npf_handler.c revision 1.2.2.2
1 1.2.2.2 yamt /* $NetBSD: npf_handler.c,v 1.2.2.2 2010/10/09 03:32:37 yamt Exp $ */ 2 1.2.2.2 yamt 3 1.2.2.2 yamt /*- 4 1.2.2.2 yamt * Copyright (c) 2009-2010 The NetBSD Foundation, Inc. 5 1.2.2.2 yamt * All rights reserved. 6 1.2.2.2 yamt * 7 1.2.2.2 yamt * This material is based upon work partially supported by The 8 1.2.2.2 yamt * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 1.2.2.2 yamt * 10 1.2.2.2 yamt * Redistribution and use in source and binary forms, with or without 11 1.2.2.2 yamt * modification, are permitted provided that the following conditions 12 1.2.2.2 yamt * are met: 13 1.2.2.2 yamt * 1. Redistributions of source code must retain the above copyright 14 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer. 15 1.2.2.2 yamt * 2. Redistributions in binary form must reproduce the above copyright 16 1.2.2.2 yamt * notice, this list of conditions and the following disclaimer in the 17 1.2.2.2 yamt * documentation and/or other materials provided with the distribution. 18 1.2.2.2 yamt * 19 1.2.2.2 yamt * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 1.2.2.2 yamt * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 1.2.2.2 yamt * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 1.2.2.2 yamt * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 1.2.2.2 yamt * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 1.2.2.2 yamt * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 1.2.2.2 yamt * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 1.2.2.2 yamt * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 1.2.2.2 yamt * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 1.2.2.2 yamt * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 1.2.2.2 yamt * POSSIBILITY OF SUCH DAMAGE. 30 1.2.2.2 yamt */ 31 1.2.2.2 yamt 32 1.2.2.2 yamt /* 33 1.2.2.2 yamt * NPF packet handler. 34 1.2.2.2 yamt */ 35 1.2.2.2 yamt 36 1.2.2.2 yamt #ifdef _KERNEL 37 1.2.2.2 yamt #include <sys/cdefs.h> 38 1.2.2.2 yamt __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.2.2.2 2010/10/09 03:32:37 yamt Exp $"); 39 1.2.2.2 yamt 40 1.2.2.2 yamt #include <sys/param.h> 41 1.2.2.2 yamt #include <sys/systm.h> 42 1.2.2.2 yamt #endif 43 1.2.2.2 yamt 44 1.2.2.2 yamt #include <sys/mbuf.h> 45 1.2.2.2 yamt #include <sys/mutex.h> 46 1.2.2.2 yamt #include <net/if.h> 47 1.2.2.2 yamt #include <net/pfil.h> 48 1.2.2.2 yamt #include <sys/socketvar.h> 49 1.2.2.2 yamt 50 1.2.2.2 yamt #include "npf_impl.h" 51 1.2.2.2 yamt 52 1.2.2.2 yamt /* 53 1.2.2.2 yamt * If npf_ph_if != NULL, pfil hooks are registers. If NULL, not registered. 54 1.2.2.2 yamt * Used to check the state. Locked by: softnet_lock + KERNEL_LOCK (XXX). 55 1.2.2.2 yamt */ 56 1.2.2.2 yamt static struct pfil_head * npf_ph_if = NULL; 57 1.2.2.2 yamt static struct pfil_head * npf_ph_inet = NULL; 58 1.2.2.2 yamt 59 1.2.2.2 yamt static bool default_pass = true; 60 1.2.2.2 yamt 61 1.2.2.2 yamt int npf_packet_handler(void *, struct mbuf **, struct ifnet *, int); 62 1.2.2.2 yamt 63 1.2.2.2 yamt /* 64 1.2.2.2 yamt * npf_ifhook: hook handling interface changes. 65 1.2.2.2 yamt */ 66 1.2.2.2 yamt static int 67 1.2.2.2 yamt npf_ifhook(void *arg, struct mbuf **mp, struct ifnet *ifp, int di) 68 1.2.2.2 yamt { 69 1.2.2.2 yamt 70 1.2.2.2 yamt return 0; 71 1.2.2.2 yamt } 72 1.2.2.2 yamt 73 1.2.2.2 yamt /* 74 1.2.2.2 yamt * npf_packet_handler: main packet handling routine for layer 3. 75 1.2.2.2 yamt * 76 1.2.2.2 yamt * Note: packet flow and inspection logic is in strict order. 77 1.2.2.2 yamt */ 78 1.2.2.2 yamt int 79 1.2.2.2 yamt npf_packet_handler(void *arg, struct mbuf **mp, struct ifnet *ifp, int di) 80 1.2.2.2 yamt { 81 1.2.2.2 yamt nbuf_t *nbuf = *mp; 82 1.2.2.2 yamt npf_cache_t npc; 83 1.2.2.2 yamt npf_session_t *se; 84 1.2.2.2 yamt npf_rule_t *rl; 85 1.2.2.2 yamt bool keepstate; 86 1.2.2.2 yamt int retfl, error; 87 1.2.2.2 yamt 88 1.2.2.2 yamt /* 89 1.2.2.2 yamt * Initialise packet information cache. 90 1.2.2.2 yamt * Note: it is enough to clear the info bits. 91 1.2.2.2 yamt */ 92 1.2.2.2 yamt npc.npc_info = 0; 93 1.2.2.2 yamt error = 0; 94 1.2.2.2 yamt retfl = 0; 95 1.2.2.2 yamt 96 1.2.2.2 yamt /* Inspect the list of sessions. */ 97 1.2.2.2 yamt se = npf_session_inspect(&npc, nbuf, ifp, di); 98 1.2.2.2 yamt 99 1.2.2.2 yamt /* If "passing" session found - skip the ruleset inspection. */ 100 1.2.2.2 yamt if (se && npf_session_pass(se)) { 101 1.2.2.2 yamt goto pass; 102 1.2.2.2 yamt } 103 1.2.2.2 yamt 104 1.2.2.2 yamt /* Inspect the ruleset using this packet. */ 105 1.2.2.2 yamt rl = npf_ruleset_inspect(&npc, nbuf, ifp, di, NPF_LAYER_3); 106 1.2.2.2 yamt if (rl == NULL) { 107 1.2.2.2 yamt if (default_pass) { 108 1.2.2.2 yamt goto pass; 109 1.2.2.2 yamt } 110 1.2.2.2 yamt error = ENETUNREACH; 111 1.2.2.2 yamt goto out; 112 1.2.2.2 yamt } 113 1.2.2.2 yamt 114 1.2.2.2 yamt /* Apply the rule. */ 115 1.2.2.2 yamt error = npf_rule_apply(&npc, rl, &keepstate, &retfl); 116 1.2.2.2 yamt if (error) { 117 1.2.2.2 yamt goto out; 118 1.2.2.2 yamt } 119 1.2.2.2 yamt 120 1.2.2.2 yamt /* Establish a "pass" session, if required. */ 121 1.2.2.2 yamt if (keepstate && !se) { 122 1.2.2.2 yamt se = npf_session_establish(&npc, NULL, di); 123 1.2.2.2 yamt if (se == NULL) { 124 1.2.2.2 yamt error = ENOMEM; 125 1.2.2.2 yamt goto out; 126 1.2.2.2 yamt } 127 1.2.2.2 yamt npf_session_setpass(se); 128 1.2.2.2 yamt } 129 1.2.2.2 yamt pass: 130 1.2.2.2 yamt KASSERT(error == 0); 131 1.2.2.2 yamt /* 132 1.2.2.2 yamt * Perform NAT. 133 1.2.2.2 yamt */ 134 1.2.2.2 yamt error = npf_do_nat(&npc, se, nbuf, ifp, di); 135 1.2.2.2 yamt out: 136 1.2.2.2 yamt /* Release reference on session. */ 137 1.2.2.2 yamt if (se != NULL) { 138 1.2.2.2 yamt npf_session_release(se); 139 1.2.2.2 yamt } 140 1.2.2.2 yamt 141 1.2.2.2 yamt /* 142 1.2.2.2 yamt * If error is set - drop the packet. 143 1.2.2.2 yamt * Normally, ENETUNREACH is used for "block". 144 1.2.2.2 yamt */ 145 1.2.2.2 yamt if (error) { 146 1.2.2.2 yamt /* 147 1.2.2.2 yamt * Depending on flags and protocol, return TCP reset (RST) 148 1.2.2.2 yamt * or ICMP destination unreachable 149 1.2.2.2 yamt */ 150 1.2.2.2 yamt if (retfl) { 151 1.2.2.2 yamt npf_return_block(&npc, nbuf, retfl); 152 1.2.2.2 yamt } 153 1.2.2.2 yamt m_freem(*mp); 154 1.2.2.2 yamt *mp = NULL; 155 1.2.2.2 yamt } 156 1.2.2.2 yamt return error; 157 1.2.2.2 yamt } 158 1.2.2.2 yamt 159 1.2.2.2 yamt /* 160 1.2.2.2 yamt * npf_register_pfil: register pfil(9) hooks. 161 1.2.2.2 yamt */ 162 1.2.2.2 yamt int 163 1.2.2.2 yamt npf_register_pfil(void) 164 1.2.2.2 yamt { 165 1.2.2.2 yamt int error; 166 1.2.2.2 yamt 167 1.2.2.2 yamt mutex_enter(softnet_lock); 168 1.2.2.2 yamt KERNEL_LOCK(1, NULL); 169 1.2.2.2 yamt 170 1.2.2.2 yamt /* Check if pfil hooks are not already registered. */ 171 1.2.2.2 yamt if (npf_ph_if) { 172 1.2.2.2 yamt error = EEXIST; 173 1.2.2.2 yamt goto fail; 174 1.2.2.2 yamt } 175 1.2.2.2 yamt 176 1.2.2.2 yamt /* Capture point of any activity in interfaces and IP layer. */ 177 1.2.2.2 yamt npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0); 178 1.2.2.2 yamt npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 179 1.2.2.2 yamt if (npf_ph_if == NULL || npf_ph_inet == NULL) { 180 1.2.2.2 yamt npf_ph_if = NULL; 181 1.2.2.2 yamt error = ENOENT; 182 1.2.2.2 yamt goto fail; 183 1.2.2.2 yamt } 184 1.2.2.2 yamt 185 1.2.2.2 yamt /* Interface re-config or attach/detach hook. */ 186 1.2.2.2 yamt error = pfil_add_hook(npf_ifhook, NULL, 187 1.2.2.2 yamt PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 188 1.2.2.2 yamt KASSERT(error == 0); 189 1.2.2.2 yamt 190 1.2.2.2 yamt /* Packet IN/OUT handler on all interfaces and IP layer. */ 191 1.2.2.2 yamt error = pfil_add_hook(npf_packet_handler, NULL, 192 1.2.2.2 yamt PFIL_WAITOK | PFIL_ALL, npf_ph_inet); 193 1.2.2.2 yamt KASSERT(error == 0); 194 1.2.2.2 yamt 195 1.2.2.2 yamt fail: 196 1.2.2.2 yamt KERNEL_UNLOCK_ONE(NULL); 197 1.2.2.2 yamt mutex_exit(softnet_lock); 198 1.2.2.2 yamt 199 1.2.2.2 yamt return error; 200 1.2.2.2 yamt } 201 1.2.2.2 yamt 202 1.2.2.2 yamt /* 203 1.2.2.2 yamt * npf_unregister: unregister pfil(9) hooks. 204 1.2.2.2 yamt */ 205 1.2.2.2 yamt void 206 1.2.2.2 yamt npf_unregister_pfil(void) 207 1.2.2.2 yamt { 208 1.2.2.2 yamt 209 1.2.2.2 yamt mutex_enter(softnet_lock); 210 1.2.2.2 yamt KERNEL_LOCK(1, NULL); 211 1.2.2.2 yamt 212 1.2.2.2 yamt if (npf_ph_if) { 213 1.2.2.2 yamt (void)pfil_remove_hook(npf_packet_handler, NULL, 214 1.2.2.2 yamt PFIL_ALL, npf_ph_inet); 215 1.2.2.2 yamt (void)pfil_remove_hook(npf_ifhook, NULL, 216 1.2.2.2 yamt PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 217 1.2.2.2 yamt 218 1.2.2.2 yamt npf_ph_if = NULL; 219 1.2.2.2 yamt } 220 1.2.2.2 yamt 221 1.2.2.2 yamt KERNEL_UNLOCK_ONE(NULL); 222 1.2.2.2 yamt mutex_exit(softnet_lock); 223 1.2.2.2 yamt } 224
Indexes created Thu Oct 02 14:10:14 GMT 2025