Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/netinet/ip_divert.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /* 2 * Copyright (c) 1982, 1986, 1988, 1993 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 * 33 * $FreeBSD: src/sys/netinet/ip_divert.c,v 1.1.2.15 1999/09/05 08:18:25 peter Exp $ 34 */ 35 36 #include "opt_ipfw.h" 37 38 #ifndef INET 39 #error "IPDIVERT requires INET." 40 #endif 41 42 #include <sys/param.h> 43 #include <sys/queue.h> 44 #include <sys/malloc.h> 45 #include <sys/mbuf.h> 46 #include <sys/socket.h> 47 #include <sys/protosw.h> 48 #include <sys/socketvar.h> 49 #include <sys/errno.h> 50 #include <sys/systm.h> 51 52 #include <net/if.h> 53 #include <net/route.h> 54 55 #include <netinet/in.h> 56 #include <netinet/in_systm.h> 57 #include <netinet/ip.h> 58 #include <netinet/in_pcb.h> 59 #include <netinet/in_var.h> 60 #include <netinet/ip_var.h> 61 62 /* 63 * Divert sockets 64 */ 65 66 /* 67 * Allocate enough space to hold a full IP packet 68 */ 69 #define DIVSNDQ (65536 + 100) 70 #define DIVRCVQ (65536 + 100) 71 72 /* Global variables */ 73 74 /* 75 * ip_input() and ip_output() set this secret value before calling us to 76 * let us know which divert port to divert a packet to; this is done so 77 * we can use the existing prototype for struct protosw's pr_input(). 78 * This is stored in host order. 79 */ 80 u_short ip_divert_port; 81 82 /* 83 * #ifndef IPFW_DIVERT_RESTART 84 * We set this value to a non-zero port number when we want the call to 85 * ip_fw_chk() in ip_input() or ip_output() to ignore ``divert <port>'' 86 * chain entries. This is stored in host order. 87 * #else 88 * A 16 bit cookie is passed to the user process. 89 * The user process can send it back to help the caller know something 90 * about where the packet came from. 91 * 92 * If IPFW is the caller then the IN cookie is the rule that sent 93 * us here and the OUT cookie is the rule after which processing 94 * should continue. Leaving it the same will make processing start 95 * at the rule number after that which sent it here. Setting it to 96 * 0 will restart processing at the beginning. 97 * #endif 98 */ 99 u_short ip_divert_cookie; 100 101 /* Internal variables */ 102 103 static struct inpcbhead divcb; 104 static struct inpcbinfo divcbinfo; 105 106 static u_long div_sendspace = DIVSNDQ; /* XXX sysctl ? */ 107 static u_long div_recvspace = DIVRCVQ; /* XXX sysctl ? */ 108 109 /* Optimization: have this preinitialized */ 110 static struct sockaddr_in divsrc = { sizeof(divsrc), AF_INET }; 111 112 /* Internal functions */ 113 114 static int div_output(struct socket *so, 115 struct mbuf *m, struct mbuf *addr, struct mbuf *control); 116 117 /* 118 * Initialize divert connection block queue. 119 */ 120 void 121 div_init(void) 122 { 123 LIST_INIT(&divcb); 124 divcbinfo.listhead = &divcb; 125 /* 126 * XXX We don't use the hash list for divert IP, but it's easier 127 * to allocate a one entry hash list than it is to check all 128 * over the place for hashbase == NULL. 129 */ 130 divcbinfo.hashbase = hashinit(1, M_PCB, &divcbinfo.hashmask); 131 } 132 133 /* 134 * Setup generic address and protocol structures 135 * for div_input routine, then pass them along with 136 * mbuf chain. ip->ip_len is assumed to have had 137 * the header length (hlen) subtracted out already. 138 * We tell whether the packet was incoming or outgoing 139 * by seeing if hlen == 0, which is a hack. 140 */ 141 void 142 div_input(struct mbuf *m, int hlen) 143 { 144 struct ip *ip; 145 struct inpcb *inp; 146 struct socket *sa; 147 148 /* Sanity check */ 149 if (ip_divert_port == 0) 150 panic("div_input: port is 0"); 151 152 /* Assure header */ 153 if (m->m_len < sizeof(struct ip) && 154 (m = m_pullup(m, sizeof(struct ip))) == 0) { 155 return; 156 } 157 ip = mtod(m, struct ip *); 158 159 /* Record divert cookie */ 160 divsrc.sin_port = ip_divert_cookie; 161 ip_divert_cookie = 0; 162 163 /* Restore packet header fields */ 164 ip->ip_len += hlen; 165 HTONS(ip->ip_len); 166 HTONS(ip->ip_off); 167 168 /* 169 * Record receive interface address, if any 170 * But only for incoming packets. 171 */ 172 divsrc.sin_addr.s_addr = 0; 173 if (hlen) { 174 struct ifaddr *ifa; 175 176 #ifdef DIAGNOSTIC 177 /* Sanity check */ 178 if (!(m->m_flags & M_PKTHDR)) 179 panic("div_input: no pkt hdr"); 180 #endif 181 182 /* More fields affected by ip_input() */ 183 HTONS(ip->ip_id); 184 185 /* Find IP address for recieve interface */ 186 for (ifa = m->m_pkthdr.rcvif->if_addrlist; 187 ifa != NULL; ifa = ifa->ifa_next) { 188 if (ifa->ifa_addr == NULL) 189 continue; 190 if (ifa->ifa_addr->sa_family != AF_INET) 191 continue; 192 divsrc.sin_addr = 193 ((struct sockaddr_in *) ifa->ifa_addr)->sin_addr; 194 break; 195 } 196 } 197 /* 198 * Record the incoming interface name whenever we have one. 199 */ 200 if (m->m_pkthdr.rcvif) { 201 char name[32]; 202 203 /* 204 * Hide the actual interface name in there in the 205 * sin_zero array. XXX This needs to be moved to a 206 * different sockaddr type for divert, e.g. 207 * sockaddr_div with multiple fields like 208 * sockaddr_dl. Presently we have only 7 bytes 209 * but that will do for now as most interfaces 210 * are 4 or less + 2 or less bytes for unit. 211 * There is probably a faster way of doing this, 212 * possibly taking it from the sockaddr_dl on the iface. 213 * This solves the problem of a P2P link and a LAN interface 214 * having the same address, which can result in the wrong 215 * interface being assigned to the packet when fed back 216 * into the divert socket. Theoretically if the daemon saves 217 * and re-uses the sockaddr_in as suggested in the man pages, 218 * this iface name will come along for the ride. 219 * (see div_output for the other half of this.) 220 */ 221 sprintf(name, "%s%d", 222 m->m_pkthdr.rcvif->if_name, m->m_pkthdr.rcvif->if_unit); 223 strncpy(divsrc.sin_zero, name, 7); 224 } 225 226 /* Put packet on socket queue, if any */ 227 sa = NULL; 228 for (inp = divcb.lh_first; inp != NULL; inp = inp->inp_list.le_next) { 229 if (inp->inp_lport == htons(ip_divert_port)) 230 sa = inp->inp_socket; 231 } 232 ip_divert_port = 0; 233 if (sa) { 234 if (sbappendaddr(&sa->so_rcv, (struct sockaddr *)&divsrc, 235 m, (struct mbuf *)0) == 0) 236 m_freem(m); 237 else 238 sorwakeup(sa); 239 } else { 240 m_freem(m); 241 ipstat.ips_noproto++; 242 ipstat.ips_delivered--; 243 } 244 } 245 246 /* 247 * Deliver packet back into the IP processing machinery. 248 * 249 * If no address specified, or address is 0.0.0.0, send to ip_output(); 250 * otherwise, send to ip_input() and mark as having been received on 251 * the interface with that address. 252 * 253 * If no address specified, or dest port is 0, allow packet to divert 254 * back to this socket; otherwise, don't. 255 */ 256 static int 257 div_output(so, m, addr, control) 258 struct socket *so; 259 register struct mbuf *m; 260 struct mbuf *addr, *control; 261 { 262 register struct inpcb *const inp = sotoinpcb(so); 263 register struct ip *const ip = mtod(m, struct ip *); 264 struct sockaddr_in *sin = NULL; 265 int error = 0; 266 267 if (control) 268 m_freem(control); /* XXX */ 269 if (addr) 270 sin = mtod(addr, struct sockaddr_in *); 271 272 /* Loopback avoidance */ 273 if (sin) { 274 int len = 0; 275 char *c = sin->sin_zero; 276 277 ip_divert_cookie = sin->sin_port; 278 279 /* 280 * Find receive interface with the given name or IP address. 281 * The name is user supplied data so don't trust it's size or 282 * that it is zero terminated. The name has priority. 283 * We are presently assuming that the sockaddr_in 284 * has not been replaced by a sockaddr_div, so we limit it 285 * to 16 bytes in total. the name is stuffed (if it exists) 286 * in the sin_zero[] field. 287 */ 288 while (*c++ && (len++ < sizeof(sin->sin_zero))); 289 if ((len > 0) && (len < sizeof(sin->sin_zero))) 290 m->m_pkthdr.rcvif = ifunit(sin->sin_zero); 291 } else { 292 ip_divert_cookie = 0; 293 } 294 295 /* Reinject packet into the system as incoming or outgoing */ 296 if (!sin || sin->sin_addr.s_addr == 0) { 297 /* 298 * Don't allow both user specified and setsockopt options, 299 * and don't allow packet length sizes that will crash 300 */ 301 if (((ip->ip_hl != (sizeof (*ip) >> 2)) && inp->inp_options) || 302 ((u_short)ntohs(ip->ip_len) > m->m_pkthdr.len)) { 303 error = EINVAL; 304 goto cantsend; 305 } 306 307 /* Convert fields to host order for ip_output() */ 308 NTOHS(ip->ip_len); 309 NTOHS(ip->ip_off); 310 311 /* Send packet to output processing */ 312 ipstat.ips_rawout++; /* XXX */ 313 error = ip_output(m, inp->inp_options, &inp->inp_route, 314 (so->so_options & SO_DONTROUTE) | 315 IP_ALLOWBROADCAST | IP_RAWOUTPUT, inp->inp_moptions); 316 } else { 317 struct ifaddr *ifa; 318 319 /* If no luck with the name above, check by IP address. */ 320 if (m->m_pkthdr.rcvif == NULL) { 321 /* 322 * Make sure there are no distractions 323 * for ifa_ifwithaddr. Clear the port and the ifname. 324 */ 325 bzero(sin->sin_zero, sizeof(sin->sin_zero)); 326 sin->sin_port = 0; 327 if (!(ifa = ifa_ifwithaddr((struct sockaddr *) sin))) { 328 error = EADDRNOTAVAIL; 329 goto cantsend; 330 } 331 m->m_pkthdr.rcvif = ifa->ifa_ifp; 332 } 333 334 /* Send packet to input processing */ 335 ip_input(m); 336 } 337 338 /* Reset for next time (and other packets) */ 339 ip_divert_cookie = 0; 340 return error; 341 342 cantsend: 343 ip_divert_cookie = 0; 344 m_freem(m); 345 return error; 346 } 347 348 /*ARGSUSED*/ 349 int 350 div_usrreq(so, req, m, nam, control) 351 register struct socket *so; 352 int req; 353 struct mbuf *m, *nam, *control; 354 { 355 register int error = 0; 356 register struct inpcb *inp = sotoinpcb(so); 357 int s; 358 359 if (inp == NULL && req != PRU_ATTACH) { 360 error = EINVAL; 361 goto release; 362 } 363 switch (req) { 364 365 case PRU_ATTACH: 366 if (inp) 367 panic("div_attach"); 368 if ((so->so_state & SS_PRIV) == 0) { 369 error = EACCES; 370 break; 371 } 372 s = splnet(); 373 error = in_pcballoc(so, &divcbinfo); 374 splx(s); 375 if (error) 376 break; 377 error = soreserve(so, div_sendspace, div_recvspace); 378 if (error) 379 break; 380 inp = (struct inpcb *)so->so_pcb; 381 inp->inp_ip_p = (int)nam; /* XXX */ 382 inp->inp_flags |= INP_HDRINCL; 383 /* The socket is always "connected" because 384 we always know "where" to send the packet */ 385 so->so_state |= SS_ISCONNECTED; 386 break; 387 388 case PRU_DISCONNECT: 389 if ((so->so_state & SS_ISCONNECTED) == 0) { 390 error = ENOTCONN; 391 break; 392 } 393 /* FALLTHROUGH */ 394 case PRU_ABORT: 395 soisdisconnected(so); 396 /* FALLTHROUGH */ 397 case PRU_DETACH: 398 if (inp == 0) 399 panic("div_detach"); 400 in_pcbdetach(inp); 401 break; 402 403 case PRU_BIND: 404 s = splnet(); 405 error = in_pcbbind(inp, nam); 406 splx(s); 407 break; 408 409 /* 410 * Mark the connection as being incapable of further input. 411 */ 412 case PRU_SHUTDOWN: 413 socantsendmore(so); 414 break; 415 416 case PRU_SEND: 417 /* Packet must have a header (but that's about it) */ 418 if (m->m_len < sizeof (struct ip) || 419 (m = m_pullup(m, sizeof (struct ip))) == 0) { 420 ipstat.ips_toosmall++; 421 error = EINVAL; 422 break; 423 } 424 425 /* Send packet */ 426 error = div_output(so, m, nam, control); 427 m = NULL; 428 break; 429 430 case PRU_SOCKADDR: 431 in_setsockaddr(inp, nam); 432 break; 433 434 case PRU_SENSE: 435 /* 436 * stat: don't bother with a blocksize. 437 */ 438 return (0); 439 440 /* 441 * Not supported. 442 */ 443 case PRU_CONNECT: 444 case PRU_CONNECT2: 445 case PRU_CONTROL: 446 case PRU_RCVOOB: 447 case PRU_RCVD: 448 case PRU_LISTEN: 449 case PRU_ACCEPT: 450 case PRU_SENDOOB: 451 case PRU_PEERADDR: 452 error = EOPNOTSUPP; 453 break; 454 455 default: 456 panic("div_usrreq"); 457 } 458 release: 459 if (m) 460 m_freem(m); 461 return (error); 462 }
Cache object: 02e57e15fd00aef7db6907c0a78b0a74
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]