RTF_BLACKHOLE|RTF_REJECT)) == 0)
645#endif
646 {
647 printf("ip6_forward: outgoing interface is loopback. "
648 "src %s, dst %s, nxt %d, rcvif %s, outif %s\n",
649 ip6_sprintf(&ip6->ip6_src),
650 ip6_sprintf(&ip6->ip6_dst),
651 ip6->ip6_nxt, if_name(m->m_pkthdr.rcvif),
652 if_name(rt->rt_ifp));
653 }
654
655 /* we can just use rcvif in forwarding. */
656 origifp = rcvifp = m->m_pkthdr.rcvif;
657 } else if (nd6_prproxy) {
658 /*
659 * In the prefix proxying case, we need to inform nd6_output()
660 * about the inbound interface, so that any subsequent NS
661 * packets generated by nd6_prproxy_ns_output() will not be
662 * sent back to that same interface.
663 */
664 origifp = rcvifp = m->m_pkthdr.rcvif;
665 } else {
666 rcvifp = m->m_pkthdr.rcvif;
667 origifp = rt->rt_ifp;
668 }
669 /*
670 * clear embedded scope identifiers if necessary.
671 * in6_clearscope will touch the addresses only when necessary.
672 */
673 in6_clearscope(&ip6->ip6_src);
674 in6_clearscope(&ip6->ip6_dst);
675
676 ifp = rt->rt_ifp;
677 /* Drop the lock but retain the extra ref */
678 RT_UNLOCK(rt);
679
680 /*
681 * If this is to be processed locally, let ip6_input have it.
682 */
683 if (proxy) {
684 VERIFY(m->m_pkthdr.pkt_flags & PKTF_PROXY_DST);
685 /* Release extra ref */
686 RT_REMREF(rt);
687 if (mcopy != NULL)
688 m_freem(mcopy);
689 return (m);
690 }
691
692 /* Mark this packet as being forwarded from another interface */
693 m->m_pkthdr.pkt_flags |= PKTF_FORWARDED;
694
695#if PF
696 if (PF_IS_ENABLED) {
697#if DUMMYNET
698 struct ip_fw_args args;
699 bzero(&args, sizeof(args));
700
701 args.fwa_m = m;
702 args.fwa_oif = ifp;
703 args.fwa_oflags = 0;
704 args.fwa_ro6 = ip6forward_rt;
705 args.fwa_ro6_pmtu = ip6forward_rt;
706 args.fwa_mtu = rt->rt_ifp->if_mtu;
707 args.fwa_dst6 = dst;
708 args.fwa_origifp = origifp;
709 /* Invoke outbound packet filter */
710 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, &args);
711#else /* !DUMMYNET */
712 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, NULL);
713#endif /* !DUMMYNET */
714 if (error != 0 || m == NULL) {
715 if (m != NULL) {
716 panic("%s: unexpected packet %p\n", __func__, m);
717 /* NOTREACHED */
718 }
719 /* Already freed by callee */
720 goto senderr;
721 }
722 /*
723 * We do not use ip6 header again in the code below,
724 * however still adding the bit here so that any new
725 * code in future doesn't end up working with the
726 * wrong pointer
727 */
728 ip6 = mtod(m, struct ip6_hdr *);
729 }
730#endif /* PF */
731
732 len = m_pktlen(m);
733 error = nd6_output(ifp, origifp, m, dst, rt, NULL);
734 if (error) {
735 in6_ifstat_inc(ifp, ifs6_out_discard);
736 ip6stat.ip6s_cantforward++;
737 } else {
738 /*
739 * Increment stats on the source interface; the ones
740 * for destination interface has been taken care of
741 * during output above by virtue of PKTF_FORWARDED.
742 */
743 rcvifp->if_fpackets++;
744 rcvifp->if_fbytes += len;
745
746 ip6stat.ip6s_forward++;
747 in6_ifstat_inc(ifp, ifs6_out_forward);
748 if (type)
749 ip6stat.ip6s_redirectsent++;
750 else {
751 if (mcopy) {
752 goto freecopy;
753 }
754 }
755 }
756#if PF
757senderr:
758#endif /* PF */
759 if (mcopy == NULL) {
760 /* Release extra ref */
761 RT_REMREF(rt);
762 return (NULL);
763 }
764 switch (error) {
765 case 0:
766#if 1
767 if (type == ND_REDIRECT) {
768 icmp6_redirect_output(mcopy, rt);
769 /* Release extra ref */
770 RT_REMREF(rt);
771 return (NULL);
772 }
773#endif
774 goto freecopy;
775
776 case EMSGSIZE:
777 /* xxx MTU is constant in PPP? */
778 goto freecopy;
779
780 case ENOBUFS:
781 /* Tell source to slow down like source quench in IP? */
782 goto freecopy;
783
784 case ENETUNREACH: /* shouldn't happen, checked above */
785 case EHOSTUNREACH:
786 case ENETDOWN:
787 case EHOSTDOWN:
788 default:
789 type = ICMP6_DST_UNREACH;
790 code = ICMP6_DST_UNREACH_ADDR;
791 break;
792 }
793 icmp6_error(mcopy, type, code, 0);
794 /* Release extra ref */
795 RT_REMREF(rt);
796 return (NULL);
797
798 freecopy:
799 m_freem(mcopy);
800 /* Release extra ref */
801 RT_REMREF(rt);
802 return (NULL);
803}
804