1 /* $NetBSD: if_pflog.c,v 1.4 2004/09/10 08:48:32 yamt Exp $ */ 2 /* $OpenBSD: if_pflog.c,v 1.11 2003/12/31 11:18:25 cedric Exp $ */ 3 /* 4 * The authors of this code are John Ioannidis (ji@tla.org), 5 * Angelos D. Keromytis (kermit@csd.uch.gr) and 6 * Niels Provos (provos@physnet.uni-hamburg.de). 7 * 8 * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 9 * in November 1995. 10 * 11 * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996, 12 * by Angelos D. Keromytis. 13 * 14 * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis 15 * and Niels Provos. 16 * 17 * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis 18 * and Niels Provos. 19 * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos. 20 * 21 * Permission to use, copy, and modify this software with or without fee 22 * is hereby granted, provided that this entire notice is included in 23 * all copies of any software which is or includes a copy or 24 * modification of this software. 25 * You may use this code under the GNU public license if you so wish. Please 26 * contribute changes back to the authors under this freer than GPL license 27 * so that we may further the use of strong encryption without limitations to 28 * all. 29 * 30 * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR 31 * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY 32 * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE 33 * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR 34 * PURPOSE. 35 */ 36 37 #ifdef _KERNEL_OPT 38 #include "opt_inet.h" 39 #endif 40 41 #include "bpfilter.h" 42 #include "pflog.h" 43 44 #include <sys/param.h> 45 #include <sys/systm.h> 46 #include <sys/mbuf.h> 47 #include <sys/socket.h> 48 #include <sys/ioctl.h> 49 50 #include <net/if.h> 51 #include <net/if_types.h> 52 #include <net/route.h> 53 #include <net/bpf.h> 54 55 #ifdef INET 56 #include <netinet/in.h> 57 #include <netinet/in_var.h> 58 #include <netinet/in_systm.h> 59 #include <netinet/ip.h> 60 #endif 61 62 #ifdef INET6 63 #ifndef INET 64 #include <netinet/in.h> 65 #endif 66 #include <netinet6/nd6.h> 67 #endif /* INET6 */ 68 69 #include <net/pfvar.h> 70 #include <net/if_pflog.h> 71 72 #define PFLOGMTU (32768 + MHLEN + MLEN) 73 74 #ifdef PFLOGDEBUG 75 #define DPRINTF(x) do { if (pflogdebug) printf x ; } while (0) 76 #else 77 #define DPRINTF(x) 78 #endif 79 80 struct pflog_softc pflogif[NPFLOG]; 81 82 void pflogattach(int); 83 #ifdef _LKM 84 void pflogdetach(void); 85 #endif 86 int pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *, 87 struct rtentry *); 88 int pflogioctl(struct ifnet *, u_long, caddr_t); 89 void pflogrtrequest(int, struct rtentry *, struct sockaddr *); 90 void pflogstart(struct ifnet *); 91 92 extern int ifqmaxlen; 93 94 void 95 pflogattach(int npflog) 96 { 97 struct ifnet *ifp; 98 int i; 99 100 bzero(pflogif, sizeof(pflogif)); 101 102 for (i = 0; i < NPFLOG; i++) { 103 ifp = &pflogif[i].sc_if; 104 snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", i); 105 ifp->if_softc = &pflogif[i]; 106 ifp->if_mtu = PFLOGMTU; 107 ifp->if_ioctl = pflogioctl; 108 ifp->if_output = pflogoutput; 109 ifp->if_start = pflogstart; 110 ifp->if_type = IFT_PFLOG; 111 ifp->if_snd.ifq_maxlen = ifqmaxlen; 112 ifp->if_hdrlen = PFLOG_HDRLEN; 113 if_attach(ifp); 114 if_alloc_sadl(ifp); 115 116 #if NBPFILTER > 0 117 #ifdef __OpenBSD__ 118 bpfattach(&pflogif[i].sc_if.if_bpf, ifp, DLT_PFLOG, 119 PFLOG_HDRLEN); 120 #else 121 bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN); 122 #endif 123 #endif 124 } 125 } 126 127 #ifdef _LKM 128 void 129 pflogdetach(void) 130 { 131 struct ifnet *ifp; 132 int i; 133 134 for (i = 0; i < NPFLOG; i++) { 135 ifp = &pflogif[i].sc_if; 136 bpfdetach(ifp); 137 if_detach(ifp); 138 } 139 } 140 #endif 141 142 /* 143 * Start output on the pflog interface. 144 */ 145 void 146 pflogstart(struct ifnet *ifp) 147 { 148 struct mbuf *m; 149 int s; 150 151 for (;;) { 152 #ifdef __OpenBSD__ 153 s = splimp(); 154 #else 155 s = splnet(); 156 #endif 157 IF_DROP(&ifp->if_snd); 158 IF_DEQUEUE(&ifp->if_snd, m); 159 splx(s); 160 161 if (m == NULL) 162 return; 163 else 164 m_freem(m); 165 } 166 } 167 168 int 169 pflogoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst, 170 struct rtentry *rt) 171 { 172 m_freem(m); 173 return (0); 174 } 175 176 /* ARGSUSED */ 177 void 178 pflogrtrequest(int cmd, struct rtentry *rt, struct sockaddr *sa) 179 { 180 if (rt) 181 rt->rt_rmx.rmx_mtu = PFLOGMTU; 182 } 183 184 /* ARGSUSED */ 185 int 186 pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data) 187 { 188 switch (cmd) { 189 case SIOCSIFADDR: 190 case SIOCAIFADDR: 191 case SIOCSIFDSTADDR: 192 case SIOCSIFFLAGS: 193 if (ifp->if_flags & IFF_UP) 194 ifp->if_flags |= IFF_RUNNING; 195 else 196 ifp->if_flags &= ~IFF_RUNNING; 197 break; 198 default: 199 return (EINVAL); 200 } 201 202 return (0); 203 } 204 205 int 206 pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir, 207 u_int8_t reason, struct pf_rule *rm, struct pf_rule *am, 208 struct pf_ruleset *ruleset) 209 { 210 #if NBPFILTER > 0 211 struct ifnet *ifn; 212 struct pfloghdr hdr; 213 #ifndef __NetBSD__ 214 struct mbuf m1; 215 #endif 216 217 if (kif == NULL || m == NULL || rm == NULL) 218 return (-1); 219 220 bzero(&hdr, sizeof(hdr)); 221 hdr.length = PFLOG_REAL_HDRLEN; 222 hdr.af = af; 223 hdr.action = rm->action; 224 hdr.reason = reason; 225 memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname)); 226 227 if (am == NULL) { 228 hdr.rulenr = htonl(rm->nr); 229 hdr.subrulenr = -1; 230 } else { 231 hdr.rulenr = htonl(am->nr); 232 hdr.subrulenr = htonl(rm->nr); 233 if (ruleset != NULL) 234 memcpy(hdr.ruleset, ruleset->name, 235 sizeof(hdr.ruleset)); 236 237 238 } 239 hdr.dir = dir; 240 241 #ifdef INET 242 if (af == AF_INET && dir == PF_OUT) { 243 struct ip *ip; 244 245 ip = mtod(m, struct ip *); 246 ip->ip_sum = 0; 247 ip->ip_sum = in_cksum(m, ip->ip_hl << 2); 248 } 249 #endif /* INET */ 250 251 #ifndef __NetBSD__ 252 m1.m_next = m; 253 m1.m_len = PFLOG_HDRLEN; 254 m1.m_data = (char *) &hdr; 255 #endif 256 257 ifn = &(pflogif[0].sc_if); 258 259 if (ifn->if_bpf) 260 #ifndef __NetBSD__ 261 bpf_mtap(ifn->if_bpf, &m1); 262 #else 263 bpf_mtap2(ifn->if_bpf, &hdr, PFLOG_HDRLEN, m); 264 #endif 265 #endif 266 267 return (0); 268 } 269