2006-06-26 22:30:08 +00:00
|
|
|
/*-
|
2017-11-27 15:23:17 +00:00
|
|
|
* SPDX-License-Identifier: BSD-2-Clause-FreeBSD
|
|
|
|
*
|
2006-06-26 22:30:08 +00:00
|
|
|
* Copyright (c) 2006 The FreeBSD Project.
|
2015-11-25 07:31:59 +00:00
|
|
|
* Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
|
2006-06-26 22:30:08 +00:00
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
*
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*
|
|
|
|
* $FreeBSD$
|
|
|
|
*/
|
|
|
|
|
2011-04-27 19:30:44 +00:00
|
|
|
#include "opt_inet.h"
|
|
|
|
#include "opt_inet6.h"
|
|
|
|
|
2006-06-26 22:30:08 +00:00
|
|
|
#include <sys/param.h>
|
|
|
|
#include <sys/systm.h>
|
2015-11-25 21:16:10 +00:00
|
|
|
#include <sys/hhook.h>
|
2006-06-26 22:30:08 +00:00
|
|
|
#include <sys/kernel.h>
|
|
|
|
#include <sys/malloc.h>
|
|
|
|
#include <sys/mbuf.h>
|
|
|
|
#include <sys/module.h>
|
|
|
|
#include <machine/bus.h>
|
|
|
|
#include <sys/rman.h>
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#include <sys/sockio.h>
|
|
|
|
#include <sys/sysctl.h>
|
|
|
|
|
|
|
|
#include <net/if.h>
|
2015-11-25 21:16:10 +00:00
|
|
|
#include <net/if_enc.h>
|
2013-10-26 17:58:36 +00:00
|
|
|
#include <net/if_var.h>
|
2006-06-26 22:30:08 +00:00
|
|
|
#include <net/if_clone.h>
|
|
|
|
#include <net/if_types.h>
|
|
|
|
#include <net/pfil.h>
|
|
|
|
#include <net/route.h>
|
|
|
|
#include <net/netisr.h>
|
|
|
|
#include <net/bpf.h>
|
Build on Jeff Roberson's linker-set based dynamic per-CPU allocator
(DPCPU), as suggested by Peter Wemm, and implement a new per-virtual
network stack memory allocator. Modify vnet to use the allocator
instead of monolithic global container structures (vinet, ...). This
change solves many binary compatibility problems associated with
VIMAGE, and restores ELF symbols for virtualized global variables.
Each virtualized global variable exists as a "reference copy", and also
once per virtual network stack. Virtualized global variables are
tagged at compile-time, placing the in a special linker set, which is
loaded into a contiguous region of kernel memory. Virtualized global
variables in the base kernel are linked as normal, but those in modules
are copied and relocated to a reserved portion of the kernel's vnet
region with the help of a the kernel linker.
Virtualized global variables exist in per-vnet memory set up when the
network stack instance is created, and are initialized statically from
the reference copy. Run-time access occurs via an accessor macro, which
converts from the current vnet and requested symbol to a per-vnet
address. When "options VIMAGE" is not compiled into the kernel, normal
global ELF symbols will be used instead and indirection is avoided.
This change restores static initialization for network stack global
variables, restores support for non-global symbols and types, eliminates
the need for many subsystem constructors, eliminates large per-subsystem
structures that caused many binary compatibility issues both for
monitoring applications (netstat) and kernel modules, removes the
per-function INIT_VNET_*() macros throughout the stack, eliminates the
need for vnet_symmap ksym(2) munging, and eliminates duplicate
definitions of virtualized globals under VIMAGE_GLOBALS.
Bump __FreeBSD_version and update UPDATING.
Portions submitted by: bz
Reviewed by: bz, zec
Discussed with: gnn, jamie, jeff, jhb, julian, sam
Suggested by: peter
Approved by: re (kensmith)
2009-07-14 22:48:30 +00:00
|
|
|
#include <net/vnet.h>
|
2006-06-26 22:30:08 +00:00
|
|
|
|
|
|
|
#include <netinet/in.h>
|
|
|
|
#include <netinet/in_systm.h>
|
|
|
|
#include <netinet/ip.h>
|
|
|
|
#include <netinet/ip_var.h>
|
|
|
|
#include <netinet/in_var.h>
|
|
|
|
|
|
|
|
#ifdef INET6
|
|
|
|
#include <netinet/ip6.h>
|
|
|
|
#include <netinet6/ip6_var.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include <netipsec/ipsec.h>
|
2007-11-28 22:33:53 +00:00
|
|
|
#include <netipsec/xform.h>
|
2006-06-26 22:30:08 +00:00
|
|
|
|
|
|
|
#define ENCMTU (1024+512)
|
|
|
|
|
|
|
|
/* XXX this define must have the same value as in OpenBSD */
|
|
|
|
#define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */
|
|
|
|
#define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */
|
|
|
|
#define M_AUTH_AH 0x2000 /* header was authenticated (AH) */
|
|
|
|
|
|
|
|
struct enchdr {
|
|
|
|
u_int32_t af;
|
|
|
|
u_int32_t spi;
|
|
|
|
u_int32_t flags;
|
|
|
|
};
|
|
|
|
struct enc_softc {
|
|
|
|
struct ifnet *sc_ifp;
|
|
|
|
};
|
2018-07-24 16:35:52 +00:00
|
|
|
VNET_DEFINE_STATIC(struct enc_softc *, enc_sc);
|
2015-11-25 07:31:59 +00:00
|
|
|
#define V_enc_sc VNET(enc_sc)
|
2018-07-24 16:35:52 +00:00
|
|
|
VNET_DEFINE_STATIC(struct if_clone *, enc_cloner);
|
2015-11-25 07:31:59 +00:00
|
|
|
#define V_enc_cloner VNET(enc_cloner)
|
2006-06-26 22:30:08 +00:00
|
|
|
|
|
|
|
static int enc_ioctl(struct ifnet *, u_long, caddr_t);
|
2015-11-25 07:31:59 +00:00
|
|
|
static int enc_output(struct ifnet *, struct mbuf *,
|
|
|
|
const struct sockaddr *, struct route *);
|
2006-07-10 05:24:06 +00:00
|
|
|
static int enc_clone_create(struct if_clone *, int, caddr_t);
|
2006-07-04 23:09:11 +00:00
|
|
|
static void enc_clone_destroy(struct ifnet *);
|
2015-11-25 07:31:59 +00:00
|
|
|
static int enc_add_hhooks(struct enc_softc *);
|
|
|
|
static void enc_remove_hhooks(struct enc_softc *);
|
2006-06-26 22:30:08 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
static const char encname[] = "enc";
|
2007-11-28 22:33:53 +00:00
|
|
|
|
2017-08-09 12:24:07 +00:00
|
|
|
#define IPSEC_ENC_AFTER_PFIL 0x04
|
2007-11-28 22:33:53 +00:00
|
|
|
/*
|
|
|
|
* Before and after are relative to when we are stripping the
|
|
|
|
* outer IP header.
|
2017-08-09 12:24:07 +00:00
|
|
|
*
|
|
|
|
* AFTER_PFIL flag used only for bpf_mask_*. It enables BPF capturing
|
|
|
|
* after PFIL hook execution. It might be useful when PFIL hook does
|
|
|
|
* some changes to the packet, e.g. address translation. If PFIL hook
|
|
|
|
* consumes mbuf, nothing will be captured.
|
2007-11-28 22:33:53 +00:00
|
|
|
*/
|
2018-07-24 16:35:52 +00:00
|
|
|
VNET_DEFINE_STATIC(int, filter_mask_in) = IPSEC_ENC_BEFORE;
|
|
|
|
VNET_DEFINE_STATIC(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
|
|
|
|
VNET_DEFINE_STATIC(int, filter_mask_out) = IPSEC_ENC_BEFORE;
|
|
|
|
VNET_DEFINE_STATIC(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
|
2015-11-25 07:31:59 +00:00
|
|
|
#define V_filter_mask_in VNET(filter_mask_in)
|
|
|
|
#define V_bpf_mask_in VNET(bpf_mask_in)
|
|
|
|
#define V_filter_mask_out VNET(filter_mask_out)
|
|
|
|
#define V_bpf_mask_out VNET(bpf_mask_out)
|
2007-11-28 22:33:53 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
|
2011-11-07 15:43:11 +00:00
|
|
|
static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
|
|
|
|
static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
|
2015-11-25 07:31:59 +00:00
|
|
|
SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
|
|
|
|
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
|
|
|
|
"IPsec input firewall filter mask");
|
|
|
|
SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
|
|
|
|
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
|
|
|
|
"IPsec input bpf mask");
|
|
|
|
SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
|
|
|
|
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
|
|
|
|
"IPsec output firewall filter mask");
|
|
|
|
SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
|
|
|
|
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
|
|
|
|
"IPsec output bpf mask");
|
2007-11-28 22:33:53 +00:00
|
|
|
|
2006-07-04 23:09:11 +00:00
|
|
|
static void
|
2006-06-26 22:30:08 +00:00
|
|
|
enc_clone_destroy(struct ifnet *ifp)
|
|
|
|
{
|
2015-11-25 07:31:59 +00:00
|
|
|
struct enc_softc *sc;
|
2006-06-26 22:30:08 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
sc = ifp->if_softc;
|
|
|
|
KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
|
|
|
|
|
2006-06-26 22:30:08 +00:00
|
|
|
bpfdetach(ifp);
|
|
|
|
if_detach(ifp);
|
|
|
|
if_free(ifp);
|
2015-11-25 07:31:59 +00:00
|
|
|
free(sc, M_DEVBUF);
|
|
|
|
V_enc_sc = NULL;
|
2006-06-26 22:30:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2006-07-10 05:24:06 +00:00
|
|
|
enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
|
2006-06-26 22:30:08 +00:00
|
|
|
{
|
|
|
|
struct ifnet *ifp;
|
|
|
|
struct enc_softc *sc;
|
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
|
|
|
|
M_WAITOK | M_ZERO);
|
2006-06-26 22:30:08 +00:00
|
|
|
ifp = sc->sc_ifp = if_alloc(IFT_ENC);
|
|
|
|
if (ifp == NULL) {
|
|
|
|
free(sc, M_DEVBUF);
|
|
|
|
return (ENOSPC);
|
|
|
|
}
|
2015-11-25 07:31:59 +00:00
|
|
|
if (V_enc_sc != NULL) {
|
|
|
|
if_free(ifp);
|
|
|
|
free(sc, M_DEVBUF);
|
|
|
|
return (EEXIST);
|
|
|
|
}
|
|
|
|
V_enc_sc = sc;
|
2012-10-16 13:37:54 +00:00
|
|
|
if_initname(ifp, encname, unit);
|
2006-06-26 22:30:08 +00:00
|
|
|
ifp->if_mtu = ENCMTU;
|
|
|
|
ifp->if_ioctl = enc_ioctl;
|
|
|
|
ifp->if_output = enc_output;
|
|
|
|
ifp->if_softc = sc;
|
|
|
|
if_attach(ifp);
|
2006-06-27 01:53:12 +00:00
|
|
|
bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
|
2006-06-26 22:30:08 +00:00
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
2013-04-26 12:50:32 +00:00
|
|
|
enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
|
2009-04-16 20:30:28 +00:00
|
|
|
struct route *ro)
|
2006-06-26 22:30:08 +00:00
|
|
|
{
|
2015-11-25 07:31:59 +00:00
|
|
|
|
2006-06-26 22:30:08 +00:00
|
|
|
m_freem(m);
|
|
|
|
return (0);
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
|
|
|
|
{
|
2006-06-28 21:57:35 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
if (cmd != SIOCSIFFLAGS)
|
|
|
|
return (EINVAL);
|
|
|
|
if (ifp->if_flags & IFF_UP)
|
|
|
|
ifp->if_drv_flags |= IFF_DRV_RUNNING;
|
|
|
|
else
|
|
|
|
ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
|
|
|
|
return (0);
|
2006-06-26 22:30:08 +00:00
|
|
|
}
|
|
|
|
|
2017-08-09 12:24:07 +00:00
|
|
|
static void
|
|
|
|
enc_bpftap(struct ifnet *ifp, struct mbuf *m, const struct secasvar *sav,
|
|
|
|
int32_t hhook_type, uint8_t enc, uint8_t af)
|
|
|
|
{
|
|
|
|
struct enchdr hdr;
|
|
|
|
|
|
|
|
if (hhook_type == HHOOK_TYPE_IPSEC_IN &&
|
|
|
|
(enc & V_bpf_mask_in) == 0)
|
|
|
|
return;
|
|
|
|
else if (hhook_type == HHOOK_TYPE_IPSEC_OUT &&
|
|
|
|
(enc & V_bpf_mask_out) == 0)
|
|
|
|
return;
|
|
|
|
if (bpf_peers_present(ifp->if_bpf) == 0)
|
|
|
|
return;
|
|
|
|
hdr.af = af;
|
|
|
|
hdr.spi = sav->spi;
|
|
|
|
hdr.flags = 0;
|
|
|
|
if (sav->alg_enc != SADB_EALG_NONE)
|
|
|
|
hdr.flags |= M_CONF;
|
|
|
|
if (sav->alg_auth != SADB_AALG_NONE)
|
|
|
|
hdr.flags |= M_AUTH;
|
|
|
|
bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), m);
|
|
|
|
}
|
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
/*
|
|
|
|
* One helper hook function is used by any hook points.
|
|
|
|
* + from hhook_type we can determine the packet direction:
|
|
|
|
* HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
|
|
|
|
* + from hhook_id we can determine address family: AF_INET or AF_INET6;
|
|
|
|
* + udata contains pointer to enc_softc;
|
|
|
|
* + ctx_data contains pointer to struct ipsec_ctx_data.
|
|
|
|
*/
|
|
|
|
static int
|
|
|
|
enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
|
|
|
|
void *hdata, struct osd *hosd)
|
2006-06-26 22:30:08 +00:00
|
|
|
{
|
2015-11-25 07:31:59 +00:00
|
|
|
struct ipsec_ctx_data *ctx;
|
|
|
|
struct enc_softc *sc;
|
|
|
|
struct ifnet *ifp, *rcvif;
|
|
|
|
struct pfil_head *ph;
|
|
|
|
int pdir;
|
2006-06-28 21:57:35 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
sc = (struct enc_softc *)udata;
|
|
|
|
ifp = sc->sc_ifp;
|
|
|
|
if ((ifp->if_flags & IFF_UP) == 0)
|
2006-06-26 22:30:08 +00:00
|
|
|
return (0);
|
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
ctx = (struct ipsec_ctx_data *)ctx_data;
|
|
|
|
/* XXX: wrong hook point was used by caller? */
|
|
|
|
if (ctx->af != hhook_id)
|
|
|
|
return (EPFNOSUPPORT);
|
|
|
|
|
2017-08-09 12:24:07 +00:00
|
|
|
enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type, ctx->enc, ctx->af);
|
2015-11-25 07:31:59 +00:00
|
|
|
switch (hhook_type) {
|
|
|
|
case HHOOK_TYPE_IPSEC_IN:
|
|
|
|
if (ctx->enc == IPSEC_ENC_BEFORE) {
|
|
|
|
/* Do accounting only once */
|
|
|
|
if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
|
|
|
|
if_inc_counter(ifp, IFCOUNTER_IBYTES,
|
|
|
|
(*ctx->mp)->m_pkthdr.len);
|
|
|
|
}
|
|
|
|
if ((ctx->enc & V_filter_mask_in) == 0)
|
|
|
|
return (0); /* skip pfil processing */
|
|
|
|
pdir = PFIL_IN;
|
|
|
|
break;
|
|
|
|
case HHOOK_TYPE_IPSEC_OUT:
|
|
|
|
if (ctx->enc == IPSEC_ENC_BEFORE) {
|
|
|
|
/* Do accounting only once */
|
|
|
|
if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
|
|
|
|
if_inc_counter(ifp, IFCOUNTER_OBYTES,
|
|
|
|
(*ctx->mp)->m_pkthdr.len);
|
|
|
|
}
|
|
|
|
if ((ctx->enc & V_filter_mask_out) == 0)
|
|
|
|
return (0); /* skip pfil processing */
|
|
|
|
pdir = PFIL_OUT;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return (EINVAL);
|
|
|
|
}
|
|
|
|
|
|
|
|
switch (hhook_id) {
|
2011-04-27 19:30:44 +00:00
|
|
|
#ifdef INET
|
2015-11-25 07:31:59 +00:00
|
|
|
case AF_INET:
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
ph = V_inet_pfil_head;
|
2015-11-25 07:31:59 +00:00
|
|
|
break;
|
2011-04-27 19:30:44 +00:00
|
|
|
#endif
|
2006-06-26 22:30:08 +00:00
|
|
|
#ifdef INET6
|
2015-11-25 07:31:59 +00:00
|
|
|
case AF_INET6:
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
ph = V_inet6_pfil_head;
|
2015-11-25 07:31:59 +00:00
|
|
|
break;
|
2006-06-26 22:30:08 +00:00
|
|
|
#endif
|
2015-11-25 07:31:59 +00:00
|
|
|
default:
|
|
|
|
ph = NULL;
|
|
|
|
}
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
if (ph == NULL || (pdir == PFIL_OUT && !PFIL_HOOKED_OUT(ph)) ||
|
|
|
|
(pdir == PFIL_IN && !PFIL_HOOKED_IN(ph)))
|
2006-06-26 22:30:08 +00:00
|
|
|
return (0);
|
2015-11-25 07:31:59 +00:00
|
|
|
/* Make a packet looks like it was received on enc(4) */
|
|
|
|
rcvif = (*ctx->mp)->m_pkthdr.rcvif;
|
|
|
|
(*ctx->mp)->m_pkthdr.rcvif = ifp;
|
New pfil(9) KPI together with newborn pfil API and control utility.
The KPI have been reviewed and cleansed of features that were planned
back 20 years ago and never implemented. The pfil(9) internals have
been made opaque to protocols with only returned types and function
declarations exposed. The KPI is made more strict, but at the same time
more extensible, as kernel uses same command structures that userland
ioctl uses.
In nutshell [KA]PI is about declaring filtering points, declaring
filters and linking and unlinking them together.
New [KA]PI makes it possible to reconfigure pfil(9) configuration:
change order of hooks, rehook filter from one filtering point to a
different one, disconnect a hook on output leaving it on input only,
prepend/append a filter to existing list of filters.
Now it possible for a single packet filter to provide multiple rulesets
that may be linked to different points. Think of per-interface ACLs in
Cisco or Juniper. None of existing packet filters yet support that,
however limited usage is already possible, e.g. default ruleset can
be moved to single interface, as soon as interface would pride their
filtering points.
Another future feature is possiblity to create pfil heads, that provide
not an mbuf pointer but just a memory pointer with length. That would
allow filtering at very early stages of a packet lifecycle, e.g. when
packet has just been received by a NIC and no mbuf was yet allocated.
Differential Revision: https://reviews.freebsd.org/D18951
2019-01-31 23:01:03 +00:00
|
|
|
if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, ctx->inp) != PFIL_PASS) {
|
2015-11-25 07:31:59 +00:00
|
|
|
*ctx->mp = NULL; /* consumed by filter */
|
|
|
|
return (EACCES);
|
2006-06-26 22:30:08 +00:00
|
|
|
}
|
2015-11-25 07:31:59 +00:00
|
|
|
(*ctx->mp)->m_pkthdr.rcvif = rcvif;
|
2017-08-09 12:24:07 +00:00
|
|
|
enc_bpftap(ifp, *ctx->mp, ctx->sav, hhook_type,
|
|
|
|
IPSEC_ENC_AFTER_PFIL, ctx->af);
|
2015-11-25 07:31:59 +00:00
|
|
|
return (0);
|
|
|
|
}
|
2006-06-26 22:30:08 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
static int
|
|
|
|
enc_add_hhooks(struct enc_softc *sc)
|
|
|
|
{
|
|
|
|
struct hookinfo hki;
|
|
|
|
int error;
|
2006-06-26 22:30:08 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
error = EPFNOSUPPORT;
|
|
|
|
hki.hook_func = enc_hhook;
|
|
|
|
hki.hook_helper = NULL;
|
|
|
|
hki.hook_udata = sc;
|
2011-04-27 19:30:44 +00:00
|
|
|
#ifdef INET
|
2015-11-25 07:31:59 +00:00
|
|
|
hki.hook_id = AF_INET;
|
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
|
|
|
|
error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
|
|
|
|
&hki, HHOOK_WAITOK);
|
|
|
|
if (error != 0)
|
|
|
|
return (error);
|
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
|
|
|
|
error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
|
|
|
|
&hki, HHOOK_WAITOK);
|
|
|
|
if (error != 0)
|
|
|
|
return (error);
|
2011-04-27 19:30:44 +00:00
|
|
|
#endif
|
2006-06-26 22:30:08 +00:00
|
|
|
#ifdef INET6
|
2015-11-25 07:31:59 +00:00
|
|
|
hki.hook_id = AF_INET6;
|
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
|
|
|
|
error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
|
|
|
|
&hki, HHOOK_WAITOK);
|
|
|
|
if (error != 0)
|
2006-06-26 22:30:08 +00:00
|
|
|
return (error);
|
2015-11-25 07:31:59 +00:00
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
|
|
|
|
error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
|
|
|
|
&hki, HHOOK_WAITOK);
|
2006-06-26 22:30:08 +00:00
|
|
|
if (error != 0)
|
2015-11-25 07:31:59 +00:00
|
|
|
return (error);
|
|
|
|
#endif
|
2006-06-26 22:30:08 +00:00
|
|
|
return (error);
|
2015-11-25 07:31:59 +00:00
|
|
|
}
|
2006-06-26 22:30:08 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
static void
|
|
|
|
enc_remove_hhooks(struct enc_softc *sc)
|
|
|
|
{
|
|
|
|
struct hookinfo hki;
|
|
|
|
|
|
|
|
hki.hook_func = enc_hhook;
|
|
|
|
hki.hook_helper = NULL;
|
|
|
|
hki.hook_udata = sc;
|
|
|
|
#ifdef INET
|
|
|
|
hki.hook_id = AF_INET;
|
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
|
|
|
|
hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
|
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
|
|
|
|
hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
|
|
|
|
#endif
|
|
|
|
#ifdef INET6
|
|
|
|
hki.hook_id = AF_INET6;
|
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
|
|
|
|
hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
|
|
|
|
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
|
|
|
|
hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
|
|
|
|
#endif
|
2006-06-26 22:30:08 +00:00
|
|
|
}
|
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
static void
|
|
|
|
vnet_enc_init(const void *unused __unused)
|
2006-06-26 22:30:08 +00:00
|
|
|
{
|
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
V_enc_sc = NULL;
|
|
|
|
V_enc_cloner = if_clone_simple(encname, enc_clone_create,
|
|
|
|
enc_clone_destroy, 1);
|
|
|
|
}
|
Get closer to a VIMAGE network stack teardown from top to bottom rather
than removing the network interfaces first. This change is rather larger
and convoluted as the ordering requirements cannot be separated.
Move the pfil(9) framework to SI_SUB_PROTO_PFIL, move Firewalls and
related modules to their own SI_SUB_PROTO_FIREWALL.
Move initialization of "physical" interfaces to SI_SUB_DRIVERS,
move virtual (cloned) interfaces to SI_SUB_PSEUDO.
Move Multicast to SI_SUB_PROTO_MC.
Re-work parts of multicast initialisation and teardown, not taking the
huge amount of memory into account if used as a module yet.
For interface teardown we try to do as many of them as we can on
SI_SUB_INIT_IF, but for some this makes no sense, e.g., when tunnelling
over a higher layer protocol such as IP. In that case the interface
has to go along (or before) the higher layer protocol is shutdown.
Kernel hhooks need to go last on teardown as they may be used at various
higher layers and we cannot remove them before we cleaned up the higher
layers.
For interface teardown there are multiple paths:
(a) a cloned interface is destroyed (inside a VIMAGE or in the base system),
(b) any interface is moved from a virtual network stack to a different
network stack ("vmove"), or (c) a virtual network stack is being shut down.
All code paths go through if_detach_internal() where we, depending on the
vmove flag or the vnet state, make a decision on how much to shut down;
in case we are destroying a VNET the individual protocol layers will
cleanup their own parts thus we cannot do so again for each interface as
we end up with, e.g., double-frees, destroying locks twice or acquiring
already destroyed locks.
When calling into protocol cleanups we equally have to tell them
whether they need to detach upper layer protocols ("ulp") or not
(e.g., in6_ifdetach()).
Provide or enahnce helper functions to do proper cleanup at a protocol
rather than at an interface level.
Approved by: re (hrs)
Obtained from: projects/vnet
Reviewed by: gnn, jhb
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D6747
2016-06-21 13:48:49 +00:00
|
|
|
VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
|
2015-11-25 07:31:59 +00:00
|
|
|
vnet_enc_init, NULL);
|
2006-06-26 22:30:08 +00:00
|
|
|
|
Get closer to a VIMAGE network stack teardown from top to bottom rather
than removing the network interfaces first. This change is rather larger
and convoluted as the ordering requirements cannot be separated.
Move the pfil(9) framework to SI_SUB_PROTO_PFIL, move Firewalls and
related modules to their own SI_SUB_PROTO_FIREWALL.
Move initialization of "physical" interfaces to SI_SUB_DRIVERS,
move virtual (cloned) interfaces to SI_SUB_PSEUDO.
Move Multicast to SI_SUB_PROTO_MC.
Re-work parts of multicast initialisation and teardown, not taking the
huge amount of memory into account if used as a module yet.
For interface teardown we try to do as many of them as we can on
SI_SUB_INIT_IF, but for some this makes no sense, e.g., when tunnelling
over a higher layer protocol such as IP. In that case the interface
has to go along (or before) the higher layer protocol is shutdown.
Kernel hhooks need to go last on teardown as they may be used at various
higher layers and we cannot remove them before we cleaned up the higher
layers.
For interface teardown there are multiple paths:
(a) a cloned interface is destroyed (inside a VIMAGE or in the base system),
(b) any interface is moved from a virtual network stack to a different
network stack ("vmove"), or (c) a virtual network stack is being shut down.
All code paths go through if_detach_internal() where we, depending on the
vmove flag or the vnet state, make a decision on how much to shut down;
in case we are destroying a VNET the individual protocol layers will
cleanup their own parts thus we cannot do so again for each interface as
we end up with, e.g., double-frees, destroying locks twice or acquiring
already destroyed locks.
When calling into protocol cleanups we equally have to tell them
whether they need to detach upper layer protocols ("ulp") or not
(e.g., in6_ifdetach()).
Provide or enahnce helper functions to do proper cleanup at a protocol
rather than at an interface level.
Approved by: re (hrs)
Obtained from: projects/vnet
Reviewed by: gnn, jhb
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D6747
2016-06-21 13:48:49 +00:00
|
|
|
static void
|
|
|
|
vnet_enc_init_proto(void *unused __unused)
|
|
|
|
{
|
|
|
|
KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
|
|
|
|
|
|
|
|
if (enc_add_hhooks(V_enc_sc) != 0)
|
|
|
|
enc_clone_destroy(V_enc_sc->sc_ifp);
|
|
|
|
}
|
|
|
|
VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
|
|
|
|
vnet_enc_init_proto, NULL);
|
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
static void
|
|
|
|
vnet_enc_uninit(const void *unused __unused)
|
|
|
|
{
|
Get closer to a VIMAGE network stack teardown from top to bottom rather
than removing the network interfaces first. This change is rather larger
and convoluted as the ordering requirements cannot be separated.
Move the pfil(9) framework to SI_SUB_PROTO_PFIL, move Firewalls and
related modules to their own SI_SUB_PROTO_FIREWALL.
Move initialization of "physical" interfaces to SI_SUB_DRIVERS,
move virtual (cloned) interfaces to SI_SUB_PSEUDO.
Move Multicast to SI_SUB_PROTO_MC.
Re-work parts of multicast initialisation and teardown, not taking the
huge amount of memory into account if used as a module yet.
For interface teardown we try to do as many of them as we can on
SI_SUB_INIT_IF, but for some this makes no sense, e.g., when tunnelling
over a higher layer protocol such as IP. In that case the interface
has to go along (or before) the higher layer protocol is shutdown.
Kernel hhooks need to go last on teardown as they may be used at various
higher layers and we cannot remove them before we cleaned up the higher
layers.
For interface teardown there are multiple paths:
(a) a cloned interface is destroyed (inside a VIMAGE or in the base system),
(b) any interface is moved from a virtual network stack to a different
network stack ("vmove"), or (c) a virtual network stack is being shut down.
All code paths go through if_detach_internal() where we, depending on the
vmove flag or the vnet state, make a decision on how much to shut down;
in case we are destroying a VNET the individual protocol layers will
cleanup their own parts thus we cannot do so again for each interface as
we end up with, e.g., double-frees, destroying locks twice or acquiring
already destroyed locks.
When calling into protocol cleanups we equally have to tell them
whether they need to detach upper layer protocols ("ulp") or not
(e.g., in6_ifdetach()).
Provide or enahnce helper functions to do proper cleanup at a protocol
rather than at an interface level.
Approved by: re (hrs)
Obtained from: projects/vnet
Reviewed by: gnn, jhb
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D6747
2016-06-21 13:48:49 +00:00
|
|
|
KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
|
2006-06-26 22:30:08 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
if_clone_detach(V_enc_cloner);
|
|
|
|
}
|
Get closer to a VIMAGE network stack teardown from top to bottom rather
than removing the network interfaces first. This change is rather larger
and convoluted as the ordering requirements cannot be separated.
Move the pfil(9) framework to SI_SUB_PROTO_PFIL, move Firewalls and
related modules to their own SI_SUB_PROTO_FIREWALL.
Move initialization of "physical" interfaces to SI_SUB_DRIVERS,
move virtual (cloned) interfaces to SI_SUB_PSEUDO.
Move Multicast to SI_SUB_PROTO_MC.
Re-work parts of multicast initialisation and teardown, not taking the
huge amount of memory into account if used as a module yet.
For interface teardown we try to do as many of them as we can on
SI_SUB_INIT_IF, but for some this makes no sense, e.g., when tunnelling
over a higher layer protocol such as IP. In that case the interface
has to go along (or before) the higher layer protocol is shutdown.
Kernel hhooks need to go last on teardown as they may be used at various
higher layers and we cannot remove them before we cleaned up the higher
layers.
For interface teardown there are multiple paths:
(a) a cloned interface is destroyed (inside a VIMAGE or in the base system),
(b) any interface is moved from a virtual network stack to a different
network stack ("vmove"), or (c) a virtual network stack is being shut down.
All code paths go through if_detach_internal() where we, depending on the
vmove flag or the vnet state, make a decision on how much to shut down;
in case we are destroying a VNET the individual protocol layers will
cleanup their own parts thus we cannot do so again for each interface as
we end up with, e.g., double-frees, destroying locks twice or acquiring
already destroyed locks.
When calling into protocol cleanups we equally have to tell them
whether they need to detach upper layer protocols ("ulp") or not
(e.g., in6_ifdetach()).
Provide or enahnce helper functions to do proper cleanup at a protocol
rather than at an interface level.
Approved by: re (hrs)
Obtained from: projects/vnet
Reviewed by: gnn, jhb
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D6747
2016-06-21 13:48:49 +00:00
|
|
|
VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
|
2015-11-25 07:31:59 +00:00
|
|
|
vnet_enc_uninit, NULL);
|
2007-11-28 22:33:53 +00:00
|
|
|
|
Get closer to a VIMAGE network stack teardown from top to bottom rather
than removing the network interfaces first. This change is rather larger
and convoluted as the ordering requirements cannot be separated.
Move the pfil(9) framework to SI_SUB_PROTO_PFIL, move Firewalls and
related modules to their own SI_SUB_PROTO_FIREWALL.
Move initialization of "physical" interfaces to SI_SUB_DRIVERS,
move virtual (cloned) interfaces to SI_SUB_PSEUDO.
Move Multicast to SI_SUB_PROTO_MC.
Re-work parts of multicast initialisation and teardown, not taking the
huge amount of memory into account if used as a module yet.
For interface teardown we try to do as many of them as we can on
SI_SUB_INIT_IF, but for some this makes no sense, e.g., when tunnelling
over a higher layer protocol such as IP. In that case the interface
has to go along (or before) the higher layer protocol is shutdown.
Kernel hhooks need to go last on teardown as they may be used at various
higher layers and we cannot remove them before we cleaned up the higher
layers.
For interface teardown there are multiple paths:
(a) a cloned interface is destroyed (inside a VIMAGE or in the base system),
(b) any interface is moved from a virtual network stack to a different
network stack ("vmove"), or (c) a virtual network stack is being shut down.
All code paths go through if_detach_internal() where we, depending on the
vmove flag or the vnet state, make a decision on how much to shut down;
in case we are destroying a VNET the individual protocol layers will
cleanup their own parts thus we cannot do so again for each interface as
we end up with, e.g., double-frees, destroying locks twice or acquiring
already destroyed locks.
When calling into protocol cleanups we equally have to tell them
whether they need to detach upper layer protocols ("ulp") or not
(e.g., in6_ifdetach()).
Provide or enahnce helper functions to do proper cleanup at a protocol
rather than at an interface level.
Approved by: re (hrs)
Obtained from: projects/vnet
Reviewed by: gnn, jhb
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D6747
2016-06-21 13:48:49 +00:00
|
|
|
/*
|
|
|
|
* The hhook consumer needs to go before ip[6]_destroy are called on
|
|
|
|
* SI_ORDER_THIRD.
|
|
|
|
*/
|
|
|
|
static void
|
|
|
|
vnet_enc_uninit_hhook(const void *unused __unused)
|
|
|
|
{
|
|
|
|
KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
|
|
|
|
|
|
|
|
enc_remove_hhooks(V_enc_sc);
|
|
|
|
}
|
|
|
|
VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
|
|
|
|
vnet_enc_uninit_hhook, NULL);
|
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
static int
|
|
|
|
enc_modevent(module_t mod, int type, void *data)
|
|
|
|
{
|
2006-06-26 22:30:08 +00:00
|
|
|
|
2015-11-25 07:31:59 +00:00
|
|
|
switch (type) {
|
|
|
|
case MOD_LOAD:
|
|
|
|
case MOD_UNLOAD:
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return (EOPNOTSUPP);
|
2006-06-26 22:30:08 +00:00
|
|
|
}
|
2015-11-25 07:31:59 +00:00
|
|
|
return (0);
|
2006-06-26 22:30:08 +00:00
|
|
|
}
|
2015-11-25 07:31:59 +00:00
|
|
|
|
|
|
|
static moduledata_t enc_mod = {
|
|
|
|
"if_enc",
|
|
|
|
enc_modevent,
|
|
|
|
0
|
|
|
|
};
|
|
|
|
|
Get closer to a VIMAGE network stack teardown from top to bottom rather
than removing the network interfaces first. This change is rather larger
and convoluted as the ordering requirements cannot be separated.
Move the pfil(9) framework to SI_SUB_PROTO_PFIL, move Firewalls and
related modules to their own SI_SUB_PROTO_FIREWALL.
Move initialization of "physical" interfaces to SI_SUB_DRIVERS,
move virtual (cloned) interfaces to SI_SUB_PSEUDO.
Move Multicast to SI_SUB_PROTO_MC.
Re-work parts of multicast initialisation and teardown, not taking the
huge amount of memory into account if used as a module yet.
For interface teardown we try to do as many of them as we can on
SI_SUB_INIT_IF, but for some this makes no sense, e.g., when tunnelling
over a higher layer protocol such as IP. In that case the interface
has to go along (or before) the higher layer protocol is shutdown.
Kernel hhooks need to go last on teardown as they may be used at various
higher layers and we cannot remove them before we cleaned up the higher
layers.
For interface teardown there are multiple paths:
(a) a cloned interface is destroyed (inside a VIMAGE or in the base system),
(b) any interface is moved from a virtual network stack to a different
network stack ("vmove"), or (c) a virtual network stack is being shut down.
All code paths go through if_detach_internal() where we, depending on the
vmove flag or the vnet state, make a decision on how much to shut down;
in case we are destroying a VNET the individual protocol layers will
cleanup their own parts thus we cannot do so again for each interface as
we end up with, e.g., double-frees, destroying locks twice or acquiring
already destroyed locks.
When calling into protocol cleanups we equally have to tell them
whether they need to detach upper layer protocols ("ulp") or not
(e.g., in6_ifdetach()).
Provide or enahnce helper functions to do proper cleanup at a protocol
rather than at an interface level.
Approved by: re (hrs)
Obtained from: projects/vnet
Reviewed by: gnn, jhb
Sponsored by: The FreeBSD Foundation
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D6747
2016-06-21 13:48:49 +00:00
|
|
|
DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
|
2017-03-27 07:56:41 +00:00
|
|
|
MODULE_VERSION(if_enc, 1);
|