1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate /* 30*0Sstevel@tonic-gate * STREAMS Packet Filter Module 31*0Sstevel@tonic-gate * 32*0Sstevel@tonic-gate * This module applies a filter to messages arriving on its read 33*0Sstevel@tonic-gate * queue, passing on messages that the filter accepts adn discarding 34*0Sstevel@tonic-gate * the others. It supports ioctls for setting the filter. 35*0Sstevel@tonic-gate * 36*0Sstevel@tonic-gate * On the write side, the module simply passes everything through 37*0Sstevel@tonic-gate * unchanged. 38*0Sstevel@tonic-gate * 39*0Sstevel@tonic-gate * Based on SunOS 4.x version. This version has minor changes: 40*0Sstevel@tonic-gate * - general SVR4 porting stuff 41*0Sstevel@tonic-gate * - change name and prefixes from "nit" buffer to streams buffer 42*0Sstevel@tonic-gate * - multithreading assumes configured as D_MTQPAIR 43*0Sstevel@tonic-gate */ 44*0Sstevel@tonic-gate 45*0Sstevel@tonic-gate #include <sys/types.h> 46*0Sstevel@tonic-gate #include <sys/sysmacros.h> 47*0Sstevel@tonic-gate #include <sys/errno.h> 48*0Sstevel@tonic-gate #include <sys/debug.h> 49*0Sstevel@tonic-gate #include <sys/time.h> 50*0Sstevel@tonic-gate #include <sys/stropts.h> 51*0Sstevel@tonic-gate #include <sys/stream.h> 52*0Sstevel@tonic-gate #include <sys/conf.h> 53*0Sstevel@tonic-gate #include <sys/ddi.h> 54*0Sstevel@tonic-gate #include <sys/sunddi.h> 55*0Sstevel@tonic-gate #include <sys/kmem.h> 56*0Sstevel@tonic-gate #include <sys/strsun.h> 57*0Sstevel@tonic-gate #include <sys/pfmod.h> 58*0Sstevel@tonic-gate #include <sys/modctl.h> 59*0Sstevel@tonic-gate 60*0Sstevel@tonic-gate /* 61*0Sstevel@tonic-gate * Expanded version of the Packetfilt structure that includes 62*0Sstevel@tonic-gate * some additional fields that aid filter execution efficiency. 63*0Sstevel@tonic-gate */ 64*0Sstevel@tonic-gate struct epacketfilt { 65*0Sstevel@tonic-gate struct Pf_ext_packetfilt pf; 66*0Sstevel@tonic-gate #define pf_Priority pf.Pf_Priority 67*0Sstevel@tonic-gate #define pf_FilterLen pf.Pf_FilterLen 68*0Sstevel@tonic-gate #define pf_Filter pf.Pf_Filter 69*0Sstevel@tonic-gate /* pointer to word immediately past end of filter */ 70*0Sstevel@tonic-gate ushort_t *pf_FilterEnd; 71*0Sstevel@tonic-gate /* length in bytes of packet prefix the filter examines */ 72*0Sstevel@tonic-gate ushort_t pf_PByteLen; 73*0Sstevel@tonic-gate }; 74*0Sstevel@tonic-gate 75*0Sstevel@tonic-gate /* 76*0Sstevel@tonic-gate * (Internal) packet descriptor for FilterPacket 77*0Sstevel@tonic-gate */ 78*0Sstevel@tonic-gate struct packdesc { 79*0Sstevel@tonic-gate ushort_t *pd_hdr; /* header starting address */ 80*0Sstevel@tonic-gate uint_t pd_hdrlen; /* header length in shorts */ 81*0Sstevel@tonic-gate ushort_t *pd_body; /* body starting address */ 82*0Sstevel@tonic-gate uint_t pd_bodylen; /* body length in shorts */ 83*0Sstevel@tonic-gate }; 84*0Sstevel@tonic-gate 85*0Sstevel@tonic-gate 86*0Sstevel@tonic-gate /* 87*0Sstevel@tonic-gate * Function prototypes. 88*0Sstevel@tonic-gate */ 89*0Sstevel@tonic-gate static int pfopen(queue_t *, dev_t *, int, int, cred_t *); 90*0Sstevel@tonic-gate static int pfclose(queue_t *); 91*0Sstevel@tonic-gate static void pfioctl(queue_t *wq, mblk_t *mp); 92*0Sstevel@tonic-gate static int FilterPacket(struct packdesc *, struct epacketfilt *); 93*0Sstevel@tonic-gate /* 94*0Sstevel@tonic-gate * To save instructions, since STREAMS ignores the return value 95*0Sstevel@tonic-gate * from these functions, they are defined as void here. Kind of icky, but... 96*0Sstevel@tonic-gate */ 97*0Sstevel@tonic-gate static void pfwput(queue_t *, mblk_t *); 98*0Sstevel@tonic-gate static void pfrput(queue_t *, mblk_t *); 99*0Sstevel@tonic-gate 100*0Sstevel@tonic-gate static struct module_info pf_minfo = { 101*0Sstevel@tonic-gate 22, /* mi_idnum */ 102*0Sstevel@tonic-gate "pfmod", /* mi_idname */ 103*0Sstevel@tonic-gate 0, /* mi_minpsz */ 104*0Sstevel@tonic-gate INFPSZ, /* mi_maxpsz */ 105*0Sstevel@tonic-gate 0, /* mi_hiwat */ 106*0Sstevel@tonic-gate 0 /* mi_lowat */ 107*0Sstevel@tonic-gate }; 108*0Sstevel@tonic-gate 109*0Sstevel@tonic-gate static struct qinit pf_rinit = { 110*0Sstevel@tonic-gate (int (*)())pfrput, /* qi_putp */ 111*0Sstevel@tonic-gate NULL, 112*0Sstevel@tonic-gate pfopen, /* qi_qopen */ 113*0Sstevel@tonic-gate pfclose, /* qi_qclose */ 114*0Sstevel@tonic-gate NULL, /* qi_qadmin */ 115*0Sstevel@tonic-gate &pf_minfo, /* qi_minfo */ 116*0Sstevel@tonic-gate NULL /* qi_mstat */ 117*0Sstevel@tonic-gate }; 118*0Sstevel@tonic-gate 119*0Sstevel@tonic-gate static struct qinit pf_winit = { 120*0Sstevel@tonic-gate (int (*)())pfwput, /* qi_putp */ 121*0Sstevel@tonic-gate NULL, /* qi_srvp */ 122*0Sstevel@tonic-gate NULL, /* qi_qopen */ 123*0Sstevel@tonic-gate NULL, /* qi_qclose */ 124*0Sstevel@tonic-gate NULL, /* qi_qadmin */ 125*0Sstevel@tonic-gate &pf_minfo, /* qi_minfo */ 126*0Sstevel@tonic-gate NULL /* qi_mstat */ 127*0Sstevel@tonic-gate }; 128*0Sstevel@tonic-gate 129*0Sstevel@tonic-gate static struct streamtab pf_info = { 130*0Sstevel@tonic-gate &pf_rinit, /* st_rdinit */ 131*0Sstevel@tonic-gate &pf_winit, /* st_wrinit */ 132*0Sstevel@tonic-gate NULL, /* st_muxrinit */ 133*0Sstevel@tonic-gate NULL /* st_muxwinit */ 134*0Sstevel@tonic-gate }; 135*0Sstevel@tonic-gate 136*0Sstevel@tonic-gate static struct fmodsw fsw = { 137*0Sstevel@tonic-gate "pfmod", 138*0Sstevel@tonic-gate &pf_info, 139*0Sstevel@tonic-gate D_MTQPAIR | D_MP 140*0Sstevel@tonic-gate }; 141*0Sstevel@tonic-gate 142*0Sstevel@tonic-gate static struct modlstrmod modlstrmod = { 143*0Sstevel@tonic-gate &mod_strmodops, "streams packet filter module", &fsw 144*0Sstevel@tonic-gate }; 145*0Sstevel@tonic-gate 146*0Sstevel@tonic-gate static struct modlinkage modlinkage = { 147*0Sstevel@tonic-gate MODREV_1, &modlstrmod, NULL 148*0Sstevel@tonic-gate }; 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate int 151*0Sstevel@tonic-gate _init(void) 152*0Sstevel@tonic-gate { 153*0Sstevel@tonic-gate return (mod_install(&modlinkage)); 154*0Sstevel@tonic-gate } 155*0Sstevel@tonic-gate 156*0Sstevel@tonic-gate int 157*0Sstevel@tonic-gate _fini(void) 158*0Sstevel@tonic-gate { 159*0Sstevel@tonic-gate return (mod_remove(&modlinkage)); 160*0Sstevel@tonic-gate } 161*0Sstevel@tonic-gate 162*0Sstevel@tonic-gate int 163*0Sstevel@tonic-gate _info(struct modinfo *modinfop) 164*0Sstevel@tonic-gate { 165*0Sstevel@tonic-gate return (mod_info(&modlinkage, modinfop)); 166*0Sstevel@tonic-gate } 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate /*ARGSUSED*/ 169*0Sstevel@tonic-gate static int 170*0Sstevel@tonic-gate pfopen(queue_t *rq, dev_t *dev, int oflag, int sflag, cred_t *crp) 171*0Sstevel@tonic-gate { 172*0Sstevel@tonic-gate struct epacketfilt *pfp; 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate ASSERT(rq); 175*0Sstevel@tonic-gate 176*0Sstevel@tonic-gate if (sflag != MODOPEN) 177*0Sstevel@tonic-gate return (EINVAL); 178*0Sstevel@tonic-gate 179*0Sstevel@tonic-gate if (rq->q_ptr) 180*0Sstevel@tonic-gate return (0); 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate /* 183*0Sstevel@tonic-gate * Allocate and initialize per-Stream structure. 184*0Sstevel@tonic-gate */ 185*0Sstevel@tonic-gate pfp = kmem_alloc(sizeof (struct epacketfilt), KM_SLEEP); 186*0Sstevel@tonic-gate rq->q_ptr = WR(rq)->q_ptr = (char *)pfp; 187*0Sstevel@tonic-gate 188*0Sstevel@tonic-gate qprocson(rq); 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate return (0); 191*0Sstevel@tonic-gate } 192*0Sstevel@tonic-gate 193*0Sstevel@tonic-gate static int 194*0Sstevel@tonic-gate pfclose(queue_t *rq) 195*0Sstevel@tonic-gate { 196*0Sstevel@tonic-gate struct epacketfilt *pfp = (struct epacketfilt *)rq->q_ptr; 197*0Sstevel@tonic-gate 198*0Sstevel@tonic-gate ASSERT(pfp); 199*0Sstevel@tonic-gate 200*0Sstevel@tonic-gate qprocsoff(rq); 201*0Sstevel@tonic-gate 202*0Sstevel@tonic-gate kmem_free(pfp, sizeof (struct epacketfilt)); 203*0Sstevel@tonic-gate rq->q_ptr = WR(rq)->q_ptr = NULL; 204*0Sstevel@tonic-gate 205*0Sstevel@tonic-gate return (0); 206*0Sstevel@tonic-gate } 207*0Sstevel@tonic-gate 208*0Sstevel@tonic-gate /* 209*0Sstevel@tonic-gate * Write-side put procedure. Its main task is to detect ioctls. 210*0Sstevel@tonic-gate * Other message types are passed on through. 211*0Sstevel@tonic-gate */ 212*0Sstevel@tonic-gate static void 213*0Sstevel@tonic-gate pfwput(queue_t *wq, mblk_t *mp) 214*0Sstevel@tonic-gate { 215*0Sstevel@tonic-gate switch (mp->b_datap->db_type) { 216*0Sstevel@tonic-gate case M_IOCTL: 217*0Sstevel@tonic-gate pfioctl(wq, mp); 218*0Sstevel@tonic-gate break; 219*0Sstevel@tonic-gate 220*0Sstevel@tonic-gate default: 221*0Sstevel@tonic-gate putnext(wq, mp); 222*0Sstevel@tonic-gate break; 223*0Sstevel@tonic-gate } 224*0Sstevel@tonic-gate } 225*0Sstevel@tonic-gate 226*0Sstevel@tonic-gate /* 227*0Sstevel@tonic-gate * Read-side put procedure. It's responsible for applying the 228*0Sstevel@tonic-gate * packet filter and passing upstream message on or discarding it 229*0Sstevel@tonic-gate * depending upon the results. 230*0Sstevel@tonic-gate * 231*0Sstevel@tonic-gate * Upstream messages can start with zero or more M_PROTO mblks 232*0Sstevel@tonic-gate * which are skipped over before executing the packet filter 233*0Sstevel@tonic-gate * on any remaining M_DATA mblks. 234*0Sstevel@tonic-gate */ 235*0Sstevel@tonic-gate static void 236*0Sstevel@tonic-gate pfrput(queue_t *rq, mblk_t *mp) 237*0Sstevel@tonic-gate { 238*0Sstevel@tonic-gate struct epacketfilt *pfp = (struct epacketfilt *)rq->q_ptr; 239*0Sstevel@tonic-gate mblk_t *mbp, *mpp; 240*0Sstevel@tonic-gate struct packdesc pd; 241*0Sstevel@tonic-gate int need; 242*0Sstevel@tonic-gate 243*0Sstevel@tonic-gate ASSERT(pfp); 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate switch (DB_TYPE(mp)) { 246*0Sstevel@tonic-gate case M_PROTO: 247*0Sstevel@tonic-gate case M_DATA: 248*0Sstevel@tonic-gate /* 249*0Sstevel@tonic-gate * Skip over protocol information and find the start 250*0Sstevel@tonic-gate * of the message body, saving the overall message 251*0Sstevel@tonic-gate * start in mpp. 252*0Sstevel@tonic-gate */ 253*0Sstevel@tonic-gate for (mpp = mp; mp && (DB_TYPE(mp) == M_PROTO); mp = mp->b_cont) 254*0Sstevel@tonic-gate ; 255*0Sstevel@tonic-gate 256*0Sstevel@tonic-gate /* 257*0Sstevel@tonic-gate * Null body (exclusive of M_PROTO blocks) ==> accept. 258*0Sstevel@tonic-gate * Note that a null body is not the same as an empty body. 259*0Sstevel@tonic-gate */ 260*0Sstevel@tonic-gate if (mp == NULL) { 261*0Sstevel@tonic-gate putnext(rq, mpp); 262*0Sstevel@tonic-gate break; 263*0Sstevel@tonic-gate } 264*0Sstevel@tonic-gate 265*0Sstevel@tonic-gate /* 266*0Sstevel@tonic-gate * Pull the packet up to the length required by 267*0Sstevel@tonic-gate * the filter. Note that doing so destroys sharing 268*0Sstevel@tonic-gate * relationships, which is unfortunate, since the 269*0Sstevel@tonic-gate * results of pulling up here are likely to be useful 270*0Sstevel@tonic-gate * for shared messages applied to a filter on a sibling 271*0Sstevel@tonic-gate * stream. 272*0Sstevel@tonic-gate * 273*0Sstevel@tonic-gate * Most packet sources will provide the packet in two 274*0Sstevel@tonic-gate * logical pieces: an initial header in a single mblk, 275*0Sstevel@tonic-gate * and a body in a sequence of mblks hooked to the 276*0Sstevel@tonic-gate * header. We're prepared to deal with variant forms, 277*0Sstevel@tonic-gate * but in any case, the pullup applies only to the body 278*0Sstevel@tonic-gate * part. 279*0Sstevel@tonic-gate */ 280*0Sstevel@tonic-gate mbp = mp->b_cont; 281*0Sstevel@tonic-gate need = pfp->pf_PByteLen; 282*0Sstevel@tonic-gate if (mbp && (MBLKL(mbp) < need)) { 283*0Sstevel@tonic-gate int len = msgdsize(mbp); 284*0Sstevel@tonic-gate 285*0Sstevel@tonic-gate /* XXX discard silently on pullupmsg failure */ 286*0Sstevel@tonic-gate if (pullupmsg(mbp, MIN(need, len)) == 0) { 287*0Sstevel@tonic-gate freemsg(mpp); 288*0Sstevel@tonic-gate break; 289*0Sstevel@tonic-gate } 290*0Sstevel@tonic-gate } 291*0Sstevel@tonic-gate 292*0Sstevel@tonic-gate /* 293*0Sstevel@tonic-gate * Misalignment (not on short boundary) ==> reject. 294*0Sstevel@tonic-gate */ 295*0Sstevel@tonic-gate if (((uintptr_t)mp->b_rptr & (sizeof (ushort_t) - 1)) || 296*0Sstevel@tonic-gate (mbp != NULL && 297*0Sstevel@tonic-gate ((uintptr_t)mbp->b_rptr & (sizeof (ushort_t) - 1)))) { 298*0Sstevel@tonic-gate freemsg(mpp); 299*0Sstevel@tonic-gate break; 300*0Sstevel@tonic-gate } 301*0Sstevel@tonic-gate 302*0Sstevel@tonic-gate /* 303*0Sstevel@tonic-gate * These assignments are distasteful, but necessary, 304*0Sstevel@tonic-gate * since the packet filter wants to work in terms of 305*0Sstevel@tonic-gate * shorts. Odd bytes at the end of header or data can't 306*0Sstevel@tonic-gate * participate in the filtering operation. 307*0Sstevel@tonic-gate */ 308*0Sstevel@tonic-gate pd.pd_hdr = (ushort_t *)mp->b_rptr; 309*0Sstevel@tonic-gate pd.pd_hdrlen = (mp->b_wptr - mp->b_rptr) / sizeof (ushort_t); 310*0Sstevel@tonic-gate if (mbp) { 311*0Sstevel@tonic-gate pd.pd_body = (ushort_t *)mbp->b_rptr; 312*0Sstevel@tonic-gate pd.pd_bodylen = (mbp->b_wptr - mbp->b_rptr) / 313*0Sstevel@tonic-gate sizeof (ushort_t); 314*0Sstevel@tonic-gate } else { 315*0Sstevel@tonic-gate pd.pd_body = NULL; 316*0Sstevel@tonic-gate pd.pd_bodylen = 0; 317*0Sstevel@tonic-gate } 318*0Sstevel@tonic-gate 319*0Sstevel@tonic-gate /* 320*0Sstevel@tonic-gate * Apply the filter. 321*0Sstevel@tonic-gate */ 322*0Sstevel@tonic-gate if (FilterPacket(&pd, pfp)) 323*0Sstevel@tonic-gate putnext(rq, mpp); 324*0Sstevel@tonic-gate else 325*0Sstevel@tonic-gate freemsg(mpp); 326*0Sstevel@tonic-gate 327*0Sstevel@tonic-gate break; 328*0Sstevel@tonic-gate 329*0Sstevel@tonic-gate default: 330*0Sstevel@tonic-gate putnext(rq, mp); 331*0Sstevel@tonic-gate break; 332*0Sstevel@tonic-gate } 333*0Sstevel@tonic-gate 334*0Sstevel@tonic-gate } 335*0Sstevel@tonic-gate 336*0Sstevel@tonic-gate /* 337*0Sstevel@tonic-gate * Handle write-side M_IOCTL messages. 338*0Sstevel@tonic-gate */ 339*0Sstevel@tonic-gate static void 340*0Sstevel@tonic-gate pfioctl(queue_t *wq, mblk_t *mp) 341*0Sstevel@tonic-gate { 342*0Sstevel@tonic-gate struct epacketfilt *pfp = (struct epacketfilt *)wq->q_ptr; 343*0Sstevel@tonic-gate struct Pf_ext_packetfilt *upfp; 344*0Sstevel@tonic-gate struct packetfilt *opfp; 345*0Sstevel@tonic-gate ushort_t *fwp; 346*0Sstevel@tonic-gate int maxoff, arg; 347*0Sstevel@tonic-gate struct iocblk *iocp = (struct iocblk *)mp->b_rptr; 348*0Sstevel@tonic-gate int error; 349*0Sstevel@tonic-gate 350*0Sstevel@tonic-gate switch (iocp->ioc_cmd) { 351*0Sstevel@tonic-gate case PFIOCSETF: 352*0Sstevel@tonic-gate /* 353*0Sstevel@tonic-gate * Verify argument length. Since the size of packet filter 354*0Sstevel@tonic-gate * got increased (ENMAXFILTERS was bumped up to 2047), to 355*0Sstevel@tonic-gate * maintain backwards binary compatibility, we need to 356*0Sstevel@tonic-gate * check for both possible sizes. 357*0Sstevel@tonic-gate */ 358*0Sstevel@tonic-gate switch (iocp->ioc_count) { 359*0Sstevel@tonic-gate case sizeof (struct Pf_ext_packetfilt): 360*0Sstevel@tonic-gate error = miocpullup(mp, 361*0Sstevel@tonic-gate sizeof (struct Pf_ext_packetfilt)); 362*0Sstevel@tonic-gate if (error != 0) { 363*0Sstevel@tonic-gate miocnak(wq, mp, 0, error); 364*0Sstevel@tonic-gate return; 365*0Sstevel@tonic-gate } 366*0Sstevel@tonic-gate upfp = (struct Pf_ext_packetfilt *)mp->b_cont->b_rptr; 367*0Sstevel@tonic-gate if (upfp->Pf_FilterLen > PF_MAXFILTERS) { 368*0Sstevel@tonic-gate miocnak(wq, mp, 0, EINVAL); 369*0Sstevel@tonic-gate return; 370*0Sstevel@tonic-gate } 371*0Sstevel@tonic-gate 372*0Sstevel@tonic-gate bcopy(upfp, pfp, sizeof (struct Pf_ext_packetfilt)); 373*0Sstevel@tonic-gate pfp->pf_FilterEnd = &pfp->pf_Filter[pfp->pf_FilterLen]; 374*0Sstevel@tonic-gate break; 375*0Sstevel@tonic-gate 376*0Sstevel@tonic-gate case sizeof (struct packetfilt): 377*0Sstevel@tonic-gate error = miocpullup(mp, sizeof (struct packetfilt)); 378*0Sstevel@tonic-gate if (error != 0) { 379*0Sstevel@tonic-gate miocnak(wq, mp, 0, error); 380*0Sstevel@tonic-gate return; 381*0Sstevel@tonic-gate } 382*0Sstevel@tonic-gate opfp = (struct packetfilt *)mp->b_cont->b_rptr; 383*0Sstevel@tonic-gate /* this strange comparison keeps gcc from complaining */ 384*0Sstevel@tonic-gate if (opfp->Pf_FilterLen - 1 >= ENMAXFILTERS) { 385*0Sstevel@tonic-gate miocnak(wq, mp, 0, EINVAL); 386*0Sstevel@tonic-gate return; 387*0Sstevel@tonic-gate } 388*0Sstevel@tonic-gate 389*0Sstevel@tonic-gate pfp->pf.Pf_Priority = opfp->Pf_Priority; 390*0Sstevel@tonic-gate pfp->pf.Pf_FilterLen = (unsigned int)opfp->Pf_FilterLen; 391*0Sstevel@tonic-gate 392*0Sstevel@tonic-gate bcopy(opfp->Pf_Filter, pfp->pf.Pf_Filter, 393*0Sstevel@tonic-gate sizeof (opfp->Pf_Filter)); 394*0Sstevel@tonic-gate pfp->pf_FilterEnd = &pfp->pf_Filter[pfp->pf_FilterLen]; 395*0Sstevel@tonic-gate break; 396*0Sstevel@tonic-gate 397*0Sstevel@tonic-gate default: 398*0Sstevel@tonic-gate miocnak(wq, mp, 0, EINVAL); 399*0Sstevel@tonic-gate return; 400*0Sstevel@tonic-gate } 401*0Sstevel@tonic-gate 402*0Sstevel@tonic-gate /* 403*0Sstevel@tonic-gate * Find and record maximum byte offset that the 404*0Sstevel@tonic-gate * filter users. We use this when executing the 405*0Sstevel@tonic-gate * filter to determine how much of the packet 406*0Sstevel@tonic-gate * body to pull up. This code depends on the 407*0Sstevel@tonic-gate * filter encoding. 408*0Sstevel@tonic-gate */ 409*0Sstevel@tonic-gate maxoff = 0; 410*0Sstevel@tonic-gate for (fwp = pfp->pf_Filter; fwp < pfp->pf_FilterEnd; fwp++) { 411*0Sstevel@tonic-gate arg = *fwp & ((1 << ENF_NBPA) - 1); 412*0Sstevel@tonic-gate switch (arg) { 413*0Sstevel@tonic-gate default: 414*0Sstevel@tonic-gate if ((arg -= ENF_PUSHWORD) > maxoff) 415*0Sstevel@tonic-gate maxoff = arg; 416*0Sstevel@tonic-gate break; 417*0Sstevel@tonic-gate 418*0Sstevel@tonic-gate case ENF_PUSHLIT: 419*0Sstevel@tonic-gate /* Skip over the literal. */ 420*0Sstevel@tonic-gate fwp++; 421*0Sstevel@tonic-gate break; 422*0Sstevel@tonic-gate 423*0Sstevel@tonic-gate case ENF_PUSHZERO: 424*0Sstevel@tonic-gate case ENF_PUSHONE: 425*0Sstevel@tonic-gate case ENF_PUSHFFFF: 426*0Sstevel@tonic-gate case ENF_PUSHFF00: 427*0Sstevel@tonic-gate case ENF_PUSH00FF: 428*0Sstevel@tonic-gate case ENF_NOPUSH: 429*0Sstevel@tonic-gate break; 430*0Sstevel@tonic-gate } 431*0Sstevel@tonic-gate } 432*0Sstevel@tonic-gate 433*0Sstevel@tonic-gate /* 434*0Sstevel@tonic-gate * Convert word offset to length in bytes. 435*0Sstevel@tonic-gate */ 436*0Sstevel@tonic-gate pfp->pf_PByteLen = (maxoff + 1) * sizeof (ushort_t); 437*0Sstevel@tonic-gate 438*0Sstevel@tonic-gate miocack(wq, mp, 0, 0); 439*0Sstevel@tonic-gate break; 440*0Sstevel@tonic-gate 441*0Sstevel@tonic-gate default: 442*0Sstevel@tonic-gate putnext(wq, mp); 443*0Sstevel@tonic-gate break; 444*0Sstevel@tonic-gate } 445*0Sstevel@tonic-gate } 446*0Sstevel@tonic-gate 447*0Sstevel@tonic-gate /* #define DEBUG 1 */ 448*0Sstevel@tonic-gate /* #define INNERDEBUG 1 */ 449*0Sstevel@tonic-gate 450*0Sstevel@tonic-gate #ifdef INNERDEBUG 451*0Sstevel@tonic-gate #define enprintf(flags) if (enDebug & (flags)) printf 452*0Sstevel@tonic-gate 453*0Sstevel@tonic-gate /* 454*0Sstevel@tonic-gate * Symbolic definitions for enDebug flag bits 455*0Sstevel@tonic-gate * ENDBG_TRACE should be 1 because it is the most common 456*0Sstevel@tonic-gate * use in the code, and the compiler generates faster code 457*0Sstevel@tonic-gate * for testing the low bit in a word. 458*0Sstevel@tonic-gate */ 459*0Sstevel@tonic-gate 460*0Sstevel@tonic-gate #define ENDBG_TRACE 1 /* trace most operations */ 461*0Sstevel@tonic-gate #define ENDBG_DESQ 2 /* trace descriptor queues */ 462*0Sstevel@tonic-gate #define ENDBG_INIT 4 /* initialization info */ 463*0Sstevel@tonic-gate #define ENDBG_SCAV 8 /* scavenger operation */ 464*0Sstevel@tonic-gate #define ENDBG_ABNORM 16 /* abnormal events */ 465*0Sstevel@tonic-gate 466*0Sstevel@tonic-gate int enDebug = /* ENDBG_ABNORM | ENDBG_INIT | ENDBG_TRACE */ -1; 467*0Sstevel@tonic-gate #endif /* INNERDEBUG */ 468*0Sstevel@tonic-gate 469*0Sstevel@tonic-gate /* 470*0Sstevel@tonic-gate * Apply the packet filter given by pfp to the packet given by 471*0Sstevel@tonic-gate * pp. Return nonzero iff the filter accepts the packet. 472*0Sstevel@tonic-gate * 473*0Sstevel@tonic-gate * The packet comes in two pieces, a header and a body, since 474*0Sstevel@tonic-gate * that's the most convenient form for our caller. The header 475*0Sstevel@tonic-gate * is in contiguous memory, whereas the body is in a mbuf. 476*0Sstevel@tonic-gate * Our caller will have adjusted the mbuf chain so that its first 477*0Sstevel@tonic-gate * min(MLEN, length(body)) bytes are guaranteed contiguous. For 478*0Sstevel@tonic-gate * the sake of efficiency (and some laziness) the filter is prepared 479*0Sstevel@tonic-gate * to examine only these two contiguous pieces. Furthermore, it 480*0Sstevel@tonic-gate * assumes that the header length is even, so that there's no need 481*0Sstevel@tonic-gate * to glue the last byte of header to the first byte of data. 482*0Sstevel@tonic-gate */ 483*0Sstevel@tonic-gate 484*0Sstevel@tonic-gate #define opx(i) ((i) >> ENF_NBPA) 485*0Sstevel@tonic-gate 486*0Sstevel@tonic-gate static int 487*0Sstevel@tonic-gate FilterPacket(struct packdesc *pp, struct epacketfilt *pfp) 488*0Sstevel@tonic-gate { 489*0Sstevel@tonic-gate int maxhdr = pp->pd_hdrlen; 490*0Sstevel@tonic-gate int maxword = maxhdr + pp->pd_bodylen; 491*0Sstevel@tonic-gate ushort_t *sp; 492*0Sstevel@tonic-gate ushort_t *fp; 493*0Sstevel@tonic-gate ushort_t *fpe; 494*0Sstevel@tonic-gate unsigned op; 495*0Sstevel@tonic-gate unsigned arg; 496*0Sstevel@tonic-gate ushort_t stack[ENMAXFILTERS+1]; 497*0Sstevel@tonic-gate 498*0Sstevel@tonic-gate fp = &pfp->pf_Filter[0]; 499*0Sstevel@tonic-gate fpe = pfp->pf_FilterEnd; 500*0Sstevel@tonic-gate 501*0Sstevel@tonic-gate #ifdef INNERDEBUG 502*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("FilterPacket(%p, %p, %p, %p):\n", 503*0Sstevel@tonic-gate pp, pfp, fp, fpe); 504*0Sstevel@tonic-gate #endif 505*0Sstevel@tonic-gate 506*0Sstevel@tonic-gate /* 507*0Sstevel@tonic-gate * Push TRUE on stack to start. The stack size is chosen such 508*0Sstevel@tonic-gate * that overflow can't occur -- each operation can push at most 509*0Sstevel@tonic-gate * one item on the stack, and the stack size equals the maximum 510*0Sstevel@tonic-gate * program length. 511*0Sstevel@tonic-gate */ 512*0Sstevel@tonic-gate sp = &stack[ENMAXFILTERS]; 513*0Sstevel@tonic-gate *sp = 1; 514*0Sstevel@tonic-gate 515*0Sstevel@tonic-gate while (fp < fpe) { 516*0Sstevel@tonic-gate op = *fp >> ENF_NBPA; 517*0Sstevel@tonic-gate arg = *fp & ((1 << ENF_NBPA) - 1); 518*0Sstevel@tonic-gate fp++; 519*0Sstevel@tonic-gate 520*0Sstevel@tonic-gate switch (arg) { 521*0Sstevel@tonic-gate default: 522*0Sstevel@tonic-gate arg -= ENF_PUSHWORD; 523*0Sstevel@tonic-gate /* 524*0Sstevel@tonic-gate * Since arg is unsigned, 525*0Sstevel@tonic-gate * if it were less than ENF_PUSHWORD before, 526*0Sstevel@tonic-gate * it would now be huge. 527*0Sstevel@tonic-gate */ 528*0Sstevel@tonic-gate if (arg < maxhdr) 529*0Sstevel@tonic-gate *--sp = pp->pd_hdr[arg]; 530*0Sstevel@tonic-gate else if (arg < maxword) 531*0Sstevel@tonic-gate *--sp = pp->pd_body[arg - maxhdr]; 532*0Sstevel@tonic-gate else { 533*0Sstevel@tonic-gate #ifdef INNERDEBUG 534*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>0(len)\n"); 535*0Sstevel@tonic-gate #endif 536*0Sstevel@tonic-gate return (0); 537*0Sstevel@tonic-gate } 538*0Sstevel@tonic-gate break; 539*0Sstevel@tonic-gate case ENF_PUSHLIT: 540*0Sstevel@tonic-gate *--sp = *fp++; 541*0Sstevel@tonic-gate break; 542*0Sstevel@tonic-gate case ENF_PUSHZERO: 543*0Sstevel@tonic-gate *--sp = 0; 544*0Sstevel@tonic-gate break; 545*0Sstevel@tonic-gate case ENF_PUSHONE: 546*0Sstevel@tonic-gate *--sp = 1; 547*0Sstevel@tonic-gate break; 548*0Sstevel@tonic-gate case ENF_PUSHFFFF: 549*0Sstevel@tonic-gate *--sp = 0xffff; 550*0Sstevel@tonic-gate break; 551*0Sstevel@tonic-gate case ENF_PUSHFF00: 552*0Sstevel@tonic-gate *--sp = 0xff00; 553*0Sstevel@tonic-gate break; 554*0Sstevel@tonic-gate case ENF_PUSH00FF: 555*0Sstevel@tonic-gate *--sp = 0x00ff; 556*0Sstevel@tonic-gate break; 557*0Sstevel@tonic-gate case ENF_NOPUSH: 558*0Sstevel@tonic-gate break; 559*0Sstevel@tonic-gate } 560*0Sstevel@tonic-gate 561*0Sstevel@tonic-gate if (sp < &stack[2]) { /* check stack overflow: small yellow zone */ 562*0Sstevel@tonic-gate #ifdef INNERDEBUG 563*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>0(--sp)\n"); 564*0Sstevel@tonic-gate #endif 565*0Sstevel@tonic-gate return (0); 566*0Sstevel@tonic-gate } 567*0Sstevel@tonic-gate 568*0Sstevel@tonic-gate if (op == ENF_NOP) 569*0Sstevel@tonic-gate continue; 570*0Sstevel@tonic-gate 571*0Sstevel@tonic-gate /* 572*0Sstevel@tonic-gate * all non-NOP operators binary, must have at least two operands 573*0Sstevel@tonic-gate * on stack to evaluate. 574*0Sstevel@tonic-gate */ 575*0Sstevel@tonic-gate if (sp > &stack[ENMAXFILTERS-2]) { 576*0Sstevel@tonic-gate #ifdef INNERDEBUG 577*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>0(sp++)\n"); 578*0Sstevel@tonic-gate #endif 579*0Sstevel@tonic-gate return (0); 580*0Sstevel@tonic-gate } 581*0Sstevel@tonic-gate 582*0Sstevel@tonic-gate arg = *sp++; 583*0Sstevel@tonic-gate switch (op) { 584*0Sstevel@tonic-gate default: 585*0Sstevel@tonic-gate #ifdef INNERDEBUG 586*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>0(def)\n"); 587*0Sstevel@tonic-gate #endif 588*0Sstevel@tonic-gate return (0); 589*0Sstevel@tonic-gate case opx(ENF_AND): 590*0Sstevel@tonic-gate *sp &= arg; 591*0Sstevel@tonic-gate break; 592*0Sstevel@tonic-gate case opx(ENF_OR): 593*0Sstevel@tonic-gate *sp |= arg; 594*0Sstevel@tonic-gate break; 595*0Sstevel@tonic-gate case opx(ENF_XOR): 596*0Sstevel@tonic-gate *sp ^= arg; 597*0Sstevel@tonic-gate break; 598*0Sstevel@tonic-gate case opx(ENF_EQ): 599*0Sstevel@tonic-gate *sp = (*sp == arg); 600*0Sstevel@tonic-gate break; 601*0Sstevel@tonic-gate case opx(ENF_NEQ): 602*0Sstevel@tonic-gate *sp = (*sp != arg); 603*0Sstevel@tonic-gate break; 604*0Sstevel@tonic-gate case opx(ENF_LT): 605*0Sstevel@tonic-gate *sp = (*sp < arg); 606*0Sstevel@tonic-gate break; 607*0Sstevel@tonic-gate case opx(ENF_LE): 608*0Sstevel@tonic-gate *sp = (*sp <= arg); 609*0Sstevel@tonic-gate break; 610*0Sstevel@tonic-gate case opx(ENF_GT): 611*0Sstevel@tonic-gate *sp = (*sp > arg); 612*0Sstevel@tonic-gate break; 613*0Sstevel@tonic-gate case opx(ENF_GE): 614*0Sstevel@tonic-gate *sp = (*sp >= arg); 615*0Sstevel@tonic-gate break; 616*0Sstevel@tonic-gate 617*0Sstevel@tonic-gate /* short-circuit operators */ 618*0Sstevel@tonic-gate 619*0Sstevel@tonic-gate case opx(ENF_COR): 620*0Sstevel@tonic-gate if (*sp++ == arg) { 621*0Sstevel@tonic-gate #ifdef INNERDEBUG 622*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>COR %x\n", *sp); 623*0Sstevel@tonic-gate #endif 624*0Sstevel@tonic-gate return (1); 625*0Sstevel@tonic-gate } 626*0Sstevel@tonic-gate break; 627*0Sstevel@tonic-gate case opx(ENF_CAND): 628*0Sstevel@tonic-gate if (*sp++ != arg) { 629*0Sstevel@tonic-gate #ifdef INNERDEBUG 630*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>CAND %x\n", *sp); 631*0Sstevel@tonic-gate #endif 632*0Sstevel@tonic-gate return (0); 633*0Sstevel@tonic-gate } 634*0Sstevel@tonic-gate break; 635*0Sstevel@tonic-gate case opx(ENF_CNOR): 636*0Sstevel@tonic-gate if (*sp++ == arg) { 637*0Sstevel@tonic-gate #ifdef INNERDEBUG 638*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>COR %x\n", *sp); 639*0Sstevel@tonic-gate #endif 640*0Sstevel@tonic-gate return (0); 641*0Sstevel@tonic-gate } 642*0Sstevel@tonic-gate break; 643*0Sstevel@tonic-gate case opx(ENF_CNAND): 644*0Sstevel@tonic-gate if (*sp++ != arg) { 645*0Sstevel@tonic-gate #ifdef INNERDEBUG 646*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>CNAND %x\n", *sp); 647*0Sstevel@tonic-gate #endif 648*0Sstevel@tonic-gate return (1); 649*0Sstevel@tonic-gate } 650*0Sstevel@tonic-gate break; 651*0Sstevel@tonic-gate } 652*0Sstevel@tonic-gate } 653*0Sstevel@tonic-gate #ifdef INNERDEBUG 654*0Sstevel@tonic-gate enprintf(ENDBG_TRACE)("=>%x\n", *sp); 655*0Sstevel@tonic-gate #endif 656*0Sstevel@tonic-gate return (*sp); 657*0Sstevel@tonic-gate } 658