svn commit: r211501 - in head/sys: modules modules/send netinet
netinet6 sys
Ana Kukec
anchie at FreeBSD.org
Thu Aug 19 11:31:04 UTC 2010
Author: anchie
Date: Thu Aug 19 11:31:03 2010
New Revision: 211501
URL: http://svn.freebsd.org/changeset/base/211501
Log:
MFp4: anchie_soc2009 branch:
Add kernel side support for Secure Neighbor Discovery (SeND), RFC 3971.
The implementation consists of a kernel module that gets packets from
the nd6 code, sends them to user space on a dedicated socket and reinjects
them back for further processing.
Hooks are used from nd6 code paths to divert relevant packets to the
send implementation for processing in user space. The hooks are only
triggered if the send module is loaded. In case no user space
application is connected to the send socket, processing continues
normaly as if the module would not be loaded. Unloading the module
is not possible at this time due to missing nd6 locking.
The native SeND socket is similar to a raw IPv6 socket but with its own,
internal pseudo-protocol.
Approved by: bz (mentor)
Added:
head/sys/modules/send/
head/sys/modules/send/Makefile (contents, props changed)
head/sys/netinet6/send.c (contents, props changed)
head/sys/netinet6/send.h (contents, props changed)
Modified:
head/sys/modules/Makefile
head/sys/netinet/in.h
head/sys/netinet6/icmp6.c
head/sys/netinet6/nd6.c
head/sys/netinet6/nd6_nbr.c
head/sys/netinet6/raw_ip6.c
head/sys/sys/mbuf.h
Modified: head/sys/modules/Makefile
==============================================================================
--- head/sys/modules/Makefile Thu Aug 19 11:20:24 2010 (r211500)
+++ head/sys/modules/Makefile Thu Aug 19 11:31:03 2010 (r211501)
@@ -257,6 +257,7 @@ SUBDIR= ${_3dfx} \
${_scsi_low} \
sdhci \
sem \
+ send \
sf \
sge \
siba_bwn \
Added: head/sys/modules/send/Makefile
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/sys/modules/send/Makefile Thu Aug 19 11:31:03 2010 (r211501)
@@ -0,0 +1,7 @@
+# $FreeBSD$
+.PATH: ${.CURDIR}/../../netinet6
+
+KMOD= send
+SRCS= send.c
+
+.include <bsd.kmod.mk>
Modified: head/sys/netinet/in.h
==============================================================================
--- head/sys/netinet/in.h Thu Aug 19 11:20:24 2010 (r211500)
+++ head/sys/netinet/in.h Thu Aug 19 11:31:03 2010 (r211501)
@@ -252,6 +252,7 @@ __END_DECLS
/* Only used internally, so can be outside the range of valid IP protocols. */
#define IPPROTO_DIVERT 258 /* divert pseudo-protocol */
+#define IPPROTO_SEND 259 /* SeND pseudo-protocol */
/*
* Defined to avoid confusion. The master value is defined by
Modified: head/sys/netinet6/icmp6.c
==============================================================================
--- head/sys/netinet6/icmp6.c Thu Aug 19 11:20:24 2010 (r211500)
+++ head/sys/netinet6/icmp6.c Thu Aug 19 11:31:03 2010 (r211501)
@@ -105,6 +105,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/scope6_var.h>
#include <netinet6/mld6_var.h>
#include <netinet6/nd6.h>
+#include <netinet6/send.h>
#ifdef IPSEC
#include <netipsec/ipsec.h>
@@ -414,6 +415,7 @@ icmp6_input(struct mbuf **mp, int *offp,
int icmp6len = m->m_pkthdr.len - *offp;
int code, sum, noff;
char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
+ int ip6len, error;
ifp = m->m_pkthdr.rcvif;
@@ -428,6 +430,7 @@ icmp6_input(struct mbuf **mp, int *offp,
*/
ip6 = mtod(m, struct ip6_hdr *);
+ ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
if (icmp6len < sizeof(struct icmp6_hdr)) {
ICMP6STAT_INC(icp6s_tooshort);
goto freeit;
@@ -766,11 +769,35 @@ icmp6_input(struct mbuf **mp, int *offp,
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
/* give up local */
- nd6_rs_input(m, off, icmp6len);
+
+ /* Send incoming SeND packet to user space. */
+ if (send_sendso_input_hook != NULL) {
+ IP6_EXTHDR_CHECK(m, off,
+ icmp6len, IPPROTO_DONE);
+ error = send_sendso_input_hook(m, ifp,
+ SND_IN, ip6len);
+ /* -1 == no app on SEND socket */
+ if (error == 0)
+ return (IPPROTO_DONE);
+ nd6_rs_input(m, off, icmp6len);
+ } else
+ nd6_rs_input(m, off, icmp6len);
m = NULL;
goto freeit;
}
- nd6_rs_input(n, off, icmp6len);
+ if (send_sendso_input_hook != NULL) {
+ IP6_EXTHDR_CHECK(m, off,
+ icmp6len, IPPROTO_DONE);
+ error = send_sendso_input_hook(n, ifp,
+ SND_IN, ip6len);
+ if (error == 0) {
+ m_freem(n);
+ return (IPPROTO_DONE);
+ }
+ /* -1 == no app on SEND socket */
+ nd6_rs_input(n, off, icmp6len);
+ } else
+ nd6_rs_input(n, off, icmp6len);
/* m stays. */
break;
@@ -781,12 +808,28 @@ icmp6_input(struct mbuf **mp, int *offp,
if (icmp6len < sizeof(struct nd_router_advert))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
- /* give up local */
- nd6_ra_input(m, off, icmp6len);
+
+ /* Send incoming SeND-protected/ND packet to user space. */
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(m, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ nd6_ra_input(m, off, icmp6len);
+ } else
+ nd6_ra_input(m, off, icmp6len);
m = NULL;
+ m_freem(n);
goto freeit;
}
- nd6_ra_input(n, off, icmp6len);
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(n, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ nd6_ra_input(n, off, icmp6len);
+ } else
+ nd6_ra_input(n, off, icmp6len);
/* m stays. */
break;
@@ -797,12 +840,26 @@ icmp6_input(struct mbuf **mp, int *offp,
if (icmp6len < sizeof(struct nd_neighbor_solicit))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
- /* give up local */
- nd6_ns_input(m, off, icmp6len);
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(m, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ nd6_ns_input(m, off, icmp6len);
+ } else
+ nd6_ns_input(m, off, icmp6len);
+ m_freem(n);
m = NULL;
goto freeit;
}
- nd6_ns_input(n, off, icmp6len);
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(n, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ nd6_ns_input(n, off, icmp6len);
+ } else
+ nd6_ns_input(n, off, icmp6len);
/* m stays. */
break;
@@ -813,12 +870,28 @@ icmp6_input(struct mbuf **mp, int *offp,
if (icmp6len < sizeof(struct nd_neighbor_advert))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
- /* give up local */
- nd6_na_input(m, off, icmp6len);
+
+ /* Send incoming SeND-protected/ND packet to user space. */
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(m, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ nd6_na_input(m, off, icmp6len);
+ } else
+ nd6_na_input(m, off, icmp6len);
+ m_freem(n);
m = NULL;
goto freeit;
}
- nd6_na_input(n, off, icmp6len);
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(n, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ nd6_na_input(n, off, icmp6len);
+ } else
+ nd6_na_input(n, off, icmp6len);
/* m stays. */
break;
@@ -829,12 +902,26 @@ icmp6_input(struct mbuf **mp, int *offp,
if (icmp6len < sizeof(struct nd_redirect))
goto badlen;
if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
- /* give up local */
- icmp6_redirect_input(m, off);
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(m, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ icmp6_redirect_input(m, off);
+ } else
+ icmp6_redirect_input(m, off);
+ m_freem(n);
m = NULL;
goto freeit;
}
- icmp6_redirect_input(n, off);
+ if (send_sendso_input_hook != NULL) {
+ error = send_sendso_input_hook(n, ifp,
+ SND_IN, ip6len);
+ if (error == 0)
+ return (IPPROTO_DONE);
+ icmp6_redirect_input(n, off);
+ } else
+ icmp6_redirect_input(n, off);
/* m stays. */
break;
@@ -2476,6 +2563,7 @@ icmp6_redirect_output(struct mbuf *m0, s
struct in6_addr *router_ll6;
struct ip6_hdr *sip6; /* m0 as struct ip6_hdr */
struct mbuf *m = NULL; /* newly allocated one */
+ struct m_tag *mtag;
struct ip6_hdr *ip6; /* m as struct ip6_hdr */
struct nd_redirect *nd_rd;
struct llentry *ln = NULL;
@@ -2735,6 +2823,15 @@ noredhdropt:;
nd_rd->nd_rd_cksum = in6_cksum(m, IPPROTO_ICMPV6,
sizeof(*ip6), ntohs(ip6->ip6_plen));
+ if (send_sendso_input_hook != NULL) {
+ mtag = m_tag_get(PACKET_TAG_ND_OUTGOING, sizeof(unsigned short),
+ M_NOWAIT);
+ if (mtag == NULL)
+ goto fail;
+ *(unsigned short *)(mtag + 1) = nd_rd->nd_rd_type;
+ m_tag_prepend(m, mtag);
+ }
+
/* send the packet to outside... */
ip6_output(m, NULL, NULL, 0, NULL, &outif, NULL);
if (outif) {
Modified: head/sys/netinet6/nd6.c
==============================================================================
--- head/sys/netinet6/nd6.c Thu Aug 19 11:20:24 2010 (r211500)
+++ head/sys/netinet6/nd6.c Thu Aug 19 11:31:03 2010 (r211501)
@@ -72,6 +72,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/nd6.h>
#include <netinet6/in6_ifattach.h>
#include <netinet/icmp6.h>
+#include <netinet6/send.h>
#include <sys/limits.h>
@@ -121,6 +122,8 @@ VNET_DEFINE(int, nd6_recalc_reachtm_inte
static struct sockaddr_in6 all1_sa;
+int (*send_sendso_input_hook)(struct mbuf *, struct ifnet *, int, int);
+
static int nd6_is_new_addr_neighbor __P((struct sockaddr_in6 *,
struct ifnet *));
static void nd6_setmtu0(struct ifnet *, struct nd_ifinfo *);
@@ -1758,9 +1761,12 @@ nd6_output_lle(struct ifnet *ifp, struct
struct mbuf **chain)
{
struct mbuf *m = m0;
+ struct m_tag *mtag;
struct llentry *ln = lle;
+ struct ip6_hdr *ip6;
int error = 0;
int flags = 0;
+ int ip6len;
#ifdef INVARIANTS
if (lle != NULL) {
@@ -1935,6 +1941,28 @@ nd6_output_lle(struct ifnet *ifp, struct
#ifdef MAC
mac_netinet6_nd6_send(ifp, m);
#endif
+
+ /*
+ * If called from nd6_ns_output() (NS), nd6_na_output() (NA),
+ * icmp6_redirect_output() (REDIRECT) or from rip6_output() (RS, RA
+ * as handled by rtsol and rtadvd), mbufs will be tagged for SeND
+ * to be diverted to user space. When re-injected into the kernel,
+ * send_output() will directly dispatch them to the outgoing interface.
+ */
+ if (send_sendso_input_hook != NULL) {
+ mtag = m_tag_find(m, PACKET_TAG_ND_OUTGOING, NULL);
+ if (mtag != NULL) {
+ ip6 = mtod(m, struct ip6_hdr *);
+ ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
+ /* Use the SEND socket */
+ error = send_sendso_input_hook(m, ifp, SND_OUT,
+ ip6len);
+ /* -1 == no app on SEND socket */
+ if (error == 0 || error != -1)
+ return (error);
+ }
+ }
+
/*
* We were passed in a pointer to an lle with the lock held
* this means that we can't call if_output as we will
Modified: head/sys/netinet6/nd6_nbr.c
==============================================================================
--- head/sys/netinet6/nd6_nbr.c Thu Aug 19 11:20:24 2010 (r211500)
+++ head/sys/netinet6/nd6_nbr.c Thu Aug 19 11:31:03 2010 (r211501)
@@ -73,6 +73,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/nd6.h>
#include <netinet/icmp6.h>
#include <netinet/ip_carp.h>
+#include <netinet6/send.h>
#define SDL(s) ((struct sockaddr_dl *)s)
@@ -379,6 +380,7 @@ nd6_ns_output(struct ifnet *ifp, const s
const struct in6_addr *taddr6, struct llentry *ln, int dad)
{
struct mbuf *m;
+ struct m_tag *mtag;
struct ip6_hdr *ip6;
struct nd_neighbor_solicit *nd_ns;
struct in6_addr *src, src_in;
@@ -557,6 +559,15 @@ nd6_ns_output(struct ifnet *ifp, const s
nd_ns->nd_ns_cksum =
in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
+ if (send_sendso_input_hook != NULL) {
+ mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+ sizeof(unsigned short), M_NOWAIT);
+ if (mtag == NULL)
+ goto bad;
+ *(unsigned short *)(mtag + 1) = nd_ns->nd_ns_type;
+ m_tag_prepend(m, mtag);
+ }
+
ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL);
icmp6_ifstat_inc(ifp, ifs6_out_msg);
icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit);
@@ -604,6 +615,7 @@ nd6_na_input(struct mbuf *m, int off, in
struct llentry *ln = NULL;
union nd_opts ndopts;
struct mbuf *chain = NULL;
+ struct m_tag *mtag;
struct sockaddr_in6 sin6;
char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
@@ -873,6 +885,15 @@ nd6_na_input(struct mbuf *m, int off, in
* we assume ifp is not a loopback here, so just set
* the 2nd argument as the 1st one.
*/
+
+ if (send_sendso_input_hook != NULL) {
+ mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+ sizeof(unsigned short), M_NOWAIT);
+ if (mtag == NULL)
+ goto bad;
+ m_tag_prepend(m, mtag);
+ }
+
nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
}
}
@@ -917,6 +938,7 @@ nd6_na_output(struct ifnet *ifp, const s
struct sockaddr *sdl0)
{
struct mbuf *m;
+ struct m_tag *mtag;
struct ip6_hdr *ip6;
struct nd_neighbor_advert *nd_na;
struct ip6_moptions im6o;
@@ -1055,6 +1077,15 @@ nd6_na_output(struct ifnet *ifp, const s
nd_na->nd_na_cksum =
in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
+ if (send_sendso_input_hook != NULL) {
+ mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+ sizeof(unsigned short), M_NOWAIT);
+ if (mtag == NULL)
+ goto bad;
+ *(unsigned short *)(mtag + 1) = nd_na->nd_na_type;
+ m_tag_prepend(m, mtag);
+ }
+
ip6_output(m, NULL, &ro, 0, &im6o, NULL, NULL);
icmp6_ifstat_inc(ifp, ifs6_out_msg);
icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert);
Modified: head/sys/netinet6/raw_ip6.c
==============================================================================
--- head/sys/netinet6/raw_ip6.c Thu Aug 19 11:20:24 2010 (r211500)
+++ head/sys/netinet6/raw_ip6.c Thu Aug 19 11:31:03 2010 (r211501)
@@ -92,6 +92,7 @@ __FBSDID("$FreeBSD$");
#include <netinet/icmp6.h>
#include <netinet/ip6.h>
+#include <netinet/ip_var.h>
#include <netinet6/ip6protosw.h>
#include <netinet6/ip6_mroute.h>
#include <netinet6/in6_pcb.h>
@@ -99,6 +100,7 @@ __FBSDID("$FreeBSD$");
#include <netinet6/nd6.h>
#include <netinet6/raw_ip6.h>
#include <netinet6/scope6_var.h>
+#include <netinet6/send.h>
#ifdef IPSEC
#include <netipsec/ipsec.h>
@@ -390,6 +392,7 @@ rip6_output(m, va_alist)
#endif
{
struct mbuf *control;
+ struct m_tag *mtag;
struct socket *so;
struct sockaddr_in6 *dstsock;
struct in6_addr *dst;
@@ -532,6 +535,23 @@ rip6_output(m, va_alist)
*p = in6_cksum(m, ip6->ip6_nxt, sizeof(*ip6), plen);
}
+ /*
+ * Send RA/RS messages to user land for protection, before sending
+ * them to rtadvd/rtsol.
+ */
+ if ((send_sendso_input_hook != NULL) &&
+ so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
+ switch (type) {
+ case ND_ROUTER_ADVERT:
+ case ND_ROUTER_SOLICIT:
+ mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+ sizeof(unsigned short), M_NOWAIT);
+ if (mtag == NULL)
+ goto bad;
+ m_tag_prepend(m, mtag);
+ }
+ }
+
error = ip6_output(m, optp, NULL, 0, in6p->in6p_moptions, &oifp, in6p);
if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
if (oifp)
Added: head/sys/netinet6/send.c
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/sys/netinet6/send.c Thu Aug 19 11:31:03 2010 (r211501)
@@ -0,0 +1,367 @@
+/*-
+ * Copyright (c) 2009-2010 Ana Kukec <anchie at FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/mbuf.h>
+#include <sys/module.h>
+#include <sys/priv.h>
+#include <sys/protosw.h>
+#include <sys/systm.h>
+#include <sys/socket.h>
+#include <sys/sockstate.h>
+#include <sys/sockbuf.h>
+#include <sys/socketvar.h>
+#include <sys/types.h>
+
+#include <net/route.h>
+#include <net/if.h>
+#include <net/if_var.h>
+#include <net/vnet.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+#include <netinet/ip6.h>
+#include <netinet/icmp6.h>
+
+#include <netinet6/in6_var.h>
+#include <netinet6/nd6.h>
+#include <netinet6/scope6_var.h>
+#include <netinet6/send.h>
+
+MALLOC_DEFINE(M_SEND, "send", "Secure Neighbour Discovery");
+
+/*
+ * The socket used to communicate with the SeND daemon.
+ */
+static VNET_DEFINE(struct socket *, send_so);
+#define V_send_so VNET(send_so)
+
+u_long send_sendspace = 8 * (1024 + sizeof(struct sockaddr_send));
+u_long send_recvspace = 9216;
+
+struct mtx send_mtx;
+#define SEND_LOCK_INIT() mtx_init(&send_mtx, "send_mtx", NULL, MTX_DEF)
+#define SEND_LOCK() mtx_lock(&send_mtx)
+#define SEND_UNLOCK() mtx_unlock(&send_mtx)
+#define SEND_LOCK_DESTROY() mtx_destroy(&send_mtx)
+
+static int
+send_attach(struct socket *so, int proto, struct thread *td)
+{
+ int error;
+
+ SEND_LOCK();
+ if (V_send_so != NULL) {
+ SEND_UNLOCK();
+ return (EEXIST);
+ }
+
+ error = priv_check(td, PRIV_NETINET_RAW);
+ if (error) {
+ SEND_UNLOCK();
+ return(error);
+ }
+
+ if (proto != IPPROTO_SEND) {
+ SEND_UNLOCK();
+ return (EPROTONOSUPPORT);
+ }
+ error = soreserve(so, send_sendspace, send_recvspace);
+ if (error) {
+ SEND_UNLOCK();
+ return(error);
+ }
+
+ V_send_so = so;
+ SEND_UNLOCK();
+
+ return (0);
+}
+
+static int
+send_output(struct mbuf *m, struct ifnet *ifp, int direction)
+{
+ struct ip6_hdr *ip6;
+ struct sockaddr_in6 dst;
+ struct icmp6_hdr *icmp6;
+ int icmp6len;
+
+ /*
+ * Receive incoming (SeND-protected) or outgoing traffic
+ * (SeND-validated) from the SeND user space application.
+ */
+
+ switch (direction) {
+ case SND_IN:
+ if (m->m_len < (sizeof(struct ip6_hdr) +
+ sizeof(struct icmp6_hdr))) {
+ m = m_pullup(m, sizeof(struct ip6_hdr) +
+ sizeof(struct icmp6_hdr));
+ if (!m)
+ return (ENOBUFS);
+ }
+
+ /* Before passing off the mbuf record the proper interface. */
+ m->m_pkthdr.rcvif = ifp;
+
+ if (m->m_flags & M_PKTHDR)
+ icmp6len = m->m_pkthdr.len - sizeof(struct ip6_hdr);
+ else
+ panic("Doh! not the first mbuf.");
+
+ ip6 = mtod(m, struct ip6_hdr *);
+ icmp6 = (struct icmp6_hdr *)(ip6 + 1);
+
+ /*
+ * Output the packet as icmp6.c:icpm6_input() would do.
+ * The mbuf is always consumed, so we do not have to
+ * care about that.
+ */
+ switch (icmp6->icmp6_type) {
+ case ND_NEIGHBOR_SOLICIT:
+ nd6_ns_input(m, sizeof(struct ip6_hdr), icmp6len);
+ break;
+ case ND_NEIGHBOR_ADVERT:
+ nd6_na_input(m, sizeof(struct ip6_hdr), icmp6len);
+ break;
+ case ND_REDIRECT:
+ icmp6_redirect_input(m, sizeof(struct ip6_hdr));
+ break;
+ case ND_ROUTER_SOLICIT:
+ nd6_rs_input(m, sizeof(struct ip6_hdr), icmp6len);
+ break;
+ case ND_ROUTER_ADVERT:
+ nd6_ra_input(m, sizeof(struct ip6_hdr), icmp6len);
+ break;
+ default:
+ return (ENOSYS);
+ }
+ return (0);
+
+ case SND_OUT:
+ if (m->m_len < sizeof(struct ip6_hdr)) {
+ m = m_pullup(m, sizeof(struct ip6_hdr));
+ if (!m)
+ return (ENOBUFS);
+ }
+ ip6 = mtod(m, struct ip6_hdr *);
+ if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
+ m->m_flags |= M_MCAST;
+
+ bzero(&dst, sizeof(dst));
+ dst.sin6_family = AF_INET6;
+ dst.sin6_len = sizeof(dst);
+ dst.sin6_addr = ip6->ip6_dst;
+
+ /*
+ * Output the packet as nd6.c:nd6_output_lle() would do.
+ * The mbuf is always consumed, so we do not have to care
+ * about that.
+ * XXX-BZ as we added data, what about fragmenting,
+ * if now needed?
+ */
+ int error;
+ error = ((*ifp->if_output)(ifp, m, (struct sockaddr *)&dst,
+ NULL));
+ if (error)
+ error = ENOENT;
+ return (error);
+
+ default:
+ panic("%s: direction %d neither SND_IN nor SND_OUT.",
+ __func__, direction);
+ }
+}
+
+/*
+ * Receive a SeND message from user space to be either send out by the kernel
+ * or, with SeND ICMPv6 options removed, to be further processed by the icmp6
+ * input path.
+ */
+static int
+send_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
+ struct mbuf *control, struct thread *td)
+{
+ struct sockaddr_send *sendsrc;
+ struct ifnet *ifp;
+ int error;
+
+ KASSERT(V_send_so == so, ("%s: socket %p not send socket %p",
+ __func__, so, V_send_so));
+
+ sendsrc = (struct sockaddr_send *)nam;
+ ifp = ifnet_byindex_ref(sendsrc->send_ifidx);
+ if (ifp == NULL) {
+ error = ENETUNREACH;
+ goto err;
+ }
+
+ error = send_output(m, ifp, sendsrc->send_direction);
+ if_rele(ifp);
+ m = NULL;
+
+err:
+ if (m != NULL)
+ m_freem(m);
+ return (error);
+}
+
+static void
+send_close(struct socket *so)
+{
+
+ SEND_LOCK();
+ if (V_send_so)
+ V_send_so = NULL;
+ SEND_UNLOCK();
+}
+
+/*
+ * Send a SeND message to user space, that was either received and has to be
+ * validated or was about to be send out and has to be handled by the SEND
+ * daemon adding SeND ICMPv6 options.
+ */
+static int
+send_input(struct mbuf *m, struct ifnet *ifp, int direction, int msglen __unused)
+{
+ struct ip6_hdr *ip6;
+ struct sockaddr_send sendsrc;
+
+ SEND_LOCK();
+ if (V_send_so == NULL) {
+ SEND_UNLOCK();
+ return (-1);
+ }
+
+ /*
+ * Make sure to clear any possible internally embedded scope before
+ * passing the packet to user space for SeND cryptographic signature
+ * validation to succeed.
+ */
+ ip6 = mtod(m, struct ip6_hdr *);
+ in6_clearscope(&ip6->ip6_src);
+ in6_clearscope(&ip6->ip6_dst);
+
+ bzero(&sendsrc, sizeof(sendsrc));
+ sendsrc.send_len = sizeof(sendsrc);
+ sendsrc.send_family = AF_INET6;
+ sendsrc.send_direction = direction;
+ sendsrc.send_ifidx = ifp->if_index;
+
+ /*
+ * Send incoming or outgoing traffic to user space either to be
+ * protected (outgoing) or validated (incoming) according to rfc3971.
+ */
+ SOCKBUF_LOCK(&V_send_so->so_rcv);
+ if (sbappendaddr_locked(&V_send_so->so_rcv,
+ (struct sockaddr *)&sendsrc, m, NULL) == 0) {
+ SOCKBUF_UNLOCK(&V_send_so->so_rcv);
+ /* XXX stats. */
+ m_freem(m);
+ } else {
+ sorwakeup_locked(V_send_so);
+ }
+
+ SEND_UNLOCK();
+ return (0);
+}
+
+struct pr_usrreqs send_usrreqs = {
+ .pru_attach = send_attach,
+ .pru_send = send_send,
+ .pru_detach = send_close
+};
+struct protosw send_protosw = {
+ .pr_type = SOCK_RAW,
+ .pr_flags = PR_ATOMIC|PR_ADDR,
+ .pr_protocol = IPPROTO_SEND,
+ .pr_usrreqs = &send_usrreqs
+};
+
+static int
+send_modevent(module_t mod, int type, void *unused)
+{
+#ifdef __notyet__
+ VNET_ITERATOR_DECL(vnet_iter);
+#endif
+ int error;
+
+ switch (type) {
+ case MOD_LOAD:
+ SEND_LOCK_INIT();
+
+ error = pf_proto_register(PF_INET6, &send_protosw);
+ if (error != 0) {
+ printf("%s:%d: MOD_LOAD pf_proto_register(): %d\n",
+ __func__, __LINE__, error);
+ SEND_LOCK_DESTROY();
+ break;
+ }
+ send_sendso_input_hook = send_input;
+ break;
+ case MOD_UNLOAD:
+ /* Do not allow unloading w/o locking. */
+ return (EBUSY);
+#ifdef __notyet__
+ VNET_LIST_RLOCK_NOSLEEP();
+ SEND_LOCK();
+ VNET_FOREACH(vnet_iter) {
+ CURVNET_SET(vnet_iter);
+ if (V_send_so != NULL) {
+ CURVNET_RESTORE();
+ SEND_UNLOCK();
+ VNET_LIST_RUNLOCK_NOSLEEP();
+ return (EBUSY);
+ }
+ CURVNET_RESTORE();
+ }
+ SEND_UNLOCK();
+ VNET_LIST_RUNLOCK_NOSLEEP();
+ error = pf_proto_unregister(PF_INET6, IPPROTO_SEND, SOCK_RAW);
+ if (error == 0)
+ SEND_LOCK_DESTROY();
+ send_sendso_input_hook = NULL;
+ break;
+#endif
+ default:
+ error = 0;
+ break;
+ }
+
+ return (error);
+}
+
+static moduledata_t sendmod = {
+ "send",
+ send_modevent,
+ 0
+};
+
+DECLARE_MODULE(send, sendmod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);
Added: head/sys/netinet6/send.h
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ head/sys/netinet6/send.h Thu Aug 19 11:31:03 2010 (r211501)
@@ -0,0 +1,45 @@
+/*-
+ * Copyright (c) 2009-2010 Ana Kukec <anchie at FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _NETINET6_SEND_H_
+#define _NETINET6_SEND_H_
+
+#define SND_OUT 0 /* Outgoing traffic */
+#define SND_IN 1 /* Incoming traffic. */
+
+struct sockaddr_send {
+ unsigned char send_len; /* total length */
+ sa_family_t send_family; /* address family */
+ int send_direction;
+ int send_ifidx;
+ char send_zero[8];
+};
+
+extern int (*send_sendso_input_hook)(struct mbuf *, struct ifnet *, int, int);
+
+#endif /* _NETINET6_SEND_H_ */
Modified: head/sys/sys/mbuf.h
==============================================================================
--- head/sys/sys/mbuf.h Thu Aug 19 11:20:24 2010 (r211500)
+++ head/sys/sys/mbuf.h Thu Aug 19 11:31:03 2010 (r211501)
@@ -903,6 +903,7 @@ struct mbuf *m_unshare(struct mbuf *, in
#define PACKET_TAG_IPOPTIONS 27 /* Saved IP options */
#define PACKET_TAG_CARP 28 /* CARP info */
#define PACKET_TAG_IPSEC_NAT_T_PORTS 29 /* two uint16_t */
+#define PACKET_TAG_ND_OUTGOING 30 /* ND outgoing */
/* Specific cookies and tags. */
More information about the svn-src-all
mailing list