9b932e9e04
and preserves the ipfw ABI. The ipfw core packet inspection and filtering functions have not been changed, only how ipfw is invoked is different. However there are many changes how ipfw is and its add-on's are handled: In general ipfw is now called through the PFIL_HOOKS and most associated magic, that was in ip_input() or ip_output() previously, is now done in ipfw_check_[in|out]() in the ipfw PFIL handler. IPDIVERT is entirely handled within the ipfw PFIL handlers. A packet to be diverted is checked if it is fragmented, if yes, ip_reass() gets in for reassembly. If not, or all fragments arrived and the packet is complete, divert_packet is called directly. For 'tee' no reassembly attempt is made and a copy of the packet is sent to the divert socket unmodified. The original packet continues its way through ip_input/output(). ipfw 'forward' is done via m_tag's. The ipfw PFIL handlers tag the packet with the new destination sockaddr_in. A check if the new destination is a local IP address is made and the m_flags are set appropriately. ip_input() and ip_output() have some more work to do here. For ip_input() the m_flags are checked and a packet for us is directly sent to the 'ours' section for further processing. Destination changes on the input path are only tagged and the 'srcrt' flag to ip_forward() is set to disable destination checks and ICMP replies at this stage. The tag is going to be handled on output. ip_output() again checks for m_flags and the 'ours' tag. If found, the packet will be dropped back to the IP netisr where it is going to be picked up by ip_input() again and the directly sent to the 'ours' section. When only the destination changes, the route's 'dst' is overwritten with the new destination from the forward m_tag. Then it jumps back at the route lookup again and skips the firewall check because it has been marked with M_SKIP_FIREWALL. ipfw 'forward' has to be compiled into the kernel with 'option IPFIREWALL_FORWARD' to enable it. DUMMYNET is entirely handled within the ipfw PFIL handlers. A packet for a dummynet pipe or queue is directly sent to dummynet_io(). Dummynet will then inject it back into ip_input/ip_output() after it has served its time. Dummynet packets are tagged and will continue from the next rule when they hit the ipfw PFIL handlers again after re-injection. BRIDGING and IPFW_ETHER are not changed yet and use ipfw_chk() directly as they did before. Later this will be changed to dedicated ETHER PFIL_HOOKS. More detailed changes to the code: conf/files Add netinet/ip_fw_pfil.c. conf/options Add IPFIREWALL_FORWARD option. modules/ipfw/Makefile Add ip_fw_pfil.c. net/bridge.c Disable PFIL_HOOKS if ipfw for bridging is active. Bridging ipfw is still directly invoked to handle layer2 headers and packets would get a double ipfw when run through PFIL_HOOKS as well. netinet/ip_divert.c Removed divert_clone() function. It is no longer used. netinet/ip_dummynet.[ch] Neither the route 'ro' nor the destination 'dst' need to be stored while in dummynet transit. Structure members and associated macros are removed. netinet/ip_fastfwd.c Removed all direct ipfw handling code and replace it with the new 'ipfw forward' handling code. netinet/ip_fw.h Removed 'ro' and 'dst' from struct ip_fw_args. netinet/ip_fw2.c (Re)moved some global variables and the module handling. netinet/ip_fw_pfil.c New file containing the ipfw PFIL handlers and module initialization. netinet/ip_input.c Removed all direct ipfw handling code and replace it with the new 'ipfw forward' handling code. ip_forward() does not longer require the 'next_hop' struct sockaddr_in argument. Disable early checks if 'srcrt' is set. netinet/ip_output.c Removed all direct ipfw handling code and replace it with the new 'ipfw forward' handling code. netinet/ip_var.h Add ip_reass() as general function. (Used from ipfw PFIL handlers for IPDIVERT.) netinet/raw_ip.c Directly check if ipfw and dummynet control pointers are active. netinet/tcp_input.c Rework the 'ipfw forward' to local code to work with the new way of forward tags. netinet/tcp_sack.c Remove include 'opt_ipfw.h' which is not needed here. sys/mbuf.h Remove m_claim_next() macro which was exclusively for ipfw 'forward' and is no longer needed. Approved by: re (scottl)
216 lines
7.9 KiB
C
216 lines
7.9 KiB
C
/*
|
|
* Copyright (c) 1982, 1986, 1993
|
|
* The Regents of the University of California. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* @(#)ip_var.h 8.2 (Berkeley) 1/9/95
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
#ifndef _NETINET_IP_VAR_H_
|
|
#define _NETINET_IP_VAR_H_
|
|
|
|
#include <sys/queue.h>
|
|
|
|
/*
|
|
* Overlay for ip header used by other protocols (tcp, udp).
|
|
*/
|
|
struct ipovly {
|
|
u_char ih_x1[9]; /* (unused) */
|
|
u_char ih_pr; /* protocol */
|
|
u_short ih_len; /* protocol length */
|
|
struct in_addr ih_src; /* source internet address */
|
|
struct in_addr ih_dst; /* destination internet address */
|
|
};
|
|
|
|
#ifdef _KERNEL
|
|
/*
|
|
* Ip reassembly queue structure. Each fragment
|
|
* being reassembled is attached to one of these structures.
|
|
* They are timed out after ipq_ttl drops to 0, and may also
|
|
* be reclaimed if memory becomes tight.
|
|
*/
|
|
struct ipq {
|
|
TAILQ_ENTRY(ipq) ipq_list; /* to other reass headers */
|
|
u_char ipq_ttl; /* time for reass q to live */
|
|
u_char ipq_p; /* protocol of this fragment */
|
|
u_short ipq_id; /* sequence id for reassembly */
|
|
struct mbuf *ipq_frags; /* to ip headers of fragments */
|
|
struct in_addr ipq_src,ipq_dst;
|
|
u_char ipq_nfrags; /* # frags in this packet */
|
|
struct label *ipq_label; /* MAC label */
|
|
};
|
|
#endif /* _KERNEL */
|
|
|
|
/*
|
|
* Structure stored in mbuf in inpcb.ip_options
|
|
* and passed to ip_output when ip options are in use.
|
|
* The actual length of the options (including ipopt_dst)
|
|
* is in m_len.
|
|
*/
|
|
#define MAX_IPOPTLEN 40
|
|
|
|
struct ipoption {
|
|
struct in_addr ipopt_dst; /* first-hop dst if source routed */
|
|
char ipopt_list[MAX_IPOPTLEN]; /* options proper */
|
|
};
|
|
|
|
/*
|
|
* Structure attached to inpcb.ip_moptions and
|
|
* passed to ip_output when IP multicast options are in use.
|
|
*/
|
|
struct ip_moptions {
|
|
struct ifnet *imo_multicast_ifp; /* ifp for outgoing multicasts */
|
|
struct in_addr imo_multicast_addr; /* ifindex/addr on MULTICAST_IF */
|
|
u_char imo_multicast_ttl; /* TTL for outgoing multicasts */
|
|
u_char imo_multicast_loop; /* 1 => hear sends if a member */
|
|
u_short imo_num_memberships; /* no. memberships this socket */
|
|
struct in_multi *imo_membership[IP_MAX_MEMBERSHIPS];
|
|
u_long imo_multicast_vif; /* vif num outgoing multicasts */
|
|
};
|
|
|
|
struct ipstat {
|
|
u_long ips_total; /* total packets received */
|
|
u_long ips_badsum; /* checksum bad */
|
|
u_long ips_tooshort; /* packet too short */
|
|
u_long ips_toosmall; /* not enough data */
|
|
u_long ips_badhlen; /* ip header length < data size */
|
|
u_long ips_badlen; /* ip length < ip header length */
|
|
u_long ips_fragments; /* fragments received */
|
|
u_long ips_fragdropped; /* frags dropped (dups, out of space) */
|
|
u_long ips_fragtimeout; /* fragments timed out */
|
|
u_long ips_forward; /* packets forwarded */
|
|
u_long ips_fastforward; /* packets fast forwarded */
|
|
u_long ips_cantforward; /* packets rcvd for unreachable dest */
|
|
u_long ips_redirectsent; /* packets forwarded on same net */
|
|
u_long ips_noproto; /* unknown or unsupported protocol */
|
|
u_long ips_delivered; /* datagrams delivered to upper level*/
|
|
u_long ips_localout; /* total ip packets generated here */
|
|
u_long ips_odropped; /* lost packets due to nobufs, etc. */
|
|
u_long ips_reassembled; /* total packets reassembled ok */
|
|
u_long ips_fragmented; /* datagrams successfully fragmented */
|
|
u_long ips_ofragments; /* output fragments created */
|
|
u_long ips_cantfrag; /* don't fragment flag was set, etc. */
|
|
u_long ips_badoptions; /* error in option processing */
|
|
u_long ips_noroute; /* packets discarded due to no route */
|
|
u_long ips_badvers; /* ip version != 4 */
|
|
u_long ips_rawout; /* total raw ip packets generated */
|
|
u_long ips_toolong; /* ip length > max ip packet size */
|
|
u_long ips_notmember; /* multicasts for unregistered grps */
|
|
u_long ips_nogif; /* no match gif found */
|
|
u_long ips_badaddr; /* invalid address on header */
|
|
};
|
|
|
|
#ifdef _KERNEL
|
|
|
|
/* flags passed to ip_output as last parameter */
|
|
#define IP_FORWARDING 0x1 /* most of ip header exists */
|
|
#define IP_RAWOUTPUT 0x2 /* raw ip header exists */
|
|
#define IP_SENDONES 0x4 /* send all-ones broadcast */
|
|
#define IP_ROUTETOIF SO_DONTROUTE /* bypass routing tables */
|
|
#define IP_ALLOWBROADCAST SO_BROADCAST /* can send broadcast packets */
|
|
|
|
/* mbuf flag used by ip_fastfwd */
|
|
#define M_FASTFWD_OURS M_PROTO1 /* changed dst to local */
|
|
|
|
struct ip;
|
|
struct inpcb;
|
|
struct route;
|
|
struct sockopt;
|
|
|
|
extern struct ipstat ipstat;
|
|
extern u_short ip_id; /* ip packet ctr, for ids */
|
|
extern int ip_defttl; /* default IP ttl */
|
|
extern int ipforwarding; /* ip forwarding */
|
|
extern int ip_doopts; /* process or ignore IP options */
|
|
#ifdef IPSTEALTH
|
|
extern int ipstealth; /* stealth forwarding */
|
|
#endif
|
|
extern u_char ip_protox[];
|
|
extern struct socket *ip_rsvpd; /* reservation protocol daemon */
|
|
extern struct socket *ip_mrouter; /* multicast routing daemon */
|
|
extern int (*legal_vif_num)(int);
|
|
extern u_long (*ip_mcast_src)(int);
|
|
extern int rsvp_on;
|
|
extern struct pr_usrreqs rip_usrreqs;
|
|
|
|
int ip_ctloutput(struct socket *, struct sockopt *sopt);
|
|
void ip_drain(void);
|
|
int ip_fragment(struct ip *ip, struct mbuf **m_frag, int mtu,
|
|
u_long if_hwassist_flags, int sw_csum);
|
|
void ip_freemoptions(struct ip_moptions *);
|
|
void ip_init(void);
|
|
extern int (*ip_mforward)(struct ip *, struct ifnet *, struct mbuf *,
|
|
struct ip_moptions *);
|
|
int ip_output(struct mbuf *,
|
|
struct mbuf *, struct route *, int, struct ip_moptions *,
|
|
struct inpcb *);
|
|
struct mbuf *
|
|
ip_reass(struct mbuf *);
|
|
struct in_ifaddr *
|
|
ip_rtaddr(struct in_addr);
|
|
void ip_savecontrol(struct inpcb *, struct mbuf **, struct ip *,
|
|
struct mbuf *);
|
|
void ip_slowtimo(void);
|
|
struct mbuf *
|
|
ip_srcroute(void);
|
|
void ip_stripoptions(struct mbuf *, struct mbuf *);
|
|
u_int16_t ip_randomid(void);
|
|
int rip_ctloutput(struct socket *, struct sockopt *);
|
|
void rip_ctlinput(int, struct sockaddr *, void *);
|
|
void rip_init(void);
|
|
void rip_input(struct mbuf *, int);
|
|
int rip_output(struct mbuf *, struct socket *, u_long);
|
|
void ipip_input(struct mbuf *, int);
|
|
void rsvp_input(struct mbuf *, int);
|
|
int ip_rsvp_init(struct socket *);
|
|
int ip_rsvp_done(void);
|
|
extern int (*ip_rsvp_vif)(struct socket *, struct sockopt *);
|
|
extern void (*ip_rsvp_force_done)(struct socket *);
|
|
extern void (*rsvp_input_p)(struct mbuf *m, int off);
|
|
|
|
#ifdef PFIL_HOOKS
|
|
extern struct pfil_head inet_pfil_hook;
|
|
#endif
|
|
|
|
void in_delayed_cksum(struct mbuf *m);
|
|
|
|
static __inline uint16_t ip_newid(void);
|
|
extern int ip_do_randomid;
|
|
|
|
static __inline uint16_t
|
|
ip_newid(void)
|
|
{
|
|
if (ip_do_randomid)
|
|
return ip_randomid();
|
|
|
|
return htons(ip_id++);
|
|
}
|
|
|
|
#endif /* _KERNEL */
|
|
|
|
#endif /* !_NETINET_IP_VAR_H_ */
|