xref: /netbsd/sys/dist/pf/net/if_pflog.c (revision 6550d01e) 
1 /*	$NetBSD: if_pflog.c,v 1.18 2010/04/12 13:57:38 ahoka Exp $	*/
2 /*	$OpenBSD: if_pflog.c,v 1.24 2007/05/26 17:13:30 jason Exp $	*/
3 
4 /*
5  * The authors of this code are John Ioannidis (ji@tla.org),
6  * Angelos D. Keromytis (kermit@csd.uch.gr) and
7  * Niels Provos (provos@physnet.uni-hamburg.de).
8  *
9  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
10  * in November 1995.
11  *
12  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
13  * by Angelos D. Keromytis.
14  *
15  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
16  * and Niels Provos.
17  *
18  * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
19  * and Niels Provos.
20  * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
21  *
22  * Permission to use, copy, and modify this software with or without fee
23  * is hereby granted, provided that this entire notice is included in
24  * all copies of any software which is or includes a copy or
25  * modification of this software.
26  * You may use this code under the GNU public license if you so wish. Please
27  * contribute changes back to the authors under this freer than GPL license
28  * so that we may further the use of strong encryption without limitations to
29  * all.
30  *
31  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
32  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
33  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
34  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
35  * PURPOSE.
36  */
37 
38 #include <sys/cdefs.h>
39 __KERNEL_RCSID(0, "$NetBSD: if_pflog.c,v 1.18 2010/04/12 13:57:38 ahoka Exp $");
40 
41 #ifdef _KERNEL_OPT
42 #include "opt_inet.h"
43 #endif
44 
45 #include "pflog.h"
46 
47 #include <sys/param.h>
48 #include <sys/systm.h>
49 #include <sys/mbuf.h>
50 #include <sys/proc.h>
51 #include <sys/socket.h>
52 #include <sys/ioctl.h>
53 
54 #include <net/if.h>
55 #include <net/if_types.h>
56 #include <net/route.h>
57 #include <net/bpf.h>
58 
59 #ifdef	INET
60 #include <netinet/in.h>
61 #include <netinet/in_var.h>
62 #include <netinet/in_systm.h>
63 #include <netinet/ip.h>
64 #endif
65 
66 #ifdef INET6
67 #ifndef INET
68 #include <netinet/in.h>
69 #endif
70 #include <netinet6/nd6.h>
71 #endif /* INET6 */
72 
73 #include <net/pfvar.h>
74 #include <net/if_pflog.h>
75 
76 #define PFLOGMTU	(32768 + MHLEN + MLEN)
77 
78 #ifdef PFLOGDEBUG
79 #define DPRINTF(x)    do { if (pflogdebug) printf x ; } while (0)
80 #else
81 #define DPRINTF(x)
82 #endif
83 
84 void	pflogattach(int);
85 #ifdef _MODULE
86 void	pflogdetach(void);
87 #endif /* _MODULE */
88 int	pflogoutput(struct ifnet *, struct mbuf *, const struct sockaddr *,
89 	    	       struct rtentry *);
90 int	pflogioctl(struct ifnet *, u_long, void *);
91 void	pflogstart(struct ifnet *);
92 int	pflog_clone_create(struct if_clone *, int);
93 int	pflog_clone_destroy(struct ifnet *);
94 
95 LIST_HEAD(, pflog_softc)	pflogif_list;
96 struct if_clone	pflog_cloner =
97     IF_CLONE_INITIALIZER("pflog", pflog_clone_create, pflog_clone_destroy);
98 
99 struct ifnet	*pflogifs[PFLOGIFS_MAX];	/* for fast access */
100 
101 void
102 pflogattach(int npflog)
103 {
104 	int i;
105 
106 	LIST_INIT(&pflogif_list);
107 	for (i = 0; i < PFLOGIFS_MAX; i++)
108 		pflogifs[i] = NULL;
109 	if_clone_attach(&pflog_cloner);
110 }
111 
112 #ifdef _MODULE
113 void
114 pflogdetach(void)
115 {
116 	int i;
117 
118 	for (i = 0; i < PFLOGIFS_MAX; i++) {
119 		if (pflogifs[i] != NULL)
120 			pflog_clone_destroy(pflogifs[i]);
121 	}
122 	if_clone_detach(&pflog_cloner);
123 }
124 #endif /* _MODULE */
125 
126 int
127 pflog_clone_create(struct if_clone *ifc, int unit)
128 {
129 	struct ifnet *ifp;
130 	struct pflog_softc *pflogif;
131 	int s;
132 
133 	if (unit >= PFLOGIFS_MAX)
134 		return (EINVAL);
135 
136 	if ((pflogif = malloc(sizeof(*pflogif), M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
137 		return (ENOMEM);
138 
139 	pflogif->sc_unit = unit;
140 	ifp = &pflogif->sc_if;
141 	snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", unit);
142 	ifp->if_softc = pflogif;
143 	ifp->if_mtu = PFLOGMTU;
144 	ifp->if_ioctl = pflogioctl;
145 	ifp->if_output = pflogoutput;
146 	ifp->if_start = pflogstart;
147 	ifp->if_type = IFT_PFLOG;
148 #ifndef __NetBSD__
149 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
150 #endif /* !__NetBSD__ */
151 	ifp->if_hdrlen = PFLOG_HDRLEN;
152 	if_attach(ifp);
153 	if_alloc_sadl(ifp);
154 
155 #ifdef __NetBSD__
156 	bpf_attach(ifp, DLT_PFLOG, PFLOG_HDRLEN);
157 #else
158 	bpfattach(&pflogif->sc_if.if_bpf, ifp, DLT_PFLOG, PFLOG_HDRLEN);
159 #endif /* !__NetBSD__ */
160 
161 	s = splnet();
162 	LIST_INSERT_HEAD(&pflogif_list, pflogif, sc_list);
163 	pflogifs[unit] = ifp;
164 	splx(s);
165 
166 	return (0);
167 }
168 
169 int
170 pflog_clone_destroy(struct ifnet *ifp)
171 {
172 	struct pflog_softc	*pflogif = ifp->if_softc;
173 	int			 s;
174 
175 	s = splnet();
176 	pflogifs[pflogif->sc_unit] = NULL;
177 	LIST_REMOVE(pflogif, sc_list);
178 	splx(s);
179 
180 	bpf_detach(ifp);
181 	if_detach(ifp);
182 	free(pflogif, M_DEVBUF);
183 	return (0);
184 }
185 
186 /*
187  * Start output on the pflog interface.
188  */
189 void
190 pflogstart(struct ifnet *ifp)
191 {
192 	struct mbuf *m;
193 	int s;
194 
195 	for (;;) {
196 		s = splnet();
197 		IF_DROP(&ifp->if_snd);
198 		IF_DEQUEUE(&ifp->if_snd, m);
199 		splx(s);
200 
201 		if (m == NULL)
202 			return;
203 		else
204 			m_freem(m);
205 	}
206 }
207 
208 int
209 pflogoutput(struct ifnet *ifp, struct mbuf *m,
210     const struct sockaddr *dst, struct rtentry *rt)
211 {
212 	m_freem(m);
213 	return (0);
214 }
215 
216 /* ARGSUSED */
217 int
218 pflogioctl(struct ifnet *ifp, u_long cmd, void *data)
219 {
220 	int error = 0;
221 
222 	switch (cmd) {
223 	case SIOCSIFFLAGS:
224 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
225 			break;
226 		/*FALLTHROUGH*/
227 	case SIOCINITIFADDR:
228 	case SIOCAIFADDR:
229 	case SIOCSIFDSTADDR:
230 		if (ifp->if_flags & IFF_UP)
231 			ifp->if_flags |= IFF_RUNNING;
232 		else
233 			ifp->if_flags &= ~IFF_RUNNING;
234 		break;
235 	default:
236 		error = ifioctl_common(ifp, cmd, data);
237 	}
238 
239 	return error;
240 }
241 
242 int
243 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
244     u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
245     struct pf_ruleset *ruleset, struct pf_pdesc *pd)
246 {
247 	struct ifnet *ifn;
248 	struct pfloghdr hdr;
249 
250 	if (kif == NULL || m == NULL || rm == NULL || pd == NULL)
251 		return (-1);
252 
253 	if ((ifn = pflogifs[rm->logif]) == NULL || !ifn->if_bpf)
254 		return (0);
255 
256 	bzero(&hdr, sizeof(hdr));
257 	hdr.length = PFLOG_REAL_HDRLEN;
258 	hdr.af = af;
259 	hdr.action = rm->action;
260 	hdr.reason = reason;
261 	memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
262 
263 	if (am == NULL) {
264 		hdr.rulenr = htonl(rm->nr);
265 		hdr.subrulenr = -1;
266 	} else {
267 		hdr.rulenr = htonl(am->nr);
268 		hdr.subrulenr = htonl(rm->nr);
269 		if (ruleset != NULL && ruleset->anchor != NULL)
270 			strlcpy(hdr.ruleset, ruleset->anchor->name,
271 			    sizeof(hdr.ruleset));
272 	}
273 	if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done)
274 		pd->lookup.done = pf_socket_lookup(dir, pd);
275 	if (pd->lookup.done > 0) {
276 		hdr.uid = pd->lookup.uid;
277 		hdr.pid = pd->lookup.pid;
278 	} else {
279 		hdr.uid = UID_MAX;
280 		hdr.pid = NO_PID;
281 	}
282 	hdr.rule_uid = rm->cuid;
283 	hdr.rule_pid = rm->cpid;
284 	hdr.dir = dir;
285 
286 #ifdef INET
287 	if (af == AF_INET && dir == PF_OUT) {
288 		struct ip *ip;
289 
290 		ip = mtod(m, struct ip *);
291 		ip->ip_sum = 0;
292 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
293 	}
294 #endif /* INET */
295 
296 	ifn->if_opackets++;
297 	ifn->if_obytes += m->m_pkthdr.len;
298 
299 #ifdef __NetBSD__
300 	bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m);
301 #else
302 	bpf_mtap_hdr(ifn->if_bpf, (char *)&hdr, PFLOG_HDRLEN, m,
303 	    BPF_DIRECTION_OUT);
304 #endif /* !__NetBSD__ */
305 
306 
307 	return (0);
308 }
309