Home | History | Annotate | Line # | Download | only in net
if_pflog.c revision 1.3 
      1 /*	$NetBSD: if_pflog.c,v 1.3 2004/06/29 04:42:55 itojun Exp $	*/
      2 /*	$OpenBSD: if_pflog.c,v 1.11 2003/12/31 11:18:25 cedric Exp $	*/
      3 /*
      4  * The authors of this code are John Ioannidis (ji (at) tla.org),
      5  * Angelos D. Keromytis (kermit (at) csd.uch.gr) and
      6  * Niels Provos (provos (at) physnet.uni-hamburg.de).
      7  *
      8  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
      9  * in November 1995.
     10  *
     11  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
     12  * by Angelos D. Keromytis.
     13  *
     14  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
     15  * and Niels Provos.
     16  *
     17  * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
     18  * and Niels Provos.
     19  * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
     20  *
     21  * Permission to use, copy, and modify this software with or without fee
     22  * is hereby granted, provided that this entire notice is included in
     23  * all copies of any software which is or includes a copy or
     24  * modification of this software.
     25  * You may use this code under the GNU public license if you so wish. Please
     26  * contribute changes back to the authors under this freer than GPL license
     27  * so that we may further the use of strong encryption without limitations to
     28  * all.
     29  *
     30  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
     31  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
     32  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
     33  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
     34  * PURPOSE.
     35  */
     36 
     37 #ifdef _KERNEL_OPT
     38 #include "opt_inet.h"
     39 #endif
     40 
     41 #include "bpfilter.h"
     42 #include "pflog.h"
     43 
     44 #include <sys/param.h>
     45 #include <sys/systm.h>
     46 #include <sys/mbuf.h>
     47 #include <sys/socket.h>
     48 #include <sys/ioctl.h>
     49 
     50 #include <net/if.h>
     51 #include <net/if_types.h>
     52 #include <net/route.h>
     53 #include <net/bpf.h>
     54 
     55 #ifdef	INET
     56 #include <netinet/in.h>
     57 #include <netinet/in_var.h>
     58 #include <netinet/in_systm.h>
     59 #include <netinet/ip.h>
     60 #endif
     61 
     62 #ifdef INET6
     63 #ifndef INET
     64 #include <netinet/in.h>
     65 #endif
     66 #include <netinet6/nd6.h>
     67 #endif /* INET6 */
     68 
     69 #include <net/pfvar.h>
     70 #include <net/if_pflog.h>
     71 
     72 #define PFLOGMTU	(32768 + MHLEN + MLEN)
     73 
     74 #ifdef PFLOGDEBUG
     75 #define DPRINTF(x)    do { if (pflogdebug) printf x ; } while (0)
     76 #else
     77 #define DPRINTF(x)
     78 #endif
     79 
     80 struct pflog_softc pflogif[NPFLOG];
     81 
     82 void	pflogattach(int);
     83 #ifdef _LKM
     84 void	pflogdetach(void);
     85 #endif
     86 int	pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
     87 	    	       struct rtentry *);
     88 int	pflogioctl(struct ifnet *, u_long, caddr_t);
     89 void	pflogrtrequest(int, struct rtentry *, struct sockaddr *);
     90 void	pflogstart(struct ifnet *);
     91 
     92 extern int ifqmaxlen;
     93 
     94 void
     95 pflogattach(int npflog)
     96 {
     97 	struct ifnet *ifp;
     98 	int i;
     99 
    100 	bzero(pflogif, sizeof(pflogif));
    101 
    102 	for (i = 0; i < NPFLOG; i++) {
    103 		ifp = &pflogif[i].sc_if;
    104 		snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", i);
    105 		ifp->if_softc = &pflogif[i];
    106 		ifp->if_mtu = PFLOGMTU;
    107 		ifp->if_ioctl = pflogioctl;
    108 		ifp->if_output = pflogoutput;
    109 		ifp->if_start = pflogstart;
    110 		ifp->if_type = IFT_PFLOG;
    111 		ifp->if_snd.ifq_maxlen = ifqmaxlen;
    112 		ifp->if_hdrlen = PFLOG_HDRLEN;
    113 		if_attach(ifp);
    114 		if_alloc_sadl(ifp);
    115 
    116 #if NBPFILTER > 0
    117 #ifdef __OpenBSD__
    118 		bpfattach(&pflogif[i].sc_if.if_bpf, ifp, DLT_PFLOG,
    119 			  PFLOG_HDRLEN);
    120 #else
    121 		bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN);
    122 #endif
    123 #endif
    124 	}
    125 }
    126 
    127 #ifdef _LKM
    128 void
    129 pflogdetach(void)
    130 {
    131 	struct ifnet *ifp;
    132 	int i;
    133 
    134 	for (i = 0; i < NPFLOG; i++) {
    135 		ifp = &pflogif[i].sc_if;
    136 		bpfdetach(ifp);
    137 		if_detach(ifp);
    138 	}
    139 }
    140 #endif
    141 
    142 /*
    143  * Start output on the pflog interface.
    144  */
    145 void
    146 pflogstart(struct ifnet *ifp)
    147 {
    148 	struct mbuf *m;
    149 	int s;
    150 
    151 	for (;;) {
    152 #ifdef __OpenBSD__
    153 		s = splimp();
    154 #else
    155 		s = splnet();
    156 #endif
    157 		IF_DROP(&ifp->if_snd);
    158 		IF_DEQUEUE(&ifp->if_snd, m);
    159 		splx(s);
    160 
    161 		if (m == NULL)
    162 			return;
    163 		else
    164 			m_freem(m);
    165 	}
    166 }
    167 
    168 int
    169 pflogoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
    170 	struct rtentry *rt)
    171 {
    172 	m_freem(m);
    173 	return (0);
    174 }
    175 
    176 /* ARGSUSED */
    177 void
    178 pflogrtrequest(int cmd, struct rtentry *rt, struct sockaddr *sa)
    179 {
    180 	if (rt)
    181 		rt->rt_rmx.rmx_mtu = PFLOGMTU;
    182 }
    183 
    184 /* ARGSUSED */
    185 int
    186 pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
    187 {
    188 	switch (cmd) {
    189 	case SIOCSIFADDR:
    190 	case SIOCAIFADDR:
    191 	case SIOCSIFDSTADDR:
    192 	case SIOCSIFFLAGS:
    193 		if (ifp->if_flags & IFF_UP)
    194 			ifp->if_flags |= IFF_RUNNING;
    195 		else
    196 			ifp->if_flags &= ~IFF_RUNNING;
    197 		break;
    198 	default:
    199 		return (EINVAL);
    200 	}
    201 
    202 	return (0);
    203 }
    204 
    205 int
    206 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
    207     u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
    208     struct pf_ruleset *ruleset)
    209 {
    210 #if NBPFILTER > 0
    211 	struct ifnet *ifn;
    212 	struct pfloghdr hdr;
    213 	struct mbuf m1;
    214 
    215 	if (kif == NULL || m == NULL || rm == NULL)
    216 		return (-1);
    217 
    218 	bzero(&hdr, sizeof(hdr));
    219 	hdr.length = PFLOG_REAL_HDRLEN;
    220 	hdr.af = af;
    221 	hdr.action = rm->action;
    222 	hdr.reason = reason;
    223 	memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
    224 
    225 	if (am == NULL) {
    226 		hdr.rulenr = htonl(rm->nr);
    227 		hdr.subrulenr = -1;
    228 	} else {
    229 		hdr.rulenr = htonl(am->nr);
    230 		hdr.subrulenr = htonl(rm->nr);
    231 		if (ruleset != NULL)
    232 			memcpy(hdr.ruleset, ruleset->name,
    233 			    sizeof(hdr.ruleset));
    234 
    235 
    236 	}
    237 	hdr.dir = dir;
    238 
    239 #ifdef INET
    240 	if (af == AF_INET && dir == PF_OUT) {
    241 		struct ip *ip;
    242 
    243 		ip = mtod(m, struct ip *);
    244 		ip->ip_sum = 0;
    245 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
    246 	}
    247 #endif /* INET */
    248 
    249 	m1.m_next = m;
    250 	m1.m_len = PFLOG_HDRLEN;
    251 	m1.m_data = (char *) &hdr;
    252 
    253 	ifn = &(pflogif[0].sc_if);
    254 
    255 	if (ifn->if_bpf)
    256 		bpf_mtap(ifn->if_bpf, &m1);
    257 #endif
    258 
    259 	return (0);
    260 }
    261