xref: /freebsd/sys/netinet6/send.c (revision 13de33a5dc2304b13d595d75d48c51793958474f)
1 /*-
2  * Copyright (c) 2009-2010 Ana Kukec <anchie@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include <sys/param.h>
31 #include <sys/kernel.h>
32 #include <sys/mbuf.h>
33 #include <sys/module.h>
34 #include <sys/priv.h>
35 #include <sys/protosw.h>
36 #include <sys/sdt.h>
37 #include <sys/systm.h>
38 #include <sys/socket.h>
39 #include <sys/sockstate.h>
40 #include <sys/sockbuf.h>
41 #include <sys/socketvar.h>
42 #include <sys/types.h>
43 
44 #include <net/route.h>
45 #include <net/if.h>
46 #include <net/if_var.h>
47 #include <net/vnet.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/in_kdtrace.h>
51 #include <netinet/ip_var.h>
52 #include <netinet/ip6.h>
53 #include <netinet/icmp6.h>
54 
55 #include <netinet6/in6_var.h>
56 #include <netinet6/nd6.h>
57 #include <netinet6/scope6_var.h>
58 #include <netinet6/send.h>
59 
60 static MALLOC_DEFINE(M_SEND, "send", "Secure Neighbour Discovery");
61 
62 /*
63  * The socket used to communicate with the SeND daemon.
64  */
65 static VNET_DEFINE(struct socket *, send_so);
66 #define	V_send_so	VNET(send_so)
67 
68 u_long	send_sendspace	= 8 * (1024 + sizeof(struct sockaddr_send));
69 u_long	send_recvspace	= 9216;
70 
71 struct mtx	send_mtx;
72 #define SEND_LOCK_INIT()	mtx_init(&send_mtx, "send_mtx", NULL, MTX_DEF)
73 #define SEND_LOCK()		mtx_lock(&send_mtx)
74 #define SEND_UNLOCK()		mtx_unlock(&send_mtx)
75 #define SEND_LOCK_DESTROY()     mtx_destroy(&send_mtx)
76 
77 static int
78 send_attach(struct socket *so, int proto, struct thread *td)
79 {
80 	int error;
81 
82 	SEND_LOCK();
83 	if (V_send_so != NULL) {
84 		SEND_UNLOCK();
85 		return (EEXIST);
86 	}
87 
88 	error = priv_check(td, PRIV_NETINET_RAW);
89 	if (error) {
90 		SEND_UNLOCK();
91 		return(error);
92 	}
93 
94 	if (proto != IPPROTO_SEND) {
95 		SEND_UNLOCK();
96 		return (EPROTONOSUPPORT);
97 	}
98 	error = soreserve(so, send_sendspace, send_recvspace);
99 	if (error) {
100 		SEND_UNLOCK();
101 		return(error);
102 	}
103 
104 	V_send_so = so;
105 	SEND_UNLOCK();
106 
107 	return (0);
108 }
109 
110 static int
111 send_output(struct mbuf *m, struct ifnet *ifp, int direction)
112 {
113 	struct ip6_hdr *ip6;
114 	struct sockaddr_in6 dst;
115 	struct icmp6_hdr *icmp6;
116 	int icmp6len;
117 
118 	/*
119 	 * Receive incoming (SeND-protected) or outgoing traffic
120 	 * (SeND-validated) from the SeND user space application.
121 	 */
122 
123 	switch (direction) {
124 	case SND_IN:
125 		if (m->m_len < (sizeof(struct ip6_hdr) +
126 		    sizeof(struct icmp6_hdr))) {
127 			m = m_pullup(m, sizeof(struct ip6_hdr) +
128 			    sizeof(struct icmp6_hdr));
129 			if (!m)
130 				return (ENOBUFS);
131 		}
132 
133 		/* Before passing off the mbuf record the proper interface. */
134 		m->m_pkthdr.rcvif = ifp;
135 
136 		if (m->m_flags & M_PKTHDR)
137 			icmp6len = m->m_pkthdr.len - sizeof(struct ip6_hdr);
138 		else
139 			panic("Doh! not the first mbuf.");
140 
141 		ip6 = mtod(m, struct ip6_hdr *);
142 		icmp6 = (struct icmp6_hdr *)(ip6 + 1);
143 
144 		/*
145 		 * Output the packet as icmp6.c:icpm6_input() would do.
146 		 * The mbuf is always consumed, so we do not have to
147 		 * care about that.
148 		 */
149 		switch (icmp6->icmp6_type) {
150 		case ND_NEIGHBOR_SOLICIT:
151 			nd6_ns_input(m, sizeof(struct ip6_hdr), icmp6len);
152 			break;
153 		case ND_NEIGHBOR_ADVERT:
154 			nd6_na_input(m, sizeof(struct ip6_hdr), icmp6len);
155 			break;
156 		case ND_REDIRECT:
157 			icmp6_redirect_input(m, sizeof(struct ip6_hdr));
158 			break;
159 		case ND_ROUTER_SOLICIT:
160 			nd6_rs_input(m, sizeof(struct ip6_hdr), icmp6len);
161 			break;
162 		case ND_ROUTER_ADVERT:
163 			nd6_ra_input(m, sizeof(struct ip6_hdr), icmp6len);
164 			break;
165 		default:
166 			return (ENOSYS);
167 		}
168 		return (0);
169 
170 	case SND_OUT:
171 		if (m->m_len < sizeof(struct ip6_hdr)) {
172 			m = m_pullup(m, sizeof(struct ip6_hdr));
173 			if (!m)
174 				return (ENOBUFS);
175 		}
176 		ip6 = mtod(m, struct ip6_hdr *);
177 		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
178 			m->m_flags |= M_MCAST;
179 
180 		bzero(&dst, sizeof(dst));
181 		dst.sin6_family = AF_INET6;
182 		dst.sin6_len = sizeof(dst);
183 		dst.sin6_addr = ip6->ip6_dst;
184 
185 		m_clrprotoflags(m);	/* Avoid confusing lower layers. */
186 
187 		IP_PROBE(send, NULL, NULL, ip6, ifp, NULL, ip6);
188 
189 		/*
190 		 * Output the packet as nd6.c:nd6_output_lle() would do.
191 		 * The mbuf is always consumed, so we do not have to care
192 		 * about that.
193 		 * XXX-BZ as we added data, what about fragmenting,
194 		 * if now needed?
195 		 */
196 		int error;
197 		error = ((*ifp->if_output)(ifp, m, (struct sockaddr *)&dst,
198 		    NULL));
199 		if (error)
200 			error = ENOENT;
201 		return (error);
202 
203 	default:
204 		panic("%s: direction %d neither SND_IN nor SND_OUT.",
205 		     __func__, direction);
206 	}
207 }
208 
209 /*
210  * Receive a SeND message from user space to be either send out by the kernel
211  * or, with SeND ICMPv6 options removed, to be further processed by the icmp6
212  * input path.
213  */
214 static int
215 send_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
216     struct mbuf *control, struct thread *td)
217 {
218 	struct sockaddr_send *sendsrc;
219 	struct ifnet *ifp;
220 	int error;
221 
222 	KASSERT(V_send_so == so, ("%s: socket %p not send socket %p",
223 		__func__, so, V_send_so));
224 
225 	sendsrc = (struct sockaddr_send *)nam;
226 	ifp = ifnet_byindex_ref(sendsrc->send_ifidx);
227 	if (ifp == NULL) {
228 		error = ENETUNREACH;
229 		goto err;
230 	}
231 
232 	error = send_output(m, ifp, sendsrc->send_direction);
233 	if_rele(ifp);
234 	m = NULL;
235 
236 err:
237 	if (m != NULL)
238 		m_freem(m);
239 	return (error);
240 }
241 
242 static void
243 send_close(struct socket *so)
244 {
245 
246 	SEND_LOCK();
247 	if (V_send_so)
248 		V_send_so = NULL;
249 	SEND_UNLOCK();
250 }
251 
252 /*
253  * Send a SeND message to user space, that was either received and has to be
254  * validated or was about to be send out and has to be handled by the SEND
255  * daemon adding SeND ICMPv6 options.
256  */
257 static int
258 send_input(struct mbuf *m, struct ifnet *ifp, int direction, int msglen __unused)
259 {
260 	struct ip6_hdr *ip6;
261 	struct sockaddr_send sendsrc;
262 
263 	SEND_LOCK();
264 	if (V_send_so == NULL) {
265 		SEND_UNLOCK();
266 		return (-1);
267 	}
268 
269 	/*
270 	 * Make sure to clear any possible internally embedded scope before
271 	 * passing the packet to user space for SeND cryptographic signature
272 	 * validation to succeed.
273 	 */
274 	ip6 = mtod(m, struct ip6_hdr *);
275 	in6_clearscope(&ip6->ip6_src);
276 	in6_clearscope(&ip6->ip6_dst);
277 
278 	bzero(&sendsrc, sizeof(sendsrc));
279 	sendsrc.send_len = sizeof(sendsrc);
280 	sendsrc.send_family = AF_INET6;
281 	sendsrc.send_direction = direction;
282 	sendsrc.send_ifidx = ifp->if_index;
283 
284 	/*
285 	 * Send incoming or outgoing traffic to user space either to be
286 	 * protected (outgoing) or validated (incoming) according to rfc3971.
287 	 */
288 	SOCKBUF_LOCK(&V_send_so->so_rcv);
289 	if (sbappendaddr_locked(&V_send_so->so_rcv,
290 	    (struct sockaddr *)&sendsrc, m, NULL) == 0) {
291 		SOCKBUF_UNLOCK(&V_send_so->so_rcv);
292 		/* XXX stats. */
293 		m_freem(m);
294 	} else {
295 		sorwakeup_locked(V_send_so);
296 	}
297 
298 	SEND_UNLOCK();
299 	return (0);
300 }
301 
302 struct pr_usrreqs send_usrreqs = {
303 	.pru_attach =		send_attach,
304 	.pru_send =		send_send,
305 	.pru_detach =		send_close
306 };
307 struct protosw send_protosw = {
308 	.pr_type =		SOCK_RAW,
309 	.pr_flags =		PR_ATOMIC|PR_ADDR,
310 	.pr_protocol =		IPPROTO_SEND,
311 	.pr_usrreqs =		&send_usrreqs
312 };
313 
314 static int
315 send_modevent(module_t mod, int type, void *unused)
316 {
317 #ifdef __notyet__
318 	VNET_ITERATOR_DECL(vnet_iter);
319 #endif
320 	int error;
321 
322 	switch (type) {
323 	case MOD_LOAD:
324 		SEND_LOCK_INIT();
325 
326 		error = pf_proto_register(PF_INET6, &send_protosw);
327 		if (error != 0) {
328 			printf("%s:%d: MOD_LOAD pf_proto_register(): %d\n",
329 			   __func__, __LINE__, error);
330 			SEND_LOCK_DESTROY();
331 			break;
332 		}
333 		send_sendso_input_hook = send_input;
334 		break;
335 	case MOD_UNLOAD:
336 		/* Do not allow unloading w/o locking. */
337 		return (EBUSY);
338 #ifdef __notyet__
339 		VNET_LIST_RLOCK_NOSLEEP();
340 		SEND_LOCK();
341 		VNET_FOREACH(vnet_iter) {
342 			CURVNET_SET(vnet_iter);
343 			if (V_send_so != NULL) {
344 				CURVNET_RESTORE();
345 				SEND_UNLOCK();
346 				VNET_LIST_RUNLOCK_NOSLEEP();
347 				return (EBUSY);
348 			}
349 			CURVNET_RESTORE();
350 		}
351 		SEND_UNLOCK();
352 		VNET_LIST_RUNLOCK_NOSLEEP();
353 		error = pf_proto_unregister(PF_INET6, IPPROTO_SEND, SOCK_RAW);
354 		if (error == 0)
355 			SEND_LOCK_DESTROY();
356 		send_sendso_input_hook = NULL;
357 		break;
358 #endif
359 	default:
360 		error = 0;
361 		break;
362 	}
363 
364 	return (error);
365 }
366 
367 static moduledata_t sendmod = {
368 	"send",
369 	send_modevent,
370 	0
371 };
372 
373 DECLARE_MODULE(send, sendmod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);
374