Home | History | Annotate | Line # | Download | only in net
if_pflog.c revision 1.11 
      1 /*	$NetBSD: if_pflog.c,v 1.11 2007/12/11 11:08:19 lukem Exp $	*/
      2 /*	$OpenBSD: if_pflog.c,v 1.12 2004/05/19 17:50:51 dhartmei Exp $	*/
      3 /*
      4  * The authors of this code are John Ioannidis (ji (at) tla.org),
      5  * Angelos D. Keromytis (kermit (at) csd.uch.gr) and
      6  * Niels Provos (provos (at) physnet.uni-hamburg.de).
      7  *
      8  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
      9  * in November 1995.
     10  *
     11  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
     12  * by Angelos D. Keromytis.
     13  *
     14  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
     15  * and Niels Provos.
     16  *
     17  * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
     18  * and Niels Provos.
     19  * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
     20  *
     21  * Permission to use, copy, and modify this software with or without fee
     22  * is hereby granted, provided that this entire notice is included in
     23  * all copies of any software which is or includes a copy or
     24  * modification of this software.
     25  * You may use this code under the GNU public license if you so wish. Please
     26  * contribute changes back to the authors under this freer than GPL license
     27  * so that we may further the use of strong encryption without limitations to
     28  * all.
     29  *
     30  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
     31  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
     32  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
     33  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
     34  * PURPOSE.
     35  */
     36 
     37 #include <sys/cdefs.h>
     38 __KERNEL_RCSID(0, "$NetBSD: if_pflog.c,v 1.11 2007/12/11 11:08:19 lukem Exp $");
     39 
     40 #ifdef _KERNEL_OPT
     41 #include "opt_inet.h"
     42 #endif
     43 
     44 #include "bpfilter.h"
     45 #include "pflog.h"
     46 
     47 #include <sys/param.h>
     48 #include <sys/systm.h>
     49 #include <sys/mbuf.h>
     50 #include <sys/socket.h>
     51 #include <sys/ioctl.h>
     52 
     53 #include <net/if.h>
     54 #include <net/if_types.h>
     55 #include <net/route.h>
     56 #include <net/bpf.h>
     57 
     58 #ifdef	INET
     59 #include <netinet/in.h>
     60 #include <netinet/in_var.h>
     61 #include <netinet/in_systm.h>
     62 #include <netinet/ip.h>
     63 #endif
     64 
     65 #ifdef INET6
     66 #ifndef INET
     67 #include <netinet/in.h>
     68 #endif
     69 #include <netinet6/nd6.h>
     70 #endif /* INET6 */
     71 
     72 #include <net/pfvar.h>
     73 #include <net/if_pflog.h>
     74 
     75 #define PFLOGMTU	(32768 + MHLEN + MLEN)
     76 
     77 #ifdef PFLOGDEBUG
     78 #define DPRINTF(x)    do { if (pflogdebug) printf x ; } while (0)
     79 #else
     80 #define DPRINTF(x)
     81 #endif
     82 
     83 struct pflog_softc pflogif[NPFLOG];
     84 
     85 void	pflogattach(int);
     86 #ifdef _LKM
     87 void	pflogdetach(void);
     88 #endif
     89 int	pflogoutput(struct ifnet *, struct mbuf *, const struct sockaddr *,
     90 	    	       struct rtentry *);
     91 int	pflogioctl(struct ifnet *, u_long, void *);
     92 void	pflogrtrequest(int, struct rtentry *, struct sockaddr *);
     93 void	pflogstart(struct ifnet *);
     94 
     95 extern int ifqmaxlen;
     96 
     97 void
     98 pflogattach(int npflog)
     99 {
    100 	struct ifnet *ifp;
    101 	int i;
    102 
    103 	bzero(pflogif, sizeof(pflogif));
    104 
    105 	for (i = 0; i < NPFLOG; i++) {
    106 		ifp = &pflogif[i].sc_if;
    107 		snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", i);
    108 		ifp->if_softc = &pflogif[i];
    109 		ifp->if_mtu = PFLOGMTU;
    110 		ifp->if_ioctl = pflogioctl;
    111 		ifp->if_output = pflogoutput;
    112 		ifp->if_start = pflogstart;
    113 		ifp->if_type = IFT_PFLOG;
    114 		ifp->if_snd.ifq_maxlen = ifqmaxlen;
    115 		ifp->if_hdrlen = PFLOG_HDRLEN;
    116 		if_attach(ifp);
    117 		if_alloc_sadl(ifp);
    118 
    119 #if NBPFILTER > 0
    120 #ifdef __OpenBSD__
    121 		bpfattach(&pflogif[i].sc_if.if_bpf, ifp, DLT_PFLOG,
    122 			  PFLOG_HDRLEN);
    123 #else
    124 		bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN);
    125 #endif
    126 #endif
    127 	}
    128 }
    129 
    130 #ifdef _LKM
    131 void
    132 pflogdetach(void)
    133 {
    134 	struct ifnet *ifp;
    135 	int i;
    136 
    137 	for (i = 0; i < NPFLOG; i++) {
    138 		ifp = &pflogif[i].sc_if;
    139 		bpfdetach(ifp);
    140 		if_detach(ifp);
    141 	}
    142 }
    143 #endif
    144 
    145 /*
    146  * Start output on the pflog interface.
    147  */
    148 void
    149 pflogstart(struct ifnet *ifp)
    150 {
    151 	struct mbuf *m;
    152 	int s;
    153 
    154 	for (;;) {
    155 #ifdef __OpenBSD__
    156 		s = splimp();
    157 #else
    158 		s = splnet();
    159 #endif
    160 		IF_DROP(&ifp->if_snd);
    161 		IF_DEQUEUE(&ifp->if_snd, m);
    162 		splx(s);
    163 
    164 		if (m == NULL)
    165 			return;
    166 		else
    167 			m_freem(m);
    168 	}
    169 }
    170 
    171 int
    172 pflogoutput(struct ifnet *ifp, struct mbuf *m,
    173     const struct sockaddr *dst, struct rtentry *rt)
    174 {
    175 	m_freem(m);
    176 	return (0);
    177 }
    178 
    179 /* ARGSUSED */
    180 void
    181 pflogrtrequest(int cmd, struct rtentry *rt,
    182     struct sockaddr *sa)
    183 {
    184 	if (rt)
    185 		rt->rt_rmx.rmx_mtu = PFLOGMTU;
    186 }
    187 
    188 /* ARGSUSED */
    189 int
    190 pflogioctl(struct ifnet *ifp, u_long cmd, void *data)
    191 {
    192 	switch (cmd) {
    193 	case SIOCSIFADDR:
    194 	case SIOCAIFADDR:
    195 	case SIOCSIFDSTADDR:
    196 	case SIOCSIFFLAGS:
    197 		if (ifp->if_flags & IFF_UP)
    198 			ifp->if_flags |= IFF_RUNNING;
    199 		else
    200 			ifp->if_flags &= ~IFF_RUNNING;
    201 		break;
    202 	default:
    203 		return (EINVAL);
    204 	}
    205 
    206 	return (0);
    207 }
    208 
    209 int
    210 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
    211     u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
    212     struct pf_ruleset *ruleset)
    213 {
    214 #if NBPFILTER > 0
    215 	struct ifnet *ifn;
    216 	struct pfloghdr hdr;
    217 #ifndef __NetBSD__
    218 	struct mbuf m1;
    219 #endif
    220 
    221 	if (kif == NULL || m == NULL || rm == NULL)
    222 		return (-1);
    223 
    224 	bzero(&hdr, sizeof(hdr));
    225 	hdr.length = PFLOG_REAL_HDRLEN;
    226 	hdr.af = af;
    227 	hdr.action = rm->action;
    228 	hdr.reason = reason;
    229 	memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
    230 
    231 	if (am == NULL) {
    232 		hdr.rulenr = htonl(rm->nr);
    233 		hdr.subrulenr = -1;
    234 	} else {
    235 		hdr.rulenr = htonl(am->nr);
    236 		hdr.subrulenr = htonl(rm->nr);
    237 		if (ruleset != NULL && ruleset->anchor != NULL)
    238 			strlcpy(hdr.ruleset, ruleset->anchor->name,
    239 			    sizeof(hdr.ruleset));
    240 	}
    241 	hdr.dir = dir;
    242 
    243 #ifdef INET
    244 	if (af == AF_INET && dir == PF_OUT) {
    245 		struct ip *ip;
    246 
    247 		ip = mtod(m, struct ip *);
    248 		ip->ip_sum = 0;
    249 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
    250 	}
    251 #endif /* INET */
    252 
    253 #ifndef __NetBSD__
    254 	m1.m_next = m;
    255 	m1.m_len = PFLOG_HDRLEN;
    256 	m1.m_data = (char *) &hdr;
    257 #endif
    258 
    259 	ifn = &(pflogif[0].sc_if);
    260 
    261 	if (ifn->if_bpf)
    262 #ifndef __NetBSD__
    263 		bpf_mtap(ifn->if_bpf, &m1);
    264 #else
    265 		bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m);
    266 #endif
    267 #endif
    268 
    269 	return (0);
    270 }
    271