d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFp4: anchie_soc2009 branch:

Browse Source 
Add kernel side support for Secure Neighbor Discovery (SeND), RFC 3971.

The implementation consists of a kernel module that gets packets from
the nd6 code, sends them to user space on a dedicated socket and reinjects
them back for further processing.

Hooks are used from nd6 code paths to divert relevant packets to the
send implementation for processing in user space.  The hooks are only
triggered if the send module is loaded. In case no user space
application is connected to the send socket, processing continues
normaly as if the module would not be loaded. Unloading the module
is not possible at this time due to missing nd6 locking.

The native SeND socket is similar to a raw IPv6 socket but with its own,
internal pseudo-protocol.

Approved by:	bz (mentor)
This commit is contained in:
Ana Kukec 2010-08-19 11:31:03 +00:00
parent 35efcc8b69
commit 1db8d1f843
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=211501
10 changed files with 612 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
sys/modules/Makefile
View File

@ -257,6 +257,7 @@ SUBDIR= ${_3dfx} \
${_scsi_low} \
sdhci \
sem \
send \
sf \
sge \
siba_bwn \

7
sys/modules/send/Makefile Normal file
View File

@ -0,0 +1,7 @@
# $FreeBSD$
.PATH: ${.CURDIR}/../../netinet6
KMOD= send
SRCS= send.c
.include <bsd.kmod.mk>

1
sys/netinet/in.h
View File

@ -252,6 +252,7 @@ __END_DECLS
/* Only used internally, so can be outside the range of valid IP protocols. */
#define IPPROTO_DIVERT 258 /* divert pseudo-protocol */
#define IPPROTO_SEND 259 /* SeND pseudo-protocol */
/*
* Defined to avoid confusion. The master value is defined by

125
sys/netinet6/icmp6.c
View File

@ -105,6 +105,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/scope6_var.h>
#include <netinet6/mld6_var.h>
#include <netinet6/nd6.h>
#include <netinet6/send.h>
#ifdef IPSEC
#include <netipsec/ipsec.h>
@ -414,6 +415,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
int icmp6len = m->m_pkthdr.len - *offp;
int code, sum, noff;
char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
int ip6len, error;
ifp = m->m_pkthdr.rcvif;
@ -428,6 +430,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
*/
ip6 = mtod(m, struct ip6_hdr *);
ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
if (icmp6len < sizeof(struct icmp6_hdr)) {
ICMP6STAT_INC(icp6s_tooshort);
goto freeit;
@ -766,11 +769,35 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
/* give up local */
nd6_rs_input(m, off, icmp6len);
/* Send incoming SeND packet to user space. */
if (send_sendso_input_hook != NULL) {
IP6_EXTHDR_CHECK(m, off,
icmp6len, IPPROTO_DONE);
error = send_sendso_input_hook(m, ifp,
SND_IN, ip6len);
/* -1 == no app on SEND socket */
if (error == 0)
return (IPPROTO_DONE);
nd6_rs_input(m, off, icmp6len);
} else
nd6_rs_input(m, off, icmp6len);
m = NULL;
goto freeit;
}
nd6_rs_input(n, off, icmp6len);
if (send_sendso_input_hook != NULL) {
IP6_EXTHDR_CHECK(m, off,
icmp6len, IPPROTO_DONE);
error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len);
if (error == 0) {
m_freem(n);
return (IPPROTO_DONE);
}
/* -1 == no app on SEND socket */
nd6_rs_input(n, off, icmp6len);
} else
nd6_rs_input(n, off, icmp6len);
/* m stays. */
break;
@ -781,12 +808,28 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
if (icmp6len < sizeof(struct nd_router_advert))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
/* give up local */
nd6_ra_input(m, off, icmp6len);
/* Send incoming SeND-protected/ND packet to user space. */
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(m, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
nd6_ra_input(m, off, icmp6len);
} else
nd6_ra_input(m, off, icmp6len);
m = NULL;
m_freem(n);
goto freeit;
}
nd6_ra_input(n, off, icmp6len);
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
nd6_ra_input(n, off, icmp6len);
} else
nd6_ra_input(n, off, icmp6len);
/* m stays. */
break;
@ -797,12 +840,26 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
if (icmp6len < sizeof(struct nd_neighbor_solicit))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
/* give up local */
nd6_ns_input(m, off, icmp6len);
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(m, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
nd6_ns_input(m, off, icmp6len);
} else
nd6_ns_input(m, off, icmp6len);
m_freem(n);
m = NULL;
goto freeit;
}
nd6_ns_input(n, off, icmp6len);
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
nd6_ns_input(n, off, icmp6len);
} else
nd6_ns_input(n, off, icmp6len);
/* m stays. */
break;
@ -813,12 +870,28 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
if (icmp6len < sizeof(struct nd_neighbor_advert))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
/* give up local */
nd6_na_input(m, off, icmp6len);
/* Send incoming SeND-protected/ND packet to user space. */
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(m, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
nd6_na_input(m, off, icmp6len);
} else
nd6_na_input(m, off, icmp6len);
m_freem(n);
m = NULL;
goto freeit;
}
nd6_na_input(n, off, icmp6len);
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
nd6_na_input(n, off, icmp6len);
} else
nd6_na_input(n, off, icmp6len);
/* m stays. */
break;
@ -829,12 +902,26 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
if (icmp6len < sizeof(struct nd_redirect))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
/* give up local */
icmp6_redirect_input(m, off);
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(m, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
icmp6_redirect_input(m, off);
} else
icmp6_redirect_input(m, off);
m_freem(n);
m = NULL;
goto freeit;
}
icmp6_redirect_input(n, off);
if (send_sendso_input_hook != NULL) {
error = send_sendso_input_hook(n, ifp,
SND_IN, ip6len);
if (error == 0)
return (IPPROTO_DONE);
icmp6_redirect_input(n, off);
} else
icmp6_redirect_input(n, off);
/* m stays. */
break;
@ -2476,6 +2563,7 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
struct in6_addr *router_ll6;
struct ip6_hdr *sip6; /* m0 as struct ip6_hdr */
struct mbuf *m = NULL; /* newly allocated one */
struct m_tag *mtag;
struct ip6_hdr *ip6; /* m as struct ip6_hdr */
struct nd_redirect *nd_rd;
struct llentry *ln = NULL;
@ -2735,6 +2823,15 @@ noredhdropt:;
nd_rd->nd_rd_cksum = in6_cksum(m, IPPROTO_ICMPV6,
sizeof(*ip6), ntohs(ip6->ip6_plen));
if (send_sendso_input_hook != NULL) {
mtag = m_tag_get(PACKET_TAG_ND_OUTGOING, sizeof(unsigned short),
M_NOWAIT);
if (mtag == NULL)
goto fail;
*(unsigned short *)(mtag + 1) = nd_rd->nd_rd_type;
m_tag_prepend(m, mtag);
}
/* send the packet to outside... */
ip6_output(m, NULL, NULL, 0, NULL, &outif, NULL);
if (outif) {

28
sys/netinet6/nd6.c
View File

@ -72,6 +72,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/nd6.h>
#include <netinet6/in6_ifattach.h>
#include <netinet/icmp6.h>
#include <netinet6/send.h>
#include <sys/limits.h>
@ -121,6 +122,8 @@ VNET_DEFINE(int, nd6_recalc_reachtm_interval) = ND6_RECALC_REACHTM_INTERVAL;
static struct sockaddr_in6 all1_sa;
int (*send_sendso_input_hook)(struct mbuf *, struct ifnet *, int, int);
static int nd6_is_new_addr_neighbor __P((struct sockaddr_in6 *,
struct ifnet *));
static void nd6_setmtu0(struct ifnet *, struct nd_ifinfo *);
@ -1758,9 +1761,12 @@ nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
struct mbuf **chain)
{
struct mbuf *m = m0;
struct m_tag *mtag;
struct llentry *ln = lle;
struct ip6_hdr *ip6;
int error = 0;
int flags = 0;
int ip6len;
#ifdef INVARIANTS
if (lle != NULL) {
@ -1935,6 +1941,28 @@ nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
#ifdef MAC
mac_netinet6_nd6_send(ifp, m);
#endif
/*
* If called from nd6_ns_output() (NS), nd6_na_output() (NA),
* icmp6_redirect_output() (REDIRECT) or from rip6_output() (RS, RA
* as handled by rtsol and rtadvd), mbufs will be tagged for SeND
* to be diverted to user space. When re-injected into the kernel,
* send_output() will directly dispatch them to the outgoing interface.
*/
if (send_sendso_input_hook != NULL) {
mtag = m_tag_find(m, PACKET_TAG_ND_OUTGOING, NULL);
if (mtag != NULL) {
ip6 = mtod(m, struct ip6_hdr *);
ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
/* Use the SEND socket */
error = send_sendso_input_hook(m, ifp, SND_OUT,
ip6len);
/* -1 == no app on SEND socket */
if (error == 0 || error != -1)
return (error);
}
}
/*
* We were passed in a pointer to an lle with the lock held
* this means that we can't call if_output as we will

31
sys/netinet6/nd6_nbr.c
View File

@ -73,6 +73,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/nd6.h>
#include <netinet/icmp6.h>
#include <netinet/ip_carp.h>
#include <netinet6/send.h>
#define SDL(s) ((struct sockaddr_dl *)s)
@ -379,6 +380,7 @@ nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
const struct in6_addr *taddr6, struct llentry *ln, int dad)
{
struct mbuf *m;
struct m_tag *mtag;
struct ip6_hdr *ip6;
struct nd_neighbor_solicit *nd_ns;
struct in6_addr *src, src_in;
@ -557,6 +559,15 @@ nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
nd_ns->nd_ns_cksum =
in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
if (send_sendso_input_hook != NULL) {
mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
sizeof(unsigned short), M_NOWAIT);
if (mtag == NULL)
goto bad;
*(unsigned short *)(mtag + 1) = nd_ns->nd_ns_type;
m_tag_prepend(m, mtag);
}
ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL);
icmp6_ifstat_inc(ifp, ifs6_out_msg);
icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit);
@ -604,6 +615,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
struct llentry *ln = NULL;
union nd_opts ndopts;
struct mbuf *chain = NULL;
struct m_tag *mtag;
struct sockaddr_in6 sin6;
char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
@ -873,6 +885,15 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
* we assume ifp is not a loopback here, so just set
* the 2nd argument as the 1st one.
*/
if (send_sendso_input_hook != NULL) {
mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
sizeof(unsigned short), M_NOWAIT);
if (mtag == NULL)
goto bad;
m_tag_prepend(m, mtag);
}
nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
}
}
@ -917,6 +938,7 @@ nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0,
struct sockaddr *sdl0)
{
struct mbuf *m;
struct m_tag *mtag;
struct ip6_hdr *ip6;
struct nd_neighbor_advert *nd_na;
struct ip6_moptions im6o;
@ -1055,6 +1077,15 @@ nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0,
nd_na->nd_na_cksum =
in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
if (send_sendso_input_hook != NULL) {
mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
sizeof(unsigned short), M_NOWAIT);
if (mtag == NULL)
goto bad;
*(unsigned short *)(mtag + 1) = nd_na->nd_na_type;
m_tag_prepend(m, mtag);
}
ip6_output(m, NULL, &ro, 0, &im6o, NULL, NULL);
icmp6_ifstat_inc(ifp, ifs6_out_msg);
icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert);

20
sys/netinet6/raw_ip6.c
View File

@ -92,6 +92,7 @@ __FBSDID("$FreeBSD$");
#include <netinet/icmp6.h>
#include <netinet/ip6.h>
#include <netinet/ip_var.h>
#include <netinet6/ip6protosw.h>
#include <netinet6/ip6_mroute.h>
#include <netinet6/in6_pcb.h>
@ -99,6 +100,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/nd6.h>
#include <netinet6/raw_ip6.h>
#include <netinet6/scope6_var.h>
#include <netinet6/send.h>
#ifdef IPSEC
#include <netipsec/ipsec.h>
@ -390,6 +392,7 @@ rip6_output(m, va_alist)
#endif
{
struct mbuf *control;
struct m_tag *mtag;
struct socket *so;
struct sockaddr_in6 *dstsock;
struct in6_addr *dst;
@ -532,6 +535,23 @@ rip6_output(m, va_alist)
*p = in6_cksum(m, ip6->ip6_nxt, sizeof(*ip6), plen);
}
/*
* Send RA/RS messages to user land for protection, before sending
* them to rtadvd/rtsol.
*/
if ((send_sendso_input_hook != NULL) &&
so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
switch (type) {
case ND_ROUTER_ADVERT:
case ND_ROUTER_SOLICIT:
mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
sizeof(unsigned short), M_NOWAIT);
if (mtag == NULL)
goto bad;
m_tag_prepend(m, mtag);
}
}
error = ip6_output(m, optp, NULL, 0, in6p->in6p_moptions, &oifp, in6p);
if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
if (oifp)

367
sys/netinet6/send.c Normal file
View File

@ -0,0 +1,367 @@
/*-
* Copyright (c) 2009-2010 Ana Kukec <anchie@FreeBSD.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/
#include <sys/cdefs.h>
__FBSDID("$FreeBSD$");
#include <sys/param.h>
#include <sys/kernel.h>
#include <sys/mbuf.h>
#include <sys/module.h>
#include <sys/priv.h>
#include <sys/protosw.h>
#include <sys/systm.h>
#include <sys/socket.h>
#include <sys/sockstate.h>
#include <sys/sockbuf.h>
#include <sys/socketvar.h>
#include <sys/types.h>
#include <net/route.h>
#include <net/if.h>
#include <net/if_var.h>
#include <net/vnet.h>
#include <netinet/in.h>
#include <netinet/ip_var.h>
#include <netinet/ip6.h>
#include <netinet/icmp6.h>
#include <netinet6/in6_var.h>
#include <netinet6/nd6.h>
#include <netinet6/scope6_var.h>
#include <netinet6/send.h>
MALLOC_DEFINE(M_SEND, "send", "Secure Neighbour Discovery");
/*
* The socket used to communicate with the SeND daemon.
*/
static VNET_DEFINE(struct socket *, send_so);
#define V_send_so VNET(send_so)
u_long send_sendspace = 8 * (1024 + sizeof(struct sockaddr_send));
u_long send_recvspace = 9216;
struct mtx send_mtx;
#define SEND_LOCK_INIT() mtx_init(&send_mtx, "send_mtx", NULL, MTX_DEF)
#define SEND_LOCK() mtx_lock(&send_mtx)
#define SEND_UNLOCK() mtx_unlock(&send_mtx)
#define SEND_LOCK_DESTROY() mtx_destroy(&send_mtx)
static int
send_attach(struct socket *so, int proto, struct thread *td)
{
int error;
SEND_LOCK();
if (V_send_so != NULL) {
SEND_UNLOCK();
return (EEXIST);
}
error = priv_check(td, PRIV_NETINET_RAW);
if (error) {
SEND_UNLOCK();
return(error);
}
if (proto != IPPROTO_SEND) {
SEND_UNLOCK();
return (EPROTONOSUPPORT);
}
error = soreserve(so, send_sendspace, send_recvspace);
if (error) {
SEND_UNLOCK();
return(error);
}
V_send_so = so;
SEND_UNLOCK();
return (0);
}
static int
send_output(struct mbuf *m, struct ifnet *ifp, int direction)
{
struct ip6_hdr *ip6;
struct sockaddr_in6 dst;
struct icmp6_hdr *icmp6;
int icmp6len;
/*
* Receive incoming (SeND-protected) or outgoing traffic
* (SeND-validated) from the SeND user space application.
*/
switch (direction) {
case SND_IN:
if (m->m_len < (sizeof(struct ip6_hdr) +
sizeof(struct icmp6_hdr))) {
m = m_pullup(m, sizeof(struct ip6_hdr) +
sizeof(struct icmp6_hdr));
if (!m)
return (ENOBUFS);
}
/* Before passing off the mbuf record the proper interface. */
m->m_pkthdr.rcvif = ifp;
if (m->m_flags & M_PKTHDR)
icmp6len = m->m_pkthdr.len - sizeof(struct ip6_hdr);
else
panic("Doh! not the first mbuf.");
ip6 = mtod(m, struct ip6_hdr *);
icmp6 = (struct icmp6_hdr *)(ip6 + 1);
/*
* Output the packet as icmp6.c:icpm6_input() would do.
* The mbuf is always consumed, so we do not have to
* care about that.
*/
switch (icmp6->icmp6_type) {
case ND_NEIGHBOR_SOLICIT:
nd6_ns_input(m, sizeof(struct ip6_hdr), icmp6len);
break;
case ND_NEIGHBOR_ADVERT:
nd6_na_input(m, sizeof(struct ip6_hdr), icmp6len);
break;
case ND_REDIRECT:
icmp6_redirect_input(m, sizeof(struct ip6_hdr));
break;
case ND_ROUTER_SOLICIT:
nd6_rs_input(m, sizeof(struct ip6_hdr), icmp6len);
break;
case ND_ROUTER_ADVERT:
nd6_ra_input(m, sizeof(struct ip6_hdr), icmp6len);
break;
default:
return (ENOSYS);
}
return (0);
case SND_OUT:
if (m->m_len < sizeof(struct ip6_hdr)) {
m = m_pullup(m, sizeof(struct ip6_hdr));
if (!m)
return (ENOBUFS);
}
ip6 = mtod(m, struct ip6_hdr *);
if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
m->m_flags |= M_MCAST;
bzero(&dst, sizeof(dst));
dst.sin6_family = AF_INET6;
dst.sin6_len = sizeof(dst);
dst.sin6_addr = ip6->ip6_dst;
/*
* Output the packet as nd6.c:nd6_output_lle() would do.
* The mbuf is always consumed, so we do not have to care
* about that.
* XXX-BZ as we added data, what about fragmenting,
* if now needed?
*/
int error;
error = ((*ifp->if_output)(ifp, m, (struct sockaddr *)&dst,
NULL));
if (error)
error = ENOENT;
return (error);
default:
panic("%s: direction %d neither SND_IN nor SND_OUT.",
__func__, direction);
}
}
/*
* Receive a SeND message from user space to be either send out by the kernel
* or, with SeND ICMPv6 options removed, to be further processed by the icmp6
* input path.
*/
static int
send_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
struct mbuf *control, struct thread *td)
{
struct sockaddr_send *sendsrc;
struct ifnet *ifp;
int error;
KASSERT(V_send_so == so, ("%s: socket %p not send socket %p",
__func__, so, V_send_so));
sendsrc = (struct sockaddr_send *)nam;
ifp = ifnet_byindex_ref(sendsrc->send_ifidx);
if (ifp == NULL) {
error = ENETUNREACH;
goto err;
}
error = send_output(m, ifp, sendsrc->send_direction);
if_rele(ifp);
m = NULL;
err:
if (m != NULL)
m_freem(m);
return (error);
}
static void
send_close(struct socket *so)
{
SEND_LOCK();
if (V_send_so)
V_send_so = NULL;
SEND_UNLOCK();
}
/*
* Send a SeND message to user space, that was either received and has to be
* validated or was about to be send out and has to be handled by the SEND
* daemon adding SeND ICMPv6 options.
*/
static int
send_input(struct mbuf *m, struct ifnet *ifp, int direction, int msglen __unused)
{
struct ip6_hdr *ip6;
struct sockaddr_send sendsrc;
SEND_LOCK();
if (V_send_so == NULL) {
SEND_UNLOCK();
return (-1);
}
/*
* Make sure to clear any possible internally embedded scope before
* passing the packet to user space for SeND cryptographic signature
* validation to succeed.
*/
ip6 = mtod(m, struct ip6_hdr *);
in6_clearscope(&ip6->ip6_src);
in6_clearscope(&ip6->ip6_dst);
bzero(&sendsrc, sizeof(sendsrc));
sendsrc.send_len = sizeof(sendsrc);
sendsrc.send_family = AF_INET6;
sendsrc.send_direction = direction;
sendsrc.send_ifidx = ifp->if_index;
/*
* Send incoming or outgoing traffic to user space either to be
* protected (outgoing) or validated (incoming) according to rfc3971.
*/
SOCKBUF_LOCK(&V_send_so->so_rcv);
if (sbappendaddr_locked(&V_send_so->so_rcv,
(struct sockaddr *)&sendsrc, m, NULL) == 0) {
SOCKBUF_UNLOCK(&V_send_so->so_rcv);
/* XXX stats. */
m_freem(m);
} else {
sorwakeup_locked(V_send_so);
}
SEND_UNLOCK();
return (0);
}
struct pr_usrreqs send_usrreqs = {
.pru_attach = send_attach,
.pru_send = send_send,
.pru_detach = send_close
};
struct protosw send_protosw = {
.pr_type = SOCK_RAW,
.pr_flags = PR_ATOMIC|PR_ADDR,
.pr_protocol = IPPROTO_SEND,
.pr_usrreqs = &send_usrreqs
};
static int
send_modevent(module_t mod, int type, void *unused)
{
#ifdef __notyet__
VNET_ITERATOR_DECL(vnet_iter);
#endif
int error;
switch (type) {
case MOD_LOAD:
SEND_LOCK_INIT();
error = pf_proto_register(PF_INET6, &send_protosw);
if (error != 0) {
printf("%s:%d: MOD_LOAD pf_proto_register(): %d\n",
__func__, __LINE__, error);
SEND_LOCK_DESTROY();
break;
}
send_sendso_input_hook = send_input;
break;
case MOD_UNLOAD:
/* Do not allow unloading w/o locking. */
return (EBUSY);
#ifdef __notyet__
VNET_LIST_RLOCK_NOSLEEP();
SEND_LOCK();
VNET_FOREACH(vnet_iter) {
CURVNET_SET(vnet_iter);
if (V_send_so != NULL) {
CURVNET_RESTORE();
SEND_UNLOCK();
VNET_LIST_RUNLOCK_NOSLEEP();
return (EBUSY);
}
CURVNET_RESTORE();
}
SEND_UNLOCK();
VNET_LIST_RUNLOCK_NOSLEEP();
error = pf_proto_unregister(PF_INET6, IPPROTO_SEND, SOCK_RAW);
if (error == 0)
SEND_LOCK_DESTROY();
send_sendso_input_hook = NULL;
break;
#endif
default:
error = 0;
break;
}
return (error);
}
static moduledata_t sendmod = {
"send",
send_modevent,
0
};
DECLARE_MODULE(send, sendmod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);

45
sys/netinet6/send.h Normal file
View File

@ -0,0 +1,45 @@
/*-
* Copyright (c) 2009-2010 Ana Kukec <anchie@FreeBSD.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
#ifndef _NETINET6_SEND_H_
#define _NETINET6_SEND_H_
#define SND_OUT 0 /* Outgoing traffic */
#define SND_IN 1 /* Incoming traffic. */
struct sockaddr_send {
unsigned char send_len; /* total length */
sa_family_t send_family; /* address family */
int send_direction;
int send_ifidx;
char send_zero[8];
};
extern int (*send_sendso_input_hook)(struct mbuf *, struct ifnet *, int, int);
#endif /* _NETINET6_SEND_H_ */

1
sys/sys/mbuf.h
View File

@ -903,6 +903,7 @@ struct mbuf *m_unshare(struct mbuf *, int how);
#define PACKET_TAG_IPOPTIONS 27 /* Saved IP options */
#define PACKET_TAG_CARP 28 /* CARP info */
#define PACKET_TAG_IPSEC_NAT_T_PORTS 29 /* two uint16_t */
#define PACKET_TAG_ND_OUTGOING 30 /* ND outgoing */
/* Specific cookies and tags. */