1 /* $NetBSD: if_pflog.c,v 1.7 2006/10/12 01:32:10 christos Exp $ */ 2 /* $OpenBSD: if_pflog.c,v 1.12 2004/05/19 17:50:51 dhartmei Exp $ */ 3 /* 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis 18 * and Niels Provos. 19 * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos. 20 * 21 * Permission to use, copy, and modify this software with or without fee 22 * is hereby granted, provided that this entire notice is included in 23 * all copies of any software which is or includes a copy or 24 * modification of this software. 25 * You may use this code under the GNU public license if you so wish. Please 26 * contribute changes back to the authors under this freer than GPL license 27 * so that we may further the use of strong encryption without limitations to 28 * all. 29 * 30 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 31 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 32 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 33 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 34 * PURPOSE. 35 */ 36 37 #ifdef _KERNEL_OPT 38 #include "opt_inet.h" 39 #endif 40 41 #include "bpfilter.h" 42 #include "pflog.h" 43 44 #include <sys/param.h> 45 #include <sys/systm.h> 46 #include <sys/mbuf.h> 47 #include <sys/socket.h> 48 #include <sys/ioctl.h> 49 50 #include <net/if.h> 51 #include <net/if_types.h> 52 #include <net/route.h> 53 #include <net/bpf.h> 54 55 #ifdef INET 56 #include <netinet/in.h> 57 #include <netinet/in_var.h> 58 #include <netinet/in_systm.h> 59 #include <netinet/ip.h> 60 #endif 61 62 #ifdef INET6 63 #ifndef INET 64 #include <netinet/in.h> 65 #endif 66 #include <netinet6/nd6.h> 67 #endif /* INET6 */ 68 69 #include <net/pfvar.h> 70 #include <net/if_pflog.h> 71 72 #define PFLOGMTU (32768 + MHLEN + MLEN) 73 74 #ifdef PFLOGDEBUG 75 #define DPRINTF(x) do { if (pflogdebug) printf x ; } while (0) 76 #else 77 #define DPRINTF(x) 78 #endif 79 80 struct pflog_softc pflogif[NPFLOG]; 81 82 void pflogattach(int); 83 #ifdef _LKM 84 void pflogdetach(void); 85 #endif 86 int pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *, 87 struct rtentry *); 88 int pflogioctl(struct ifnet *, u_long, caddr_t); 89 void pflogrtrequest(int, struct rtentry *, struct sockaddr *); 90 void pflogstart(struct ifnet *); 91 92 extern int ifqmaxlen; 93 94 void 95 pflogattach(int npflog __unused) 96 { 97 struct ifnet *ifp; 98 int i; 99 100 bzero(pflogif, sizeof(pflogif)); 101 102 for (i = 0; i < NPFLOG; i++) { 103 ifp = &pflogif[i].sc_if; 104 snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", i); 105 ifp->if_softc = &pflogif[i]; 106 ifp->if_mtu = PFLOGMTU; 107 ifp->if_ioctl = pflogioctl; 108 ifp->if_output = pflogoutput; 109 ifp->if_start = pflogstart; 110 ifp->if_type = IFT_PFLOG; 111 ifp->if_snd.ifq_maxlen = ifqmaxlen; 112 ifp->if_hdrlen = PFLOG_HDRLEN; 113 if_attach(ifp); 114 if_alloc_sadl(ifp); 115 116 #if NBPFILTER > 0 117 #ifdef __OpenBSD__ 118 bpfattach(&pflogif[i].sc_if.if_bpf, ifp, DLT_PFLOG, 119 PFLOG_HDRLEN); 120 #else 121 bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN); 122 #endif 123 #endif 124 } 125 } 126 127 #ifdef _LKM 128 void 129 pflogdetach(void) 130 { 131 struct ifnet *ifp; 132 int i; 133 134 for (i = 0; i < NPFLOG; i++) { 135 ifp = &pflogif[i].sc_if; 136 bpfdetach(ifp); 137 if_detach(ifp); 138 } 139 } 140 #endif 141 142 /* 143 * Start output on the pflog interface. 144 */ 145 void 146 pflogstart(struct ifnet *ifp) 147 { 148 struct mbuf *m; 149 int s; 150 151 for (;;) { 152 #ifdef __OpenBSD__ 153 s = splimp(); 154 #else 155 s = splnet(); 156 #endif 157 IF_DROP(&ifp->if_snd); 158 IF_DEQUEUE(&ifp->if_snd, m); 159 splx(s); 160 161 if (m == NULL) 162 return; 163 else 164 m_freem(m); 165 } 166 } 167 168 int 169 pflogoutput(struct ifnet *ifp __unused, struct mbuf *m, 170 struct sockaddr *dst __unused, struct rtentry *rt __unused) 171 { 172 m_freem(m); 173 return (0); 174 } 175 176 /* ARGSUSED */ 177 void 178 pflogrtrequest(int cmd __unused, struct rtentry *rt, 179 struct sockaddr *sa __unused) 180 { 181 if (rt) 182 rt->rt_rmx.rmx_mtu = PFLOGMTU; 183 } 184 185 /* ARGSUSED */ 186 int 187 pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data __unused) 188 { 189 switch (cmd) { 190 case SIOCSIFADDR: 191 case SIOCAIFADDR: 192 case SIOCSIFDSTADDR: 193 case SIOCSIFFLAGS: 194 if (ifp->if_flags & IFF_UP) 195 ifp->if_flags |= IFF_RUNNING; 196 else 197 ifp->if_flags &= ~IFF_RUNNING; 198 break; 199 default: 200 return (EINVAL); 201 } 202 203 return (0); 204 } 205 206 int 207 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir, 208 u_int8_t reason, struct pf_rule *rm, struct pf_rule *am, 209 struct pf_ruleset *ruleset) 210 { 211 #if NBPFILTER > 0 212 struct ifnet *ifn; 213 struct pfloghdr hdr; 214 #ifndef __NetBSD__ 215 struct mbuf m1; 216 #endif 217 218 if (kif == NULL || m == NULL || rm == NULL) 219 return (-1); 220 221 bzero(&hdr, sizeof(hdr)); 222 hdr.length = PFLOG_REAL_HDRLEN; 223 hdr.af = af; 224 hdr.action = rm->action; 225 hdr.reason = reason; 226 memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname)); 227 228 if (am == NULL) { 229 hdr.rulenr = htonl(rm->nr); 230 hdr.subrulenr = -1; 231 } else { 232 hdr.rulenr = htonl(am->nr); 233 hdr.subrulenr = htonl(rm->nr); 234 if (ruleset != NULL && ruleset->anchor != NULL) 235 strlcpy(hdr.ruleset, ruleset->anchor->name, 236 sizeof(hdr.ruleset)); 237 } 238 hdr.dir = dir; 239 240 #ifdef INET 241 if (af == AF_INET && dir == PF_OUT) { 242 struct ip *ip; 243 244 ip = mtod(m, struct ip *); 245 ip->ip_sum = 0; 246 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 247 } 248 #endif /* INET */ 249 250 #ifndef __NetBSD__ 251 m1.m_next = m; 252 m1.m_len = PFLOG_HDRLEN; 253 m1.m_data = (char *) &hdr; 254 #endif 255 256 ifn = &(pflogif[0].sc_if); 257 258 if (ifn->if_bpf) 259 #ifndef __NetBSD__ 260 bpf_mtap(ifn->if_bpf, &m1); 261 #else 262 bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m); 263 #endif 264 #endif 265 266 return (0); 267 } 268