| 1 | /* $NetBSD: pfil.c,v 1.20 2001/11/12 23:49:46 lukem Exp $ */ |
| 2 | /* $DragonFly: src/sys/net/pfil.c,v 1.10 2008/09/14 08:58:55 sephe Exp $ */ |
| 3 | |
| 4 | /* |
| 5 | * Copyright (c) 1996 Matthew R. Green |
| 6 | * All rights reserved. |
| 7 | * |
| 8 | * Redistribution and use in source and binary forms, with or without |
| 9 | * modification, are permitted provided that the following conditions |
| 10 | * are met: |
| 11 | * 1. Redistributions of source code must retain the above copyright |
| 12 | * notice, this list of conditions and the following disclaimer. |
| 13 | * 2. Redistributions in binary form must reproduce the above copyright |
| 14 | * notice, this list of conditions and the following disclaimer in the |
| 15 | * documentation and/or other materials provided with the distribution. |
| 16 | * 3. The name of the author may not be used to endorse or promote products |
| 17 | * derived from this software without specific prior written permission. |
| 18 | * |
| 19 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
| 20 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
| 21 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| 22 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
| 23 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, |
| 24 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
| 25 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED |
| 26 | * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, |
| 27 | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 28 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 29 | * SUCH DAMAGE. |
| 30 | */ |
| 31 | |
| 32 | #include <sys/param.h> |
| 33 | #include <sys/errno.h> |
| 34 | #include <sys/malloc.h> |
| 35 | #include <sys/socket.h> |
| 36 | #include <sys/socketvar.h> |
| 37 | #include <sys/systm.h> |
| 38 | #include <sys/proc.h> |
| 39 | #include <sys/queue.h> |
| 40 | |
| 41 | #include <net/if.h> |
| 42 | #include <net/pfil.h> |
| 43 | #include <net/netmsg2.h> |
| 44 | |
| 45 | #define PFIL_CFGPORT cpu_portfn(0) |
| 46 | |
| 47 | struct netmsg_pfil { |
| 48 | struct netmsg pfil_nmsg; |
| 49 | pfil_func_t pfil_func; |
| 50 | void *pfil_arg; |
| 51 | int pfil_flags; |
| 52 | struct pfil_head *pfil_ph; |
| 53 | }; |
| 54 | |
| 55 | static int pfil_list_add(struct pfil_head *, pfil_func_t, void *, int); |
| 56 | static int pfil_list_remove(struct pfil_head *, pfil_func_t, void *, int); |
| 57 | |
| 58 | LIST_HEAD(, pfil_head) pfil_head_list = |
| 59 | LIST_HEAD_INITIALIZER(&pfil_head_list); |
| 60 | |
| 61 | /* |
| 62 | * pfil_run_hooks() runs the specified packet filter hooks. |
| 63 | */ |
| 64 | int |
| 65 | pfil_run_hooks(struct pfil_head *ph, struct mbuf **mp, struct ifnet *ifp, |
| 66 | int dir) |
| 67 | { |
| 68 | struct packet_filter_hook *pfh; |
| 69 | struct mbuf *m = *mp; |
| 70 | pfil_list_t *list; |
| 71 | int rv = 0; |
| 72 | |
| 73 | if (dir == PFIL_IN) |
| 74 | list = &ph->ph_in; |
| 75 | else if (dir == PFIL_OUT) |
| 76 | list = &ph->ph_out; |
| 77 | else |
| 78 | return 0; /* XXX panic? */ |
| 79 | |
| 80 | TAILQ_FOREACH(pfh, list, pfil_link) { |
| 81 | if (pfh->pfil_func != NULL) { |
| 82 | rv = (*pfh->pfil_func)(pfh->pfil_arg, &m, ifp, dir); |
| 83 | if (rv != 0 || m == NULL) |
| 84 | break; |
| 85 | } |
| 86 | } |
| 87 | |
| 88 | *mp = m; |
| 89 | return (rv); |
| 90 | } |
| 91 | |
| 92 | /* |
| 93 | * pfil_head_register() registers a pfil_head with the packet filter |
| 94 | * hook mechanism. |
| 95 | */ |
| 96 | int |
| 97 | pfil_head_register(struct pfil_head *ph) |
| 98 | { |
| 99 | struct pfil_head *lph; |
| 100 | |
| 101 | LIST_FOREACH(lph, &pfil_head_list, ph_list) { |
| 102 | if (ph->ph_type == lph->ph_type && |
| 103 | ph->ph_un.phu_val == lph->ph_un.phu_val) |
| 104 | return EEXIST; |
| 105 | } |
| 106 | |
| 107 | TAILQ_INIT(&ph->ph_in); |
| 108 | TAILQ_INIT(&ph->ph_out); |
| 109 | ph->ph_hashooks = 0; |
| 110 | |
| 111 | LIST_INSERT_HEAD(&pfil_head_list, ph, ph_list); |
| 112 | |
| 113 | return (0); |
| 114 | } |
| 115 | |
| 116 | /* |
| 117 | * pfil_head_unregister() removes a pfil_head from the packet filter |
| 118 | * hook mechanism. |
| 119 | */ |
| 120 | int |
| 121 | pfil_head_unregister(struct pfil_head *pfh) |
| 122 | { |
| 123 | LIST_REMOVE(pfh, ph_list); |
| 124 | return (0); |
| 125 | } |
| 126 | |
| 127 | /* |
| 128 | * pfil_head_get() returns the pfil_head for a given key/dlt. |
| 129 | */ |
| 130 | struct pfil_head * |
| 131 | pfil_head_get(int type, u_long val) |
| 132 | { |
| 133 | struct pfil_head *ph; |
| 134 | |
| 135 | LIST_FOREACH(ph, &pfil_head_list, ph_list) { |
| 136 | if (ph->ph_type == type && ph->ph_un.phu_val == val) |
| 137 | break; |
| 138 | } |
| 139 | return (ph); |
| 140 | } |
| 141 | |
| 142 | static void |
| 143 | pfil_add_hook_dispatch(struct netmsg *nmsg) |
| 144 | { |
| 145 | struct netmsg_pfil *pfilmsg = (struct netmsg_pfil *)nmsg; |
| 146 | pfil_func_t func = pfilmsg->pfil_func; |
| 147 | void *arg = pfilmsg->pfil_arg; |
| 148 | int flags = pfilmsg->pfil_flags; |
| 149 | struct pfil_head *ph = pfilmsg->pfil_ph; |
| 150 | int err = 0; |
| 151 | |
| 152 | if (flags & PFIL_IN) { |
| 153 | err = pfil_list_add(ph, func, arg, flags & ~PFIL_OUT); |
| 154 | if (err) |
| 155 | goto reply; |
| 156 | } |
| 157 | if (flags & PFIL_OUT) { |
| 158 | err = pfil_list_add(ph, func, arg, flags & ~PFIL_IN); |
| 159 | if (err) { |
| 160 | if (flags & PFIL_IN) |
| 161 | pfil_list_remove(ph, func, arg, PFIL_IN); |
| 162 | } |
| 163 | } |
| 164 | reply: |
| 165 | lwkt_replymsg(&nmsg->nm_lmsg, err); |
| 166 | } |
| 167 | |
| 168 | /* |
| 169 | * pfil_add_hook() adds a function to the packet filter hook. the |
| 170 | * flags are: |
| 171 | * PFIL_IN call me on incoming packets |
| 172 | * PFIL_OUT call me on outgoing packets |
| 173 | * PFIL_ALL call me on all of the above |
| 174 | * PFIL_WAITOK OK to call kmalloc with M_WAITOK. |
| 175 | */ |
| 176 | int |
| 177 | pfil_add_hook(pfil_func_t func, void *arg, int flags, struct pfil_head *ph) |
| 178 | { |
| 179 | struct netmsg_pfil pfilmsg; |
| 180 | struct netmsg *nmsg; |
| 181 | |
| 182 | nmsg = &pfilmsg.pfil_nmsg; |
| 183 | netmsg_init(nmsg, &curthread->td_msgport, 0, pfil_add_hook_dispatch); |
| 184 | pfilmsg.pfil_func = func; |
| 185 | pfilmsg.pfil_arg = arg; |
| 186 | pfilmsg.pfil_flags = flags; |
| 187 | pfilmsg.pfil_ph = ph; |
| 188 | |
| 189 | return lwkt_domsg(PFIL_CFGPORT, &nmsg->nm_lmsg, 0); |
| 190 | } |
| 191 | |
| 192 | static int |
| 193 | pfil_list_add(struct pfil_head *ph, pfil_func_t func, void *arg, int flags) |
| 194 | { |
| 195 | struct packet_filter_hook *pfh; |
| 196 | pfil_list_t *list; |
| 197 | |
| 198 | KKASSERT(&curthread->td_msgport == PFIL_CFGPORT); |
| 199 | |
| 200 | list = (flags & PFIL_IN) ? &ph->ph_in : &ph->ph_out; |
| 201 | |
| 202 | /* |
| 203 | * First make sure the hook is not already there. |
| 204 | */ |
| 205 | TAILQ_FOREACH(pfh, list, pfil_link) { |
| 206 | if (pfh->pfil_func == func && pfh->pfil_arg == arg) |
| 207 | return EEXIST; |
| 208 | } |
| 209 | |
| 210 | pfh = (struct packet_filter_hook *)kmalloc(sizeof(*pfh), M_IFADDR, |
| 211 | (flags & PFIL_WAITOK) ? M_WAITOK : M_NOWAIT); |
| 212 | if (pfh == NULL) |
| 213 | return ENOMEM; |
| 214 | |
| 215 | pfh->pfil_func = func; |
| 216 | pfh->pfil_arg = arg; |
| 217 | |
| 218 | /* |
| 219 | * insert the input list in reverse order of the output list |
| 220 | * so that the same path is followed in or out of the kernel. |
| 221 | */ |
| 222 | if (flags & PFIL_IN) |
| 223 | TAILQ_INSERT_HEAD(list, pfh, pfil_link); |
| 224 | else |
| 225 | TAILQ_INSERT_TAIL(list, pfh, pfil_link); |
| 226 | ph->ph_hashooks = 1; |
| 227 | return (0); |
| 228 | } |
| 229 | |
| 230 | static void |
| 231 | pfil_remove_hook_dispatch(struct netmsg *nmsg) |
| 232 | { |
| 233 | struct netmsg_pfil *pfilmsg = (struct netmsg_pfil *)nmsg; |
| 234 | pfil_func_t func = pfilmsg->pfil_func; |
| 235 | void *arg = pfilmsg->pfil_arg; |
| 236 | int flags = pfilmsg->pfil_flags; |
| 237 | struct pfil_head *ph = pfilmsg->pfil_ph; |
| 238 | int err = 0; |
| 239 | |
| 240 | if (flags & PFIL_IN) |
| 241 | err = pfil_list_remove(ph, func, arg, PFIL_IN); |
| 242 | if ((err == 0) && (flags & PFIL_OUT)) |
| 243 | err = pfil_list_remove(ph, func, arg, PFIL_OUT); |
| 244 | lwkt_replymsg(&nmsg->nm_lmsg, err); |
| 245 | } |
| 246 | |
| 247 | /* |
| 248 | * pfil_remove_hook removes a specific function from the packet filter |
| 249 | * hook list. |
| 250 | */ |
| 251 | int |
| 252 | pfil_remove_hook(pfil_func_t func, void *arg, int flags, struct pfil_head *ph) |
| 253 | { |
| 254 | struct netmsg_pfil pfilmsg; |
| 255 | struct netmsg *nmsg; |
| 256 | |
| 257 | nmsg = &pfilmsg.pfil_nmsg; |
| 258 | netmsg_init(nmsg, &curthread->td_msgport, 0, pfil_remove_hook_dispatch); |
| 259 | pfilmsg.pfil_func = func; |
| 260 | pfilmsg.pfil_arg = arg; |
| 261 | pfilmsg.pfil_flags = flags; |
| 262 | pfilmsg.pfil_ph = ph; |
| 263 | |
| 264 | return lwkt_domsg(PFIL_CFGPORT, &nmsg->nm_lmsg, 0); |
| 265 | } |
| 266 | |
| 267 | /* |
| 268 | * pfil_list_remove is an internal function that takes a function off the |
| 269 | * specified list. Clear ph_hashooks if no functions remain on any list. |
| 270 | */ |
| 271 | static int |
| 272 | pfil_list_remove(struct pfil_head *ph, pfil_func_t func, void *arg, int flags) |
| 273 | { |
| 274 | struct packet_filter_hook *pfh; |
| 275 | pfil_list_t *list; |
| 276 | |
| 277 | KKASSERT(&curthread->td_msgport == PFIL_CFGPORT); |
| 278 | |
| 279 | list = (flags & PFIL_IN) ? &ph->ph_in : &ph->ph_out; |
| 280 | |
| 281 | TAILQ_FOREACH(pfh, list, pfil_link) { |
| 282 | if (pfh->pfil_func == func && pfh->pfil_arg == arg) { |
| 283 | TAILQ_REMOVE(list, pfh, pfil_link); |
| 284 | kfree(pfh, M_IFADDR); |
| 285 | if (TAILQ_EMPTY(&ph->ph_in) && TAILQ_EMPTY(&ph->ph_out)) |
| 286 | ph->ph_hashooks = 0; |
| 287 | return 0; |
| 288 | } |
| 289 | } |
| 290 | return ENOENT; |
| 291 | } |