bb60f459a0
Prior to this change, Accidental recursion protection was done by the diverted daemon feeding back the divert port number it got the packet on, as the port number on a sendto(). IPFW knew not to redivert a packet to this port (again). Processing of the ruleset started at the beginning again, skipping that divert port. The new semantic (which is how we should have done it the first time) is that the port number in the sendto() is the rule number AFTER which processing should restart, and on a recvfrom(), the port number is the rule number which caused the diversion. This is much more flexible, and also more intuitive. If the user uses the same sockaddr received when resending, processing resumes at the rule number following that that caused the diversion. The user can however select to resume rule processing at any rule. (0 is restart at the beginning) To enable the new code use option IPFW_DIVERT_RESTART This should become the default as soon as people have looked at it a bit
225 lines
8.3 KiB
C
225 lines
8.3 KiB
C
/*
|
|
* Copyright (c) 1982, 1986, 1993
|
|
* The Regents of the University of California. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. All advertising materials mentioning features or use of this software
|
|
* must display the following acknowledgement:
|
|
* This product includes software developed by the University of
|
|
* California, Berkeley and its contributors.
|
|
* 4. Neither the name of the University nor the names of its contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* @(#)ip_var.h 8.2 (Berkeley) 1/9/95
|
|
* $Id: ip_var.h,v 1.37 1998/05/19 15:53:50 pb Exp $
|
|
*/
|
|
|
|
#ifndef _NETINET_IP_VAR_H_
|
|
#define _NETINET_IP_VAR_H_
|
|
|
|
/*
|
|
* Overlay for ip header used by other protocols (tcp, udp).
|
|
*/
|
|
struct ipovly {
|
|
caddr_t ih_next, ih_prev; /* for protocol sequence q's */
|
|
u_char ih_x1; /* (unused) */
|
|
u_char ih_pr; /* protocol */
|
|
u_short ih_len; /* protocol length */
|
|
struct in_addr ih_src; /* source internet address */
|
|
struct in_addr ih_dst; /* destination internet address */
|
|
};
|
|
|
|
/*
|
|
* Ip reassembly queue structure. Each fragment
|
|
* being reassembled is attached to one of these structures.
|
|
* They are timed out after ipq_ttl drops to 0, and may also
|
|
* be reclaimed if memory becomes tight.
|
|
*/
|
|
struct ipq {
|
|
struct ipq *next,*prev; /* to other reass headers */
|
|
u_char ipq_ttl; /* time for reass q to live */
|
|
u_char ipq_p; /* protocol of this fragment */
|
|
u_short ipq_id; /* sequence id for reassembly */
|
|
struct ipasfrag *ipq_next,*ipq_prev;
|
|
/* to ip headers of fragments */
|
|
struct in_addr ipq_src,ipq_dst;
|
|
#ifdef IPDIVERT
|
|
u_short ipq_divert; /* divert protocol port */
|
|
#ifdef IPFW_DIVERT_RESTART
|
|
u_short ipq_div_cookie; /* divert protocol cookie */
|
|
#endif /* IPFW_DIVERT_RESTART */
|
|
#endif
|
|
};
|
|
|
|
/*
|
|
* Ip header, when holding a fragment.
|
|
*
|
|
* Note: ipf_next must be at same offset as ipq_next above
|
|
*/
|
|
struct ipasfrag {
|
|
#if BYTE_ORDER == LITTLE_ENDIAN
|
|
u_char ip_hl:4,
|
|
ip_v:4;
|
|
#endif
|
|
#if BYTE_ORDER == BIG_ENDIAN
|
|
u_char ip_v:4,
|
|
ip_hl:4;
|
|
#endif
|
|
u_char ipf_mff; /* XXX overlays ip_tos: use low bit
|
|
* to avoid destroying tos;
|
|
* copied from (ip_off&IP_MF) */
|
|
u_short ip_len;
|
|
u_short ip_id;
|
|
u_short ip_off;
|
|
u_char ip_ttl;
|
|
u_char ip_p;
|
|
u_short ip_sum;
|
|
struct ipasfrag *ipf_next; /* next fragment */
|
|
struct ipasfrag *ipf_prev; /* previous fragment */
|
|
};
|
|
|
|
/*
|
|
* Structure stored in mbuf in inpcb.ip_options
|
|
* and passed to ip_output when ip options are in use.
|
|
* The actual length of the options (including ipopt_dst)
|
|
* is in m_len.
|
|
*/
|
|
#define MAX_IPOPTLEN 40
|
|
|
|
struct ipoption {
|
|
struct in_addr ipopt_dst; /* first-hop dst if source routed */
|
|
char ipopt_list[MAX_IPOPTLEN]; /* options proper */
|
|
};
|
|
|
|
/*
|
|
* Structure attached to inpcb.ip_moptions and
|
|
* passed to ip_output when IP multicast options are in use.
|
|
*/
|
|
struct ip_moptions {
|
|
struct ifnet *imo_multicast_ifp; /* ifp for outgoing multicasts */
|
|
u_char imo_multicast_ttl; /* TTL for outgoing multicasts */
|
|
u_char imo_multicast_loop; /* 1 => hear sends if a member */
|
|
u_short imo_num_memberships; /* no. memberships this socket */
|
|
struct in_multi *imo_membership[IP_MAX_MEMBERSHIPS];
|
|
u_long imo_multicast_vif; /* vif num outgoing multicasts */
|
|
};
|
|
|
|
struct ipstat {
|
|
u_long ips_total; /* total packets received */
|
|
u_long ips_badsum; /* checksum bad */
|
|
u_long ips_tooshort; /* packet too short */
|
|
u_long ips_toosmall; /* not enough data */
|
|
u_long ips_badhlen; /* ip header length < data size */
|
|
u_long ips_badlen; /* ip length < ip header length */
|
|
u_long ips_fragments; /* fragments received */
|
|
u_long ips_fragdropped; /* frags dropped (dups, out of space) */
|
|
u_long ips_fragtimeout; /* fragments timed out */
|
|
u_long ips_forward; /* packets forwarded */
|
|
u_long ips_fastforward; /* packets fast forwarded */
|
|
u_long ips_cantforward; /* packets rcvd for unreachable dest */
|
|
u_long ips_redirectsent; /* packets forwarded on same net */
|
|
u_long ips_noproto; /* unknown or unsupported protocol */
|
|
u_long ips_delivered; /* datagrams delivered to upper level*/
|
|
u_long ips_localout; /* total ip packets generated here */
|
|
u_long ips_odropped; /* lost packets due to nobufs, etc. */
|
|
u_long ips_reassembled; /* total packets reassembled ok */
|
|
u_long ips_fragmented; /* datagrams successfully fragmented */
|
|
u_long ips_ofragments; /* output fragments created */
|
|
u_long ips_cantfrag; /* don't fragment flag was set, etc. */
|
|
u_long ips_badoptions; /* error in option processing */
|
|
u_long ips_noroute; /* packets discarded due to no route */
|
|
u_long ips_badvers; /* ip version != 4 */
|
|
u_long ips_rawout; /* total raw ip packets generated */
|
|
u_long ips_toolong; /* ip length > max ip packet size */
|
|
u_long ips_notmember; /* multicasts for unregistered grps */
|
|
};
|
|
|
|
#ifdef KERNEL
|
|
/* flags passed to ip_output as last parameter */
|
|
#define IP_FORWARDING 0x1 /* most of ip header exists */
|
|
#define IP_RAWOUTPUT 0x2 /* raw ip header exists */
|
|
#define IP_ROUTETOIF SO_DONTROUTE /* bypass routing tables */
|
|
#define IP_ALLOWBROADCAST SO_BROADCAST /* can send broadcast packets */
|
|
|
|
struct inpcb;
|
|
struct route;
|
|
|
|
extern struct ipstat ipstat;
|
|
extern u_short ip_id; /* ip packet ctr, for ids */
|
|
extern int ip_defttl; /* default IP ttl */
|
|
extern int ipforwarding; /* ip forwarding */
|
|
extern u_char ip_protox[];
|
|
extern struct socket *ip_rsvpd; /* reservation protocol daemon */
|
|
extern struct socket *ip_mrouter; /* multicast routing daemon */
|
|
extern int (*legal_vif_num) __P((int));
|
|
extern u_long (*ip_mcast_src) __P((int));
|
|
extern int rsvp_on;
|
|
extern struct pr_usrreqs rip_usrreqs;
|
|
|
|
int ip_ctloutput __P((int, struct socket *, int, int, struct mbuf **,
|
|
struct proc *));
|
|
void ip_drain __P((void));
|
|
void ip_freemoptions __P((struct ip_moptions *));
|
|
void ip_init __P((void));
|
|
extern int (*ip_mforward) __P((struct ip *, struct ifnet *, struct mbuf *,
|
|
struct ip_moptions *));
|
|
int ip_output __P((struct mbuf *,
|
|
struct mbuf *, struct route *, int, struct ip_moptions *));
|
|
void ip_savecontrol __P((struct inpcb *, struct mbuf **, struct ip *,
|
|
struct mbuf *));
|
|
void ip_slowtimo __P((void));
|
|
struct mbuf *
|
|
ip_srcroute __P((void));
|
|
void ip_stripoptions __P((struct mbuf *, struct mbuf *));
|
|
int rip_ctloutput __P((int, struct socket *, int, int, struct mbuf **,
|
|
struct proc *p));
|
|
void rip_ctlinput __P((int, struct sockaddr *, void *));
|
|
void rip_init __P((void));
|
|
void rip_input __P((struct mbuf *, int));
|
|
int rip_output __P((struct mbuf *, struct socket *, u_long));
|
|
void ipip_input __P((struct mbuf *, int));
|
|
void rsvp_input __P((struct mbuf *, int));
|
|
int ip_rsvp_init __P((struct socket *));
|
|
int ip_rsvp_done __P((void));
|
|
int ip_rsvp_vif_init __P((struct socket *, struct mbuf *));
|
|
int ip_rsvp_vif_done __P((struct socket *, struct mbuf *));
|
|
void ip_rsvp_force_done __P((struct socket *));
|
|
|
|
#ifdef IPDIVERT
|
|
void div_init __P((void));
|
|
void div_input __P((struct mbuf *, int));
|
|
extern struct pr_usrreqs div_usrreqs;
|
|
extern u_short ip_divert_port;
|
|
#ifndef IPFW_DIVERT_RESTART
|
|
extern u_short ip_divert_ignore;
|
|
#else
|
|
extern u_short ip_divert_in_cookie;
|
|
extern u_short ip_divert_out_cookie;
|
|
|
|
#endif /* IPFW_DIVERT_RESTART */
|
|
#endif /* IPDIVERT */
|
|
|
|
#endif /* KERNEL */
|
|
|
|
#endif /* _NETINET_IP_VAR_H_ */
|