1 /* $NetBSD: npf_handler.c,v 1.7 2011/02/02 02:20:25 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2010 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF packet handler. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.7 2011/02/02 02:20:25 rmind Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 42 #include <sys/mbuf.h> 43 #include <sys/mutex.h> 44 #include <net/if.h> 45 #include <net/pfil.h> 46 #include <sys/socketvar.h> 47 48 #include <netinet/in_systm.h> 49 #include <netinet/in.h> 50 #include <netinet/ip_var.h> 51 52 #include "npf_impl.h" 53 54 /* 55 * If npf_ph_if != NULL, pfil hooks are registers. If NULL, not registered. 56 * Used to check the state. Locked by: softnet_lock + KERNEL_LOCK (XXX). 57 */ 58 static struct pfil_head * npf_ph_if = NULL; 59 static struct pfil_head * npf_ph_inet = NULL; 60 61 static bool default_pass = true; 62 63 int npf_packet_handler(void *, struct mbuf **, ifnet_t *, int); 64 65 /* 66 * npf_ifhook: hook handling interface changes. 67 */ 68 static int 69 npf_ifhook(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 70 { 71 72 return 0; 73 } 74 75 /* 76 * npf_packet_handler: main packet handling routine for layer 3. 77 * 78 * Note: packet flow and inspection logic is in strict order. 79 */ 80 int 81 npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 82 { 83 nbuf_t *nbuf = *mp; 84 npf_cache_t npc; 85 npf_session_t *se; 86 npf_ruleset_t *rlset; 87 npf_rule_t *rl; 88 npf_rproc_t *rp; 89 int retfl, error; 90 91 /* 92 * Initialise packet information cache. 93 * Note: it is enough to clear the info bits. 94 */ 95 npc.npc_info = 0; 96 error = 0; 97 retfl = 0; 98 rp = NULL; 99 100 /* Cache everything. Determine whether it is an IPv4 fragment. */ 101 if (npf_cache_all(&npc, nbuf) && npf_iscached(&npc, NPC_IPFRAG)) { 102 struct ip *ip = nbuf_dataptr(*mp); 103 /* 104 * Pass to IPv4 reassembly mechanism. 105 */ 106 if (ip_reass_packet(mp, ip) != 0) { 107 /* Failed; invalid fragment(s) or packet. */ 108 error = EINVAL; 109 se = NULL; 110 goto out; 111 } 112 if (*mp == NULL) { 113 /* More fragments should come; return. */ 114 return 0; 115 } 116 /* Reassembly is complete, we have the final packet. */ 117 nbuf = (nbuf_t *)*mp; 118 } 119 120 /* Inspect the list of sessions. */ 121 se = npf_session_inspect(&npc, nbuf, di); 122 123 /* If "passing" session found - skip the ruleset inspection. */ 124 if (se && npf_session_pass(se, &rp)) { 125 npf_stats_inc(NPF_STAT_PASS_SESSION); 126 goto pass; 127 } 128 129 /* Acquire the lock, inspect the ruleset using this packet. */ 130 npf_core_enter(); 131 rlset = npf_core_ruleset(); 132 rl = npf_ruleset_inspect(&npc, nbuf, rlset, ifp, di, NPF_LAYER_3); 133 if (rl == NULL) { 134 if (default_pass) { 135 npf_stats_inc(NPF_STAT_PASS_DEFAULT); 136 goto pass; 137 } 138 npf_stats_inc(NPF_STAT_BLOCK_DEFAULT); 139 error = ENETUNREACH; 140 goto block; 141 } 142 143 /* Get rule procedure for assocation and/or execution. */ 144 KASSERT(rp == NULL); 145 rp = npf_rproc_return(rl); 146 147 /* Apply the rule, release the lock. */ 148 error = npf_rule_apply(&npc, nbuf, rl, &retfl); 149 if (error) { 150 npf_stats_inc(NPF_STAT_BLOCK_RULESET); 151 goto block; 152 } 153 npf_stats_inc(NPF_STAT_PASS_RULESET); 154 155 /* Establish a "pass" session, if required. */ 156 if ((retfl & NPF_RULE_KEEPSTATE) != 0 && !se) { 157 se = npf_session_establish(&npc, nbuf, di); 158 if (se == NULL) { 159 error = ENOMEM; 160 goto out; 161 } 162 npf_session_setpass(se, rp); 163 } 164 pass: 165 KASSERT(error == 0); 166 /* 167 * Perform NAT. 168 */ 169 error = npf_do_nat(&npc, se, nbuf, ifp, di); 170 block: 171 /* 172 * Perform rule procedure, if any. 173 */ 174 if (rp) { 175 npf_rproc_run(&npc, nbuf, rp, error); 176 } 177 out: 178 /* Release the reference on session, or rule procedure. */ 179 if (se) { 180 npf_session_release(se); 181 } else if (rp) { 182 npf_rproc_release(rp); /* XXXkmem */ 183 } 184 185 /* 186 * If error is set - drop the packet. 187 * Normally, ENETUNREACH is used for "block". 188 */ 189 if (error) { 190 /* 191 * Depending on flags and protocol, return TCP reset (RST) 192 * or ICMP destination unreachable 193 */ 194 if (retfl) { 195 npf_return_block(&npc, nbuf, retfl); 196 } 197 if (error != ENETUNREACH) { 198 NPF_PRINTF(("NPF: error in handler '%d'\n", error)); 199 npf_stats_inc(NPF_STAT_ERROR); 200 } 201 m_freem(*mp); 202 *mp = NULL; 203 } else { 204 /* 205 * XXX: Disable for now, it will be set accordingly later, 206 * for optimisations (to reduce inspection). 207 */ 208 (*mp)->m_flags &= ~M_CANFASTFWD; 209 } 210 return error; 211 } 212 213 /* 214 * npf_register_pfil: register pfil(9) hooks. 215 */ 216 int 217 npf_register_pfil(void) 218 { 219 int error; 220 221 mutex_enter(softnet_lock); 222 KERNEL_LOCK(1, NULL); 223 224 /* Check if pfil hooks are not already registered. */ 225 if (npf_ph_if) { 226 error = EEXIST; 227 goto fail; 228 } 229 230 /* Capture point of any activity in interfaces and IP layer. */ 231 npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0); 232 npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 233 if (npf_ph_if == NULL || npf_ph_inet == NULL) { 234 npf_ph_if = NULL; 235 error = ENOENT; 236 goto fail; 237 } 238 239 /* Interface re-config or attach/detach hook. */ 240 error = pfil_add_hook(npf_ifhook, NULL, 241 PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 242 KASSERT(error == 0); 243 244 /* Packet IN/OUT handler on all interfaces and IP layer. */ 245 error = pfil_add_hook(npf_packet_handler, NULL, 246 PFIL_WAITOK | PFIL_ALL, npf_ph_inet); 247 KASSERT(error == 0); 248 249 fail: 250 KERNEL_UNLOCK_ONE(NULL); 251 mutex_exit(softnet_lock); 252 253 return error; 254 } 255 256 /* 257 * npf_unregister: unregister pfil(9) hooks. 258 */ 259 void 260 npf_unregister_pfil(void) 261 { 262 263 mutex_enter(softnet_lock); 264 KERNEL_LOCK(1, NULL); 265 266 if (npf_ph_if) { 267 (void)pfil_remove_hook(npf_packet_handler, NULL, 268 PFIL_ALL, npf_ph_inet); 269 (void)pfil_remove_hook(npf_ifhook, NULL, 270 PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 271 272 npf_ph_if = NULL; 273 } 274 275 KERNEL_UNLOCK_ONE(NULL); 276 mutex_exit(softnet_lock); 277 } 278