1 /* $NetBSD: npf_handler.c,v 1.12 2012/01/15 00:49:48 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2010 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF packet handler. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.12 2012/01/15 00:49:48 rmind Exp $"); 38 39 #include <sys/param.h> 40 #include <sys/systm.h> 41 42 #include <sys/mbuf.h> 43 #include <sys/mutex.h> 44 #include <net/if.h> 45 #include <net/pfil.h> 46 #include <sys/socketvar.h> 47 48 #include <netinet/in_systm.h> 49 #include <netinet/in.h> 50 #include <netinet/ip_var.h> 51 #include <netinet/ip6.h> 52 #include <netinet6/ip6_var.h> 53 54 #include "npf_impl.h" 55 56 /* 57 * If npf_ph_if != NULL, pfil hooks are registers. If NULL, not registered. 58 * Used to check the state. Locked by: softnet_lock + KERNEL_LOCK (XXX). 59 */ 60 static struct pfil_head * npf_ph_if = NULL; 61 static struct pfil_head * npf_ph_inet = NULL; 62 static struct pfil_head * npf_ph_inet6 = NULL; 63 64 static bool default_pass = true; 65 66 int npf_packet_handler(void *, struct mbuf **, ifnet_t *, int); 67 68 /* 69 * npf_ifhook: hook handling interface changes. 70 */ 71 static int 72 npf_ifhook(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 73 { 74 75 return 0; 76 } 77 78 /* 79 * npf_packet_handler: main packet handling routine for layer 3. 80 * 81 * Note: packet flow and inspection logic is in strict order. 82 */ 83 int 84 npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 85 { 86 nbuf_t *nbuf = *mp; 87 npf_cache_t npc; 88 npf_session_t *se; 89 npf_ruleset_t *rlset; 90 npf_rule_t *rl; 91 npf_rproc_t *rp; 92 int retfl, error, ret; 93 94 /* 95 * Initialise packet information cache. 96 * Note: it is enough to clear the info bits. 97 */ 98 npc.npc_info = 0; 99 error = 0; 100 retfl = 0; 101 rp = NULL; 102 ret = 0; 103 104 /* Cache everything. Determine whether it is an IP fragment. */ 105 if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) { 106 /* Pass to IPv4 or IPv6 reassembly mechanism. */ 107 if (npf_iscached(&npc, NPC_IP4)) { 108 struct ip *ip = nbuf_dataptr(*mp); 109 ret = ip_reass_packet(mp, ip); 110 } else { 111 KASSERT(npf_iscached(&npc, NPC_IP6)); 112 #ifdef INET6 113 /* 114 * Note: frag6_input() offset is the start of the 115 * fragment header. 116 */ 117 const u_int hlen = npf_cache_hlen(&npc); 118 ret = ip6_reass_packet(mp, hlen); 119 #else 120 ret = -1; 121 #endif 122 } 123 124 if (ret) { 125 error = EINVAL; 126 se = NULL; 127 goto out; 128 } 129 if (*mp == NULL) { 130 /* More fragments should come; return. */ 131 return 0; 132 } 133 134 /* 135 * Reassembly is complete, we have the final packet. 136 * Cache again, since layer 4 data is accessible now. 137 */ 138 nbuf = (nbuf_t *)*mp; 139 npc.npc_info = 0; 140 (void)npf_cache_all(&npc, nbuf); 141 } 142 143 /* Inspect the list of sessions. */ 144 se = npf_session_inspect(&npc, nbuf, di, &error); 145 146 /* If "passing" session found - skip the ruleset inspection. */ 147 if (se && npf_session_pass(se, &rp)) { 148 npf_stats_inc(NPF_STAT_PASS_SESSION); 149 goto pass; 150 } else if (error) { 151 goto block; 152 } 153 154 /* Acquire the lock, inspect the ruleset using this packet. */ 155 npf_core_enter(); 156 rlset = npf_core_ruleset(); 157 rl = npf_ruleset_inspect(&npc, nbuf, rlset, ifp, di, NPF_LAYER_3); 158 if (rl == NULL) { 159 npf_core_exit(); 160 if (default_pass) { 161 npf_stats_inc(NPF_STAT_PASS_DEFAULT); 162 goto pass; 163 } 164 npf_stats_inc(NPF_STAT_BLOCK_DEFAULT); 165 error = ENETUNREACH; 166 goto block; 167 } 168 169 /* Get rule procedure for assocation and/or execution. */ 170 KASSERT(rp == NULL); 171 rp = npf_rproc_return(rl); 172 173 /* Apply the rule, release the lock. */ 174 error = npf_rule_apply(&npc, nbuf, rl, &retfl); 175 if (error) { 176 npf_stats_inc(NPF_STAT_BLOCK_RULESET); 177 goto block; 178 } 179 npf_stats_inc(NPF_STAT_PASS_RULESET); 180 181 /* Establish a "pass" session, if required. */ 182 if ((retfl & NPF_RULE_KEEPSTATE) != 0 && !se) { 183 se = npf_session_establish(&npc, nbuf, di); 184 if (se == NULL) { 185 error = ENOMEM; 186 goto out; 187 } 188 npf_session_setpass(se, rp); 189 } 190 pass: 191 KASSERT(error == 0); 192 /* 193 * Perform NAT. 194 */ 195 error = npf_do_nat(&npc, se, nbuf, ifp, di); 196 block: 197 /* 198 * Perform rule procedure, if any. 199 */ 200 if (rp) { 201 npf_rproc_run(&npc, nbuf, rp, error); 202 } 203 out: 204 /* Release the reference on session, or rule procedure. */ 205 if (se) { 206 npf_session_release(se); 207 } else if (rp) { 208 npf_rproc_release(rp); /* XXXkmem */ 209 } 210 211 /* 212 * If error is set - drop the packet. 213 * Normally, ENETUNREACH is used for "block". 214 */ 215 if (error) { 216 /* 217 * Depending on flags and protocol, return TCP reset (RST) 218 * or ICMP destination unreachable 219 */ 220 if (retfl) { 221 npf_return_block(&npc, nbuf, retfl); 222 } 223 if (error != ENETUNREACH) { 224 NPF_PRINTF(("NPF: error in handler '%d'\n", error)); 225 npf_stats_inc(NPF_STAT_ERROR); 226 } 227 m_freem(*mp); 228 *mp = NULL; 229 } else { 230 /* 231 * XXX: Disable for now, it will be set accordingly later, 232 * for optimisations (to reduce inspection). 233 */ 234 (*mp)->m_flags &= ~M_CANFASTFWD; 235 } 236 return error; 237 } 238 239 /* 240 * npf_register_pfil: register pfil(9) hooks. 241 */ 242 int 243 npf_register_pfil(void) 244 { 245 int error; 246 247 mutex_enter(softnet_lock); 248 KERNEL_LOCK(1, NULL); 249 250 /* Check if pfil hooks are not already registered. */ 251 if (npf_ph_if) { 252 error = EEXIST; 253 goto fail; 254 } 255 256 /* Capture point of any activity in interfaces and IP layer. */ 257 npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0); 258 npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 259 npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 260 if (npf_ph_if == NULL || npf_ph_inet == NULL) { 261 npf_ph_if = NULL; 262 error = ENOENT; 263 goto fail; 264 } 265 266 /* Interface re-config or attach/detach hook. */ 267 error = pfil_add_hook(npf_ifhook, NULL, 268 PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 269 KASSERT(error == 0); 270 271 /* Packet IN/OUT handler on all interfaces and IP layer. */ 272 error = pfil_add_hook(npf_packet_handler, NULL, 273 PFIL_WAITOK | PFIL_ALL, npf_ph_inet); 274 KASSERT(error == 0); 275 276 error = pfil_add_hook(npf_packet_handler, NULL, 277 PFIL_WAITOK | PFIL_ALL, npf_ph_inet6); 278 KASSERT(error == 0); 279 fail: 280 KERNEL_UNLOCK_ONE(NULL); 281 mutex_exit(softnet_lock); 282 283 return error; 284 } 285 286 /* 287 * npf_unregister: unregister pfil(9) hooks. 288 */ 289 void 290 npf_unregister_pfil(void) 291 { 292 293 mutex_enter(softnet_lock); 294 KERNEL_LOCK(1, NULL); 295 296 if (npf_ph_if) { 297 (void)pfil_remove_hook(npf_packet_handler, NULL, 298 PFIL_ALL, npf_ph_inet6); 299 (void)pfil_remove_hook(npf_packet_handler, NULL, 300 PFIL_ALL, npf_ph_inet); 301 (void)pfil_remove_hook(npf_ifhook, NULL, 302 PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 303 304 npf_ph_if = NULL; 305 } 306 307 KERNEL_UNLOCK_ONE(NULL); 308 mutex_exit(softnet_lock); 309 } 310