npf_handler.c revision 1.3 1 1.3 rmind /* $NetBSD: npf_handler.c,v 1.3 2010/10/10 15:29:01 rmind Exp $ */
2 1.1 rmind
3 1.1 rmind /*-
4 1.1 rmind * Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
5 1.1 rmind * All rights reserved.
6 1.1 rmind *
7 1.1 rmind * This material is based upon work partially supported by The
8 1.1 rmind * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9 1.1 rmind *
10 1.1 rmind * Redistribution and use in source and binary forms, with or without
11 1.1 rmind * modification, are permitted provided that the following conditions
12 1.1 rmind * are met:
13 1.1 rmind * 1. Redistributions of source code must retain the above copyright
14 1.1 rmind * notice, this list of conditions and the following disclaimer.
15 1.1 rmind * 2. Redistributions in binary form must reproduce the above copyright
16 1.1 rmind * notice, this list of conditions and the following disclaimer in the
17 1.1 rmind * documentation and/or other materials provided with the distribution.
18 1.1 rmind *
19 1.1 rmind * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 1.1 rmind * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 1.1 rmind * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 1.1 rmind * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 1.1 rmind * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 1.1 rmind * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 1.1 rmind * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 1.1 rmind * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 1.1 rmind * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 1.1 rmind * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 1.1 rmind * POSSIBILITY OF SUCH DAMAGE.
30 1.1 rmind */
31 1.1 rmind
32 1.1 rmind /*
33 1.1 rmind * NPF packet handler.
34 1.1 rmind */
35 1.1 rmind
36 1.1 rmind #include <sys/cdefs.h>
37 1.3 rmind __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.3 2010/10/10 15:29:01 rmind Exp $");
38 1.1 rmind
39 1.1 rmind #include <sys/param.h>
40 1.1 rmind #include <sys/systm.h>
41 1.1 rmind
42 1.1 rmind #include <sys/mbuf.h>
43 1.1 rmind #include <sys/mutex.h>
44 1.1 rmind #include <net/if.h>
45 1.1 rmind #include <net/pfil.h>
46 1.1 rmind #include <sys/socketvar.h>
47 1.1 rmind
48 1.1 rmind #include "npf_impl.h"
49 1.1 rmind
50 1.1 rmind /*
51 1.1 rmind * If npf_ph_if != NULL, pfil hooks are registers. If NULL, not registered.
52 1.1 rmind * Used to check the state. Locked by: softnet_lock + KERNEL_LOCK (XXX).
53 1.1 rmind */
54 1.1 rmind static struct pfil_head * npf_ph_if = NULL;
55 1.1 rmind static struct pfil_head * npf_ph_inet = NULL;
56 1.1 rmind
57 1.2 rmind static bool default_pass = true;
58 1.2 rmind
59 1.1 rmind int npf_packet_handler(void *, struct mbuf **, struct ifnet *, int);
60 1.1 rmind
61 1.1 rmind /*
62 1.1 rmind * npf_ifhook: hook handling interface changes.
63 1.1 rmind */
64 1.1 rmind static int
65 1.1 rmind npf_ifhook(void *arg, struct mbuf **mp, struct ifnet *ifp, int di)
66 1.1 rmind {
67 1.1 rmind
68 1.1 rmind return 0;
69 1.1 rmind }
70 1.1 rmind
71 1.1 rmind /*
72 1.2 rmind * npf_packet_handler: main packet handling routine for layer 3.
73 1.1 rmind *
74 1.1 rmind * Note: packet flow and inspection logic is in strict order.
75 1.1 rmind */
76 1.1 rmind int
77 1.1 rmind npf_packet_handler(void *arg, struct mbuf **mp, struct ifnet *ifp, int di)
78 1.1 rmind {
79 1.1 rmind nbuf_t *nbuf = *mp;
80 1.1 rmind npf_cache_t npc;
81 1.1 rmind npf_session_t *se;
82 1.1 rmind npf_rule_t *rl;
83 1.2 rmind bool keepstate;
84 1.2 rmind int retfl, error;
85 1.1 rmind
86 1.1 rmind /*
87 1.1 rmind * Initialise packet information cache.
88 1.1 rmind * Note: it is enough to clear the info bits.
89 1.1 rmind */
90 1.1 rmind npc.npc_info = 0;
91 1.2 rmind error = 0;
92 1.2 rmind retfl = 0;
93 1.1 rmind
94 1.1 rmind /* Inspect the list of sessions. */
95 1.2 rmind se = npf_session_inspect(&npc, nbuf, ifp, di);
96 1.2 rmind
97 1.2 rmind /* If "passing" session found - skip the ruleset inspection. */
98 1.2 rmind if (se && npf_session_pass(se)) {
99 1.2 rmind goto pass;
100 1.2 rmind }
101 1.1 rmind
102 1.2 rmind /* Inspect the ruleset using this packet. */
103 1.2 rmind rl = npf_ruleset_inspect(&npc, nbuf, ifp, di, NPF_LAYER_3);
104 1.2 rmind if (rl == NULL) {
105 1.2 rmind if (default_pass) {
106 1.2 rmind goto pass;
107 1.2 rmind }
108 1.2 rmind error = ENETUNREACH;
109 1.1 rmind goto out;
110 1.1 rmind }
111 1.1 rmind
112 1.2 rmind /* Apply the rule. */
113 1.2 rmind error = npf_rule_apply(&npc, rl, &keepstate, &retfl);
114 1.2 rmind if (error) {
115 1.2 rmind goto out;
116 1.1 rmind }
117 1.1 rmind
118 1.2 rmind /* Establish a "pass" session, if required. */
119 1.2 rmind if (keepstate && !se) {
120 1.2 rmind se = npf_session_establish(&npc, NULL, di);
121 1.2 rmind if (se == NULL) {
122 1.2 rmind error = ENOMEM;
123 1.2 rmind goto out;
124 1.2 rmind }
125 1.2 rmind npf_session_setpass(se);
126 1.1 rmind }
127 1.2 rmind pass:
128 1.2 rmind KASSERT(error == 0);
129 1.2 rmind /*
130 1.2 rmind * Perform NAT.
131 1.2 rmind */
132 1.2 rmind error = npf_do_nat(&npc, se, nbuf, ifp, di);
133 1.1 rmind out:
134 1.1 rmind /* Release reference on session. */
135 1.1 rmind if (se != NULL) {
136 1.1 rmind npf_session_release(se);
137 1.1 rmind }
138 1.1 rmind
139 1.1 rmind /*
140 1.1 rmind * If error is set - drop the packet.
141 1.2 rmind * Normally, ENETUNREACH is used for "block".
142 1.1 rmind */
143 1.1 rmind if (error) {
144 1.2 rmind /*
145 1.2 rmind * Depending on flags and protocol, return TCP reset (RST)
146 1.2 rmind * or ICMP destination unreachable
147 1.2 rmind */
148 1.2 rmind if (retfl) {
149 1.2 rmind npf_return_block(&npc, nbuf, retfl);
150 1.2 rmind }
151 1.1 rmind m_freem(*mp);
152 1.1 rmind *mp = NULL;
153 1.3 rmind } else {
154 1.3 rmind /*
155 1.3 rmind * XXX: Disable for now, it will be set accordingly later,
156 1.3 rmind * for optimisations (to reduce inspection).
157 1.3 rmind */
158 1.3 rmind (*mp)->m_flags &= ~M_CANFASTFWD;
159 1.1 rmind }
160 1.1 rmind return error;
161 1.1 rmind }
162 1.1 rmind
163 1.1 rmind /*
164 1.1 rmind * npf_register_pfil: register pfil(9) hooks.
165 1.1 rmind */
166 1.1 rmind int
167 1.1 rmind npf_register_pfil(void)
168 1.1 rmind {
169 1.1 rmind int error;
170 1.1 rmind
171 1.1 rmind mutex_enter(softnet_lock);
172 1.1 rmind KERNEL_LOCK(1, NULL);
173 1.1 rmind
174 1.1 rmind /* Check if pfil hooks are not already registered. */
175 1.1 rmind if (npf_ph_if) {
176 1.1 rmind error = EEXIST;
177 1.1 rmind goto fail;
178 1.1 rmind }
179 1.1 rmind
180 1.1 rmind /* Capture point of any activity in interfaces and IP layer. */
181 1.1 rmind npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
182 1.1 rmind npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
183 1.1 rmind if (npf_ph_if == NULL || npf_ph_inet == NULL) {
184 1.1 rmind npf_ph_if = NULL;
185 1.1 rmind error = ENOENT;
186 1.1 rmind goto fail;
187 1.1 rmind }
188 1.1 rmind
189 1.1 rmind /* Interface re-config or attach/detach hook. */
190 1.1 rmind error = pfil_add_hook(npf_ifhook, NULL,
191 1.1 rmind PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
192 1.1 rmind KASSERT(error == 0);
193 1.1 rmind
194 1.1 rmind /* Packet IN/OUT handler on all interfaces and IP layer. */
195 1.2 rmind error = pfil_add_hook(npf_packet_handler, NULL,
196 1.1 rmind PFIL_WAITOK | PFIL_ALL, npf_ph_inet);
197 1.1 rmind KASSERT(error == 0);
198 1.1 rmind
199 1.1 rmind fail:
200 1.1 rmind KERNEL_UNLOCK_ONE(NULL);
201 1.1 rmind mutex_exit(softnet_lock);
202 1.1 rmind
203 1.1 rmind return error;
204 1.1 rmind }
205 1.1 rmind
206 1.1 rmind /*
207 1.1 rmind * npf_unregister: unregister pfil(9) hooks.
208 1.1 rmind */
209 1.1 rmind void
210 1.1 rmind npf_unregister_pfil(void)
211 1.1 rmind {
212 1.1 rmind
213 1.1 rmind mutex_enter(softnet_lock);
214 1.1 rmind KERNEL_LOCK(1, NULL);
215 1.1 rmind
216 1.1 rmind if (npf_ph_if) {
217 1.2 rmind (void)pfil_remove_hook(npf_packet_handler, NULL,
218 1.1 rmind PFIL_ALL, npf_ph_inet);
219 1.1 rmind (void)pfil_remove_hook(npf_ifhook, NULL,
220 1.1 rmind PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
221 1.1 rmind
222 1.1 rmind npf_ph_if = NULL;
223 1.1 rmind }
224 1.1 rmind
225 1.1 rmind KERNEL_UNLOCK_ONE(NULL);
226 1.1 rmind mutex_exit(softnet_lock);
227 1.1 rmind }
228