1 /* $NetBSD: npf_handler.c,v 1.39 2018/03/13 09:04:02 maxv Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF packet handler. 34 * 35 * Note: pfil(9) hooks are currently locked by softnet_lock and kernel-lock. 36 */ 37 38 #ifdef _KERNEL 39 #include <sys/cdefs.h> 40 __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.39 2018/03/13 09:04:02 maxv Exp $"); 41 42 #include <sys/types.h> 43 #include <sys/param.h> 44 45 #include <sys/mbuf.h> 46 #include <sys/mutex.h> 47 #include <net/if.h> 48 #include <net/pfil.h> 49 #include <sys/socketvar.h> 50 51 #include <netinet/in_systm.h> 52 #include <netinet/in.h> 53 #include <netinet/ip_var.h> 54 #include <netinet/ip6.h> 55 #include <netinet6/ip6_var.h> 56 #endif 57 58 #include "npf_impl.h" 59 #include "npf_conn.h" 60 61 #if defined(_NPF_STANDALONE) 62 #define m_freem(m) npf->mbufops->free(m) 63 #define m_clear_flag(m,f) 64 #else 65 #define m_clear_flag(m,f) (m)->m_flags &= ~(f) 66 #endif 67 68 #ifndef INET6 69 #define ip6_reass_packet(x, y) ENOTSUP 70 #endif 71 72 static int 73 npf_reassembly(npf_t *npf, npf_cache_t *npc, struct mbuf **mp) 74 { 75 nbuf_t *nbuf = npc->npc_nbuf; 76 int error = EINVAL; 77 78 /* Reset the mbuf as it may have changed. */ 79 *mp = nbuf_head_mbuf(nbuf); 80 nbuf_reset(nbuf); 81 82 if (npf_iscached(npc, NPC_IP4)) { 83 struct ip *ip = nbuf_dataptr(nbuf); 84 error = ip_reass_packet(mp, ip); 85 } else if (npf_iscached(npc, NPC_IP6)) { 86 /* 87 * Note: ip6_reass_packet() offset is the start of 88 * the fragment header. 89 */ 90 error = ip6_reass_packet(mp, npc->npc_hlen); 91 if (error && *mp == NULL) { 92 memset(nbuf, 0, sizeof(nbuf_t)); 93 } 94 } 95 if (error) { 96 npf_stats_inc(npf, NPF_STAT_REASSFAIL); 97 return error; 98 } 99 if (*mp == NULL) { 100 /* More fragments should come. */ 101 npf_stats_inc(npf, NPF_STAT_FRAGMENTS); 102 return 0; 103 } 104 105 /* 106 * Reassembly is complete, we have the final packet. 107 * Cache again, since layer 4 data is accessible now. 108 */ 109 nbuf_init(npf, nbuf, *mp, nbuf->nb_ifp); 110 npc->npc_info = 0; 111 112 if (npf_cache_all(npc) & (NPC_IPFRAG|NPC_FMTERR)) { 113 return EINVAL; 114 } 115 npf_stats_inc(npf, NPF_STAT_REASSEMBLY); 116 return 0; 117 } 118 119 /* 120 * npf_packet_handler: main packet handling routine for layer 3. 121 * 122 * Note: packet flow and inspection logic is in strict order. 123 */ 124 __dso_public int 125 npf_packet_handler(npf_t *npf, struct mbuf **mp, ifnet_t *ifp, int di) 126 { 127 nbuf_t nbuf; 128 npf_cache_t npc; 129 npf_conn_t *con; 130 npf_rule_t *rl; 131 npf_rproc_t *rp; 132 int error, decision, flags; 133 uint32_t ntag; 134 npf_match_info_t mi; 135 136 /* QSBR checkpoint. */ 137 pserialize_checkpoint(npf->qsbr); 138 KASSERT(ifp != NULL); 139 140 /* 141 * Initialise packet information cache. 142 * Note: it is enough to clear the info bits. 143 */ 144 npc.npc_ctx = npf; 145 nbuf_init(npf, &nbuf, *mp, ifp); 146 npc.npc_nbuf = &nbuf; 147 npc.npc_info = 0; 148 149 mi.mi_di = di; 150 mi.mi_rid = 0; 151 mi.mi_retfl = 0; 152 153 decision = NPF_DECISION_BLOCK; 154 error = 0; 155 rp = NULL; 156 157 /* Cache everything. */ 158 flags = npf_cache_all(&npc); 159 160 /* If error on the format, leave quickly. */ 161 if (flags & NPC_FMTERR) { 162 error = EINVAL; 163 goto fastout; 164 } 165 166 /* Determine whether it is an IP fragment. */ 167 if (__predict_false(flags & NPC_IPFRAG)) { 168 /* 169 * Pass to IPv4/IPv6 reassembly mechanism. 170 */ 171 error = npf_reassembly(npf, &npc, mp); 172 if (error) { 173 con = NULL; 174 goto out; 175 } 176 if (*mp == NULL) { 177 /* More fragments should come; return. */ 178 return 0; 179 } 180 } 181 182 /* Just pass-through if specially tagged. */ 183 if (nbuf_find_tag(&nbuf, &ntag) == 0 && (ntag & NPF_NTAG_PASS) != 0) { 184 con = NULL; 185 goto pass; 186 } 187 188 /* Inspect the list of connections (if found, acquires a reference). */ 189 con = npf_conn_inspect(&npc, di, &error); 190 191 /* If "passing" connection found - skip the ruleset inspection. */ 192 if (con && npf_conn_pass(con, &mi, &rp)) { 193 npf_stats_inc(npf, NPF_STAT_PASS_CONN); 194 KASSERT(error == 0); 195 goto pass; 196 } 197 if (__predict_false(error)) { 198 if (error == ENETUNREACH) 199 goto block; 200 goto out; 201 } 202 203 /* Acquire the lock, inspect the ruleset using this packet. */ 204 int slock = npf_config_read_enter(); 205 npf_ruleset_t *rlset = npf_config_ruleset(npf); 206 207 rl = npf_ruleset_inspect(&npc, rlset, di, NPF_LAYER_3); 208 if (__predict_false(rl == NULL)) { 209 const bool pass = npf_default_pass(npf); 210 npf_config_read_exit(slock); 211 212 if (pass) { 213 npf_stats_inc(npf, NPF_STAT_PASS_DEFAULT); 214 goto pass; 215 } 216 npf_stats_inc(npf, NPF_STAT_BLOCK_DEFAULT); 217 goto block; 218 } 219 220 /* 221 * Get the rule procedure (acquires a reference) for association 222 * with a connection (if any) and execution. 223 */ 224 KASSERT(rp == NULL); 225 rp = npf_rule_getrproc(rl); 226 227 /* Conclude with the rule and release the lock. */ 228 error = npf_rule_conclude(rl, &mi); 229 npf_config_read_exit(slock); 230 231 if (error) { 232 npf_stats_inc(npf, NPF_STAT_BLOCK_RULESET); 233 goto block; 234 } 235 npf_stats_inc(npf, NPF_STAT_PASS_RULESET); 236 237 /* 238 * Establish a "pass" connection, if required. Just proceed if 239 * connection creation fails (e.g. due to unsupported protocol). 240 */ 241 if ((mi.mi_retfl & NPF_RULE_STATEFUL) != 0 && !con) { 242 con = npf_conn_establish(&npc, di, 243 (mi.mi_retfl & NPF_RULE_MULTIENDS) == 0); 244 if (con) { 245 /* 246 * Note: the reference on the rule procedure is 247 * transfered to the connection. It will be 248 * released on connection destruction. 249 */ 250 npf_conn_setpass(con, &mi, rp); 251 } 252 } 253 pass: 254 decision = NPF_DECISION_PASS; 255 KASSERT(error == 0); 256 /* 257 * Perform NAT. 258 */ 259 error = npf_do_nat(&npc, con, di); 260 block: 261 /* 262 * Execute the rule procedure, if any is associated. 263 * It may reverse the decision from pass to block. 264 */ 265 if (rp && !npf_rproc_run(&npc, rp, &mi, &decision)) { 266 if (con) { 267 npf_conn_release(con); 268 } 269 npf_rproc_release(rp); 270 *mp = NULL; 271 return 0; 272 } 273 out: 274 /* 275 * Release the reference on a connection. Release the reference 276 * on a rule procedure only if there was no association. 277 */ 278 if (con) { 279 npf_conn_release(con); 280 } else if (rp) { 281 npf_rproc_release(rp); 282 } 283 284 /* Reset mbuf pointer before returning to the caller. */ 285 if ((*mp = nbuf_head_mbuf(&nbuf)) == NULL) { 286 return error ? error : ENOMEM; 287 } 288 289 /* Pass the packet if decided and there is no error. */ 290 if (decision == NPF_DECISION_PASS && !error) { 291 /* 292 * XXX: Disable for now, it will be set accordingly later, 293 * for optimisations (to reduce inspection). 294 */ 295 m_clear_flag(*mp, M_CANFASTFWD); 296 return 0; 297 } 298 299 /* 300 * Block the packet. ENETUNREACH is used to indicate blocking. 301 * Depending on the flags and protocol, return TCP reset (RST) or 302 * ICMP destination unreachable. 303 */ 304 if (mi.mi_retfl && npf_return_block(&npc, mi.mi_retfl)) { 305 *mp = NULL; 306 } 307 308 if (!error) { 309 error = ENETUNREACH; 310 } 311 312 fastout: 313 if (*mp) { 314 /* Free the mbuf chain. */ 315 m_freem(*mp); 316 *mp = NULL; 317 } 318 return error; 319 } 320