2005-02-05 12:06:33 +00:00
|
|
|
/*-
|
|
|
|
* Copyright 2005, Gleb Smirnoff <glebius@FreeBSD.org>
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
|
|
|
* $FreeBSD$
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/systm.h>
|
|
|
|
#include <sys/kernel.h>
|
Conditionally compile out V_ globals while instantiating the appropriate
container structures, depending on VIMAGE_GLOBALS compile time option.
Make VIMAGE_GLOBALS a new compile-time option, which by default will not
be defined, resulting in instatiations of global variables selected for
V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be
effectively compiled out. Instantiate new global container structures
to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0,
vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0.
Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_
macros resolve either to the original globals, or to fields inside
container structures, i.e. effectively
#ifdef VIMAGE_GLOBALS
#define V_rt_tables rt_tables
#else
#define V_rt_tables vnet_net_0._rt_tables
#endif
Update SYSCTL_V_*() macros to operate either on globals or on fields
inside container structs.
Extend the internal kldsym() lookups with the ability to resolve
selected fields inside the virtualization container structs. This
applies only to the fields which are explicitly registered for kldsym()
visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently
this is done only in sys/net/if.c.
Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code,
and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in
turn result in proper code being generated depending on VIMAGE_GLOBALS.
De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c
which were prematurely V_irtualized by automated V_ prepending scripts
during earlier merging steps. PF virtualization will be done
separately, most probably after next PF import.
Convert a few variable initializations at instantiation to
initialization in init functions, most notably in ipfw. Also convert
TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in
initializer functions.
Discussed at: devsummit Strassburg
Reviewed by: bz, julian
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-12-10 23:12:39 +00:00
|
|
|
#include <sys/lock.h>
|
2005-02-05 12:06:33 +00:00
|
|
|
#include <sys/mbuf.h>
|
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/ctype.h>
|
|
|
|
#include <sys/errno.h>
|
Conditionally compile out V_ globals while instantiating the appropriate
container structures, depending on VIMAGE_GLOBALS compile time option.
Make VIMAGE_GLOBALS a new compile-time option, which by default will not
be defined, resulting in instatiations of global variables selected for
V_irtualization (enclosed in #ifdef VIMAGE_GLOBALS blocks) to be
effectively compiled out. Instantiate new global container structures
to hold V_irtualized variables: vnet_net_0, vnet_inet_0, vnet_inet6_0,
vnet_ipsec_0, vnet_netgraph_0, and vnet_gif_0.
Update the VSYM() macro so that depending on VIMAGE_GLOBALS the V_
macros resolve either to the original globals, or to fields inside
container structures, i.e. effectively
#ifdef VIMAGE_GLOBALS
#define V_rt_tables rt_tables
#else
#define V_rt_tables vnet_net_0._rt_tables
#endif
Update SYSCTL_V_*() macros to operate either on globals or on fields
inside container structs.
Extend the internal kldsym() lookups with the ability to resolve
selected fields inside the virtualization container structs. This
applies only to the fields which are explicitly registered for kldsym()
visibility via VNET_MOD_DECLARE() and vnet_mod_register(), currently
this is done only in sys/net/if.c.
Fix a few broken instances of MODULE_GLOBAL() macro use in SCTP code,
and modify the MODULE_GLOBAL() macro to resolve to V_ macros, which in
turn result in proper code being generated depending on VIMAGE_GLOBALS.
De-virtualize local static variables in sys/contrib/pf/net/pf_subr.c
which were prematurely V_irtualized by automated V_ prepending scripts
during earlier merging steps. PF virtualization will be done
separately, most probably after next PF import.
Convert a few variable initializations at instantiation to
initialization in init functions, most notably in ipfw. Also convert
TUNABLE_INT() initializers for V_ variables to TUNABLE_FETCH_INT() in
initializer functions.
Discussed at: devsummit Strassburg
Reviewed by: bz, julian
Approved by: julian (mentor)
Obtained from: //depot/projects/vimage-commit2/...
X-MFC after: never
Sponsored by: NLnet Foundation, The FreeBSD Foundation
2008-12-10 23:12:39 +00:00
|
|
|
#include <sys/rwlock.h>
|
2005-02-05 12:06:33 +00:00
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/syslog.h>
|
|
|
|
|
|
|
|
#include <net/if.h>
|
|
|
|
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_systm.h>
|
|
|
|
#include <netinet/in_var.h>
|
2010-01-07 14:23:19 +00:00
|
|
|
#include <netinet/ip_var.h>
|
2005-02-05 12:06:33 +00:00
|
|
|
#include <netinet/ip_fw.h>
|
2009-12-15 18:33:12 +00:00
|
|
|
#include <netinet/ipfw/ip_fw_private.h>
|
2005-02-05 12:06:33 +00:00
|
|
|
#include <netinet/ip.h>
|
|
|
|
|
|
|
|
#include <netgraph/ng_message.h>
|
|
|
|
#include <netgraph/ng_parse.h>
|
|
|
|
#include <netgraph/ng_ipfw.h>
|
|
|
|
#include <netgraph/netgraph.h>
|
|
|
|
|
|
|
|
static int ng_ipfw_mod_event(module_t mod, int event, void *data);
|
|
|
|
static ng_constructor_t ng_ipfw_constructor;
|
|
|
|
static ng_shutdown_t ng_ipfw_shutdown;
|
|
|
|
static ng_newhook_t ng_ipfw_newhook;
|
|
|
|
static ng_connect_t ng_ipfw_connect;
|
|
|
|
static ng_findhook_t ng_ipfw_findhook;
|
|
|
|
static ng_rcvdata_t ng_ipfw_rcvdata;
|
|
|
|
static ng_disconnect_t ng_ipfw_disconnect;
|
|
|
|
|
|
|
|
static hook_p ng_ipfw_findhook1(node_p, u_int16_t );
|
|
|
|
static int ng_ipfw_input(struct mbuf **, int, struct ip_fw_args *,
|
|
|
|
int);
|
|
|
|
|
|
|
|
/* We have only one node */
|
|
|
|
static node_p fw_node;
|
|
|
|
|
|
|
|
/* Netgraph node type descriptor */
|
|
|
|
static struct ng_type ng_ipfw_typestruct = {
|
|
|
|
.version = NG_ABI_VERSION,
|
|
|
|
.name = NG_IPFW_NODE_TYPE,
|
|
|
|
.mod_event = ng_ipfw_mod_event,
|
|
|
|
.constructor = ng_ipfw_constructor,
|
|
|
|
.shutdown = ng_ipfw_shutdown,
|
|
|
|
.newhook = ng_ipfw_newhook,
|
|
|
|
.connect = ng_ipfw_connect,
|
|
|
|
.findhook = ng_ipfw_findhook,
|
|
|
|
.rcvdata = ng_ipfw_rcvdata,
|
|
|
|
.disconnect = ng_ipfw_disconnect,
|
|
|
|
};
|
|
|
|
NETGRAPH_INIT(ipfw, &ng_ipfw_typestruct);
|
|
|
|
MODULE_DEPEND(ng_ipfw, ipfw, 2, 2, 2);
|
|
|
|
|
|
|
|
/* Information we store for each hook */
|
|
|
|
struct ng_ipfw_hook_priv {
|
|
|
|
hook_p hook;
|
|
|
|
u_int16_t rulenum;
|
|
|
|
};
|
|
|
|
typedef struct ng_ipfw_hook_priv *hpriv_p;
|
|
|
|
|
|
|
|
static int
|
|
|
|
ng_ipfw_mod_event(module_t mod, int event, void *data)
|
|
|
|
{
|
|
|
|
int error = 0;
|
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
case MOD_LOAD:
|
|
|
|
|
|
|
|
if (ng_ipfw_input_p != NULL) {
|
|
|
|
error = EEXIST;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Setup node without any private data */
|
|
|
|
if ((error = ng_make_node_common(&ng_ipfw_typestruct, &fw_node))
|
|
|
|
!= 0) {
|
|
|
|
log(LOG_ERR, "%s: can't create ng_ipfw node", __func__);
|
|
|
|
break;
|
|
|
|
};
|
|
|
|
|
|
|
|
/* Try to name node */
|
|
|
|
if (ng_name_node(fw_node, "ipfw") != 0)
|
|
|
|
log(LOG_WARNING, "%s: failed to name node \"ipfw\"",
|
|
|
|
__func__);
|
|
|
|
|
|
|
|
/* Register hook */
|
|
|
|
ng_ipfw_input_p = ng_ipfw_input;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case MOD_UNLOAD:
|
|
|
|
/*
|
|
|
|
* This won't happen if a node exists.
|
|
|
|
* ng_ipfw_input_p is already cleared.
|
|
|
|
*/
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
|
|
|
error = EOPNOTSUPP;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ng_ipfw_constructor(node_p node)
|
|
|
|
{
|
|
|
|
return (EINVAL); /* Only one node */
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ng_ipfw_newhook(node_p node, hook_p hook, const char *name)
|
|
|
|
{
|
|
|
|
hpriv_p hpriv;
|
|
|
|
u_int16_t rulenum;
|
|
|
|
const char *cp;
|
2005-02-07 11:16:07 +00:00
|
|
|
char *endptr;
|
2005-02-05 12:06:33 +00:00
|
|
|
|
2005-05-29 12:20:41 +00:00
|
|
|
/* Protect from leading zero */
|
|
|
|
if (name[0] == '0' && name[1] != '\0')
|
|
|
|
return (EINVAL);
|
|
|
|
|
2005-02-05 12:06:33 +00:00
|
|
|
/* Check that name contains only digits */
|
2005-02-07 11:16:07 +00:00
|
|
|
for (cp = name; *cp != '\0'; cp++)
|
2005-05-29 12:20:41 +00:00
|
|
|
if (!isdigit(*cp))
|
2005-02-05 12:06:33 +00:00
|
|
|
return (EINVAL);
|
|
|
|
|
|
|
|
/* Convert it to integer */
|
2005-02-07 11:16:07 +00:00
|
|
|
rulenum = (u_int16_t)strtol(name, &endptr, 10);
|
|
|
|
if (*endptr != '\0')
|
2005-02-05 12:06:33 +00:00
|
|
|
return (EINVAL);
|
|
|
|
|
|
|
|
/* Allocate memory for this hook's private data */
|
2008-10-23 15:53:51 +00:00
|
|
|
hpriv = malloc(sizeof(*hpriv), M_NETGRAPH, M_NOWAIT | M_ZERO);
|
2005-02-05 12:06:33 +00:00
|
|
|
if (hpriv== NULL)
|
|
|
|
return (ENOMEM);
|
|
|
|
|
|
|
|
hpriv->hook = hook;
|
|
|
|
hpriv->rulenum = rulenum;
|
|
|
|
|
|
|
|
NG_HOOK_SET_PRIVATE(hook, hpriv);
|
|
|
|
|
|
|
|
return(0);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Set hooks into queueing mode, to avoid recursion between
|
|
|
|
* netgraph layer and ip_{input,output}.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
ng_ipfw_connect(hook_p hook)
|
|
|
|
{
|
|
|
|
NG_HOOK_FORCE_QUEUE(hook);
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Look up hook by name */
|
|
|
|
hook_p
|
|
|
|
ng_ipfw_findhook(node_p node, const char *name)
|
|
|
|
{
|
|
|
|
u_int16_t n; /* numeric representation of hook */
|
2005-02-07 11:16:07 +00:00
|
|
|
char *endptr;
|
2005-02-05 12:06:33 +00:00
|
|
|
|
2005-02-07 11:16:07 +00:00
|
|
|
n = (u_int16_t)strtol(name, &endptr, 10);
|
|
|
|
if (*endptr != '\0')
|
2005-02-05 12:06:33 +00:00
|
|
|
return NULL;
|
|
|
|
return ng_ipfw_findhook1(node, n);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Look up hook by rule number */
|
|
|
|
static hook_p
|
|
|
|
ng_ipfw_findhook1(node_p node, u_int16_t rulenum)
|
|
|
|
{
|
|
|
|
hook_p hook;
|
|
|
|
hpriv_p hpriv;
|
|
|
|
|
|
|
|
LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
|
|
|
|
hpriv = NG_HOOK_PRIVATE(hook);
|
|
|
|
if (NG_HOOK_IS_VALID(hook) && (hpriv->rulenum == rulenum))
|
|
|
|
return (hook);
|
|
|
|
}
|
|
|
|
|
|
|
|
return (NULL);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
ng_ipfw_rcvdata(hook_p hook, item_p item)
|
|
|
|
{
|
2010-01-04 19:01:22 +00:00
|
|
|
struct ipfw_rule_ref *tag;
|
2005-02-05 12:06:33 +00:00
|
|
|
struct mbuf *m;
|
|
|
|
|
|
|
|
NGI_GET_M(item, m);
|
|
|
|
NG_FREE_ITEM(item);
|
|
|
|
|
2010-01-04 19:01:22 +00:00
|
|
|
tag = (struct ipfw_rule_ref *)
|
|
|
|
m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL);
|
|
|
|
if (tag == NULL) {
|
2005-02-05 12:06:33 +00:00
|
|
|
NG_FREE_M(m);
|
|
|
|
return (EINVAL); /* XXX: find smth better */
|
|
|
|
};
|
|
|
|
|
2010-01-04 19:01:22 +00:00
|
|
|
if (tag->info & IPFW_INFO_IN) {
|
|
|
|
ip_input(m);
|
|
|
|
return (0);
|
|
|
|
} else {
|
2005-02-11 21:26:39 +00:00
|
|
|
struct ip *ip;
|
|
|
|
|
2005-02-11 22:28:58 +00:00
|
|
|
if (m->m_len < sizeof(struct ip) &&
|
2005-02-11 23:17:50 +00:00
|
|
|
(m = m_pullup(m, sizeof(struct ip))) == NULL)
|
|
|
|
return (EINVAL);
|
2005-02-11 21:26:39 +00:00
|
|
|
|
|
|
|
ip = mtod(m, struct ip *);
|
2005-02-05 12:06:33 +00:00
|
|
|
|
2010-01-04 19:01:22 +00:00
|
|
|
SET_HOST_IPLEN(ip);
|
2005-02-05 12:06:33 +00:00
|
|
|
|
2006-02-14 15:22:24 +00:00
|
|
|
return ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL);
|
2005-02-05 12:06:33 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ng_ipfw_input(struct mbuf **m0, int dir, struct ip_fw_args *fwa, int tee)
|
|
|
|
{
|
|
|
|
struct mbuf *m;
|
2005-02-11 20:53:41 +00:00
|
|
|
struct ip *ip;
|
2005-02-05 12:06:33 +00:00
|
|
|
hook_p hook;
|
|
|
|
int error = 0;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Node must be loaded and corresponding hook must be present.
|
|
|
|
*/
|
|
|
|
if (fw_node == NULL ||
|
2010-01-04 19:01:22 +00:00
|
|
|
(hook = ng_ipfw_findhook1(fw_node, fwa->rule.info)) == NULL) {
|
2005-02-05 12:06:33 +00:00
|
|
|
if (tee == 0)
|
|
|
|
m_freem(*m0);
|
|
|
|
return (ESRCH); /* no hook associated with this rule */
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* We have two modes: in normal mode we add a tag to packet, which is
|
|
|
|
* important to return packet back to IP stack. In tee mode we make
|
|
|
|
* a copy of a packet and forward it into netgraph without a tag.
|
|
|
|
*/
|
|
|
|
if (tee == 0) {
|
2010-01-04 19:01:22 +00:00
|
|
|
struct m_tag *tag;
|
|
|
|
struct ipfw_rule_ref *r;
|
2005-02-05 12:06:33 +00:00
|
|
|
m = *m0;
|
|
|
|
*m0 = NULL; /* it belongs now to netgraph */
|
|
|
|
|
2010-01-04 19:01:22 +00:00
|
|
|
tag = m_tag_alloc(MTAG_IPFW_RULE, 0, sizeof(*r),
|
|
|
|
M_NOWAIT|M_ZERO);
|
|
|
|
if (tag == NULL) {
|
2005-02-05 12:06:33 +00:00
|
|
|
m_freem(m);
|
|
|
|
return (ENOMEM);
|
|
|
|
}
|
2010-01-04 19:01:22 +00:00
|
|
|
r = (struct ipfw_rule_ref *)(tag + 1);
|
|
|
|
*r = fwa->rule;
|
|
|
|
r->info = dir ? IPFW_INFO_IN : IPFW_INFO_OUT;
|
|
|
|
m_tag_prepend(m, tag);
|
2005-02-05 12:06:33 +00:00
|
|
|
|
|
|
|
} else
|
2005-02-11 23:07:22 +00:00
|
|
|
if ((m = m_dup(*m0, M_DONTWAIT)) == NULL)
|
2005-02-05 12:06:33 +00:00
|
|
|
return (ENOMEM); /* which is ignored */
|
|
|
|
|
2005-02-11 23:07:22 +00:00
|
|
|
if (m->m_len < sizeof(struct ip) &&
|
2005-02-11 23:17:50 +00:00
|
|
|
(m = m_pullup(m, sizeof(struct ip))) == NULL)
|
|
|
|
return (EINVAL);
|
2005-02-11 23:07:22 +00:00
|
|
|
|
2005-02-11 20:53:41 +00:00
|
|
|
ip = mtod(m, struct ip *);
|
|
|
|
|
2005-02-05 12:06:33 +00:00
|
|
|
NG_SEND_DATA_ONLY(error, hook, m);
|
|
|
|
|
|
|
|
return (error);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ng_ipfw_shutdown(node_p node)
|
|
|
|
{
|
|
|
|
|
|
|
|
/*
|
|
|
|
* After our single node has been removed,
|
|
|
|
* the only thing that can be done is
|
|
|
|
* 'kldunload ng_ipfw.ko'
|
|
|
|
*/
|
|
|
|
ng_ipfw_input_p = NULL;
|
|
|
|
NG_NODE_UNREF(node);
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
ng_ipfw_disconnect(hook_p hook)
|
|
|
|
{
|
|
|
|
const hpriv_p hpriv = NG_HOOK_PRIVATE(hook);
|
|
|
|
|
2008-10-23 15:53:51 +00:00
|
|
|
free(hpriv, M_NETGRAPH);
|
2005-02-05 12:06:33 +00:00
|
|
|
NG_HOOK_SET_PRIVATE(hook, NULL);
|
|
|
|
|
|
|
|
return (0);
|
|
|
|
}
|