10fe49d72c
#if NBPFILTER is no longer required in the client. This change doesn't yet add support for loading bpf as a module, since drivers can register before bpf is attached. However, callers of bpf can now be modularized. Dynamically loadable bpf could probably be done fairly easily with coordination from the stub driver and the real driver by registering attachments in the stub before the real driver is loaded and doing a handoff. ... and I'm not going to ponder the depths of unload here. Tested with i386/MONOLITHIC, modified MONOLITHIC without bpf and rump.
292 lines
6.6 KiB
C
292 lines
6.6 KiB
C
/* $NetBSD: if_pflog.c,v 1.16 2010/01/19 22:08:00 pooka Exp $ */
|
|
/* $OpenBSD: if_pflog.c,v 1.24 2007/05/26 17:13:30 jason Exp $ */
|
|
|
|
/*
|
|
* The authors of this code are John Ioannidis (ji@tla.org),
|
|
* Angelos D. Keromytis (kermit@csd.uch.gr) and
|
|
* Niels Provos (provos@physnet.uni-hamburg.de).
|
|
*
|
|
* This code was written by John Ioannidis for BSD/OS in Athens, Greece,
|
|
* in November 1995.
|
|
*
|
|
* Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
|
|
* by Angelos D. Keromytis.
|
|
*
|
|
* Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
|
|
* and Niels Provos.
|
|
*
|
|
* Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
|
|
* and Niels Provos.
|
|
* Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
|
|
*
|
|
* Permission to use, copy, and modify this software with or without fee
|
|
* is hereby granted, provided that this entire notice is included in
|
|
* all copies of any software which is or includes a copy or
|
|
* modification of this software.
|
|
* You may use this code under the GNU public license if you so wish. Please
|
|
* contribute changes back to the authors under this freer than GPL license
|
|
* so that we may further the use of strong encryption without limitations to
|
|
* all.
|
|
*
|
|
* THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
|
|
* IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
|
|
* REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
|
|
* MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
|
|
* PURPOSE.
|
|
*/
|
|
|
|
#include <sys/cdefs.h>
|
|
__KERNEL_RCSID(0, "$NetBSD: if_pflog.c,v 1.16 2010/01/19 22:08:00 pooka Exp $");
|
|
|
|
#ifdef _KERNEL_OPT
|
|
#include "opt_inet.h"
|
|
#endif
|
|
|
|
#include "pflog.h"
|
|
|
|
#include <sys/param.h>
|
|
#include <sys/systm.h>
|
|
#include <sys/mbuf.h>
|
|
#include <sys/proc.h>
|
|
#include <sys/socket.h>
|
|
#include <sys/ioctl.h>
|
|
|
|
#include <net/if.h>
|
|
#include <net/if_types.h>
|
|
#include <net/route.h>
|
|
#include <net/bpf.h>
|
|
|
|
#ifdef INET
|
|
#include <netinet/in.h>
|
|
#include <netinet/in_var.h>
|
|
#include <netinet/in_systm.h>
|
|
#include <netinet/ip.h>
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
#ifndef INET
|
|
#include <netinet/in.h>
|
|
#endif
|
|
#include <netinet6/nd6.h>
|
|
#endif /* INET6 */
|
|
|
|
#include <net/pfvar.h>
|
|
#include <net/if_pflog.h>
|
|
|
|
#define PFLOGMTU (32768 + MHLEN + MLEN)
|
|
|
|
#ifdef PFLOGDEBUG
|
|
#define DPRINTF(x) do { if (pflogdebug) printf x ; } while (0)
|
|
#else
|
|
#define DPRINTF(x)
|
|
#endif
|
|
|
|
void pflogattach(int);
|
|
int pflogoutput(struct ifnet *, struct mbuf *, const struct sockaddr *,
|
|
struct rtentry *);
|
|
int pflogioctl(struct ifnet *, u_long, void *);
|
|
void pflogstart(struct ifnet *);
|
|
int pflog_clone_create(struct if_clone *, int);
|
|
int pflog_clone_destroy(struct ifnet *);
|
|
|
|
LIST_HEAD(, pflog_softc) pflogif_list;
|
|
struct if_clone pflog_cloner =
|
|
IF_CLONE_INITIALIZER("pflog", pflog_clone_create, pflog_clone_destroy);
|
|
|
|
struct ifnet *pflogifs[PFLOGIFS_MAX]; /* for fast access */
|
|
|
|
void
|
|
pflogattach(int npflog)
|
|
{
|
|
int i;
|
|
|
|
LIST_INIT(&pflogif_list);
|
|
for (i = 0; i < PFLOGIFS_MAX; i++)
|
|
pflogifs[i] = NULL;
|
|
if_clone_attach(&pflog_cloner);
|
|
}
|
|
|
|
int
|
|
pflog_clone_create(struct if_clone *ifc, int unit)
|
|
{
|
|
struct ifnet *ifp;
|
|
struct pflog_softc *pflogif;
|
|
int s;
|
|
|
|
if (unit >= PFLOGIFS_MAX)
|
|
return (EINVAL);
|
|
|
|
if ((pflogif = malloc(sizeof(*pflogif), M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
|
|
return (ENOMEM);
|
|
|
|
pflogif->sc_unit = unit;
|
|
ifp = &pflogif->sc_if;
|
|
snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", unit);
|
|
ifp->if_softc = pflogif;
|
|
ifp->if_mtu = PFLOGMTU;
|
|
ifp->if_ioctl = pflogioctl;
|
|
ifp->if_output = pflogoutput;
|
|
ifp->if_start = pflogstart;
|
|
ifp->if_type = IFT_PFLOG;
|
|
#ifndef __NetBSD__
|
|
ifp->if_snd.ifq_maxlen = ifqmaxlen;
|
|
#endif /* !__NetBSD__ */
|
|
ifp->if_hdrlen = PFLOG_HDRLEN;
|
|
if_attach(ifp);
|
|
if_alloc_sadl(ifp);
|
|
|
|
#ifdef __NetBSD__
|
|
bpf_ops->bpf_attach(ifp, DLT_PFLOG, PFLOG_HDRLEN, &ifp->if_bpf);
|
|
#else
|
|
bpfattach(&pflogif->sc_if.if_bpf, ifp, DLT_PFLOG, PFLOG_HDRLEN);
|
|
#endif /* !__NetBSD__ */
|
|
|
|
s = splnet();
|
|
LIST_INSERT_HEAD(&pflogif_list, pflogif, sc_list);
|
|
pflogifs[unit] = ifp;
|
|
splx(s);
|
|
|
|
return (0);
|
|
}
|
|
|
|
int
|
|
pflog_clone_destroy(struct ifnet *ifp)
|
|
{
|
|
struct pflog_softc *pflogif = ifp->if_softc;
|
|
int s;
|
|
|
|
s = splnet();
|
|
pflogifs[pflogif->sc_unit] = NULL;
|
|
LIST_REMOVE(pflogif, sc_list);
|
|
splx(s);
|
|
|
|
bpf_ops->bpf_detach(ifp);
|
|
if_detach(ifp);
|
|
free(pflogif, M_DEVBUF);
|
|
return (0);
|
|
}
|
|
|
|
/*
|
|
* Start output on the pflog interface.
|
|
*/
|
|
void
|
|
pflogstart(struct ifnet *ifp)
|
|
{
|
|
struct mbuf *m;
|
|
int s;
|
|
|
|
for (;;) {
|
|
s = splnet();
|
|
IF_DROP(&ifp->if_snd);
|
|
IF_DEQUEUE(&ifp->if_snd, m);
|
|
splx(s);
|
|
|
|
if (m == NULL)
|
|
return;
|
|
else
|
|
m_freem(m);
|
|
}
|
|
}
|
|
|
|
int
|
|
pflogoutput(struct ifnet *ifp, struct mbuf *m,
|
|
const struct sockaddr *dst, struct rtentry *rt)
|
|
{
|
|
m_freem(m);
|
|
return (0);
|
|
}
|
|
|
|
/* ARGSUSED */
|
|
int
|
|
pflogioctl(struct ifnet *ifp, u_long cmd, void *data)
|
|
{
|
|
int error = 0;
|
|
|
|
switch (cmd) {
|
|
case SIOCSIFFLAGS:
|
|
if ((error = ifioctl_common(ifp, cmd, data)) != 0)
|
|
break;
|
|
/*FALLTHROUGH*/
|
|
case SIOCINITIFADDR:
|
|
case SIOCAIFADDR:
|
|
case SIOCSIFDSTADDR:
|
|
if (ifp->if_flags & IFF_UP)
|
|
ifp->if_flags |= IFF_RUNNING;
|
|
else
|
|
ifp->if_flags &= ~IFF_RUNNING;
|
|
break;
|
|
default:
|
|
error = ifioctl_common(ifp, cmd, data);
|
|
}
|
|
|
|
return error;
|
|
}
|
|
|
|
int
|
|
pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
|
|
u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
|
|
struct pf_ruleset *ruleset, struct pf_pdesc *pd)
|
|
{
|
|
struct ifnet *ifn;
|
|
struct pfloghdr hdr;
|
|
|
|
if (kif == NULL || m == NULL || rm == NULL || pd == NULL)
|
|
return (-1);
|
|
|
|
if ((ifn = pflogifs[rm->logif]) == NULL || !ifn->if_bpf)
|
|
return (0);
|
|
|
|
bzero(&hdr, sizeof(hdr));
|
|
hdr.length = PFLOG_REAL_HDRLEN;
|
|
hdr.af = af;
|
|
hdr.action = rm->action;
|
|
hdr.reason = reason;
|
|
memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
|
|
|
|
if (am == NULL) {
|
|
hdr.rulenr = htonl(rm->nr);
|
|
hdr.subrulenr = -1;
|
|
} else {
|
|
hdr.rulenr = htonl(am->nr);
|
|
hdr.subrulenr = htonl(rm->nr);
|
|
if (ruleset != NULL && ruleset->anchor != NULL)
|
|
strlcpy(hdr.ruleset, ruleset->anchor->name,
|
|
sizeof(hdr.ruleset));
|
|
}
|
|
if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done)
|
|
pd->lookup.done = pf_socket_lookup(dir, pd);
|
|
if (pd->lookup.done > 0) {
|
|
hdr.uid = pd->lookup.uid;
|
|
hdr.pid = pd->lookup.pid;
|
|
} else {
|
|
hdr.uid = UID_MAX;
|
|
hdr.pid = NO_PID;
|
|
}
|
|
hdr.rule_uid = rm->cuid;
|
|
hdr.rule_pid = rm->cpid;
|
|
hdr.dir = dir;
|
|
|
|
#ifdef INET
|
|
if (af == AF_INET && dir == PF_OUT) {
|
|
struct ip *ip;
|
|
|
|
ip = mtod(m, struct ip *);
|
|
ip->ip_sum = 0;
|
|
ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
|
|
}
|
|
#endif /* INET */
|
|
|
|
ifn->if_opackets++;
|
|
ifn->if_obytes += m->m_pkthdr.len;
|
|
|
|
#ifdef __NetBSD__
|
|
bpf_ops->bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m);
|
|
#else
|
|
bpf_mtap_hdr(ifn->if_bpf, (char *)&hdr, PFLOG_HDRLEN, m,
|
|
BPF_DIRECTION_OUT);
|
|
#endif /* !__NetBSD__ */
|
|
|
|
|
|
return (0);
|
|
}
|