ng_ipfw.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*-
    2  * Copyright 2005, Gleb Smirnoff <glebius@FreeBSD.org>
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
   15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
   18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   24  * SUCH DAMAGE.
   25  *
   26  * $FreeBSD: releng/8.0/sys/netgraph/ng_ipfw.c 193859 2009-06-09 21:27:11Z oleg $
   27  */
   28 
   29 #include <sys/param.h>
   30 #include <sys/systm.h>
   31 #include <sys/kernel.h>
   32 #include <sys/lock.h>
   33 #include <sys/mbuf.h>
   34 #include <sys/malloc.h>
   35 #include <sys/ctype.h>
   36 #include <sys/errno.h>
   37 #include <sys/rwlock.h>
   38 #include <sys/socket.h>
   39 #include <sys/syslog.h>
   40 
   41 #include <net/if.h>
   42 
   43 #include <netinet/in.h>
   44 #include <netinet/in_systm.h>
   45 #include <netinet/in_var.h>
   46 #include <netinet/ip_fw.h>
   47 #include <netinet/ip.h>
   48 #include <netinet/ip_var.h>
   49 
   50 #include <netgraph/ng_message.h>
   51 #include <netgraph/ng_parse.h>
   52 #include <netgraph/ng_ipfw.h>
   53 #include <netgraph/netgraph.h>
   54 
   55 static int              ng_ipfw_mod_event(module_t mod, int event, void *data);
   56 static ng_constructor_t ng_ipfw_constructor;
   57 static ng_shutdown_t    ng_ipfw_shutdown;
   58 static ng_newhook_t     ng_ipfw_newhook;
   59 static ng_connect_t     ng_ipfw_connect;
   60 static ng_findhook_t    ng_ipfw_findhook;
   61 static ng_rcvdata_t     ng_ipfw_rcvdata;
   62 static ng_disconnect_t  ng_ipfw_disconnect;
   63 
   64 static hook_p           ng_ipfw_findhook1(node_p, u_int16_t );
   65 static int              ng_ipfw_input(struct mbuf **, int, struct ip_fw_args *,
   66                             int);
   67 
   68 /* We have only one node */
   69 static node_p   fw_node;
   70 
   71 /* Netgraph node type descriptor */
   72 static struct ng_type ng_ipfw_typestruct = {
   73         .version =      NG_ABI_VERSION,
   74         .name =         NG_IPFW_NODE_TYPE,
   75         .mod_event =    ng_ipfw_mod_event,
   76         .constructor =  ng_ipfw_constructor,
   77         .shutdown =     ng_ipfw_shutdown,
   78         .newhook =      ng_ipfw_newhook,
   79         .connect =      ng_ipfw_connect,
   80         .findhook =     ng_ipfw_findhook,
   81         .rcvdata =      ng_ipfw_rcvdata,
   82         .disconnect =   ng_ipfw_disconnect,
   83 };
   84 NETGRAPH_INIT(ipfw, &ng_ipfw_typestruct);
   85 MODULE_DEPEND(ng_ipfw, ipfw, 2, 2, 2);
   86 
   87 /* Information we store for each hook */
   88 struct ng_ipfw_hook_priv {
   89         hook_p          hook;
   90         u_int16_t       rulenum;
   91 };
   92 typedef struct ng_ipfw_hook_priv *hpriv_p;
   93 
   94 static int
   95 ng_ipfw_mod_event(module_t mod, int event, void *data)
   96 {
   97         int error = 0;
   98 
   99         switch (event) {
  100         case MOD_LOAD:
  101 
  102                 if (ng_ipfw_input_p != NULL) {
  103                         error = EEXIST;
  104                         break;
  105                 }
  106 
  107                 /* Setup node without any private data */
  108                 if ((error = ng_make_node_common(&ng_ipfw_typestruct, &fw_node))
  109                     != 0) {
  110                         log(LOG_ERR, "%s: can't create ng_ipfw node", __func__);
  111                         break;
  112                 };
  113 
  114                 /* Try to name node */
  115                 if (ng_name_node(fw_node, "ipfw") != 0)
  116                         log(LOG_WARNING, "%s: failed to name node \"ipfw\"",
  117                             __func__);
  118 
  119                 /* Register hook */
  120                 ng_ipfw_input_p = ng_ipfw_input;
  121                 break;
  122 
  123         case MOD_UNLOAD:
  124                  /*
  125                   * This won't happen if a node exists.
  126                   * ng_ipfw_input_p is already cleared.
  127                   */
  128                 break;
  129 
  130         default:
  131                 error = EOPNOTSUPP;
  132                 break;
  133         }
  134 
  135         return (error);
  136 }
  137 
  138 static int
  139 ng_ipfw_constructor(node_p node)
  140 {
  141         return (EINVAL);        /* Only one node */
  142 }
  143 
  144 static int
  145 ng_ipfw_newhook(node_p node, hook_p hook, const char *name)
  146 {
  147         hpriv_p hpriv;
  148         u_int16_t rulenum;
  149         const char *cp;
  150         char *endptr;
  151 
  152         /* Protect from leading zero */
  153         if (name[0] == '' && name[1] != '\0')
  154                 return (EINVAL);
  155 
  156         /* Check that name contains only digits */
  157         for (cp = name; *cp != '\0'; cp++)
  158                 if (!isdigit(*cp))
  159                         return (EINVAL);
  160 
  161         /* Convert it to integer */
  162         rulenum = (u_int16_t)strtol(name, &endptr, 10);
  163         if (*endptr != '\0')
  164                 return (EINVAL);
  165 
  166         /* Allocate memory for this hook's private data */
  167         hpriv = malloc(sizeof(*hpriv), M_NETGRAPH, M_NOWAIT | M_ZERO);
  168         if (hpriv== NULL)
  169                 return (ENOMEM);
  170 
  171         hpriv->hook = hook;
  172         hpriv->rulenum = rulenum;
  173 
  174         NG_HOOK_SET_PRIVATE(hook, hpriv);
  175 
  176         return(0);
  177 }
  178 
  179 /*
  180  * Set hooks into queueing mode, to avoid recursion between
  181  * netgraph layer and ip_{input,output}.
  182  */
  183 static int
  184 ng_ipfw_connect(hook_p hook)
  185 {
  186         NG_HOOK_FORCE_QUEUE(hook);
  187         return (0);
  188 }
  189 
  190 /* Look up hook by name */
  191 hook_p
  192 ng_ipfw_findhook(node_p node, const char *name)
  193 {
  194         u_int16_t n;    /* numeric representation of hook */
  195         char *endptr;
  196 
  197         n = (u_int16_t)strtol(name, &endptr, 10);
  198         if (*endptr != '\0')
  199                 return NULL;
  200         return ng_ipfw_findhook1(node, n);
  201 }
  202 
  203 /* Look up hook by rule number */
  204 static hook_p
  205 ng_ipfw_findhook1(node_p node, u_int16_t rulenum)
  206 {
  207         hook_p  hook;
  208         hpriv_p hpriv;
  209 
  210         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
  211                 hpriv = NG_HOOK_PRIVATE(hook);
  212                 if (NG_HOOK_IS_VALID(hook) && (hpriv->rulenum == rulenum))
  213                         return (hook);
  214         }
  215 
  216         return (NULL);
  217 }
  218 
  219 
  220 static int
  221 ng_ipfw_rcvdata(hook_p hook, item_p item)
  222 {
  223         struct ng_ipfw_tag      *ngit;
  224         struct mbuf *m;
  225 
  226         NGI_GET_M(item, m);
  227         NG_FREE_ITEM(item);
  228 
  229         if ((ngit = (struct ng_ipfw_tag *)m_tag_locate(m, NGM_IPFW_COOKIE, 0,
  230             NULL)) == NULL) {
  231                 NG_FREE_M(m);
  232                 return (EINVAL);        /* XXX: find smth better */
  233         };
  234 
  235         switch (ngit->dir) {
  236         case NG_IPFW_OUT:
  237             {
  238                 struct ip *ip;
  239 
  240                 if (m->m_len < sizeof(struct ip) &&
  241                     (m = m_pullup(m, sizeof(struct ip))) == NULL)
  242                         return (EINVAL);
  243 
  244                 ip = mtod(m, struct ip *);
  245 
  246                 ip->ip_len = ntohs(ip->ip_len);
  247                 ip->ip_off = ntohs(ip->ip_off);
  248 
  249                 return ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL);
  250             }
  251         case NG_IPFW_IN:
  252                 ip_input(m);
  253                 return (0);
  254         default:
  255                 panic("ng_ipfw_rcvdata: bad dir %u", ngit->dir);
  256         }       
  257 
  258         /* not reached */
  259         return (0);
  260 }
  261 
  262 static int
  263 ng_ipfw_input(struct mbuf **m0, int dir, struct ip_fw_args *fwa, int tee)
  264 {
  265         struct mbuf *m;
  266         struct ng_ipfw_tag *ngit;
  267         struct ip *ip;
  268         hook_p  hook;
  269         int error = 0;
  270 
  271         /*
  272          * Node must be loaded and corresponding hook must be present.
  273          */
  274         if (fw_node == NULL || 
  275            (hook = ng_ipfw_findhook1(fw_node, fwa->cookie)) == NULL) {
  276                 if (tee == 0)
  277                         m_freem(*m0);
  278                 return (ESRCH);         /* no hook associated with this rule */
  279         }
  280 
  281         /*
  282          * We have two modes: in normal mode we add a tag to packet, which is
  283          * important to return packet back to IP stack. In tee mode we make
  284          * a copy of a packet and forward it into netgraph without a tag.
  285          */
  286         if (tee == 0) {
  287                 m = *m0;
  288                 *m0 = NULL;     /* it belongs now to netgraph */
  289 
  290                 if ((ngit = (struct ng_ipfw_tag *)m_tag_alloc(NGM_IPFW_COOKIE,
  291                     0, TAGSIZ, M_NOWAIT|M_ZERO)) == NULL) {
  292                         m_freem(m);
  293                         return (ENOMEM);
  294                 }
  295                 ngit->rule = fwa->rule;
  296                 ngit->rule_id = fwa->rule_id;
  297                 ngit->chain_id = fwa->chain_id;
  298                 ngit->dir = dir;
  299                 ngit->ifp = fwa->oif;
  300                 m_tag_prepend(m, &ngit->mt);
  301 
  302         } else
  303                 if ((m = m_dup(*m0, M_DONTWAIT)) == NULL)
  304                         return (ENOMEM);        /* which is ignored */
  305 
  306         if (m->m_len < sizeof(struct ip) &&
  307             (m = m_pullup(m, sizeof(struct ip))) == NULL)
  308                 return (EINVAL);
  309 
  310         ip = mtod(m, struct ip *);
  311         ip->ip_len = htons(ip->ip_len);
  312         ip->ip_off = htons(ip->ip_off);
  313 
  314         NG_SEND_DATA_ONLY(error, hook, m);
  315 
  316         return (error);
  317 }
  318 
  319 static int
  320 ng_ipfw_shutdown(node_p node)
  321 {
  322 
  323         /*
  324          * After our single node has been removed,
  325          * the only thing that can be done is
  326          * 'kldunload ng_ipfw.ko'
  327          */
  328         ng_ipfw_input_p = NULL;
  329         NG_NODE_UNREF(node);
  330         return (0);
  331 }
  332 
  333 static int
  334 ng_ipfw_disconnect(hook_p hook)
  335 {
  336         const hpriv_p hpriv = NG_HOOK_PRIVATE(hook);
  337 
  338         free(hpriv, M_NETGRAPH);
  339         NG_HOOK_SET_PRIVATE(hook, NULL);
  340 
  341         return (0);
  342 }
Cache object: 384afa632789b961433baccd21cda553
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netgraph/ng_ipfw.c

FreeBSD/Linux Kernel Cross Reference
sys/netgraph/ng_ipfw.c
