2 * Copyright (c) 1982, 1986, 1988, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the University of
16 * California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * $FreeBSD: src/sys/netinet/ip_divert.c,v 1.42.2.6 2003/01/23 21:06:45 sam Exp $
34 * $DragonFly: src/sys/netinet/ip_divert.c,v 1.36 2008/03/07 11:34:20 sephe Exp $
39 #include "opt_ipdivert.h"
40 #include "opt_ipsec.h"
43 #error "IPDIVERT requires INET."
46 #include <sys/param.h>
47 #include <sys/kernel.h>
48 #include <sys/malloc.h>
50 #include <sys/socket.h>
51 #include <sys/protosw.h>
52 #include <sys/socketvar.h>
53 #include <sys/sysctl.h>
54 #include <sys/systm.h>
56 #include <sys/thread2.h>
58 #include <sys/msgport.h>
61 #include <vm/vm_zone.h>
64 #include <net/route.h>
66 #include <net/netmsg2.h>
69 #include <netinet/in.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/ip.h>
72 #include <netinet/in_pcb.h>
73 #include <netinet/in_var.h>
74 #include <netinet/ip_var.h>
81 * Allocate enough space to hold a full IP packet
83 #define DIVSNDQ (65536 + 100)
84 #define DIVRCVQ (65536 + 100)
86 #define DIV_IS_OUTPUT(sin) ((sin) == NULL || (sin)->sin_addr.s_addr == 0)
88 #define DIV_OUTPUT 0x10000
89 #define DIV_INPUT 0x20000
92 * Divert sockets work in conjunction with ipfw, see the divert(4)
93 * manpage for features.
94 * Internally, packets selected by ipfw in ip_input() or ip_output(),
95 * and never diverted before, are passed to the input queue of the
96 * divert socket with a given 'divert_port' number (as specified in
97 * the matching ipfw rule), and they are tagged with a 16 bit cookie
98 * (representing the rule number of the matching ipfw rule), which
99 * is passed to process reading from the socket.
101 * Packets written to the divert socket are again tagged with a cookie
102 * (usually the same as above) and a destination address.
103 * If the destination address is INADDR_ANY then the packet is
104 * treated as outgoing and sent to ip_output(), otherwise it is
105 * treated as incoming and sent to ip_input().
106 * In both cases, the packet is tagged with the cookie.
108 * On reinjection, processing in ip_input() and ip_output()
109 * will be exactly the same as for the original packet, except that
110 * ipfw processing will start at the rule number after the one
111 * written in the cookie (so, tagging a packet with a cookie of 0
112 * will cause it to be effectively considered as a standard packet).
115 /* Internal variables */
116 static struct inpcbinfo divcbinfo
;
118 static u_long div_sendspace
= DIVSNDQ
; /* XXX sysctl ? */
119 static u_long div_recvspace
= DIVRCVQ
; /* XXX sysctl ? */
122 * Initialize divert connection block queue.
127 in_pcbinfo_init(&divcbinfo
);
129 * XXX We don't use the hash list for divert IP, but it's easier
130 * to allocate a one entry hash list than it is to check all
131 * over the place for hashbase == NULL.
133 divcbinfo
.hashbase
= hashinit(1, M_PCB
, &divcbinfo
.hashmask
);
134 divcbinfo
.porthashbase
= hashinit(1, M_PCB
, &divcbinfo
.porthashmask
);
135 divcbinfo
.wildcardhashbase
= hashinit(1, M_PCB
,
136 &divcbinfo
.wildcardhashmask
);
137 divcbinfo
.ipi_zone
= zinit("divcb", sizeof(struct inpcb
),
138 maxsockets
, ZONE_INTERRUPT
, 0);
142 * IPPROTO_DIVERT is not a real IP protocol; don't allow any packets
143 * with that protocol number to enter the system from the outside.
146 div_input(struct mbuf
*m
, ...)
148 ipstat
.ips_noproto
++;
153 div_soport(struct socket
*so
, struct sockaddr
*nam
,
154 struct mbuf
**mptr
, int req
)
156 struct sockaddr_in
*sin
;
160 /* Except for send(), everything happens on CPU0 */
162 return cpu0_soport(so
, nam
, mptr
, req
);
164 sin
= (struct sockaddr_in
*)nam
;
168 m
->m_pkthdr
.rcvif
= NULL
;
169 dir
= DIV_IS_OUTPUT(sin
) ? IP_MPORT_OUT
: IP_MPORT_IN
;
175 * Try locating the interface, if we originally had one.
176 * This is done even for outgoing packets, since for a
177 * forwarded packet, there must be an interface attached.
179 * Find receive interface with the given name, stuffed
180 * (if it exists) in the sin_zero[] field.
181 * The name is user supplied data so don't trust its size
182 * or that it is zero terminated.
184 for (i
= 0; sin
->sin_zero
[i
] && i
< sizeof(sin
->sin_zero
); i
++)
186 if (i
> 0 && i
< sizeof(sin
->sin_zero
))
187 m
->m_pkthdr
.rcvif
= ifunit(sin
->sin_zero
);
190 if (dir
== IP_MPORT_IN
&& m
->m_pkthdr
.rcvif
== NULL
) {
192 * No luck with the name, check by IP address.
193 * Clear the port and the ifname to make sure
194 * there are no distractions for ifa_ifwithaddr.
196 * Be careful not to trash sin->sin_port; it will
197 * be used later in div_output().
202 bzero(sin
->sin_zero
, sizeof(sin
->sin_zero
));
203 sin_port
= sin
->sin_port
; /* save */
205 ifa
= ifa_ifwithaddr((struct sockaddr
*)sin
);
211 sin
->sin_port
= sin_port
; /* restore */
212 m
->m_pkthdr
.rcvif
= ifa
->ifa_ifp
;
215 return ip_mport(mptr
, dir
);
219 * Divert a packet by passing it up to the divert socket at port 'port'.
221 * Setup generic address and protocol structures for div_input routine,
222 * then pass them along with mbuf chain.
225 div_packet(struct mbuf
*m
, int incoming
, int port
)
227 struct sockaddr_in divsrc
= { sizeof divsrc
, AF_INET
};
233 /* Locate the divert tag */
234 mtag
= m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
);
235 divsrc
.sin_port
= *(u_int16_t
*)m_tag_data(mtag
);
238 * Record receive interface address, if any.
239 * But only for incoming packets.
241 divsrc
.sin_addr
.s_addr
= 0;
243 struct ifaddr_container
*ifac
;
245 /* Find IP address for receive interface */
246 TAILQ_FOREACH(ifac
, &m
->m_pkthdr
.rcvif
->if_addrheads
[mycpuid
],
248 struct ifaddr
*ifa
= ifac
->ifa
;
250 if (ifa
->ifa_addr
== NULL
)
252 if (ifa
->ifa_addr
->sa_family
!= AF_INET
)
255 ((struct sockaddr_in
*) ifa
->ifa_addr
)->sin_addr
;
260 * Record the incoming interface name whenever we have one.
262 if (m
->m_pkthdr
.rcvif
) {
264 * Hide the actual interface name in there in the
265 * sin_zero array. XXX This needs to be moved to a
266 * different sockaddr type for divert, e.g.
267 * sockaddr_div with multiple fields like
268 * sockaddr_dl. Presently we have only 7 bytes
269 * but that will do for now as most interfaces
270 * are 4 or less + 2 or less bytes for unit.
271 * There is probably a faster way of doing this,
272 * possibly taking it from the sockaddr_dl on the iface.
273 * This solves the problem of a P2P link and a LAN interface
274 * having the same address, which can result in the wrong
275 * interface being assigned to the packet when fed back
276 * into the divert socket. Theoretically if the daemon saves
277 * and re-uses the sockaddr_in as suggested in the man pages,
278 * this iface name will come along for the ride.
279 * (see div_output for the other half of this.)
281 ksnprintf(divsrc
.sin_zero
, sizeof divsrc
.sin_zero
,
282 m
->m_pkthdr
.rcvif
->if_xname
);
285 /* Put packet on socket queue, if any */
287 nport
= htons((u_int16_t
)port
);
288 LIST_FOREACH(inp
, &divcbinfo
.pcblisthead
, inp_list
) {
289 if (inp
->inp_flags
& INP_PLACEMARKER
)
291 if (inp
->inp_lport
== nport
)
292 sa
= inp
->inp_socket
;
295 if (ssb_appendaddr(&sa
->so_rcv
, (struct sockaddr
*)&divsrc
, m
,
296 (struct mbuf
*)NULL
) == 0)
302 ipstat
.ips_noproto
++;
303 ipstat
.ips_delivered
--;
309 div_packet_handler(struct netmsg
*nmsg
)
311 struct netmsg_packet
*nmp
;
312 struct lwkt_msg
*msg
;
314 int port
, incoming
= 0;
316 nmp
= (struct netmsg_packet
*)nmsg
;
319 msg
= &nmsg
->nm_lmsg
;
320 port
= msg
->u
.ms_result32
& 0xffff;
321 if (msg
->u
.ms_result32
& DIV_INPUT
)
324 div_packet(m
, incoming
, port
);
329 divert_packet(struct mbuf
*m
, int incoming
, int port
)
332 KASSERT(port
!= 0, ("%s: port=0", __func__
));
336 if (m
->m_len
< sizeof(struct ip
) &&
337 (m
= m_pullup(m
, sizeof(struct ip
))) == NULL
)
341 KASSERT(m_tag_find(m
, PACKET_TAG_IPFW_DIVERT
, NULL
) != NULL
,
342 ("%s no divert tag!", __func__
));
346 struct netmsg_packet
*nmp
;
347 struct lwkt_msg
*msg
;
349 nmp
= &m
->m_hdr
.mh_netmsg
;
350 netmsg_init(&nmp
->nm_netmsg
, &netisr_apanic_rport
, 0,
354 msg
= &nmp
->nm_netmsg
.nm_lmsg
;
355 msg
->u
.ms_result32
= port
; /* port is 16bits */
357 msg
->u
.ms_result32
|= DIV_INPUT
;
359 msg
->u
.ms_result32
|= DIV_OUTPUT
;
361 lwkt_sendmsg(cpu_portfn(0), &nmp
->nm_netmsg
.nm_lmsg
);
364 div_packet(m
, incoming
, port
);
368 * Deliver packet back into the IP processing machinery.
370 * If no address specified, or address is 0.0.0.0, send to ip_output();
371 * otherwise, send to ip_input() and mark as having been received on
372 * the interface with that address.
375 div_output(struct socket
*so
, struct mbuf
*m
,
376 struct sockaddr_in
*sin
, struct mbuf
*control
)
382 m_freem(control
); /* XXX */
385 * Prepare the tag for divert info. Note that a packet
386 * with a 0 tag in mh_data is effectively untagged,
387 * so we could optimize that case.
389 mtag
= m_tag_get(PACKET_TAG_IPFW_DIVERT
, sizeof(u_int16_t
), MB_DONTWAIT
);
394 m_tag_prepend(m
, mtag
);
396 /* Loopback avoidance and state recovery */
398 *(u_int16_t
*)m_tag_data(mtag
) = sin
->sin_port
;
400 *(u_int16_t
*)m_tag_data(mtag
) = 0;
402 /* Reinject packet into the system as incoming or outgoing */
403 if (DIV_IS_OUTPUT(sin
)) {
404 struct ip
*const ip
= mtod(m
, struct ip
*);
406 /* Don't allow packet length sizes that will crash */
407 if ((u_short
)ntohs(ip
->ip_len
) > m
->m_pkthdr
.len
) {
412 /* Convert fields to host order for ip_output() */
413 ip
->ip_len
= ntohs(ip
->ip_len
);
414 ip
->ip_off
= ntohs(ip
->ip_off
);
416 /* Send packet to output processing */
417 ipstat
.ips_rawout
++; /* XXX */
418 error
= ip_output(m
, NULL
, NULL
,
419 (so
->so_options
& SO_DONTROUTE
) |
420 IP_ALLOWBROADCAST
| IP_RAWOUTPUT
,
433 div_attach(struct socket
*so
, int proto
, struct pru_attach_info
*ai
)
441 if ((error
= suser_cred(ai
->p_ucred
, NULL_CRED_OKAY
)) != 0)
444 error
= soreserve(so
, div_sendspace
, div_recvspace
, ai
->sb_rlimit
);
447 error
= in_pcballoc(so
, &divcbinfo
);
450 inp
= (struct inpcb
*)so
->so_pcb
;
451 inp
->inp_ip_p
= proto
;
452 inp
->inp_vflag
|= INP_IPV4
;
453 inp
->inp_flags
|= INP_HDRINCL
;
455 * The socket is always "connected" because
456 * we always know "where" to send the packet.
458 so
->so_state
|= SS_ISCONNECTED
;
463 div_detach(struct socket
*so
)
475 div_abort(struct socket
*so
)
477 soisdisconnected(so
);
478 return div_detach(so
);
482 div_disconnect(struct socket
*so
)
484 if (!(so
->so_state
& SS_ISCONNECTED
))
486 return div_abort(so
);
490 div_bind(struct socket
*so
, struct sockaddr
*nam
, struct thread
*td
)
495 * in_pcbbind assumes that nam is a sockaddr_in
496 * and in_pcbbind requires a valid address. Since divert
497 * sockets don't we need to make sure the address is
498 * filled in properly.
499 * XXX -- divert should not be abusing in_pcbind
500 * and should probably have its own family.
502 if (nam
->sa_family
!= AF_INET
) {
503 error
= EAFNOSUPPORT
;
505 ((struct sockaddr_in
*)nam
)->sin_addr
.s_addr
= INADDR_ANY
;
506 error
= in_pcbbind(so
->so_pcb
, nam
, td
);
512 div_shutdown(struct socket
*so
)
519 div_send(struct socket
*so
, int flags
, struct mbuf
*m
, struct sockaddr
*nam
,
520 struct mbuf
*control
, struct thread
*td
)
522 /* Length check already done in ip_mport() */
523 KASSERT(m
->m_len
>= sizeof(struct ip
), ("IP header not in one mbuf"));
526 return div_output(so
, m
, (struct sockaddr_in
*)nam
, control
);
529 SYSCTL_DECL(_net_inet_divert
);
530 SYSCTL_PROC(_net_inet_divert
, OID_AUTO
, pcblist
, CTLFLAG_RD
, &divcbinfo
, 0,
531 in_pcblist_global
, "S,xinpcb", "List of active divert sockets");
533 struct pr_usrreqs div_usrreqs
= {
534 .pru_abort
= div_abort
,
535 .pru_accept
= pru_accept_notsupp
,
536 .pru_attach
= div_attach
,
537 .pru_bind
= div_bind
,
538 .pru_connect
= pru_connect_notsupp
,
539 .pru_connect2
= pru_connect2_notsupp
,
540 .pru_control
= in_control
,
541 .pru_detach
= div_detach
,
542 .pru_disconnect
= div_disconnect
,
543 .pru_listen
= pru_listen_notsupp
,
544 .pru_peeraddr
= in_setpeeraddr
,
545 .pru_rcvd
= pru_rcvd_notsupp
,
546 .pru_rcvoob
= pru_rcvoob_notsupp
,
547 .pru_send
= div_send
,
548 .pru_sense
= pru_sense_null
,
549 .pru_shutdown
= div_shutdown
,
550 .pru_sockaddr
= in_setsockaddr
,
551 .pru_sosend
= sosend
,
552 .pru_soreceive
= soreceive
,