1 /* $NetBSD: npf_handler.c,v 1.26 2013/02/09 03:35:31 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2013 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF packet handler. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.26 2013/02/09 03:35:31 rmind Exp $"); 38 39 #include <sys/types.h> 40 #include <sys/param.h> 41 42 #include <sys/mbuf.h> 43 #include <sys/mutex.h> 44 #include <net/if.h> 45 #include <net/pfil.h> 46 #include <sys/socketvar.h> 47 48 #include <netinet/in_systm.h> 49 #include <netinet/in.h> 50 #include <netinet/ip_var.h> 51 #include <netinet/ip6.h> 52 #include <netinet6/ip6_var.h> 53 54 #include "npf_impl.h" 55 56 /* 57 * If npf_ph_if != NULL, pfil hooks are registered. If NULL, not registered. 58 * Used to check the state. Locked by: softnet_lock + KERNEL_LOCK (XXX). 59 */ 60 static struct pfil_head * npf_ph_if = NULL; 61 static struct pfil_head * npf_ph_inet = NULL; 62 static struct pfil_head * npf_ph_inet6 = NULL; 63 64 #ifndef INET6 65 #define ip6_reass_packet(x, y) ENOTSUP 66 #endif 67 68 /* 69 * npf_ifhook: hook handling interface changes. 70 */ 71 static int 72 npf_ifhook(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 73 { 74 75 return 0; 76 } 77 78 static int 79 npf_reassembly(npf_cache_t *npc, nbuf_t *nbuf, struct mbuf **mp) 80 { 81 int error = EINVAL; 82 83 /* Reset the mbuf as it may have changed. */ 84 *mp = nbuf_head_mbuf(nbuf); 85 nbuf_reset(nbuf); 86 87 if (npf_iscached(npc, NPC_IP4)) { 88 struct ip *ip = nbuf_dataptr(nbuf); 89 error = ip_reass_packet(mp, ip); 90 } else if (npf_iscached(npc, NPC_IP6)) { 91 /* 92 * Note: ip6_reass_packet() offset is the start of 93 * the fragment header. 94 */ 95 error = ip6_reass_packet(mp, npc->npc_hlen); 96 if (error && *mp == NULL) { 97 memset(nbuf, 0, sizeof(nbuf_t)); 98 } 99 } 100 if (error) { 101 npf_stats_inc(NPF_STAT_REASSFAIL); 102 return error; 103 } 104 if (*mp == NULL) { 105 /* More fragments should come. */ 106 npf_stats_inc(NPF_STAT_FRAGMENTS); 107 return 0; 108 } 109 110 /* 111 * Reassembly is complete, we have the final packet. 112 * Cache again, since layer 4 data is accessible now. 113 */ 114 nbuf_init(nbuf, *mp, nbuf->nb_ifp); 115 npc->npc_info = 0; 116 117 if (npf_cache_all(npc, nbuf) & NPC_IPFRAG) { 118 return EINVAL; 119 } 120 npf_stats_inc(NPF_STAT_REASSEMBLY); 121 return 0; 122 } 123 124 /* 125 * npf_packet_handler: main packet handling routine for layer 3. 126 * 127 * Note: packet flow and inspection logic is in strict order. 128 */ 129 int 130 npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 131 { 132 nbuf_t nbuf; 133 npf_cache_t npc; 134 npf_session_t *se; 135 npf_rule_t *rl; 136 npf_rproc_t *rp; 137 int error, retfl; 138 int decision; 139 140 /* 141 * Initialise packet information cache. 142 * Note: it is enough to clear the info bits. 143 */ 144 KASSERT(ifp != NULL); 145 nbuf_init(&nbuf, *mp, ifp); 146 npc.npc_info = 0; 147 decision = NPF_DECISION_BLOCK; 148 error = 0; 149 retfl = 0; 150 rp = NULL; 151 152 /* Cache everything. Determine whether it is an IP fragment. */ 153 if (npf_cache_all(&npc, &nbuf) & NPC_IPFRAG) { 154 /* 155 * Pass to IPv4 or IPv6 reassembly mechanism. 156 */ 157 error = npf_reassembly(&npc, &nbuf, mp); 158 if (error) { 159 se = NULL; 160 goto out; 161 } 162 if (*mp == NULL) { 163 /* More fragments should come; return. */ 164 return 0; 165 } 166 } 167 168 /* Inspect the list of sessions (if found, acquires a reference). */ 169 se = npf_session_inspect(&npc, &nbuf, di, &error); 170 171 /* If "passing" session found - skip the ruleset inspection. */ 172 if (se && npf_session_pass(se, &rp)) { 173 npf_stats_inc(NPF_STAT_PASS_SESSION); 174 KASSERT(error == 0); 175 goto pass; 176 } 177 if (error) { 178 if (error == ENETUNREACH) 179 goto block; 180 goto out; 181 } 182 183 /* Acquire the lock, inspect the ruleset using this packet. */ 184 int slock = npf_config_read_enter(); 185 npf_ruleset_t *rlset = npf_config_ruleset(); 186 187 rl = npf_ruleset_inspect(&npc, &nbuf, rlset, di, NPF_LAYER_3); 188 if (rl == NULL) { 189 const bool pass = npf_default_pass(); 190 npf_config_read_exit(slock); 191 192 if (pass) { 193 npf_stats_inc(NPF_STAT_PASS_DEFAULT); 194 goto pass; 195 } 196 npf_stats_inc(NPF_STAT_BLOCK_DEFAULT); 197 goto block; 198 } 199 200 /* 201 * Get the rule procedure (acquires a reference) for association 202 * with a session (if any) and execution. 203 */ 204 KASSERT(rp == NULL); 205 rp = npf_rule_getrproc(rl); 206 207 /* Conclude with the rule and release the lock. */ 208 error = npf_rule_conclude(rl, &retfl); 209 npf_config_read_exit(slock); 210 211 if (error) { 212 npf_stats_inc(NPF_STAT_BLOCK_RULESET); 213 goto block; 214 } 215 npf_stats_inc(NPF_STAT_PASS_RULESET); 216 217 /* 218 * Establish a "pass" session, if required. Just proceed, 219 * if session creation fails (e.g. due to unsupported protocol). 220 */ 221 if ((retfl & NPF_RULE_STATEFUL) != 0 && !se) { 222 se = npf_session_establish(&npc, &nbuf, di); 223 if (se) { 224 /* 225 * Note: the reference on the rule procedure is 226 * transfered to the session. It will be released 227 * on session destruction. 228 */ 229 npf_session_setpass(se, rp); 230 } 231 } 232 pass: 233 decision = NPF_DECISION_PASS; 234 KASSERT(error == 0); 235 /* 236 * Perform NAT. 237 */ 238 error = npf_do_nat(&npc, se, &nbuf, di); 239 block: 240 /* 241 * Execute the rule procedure, if any is associated. 242 * It may reverse the decision from pass to block. 243 */ 244 if (rp) { 245 npf_rproc_run(&npc, &nbuf, rp, &decision); 246 } 247 out: 248 /* 249 * Release the reference on a session. Release the reference on a 250 * rule procedure only if there was no association. 251 */ 252 if (se) { 253 npf_session_release(se); 254 } else if (rp) { 255 npf_rproc_release(rp); 256 } 257 258 /* Reset mbuf pointer before returning to the caller. */ 259 if ((*mp = nbuf_head_mbuf(&nbuf)) == NULL) { 260 return error ? error : ENOMEM; 261 } 262 263 /* Pass the packet if decided and there is no error. */ 264 if (decision == NPF_DECISION_PASS && !error) { 265 /* 266 * XXX: Disable for now, it will be set accordingly later, 267 * for optimisations (to reduce inspection). 268 */ 269 (*mp)->m_flags &= ~M_CANFASTFWD; 270 return 0; 271 } 272 273 /* 274 * Block the packet. ENETUNREACH is used to indicate blocking. 275 * Depending on the flags and protocol, return TCP reset (RST) or 276 * ICMP destination unreachable. 277 */ 278 if (retfl && npf_return_block(&npc, &nbuf, retfl)) { 279 *mp = NULL; 280 } 281 282 if (!error) { 283 error = ENETUNREACH; 284 } 285 286 if (*mp) { 287 m_freem(*mp); 288 *mp = NULL; 289 } 290 return error; 291 } 292 293 /* 294 * npf_pfil_register: register pfil(9) hooks. 295 */ 296 int 297 npf_pfil_register(void) 298 { 299 int error; 300 301 mutex_enter(softnet_lock); 302 KERNEL_LOCK(1, NULL); 303 304 /* Check if pfil hooks are not already registered. */ 305 if (npf_ph_if) { 306 error = EEXIST; 307 goto fail; 308 } 309 310 /* Capture point of any activity in interfaces and IP layer. */ 311 npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0); 312 npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 313 npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 314 if (!npf_ph_if || (!npf_ph_inet && !npf_ph_inet6)) { 315 npf_ph_if = NULL; 316 error = ENOENT; 317 goto fail; 318 } 319 320 /* Interface re-config or attach/detach hook. */ 321 error = pfil_add_hook(npf_ifhook, NULL, 322 PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 323 KASSERT(error == 0); 324 325 /* Packet IN/OUT handler on all interfaces and IP layer. */ 326 if (npf_ph_inet) { 327 error = pfil_add_hook(npf_packet_handler, NULL, 328 PFIL_WAITOK | PFIL_ALL, npf_ph_inet); 329 KASSERT(error == 0); 330 } 331 if (npf_ph_inet6) { 332 error = pfil_add_hook(npf_packet_handler, NULL, 333 PFIL_WAITOK | PFIL_ALL, npf_ph_inet6); 334 KASSERT(error == 0); 335 } 336 fail: 337 KERNEL_UNLOCK_ONE(NULL); 338 mutex_exit(softnet_lock); 339 340 return error; 341 } 342 343 /* 344 * npf_pfil_unregister: unregister pfil(9) hooks. 345 */ 346 void 347 npf_pfil_unregister(void) 348 { 349 350 mutex_enter(softnet_lock); 351 KERNEL_LOCK(1, NULL); 352 353 if (npf_ph_if) { 354 (void)pfil_remove_hook(npf_ifhook, NULL, 355 PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 356 } 357 if (npf_ph_inet) { 358 (void)pfil_remove_hook(npf_packet_handler, NULL, 359 PFIL_ALL, npf_ph_inet); 360 } 361 if (npf_ph_inet6) { 362 (void)pfil_remove_hook(npf_packet_handler, NULL, 363 PFIL_ALL, npf_ph_inet6); 364 } 365 366 npf_ph_if = NULL; 367 368 KERNEL_UNLOCK_ONE(NULL); 369 mutex_exit(softnet_lock); 370 } 371 372 bool 373 npf_pfil_registered_p(void) 374 { 375 return npf_ph_if != NULL; 376 } 377