182}
183
184/*
185 * Divert a packet by passing it up to the divert socket at port 'port'.
186 *
187 * Setup generic address and protocol structures for div_input routine,
188 * then pass them along with mbuf chain.
189 */
190static void
191divert_packet(struct mbuf *m, int incoming)
192{
193 struct ip *ip;
194 struct inpcb *inp;
195 struct socket *sa;
196 u_int16_t nport;
197 struct sockaddr_in divsrc;
198 struct m_tag *mtag;
199
200 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
201 if (mtag == NULL) {
202 m_freem(m);
203 return;
204 }
205 /* Assure header */
206 if (m->m_len < sizeof(struct ip) &&
207 (m = m_pullup(m, sizeof(struct ip))) == 0)
208 return;
209 ip = mtod(m, struct ip *);
210
211 /* Delayed checksums are currently not compatible with divert. */
212 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
213 in_delayed_cksum(m);
214 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
215 }
216#ifdef SCTP
217 if (m->m_pkthdr.csum_flags & CSUM_SCTP) {
218 sctp_delayed_cksum(m, (uint32_t)(ip->ip_hl << 2));
219 m->m_pkthdr.csum_flags &= ~CSUM_SCTP;
220 }
221#endif
222 bzero(&divsrc, sizeof(divsrc));
223 divsrc.sin_len = sizeof(divsrc);
224 divsrc.sin_family = AF_INET;
225 /* record matching rule, in host format */
226 divsrc.sin_port = ((struct ipfw_rule_ref *)(mtag+1))->rulenum;
227 /*
228 * Record receive interface address, if any.
229 * But only for incoming packets.
230 */
231 if (incoming) {
232 struct ifaddr *ifa;
233 struct ifnet *ifp;
234
235 /* Sanity check */
236 M_ASSERTPKTHDR(m);
237
238 /* Find IP address for receive interface */
239 ifp = m->m_pkthdr.rcvif;
240 if_addr_rlock(ifp);
241 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
242 if (ifa->ifa_addr->sa_family != AF_INET)
243 continue;
244 divsrc.sin_addr =
245 ((struct sockaddr_in *) ifa->ifa_addr)->sin_addr;
246 break;
247 }
248 if_addr_runlock(ifp);
249 }
250 /*
251 * Record the incoming interface name whenever we have one.
252 */
253 if (m->m_pkthdr.rcvif) {
254 /*
255 * Hide the actual interface name in there in the
256 * sin_zero array. XXX This needs to be moved to a
257 * different sockaddr type for divert, e.g.
258 * sockaddr_div with multiple fields like
259 * sockaddr_dl. Presently we have only 7 bytes
260 * but that will do for now as most interfaces
261 * are 4 or less + 2 or less bytes for unit.
262 * There is probably a faster way of doing this,
263 * possibly taking it from the sockaddr_dl on the iface.
264 * This solves the problem of a P2P link and a LAN interface
265 * having the same address, which can result in the wrong
266 * interface being assigned to the packet when fed back
267 * into the divert socket. Theoretically if the daemon saves
268 * and re-uses the sockaddr_in as suggested in the man pages,
269 * this iface name will come along for the ride.
270 * (see div_output for the other half of this.)
271 */
272 strlcpy(divsrc.sin_zero, m->m_pkthdr.rcvif->if_xname,
273 sizeof(divsrc.sin_zero));
274 }
275
276 /* Put packet on socket queue, if any */
277 sa = NULL;
278 nport = htons((u_int16_t)(((struct ipfw_rule_ref *)(mtag+1))->info));
279 INP_INFO_RLOCK(&V_divcbinfo);
280 LIST_FOREACH(inp, &V_divcb, inp_list) {
281 /* XXX why does only one socket match? */
282 if (inp->inp_lport == nport) {
283 INP_RLOCK(inp);
284 sa = inp->inp_socket;
285 SOCKBUF_LOCK(&sa->so_rcv);
286 if (sbappendaddr_locked(&sa->so_rcv,
287 (struct sockaddr *)&divsrc, m,
288 (struct mbuf *)0) == 0) {
289 SOCKBUF_UNLOCK(&sa->so_rcv);
290 sa = NULL; /* force mbuf reclaim below */
291 } else
292 sorwakeup_locked(sa);
293 INP_RUNLOCK(inp);
294 break;
295 }
296 }
297 INP_INFO_RUNLOCK(&V_divcbinfo);
298 if (sa == NULL) {
299 m_freem(m);
300 KMOD_IPSTAT_INC(ips_noproto);
301 KMOD_IPSTAT_DEC(ips_delivered);
302 }
303}
304
305/*
306 * Deliver packet back into the IP processing machinery.
307 *
308 * If no address specified, or address is 0.0.0.0, send to ip_output();
309 * otherwise, send to ip_input() and mark as having been received on
310 * the interface with that address.
311 */
312static int
313div_output(struct socket *so, struct mbuf *m, struct sockaddr_in *sin,
314 struct mbuf *control)
315{
316 struct ip *const ip = mtod(m, struct ip *);
317 struct m_tag *mtag;
318 struct ipfw_rule_ref *dt;
319 int error = 0;
320
321 /*
322 * An mbuf may hasn't come from userland, but we pretend
323 * that it has.
324 */
325 m->m_pkthdr.rcvif = NULL;
326 m->m_nextpkt = NULL;
327 M_SETFIB(m, so->so_fibnum);
328
329 if (control)
330 m_freem(control); /* XXX */
331
332 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
333 if (mtag == NULL) {
334 /* this should be normal */
335 mtag = m_tag_alloc(MTAG_IPFW_RULE, 0,
336 sizeof(struct ipfw_rule_ref), M_NOWAIT | M_ZERO);
337 if (mtag == NULL) {
338 error = ENOBUFS;
339 goto cantsend;
340 }
341 m_tag_prepend(m, mtag);
342 }
343 dt = (struct ipfw_rule_ref *)(mtag+1);
344
345 /* Loopback avoidance and state recovery */
346 if (sin) {
347 int i;
348
349 /* set the starting point. We provide a non-zero slot,
350 * but a non_matching chain_id to skip that info and use
351 * the rulenum/rule_id.
352 */
353 dt->slot = 1; /* dummy, chain_id is invalid */
354 dt->chain_id = 0;
355 dt->rulenum = sin->sin_port+1; /* host format ? */
356 dt->rule_id = 0;
357 /*
358 * Find receive interface with the given name, stuffed
359 * (if it exists) in the sin_zero[] field.
360 * The name is user supplied data so don't trust its size
361 * or that it is zero terminated.
362 */
363 for (i = 0; i < sizeof(sin->sin_zero) && sin->sin_zero[i]; i++)
364 ;
365 if ( i > 0 && i < sizeof(sin->sin_zero))
366 m->m_pkthdr.rcvif = ifunit(sin->sin_zero);
367 }
368
369 /* Reinject packet into the system as incoming or outgoing */
370 if (!sin || sin->sin_addr.s_addr == 0) {
371 struct mbuf *options = NULL;
372 struct inpcb *inp;
373
374 dt->info |= IPFW_IS_DIVERT | IPFW_INFO_OUT;
375 inp = sotoinpcb(so);
376 INP_RLOCK(inp);
377 switch (ip->ip_v) {
378 case IPVERSION:
379 /*
380 * Don't allow both user specified and setsockopt
381 * options, and don't allow packet length sizes that
382 * will crash.
383 */
384 if ((((ip->ip_hl << 2) != sizeof(struct ip)) &&
385 inp->inp_options != NULL) ||
386 ((u_short)ntohs(ip->ip_len) > m->m_pkthdr.len)) {
387 error = EINVAL;
388 INP_RUNLOCK(inp);
389 goto cantsend;
390 }
391 break;
392#ifdef INET6
393 case IPV6_VERSION >> 4:
394 {
395 struct ip6_hdr *const ip6 = mtod(m, struct ip6_hdr *);
396
397 /* Don't allow packet length sizes that will crash */
398 if (((u_short)ntohs(ip6->ip6_plen) > m->m_pkthdr.len)) {
399 error = EINVAL;
400 INP_RUNLOCK(inp);
401 goto cantsend;
402 }
403 break;
404 }
405#endif
406 default:
407 error = EINVAL;
408 INP_RUNLOCK(inp);
409 goto cantsend;
410 }
411
412 /* Send packet to output processing */
413 KMOD_IPSTAT_INC(ips_rawout); /* XXX */
414
415#ifdef MAC
416 mac_inpcb_create_mbuf(inp, m);
417#endif
418 /*
419 * Get ready to inject the packet into ip_output().
420 * Just in case socket options were specified on the
421 * divert socket, we duplicate them. This is done
422 * to avoid having to hold the PCB locks over the call
423 * to ip_output(), as doing this results in a number of
424 * lock ordering complexities.
425 *
426 * Note that we set the multicast options argument for
427 * ip_output() to NULL since it should be invariant that
428 * they are not present.
429 */
430 KASSERT(inp->inp_moptions == NULL,
431 ("multicast options set on a divert socket"));
432 /*
433 * XXXCSJP: It is unclear to me whether or not it makes
434 * sense for divert sockets to have options. However,
435 * for now we will duplicate them with the INP locks
436 * held so we can use them in ip_output() without
437 * requring a reference to the pcb.
438 */
439 if (inp->inp_options != NULL) {
440 options = m_dup(inp->inp_options, M_NOWAIT);
441 if (options == NULL) {
442 INP_RUNLOCK(inp);
443 error = ENOBUFS;
444 goto cantsend;
445 }
446 }
447 INP_RUNLOCK(inp);
448
449 switch (ip->ip_v) {
450 case IPVERSION:
451 error = ip_output(m, options, NULL,
452 ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0)
453 | IP_ALLOWBROADCAST | IP_RAWOUTPUT, NULL, NULL);
454 break;
455#ifdef INET6
456 case IPV6_VERSION >> 4:
457 error = ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
458 break;
459#endif
460 }
461 if (options != NULL)
462 m_freem(options);
463 } else {
464 dt->info |= IPFW_IS_DIVERT | IPFW_INFO_IN;
465 if (m->m_pkthdr.rcvif == NULL) {
466 /*
467 * No luck with the name, check by IP address.
468 * Clear the port and the ifname to make sure
469 * there are no distractions for ifa_ifwithaddr.
470 */
471 struct ifaddr *ifa;
472
473 bzero(sin->sin_zero, sizeof(sin->sin_zero));
474 sin->sin_port = 0;
475 ifa = ifa_ifwithaddr((struct sockaddr *) sin);
476 if (ifa == NULL) {
477 error = EADDRNOTAVAIL;
478 goto cantsend;
479 }
480 m->m_pkthdr.rcvif = ifa->ifa_ifp;
481 ifa_free(ifa);
482 }
483#ifdef MAC
484 mac_socket_create_mbuf(so, m);
485#endif
486 /* Send packet to input processing via netisr */
487 switch (ip->ip_v) {
488 case IPVERSION:
489 netisr_queue_src(NETISR_IP, (uintptr_t)so, m);
490 break;
491#ifdef INET6
492 case IPV6_VERSION >> 4:
493 netisr_queue_src(NETISR_IPV6, (uintptr_t)so, m);
494 break;
495#endif
496 default:
497 error = EINVAL;
498 goto cantsend;
499 }
500 }
501
502 return (error);
503
504cantsend:
505 m_freem(m);
506 return (error);
507}
508
509static int
510div_attach(struct socket *so, int proto, struct thread *td)
511{
512 struct inpcb *inp;
513 int error;
514
515 inp = sotoinpcb(so);
516 KASSERT(inp == NULL, ("div_attach: inp != NULL"));
517 if (td != NULL) {
518 error = priv_check(td, PRIV_NETINET_DIVERT);
519 if (error)
520 return (error);
521 }
522 error = soreserve(so, div_sendspace, div_recvspace);
523 if (error)
524 return error;
525 INP_INFO_WLOCK(&V_divcbinfo);
526 error = in_pcballoc(so, &V_divcbinfo);
527 if (error) {
528 INP_INFO_WUNLOCK(&V_divcbinfo);
529 return error;
530 }
531 inp = (struct inpcb *)so->so_pcb;
532 INP_INFO_WUNLOCK(&V_divcbinfo);
533 inp->inp_ip_p = proto;
534 inp->inp_vflag |= INP_IPV4;
535 inp->inp_flags |= INP_HDRINCL;
536 INP_WUNLOCK(inp);
537 return 0;
538}
539
540static void
541div_detach(struct socket *so)
542{
543 struct inpcb *inp;
544
545 inp = sotoinpcb(so);
546 KASSERT(inp != NULL, ("div_detach: inp == NULL"));
547 INP_INFO_WLOCK(&V_divcbinfo);
548 INP_WLOCK(inp);
549 in_pcbdetach(inp);
550 in_pcbfree(inp);
551 INP_INFO_WUNLOCK(&V_divcbinfo);
552}
553
554static int
555div_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
556{
557 struct inpcb *inp;
558 int error;
559
560 inp = sotoinpcb(so);
561 KASSERT(inp != NULL, ("div_bind: inp == NULL"));
562 /* in_pcbbind assumes that nam is a sockaddr_in
563 * and in_pcbbind requires a valid address. Since divert
564 * sockets don't we need to make sure the address is
565 * filled in properly.
566 * XXX -- divert should not be abusing in_pcbind
567 * and should probably have its own family.
568 */
569 if (nam->sa_family != AF_INET)
570 return EAFNOSUPPORT;
571 ((struct sockaddr_in *)nam)->sin_addr.s_addr = INADDR_ANY;
572 INP_INFO_WLOCK(&V_divcbinfo);
573 INP_WLOCK(inp);
574 INP_HASH_WLOCK(&V_divcbinfo);
575 error = in_pcbbind(inp, nam, td->td_ucred);
576 INP_HASH_WUNLOCK(&V_divcbinfo);
577 INP_WUNLOCK(inp);
578 INP_INFO_WUNLOCK(&V_divcbinfo);
579 return error;
580}
581
582static int
583div_shutdown(struct socket *so)
584{
585 struct inpcb *inp;
586
587 inp = sotoinpcb(so);
588 KASSERT(inp != NULL, ("div_shutdown: inp == NULL"));
589 INP_WLOCK(inp);
590 socantsendmore(so);
591 INP_WUNLOCK(inp);
592 return 0;
593}
594
595static int
596div_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
597 struct mbuf *control, struct thread *td)
598{
599
600 /* Packet must have a header (but that's about it) */
601 if (m->m_len < sizeof (struct ip) &&
602 (m = m_pullup(m, sizeof (struct ip))) == 0) {
603 KMOD_IPSTAT_INC(ips_toosmall);
604 m_freem(m);
605 return EINVAL;
606 }
607
608 /* Send packet */
609 return div_output(so, m, (struct sockaddr_in *)nam, control);
610}
611
612static void
613div_ctlinput(int cmd, struct sockaddr *sa, void *vip)
614{
615 struct in_addr faddr;
616
617 faddr = ((struct sockaddr_in *)sa)->sin_addr;
618 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
619 return;
620 if (PRC_IS_REDIRECT(cmd))
621 return;
622}
623
624static int
625div_pcblist(SYSCTL_HANDLER_ARGS)
626{
627 int error, i, n;
628 struct inpcb *inp, **inp_list;
629 inp_gen_t gencnt;
630 struct xinpgen xig;
631
632 /*
633 * The process of preparing the TCB list is too time-consuming and
634 * resource-intensive to repeat twice on every request.
635 */
636 if (req->oldptr == 0) {
637 n = V_divcbinfo.ipi_count;
638 n += imax(n / 8, 10);
639 req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
640 return 0;
641 }
642
643 if (req->newptr != 0)
644 return EPERM;
645
646 /*
647 * OK, now we're committed to doing something.
648 */
649 INP_INFO_RLOCK(&V_divcbinfo);
650 gencnt = V_divcbinfo.ipi_gencnt;
651 n = V_divcbinfo.ipi_count;
652 INP_INFO_RUNLOCK(&V_divcbinfo);
653
654 error = sysctl_wire_old_buffer(req,
655 2 * sizeof(xig) + n*sizeof(struct xinpcb));
656 if (error != 0)
657 return (error);
658
659 xig.xig_len = sizeof xig;
660 xig.xig_count = n;
661 xig.xig_gen = gencnt;
662 xig.xig_sogen = so_gencnt;
663 error = SYSCTL_OUT(req, &xig, sizeof xig);
664 if (error)
665 return error;
666
667 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
668 if (inp_list == 0)
669 return ENOMEM;
670
671 INP_INFO_RLOCK(&V_divcbinfo);
672 for (inp = LIST_FIRST(V_divcbinfo.ipi_listhead), i = 0; inp && i < n;
673 inp = LIST_NEXT(inp, inp_list)) {
674 INP_WLOCK(inp);
675 if (inp->inp_gencnt <= gencnt &&
676 cr_canseeinpcb(req->td->td_ucred, inp) == 0) {
677 in_pcbref(inp);
678 inp_list[i++] = inp;
679 }
680 INP_WUNLOCK(inp);
681 }
682 INP_INFO_RUNLOCK(&V_divcbinfo);
683 n = i;
684
685 error = 0;
686 for (i = 0; i < n; i++) {
687 inp = inp_list[i];
688 INP_RLOCK(inp);
689 if (inp->inp_gencnt <= gencnt) {
690 struct xinpcb xi;
691 bzero(&xi, sizeof(xi));
692 xi.xi_len = sizeof xi;
693 /* XXX should avoid extra copy */
694 bcopy(inp, &xi.xi_inp, sizeof *inp);
695 if (inp->inp_socket)
696 sotoxsocket(inp->inp_socket, &xi.xi_socket);
697 INP_RUNLOCK(inp);
698 error = SYSCTL_OUT(req, &xi, sizeof xi);
699 } else
700 INP_RUNLOCK(inp);
701 }
702 INP_INFO_WLOCK(&V_divcbinfo);
703 for (i = 0; i < n; i++) {
704 inp = inp_list[i];
705 INP_RLOCK(inp);
706 if (!in_pcbrele_rlocked(inp))
707 INP_RUNLOCK(inp);
708 }
709 INP_INFO_WUNLOCK(&V_divcbinfo);
710
711 if (!error) {
712 /*
713 * Give the user an updated idea of our state.
714 * If the generation differs from what we told
715 * her before, she knows that something happened
716 * while we were processing this request, and it
717 * might be necessary to retry.
718 */
719 INP_INFO_RLOCK(&V_divcbinfo);
720 xig.xig_gen = V_divcbinfo.ipi_gencnt;
721 xig.xig_sogen = so_gencnt;
722 xig.xig_count = V_divcbinfo.ipi_count;
723 INP_INFO_RUNLOCK(&V_divcbinfo);
724 error = SYSCTL_OUT(req, &xig, sizeof xig);
725 }
726 free(inp_list, M_TEMP);
727 return error;
728}
729
730#ifdef SYSCTL_NODE
731static SYSCTL_NODE(_net_inet, IPPROTO_DIVERT, divert, CTLFLAG_RW, 0,
732 "IPDIVERT");
733SYSCTL_PROC(_net_inet_divert, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
734 NULL, 0, div_pcblist, "S,xinpcb", "List of active divert sockets");
735#endif
736
737struct pr_usrreqs div_usrreqs = {
738 .pru_attach = div_attach,
739 .pru_bind = div_bind,
740 .pru_control = in_control,
741 .pru_detach = div_detach,
742 .pru_peeraddr = in_getpeeraddr,
743 .pru_send = div_send,
744 .pru_shutdown = div_shutdown,
745 .pru_sockaddr = in_getsockaddr,
746 .pru_sosetlabel = in_pcbsosetlabel
747};
748
749struct protosw div_protosw = {
750 .pr_type = SOCK_RAW,
751 .pr_protocol = IPPROTO_DIVERT,
752 .pr_flags = PR_ATOMIC|PR_ADDR,
753 .pr_input = div_input,
754 .pr_ctlinput = div_ctlinput,
755 .pr_ctloutput = ip_ctloutput,
756 .pr_init = div_init,
757#ifdef VIMAGE
758 .pr_destroy = div_destroy,
759#endif
760 .pr_usrreqs = &div_usrreqs
761};
762
763static int
764div_modevent(module_t mod, int type, void *unused)
765{
766 int err = 0;
767#ifndef VIMAGE
768 int n;
769#endif
770
771 switch (type) {
772 case MOD_LOAD:
773 /*
774 * Protocol will be initialized by pf_proto_register().
775 * We don't have to register ip_protox because we are not
776 * a true IP protocol that goes over the wire.
777 */
778 err = pf_proto_register(PF_INET, &div_protosw);
779 if (err != 0)
780 return (err);
781 ip_divert_ptr = divert_packet;
782 ip_divert_event_tag = EVENTHANDLER_REGISTER(maxsockets_change,
783 div_zone_change, NULL, EVENTHANDLER_PRI_ANY);
784 break;
785 case MOD_QUIESCE:
786 /*
787 * IPDIVERT may normally not be unloaded because of the
788 * potential race conditions. Tell kldunload we can't be
789 * unloaded unless the unload is forced.
790 */
791 err = EPERM;
792 break;
793 case MOD_UNLOAD:
794#ifdef VIMAGE
795 err = EPERM;
796 break;
797#else
798 /*
799 * Forced unload.
800 *
801 * Module ipdivert can only be unloaded if no sockets are
802 * connected. Maybe this can be changed later to forcefully
803 * disconnect any open sockets.
804 *
805 * XXXRW: Note that there is a slight race here, as a new
806 * socket open request could be spinning on the lock and then
807 * we destroy the lock.
808 */
809 INP_INFO_WLOCK(&V_divcbinfo);
810 n = V_divcbinfo.ipi_count;
811 if (n != 0) {
812 err = EBUSY;
813 INP_INFO_WUNLOCK(&V_divcbinfo);
814 break;
815 }
816 ip_divert_ptr = NULL;
817 err = pf_proto_unregister(PF_INET, IPPROTO_DIVERT, SOCK_RAW);
818 INP_INFO_WUNLOCK(&V_divcbinfo);
819 div_destroy();
820 EVENTHANDLER_DEREGISTER(maxsockets_change, ip_divert_event_tag);
821 break;
822#endif /* !VIMAGE */
823 default:
824 err = EOPNOTSUPP;
825 break;
826 }
827 return err;
828}
829
830static moduledata_t ipdivertmod = {
831 "ipdivert",
832 div_modevent,
833 0
834};
835
836DECLARE_MODULE(ipdivert, ipdivertmod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
837MODULE_DEPEND(ipdivert, ipfw, 2, 2, 2);
838MODULE_VERSION(ipdivert, 1);
| 184}
185
186/*
187 * Divert a packet by passing it up to the divert socket at port 'port'.
188 *
189 * Setup generic address and protocol structures for div_input routine,
190 * then pass them along with mbuf chain.
191 */
192static void
193divert_packet(struct mbuf *m, int incoming)
194{
195 struct ip *ip;
196 struct inpcb *inp;
197 struct socket *sa;
198 u_int16_t nport;
199 struct sockaddr_in divsrc;
200 struct m_tag *mtag;
201
202 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
203 if (mtag == NULL) {
204 m_freem(m);
205 return;
206 }
207 /* Assure header */
208 if (m->m_len < sizeof(struct ip) &&
209 (m = m_pullup(m, sizeof(struct ip))) == 0)
210 return;
211 ip = mtod(m, struct ip *);
212
213 /* Delayed checksums are currently not compatible with divert. */
214 if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
215 in_delayed_cksum(m);
216 m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
217 }
218#ifdef SCTP
219 if (m->m_pkthdr.csum_flags & CSUM_SCTP) {
220 sctp_delayed_cksum(m, (uint32_t)(ip->ip_hl << 2));
221 m->m_pkthdr.csum_flags &= ~CSUM_SCTP;
222 }
223#endif
224 bzero(&divsrc, sizeof(divsrc));
225 divsrc.sin_len = sizeof(divsrc);
226 divsrc.sin_family = AF_INET;
227 /* record matching rule, in host format */
228 divsrc.sin_port = ((struct ipfw_rule_ref *)(mtag+1))->rulenum;
229 /*
230 * Record receive interface address, if any.
231 * But only for incoming packets.
232 */
233 if (incoming) {
234 struct ifaddr *ifa;
235 struct ifnet *ifp;
236
237 /* Sanity check */
238 M_ASSERTPKTHDR(m);
239
240 /* Find IP address for receive interface */
241 ifp = m->m_pkthdr.rcvif;
242 if_addr_rlock(ifp);
243 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
244 if (ifa->ifa_addr->sa_family != AF_INET)
245 continue;
246 divsrc.sin_addr =
247 ((struct sockaddr_in *) ifa->ifa_addr)->sin_addr;
248 break;
249 }
250 if_addr_runlock(ifp);
251 }
252 /*
253 * Record the incoming interface name whenever we have one.
254 */
255 if (m->m_pkthdr.rcvif) {
256 /*
257 * Hide the actual interface name in there in the
258 * sin_zero array. XXX This needs to be moved to a
259 * different sockaddr type for divert, e.g.
260 * sockaddr_div with multiple fields like
261 * sockaddr_dl. Presently we have only 7 bytes
262 * but that will do for now as most interfaces
263 * are 4 or less + 2 or less bytes for unit.
264 * There is probably a faster way of doing this,
265 * possibly taking it from the sockaddr_dl on the iface.
266 * This solves the problem of a P2P link and a LAN interface
267 * having the same address, which can result in the wrong
268 * interface being assigned to the packet when fed back
269 * into the divert socket. Theoretically if the daemon saves
270 * and re-uses the sockaddr_in as suggested in the man pages,
271 * this iface name will come along for the ride.
272 * (see div_output for the other half of this.)
273 */
274 strlcpy(divsrc.sin_zero, m->m_pkthdr.rcvif->if_xname,
275 sizeof(divsrc.sin_zero));
276 }
277
278 /* Put packet on socket queue, if any */
279 sa = NULL;
280 nport = htons((u_int16_t)(((struct ipfw_rule_ref *)(mtag+1))->info));
281 INP_INFO_RLOCK(&V_divcbinfo);
282 LIST_FOREACH(inp, &V_divcb, inp_list) {
283 /* XXX why does only one socket match? */
284 if (inp->inp_lport == nport) {
285 INP_RLOCK(inp);
286 sa = inp->inp_socket;
287 SOCKBUF_LOCK(&sa->so_rcv);
288 if (sbappendaddr_locked(&sa->so_rcv,
289 (struct sockaddr *)&divsrc, m,
290 (struct mbuf *)0) == 0) {
291 SOCKBUF_UNLOCK(&sa->so_rcv);
292 sa = NULL; /* force mbuf reclaim below */
293 } else
294 sorwakeup_locked(sa);
295 INP_RUNLOCK(inp);
296 break;
297 }
298 }
299 INP_INFO_RUNLOCK(&V_divcbinfo);
300 if (sa == NULL) {
301 m_freem(m);
302 KMOD_IPSTAT_INC(ips_noproto);
303 KMOD_IPSTAT_DEC(ips_delivered);
304 }
305}
306
307/*
308 * Deliver packet back into the IP processing machinery.
309 *
310 * If no address specified, or address is 0.0.0.0, send to ip_output();
311 * otherwise, send to ip_input() and mark as having been received on
312 * the interface with that address.
313 */
314static int
315div_output(struct socket *so, struct mbuf *m, struct sockaddr_in *sin,
316 struct mbuf *control)
317{
318 struct ip *const ip = mtod(m, struct ip *);
319 struct m_tag *mtag;
320 struct ipfw_rule_ref *dt;
321 int error = 0;
322
323 /*
324 * An mbuf may hasn't come from userland, but we pretend
325 * that it has.
326 */
327 m->m_pkthdr.rcvif = NULL;
328 m->m_nextpkt = NULL;
329 M_SETFIB(m, so->so_fibnum);
330
331 if (control)
332 m_freem(control); /* XXX */
333
334 mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
335 if (mtag == NULL) {
336 /* this should be normal */
337 mtag = m_tag_alloc(MTAG_IPFW_RULE, 0,
338 sizeof(struct ipfw_rule_ref), M_NOWAIT | M_ZERO);
339 if (mtag == NULL) {
340 error = ENOBUFS;
341 goto cantsend;
342 }
343 m_tag_prepend(m, mtag);
344 }
345 dt = (struct ipfw_rule_ref *)(mtag+1);
346
347 /* Loopback avoidance and state recovery */
348 if (sin) {
349 int i;
350
351 /* set the starting point. We provide a non-zero slot,
352 * but a non_matching chain_id to skip that info and use
353 * the rulenum/rule_id.
354 */
355 dt->slot = 1; /* dummy, chain_id is invalid */
356 dt->chain_id = 0;
357 dt->rulenum = sin->sin_port+1; /* host format ? */
358 dt->rule_id = 0;
359 /*
360 * Find receive interface with the given name, stuffed
361 * (if it exists) in the sin_zero[] field.
362 * The name is user supplied data so don't trust its size
363 * or that it is zero terminated.
364 */
365 for (i = 0; i < sizeof(sin->sin_zero) && sin->sin_zero[i]; i++)
366 ;
367 if ( i > 0 && i < sizeof(sin->sin_zero))
368 m->m_pkthdr.rcvif = ifunit(sin->sin_zero);
369 }
370
371 /* Reinject packet into the system as incoming or outgoing */
372 if (!sin || sin->sin_addr.s_addr == 0) {
373 struct mbuf *options = NULL;
374 struct inpcb *inp;
375
376 dt->info |= IPFW_IS_DIVERT | IPFW_INFO_OUT;
377 inp = sotoinpcb(so);
378 INP_RLOCK(inp);
379 switch (ip->ip_v) {
380 case IPVERSION:
381 /*
382 * Don't allow both user specified and setsockopt
383 * options, and don't allow packet length sizes that
384 * will crash.
385 */
386 if ((((ip->ip_hl << 2) != sizeof(struct ip)) &&
387 inp->inp_options != NULL) ||
388 ((u_short)ntohs(ip->ip_len) > m->m_pkthdr.len)) {
389 error = EINVAL;
390 INP_RUNLOCK(inp);
391 goto cantsend;
392 }
393 break;
394#ifdef INET6
395 case IPV6_VERSION >> 4:
396 {
397 struct ip6_hdr *const ip6 = mtod(m, struct ip6_hdr *);
398
399 /* Don't allow packet length sizes that will crash */
400 if (((u_short)ntohs(ip6->ip6_plen) > m->m_pkthdr.len)) {
401 error = EINVAL;
402 INP_RUNLOCK(inp);
403 goto cantsend;
404 }
405 break;
406 }
407#endif
408 default:
409 error = EINVAL;
410 INP_RUNLOCK(inp);
411 goto cantsend;
412 }
413
414 /* Send packet to output processing */
415 KMOD_IPSTAT_INC(ips_rawout); /* XXX */
416
417#ifdef MAC
418 mac_inpcb_create_mbuf(inp, m);
419#endif
420 /*
421 * Get ready to inject the packet into ip_output().
422 * Just in case socket options were specified on the
423 * divert socket, we duplicate them. This is done
424 * to avoid having to hold the PCB locks over the call
425 * to ip_output(), as doing this results in a number of
426 * lock ordering complexities.
427 *
428 * Note that we set the multicast options argument for
429 * ip_output() to NULL since it should be invariant that
430 * they are not present.
431 */
432 KASSERT(inp->inp_moptions == NULL,
433 ("multicast options set on a divert socket"));
434 /*
435 * XXXCSJP: It is unclear to me whether or not it makes
436 * sense for divert sockets to have options. However,
437 * for now we will duplicate them with the INP locks
438 * held so we can use them in ip_output() without
439 * requring a reference to the pcb.
440 */
441 if (inp->inp_options != NULL) {
442 options = m_dup(inp->inp_options, M_NOWAIT);
443 if (options == NULL) {
444 INP_RUNLOCK(inp);
445 error = ENOBUFS;
446 goto cantsend;
447 }
448 }
449 INP_RUNLOCK(inp);
450
451 switch (ip->ip_v) {
452 case IPVERSION:
453 error = ip_output(m, options, NULL,
454 ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0)
455 | IP_ALLOWBROADCAST | IP_RAWOUTPUT, NULL, NULL);
456 break;
457#ifdef INET6
458 case IPV6_VERSION >> 4:
459 error = ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
460 break;
461#endif
462 }
463 if (options != NULL)
464 m_freem(options);
465 } else {
466 dt->info |= IPFW_IS_DIVERT | IPFW_INFO_IN;
467 if (m->m_pkthdr.rcvif == NULL) {
468 /*
469 * No luck with the name, check by IP address.
470 * Clear the port and the ifname to make sure
471 * there are no distractions for ifa_ifwithaddr.
472 */
473 struct ifaddr *ifa;
474
475 bzero(sin->sin_zero, sizeof(sin->sin_zero));
476 sin->sin_port = 0;
477 ifa = ifa_ifwithaddr((struct sockaddr *) sin);
478 if (ifa == NULL) {
479 error = EADDRNOTAVAIL;
480 goto cantsend;
481 }
482 m->m_pkthdr.rcvif = ifa->ifa_ifp;
483 ifa_free(ifa);
484 }
485#ifdef MAC
486 mac_socket_create_mbuf(so, m);
487#endif
488 /* Send packet to input processing via netisr */
489 switch (ip->ip_v) {
490 case IPVERSION:
491 netisr_queue_src(NETISR_IP, (uintptr_t)so, m);
492 break;
493#ifdef INET6
494 case IPV6_VERSION >> 4:
495 netisr_queue_src(NETISR_IPV6, (uintptr_t)so, m);
496 break;
497#endif
498 default:
499 error = EINVAL;
500 goto cantsend;
501 }
502 }
503
504 return (error);
505
506cantsend:
507 m_freem(m);
508 return (error);
509}
510
511static int
512div_attach(struct socket *so, int proto, struct thread *td)
513{
514 struct inpcb *inp;
515 int error;
516
517 inp = sotoinpcb(so);
518 KASSERT(inp == NULL, ("div_attach: inp != NULL"));
519 if (td != NULL) {
520 error = priv_check(td, PRIV_NETINET_DIVERT);
521 if (error)
522 return (error);
523 }
524 error = soreserve(so, div_sendspace, div_recvspace);
525 if (error)
526 return error;
527 INP_INFO_WLOCK(&V_divcbinfo);
528 error = in_pcballoc(so, &V_divcbinfo);
529 if (error) {
530 INP_INFO_WUNLOCK(&V_divcbinfo);
531 return error;
532 }
533 inp = (struct inpcb *)so->so_pcb;
534 INP_INFO_WUNLOCK(&V_divcbinfo);
535 inp->inp_ip_p = proto;
536 inp->inp_vflag |= INP_IPV4;
537 inp->inp_flags |= INP_HDRINCL;
538 INP_WUNLOCK(inp);
539 return 0;
540}
541
542static void
543div_detach(struct socket *so)
544{
545 struct inpcb *inp;
546
547 inp = sotoinpcb(so);
548 KASSERT(inp != NULL, ("div_detach: inp == NULL"));
549 INP_INFO_WLOCK(&V_divcbinfo);
550 INP_WLOCK(inp);
551 in_pcbdetach(inp);
552 in_pcbfree(inp);
553 INP_INFO_WUNLOCK(&V_divcbinfo);
554}
555
556static int
557div_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
558{
559 struct inpcb *inp;
560 int error;
561
562 inp = sotoinpcb(so);
563 KASSERT(inp != NULL, ("div_bind: inp == NULL"));
564 /* in_pcbbind assumes that nam is a sockaddr_in
565 * and in_pcbbind requires a valid address. Since divert
566 * sockets don't we need to make sure the address is
567 * filled in properly.
568 * XXX -- divert should not be abusing in_pcbind
569 * and should probably have its own family.
570 */
571 if (nam->sa_family != AF_INET)
572 return EAFNOSUPPORT;
573 ((struct sockaddr_in *)nam)->sin_addr.s_addr = INADDR_ANY;
574 INP_INFO_WLOCK(&V_divcbinfo);
575 INP_WLOCK(inp);
576 INP_HASH_WLOCK(&V_divcbinfo);
577 error = in_pcbbind(inp, nam, td->td_ucred);
578 INP_HASH_WUNLOCK(&V_divcbinfo);
579 INP_WUNLOCK(inp);
580 INP_INFO_WUNLOCK(&V_divcbinfo);
581 return error;
582}
583
584static int
585div_shutdown(struct socket *so)
586{
587 struct inpcb *inp;
588
589 inp = sotoinpcb(so);
590 KASSERT(inp != NULL, ("div_shutdown: inp == NULL"));
591 INP_WLOCK(inp);
592 socantsendmore(so);
593 INP_WUNLOCK(inp);
594 return 0;
595}
596
597static int
598div_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
599 struct mbuf *control, struct thread *td)
600{
601
602 /* Packet must have a header (but that's about it) */
603 if (m->m_len < sizeof (struct ip) &&
604 (m = m_pullup(m, sizeof (struct ip))) == 0) {
605 KMOD_IPSTAT_INC(ips_toosmall);
606 m_freem(m);
607 return EINVAL;
608 }
609
610 /* Send packet */
611 return div_output(so, m, (struct sockaddr_in *)nam, control);
612}
613
614static void
615div_ctlinput(int cmd, struct sockaddr *sa, void *vip)
616{
617 struct in_addr faddr;
618
619 faddr = ((struct sockaddr_in *)sa)->sin_addr;
620 if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
621 return;
622 if (PRC_IS_REDIRECT(cmd))
623 return;
624}
625
626static int
627div_pcblist(SYSCTL_HANDLER_ARGS)
628{
629 int error, i, n;
630 struct inpcb *inp, **inp_list;
631 inp_gen_t gencnt;
632 struct xinpgen xig;
633
634 /*
635 * The process of preparing the TCB list is too time-consuming and
636 * resource-intensive to repeat twice on every request.
637 */
638 if (req->oldptr == 0) {
639 n = V_divcbinfo.ipi_count;
640 n += imax(n / 8, 10);
641 req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
642 return 0;
643 }
644
645 if (req->newptr != 0)
646 return EPERM;
647
648 /*
649 * OK, now we're committed to doing something.
650 */
651 INP_INFO_RLOCK(&V_divcbinfo);
652 gencnt = V_divcbinfo.ipi_gencnt;
653 n = V_divcbinfo.ipi_count;
654 INP_INFO_RUNLOCK(&V_divcbinfo);
655
656 error = sysctl_wire_old_buffer(req,
657 2 * sizeof(xig) + n*sizeof(struct xinpcb));
658 if (error != 0)
659 return (error);
660
661 xig.xig_len = sizeof xig;
662 xig.xig_count = n;
663 xig.xig_gen = gencnt;
664 xig.xig_sogen = so_gencnt;
665 error = SYSCTL_OUT(req, &xig, sizeof xig);
666 if (error)
667 return error;
668
669 inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
670 if (inp_list == 0)
671 return ENOMEM;
672
673 INP_INFO_RLOCK(&V_divcbinfo);
674 for (inp = LIST_FIRST(V_divcbinfo.ipi_listhead), i = 0; inp && i < n;
675 inp = LIST_NEXT(inp, inp_list)) {
676 INP_WLOCK(inp);
677 if (inp->inp_gencnt <= gencnt &&
678 cr_canseeinpcb(req->td->td_ucred, inp) == 0) {
679 in_pcbref(inp);
680 inp_list[i++] = inp;
681 }
682 INP_WUNLOCK(inp);
683 }
684 INP_INFO_RUNLOCK(&V_divcbinfo);
685 n = i;
686
687 error = 0;
688 for (i = 0; i < n; i++) {
689 inp = inp_list[i];
690 INP_RLOCK(inp);
691 if (inp->inp_gencnt <= gencnt) {
692 struct xinpcb xi;
693 bzero(&xi, sizeof(xi));
694 xi.xi_len = sizeof xi;
695 /* XXX should avoid extra copy */
696 bcopy(inp, &xi.xi_inp, sizeof *inp);
697 if (inp->inp_socket)
698 sotoxsocket(inp->inp_socket, &xi.xi_socket);
699 INP_RUNLOCK(inp);
700 error = SYSCTL_OUT(req, &xi, sizeof xi);
701 } else
702 INP_RUNLOCK(inp);
703 }
704 INP_INFO_WLOCK(&V_divcbinfo);
705 for (i = 0; i < n; i++) {
706 inp = inp_list[i];
707 INP_RLOCK(inp);
708 if (!in_pcbrele_rlocked(inp))
709 INP_RUNLOCK(inp);
710 }
711 INP_INFO_WUNLOCK(&V_divcbinfo);
712
713 if (!error) {
714 /*
715 * Give the user an updated idea of our state.
716 * If the generation differs from what we told
717 * her before, she knows that something happened
718 * while we were processing this request, and it
719 * might be necessary to retry.
720 */
721 INP_INFO_RLOCK(&V_divcbinfo);
722 xig.xig_gen = V_divcbinfo.ipi_gencnt;
723 xig.xig_sogen = so_gencnt;
724 xig.xig_count = V_divcbinfo.ipi_count;
725 INP_INFO_RUNLOCK(&V_divcbinfo);
726 error = SYSCTL_OUT(req, &xig, sizeof xig);
727 }
728 free(inp_list, M_TEMP);
729 return error;
730}
731
732#ifdef SYSCTL_NODE
733static SYSCTL_NODE(_net_inet, IPPROTO_DIVERT, divert, CTLFLAG_RW, 0,
734 "IPDIVERT");
735SYSCTL_PROC(_net_inet_divert, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
736 NULL, 0, div_pcblist, "S,xinpcb", "List of active divert sockets");
737#endif
738
739struct pr_usrreqs div_usrreqs = {
740 .pru_attach = div_attach,
741 .pru_bind = div_bind,
742 .pru_control = in_control,
743 .pru_detach = div_detach,
744 .pru_peeraddr = in_getpeeraddr,
745 .pru_send = div_send,
746 .pru_shutdown = div_shutdown,
747 .pru_sockaddr = in_getsockaddr,
748 .pru_sosetlabel = in_pcbsosetlabel
749};
750
751struct protosw div_protosw = {
752 .pr_type = SOCK_RAW,
753 .pr_protocol = IPPROTO_DIVERT,
754 .pr_flags = PR_ATOMIC|PR_ADDR,
755 .pr_input = div_input,
756 .pr_ctlinput = div_ctlinput,
757 .pr_ctloutput = ip_ctloutput,
758 .pr_init = div_init,
759#ifdef VIMAGE
760 .pr_destroy = div_destroy,
761#endif
762 .pr_usrreqs = &div_usrreqs
763};
764
765static int
766div_modevent(module_t mod, int type, void *unused)
767{
768 int err = 0;
769#ifndef VIMAGE
770 int n;
771#endif
772
773 switch (type) {
774 case MOD_LOAD:
775 /*
776 * Protocol will be initialized by pf_proto_register().
777 * We don't have to register ip_protox because we are not
778 * a true IP protocol that goes over the wire.
779 */
780 err = pf_proto_register(PF_INET, &div_protosw);
781 if (err != 0)
782 return (err);
783 ip_divert_ptr = divert_packet;
784 ip_divert_event_tag = EVENTHANDLER_REGISTER(maxsockets_change,
785 div_zone_change, NULL, EVENTHANDLER_PRI_ANY);
786 break;
787 case MOD_QUIESCE:
788 /*
789 * IPDIVERT may normally not be unloaded because of the
790 * potential race conditions. Tell kldunload we can't be
791 * unloaded unless the unload is forced.
792 */
793 err = EPERM;
794 break;
795 case MOD_UNLOAD:
796#ifdef VIMAGE
797 err = EPERM;
798 break;
799#else
800 /*
801 * Forced unload.
802 *
803 * Module ipdivert can only be unloaded if no sockets are
804 * connected. Maybe this can be changed later to forcefully
805 * disconnect any open sockets.
806 *
807 * XXXRW: Note that there is a slight race here, as a new
808 * socket open request could be spinning on the lock and then
809 * we destroy the lock.
810 */
811 INP_INFO_WLOCK(&V_divcbinfo);
812 n = V_divcbinfo.ipi_count;
813 if (n != 0) {
814 err = EBUSY;
815 INP_INFO_WUNLOCK(&V_divcbinfo);
816 break;
817 }
818 ip_divert_ptr = NULL;
819 err = pf_proto_unregister(PF_INET, IPPROTO_DIVERT, SOCK_RAW);
820 INP_INFO_WUNLOCK(&V_divcbinfo);
821 div_destroy();
822 EVENTHANDLER_DEREGISTER(maxsockets_change, ip_divert_event_tag);
823 break;
824#endif /* !VIMAGE */
825 default:
826 err = EOPNOTSUPP;
827 break;
828 }
829 return err;
830}
831
832static moduledata_t ipdivertmod = {
833 "ipdivert",
834 div_modevent,
835 0
836};
837
838DECLARE_MODULE(ipdivert, ipdivertmod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
839MODULE_DEPEND(ipdivert, ipfw, 2, 2, 2);
840MODULE_VERSION(ipdivert, 1);
|