net/ipv4/ip_forward.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * INET     An implementation of the TCP/IP protocol suite for the LINUX
0004  *      operating system.  INET is implemented using the  BSD Socket
0005  *      interface as the means of communication with the user level.
0006  *
0007  *      The IP forwarding functionality.
0008  *
0009  * Authors: see ip.c
0010  *
0011  * Fixes:
0012  *      Many        :   Split from ip.c , see ip_input.c for
0013  *                  history.
0014  *      Dave Gregorich  :   NULL ip_rt_put fix for multicast
0015  *                  routing.
0016  *      Jos Vos     :   Add call_out_firewall before sending,
0017  *                  use output device for accounting.
0018  *      Jos Vos     :   Call forward firewall after routing
0019  *                  (always use output device).
0020  *      Mike McLagan    :   Routing by source
0021  */
0022
0023 #include <linux/types.h>
0024 #include <linux/mm.h>
0025 #include <linux/skbuff.h>
0026 #include <linux/ip.h>
0027 #include <linux/icmp.h>
0028 #include <linux/netdevice.h>
0029 #include <linux/slab.h>
0030 #include <net/sock.h>
0031 #include <net/ip.h>
0032 #include <net/tcp.h>
0033 #include <net/udp.h>
0034 #include <net/icmp.h>
0035 #include <linux/tcp.h>
0036 #include <linux/udp.h>
0037 #include <linux/netfilter_ipv4.h>
0038 #include <net/checksum.h>
0039 #include <linux/route.h>
0040 #include <net/route.h>
0041 #include <net/xfrm.h>
0042
0043 static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
0044 {
0045     if (skb->len <= mtu)
0046         return false;
0047
0048     if (unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0))
0049         return false;
0050
0051     /* original fragment exceeds mtu and DF is set */
0052     if (unlikely(IPCB(skb)->frag_max_size > mtu))
0053         return true;
0054
0055     if (skb->ignore_df)
0056         return false;
0057
0058     if (skb_is_gso(skb) && skb_gso_validate_network_len(skb, mtu))
0059         return false;
0060
0061     return true;
0062 }
0063
0064
0065 static int ip_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
0066 {
0067     struct ip_options *opt  = &(IPCB(skb)->opt);
0068
0069     __IP_INC_STATS(net, IPSTATS_MIB_OUTFORWDATAGRAMS);
0070     __IP_ADD_STATS(net, IPSTATS_MIB_OUTOCTETS, skb->len);
0071
0072 #ifdef CONFIG_NET_SWITCHDEV
0073     if (skb->offload_l3_fwd_mark) {
0074         consume_skb(skb);
0075         return 0;
0076     }
0077 #endif
0078
0079     if (unlikely(opt->optlen))
0080         ip_forward_options(skb);
0081
0082     skb_clear_tstamp(skb);
0083     return dst_output(net, sk, skb);
0084 }
0085
0086 int ip_forward(struct sk_buff *skb)
0087 {
0088     u32 mtu;
0089     struct iphdr *iph;  /* Our header */
0090     struct rtable *rt;  /* Route we use */
0091     struct ip_options *opt  = &(IPCB(skb)->opt);
0092     struct net *net;
0093     SKB_DR(reason);
0094
0095     /* that should never happen */
0096     if (skb->pkt_type != PACKET_HOST)
0097         goto drop;
0098
0099     if (unlikely(skb->sk))
0100         goto drop;
0101
0102     if (skb_warn_if_lro(skb))
0103         goto drop;
0104
0105     if (!xfrm4_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
0106         SKB_DR_SET(reason, XFRM_POLICY);
0107         goto drop;
0108     }
0109
0110     if (IPCB(skb)->opt.router_alert && ip_call_ra_chain(skb))
0111         return NET_RX_SUCCESS;
0112
0113     skb_forward_csum(skb);
0114     net = dev_net(skb->dev);
0115
0116     /*
0117      *  According to the RFC, we must first decrease the TTL field. If
0118      *  that reaches zero, we must reply an ICMP control message telling
0119      *  that the packet's lifetime expired.
0120      */
0121     if (ip_hdr(skb)->ttl <= 1)
0122         goto too_many_hops;
0123
0124     if (!xfrm4_route_forward(skb)) {
0125         SKB_DR_SET(reason, XFRM_POLICY);
0126         goto drop;
0127     }
0128
0129     rt = skb_rtable(skb);
0130
0131     if (opt->is_strictroute && rt->rt_uses_gateway)
0132         goto sr_failed;
0133
0134     IPCB(skb)->flags |= IPSKB_FORWARDED;
0135     mtu = ip_dst_mtu_maybe_forward(&rt->dst, true);
0136     if (ip_exceeds_mtu(skb, mtu)) {
0137         IP_INC_STATS(net, IPSTATS_MIB_FRAGFAILS);
0138         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
0139               htonl(mtu));
0140         SKB_DR_SET(reason, PKT_TOO_BIG);
0141         goto drop;
0142     }
0143
0144     /* We are about to mangle packet. Copy it! */
0145     if (skb_cow(skb, LL_RESERVED_SPACE(rt->dst.dev)+rt->dst.header_len))
0146         goto drop;
0147     iph = ip_hdr(skb);
0148
0149     /* Decrease ttl after skb cow done */
0150     ip_decrease_ttl(iph);
0151
0152     /*
0153      *  We now generate an ICMP HOST REDIRECT giving the route
0154      *  we calculated.
0155      */
0156     if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
0157         !skb_sec_path(skb))
0158         ip_rt_send_redirect(skb);
0159
0160     if (READ_ONCE(net->ipv4.sysctl_ip_fwd_update_priority))
0161         skb->priority = rt_tos2priority(iph->tos);
0162
0163     return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,
0164                net, NULL, skb, skb->dev, rt->dst.dev,
0165                ip_forward_finish);
0166
0167 sr_failed:
0168     /*
0169      *  Strict routing permits no gatewaying
0170      */
0171      icmp_send(skb, ICMP_DEST_UNREACH, ICMP_SR_FAILED, 0);
0172      goto drop;
0173
0174 too_many_hops:
0175     /* Tell the sender its packet died... */
0176     __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
0177     icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
0178     SKB_DR_SET(reason, IP_INHDR);
0179 drop:
0180     kfree_skb_reason(skb, reason);
0181     return NET_RX_DROP;
0182 }