1 /* $NetBSD: if_pflog.c,v 1.11 2007/12/11 11:08:19 lukem Exp $ */ 2 /* $OpenBSD: if_pflog.c,v 1.12 2004/05/19 17:50:51 dhartmei Exp $ */ 3 /* 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis 18 * and Niels Provos. 19 * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos. 20 * 21 * Permission to use, copy, and modify this software with or without fee 22 * is hereby granted, provided that this entire notice is included in 23 * all copies of any software which is or includes a copy or 24 * modification of this software. 25 * You may use this code under the GNU public license if you so wish. Please 26 * contribute changes back to the authors under this freer than GPL license 27 * so that we may further the use of strong encryption without limitations to 28 * all. 29 * 30 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 31 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 32 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 33 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 34 * PURPOSE. 35 */ 36 37 #include <sys/cdefs.h> 38 __KERNEL_RCSID(0, "$NetBSD: if_pflog.c,v 1.11 2007/12/11 11:08:19 lukem Exp $"); 39 40 #ifdef _KERNEL_OPT 41 #include "opt_inet.h" 42 #endif 43 44 #include "bpfilter.h" 45 #include "pflog.h" 46 47 #include <sys/param.h> 48 #include <sys/systm.h> 49 #include <sys/mbuf.h> 50 #include <sys/socket.h> 51 #include <sys/ioctl.h> 52 53 #include <net/if.h> 54 #include <net/if_types.h> 55 #include <net/route.h> 56 #include <net/bpf.h> 57 58 #ifdef INET 59 #include <netinet/in.h> 60 #include <netinet/in_var.h> 61 #include <netinet/in_systm.h> 62 #include <netinet/ip.h> 63 #endif 64 65 #ifdef INET6 66 #ifndef INET 67 #include <netinet/in.h> 68 #endif 69 #include <netinet6/nd6.h> 70 #endif /* INET6 */ 71 72 #include <net/pfvar.h> 73 #include <net/if_pflog.h> 74 75 #define PFLOGMTU (32768 + MHLEN + MLEN) 76 77 #ifdef PFLOGDEBUG 78 #define DPRINTF(x) do { if (pflogdebug) printf x ; } while (0) 79 #else 80 #define DPRINTF(x) 81 #endif 82 83 struct pflog_softc pflogif[NPFLOG]; 84 85 void pflogattach(int); 86 #ifdef _LKM 87 void pflogdetach(void); 88 #endif 89 int pflogoutput(struct ifnet *, struct mbuf *, const struct sockaddr *, 90 struct rtentry *); 91 int pflogioctl(struct ifnet *, u_long, void *); 92 void pflogrtrequest(int, struct rtentry *, struct sockaddr *); 93 void pflogstart(struct ifnet *); 94 95 extern int ifqmaxlen; 96 97 void 98 pflogattach(int npflog) 99 { 100 struct ifnet *ifp; 101 int i; 102 103 bzero(pflogif, sizeof(pflogif)); 104 105 for (i = 0; i < NPFLOG; i++) { 106 ifp = &pflogif[i].sc_if; 107 snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", i); 108 ifp->if_softc = &pflogif[i]; 109 ifp->if_mtu = PFLOGMTU; 110 ifp->if_ioctl = pflogioctl; 111 ifp->if_output = pflogoutput; 112 ifp->if_start = pflogstart; 113 ifp->if_type = IFT_PFLOG; 114 ifp->if_snd.ifq_maxlen = ifqmaxlen; 115 ifp->if_hdrlen = PFLOG_HDRLEN; 116 if_attach(ifp); 117 if_alloc_sadl(ifp); 118 119 #if NBPFILTER > 0 120 #ifdef __OpenBSD__ 121 bpfattach(&pflogif[i].sc_if.if_bpf, ifp, DLT_PFLOG, 122 PFLOG_HDRLEN); 123 #else 124 bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN); 125 #endif 126 #endif 127 } 128 } 129 130 #ifdef _LKM 131 void 132 pflogdetach(void) 133 { 134 struct ifnet *ifp; 135 int i; 136 137 for (i = 0; i < NPFLOG; i++) { 138 ifp = &pflogif[i].sc_if; 139 bpfdetach(ifp); 140 if_detach(ifp); 141 } 142 } 143 #endif 144 145 /* 146 * Start output on the pflog interface. 147 */ 148 void 149 pflogstart(struct ifnet *ifp) 150 { 151 struct mbuf *m; 152 int s; 153 154 for (;;) { 155 #ifdef __OpenBSD__ 156 s = splimp(); 157 #else 158 s = splnet(); 159 #endif 160 IF_DROP(&ifp->if_snd); 161 IF_DEQUEUE(&ifp->if_snd, m); 162 splx(s); 163 164 if (m == NULL) 165 return; 166 else 167 m_freem(m); 168 } 169 } 170 171 int 172 pflogoutput(struct ifnet *ifp, struct mbuf *m, 173 const struct sockaddr *dst, struct rtentry *rt) 174 { 175 m_freem(m); 176 return (0); 177 } 178 179 /* ARGSUSED */ 180 void 181 pflogrtrequest(int cmd, struct rtentry *rt, 182 struct sockaddr *sa) 183 { 184 if (rt) 185 rt->rt_rmx.rmx_mtu = PFLOGMTU; 186 } 187 188 /* ARGSUSED */ 189 int 190 pflogioctl(struct ifnet *ifp, u_long cmd, void *data) 191 { 192 switch (cmd) { 193 case SIOCSIFADDR: 194 case SIOCAIFADDR: 195 case SIOCSIFDSTADDR: 196 case SIOCSIFFLAGS: 197 if (ifp->if_flags & IFF_UP) 198 ifp->if_flags |= IFF_RUNNING; 199 else 200 ifp->if_flags &= ~IFF_RUNNING; 201 break; 202 default: 203 return (EINVAL); 204 } 205 206 return (0); 207 } 208 209 int 210 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir, 211 u_int8_t reason, struct pf_rule *rm, struct pf_rule *am, 212 struct pf_ruleset *ruleset) 213 { 214 #if NBPFILTER > 0 215 struct ifnet *ifn; 216 struct pfloghdr hdr; 217 #ifndef __NetBSD__ 218 struct mbuf m1; 219 #endif 220 221 if (kif == NULL || m == NULL || rm == NULL) 222 return (-1); 223 224 bzero(&hdr, sizeof(hdr)); 225 hdr.length = PFLOG_REAL_HDRLEN; 226 hdr.af = af; 227 hdr.action = rm->action; 228 hdr.reason = reason; 229 memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname)); 230 231 if (am == NULL) { 232 hdr.rulenr = htonl(rm->nr); 233 hdr.subrulenr = -1; 234 } else { 235 hdr.rulenr = htonl(am->nr); 236 hdr.subrulenr = htonl(rm->nr); 237 if (ruleset != NULL && ruleset->anchor != NULL) 238 strlcpy(hdr.ruleset, ruleset->anchor->name, 239 sizeof(hdr.ruleset)); 240 } 241 hdr.dir = dir; 242 243 #ifdef INET 244 if (af == AF_INET && dir == PF_OUT) { 245 struct ip *ip; 246 247 ip = mtod(m, struct ip *); 248 ip->ip_sum = 0; 249 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 250 } 251 #endif /* INET */ 252 253 #ifndef __NetBSD__ 254 m1.m_next = m; 255 m1.m_len = PFLOG_HDRLEN; 256 m1.m_data = (char *) &hdr; 257 #endif 258 259 ifn = &(pflogif[0].sc_if); 260 261 if (ifn->if_bpf) 262 #ifndef __NetBSD__ 263 bpf_mtap(ifn->if_bpf, &m1); 264 #else 265 bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m); 266 #endif 267 #endif 268 269 return (0); 270 } 271