2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * $FreeBSD: src/sys/netinet/ip_divert.c,v 1.42.2.6 2003/01/23 21:06:45 sam Exp $
35 #include "opt_ipdivert.h"
38 #error "IPDIVERT requires INET."
41 #include <sys/param.h>
42 #include <sys/kernel.h>
43 #include <sys/malloc.h>
45 #include <sys/socket.h>
46 #include <sys/protosw.h>
47 #include <sys/socketvar.h>
48 #include <sys/socketvar2.h>
49 #include <sys/sysctl.h>
50 #include <sys/systm.h>
53 #include <sys/in_cksum.h>
55 #include <sys/msgport.h>
58 #include <net/route.h>
60 #include <net/netmsg2.h>
61 #include <net/netisr2.h>
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/ip.h>
66 #include <netinet/in_pcb.h>
67 #include <netinet/in_var.h>
68 #include <netinet/ip_var.h>
69 #include <netinet/ip_divert.h>
76 * Allocate enough space to hold a full IP packet
78 #define DIVSNDQ (65536 + 100)
79 #define DIVRCVQ (65536 + 100)
81 #define DIV_IS_OUTPUT(sin) ((sin) == NULL || (sin)->sin_addr.s_addr == 0)
83 #define DIV_OUTPUT 0x10000
84 #define DIV_INPUT 0x20000
87 * Divert sockets work in conjunction with ipfw, see the divert(4)
88 * manpage for features.
89 * Internally, packets selected by ipfw in ip_input() or ip_output(),
90 * and never diverted before, are passed to the input queue of the
91 * divert socket with a given 'divert_port' number (as specified in
92 * the matching ipfw rule), and they are tagged with a 16 bit cookie
93 * (representing the rule number of the matching ipfw rule), which
94 * is passed to process reading from the socket.
96 * Packets written to the divert socket are again tagged with a cookie
97 * (usually the same as above) and a destination address.
98 * If the destination address is INADDR_ANY then the packet is
99 * treated as outgoing and sent to ip_output(), otherwise it is
100 * treated as incoming and sent to ip_input().
101 * In both cases, the packet is tagged with the cookie.
103 * On reinjection, processing in ip_input() and ip_output()
104 * will be exactly the same as for the original packet, except that
105 * ipfw processing will start at the rule number after the one
106 * written in the cookie (so, tagging a packet with a cookie of 0
107 * will cause it to be effectively considered as a standard packet).
110 /* Internal variables */
111 static struct inpcbinfo divcbinfo
;
112 static struct inpcbportinfo divcbportinfo
;
114 static u_long div_sendspace
= DIVSNDQ
; /* XXX sysctl ? */
115 static u_long div_recvspace
= DIVRCVQ
; /* XXX sysctl ? */
117 static struct mbuf
*ip_divert(struct mbuf
*, int, int);
120 * Initialize divert connection block queue.
125 in_pcbinfo_init(&divcbinfo
, 0, FALSE
);
126 in_pcbportinfo_init(&divcbportinfo
, 1, 0);
128 * XXX We don't use the hash list for divert IP, but it's easier
129 * to allocate a one entry hash list than it is to check all
130 * over the place for hashbase == NULL.
132 divcbinfo
.hashbase
= hashinit(1, M_PCB
, &divcbinfo
.hashmask
);
133 in_pcbportinfo_set(&divcbinfo
, &divcbportinfo
, 1);
134 divcbinfo
.wildcardhashbase
= hashinit(1, M_PCB
,
135 &divcbinfo
.wildcardhashmask
);
136 divcbinfo
.ipi_size
= sizeof(struct inpcb
);
137 ip_divert_p
= ip_divert
;
141 * IPPROTO_DIVERT is not a real IP protocol; don't allow any packets
142 * with that protocol number to enter the system from the outside.
145 div_input(struct mbuf
**mp
, int *offp
, int proto
)
147 struct mbuf
*m
= *mp
;
149 ipstat
.ips_noproto
++;
151 return(IPPROTO_DONE
);
155 * Divert a packet by passing it up to the divert socket at port 'port'.
157 * Setup generic address and protocol structures for div_input routine,
158 * then pass them along with mbuf chain.
161 div_packet(struct mbuf
*m
, int incoming
, int port
)
163 struct sockaddr_in divsrc
= { sizeof divsrc
, AF_INET
};
167 struct divert_info
*divinfo
;
172 /* Locate the divert info */
173 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
174 divinfo
= m_tag_data(mtag
);
175 divsrc
.sin_port
= divinfo
->skipto
;
178 * Record receive interface address, if any.
179 * But only for incoming packets.
181 divsrc
.sin_addr
.s_addr
= 0;
183 struct ifaddr_container
*ifac
;
185 /* Find IP address for receive interface */
186 TAILQ_FOREACH(ifac
, &m
->m_pkthdr
.rcvif
->if_addrheads
[mycpuid
],
188 struct ifaddr
*ifa
= ifac
->ifa
;
190 if (ifa
->ifa_addr
== NULL
)
192 if (ifa
->ifa_addr
->sa_family
!= AF_INET
)
195 ((struct sockaddr_in
*) ifa
->ifa_addr
)->sin_addr
;
200 * Record the incoming interface name whenever we have one.
202 if (m
->m_pkthdr
.rcvif
) {
204 * Hide the actual interface name in there in the
205 * sin_zero array. XXX This needs to be moved to a
206 * different sockaddr type for divert, e.g.
207 * sockaddr_div with multiple fields like
208 * sockaddr_dl. Presently we have only 7 bytes
209 * but that will do for now as most interfaces
210 * are 4 or less + 2 or less bytes for unit.
211 * There is probably a faster way of doing this,
212 * possibly taking it from the sockaddr_dl on the iface.
213 * This solves the problem of a P2P link and a LAN interface
214 * having the same address, which can result in the wrong
215 * interface being assigned to the packet when fed back
216 * into the divert socket. Theoretically if the daemon saves
217 * and re-uses the sockaddr_in as suggested in the man pages,
218 * this iface name will come along for the ride.
219 * (see div_output for the other half of this.)
221 ksnprintf(divsrc
.sin_zero
, sizeof divsrc
.sin_zero
, "%s",
222 m
->m_pkthdr
.rcvif
->if_xname
);
225 /* Put packet on socket queue, if any */
227 nport
= htons((u_int16_t
)port
);
230 * Following loop to locate the inpcb is MPSAFE since the inpcb
231 * insertion/removal happens on the same CPU (CPU0).
233 LIST_FOREACH(inp
, &divcbinfo
.pcblisthead
, inp_list
) {
234 if (inp
->inp_flags
& INP_PLACEMARKER
)
236 if (inp
->inp_lport
== nport
)
237 sa
= inp
->inp_socket
;
240 lwkt_gettoken(&sa
->so_rcv
.ssb_token
);
241 if (ssb_appendaddr(&sa
->so_rcv
, (struct sockaddr
*)&divsrc
, m
, NULL
) == 0) {
246 lwkt_reltoken(&sa
->so_rcv
.ssb_token
);
249 ipstat
.ips_noproto
++;
250 ipstat
.ips_delivered
--;
255 div_packet_handler(netmsg_t msg
)
258 int port
, incoming
= 0;
260 m
= msg
->packet
.nm_packet
;
262 port
= msg
->lmsg
.u
.ms_result32
& 0xffff;
263 if (msg
->lmsg
.u
.ms_result32
& DIV_INPUT
)
265 div_packet(m
, incoming
, port
);
266 /* no reply, msg embedded in mbuf */
270 divert_packet(struct mbuf
*m
, int incoming
)
273 struct divert_info
*divinfo
;
279 if (m
->m_len
< sizeof(struct ip
) &&
280 (m
= m_pullup(m
, sizeof(struct ip
))) == NULL
)
283 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
284 KASSERT(mtag
!= NULL
, ("%s no divert tag!", __func__
));
285 divinfo
= m_tag_data(mtag
);
287 port
= divinfo
->port
;
288 KASSERT(port
!= 0, ("%s: port=0", __func__
));
291 struct netmsg_packet
*nmp
;
293 nmp
= &m
->m_hdr
.mh_netmsg
;
294 netmsg_init(&nmp
->base
, NULL
, &netisr_apanic_rport
,
295 0, div_packet_handler
);
298 nmp
->base
.lmsg
.u
.ms_result32
= port
; /* port is 16bits */
300 nmp
->base
.lmsg
.u
.ms_result32
|= DIV_INPUT
;
302 nmp
->base
.lmsg
.u
.ms_result32
|= DIV_OUTPUT
;
304 lwkt_sendmsg(netisr_cpuport(0), &nmp
->base
.lmsg
);
306 div_packet(m
, incoming
, port
);
311 * Deliver packet back into the IP processing machinery.
313 * If no address specified, or address is 0.0.0.0, send to ip_output();
314 * otherwise, send to ip_input() and mark as having been received on
315 * the interface with that address.
318 div_output(struct socket
*so
, struct mbuf
*m
,
319 struct sockaddr_in
*sin
, struct mbuf
*control
)
323 struct divert_info
*divinfo
;
328 m_freem(control
); /* XXX */
331 * Prepare the tag for divert info. Note that a packet
332 * with a 0 tag in mh_data is effectively untagged,
333 * so we could optimize that case.
335 mtag
= m_tag_get(PACKET_TAG_IPFW_DIVERT
, sizeof(*divinfo
), M_NOWAIT
);
340 m_tag_prepend(m
, mtag
);
342 /* Loopback avoidance and state recovery */
343 divinfo
= m_tag_data(mtag
);
345 divinfo
->skipto
= sin
->sin_port
;
349 /* Reinject packet into the system as incoming or outgoing */
350 if (DIV_IS_OUTPUT(sin
)) {
351 struct ip
*const ip
= mtod(m
, struct ip
*);
353 /* Don't allow packet length sizes that will crash */
354 if ((u_short
)ntohs(ip
->ip_len
) > m
->m_pkthdr
.len
) {
359 /* Send packet to output processing */
360 ipstat
.ips_rawout
++; /* XXX */
361 error
= ip_output(m
, NULL
, NULL
,
362 (so
->so_options
& SO_DONTROUTE
) |
363 IP_ALLOWBROADCAST
| IP_RAWOUTPUT
,
376 div_attach(netmsg_t msg
)
378 struct socket
*so
= msg
->attach
.base
.nm_so
;
379 int proto
= msg
->attach
.nm_proto
;
380 struct pru_attach_info
*ai
= msg
->attach
.nm_ai
;
389 error
= caps_priv_check(ai
->p_ucred
, SYSCAP_RESTRICTEDROOT
|
394 error
= soreserve(so
, div_sendspace
, div_recvspace
, ai
->sb_rlimit
);
397 error
= in_pcballoc(so
, &divcbinfo
);
400 inp
= (struct inpcb
*)so
->so_pcb
;
401 inp
->inp_ip_p
= proto
;
402 inp
->inp_flags
|= INP_HDRINCL
;
404 * The socket is always "connected" because
405 * we always know "where" to send the packet.
407 sosetstate(so
, SS_ISCONNECTED
);
410 lwkt_replymsg(&msg
->attach
.base
.lmsg
, error
);
414 div_detach(netmsg_t msg
)
416 struct socket
*so
= msg
->detach
.base
.nm_so
;
425 lwkt_replymsg(&msg
->detach
.base
.lmsg
, 0);
429 div_abort(netmsg_t msg
)
432 * Divert socket does not support listen(2),
433 * so this should never be called.
435 panic("div_abort is called");
439 div_disconnect(netmsg_t msg
)
441 struct socket
*so
= msg
->disconnect
.base
.nm_so
;
446 if (so
->so_state
& SS_ISCONNECTED
) {
447 soisdisconnected(so
);
452 lwkt_replymsg(&msg
->disconnect
.base
.lmsg
, error
);
456 div_bind(netmsg_t msg
)
458 struct socket
*so
= msg
->bind
.base
.nm_so
;
459 struct sockaddr
*nam
= msg
->bind
.nm_nam
;
465 * in_pcbbind assumes that nam is a sockaddr_in
466 * and in_pcbbind requires a valid address. Since divert
467 * sockets don't we need to make sure the address is
468 * filled in properly.
469 * XXX -- divert should not be abusing in_pcbind
470 * and should probably have its own family.
472 if (nam
->sa_family
!= AF_INET
) {
473 error
= EAFNOSUPPORT
;
475 ((struct sockaddr_in
*)nam
)->sin_addr
.s_addr
= INADDR_ANY
;
476 error
= in_pcbbind(so
->so_pcb
, nam
, msg
->bind
.nm_td
);
478 lwkt_replymsg(&msg
->bind
.base
.lmsg
, error
);
482 div_shutdown(netmsg_t msg
)
484 struct socket
*so
= msg
->shutdown
.base
.nm_so
;
490 lwkt_replymsg(&msg
->shutdown
.base
.lmsg
, 0);
494 div_send(netmsg_t msg
)
496 struct socket
*so
= msg
->send
.base
.nm_so
;
497 struct mbuf
*m
= msg
->send
.nm_m
;
498 struct sockaddr
*nam
= msg
->send
.nm_addr
;
499 struct mbuf
*control
= msg
->send
.nm_control
;
502 /* Length check already done in ip_hashfn() */
503 KASSERT(m
->m_len
>= sizeof(struct ip
), ("IP header not in one mbuf"));
506 error
= div_output(so
, m
, (struct sockaddr_in
*)nam
, control
);
507 lwkt_replymsg(&msg
->send
.base
.lmsg
, error
);
510 SYSCTL_DECL(_net_inet_divert
);
511 SYSCTL_PROC(_net_inet_divert
, OID_AUTO
, pcblist
, CTLFLAG_RD
, &divcbinfo
, 1,
512 in_pcblist_range
, "S,xinpcb", "List of active divert sockets");
514 struct pr_usrreqs div_usrreqs
= {
515 .pru_abort
= div_abort
,
516 .pru_accept
= pr_generic_notsupp
,
517 .pru_attach
= div_attach
,
518 .pru_bind
= div_bind
,
519 .pru_connect
= pr_generic_notsupp
,
520 .pru_connect2
= pr_generic_notsupp
,
521 .pru_control
= in_control_dispatch
,
522 .pru_detach
= div_detach
,
523 .pru_disconnect
= div_disconnect
,
524 .pru_listen
= pr_generic_notsupp
,
525 .pru_peeraddr
= in_setpeeraddr_dispatch
,
526 .pru_rcvd
= pr_generic_notsupp
,
527 .pru_rcvoob
= pr_generic_notsupp
,
528 .pru_send
= div_send
,
529 .pru_sense
= pru_sense_null
,
530 .pru_shutdown
= div_shutdown
,
531 .pru_sockaddr
= in_setsockaddr_dispatch
,
532 .pru_sosend
= sosend
,
533 .pru_soreceive
= soreceive
537 ip_divert_out(struct mbuf
*m
, int tee
)
539 struct mbuf
*clone
= NULL
;
540 //struct ip *ip = mtod(m, struct ip *);
542 /* Clone packet if we're doing a 'tee' */
544 clone
= m_dup(m
, M_NOWAIT
);
548 * delayed checksums are not currently compatible
549 * with divert sockets.
551 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
553 m
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
556 /* Deliver packet to divert input routine */
559 /* If 'tee', continue with original packet */
564 ip_divert_in(struct mbuf
*m
, int tee
)
566 struct mbuf
*clone
= NULL
;
567 struct ip
*ip
= mtod(m
, struct ip
*);
570 if (ip
->ip_off
& htons(IP_MF
| IP_OFFMASK
)) {
571 const struct divert_info
*divinfo
;
576 * Only trust divert info in the fragment
579 frag_off
= ntohs(ip
->ip_off
) << 3;
581 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
582 m_tag_delete(m
, mtag
);
586 * Attempt reassembly; if it succeeds, proceed.
587 * ip_reass() will return a different mbuf.
592 ip
= mtod(m
, struct ip
*);
594 /* Caller need to redispatch the packet, if it is for us */
595 m
->m_pkthdr
.fw_flags
|= FW_MBUF_REDISPATCH
;
598 * Get the header length of the reassembled
601 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
604 * Restore original checksum before diverting
607 ip
->ip_len
= htons(ntohs(ip
->ip_len
) + hlen
);
609 if (hlen
== sizeof(struct ip
))
610 ip
->ip_sum
= in_cksum_hdr(ip
);
612 ip
->ip_sum
= in_cksum(m
, hlen
);
615 * Only use the saved divert info
617 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
619 /* Wrongly configured ipfw */
620 kprintf("ip_input no divert info\n");
624 divinfo
= m_tag_data(mtag
);
629 * Divert or tee packet to the divert protocol if
633 /* Clone packet if we're doing a 'tee' */
635 clone
= m_dup(m
, M_NOWAIT
);
637 /* Deliver packet to divert input routine */
640 /* Catch invalid reference */
644 ipstat
.ips_delivered
++;
646 /* If 'tee', continue with original packet */
649 * Complete processing of the packet.
650 * XXX Better safe than sorry, remove the DIVERT tag.
652 mtag
= m_tag_find(clone
, PACKET_TAG_IPFW_DIVERT
, NULL
);
653 KKASSERT(mtag
!= NULL
);
654 m_tag_delete(clone
, mtag
);
660 ip_divert(struct mbuf
*m
, int tee
, int incoming
)
665 ret
= ip_divert_in(m
, tee
);
667 ret
= ip_divert_out(m
, tee
);