npf_handler.c revision 1.49 1 1.1 rmind /*-
2 1.49 rmind * Copyright (c) 2020 Mindaugas Rasiukevicius <rmind at noxt eu>
3 1.26 rmind * Copyright (c) 2009-2013 The NetBSD Foundation, Inc.
4 1.1 rmind * All rights reserved.
5 1.1 rmind *
6 1.1 rmind * This material is based upon work partially supported by The
7 1.1 rmind * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
8 1.1 rmind *
9 1.1 rmind * Redistribution and use in source and binary forms, with or without
10 1.1 rmind * modification, are permitted provided that the following conditions
11 1.1 rmind * are met:
12 1.1 rmind * 1. Redistributions of source code must retain the above copyright
13 1.1 rmind * notice, this list of conditions and the following disclaimer.
14 1.1 rmind * 2. Redistributions in binary form must reproduce the above copyright
15 1.1 rmind * notice, this list of conditions and the following disclaimer in the
16 1.1 rmind * documentation and/or other materials provided with the distribution.
17 1.1 rmind *
18 1.1 rmind * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19 1.1 rmind * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20 1.1 rmind * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21 1.1 rmind * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22 1.1 rmind * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23 1.1 rmind * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24 1.1 rmind * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25 1.1 rmind * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26 1.1 rmind * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27 1.1 rmind * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28 1.1 rmind * POSSIBILITY OF SUCH DAMAGE.
29 1.1 rmind */
30 1.1 rmind
31 1.1 rmind /*
32 1.1 rmind * NPF packet handler.
33 1.28 rmind *
34 1.49 rmind * This is the main entry point to the NPF where packet processing happens.
35 1.49 rmind * There are some important synchronization rules:
36 1.49 rmind *
37 1.49 rmind * 1) Lookups into the connection database and configuration (ruleset,
38 1.49 rmind * tables, etc) are protected by Epoch-Based Reclamation (EBR);
39 1.49 rmind *
40 1.49 rmind * 2) The code in the critical path (protected by EBR) should generally
41 1.49 rmind * not block (that includes adaptive mutex acquisitions);
42 1.49 rmind *
43 1.49 rmind * 3) Where it will blocks, references should be acquired atomically,
44 1.49 rmind * while in the critical path, on the relevant objects.
45 1.1 rmind */
46 1.1 rmind
47 1.35 christos #ifdef _KERNEL
48 1.1 rmind #include <sys/cdefs.h>
49 1.49 rmind __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.49 2020/05/30 14:16:56 rmind Exp $");
50 1.1 rmind
51 1.14 rmind #include <sys/types.h>
52 1.1 rmind #include <sys/param.h>
53 1.1 rmind
54 1.1 rmind #include <sys/mbuf.h>
55 1.1 rmind #include <sys/mutex.h>
56 1.1 rmind #include <net/if.h>
57 1.1 rmind #include <net/pfil.h>
58 1.1 rmind #include <sys/socketvar.h>
59 1.1 rmind
60 1.4 rmind #include <netinet/in_systm.h>
61 1.4 rmind #include <netinet/in.h>
62 1.4 rmind #include <netinet/ip_var.h>
63 1.8 zoltan #include <netinet/ip6.h>
64 1.8 zoltan #include <netinet6/ip6_var.h>
65 1.35 christos #endif
66 1.4 rmind
67 1.1 rmind #include "npf_impl.h"
68 1.31 rmind #include "npf_conn.h"
69 1.1 rmind
70 1.35 christos #if defined(_NPF_STANDALONE)
71 1.35 christos #define m_freem(m) npf->mbufops->free(m)
72 1.35 christos #define m_clear_flag(m,f)
73 1.35 christos #else
74 1.35 christos #define m_clear_flag(m,f) (m)->m_flags &= ~(f)
75 1.35 christos #endif
76 1.1 rmind
77 1.26 rmind #ifndef INET6
78 1.26 rmind #define ip6_reass_packet(x, y) ENOTSUP
79 1.26 rmind #endif
80 1.26 rmind
81 1.24 rmind static int
82 1.42 maxv npf_reassembly(npf_t *npf, npf_cache_t *npc, bool *mff)
83 1.24 rmind {
84 1.32 rmind nbuf_t *nbuf = npc->npc_nbuf;
85 1.24 rmind int error = EINVAL;
86 1.42 maxv struct mbuf *m;
87 1.42 maxv
88 1.42 maxv *mff = false;
89 1.42 maxv m = nbuf_head_mbuf(nbuf);
90 1.24 rmind
91 1.49 rmind if (npf_iscached(npc, NPC_IP4) && npf->ip4_reassembly) {
92 1.43 maxv error = ip_reass_packet(&m);
93 1.49 rmind } else if (npf_iscached(npc, NPC_IP6) && npf->ip6_reassembly) {
94 1.42 maxv error = ip6_reass_packet(&m, npc->npc_hlen);
95 1.49 rmind } else {
96 1.49 rmind /*
97 1.49 rmind * Reassembly is disabled: just pass the packet through
98 1.49 rmind * the ruleset for inspection.
99 1.49 rmind */
100 1.49 rmind return 0;
101 1.24 rmind }
102 1.44 maxv
103 1.24 rmind if (error) {
104 1.49 rmind /* Reassembly failed; free the mbuf, clear the nbuf. */
105 1.35 christos npf_stats_inc(npf, NPF_STAT_REASSFAIL);
106 1.44 maxv m_freem(m);
107 1.44 maxv memset(nbuf, 0, sizeof(nbuf_t));
108 1.24 rmind return error;
109 1.24 rmind }
110 1.42 maxv if (m == NULL) {
111 1.24 rmind /* More fragments should come. */
112 1.35 christos npf_stats_inc(npf, NPF_STAT_FRAGMENTS);
113 1.42 maxv *mff = true;
114 1.24 rmind return 0;
115 1.24 rmind }
116 1.24 rmind
117 1.24 rmind /*
118 1.24 rmind * Reassembly is complete, we have the final packet.
119 1.24 rmind * Cache again, since layer 4 data is accessible now.
120 1.24 rmind */
121 1.42 maxv nbuf_init(npf, nbuf, m, nbuf->nb_ifp);
122 1.24 rmind npc->npc_info = 0;
123 1.24 rmind
124 1.38 maxv if (npf_cache_all(npc) & (NPC_IPFRAG|NPC_FMTERR)) {
125 1.24 rmind return EINVAL;
126 1.24 rmind }
127 1.35 christos npf_stats_inc(npf, NPF_STAT_REASSEMBLY);
128 1.24 rmind return 0;
129 1.24 rmind }
130 1.24 rmind
131 1.49 rmind static inline bool
132 1.49 rmind npf_packet_bypass_tag_p(nbuf_t *nbuf)
133 1.49 rmind {
134 1.49 rmind uint32_t ntag;
135 1.49 rmind return nbuf_find_tag(nbuf, &ntag) == 0 && (ntag & NPF_NTAG_PASS) != 0;
136 1.49 rmind }
137 1.49 rmind
138 1.1 rmind /*
139 1.47 rmind * npfk_packet_handler: main packet handling routine for layer 3.
140 1.1 rmind *
141 1.1 rmind * Note: packet flow and inspection logic is in strict order.
142 1.1 rmind */
143 1.35 christos __dso_public int
144 1.47 rmind npfk_packet_handler(npf_t *npf, struct mbuf **mp, ifnet_t *ifp, int di)
145 1.1 rmind {
146 1.24 rmind nbuf_t nbuf;
147 1.1 rmind npf_cache_t npc;
148 1.31 rmind npf_conn_t *con;
149 1.1 rmind npf_rule_t *rl;
150 1.5 rmind npf_rproc_t *rp;
151 1.37 christos int error, decision, flags;
152 1.36 christos npf_match_info_t mi;
153 1.42 maxv bool mff;
154 1.1 rmind
155 1.35 christos KASSERT(ifp != NULL);
156 1.35 christos
157 1.1 rmind /*
158 1.49 rmind * Initialize packet information cache.
159 1.1 rmind * Note: it is enough to clear the info bits.
160 1.1 rmind */
161 1.49 rmind nbuf_init(npf, &nbuf, *mp, ifp);
162 1.49 rmind memset(&npc, 0, sizeof(npf_cache_t));
163 1.35 christos npc.npc_ctx = npf;
164 1.32 rmind npc.npc_nbuf = &nbuf;
165 1.32 rmind
166 1.36 christos mi.mi_di = di;
167 1.36 christos mi.mi_rid = 0;
168 1.36 christos mi.mi_retfl = 0;
169 1.36 christos
170 1.42 maxv *mp = NULL;
171 1.14 rmind decision = NPF_DECISION_BLOCK;
172 1.2 rmind error = 0;
173 1.5 rmind rp = NULL;
174 1.40 maxv con = NULL;
175 1.1 rmind
176 1.38 maxv /* Cache everything. */
177 1.37 christos flags = npf_cache_all(&npc);
178 1.38 maxv
179 1.49 rmind /* Malformed packet, leave quickly. */
180 1.38 maxv if (flags & NPC_FMTERR) {
181 1.38 maxv error = EINVAL;
182 1.42 maxv goto out;
183 1.38 maxv }
184 1.38 maxv
185 1.38 maxv /* Determine whether it is an IP fragment. */
186 1.37 christos if (__predict_false(flags & NPC_IPFRAG)) {
187 1.42 maxv /* Pass to IPv4/IPv6 reassembly mechanism. */
188 1.42 maxv error = npf_reassembly(npf, &npc, &mff);
189 1.18 rmind if (error) {
190 1.4 rmind goto out;
191 1.4 rmind }
192 1.42 maxv if (mff) {
193 1.42 maxv /* More fragments should come. */
194 1.4 rmind return 0;
195 1.4 rmind }
196 1.4 rmind }
197 1.4 rmind
198 1.34 rmind /* Just pass-through if specially tagged. */
199 1.49 rmind if (npf_packet_bypass_tag_p(&nbuf)) {
200 1.34 rmind goto pass;
201 1.34 rmind }
202 1.34 rmind
203 1.31 rmind /* Inspect the list of connections (if found, acquires a reference). */
204 1.32 rmind con = npf_conn_inspect(&npc, di, &error);
205 1.2 rmind
206 1.31 rmind /* If "passing" connection found - skip the ruleset inspection. */
207 1.36 christos if (con && npf_conn_pass(con, &mi, &rp)) {
208 1.35 christos npf_stats_inc(npf, NPF_STAT_PASS_CONN);
209 1.14 rmind KASSERT(error == 0);
210 1.2 rmind goto pass;
211 1.14 rmind }
212 1.32 rmind if (__predict_false(error)) {
213 1.24 rmind if (error == ENETUNREACH)
214 1.24 rmind goto block;
215 1.24 rmind goto out;
216 1.2 rmind }
217 1.1 rmind
218 1.7 rmind /* Acquire the lock, inspect the ruleset using this packet. */
219 1.48 rmind int slock = npf_config_read_enter(npf);
220 1.35 christos npf_ruleset_t *rlset = npf_config_ruleset(npf);
221 1.26 rmind
222 1.32 rmind rl = npf_ruleset_inspect(&npc, rlset, di, NPF_LAYER_3);
223 1.32 rmind if (__predict_false(rl == NULL)) {
224 1.35 christos const bool pass = npf_default_pass(npf);
225 1.48 rmind npf_config_read_exit(npf, slock);
226 1.14 rmind
227 1.26 rmind if (pass) {
228 1.35 christos npf_stats_inc(npf, NPF_STAT_PASS_DEFAULT);
229 1.2 rmind goto pass;
230 1.2 rmind }
231 1.35 christos npf_stats_inc(npf, NPF_STAT_BLOCK_DEFAULT);
232 1.6 rmind goto block;
233 1.1 rmind }
234 1.1 rmind
235 1.13 rmind /*
236 1.24 rmind * Get the rule procedure (acquires a reference) for association
237 1.31 rmind * with a connection (if any) and execution.
238 1.13 rmind */
239 1.6 rmind KASSERT(rp == NULL);
240 1.13 rmind rp = npf_rule_getrproc(rl);
241 1.6 rmind
242 1.26 rmind /* Conclude with the rule and release the lock. */
243 1.36 christos error = npf_rule_conclude(rl, &mi);
244 1.48 rmind npf_config_read_exit(npf, slock);
245 1.26 rmind
246 1.2 rmind if (error) {
247 1.35 christos npf_stats_inc(npf, NPF_STAT_BLOCK_RULESET);
248 1.6 rmind goto block;
249 1.1 rmind }
250 1.35 christos npf_stats_inc(npf, NPF_STAT_PASS_RULESET);
251 1.1 rmind
252 1.14 rmind /*
253 1.31 rmind * Establish a "pass" connection, if required. Just proceed if
254 1.31 rmind * connection creation fails (e.g. due to unsupported protocol).
255 1.14 rmind */
256 1.36 christos if ((mi.mi_retfl & NPF_RULE_STATEFUL) != 0 && !con) {
257 1.32 rmind con = npf_conn_establish(&npc, di,
258 1.46 rmind (mi.mi_retfl & NPF_RULE_GSTATEFUL) == 0);
259 1.31 rmind if (con) {
260 1.26 rmind /*
261 1.26 rmind * Note: the reference on the rule procedure is
262 1.49 rmind * transferred to the connection. It will be
263 1.31 rmind * released on connection destruction.
264 1.26 rmind */
265 1.36 christos npf_conn_setpass(con, &mi, rp);
266 1.2 rmind }
267 1.1 rmind }
268 1.42 maxv
269 1.2 rmind pass:
270 1.14 rmind decision = NPF_DECISION_PASS;
271 1.2 rmind KASSERT(error == 0);
272 1.48 rmind
273 1.5 rmind /*
274 1.6 rmind * Perform NAT.
275 1.6 rmind */
276 1.32 rmind error = npf_do_nat(&npc, con, di);
277 1.42 maxv
278 1.6 rmind block:
279 1.6 rmind /*
280 1.22 rmind * Execute the rule procedure, if any is associated.
281 1.22 rmind * It may reverse the decision from pass to block.
282 1.5 rmind */
283 1.36 christos if (rp && !npf_rproc_run(&npc, rp, &mi, &decision)) {
284 1.31 rmind if (con) {
285 1.31 rmind npf_conn_release(con);
286 1.30 jakllsch }
287 1.30 jakllsch npf_rproc_release(rp);
288 1.42 maxv /* mbuf already freed */
289 1.30 jakllsch return 0;
290 1.5 rmind }
291 1.42 maxv
292 1.1 rmind out:
293 1.13 rmind /*
294 1.31 rmind * Release the reference on a connection. Release the reference
295 1.31 rmind * on a rule procedure only if there was no association.
296 1.13 rmind */
297 1.31 rmind if (con) {
298 1.31 rmind npf_conn_release(con);
299 1.6 rmind } else if (rp) {
300 1.13 rmind npf_rproc_release(rp);
301 1.1 rmind }
302 1.1 rmind
303 1.42 maxv /* Get the new mbuf pointer. */
304 1.24 rmind if ((*mp = nbuf_head_mbuf(&nbuf)) == NULL) {
305 1.25 rmind return error ? error : ENOMEM;
306 1.24 rmind }
307 1.24 rmind
308 1.14 rmind /* Pass the packet if decided and there is no error. */
309 1.14 rmind if (decision == NPF_DECISION_PASS && !error) {
310 1.3 rmind /*
311 1.3 rmind * XXX: Disable for now, it will be set accordingly later,
312 1.3 rmind * for optimisations (to reduce inspection).
313 1.3 rmind */
314 1.35 christos m_clear_flag(*mp, M_CANFASTFWD);
315 1.13 rmind return 0;
316 1.1 rmind }
317 1.13 rmind
318 1.13 rmind /*
319 1.13 rmind * Block the packet. ENETUNREACH is used to indicate blocking.
320 1.13 rmind * Depending on the flags and protocol, return TCP reset (RST) or
321 1.13 rmind * ICMP destination unreachable.
322 1.13 rmind */
323 1.36 christos if (mi.mi_retfl && npf_return_block(&npc, mi.mi_retfl)) {
324 1.16 rmind *mp = NULL;
325 1.13 rmind }
326 1.16 rmind
327 1.20 rmind if (!error) {
328 1.14 rmind error = ENETUNREACH;
329 1.13 rmind }
330 1.13 rmind
331 1.16 rmind if (*mp) {
332 1.35 christos /* Free the mbuf chain. */
333 1.16 rmind m_freem(*mp);
334 1.16 rmind *mp = NULL;
335 1.16 rmind }
336 1.1 rmind return error;
337 1.1 rmind }
338