3242 lines
108 KiB
C
3242 lines
108 KiB
C
// -*- mode: C++; tab-width: 4; indent-tabs-mode: nil -*- (for GNU Emacs)
|
|
//
|
|
// Copyright (c) 1985-2000 Microsoft Corporation
|
|
//
|
|
// This file is part of the Microsoft Research IPv6 Network Protocol Stack.
|
|
// You should have received a copy of the Microsoft End-User License Agreement
|
|
// for this software along with this release; see the file "license.txt".
|
|
// If not, please see http://www.research.microsoft.com/msripv6/license.htm,
|
|
// or write to Microsoft Research, One Microsoft Way, Redmond, WA 98052-6399.
|
|
//
|
|
// Abstract:
|
|
//
|
|
// Receive routines for Internet Protocol Version 6.
|
|
//
|
|
|
|
|
|
#include "oscfg.h"
|
|
#include "ndis.h"
|
|
#include "ip6imp.h"
|
|
#include "ip6def.h"
|
|
#include "icmp.h"
|
|
#include "route.h"
|
|
#include "fragment.h"
|
|
#include "mobile.h"
|
|
#include "security.h"
|
|
#include "info.h"
|
|
|
|
#include "ipsec.h"
|
|
|
|
struct ReassemblyList ReassemblyList;
|
|
|
|
typedef struct Options {
|
|
uint JumboLength; // Length of packet excluding IPv6 header.
|
|
IPv6RouterAlertOption UNALIGNED *Alert;
|
|
IPv6HomeAddressOption UNALIGNED *HomeAddress;
|
|
IPv6BindingUpdateOption UNALIGNED *BindingUpdate;
|
|
} Options;
|
|
|
|
int
|
|
ParseOptions(
|
|
IPv6Packet *Packet, // The packet handed to us by IPv6Receive.
|
|
uchar HdrType, // Hop-by-hop or destination.
|
|
IPv6OptionsHeader *Hdr, // Header with following data.
|
|
uint HdrLength, // Length of the entire options area.
|
|
Options *Opts); // Return option values to caller.
|
|
|
|
extern void TCPRcvComplete(void);
|
|
|
|
//* IPv6ReceiveComplete - Handle a receive complete.
|
|
//
|
|
// Called by the lower layer when receives are temporarily done.
|
|
//
|
|
void
|
|
IPv6ReceiveComplete(void)
|
|
{
|
|
// REVIEW: Original IP implementation had code here to call every
|
|
// REVIEW: UL protocol's receive complete routine (yes, all of them) here.
|
|
|
|
TCPRcvComplete();
|
|
}
|
|
|
|
//
|
|
// By default, test pullup in checked builds.
|
|
//
|
|
#ifndef PULLUP_TEST
|
|
#define PULLUP_TEST DBG
|
|
#endif
|
|
|
|
#if PULLUP_TEST
|
|
|
|
#define PULLUP_TEST_MAX_BUFFERS 8
|
|
#define PULLUP_TEST_MAX_BUFFER_SIZE 32
|
|
|
|
//* PullupTestChooseDistribution
|
|
//
|
|
// Choose a random distribution.
|
|
// Divides Size bytes into NumBuffers pieces,
|
|
// and returns the result in the Counts array.
|
|
//
|
|
void
|
|
PullupTestChooseDistribution(
|
|
uint Counts[],
|
|
uint NumBuffers,
|
|
uint Size)
|
|
{
|
|
uint i;
|
|
uint ThisBuffer;
|
|
|
|
//
|
|
// We are somewhat biased towards cutting the packet
|
|
// up into small pieces with a large remainder.
|
|
// This puts the fragment boundaries at the beginning,
|
|
// where the headers are.
|
|
//
|
|
|
|
for (i = 0; i < NumBuffers - 1; i++) {
|
|
ThisBuffer = RandomNumber(1, PULLUP_TEST_MAX_BUFFER_SIZE);
|
|
|
|
//
|
|
// Make sure that each segment has non-zero length.
|
|
//
|
|
if (ThisBuffer > Size - (NumBuffers - 1 - i))
|
|
ThisBuffer = Size - (NumBuffers - 1 - i);
|
|
|
|
Counts[i] = ThisBuffer;
|
|
Size -= ThisBuffer;
|
|
}
|
|
Counts[i] = Size;
|
|
}
|
|
|
|
//* PullupTestCreatePacket
|
|
//
|
|
// Given an IPv6 packet, creates a new IPv6 packet
|
|
// that can be handed up the receive path.
|
|
//
|
|
// We randomly fragment the IPv6 packet into multiple buffers.
|
|
// This tests pull-up processing in the receive path.
|
|
//
|
|
// Returns NULL if any memory allocation fails.
|
|
//
|
|
IPv6Packet *
|
|
PullupTestCreatePacket(IPv6Packet *Packet)
|
|
{
|
|
IPv6Packet *TestPacket;
|
|
|
|
//
|
|
// We mostly want to test discontiguous packets.
|
|
// But occasionally test a contiguous packet.
|
|
//
|
|
if (RandomNumber(0, 10) == 0) {
|
|
//
|
|
// We need to create a contiguous packet.
|
|
//
|
|
uint Padding;
|
|
uint MemLen;
|
|
void *Mem;
|
|
|
|
//
|
|
// We insert some padding to vary the alignment.
|
|
//
|
|
Padding = RandomNumber(0, 16);
|
|
MemLen = sizeof *TestPacket + Padding + Packet->TotalSize;
|
|
TestPacket = ExAllocatePool(NonPagedPool, MemLen);
|
|
if (TestPacket == NULL)
|
|
return NULL;
|
|
Mem = (void *)((uchar *)(TestPacket + 1) + Padding);
|
|
|
|
if (Packet->NdisPacket == NULL) {
|
|
RtlCopyMemory(Mem, Packet->Data, Packet->TotalSize);
|
|
}
|
|
else {
|
|
PNDIS_BUFFER NdisBuffer;
|
|
uint Offset;
|
|
int Ok;
|
|
|
|
NdisBuffer = NdisFirstBuffer(Packet->NdisPacket);
|
|
Offset = Packet->Position;
|
|
Ok = CopyNdisToFlat(Mem, NdisBuffer, Offset, Packet->TotalSize,
|
|
&NdisBuffer, &Offset);
|
|
ASSERT(Ok);
|
|
}
|
|
|
|
RtlZeroMemory(TestPacket, sizeof *TestPacket);
|
|
TestPacket->Data = TestPacket->FlatData = Mem;
|
|
TestPacket->ContigSize = TestPacket->TotalSize = Packet->TotalSize;
|
|
TestPacket->NTEorIF = Packet->NTEorIF;
|
|
TestPacket->Flags = Packet->Flags;
|
|
}
|
|
else {
|
|
//
|
|
// Create a packet with multiple NDIS buffers.
|
|
// Start with an over-estimate of the size of the MDLs we need.
|
|
//
|
|
uint NumPages = (Packet->TotalSize >> PAGE_SHIFT) + 2;
|
|
uint MdlRawSize = sizeof(MDL) + (NumPages * sizeof(PFN_NUMBER));
|
|
uint MdlAlign = __builtin_alignof(MDL) - 1;
|
|
uint MdlSize = (MdlRawSize + MdlAlign) &~ MdlAlign;
|
|
uint Padding;
|
|
uint MemLen;
|
|
uint Counts[PULLUP_TEST_MAX_BUFFERS];
|
|
uint NumBuffers;
|
|
void *Mem;
|
|
PNDIS_PACKET NdisPacket;
|
|
PNDIS_BUFFER NdisBuffer;
|
|
uint Garbage = 0xdeadbeef;
|
|
uint i;
|
|
|
|
//
|
|
// Choose the number of buffers/MDLs that we will use
|
|
// and the distribution of bytes into those buffers.
|
|
//
|
|
NumBuffers = RandomNumber(1, PULLUP_TEST_MAX_BUFFERS);
|
|
PullupTestChooseDistribution(Counts, NumBuffers, Packet->TotalSize);
|
|
|
|
//
|
|
// Allocate all the memory that we will need.
|
|
// (Actually a bit of an over-estimate.)
|
|
// We insert some padding to vary the initial alignment.
|
|
//
|
|
Padding = RandomNumber(0, 16);
|
|
MemLen = (sizeof *TestPacket + sizeof(NDIS_PACKET) +
|
|
NumBuffers * (MdlSize + sizeof Garbage) +
|
|
Padding + Packet->TotalSize);
|
|
TestPacket = ExAllocatePool(NonPagedPool, MemLen);
|
|
if (TestPacket == NULL)
|
|
return NULL;
|
|
NdisPacket = (PNDIS_PACKET)(TestPacket + 1);
|
|
NdisBuffer = (PNDIS_BUFFER)(NdisPacket + 1);
|
|
Mem = (void *)((uchar *)NdisBuffer + NumBuffers * MdlSize + Padding);
|
|
|
|
//
|
|
// Initialize the NDIS packet and buffers.
|
|
//
|
|
RtlZeroMemory(NdisPacket, sizeof *NdisPacket);
|
|
for (i = 0; i < NumBuffers; i++) {
|
|
MmInitializeMdl(NdisBuffer, Mem, Counts[i]);
|
|
MmBuildMdlForNonPagedPool(NdisBuffer);
|
|
NdisChainBufferAtBack(NdisPacket, NdisBuffer);
|
|
RtlCopyMemory((uchar *)Mem + Counts[i], &Garbage, sizeof Garbage);
|
|
|
|
(uchar *)Mem += Counts[i] + sizeof Garbage;
|
|
(uchar *)NdisBuffer += MdlSize;
|
|
}
|
|
|
|
//
|
|
// Copy data to the new packet.
|
|
//
|
|
CopyToBufferChain((PNDIS_BUFFER)(NdisPacket + 1), 0,
|
|
Packet->NdisPacket, Packet->Position,
|
|
Packet->FlatData, Packet->TotalSize);
|
|
|
|
//
|
|
// Initialize the new packet.
|
|
//
|
|
InitializePacketFromNdis(TestPacket, NdisPacket, 0);
|
|
TestPacket->NTEorIF = Packet->NTEorIF;
|
|
TestPacket->Flags = Packet->Flags;
|
|
}
|
|
|
|
return TestPacket;
|
|
}
|
|
#endif // PULLUP_TEST
|
|
|
|
|
|
//* IPv6Receive - Receive an incoming IPv6 datagram.
|
|
//
|
|
// This is the routine called by the link layer module when an incoming IPv6
|
|
// datagram is to be processed. We validate the datagram and decide what to
|
|
// do with it.
|
|
//
|
|
// The Packet->NTEorIF field holds the NTE or interface that is receiving
|
|
// the packet. Typically this is an interface, but there are some tunnel
|
|
// situations where the link layer has already found an NTE.
|
|
//
|
|
// Either the caller should hold a reference to the NTE or interface
|
|
// across the call, or the caller can place a reference in the Packet
|
|
// with PACKET_HOLDS_REF. If the caller specifies PACKET_HOLDS_REF,
|
|
/// IPv6Receive will release the reference.
|
|
//
|
|
// There is one exception: the caller can supply an interface
|
|
// with zero references (not using PACKET_HOLDS_REF),
|
|
// if the interface is being destroyed but IF->Cleanup has not yet returned.
|
|
//
|
|
// NB: The datagram may either be held in a NDIS_PACKET allocated by the
|
|
// link-layer or the interface driver (in which case 'Packet->NdisPacket'
|
|
// is non-NULL and 'Data' points to the first data buffer in the buffer
|
|
// chain), or the datagram may still be held by NDIS (in which case
|
|
// 'Packet->NdisPacket' is NULL and 'Data' points to a buffer containing
|
|
// the entire datagram).
|
|
//
|
|
// NB: We do NOT check for link-level multi/broadcasts to
|
|
// IPv6 unicast destinations. In the IPv4 world, receivers dropped
|
|
// such packets, but in the IPv6 world they are accepted.
|
|
//
|
|
// Returns count of references for the packet.
|
|
// For now, this should always be zero.
|
|
// Someday in the future this might be used to indicate
|
|
// that the IPv6 layer has not finished its receive processing.
|
|
//
|
|
// Callable from DPC context, not from thread context.
|
|
//
|
|
int
|
|
IPv6Receive(IPv6Packet *Packet)
|
|
{
|
|
uchar NextHeader; // Current header's NextHeader field.
|
|
uchar (*Handler)();
|
|
SALinkage *ThisSA, *NextSA;
|
|
int PktRefs;
|
|
|
|
ASSERT((Packet->FlatData == NULL) != (Packet->NdisPacket == NULL));
|
|
ASSERT(Packet->NTEorIF != NULL);
|
|
ASSERT(Packet->SAPerformed == NULL);
|
|
|
|
IPSIncrementInReceiveCount();
|
|
|
|
//
|
|
// Ensure that the packet is accessible in the kernel address space.
|
|
// If any mappings fail, just drop the packet.
|
|
// In practice, the packet buffers are usually already mapped.
|
|
// But they may not be, for example in loopback.
|
|
//
|
|
if (Packet->NdisPacket != NULL) {
|
|
NDIS_BUFFER *Buffer;
|
|
|
|
Buffer = NdisFirstBuffer(Packet->NdisPacket);
|
|
if (! MapNdisBuffers(Buffer)) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
|
|
"IPv6Receive(%p): buffer mapping failed\n",
|
|
Packet));
|
|
IPSInfo.ipsi_indiscards++;
|
|
return 0; // Drop the packet.
|
|
}
|
|
}
|
|
|
|
#if PULLUP_TEST
|
|
Packet = PullupTestCreatePacket(Packet);
|
|
if (Packet == NULL) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
|
|
"IPv6Receive(%p): PullupTestCreatePacket failed\n",
|
|
Packet));
|
|
IPSInfo.ipsi_indiscards++;
|
|
return 0; // Drop the packet.
|
|
}
|
|
#endif
|
|
|
|
//
|
|
// Iteratively switch out to the handler for each successive next header
|
|
// until we reach a handler that reports no more headers follow it.
|
|
//
|
|
// NB: We do NOT check NTE->DADStatus here.
|
|
// That is the responsibility of higher-level protocols.
|
|
//
|
|
NextHeader = IP_PROTOCOL_V6; // Always first header in packet.
|
|
do {
|
|
//
|
|
// Current header indicates that another header follows.
|
|
// See if we have a handler for it.
|
|
//
|
|
Handler = ProtocolSwitchTable[NextHeader].DataReceive;
|
|
if (Handler == NULL) {
|
|
|
|
//
|
|
// We don't have a handler for this header type,
|
|
// so see if there is a raw receiver for it.
|
|
//
|
|
if (!RawReceive(Packet, NextHeader)) {
|
|
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"IPv6 Receive: Next Header type %u not handled.\n",
|
|
NextHeader));
|
|
|
|
//
|
|
// There isn't a raw receiver either.
|
|
// Send an ICMP error message.
|
|
// ICMP Pointer value is the offset from the start of the
|
|
// incoming packet's IPv6 header to the offending field.
|
|
//
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_UNRECOGNIZED_NEXT_HEADER,
|
|
Packet->NextHeaderPosition -
|
|
Packet->IPPosition,
|
|
NextHeader, FALSE);
|
|
|
|
IPSInfo.ipsi_inunknownprotos++;
|
|
} else {
|
|
IPSIncrementInDeliverCount();
|
|
}
|
|
|
|
break; // We can't do anything more with this packet.
|
|
}
|
|
|
|
NextHeader = (*Handler)(Packet);
|
|
} while (NextHeader != IP_PROTOCOL_NONE);
|
|
|
|
//
|
|
// If this packet holds a reference, free it now.
|
|
//
|
|
if (Packet->Flags & PACKET_HOLDS_REF) {
|
|
if (IsNTE(Packet->NTEorIF))
|
|
ReleaseNTE(CastToNTE(Packet->NTEorIF));
|
|
else
|
|
ReleaseIF(CastToIF(Packet->NTEorIF));
|
|
}
|
|
|
|
//
|
|
// Clean up any contiguous regions left by PacketPullup.
|
|
//
|
|
PacketPullupCleanup(Packet);
|
|
|
|
//
|
|
// Clean up list of SA's performed.
|
|
//
|
|
for (ThisSA = Packet->SAPerformed; ThisSA != NULL; ThisSA = NextSA) {
|
|
ReleaseSA(ThisSA->This);
|
|
NextSA = ThisSA->Next;
|
|
ExFreePool(ThisSA);
|
|
}
|
|
|
|
PktRefs = Packet->RefCnt;
|
|
#if PULLUP_TEST
|
|
ExFreePool(Packet);
|
|
#endif
|
|
return PktRefs;
|
|
}
|
|
|
|
|
|
//* IPv6HeaderReceive - Handle a IPv6 header.
|
|
//
|
|
// This is the routine called to process an IPv6 header, a next header
|
|
// value of 41 (e.g. as would be encountered with v6 in v6 tunnels). To
|
|
// avoid code duplication, it is also used to process the initial IPv6
|
|
// header found in all IPv6 packets, in which mode it may be viewed as
|
|
// a continuation of IPv6Receive.
|
|
//
|
|
uchar
|
|
IPv6HeaderReceive(
|
|
IPv6Packet *Packet) // Packet handed to us by IPv6Receive.
|
|
{
|
|
uint PayloadLength;
|
|
uchar NextHeader;
|
|
int Forwarding; // TRUE means Forwarding, FALSE means Receiving.
|
|
|
|
//
|
|
// Sanity-check ContigSize & TotalSize.
|
|
// Higher-level code in the receive path relies on these conditions.
|
|
//
|
|
ASSERT(Packet->ContigSize <= Packet->TotalSize);
|
|
|
|
//
|
|
// If we are decapsulating a packet,
|
|
// remember that this packet was originally tunneled.
|
|
//
|
|
// Some argue that decapsulating and receiving
|
|
// the inner packet on the same interface as the outer packet
|
|
// is incorrect: the inner packet should be received
|
|
// on a tunnel interface distinct from the original interface.
|
|
// (This approach introduces some issues with handling
|
|
// IPsec encapsulation, especially tunnel-mode IPsec between peers
|
|
// where you want the inner & outer source address to be the same.)
|
|
//
|
|
// In any case, for now we receive the inner packet on the original
|
|
// interface. However, this introduces a potential security
|
|
// problem. An off-link node can send an encapsulated packet
|
|
// that when decapsulated, appears to have originated from
|
|
// an on-link neighbor. This is a security problem for ND.
|
|
// We can not conveniently decrement the HopLimit (to make ND's
|
|
// check against 255 effective in this case), because the packet
|
|
// is read-only. Instead, we remember that the packet is tunneled
|
|
// and check this flag bit in the ND code.
|
|
//
|
|
if (Packet->IP != NULL) {
|
|
Packet->Flags |= PACKET_TUNNELED;
|
|
Packet->Flags &= ~PACKET_SAW_HA_OPT; // Forget if we saw one.
|
|
Packet->SkippedHeaderLength = 0;
|
|
|
|
//
|
|
// If we've already done some IPSec processing on this packet,
|
|
// then this is a tunnel header and the preceeding IPSec header
|
|
// is operating in tunnel mode.
|
|
//
|
|
if (Packet->SAPerformed != NULL)
|
|
Packet->SAPerformed->Mode = TUNNEL;
|
|
} else {
|
|
//
|
|
// In the reassembly path, we remember if the fragments were
|
|
// tunneled but we do not have a Packet->IP.
|
|
//
|
|
ASSERT((((Packet->Flags & PACKET_TUNNELED) == 0) ||
|
|
(Packet->Flags & PACKET_REASSEMBLED)) &&
|
|
((Packet->Flags & PACKET_SAW_HA_OPT) == 0) &&
|
|
(Packet->SAPerformed == NULL));
|
|
}
|
|
|
|
//
|
|
// Make sure we have enough contiguous bytes for an IPv6 header, otherwise
|
|
// attempt to pullup that amount. Then stash away a pointer to the header
|
|
// and also remember the offset into the packet at which it begins (needed
|
|
// to calculate an offset for certain ICMP error messages).
|
|
//
|
|
if (! PacketPullup(Packet, sizeof(IPv6Header),
|
|
__builtin_alignof(IPv6Addr), 0)) {
|
|
// Pullup failed.
|
|
if (Packet->TotalSize < sizeof(IPv6Header))
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"IPv6HeaderReceive: "
|
|
"Packet too small to contain IPv6 header\n"));
|
|
IPSInfo.ipsi_inhdrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
Packet->IP = (IPv6Header UNALIGNED *)Packet->Data;
|
|
Packet->IPPosition = Packet->Position;
|
|
Packet->NextHeaderPosition = Packet->Position +
|
|
FIELD_OFFSET(IPv6Header, NextHeader);
|
|
|
|
//
|
|
// Skip over IPv6 header (note we keep our pointer to it).
|
|
//
|
|
AdjustPacketParams(Packet, sizeof(IPv6Header));
|
|
|
|
//
|
|
// Check the IP version is correct.
|
|
// We specifically do NOT check HopLimit.
|
|
// HopLimit is only checked when forwarding.
|
|
//
|
|
if ((Packet->IP->VersClassFlow & IP_VER_MASK) != IP_VERSION) {
|
|
// Silently discard the packet.
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"IPv6HeaderReceive: bad version\n"));
|
|
IPSInfo.ipsi_inhdrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// We use a separate pointer to refer to the source address so that
|
|
// later options can change it.
|
|
//
|
|
Packet->SrcAddr = AlignAddr(&Packet->IP->Source);
|
|
|
|
//
|
|
// Protect against attacks that use bogus source addresses.
|
|
//
|
|
if (IsInvalidSourceAddress(Packet->SrcAddr)) {
|
|
// Silently discard the packet.
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"IPv6HeaderReceive: source address is invalid\n"));
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
if (IsLoopback(Packet->SrcAddr) &&
|
|
((Packet->Flags & PACKET_LOOPED_BACK) == 0)) {
|
|
// Silently discard the packet.
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"IPv6HeaderReceive: loopback source addr from wire?\n"));
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
if (IsNTE(Packet->NTEorIF)) {
|
|
NetTableEntry *NTE;
|
|
|
|
//
|
|
// We were called with an NTE.
|
|
// Our caller (or the packet itself) should be holding a reference.
|
|
// The NTE holds an interface reference.
|
|
//
|
|
NTE = CastToNTE(Packet->NTEorIF);
|
|
|
|
//
|
|
// Verify that the packet's destination address is
|
|
// consistent with this NTE.
|
|
//
|
|
if (!IP6_ADDR_EQUAL(AlignAddr(&Packet->IP->Dest), &NTE->Address)) {
|
|
Interface *IF = NTE->IF;
|
|
|
|
//
|
|
// We can't accept this new header on this NTE.
|
|
// Convert to an Interface and punt to forwarding code below.
|
|
//
|
|
if (Packet->Flags & PACKET_HOLDS_REF) {
|
|
AddRefIF(IF);
|
|
ReleaseNTE(NTE);
|
|
}
|
|
else {
|
|
//
|
|
// Our caller holds a reference for the NTE,
|
|
// which holds a reference for the interface.
|
|
// So the packet does not need to hold a reference.
|
|
//
|
|
}
|
|
Packet->NTEorIF = CastFromIF(IF);
|
|
goto Forward;
|
|
}
|
|
|
|
//
|
|
// We are Receiving the packet.
|
|
//
|
|
Forwarding = FALSE;
|
|
|
|
} else {
|
|
NetTableEntryOrInterface *NTEorIF;
|
|
ushort Type;
|
|
|
|
//
|
|
// We were called with an Interface.
|
|
// In some situations, there is no reference for this interface
|
|
// and the interface is being destroyed. FindAddressOnInterface
|
|
// will return NULL in that case. After this point, we must ensure
|
|
// that the interface does have a reference, by having the packet
|
|
// hold a reference for the interface or a reference for an NTE
|
|
// on the interface.
|
|
//
|
|
NTEorIF = FindAddressOnInterface(CastToIF(Packet->NTEorIF),
|
|
AlignAddr(&Packet->IP->Dest), &Type);
|
|
if (NTEorIF == NULL) {
|
|
//
|
|
// The interface is being destroyed.
|
|
//
|
|
IPSInfo.ipsi_indiscards++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// FindAddressOnInterface returned a reference to NTEorIF
|
|
// (which could be an interface or an NTE). We either need
|
|
// to put this reference into the packet, or release it
|
|
// if the packet already holds an appropriate reference.
|
|
//
|
|
|
|
if (Type == ADE_NONE) {
|
|
//
|
|
// If the packet does not hold a reference for the interface,
|
|
// give it one now.
|
|
//
|
|
ASSERT(NTEorIF == Packet->NTEorIF);
|
|
if (Packet->Flags & PACKET_HOLDS_REF) {
|
|
//
|
|
// The packet already holds an interface reference,
|
|
// so our reference is not neeeded.
|
|
//
|
|
ReleaseIF(CastToIF(NTEorIF));
|
|
}
|
|
else {
|
|
//
|
|
// Give the packet our interface reference.
|
|
//
|
|
Packet->Flags |= PACKET_HOLDS_REF;
|
|
}
|
|
|
|
//
|
|
// The address is not assigned to this interface. Check to see
|
|
// if it is appropriate for us to forward this packet.
|
|
// If not, drop it. At this point, we are fairly
|
|
// conservative about what we will forward.
|
|
//
|
|
Forward:
|
|
if (!(CastToIF(Packet->NTEorIF)->Flags & IF_FLAG_FORWARDS) ||
|
|
(Packet->Flags & PACKET_NOT_LINK_UNICAST) ||
|
|
IsUnspecified(AlignAddr(&Packet->IP->Source)) ||
|
|
IsLoopback(AlignAddr(&Packet->IP->Source))) {
|
|
//
|
|
// Drop the packet with no ICMP error.
|
|
//
|
|
IPSInfo.ipsi_inaddrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// No support yet for forwarding multicast packets.
|
|
//
|
|
if (IsUnspecified(AlignAddr(&Packet->IP->Dest)) ||
|
|
IsLoopback(AlignAddr(&Packet->IP->Dest)) ||
|
|
IsMulticast(AlignAddr(&Packet->IP->Dest))) {
|
|
//
|
|
// Send an ICMP error.
|
|
//
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_DESTINATION_UNREACHABLE,
|
|
ICMPv6_COMMUNICATION_PROHIBITED,
|
|
0, Packet->IP->NextHeader, FALSE);
|
|
IPSInfo.ipsi_inaddrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// We do the actual forwarding below...
|
|
//
|
|
Forwarding = TRUE;
|
|
|
|
} else {
|
|
//
|
|
// If we found a unicast ADE, then remember the NTE.
|
|
// Conceptually, we think of the packet as holding
|
|
// the reference to the NTE. Normally for multicast/anycast
|
|
// addresses, we delay our choice of an appropriate NTE
|
|
// until it is time to reply to the packet.
|
|
//
|
|
if (IsNTE(NTEorIF)) {
|
|
NetTableEntry *NTE = CastToNTE(NTEorIF);
|
|
Interface *IF = NTE->IF;
|
|
|
|
ASSERT(CastFromIF(IF) == Packet->NTEorIF);
|
|
|
|
if (!IsValidNTE(NTE)) {
|
|
//
|
|
// The unicast address is not valid, so it can't
|
|
// receive packets. The address may be assigned
|
|
// to some other node, so forwarding is appropriate.
|
|
//
|
|
// Ensure that the packet holds an interface reference.
|
|
//
|
|
if (!(Packet->Flags & PACKET_HOLDS_REF)) {
|
|
//
|
|
// The packet does not already hold an interface ref,
|
|
// so give it one.
|
|
//
|
|
AddRefIF(IF);
|
|
Packet->Flags |= PACKET_HOLDS_REF;
|
|
}
|
|
//
|
|
// Now our NTE reference is not needed.
|
|
//
|
|
ReleaseNTE(NTE);
|
|
goto Forward;
|
|
}
|
|
|
|
//
|
|
// Ensure that the packet holds a reference for the NTE,
|
|
// which holds an interface reference.
|
|
//
|
|
if (Packet->Flags & PACKET_HOLDS_REF) {
|
|
//
|
|
// The packet already holds an interface reference.
|
|
// Release that reference and give the packet
|
|
// our NTE reference.
|
|
//
|
|
ReleaseIF(IF);
|
|
}
|
|
else {
|
|
//
|
|
// The packet does not hold a reference.
|
|
// Give the packet our NTE reference.
|
|
//
|
|
Packet->Flags |= PACKET_HOLDS_REF;
|
|
}
|
|
Packet->NTEorIF = CastFromNTE(NTE);
|
|
}
|
|
else {
|
|
//
|
|
// Ensure that the packet holds an interface reference.
|
|
//
|
|
ASSERT(NTEorIF == Packet->NTEorIF);
|
|
if (Packet->Flags & PACKET_HOLDS_REF) {
|
|
//
|
|
// The packet already holds an interface reference,
|
|
// so our reference is not needed.
|
|
//
|
|
ReleaseIF(CastToIF(NTEorIF));
|
|
}
|
|
else {
|
|
//
|
|
// Give our interface reference to the packet.
|
|
//
|
|
Packet->Flags |= PACKET_HOLDS_REF;
|
|
}
|
|
}
|
|
|
|
//
|
|
// We found an ADE on this IF to accept the packet,
|
|
// so we will be Receiving it.
|
|
//
|
|
Forwarding = FALSE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// At this point, the Forwarding variable tells us
|
|
// if we are forwarding or receiving the packet.
|
|
//
|
|
|
|
//
|
|
// Before processing any headers, including Hop-by-Hop,
|
|
// check that the amount of payload the IPv6 header thinks is present
|
|
// can actually fit inside the packet data area that the link handed us.
|
|
// Note that a Payload Length of zero *might* mean a Jumbo Payload option.
|
|
//
|
|
PayloadLength = net_short(Packet->IP->PayloadLength);
|
|
if (PayloadLength > Packet->TotalSize) {
|
|
// Silently discard the packet.
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"IPv6HeaderReceive: Header's PayloadLength is greater than "
|
|
"the amount of data received\n"));
|
|
IPSInfo.ipsi_inhdrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// Check for Hop-by-Hop Options.
|
|
//
|
|
if (Packet->IP->NextHeader == IP_PROTOCOL_HOP_BY_HOP) {
|
|
int RetVal;
|
|
|
|
//
|
|
// If there is a Jumbo Payload option, HopByHopOptionsReceive
|
|
// will adjust the packet size. Otherwise we take care of it
|
|
// now, before reading the Hop-by-Hop header.
|
|
//
|
|
if (PayloadLength != 0) {
|
|
Packet->TotalSize = PayloadLength;
|
|
if (Packet->ContigSize > PayloadLength)
|
|
Packet->ContigSize = PayloadLength;
|
|
}
|
|
|
|
//
|
|
// Parse the Hop-by-Hop options.
|
|
//
|
|
RetVal = HopByHopOptionsReceive(Packet);
|
|
if (RetVal < 0) {
|
|
//
|
|
// The packet had bad Hop-by-Hop Options.
|
|
// Drop it.
|
|
//
|
|
IPSInfo.ipsi_inhdrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
NextHeader = (uchar)RetVal; // Truncate to 8 bits.
|
|
|
|
} else {
|
|
//
|
|
// No Jumbo Payload option. Adjust the packet size.
|
|
//
|
|
Packet->TotalSize = PayloadLength;
|
|
if (Packet->ContigSize > PayloadLength)
|
|
Packet->ContigSize = PayloadLength;
|
|
|
|
//
|
|
// No Hop-by-Hop options.
|
|
//
|
|
NextHeader = Packet->IP->NextHeader;
|
|
}
|
|
|
|
//
|
|
// Check if we are forwarding this packet.
|
|
//
|
|
if (Forwarding) {
|
|
IPv6Header UNALIGNED *FwdIP;
|
|
NDIS_PACKET *FwdPacket;
|
|
NDIS_STATUS NdisStatus;
|
|
uint Offset;
|
|
uint MemLen;
|
|
uchar *Mem;
|
|
uint TunnelStart = NO_TUNNEL, IPSecBytes = 0;
|
|
IPSecProc *IPSecToDo;
|
|
uint Action;
|
|
RouteCacheEntry *RCE;
|
|
IP_STATUS Status;
|
|
|
|
//
|
|
// Verify IPSec was performed.
|
|
//
|
|
if (InboundSecurityCheck(Packet, 0, 0, 0,
|
|
CastToIF(Packet->NTEorIF)) != TRUE) {
|
|
//
|
|
// No policy was found or the policy indicated to drop the packet.
|
|
//
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"IPv6Receive: "
|
|
"IPSec lookup failed or policy was to drop\n"));
|
|
IPSInfo.ipsi_inaddrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// At this time, we need to copy the incoming packet,
|
|
// for several reasons: We can't hold the Packet
|
|
// once IPv6HeaderReceive returns, yet we need to queue
|
|
// packet to forward it. We need to modify the packet
|
|
// (in IPv6Forward) by decrementing the hop count,
|
|
// yet our incoming packet is read-only. Finally,
|
|
// we need space in the outgoing packet for the outgoing
|
|
// interface's link-level header, which may differ in size
|
|
// from that of the incoming interface. Someday, we can
|
|
// implement support for returning a non-zero reference
|
|
// count from IPv6Receive and only copy the incoming
|
|
// packet's header to construct the outgoing packet.
|
|
//
|
|
|
|
//
|
|
// Find a route to the new destination.
|
|
//
|
|
Status = RouteToDestination(AlignAddr(&Packet->IP->Dest),
|
|
0, Packet->NTEorIF,
|
|
RTD_FLAG_LOOSE, &RCE);
|
|
if (Status != IP_SUCCESS) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_INTERNAL_ERROR,
|
|
"IPv6HeaderReceive: "
|
|
"No route to destination for forwarding.\n"));
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_DESTINATION_UNREACHABLE,
|
|
ICMPv6_NO_ROUTE_TO_DESTINATION,
|
|
0, NextHeader, FALSE);
|
|
IPSInfo.ipsi_outnoroutes++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// Find the Security Policy for this outbound traffic.
|
|
//
|
|
IPSecToDo = OutboundSPLookup(AlignAddr(&Packet->IP->Source),
|
|
AlignAddr(&Packet->IP->Dest),
|
|
0, 0, 0, RCE->NCE->IF, &Action);
|
|
|
|
if (IPSecToDo == NULL) {
|
|
//
|
|
// Check Action.
|
|
//
|
|
if (Action == LOOKUP_DROP) {
|
|
// Drop packet.
|
|
ReleaseRCE(RCE);
|
|
IPSInfo.ipsi_inaddrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
} else {
|
|
if (Action == LOOKUP_IKE_NEG) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"IPv6HeaderReceive: IKE not supported yet.\n"));
|
|
ReleaseRCE(RCE);
|
|
IPSInfo.ipsi_inaddrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// With no IPSec to perform, IPv6Forward won't be changing the
|
|
// outgoing interface from what we currently think it will be.
|
|
// So we can use the exact size of its link-level header.
|
|
//
|
|
Offset = RCE->NCE->IF->LinkHeaderSize;
|
|
|
|
} else {
|
|
//
|
|
// Calculate the space needed for the IPSec headers.
|
|
//
|
|
IPSecBytes = IPSecBytesToInsert(IPSecToDo, &TunnelStart, NULL);
|
|
|
|
if (TunnelStart != 0) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"IPv6HeaderReceive: IPSec Tunnel mode only.\n"));
|
|
FreeIPSecToDo(IPSecToDo, IPSecToDo->BundleSize);
|
|
ReleaseRCE(RCE);
|
|
IPSInfo.ipsi_inaddrerrors++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// The IPSec code in IPv6Forward might change the outgoing
|
|
// interface from what we currently think it will be.
|
|
// Leave the max amount of space for its link-level header.
|
|
//
|
|
Offset = MAX_LINK_HEADER_SIZE;
|
|
}
|
|
|
|
PayloadLength = Packet->TotalSize;
|
|
MemLen = Offset + sizeof(IPv6Header) + PayloadLength + IPSecBytes;
|
|
|
|
NdisStatus = IPv6AllocatePacket(MemLen, &FwdPacket, &Mem);
|
|
if (NdisStatus != NDIS_STATUS_SUCCESS) {
|
|
if (IPSecToDo) {
|
|
FreeIPSecToDo(IPSecToDo, IPSecToDo->BundleSize);
|
|
}
|
|
ReleaseRCE(RCE);
|
|
IPSInfo.ipsi_indiscards++;
|
|
return IP_PROTOCOL_NONE; // We can't forward.
|
|
}
|
|
|
|
FwdIP = (IPv6Header UNALIGNED *)(Mem + Offset + IPSecBytes);
|
|
|
|
//
|
|
// Copy from the incoming packet to the outgoing packet.
|
|
//
|
|
CopyPacketToBuffer((uchar *)FwdIP, Packet,
|
|
sizeof(IPv6Header) + PayloadLength,
|
|
Packet->IPPosition);
|
|
|
|
//
|
|
// Send the outgoing packet.
|
|
//
|
|
IPv6Forward(Packet->NTEorIF, FwdPacket, Offset + IPSecBytes, FwdIP,
|
|
PayloadLength, TRUE, // OK to Redirect.
|
|
IPSecToDo, RCE);
|
|
|
|
if (IPSecToDo) {
|
|
FreeIPSecToDo(IPSecToDo, IPSecToDo->BundleSize);
|
|
}
|
|
|
|
ReleaseRCE(RCE);
|
|
|
|
return IP_PROTOCOL_NONE;
|
|
} // end of if (Forwarding)
|
|
|
|
//
|
|
// Packet is for this node.
|
|
// Note: We may only be an intermediate node and not the packet's final
|
|
// destination, if there is a routing header.
|
|
//
|
|
return NextHeader;
|
|
}
|
|
|
|
|
|
//* ReassemblyInit
|
|
//
|
|
// Initialize data structures required for fragment reassembly.
|
|
//
|
|
void
|
|
ReassemblyInit(void)
|
|
{
|
|
KeInitializeSpinLock(&ReassemblyList.Lock);
|
|
ReassemblyList.First = ReassemblyList.Last = SentinelReassembly;
|
|
KeInitializeSpinLock(&ReassemblyList.LockSize);
|
|
}
|
|
|
|
|
|
//* ReassemblyUnload
|
|
//
|
|
// Cleanup the fragment reassembly data structures and
|
|
// prepare for stack unload.
|
|
//
|
|
void
|
|
ReassemblyUnload(void)
|
|
{
|
|
//
|
|
// We are called after all interfaces have been destroyed,
|
|
// so the reassemblies should already be gone.
|
|
//
|
|
|
|
ASSERT(ReassemblyList.Last == SentinelReassembly);
|
|
ASSERT(ReassemblyList.Size == 0);
|
|
}
|
|
|
|
|
|
//* ReassemblyRemove
|
|
//
|
|
// Cleanup the fragment reassembly data structures
|
|
// when an interface becomes invalid.
|
|
//
|
|
// Callable from DPC or thread context.
|
|
//
|
|
void
|
|
ReassemblyRemove(Interface *IF)
|
|
{
|
|
Reassembly *DeleteList = NULL;
|
|
Reassembly *Reass, *NextReass;
|
|
KIRQL OldIrql;
|
|
|
|
KeAcquireSpinLock(&ReassemblyList.Lock, &OldIrql);
|
|
for (Reass = ReassemblyList.First;
|
|
Reass != SentinelReassembly;
|
|
Reass = NextReass) {
|
|
NextReass = Reass->Next;
|
|
|
|
if (Reass->IF == IF) {
|
|
//
|
|
// Remove this reassembly.
|
|
// If it is not already being deleted,
|
|
// put it on our temporary list.
|
|
//
|
|
RemoveReassembly(Reass);
|
|
KeAcquireSpinLockAtDpcLevel(&Reass->Lock);
|
|
if (Reass->State == REASSEMBLY_STATE_DELETING) {
|
|
//
|
|
// Note that it has been removed from the list.
|
|
//
|
|
Reass->State = REASSEMBLY_STATE_REMOVED;
|
|
}
|
|
else {
|
|
Reass->Next = DeleteList;
|
|
DeleteList = Reass;
|
|
}
|
|
KeReleaseSpinLockFromDpcLevel(&Reass->Lock);
|
|
}
|
|
}
|
|
KeReleaseSpinLock(&ReassemblyList.Lock, OldIrql);
|
|
|
|
//
|
|
// Actually free the reassemblies that we removed above.
|
|
//
|
|
while ((Reass = DeleteList) != NULL) {
|
|
DeleteList = Reass->Next;
|
|
DeleteReassembly(Reass);
|
|
}
|
|
}
|
|
|
|
|
|
//* FragmentReceive - Handle a IPv6 datagram fragment.
|
|
//
|
|
// This is the routine called by IPv6 when it receives a fragment of an
|
|
// IPv6 datagram, i.e. a next header value of 44. Here we attempt to
|
|
// reassemble incoming fragments into complete IPv6 datagrams.
|
|
//
|
|
// If a later fragment provides data that conflicts with an earlier
|
|
// fragment, then we use the first-arriving data.
|
|
//
|
|
// We silently drop the fragment and stop reassembly in several
|
|
// cases that are not specified in the spec, to prevent DoS attacks.
|
|
// These include partially overlapping fragments and fragments
|
|
// that carry no data. Legitimate senders should never generate them.
|
|
//
|
|
uchar
|
|
FragmentReceive(
|
|
IPv6Packet *Packet) // Packet handed to us by IPv6Receive.
|
|
{
|
|
Interface *IF = Packet->NTEorIF->IF;
|
|
FragmentHeader UNALIGNED *Frag;
|
|
Reassembly *Reass;
|
|
ushort FragOffset;
|
|
PacketShim *Shim, *ThisShim, **MoveShim;
|
|
uint NextHeaderPosition;
|
|
|
|
IPSInfo.ipsi_reasmreqds++;
|
|
|
|
//
|
|
// We can not reassemble fragments that have had IPsec processing.
|
|
// It can't work because the IPsec headers in the unfragmentable part
|
|
// of the offset-zero fragment will authenticate/decrypt that fragment.
|
|
// Then the same headers would be copied to the reassembled packet.
|
|
// They couldn't possibly successfully authenticate/decrypt again.
|
|
// Also see RFC 2401 B.2.
|
|
//
|
|
if (Packet->SAPerformed != NULL) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"FragmentReceive: IPsec on fragment\n"));
|
|
//
|
|
// The spec does not tell us what ICMP error to generate in this case,
|
|
// but flagging the fragment header seems reasonable.
|
|
//
|
|
goto BadFragment;
|
|
}
|
|
|
|
//
|
|
// If a jumbo payload option was seen, send an ICMP error.
|
|
// Set ICMP pointer to the offset of the fragment header.
|
|
//
|
|
if (Packet->Flags & PACKET_JUMBO_OPTION) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"FragmentReceive: jumbo fragment\n"));
|
|
|
|
BadFragment:
|
|
//
|
|
// The NextHeader value passed to ICMPv6SendError
|
|
// is IP_PROTOCOL_FRAGMENT because we haven't moved
|
|
// past the fragment header yet.
|
|
//
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
Packet->Position - Packet->IPPosition,
|
|
IP_PROTOCOL_FRAGMENT, FALSE);
|
|
goto Failed; // Drop packet.
|
|
}
|
|
|
|
//
|
|
// Verify that we have enough contiguous data to overlay a FragmentHeader
|
|
// structure on the incoming packet. Then do so.
|
|
//
|
|
if (! PacketPullup(Packet, sizeof *Frag, 1, 0)) {
|
|
// Pullup failed.
|
|
if (Packet->TotalSize < sizeof *Frag)
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
FIELD_OFFSET(IPv6Header, PayloadLength),
|
|
IP_PROTOCOL_NONE, FALSE);
|
|
goto Failed; // Drop packet.
|
|
}
|
|
Frag = (FragmentHeader UNALIGNED *) Packet->Data;
|
|
|
|
//
|
|
// Remember offset to this header's NextHeader field.
|
|
// But don't overwrite offset to previous header's NextHeader just yet.
|
|
//
|
|
NextHeaderPosition = Packet->Position +
|
|
FIELD_OFFSET(FragmentHeader, NextHeader);
|
|
|
|
//
|
|
// Skip over fragment header.
|
|
//
|
|
AdjustPacketParams(Packet, sizeof *Frag);
|
|
|
|
//
|
|
// Lookup this fragment triple (Source Address, Destination
|
|
// Address, and Identification field) per-interface to see if
|
|
// we've already received other fragments of this packet.
|
|
//
|
|
Reass = FragmentLookup(IF, Frag->Id,
|
|
AlignAddr(&Packet->IP->Source),
|
|
AlignAddr(&Packet->IP->Dest));
|
|
if (Reass == NULL) {
|
|
//
|
|
// We hold the global reassembly list lock.
|
|
//
|
|
// Handle a special case first: if this is the first, last, and only
|
|
// fragment, then we can just continue parsing without reassembly.
|
|
// Test both paths in checked builds.
|
|
//
|
|
if ((Frag->OffsetFlag == 0)
|
|
#if DBG
|
|
&& ((int)Random() < 0)
|
|
#endif
|
|
) {
|
|
//
|
|
// Return next header value.
|
|
//
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.Lock);
|
|
Packet->NextHeaderPosition = NextHeaderPosition;
|
|
Packet->SkippedHeaderLength += sizeof(FragmentHeader);
|
|
IPSInfo.ipsi_reasmoks++;
|
|
return Frag->NextHeader;
|
|
}
|
|
|
|
//
|
|
// We must avoid creating new reassembly records
|
|
// if the interface is going away, to prevent races
|
|
// with DestroyIF/ReassemblyRemove.
|
|
//
|
|
if (IsDisabledIF(IF)) {
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.Lock);
|
|
goto Failed;
|
|
}
|
|
|
|
//
|
|
// This is the first fragment of this datagram we've received.
|
|
// Allocate a reassembly structure to keep track of the pieces.
|
|
//
|
|
Reass = ExAllocatePool(NonPagedPool, sizeof(struct Reassembly));
|
|
if (Reass == NULL) {
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.Lock);
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
|
|
"FragmentReceive: Couldn't allocate memory!?!\n"));
|
|
goto Failed;
|
|
}
|
|
|
|
KeInitializeSpinLock(&Reass->Lock);
|
|
Reass->State = REASSEMBLY_STATE_NORMAL;
|
|
|
|
RtlCopyMemory(&Reass->IPHdr, Packet->IP, sizeof(IPv6Header));
|
|
Reass->IF = IF;
|
|
Reass->Id = Frag->Id;
|
|
Reass->ContigList = NULL;
|
|
#if DBG
|
|
Reass->ContigEnd = NULL;
|
|
#endif
|
|
Reass->GapList = NULL;
|
|
Reass->Timer = DEFAULT_REASSEMBLY_TIMEOUT;
|
|
Reass->Marker = 0;
|
|
Reass->MaxGap = 0;
|
|
//
|
|
// We must initialize DataLength to an invalid value.
|
|
// Initializing to zero doesn't work.
|
|
//
|
|
Reass->DataLength = (uint)-1;
|
|
Reass->UnfragmentLength = 0;
|
|
Reass->UnfragData = NULL;
|
|
Reass->Flags = 0;
|
|
Reass->Size = REASSEMBLY_SIZE_PACKET;
|
|
|
|
//
|
|
// Add new Reassembly struct to front of the ReassemblyList.
|
|
// Acquires the reassembly record lock and
|
|
// releases the global reassembly list lock.
|
|
//
|
|
AddToReassemblyList(Reass);
|
|
}
|
|
else {
|
|
//
|
|
// We have found and locked an existing reassembly structure.
|
|
// Because we remove the reassembly structure in every
|
|
// error situation below, an existing reassembly structure
|
|
// must have a shim that has been successfully added to it.
|
|
//
|
|
ASSERT((Reass->ContigList != NULL) || (Reass->GapList != NULL));
|
|
}
|
|
|
|
//
|
|
// At this point, we have a locked reassembly record.
|
|
// We do not hold the global reassembly list lock
|
|
// while we perform the relatively expensive work
|
|
// of copying the fragment.
|
|
//
|
|
ASSERT(Reass->State == REASSEMBLY_STATE_NORMAL);
|
|
|
|
//
|
|
// Update the saved packet flags from this fragment packet.
|
|
// We are really only interested in PACKET_NOT_LINK_UNICAST.
|
|
//
|
|
Reass->Flags |= Packet->Flags;
|
|
|
|
FragOffset = net_short(Frag->OffsetFlag) & FRAGMENT_OFFSET_MASK;
|
|
|
|
//
|
|
// Send ICMP error if this fragment causes the total packet length
|
|
// to exceed 65,535 bytes. Set ICMP pointer equal to the offset to
|
|
// the Fragment Offset field.
|
|
//
|
|
if (FragOffset + Packet->TotalSize > MAX_IPv6_PAYLOAD) {
|
|
DeleteFromReassemblyList(Reass);
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(Packet->Position - sizeof(FragmentHeader) +
|
|
(uint)FIELD_OFFSET(FragmentHeader, OffsetFlag) -
|
|
Packet->IPPosition),
|
|
((FragOffset == 0) ?
|
|
Frag->NextHeader : IP_PROTOCOL_NONE),
|
|
FALSE);
|
|
goto Failed;
|
|
}
|
|
|
|
if ((Packet->TotalSize == 0) && (Frag->OffsetFlag != 0)) {
|
|
//
|
|
// We allow a moot fragment header (Frag->OffsetFlag == 0),
|
|
// because some test programs might generate them.
|
|
// (The first/last/only check above catches this in free builds.)
|
|
// But otherwise, we disallow fragments that do not actually
|
|
// carry any data for DoS protection.
|
|
//
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"FragmentReceive: zero data fragment\n"));
|
|
DeleteFromReassemblyList(Reass);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// If this is the last fragment (more fragments bit not set), then
|
|
// remember the total data length, else, check that the length
|
|
// is a multiple of 8 bytes.
|
|
//
|
|
if ((net_short(Frag->OffsetFlag) & FRAGMENT_FLAG_MASK) == 0) {
|
|
if (Reass->DataLength != (uint)-1) {
|
|
//
|
|
// We already received a last fragment.
|
|
// This can happen if a packet is duplicated.
|
|
//
|
|
if (FragOffset + Packet->TotalSize != Reass->DataLength) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"FragmentReceive: second last fragment\n"));
|
|
DeleteFromReassemblyList(Reass);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
}
|
|
else {
|
|
//
|
|
// Set expected data length from this fragment.
|
|
//
|
|
Reass->DataLength = FragOffset + Packet->TotalSize;
|
|
|
|
//
|
|
// Do we have any fragments beyond this length?
|
|
//
|
|
if ((Reass->Marker > Reass->DataLength) ||
|
|
(Reass->MaxGap > Reass->DataLength))
|
|
goto BadFragmentBeyondData;
|
|
}
|
|
} else {
|
|
if ((Packet->TotalSize % 8) != 0) {
|
|
//
|
|
// Length is not multiple of 8, send ICMP error with a pointer
|
|
// value equal to offset of payload length field in IP header.
|
|
//
|
|
DeleteFromReassemblyList(Reass);
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
FIELD_OFFSET(IPv6Header, PayloadLength),
|
|
((FragOffset == 0) ?
|
|
Frag->NextHeader : IP_PROTOCOL_NONE),
|
|
FALSE);
|
|
goto Failed; // Drop packet.
|
|
}
|
|
|
|
if ((Reass->DataLength != (uint)-1) &&
|
|
(FragOffset + Packet->TotalSize > Reass->DataLength)) {
|
|
//
|
|
// This fragment falls beyond the data length.
|
|
// As part of our DoS prevention, drop the reassembly.
|
|
//
|
|
BadFragmentBeyondData:
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"FragmentReceive: fragment beyond data length\n"));
|
|
DeleteFromReassemblyList(Reass);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Allocate and initialize a shim structure to hold the fragment data.
|
|
//
|
|
Shim = ExAllocatePool(NonPagedPool, sizeof *Shim + Packet->TotalSize);
|
|
if (Shim == NULL) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
|
|
"FragmentReceive: Couldn't allocate memory!?!\n"));
|
|
DeleteFromReassemblyList(Reass);
|
|
goto Failed;
|
|
}
|
|
|
|
IncreaseReassemblySize(Reass, REASSEMBLY_SIZE_FRAG + Packet->TotalSize);
|
|
Shim->Len = (ushort)Packet->TotalSize;
|
|
Shim->Offset = FragOffset;
|
|
Shim->Next = NULL;
|
|
|
|
//
|
|
// Determine where this fragment fits among the previous ones.
|
|
//
|
|
// There is no good reason for senders to ever generate overlapping
|
|
// fragments. However, packets may sometimes be duplicated in the network.
|
|
// If we receive a fragment that duplicates previously received fragments,
|
|
// then we just discard it. If we receive a fragment that only partially
|
|
// overlaps previously received fragments, then we assume a malicious
|
|
// sender and just drop the reassembly. This gives us better behavior
|
|
// under some kinds of DoS attacks, although the upper bound on reassembly
|
|
// buffers (see CheckReassemblyQuota) is the ultimate protection.
|
|
//
|
|
if (FragOffset == Reass->Marker) {
|
|
//
|
|
// This fragment extends the contiguous list.
|
|
//
|
|
|
|
if (Reass->ContigList == NULL) {
|
|
//
|
|
// We're first on the list.
|
|
// We use info from the (first) offset zero fragment to recreate
|
|
// the original datagram. Info in a second offset zero fragment
|
|
// is ignored.
|
|
//
|
|
ASSERT(FragOffset == 0);
|
|
ASSERT(Reass->UnfragData == NULL);
|
|
Reass->ContigList = Shim;
|
|
|
|
// Save the next header value.
|
|
Reass->NextHeader = Frag->NextHeader;
|
|
|
|
//
|
|
// Grab the unfragmentable data, i.e. the extension headers that
|
|
// preceded the fragment header.
|
|
//
|
|
Reass->UnfragmentLength = (ushort)
|
|
(Packet->Position - sizeof(FragmentHeader)) -
|
|
(Packet->IPPosition + sizeof(IPv6Header));
|
|
|
|
if (Reass->UnfragmentLength != 0) {
|
|
Reass->UnfragData = ExAllocatePool(NonPagedPool,
|
|
Reass->UnfragmentLength);
|
|
if (Reass->UnfragData == NULL) {
|
|
// Out of memory!?! Clean up and drop packet.
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
|
|
"FragmentReceive: "
|
|
"Couldn't allocate memory?\n"));
|
|
// Will also free Shim because of Reass->ContigList.
|
|
DeleteFromReassemblyList(Reass);
|
|
goto Failed;
|
|
}
|
|
IncreaseReassemblySize(Reass, Reass->UnfragmentLength);
|
|
CopyPacketToBuffer(Reass->UnfragData, Packet,
|
|
Reass->UnfragmentLength,
|
|
Packet->IPPosition + sizeof(IPv6Header));
|
|
|
|
Reass->NextHeaderOffset = Packet->NextHeaderPosition -
|
|
Packet->IPPosition;
|
|
} else
|
|
Reass->NextHeaderOffset = FIELD_OFFSET(IPv6Header, NextHeader);
|
|
|
|
//
|
|
// We need to have the IP header of the offset-zero fragment.
|
|
// (Every fragment normally will have the same IP header,
|
|
// except for PayloadLength, and unfragmentable headers,
|
|
// but they might not.) ReassembleDatagram and
|
|
// CreateFragmentPacket both need it.
|
|
//
|
|
// Of the 40 bytes in the header, the 32 bytes in the source
|
|
// and destination addresses are already correct.
|
|
// So we just copy the other 8 bytes now.
|
|
//
|
|
RtlCopyMemory(&Reass->IPHdr, Packet->IP, 8);
|
|
|
|
} else {
|
|
//
|
|
// Add us to the end of the list.
|
|
//
|
|
Reass->ContigEnd->Next = Shim;
|
|
}
|
|
Reass->ContigEnd = Shim;
|
|
|
|
//
|
|
// Increment our contiguous extent marker.
|
|
//
|
|
Reass->Marker += (ushort)Packet->TotalSize;
|
|
|
|
//
|
|
// Now peruse the non-contiguous list here to see if we already
|
|
// have the next fragment to extend the contiguous list, and if so,
|
|
// move it on over. Repeat until we can't.
|
|
//
|
|
MoveShim = &Reass->GapList;
|
|
while ((ThisShim = *MoveShim) != NULL) {
|
|
if (ThisShim->Offset == Reass->Marker) {
|
|
//
|
|
// This fragment now extends the contiguous list.
|
|
// Add it to the end of the list.
|
|
//
|
|
Reass->ContigEnd->Next = ThisShim;
|
|
Reass->ContigEnd = ThisShim;
|
|
Reass->Marker += ThisShim->Len;
|
|
|
|
//
|
|
// Remove it from non-contiguous list.
|
|
//
|
|
*MoveShim = ThisShim->Next;
|
|
ThisShim->Next = NULL;
|
|
}
|
|
else if (ThisShim->Offset > Reass->Marker) {
|
|
//
|
|
// This fragment lies beyond the contiguous list.
|
|
// Because the gap list is sorted, we can stop now.
|
|
//
|
|
break;
|
|
}
|
|
else {
|
|
//
|
|
// This fragment overlaps the contiguous list.
|
|
// For DoS prevention, drop the reassembly.
|
|
//
|
|
BadFragmentOverlap:
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"FragmentReceive: overlapping fragment\n"));
|
|
DeleteFromReassemblyList(Reass);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
}
|
|
} else {
|
|
//
|
|
// Exile this fragment to the non-contiguous (gap) list.
|
|
// The gap list is sorted by Offset.
|
|
//
|
|
MoveShim = &Reass->GapList;
|
|
for (;;) {
|
|
ThisShim = *MoveShim;
|
|
if (ThisShim == NULL) {
|
|
//
|
|
// Insert Shim at the end of the gap list.
|
|
//
|
|
Reass->MaxGap = Shim->Offset + Shim->Len;
|
|
break;
|
|
}
|
|
|
|
if (Shim->Offset < ThisShim->Offset) {
|
|
//
|
|
// Check for partial overlap.
|
|
//
|
|
if (Shim->Offset + Shim->Len > ThisShim->Offset) {
|
|
ExFreePool(Shim);
|
|
goto BadFragmentOverlap;
|
|
}
|
|
|
|
//
|
|
// OK, insert Shim before ThisShim.
|
|
//
|
|
break;
|
|
}
|
|
else if (ThisShim->Offset < Shim->Offset) {
|
|
//
|
|
// Check for partial overlap.
|
|
//
|
|
if (ThisShim->Offset + ThisShim->Len > Shim->Offset) {
|
|
ExFreePool(Shim);
|
|
goto BadFragmentOverlap;
|
|
}
|
|
|
|
//
|
|
// OK, insert Shim somewhere after ThisShim.
|
|
// Keep looking for the right spot.
|
|
//
|
|
MoveShim = &ThisShim->Next;
|
|
}
|
|
else {
|
|
//
|
|
// If the new fragment duplicates the old,
|
|
// then just ignore the new fragment.
|
|
//
|
|
if (Shim->Len == ThisShim->Len) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"FragmentReceive: duplicate fragment\n"));
|
|
ExFreePool(Shim);
|
|
KeReleaseSpinLockFromDpcLevel(&Reass->Lock);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
else {
|
|
ExFreePool(Shim);
|
|
goto BadFragmentOverlap;
|
|
}
|
|
}
|
|
}
|
|
|
|
Shim->Next = *MoveShim;
|
|
*MoveShim = Shim;
|
|
}
|
|
|
|
//
|
|
// Now that we have added the shim to the reassembly record
|
|
// and passed various checks (particularly DoS checks),
|
|
// copy the actual fragment data to the shim.
|
|
//
|
|
CopyPacketToBuffer(PacketShimData(Shim), Packet,
|
|
Packet->TotalSize, Packet->Position);
|
|
|
|
if (Reass->Marker == Reass->DataLength) {
|
|
//
|
|
// We have received all the fragments.
|
|
// Because of the overlapping/data-length/zero-size sanity checks
|
|
// above, when this happens there should be no fragments
|
|
// left on the gap list. However, ReassembleDatagram does not
|
|
// rely on having an empty gap list.
|
|
//
|
|
ASSERT(Reass->GapList == NULL);
|
|
ReassembleDatagram(Packet, Reass);
|
|
}
|
|
else {
|
|
//
|
|
// Finally, check if we're too close to our limit for
|
|
// reassembly buffers. If so, drop this packet. Otherwise,
|
|
// wait for more fragments to arrive.
|
|
//
|
|
CheckReassemblyQuota(Reass);
|
|
}
|
|
return IP_PROTOCOL_NONE;
|
|
|
|
Failed:
|
|
IPSInfo.ipsi_reasmfails++;
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
|
|
//* FragmentLookup - look for record of previous fragments from this datagram.
|
|
//
|
|
// A datagram on an interface is uniquely identified by its
|
|
// {source address, destination address, identification field} triple.
|
|
// This function checks our reassembly list for previously
|
|
// received fragments of a given datagram.
|
|
//
|
|
// If an existing reassembly record is found,
|
|
// it is returned locked.
|
|
//
|
|
// If there is no existing reassembly record, returns NULL
|
|
// and leaves the global reassembly list locked.
|
|
//
|
|
// Callable from DPC context, not from thread context.
|
|
//
|
|
Reassembly *
|
|
FragmentLookup(
|
|
Interface *IF, // Receiving interface.
|
|
ulong Id, // Fragment identification field to match.
|
|
const IPv6Addr *Src, // Source address to match.
|
|
const IPv6Addr *Dst) // Destination address to match.
|
|
{
|
|
Reassembly *Reass;
|
|
|
|
KeAcquireSpinLockAtDpcLevel(&ReassemblyList.Lock);
|
|
|
|
for (Reass = ReassemblyList.First;; Reass = Reass->Next) {
|
|
if (Reass == SentinelReassembly) {
|
|
//
|
|
// Return with the global reassembly list lock still held.
|
|
//
|
|
return NULL;
|
|
}
|
|
|
|
if ((Reass->IF == IF) &&
|
|
(Reass->Id == Id) &&
|
|
IP6_ADDR_EQUAL(&Reass->IPHdr.Source, Src) &&
|
|
IP6_ADDR_EQUAL(&Reass->IPHdr.Dest, Dst)) {
|
|
//
|
|
// Is this reassembly record being deleted?
|
|
// If so, ignore it.
|
|
//
|
|
KeAcquireSpinLockAtDpcLevel(&Reass->Lock);
|
|
ASSERT((Reass->State == REASSEMBLY_STATE_NORMAL) ||
|
|
(Reass->State == REASSEMBLY_STATE_DELETING));
|
|
|
|
if (Reass->State == REASSEMBLY_STATE_DELETING) {
|
|
KeReleaseSpinLockFromDpcLevel(&Reass->Lock);
|
|
continue;
|
|
}
|
|
|
|
//
|
|
// Return with the reassembly record lock still held.
|
|
//
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.Lock);
|
|
return Reass;
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
//* AddToReassemblyList
|
|
//
|
|
// Add the reassembly record to the list.
|
|
// It must NOT already be on the list.
|
|
//
|
|
// Called with the global reassembly list lock held.
|
|
// Returns with the reassembly record lock held.
|
|
//
|
|
// Callable from DPC context, not from thread context.
|
|
//
|
|
void
|
|
AddToReassemblyList(Reassembly *Reass)
|
|
{
|
|
Reassembly *AfterReass = SentinelReassembly;
|
|
|
|
Reass->Prev = AfterReass;
|
|
(Reass->Next = AfterReass->Next)->Prev = Reass;
|
|
AfterReass->Next = Reass;
|
|
|
|
KeAcquireSpinLockAtDpcLevel(&ReassemblyList.LockSize);
|
|
ReassemblyList.Size += Reass->Size;
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.LockSize);
|
|
|
|
//
|
|
// We must acquire the reassembly record lock
|
|
// *before* releasing the global reassembly list lock,
|
|
// to prevent the reassembly from diappearing underneath us.
|
|
//
|
|
KeAcquireSpinLockAtDpcLevel(&Reass->Lock);
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.Lock);
|
|
}
|
|
|
|
|
|
//* RemoveReassembly
|
|
//
|
|
// Remove a reassembly record from the list.
|
|
//
|
|
// Called with the global reassembly lock held.
|
|
// The reassembly record lock may be held.
|
|
//
|
|
void
|
|
RemoveReassembly(Reassembly *Reass)
|
|
{
|
|
Reass->Prev->Next = Reass->Next;
|
|
Reass->Next->Prev = Reass->Prev;
|
|
|
|
KeAcquireSpinLockAtDpcLevel(&ReassemblyList.LockSize);
|
|
ReassemblyList.Size -= Reass->Size;
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.LockSize);
|
|
}
|
|
|
|
|
|
//* IncreaseReassemblySize
|
|
//
|
|
// Increase the size of the reassembly record.
|
|
// Called with the reassembly record lock held.
|
|
//
|
|
// Callable from DPC context, not from thread context.
|
|
//
|
|
void
|
|
IncreaseReassemblySize(Reassembly *Reass, uint Size)
|
|
{
|
|
Reass->Size += Size;
|
|
KeAcquireSpinLockAtDpcLevel(&ReassemblyList.LockSize);
|
|
ReassemblyList.Size += Size;
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.LockSize);
|
|
}
|
|
|
|
|
|
//* DeleteReassembly
|
|
//
|
|
// Delete a reassembly record.
|
|
//
|
|
void
|
|
DeleteReassembly(Reassembly *Reass)
|
|
{
|
|
PacketShim *ThisShim, *PrevShim;
|
|
|
|
//
|
|
// Free ContigList if populated.
|
|
//
|
|
PrevShim = ThisShim = Reass->ContigList;
|
|
while (ThisShim != NULL) {
|
|
PrevShim = ThisShim;
|
|
ThisShim = ThisShim->Next;
|
|
ExFreePool(PrevShim);
|
|
}
|
|
|
|
//
|
|
// Free GapList if populated.
|
|
//
|
|
PrevShim = ThisShim = Reass->GapList;
|
|
while (ThisShim != NULL) {
|
|
PrevShim = ThisShim;
|
|
ThisShim = ThisShim->Next;
|
|
ExFreePool(PrevShim);
|
|
}
|
|
|
|
//
|
|
// Free unfragmentable data.
|
|
//
|
|
if (Reass->UnfragData != NULL)
|
|
ExFreePool(Reass->UnfragData);
|
|
|
|
ExFreePool(Reass);
|
|
}
|
|
|
|
|
|
//* DeleteFromReassemblyList
|
|
//
|
|
// Remove and delete the reassembly record.
|
|
// The reassembly record MUST be on the list.
|
|
//
|
|
// Callable from DPC context, not from thread context.
|
|
// Called with the reassembly record lock held,
|
|
// but not the global reassembly list lock.
|
|
//
|
|
void
|
|
DeleteFromReassemblyList(Reassembly *Reass)
|
|
{
|
|
//
|
|
// Mark the reassembly as being deleted.
|
|
// This will prevent someone else from freeing it.
|
|
//
|
|
ASSERT(Reass->State == REASSEMBLY_STATE_NORMAL);
|
|
Reass->State = REASSEMBLY_STATE_DELETING;
|
|
KeReleaseSpinLockFromDpcLevel(&Reass->Lock);
|
|
|
|
KeAcquireSpinLockAtDpcLevel(&ReassemblyList.Lock);
|
|
KeAcquireSpinLockAtDpcLevel(&Reass->Lock);
|
|
ASSERT((Reass->State == REASSEMBLY_STATE_DELETING) ||
|
|
(Reass->State == REASSEMBLY_STATE_REMOVED));
|
|
|
|
//
|
|
// Remove the reassembly record from the list,
|
|
// if someone else hasn't already removed it.
|
|
//
|
|
if (Reass->State != REASSEMBLY_STATE_REMOVED)
|
|
RemoveReassembly(Reass);
|
|
|
|
KeReleaseSpinLockFromDpcLevel(&Reass->Lock);
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.Lock);
|
|
|
|
//
|
|
// Delete the reassembly record.
|
|
//
|
|
DeleteReassembly(Reass);
|
|
}
|
|
|
|
//* CheckReassemblyQuota
|
|
//
|
|
// Delete reassembly record if necessary,
|
|
// to keep the reassembly buffering under quota.
|
|
//
|
|
// Callable from DPC context, not from thread context.
|
|
// Called with the reassembly record lock held,
|
|
// but not the global reassembly list lock.
|
|
//
|
|
void
|
|
CheckReassemblyQuota(Reassembly *Reass)
|
|
{
|
|
int Prune = FALSE;
|
|
uint Threshold = ReassemblyList.Limit / 2;
|
|
|
|
//
|
|
// Decide whether to drop the reassembly record based on a RED-like
|
|
// algorithm. If the total size is less than 50% of the max, never
|
|
// drop. If the total size is over the max, always drop. If between
|
|
// 50% and 100% full, drop based on a probability proportional to the
|
|
// amount over 50%. This is an O(1) algorithm which is proportionally
|
|
// biased against large packets, and against sources which send more
|
|
// packets. This should provide a decent level of protection against
|
|
// DoS attacks.
|
|
//
|
|
KeAcquireSpinLockAtDpcLevel(&ReassemblyList.LockSize);
|
|
if ((ReassemblyList.Size > Threshold) &&
|
|
(RandomNumber(0, Threshold) < ReassemblyList.Size - Threshold))
|
|
Prune = TRUE;
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.LockSize);
|
|
|
|
if (Prune) {
|
|
//
|
|
// Delete this reassembly record.
|
|
// We do not send ICMP errors in this situation.
|
|
// The reassembly timer has not expired.
|
|
// This is more analogous to a router dropping packets
|
|
// when a queue gets full, and no ICMP error is sent
|
|
// in that situation.
|
|
//
|
|
#if DBG
|
|
char Buffer1[INET6_ADDRSTRLEN], Buffer2[INET6_ADDRSTRLEN];
|
|
|
|
FormatV6AddressWorker(Buffer1, &Reass->IPHdr.Source);
|
|
FormatV6AddressWorker(Buffer2, &Reass->IPHdr.Dest);
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"CheckReassemblyQuota: Src %s Dst %s Id %x\n",
|
|
Buffer1, Buffer2, Reass->Id));
|
|
#endif
|
|
DeleteFromReassemblyList(Reass);
|
|
}
|
|
else
|
|
KeReleaseSpinLockFromDpcLevel(&Reass->Lock);
|
|
}
|
|
|
|
typedef struct ReassembledReceiveContext {
|
|
WORK_QUEUE_ITEM WQItem;
|
|
IPv6Packet Packet;
|
|
uchar Data[];
|
|
} ReassembledReceiveContext;
|
|
|
|
//* ReassembledReceive
|
|
//
|
|
// Receive a reassembled packet.
|
|
// This function is called from a kernel worker thread context.
|
|
// It prevents "reassembly recursion".
|
|
//
|
|
void
|
|
ReassembledReceive(PVOID Context)
|
|
{
|
|
ReassembledReceiveContext *rrc = (ReassembledReceiveContext *) Context;
|
|
KIRQL Irql;
|
|
int PktRefs;
|
|
|
|
//
|
|
// All receive processing normally happens at DPC level,
|
|
// so we must pretend to be a DPC, so we raise IRQL.
|
|
// (System worker threads typically run at PASSIVE_LEVEL).
|
|
//
|
|
KeRaiseIrql(DISPATCH_LEVEL, &Irql);
|
|
PktRefs = IPv6Receive(&rrc->Packet);
|
|
ASSERT(PktRefs == 0);
|
|
KeLowerIrql(Irql);
|
|
ExFreePool(rrc);
|
|
}
|
|
|
|
|
|
//* ReassembleDatagram - put all the fragments together.
|
|
//
|
|
// Called when we have all the fragments to complete a datagram.
|
|
// Patch them together and pass the packet up.
|
|
//
|
|
// We allocate a single contiguous buffer and copy the fragments
|
|
// into this buffer.
|
|
// REVIEW: Instead use ndis buffers to chain the fragments?
|
|
//
|
|
// Callable from DPC context, not from thread context.
|
|
// Called with the reassembly record lock held,
|
|
// but not the global reassembly list lock.
|
|
//
|
|
// Deletes the reassembly record.
|
|
//
|
|
void
|
|
ReassembleDatagram(
|
|
IPv6Packet *Packet, // The packet being currently received.
|
|
Reassembly *Reass) // Reassembly record for fragmented datagram.
|
|
{
|
|
uint DataLen;
|
|
uint TotalLength;
|
|
uint memptr = sizeof(IPv6Header);
|
|
PacketShim *ThisShim, *PrevShim;
|
|
ReassembledReceiveContext *rrc;
|
|
IPv6Packet *ReassPacket;
|
|
uchar *ReassBuffer;
|
|
uchar *pNextHeader;
|
|
|
|
DataLen = Reass->DataLength + Reass->UnfragmentLength;
|
|
ASSERT(DataLen <= MAX_IPv6_PAYLOAD);
|
|
TotalLength = sizeof(IPv6Header) + DataLen;
|
|
|
|
//
|
|
// Allocate memory for buffer and copy fragment data into it.
|
|
// At the same time we allocate space for context information
|
|
// and an IPv6 packet structure.
|
|
//
|
|
rrc = ExAllocatePool(NonPagedPool, sizeof *rrc + TotalLength);
|
|
if (rrc == NULL) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
|
|
"ReassembleDatagram: Couldn't allocate memory!?!\n"));
|
|
DeleteFromReassemblyList(Reass);
|
|
IPSInfo.ipsi_reasmfails++;
|
|
return;
|
|
}
|
|
|
|
//
|
|
// We must take a reference on the interface before
|
|
// DeleteFromReassemblyList releases the record lock.
|
|
//
|
|
ReassPacket = &rrc->Packet;
|
|
ReassBuffer = rrc->Data;
|
|
|
|
//
|
|
// Generate the original IP hdr and copy it and any unfragmentable
|
|
// data into the new packet. Note we have to update the next header
|
|
// field in the last unfragmentable header (or the IP hdr, if none).
|
|
//
|
|
Reass->IPHdr.PayloadLength = net_short((ushort)DataLen);
|
|
RtlCopyMemory(ReassBuffer, (uchar *)&Reass->IPHdr, sizeof(IPv6Header));
|
|
|
|
RtlCopyMemory(ReassBuffer + memptr, Reass->UnfragData,
|
|
Reass->UnfragmentLength);
|
|
memptr += Reass->UnfragmentLength;
|
|
|
|
pNextHeader = ReassBuffer + Reass->NextHeaderOffset;
|
|
ASSERT(*pNextHeader == IP_PROTOCOL_FRAGMENT);
|
|
*pNextHeader = Reass->NextHeader;
|
|
|
|
//
|
|
// Run through the contiguous list, copying data over to our new packet.
|
|
//
|
|
PrevShim = ThisShim = Reass->ContigList;
|
|
while(ThisShim != NULL) {
|
|
RtlCopyMemory(ReassBuffer + memptr, PacketShimData(ThisShim),
|
|
ThisShim->Len);
|
|
memptr += ThisShim->Len;
|
|
if (memptr > TotalLength) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_INTERNAL_ERROR,
|
|
"ReassembleDatagram: packets don't add up\n"));
|
|
}
|
|
PrevShim = ThisShim;
|
|
ThisShim = ThisShim->Next;
|
|
|
|
ExFreePool(PrevShim);
|
|
}
|
|
|
|
//
|
|
// Initialize the reassembled packet structure.
|
|
//
|
|
RtlZeroMemory(ReassPacket, sizeof *ReassPacket);
|
|
AddRefIF(Reass->IF);
|
|
ReassPacket->NTEorIF = CastFromIF(Reass->IF);
|
|
ReassPacket->FlatData = ReassBuffer;
|
|
ReassPacket->Data = ReassBuffer;
|
|
ReassPacket->ContigSize = TotalLength;
|
|
ReassPacket->TotalSize = TotalLength;
|
|
ReassPacket->Flags = PACKET_HOLDS_REF | PACKET_REASSEMBLED |
|
|
(Reass->Flags & PACKET_INHERITED_FLAGS);
|
|
|
|
//
|
|
// Explicitly null out the ContigList which was freed above and
|
|
// clean up the reassembly struct. This also drops our lock
|
|
// on the reassembly struct.
|
|
//
|
|
Reass->ContigList = NULL;
|
|
DeleteFromReassemblyList(Reass);
|
|
|
|
IPSInfo.ipsi_reasmoks++;
|
|
|
|
//
|
|
// Receive the reassembled packet.
|
|
// If the current fragment was reassembled,
|
|
// then we should avoid another level of recursion.
|
|
// We must prevent "reassembly recursion".
|
|
// Test both paths in checked builds.
|
|
//
|
|
if ((Packet->Flags & PACKET_REASSEMBLED)
|
|
#if DBG
|
|
|| ((int)Random() < 0)
|
|
#endif
|
|
) {
|
|
ExInitializeWorkItem(&rrc->WQItem, ReassembledReceive, rrc);
|
|
ExQueueWorkItem(&rrc->WQItem, CriticalWorkQueue);
|
|
}
|
|
else {
|
|
int PktRefs = IPv6Receive(ReassPacket);
|
|
ASSERT(PktRefs == 0);
|
|
ExFreePool(rrc);
|
|
}
|
|
}
|
|
|
|
|
|
//* CreateFragmentPacket
|
|
//
|
|
// Recreates the first fragment packet for purposes of notifying a source
|
|
// of a 'fragment reassembly time exceeded'.
|
|
//
|
|
IPv6Packet *
|
|
CreateFragmentPacket(
|
|
Reassembly *Reass)
|
|
{
|
|
PacketShim *FirstFrag;
|
|
IPv6Packet *Packet;
|
|
FragmentHeader *FragHdr;
|
|
uint PayloadLength;
|
|
uint PacketLength;
|
|
uint MemLen;
|
|
uchar *Mem;
|
|
|
|
//
|
|
// There must be a first (offset-zero) fragment.
|
|
//
|
|
FirstFrag = Reass->ContigList;
|
|
ASSERT((FirstFrag != NULL) && (FirstFrag->Offset == 0));
|
|
|
|
//
|
|
// Allocate memory for creating the first fragment, i.e. the first
|
|
// buffer in our contig list. We include space for an IPv6Packet.
|
|
//
|
|
PayloadLength = (Reass->UnfragmentLength + sizeof(FragmentHeader) +
|
|
FirstFrag->Len);
|
|
PacketLength = sizeof(IPv6Header) + PayloadLength;
|
|
MemLen = sizeof(IPv6Packet) + PacketLength;
|
|
Mem = ExAllocatePool(NonPagedPool, MemLen);
|
|
if (Mem == NULL) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NTOS_ERROR,
|
|
"CreateFragmentPacket: Couldn't allocate memory!?!\n"));
|
|
return NULL;
|
|
}
|
|
|
|
Packet = (IPv6Packet *) Mem;
|
|
Mem += sizeof(IPv6Packet);
|
|
|
|
Packet->Next = NULL;
|
|
Packet->IP = (IPv6Header UNALIGNED *) Mem;
|
|
Packet->IPPosition = 0;
|
|
Packet->Data = Packet->FlatData = Mem;
|
|
Packet->Position = 0;
|
|
Packet->ContigSize = Packet->TotalSize = PacketLength;
|
|
Packet->NdisPacket = NULL;
|
|
Packet->AuxList = NULL;
|
|
Packet->Flags = 0;
|
|
Packet->SrcAddr = AlignAddr(&Packet->IP->Source);
|
|
Packet->SAPerformed = NULL;
|
|
// Our caller must initialize Packet->NTEorIF.
|
|
AdjustPacketParams(Packet, sizeof(IPv6Header));
|
|
|
|
//
|
|
// Copy the original IPv6 header into the packet.
|
|
// Note that FragmentReceive ensures that
|
|
// Reass->IPHdr, Reass->UnfragData, and FirstFrag
|
|
// are all consistent.
|
|
//
|
|
RtlCopyMemory(Mem, (uchar *)&Reass->IPHdr, sizeof(IPv6Header));
|
|
Mem += sizeof(IPv6Header);
|
|
|
|
ASSERT(Reass->IPHdr.PayloadLength == net_short((ushort)PayloadLength));
|
|
|
|
//
|
|
// Copy the unfragmentable data into the packet.
|
|
//
|
|
RtlCopyMemory(Mem, Reass->UnfragData, Reass->UnfragmentLength);
|
|
Mem += Reass->UnfragmentLength;
|
|
|
|
//
|
|
// Create a fragment header in the packet.
|
|
//
|
|
FragHdr = (FragmentHeader *) Mem;
|
|
Mem += sizeof(FragmentHeader);
|
|
|
|
//
|
|
// Note that if the original offset-zero fragment had
|
|
// a non-zero value in the Reserved field, then we will
|
|
// not recreate it properly. It shouldn't do that.
|
|
//
|
|
FragHdr->NextHeader = Reass->NextHeader;
|
|
FragHdr->Reserved = 0;
|
|
FragHdr->OffsetFlag = net_short(FRAGMENT_FLAG_MASK);
|
|
FragHdr->Id = Reass->Id;
|
|
|
|
//
|
|
// Copy the original fragment data into the packet.
|
|
//
|
|
RtlCopyMemory(Mem, PacketShimData(FirstFrag), FirstFrag->Len);
|
|
|
|
return Packet;
|
|
}
|
|
|
|
|
|
//* ReassemblyTimeout - Handle a reassembly timer event.
|
|
//
|
|
// This routine is called periodically by IPv6Timeout to check for
|
|
// timed out fragments.
|
|
//
|
|
void
|
|
ReassemblyTimeout(void)
|
|
{
|
|
Reassembly *ThisReass, *NextReass;
|
|
Reassembly *Expired = NULL;
|
|
|
|
//
|
|
// Scan the ReassemblyList checking for expired reassembly contexts.
|
|
//
|
|
KeAcquireSpinLockAtDpcLevel(&ReassemblyList.Lock);
|
|
for (ThisReass = ReassemblyList.First;
|
|
ThisReass != SentinelReassembly;
|
|
ThisReass = NextReass) {
|
|
NextReass = ThisReass->Next;
|
|
|
|
//
|
|
// First decrement the timer then check if it has expired. If so,
|
|
// remove the reassembly record. This is basically the same code
|
|
// as in DeleteFromReassemblyList().
|
|
//
|
|
ThisReass->Timer--;
|
|
|
|
if (ThisReass->Timer == 0) {
|
|
RemoveReassembly(ThisReass);
|
|
|
|
KeAcquireSpinLockAtDpcLevel(&ThisReass->Lock);
|
|
ASSERT((ThisReass->State == REASSEMBLY_STATE_NORMAL) ||
|
|
(ThisReass->State == REASSEMBLY_STATE_DELETING));
|
|
|
|
if (ThisReass->State == REASSEMBLY_STATE_DELETING) {
|
|
//
|
|
// Note that we've removed it from the list already.
|
|
//
|
|
ThisReass->State = REASSEMBLY_STATE_REMOVED;
|
|
}
|
|
else {
|
|
//
|
|
// Move this reassembly context to the expired list.
|
|
// We must take a reference on the interface
|
|
// before releasing the reassembly record lock.
|
|
//
|
|
AddRefIF(ThisReass->IF);
|
|
ThisReass->Next = Expired;
|
|
Expired = ThisReass;
|
|
}
|
|
KeReleaseSpinLockFromDpcLevel(&ThisReass->Lock);
|
|
}
|
|
}
|
|
KeReleaseSpinLockFromDpcLevel(&ReassemblyList.Lock);
|
|
|
|
//
|
|
// Now that we no longer need the reassembly list lock,
|
|
// we can send ICMP errors at our leisure.
|
|
//
|
|
|
|
while ((ThisReass = Expired) != NULL) {
|
|
Interface *IF = ThisReass->IF;
|
|
#if DBG
|
|
char Buffer1[INET6_ADDRSTRLEN], Buffer2[INET6_ADDRSTRLEN];
|
|
|
|
FormatV6AddressWorker(Buffer1, &ThisReass->IPHdr.Source);
|
|
FormatV6AddressWorker(Buffer2, &ThisReass->IPHdr.Dest);
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"ReassemblyTimeout: Src %s Dst %s Id %x\n",
|
|
Buffer1, Buffer2, ThisReass->Id));
|
|
#endif
|
|
|
|
Expired = ThisReass->Next;
|
|
|
|
//
|
|
// Send ICMP error IF we have received the first fragment.
|
|
// NB: Checking Marker != 0 is wrong, because we might have
|
|
// received a zero-length first fragment.
|
|
//
|
|
if (ThisReass->ContigList != NULL) {
|
|
IPv6Packet *Packet;
|
|
|
|
Packet = CreateFragmentPacket(ThisReass);
|
|
if (Packet != NULL) {
|
|
NetTableEntryOrInterface *NTEorIF;
|
|
ushort Type;
|
|
|
|
NTEorIF = FindAddressOnInterface(IF,
|
|
&ThisReass->IPHdr.Dest,
|
|
&Type);
|
|
if (NTEorIF != NULL) {
|
|
Packet->NTEorIF = NTEorIF;
|
|
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_TIME_EXCEEDED,
|
|
ICMPv6_REASSEMBLY_TIME_EXCEEDED, 0,
|
|
Packet->IP->NextHeader, FALSE);
|
|
|
|
if (IsNTE(NTEorIF))
|
|
ReleaseNTE(CastToNTE(NTEorIF));
|
|
else
|
|
ReleaseIF(CastToIF(NTEorIF));
|
|
}
|
|
|
|
ExFreePool(Packet);
|
|
}
|
|
}
|
|
|
|
//
|
|
// Delete the reassembly record.
|
|
//
|
|
ReleaseIF(IF);
|
|
DeleteReassembly(ThisReass);
|
|
}
|
|
}
|
|
|
|
|
|
//* DestinationOptionsReceive - Handle IPv6 Destination options.
|
|
//
|
|
// This is the routine called to process a Destination Options Header,
|
|
// a next header value of 60.
|
|
//
|
|
uchar
|
|
DestinationOptionsReceive(
|
|
IPv6Packet *Packet) // Packet handed to us by IPv6Receive.
|
|
{
|
|
IPv6OptionsHeader *DestOpt;
|
|
uint ExtLen;
|
|
Options Opts;
|
|
|
|
//
|
|
// Verify that we have enough contiguous data to overlay a Destination
|
|
// Options Header structure on the incoming packet. Then do so.
|
|
//
|
|
if (! PacketPullup(Packet, sizeof *DestOpt,
|
|
__builtin_alignof(IPv6OptionsHeader), 0)) {
|
|
if (Packet->TotalSize < sizeof *DestOpt) {
|
|
BadPayloadLength:
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"DestinationOptionsReceive: Incoming packet too small"
|
|
" to contain destination options header\n"));
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
FIELD_OFFSET(IPv6Header, PayloadLength),
|
|
IP_PROTOCOL_NONE, FALSE);
|
|
}
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
DestOpt = (IPv6OptionsHeader *) Packet->Data;
|
|
|
|
//
|
|
// Check that length of destination options also fit in remaining data.
|
|
// The options must also be aligned for any addresses in them.
|
|
//
|
|
ExtLen = (DestOpt->HeaderExtLength + 1) * EXT_LEN_UNIT;
|
|
if (! PacketPullup(Packet, ExtLen,
|
|
MAX(__builtin_alignof(IPv6OptionsHeader),
|
|
__builtin_alignof(IPv6Addr)), 0)) {
|
|
if (Packet->TotalSize < ExtLen)
|
|
goto BadPayloadLength;
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
DestOpt = (IPv6OptionsHeader *) Packet->Data;
|
|
|
|
//
|
|
// Remember offset to this header's NextHeader field.
|
|
//
|
|
Packet->NextHeaderPosition = Packet->Position +
|
|
FIELD_OFFSET(IPv6OptionsHeader, NextHeader);
|
|
|
|
//
|
|
// Skip over the extension header.
|
|
// We need to do this now so subsequent ICMP error generation works.
|
|
//
|
|
AdjustPacketParams(Packet, ExtLen);
|
|
|
|
//
|
|
// Parse options in this extension header. If an error occurs
|
|
// while parsing the options, discard packet.
|
|
//
|
|
if (!ParseOptions(Packet, IP_PROTOCOL_DEST_OPTS, DestOpt, ExtLen, &Opts)) {
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
|
|
//
|
|
// The processing of any additional options should be added here,
|
|
// before the home address option.
|
|
//
|
|
|
|
//
|
|
// Process the home address option.
|
|
//
|
|
if (Opts.HomeAddress) {
|
|
if (IPv6RecvHomeAddress(Packet, Opts.HomeAddress)) {
|
|
//
|
|
// Couldn't process the home address option. Drop the packet.
|
|
//
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Process binding update option.
|
|
//
|
|
// Note that the Mobile IP spec says that the effects of processing the
|
|
// Home Address option should not be visible until all other options in
|
|
// the same Destination Options header have been processed. Although
|
|
// we process the Binding Update option after the Home Address option,
|
|
// we achieve the same effect by requiring IPv6RecvBindingUpdate to
|
|
// know that the Packet->SrcAddr has already been updated.
|
|
//
|
|
if (Opts.BindingUpdate) {
|
|
if (IPv6RecvBindingUpdate(Packet, Opts.BindingUpdate)) {
|
|
//
|
|
// Couldn't process the binding update. Drop the packet.
|
|
//
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Return next header value.
|
|
//
|
|
return DestOpt->NextHeader;
|
|
}
|
|
|
|
|
|
//* HopByHopOptionsReceive - Handle a IPv6 Hop-by-Hop Options.
|
|
//
|
|
// This is the routine called to process a Hop-by-Hop Options Header,
|
|
// next header value of 0.
|
|
//
|
|
// Note that this routine is not a normal handler in the Protocol Switch
|
|
// Table. Instead, it receives special treatment in IPv6HeaderReceive.
|
|
// Because of this, it returns -1 instead of IP_PROTOCOL_NONE on error.
|
|
//
|
|
int
|
|
HopByHopOptionsReceive(
|
|
IPv6Packet *Packet) // Packet handed to us by IPv6Receive.
|
|
{
|
|
IPv6OptionsHeader *HopByHop;
|
|
uint ExtLen;
|
|
Options Opts;
|
|
|
|
//
|
|
// Verify that we have enough contiguous data to overlay a minimum
|
|
// length Hop-by-Hop Options Header. Then do so.
|
|
//
|
|
if (! PacketPullup(Packet, sizeof *HopByHop,
|
|
__builtin_alignof(IPv6OptionsHeader), 0)) {
|
|
if (Packet->TotalSize < sizeof *HopByHop) {
|
|
BadPayloadLength:
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"HopByHopOptionsReceive: Incoming packet too small"
|
|
" to contain Hop-by-Hop Options header\n"));
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
FIELD_OFFSET(IPv6Header, PayloadLength),
|
|
IP_PROTOCOL_NONE, FALSE);
|
|
}
|
|
return -1; // Drop packet.
|
|
}
|
|
HopByHop = (IPv6OptionsHeader *) Packet->Data;
|
|
|
|
//
|
|
// Check that length of the Hop-by-Hop options also fits in remaining data.
|
|
// The options must also be aligned for any addresses in them.
|
|
//
|
|
ExtLen = (HopByHop->HeaderExtLength + 1) * EXT_LEN_UNIT;
|
|
if (! PacketPullup(Packet, ExtLen,
|
|
MAX(__builtin_alignof(IPv6OptionsHeader),
|
|
__builtin_alignof(IPv6Addr)), 0)) {
|
|
if (Packet->TotalSize < ExtLen)
|
|
goto BadPayloadLength;
|
|
return -1; // Drop packet.
|
|
}
|
|
HopByHop = (IPv6OptionsHeader *) Packet->Data;
|
|
|
|
//
|
|
// Remember offset to this header's NextHeader field.
|
|
//
|
|
Packet->NextHeaderPosition = Packet->Position +
|
|
FIELD_OFFSET(IPv6OptionsHeader, NextHeader);
|
|
|
|
//
|
|
// Skip over the extension header.
|
|
// We need to do this now so subsequent ICMP error generation works.
|
|
//
|
|
AdjustPacketParams(Packet, ExtLen);
|
|
|
|
//
|
|
// Parse options in this extension header. If an error occurs
|
|
// while parsing the options, discard packet.
|
|
//
|
|
if (!ParseOptions(Packet, IP_PROTOCOL_HOP_BY_HOP, HopByHop,
|
|
ExtLen, &Opts)) {
|
|
return -1; // Drop packet.
|
|
}
|
|
|
|
//
|
|
// If we have a valid Jumbo Payload Option, use its value as
|
|
// the packet PayloadLength.
|
|
//
|
|
if (Opts.JumboLength) {
|
|
uint PayloadLength = Opts.JumboLength;
|
|
|
|
ASSERT(Packet->IP->PayloadLength == 0);
|
|
|
|
//
|
|
// Check that the jumbo length is big enough to include
|
|
// the extension header length. This must be true because
|
|
// the extension-header length is at most 11 bits,
|
|
// while the jumbo length is at least 16 bits.
|
|
//
|
|
ASSERT(PayloadLength > ExtLen);
|
|
PayloadLength -= ExtLen;
|
|
|
|
//
|
|
// Check that the amount of payload specified in the Jumbo
|
|
// Payload value fits in the buffer handed to us.
|
|
//
|
|
if (PayloadLength > Packet->TotalSize) {
|
|
// Silently discard data.
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"HopByHopOptionsReceive: "
|
|
"Jumbo payload length too big\n"));
|
|
return -1;
|
|
}
|
|
|
|
//
|
|
// As in IPv6HeaderReceive, adjust the TotalSize to be exactly the
|
|
// IP payload size (assume excess is media padding).
|
|
//
|
|
Packet->TotalSize = PayloadLength;
|
|
if (Packet->ContigSize > PayloadLength)
|
|
Packet->ContigSize = PayloadLength;
|
|
|
|
//
|
|
// Set the jumbo option packet flag.
|
|
//
|
|
Packet->Flags |= PACKET_JUMBO_OPTION;
|
|
}
|
|
else if (Packet->IP->PayloadLength == 0) {
|
|
//
|
|
// We should have a Jumbo Payload option,
|
|
// but we didn't find it. Send an ICMP error.
|
|
//
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
FIELD_OFFSET(IPv6Header, PayloadLength),
|
|
HopByHop->NextHeader, FALSE);
|
|
return -1;
|
|
}
|
|
|
|
//
|
|
// Return next header value.
|
|
//
|
|
return HopByHop->NextHeader;
|
|
}
|
|
|
|
|
|
//* ParseOptions - Routine for generic header options parsing.
|
|
//
|
|
// Returns TRUE if the options were successfully parsed.
|
|
// Returns FALSE if the packet should be discarded.
|
|
//
|
|
int
|
|
ParseOptions(
|
|
IPv6Packet *Packet, // The packet handed to us by IPv6Receive.
|
|
uchar HdrType, // Hop-by-hop or destination.
|
|
IPv6OptionsHeader *Hdr, // Header with following data.
|
|
uint HdrLength, // Length of the entire options area.
|
|
Options *Opts) // Return option values to caller.
|
|
{
|
|
uchar *OptPtr;
|
|
uint OptSizeLeft;
|
|
OptionHeader *OptHdr;
|
|
uint OptLen;
|
|
|
|
ASSERT((HdrType == IP_PROTOCOL_DEST_OPTS) ||
|
|
(HdrType == IP_PROTOCOL_HOP_BY_HOP));
|
|
|
|
//
|
|
// Zero out the Options struct that is returned.
|
|
//
|
|
RtlZeroMemory(Opts, sizeof *Opts);
|
|
|
|
//
|
|
// Skip over the extension header.
|
|
//
|
|
OptPtr = (uchar *)(Hdr + 1);
|
|
OptSizeLeft = HdrLength - sizeof *Hdr;
|
|
|
|
//
|
|
// Note that if there are multiple options
|
|
// of the same type, we just use the last one encountered
|
|
// unless the spec says specifically it is an error.
|
|
//
|
|
|
|
while (OptSizeLeft > 0) {
|
|
|
|
//
|
|
// First we check the option length and ensure that it fits.
|
|
// We move OptPtr past this option while leaving OptHdr
|
|
// for use by the option processing code below.
|
|
//
|
|
|
|
OptHdr = (OptionHeader *) OptPtr;
|
|
if (OptHdr->Type == OPT6_PAD_1) {
|
|
//
|
|
// This is a special pad option which is just a one byte field,
|
|
// i.e. it has no length or data field.
|
|
//
|
|
OptLen = 1;
|
|
}
|
|
else {
|
|
//
|
|
// This is a multi-byte option.
|
|
//
|
|
if ((sizeof *OptHdr > OptSizeLeft) ||
|
|
((OptLen = sizeof *OptHdr + OptHdr->DataLength) >
|
|
OptSizeLeft)) {
|
|
//
|
|
// Bad length, generate error and discard packet.
|
|
//
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
&Hdr->HeaderExtLength) -
|
|
Packet->IPPosition),
|
|
Hdr->NextHeader, FALSE);
|
|
return FALSE;
|
|
}
|
|
}
|
|
OptPtr += OptLen;
|
|
OptSizeLeft -= OptLen;
|
|
|
|
switch (OptHdr->Type) {
|
|
case OPT6_PAD_1:
|
|
case OPT6_PAD_N:
|
|
break;
|
|
|
|
case OPT6_JUMBO_PAYLOAD:
|
|
if (HdrType != IP_PROTOCOL_HOP_BY_HOP)
|
|
goto BadOptionType;
|
|
|
|
if (OptHdr->DataLength != sizeof Opts->JumboLength)
|
|
goto BadOptionLength;
|
|
|
|
if (Packet->IP->PayloadLength != 0) {
|
|
//
|
|
// Jumbo option encountered when IP payload is not zero.
|
|
// Send ICMP error, set pointer to offset of this option type.
|
|
//
|
|
goto BadOptionType;
|
|
}
|
|
|
|
Opts->JumboLength = net_long(*(ulong UNALIGNED *)(OptHdr + 1));
|
|
if (Opts->JumboLength <= MAX_IPv6_PAYLOAD) {
|
|
//
|
|
// Jumbo payload length is not jumbo, send ICMP error.
|
|
// ICMP pointer is set to offset of jumbo payload len field.
|
|
//
|
|
goto BadOptionData;
|
|
}
|
|
break;
|
|
|
|
case OPT6_ROUTER_ALERT:
|
|
if (HdrType != IP_PROTOCOL_HOP_BY_HOP)
|
|
goto BadOptionType;
|
|
|
|
if (OptLen != sizeof *Opts->Alert)
|
|
goto BadOptionLength;
|
|
|
|
if (Opts->Alert != NULL) {
|
|
//
|
|
// Can only have one router alert option.
|
|
//
|
|
goto BadOptionType;
|
|
}
|
|
|
|
//
|
|
// Return the pointer to the router alert struct.
|
|
//
|
|
Opts->Alert = (IPv6RouterAlertOption UNALIGNED *)(OptHdr + 1);
|
|
break;
|
|
|
|
case OPT6_HOME_ADDRESS:
|
|
if (HdrType != IP_PROTOCOL_DEST_OPTS)
|
|
goto BadOptionType;
|
|
|
|
if (OptLen < sizeof *Opts->HomeAddress)
|
|
goto BadOptionLength;
|
|
|
|
//
|
|
// Return the pointer to the home address option
|
|
// after checking to make sure the address is reasonable.
|
|
// The option must be aligned so that the home address
|
|
// is appropriately aligned.
|
|
//
|
|
Opts->HomeAddress = (IPv6HomeAddressOption UNALIGNED *)OptHdr;
|
|
if (((UINT_PTR)&Opts->HomeAddress->HomeAddress % __builtin_alignof(IPv6Addr)) != 0) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"ParseOptions: misaligned home address\n"));
|
|
goto BadOptionType;
|
|
}
|
|
if (IsInvalidSourceAddress(AlignAddr(&Opts->HomeAddress->HomeAddress)) ||
|
|
IsUnspecified(AlignAddr(&Opts->HomeAddress->HomeAddress)) ||
|
|
IsLoopback(AlignAddr(&Opts->HomeAddress->HomeAddress))) {
|
|
//
|
|
// Address contained in option is invalid.
|
|
// Send ICMP error, set pointer to offset of home address.
|
|
//
|
|
goto BadOptionData;
|
|
}
|
|
break;
|
|
|
|
case OPT6_BINDING_UPDATE:
|
|
if (HdrType != IP_PROTOCOL_DEST_OPTS)
|
|
goto BadOptionType;
|
|
|
|
//
|
|
// At a minimum, the binding update must include all of the
|
|
// base header fields.
|
|
//
|
|
if (OptLen < sizeof(IPv6BindingUpdateOption)) {
|
|
//
|
|
// draft-ietf-mobileip-ipv6-13 sec 8.2 says we must
|
|
// silently drop the packet. Normally we would
|
|
// goto BadOptionLength to send an ICMP error.
|
|
//
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Save pointer to the binding update option. Note we still
|
|
// need to do further length checking.
|
|
//
|
|
Opts->BindingUpdate = (IPv6BindingUpdateOption UNALIGNED *)OptHdr;
|
|
break;
|
|
|
|
default:
|
|
if (OPT6_ACTION(OptHdr->Type) == OPT6_A_SKIP) {
|
|
//
|
|
// Ignore the unrecognized option.
|
|
//
|
|
break;
|
|
}
|
|
else if (OPT6_ACTION(OptHdr->Type) == OPT6_A_DISCARD) {
|
|
//
|
|
// Discard the packet.
|
|
//
|
|
return FALSE;
|
|
}
|
|
else {
|
|
//
|
|
// Send an ICMP error.
|
|
//
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_UNRECOGNIZED_OPTION,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
&OptHdr->Type) -
|
|
Packet->IPPosition),
|
|
Hdr->NextHeader,
|
|
OPT6_ACTION(OptHdr->Type) ==
|
|
OPT6_A_SEND_ICMP_ALL);
|
|
return FALSE; // discard the packet.
|
|
}
|
|
}
|
|
}
|
|
|
|
return TRUE;
|
|
|
|
BadOptionType:
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
&OptHdr->Type) -
|
|
Packet->IPPosition),
|
|
Hdr->NextHeader, FALSE);
|
|
return FALSE; // discard packet.
|
|
|
|
BadOptionLength:
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
&OptHdr->DataLength) -
|
|
Packet->IPPosition),
|
|
Hdr->NextHeader, FALSE);
|
|
return FALSE; // discard packet.
|
|
|
|
BadOptionData:
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
(uchar *)(OptHdr + 1)) -
|
|
Packet->IPPosition),
|
|
Hdr->NextHeader, FALSE);
|
|
return FALSE; // discard packet.
|
|
}
|
|
|
|
|
|
//* ExtHdrControlReceive - generic extension header skip-over routine.
|
|
//
|
|
// Routine for processing the extension headers in an ICMP error message
|
|
// before delivering the error message to the upper-layer protocol.
|
|
//
|
|
uchar
|
|
ExtHdrControlReceive(
|
|
IPv6Packet *Packet, // Packet handed to us by ICMPv6ErrorReceive.
|
|
StatusArg *StatArg) // ICMP Error code and offset pointer.
|
|
{
|
|
uchar NextHdr = StatArg->IP->NextHeader;
|
|
uint HdrLen;
|
|
|
|
for (;;) {
|
|
switch (NextHdr) {
|
|
case IP_PROTOCOL_HOP_BY_HOP:
|
|
case IP_PROTOCOL_DEST_OPTS:
|
|
case IP_PROTOCOL_ROUTING: {
|
|
ExtensionHeader *ExtHdr; // Generic exension header.
|
|
|
|
//
|
|
// Here we take advantage of the fact that all of these extension
|
|
// headers share the same first two fields (except as noted below).
|
|
// Since those two fields (Next Header and Header Extension Length)
|
|
// provide us with all the information we need to skip over the
|
|
// header, they're all we need to look at here.
|
|
//
|
|
if (! PacketPullup(Packet, sizeof *ExtHdr,
|
|
__builtin_alignof(ExtensionHeader), 0)) {
|
|
if (Packet->TotalSize < sizeof *ExtHdr) {
|
|
PacketTooSmall:
|
|
//
|
|
// Pullup failed. There isn't enough of the invoking
|
|
// packet included in the error message to figure out
|
|
// what upper layer protocol it originated with.
|
|
//
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"ExtHdrControlReceive: "
|
|
"Incoming ICMP error packet "
|
|
"doesn't contain enough of invoking packet\n"));
|
|
}
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
|
|
ExtHdr = (ExtensionHeader *) Packet->Data;
|
|
HdrLen = (ExtHdr->HeaderExtLength + 1) * EXT_LEN_UNIT;
|
|
|
|
//
|
|
// Now that we know the actual length of this extension header,
|
|
// skip over it.
|
|
//
|
|
// REVIEW: We could rework this to use PositionPacketAt
|
|
// REVIEW: here instead of PacketPullup as we don't need to
|
|
// REVIEW: look at the data we're skipping over. Better?
|
|
//
|
|
if (! PacketPullup(Packet, HdrLen, 1, 0)) {
|
|
if (Packet->TotalSize < HdrLen)
|
|
goto PacketTooSmall;
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
|
|
NextHdr = ExtHdr->NextHeader;
|
|
break;
|
|
}
|
|
|
|
case IP_PROTOCOL_FRAGMENT: {
|
|
FragmentHeader UNALIGNED *FragHdr;
|
|
|
|
if (! PacketPullup(Packet, sizeof *FragHdr, 1, 0)) {
|
|
if (Packet->TotalSize < sizeof *FragHdr)
|
|
goto PacketTooSmall;
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
|
|
FragHdr = (FragmentHeader UNALIGNED *) Packet->Data;
|
|
|
|
if ((net_short(FragHdr->OffsetFlag) & FRAGMENT_OFFSET_MASK) != 0) {
|
|
//
|
|
// We can only continue parsing if this
|
|
// fragment has offset zero.
|
|
//
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"ExtHdrControlReceive: "
|
|
"non-zero-offset fragment\n"));
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
HdrLen = sizeof *FragHdr;
|
|
NextHdr = FragHdr->NextHeader;
|
|
break;
|
|
}
|
|
|
|
case IP_PROTOCOL_AH:
|
|
case IP_PROTOCOL_ESP:
|
|
//
|
|
// REVIEW - What is the correct thing here?
|
|
//
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"ExtHdrControlReceive: found AH/ESP\n"));
|
|
return IP_PROTOCOL_NONE;
|
|
|
|
default:
|
|
//
|
|
// We came to a header that we do not recognize,
|
|
// so we can not continue parsing here.
|
|
// But our caller might recognize this header type.
|
|
//
|
|
return NextHdr;
|
|
}
|
|
|
|
//
|
|
// Move past this extension header.
|
|
//
|
|
AdjustPacketParams(Packet, HdrLen);
|
|
}
|
|
}
|
|
|
|
|
|
//* RoutingReceive - Handle the IPv6 Routing Header.
|
|
//
|
|
// Called from IPv6Receive when we encounter a Routing Header,
|
|
// next header value of 43.
|
|
//
|
|
uchar
|
|
RoutingReceive(
|
|
IPv6Packet *Packet) // Packet handed to us by link layer.
|
|
{
|
|
IPv6RoutingHeader *RH;
|
|
uint HeaderLength;
|
|
uint SegmentsLeft;
|
|
uint NumAddresses, i;
|
|
IPv6Addr *Addresses;
|
|
IP_STATUS Status;
|
|
uchar *Mem;
|
|
uint MemLen, Offset;
|
|
NDIS_PACKET *FwdPacket;
|
|
NDIS_STATUS NdisStatus;
|
|
IPv6Header UNALIGNED *FwdIP;
|
|
IPv6RoutingHeader UNALIGNED *FwdRH;
|
|
IPv6Addr UNALIGNED *FwdAddresses;
|
|
IPv6Addr FwdDest;
|
|
int Delta;
|
|
uint PayloadLength;
|
|
uint TunnelStart = NO_TUNNEL, IPSecBytes = 0;
|
|
IPSecProc *IPSecToDo;
|
|
RouteCacheEntry *RCE;
|
|
uint Action;
|
|
|
|
//
|
|
// Verify that we have enough contiguous data,
|
|
// then get a pointer to the routing header.
|
|
//
|
|
if (! PacketPullup(Packet, sizeof *RH,
|
|
__builtin_alignof(IPv6RoutingHeader), 0)) {
|
|
if (Packet->TotalSize < sizeof *RH) {
|
|
BadPayloadLength:
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"RoutingReceive: Incoming packet too small"
|
|
" to contain routing header\n"));
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
FIELD_OFFSET(IPv6Header, PayloadLength),
|
|
IP_PROTOCOL_NONE, FALSE);
|
|
}
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
RH = (IPv6RoutingHeader *) Packet->Data;
|
|
|
|
//
|
|
// Now get the entire routing header.
|
|
// Also align for the address array.
|
|
//
|
|
HeaderLength = (RH->HeaderExtLength + 1) * EXT_LEN_UNIT;
|
|
if (! PacketPullup(Packet, HeaderLength,
|
|
MAX(__builtin_alignof(IPv6RoutingHeader),
|
|
__builtin_alignof(IPv6Addr)), 0)) {
|
|
if (Packet->TotalSize < HeaderLength)
|
|
goto BadPayloadLength;
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
RH = (IPv6RoutingHeader *) Packet->Data;
|
|
|
|
//
|
|
// Remember offset to this header's NextHeader field.
|
|
//
|
|
Packet->NextHeaderPosition = Packet->Position +
|
|
FIELD_OFFSET(IPv6RoutingHeader, NextHeader);
|
|
|
|
//
|
|
// Move past the routing header.
|
|
// We need to do this now so subsequent ICMP error generation works.
|
|
//
|
|
AdjustPacketParams(Packet, HeaderLength);
|
|
|
|
//
|
|
// If SegmentsLeft is zero, we proceed directly to the next header.
|
|
// We must not check the Type value or HeaderLength.
|
|
//
|
|
SegmentsLeft = RH->SegmentsLeft;
|
|
if (SegmentsLeft == 0) {
|
|
//
|
|
// Return next header value.
|
|
//
|
|
return RH->NextHeader;
|
|
}
|
|
|
|
//
|
|
// If we do not recognize the Type value, generate an ICMP error.
|
|
//
|
|
if (RH->RoutingType != 0) {
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
&RH->RoutingType) -
|
|
Packet->IPPosition),
|
|
RH->NextHeader, FALSE);
|
|
return IP_PROTOCOL_NONE; // No further processing of this packet.
|
|
}
|
|
|
|
//
|
|
// We must have an integral number of IPv6 addresses
|
|
// in the routing header.
|
|
//
|
|
if (RH->HeaderExtLength & 1) {
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
&RH->HeaderExtLength) -
|
|
Packet->IPPosition),
|
|
RH->NextHeader, FALSE);
|
|
return IP_PROTOCOL_NONE; // No further processing of this packet.
|
|
}
|
|
|
|
NumAddresses = RH->HeaderExtLength / 2;
|
|
|
|
//
|
|
// Sanity check SegmentsLeft.
|
|
//
|
|
if (SegmentsLeft > NumAddresses) {
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet,
|
|
&RH->SegmentsLeft) -
|
|
Packet->IPPosition),
|
|
RH->NextHeader, FALSE);
|
|
return IP_PROTOCOL_NONE; // No further processing of this packet.
|
|
}
|
|
|
|
//
|
|
// Sanity check the destination address.
|
|
// Packets carrying a Type 0 Routing Header must not
|
|
// be sent to a multicast destination.
|
|
//
|
|
if (IsMulticast(AlignAddr(&Packet->IP->Dest))) {
|
|
//
|
|
// Just drop the packet, no ICMP error in this case.
|
|
//
|
|
return IP_PROTOCOL_NONE; // No further processing of this packet.
|
|
}
|
|
|
|
i = NumAddresses - SegmentsLeft;
|
|
Addresses = AlignAddr((IPv6Addr UNALIGNED *) (RH + 1));
|
|
|
|
//
|
|
// Sanity check the new destination.
|
|
// RFC 2460 doesn't mention checking for an unspecified address,
|
|
// but I think it's a good idea. Similarly, for security reasons,
|
|
// we also check the scope of the destination. This allows
|
|
// applications to check the scope of the eventual destination address
|
|
// and know that the packet originated within that scope.
|
|
// RFC 2460 says to discard the packet without an ICMP error
|
|
// (at least when the new destination is multicast),
|
|
// but I think an ICMP error is helpful in this situation.
|
|
//
|
|
if (IsMulticast(&Addresses[i]) ||
|
|
IsUnspecified(&Addresses[i]) ||
|
|
(UnicastAddressScope(&Addresses[i]) <
|
|
UnicastAddressScope(AlignAddr(&Packet->IP->Dest)))) {
|
|
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_PARAMETER_PROBLEM,
|
|
ICMPv6_ERRONEOUS_HEADER_FIELD,
|
|
(GetPacketPositionFromPointer(Packet, (uchar *)
|
|
&Addresses[i]) -
|
|
Packet->IPPosition),
|
|
RH->NextHeader, FALSE);
|
|
return IP_PROTOCOL_NONE; // No further processing of this packet.
|
|
}
|
|
|
|
//
|
|
// Verify IPSec was performed.
|
|
//
|
|
if (InboundSecurityCheck(Packet, 0, 0, 0, Packet->NTEorIF->IF) != TRUE) {
|
|
//
|
|
// No policy was found or the policy indicated to drop the packet.
|
|
//
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"RoutingReceive: "
|
|
"IPSec lookup failed or policy was to drop\n"));
|
|
return IP_PROTOCOL_NONE; // Drop packet.
|
|
}
|
|
|
|
//
|
|
// Find a route to the new destination.
|
|
//
|
|
Status = RouteToDestination(&Addresses[i],
|
|
0, Packet->NTEorIF,
|
|
RTD_FLAG_LOOSE, &RCE);
|
|
if (Status != IP_SUCCESS) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_INTERNAL_ERROR,
|
|
"RoutingReceive: "
|
|
"No route to destination for forwarding.\n"));
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_DESTINATION_UNREACHABLE,
|
|
ICMPv6_NO_ROUTE_TO_DESTINATION,
|
|
0, RH->NextHeader, FALSE);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// For security reasons, we prevent source routing
|
|
// in some situations. Check those now.
|
|
//
|
|
if (Packet->NTEorIF->IF->Flags & IF_FLAG_FORWARDS) {
|
|
//
|
|
// The interface is forwarding, so source-routing is allowed.
|
|
//
|
|
}
|
|
else if (Packet->NTEorIF->IF == RCE->NCE->IF) {
|
|
//
|
|
// Same-interface rule says source-routing is allowed,
|
|
// because the host is not acting as a conduit
|
|
// between two networks. See RFC 1122 section 3.3.5.
|
|
//
|
|
}
|
|
else if ((SegmentsLeft == 1) && RCE->NCE->IsLoopback) {
|
|
//
|
|
// The packet is locally destined, so source-routing is allowed.
|
|
// Mobile IPv6 uses the Routing Header in this way.
|
|
//
|
|
}
|
|
else {
|
|
//
|
|
// We can not allow this use of source-routing.
|
|
// Instead of reporting an error, we could
|
|
// redo RouteToDestination with RTD_FLAG_STRICT
|
|
// to constrain to the same interface.
|
|
// However, an ICMP error is more in keeping
|
|
// with the treatment of scoped source addresses,
|
|
// which can produce a destination-unreachable error.
|
|
//
|
|
ReleaseRCE(RCE);
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_BAD_PACKET,
|
|
"RoutingReceive: Inappropriate route.\n"));
|
|
ICMPv6SendError(Packet,
|
|
ICMPv6_DESTINATION_UNREACHABLE,
|
|
ICMPv6_COMMUNICATION_PROHIBITED,
|
|
0, RH->NextHeader, FALSE);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// Find the Security Policy for this outbound traffic.
|
|
// The source address is the same but the destination address is the
|
|
// next hop from the routing header.
|
|
//
|
|
IPSecToDo = OutboundSPLookup(AlignAddr(&Packet->IP->Source),
|
|
&Addresses[i],
|
|
0, 0, 0, RCE->NCE->IF, &Action);
|
|
|
|
if (IPSecToDo == NULL) {
|
|
//
|
|
// Check Action.
|
|
//
|
|
if (Action == LOOKUP_DROP) {
|
|
// Drop packet.
|
|
ReleaseRCE(RCE);
|
|
return IP_PROTOCOL_NONE;
|
|
} else {
|
|
if (Action == LOOKUP_IKE_NEG) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"RoutingReceive: IKE not supported yet.\n"));
|
|
ReleaseRCE(RCE);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// With no IPSec to perform, IPv6Forward won't be changing the
|
|
// outgoing interface from what we currently think it will be.
|
|
// So we can use the exact size of its link-level header.
|
|
//
|
|
Offset = RCE->NCE->IF->LinkHeaderSize;
|
|
|
|
} else {
|
|
//
|
|
// Calculate the space needed for the IPSec headers.
|
|
//
|
|
IPSecBytes = IPSecBytesToInsert(IPSecToDo, &TunnelStart, NULL);
|
|
|
|
if (TunnelStart != 0) {
|
|
KdPrintEx((DPFLTR_TCPIP6_ID, DPFLTR_NET_ERROR,
|
|
"RoutingReceive: IPSec Tunnel mode only.\n"));
|
|
FreeIPSecToDo(IPSecToDo, IPSecToDo->BundleSize);
|
|
ReleaseRCE(RCE);
|
|
return IP_PROTOCOL_NONE;
|
|
}
|
|
|
|
//
|
|
// The IPSec code in IPv6Forward might change the outgoing
|
|
// interface from what we currently think it will be. Play it
|
|
// safe and leave the max amount of space for its link-level header.
|
|
//
|
|
Offset = MAX_LINK_HEADER_SIZE;
|
|
}
|
|
|
|
//
|
|
// The packet has passed all our checks.
|
|
// We can construct a revised packet for transmission.
|
|
// First we allocate a packet, buffer, and memory.
|
|
//
|
|
// NB: The original packet is read-only for us. Furthermore
|
|
// we can not keep a pointer to it beyond the return of this
|
|
// function. So we must copy the packet and then modify it.
|
|
//
|
|
|
|
// Packet->IP->PayloadLength might be zero with jumbograms.
|
|
Delta = Packet->Position - Packet->IPPosition;
|
|
PayloadLength = Packet->TotalSize + Delta - sizeof(IPv6Header);
|
|
MemLen = Offset + sizeof(IPv6Header) + PayloadLength + IPSecBytes;
|
|
|
|
NdisStatus = IPv6AllocatePacket(MemLen, &FwdPacket, &Mem);
|
|
if (NdisStatus != NDIS_STATUS_SUCCESS) {
|
|
if (IPSecToDo) {
|
|
FreeIPSecToDo(IPSecToDo, IPSecToDo->BundleSize);
|
|
}
|
|
ReleaseRCE(RCE);
|
|
return IP_PROTOCOL_NONE; // No further processing of this packet.
|
|
}
|
|
|
|
FwdIP = (IPv6Header UNALIGNED *)(Mem + Offset + IPSecBytes);
|
|
FwdRH = (IPv6RoutingHeader UNALIGNED *)
|
|
((uchar *)FwdIP + Delta - HeaderLength);
|
|
FwdAddresses = (IPv6Addr UNALIGNED *) (FwdRH + 1);
|
|
|
|
//
|
|
// Now we copy from the original packet to the new packet.
|
|
//
|
|
CopyPacketToBuffer((uchar *)FwdIP, Packet,
|
|
sizeof(IPv6Header) + PayloadLength,
|
|
Packet->IPPosition);
|
|
|
|
//
|
|
// Fix up the new packet - put in the new destination address
|
|
// and decrement SegmentsLeft.
|
|
// NB: We pass the Reserved field through unmodified!
|
|
// This violates a strict reading of the spec,
|
|
// but Steve Deering has confirmed that this is his intent.
|
|
//
|
|
FwdDest = *AlignAddr(&FwdAddresses[i]);
|
|
*AlignAddr(&FwdAddresses[i]) = *AlignAddr(&FwdIP->Dest);
|
|
*AlignAddr(&FwdIP->Dest) = FwdDest;
|
|
FwdRH->SegmentsLeft--;
|
|
|
|
//
|
|
// Forward the packet. This decrements the Hop Limit and generates
|
|
// any applicable ICMP errors (Time Limit Exceeded, Destination
|
|
// Unreachable, Packet Too Big). Note that previous ICMP errors
|
|
// that we generated were based on the unmodified incoming packet,
|
|
// while from here on the ICMP errors are based on the new FwdPacket.
|
|
//
|
|
IPv6Forward(Packet->NTEorIF, FwdPacket, Offset + IPSecBytes, FwdIP,
|
|
PayloadLength, FALSE, // Don't Redirect.
|
|
IPSecToDo, RCE);
|
|
|
|
if (IPSecToDo) {
|
|
FreeIPSecToDo(IPSecToDo, IPSecToDo->BundleSize);
|
|
}
|
|
|
|
ReleaseRCE(RCE);
|
|
return IP_PROTOCOL_NONE; // No further processing of this packet.
|
|
}
|