1 /* $NetBSD: npf_handler.c,v 1.23 2012/10/06 23:38:20 rmind Exp $ */ 2 3 /*- 4 * Copyright (c) 2009-2012 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This material is based upon work partially supported by The 8 * NetBSD Foundation under a contract with Mindaugas Rasiukevicius. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32 /* 33 * NPF packet handler. 34 */ 35 36 #include <sys/cdefs.h> 37 __KERNEL_RCSID(0, "$NetBSD: npf_handler.c,v 1.23 2012/10/06 23:38:20 rmind Exp $"); 38 39 #include <sys/types.h> 40 #include <sys/param.h> 41 42 #include <sys/mbuf.h> 43 #include <sys/mutex.h> 44 #include <net/if.h> 45 #include <net/pfil.h> 46 #include <sys/socketvar.h> 47 48 #include <netinet/in_systm.h> 49 #include <netinet/in.h> 50 #include <netinet/ip_var.h> 51 #include <netinet/ip6.h> 52 #include <netinet6/ip6_var.h> 53 54 #include "npf_impl.h" 55 56 /* 57 * If npf_ph_if != NULL, pfil hooks are registered. If NULL, not registered. 58 * Used to check the state. Locked by: softnet_lock + KERNEL_LOCK (XXX). 59 */ 60 static struct pfil_head * npf_ph_if = NULL; 61 static struct pfil_head * npf_ph_inet = NULL; 62 static struct pfil_head * npf_ph_inet6 = NULL; 63 64 /* 65 * npf_ifhook: hook handling interface changes. 66 */ 67 static int 68 npf_ifhook(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 69 { 70 71 return 0; 72 } 73 74 /* 75 * npf_packet_handler: main packet handling routine for layer 3. 76 * 77 * Note: packet flow and inspection logic is in strict order. 78 */ 79 int 80 npf_packet_handler(void *arg, struct mbuf **mp, ifnet_t *ifp, int di) 81 { 82 nbuf_t *nbuf = *mp; 83 npf_cache_t npc; 84 npf_session_t *se; 85 npf_ruleset_t *rlset; 86 npf_rule_t *rl; 87 npf_rproc_t *rp; 88 int error, retfl; 89 int decision; 90 91 /* 92 * Initialise packet information cache. 93 * Note: it is enough to clear the info bits. 94 */ 95 npc.npc_info = 0; 96 decision = NPF_DECISION_BLOCK; 97 error = 0; 98 retfl = 0; 99 rp = NULL; 100 101 /* Cache everything. Determine whether it is an IP fragment. */ 102 if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) { 103 /* 104 * Pass to IPv4 or IPv6 reassembly mechanism. 105 */ 106 error = EINVAL; 107 108 if (npf_iscached(&npc, NPC_IP4)) { 109 struct ip *ip = nbuf_dataptr(*mp); 110 error = ip_reass_packet(mp, ip); 111 } else if (npf_iscached(&npc, NPC_IP6)) { 112 #ifdef INET6 113 /* 114 * Note: ip6_reass_packet() offset is the start of 115 * the fragment header. 116 */ 117 const u_int hlen = npf_cache_hlen(&npc); 118 error = ip6_reass_packet(mp, hlen); 119 #endif 120 } 121 if (error) { 122 npf_stats_inc(NPF_STAT_REASSFAIL); 123 se = NULL; 124 goto out; 125 } 126 if (*mp == NULL) { 127 /* More fragments should come; return. */ 128 npf_stats_inc(NPF_STAT_FRAGMENTS); 129 return 0; 130 } 131 132 /* 133 * Reassembly is complete, we have the final packet. 134 * Cache again, since layer 4 data is accessible now. 135 */ 136 nbuf = (nbuf_t *)*mp; 137 npc.npc_info = 0; 138 139 if (npf_cache_all(&npc, nbuf) & NPC_IPFRAG) { 140 se = NULL; 141 goto out; 142 } 143 npf_stats_inc(NPF_STAT_REASSEMBLY); 144 } 145 146 /* Inspect the list of sessions. */ 147 se = npf_session_inspect(&npc, nbuf, ifp, di, &error); 148 149 /* If "passing" session found - skip the ruleset inspection. */ 150 if (se && npf_session_pass(se, &rp)) { 151 npf_stats_inc(NPF_STAT_PASS_SESSION); 152 KASSERT(error == 0); 153 goto pass; 154 } 155 if (error) { 156 goto block; 157 } 158 159 /* Acquire the lock, inspect the ruleset using this packet. */ 160 npf_core_enter(); 161 rlset = npf_core_ruleset(); 162 rl = npf_ruleset_inspect(&npc, nbuf, rlset, ifp, di, NPF_LAYER_3); 163 if (rl == NULL) { 164 bool default_pass = npf_default_pass(); 165 npf_core_exit(); 166 167 if (default_pass) { 168 npf_stats_inc(NPF_STAT_PASS_DEFAULT); 169 goto pass; 170 } 171 npf_stats_inc(NPF_STAT_BLOCK_DEFAULT); 172 goto block; 173 } 174 175 /* 176 * Get the rule procedure (acquires a reference) for assocation 177 * with a session (if any) and execution. 178 */ 179 KASSERT(rp == NULL); 180 rp = npf_rule_getrproc(rl); 181 182 /* Apply the rule, release the lock. */ 183 error = npf_rule_apply(&npc, nbuf, rl, &retfl); 184 if (error) { 185 npf_stats_inc(NPF_STAT_BLOCK_RULESET); 186 goto block; 187 } 188 npf_stats_inc(NPF_STAT_PASS_RULESET); 189 190 /* 191 * Establish a "pass" session, if required. Just proceed, if session 192 * creation fails (e.g. due to unsupported protocol). 193 * 194 * Note: the reference on the rule procedure is transfered to the 195 * session. It will be released on session destruction. 196 */ 197 if ((retfl & NPF_RULE_STATEFUL) != 0 && !se) { 198 se = npf_session_establish(&npc, nbuf, ifp, di); 199 if (se) { 200 npf_session_setpass(se, rp); 201 } 202 } 203 pass: 204 decision = NPF_DECISION_PASS; 205 KASSERT(error == 0); 206 /* 207 * Perform NAT. 208 */ 209 error = npf_do_nat(&npc, se, nbuf, ifp, di); 210 block: 211 /* 212 * Execute the rule procedure, if any is associated. 213 * It may reverse the decision from pass to block. 214 */ 215 if (rp) { 216 npf_rproc_run(&npc, nbuf, rp, &decision); 217 } 218 out: 219 /* 220 * Release the reference on a session. Release the reference on a 221 * rule procedure only if there was no association. 222 */ 223 if (se) { 224 npf_session_release(se); 225 } else if (rp) { 226 npf_rproc_release(rp); 227 } 228 229 /* Pass the packet if decided and there is no error. */ 230 if (decision == NPF_DECISION_PASS && !error) { 231 /* 232 * XXX: Disable for now, it will be set accordingly later, 233 * for optimisations (to reduce inspection). 234 */ 235 (*mp)->m_flags &= ~M_CANFASTFWD; 236 return 0; 237 } 238 239 /* 240 * Block the packet. ENETUNREACH is used to indicate blocking. 241 * Depending on the flags and protocol, return TCP reset (RST) or 242 * ICMP destination unreachable. 243 */ 244 if (retfl && npf_return_block(&npc, nbuf, retfl)) { 245 *mp = NULL; 246 } 247 248 if (!error) { 249 error = ENETUNREACH; 250 } 251 252 if (*mp) { 253 m_freem(*mp); 254 *mp = NULL; 255 } 256 return error; 257 } 258 259 /* 260 * npf_pfil_register: register pfil(9) hooks. 261 */ 262 int 263 npf_pfil_register(void) 264 { 265 int error; 266 267 mutex_enter(softnet_lock); 268 KERNEL_LOCK(1, NULL); 269 270 /* Check if pfil hooks are not already registered. */ 271 if (npf_ph_if) { 272 error = EEXIST; 273 goto fail; 274 } 275 276 /* Capture point of any activity in interfaces and IP layer. */ 277 npf_ph_if = pfil_head_get(PFIL_TYPE_IFNET, 0); 278 npf_ph_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET); 279 npf_ph_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6); 280 if (!npf_ph_if || (!npf_ph_inet && !npf_ph_inet6)) { 281 npf_ph_if = NULL; 282 error = ENOENT; 283 goto fail; 284 } 285 286 /* Interface re-config or attach/detach hook. */ 287 error = pfil_add_hook(npf_ifhook, NULL, 288 PFIL_WAITOK | PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 289 KASSERT(error == 0); 290 291 /* Packet IN/OUT handler on all interfaces and IP layer. */ 292 if (npf_ph_inet) { 293 error = pfil_add_hook(npf_packet_handler, NULL, 294 PFIL_WAITOK | PFIL_ALL, npf_ph_inet); 295 KASSERT(error == 0); 296 } 297 if (npf_ph_inet6) { 298 error = pfil_add_hook(npf_packet_handler, NULL, 299 PFIL_WAITOK | PFIL_ALL, npf_ph_inet6); 300 KASSERT(error == 0); 301 } 302 fail: 303 KERNEL_UNLOCK_ONE(NULL); 304 mutex_exit(softnet_lock); 305 306 return error; 307 } 308 309 /* 310 * npf_pfil_unregister: unregister pfil(9) hooks. 311 */ 312 void 313 npf_pfil_unregister(void) 314 { 315 316 mutex_enter(softnet_lock); 317 KERNEL_LOCK(1, NULL); 318 319 if (npf_ph_if) { 320 (void)pfil_remove_hook(npf_ifhook, NULL, 321 PFIL_IFADDR | PFIL_IFNET, npf_ph_if); 322 } 323 if (npf_ph_inet) { 324 (void)pfil_remove_hook(npf_packet_handler, NULL, 325 PFIL_ALL, npf_ph_inet); 326 } 327 if (npf_ph_inet6) { 328 (void)pfil_remove_hook(npf_packet_handler, NULL, 329 PFIL_ALL, npf_ph_inet6); 330 } 331 332 npf_ph_if = NULL; 333 334 KERNEL_UNLOCK_ONE(NULL); 335 mutex_exit(softnet_lock); 336 } 337 338 bool 339 npf_pfil_registered_p(void) 340 { 341 return npf_ph_if != NULL; 342 } 343