2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * $FreeBSD: src/sys/netinet/ip_divert.c,v 1.42.2.6 2003/01/23 21:06:45 sam Exp $
35 #include "opt_ipdivert.h"
38 #error "IPDIVERT requires INET."
41 #include <sys/param.h>
42 #include <sys/kernel.h>
43 #include <sys/malloc.h>
45 #include <sys/socket.h>
46 #include <sys/protosw.h>
47 #include <sys/socketvar.h>
48 #include <sys/socketvar2.h>
49 #include <sys/sysctl.h>
50 #include <sys/systm.h>
53 #include <sys/in_cksum.h>
55 #include <sys/msgport.h>
58 #include <net/route.h>
60 #include <net/netmsg2.h>
61 #include <net/netisr2.h>
62 #include <sys/thread2.h>
63 #include <sys/mplock2.h>
65 #include <netinet/in.h>
66 #include <netinet/in_systm.h>
67 #include <netinet/ip.h>
68 #include <netinet/in_pcb.h>
69 #include <netinet/in_var.h>
70 #include <netinet/ip_var.h>
71 #include <netinet/ip_divert.h>
78 * Allocate enough space to hold a full IP packet
80 #define DIVSNDQ (65536 + 100)
81 #define DIVRCVQ (65536 + 100)
83 #define DIV_IS_OUTPUT(sin) ((sin) == NULL || (sin)->sin_addr.s_addr == 0)
85 #define DIV_OUTPUT 0x10000
86 #define DIV_INPUT 0x20000
89 * Divert sockets work in conjunction with ipfw, see the divert(4)
90 * manpage for features.
91 * Internally, packets selected by ipfw in ip_input() or ip_output(),
92 * and never diverted before, are passed to the input queue of the
93 * divert socket with a given 'divert_port' number (as specified in
94 * the matching ipfw rule), and they are tagged with a 16 bit cookie
95 * (representing the rule number of the matching ipfw rule), which
96 * is passed to process reading from the socket.
98 * Packets written to the divert socket are again tagged with a cookie
99 * (usually the same as above) and a destination address.
100 * If the destination address is INADDR_ANY then the packet is
101 * treated as outgoing and sent to ip_output(), otherwise it is
102 * treated as incoming and sent to ip_input().
103 * In both cases, the packet is tagged with the cookie.
105 * On reinjection, processing in ip_input() and ip_output()
106 * will be exactly the same as for the original packet, except that
107 * ipfw processing will start at the rule number after the one
108 * written in the cookie (so, tagging a packet with a cookie of 0
109 * will cause it to be effectively considered as a standard packet).
112 /* Internal variables */
113 static struct inpcbinfo divcbinfo
;
114 static struct inpcbportinfo divcbportinfo
;
116 static u_long div_sendspace
= DIVSNDQ
; /* XXX sysctl ? */
117 static u_long div_recvspace
= DIVRCVQ
; /* XXX sysctl ? */
119 static struct mbuf
*ip_divert(struct mbuf
*, int, int);
122 * Initialize divert connection block queue.
127 in_pcbinfo_init(&divcbinfo
, 0, FALSE
);
128 in_pcbportinfo_init(&divcbportinfo
, 1, 0);
130 * XXX We don't use the hash list for divert IP, but it's easier
131 * to allocate a one entry hash list than it is to check all
132 * over the place for hashbase == NULL.
134 divcbinfo
.hashbase
= hashinit(1, M_PCB
, &divcbinfo
.hashmask
);
135 in_pcbportinfo_set(&divcbinfo
, &divcbportinfo
, 1);
136 divcbinfo
.wildcardhashbase
= hashinit(1, M_PCB
,
137 &divcbinfo
.wildcardhashmask
);
138 divcbinfo
.ipi_size
= sizeof(struct inpcb
);
139 ip_divert_p
= ip_divert
;
143 * IPPROTO_DIVERT is not a real IP protocol; don't allow any packets
144 * with that protocol number to enter the system from the outside.
147 div_input(struct mbuf
**mp
, int *offp
, int proto
)
149 struct mbuf
*m
= *mp
;
151 ipstat
.ips_noproto
++;
153 return(IPPROTO_DONE
);
157 * Divert a packet by passing it up to the divert socket at port 'port'.
159 * Setup generic address and protocol structures for div_input routine,
160 * then pass them along with mbuf chain.
163 div_packet(struct mbuf
*m
, int incoming
, int port
)
165 struct sockaddr_in divsrc
= { sizeof divsrc
, AF_INET
};
169 struct divert_info
*divinfo
;
174 /* Locate the divert info */
175 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
176 divinfo
= m_tag_data(mtag
);
177 divsrc
.sin_port
= divinfo
->skipto
;
180 * Record receive interface address, if any.
181 * But only for incoming packets.
183 divsrc
.sin_addr
.s_addr
= 0;
185 struct ifaddr_container
*ifac
;
187 /* Find IP address for receive interface */
188 TAILQ_FOREACH(ifac
, &m
->m_pkthdr
.rcvif
->if_addrheads
[mycpuid
],
190 struct ifaddr
*ifa
= ifac
->ifa
;
192 if (ifa
->ifa_addr
== NULL
)
194 if (ifa
->ifa_addr
->sa_family
!= AF_INET
)
197 ((struct sockaddr_in
*) ifa
->ifa_addr
)->sin_addr
;
202 * Record the incoming interface name whenever we have one.
204 if (m
->m_pkthdr
.rcvif
) {
206 * Hide the actual interface name in there in the
207 * sin_zero array. XXX This needs to be moved to a
208 * different sockaddr type for divert, e.g.
209 * sockaddr_div with multiple fields like
210 * sockaddr_dl. Presently we have only 7 bytes
211 * but that will do for now as most interfaces
212 * are 4 or less + 2 or less bytes for unit.
213 * There is probably a faster way of doing this,
214 * possibly taking it from the sockaddr_dl on the iface.
215 * This solves the problem of a P2P link and a LAN interface
216 * having the same address, which can result in the wrong
217 * interface being assigned to the packet when fed back
218 * into the divert socket. Theoretically if the daemon saves
219 * and re-uses the sockaddr_in as suggested in the man pages,
220 * this iface name will come along for the ride.
221 * (see div_output for the other half of this.)
223 ksnprintf(divsrc
.sin_zero
, sizeof divsrc
.sin_zero
, "%s",
224 m
->m_pkthdr
.rcvif
->if_xname
);
227 /* Put packet on socket queue, if any */
229 nport
= htons((u_int16_t
)port
);
232 * Following loop to locate the inpcb is MPSAFE since the inpcb
233 * insertion/removal happens on the same CPU (CPU0).
235 LIST_FOREACH(inp
, &divcbinfo
.pcblisthead
, inp_list
) {
236 if (inp
->inp_flags
& INP_PLACEMARKER
)
238 if (inp
->inp_lport
== nport
)
239 sa
= inp
->inp_socket
;
242 lwkt_gettoken(&sa
->so_rcv
.ssb_token
);
243 if (ssb_appendaddr(&sa
->so_rcv
, (struct sockaddr
*)&divsrc
, m
, NULL
) == 0)
247 lwkt_reltoken(&sa
->so_rcv
.ssb_token
);
250 ipstat
.ips_noproto
++;
251 ipstat
.ips_delivered
--;
256 div_packet_handler(netmsg_t msg
)
259 int port
, incoming
= 0;
261 m
= msg
->packet
.nm_packet
;
263 port
= msg
->lmsg
.u
.ms_result32
& 0xffff;
264 if (msg
->lmsg
.u
.ms_result32
& DIV_INPUT
)
266 div_packet(m
, incoming
, port
);
267 /* no reply, msg embedded in mbuf */
271 divert_packet(struct mbuf
*m
, int incoming
)
274 struct divert_info
*divinfo
;
280 if (m
->m_len
< sizeof(struct ip
) &&
281 (m
= m_pullup(m
, sizeof(struct ip
))) == NULL
)
284 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
285 KASSERT(mtag
!= NULL
, ("%s no divert tag!", __func__
));
286 divinfo
= m_tag_data(mtag
);
288 port
= divinfo
->port
;
289 KASSERT(port
!= 0, ("%s: port=0", __func__
));
292 struct netmsg_packet
*nmp
;
294 nmp
= &m
->m_hdr
.mh_netmsg
;
295 netmsg_init(&nmp
->base
, NULL
, &netisr_apanic_rport
,
296 0, div_packet_handler
);
299 nmp
->base
.lmsg
.u
.ms_result32
= port
; /* port is 16bits */
301 nmp
->base
.lmsg
.u
.ms_result32
|= DIV_INPUT
;
303 nmp
->base
.lmsg
.u
.ms_result32
|= DIV_OUTPUT
;
305 lwkt_sendmsg(netisr_cpuport(0), &nmp
->base
.lmsg
);
307 div_packet(m
, incoming
, port
);
312 * Deliver packet back into the IP processing machinery.
314 * If no address specified, or address is 0.0.0.0, send to ip_output();
315 * otherwise, send to ip_input() and mark as having been received on
316 * the interface with that address.
319 div_output(struct socket
*so
, struct mbuf
*m
,
320 struct sockaddr_in
*sin
, struct mbuf
*control
)
324 struct divert_info
*divinfo
;
329 m_freem(control
); /* XXX */
332 * Prepare the tag for divert info. Note that a packet
333 * with a 0 tag in mh_data is effectively untagged,
334 * so we could optimize that case.
336 mtag
= m_tag_get(PACKET_TAG_IPFW_DIVERT
, sizeof(*divinfo
), M_NOWAIT
);
341 m_tag_prepend(m
, mtag
);
343 /* Loopback avoidance and state recovery */
344 divinfo
= m_tag_data(mtag
);
346 divinfo
->skipto
= sin
->sin_port
;
350 /* Reinject packet into the system as incoming or outgoing */
351 if (DIV_IS_OUTPUT(sin
)) {
352 struct ip
*const ip
= mtod(m
, struct ip
*);
354 /* Don't allow packet length sizes that will crash */
355 if ((u_short
)ntohs(ip
->ip_len
) > m
->m_pkthdr
.len
) {
360 /* Convert fields to host order for ip_output() */
361 ip
->ip_len
= ntohs(ip
->ip_len
);
362 ip
->ip_off
= ntohs(ip
->ip_off
);
364 /* Send packet to output processing */
365 ipstat
.ips_rawout
++; /* XXX */
366 error
= ip_output(m
, NULL
, NULL
,
367 (so
->so_options
& SO_DONTROUTE
) |
368 IP_ALLOWBROADCAST
| IP_RAWOUTPUT
,
381 div_attach(netmsg_t msg
)
383 struct socket
*so
= msg
->attach
.base
.nm_so
;
384 int proto
= msg
->attach
.nm_proto
;
385 struct pru_attach_info
*ai
= msg
->attach
.nm_ai
;
394 error
= priv_check_cred(ai
->p_ucred
, PRIV_ROOT
, NULL_CRED_OKAY
);
398 error
= soreserve(so
, div_sendspace
, div_recvspace
, ai
->sb_rlimit
);
401 error
= in_pcballoc(so
, &divcbinfo
);
404 inp
= (struct inpcb
*)so
->so_pcb
;
405 inp
->inp_ip_p
= proto
;
406 inp
->inp_flags
|= INP_HDRINCL
;
408 * The socket is always "connected" because
409 * we always know "where" to send the packet.
411 sosetstate(so
, SS_ISCONNECTED
);
414 lwkt_replymsg(&msg
->attach
.base
.lmsg
, error
);
418 div_detach(netmsg_t msg
)
420 struct socket
*so
= msg
->detach
.base
.nm_so
;
429 lwkt_replymsg(&msg
->detach
.base
.lmsg
, 0);
433 div_abort(netmsg_t msg
)
436 * Divert socket does not support listen(2),
437 * so this should never be called.
439 panic("div_abort is called");
443 div_disconnect(netmsg_t msg
)
445 struct socket
*so
= msg
->disconnect
.base
.nm_so
;
450 if (so
->so_state
& SS_ISCONNECTED
) {
451 soisdisconnected(so
);
456 lwkt_replymsg(&msg
->disconnect
.base
.lmsg
, error
);
460 div_bind(netmsg_t msg
)
462 struct socket
*so
= msg
->bind
.base
.nm_so
;
463 struct sockaddr
*nam
= msg
->bind
.nm_nam
;
469 * in_pcbbind assumes that nam is a sockaddr_in
470 * and in_pcbbind requires a valid address. Since divert
471 * sockets don't we need to make sure the address is
472 * filled in properly.
473 * XXX -- divert should not be abusing in_pcbind
474 * and should probably have its own family.
476 if (nam
->sa_family
!= AF_INET
) {
477 error
= EAFNOSUPPORT
;
479 ((struct sockaddr_in
*)nam
)->sin_addr
.s_addr
= INADDR_ANY
;
480 error
= in_pcbbind(so
->so_pcb
, nam
, msg
->bind
.nm_td
);
482 lwkt_replymsg(&msg
->bind
.base
.lmsg
, error
);
486 div_shutdown(netmsg_t msg
)
488 struct socket
*so
= msg
->shutdown
.base
.nm_so
;
494 lwkt_replymsg(&msg
->shutdown
.base
.lmsg
, 0);
498 div_send(netmsg_t msg
)
500 struct socket
*so
= msg
->send
.base
.nm_so
;
501 struct mbuf
*m
= msg
->send
.nm_m
;
502 struct sockaddr
*nam
= msg
->send
.nm_addr
;
503 struct mbuf
*control
= msg
->send
.nm_control
;
506 /* Length check already done in ip_hashfn() */
507 KASSERT(m
->m_len
>= sizeof(struct ip
), ("IP header not in one mbuf"));
510 error
= div_output(so
, m
, (struct sockaddr_in
*)nam
, control
);
511 lwkt_replymsg(&msg
->send
.base
.lmsg
, error
);
514 SYSCTL_DECL(_net_inet_divert
);
515 SYSCTL_PROC(_net_inet_divert
, OID_AUTO
, pcblist
, CTLFLAG_RD
, &divcbinfo
, 1,
516 in_pcblist_range
, "S,xinpcb", "List of active divert sockets");
518 struct pr_usrreqs div_usrreqs
= {
519 .pru_abort
= div_abort
,
520 .pru_accept
= pr_generic_notsupp
,
521 .pru_attach
= div_attach
,
522 .pru_bind
= div_bind
,
523 .pru_connect
= pr_generic_notsupp
,
524 .pru_connect2
= pr_generic_notsupp
,
525 .pru_control
= in_control_dispatch
,
526 .pru_detach
= div_detach
,
527 .pru_disconnect
= div_disconnect
,
528 .pru_listen
= pr_generic_notsupp
,
529 .pru_peeraddr
= in_setpeeraddr_dispatch
,
530 .pru_rcvd
= pr_generic_notsupp
,
531 .pru_rcvoob
= pr_generic_notsupp
,
532 .pru_send
= div_send
,
533 .pru_sense
= pru_sense_null
,
534 .pru_shutdown
= div_shutdown
,
535 .pru_sockaddr
= in_setsockaddr_dispatch
,
536 .pru_sosend
= sosend
,
537 .pru_soreceive
= soreceive
541 ip_divert_out(struct mbuf
*m
, int tee
)
543 struct mbuf
*clone
= NULL
;
544 struct ip
*ip
= mtod(m
, struct ip
*);
546 /* Clone packet if we're doing a 'tee' */
548 clone
= m_dup(m
, M_NOWAIT
);
552 * delayed checksums are not currently compatible
553 * with divert sockets.
555 if (m
->m_pkthdr
.csum_flags
& CSUM_DELAY_DATA
) {
557 m
->m_pkthdr
.csum_flags
&= ~CSUM_DELAY_DATA
;
560 /* Restore packet header fields to original values */
561 ip
->ip_len
= htons(ip
->ip_len
);
562 ip
->ip_off
= htons(ip
->ip_off
);
564 /* Deliver packet to divert input routine */
567 /* If 'tee', continue with original packet */
572 ip_divert_in(struct mbuf
*m
, int tee
)
574 struct mbuf
*clone
= NULL
;
575 struct ip
*ip
= mtod(m
, struct ip
*);
578 if (ip
->ip_off
& (IP_MF
| IP_OFFMASK
)) {
579 const struct divert_info
*divinfo
;
584 * Only trust divert info in the fragment
587 frag_off
= ip
->ip_off
<< 3;
589 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
590 m_tag_delete(m
, mtag
);
594 * Attempt reassembly; if it succeeds, proceed.
595 * ip_reass() will return a different mbuf.
600 ip
= mtod(m
, struct ip
*);
602 /* Caller need to redispatch the packet, if it is for us */
603 m
->m_pkthdr
.fw_flags
|= FW_MBUF_REDISPATCH
;
606 * Get the header length of the reassembled
609 hlen
= IP_VHL_HL(ip
->ip_vhl
) << 2;
612 * Restore original checksum before diverting
616 ip
->ip_len
= htons(ip
->ip_len
);
617 ip
->ip_off
= htons(ip
->ip_off
);
619 if (hlen
== sizeof(struct ip
))
620 ip
->ip_sum
= in_cksum_hdr(ip
);
622 ip
->ip_sum
= in_cksum(m
, hlen
);
623 ip
->ip_off
= ntohs(ip
->ip_off
);
624 ip
->ip_len
= ntohs(ip
->ip_len
);
627 * Only use the saved divert info
629 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
631 /* Wrongly configured ipfw */
632 kprintf("ip_input no divert info\n");
636 divinfo
= m_tag_data(mtag
);
641 * Divert or tee packet to the divert protocol if
645 /* Clone packet if we're doing a 'tee' */
647 clone
= m_dup(m
, M_NOWAIT
);
650 * Restore packet header fields to original
653 ip
->ip_len
= htons(ip
->ip_len
);
654 ip
->ip_off
= htons(ip
->ip_off
);
656 /* Deliver packet to divert input routine */
659 /* Catch invalid reference */
663 ipstat
.ips_delivered
++;
665 /* If 'tee', continue with original packet */
668 * Complete processing of the packet.
669 * XXX Better safe than sorry, remove the DIVERT tag.
671 mtag
= m_tag_find(clone
, PACKET_TAG_IPFW_DIVERT
, NULL
);
672 KKASSERT(mtag
!= NULL
);
673 m_tag_delete(clone
, mtag
);
679 ip_divert(struct mbuf
*m
, int tee
, int incoming
)
684 ret
= ip_divert_in(m
, tee
);
686 ret
= ip_divert_out(m
, tee
);