2005-01-07 01:45:51 +00:00
|
|
|
/*-
|
2017-11-20 19:43:44 +00:00
|
|
|
* SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
*
|
1996-07-10 19:44:30 +00:00
|
|
|
* Copyright (c) 1982, 1986, 1988, 1993
|
|
|
|
* The Regents of the University of California. All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
2017-02-28 23:42:47 +00:00
|
|
|
* 3. Neither the name of the University nor the names of its contributors
|
1996-07-10 19:44:30 +00:00
|
|
|
* may be used to endorse or promote products derived from this software
|
|
|
|
* without specific prior written permission.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
2007-10-07 20:44:24 +00:00
|
|
|
#include <sys/cdefs.h>
|
|
|
|
__FBSDID("$FreeBSD$");
|
|
|
|
|
1998-01-08 23:42:31 +00:00
|
|
|
#include "opt_inet.h"
|
2012-01-22 02:16:31 +00:00
|
|
|
#include "opt_inet6.h"
|
2009-02-03 11:00:43 +00:00
|
|
|
#include "opt_sctp.h"
|
1998-01-08 23:42:31 +00:00
|
|
|
|
1996-07-10 19:44:30 +00:00
|
|
|
#include <sys/param.h>
|
2013-10-28 07:29:16 +00:00
|
|
|
#include <sys/eventhandler.h>
|
2000-08-03 14:09:52 +00:00
|
|
|
#include <sys/kernel.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <sys/lock.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/mbuf.h>
|
2004-10-19 21:14:57 +00:00
|
|
|
#include <sys/module.h>
|
|
|
|
#include <sys/kernel.h>
|
2006-11-06 13:42:10 +00:00
|
|
|
#include <sys/priv.h>
|
2001-11-08 02:13:18 +00:00
|
|
|
#include <sys/proc.h>
|
2022-08-30 22:09:21 +00:00
|
|
|
#include <sys/domain.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
#include <sys/protosw.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <sys/socket.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
#include <sys/socketvar.h>
|
2000-08-03 14:09:52 +00:00
|
|
|
#include <sys/sysctl.h>
|
2010-01-07 10:39:15 +00:00
|
|
|
#include <net/vnet.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
|
|
|
|
#include <net/if.h>
|
2013-10-26 17:58:36 +00:00
|
|
|
#include <net/if_var.h>
|
2023-01-23 15:05:29 +00:00
|
|
|
#include <net/if_private.h>
|
2020-02-12 13:31:36 +00:00
|
|
|
#include <net/netisr.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_pcb.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <netinet/in_systm.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
#include <netinet/in_var.h>
|
2002-04-30 01:54:54 +00:00
|
|
|
#include <netinet/ip.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
#include <netinet/ip_var.h>
|
2022-08-30 22:09:21 +00:00
|
|
|
#include <netinet/ip_divert.h>
|
2011-06-27 12:21:11 +00:00
|
|
|
#ifdef INET6
|
|
|
|
#include <netinet/ip6.h>
|
|
|
|
#include <netinet6/ip6_var.h>
|
|
|
|
#endif
|
2020-06-18 19:32:34 +00:00
|
|
|
#if defined(SCTP) || defined(SCTP_SUPPORT)
|
2009-02-03 11:00:43 +00:00
|
|
|
#include <netinet/sctp_crc32.h>
|
|
|
|
#endif
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2006-10-22 11:52:19 +00:00
|
|
|
#include <security/mac/mac_framework.h>
|
1996-07-10 19:44:30 +00:00
|
|
|
/*
|
|
|
|
* Divert sockets
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Allocate enough space to hold a full IP packet
|
|
|
|
*/
|
|
|
|
#define DIVSNDQ (65536 + 100)
|
|
|
|
#define DIVRCVQ (65536 + 100)
|
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
/*
|
|
|
|
* Usually a system has very few divert ports. Previous implementation
|
|
|
|
* used a linked list.
|
|
|
|
*/
|
|
|
|
#define DIVHASHSIZE (1 << 3) /* 8 entries, one cache line. */
|
|
|
|
#define DIVHASH(port) (port % DIVHASHSIZE)
|
|
|
|
#define DCBHASH(dcb) ((dcb)->dcb_port % DIVHASHSIZE)
|
|
|
|
|
1996-07-10 19:44:30 +00:00
|
|
|
/*
|
2010-01-07 10:39:15 +00:00
|
|
|
* Divert sockets work in conjunction with ipfw or other packet filters,
|
|
|
|
* see the divert(4) manpage for features.
|
|
|
|
* Packets are selected by the packet filter and tagged with an
|
|
|
|
* MTAG_IPFW_RULE tag carrying the 'divert port' number (as set by
|
|
|
|
* the packet filter) and information on the matching filter rule for
|
|
|
|
* subsequent reinjection. The divert_port is used to put the packet
|
|
|
|
* on the corresponding divert socket, while the rule number is passed
|
|
|
|
* up (at least partially) as the sin_port in the struct sockaddr.
|
1998-05-25 10:37:48 +00:00
|
|
|
*
|
2010-01-07 10:39:15 +00:00
|
|
|
* Packets written to the divert socket carry in sin_addr a
|
|
|
|
* destination address, and in sin_port the number of the filter rule
|
|
|
|
* after which to continue processing.
|
|
|
|
* If the destination address is INADDR_ANY, the packet is treated as
|
|
|
|
* as outgoing and sent to ip_output(); otherwise it is treated as
|
|
|
|
* incoming and sent to ip_input().
|
|
|
|
* Further, sin_zero carries some information on the interface,
|
|
|
|
* which can be used in the reinject -- see comments in the code.
|
1999-12-06 00:43:07 +00:00
|
|
|
*
|
Remove (almost all) global variables that were used to hold
packet forwarding state ("annotations") during ip processing.
The code is considerably cleaner now.
The variables removed by this change are:
ip_divert_cookie used by divert sockets
ip_fw_fwd_addr used for transparent ip redirection
last_pkt used by dynamic pipes in dummynet
Removal of the first two has been done by carrying the annotations
into volatile structs prepended to the mbuf chains, and adding
appropriate code to add/remove annotations in the routines which
make use of them, i.e. ip_input(), ip_output(), tcp_input(),
bdg_forward(), ether_demux(), ether_output_frame(), div_output().
On passing, remove a bug in divert handling of fragmented packet.
Now it is the fragment at offset 0 which sets the divert status of
the whole packet, whereas formerly it was the last incoming fragment
to decide.
Removal of last_pkt required a change in the interface of ip_fw_chk()
and dummynet_io(). On passing, use the same mechanism for dummynet
annotations and for divert/forward annotations.
option IPFIREWALL_FORWARD is effectively useless, the code to
implement it is very small and is now in by default to avoid the
obfuscation of conditionally compiled code.
NOTES:
* there is at least one global variable left, sro_fwd, in ip_output().
I am not sure if/how this can be removed.
* I have deliberately avoided gratuitous style changes in this commit
to avoid cluttering the diffs. Minor stule cleanup will likely be
necessary
* this commit only focused on the IP layer. I am sure there is a
number of global variables used in the TCP and maybe UDP stack.
* despite the number of files touched, there are absolutely no API's
or data structures changed by this commit (except the interfaces of
ip_fw_chk() and dummynet_io(), which are internal anyways), so
an MFC is quite safe and unintrusive (and desirable, given the
improved readability of the code).
MFC after: 10 days
2002-06-22 11:51:02 +00:00
|
|
|
* On reinjection, processing in ip_input() and ip_output()
|
|
|
|
* will be exactly the same as for the original packet, except that
|
2010-01-07 10:39:15 +00:00
|
|
|
* packet filter processing will start at the rule number after the one
|
|
|
|
* written in the sin_port (ipfw does not allow a rule #0, so sin_port=0
|
|
|
|
* will apply the entire ruleset to the packet).
|
1996-07-10 19:44:30 +00:00
|
|
|
*/
|
2022-08-30 22:09:21 +00:00
|
|
|
static SYSCTL_NODE(_net_inet, OID_AUTO, divert, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
|
|
|
|
"divert(4)");
|
|
|
|
|
|
|
|
VNET_PCPUSTAT_DEFINE_STATIC(struct divstat, divstat);
|
|
|
|
VNET_PCPUSTAT_SYSINIT(divstat);
|
|
|
|
#ifdef VIMAGE
|
|
|
|
VNET_PCPUSTAT_SYSUNINIT(divstat);
|
|
|
|
#endif
|
|
|
|
SYSCTL_VNET_PCPUSTAT(_net_inet_divert, OID_AUTO, stats, struct divstat,
|
|
|
|
divstat, "divert(4) socket statistics");
|
|
|
|
#define DIVSTAT_INC(name) \
|
|
|
|
VNET_PCPUSTAT_ADD(struct divstat, divstat, div_ ## name, 1)
|
1996-07-10 19:44:30 +00:00
|
|
|
|
|
|
|
static u_long div_sendspace = DIVSNDQ; /* XXX sysctl ? */
|
|
|
|
static u_long div_recvspace = DIVRCVQ; /* XXX sysctl ? */
|
|
|
|
|
2020-01-23 09:14:28 +00:00
|
|
|
static int div_output_inbound(int fmaily, struct socket *so, struct mbuf *m,
|
|
|
|
struct sockaddr_in *sin);
|
|
|
|
static int div_output_outbound(int family, struct socket *so, struct mbuf *m);
|
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
struct divcb {
|
|
|
|
union {
|
|
|
|
SLIST_ENTRY(divcb) dcb_next;
|
|
|
|
intptr_t dcb_bound;
|
|
|
|
#define DCB_UNBOUND ((intptr_t)-1)
|
|
|
|
};
|
|
|
|
struct socket *dcb_socket;
|
|
|
|
uint16_t dcb_port;
|
|
|
|
uint64_t dcb_gencnt;
|
|
|
|
struct epoch_context dcb_epochctx;
|
|
|
|
};
|
Introduce a div_destroy() function which takes over per-vnet cleanup tasks
from the existing modevent / MOD_UNLOAD handler, and register div_destroy()
in protosw as per-vnet .pr_destroy() handler for options VIMAGE builds. In
nooptions VIMAGE builds, div_destroy() will be invoked from the modevent
handler, resulting in effectively identical operation as it was prior this
change. div_destroy() also tears down hashtables used by ipdivert, which
were previously left behind on ipdivert kldunloads.
For options VIMAGE builds only, temporarily disable kldunloading of ipdivert,
because without introducing additional locking logic it is impossible to
atomically check whether all ipdivert instances in all vnets are idle, and
proceed with cleanup without opening a race window for a vnet to open an
ipdivert socket while ipdivert tear-down is in progress.
While here, staticize div_init(), because it is not used outside of
ip_divert.c.
In cooperation with: julian
Approved by: re (rwatson), julian (mentor)
MFC after: 3 days
2009-08-24 10:06:02 +00:00
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
SLIST_HEAD(divhashhead, divcb);
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
VNET_DEFINE_STATIC(struct divhashhead, divhash[DIVHASHSIZE]) = {};
|
|
|
|
#define V_divhash VNET(divhash)
|
|
|
|
VNET_DEFINE_STATIC(uint64_t, dcb_count) = 0;
|
|
|
|
#define V_dcb_count VNET(dcb_count)
|
|
|
|
VNET_DEFINE_STATIC(uint64_t, dcb_gencnt) = 0;
|
|
|
|
#define V_dcb_gencnt VNET(dcb_gencnt)
|
2021-12-02 22:45:04 +00:00
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
static struct mtx divert_mtx;
|
|
|
|
MTX_SYSINIT(divert, &divert_mtx, "divert(4) socket pcb lists", MTX_DEF);
|
|
|
|
#define DIVERT_LOCK() mtx_lock(&divert_mtx)
|
|
|
|
#define DIVERT_UNLOCK() mtx_unlock(&divert_mtx)
|
2021-12-02 22:45:04 +00:00
|
|
|
|
1999-12-06 00:43:07 +00:00
|
|
|
/*
|
|
|
|
* Divert a packet by passing it up to the divert socket at port 'port'.
|
|
|
|
*/
|
2004-10-19 21:14:57 +00:00
|
|
|
static void
|
2019-03-14 22:23:09 +00:00
|
|
|
divert_packet(struct mbuf *m, bool incoming)
|
1996-07-10 19:44:30 +00:00
|
|
|
{
|
2022-08-30 22:09:21 +00:00
|
|
|
struct divcb *dcb;
|
1999-12-06 00:43:07 +00:00
|
|
|
u_int16_t nport;
|
2003-09-05 00:00:51 +00:00
|
|
|
struct sockaddr_in divsrc;
|
2004-02-25 19:55:29 +00:00
|
|
|
struct m_tag *mtag;
|
2019-11-07 20:44:34 +00:00
|
|
|
|
|
|
|
NET_EPOCH_ASSERT();
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2010-01-04 19:01:22 +00:00
|
|
|
mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
|
2004-02-25 19:55:29 +00:00
|
|
|
if (mtag == NULL) {
|
|
|
|
m_freem(m);
|
|
|
|
return;
|
|
|
|
}
|
1997-06-02 05:02:37 +00:00
|
|
|
/* Assure header */
|
|
|
|
if (m->m_len < sizeof(struct ip) &&
|
2016-04-15 15:46:41 +00:00
|
|
|
(m = m_pullup(m, sizeof(struct ip))) == NULL)
|
1997-06-02 05:02:37 +00:00
|
|
|
return;
|
2022-08-30 22:09:21 +00:00
|
|
|
#ifdef INET
|
2004-08-03 12:31:38 +00:00
|
|
|
/* Delayed checksums are currently not compatible with divert. */
|
|
|
|
if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
|
|
|
|
in_delayed_cksum(m);
|
|
|
|
m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
|
|
|
|
}
|
2020-06-18 19:32:34 +00:00
|
|
|
#if defined(SCTP) || defined(SCTP_SUPPORT)
|
2009-02-03 11:00:43 +00:00
|
|
|
if (m->m_pkthdr.csum_flags & CSUM_SCTP) {
|
2022-08-30 22:09:21 +00:00
|
|
|
struct ip *ip;
|
|
|
|
|
2022-04-13 23:08:23 +00:00
|
|
|
ip = mtod(m, struct ip *);
|
2010-03-12 22:58:52 +00:00
|
|
|
sctp_delayed_cksum(m, (uint32_t)(ip->ip_hl << 2));
|
2009-02-03 11:00:43 +00:00
|
|
|
m->m_pkthdr.csum_flags &= ~CSUM_SCTP;
|
|
|
|
}
|
|
|
|
#endif
|
2022-09-07 03:54:57 +00:00
|
|
|
#endif
|
2021-11-02 16:59:06 +00:00
|
|
|
#ifdef INET6
|
|
|
|
if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA_IPV6) {
|
|
|
|
in6_delayed_cksum(m, m->m_pkthdr.len -
|
|
|
|
sizeof(struct ip6_hdr), sizeof(struct ip6_hdr));
|
|
|
|
m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA_IPV6;
|
|
|
|
}
|
|
|
|
#if defined(SCTP) || defined(SCTP_SUPPORT)
|
|
|
|
if (m->m_pkthdr.csum_flags & CSUM_SCTP_IPV6) {
|
|
|
|
sctp_delayed_cksum(m, sizeof(struct ip6_hdr));
|
|
|
|
m->m_pkthdr.csum_flags &= ~CSUM_SCTP_IPV6;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
#endif /* INET6 */
|
2010-01-04 19:01:22 +00:00
|
|
|
bzero(&divsrc, sizeof(divsrc));
|
|
|
|
divsrc.sin_len = sizeof(divsrc);
|
|
|
|
divsrc.sin_family = AF_INET;
|
|
|
|
/* record matching rule, in host format */
|
|
|
|
divsrc.sin_port = ((struct ipfw_rule_ref *)(mtag+1))->rulenum;
|
1998-07-06 09:06:58 +00:00
|
|
|
/*
|
1999-12-06 00:43:07 +00:00
|
|
|
* Record receive interface address, if any.
|
1998-07-06 09:06:58 +00:00
|
|
|
* But only for incoming packets.
|
|
|
|
*/
|
1999-12-06 00:43:07 +00:00
|
|
|
if (incoming) {
|
1996-07-10 19:44:30 +00:00
|
|
|
struct ifaddr *ifa;
|
2009-04-19 22:29:16 +00:00
|
|
|
struct ifnet *ifp;
|
1996-07-10 19:44:30 +00:00
|
|
|
|
1997-06-02 05:02:37 +00:00
|
|
|
/* Sanity check */
|
2003-04-08 14:25:47 +00:00
|
|
|
M_ASSERTPKTHDR(m);
|
1996-07-10 19:44:30 +00:00
|
|
|
|
1998-05-25 08:44:31 +00:00
|
|
|
/* Find IP address for receive interface */
|
2009-04-19 22:29:16 +00:00
|
|
|
ifp = m->m_pkthdr.rcvif;
|
2018-05-18 20:13:34 +00:00
|
|
|
CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
|
1996-07-10 19:44:30 +00:00
|
|
|
if (ifa->ifa_addr->sa_family != AF_INET)
|
|
|
|
continue;
|
|
|
|
divsrc.sin_addr =
|
|
|
|
((struct sockaddr_in *) ifa->ifa_addr)->sin_addr;
|
|
|
|
break;
|
|
|
|
}
|
1998-06-12 01:54:29 +00:00
|
|
|
}
|
1998-07-06 09:06:58 +00:00
|
|
|
/*
|
|
|
|
* Record the incoming interface name whenever we have one.
|
|
|
|
*/
|
1998-06-12 01:54:29 +00:00
|
|
|
if (m->m_pkthdr.rcvif) {
|
1998-05-25 08:44:31 +00:00
|
|
|
/*
|
2020-02-12 13:31:36 +00:00
|
|
|
* Hide the actual interface name in there in the
|
1998-05-25 08:44:31 +00:00
|
|
|
* sin_zero array. XXX This needs to be moved to a
|
|
|
|
* different sockaddr type for divert, e.g.
|
2020-02-12 13:31:36 +00:00
|
|
|
* sockaddr_div with multiple fields like
|
1998-05-25 08:44:31 +00:00
|
|
|
* sockaddr_dl. Presently we have only 7 bytes
|
|
|
|
* but that will do for now as most interfaces
|
|
|
|
* are 4 or less + 2 or less bytes for unit.
|
|
|
|
* There is probably a faster way of doing this,
|
|
|
|
* possibly taking it from the sockaddr_dl on the iface.
|
|
|
|
* This solves the problem of a P2P link and a LAN interface
|
|
|
|
* having the same address, which can result in the wrong
|
|
|
|
* interface being assigned to the packet when fed back
|
|
|
|
* into the divert socket. Theoretically if the daemon saves
|
|
|
|
* and re-uses the sockaddr_in as suggested in the man pages,
|
|
|
|
* this iface name will come along for the ride.
|
|
|
|
* (see div_output for the other half of this.)
|
2020-02-12 13:31:36 +00:00
|
|
|
*/
|
2003-10-31 18:32:15 +00:00
|
|
|
strlcpy(divsrc.sin_zero, m->m_pkthdr.rcvif->if_xname,
|
|
|
|
sizeof(divsrc.sin_zero));
|
1996-07-10 19:44:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Put packet on socket queue, if any */
|
2022-08-30 22:09:21 +00:00
|
|
|
nport = htons((uint16_t)(((struct ipfw_rule_ref *)(mtag+1))->info));
|
|
|
|
SLIST_FOREACH(dcb, &V_divhash[DIVHASH(nport)], dcb_next)
|
|
|
|
if (dcb->dcb_port == nport)
|
|
|
|
break;
|
|
|
|
|
|
|
|
if (dcb != NULL) {
|
|
|
|
struct socket *sa = dcb->dcb_socket;
|
|
|
|
|
2021-12-02 22:45:04 +00:00
|
|
|
SOCKBUF_LOCK(&sa->so_rcv);
|
|
|
|
if (sbappendaddr_locked(&sa->so_rcv,
|
|
|
|
(struct sockaddr *)&divsrc, m, NULL) == 0) {
|
|
|
|
soroverflow_locked(sa);
|
2022-08-30 22:09:21 +00:00
|
|
|
m_freem(m);
|
2022-08-30 22:09:21 +00:00
|
|
|
} else {
|
2021-12-02 22:45:04 +00:00
|
|
|
sorwakeup_locked(sa);
|
2022-08-30 22:09:21 +00:00
|
|
|
DIVSTAT_INC(diverted);
|
|
|
|
}
|
2022-08-30 22:09:21 +00:00
|
|
|
} else {
|
2022-08-30 22:09:21 +00:00
|
|
|
DIVSTAT_INC(noport);
|
2022-08-30 22:09:21 +00:00
|
|
|
m_freem(m);
|
2022-08-30 22:09:21 +00:00
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Deliver packet back into the IP processing machinery.
|
|
|
|
*
|
|
|
|
* If no address specified, or address is 0.0.0.0, send to ip_output();
|
|
|
|
* otherwise, send to ip_input() and mark as having been received on
|
|
|
|
* the interface with that address.
|
|
|
|
*/
|
|
|
|
static int
|
2022-08-30 02:15:01 +00:00
|
|
|
div_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
|
|
|
|
struct mbuf *control, struct thread *td)
|
1996-07-10 19:44:30 +00:00
|
|
|
{
|
2020-01-22 05:51:22 +00:00
|
|
|
struct epoch_tracker et;
|
2022-08-30 02:15:01 +00:00
|
|
|
struct sockaddr_in *sin = (struct sockaddr_in *)nam;
|
2020-01-23 09:14:28 +00:00
|
|
|
const struct ip *ip;
|
2004-10-03 00:26:35 +00:00
|
|
|
struct m_tag *mtag;
|
2010-01-04 19:01:22 +00:00
|
|
|
struct ipfw_rule_ref *dt;
|
2020-01-23 09:14:28 +00:00
|
|
|
int error, family;
|
Remove (almost all) global variables that were used to hold
packet forwarding state ("annotations") during ip processing.
The code is considerably cleaner now.
The variables removed by this change are:
ip_divert_cookie used by divert sockets
ip_fw_fwd_addr used for transparent ip redirection
last_pkt used by dynamic pipes in dummynet
Removal of the first two has been done by carrying the annotations
into volatile structs prepended to the mbuf chains, and adding
appropriate code to add/remove annotations in the routines which
make use of them, i.e. ip_input(), ip_output(), tcp_input(),
bdg_forward(), ether_demux(), ether_output_frame(), div_output().
On passing, remove a bug in divert handling of fragmented packet.
Now it is the fragment at offset 0 which sets the divert status of
the whole packet, whereas formerly it was the last incoming fragment
to decide.
Removal of last_pkt required a change in the interface of ip_fw_chk()
and dummynet_io(). On passing, use the same mechanism for dummynet
annotations and for divert/forward annotations.
option IPFIREWALL_FORWARD is effectively useless, the code to
implement it is very small and is now in by default to avoid the
obfuscation of conditionally compiled code.
NOTES:
* there is at least one global variable left, sro_fwd, in ip_output().
I am not sure if/how this can be removed.
* I have deliberately avoided gratuitous style changes in this commit
to avoid cluttering the diffs. Minor stule cleanup will likely be
necessary
* this commit only focused on the IP layer. I am sure there is a
number of global variables used in the TCP and maybe UDP stack.
* despite the number of files touched, there are absolutely no API's
or data structures changed by this commit (except the interfaces of
ip_fw_chk() and dummynet_io(), which are internal anyways), so
an MFC is quite safe and unintrusive (and desirable, given the
improved readability of the code).
MFC after: 10 days
2002-06-22 11:51:02 +00:00
|
|
|
|
2022-08-30 02:15:01 +00:00
|
|
|
if (control)
|
|
|
|
m_freem(control);
|
|
|
|
|
|
|
|
/* Packet must have a header (but that's about it) */
|
|
|
|
if (m->m_len < sizeof (struct ip) &&
|
|
|
|
(m = m_pullup(m, sizeof (struct ip))) == NULL) {
|
|
|
|
m_freem(m);
|
|
|
|
return (EINVAL);
|
2021-05-03 16:51:04 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if (sin != NULL) {
|
|
|
|
if (sin->sin_family != AF_INET) {
|
|
|
|
m_freem(m);
|
|
|
|
return (EAFNOSUPPORT);
|
|
|
|
}
|
|
|
|
if (sin->sin_len != sizeof(*sin)) {
|
|
|
|
m_freem(m);
|
|
|
|
return (EINVAL);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2005-05-13 11:44:37 +00:00
|
|
|
/*
|
|
|
|
* An mbuf may hasn't come from userland, but we pretend
|
|
|
|
* that it has.
|
|
|
|
*/
|
2004-11-12 22:17:42 +00:00
|
|
|
m->m_pkthdr.rcvif = NULL;
|
2005-05-13 11:44:37 +00:00
|
|
|
m->m_nextpkt = NULL;
|
2008-11-19 19:19:30 +00:00
|
|
|
M_SETFIB(m, so->so_fibnum);
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2010-01-04 19:01:22 +00:00
|
|
|
mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
|
|
|
|
if (mtag == NULL) {
|
|
|
|
/* this should be normal */
|
|
|
|
mtag = m_tag_alloc(MTAG_IPFW_RULE, 0,
|
|
|
|
sizeof(struct ipfw_rule_ref), M_NOWAIT | M_ZERO);
|
2004-11-12 22:17:42 +00:00
|
|
|
if (mtag == NULL) {
|
2020-01-23 09:14:28 +00:00
|
|
|
m_freem(m);
|
|
|
|
return (ENOBUFS);
|
2004-11-12 22:17:42 +00:00
|
|
|
}
|
|
|
|
m_tag_prepend(m, mtag);
|
2010-01-04 19:01:22 +00:00
|
|
|
}
|
|
|
|
dt = (struct ipfw_rule_ref *)(mtag+1);
|
2004-10-03 00:26:35 +00:00
|
|
|
|
1998-06-12 01:54:29 +00:00
|
|
|
/* Loopback avoidance and state recovery */
|
1998-05-25 07:41:23 +00:00
|
|
|
if (sin) {
|
Remove (almost all) global variables that were used to hold
packet forwarding state ("annotations") during ip processing.
The code is considerably cleaner now.
The variables removed by this change are:
ip_divert_cookie used by divert sockets
ip_fw_fwd_addr used for transparent ip redirection
last_pkt used by dynamic pipes in dummynet
Removal of the first two has been done by carrying the annotations
into volatile structs prepended to the mbuf chains, and adding
appropriate code to add/remove annotations in the routines which
make use of them, i.e. ip_input(), ip_output(), tcp_input(),
bdg_forward(), ether_demux(), ether_output_frame(), div_output().
On passing, remove a bug in divert handling of fragmented packet.
Now it is the fragment at offset 0 which sets the divert status of
the whole packet, whereas formerly it was the last incoming fragment
to decide.
Removal of last_pkt required a change in the interface of ip_fw_chk()
and dummynet_io(). On passing, use the same mechanism for dummynet
annotations and for divert/forward annotations.
option IPFIREWALL_FORWARD is effectively useless, the code to
implement it is very small and is now in by default to avoid the
obfuscation of conditionally compiled code.
NOTES:
* there is at least one global variable left, sro_fwd, in ip_output().
I am not sure if/how this can be removed.
* I have deliberately avoided gratuitous style changes in this commit
to avoid cluttering the diffs. Minor stule cleanup will likely be
necessary
* this commit only focused on the IP layer. I am sure there is a
number of global variables used in the TCP and maybe UDP stack.
* despite the number of files touched, there are absolutely no API's
or data structures changed by this commit (except the interfaces of
ip_fw_chk() and dummynet_io(), which are internal anyways), so
an MFC is quite safe and unintrusive (and desirable, given the
improved readability of the code).
MFC after: 10 days
2002-06-22 11:51:02 +00:00
|
|
|
int i;
|
1998-06-12 01:54:29 +00:00
|
|
|
|
2010-01-04 19:01:22 +00:00
|
|
|
/* set the starting point. We provide a non-zero slot,
|
|
|
|
* but a non_matching chain_id to skip that info and use
|
|
|
|
* the rulenum/rule_id.
|
|
|
|
*/
|
|
|
|
dt->slot = 1; /* dummy, chain_id is invalid */
|
|
|
|
dt->chain_id = 0;
|
|
|
|
dt->rulenum = sin->sin_port+1; /* host format ? */
|
|
|
|
dt->rule_id = 0;
|
2020-01-23 09:14:28 +00:00
|
|
|
/* XXX: broken for IPv6 */
|
1998-06-12 01:54:29 +00:00
|
|
|
/*
|
Remove (almost all) global variables that were used to hold
packet forwarding state ("annotations") during ip processing.
The code is considerably cleaner now.
The variables removed by this change are:
ip_divert_cookie used by divert sockets
ip_fw_fwd_addr used for transparent ip redirection
last_pkt used by dynamic pipes in dummynet
Removal of the first two has been done by carrying the annotations
into volatile structs prepended to the mbuf chains, and adding
appropriate code to add/remove annotations in the routines which
make use of them, i.e. ip_input(), ip_output(), tcp_input(),
bdg_forward(), ether_demux(), ether_output_frame(), div_output().
On passing, remove a bug in divert handling of fragmented packet.
Now it is the fragment at offset 0 which sets the divert status of
the whole packet, whereas formerly it was the last incoming fragment
to decide.
Removal of last_pkt required a change in the interface of ip_fw_chk()
and dummynet_io(). On passing, use the same mechanism for dummynet
annotations and for divert/forward annotations.
option IPFIREWALL_FORWARD is effectively useless, the code to
implement it is very small and is now in by default to avoid the
obfuscation of conditionally compiled code.
NOTES:
* there is at least one global variable left, sro_fwd, in ip_output().
I am not sure if/how this can be removed.
* I have deliberately avoided gratuitous style changes in this commit
to avoid cluttering the diffs. Minor stule cleanup will likely be
necessary
* this commit only focused on the IP layer. I am sure there is a
number of global variables used in the TCP and maybe UDP stack.
* despite the number of files touched, there are absolutely no API's
or data structures changed by this commit (except the interfaces of
ip_fw_chk() and dummynet_io(), which are internal anyways), so
an MFC is quite safe and unintrusive (and desirable, given the
improved readability of the code).
MFC after: 10 days
2002-06-22 11:51:02 +00:00
|
|
|
* Find receive interface with the given name, stuffed
|
|
|
|
* (if it exists) in the sin_zero[] field.
|
|
|
|
* The name is user supplied data so don't trust its size
|
|
|
|
* or that it is zero terminated.
|
1998-06-12 01:54:29 +00:00
|
|
|
*/
|
2003-01-28 22:44:12 +00:00
|
|
|
for (i = 0; i < sizeof(sin->sin_zero) && sin->sin_zero[i]; i++)
|
Remove (almost all) global variables that were used to hold
packet forwarding state ("annotations") during ip processing.
The code is considerably cleaner now.
The variables removed by this change are:
ip_divert_cookie used by divert sockets
ip_fw_fwd_addr used for transparent ip redirection
last_pkt used by dynamic pipes in dummynet
Removal of the first two has been done by carrying the annotations
into volatile structs prepended to the mbuf chains, and adding
appropriate code to add/remove annotations in the routines which
make use of them, i.e. ip_input(), ip_output(), tcp_input(),
bdg_forward(), ether_demux(), ether_output_frame(), div_output().
On passing, remove a bug in divert handling of fragmented packet.
Now it is the fragment at offset 0 which sets the divert status of
the whole packet, whereas formerly it was the last incoming fragment
to decide.
Removal of last_pkt required a change in the interface of ip_fw_chk()
and dummynet_io(). On passing, use the same mechanism for dummynet
annotations and for divert/forward annotations.
option IPFIREWALL_FORWARD is effectively useless, the code to
implement it is very small and is now in by default to avoid the
obfuscation of conditionally compiled code.
NOTES:
* there is at least one global variable left, sro_fwd, in ip_output().
I am not sure if/how this can be removed.
* I have deliberately avoided gratuitous style changes in this commit
to avoid cluttering the diffs. Minor stule cleanup will likely be
necessary
* this commit only focused on the IP layer. I am sure there is a
number of global variables used in the TCP and maybe UDP stack.
* despite the number of files touched, there are absolutely no API's
or data structures changed by this commit (except the interfaces of
ip_fw_chk() and dummynet_io(), which are internal anyways), so
an MFC is quite safe and unintrusive (and desirable, given the
improved readability of the code).
MFC after: 10 days
2002-06-22 11:51:02 +00:00
|
|
|
;
|
|
|
|
if ( i > 0 && i < sizeof(sin->sin_zero))
|
1998-06-12 01:54:29 +00:00
|
|
|
m->m_pkthdr.rcvif = ifunit(sin->sin_zero);
|
1998-05-25 10:37:48 +00:00
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2020-01-23 09:14:28 +00:00
|
|
|
ip = mtod(m, struct ip *);
|
|
|
|
switch (ip->ip_v) {
|
2022-08-30 22:09:21 +00:00
|
|
|
#ifdef INET
|
2020-01-23 09:14:28 +00:00
|
|
|
case IPVERSION:
|
|
|
|
family = AF_INET;
|
|
|
|
break;
|
2022-08-30 22:09:21 +00:00
|
|
|
#endif
|
2020-01-26 11:54:21 +00:00
|
|
|
#ifdef INET6
|
2020-01-23 09:14:28 +00:00
|
|
|
case IPV6_VERSION >> 4:
|
|
|
|
family = AF_INET6;
|
|
|
|
break;
|
2020-01-26 11:54:21 +00:00
|
|
|
#endif
|
2020-01-23 09:14:28 +00:00
|
|
|
default:
|
|
|
|
m_freem(m);
|
|
|
|
return (EAFNOSUPPORT);
|
|
|
|
}
|
|
|
|
|
1996-07-10 19:44:30 +00:00
|
|
|
/* Reinject packet into the system as incoming or outgoing */
|
2020-01-23 09:14:28 +00:00
|
|
|
NET_EPOCH_ENTER(et);
|
1996-07-10 19:44:30 +00:00
|
|
|
if (!sin || sin->sin_addr.s_addr == 0) {
|
2020-01-23 09:14:28 +00:00
|
|
|
dt->info |= IPFW_IS_DIVERT | IPFW_INFO_OUT;
|
|
|
|
error = div_output_outbound(family, so, m);
|
|
|
|
} else {
|
|
|
|
dt->info |= IPFW_IS_DIVERT | IPFW_INFO_IN;
|
|
|
|
error = div_output_inbound(family, so, m, sin);
|
|
|
|
}
|
|
|
|
NET_EPOCH_EXIT(et);
|
|
|
|
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Sends mbuf @m to the wire via ip[6]_output().
|
|
|
|
*
|
2021-05-07 18:27:58 +00:00
|
|
|
* Returns 0 on success or an errno value on failure. @m is always consumed.
|
2020-01-23 09:14:28 +00:00
|
|
|
*/
|
|
|
|
static int
|
|
|
|
div_output_outbound(int family, struct socket *so, struct mbuf *m)
|
|
|
|
{
|
2020-01-23 09:46:45 +00:00
|
|
|
int error;
|
2020-01-23 09:14:28 +00:00
|
|
|
|
2020-01-23 09:46:45 +00:00
|
|
|
switch (family) {
|
2022-08-30 22:09:21 +00:00
|
|
|
#ifdef INET
|
2020-01-23 09:46:45 +00:00
|
|
|
case AF_INET:
|
2022-08-30 22:09:21 +00:00
|
|
|
{
|
|
|
|
struct ip *const ip = mtod(m, struct ip *);
|
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
/* Don't allow packet length sizes that will crash. */
|
|
|
|
if (((u_short)ntohs(ip->ip_len) > m->m_pkthdr.len)) {
|
2021-05-07 18:27:58 +00:00
|
|
|
m_freem(m);
|
2020-01-23 09:46:45 +00:00
|
|
|
return (EINVAL);
|
|
|
|
}
|
|
|
|
break;
|
2022-08-30 22:09:21 +00:00
|
|
|
}
|
|
|
|
#endif
|
2011-06-27 12:21:11 +00:00
|
|
|
#ifdef INET6
|
2020-01-23 09:46:45 +00:00
|
|
|
case AF_INET6:
|
|
|
|
{
|
|
|
|
struct ip6_hdr *const ip6 = mtod(m, struct ip6_hdr *);
|
|
|
|
|
|
|
|
/* Don't allow packet length sizes that will crash */
|
|
|
|
if (((u_short)ntohs(ip6->ip6_plen) > m->m_pkthdr.len)) {
|
2021-05-07 18:27:58 +00:00
|
|
|
m_freem(m);
|
2020-01-23 09:46:45 +00:00
|
|
|
return (EINVAL);
|
2011-06-27 12:21:11 +00:00
|
|
|
}
|
2020-01-23 09:46:45 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
2003-11-08 23:09:42 +00:00
|
|
|
|
2004-06-22 03:58:50 +00:00
|
|
|
#ifdef MAC
|
2022-08-30 22:09:21 +00:00
|
|
|
mac_socket_create_mbuf(so, m);
|
2004-06-22 03:58:50 +00:00
|
|
|
#endif
|
2020-01-23 09:46:45 +00:00
|
|
|
|
|
|
|
error = 0;
|
|
|
|
switch (family) {
|
2022-08-30 22:09:21 +00:00
|
|
|
#ifdef INET
|
2020-01-23 09:46:45 +00:00
|
|
|
case AF_INET:
|
2022-08-30 22:09:21 +00:00
|
|
|
error = ip_output(m, NULL, NULL,
|
2020-01-23 09:46:45 +00:00
|
|
|
((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0)
|
|
|
|
| IP_ALLOWBROADCAST | IP_RAWOUTPUT, NULL, NULL);
|
|
|
|
break;
|
2022-08-30 22:09:21 +00:00
|
|
|
#endif
|
2011-06-27 12:21:11 +00:00
|
|
|
#ifdef INET6
|
2020-01-23 09:46:45 +00:00
|
|
|
case AF_INET6:
|
|
|
|
error = ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
|
|
|
|
break;
|
2011-06-27 12:21:11 +00:00
|
|
|
#endif
|
2020-01-23 09:46:45 +00:00
|
|
|
}
|
2022-08-30 22:09:21 +00:00
|
|
|
if (error == 0)
|
|
|
|
DIVSTAT_INC(outbound);
|
2020-01-23 09:14:28 +00:00
|
|
|
|
2020-01-23 09:46:45 +00:00
|
|
|
return (error);
|
2020-01-23 09:14:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Schedules mbuf @m for local processing via IPv4/IPv6 netisr queue.
|
|
|
|
*
|
2021-05-07 18:27:58 +00:00
|
|
|
* Returns 0 on success or an errno value on failure. @m is always consumed.
|
2020-01-23 09:14:28 +00:00
|
|
|
*/
|
|
|
|
static int
|
|
|
|
div_output_inbound(int family, struct socket *so, struct mbuf *m,
|
|
|
|
struct sockaddr_in *sin)
|
|
|
|
{
|
|
|
|
struct ifaddr *ifa;
|
|
|
|
|
2020-01-23 09:46:45 +00:00
|
|
|
if (m->m_pkthdr.rcvif == NULL) {
|
|
|
|
/*
|
|
|
|
* No luck with the name, check by IP address.
|
|
|
|
* Clear the port and the ifname to make sure
|
|
|
|
* there are no distractions for ifa_ifwithaddr.
|
|
|
|
*/
|
|
|
|
|
|
|
|
/* XXX: broken for IPv6 */
|
|
|
|
bzero(sin->sin_zero, sizeof(sin->sin_zero));
|
|
|
|
sin->sin_port = 0;
|
|
|
|
ifa = ifa_ifwithaddr((struct sockaddr *) sin);
|
2021-05-07 18:27:58 +00:00
|
|
|
if (ifa == NULL) {
|
|
|
|
m_freem(m);
|
2020-01-23 09:46:45 +00:00
|
|
|
return (EADDRNOTAVAIL);
|
2021-05-07 18:27:58 +00:00
|
|
|
}
|
2020-01-23 09:46:45 +00:00
|
|
|
m->m_pkthdr.rcvif = ifa->ifa_ifp;
|
|
|
|
}
|
2004-06-22 03:58:50 +00:00
|
|
|
#ifdef MAC
|
2020-01-23 09:46:45 +00:00
|
|
|
mac_socket_create_mbuf(so, m);
|
2004-06-22 03:58:50 +00:00
|
|
|
#endif
|
2020-01-23 09:46:45 +00:00
|
|
|
/* Send packet to input processing via netisr */
|
|
|
|
switch (family) {
|
2022-08-30 22:09:21 +00:00
|
|
|
#ifdef INET
|
2020-01-23 09:46:45 +00:00
|
|
|
case AF_INET:
|
2022-08-30 22:09:21 +00:00
|
|
|
{
|
|
|
|
const struct ip *ip;
|
|
|
|
|
2020-01-23 09:46:45 +00:00
|
|
|
ip = mtod(m, struct ip *);
|
|
|
|
/*
|
|
|
|
* Restore M_BCAST flag when destination address is
|
|
|
|
* broadcast. It is expected by ip_tryforward().
|
|
|
|
*/
|
|
|
|
if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)))
|
|
|
|
m->m_flags |= M_MCAST;
|
|
|
|
else if (in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
|
|
|
|
m->m_flags |= M_BCAST;
|
|
|
|
netisr_queue_src(NETISR_IP, (uintptr_t)so, m);
|
2022-08-30 22:09:21 +00:00
|
|
|
DIVSTAT_INC(inbound);
|
2020-01-23 09:46:45 +00:00
|
|
|
break;
|
2022-08-30 22:09:21 +00:00
|
|
|
}
|
|
|
|
#endif
|
2011-06-27 12:21:11 +00:00
|
|
|
#ifdef INET6
|
2020-01-23 09:46:45 +00:00
|
|
|
case AF_INET6:
|
|
|
|
netisr_queue_src(NETISR_IPV6, (uintptr_t)so, m);
|
2022-08-30 22:09:21 +00:00
|
|
|
DIVSTAT_INC(inbound);
|
2020-01-23 09:46:45 +00:00
|
|
|
break;
|
2011-06-27 12:21:11 +00:00
|
|
|
#endif
|
2020-01-23 09:46:45 +00:00
|
|
|
default:
|
2021-05-07 18:27:58 +00:00
|
|
|
m_freem(m);
|
2020-01-23 09:46:45 +00:00
|
|
|
return (EINVAL);
|
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2020-01-23 09:14:28 +00:00
|
|
|
return (0);
|
1996-07-10 19:44:30 +00:00
|
|
|
}
|
|
|
|
|
1997-05-24 17:23:11 +00:00
|
|
|
static int
|
2001-09-12 08:38:13 +00:00
|
|
|
div_attach(struct socket *so, int proto, struct thread *td)
|
1996-07-10 19:44:30 +00:00
|
|
|
{
|
2022-08-30 22:09:21 +00:00
|
|
|
struct divcb *dcb;
|
2003-09-05 00:00:51 +00:00
|
|
|
int error;
|
1997-05-24 17:23:11 +00:00
|
|
|
|
2006-11-06 13:42:10 +00:00
|
|
|
if (td != NULL) {
|
|
|
|
error = priv_check(td, PRIV_NETINET_DIVERT);
|
|
|
|
if (error)
|
|
|
|
return (error);
|
|
|
|
}
|
1999-12-22 19:13:38 +00:00
|
|
|
error = soreserve(so, div_sendspace, div_recvspace);
|
Update in_pcb-derived basic socket types following changes to
pru_abort(), pru_detach(), and in_pcbdetach():
- Universally support and enforce the invariant that so_pcb is
never NULL, converting dozens of unnecessary NULL checks into
assertions, and eliminating dozens of unnecessary error handling
cases in protocol code.
- In some cases, eliminate unnecessary pcbinfo locking, as it is no
longer required to ensure so_pcb != NULL. For example, in protocol
shutdown methods, and in raw IP send.
- Abort and detach protocol switch methods no longer return failures,
nor attempt to free sockets, as the socket layer does this.
- Invoke in_pcbfree() after in_pcbdetach() in order to free the
detached in_pcb structure for a socket.
MFC after: 3 months
2006-04-01 16:20:54 +00:00
|
|
|
if (error)
|
1999-12-22 19:13:38 +00:00
|
|
|
return error;
|
2022-08-30 22:09:21 +00:00
|
|
|
dcb = malloc(sizeof(*dcb), M_PCB, M_WAITOK);
|
|
|
|
dcb->dcb_bound = DCB_UNBOUND;
|
|
|
|
dcb->dcb_socket = so;
|
|
|
|
DIVERT_LOCK();
|
|
|
|
V_dcb_count++;
|
|
|
|
dcb->dcb_gencnt = ++V_dcb_gencnt;
|
|
|
|
DIVERT_UNLOCK();
|
|
|
|
so->so_pcb = dcb;
|
|
|
|
|
|
|
|
return (0);
|
1997-05-24 17:23:11 +00:00
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
|
Chance protocol switch method pru_detach() so that it returns void
rather than an error. Detaches do not "fail", they other occur or
the protocol flags SS_PROTOREF to take ownership of the socket.
soclose() no longer looks at so_pcb to see if it's NULL, relying
entirely on the protocol to decide whether it's time to free the
socket or not using SS_PROTOREF. so_pcb is now entirely owned and
managed by the protocol code. Likewise, no longer test so_pcb in
other socket functions, such as soreceive(), which have no business
digging into protocol internals.
Protocol detach routines no longer try to free the socket on detach,
this is performed in the socket code if the protocol permits it.
In rts_detach(), no longer test for rp != NULL in detach, and
likewise in other protocols that don't permit a NULL so_pcb, reduce
the incidence of testing for it during detach.
netinet and netinet6 are not fully updated to this change, which
will be in an upcoming commit. In their current state they may leak
memory or panic.
MFC after: 3 months
2006-04-01 15:42:02 +00:00
|
|
|
static void
|
2022-08-30 22:09:21 +00:00
|
|
|
div_free(epoch_context_t ctx)
|
1997-05-24 17:23:11 +00:00
|
|
|
{
|
2022-08-30 22:09:21 +00:00
|
|
|
struct divcb *dcb = __containerof(ctx, struct divcb, dcb_epochctx);
|
|
|
|
|
|
|
|
free(dcb, M_PCB);
|
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
static void
|
|
|
|
div_detach(struct socket *so)
|
|
|
|
{
|
|
|
|
struct divcb *dcb = so->so_pcb;
|
|
|
|
|
|
|
|
so->so_pcb = NULL;
|
|
|
|
DIVERT_LOCK();
|
|
|
|
if (dcb->dcb_bound != DCB_UNBOUND)
|
|
|
|
SLIST_REMOVE(&V_divhash[DCBHASH(dcb)], dcb, divcb, dcb_next);
|
|
|
|
V_dcb_count--;
|
|
|
|
V_dcb_gencnt++;
|
|
|
|
DIVERT_UNLOCK();
|
|
|
|
NET_EPOCH_CALL(div_free, &dcb->dcb_epochctx);
|
1997-05-24 17:23:11 +00:00
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
|
1997-05-24 17:23:11 +00:00
|
|
|
static int
|
2001-09-12 08:38:13 +00:00
|
|
|
div_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
|
1997-05-24 17:23:11 +00:00
|
|
|
{
|
2022-08-30 22:09:21 +00:00
|
|
|
struct divcb *dcb;
|
|
|
|
uint16_t port;
|
1997-05-24 17:23:11 +00:00
|
|
|
|
Remove (almost all) global variables that were used to hold
packet forwarding state ("annotations") during ip processing.
The code is considerably cleaner now.
The variables removed by this change are:
ip_divert_cookie used by divert sockets
ip_fw_fwd_addr used for transparent ip redirection
last_pkt used by dynamic pipes in dummynet
Removal of the first two has been done by carrying the annotations
into volatile structs prepended to the mbuf chains, and adding
appropriate code to add/remove annotations in the routines which
make use of them, i.e. ip_input(), ip_output(), tcp_input(),
bdg_forward(), ether_demux(), ether_output_frame(), div_output().
On passing, remove a bug in divert handling of fragmented packet.
Now it is the fragment at offset 0 which sets the divert status of
the whole packet, whereas formerly it was the last incoming fragment
to decide.
Removal of last_pkt required a change in the interface of ip_fw_chk()
and dummynet_io(). On passing, use the same mechanism for dummynet
annotations and for divert/forward annotations.
option IPFIREWALL_FORWARD is effectively useless, the code to
implement it is very small and is now in by default to avoid the
obfuscation of conditionally compiled code.
NOTES:
* there is at least one global variable left, sro_fwd, in ip_output().
I am not sure if/how this can be removed.
* I have deliberately avoided gratuitous style changes in this commit
to avoid cluttering the diffs. Minor stule cleanup will likely be
necessary
* this commit only focused on the IP layer. I am sure there is a
number of global variables used in the TCP and maybe UDP stack.
* despite the number of files touched, there are absolutely no API's
or data structures changed by this commit (except the interfaces of
ip_fw_chk() and dummynet_io(), which are internal anyways), so
an MFC is quite safe and unintrusive (and desirable, given the
improved readability of the code).
MFC after: 10 days
2002-06-22 11:51:02 +00:00
|
|
|
if (nam->sa_family != AF_INET)
|
Update in_pcb-derived basic socket types following changes to
pru_abort(), pru_detach(), and in_pcbdetach():
- Universally support and enforce the invariant that so_pcb is
never NULL, converting dozens of unnecessary NULL checks into
assertions, and eliminating dozens of unnecessary error handling
cases in protocol code.
- In some cases, eliminate unnecessary pcbinfo locking, as it is no
longer required to ensure so_pcb != NULL. For example, in protocol
shutdown methods, and in raw IP send.
- Abort and detach protocol switch methods no longer return failures,
nor attempt to free sockets, as the socket layer does this.
- Invoke in_pcbfree() after in_pcbdetach() in order to free the
detached in_pcb structure for a socket.
MFC after: 3 months
2006-04-01 16:20:54 +00:00
|
|
|
return EAFNOSUPPORT;
|
2021-05-03 16:51:04 +00:00
|
|
|
if (nam->sa_len != sizeof(struct sockaddr_in))
|
|
|
|
return EINVAL;
|
2022-08-30 22:09:21 +00:00
|
|
|
port = ((struct sockaddr_in *)nam)->sin_port;
|
|
|
|
DIVERT_LOCK();
|
|
|
|
SLIST_FOREACH(dcb, &V_divhash[DIVHASH(port)], dcb_next)
|
|
|
|
if (dcb->dcb_port == port) {
|
|
|
|
DIVERT_UNLOCK();
|
|
|
|
return (EADDRINUSE);
|
|
|
|
}
|
|
|
|
dcb = so->so_pcb;
|
|
|
|
if (dcb->dcb_bound != DCB_UNBOUND)
|
|
|
|
SLIST_REMOVE(&V_divhash[DCBHASH(dcb)], dcb, divcb, dcb_next);
|
|
|
|
dcb->dcb_port = port;
|
|
|
|
SLIST_INSERT_HEAD(&V_divhash[DIVHASH(port)], dcb, dcb_next);
|
|
|
|
DIVERT_UNLOCK();
|
|
|
|
|
|
|
|
return (0);
|
1997-05-24 17:23:11 +00:00
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
|
1997-05-24 17:23:11 +00:00
|
|
|
static int
|
|
|
|
div_shutdown(struct socket *so)
|
|
|
|
{
|
2003-11-08 23:09:42 +00:00
|
|
|
|
1997-05-24 17:23:11 +00:00
|
|
|
socantsendmore(so);
|
|
|
|
return 0;
|
|
|
|
}
|
1996-07-10 19:44:30 +00:00
|
|
|
|
2000-08-03 14:09:52 +00:00
|
|
|
static int
|
|
|
|
div_pcblist(SYSCTL_HANDLER_ARGS)
|
|
|
|
{
|
|
|
|
struct xinpgen xig;
|
2022-08-30 22:09:21 +00:00
|
|
|
struct divcb *dcb;
|
2019-11-07 21:27:32 +00:00
|
|
|
int error;
|
|
|
|
|
|
|
|
if (req->newptr != 0)
|
|
|
|
return EPERM;
|
2000-08-03 14:09:52 +00:00
|
|
|
|
|
|
|
if (req->oldptr == 0) {
|
2022-08-30 22:09:21 +00:00
|
|
|
u_int n;
|
2019-11-07 21:27:32 +00:00
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
n = V_dcb_count;
|
2010-08-17 16:41:16 +00:00
|
|
|
n += imax(n / 8, 10);
|
|
|
|
req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
|
2000-08-03 14:09:52 +00:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2019-11-07 21:27:32 +00:00
|
|
|
if ((error = sysctl_wire_old_buffer(req, 0)) != 0)
|
2004-02-26 00:27:04 +00:00
|
|
|
return (error);
|
2000-08-03 14:09:52 +00:00
|
|
|
|
2018-11-22 20:49:41 +00:00
|
|
|
bzero(&xig, sizeof(xig));
|
2000-08-03 14:09:52 +00:00
|
|
|
xig.xig_len = sizeof xig;
|
2022-08-30 22:09:21 +00:00
|
|
|
xig.xig_count = V_dcb_count;
|
|
|
|
xig.xig_gen = V_dcb_gencnt;
|
2000-08-03 14:09:52 +00:00
|
|
|
xig.xig_sogen = so_gencnt;
|
|
|
|
error = SYSCTL_OUT(req, &xig, sizeof xig);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
DIVERT_LOCK();
|
|
|
|
for (int i = 0; i < DIVHASHSIZE; i++)
|
|
|
|
SLIST_FOREACH(dcb, &V_divhash[i], dcb_next) {
|
|
|
|
if (dcb->dcb_gencnt <= xig.xig_gen) {
|
|
|
|
struct xinpcb xi;
|
|
|
|
|
|
|
|
bzero(&xi, sizeof(xi));
|
|
|
|
xi.xi_len = sizeof(struct xinpcb);
|
|
|
|
sotoxsocket(dcb->dcb_socket, &xi.xi_socket);
|
|
|
|
xi.inp_gencnt = dcb->dcb_gencnt;
|
|
|
|
xi.inp_vflag = INP_IPV4; /* XXX: netstat(1) */
|
|
|
|
xi.inp_inc.inc_ie.ie_lport = dcb->dcb_port;
|
|
|
|
error = SYSCTL_OUT(req, &xi, sizeof xi);
|
|
|
|
if (error)
|
|
|
|
goto errout;
|
2021-12-02 22:45:04 +00:00
|
|
|
}
|
|
|
|
}
|
2010-03-17 18:28:27 +00:00
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
/*
|
|
|
|
* Give the user an updated idea of our state.
|
|
|
|
* If the generation differs from what we told
|
|
|
|
* her before, she knows that something happened
|
|
|
|
* while we were processing this request, and it
|
|
|
|
* might be necessary to retry.
|
|
|
|
*/
|
|
|
|
xig.xig_gen = V_dcb_gencnt;
|
|
|
|
xig.xig_sogen = so_gencnt;
|
|
|
|
xig.xig_count = V_dcb_count;
|
|
|
|
error = SYSCTL_OUT(req, &xig, sizeof xig);
|
|
|
|
|
|
|
|
errout:
|
|
|
|
DIVERT_UNLOCK();
|
2019-11-07 21:27:32 +00:00
|
|
|
|
|
|
|
return (error);
|
2000-08-03 14:09:52 +00:00
|
|
|
}
|
2020-02-26 14:26:36 +00:00
|
|
|
SYSCTL_PROC(_net_inet_divert, OID_AUTO, pcblist,
|
2022-08-30 22:09:21 +00:00
|
|
|
CTLTYPE_OPAQUE | CTLFLAG_RD | CTLFLAG_MPSAFE, NULL, 0, div_pcblist,
|
|
|
|
"S,xinpcb", "List of active divert sockets");
|
2000-08-03 14:09:52 +00:00
|
|
|
|
2022-08-17 18:50:32 +00:00
|
|
|
static struct protosw div_protosw = {
|
2005-11-09 13:29:16 +00:00
|
|
|
.pr_type = SOCK_RAW,
|
|
|
|
.pr_flags = PR_ATOMIC|PR_ADDR,
|
2022-08-17 18:50:32 +00:00
|
|
|
.pr_attach = div_attach,
|
|
|
|
.pr_bind = div_bind,
|
|
|
|
.pr_detach = div_detach,
|
|
|
|
.pr_send = div_send,
|
|
|
|
.pr_shutdown = div_shutdown,
|
2004-10-19 21:14:57 +00:00
|
|
|
};
|
|
|
|
|
2022-08-30 22:09:21 +00:00
|
|
|
static struct domain divertdomain = {
|
|
|
|
.dom_family = PF_DIVERT,
|
|
|
|
.dom_name = "divert",
|
|
|
|
.dom_nprotosw = 1,
|
|
|
|
.dom_protosw = { &div_protosw },
|
|
|
|
};
|
|
|
|
|
2004-10-19 21:14:57 +00:00
|
|
|
static int
|
|
|
|
div_modevent(module_t mod, int type, void *unused)
|
|
|
|
{
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
switch (type) {
|
|
|
|
case MOD_LOAD:
|
2022-08-30 22:09:21 +00:00
|
|
|
domain_add(&divertdomain);
|
2004-10-19 21:14:57 +00:00
|
|
|
ip_divert_ptr = divert_packet;
|
|
|
|
break;
|
2004-10-22 19:12:01 +00:00
|
|
|
case MOD_QUIESCE:
|
|
|
|
/*
|
|
|
|
* IPDIVERT may normally not be unloaded because of the
|
|
|
|
* potential race conditions. Tell kldunload we can't be
|
|
|
|
* unloaded unless the unload is forced.
|
|
|
|
*/
|
|
|
|
err = EPERM;
|
|
|
|
break;
|
2004-10-19 21:14:57 +00:00
|
|
|
case MOD_UNLOAD:
|
|
|
|
/*
|
2004-10-22 19:12:01 +00:00
|
|
|
* Forced unload.
|
|
|
|
*
|
2004-10-19 21:14:57 +00:00
|
|
|
* Module ipdivert can only be unloaded if no sockets are
|
|
|
|
* connected. Maybe this can be changed later to forcefully
|
|
|
|
* disconnect any open sockets.
|
2004-10-19 21:35:42 +00:00
|
|
|
*
|
2004-10-19 22:08:13 +00:00
|
|
|
* XXXRW: Note that there is a slight race here, as a new
|
|
|
|
* socket open request could be spinning on the lock and then
|
|
|
|
* we destroy the lock.
|
2022-08-30 22:09:21 +00:00
|
|
|
*
|
|
|
|
* XXXGL: One more reason this code is incorrect is that it
|
|
|
|
* checks only the current vnet.
|
2004-10-19 21:14:57 +00:00
|
|
|
*/
|
2022-08-30 22:09:21 +00:00
|
|
|
DIVERT_LOCK();
|
|
|
|
if (V_dcb_count != 0) {
|
|
|
|
DIVERT_UNLOCK();
|
2004-10-19 21:14:57 +00:00
|
|
|
err = EBUSY;
|
|
|
|
break;
|
|
|
|
}
|
2022-08-30 22:09:21 +00:00
|
|
|
DIVERT_UNLOCK();
|
2004-10-19 21:14:57 +00:00
|
|
|
ip_divert_ptr = NULL;
|
2022-08-30 22:09:21 +00:00
|
|
|
domain_remove(&divertdomain);
|
2004-10-19 21:14:57 +00:00
|
|
|
break;
|
|
|
|
default:
|
2004-10-22 19:12:01 +00:00
|
|
|
err = EOPNOTSUPP;
|
2004-10-19 21:14:57 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
static moduledata_t ipdivertmod = {
|
|
|
|
"ipdivert",
|
|
|
|
div_modevent,
|
2012-10-10 08:36:38 +00:00
|
|
|
0
|
2004-10-19 21:14:57 +00:00
|
|
|
};
|
|
|
|
|
2016-06-01 10:14:04 +00:00
|
|
|
DECLARE_MODULE(ipdivert, ipdivertmod, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY);
|
2004-10-19 21:14:57 +00:00
|
|
|
MODULE_VERSION(ipdivert, 1);
|