| 1 | /* |
| 2 | * Copyright (c) 1982, 1986, 1988, 1993 |
| 3 | * The Regents of the University of California. All rights reserved. |
| 4 | * |
| 5 | * Redistribution and use in source and binary forms, with or without |
| 6 | * modification, are permitted provided that the following conditions |
| 7 | * are met: |
| 8 | * 1. Redistributions of source code must retain the above copyright |
| 9 | * notice, this list of conditions and the following disclaimer. |
| 10 | * 2. Redistributions in binary form must reproduce the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer in the |
| 12 | * documentation and/or other materials provided with the distribution. |
| 13 | * 3. All advertising materials mentioning features or use of this software |
| 14 | * must display the following acknowledgement: |
| 15 | * This product includes software developed by the University of |
| 16 | * California, Berkeley and its contributors. |
| 17 | * 4. Neither the name of the University nor the names of its contributors |
| 18 | * may be used to endorse or promote products derived from this software |
| 19 | * without specific prior written permission. |
| 20 | * |
| 21 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
| 22 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 23 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 24 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
| 25 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 26 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 27 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 28 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 29 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 30 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 31 | * SUCH DAMAGE. |
| 32 | * |
| 33 | * $FreeBSD: src/sys/netinet/ip_divert.c,v 1.42.2.6 2003/01/23 21:06:45 sam Exp $ |
| 34 | * $DragonFly: src/sys/netinet/ip_divert.c,v 1.40 2008/10/21 13:51:01 sephe Exp $ |
| 35 | */ |
| 36 | |
| 37 | #define _IP_VHL |
| 38 | |
| 39 | #include "opt_inet.h" |
| 40 | #include "opt_ipfw.h" |
| 41 | #include "opt_ipdivert.h" |
| 42 | #include "opt_ipsec.h" |
| 43 | |
| 44 | #ifndef INET |
| 45 | #error "IPDIVERT requires INET." |
| 46 | #endif |
| 47 | |
| 48 | #include <sys/param.h> |
| 49 | #include <sys/kernel.h> |
| 50 | #include <sys/malloc.h> |
| 51 | #include <sys/mbuf.h> |
| 52 | #include <sys/socket.h> |
| 53 | #include <sys/protosw.h> |
| 54 | #include <sys/socketvar.h> |
| 55 | #include <sys/sysctl.h> |
| 56 | #include <sys/systm.h> |
| 57 | #include <sys/proc.h> |
| 58 | #include <sys/priv.h> |
| 59 | #include <sys/thread2.h> |
| 60 | #include <sys/in_cksum.h> |
| 61 | #include <sys/lock.h> |
| 62 | #ifdef SMP |
| 63 | #include <sys/msgport.h> |
| 64 | #endif |
| 65 | |
| 66 | #include <vm/vm_zone.h> |
| 67 | |
| 68 | #include <net/if.h> |
| 69 | #include <net/route.h> |
| 70 | #ifdef SMP |
| 71 | #include <net/netmsg2.h> |
| 72 | #endif |
| 73 | |
| 74 | #include <netinet/in.h> |
| 75 | #include <netinet/in_systm.h> |
| 76 | #include <netinet/ip.h> |
| 77 | #include <netinet/in_pcb.h> |
| 78 | #include <netinet/in_var.h> |
| 79 | #include <netinet/ip_var.h> |
| 80 | #include <netinet/ip_divert.h> |
| 81 | |
| 82 | /* |
| 83 | * Divert sockets |
| 84 | */ |
| 85 | |
| 86 | /* |
| 87 | * Allocate enough space to hold a full IP packet |
| 88 | */ |
| 89 | #define DIVSNDQ (65536 + 100) |
| 90 | #define DIVRCVQ (65536 + 100) |
| 91 | |
| 92 | #define DIV_IS_OUTPUT(sin) ((sin) == NULL || (sin)->sin_addr.s_addr == 0) |
| 93 | |
| 94 | #define DIV_OUTPUT 0x10000 |
| 95 | #define DIV_INPUT 0x20000 |
| 96 | |
| 97 | /* |
| 98 | * Divert sockets work in conjunction with ipfw, see the divert(4) |
| 99 | * manpage for features. |
| 100 | * Internally, packets selected by ipfw in ip_input() or ip_output(), |
| 101 | * and never diverted before, are passed to the input queue of the |
| 102 | * divert socket with a given 'divert_port' number (as specified in |
| 103 | * the matching ipfw rule), and they are tagged with a 16 bit cookie |
| 104 | * (representing the rule number of the matching ipfw rule), which |
| 105 | * is passed to process reading from the socket. |
| 106 | * |
| 107 | * Packets written to the divert socket are again tagged with a cookie |
| 108 | * (usually the same as above) and a destination address. |
| 109 | * If the destination address is INADDR_ANY then the packet is |
| 110 | * treated as outgoing and sent to ip_output(), otherwise it is |
| 111 | * treated as incoming and sent to ip_input(). |
| 112 | * In both cases, the packet is tagged with the cookie. |
| 113 | * |
| 114 | * On reinjection, processing in ip_input() and ip_output() |
| 115 | * will be exactly the same as for the original packet, except that |
| 116 | * ipfw processing will start at the rule number after the one |
| 117 | * written in the cookie (so, tagging a packet with a cookie of 0 |
| 118 | * will cause it to be effectively considered as a standard packet). |
| 119 | */ |
| 120 | |
| 121 | /* Internal variables */ |
| 122 | static struct inpcbinfo divcbinfo; |
| 123 | |
| 124 | static u_long div_sendspace = DIVSNDQ; /* XXX sysctl ? */ |
| 125 | static u_long div_recvspace = DIVRCVQ; /* XXX sysctl ? */ |
| 126 | |
| 127 | static struct mbuf *ip_divert(struct mbuf *, int, int); |
| 128 | |
| 129 | /* |
| 130 | * Initialize divert connection block queue. |
| 131 | */ |
| 132 | void |
| 133 | div_init(void) |
| 134 | { |
| 135 | in_pcbinfo_init(&divcbinfo); |
| 136 | /* |
| 137 | * XXX We don't use the hash list for divert IP, but it's easier |
| 138 | * to allocate a one entry hash list than it is to check all |
| 139 | * over the place for hashbase == NULL. |
| 140 | */ |
| 141 | divcbinfo.hashbase = hashinit(1, M_PCB, &divcbinfo.hashmask); |
| 142 | divcbinfo.porthashbase = hashinit(1, M_PCB, &divcbinfo.porthashmask); |
| 143 | divcbinfo.wildcardhashbase = hashinit(1, M_PCB, |
| 144 | &divcbinfo.wildcardhashmask); |
| 145 | divcbinfo.ipi_zone = zinit("divcb", sizeof(struct inpcb), |
| 146 | maxsockets, ZONE_INTERRUPT, 0); |
| 147 | ip_divert_p = ip_divert; |
| 148 | } |
| 149 | |
| 150 | /* |
| 151 | * IPPROTO_DIVERT is not a real IP protocol; don't allow any packets |
| 152 | * with that protocol number to enter the system from the outside. |
| 153 | */ |
| 154 | void |
| 155 | div_input(struct mbuf *m, ...) |
| 156 | { |
| 157 | ipstat.ips_noproto++; |
| 158 | m_freem(m); |
| 159 | } |
| 160 | |
| 161 | struct lwkt_port * |
| 162 | div_soport(struct socket *so, struct sockaddr *nam, |
| 163 | struct mbuf **mptr, int req) |
| 164 | { |
| 165 | struct sockaddr_in *sin; |
| 166 | struct mbuf *m; |
| 167 | int dir; |
| 168 | |
| 169 | /* Except for send(), everything happens on CPU0 */ |
| 170 | if (req != PRU_SEND) |
| 171 | return cpu0_soport(so, nam, mptr, req); |
| 172 | |
| 173 | sin = (struct sockaddr_in *)nam; |
| 174 | m = *mptr; |
| 175 | M_ASSERTPKTHDR(m); |
| 176 | |
| 177 | m->m_pkthdr.rcvif = NULL; |
| 178 | dir = DIV_IS_OUTPUT(sin) ? IP_MPORT_OUT : IP_MPORT_IN; |
| 179 | |
| 180 | if (sin != NULL) { |
| 181 | int i; |
| 182 | |
| 183 | /* |
| 184 | * Try locating the interface, if we originally had one. |
| 185 | * This is done even for outgoing packets, since for a |
| 186 | * forwarded packet, there must be an interface attached. |
| 187 | * |
| 188 | * Find receive interface with the given name, stuffed |
| 189 | * (if it exists) in the sin_zero[] field. |
| 190 | * The name is user supplied data so don't trust its size |
| 191 | * or that it is zero terminated. |
| 192 | */ |
| 193 | for (i = 0; sin->sin_zero[i] && i < sizeof(sin->sin_zero); i++) |
| 194 | ; |
| 195 | if (i > 0 && i < sizeof(sin->sin_zero)) |
| 196 | m->m_pkthdr.rcvif = ifunit(sin->sin_zero); |
| 197 | } |
| 198 | |
| 199 | if (dir == IP_MPORT_IN && m->m_pkthdr.rcvif == NULL) { |
| 200 | /* |
| 201 | * No luck with the name, check by IP address. |
| 202 | * Clear the port and the ifname to make sure |
| 203 | * there are no distractions for ifa_ifwithaddr. |
| 204 | * |
| 205 | * Be careful not to trash sin->sin_port; it will |
| 206 | * be used later in div_output(). |
| 207 | */ |
| 208 | struct ifaddr *ifa; |
| 209 | u_short sin_port; |
| 210 | |
| 211 | bzero(sin->sin_zero, sizeof(sin->sin_zero)); |
| 212 | sin_port = sin->sin_port; /* save */ |
| 213 | sin->sin_port = 0; |
| 214 | ifa = ifa_ifwithaddr((struct sockaddr *)sin); |
| 215 | if (ifa == NULL) { |
| 216 | m_freem(m); |
| 217 | *mptr = NULL; |
| 218 | return NULL; |
| 219 | } |
| 220 | sin->sin_port = sin_port; /* restore */ |
| 221 | m->m_pkthdr.rcvif = ifa->ifa_ifp; |
| 222 | } |
| 223 | |
| 224 | return ip_mport(mptr, dir); |
| 225 | } |
| 226 | |
| 227 | /* |
| 228 | * Divert a packet by passing it up to the divert socket at port 'port'. |
| 229 | * |
| 230 | * Setup generic address and protocol structures for div_input routine, |
| 231 | * then pass them along with mbuf chain. |
| 232 | */ |
| 233 | static void |
| 234 | div_packet(struct mbuf *m, int incoming, int port) |
| 235 | { |
| 236 | struct sockaddr_in divsrc = { sizeof divsrc, AF_INET }; |
| 237 | struct inpcb *inp; |
| 238 | struct socket *sa; |
| 239 | struct m_tag *mtag; |
| 240 | struct divert_info *divinfo; |
| 241 | u_int16_t nport; |
| 242 | |
| 243 | /* Locate the divert info */ |
| 244 | mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL); |
| 245 | divinfo = m_tag_data(mtag); |
| 246 | divsrc.sin_port = divinfo->skipto; |
| 247 | |
| 248 | /* |
| 249 | * Record receive interface address, if any. |
| 250 | * But only for incoming packets. |
| 251 | */ |
| 252 | divsrc.sin_addr.s_addr = 0; |
| 253 | if (incoming) { |
| 254 | struct ifaddr_container *ifac; |
| 255 | |
| 256 | /* Find IP address for receive interface */ |
| 257 | TAILQ_FOREACH(ifac, &m->m_pkthdr.rcvif->if_addrheads[mycpuid], |
| 258 | ifa_link) { |
| 259 | struct ifaddr *ifa = ifac->ifa; |
| 260 | |
| 261 | if (ifa->ifa_addr == NULL) |
| 262 | continue; |
| 263 | if (ifa->ifa_addr->sa_family != AF_INET) |
| 264 | continue; |
| 265 | divsrc.sin_addr = |
| 266 | ((struct sockaddr_in *) ifa->ifa_addr)->sin_addr; |
| 267 | break; |
| 268 | } |
| 269 | } |
| 270 | /* |
| 271 | * Record the incoming interface name whenever we have one. |
| 272 | */ |
| 273 | if (m->m_pkthdr.rcvif) { |
| 274 | /* |
| 275 | * Hide the actual interface name in there in the |
| 276 | * sin_zero array. XXX This needs to be moved to a |
| 277 | * different sockaddr type for divert, e.g. |
| 278 | * sockaddr_div with multiple fields like |
| 279 | * sockaddr_dl. Presently we have only 7 bytes |
| 280 | * but that will do for now as most interfaces |
| 281 | * are 4 or less + 2 or less bytes for unit. |
| 282 | * There is probably a faster way of doing this, |
| 283 | * possibly taking it from the sockaddr_dl on the iface. |
| 284 | * This solves the problem of a P2P link and a LAN interface |
| 285 | * having the same address, which can result in the wrong |
| 286 | * interface being assigned to the packet when fed back |
| 287 | * into the divert socket. Theoretically if the daemon saves |
| 288 | * and re-uses the sockaddr_in as suggested in the man pages, |
| 289 | * this iface name will come along for the ride. |
| 290 | * (see div_output for the other half of this.) |
| 291 | */ |
| 292 | ksnprintf(divsrc.sin_zero, sizeof divsrc.sin_zero, |
| 293 | m->m_pkthdr.rcvif->if_xname); |
| 294 | } |
| 295 | |
| 296 | /* Put packet on socket queue, if any */ |
| 297 | sa = NULL; |
| 298 | nport = htons((u_int16_t)port); |
| 299 | |
| 300 | /* |
| 301 | * XXX |
| 302 | * Following loop to locate the inpcb is MPSAFE since the inpcb |
| 303 | * insertion/removal happens on the same CPU (CPU0), however, |
| 304 | * saving/testing the socket pointer is not MPSAFE. So we still |
| 305 | * need to hold BGL here. |
| 306 | */ |
| 307 | get_mplock(); |
| 308 | LIST_FOREACH(inp, &divcbinfo.pcblisthead, inp_list) { |
| 309 | if (inp->inp_flags & INP_PLACEMARKER) |
| 310 | continue; |
| 311 | if (inp->inp_lport == nport) |
| 312 | sa = inp->inp_socket; |
| 313 | } |
| 314 | if (sa) { |
| 315 | if (ssb_appendaddr(&sa->so_rcv, (struct sockaddr *)&divsrc, m, |
| 316 | NULL) == 0) |
| 317 | m_freem(m); |
| 318 | else |
| 319 | sorwakeup(sa); |
| 320 | rel_mplock(); |
| 321 | } else { |
| 322 | rel_mplock(); |
| 323 | m_freem(m); |
| 324 | ipstat.ips_noproto++; |
| 325 | ipstat.ips_delivered--; |
| 326 | } |
| 327 | } |
| 328 | |
| 329 | #ifdef SMP |
| 330 | static void |
| 331 | div_packet_handler(struct netmsg *nmsg) |
| 332 | { |
| 333 | struct netmsg_packet *nmp; |
| 334 | struct lwkt_msg *msg; |
| 335 | struct mbuf *m; |
| 336 | int port, incoming = 0; |
| 337 | |
| 338 | nmp = (struct netmsg_packet *)nmsg; |
| 339 | m = nmp->nm_packet; |
| 340 | |
| 341 | msg = &nmsg->nm_lmsg; |
| 342 | port = msg->u.ms_result32 & 0xffff; |
| 343 | if (msg->u.ms_result32 & DIV_INPUT) |
| 344 | incoming = 1; |
| 345 | |
| 346 | div_packet(m, incoming, port); |
| 347 | } |
| 348 | #endif /* SMP */ |
| 349 | |
| 350 | static void |
| 351 | divert_packet(struct mbuf *m, int incoming) |
| 352 | { |
| 353 | struct m_tag *mtag; |
| 354 | struct divert_info *divinfo; |
| 355 | int port; |
| 356 | |
| 357 | M_ASSERTPKTHDR(m); |
| 358 | |
| 359 | /* Assure header */ |
| 360 | if (m->m_len < sizeof(struct ip) && |
| 361 | (m = m_pullup(m, sizeof(struct ip))) == NULL) |
| 362 | return; |
| 363 | |
| 364 | mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL); |
| 365 | KASSERT(mtag != NULL, ("%s no divert tag!", __func__)); |
| 366 | divinfo = m_tag_data(mtag); |
| 367 | |
| 368 | port = divinfo->port; |
| 369 | KASSERT(port != 0, ("%s: port=0", __func__)); |
| 370 | |
| 371 | #ifdef SMP |
| 372 | if (mycpuid != 0) { |
| 373 | struct netmsg_packet *nmp; |
| 374 | struct lwkt_msg *msg; |
| 375 | |
| 376 | nmp = &m->m_hdr.mh_netmsg; |
| 377 | netmsg_init(&nmp->nm_netmsg, &netisr_apanic_rport, MSGF_MPSAFE, |
| 378 | div_packet_handler); |
| 379 | nmp->nm_packet = m; |
| 380 | |
| 381 | msg = &nmp->nm_netmsg.nm_lmsg; |
| 382 | msg->u.ms_result32 = port; /* port is 16bits */ |
| 383 | if (incoming) |
| 384 | msg->u.ms_result32 |= DIV_INPUT; |
| 385 | else |
| 386 | msg->u.ms_result32 |= DIV_OUTPUT; |
| 387 | |
| 388 | lwkt_sendmsg(cpu_portfn(0), &nmp->nm_netmsg.nm_lmsg); |
| 389 | } else |
| 390 | #endif |
| 391 | div_packet(m, incoming, port); |
| 392 | } |
| 393 | |
| 394 | /* |
| 395 | * Deliver packet back into the IP processing machinery. |
| 396 | * |
| 397 | * If no address specified, or address is 0.0.0.0, send to ip_output(); |
| 398 | * otherwise, send to ip_input() and mark as having been received on |
| 399 | * the interface with that address. |
| 400 | */ |
| 401 | static int |
| 402 | div_output(struct socket *so, struct mbuf *m, |
| 403 | struct sockaddr_in *sin, struct mbuf *control) |
| 404 | { |
| 405 | int error = 0; |
| 406 | struct m_tag *mtag; |
| 407 | struct divert_info *divinfo; |
| 408 | |
| 409 | if (control) |
| 410 | m_freem(control); /* XXX */ |
| 411 | |
| 412 | /* |
| 413 | * Prepare the tag for divert info. Note that a packet |
| 414 | * with a 0 tag in mh_data is effectively untagged, |
| 415 | * so we could optimize that case. |
| 416 | */ |
| 417 | mtag = m_tag_get(PACKET_TAG_IPFW_DIVERT, sizeof(*divinfo), MB_DONTWAIT); |
| 418 | if (mtag == NULL) { |
| 419 | error = ENOBUFS; |
| 420 | goto cantsend; |
| 421 | } |
| 422 | m_tag_prepend(m, mtag); |
| 423 | |
| 424 | /* Loopback avoidance and state recovery */ |
| 425 | divinfo = m_tag_data(mtag); |
| 426 | if (sin) |
| 427 | divinfo->skipto = sin->sin_port; |
| 428 | else |
| 429 | divinfo->skipto = 0; |
| 430 | |
| 431 | /* Reinject packet into the system as incoming or outgoing */ |
| 432 | if (DIV_IS_OUTPUT(sin)) { |
| 433 | struct ip *const ip = mtod(m, struct ip *); |
| 434 | |
| 435 | /* Don't allow packet length sizes that will crash */ |
| 436 | if ((u_short)ntohs(ip->ip_len) > m->m_pkthdr.len) { |
| 437 | error = EINVAL; |
| 438 | goto cantsend; |
| 439 | } |
| 440 | |
| 441 | /* Convert fields to host order for ip_output() */ |
| 442 | ip->ip_len = ntohs(ip->ip_len); |
| 443 | ip->ip_off = ntohs(ip->ip_off); |
| 444 | |
| 445 | /* Send packet to output processing */ |
| 446 | ipstat.ips_rawout++; /* XXX */ |
| 447 | error = ip_output(m, NULL, NULL, |
| 448 | (so->so_options & SO_DONTROUTE) | |
| 449 | IP_ALLOWBROADCAST | IP_RAWOUTPUT, |
| 450 | NULL, NULL); |
| 451 | } else { |
| 452 | ip_input(m); |
| 453 | } |
| 454 | return error; |
| 455 | |
| 456 | cantsend: |
| 457 | m_freem(m); |
| 458 | return error; |
| 459 | } |
| 460 | |
| 461 | static int |
| 462 | div_attach(struct socket *so, int proto, struct pru_attach_info *ai) |
| 463 | { |
| 464 | struct inpcb *inp; |
| 465 | int error; |
| 466 | |
| 467 | inp = so->so_pcb; |
| 468 | if (inp) |
| 469 | panic("div_attach"); |
| 470 | if ((error = priv_check_cred(ai->p_ucred, PRIV_ROOT, NULL_CRED_OKAY)) != 0) |
| 471 | return error; |
| 472 | |
| 473 | error = soreserve(so, div_sendspace, div_recvspace, ai->sb_rlimit); |
| 474 | if (error) |
| 475 | return error; |
| 476 | error = in_pcballoc(so, &divcbinfo); |
| 477 | if (error) |
| 478 | return error; |
| 479 | inp = (struct inpcb *)so->so_pcb; |
| 480 | inp->inp_ip_p = proto; |
| 481 | inp->inp_vflag |= INP_IPV4; |
| 482 | inp->inp_flags |= INP_HDRINCL; |
| 483 | /* |
| 484 | * The socket is always "connected" because |
| 485 | * we always know "where" to send the packet. |
| 486 | */ |
| 487 | so->so_state |= SS_ISCONNECTED; |
| 488 | return 0; |
| 489 | } |
| 490 | |
| 491 | static int |
| 492 | div_detach(struct socket *so) |
| 493 | { |
| 494 | struct inpcb *inp; |
| 495 | |
| 496 | inp = so->so_pcb; |
| 497 | if (inp == NULL) |
| 498 | panic("div_detach"); |
| 499 | in_pcbdetach(inp); |
| 500 | return 0; |
| 501 | } |
| 502 | |
| 503 | static int |
| 504 | div_abort(struct socket *so) |
| 505 | { |
| 506 | soisdisconnected(so); |
| 507 | return div_detach(so); |
| 508 | } |
| 509 | |
| 510 | static int |
| 511 | div_disconnect(struct socket *so) |
| 512 | { |
| 513 | if (!(so->so_state & SS_ISCONNECTED)) |
| 514 | return ENOTCONN; |
| 515 | return div_abort(so); |
| 516 | } |
| 517 | |
| 518 | static int |
| 519 | div_bind(struct socket *so, struct sockaddr *nam, struct thread *td) |
| 520 | { |
| 521 | int error; |
| 522 | |
| 523 | /* |
| 524 | * in_pcbbind assumes that nam is a sockaddr_in |
| 525 | * and in_pcbbind requires a valid address. Since divert |
| 526 | * sockets don't we need to make sure the address is |
| 527 | * filled in properly. |
| 528 | * XXX -- divert should not be abusing in_pcbind |
| 529 | * and should probably have its own family. |
| 530 | */ |
| 531 | if (nam->sa_family != AF_INET) { |
| 532 | error = EAFNOSUPPORT; |
| 533 | } else { |
| 534 | ((struct sockaddr_in *)nam)->sin_addr.s_addr = INADDR_ANY; |
| 535 | error = in_pcbbind(so->so_pcb, nam, td); |
| 536 | } |
| 537 | return error; |
| 538 | } |
| 539 | |
| 540 | static int |
| 541 | div_shutdown(struct socket *so) |
| 542 | { |
| 543 | socantsendmore(so); |
| 544 | return 0; |
| 545 | } |
| 546 | |
| 547 | static int |
| 548 | div_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam, |
| 549 | struct mbuf *control, struct thread *td) |
| 550 | { |
| 551 | /* Length check already done in ip_mport() */ |
| 552 | KASSERT(m->m_len >= sizeof(struct ip), ("IP header not in one mbuf")); |
| 553 | |
| 554 | /* Send packet */ |
| 555 | return div_output(so, m, (struct sockaddr_in *)nam, control); |
| 556 | } |
| 557 | |
| 558 | SYSCTL_DECL(_net_inet_divert); |
| 559 | SYSCTL_PROC(_net_inet_divert, OID_AUTO, pcblist, CTLFLAG_RD, &divcbinfo, 0, |
| 560 | in_pcblist_global, "S,xinpcb", "List of active divert sockets"); |
| 561 | |
| 562 | struct pr_usrreqs div_usrreqs = { |
| 563 | .pru_abort = div_abort, |
| 564 | .pru_accept = pru_accept_notsupp, |
| 565 | .pru_attach = div_attach, |
| 566 | .pru_bind = div_bind, |
| 567 | .pru_connect = pru_connect_notsupp, |
| 568 | .pru_connect2 = pru_connect2_notsupp, |
| 569 | .pru_control = in_control, |
| 570 | .pru_detach = div_detach, |
| 571 | .pru_disconnect = div_disconnect, |
| 572 | .pru_listen = pru_listen_notsupp, |
| 573 | .pru_peeraddr = in_setpeeraddr, |
| 574 | .pru_rcvd = pru_rcvd_notsupp, |
| 575 | .pru_rcvoob = pru_rcvoob_notsupp, |
| 576 | .pru_send = div_send, |
| 577 | .pru_sense = pru_sense_null, |
| 578 | .pru_shutdown = div_shutdown, |
| 579 | .pru_sockaddr = in_setsockaddr, |
| 580 | .pru_sosend = sosend, |
| 581 | .pru_soreceive = soreceive, |
| 582 | .pru_sopoll = sopoll |
| 583 | }; |
| 584 | |
| 585 | static struct mbuf * |
| 586 | ip_divert_out(struct mbuf *m, int tee) |
| 587 | { |
| 588 | struct mbuf *clone = NULL; |
| 589 | struct ip *ip = mtod(m, struct ip *); |
| 590 | |
| 591 | /* Clone packet if we're doing a 'tee' */ |
| 592 | if (tee) |
| 593 | clone = m_dup(m, MB_DONTWAIT); |
| 594 | |
| 595 | /* |
| 596 | * XXX |
| 597 | * delayed checksums are not currently compatible |
| 598 | * with divert sockets. |
| 599 | */ |
| 600 | if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) { |
| 601 | in_delayed_cksum(m); |
| 602 | m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA; |
| 603 | } |
| 604 | |
| 605 | /* Restore packet header fields to original values */ |
| 606 | ip->ip_len = htons(ip->ip_len); |
| 607 | ip->ip_off = htons(ip->ip_off); |
| 608 | |
| 609 | /* Deliver packet to divert input routine */ |
| 610 | divert_packet(m, 0); |
| 611 | |
| 612 | /* If 'tee', continue with original packet */ |
| 613 | return clone; |
| 614 | } |
| 615 | |
| 616 | static struct mbuf * |
| 617 | ip_divert_in(struct mbuf *m, int tee) |
| 618 | { |
| 619 | struct mbuf *clone = NULL; |
| 620 | struct ip *ip = mtod(m, struct ip *); |
| 621 | struct m_tag *mtag; |
| 622 | |
| 623 | if (ip->ip_off & (IP_MF | IP_OFFMASK)) { |
| 624 | const struct divert_info *divinfo; |
| 625 | u_short frag_off; |
| 626 | int hlen; |
| 627 | |
| 628 | /* |
| 629 | * Only trust divert info in the fragment |
| 630 | * at offset 0. |
| 631 | */ |
| 632 | frag_off = ip->ip_off << 3; |
| 633 | if (frag_off != 0) { |
| 634 | mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL); |
| 635 | m_tag_delete(m, mtag); |
| 636 | } |
| 637 | |
| 638 | /* |
| 639 | * Attempt reassembly; if it succeeds, proceed. |
| 640 | * ip_reass() will return a different mbuf. |
| 641 | */ |
| 642 | m = ip_reass(m); |
| 643 | if (m == NULL) |
| 644 | return NULL; |
| 645 | ip = mtod(m, struct ip *); |
| 646 | |
| 647 | /* Caller need to redispatch the packet, if it is for us */ |
| 648 | m->m_pkthdr.fw_flags |= FW_MBUF_REDISPATCH; |
| 649 | |
| 650 | /* |
| 651 | * Get the header length of the reassembled |
| 652 | * packet |
| 653 | */ |
| 654 | hlen = IP_VHL_HL(ip->ip_vhl) << 2; |
| 655 | |
| 656 | /* |
| 657 | * Restore original checksum before diverting |
| 658 | * packet |
| 659 | */ |
| 660 | ip->ip_len += hlen; |
| 661 | ip->ip_len = htons(ip->ip_len); |
| 662 | ip->ip_off = htons(ip->ip_off); |
| 663 | ip->ip_sum = 0; |
| 664 | if (hlen == sizeof(struct ip)) |
| 665 | ip->ip_sum = in_cksum_hdr(ip); |
| 666 | else |
| 667 | ip->ip_sum = in_cksum(m, hlen); |
| 668 | ip->ip_off = ntohs(ip->ip_off); |
| 669 | ip->ip_len = ntohs(ip->ip_len); |
| 670 | |
| 671 | /* |
| 672 | * Only use the saved divert info |
| 673 | */ |
| 674 | mtag = m_tag_find(m, PACKET_TAG_IPFW_DIVERT, NULL); |
| 675 | if (mtag == NULL) { |
| 676 | /* Wrongly configured ipfw */ |
| 677 | kprintf("ip_input no divert info\n"); |
| 678 | m_freem(m); |
| 679 | return NULL; |
| 680 | } |
| 681 | divinfo = m_tag_data(mtag); |
| 682 | tee = divinfo->tee; |
| 683 | } |
| 684 | |
| 685 | /* |
| 686 | * Divert or tee packet to the divert protocol if |
| 687 | * required. |
| 688 | */ |
| 689 | |
| 690 | /* Clone packet if we're doing a 'tee' */ |
| 691 | if (tee) |
| 692 | clone = m_dup(m, MB_DONTWAIT); |
| 693 | |
| 694 | /* |
| 695 | * Restore packet header fields to original |
| 696 | * values |
| 697 | */ |
| 698 | ip->ip_len = htons(ip->ip_len); |
| 699 | ip->ip_off = htons(ip->ip_off); |
| 700 | |
| 701 | /* Deliver packet to divert input routine */ |
| 702 | divert_packet(m, 1); |
| 703 | |
| 704 | /* Catch invalid reference */ |
| 705 | m = NULL; |
| 706 | ip = NULL; |
| 707 | |
| 708 | ipstat.ips_delivered++; |
| 709 | |
| 710 | /* If 'tee', continue with original packet */ |
| 711 | if (clone != NULL) { |
| 712 | /* |
| 713 | * Complete processing of the packet. |
| 714 | * XXX Better safe than sorry, remove the DIVERT tag. |
| 715 | */ |
| 716 | mtag = m_tag_find(clone, PACKET_TAG_IPFW_DIVERT, NULL); |
| 717 | KKASSERT(mtag != NULL); |
| 718 | m_tag_delete(clone, mtag); |
| 719 | } |
| 720 | return clone; |
| 721 | } |
| 722 | |
| 723 | static struct mbuf * |
| 724 | ip_divert(struct mbuf *m, int tee, int incoming) |
| 725 | { |
| 726 | struct mbuf *ret; |
| 727 | |
| 728 | if (incoming) |
| 729 | ret = ip_divert_in(m, tee); |
| 730 | else |
| 731 | ret = ip_divert_out(m, tee); |
| 732 | return ret; |
| 733 | } |