if_pflog.c revision 1.3.2.5
1 1.3.2.5 skrll /* $NetBSD: if_pflog.c,v 1.3.2.5 2004/11/29 07:24:33 skrll Exp $ */ 2 1.3.2.5 skrll /* $OpenBSD: if_pflog.c,v 1.12 2004/05/19 17:50:51 dhartmei Exp $ */ 3 1.3.2.2 skrll /* 4 1.3.2.2 skrll * The authors of this code are John Ioannidis (ji (at) tla.org), 5 1.3.2.2 skrll * Angelos D. Keromytis (kermit (at) csd.uch.gr) and 6 1.3.2.2 skrll * Niels Provos (provos (at) physnet.uni-hamburg.de). 7 1.3.2.2 skrll * 8 1.3.2.2 skrll * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 1.3.2.2 skrll * in November 1995. 10 1.3.2.2 skrll * 11 1.3.2.2 skrll * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 1.3.2.2 skrll * by Angelos D. Keromytis. 13 1.3.2.2 skrll * 14 1.3.2.2 skrll * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 1.3.2.2 skrll * and Niels Provos. 16 1.3.2.2 skrll * 17 1.3.2.2 skrll * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis 18 1.3.2.2 skrll * and Niels Provos. 19 1.3.2.2 skrll * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos. 20 1.3.2.2 skrll * 21 1.3.2.2 skrll * Permission to use, copy, and modify this software with or without fee 22 1.3.2.2 skrll * is hereby granted, provided that this entire notice is included in 23 1.3.2.2 skrll * all copies of any software which is or includes a copy or 24 1.3.2.2 skrll * modification of this software. 25 1.3.2.2 skrll * You may use this code under the GNU public license if you so wish. Please 26 1.3.2.2 skrll * contribute changes back to the authors under this freer than GPL license 27 1.3.2.2 skrll * so that we may further the use of strong encryption without limitations to 28 1.3.2.2 skrll * all. 29 1.3.2.2 skrll * 30 1.3.2.2 skrll * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 31 1.3.2.2 skrll * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 32 1.3.2.2 skrll * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 33 1.3.2.2 skrll * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 34 1.3.2.2 skrll * PURPOSE. 35 1.3.2.2 skrll */ 36 1.3.2.2 skrll 37 1.3.2.2 skrll #ifdef _KERNEL_OPT 38 1.3.2.2 skrll #include "opt_inet.h" 39 1.3.2.2 skrll #endif 40 1.3.2.2 skrll 41 1.3.2.2 skrll #include "bpfilter.h" 42 1.3.2.2 skrll #include "pflog.h" 43 1.3.2.2 skrll 44 1.3.2.2 skrll #include <sys/param.h> 45 1.3.2.2 skrll #include <sys/systm.h> 46 1.3.2.2 skrll #include <sys/mbuf.h> 47 1.3.2.2 skrll #include <sys/socket.h> 48 1.3.2.2 skrll #include <sys/ioctl.h> 49 1.3.2.2 skrll 50 1.3.2.2 skrll #include <net/if.h> 51 1.3.2.2 skrll #include <net/if_types.h> 52 1.3.2.2 skrll #include <net/route.h> 53 1.3.2.2 skrll #include <net/bpf.h> 54 1.3.2.2 skrll 55 1.3.2.2 skrll #ifdef INET 56 1.3.2.2 skrll #include <netinet/in.h> 57 1.3.2.2 skrll #include <netinet/in_var.h> 58 1.3.2.2 skrll #include <netinet/in_systm.h> 59 1.3.2.2 skrll #include <netinet/ip.h> 60 1.3.2.2 skrll #endif 61 1.3.2.2 skrll 62 1.3.2.2 skrll #ifdef INET6 63 1.3.2.2 skrll #ifndef INET 64 1.3.2.2 skrll #include <netinet/in.h> 65 1.3.2.2 skrll #endif 66 1.3.2.2 skrll #include <netinet6/nd6.h> 67 1.3.2.2 skrll #endif /* INET6 */ 68 1.3.2.2 skrll 69 1.3.2.2 skrll #include <net/pfvar.h> 70 1.3.2.2 skrll #include <net/if_pflog.h> 71 1.3.2.2 skrll 72 1.3.2.2 skrll #define PFLOGMTU (32768 + MHLEN + MLEN) 73 1.3.2.2 skrll 74 1.3.2.2 skrll #ifdef PFLOGDEBUG 75 1.3.2.2 skrll #define DPRINTF(x) do { if (pflogdebug) printf x ; } while (0) 76 1.3.2.2 skrll #else 77 1.3.2.2 skrll #define DPRINTF(x) 78 1.3.2.2 skrll #endif 79 1.3.2.2 skrll 80 1.3.2.2 skrll struct pflog_softc pflogif[NPFLOG]; 81 1.3.2.2 skrll 82 1.3.2.2 skrll void pflogattach(int); 83 1.3.2.2 skrll #ifdef _LKM 84 1.3.2.2 skrll void pflogdetach(void); 85 1.3.2.2 skrll #endif 86 1.3.2.2 skrll int pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *, 87 1.3.2.2 skrll struct rtentry *); 88 1.3.2.2 skrll int pflogioctl(struct ifnet *, u_long, caddr_t); 89 1.3.2.2 skrll void pflogrtrequest(int, struct rtentry *, struct sockaddr *); 90 1.3.2.2 skrll void pflogstart(struct ifnet *); 91 1.3.2.2 skrll 92 1.3.2.2 skrll extern int ifqmaxlen; 93 1.3.2.2 skrll 94 1.3.2.2 skrll void 95 1.3.2.2 skrll pflogattach(int npflog) 96 1.3.2.2 skrll { 97 1.3.2.2 skrll struct ifnet *ifp; 98 1.3.2.2 skrll int i; 99 1.3.2.2 skrll 100 1.3.2.2 skrll bzero(pflogif, sizeof(pflogif)); 101 1.3.2.2 skrll 102 1.3.2.2 skrll for (i = 0; i < NPFLOG; i++) { 103 1.3.2.2 skrll ifp = &pflogif[i].sc_if; 104 1.3.2.2 skrll snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", i); 105 1.3.2.2 skrll ifp->if_softc = &pflogif[i]; 106 1.3.2.2 skrll ifp->if_mtu = PFLOGMTU; 107 1.3.2.2 skrll ifp->if_ioctl = pflogioctl; 108 1.3.2.2 skrll ifp->if_output = pflogoutput; 109 1.3.2.2 skrll ifp->if_start = pflogstart; 110 1.3.2.2 skrll ifp->if_type = IFT_PFLOG; 111 1.3.2.2 skrll ifp->if_snd.ifq_maxlen = ifqmaxlen; 112 1.3.2.2 skrll ifp->if_hdrlen = PFLOG_HDRLEN; 113 1.3.2.2 skrll if_attach(ifp); 114 1.3.2.2 skrll if_alloc_sadl(ifp); 115 1.3.2.2 skrll 116 1.3.2.2 skrll #if NBPFILTER > 0 117 1.3.2.2 skrll #ifdef __OpenBSD__ 118 1.3.2.2 skrll bpfattach(&pflogif[i].sc_if.if_bpf, ifp, DLT_PFLOG, 119 1.3.2.2 skrll PFLOG_HDRLEN); 120 1.3.2.2 skrll #else 121 1.3.2.2 skrll bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN); 122 1.3.2.2 skrll #endif 123 1.3.2.2 skrll #endif 124 1.3.2.2 skrll } 125 1.3.2.2 skrll } 126 1.3.2.2 skrll 127 1.3.2.2 skrll #ifdef _LKM 128 1.3.2.2 skrll void 129 1.3.2.2 skrll pflogdetach(void) 130 1.3.2.2 skrll { 131 1.3.2.2 skrll struct ifnet *ifp; 132 1.3.2.2 skrll int i; 133 1.3.2.2 skrll 134 1.3.2.2 skrll for (i = 0; i < NPFLOG; i++) { 135 1.3.2.2 skrll ifp = &pflogif[i].sc_if; 136 1.3.2.2 skrll bpfdetach(ifp); 137 1.3.2.2 skrll if_detach(ifp); 138 1.3.2.2 skrll } 139 1.3.2.2 skrll } 140 1.3.2.2 skrll #endif 141 1.3.2.2 skrll 142 1.3.2.2 skrll /* 143 1.3.2.2 skrll * Start output on the pflog interface. 144 1.3.2.2 skrll */ 145 1.3.2.2 skrll void 146 1.3.2.2 skrll pflogstart(struct ifnet *ifp) 147 1.3.2.2 skrll { 148 1.3.2.2 skrll struct mbuf *m; 149 1.3.2.2 skrll int s; 150 1.3.2.2 skrll 151 1.3.2.2 skrll for (;;) { 152 1.3.2.2 skrll #ifdef __OpenBSD__ 153 1.3.2.2 skrll s = splimp(); 154 1.3.2.2 skrll #else 155 1.3.2.2 skrll s = splnet(); 156 1.3.2.2 skrll #endif 157 1.3.2.2 skrll IF_DROP(&ifp->if_snd); 158 1.3.2.2 skrll IF_DEQUEUE(&ifp->if_snd, m); 159 1.3.2.2 skrll splx(s); 160 1.3.2.2 skrll 161 1.3.2.2 skrll if (m == NULL) 162 1.3.2.2 skrll return; 163 1.3.2.2 skrll else 164 1.3.2.2 skrll m_freem(m); 165 1.3.2.2 skrll } 166 1.3.2.2 skrll } 167 1.3.2.2 skrll 168 1.3.2.2 skrll int 169 1.3.2.2 skrll pflogoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 170 1.3.2.2 skrll struct rtentry *rt) 171 1.3.2.2 skrll { 172 1.3.2.2 skrll m_freem(m); 173 1.3.2.2 skrll return (0); 174 1.3.2.2 skrll } 175 1.3.2.2 skrll 176 1.3.2.2 skrll /* ARGSUSED */ 177 1.3.2.2 skrll void 178 1.3.2.2 skrll pflogrtrequest(int cmd, struct rtentry *rt, struct sockaddr *sa) 179 1.3.2.2 skrll { 180 1.3.2.2 skrll if (rt) 181 1.3.2.2 skrll rt->rt_rmx.rmx_mtu = PFLOGMTU; 182 1.3.2.2 skrll } 183 1.3.2.2 skrll 184 1.3.2.2 skrll /* ARGSUSED */ 185 1.3.2.2 skrll int 186 1.3.2.2 skrll pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 187 1.3.2.2 skrll { 188 1.3.2.2 skrll switch (cmd) { 189 1.3.2.2 skrll case SIOCSIFADDR: 190 1.3.2.2 skrll case SIOCAIFADDR: 191 1.3.2.2 skrll case SIOCSIFDSTADDR: 192 1.3.2.2 skrll case SIOCSIFFLAGS: 193 1.3.2.2 skrll if (ifp->if_flags & IFF_UP) 194 1.3.2.2 skrll ifp->if_flags |= IFF_RUNNING; 195 1.3.2.2 skrll else 196 1.3.2.2 skrll ifp->if_flags &= ~IFF_RUNNING; 197 1.3.2.2 skrll break; 198 1.3.2.2 skrll default: 199 1.3.2.2 skrll return (EINVAL); 200 1.3.2.2 skrll } 201 1.3.2.2 skrll 202 1.3.2.2 skrll return (0); 203 1.3.2.2 skrll } 204 1.3.2.2 skrll 205 1.3.2.2 skrll int 206 1.3.2.2 skrll pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir, 207 1.3.2.2 skrll u_int8_t reason, struct pf_rule *rm, struct pf_rule *am, 208 1.3.2.2 skrll struct pf_ruleset *ruleset) 209 1.3.2.2 skrll { 210 1.3.2.2 skrll #if NBPFILTER > 0 211 1.3.2.2 skrll struct ifnet *ifn; 212 1.3.2.2 skrll struct pfloghdr hdr; 213 1.3.2.3 skrll #ifndef __NetBSD__ 214 1.3.2.2 skrll struct mbuf m1; 215 1.3.2.3 skrll #endif 216 1.3.2.2 skrll 217 1.3.2.2 skrll if (kif == NULL || m == NULL || rm == NULL) 218 1.3.2.2 skrll return (-1); 219 1.3.2.2 skrll 220 1.3.2.2 skrll bzero(&hdr, sizeof(hdr)); 221 1.3.2.2 skrll hdr.length = PFLOG_REAL_HDRLEN; 222 1.3.2.2 skrll hdr.af = af; 223 1.3.2.2 skrll hdr.action = rm->action; 224 1.3.2.2 skrll hdr.reason = reason; 225 1.3.2.2 skrll memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname)); 226 1.3.2.2 skrll 227 1.3.2.2 skrll if (am == NULL) { 228 1.3.2.2 skrll hdr.rulenr = htonl(rm->nr); 229 1.3.2.2 skrll hdr.subrulenr = -1; 230 1.3.2.2 skrll } else { 231 1.3.2.2 skrll hdr.rulenr = htonl(am->nr); 232 1.3.2.2 skrll hdr.subrulenr = htonl(rm->nr); 233 1.3.2.5 skrll if (ruleset != NULL && ruleset->anchor != NULL) 234 1.3.2.5 skrll strlcpy(hdr.ruleset, ruleset->anchor->name, 235 1.3.2.2 skrll sizeof(hdr.ruleset)); 236 1.3.2.2 skrll } 237 1.3.2.2 skrll hdr.dir = dir; 238 1.3.2.2 skrll 239 1.3.2.2 skrll #ifdef INET 240 1.3.2.2 skrll if (af == AF_INET && dir == PF_OUT) { 241 1.3.2.2 skrll struct ip *ip; 242 1.3.2.2 skrll 243 1.3.2.2 skrll ip = mtod(m, struct ip *); 244 1.3.2.2 skrll ip->ip_sum = 0; 245 1.3.2.2 skrll ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 246 1.3.2.2 skrll } 247 1.3.2.2 skrll #endif /* INET */ 248 1.3.2.2 skrll 249 1.3.2.3 skrll #ifndef __NetBSD__ 250 1.3.2.2 skrll m1.m_next = m; 251 1.3.2.2 skrll m1.m_len = PFLOG_HDRLEN; 252 1.3.2.2 skrll m1.m_data = (char *) &hdr; 253 1.3.2.3 skrll #endif 254 1.3.2.2 skrll 255 1.3.2.2 skrll ifn = &(pflogif[0].sc_if); 256 1.3.2.2 skrll 257 1.3.2.2 skrll if (ifn->if_bpf) 258 1.3.2.3 skrll #ifndef __NetBSD__ 259 1.3.2.2 skrll bpf_mtap(ifn->if_bpf, &m1); 260 1.3.2.3 skrll #else 261 1.3.2.3 skrll bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m); 262 1.3.2.3 skrll #endif 263 1.3.2.2 skrll #endif 264 1.3.2.2 skrll 265 1.3.2.2 skrll return (0); 266 1.3.2.2 skrll } 267
Indexes created Mon Oct 20 11:09:49 GMT 2025