aboutgitcodebugslistschat
path: root/icmp.c
diff options
context:
space:
mode:
Diffstat (limited to 'icmp.c')
-rw-r--r--icmp.c154
1 files changed, 88 insertions, 66 deletions
diff --git a/icmp.c b/icmp.c
index 76bb9e9..7e2b342 100644
--- a/icmp.c
+++ b/icmp.c
@@ -45,14 +45,23 @@
#define ICMP_ECHO_TIMEOUT 60 /* s, timeout for ICMP socket activity */
#define ICMP_NUM_IDS (1U << 16)
-/* Sides of a flow as we use them for ping streams */
-#define SOCKSIDE 0
-#define TAPSIDE 1
+/**
+ * ping_at_sidx() - Get ping specific flow at given sidx
+ * @sidx: Flow and side to retrieve
+ *
+ * Return: ping specific flow at @sidx, or NULL of @sidx is invalid. Asserts if
+ * the flow at @sidx is not FLOW_PING4 or FLOW_PING6
+ */
+static struct icmp_ping_flow *ping_at_sidx(flow_sidx_t sidx)
+{
+ union flow *flow = flow_at_sidx(sidx);
-#define PINGF(idx) (&(FLOW(idx)->ping))
+ if (!flow)
+ return NULL;
-/* Indexed by ICMP echo identifier */
-static struct icmp_ping_flow *icmp_id_map[IP_VERSIONS][ICMP_NUM_IDS];
+ ASSERT(flow->f.type == FLOW_PING4 || flow->f.type == FLOW_PING6);
+ return &flow->ping;
+}
/**
* icmp_sock_handler() - Handle new data from ICMP or ICMPv6 socket
@@ -61,7 +70,8 @@ static struct icmp_ping_flow *icmp_id_map[IP_VERSIONS][ICMP_NUM_IDS];
*/
void icmp_sock_handler(const struct ctx *c, union epoll_ref ref)
{
- struct icmp_ping_flow *pingf = PINGF(ref.flowside.flow);
+ struct icmp_ping_flow *pingf = ping_at_sidx(ref.flowside);
+ const struct flowside *ini = &pingf->f.side[INISIDE];
union sockaddr_inany sr;
socklen_t sl = sizeof(sr);
char buf[USHRT_MAX];
@@ -75,7 +85,7 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref)
n = recvfrom(ref.fd, buf, sizeof(buf), 0, &sr.sa, &sl);
if (n < 0) {
- flow_err(pingf, "recvfrom() error: %s", strerror(errno));
+ flow_perror(pingf, "recvfrom() error");
return;
}
@@ -87,7 +97,7 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref)
goto unexpected;
/* Adjust packet back to guest-side ID */
- ih4->un.echo.id = htons(pingf->id);
+ ih4->un.echo.id = htons(ini->eport);
seq = ntohs(ih4->un.echo.sequence);
} else if (pingf->f.type == FLOW_PING6) {
struct icmp6hdr *ih6 = (struct icmp6hdr *)buf;
@@ -97,7 +107,7 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref)
goto unexpected;
/* Adjust packet back to guest-side ID */
- ih6->icmp6_identifier = htons(pingf->id);
+ ih6->icmp6_identifier = htons(ini->eport);
seq = ntohs(ih6->icmp6_sequence);
} else {
ASSERT(0);
@@ -112,13 +122,20 @@ void icmp_sock_handler(const struct ctx *c, union epoll_ref ref)
}
flow_dbg(pingf, "echo reply to tap, ID: %"PRIu16", seq: %"PRIu16,
- pingf->id, seq);
+ ini->eport, seq);
+
+ if (pingf->f.type == FLOW_PING4) {
+ const struct in_addr *saddr = inany_v4(&ini->oaddr);
+ const struct in_addr *daddr = inany_v4(&ini->eaddr);
+
+ ASSERT(saddr && daddr); /* Must have IPv4 addresses */
+ tap_icmp4_send(c, *saddr, *daddr, buf, n);
+ } else if (pingf->f.type == FLOW_PING6) {
+ const struct in6_addr *saddr = &ini->oaddr.a6;
+ const struct in6_addr *daddr = &ini->eaddr.a6;
- if (pingf->f.type == FLOW_PING4)
- tap_icmp4_send(c, sr.sa4.sin_addr, tap_ip4_daddr(c), buf, n);
- else if (pingf->f.type == FLOW_PING6)
- tap_icmp6_send(c, &sr.sa6.sin6_addr,
- tap_ip6_daddr(c, &sr.sa6.sin6_addr), buf, n);
+ tap_icmp6_send(c, saddr, daddr, buf, n);
+ }
return;
unexpected:
@@ -133,56 +150,54 @@ unexpected:
static void icmp_ping_close(const struct ctx *c,
const struct icmp_ping_flow *pingf)
{
- uint16_t id = pingf->id;
-
- epoll_ctl(c->epollfd, EPOLL_CTL_DEL, pingf->sock, NULL);
+ epoll_del(c, pingf->sock);
close(pingf->sock);
-
- if (pingf->f.type == FLOW_PING4)
- icmp_id_map[V4][id] = NULL;
- else
- icmp_id_map[V6][id] = NULL;
+ flow_hash_remove(c, FLOW_SIDX(pingf, INISIDE));
}
/**
* icmp_ping_new() - Prepare a new ping socket for a new id
* @c: Execution context
- * @id_sock: Pointer to ping flow entry slot in icmp_id_map[] to update
* @af: Address family, AF_INET or AF_INET6
* @id: ICMP id for the new socket
+ * @saddr: Source address
+ * @daddr: Destination address
*
* Return: Newly opened ping flow, or NULL on failure
*/
static struct icmp_ping_flow *icmp_ping_new(const struct ctx *c,
- struct icmp_ping_flow **id_sock,
- sa_family_t af, uint16_t id)
+ sa_family_t af, uint16_t id,
+ const void *saddr, const void *daddr)
{
+ uint8_t proto = af == AF_INET ? IPPROTO_ICMP : IPPROTO_ICMPV6;
uint8_t flowtype = af == AF_INET ? FLOW_PING4 : FLOW_PING6;
union epoll_ref ref = { .type = EPOLL_TYPE_PING };
union flow *flow = flow_alloc();
struct icmp_ping_flow *pingf;
- const void *bind_addr;
- const char *bind_if;
+ const struct flowside *tgt;
if (!flow)
return NULL;
- pingf = FLOW_START(flow, flowtype, ping, TAPSIDE);
-
- pingf->seq = -1;
- pingf->id = id;
+ flow_initiate_af(flow, PIF_TAP, af, saddr, id, daddr, id);
+ if (!(tgt = flow_target(c, flow, proto)))
+ goto cancel;
- if (af == AF_INET) {
- bind_addr = &c->ip4.addr_out;
- bind_if = c->ip4.ifname_out;
- } else {
- bind_addr = &c->ip6.addr_out;
- bind_if = c->ip6.ifname_out;
+ if (flow->f.pif[TGTSIDE] != PIF_HOST) {
+ flow_err(flow, "No support for forwarding %s from %s to %s",
+ proto == IPPROTO_ICMP ? "ICMP" : "ICMPv6",
+ pif_name(flow->f.pif[INISIDE]),
+ pif_name(flow->f.pif[TGTSIDE]));
+ goto cancel;
}
- ref.flowside = FLOW_SIDX(flow, SOCKSIDE);
- pingf->sock = sock_l4(c, af, flow_proto[flowtype], bind_addr, bind_if,
- 0, ref.data);
+ pingf = FLOW_SET_TYPE(flow, flowtype, ping);
+
+ pingf->seq = -1;
+
+ ref.flowside = FLOW_SIDX(flow, TGTSIDE);
+ pingf->sock = flowside_sock_l4(c, EPOLL_TYPE_PING, PIF_HOST,
+ tgt, ref.data);
if (pingf->sock < 0) {
warn("Cannot open \"ping\" socket. You might need to:");
@@ -196,7 +211,9 @@ static struct icmp_ping_flow *icmp_ping_new(const struct ctx *c,
flow_dbg(pingf, "new socket %i for echo ID %"PRIu16, pingf->sock, id);
- *id_sock = pingf;
+ flow_hash_insert(c, FLOW_SIDX(pingf, INISIDE));
+
+ FLOW_ACTIVATE(pingf);
return pingf;
@@ -221,11 +238,14 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af,
const void *saddr, const void *daddr,
const struct pool *p, const struct timespec *now)
{
- union sockaddr_inany sa = { .sa_family = af };
- const socklen_t sl = af == AF_INET ? sizeof(sa.sa4) : sizeof(sa.sa6);
- struct icmp_ping_flow *pingf, **id_sock;
+ struct icmp_ping_flow *pingf;
+ const struct flowside *tgt;
+ union sockaddr_inany sa;
+ size_t dlen, l4len;
uint16_t id, seq;
- size_t plen;
+ union flow *flow;
+ uint8_t proto;
+ socklen_t sl;
void *pkt;
(void)saddr;
@@ -234,49 +254,53 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af,
if (af == AF_INET) {
const struct icmphdr *ih;
- if (!(pkt = packet_get(p, 0, 0, sizeof(*ih), &plen)))
+ if (!(pkt = packet_get(p, 0, 0, sizeof(*ih), &dlen)))
return 1;
ih = (struct icmphdr *)pkt;
- plen += sizeof(*ih);
+ l4len = dlen + sizeof(*ih);
if (ih->type != ICMP_ECHO)
return 1;
+ proto = IPPROTO_ICMP;
id = ntohs(ih->un.echo.id);
- id_sock = &icmp_id_map[V4][id];
seq = ntohs(ih->un.echo.sequence);
- sa.sa4.sin_addr = *(struct in_addr *)daddr;
} else if (af == AF_INET6) {
const struct icmp6hdr *ih;
- if (!(pkt = packet_get(p, 0, 0, sizeof(*ih), &plen)))
+ if (!(pkt = packet_get(p, 0, 0, sizeof(*ih), &dlen)))
return 1;
ih = (struct icmp6hdr *)pkt;
- plen += sizeof(*ih);
+ l4len = dlen + sizeof(*ih);
if (ih->icmp6_type != ICMPV6_ECHO_REQUEST)
return 1;
+ proto = IPPROTO_ICMPV6;
id = ntohs(ih->icmp6_identifier);
- id_sock = &icmp_id_map[V6][id];
seq = ntohs(ih->icmp6_sequence);
- sa.sa6.sin6_addr = *(struct in6_addr *)daddr;
- sa.sa6.sin6_scope_id = c->ifi6;
} else {
ASSERT(0);
}
- if (!(pingf = *id_sock))
- if (!(pingf = icmp_ping_new(c, id_sock, af, id)))
- return 1;
+ flow = flow_at_sidx(flow_lookup_af(c, proto, PIF_TAP,
+ af, saddr, daddr, id, id));
+ if (flow)
+ pingf = &flow->ping;
+ else if (!(pingf = icmp_ping_new(c, af, id, saddr, daddr)))
+ return 1;
+
+ tgt = &pingf->f.side[TGTSIDE];
+
+ ASSERT(flow_proto[pingf->f.type] == proto);
pingf->ts = now->tv_sec;
- if (sendto(pingf->sock, pkt, plen, MSG_NOSIGNAL, &sa.sa, sl) < 0) {
- flow_dbg(pingf, "failed to relay request to socket: %s",
- strerror(errno));
+ pif_sockaddr(c, &sa, &sl, PIF_HOST, &tgt->eaddr, 0);
+ if (sendto(pingf->sock, pkt, l4len, MSG_NOSIGNAL, &sa.sa, sl) < 0) {
+ flow_dbg_perror(pingf, "failed to relay request to socket");
} else {
flow_dbg(pingf,
"echo request to socket, ID: %"PRIu16", seq: %"PRIu16,
@@ -289,16 +313,14 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af,
/**
* icmp_ping_timer() - Handler for timed events related to a given flow
* @c: Execution context
- * @flow: flow table entry to check for timeout
+ * @pingf: Ping flow to check for timeout
* @now: Current timestamp
*
* Return: true if the flow is ready to free, false otherwise
*/
-bool icmp_ping_timer(const struct ctx *c, union flow *flow,
+bool icmp_ping_timer(const struct ctx *c, const struct icmp_ping_flow *pingf,
const struct timespec *now)
{
- const struct icmp_ping_flow *pingf = &flow->ping;
-
if (now->tv_sec - pingf->ts <= ICMP_ECHO_TIMEOUT)
return false;
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-04 00:47:24 +0000