Home | History | Annotate | Line # | Download | only in net
if_pflog.c revision 1.9 
      1 /*	$NetBSD: if_pflog.c,v 1.9 2007/02/17 22:34:07 dyoung Exp $	*/
      2 /*	$OpenBSD: if_pflog.c,v 1.12 2004/05/19 17:50:51 dhartmei Exp $	*/
      3 /*
      4  * The authors of this code are John Ioannidis (ji (at) tla.org),
      5  * Angelos D. Keromytis (kermit (at) csd.uch.gr) and
      6  * Niels Provos (provos (at) physnet.uni-hamburg.de).
      7  *
      8  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
      9  * in November 1995.
     10  *
     11  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
     12  * by Angelos D. Keromytis.
     13  *
     14  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
     15  * and Niels Provos.
     16  *
     17  * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
     18  * and Niels Provos.
     19  * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
     20  *
     21  * Permission to use, copy, and modify this software with or without fee
     22  * is hereby granted, provided that this entire notice is included in
     23  * all copies of any software which is or includes a copy or
     24  * modification of this software.
     25  * You may use this code under the GNU public license if you so wish. Please
     26  * contribute changes back to the authors under this freer than GPL license
     27  * so that we may further the use of strong encryption without limitations to
     28  * all.
     29  *
     30  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
     31  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
     32  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
     33  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
     34  * PURPOSE.
     35  */
     36 
     37 #ifdef _KERNEL_OPT
     38 #include "opt_inet.h"
     39 #endif
     40 
     41 #include "bpfilter.h"
     42 #include "pflog.h"
     43 
     44 #include <sys/param.h>
     45 #include <sys/systm.h>
     46 #include <sys/mbuf.h>
     47 #include <sys/socket.h>
     48 #include <sys/ioctl.h>
     49 
     50 #include <net/if.h>
     51 #include <net/if_types.h>
     52 #include <net/route.h>
     53 #include <net/bpf.h>
     54 
     55 #ifdef	INET
     56 #include <netinet/in.h>
     57 #include <netinet/in_var.h>
     58 #include <netinet/in_systm.h>
     59 #include <netinet/ip.h>
     60 #endif
     61 
     62 #ifdef INET6
     63 #ifndef INET
     64 #include <netinet/in.h>
     65 #endif
     66 #include <netinet6/nd6.h>
     67 #endif /* INET6 */
     68 
     69 #include <net/pfvar.h>
     70 #include <net/if_pflog.h>
     71 
     72 #define PFLOGMTU	(32768 + MHLEN + MLEN)
     73 
     74 #ifdef PFLOGDEBUG
     75 #define DPRINTF(x)    do { if (pflogdebug) printf x ; } while (0)
     76 #else
     77 #define DPRINTF(x)
     78 #endif
     79 
     80 struct pflog_softc pflogif[NPFLOG];
     81 
     82 void	pflogattach(int);
     83 #ifdef _LKM
     84 void	pflogdetach(void);
     85 #endif
     86 int	pflogoutput(struct ifnet *, struct mbuf *, const struct sockaddr *,
     87 	    	       struct rtentry *);
     88 int	pflogioctl(struct ifnet *, u_long, caddr_t);
     89 void	pflogrtrequest(int, struct rtentry *, struct sockaddr *);
     90 void	pflogstart(struct ifnet *);
     91 
     92 extern int ifqmaxlen;
     93 
     94 void
     95 pflogattach(int npflog)
     96 {
     97 	struct ifnet *ifp;
     98 	int i;
     99 
    100 	bzero(pflogif, sizeof(pflogif));
    101 
    102 	for (i = 0; i < NPFLOG; i++) {
    103 		ifp = &pflogif[i].sc_if;
    104 		snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", i);
    105 		ifp->if_softc = &pflogif[i];
    106 		ifp->if_mtu = PFLOGMTU;
    107 		ifp->if_ioctl = pflogioctl;
    108 		ifp->if_output = pflogoutput;
    109 		ifp->if_start = pflogstart;
    110 		ifp->if_type = IFT_PFLOG;
    111 		ifp->if_snd.ifq_maxlen = ifqmaxlen;
    112 		ifp->if_hdrlen = PFLOG_HDRLEN;
    113 		if_attach(ifp);
    114 		if_alloc_sadl(ifp);
    115 
    116 #if NBPFILTER > 0
    117 #ifdef __OpenBSD__
    118 		bpfattach(&pflogif[i].sc_if.if_bpf, ifp, DLT_PFLOG,
    119 			  PFLOG_HDRLEN);
    120 #else
    121 		bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN);
    122 #endif
    123 #endif
    124 	}
    125 }
    126 
    127 #ifdef _LKM
    128 void
    129 pflogdetach(void)
    130 {
    131 	struct ifnet *ifp;
    132 	int i;
    133 
    134 	for (i = 0; i < NPFLOG; i++) {
    135 		ifp = &pflogif[i].sc_if;
    136 		bpfdetach(ifp);
    137 		if_detach(ifp);
    138 	}
    139 }
    140 #endif
    141 
    142 /*
    143  * Start output on the pflog interface.
    144  */
    145 void
    146 pflogstart(struct ifnet *ifp)
    147 {
    148 	struct mbuf *m;
    149 	int s;
    150 
    151 	for (;;) {
    152 #ifdef __OpenBSD__
    153 		s = splimp();
    154 #else
    155 		s = splnet();
    156 #endif
    157 		IF_DROP(&ifp->if_snd);
    158 		IF_DEQUEUE(&ifp->if_snd, m);
    159 		splx(s);
    160 
    161 		if (m == NULL)
    162 			return;
    163 		else
    164 			m_freem(m);
    165 	}
    166 }
    167 
    168 int
    169 pflogoutput(struct ifnet *ifp, struct mbuf *m,
    170     const struct sockaddr *dst, struct rtentry *rt)
    171 {
    172 	m_freem(m);
    173 	return (0);
    174 }
    175 
    176 /* ARGSUSED */
    177 void
    178 pflogrtrequest(int cmd, struct rtentry *rt,
    179     struct sockaddr *sa)
    180 {
    181 	if (rt)
    182 		rt->rt_rmx.rmx_mtu = PFLOGMTU;
    183 }
    184 
    185 /* ARGSUSED */
    186 int
    187 pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
    188 {
    189 	switch (cmd) {
    190 	case SIOCSIFADDR:
    191 	case SIOCAIFADDR:
    192 	case SIOCSIFDSTADDR:
    193 	case SIOCSIFFLAGS:
    194 		if (ifp->if_flags & IFF_UP)
    195 			ifp->if_flags |= IFF_RUNNING;
    196 		else
    197 			ifp->if_flags &= ~IFF_RUNNING;
    198 		break;
    199 	default:
    200 		return (EINVAL);
    201 	}
    202 
    203 	return (0);
    204 }
    205 
    206 int
    207 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
    208     u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
    209     struct pf_ruleset *ruleset)
    210 {
    211 #if NBPFILTER > 0
    212 	struct ifnet *ifn;
    213 	struct pfloghdr hdr;
    214 #ifndef __NetBSD__
    215 	struct mbuf m1;
    216 #endif
    217 
    218 	if (kif == NULL || m == NULL || rm == NULL)
    219 		return (-1);
    220 
    221 	bzero(&hdr, sizeof(hdr));
    222 	hdr.length = PFLOG_REAL_HDRLEN;
    223 	hdr.af = af;
    224 	hdr.action = rm->action;
    225 	hdr.reason = reason;
    226 	memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
    227 
    228 	if (am == NULL) {
    229 		hdr.rulenr = htonl(rm->nr);
    230 		hdr.subrulenr = -1;
    231 	} else {
    232 		hdr.rulenr = htonl(am->nr);
    233 		hdr.subrulenr = htonl(rm->nr);
    234 		if (ruleset != NULL && ruleset->anchor != NULL)
    235 			strlcpy(hdr.ruleset, ruleset->anchor->name,
    236 			    sizeof(hdr.ruleset));
    237 	}
    238 	hdr.dir = dir;
    239 
    240 #ifdef INET
    241 	if (af == AF_INET && dir == PF_OUT) {
    242 		struct ip *ip;
    243 
    244 		ip = mtod(m, struct ip *);
    245 		ip->ip_sum = 0;
    246 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
    247 	}
    248 #endif /* INET */
    249 
    250 #ifndef __NetBSD__
    251 	m1.m_next = m;
    252 	m1.m_len = PFLOG_HDRLEN;
    253 	m1.m_data = (char *) &hdr;
    254 #endif
    255 
    256 	ifn = &(pflogif[0].sc_if);
    257 
    258 	if (ifn->if_bpf)
    259 #ifndef __NetBSD__
    260 		bpf_mtap(ifn->if_bpf, &m1);
    261 #else
    262 		bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m);
    263 #endif
    264 #endif
    265 
    266 	return (0);
    267 }
    268