NetBSD/dist/ipf/mlfk_ipl.c

272 lines
6.4 KiB
C
Raw Normal View History

2005-02-08 09:52:59 +03:00
/* $NetBSD: mlfk_ipl.c,v 1.1.1.7 2005/02/08 06:53:02 martti Exp $ */
2000-05-03 14:55:27 +04:00
/*
2004-03-28 12:55:20 +04:00
* Copyright (C) 2000 by Darren Reed.
2000-05-03 14:55:27 +04:00
*
2004-03-28 12:55:20 +04:00
* See the IPFILTER.LICENCE file for details on licencing.
2000-05-03 14:55:27 +04:00
*/
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/kernel.h>
#include <sys/module.h>
#include <sys/conf.h>
#include <sys/socket.h>
#include <sys/sysctl.h>
#include <net/if.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ipl.h>
#include <netinet/ip_compat.h>
#include <netinet/ip_fil.h>
#include <netinet/ip_state.h>
#include <netinet/ip_nat.h>
#include <netinet/ip_auth.h>
#include <netinet/ip_frag.h>
2005-02-08 09:52:59 +03:00
#if __FreeBSD_version >= 502116
static struct cdev *ipf_devs[IPL_LOGSIZE];
#else
2004-03-28 12:55:20 +04:00
static dev_t ipf_devs[IPL_LOGSIZE];
2005-02-08 09:52:59 +03:00
#endif
2004-03-28 12:55:20 +04:00
static int sysctl_ipf_int ( SYSCTL_HANDLER_ARGS );
static int ipf_modload(void);
static int ipf_modunload(void);
2000-05-03 14:55:27 +04:00
SYSCTL_DECL(_net_inet);
2004-03-28 12:55:20 +04:00
#define SYSCTL_IPF(parent, nbr, name, access, ptr, val, descr) \
SYSCTL_OID(parent, nbr, name, CTLTYPE_INT|access, \
ptr, val, sysctl_ipf_int, "I", descr);
#define CTLFLAG_OFF 0x00800000 /* IPFilter must be disabled */
#define CTLFLAG_RWO (CTLFLAG_RW|CTLFLAG_OFF)
2000-05-03 14:55:27 +04:00
SYSCTL_NODE(_net_inet, OID_AUTO, ipf, CTLFLAG_RW, 0, "IPF");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_flags, CTLFLAG_RW, &fr_flags, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_pass, CTLFLAG_RW, &fr_pass, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_active, CTLFLAG_RD, &fr_active, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcpidletimeout, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_tcpidletimeout, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcphalfclosed, CTLFLAG_RWO,
&fr_tcphalfclosed, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcpclosewait, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_tcpclosewait, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcplastack, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_tcplastack, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcptimeout, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_tcptimeout, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_tcpclosed, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_tcpclosed, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_udptimeout, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_udptimeout, 0, "");
2005-02-08 09:52:59 +03:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_udpacktimeout, CTLFLAG_RWO,
&fr_udpacktimeout, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_icmptimeout, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_icmptimeout, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_defnatage, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_defnatage, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_ipfrttl, CTLFLAG_RW,
2000-05-03 14:55:27 +04:00
&fr_ipfrttl, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_running, CTLFLAG_RD,
2000-05-03 14:55:27 +04:00
&fr_running, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_statesize, CTLFLAG_RWO,
&fr_statesize, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_statemax, CTLFLAG_RWO,
&fr_statemax, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_nattable_sz, CTLFLAG_RWO,
&ipf_nattable_sz, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_natrules_sz, CTLFLAG_RWO,
&ipf_natrules_sz, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_rdrrules_sz, CTLFLAG_RWO,
&ipf_rdrrules_sz, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, ipf_hostmap_sz, CTLFLAG_RWO,
&ipf_hostmap_sz, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_authsize, CTLFLAG_RWO,
2000-05-03 14:55:27 +04:00
&fr_authsize, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_authused, CTLFLAG_RD,
2000-05-03 14:55:27 +04:00
&fr_authused, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_defaultauthage, CTLFLAG_RW,
2000-05-03 14:55:27 +04:00
&fr_defaultauthage, 0, "");
2004-03-28 12:55:20 +04:00
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_chksrc, CTLFLAG_RW, &fr_chksrc, 0, "");
SYSCTL_IPF(_net_inet_ipf, OID_AUTO, fr_minttl, CTLFLAG_RW, &fr_minttl, 0, "");
2000-05-03 14:55:27 +04:00
#define CDEV_MAJOR 79
2004-03-28 12:55:20 +04:00
#if __FreeBSD_version >= 501000
static struct cdevsw ipl_cdevsw = {
2005-02-08 09:52:59 +03:00
#if __FreeBSD_version >= 502103
.d_version = D_VERSION,
.d_flags = 0, /* D_NEEDGIANT - Should be SMP safe */
#endif
2004-03-28 12:55:20 +04:00
.d_open = iplopen,
.d_close = iplclose,
.d_read = iplread,
.d_ioctl = iplioctl,
.d_name = "ipl",
.d_maj = CDEV_MAJOR,
};
#else
2000-05-03 14:55:27 +04:00
static struct cdevsw ipl_cdevsw = {
/* open */ iplopen,
/* close */ iplclose,
/* read */ iplread,
2005-02-08 09:52:59 +03:00
/* write */ iplwrite,
2000-05-03 14:55:27 +04:00
/* ioctl */ iplioctl,
/* poll */ nopoll,
/* mmap */ nommap,
/* strategy */ nostrategy,
/* name */ "ipl",
/* maj */ CDEV_MAJOR,
/* dump */ nodump,
/* psize */ nopsize,
/* flags */ 0,
2004-03-28 12:55:20 +04:00
# if (__FreeBSD_version < 500043)
/* bmaj */ -1,
# endif
/* kqfilter */ NULL
2000-05-03 14:55:27 +04:00
};
2004-03-28 12:55:20 +04:00
#endif
static char *ipf_devfiles[] = { IPL_NAME, IPNAT_NAME, IPSTATE_NAME, IPAUTH_NAME,
2005-02-08 09:52:59 +03:00
IPSYNC_NAME, IPSCAN_NAME, IPLOOKUP_NAME, NULL };
2000-05-03 14:55:27 +04:00
2004-07-23 09:33:55 +04:00
2000-05-03 14:55:27 +04:00
static int
ipfilter_modevent(module_t mod, int type, void *unused)
{
2004-03-28 12:55:20 +04:00
int error = 0;
2000-05-03 14:55:27 +04:00
2004-03-28 12:55:20 +04:00
switch (type)
{
2000-05-03 14:55:27 +04:00
case MOD_LOAD :
2004-03-28 12:55:20 +04:00
error = ipf_modload();
break;
case MOD_UNLOAD :
error = ipf_modunload();
break;
default:
error = EINVAL;
break;
}
return error;
}
2000-05-03 14:55:27 +04:00
2004-03-28 12:55:20 +04:00
static int
ipf_modload()
{
char *defpass, *c, *str;
int i, j, error;
2000-05-03 14:55:27 +04:00
2004-03-28 12:55:20 +04:00
error = iplattach();
if (error)
return error;
2000-05-03 14:55:27 +04:00
2004-03-28 12:55:20 +04:00
for (i = 0; i < IPL_LOGSIZE; i++)
ipf_devs[i] = NULL;
2000-05-03 14:55:27 +04:00
2004-03-28 12:55:20 +04:00
for (i = 0; (str = ipf_devfiles[i]); i++) {
2000-05-03 14:55:27 +04:00
c = NULL;
2004-03-28 12:55:20 +04:00
for(j = strlen(str); j > 0; j--)
if (str[j] == '/') {
c = str + j + 1;
2000-05-03 14:55:27 +04:00
break;
}
if (!c)
2004-03-28 12:55:20 +04:00
c = str;
ipf_devs[i] = make_dev(&ipl_cdevsw, i, 0, 0, 0600, c);
}
2000-05-03 14:55:27 +04:00
2004-03-28 12:55:20 +04:00
if (FR_ISPASS(fr_pass))
defpass = "pass";
else if (FR_ISBLOCK(fr_pass))
defpass = "block";
else
defpass = "no-match -> block";
printf("%s initialized. Default = %s all, Logging = %s%s\n",
ipfilter_version, defpass,
#ifdef IPFILTER_LOG
"enabled",
#else
"disabled",
#endif
#ifdef IPFILTER_COMPILED
" (COMPILED)"
#else
""
#endif
);
return 0;
}
static int
ipf_modunload()
{
int error, i;
if (fr_refcnt)
return EBUSY;
if (fr_running >= 0) {
2000-05-03 14:55:27 +04:00
error = ipldetach();
2004-03-28 12:55:20 +04:00
if (error != 0)
return error;
} else
error = 0;
fr_running = -2;
for (i = 0; ipf_devfiles[i]; i++) {
if (ipf_devs[i] != NULL)
destroy_dev(ipf_devs[i]);
2000-05-03 14:55:27 +04:00
}
2004-03-28 12:55:20 +04:00
printf("%s unloaded\n", ipfilter_version);
2000-05-03 14:55:27 +04:00
return error;
}
2004-03-28 12:55:20 +04:00
2000-05-03 14:55:27 +04:00
static moduledata_t ipfiltermod = {
2004-07-23 09:33:55 +04:00
"ipfilter",
2000-05-03 14:55:27 +04:00
ipfilter_modevent,
2004-03-28 12:55:20 +04:00
0
2000-05-03 14:55:27 +04:00
};
2004-03-28 12:55:20 +04:00
2000-05-03 14:55:27 +04:00
DECLARE_MODULE(ipfilter, ipfiltermod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);
2004-07-23 09:33:55 +04:00
#ifdef MODULE_VERSION
MODULE_VERSION(ipfilter, 1);
#endif
2004-03-28 12:55:20 +04:00
#ifdef SYSCTL_IPF
int
sysctl_ipf_int ( SYSCTL_HANDLER_ARGS )
{
int error = 0;
if (arg1)
error = SYSCTL_OUT(req, arg1, sizeof(int));
else
error = SYSCTL_OUT(req, &arg2, sizeof(int));
if (error || !req->newptr)
return (error);
if (!arg1)
error = EPERM;
else {
if ((oidp->oid_kind & CTLFLAG_OFF) && (fr_running > 0))
error = EBUSY;
else
error = SYSCTL_IN(req, arg1, sizeof(int));
}
return (error);
}
#endif