xref: /netbsd-src/sys/net/npf/npf_handler.c (revision 9ddb6ab554e70fb9bbd90c3d96b812bc57755a14)
1 /*	$NetBSD: npf_handler.c,v 1.15 2012/03/11 18:27:59 rmind Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009-2012 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This material is based upon work partially supported by The
8  * NetBSD Foundation under a contract with Mindaugas Rasiukevicius.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 
32 /*
33  * NPF packet handler.
34  */
35 
36 #include <sys/cdefs.h>
37 __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.15 2012/03/11 18:27:59 rmind Exp $");
38 
39 #include <sys/types.h>
40 #include <sys/param.h>
41 
42 #include <sys/mbuf.h>
43 #include <sys/mutex.h>
44 #include <net/if.h>
45 #include <net/pfil.h>
46 #include <sys/socketvar.h>
47 
48 #include <netinet/in_systm.h>
49 #include <netinet/in.h>
50 #include <netinet/ip_var.h>
51 #include <netinet/ip6.h>
52 #include <netinet6/ip6_var.h>
53 
54 #include "npf_impl.h"
55 
56 /*
57  * If npf_ph_if != NULL, pfil hooks are registers.  If NULL, not registered.
58  * Used to check the state.  Locked by: softnet_lock + KERNEL_LOCK (XXX).
59  */
60 static struct pfil_head *	npf_ph_if = NULL;
61 static struct pfil_head *	npf_ph_inet = NULL;
62 static struct pfil_head *	npf_ph_inet6 = NULL;
63 
64 int	npf_packet_handler(void *, struct mbuf **, ifnet_t *, int);
65 
66 /*
67  * npf_ifhook: hook handling interface changes.
68  */
69 static int
70 npf_ifhook(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
71 {
72 
73 	return 0;
74 }
75 
76 /*
77  * npf_packet_handler: main packet handling routine for layer 3.
78  *
79  * Note: packet flow and inspection logic is in strict order.
80  */
81 int
82 npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di)
83 {
84 	nbuf_t *nbuf = *mp;
85 	npf_cache_t npc;
86 	npf_session_t *se;
87 	npf_ruleset_t *rlset;
88 	npf_rule_t *rl;
89 	npf_rproc_t *rp;
90 	int error, retfl;
91 	int decision;
92 
93 	/*
94 	 * Initialise packet information cache.
95 	 * Note: it is enough to clear the info bits.
96 	 */
97 	npc.npc_info = 0;
98 	decision = NPF_DECISION_BLOCK;
99 	error = 0;
100 	retfl = 0;
101 	rp = NULL;
102 
103 	/* Cache everything.  Determine whether it is an IP fragment. */
104 	if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) {
105 		int ret = -1;
106 
107 		/* Pass to IPv4 or IPv6 reassembly mechanism. */
108 		if (npf_iscached(&npc, NPC_IP4)) {
109 			struct ip *ip = nbuf_dataptr(*mp);
110 			ret = ip_reass_packet(mp, ip);
111 		} else if (npf_iscached(&npc, NPC_IP6)) {
112 #ifdef INET6
113 			/*
114 			 * Note: frag6_input() offset is the start of the
115 			 * fragment header.
116 			 */
117 			const u_int hlen = npf_cache_hlen(&npc);
118 			ret = ip6_reass_packet(mp, hlen);
119 #endif
120 		}
121 		if (ret) {
122 			error = EINVAL;
123 			se = NULL;
124 			goto out;
125 		}
126 		if (*mp == NULL) {
127 			/* More fragments should come; return. */
128 			return 0;
129 		}
130 
131 		/*
132 		 * Reassembly is complete, we have the final packet.
133 		 * Cache again, since layer 4 data is accessible now.
134 		 */
135 		nbuf = (nbuf_t *)*mp;
136 		npc.npc_info = 0;
137 
138 		ret = npf_cache_all(&npc, nbuf);
139 		KASSERT((ret & NPC_IPFRAG) == 0);
140 	}
141 
142 	/* Inspect the list of sessions. */
143 	se = npf_session_inspect(&npc, nbuf, di, &error);
144 
145 	/* If "passing" session found - skip the ruleset inspection. */
146 	if (se && npf_session_pass(se, &rp)) {
147 		npf_stats_inc(NPF_STAT_PASS_SESSION);
148 		KASSERT(error == 0);
149 		goto pass;
150 	}
151 	if (error) {
152 		goto block;
153 	}
154 
155 	/* Acquire the lock, inspect the ruleset using this packet. */
156 	npf_core_enter();
157 	rlset = npf_core_ruleset();
158 	rl = npf_ruleset_inspect(&npc, nbuf, rlset, ifp, di, NPF_LAYER_3);
159 	if (rl == NULL) {
160 		bool default_pass = npf_default_pass();
161 		npf_core_exit();
162 
163 		if (default_pass) {
164 			npf_stats_inc(NPF_STAT_PASS_DEFAULT);
165 			goto pass;
166 		}
167 		npf_stats_inc(NPF_STAT_BLOCK_DEFAULT);
168 		goto block;
169 	}
170 
171 	/*
172 	 * Get the rule procedure (acquires a reference) for assocation
173 	 * with a session (if any) and execution.
174 	 */
175 	KASSERT(rp == NULL);
176 	rp = npf_rule_getrproc(rl);
177 
178 	/* Apply the rule, release the lock. */
179 	error = npf_rule_apply(&npc, nbuf, rl, &retfl);
180 	if (error) {
181 		npf_stats_inc(NPF_STAT_BLOCK_RULESET);
182 		goto block;
183 	}
184 	npf_stats_inc(NPF_STAT_PASS_RULESET);
185 
186 	/*
187 	 * Establish a "pass" session, if required.  Just proceed, if session
188 	 * creation fails (e.g. due to unsupported protocol).
189 	 *
190 	 * Note: the reference on the rule procedure is transfered to the
191 	 * session.  It will be released on session destruction.
192 	 */
193 	if ((retfl & NPF_RULE_KEEPSTATE) != 0 && !se) {
194 		se = npf_session_establish(&npc, nbuf, di);
195 		if (se) {
196 			npf_session_setpass(se, rp);
197 		}
198 	}
199 pass:
200 	decision = NPF_DECISION_PASS;
201 	KASSERT(error == 0);
202 	/*
203 	 * Perform NAT.
204 	 */
205 	error = npf_do_nat(&npc, se, nbuf, ifp, di);
206 block:
207 	/*
208 	 * Execute rule procedure, if any.
209 	 */
210 	if (rp) {
211 		npf_rproc_run(&npc, nbuf, rp, error);
212 	}
213 out:
214 	/*
215 	 * Release the reference on a session.  Release the reference on a
216 	 * rule procedure only if there was no association.
217 	 */
218 	if (se) {
219 		npf_session_release(se);
220 	} else if (rp) {
221 		npf_rproc_release(rp);
222 	}
223 
224 	/* Pass the packet if decided and there is no error. */
225 	if (decision == NPF_DECISION_PASS && !error) {
226 		/*
227 		 * XXX: Disable for now, it will be set accordingly later,
228 		 * for optimisations (to reduce inspection).
229 		 */
230 		(*mp)->m_flags &= ~M_CANFASTFWD;
231 		return 0;
232 	}
233 
234 	/*
235 	 * Block the packet.  ENETUNREACH is used to indicate blocking.
236 	 * Depending on the flags and protocol, return TCP reset (RST) or
237 	 * ICMP destination unreachable.
238 	 */
239 	if (retfl) {
240 		npf_return_block(&npc, nbuf, retfl);
241 	}
242 	if (error) {
243 		npf_stats_inc(NPF_STAT_ERROR);
244 	} else {
245 		error = ENETUNREACH;
246 	}
247 	m_freem(*mp);
248 	*mp = NULL;
249 
250 	return error;
251 }
252 
253 /*
254  * npf_pfil_register: register pfil(9) hooks.
255  */
256 int
257 npf_pfil_register(void)
258 {
259 	int error;
260 
261 	mutex_enter(softnet_lock);
262 	KERNEL_LOCK(1, NULL);
263 
264 	/* Check if pfil hooks are not already registered. */
265 	if (npf_ph_if) {
266 		error = EEXIST;
267 		goto fail;
268 	}
269 
270 	/* Capture point of any activity in interfaces and IP layer. */
271 	npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0);
272 	npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
273 	npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
274 	if (npf_ph_if == NULL || npf_ph_inet == NULL || npf_ph_inet6 == NULL) {
275 		npf_ph_if = NULL;
276 		error = ENOENT;
277 		goto fail;
278 	}
279 
280 	/* Interface re-config or attach/detach hook. */
281 	error = pfil_add_hook(npf_ifhook, NULL,
282 	    PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
283 	KASSERT(error == 0);
284 
285 	/* Packet IN/OUT handler on all interfaces and IP layer. */
286 	error = pfil_add_hook(npf_packet_handler, NULL,
287 	    PFIL_WAITOK | PFIL_ALL, npf_ph_inet);
288 	KASSERT(error == 0);
289 
290 	error = pfil_add_hook(npf_packet_handler, NULL,
291 	    PFIL_WAITOK | PFIL_ALL, npf_ph_inet6);
292 	KASSERT(error == 0);
293 fail:
294 	KERNEL_UNLOCK_ONE(NULL);
295 	mutex_exit(softnet_lock);
296 
297 	return error;
298 }
299 
300 /*
301  * npf_pfil_unregister: unregister pfil(9) hooks.
302  */
303 void
304 npf_pfil_unregister(void)
305 {
306 
307 	mutex_enter(softnet_lock);
308 	KERNEL_LOCK(1, NULL);
309 
310 	if (npf_ph_if) {
311 		(void)pfil_remove_hook(npf_packet_handler, NULL,
312 		    PFIL_ALL, npf_ph_inet6);
313 		(void)pfil_remove_hook(npf_packet_handler, NULL,
314 		    PFIL_ALL, npf_ph_inet);
315 		(void)pfil_remove_hook(npf_ifhook, NULL,
316 		    PFIL_IFADDR | PFIL_IFNET, npf_ph_if);
317 
318 		npf_ph_if = NULL;
319 	}
320 
321 	KERNEL_UNLOCK_ONE(NULL);
322 	mutex_exit(softnet_lock);
323 }
324 
325 bool
326 npf_pfil_registered_p(void)
327 {
328 	return npf_ph_if != NULL;
329 }
330