d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6c99c46bbb
freebsd-skq/sys/net/if_enc.c
bz 7a1c0b1ad1 Get closer to a VIMAGE network stack teardown from top to bottom rather 
than removing the network interfaces first. This change is rather larger
and convoluted as the ordering requirements cannot be separated.

Move the pfil(9) framework to SI_SUB_PROTO_PFIL, move Firewalls and
related modules to their own SI_SUB_PROTO_FIREWALL.
Move initialization of "physical" interfaces to SI_SUB_DRIVERS,
move virtual (cloned) interfaces to SI_SUB_PSEUDO.
Move Multicast to SI_SUB_PROTO_MC.

Re-work parts of multicast initialisation and teardown, not taking the
huge amount of memory into account if used as a module yet.

For interface teardown we try to do as many of them as we can on
SI_SUB_INIT_IF, but for some this makes no sense, e.g., when tunnelling
over a higher layer protocol such as IP. In that case the interface
has to go along (or before) the higher layer protocol is shutdown.

Kernel hhooks need to go last on teardown as they may be used at various
higher layers and we cannot remove them before we cleaned up the higher
layers.

For interface teardown there are multiple paths:
(a) a cloned interface is destroyed (inside a VIMAGE or in the base system),
(b) any interface is moved from a virtual network stack to a different
network stack ("vmove"), or (c) a virtual network stack is being shut down.
All code paths go through if_detach_internal() where we, depending on the
vmove flag or the vnet state, make a decision on how much to shut down;
in case we are destroying a VNET the individual protocol layers will
cleanup their own parts thus we cannot do so again for each interface as
we end up with, e.g., double-frees, destroying locks twice or acquiring
already destroyed locks.
When calling into protocol cleanups we equally have to tell them
whether they need to detach upper layer protocols ("ulp") or not
(e.g., in6_ifdetach()).

Provide or enahnce helper functions to do proper cleanup at a protocol
rather than at an interface level.

Approved by:		re (hrs)
Obtained from:		projects/vnet
Reviewed by:		gnn, jhb
Sponsored by:		The FreeBSD Foundation
MFC after:		2 weeks
Differential Revision:	https://reviews.freebsd.org/D6747
2016-06-21 13:48:49 +00:00

426 lines
11 KiB
C
Raw Blame History

/*-
* Copyright (c) 2006 The FreeBSD Project.
* Copyright (c) 2015 Andrey V. Elsukov <ae@FreeBSD.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* $FreeBSD$
*/
#include "opt_inet.h"
#include "opt_inet6.h"
#include <sys/param.h>
#include <sys/systm.h>
#include <sys/hhook.h>
#include <sys/kernel.h>
#include <sys/malloc.h>
#include <sys/mbuf.h>
#include <sys/module.h>
#include <machine/bus.h>
#include <sys/rman.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <sys/sysctl.h>
#include <net/if.h>
#include <net/if_enc.h>
#include <net/if_var.h>
#include <net/if_clone.h>
#include <net/if_types.h>
#include <net/pfil.h>
#include <net/route.h>
#include <net/netisr.h>
#include <net/bpf.h>
#include <net/vnet.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_var.h>
#include <netinet/in_var.h>
#ifdef INET6
#include <netinet/ip6.h>
#include <netinet6/ip6_var.h>
#endif
#include <netipsec/ipsec.h>
#include <netipsec/xform.h>
#define ENCMTU (1024+512)
/* XXX this define must have the same value as in OpenBSD */
#define M_CONF 0x0400 /* payload was encrypted (ESP-transport) */
#define M_AUTH 0x0800 /* payload was authenticated (AH or ESP auth) */
#define M_AUTH_AH 0x2000 /* header was authenticated (AH) */
struct enchdr {
u_int32_t af;
u_int32_t spi;
u_int32_t flags;
};
struct enc_softc {
struct ifnet *sc_ifp;
};
static VNET_DEFINE(struct enc_softc *, enc_sc);
#define V_enc_sc VNET(enc_sc)
static VNET_DEFINE(struct if_clone *, enc_cloner);
#define V_enc_cloner VNET(enc_cloner)
static int enc_ioctl(struct ifnet *, u_long, caddr_t);
static int enc_output(struct ifnet *, struct mbuf *,
const struct sockaddr *, struct route *);
static int enc_clone_create(struct if_clone *, int, caddr_t);
static void enc_clone_destroy(struct ifnet *);
static int enc_add_hhooks(struct enc_softc *);
static void enc_remove_hhooks(struct enc_softc *);
static const char encname[] = "enc";
/*
* Before and after are relative to when we are stripping the
* outer IP header.
*/
static VNET_DEFINE(int, filter_mask_in) = IPSEC_ENC_BEFORE;
static VNET_DEFINE(int, bpf_mask_in) = IPSEC_ENC_BEFORE;
static VNET_DEFINE(int, filter_mask_out) = IPSEC_ENC_BEFORE;
static VNET_DEFINE(int, bpf_mask_out) = IPSEC_ENC_BEFORE | IPSEC_ENC_AFTER;
#define V_filter_mask_in VNET(filter_mask_in)
#define V_bpf_mask_in VNET(bpf_mask_in)
#define V_filter_mask_out VNET(filter_mask_out)
#define V_bpf_mask_out VNET(bpf_mask_out)
static SYSCTL_NODE(_net, OID_AUTO, enc, CTLFLAG_RW, 0, "enc sysctl");
static SYSCTL_NODE(_net_enc, OID_AUTO, in, CTLFLAG_RW, 0, "enc input sysctl");
static SYSCTL_NODE(_net_enc, OID_AUTO, out, CTLFLAG_RW, 0, "enc output sysctl");
SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_filter_mask,
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_in), 0,
"IPsec input firewall filter mask");
SYSCTL_INT(_net_enc_in, OID_AUTO, ipsec_bpf_mask,
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_in), 0,
"IPsec input bpf mask");
SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_filter_mask,
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(filter_mask_out), 0,
"IPsec output firewall filter mask");
SYSCTL_INT(_net_enc_out, OID_AUTO, ipsec_bpf_mask,
CTLFLAG_RW | CTLFLAG_VNET, &VNET_NAME(bpf_mask_out), 0,
"IPsec output bpf mask");
static void
enc_clone_destroy(struct ifnet *ifp)
{
struct enc_softc *sc;
sc = ifp->if_softc;
KASSERT(sc == V_enc_sc, ("sc != ifp->if_softc"));
bpfdetach(ifp);
if_detach(ifp);
if_free(ifp);
free(sc, M_DEVBUF);
V_enc_sc = NULL;
}
static int
enc_clone_create(struct if_clone *ifc, int unit, caddr_t params)
{
struct ifnet *ifp;
struct enc_softc *sc;
sc = malloc(sizeof(struct enc_softc), M_DEVBUF,
M_WAITOK | M_ZERO);
ifp = sc->sc_ifp = if_alloc(IFT_ENC);
if (ifp == NULL) {
free(sc, M_DEVBUF);
return (ENOSPC);
}
if (V_enc_sc != NULL) {
if_free(ifp);
free(sc, M_DEVBUF);
return (EEXIST);
}
V_enc_sc = sc;
if_initname(ifp, encname, unit);
ifp->if_mtu = ENCMTU;
ifp->if_ioctl = enc_ioctl;
ifp->if_output = enc_output;
ifp->if_softc = sc;
if_attach(ifp);
bpfattach(ifp, DLT_ENC, sizeof(struct enchdr));
return (0);
}
static int
enc_output(struct ifnet *ifp, struct mbuf *m, const struct sockaddr *dst,
struct route *ro)
{
m_freem(m);
return (0);
}
static int
enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
{
if (cmd != SIOCSIFFLAGS)
return (EINVAL);
if (ifp->if_flags & IFF_UP)
ifp->if_drv_flags |= IFF_DRV_RUNNING;
else
ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
return (0);
}
/*
* One helper hook function is used by any hook points.
* + from hhook_type we can determine the packet direction:
* HHOOK_TYPE_IPSEC_IN or HHOOK_TYPE_IPSEC_OUT;
* + from hhook_id we can determine address family: AF_INET or AF_INET6;
* + udata contains pointer to enc_softc;
* + ctx_data contains pointer to struct ipsec_ctx_data.
*/
static int
enc_hhook(int32_t hhook_type, int32_t hhook_id, void *udata, void *ctx_data,
void *hdata, struct osd *hosd)
{
struct enchdr hdr;
struct ipsec_ctx_data *ctx;
struct enc_softc *sc;
struct ifnet *ifp, *rcvif;
struct pfil_head *ph;
int pdir;
sc = (struct enc_softc *)udata;
ifp = sc->sc_ifp;
if ((ifp->if_flags & IFF_UP) == 0)
return (0);
ctx = (struct ipsec_ctx_data *)ctx_data;
/* XXX: wrong hook point was used by caller? */
if (ctx->af != hhook_id)
return (EPFNOSUPPORT);
if (((hhook_type == HHOOK_TYPE_IPSEC_IN &&
(ctx->enc & V_bpf_mask_in) != 0) ||
(hhook_type == HHOOK_TYPE_IPSEC_OUT &&
(ctx->enc & V_bpf_mask_out) != 0)) &&
bpf_peers_present(ifp->if_bpf) != 0) {
hdr.af = ctx->af;
hdr.spi = ctx->sav->spi;
hdr.flags = 0;
if (ctx->sav->alg_enc != SADB_EALG_NONE)
hdr.flags |= M_CONF;
if (ctx->sav->alg_auth != SADB_AALG_NONE)
hdr.flags |= M_AUTH;
bpf_mtap2(ifp->if_bpf, &hdr, sizeof(hdr), *ctx->mp);
}
switch (hhook_type) {
case HHOOK_TYPE_IPSEC_IN:
if (ctx->enc == IPSEC_ENC_BEFORE) {
/* Do accounting only once */
if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
if_inc_counter(ifp, IFCOUNTER_IBYTES,
(*ctx->mp)->m_pkthdr.len);
}
if ((ctx->enc & V_filter_mask_in) == 0)
return (0); /* skip pfil processing */
pdir = PFIL_IN;
break;
case HHOOK_TYPE_IPSEC_OUT:
if (ctx->enc == IPSEC_ENC_BEFORE) {
/* Do accounting only once */
if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
if_inc_counter(ifp, IFCOUNTER_OBYTES,
(*ctx->mp)->m_pkthdr.len);
}
if ((ctx->enc & V_filter_mask_out) == 0)
return (0); /* skip pfil processing */
pdir = PFIL_OUT;
break;
default:
return (EINVAL);
}
switch (hhook_id) {
#ifdef INET
case AF_INET:
ph = &V_inet_pfil_hook;
break;
#endif
#ifdef INET6
case AF_INET6:
ph = &V_inet6_pfil_hook;
break;
#endif
default:
ph = NULL;
}
if (ph == NULL || !PFIL_HOOKED(ph))
return (0);
/* Make a packet looks like it was received on enc(4) */
rcvif = (*ctx->mp)->m_pkthdr.rcvif;
(*ctx->mp)->m_pkthdr.rcvif = ifp;
if (pfil_run_hooks(ph, ctx->mp, ifp, pdir, NULL) != 0 ||
*ctx->mp == NULL) {
*ctx->mp = NULL; /* consumed by filter */
return (EACCES);
}
(*ctx->mp)->m_pkthdr.rcvif = rcvif;
return (0);
}
static int
enc_add_hhooks(struct enc_softc *sc)
{
struct hookinfo hki;
int error;
error = EPFNOSUPPORT;
hki.hook_func = enc_hhook;
hki.hook_helper = NULL;
hki.hook_udata = sc;
#ifdef INET
hki.hook_id = AF_INET;
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET],
&hki, HHOOK_WAITOK);
if (error != 0)
return (error);
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET],
&hki, HHOOK_WAITOK);
if (error != 0)
return (error);
#endif
#ifdef INET6
hki.hook_id = AF_INET6;
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
error = hhook_add_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6],
&hki, HHOOK_WAITOK);
if (error != 0)
return (error);
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
error = hhook_add_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6],
&hki, HHOOK_WAITOK);
if (error != 0)
return (error);
#endif
return (error);
}
static void
enc_remove_hhooks(struct enc_softc *sc)
{
struct hookinfo hki;
hki.hook_func = enc_hhook;
hki.hook_helper = NULL;
hki.hook_udata = sc;
#ifdef INET
hki.hook_id = AF_INET;
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET], &hki);
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET], &hki);
#endif
#ifdef INET6
hki.hook_id = AF_INET6;
hki.hook_type = HHOOK_TYPE_IPSEC_IN;
hhook_remove_hook(V_ipsec_hhh_in[HHOOK_IPSEC_INET6], &hki);
hki.hook_type = HHOOK_TYPE_IPSEC_OUT;
hhook_remove_hook(V_ipsec_hhh_out[HHOOK_IPSEC_INET6], &hki);
#endif
}
static void
vnet_enc_init(const void *unused __unused)
{
V_enc_sc = NULL;
V_enc_cloner = if_clone_simple(encname, enc_clone_create,
enc_clone_destroy, 1);
}
VNET_SYSINIT(vnet_enc_init, SI_SUB_PSEUDO, SI_ORDER_ANY,
vnet_enc_init, NULL);
static void
vnet_enc_init_proto(void *unused __unused)
{
KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
if (enc_add_hhooks(V_enc_sc) != 0)
enc_clone_destroy(V_enc_sc->sc_ifp);
}
VNET_SYSINIT(vnet_enc_init_proto, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY,
vnet_enc_init_proto, NULL);
static void
vnet_enc_uninit(const void *unused __unused)
{
KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
if_clone_detach(V_enc_cloner);
}
VNET_SYSUNINIT(vnet_enc_uninit, SI_SUB_INIT_IF, SI_ORDER_ANY,
vnet_enc_uninit, NULL);
/*
* The hhook consumer needs to go before ip[6]_destroy are called on
* SI_ORDER_THIRD.
*/
static void
vnet_enc_uninit_hhook(const void *unused __unused)
{
KASSERT(V_enc_sc != NULL, ("%s: V_enc_sc is %p\n", __func__, V_enc_sc));
enc_remove_hhooks(V_enc_sc);
}
VNET_SYSUNINIT(vnet_enc_uninit_hhook, SI_SUB_PROTO_DOMAIN, SI_ORDER_FOURTH,
vnet_enc_uninit_hhook, NULL);
static int
enc_modevent(module_t mod, int type, void *data)
{
switch (type) {
case MOD_LOAD:
case MOD_UNLOAD:
break;
default:
return (EOPNOTSUPP);
}
return (0);
}
static moduledata_t enc_mod = {
"if_enc",
enc_modevent,
0
};
DECLARE_MODULE(if_enc, enc_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
Reference in New Issue View Git Blame Copy Permalink