Changeset 36089 in vbox

Timestamp:

Feb 25, 2011 3:32:02 PM (14 years ago)

Author:

vboxsync

Message:

SrvIntNetR0.cpp: Addressed the allow-network promiscuous mode policy issue wrt related trunk traffic.

File:

• trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp (modified) (12 diffs)

trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp

@@ -72 +72 @@
     /** The MAC address of this entry. */
     RTMAC                   MacAddr;
-    /** Is it promiscuous.
-     * Shadows INTNETIF::fPromiscuousEff.  */
+    /** Is it is effectively promiscuous mode. */
     bool                    fPromiscuousEff;
     /** Is it promiscuous and should it see unrelated trunk traffic. */
@@ -102 +101 @@
     /** Table entries. */
     PINTNETMACTABENTRY      paEntries;
+
+    /** The number of interface entries currently in promicuous mode. */
+    uint32_t                cPromiscuousEntries;
+    /** The number of interface entries currently in promicuous mode that
+     * shall not see unrelated trunk traffic. */
+    uint32_t                cPromiscuousNoTrunkEntries;
 
     /** The host MAC address (reported). */
@@ -224 +229 @@
     /** Set if the INTNET::MacAddr member has been explicitly set. */
     bool                    fMacSet;
-    /** Set if the interface is in promiscuous mode.
-     * This is shadowed by INTNETMACTABENTRY::fPromiscuous. */
-    bool                    fPromiscuousEff;
     /** Tracks the desired promiscuous setting of the interface. */
     bool                    fPromiscuousReal;
@@ -1475 +1477 @@
     }
 
+    /* Network only promicuous mode ifs should see related trunk traffic. */
+    if (   cExactHits
+        && fSrc
+        && pNetwork->MacTab.cPromiscuousNoTrunkEntries)
+    {
+        iIfMac = pTab->cEntries;
+        while (iIfMac-- > 0)
+        {
+            if (   pTab->paEntries[iIfMac].fActive
+                && pTab->paEntries[iIfMac].fPromiscuousEff
+                && !pTab->paEntries[iIfMac].fPromiscuousSeeTrunk)
+            {
+                PINTNETIF pIf = pTab->paEntries[iIfMac].pIf;        AssertPtr(pIf); Assert(pIf->pNetwork == pNetwork);
+                if (intnetR0IfAddrCacheLookup(&pIf->aAddrCache[enmL3AddrType], pL3Addr, cbL3Addr) < 0)
+                {
+                    uint32_t iIfDst = pDstTab->cIfs++;
+                    pDstTab->aIfs[iIfDst].pIf            = pIf;
+                    pDstTab->aIfs[iIfDst].fReplaceDstMac = false;
+                    intnetR0BusyIncIf(pIf);
+                }
+            }
+        }
+    }
+
     /* Does it match the host, or is the host promiscuous? */
     if (pTab->fHostActive)
@@ -1623 +1649 @@
         }
     }
-    /** @todo Interfaces with fPromiscuousEff && !fPromiscuousSeeTrunk needs to
-     *        be added if there are exact matches and fSrc != 0.  This means
-     *        we need to count interfaces in this state to avoid traversing
-     *        the table a second time for no good reason. */
+
+    /* Network only promicuous mode ifs should see related trunk traffic. */
+    if (   cExactHits
+        && fSrc
+        && pNetwork->MacTab.cPromiscuousNoTrunkEntries)
+    {
+        iIfMac = pTab->cEntries;
+        while (iIfMac-- > 0)
+        {
+            if (   pTab->paEntries[iIfMac].fPromiscuousEff
+                && !pTab->paEntries[iIfMac].fPromiscuousSeeTrunk
+                && pTab->paEntries[iIfMac].fActive
+                && !intnetR0AreMacAddrsEqual(&pTab->paEntries[iIfMac].MacAddr, pDstAddr)
+                && !intnetR0IsMacAddrDummy(&pTab->paEntries[iIfMac].MacAddr) )
+            {
+                PINTNETIF pIf    = pTab->paEntries[iIfMac].pIf;     AssertPtr(pIf); Assert(pIf->pNetwork == pNetwork);
+                uint32_t  iIfDst = pDstTab->cIfs++;
+                pDstTab->aIfs[iIfDst].pIf            = pIf;
+                pDstTab->aIfs[iIfDst].fReplaceDstMac = false;
+                intnetR0BusyIncIf(pIf);
+            }
+        }
+    }
 
     /* Does it match the host, or is the host promiscuous? */
@@ -3664 +3709 @@
                                       && (pIf->fOpenFlags  & INTNET_OPEN_FLAGS_IF_PROMISC_ALLOW)
                                       && (pNetwork->fFlags & INTNET_OPEN_FLAGS_PROMISC_ALLOW_CLIENTS);
-            Log(("IntNetR0IfSetPromiscuousMode: hIf=%RX32: Changed from %d (%d) -> %d (%d)\n",
-                 hIf, !fPromiscuous, pIf->fPromiscuousEff, !!fPromiscuous, fPromiscuousEff));
+            Log(("IntNetR0IfSetPromiscuousMode: hIf=%RX32: Changed from %d -> %d (%d)\n",
+                 hIf, !fPromiscuous, !!fPromiscuous, fPromiscuousEff));
 
             pIf->fPromiscuousReal = fPromiscuous;
-            pIf->fPromiscuousEff  = fPromiscuousEff;
 
             PINTNETMACTABENTRY pEntry = intnetR0NetworkFindMacAddrEntry(pNetwork, pIf); Assert(pEntry);
             if (RT_LIKELY(pEntry))
             {
+                if (pEntry->fPromiscuousEff)
+                {
+                    pNetwork->MacTab.cPromiscuousEntries--;
+                    if (!pEntry->fPromiscuousSeeTrunk)
+                        pNetwork->MacTab.cPromiscuousNoTrunkEntries--;
+                    Assert(pNetwork->MacTab.cPromiscuousEntries        < pNetwork->MacTab.cEntries);
+                    Assert(pNetwork->MacTab.cPromiscuousNoTrunkEntries < pNetwork->MacTab.cEntries);
+                }
+
                 pEntry->fPromiscuousEff      = fPromiscuousEff;
                 pEntry->fPromiscuousSeeTrunk = fPromiscuousEff
                                             && (pIf->fOpenFlags & INTNET_OPEN_FLAGS_IF_PROMISC_SEE_TRUNK);
+
+                if (pEntry->fPromiscuousEff)
+                {
+                    pNetwork->MacTab.cPromiscuousEntries++;
+                    if (!pEntry->fPromiscuousSeeTrunk)
+                        pNetwork->MacTab.cPromiscuousNoTrunkEntries++;
+                }
+                Assert(pNetwork->MacTab.cPromiscuousEntries        <= pNetwork->MacTab.cEntries);
+                Assert(pNetwork->MacTab.cPromiscuousNoTrunkEntries <= pNetwork->MacTab.cEntries);
             }
         }
@@ -4236 +4298 @@
             if (pNetwork->MacTab.paEntries[iIf].pIf == pIf)
             {
+                if (pNetwork->MacTab.paEntries[iIf].fPromiscuousEff)
+                {
+                    pNetwork->MacTab.cPromiscuousEntries--;
+                    if (!pNetwork->MacTab.paEntries[iIf].fPromiscuousSeeTrunk)
+                        pNetwork->MacTab.cPromiscuousNoTrunkEntries--;
+                }
+                Assert(pNetwork->MacTab.cPromiscuousEntries        < pNetwork->MacTab.cEntries);
+                Assert(pNetwork->MacTab.cPromiscuousNoTrunkEntries < pNetwork->MacTab.cEntries);
+
                 if (iIf + 1 < pNetwork->MacTab.cEntries)
                     memmove(&pNetwork->MacTab.paEntries[iIf],
@@ -4258 +4329 @@
             pNetwork->fMinFlags = fMinFlags;
         }
+
         PINTNETTRUNKIF pTrunk = pNetwork->MacTab.pTrunk;
 
@@ -4402 +4474 @@
     memset(&pIf->MacAddr, 0xff, sizeof(pIf->MacAddr)); /* broadcast */
     //pIf->fMacSet          = false;
-    //pIf->fPromiscuousEff  = false;
     //pIf->fPromiscuousReal = false;
     //pIf->fActive          = false;
@@ -5351 +5422 @@
         if ((fOldNetFlags ^ fNetFlags) & INTNET_OPEN_FLAGS_PROMISC_ALLOW_CLIENTS)
         {
+            pNetwork->MacTab.cPromiscuousEntries        = 0;
+            pNetwork->MacTab.cPromiscuousNoTrunkEntries = 0;
+
             uint32_t iIf = pNetwork->MacTab.cEntries;
             while (iIf-- > 0)
@@ -5361 +5435 @@
                     bool fPromiscuousEff = (fNetFlags & INTNET_OPEN_FLAGS_PROMISC_ALLOW_CLIENTS)
                                         && (pIf2->fOpenFlags & INTNET_OPEN_FLAGS_IF_PROMISC_ALLOW);
-                    pIf2->fPromiscuousEff        = fPromiscuousEff;
                     pEntry->fPromiscuousEff      = fPromiscuousEff;
                     pEntry->fPromiscuousSeeTrunk = fPromiscuousEff
                                                 && (pIf2->fOpenFlags & INTNET_OPEN_FLAGS_IF_PROMISC_SEE_TRUNK);
+
+                    if (pEntry->fPromiscuousEff)
+                    {
+                        pNetwork->MacTab.cPromiscuousEntries++;
+                        if (!pEntry->fPromiscuousSeeTrunk)
+                            pNetwork->MacTab.cPromiscuousNoTrunkEntries++;
+                    }
                 }
             }
@@ -5541 +5621 @@
     pNetwork->MacTab.cEntries               = 0;
     pNetwork->MacTab.cEntriesAllocated      = INTNET_GROW_DSTTAB_SIZE;
+    //pNetwork->MacTab.cPromiscuousEntries  = 0;
+    //pNetwork->MacTab.cPromiscuousNoTrunkEntries = 0;
     pNetwork->MacTab.paEntries              = NULL;
     pNetwork->MacTab.fHostPromiscuousReal   = false;