![[first]](../icons/first.png){kind=icon}
![[previous]](../icons/n_left.png){kind=icon}
![[next]](../icons/n_right.png){kind=icon}
![[last]](../icons/last.png){kind=icon}
![[top]](../icons/n_top.png){kind=icon}
![[bottom]](../icons/bottom.png){kind=icon}
![[index]](../icons/index.png){kind=icon}
![[help]](../icons/help.png){kind=icon}
*/
1 /*
2 * INET An implementation of the TCP/IP protocol suite for the LINUX
3 * operating system. INET is implemented using the BSD Socket
4 * interface as the means of communication with the user level.
5 *
6 * The IP forwarding functionality.
7 *
8 * Authors: see ip.c
9 *
10 * Fixes:
11 * Many : Split from ip.c , see ip_input.c for history.
12 */
13
14 #include <linux/config.h>
15 #include <linux/types.h>
16 #include <linux/mm.h>
17 #include <linux/sched.h>
18 #include <linux/skbuff.h>
19 #include <linux/ip.h>
20 #include <linux/icmp.h>
21 #include <linux/netdevice.h>
22 #include <net/sock.h>
23 #include <net/ip.h>
24 #include <net/icmp.h>
25 #include <linux/tcp.h>
26 #include <linux/udp.h>
27 #include <linux/firewall.h>
28 #include <linux/ip_fw.h>
29 #include <net/checksum.h>
30 #include <linux/route.h>
31 #include <net/route.h>
32
33 #ifdef CONFIG_IP_FORWARD
34 #ifdef CONFIG_IP_MROUTE
35
36 /*
37 * Encapsulate a packet by attaching a valid IPIP header to it.
38 * This avoids tunnel drivers and other mess and gives us the speed so
39 * important for multicast video.
40 */
41
42 static void ip_encap(struct sk_buff *skb, int len, struct device *out, __u32 daddr)
/* ![[next]](../icons/right.png)
![[first]](../icons/n_first.png)
![[top]](../icons/top.png)
*/
43 {
44 /*
45 * There is space for the IPIP header and MAC left.
46 *
47 * Firstly push down and install the IPIP header.
48 */
49 struct iphdr *iph=(struct iphdr *)skb_push(skb,sizeof(struct iphdr));
50 if(len>65515)
51 len=65515;
52 iph->version = 4;
53 iph->tos = skb->ip_hdr->tos;
54 iph->ttl = skb->ip_hdr->ttl;
55 iph->frag_off = 0;
56 iph->daddr = daddr;
57 iph->saddr = out->pa_addr;
58 iph->protocol = IPPROTO_IPIP;
59 iph->ihl = 5;
60 iph->tot_len = htons(skb->len);
61 iph->id = htons(ip_id_count++);
62 ip_send_check(iph);
63
64 skb->dev = out;
65 skb->arp = 1;
66 skb->raddr=daddr;
67 /*
68 * Now add the physical header (driver will push it down).
69 */
70 if (out->hard_header && out->hard_header(skb, out, ETH_P_IP, NULL, NULL, len)<0)
71 skb->arp=0;
72 /*
73 * Read to queue for transmission.
74 */
75 }
76
77 #endif
78
79 /*
80 * Forward an IP datagram to its next destination.
81 */
82
83 int ip_forward(struct sk_buff *skb, struct device *dev, int is_frag,
/* ![[previous]](../icons/left.png)
![[last]](../icons/n_last.png)
*/
84 __u32 target_addr)
85 {
86 struct device *dev2; /* Output device */
87 struct iphdr *iph; /* Our header */
88 struct sk_buff *skb2; /* Output packet */
89 struct rtable *rt; /* Route we use */
90 unsigned char *ptr; /* Data pointer */
91 unsigned long raddr; /* Router IP address */
92 struct options * opt = (struct options*)skb->proto_priv;
93 int encap = 0; /* Encap length */
94 #ifdef CONFIG_FIREWALL
95 int fw_res = 0; /* Forwarding result */
96 #ifdef CONFIG_IP_MASQUERADE
97 struct sk_buff *skb_in = skb; /* So we can remember if the masquerader did some swaps */
98 #endif
99
100 /*
101 * See if we are allowed to forward this.
102 * Note: demasqueraded fragments are always 'back'warded.
103 */
104
105
106 if(!(is_frag&4))
107 {
108 fw_res=call_fw_firewall(PF_INET, skb, skb->h.iph);
109 switch (fw_res) {
110 case FW_ACCEPT:
111 case FW_MASQUERADE:
112 break;
113 case FW_REJECT:
114 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, dev);
115 /* fall thru */
116 default:
117 return -1;
118 }
119 }
120 #endif
121 /*
122 * According to the RFC, we must first decrease the TTL field. If
123 * that reaches zero, we must reply an ICMP control message telling
124 * that the packet's lifetime expired.
125 *
126 * Exception:
127 * We may not generate an ICMP for an ICMP. icmp_send does the
128 * enforcement of this so we can forget it here. It is however
129 * sometimes VERY important.
130 */
131
132 iph = skb->h.iph;
133 iph->ttl--;
134
135 /*
136 * Re-compute the IP header checksum.
137 * This is inefficient. We know what has happened to the header
138 * and could thus adjust the checksum as Phil Karn does in KA9Q
139 */
140
141 iph->check = ntohs(iph->check) + 0x0100;
142 if ((iph->check & 0xFF00) == 0)
143 iph->check++; /* carry overflow */
144 iph->check = htons(iph->check);
145
146 if (iph->ttl <= 0)
147 {
148 /* Tell the sender its packet died... */
149 icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0, dev);
150 return -1;
151 }
152
153 #ifdef CONFIG_IP_MROUTE
154 if(!(is_frag&8))
155 {
156 #endif
157 /*
158 * OK, the packet is still valid. Fetch its destination address,
159 * and give it to the IP sender for further processing.
160 */
161
162 rt = ip_rt_route(target_addr, NULL, NULL);
163 if (rt == NULL)
164 {
165 /*
166 * Tell the sender its packet cannot be delivered. Again
167 * ICMP is screened later.
168 */
169 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_UNREACH, 0, dev);
170 return -1;
171 }
172
173
174 /*
175 * Gosh. Not only is the packet valid; we even know how to
176 * forward it onto its final destination. Can we say this
177 * is being plain lucky?
178 * If the router told us that there is no GW, use the dest.
179 * IP address itself- we seem to be connected directly...
180 */
181
182 raddr = rt->rt_gateway;
183
184 if (raddr != 0)
185 {
186 /*
187 * Strict routing permits no gatewaying
188 */
189
190 if (opt->is_strictroute)
191 {
192 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_SR_FAILED, 0, dev);
193 return -1;
194 }
195
196 /*
197 * There is a gateway so find the correct route for it.
198 * Gateways cannot in turn be gatewayed.
199 */
200 }
201 else
202 raddr = target_addr;
203
204 /*
205 * Having picked a route we can now send the frame out.
206 */
207
208 dev2 = rt->rt_dev;
209 /*
210 * In IP you never have to forward a frame on the interface that it
211 * arrived upon. We now generate an ICMP HOST REDIRECT giving the route
212 * we calculated.
213 */
214 #ifndef CONFIG_IP_NO_ICMP_REDIRECT
215 if (dev == dev2 && !((iph->saddr^iph->daddr)&dev->pa_mask) &&
216 (rt->rt_flags&RTF_MODIFIED) && !opt->srr)
217 icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, raddr, dev);
218 #endif
219 #ifdef CONFIG_IP_MROUTE
220 }
221 else
222 {
223 /*
224 * Multicast route forward. Routing is already done
225 */
226 dev2=skb->dev;
227 raddr=skb->raddr;
228 if(is_frag&16) /* VIFF_TUNNEL mode */
229 encap=20;
230 }
231 #endif
232
233
234 /*
235 * We now may allocate a new buffer, and copy the datagram into it.
236 * If the indicated interface is up and running, kick it.
237 */
238
239 if (dev2->flags & IFF_UP)
240 {
241 #ifdef CONFIG_IP_MASQUERADE
242 /*
243 * If this fragment needs masquerading, make it so...
244 * (Dont masquerade de-masqueraded fragments)
245 */
246 if (!(is_frag&4) && fw_res==FW_MASQUERADE)
247 ip_fw_masquerade(&skb, dev2);
248 #endif
249 IS_SKB(skb);
250
251 if (skb->len+encap > dev2->mtu && (ntohs(iph->frag_off) & IP_DF)) {
252 ip_statistics.IpFragFails++;
253 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, dev2->mtu, dev);
254 return -1;
255 }
256
257 #ifdef CONFIG_IP_MROUTE
258 if(skb_headroom(skb)-encap<dev2->hard_header_len)
259 {
260 skb2 = alloc_skb(dev2->hard_header_len + skb->len + encap + 15, GFP_ATOMIC);
261 #else
262 if(skb_headroom(skb)<dev2->hard_header_len)
263 {
264 skb2 = alloc_skb(dev2->hard_header_len + skb->len + 15, GFP_ATOMIC);
265 #endif
266 /*
267 * This is rare and since IP is tolerant of network failures
268 * quite harmless.
269 */
270
271 if (skb2 == NULL)
272 {
273 NETDEBUG(printk("\nIP: No memory available for IP forward\n"));
274 return -1;
275 }
276
277 IS_SKB(skb2);
278 /*
279 * Add the physical headers.
280 */
281 #ifdef CONFIG_IP_MROUTE
282 if(is_frag&16)
283 {
284 skb_reserve(skb,(encap+dev->hard_header_len+15)&~15); /* 16 byte aligned IP headers are good */
285 ip_encap(skb2,skb->len, dev2, raddr);
286 }
287 else
288 #endif
289 ip_send(skb2,raddr,skb->len,dev2,dev2->pa_addr);
290
291 /*
292 * We have to copy the bytes over as the new header wouldn't fit
293 * the old buffer. This should be very rare.
294 */
295
296 ptr = skb_put(skb2,skb->len);
297 skb2->free = 1;
298 skb2->h.raw = ptr;
299
300 /*
301 * Copy the packet data into the new buffer.
302 */
303 memcpy(ptr, skb->h.raw, skb->len);
304 memcpy(skb2->proto_priv, skb->proto_priv, sizeof(skb->proto_priv));
305 iph = skb2->ip_hdr = skb2->h.iph;
306 }
307 else
308 {
309 /*
310 * Build a new MAC header.
311 */
312
313 skb2 = skb;
314 skb2->dev=dev2;
315 #ifdef CONFIG_IP_MROUTE
316 if(is_frag&16)
317 ip_encap(skb,skb->len, dev2, raddr);
318 else
319 {
320 #endif
321 skb->arp=1;
322 skb->raddr=raddr;
323 if(dev2->hard_header)
324 {
325 if(dev2->hard_header(skb, dev2, ETH_P_IP, NULL, NULL, skb->len)<0)
326 skb->arp=0;
327 }
328 #ifdef CONFIG_IP_MROUTE
329 }
330 #endif
331 ip_statistics.IpForwDatagrams++;
332 }
333
334 if (opt->optlen)
335 {
336 unsigned char * optptr;
337 if (opt->rr_needaddr)
338 {
339 optptr = (unsigned char *)iph + opt->rr;
340 memcpy(&optptr[optptr[2]-5], &dev2->pa_addr, 4);
341 opt->is_changed = 1;
342 }
343 if (opt->srr_is_hit)
344 {
345 int srrptr, srrspace;
346
347 optptr = (unsigned char *)iph + opt->srr;
348
349 for ( srrptr=optptr[2], srrspace = optptr[1];
350 srrptr <= srrspace;
351 srrptr += 4
352 )
353 {
354 if (srrptr + 3 > srrspace)
355 break;
356 if (memcmp(&target_addr, &optptr[srrptr-1], 4) == 0)
357 break;
358 }
359 if (srrptr + 3 <= srrspace)
360 {
361 opt->is_changed = 1;
362 memcpy(&optptr[srrptr-1], &dev2->pa_addr, 4);
363 iph->daddr = target_addr;
364 optptr[2] = srrptr+4;
365 }
366 else
367 printk("ip_forward(): Argh! Destination lost!\n");
368 }
369 if (opt->ts_needaddr)
370 {
371 optptr = (unsigned char *)iph + opt->ts;
372 memcpy(&optptr[optptr[2]-9], &dev2->pa_addr, 4);
373 opt->is_changed = 1;
374 }
375 if (opt->is_changed)
376 {
377 opt->is_changed = 0;
378 ip_send_check(iph);
379 }
380 }
381 /*
382 * ANK: this is point of "no return", we cannot send an ICMP,
383 * because we changed SRR option.
384 */
385
386 /*
387 * See if it needs fragmenting. Note in ip_rcv we tagged
388 * the fragment type. This must be right so that
389 * the fragmenter does the right thing.
390 */
391
392 if(skb2->len > dev2->mtu + dev2->hard_header_len)
393 {
394 ip_fragment(NULL,skb2,dev2, is_frag);
395 kfree_skb(skb2,FREE_WRITE);
396 }
397 else
398 {
399 #ifdef CONFIG_IP_ACCT
400 /*
401 * Count mapping we shortcut
402 */
403
404 ip_fw_chk(iph,dev,ip_acct_chain,IP_FW_F_ACCEPT,1);
405 #endif
406
407 /*
408 * Map service types to priority. We lie about
409 * throughput being low priority, but it's a good
410 * choice to help improve general usage.
411 */
412 if(iph->tos & IPTOS_LOWDELAY)
413 dev_queue_xmit(skb2, dev2, SOPRI_INTERACTIVE);
414 else if(iph->tos & IPTOS_THROUGHPUT)
415 dev_queue_xmit(skb2, dev2, SOPRI_BACKGROUND);
416 else
417 dev_queue_xmit(skb2, dev2, SOPRI_NORMAL);
418 }
419 }
420 else
421 return -1;
422
423 /*
424 * Tell the caller if their buffer is free.
425 */
426
427 if(skb==skb2)
428 return 0;
429
430 #ifdef CONFIG_IP_MASQUERADE
431 /*
432 * The original is free. Free our copy and
433 * tell the caller not to free.
434 */
435 if(skb!=skb_in)
436 {
437 kfree_skb(skb_in, FREE_WRITE);
438 return 0;
439 }
440 #endif
441 return 1;
442 }
443
444
445 #endif
![[bottom]](../icons/n_bottom.png){kind=icon}
*/