xref: /freebsd/sys/netinet/ip_divert.c (revision 56e766af41cd68310f5583bb893b13c006fcb44f)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37 #include "opt_sctp.h"
38 #ifndef INET
39 #error "IPDIVERT requires INET"
40 #endif
41 
42 #include <sys/param.h>
43 #include <sys/eventhandler.h>
44 #include <sys/kernel.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/mbuf.h>
48 #include <sys/module.h>
49 #include <sys/kernel.h>
50 #include <sys/priv.h>
51 #include <sys/proc.h>
52 #include <sys/protosw.h>
53 #include <sys/socket.h>
54 #include <sys/socketvar.h>
55 #include <sys/sysctl.h>
56 #include <net/vnet.h>
57 
58 #include <net/if.h>
59 #include <net/if_var.h>
60 #include <net/netisr.h>
61 
62 #include <netinet/in.h>
63 #include <netinet/in_pcb.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/in_var.h>
66 #include <netinet/ip.h>
67 #include <netinet/ip_var.h>
68 #ifdef INET6
69 #include <netinet/ip6.h>
70 #include <netinet6/ip6_var.h>
71 #endif
72 #ifdef SCTP
73 #include <netinet/sctp_crc32.h>
74 #endif
75 
76 #include <security/mac/mac_framework.h>
77 /*
78  * Divert sockets
79  */
80 
81 /*
82  * Allocate enough space to hold a full IP packet
83  */
84 #define	DIVSNDQ		(65536 + 100)
85 #define	DIVRCVQ		(65536 + 100)
86 
87 /*
88  * Divert sockets work in conjunction with ipfw or other packet filters,
89  * see the divert(4) manpage for features.
90  * Packets are selected by the packet filter and tagged with an
91  * MTAG_IPFW_RULE tag carrying the 'divert port' number (as set by
92  * the packet filter) and information on the matching filter rule for
93  * subsequent reinjection. The divert_port is used to put the packet
94  * on the corresponding divert socket, while the rule number is passed
95  * up (at least partially) as the sin_port in the struct sockaddr.
96  *
97  * Packets written to the divert socket carry in sin_addr a
98  * destination address, and in sin_port the number of the filter rule
99  * after which to continue processing.
100  * If the destination address is INADDR_ANY, the packet is treated as
101  * as outgoing and sent to ip_output(); otherwise it is treated as
102  * incoming and sent to ip_input().
103  * Further, sin_zero carries some information on the interface,
104  * which can be used in the reinject -- see comments in the code.
105  *
106  * On reinjection, processing in ip_input() and ip_output()
107  * will be exactly the same as for the original packet, except that
108  * packet filter processing will start at the rule number after the one
109  * written in the sin_port (ipfw does not allow a rule #0, so sin_port=0
110  * will apply the entire ruleset to the packet).
111  */
112 
113 /* Internal variables. */
114 VNET_DEFINE_STATIC(struct inpcbhead, divcb);
115 VNET_DEFINE_STATIC(struct inpcbinfo, divcbinfo);
116 
117 #define	V_divcb				VNET(divcb)
118 #define	V_divcbinfo			VNET(divcbinfo)
119 
120 static u_long	div_sendspace = DIVSNDQ;	/* XXX sysctl ? */
121 static u_long	div_recvspace = DIVRCVQ;	/* XXX sysctl ? */
122 
123 static eventhandler_tag ip_divert_event_tag;
124 
125 static int div_output_inbound(int fmaily, struct socket *so, struct mbuf *m,
126     struct sockaddr_in *sin);
127 static int div_output_outbound(int family, struct socket *so, struct mbuf *m);
128 
129 /*
130  * Initialize divert connection block queue.
131  */
132 static void
133 div_zone_change(void *tag)
134 {
135 
136 	uma_zone_set_max(V_divcbinfo.ipi_zone, maxsockets);
137 }
138 
139 static int
140 div_inpcb_init(void *mem, int size, int flags)
141 {
142 	struct inpcb *inp = mem;
143 
144 	INP_LOCK_INIT(inp, "inp", "divinp");
145 	return (0);
146 }
147 
148 static void
149 div_init(void)
150 {
151 
152 	/*
153 	 * XXX We don't use the hash list for divert IP, but it's easier to
154 	 * allocate one-entry hash lists than it is to check all over the
155 	 * place for hashbase == NULL.
156 	 */
157 	in_pcbinfo_init(&V_divcbinfo, "div", &V_divcb, 1, 1, "divcb",
158 	    div_inpcb_init, IPI_HASHFIELDS_NONE);
159 }
160 
161 static void
162 div_destroy(void *unused __unused)
163 {
164 
165 	in_pcbinfo_destroy(&V_divcbinfo);
166 }
167 VNET_SYSUNINIT(divert, SI_SUB_PROTO_DOMAININIT, SI_ORDER_ANY,
168     div_destroy, NULL);
169 
170 /*
171  * IPPROTO_DIVERT is not in the real IP protocol number space; this
172  * function should never be called.  Just in case, drop any packets.
173  */
174 static int
175 div_input(struct mbuf **mp, int *offp, int proto)
176 {
177 	struct mbuf *m = *mp;
178 
179 	KMOD_IPSTAT_INC(ips_noproto);
180 	m_freem(m);
181 	return (IPPROTO_DONE);
182 }
183 
184 /*
185  * Divert a packet by passing it up to the divert socket at port 'port'.
186  *
187  * Setup generic address and protocol structures for div_input routine,
188  * then pass them along with mbuf chain.
189  */
190 static void
191 divert_packet(struct mbuf *m, bool incoming)
192 {
193 	struct ip *ip;
194 	struct inpcb *inp;
195 	struct socket *sa;
196 	u_int16_t nport;
197 	struct sockaddr_in divsrc;
198 	struct m_tag *mtag;
199 
200 	NET_EPOCH_ASSERT();
201 
202 	mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
203 	if (mtag == NULL) {
204 		m_freem(m);
205 		return;
206 	}
207 	/* Assure header */
208 	if (m->m_len < sizeof(struct ip) &&
209 	    (m = m_pullup(m, sizeof(struct ip))) == NULL)
210 		return;
211 	ip = mtod(m, struct ip *);
212 
213 	/* Delayed checksums are currently not compatible with divert. */
214 	if (m->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
215 		in_delayed_cksum(m);
216 		m->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
217 	}
218 #ifdef SCTP
219 	if (m->m_pkthdr.csum_flags & CSUM_SCTP) {
220 		sctp_delayed_cksum(m, (uint32_t)(ip->ip_hl << 2));
221 		m->m_pkthdr.csum_flags &= ~CSUM_SCTP;
222 	}
223 #endif
224 	bzero(&divsrc, sizeof(divsrc));
225 	divsrc.sin_len = sizeof(divsrc);
226 	divsrc.sin_family = AF_INET;
227 	/* record matching rule, in host format */
228 	divsrc.sin_port = ((struct ipfw_rule_ref *)(mtag+1))->rulenum;
229 	/*
230 	 * Record receive interface address, if any.
231 	 * But only for incoming packets.
232 	 */
233 	if (incoming) {
234 		struct ifaddr *ifa;
235 		struct ifnet *ifp;
236 
237 		/* Sanity check */
238 		M_ASSERTPKTHDR(m);
239 
240 		/* Find IP address for receive interface */
241 		ifp = m->m_pkthdr.rcvif;
242 		CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
243 			if (ifa->ifa_addr->sa_family != AF_INET)
244 				continue;
245 			divsrc.sin_addr =
246 			    ((struct sockaddr_in *) ifa->ifa_addr)->sin_addr;
247 			break;
248 		}
249 	}
250 	/*
251 	 * Record the incoming interface name whenever we have one.
252 	 */
253 	if (m->m_pkthdr.rcvif) {
254 		/*
255 		 * Hide the actual interface name in there in the
256 		 * sin_zero array. XXX This needs to be moved to a
257 		 * different sockaddr type for divert, e.g.
258 		 * sockaddr_div with multiple fields like
259 		 * sockaddr_dl. Presently we have only 7 bytes
260 		 * but that will do for now as most interfaces
261 		 * are 4 or less + 2 or less bytes for unit.
262 		 * There is probably a faster way of doing this,
263 		 * possibly taking it from the sockaddr_dl on the iface.
264 		 * This solves the problem of a P2P link and a LAN interface
265 		 * having the same address, which can result in the wrong
266 		 * interface being assigned to the packet when fed back
267 		 * into the divert socket. Theoretically if the daemon saves
268 		 * and re-uses the sockaddr_in as suggested in the man pages,
269 		 * this iface name will come along for the ride.
270 		 * (see div_output for the other half of this.)
271 		 */
272 		strlcpy(divsrc.sin_zero, m->m_pkthdr.rcvif->if_xname,
273 		    sizeof(divsrc.sin_zero));
274 	}
275 
276 	/* Put packet on socket queue, if any */
277 	sa = NULL;
278 	nport = htons((u_int16_t)(((struct ipfw_rule_ref *)(mtag+1))->info));
279 	CK_LIST_FOREACH(inp, &V_divcb, inp_list) {
280 		/* XXX why does only one socket match? */
281 		if (inp->inp_lport == nport) {
282 			INP_RLOCK(inp);
283 			sa = inp->inp_socket;
284 			SOCKBUF_LOCK(&sa->so_rcv);
285 			if (sbappendaddr_locked(&sa->so_rcv,
286 			    (struct sockaddr *)&divsrc, m,
287 			    (struct mbuf *)0) == 0) {
288 				SOCKBUF_UNLOCK(&sa->so_rcv);
289 				sa = NULL;	/* force mbuf reclaim below */
290 			} else
291 				sorwakeup_locked(sa);
292 			INP_RUNLOCK(inp);
293 			break;
294 		}
295 	}
296 	if (sa == NULL) {
297 		m_freem(m);
298 		KMOD_IPSTAT_INC(ips_noproto);
299 		KMOD_IPSTAT_DEC(ips_delivered);
300         }
301 }
302 
303 /*
304  * Deliver packet back into the IP processing machinery.
305  *
306  * If no address specified, or address is 0.0.0.0, send to ip_output();
307  * otherwise, send to ip_input() and mark as having been received on
308  * the interface with that address.
309  */
310 static int
311 div_output(struct socket *so, struct mbuf *m, struct sockaddr_in *sin,
312     struct mbuf *control)
313 {
314 	struct epoch_tracker et;
315 	const struct ip *ip;
316 	struct m_tag *mtag;
317 	struct ipfw_rule_ref *dt;
318 	int error, family;
319 
320 	/*
321 	 * An mbuf may hasn't come from userland, but we pretend
322 	 * that it has.
323 	 */
324 	m->m_pkthdr.rcvif = NULL;
325 	m->m_nextpkt = NULL;
326 	M_SETFIB(m, so->so_fibnum);
327 
328 	if (control)
329 		m_freem(control);		/* XXX */
330 
331 	mtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
332 	if (mtag == NULL) {
333 		/* this should be normal */
334 		mtag = m_tag_alloc(MTAG_IPFW_RULE, 0,
335 		    sizeof(struct ipfw_rule_ref), M_NOWAIT | M_ZERO);
336 		if (mtag == NULL) {
337 			m_freem(m);
338 			return (ENOBUFS);
339 		}
340 		m_tag_prepend(m, mtag);
341 	}
342 	dt = (struct ipfw_rule_ref *)(mtag+1);
343 
344 	/* Loopback avoidance and state recovery */
345 	if (sin) {
346 		int i;
347 
348 		/* set the starting point. We provide a non-zero slot,
349 		 * but a non_matching chain_id to skip that info and use
350 		 * the rulenum/rule_id.
351 		 */
352 		dt->slot = 1; /* dummy, chain_id is invalid */
353 		dt->chain_id = 0;
354 		dt->rulenum = sin->sin_port+1; /* host format ? */
355 		dt->rule_id = 0;
356 		/* XXX: broken for IPv6 */
357 		/*
358 		 * Find receive interface with the given name, stuffed
359 		 * (if it exists) in the sin_zero[] field.
360 		 * The name is user supplied data so don't trust its size
361 		 * or that it is zero terminated.
362 		 */
363 		for (i = 0; i < sizeof(sin->sin_zero) && sin->sin_zero[i]; i++)
364 			;
365 		if ( i > 0 && i < sizeof(sin->sin_zero))
366 			m->m_pkthdr.rcvif = ifunit(sin->sin_zero);
367 	}
368 
369 	ip = mtod(m, struct ip *);
370 	switch (ip->ip_v) {
371 	case IPVERSION:
372 		family = AF_INET;
373 		break;
374 	case IPV6_VERSION >> 4:
375 		family = AF_INET6;
376 		break;
377 	default:
378 		m_freem(m);
379 		return (EAFNOSUPPORT);
380 	}
381 
382 	/* Reinject packet into the system as incoming or outgoing */
383 	NET_EPOCH_ENTER(et);
384 	if (!sin || sin->sin_addr.s_addr == 0) {
385 		dt->info |= IPFW_IS_DIVERT | IPFW_INFO_OUT;
386 		error = div_output_outbound(family, so, m);
387 	} else {
388 		dt->info |= IPFW_IS_DIVERT | IPFW_INFO_IN;
389 		error = div_output_inbound(family, so, m, sin);
390 	}
391 	NET_EPOCH_EXIT(et);
392 
393 	if (error != 0)
394 		m_freem(m);
395 
396 	return (error);
397 }
398 
399 /*
400  * Sends mbuf @m to the wire via ip[6]_output().
401  *
402  * Returns 0 on success, @m is consumed.
403  * On failure, returns error code. It is caller responsibility to free @m.
404  */
405 static int
406 div_output_outbound(int family, struct socket *so, struct mbuf *m)
407 {
408 	struct ip *const ip = mtod(m, struct ip *);
409 	struct mbuf *options;
410 	struct inpcb *inp;
411 	int error;
412 
413 	inp = sotoinpcb(so);
414 	INP_RLOCK(inp);
415 	switch (family) {
416 	case AF_INET:
417 		/*
418 		 * Don't allow both user specified and setsockopt
419 		 * options, and don't allow packet length sizes that
420 		 * will crash.
421 		 */
422 		if ((((ip->ip_hl << 2) != sizeof(struct ip)) &&
423 		    inp->inp_options != NULL) ||
424 		    ((u_short)ntohs(ip->ip_len) > m->m_pkthdr.len)) {
425 			INP_RUNLOCK(inp);
426 			return (EINVAL);
427 		}
428 		break;
429 #ifdef INET6
430 	case AF_INET6:
431 	    {
432 		struct ip6_hdr *const ip6 = mtod(m, struct ip6_hdr *);
433 
434 		/* Don't allow packet length sizes that will crash */
435 		if (((u_short)ntohs(ip6->ip6_plen) > m->m_pkthdr.len)) {
436 			INP_RUNLOCK(inp);
437 			return (EINVAL);
438 		}
439 		break;
440 	    }
441 #endif
442 	}
443 
444 	/* Send packet to output processing */
445 	KMOD_IPSTAT_INC(ips_rawout);		/* XXX */
446 
447 #ifdef MAC
448 	mac_inpcb_create_mbuf(inp, m);
449 #endif
450 	/*
451 	 * Get ready to inject the packet into ip_output().
452 	 * Just in case socket options were specified on the
453 	 * divert socket, we duplicate them.  This is done
454 	 * to avoid having to hold the PCB locks over the call
455 	 * to ip_output(), as doing this results in a number of
456 	 * lock ordering complexities.
457 	 *
458 	 * Note that we set the multicast options argument for
459 	 * ip_output() to NULL since it should be invariant that
460 	 * they are not present.
461 	 */
462 	KASSERT(inp->inp_moptions == NULL,
463 	    ("multicast options set on a divert socket"));
464 	/*
465 	 * XXXCSJP: It is unclear to me whether or not it makes
466 	 * sense for divert sockets to have options.  However,
467 	 * for now we will duplicate them with the INP locks
468 	 * held so we can use them in ip_output() without
469 	 * requring a reference to the pcb.
470 	 */
471 	options = NULL;
472 	if (inp->inp_options != NULL) {
473 		options = m_dup(inp->inp_options, M_NOWAIT);
474 		if (options == NULL) {
475 			INP_RUNLOCK(inp);
476 			return (ENOBUFS);
477 		}
478 	}
479 	INP_RUNLOCK(inp);
480 
481 	error = 0;
482 	switch (family) {
483 	case AF_INET:
484 		error = ip_output(m, options, NULL,
485 		    ((so->so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0)
486 		    | IP_ALLOWBROADCAST | IP_RAWOUTPUT, NULL, NULL);
487 		break;
488 #ifdef INET6
489 	case AF_INET6:
490 		error = ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
491 		break;
492 #endif
493 	}
494 	if (options != NULL)
495 		m_freem(options);
496 
497 	return (error);
498 }
499 
500 /*
501  * Schedules mbuf @m for local processing via IPv4/IPv6 netisr queue.
502  *
503  * Returns 0 on success, @m is consumed.
504  * Returns error code on failure. It is caller responsibility to free @m.
505  */
506 static int
507 div_output_inbound(int family, struct socket *so, struct mbuf *m,
508     struct sockaddr_in *sin)
509 {
510 	const struct ip *ip;
511 	struct ifaddr *ifa;
512 
513 	if (m->m_pkthdr.rcvif == NULL) {
514 		/*
515 		 * No luck with the name, check by IP address.
516 		 * Clear the port and the ifname to make sure
517 		 * there are no distractions for ifa_ifwithaddr.
518 		 */
519 
520 		/* XXX: broken for IPv6 */
521 		bzero(sin->sin_zero, sizeof(sin->sin_zero));
522 		sin->sin_port = 0;
523 		ifa = ifa_ifwithaddr((struct sockaddr *) sin);
524 		if (ifa == NULL)
525 			return (EADDRNOTAVAIL);
526 		m->m_pkthdr.rcvif = ifa->ifa_ifp;
527 	}
528 #ifdef MAC
529 	mac_socket_create_mbuf(so, m);
530 #endif
531 	/* Send packet to input processing via netisr */
532 	switch (family) {
533 	case AF_INET:
534 		ip = mtod(m, struct ip *);
535 		/*
536 		 * Restore M_BCAST flag when destination address is
537 		 * broadcast. It is expected by ip_tryforward().
538 		 */
539 		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)))
540 			m->m_flags |= M_MCAST;
541 		else if (in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
542 			m->m_flags |= M_BCAST;
543 		netisr_queue_src(NETISR_IP, (uintptr_t)so, m);
544 		break;
545 #ifdef INET6
546 	case AF_INET6:
547 		netisr_queue_src(NETISR_IPV6, (uintptr_t)so, m);
548 		break;
549 #endif
550 	default:
551 		return (EINVAL);
552 	}
553 
554 	return (0);
555 }
556 
557 static int
558 div_attach(struct socket *so, int proto, struct thread *td)
559 {
560 	struct inpcb *inp;
561 	int error;
562 
563 	inp  = sotoinpcb(so);
564 	KASSERT(inp == NULL, ("div_attach: inp != NULL"));
565 	if (td != NULL) {
566 		error = priv_check(td, PRIV_NETINET_DIVERT);
567 		if (error)
568 			return (error);
569 	}
570 	error = soreserve(so, div_sendspace, div_recvspace);
571 	if (error)
572 		return error;
573 	INP_INFO_WLOCK(&V_divcbinfo);
574 	error = in_pcballoc(so, &V_divcbinfo);
575 	if (error) {
576 		INP_INFO_WUNLOCK(&V_divcbinfo);
577 		return error;
578 	}
579 	inp = (struct inpcb *)so->so_pcb;
580 	INP_INFO_WUNLOCK(&V_divcbinfo);
581 	inp->inp_ip_p = proto;
582 	inp->inp_vflag |= INP_IPV4;
583 	inp->inp_flags |= INP_HDRINCL;
584 	INP_WUNLOCK(inp);
585 	return 0;
586 }
587 
588 static void
589 div_detach(struct socket *so)
590 {
591 	struct inpcb *inp;
592 
593 	inp = sotoinpcb(so);
594 	KASSERT(inp != NULL, ("div_detach: inp == NULL"));
595 	INP_INFO_WLOCK(&V_divcbinfo);
596 	INP_WLOCK(inp);
597 	in_pcbdetach(inp);
598 	in_pcbfree(inp);
599 	INP_INFO_WUNLOCK(&V_divcbinfo);
600 }
601 
602 static int
603 div_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
604 {
605 	struct inpcb *inp;
606 	int error;
607 
608 	inp = sotoinpcb(so);
609 	KASSERT(inp != NULL, ("div_bind: inp == NULL"));
610 	/* in_pcbbind assumes that nam is a sockaddr_in
611 	 * and in_pcbbind requires a valid address. Since divert
612 	 * sockets don't we need to make sure the address is
613 	 * filled in properly.
614 	 * XXX -- divert should not be abusing in_pcbind
615 	 * and should probably have its own family.
616 	 */
617 	if (nam->sa_family != AF_INET)
618 		return EAFNOSUPPORT;
619 	((struct sockaddr_in *)nam)->sin_addr.s_addr = INADDR_ANY;
620 	INP_INFO_WLOCK(&V_divcbinfo);
621 	INP_WLOCK(inp);
622 	INP_HASH_WLOCK(&V_divcbinfo);
623 	error = in_pcbbind(inp, nam, td->td_ucred);
624 	INP_HASH_WUNLOCK(&V_divcbinfo);
625 	INP_WUNLOCK(inp);
626 	INP_INFO_WUNLOCK(&V_divcbinfo);
627 	return error;
628 }
629 
630 static int
631 div_shutdown(struct socket *so)
632 {
633 	struct inpcb *inp;
634 
635 	inp = sotoinpcb(so);
636 	KASSERT(inp != NULL, ("div_shutdown: inp == NULL"));
637 	INP_WLOCK(inp);
638 	socantsendmore(so);
639 	INP_WUNLOCK(inp);
640 	return 0;
641 }
642 
643 static int
644 div_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
645     struct mbuf *control, struct thread *td)
646 {
647 
648 	/* Packet must have a header (but that's about it) */
649 	if (m->m_len < sizeof (struct ip) &&
650 	    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
651 		KMOD_IPSTAT_INC(ips_toosmall);
652 		m_freem(m);
653 		return EINVAL;
654 	}
655 
656 	/* Send packet */
657 	return div_output(so, m, (struct sockaddr_in *)nam, control);
658 }
659 
660 static void
661 div_ctlinput(int cmd, struct sockaddr *sa, void *vip)
662 {
663         struct in_addr faddr;
664 
665 	faddr = ((struct sockaddr_in *)sa)->sin_addr;
666 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
667         	return;
668 	if (PRC_IS_REDIRECT(cmd))
669 		return;
670 }
671 
672 static int
673 div_pcblist(SYSCTL_HANDLER_ARGS)
674 {
675 	struct xinpgen xig;
676 	struct epoch_tracker et;
677 	struct inpcb *inp;
678 	int error;
679 
680 	if (req->newptr != 0)
681 		return EPERM;
682 
683 	if (req->oldptr == 0) {
684 		int n;
685 
686 		n = V_divcbinfo.ipi_count;
687 		n += imax(n / 8, 10);
688 		req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xinpcb);
689 		return 0;
690 	}
691 
692 	if ((error = sysctl_wire_old_buffer(req, 0)) != 0)
693 		return (error);
694 
695 	bzero(&xig, sizeof(xig));
696 	xig.xig_len = sizeof xig;
697 	xig.xig_count = V_divcbinfo.ipi_count;
698 	xig.xig_gen = V_divcbinfo.ipi_gencnt;
699 	xig.xig_sogen = so_gencnt;
700 	error = SYSCTL_OUT(req, &xig, sizeof xig);
701 	if (error)
702 		return error;
703 
704 	NET_EPOCH_ENTER(et);
705 	for (inp = CK_LIST_FIRST(V_divcbinfo.ipi_listhead);
706 	    inp != NULL;
707 	    inp = CK_LIST_NEXT(inp, inp_list)) {
708 		INP_RLOCK(inp);
709 		if (inp->inp_gencnt <= xig.xig_gen) {
710 			struct xinpcb xi;
711 
712 			in_pcbtoxinpcb(inp, &xi);
713 			INP_RUNLOCK(inp);
714 			error = SYSCTL_OUT(req, &xi, sizeof xi);
715 		} else
716 			INP_RUNLOCK(inp);
717 	}
718 	NET_EPOCH_EXIT(et);
719 
720 	if (!error) {
721 		/*
722 		 * Give the user an updated idea of our state.
723 		 * If the generation differs from what we told
724 		 * her before, she knows that something happened
725 		 * while we were processing this request, and it
726 		 * might be necessary to retry.
727 		 */
728 		xig.xig_gen = V_divcbinfo.ipi_gencnt;
729 		xig.xig_sogen = so_gencnt;
730 		xig.xig_count = V_divcbinfo.ipi_count;
731 		error = SYSCTL_OUT(req, &xig, sizeof xig);
732 	}
733 
734 	return (error);
735 }
736 
737 #ifdef SYSCTL_NODE
738 static SYSCTL_NODE(_net_inet, IPPROTO_DIVERT, divert, CTLFLAG_RW, 0,
739     "IPDIVERT");
740 SYSCTL_PROC(_net_inet_divert, OID_AUTO, pcblist, CTLTYPE_OPAQUE | CTLFLAG_RD,
741     NULL, 0, div_pcblist, "S,xinpcb", "List of active divert sockets");
742 #endif
743 
744 struct pr_usrreqs div_usrreqs = {
745 	.pru_attach =		div_attach,
746 	.pru_bind =		div_bind,
747 	.pru_control =		in_control,
748 	.pru_detach =		div_detach,
749 	.pru_peeraddr =		in_getpeeraddr,
750 	.pru_send =		div_send,
751 	.pru_shutdown =		div_shutdown,
752 	.pru_sockaddr =		in_getsockaddr,
753 	.pru_sosetlabel =	in_pcbsosetlabel
754 };
755 
756 struct protosw div_protosw = {
757 	.pr_type =		SOCK_RAW,
758 	.pr_protocol =		IPPROTO_DIVERT,
759 	.pr_flags =		PR_ATOMIC|PR_ADDR,
760 	.pr_input =		div_input,
761 	.pr_ctlinput =		div_ctlinput,
762 	.pr_ctloutput =		ip_ctloutput,
763 	.pr_init =		div_init,
764 	.pr_usrreqs =		&div_usrreqs
765 };
766 
767 static int
768 div_modevent(module_t mod, int type, void *unused)
769 {
770 	int err = 0;
771 
772 	switch (type) {
773 	case MOD_LOAD:
774 		/*
775 		 * Protocol will be initialized by pf_proto_register().
776 		 * We don't have to register ip_protox because we are not
777 		 * a true IP protocol that goes over the wire.
778 		 */
779 		err = pf_proto_register(PF_INET, &div_protosw);
780 		if (err != 0)
781 			return (err);
782 		ip_divert_ptr = divert_packet;
783 		ip_divert_event_tag = EVENTHANDLER_REGISTER(maxsockets_change,
784 		    div_zone_change, NULL, EVENTHANDLER_PRI_ANY);
785 		break;
786 	case MOD_QUIESCE:
787 		/*
788 		 * IPDIVERT may normally not be unloaded because of the
789 		 * potential race conditions.  Tell kldunload we can't be
790 		 * unloaded unless the unload is forced.
791 		 */
792 		err = EPERM;
793 		break;
794 	case MOD_UNLOAD:
795 		/*
796 		 * Forced unload.
797 		 *
798 		 * Module ipdivert can only be unloaded if no sockets are
799 		 * connected.  Maybe this can be changed later to forcefully
800 		 * disconnect any open sockets.
801 		 *
802 		 * XXXRW: Note that there is a slight race here, as a new
803 		 * socket open request could be spinning on the lock and then
804 		 * we destroy the lock.
805 		 */
806 		INP_INFO_WLOCK(&V_divcbinfo);
807 		if (V_divcbinfo.ipi_count != 0) {
808 			err = EBUSY;
809 			INP_INFO_WUNLOCK(&V_divcbinfo);
810 			break;
811 		}
812 		ip_divert_ptr = NULL;
813 		err = pf_proto_unregister(PF_INET, IPPROTO_DIVERT, SOCK_RAW);
814 		INP_INFO_WUNLOCK(&V_divcbinfo);
815 #ifndef VIMAGE
816 		div_destroy(NULL);
817 #endif
818 		EVENTHANDLER_DEREGISTER(maxsockets_change, ip_divert_event_tag);
819 		break;
820 	default:
821 		err = EOPNOTSUPP;
822 		break;
823 	}
824 	return err;
825 }
826 
827 static moduledata_t ipdivertmod = {
828         "ipdivert",
829         div_modevent,
830         0
831 };
832 
833 DECLARE_MODULE(ipdivert, ipdivertmod, SI_SUB_PROTO_FIREWALL, SI_ORDER_ANY);
834 MODULE_DEPEND(ipdivert, ipfw, 3, 3, 3);
835 MODULE_VERSION(ipdivert, 1);
836