Add a ng_ipfw node, implementing a quick and simple interface between
ipfw(4) and netgraph(4) facilities. Reviewed by: andre, brooks, julian
This commit is contained in:
parent
fbad9e2d95
commit
670742a102
@ -198,6 +198,8 @@ enum tokens {
|
|||||||
TOK_QUEUE,
|
TOK_QUEUE,
|
||||||
TOK_DIVERT,
|
TOK_DIVERT,
|
||||||
TOK_TEE,
|
TOK_TEE,
|
||||||
|
TOK_NETGRAPH,
|
||||||
|
TOK_NGTEE,
|
||||||
TOK_FORWARD,
|
TOK_FORWARD,
|
||||||
TOK_SKIPTO,
|
TOK_SKIPTO,
|
||||||
TOK_DENY,
|
TOK_DENY,
|
||||||
@ -300,6 +302,8 @@ struct _s_x rule_actions[] = {
|
|||||||
{ "queue", TOK_QUEUE },
|
{ "queue", TOK_QUEUE },
|
||||||
{ "divert", TOK_DIVERT },
|
{ "divert", TOK_DIVERT },
|
||||||
{ "tee", TOK_TEE },
|
{ "tee", TOK_TEE },
|
||||||
|
{ "netgraph", TOK_NETGRAPH },
|
||||||
|
{ "ngtee", TOK_NGTEE },
|
||||||
{ "fwd", TOK_FORWARD },
|
{ "fwd", TOK_FORWARD },
|
||||||
{ "forward", TOK_FORWARD },
|
{ "forward", TOK_FORWARD },
|
||||||
{ "skipto", TOK_SKIPTO },
|
{ "skipto", TOK_SKIPTO },
|
||||||
@ -1193,6 +1197,14 @@ show_ipfw(struct ip_fw *rule, int pcwidth, int bcwidth)
|
|||||||
printf("tee %u", cmd->arg1);
|
printf("tee %u", cmd->arg1);
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case O_NETGRAPH:
|
||||||
|
printf("netgraph %u", cmd->arg1);
|
||||||
|
break;
|
||||||
|
|
||||||
|
case O_NGTEE:
|
||||||
|
printf("ngtee %u", cmd->arg1);
|
||||||
|
break;
|
||||||
|
|
||||||
case O_FORWARD_IP:
|
case O_FORWARD_IP:
|
||||||
{
|
{
|
||||||
ipfw_insn_sa *s = (ipfw_insn_sa *)cmd;
|
ipfw_insn_sa *s = (ipfw_insn_sa *)cmd;
|
||||||
@ -3123,6 +3135,16 @@ add(int ac, char *av[])
|
|||||||
ac--; av++;
|
ac--; av++;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
case TOK_NETGRAPH:
|
||||||
|
case TOK_NGTEE:
|
||||||
|
action->opcode = (i == TOK_NETGRAPH ) ? O_NETGRAPH : O_NGTEE;
|
||||||
|
NEED1("missing netgraph cookie");
|
||||||
|
action->arg1 = strtoul(*av, NULL, 0);
|
||||||
|
if (action->arg1 == 0)
|
||||||
|
errx(EX_DATAERR, "illegal netgraph cookie");
|
||||||
|
ac--; av++;
|
||||||
|
break;
|
||||||
|
|
||||||
case TOK_FORWARD: {
|
case TOK_FORWARD: {
|
||||||
ipfw_insn_sa *p = (ipfw_insn_sa *)action;
|
ipfw_insn_sa *p = (ipfw_insn_sa *)action;
|
||||||
char *s, *end;
|
char *s, *end;
|
||||||
|
321
sys/netgraph/ng_ipfw.c
Normal file
321
sys/netgraph/ng_ipfw.c
Normal file
@ -0,0 +1,321 @@
|
|||||||
|
/*-
|
||||||
|
* Copyright 2005, Gleb Smirnoff <glebius@FreeBSD.org>
|
||||||
|
* All rights reserved.
|
||||||
|
*
|
||||||
|
* Redistribution and use in source and binary forms, with or without
|
||||||
|
* modification, are permitted provided that the following conditions
|
||||||
|
* are met:
|
||||||
|
* 1. Redistributions of source code must retain the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer.
|
||||||
|
* 2. Redistributions in binary form must reproduce the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer in the
|
||||||
|
* documentation and/or other materials provided with the distribution.
|
||||||
|
*
|
||||||
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||||
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||||
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||||
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||||
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||||
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||||
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||||
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
|
* SUCH DAMAGE.
|
||||||
|
*
|
||||||
|
* $FreeBSD$
|
||||||
|
*/
|
||||||
|
|
||||||
|
#include <sys/param.h>
|
||||||
|
#include <sys/systm.h>
|
||||||
|
#include <sys/kernel.h>
|
||||||
|
#include <sys/mbuf.h>
|
||||||
|
#include <sys/malloc.h>
|
||||||
|
#include <sys/ctype.h>
|
||||||
|
#include <sys/errno.h>
|
||||||
|
#include <sys/socket.h>
|
||||||
|
#include <sys/syslog.h>
|
||||||
|
|
||||||
|
#include <net/if.h>
|
||||||
|
|
||||||
|
#include <netinet/in.h>
|
||||||
|
#include <netinet/in_systm.h>
|
||||||
|
#include <netinet/in_var.h>
|
||||||
|
#include <netinet/ip_fw.h>
|
||||||
|
#include <netinet/ip.h>
|
||||||
|
#include <netinet/ip_var.h>
|
||||||
|
|
||||||
|
#include <netgraph/ng_message.h>
|
||||||
|
#include <netgraph/ng_parse.h>
|
||||||
|
#include <netgraph/ng_ipfw.h>
|
||||||
|
#include <netgraph/netgraph.h>
|
||||||
|
|
||||||
|
static int ng_ipfw_mod_event(module_t mod, int event, void *data);
|
||||||
|
static ng_constructor_t ng_ipfw_constructor;
|
||||||
|
static ng_shutdown_t ng_ipfw_shutdown;
|
||||||
|
static ng_newhook_t ng_ipfw_newhook;
|
||||||
|
static ng_connect_t ng_ipfw_connect;
|
||||||
|
static ng_findhook_t ng_ipfw_findhook;
|
||||||
|
static ng_rcvdata_t ng_ipfw_rcvdata;
|
||||||
|
static ng_disconnect_t ng_ipfw_disconnect;
|
||||||
|
|
||||||
|
static hook_p ng_ipfw_findhook1(node_p, u_int16_t );
|
||||||
|
static int ng_ipfw_input(struct mbuf **, int, struct ip_fw_args *,
|
||||||
|
int);
|
||||||
|
|
||||||
|
/* We have only one node */
|
||||||
|
static node_p fw_node;
|
||||||
|
|
||||||
|
/* Netgraph node type descriptor */
|
||||||
|
static struct ng_type ng_ipfw_typestruct = {
|
||||||
|
.version = NG_ABI_VERSION,
|
||||||
|
.name = NG_IPFW_NODE_TYPE,
|
||||||
|
.mod_event = ng_ipfw_mod_event,
|
||||||
|
.constructor = ng_ipfw_constructor,
|
||||||
|
.shutdown = ng_ipfw_shutdown,
|
||||||
|
.newhook = ng_ipfw_newhook,
|
||||||
|
.connect = ng_ipfw_connect,
|
||||||
|
.findhook = ng_ipfw_findhook,
|
||||||
|
.rcvdata = ng_ipfw_rcvdata,
|
||||||
|
.disconnect = ng_ipfw_disconnect,
|
||||||
|
};
|
||||||
|
NETGRAPH_INIT(ipfw, &ng_ipfw_typestruct);
|
||||||
|
MODULE_DEPEND(ng_ipfw, ipfw, 2, 2, 2);
|
||||||
|
|
||||||
|
/* Information we store for each hook */
|
||||||
|
struct ng_ipfw_hook_priv {
|
||||||
|
hook_p hook;
|
||||||
|
u_int16_t rulenum;
|
||||||
|
};
|
||||||
|
typedef struct ng_ipfw_hook_priv *hpriv_p;
|
||||||
|
|
||||||
|
static int
|
||||||
|
ng_ipfw_mod_event(module_t mod, int event, void *data)
|
||||||
|
{
|
||||||
|
int error = 0;
|
||||||
|
|
||||||
|
switch (event) {
|
||||||
|
case MOD_LOAD:
|
||||||
|
|
||||||
|
if (ng_ipfw_input_p != NULL) {
|
||||||
|
error = EEXIST;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Setup node without any private data */
|
||||||
|
if ((error = ng_make_node_common(&ng_ipfw_typestruct, &fw_node))
|
||||||
|
!= 0) {
|
||||||
|
log(LOG_ERR, "%s: can't create ng_ipfw node", __func__);
|
||||||
|
break;
|
||||||
|
};
|
||||||
|
|
||||||
|
/* Try to name node */
|
||||||
|
if (ng_name_node(fw_node, "ipfw") != 0)
|
||||||
|
log(LOG_WARNING, "%s: failed to name node \"ipfw\"",
|
||||||
|
__func__);
|
||||||
|
|
||||||
|
/* Register hook */
|
||||||
|
ng_ipfw_input_p = ng_ipfw_input;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case MOD_UNLOAD:
|
||||||
|
/*
|
||||||
|
* This won't happen if a node exists.
|
||||||
|
* ng_ipfw_input_p is already cleared.
|
||||||
|
*/
|
||||||
|
break;
|
||||||
|
|
||||||
|
default:
|
||||||
|
error = EOPNOTSUPP;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
|
||||||
|
return (error);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
ng_ipfw_constructor(node_p node)
|
||||||
|
{
|
||||||
|
return (EINVAL); /* Only one node */
|
||||||
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
ng_ipfw_newhook(node_p node, hook_p hook, const char *name)
|
||||||
|
{
|
||||||
|
hpriv_p hpriv;
|
||||||
|
u_int16_t rulenum;
|
||||||
|
const char *cp;
|
||||||
|
char c;
|
||||||
|
int len;
|
||||||
|
|
||||||
|
/* Check that name contains only digits */
|
||||||
|
for (len = strlen(name), cp = name, c = *cp; len > 0; c =*++cp, len--)
|
||||||
|
if (!isdigit(c))
|
||||||
|
return (EINVAL);
|
||||||
|
|
||||||
|
/* Convert it to integer */
|
||||||
|
if ((rulenum = (u_int16_t)strtol(name, NULL, 10)) == 0)
|
||||||
|
return (EINVAL);
|
||||||
|
|
||||||
|
/* Allocate memory for this hook's private data */
|
||||||
|
MALLOC(hpriv, hpriv_p, sizeof(*hpriv), M_NETGRAPH, M_NOWAIT | M_ZERO);
|
||||||
|
if (hpriv== NULL)
|
||||||
|
return (ENOMEM);
|
||||||
|
|
||||||
|
hpriv->hook = hook;
|
||||||
|
hpriv->rulenum = rulenum;
|
||||||
|
|
||||||
|
NG_HOOK_SET_PRIVATE(hook, hpriv);
|
||||||
|
|
||||||
|
return(0);
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Set hooks into queueing mode, to avoid recursion between
|
||||||
|
* netgraph layer and ip_{input,output}.
|
||||||
|
*/
|
||||||
|
static int
|
||||||
|
ng_ipfw_connect(hook_p hook)
|
||||||
|
{
|
||||||
|
NG_HOOK_FORCE_QUEUE(hook);
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Look up hook by name */
|
||||||
|
hook_p
|
||||||
|
ng_ipfw_findhook(node_p node, const char *name)
|
||||||
|
{
|
||||||
|
u_int16_t n; /* numeric representation of hook */
|
||||||
|
|
||||||
|
if ((n = (u_int16_t)strtol(name, NULL, 10)) == 0)
|
||||||
|
return NULL;
|
||||||
|
return ng_ipfw_findhook1(node, n);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Look up hook by rule number */
|
||||||
|
static hook_p
|
||||||
|
ng_ipfw_findhook1(node_p node, u_int16_t rulenum)
|
||||||
|
{
|
||||||
|
hook_p hook;
|
||||||
|
hpriv_p hpriv;
|
||||||
|
|
||||||
|
LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
|
||||||
|
hpriv = NG_HOOK_PRIVATE(hook);
|
||||||
|
if (NG_HOOK_IS_VALID(hook) && (hpriv->rulenum == rulenum))
|
||||||
|
return (hook);
|
||||||
|
}
|
||||||
|
|
||||||
|
return (NULL);
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
static int
|
||||||
|
ng_ipfw_rcvdata(hook_p hook, item_p item)
|
||||||
|
{
|
||||||
|
struct ng_ipfw_tag *ngit;
|
||||||
|
struct mbuf *m;
|
||||||
|
|
||||||
|
NGI_GET_M(item, m);
|
||||||
|
NG_FREE_ITEM(item);
|
||||||
|
|
||||||
|
if ((ngit = (struct ng_ipfw_tag *)m_tag_locate(m, NGM_IPFW_COOKIE, 0,
|
||||||
|
NULL)) == NULL) {
|
||||||
|
NG_FREE_M(m);
|
||||||
|
return (EINVAL); /* XXX: find smth better */
|
||||||
|
};
|
||||||
|
|
||||||
|
switch (ngit->dir) {
|
||||||
|
case NG_IPFW_OUT:
|
||||||
|
return ip_output(m, NULL, NULL, ngit->flags, NULL, NULL);
|
||||||
|
|
||||||
|
case NG_IPFW_IN:
|
||||||
|
{
|
||||||
|
struct ip *ip;
|
||||||
|
|
||||||
|
ip = mtod(m, struct ip *);
|
||||||
|
ip->ip_len = htons(ip->ip_len);
|
||||||
|
ip->ip_off = htons(ip->ip_off);
|
||||||
|
ip_input(m);
|
||||||
|
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
default:
|
||||||
|
panic("ng_ipfw_rcvdata: bad dir %u", ngit->dir);
|
||||||
|
}
|
||||||
|
|
||||||
|
/* not reached */
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
ng_ipfw_input(struct mbuf **m0, int dir, struct ip_fw_args *fwa, int tee)
|
||||||
|
{
|
||||||
|
struct mbuf *m;
|
||||||
|
struct ng_ipfw_tag *ngit;
|
||||||
|
hook_p hook;
|
||||||
|
int error = 0;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Node must be loaded and corresponding hook must be present.
|
||||||
|
*/
|
||||||
|
if (fw_node == NULL ||
|
||||||
|
(hook = ng_ipfw_findhook1(fw_node, fwa->cookie)) == NULL) {
|
||||||
|
if (tee == 0)
|
||||||
|
m_freem(*m0);
|
||||||
|
return (ESRCH); /* no hook associated with this rule */
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
* We have two modes: in normal mode we add a tag to packet, which is
|
||||||
|
* important to return packet back to IP stack. In tee mode we make
|
||||||
|
* a copy of a packet and forward it into netgraph without a tag.
|
||||||
|
*/
|
||||||
|
if (tee == 0) {
|
||||||
|
m = *m0;
|
||||||
|
*m0 = NULL; /* it belongs now to netgraph */
|
||||||
|
|
||||||
|
if ((ngit = (struct ng_ipfw_tag *)m_tag_alloc(NGM_IPFW_COOKIE,
|
||||||
|
0, TAGSIZ, M_NOWAIT|M_ZERO)) == NULL) {
|
||||||
|
m_freem(m);
|
||||||
|
return (ENOMEM);
|
||||||
|
}
|
||||||
|
ngit->rule = fwa->rule;
|
||||||
|
ngit->dir = dir;
|
||||||
|
ngit->ifp = fwa->oif;
|
||||||
|
if (dir == NG_IPFW_OUT)
|
||||||
|
ngit->flags = fwa->flags;
|
||||||
|
m_tag_prepend(m, &ngit->mt);
|
||||||
|
|
||||||
|
} else
|
||||||
|
if ((m = m_dup(*m0, M_DONTWAIT)) == NULL)
|
||||||
|
return (ENOMEM); /* which is ignored */
|
||||||
|
|
||||||
|
NG_SEND_DATA_ONLY(error, hook, m);
|
||||||
|
|
||||||
|
return (error);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
ng_ipfw_shutdown(node_p node)
|
||||||
|
{
|
||||||
|
|
||||||
|
/*
|
||||||
|
* After our single node has been removed,
|
||||||
|
* the only thing that can be done is
|
||||||
|
* 'kldunload ng_ipfw.ko'
|
||||||
|
*/
|
||||||
|
ng_ipfw_input_p = NULL;
|
||||||
|
NG_NODE_UNREF(node);
|
||||||
|
return (0);
|
||||||
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
ng_ipfw_disconnect(hook_p hook)
|
||||||
|
{
|
||||||
|
const hpriv_p hpriv = NG_HOOK_PRIVATE(hook);
|
||||||
|
|
||||||
|
FREE(hpriv, M_NETGRAPH);
|
||||||
|
NG_HOOK_SET_PRIVATE(hook, NULL);
|
||||||
|
|
||||||
|
return (0);
|
||||||
|
}
|
50
sys/netgraph/ng_ipfw.h
Normal file
50
sys/netgraph/ng_ipfw.h
Normal file
@ -0,0 +1,50 @@
|
|||||||
|
/*-
|
||||||
|
* Copyright 2005, Gleb Smirnoff <glebius@FreeBSD.org>
|
||||||
|
* All rights reserved.
|
||||||
|
*
|
||||||
|
* Redistribution and use in source and binary forms, with or without
|
||||||
|
* modification, are permitted provided that the following conditions
|
||||||
|
* are met:
|
||||||
|
* 1. Redistributions of source code must retain the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer.
|
||||||
|
* 2. Redistributions in binary form must reproduce the above copyright
|
||||||
|
* notice, this list of conditions and the following disclaimer in the
|
||||||
|
* documentation and/or other materials provided with the distribution.
|
||||||
|
*
|
||||||
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
||||||
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||||
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||||
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
||||||
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||||
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
||||||
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
||||||
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||||
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||||
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
||||||
|
* SUCH DAMAGE.
|
||||||
|
*
|
||||||
|
* $FreeBSD$
|
||||||
|
*/
|
||||||
|
|
||||||
|
#define NG_IPFW_NODE_TYPE "ipfw"
|
||||||
|
#define NGM_IPFW_COOKIE 1105988990
|
||||||
|
|
||||||
|
#ifdef _KERNEL
|
||||||
|
|
||||||
|
typedef int ng_ipfw_input_t(struct mbuf **, int, struct ip_fw_args *, int);
|
||||||
|
extern ng_ipfw_input_t *ng_ipfw_input_p;
|
||||||
|
#define NG_IPFW_LOADED (ng_ipfw_input_p != NULL)
|
||||||
|
|
||||||
|
struct ng_ipfw_tag {
|
||||||
|
struct m_tag mt; /* tag header */
|
||||||
|
struct ip_fw *rule; /* matching rule */
|
||||||
|
struct ifnet *ifp; /* interface, for ip_output */
|
||||||
|
int dir;
|
||||||
|
#define NG_IPFW_OUT 0
|
||||||
|
#define NG_IPFW_IN 1
|
||||||
|
int flags; /* flags, for ip_output (IPv6 ?) */
|
||||||
|
};
|
||||||
|
|
||||||
|
#define TAGSIZ (sizeof(struct ng_ipfw_tag) - sizeof(struct m_tag))
|
||||||
|
|
||||||
|
#endif /* _KERNEL */
|
@ -138,6 +138,12 @@ enum ipfw_opcodes { /* arguments (4 byte each) */
|
|||||||
O_DIVERTED, /* arg1=bitmap (1:loop, 2:out) */
|
O_DIVERTED, /* arg1=bitmap (1:loop, 2:out) */
|
||||||
O_TCPDATALEN, /* arg1 = tcp data len */
|
O_TCPDATALEN, /* arg1 = tcp data len */
|
||||||
|
|
||||||
|
/*
|
||||||
|
* actions for ng_ipfw
|
||||||
|
*/
|
||||||
|
O_NETGRAPH, /* send to ng_ipfw */
|
||||||
|
O_NGTEE, /* copy to ng_ipfw */
|
||||||
|
|
||||||
O_LAST_OPCODE /* not an opcode! */
|
O_LAST_OPCODE /* not an opcode! */
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -425,6 +431,7 @@ enum {
|
|||||||
IP_FW_TEE,
|
IP_FW_TEE,
|
||||||
IP_FW_DUMMYNET,
|
IP_FW_DUMMYNET,
|
||||||
IP_FW_NETGRAPH,
|
IP_FW_NETGRAPH,
|
||||||
|
IP_FW_NGTEE,
|
||||||
};
|
};
|
||||||
|
|
||||||
/* flags for divert mtag */
|
/* flags for divert mtag */
|
||||||
|
@ -77,6 +77,9 @@
|
|||||||
#include <netinet/tcpip.h>
|
#include <netinet/tcpip.h>
|
||||||
#include <netinet/udp.h>
|
#include <netinet/udp.h>
|
||||||
#include <netinet/udp_var.h>
|
#include <netinet/udp_var.h>
|
||||||
|
|
||||||
|
#include <netgraph/ng_ipfw.h>
|
||||||
|
|
||||||
#include <altq/if_altq.h>
|
#include <altq/if_altq.h>
|
||||||
|
|
||||||
#ifdef IPSEC
|
#ifdef IPSEC
|
||||||
@ -649,6 +652,14 @@ ipfw_log(struct ip_fw *f, u_int hlen, struct ether_header *eh,
|
|||||||
sa->sa.sin_port);
|
sa->sa.sin_port);
|
||||||
}
|
}
|
||||||
break;
|
break;
|
||||||
|
case O_NETGRAPH:
|
||||||
|
snprintf(SNPARGS(action2, 0), "Netgraph %d",
|
||||||
|
cmd->arg1);
|
||||||
|
break;
|
||||||
|
case O_NGTEE:
|
||||||
|
snprintf(SNPARGS(action2, 0), "Ngtee %d",
|
||||||
|
cmd->arg1);
|
||||||
|
break;
|
||||||
default:
|
default:
|
||||||
action = "UNKNOWN";
|
action = "UNKNOWN";
|
||||||
break;
|
break;
|
||||||
@ -2528,6 +2539,14 @@ ipfw_chk(struct ip_fw_args *args)
|
|||||||
retval = IP_FW_PASS;
|
retval = IP_FW_PASS;
|
||||||
goto done;
|
goto done;
|
||||||
|
|
||||||
|
case O_NETGRAPH:
|
||||||
|
case O_NGTEE:
|
||||||
|
args->rule = f; /* report matching rule */
|
||||||
|
args->cookie = cmd->arg1;
|
||||||
|
retval = (cmd->opcode == O_NETGRAPH) ?
|
||||||
|
IP_FW_NETGRAPH : IP_FW_NGTEE;
|
||||||
|
goto done;
|
||||||
|
|
||||||
default:
|
default:
|
||||||
panic("-- unknown opcode %d\n", cmd->opcode);
|
panic("-- unknown opcode %d\n", cmd->opcode);
|
||||||
} /* end of switch() on opcodes */
|
} /* end of switch() on opcodes */
|
||||||
@ -3108,6 +3127,10 @@ check_ipfw_struct(struct ip_fw *rule, int size)
|
|||||||
case O_TEE:
|
case O_TEE:
|
||||||
if (ip_divert_ptr == NULL)
|
if (ip_divert_ptr == NULL)
|
||||||
return EINVAL;
|
return EINVAL;
|
||||||
|
case O_NETGRAPH:
|
||||||
|
case O_NGTEE:
|
||||||
|
if (!NG_IPFW_LOADED)
|
||||||
|
return EINVAL;
|
||||||
case O_FORWARD_MAC: /* XXX not implemented yet */
|
case O_FORWARD_MAC: /* XXX not implemented yet */
|
||||||
case O_CHECK_STATE:
|
case O_CHECK_STATE:
|
||||||
case O_COUNT:
|
case O_COUNT:
|
||||||
|
@ -59,6 +59,8 @@
|
|||||||
#include <netinet/ip_divert.h>
|
#include <netinet/ip_divert.h>
|
||||||
#include <netinet/ip_dummynet.h>
|
#include <netinet/ip_dummynet.h>
|
||||||
|
|
||||||
|
#include <netgraph/ng_ipfw.h>
|
||||||
|
|
||||||
#include <machine/in_cksum.h>
|
#include <machine/in_cksum.h>
|
||||||
|
|
||||||
static int ipfw_pfil_hooked = 0;
|
static int ipfw_pfil_hooked = 0;
|
||||||
@ -69,6 +71,9 @@ ip_dn_ruledel_t *ip_dn_ruledel_ptr = NULL;
|
|||||||
/* Divert hooks. */
|
/* Divert hooks. */
|
||||||
ip_divert_packet_t *ip_divert_ptr = NULL;
|
ip_divert_packet_t *ip_divert_ptr = NULL;
|
||||||
|
|
||||||
|
/* ng_ipfw hooks. */
|
||||||
|
ng_ipfw_input_t *ng_ipfw_input_p = NULL;
|
||||||
|
|
||||||
/* Forward declarations. */
|
/* Forward declarations. */
|
||||||
static int ipfw_divert(struct mbuf **, int, int);
|
static int ipfw_divert(struct mbuf **, int, int);
|
||||||
#define DIV_DIR_IN 1
|
#define DIV_DIR_IN 1
|
||||||
@ -79,6 +84,7 @@ ipfw_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
|
|||||||
struct inpcb *inp)
|
struct inpcb *inp)
|
||||||
{
|
{
|
||||||
struct ip_fw_args args;
|
struct ip_fw_args args;
|
||||||
|
struct ng_ipfw_tag *ng_tag;
|
||||||
struct m_tag *dn_tag;
|
struct m_tag *dn_tag;
|
||||||
int ipfw = 0;
|
int ipfw = 0;
|
||||||
int divert;
|
int divert;
|
||||||
@ -104,6 +110,15 @@ ipfw_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
|
|||||||
m_tag_delete(*m0, dn_tag);
|
m_tag_delete(*m0, dn_tag);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ng_tag = (struct ng_ipfw_tag *)m_tag_locate(*m0, NGM_IPFW_COOKIE, 0,
|
||||||
|
NULL);
|
||||||
|
if (ng_tag != NULL) {
|
||||||
|
KASSERT(ng_tag->dir == NG_IPFW_IN,
|
||||||
|
("ng_ipfw tag with wrong direction"));
|
||||||
|
args.rule = ng_tag->rule;
|
||||||
|
m_tag_delete(*m0, (struct m_tag *)ng_tag);
|
||||||
|
}
|
||||||
|
|
||||||
again:
|
again:
|
||||||
args.m = *m0;
|
args.m = *m0;
|
||||||
args.inp = inp;
|
args.inp = inp;
|
||||||
@ -156,6 +171,17 @@ ipfw_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
|
|||||||
} else
|
} else
|
||||||
goto again; /* continue with packet */
|
goto again; /* continue with packet */
|
||||||
|
|
||||||
|
case IP_FW_NGTEE:
|
||||||
|
if (!NG_IPFW_LOADED)
|
||||||
|
goto drop;
|
||||||
|
(void)ng_ipfw_input_p(m0, NG_IPFW_IN, &args, 1);
|
||||||
|
goto again; /* continue with packet */
|
||||||
|
|
||||||
|
case IP_FW_NETGRAPH:
|
||||||
|
if (!NG_IPFW_LOADED)
|
||||||
|
goto drop;
|
||||||
|
return ng_ipfw_input_p(m0, NG_IPFW_IN, &args, 0);
|
||||||
|
|
||||||
default:
|
default:
|
||||||
KASSERT(0, ("%s: unknown retval", __func__));
|
KASSERT(0, ("%s: unknown retval", __func__));
|
||||||
}
|
}
|
||||||
@ -174,6 +200,7 @@ ipfw_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
|
|||||||
struct inpcb *inp)
|
struct inpcb *inp)
|
||||||
{
|
{
|
||||||
struct ip_fw_args args;
|
struct ip_fw_args args;
|
||||||
|
struct ng_ipfw_tag *ng_tag;
|
||||||
struct m_tag *dn_tag;
|
struct m_tag *dn_tag;
|
||||||
int ipfw = 0;
|
int ipfw = 0;
|
||||||
int divert;
|
int divert;
|
||||||
@ -199,6 +226,15 @@ ipfw_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
|
|||||||
m_tag_delete(*m0, dn_tag);
|
m_tag_delete(*m0, dn_tag);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
ng_tag = (struct ng_ipfw_tag *)m_tag_locate(*m0, NGM_IPFW_COOKIE, 0,
|
||||||
|
NULL);
|
||||||
|
if (ng_tag != NULL) {
|
||||||
|
KASSERT(ng_tag->dir == NG_IPFW_OUT,
|
||||||
|
("ng_ipfw tag with wrong direction"));
|
||||||
|
args.rule = ng_tag->rule;
|
||||||
|
m_tag_delete(*m0, (struct m_tag *)ng_tag);
|
||||||
|
}
|
||||||
|
|
||||||
again:
|
again:
|
||||||
args.m = *m0;
|
args.m = *m0;
|
||||||
args.oif = ifp;
|
args.oif = ifp;
|
||||||
@ -258,6 +294,17 @@ ipfw_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
|
|||||||
} else
|
} else
|
||||||
goto again; /* continue with packet */
|
goto again; /* continue with packet */
|
||||||
|
|
||||||
|
case IP_FW_NGTEE:
|
||||||
|
if (!NG_IPFW_LOADED)
|
||||||
|
goto drop;
|
||||||
|
(void)ng_ipfw_input_p(m0, NG_IPFW_OUT, &args, 1);
|
||||||
|
goto again; /* continue with packet */
|
||||||
|
|
||||||
|
case IP_FW_NETGRAPH:
|
||||||
|
if (!NG_IPFW_LOADED)
|
||||||
|
goto drop;
|
||||||
|
return ng_ipfw_input_p(m0, NG_IPFW_OUT, &args, 0);
|
||||||
|
|
||||||
default:
|
default:
|
||||||
KASSERT(0, ("%s: unknown retval", __func__));
|
KASSERT(0, ("%s: unknown retval", __func__));
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user