Revert 295285 which was an MFC of the tryforward work (r290383,295282,295283)

In the IPFW+NAT+divergent MTU case there is a bug in sening ICMP MTU updates.

Approved by:	re (marius, gjb)
Sponsored by:	Rubicon Communications (Netgate)

1 files changed, 112 insertions, 5 deletions

diff --git a/sys/netinet/ip_fastfwd.c b/sys/netinet/ip_fastfwd.c
index 13c5785..0772cf0 100644
--- a/sys/netinet/ip_fastfwd.c
+++ b/sys/netinet/ip_fastfwd.c
@@ -109,6 +109,12 @@ __FBSDID("$FreeBSD$");
 
 #include <machine/in_cksum.h>
 
+static VNET_DEFINE(int, ipfastforward_active);
+#define	V_ipfastforward_active		VNET(ipfastforward_active)
+
+SYSCTL_VNET_INT(_net_inet_ip, OID_AUTO, fastforwarding, CTLFLAG_RW,
+    &VNET_NAME(ipfastforward_active), 0, "Enable fast IP forwarding");
+
 static struct sockaddr_in *
 ip_findroute(struct route *ro, struct in_addr dest, struct mbuf *m)
 {
@@ -153,7 +159,7 @@ ip_findroute(struct route *ro, struct in_addr dest, struct mbuf *m)
  * to ip_input for full processing.
  */
 struct mbuf *
-ip_tryforward(struct mbuf *m)
+ip_fastforward(struct mbuf *m)
 {
 	struct ip *ip;
 	struct mbuf *m0 = NULL;
@@ -161,20 +167,119 @@ ip_tryforward(struct mbuf *m)
 	struct sockaddr_in *dst = NULL;
 	struct ifnet *ifp;
 	struct in_addr odest, dest;
-	uint16_t ip_len, ip_off;
+	uint16_t sum, ip_len, ip_off;
 	int error = 0;
-	int mtu;
+	int hlen, mtu;
 	struct m_tag *fwd_tag = NULL;
 
 	/*
 	 * Are we active and forwarding packets?
 	 */
+	if (!V_ipfastforward_active || !V_ipforwarding)
+		return m;
 
 	M_ASSERTVALID(m);
 	M_ASSERTPKTHDR(m);
 
 	bzero(&ro, sizeof(ro));
 
+	/*
+	 * Step 1: check for packet drop conditions (and sanity checks)
+	 */
+
+	/*
+	 * Is entire packet big enough?
+	 */
+	if (m->m_pkthdr.len < sizeof(struct ip)) {
+		IPSTAT_INC(ips_tooshort);
+		goto drop;
+	}
+
+	/*
+	 * Is first mbuf large enough for ip header and is header present?
+	 */
+	if (m->m_len < sizeof (struct ip) &&
+	   (m = m_pullup(m, sizeof (struct ip))) == NULL) {
+		IPSTAT_INC(ips_toosmall);
+		return NULL;	/* mbuf already free'd */
+	}
+
+	ip = mtod(m, struct ip *);
+
+	/*
+	 * Is it IPv4?
+	 */
+	if (ip->ip_v != IPVERSION) {
+		IPSTAT_INC(ips_badvers);
+		goto drop;
+	}
+
+	/*
+	 * Is IP header length correct and is it in first mbuf?
+	 */
+	hlen = ip->ip_hl << 2;
+	if (hlen < sizeof(struct ip)) {	/* minimum header length */
+		IPSTAT_INC(ips_badhlen);
+		goto drop;
+	}
+	if (hlen > m->m_len) {
+		if ((m = m_pullup(m, hlen)) == NULL) {
+			IPSTAT_INC(ips_badhlen);
+			return NULL;	/* mbuf already free'd */
+		}
+		ip = mtod(m, struct ip *);
+	}
+
+	/*
+	 * Checksum correct?
+	 */
+	if (m->m_pkthdr.csum_flags & CSUM_IP_CHECKED)
+		sum = !(m->m_pkthdr.csum_flags & CSUM_IP_VALID);
+	else {
+		if (hlen == sizeof(struct ip))
+			sum = in_cksum_hdr(ip);
+		else
+			sum = in_cksum(m, hlen);
+	}
+	if (sum) {
+		IPSTAT_INC(ips_badsum);
+		goto drop;
+	}
+
+	/*
+	 * Remember that we have checked the IP header and found it valid.
+	 */
+	m->m_pkthdr.csum_flags |= (CSUM_IP_CHECKED | CSUM_IP_VALID);
+
+	ip_len = ntohs(ip->ip_len);
+
+	/*
+	 * Is IP length longer than packet we have got?
+	 */
+	if (m->m_pkthdr.len < ip_len) {
+		IPSTAT_INC(ips_tooshort);
+		goto drop;
+	}
+
+	/*
+	 * Is packet longer than IP header tells us? If yes, truncate packet.
+	 */
+	if (m->m_pkthdr.len > ip_len) {
+		if (m->m_len == m->m_pkthdr.len) {
+			m->m_len = ip_len;
+			m->m_pkthdr.len = ip_len;
+		} else
+			m_adj(m, ip_len - m->m_pkthdr.len);
+	}
+
+	/*
+	 * Is packet from or to 127/8?
+	 */
+	if ((ntohl(ip->ip_dst.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET ||
+	    (ntohl(ip->ip_src.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET) {
+		IPSTAT_INC(ips_badaddr);
+		goto drop;
+	}
 
 #ifdef ALTQ
 	/*
@@ -185,10 +290,12 @@ ip_tryforward(struct mbuf *m)
 #endif
 
 	/*
-	 * Only IP packets without options
+	 * Step 2: fallback conditions to normal ip_input path processing
 	 */
-	ip = mtod(m, struct ip *);
 
+	/*
+	 * Only IP packets without options
+	 */
 	if (ip->ip_hl != (sizeof(struct ip) >> 2)) {
 		if (V_ip_doopts == 1)
 			return m;