Home | History | Annotate | Line # | Download | only in npf
npf_handler.c revision 1.3
      1  1.3  rmind /*	$NetBSD: npf_handler.c,v 1.3 2010/10/10 15:29:01 rmind Exp $	*/
      2  1.1  rmind 
      3  1.1  rmind /*-
      4  1.1  rmind  * Copyright (c) 2009-2010 The NetBSD Foundation, Inc.
      5  1.1  rmind  * All rights reserved.
      6  1.1  rmind  *
      7  1.1  rmind  * This material is based upon work partially supported by The
      8  1.1  rmind  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
      9  1.1  rmind  *
     10  1.1  rmind  * Redistribution and use in source and binary forms, with or without
     11  1.1  rmind  * modification, are permitted provided that the following conditions
     12  1.1  rmind  * are met:
     13  1.1  rmind  * 1. Redistributions of source code must retain the above copyright
     14  1.1  rmind  *    notice, this list of conditions and the following disclaimer.
     15  1.1  rmind  * 2. Redistributions in binary form must reproduce the above copyright
     16  1.1  rmind  *    notice, this list of conditions and the following disclaimer in the
     17  1.1  rmind  *    documentation and/or other materials provided with the distribution.
     18  1.1  rmind  *
     19  1.1  rmind  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  1.1  rmind  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  1.1  rmind  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  1.1  rmind  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  1.1  rmind  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  1.1  rmind  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  1.1  rmind  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  1.1  rmind  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  1.1  rmind  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  1.1  rmind  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  1.1  rmind  * POSSIBILITY OF SUCH DAMAGE.
     30  1.1  rmind  */
     31  1.1  rmind 
     32  1.1  rmind /*
     33  1.1  rmind  * NPF packet handler.
     34  1.1  rmind  */
     35  1.1  rmind 
     36  1.1  rmind #include <sys/cdefs.h>
     37  1.3  rmind __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.3 2010/10/10 15:29:01 rmind Exp $");
     38  1.1  rmind 
     39  1.1  rmind #include <sys/param.h>
     40  1.1  rmind #include <sys/systm.h>
     41  1.1  rmind 
     42  1.1  rmind #include <sys/mbuf.h>
     43  1.1  rmind #include <sys/mutex.h>
     44  1.1  rmind #include <net/if.h>
     45  1.1  rmind #include <net/pfil.h>
     46  1.1  rmind #include <sys/socketvar.h>
     47  1.1  rmind 
     48  1.1  rmind #include "npf_impl.h"
     49  1.1  rmind 
     50  1.1  rmind /*
     51  1.1  rmind  * If npf_ph_if != NULL, pfil hooks are registers.  If NULL, not registered.
     52  1.1  rmind  * Used to check the state.  Locked by: softnet_lock + KERNEL_LOCK (XXX).
     53  1.1  rmind  */
     54  1.1  rmind static struct pfil_head *	npf_ph_if = NULL;
     55  1.1  rmind static struct pfil_head *	npf_ph_inet = NULL;
     56  1.1  rmind 
     57  1.2  rmind static bool			default_pass = true;
     58  1.2  rmind 
     59  1.1  rmind int	npf_packet_handler(void *, struct mbuf **, struct ifnet *, int);
     60  1.1  rmind 
     61  1.1  rmind /*
     62  1.1  rmind  * npf_ifhook: hook handling interface changes.
     63  1.1  rmind  */
     64  1.1  rmind static int
     65  1.1  rmind npf_ifhook(void *arg, struct mbuf **mp, struct ifnet *ifp, int di)
     66  1.1  rmind {
     67  1.1  rmind 
     68  1.1  rmind 	return 0;
     69  1.1  rmind }
     70  1.1  rmind 
     71  1.1  rmind /*
     72  1.2  rmind  * npf_packet_handler: main packet handling routine for layer 3.
     73  1.1  rmind  *
     74  1.1  rmind  * Note: packet flow and inspection logic is in strict order.
     75  1.1  rmind  */
     76  1.1  rmind int
     77  1.1  rmind npf_packet_handler(void *arg, struct mbuf **mp, struct ifnet *ifp, int di)
     78  1.1  rmind {
     79  1.1  rmind 	nbuf_t *nbuf = *mp;
     80  1.1  rmind 	npf_cache_t npc;
     81  1.1  rmind 	npf_session_t *se;
     82  1.1  rmind 	npf_rule_t *rl;
     83  1.2  rmind 	bool keepstate;
     84  1.2  rmind 	int retfl, error;
     85  1.1  rmind 
     86  1.1  rmind 	/*
     87  1.1  rmind 	 * Initialise packet information cache.
     88  1.1  rmind 	 * Note: it is enough to clear the info bits.
     89  1.1  rmind 	 */
     90  1.1  rmind 	npc.npc_info = 0;
     91  1.2  rmind 	error = 0;
     92  1.2  rmind 	retfl = 0;
     93  1.1  rmind 
     94  1.1  rmind 	/* Inspect the list of sessions. */
     95  1.2  rmind 	se = npf_session_inspect(&npc, nbuf, ifp, di);
     96  1.2  rmind 
     97  1.2  rmind 	/* If "passing" session found - skip the ruleset inspection. */
     98  1.2  rmind 	if (se && npf_session_pass(se)) {
     99  1.2  rmind 		goto pass;
    100  1.2  rmind 	}
    101  1.1  rmind 
    102  1.2  rmind 	/* Inspect the ruleset using this packet. */
    103  1.2  rmind 	rl = npf_ruleset_inspect(&npc, nbuf, ifp, di, NPF_LAYER_3);
    104  1.2  rmind 	if (rl == NULL) {
    105  1.2  rmind 		if (default_pass) {
    106  1.2  rmind 			goto pass;
    107  1.2  rmind 		}
    108  1.2  rmind 		error = ENETUNREACH;
    109  1.1  rmind 		goto out;
    110  1.1  rmind 	}
    111  1.1  rmind 
    112  1.2  rmind 	/* Apply the rule. */
    113  1.2  rmind 	error = npf_rule_apply(&npc, rl, &keepstate, &retfl);
    114  1.2  rmind 	if (error) {
    115  1.2  rmind 		goto out;
    116  1.1  rmind 	}
    117  1.1  rmind 
    118  1.2  rmind 	/* Establish a "pass" session, if required. */
    119  1.2  rmind 	if (keepstate && !se) {
    120  1.2  rmind 		se = npf_session_establish(&npc, NULL, di);
    121  1.2  rmind 		if (se == NULL) {
    122  1.2  rmind 			error = ENOMEM;
    123  1.2  rmind 			goto out;
    124  1.2  rmind 		}
    125  1.2  rmind 		npf_session_setpass(se);
    126  1.1  rmind 	}
    127  1.2  rmind pass:
    128  1.2  rmind 	KASSERT(error == 0);
    129  1.2  rmind 	/*
    130  1.2  rmind 	 * Perform NAT.
    131  1.2  rmind 	 */
    132  1.2  rmind 	error = npf_do_nat(&npc, se, nbuf, ifp, di);
    133  1.1  rmind out:
    134  1.1  rmind 	/* Release reference on session. */
    135  1.1  rmind 	if (se != NULL) {
    136  1.1  rmind 		npf_session_release(se);
    137  1.1  rmind 	}
    138  1.1  rmind 
    139  1.1  rmind 	/*
    140  1.1  rmind 	 * If error is set - drop the packet.
    141  1.2  rmind 	 * Normally, ENETUNREACH is used for "block".
    142  1.1  rmind 	 */
    143  1.1  rmind 	if (error) {
    144  1.2  rmind 		/*
    145  1.2  rmind 		 * Depending on flags and protocol, return TCP reset (RST)
    146  1.2  rmind 		 * or ICMP destination unreachable
    147  1.2  rmind 		 */
    148  1.2  rmind 		if (retfl) {
    149  1.2  rmind 			npf_return_block(&npc, nbuf, retfl);
    150  1.2  rmind 		}
    151  1.1  rmind 		m_freem(*mp);
    152  1.1  rmind 		*mp = NULL;
    153  1.3  rmind 	} else {
    154  1.3  rmind 		/*
    155  1.3  rmind 		 * XXX: Disable for now, it will be set accordingly later,
    156  1.3  rmind 		 * for optimisations (to reduce inspection).
    157  1.3  rmind 		 */
    158  1.3  rmind 		(*mp)->m_flags &= ~M_CANFASTFWD;
    159  1.1  rmind 	}
    160  1.1  rmind 	return error;
    161  1.1  rmind }
    162  1.1  rmind 
    163  1.1  rmind /*
    164  1.1  rmind  * npf_register_pfil: register pfil(9) hooks.
    165  1.1  rmind  */
    166  1.1  rmind int
    167  1.1  rmind npf_register_pfil(void)
    168  1.1  rmind {
    169  1.1  rmind 	int error;
    170  1.1  rmind 
    171  1.1  rmind 	mutex_enter(softnet_lock);
    172  1.1  rmind 	KERNEL_LOCK(1, NULL);
    173  1.1  rmind 
    174  1.1  rmind 	/* Check if pfil hooks are not already registered. */
    175  1.1  rmind 	if (npf_ph_if) {
    176  1.1  rmind 		error = EEXIST;
    177  1.1  rmind 		goto fail;
    178  1.1  rmind 	}
    179  1.1  rmind 
    180  1.1  rmind 	/* Capture point of any activity in interfaces and IP layer. */
    181  1.1  rmind 	npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
    182  1.1  rmind 	npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
    183  1.1  rmind 	if (npf_ph_if == NULL || npf_ph_inet == NULL) {
    184  1.1  rmind 		npf_ph_if = NULL;
    185  1.1  rmind 		error = ENOENT;
    186  1.1  rmind 		goto fail;
    187  1.1  rmind 	}
    188  1.1  rmind 
    189  1.1  rmind 	/* Interface re-config or attach/detach hook. */
    190  1.1  rmind 	error = pfil_add_hook(npf_ifhook, NULL,
    191  1.1  rmind 	    PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
    192  1.1  rmind 	KASSERT(error == 0);
    193  1.1  rmind 
    194  1.1  rmind 	/* Packet IN/OUT handler on all interfaces and IP layer. */
    195  1.2  rmind 	error = pfil_add_hook(npf_packet_handler, NULL,
    196  1.1  rmind 	    PFIL_WAITOK | PFIL_ALL, npf_ph_inet);
    197  1.1  rmind 	KASSERT(error == 0);
    198  1.1  rmind 
    199  1.1  rmind fail:
    200  1.1  rmind 	KERNEL_UNLOCK_ONE(NULL);
    201  1.1  rmind 	mutex_exit(softnet_lock);
    202  1.1  rmind 
    203  1.1  rmind 	return error;
    204  1.1  rmind }
    205  1.1  rmind 
    206  1.1  rmind /*
    207  1.1  rmind  * npf_unregister: unregister pfil(9) hooks.
    208  1.1  rmind  */
    209  1.1  rmind void
    210  1.1  rmind npf_unregister_pfil(void)
    211  1.1  rmind {
    212  1.1  rmind 
    213  1.1  rmind 	mutex_enter(softnet_lock);
    214  1.1  rmind 	KERNEL_LOCK(1, NULL);
    215  1.1  rmind 
    216  1.1  rmind 	if (npf_ph_if) {
    217  1.2  rmind 		(void)pfil_remove_hook(npf_packet_handler, NULL,
    218  1.1  rmind 		    PFIL_ALL, npf_ph_inet);
    219  1.1  rmind 		(void)pfil_remove_hook(npf_ifhook, NULL,
    220  1.1  rmind 		    PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
    221  1.1  rmind 
    222  1.1  rmind 		npf_ph_if = NULL;
    223  1.1  rmind 	}
    224  1.1  rmind 
    225  1.1  rmind 	KERNEL_UNLOCK_ONE(NULL);
    226  1.1  rmind 	mutex_exit(softnet_lock);
    227  1.1  rmind }
    228